Commit | Line | Data |
---|---|---|
984263bc | 1 | /* |
66d6c637 JH |
2 | * Copyright (c) 2002, 2003, 2004 Jeffrey M. Hsu. All rights reserved. |
3 | * Copyright (c) 2002, 2003, 2004 The DragonFly Project. All rights reserved. | |
95b22adf | 4 | * |
66d6c637 JH |
5 | * This code is derived from software contributed to The DragonFly Project |
6 | * by Jeffrey M. Hsu. | |
95b22adf | 7 | * |
66d6c637 JH |
8 | * Redistribution and use in source and binary forms, with or without |
9 | * modification, are permitted provided that the following conditions | |
10 | * are met: | |
11 | * 1. Redistributions of source code must retain the above copyright | |
12 | * notice, this list of conditions and the following disclaimer. | |
13 | * 2. Redistributions in binary form must reproduce the above copyright | |
14 | * notice, this list of conditions and the following disclaimer in the | |
15 | * documentation and/or other materials provided with the distribution. | |
16 | * 3. Neither the name of The DragonFly Project nor the names of its | |
17 | * contributors may be used to endorse or promote products derived | |
18 | * from this software without specific, prior written permission. | |
95b22adf | 19 | * |
66d6c637 JH |
20 | * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS |
21 | * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT | |
22 | * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS | |
23 | * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE | |
24 | * COPYRIGHT HOLDERS OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, | |
25 | * INCIDENTAL, SPECIAL, EXEMPLARY OR CONSEQUENTIAL DAMAGES (INCLUDING, | |
26 | * BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; | |
27 | * LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED | |
28 | * AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, | |
29 | * OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT | |
30 | * OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | |
31 | * SUCH DAMAGE. | |
32 | */ | |
33 | ||
66d6c637 | 34 | /* |
984263bc MD |
35 | * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 |
36 | * The Regents of the University of California. All rights reserved. | |
37 | * | |
38 | * Redistribution and use in source and binary forms, with or without | |
39 | * modification, are permitted provided that the following conditions | |
40 | * are met: | |
41 | * 1. Redistributions of source code must retain the above copyright | |
42 | * notice, this list of conditions and the following disclaimer. | |
43 | * 2. Redistributions in binary form must reproduce the above copyright | |
44 | * notice, this list of conditions and the following disclaimer in the | |
45 | * documentation and/or other materials provided with the distribution. | |
46 | * 3. All advertising materials mentioning features or use of this software | |
47 | * must display the following acknowledgement: | |
48 | * This product includes software developed by the University of | |
49 | * California, Berkeley and its contributors. | |
50 | * 4. Neither the name of the University nor the names of its contributors | |
51 | * may be used to endorse or promote products derived from this software | |
52 | * without specific prior written permission. | |
53 | * | |
54 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND | |
55 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE | |
56 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE | |
57 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE | |
58 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL | |
59 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS | |
60 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) | |
61 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT | |
62 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY | |
63 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF | |
64 | * SUCH DAMAGE. | |
65 | * | |
66 | * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 | |
67 | * $FreeBSD: src/sys/netinet/tcp_input.c,v 1.107.2.38 2003/05/21 04:46:41 cjc Exp $ | |
68 | */ | |
69 | ||
b1992928 | 70 | #include "opt_inet.h" |
984263bc MD |
71 | #include "opt_inet6.h" |
72 | #include "opt_ipsec.h" | |
73 | #include "opt_tcpdebug.h" | |
74 | #include "opt_tcp_input.h" | |
75 | ||
76 | #include <sys/param.h> | |
77 | #include <sys/systm.h> | |
78 | #include <sys/kernel.h> | |
79 | #include <sys/sysctl.h> | |
80 | #include <sys/malloc.h> | |
81 | #include <sys/mbuf.h> | |
82 | #include <sys/proc.h> /* for proc0 declaration */ | |
83 | #include <sys/protosw.h> | |
84 | #include <sys/socket.h> | |
85 | #include <sys/socketvar.h> | |
86 | #include <sys/syslog.h> | |
3f9db7f8 | 87 | #include <sys/in_cksum.h> |
984263bc | 88 | |
6cef7136 MD |
89 | #include <sys/socketvar2.h> |
90 | ||
984263bc | 91 | #include <machine/cpu.h> /* before tcp_seq.h, for tcp_random18() */ |
a00138cb | 92 | #include <machine/stdarg.h> |
984263bc MD |
93 | |
94 | #include <net/if.h> | |
95 | #include <net/route.h> | |
96 | ||
97 | #include <netinet/in.h> | |
98 | #include <netinet/in_systm.h> | |
99 | #include <netinet/ip.h> | |
95b22adf | 100 | #include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */ |
984263bc | 101 | #include <netinet/in_var.h> |
95b22adf | 102 | #include <netinet/icmp_var.h> /* for ICMP_BANDLIM */ |
984263bc MD |
103 | #include <netinet/in_pcb.h> |
104 | #include <netinet/ip_var.h> | |
105 | #include <netinet/ip6.h> | |
106 | #include <netinet/icmp6.h> | |
107 | #include <netinet6/nd6.h> | |
108 | #include <netinet6/ip6_var.h> | |
109 | #include <netinet6/in6_pcb.h> | |
110 | #include <netinet/tcp.h> | |
111 | #include <netinet/tcp_fsm.h> | |
112 | #include <netinet/tcp_seq.h> | |
113 | #include <netinet/tcp_timer.h> | |
a48c5dd5 | 114 | #include <netinet/tcp_timer2.h> |
984263bc MD |
115 | #include <netinet/tcp_var.h> |
116 | #include <netinet6/tcp6_var.h> | |
117 | #include <netinet/tcpip.h> | |
95b22adf | 118 | |
984263bc MD |
119 | #ifdef TCPDEBUG |
120 | #include <netinet/tcp_debug.h> | |
121 | ||
95b22adf | 122 | u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */ |
984263bc | 123 | struct tcphdr tcp_savetcp; |
95b22adf | 124 | #endif |
984263bc MD |
125 | |
126 | #ifdef FAST_IPSEC | |
bf844ffa JH |
127 | #include <netproto/ipsec/ipsec.h> |
128 | #include <netproto/ipsec/ipsec6.h> | |
984263bc MD |
129 | #endif |
130 | ||
131 | #ifdef IPSEC | |
132 | #include <netinet6/ipsec.h> | |
133 | #include <netinet6/ipsec6.h> | |
d2438d69 | 134 | #include <netproto/key/key.h> |
95b22adf | 135 | #endif |
984263bc | 136 | |
984263bc MD |
137 | MALLOC_DEFINE(M_TSEGQ, "tseg_qent", "TCP segment queue entry"); |
138 | ||
984263bc | 139 | static int log_in_vain = 0; |
d24ce1dc | 140 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, CTLFLAG_RW, |
984263bc MD |
141 | &log_in_vain, 0, "Log all incoming TCP connections"); |
142 | ||
143 | static int blackhole = 0; | |
144 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, CTLFLAG_RW, | |
145 | &blackhole, 0, "Do not send RST when dropping refused connections"); | |
146 | ||
147 | int tcp_delack_enabled = 1; | |
d24ce1dc JH |
148 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW, |
149 | &tcp_delack_enabled, 0, | |
984263bc MD |
150 | "Delay ACK to try and piggyback it onto a data packet"); |
151 | ||
152 | #ifdef TCP_DROP_SYNFIN | |
153 | static int drop_synfin = 0; | |
154 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW, | |
155 | &drop_synfin, 0, "Drop TCP packets with SYN+FIN set"); | |
156 | #endif | |
157 | ||
33abdd1c MD |
158 | static int tcp_do_limitedtransmit = 1; |
159 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, limitedtransmit, CTLFLAG_RW, | |
160 | &tcp_do_limitedtransmit, 0, "Enable RFC 3042 (Limited Transmit)"); | |
161 | ||
91489f6b | 162 | static int tcp_do_early_retransmit = 1; |
8819433a JH |
163 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, earlyretransmit, CTLFLAG_RW, |
164 | &tcp_do_early_retransmit, 0, "Early retransmit"); | |
165 | ||
8acdb67c | 166 | int tcp_aggregate_acks = 1; |
72b37eeb MD |
167 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, aggregate_acks, CTLFLAG_RW, |
168 | &tcp_aggregate_acks, 0, "Aggregate built-up acks into one ack"); | |
169 | ||
efd4b327 JH |
170 | static int tcp_do_eifel_detect = 1; |
171 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, eifel, CTLFLAG_RW, | |
172 | &tcp_do_eifel_detect, 0, "Eifel detection algorithm (RFC 3522)"); | |
173 | ||
8acdb67c JH |
174 | static int tcp_do_abc = 1; |
175 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, abc, CTLFLAG_RW, | |
176 | &tcp_do_abc, 0, | |
177 | "TCP Appropriate Byte Counting (RFC 3465)"); | |
178 | ||
91489f6b JH |
179 | /* |
180 | * Define as tunable for easy testing with SACK on and off. | |
181 | * Warning: do not change setting in the middle of an existing active TCP flow, | |
182 | * else strange things might happen to that flow. | |
183 | */ | |
6e5bbdda | 184 | int tcp_do_sack = 1; |
91489f6b JH |
185 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, sack, CTLFLAG_RW, |
186 | &tcp_do_sack, 0, "Enable SACK Algorithms"); | |
187 | ||
188 | int tcp_do_smartsack = 1; | |
189 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, smartsack, CTLFLAG_RW, | |
190 | &tcp_do_smartsack, 0, "Enable Smart SACK Algorithms"); | |
191 | ||
3edf7c37 RG |
192 | SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0, |
193 | "TCP Segment Reassembly Queue"); | |
194 | ||
195 | int tcp_reass_maxseg = 0; | |
196 | SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RD, | |
197 | &tcp_reass_maxseg, 0, | |
198 | "Global maximum number of TCP Segments in Reassembly Queue"); | |
199 | ||
200 | int tcp_reass_qsize = 0; | |
201 | SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, cursegments, CTLFLAG_RD, | |
202 | &tcp_reass_qsize, 0, | |
203 | "Global number of TCP Segments currently in Reassembly Queue"); | |
204 | ||
205 | static int tcp_reass_overflows = 0; | |
206 | SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, CTLFLAG_RD, | |
207 | &tcp_reass_overflows, 0, | |
208 | "Global number of TCP Segment Reassembly Queue Overflows"); | |
209 | ||
5b0b9fa5 PA |
210 | int tcp_do_autorcvbuf = 1; |
211 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_auto, CTLFLAG_RW, | |
212 | &tcp_do_autorcvbuf, 0, "Enable automatic receive buffer sizing"); | |
213 | ||
214 | int tcp_autorcvbuf_inc = 16*1024; | |
215 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_inc, CTLFLAG_RW, | |
216 | &tcp_autorcvbuf_inc, 0, | |
217 | "Incrementor step size of automatic receive buffer"); | |
218 | ||
46e92930 | 219 | int tcp_autorcvbuf_max = 2*1024*1024; |
5b0b9fa5 PA |
220 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, recvbuf_max, CTLFLAG_RW, |
221 | &tcp_autorcvbuf_max, 0, "Max size of automatic receive buffer"); | |
222 | ||
0df7608b SZ |
223 | int tcp_sosend_agglim = 2; |
224 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, sosend_agglim, CTLFLAG_RW, | |
225 | &tcp_sosend_agglim, 0, "TCP sosend mbuf aggregation limit"); | |
5b0b9fa5 | 226 | |
0df7608b SZ |
227 | int tcp_sosend_async = 1; |
228 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, sosend_async, CTLFLAG_RW, | |
229 | &tcp_sosend_async, 0, "TCP asynchronized pru_send"); | |
f2a3782e | 230 | |
95b22adf | 231 | static void tcp_dooptions(struct tcpopt *, u_char *, int, boolean_t); |
984263bc MD |
232 | static void tcp_pulloutofband(struct socket *, |
233 | struct tcphdr *, struct mbuf *, int); | |
234 | static int tcp_reass(struct tcpcb *, struct tcphdr *, int *, | |
235 | struct mbuf *); | |
236 | static void tcp_xmit_timer(struct tcpcb *, int); | |
91489f6b JH |
237 | static void tcp_newreno_partial_ack(struct tcpcb *, struct tcphdr *, int); |
238 | static void tcp_sack_rexmt(struct tcpcb *, struct tcphdr *); | |
01d3427a | 239 | static int tcp_rmx_msl(const struct tcpcb *); |
8651f7f8 | 240 | static void tcp_established(struct tcpcb *); |
984263bc MD |
241 | |
242 | /* Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint. */ | |
243 | #ifdef INET6 | |
244 | #define ND6_HINT(tp) \ | |
245 | do { \ | |
246 | if ((tp) && (tp)->t_inpcb && \ | |
61896e3c | 247 | ((tp)->t_inpcb->inp_vflag & INP_IPV6) && \ |
984263bc MD |
248 | (tp)->t_inpcb->in6p_route.ro_rt) \ |
249 | nd6_nud_hint((tp)->t_inpcb->in6p_route.ro_rt, NULL, 0); \ | |
250 | } while (0) | |
251 | #else | |
252 | #define ND6_HINT(tp) | |
253 | #endif | |
254 | ||
255 | /* | |
256 | * Indicate whether this ack should be delayed. We can delay the ack if | |
257 | * - delayed acks are enabled and | |
258 | * - there is no delayed ack timer in progress and | |
259 | * - our last ack wasn't a 0-sized window. We never want to delay | |
260 | * the ack that opens up a 0-sized window. | |
261 | */ | |
262 | #define DELAY_ACK(tp) \ | |
a48c5dd5 | 263 | (tcp_delack_enabled && !tcp_callout_pending(tp, tp->tt_delack) && \ |
61896e3c | 264 | !(tp->t_flags & TF_RXWIN0SENT)) |
984263bc | 265 | |
df9d7670 JH |
266 | #define acceptable_window_update(tp, th, tiwin) \ |
267 | (SEQ_LT(tp->snd_wl1, th->th_seq) || \ | |
268 | (tp->snd_wl1 == th->th_seq && \ | |
269 | (SEQ_LT(tp->snd_wl2, th->th_ack) || \ | |
270 | (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)))) | |
271 | ||
984263bc | 272 | static int |
95b22adf | 273 | tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m) |
984263bc MD |
274 | { |
275 | struct tseg_qent *q; | |
276 | struct tseg_qent *p = NULL; | |
984263bc MD |
277 | struct tseg_qent *te; |
278 | struct socket *so = tp->t_inpcb->inp_socket; | |
279 | int flags; | |
280 | ||
281 | /* | |
61896e3c | 282 | * Call with th == NULL after become established to |
984263bc MD |
283 | * force pre-ESTABLISHED data up to user socket. |
284 | */ | |
61896e3c | 285 | if (th == NULL) |
984263bc MD |
286 | goto present; |
287 | ||
3edf7c37 RG |
288 | /* |
289 | * Limit the number of segments in the reassembly queue to prevent | |
290 | * holding on to too many segments (and thus running out of mbufs). | |
291 | * Make sure to let the missing segment through which caused this | |
292 | * queue. Always keep one global queue entry spare to be able to | |
293 | * process the missing segment. | |
294 | */ | |
295 | if (th->th_seq != tp->rcv_nxt && | |
296 | tcp_reass_qsize + 1 >= tcp_reass_maxseg) { | |
297 | tcp_reass_overflows++; | |
298 | tcpstat.tcps_rcvmemdrop++; | |
299 | m_freem(m); | |
91489f6b JH |
300 | /* no SACK block to report */ |
301 | tp->reportblk.rblk_start = tp->reportblk.rblk_end; | |
3edf7c37 RG |
302 | return (0); |
303 | } | |
304 | ||
ba4e3dbe | 305 | /* Allocate a new queue entry. */ |
884717e1 | 306 | te = kmalloc(sizeof(struct tseg_qent), M_TSEGQ, M_INTWAIT | M_NULLOK); |
984263bc MD |
307 | if (te == NULL) { |
308 | tcpstat.tcps_rcvmemdrop++; | |
309 | m_freem(m); | |
91489f6b JH |
310 | /* no SACK block to report */ |
311 | tp->reportblk.rblk_start = tp->reportblk.rblk_end; | |
984263bc MD |
312 | return (0); |
313 | } | |
2d23a8be | 314 | atomic_add_int(&tcp_reass_qsize, 1); |
984263bc MD |
315 | |
316 | /* | |
317 | * Find a segment which begins after this one does. | |
318 | */ | |
319 | LIST_FOREACH(q, &tp->t_segq, tqe_q) { | |
320 | if (SEQ_GT(q->tqe_th->th_seq, th->th_seq)) | |
321 | break; | |
322 | p = q; | |
323 | } | |
324 | ||
325 | /* | |
326 | * If there is a preceding segment, it may provide some of | |
327 | * our data already. If so, drop the data from the incoming | |
328 | * segment. If it provides all of our data, drop us. | |
329 | */ | |
330 | if (p != NULL) { | |
76cf5e41 | 331 | tcp_seq_diff_t i; |
91489f6b | 332 | |
984263bc MD |
333 | /* conversion to int (in i) handles seq wraparound */ |
334 | i = p->tqe_th->th_seq + p->tqe_len - th->th_seq; | |
91489f6b JH |
335 | if (i > 0) { /* overlaps preceding segment */ |
336 | tp->t_flags |= (TF_DUPSEG | TF_ENCLOSESEG); | |
337 | /* enclosing block starts w/ preceding segment */ | |
338 | tp->encloseblk.rblk_start = p->tqe_th->th_seq; | |
984263bc | 339 | if (i >= *tlenp) { |
91489f6b | 340 | /* preceding encloses incoming segment */ |
3a5d999b SZ |
341 | tp->encloseblk.rblk_end = TCP_SACK_BLKEND( |
342 | p->tqe_th->th_seq + p->tqe_len, | |
343 | p->tqe_th->th_flags); | |
984263bc MD |
344 | tcpstat.tcps_rcvduppack++; |
