sys/netinet/tcp_input.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
   3  *      The Regents of the University of California.  All rights reserved.
   4  * Copyright (c) 2007-2008,2010
   5  *      Swinburne University of Technology, Melbourne, Australia.
   6  * Copyright (c) 2009-2010 Lawrence Stewart <lstewart@freebsd.org>
   7  * Copyright (c) 2010 The FreeBSD Foundation
   8  * Copyright (c) 2010-2011 Juniper Networks, Inc.
   9  * All rights reserved.
  10  *
  11  * Portions of this software were developed at the Centre for Advanced Internet
  12  * Architectures, Swinburne University of Technology, by Lawrence Stewart,
  13  * James Healy and David Hayes, made possible in part by a grant from the Cisco
  14  * University Research Program Fund at Community Foundation Silicon Valley.
  15  *
  16  * Portions of this software were developed at the Centre for Advanced
  17  * Internet Architectures, Swinburne University of Technology, Melbourne,
  18  * Australia by David Hayes under sponsorship from the FreeBSD Foundation.
  19  *
  20  * Portions of this software were developed by Robert N. M. Watson under
  21  * contract to Juniper Networks, Inc.
  22  *
  23  * Redistribution and use in source and binary forms, with or without
  24  * modification, are permitted provided that the following conditions
  25  * are met:
  26  * 1. Redistributions of source code must retain the above copyright
  27  *    notice, this list of conditions and the following disclaimer.
  28  * 2. Redistributions in binary form must reproduce the above copyright
  29  *    notice, this list of conditions and the following disclaimer in the
  30  *    documentation and/or other materials provided with the distribution.
  31  * 4. Neither the name of the University nor the names of its contributors
  32  *    may be used to endorse or promote products derived from this software
  33  *    without specific prior written permission.
  34  *
  35  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  36  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  37  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  38  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  39  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  40  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  41  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  42  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  43  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  44  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  45  * SUCH DAMAGE.
  46  *
  47  *      @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
  48  */
  49
  50 #include <sys/cdefs.h>
  51 __FBSDID("$FreeBSD$");
  52
  53 #include "opt_ipfw.h"           /* for ipfw_fwd */
  54 #include "opt_inet.h"
  55 #include "opt_inet6.h"
  56 #include "opt_ipsec.h"
  57 #include "opt_tcpdebug.h"
  58
  59 #include <sys/param.h>
  60 #include <sys/kernel.h>
  61 #include <sys/hhook.h>
  62 #include <sys/malloc.h>
  63 #include <sys/mbuf.h>
  64 #include <sys/proc.h>           /* for proc0 declaration */
  65 #include <sys/protosw.h>
  66 #include <sys/sdt.h>
  67 #include <sys/signalvar.h>
  68 #include <sys/socket.h>
  69 #include <sys/socketvar.h>
  70 #include <sys/sysctl.h>
  71 #include <sys/syslog.h>
  72 #include <sys/systm.h>
  73
  74 #include <machine/cpu.h>        /* before tcp_seq.h, for tcp_random18() */
  75
  76 #include <vm/uma.h>
  77
  78 #include <net/if.h>
  79 #include <net/if_var.h>
  80 #include <net/route.h>
  81 #include <net/vnet.h>
  82
  83 #define TCPSTATES               /* for logging */
  84
  85 #include <netinet/cc.h>
  86 #include <netinet/in.h>
  87 #include <netinet/in_kdtrace.h>
  88 #include <netinet/in_pcb.h>
  89 #include <netinet/in_systm.h>
  90 #include <netinet/in_var.h>
  91 #include <netinet/ip.h>
  92 #include <netinet/ip_icmp.h>    /* required for icmp_var.h */
  93 #include <netinet/icmp_var.h>   /* for ICMP_BANDLIM */
  94 #include <netinet/ip_var.h>
  95 #include <netinet/ip_options.h>
  96 #include <netinet/ip6.h>
  97 #include <netinet/icmp6.h>
  98 #include <netinet6/in6_pcb.h>
  99 #include <netinet6/ip6_var.h>
 100 #include <netinet6/nd6.h>
 101 #include <netinet/tcp_fsm.h>
 102 #include <netinet/tcp_seq.h>
 103 #include <netinet/tcp_timer.h>
 104 #include <netinet/tcp_var.h>
 105 #include <netinet6/tcp6_var.h>
 106 #include <netinet/tcpip.h>
 107 #include <netinet/tcp_syncache.h>
 108 #ifdef TCPDEBUG
 109 #include <netinet/tcp_debug.h>
 110 #endif /* TCPDEBUG */
 111 #ifdef TCP_OFFLOAD
 112 #include <netinet/tcp_offload.h>
 113 #endif
 114
 115 #ifdef IPSEC
 116 #include <netipsec/ipsec.h>
 117 #include <netipsec/ipsec6.h>
 118 #endif /*IPSEC*/
 119
 120 #include <machine/in_cksum.h>
 121
 122 #include <security/mac/mac_framework.h>
 123
 124 const int tcprexmtthresh = 3;
 125
 126 int tcp_log_in_vain = 0;
 127 SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW,
 128     &tcp_log_in_vain, 0,
 129     "Log all incoming TCP segments to closed ports");
 130
 131 VNET_DEFINE(int, blackhole) = 0;
 132 #define V_blackhole             VNET(blackhole)
 133 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW,
 134     &VNET_NAME(blackhole), 0,
 135     "Do not send RST on segments to closed ports");
 136
 137 VNET_DEFINE(int, tcp_delack_enabled) = 1;
 138 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
 139     &VNET_NAME(tcp_delack_enabled), 0,
 140     "Delay ACK to try and piggyback it onto a data packet");
 141
 142 VNET_DEFINE(int, drop_synfin) = 0;
 143 #define V_drop_synfin           VNET(drop_synfin)
 144 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
 145     &VNET_NAME(drop_synfin), 0,
 146     "Drop TCP packets with SYN+FIN set");
 147
 148 VNET_DEFINE(int, tcp_do_rfc3042) = 1;
 149 #define V_tcp_do_rfc3042        VNET(tcp_do_rfc3042)
 150 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, rfc3042, CTLFLAG_RW,
 151     &VNET_NAME(tcp_do_rfc3042), 0,
 152     "Enable RFC 3042 (Limited Transmit)");
 153
 154 VNET_DEFINE(int, tcp_do_rfc3390) = 1;
 155 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, rfc3390, CTLFLAG_RW,
 156     &VNET_NAME(tcp_do_rfc3390), 0,
 157     "Enable RFC 3390 (Increasing TCP's Initial Congestion Window)");
 158
 159 SYSCTL_NODE(_net_inet_tcp, OID_AUTO, experimental, CTLFLAG_RW, 0,
 160     "Experimental TCP extensions");
 161
 162 VNET_DEFINE(int, tcp_do_initcwnd10) = 1;
 163 SYSCTL_VNET_INT(_net_inet_tcp_experimental, OID_AUTO, initcwnd10, CTLFLAG_RW,
 164     &VNET_NAME(tcp_do_initcwnd10), 0,
 165     "Enable RFC 6928 (Increasing initial CWND to 10)");
 166
 167 VNET_DEFINE(int, tcp_do_rfc3465) = 1;
 168 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, rfc3465, CTLFLAG_RW,
 169     &VNET_NAME(tcp_do_rfc3465), 0,
 170     "Enable RFC 3465 (Appropriate Byte Counting)");
 171
 172 VNET_DEFINE(int, tcp_abc_l_var) = 2;
 173 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, abc_l_var, CTLFLAG_RW,
 174     &VNET_NAME(tcp_abc_l_var), 2,
 175     "Cap the max cwnd increment during slow-start to this number of segments");
 176
 177 static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, ecn, CTLFLAG_RW, 0, "TCP ECN");
 178
 179 VNET_DEFINE(int, tcp_do_ecn) = 0;
 180 SYSCTL_VNET_INT(_net_inet_tcp_ecn, OID_AUTO, enable, CTLFLAG_RW,
 181     &VNET_NAME(tcp_do_ecn), 0,
 182     "TCP ECN support");
 183
 184 VNET_DEFINE(int, tcp_ecn_maxretries) = 1;
 185 SYSCTL_VNET_INT(_net_inet_tcp_ecn, OID_AUTO, maxretries, CTLFLAG_RW,
 186     &VNET_NAME(tcp_ecn_maxretries), 0,
 187     "Max retries before giving up on ECN");
 188
 189 VNET_DEFINE(int, tcp_insecure_rst) = 0;
 190 #define V_tcp_insecure_rst      VNET(tcp_insecure_rst)
 191 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, insecure_rst, CTLFLAG_RW,
 192     &VNET_NAME(tcp_insecure_rst), 0,
 193     "Follow the old (insecure) criteria for accepting RST packets");
 194
 195 VNET_DEFINE(int, tcp_recvspace) = 1024*64;
 196 #define V_tcp_recvspace VNET(tcp_recvspace)
 197 SYSCTL_VNET_INT(_net_inet_tcp, TCPCTL_RECVSPACE, recvspace, CTLFLAG_RW,
 198     &VNET_NAME(tcp_recvspace), 0, "Initial receive socket buffer size");
 199
 200 VNET_DEFINE(int, tcp_do_autorcvbuf) = 1;
 201 #define V_tcp_do_autorcvbuf     VNET(tcp_do_autorcvbuf)
 202 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_RW,
 203     &VNET_NAME(tcp_do_autorcvbuf), 0,
 204     "Enable automatic receive buffer sizing");
 205
 206 VNET_DEFINE(int, tcp_autorcvbuf_inc) = 16*1024;
 207 #define V_tcp_autorcvbuf_inc    VNET(tcp_autorcvbuf_inc)
 208 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, recvbuf_inc, CTLFLAG_RW,
 209     &VNET_NAME(tcp_autorcvbuf_inc), 0,
 210     "Incrementor step size of automatic receive buffer");
 211
 212 VNET_DEFINE(int, tcp_autorcvbuf_max) = 2*1024*1024;
 213 #define V_tcp_autorcvbuf_max    VNET(tcp_autorcvbuf_max)
 214 SYSCTL_VNET_INT(_net_inet_tcp, OID_AUTO, recvbuf_max, CTLFLAG_RW,
 215     &VNET_NAME(tcp_autorcvbuf_max), 0,
 216     "Max size of automatic receive buffer");
 217
 218 VNET_DEFINE(struct inpcbhead, tcb);
 219 #define tcb6    tcb  /* for KAME src sync over BSD*'s */
 220 VNET_DEFINE(struct inpcbinfo, tcbinfo);
 221
 222 static void      tcp_dooptions(struct tcpopt *, u_char *, int, int);
 223 static void      tcp_do_segment(struct mbuf *, struct tcphdr *,
 224                      struct socket *, struct tcpcb *, int, int, uint8_t,
 225                      int);
 226 static void      tcp_dropwithreset(struct mbuf *, struct tcphdr *,
 227                      struct tcpcb *, int, int);
 228 static void      tcp_pulloutofband(struct socket *,
 229                      struct tcphdr *, struct mbuf *, int);
 230 static void      tcp_xmit_timer(struct tcpcb *, int);
 231 static void      tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *);
 232 static void inline      cc_ack_received(struct tcpcb *tp, struct tcphdr *th,
 233                             uint16_t type);
 234 static void inline      cc_conn_init(struct tcpcb *tp);
 235 static void inline      cc_post_recovery(struct tcpcb *tp, struct tcphdr *th);
 236 static void inline      hhook_run_tcp_est_in(struct tcpcb *tp,
 237                             struct tcphdr *th, struct tcpopt *to);
 238
 239 /*
 240  * TCP statistics are stored in an "array" of counter(9)s.
 241  */
 242 VNET_PCPUSTAT_DEFINE(struct tcpstat, tcpstat);
 243 VNET_PCPUSTAT_SYSINIT(tcpstat);
 244 SYSCTL_VNET_PCPUSTAT(_net_inet_tcp, TCPCTL_STATS, stats, struct tcpstat,
 245     tcpstat, "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
 246
 247 #ifdef VIMAGE
 248 VNET_PCPUSTAT_SYSUNINIT(tcpstat);
 249 #endif /* VIMAGE */
 250 /*
 251  * Kernel module interface for updating tcpstat.  The argument is an index
 252  * into tcpstat treated as an array.
 253  */
 254 void
 255 kmod_tcpstat_inc(int statnum)
 256 {
 257
 258         counter_u64_add(VNET(tcpstat)[statnum], 1);
 259 }
 260
 261 /*
 262  * Wrapper for the TCP established input helper hook.
 263  */
 264 static void inline
 265 hhook_run_tcp_est_in(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to)
 266 {
 267         struct tcp_hhook_data hhook_data;
 268
 269         if (V_tcp_hhh[HHOOK_TCP_EST_IN]->hhh_nhooks > 0) {
 270                 hhook_data.tp = tp;
 271                 hhook_data.th = th;
 272                 hhook_data.to = to;
 273
 274                 hhook_run_hooks(V_tcp_hhh[HHOOK_TCP_EST_IN], &hhook_data,
 275                     tp->osd);
 276         }
 277 }
 278
 279 /*
 280  * CC wrapper hook functions
 281  */
 282 static void inline
 283 cc_ack_received(struct tcpcb *tp, struct tcphdr *th, uint16_t type)
 284 {
 285         INP_WLOCK_ASSERT(tp->t_inpcb);
 286
 287         tp->ccv->bytes_this_ack = BYTES_THIS_ACK(tp, th);
 288         if (tp->snd_cwnd <= tp->snd_wnd)
 289                 tp->ccv->flags |= CCF_CWND_LIMITED;
 290         else
 291                 tp->ccv->flags &= ~CCF_CWND_LIMITED;
 292
 293         if (type == CC_ACK) {
 294                 if (tp->snd_cwnd > tp->snd_ssthresh) {
 295                         tp->t_bytes_acked += min(tp->ccv->bytes_this_ack,
 296                              V_tcp_abc_l_var * tp->t_maxseg);
 297                         if (tp->t_bytes_acked >= tp->snd_cwnd) {
 298                                 tp->t_bytes_acked -= tp->snd_cwnd;
 299                                 tp->ccv->flags |= CCF_ABC_SENTAWND;
 300                         }
 301                 } else {
 302                                 tp->ccv->flags &= ~CCF_ABC_SENTAWND;
 303                                 tp->t_bytes_acked = 0;
 304                 }
 305         }
 306
 307         if (CC_ALGO(tp)->ack_received != NULL) {
 308                 /* XXXLAS: Find a way to live without this */
 309                 tp->ccv->curack = th->th_ack;
 310                 CC_ALGO(tp)->ack_received(tp->ccv, type);
 311         }
 312 }
 313
 314 static void inline
 315 cc_conn_init(struct tcpcb *tp)
 316 {
 317         struct hc_metrics_lite metrics;
 318         struct inpcb *inp = tp->t_inpcb;
 319         int rtt;
 320
 321         INP_WLOCK_ASSERT(tp->t_inpcb);
 322
 323         tcp_hc_get(&inp->inp_inc, &metrics);
 324
 325         if (tp->t_srtt == 0 && (rtt = metrics.rmx_rtt)) {
 326                 tp->t_srtt = rtt;
 327                 tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE;
 328                 TCPSTAT_INC(tcps_usedrtt);
 329                 if (metrics.rmx_rttvar) {
 330                         tp->t_rttvar = metrics.rmx_rttvar;
 331                         TCPSTAT_INC(tcps_usedrttvar);
 332                 } else {
 333                         /* default variation is +- 1 rtt */
 334                         tp->t_rttvar =
 335                             tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE;
 336                 }
 337                 TCPT_RANGESET(tp->t_rxtcur,
 338                     ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1,
 339                     tp->t_rttmin, TCPTV_REXMTMAX);
 340         }
 341         if (metrics.rmx_ssthresh) {
 342                 /*
 343                  * There's some sort of gateway or interface
 344                  * buffer limit on the path.  Use this to set
 345                  * the slow start threshhold, but set the
 346                  * threshold to no less than 2*mss.
 347                  */
 348                 tp->snd_ssthresh = max(2 * tp->t_maxseg, metrics.rmx_ssthresh);
 349                 TCPSTAT_INC(tcps_usedssthresh);
 350         }
 351
 352         /*
 353          * Set the initial slow-start flight size.
 354          *
 355          * RFC5681 Section 3.1 specifies the default conservative values.
 356          * RFC3390 specifies slightly more aggressive values.
 357          * RFC6928 increases it to ten segments.
 358          *
 359          * If a SYN or SYN/ACK was lost and retransmitted, we have to
 360          * reduce the initial CWND to one segment as congestion is likely
 361          * requiring us to be cautious.
