1 /* $NetBSD: tcp_input.c,v 1.441 2024/10/08 06:17:14 rin Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006,
74 * 2011 The NetBSD Foundation, Inc.
75 * All rights reserved.
76 *
77 * This code is derived from software contributed to The NetBSD Foundation
78 * by Coyote Point Systems, Inc.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
81 * Facility, NASA Ames Research Center.
82 * This code is derived from software contributed to The NetBSD Foundation
83 * by Charles M. Hannum.
84 * This code is derived from software contributed to The NetBSD Foundation
85 * by Rui Paulo.
86 *
87 * Redistribution and use in source and binary forms, with or without
88 * modification, are permitted provided that the following conditions
89 * are met:
90 * 1. Redistributions of source code must retain the above copyright
91 * notice, this list of conditions and the following disclaimer.
92 * 2. Redistributions in binary form must reproduce the above copyright
93 * notice, this list of conditions and the following disclaimer in the
94 * documentation and/or other materials provided with the distribution.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. Neither the name of the University nor the names of its contributors
122 * may be used to endorse or promote products derived from this software
123 * without specific prior written permission.
124 *
125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135 * SUCH DAMAGE.
136 *
137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
138 */
139
140 #include <sys/cdefs.h>
141 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.441 2024/10/08 06:17:14 rin Exp $");
142
143 #ifdef _KERNEL_OPT
144 #include "opt_inet.h"
145 #include "opt_ipsec.h"
146 #include "opt_inet_csum.h"
147 #include "opt_tcp_debug.h"
148 #endif
149
150 #include <sys/param.h>
151 #include <sys/systm.h>
152 #include <sys/malloc.h>
153 #include <sys/mbuf.h>
154 #include <sys/protosw.h>
155 #include <sys/socket.h>
156 #include <sys/socketvar.h>
157 #include <sys/errno.h>
158 #include <sys/syslog.h>
159 #include <sys/pool.h>
160 #include <sys/domain.h>
161 #include <sys/kernel.h>
162 #ifdef TCP_SIGNATURE
163 #include <sys/md5.h>
164 #endif
165 #include <sys/lwp.h> /* for lwp0 */
166 #include <sys/cprng.h>
167
168 #include <net/if.h>
169 #include <net/if_types.h>
170
171 #include <netinet/in.h>
172 #include <netinet/in_systm.h>
173 #include <netinet/ip.h>
174 #include <netinet/in_pcb.h>
175 #include <netinet/in_var.h>
176 #include <netinet/ip_var.h>
177 #include <netinet/in_offload.h>
178
179 #if NARP > 0
180 #include <netinet/if_inarp.h>
181 #endif
182 #ifdef INET6
183 #include <netinet/ip6.h>
184 #include <netinet6/ip6_var.h>
185 #include <netinet6/in6_pcb.h>
186 #include <netinet6/ip6_var.h>
187 #include <netinet6/in6_var.h>
188 #include <netinet/icmp6.h>
189 #include <netinet6/nd6.h>
190 #ifdef TCP_SIGNATURE
191 #include <netinet6/scope6_var.h>
192 #endif
193 #endif
194
195 #ifndef INET6
196 #include <netinet/ip6.h>
197 #endif
198
199 #include <netinet/tcp.h>
200 #include <netinet/tcp_fsm.h>
201 #include <netinet/tcp_seq.h>
202 #include <netinet/tcp_timer.h>
203 #include <netinet/tcp_var.h>
204 #include <netinet/tcp_private.h>
205 #include <netinet/tcp_congctl.h>
206 #include <netinet/tcp_debug.h>
207 #include <netinet/tcp_syncache.h>
208
209 #ifdef INET6
210 #include "faith.h"
211 #if defined(NFAITH) && NFAITH > 0
212 #include <net/if_faith.h>
213 #endif
214 #endif
215
216 #ifdef IPSEC
217 #include <netipsec/ipsec.h>
218 #include <netipsec/key.h>
219 #ifdef INET6
220 #include <netipsec/ipsec6.h>
221 #endif
222 #endif /* IPSEC*/
223
224 #include <netinet/tcp_vtw.h>
225
226 int tcprexmtthresh = 3;
227 int tcp_log_refused;
228
229 int tcp_do_autorcvbuf = 1;
230 int tcp_autorcvbuf_inc = 16 * 1024;
231 int tcp_autorcvbuf_max = 256 * 1024;
232 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
233
234 int tcp_reass_maxqueuelen = 100;
235
236 static int tcp_rst_ppslim_count = 0;
237 static struct timeval tcp_rst_ppslim_last;
238 static int tcp_ackdrop_ppslim_count = 0;
239 static struct timeval tcp_ackdrop_ppslim_last;
240
241 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
242
243 /* for modulo comparisons of timestamps */
244 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
245 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
246
247 /*
248 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
249 */
250 static void
nd_hint(struct tcpcb * tp)251 nd_hint(struct tcpcb *tp)
252 {
253 struct route *ro = NULL;
254 struct rtentry *rt;
255
256 if (tp == NULL)
257 return;
258
259 ro = &tp->t_inpcb->inp_route;
260 if (ro == NULL)
261 return;
262
263 rt = rtcache_validate(ro);
264 if (rt == NULL)
265 return;
266
267 switch (tp->t_family) {
268 #if NARP > 0
269 case AF_INET:
270 arp_nud_hint(rt);
271 break;
272 #endif
273 #ifdef INET6
274 case AF_INET6:
275 nd6_nud_hint(rt);
276 break;
277 #endif
278 }
279
280 rtcache_unref(rt, ro);
281 }
282
283 /*
284 * Compute ACK transmission behavior. Delay the ACK unless
285 * we have already delayed an ACK (must send an ACK every two segments).
286 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
287 * option is enabled.
288 */
289 static void
tcp_setup_ack(struct tcpcb * tp,const struct tcphdr * th)290 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
291 {
292
293 if (tp->t_flags & TF_DELACK ||
294 (tcp_ack_on_push && th->th_flags & TH_PUSH))
295 tp->t_flags |= TF_ACKNOW;
296 else
297 TCP_SET_DELACK(tp);
298 }
299
300 static void
icmp_check(struct tcpcb * tp,const struct tcphdr * th,int acked)301 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
302 {
303
304 /*
305 * If we had a pending ICMP message that refers to data that have
306 * just been acknowledged, disregard the recorded ICMP message.
307 */
308 if ((tp->t_flags & TF_PMTUD_PEND) &&
309 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
310 tp->t_flags &= ~TF_PMTUD_PEND;
311
312 /*
313 * Keep track of the largest chunk of data
314 * acknowledged since last PMTU update
315 */
316 if (tp->t_pmtud_mss_acked < acked)
317 tp->t_pmtud_mss_acked = acked;
318 }
319
320 /*
321 * Convert TCP protocol fields to host order for easier processing.
322 */
323 static void
tcp_fields_to_host(struct tcphdr * th)324 tcp_fields_to_host(struct tcphdr *th)
325 {
326
327 NTOHL(th->th_seq);
328 NTOHL(th->th_ack);
329 NTOHS(th->th_win);
330 NTOHS(th->th_urp);
331 }
332
333 /*
334 * ... and reverse the above.
335 */
336 static void
tcp_fields_to_net(struct tcphdr * th)337 tcp_fields_to_net(struct tcphdr *th)
338 {
339
340 HTONL(th->th_seq);
341 HTONL(th->th_ack);
342 HTONS(th->th_win);
343 HTONS(th->th_urp);
344 }
345
346 static void
tcp_urp_drop(struct tcphdr * th,int todrop,int * tiflags)347 tcp_urp_drop(struct tcphdr *th, int todrop, int *tiflags)
348 {
349 if (th->th_urp > todrop) {
350 th->th_urp -= todrop;
351 } else {
352 *tiflags &= ~TH_URG;
353 th->th_urp = 0;
354 }
355 }
356
357 #ifdef TCP_CSUM_COUNTERS
358 #include <sys/device.h>
359
360 extern struct evcnt tcp_hwcsum_ok;
361 extern struct evcnt tcp_hwcsum_bad;
362 extern struct evcnt tcp_hwcsum_data;
363 extern struct evcnt tcp_swcsum;
364 #if defined(INET6)
365 extern struct evcnt tcp6_hwcsum_ok;
366 extern struct evcnt tcp6_hwcsum_bad;
367 extern struct evcnt tcp6_hwcsum_data;
368 extern struct evcnt tcp6_swcsum;
369 #endif /* defined(INET6) */
370
371 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
372
373 #else
374
375 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
376
377 #endif /* TCP_CSUM_COUNTERS */
378
379 #ifdef TCP_REASS_COUNTERS
380 #include <sys/device.h>
381
382 extern struct evcnt tcp_reass_;
383 extern struct evcnt tcp_reass_empty;
384 extern struct evcnt tcp_reass_iteration[8];
385 extern struct evcnt tcp_reass_prependfirst;
386 extern struct evcnt tcp_reass_prepend;
387 extern struct evcnt tcp_reass_insert;
388 extern struct evcnt tcp_reass_inserttail;
389 extern struct evcnt tcp_reass_append;
390 extern struct evcnt tcp_reass_appendtail;
391 extern struct evcnt tcp_reass_overlaptail;
392 extern struct evcnt tcp_reass_overlapfront;
393 extern struct evcnt tcp_reass_segdup;
394 extern struct evcnt tcp_reass_fragdup;
395
396 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
397
398 #else
399
400 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
401
402 #endif /* TCP_REASS_COUNTERS */
403
404 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
405 int);
406
407 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
408 #ifdef INET6
409 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
410 #endif
411
412 #if defined(MBUFTRACE)
413 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
414 #endif /* defined(MBUFTRACE) */
415
416 static struct pool tcpipqent_pool;
417
418 void
tcpipqent_init(void)419 tcpipqent_init(void)
420 {
421
422 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
423 NULL, IPL_VM);
424 }
425
426 struct ipqent *
tcpipqent_alloc(void)427 tcpipqent_alloc(void)
428 {
429 struct ipqent *ipqe;
430 int s;
431
432 s = splvm();
433 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
434 splx(s);
435
436 return ipqe;
437 }
438
439 void
tcpipqent_free(struct ipqent * ipqe)440 tcpipqent_free(struct ipqent *ipqe)
441 {
442 int s;
443
444 s = splvm();
445 pool_put(&tcpipqent_pool, ipqe);
446 splx(s);
447 }
448
449 /*
450 * Insert segment ti into reassembly queue of tcp with
451 * control block tp. Return TH_FIN if reassembly now includes
452 * a segment with FIN.
453 */
454 static int
tcp_reass(struct tcpcb * tp,const struct tcphdr * th,struct mbuf * m,int tlen)455 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int tlen)
456 {
457 struct ipqent *p, *q, *nq, *tiqe = NULL;
458 struct socket *so = NULL;
459 int pkt_flags;
460 tcp_seq pkt_seq;
461 unsigned pkt_len;
462 u_long rcvpartdupbyte = 0;
463 u_long rcvoobyte;
464 #ifdef TCP_REASS_COUNTERS
465 u_int count = 0;
466 #endif
467 net_stat_ref_t tcps;
468
469 so = tp->t_inpcb->inp_socket;
470
471 TCP_REASS_LOCK_CHECK(tp);
472
473 /*
474 * Call with th==NULL after become established to
475 * force pre-ESTABLISHED data up to user socket.
476 */
477 if (th == NULL)
478 goto present;
479
480 m_claimm(m, &tcp_reass_mowner);
481
482 rcvoobyte = tlen;
483 /*
484 * Copy these to local variables because the TCP header gets munged
485 * while we are collapsing mbufs.
486 */
487 pkt_seq = th->th_seq;
488 pkt_len = tlen;
489 pkt_flags = th->th_flags;
490
491 TCP_REASS_COUNTER_INCR(&tcp_reass_);
492
493 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
494 /*
495 * When we miss a packet, the vast majority of time we get
496 * packets that follow it in order. So optimize for that.
497 */
498 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
499 p->ipqe_len += pkt_len;
500 p->ipqe_flags |= pkt_flags;
501 m_cat(p->ipqe_m, m);
502 m = NULL;
503 tiqe = p;
504 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
505 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
506 goto skip_replacement;
507 }
508 /*
509 * While we're here, if the pkt is completely beyond
510 * anything we have, just insert it at the tail.
511 */
512 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
513 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
514 goto insert_it;
515 }
516 }
517
518 q = TAILQ_FIRST(&tp->segq);
519
520 if (q != NULL) {
521 /*
522 * If this segment immediately precedes the first out-of-order
523 * block, simply slap the segment in front of it and (mostly)
524 * skip the complicated logic.
525 */
526 if (pkt_seq + pkt_len == q->ipqe_seq) {
527 q->ipqe_seq = pkt_seq;
528 q->ipqe_len += pkt_len;
529 q->ipqe_flags |= pkt_flags;
530 m_cat(m, q->ipqe_m);
531 q->ipqe_m = m;
532 tiqe = q;
533 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
534 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
535 goto skip_replacement;
536 }
537 } else {
538 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
539 }
540
541 /*
542 * Find a segment which begins after this one does.
543 */
544 for (p = NULL; q != NULL; q = nq) {
545 nq = TAILQ_NEXT(q, ipqe_q);
546 #ifdef TCP_REASS_COUNTERS
547 count++;
548 #endif
549
550 /*
551 * If the received segment is just right after this
552 * fragment, merge the two together and then check
553 * for further overlaps.
554 */
555 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
556 pkt_len += q->ipqe_len;
557 pkt_flags |= q->ipqe_flags;
558 pkt_seq = q->ipqe_seq;
559 m_cat(q->ipqe_m, m);
560 m = q->ipqe_m;
561 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
562 goto free_ipqe;
563 }
564
565 /*
566 * If the received segment is completely past this
567 * fragment, we need to go to the next fragment.
