1 /* $NetBSD: tcp_input.c,v 1.347 2016/06/10 13:31:44 ozaki-r Exp $ */
2
3 /*
4 * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
5 * All rights reserved.
6 *
7 * Redistribution and use in source and binary forms, with or without
8 * modification, are permitted provided that the following conditions
9 * are met:
10 * 1. Redistributions of source code must retain the above copyright
11 * notice, this list of conditions and the following disclaimer.
12 * 2. Redistributions in binary form must reproduce the above copyright
13 * notice, this list of conditions and the following disclaimer in the
14 * documentation and/or other materials provided with the distribution.
15 * 3. Neither the name of the project nor the names of its contributors
16 * may be used to endorse or promote products derived from this software
17 * without specific prior written permission.
18 *
19 * THIS SOFTWARE IS PROVIDED BY THE PROJECT AND CONTRIBUTORS ``AS IS'' AND
20 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
21 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
22 * ARE DISCLAIMED. IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
23 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
24 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
25 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
26 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
27 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
28 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
29 * SUCH DAMAGE.
30 */
31
32 /*
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 /*-
73 * Copyright (c) 1997, 1998, 1999, 2001, 2005, 2006,
74 * 2011 The NetBSD Foundation, Inc.
75 * All rights reserved.
76 *
77 * This code is derived from software contributed to The NetBSD Foundation
78 * by Coyote Point Systems, Inc.
79 * This code is derived from software contributed to The NetBSD Foundation
80 * by Jason R. Thorpe and Kevin M. Lahey of the Numerical Aerospace Simulation
81 * Facility, NASA Ames Research Center.
82 * This code is derived from software contributed to The NetBSD Foundation
83 * by Charles M. Hannum.
84 * This code is derived from software contributed to The NetBSD Foundation
85 * by Rui Paulo.
86 *
87 * Redistribution and use in source and binary forms, with or without
88 * modification, are permitted provided that the following conditions
89 * are met:
90 * 1. Redistributions of source code must retain the above copyright
91 * notice, this list of conditions and the following disclaimer.
92 * 2. Redistributions in binary form must reproduce the above copyright
93 * notice, this list of conditions and the following disclaimer in the
94 * documentation and/or other materials provided with the distribution.
95 *
96 * THIS SOFTWARE IS PROVIDED BY THE NETBSD FOUNDATION, INC. AND CONTRIBUTORS
97 * ``AS IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
98 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
99 * PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE FOUNDATION OR CONTRIBUTORS
100 * BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR
101 * CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF
102 * SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS
103 * INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN
104 * CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
105 * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE
106 * POSSIBILITY OF SUCH DAMAGE.
107 */
108
109 /*
110 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
111 * The Regents of the University of California. All rights reserved.
112 *
113 * Redistribution and use in source and binary forms, with or without
114 * modification, are permitted provided that the following conditions
115 * are met:
116 * 1. Redistributions of source code must retain the above copyright
117 * notice, this list of conditions and the following disclaimer.
118 * 2. Redistributions in binary form must reproduce the above copyright
119 * notice, this list of conditions and the following disclaimer in the
120 * documentation and/or other materials provided with the distribution.
121 * 3. Neither the name of the University nor the names of its contributors
122 * may be used to endorse or promote products derived from this software
123 * without specific prior written permission.
124 *
125 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
126 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
127 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
128 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
129 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
130 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
131 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
132 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
133 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
134 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
135 * SUCH DAMAGE.
136 *
137 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
138 */
139
140 /*
141 * TODO list for SYN cache stuff:
142 *
143 * Find room for a "state" field, which is needed to keep a
144 * compressed state for TIME_WAIT TCBs. It's been noted already
145 * that this is fairly important for very high-volume web and
146 * mail servers, which use a large number of short-lived
147 * connections.