 362          */
 363         if (tp->snd_cwnd == 1)
 364                 tp->snd_cwnd = tp->t_maxseg;            /* SYN(-ACK) lost */
 365         else if (V_tcp_do_initcwnd10)
 366                 tp->snd_cwnd = min(10 * tp->t_maxseg,
 367                     max(2 * tp->t_maxseg, 14600));
 368         else if (V_tcp_do_rfc3390)
 369                 tp->snd_cwnd = min(4 * tp->t_maxseg,
 370                     max(2 * tp->t_maxseg, 4380));
 371         else {
 372                 /* Per RFC5681 Section 3.1 */
 373                 if (tp->t_maxseg > 2190)
 374                         tp->snd_cwnd = 2 * tp->t_maxseg;
 375                 else if (tp->t_maxseg > 1095)
 376                         tp->snd_cwnd = 3 * tp->t_maxseg;
 377                 else
 378                         tp->snd_cwnd = 4 * tp->t_maxseg;
 379         }
 380
 381         if (CC_ALGO(tp)->conn_init != NULL)
 382                 CC_ALGO(tp)->conn_init(tp->ccv);
 383 }
 384
 385 void inline
 386 cc_cong_signal(struct tcpcb *tp, struct tcphdr *th, uint32_t type)
 387 {
 388         INP_WLOCK_ASSERT(tp->t_inpcb);
 389
 390         switch(type) {
 391         case CC_NDUPACK:
 392                 if (!IN_FASTRECOVERY(tp->t_flags)) {
 393                         tp->snd_recover = tp->snd_max;
 394                         if (tp->t_flags & TF_ECN_PERMIT)
 395                                 tp->t_flags |= TF_ECN_SND_CWR;
 396                 }
 397                 break;
 398         case CC_ECN:
 399                 if (!IN_CONGRECOVERY(tp->t_flags)) {
 400                         TCPSTAT_INC(tcps_ecn_rcwnd);
 401                         tp->snd_recover = tp->snd_max;
 402                         if (tp->t_flags & TF_ECN_PERMIT)
 403                                 tp->t_flags |= TF_ECN_SND_CWR;
 404                 }
 405                 break;
 406         case CC_RTO:
 407                 tp->t_dupacks = 0;
 408                 tp->t_bytes_acked = 0;
 409                 EXIT_RECOVERY(tp->t_flags);
 410                 tp->snd_ssthresh = max(2, min(tp->snd_wnd, tp->snd_cwnd) / 2 /
 411                     tp->t_maxseg) * tp->t_maxseg;
 412                 tp->snd_cwnd = tp->t_maxseg;
 413                 break;
 414         case CC_RTO_ERR:
 415                 TCPSTAT_INC(tcps_sndrexmitbad);
 416                 /* RTO was unnecessary, so reset everything. */
 417                 tp->snd_cwnd = tp->snd_cwnd_prev;
 418                 tp->snd_ssthresh = tp->snd_ssthresh_prev;
 419                 tp->snd_recover = tp->snd_recover_prev;
 420                 if (tp->t_flags & TF_WASFRECOVERY)
 421                         ENTER_FASTRECOVERY(tp->t_flags);
 422                 if (tp->t_flags & TF_WASCRECOVERY)
 423                         ENTER_CONGRECOVERY(tp->t_flags);
 424                 tp->snd_nxt = tp->snd_max;
 425                 tp->t_flags &= ~TF_PREVVALID;
 426                 tp->t_badrxtwin = 0;
 427                 break;
 428         }
 429
 430         if (CC_ALGO(tp)->cong_signal != NULL) {
 431                 if (th != NULL)
 432                         tp->ccv->curack = th->th_ack;
 433                 CC_ALGO(tp)->cong_signal(tp->ccv, type);
 434         }
 435 }
 436
 437 static void inline
 438 cc_post_recovery(struct tcpcb *tp, struct tcphdr *th)
 439 {
 440         INP_WLOCK_ASSERT(tp->t_inpcb);
 441
 442         /* XXXLAS: KASSERT that we're in recovery? */
 443
 444         if (CC_ALGO(tp)->post_recovery != NULL) {
 445                 tp->ccv->curack = th->th_ack;
 446                 CC_ALGO(tp)->post_recovery(tp->ccv);
 447         }
 448         /* XXXLAS: EXIT_RECOVERY ? */
 449         tp->t_bytes_acked = 0;
 450 }
 451
 452 #ifdef TCP_SIGNATURE
 453 static inline int
 454 tcp_signature_verify_input(struct mbuf *m, int off0, int tlen, int optlen,
 455     struct tcpopt *to, struct tcphdr *th, u_int tcpbflag)
 456 {
 457         int ret;
 458
 459         tcp_fields_to_net(th);
 460         ret = tcp_signature_verify(m, off0, tlen, optlen, to, th, tcpbflag);
 461         tcp_fields_to_host(th);
 462         return (ret);
 463 }
 464 #endif
 465
 466 /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */
 467 #ifdef INET6
 468 #define ND6_HINT(tp) \
 469 do { \
 470         if ((tp) && (tp)->t_inpcb && \
 471             ((tp)->t_inpcb->inp_vflag & INP_IPV6) != 0) \
 472                 nd6_nud_hint(NULL, NULL, 0); \
 473 } while (0)
 474 #else
 475 #define ND6_HINT(tp)
 476 #endif
 477
 478 /*
 479  * Indicate whether this ack should be delayed.  We can delay the ack if
 480  * following conditions are met:
 481  *      - There is no delayed ack timer in progress.
 482  *      - Our last ack wasn't a 0-sized window. We never want to delay
 483  *        the ack that opens up a 0-sized window.
 484  *      - LRO wasn't used for this segment. We make sure by checking that the
 485  *        segment size is not larger than the MSS.
 486  *      - Delayed acks are enabled or this is a half-synchronized T/TCP
 487  *        connection.
 488  */
 489 #define DELAY_ACK(tp, tlen)                                             \
 490         ((!tcp_timer_active(tp, TT_DELACK) &&                           \
 491             (tp->t_flags & TF_RXWIN0SENT) == 0) &&                      \
 492             (tlen <= tp->t_maxopd) &&                                   \
 493             (V_tcp_delack_enabled || (tp->t_flags & TF_NEEDSYN)))
 494
 495 /*
 496  * TCP input handling is split into multiple parts:
 497  *   tcp6_input is a thin wrapper around tcp_input for the extended
 498  *      ip6_protox[] call format in ip6_input
 499  *   tcp_input handles primary segment validation, inpcb lookup and
 500  *      SYN processing on listen sockets
 501  *   tcp_do_segment processes the ACK and text of the segment for
 502  *      establishing, established and closing connections
 503  */
 504 #ifdef INET6
 505 int
 506 tcp6_input(struct mbuf **mp, int *offp, int proto)
 507 {
 508         struct mbuf *m = *mp;
 509         struct in6_ifaddr *ia6;
 510
 511         IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE);
 512
 513         /*
 514          * draft-itojun-ipv6-tcp-to-anycast
 515          * better place to put this in?
 516          */
 517         ia6 = ip6_getdstifaddr(m);
 518         if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) {
 519                 struct ip6_hdr *ip6;
 520
 521                 ifa_free(&ia6->ia_ifa);
 522                 ip6 = mtod(m, struct ip6_hdr *);
 523                 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
 524                             (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
 525                 return (IPPROTO_DONE);
 526         }
 527         if (ia6)
 528                 ifa_free(&ia6->ia_ifa);
 529
 530         return (tcp_input(mp, offp, proto));
 531 }
 532 #endif /* INET6 */
 533
 534 int
 535 tcp_input(struct mbuf **mp, int *offp, int proto)
 536 {
 537         struct mbuf *m = *mp;
 538         struct tcphdr *th = NULL;
 539         struct ip *ip = NULL;
 540         struct inpcb *inp = NULL;
 541         struct tcpcb *tp = NULL;
 542         struct socket *so = NULL;
 543         u_char *optp = NULL;
 544         int off0;
 545         int optlen = 0;
 546 #ifdef INET
 547         int len;
 548 #endif
 549         int tlen = 0, off;
 550         int drop_hdrlen;
 551         int thflags;
 552         int rstreason = 0;      /* For badport_bandlim accounting purposes */
 553 #ifdef TCP_SIGNATURE
 554         uint8_t sig_checked = 0;
 555 #endif
 556         uint8_t iptos = 0;
 557         struct m_tag *fwd_tag = NULL;
 558 #ifdef INET6
 559         struct ip6_hdr *ip6 = NULL;
 560         int isipv6;
 561 #else
 562         const void *ip6 = NULL;
 563 #endif /* INET6 */
 564         struct tcpopt to;               /* options in this segment */
 565         char *s = NULL;                 /* address and port logging */
 566         int ti_locked;
 567 #define TI_UNLOCKED     1
 568 #define TI_WLOCKED      2
 569
 570 #ifdef TCPDEBUG
 571         /*
 572          * The size of tcp_saveipgen must be the size of the max ip header,
 573          * now IPv6.
 574          */
 575         u_char tcp_saveipgen[IP6_HDR_LEN];
 576         struct tcphdr tcp_savetcp;
 577         short ostate = 0;
 578 #endif
 579
 580 #ifdef INET6
 581         isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
 582 #endif
 583
 584         off0 = *offp;
 585         m = *mp;
 586         *mp = NULL;
 587         to.to_flags = 0;
 588         TCPSTAT_INC(tcps_rcvtotal);
 589
 590 #ifdef INET6
 591         if (isipv6) {
 592                 /* IP6_EXTHDR_CHECK() is already done at tcp6_input(). */
 593
 594                 if (m->m_len < (sizeof(*ip6) + sizeof(*th))) {
 595                         m = m_pullup(m, sizeof(*ip6) + sizeof(*th));
 596                         if (m == NULL) {
 597                                 TCPSTAT_INC(tcps_rcvshort);
 598                                 return (IPPROTO_DONE);
 599                         }
 600                 }
 601
 602                 ip6 = mtod(m, struct ip6_hdr *);
 603                 th = (struct tcphdr *)((caddr_t)ip6 + off0);
 604                 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
 605                 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID_IPV6) {
 606                         if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 607                                 th->th_sum = m->m_pkthdr.csum_data;
 608                         else
 609                                 th->th_sum = in6_cksum_pseudo(ip6, tlen,
 610                                     IPPROTO_TCP, m->m_pkthdr.csum_data);
 611                         th->th_sum ^= 0xffff;
 612                 } else
 613                         th->th_sum = in6_cksum(m, IPPROTO_TCP, off0, tlen);
 614                 if (th->th_sum) {
 615                         TCPSTAT_INC(tcps_rcvbadsum);
 616                         goto drop;
 617                 }
 618
 619                 /*
 620                  * Be proactive about unspecified IPv6 address in source.
 621                  * As we use all-zero to indicate unbounded/unconnected pcb,
 622                  * unspecified IPv6 address can be used to confuse us.
 623                  *
 624                  * Note that packets with unspecified IPv6 destination is
 625                  * already dropped in ip6_input.
 626                  */
 627                 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
 628                         /* XXX stat */
 629                         goto drop;
 630                 }
 631         }
 632 #endif
 633 #if defined(INET) && defined(INET6)
 634         else
 635 #endif
 636 #ifdef INET
 637         {
 638                 /*
 639                  * Get IP and TCP header together in first mbuf.
 640                  * Note: IP leaves IP header in first mbuf.
 641                  */
 642                 if (off0 > sizeof (struct ip)) {
 643                         ip_stripoptions(m);
 644                         off0 = sizeof(struct ip);
 645                 }
 646                 if (m->m_len < sizeof (struct tcpiphdr)) {
 647                         if ((m = m_pullup(m, sizeof (struct tcpiphdr)))
 648                             == NULL) {
 649                                 TCPSTAT_INC(tcps_rcvshort);
 650                                 return (IPPROTO_DONE);
 651                         }
 652                 }
 653                 ip = mtod(m, struct ip *);
 654                 th = (struct tcphdr *)((caddr_t)ip + off0);
 655                 tlen = ntohs(ip->ip_len) - off0;
 656
 657                 if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) {
 658                         if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR)
 659                                 th->th_sum = m->m_pkthdr.csum_data;
 660                         else
 661                                 th->th_sum = in_pseudo(ip->ip_src.s_addr,
 662                                     ip->ip_dst.s_addr,
 663                                     htonl(m->m_pkthdr.csum_data + tlen +
 664                                     IPPROTO_TCP));
 665                         th->th_sum ^= 0xffff;
 666                 } else {
 667                         struct ipovly *ipov = (struct ipovly *)ip;
 668
 669                         /*
 670                          * Checksum extended TCP header and data.
 671                          */
 672                         len = off0 + tlen;
 673                         bzero(ipov->ih_x1, sizeof(ipov->ih_x1));
 674                         ipov->ih_len = htons(tlen);
 675                         th->th_sum = in_cksum(m, len);
 676                         /* Reset length for SDT probes. */
 677                         ip->ip_len = htons(tlen + off0);
 678                 }
 679
 680                 if (th->th_sum) {
 681                         TCPSTAT_INC(tcps_rcvbadsum);
 682                         goto drop;
 683                 }
 684                 /* Re-initialization for later version check */
 685                 ip->ip_v = IPVERSION;
 686         }
 687 #endif /* INET */
 688
 689 #ifdef INET6
 690         if (isipv6)
 691                 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
 692 #endif
 693 #if defined(INET) && defined(INET6)
 694         else
 695 #endif
 696 #ifdef INET
 697                 iptos = ip->ip_tos;
 698 #endif
 699
 700         /*
 701          * Check that TCP offset makes sense,
 702          * pull out TCP options and adjust length.              XXX
 703          */
 704         off = th->th_off << 2;
 705         if (off < sizeof (struct tcphdr) || off > tlen) {
 706                 TCPSTAT_INC(tcps_rcvbadoff);
 707                 goto drop;
 708         }
 709         tlen -= off;    /* tlen is used instead of ti->ti_len */
 710         if (off > sizeof (struct tcphdr)) {
 711 #ifdef INET6
 712                 if (isipv6) {
 713                         IP6_EXTHDR_CHECK(m, off0, off, IPPROTO_DONE);
 714                         ip6 = mtod(m, struct ip6_hdr *);
 715                         th = (struct tcphdr *)((caddr_t)ip6 + off0);
 716                 }
 717 #endif
 718 #if defined(INET) && defined(INET6)
 719                 else
 720 #endif
 721 #ifdef INET
 722                 {
 723                         if (m->m_len < sizeof(struct ip) + off) {
 724                                 if ((m = m_pullup(m, sizeof (struct ip) + off))
 725                                     == NULL) {
 726                                         TCPSTAT_INC(tcps_rcvshort);
 727                                         return (IPPROTO_DONE);
 728                                 }
 729                                 ip = mtod(m, struct ip *);
 730                                 th = (struct tcphdr *)((caddr_t)ip + off0);
 731                         }
 732                 }
 733 #endif
 734                 optlen = off - sizeof (struct tcphdr);
 735                 optp = (u_char *)(th + 1);
 736         }
 737         thflags = th->th_flags;
 738
 739         /*
 740          * Convert TCP protocol specific fields to host format.
 741          */
 742         tcp_fields_to_host(th);
 743
 744         /*
 745          * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options.
 746          */
 747         drop_hdrlen = off0 + off;
 748
 749         /*
 750          * Locate pcb for segment; if we're likely to add or remove a
 751          * connection then first acquire pcbinfo lock.  There are three cases
 752          * where we might discover later we need a write lock despite the
 753          * flags: ACKs moving a connection out of the syncache, ACKs for a
 754          * connection in TIMEWAIT and SYNs not targeting a listening socket.
 755          */
 756         if ((thflags & (TH_FIN | TH_RST)) != 0) {
 757                 INP_INFO_WLOCK(&V_tcbinfo);
 758                 ti_locked = TI_WLOCKED;
 759         } else
 760                 ti_locked = TI_UNLOCKED;
 761
 762         /*
 763          * Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain.
 764          */
 765         if (
 766 #ifdef INET6
 767             (isipv6 && (m->m_flags & M_IP6_NEXTHOP))
 768 #ifdef INET
 769             || (!isipv6 && (m->m_flags & M_IP_NEXTHOP))
 770 #endif
 771 #endif
 772 #if defined(INET) && !defined(INET6)
 773             (m->m_flags & M_IP_NEXTHOP)
 774 #endif
 775             )
 776                 fwd_tag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL);
 777
 778 findpcb:
 779 #ifdef INVARIANTS
 780         if (ti_locked == TI_WLOCKED) {
 781                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
 782         } else {
 783                 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
 784         }
 785 #endif
 786 #ifdef INET6
 787         if (isipv6 && fwd_tag != NULL) {
 788                 struct sockaddr_in6 *next_hop6;
 789
 790                 next_hop6 = (struct sockaddr_in6 *)(fwd_tag + 1);
 791                 /*
 792                  * Transparently forwarded. Pretend to be the destination.
 793                  * Already got one like this?
 794                  */
 795                 inp = in6_pcblookup_mbuf(&V_tcbinfo,
 796                     &ip6->ip6_src, th->th_sport, &ip6->ip6_dst, th->th_dport,
 797                     INPLOOKUP_WLOCKPCB, m->m_pkthdr.rcvif, m);
 798                 if (!inp) {
 799                         /*
 800                          * It's new.  Try to find the ambushing socket.
 801                          * Because we've rewritten the destination address,
 802                          * any hardware-generated hash is ignored.
 803                          */
 804                         inp = in6_pcblookup(&V_tcbinfo, &ip6->ip6_src,
 805                             th->th_sport, &next_hop6->sin6_addr,
 806                             next_hop6->sin6_port ? ntohs(next_hop6->sin6_port) :
 807                             th->th_dport, INPLOOKUP_WILDCARD |
 808                             INPLOOKUP_WLOCKPCB, m->m_pkthdr.rcvif);
 809                 }
 810         } else if (isipv6) {
 811                 inp = in6_pcblookup_mbuf(&V_tcbinfo, &ip6->ip6_src,
 812                     th->th_sport, &ip6->ip6_dst, th->th_dport,
 813                     INPLOOKUP_WILDCARD | INPLOOKUP_WLOCKPCB,
 814                     m->m_pkthdr.rcvif, m);
 815         }
 816 #endif /* INET6 */
 817 #if defined(INET6) && defined(INET)
 818         else
 819 #endif
 820 #ifdef INET
 821         if (fwd_tag != NULL) {
 822                 struct sockaddr_in *next_hop;
 823
 824                 next_hop = (struct sockaddr_in *)(fwd_tag+1);
 825                 /*
 826                  * Transparently forwarded. Pretend to be the destination.
 827                  * already got one like this?
 828                  */
 829                 inp = in_pcblookup_mbuf(&V_tcbinfo, ip->ip_src, th->th_sport,
 830                     ip->ip_dst, th->th_dport, INPLOOKUP_WLOCKPCB,
 831                     m->m_pkthdr.rcvif, m);
 832                 if (!inp) {
 833                         /*
 834                          * It's new.  Try to find the ambushing socket.
 835                          * Because we've rewritten the destination address,
 836                          * any hardware-generated hash is ignored.
 837                          */
 838                         inp = in_pcblookup(&V_tcbinfo, ip->ip_src,
 839                             th->th_sport, next_hop->sin_addr,
 840                             next_hop->sin_port ? ntohs(next_hop->sin_port) :
 841                             th->th_dport, INPLOOKUP_WILDCARD |
 842                             INPLOOKUP_WLOCKPCB, m->m_pkthdr.rcvif);
 843                 }
 844         } else
 845                 inp = in_pcblookup_mbuf(&V_tcbinfo, ip->ip_src,
 846                     th->th_sport, ip->ip_dst, th->th_dport,
 847                     INPLOOKUP_WILDCARD | INPLOOKUP_WLOCKPCB,
 848                     m->m_pkthdr.rcvif, m);
 849 #endif /* INET */
 850
 851         /*
 852          * If the INPCB does not exist then all data in the incoming
 853          * segment is discarded and an appropriate RST is sent back.
 854          * XXX MRT Send RST using which routing table?
 855          */
 856         if (inp == NULL) {
 857                 /*
 858                  * Log communication attempts to ports that are not
 859                  * in use.
 860                  */
 861                 if ((tcp_log_in_vain == 1 && (thflags & TH_SYN)) ||
 862                     tcp_log_in_vain == 2) {
 863                         if ((s = tcp_log_vain(NULL, th, (void *)ip, ip6)))
 864                                 log(LOG_INFO, "%s; %s: Connection attempt "
 865                                     "to closed port\n", s, __func__);
 866                 }
 867                 /*
 868                  * When blackholing do not respond with a RST but
 869                  * completely ignore the segment and drop it.
 870                  */
 871                 if ((V_blackhole == 1 && (thflags & TH_SYN)) ||
 872                     V_blackhole == 2)
 873                         goto dropunlock;
 874
 875                 rstreason = BANDLIM_RST_CLOSEDPORT;
 876                 goto dropwithreset;
 877         }
 878         INP_WLOCK_ASSERT(inp);
 879         if (!(inp->inp_flags & INP_HW_FLOWID)
 880             && (m->m_flags & M_FLOWID)
 881             && ((inp->inp_socket == NULL)
 882                 || !(inp->inp_socket->so_options & SO_ACCEPTCONN))) {
 883                 inp->inp_flags |= INP_HW_FLOWID;
 884                 inp->inp_flags &= ~INP_SW_FLOWID;
 885                 inp->inp_flowid = m->m_pkthdr.flowid;
 886                 inp->inp_flowtype = M_HASHTYPE_GET(m);
 887         }
 888 #ifdef IPSEC
 889 #ifdef INET6
 890         if (isipv6 && ipsec6_in_reject(m, inp)) {
 891                 IPSEC6STAT_INC(ips_in_polvio);
 892                 goto dropunlock;
 893         } else
 894 #endif /* INET6 */
 895         if (ipsec4_in_reject(m, inp) != 0) {
 896                 IPSECSTAT_INC(ips_in_polvio);
 897                 goto dropunlock;
 898         }
 899 #endif /* IPSEC */
 900
 901         /*
 902          * Check the minimum TTL for socket.