345 | tcpstat.tcps_rcvdupbyte += *tlenp; | |
346 | m_freem(m); | |
efda3bd0 | 347 | kfree(te, M_TSEGQ); |
2d23a8be | 348 | atomic_add_int(&tcp_reass_qsize, -1); |
984263bc MD |
349 | /* |
350 | * Try to present any queued data | |
351 | * at the left window edge to the user. | |
352 | * This is needed after the 3-WHS | |
353 | * completes. | |
354 | */ | |
355 | goto present; /* ??? */ | |
356 | } | |
357 | m_adj(m, i); | |
358 | *tlenp -= i; | |
359 | th->th_seq += i; | |
91489f6b | 360 | /* incoming segment end is enclosing block end */ |
3a5d999b SZ |
361 | tp->encloseblk.rblk_end = TCP_SACK_BLKEND( |
362 | th->th_seq + *tlenp, th->th_flags); | |
91489f6b JH |
363 | /* trim end of reported D-SACK block */ |
364 | tp->reportblk.rblk_end = th->th_seq; | |
984263bc MD |
365 | } |
366 | } | |
367 | tcpstat.tcps_rcvoopack++; | |
368 | tcpstat.tcps_rcvoobyte += *tlenp; | |
369 | ||
370 | /* | |
371 | * While we overlap succeeding segments trim them or, | |
372 | * if they are completely covered, dequeue them. | |
373 | */ | |
374 | while (q) { | |
76cf5e41 | 375 | tcp_seq_diff_t i = (th->th_seq + *tlenp) - q->tqe_th->th_seq; |
91489f6b | 376 | tcp_seq qend = q->tqe_th->th_seq + q->tqe_len; |
3a5d999b | 377 | tcp_seq qend_sack = TCP_SACK_BLKEND(qend, q->tqe_th->th_flags); |
91489f6b JH |
378 | struct tseg_qent *nq; |
379 | ||
984263bc MD |
380 | if (i <= 0) |
381 | break; | |
91489f6b JH |
382 | if (!(tp->t_flags & TF_DUPSEG)) { /* first time through */ |
383 | tp->t_flags |= (TF_DUPSEG | TF_ENCLOSESEG); | |
384 | tp->encloseblk = tp->reportblk; | |
385 | /* report trailing duplicate D-SACK segment */ | |
386 | tp->reportblk.rblk_start = q->tqe_th->th_seq; | |
387 | } | |
388 | if ((tp->t_flags & TF_ENCLOSESEG) && | |
3a5d999b | 389 | SEQ_GT(qend_sack, tp->encloseblk.rblk_end)) { |
91489f6b | 390 | /* extend enclosing block if one exists */ |
3a5d999b | 391 | tp->encloseblk.rblk_end = qend_sack; |
91489f6b | 392 | } |
984263bc MD |
393 | if (i < q->tqe_len) { |
394 | q->tqe_th->th_seq += i; | |
395 | q->tqe_len -= i; | |
396 | m_adj(q->tqe_m, i); | |
397 | break; | |
398 | } | |
399 | ||
400 | nq = LIST_NEXT(q, tqe_q); | |
401 | LIST_REMOVE(q, tqe_q); | |
402 | m_freem(q->tqe_m); | |
efda3bd0 | 403 | kfree(q, M_TSEGQ); |
2d23a8be | 404 | atomic_add_int(&tcp_reass_qsize, -1); |
984263bc MD |
405 | q = nq; |
406 | } | |
407 | ||
408 | /* Insert the new segment queue entry into place. */ | |
409 | te->tqe_m = m; | |
410 | te->tqe_th = th; | |
411 | te->tqe_len = *tlenp; | |
412 | ||
91489f6b JH |
413 | /* check if can coalesce with following segment */ |
414 | if (q != NULL && (th->th_seq + *tlenp == q->tqe_th->th_seq)) { | |
415 | tcp_seq tend = te->tqe_th->th_seq + te->tqe_len; | |
3a5d999b | 416 | tcp_seq tend_sack = TCP_SACK_BLKEND(tend, te->tqe_th->th_flags); |
91489f6b JH |
417 | |
418 | te->tqe_len += q->tqe_len; | |
a174690a | 419 | if (q->tqe_th->th_flags & TH_FIN) |
f16f8cc3 | 420 | te->tqe_th->th_flags |= TH_FIN; |
91489f6b | 421 | m_cat(te->tqe_m, q->tqe_m); |
3a5d999b | 422 | tp->encloseblk.rblk_end = tend_sack; |
91489f6b JH |
423 | /* |
424 | * When not reporting a duplicate segment, use | |
425 | * the larger enclosing block as the SACK block. | |
426 | */ | |
427 | if (!(tp->t_flags & TF_DUPSEG)) | |
3a5d999b | 428 | tp->reportblk.rblk_end = tend_sack; |
91489f6b | 429 | LIST_REMOVE(q, tqe_q); |
efda3bd0 | 430 | kfree(q, M_TSEGQ); |
2d23a8be | 431 | atomic_add_int(&tcp_reass_qsize, -1); |
91489f6b JH |
432 | } |
433 | ||
984263bc MD |
434 | if (p == NULL) { |
435 | LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q); | |
436 | } else { | |
91489f6b JH |
437 | /* check if can coalesce with preceding segment */ |
438 | if (p->tqe_th->th_seq + p->tqe_len == th->th_seq) { | |
a174690a JH |
439 | p->tqe_len += te->tqe_len; |
440 | m_cat(p->tqe_m, te->tqe_m); | |
91489f6b JH |
441 | tp->encloseblk.rblk_start = p->tqe_th->th_seq; |
442 | /* | |
443 | * When not reporting a duplicate segment, use | |
444 | * the larger enclosing block as the SACK block. | |
445 | */ | |
446 | if (!(tp->t_flags & TF_DUPSEG)) | |
447 | tp->reportblk.rblk_start = p->tqe_th->th_seq; | |
efda3bd0 | 448 | kfree(te, M_TSEGQ); |
2d23a8be MD |
449 | atomic_add_int(&tcp_reass_qsize, -1); |
450 | } else { | |
91489f6b | 451 | LIST_INSERT_AFTER(p, te, tqe_q); |
2d23a8be | 452 | } |
984263bc MD |
453 | } |
454 | ||
455 | present: | |
456 | /* | |
457 | * Present data to user, advancing rcv_nxt through | |
458 | * completed sequence space. | |
459 | */ | |
460 | if (!TCPS_HAVEESTABLISHED(tp->t_state)) | |
461 | return (0); | |
462 | q = LIST_FIRST(&tp->t_segq); | |
61896e3c | 463 | if (q == NULL || q->tqe_th->th_seq != tp->rcv_nxt) |
984263bc | 464 | return (0); |
91489f6b JH |
465 | tp->rcv_nxt += q->tqe_len; |
466 | if (!(tp->t_flags & TF_DUPSEG)) { | |
467 | /* no SACK block to report since ACK advanced */ | |
468 | tp->reportblk.rblk_start = tp->reportblk.rblk_end; | |
469 | } | |
470 | /* no enclosing block to report since ACK advanced */ | |
471 | tp->t_flags &= ~TF_ENCLOSESEG; | |
472 | flags = q->tqe_th->th_flags & TH_FIN; | |
473 | LIST_REMOVE(q, tqe_q); | |
474 | KASSERT(LIST_EMPTY(&tp->t_segq) || | |
475 | LIST_FIRST(&tp->t_segq)->tqe_th->th_seq != tp->rcv_nxt, | |
476 | ("segment not coalesced")); | |
6cef7136 | 477 | if (so->so_state & SS_CANTRCVMORE) { |
91489f6b | 478 | m_freem(q->tqe_m); |
6cef7136 MD |
479 | } else { |
480 | lwkt_gettoken(&so->so_rcv.ssb_token); | |
6d49aa6f | 481 | ssb_appendstream(&so->so_rcv, q->tqe_m); |
6cef7136 MD |
482 | lwkt_reltoken(&so->so_rcv.ssb_token); |
483 | } | |
efda3bd0 | 484 | kfree(q, M_TSEGQ); |
2d23a8be | 485 | atomic_add_int(&tcp_reass_qsize, -1); |
984263bc MD |
486 | ND6_HINT(tp); |
487 | sorwakeup(so); | |
488 | return (flags); | |
489 | } | |
490 | ||
491 | /* | |
492 | * TCP input routine, follows pages 65-76 of the | |
493 | * protocol specification dated September, 1981 very closely. | |
494 | */ | |
495 | #ifdef INET6 | |
496 | int | |
95b22adf | 497 | tcp6_input(struct mbuf **mp, int *offp, int proto) |
984263bc | 498 | { |
2256ba69 | 499 | struct mbuf *m = *mp; |
984263bc MD |
500 | struct in6_ifaddr *ia6; |
501 | ||
502 | IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), IPPROTO_DONE); | |
503 | ||
504 | /* | |
505 | * draft-itojun-ipv6-tcp-to-anycast | |
506 | * better place to put this in? | |
507 | */ | |
508 | ia6 = ip6_getdstifaddr(m); | |
d24ce1dc | 509 | if (ia6 && (ia6->ia6_flags & IN6_IFF_ANYCAST)) { |
984263bc MD |
510 | struct ip6_hdr *ip6; |
511 | ||
512 | ip6 = mtod(m, struct ip6_hdr *); | |
513 | icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR, | |
f23061d4 | 514 | offsetof(struct ip6_hdr, ip6_dst)); |
d24ce1dc | 515 | return (IPPROTO_DONE); |
984263bc MD |
516 | } |
517 | ||
002c1265 | 518 | tcp_input(mp, offp, proto); |
d24ce1dc | 519 | return (IPPROTO_DONE); |
984263bc MD |
520 | } |
521 | #endif | |
522 | ||
002c1265 MD |
523 | int |
524 | tcp_input(struct mbuf **mp, int *offp, int proto) | |
984263bc | 525 | { |
002c1265 | 526 | int off0; |
2256ba69 RG |
527 | struct tcphdr *th; |
528 | struct ip *ip = NULL; | |
529 | struct ipovly *ipov; | |
530 | struct inpcb *inp = NULL; | |
984263bc MD |
531 | u_char *optp = NULL; |
532 | int optlen = 0; | |
b1992928 MD |
533 | int tlen, off; |
534 | int len = 0; | |
984263bc | 535 | int drop_hdrlen; |
2256ba69 RG |
536 | struct tcpcb *tp = NULL; |
537 | int thflags; | |
4090d6ff | 538 | struct socket *so = NULL; |
61896e3c JH |
539 | int todrop, acked; |
540 | boolean_t ourfinisacked, needoutput = FALSE; | |
984263bc | 541 | u_long tiwin; |
61896e3c | 542 | int recvwin; |
984263bc | 543 | struct tcpopt to; /* options in this segment */ |
984263bc MD |
544 | struct sockaddr_in *next_hop = NULL; |
545 | int rstreason; /* For badport_bandlim accounting purposes */ | |
d371a63a | 546 | int cpu; |
984263bc | 547 | struct ip6_hdr *ip6 = NULL; |
002c1265 | 548 | struct mbuf *m; |
984263bc | 549 | #ifdef INET6 |
d24ce1dc | 550 | boolean_t isipv6; |
984263bc | 551 | #else |
d24ce1dc | 552 | const boolean_t isipv6 = FALSE; |
984263bc MD |
553 | #endif |
554 | #ifdef TCPDEBUG | |
555 | short ostate = 0; | |
556 | #endif | |
557 | ||
002c1265 MD |
558 | off0 = *offp; |
559 | m = *mp; | |
560 | *mp = NULL; | |
a00138cb | 561 | |
d24ce1dc JH |
562 | tcpstat.tcps_rcvtotal++; |
563 | ||
5de23090 SZ |
564 | if (m->m_pkthdr.fw_flags & IPFORWARD_MBUF_TAGGED) { |
565 | struct m_tag *mtag; | |
566 | ||
567 | mtag = m_tag_find(m, PACKET_TAG_IPFORWARD, NULL); | |
568 | KKASSERT(mtag != NULL); | |
569 | next_hop = m_tag_data(mtag); | |
984263bc | 570 | } |
d24ce1dc | 571 | |
984263bc | 572 | #ifdef INET6 |
d24ce1dc | 573 | isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? TRUE : FALSE; |
984263bc | 574 | #endif |
984263bc MD |
575 | |
576 | if (isipv6) { | |
577 | /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */ | |
578 | ip6 = mtod(m, struct ip6_hdr *); | |
407e896e | 579 | tlen = (sizeof *ip6) + ntohs(ip6->ip6_plen) - off0; |
984263bc MD |
580 | if (in6_cksum(m, IPPROTO_TCP, off0, tlen)) { |
581 | tcpstat.tcps_rcvbadsum++; | |
582 | goto drop; | |
583 | } | |
584 | th = (struct tcphdr *)((caddr_t)ip6 + off0); | |
585 | ||
586 | /* | |
587 | * Be proactive about unspecified IPv6 address in source. | |
588 | * As we use all-zero to indicate unbounded/unconnected pcb, | |
589 | * unspecified IPv6 address can be used to confuse us. | |
590 | * | |
591 | * Note that packets with unspecified IPv6 destination is | |
592 | * already dropped in ip6_input. | |
593 | */ | |
594 | if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { | |
595 | /* XXX stat */ | |
596 | goto drop; | |
597 | } | |
598 | } else { | |
599 | /* | |
600 | * Get IP and TCP header together in first mbuf. | |
601 | * Note: IP leaves IP header in first mbuf. | |
602 | */ | |
603 | if (off0 > sizeof(struct ip)) { | |
bddf0751 | 604 | ip_stripoptions(m); |
984263bc MD |
605 | off0 = sizeof(struct ip); |
606 | } | |
55d829f8 JH |
607 | /* already checked and pulled up in ip_demux() */ |
608 | KASSERT(m->m_len >= sizeof(struct tcpiphdr), | |
61896e3c | 609 | ("TCP header not in one mbuf: m->m_len %d", m->m_len)); |
984263bc MD |
610 | ip = mtod(m, struct ip *); |
611 | ipov = (struct ipovly *)ip; | |
612 | th = (struct tcphdr *)((caddr_t)ip + off0); | |
613 | tlen = ip->ip_len; | |
614 | ||
615 | if (m->m_pkthdr.csum_flags & CSUM_DATA_VALID) { | |
616 | if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) | |
617 | th->th_sum = m->m_pkthdr.csum_data; | |
618 | else | |
619 | th->th_sum = in_pseudo(ip->ip_src.s_addr, | |
620 | ip->ip_dst.s_addr, | |
621 | htonl(m->m_pkthdr.csum_data + | |
622 | ip->ip_len + | |
623 | IPPROTO_TCP)); | |
624 | th->th_sum ^= 0xffff; | |
625 | } else { | |
626 | /* | |
627 | * Checksum extended TCP header and data. | |
628 | */ | |
629 | len = sizeof(struct ip) + tlen; | |
407e896e | 630 | bzero(ipov->ih_x1, sizeof ipov->ih_x1); |
984263bc MD |
631 | ipov->ih_len = (u_short)tlen; |
632 | ipov->ih_len = htons(ipov->ih_len); | |
633 | th->th_sum = in_cksum(m, len); | |
634 | } | |
635 | if (th->th_sum) { | |
636 | tcpstat.tcps_rcvbadsum++; | |
637 | goto drop; | |
638 | } | |
639 | #ifdef INET6 | |
640 | /* Re-initialization for later version check */ | |
641 | ip->ip_v = IPVERSION; | |
642 | #endif | |
643 | } | |
644 | ||
645 | /* | |
646 | * Check that TCP offset makes sense, | |
647 | * pull out TCP options and adjust length. XXX | |
648 | */ | |
649 | off = th->th_off << 2; | |
55d829f8 JH |
650 | /* already checked and pulled up in ip_demux() */ |
651 | KASSERT(off >= sizeof(struct tcphdr) && off <= tlen, | |
61896e3c | 652 | ("bad TCP data offset %d (tlen %d)", off, tlen)); |
984263bc MD |
653 | tlen -= off; /* tlen is used instead of ti->ti_len */ |
654 | if (off > sizeof(struct tcphdr)) { | |
655 | if (isipv6) { | |
002c1265 | 656 | IP6_EXTHDR_CHECK(m, off0, off, IPPROTO_DONE); |
984263bc MD |
657 | ip6 = mtod(m, struct ip6_hdr *); |
658 | th = (struct tcphdr *)((caddr_t)ip6 + off0); | |
659 | } else { | |
55d829f8 JH |
660 | /* already pulled up in ip_demux() */ |
661 | KASSERT(m->m_len >= sizeof(struct ip) + off, | |
61896e3c JH |
662 | ("TCP header and options not in one mbuf: " |
663 | "m_len %d, off %d", m->m_len, off)); | |
984263bc MD |
664 | } |
665 | optlen = off - sizeof(struct tcphdr); | |
666 | optp = (u_char *)(th + 1); | |
667 | } | |
668 | thflags = th->th_flags; | |
669 | ||
670 | #ifdef TCP_DROP_SYNFIN | |
671 | /* | |
672 | * If the drop_synfin option is enabled, drop all packets with | |
673 | * both the SYN and FIN bits set. This prevents e.g. nmap from | |
674 | * identifying the TCP/IP stack. | |
675 | * | |
676 | * This is a violation of the TCP specification. | |
677 | */ | |
61896e3c | 678 | if (drop_synfin && (thflags & (TH_SYN | TH_FIN)) == (TH_SYN | TH_FIN)) |
984263bc MD |
679 | goto drop; |
680 | #endif | |
681 | ||
682 | /* | |
683 | * Convert TCP protocol specific fields to host format. | |
684 | */ | |
685 | th->th_seq = ntohl(th->th_seq); | |
686 | th->th_ack = ntohl(th->th_ack); | |
687 | th->th_win = ntohs(th->th_win); | |
688 | th->th_urp = ntohs(th->th_urp); | |
689 | ||
690 | /* | |
d24ce1dc | 691 | * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options, |
984263bc MD |
692 | * until after ip6_savecontrol() is called and before other functions |
693 | * which don't want those proto headers. | |
694 | * Because ip6_savecontrol() is going to parse the mbuf to | |
695 | * search for data to be passed up to user-land, it wants mbuf | |
696 | * parameters to be unchanged. | |
697 | * XXX: the call of ip6_savecontrol() has been obsoleted based on | |
698 | * latest version of the advanced API (20020110). | |
699 | */ | |
700 | drop_hdrlen = off0 + off; | |
701 | ||
702 | /* | |
703 | * Locate pcb for segment. | |
704 | */ | |
705 | findpcb: | |
706 | /* IPFIREWALL_FORWARD section */ | |
d24ce1dc | 707 | if (next_hop != NULL && !isipv6) { /* IPv6 support is not there yet */ |
984263bc MD |
708 | /* |
709 | * Transparently forwarded. Pretend to be the destination. | |
d24ce1dc | 710 | * already got one like this? |
984263bc | 711 | */ |
6ca1a1cd | 712 | cpu = mycpu->gd_cpuid; |
6ca1a1cd | 713 | inp = in_pcblookup_hash(&tcbinfo[cpu], |
d371a63a | 714 | ip->ip_src, th->th_sport, |
984263bc MD |
715 | ip->ip_dst, th->th_dport, |
716 | 0, m->m_pkthdr.rcvif); | |
717 | if (!inp) { | |
83be63fe JH |
718 | /* |
719 | * It's new. Try to find the ambushing socket. | |
720 | */ | |
721 | ||
722 | /* | |
723 | * The rest of the ipfw code stores the port in | |
724 | * host order. XXX | |
725 | * (The IP address is still in network order.) | |
726 | */ | |
727 | in_port_t dport = next_hop->sin_port ? | |
728 | htons(next_hop->sin_port) : | |
729 | th->th_dport; | |
730 | ||
d371a63a | 731 | cpu = tcp_addrcpu(ip->ip_src.s_addr, th->th_sport, |
83be63fe | 732 | next_hop->sin_addr.s_addr, dport); |
d371a63a | 733 | inp = in_pcblookup_hash(&tcbinfo[cpu], |
984263bc | 734 | ip->ip_src, th->th_sport, |
83be63fe | 735 | next_hop->sin_addr, dport, |
984263bc MD |
736 | 1, m->m_pkthdr.rcvif); |
737 | } | |
738 | } else { | |
6ca1a1cd | 739 | if (isipv6) { |
d371a63a | 740 | inp = in6_pcblookup_hash(&tcbinfo[0], |
984263bc MD |
741 | &ip6->ip6_src, th->th_sport, |
742 | &ip6->ip6_dst, th->th_dport, | |
743 | 1, m->m_pkthdr.rcvif); | |
6ca1a1cd | 744 | } else { |
6ca1a1cd | 745 | cpu = mycpu->gd_cpuid; |
6ca1a1cd | 746 | inp = in_pcblookup_hash(&tcbinfo[cpu], |
984263bc MD |
747 | ip->ip_src, th->th_sport, |
748 | ip->ip_dst, th->th_dport, | |
749 | 1, m->m_pkthdr.rcvif); | |
6ca1a1cd | 750 | } |
984263bc | 751 | } |
984263bc MD |
752 | |
753 | /* | |
754 | * If the state is CLOSED (i.e., TCB does not exist) then | |
755 | * all data in the incoming segment is discarded. | |
756 | * If the TCB exists but is in CLOSED state, it is embryonic, | |
757 | * but should either do a listen or a connect soon. | |
758 | */ | |
759 | if (inp == NULL) { | |
760 | if (log_in_vain) { | |
761 | #ifdef INET6 | |
762 | char dbuf[INET6_ADDRSTRLEN+2], sbuf[INET6_ADDRSTRLEN+2]; | |
763 | #else | |
1141eb20 JH |
764 | char dbuf[sizeof "aaa.bbb.ccc.ddd"]; |
765 | char sbuf[sizeof "aaa.bbb.ccc.ddd"]; | |
984263bc MD |
766 | #endif |
767 | if (isipv6) { | |
768 | strcpy(dbuf, "["); | |