568 */
569 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
570 p = q;
571 continue;
572 }
573
574 /*
575 * If the fragment is past the received segment,
576 * it (or any following) can't be concatenated.
577 */
578 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
579 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
580 break;
581 }
582
583 /*
584 * We've received all the data in this segment before.
585 * Mark it as a duplicate and return.
586 */
587 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
588 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
589 tcps = TCP_STAT_GETREF();
590 _NET_STATINC_REF(tcps, TCP_STAT_RCVDUPPACK);
591 _NET_STATADD_REF(tcps, TCP_STAT_RCVDUPBYTE, pkt_len);
592 TCP_STAT_PUTREF();
593 tcp_new_dsack(tp, pkt_seq, pkt_len);
594 m_freem(m);
595 if (tiqe != NULL) {
596 tcpipqent_free(tiqe);
597 }
598 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
599 goto out;
600 }
601
602 /*
603 * Received segment completely overlaps this fragment
604 * so we drop the fragment (this keeps the temporal
605 * ordering of segments correct).
606 */
607 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
608 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
609 rcvpartdupbyte += q->ipqe_len;
610 m_freem(q->ipqe_m);
611 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
612 goto free_ipqe;
613 }
614
615 /*
616 * Received segment extends past the end of the fragment.
617 * Drop the overlapping bytes, merge the fragment and
618 * segment, and treat as a longer received packet.
619 */
620 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
621 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
622 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
623 m_adj(m, overlap);
624 rcvpartdupbyte += overlap;
625 m_cat(q->ipqe_m, m);
626 m = q->ipqe_m;
627 pkt_seq = q->ipqe_seq;
628 pkt_len += q->ipqe_len - overlap;
629 rcvoobyte -= overlap;
630 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
631 goto free_ipqe;
632 }
633
634 /*
635 * Received segment extends past the front of the fragment.
636 * Drop the overlapping bytes on the received packet. The
637 * packet will then be concatenated with this fragment a
638 * bit later.
639 */
640 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
641 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
642 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
643 m_adj(m, -overlap);
644 pkt_len -= overlap;
645 rcvpartdupbyte += overlap;
646 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
647 rcvoobyte -= overlap;
648 }
649
650 /*
651 * If the received segment immediately precedes this
652 * fragment then tack the fragment onto this segment
653 * and reinsert the data.
654 */
655 if (q->ipqe_seq == pkt_seq + pkt_len) {
656 pkt_len += q->ipqe_len;
657 pkt_flags |= q->ipqe_flags;
658 m_cat(m, q->ipqe_m);
659 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
660 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
661 tp->t_segqlen--;
662 KASSERT(tp->t_segqlen >= 0);
663 KASSERT(tp->t_segqlen != 0 ||
664 (TAILQ_EMPTY(&tp->segq) &&
665 TAILQ_EMPTY(&tp->timeq)));
666 if (tiqe == NULL) {
667 tiqe = q;
668 } else {
669 tcpipqent_free(q);
670 }
671 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
672 break;
673 }
674
675 /*
676 * If the fragment is before the segment, remember it.
677 * When this loop is terminated, p will contain the
678 * pointer to the fragment that is right before the
679 * received segment.
680 */
681 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
682 p = q;
683
684 continue;
685
686 /*
687 * This is a common operation. It also will allow
688 * to save doing a malloc/free in most instances.
689 */
690 free_ipqe:
691 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
692 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
693 tp->t_segqlen--;
694 KASSERT(tp->t_segqlen >= 0);
695 KASSERT(tp->t_segqlen != 0 ||
696 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
697 if (tiqe == NULL) {
698 tiqe = q;
699 } else {
700 tcpipqent_free(q);
701 }
702 }
703
704 #ifdef TCP_REASS_COUNTERS
705 if (count > 7)
706 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
707 else if (count > 0)
708 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
709 #endif
710
711 insert_it:
712 /* limit tcp segments per reassembly queue */
713 if (tp->t_segqlen > tcp_reass_maxqueuelen) {
714 TCP_STATINC(TCP_STAT_RCVMEMDROP);
715 m_freem(m);
716 goto out;
717 }
718
719 /*
720 * Allocate a new queue entry (block) since the received segment
721 * did not collapse onto any other out-of-order block. If it had
722 * collapsed, tiqe would not be NULL and we would be reusing it.
723 *
724 * If the allocation fails, drop the packet.
725 */
726 if (tiqe == NULL) {
727 tiqe = tcpipqent_alloc();
728 if (tiqe == NULL) {
729 TCP_STATINC(TCP_STAT_RCVMEMDROP);
730 m_freem(m);
731 goto out;
732 }
733 }
734
735 /*
736 * Update the counters.
737 */
738 tp->t_rcvoopack++;
739 tcps = TCP_STAT_GETREF();
740 _NET_STATINC_REF(tcps, TCP_STAT_RCVOOPACK);
741 _NET_STATADD_REF(tcps, TCP_STAT_RCVOOBYTE, rcvoobyte);
742 if (rcvpartdupbyte) {
743 _NET_STATINC_REF(tcps, TCP_STAT_RCVPARTDUPPACK);
744 _NET_STATADD_REF(tcps, TCP_STAT_RCVPARTDUPBYTE,
745 rcvpartdupbyte);
746 }
747 TCP_STAT_PUTREF();
748
749 /*
750 * Insert the new fragment queue entry into both queues.
751 */
752 tiqe->ipqe_m = m;
753 tiqe->ipqe_seq = pkt_seq;
754 tiqe->ipqe_len = pkt_len;
755 tiqe->ipqe_flags = pkt_flags;
756 if (p == NULL) {
757 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
758 } else {
759 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
760 }
761 tp->t_segqlen++;
762
763 skip_replacement:
764 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
765
766 present:
767 /*
768 * Present data to user, advancing rcv_nxt through
769 * completed sequence space.
770 */
771 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
772 goto out;
773 q = TAILQ_FIRST(&tp->segq);
774 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
775 goto out;
776 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
777 goto out;
778
779 tp->rcv_nxt += q->ipqe_len;
780 pkt_flags = q->ipqe_flags & TH_FIN;
781 nd_hint(tp);
782
783 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
784 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
785 tp->t_segqlen--;
786 KASSERT(tp->t_segqlen >= 0);
787 KASSERT(tp->t_segqlen != 0 ||
788 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
789 if (so->so_state & SS_CANTRCVMORE)
790 m_freem(q->ipqe_m);
791 else
792 sbappendstream(&so->so_rcv, q->ipqe_m);
793 tcpipqent_free(q);
794 TCP_REASS_UNLOCK(tp);
795 sorwakeup(so);
796 return pkt_flags;
797
798 out:
799 TCP_REASS_UNLOCK(tp);
800 return 0;
801 }
802
803 #ifdef INET6
804 int
tcp6_input(struct mbuf ** mp,int * offp,int proto)805 tcp6_input(struct mbuf **mp, int *offp, int proto)
806 {
807 struct mbuf *m = *mp;
808
809 /*
810 * draft-itojun-ipv6-tcp-to-anycast
811 * better place to put this in?
812 */
813 if (m->m_flags & M_ANYCAST6) {
814 struct ip6_hdr *ip6;
815 if (m->m_len < sizeof(struct ip6_hdr)) {
816 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
817 TCP_STATINC(TCP_STAT_RCVSHORT);
818 return IPPROTO_DONE;
819 }
820 }
821 ip6 = mtod(m, struct ip6_hdr *);
822 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
823 (char *)&ip6->ip6_dst - (char *)ip6);
824 return IPPROTO_DONE;
825 }
826
827 tcp_input(m, *offp, proto);
828 return IPPROTO_DONE;
829 }
830 #endif
831
832 static void
tcp4_log_refused(const struct ip * ip,const struct tcphdr * th)833 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
834 {
835 char src[INET_ADDRSTRLEN];
836 char dst[INET_ADDRSTRLEN];
837
838 if (ip) {
839 in_print(src, sizeof(src), &ip->ip_src);
840 in_print(dst, sizeof(dst), &ip->ip_dst);
841 } else {
842 strlcpy(src, "(unknown)", sizeof(src));
843 strlcpy(dst, "(unknown)", sizeof(dst));
844 }
845 log(LOG_INFO,
846 "Connection attempt to TCP %s:%d from %s:%d\n",
847 dst, ntohs(th->th_dport),
848 src, ntohs(th->th_sport));
849 }
850
851 #ifdef INET6
852 static void
tcp6_log_refused(const struct ip6_hdr * ip6,const struct tcphdr * th)853 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
854 {
855 char src[INET6_ADDRSTRLEN];
856 char dst[INET6_ADDRSTRLEN];
857
858 if (ip6) {
859 in6_print(src, sizeof(src), &ip6->ip6_src);
860 in6_print(dst, sizeof(dst), &ip6->ip6_dst);
861 } else {
862 strlcpy(src, "(unknown v6)", sizeof(src));
863 strlcpy(dst, "(unknown v6)", sizeof(dst));
864 }
865 log(LOG_INFO,
866 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
867 dst, ntohs(th->th_dport),
868 src, ntohs(th->th_sport));
869 }
870 #endif
871
872 /*
873 * Checksum extended TCP header and data.
874 */
875 int
tcp_input_checksum(int af,struct mbuf * m,const struct tcphdr * th,int toff,int off,int tlen)876 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
877 int toff, int off, int tlen)
878 {
879 struct ifnet *rcvif;
880 int s;
881
882 /*
883 * XXX it's better to record and check if this mbuf is
884 * already checked.
885 */
886
887 rcvif = m_get_rcvif(m, &s);
888 if (__predict_false(rcvif == NULL))
889 goto badcsum; /* XXX */
890
891 switch (af) {
892 case AF_INET:
893 switch (m->m_pkthdr.csum_flags &
894 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
895 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
896 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
897 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
898 goto badcsum;
899
900 case M_CSUM_TCPv4|M_CSUM_DATA: {
901 u_int32_t hw_csum = m->m_pkthdr.csum_data;
902
903 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
904 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
905 const struct ip *ip =
906 mtod(m, const struct ip *);
907
908 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
909 ip->ip_dst.s_addr,
910 htons(hw_csum + tlen + off + IPPROTO_TCP));
911 }
912 if ((hw_csum ^ 0xffff) != 0)
913 goto badcsum;
914 break;
915 }
916
917 case M_CSUM_TCPv4:
918 /* Checksum was okay. */
919 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
920 break;
921
922 default:
923 /*
924 * Must compute it ourselves. Maybe skip checksum
925 * on loopback interfaces.
926 */
927 if (__predict_true(!(rcvif->if_flags & IFF_LOOPBACK) ||
928 tcp_do_loopback_cksum)) {
929 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
930 if (in4_cksum(m, IPPROTO_TCP, toff,
931 tlen + off) != 0)
932 goto badcsum;
933 }
934 break;
935 }
936 break;
937
938 #ifdef INET6
939 case AF_INET6:
940 switch (m->m_pkthdr.csum_flags &
941 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
942 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
943 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
944 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
945 goto badcsum;
946
947 #if 0 /* notyet */
948 case M_CSUM_TCPv6|M_CSUM_DATA:
949 #endif
950
951 case M_CSUM_TCPv6:
952 /* Checksum was okay. */
953 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
954 break;
955
956 default:
957 /*
958 * Must compute it ourselves. Maybe skip checksum
959 * on loopback interfaces.
960 */
961 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
962 tcp_do_loopback_cksum)) {
963 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
964 if (in6_cksum(m, IPPROTO_TCP, toff,
965 tlen + off) != 0)
966 goto badcsum;
967 }
968 }
969 break;
970 #endif /* INET6 */
971 }
972 m_put_rcvif(rcvif, &s);
973
974 return 0;
975
976 badcsum:
977 m_put_rcvif(rcvif, &s);
978 TCP_STATINC(TCP_STAT_RCVBADSUM);
979 return -1;
980 }
981
982 /*
983 * When a packet arrives addressed to a vestigial tcpbp, we
984 * nevertheless have to respond to it per the spec.
985 *
986 * This code is duplicated from the one in tcp_input().
987 */
tcp_vtw_input(struct tcphdr * th,vestigial_inpcb_t * vp,struct mbuf * m,int tlen)988 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp,
989 struct mbuf *m, int tlen)
990 {
991 int tiflags;
992 int todrop;
993 uint32_t t_flags = 0;
994 net_stat_ref_t tcps;
995
996 tiflags = th->th_flags;
997 todrop = vp->rcv_nxt - th->th_seq;
998
999 if (todrop > 0) {
1000 if (tiflags & TH_SYN) {
1001 tiflags &= ~TH_SYN;
1002 th->th_seq++;
1003 tcp_urp_drop(th, 1, &tiflags);
1004 todrop--;
1005 }
1006 if (todrop > tlen ||
1007 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1008 /*
1009 * Any valid FIN or RST must be to the left of the
1010 * window. At this point the FIN or RST must be a
1011 * duplicate or out of sequence; drop it.
1012 */
1013 if (tiflags & TH_RST)
1014 goto drop;
1015 tiflags &= ~(TH_FIN|TH_RST);
1016
1017 /*
1018 * Send an ACK to resynchronize and drop any data.
1019 * But keep on processing for RST or ACK.
1020 */
1021 t_flags |= TF_ACKNOW;
1022 todrop = tlen;
1023 tcps = TCP_STAT_GETREF();
1024 _NET_STATINC_REF(tcps, TCP_STAT_RCVDUPPACK);
1025 _NET_STATADD_REF(tcps, TCP_STAT_RCVDUPBYTE, todrop);
1026 TCP_STAT_PUTREF();
1027 } else if ((tiflags & TH_RST) &&
1028 th->th_seq != vp->rcv_nxt) {
1029 /*
1030 * Test for reset before adjusting the sequence
1031 * number for overlapping data.