 903          */
 904         if (inp->inp_ip_minttl != 0) {
 905 #ifdef INET6
 906                 if (isipv6 && inp->inp_ip_minttl > ip6->ip6_hlim)
 907                         goto dropunlock;
 908                 else
 909 #endif
 910                 if (inp->inp_ip_minttl > ip->ip_ttl)
 911                         goto dropunlock;
 912         }
 913
 914         /*
 915          * A previous connection in TIMEWAIT state is supposed to catch stray
 916          * or duplicate segments arriving late.  If this segment was a
 917          * legitimate new connection attempt, the old INPCB gets removed and
 918          * we can try again to find a listening socket.
 919          *
 920          * At this point, due to earlier optimism, we may hold only an inpcb
 921          * lock, and not the inpcbinfo write lock.  If so, we need to try to
 922          * acquire it, or if that fails, acquire a reference on the inpcb,
 923          * drop all locks, acquire a global write lock, and then re-acquire
 924          * the inpcb lock.  We may at that point discover that another thread
 925          * has tried to free the inpcb, in which case we need to loop back
 926          * and try to find a new inpcb to deliver to.
 927          *
 928          * XXXRW: It may be time to rethink timewait locking.
 929          */
 930 relocked:
 931         if (inp->inp_flags & INP_TIMEWAIT) {
 932                 if (ti_locked == TI_UNLOCKED) {
 933                         if (INP_INFO_TRY_WLOCK(&V_tcbinfo) == 0) {
 934                                 in_pcbref(inp);
 935                                 INP_WUNLOCK(inp);
 936                                 INP_INFO_WLOCK(&V_tcbinfo);
 937                                 ti_locked = TI_WLOCKED;
 938                                 INP_WLOCK(inp);
 939                                 if (in_pcbrele_wlocked(inp)) {
 940                                         inp = NULL;
 941                                         goto findpcb;
 942                                 }
 943                         } else
 944                                 ti_locked = TI_WLOCKED;
 945                 }
 946                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
 947
 948                 if (thflags & TH_SYN)
 949                         tcp_dooptions(&to, optp, optlen, TO_SYN);
 950                 /*
 951                  * NB: tcp_twcheck unlocks the INP and frees the mbuf.
 952                  */
 953                 if (tcp_twcheck(inp, &to, th, m, tlen))
 954                         goto findpcb;
 955                 INP_INFO_WUNLOCK(&V_tcbinfo);
 956                 return (IPPROTO_DONE);
 957         }
 958         /*
 959          * The TCPCB may no longer exist if the connection is winding
 960          * down or it is in the CLOSED state.  Either way we drop the
 961          * segment and send an appropriate response.
 962          */
 963         tp = intotcpcb(inp);
 964         if (tp == NULL || tp->t_state == TCPS_CLOSED) {
 965                 rstreason = BANDLIM_RST_CLOSEDPORT;
 966                 goto dropwithreset;
 967         }
 968
 969 #ifdef TCP_OFFLOAD
 970         if (tp->t_flags & TF_TOE) {
 971                 tcp_offload_input(tp, m);
 972                 m = NULL;       /* consumed by the TOE driver */
 973                 goto dropunlock;
 974         }
 975 #endif
 976
 977         /*
 978          * We've identified a valid inpcb, but it could be that we need an
 979          * inpcbinfo write lock but don't hold it.  In this case, attempt to
 980          * acquire using the same strategy as the TIMEWAIT case above.  If we
 981          * relock, we have to jump back to 'relocked' as the connection might
 982          * now be in TIMEWAIT.
 983          */
 984 #ifdef INVARIANTS
 985         if ((thflags & (TH_FIN | TH_RST)) != 0)
 986                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
 987 #endif
 988         if (!((tp->t_state == TCPS_ESTABLISHED && (thflags & TH_SYN) == 0) ||
 989             (tp->t_state == TCPS_LISTEN && (thflags & TH_SYN)))) {
 990                 if (ti_locked == TI_UNLOCKED) {
 991                         if (INP_INFO_TRY_WLOCK(&V_tcbinfo) == 0) {
 992                                 in_pcbref(inp);
 993                                 INP_WUNLOCK(inp);
 994                                 INP_INFO_WLOCK(&V_tcbinfo);
 995                                 ti_locked = TI_WLOCKED;
 996                                 INP_WLOCK(inp);
 997                                 if (in_pcbrele_wlocked(inp)) {
 998                                         inp = NULL;
 999                                         goto findpcb;
1000                                 }
1001                                 goto relocked;
1002                         } else
1003                                 ti_locked = TI_WLOCKED;
1004                 }
1005                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1006         }
1007
1008 #ifdef MAC
1009         INP_WLOCK_ASSERT(inp);
1010         if (mac_inpcb_check_deliver(inp, m))
1011                 goto dropunlock;
1012 #endif
1013         so = inp->inp_socket;
1014         KASSERT(so != NULL, ("%s: so == NULL", __func__));
1015 #ifdef TCPDEBUG
1016         if (so->so_options & SO_DEBUG) {
1017                 ostate = tp->t_state;
1018 #ifdef INET6
1019                 if (isipv6) {
1020                         bcopy((char *)ip6, (char *)tcp_saveipgen, sizeof(*ip6));
1021                 } else
1022 #endif
1023                         bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
1024                 tcp_savetcp = *th;
1025         }
1026 #endif /* TCPDEBUG */
1027         /*
1028          * When the socket is accepting connections (the INPCB is in LISTEN
1029          * state) we look into the SYN cache if this is a new connection
1030          * attempt or the completion of a previous one.
1031          */
1032         if (so->so_options & SO_ACCEPTCONN) {
1033                 struct in_conninfo inc;
1034
1035                 KASSERT(tp->t_state == TCPS_LISTEN, ("%s: so accepting but "
1036                     "tp not listening", __func__));
1037                 bzero(&inc, sizeof(inc));
1038 #ifdef INET6
1039                 if (isipv6) {
1040                         inc.inc_flags |= INC_ISIPV6;
1041                         inc.inc6_faddr = ip6->ip6_src;
1042                         inc.inc6_laddr = ip6->ip6_dst;
1043                 } else
1044 #endif
1045                 {
1046                         inc.inc_faddr = ip->ip_src;
1047                         inc.inc_laddr = ip->ip_dst;
1048                 }
1049                 inc.inc_fport = th->th_sport;
1050                 inc.inc_lport = th->th_dport;
1051                 inc.inc_fibnum = so->so_fibnum;
1052
1053                 /*
1054                  * Check for an existing connection attempt in syncache if
1055                  * the flag is only ACK.  A successful lookup creates a new
1056                  * socket appended to the listen queue in SYN_RECEIVED state.
1057                  */
1058                 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
1059
1060                         INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1061                         /*
1062                          * Parse the TCP options here because
1063                          * syncookies need access to the reflected
1064                          * timestamp.
1065                          */
1066                         tcp_dooptions(&to, optp, optlen, 0);
1067                         /*
1068                          * NB: syncache_expand() doesn't unlock
1069                          * inp and tcpinfo locks.
1070                          */
1071                         if (!syncache_expand(&inc, &to, th, &so, m)) {
1072                                 /*
1073                                  * No syncache entry or ACK was not
1074                                  * for our SYN/ACK.  Send a RST.
1075                                  * NB: syncache did its own logging
1076                                  * of the failure cause.
1077                                  */
1078                                 rstreason = BANDLIM_RST_OPENPORT;
1079                                 goto dropwithreset;
1080                         }
1081                         if (so == NULL) {
1082                                 /*
1083                                  * We completed the 3-way handshake
1084                                  * but could not allocate a socket
1085                                  * either due to memory shortage,
1086                                  * listen queue length limits or
1087                                  * global socket limits.  Send RST
1088                                  * or wait and have the remote end
1089                                  * retransmit the ACK for another
1090                                  * try.
1091                                  */
1092                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1093                                         log(LOG_DEBUG, "%s; %s: Listen socket: "
1094                                             "Socket allocation failed due to "
1095                                             "limits or memory shortage, %s\n",
1096                                             s, __func__,
1097                                             V_tcp_sc_rst_sock_fail ?
1098                                             "sending RST" : "try again");
1099                                 if (V_tcp_sc_rst_sock_fail) {
1100                                         rstreason = BANDLIM_UNLIMITED;
1101                                         goto dropwithreset;
1102                                 } else
1103                                         goto dropunlock;
1104                         }
1105                         /*
1106                          * Socket is created in state SYN_RECEIVED.
1107                          * Unlock the listen socket, lock the newly
1108                          * created socket and update the tp variable.
1109                          */
1110                         INP_WUNLOCK(inp);       /* listen socket */
1111                         inp = sotoinpcb(so);
1112                         INP_WLOCK(inp);         /* new connection */
1113                         tp = intotcpcb(inp);
1114                         KASSERT(tp->t_state == TCPS_SYN_RECEIVED,
1115                             ("%s: ", __func__));
1116 #ifdef TCP_SIGNATURE
1117                         if (sig_checked == 0)  {
1118                                 tcp_dooptions(&to, optp, optlen,
1119                                     (thflags & TH_SYN) ? TO_SYN : 0);
1120                                 if (!tcp_signature_verify_input(m, off0, tlen,
1121                                     optlen, &to, th, tp->t_flags)) {
1122
1123                                         /*
1124                                          * In SYN_SENT state if it receives an
1125                                          * RST, it is allowed for further
1126                                          * processing.
1127                                          */
1128                                         if ((thflags & TH_RST) == 0 ||
1129                                             (tp->t_state == TCPS_SYN_SENT) == 0)
1130                                                 goto dropunlock;
1131                                 }
1132                                 sig_checked = 1;
1133                         }
1134 #endif
1135
1136                         /*
1137                          * Process the segment and the data it
1138                          * contains.  tcp_do_segment() consumes
1139                          * the mbuf chain and unlocks the inpcb.
1140                          */
1141                         tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen,
1142                             iptos, ti_locked);
1143                         INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1144                         return (IPPROTO_DONE);
1145                 }
1146                 /*
1147                  * Segment flag validation for new connection attempts:
1148                  *
1149                  * Our (SYN|ACK) response was rejected.
1150                  * Check with syncache and remove entry to prevent
1151                  * retransmits.
1152                  *
1153                  * NB: syncache_chkrst does its own logging of failure
1154                  * causes.
1155                  */
1156                 if (thflags & TH_RST) {
1157                         syncache_chkrst(&inc, th);
1158                         goto dropunlock;
1159                 }
1160                 /*
1161                  * We can't do anything without SYN.
1162                  */
1163                 if ((thflags & TH_SYN) == 0) {
1164                         if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1165                                 log(LOG_DEBUG, "%s; %s: Listen socket: "
1166                                     "SYN is missing, segment ignored\n",
1167                                     s, __func__);
1168                         TCPSTAT_INC(tcps_badsyn);
1169                         goto dropunlock;
1170                 }
1171                 /*
1172                  * (SYN|ACK) is bogus on a listen socket.
1173                  */
1174                 if (thflags & TH_ACK) {
1175                         if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1176                                 log(LOG_DEBUG, "%s; %s: Listen socket: "
1177                                     "SYN|ACK invalid, segment rejected\n",
1178                                     s, __func__);
1179                         syncache_badack(&inc);  /* XXX: Not needed! */
1180                         TCPSTAT_INC(tcps_badsyn);
1181                         rstreason = BANDLIM_RST_OPENPORT;
1182                         goto dropwithreset;
1183                 }
1184                 /*
1185                  * If the drop_synfin option is enabled, drop all
1186                  * segments with both the SYN and FIN bits set.
1187                  * This prevents e.g. nmap from identifying the
1188                  * TCP/IP stack.
1189                  * XXX: Poor reasoning.  nmap has other methods
1190                  * and is constantly refining its stack detection
1191                  * strategies.
1192                  * XXX: This is a violation of the TCP specification
1193                  * and was used by RFC1644.
1194                  */
1195                 if ((thflags & TH_FIN) && V_drop_synfin) {
1196                         if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1197                                 log(LOG_DEBUG, "%s; %s: Listen socket: "
1198                                     "SYN|FIN segment ignored (based on "
1199                                     "sysctl setting)\n", s, __func__);
1200                         TCPSTAT_INC(tcps_badsyn);
1201                         goto dropunlock;
1202                 }
1203                 /*
1204                  * Segment's flags are (SYN) or (SYN|FIN).
1205                  *
1206                  * TH_PUSH, TH_URG, TH_ECE, TH_CWR are ignored
1207                  * as they do not affect the state of the TCP FSM.
1208                  * The data pointed to by TH_URG and th_urp is ignored.
1209                  */
1210                 KASSERT((thflags & (TH_RST|TH_ACK)) == 0,
1211                     ("%s: Listen socket: TH_RST or TH_ACK set", __func__));
1212                 KASSERT(thflags & (TH_SYN),
1213                     ("%s: Listen socket: TH_SYN not set", __func__));
1214 #ifdef INET6
1215                 /*
1216                  * If deprecated address is forbidden,
1217                  * we do not accept SYN to deprecated interface
1218                  * address to prevent any new inbound connection from
1219                  * getting established.
1220                  * When we do not accept SYN, we send a TCP RST,
1221                  * with deprecated source address (instead of dropping
1222                  * it).  We compromise it as it is much better for peer
1223                  * to send a RST, and RST will be the final packet
1224                  * for the exchange.
1225                  *
1226                  * If we do not forbid deprecated addresses, we accept
1227                  * the SYN packet.  RFC2462 does not suggest dropping
1228                  * SYN in this case.
1229                  * If we decipher RFC2462 5.5.4, it says like this:
1230                  * 1. use of deprecated addr with existing
1231                  *    communication is okay - "SHOULD continue to be
1232                  *    used"
1233                  * 2. use of it with new communication:
1234                  *   (2a) "SHOULD NOT be used if alternate address
1235                  *        with sufficient scope is available"
1236                  *   (2b) nothing mentioned otherwise.
1237                  * Here we fall into (2b) case as we have no choice in
1238                  * our source address selection - we must obey the peer.
1239                  *
1240                  * The wording in RFC2462 is confusing, and there are
1241                  * multiple description text for deprecated address
1242                  * handling - worse, they are not exactly the same.
1243                  * I believe 5.5.4 is the best one, so we follow 5.5.4.
1244                  */
1245                 if (isipv6 && !V_ip6_use_deprecated) {
1246                         struct in6_ifaddr *ia6;
1247
1248                         ia6 = ip6_getdstifaddr(m);
1249                         if (ia6 != NULL &&
1250                             (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1251                                 ifa_free(&ia6->ia_ifa);
1252                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1253                                     log(LOG_DEBUG, "%s; %s: Listen socket: "
1254                                         "Connection attempt to deprecated "
1255                                         "IPv6 address rejected\n",
1256                                         s, __func__);
1257                                 rstreason = BANDLIM_RST_OPENPORT;
1258                                 goto dropwithreset;
1259                         }
1260                         if (ia6)
1261                                 ifa_free(&ia6->ia_ifa);
1262                 }
1263 #endif /* INET6 */
1264                 /*
1265                  * Basic sanity checks on incoming SYN requests:
1266                  *   Don't respond if the destination is a link layer
1267                  *      broadcast according to RFC1122 4.2.3.10, p. 104.
1268                  *   If it is from this socket it must be forged.
1269                  *   Don't respond if the source or destination is a
1270                  *      global or subnet broad- or multicast address.
1271                  *   Note that it is quite possible to receive unicast
1272                  *      link-layer packets with a broadcast IP address. Use
1273                  *      in_broadcast() to find them.
1274                  */
1275                 if (m->m_flags & (M_BCAST|M_MCAST)) {
1276                         if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1277                             log(LOG_DEBUG, "%s; %s: Listen socket: "
1278                                 "Connection attempt from broad- or multicast "
1279                                 "link layer address ignored\n", s, __func__);
1280                         goto dropunlock;
1281                 }
1282 #ifdef INET6
1283                 if (isipv6) {
1284                         if (th->th_dport == th->th_sport &&
1285                             IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) {
1286                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1287                                     log(LOG_DEBUG, "%s; %s: Listen socket: "
1288                                         "Connection attempt to/from self "
1289                                         "ignored\n", s, __func__);
1290                                 goto dropunlock;
1291                         }
1292                         if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
1293                             IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) {
1294                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1295                                     log(LOG_DEBUG, "%s; %s: Listen socket: "
1296                                         "Connection attempt from/to multicast "
1297                                         "address ignored\n", s, __func__);
1298                                 goto dropunlock;
1299                         }
1300                 }
1301 #endif
1302 #if defined(INET) && defined(INET6)
1303                 else
1304 #endif
1305 #ifdef INET
1306                 {
1307                         if (th->th_dport == th->th_sport &&
1308                             ip->ip_dst.s_addr == ip->ip_src.s_addr) {
1309                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1310                                     log(LOG_DEBUG, "%s; %s: Listen socket: "
1311                                         "Connection attempt from/to self "
1312                                         "ignored\n", s, __func__);
1313                                 goto dropunlock;
1314                         }
1315                         if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
1316                             IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
1317                             ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
1318                             in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) {
1319                                 if ((s = tcp_log_addrs(&inc, th, NULL, NULL)))
1320                                     log(LOG_DEBUG, "%s; %s: Listen socket: "
1321                                         "Connection attempt from/to broad- "
1322                                         "or multicast address ignored\n",
1323                                         s, __func__);
1324                                 goto dropunlock;
1325                         }
1326                 }
1327 #endif
1328                 /*
1329                  * SYN appears to be valid.  Create compressed TCP state
1330                  * for syncache.
1331                  */
1332 #ifdef TCPDEBUG
1333                 if (so->so_options & SO_DEBUG)
1334                         tcp_trace(TA_INPUT, ostate, tp,
1335                             (void *)tcp_saveipgen, &tcp_savetcp, 0);
1336 #endif
1337                 tcp_dooptions(&to, optp, optlen, TO_SYN);
1338                 syncache_add(&inc, &to, th, inp, &so, m, NULL, NULL);
1339                 /*
1340                  * Entry added to syncache and mbuf consumed.
1341                  * Only the listen socket is unlocked by syncache_add().
1342                  */
1343                 if (ti_locked == TI_WLOCKED) {
1344                         INP_INFO_WUNLOCK(&V_tcbinfo);
1345                         ti_locked = TI_UNLOCKED;
1346                 }
1347                 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1348                 return (IPPROTO_DONE);
1349         } else if (tp->t_state == TCPS_LISTEN) {
1350                 /*
1351                  * When a listen socket is torn down the SO_ACCEPTCONN
1352                  * flag is removed first while connections are drained
1353                  * from the accept queue in a unlock/lock cycle of the
1354                  * ACCEPT_LOCK, opening a race condition allowing a SYN
1355                  * attempt go through unhandled.