984263bc | 769 | strcat(dbuf, ip6_sprintf(&ip6->ip6_dst)); |
984263bc | 770 | strcat(dbuf, "]"); |
95b22adf JH |
771 | strcpy(sbuf, "["); |
772 | strcat(sbuf, ip6_sprintf(&ip6->ip6_src)); | |
984263bc MD |
773 | strcat(sbuf, "]"); |
774 | } else { | |
775 | strcpy(dbuf, inet_ntoa(ip->ip_dst)); | |
776 | strcpy(sbuf, inet_ntoa(ip->ip_src)); | |
777 | } | |
778 | switch (log_in_vain) { | |
779 | case 1: | |
61896e3c | 780 | if (!(thflags & TH_SYN)) |
984263bc MD |
781 | break; |
782 | case 2: | |
783 | log(LOG_INFO, | |
784 | "Connection attempt to TCP %s:%d " | |
785 | "from %s:%d flags:0x%02x\n", | |
786 | dbuf, ntohs(th->th_dport), sbuf, | |
787 | ntohs(th->th_sport), thflags); | |
788 | break; | |
789 | default: | |
790 | break; | |
791 | } | |
792 | } | |
d24ce1dc | 793 | if (blackhole) { |
984263bc MD |
794 | switch (blackhole) { |
795 | case 1: | |
796 | if (thflags & TH_SYN) | |
797 | goto drop; | |
798 | break; | |
799 | case 2: | |
800 | goto drop; | |
801 | default: | |
802 | goto drop; | |
803 | } | |
804 | } | |
805 | rstreason = BANDLIM_RST_CLOSEDPORT; | |
806 | goto dropwithreset; | |
807 | } | |
61896e3c JH |
808 | |
809 | #ifdef IPSEC | |
810 | if (isipv6) { | |
811 | if (ipsec6_in_reject_so(m, inp->inp_socket)) { | |
812 | ipsec6stat.in_polvio++; | |
813 | goto drop; | |
814 | } | |
815 | } else { | |
816 | if (ipsec4_in_reject_so(m, inp->inp_socket)) { | |
817 | ipsecstat.in_polvio++; | |
818 | goto drop; | |
819 | } | |
820 | } | |
821 | #endif | |
822 | #ifdef FAST_IPSEC | |
823 | if (isipv6) { | |
824 | if (ipsec6_in_reject(m, inp)) | |
825 | goto drop; | |
826 | } else { | |
827 | if (ipsec4_in_reject(m, inp)) | |
828 | goto drop; | |
829 | } | |
830 | #endif | |
95926362 MD |
831 | /* Check the minimum TTL for socket. */ |
832 | #ifdef INET6 | |
833 | if ((isipv6 ? ip6->ip6_hlim : ip->ip_ttl) < inp->inp_ip_minttl) | |
834 | goto drop; | |
835 | #endif | |
61896e3c | 836 | |
984263bc MD |
837 | tp = intotcpcb(inp); |
838 | if (tp == NULL) { | |
839 | rstreason = BANDLIM_RST_CLOSEDPORT; | |
840 | goto dropwithreset; | |
841 | } | |
eb594563 | 842 | if (tp->t_state <= TCPS_CLOSED) |
984263bc MD |
843 | goto drop; |
844 | ||
845 | /* Unscale the window into a 32-bit value. */ | |
95b22adf | 846 | if (!(thflags & TH_SYN)) |
984263bc MD |
847 | tiwin = th->th_win << tp->snd_scale; |
848 | else | |
849 | tiwin = th->th_win; | |
850 | ||
851 | so = inp->inp_socket; | |
47654766 | 852 | |
984263bc | 853 | #ifdef TCPDEBUG |
47654766 JH |
854 | if (so->so_options & SO_DEBUG) { |
855 | ostate = tp->t_state; | |
856 | if (isipv6) | |
95b22adf | 857 | bcopy(ip6, tcp_saveipgen, sizeof(*ip6)); |
47654766 | 858 | else |
95b22adf | 859 | bcopy(ip, tcp_saveipgen, sizeof(*ip)); |
47654766 JH |
860 | tcp_savetcp = *th; |
861 | } | |
984263bc | 862 | #endif |
47654766 | 863 | |
407e896e | 864 | bzero(&to, sizeof to); |
d24ce1dc | 865 | |
47654766 JH |
866 | if (so->so_options & SO_ACCEPTCONN) { |
867 | struct in_conninfo inc; | |
868 | ||
984263bc | 869 | #ifdef INET6 |
d24ce1dc | 870 | inc.inc_isipv6 = (isipv6 == TRUE); |
984263bc MD |
871 | #endif |
872 | if (isipv6) { | |
873 | inc.inc6_faddr = ip6->ip6_src; | |
874 | inc.inc6_laddr = ip6->ip6_dst; | |
875 | inc.inc6_route.ro_rt = NULL; /* XXX */ | |
876 | } else { | |
877 | inc.inc_faddr = ip->ip_src; | |
878 | inc.inc_laddr = ip->ip_dst; | |
879 | inc.inc_route.ro_rt = NULL; /* XXX */ | |
880 | } | |
881 | inc.inc_fport = th->th_sport; | |
882 | inc.inc_lport = th->th_dport; | |
883 | ||
61896e3c JH |
884 | /* |
885 | * If the state is LISTEN then ignore segment if it contains | |
984263bc MD |
886 | * a RST. If the segment contains an ACK then it is bad and |
887 | * send a RST. If it does not contain a SYN then it is not | |
888 | * interesting; drop it. | |
889 | * | |
890 | * If the state is SYN_RECEIVED (syncache) and seg contains | |
891 | * an ACK, but not for our SYN/ACK, send a RST. If the seg | |
892 | * contains a RST, check the sequence number to see if it | |
893 | * is a valid reset segment. | |
894 | */ | |
61896e3c JH |
895 | if ((thflags & (TH_RST | TH_ACK | TH_SYN)) != TH_SYN) { |
896 | if ((thflags & (TH_RST | TH_ACK | TH_SYN)) == TH_ACK) { | |
984263bc MD |
897 | if (!syncache_expand(&inc, th, &so, m)) { |
898 | /* | |
899 | * No syncache entry, or ACK was not | |
900 | * for our SYN/ACK. Send a RST. | |
901 | */ | |
902 | tcpstat.tcps_badsyn++; | |
903 | rstreason = BANDLIM_RST_OPENPORT; | |
904 | goto dropwithreset; | |
905 | } | |
2d23a8be MD |
906 | |
907 | /* | |
908 | * Could not complete 3-way handshake, | |
909 | * connection is being closed down, and | |
910 | * syncache will free mbuf. | |
911 | */ | |
984263bc | 912 | if (so == NULL) |
002c1265 | 913 | return(IPPROTO_DONE); |
2d23a8be MD |
914 | |
915 | /* | |
916 | * We must be in the correct protocol thread | |
917 | * for this connection. | |
918 | */ | |
919 | KKASSERT(so->so_port == &curthread->td_msgport); | |
920 | ||
984263bc MD |
921 | /* |
922 | * Socket is created in state SYN_RECEIVED. | |
923 | * Continue processing segment. | |
924 | */ | |
ed894f8c | 925 | inp = so->so_pcb; |
984263bc MD |
926 | tp = intotcpcb(inp); |
927 | /* | |
928 | * This is what would have happened in | |
929 | * tcp_output() when the SYN,ACK was sent. | |
930 | */ | |
931 | tp->snd_up = tp->snd_una; | |
932 | tp->snd_max = tp->snd_nxt = tp->iss + 1; | |
933 | tp->last_ack_sent = tp->rcv_nxt; | |
934 | /* | |
935 | * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled | |
936 | * until the _second_ ACK is received: | |
937 | * rcv SYN (set wscale opts) --> send SYN/ACK, set snd_wnd = window. | |
938 | * rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale, | |
61896e3c | 939 | * move to ESTAB, set snd_wnd to tiwin. |
d24ce1dc | 940 | */ |
984263bc MD |
941 | tp->snd_wnd = tiwin; /* unscaled */ |
942 | goto after_listen; | |
943 | } | |
944 | if (thflags & TH_RST) { | |
945 | syncache_chkrst(&inc, th); | |
946 | goto drop; | |
947 | } | |
948 | if (thflags & TH_ACK) { | |
949 | syncache_badack(&inc); | |
950 | tcpstat.tcps_badsyn++; | |
951 | rstreason = BANDLIM_RST_OPENPORT; | |
952 | goto dropwithreset; | |
953 | } | |
954 | goto drop; | |
955 | } | |
956 | ||
957 | /* | |
61896e3c | 958 | * Segment's flags are (SYN) or (SYN | FIN). |
984263bc MD |
959 | */ |
960 | #ifdef INET6 | |
961 | /* | |
962 | * If deprecated address is forbidden, | |
963 | * we do not accept SYN to deprecated interface | |
964 | * address to prevent any new inbound connection from | |
965 | * getting established. | |
966 | * When we do not accept SYN, we send a TCP RST, | |
967 | * with deprecated source address (instead of dropping | |
968 | * it). We compromise it as it is much better for peer | |
969 | * to send a RST, and RST will be the final packet | |
970 | * for the exchange. | |
971 | * | |
972 | * If we do not forbid deprecated addresses, we accept | |
973 | * the SYN packet. RFC2462 does not suggest dropping | |
974 | * SYN in this case. | |
975 | * If we decipher RFC2462 5.5.4, it says like this: | |
976 | * 1. use of deprecated addr with existing | |
977 | * communication is okay - "SHOULD continue to be | |
978 | * used" | |
979 | * 2. use of it with new communication: | |
980 | * (2a) "SHOULD NOT be used if alternate address | |
61896e3c | 981 | * with sufficient scope is available" |
984263bc MD |
982 | * (2b) nothing mentioned otherwise. |
983 | * Here we fall into (2b) case as we have no choice in | |
984 | * our source address selection - we must obey the peer. | |
985 | * | |
986 | * The wording in RFC2462 is confusing, and there are | |
987 | * multiple description text for deprecated address | |
988 | * handling - worse, they are not exactly the same. | |
989 | * I believe 5.5.4 is the best one, so we follow 5.5.4. | |
990 | */ | |
991 | if (isipv6 && !ip6_use_deprecated) { | |
992 | struct in6_ifaddr *ia6; | |
993 | ||
994 | if ((ia6 = ip6_getdstifaddr(m)) && | |
995 | (ia6->ia6_flags & IN6_IFF_DEPRECATED)) { | |
996 | tp = NULL; | |
997 | rstreason = BANDLIM_RST_OPENPORT; | |
998 | goto dropwithreset; | |
999 | } | |
1000 | } | |
1001 | #endif | |
1002 | /* | |
1003 | * If it is from this socket, drop it, it must be forged. | |
1004 | * Don't bother responding if the destination was a broadcast. | |
1005 | */ | |
1006 | if (th->th_dport == th->th_sport) { | |
1007 | if (isipv6) { | |
1008 | if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, | |
1009 | &ip6->ip6_src)) | |
1010 | goto drop; | |
1011 | } else { | |
1012 | if (ip->ip_dst.s_addr == ip->ip_src.s_addr) | |
1013 | goto drop; | |
1014 | } | |
1015 | } | |
1016 | /* | |
1017 | * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN | |
1018 | * | |
1019 | * Note that it is quite possible to receive unicast | |
1020 | * link-layer packets with a broadcast IP address. Use | |
1021 | * in_broadcast() to find them. | |
1022 | */ | |
61896e3c | 1023 | if (m->m_flags & (M_BCAST | M_MCAST)) |
984263bc MD |
1024 | goto drop; |
1025 | if (isipv6) { | |
1026 | if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || | |
1027 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) | |
1028 | goto drop; | |
1029 | } else { | |
1030 | if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || | |
1031 | IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || | |
1032 | ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || | |
1033 | in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) | |
1034 | goto drop; | |
1035 | } | |
1036 | /* | |
1037 | * SYN appears to be valid; create compressed TCP state | |
1038 | * for syncache, or perform t/tcp connection. | |
1039 | */ | |
1040 | if (so->so_qlen <= so->so_qlimit) { | |
95b22adf | 1041 | tcp_dooptions(&to, optp, optlen, TRUE); |
b09567cc | 1042 | if (!syncache_add(&inc, &to, th, so, m)) |
984263bc | 1043 | goto drop; |
2d23a8be MD |
1044 | |
1045 | /* | |
1046 | * Entry added to syncache, mbuf used to | |
1047 | * send SYN,ACK packet. | |
1048 | */ | |
b09567cc | 1049 | return(IPPROTO_DONE); |
984263bc MD |
1050 | } |
1051 | goto drop; | |
1052 | } | |
984263bc | 1053 | |
2d23a8be MD |
1054 | after_listen: |
1055 | /* | |
1056 | * Should not happen - syncache should pick up these connections. | |
1057 | * | |
1058 | * Once we are past handling listen sockets we must be in the | |
1059 | * correct protocol processing thread. | |
1060 | */ | |
61896e3c | 1061 | KASSERT(tp->t_state != TCPS_LISTEN, ("tcp_input: TCPS_LISTEN state")); |
2d23a8be | 1062 | KKASSERT(so->so_port == &curthread->td_msgport); |
984263bc | 1063 | |
5b0b9fa5 PA |
1064 | /* |
1065 | * This is the second part of the MSS DoS prevention code (after | |
1066 | * minmss on the sending side) and it deals with too many too small | |
1067 | * tcp packets in a too short timeframe (1 second). | |
1068 | * | |
153d34ac MD |
1069 | * XXX Removed. This code was crap. It does not scale to network |
1070 | * speed, and default values break NFS. Gone. | |
5b0b9fa5 | 1071 | */ |
153d34ac | 1072 | /* REMOVED */ |
5b0b9fa5 | 1073 | |
984263bc MD |
1074 | /* |
1075 | * Segment received on connection. | |
efca2b8e MD |
1076 | * |
1077 | * Reset idle time and keep-alive timer. Don't waste time if less | |
0ecd93f9 | 1078 | * then a second has elapsed. |
984263bc | 1079 | */ |
0ecd93f9 MD |
1080 | if ((int)(ticks - tp->t_rcvtime) > hz) |
1081 | tcp_timer_keep_activity(tp, thflags); | |
984263bc MD |
1082 | |
1083 | /* | |
1084 | * Process options. | |
1085 | * XXX this is tradtitional behavior, may need to be cleaned up. | |
1086 | */ | |
95b22adf | 1087 | tcp_dooptions(&to, optp, optlen, (thflags & TH_SYN) != 0); |
ad0af98b | 1088 | if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) { |
984263bc MD |
1089 | if (to.to_flags & TOF_SCALE) { |
1090 | tp->t_flags |= TF_RCVD_SCALE; | |
1091 | tp->requested_s_scale = to.to_requested_s_scale; | |
1092 | } | |
1093 | if (to.to_flags & TOF_TS) { | |
1094 | tp->t_flags |= TF_RCVD_TSTMP; | |
1095 | tp->ts_recent = to.to_tsval; | |
1096 | tp->ts_recent_age = ticks; | |
1097 | } | |
f34fd0f2 SZ |
1098 | if (!(to.to_flags & TOF_MSS)) |
1099 | to.to_mss = 0; | |
1100 | tcp_mss(tp, to.to_mss); | |
91489f6b JH |
1101 | /* |
1102 | * Only set the TF_SACK_PERMITTED per-connection flag | |
1103 | * if we got a SACK_PERMITTED option from the other side | |
1104 | * and the global tcp_do_sack variable is true. | |
1105 | */ | |
1106 | if (tcp_do_sack && (to.to_flags & TOF_SACK_PERMITTED)) | |
1107 | tp->t_flags |= TF_SACK_PERMITTED; | |
984263bc MD |
1108 | } |
1109 | ||
1110 | /* | |
1111 | * Header prediction: check for the two common cases | |
1112 | * of a uni-directional data xfer. If the packet has | |
1113 | * no control flags, is in-sequence, the window didn't | |
1114 | * change and we're not retransmitting, it's a | |
1115 | * candidate. If the length is zero and the ack moved | |
1116 | * forward, we're the sender side of the xfer. Just | |
1117 | * free the data acked & wake any higher level process | |
1118 | * that was blocked waiting for space. If the length | |
1119 | * is non-zero and the ack didn't move, we're the | |
1120 | * receiver side. If we're getting packets in-order | |
1121 | * (the reassembly queue is empty), add the data to | |
1122 | * the socket buffer and note that we need a delayed ack. | |
1123 | * Make sure that the hidden state-flags are also off. | |
1124 | * Since we check for TCPS_ESTABLISHED above, it can only | |
1125 | * be TH_NEEDSYN. | |
1126 | */ | |
1127 | if (tp->t_state == TCPS_ESTABLISHED && | |
1128 | (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && | |
61896e3c JH |
1129 | !(tp->t_flags & (TF_NEEDSYN | TF_NEEDFIN)) && |
1130 | (!(to.to_flags & TOF_TS) || | |
984263bc | 1131 | TSTMP_GEQ(to.to_tsval, tp->ts_recent)) && |
984263bc | 1132 | th->th_seq == tp->rcv_nxt && |
984263bc MD |
1133 | tp->snd_nxt == tp->snd_max) { |
1134 | ||
1135 | /* | |
1136 | * If last ACK falls within this segment's sequence numbers, | |
1137 | * record the timestamp. | |
1138 | * NOTE that the test is modified according to the latest | |
1139 | * proposal of the tcplw@cray.com list (Braden 1993/04/26). | |
1140 | */ | |
61896e3c | 1141 | if ((to.to_flags & TOF_TS) && |
984263bc MD |
1142 | SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { |
1143 | tp->ts_recent_age = ticks; | |
1144 | tp->ts_recent = to.to_tsval; | |
1145 | } | |
1146 | ||
1147 | if (tlen == 0) { | |
1148 | if (SEQ_GT(th->th_ack, tp->snd_una) && | |
1149 | SEQ_LEQ(th->th_ack, tp->snd_max) && | |
1150 | tp->snd_cwnd >= tp->snd_wnd && | |
95b22adf | 1151 | !IN_FASTRECOVERY(tp)) { |
984263bc | 1152 | /* |
be23faf1 | 1153 | * This is a pure ack for outstanding data. |
984263bc MD |
1154 | */ |
1155 | ++tcpstat.tcps_predack; | |
1156 | /* | |
1157 | * "bad retransmit" recovery | |
bfdb979e JH |
1158 | * |
1159 | * If Eifel detection applies, then | |
1160 | * it is deterministic, so use it | |
1161 | * unconditionally over the old heuristic. | |
1162 | * Otherwise, fall back to the old heuristic. | |
984263bc | 1163 | */ |
bfdb979e JH |
1164 | if (tcp_do_eifel_detect && |
1165 | (to.to_flags & TOF_TS) && to.to_tsecr && | |
1166 | (tp->t_flags & TF_FIRSTACCACK)) { | |
1167 | /* Eifel detection applicable. */ | |
1168 | if (to.to_tsecr < tp->t_rexmtTS) { | |
1169 | tcp_revert_congestion_state(tp); | |
1170 | ++tcpstat.tcps_eifeldetected; | |
928c3291 SZ |
1171 | if (tp->t_rxtshift != 1 || |
1172 | ticks >= tp->t_badrxtwin) | |
1173 | ++tcpstat.tcps_rttcantdetect; | |
bfdb979e JH |
1174 | } |
1175 | } else if (tp->t_rxtshift == 1 && | |
1176 | ticks < tp->t_badrxtwin) { | |
1177 | tcp_revert_congestion_state(tp); | |
1178 | ++tcpstat.tcps_rttdetected; | |
984263bc | 1179 | } |
8819433a JH |
1180 | tp->t_flags &= ~(TF_FIRSTACCACK | |
1181 | TF_FASTREXMT | TF_EARLYREXMT); | |
984263bc MD |
1182 | /* |
1183 | * Recalculate the retransmit timer / rtt. | |
1184 | * | |
d24ce1dc | 1185 | * Some machines (certain windows boxes) |
984263bc MD |
1186 | * send broken timestamp replies during the |
1187 | * SYN+ACK phase, ignore timestamps of 0. | |
1188 | */ | |
95b22adf | 1189 | if ((to.to_flags & TOF_TS) && to.to_tsecr) { |
984263bc | 1190 | tcp_xmit_timer(tp, |
95b22adf | 1191 | ticks - to.to_tsecr + 1); |
984263bc | 1192 | } else if (tp->t_rtttime && |
95b22adf | 1193 | SEQ_GT(th->th_ack, tp->t_rtseq)) { |