1032 */
1033 goto dropafterack_ratelim;
1034 } else {
1035 tcps = TCP_STAT_GETREF();
1036 _NET_STATINC_REF(tcps, TCP_STAT_RCVPARTDUPPACK);
1037 _NET_STATADD_REF(tcps, TCP_STAT_RCVPARTDUPBYTE,
1038 todrop);
1039 TCP_STAT_PUTREF();
1040 }
1041
1042 // tcp_new_dsack(tp, th->th_seq, todrop);
1043 // hdroptlen += todrop; /*drop from head afterwards*/
1044
1045 th->th_seq += todrop;
1046 tlen -= todrop;
1047 tcp_urp_drop(th, todrop, &tiflags);
1048 }
1049
1050 /*
1051 * If new data are received on a connection after the
1052 * user processes are gone, then RST the other end.
1053 */
1054 if (tlen) {
1055 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
1056 goto dropwithreset;
1057 }
1058
1059 /*
1060 * If segment ends after window, drop trailing data
1061 * (and PUSH and FIN); if nothing left, just ACK.
1062 */
1063 todrop = (th->th_seq + tlen) - (vp->rcv_nxt + vp->rcv_wnd);
1064
1065 if (todrop > 0) {
1066 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
1067 if (todrop >= tlen) {
1068 /*
1069 * The segment actually starts after the window.
1070 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen
1071 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0
1072 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd
1073 */
1074 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
1075
1076 /*
1077 * If a new connection request is received
1078 * while in TIME_WAIT, drop the old connection
1079 * and start over if the sequence numbers
1080 * are above the previous ones.
1081 */
1082 if ((tiflags & TH_SYN) &&
1083 SEQ_GT(th->th_seq, vp->rcv_nxt)) {
1084 /*
1085 * We only support this in the !NOFDREF case, which
1086 * is to say: not here.
1087 */
1088 goto dropwithreset;
1089 }
1090
1091 /*
1092 * If window is closed can only take segments at
1093 * window edge, and have to drop data and PUSH from
1094 * incoming segments. Continue processing, but
1095 * remember to ack. Otherwise, drop segment
1096 * and (if not RST) ack.
1097 */
1098 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) {
1099 t_flags |= TF_ACKNOW;
1100 TCP_STATINC(TCP_STAT_RCVWINPROBE);
1101 } else {
1102 goto dropafterack;
1103 }
1104 } else {
1105 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
1106 }
1107 m_adj(m, -todrop);
1108 tlen -= todrop;
1109 tiflags &= ~(TH_PUSH|TH_FIN);
1110 }
1111
1112 if (tiflags & TH_RST) {
1113 if (th->th_seq != vp->rcv_nxt)
1114 goto dropafterack_ratelim;
1115
1116 vtw_del(vp->ctl, vp->vtw);
1117 goto drop;
1118 }
1119
1120 /*
1121 * If the ACK bit is off we drop the segment and return.
1122 */
1123 if ((tiflags & TH_ACK) == 0) {
1124 if (t_flags & TF_ACKNOW)
1125 goto dropafterack;
1126 goto drop;
1127 }
1128
1129 /*
1130 * In TIME_WAIT state the only thing that should arrive
1131 * is a retransmission of the remote FIN. Acknowledge
1132 * it and restart the finack timer.
1133 */
1134 vtw_restart(vp);
1135 goto dropafterack;
1136
1137 dropafterack:
1138 /*
1139 * Generate an ACK dropping incoming segment if it occupies
1140 * sequence space, where the ACK reflects our state.
1141 */
1142 if (tiflags & TH_RST)
1143 goto drop;
1144 goto dropafterack2;
1145
1146 dropafterack_ratelim:
1147 /*
1148 * We may want to rate-limit ACKs against SYN/RST attack.
1149 */
1150 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
1151 tcp_ackdrop_ppslim) == 0) {
1152 /* XXX stat */
1153 goto drop;
1154 }
1155 /* ...fall into dropafterack2... */
1156
1157 dropafterack2:
1158 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack, TH_ACK);
1159 return;
1160
1161 dropwithreset:
1162 /*
1163 * Generate a RST, dropping incoming segment.
1164 * Make ACK acceptable to originator of segment.
1165 */
1166 if (tiflags & TH_RST)
1167 goto drop;
1168
1169 if (tiflags & TH_ACK) {
1170 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
1171 } else {
1172 if (tiflags & TH_SYN)
1173 ++tlen;
1174 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0,
1175 TH_RST|TH_ACK);
1176 }
1177 return;
1178 drop:
1179 m_freem(m);
1180 }
1181
1182 /*
1183 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
1184 */
1185 void
tcp_input(struct mbuf * m,int off,int proto)1186 tcp_input(struct mbuf *m, int off, int proto)
1187 {
1188 struct tcphdr *th;
1189 struct ip *ip;
1190 struct inpcb *inp;
1191 #ifdef INET6
1192 struct ip6_hdr *ip6;
1193 #endif
1194 u_int8_t *optp = NULL;
1195 int optlen = 0;
1196 int len, tlen, hdroptlen = 0;
1197 struct tcpcb *tp = NULL;
1198 int tiflags;
1199 struct socket *so = NULL;
1200 int todrop, acked, ourfinisacked, needoutput = 0;
1201 bool dupseg;
1202 #ifdef TCP_DEBUG
1203 short ostate = 0;
1204 #endif
1205 u_long tiwin;
1206 struct tcp_opt_info opti;
1207 int thlen, iphlen;
1208 int af; /* af on the wire */
1209 struct mbuf *tcp_saveti = NULL;
1210 uint32_t ts_rtt;
1211 uint8_t iptos;
1212 net_stat_ref_t tcps;
1213 vestigial_inpcb_t vestige;
1214
1215 vestige.valid = 0;
1216
1217 MCLAIM(m, &tcp_rx_mowner);
1218
1219 TCP_STATINC(TCP_STAT_RCVTOTAL);
1220
1221 memset(&opti, 0, sizeof(opti));
1222 opti.ts_present = 0;
1223 opti.maxseg = 0;
1224
1225 /*
1226 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1227 *
1228 * TCP is, by definition, unicast, so we reject all
1229 * multicast outright.
1230 *
1231 * Note, there are additional src/dst address checks in
1232 * the AF-specific code below.
1233 */
1234 if (m->m_flags & (M_BCAST|M_MCAST)) {
1235 /* XXX stat */
1236 goto drop;
1237 }
1238 #ifdef INET6
1239 if (m->m_flags & M_ANYCAST6) {
1240 /* XXX stat */
1241 goto drop;
1242 }
1243 #endif
1244
1245 M_REGION_GET(th, struct tcphdr *, m, off, sizeof(struct tcphdr));
1246 if (th == NULL) {
1247 TCP_STATINC(TCP_STAT_RCVSHORT);
1248 return;
1249 }
1250
1251 /*
1252 * Enforce alignment requirements that are violated in
1253 * some cases, see kern/50766 for details.
1254 */
1255 if (ACCESSIBLE_POINTER(th, struct tcphdr) == 0) {
1256 m = m_copyup(m, off + sizeof(struct tcphdr), 0);
1257 if (m == NULL) {
1258 TCP_STATINC(TCP_STAT_RCVSHORT);
1259 return;
1260 }
1261 th = (struct tcphdr *)(mtod(m, char *) + off);
1262 }
1263 KASSERT(ACCESSIBLE_POINTER(th, struct tcphdr));
1264
1265 /*
1266 * Get IP and TCP header.
1267 * Note: IP leaves IP header in first mbuf.
1268 */
1269 ip = mtod(m, struct ip *);
1270 #ifdef INET6
1271 ip6 = mtod(m, struct ip6_hdr *);
1272 #endif
1273 switch (ip->ip_v) {
1274 case 4:
1275 af = AF_INET;
1276 iphlen = sizeof(struct ip);
1277
1278 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1279 in_broadcast(ip->ip_dst, m_get_rcvif_NOMPSAFE(m)))
1280 goto drop;
1281
1282 /* We do the checksum after PCB lookup... */
1283 len = ntohs(ip->ip_len);
1284 tlen = len - off;
1285 iptos = ip->ip_tos;
1286 break;
1287 #ifdef INET6
1288 case 6:
1289 iphlen = sizeof(struct ip6_hdr);
1290 af = AF_INET6;
1291
1292 /*
1293 * Be proactive about unspecified IPv6 address in source.
1294 * As we use all-zero to indicate unbounded/unconnected pcb,
1295 * unspecified IPv6 address can be used to confuse us.
1296 *
1297 * Note that packets with unspecified IPv6 destination is
1298 * already dropped in ip6_input.
1299 */
1300 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1301 /* XXX stat */
1302 goto drop;
1303 }
1304
1305 /*
1306 * Make sure destination address is not multicast.
1307 * Source address checked in ip6_input().
1308 */
1309 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1310 /* XXX stat */
1311 goto drop;
1312 }
1313
1314 /* We do the checksum after PCB lookup... */
1315 len = m->m_pkthdr.len;
1316 tlen = len - off;
1317 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1318 break;
1319 #endif
1320 default:
1321 m_freem(m);
1322 return;
1323 }
1324
1325
1326 /*
1327 * Check that TCP offset makes sense, pull out TCP options and
1328 * adjust length.
1329 */
1330 thlen = th->th_off << 2;
1331 if (thlen < sizeof(struct tcphdr) || thlen > tlen) {
1332 TCP_STATINC(TCP_STAT_RCVBADOFF);
1333 goto drop;
1334 }
1335 tlen -= thlen;
1336
1337 if (thlen > sizeof(struct tcphdr)) {
1338 M_REGION_GET(th, struct tcphdr *, m, off, thlen);
1339 if (th == NULL) {
1340 TCP_STATINC(TCP_STAT_RCVSHORT);
1341 return;
1342 }
1343 KASSERT(ACCESSIBLE_POINTER(th, struct tcphdr));
1344 optlen = thlen - sizeof(struct tcphdr);
1345 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1346
1347 /*
1348 * Do quick retrieval of timestamp options.
1349 *
1350 * If timestamp is the only option and it's formatted as
1351 * recommended in RFC 1323 appendix A, we quickly get the
1352 * values now and don't bother calling tcp_dooptions(),
1353 * etc.
1354 */
1355 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1356 (optlen > TCPOLEN_TSTAMP_APPA &&
1357 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1358 be32dec(optp) == TCPOPT_TSTAMP_HDR &&
1359 (th->th_flags & TH_SYN) == 0) {
1360 opti.ts_present = 1;
1361 opti.ts_val = be32dec(optp + 4);
1362 opti.ts_ecr = be32dec(optp + 8);
1363 optp = NULL; /* we've parsed the options */
1364 }
1365 }
1366 tiflags = th->th_flags;
1367
1368 /*
1369 * Checksum extended TCP header and data
1370 */
1371 if (tcp_input_checksum(af, m, th, off, thlen, tlen))
1372 goto badcsum;
1373
1374 /*
1375 * Locate pcb for segment.
1376 */
1377 findpcb:
1378 inp = NULL;
1379 switch (af) {
1380 case AF_INET:
1381 inp = inpcb_lookup(&tcbtable, ip->ip_src, th->th_sport,
1382 ip->ip_dst, th->th_dport, &vestige);
1383 if (inp == NULL && !vestige.valid) {
1384 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1385 inp = inpcb_lookup_bound(&tcbtable, ip->ip_dst,
1386 th->th_dport);
1387 }
1388 #ifdef INET6
1389 if (inp == NULL && !vestige.valid) {
1390 struct in6_addr s, d;
1391
1392 /* mapped addr case */
1393 in6_in_2_v4mapin6(&ip->ip_src, &s);
1394 in6_in_2_v4mapin6(&ip->ip_dst, &d);
1395 inp = in6pcb_lookup(&tcbtable, &s,
1396 th->th_sport, &d, th->th_dport, 0, &vestige);
1397 if (inp == NULL && !vestige.valid) {
1398 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1399 inp = in6pcb_lookup_bound(&tcbtable, &d,
1400 th->th_dport, 0);
1401 }
1402 }
1403 #endif
1404 if (inp == NULL && !vestige.valid) {
1405 TCP_STATINC(TCP_STAT_NOPORT);
1406 if (tcp_log_refused &&
1407 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1408 tcp4_log_refused(ip, th);
1409 }
1410 tcp_fields_to_host(th);
1411 goto dropwithreset_ratelim;
1412 }
1413 #if defined(IPSEC)
1414 if (ipsec_used) {
1415 if (inp && ipsec_in_reject(m, inp))
1416 goto drop;
1417 }
1418 #endif /*IPSEC*/
1419 break;
1420 #ifdef INET6
1421 case AF_INET6:
1422 {
1423 int faith;
1424
1425 #if defined(NFAITH) && NFAITH > 0
1426 faith = faithprefix(&ip6->ip6_dst);
1427 #else
1428 faith = 0;
1429 #endif
1430 inp = in6pcb_lookup(&tcbtable, &ip6->ip6_src,
1431 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige);
1432 if (inp == NULL && !vestige.valid) {
1433 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1434 inp = in6pcb_lookup_bound(&tcbtable, &ip6->ip6_dst,
1435 th->th_dport, faith);
1436 }
1437 if (inp == NULL && !vestige.valid) {
1438 TCP_STATINC(TCP_STAT_NOPORT);
1439 if (tcp_log_refused &&
1440 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1441 tcp6_log_refused(ip6, th);
1442 }
1443 tcp_fields_to_host(th);
1444 goto dropwithreset_ratelim;
1445 }
1446 #if defined(IPSEC)
1447 if (ipsec_used && inp && ipsec_in_reject(m, inp))
1448 goto drop;
1449 #endif
1450 break;
1451 }
1452 #endif
1453 }
1454
1455 tcp_fields_to_host(th);
1456
1457 /*
1458 * If the state is CLOSED (i.e., TCB does not exist) then
1459 * all data in the incoming segment is discarded.