1356                  */
1357                 goto dropunlock;
1358         }
1359
1360 #ifdef TCP_SIGNATURE
1361         if (sig_checked == 0)  {
1362                 tcp_dooptions(&to, optp, optlen,
1363                     (thflags & TH_SYN) ? TO_SYN : 0);
1364                 if (!tcp_signature_verify_input(m, off0, tlen, optlen, &to,
1365                     th, tp->t_flags)) {
1366
1367                         /*
1368                          * In SYN_SENT state if it receives an RST, it is
1369                          * allowed for further processing.
1370                          */
1371                         if ((thflags & TH_RST) == 0 ||
1372                             (tp->t_state == TCPS_SYN_SENT) == 0)
1373                                 goto dropunlock;
1374                 }
1375                 sig_checked = 1;
1376         }
1377 #endif
1378
1379         TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th);
1380
1381         /*
1382          * Segment belongs to a connection in SYN_SENT, ESTABLISHED or later
1383          * state.  tcp_do_segment() always consumes the mbuf chain, unlocks
1384          * the inpcb, and unlocks pcbinfo.
1385          */
1386         tcp_do_segment(m, th, so, tp, drop_hdrlen, tlen, iptos, ti_locked);
1387         INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1388         return (IPPROTO_DONE);
1389
1390 dropwithreset:
1391         TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th);
1392
1393         if (ti_locked == TI_WLOCKED) {
1394                 INP_INFO_WUNLOCK(&V_tcbinfo);
1395                 ti_locked = TI_UNLOCKED;
1396         }
1397 #ifdef INVARIANTS
1398         else {
1399                 KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropwithreset "
1400                     "ti_locked: %d", __func__, ti_locked));
1401                 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1402         }
1403 #endif
1404
1405         if (inp != NULL) {
1406                 tcp_dropwithreset(m, th, tp, tlen, rstreason);
1407                 INP_WUNLOCK(inp);
1408         } else
1409                 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
1410         m = NULL;       /* mbuf chain got consumed. */
1411         goto drop;
1412
1413 dropunlock:
1414         if (m != NULL)
1415                 TCP_PROBE5(receive, NULL, tp, mtod(m, const char *), tp, th);
1416
1417         if (ti_locked == TI_WLOCKED) {
1418                 INP_INFO_WUNLOCK(&V_tcbinfo);
1419                 ti_locked = TI_UNLOCKED;
1420         }
1421 #ifdef INVARIANTS
1422         else {
1423                 KASSERT(ti_locked == TI_UNLOCKED, ("%s: dropunlock "
1424                     "ti_locked: %d", __func__, ti_locked));
1425                 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1426         }
1427 #endif
1428
1429         if (inp != NULL)
1430                 INP_WUNLOCK(inp);
1431
1432 drop:
1433         INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1434         if (s != NULL)
1435                 free(s, M_TCPLOG);
1436         if (m != NULL)
1437                 m_freem(m);
1438         return (IPPROTO_DONE);
1439 }
1440
1441 static void
1442 tcp_do_segment(struct mbuf *m, struct tcphdr *th, struct socket *so,
1443     struct tcpcb *tp, int drop_hdrlen, int tlen, uint8_t iptos,
1444     int ti_locked)
1445 {
1446         int thflags, acked, ourfinisacked, needoutput = 0;
1447         int rstreason, todrop, win;
1448         u_long tiwin;
1449         char *s;
1450         struct in_conninfo *inc;
1451         struct mbuf *mfree;
1452         struct tcpopt to;
1453
1454 #ifdef TCPDEBUG
1455         /*
1456          * The size of tcp_saveipgen must be the size of the max ip header,
1457          * now IPv6.
1458          */
1459         u_char tcp_saveipgen[IP6_HDR_LEN];
1460         struct tcphdr tcp_savetcp;
1461         short ostate = 0;
1462 #endif
1463         thflags = th->th_flags;
1464         inc = &tp->t_inpcb->inp_inc;
1465         tp->sackhint.last_sack_ack = 0;
1466
1467         /*
1468          * If this is either a state-changing packet or current state isn't
1469          * established, we require a write lock on tcbinfo.  Otherwise, we
1470          * allow the tcbinfo to be in either alocked or unlocked, as the
1471          * caller may have unnecessarily acquired a write lock due to a race.
1472          */
1473         if ((thflags & (TH_SYN | TH_FIN | TH_RST)) != 0 ||
1474             tp->t_state != TCPS_ESTABLISHED) {
1475                 KASSERT(ti_locked == TI_WLOCKED, ("%s ti_locked %d for "
1476                     "SYN/FIN/RST/!EST", __func__, ti_locked));
1477                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1478         } else {
1479 #ifdef INVARIANTS
1480                 if (ti_locked == TI_WLOCKED)
1481                         INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1482                 else {
1483                         KASSERT(ti_locked == TI_UNLOCKED, ("%s: EST "
1484                             "ti_locked: %d", __func__, ti_locked));
1485                         INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
1486                 }
1487 #endif
1488         }
1489         INP_WLOCK_ASSERT(tp->t_inpcb);
1490         KASSERT(tp->t_state > TCPS_LISTEN, ("%s: TCPS_LISTEN",
1491             __func__));
1492         KASSERT(tp->t_state != TCPS_TIME_WAIT, ("%s: TCPS_TIME_WAIT",
1493             __func__));
1494
1495         /*
1496          * Segment received on connection.
1497          * Reset idle time and keep-alive timer.
1498          * XXX: This should be done after segment
1499          * validation to ignore broken/spoofed segs.
1500          */
1501         tp->t_rcvtime = ticks;
1502         if (TCPS_HAVEESTABLISHED(tp->t_state))
1503                 tcp_timer_activate(tp, TT_KEEP, TP_KEEPIDLE(tp));
1504
1505         /*
1506          * Unscale the window into a 32-bit value.
1507          * For the SYN_SENT state the scale is zero.
1508          */
1509         tiwin = th->th_win << tp->snd_scale;
1510
1511         /*
1512          * TCP ECN processing.
1513          */
1514         if (tp->t_flags & TF_ECN_PERMIT) {
1515                 if (thflags & TH_CWR)
1516                         tp->t_flags &= ~TF_ECN_SND_ECE;
1517                 switch (iptos & IPTOS_ECN_MASK) {
1518                 case IPTOS_ECN_CE:
1519                         tp->t_flags |= TF_ECN_SND_ECE;
1520                         TCPSTAT_INC(tcps_ecn_ce);
1521                         break;
1522                 case IPTOS_ECN_ECT0:
1523                         TCPSTAT_INC(tcps_ecn_ect0);
1524                         break;
1525                 case IPTOS_ECN_ECT1:
1526                         TCPSTAT_INC(tcps_ecn_ect1);
1527                         break;
1528                 }
1529                 /* Congestion experienced. */
1530                 if (thflags & TH_ECE) {
1531                         cc_cong_signal(tp, th, CC_ECN);
1532                 }
1533         }
1534
1535         /*
1536          * Parse options on any incoming segment.
1537          */
1538         tcp_dooptions(&to, (u_char *)(th + 1),
1539             (th->th_off << 2) - sizeof(struct tcphdr),
1540             (thflags & TH_SYN) ? TO_SYN : 0);
1541
1542         /*
1543          * If echoed timestamp is later than the current time,
1544          * fall back to non RFC1323 RTT calculation.  Normalize
1545          * timestamp if syncookies were used when this connection
1546          * was established.
1547          */
1548         if ((to.to_flags & TOF_TS) && (to.to_tsecr != 0)) {
1549                 to.to_tsecr -= tp->ts_offset;
1550                 if (TSTMP_GT(to.to_tsecr, tcp_ts_getticks()))
1551                         to.to_tsecr = 0;
1552         }
1553         /*
1554          * If timestamps were negotiated during SYN/ACK they should
1555          * appear on every segment during this session and vice versa.
1556          */
1557         if ((tp->t_flags & TF_RCVD_TSTMP) && !(to.to_flags & TOF_TS)) {
1558                 if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1559                         log(LOG_DEBUG, "%s; %s: Timestamp missing, "
1560                             "no action\n", s, __func__);
1561                         free(s, M_TCPLOG);
1562                 }
1563         }
1564         if (!(tp->t_flags & TF_RCVD_TSTMP) && (to.to_flags & TOF_TS)) {
1565                 if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
1566                         log(LOG_DEBUG, "%s; %s: Timestamp not expected, "
1567                             "no action\n", s, __func__);
1568                         free(s, M_TCPLOG);
1569                 }
1570         }
1571
1572         /*
1573          * Process options only when we get SYN/ACK back. The SYN case
1574          * for incoming connections is handled in tcp_syncache.
1575          * According to RFC1323 the window field in a SYN (i.e., a <SYN>
1576          * or <SYN,ACK>) segment itself is never scaled.
1577          * XXX this is traditional behavior, may need to be cleaned up.
1578          */
1579         if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
1580                 if ((to.to_flags & TOF_SCALE) &&
1581                     (tp->t_flags & TF_REQ_SCALE)) {
1582                         tp->t_flags |= TF_RCVD_SCALE;
1583                         tp->snd_scale = to.to_wscale;
1584                 }
1585                 /*
1586                  * Initial send window.  It will be updated with
1587                  * the next incoming segment to the scaled value.
1588                  */
1589                 tp->snd_wnd = th->th_win;
1590                 if (to.to_flags & TOF_TS) {
1591                         tp->t_flags |= TF_RCVD_TSTMP;
1592                         tp->ts_recent = to.to_tsval;
1593                         tp->ts_recent_age = tcp_ts_getticks();
1594                 }
1595                 if (to.to_flags & TOF_MSS)
1596                         tcp_mss(tp, to.to_mss);
1597                 if ((tp->t_flags & TF_SACK_PERMIT) &&
1598                     (to.to_flags & TOF_SACKPERM) == 0)
1599                         tp->t_flags &= ~TF_SACK_PERMIT;
1600         }
1601
1602         /*
1603          * Header prediction: check for the two common cases
1604          * of a uni-directional data xfer.  If the packet has
1605          * no control flags, is in-sequence, the window didn't
1606          * change and we're not retransmitting, it's a
1607          * candidate.  If the length is zero and the ack moved
1608          * forward, we're the sender side of the xfer.  Just
1609          * free the data acked & wake any higher level process
1610          * that was blocked waiting for space.  If the length
1611          * is non-zero and the ack didn't move, we're the
1612          * receiver side.  If we're getting packets in-order
1613          * (the reassembly queue is empty), add the data to
1614          * the socket buffer and note that we need a delayed ack.
1615          * Make sure that the hidden state-flags are also off.
1616          * Since we check for TCPS_ESTABLISHED first, it can only
1617          * be TH_NEEDSYN.
1618          */
1619         if (tp->t_state == TCPS_ESTABLISHED &&
1620             th->th_seq == tp->rcv_nxt &&
1621             (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
1622             tp->snd_nxt == tp->snd_max &&
1623             tiwin && tiwin == tp->snd_wnd &&
1624             ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
1625             tp->t_segq == NULL && ((to.to_flags & TOF_TS) == 0 ||
1626              TSTMP_GEQ(to.to_tsval, tp->ts_recent)) ) {
1627
1628                 /*
1629                  * If last ACK falls within this segment's sequence numbers,
1630                  * record the timestamp.
1631                  * NOTE that the test is modified according to the latest
1632                  * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1633                  */
1634                 if ((to.to_flags & TOF_TS) != 0 &&
1635                     SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1636                         tp->ts_recent_age = tcp_ts_getticks();
1637                         tp->ts_recent = to.to_tsval;
1638                 }
1639
1640                 if (tlen == 0) {
1641                         if (SEQ_GT(th->th_ack, tp->snd_una) &&
1642                             SEQ_LEQ(th->th_ack, tp->snd_max) &&
1643                             !IN_RECOVERY(tp->t_flags) &&
1644                             (to.to_flags & TOF_SACK) == 0 &&
1645                             TAILQ_EMPTY(&tp->snd_holes)) {
1646                                 /*
1647                                  * This is a pure ack for outstanding data.
1648                                  */
1649                                 if (ti_locked == TI_WLOCKED)
1650                                         INP_INFO_WUNLOCK(&V_tcbinfo);
1651                                 ti_locked = TI_UNLOCKED;
1652
1653                                 TCPSTAT_INC(tcps_predack);
1654
1655                                 /*
1656                                  * "bad retransmit" recovery.
1657                                  */
1658                                 if (tp->t_rxtshift == 1 &&
1659                                     tp->t_flags & TF_PREVVALID &&
1660                                     (int)(ticks - tp->t_badrxtwin) < 0) {
1661                                         cc_cong_signal(tp, th, CC_RTO_ERR);
1662                                 }
1663
1664                                 /*
1665                                  * Recalculate the transmit timer / rtt.
1666                                  *
1667                                  * Some boxes send broken timestamp replies
1668                                  * during the SYN+ACK phase, ignore
1669                                  * timestamps of 0 or we could calculate a
1670                                  * huge RTT and blow up the retransmit timer.
1671                                  */
1672                                 if ((to.to_flags & TOF_TS) != 0 &&
1673                                     to.to_tsecr) {
1674                                         u_int t;
1675
1676                                         t = tcp_ts_getticks() - to.to_tsecr;
1677                                         if (!tp->t_rttlow || tp->t_rttlow > t)
1678                                                 tp->t_rttlow = t;
1679                                         tcp_xmit_timer(tp,
1680                                             TCP_TS_TO_TICKS(t) + 1);
1681                                 } else if (tp->t_rtttime &&
1682                                     SEQ_GT(th->th_ack, tp->t_rtseq)) {
1683                                         if (!tp->t_rttlow ||
1684                                             tp->t_rttlow > ticks - tp->t_rtttime)
1685                                                 tp->t_rttlow = ticks - tp->t_rtttime;
1686                                         tcp_xmit_timer(tp,
1687                                                         ticks - tp->t_rtttime);
1688                                 }
1689                                 acked = BYTES_THIS_ACK(tp, th);
1690
1691                                 /* Run HHOOK_TCP_ESTABLISHED_IN helper hooks. */
1692                                 hhook_run_tcp_est_in(tp, th, &to);
1693
1694                                 TCPSTAT_INC(tcps_rcvackpack);
1695                                 TCPSTAT_ADD(tcps_rcvackbyte, acked);
1696                                 sbdrop(&so->so_snd, acked);
1697                                 if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
1698                                     SEQ_LEQ(th->th_ack, tp->snd_recover))
1699                                         tp->snd_recover = th->th_ack - 1;
1700
1701                                 /*
1702                                  * Let the congestion control algorithm update
1703                                  * congestion control related information. This
1704                                  * typically means increasing the congestion
1705                                  * window.
1706                                  */
1707                                 cc_ack_received(tp, th, CC_ACK);
1708
1709                                 tp->snd_una = th->th_ack;
1710                                 /*
1711                                  * Pull snd_wl2 up to prevent seq wrap relative
1712                                  * to th_ack.
1713                                  */
1714                                 tp->snd_wl2 = th->th_ack;
1715                                 tp->t_dupacks = 0;
1716                                 m_freem(m);
1717                                 ND6_HINT(tp); /* Some progress has been made. */
1718
1719                                 /*
1720                                  * If all outstanding data are acked, stop
1721                                  * retransmit timer, otherwise restart timer
1722                                  * using current (possibly backed-off) value.
1723                                  * If process is waiting for space,
1724                                  * wakeup/selwakeup/signal.  If data
1725                                  * are ready to send, let tcp_output
1726                                  * decide between more output or persist.
1727                                  */
1728 #ifdef TCPDEBUG
1729                                 if (so->so_options & SO_DEBUG)
1730                                         tcp_trace(TA_INPUT, ostate, tp,
1731                                             (void *)tcp_saveipgen,
1732                                             &tcp_savetcp, 0);
1733 #endif
1734                                 if (tp->snd_una == tp->snd_max)
1735                                         tcp_timer_activate(tp, TT_REXMT, 0);
1736                                 else if (!tcp_timer_active(tp, TT_PERSIST))
1737                                         tcp_timer_activate(tp, TT_REXMT,
1738                                                       tp->t_rxtcur);
1739                                 sowwakeup(so);
1740                                 if (so->so_snd.sb_cc)
1741                                         (void) tcp_output(tp);
1742                                 goto check_delack;
1743                         }
1744                 } else if (th->th_ack == tp->snd_una &&
1745                     tlen <= sbspace(&so->so_rcv)) {
1746                         int newsize = 0;        /* automatic sockbuf scaling */
1747
1748                         /*
1749                          * This is a pure, in-sequence data packet with
1750                          * nothing on the reassembly queue and we have enough
1751                          * buffer space to take it.
1752                          */
1753                         if (ti_locked == TI_WLOCKED)
1754                                 INP_INFO_WUNLOCK(&V_tcbinfo);
1755                         ti_locked = TI_UNLOCKED;
1756
1757                         /* Clean receiver SACK report if present */
1758                         if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks)
1759                                 tcp_clean_sackreport(tp);
1760                         TCPSTAT_INC(tcps_preddat);
1761                         tp->rcv_nxt += tlen;
1762                         /*
1763                          * Pull snd_wl1 up to prevent seq wrap relative to
1764                          * th_seq.
1765                          */
1766                         tp->snd_wl1 = th->th_seq;
1767                         /*
1768                          * Pull rcv_up up to prevent seq wrap relative to
1769                          * rcv_nxt.
1770                          */
1771                         tp->rcv_up = tp->rcv_nxt;
1772                         TCPSTAT_INC(tcps_rcvpack);
1773                         TCPSTAT_ADD(tcps_rcvbyte, tlen);
1774                         ND6_HINT(tp);   /* Some progress has been made */
1775 #ifdef TCPDEBUG
1776                         if (so->so_options & SO_DEBUG)
1777                                 tcp_trace(TA_INPUT, ostate, tp,
1778                                     (void *)tcp_saveipgen, &tcp_savetcp, 0);
1779 #endif
1780                 /*
1781                  * Automatic sizing of receive socket buffer.  Often the send
1782                  * buffer size is not optimally adjusted to the actual network
1783                  * conditions at hand (delay bandwidth product).  Setting the
1784                  * buffer size too small limits throughput on links with high
1785                  * bandwidth and high delay (eg. trans-continental/oceanic links).
1786                  *
1787                  * On the receive side the socket buffer memory is only rarely
1788                  * used to any significant extent.  This allows us to be much
1789                  * more aggressive in scaling the receive socket buffer.  For
1790                  * the case that the buffer space is actually used to a large
1791                  * extent and we run out of kernel memory we can simply drop
1792                  * the new segments; TCP on the sender will just retransmit it
1793                  * later.  Setting the buffer size too big may only consume too
1794                  * much kernel memory if the application doesn't read() from
1795                  * the socket or packet loss or reordering makes use of the
1796                  * reassembly queue.
1797                  *
1798                  * The criteria to step up the receive buffer one notch are:
1799                  *  1. Application has not set receive buffer size with
1800                  *     SO_RCVBUF. Setting SO_RCVBUF clears SB_AUTOSIZE.
1801                  *  2. the number of bytes received during the time it takes
1802                  *     one timestamp to be reflected back to us (the RTT);
1803                  *  3. received bytes per RTT is within seven eighth of the
1804                  *     current socket buffer size;
1805                  *  4. receive buffer size has not hit maximal automatic size;
1806                  *
1807                  * This algorithm does one step per RTT at most and only if
1808                  * we receive a bulk stream w/o packet losses or reorderings.