984263bc MD |
1194 | tcp_xmit_timer(tp, |
1195 | ticks - tp->t_rtttime); | |
1196 | } | |
1197 | tcp_xmit_bandwidth_limit(tp, th->th_ack); | |
1198 | acked = th->th_ack - tp->snd_una; | |
1199 | tcpstat.tcps_rcvackpack++; | |
1200 | tcpstat.tcps_rcvackbyte += acked; | |
6d49aa6f | 1201 | sbdrop(&so->so_snd.sb, acked); |
cfb3f3f4 | 1202 | tp->snd_recover = th->th_ack - 1; |
9845754e | 1203 | tp->snd_una = th->th_ack; |
984263bc | 1204 | tp->t_dupacks = 0; |
df9d7670 JH |
1205 | /* |
1206 | * Update window information. | |
1207 | */ | |
1208 | if (tiwin != tp->snd_wnd && | |
1209 | acceptable_window_update(tp, th, tiwin)) { | |
1210 | /* keep track of pure window updates */ | |
1211 | if (tp->snd_wl2 == th->th_ack && | |
1212 | tiwin > tp->snd_wnd) | |
1213 | tcpstat.tcps_rcvwinupd++; | |
1214 | tp->snd_wnd = tiwin; | |
1215 | tp->snd_wl1 = th->th_seq; | |
1216 | tp->snd_wl2 = th->th_ack; | |
1217 | if (tp->snd_wnd > tp->max_sndwnd) | |
1218 | tp->max_sndwnd = tp->snd_wnd; | |
1219 | } | |
984263bc MD |
1220 | m_freem(m); |
1221 | ND6_HINT(tp); /* some progress has been done */ | |
984263bc MD |
1222 | /* |
1223 | * If all outstanding data are acked, stop | |
1224 | * retransmit timer, otherwise restart timer | |
1225 | * using current (possibly backed-off) value. | |
1226 | * If process is waiting for space, | |
1227 | * wakeup/selwakeup/signal. If data | |
1228 | * are ready to send, let tcp_output | |
1229 | * decide between more output or persist. | |
1230 | */ | |
a48c5dd5 SZ |
1231 | if (tp->snd_una == tp->snd_max) { |
1232 | tcp_callout_stop(tp, tp->tt_rexmt); | |
1233 | } else if (!tcp_callout_active(tp, | |
1234 | tp->tt_persist)) { | |
1235 | tcp_callout_reset(tp, tp->tt_rexmt, | |
1236 | tp->t_rxtcur, tcp_timer_rexmt); | |
1237 | } | |
984263bc | 1238 | sowwakeup(so); |
6d49aa6f | 1239 | if (so->so_snd.ssb_cc > 0) |
f23061d4 | 1240 | tcp_output(tp); |
002c1265 | 1241 | return(IPPROTO_DONE); |
984263bc | 1242 | } |
df9d7670 JH |
1243 | } else if (tiwin == tp->snd_wnd && |
1244 | th->th_ack == tp->snd_una && | |
984263bc | 1245 | LIST_EMPTY(&tp->t_segq) && |
6d49aa6f | 1246 | tlen <= ssb_space(&so->so_rcv)) { |
46e92930 | 1247 | u_long newsize = 0; /* automatic sockbuf scaling */ |
984263bc | 1248 | /* |
be23faf1 | 1249 | * This is a pure, in-sequence data packet |
984263bc MD |
1250 | * with nothing on the reassembly queue and |
1251 | * we have enough buffer space to take it. | |
1252 | */ | |
1253 | ++tcpstat.tcps_preddat; | |
1254 | tp->rcv_nxt += tlen; | |
1255 | tcpstat.tcps_rcvpack++; | |
1256 | tcpstat.tcps_rcvbyte += tlen; | |
1257 | ND6_HINT(tp); /* some progress has been done */ | |
5b0b9fa5 PA |
1258 | /* |
1259 | * Automatic sizing of receive socket buffer. Often the send | |
1260 | * buffer size is not optimally adjusted to the actual network | |
1261 | * conditions at hand (delay bandwidth product). Setting the | |
1262 | * buffer size too small limits throughput on links with high | |
1263 | * bandwidth and high delay (eg. trans-continental/oceanic links). | |
1264 | * | |
1265 | * On the receive side the socket buffer memory is only rarely | |
1266 | * used to any significant extent. This allows us to be much | |
1267 | * more aggressive in scaling the receive socket buffer. For | |
1268 | * the case that the buffer space is actually used to a large | |
1269 | * extent and we run out of kernel memory we can simply drop | |
1270 | * the new segments; TCP on the sender will just retransmit it | |
1271 | * later. Setting the buffer size too big may only consume too | |
1272 | * much kernel memory if the application doesn't read() from | |
1273 | * the socket or packet loss or reordering makes use of the | |
1274 | * reassembly queue. | |
1275 | * | |
1276 | * The criteria to step up the receive buffer one notch are: | |
1277 | * 1. the number of bytes received during the time it takes | |
1278 | * one timestamp to be reflected back to us (the RTT); | |
1279 | * 2. received bytes per RTT is within seven eighth of the | |
1280 | * current socket buffer size; | |
1281 | * 3. receive buffer size has not hit maximal automatic size; | |
1282 | * | |
1283 | * This algorithm does one step per RTT at most and only if | |
1284 | * we receive a bulk stream w/o packet losses or reorderings. | |
1285 | * Shrinking the buffer during idle times is not necessary as | |
1286 | * it doesn't consume any memory when idle. | |
1287 | * | |
1288 | * TODO: Only step up if the application is actually serving | |
1289 | * the buffer to better manage the socket buffer resources. | |
1290 | */ | |
1291 | if (tcp_do_autorcvbuf && | |
1292 | to.to_tsecr && | |
1293 | (so->so_rcv.ssb_flags & SSB_AUTOSIZE)) { | |
1294 | if (to.to_tsecr > tp->rfbuf_ts && | |
1295 | to.to_tsecr - tp->rfbuf_ts < hz) { | |
1296 | if (tp->rfbuf_cnt > | |
1297 | (so->so_rcv.ssb_hiwat / 8 * 7) && | |
1298 | so->so_rcv.ssb_hiwat < | |
1299 | tcp_autorcvbuf_max) { | |
1300 | newsize = | |
46e92930 MD |
1301 | ulmin(so->so_rcv.ssb_hiwat + |
1302 | tcp_autorcvbuf_inc, | |
1303 | tcp_autorcvbuf_max); | |
5b0b9fa5 PA |
1304 | } |
1305 | /* Start over with next RTT. */ | |
1306 | tp->rfbuf_ts = 0; | |
1307 | tp->rfbuf_cnt = 0; | |
1308 | } else | |
1309 | tp->rfbuf_cnt += tlen; /* add up */ | |
1310 | } | |
984263bc MD |
1311 | /* |
1312 | * Add data to socket buffer. | |
1313 | */ | |
1314 | if (so->so_state & SS_CANTRCVMORE) { | |
1315 | m_freem(m); | |
1316 | } else { | |
5b0b9fa5 | 1317 | /* |
46e92930 MD |
1318 | * Set new socket buffer size, give up when |
1319 | * limit is reached. | |
1320 | * | |
1321 | * Adjusting the size can mess up ACK | |
1322 | * sequencing when pure window updates are | |
1323 | * being avoided (which is the default), | |
1324 | * so force an ack. | |
5b0b9fa5 | 1325 | */ |
6cef7136 | 1326 | lwkt_gettoken(&so->so_rcv.ssb_token); |
46e92930 MD |
1327 | if (newsize) { |
1328 | tp->t_flags |= TF_RXRESIZED; | |
5b0b9fa5 | 1329 | if (!ssb_reserve(&so->so_rcv, newsize, |
46e92930 | 1330 | so, NULL)) { |
14343ad3 | 1331 | atomic_clear_int(&so->so_rcv.ssb_flags, SSB_AUTOSIZE); |
46e92930 MD |
1332 | } |
1333 | if (newsize >= | |
1334 | (TCP_MAXWIN << tp->rcv_scale)) { | |
14343ad3 | 1335 | atomic_clear_int(&so->so_rcv.ssb_flags, SSB_AUTOSIZE); |
46e92930 MD |
1336 | } |
1337 | } | |
09cf73e0 | 1338 | m_adj(m, drop_hdrlen); /* delayed header drop */ |
6d49aa6f | 1339 | ssb_appendstream(&so->so_rcv, m); |
6cef7136 | 1340 | lwkt_reltoken(&so->so_rcv.ssb_token); |
984263bc MD |
1341 | } |
1342 | sorwakeup(so); | |
2b1ce38a MD |
1343 | /* |
1344 | * This code is responsible for most of the ACKs | |
1345 | * the TCP stack sends back after receiving a data | |
1346 | * packet. Note that the DELAY_ACK check fails if | |
1347 | * the delack timer is already running, which results | |
1348 | * in an ack being sent every other packet (which is | |
1349 | * what we want). | |
72b37eeb MD |
1350 | * |
1351 | * We then further aggregate acks by not actually | |
1352 | * sending one until the protocol thread has completed | |
1353 | * processing the current backlog of packets. This | |
1354 | * does not delay the ack any further, but allows us | |
1355 | * to take advantage of the packet aggregation that | |
1356 | * high speed NICs do (usually blocks of 8-10 packets) | |
1357 | * to send a single ack rather then four or five acks, | |
1358 | * greatly reducing the ack rate, the return channel | |
1359 | * bandwidth, and the protocol overhead on both ends. | |
1360 | * | |
1361 | * Since this also has the effect of slowing down | |
1362 | * the exponential slow-start ramp-up, systems with | |
1363 | * very large bandwidth-delay products might want | |
1364 | * to turn the feature off. | |
2b1ce38a | 1365 | */ |
984263bc | 1366 | if (DELAY_ACK(tp)) { |
a48c5dd5 SZ |
1367 | tcp_callout_reset(tp, tp->tt_delack, |
1368 | tcp_delacktime, tcp_timer_delack); | |
72b37eeb | 1369 | } else if (tcp_aggregate_acks) { |
984263bc | 1370 | tp->t_flags |= TF_ACKNOW; |
61896e3c | 1371 | if (!(tp->t_flags & TF_ONOUTPUTQ)) { |
2b1ce38a MD |
1372 | tp->t_flags |= TF_ONOUTPUTQ; |
1373 | tp->tt_cpu = mycpu->gd_cpuid; | |
1374 | TAILQ_INSERT_TAIL( | |
1375 | &tcpcbackq[tp->tt_cpu], | |
1376 | tp, t_outputq); | |
1377 | } | |
72b37eeb MD |
1378 | } else { |
1379 | tp->t_flags |= TF_ACKNOW; | |
1380 | tcp_output(tp); | |
984263bc | 1381 | } |
002c1265 | 1382 | return(IPPROTO_DONE); |
984263bc MD |
1383 | } |
1384 | } | |
1385 | ||
1386 | /* | |
1387 | * Calculate amount of space in receive window, | |
1388 | * and then do TCP input processing. | |
1389 | * Receive window is amount of space in rcv queue, | |
1390 | * but not less than advertised window. | |
1391 | */ | |
6d49aa6f | 1392 | recvwin = ssb_space(&so->so_rcv); |
61896e3c JH |
1393 | if (recvwin < 0) |
1394 | recvwin = 0; | |
1395 | tp->rcv_wnd = imax(recvwin, (int)(tp->rcv_adv - tp->rcv_nxt)); | |
984263bc | 1396 | |
5b0b9fa5 PA |
1397 | /* Reset receive buffer auto scaling when not in bulk receive mode. */ |
1398 | tp->rfbuf_ts = 0; | |
1399 | tp->rfbuf_cnt = 0; | |
1400 | ||
984263bc | 1401 | switch (tp->t_state) { |
984263bc MD |
1402 | /* |
1403 | * If the state is SYN_RECEIVED: | |
1404 | * if seg contains an ACK, but not for our SYN/ACK, send a RST. | |
1405 | */ | |
1406 | case TCPS_SYN_RECEIVED: | |
1407 | if ((thflags & TH_ACK) && | |
1408 | (SEQ_LEQ(th->th_ack, tp->snd_una) || | |
1409 | SEQ_GT(th->th_ack, tp->snd_max))) { | |
1410 | rstreason = BANDLIM_RST_OPENPORT; | |
1411 | goto dropwithreset; | |
1412 | } | |
1413 | break; | |
1414 | ||
1415 | /* | |
1416 | * If the state is SYN_SENT: | |
1417 | * if seg contains an ACK, but not for our SYN, drop the input. | |
1418 | * if seg contains a RST, then drop the connection. | |
1419 | * if seg does not contain SYN, then drop it. | |
1420 | * Otherwise this is an acceptable SYN segment | |
1421 | * initialize tp->rcv_nxt and tp->irs | |
1422 | * if seg contains ack then advance tp->snd_una | |
1423 | * if SYN has been acked change to ESTABLISHED else SYN_RCVD state | |
1424 | * arrange for segment to be acked (eventually) | |
1425 | * continue processing rest of data/controls, beginning with URG | |
1426 | */ | |
1427 | case TCPS_SYN_SENT: | |
984263bc MD |
1428 | if ((thflags & TH_ACK) && |
1429 | (SEQ_LEQ(th->th_ack, tp->iss) || | |
1430 | SEQ_GT(th->th_ack, tp->snd_max))) { | |
27b8aee3 AE |
1431 | rstreason = BANDLIM_UNLIMITED; |
1432 | goto dropwithreset; | |
984263bc MD |
1433 | } |
1434 | if (thflags & TH_RST) { | |
1435 | if (thflags & TH_ACK) | |
1436 | tp = tcp_drop(tp, ECONNREFUSED); | |
1437 | goto drop; | |
1438 | } | |
61896e3c | 1439 | if (!(thflags & TH_SYN)) |
984263bc MD |
1440 | goto drop; |
1441 | tp->snd_wnd = th->th_win; /* initial send window */ | |
984263bc MD |
1442 | |
1443 | tp->irs = th->th_seq; | |
1444 | tcp_rcvseqinit(tp); | |
1445 | if (thflags & TH_ACK) { | |
27b8aee3 | 1446 | /* Our SYN was acked. */ |
984263bc MD |
1447 | tcpstat.tcps_connects++; |
1448 | soisconnected(so); | |
1449 | /* Do window scaling on this connection? */ | |
61896e3c | 1450 | if ((tp->t_flags & (TF_RCVD_SCALE | TF_REQ_SCALE)) == |
b5572302 | 1451 | (TF_RCVD_SCALE | TF_REQ_SCALE)) { |
984263bc MD |
1452 | tp->snd_scale = tp->requested_s_scale; |
1453 | tp->rcv_scale = tp->request_r_scale; | |
1454 | } | |
984263bc MD |
1455 | tp->rcv_adv += tp->rcv_wnd; |
1456 | tp->snd_una++; /* SYN is acked */ | |
a48c5dd5 | 1457 | tcp_callout_stop(tp, tp->tt_rexmt); |
984263bc MD |
1458 | /* |
1459 | * If there's data, delay ACK; if there's also a FIN | |
1460 | * ACKNOW will be turned on later. | |
1461 | */ | |
a48c5dd5 SZ |
1462 | if (DELAY_ACK(tp) && tlen != 0) { |
1463 | tcp_callout_reset(tp, tp->tt_delack, | |
1464 | tcp_delacktime, tcp_timer_delack); | |
1465 | } else { | |
984263bc | 1466 | tp->t_flags |= TF_ACKNOW; |
a48c5dd5 | 1467 | } |
984263bc MD |
1468 | /* |
1469 | * Received <SYN,ACK> in SYN_SENT[*] state. | |
1470 | * Transitions: | |
1471 | * SYN_SENT --> ESTABLISHED | |
1472 | * SYN_SENT* --> FIN_WAIT_1 | |
1473 | */ | |
1474 | tp->t_starttime = ticks; | |
1475 | if (tp->t_flags & TF_NEEDFIN) { | |
1476 | tp->t_state = TCPS_FIN_WAIT_1; | |
1477 | tp->t_flags &= ~TF_NEEDFIN; | |
1478 | thflags &= ~TH_SYN; | |
1479 | } else { | |
8651f7f8 | 1480 | tcp_established(tp); |
984263bc MD |
1481 | } |
1482 | } else { | |
1483 | /* | |
95b22adf | 1484 | * Received initial SYN in SYN-SENT[*] state => |
27b8aee3 AE |
1485 | * simultaneous open. |
1486 | * Do 3-way handshake: | |
61896e3c JH |
1487 | * SYN-SENT -> SYN-RECEIVED |
1488 | * SYN-SENT* -> SYN-RECEIVED* | |
95b22adf | 1489 | */ |
984263bc | 1490 | tp->t_flags |= TF_ACKNOW; |
a48c5dd5 | 1491 | tcp_callout_stop(tp, tp->tt_rexmt); |
27b8aee3 | 1492 | tp->t_state = TCPS_SYN_RECEIVED; |
984263bc MD |
1493 | } |
1494 | ||
984263bc MD |
1495 | /* |
1496 | * Advance th->th_seq to correspond to first data byte. | |
1497 | * If data, trim to stay within window, | |
1498 | * dropping FIN if necessary. | |
1499 | */ | |
1500 | th->th_seq++; | |
1501 | if (tlen > tp->rcv_wnd) { | |
1502 | todrop = tlen - tp->rcv_wnd; | |
1503 | m_adj(m, -todrop); | |
1504 | tlen = tp->rcv_wnd; | |
1505 | thflags &= ~TH_FIN; | |
1506 | tcpstat.tcps_rcvpackafterwin++; | |
1507 | tcpstat.tcps_rcvbyteafterwin += todrop; | |
1508 | } | |
1509 | tp->snd_wl1 = th->th_seq - 1; | |
1510 | tp->rcv_up = th->th_seq; | |
1511 | /* | |
1512 | * Client side of transaction: already sent SYN and data. | |
1513 | * If the remote host used T/TCP to validate the SYN, | |
1514 | * our data will be ACK'd; if so, enter normal data segment | |
1515 | * processing in the middle of step 5, ack processing. | |
1516 | * Otherwise, goto step 6. | |
1517 | */ | |
95b22adf | 1518 | if (thflags & TH_ACK) |
984263bc MD |
1519 | goto process_ACK; |
1520 | ||
1521 | goto step6; | |
1522 | ||
1523 | /* | |
1524 | * If the state is LAST_ACK or CLOSING or TIME_WAIT: | |
27b8aee3 | 1525 | * do normal processing (we no longer bother with T/TCP). |
984263bc MD |
1526 | */ |
1527 | case TCPS_LAST_ACK: | |
1528 | case TCPS_CLOSING: | |
1529 | case TCPS_TIME_WAIT: | |
95b22adf | 1530 | break; /* continue normal processing */ |
984263bc MD |
1531 | } |
1532 | ||
1533 | /* | |
1534 | * States other than LISTEN or SYN_SENT. | |
1535 | * First check the RST flag and sequence number since reset segments | |
1536 | * are exempt from the timestamp and connection count tests. This | |
1537 | * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix | |
1538 | * below which allowed reset segments in half the sequence space | |
1539 | * to fall though and be processed (which gives forged reset | |
1540 | * segments with a random sequence number a 50 percent chance of | |
1541 | * killing a connection). | |
1542 | * Then check timestamp, if present. | |
1543 | * Then check the connection count, if present. | |
1544 | * Then check that at least some bytes of segment are within | |
1545 | * receive window. If segment begins before rcv_nxt, | |
1546 | * drop leading data (and SYN); if nothing left, just ack. | |
1547 | * | |
1548 | * | |
1549 | * If the RST bit is set, check the sequence number to see | |
1550 | * if this is a valid reset segment. | |
1551 | * RFC 793 page 37: | |
1552 | * In all states except SYN-SENT, all reset (RST) segments | |
1553 | * are validated by checking their SEQ-fields. A reset is | |
1554 | * valid if its sequence number is in the window. | |
1555 | * Note: this does not take into account delayed ACKs, so | |
1556 | * we should test against last_ack_sent instead of rcv_nxt. | |
1557 | * The sequence number in the reset segment is normally an | |
91489f6b | 1558 | * echo of our outgoing acknowledgement numbers, but some hosts |
984263bc MD |
1559 | * send a reset with the sequence number at the rightmost edge |
1560 | * of our receive window, and we have to handle this case. | |
1561 | * If we have multiple segments in flight, the intial reset | |
1562 | * segment sequence numbers will be to the left of last_ack_sent, | |
1563 | * but they will eventually catch up. | |
1564 | * In any case, it never made sense to trim reset segments to | |
1565 | * fit the receive window since RFC 1122 says: | |
1566 | * 4.2.2.12 RST Segment: RFC-793 Section 3.4 | |
1567 | * | |
1568 | * A TCP SHOULD allow a received RST segment to include data. | |