1460 * If the TCB exists but is in CLOSED state, it is embryonic,
1461 * but should either do a listen or a connect soon.
1462 */
1463 tp = NULL;
1464 so = NULL;
1465 if (inp) {
1466 /* Check the minimum TTL for socket. */
1467 if (inp->inp_af == AF_INET && ip->ip_ttl < in4p_ip_minttl(inp))
1468 goto drop;
1469
1470 tp = intotcpcb(inp);
1471 so = inp->inp_socket;
1472 } else if (vestige.valid) {
1473 /* We do not support the resurrection of vtw tcpcps. */
1474 tcp_vtw_input(th, &vestige, m, tlen);
1475 m = NULL;
1476 goto drop;
1477 }
1478
1479 if (tp == NULL)
1480 goto dropwithreset_ratelim;
1481 if (tp->t_state == TCPS_CLOSED)
1482 goto drop;
1483
1484 KASSERT(so->so_lock == softnet_lock);
1485 KASSERT(solocked(so));
1486
1487 /* Unscale the window into a 32-bit value. */
1488 if ((tiflags & TH_SYN) == 0)
1489 tiwin = th->th_win << tp->snd_scale;
1490 else
1491 tiwin = th->th_win;
1492
1493 #ifdef INET6
1494 /* save packet options if user wanted */
1495 if (inp->inp_af == AF_INET6 && (inp->inp_flags & IN6P_CONTROLOPTS)) {
1496 m_freem(inp->inp_options);
1497 inp->inp_options = NULL;
1498 ip6_savecontrol(inp, &inp->inp_options, ip6, m);
1499 }
1500 #endif
1501
1502 if (so->so_options & SO_DEBUG) {
1503 #ifdef TCP_DEBUG
1504 ostate = tp->t_state;
1505 #endif
1506
1507 tcp_saveti = NULL;
1508 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1509 goto nosave;
1510
1511 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1512 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1513 if (tcp_saveti == NULL)
1514 goto nosave;
1515 } else {
1516 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1517 if (tcp_saveti == NULL)
1518 goto nosave;
1519 MCLAIM(m, &tcp_mowner);
1520 tcp_saveti->m_len = iphlen;
1521 m_copydata(m, 0, iphlen,
1522 mtod(tcp_saveti, void *));
1523 }
1524
1525 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1526 m_freem(tcp_saveti);
1527 tcp_saveti = NULL;
1528 } else {
1529 tcp_saveti->m_len += sizeof(struct tcphdr);
1530 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1531 sizeof(struct tcphdr));
1532 }
1533 nosave:;
1534 }
1535
1536 if (so->so_options & SO_ACCEPTCONN) {
1537 union syn_cache_sa src;
1538 union syn_cache_sa dst;
1539
1540 KASSERT(tp->t_state == TCPS_LISTEN);
1541
1542 memset(&src, 0, sizeof(src));
1543 memset(&dst, 0, sizeof(dst));
1544 switch (af) {
1545 case AF_INET:
1546 src.sin.sin_len = sizeof(struct sockaddr_in);
1547 src.sin.sin_family = AF_INET;
1548 src.sin.sin_addr = ip->ip_src;
1549 src.sin.sin_port = th->th_sport;
1550
1551 dst.sin.sin_len = sizeof(struct sockaddr_in);
1552 dst.sin.sin_family = AF_INET;
1553 dst.sin.sin_addr = ip->ip_dst;
1554 dst.sin.sin_port = th->th_dport;
1555 break;
1556 #ifdef INET6
1557 case AF_INET6:
1558 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1559 src.sin6.sin6_family = AF_INET6;
1560 src.sin6.sin6_addr = ip6->ip6_src;
1561 src.sin6.sin6_port = th->th_sport;
1562
1563 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1564 dst.sin6.sin6_family = AF_INET6;
1565 dst.sin6.sin6_addr = ip6->ip6_dst;
1566 dst.sin6.sin6_port = th->th_dport;
1567 break;
1568 #endif
1569 }
1570
1571 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1572 if (tiflags & TH_RST) {
1573 syn_cache_reset(&src.sa, &dst.sa, th);
1574 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1575 (TH_ACK|TH_SYN)) {
1576 /*
1577 * Received a SYN,ACK. This should never
1578 * happen while we are in LISTEN. Send an RST.
1579 */
1580 goto badsyn;
1581 } else if (tiflags & TH_ACK) {
1582 so = syn_cache_get(&src.sa, &dst.sa, th, so, m);
1583 if (so == NULL) {
1584 /*
1585 * We don't have a SYN for this ACK;
1586 * send an RST.
1587 */
1588 goto badsyn;
1589 } else if (so == (struct socket *)(-1)) {
1590 /*
1591 * We were unable to create the
1592 * connection. If the 3-way handshake
1593 * was completed, and RST has been
1594 * sent to the peer. Since the mbuf
1595 * might be in use for the reply, do
1596 * not free it.
1597 */
1598 m = NULL;
1599 } else {
1600 /*
1601 * We have created a full-blown
1602 * connection.
1603 */
1604 inp = sotoinpcb(so);
1605 tp = intotcpcb(inp);
1606 if (tp == NULL)
1607 goto badsyn; /*XXX*/
1608 tiwin <<= tp->snd_scale;
1609 goto after_listen;
1610 }
1611 } else {
1612 /*
1613 * None of RST, SYN or ACK was set.
1614 * This is an invalid packet for a
1615 * TCB in LISTEN state. Send a RST.
1616 */
1617 goto badsyn;
1618 }
1619 } else {
1620 /*
1621 * Received a SYN.
1622 */
1623
1624 #ifdef INET6
1625 /*
1626 * If deprecated address is forbidden, we do
1627 * not accept SYN to deprecated interface
1628 * address to prevent any new inbound
1629 * connection from getting established.
1630 * When we do not accept SYN, we send a TCP
1631 * RST, with deprecated source address (instead
1632 * of dropping it). We compromise it as it is
1633 * much better for peer to send a RST, and
1634 * RST will be the final packet for the
1635 * exchange.
1636 *
1637 * If we do not forbid deprecated addresses, we
1638 * accept the SYN packet. RFC2462 does not
1639 * suggest dropping SYN in this case.
1640 * If we decipher RFC2462 5.5.4, it says like
1641 * this:
1642 * 1. use of deprecated addr with existing
1643 * communication is okay - "SHOULD continue
1644 * to be used"
1645 * 2. use of it with new communication:
1646 * (2a) "SHOULD NOT be used if alternate
1647 * address with sufficient scope is
1648 * available"
1649 * (2b) nothing mentioned otherwise.
1650 * Here we fall into (2b) case as we have no
1651 * choice in our source address selection - we
1652 * must obey the peer.
1653 *
1654 * The wording in RFC2462 is confusing, and
1655 * there are multiple description text for
1656 * deprecated address handling - worse, they
1657 * are not exactly the same. I believe 5.5.4
1658 * is the best one, so we follow 5.5.4.
1659 */
1660 if (af == AF_INET6 && !ip6_use_deprecated) {
1661 struct in6_ifaddr *ia6;
1662 int s;
1663 struct ifnet *rcvif = m_get_rcvif(m, &s);
1664 if (rcvif == NULL)
1665 goto dropwithreset; /* XXX */
1666 if ((ia6 = in6ifa_ifpwithaddr(rcvif,
1667 &ip6->ip6_dst)) &&
1668 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1669 tp = NULL;
1670 m_put_rcvif(rcvif, &s);
1671 goto dropwithreset;
1672 }
1673 m_put_rcvif(rcvif, &s);
1674 }
1675 #endif
1676
1677 /*
1678 * LISTEN socket received a SYN from itself? This
1679 * can't possibly be valid; drop the packet.
1680 */
1681 if (th->th_sport == th->th_dport) {
1682 int eq = 0;
1683
1684 switch (af) {
1685 case AF_INET:
1686 eq = in_hosteq(ip->ip_src, ip->ip_dst);
1687 break;
1688 #ifdef INET6
1689 case AF_INET6:
1690 eq = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src,
1691 &ip6->ip6_dst);
1692 break;
1693 #endif
1694 }
1695 if (eq) {
1696 TCP_STATINC(TCP_STAT_BADSYN);
1697 goto drop;
1698 }
1699 }
1700
1701 /*
1702 * SYN looks ok; create compressed TCP
1703 * state for it.
1704 */
1705 if (so->so_qlen <= so->so_qlimit &&
1706 syn_cache_add(&src.sa, &dst.sa, th, off,
1707 so, m, optp, optlen, &opti))
1708 m = NULL;
1709 }
1710
1711 goto drop;
1712 }
1713
1714 after_listen:
1715 /*
1716 * From here on, we're dealing with !LISTEN.
1717 */
1718 KASSERT(tp->t_state != TCPS_LISTEN);
1719
1720 /*
1721 * Segment received on connection.
1722 * Reset idle time and keep-alive timer.
1723 */
1724 tp->t_rcvtime = tcp_now;
1725 if (TCPS_HAVEESTABLISHED(tp->t_state))
1726 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1727
1728 /*
1729 * Process options.
1730 */
1731 #ifdef TCP_SIGNATURE
1732 if (optp || (tp->t_flags & TF_SIGNATURE))
1733 #else
1734 if (optp)
1735 #endif
1736 if (tcp_dooptions(tp, optp, optlen, th, m, off, &opti) < 0)
1737 goto drop;
1738
1739 if (TCP_SACK_ENABLED(tp)) {
1740 tcp_del_sackholes(tp, th);
1741 }
1742
1743 if (TCP_ECN_ALLOWED(tp)) {
1744 if (tiflags & TH_CWR) {
1745 tp->t_flags &= ~TF_ECN_SND_ECE;
1746 }
1747 switch (iptos & IPTOS_ECN_MASK) {
1748 case IPTOS_ECN_CE:
1749 tp->t_flags |= TF_ECN_SND_ECE;
1750 TCP_STATINC(TCP_STAT_ECN_CE);
1751 break;
1752 case IPTOS_ECN_ECT0:
1753 TCP_STATINC(TCP_STAT_ECN_ECT);
1754 break;
1755 case IPTOS_ECN_ECT1:
1756 /* XXX: ignore for now -- rpaulo */
1757 break;
1758 }
1759 /*
1760 * Congestion experienced.
1761 * Ignore if we are already trying to recover.
1762 */
1763 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1764 tp->t_congctl->cong_exp(tp);
1765 }
1766
1767 if (opti.ts_present && opti.ts_ecr) {
1768 /*
1769 * Calculate the RTT from the returned time stamp and the
1770 * connection's time base. If the time stamp is later than
1771 * the current time, or is extremely old, fall back to non-1323
1772 * RTT calculation. Since ts_rtt is unsigned, we can test both
1773 * at the same time.
1774 *
1775 * Note that ts_rtt is in units of slow ticks (500
1776 * ms). Since most earthbound RTTs are < 500 ms,
1777 * observed values will have large quantization noise.
1778 * Our smoothed RTT is then the fraction of observed
1779 * samples that are 1 tick instead of 0 (times 500
1780 * ms).
1781 *
1782 * ts_rtt is increased by 1 to denote a valid sample,
1783 * with 0 indicating an invalid measurement. This
1784 * extra 1 must be removed when ts_rtt is used, or
1785 * else an erroneous extra 500 ms will result.
1786 */
1787 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1788 if (ts_rtt > TCP_PAWS_IDLE)
1789 ts_rtt = 0;
1790 } else {
1791 ts_rtt = 0;
1792 }
1793
1794 /*
1795 * Fast path: check for the two common cases of a uni-directional
1796 * data transfer. If:
1797 * o We are in the ESTABLISHED state, and
1798 * o The packet has no control flags, and
1799 * o The packet is in-sequence, and
1800 * o The window didn't change, and
1801 * o We are not retransmitting
1802 * It's a candidate.
1803 *
1804 * If the length (tlen) is zero and the ack moved forward, we're
1805 * the sender side of the transfer. Just free the data acked and
1806 * wake any higher level process that was blocked waiting for
1807 * space.
1808 *
1809 * If the length is non-zero and the ack didn't move, we're the
1810 * receiver side. If we're getting packets in-order (the reassembly
1811 * queue is empty), add the data to the socket buffer and note
1812 * that we need a delayed ack.
1813 */
1814 if (tp->t_state == TCPS_ESTABLISHED &&
1815 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1816 == TH_ACK &&
1817 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1818 th->th_seq == tp->rcv_nxt &&
1819 tiwin && tiwin == tp->snd_wnd &&
1820 tp->snd_nxt == tp->snd_max) {
1821
1822 /*
1823 * If last ACK falls within this segment's sequence numbers,
1824 * record the timestamp.
1825 * NOTE that the test is modified according to the latest
1826 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1827 *
1828 * note that we already know
1829 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1830 */
1831 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1832 tp->ts_recent_age = tcp_now;
1833 tp->ts_recent = opti.ts_val;
1834 }
1835
1836 if (tlen == 0) {
1837 /* Ack prediction. */
1838 if (SEQ_GT(th->th_ack, tp->snd_una) &&
1839 SEQ_LEQ(th->th_ack, tp->snd_max) &&
1840 tp->snd_cwnd >= tp->snd_wnd &&
1841 tp->t_partialacks < 0) {
1842 /*
1843 * this is a pure ack for outstanding data.
