The Design and Implementation of the FreeBSD Operating System, Second Edition
Now available: The Design and Implementation of the FreeBSD Operating System (Second Edition)


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]

FreeBSD/Linux Kernel Cross Reference
sys/netinet/tcp_input.c

Version: -  FREEBSD  -  FREEBSD-13-STABLE  -  FREEBSD-13-0  -  FREEBSD-12-STABLE  -  FREEBSD-12-0  -  FREEBSD-11-STABLE  -  FREEBSD-11-0  -  FREEBSD-10-STABLE  -  FREEBSD-10-0  -  FREEBSD-9-STABLE  -  FREEBSD-9-0  -  FREEBSD-8-STABLE  -  FREEBSD-8-0  -  FREEBSD-7-STABLE  -  FREEBSD-7-0  -  FREEBSD-6-STABLE  -  FREEBSD-6-0  -  FREEBSD-5-STABLE  -  FREEBSD-5-0  -  FREEBSD-4-STABLE  -  FREEBSD-3-STABLE  -  FREEBSD22  -  l41  -  OPENBSD  -  linux-2.6  -  MK84  -  PLAN9  -  xnu-8792 
SearchContext: -  none  -  3  -  10 

    1 /*      $NetBSD: tcp_input.c,v 1.291.4.5 2010/06/11 23:36:07 riz Exp $  */
    2 
    3 /*
    4  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
    5  * All rights reserved.
    6  *
    7  * Redistribution and use in source and binary forms, with or without
    8  * modification, are permitted provided that the following conditions
    9  * are met:
   10  * 1. Redistributions of source code must retain the above copyright
   11  *    notice, this list of conditions and the following disclaimer.
   12  * 2. Redistributions in binary form must reproduce the above copyright
   13  *    notice, this list of conditions and the following disclaimer in the
   14  *    documentation and/or other materials provided with the distribution.
   15  * 3. Neither the name of the project nor the names of its contributors
   16  *    may be used to endorse or promote products derived from this software
   17  *    without specific prior written permission.
   18  *
   19  * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
   20  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   21  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   22  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
   23  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   24  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   25  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   26  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   27  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   28  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   29  * SUCH DAMAGE.
   30  */
   31 
   32 /*
   33  *      @(#)COPYRIGHT   1.1 (NRL) 17 January 1995
   34  *
   35  * NRL grants permission for redistribution and use in source and binary
   36  * forms, with or without modification, of the software and documentation
   37  * created at NRL provided that the following conditions are met:
   38  *
   39  * 1. Redistributions of source code must retain the above copyright
   40  *    notice, this list of conditions and the following disclaimer.
   41  * 2. Redistributions in binary form must reproduce the above copyright
   42  *    notice, this list of conditions and the following disclaimer in the
   43  *    documentation and/or other materials provided with the distribution.
   44  * 3. All advertising materials mentioning features or use of this software
   45  *    must display the following acknowledgements:
   46  *      This product includes software developed by the University of
   47  *      California, Berkeley and its contributors.
   48  *      This product includes software developed at the Information
   49  *      Technology Division, US Naval Research Laboratory.
   50  * 4. Neither the name of the NRL nor the names of its contributors
   51  *    may be used to endorse or promote products derived from this software
   52  *    without specific prior written permission.
   53  *
   54  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
   55  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   56  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
   57  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
   58  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
   59  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
   60  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
   61  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
   62  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
   63  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
   64  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   65  *
   66  * The views and conclusions contained in the software and documentation
   67  * are those of the authors and should not be interpreted as representing
   68  * official policies, either expressed or implied, of the US Naval
   69  * Research Laboratory (NRL).
   70  */
   71 
   72 /*-
   73  * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006 The NetBSD Foundation, Inc.
   74  * All rights reserved.
   75  *
   76  * This code is derived from software contributed to The NetBSD Foundation
   77  * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
   78  * Facility, NASA Ames Research Center.
   79  * This code is derived from software contributed to The NetBSD Foundation
   80  * by Charles M. Hannum.
   81  * This code is derived from software contributed to The NetBSD Foundation
   82  * by Rui Paulo.
   83  *
   84  * Redistribution and use in source and binary forms, with or without
   85  * modification, are permitted provided that the following conditions
   86  * are met:
   87  * 1. Redistributions of source code must retain the above copyright
   88  *    notice, this list of conditions and the following disclaimer.
   89  * 2. Redistributions in binary form must reproduce the above copyright
   90  *    notice, this list of conditions and the following disclaimer in the
   91  *    documentation and/or other materials provided with the distribution.
   92  *
   93  * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
   94  * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   95  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
   96  * PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
   97  * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
   98  * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
   99  * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
  100  * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
  101  * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
  102  * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
  103  * POSSIBILITY OF SUCH DAMAGE.
  104  */
  105 
  106 /*
  107  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
  108  *      The Regents of the University of California.  All rights reserved.
  109  *
  110  * Redistribution and use in source and binary forms, with or without
  111  * modification, are permitted provided that the following conditions
  112  * are met:
  113  * 1. Redistributions of source code must retain the above copyright
  114  *    notice, this list of conditions and the following disclaimer.
  115  * 2. Redistributions in binary form must reproduce the above copyright
  116  *    notice, this list of conditions and the following disclaimer in the
  117  *    documentation and/or other materials provided with the distribution.
  118  * 3. Neither the name of the University nor the names of its contributors
  119  *    may be used to endorse or promote products derived from this software
  120  *    without specific prior written permission.
  121  *
  122  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  123  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  124  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  125  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  126  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  127  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  128  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  129  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  130  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  131  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  132  * SUCH DAMAGE.
  133  *
  134  *      @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
  135  */
  136 
  137 /*
  138  *      TODO list for SYN cache stuff:
  139  *
  140  *      Find room for a "state" field, which is needed to keep a
  141  *      compressed state for TIME_WAIT TCBs.  It's been noted already
  142  *      that this is fairly important for very high-volume web and
  143  *      mail servers, which use a large number of short-lived
  144  *      connections.
  145  */
  146 
  147 #include <sys/cdefs.h>
  148 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.291.4.5 2010/06/11 23:36:07 riz Exp $");
  149 
  150 #include "opt_inet.h"
  151 #include "opt_ipsec.h"
  152 #include "opt_inet_csum.h"
  153 #include "opt_tcp_debug.h"
  154 
  155 #include <sys/param.h>
  156 #include <sys/systm.h>
  157 #include <sys/malloc.h>
  158 #include <sys/mbuf.h>
  159 #include <sys/protosw.h>
  160 #include <sys/socket.h>
  161 #include <sys/socketvar.h>
  162 #include <sys/errno.h>
  163 #include <sys/syslog.h>
  164 #include <sys/pool.h>
  165 #include <sys/domain.h>
  166 #include <sys/kernel.h>
  167 #ifdef TCP_SIGNATURE
  168 #include <sys/md5.h>
  169 #endif
  170 #include <sys/lwp.h> /* for lwp0 */
  171 
  172 #include <net/if.h>
  173 #include <net/route.h>
  174 #include <net/if_types.h>
  175 
  176 #include <netinet/in.h>
  177 #include <netinet/in_systm.h>
  178 #include <netinet/ip.h>
  179 #include <netinet/in_pcb.h>
  180 #include <netinet/in_var.h>
  181 #include <netinet/ip_var.h>
  182 #include <netinet/in_offload.h>
  183 
  184 #ifdef INET6
  185 #ifndef INET
  186 #include <netinet/in.h>
  187 #endif
  188 #include <netinet/ip6.h>
  189 #include <netinet6/ip6_var.h>
  190 #include <netinet6/in6_pcb.h>
  191 #include <netinet6/ip6_var.h>
  192 #include <netinet6/in6_var.h>
  193 #include <netinet/icmp6.h>
  194 #include <netinet6/nd6.h>
  195 #ifdef TCP_SIGNATURE
  196 #include <netinet6/scope6_var.h>
  197 #endif
  198 #endif
  199 
  200 #ifndef INET6
  201 /* always need ip6.h for IP6_EXTHDR_GET */
  202 #include <netinet/ip6.h>
  203 #endif
  204 
  205 #include <netinet/tcp.h>
  206 #include <netinet/tcp_fsm.h>
  207 #include <netinet/tcp_seq.h>
  208 #include <netinet/tcp_timer.h>
  209 #include <netinet/tcp_var.h>
  210 #include <netinet/tcp_private.h>
  211 #include <netinet/tcpip.h>
  212 #include <netinet/tcp_congctl.h>
  213 #include <netinet/tcp_debug.h>
  214 
  215 #include <machine/stdarg.h>
  216 
  217 #ifdef IPSEC
  218 #include <netinet6/ipsec.h>
  219 #include <netinet6/ipsec_private.h>
  220 #include <netkey/key.h>
  221 #endif /*IPSEC*/
  222 #ifdef INET6
  223 #include "faith.h"
  224 #if defined(NFAITH) && NFAITH > 0
  225 #include <net/if_faith.h>
  226 #endif
  227 #endif  /* IPSEC */
  228 
  229 #ifdef FAST_IPSEC
  230 #include <netipsec/ipsec.h>
  231 #include <netipsec/ipsec_var.h>
  232 #include <netipsec/ipsec_private.h>
  233 #include <netipsec/key.h>
  234 #ifdef INET6
  235 #include <netipsec/ipsec6.h>
  236 #endif
  237 #endif  /* FAST_IPSEC*/
  238 
  239 int     tcprexmtthresh = 3;
  240 int     tcp_log_refused;
  241 
  242 int     tcp_do_autorcvbuf = 0;
  243 int     tcp_autorcvbuf_inc = 16 * 1024;
  244 int     tcp_autorcvbuf_max = 256 * 1024;
  245 int     tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
  246 
  247 static int tcp_rst_ppslim_count = 0;
  248 static struct timeval tcp_rst_ppslim_last;
  249 static int tcp_ackdrop_ppslim_count = 0;
  250 static struct timeval tcp_ackdrop_ppslim_last;
  251 
  252 #define TCP_PAWS_IDLE   (24U * 24 * 60 * 60 * PR_SLOWHZ)
  253 
  254 /* for modulo comparisons of timestamps */
  255 #define TSTMP_LT(a,b)   ((int)((a)-(b)) < 0)
  256 #define TSTMP_GEQ(a,b)  ((int)((a)-(b)) >= 0)
  257 
  258 /*
  259  * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
  260  */
  261 #ifdef INET6
  262 static inline void
  263 nd6_hint(struct tcpcb *tp)
  264 {
  265         struct rtentry *rt;
  266 
  267         if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
  268             (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
  269                 nd6_nud_hint(rt, NULL, 0);
  270 }
  271 #else
  272 static inline void
  273 nd6_hint(struct tcpcb *tp)
  274 {
  275 }
  276 #endif
  277 
  278 /*
  279  * Compute ACK transmission behavior.  Delay the ACK unless
  280  * we have already delayed an ACK (must send an ACK every two segments).
  281  * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
  282  * option is enabled.
  283  */
  284 static void
  285 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
  286 {
  287 
  288         if (tp->t_flags & TF_DELACK ||
  289             (tcp_ack_on_push && th->th_flags & TH_PUSH))
  290                 tp->t_flags |= TF_ACKNOW;
  291         else
  292                 TCP_SET_DELACK(tp);
  293 }
  294 
  295 static void
  296 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
  297 {
  298 
  299         /*
  300          * If we had a pending ICMP message that refers to data that have
  301          * just been acknowledged, disregard the recorded ICMP message.
  302          */
  303         if ((tp->t_flags & TF_PMTUD_PEND) &&
  304             SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
  305                 tp->t_flags &= ~TF_PMTUD_PEND;
  306 
  307         /*
  308          * Keep track of the largest chunk of data
  309          * acknowledged since last PMTU update
  310          */
  311         if (tp->t_pmtud_mss_acked < acked)
  312                 tp->t_pmtud_mss_acked = acked;
  313 }
  314 
  315 /*
  316  * Convert TCP protocol fields to host order for easier processing.
  317  */
  318 static void
  319 tcp_fields_to_host(struct tcphdr *th)
  320 {
  321 
  322         NTOHL(th->th_seq);
  323         NTOHL(th->th_ack);
  324         NTOHS(th->th_win);
  325         NTOHS(th->th_urp);
  326 }
  327 
  328 /*
  329  * ... and reverse the above.
  330  */
  331 static void
  332 tcp_fields_to_net(struct tcphdr *th)
  333 {
  334 
  335         HTONL(th->th_seq);
  336         HTONL(th->th_ack);
  337         HTONS(th->th_win);
  338         HTONS(th->th_urp);
  339 }
  340 
  341 #ifdef TCP_CSUM_COUNTERS
  342 #include <sys/device.h>
  343 
  344 #if defined(INET)
  345 extern struct evcnt tcp_hwcsum_ok;
  346 extern struct evcnt tcp_hwcsum_bad;
  347 extern struct evcnt tcp_hwcsum_data;
  348 extern struct evcnt tcp_swcsum;
  349 #endif /* defined(INET) */
  350 #if defined(INET6)
  351 extern struct evcnt tcp6_hwcsum_ok;
  352 extern struct evcnt tcp6_hwcsum_bad;
  353 extern struct evcnt tcp6_hwcsum_data;
  354 extern struct evcnt tcp6_swcsum;
  355 #endif /* defined(INET6) */
  356 
  357 #define TCP_CSUM_COUNTER_INCR(ev)       (ev)->ev_count++
  358 
  359 #else
  360 
  361 #define TCP_CSUM_COUNTER_INCR(ev)       /* nothing */
  362 
  363 #endif /* TCP_CSUM_COUNTERS */
  364 
  365 #ifdef TCP_REASS_COUNTERS
  366 #include <sys/device.h>
  367 
  368 extern struct evcnt tcp_reass_;
  369 extern struct evcnt tcp_reass_empty;
  370 extern struct evcnt tcp_reass_iteration[8];
  371 extern struct evcnt tcp_reass_prependfirst;
  372 extern struct evcnt tcp_reass_prepend;
  373 extern struct evcnt tcp_reass_insert;
  374 extern struct evcnt tcp_reass_inserttail;
  375 extern struct evcnt tcp_reass_append;
  376 extern struct evcnt tcp_reass_appendtail;
  377 extern struct evcnt tcp_reass_overlaptail;
  378 extern struct evcnt tcp_reass_overlapfront;
  379 extern struct evcnt tcp_reass_segdup;
  380 extern struct evcnt tcp_reass_fragdup;
  381 
  382 #define TCP_REASS_COUNTER_INCR(ev)      (ev)->ev_count++
  383 
  384 #else
  385 
  386 #define TCP_REASS_COUNTER_INCR(ev)      /* nothing */
  387 
  388 #endif /* TCP_REASS_COUNTERS */
  389 
  390 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
  391     int *);
  392 static int tcp_dooptions(struct tcpcb *, const u_char *, int,
  393     struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *);
  394 
  395 #ifdef INET
  396 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
  397 #endif
  398 #ifdef INET6
  399 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
  400 #endif
  401 
  402 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next
  403 
  404 #if defined(MBUFTRACE)
  405 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
  406 #endif /* defined(MBUFTRACE) */
  407 
  408 static POOL_INIT(tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
  409     NULL, IPL_VM);
  410 
  411 struct ipqent *
  412 tcpipqent_alloc(void)
  413 {
  414         struct ipqent *ipqe;
  415         int s;
  416 
  417         s = splvm();
  418         ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
  419         splx(s);
  420 
  421         return ipqe;
  422 }
  423 
  424 void
  425 tcpipqent_free(struct ipqent *ipqe)
  426 {
  427         int s;
  428 
  429         s = splvm();
  430         pool_put(&tcpipqent_pool, ipqe);
  431         splx(s);
  432 }
  433 
  434 static int
  435 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen)
  436 {
  437         struct ipqent *p, *q, *nq, *tiqe = NULL;
  438         struct socket *so = NULL;
  439         int pkt_flags;
  440         tcp_seq pkt_seq;
  441         unsigned pkt_len;
  442         u_long rcvpartdupbyte = 0;
  443         u_long rcvoobyte;
  444 #ifdef TCP_REASS_COUNTERS
  445         u_int count = 0;
  446 #endif
  447         uint64_t *tcps;
  448 
  449         if (tp->t_inpcb)
  450                 so = tp->t_inpcb->inp_socket;
  451 #ifdef INET6
  452         else if (tp->t_in6pcb)
  453                 so = tp->t_in6pcb->in6p_socket;
  454 #endif
  455 
  456         TCP_REASS_LOCK_CHECK(tp);
  457 
  458         /*
  459          * Call with th==0 after become established to
  460          * force pre-ESTABLISHED data up to user socket.
  461          */
  462         if (th == 0)
  463                 goto present;
  464 
  465         m_claimm(m, &tcp_reass_mowner);
  466 
  467         rcvoobyte = *tlen;
  468         /*
  469          * Copy these to local variables because the tcpiphdr
  470          * gets munged while we are collapsing mbufs.
  471          */
  472         pkt_seq = th->th_seq;
  473         pkt_len = *tlen;
  474         pkt_flags = th->th_flags;
  475 
  476         TCP_REASS_COUNTER_INCR(&tcp_reass_);
  477 
  478         if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
  479                 /*
  480                  * When we miss a packet, the vast majority of time we get
  481                  * packets that follow it in order.  So optimize for that.
  482                  */
  483                 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
  484                         p->ipqe_len += pkt_len;
  485                         p->ipqe_flags |= pkt_flags;
  486                         m_cat(p->ipre_mlast, m);
  487                         TRAVERSE(p->ipre_mlast);
  488                         m = NULL;
  489                         tiqe = p;
  490                         TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
  491                         TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
  492                         goto skip_replacement;
  493                 }
  494                 /*
  495                  * While we're here, if the pkt is completely beyond
  496                  * anything we have, just insert it at the tail.
  497                  */
  498                 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
  499                         TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
  500                         goto insert_it;
  501                 }
  502         }
  503 
  504         q = TAILQ_FIRST(&tp->segq);
  505 
  506         if (q != NULL) {
  507                 /*
  508                  * If this segment immediately precedes the first out-of-order
  509                  * block, simply slap the segment in front of it and (mostly)
  510                  * skip the complicated logic.
  511                  */
  512                 if (pkt_seq + pkt_len == q->ipqe_seq) {
  513                         q->ipqe_seq = pkt_seq;
  514                         q->ipqe_len += pkt_len;
  515                         q->ipqe_flags |= pkt_flags;
  516                         m_cat(m, q->ipqe_m);
  517                         q->ipqe_m = m;
  518                         q->ipre_mlast = m; /* last mbuf may have changed */
  519                         TRAVERSE(q->ipre_mlast);
  520                         tiqe = q;
  521                         TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
  522                         TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
  523                         goto skip_replacement;
  524                 }
  525         } else {
  526                 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
  527         }
  528 
  529         /*
  530          * Find a segment which begins after this one does.
  531          */
  532         for (p = NULL; q != NULL; q = nq) {
  533                 nq = TAILQ_NEXT(q, ipqe_q);
  534 #ifdef TCP_REASS_COUNTERS
  535                 count++;
  536 #endif
  537                 /*
  538                  * If the received segment is just right after this
  539                  * fragment, merge the two together and then check
  540                  * for further overlaps.
  541                  */
  542                 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
  543 #ifdef TCPREASS_DEBUG
  544                         printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
  545                                tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
  546                                q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
  547 #endif
  548                         pkt_len += q->ipqe_len;
  549                         pkt_flags |= q->ipqe_flags;
  550                         pkt_seq = q->ipqe_seq;
  551                         m_cat(q->ipre_mlast, m);
  552                         TRAVERSE(q->ipre_mlast);
  553                         m = q->ipqe_m;
  554                         TCP_REASS_COUNTER_INCR(&tcp_reass_append);
  555                         goto free_ipqe;
  556                 }
  557                 /*
  558                  * If the received segment is completely past this
  559                  * fragment, we need to go the next fragment.
  560                  */
  561                 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
  562                         p = q;
  563                         continue;
  564                 }
  565                 /*
  566                  * If the fragment is past the received segment,
  567                  * it (or any following) can't be concatenated.
  568                  */
  569                 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
  570                         TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
  571                         break;
  572                 }
  573 
  574                 /*
  575                  * We've received all the data in this segment before.
  576                  * mark it as a duplicate and return.
  577                  */
  578                 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
  579                     SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
  580                         tcps = TCP_STAT_GETREF();
  581                         tcps[TCP_STAT_RCVDUPPACK]++;
  582                         tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
  583                         TCP_STAT_PUTREF();
  584                         tcp_new_dsack(tp, pkt_seq, pkt_len);
  585                         m_freem(m);
  586                         if (tiqe != NULL) {
  587                                 tcpipqent_free(tiqe);
  588                         }
  589                         TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
  590                         return (0);
  591                 }
  592                 /*
  593                  * Received segment completely overlaps this fragment
  594                  * so we drop the fragment (this keeps the temporal
  595                  * ordering of segments correct).
  596                  */
  597                 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
  598                     SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
  599                         rcvpartdupbyte += q->ipqe_len;
  600                         m_freem(q->ipqe_m);
  601                         TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
  602                         goto free_ipqe;
  603                 }
  604                 /*
  605                  * RX'ed segment extends past the end of the
  606                  * fragment.  Drop the overlapping bytes.  Then
  607                  * merge the fragment and segment then treat as
  608                  * a longer received packet.