1569 | * | |
1570 | * DISCUSSION | |
61896e3c JH |
1571 | * It has been suggested that a RST segment could contain |
1572 | * ASCII text that encoded and explained the cause of the | |
91489f6b | 1573 | * RST. No standard has yet been established for such |
61896e3c | 1574 | * data. |
984263bc MD |
1575 | * |
1576 | * If the reset segment passes the sequence number test examine | |
1577 | * the state: | |
1578 | * SYN_RECEIVED STATE: | |
1579 | * If passive open, return to LISTEN state. | |
1580 | * If active open, inform user that connection was refused. | |
1581 | * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES: | |
1582 | * Inform user that connection was reset, and close tcb. | |
1583 | * CLOSING, LAST_ACK STATES: | |
1584 | * Close the tcb. | |
1585 | * TIME_WAIT STATE: | |
1586 | * Drop the segment - see Stevens, vol. 2, p. 964 and | |
61896e3c | 1587 | * RFC 1337. |
984263bc MD |
1588 | */ |
1589 | if (thflags & TH_RST) { | |
1590 | if (SEQ_GEQ(th->th_seq, tp->last_ack_sent) && | |
d4dbb5be | 1591 | SEQ_LEQ(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) { |
984263bc MD |
1592 | switch (tp->t_state) { |
1593 | ||
1594 | case TCPS_SYN_RECEIVED: | |
1595 | so->so_error = ECONNREFUSED; | |
1596 | goto close; | |
1597 | ||
1598 | case TCPS_ESTABLISHED: | |
1599 | case TCPS_FIN_WAIT_1: | |
1600 | case TCPS_FIN_WAIT_2: | |
1601 | case TCPS_CLOSE_WAIT: | |
1602 | so->so_error = ECONNRESET; | |
1603 | close: | |
1604 | tp->t_state = TCPS_CLOSED; | |
1605 | tcpstat.tcps_drops++; | |
1606 | tp = tcp_close(tp); | |
1607 | break; | |
1608 | ||
1609 | case TCPS_CLOSING: | |
1610 | case TCPS_LAST_ACK: | |
1611 | tp = tcp_close(tp); | |
1612 | break; | |
1613 | ||
1614 | case TCPS_TIME_WAIT: | |
1615 | break; | |
1616 | } | |
1617 | } | |
1618 | goto drop; | |
1619 | } | |
1620 | ||
1621 | /* | |
1622 | * RFC 1323 PAWS: If we have a timestamp reply on this segment | |
1623 | * and it's less than ts_recent, drop it. | |
1624 | */ | |
61896e3c | 1625 | if ((to.to_flags & TOF_TS) && tp->ts_recent != 0 && |
984263bc MD |
1626 | TSTMP_LT(to.to_tsval, tp->ts_recent)) { |
1627 | ||
1628 | /* Check to see if ts_recent is over 24 days old. */ | |
1629 | if ((int)(ticks - tp->ts_recent_age) > TCP_PAWS_IDLE) { | |
1630 | /* | |
1631 | * Invalidate ts_recent. If this segment updates | |
1632 | * ts_recent, the age will be reset later and ts_recent | |
1633 | * will get a valid value. If it does not, setting | |
1634 | * ts_recent to zero will at least satisfy the | |
1635 | * requirement that zero be placed in the timestamp | |
1636 | * echo reply when ts_recent isn't valid. The | |
1637 | * age isn't reset until we get a valid ts_recent | |
1638 | * because we don't want out-of-order segments to be | |
1639 | * dropped when ts_recent is old. | |
1640 | */ | |
1641 | tp->ts_recent = 0; | |
1642 | } else { | |
1643 | tcpstat.tcps_rcvduppack++; | |
1644 | tcpstat.tcps_rcvdupbyte += tlen; | |
1645 | tcpstat.tcps_pawsdrop++; | |
1646 | if (tlen) | |
1647 | goto dropafterack; | |
1648 | goto drop; | |
1649 | } | |
1650 | } | |
1651 | ||
984263bc MD |
1652 | /* |
1653 | * In the SYN-RECEIVED state, validate that the packet belongs to | |
1654 | * this connection before trimming the data to fit the receive | |
1655 | * window. Check the sequence number versus IRS since we know | |
1656 | * the sequence numbers haven't wrapped. This is a partial fix | |
1657 | * for the "LAND" DoS attack. | |
1658 | */ | |
1659 | if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) { | |
1660 | rstreason = BANDLIM_RST_OPENPORT; | |
1661 | goto dropwithreset; | |
1662 | } | |
1663 | ||
1664 | todrop = tp->rcv_nxt - th->th_seq; | |
1665 | if (todrop > 0) { | |
91489f6b JH |
1666 | if (TCP_DO_SACK(tp)) { |
1667 | /* Report duplicate segment at head of packet. */ | |
1668 | tp->reportblk.rblk_start = th->th_seq; | |
3a5d999b SZ |
1669 | tp->reportblk.rblk_end = TCP_SACK_BLKEND( |
1670 | th->th_seq + tlen, thflags); | |
91489f6b JH |
1671 | if (SEQ_GT(tp->reportblk.rblk_end, tp->rcv_nxt)) |
1672 | tp->reportblk.rblk_end = tp->rcv_nxt; | |
1673 | tp->t_flags |= (TF_DUPSEG | TF_SACKLEFT | TF_ACKNOW); | |
1674 | } | |
984263bc MD |
1675 | if (thflags & TH_SYN) { |
1676 | thflags &= ~TH_SYN; | |
1677 | th->th_seq++; | |
1678 | if (th->th_urp > 1) | |
1679 | th->th_urp--; | |
1680 | else | |
1681 | thflags &= ~TH_URG; | |
1682 | todrop--; | |
1683 | } | |
1684 | /* | |
1685 | * Following if statement from Stevens, vol. 2, p. 960. | |
1686 | */ | |
61896e3c JH |
1687 | if (todrop > tlen || |
1688 | (todrop == tlen && !(thflags & TH_FIN))) { | |
984263bc MD |
1689 | /* |
1690 | * Any valid FIN must be to the left of the window. | |
1691 | * At this point the FIN must be a duplicate or out | |
1692 | * of sequence; drop it. | |
1693 | */ | |
1694 | thflags &= ~TH_FIN; | |
1695 | ||
1696 | /* | |
1697 | * Send an ACK to resynchronize and drop any data. | |
1698 | * But keep on processing for RST or ACK. | |
1699 | */ | |
1700 | tp->t_flags |= TF_ACKNOW; | |
1701 | todrop = tlen; | |
1702 | tcpstat.tcps_rcvduppack++; | |
1703 | tcpstat.tcps_rcvdupbyte += todrop; | |
1704 | } else { | |
1705 | tcpstat.tcps_rcvpartduppack++; | |
1706 | tcpstat.tcps_rcvpartdupbyte += todrop; | |
1707 | } | |
1708 | drop_hdrlen += todrop; /* drop from the top afterwards */ | |
1709 | th->th_seq += todrop; | |
1710 | tlen -= todrop; | |
1711 | if (th->th_urp > todrop) | |
1712 | th->th_urp -= todrop; | |
1713 | else { | |
1714 | thflags &= ~TH_URG; | |
1715 | th->th_urp = 0; | |
1716 | } | |
1717 | } | |
1718 | ||
1719 | /* | |
1720 | * If new data are received on a connection after the | |
1721 | * user processes are gone, then RST the other end. | |
1722 | */ | |
1723 | if ((so->so_state & SS_NOFDREF) && | |
1724 | tp->t_state > TCPS_CLOSE_WAIT && tlen) { | |
1725 | tp = tcp_close(tp); | |
1726 | tcpstat.tcps_rcvafterclose++; | |
1727 | rstreason = BANDLIM_UNLIMITED; | |
1728 | goto dropwithreset; | |
1729 | } | |
1730 | ||
1731 | /* | |
1732 | * If segment ends after window, drop trailing data | |
1733 | * (and PUSH and FIN); if nothing left, just ACK. | |
1734 | */ | |
61896e3c | 1735 | todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd); |
984263bc MD |
1736 | if (todrop > 0) { |
1737 | tcpstat.tcps_rcvpackafterwin++; | |
1738 | if (todrop >= tlen) { | |
1739 | tcpstat.tcps_rcvbyteafterwin += tlen; | |
1740 | /* | |
1741 | * If a new connection request is received | |
1742 | * while in TIME_WAIT, drop the old connection | |
1743 | * and start over if the sequence numbers | |
1744 | * are above the previous ones. | |
1745 | */ | |
1746 | if (thflags & TH_SYN && | |
1747 | tp->t_state == TCPS_TIME_WAIT && | |
1748 | SEQ_GT(th->th_seq, tp->rcv_nxt)) { | |
1749 | tp = tcp_close(tp); | |
1750 | goto findpcb; | |
1751 | } | |
1752 | /* | |
1753 | * If window is closed can only take segments at | |
1754 | * window edge, and have to drop data and PUSH from | |
1755 | * incoming segments. Continue processing, but | |
1756 | * remember to ack. Otherwise, drop segment | |
1757 | * and ack. | |
1758 | */ | |
1759 | if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { | |
1760 | tp->t_flags |= TF_ACKNOW; | |
1761 | tcpstat.tcps_rcvwinprobe++; | |
1762 | } else | |
1763 | goto dropafterack; | |
1764 | } else | |
1765 | tcpstat.tcps_rcvbyteafterwin += todrop; | |
1766 | m_adj(m, -todrop); | |
1767 | tlen -= todrop; | |
61896e3c | 1768 | thflags &= ~(TH_PUSH | TH_FIN); |
984263bc MD |
1769 | } |
1770 | ||
1771 | /* | |
1772 | * If last ACK falls within this segment's sequence numbers, | |
1773 | * record its timestamp. | |
ad0af98b ND |
1774 | * NOTE: |
1775 | * 1) That the test incorporates suggestions from the latest | |
1776 | * proposal of the tcplw@cray.com list (Braden 1993/04/26). | |
1777 | * 2) That updating only on newer timestamps interferes with | |
1778 | * our earlier PAWS tests, so this check should be solely | |
1779 | * predicated on the sequence space of this segment. | |
1780 | * 3) That we modify the segment boundary check to be | |
1781 | * Last.ACK.Sent <= SEG.SEQ + SEG.LEN | |
1782 | * instead of RFC1323's | |
1783 | * Last.ACK.Sent < SEG.SEQ + SEG.LEN, | |
1784 | * This modified check allows us to overcome RFC1323's | |
1785 | * limitations as described in Stevens TCP/IP Illustrated | |
1786 | * Vol. 2 p.869. In such cases, we can still calculate the | |
1787 | * RTT correctly when RCV.NXT == Last.ACK.Sent. | |
984263bc | 1788 | */ |
ad0af98b ND |
1789 | if ((to.to_flags & TOF_TS) && SEQ_LEQ(th->th_seq, tp->last_ack_sent) && |
1790 | SEQ_LEQ(tp->last_ack_sent, (th->th_seq + tlen | |
1791 | + ((thflags & TH_SYN) != 0) | |
1792 | + ((thflags & TH_FIN) != 0)))) { | |
984263bc MD |
1793 | tp->ts_recent_age = ticks; |
1794 | tp->ts_recent = to.to_tsval; | |
1795 | } | |
1796 | ||
1797 | /* | |
1798 | * If a SYN is in the window, then this is an | |
1799 | * error and we send an RST and drop the connection. | |
1800 | */ | |
1801 | if (thflags & TH_SYN) { | |
1802 | tp = tcp_drop(tp, ECONNRESET); | |
1803 | rstreason = BANDLIM_UNLIMITED; | |
1804 | goto dropwithreset; | |
1805 | } | |
1806 | ||
1807 | /* | |
1808 | * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN | |
1809 | * flag is on (half-synchronized state), then queue data for | |
1810 | * later processing; else drop segment and return. | |
1811 | */ | |
61896e3c | 1812 | if (!(thflags & TH_ACK)) { |
984263bc MD |
1813 | if (tp->t_state == TCPS_SYN_RECEIVED || |
1814 | (tp->t_flags & TF_NEEDSYN)) | |
1815 | goto step6; | |
1816 | else | |
1817 | goto drop; | |
1818 | } | |
1819 | ||
1820 | /* | |
1821 | * Ack processing. | |
1822 | */ | |
1823 | switch (tp->t_state) { | |
984263bc | 1824 | /* |
91489f6b | 1825 | * In SYN_RECEIVED state, the ACK acknowledges our SYN, so enter |
984263bc MD |
1826 | * ESTABLISHED state and continue processing. |
1827 | * The ACK was checked above. | |
1828 | */ | |
1829 | case TCPS_SYN_RECEIVED: | |
1830 | ||
1831 | tcpstat.tcps_connects++; | |
1832 | soisconnected(so); | |
1833 | /* Do window scaling? */ | |
61896e3c | 1834 | if ((tp->t_flags & (TF_RCVD_SCALE | TF_REQ_SCALE)) == |
b5572302 | 1835 | (TF_RCVD_SCALE | TF_REQ_SCALE)) { |
984263bc MD |
1836 | tp->snd_scale = tp->requested_s_scale; |
1837 | tp->rcv_scale = tp->request_r_scale; | |
1838 | } | |
984263bc MD |
1839 | /* |
1840 | * Make transitions: | |
1841 | * SYN-RECEIVED -> ESTABLISHED | |
1842 | * SYN-RECEIVED* -> FIN-WAIT-1 | |
1843 | */ | |
1844 | tp->t_starttime = ticks; | |
1845 | if (tp->t_flags & TF_NEEDFIN) { | |
1846 | tp->t_state = TCPS_FIN_WAIT_1; | |
1847 | tp->t_flags &= ~TF_NEEDFIN; | |
1848 | } else { | |
8651f7f8 | 1849 | tcp_established(tp); |
984263bc MD |
1850 | } |
1851 | /* | |
1852 | * If segment contains data or ACK, will call tcp_reass() | |
1853 | * later; if not, do so now to pass queued data to user. | |
1854 | */ | |
61896e3c | 1855 | if (tlen == 0 && !(thflags & TH_FIN)) |
f23061d4 | 1856 | tcp_reass(tp, NULL, NULL, NULL); |
984263bc MD |
1857 | /* fall into ... */ |
1858 | ||
1859 | /* | |
1860 | * In ESTABLISHED state: drop duplicate ACKs; ACK out of range | |
1861 | * ACKs. If the ack is in the range | |
1862 | * tp->snd_una < th->th_ack <= tp->snd_max | |
1863 | * then advance tp->snd_una to th->th_ack and drop | |
1864 | * data from the retransmission queue. If this ACK reflects | |
1865 | * more up to date window information we update our window information. | |
1866 | */ | |
1867 | case TCPS_ESTABLISHED: | |
1868 | case TCPS_FIN_WAIT_1: | |
1869 | case TCPS_FIN_WAIT_2: | |
1870 | case TCPS_CLOSE_WAIT: | |
1871 | case TCPS_CLOSING: | |
1872 | case TCPS_LAST_ACK: | |
1873 | case TCPS_TIME_WAIT: | |
1874 | ||
1875 | if (SEQ_LEQ(th->th_ack, tp->snd_una)) { | |
91489f6b JH |
1876 | if (TCP_DO_SACK(tp)) |
1877 | tcp_sack_update_scoreboard(tp, &to); | |
95b22adf JH |
1878 | if (tlen != 0 || tiwin != tp->snd_wnd) { |
1879 | tp->t_dupacks = 0; | |
1880 | break; | |
1881 | } | |
1882 | tcpstat.tcps_rcvdupack++; | |
a48c5dd5 | 1883 | if (!tcp_callout_active(tp, tp->tt_rexmt) || |
91489f6b JH |
1884 | th->th_ack != tp->snd_una) { |
1885 | tp->t_dupacks = 0; | |
1886 | break; | |
1887 | } | |
95b22adf | 1888 | /* |
91489f6b | 1889 | * We have outstanding data (other than |
95b22adf JH |
1890 | * a window probe), this is a completely |
1891 | * duplicate ack (ie, window info didn't | |
1892 | * change), the ack is the biggest we've | |
1893 | * seen and we've seen exactly our rexmt | |
91489f6b | 1894 | * threshhold of them, so assume a packet |
95b22adf JH |
1895 | * has been dropped and retransmit it. |
1896 | * Kludge snd_nxt & the congestion | |
1897 | * window so we send only this one | |
1898 | * packet. | |
95b22adf | 1899 | */ |
91489f6b JH |
1900 | if (IN_FASTRECOVERY(tp)) { |
1901 | if (TCP_DO_SACK(tp)) { | |
1902 | /* No artifical cwnd inflation. */ | |
1903 | tcp_sack_rexmt(tp, th); | |
1904 | } else { | |
1905 | /* | |
1906 | * Dup acks mean that packets | |
1907 | * have left the network | |
1908 | * (they're now cached at the | |
1909 | * receiver) so bump cwnd by | |
1910 | * the amount in the receiver | |
1911 | * to keep a constant cwnd | |
1912 | * packets in the network. | |
1913 | */ | |
1914 | tp->snd_cwnd += tp->t_maxseg; | |
f23061d4 | 1915 | tcp_output(tp); |
91489f6b JH |
1916 | } |
1917 | } else if (SEQ_LT(th->th_ack, tp->snd_recover)) { | |
95b22adf JH |
1918 | tp->t_dupacks = 0; |
1919 | break; | |
95b22adf | 1920 | } else if (++tp->t_dupacks == tcprexmtthresh) { |
91489f6b | 1921 | tcp_seq old_snd_nxt; |
95b22adf JH |
1922 | u_int win; |
1923 | ||
8819433a | 1924 | fastretransmit: |
95b22adf JH |
1925 | if (tcp_do_eifel_detect && |
1926 | (tp->t_flags & TF_RCVD_TSTMP)) { | |
1927 | tcp_save_congestion_state(tp); | |
1928 | tp->t_flags |= TF_FASTREXMT; | |
1929 | } | |
91489f6b JH |
1930 | /* |
1931 | * We know we're losing at the current | |
1932 | * window size, so do congestion avoidance: | |
1933 | * set ssthresh to half the current window | |
1934 | * and pull our congestion window back to the | |
1935 | * new ssthresh. | |
1936 | */ | |
95b22adf JH |
1937 | win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / |
1938 | tp->t_maxseg; | |
1939 | if (win < 2) | |
1940 | win = 2; | |
1941 | tp->snd_ssthresh = win * tp->t_maxseg; | |
1942 | ENTER_FASTRECOVERY(tp); | |
1943 | tp->snd_recover = tp->snd_max; | |
a48c5dd5 | 1944 | tcp_callout_stop(tp, tp->tt_rexmt); |
95b22adf | 1945 | tp->t_rtttime = 0; |
91489f6b | 1946 | old_snd_nxt = tp->snd_nxt; |
95b22adf JH |
1947 | tp->snd_nxt = th->th_ack; |
1948 | tp->snd_cwnd = tp->t_maxseg; | |
f23061d4 | 1949 | tcp_output(tp); |
95b22adf | 1950 | ++tcpstat.tcps_sndfastrexmit; |
91489f6b JH |
1951 | tp->snd_cwnd = tp->snd_ssthresh; |
1952 | tp->rexmt_high = tp->snd_nxt; | |
1953 | if (SEQ_GT(old_snd_nxt, tp->snd_nxt)) | |
1954 | tp->snd_nxt = old_snd_nxt; | |
95b22adf JH |
1955 | KASSERT(tp->snd_limited <= 2, |
1956 | ("tp->snd_limited too big")); | |
91489f6b JH |
1957 | if (TCP_DO_SACK(tp)) |
1958 | tcp_sack_rexmt(tp, th); | |
1959 | else | |
1960 | tp->snd_cwnd += tp->t_maxseg * | |
1961 | (tp->t_dupacks - tp->snd_limited); | |
95b22adf JH |
1962 | } else if (tcp_do_limitedtransmit) { |
1963 | u_long oldcwnd = tp->snd_cwnd; | |
1964 | tcp_seq oldsndmax = tp->snd_max; | |
9e707f76 | 1965 | tcp_seq oldsndnxt = tp->snd_nxt; |
95b22adf JH |
1966 | /* outstanding data */ |
1967 | uint32_t ownd = tp->snd_max - tp->snd_una; | |
1968 | u_int sent; | |
ca94b4a6 | 1969 | |
8819433a JH |
1970 | #define iceildiv(n, d) (((n)+(d)-1) / (d)) |
1971 | ||
95b22adf JH |
1972 | KASSERT(tp->t_dupacks == 1 || |
1973 | tp->t_dupacks == 2, | |
1974 | ("dupacks not 1 or 2")); | |
1975 | if (tp->t_dupacks == 1) | |
1976 | tp->snd_limited = 0; | |
9e707f76 | 1977 | tp->snd_nxt = tp->snd_max; |
95b22adf JH |
1978 | tp->snd_cwnd = ownd + |
1979 | (tp->t_dupacks - tp->snd_limited) * | |
1980 | tp->t_maxseg; | |
f23061d4 | 1981 | tcp_output(tp); |
98cb2337 | 1982 | |
98cb2337 | 1983 | if (SEQ_LT(oldsndnxt, oldsndmax)) { |
31ea9b1e SZ |
1984 | KASSERT(SEQ_GEQ(oldsndnxt, tp->snd_una), |
1985 | ("snd_una moved in other threads")); | |
6d08465d | 1986 | tp->snd_nxt = oldsndnxt; |
98cb2337 | 1987 | } |
95b22adf JH |
1988 | tp->snd_cwnd = oldcwnd; |
1989 | sent = tp->snd_max - oldsndmax; | |