1809                  * Shrinking the buffer during idle times is not necessary as
1810                  * it doesn't consume any memory when idle.
1811                  *
1812                  * TODO: Only step up if the application is actually serving
1813                  * the buffer to better manage the socket buffer resources.
1814                  */
1815                         if (V_tcp_do_autorcvbuf &&
1816                             to.to_tsecr &&
1817                             (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1818                                 if (TSTMP_GT(to.to_tsecr, tp->rfbuf_ts) &&
1819                                     to.to_tsecr - tp->rfbuf_ts < hz) {
1820                                         if (tp->rfbuf_cnt >
1821                                             (so->so_rcv.sb_hiwat / 8 * 7) &&
1822                                             so->so_rcv.sb_hiwat <
1823                                             V_tcp_autorcvbuf_max) {
1824                                                 newsize =
1825                                                     min(so->so_rcv.sb_hiwat +
1826                                                     V_tcp_autorcvbuf_inc,
1827                                                     V_tcp_autorcvbuf_max);
1828                                         }
1829                                         /* Start over with next RTT. */
1830                                         tp->rfbuf_ts = 0;
1831                                         tp->rfbuf_cnt = 0;
1832                                 } else
1833                                         tp->rfbuf_cnt += tlen;  /* add up */
1834                         }
1835
1836                         /* Add data to socket buffer. */
1837                         SOCKBUF_LOCK(&so->so_rcv);
1838                         if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
1839                                 m_freem(m);
1840                         } else {
1841                                 /*
1842                                  * Set new socket buffer size.
1843                                  * Give up when limit is reached.
1844                                  */
1845                                 if (newsize)
1846                                         if (!sbreserve_locked(&so->so_rcv,
1847                                             newsize, so, NULL))
1848                                                 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
1849                                 m_adj(m, drop_hdrlen);  /* delayed header drop */
1850                                 sbappendstream_locked(&so->so_rcv, m);
1851                         }
1852                         /* NB: sorwakeup_locked() does an implicit unlock. */
1853                         sorwakeup_locked(so);
1854                         if (DELAY_ACK(tp, tlen)) {
1855                                 tp->t_flags |= TF_DELACK;
1856                         } else {
1857                                 tp->t_flags |= TF_ACKNOW;
1858                                 tcp_output(tp);
1859                         }
1860                         goto check_delack;
1861                 }
1862         }
1863
1864         /*
1865          * Calculate amount of space in receive window,
1866          * and then do TCP input processing.
1867          * Receive window is amount of space in rcv queue,
1868          * but not less than advertised window.
1869          */
1870         win = sbspace(&so->so_rcv);
1871         if (win < 0)
1872                 win = 0;
1873         tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1874
1875         /* Reset receive buffer auto scaling when not in bulk receive mode. */
1876         tp->rfbuf_ts = 0;
1877         tp->rfbuf_cnt = 0;
1878
1879         switch (tp->t_state) {
1880
1881         /*
1882          * If the state is SYN_RECEIVED:
1883          *      if seg contains an ACK, but not for our SYN/ACK, send a RST.
1884          */
1885         case TCPS_SYN_RECEIVED:
1886                 if ((thflags & TH_ACK) &&
1887                     (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1888                      SEQ_GT(th->th_ack, tp->snd_max))) {
1889                                 rstreason = BANDLIM_RST_OPENPORT;
1890                                 goto dropwithreset;
1891                 }
1892                 break;
1893
1894         /*
1895          * If the state is SYN_SENT:
1896          *      if seg contains an ACK, but not for our SYN, drop the input.
1897          *      if seg contains a RST, then drop the connection.
1898          *      if seg does not contain SYN, then drop it.
1899          * Otherwise this is an acceptable SYN segment
1900          *      initialize tp->rcv_nxt and tp->irs
1901          *      if seg contains ack then advance tp->snd_una
1902          *      if seg contains an ECE and ECN support is enabled, the stream
1903          *          is ECN capable.
1904          *      if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1905          *      arrange for segment to be acked (eventually)
1906          *      continue processing rest of data/controls, beginning with URG
1907          */
1908         case TCPS_SYN_SENT:
1909                 if ((thflags & TH_ACK) &&
1910                     (SEQ_LEQ(th->th_ack, tp->iss) ||
1911                      SEQ_GT(th->th_ack, tp->snd_max))) {
1912                         rstreason = BANDLIM_UNLIMITED;
1913                         goto dropwithreset;
1914                 }
1915                 if ((thflags & (TH_ACK|TH_RST)) == (TH_ACK|TH_RST)) {
1916                         TCP_PROBE5(connect__refused, NULL, tp,
1917                             mtod(m, const char *), tp, th);
1918                         tp = tcp_drop(tp, ECONNREFUSED);
1919                 }
1920                 if (thflags & TH_RST)
1921                         goto drop;
1922                 if (!(thflags & TH_SYN))
1923                         goto drop;
1924
1925                 tp->irs = th->th_seq;
1926                 tcp_rcvseqinit(tp);
1927                 if (thflags & TH_ACK) {
1928                         TCPSTAT_INC(tcps_connects);
1929                         soisconnected(so);
1930 #ifdef MAC
1931                         mac_socketpeer_set_from_mbuf(m, so);
1932 #endif
1933                         /* Do window scaling on this connection? */
1934                         if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1935                                 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1936                                 tp->rcv_scale = tp->request_r_scale;
1937                         }
1938                         tp->rcv_adv += imin(tp->rcv_wnd,
1939                             TCP_MAXWIN << tp->rcv_scale);
1940                         tp->snd_una++;          /* SYN is acked */
1941                         /*
1942                          * If there's data, delay ACK; if there's also a FIN
1943                          * ACKNOW will be turned on later.
1944                          */
1945                         if (DELAY_ACK(tp, tlen) && tlen != 0)
1946                                 tcp_timer_activate(tp, TT_DELACK,
1947                                     tcp_delacktime);
1948                         else
1949                                 tp->t_flags |= TF_ACKNOW;
1950
1951                         if ((thflags & TH_ECE) && V_tcp_do_ecn) {
1952                                 tp->t_flags |= TF_ECN_PERMIT;
1953                                 TCPSTAT_INC(tcps_ecn_shs);
1954                         }
1955
1956                         /*
1957                          * Received <SYN,ACK> in SYN_SENT[*] state.
1958                          * Transitions:
1959                          *      SYN_SENT  --> ESTABLISHED
1960                          *      SYN_SENT* --> FIN_WAIT_1
1961                          */
1962                         tp->t_starttime = ticks;
1963                         if (tp->t_flags & TF_NEEDFIN) {
1964                                 tcp_state_change(tp, TCPS_FIN_WAIT_1);
1965                                 tp->t_flags &= ~TF_NEEDFIN;
1966                                 thflags &= ~TH_SYN;
1967                         } else {
1968                                 tcp_state_change(tp, TCPS_ESTABLISHED);
1969                                 TCP_PROBE5(connect__established, NULL, tp,
1970                                     mtod(m, const char *), tp, th);
1971                                 cc_conn_init(tp);
1972                                 tcp_timer_activate(tp, TT_KEEP,
1973                                     TP_KEEPIDLE(tp));
1974                         }
1975                 } else {
1976                         /*
1977                          * Received initial SYN in SYN-SENT[*] state =>
1978                          * simultaneous open.
1979                          * If it succeeds, connection is * half-synchronized.
1980                          * Otherwise, do 3-way handshake:
1981                          *        SYN-SENT -> SYN-RECEIVED
1982                          *        SYN-SENT* -> SYN-RECEIVED*
1983                          */
1984                         tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
1985                         tcp_timer_activate(tp, TT_REXMT, 0);
1986                         tcp_state_change(tp, TCPS_SYN_RECEIVED);
1987                 }
1988
1989                 KASSERT(ti_locked == TI_WLOCKED, ("%s: trimthenstep6: "
1990                     "ti_locked %d", __func__, ti_locked));
1991                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
1992                 INP_WLOCK_ASSERT(tp->t_inpcb);
1993
1994                 /*
1995                  * Advance th->th_seq to correspond to first data byte.
1996                  * If data, trim to stay within window,
1997                  * dropping FIN if necessary.
1998                  */
1999                 th->th_seq++;
2000                 if (tlen > tp->rcv_wnd) {
2001                         todrop = tlen - tp->rcv_wnd;
2002                         m_adj(m, -todrop);
2003                         tlen = tp->rcv_wnd;
2004                         thflags &= ~TH_FIN;
2005                         TCPSTAT_INC(tcps_rcvpackafterwin);
2006                         TCPSTAT_ADD(tcps_rcvbyteafterwin, todrop);
2007                 }
2008                 tp->snd_wl1 = th->th_seq - 1;
2009                 tp->rcv_up = th->th_seq;
2010                 /*
2011                  * Client side of transaction: already sent SYN and data.
2012                  * If the remote host used T/TCP to validate the SYN,
2013                  * our data will be ACK'd; if so, enter normal data segment
2014                  * processing in the middle of step 5, ack processing.
2015                  * Otherwise, goto step 6.
2016                  */
2017                 if (thflags & TH_ACK)
2018                         goto process_ACK;
2019
2020                 goto step6;
2021
2022         /*
2023          * If the state is LAST_ACK or CLOSING or TIME_WAIT:
2024          *      do normal processing.
2025          *
2026          * NB: Leftover from RFC1644 T/TCP.  Cases to be reused later.
2027          */
2028         case TCPS_LAST_ACK:
2029         case TCPS_CLOSING:
2030                 break;  /* continue normal processing */
2031         }
2032
2033         /*
2034          * States other than LISTEN or SYN_SENT.
2035          * First check the RST flag and sequence number since reset segments
2036          * are exempt from the timestamp and connection count tests.  This
2037          * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
2038          * below which allowed reset segments in half the sequence space
2039          * to fall though and be processed (which gives forged reset
2040          * segments with a random sequence number a 50 percent chance of
2041          * killing a connection).
2042          * Then check timestamp, if present.
2043          * Then check the connection count, if present.
2044          * Then check that at least some bytes of segment are within
2045          * receive window.  If segment begins before rcv_nxt,
2046          * drop leading data (and SYN); if nothing left, just ack.
2047          *
2048          *
2049          * If the RST bit is set, check the sequence number to see
2050          * if this is a valid reset segment.
2051          * RFC 793 page 37:
2052          *   In all states except SYN-SENT, all reset (RST) segments
2053          *   are validated by checking their SEQ-fields.  A reset is
2054          *   valid if its sequence number is in the window.
2055          * Note: this does not take into account delayed ACKs, so
2056          *   we should test against last_ack_sent instead of rcv_nxt.
2057          *   The sequence number in the reset segment is normally an
2058          *   echo of our outgoing acknowlegement numbers, but some hosts
2059          *   send a reset with the sequence number at the rightmost edge
2060          *   of our receive window, and we have to handle this case.
2061          * Note 2: Paul Watson's paper "Slipping in the Window" has shown
2062          *   that brute force RST attacks are possible.  To combat this,
2063          *   we use a much stricter check while in the ESTABLISHED state,
2064          *   only accepting RSTs where the sequence number is equal to
2065          *   last_ack_sent.  In all other states (the states in which a
2066          *   RST is more likely), the more permissive check is used.
2067          * If we have multiple segments in flight, the initial reset
2068          * segment sequence numbers will be to the left of last_ack_sent,
2069          * but they will eventually catch up.
2070          * In any case, it never made sense to trim reset segments to
2071          * fit the receive window since RFC 1122 says:
2072          *   4.2.2.12  RST Segment: RFC-793 Section 3.4
2073          *
2074          *    A TCP SHOULD allow a received RST segment to include data.
2075          *
2076          *    DISCUSSION
2077          *         It has been suggested that a RST segment could contain
2078          *         ASCII text that encoded and explained the cause of the
2079          *         RST.  No standard has yet been established for such
2080          *         data.
2081          *
2082          * If the reset segment passes the sequence number test examine
2083          * the state:
2084          *    SYN_RECEIVED STATE:
2085          *      If passive open, return to LISTEN state.
2086          *      If active open, inform user that connection was refused.
2087          *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
2088          *      Inform user that connection was reset, and close tcb.
2089          *    CLOSING, LAST_ACK STATES:
2090          *      Close the tcb.
2091          *    TIME_WAIT STATE:
2092          *      Drop the segment - see Stevens, vol. 2, p. 964 and
2093          *      RFC 1337.
2094          */
2095         if (thflags & TH_RST) {
2096                 if (SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
2097                     SEQ_LEQ(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
2098                         switch (tp->t_state) {
2099
2100                         case TCPS_SYN_RECEIVED:
2101                                 so->so_error = ECONNREFUSED;
2102                                 goto close;
2103
2104                         case TCPS_ESTABLISHED:
2105                                 if (V_tcp_insecure_rst == 0 &&
2106                                     !(SEQ_GEQ(th->th_seq, tp->rcv_nxt - 1) &&
2107                                     SEQ_LEQ(th->th_seq, tp->rcv_nxt + 1)) &&
2108                                     !(SEQ_GEQ(th->th_seq, tp->last_ack_sent - 1) &&
2109                                     SEQ_LEQ(th->th_seq, tp->last_ack_sent + 1))) {
2110                                         TCPSTAT_INC(tcps_badrst);
2111                                         goto drop;
2112                                 }
2113                                 /* FALLTHROUGH */
2114                         case TCPS_FIN_WAIT_1:
2115                         case TCPS_FIN_WAIT_2:
2116                         case TCPS_CLOSE_WAIT:
2117                                 so->so_error = ECONNRESET;
2118                         close:
2119                                 KASSERT(ti_locked == TI_WLOCKED,
2120                                     ("tcp_do_segment: TH_RST 1 ti_locked %d",
2121                                     ti_locked));
2122                                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2123
2124                                 tcp_state_change(tp, TCPS_CLOSED);
2125                                 TCPSTAT_INC(tcps_drops);
2126                                 tp = tcp_close(tp);
2127                                 break;
2128
2129                         case TCPS_CLOSING:
2130                         case TCPS_LAST_ACK:
2131                                 KASSERT(ti_locked == TI_WLOCKED,
2132                                     ("tcp_do_segment: TH_RST 2 ti_locked %d",
2133                                     ti_locked));
2134                                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2135
2136                                 tp = tcp_close(tp);
2137                                 break;
2138                         }
2139                 }
2140                 goto drop;
2141         }
2142
2143         /*
2144          * RFC 1323 PAWS: If we have a timestamp reply on this segment
2145          * and it's less than ts_recent, drop it.
2146          */
2147         if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
2148             TSTMP_LT(to.to_tsval, tp->ts_recent)) {
2149
2150                 /* Check to see if ts_recent is over 24 days old.  */
2151                 if (tcp_ts_getticks() - tp->ts_recent_age > TCP_PAWS_IDLE) {
2152                         /*
2153                          * Invalidate ts_recent.  If this segment updates
2154                          * ts_recent, the age will be reset later and ts_recent
2155                          * will get a valid value.  If it does not, setting
2156                          * ts_recent to zero will at least satisfy the
2157                          * requirement that zero be placed in the timestamp
2158                          * echo reply when ts_recent isn't valid.  The
2159                          * age isn't reset until we get a valid ts_recent
2160                          * because we don't want out-of-order segments to be
2161                          * dropped when ts_recent is old.
2162                          */
2163                         tp->ts_recent = 0;
2164                 } else {
2165                         TCPSTAT_INC(tcps_rcvduppack);
2166                         TCPSTAT_ADD(tcps_rcvdupbyte, tlen);
2167                         TCPSTAT_INC(tcps_pawsdrop);
2168                         if (tlen)
2169                                 goto dropafterack;
2170                         goto drop;
2171                 }
2172         }
2173
2174         /*
2175          * In the SYN-RECEIVED state, validate that the packet belongs to
2176          * this connection before trimming the data to fit the receive
2177          * window.  Check the sequence number versus IRS since we know
2178          * the sequence numbers haven't wrapped.  This is a partial fix
2179          * for the "LAND" DoS attack.
2180          */
2181         if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
2182                 rstreason = BANDLIM_RST_OPENPORT;
2183                 goto dropwithreset;
2184         }
2185
2186         todrop = tp->rcv_nxt - th->th_seq;
2187         if (todrop > 0) {
2188                 /*
2189                  * If this is a duplicate SYN for our current connection,
2190                  * advance over it and pretend and it's not a SYN.
2191                  */
2192                 if (thflags & TH_SYN && th->th_seq == tp->irs) {
2193                         thflags &= ~TH_SYN;
2194                         th->th_seq++;
2195                         if (th->th_urp > 1)
2196                                 th->th_urp--;
2197                         else
2198                                 thflags &= ~TH_URG;
2199                         todrop--;
2200                 }
2201                 /*
2202                  * Following if statement from Stevens, vol. 2, p. 960.
2203                  */
2204                 if (todrop > tlen
2205                     || (todrop == tlen && (thflags & TH_FIN) == 0)) {
2206                         /*
2207                          * Any valid FIN must be to the left of the window.
2208                          * At this point the FIN must be a duplicate or out
2209                          * of sequence; drop it.
2210                          */
2211                         thflags &= ~TH_FIN;
2212
2213                         /*
2214                          * Send an ACK to resynchronize and drop any data.
2215                          * But keep on processing for RST or ACK.
2216                          */
2217                         tp->t_flags |= TF_ACKNOW;
2218                         todrop = tlen;
2219                         TCPSTAT_INC(tcps_rcvduppack);
2220                         TCPSTAT_ADD(tcps_rcvdupbyte, todrop);
2221                 } else {
2222                         TCPSTAT_INC(tcps_rcvpartduppack);
2223                         TCPSTAT_ADD(tcps_rcvpartdupbyte, todrop);
2224                 }
2225                 drop_hdrlen += todrop;  /* drop from the top afterwards */
2226                 th->th_seq += todrop;
2227                 tlen -= todrop;
2228                 if (th->th_urp > todrop)
2229                         th->th_urp -= todrop;
2230                 else {
2231                         thflags &= ~TH_URG;
2232                         th->th_urp = 0;
2233                 }
2234         }
2235
2236         /*
2237          * If new data are received on a connection after the
2238          * user processes are gone, then RST the other end.
2239          */
2240         if ((so->so_state & SS_NOFDREF) &&
2241             tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2242                 KASSERT(ti_locked == TI_WLOCKED, ("%s: SS_NOFDEREF && "
2243                     "CLOSE_WAIT && tlen ti_locked %d", __func__, ti_locked));
2244                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2245
2246                 if ((s = tcp_log_addrs(inc, th, NULL, NULL))) {
2247                         log(LOG_DEBUG, "%s; %s: %s: Received %d bytes of data "
2248                             "after socket was closed, "
2249                             "sending RST and removing tcpcb\n",
2250                             s, __func__, tcpstates[tp->t_state], tlen);
2251                         free(s, M_TCPLOG);
2252                 }
2253                 tp = tcp_close(tp);
2254                 TCPSTAT_INC(tcps_rcvafterclose);
2255                 rstreason = BANDLIM_UNLIMITED;
2256                 goto dropwithreset;
2257         }
2258
2259         /*
2260          * If segment ends after window, drop trailing data
2261          * (and PUSH and FIN); if nothing left, just ACK.