  609                  */
  610                 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
  611                     SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq))  {
  612                         int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
  613 #ifdef TCPREASS_DEBUG
  614                         printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
  615                                tp, overlap,
  616                                pkt_seq, pkt_seq + pkt_len, pkt_len);
  617 #endif
  618                         m_adj(m, overlap);
  619                         rcvpartdupbyte += overlap;
  620                         m_cat(q->ipre_mlast, m);
  621                         TRAVERSE(q->ipre_mlast);
  622                         m = q->ipqe_m;
  623                         pkt_seq = q->ipqe_seq;
  624                         pkt_len += q->ipqe_len - overlap;
  625                         rcvoobyte -= overlap;
  626                         TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
  627                         goto free_ipqe;
  628                 }
  629                 /*
  630                  * RX'ed segment extends past the front of the
  631                  * fragment.  Drop the overlapping bytes on the
  632                  * received packet.  The packet will then be
  633                  * contatentated with this fragment a bit later.
  634                  */
  635                 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
  636                     SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len))  {
  637                         int overlap = pkt_seq + pkt_len - q->ipqe_seq;
  638 #ifdef TCPREASS_DEBUG
  639                         printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
  640                                tp, overlap,
  641                                pkt_seq, pkt_seq + pkt_len, pkt_len);
  642 #endif
  643                         m_adj(m, -overlap);
  644                         pkt_len -= overlap;
  645                         rcvpartdupbyte += overlap;
  646                         TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
  647                         rcvoobyte -= overlap;
  648                 }
  649                 /*
  650                  * If the received segment immediates precedes this
  651                  * fragment then tack the fragment onto this segment
  652                  * and reinsert the data.
  653                  */
  654                 if (q->ipqe_seq == pkt_seq + pkt_len) {
  655 #ifdef TCPREASS_DEBUG
  656                         printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
  657                                tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
  658                                pkt_seq, pkt_seq + pkt_len, pkt_len);
  659 #endif
  660                         pkt_len += q->ipqe_len;
  661                         pkt_flags |= q->ipqe_flags;
  662                         m_cat(m, q->ipqe_m);
  663                         TAILQ_REMOVE(&tp->segq, q, ipqe_q);
  664                         TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
  665                         tp->t_segqlen--;
  666                         KASSERT(tp->t_segqlen >= 0);
  667                         KASSERT(tp->t_segqlen != 0 ||
  668                             (TAILQ_EMPTY(&tp->segq) &&
  669                             TAILQ_EMPTY(&tp->timeq)));
  670                         if (tiqe == NULL) {
  671                                 tiqe = q;
  672                         } else {
  673                                 tcpipqent_free(q);
  674                         }
  675                         TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
  676                         break;
  677                 }
  678                 /*
  679                  * If the fragment is before the segment, remember it.
  680                  * When this loop is terminated, p will contain the
  681                  * pointer to fragment that is right before the received
  682                  * segment.
  683                  */
  684                 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
  685                         p = q;
  686 
  687                 continue;
  688 
  689                 /*
  690                  * This is a common operation.  It also will allow
  691                  * to save doing a malloc/free in most instances.
  692                  */
  693           free_ipqe:
  694                 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
  695                 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
  696                 tp->t_segqlen--;
  697                 KASSERT(tp->t_segqlen >= 0);
  698                 KASSERT(tp->t_segqlen != 0 ||
  699                     (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
  700                 if (tiqe == NULL) {
  701                         tiqe = q;
  702                 } else {
  703                         tcpipqent_free(q);
  704                 }
  705         }
  706 
  707 #ifdef TCP_REASS_COUNTERS
  708         if (count > 7)
  709                 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
  710         else if (count > 0)
  711                 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
  712 #endif
  713 
  714     insert_it:
  715 
  716         /*
  717          * Allocate a new queue entry since the received segment did not
  718          * collapse onto any other out-of-order block; thus we are allocating
  719          * a new block.  If it had collapsed, tiqe would not be NULL and
  720          * we would be reusing it.
  721          * XXX If we can't, just drop the packet.  XXX
  722          */
  723         if (tiqe == NULL) {
  724                 tiqe = tcpipqent_alloc();
  725                 if (tiqe == NULL) {
  726                         TCP_STATINC(TCP_STAT_RCVMEMDROP);
  727                         m_freem(m);
  728                         return (0);
  729                 }
  730         }
  731 
  732         /*
  733          * Update the counters.
  734          */
  735         tcps = TCP_STAT_GETREF();
  736         tcps[TCP_STAT_RCVOOPACK]++;
  737         tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
  738         if (rcvpartdupbyte) {
  739             tcps[TCP_STAT_RCVPARTDUPPACK]++;
  740             tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
  741         }
  742         TCP_STAT_PUTREF();
  743 
  744         /*
  745          * Insert the new fragment queue entry into both queues.
  746          */
  747         tiqe->ipqe_m = m;
  748         tiqe->ipre_mlast = m;
  749         tiqe->ipqe_seq = pkt_seq;
  750         tiqe->ipqe_len = pkt_len;
  751         tiqe->ipqe_flags = pkt_flags;
  752         if (p == NULL) {
  753                 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
  754 #ifdef TCPREASS_DEBUG
  755                 if (tiqe->ipqe_seq != tp->rcv_nxt)
  756                         printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
  757                                tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
  758 #endif
  759         } else {
  760                 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
  761 #ifdef TCPREASS_DEBUG
  762                 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
  763                        tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
  764                        p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
  765 #endif
  766         }
  767         tp->t_segqlen++;
  768 
  769 skip_replacement:
  770 
  771         TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
  772 
  773 present:
  774         /*
  775          * Present data to user, advancing rcv_nxt through
  776          * completed sequence space.
  777          */
  778         if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
  779                 return (0);
  780         q = TAILQ_FIRST(&tp->segq);
  781         if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
  782                 return (0);
  783         if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
  784                 return (0);
  785 
  786         tp->rcv_nxt += q->ipqe_len;
  787         pkt_flags = q->ipqe_flags & TH_FIN;
  788         nd6_hint(tp);
  789 
  790         TAILQ_REMOVE(&tp->segq, q, ipqe_q);
  791         TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
  792         tp->t_segqlen--;
  793         KASSERT(tp->t_segqlen >= 0);
  794         KASSERT(tp->t_segqlen != 0 ||
  795             (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
  796         if (so->so_state & SS_CANTRCVMORE)
  797                 m_freem(q->ipqe_m);
  798         else
  799                 sbappendstream(&so->so_rcv, q->ipqe_m);
  800         tcpipqent_free(q);
  801         sorwakeup(so);
  802         return (pkt_flags);
  803 }
  804 
  805 #ifdef INET6
  806 int
  807 tcp6_input(struct mbuf **mp, int *offp, int proto)
  808 {
  809         struct mbuf *m = *mp;
  810 
  811         /*
  812          * draft-itojun-ipv6-tcp-to-anycast
  813          * better place to put this in?
  814          */
  815         if (m->m_flags & M_ANYCAST6) {
  816                 struct ip6_hdr *ip6;
  817                 if (m->m_len < sizeof(struct ip6_hdr)) {
  818                         if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
  819                                 TCP_STATINC(TCP_STAT_RCVSHORT);
  820                                 return IPPROTO_DONE;
  821                         }
  822                 }
  823                 ip6 = mtod(m, struct ip6_hdr *);
  824                 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
  825                     (char *)&ip6->ip6_dst - (char *)ip6);
  826                 return IPPROTO_DONE;
  827         }
  828 
  829         tcp_input(m, *offp, proto);
  830         return IPPROTO_DONE;
  831 }
  832 #endif
  833 
  834 #ifdef INET
  835 static void
  836 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
  837 {
  838         char src[4*sizeof "123"];
  839         char dst[4*sizeof "123"];
  840 
  841         if (ip) {
  842                 strlcpy(src, inet_ntoa(ip->ip_src), sizeof(src));
  843                 strlcpy(dst, inet_ntoa(ip->ip_dst), sizeof(dst));
  844         }
  845         else {
  846                 strlcpy(src, "(unknown)", sizeof(src));
  847                 strlcpy(dst, "(unknown)", sizeof(dst));
  848         }
  849         log(LOG_INFO,
  850             "Connection attempt to TCP %s:%d from %s:%d\n",
  851             dst, ntohs(th->th_dport),
  852             src, ntohs(th->th_sport));
  853 }
  854 #endif
  855 
  856 #ifdef INET6
  857 static void
  858 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
  859 {
  860         char src[INET6_ADDRSTRLEN];
  861         char dst[INET6_ADDRSTRLEN];
  862 
  863         if (ip6) {
  864                 strlcpy(src, ip6_sprintf(&ip6->ip6_src), sizeof(src));
  865                 strlcpy(dst, ip6_sprintf(&ip6->ip6_dst), sizeof(dst));
  866         }
  867         else {
  868                 strlcpy(src, "(unknown v6)", sizeof(src));
  869                 strlcpy(dst, "(unknown v6)", sizeof(dst));
  870         }
  871         log(LOG_INFO,
  872             "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
  873             dst, ntohs(th->th_dport),
  874             src, ntohs(th->th_sport));
  875 }
  876 #endif
  877 
  878 /*
  879  * Checksum extended TCP header and data.
  880  */
  881 int
  882 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
  883     int toff, int off, int tlen)
  884 {
  885 
  886         /*
  887          * XXX it's better to record and check if this mbuf is
  888          * already checked.
  889          */
  890 
  891         switch (af) {
  892 #ifdef INET
  893         case AF_INET:
  894                 switch (m->m_pkthdr.csum_flags &
  895                         ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
  896                          M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
  897                 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
  898                         TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
  899                         goto badcsum;
  900 
  901                 case M_CSUM_TCPv4|M_CSUM_DATA: {
  902                         u_int32_t hw_csum = m->m_pkthdr.csum_data;
  903 
  904                         TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
  905                         if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
  906                                 const struct ip *ip =
  907                                     mtod(m, const struct ip *);
  908 
  909                                 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
  910                                     ip->ip_dst.s_addr,
  911                                     htons(hw_csum + tlen + off + IPPROTO_TCP));
  912                         }
  913                         if ((hw_csum ^ 0xffff) != 0)
  914                                 goto badcsum;
  915                         break;
  916                 }
  917 
  918                 case M_CSUM_TCPv4:
  919                         /* Checksum was okay. */
  920                         TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
  921                         break;
  922 
  923                 default:
  924                         /*
  925                          * Must compute it ourselves.  Maybe skip checksum
  926                          * on loopback interfaces.
  927                          */
  928                         if (__predict_true(!(m->m_pkthdr.rcvif->if_flags &
  929                                              IFF_LOOPBACK) ||
  930                                            tcp_do_loopback_cksum)) {
  931                                 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
  932                                 if (in4_cksum(m, IPPROTO_TCP, toff,
  933                                               tlen + off) != 0)
  934                                         goto badcsum;
  935                         }
  936                         break;
  937                 }
  938                 break;
  939 #endif /* INET4 */
  940 
  941 #ifdef INET6
  942         case AF_INET6:
  943                 switch (m->m_pkthdr.csum_flags &
  944                         ((m->m_pkthdr.rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
  945                          M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
  946                 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
  947                         TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
  948                         goto badcsum;
  949 
  950 #if 0 /* notyet */
  951                 case M_CSUM_TCPv6|M_CSUM_DATA:
  952 #endif
  953 
  954                 case M_CSUM_TCPv6:
  955                         /* Checksum was okay. */
  956                         TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
  957                         break;
  958 
  959                 default:
  960                         /*
  961                          * Must compute it ourselves.  Maybe skip checksum
  962                          * on loopback interfaces.
  963                          */
  964                         if (__predict_true((m->m_flags & M_LOOP) == 0 ||
  965                             tcp_do_loopback_cksum)) {
  966                                 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
  967                                 if (in6_cksum(m, IPPROTO_TCP, toff,
  968                                     tlen + off) != 0)
  969                                         goto badcsum;
  970                         }
  971                 }
  972                 break;
  973 #endif /* INET6 */
  974         }
  975 
  976         return 0;
  977 
  978 badcsum:
  979         TCP_STATINC(TCP_STAT_RCVBADSUM);
  980         return -1;
  981 }
  982 
  983 /*
  984  * TCP input routine, follows pages 65-76 of RFC 793 very closely.
  985  */
  986 void
  987 tcp_input(struct mbuf *m, ...)
  988 {
  989         struct tcphdr *th;
  990         struct ip *ip;
  991         struct inpcb *inp;
  992 #ifdef INET6
  993         struct ip6_hdr *ip6;
  994         struct in6pcb *in6p;
  995 #endif
  996         u_int8_t *optp = NULL;
  997         int optlen = 0;
  998         int len, tlen, toff, hdroptlen = 0;
  999         struct tcpcb *tp = 0;
 1000         int tiflags;
 1001         struct socket *so = NULL;
 1002         int todrop, dupseg, acked, ourfinisacked, needoutput = 0;
 1003 #ifdef TCP_DEBUG
 1004         short ostate = 0;
 1005 #endif
 1006         u_long tiwin;
 1007         struct tcp_opt_info opti;
 1008         int off, iphlen;
 1009         va_list ap;
 1010         int af;         /* af on the wire */
 1011         struct mbuf *tcp_saveti = NULL;
 1012         uint32_t ts_rtt;
 1013         uint8_t iptos;
 1014         uint64_t *tcps;
 1015 
 1016         MCLAIM(m, &tcp_rx_mowner);
 1017         va_start(ap, m);
 1018         toff = va_arg(ap, int);
 1019         (void)va_arg(ap, int);          /* ignore value, advance ap */
 1020         va_end(ap);
 1021 
 1022         TCP_STATINC(TCP_STAT_RCVTOTAL);
 1023 
 1024         bzero(&opti, sizeof(opti));
 1025         opti.ts_present = 0;
 1026         opti.maxseg = 0;
 1027 
 1028         /*
 1029          * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
 1030          *
 1031          * TCP is, by definition, unicast, so we reject all
 1032          * multicast outright.
 1033          *
 1034          * Note, there are additional src/dst address checks in
 1035          * the AF-specific code below.
 1036          */
 1037         if (m->m_flags & (M_BCAST|M_MCAST)) {
 1038                 /* XXX stat */
 1039                 goto drop;
 1040         }
 1041 #ifdef INET6
 1042         if (m->m_flags & M_ANYCAST6) {
 1043                 /* XXX stat */
 1044                 goto drop;
 1045         }
 1046 #endif
 1047 
 1048         /*
 1049          * Get IP and TCP header.
 1050          * Note: IP leaves IP header in first mbuf.
 1051          */
 1052         ip = mtod(m, struct ip *);
 1053 #ifdef INET6
 1054         ip6 = NULL;
 1055 #endif
 1056         switch (ip->ip_v) {
 1057 #ifdef INET
 1058         case 4:
 1059                 af = AF_INET;
 1060                 iphlen = sizeof(struct ip);
 1061                 ip = mtod(m, struct ip *);
 1062                 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
 1063                         sizeof(struct tcphdr));
 1064                 if (th == NULL) {
 1065                         TCP_STATINC(TCP_STAT_RCVSHORT);
 1066                         return;
 1067                 }
 1068                 /* We do the checksum after PCB lookup... */
 1069                 len = ntohs(ip->ip_len);
 1070                 tlen = len - toff;
 1071                 iptos = ip->ip_tos;
 1072                 break;
 1073 #endif
 1074 #ifdef INET6
 1075         case 6:
 1076                 ip = NULL;
 1077                 iphlen = sizeof(struct ip6_hdr);
 1078                 af = AF_INET6;
 1079                 ip6 = mtod(m, struct ip6_hdr *);
 1080                 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
 1081                         sizeof(struct tcphdr));
 1082                 if (th == NULL) {
 1083                         TCP_STATINC(TCP_STAT_RCVSHORT);
 1084                         return;
 1085                 }
 1086 
 1087                 /* Be proactive about malicious use of IPv4 mapped address */
 1088                 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
 1089                     IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
 1090                         /* XXX stat */
 1091                         goto drop;
 1092                 }
 1093 
 1094                 /*
 1095                  * Be proactive about unspecified IPv6 address in source.
 1096                  * As we use all-zero to indicate unbounded/unconnected pcb,
 1097                  * unspecified IPv6 address can be used to confuse us.
 1098                  *
 1099                  * Note that packets with unspecified IPv6 destination is
 1100                  * already dropped in ip6_input.
 1101                  */
 1102                 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
 1103                         /* XXX stat */
 1104                         goto drop;
 1105                 }
 1106 
 1107                 /*
 1108                  * Make sure destination address is not multicast.
 1109                  * Source address checked in ip6_input().
 1110                  */
 1111                 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
 1112                         /* XXX stat */
 1113                         goto drop;
 1114                 }
 1115 
 1116                 /* We do the checksum after PCB lookup... */
 1117                 len = m->m_pkthdr.len;
 1118                 tlen = len - toff;
 1119                 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 1120                 break;
 1121 #endif
 1122         default:
 1123                 m_freem(m);
 1124                 return;
 1125         }
 1126 
 1127         KASSERT(TCP_HDR_ALIGNED_P(th));
 1128 
 1129         /*
 1130          * Check that TCP offset makes sense,
 1131          * pull out TCP options and adjust length.              XXX
 1132          */
 1133         off = th->th_off << 2;
 1134         if (off < sizeof (struct tcphdr) || off > tlen) {
 1135                 TCP_STATINC(TCP_STAT_RCVBADOFF);
 1136                 goto drop;
 1137         }
 1138         tlen -= off;
 1139 
 1140         /*
 1141          * tcp_input() has been modified to use tlen to mean the TCP data
 1142          * length throughout the function.  Other functions can use
 1143          * m->m_pkthdr.len as the basis for calculating the TCP data length.
 1144          * rja
 1145          */
 1146 
 1147         if (off > sizeof (struct tcphdr)) {
 1148                 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
 1149                 if (th == NULL) {
 1150                         TCP_STATINC(TCP_STAT_RCVSHORT);
 1151                         return;
 1152                 }
 1153                 /*
 1154                  * NOTE: ip/ip6 will not be affected by m_pulldown()
 1155                  * (as they're before toff) and we don't need to update those.
 1156                  */
 1157                 KASSERT(TCP_HDR_ALIGNED_P(th));
 1158                 optlen = off - sizeof (struct tcphdr);
 1159                 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
 1160                 /*
 1161                  * Do quick retrieval of timestamp options ("options
 1162                  * prediction?").  If timestamp is the only option and it's
 1163                  * formatted as recommended in RFC 1323 appendix A, we
 1164                  * quickly get the values now and not bother calling
 1165                  * tcp_dooptions(), etc.
 1166                  */
 1167                 if ((optlen == TCPOLEN_TSTAMP_APPA ||
 1168                      (optlen > TCPOLEN_TSTAMP_APPA &&
 1169                         optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
 1170                      *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
 1171                      (th->th_flags & TH_SYN) == 0) {
 1172                         opti.ts_present = 1;
 1173                         opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
 1174                         opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
 1175                         optp = NULL;    /* we've parsed the options */
 1176                 }
 1177         }
 1178         tiflags = th->th_flags;
 1179 
 1180         /*
 1181          * Locate pcb for segment.