1990 | if (sent > tp->t_maxseg) { | |
1991 | KASSERT((tp->t_dupacks == 2 && | |
1992 | tp->snd_limited == 0) || | |
1993 | (sent == tp->t_maxseg + 1 && | |
1994 | tp->t_flags & TF_SENTFIN), | |
1995 | ("sent too much")); | |
1996 | KASSERT(sent <= tp->t_maxseg * 2, | |
1997 | ("sent too many segments")); | |
1998 | tp->snd_limited = 2; | |
1999 | tcpstat.tcps_sndlimited += 2; | |
2000 | } else if (sent > 0) { | |
2001 | ++tp->snd_limited; | |
2002 | ++tcpstat.tcps_sndlimited; | |
2003 | } else if (tcp_do_early_retransmit && | |
2004 | (tcp_do_eifel_detect && | |
2005 | (tp->t_flags & TF_RCVD_TSTMP)) && | |
91489f6b | 2006 | ownd < 4 * tp->t_maxseg && |
95b22adf | 2007 | tp->t_dupacks + 1 >= |
91489f6b JH |
2008 | iceildiv(ownd, tp->t_maxseg) && |
2009 | (!TCP_DO_SACK(tp) || | |
f23061d4 | 2010 | ownd <= tp->t_maxseg || |
91489f6b | 2011 | tcp_sack_has_sacked(&tp->scb, |
f23061d4 | 2012 | ownd - tp->t_maxseg))) { |
95b22adf JH |
2013 | ++tcpstat.tcps_sndearlyrexmit; |
2014 | tp->t_flags |= TF_EARLYREXMT; | |
2015 | goto fastretransmit; | |
984263bc | 2016 | } |
95b22adf JH |
2017 | } |
2018 | goto drop; | |
984263bc MD |
2019 | } |
2020 | ||
2021 | KASSERT(SEQ_GT(th->th_ack, tp->snd_una), ("th_ack <= snd_una")); | |
984263bc MD |
2022 | tp->t_dupacks = 0; |
2023 | if (SEQ_GT(th->th_ack, tp->snd_max)) { | |
5a274421 JH |
2024 | /* |
2025 | * Detected optimistic ACK attack. | |
2026 | * Force slow-start to de-synchronize attack. | |
2027 | */ | |
2028 | tp->snd_cwnd = tp->t_maxseg; | |
8acdb67c | 2029 | tp->snd_wacked = 0; |
5a274421 | 2030 | |
984263bc MD |
2031 | tcpstat.tcps_rcvacktoomuch++; |
2032 | goto dropafterack; | |
2033 | } | |
2034 | /* | |
2035 | * If we reach this point, ACK is not a duplicate, | |
2036 | * i.e., it ACKs something we sent. | |
2037 | */ | |
2038 | if (tp->t_flags & TF_NEEDSYN) { | |
2039 | /* | |
2040 | * T/TCP: Connection was half-synchronized, and our | |
2041 | * SYN has been ACK'd (so connection is now fully | |
2042 | * synchronized). Go to non-starred state, | |
2043 | * increment snd_una for ACK of SYN, and check if | |
2044 | * we can do window scaling. | |
2045 | */ | |
2046 | tp->t_flags &= ~TF_NEEDSYN; | |
2047 | tp->snd_una++; | |
2048 | /* Do window scaling? */ | |
61896e3c JH |
2049 | if ((tp->t_flags & (TF_RCVD_SCALE | TF_REQ_SCALE)) == |
2050 | (TF_RCVD_SCALE | TF_REQ_SCALE)) { | |
984263bc MD |
2051 | tp->snd_scale = tp->requested_s_scale; |
2052 | tp->rcv_scale = tp->request_r_scale; | |
2053 | } | |
2054 | } | |
2055 | ||
2056 | process_ACK: | |
2057 | acked = th->th_ack - tp->snd_una; | |
2058 | tcpstat.tcps_rcvackpack++; | |
2059 | tcpstat.tcps_rcvackbyte += acked; | |
2060 | ||
b5572302 | 2061 | if (tcp_do_eifel_detect && acked > 0 && |
95b22adf | 2062 | (to.to_flags & TOF_TS) && (to.to_tsecr != 0) && |
bfdb979e JH |
2063 | (tp->t_flags & TF_FIRSTACCACK)) { |
2064 | /* Eifel detection applicable. */ | |
2065 | if (to.to_tsecr < tp->t_rexmtTS) { | |
bfdb979e | 2066 | ++tcpstat.tcps_eifeldetected; |
8819433a | 2067 | tcp_revert_congestion_state(tp); |
928c3291 | 2068 | if (tp->t_rxtshift != 1 || |
8819433a JH |
2069 | ticks >= tp->t_badrxtwin) |
2070 | ++tcpstat.tcps_rttcantdetect; | |
bfdb979e JH |
2071 | } |
2072 | } else if (tp->t_rxtshift == 1 && ticks < tp->t_badrxtwin) { | |
b5572302 JH |
2073 | /* |
2074 | * If we just performed our first retransmit, | |
2075 | * and the ACK arrives within our recovery window, | |
2076 | * then it was a mistake to do the retransmit | |
91489f6b | 2077 | * in the first place. Recover our original cwnd |
b5572302 JH |
2078 | * and ssthresh, and proceed to transmit where we |
2079 | * left off. | |
2080 | */ | |
bfdb979e JH |
2081 | tcp_revert_congestion_state(tp); |
2082 | ++tcpstat.tcps_rttdetected; | |
984263bc MD |
2083 | } |
2084 | ||
2085 | /* | |
2086 | * If we have a timestamp reply, update smoothed | |
2087 | * round trip time. If no timestamp is present but | |
2088 | * transmit timer is running and timed sequence | |
2089 | * number was acked, update smoothed round trip time. | |
2090 | * Since we now have an rtt measurement, cancel the | |
2091 | * timer backoff (cf., Phil Karn's retransmit alg.). | |
2092 | * Recompute the initial retransmit timer. | |
2093 | * | |
2094 | * Some machines (certain windows boxes) send broken | |
d24ce1dc | 2095 | * timestamp replies during the SYN+ACK phase, ignore |
984263bc MD |
2096 | * timestamps of 0. |
2097 | */ | |
95b22adf | 2098 | if ((to.to_flags & TOF_TS) && (to.to_tsecr != 0)) |
984263bc | 2099 | tcp_xmit_timer(tp, ticks - to.to_tsecr + 1); |
95b22adf | 2100 | else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq)) |
984263bc | 2101 | tcp_xmit_timer(tp, ticks - tp->t_rtttime); |
984263bc MD |
2102 | tcp_xmit_bandwidth_limit(tp, th->th_ack); |
2103 | ||
984263bc MD |
2104 | /* |
2105 | * If no data (only SYN) was ACK'd, | |
2106 | * skip rest of ACK processing. | |
2107 | */ | |
2108 | if (acked == 0) | |
2109 | goto step6; | |
2110 | ||
efd4b327 | 2111 | /* Stop looking for an acceptable ACK since one was received. */ |
8819433a | 2112 | tp->t_flags &= ~(TF_FIRSTACCACK | TF_FASTREXMT | TF_EARLYREXMT); |
efd4b327 | 2113 | |
6d49aa6f MD |
2114 | if (acked > so->so_snd.ssb_cc) { |
2115 | tp->snd_wnd -= so->so_snd.ssb_cc; | |
2116 | sbdrop(&so->so_snd.sb, (int)so->so_snd.ssb_cc); | |
61896e3c | 2117 | ourfinisacked = TRUE; |
984263bc | 2118 | } else { |
6d49aa6f | 2119 | sbdrop(&so->so_snd.sb, acked); |
984263bc | 2120 | tp->snd_wnd -= acked; |
61896e3c | 2121 | ourfinisacked = FALSE; |
984263bc MD |
2122 | } |
2123 | sowwakeup(so); | |
91489f6b JH |
2124 | |
2125 | /* | |
2126 | * Update window information. | |
91489f6b | 2127 | */ |
e126661b | 2128 | if (acceptable_window_update(tp, th, tiwin)) { |
91489f6b JH |
2129 | /* keep track of pure window updates */ |
2130 | if (tlen == 0 && tp->snd_wl2 == th->th_ack && | |
2131 | tiwin > tp->snd_wnd) | |
2132 | tcpstat.tcps_rcvwinupd++; | |
2133 | tp->snd_wnd = tiwin; | |
2134 | tp->snd_wl1 = th->th_seq; | |
2135 | tp->snd_wl2 = th->th_ack; | |
2136 | if (tp->snd_wnd > tp->max_sndwnd) | |
2137 | tp->max_sndwnd = tp->snd_wnd; | |
2138 | needoutput = TRUE; | |
2139 | } | |
2140 | ||
2141 | tp->snd_una = th->th_ack; | |
2142 | if (TCP_DO_SACK(tp)) | |
2143 | tcp_sack_update_scoreboard(tp, &to); | |
95b22adf | 2144 | if (IN_FASTRECOVERY(tp)) { |
91489f6b | 2145 | if (SEQ_GEQ(th->th_ack, tp->snd_recover)) { |
95b22adf | 2146 | EXIT_FASTRECOVERY(tp); |
91489f6b JH |
2147 | needoutput = TRUE; |
2148 | /* | |
2149 | * If the congestion window was inflated | |
2150 | * to account for the other side's | |
2151 | * cached packets, retract it. | |
8acdb67c JH |
2152 | */ |
2153 | if (!TCP_DO_SACK(tp)) | |
2154 | tp->snd_cwnd = tp->snd_ssthresh; | |
2155 | ||
2156 | /* | |
91489f6b JH |
2157 | * Window inflation should have left us |
2158 | * with approximately snd_ssthresh outstanding | |
2159 | * data. But, in case we would be inclined | |
2160 | * to send a burst, better do it using | |
2161 | * slow start. | |
2162 | */ | |
91489f6b JH |
2163 | if (SEQ_GT(th->th_ack + tp->snd_cwnd, |
2164 | tp->snd_max + 2 * tp->t_maxseg)) | |
2165 | tp->snd_cwnd = | |
2166 | (tp->snd_max - tp->snd_una) + | |
2167 | 2 * tp->t_maxseg; | |
8acdb67c JH |
2168 | |
2169 | tp->snd_wacked = 0; | |
91489f6b JH |
2170 | } else { |
2171 | if (TCP_DO_SACK(tp)) { | |
2172 | tp->snd_max_rexmt = tp->snd_max; | |
2173 | tcp_sack_rexmt(tp, th); | |
2174 | } else { | |
2175 | tcp_newreno_partial_ack(tp, th, acked); | |
2176 | } | |
2177 | needoutput = FALSE; | |
2178 | } | |
95b22adf | 2179 | } else { |
91489f6b | 2180 | /* |
8acdb67c JH |
2181 | * Open the congestion window. When in slow-start, |
2182 | * open exponentially: maxseg per packet. Otherwise, | |
2183 | * open linearly: maxseg per window. | |
91489f6b | 2184 | */ |
8acdb67c JH |
2185 | if (tp->snd_cwnd <= tp->snd_ssthresh) { |
2186 | u_int abc_sslimit = | |
2187 | (SEQ_LT(tp->snd_nxt, tp->snd_max) ? | |
2188 | tp->t_maxseg : 2 * tp->t_maxseg); | |
2189 | ||
2190 | /* slow-start */ | |
2191 | tp->snd_cwnd += tcp_do_abc ? | |
2192 | min(acked, abc_sslimit) : tp->t_maxseg; | |
2193 | } else { | |
2194 | /* linear increase */ | |
2195 | tp->snd_wacked += tcp_do_abc ? acked : | |
2196 | tp->t_maxseg; | |
2197 | if (tp->snd_wacked >= tp->snd_cwnd) { | |
2198 | tp->snd_wacked -= tp->snd_cwnd; | |
2199 | tp->snd_cwnd += tp->t_maxseg; | |
2200 | } | |
2201 | } | |
2202 | tp->snd_cwnd = min(tp->snd_cwnd, | |
2203 | TCP_MAXWIN << tp->snd_scale); | |
95b22adf | 2204 | tp->snd_recover = th->th_ack - 1; |
cfb3f3f4 | 2205 | } |
984263bc MD |
2206 | if (SEQ_LT(tp->snd_nxt, tp->snd_una)) |
2207 | tp->snd_nxt = tp->snd_una; | |
2208 | ||
91489f6b JH |
2209 | /* |
2210 | * If all outstanding data is acked, stop retransmit | |
2211 | * timer and remember to restart (more output or persist). | |
2212 | * If there is more data to be acked, restart retransmit | |
2213 | * timer, using current (possibly backed-off) value. | |
2214 | */ | |
2215 | if (th->th_ack == tp->snd_max) { | |
a48c5dd5 | 2216 | tcp_callout_stop(tp, tp->tt_rexmt); |
91489f6b | 2217 | needoutput = TRUE; |
a48c5dd5 SZ |
2218 | } else if (!tcp_callout_active(tp, tp->tt_persist)) { |
2219 | tcp_callout_reset(tp, tp->tt_rexmt, tp->t_rxtcur, | |
2220 | tcp_timer_rexmt); | |
2221 | } | |
91489f6b | 2222 | |
984263bc | 2223 | switch (tp->t_state) { |
984263bc MD |
2224 | /* |
2225 | * In FIN_WAIT_1 STATE in addition to the processing | |
2226 | * for the ESTABLISHED state if our FIN is now acknowledged | |
2227 | * then enter FIN_WAIT_2. | |
2228 | */ | |
2229 | case TCPS_FIN_WAIT_1: | |
2230 | if (ourfinisacked) { | |
2231 | /* | |
2232 | * If we can't receive any more | |
2233 | * data, then closing user can proceed. | |
2234 | * Starting the timer is contrary to the | |
2235 | * specification, but if we don't get a FIN | |
2236 | * we'll hang forever. | |
2237 | */ | |
2238 | if (so->so_state & SS_CANTRCVMORE) { | |
2239 | soisdisconnected(so); | |
a48c5dd5 | 2240 | tcp_callout_reset(tp, tp->tt_2msl, |
5d61ded3 | 2241 | tp->t_maxidle, tcp_timer_2msl); |
984263bc MD |
2242 | } |
2243 | tp->t_state = TCPS_FIN_WAIT_2; | |
2244 | } | |
2245 | break; | |
2246 | ||
95b22adf | 2247 | /* |
984263bc MD |
2248 | * In CLOSING STATE in addition to the processing for |
2249 | * the ESTABLISHED state if the ACK acknowledges our FIN | |
2250 | * then enter the TIME-WAIT state, otherwise ignore | |
2251 | * the segment. | |
2252 | */ | |
2253 | case TCPS_CLOSING: | |
2254 | if (ourfinisacked) { | |
2255 | tp->t_state = TCPS_TIME_WAIT; | |
2256 | tcp_canceltimers(tp); | |
27b8aee3 | 2257 | tcp_callout_reset(tp, tp->tt_2msl, |
01d3427a SZ |
2258 | 2 * tcp_rmx_msl(tp), |
2259 | tcp_timer_2msl); | |
984263bc MD |
2260 | soisdisconnected(so); |
2261 | } | |
2262 | break; | |
2263 | ||
2264 | /* | |
2265 | * In LAST_ACK, we may still be waiting for data to drain | |
2266 | * and/or to be acked, as well as for the ack of our FIN. | |
2267 | * If our FIN is now acknowledged, delete the TCB, | |
2268 | * enter the closed state and return. | |
2269 | */ | |
2270 | case TCPS_LAST_ACK: | |
2271 | if (ourfinisacked) { | |
2272 | tp = tcp_close(tp); | |
2273 | goto drop; | |
2274 | } | |
2275 | break; | |
2276 | ||
2277 | /* | |
2278 | * In TIME_WAIT state the only thing that should arrive | |
2279 | * is a retransmission of the remote FIN. Acknowledge | |
2280 | * it and restart the finack timer. | |
2281 | */ | |
2282 | case TCPS_TIME_WAIT: | |
01d3427a | 2283 | tcp_callout_reset(tp, tp->tt_2msl, 2 * tcp_rmx_msl(tp), |
a48c5dd5 | 2284 | tcp_timer_2msl); |
984263bc MD |
2285 | goto dropafterack; |
2286 | } | |
2287 | } | |
2288 | ||
2289 | step6: | |
2290 | /* | |
2291 | * Update window information. | |
2292 | * Don't look at window if no ACK: TAC's send garbage on first SYN. | |
2293 | */ | |
2294 | if ((thflags & TH_ACK) && | |
df9d7670 | 2295 | acceptable_window_update(tp, th, tiwin)) { |
984263bc | 2296 | /* keep track of pure window updates */ |
b5572302 JH |
2297 | if (tlen == 0 && tp->snd_wl2 == th->th_ack && |
2298 | tiwin > tp->snd_wnd) | |
984263bc MD |
2299 | tcpstat.tcps_rcvwinupd++; |
2300 | tp->snd_wnd = tiwin; | |
2301 | tp->snd_wl1 = th->th_seq; | |
2302 | tp->snd_wl2 = th->th_ack; | |
2303 | if (tp->snd_wnd > tp->max_sndwnd) | |
2304 | tp->max_sndwnd = tp->snd_wnd; | |
61896e3c | 2305 | needoutput = TRUE; |
984263bc MD |
2306 | } |
2307 | ||
2308 | /* | |
2309 | * Process segments with URG. | |
2310 | */ | |
2311 | if ((thflags & TH_URG) && th->th_urp && | |
95b22adf | 2312 | !TCPS_HAVERCVDFIN(tp->t_state)) { |
984263bc MD |
2313 | /* |
2314 | * This is a kludge, but if we receive and accept | |
2315 | * random urgent pointers, we'll crash in | |
2316 | * soreceive. It's hard to imagine someone | |
2317 | * actually wanting to send this much urgent data. | |
2318 | */ | |
6d49aa6f | 2319 | if (th->th_urp + so->so_rcv.ssb_cc > sb_max) { |
984263bc MD |
2320 | th->th_urp = 0; /* XXX */ |
2321 | thflags &= ~TH_URG; /* XXX */ | |
2322 | goto dodata; /* XXX */ | |
2323 | } | |
2324 | /* | |
2325 | * If this segment advances the known urgent pointer, | |
2326 | * then mark the data stream. This should not happen | |
2327 | * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since | |
2328 | * a FIN has been received from the remote side. | |
2329 | * In these states we ignore the URG. | |
2330 | * | |
2331 | * According to RFC961 (Assigned Protocols), | |
2332 | * the urgent pointer points to the last octet | |
2333 | * of urgent data. We continue, however, | |
2334 | * to consider it to indicate the first octet | |
2335 | * of data past the urgent section as the original | |
2336 | * spec states (in one of two places). | |
2337 | */ | |
61896e3c | 2338 | if (SEQ_GT(th->th_seq + th->th_urp, tp->rcv_up)) { |
984263bc | 2339 | tp->rcv_up = th->th_seq + th->th_urp; |
6d49aa6f | 2340 | so->so_oobmark = so->so_rcv.ssb_cc + |
984263bc MD |
2341 | (tp->rcv_up - tp->rcv_nxt) - 1; |
2342 | if (so->so_oobmark == 0) | |
6cef7136 | 2343 | sosetstate(so, SS_RCVATMARK); |
984263bc MD |
2344 | sohasoutofband(so); |
2345 | tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); | |
2346 | } | |
2347 | /* | |
2348 | * Remove out of band data so doesn't get presented to user. | |
2349 | * This can happen independent of advancing the URG pointer, | |
2350 | * but if two URG's are pending at once, some out-of-band | |
2351 | * data may creep in... ick. | |
2352 | */ | |
61896e3c JH |
2353 | if (th->th_urp <= (u_long)tlen && |
2354 | !(so->so_options & SO_OOBINLINE)) { | |
2355 | /* hdr drop is delayed */ | |
2356 | tcp_pulloutofband(so, th, m, drop_hdrlen); | |
2357 | } | |
984263bc MD |
2358 | } else { |
2359 | /* | |
2360 | * If no out of band data is expected, | |
2361 | * pull receive urgent pointer along | |
2362 | * with the receive window. | |
2363 | */ | |
2364 | if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) | |
2365 | tp->rcv_up = tp->rcv_nxt; | |
2366 | } | |
984263bc | 2367 | |
61896e3c | 2368 | dodata: /* XXX */ |
984263bc MD |
2369 | /* |
2370 | * Process the segment text, merging it into the TCP sequencing queue, | |
2371 | * and arranging for acknowledgment of receipt if necessary. | |
2372 | * This process logically involves adjusting tp->rcv_wnd as data | |
2373 | * is presented to the user (this happens in tcp_usrreq.c, | |
2374 | * case PRU_RCVD). If a FIN has already been received on this | |
2375 | * connection then we just ignore the text. | |
2376 | */ | |
95b22adf | 2377 | if ((tlen || (thflags & TH_FIN)) && !TCPS_HAVERCVDFIN(tp->t_state)) { |
984263bc MD |
2378 | m_adj(m, drop_hdrlen); /* delayed header drop */ |
2379 | /* | |
2380 | * Insert segment which includes th into TCP reassembly queue | |
2381 | * with control block tp. Set thflags to whether reassembly now | |
2382 | * includes a segment with FIN. This handles the common case | |
2383 | * inline (segment is the next to be received on an established | |
2384 | * connection, and the queue is empty), avoiding linkage into | |
2385 | * and removal from the queue and repetition of various | |
2386 | * conversions. | |
2387 | * Set DELACK for segments received in order, but ack | |
2388 | * immediately when segments are out of order (so | |
2389 | * fast retransmit can work). | |