2262          */
2263         todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
2264         if (todrop > 0) {
2265                 TCPSTAT_INC(tcps_rcvpackafterwin);
2266                 if (todrop >= tlen) {
2267                         TCPSTAT_ADD(tcps_rcvbyteafterwin, tlen);
2268                         /*
2269                          * If window is closed can only take segments at
2270                          * window edge, and have to drop data and PUSH from
2271                          * incoming segments.  Continue processing, but
2272                          * remember to ack.  Otherwise, drop segment
2273                          * and ack.
2274                          */
2275                         if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2276                                 tp->t_flags |= TF_ACKNOW;
2277                                 TCPSTAT_INC(tcps_rcvwinprobe);
2278                         } else
2279                                 goto dropafterack;
2280                 } else
2281                         TCPSTAT_ADD(tcps_rcvbyteafterwin, todrop);
2282                 m_adj(m, -todrop);
2283                 tlen -= todrop;
2284                 thflags &= ~(TH_PUSH|TH_FIN);
2285         }
2286
2287         /*
2288          * If last ACK falls within this segment's sequence numbers,
2289          * record its timestamp.
2290          * NOTE:
2291          * 1) That the test incorporates suggestions from the latest
2292          *    proposal of the tcplw@cray.com list (Braden 1993/04/26).
2293          * 2) That updating only on newer timestamps interferes with
2294          *    our earlier PAWS tests, so this check should be solely
2295          *    predicated on the sequence space of this segment.
2296          * 3) That we modify the segment boundary check to be
2297          *        Last.ACK.Sent <= SEG.SEQ + SEG.Len
2298          *    instead of RFC1323's
2299          *        Last.ACK.Sent < SEG.SEQ + SEG.Len,
2300          *    This modified check allows us to overcome RFC1323's
2301          *    limitations as described in Stevens TCP/IP Illustrated
2302          *    Vol. 2 p.869. In such cases, we can still calculate the
2303          *    RTT correctly when RCV.NXT == Last.ACK.Sent.
2304          */
2305         if ((to.to_flags & TOF_TS) != 0 &&
2306             SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2307             SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2308                 ((thflags & (TH_SYN|TH_FIN)) != 0))) {
2309                 tp->ts_recent_age = tcp_ts_getticks();
2310                 tp->ts_recent = to.to_tsval;
2311         }
2312
2313         /*
2314          * If a SYN is in the window, then this is an
2315          * error and we send an RST and drop the connection.
2316          */
2317         if (thflags & TH_SYN) {
2318                 KASSERT(ti_locked == TI_WLOCKED,
2319                     ("tcp_do_segment: TH_SYN ti_locked %d", ti_locked));
2320                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2321
2322                 tp = tcp_drop(tp, ECONNRESET);
2323                 rstreason = BANDLIM_UNLIMITED;
2324                 goto drop;
2325         }
2326
2327         /*
2328          * If the ACK bit is off:  if in SYN-RECEIVED state or SENDSYN
2329          * flag is on (half-synchronized state), then queue data for
2330          * later processing; else drop segment and return.
2331          */
2332         if ((thflags & TH_ACK) == 0) {
2333                 if (tp->t_state == TCPS_SYN_RECEIVED ||
2334                     (tp->t_flags & TF_NEEDSYN))
2335                         goto step6;
2336                 else if (tp->t_flags & TF_ACKNOW)
2337                         goto dropafterack;
2338                 else
2339                         goto drop;
2340         }
2341
2342         /*
2343          * Ack processing.
2344          */
2345         switch (tp->t_state) {
2346
2347         /*
2348          * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
2349          * ESTABLISHED state and continue processing.
2350          * The ACK was checked above.
2351          */
2352         case TCPS_SYN_RECEIVED:
2353
2354                 TCPSTAT_INC(tcps_connects);
2355                 soisconnected(so);
2356                 /* Do window scaling? */
2357                 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2358                         (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2359                         tp->rcv_scale = tp->request_r_scale;
2360                         tp->snd_wnd = tiwin;
2361                 }
2362                 /*
2363                  * Make transitions:
2364                  *      SYN-RECEIVED  -> ESTABLISHED
2365                  *      SYN-RECEIVED* -> FIN-WAIT-1
2366                  */
2367                 tp->t_starttime = ticks;
2368                 if (tp->t_flags & TF_NEEDFIN) {
2369                         tcp_state_change(tp, TCPS_FIN_WAIT_1);
2370                         tp->t_flags &= ~TF_NEEDFIN;
2371                 } else {
2372                         tcp_state_change(tp, TCPS_ESTABLISHED);
2373                         TCP_PROBE5(accept__established, NULL, tp,
2374                             mtod(m, const char *), tp, th);
2375                         cc_conn_init(tp);
2376                         tcp_timer_activate(tp, TT_KEEP, TP_KEEPIDLE(tp));
2377                 }
2378                 /*
2379                  * If segment contains data or ACK, will call tcp_reass()
2380                  * later; if not, do so now to pass queued data to user.
2381                  */
2382                 if (tlen == 0 && (thflags & TH_FIN) == 0)
2383                         (void) tcp_reass(tp, (struct tcphdr *)0, 0,
2384                             (struct mbuf *)0);
2385                 tp->snd_wl1 = th->th_seq - 1;
2386                 /* FALLTHROUGH */
2387
2388         /*
2389          * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2390          * ACKs.  If the ack is in the range
2391          *      tp->snd_una < th->th_ack <= tp->snd_max
2392          * then advance tp->snd_una to th->th_ack and drop
2393          * data from the retransmission queue.  If this ACK reflects
2394          * more up to date window information we update our window information.
2395          */
2396         case TCPS_ESTABLISHED:
2397         case TCPS_FIN_WAIT_1:
2398         case TCPS_FIN_WAIT_2:
2399         case TCPS_CLOSE_WAIT:
2400         case TCPS_CLOSING:
2401         case TCPS_LAST_ACK:
2402                 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2403                         TCPSTAT_INC(tcps_rcvacktoomuch);
2404                         goto dropafterack;
2405                 }
2406                 if ((tp->t_flags & TF_SACK_PERMIT) &&
2407                     ((to.to_flags & TOF_SACK) ||
2408                      !TAILQ_EMPTY(&tp->snd_holes)))
2409                         tcp_sack_doack(tp, &to, th->th_ack);
2410
2411                 /* Run HHOOK_TCP_ESTABLISHED_IN helper hooks. */
2412                 hhook_run_tcp_est_in(tp, th, &to);
2413
2414                 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2415                         if (tlen == 0 && tiwin == tp->snd_wnd) {
2416                                 /*
2417                                  * If this is the first time we've seen a
2418                                  * FIN from the remote, this is not a
2419                                  * duplicate and it needs to be processed
2420                                  * normally.  This happens during a
2421                                  * simultaneous close.
2422                                  */
2423                                 if ((thflags & TH_FIN) &&
2424                                     (TCPS_HAVERCVDFIN(tp->t_state) == 0)) {
2425                                         tp->t_dupacks = 0;
2426                                         break;
2427                                 }
2428                                 TCPSTAT_INC(tcps_rcvdupack);
2429                                 /*
2430                                  * If we have outstanding data (other than
2431                                  * a window probe), this is a completely
2432                                  * duplicate ack (ie, window info didn't
2433                                  * change and FIN isn't set),
2434                                  * the ack is the biggest we've
2435                                  * seen and we've seen exactly our rexmt
2436                                  * threshhold of them, assume a packet
2437                                  * has been dropped and retransmit it.
2438                                  * Kludge snd_nxt & the congestion
2439                                  * window so we send only this one
2440                                  * packet.
2441                                  *
2442                                  * We know we're losing at the current
2443                                  * window size so do congestion avoidance
2444                                  * (set ssthresh to half the current window
2445                                  * and pull our congestion window back to
2446                                  * the new ssthresh).
2447                                  *
2448                                  * Dup acks mean that packets have left the
2449                                  * network (they're now cached at the receiver)
2450                                  * so bump cwnd by the amount in the receiver
2451                                  * to keep a constant cwnd packets in the
2452                                  * network.
2453                                  *
2454                                  * When using TCP ECN, notify the peer that
2455                                  * we reduced the cwnd.
2456                                  */
2457                                 if (!tcp_timer_active(tp, TT_REXMT) ||
2458                                     th->th_ack != tp->snd_una)
2459                                         tp->t_dupacks = 0;
2460                                 else if (++tp->t_dupacks > tcprexmtthresh ||
2461                                      IN_FASTRECOVERY(tp->t_flags)) {
2462                                         cc_ack_received(tp, th, CC_DUPACK);
2463                                         if ((tp->t_flags & TF_SACK_PERMIT) &&
2464                                             IN_FASTRECOVERY(tp->t_flags)) {
2465                                                 int awnd;
2466
2467                                                 /*
2468                                                  * Compute the amount of data in flight first.
2469                                                  * We can inject new data into the pipe iff
2470                                                  * we have less than 1/2 the original window's
2471                                                  * worth of data in flight.
2472                                                  */
2473                                                 awnd = (tp->snd_nxt - tp->snd_fack) +
2474                                                         tp->sackhint.sack_bytes_rexmit;
2475                                                 if (awnd < tp->snd_ssthresh) {
2476                                                         tp->snd_cwnd += tp->t_maxseg;
2477                                                         if (tp->snd_cwnd > tp->snd_ssthresh)
2478                                                                 tp->snd_cwnd = tp->snd_ssthresh;
2479                                                 }
2480                                         } else
2481                                                 tp->snd_cwnd += tp->t_maxseg;
2482                                         (void) tcp_output(tp);
2483                                         goto drop;
2484                                 } else if (tp->t_dupacks == tcprexmtthresh) {
2485                                         tcp_seq onxt = tp->snd_nxt;
2486
2487                                         /*
2488                                          * If we're doing sack, check to
2489                                          * see if we're already in sack
2490                                          * recovery. If we're not doing sack,
2491                                          * check to see if we're in newreno
2492                                          * recovery.
2493                                          */
2494                                         if (tp->t_flags & TF_SACK_PERMIT) {
2495                                                 if (IN_FASTRECOVERY(tp->t_flags)) {
2496                                                         tp->t_dupacks = 0;
2497                                                         break;
2498                                                 }
2499                                         } else {
2500                                                 if (SEQ_LEQ(th->th_ack,
2501                                                     tp->snd_recover)) {
2502                                                         tp->t_dupacks = 0;
2503                                                         break;
2504                                                 }
2505                                         }
2506                                         /* Congestion signal before ack. */
2507                                         cc_cong_signal(tp, th, CC_NDUPACK);
2508                                         cc_ack_received(tp, th, CC_DUPACK);
2509                                         tcp_timer_activate(tp, TT_REXMT, 0);
2510                                         tp->t_rtttime = 0;
2511                                         if (tp->t_flags & TF_SACK_PERMIT) {
2512                                                 TCPSTAT_INC(
2513                                                     tcps_sack_recovery_episode);
2514                                                 tp->sack_newdata = tp->snd_nxt;
2515                                                 tp->snd_cwnd = tp->t_maxseg;
2516                                                 (void) tcp_output(tp);
2517                                                 goto drop;
2518                                         }
2519                                         tp->snd_nxt = th->th_ack;
2520                                         tp->snd_cwnd = tp->t_maxseg;
2521                                         (void) tcp_output(tp);
2522                                         KASSERT(tp->snd_limited <= 2,
2523                                             ("%s: tp->snd_limited too big",
2524                                             __func__));
2525                                         tp->snd_cwnd = tp->snd_ssthresh +
2526                                              tp->t_maxseg *
2527                                              (tp->t_dupacks - tp->snd_limited);
2528                                         if (SEQ_GT(onxt, tp->snd_nxt))
2529                                                 tp->snd_nxt = onxt;
2530                                         goto drop;
2531                                 } else if (V_tcp_do_rfc3042) {
2532                                         cc_ack_received(tp, th, CC_DUPACK);
2533                                         u_long oldcwnd = tp->snd_cwnd;
2534                                         tcp_seq oldsndmax = tp->snd_max;
2535                                         u_int sent;
2536                                         int avail;
2537
2538                                         KASSERT(tp->t_dupacks == 1 ||
2539                                             tp->t_dupacks == 2,
2540                                             ("%s: dupacks not 1 or 2",
2541                                             __func__));
2542                                         if (tp->t_dupacks == 1)
2543                                                 tp->snd_limited = 0;
2544                                         tp->snd_cwnd =
2545                                             (tp->snd_nxt - tp->snd_una) +
2546                                             (tp->t_dupacks - tp->snd_limited) *
2547                                             tp->t_maxseg;
2548                                         /*
2549                                          * Only call tcp_output when there
2550                                          * is new data available to be sent.
2551                                          * Otherwise we would send pure ACKs.
2552                                          */
2553                                         SOCKBUF_LOCK(&so->so_snd);
2554                                         avail = so->so_snd.sb_cc -
2555                                             (tp->snd_nxt - tp->snd_una);
2556                                         SOCKBUF_UNLOCK(&so->so_snd);
2557                                         if (avail > 0)
2558                                                 (void) tcp_output(tp);
2559                                         sent = tp->snd_max - oldsndmax;
2560                                         if (sent > tp->t_maxseg) {
2561                                                 KASSERT((tp->t_dupacks == 2 &&
2562                                                     tp->snd_limited == 0) ||
2563                                                    (sent == tp->t_maxseg + 1 &&
2564                                                     tp->t_flags & TF_SENTFIN),
2565                                                     ("%s: sent too much",
2566                                                     __func__));
2567                                                 tp->snd_limited = 2;
2568                                         } else if (sent > 0)
2569                                                 ++tp->snd_limited;
2570                                         tp->snd_cwnd = oldcwnd;
2571                                         goto drop;
2572                                 }
2573                         } else
2574                                 tp->t_dupacks = 0;
2575                         break;
2576                 }
2577
2578                 KASSERT(SEQ_GT(th->th_ack, tp->snd_una),
2579                     ("%s: th_ack <= snd_una", __func__));
2580
2581                 /*
2582                  * If the congestion window was inflated to account
2583                  * for the other side's cached packets, retract it.
2584                  */
2585                 if (IN_FASTRECOVERY(tp->t_flags)) {
2586                         if (SEQ_LT(th->th_ack, tp->snd_recover)) {
2587                                 if (tp->t_flags & TF_SACK_PERMIT)
2588                                         tcp_sack_partialack(tp, th);
2589                                 else
2590                                         tcp_newreno_partial_ack(tp, th);
2591                         } else
2592                                 cc_post_recovery(tp, th);
2593                 }
2594                 tp->t_dupacks = 0;
2595                 /*
2596                  * If we reach this point, ACK is not a duplicate,
2597                  *     i.e., it ACKs something we sent.
2598                  */
2599                 if (tp->t_flags & TF_NEEDSYN) {
2600                         /*
2601                          * T/TCP: Connection was half-synchronized, and our
2602                          * SYN has been ACK'd (so connection is now fully
2603                          * synchronized).  Go to non-starred state,
2604                          * increment snd_una for ACK of SYN, and check if
2605                          * we can do window scaling.
2606                          */
2607                         tp->t_flags &= ~TF_NEEDSYN;
2608                         tp->snd_una++;
2609                         /* Do window scaling? */
2610                         if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2611                                 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2612                                 tp->rcv_scale = tp->request_r_scale;
2613                                 /* Send window already scaled. */
2614                         }
2615                 }
2616
2617 process_ACK:
2618                 INP_WLOCK_ASSERT(tp->t_inpcb);
2619
2620                 acked = BYTES_THIS_ACK(tp, th);
2621                 TCPSTAT_INC(tcps_rcvackpack);
2622                 TCPSTAT_ADD(tcps_rcvackbyte, acked);
2623
2624                 /*
2625                  * If we just performed our first retransmit, and the ACK
2626                  * arrives within our recovery window, then it was a mistake
2627                  * to do the retransmit in the first place.  Recover our
2628                  * original cwnd and ssthresh, and proceed to transmit where
2629                  * we left off.
2630                  */
2631                 if (tp->t_rxtshift == 1 && tp->t_flags & TF_PREVVALID &&
2632                     (int)(ticks - tp->t_badrxtwin) < 0)
2633                         cc_cong_signal(tp, th, CC_RTO_ERR);
2634
2635                 /*
2636                  * If we have a timestamp reply, update smoothed
2637                  * round trip time.  If no timestamp is present but
2638                  * transmit timer is running and timed sequence
2639                  * number was acked, update smoothed round trip time.
2640                  * Since we now have an rtt measurement, cancel the
2641                  * timer backoff (cf., Phil Karn's retransmit alg.).
2642                  * Recompute the initial retransmit timer.
2643                  *
2644                  * Some boxes send broken timestamp replies
2645                  * during the SYN+ACK phase, ignore
2646                  * timestamps of 0 or we could calculate a
2647                  * huge RTT and blow up the retransmit timer.
2648                  */
2649                 if ((to.to_flags & TOF_TS) != 0 && to.to_tsecr) {
2650                         u_int t;
2651
2652                         t = tcp_ts_getticks() - to.to_tsecr;
2653                         if (!tp->t_rttlow || tp->t_rttlow > t)
2654                                 tp->t_rttlow = t;
2655                         tcp_xmit_timer(tp, TCP_TS_TO_TICKS(t) + 1);
2656                 } else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) {
2657                         if (!tp->t_rttlow || tp->t_rttlow > ticks - tp->t_rtttime)
2658                                 tp->t_rttlow = ticks - tp->t_rtttime;
2659                         tcp_xmit_timer(tp, ticks - tp->t_rtttime);
2660                 }
2661
2662                 /*
2663                  * If all outstanding data is acked, stop retransmit
2664                  * timer and remember to restart (more output or persist).
2665                  * If there is more data to be acked, restart retransmit
2666                  * timer, using current (possibly backed-off) value.
2667                  */
2668                 if (th->th_ack == tp->snd_max) {
2669                         tcp_timer_activate(tp, TT_REXMT, 0);
2670                         needoutput = 1;
2671                 } else if (!tcp_timer_active(tp, TT_PERSIST))
2672                         tcp_timer_activate(tp, TT_REXMT, tp->t_rxtcur);
2673
2674                 /*
2675                  * If no data (only SYN) was ACK'd,
2676                  *    skip rest of ACK processing.
2677                  */
2678                 if (acked == 0)
2679                         goto step6;
2680
2681                 /*
2682                  * Let the congestion control algorithm update congestion
2683                  * control related information. This typically means increasing
2684                  * the congestion window.