 1182          */
 1183 findpcb:
 1184         inp = NULL;
 1185 #ifdef INET6
 1186         in6p = NULL;
 1187 #endif
 1188         switch (af) {
 1189 #ifdef INET
 1190         case AF_INET:
 1191                 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
 1192                     ip->ip_dst, th->th_dport);
 1193                 if (inp == 0) {
 1194                         TCP_STATINC(TCP_STAT_PCBHASHMISS);
 1195                         inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
 1196                 }
 1197 #ifdef INET6
 1198                 if (inp == 0) {
 1199                         struct in6_addr s, d;
 1200 
 1201                         /* mapped addr case */
 1202                         bzero(&s, sizeof(s));
 1203                         s.s6_addr16[5] = htons(0xffff);
 1204                         bcopy(&ip->ip_src, &s.s6_addr32[3], sizeof(ip->ip_src));
 1205                         bzero(&d, sizeof(d));
 1206                         d.s6_addr16[5] = htons(0xffff);
 1207                         bcopy(&ip->ip_dst, &d.s6_addr32[3], sizeof(ip->ip_dst));
 1208                         in6p = in6_pcblookup_connect(&tcbtable, &s,
 1209                             th->th_sport, &d, th->th_dport, 0);
 1210                         if (in6p == 0) {
 1211                                 TCP_STATINC(TCP_STAT_PCBHASHMISS);
 1212                                 in6p = in6_pcblookup_bind(&tcbtable, &d,
 1213                                     th->th_dport, 0);
 1214                         }
 1215                 }
 1216 #endif
 1217 #ifndef INET6
 1218                 if (inp == 0)
 1219 #else
 1220                 if (inp == 0 && in6p == 0)
 1221 #endif
 1222                 {
 1223                         TCP_STATINC(TCP_STAT_NOPORT);
 1224                         if (tcp_log_refused &&
 1225                             (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
 1226                                 tcp4_log_refused(ip, th);
 1227                         }
 1228                         tcp_fields_to_host(th);
 1229                         goto dropwithreset_ratelim;
 1230                 }
 1231 #if defined(IPSEC) || defined(FAST_IPSEC)
 1232                 if (inp && (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0 &&
 1233                     ipsec4_in_reject(m, inp)) {
 1234                         IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
 1235                         goto drop;
 1236                 }
 1237 #ifdef INET6
 1238                 else if (in6p &&
 1239                     (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 &&
 1240                     ipsec6_in_reject_so(m, in6p->in6p_socket)) {
 1241                         IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
 1242                         goto drop;
 1243                 }
 1244 #endif
 1245 #endif /*IPSEC*/
 1246                 break;
 1247 #endif /*INET*/
 1248 #ifdef INET6
 1249         case AF_INET6:
 1250             {
 1251                 int faith;
 1252 
 1253 #if defined(NFAITH) && NFAITH > 0
 1254                 faith = faithprefix(&ip6->ip6_dst);
 1255 #else
 1256                 faith = 0;
 1257 #endif
 1258                 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src,
 1259                     th->th_sport, &ip6->ip6_dst, th->th_dport, faith);
 1260                 if (in6p == NULL) {
 1261                         TCP_STATINC(TCP_STAT_PCBHASHMISS);
 1262                         in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst,
 1263                                 th->th_dport, faith);
 1264                 }
 1265                 if (in6p == NULL) {
 1266                         TCP_STATINC(TCP_STAT_NOPORT);
 1267                         if (tcp_log_refused &&
 1268                             (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
 1269                                 tcp6_log_refused(ip6, th);
 1270                         }
 1271                         tcp_fields_to_host(th);
 1272                         goto dropwithreset_ratelim;
 1273                 }
 1274 #if defined(IPSEC) || defined(FAST_IPSEC)
 1275                 if ((in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0 &&
 1276                     ipsec6_in_reject(m, in6p)) {
 1277                         IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
 1278                         goto drop;
 1279                 }
 1280 #endif /*IPSEC*/
 1281                 break;
 1282             }
 1283 #endif
 1284         }
 1285 
 1286         /*
 1287          * If the state is CLOSED (i.e., TCB does not exist) then
 1288          * all data in the incoming segment is discarded.
 1289          * If the TCB exists but is in CLOSED state, it is embryonic,
 1290          * but should either do a listen or a connect soon.
 1291          */
 1292         tp = NULL;
 1293         so = NULL;
 1294         if (inp) {
 1295                 tp = intotcpcb(inp);
 1296                 so = inp->inp_socket;
 1297         }
 1298 #ifdef INET6
 1299         else if (in6p) {
 1300                 tp = in6totcpcb(in6p);
 1301                 so = in6p->in6p_socket;
 1302         }
 1303 #endif
 1304         if (tp == 0) {
 1305                 tcp_fields_to_host(th);
 1306                 goto dropwithreset_ratelim;
 1307         }
 1308         if (tp->t_state == TCPS_CLOSED)
 1309                 goto drop;
 1310 
 1311         KASSERT(so->so_lock == softnet_lock);
 1312         KASSERT(solocked(so));
 1313 
 1314         /*
 1315          * Checksum extended TCP header and data.
 1316          */
 1317         if (tcp_input_checksum(af, m, th, toff, off, tlen))
 1318                 goto badcsum;
 1319 
 1320         tcp_fields_to_host(th);
 1321 
 1322         /* Unscale the window into a 32-bit value. */
 1323         if ((tiflags & TH_SYN) == 0)
 1324                 tiwin = th->th_win << tp->snd_scale;
 1325         else
 1326                 tiwin = th->th_win;
 1327 
 1328 #ifdef INET6
 1329         /* save packet options if user wanted */
 1330         if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
 1331                 if (in6p->in6p_options) {
 1332                         m_freem(in6p->in6p_options);
 1333                         in6p->in6p_options = 0;
 1334                 }
 1335                 KASSERT(ip6 != NULL);
 1336                 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
 1337         }
 1338 #endif
 1339 
 1340         if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
 1341                 union syn_cache_sa src;
 1342                 union syn_cache_sa dst;
 1343 
 1344                 bzero(&src, sizeof(src));
 1345                 bzero(&dst, sizeof(dst));
 1346                 switch (af) {
 1347 #ifdef INET
 1348                 case AF_INET:
 1349                         src.sin.sin_len = sizeof(struct sockaddr_in);
 1350                         src.sin.sin_family = AF_INET;
 1351                         src.sin.sin_addr = ip->ip_src;
 1352                         src.sin.sin_port = th->th_sport;
 1353 
 1354                         dst.sin.sin_len = sizeof(struct sockaddr_in);
 1355                         dst.sin.sin_family = AF_INET;
 1356                         dst.sin.sin_addr = ip->ip_dst;
 1357                         dst.sin.sin_port = th->th_dport;
 1358                         break;
 1359 #endif
 1360 #ifdef INET6
 1361                 case AF_INET6:
 1362                         src.sin6.sin6_len = sizeof(struct sockaddr_in6);
 1363                         src.sin6.sin6_family = AF_INET6;
 1364                         src.sin6.sin6_addr = ip6->ip6_src;
 1365                         src.sin6.sin6_port = th->th_sport;
 1366 
 1367                         dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
 1368                         dst.sin6.sin6_family = AF_INET6;
 1369                         dst.sin6.sin6_addr = ip6->ip6_dst;
 1370                         dst.sin6.sin6_port = th->th_dport;
 1371                         break;
 1372 #endif /* INET6 */
 1373                 default:
 1374                         goto badsyn;    /*sanity*/
 1375                 }
 1376 
 1377                 if (so->so_options & SO_DEBUG) {
 1378 #ifdef TCP_DEBUG
 1379                         ostate = tp->t_state;
 1380 #endif
 1381 
 1382                         tcp_saveti = NULL;
 1383                         if (iphlen + sizeof(struct tcphdr) > MHLEN)
 1384                                 goto nosave;
 1385 
 1386                         if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
 1387                                 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
 1388                                 if (!tcp_saveti)
 1389                                         goto nosave;
 1390                         } else {
 1391                                 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
 1392                                 if (!tcp_saveti)
 1393                                         goto nosave;
 1394                                 MCLAIM(m, &tcp_mowner);
 1395                                 tcp_saveti->m_len = iphlen;
 1396                                 m_copydata(m, 0, iphlen,
 1397                                     mtod(tcp_saveti, void *));
 1398                         }
 1399 
 1400                         if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
 1401                                 m_freem(tcp_saveti);
 1402                                 tcp_saveti = NULL;
 1403                         } else {
 1404                                 tcp_saveti->m_len += sizeof(struct tcphdr);
 1405                                 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
 1406                                     sizeof(struct tcphdr));
 1407                         }
 1408         nosave:;
 1409                 }
 1410                 if (so->so_options & SO_ACCEPTCONN) {
 1411                         if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
 1412                                 if (tiflags & TH_RST) {
 1413                                         syn_cache_reset(&src.sa, &dst.sa, th);
 1414                                 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
 1415                                     (TH_ACK|TH_SYN)) {
 1416                                         /*
 1417                                          * Received a SYN,ACK.  This should
 1418                                          * never happen while we are in
 1419                                          * LISTEN.  Send an RST.
 1420                                          */
 1421                                         goto badsyn;
 1422                                 } else if (tiflags & TH_ACK) {
 1423                                         so = syn_cache_get(&src.sa, &dst.sa,
 1424                                                 th, toff, tlen, so, m);
 1425                                         if (so == NULL) {
 1426                                                 /*
 1427                                                  * We don't have a SYN for
 1428                                                  * this ACK; send an RST.
 1429                                                  */
 1430                                                 goto badsyn;
 1431                                         } else if (so ==
 1432                                             (struct socket *)(-1)) {
 1433                                                 /*
 1434                                                  * We were unable to create
 1435                                                  * the connection.  If the
 1436                                                  * 3-way handshake was
 1437                                                  * completed, and RST has
 1438                                                  * been sent to the peer.
 1439                                                  * Since the mbuf might be
 1440                                                  * in use for the reply,
 1441                                                  * do not free it.
 1442                                                  */
 1443                                                 m = NULL;
 1444                                         } else {
 1445                                                 /*
 1446                                                  * We have created a
 1447                                                  * full-blown connection.
 1448                                                  */
 1449                                                 tp = NULL;
 1450                                                 inp = NULL;
 1451 #ifdef INET6
 1452                                                 in6p = NULL;
 1453 #endif
 1454                                                 switch (so->so_proto->pr_domain->dom_family) {
 1455 #ifdef INET
 1456                                                 case AF_INET:
 1457                                                         inp = sotoinpcb(so);
 1458                                                         tp = intotcpcb(inp);
 1459                                                         break;
 1460 #endif
 1461 #ifdef INET6
 1462                                                 case AF_INET6:
 1463                                                         in6p = sotoin6pcb(so);
 1464                                                         tp = in6totcpcb(in6p);
 1465                                                         break;
 1466 #endif
 1467                                                 }
 1468                                                 if (tp == NULL)
 1469                                                         goto badsyn;    /*XXX*/
 1470                                                 tiwin <<= tp->snd_scale;
 1471                                                 goto after_listen;
 1472                                         }
 1473                                 } else {
 1474                                         /*
 1475                                          * None of RST, SYN or ACK was set.
 1476                                          * This is an invalid packet for a
 1477                                          * TCB in LISTEN state.  Send a RST.
 1478                                          */
 1479                                         goto badsyn;
 1480                                 }
 1481                         } else {
 1482                                 /*
 1483                                  * Received a SYN.
 1484                                  *
 1485                                  * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
 1486                                  */
 1487                                 if (m->m_flags & (M_BCAST|M_MCAST))
 1488                                         goto drop;
 1489 
 1490                                 switch (af) {
 1491 #ifdef INET6
 1492                                 case AF_INET6:
 1493                                         if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
 1494                                                 goto drop;
 1495                                         break;
 1496 #endif /* INET6 */
 1497                                 case AF_INET:
 1498                                         if (IN_MULTICAST(ip->ip_dst.s_addr) ||
 1499                                             in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
 1500                                                 goto drop;
 1501                                 break;
 1502                                 }
 1503 
 1504 #ifdef INET6
 1505                                 /*
 1506                                  * If deprecated address is forbidden, we do
 1507                                  * not accept SYN to deprecated interface
 1508                                  * address to prevent any new inbound
 1509                                  * connection from getting established.
 1510                                  * When we do not accept SYN, we send a TCP
 1511                                  * RST, with deprecated source address (instead
 1512                                  * of dropping it).  We compromise it as it is
 1513                                  * much better for peer to send a RST, and
 1514                                  * RST will be the final packet for the
 1515                                  * exchange.
 1516                                  *
 1517                                  * If we do not forbid deprecated addresses, we
 1518                                  * accept the SYN packet.  RFC2462 does not
 1519                                  * suggest dropping SYN in this case.
 1520                                  * If we decipher RFC2462 5.5.4, it says like
 1521                                  * this:
 1522                                  * 1. use of deprecated addr with existing
 1523                                  *    communication is okay - "SHOULD continue
 1524                                  *    to be used"
 1525                                  * 2. use of it with new communication:
 1526                                  *   (2a) "SHOULD NOT be used if alternate
 1527                                  *        address with sufficient scope is
 1528                                  *        available"
 1529                                  *   (2b) nothing mentioned otherwise.
 1530                                  * Here we fall into (2b) case as we have no
 1531                                  * choice in our source address selection - we
 1532                                  * must obey the peer.
 1533                                  *
 1534                                  * The wording in RFC2462 is confusing, and
 1535                                  * there are multiple description text for
 1536                                  * deprecated address handling - worse, they
 1537                                  * are not exactly the same.  I believe 5.5.4
 1538                                  * is the best one, so we follow 5.5.4.
 1539                                  */
 1540                                 if (af == AF_INET6 && !ip6_use_deprecated) {
 1541                                         struct in6_ifaddr *ia6;
 1542                                         if ((ia6 = in6ifa_ifpwithaddr(m->m_pkthdr.rcvif,
 1543                                             &ip6->ip6_dst)) &&
 1544                                             (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
 1545                                                 tp = NULL;
 1546                                                 goto dropwithreset;
 1547                                         }
 1548                                 }
 1549 #endif
 1550 
 1551 #if defined(IPSEC) || defined(FAST_IPSEC)
 1552                                 switch (af) {
 1553 #ifdef INET
 1554                                 case AF_INET:
 1555                                         if (ipsec4_in_reject_so(m, so)) {
 1556                                                 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
 1557                                                 tp = NULL;
 1558                                                 goto dropwithreset;
 1559                                         }
 1560                                         break;
 1561 #endif
 1562 #ifdef INET6
 1563                                 case AF_INET6:
 1564                                         if (ipsec6_in_reject_so(m, so)) {
 1565                                                 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
 1566                                                 tp = NULL;
 1567                                                 goto dropwithreset;
 1568                                         }
 1569                                         break;
 1570 #endif /*INET6*/
 1571                                 }
 1572 #endif /*IPSEC*/
 1573 
 1574                                 /*
 1575                                  * LISTEN socket received a SYN
 1576                                  * from itself?  This can't possibly
 1577                                  * be valid; drop the packet.
 1578                                  */
 1579                                 if (th->th_sport == th->th_dport) {
 1580                                         int i;
 1581 
 1582                                         switch (af) {
 1583 #ifdef INET
 1584                                         case AF_INET:
 1585                                                 i = in_hosteq(ip->ip_src, ip->ip_dst);
 1586                                                 break;
 1587 #endif
 1588 #ifdef INET6
 1589                                         case AF_INET6:
 1590                                                 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
 1591                                                 break;
 1592 #endif
 1593                                         default:
 1594                                                 i = 1;
 1595                                         }
 1596                                         if (i) {
 1597                                                 TCP_STATINC(TCP_STAT_BADSYN);
 1598                                                 goto drop;
 1599                                         }
 1600                                 }
 1601 
 1602                                 /*
 1603                                  * SYN looks ok; create compressed TCP
 1604                                  * state for it.
 1605                                  */
 1606                                 if (so->so_qlen <= so->so_qlimit &&
 1607                                     syn_cache_add(&src.sa, &dst.sa, th, tlen,
 1608                                                 so, m, optp, optlen, &opti))
 1609                                         m = NULL;
 1610                         }
 1611                         goto drop;
 1612                 }
 1613         }
 1614 
 1615 after_listen:
 1616 #ifdef DIAGNOSTIC
 1617         /*
 1618          * Should not happen now that all embryonic connections
 1619          * are handled with compressed state.
 1620          */
 1621         if (tp->t_state == TCPS_LISTEN)
 1622                 panic("tcp_input: TCPS_LISTEN");
 1623 #endif
 1624 
 1625         /*
 1626          * Segment received on connection.
 1627          * Reset idle time and keep-alive timer.
 1628          */
 1629         tp->t_rcvtime = tcp_now;
 1630         if (TCPS_HAVEESTABLISHED(tp->t_state))
 1631                 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
 1632 
 1633         /*
 1634          * Process options.
 1635          */
 1636 #ifdef TCP_SIGNATURE
 1637         if (optp || (tp->t_flags & TF_SIGNATURE))
 1638 #else
 1639         if (optp)
 1640 #endif
 1641                 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0)
 1642                         goto drop;
 1643 
 1644         if (TCP_SACK_ENABLED(tp)) {
 1645                 tcp_del_sackholes(tp, th);
 1646         }
 1647 
 1648         if (TCP_ECN_ALLOWED(tp)) {
 1649                 switch (iptos & IPTOS_ECN_MASK) {
 1650                 case IPTOS_ECN_CE:
 1651                         tp->t_flags |= TF_ECN_SND_ECE;
 1652                         TCP_STATINC(TCP_STAT_ECN_CE);
 1653                         break;
 1654                 case IPTOS_ECN_ECT0:
 1655                         TCP_STATINC(TCP_STAT_ECN_ECT);
 1656                         break;
 1657                 case IPTOS_ECN_ECT1:
 1658                         /* XXX: ignore for now -- rpaulo */
 1659                         break;
 1660                 }
 1661 
 1662                 if (tiflags & TH_CWR)
 1663                         tp->t_flags &= ~TF_ECN_SND_ECE;
 1664 
 1665                 /*
 1666                  * Congestion experienced.
 1667                  * Ignore if we are already trying to recover.
 1668                  */
 1669                 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
 1670                         tp->t_congctl->cong_exp(tp);
 1671         }
 1672 
 1673         if (opti.ts_present && opti.ts_ecr) {
 1674                 /*
 1675                  * Calculate the RTT from the returned time stamp and the
 1676                  * connection's time base.  If the time stamp is later than
 1677                  * the current time, or is extremely old, fall back to non-1323
 1678                  * RTT calculation.  Since ts_ecr is unsigned, we can test both
 1679                  * at the same time.
 1680                  */
 1681                 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
 1682                 if (ts_rtt > TCP_PAWS_IDLE)
 1683                         ts_rtt = 0;
 1684         } else {
 1685                 ts_rtt = 0;
 1686         }
 1687 
 1688         /*
 1689          * Header prediction: check for the two common cases
 1690          * of a uni-directional data xfer.  If the packet has
 1691          * no control flags, is in-sequence, the window didn't
 1692          * change and we're not retransmitting, it's a
 1693          * candidate.  If the length is zero and the ack moved
 1694          * forward, we're the sender side of the xfer.  Just
 1695          * free the data acked & wake any higher level process
 1696          * that was blocked waiting for space.  If the length
 1697          * is non-zero and the ack didn't move, we're the
 1698          * receiver side.  If we're getting packets in-order
 1699          * (the reassembly queue is empty), add the data to
 1700          * the socket buffer and note that we need a delayed ack.
 1701          */
 1702         if (tp->t_state == TCPS_ESTABLISHED &&
 1703             (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
 1704                 == TH_ACK &&
 1705             (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
 1706             th->th_seq == tp->rcv_nxt &&
 1707             tiwin && tiwin == tp->snd_wnd &&
 1708             tp->snd_nxt == tp->snd_max) {
 1709 
 1710                 /*
 1711                  * If last ACK falls within this segment's sequence numbers,
 1712                  * record the timestamp.
 1713                  * NOTE that the test is modified according to the latest
 1714                  * proposal of the tcplw@cray.com list (Braden 1993/04/26).
 1715                  *
 1716                  * note that we already know
 1717                  *      TSTMP_GEQ(opti.ts_val, tp->ts_recent)
 1718                  */
 1719                 if (opti.ts_present &&
 1720                     SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
 1721                         tp->ts_recent_age = tcp_now;
 1722                         tp->ts_recent = opti.ts_val;
 1723                 }
 1724 
 1725                 if (tlen == 0) {
 1726                         /* Ack prediction. */
 1727                         if (SEQ_GT(th->th_ack, tp->snd_una) &&
 1728                             SEQ_LEQ(th->th_ack, tp->snd_max) &&
 1729                             tp->snd_cwnd >= tp->snd_wnd &&
 1730                             tp->t_partialacks < 0) {
 1731                                 /*
 1732                                  * this is a pure ack for outstanding data.
 1733                                  */
 1734                                 if (ts_rtt)
 1735                                         tcp_xmit_timer(tp, ts_rtt);
 1736                                 else if (tp->t_rtttime &&
 1737                                     SEQ_GT(th->th_ack, tp->t_rtseq))
 1738                                         tcp_xmit_timer(tp,
 1739                                           tcp_now - tp->t_rtttime);
 1740                                 acked = th->th_ack - tp->snd_una;
 1741                                 tcps = TCP_STAT_GETREF();
 1742                                 tcps[TCP_STAT_PREDACK]++;
 1743                                 tcps[TCP_STAT_RCVACKPACK]++;
 1744                                 tcps[TCP_STAT_RCVACKBYTE] += acked;
 1745                                 TCP_STAT_PUTREF();
 1746                                 nd6_hint(tp);
 1747 
 1748                                 if (acked > (tp->t_lastoff - tp->t_inoff))
 1749                                         tp->t_lastm = NULL;
 1750                                 sbdrop(&so->so_snd, acked);
 1751                                 tp->t_lastoff -= acked;
 1752 
 1753                                 icmp_check(tp, th, acked);
 1754 
 1755                                 tp->snd_una = th->th_ack;
 1756                                 tp->snd_fack = tp->snd_una;
 1757                                 if (SEQ_LT(tp->snd_high, tp->snd_una))
 1758                                         tp->snd_high = tp->snd_una;
 1759                                 m_freem(m);
 1760 
 1761                                 /*
 1762                                  * If all outstanding data are acked, stop
 1763                                  * retransmit timer, otherwise restart timer
 1764                                  * using current (possibly backed-off) value.
 1765                                  * If process is waiting for space,
 1766                                  * wakeup/selnotify/signal.  If data
 1767                                  * are ready to send, let tcp_output
 1768                                  * decide between more output or persist.