2390 | */ | |
2391 | if (th->th_seq == tp->rcv_nxt && | |
2392 | LIST_EMPTY(&tp->t_segq) && | |
2393 | TCPS_HAVEESTABLISHED(tp->t_state)) { | |
a48c5dd5 SZ |
2394 | if (DELAY_ACK(tp)) { |
2395 | tcp_callout_reset(tp, tp->tt_delack, | |
2396 | tcp_delacktime, tcp_timer_delack); | |
2397 | } else { | |
984263bc | 2398 | tp->t_flags |= TF_ACKNOW; |
a48c5dd5 | 2399 | } |
984263bc MD |
2400 | tp->rcv_nxt += tlen; |
2401 | thflags = th->th_flags & TH_FIN; | |
2402 | tcpstat.tcps_rcvpack++; | |
2403 | tcpstat.tcps_rcvbyte += tlen; | |
2404 | ND6_HINT(tp); | |
6cef7136 | 2405 | if (so->so_state & SS_CANTRCVMORE) { |
984263bc | 2406 | m_freem(m); |
6cef7136 MD |
2407 | } else { |
2408 | lwkt_gettoken(&so->so_rcv.ssb_token); | |
6d49aa6f | 2409 | ssb_appendstream(&so->so_rcv, m); |
6cef7136 MD |
2410 | lwkt_reltoken(&so->so_rcv.ssb_token); |
2411 | } | |
984263bc MD |
2412 | sorwakeup(so); |
2413 | } else { | |
91489f6b JH |
2414 | if (!(tp->t_flags & TF_DUPSEG)) { |
2415 | /* Initialize SACK report block. */ | |
2416 | tp->reportblk.rblk_start = th->th_seq; | |
3a5d999b SZ |
2417 | tp->reportblk.rblk_end = TCP_SACK_BLKEND( |
2418 | th->th_seq + tlen, thflags); | |
91489f6b | 2419 | } |
984263bc MD |
2420 | thflags = tcp_reass(tp, th, &tlen, m); |
2421 | tp->t_flags |= TF_ACKNOW; | |
2422 | } | |
2423 | ||
2424 | /* | |
2425 | * Note the amount of data that peer has sent into | |
2426 | * our window, in order to estimate the sender's | |
2427 | * buffer size. | |
2428 | */ | |
6d49aa6f | 2429 | len = so->so_rcv.ssb_hiwat - (tp->rcv_adv - tp->rcv_nxt); |
984263bc MD |
2430 | } else { |
2431 | m_freem(m); | |
2432 | thflags &= ~TH_FIN; | |
2433 | } | |
2434 | ||
2435 | /* | |
2436 | * If FIN is received ACK the FIN and let the user know | |
2437 | * that the connection is closing. | |
2438 | */ | |
2439 | if (thflags & TH_FIN) { | |
95b22adf | 2440 | if (!TCPS_HAVERCVDFIN(tp->t_state)) { |
984263bc MD |
2441 | socantrcvmore(so); |
2442 | /* | |
2443 | * If connection is half-synchronized | |
2444 | * (ie NEEDSYN flag on) then delay ACK, | |
2445 | * so it may be piggybacked when SYN is sent. | |
2446 | * Otherwise, since we received a FIN then no | |
2447 | * more input can be expected, send ACK now. | |
2448 | */ | |
a48c5dd5 SZ |
2449 | if (DELAY_ACK(tp) && (tp->t_flags & TF_NEEDSYN)) { |
2450 | tcp_callout_reset(tp, tp->tt_delack, | |
2451 | tcp_delacktime, tcp_timer_delack); | |
2452 | } else { | |
984263bc | 2453 | tp->t_flags |= TF_ACKNOW; |
a48c5dd5 | 2454 | } |
984263bc MD |
2455 | tp->rcv_nxt++; |
2456 | } | |
984263bc | 2457 | |
61896e3c | 2458 | switch (tp->t_state) { |
95b22adf | 2459 | /* |
984263bc MD |
2460 | * In SYN_RECEIVED and ESTABLISHED STATES |
2461 | * enter the CLOSE_WAIT state. | |
2462 | */ | |
2463 | case TCPS_SYN_RECEIVED: | |
2464 | tp->t_starttime = ticks; | |
2465 | /*FALLTHROUGH*/ | |
2466 | case TCPS_ESTABLISHED: | |
2467 | tp->t_state = TCPS_CLOSE_WAIT; | |
2468 | break; | |
2469 | ||
95b22adf | 2470 | /* |
984263bc MD |
2471 | * If still in FIN_WAIT_1 STATE FIN has not been acked so |
2472 | * enter the CLOSING state. | |
2473 | */ | |
2474 | case TCPS_FIN_WAIT_1: | |
2475 | tp->t_state = TCPS_CLOSING; | |
2476 | break; | |
2477 | ||
95b22adf | 2478 | /* |
984263bc MD |
2479 | * In FIN_WAIT_2 state enter the TIME_WAIT state, |
2480 | * starting the time-wait timer, turning off the other | |
2481 | * standard timers. | |
2482 | */ | |
2483 | case TCPS_FIN_WAIT_2: | |
2484 | tp->t_state = TCPS_TIME_WAIT; | |
2485 | tcp_canceltimers(tp); | |
01d3427a | 2486 | tcp_callout_reset(tp, tp->tt_2msl, 2 * tcp_rmx_msl(tp), |
a48c5dd5 | 2487 | tcp_timer_2msl); |
984263bc MD |
2488 | soisdisconnected(so); |
2489 | break; | |
2490 | ||
2491 | /* | |
2492 | * In TIME_WAIT state restart the 2 MSL time_wait timer. | |
2493 | */ | |
2494 | case TCPS_TIME_WAIT: | |
01d3427a | 2495 | tcp_callout_reset(tp, tp->tt_2msl, 2 * tcp_rmx_msl(tp), |
a48c5dd5 | 2496 | tcp_timer_2msl); |
984263bc MD |
2497 | break; |
2498 | } | |
2499 | } | |
61896e3c | 2500 | |
984263bc MD |
2501 | #ifdef TCPDEBUG |
2502 | if (so->so_options & SO_DEBUG) | |
f23061d4 | 2503 | tcp_trace(TA_INPUT, ostate, tp, tcp_saveipgen, &tcp_savetcp, 0); |
984263bc MD |
2504 | #endif |
2505 | ||
2506 | /* | |
2507 | * Return any desired output. | |
2508 | */ | |
2509 | if (needoutput || (tp->t_flags & TF_ACKNOW)) | |
f23061d4 | 2510 | tcp_output(tp); |
d58ca578 | 2511 | tcp_sack_report_cleanup(tp); |
002c1265 | 2512 | return(IPPROTO_DONE); |
984263bc MD |
2513 | |
2514 | dropafterack: | |
2515 | /* | |
2516 | * Generate an ACK dropping incoming segment if it occupies | |
2517 | * sequence space, where the ACK reflects our state. | |
2518 | * | |
2519 | * We can now skip the test for the RST flag since all | |
2520 | * paths to this code happen after packets containing | |
2521 | * RST have been dropped. | |
2522 | * | |
2523 | * In the SYN-RECEIVED state, don't send an ACK unless the | |
2524 | * segment we received passes the SYN-RECEIVED ACK test. | |
2525 | * If it fails send a RST. This breaks the loop in the | |
2526 | * "LAND" DoS attack, and also prevents an ACK storm | |
2527 | * between two listening ports that have been sent forged | |
2528 | * SYN segments, each with the source address of the other. | |
2529 | */ | |
2530 | if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) && | |
2531 | (SEQ_GT(tp->snd_una, th->th_ack) || | |
2532 | SEQ_GT(th->th_ack, tp->snd_max)) ) { | |
2533 | rstreason = BANDLIM_RST_OPENPORT; | |
2534 | goto dropwithreset; | |
2535 | } | |
2536 | #ifdef TCPDEBUG | |
2537 | if (so->so_options & SO_DEBUG) | |
f23061d4 | 2538 | tcp_trace(TA_DROP, ostate, tp, tcp_saveipgen, &tcp_savetcp, 0); |
984263bc MD |
2539 | #endif |
2540 | m_freem(m); | |
2541 | tp->t_flags |= TF_ACKNOW; | |
f23061d4 | 2542 | tcp_output(tp); |
d58ca578 | 2543 | tcp_sack_report_cleanup(tp); |
002c1265 | 2544 | return(IPPROTO_DONE); |
984263bc MD |
2545 | |
2546 | dropwithreset: | |
2547 | /* | |
2548 | * Generate a RST, dropping incoming segment. | |
2549 | * Make ACK acceptable to originator of segment. | |
2550 | * Don't bother to respond if destination was broadcast/multicast. | |
2551 | */ | |
61896e3c | 2552 | if ((thflags & TH_RST) || m->m_flags & (M_BCAST | M_MCAST)) |
984263bc MD |
2553 | goto drop; |
2554 | if (isipv6) { | |
2555 | if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || | |
2556 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) | |
2557 | goto drop; | |
2558 | } else { | |
2559 | if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || | |
2560 | IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || | |
95b22adf JH |
2561 | ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || |
2562 | in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) | |
984263bc MD |
2563 | goto drop; |
2564 | } | |
2565 | /* IPv6 anycast check is done at tcp6_input() */ | |
2566 | ||
2567 | /* | |
2568 | * Perform bandwidth limiting. | |
2569 | */ | |
2570 | #ifdef ICMP_BANDLIM | |
2571 | if (badport_bandlim(rstreason) < 0) | |
2572 | goto drop; | |
2573 | #endif | |
2574 | ||
2575 | #ifdef TCPDEBUG | |
2576 | if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) | |
f23061d4 | 2577 | tcp_trace(TA_DROP, ostate, tp, tcp_saveipgen, &tcp_savetcp, 0); |
984263bc MD |
2578 | #endif |
2579 | if (thflags & TH_ACK) | |
2580 | /* mtod() below is safe as long as hdr dropping is delayed */ | |
2581 | tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack, | |
2582 | TH_RST); | |
2583 | else { | |
2584 | if (thflags & TH_SYN) | |
2585 | tlen++; | |
2586 | /* mtod() below is safe as long as hdr dropping is delayed */ | |
61896e3c JH |
2587 | tcp_respond(tp, mtod(m, void *), th, m, th->th_seq + tlen, |
2588 | (tcp_seq)0, TH_RST | TH_ACK); | |
984263bc | 2589 | } |
d58ca578 SZ |
2590 | if (tp != NULL) |
2591 | tcp_sack_report_cleanup(tp); | |
002c1265 | 2592 | return(IPPROTO_DONE); |
984263bc MD |
2593 | |
2594 | drop: | |
2595 | /* | |
2596 | * Drop space held by incoming segment and return. | |
2597 | */ | |
2598 | #ifdef TCPDEBUG | |
2599 | if (tp == NULL || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) | |
f23061d4 | 2600 | tcp_trace(TA_DROP, ostate, tp, tcp_saveipgen, &tcp_savetcp, 0); |
984263bc MD |
2601 | #endif |
2602 | m_freem(m); | |
d58ca578 SZ |
2603 | if (tp != NULL) |
2604 | tcp_sack_report_cleanup(tp); | |
002c1265 | 2605 | return(IPPROTO_DONE); |
984263bc MD |
2606 | } |
2607 | ||
2608 | /* | |
2609 | * Parse TCP options and place in tcpopt. | |
2610 | */ | |
2611 | static void | |
95b22adf | 2612 | tcp_dooptions(struct tcpopt *to, u_char *cp, int cnt, boolean_t is_syn) |
984263bc | 2613 | { |
91489f6b | 2614 | int opt, optlen, i; |
984263bc MD |
2615 | |
2616 | to->to_flags = 0; | |
2617 | for (; cnt > 0; cnt -= optlen, cp += optlen) { | |
2618 | opt = cp[0]; | |
2619 | if (opt == TCPOPT_EOL) | |
2620 | break; | |
2621 | if (opt == TCPOPT_NOP) | |
2622 | optlen = 1; | |
2623 | else { | |
2624 | if (cnt < 2) | |
2625 | break; | |
2626 | optlen = cp[1]; | |
2627 | if (optlen < 2 || optlen > cnt) | |
2628 | break; | |
2629 | } | |
2630 | switch (opt) { | |
2631 | case TCPOPT_MAXSEG: | |
2632 | if (optlen != TCPOLEN_MAXSEG) | |
2633 | continue; | |
2634 | if (!is_syn) | |
2635 | continue; | |
2636 | to->to_flags |= TOF_MSS; | |
407e896e | 2637 | bcopy(cp + 2, &to->to_mss, sizeof to->to_mss); |
984263bc MD |
2638 | to->to_mss = ntohs(to->to_mss); |
2639 | break; | |
2640 | case TCPOPT_WINDOW: | |
2641 | if (optlen != TCPOLEN_WINDOW) | |
2642 | continue; | |
95b22adf | 2643 | if (!is_syn) |
984263bc MD |
2644 | continue; |
2645 | to->to_flags |= TOF_SCALE; | |
2646 | to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); | |
2647 | break; | |
2648 | case TCPOPT_TIMESTAMP: | |
2649 | if (optlen != TCPOLEN_TIMESTAMP) | |
2650 | continue; | |
2651 | to->to_flags |= TOF_TS; | |
407e896e | 2652 | bcopy(cp + 2, &to->to_tsval, sizeof to->to_tsval); |
984263bc | 2653 | to->to_tsval = ntohl(to->to_tsval); |
407e896e | 2654 | bcopy(cp + 6, &to->to_tsecr, sizeof to->to_tsecr); |
984263bc | 2655 | to->to_tsecr = ntohl(to->to_tsecr); |
ad0af98b ND |
2656 | /* |
2657 | * If echoed timestamp is later than the current time, | |
2658 | * fall back to non RFC1323 RTT calculation. | |
2659 | */ | |
2660 | if (to->to_tsecr != 0 && TSTMP_GT(to->to_tsecr, ticks)) | |
2661 | to->to_tsecr = 0; | |
984263bc | 2662 | break; |
91489f6b JH |
2663 | case TCPOPT_SACK_PERMITTED: |
2664 | if (optlen != TCPOLEN_SACK_PERMITTED) | |
2665 | continue; | |
2666 | if (!is_syn) | |
2667 | continue; | |
2668 | to->to_flags |= TOF_SACK_PERMITTED; | |
2669 | break; | |
2670 | case TCPOPT_SACK: | |
2671 | if ((optlen - 2) & 0x07) /* not multiple of 8 */ | |
2672 | continue; | |
2673 | to->to_nsackblocks = (optlen - 2) / 8; | |
2674 | to->to_sackblocks = (struct raw_sackblock *) (cp + 2); | |
2675 | to->to_flags |= TOF_SACK; | |
2676 | for (i = 0; i < to->to_nsackblocks; i++) { | |
2677 | struct raw_sackblock *r = &to->to_sackblocks[i]; | |
2678 | ||
2679 | r->rblk_start = ntohl(r->rblk_start); | |
2680 | r->rblk_end = ntohl(r->rblk_end); | |
865b0477 SZ |
2681 | |
2682 | if (SEQ_LEQ(r->rblk_end, r->rblk_start)) { | |
2683 | /* | |
2684 | * Invalid SACK block; discard all | |
2685 | * SACK blocks | |
2686 | */ | |
02cc2f35 | 2687 | tcpstat.tcps_rcvbadsackopt++; |
865b0477 SZ |
2688 | to->to_nsackblocks = 0; |
2689 | to->to_sackblocks = NULL; | |
2690 | to->to_flags &= ~TOF_SACK; | |
2691 | break; | |
2692 | } | |
91489f6b JH |
2693 | } |
2694 | break; | |
b1992928 MD |
2695 | #ifdef TCP_SIGNATURE |
2696 | /* | |
2697 | * XXX In order to reply to a host which has set the | |
2698 | * TCP_SIGNATURE option in its initial SYN, we have to | |
2699 | * record the fact that the option was observed here | |
2700 | * for the syncache code to perform the correct response. | |
2701 | */ | |
2702 | case TCPOPT_SIGNATURE: | |
2703 | if (optlen != TCPOLEN_SIGNATURE) | |
2704 | continue; | |
2705 | to->to_flags |= (TOF_SIGNATURE | TOF_SIGLEN); | |
2706 | break; | |
2707 | #endif /* TCP_SIGNATURE */ | |
984263bc MD |
2708 | default: |
2709 | continue; | |
2710 | } | |
2711 | } | |
2712 | } | |
2713 | ||
2714 | /* | |
2715 | * Pull out of band byte out of a segment so | |
2716 | * it doesn't appear in the user's data queue. | |
2717 | * It is still reflected in the segment length for | |
2718 | * sequencing purposes. | |
95b22adf | 2719 | * "off" is the delayed to be dropped hdrlen. |
984263bc MD |
2720 | */ |
2721 | static void | |
95b22adf | 2722 | tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m, int off) |
984263bc MD |
2723 | { |
2724 | int cnt = off + th->th_urp - 1; | |
2725 | ||
2726 | while (cnt >= 0) { | |
2727 | if (m->m_len > cnt) { | |
2728 | char *cp = mtod(m, caddr_t) + cnt; | |
2729 | struct tcpcb *tp = sototcpcb(so); | |
2730 | ||
2731 | tp->t_iobc = *cp; | |
2732 | tp->t_oobflags |= TCPOOB_HAVEDATA; | |
95b22adf | 2733 | bcopy(cp + 1, cp, m->m_len - cnt - 1); |
984263bc MD |
2734 | m->m_len--; |
2735 | if (m->m_flags & M_PKTHDR) | |
2736 | m->m_pkthdr.len--; | |
2737 | return; | |
2738 | } | |
2739 | cnt -= m->m_len; | |
2740 | m = m->m_next; | |
4090d6ff | 2741 | if (m == NULL) |
984263bc MD |
2742 | break; |
2743 | } | |
2744 | panic("tcp_pulloutofband"); | |
2745 | } | |
2746 | ||
2747 | /* | |
2748 | * Collect new round-trip time estimate | |
2749 | * and update averages and current timeout. | |
2750 | */ | |
2751 | static void | |
95b22adf | 2752 | tcp_xmit_timer(struct tcpcb *tp, int rtt) |
984263bc | 2753 | { |
2256ba69 | 2754 | int delta; |
984263bc MD |
2755 | |
2756 | tcpstat.tcps_rttupdated++; | |
2757 | tp->t_rttupdated++; | |
2758 | if (tp->t_srtt != 0) { | |
2759 | /* | |
2760 | * srtt is stored as fixed point with 5 bits after the | |
2761 | * binary point (i.e., scaled by 8). The following magic | |
2762 | * is equivalent to the smoothing algorithm in rfc793 with | |
2763 | * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed | |
2764 | * point). Adjust rtt to origin 0. | |
2765 | */ | |
2766 | delta = ((rtt - 1) << TCP_DELTA_SHIFT) | |
2767 | - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT)); | |
2768 | ||
2769 | if ((tp->t_srtt += delta) <= 0) | |
2770 | tp->t_srtt = 1; | |
2771 | ||
2772 | /* | |
2773 | * We accumulate a smoothed rtt variance (actually, a | |
2774 | * smoothed mean difference), then set the retransmit | |
2775 | * timer to smoothed rtt + 4 times the smoothed variance. | |
2776 | * rttvar is stored as fixed point with 4 bits after the | |
2777 | * binary point (scaled by 16). The following is | |
2778 | * equivalent to rfc793 smoothing with an alpha of .75 | |
2779 | * (rttvar = rttvar*3/4 + |delta| / 4). This replaces | |
2780 | * rfc793's wired-in beta. | |
2781 | */ | |
2782 | if (delta < 0) | |
2783 | delta = -delta; | |
2784 | delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT); | |
2785 | if ((tp->t_rttvar += delta) <= 0) | |
2786 | tp->t_rttvar = 1; | |
2787 | if (tp->t_rttbest > tp->t_srtt + tp->t_rttvar) | |
2788 | tp->t_rttbest = tp->t_srtt + tp->t_rttvar; | |
2789 | } else { | |
2790 | /* | |
2791 | * No rtt measurement yet - use the unsmoothed rtt. | |
2792 | * Set the variance to half the rtt (so our first | |
2793 | * retransmit happens at 3*rtt). | |
2794 | */ | |
2795 | tp->t_srtt = rtt << TCP_RTT_SHIFT; | |
2796 | tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1); | |
2797 | tp->t_rttbest = tp->t_srtt + tp->t_rttvar; | |
2798 | } | |
2799 | tp->t_rtttime = 0; | |
2800 | tp->t_rxtshift = 0; | |
2801 | ||
2802 | /* | |
2803 | * the retransmit should happen at rtt + 4 * rttvar. | |
2804 | * Because of the way we do the smoothing, srtt and rttvar | |
2805 | * will each average +1/2 tick of bias. When we compute | |
2806 | * the retransmit timer, we want 1/2 tick of rounding and | |
2807 | * 1 extra tick because of +-1/2 tick uncertainty in the | |
2808 | * firing of the timer. The bias will give us exactly the | |
2809 | * 1.5 tick we need. But, because the bias is | |
2810 | * statistical, we have to test that we don't drop below | |
2811 | * the minimum feasible timer (which is 2 ticks). | |
2812 | */ | |
2813 | TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), | |
2814 | max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX); | |