1844 */
1845 if (ts_rtt)
1846 tcp_xmit_timer(tp, ts_rtt - 1);
1847 else if (tp->t_rtttime &&
1848 SEQ_GT(th->th_ack, tp->t_rtseq))
1849 tcp_xmit_timer(tp,
1850 tcp_now - tp->t_rtttime);
1851 acked = th->th_ack - tp->snd_una;
1852 tcps = TCP_STAT_GETREF();
1853 _NET_STATINC_REF(tcps, TCP_STAT_PREDACK);
1854 _NET_STATINC_REF(tcps, TCP_STAT_RCVACKPACK);
1855 _NET_STATADD_REF(tcps, TCP_STAT_RCVACKBYTE,
1856 acked);
1857 TCP_STAT_PUTREF();
1858 nd_hint(tp);
1859
1860 if (acked > (tp->t_lastoff - tp->t_inoff))
1861 tp->t_lastm = NULL;
1862 sbdrop(&so->so_snd, acked);
1863 tp->t_lastoff -= acked;
1864
1865 icmp_check(tp, th, acked);
1866
1867 tp->snd_una = th->th_ack;
1868 tp->snd_fack = tp->snd_una;
1869 if (SEQ_LT(tp->snd_high, tp->snd_una))
1870 tp->snd_high = tp->snd_una;
1871 /*
1872 * drag snd_wl2 along so only newer
1873 * ACKs can update the window size.
1874 * also avoids the state where snd_wl2
1875 * is eventually larger than th_ack and thus
1876 * blocking the window update mechanism and
1877 * the connection gets stuck for a loooong
1878 * time in the zero sized send window state.
1879 *
1880 * see PR/kern 55567
1881 */
1882 tp->snd_wl2 = tp->snd_una;
1883
1884 m_freem(m);
1885
1886 /*
1887 * If all outstanding data are acked, stop
1888 * retransmit timer, otherwise restart timer
1889 * using current (possibly backed-off) value.
1890 * If process is waiting for space,
1891 * wakeup/selnotify/signal. If data
1892 * are ready to send, let tcp_output
1893 * decide between more output or persist.
1894 */
1895 if (tp->snd_una == tp->snd_max)
1896 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1897 else if (TCP_TIMER_ISARMED(tp,
1898 TCPT_PERSIST) == 0)
1899 TCP_TIMER_ARM(tp, TCPT_REXMT,
1900 tp->t_rxtcur);
1901
1902 sowwakeup(so);
1903 if (so->so_snd.sb_cc) {
1904 KERNEL_LOCK(1, NULL);
1905 (void)tcp_output(tp);
1906 KERNEL_UNLOCK_ONE(NULL);
1907 }
1908 m_freem(tcp_saveti);
1909 return;
1910 }
1911 } else if (th->th_ack == tp->snd_una &&
1912 TAILQ_FIRST(&tp->segq) == NULL &&
1913 tlen <= sbspace(&so->so_rcv)) {
1914 int newsize = 0;
1915
1916 /*
1917 * this is a pure, in-sequence data packet
1918 * with nothing on the reassembly queue and
1919 * we have enough buffer space to take it.
1920 */
1921 tp->rcv_nxt += tlen;
1922
1923 /*
1924 * Pull rcv_up up to prevent seq wrap relative to
1925 * rcv_nxt.
1926 */
1927 tp->rcv_up = tp->rcv_nxt;
1928
1929 /*
1930 * Pull snd_wl1 up to prevent seq wrap relative to
1931 * th_seq.
1932 */
1933 tp->snd_wl1 = th->th_seq;
1934
1935 tcps = TCP_STAT_GETREF();
1936 _NET_STATINC_REF(tcps, TCP_STAT_PREDDAT);
1937 _NET_STATINC_REF(tcps, TCP_STAT_RCVPACK);
1938 _NET_STATADD_REF(tcps, TCP_STAT_RCVBYTE, tlen);
1939 TCP_STAT_PUTREF();
1940 nd_hint(tp);
1941 /*
1942 * Automatic sizing enables the performance of large buffers
1943 * and most of the efficiency of small ones by only allocating
1944 * space when it is needed.
1945 *
1946 * On the receive side the socket buffer memory is only rarely
1947 * used to any significant extent. This allows us to be much
1948 * more aggressive in scaling the receive socket buffer. For
1949 * the case that the buffer space is actually used to a large
1950 * extent and we run out of kernel memory we can simply drop
1951 * the new segments; TCP on the sender will just retransmit it
1952 * later. Setting the buffer size too big may only consume too
1953 * much kernel memory if the application doesn't read() from
1954 * the socket or packet loss or reordering makes use of the
1955 * reassembly queue.
1956 *
1957 * The criteria to step up the receive buffer one notch are:
1958 * 1. the number of bytes received during the time it takes
1959 * one timestamp to be reflected back to us (the RTT);
1960 * 2. received bytes per RTT is within seven eighth of the
1961 * current socket buffer size;
1962 * 3. receive buffer size has not hit maximal automatic size;
1963 *
1964 * This algorithm does one step per RTT at most and only if
1965 * we receive a bulk stream w/o packet losses or reorderings.
1966 * Shrinking the buffer during idle times is not necessary as
1967 * it doesn't consume any memory when idle.
1968 *
1969 * TODO: Only step up if the application is actually serving
1970 * the buffer to better manage the socket buffer resources.
1971 */
1972 if (tcp_do_autorcvbuf &&
1973 opti.ts_ecr &&
1974 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
1975 if (opti.ts_ecr > tp->rfbuf_ts &&
1976 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
1977 if (tp->rfbuf_cnt >
1978 (so->so_rcv.sb_hiwat / 8 * 7) &&
1979 so->so_rcv.sb_hiwat <
1980 tcp_autorcvbuf_max) {
1981 newsize =
1982 uimin(so->so_rcv.sb_hiwat +
1983 tcp_autorcvbuf_inc,
1984 tcp_autorcvbuf_max);
1985 }
1986 /* Start over with next RTT. */
1987 tp->rfbuf_ts = 0;
1988 tp->rfbuf_cnt = 0;
1989 } else
1990 tp->rfbuf_cnt += tlen; /* add up */
1991 }
1992
1993 /*
1994 * Drop TCP, IP headers and TCP options then add data
1995 * to socket buffer.
1996 */
1997 if (so->so_state & SS_CANTRCVMORE) {
1998 m_freem(m);
1999 } else {
2000 /*
2001 * Set new socket buffer size.
2002 * Give up when limit is reached.
2003 */
2004 if (newsize)
2005 if (!sbreserve(&so->so_rcv,
2006 newsize, so))
2007 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
2008 m_adj(m, off + thlen);
2009 sbappendstream(&so->so_rcv, m);
2010 }
2011 sorwakeup(so);
2012 tcp_setup_ack(tp, th);
2013 if (tp->t_flags & TF_ACKNOW) {
2014 KERNEL_LOCK(1, NULL);
2015 (void)tcp_output(tp);
2016 KERNEL_UNLOCK_ONE(NULL);
2017 }
2018 m_freem(tcp_saveti);
2019 return;
2020 }
2021 }
2022
2023 /*
2024 * Compute mbuf offset to TCP data segment.
2025 */
2026 hdroptlen = off + thlen;
2027
2028 /*
2029 * Calculate amount of space in receive window. Receive window is
2030 * amount of space in rcv queue, but not less than advertised
2031 * window.
2032 */
2033 {
2034 int win;
2035 win = sbspace(&so->so_rcv);
2036 if (win < 0)
2037 win = 0;
2038 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2039 }
2040
2041 /* Reset receive buffer auto scaling when not in bulk receive mode. */
2042 tp->rfbuf_ts = 0;
2043 tp->rfbuf_cnt = 0;
2044
2045 switch (tp->t_state) {
2046 /*
2047 * If the state is SYN_SENT:
2048 * if seg contains an ACK, but not for our SYN, drop the input.
2049 * if seg contains a RST, then drop the connection.
2050 * if seg does not contain SYN, then drop it.
2051 * Otherwise this is an acceptable SYN segment
2052 * initialize tp->rcv_nxt and tp->irs
2053 * if seg contains ack then advance tp->snd_una
2054 * if seg contains a ECE and ECN support is enabled, the stream
2055 * is ECN capable.
2056 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2057 * arrange for segment to be acked (eventually)
2058 * continue processing rest of data/controls, beginning with URG
2059 */
2060 case TCPS_SYN_SENT:
2061 if ((tiflags & TH_ACK) &&
2062 (SEQ_LEQ(th->th_ack, tp->iss) ||
2063 SEQ_GT(th->th_ack, tp->snd_max)))
2064 goto dropwithreset;
2065 if (tiflags & TH_RST) {
2066 if (tiflags & TH_ACK)
2067 tp = tcp_drop(tp, ECONNREFUSED);
2068 goto drop;
2069 }
2070 if ((tiflags & TH_SYN) == 0)
2071 goto drop;
2072 if (tiflags & TH_ACK) {
2073 tp->snd_una = th->th_ack;
2074 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2075 tp->snd_nxt = tp->snd_una;
2076 if (SEQ_LT(tp->snd_high, tp->snd_una))
2077 tp->snd_high = tp->snd_una;
2078 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2079
2080 if ((tiflags & TH_ECE) && tcp_do_ecn) {
2081 tp->t_flags |= TF_ECN_PERMIT;
2082 TCP_STATINC(TCP_STAT_ECN_SHS);
2083 }
2084 }
2085 tp->irs = th->th_seq;
2086 tcp_rcvseqinit(tp);
2087 tp->t_flags |= TF_ACKNOW;
2088 tcp_mss_from_peer(tp, opti.maxseg);
2089
2090 /*
2091 * Initialize the initial congestion window. If we
2092 * had to retransmit the SYN, we must initialize cwnd
2093 * to 1 segment (i.e. the Loss Window).
2094 */
2095 if (tp->t_flags & TF_SYN_REXMT)
2096 tp->snd_cwnd = tp->t_peermss;
2097 else {
2098 int ss = tcp_init_win;
2099 if (inp->inp_af == AF_INET && in_localaddr(in4p_faddr(inp)))
2100 ss = tcp_init_win_local;
2101 #ifdef INET6
2102 else if (inp->inp_af == AF_INET6 && in6_localaddr(&in6p_faddr(inp)))
2103 ss = tcp_init_win_local;
2104 #endif
2105 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
2106 }
2107
2108 tcp_rmx_rtt(tp);
2109 if (tiflags & TH_ACK) {
2110 TCP_STATINC(TCP_STAT_CONNECTS);
2111 /*
2112 * move tcp_established before soisconnected
2113 * because upcall handler can drive tcp_output
2114 * functionality.
2115 * XXX we might call soisconnected at the end of
2116 * all processing
2117 */
2118 tcp_established(tp);
2119 soisconnected(so);
2120 /* Do window scaling on this connection? */
2121 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2122 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2123 tp->snd_scale = tp->requested_s_scale;
2124 tp->rcv_scale = tp->request_r_scale;
2125 }
2126 TCP_REASS_LOCK(tp);
2127 (void)tcp_reass(tp, NULL, NULL, tlen);
2128 /*
2129 * if we didn't have to retransmit the SYN,
2130 * use its rtt as our initial srtt & rtt var.
2131 */
2132 if (tp->t_rtttime)
2133 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2134 } else {
2135 tp->t_state = TCPS_SYN_RECEIVED;
2136 }
2137
2138 /*
2139 * Advance th->th_seq to correspond to first data byte.
2140 * If data, trim to stay within window,
2141 * dropping FIN if necessary.
2142 */
2143 th->th_seq++;
2144 if (tlen > tp->rcv_wnd) {
2145 todrop = tlen - tp->rcv_wnd;
2146 m_adj(m, -todrop);
2147 tlen = tp->rcv_wnd;
2148 tiflags &= ~TH_FIN;
2149 tcps = TCP_STAT_GETREF();
2150 _NET_STATINC_REF(tcps, TCP_STAT_RCVPACKAFTERWIN);
2151 _NET_STATADD_REF(tcps, TCP_STAT_RCVBYTEAFTERWIN,
2152 todrop);
2153 TCP_STAT_PUTREF();
2154 }
2155 tp->snd_wl1 = th->th_seq - 1;
2156 tp->rcv_up = th->th_seq;
2157 goto step6;
2158
2159 /*
2160 * If the state is SYN_RECEIVED:
2161 * If seg contains an ACK, but not for our SYN, drop the input
2162 * and generate an RST. See page 36, rfc793
2163 */
2164 case TCPS_SYN_RECEIVED:
2165 if ((tiflags & TH_ACK) &&
2166 (SEQ_LEQ(th->th_ack, tp->iss) ||
2167 SEQ_GT(th->th_ack, tp->snd_max)))
2168 goto dropwithreset;
2169 break;
2170 }
2171
2172 /*
2173 * From here on, we're dealing with !LISTEN and !SYN_SENT.
2174 */
2175 KASSERT(tp->t_state != TCPS_LISTEN &&
2176 tp->t_state != TCPS_SYN_SENT);
2177
2178 /*
2179 * RFC1323 PAWS: if we have a timestamp reply on this segment and
2180 * it's less than ts_recent, drop it.
2181 */
2182 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2183 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2184 /* Check to see if ts_recent is over 24 days old. */
2185 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2186 /*
2187 * Invalidate ts_recent. If this segment updates
2188 * ts_recent, the age will be reset later and ts_recent
2189 * will get a valid value. If it does not, setting
2190 * ts_recent to zero will at least satisfy the
2191 * requirement that zero be placed in the timestamp
2192 * echo reply when ts_recent isn't valid. The
2193 * age isn't reset until we get a valid ts_recent
2194 * because we don't want out-of-order segments to be
2195 * dropped when ts_recent is old.