 1769                                  */
 1770                                 if (tp->snd_una == tp->snd_max)
 1771                                         TCP_TIMER_DISARM(tp, TCPT_REXMT);
 1772                                 else if (TCP_TIMER_ISARMED(tp,
 1773                                     TCPT_PERSIST) == 0)
 1774                                         TCP_TIMER_ARM(tp, TCPT_REXMT,
 1775                                             tp->t_rxtcur);
 1776 
 1777                                 sowwakeup(so);
 1778                                 if (so->so_snd.sb_cc)
 1779                                         (void) tcp_output(tp);
 1780                                 if (tcp_saveti)
 1781                                         m_freem(tcp_saveti);
 1782                                 return;
 1783                         }
 1784                 } else if (th->th_ack == tp->snd_una &&
 1785                     TAILQ_FIRST(&tp->segq) == NULL &&
 1786                     tlen <= sbspace(&so->so_rcv)) {
 1787                         int newsize = 0;        /* automatic sockbuf scaling */
 1788 
 1789                         /*
 1790                          * this is a pure, in-sequence data packet
 1791                          * with nothing on the reassembly queue and
 1792                          * we have enough buffer space to take it.
 1793                          */
 1794                         tp->rcv_nxt += tlen;
 1795                         tcps = TCP_STAT_GETREF();
 1796                         tcps[TCP_STAT_PREDDAT]++;
 1797                         tcps[TCP_STAT_RCVPACK]++;
 1798                         tcps[TCP_STAT_RCVBYTE] += tlen;
 1799                         TCP_STAT_PUTREF();
 1800                         nd6_hint(tp);
 1801 
 1802                 /*
 1803                  * Automatic sizing enables the performance of large buffers
 1804                  * and most of the efficiency of small ones by only allocating
 1805                  * space when it is needed.
 1806                  *
 1807                  * On the receive side the socket buffer memory is only rarely
 1808                  * used to any significant extent.  This allows us to be much
 1809                  * more aggressive in scaling the receive socket buffer.  For
 1810                  * the case that the buffer space is actually used to a large
 1811                  * extent and we run out of kernel memory we can simply drop
 1812                  * the new segments; TCP on the sender will just retransmit it
 1813                  * later.  Setting the buffer size too big may only consume too
 1814                  * much kernel memory if the application doesn't read() from
 1815                  * the socket or packet loss or reordering makes use of the
 1816                  * reassembly queue.
 1817                  *
 1818                  * The criteria to step up the receive buffer one notch are:
 1819                  *  1. the number of bytes received during the time it takes
 1820                  *     one timestamp to be reflected back to us (the RTT);
 1821                  *  2. received bytes per RTT is within seven eighth of the
 1822                  *     current socket buffer size;
 1823                  *  3. receive buffer size has not hit maximal automatic size;
 1824                  *
 1825                  * This algorithm does one step per RTT at most and only if
 1826                  * we receive a bulk stream w/o packet losses or reorderings.
 1827                  * Shrinking the buffer during idle times is not necessary as
 1828                  * it doesn't consume any memory when idle.
 1829                  *
 1830                  * TODO: Only step up if the application is actually serving
 1831                  * the buffer to better manage the socket buffer resources.
 1832                  */
 1833                         if (tcp_do_autorcvbuf &&
 1834                             opti.ts_ecr &&
 1835                             (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
 1836                                 if (opti.ts_ecr > tp->rfbuf_ts &&
 1837                                     opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
 1838                                         if (tp->rfbuf_cnt >
 1839                                             (so->so_rcv.sb_hiwat / 8 * 7) &&
 1840                                             so->so_rcv.sb_hiwat <
 1841                                             tcp_autorcvbuf_max) {
 1842                                                 newsize =
 1843                                                     min(so->so_rcv.sb_hiwat +
 1844                                                     tcp_autorcvbuf_inc,
 1845                                                     tcp_autorcvbuf_max);
 1846                                         }
 1847                                         /* Start over with next RTT. */
 1848                                         tp->rfbuf_ts = 0;
 1849                                         tp->rfbuf_cnt = 0;
 1850                                 } else
 1851                                         tp->rfbuf_cnt += tlen;  /* add up */
 1852                         }
 1853 
 1854                         /*
 1855                          * Drop TCP, IP headers and TCP options then add data
 1856                          * to socket buffer.
 1857                          */
 1858                         if (so->so_state & SS_CANTRCVMORE)
 1859                                 m_freem(m);
 1860                         else {
 1861                                 /*
 1862                                  * Set new socket buffer size.
 1863                                  * Give up when limit is reached.
 1864                                  */
 1865                                 if (newsize)
 1866                                         if (!sbreserve(&so->so_rcv,
 1867                                             newsize, so))
 1868                                                 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
 1869                                 m_adj(m, toff + off);
 1870                                 sbappendstream(&so->so_rcv, m);
 1871                         }
 1872                         sorwakeup(so);
 1873                         tcp_setup_ack(tp, th);
 1874                         if (tp->t_flags & TF_ACKNOW)
 1875                                 (void) tcp_output(tp);
 1876                         if (tcp_saveti)
 1877                                 m_freem(tcp_saveti);
 1878                         return;
 1879                 }
 1880         }
 1881 
 1882         /*
 1883          * Compute mbuf offset to TCP data segment.
 1884          */
 1885         hdroptlen = toff + off;
 1886 
 1887         /*
 1888          * Calculate amount of space in receive window,
 1889          * and then do TCP input processing.
 1890          * Receive window is amount of space in rcv queue,
 1891          * but not less than advertised window.
 1892          */
 1893         { int win;
 1894 
 1895         win = sbspace(&so->so_rcv);
 1896         if (win < 0)
 1897                 win = 0;
 1898         tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
 1899         }
 1900 
 1901         /* Reset receive buffer auto scaling when not in bulk receive mode. */
 1902         tp->rfbuf_ts = 0;
 1903         tp->rfbuf_cnt = 0;
 1904 
 1905         switch (tp->t_state) {
 1906         /*
 1907          * If the state is SYN_SENT:
 1908          *      if seg contains an ACK, but not for our SYN, drop the input.
 1909          *      if seg contains a RST, then drop the connection.
 1910          *      if seg does not contain SYN, then drop it.
 1911          * Otherwise this is an acceptable SYN segment
 1912          *      initialize tp->rcv_nxt and tp->irs
 1913          *      if seg contains ack then advance tp->snd_una
 1914          *      if seg contains a ECE and ECN support is enabled, the stream
 1915          *          is ECN capable.
 1916          *      if SYN has been acked change to ESTABLISHED else SYN_RCVD state
 1917          *      arrange for segment to be acked (eventually)
 1918          *      continue processing rest of data/controls, beginning with URG
 1919          */
 1920         case TCPS_SYN_SENT:
 1921                 if ((tiflags & TH_ACK) &&
 1922                     (SEQ_LEQ(th->th_ack, tp->iss) ||
 1923                      SEQ_GT(th->th_ack, tp->snd_max)))
 1924                         goto dropwithreset;
 1925                 if (tiflags & TH_RST) {
 1926                         if (tiflags & TH_ACK)
 1927                                 tp = tcp_drop(tp, ECONNREFUSED);
 1928                         goto drop;
 1929                 }
 1930                 if ((tiflags & TH_SYN) == 0)
 1931                         goto drop;
 1932                 if (tiflags & TH_ACK) {
 1933                         tp->snd_una = th->th_ack;
 1934                         if (SEQ_LT(tp->snd_nxt, tp->snd_una))
 1935                                 tp->snd_nxt = tp->snd_una;
 1936                         if (SEQ_LT(tp->snd_high, tp->snd_una))
 1937                                 tp->snd_high = tp->snd_una;
 1938                         TCP_TIMER_DISARM(tp, TCPT_REXMT);
 1939 
 1940                         if ((tiflags & TH_ECE) && tcp_do_ecn) {
 1941                                 tp->t_flags |= TF_ECN_PERMIT;
 1942                                 TCP_STATINC(TCP_STAT_ECN_SHS);
 1943                         }
 1944 
 1945                 }
 1946                 tp->irs = th->th_seq;
 1947                 tcp_rcvseqinit(tp);
 1948                 tp->t_flags |= TF_ACKNOW;
 1949                 tcp_mss_from_peer(tp, opti.maxseg);
 1950 
 1951                 /*
 1952                  * Initialize the initial congestion window.  If we
 1953                  * had to retransmit the SYN, we must initialize cwnd
 1954                  * to 1 segment (i.e. the Loss Window).
 1955                  */
 1956                 if (tp->t_flags & TF_SYN_REXMT)
 1957                         tp->snd_cwnd = tp->t_peermss;
 1958                 else {
 1959                         int ss = tcp_init_win;
 1960 #ifdef INET
 1961                         if (inp != NULL && in_localaddr(inp->inp_faddr))
 1962                                 ss = tcp_init_win_local;
 1963 #endif
 1964 #ifdef INET6
 1965                         if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
 1966                                 ss = tcp_init_win_local;
 1967 #endif
 1968                         tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
 1969                 }
 1970 
 1971                 tcp_rmx_rtt(tp);
 1972                 if (tiflags & TH_ACK) {
 1973                         TCP_STATINC(TCP_STAT_CONNECTS);
 1974                         soisconnected(so);
 1975                         tcp_established(tp);
 1976                         /* Do window scaling on this connection? */
 1977                         if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
 1978                             (TF_RCVD_SCALE|TF_REQ_SCALE)) {
 1979                                 tp->snd_scale = tp->requested_s_scale;
 1980                                 tp->rcv_scale = tp->request_r_scale;
 1981                         }
 1982                         TCP_REASS_LOCK(tp);
 1983                         (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
 1984                         TCP_REASS_UNLOCK(tp);
 1985                         /*
 1986                          * if we didn't have to retransmit the SYN,
 1987                          * use its rtt as our initial srtt & rtt var.
 1988                          */
 1989                         if (tp->t_rtttime)
 1990                                 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
 1991                 } else
 1992                         tp->t_state = TCPS_SYN_RECEIVED;
 1993 
 1994                 /*
 1995                  * Advance th->th_seq to correspond to first data byte.
 1996                  * If data, trim to stay within window,
 1997                  * dropping FIN if necessary.
 1998                  */
 1999                 th->th_seq++;
 2000                 if (tlen > tp->rcv_wnd) {
 2001                         todrop = tlen - tp->rcv_wnd;
 2002                         m_adj(m, -todrop);
 2003                         tlen = tp->rcv_wnd;
 2004                         tiflags &= ~TH_FIN;
 2005                         tcps = TCP_STAT_GETREF();
 2006                         tcps[TCP_STAT_RCVPACKAFTERWIN]++;
 2007                         tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
 2008                         TCP_STAT_PUTREF();
 2009                 }
 2010                 tp->snd_wl1 = th->th_seq - 1;
 2011                 tp->rcv_up = th->th_seq;
 2012                 goto step6;
 2013 
 2014         /*
 2015          * If the state is SYN_RECEIVED:
 2016          *      If seg contains an ACK, but not for our SYN, drop the input
 2017          *      and generate an RST.  See page 36, rfc793
 2018          */
 2019         case TCPS_SYN_RECEIVED:
 2020                 if ((tiflags & TH_ACK) &&
 2021                     (SEQ_LEQ(th->th_ack, tp->iss) ||
 2022                      SEQ_GT(th->th_ack, tp->snd_max)))
 2023                         goto dropwithreset;
 2024                 break;
 2025         }
 2026 
 2027         /*
 2028          * States other than LISTEN or SYN_SENT.
 2029          * First check timestamp, if present.
 2030          * Then check that at least some bytes of segment are within
 2031          * receive window.  If segment begins before rcv_nxt,
 2032          * drop leading data (and SYN); if nothing left, just ack.
 2033          *
 2034          * RFC 1323 PAWS: If we have a timestamp reply on this segment
 2035          * and it's less than ts_recent, drop it.
 2036          */
 2037         if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
 2038             TSTMP_LT(opti.ts_val, tp->ts_recent)) {
 2039 
 2040                 /* Check to see if ts_recent is over 24 days old.  */
 2041                 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
 2042                         /*
 2043                          * Invalidate ts_recent.  If this segment updates
 2044                          * ts_recent, the age will be reset later and ts_recent
 2045                          * will get a valid value.  If it does not, setting
 2046                          * ts_recent to zero will at least satisfy the
 2047                          * requirement that zero be placed in the timestamp
 2048                          * echo reply when ts_recent isn't valid.  The
 2049                          * age isn't reset until we get a valid ts_recent
 2050                          * because we don't want out-of-order segments to be
 2051                          * dropped when ts_recent is old.
 2052                          */
 2053                         tp->ts_recent = 0;
 2054                 } else {
 2055                         tcps = TCP_STAT_GETREF();
 2056                         tcps[TCP_STAT_RCVDUPPACK]++;
 2057                         tcps[TCP_STAT_RCVDUPBYTE] += tlen;
 2058                         tcps[TCP_STAT_PAWSDROP]++;
 2059                         TCP_STAT_PUTREF();
 2060                         tcp_new_dsack(tp, th->th_seq, tlen);
 2061                         goto dropafterack;
 2062                 }
 2063         }
 2064 
 2065         todrop = tp->rcv_nxt - th->th_seq;
 2066         dupseg = false;
 2067         if (todrop > 0) {
 2068                 if (tiflags & TH_SYN) {
 2069                         tiflags &= ~TH_SYN;
 2070                         th->th_seq++;
 2071                         if (th->th_urp > 1)
 2072                                 th->th_urp--;
 2073                         else {
 2074                                 tiflags &= ~TH_URG;
 2075                                 th->th_urp = 0;
 2076                         }
 2077                         todrop--;
 2078                 }
 2079                 if (todrop > tlen ||
 2080                     (todrop == tlen && (tiflags & TH_FIN) == 0)) {
 2081                         /*
 2082                          * Any valid FIN or RST must be to the left of the
 2083                          * window.  At this point the FIN or RST must be a
 2084                          * duplicate or out of sequence; drop it.
 2085                          */
 2086                         if (tiflags & TH_RST)
 2087                                 goto drop;
 2088                         tiflags &= ~(TH_FIN|TH_RST);
 2089                         /*
 2090                          * Send an ACK to resynchronize and drop any data.
 2091                          * But keep on processing for RST or ACK.
 2092                          */
 2093                         tp->t_flags |= TF_ACKNOW;
 2094                         todrop = tlen;
 2095                         dupseg = true;
 2096                         tcps = TCP_STAT_GETREF();
 2097                         tcps[TCP_STAT_RCVDUPPACK]++;
 2098                         tcps[TCP_STAT_RCVDUPBYTE] += todrop;
 2099                         TCP_STAT_PUTREF();
 2100                 } else if ((tiflags & TH_RST) &&
 2101                            th->th_seq != tp->rcv_nxt) {
 2102                         /*
 2103                          * Test for reset before adjusting the sequence
 2104                          * number for overlapping data.
 2105                          */
 2106                         goto dropafterack_ratelim;
 2107                 } else {
 2108                         tcps = TCP_STAT_GETREF();
 2109                         tcps[TCP_STAT_RCVPARTDUPPACK]++;
 2110                         tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
 2111                         TCP_STAT_PUTREF();
 2112                 }
 2113                 tcp_new_dsack(tp, th->th_seq, todrop);
 2114                 hdroptlen += todrop;    /*drop from head afterwards*/
 2115                 th->th_seq += todrop;
 2116                 tlen -= todrop;
 2117                 if (th->th_urp > todrop)
 2118                         th->th_urp -= todrop;
 2119                 else {
 2120                         tiflags &= ~TH_URG;
 2121                         th->th_urp = 0;
 2122                 }
 2123         }
 2124 
 2125         /*
 2126          * If new data are received on a connection after the
 2127          * user processes are gone, then RST the other end.
 2128          */
 2129         if ((so->so_state & SS_NOFDREF) &&
 2130             tp->t_state > TCPS_CLOSE_WAIT && tlen) {
 2131                 tp = tcp_close(tp);
 2132                 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
 2133                 goto dropwithreset;
 2134         }
 2135 
 2136         /*
 2137          * If segment ends after window, drop trailing data
 2138          * (and PUSH and FIN); if nothing left, just ACK.
 2139          */
 2140         todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
 2141         if (todrop > 0) {
 2142                 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
 2143                 if (todrop >= tlen) {
 2144                         /*
 2145                          * The segment actually starts after the window.
 2146                          * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
 2147                          * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
 2148                          * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
 2149                          */
 2150                         TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
 2151                         /*
 2152                          * If a new connection request is received
 2153                          * while in TIME_WAIT, drop the old connection
 2154                          * and start over if the sequence numbers
 2155                          * are above the previous ones.
 2156                          *
 2157                          * NOTE: We will checksum the packet again, and
 2158                          * so we need to put the header fields back into
 2159                          * network order!
 2160                          * XXX This kind of sucks, but we don't expect
 2161                          * XXX this to happen very often, so maybe it
 2162                          * XXX doesn't matter so much.
 2163                          */
 2164                         if (tiflags & TH_SYN &&
 2165                             tp->t_state == TCPS_TIME_WAIT &&
 2166                             SEQ_GT(th->th_seq, tp->rcv_nxt)) {
 2167                                 tp = tcp_close(tp);
 2168                                 tcp_fields_to_net(th);
 2169                                 goto findpcb;
 2170                         }
 2171                         /*
 2172                          * If window is closed can only take segments at
 2173                          * window edge, and have to drop data and PUSH from
 2174                          * incoming segments.  Continue processing, but
 2175                          * remember to ack.  Otherwise, drop segment
 2176                          * and (if not RST) ack.
 2177                          */
 2178                         if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
 2179                                 tp->t_flags |= TF_ACKNOW;
 2180                                 TCP_STATINC(TCP_STAT_RCVWINPROBE);
 2181                         } else
 2182                                 goto dropafterack;
 2183                 } else
 2184                         TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
 2185                 m_adj(m, -todrop);
 2186                 tlen -= todrop;
 2187                 tiflags &= ~(TH_PUSH|TH_FIN);
 2188         }
 2189 
 2190         /*
 2191          * If last ACK falls within this segment's sequence numbers,
 2192          *  record the timestamp.
 2193          * NOTE: 
 2194          * 1) That the test incorporates suggestions from the latest
 2195          *    proposal of the tcplw@cray.com list (Braden 1993/04/26).
 2196          * 2) That updating only on newer timestamps interferes with
 2197          *    our earlier PAWS tests, so this check should be solely
 2198          *    predicated on the sequence space of this segment.
 2199          * 3) That we modify the segment boundary check to be 
 2200          *        Last.ACK.Sent <= SEG.SEQ + SEG.Len  
 2201          *    instead of RFC1323's
 2202          *        Last.ACK.Sent < SEG.SEQ + SEG.Len,
 2203          *    This modified check allows us to overcome RFC1323's
 2204          *    limitations as described in Stevens TCP/IP Illustrated
 2205          *    Vol. 2 p.869. In such cases, we can still calculate the
 2206          *    RTT correctly when RCV.NXT == Last.ACK.Sent.
 2207          */
 2208         if (opti.ts_present &&
 2209             SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
 2210             SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
 2211                     ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
 2212                 tp->ts_recent_age = tcp_now;
 2213                 tp->ts_recent = opti.ts_val;
 2214         }
 2215 
 2216         /*
 2217          * If the RST bit is set examine the state:
 2218          *    SYN_RECEIVED STATE:
 2219          *      If passive open, return to LISTEN state.
 2220          *      If active open, inform user that connection was refused.
 2221          *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
 2222          *      Inform user that connection was reset, and close tcb.
 2223          *    CLOSING, LAST_ACK, TIME_WAIT STATES
 2224          *      Close the tcb.
 2225          */
 2226         if (tiflags & TH_RST) {
 2227                 if (th->th_seq != tp->rcv_nxt)
 2228                         goto dropafterack_ratelim;
 2229 
 2230                 switch (tp->t_state) {
 2231                 case TCPS_SYN_RECEIVED:
 2232                         so->so_error = ECONNREFUSED;
 2233                         goto close;
 2234 
 2235                 case TCPS_ESTABLISHED:
 2236                 case TCPS_FIN_WAIT_1:
 2237                 case TCPS_FIN_WAIT_2:
 2238                 case TCPS_CLOSE_WAIT:
 2239                         so->so_error = ECONNRESET;
 2240                 close:
 2241                         tp->t_state = TCPS_CLOSED;
 2242                         TCP_STATINC(TCP_STAT_DROPS);
 2243                         tp = tcp_close(tp);
 2244                         goto drop;
 2245 
 2246                 case TCPS_CLOSING:
 2247                 case TCPS_LAST_ACK:
 2248                 case TCPS_TIME_WAIT:
 2249                         tp = tcp_close(tp);
 2250                         goto drop;
 2251                 }
 2252         }
 2253 
 2254         /*
 2255          * Since we've covered the SYN-SENT and SYN-RECEIVED states above
 2256          * we must be in a synchronized state.  RFC791 states (under RST
 2257          * generation) that any unacceptable segment (an out-of-order SYN
 2258          * qualifies) received in a synchronized state must elicit only an
 2259          * empty acknowledgment segment ... and the connection remains in
 2260          * the same state.
 2261          */
 2262         if (tiflags & TH_SYN) {
 2263                 if (tp->rcv_nxt == th->th_seq) {
 2264                         tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
 2265                             TH_ACK);
 2266                         if (tcp_saveti)
 2267                                 m_freem(tcp_saveti);
 2268                         return;
 2269                 }
 2270 
 2271                 goto dropafterack_ratelim;
 2272         }
 2273 
 2274         /*
 2275          * If the ACK bit is off we drop the segment and return.