2685                  */
2686                 cc_ack_received(tp, th, CC_ACK);
2687
2688                 SOCKBUF_LOCK(&so->so_snd);
2689                 if (acked > so->so_snd.sb_cc) {
2690                         tp->snd_wnd -= so->so_snd.sb_cc;
2691                         mfree = sbcut_locked(&so->so_snd,
2692                             (int)so->so_snd.sb_cc);
2693                         ourfinisacked = 1;
2694                 } else {
2695                         mfree = sbcut_locked(&so->so_snd, acked);
2696                         tp->snd_wnd -= acked;
2697                         ourfinisacked = 0;
2698                 }
2699                 /* NB: sowwakeup_locked() does an implicit unlock. */
2700                 sowwakeup_locked(so);
2701                 m_freem(mfree);
2702                 /* Detect una wraparound. */
2703                 if (!IN_RECOVERY(tp->t_flags) &&
2704                     SEQ_GT(tp->snd_una, tp->snd_recover) &&
2705                     SEQ_LEQ(th->th_ack, tp->snd_recover))
2706                         tp->snd_recover = th->th_ack - 1;
2707                 /* XXXLAS: Can this be moved up into cc_post_recovery? */
2708                 if (IN_RECOVERY(tp->t_flags) &&
2709                     SEQ_GEQ(th->th_ack, tp->snd_recover)) {
2710                         EXIT_RECOVERY(tp->t_flags);
2711                 }
2712                 tp->snd_una = th->th_ack;
2713                 if (tp->t_flags & TF_SACK_PERMIT) {
2714                         if (SEQ_GT(tp->snd_una, tp->snd_recover))
2715                                 tp->snd_recover = tp->snd_una;
2716                 }
2717                 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2718                         tp->snd_nxt = tp->snd_una;
2719
2720                 switch (tp->t_state) {
2721
2722                 /*
2723                  * In FIN_WAIT_1 STATE in addition to the processing
2724                  * for the ESTABLISHED state if our FIN is now acknowledged
2725                  * then enter FIN_WAIT_2.
2726                  */
2727                 case TCPS_FIN_WAIT_1:
2728                         if (ourfinisacked) {
2729                                 /*
2730                                  * If we can't receive any more
2731                                  * data, then closing user can proceed.
2732                                  * Starting the timer is contrary to the
2733                                  * specification, but if we don't get a FIN
2734                                  * we'll hang forever.
2735                                  *
2736                                  * XXXjl:
2737                                  * we should release the tp also, and use a
2738                                  * compressed state.
2739                                  */
2740                                 if (so->so_rcv.sb_state & SBS_CANTRCVMORE) {
2741                                         soisdisconnected(so);
2742                                         tcp_timer_activate(tp, TT_2MSL,
2743                                             (tcp_fast_finwait2_recycle ?
2744                                             tcp_finwait2_timeout :
2745                                             TP_MAXIDLE(tp)));
2746                                 }
2747                                 tcp_state_change(tp, TCPS_FIN_WAIT_2);
2748                         }
2749                         break;
2750
2751                 /*
2752                  * In CLOSING STATE in addition to the processing for
2753                  * the ESTABLISHED state if the ACK acknowledges our FIN
2754                  * then enter the TIME-WAIT state, otherwise ignore
2755                  * the segment.
2756                  */
2757                 case TCPS_CLOSING:
2758                         if (ourfinisacked) {
2759                                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2760                                 tcp_twstart(tp);
2761                                 INP_INFO_WUNLOCK(&V_tcbinfo);
2762                                 m_freem(m);
2763                                 return;
2764                         }
2765                         break;
2766
2767                 /*
2768                  * In LAST_ACK, we may still be waiting for data to drain
2769                  * and/or to be acked, as well as for the ack of our FIN.
2770                  * If our FIN is now acknowledged, delete the TCB,
2771                  * enter the closed state and return.
2772                  */
2773                 case TCPS_LAST_ACK:
2774                         if (ourfinisacked) {
2775                                 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2776                                 tp = tcp_close(tp);
2777                                 goto drop;
2778                         }
2779                         break;
2780                 }
2781         }
2782
2783 step6:
2784         INP_WLOCK_ASSERT(tp->t_inpcb);
2785
2786         /*
2787          * Update window information.
2788          * Don't look at window if no ACK: TAC's send garbage on first SYN.
2789          */
2790         if ((thflags & TH_ACK) &&
2791             (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2792             (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2793              (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2794                 /* keep track of pure window updates */
2795                 if (tlen == 0 &&
2796                     tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2797                         TCPSTAT_INC(tcps_rcvwinupd);
2798                 tp->snd_wnd = tiwin;
2799                 tp->snd_wl1 = th->th_seq;
2800                 tp->snd_wl2 = th->th_ack;
2801                 if (tp->snd_wnd > tp->max_sndwnd)
2802                         tp->max_sndwnd = tp->snd_wnd;
2803                 needoutput = 1;
2804         }
2805
2806         /*
2807          * Process segments with URG.
2808          */
2809         if ((thflags & TH_URG) && th->th_urp &&
2810             TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2811                 /*
2812                  * This is a kludge, but if we receive and accept
2813                  * random urgent pointers, we'll crash in
2814                  * soreceive.  It's hard to imagine someone
2815                  * actually wanting to send this much urgent data.
2816                  */
2817                 SOCKBUF_LOCK(&so->so_rcv);
2818                 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2819                         th->th_urp = 0;                 /* XXX */
2820                         thflags &= ~TH_URG;             /* XXX */
2821                         SOCKBUF_UNLOCK(&so->so_rcv);    /* XXX */
2822                         goto dodata;                    /* XXX */
2823                 }
2824                 /*
2825                  * If this segment advances the known urgent pointer,
2826                  * then mark the data stream.  This should not happen
2827                  * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2828                  * a FIN has been received from the remote side.
2829                  * In these states we ignore the URG.
2830                  *
2831                  * According to RFC961 (Assigned Protocols),
2832                  * the urgent pointer points to the last octet
2833                  * of urgent data.  We continue, however,
2834                  * to consider it to indicate the first octet
2835                  * of data past the urgent section as the original
2836                  * spec states (in one of two places).
2837                  */
2838                 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2839                         tp->rcv_up = th->th_seq + th->th_urp;
2840                         so->so_oobmark = so->so_rcv.sb_cc +
2841                             (tp->rcv_up - tp->rcv_nxt) - 1;
2842                         if (so->so_oobmark == 0)
2843                                 so->so_rcv.sb_state |= SBS_RCVATMARK;
2844                         sohasoutofband(so);
2845                         tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2846                 }
2847                 SOCKBUF_UNLOCK(&so->so_rcv);
2848                 /*
2849                  * Remove out of band data so doesn't get presented to user.
2850                  * This can happen independent of advancing the URG pointer,
2851                  * but if two URG's are pending at once, some out-of-band
2852                  * data may creep in... ick.
2853                  */
2854                 if (th->th_urp <= (u_long)tlen &&
2855                     !(so->so_options & SO_OOBINLINE)) {
2856                         /* hdr drop is delayed */
2857                         tcp_pulloutofband(so, th, m, drop_hdrlen);
2858                 }
2859         } else {
2860                 /*
2861                  * If no out of band data is expected,
2862                  * pull receive urgent pointer along
2863                  * with the receive window.
2864                  */
2865                 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2866                         tp->rcv_up = tp->rcv_nxt;
2867         }
2868 dodata:                                                 /* XXX */
2869         INP_WLOCK_ASSERT(tp->t_inpcb);
2870
2871         /*
2872          * Process the segment text, merging it into the TCP sequencing queue,
2873          * and arranging for acknowledgment of receipt if necessary.
2874          * This process logically involves adjusting tp->rcv_wnd as data
2875          * is presented to the user (this happens in tcp_usrreq.c,
2876          * case PRU_RCVD).  If a FIN has already been received on this
2877          * connection then we just ignore the text.
2878          */
2879         if ((tlen || (thflags & TH_FIN)) &&
2880             TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2881                 tcp_seq save_start = th->th_seq;
2882                 m_adj(m, drop_hdrlen);  /* delayed header drop */
2883                 /*
2884                  * Insert segment which includes th into TCP reassembly queue
2885                  * with control block tp.  Set thflags to whether reassembly now
2886                  * includes a segment with FIN.  This handles the common case
2887                  * inline (segment is the next to be received on an established
2888                  * connection, and the queue is empty), avoiding linkage into
2889                  * and removal from the queue and repetition of various
2890                  * conversions.
2891                  * Set DELACK for segments received in order, but ack
2892                  * immediately when segments are out of order (so
2893                  * fast retransmit can work).
2894                  */
2895                 if (th->th_seq == tp->rcv_nxt && tp->t_segq == NULL &&
2896                     TCPS_HAVEESTABLISHED(tp->t_state)) {
2897                         if (DELAY_ACK(tp, tlen))
2898                                 tp->t_flags |= TF_DELACK;
2899                         else
2900                                 tp->t_flags |= TF_ACKNOW;
2901                         tp->rcv_nxt += tlen;
2902                         thflags = th->th_flags & TH_FIN;
2903                         TCPSTAT_INC(tcps_rcvpack);
2904                         TCPSTAT_ADD(tcps_rcvbyte, tlen);
2905                         ND6_HINT(tp);
2906                         SOCKBUF_LOCK(&so->so_rcv);
2907                         if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
2908                                 m_freem(m);
2909                         else
2910                                 sbappendstream_locked(&so->so_rcv, m);
2911                         /* NB: sorwakeup_locked() does an implicit unlock. */
2912                         sorwakeup_locked(so);
2913                 } else {
2914                         /*
2915                          * XXX: Due to the header drop above "th" is
2916                          * theoretically invalid by now.  Fortunately
2917                          * m_adj() doesn't actually frees any mbufs
2918                          * when trimming from the head.
2919                          */
2920                         thflags = tcp_reass(tp, th, &tlen, m);
2921                         tp->t_flags |= TF_ACKNOW;
2922                 }
2923                 if (tlen > 0 && (tp->t_flags & TF_SACK_PERMIT))
2924                         tcp_update_sack_list(tp, save_start, save_start + tlen);
2925 #if 0
2926                 /*
2927                  * Note the amount of data that peer has sent into
2928                  * our window, in order to estimate the sender's
2929                  * buffer size.
2930                  * XXX: Unused.
2931                  */
2932                 if (SEQ_GT(tp->rcv_adv, tp->rcv_nxt))
2933                         len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2934                 else
2935                         len = so->so_rcv.sb_hiwat;
2936 #endif
2937         } else {
2938                 m_freem(m);
2939                 thflags &= ~TH_FIN;
2940         }
2941
2942         /*
2943          * If FIN is received ACK the FIN and let the user know
2944          * that the connection is closing.
2945          */
2946         if (thflags & TH_FIN) {
2947                 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2948                         socantrcvmore(so);
2949                         /*
2950                          * If connection is half-synchronized
2951                          * (ie NEEDSYN flag on) then delay ACK,
2952                          * so it may be piggybacked when SYN is sent.
2953                          * Otherwise, since we received a FIN then no
2954                          * more input can be expected, send ACK now.
2955                          */
2956                         if (tp->t_flags & TF_NEEDSYN)
2957                                 tp->t_flags |= TF_DELACK;
2958                         else
2959                                 tp->t_flags |= TF_ACKNOW;
2960                         tp->rcv_nxt++;
2961                 }
2962                 switch (tp->t_state) {
2963
2964                 /*
2965                  * In SYN_RECEIVED and ESTABLISHED STATES
2966                  * enter the CLOSE_WAIT state.
2967                  */
2968                 case TCPS_SYN_RECEIVED:
2969                         tp->t_starttime = ticks;
2970                         /* FALLTHROUGH */
2971                 case TCPS_ESTABLISHED:
2972                         tcp_state_change(tp, TCPS_CLOSE_WAIT);
2973                         break;
2974
2975                 /*
2976                  * If still in FIN_WAIT_1 STATE FIN has not been acked so
2977                  * enter the CLOSING state.
2978                  */
2979                 case TCPS_FIN_WAIT_1:
2980                         tcp_state_change(tp, TCPS_CLOSING);
2981                         break;
2982
2983                 /*
2984                  * In FIN_WAIT_2 state enter the TIME_WAIT state,
2985                  * starting the time-wait timer, turning off the other
2986                  * standard timers.
2987                  */
2988                 case TCPS_FIN_WAIT_2:
2989                         INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
2990                         KASSERT(ti_locked == TI_WLOCKED, ("%s: dodata "
2991                             "TCP_FIN_WAIT_2 ti_locked: %d", __func__,
2992                             ti_locked));
2993
2994                         tcp_twstart(tp);
2995                         INP_INFO_WUNLOCK(&V_tcbinfo);
2996                         return;
2997                 }
2998         }
2999         if (ti_locked == TI_WLOCKED)
3000                 INP_INFO_WUNLOCK(&V_tcbinfo);
3001         ti_locked = TI_UNLOCKED;
3002
3003 #ifdef TCPDEBUG
3004         if (so->so_options & SO_DEBUG)
3005                 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
3006                           &tcp_savetcp, 0);
3007 #endif
3008
3009         /*
3010          * Return any desired output.
3011          */
3012         if (needoutput || (tp->t_flags & TF_ACKNOW))
3013                 (void) tcp_output(tp);
3014
3015 check_delack:
3016         KASSERT(ti_locked == TI_UNLOCKED, ("%s: check_delack ti_locked %d",
3017             __func__, ti_locked));
3018         INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
3019         INP_WLOCK_ASSERT(tp->t_inpcb);
3020
3021         if (tp->t_flags & TF_DELACK) {
3022                 tp->t_flags &= ~TF_DELACK;
3023                 tcp_timer_activate(tp, TT_DELACK, tcp_delacktime);
3024         }
3025         INP_WUNLOCK(tp->t_inpcb);
3026         return;
3027
3028 dropafterack:
3029         /*
3030          * Generate an ACK dropping incoming segment if it occupies
3031          * sequence space, where the ACK reflects our state.
3032          *
3033          * We can now skip the test for the RST flag since all
3034          * paths to this code happen after packets containing
3035          * RST have been dropped.
3036          *
3037          * In the SYN-RECEIVED state, don't send an ACK unless the
3038          * segment we received passes the SYN-RECEIVED ACK test.
3039          * If it fails send a RST.  This breaks the loop in the
3040          * "LAND" DoS attack, and also prevents an ACK storm
3041          * between two listening ports that have been sent forged
3042          * SYN segments, each with the source address of the other.
3043          */
3044         if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
3045             (SEQ_GT(tp->snd_una, th->th_ack) ||
3046              SEQ_GT(th->th_ack, tp->snd_max)) ) {
3047                 rstreason = BANDLIM_RST_OPENPORT;
3048                 goto dropwithreset;
3049         }
3050 #ifdef TCPDEBUG
3051         if (so->so_options & SO_DEBUG)
3052                 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
3053                           &tcp_savetcp, 0);
3054 #endif
3055         if (ti_locked == TI_WLOCKED)
3056                 INP_INFO_WUNLOCK(&V_tcbinfo);
3057         ti_locked = TI_UNLOCKED;
3058
3059         tp->t_flags |= TF_ACKNOW;
3060         (void) tcp_output(tp);
3061         INP_WUNLOCK(tp->t_inpcb);
3062         m_freem(m);
3063         return;
3064
3065 dropwithreset:
3066         if (ti_locked == TI_WLOCKED)
3067                 INP_INFO_WUNLOCK(&V_tcbinfo);
3068         ti_locked = TI_UNLOCKED;
3069
3070         if (tp != NULL) {
3071                 tcp_dropwithreset(m, th, tp, tlen, rstreason);
3072                 INP_WUNLOCK(tp->t_inpcb);
3073         } else
3074                 tcp_dropwithreset(m, th, NULL, tlen, rstreason);
3075         return;
3076
3077 drop:
3078         if (ti_locked == TI_WLOCKED) {
3079                 INP_INFO_WUNLOCK(&V_tcbinfo);
3080                 ti_locked = TI_UNLOCKED;
3081         }
3082 #ifdef INVARIANTS
3083         else
3084                 INP_INFO_UNLOCK_ASSERT(&V_tcbinfo);
3085 #endif
3086
3087         /*
3088          * Drop space held by incoming segment and return.
3089          */
3090 #ifdef TCPDEBUG
3091         if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
3092                 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
3093                           &tcp_savetcp, 0);
3094 #endif
3095         if (tp != NULL)
3096                 INP_WUNLOCK(tp->t_inpcb);
3097         m_freem(m);
3098 }
3099
3100 /*
3101  * Issue RST and make ACK acceptable to originator of segment.
3102  * The mbuf must still include the original packet header.
3103  * tp may be NULL.
3104  */
3105 static void
3106 tcp_dropwithreset(struct mbuf *m, struct tcphdr *th, struct tcpcb *tp,
3107     int tlen, int rstreason)
3108 {
3109 #ifdef INET
3110         struct ip *ip;
3111 #endif
3112 #ifdef INET6
3113         struct ip6_hdr *ip6;
3114 #endif
3115
3116         if (tp != NULL) {
3117                 INP_WLOCK_ASSERT(tp->t_inpcb);
3118         }
3119
3120         /* Don't bother if destination was broadcast/multicast. */
3121         if ((th->th_flags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
3122                 goto drop;
3123 #ifdef INET6
3124         if (mtod(m, struct ip *)->ip_v == 6) {
3125                 ip6 = mtod(m, struct ip6_hdr *);
3126                 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
3127                     IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
3128                         goto drop;
3129                 /* IPv6 anycast check is done at tcp6_input() */
3130         }
3131 #endif
3132 #if defined(INET) && defined(INET6)
3133         else
3134 #endif
3135 #ifdef INET
3136         {
3137                 ip = mtod(m, struct ip *);
3138                 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
3139                     IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
3140                     ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
3141                     in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
3142                         goto drop;
3143         }
3144 #endif
3145
3146         /* Perform bandwidth limiting. */
3147         if (badport_bandlim(rstreason) < 0)
3148                 goto drop;
3149
3150         /* tcp_respond consumes the mbuf chain. */
3151         if (th->th_flags & TH_ACK) {
3152                 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0,
3153                     th->th_ack, TH_RST);
3154         } else {
3155                 if (th->th_flags & TH_SYN)
3156                         tlen++;
3157                 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
3158                     (tcp_seq)0, TH_RST|TH_ACK);
3159         }
3160         return;
3161 drop:
3162         m_freem(m);
3163 }
3164
3165 /*
3166  * Parse TCP options and place in tcpopt.
3167  */
3168 static void
3169 tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, int flags)
3170 {
3171         int opt, optlen;
3172
3173         to->to_flags = 0;
3174         for (; cnt > 0; cnt -= optlen, cp += optlen) {
3175                 opt = cp[0];
3176                 if (opt == TCPOPT_EOL)
3177                         break;
3178                 if (opt == TCPOPT_NOP)
3179                         optlen = 1;
3180                 else {
3181                         if (cnt < 2)
3182                                 break;
3183                         optlen = cp[1];
3184                         if (optlen < 2 || optlen > cnt)
3185                                 break;
3186                 }
3187                 switch (opt) {
3188                 case TCPOPT_MAXSEG:
3189                         if (optlen != TCPOLEN_MAXSEG)
3190                                 continue;
3191                         if (!(flags & TO_SYN))
3192                                 continue;
3193                         to->to_flags |= TOF_MSS;
3194                         bcopy((char *)cp + 2,
3195                             (char *)&to->to_mss, sizeof(to->to_mss));
3196                         to->to_mss = ntohs(to->to_mss);
3197                         break;
3198                 case TCPOPT_WINDOW:
3199                         if (optlen != TCPOLEN_WINDOW)
3200                                 continue;
3201                         if (!(flags & TO_SYN))
3202                                 continue;
3203                         to->to_flags |= TOF_SCALE;
3204                         to->to_wscale = min(cp[2], TCP_MAX_WINSHIFT);
3205                         break;
3206                 case TCPOPT_TIMESTAMP:
3207                         if (optlen != TCPOLEN_TIMESTAMP)
3208                                 continue;
3209                         to->to_flags |= TOF_TS;
3210                         bcopy((char *)cp + 2,
3211                             (char *)&to->to_tsval, sizeof(to->to_tsval));
3212                         to->to_tsval = ntohl(to->to_tsval);
3213                         bcopy((char *)cp + 6,
3214                             (char *)&to->to_tsecr, sizeof(to->to_tsecr));
3215                         to->to_tsecr = ntohl(to->to_tsecr);
3216                         break;
3217 #ifdef TCP_SIGNATURE
3218                 /*
3219                  * XXX In order to reply to a host which has set the
3220                  * TCP_SIGNATURE option in its initial SYN, we have to
3221                  * record the fact that the option was observed here
3222                  * for the syncache code to perform the correct response.