2196 */
2197 tp->ts_recent = 0;
2198 } else {
2199 tcps = TCP_STAT_GETREF();
2200 _NET_STATINC_REF(tcps, TCP_STAT_RCVDUPPACK);
2201 _NET_STATADD_REF(tcps, TCP_STAT_RCVDUPBYTE, tlen);
2202 _NET_STATINC_REF(tcps, TCP_STAT_PAWSDROP);
2203 TCP_STAT_PUTREF();
2204 tcp_new_dsack(tp, th->th_seq, tlen);
2205 goto dropafterack;
2206 }
2207 }
2208
2209 /*
2210 * Check that at least some bytes of the segment are within the
2211 * receive window. If segment begins before rcv_nxt, drop leading
2212 * data (and SYN); if nothing left, just ack.
2213 */
2214 todrop = tp->rcv_nxt - th->th_seq;
2215 dupseg = false;
2216 if (todrop > 0) {
2217 if (tiflags & TH_SYN) {
2218 tiflags &= ~TH_SYN;
2219 th->th_seq++;
2220 tcp_urp_drop(th, 1, &tiflags);
2221 todrop--;
2222 }
2223 if (todrop > tlen ||
2224 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2225 /*
2226 * Any valid FIN or RST must be to the left of the
2227 * window. At this point the FIN or RST must be a
2228 * duplicate or out of sequence; drop it.
2229 */
2230 if (tiflags & TH_RST)
2231 goto drop;
2232 tiflags &= ~(TH_FIN|TH_RST);
2233
2234 /*
2235 * Send an ACK to resynchronize and drop any data.
2236 * But keep on processing for RST or ACK.
2237 */
2238 tp->t_flags |= TF_ACKNOW;
2239 todrop = tlen;
2240 dupseg = true;
2241 tcps = TCP_STAT_GETREF();
2242 _NET_STATINC_REF(tcps, TCP_STAT_RCVDUPPACK);
2243 _NET_STATADD_REF(tcps, TCP_STAT_RCVDUPBYTE, todrop);
2244 TCP_STAT_PUTREF();
2245 } else if ((tiflags & TH_RST) && th->th_seq != tp->rcv_nxt) {
2246 /*
2247 * Test for reset before adjusting the sequence
2248 * number for overlapping data.
2249 */
2250 goto dropafterack_ratelim;
2251 } else {
2252 tcps = TCP_STAT_GETREF();
2253 _NET_STATINC_REF(tcps, TCP_STAT_RCVPARTDUPPACK);
2254 _NET_STATADD_REF(tcps, TCP_STAT_RCVPARTDUPBYTE,
2255 todrop);
2256 TCP_STAT_PUTREF();
2257 }
2258 tcp_new_dsack(tp, th->th_seq, todrop);
2259 hdroptlen += todrop; /* drop from head afterwards (m_adj) */
2260 th->th_seq += todrop;
2261 tlen -= todrop;
2262 tcp_urp_drop(th, todrop, &tiflags);
2263 }
2264
2265 /*
2266 * If new data is received on a connection after the user processes
2267 * are gone, then RST the other end.
2268 */
2269 if ((so->so_state & SS_NOFDREF) &&
2270 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2271 tp = tcp_close(tp);
2272 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2273 goto dropwithreset;
2274 }
2275
2276 /*
2277 * If the segment ends after the window, drop trailing data (and
2278 * PUSH and FIN); if nothing left, just ACK.
2279 */
2280 todrop = (th->th_seq + tlen) - (tp->rcv_nxt + tp->rcv_wnd);
2281 if (todrop > 0) {
2282 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2283 if (todrop >= tlen) {
2284 /*
2285 * The segment actually starts after the window.
2286 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2287 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2288 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2289 */
2290 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2291
2292 /*
2293 * If a new connection request is received while in
2294 * TIME_WAIT, drop the old connection and start over
2295 * if the sequence numbers are above the previous
2296 * ones.
2297 *
2298 * NOTE: We need to put the header fields back into
2299 * network order.
2300 */
2301 if ((tiflags & TH_SYN) &&
2302 tp->t_state == TCPS_TIME_WAIT &&
2303 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2304 tp = tcp_close(tp);
2305 tcp_fields_to_net(th);
2306 m_freem(tcp_saveti);
2307 tcp_saveti = NULL;
2308 goto findpcb;
2309 }
2310
2311 /*
2312 * If window is closed can only take segments at
2313 * window edge, and have to drop data and PUSH from
2314 * incoming segments. Continue processing, but
2315 * remember to ack. Otherwise, drop segment
2316 * and (if not RST) ack.
2317 */
2318 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2319 KASSERT(todrop == tlen);
2320 tp->t_flags |= TF_ACKNOW;
2321 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2322 } else {
2323 goto dropafterack;
2324 }
2325 } else {
2326 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2327 }
2328 m_adj(m, -todrop);
2329 tlen -= todrop;
2330 tiflags &= ~(TH_PUSH|TH_FIN);
2331 }
2332
2333 /*
2334 * If last ACK falls within this segment's sequence numbers,
2335 * record the timestamp.
2336 * NOTE:
2337 * 1) That the test incorporates suggestions from the latest
2338 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
2339 * 2) That updating only on newer timestamps interferes with
2340 * our earlier PAWS tests, so this check should be solely
2341 * predicated on the sequence space of this segment.
2342 * 3) That we modify the segment boundary check to be
2343 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2344 * instead of RFC1323's
2345 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2346 * This modified check allows us to overcome RFC1323's
2347 * limitations as described in Stevens TCP/IP Illustrated
2348 * Vol. 2 p.869. In such cases, we can still calculate the
2349 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2350 */
2351 if (opti.ts_present &&
2352 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2353 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2354 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2355 tp->ts_recent_age = tcp_now;
2356 tp->ts_recent = opti.ts_val;
2357 }
2358
2359 /*
2360 * If the RST bit is set examine the state:
2361 * RECEIVED state:
2362 * If passive open, return to LISTEN state.
2363 * If active open, inform user that connection was refused.
2364 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT states:
2365 * Inform user that connection was reset, and close tcb.
2366 * CLOSING, LAST_ACK, TIME_WAIT states:
2367 * Close the tcb.
2368 */
2369 if (tiflags & TH_RST) {
2370 if (th->th_seq != tp->rcv_nxt)
2371 goto dropafterack_ratelim;
2372
2373 switch (tp->t_state) {
2374 case TCPS_SYN_RECEIVED:
2375 so->so_error = ECONNREFUSED;
2376 goto close;
2377
2378 case TCPS_ESTABLISHED:
2379 case TCPS_FIN_WAIT_1:
2380 case TCPS_FIN_WAIT_2:
2381 case TCPS_CLOSE_WAIT:
2382 so->so_error = ECONNRESET;
2383 close:
2384 tp->t_state = TCPS_CLOSED;
2385 TCP_STATINC(TCP_STAT_DROPS);
2386 tp = tcp_close(tp);
2387 goto drop;
2388
2389 case TCPS_CLOSING:
2390 case TCPS_LAST_ACK:
2391 case TCPS_TIME_WAIT:
2392 tp = tcp_close(tp);
2393 goto drop;
2394 }
2395 }
2396
2397 /*
2398 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2399 * we must be in a synchronized state. RFC793 states (under Reset
2400 * Generation) that any unacceptable segment (an out-of-order SYN
2401 * qualifies) received in a synchronized state must elicit only an
2402 * empty acknowledgment segment ... and the connection remains in
2403 * the same state.
2404 */
2405 if (tiflags & TH_SYN) {
2406 if (tp->rcv_nxt == th->th_seq) {
2407 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2408 TH_ACK);
2409 m_freem(tcp_saveti);
2410 return;
2411 }
2412
2413 goto dropafterack_ratelim;
2414 }
2415
2416 /*
2417 * If the ACK bit is off we drop the segment and return.
2418 */
2419 if ((tiflags & TH_ACK) == 0) {
2420 if (tp->t_flags & TF_ACKNOW)
2421 goto dropafterack;
2422 goto drop;
2423 }
2424
2425 /*
2426 * From here on, we're doing ACK processing.
2427 */
2428
2429 switch (tp->t_state) {
2430 /*
2431 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2432 * ESTABLISHED state and continue processing, otherwise
2433 * send an RST.
2434 */
2435 case TCPS_SYN_RECEIVED:
2436 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2437 SEQ_GT(th->th_ack, tp->snd_max))
2438 goto dropwithreset;
2439 TCP_STATINC(TCP_STAT_CONNECTS);
2440 soisconnected(so);
2441 tcp_established(tp);
2442 /* Do window scaling? */
2443 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2444 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2445 tp->snd_scale = tp->requested_s_scale;
2446 tp->rcv_scale = tp->request_r_scale;
2447 }
2448 TCP_REASS_LOCK(tp);
2449 (void)tcp_reass(tp, NULL, NULL, tlen);
2450 tp->snd_wl1 = th->th_seq - 1;
2451 /* FALLTHROUGH */
2452
2453 /*
2454 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2455 * ACKs. If the ack is in the range
2456 * tp->snd_una < th->th_ack <= tp->snd_max
2457 * then advance tp->snd_una to th->th_ack and drop
2458 * data from the retransmission queue. If this ACK reflects
2459 * more up to date window information we update our window information.
2460 */
2461 case TCPS_ESTABLISHED:
2462 case TCPS_FIN_WAIT_1:
2463 case TCPS_FIN_WAIT_2:
2464 case TCPS_CLOSE_WAIT:
2465 case TCPS_CLOSING:
2466 case TCPS_LAST_ACK:
2467 case TCPS_TIME_WAIT:
2468 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2469 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2470 TCP_STATINC(TCP_STAT_RCVDUPACK);
2471 /*
2472 * If we have outstanding data (other than
2473 * a window probe), this is a completely
2474 * duplicate ack (ie, window info didn't
2475 * change), the ack is the biggest we've
2476 * seen and we've seen exactly our rexmt
2477 * threshold of them, assume a packet
2478 * has been dropped and retransmit it.
2479 * Kludge snd_nxt & the congestion
2480 * window so we send only this one
2481 * packet.
2482 */
2483 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2484 th->th_ack != tp->snd_una)
2485 tp->t_dupacks = 0;
2486 else if (tp->t_partialacks < 0 &&
2487 (++tp->t_dupacks == tcprexmtthresh ||
2488 TCP_FACK_FASTRECOV(tp))) {
2489 /*
2490 * Do the fast retransmit, and adjust
2491 * congestion control parameters.
2492 */
2493 if (tp->t_congctl->fast_retransmit(tp, th)) {
2494 /* False fast retransmit */
2495 break;
2496 }
2497 goto drop;
2498 } else if (tp->t_dupacks > tcprexmtthresh) {
2499 tp->snd_cwnd += tp->t_segsz;
2500 KERNEL_LOCK(1, NULL);
2501 (void)tcp_output(tp);
2502 KERNEL_UNLOCK_ONE(NULL);
2503 goto drop;
2504 }
2505 } else {
2506 /*
2507 * If the ack appears to be very old, only
2508 * allow data that is in-sequence. This
2509 * makes it somewhat more difficult to insert
2510 * forged data by guessing sequence numbers.
2511 * Sent an ack to try to update the send
2512 * sequence number on the other side.
2513 */
2514 if (tlen && th->th_seq != tp->rcv_nxt &&
2515 SEQ_LT(th->th_ack,
2516 tp->snd_una - tp->max_sndwnd))
2517 goto dropafterack;
2518 }
2519 break;
2520 }
2521 /*
2522 * If the congestion window was inflated to account
2523 * for the other side's cached packets, retract it.
2524 */
2525 tp->t_congctl->fast_retransmit_newack(tp, th);
2526
2527 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2528 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2529 goto dropafterack;
2530 }
2531 acked = th->th_ack - tp->snd_una;
2532 tcps = TCP_STAT_GETREF();
2533 _NET_STATINC_REF(tcps, TCP_STAT_RCVACKPACK);
2534 _NET_STATADD_REF(tcps, TCP_STAT_RCVACKBYTE, acked);
2535 TCP_STAT_PUTREF();
2536
2537 /*
2538 * If we have a timestamp reply, update smoothed
2539 * round trip time. If no timestamp is present but
2540 * transmit timer is running and timed sequence
2541 * number was acked, update smoothed round trip time.
2542 * Since we now have an rtt measurement, cancel the
2543 * timer backoff (cf., Phil Karn's retransmit alg.).
2544 * Recompute the initial retransmit timer.
2545 */
2546 if (ts_rtt)
2547 tcp_xmit_timer(tp, ts_rtt - 1);
2548 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2549 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2550
2551 /*
2552 * If all outstanding data is acked, stop retransmit
2553 * timer and remember to restart (more output or persist).
2554 * If there is more data to be acked, restart retransmit
2555 * timer, using current (possibly backed-off) value.
2556 */
2557 if (th->th_ack == tp->snd_max) {
2558 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2559 needoutput = 1;
2560 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2561 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2562
2563 /*
2564 * New data has been acked, adjust the congestion window.
2565 */
2566 tp->t_congctl->newack(tp, th);
2567
2568 nd_hint(tp);
2569 if (acked > so->so_snd.sb_cc) {
2570 tp->snd_wnd -= so->so_snd.sb_cc;
2571 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2572 ourfinisacked = 1;
2573 } else {
2574 if (acked > (tp->t_lastoff - tp->t_inoff))
2575 tp->t_lastm = NULL;
2576 sbdrop(&so->so_snd, acked);
2577 tp->t_lastoff -= acked;
2578 if (tp->snd_wnd > acked)
2579 tp->snd_wnd -= acked;
2580 else
2581 tp->snd_wnd = 0;
2582 ourfinisacked = 0;
2583 }
2584 sowwakeup(so);
2585
2586 icmp_check(tp, th, acked);
2587
2588 tp->snd_una = th->th_ack;
2589 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2590 tp->snd_fack = tp->snd_una;
2591 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2592 tp->snd_nxt = tp->snd_una;
2593 if (SEQ_LT(tp->snd_high, tp->snd_una))
2594 tp->snd_high = tp->snd_una;
2595
2596 switch (tp->t_state) {
2597
2598 /*
2599 * In FIN_WAIT_1 STATE in addition to the processing
2600 * for the ESTABLISHED state if our FIN is now acknowledged
2601 * then enter FIN_WAIT_2.