 2276          */
 2277         if ((tiflags & TH_ACK) == 0) {
 2278                 if (tp->t_flags & TF_ACKNOW)
 2279                         goto dropafterack;
 2280                 else
 2281                         goto drop;
 2282         }
 2283 
 2284         /*
 2285          * Ack processing.
 2286          */
 2287         switch (tp->t_state) {
 2288 
 2289         /*
 2290          * In SYN_RECEIVED state if the ack ACKs our SYN then enter
 2291          * ESTABLISHED state and continue processing, otherwise
 2292          * send an RST.
 2293          */
 2294         case TCPS_SYN_RECEIVED:
 2295                 if (SEQ_GT(tp->snd_una, th->th_ack) ||
 2296                     SEQ_GT(th->th_ack, tp->snd_max))
 2297                         goto dropwithreset;
 2298                 TCP_STATINC(TCP_STAT_CONNECTS);
 2299                 soisconnected(so);
 2300                 tcp_established(tp);
 2301                 /* Do window scaling? */
 2302                 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
 2303                     (TF_RCVD_SCALE|TF_REQ_SCALE)) {
 2304                         tp->snd_scale = tp->requested_s_scale;
 2305                         tp->rcv_scale = tp->request_r_scale;
 2306                 }
 2307                 TCP_REASS_LOCK(tp);
 2308                 (void) tcp_reass(tp, NULL, (struct mbuf *)0, &tlen);
 2309                 TCP_REASS_UNLOCK(tp);
 2310                 tp->snd_wl1 = th->th_seq - 1;
 2311                 /* fall into ... */
 2312 
 2313         /*
 2314          * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
 2315          * ACKs.  If the ack is in the range
 2316          *      tp->snd_una < th->th_ack <= tp->snd_max
 2317          * then advance tp->snd_una to th->th_ack and drop
 2318          * data from the retransmission queue.  If this ACK reflects
 2319          * more up to date window information we update our window information.
 2320          */
 2321         case TCPS_ESTABLISHED:
 2322         case TCPS_FIN_WAIT_1:
 2323         case TCPS_FIN_WAIT_2:
 2324         case TCPS_CLOSE_WAIT:
 2325         case TCPS_CLOSING:
 2326         case TCPS_LAST_ACK:
 2327         case TCPS_TIME_WAIT:
 2328 
 2329                 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
 2330                         if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
 2331                                 TCP_STATINC(TCP_STAT_RCVDUPPACK);
 2332                                 /*
 2333                                  * If we have outstanding data (other than
 2334                                  * a window probe), this is a completely
 2335                                  * duplicate ack (ie, window info didn't
 2336                                  * change), the ack is the biggest we've
 2337                                  * seen and we've seen exactly our rexmt
 2338                                  * threshhold of them, assume a packet
 2339                                  * has been dropped and retransmit it.
 2340                                  * Kludge snd_nxt & the congestion
 2341                                  * window so we send only this one
 2342                                  * packet.
 2343                                  */
 2344                                 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
 2345                                     th->th_ack != tp->snd_una)
 2346                                         tp->t_dupacks = 0;
 2347                                 else if (tp->t_partialacks < 0 &&
 2348                                          (++tp->t_dupacks == tcprexmtthresh ||
 2349                                          TCP_FACK_FASTRECOV(tp))) {
 2350                                         /*
 2351                                          * Do the fast retransmit, and adjust
 2352                                          * congestion control paramenters.
 2353                                          */
 2354                                         if (tp->t_congctl->fast_retransmit(tp, th)) {
 2355                                                 /* False fast retransmit */
 2356                                                 break;
 2357                                         } else
 2358                                                 goto drop;
 2359                                 } else if (tp->t_dupacks > tcprexmtthresh) {
 2360                                         tp->snd_cwnd += tp->t_segsz;
 2361                                         (void) tcp_output(tp);
 2362                                         goto drop;
 2363                                 }
 2364                         } else {
 2365                                 /*
 2366                                  * If the ack appears to be very old, only
 2367                                  * allow data that is in-sequence.  This
 2368                                  * makes it somewhat more difficult to insert
 2369                                  * forged data by guessing sequence numbers.
 2370                                  * Sent an ack to try to update the send
 2371                                  * sequence number on the other side.
 2372                                  */
 2373                                 if (tlen && th->th_seq != tp->rcv_nxt &&
 2374                                     SEQ_LT(th->th_ack,
 2375                                     tp->snd_una - tp->max_sndwnd))
 2376                                         goto dropafterack;
 2377                         }
 2378                         break;
 2379                 }
 2380                 /*
 2381                  * If the congestion window was inflated to account
 2382                  * for the other side's cached packets, retract it.
 2383                  */
 2384                 /* XXX: make SACK have his own congestion control
 2385                  * struct -- rpaulo */
 2386                 if (TCP_SACK_ENABLED(tp))
 2387                         tcp_sack_newack(tp, th);
 2388                 else
 2389                         tp->t_congctl->fast_retransmit_newack(tp, th);
 2390                 if (SEQ_GT(th->th_ack, tp->snd_max)) {
 2391                         TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
 2392                         goto dropafterack;
 2393                 }
 2394                 acked = th->th_ack - tp->snd_una;
 2395                 tcps = TCP_STAT_GETREF();
 2396                 tcps[TCP_STAT_RCVACKPACK]++;
 2397                 tcps[TCP_STAT_RCVACKBYTE] += acked;
 2398                 TCP_STAT_PUTREF();
 2399 
 2400                 /*
 2401                  * If we have a timestamp reply, update smoothed
 2402                  * round trip time.  If no timestamp is present but
 2403                  * transmit timer is running and timed sequence
 2404                  * number was acked, update smoothed round trip time.
 2405                  * Since we now have an rtt measurement, cancel the
 2406                  * timer backoff (cf., Phil Karn's retransmit alg.).
 2407                  * Recompute the initial retransmit timer.
 2408                  */
 2409                 if (ts_rtt)
 2410                         tcp_xmit_timer(tp, ts_rtt);
 2411                 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
 2412                         tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
 2413 
 2414                 /*
 2415                  * If all outstanding data is acked, stop retransmit
 2416                  * timer and remember to restart (more output or persist).
 2417                  * If there is more data to be acked, restart retransmit
 2418                  * timer, using current (possibly backed-off) value.
 2419                  */
 2420                 if (th->th_ack == tp->snd_max) {
 2421                         TCP_TIMER_DISARM(tp, TCPT_REXMT);
 2422                         needoutput = 1;
 2423                 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
 2424                         TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
 2425 
 2426                 /*
 2427                  * New data has been acked, adjust the congestion window.
 2428                  */
 2429                 tp->t_congctl->newack(tp, th);
 2430 
 2431                 nd6_hint(tp);
 2432                 if (acked > so->so_snd.sb_cc) {
 2433                         tp->snd_wnd -= so->so_snd.sb_cc;
 2434                         sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
 2435                         ourfinisacked = 1;
 2436                 } else {
 2437                         if (acked > (tp->t_lastoff - tp->t_inoff))
 2438                                 tp->t_lastm = NULL;
 2439                         sbdrop(&so->so_snd, acked);
 2440                         tp->t_lastoff -= acked;
 2441                         tp->snd_wnd -= acked;
 2442                         ourfinisacked = 0;
 2443                 }
 2444                 sowwakeup(so);
 2445 
 2446                 icmp_check(tp, th, acked);
 2447 
 2448                 tp->snd_una = th->th_ack;
 2449                 if (SEQ_GT(tp->snd_una, tp->snd_fack))
 2450                         tp->snd_fack = tp->snd_una;
 2451                 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
 2452                         tp->snd_nxt = tp->snd_una;
 2453                 if (SEQ_LT(tp->snd_high, tp->snd_una))
 2454                         tp->snd_high = tp->snd_una;
 2455 
 2456                 switch (tp->t_state) {
 2457 
 2458                 /*
 2459                  * In FIN_WAIT_1 STATE in addition to the processing
 2460                  * for the ESTABLISHED state if our FIN is now acknowledged
 2461                  * then enter FIN_WAIT_2.
 2462                  */
 2463                 case TCPS_FIN_WAIT_1:
 2464                         if (ourfinisacked) {
 2465                                 /*
 2466                                  * If we can't receive any more
 2467                                  * data, then closing user can proceed.
 2468                                  * Starting the timer is contrary to the
 2469                                  * specification, but if we don't get a FIN
 2470                                  * we'll hang forever.
 2471                                  */
 2472                                 if (so->so_state & SS_CANTRCVMORE) {
 2473                                         soisdisconnected(so);
 2474                                         if (tp->t_maxidle > 0)
 2475                                                 TCP_TIMER_ARM(tp, TCPT_2MSL,
 2476                                                     tp->t_maxidle);
 2477                                 }
 2478                                 tp->t_state = TCPS_FIN_WAIT_2;
 2479                         }
 2480                         break;
 2481 
 2482                 /*
 2483                  * In CLOSING STATE in addition to the processing for
 2484                  * the ESTABLISHED state if the ACK acknowledges our FIN
 2485                  * then enter the TIME-WAIT state, otherwise ignore
 2486                  * the segment.
 2487                  */
 2488                 case TCPS_CLOSING:
 2489                         if (ourfinisacked) {
 2490                                 tp->t_state = TCPS_TIME_WAIT;
 2491                                 tcp_canceltimers(tp);
 2492                                 TCP_TIMER_ARM(tp, TCPT_2MSL, 
 2493                                                 2 * PR_SLOWHZ * tcp_msl);
 2494                                 soisdisconnected(so);
 2495                         }
 2496                         break;
 2497 
 2498                 /*
 2499                  * In LAST_ACK, we may still be waiting for data to drain
 2500                  * and/or to be acked, as well as for the ack of our FIN.
 2501                  * If our FIN is now acknowledged, delete the TCB,
 2502                  * enter the closed state and return.
 2503                  */
 2504                 case TCPS_LAST_ACK:
 2505                         if (ourfinisacked) {
 2506                                 tp = tcp_close(tp);
 2507                                 goto drop;
 2508                         }
 2509                         break;
 2510 
 2511                 /*
 2512                  * In TIME_WAIT state the only thing that should arrive
 2513                  * is a retransmission of the remote FIN.  Acknowledge
 2514                  * it and restart the finack timer.
 2515                  */
 2516                 case TCPS_TIME_WAIT:
 2517                         TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
 2518                         goto dropafterack;
 2519                 }
 2520         }
 2521 
 2522 step6:
 2523         /*
 2524          * Update window information.
 2525          * Don't look at window if no ACK: TAC's send garbage on first SYN.
 2526          */
 2527         if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
 2528             (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
 2529             (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
 2530                 /* keep track of pure window updates */
 2531                 if (tlen == 0 &&
 2532                     tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
 2533                         TCP_STATINC(TCP_STAT_RCVWINUPD);
 2534                 tp->snd_wnd = tiwin;
 2535                 tp->snd_wl1 = th->th_seq;
 2536                 tp->snd_wl2 = th->th_ack;
 2537                 if (tp->snd_wnd > tp->max_sndwnd)
 2538                         tp->max_sndwnd = tp->snd_wnd;
 2539                 needoutput = 1;
 2540         }
 2541 
 2542         /*
 2543          * Process segments with URG.
 2544          */
 2545         if ((tiflags & TH_URG) && th->th_urp &&
 2546             TCPS_HAVERCVDFIN(tp->t_state) == 0) {
 2547                 /*
 2548                  * This is a kludge, but if we receive and accept
 2549                  * random urgent pointers, we'll crash in
 2550                  * soreceive.  It's hard to imagine someone
 2551                  * actually wanting to send this much urgent data.
 2552                  */
 2553                 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
 2554                         th->th_urp = 0;                 /* XXX */
 2555                         tiflags &= ~TH_URG;             /* XXX */
 2556                         goto dodata;                    /* XXX */
 2557                 }
 2558                 /*
 2559                  * If this segment advances the known urgent pointer,
 2560                  * then mark the data stream.  This should not happen
 2561                  * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
 2562                  * a FIN has been received from the remote side.
 2563                  * In these states we ignore the URG.
 2564                  *
 2565                  * According to RFC961 (Assigned Protocols),
 2566                  * the urgent pointer points to the last octet
 2567                  * of urgent data.  We continue, however,
 2568                  * to consider it to indicate the first octet
 2569                  * of data past the urgent section as the original
 2570                  * spec states (in one of two places).
 2571                  */
 2572                 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
 2573                         tp->rcv_up = th->th_seq + th->th_urp;
 2574                         so->so_oobmark = so->so_rcv.sb_cc +
 2575                             (tp->rcv_up - tp->rcv_nxt) - 1;
 2576                         if (so->so_oobmark == 0)
 2577                                 so->so_state |= SS_RCVATMARK;
 2578                         sohasoutofband(so);
 2579                         tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
 2580                 }
 2581                 /*
 2582                  * Remove out of band data so doesn't get presented to user.
 2583                  * This can happen independent of advancing the URG pointer,
 2584                  * but if two URG's are pending at once, some out-of-band
 2585                  * data may creep in... ick.
 2586                  */
 2587                 if (th->th_urp <= (u_int16_t) tlen
 2588 #ifdef SO_OOBINLINE
 2589                      && (so->so_options & SO_OOBINLINE) == 0
 2590 #endif
 2591                      )
 2592                         tcp_pulloutofband(so, th, m, hdroptlen);
 2593         } else
 2594                 /*
 2595                  * If no out of band data is expected,
 2596                  * pull receive urgent pointer along
 2597                  * with the receive window.
 2598                  */
 2599                 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
 2600                         tp->rcv_up = tp->rcv_nxt;
 2601 dodata:                                                 /* XXX */
 2602 
 2603         /*
 2604          * Process the segment text, merging it into the TCP sequencing queue,
 2605          * and arranging for acknowledgement of receipt if necessary.
 2606          * This process logically involves adjusting tp->rcv_wnd as data
 2607          * is presented to the user (this happens in tcp_usrreq.c,
 2608          * case PRU_RCVD).  If a FIN has already been received on this
 2609          * connection then we just ignore the text.
 2610          */
 2611         if ((tlen || (tiflags & TH_FIN)) &&
 2612             TCPS_HAVERCVDFIN(tp->t_state) == 0) {
 2613                 /*
 2614                  * Insert segment ti into reassembly queue of tcp with
 2615                  * control block tp.  Return TH_FIN if reassembly now includes
 2616                  * a segment with FIN.  The macro form does the common case
 2617                  * inline (segment is the next to be received on an
 2618                  * established connection, and the queue is empty),
 2619                  * avoiding linkage into and removal from the queue and
 2620                  * repetition of various conversions.
 2621                  * Set DELACK for segments received in order, but ack
 2622                  * immediately when segments are out of order
 2623                  * (so fast retransmit can work).
 2624                  */
 2625                 /* NOTE: this was TCP_REASS() macro, but used only once */
 2626                 TCP_REASS_LOCK(tp);
 2627                 if (th->th_seq == tp->rcv_nxt &&
 2628                     TAILQ_FIRST(&tp->segq) == NULL &&
 2629                     tp->t_state == TCPS_ESTABLISHED) {
 2630                         tcp_setup_ack(tp, th);
 2631                         tp->rcv_nxt += tlen;
 2632                         tiflags = th->th_flags & TH_FIN;
 2633                         tcps = TCP_STAT_GETREF();
 2634                         tcps[TCP_STAT_RCVPACK]++;
 2635                         tcps[TCP_STAT_RCVBYTE] += tlen;
 2636                         TCP_STAT_PUTREF();
 2637                         nd6_hint(tp);
 2638                         if (so->so_state & SS_CANTRCVMORE)
 2639                                 m_freem(m);
 2640                         else {
 2641                                 m_adj(m, hdroptlen);
 2642                                 sbappendstream(&(so)->so_rcv, m);
 2643                         }
 2644                         TCP_REASS_UNLOCK(tp);
 2645                         sorwakeup(so);
 2646                 } else {
 2647                         m_adj(m, hdroptlen);
 2648                         tiflags = tcp_reass(tp, th, m, &tlen);
 2649                         tp->t_flags |= TF_ACKNOW;
 2650                         TCP_REASS_UNLOCK(tp);
 2651                 }
 2652 
 2653                 /*
 2654                  * Note the amount of data that peer has sent into
 2655                  * our window, in order to estimate the sender's
 2656                  * buffer size.
 2657                  */
 2658                 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
 2659         } else {
 2660                 m_freem(m);
 2661                 m = NULL;
 2662                 tiflags &= ~TH_FIN;
 2663         }
 2664 
 2665         /*
 2666          * If FIN is received ACK the FIN and let the user know
 2667          * that the connection is closing.  Ignore a FIN received before
 2668          * the connection is fully established.
 2669          */
 2670         if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
 2671                 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
 2672                         socantrcvmore(so);
 2673                         tp->t_flags |= TF_ACKNOW;
 2674                         tp->rcv_nxt++;
 2675                 }
 2676                 switch (tp->t_state) {
 2677 
 2678                 /*
 2679                  * In ESTABLISHED STATE enter the CLOSE_WAIT state.
 2680                  */
 2681                 case TCPS_ESTABLISHED:
 2682                         tp->t_state = TCPS_CLOSE_WAIT;
 2683                         break;
 2684 
 2685                 /*
 2686                  * If still in FIN_WAIT_1 STATE FIN has not been acked so
 2687                  * enter the CLOSING state.
 2688                  */
 2689                 case TCPS_FIN_WAIT_1:
 2690                         tp->t_state = TCPS_CLOSING;
 2691                         break;
 2692 
 2693                 /*
 2694                  * In FIN_WAIT_2 state enter the TIME_WAIT state,
 2695                  * starting the time-wait timer, turning off the other
 2696                  * standard timers.
 2697                  */
 2698                 case TCPS_FIN_WAIT_2:
 2699                         tp->t_state = TCPS_TIME_WAIT;
 2700                         tcp_canceltimers(tp);
 2701                         TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
 2702                         soisdisconnected(so);
 2703                         break;
 2704 
 2705                 /*
 2706                  * In TIME_WAIT state restart the 2 MSL time_wait timer.
 2707                  */
 2708                 case TCPS_TIME_WAIT:
 2709                         TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * PR_SLOWHZ * tcp_msl);
 2710                         break;
 2711                 }
 2712         }
 2713 #ifdef TCP_DEBUG
 2714         if (so->so_options & SO_DEBUG)
 2715                 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
 2716 #endif
 2717 
 2718         /*
 2719          * Return any desired output.
 2720          */
 2721         if (needoutput || (tp->t_flags & TF_ACKNOW)) {
 2722                 (void) tcp_output(tp);
 2723         }
 2724         if (tcp_saveti)
 2725                 m_freem(tcp_saveti);
 2726         return;
 2727 
 2728 badsyn:
 2729         /*
 2730          * Received a bad SYN.  Increment counters and dropwithreset.
 2731          */
 2732         TCP_STATINC(TCP_STAT_BADSYN);
 2733         tp = NULL;
 2734         goto dropwithreset;
 2735 
 2736 dropafterack:
 2737         /*
 2738          * Generate an ACK dropping incoming segment if it occupies
 2739          * sequence space, where the ACK reflects our state.
 2740          */
 2741         if (tiflags & TH_RST)
 2742                 goto drop;
 2743         goto dropafterack2;
 2744 
 2745 dropafterack_ratelim:
 2746         /*
 2747          * We may want to rate-limit ACKs against SYN/RST attack.
 2748          */
 2749         if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
 2750             tcp_ackdrop_ppslim) == 0) {
 2751                 /* XXX stat */
 2752                 goto drop;
 2753         }
 2754         /* ...fall into dropafterack2... */
 2755 
 2756 dropafterack2:
 2757         m_freem(m);
 2758         tp->t_flags |= TF_ACKNOW;
 2759         (void) tcp_output(tp);
 2760         if (tcp_saveti)
 2761                 m_freem(tcp_saveti);
 2762         return;
 2763 
 2764 dropwithreset_ratelim:
 2765         /*
 2766          * We may want to rate-limit RSTs in certain situations,
 2767          * particularly if we are sending an RST in response to
 2768          * an attempt to connect to or otherwise communicate with
 2769          * a port for which we have no socket.
 2770          */
 2771         if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
 2772             tcp_rst_ppslim) == 0) {
 2773                 /* XXX stat */
 2774                 goto drop;
 2775         }
 2776         /* ...fall into dropwithreset... */
 2777 
 2778 dropwithreset:
 2779         /*
 2780          * Generate a RST, dropping incoming segment.
 2781          * Make ACK acceptable to originator of segment.
 2782          */
 2783         if (tiflags & TH_RST)
 2784                 goto drop;
 2785 
 2786         switch (af) {
 2787 #ifdef INET6
 2788         case AF_INET6:
 2789                 /* For following calls to tcp_respond */
 2790                 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
 2791                         goto drop;
 2792                 break;
 2793 #endif /* INET6 */
 2794         case AF_INET:
 2795                 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
 2796                     in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
 2797                         goto drop;
 2798         }
 2799 
 2800         if (tiflags & TH_ACK)
 2801                 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
 2802         else {
 2803                 if (tiflags & TH_SYN)
 2804                         tlen++;
 2805                 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
 2806                     TH_RST|TH_ACK);
 2807         }
 2808         if (tcp_saveti)
 2809                 m_freem(tcp_saveti);
 2810         return;
 2811 
 2812 badcsum:
 2813 drop:
 2814         /*
 2815          * Drop space held by incoming segment and return.