2815 | ||
2816 | /* | |
2817 | * We received an ack for a packet that wasn't retransmitted; | |
2818 | * it is probably safe to discard any error indications we've | |
2819 | * received recently. This isn't quite right, but close enough | |
2820 | * for now (a route might have failed after we sent a segment, | |
2821 | * and the return path might not be symmetrical). | |
2822 | */ | |
2823 | tp->t_softerror = 0; | |
2824 | } | |
2825 | ||
2826 | /* | |
2827 | * Determine a reasonable value for maxseg size. | |
2828 | * If the route is known, check route for mtu. | |
2829 | * If none, use an mss that can be handled on the outgoing | |
2830 | * interface without forcing IP to fragment; if bigger than | |
2831 | * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES | |
2832 | * to utilize large mbufs. If no route is found, route has no mtu, | |
2833 | * or the destination isn't local, use a default, hopefully conservative | |
2834 | * size (usually 512 or the default IP max size, but no more than the mtu | |
2835 | * of the interface), as we can't discover anything about intervening | |
2836 | * gateways or networks. We also initialize the congestion/slow start | |
2837 | * window to be a single segment if the destination isn't local. | |
2838 | * While looking at the routing entry, we also initialize other path-dependent | |
2839 | * parameters from pre-set or cached values in the routing entry. | |
2840 | * | |
2841 | * Also take into account the space needed for options that we | |
2842 | * send regularly. Make maxseg shorter by that amount to assure | |
2843 | * that we can send maxseg amount of data even when the options | |
2844 | * are present. Store the upper limit of the length of options plus | |
2845 | * data in maxopd. | |
2846 | * | |
2847 | * NOTE that this routine is only called when we process an incoming | |
2848 | * segment, for outgoing segments only tcp_mssopt is called. | |
984263bc MD |
2849 | */ |
2850 | void | |
95b22adf | 2851 | tcp_mss(struct tcpcb *tp, int offer) |
984263bc | 2852 | { |
2256ba69 | 2853 | struct rtentry *rt; |
984263bc | 2854 | struct ifnet *ifp; |
2256ba69 | 2855 | int rtt, mss; |
984263bc MD |
2856 | u_long bufsize; |
2857 | struct inpcb *inp = tp->t_inpcb; | |
2858 | struct socket *so; | |
984263bc | 2859 | #ifdef INET6 |
d24ce1dc | 2860 | boolean_t isipv6 = ((inp->inp_vflag & INP_IPV6) ? TRUE : FALSE); |
984263bc MD |
2861 | size_t min_protoh = isipv6 ? |
2862 | sizeof(struct ip6_hdr) + sizeof(struct tcphdr) : | |
2863 | sizeof(struct tcpiphdr); | |
2864 | #else | |
d24ce1dc | 2865 | const boolean_t isipv6 = FALSE; |
984263bc MD |
2866 | const size_t min_protoh = sizeof(struct tcpiphdr); |
2867 | #endif | |
2868 | ||
2869 | if (isipv6) | |
2870 | rt = tcp_rtlookup6(&inp->inp_inc); | |
2871 | else | |
2872 | rt = tcp_rtlookup(&inp->inp_inc); | |
2873 | if (rt == NULL) { | |
2874 | tp->t_maxopd = tp->t_maxseg = | |
d24ce1dc | 2875 | (isipv6 ? tcp_v6mssdflt : tcp_mssdflt); |
984263bc MD |
2876 | return; |
2877 | } | |
2878 | ifp = rt->rt_ifp; | |
2879 | so = inp->inp_socket; | |
2880 | ||
984263bc MD |
2881 | /* |
2882 | * Offer == 0 means that there was no MSS on the SYN segment, | |
b235ad6d MD |
2883 | * in this case we use either the interface mtu or tcp_mssdflt. |
2884 | * | |
2885 | * An offer which is too large will be cut down later. | |
984263bc | 2886 | */ |
5b0b9fa5 | 2887 | if (offer == 0) { |
b235ad6d MD |
2888 | if (isipv6) { |
2889 | if (in6_localaddr(&inp->in6p_faddr)) { | |
2890 | offer = ND_IFINFO(rt->rt_ifp)->linkmtu - | |
2891 | min_protoh; | |
2892 | } else { | |
2893 | offer = tcp_v6mssdflt; | |
2894 | } | |
2895 | } else { | |
2896 | if (in_localaddr(inp->inp_faddr)) | |
2897 | offer = ifp->if_mtu - min_protoh; | |
2898 | else | |
2899 | offer = tcp_mssdflt; | |
2900 | } | |
5b0b9fa5 | 2901 | } |
b235ad6d MD |
2902 | |
2903 | /* | |
2904 | * Prevent DoS attack with too small MSS. Round up | |
2905 | * to at least minmss. | |
2906 | * | |
2907 | * Sanity check: make sure that maxopd will be large | |
2908 | * enough to allow some data on segments even is the | |
2909 | * all the option space is used (40bytes). Otherwise | |
2910 | * funny things may happen in tcp_output. | |
2911 | */ | |
2912 | offer = max(offer, tcp_minmss); | |
2913 | offer = max(offer, 64); | |
2914 | ||
27b8aee3 | 2915 | rt->rt_rmx.rmx_mssopt = offer; |
984263bc MD |
2916 | |
2917 | /* | |
2918 | * While we're here, check if there's an initial rtt | |
2919 | * or rttvar. Convert from the route-table units | |
2920 | * to scaled multiples of the slow timeout timer. | |
2921 | */ | |
2922 | if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt)) { | |
2923 | /* | |
2924 | * XXX the lock bit for RTT indicates that the value | |
2925 | * is also a minimum value; this is subject to time. | |
2926 | */ | |
2927 | if (rt->rt_rmx.rmx_locks & RTV_RTT) | |
2928 | tp->t_rttmin = rtt / (RTM_RTTUNIT / hz); | |
2929 | tp->t_srtt = rtt / (RTM_RTTUNIT / (hz * TCP_RTT_SCALE)); | |
2930 | tp->t_rttbest = tp->t_srtt + TCP_RTT_SCALE; | |
2931 | tcpstat.tcps_usedrtt++; | |
2932 | if (rt->rt_rmx.rmx_rttvar) { | |
2933 | tp->t_rttvar = rt->rt_rmx.rmx_rttvar / | |
2934 | (RTM_RTTUNIT / (hz * TCP_RTTVAR_SCALE)); | |
2935 | tcpstat.tcps_usedrttvar++; | |
2936 | } else { | |
2937 | /* default variation is +- 1 rtt */ | |
2938 | tp->t_rttvar = | |
2939 | tp->t_srtt * TCP_RTTVAR_SCALE / TCP_RTT_SCALE; | |
2940 | } | |
2941 | TCPT_RANGESET(tp->t_rxtcur, | |
2942 | ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1, | |
2943 | tp->t_rttmin, TCPTV_REXMTMAX); | |
2944 | } | |
b235ad6d | 2945 | |
984263bc MD |
2946 | /* |
2947 | * if there's an mtu associated with the route, use it | |
b235ad6d MD |
2948 | * else, use the link mtu. Take the smaller of mss or offer |
2949 | * as our final mss. | |
984263bc | 2950 | */ |
b235ad6d | 2951 | if (rt->rt_rmx.rmx_mtu) { |
984263bc | 2952 | mss = rt->rt_rmx.rmx_mtu - min_protoh; |
b235ad6d MD |
2953 | } else { |
2954 | if (isipv6) | |
698ac46c | 2955 | mss = ND_IFINFO(rt->rt_ifp)->linkmtu - min_protoh; |
b235ad6d | 2956 | else |
984263bc | 2957 | mss = ifp->if_mtu - min_protoh; |
984263bc MD |
2958 | } |
2959 | mss = min(mss, offer); | |
b235ad6d | 2960 | |
984263bc MD |
2961 | /* |
2962 | * maxopd stores the maximum length of data AND options | |
2963 | * in a segment; maxseg is the amount of data in a normal | |
2964 | * segment. We need to store this value (maxopd) apart | |
2965 | * from maxseg, because now every segment carries options | |
2966 | * and thus we normally have somewhat less data in segments. | |
2967 | */ | |
2968 | tp->t_maxopd = mss; | |
2969 | ||
61896e3c | 2970 | if ((tp->t_flags & (TF_REQ_TSTMP | TF_NOOPT)) == TF_REQ_TSTMP && |
27b8aee3 | 2971 | ((tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)) |
984263bc | 2972 | mss -= TCPOLEN_TSTAMP_APPA; |
984263bc MD |
2973 | |
2974 | #if (MCLBYTES & (MCLBYTES - 1)) == 0 | |
2975 | if (mss > MCLBYTES) | |
2976 | mss &= ~(MCLBYTES-1); | |
2977 | #else | |
2978 | if (mss > MCLBYTES) | |
2979 | mss = mss / MCLBYTES * MCLBYTES; | |
2980 | #endif | |
2981 | /* | |
2982 | * If there's a pipesize, change the socket buffer | |
2983 | * to that size. Make the socket buffers an integral | |
2984 | * number of mss units; if the mss is larger than | |
2985 | * the socket buffer, decrease the mss. | |
2986 | */ | |
2987 | #ifdef RTV_SPIPE | |
2988 | if ((bufsize = rt->rt_rmx.rmx_sendpipe) == 0) | |
2989 | #endif | |
6d49aa6f | 2990 | bufsize = so->so_snd.ssb_hiwat; |
984263bc MD |
2991 | if (bufsize < mss) |
2992 | mss = bufsize; | |
2993 | else { | |
2994 | bufsize = roundup(bufsize, mss); | |
2995 | if (bufsize > sb_max) | |
2996 | bufsize = sb_max; | |
6d49aa6f MD |
2997 | if (bufsize > so->so_snd.ssb_hiwat) |
2998 | ssb_reserve(&so->so_snd, bufsize, so, NULL); | |
984263bc MD |
2999 | } |
3000 | tp->t_maxseg = mss; | |
3001 | ||
3002 | #ifdef RTV_RPIPE | |
3003 | if ((bufsize = rt->rt_rmx.rmx_recvpipe) == 0) | |
3004 | #endif | |
6d49aa6f | 3005 | bufsize = so->so_rcv.ssb_hiwat; |
984263bc MD |
3006 | if (bufsize > mss) { |
3007 | bufsize = roundup(bufsize, mss); | |
3008 | if (bufsize > sb_max) | |
3009 | bufsize = sb_max; | |
6cef7136 MD |
3010 | if (bufsize > so->so_rcv.ssb_hiwat) { |
3011 | lwkt_gettoken(&so->so_rcv.ssb_token); | |
6d49aa6f | 3012 | ssb_reserve(&so->so_rcv, bufsize, so, NULL); |
6cef7136 MD |
3013 | lwkt_reltoken(&so->so_rcv.ssb_token); |
3014 | } | |
984263bc MD |
3015 | } |
3016 | ||
3017 | /* | |
697020f5 SZ |
3018 | * Set the slow-start flight size |
3019 | * | |
3020 | * NOTE: t_maxseg must have been configured! | |
984263bc | 3021 | */ |
697020f5 | 3022 | tp->snd_cwnd = tcp_initial_window(tp); |
984263bc MD |
3023 | |
3024 | if (rt->rt_rmx.rmx_ssthresh) { | |
3025 | /* | |
3026 | * There's some sort of gateway or interface | |
3027 | * buffer limit on the path. Use this to set | |
3028 | * the slow start threshhold, but set the | |
3029 | * threshold to no less than 2*mss. | |
3030 | */ | |
3031 | tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh); | |
3032 | tcpstat.tcps_usedssthresh++; | |
3033 | } | |
3034 | } | |
3035 | ||
3036 | /* | |
3037 | * Determine the MSS option to send on an outgoing SYN. | |
3038 | */ | |
3039 | int | |
95b22adf | 3040 | tcp_mssopt(struct tcpcb *tp) |
984263bc MD |
3041 | { |
3042 | struct rtentry *rt; | |
3043 | #ifdef INET6 | |
d24ce1dc JH |
3044 | boolean_t isipv6 = |
3045 | ((tp->t_inpcb->inp_vflag & INP_IPV6) ? TRUE : FALSE); | |
984263bc MD |
3046 | int min_protoh = isipv6 ? |
3047 | sizeof(struct ip6_hdr) + sizeof(struct tcphdr) : | |
3048 | sizeof(struct tcpiphdr); | |
3049 | #else | |
d24ce1dc | 3050 | const boolean_t isipv6 = FALSE; |
984263bc MD |
3051 | const size_t min_protoh = sizeof(struct tcpiphdr); |
3052 | #endif | |
3053 | ||
3054 | if (isipv6) | |
3055 | rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc); | |
3056 | else | |
3057 | rt = tcp_rtlookup(&tp->t_inpcb->inp_inc); | |
3058 | if (rt == NULL) | |
3059 | return (isipv6 ? tcp_v6mssdflt : tcp_mssdflt); | |
3060 | ||
3061 | return (rt->rt_ifp->if_mtu - min_protoh); | |
3062 | } | |
3063 | ||
984263bc MD |
3064 | /* |
3065 | * When a partial ack arrives, force the retransmission of the | |
91489f6b JH |
3066 | * next unacknowledged segment. Do not exit Fast Recovery. |
3067 | * | |
3068 | * Implement the Slow-but-Steady variant of NewReno by restarting the | |
3069 | * the retransmission timer. Turn it off here so it can be restarted | |
3070 | * later in tcp_output(). | |
984263bc MD |
3071 | */ |
3072 | static void | |
91489f6b | 3073 | tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th, int acked) |
984263bc | 3074 | { |
91489f6b JH |
3075 | tcp_seq old_snd_nxt = tp->snd_nxt; |
3076 | u_long ocwnd = tp->snd_cwnd; | |
984263bc | 3077 | |
a48c5dd5 | 3078 | tcp_callout_stop(tp, tp->tt_rexmt); |
984263bc MD |
3079 | tp->t_rtttime = 0; |
3080 | tp->snd_nxt = th->th_ack; | |
91489f6b JH |
3081 | /* Set snd_cwnd to one segment beyond acknowledged offset. */ |
3082 | tp->snd_cwnd = tp->t_maxseg; | |
984263bc | 3083 | tp->t_flags |= TF_ACKNOW; |
f23061d4 | 3084 | tcp_output(tp); |
91489f6b JH |
3085 | if (SEQ_GT(old_snd_nxt, tp->snd_nxt)) |
3086 | tp->snd_nxt = old_snd_nxt; | |
3087 | /* partial window deflation */ | |
68947d12 ND |
3088 | if (ocwnd > acked) |
3089 | tp->snd_cwnd = ocwnd - acked + tp->t_maxseg; | |
3090 | else | |
3091 | tp->snd_cwnd = tp->t_maxseg; | |
91489f6b JH |
3092 | } |
3093 | ||
3094 | /* | |
3095 | * In contrast to the Slow-but-Steady NewReno variant, | |
3096 | * we do not reset the retransmission timer for SACK retransmissions, | |
3097 | * except when retransmitting snd_una. | |
3098 | */ | |
3099 | static void | |
3100 | tcp_sack_rexmt(struct tcpcb *tp, struct tcphdr *th) | |
3101 | { | |
3102 | uint32_t pipe, seglen; | |
3103 | tcp_seq nextrexmt; | |
3104 | boolean_t lostdup; | |
3105 | tcp_seq old_snd_nxt = tp->snd_nxt; | |
3106 | u_long ocwnd = tp->snd_cwnd; | |
3107 | int nseg = 0; /* consecutive new segments */ | |
3108 | #define MAXBURST 4 /* limit burst of new packets on partial ack */ | |
3109 | ||
3110 | tp->t_rtttime = 0; | |
3111 | pipe = tcp_sack_compute_pipe(tp); | |
3112 | while ((tcp_seq_diff_t)(ocwnd - pipe) >= (tcp_seq_diff_t)tp->t_maxseg && | |
3113 | (!tcp_do_smartsack || nseg < MAXBURST) && | |
3114 | tcp_sack_nextseg(tp, &nextrexmt, &seglen, &lostdup)) { | |
3115 | uint32_t sent; | |
3116 | tcp_seq old_snd_max; | |
3117 | int error; | |
3118 | ||
98cb2337 MD |
3119 | if (nextrexmt == tp->snd_max) |
3120 | ++nseg; | |
91489f6b JH |
3121 | tp->snd_nxt = nextrexmt; |
3122 | tp->snd_cwnd = nextrexmt - tp->snd_una + seglen; | |
3123 | old_snd_max = tp->snd_max; | |
3124 | if (nextrexmt == tp->snd_una) | |
a48c5dd5 | 3125 | tcp_callout_stop(tp, tp->tt_rexmt); |
91489f6b JH |
3126 | error = tcp_output(tp); |
3127 | if (error != 0) | |
3128 | break; | |
3129 | sent = tp->snd_nxt - nextrexmt; | |
3130 | if (sent <= 0) | |
3131 | break; | |
3132 | if (!lostdup) | |
3133 | pipe += sent; | |
3134 | tcpstat.tcps_sndsackpack++; | |
3135 | tcpstat.tcps_sndsackbyte += sent; | |
3136 | if (SEQ_LT(nextrexmt, old_snd_max) && | |
3137 | SEQ_LT(tp->rexmt_high, tp->snd_nxt)) | |
3138 | tp->rexmt_high = seq_min(tp->snd_nxt, old_snd_max); | |
3139 | } | |
3140 | if (SEQ_GT(old_snd_nxt, tp->snd_nxt)) | |
3141 | tp->snd_nxt = old_snd_nxt; | |
984263bc | 3142 | tp->snd_cwnd = ocwnd; |
984263bc | 3143 | } |
0ecd93f9 MD |
3144 | |
3145 | /* | |
3146 | * Reset idle time and keep-alive timer, typically called when a valid | |
3147 | * tcp packet is received but may also be called when FASTKEEP is set | |
3148 | * to prevent the previous long-timeout from calculating to a drop. | |
3149 | * | |
3150 | * Only update t_rcvtime for non-SYN packets. | |
3151 | * | |
3152 | * Handle the case where one side thinks the connection is established | |
3153 | * but the other side has, say, rebooted without cleaning out the | |
3154 | * connection. The SYNs could be construed as an attack and wind | |
3155 | * up ignored, but in case it isn't an attack we can validate the | |
3156 | * connection by forcing a keepalive. | |
3157 | */ | |
3158 | void | |
3159 | tcp_timer_keep_activity(struct tcpcb *tp, int thflags) | |
3160 | { | |
3161 | if (TCPS_HAVEESTABLISHED(tp->t_state)) { | |
3162 | if ((thflags & (TH_SYN | TH_ACK)) == TH_SYN) { | |
3163 | tp->t_flags |= TF_KEEPALIVE; | |
3164 | tcp_callout_reset(tp, tp->tt_keep, hz / 2, | |
3165 | tcp_timer_keep); | |
3166 | } else { | |
3167 | tp->t_rcvtime = ticks; | |
3168 | tp->t_flags &= ~TF_KEEPALIVE; | |
3169 | tcp_callout_reset(tp, tp->tt_keep, | |
fb8d5c6d | 3170 | tp->t_keepidle, |
0ecd93f9 MD |
3171 | tcp_timer_keep); |
3172 | } | |
3173 | } | |
3174 | } | |
01d3427a SZ |
3175 | |
3176 | static int | |
3177 | tcp_rmx_msl(const struct tcpcb *tp) | |
3178 | { | |
3179 | struct rtentry *rt; | |
3180 | struct inpcb *inp = tp->t_inpcb; | |
9855a4ef | 3181 | int msl; |
01d3427a SZ |
3182 | #ifdef INET6 |
3183 | boolean_t isipv6 = ((inp->inp_vflag & INP_IPV6) ? TRUE : FALSE); | |
3184 | #else | |
3185 | const boolean_t isipv6 = FALSE; | |
3186 | #endif | |
3187 | ||
3188 | if (isipv6) | |
3189 | rt = tcp_rtlookup6(&inp->inp_inc); | |
3190 | else | |
3191 | rt = tcp_rtlookup(&inp->inp_inc); | |
3192 | if (rt == NULL || rt->rt_rmx.rmx_msl == 0) | |
3193 | return tcp_msl; | |
3194 | ||
9855a4ef SZ |
3195 | msl = (rt->rt_rmx.rmx_msl * hz) / 1000; |
3196 | if (msl == 0) | |
3197 | msl = 1; | |
3198 | ||
3199 | return msl; | |
01d3427a | 3200 | } |
8651f7f8 SZ |
3201 | |
3202 | static void | |
3203 | tcp_established(struct tcpcb *tp) | |
3204 | { | |
3205 | tp->t_state = TCPS_ESTABLISHED; | |
fb8d5c6d | 3206 | tcp_callout_reset(tp, tp->tt_keep, tp->t_keepidle, tcp_timer_keep); |
be34e534 | 3207 | |
d5082e3d | 3208 | if (tp->t_rxtsyn > 0) { |
48a4676d SZ |
3209 | /* |
3210 | * RFC6298: | |
3211 | * "If the timer expires awaiting the ACK of a SYN segment | |
3212 | * and the TCP implementation is using an RTO less than 3 | |
3213 | * seconds, the RTO MUST be re-initialized to 3 seconds | |
3214 | * when data transmission begins" | |
3215 | */ | |
3216 | if (tp->t_rxtcur < TCPTV_RTOBASE3) | |
3217 | tp->t_rxtcur = TCPTV_RTOBASE3; | |
be34e534 | 3218 | } |
8651f7f8 | 3219 | } |