2602 */
2603 case TCPS_FIN_WAIT_1:
2604 if (ourfinisacked) {
2605 /*
2606 * If we can't receive any more
2607 * data, then closing user can proceed.
2608 * Starting the timer is contrary to the
2609 * specification, but if we don't get a FIN
2610 * we'll hang forever.
2611 */
2612 if (so->so_state & SS_CANTRCVMORE) {
2613 soisdisconnected(so);
2614 if (tp->t_maxidle > 0)
2615 TCP_TIMER_ARM(tp, TCPT_2MSL,
2616 tp->t_maxidle);
2617 }
2618 tp->t_state = TCPS_FIN_WAIT_2;
2619 }
2620 break;
2621
2622 /*
2623 * In CLOSING STATE in addition to the processing for
2624 * the ESTABLISHED state if the ACK acknowledges our FIN
2625 * then enter the TIME-WAIT state, otherwise ignore
2626 * the segment.
2627 */
2628 case TCPS_CLOSING:
2629 if (ourfinisacked) {
2630 tp->t_state = TCPS_TIME_WAIT;
2631 tcp_canceltimers(tp);
2632 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2633 soisdisconnected(so);
2634 }
2635 break;
2636
2637 /*
2638 * In LAST_ACK, we may still be waiting for data to drain
2639 * and/or to be acked, as well as for the ack of our FIN.
2640 * If our FIN is now acknowledged, delete the TCB,
2641 * enter the closed state and return.
2642 */
2643 case TCPS_LAST_ACK:
2644 if (ourfinisacked) {
2645 tp = tcp_close(tp);
2646 goto drop;
2647 }
2648 break;
2649
2650 /*
2651 * In TIME_WAIT state the only thing that should arrive
2652 * is a retransmission of the remote FIN. Acknowledge
2653 * it and restart the finack timer.
2654 */
2655 case TCPS_TIME_WAIT:
2656 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2657 goto dropafterack;
2658 }
2659 }
2660
2661 step6:
2662 /*
2663 * Update window information.
2664 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2665 */
2666 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2667 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2668 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2669 /* keep track of pure window updates */
2670 if (tlen == 0 &&
2671 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2672 TCP_STATINC(TCP_STAT_RCVWINUPD);
2673 tp->snd_wnd = tiwin;
2674 tp->snd_wl1 = th->th_seq;
2675 tp->snd_wl2 = th->th_ack;
2676 if (tp->snd_wnd > tp->max_sndwnd)
2677 tp->max_sndwnd = tp->snd_wnd;
2678 needoutput = 1;
2679 }
2680
2681 /*
2682 * Process segments with URG.
2683 */
2684 if ((tiflags & TH_URG) && th->th_urp &&
2685 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2686 /*
2687 * This is a kludge, but if we receive and accept
2688 * random urgent pointers, we'll crash in
2689 * soreceive. It's hard to imagine someone
2690 * actually wanting to send this much urgent data.
2691 */
2692 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2693 th->th_urp = 0; /* XXX */
2694 tiflags &= ~TH_URG; /* XXX */
2695 goto dodata; /* XXX */
2696 }
2697
2698 /*
2699 * If this segment advances the known urgent pointer,
2700 * then mark the data stream. This should not happen
2701 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2702 * a FIN has been received from the remote side.
2703 * In these states we ignore the URG.
2704 *
2705 * According to RFC961 (Assigned Protocols),
2706 * the urgent pointer points to the last octet
2707 * of urgent data. We continue, however,
2708 * to consider it to indicate the first octet
2709 * of data past the urgent section as the original
2710 * spec states (in one of two places).
2711 */
2712 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2713 tp->rcv_up = th->th_seq + th->th_urp;
2714 so->so_oobmark = so->so_rcv.sb_cc +
2715 (tp->rcv_up - tp->rcv_nxt) - 1;
2716 if (so->so_oobmark == 0)
2717 so->so_state |= SS_RCVATMARK;
2718 sohasoutofband(so);
2719 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2720 }
2721
2722 /*
2723 * Remove out of band data so doesn't get presented to user.
2724 * This can happen independent of advancing the URG pointer,
2725 * but if two URG's are pending at once, some out-of-band
2726 * data may creep in... ick.
2727 */
2728 if (th->th_urp <= (u_int16_t)tlen &&
2729 (so->so_options & SO_OOBINLINE) == 0)
2730 tcp_pulloutofband(so, th, m, hdroptlen);
2731 } else {
2732 /*
2733 * If no out of band data is expected,
2734 * pull receive urgent pointer along
2735 * with the receive window.
2736 */
2737 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2738 tp->rcv_up = tp->rcv_nxt;
2739 }
2740 dodata:
2741
2742 /*
2743 * Process the segment text, merging it into the TCP sequencing queue,
2744 * and arranging for acknowledgement of receipt if necessary.
2745 * This process logically involves adjusting tp->rcv_wnd as data
2746 * is presented to the user (this happens in tcp_usrreq.c,
2747 * tcp_rcvd()). If a FIN has already been received on this
2748 * connection then we just ignore the text.
2749 */
2750 if ((tlen || (tiflags & TH_FIN)) &&
2751 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2752 /*
2753 * Handle the common case:
2754 * o Segment is the next to be received, and
2755 * o The queue is empty, and
2756 * o The connection is established
2757 * In this case, we avoid calling tcp_reass.
2758 *
2759 * tcp_setup_ack: set DELACK for segments received in order,
2760 * but ack immediately when segments are out of order (so that
2761 * fast retransmit can work).
2762 */
2763 TCP_REASS_LOCK(tp);
2764 if (th->th_seq == tp->rcv_nxt &&
2765 TAILQ_FIRST(&tp->segq) == NULL &&
2766 tp->t_state == TCPS_ESTABLISHED) {
2767 tcp_setup_ack(tp, th);
2768 tp->rcv_nxt += tlen;
2769 tiflags = th->th_flags & TH_FIN;
2770 tcps = TCP_STAT_GETREF();
2771 _NET_STATINC_REF(tcps, TCP_STAT_RCVPACK);
2772 _NET_STATADD_REF(tcps, TCP_STAT_RCVBYTE, tlen);
2773 TCP_STAT_PUTREF();
2774 nd_hint(tp);
2775 if (so->so_state & SS_CANTRCVMORE) {
2776 m_freem(m);
2777 } else {
2778 m_adj(m, hdroptlen);
2779 sbappendstream(&(so)->so_rcv, m);
2780 }
2781 TCP_REASS_UNLOCK(tp);
2782 sorwakeup(so);
2783 } else {
2784 m_adj(m, hdroptlen);
2785 tiflags = tcp_reass(tp, th, m, tlen);
2786 tp->t_flags |= TF_ACKNOW;
2787 }
2788
2789 /*
2790 * Note the amount of data that peer has sent into
2791 * our window, in order to estimate the sender's
2792 * buffer size.
2793 */
2794 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2795 } else {
2796 m_freem(m);
2797 m = NULL;
2798 tiflags &= ~TH_FIN;
2799 }
2800
2801 /*
2802 * If FIN is received ACK the FIN and let the user know
2803 * that the connection is closing. Ignore a FIN received before
2804 * the connection is fully established.
2805 */
2806 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2807 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2808 socantrcvmore(so);
2809 tp->t_flags |= TF_ACKNOW;
2810 tp->rcv_nxt++;
2811 }
2812 switch (tp->t_state) {
2813
2814 /*
2815 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2816 */
2817 case TCPS_ESTABLISHED:
2818 tp->t_state = TCPS_CLOSE_WAIT;
2819 break;
2820
2821 /*
2822 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2823 * enter the CLOSING state.
2824 */
2825 case TCPS_FIN_WAIT_1:
2826 tp->t_state = TCPS_CLOSING;
2827 break;
2828
2829 /*
2830 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2831 * starting the time-wait timer, turning off the other
2832 * standard timers.
2833 */
2834 case TCPS_FIN_WAIT_2:
2835 tp->t_state = TCPS_TIME_WAIT;
2836 tcp_canceltimers(tp);
2837 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2838 soisdisconnected(so);
2839 break;
2840
2841 /*
2842 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2843 */
2844 case TCPS_TIME_WAIT:
2845 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2846 break;
2847 }
2848 }
2849 #ifdef TCP_DEBUG
2850 if (so->so_options & SO_DEBUG)
2851 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
2852 #endif
2853
2854 /*
2855 * Return any desired output.
2856 */
2857 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
2858 KERNEL_LOCK(1, NULL);
2859 (void)tcp_output(tp);
2860 KERNEL_UNLOCK_ONE(NULL);
2861 }
2862 m_freem(tcp_saveti);
2863
2864 if (tp->t_state == TCPS_TIME_WAIT
2865 && (so->so_state & SS_NOFDREF)
2866 && (tp->t_inpcb || af != AF_INET || af != AF_INET6)
2867 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0
2868 && TAILQ_EMPTY(&tp->segq)
2869 && vtw_add(af, tp)) {
2870 ;
2871 }
2872 return;
2873
2874 badsyn:
2875 /*
2876 * Received a bad SYN. Increment counters and dropwithreset.
2877 */
2878 TCP_STATINC(TCP_STAT_BADSYN);
2879 tp = NULL;
2880 goto dropwithreset;
2881
2882 dropafterack:
2883 /*
2884 * Generate an ACK dropping incoming segment if it occupies
2885 * sequence space, where the ACK reflects our state.
2886 */
2887 if (tiflags & TH_RST)
2888 goto drop;
2889 goto dropafterack2;
2890
2891 dropafterack_ratelim:
2892 /*
2893 * We may want to rate-limit ACKs against SYN/RST attack.
2894 */
2895 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
2896 tcp_ackdrop_ppslim) == 0) {
2897 /* XXX stat */
2898 goto drop;
2899 }
2900
2901 dropafterack2:
2902 m_freem(m);
2903 tp->t_flags |= TF_ACKNOW;
2904 KERNEL_LOCK(1, NULL);
2905 (void)tcp_output(tp);
2906 KERNEL_UNLOCK_ONE(NULL);
2907 m_freem(tcp_saveti);
2908 return;
2909
2910 dropwithreset_ratelim:
2911 /*
2912 * We may want to rate-limit RSTs in certain situations,
2913 * particularly if we are sending an RST in response to
2914 * an attempt to connect to or otherwise communicate with
2915 * a port for which we have no socket.
2916 */
2917 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2918 tcp_rst_ppslim) == 0) {
2919 /* XXX stat */
2920 goto drop;
2921 }
2922
2923 dropwithreset:
2924 /*
2925 * Generate a RST, dropping incoming segment.
2926 * Make ACK acceptable to originator of segment.
2927 */
2928 if (tiflags & TH_RST)
2929 goto drop;
2930 if (tiflags & TH_ACK) {
2931 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
2932 } else {
2933 if (tiflags & TH_SYN)
2934 tlen++;
2935 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
2936 TH_RST|TH_ACK);
2937 }
2938 m_freem(tcp_saveti);
2939 return;
2940
2941 badcsum:
2942 drop:
2943 /*
2944 * Drop space held by incoming segment and return.
2945 */
2946 if (tp) {
2947 so = tp->t_inpcb->inp_socket;
2948 #ifdef TCP_DEBUG
2949 if (so && (so->so_options & SO_DEBUG) != 0)
2950 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
2951 #endif
2952 }
2953 m_freem(tcp_saveti);
2954 m_freem(m);
2955 return;
2956 }
2957
2958 #ifdef TCP_SIGNATURE
2959 int
tcp_signature_apply(void * fstate,void * data,u_int len)2960 tcp_signature_apply(void *fstate, void *data, u_int len)
2961 {
2962
2963 MD5Update(fstate, (u_char *)data, len);
2964 return (0);
2965 }
2966
2967 struct secasvar *
tcp_signature_getsav(struct mbuf * m)2968 tcp_signature_getsav(struct mbuf *m)
2969 {
2970 struct ip *ip;
2971 struct ip6_hdr *ip6;
2972
2973 ip = mtod(m, struct ip *);
2974 switch (ip->ip_v) {
2975 case 4:
2976 ip = mtod(m, struct ip *);
2977 ip6 = NULL;
2978 break;
2979 case 6:
2980 ip = NULL;
2981 ip6 = mtod(m, struct ip6_hdr *);
2982 break;
2983 default:
2984 return (NULL);
2985 }
2986
2987 #ifdef IPSEC
2988 union sockaddr_union dst;
2989
2990 /* Extract the destination from the IP header in the mbuf. */
2991 memset(&dst, 0, sizeof(union sockaddr_union));
2992 if (ip != NULL) {
2993 dst.sa.sa_len = sizeof(struct sockaddr_in);
2994 dst.sa.sa_family = AF_INET;
2995 dst.sin.sin_addr = ip->ip_dst;
2996 } else {
2997 dst.sa.sa_len = sizeof(struct sockaddr_in6);
2998 dst.sa.sa_family = AF_INET6;
2999 dst.sin6.sin6_addr = ip6->ip6_dst;
3000 }
3001
3002 /*
3003 * Look up an SADB entry which matches the address of the peer.