 2816          */
 2817         if (tp) {
 2818                 if (tp->t_inpcb)
 2819                         so = tp->t_inpcb->inp_socket;
 2820 #ifdef INET6
 2821                 else if (tp->t_in6pcb)
 2822                         so = tp->t_in6pcb->in6p_socket;
 2823 #endif
 2824                 else
 2825                         so = NULL;
 2826 #ifdef TCP_DEBUG
 2827                 if (so && (so->so_options & SO_DEBUG) != 0)
 2828                         tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
 2829 #endif
 2830         }
 2831         if (tcp_saveti)
 2832                 m_freem(tcp_saveti);
 2833         m_freem(m);
 2834         return;
 2835 }
 2836 
 2837 #ifdef TCP_SIGNATURE
 2838 int
 2839 tcp_signature_apply(void *fstate, void *data, u_int len)
 2840 {
 2841 
 2842         MD5Update(fstate, (u_char *)data, len);
 2843         return (0);
 2844 }
 2845 
 2846 struct secasvar *
 2847 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th)
 2848 {
 2849         struct secasvar *sav;
 2850 #ifdef FAST_IPSEC
 2851         union sockaddr_union dst;
 2852 #endif
 2853         struct ip *ip;
 2854         struct ip6_hdr *ip6;
 2855 
 2856         ip = mtod(m, struct ip *);
 2857         switch (ip->ip_v) {
 2858         case 4:
 2859                 ip = mtod(m, struct ip *);
 2860                 ip6 = NULL;
 2861                 break;
 2862         case 6:
 2863                 ip = NULL;
 2864                 ip6 = mtod(m, struct ip6_hdr *);
 2865                 break;
 2866         default:
 2867                 return (NULL);
 2868         }
 2869 
 2870 #ifdef FAST_IPSEC
 2871         /* Extract the destination from the IP header in the mbuf. */
 2872         bzero(&dst, sizeof(union sockaddr_union));
 2873         if (ip !=NULL) {
 2874                 dst.sa.sa_len = sizeof(struct sockaddr_in);
 2875                 dst.sa.sa_family = AF_INET;
 2876                 dst.sin.sin_addr = ip->ip_dst;
 2877         } else {
 2878                 dst.sa.sa_len = sizeof(struct sockaddr_in6);
 2879                 dst.sa.sa_family = AF_INET6;
 2880                 dst.sin6.sin6_addr = ip6->ip6_dst;
 2881         }
 2882 
 2883         /*
 2884          * Look up an SADB entry which matches the address of the peer.
 2885          */
 2886         sav = KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI));
 2887 #else
 2888         if (ip)
 2889                 sav = key_allocsa(AF_INET, (void *)&ip->ip_src,
 2890                     (void *)&ip->ip_dst, IPPROTO_TCP,
 2891                     htonl(TCP_SIG_SPI), 0, 0);
 2892         else
 2893                 sav = key_allocsa(AF_INET6, (void *)&ip6->ip6_src,
 2894                     (void *)&ip6->ip6_dst, IPPROTO_TCP,
 2895                     htonl(TCP_SIG_SPI), 0, 0);
 2896 #endif
 2897 
 2898         return (sav);   /* freesav must be performed by caller */
 2899 }
 2900 
 2901 int
 2902 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
 2903     struct secasvar *sav, char *sig)
 2904 {
 2905         MD5_CTX ctx;
 2906         struct ip *ip;
 2907         struct ipovly *ipovly;
 2908         struct ip6_hdr *ip6;
 2909         struct ippseudo ippseudo;
 2910         struct ip6_hdr_pseudo ip6pseudo;
 2911         struct tcphdr th0;
 2912         int l, tcphdrlen;
 2913 
 2914         if (sav == NULL)
 2915                 return (-1);
 2916 
 2917         tcphdrlen = th->th_off * 4;
 2918 
 2919         switch (mtod(m, struct ip *)->ip_v) {
 2920         case 4:
 2921                 ip = mtod(m, struct ip *);
 2922                 ip6 = NULL;
 2923                 break;
 2924         case 6:
 2925                 ip = NULL;
 2926                 ip6 = mtod(m, struct ip6_hdr *);
 2927                 break;
 2928         default:
 2929                 return (-1);
 2930         }
 2931 
 2932         MD5Init(&ctx);
 2933 
 2934         if (ip) {
 2935                 memset(&ippseudo, 0, sizeof(ippseudo));
 2936                 ipovly = (struct ipovly *)ip;
 2937                 ippseudo.ippseudo_src = ipovly->ih_src;
 2938                 ippseudo.ippseudo_dst = ipovly->ih_dst;
 2939                 ippseudo.ippseudo_pad = 0;
 2940                 ippseudo.ippseudo_p = IPPROTO_TCP;
 2941                 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
 2942                 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
 2943         } else {
 2944                 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
 2945                 ip6pseudo.ip6ph_src = ip6->ip6_src;
 2946                 in6_clearscope(&ip6pseudo.ip6ph_src);
 2947                 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
 2948                 in6_clearscope(&ip6pseudo.ip6ph_dst);
 2949                 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
 2950                 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
 2951                 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
 2952         }
 2953 
 2954         th0 = *th;
 2955         th0.th_sum = 0;
 2956         MD5Update(&ctx, (char *)&th0, sizeof(th0));
 2957 
 2958         l = m->m_pkthdr.len - thoff - tcphdrlen;
 2959         if (l > 0)
 2960                 m_apply(m, thoff + tcphdrlen,
 2961                     m->m_pkthdr.len - thoff - tcphdrlen,
 2962                     tcp_signature_apply, &ctx);
 2963 
 2964         MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
 2965         MD5Final(sig, &ctx);
 2966 
 2967         return (0);
 2968 }
 2969 #endif
 2970 
 2971 static int
 2972 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt,
 2973     struct tcphdr *th,
 2974     struct mbuf *m, int toff, struct tcp_opt_info *oi)
 2975 {
 2976         u_int16_t mss;
 2977         int opt, optlen = 0;
 2978 #ifdef TCP_SIGNATURE
 2979         void *sigp = NULL;
 2980         char sigbuf[TCP_SIGLEN];
 2981         struct secasvar *sav = NULL;
 2982 #endif
 2983 
 2984         for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
 2985                 opt = cp[0];
 2986                 if (opt == TCPOPT_EOL)
 2987                         break;
 2988                 if (opt == TCPOPT_NOP)
 2989                         optlen = 1;
 2990                 else {
 2991                         if (cnt < 2)
 2992                                 break;
 2993                         optlen = cp[1];
 2994                         if (optlen < 2 || optlen > cnt)
 2995                                 break;
 2996                 }
 2997                 switch (opt) {
 2998 
 2999                 default:
 3000                         continue;
 3001 
 3002                 case TCPOPT_MAXSEG:
 3003                         if (optlen != TCPOLEN_MAXSEG)
 3004                                 continue;
 3005                         if (!(th->th_flags & TH_SYN))
 3006                                 continue;
 3007                         if (TCPS_HAVERCVDSYN(tp->t_state))
 3008                                 continue;
 3009                         bcopy(cp + 2, &mss, sizeof(mss));
 3010                         oi->maxseg = ntohs(mss);
 3011                         break;
 3012 
 3013                 case TCPOPT_WINDOW:
 3014                         if (optlen != TCPOLEN_WINDOW)
 3015                                 continue;
 3016                         if (!(th->th_flags & TH_SYN))
 3017                                 continue;
 3018                         if (TCPS_HAVERCVDSYN(tp->t_state))
 3019                                 continue;
 3020                         tp->t_flags |= TF_RCVD_SCALE;
 3021                         tp->requested_s_scale = cp[2];
 3022                         if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
 3023 #if 0   /*XXX*/
 3024                                 char *p;
 3025 
 3026                                 if (ip)
 3027                                         p = ntohl(ip->ip_src);
 3028 #ifdef INET6
 3029                                 else if (ip6)
 3030                                         p = ip6_sprintf(&ip6->ip6_src);
 3031 #endif
 3032                                 else
 3033                                         p = "(unknown)";
 3034                                 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
 3035                                     "assuming %d\n",
 3036                                     tp->requested_s_scale, p,
 3037                                     TCP_MAX_WINSHIFT);
 3038 #else
 3039                                 log(LOG_ERR, "TCP: invalid wscale %d, "
 3040                                     "assuming %d\n",
 3041                                     tp->requested_s_scale,
 3042                                     TCP_MAX_WINSHIFT);
 3043 #endif
 3044                                 tp->requested_s_scale = TCP_MAX_WINSHIFT;
 3045                         }
 3046                         break;
 3047 
 3048                 case TCPOPT_TIMESTAMP:
 3049                         if (optlen != TCPOLEN_TIMESTAMP)
 3050                                 continue;
 3051                         oi->ts_present = 1;
 3052                         bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
 3053                         NTOHL(oi->ts_val);
 3054                         bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
 3055                         NTOHL(oi->ts_ecr);
 3056 
 3057                         if (!(th->th_flags & TH_SYN))
 3058                                 continue;
 3059                         if (TCPS_HAVERCVDSYN(tp->t_state))
 3060                                 continue;
 3061                         /*
 3062                          * A timestamp received in a SYN makes
 3063                          * it ok to send timestamp requests and replies.
 3064                          */
 3065                         tp->t_flags |= TF_RCVD_TSTMP;
 3066                         tp->ts_recent = oi->ts_val;
 3067                         tp->ts_recent_age = tcp_now;
 3068                         break;
 3069 
 3070                 case TCPOPT_SACK_PERMITTED:
 3071                         if (optlen != TCPOLEN_SACK_PERMITTED)
 3072                                 continue;
 3073                         if (!(th->th_flags & TH_SYN))
 3074                                 continue;
 3075                         if (TCPS_HAVERCVDSYN(tp->t_state))
 3076                                 continue;
 3077                         if (tcp_do_sack) {
 3078                                 tp->t_flags |= TF_SACK_PERMIT;
 3079                                 tp->t_flags |= TF_WILL_SACK;
 3080                         }
 3081                         break;
 3082 
 3083                 case TCPOPT_SACK:
 3084                         tcp_sack_option(tp, th, cp, optlen);
 3085                         break;
 3086 #ifdef TCP_SIGNATURE
 3087                 case TCPOPT_SIGNATURE:
 3088                         if (optlen != TCPOLEN_SIGNATURE)
 3089                                 continue;
 3090                         if (sigp && bcmp(sigp, cp + 2, TCP_SIGLEN))
 3091                                 return (-1);
 3092 
 3093                         sigp = sigbuf;
 3094                         memcpy(sigbuf, cp + 2, TCP_SIGLEN);
 3095                         tp->t_flags |= TF_SIGNATURE;
 3096                         break;
 3097 #endif
 3098                 }
 3099         }
 3100 
 3101 #ifdef TCP_SIGNATURE
 3102         if (tp->t_flags & TF_SIGNATURE) {
 3103 
 3104                 sav = tcp_signature_getsav(m, th);
 3105 
 3106                 if (sav == NULL && tp->t_state == TCPS_LISTEN)
 3107                         return (-1);
 3108         }
 3109 
 3110         if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) {
 3111                 if (sav == NULL)
 3112                         return (-1);
 3113 #ifdef FAST_IPSEC
 3114                 KEY_FREESAV(&sav);
 3115 #else
 3116                 key_freesav(sav);
 3117 #endif
 3118                 return (-1);
 3119         }
 3120 
 3121         if (sigp) {
 3122                 char sig[TCP_SIGLEN];
 3123 
 3124                 tcp_fields_to_net(th);
 3125                 if (tcp_signature(m, th, toff, sav, sig) < 0) {
 3126                         tcp_fields_to_host(th);
 3127                         if (sav == NULL)
 3128                                 return (-1);
 3129 #ifdef FAST_IPSEC
 3130                         KEY_FREESAV(&sav);
 3131 #else
 3132                         key_freesav(sav);
 3133 #endif
 3134                         return (-1);
 3135                 }
 3136                 tcp_fields_to_host(th);
 3137 
 3138                 if (bcmp(sig, sigp, TCP_SIGLEN)) {
 3139                         TCP_STATINC(TCP_STAT_BADSIG);
 3140                         if (sav == NULL)
 3141                                 return (-1);
 3142 #ifdef FAST_IPSEC
 3143                         KEY_FREESAV(&sav);
 3144 #else
 3145                         key_freesav(sav);
 3146 #endif
 3147                         return (-1);
 3148                 } else
 3149                         TCP_STATINC(TCP_STAT_GOODSIG);
 3150 
 3151                 key_sa_recordxfer(sav, m);
 3152 #ifdef FAST_IPSEC
 3153                 KEY_FREESAV(&sav);
 3154 #else
 3155                 key_freesav(sav);
 3156 #endif
 3157         }
 3158 #endif
 3159 
 3160         return (0);
 3161 }
 3162 
 3163 /*
 3164  * Pull out of band byte out of a segment so
 3165  * it doesn't appear in the user's data queue.
 3166  * It is still reflected in the segment length for
 3167  * sequencing purposes.
 3168  */
 3169 void
 3170 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
 3171     struct mbuf *m, int off)
 3172 {
 3173         int cnt = off + th->th_urp - 1;
 3174 
 3175         while (cnt >= 0) {
 3176                 if (m->m_len > cnt) {
 3177                         char *cp = mtod(m, char *) + cnt;
 3178                         struct tcpcb *tp = sototcpcb(so);
 3179 
 3180                         tp->t_iobc = *cp;
 3181                         tp->t_oobflags |= TCPOOB_HAVEDATA;
 3182                         bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
 3183                         m->m_len--;
 3184                         return;
 3185                 }
 3186                 cnt -= m->m_len;
 3187                 m = m->m_next;
 3188                 if (m == 0)
 3189                         break;
 3190         }
 3191         panic("tcp_pulloutofband");
 3192 }
 3193 
 3194 /*
 3195  * Collect new round-trip time estimate
 3196  * and update averages and current timeout.
 3197  */
 3198 void
 3199 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
 3200 {
 3201         int32_t delta;
 3202 
 3203         TCP_STATINC(TCP_STAT_RTTUPDATED);
 3204         if (tp->t_srtt != 0) {
 3205                 /*
 3206                  * srtt is stored as fixed point with 3 bits after the
 3207                  * binary point (i.e., scaled by 8).  The following magic
 3208                  * is equivalent to the smoothing algorithm in rfc793 with
 3209                  * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
 3210                  * point).  Adjust rtt to origin 0.
 3211                  */
 3212                 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
 3213                 if ((tp->t_srtt += delta) <= 0)
 3214                         tp->t_srtt = 1 << 2;
 3215                 /*
 3216                  * We accumulate a smoothed rtt variance (actually, a
 3217                  * smoothed mean difference), then set the retransmit
 3218                  * timer to smoothed rtt + 4 times the smoothed variance.
 3219                  * rttvar is stored as fixed point with 2 bits after the
 3220                  * binary point (scaled by 4).  The following is
 3221                  * equivalent to rfc793 smoothing with an alpha of .75
 3222                  * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
 3223                  * rfc793's wired-in beta.
 3224                  */
 3225                 if (delta < 0)
 3226                         delta = -delta;
 3227                 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
 3228                 if ((tp->t_rttvar += delta) <= 0)
 3229                         tp->t_rttvar = 1 << 2;
 3230         } else {
 3231                 /*
 3232                  * No rtt measurement yet - use the unsmoothed rtt.
 3233                  * Set the variance to half the rtt (so our first
 3234                  * retransmit happens at 3*rtt).
 3235                  */
 3236                 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
 3237                 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
 3238         }
 3239         tp->t_rtttime = 0;
 3240         tp->t_rxtshift = 0;
 3241 
 3242         /*
 3243          * the retransmit should happen at rtt + 4 * rttvar.
 3244          * Because of the way we do the smoothing, srtt and rttvar
 3245          * will each average +1/2 tick of bias.  When we compute
 3246          * the retransmit timer, we want 1/2 tick of rounding and
 3247          * 1 extra tick because of +-1/2 tick uncertainty in the
 3248          * firing of the timer.  The bias will give us exactly the
 3249          * 1.5 tick we need.  But, because the bias is
 3250          * statistical, we have to test that we don't drop below
 3251          * the minimum feasible timer (which is 2 ticks).
 3252          */
 3253         TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
 3254             max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
 3255 
 3256         /*
 3257          * We received an ack for a packet that wasn't retransmitted;
 3258          * it is probably safe to discard any error indications we've
 3259          * received recently.  This isn't quite right, but close enough
 3260          * for now (a route might have failed after we sent a segment,
 3261          * and the return path might not be symmetrical).
 3262          */
 3263         tp->t_softerror = 0;
 3264 }
 3265 
 3266 
 3267 /*
 3268  * TCP compressed state engine.  Currently used to hold compressed
 3269  * state for SYN_RECEIVED.
 3270  */
 3271 
 3272 u_long  syn_cache_count;
 3273 u_int32_t syn_hash1, syn_hash2;
 3274 
 3275 #define SYN_HASH(sa, sp, dp) \
 3276         ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
 3277                                      ((u_int32_t)(sp)))^syn_hash2)))
 3278 #ifndef INET6
 3279 #define SYN_HASHALL(hash, src, dst) \
 3280 do {                                                                    \
 3281         hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
 3282                 ((const struct sockaddr_in *)(src))->sin_port,          \
 3283                 ((const struct sockaddr_in *)(dst))->sin_port);         \
 3284 } while (/*CONSTCOND*/ 0)
 3285 #else
 3286 #define SYN_HASH6(sa, sp, dp) \
 3287         ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
 3288           (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
 3289          & 0x7fffffff)
 3290 
 3291 #define SYN_HASHALL(hash, src, dst) \
 3292 do {                                                                    \
 3293         switch ((src)->sa_family) {                                     \
 3294         case AF_INET:                                                   \
 3295                 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
 3296                         ((const struct sockaddr_in *)(src))->sin_port,  \
 3297                         ((const struct sockaddr_in *)(dst))->sin_port); \
 3298                 break;                                                  \
 3299         case AF_INET6:                                                  \
 3300                 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \
 3301                         ((const struct sockaddr_in6 *)(src))->sin6_port,        \
 3302                         ((const struct sockaddr_in6 *)(dst))->sin6_port);       \
 3303                 break;                                                  \
 3304         default:                                                        \
 3305                 hash = 0;                                               \
 3306         }                                                               \
 3307 } while (/*CONSTCOND*/0)
 3308 #endif /* INET6 */
 3309 
 3310 POOL_INIT(syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0, "synpl", NULL,
 3311     IPL_SOFTNET);
 3312 
 3313 /*
 3314  * We don't estimate RTT with SYNs, so each packet starts with the default
 3315  * RTT and each timer step has a fixed timeout value.
 3316  */
 3317 #define SYN_CACHE_TIMER_ARM(sc)                                         \
 3318 do {                                                                    \
 3319         TCPT_RANGESET((sc)->sc_rxtcur,                                  \
 3320             TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
 3321             TCPTV_REXMTMAX);                                            \
 3322         callout_reset(&(sc)->sc_timer,                                  \
 3323             (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
 3324 } while (/*CONSTCOND*/0)
 3325 
 3326 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
 3327 
 3328 static inline void
 3329 syn_cache_rm(struct syn_cache *sc)
 3330 {
 3331         TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket,
 3332             sc, sc_bucketq);
 3333         sc->sc_tp = NULL;
 3334         LIST_REMOVE(sc, sc_tpq);
 3335         tcp_syn_cache[sc->sc_bucketidx].sch_length--;
 3336         callout_stop(&sc->sc_timer);
 3337         syn_cache_count--;
 3338 }
 3339 
 3340 static inline void
 3341 syn_cache_put(struct syn_cache *sc)
 3342 {
 3343         if (sc->sc_ipopts)
 3344                 (void) m_free(sc->sc_ipopts);
 3345         rtcache_free(&sc->sc_route);
 3346         sc->sc_flags |= SCF_DEAD;
 3347         if (!callout_invoking(&sc->sc_timer))
 3348                 callout_schedule(&(sc)->sc_timer, 1);
 3349 }
 3350 
 3351 void
 3352 syn_cache_init(void)
 3353 {
 3354         int i;
 3355 
 3356         /* Initialize the hash buckets. */
 3357         for (i = 0; i < tcp_syn_cache_size; i++)
 3358                 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
 3359 }
 3360 
 3361 void
 3362 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
 3363 {
 3364         struct syn_cache_head *scp;
 3365         struct syn_cache *sc2;
 3366         int s;
 3367 
 3368         /*
 3369          * If there are no entries in the hash table, reinitialize
 3370          * the hash secrets.
 3371          */
 3372         if (syn_cache_count == 0) {
 3373                 syn_hash1 = arc4random();
 3374                 syn_hash2 = arc4random();
 3375         }
 3376 
 3377         SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
 3378         sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
 3379         scp = &tcp_syn_cache[sc->sc_bucketidx];
 3380 
 3381         /*
 3382          * Make sure that we don't overflow the per-bucket
 3383          * limit or the total cache size limit.
 3384          */
 3385         s = splsoftnet();
 3386         if (scp->sch_length >= tcp_syn_bucket_limit) {
 3387                 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW);
 3388                 /*
 3389                  * The bucket is full.  Toss the oldest element in the
 3390                  * bucket.  This will be the first entry in the bucket.