3223                  */
3224                 case TCPOPT_SIGNATURE:
3225                         if (optlen != TCPOLEN_SIGNATURE)
3226                                 continue;
3227                         to->to_flags |= TOF_SIGNATURE;
3228                         to->to_signature = cp + 2;
3229                         break;
3230 #endif
3231                 case TCPOPT_SACK_PERMITTED:
3232                         if (optlen != TCPOLEN_SACK_PERMITTED)
3233                                 continue;
3234                         if (!(flags & TO_SYN))
3235                                 continue;
3236                         if (!V_tcp_do_sack)
3237                                 continue;
3238                         to->to_flags |= TOF_SACKPERM;
3239                         break;
3240                 case TCPOPT_SACK:
3241                         if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
3242                                 continue;
3243                         if (flags & TO_SYN)
3244                                 continue;
3245                         to->to_flags |= TOF_SACK;
3246                         to->to_nsacks = (optlen - 2) / TCPOLEN_SACK;
3247                         to->to_sacks = cp + 2;
3248                         TCPSTAT_INC(tcps_sack_rcv_blocks);
3249                         break;
3250                 default:
3251                         continue;
3252                 }
3253         }
3254 }
3255
3256 /*
3257  * Pull out of band byte out of a segment so
3258  * it doesn't appear in the user's data queue.
3259  * It is still reflected in the segment length for
3260  * sequencing purposes.
3261  */
3262 static void
3263 tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m,
3264     int off)
3265 {
3266         int cnt = off + th->th_urp - 1;
3267
3268         while (cnt >= 0) {
3269                 if (m->m_len > cnt) {
3270                         char *cp = mtod(m, caddr_t) + cnt;
3271                         struct tcpcb *tp = sototcpcb(so);
3272
3273                         INP_WLOCK_ASSERT(tp->t_inpcb);
3274
3275                         tp->t_iobc = *cp;
3276                         tp->t_oobflags |= TCPOOB_HAVEDATA;
3277                         bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3278                         m->m_len--;
3279                         if (m->m_flags & M_PKTHDR)
3280                                 m->m_pkthdr.len--;
3281                         return;
3282                 }
3283                 cnt -= m->m_len;
3284                 m = m->m_next;
3285                 if (m == NULL)
3286                         break;
3287         }
3288         panic("tcp_pulloutofband");
3289 }
3290
3291 /*
3292  * Collect new round-trip time estimate
3293  * and update averages and current timeout.
3294  */
3295 static void
3296 tcp_xmit_timer(struct tcpcb *tp, int rtt)
3297 {
3298         int delta;
3299
3300         INP_WLOCK_ASSERT(tp->t_inpcb);
3301
3302         TCPSTAT_INC(tcps_rttupdated);
3303         tp->t_rttupdated++;
3304         if (tp->t_srtt != 0) {
3305                 /*
3306                  * srtt is stored as fixed point with 5 bits after the
3307                  * binary point (i.e., scaled by 8).  The following magic
3308                  * is equivalent to the smoothing algorithm in rfc793 with
3309                  * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
3310                  * point).  Adjust rtt to origin 0.
3311                  */
3312                 delta = ((rtt - 1) << TCP_DELTA_SHIFT)
3313                         - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
3314
3315                 if ((tp->t_srtt += delta) <= 0)
3316                         tp->t_srtt = 1;
3317
3318                 /*
3319                  * We accumulate a smoothed rtt variance (actually, a
3320                  * smoothed mean difference), then set the retransmit
3321                  * timer to smoothed rtt + 4 times the smoothed variance.
3322                  * rttvar is stored as fixed point with 4 bits after the
3323                  * binary point (scaled by 16).  The following is
3324                  * equivalent to rfc793 smoothing with an alpha of .75
3325                  * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
3326                  * rfc793's wired-in beta.
3327                  */
3328                 if (delta < 0)
3329                         delta = -delta;
3330                 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
3331                 if ((tp->t_rttvar += delta) <= 0)
3332                         tp->t_rttvar = 1;
3333                 if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar)
3334                     tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
3335         } else {
3336                 /*
3337                  * No rtt measurement yet - use the unsmoothed rtt.
3338                  * Set the variance to half the rtt (so our first
3339                  * retransmit happens at 3*rtt).
3340                  */
3341                 tp->t_srtt = rtt << TCP_RTT_SHIFT;
3342                 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
3343                 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
3344         }
3345         tp->t_rtttime = 0;
3346         tp->t_rxtshift = 0;
3347
3348         /*
3349          * the retransmit should happen at rtt + 4 * rttvar.
3350          * Because of the way we do the smoothing, srtt and rttvar
3351          * will each average +1/2 tick of bias.  When we compute
3352          * the retransmit timer, we want 1/2 tick of rounding and
3353          * 1 extra tick because of +-1/2 tick uncertainty in the
3354          * firing of the timer.  The bias will give us exactly the
3355          * 1.5 tick we need.  But, because the bias is
3356          * statistical, we have to test that we don't drop below
3357          * the minimum feasible timer (which is 2 ticks).
3358          */
3359         TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3360                       max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3361
3362         /*
3363          * We received an ack for a packet that wasn't retransmitted;
3364          * it is probably safe to discard any error indications we've
3365          * received recently.  This isn't quite right, but close enough
3366          * for now (a route might have failed after we sent a segment,
3367          * and the return path might not be symmetrical).
3368          */
3369         tp->t_softerror = 0;
3370 }
3371
3372 /*
3373  * Determine a reasonable value for maxseg size.
3374  * If the route is known, check route for mtu.
3375  * If none, use an mss that can be handled on the outgoing interface
3376  * without forcing IP to fragment.  If no route is found, route has no mtu,
3377  * or the destination isn't local, use a default, hopefully conservative
3378  * size (usually 512 or the default IP max size, but no more than the mtu
3379  * of the interface), as we can't discover anything about intervening
3380  * gateways or networks.  We also initialize the congestion/slow start
3381  * window to be a single segment if the destination isn't local.
3382  * While looking at the routing entry, we also initialize other path-dependent
3383  * parameters from pre-set or cached values in the routing entry.
3384  *
3385  * Also take into account the space needed for options that we
3386  * send regularly.  Make maxseg shorter by that amount to assure
3387  * that we can send maxseg amount of data even when the options
3388  * are present.  Store the upper limit of the length of options plus
3389  * data in maxopd.
3390  *
3391  * NOTE that this routine is only called when we process an incoming
3392  * segment, or an ICMP need fragmentation datagram. Outgoing SYN/ACK MSS
3393  * settings are handled in tcp_mssopt().
3394  */
3395 void
3396 tcp_mss_update(struct tcpcb *tp, int offer, int mtuoffer,
3397     struct hc_metrics_lite *metricptr, struct tcp_ifcap *cap)
3398 {
3399         int mss = 0;
3400         u_long maxmtu = 0;
3401         struct inpcb *inp = tp->t_inpcb;
3402         struct hc_metrics_lite metrics;
3403         int origoffer;
3404 #ifdef INET6
3405         int isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
3406         size_t min_protoh = isipv6 ?
3407                             sizeof (struct ip6_hdr) + sizeof (struct tcphdr) :
3408                             sizeof (struct tcpiphdr);
3409 #else
3410         const size_t min_protoh = sizeof(struct tcpiphdr);
3411 #endif
3412
3413         INP_WLOCK_ASSERT(tp->t_inpcb);
3414
3415         if (mtuoffer != -1) {
3416                 KASSERT(offer == -1, ("%s: conflict", __func__));
3417                 offer = mtuoffer - min_protoh;
3418         }
3419         origoffer = offer;
3420
3421         /* Initialize. */
3422 #ifdef INET6
3423         if (isipv6) {
3424                 maxmtu = tcp_maxmtu6(&inp->inp_inc, cap);
3425                 tp->t_maxopd = tp->t_maxseg = V_tcp_v6mssdflt;
3426         }
3427 #endif
3428 #if defined(INET) && defined(INET6)
3429         else
3430 #endif
3431 #ifdef INET
3432         {
3433                 maxmtu = tcp_maxmtu(&inp->inp_inc, cap);
3434                 tp->t_maxopd = tp->t_maxseg = V_tcp_mssdflt;
3435         }
3436 #endif
3437
3438         /*
3439          * No route to sender, stay with default mss and return.
3440          */
3441         if (maxmtu == 0) {
3442                 /*
3443                  * In case we return early we need to initialize metrics
3444                  * to a defined state as tcp_hc_get() would do for us
3445                  * if there was no cache hit.
3446                  */
3447                 if (metricptr != NULL)
3448                         bzero(metricptr, sizeof(struct hc_metrics_lite));
3449                 return;
3450         }
3451
3452         /* What have we got? */
3453         switch (offer) {
3454                 case 0:
3455                         /*
3456                          * Offer == 0 means that there was no MSS on the SYN
3457                          * segment, in this case we use tcp_mssdflt as
3458                          * already assigned to t_maxopd above.
3459                          */
3460                         offer = tp->t_maxopd;
3461                         break;
3462
3463                 case -1:
3464                         /*
3465                          * Offer == -1 means that we didn't receive SYN yet.
3466                          */
3467                         /* FALLTHROUGH */
3468
3469                 default:
3470                         /*
3471                          * Prevent DoS attack with too small MSS. Round up
3472                          * to at least minmss.
3473                          */
3474                         offer = max(offer, V_tcp_minmss);
3475         }
3476
3477         /*
3478          * rmx information is now retrieved from tcp_hostcache.
3479          */
3480         tcp_hc_get(&inp->inp_inc, &metrics);
3481         if (metricptr != NULL)
3482                 bcopy(&metrics, metricptr, sizeof(struct hc_metrics_lite));
3483
3484         /*
3485          * If there's a discovered mtu in tcp hostcache, use it.
3486          * Else, use the link mtu.
3487          */
3488         if (metrics.rmx_mtu)
3489                 mss = min(metrics.rmx_mtu, maxmtu) - min_protoh;
3490         else {
3491 #ifdef INET6
3492                 if (isipv6) {
3493                         mss = maxmtu - min_protoh;
3494                         if (!V_path_mtu_discovery &&
3495                             !in6_localaddr(&inp->in6p_faddr))
3496                                 mss = min(mss, V_tcp_v6mssdflt);
3497                 }
3498 #endif
3499 #if defined(INET) && defined(INET6)
3500                 else
3501 #endif
3502 #ifdef INET
3503                 {
3504                         mss = maxmtu - min_protoh;
3505                         if (!V_path_mtu_discovery &&
3506                             !in_localaddr(inp->inp_faddr))
3507                                 mss = min(mss, V_tcp_mssdflt);
3508                 }
3509 #endif
3510                 /*
3511                  * XXX - The above conditional (mss = maxmtu - min_protoh)
3512                  * probably violates the TCP spec.
3513                  * The problem is that, since we don't know the
3514                  * other end's MSS, we are supposed to use a conservative
3515                  * default.  But, if we do that, then MTU discovery will
3516                  * never actually take place, because the conservative
3517                  * default is much less than the MTUs typically seen
3518                  * on the Internet today.  For the moment, we'll sweep
3519                  * this under the carpet.
3520                  *
3521                  * The conservative default might not actually be a problem
3522                  * if the only case this occurs is when sending an initial
3523                  * SYN with options and data to a host we've never talked
3524                  * to before.  Then, they will reply with an MSS value which
3525                  * will get recorded and the new parameters should get
3526                  * recomputed.  For Further Study.
3527                  */
3528         }
3529         mss = min(mss, offer);
3530
3531         /*
3532          * Sanity check: make sure that maxopd will be large
3533          * enough to allow some data on segments even if the
3534          * all the option space is used (40bytes).  Otherwise
3535          * funny things may happen in tcp_output.
3536          */
3537         mss = max(mss, 64);
3538
3539         /*
3540          * maxopd stores the maximum length of data AND options
3541          * in a segment; maxseg is the amount of data in a normal
3542          * segment.  We need to store this value (maxopd) apart
3543          * from maxseg, because now every segment carries options
3544          * and thus we normally have somewhat less data in segments.
3545          */
3546         tp->t_maxopd = mss;
3547
3548         /*
3549          * origoffer==-1 indicates that no segments were received yet.
3550          * In this case we just guess.
3551          */
3552         if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
3553             (origoffer == -1 ||
3554              (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
3555                 mss -= TCPOLEN_TSTAMP_APPA;
3556
3557         tp->t_maxseg = mss;
3558 }
3559
3560 void
3561 tcp_mss(struct tcpcb *tp, int offer)
3562 {
3563         int mss;
3564         u_long bufsize;
3565         struct inpcb *inp;
3566         struct socket *so;
3567         struct hc_metrics_lite metrics;
3568         struct tcp_ifcap cap;
3569
3570         KASSERT(tp != NULL, ("%s: tp == NULL", __func__));
3571
3572         bzero(&cap, sizeof(cap));
3573         tcp_mss_update(tp, offer, -1, &metrics, &cap);
3574
3575         mss = tp->t_maxseg;
3576         inp = tp->t_inpcb;
3577
3578         /*
3579          * If there's a pipesize, change the socket buffer to that size,
3580          * don't change if sb_hiwat is different than default (then it
3581          * has been changed on purpose with setsockopt).
3582          * Make the socket buffers an integral number of mss units;
3583          * if the mss is larger than the socket buffer, decrease the mss.
3584          */
3585         so = inp->inp_socket;
3586         SOCKBUF_LOCK(&so->so_snd);
3587         if ((so->so_snd.sb_hiwat == V_tcp_sendspace) && metrics.rmx_sendpipe)
3588                 bufsize = metrics.rmx_sendpipe;
3589         else
3590                 bufsize = so->so_snd.sb_hiwat;
3591         if (bufsize < mss)
3592                 mss = bufsize;
3593         else {
3594                 bufsize = roundup(bufsize, mss);
3595                 if (bufsize > sb_max)
3596                         bufsize = sb_max;
3597                 if (bufsize > so->so_snd.sb_hiwat)
3598                         (void)sbreserve_locked(&so->so_snd, bufsize, so, NULL);
3599         }
3600         SOCKBUF_UNLOCK(&so->so_snd);
3601         tp->t_maxseg = mss;
3602
3603         SOCKBUF_LOCK(&so->so_rcv);
3604         if ((so->so_rcv.sb_hiwat == V_tcp_recvspace) && metrics.rmx_recvpipe)
3605                 bufsize = metrics.rmx_recvpipe;
3606         else
3607                 bufsize = so->so_rcv.sb_hiwat;
3608         if (bufsize > mss) {
3609                 bufsize = roundup(bufsize, mss);
3610                 if (bufsize > sb_max)
3611                         bufsize = sb_max;
3612                 if (bufsize > so->so_rcv.sb_hiwat)
3613                         (void)sbreserve_locked(&so->so_rcv, bufsize, so, NULL);
3614         }
3615         SOCKBUF_UNLOCK(&so->so_rcv);
3616
3617         /* Check the interface for TSO capabilities. */
3618         if (cap.ifcap & CSUM_TSO) {
3619                 tp->t_flags |= TF_TSO;
3620                 tp->t_tsomax = cap.tsomax;
3621         }
3622 }
3623
3624 /*
3625  * Determine the MSS option to send on an outgoing SYN.
3626  */
3627 int
3628 tcp_mssopt(struct in_conninfo *inc)
3629 {
3630         int mss = 0;
3631         u_long maxmtu = 0;
3632         u_long thcmtu = 0;
3633         size_t min_protoh;
3634
3635         KASSERT(inc != NULL, ("tcp_mssopt with NULL in_conninfo pointer"));
3636
3637 #ifdef INET6
3638         if (inc->inc_flags & INC_ISIPV6) {
3639                 mss = V_tcp_v6mssdflt;
3640                 maxmtu = tcp_maxmtu6(inc, NULL);
3641                 min_protoh = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
3642         }
3643 #endif
3644 #if defined(INET) && defined(INET6)
3645         else
3646 #endif
3647 #ifdef INET
3648         {
3649                 mss = V_tcp_mssdflt;
3650                 maxmtu = tcp_maxmtu(inc, NULL);
3651                 min_protoh = sizeof(struct tcpiphdr);
3652         }
3653 #endif
3654 #if defined(INET6) || defined(INET)
3655         thcmtu = tcp_hc_getmtu(inc); /* IPv4 and IPv6 */
3656 #endif
3657
3658         if (maxmtu && thcmtu)
3659                 mss = min(maxmtu, thcmtu) - min_protoh;
3660         else if (maxmtu || thcmtu)
3661                 mss = max(maxmtu, thcmtu) - min_protoh;
3662
3663         return (mss);
3664 }
3665
3666
3667 /*
3668  * On a partial ack arrives, force the retransmission of the
3669  * next unacknowledged segment.  Do not clear tp->t_dupacks.
3670  * By setting snd_nxt to ti_ack, this forces retransmission timer to
3671  * be started again.
3672  */
3673 static void
3674 tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th)
3675 {
3676         tcp_seq onxt = tp->snd_nxt;
3677         u_long  ocwnd = tp->snd_cwnd;
3678
3679         INP_WLOCK_ASSERT(tp->t_inpcb);
3680
3681         tcp_timer_activate(tp, TT_REXMT, 0);
3682         tp->t_rtttime = 0;
3683         tp->snd_nxt = th->th_ack;
3684         /*
3685          * Set snd_cwnd to one segment beyond acknowledged offset.
3686          * (tp->snd_una has not yet been updated when this function is called.)
3687          */
3688         tp->snd_cwnd = tp->t_maxseg + BYTES_THIS_ACK(tp, th);
3689         tp->t_flags |= TF_ACKNOW;
3690         (void) tcp_output(tp);
3691         tp->snd_cwnd = ocwnd;
3692         if (SEQ_GT(onxt, tp->snd_nxt))
3693                 tp->snd_nxt = onxt;
3694         /*
3695          * Partial window deflation.  Relies on fact that tp->snd_una
3696          * not updated yet.
3697          */
3698         if (tp->snd_cwnd > BYTES_THIS_ACK(tp, th))
3699                 tp->snd_cwnd -= BYTES_THIS_ACK(tp, th);
3700         else
3701                 tp->snd_cwnd = 0;
3702         tp->snd_cwnd += tp->t_maxseg;
3703 }