3004 */
3005 return KEY_LOOKUP_SA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0);
3006 #else
3007 return NULL;
3008 #endif
3009 }
3010
3011 int
tcp_signature(struct mbuf * m,struct tcphdr * th,int thoff,struct secasvar * sav,char * sig)3012 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
3013 struct secasvar *sav, char *sig)
3014 {
3015 MD5_CTX ctx;
3016 struct ip *ip;
3017 struct ipovly *ipovly;
3018 #ifdef INET6
3019 struct ip6_hdr *ip6;
3020 struct ip6_hdr_pseudo ip6pseudo;
3021 #endif
3022 struct ippseudo ippseudo;
3023 struct tcphdr th0;
3024 int l, tcphdrlen;
3025
3026 if (sav == NULL)
3027 return (-1);
3028
3029 tcphdrlen = th->th_off * 4;
3030
3031 switch (mtod(m, struct ip *)->ip_v) {
3032 case 4:
3033 MD5Init(&ctx);
3034 ip = mtod(m, struct ip *);
3035 memset(&ippseudo, 0, sizeof(ippseudo));
3036 ipovly = (struct ipovly *)ip;
3037 ippseudo.ippseudo_src = ipovly->ih_src;
3038 ippseudo.ippseudo_dst = ipovly->ih_dst;
3039 ippseudo.ippseudo_pad = 0;
3040 ippseudo.ippseudo_p = IPPROTO_TCP;
3041 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
3042 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
3043 break;
3044 #if INET6
3045 case 6:
3046 MD5Init(&ctx);
3047 ip6 = mtod(m, struct ip6_hdr *);
3048 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
3049 ip6pseudo.ip6ph_src = ip6->ip6_src;
3050 in6_clearscope(&ip6pseudo.ip6ph_src);
3051 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
3052 in6_clearscope(&ip6pseudo.ip6ph_dst);
3053 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
3054 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
3055 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
3056 break;
3057 #endif
3058 default:
3059 return (-1);
3060 }
3061
3062 th0 = *th;
3063 th0.th_sum = 0;
3064 MD5Update(&ctx, (char *)&th0, sizeof(th0));
3065
3066 l = m->m_pkthdr.len - thoff - tcphdrlen;
3067 if (l > 0)
3068 m_apply(m, thoff + tcphdrlen,
3069 m->m_pkthdr.len - thoff - tcphdrlen,
3070 tcp_signature_apply, &ctx);
3071
3072 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
3073 MD5Final(sig, &ctx);
3074
3075 return (0);
3076 }
3077 #endif
3078
3079 /*
3080 * Parse and process tcp options.
3081 *
3082 * Returns -1 if this segment should be dropped. (eg. wrong signature)
3083 * Otherwise returns 0.
3084 */
3085 int
tcp_dooptions(struct tcpcb * tp,const u_char * cp,int cnt,struct tcphdr * th,struct mbuf * m,int toff,struct tcp_opt_info * oi)3086 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt, struct tcphdr *th,
3087 struct mbuf *m, int toff, struct tcp_opt_info *oi)
3088 {
3089 u_int16_t mss;
3090 int opt, optlen = 0;
3091 #ifdef TCP_SIGNATURE
3092 void *sigp = NULL;
3093 char sigbuf[TCP_SIGLEN];
3094 struct secasvar *sav = NULL;
3095 #endif
3096
3097 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
3098 opt = cp[0];
3099 if (opt == TCPOPT_EOL)
3100 break;
3101 if (opt == TCPOPT_NOP)
3102 optlen = 1;
3103 else {
3104 if (cnt < 2)
3105 break;
3106 optlen = cp[1];
3107 if (optlen < 2 || optlen > cnt)
3108 break;
3109 }
3110 switch (opt) {
3111
3112 default:
3113 continue;
3114
3115 case TCPOPT_MAXSEG:
3116 if (optlen != TCPOLEN_MAXSEG)
3117 continue;
3118 if (!(th->th_flags & TH_SYN))
3119 continue;
3120 if (TCPS_HAVERCVDSYN(tp->t_state))
3121 continue;
3122 memcpy(&mss, cp + 2, sizeof(mss));
3123 oi->maxseg = ntohs(mss);
3124 break;
3125
3126 case TCPOPT_WINDOW:
3127 if (optlen != TCPOLEN_WINDOW)
3128 continue;
3129 if (!(th->th_flags & TH_SYN))
3130 continue;
3131 if (TCPS_HAVERCVDSYN(tp->t_state))
3132 continue;
3133 tp->t_flags |= TF_RCVD_SCALE;
3134 tp->requested_s_scale = cp[2];
3135 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3136 char buf[INET6_ADDRSTRLEN];
3137 struct ip *ip = mtod(m, struct ip *);
3138 #ifdef INET6
3139 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
3140 #endif
3141
3142 switch (ip->ip_v) {
3143 case 4:
3144 in_print(buf, sizeof(buf),
3145 &ip->ip_src);
3146 break;
3147 #ifdef INET6
3148 case 6:
3149 in6_print(buf, sizeof(buf),
3150 &ip6->ip6_src);
3151 break;
3152 #endif
3153 default:
3154 strlcpy(buf, "(unknown)", sizeof(buf));
3155 break;
3156 }
3157
3158 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3159 "assuming %d\n",
3160 tp->requested_s_scale, buf,
3161 TCP_MAX_WINSHIFT);
3162 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3163 }
3164 break;
3165
3166 case TCPOPT_TIMESTAMP:
3167 if (optlen != TCPOLEN_TIMESTAMP)
3168 continue;
3169 oi->ts_present = 1;
3170 memcpy(&oi->ts_val, cp + 2, sizeof(oi->ts_val));
3171 NTOHL(oi->ts_val);
3172 memcpy(&oi->ts_ecr, cp + 6, sizeof(oi->ts_ecr));
3173 NTOHL(oi->ts_ecr);
3174
3175 if (!(th->th_flags & TH_SYN))
3176 continue;
3177 if (TCPS_HAVERCVDSYN(tp->t_state))
3178 continue;
3179 /*
3180 * A timestamp received in a SYN makes
3181 * it ok to send timestamp requests and replies.
3182 */
3183 tp->t_flags |= TF_RCVD_TSTMP;
3184 tp->ts_recent = oi->ts_val;
3185 tp->ts_recent_age = tcp_now;
3186 break;
3187
3188 case TCPOPT_SACK_PERMITTED:
3189 if (optlen != TCPOLEN_SACK_PERMITTED)
3190 continue;
3191 if (!(th->th_flags & TH_SYN))
3192 continue;
3193 if (TCPS_HAVERCVDSYN(tp->t_state))
3194 continue;
3195 if (tcp_do_sack) {
3196 tp->t_flags |= TF_SACK_PERMIT;
3197 tp->t_flags |= TF_WILL_SACK;
3198 }
3199 break;
3200
3201 case TCPOPT_SACK:
3202 tcp_sack_option(tp, th, cp, optlen);
3203 break;
3204 #ifdef TCP_SIGNATURE
3205 case TCPOPT_SIGNATURE:
3206 if (optlen != TCPOLEN_SIGNATURE)
3207 continue;
3208 if (sigp &&
3209 !consttime_memequal(sigp, cp + 2, TCP_SIGLEN))
3210 return (-1);
3211
3212 sigp = sigbuf;
3213 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3214 tp->t_flags |= TF_SIGNATURE;
3215 break;
3216 #endif
3217 }
3218 }
3219
3220 #ifndef TCP_SIGNATURE
3221 return 0;
3222 #else
3223 if (tp->t_flags & TF_SIGNATURE) {
3224 sav = tcp_signature_getsav(m);
3225 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3226 return (-1);
3227 }
3228
3229 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE))
3230 goto out;
3231
3232 if (sigp) {
3233 char sig[TCP_SIGLEN];
3234
3235 tcp_fields_to_net(th);
3236 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3237 tcp_fields_to_host(th);
3238 goto out;
3239 }
3240 tcp_fields_to_host(th);
3241
3242 if (!consttime_memequal(sig, sigp, TCP_SIGLEN)) {
3243 TCP_STATINC(TCP_STAT_BADSIG);
3244 goto out;
3245 } else
3246 TCP_STATINC(TCP_STAT_GOODSIG);
3247
3248 key_sa_recordxfer(sav, m);
3249 KEY_SA_UNREF(&sav);
3250 }
3251 return 0;
3252 out:
3253 if (sav != NULL)
3254 KEY_SA_UNREF(&sav);
3255 return -1;
3256 #endif
3257 }
3258
3259 /*
3260 * Pull out of band byte out of a segment so
3261 * it doesn't appear in the user's data queue.
3262 * It is still reflected in the segment length for
3263 * sequencing purposes.
3264 */
3265 void
tcp_pulloutofband(struct socket * so,struct tcphdr * th,struct mbuf * m,int off)3266 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3267 struct mbuf *m, int off)
3268 {
3269 int cnt = off + th->th_urp - 1;
3270
3271 while (cnt >= 0) {
3272 if (m->m_len > cnt) {
3273 char *cp = mtod(m, char *) + cnt;
3274 struct tcpcb *tp = sototcpcb(so);
3275
3276 tp->t_iobc = *cp;
3277 tp->t_oobflags |= TCPOOB_HAVEDATA;
3278 memmove(cp, cp + 1, (unsigned)(m->m_len - cnt - 1));
3279 m->m_len--;
3280 return;
3281 }
3282 cnt -= m->m_len;
3283 m = m->m_next;
3284 if (m == NULL)
3285 break;
3286 }
3287 panic("tcp_pulloutofband");
3288 }
3289
3290 /*
3291 * Collect new round-trip time estimate
3292 * and update averages and current timeout.
3293 *
3294 * rtt is in units of slow ticks (typically 500 ms) -- essentially the
3295 * difference of two timestamps.
3296 */
3297 void
tcp_xmit_timer(struct tcpcb * tp,uint32_t rtt)3298 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3299 {
3300 int32_t delta;
3301
3302 TCP_STATINC(TCP_STAT_RTTUPDATED);
3303 if (tp->t_srtt != 0) {
3304 /*
3305 * Compute the amount to add to srtt for smoothing,
3306 * *alpha, or 2^(-TCP_RTT_SHIFT). Because
3307 * srtt is stored in 1/32 slow ticks, we conceptually
3308 * shift left 5 bits, subtract srtt to get the
3309 * difference, and then shift right by TCP_RTT_SHIFT
3310 * (3) to obtain 1/8 of the difference.
3311 */
3312 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3313 /*
3314 * This can never happen, because delta's lowest
3315 * possible value is 1/8 of t_srtt. But if it does,
3316 * set srtt to some reasonable value, here chosen
3317 * as 1/8 tick.
3318 */
3319 if ((tp->t_srtt += delta) <= 0)
3320 tp->t_srtt = 1 << 2;
3321 /*
3322 * RFC2988 requires that rttvar be updated first.
3323 * This code is compliant because "delta" is the old
3324 * srtt minus the new observation (scaled).
3325 *
3326 * RFC2988 says:
3327 * rttvar = (1-beta) * rttvar + beta * |srtt-observed|
3328 *
3329 * delta is in units of 1/32 ticks, and has then been
3330 * divided by 8. This is equivalent to being in 1/16s
3331 * units and divided by 4. Subtract from it 1/4 of
3332 * the existing rttvar to form the (signed) amount to
3333 * adjust.
3334 */
3335 if (delta < 0)
3336 delta = -delta;
3337 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3338 /*
3339 * As with srtt, this should never happen. There is
3340 * no support in RFC2988 for this operation. But 1/4s
3341 * as rttvar when faced with something arguably wrong
3342 * is ok.
3343 */
3344 if ((tp->t_rttvar += delta) <= 0)
3345 tp->t_rttvar = 1 << 2;
3346
3347 /*
3348 * If srtt exceeds .01 second, ensure we use the 'remote' MSL
3349 * Problem is: it doesn't work. Disabled by defaulting
3350 * tcp_rttlocal to 0; see corresponding code in
3351 * tcp_subr that selects local vs remote in a different way.
3352 *
3353 * The static branch prediction hint here should be removed
3354 * when the rtt estimator is fixed and the rtt_enable code
3355 * is turned back on.
3356 */
3357 if (__predict_false(tcp_rttlocal) && tcp_msl_enable
3358 && tp->t_srtt > tcp_msl_remote_threshold
3359 && tp->t_msl < tcp_msl_remote) {
3360 tp->t_msl = MIN(tcp_msl_remote, TCP_MAXMSL);
3361 }
3362 } else {
3363 /*
3364 * This is the first measurement. Per RFC2988, 2.2,
3365 * set rtt=R and srtt=R/2.
3366 * For srtt, storage representation is 1/32 ticks,
3367 * so shift left by 5.
3368 * For rttvar, storage representation is 1/16 ticks,
3369 * So shift left by 4, but then right by 1 to halve.
3370 */
3371 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3372 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3373 }
3374 tp->t_rtttime = 0;
3375 tp->t_rxtshift = 0;
3376
3377 /*
3378 * the retransmit should happen at rtt + 4 * rttvar.
3379 * Because of the way we do the smoothing, srtt and rttvar
3380 * will each average +1/2 tick of bias. When we compute
3381 * the retransmit timer, we want 1/2 tick of rounding and
3382 * 1 extra tick because of +-1/2 tick uncertainty in the
3383 * firing of the timer. The bias will give us exactly the
3384 * 1.5 tick we need. But, because the bias is
3385 * statistical, we have to test that we don't drop below
3386 * the minimum feasible timer (which is 2 ticks).
3387 */
3388 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3389 uimax(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3390
3391 /*
3392 * We received an ack for a packet that wasn't retransmitted;
3393 * it is probably safe to discard any error indications we've
3394 * received recently. This isn't quite right, but close enough
3395 * for now (a route might have failed after we sent a segment,
3396 * and the return path might not be symmetrical).
3397 */
3398 tp->t_softerror = 0;
3399 }
3400