 3391                  */
 3392                 sc2 = TAILQ_FIRST(&scp->sch_bucket);
 3393 #ifdef DIAGNOSTIC
 3394                 /*
 3395                  * This should never happen; we should always find an
 3396                  * entry in our bucket.
 3397                  */
 3398                 if (sc2 == NULL)
 3399                         panic("syn_cache_insert: bucketoverflow: impossible");
 3400 #endif
 3401                 syn_cache_rm(sc2);
 3402                 syn_cache_put(sc2);     /* calls pool_put but see spl above */
 3403         } else if (syn_cache_count >= tcp_syn_cache_limit) {
 3404                 struct syn_cache_head *scp2, *sce;
 3405 
 3406                 TCP_STATINC(TCP_STAT_SC_OVERFLOWED);
 3407                 /*
 3408                  * The cache is full.  Toss the oldest entry in the
 3409                  * first non-empty bucket we can find.
 3410                  *
 3411                  * XXX We would really like to toss the oldest
 3412                  * entry in the cache, but we hope that this
 3413                  * condition doesn't happen very often.
 3414                  */
 3415                 scp2 = scp;
 3416                 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
 3417                         sce = &tcp_syn_cache[tcp_syn_cache_size];
 3418                         for (++scp2; scp2 != scp; scp2++) {
 3419                                 if (scp2 >= sce)
 3420                                         scp2 = &tcp_syn_cache[0];
 3421                                 if (! TAILQ_EMPTY(&scp2->sch_bucket))
 3422                                         break;
 3423                         }
 3424 #ifdef DIAGNOSTIC
 3425                         /*
 3426                          * This should never happen; we should always find a
 3427                          * non-empty bucket.
 3428                          */
 3429                         if (scp2 == scp)
 3430                                 panic("syn_cache_insert: cacheoverflow: "
 3431                                     "impossible");
 3432 #endif
 3433                 }
 3434                 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
 3435                 syn_cache_rm(sc2);
 3436                 syn_cache_put(sc2);     /* calls pool_put but see spl above */
 3437         }
 3438 
 3439         /*
 3440          * Initialize the entry's timer.
 3441          */
 3442         sc->sc_rxttot = 0;
 3443         sc->sc_rxtshift = 0;
 3444         SYN_CACHE_TIMER_ARM(sc);
 3445 
 3446         /* Link it from tcpcb entry */
 3447         LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
 3448 
 3449         /* Put it into the bucket. */
 3450         TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
 3451         scp->sch_length++;
 3452         syn_cache_count++;
 3453 
 3454         TCP_STATINC(TCP_STAT_SC_ADDED);
 3455         splx(s);
 3456 }
 3457 
 3458 /*
 3459  * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
 3460  * If we have retransmitted an entry the maximum number of times, expire
 3461  * that entry.
 3462  */
 3463 void
 3464 syn_cache_timer(void *arg)
 3465 {
 3466         struct syn_cache *sc = arg;
 3467 
 3468         mutex_enter(softnet_lock);
 3469         KERNEL_LOCK(1, NULL);
 3470         callout_ack(&sc->sc_timer);
 3471 
 3472         if (__predict_false(sc->sc_flags & SCF_DEAD)) {
 3473                 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE);
 3474                 callout_destroy(&sc->sc_timer);
 3475                 pool_put(&syn_cache_pool, sc);
 3476                 KERNEL_UNLOCK_ONE(NULL);
 3477                 mutex_exit(softnet_lock);
 3478                 return;
 3479         }
 3480 
 3481         if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
 3482                 /* Drop it -- too many retransmissions. */
 3483                 goto dropit;
 3484         }
 3485 
 3486         /*
 3487          * Compute the total amount of time this entry has
 3488          * been on a queue.  If this entry has been on longer
 3489          * than the keep alive timer would allow, expire it.
 3490          */
 3491         sc->sc_rxttot += sc->sc_rxtcur;
 3492         if (sc->sc_rxttot >= tcp_keepinit)
 3493                 goto dropit;
 3494 
 3495         TCP_STATINC(TCP_STAT_SC_RETRANSMITTED);
 3496         (void) syn_cache_respond(sc, NULL);
 3497 
 3498         /* Advance the timer back-off. */
 3499         sc->sc_rxtshift++;
 3500         SYN_CACHE_TIMER_ARM(sc);
 3501 
 3502         KERNEL_UNLOCK_ONE(NULL);
 3503         mutex_exit(softnet_lock);
 3504         return;
 3505 
 3506  dropit:
 3507         TCP_STATINC(TCP_STAT_SC_TIMED_OUT);
 3508         syn_cache_rm(sc);
 3509         if (sc->sc_ipopts)
 3510                 (void) m_free(sc->sc_ipopts);
 3511         rtcache_free(&sc->sc_route);
 3512         callout_destroy(&sc->sc_timer);
 3513         pool_put(&syn_cache_pool, sc);
 3514         KERNEL_UNLOCK_ONE(NULL);
 3515         mutex_exit(softnet_lock);
 3516 }
 3517 
 3518 /*
 3519  * Remove syn cache created by the specified tcb entry,
 3520  * because this does not make sense to keep them
 3521  * (if there's no tcb entry, syn cache entry will never be used)
 3522  */
 3523 void
 3524 syn_cache_cleanup(struct tcpcb *tp)
 3525 {
 3526         struct syn_cache *sc, *nsc;
 3527         int s;
 3528 
 3529         s = splsoftnet();
 3530 
 3531         for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
 3532                 nsc = LIST_NEXT(sc, sc_tpq);
 3533 
 3534 #ifdef DIAGNOSTIC
 3535                 if (sc->sc_tp != tp)
 3536                         panic("invalid sc_tp in syn_cache_cleanup");
 3537 #endif
 3538                 syn_cache_rm(sc);
 3539                 syn_cache_put(sc);      /* calls pool_put but see spl above */
 3540         }
 3541         /* just for safety */
 3542         LIST_INIT(&tp->t_sc);
 3543 
 3544         splx(s);
 3545 }
 3546 
 3547 /*
 3548  * Find an entry in the syn cache.
 3549  */
 3550 struct syn_cache *
 3551 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
 3552     struct syn_cache_head **headp)
 3553 {
 3554         struct syn_cache *sc;
 3555         struct syn_cache_head *scp;
 3556         u_int32_t hash;
 3557         int s;
 3558 
 3559         SYN_HASHALL(hash, src, dst);
 3560 
 3561         scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
 3562         *headp = scp;
 3563         s = splsoftnet();
 3564         for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
 3565              sc = TAILQ_NEXT(sc, sc_bucketq)) {
 3566                 if (sc->sc_hash != hash)
 3567                         continue;
 3568                 if (!bcmp(&sc->sc_src, src, src->sa_len) &&
 3569                     !bcmp(&sc->sc_dst, dst, dst->sa_len)) {
 3570                         splx(s);
 3571                         return (sc);
 3572                 }
 3573         }
 3574         splx(s);
 3575         return (NULL);
 3576 }
 3577 
 3578 /*
 3579  * This function gets called when we receive an ACK for a
 3580  * socket in the LISTEN state.  We look up the connection
 3581  * in the syn cache, and if its there, we pull it out of
 3582  * the cache and turn it into a full-blown connection in
 3583  * the SYN-RECEIVED state.
 3584  *
 3585  * The return values may not be immediately obvious, and their effects
 3586  * can be subtle, so here they are:
 3587  *
 3588  *      NULL    SYN was not found in cache; caller should drop the
 3589  *              packet and send an RST.
 3590  *
 3591  *      -1      We were unable to create the new connection, and are
 3592  *              aborting it.  An ACK,RST is being sent to the peer
 3593  *              (unless we got screwey sequence numbners; see below),
 3594  *              because the 3-way handshake has been completed.  Caller
 3595  *              should not free the mbuf, since we may be using it.  If
 3596  *              we are not, we will free it.
 3597  *
 3598  *      Otherwise, the return value is a pointer to the new socket
 3599  *      associated with the connection.
 3600  */
 3601 struct socket *
 3602 syn_cache_get(struct sockaddr *src, struct sockaddr *dst,
 3603     struct tcphdr *th, unsigned int hlen, unsigned int tlen,
 3604     struct socket *so, struct mbuf *m)
 3605 {
 3606         struct syn_cache *sc;
 3607         struct syn_cache_head *scp;
 3608         struct inpcb *inp = NULL;
 3609 #ifdef INET6
 3610         struct in6pcb *in6p = NULL;
 3611 #endif
 3612         struct tcpcb *tp = 0;
 3613         struct mbuf *am;
 3614         int s;
 3615         struct socket *oso;
 3616 
 3617         s = splsoftnet();
 3618         if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
 3619                 splx(s);
 3620                 return (NULL);
 3621         }
 3622 
 3623         /*
 3624          * Verify the sequence and ack numbers.  Try getting the correct
 3625          * response again.
 3626          */
 3627         if ((th->th_ack != sc->sc_iss + 1) ||
 3628             SEQ_LEQ(th->th_seq, sc->sc_irs) ||
 3629             SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
 3630                 (void) syn_cache_respond(sc, m);
 3631                 splx(s);
 3632                 return ((struct socket *)(-1));
 3633         }
 3634 
 3635         /* Remove this cache entry */
 3636         syn_cache_rm(sc);
 3637         splx(s);
 3638 
 3639         /*
 3640          * Ok, create the full blown connection, and set things up
 3641          * as they would have been set up if we had created the
 3642          * connection when the SYN arrived.  If we can't create
 3643          * the connection, abort it.
 3644          */
 3645         /*
 3646          * inp still has the OLD in_pcb stuff, set the
 3647          * v6-related flags on the new guy, too.   This is
 3648          * done particularly for the case where an AF_INET6
 3649          * socket is bound only to a port, and a v4 connection
 3650          * comes in on that port.
 3651          * we also copy the flowinfo from the original pcb
 3652          * to the new one.
 3653          */
 3654         oso = so;
 3655         so = sonewconn(so, SS_ISCONNECTED);
 3656         if (so == NULL)
 3657                 goto resetandabort;
 3658 
 3659         switch (so->so_proto->pr_domain->dom_family) {
 3660 #ifdef INET
 3661         case AF_INET:
 3662                 inp = sotoinpcb(so);
 3663                 break;
 3664 #endif
 3665 #ifdef INET6
 3666         case AF_INET6:
 3667                 in6p = sotoin6pcb(so);
 3668                 break;
 3669 #endif
 3670         }
 3671         switch (src->sa_family) {
 3672 #ifdef INET
 3673         case AF_INET:
 3674                 if (inp) {
 3675                         inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
 3676                         inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
 3677                         inp->inp_options = ip_srcroute();
 3678                         in_pcbstate(inp, INP_BOUND);
 3679                         if (inp->inp_options == NULL) {
 3680                                 inp->inp_options = sc->sc_ipopts;
 3681                                 sc->sc_ipopts = NULL;
 3682                         }
 3683                 }
 3684 #ifdef INET6
 3685                 else if (in6p) {
 3686                         /* IPv4 packet to AF_INET6 socket */
 3687                         bzero(&in6p->in6p_laddr, sizeof(in6p->in6p_laddr));
 3688                         in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
 3689                         bcopy(&((struct sockaddr_in *)dst)->sin_addr,
 3690                                 &in6p->in6p_laddr.s6_addr32[3],
 3691                                 sizeof(((struct sockaddr_in *)dst)->sin_addr));
 3692                         in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
 3693                         in6totcpcb(in6p)->t_family = AF_INET;
 3694                         if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
 3695                                 in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
 3696                         else
 3697                                 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
 3698                         in6_pcbstate(in6p, IN6P_BOUND);
 3699                 }
 3700 #endif
 3701                 break;
 3702 #endif
 3703 #ifdef INET6
 3704         case AF_INET6:
 3705                 if (in6p) {
 3706                         in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
 3707                         in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
 3708                         in6_pcbstate(in6p, IN6P_BOUND);
 3709                 }
 3710                 break;
 3711 #endif
 3712         }
 3713 #ifdef INET6
 3714         if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
 3715                 struct in6pcb *oin6p = sotoin6pcb(oso);
 3716                 /* inherit socket options from the listening socket */
 3717                 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
 3718                 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
 3719                         m_freem(in6p->in6p_options);
 3720                         in6p->in6p_options = 0;
 3721                 }
 3722                 ip6_savecontrol(in6p, &in6p->in6p_options,
 3723                         mtod(m, struct ip6_hdr *), m);
 3724         }
 3725 #endif
 3726 
 3727 #if defined(IPSEC) || defined(FAST_IPSEC)
 3728         /*
 3729          * we make a copy of policy, instead of sharing the policy,
 3730          * for better behavior in terms of SA lookup and dead SA removal.
 3731          */
 3732         if (inp) {
 3733                 /* copy old policy into new socket's */
 3734                 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
 3735                         printf("tcp_input: could not copy policy\n");
 3736         }
 3737 #ifdef INET6
 3738         else if (in6p) {
 3739                 /* copy old policy into new socket's */
 3740                 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
 3741                     in6p->in6p_sp))
 3742                         printf("tcp_input: could not copy policy\n");
 3743         }
 3744 #endif
 3745 #endif
 3746 
 3747         /*
 3748          * Give the new socket our cached route reference.
 3749          */
 3750         if (inp) {
 3751                 rtcache_copy(&inp->inp_route, &sc->sc_route);
 3752                 rtcache_free(&sc->sc_route);
 3753         }
 3754 #ifdef INET6
 3755         else {
 3756                 rtcache_copy(&in6p->in6p_route, &sc->sc_route);
 3757                 rtcache_free(&sc->sc_route);
 3758         }
 3759 #endif
 3760 
 3761         am = m_get(M_DONTWAIT, MT_SONAME);      /* XXX */
 3762         if (am == NULL)
 3763                 goto resetandabort;
 3764         MCLAIM(am, &tcp_mowner);
 3765         am->m_len = src->sa_len;
 3766         bcopy(src, mtod(am, void *), src->sa_len);
 3767         if (inp) {
 3768                 if (in_pcbconnect(inp, am, &lwp0)) {
 3769                         (void) m_free(am);
 3770                         goto resetandabort;
 3771                 }
 3772         }
 3773 #ifdef INET6
 3774         else if (in6p) {
 3775                 if (src->sa_family == AF_INET) {
 3776                         /* IPv4 packet to AF_INET6 socket */
 3777                         struct sockaddr_in6 *sin6;
 3778                         sin6 = mtod(am, struct sockaddr_in6 *);
 3779                         am->m_len = sizeof(*sin6);
 3780                         bzero(sin6, sizeof(*sin6));
 3781                         sin6->sin6_family = AF_INET6;
 3782                         sin6->sin6_len = sizeof(*sin6);
 3783                         sin6->sin6_port = ((struct sockaddr_in *)src)->sin_port;
 3784                         sin6->sin6_addr.s6_addr16[5] = htons(0xffff);
 3785                         bcopy(&((struct sockaddr_in *)src)->sin_addr,
 3786                                 &sin6->sin6_addr.s6_addr32[3],
 3787                                 sizeof(sin6->sin6_addr.s6_addr32[3]));
 3788                 }
 3789                 if (in6_pcbconnect(in6p, am, NULL)) {
 3790                         (void) m_free(am);
 3791                         goto resetandabort;
 3792                 }
 3793         }
 3794 #endif
 3795         else {
 3796                 (void) m_free(am);
 3797                 goto resetandabort;
 3798         }
 3799         (void) m_free(am);
 3800 
 3801         if (inp)
 3802                 tp = intotcpcb(inp);
 3803 #ifdef INET6
 3804         else if (in6p)
 3805                 tp = in6totcpcb(in6p);
 3806 #endif
 3807         else
 3808                 tp = NULL;
 3809         tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
 3810         if (sc->sc_request_r_scale != 15) {
 3811                 tp->requested_s_scale = sc->sc_requested_s_scale;
 3812                 tp->request_r_scale = sc->sc_request_r_scale;
 3813                 tp->snd_scale = sc->sc_requested_s_scale;
 3814                 tp->rcv_scale = sc->sc_request_r_scale;
 3815                 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
 3816         }
 3817         if (sc->sc_flags & SCF_TIMESTAMP)
 3818                 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
 3819         tp->ts_timebase = sc->sc_timebase;
 3820 
 3821         tp->t_template = tcp_template(tp);
 3822         if (tp->t_template == 0) {
 3823                 tp = tcp_drop(tp, ENOBUFS);     /* destroys socket */
 3824                 so = NULL;
 3825                 m_freem(m);
 3826                 goto abort;
 3827         }
 3828 
 3829         tp->iss = sc->sc_iss;
 3830         tp->irs = sc->sc_irs;
 3831         tcp_sendseqinit(tp);
 3832         tcp_rcvseqinit(tp);
 3833         tp->t_state = TCPS_SYN_RECEIVED;
 3834         TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit);
 3835         TCP_STATINC(TCP_STAT_ACCEPTS);
 3836 
 3837         if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack)
 3838                 tp->t_flags |= TF_WILL_SACK;
 3839 
 3840         if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn)
 3841                 tp->t_flags |= TF_ECN_PERMIT;
 3842 
 3843 #ifdef TCP_SIGNATURE
 3844         if (sc->sc_flags & SCF_SIGNATURE)
 3845                 tp->t_flags |= TF_SIGNATURE;
 3846 #endif
 3847 
 3848         /* Initialize tp->t_ourmss before we deal with the peer's! */
 3849         tp->t_ourmss = sc->sc_ourmaxseg;
 3850         tcp_mss_from_peer(tp, sc->sc_peermaxseg);
 3851 
 3852         /*
 3853          * Initialize the initial congestion window.  If we
 3854          * had to retransmit the SYN,ACK, we must initialize cwnd
 3855          * to 1 segment (i.e. the Loss Window).
 3856          */
 3857         if (sc->sc_rxtshift)
 3858                 tp->snd_cwnd = tp->t_peermss;
 3859         else {
 3860                 int ss = tcp_init_win;
 3861 #ifdef INET
 3862                 if (inp != NULL && in_localaddr(inp->inp_faddr))
 3863                         ss = tcp_init_win_local;
 3864 #endif
 3865 #ifdef INET6
 3866                 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
 3867                         ss = tcp_init_win_local;
 3868 #endif
 3869                 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
 3870         }
 3871 
 3872         tcp_rmx_rtt(tp);
 3873         tp->snd_wl1 = sc->sc_irs;
 3874         tp->rcv_up = sc->sc_irs + 1;
 3875 
 3876         /*
 3877          * This is what whould have happened in tcp_output() when
 3878          * the SYN,ACK was sent.
 3879          */
 3880         tp->snd_up = tp->snd_una;
 3881         tp->snd_max = tp->snd_nxt = tp->iss+1;
 3882         TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
 3883         if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
 3884                 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
 3885         tp->last_ack_sent = tp->rcv_nxt;
 3886         tp->t_partialacks = -1;
 3887         tp->t_dupacks = 0;
 3888 
 3889         TCP_STATINC(TCP_STAT_SC_COMPLETED);
 3890         s = splsoftnet();
 3891         syn_cache_put(sc);
 3892         splx(s);
 3893         return (so);
 3894 
 3895 resetandabort:
 3896         (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
 3897 abort:
 3898         if (so != NULL) {
 3899                 (void) soqremque(so, 1);
 3900                 (void) soabort(so);
 3901                 mutex_enter(softnet_lock);
 3902         }
 3903         s = splsoftnet();
 3904         syn_cache_put(sc);
 3905         splx(s);
 3906         TCP_STATINC(TCP_STAT_SC_ABORTED);
 3907         return ((struct socket *)(-1));
 3908 }
 3909 
 3910 /*
 3911  * This function is called when we get a RST for a
 3912  * non-existent connection, so that we can see if the
 3913  * connection is in the syn cache.  If it is, zap it.
 3914  */
 3915 
 3916 void
 3917 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th)
 3918 {
 3919         struct syn_cache *sc;
 3920         struct syn_cache_head *scp;
 3921         int s = splsoftnet();
 3922 
 3923         if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
 3924                 splx(s);
 3925                 return;
 3926         }
 3927         if (SEQ_LT(th->th_seq, sc->sc_irs) ||
 3928             SEQ_GT(th->th_seq, sc->sc_irs+1)) {
 3929                 splx(s);
 3930                 return;
 3931         }
 3932         syn_cache_rm(sc);
 3933         TCP_STATINC(TCP_STAT_SC_RESET);
 3934         syn_cache_put(sc);      /* calls pool_put but see spl above */
 3935         splx(s);
 3936 }
 3937 
 3938 void
 3939 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
 3940     struct tcphdr *th)
 3941 {
 3942         struct syn_cache *sc;
 3943         struct syn_cache_head *scp;
 3944         int s;
 3945 
 3946         s = splsoftnet();
 3947         if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
 3948                 splx(s);
 3949                 return;
 3950         }
 3951         /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
 3952         if (ntohl (th->th_seq) != sc->sc_iss) {
 3953                 splx(s);
 3954                 return;
 3955         }
 3956 
 3957         /*
 3958          * If we've retransmitted 3 times and this is our second error,
 3959          * we remove the entry.  Otherwise, we allow it to continue on.
 3960          * This prevents us from incorrectly nuking an entry during a
 3961          * spurious network outage.
 3962          *
 3963          * See tcp_notify().
 3964          */
 3965         if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
 3966                 sc->sc_flags |= SCF_UNREACH;
 3967                 splx(s);
 3968                 return;
 3969         }
 3970 
 3971         syn_cache_rm(sc);
 3972         TCP_STATINC(TCP_STAT_SC_UNREACH);
 3973         syn_cache_put(sc);      /* calls pool_put but see spl above */
 3974         splx(s);
 3975 }
 3976 
 3977 /*
 3978  * Given a LISTEN socket and an inbound SYN request, add
 3979  * this to the syn cache, and send back a segment:
 3980  *      <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
 3981  * to the source.
 3982  *
 3983  * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
 3984  * Doing so would require that we hold onto the data and deliver it
 3985  * to the application.  However, if we are the target of a SYN-flood
 3986  * DoS attack, an attacker could send data which would eventually
 3987  * consume all available buffer space if it were ACKed.  By not ACKing
 3988  * the data, we avoid this DoS scenario.
 3989  */
 3990 
 3991 int
 3992 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
 3993     unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp,
 3994     int optlen, struct tcp_opt_info *oi)
 3995 {
 3996         struct tcpcb tb, *tp;
 3997         long win;
 3998         struct syn_cache *sc;
 3999         struct syn_cache_head *scp;
 4000         struct mbuf *ipopts;
 4001         struct tcp_opt_info opti;
 4002         int s;
 4003 
 4004         tp = sototcpcb(so);
 4005 
 4006         bzero(&opti, sizeof(opti));
 4007 
 4008         /*
 4009          * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
 4010          *
 4011          * Note this check is performed in tcp_input() very early on.
 4012          */
 4013 
 4014         /*
 4015          * Initialize some local state.
 4016          */
 4017         win = sbspace(&so->so_rcv);
 4018         if (win > TCP_MAXWIN)
 4019                 win = TCP_MAXWIN;
 4020 
 4021         switch (src->sa_family) {
 4022 #ifdef INET
 4023         case AF_INET:
 4024                 /*
 4025                  * Remember the IP options, if any.
 4026                  */
 4027                 ipopts = ip_srcroute();
 4028                 break;
 4029 #endif
 4030         default:
 4031                 ipopts = NULL;
 4032         }
 4033 
 4034 #ifdef TCP_SIGNATURE
 4035         if (optp || (tp->t_flags & TF_SIGNATURE))
 4036 #else
 4037         if (optp)
 4038 #endif
 4039         {
 4040                 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
 4041 #ifdef TCP_SIGNATURE
 4042                 tb.t_flags |= (tp->t_flags & TF_SIGNATURE);
 4043 #endif
 4044                 tb.t_state = TCPS_LISTEN;
 4045                 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len -
 4046                     sizeof(struct tcphdr) - optlen - hlen, oi) < 0)
 4047                         return (0);
 4048         } else
 4049                 tb.t_flags = 0;
 4050 
 4051         /*
 4052          * See if we already have an entry for this connection.
 4053          * If we do, resend the SYN,ACK.  We do not count this
 4054          * as a retransmission (XXX though maybe we should).
 4055          */
 4056         if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
 4057                 TCP_STATINC(TCP_STAT_SC_DUPESYN);
 4058                 if (ipopts) {
 4059                         /*
 4060                          * If we were remembering a previous source route,
 4061                          * forget it and use the new one we've been given.
 4062                          */
 4063                         if (sc->sc_ipopts)
 4064                                 (void) m_free(sc->sc_ipopts);
 4065                         sc->sc_ipopts = ipopts;
 4066                 }
 4067                 sc->sc_timestamp = tb.ts_recent;
 4068                 if (syn_cache_respond(sc, m) == 0) {
 4069                         uint64_t *tcps = TCP_STAT_GETREF();
 4070                         tcps[TCP_STAT_SNDACKS]++;
 4071                         tcps[TCP_STAT_SNDTOTAL]++;
 4072                         TCP_STAT_PUTREF();
 4073                 }
 4074                 return (1);
 4075         }
 4076 
 4077         s = splsoftnet();
 4078         sc = pool_get(&syn_cache_pool, PR_NOWAIT);
 4079         splx(s);
 4080         if (sc == NULL) {
 4081                 if (ipopts)
 4082                         (void) m_free(ipopts);
 4083                 return (0);
 4084         }
 4085 
 4086         /*
 4087          * Fill in the cache, and put the necessary IP and TCP
 4088          * options into the reply.
 4089          */
 4090         bzero(sc, sizeof(struct syn_cache));
 4091         callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
 4092         bcopy(src, &sc->sc_src, src->sa_len);
 4093         bcopy(dst, &sc->sc_dst, dst->sa_len);
 4094         sc->sc_flags = 0;
 4095         sc->sc_ipopts = ipopts;
 4096         sc->sc_irs = th->th_seq;
 4097         switch (src->sa_family) {
 4098 #ifdef INET
 4099         case AF_INET:
 4100             {
 4101                 struct sockaddr_in *srcin = (void *) src;
 4102                 struct sockaddr_in *dstin = (void *) dst;
 4103 
 4104                 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
 4105                     &srcin->sin_addr, dstin->sin_port,
 4106                     srcin->sin_port, sizeof(dstin->sin_addr), 0);
 4107                 break;
 4108             }
 4109 #endif /* INET */
 4110 #ifdef INET6
 4111         case AF_INET6:
 4112             {
 4113                 struct sockaddr_in6 *srcin6 = (void *) src;
 4114                 struct sockaddr_in6 *dstin6 = (void *) dst;
 4115 
 4116                 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
 4117                     &srcin6->sin6_addr, dstin6->sin6_port,
 4118                     srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
 4119                 break;
 4120             }
 4121 #endif /* INET6 */
 4122         }
 4123         sc->sc_peermaxseg = oi->maxseg;
 4124         sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
 4125                                                 m->m_pkthdr.rcvif : NULL,
 4126                                                 sc->sc_src.sa.sa_family);
 4127         sc->sc_win = win;
 4128         sc->sc_timebase = tcp_now - 1;  /* see tcp_newtcpcb() */
 4129         sc->sc_timestamp = tb.ts_recent;
 4130         if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
 4131             (TF_REQ_TSTMP|TF_RCVD_TSTMP))
 4132                 sc->sc_flags |= SCF_TIMESTAMP;
 4133         if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
 4134             (TF_RCVD_SCALE|TF_REQ_SCALE)) {
 4135                 sc->sc_requested_s_scale = tb.requested_s_scale;
 4136                 sc->sc_request_r_scale = 0;
 4137                 /*
 4138                  * Pick the smallest possible scaling factor that
 4139                  * will still allow us to scale up to sb_max.
 4140                  *
 4141                  * We do this because there are broken firewalls that
 4142                  * will corrupt the window scale option, leading to
 4143                  * the other endpoint believing that our advertised
 4144                  * window is unscaled.  At scale factors larger than
 4145                  * 5 the unscaled window will drop below 1500 bytes,
 4146                  * leading to serious problems when traversing these
 4147                  * broken firewalls.
 4148                  *
 4149                  * With the default sbmax of 256K, a scale factor
 4150                  * of 3 will be chosen by this algorithm.  Those who
 4151                  * choose a larger sbmax should watch out
 4152                  * for the compatiblity problems mentioned above.
 4153                  *
 4154                  * RFC1323: The Window field in a SYN (i.e., a <SYN>
 4155                  * or <SYN,ACK>) segment itself is never scaled.
 4156                  */
 4157                 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
 4158                     (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
 4159                         sc->sc_request_r_scale++;
 4160         } else {
 4161                 sc->sc_requested_s_scale = 15;
 4162                 sc->sc_request_r_scale = 15;
 4163         }
 4164         if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack)
 4165                 sc->sc_flags |= SCF_SACK_PERMIT;
 4166 
 4167         /*
 4168          * ECN setup packet recieved.
 4169          */
 4170         if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn)
 4171                 sc->sc_flags |= SCF_ECN_PERMIT;
 4172 
 4173 #ifdef TCP_SIGNATURE
 4174         if (tb.t_flags & TF_SIGNATURE)
 4175                 sc->sc_flags |= SCF_SIGNATURE;
 4176 #endif
 4177         sc->sc_tp = tp;
 4178         if (syn_cache_respond(sc, m) == 0) {
 4179                 uint64_t *tcps = TCP_STAT_GETREF();
 4180                 tcps[TCP_STAT_SNDACKS]++;
 4181                 tcps[TCP_STAT_SNDTOTAL]++;
 4182                 TCP_STAT_PUTREF();
 4183                 syn_cache_insert(sc, tp);
 4184         } else {
 4185                 s = splsoftnet();
 4186                 /*
 4187                  * syn_cache_put() will try to schedule the timer, so
 4188                  * we need to initialize it
 4189                  */
 4190                 SYN_CACHE_TIMER_ARM(sc);
 4191                 syn_cache_put(sc);
 4192                 splx(s);
 4193                 TCP_STATINC(TCP_STAT_SC_DROPPED);
 4194         }
 4195         return (1);
 4196 }
 4197 
 4198 int
 4199 syn_cache_respond(struct syn_cache *sc, struct mbuf *m)
 4200 {
 4201 #ifdef INET6
 4202         struct rtentry *rt;
 4203 #endif
 4204         struct route *ro;
 4205         u_int8_t *optp;
 4206         int optlen, error;
 4207         u_int16_t tlen;
 4208         struct ip *ip = NULL;
 4209 #ifdef INET6
 4210         struct ip6_hdr *ip6 = NULL;
 4211 #endif
 4212         struct tcpcb *tp = NULL;
 4213         struct tcphdr *th;
 4214         u_int hlen;
 4215         struct socket *so;
 4216 
 4217         ro = &sc->sc_route;
 4218         switch (sc->sc_src.sa.sa_family) {
 4219         case AF_INET:
 4220                 hlen = sizeof(struct ip);
 4221                 break;
 4222 #ifdef INET6
 4223         case AF_INET6:
 4224                 hlen = sizeof(struct ip6_hdr);
 4225                 break;
 4226 #endif
 4227         default:
 4228                 if (m)
 4229                         m_freem(m);
 4230                 return (EAFNOSUPPORT);
 4231         }
 4232 
 4233         /* Compute the size of the TCP options. */
 4234         optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
 4235             ((sc->sc_flags & SCF_SACK_PERMIT) ? (TCPOLEN_SACK_PERMITTED + 2) : 0) +
 4236 #ifdef TCP_SIGNATURE
 4237             ((sc->sc_flags & SCF_SIGNATURE) ? (TCPOLEN_SIGNATURE + 2) : 0) +
 4238 #endif
 4239             ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
 4240 
 4241         tlen = hlen + sizeof(struct tcphdr) + optlen;
 4242 
 4243         /*
 4244          * Create the IP+TCP header from scratch.
 4245          */
 4246         if (m)
 4247                 m_freem(m);
 4248 #ifdef DIAGNOSTIC
 4249         if (max_linkhdr + tlen > MCLBYTES)
 4250                 return (ENOBUFS);
 4251 #endif
 4252         MGETHDR(m, M_DONTWAIT, MT_DATA);
 4253         if (m && tlen > MHLEN) {
 4254                 MCLGET(m, M_DONTWAIT);
 4255                 if ((m->m_flags & M_EXT) == 0) {
 4256                         m_freem(m);
 4257                         m = NULL;
 4258                 }
 4259         }
 4260         if (m == NULL)
 4261                 return (ENOBUFS);
 4262         MCLAIM(m, &tcp_tx_mowner);
 4263 
 4264         /* Fixup the mbuf. */
 4265         m->m_data += max_linkhdr;
 4266         m->m_len = m->m_pkthdr.len = tlen;
 4267         if (sc->sc_tp) {
 4268                 tp = sc->sc_tp;
 4269                 if (tp->t_inpcb)
 4270                         so = tp->t_inpcb->inp_socket;
 4271 #ifdef INET6
 4272                 else if (tp->t_in6pcb)
 4273                         so = tp->t_in6pcb->in6p_socket;
 4274 #endif
 4275                 else
 4276                         so = NULL;
 4277         } else
 4278                 so = NULL;
 4279         m->m_pkthdr.rcvif = NULL;
 4280         memset(mtod(m, u_char *), 0, tlen);
 4281 
 4282         switch (sc->sc_src.sa.sa_family) {
 4283         case AF_INET:
 4284                 ip = mtod(m, struct ip *);
 4285                 ip->ip_v = 4;
 4286                 ip->ip_dst = sc->sc_src.sin.sin_addr;
 4287                 ip->ip_src = sc->sc_dst.sin.sin_addr;
 4288                 ip->ip_p = IPPROTO_TCP;
 4289                 th = (struct tcphdr *)(ip + 1);
 4290                 th->th_dport = sc->sc_src.sin.sin_port;
 4291                 th->th_sport = sc->sc_dst.sin.sin_port;
 4292                 break;
 4293 #ifdef INET6
 4294         case AF_INET6:
 4295                 ip6 = mtod(m, struct ip6_hdr *);
 4296                 ip6->ip6_vfc = IPV6_VERSION;
 4297                 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
 4298                 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
 4299                 ip6->ip6_nxt = IPPROTO_TCP;
 4300                 /* ip6_plen will be updated in ip6_output() */
 4301                 th = (struct tcphdr *)(ip6 + 1);
 4302                 th->th_dport = sc->sc_src.sin6.sin6_port;
 4303                 th->th_sport = sc->sc_dst.sin6.sin6_port;
 4304                 break;
 4305 #endif
 4306         default:
 4307                 th = NULL;
 4308         }
 4309 
 4310         th->th_seq = htonl(sc->sc_iss);
 4311         th->th_ack = htonl(sc->sc_irs + 1);
 4312         th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
 4313         th->th_flags = TH_SYN|TH_ACK;
 4314         th->th_win = htons(sc->sc_win);
 4315         /* th_sum already 0 */
 4316         /* th_urp already 0 */
 4317 
 4318         /* Tack on the TCP options. */
 4319         optp = (u_int8_t *)(th + 1);
 4320         *optp++ = TCPOPT_MAXSEG;
 4321         *optp++ = 4;
 4322         *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
 4323         *optp++ = sc->sc_ourmaxseg & 0xff;
 4324 
 4325         if (sc->sc_request_r_scale != 15) {
 4326                 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
 4327                     TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
 4328                     sc->sc_request_r_scale);
 4329                 optp += 4;
 4330         }
 4331 
 4332         if (sc->sc_flags & SCF_TIMESTAMP) {
 4333                 u_int32_t *lp = (u_int32_t *)(optp);
 4334                 /* Form timestamp option as shown in appendix A of RFC 1323. */
 4335                 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
 4336                 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
 4337                 *lp   = htonl(sc->sc_timestamp);
 4338                 optp += TCPOLEN_TSTAMP_APPA;
 4339         }
 4340 
 4341         if (sc->sc_flags & SCF_SACK_PERMIT) {
 4342                 u_int8_t *p = optp;
 4343 
 4344                 /* Let the peer know that we will SACK. */
 4345                 p[0] = TCPOPT_SACK_PERMITTED;
 4346                 p[1] = 2;
 4347                 p[2] = TCPOPT_NOP;
 4348                 p[3] = TCPOPT_NOP;
 4349                 optp += 4;
 4350         }
 4351 
 4352         /*
 4353          * Send ECN SYN-ACK setup packet.
 4354          * Routes can be asymetric, so, even if we receive a packet
 4355          * with ECE and CWR set, we must not assume no one will block
 4356          * the ECE packet we are about to send.
 4357          */
 4358         if ((sc->sc_flags & SCF_ECN_PERMIT) && tp &&
 4359             SEQ_GEQ(tp->snd_nxt, tp->snd_max)) {
 4360                 th->th_flags |= TH_ECE;
 4361                 TCP_STATINC(TCP_STAT_ECN_SHS);
 4362 
 4363                 /*
 4364                  * draft-ietf-tcpm-ecnsyn-00.txt
 4365                  *
 4366                  * "[...] a TCP node MAY respond to an ECN-setup
 4367                  * SYN packet by setting ECT in the responding
 4368                  * ECN-setup SYN/ACK packet, indicating to routers 
 4369                  * that the SYN/ACK packet is ECN-Capable.
 4370                  * This allows a congested router along the path
 4371                  * to mark the packet instead of dropping the
 4372                  * packet as an indication of congestion."
 4373                  *
 4374                  * "[...] There can be a great benefit in setting
 4375                  * an ECN-capable codepoint in SYN/ACK packets [...]
 4376                  * Congestion is  most likely to occur in
 4377                  * the server-to-client direction.  As a result,
 4378                  * setting an ECN-capable codepoint in SYN/ACK
 4379                  * packets can reduce the occurence of three-second
 4380                  * retransmit timeouts resulting from the drop
 4381                  * of SYN/ACK packets."
 4382                  *
 4383                  * Page 4 and 6, January 2006.
 4384                  */
 4385 
 4386                 switch (sc->sc_src.sa.sa_family) {
 4387 #ifdef INET
 4388                 case AF_INET:
 4389                         ip->ip_tos |= IPTOS_ECN_ECT0;
 4390                         break;
 4391 #endif
 4392 #ifdef INET6
 4393                 case AF_INET6:
 4394                         ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
 4395                         break;
 4396 #endif
 4397                 }
 4398                 TCP_STATINC(TCP_STAT_ECN_ECT);
 4399         }
 4400 
 4401 #ifdef TCP_SIGNATURE
 4402         if (sc->sc_flags & SCF_SIGNATURE) {
 4403                 struct secasvar *sav;
 4404                 u_int8_t *sigp;
 4405 
 4406                 sav = tcp_signature_getsav(m, th);
 4407 
 4408                 if (sav == NULL) {
 4409                         if (m)
 4410                                 m_freem(m);
 4411                         return (EPERM);
 4412                 }
 4413 
 4414                 *optp++ = TCPOPT_SIGNATURE;
 4415                 *optp++ = TCPOLEN_SIGNATURE;
 4416                 sigp = optp;
 4417                 bzero(optp, TCP_SIGLEN);
 4418                 optp += TCP_SIGLEN;
 4419                 *optp++ = TCPOPT_NOP;
 4420                 *optp++ = TCPOPT_EOL;
 4421 
 4422                 (void)tcp_signature(m, th, hlen, sav, sigp);
 4423 
 4424                 key_sa_recordxfer(sav, m);
 4425 #ifdef FAST_IPSEC
 4426                 KEY_FREESAV(&sav);
 4427 #else
 4428                 key_freesav(sav);
 4429 #endif
 4430         }
 4431 #endif
 4432 
 4433         /* Compute the packet's checksum. */
 4434         switch (sc->sc_src.sa.sa_family) {
 4435         case AF_INET:
 4436                 ip->ip_len = htons(tlen - hlen);
 4437                 th->th_sum = 0;
 4438                 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
 4439                 break;
 4440 #ifdef INET6
 4441         case AF_INET6:
 4442                 ip6->ip6_plen = htons(tlen - hlen);
 4443                 th->th_sum = 0;
 4444                 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
 4445                 break;
 4446 #endif
 4447         }
 4448 
 4449         /*
 4450          * Fill in some straggling IP bits.  Note the stack expects
 4451          * ip_len to be in host order, for convenience.
 4452          */
 4453         switch (sc->sc_src.sa.sa_family) {
 4454 #ifdef INET
 4455         case AF_INET:
 4456                 ip->ip_len = htons(tlen);
 4457                 ip->ip_ttl = ip_defttl;
 4458                 /* XXX tos? */
 4459                 break;
 4460 #endif
 4461 #ifdef INET6
 4462         case AF_INET6:
 4463                 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
 4464                 ip6->ip6_vfc |= IPV6_VERSION;
 4465                 ip6->ip6_plen = htons(tlen - hlen);
 4466                 /* ip6_hlim will be initialized afterwards */
 4467                 /* XXX flowlabel? */
 4468                 break;
 4469 #endif
 4470         }
 4471 
 4472         /* XXX use IPsec policy on listening socket, on SYN ACK */
 4473         tp = sc->sc_tp;
 4474 
 4475         switch (sc->sc_src.sa.sa_family) {
 4476 #ifdef INET
 4477         case AF_INET:
 4478                 error = ip_output(m, sc->sc_ipopts, ro,
 4479                     (ip_mtudisc ? IP_MTUDISC : 0),
 4480                     (struct ip_moptions *)NULL, so);
 4481                 break;
 4482 #endif
 4483 #ifdef INET6
 4484         case AF_INET6:
 4485                 ip6->ip6_hlim = in6_selecthlim(NULL,
 4486                                 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp
 4487                                                                     : NULL);
 4488 
 4489                 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, so, NULL);
 4490                 break;
 4491 #endif
 4492         default:
 4493                 error = EAFNOSUPPORT;
 4494                 break;
 4495         }
 4496         return (error);
 4497 }

Cache object: c394606657c8cb6360b3d8e346761321


[ source navigation ] [ diff markup ] [ identifier search ] [ freetext search ] [ file search ] [ list types ] [ track identifier ]


This page is part of the FreeBSD/Linux Linux Kernel Cross-Reference, and was automatically generated using a modified version of the LXR engine.