148 */
149
150 #include <sys/cdefs.h>
151 __KERNEL_RCSID(0, "$NetBSD: tcp_input.c,v 1.347 2016/06/10 13:31:44 ozaki-r Exp $");
152
153 #ifdef _KERNEL_OPT
154 #include "opt_inet.h"
155 #include "opt_ipsec.h"
156 #include "opt_inet_csum.h"
157 #include "opt_tcp_debug.h"
158 #endif
159
160 #include <sys/param.h>
161 #include <sys/systm.h>
162 #include <sys/malloc.h>
163 #include <sys/mbuf.h>
164 #include <sys/protosw.h>
165 #include <sys/socket.h>
166 #include <sys/socketvar.h>
167 #include <sys/errno.h>
168 #include <sys/syslog.h>
169 #include <sys/pool.h>
170 #include <sys/domain.h>
171 #include <sys/kernel.h>
172 #ifdef TCP_SIGNATURE
173 #include <sys/md5.h>
174 #endif
175 #include <sys/lwp.h> /* for lwp0 */
176 #include <sys/cprng.h>
177
178 #include <net/if.h>
179 #include <net/if_types.h>
180
181 #include <netinet/in.h>
182 #include <netinet/in_systm.h>
183 #include <netinet/ip.h>
184 #include <netinet/in_pcb.h>
185 #include <netinet/in_var.h>
186 #include <netinet/ip_var.h>
187 #include <netinet/in_offload.h>
188
189 #ifdef INET6
190 #ifndef INET
191 #include <netinet/in.h>
192 #endif
193 #include <netinet/ip6.h>
194 #include <netinet6/ip6_var.h>
195 #include <netinet6/in6_pcb.h>
196 #include <netinet6/ip6_var.h>
197 #include <netinet6/in6_var.h>
198 #include <netinet/icmp6.h>
199 #include <netinet6/nd6.h>
200 #ifdef TCP_SIGNATURE
201 #include <netinet6/scope6_var.h>
202 #endif
203 #endif
204
205 #ifndef INET6
206 /* always need ip6.h for IP6_EXTHDR_GET */
207 #include <netinet/ip6.h>
208 #endif
209
210 #include <netinet/tcp.h>
211 #include <netinet/tcp_fsm.h>
212 #include <netinet/tcp_seq.h>
213 #include <netinet/tcp_timer.h>
214 #include <netinet/tcp_var.h>
215 #include <netinet/tcp_private.h>
216 #include <netinet/tcpip.h>
217 #include <netinet/tcp_congctl.h>
218 #include <netinet/tcp_debug.h>
219
220 #ifdef INET6
221 #include "faith.h"
222 #if defined(NFAITH) && NFAITH > 0
223 #include <net/if_faith.h>
224 #endif
225 #endif /* INET6 */
226
227 #ifdef IPSEC
228 #include <netipsec/ipsec.h>
229 #include <netipsec/ipsec_var.h>
230 #include <netipsec/ipsec_private.h>
231 #include <netipsec/key.h>
232 #ifdef INET6
233 #include <netipsec/ipsec6.h>
234 #endif
235 #endif /* IPSEC*/
236
237 #include <netinet/tcp_vtw.h>
238
239 int tcprexmtthresh = 3;
240 int tcp_log_refused;
241
242 int tcp_do_autorcvbuf = 1;
243 int tcp_autorcvbuf_inc = 16 * 1024;
244 int tcp_autorcvbuf_max = 256 * 1024;
245 int tcp_msl = (TCPTV_MSL / PR_SLOWHZ);
246
247 static int tcp_rst_ppslim_count = 0;
248 static struct timeval tcp_rst_ppslim_last;
249 static int tcp_ackdrop_ppslim_count = 0;
250 static struct timeval tcp_ackdrop_ppslim_last;
251
252 #define TCP_PAWS_IDLE (24U * 24 * 60 * 60 * PR_SLOWHZ)
253
254 /* for modulo comparisons of timestamps */
255 #define TSTMP_LT(a,b) ((int)((a)-(b)) < 0)
256 #define TSTMP_GEQ(a,b) ((int)((a)-(b)) >= 0)
257
258 /*
259 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
260 */
261 #ifdef INET6
262 static inline void
nd6_hint(struct tcpcb * tp)263 nd6_hint(struct tcpcb *tp)
264 {
265 struct rtentry *rt;
266
267 if (tp != NULL && tp->t_in6pcb != NULL && tp->t_family == AF_INET6 &&
268 (rt = rtcache_validate(&tp->t_in6pcb->in6p_route)) != NULL)
269 nd6_nud_hint(rt);
270 }
271 #else
272 static inline void
nd6_hint(struct tcpcb * tp)273 nd6_hint(struct tcpcb *tp)
274 {
275 }
276 #endif
277
278 /*
279 * Compute ACK transmission behavior. Delay the ACK unless
280 * we have already delayed an ACK (must send an ACK every two segments).
281 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
282 * option is enabled.
283 */
284 static void
tcp_setup_ack(struct tcpcb * tp,const struct tcphdr * th)285 tcp_setup_ack(struct tcpcb *tp, const struct tcphdr *th)
286 {
287
288 if (tp->t_flags & TF_DELACK ||
289 (tcp_ack_on_push && th->th_flags & TH_PUSH))
290 tp->t_flags |= TF_ACKNOW;
291 else
292 TCP_SET_DELACK(tp);
293 }
294
295 static void
icmp_check(struct tcpcb * tp,const struct tcphdr * th,int acked)296 icmp_check(struct tcpcb *tp, const struct tcphdr *th, int acked)
297 {
298
299 /*
300 * If we had a pending ICMP message that refers to data that have
301 * just been acknowledged, disregard the recorded ICMP message.
302 */
303 if ((tp->t_flags & TF_PMTUD_PEND) &&
304 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
305 tp->t_flags &= ~TF_PMTUD_PEND;
306
307 /*
308 * Keep track of the largest chunk of data
309 * acknowledged since last PMTU update
310 */
311 if (tp->t_pmtud_mss_acked < acked)
312 tp->t_pmtud_mss_acked = acked;
313 }
314
315 /*
316 * Convert TCP protocol fields to host order for easier processing.
317 */
318 static void
tcp_fields_to_host(struct tcphdr * th)319 tcp_fields_to_host(struct tcphdr *th)
320 {
321
322 NTOHL(th->th_seq);
323 NTOHL(th->th_ack);
324 NTOHS(th->th_win);
325 NTOHS(th->th_urp);
326 }
327
328 /*
329 * ... and reverse the above.
330 */
331 static void
tcp_fields_to_net(struct tcphdr * th)332 tcp_fields_to_net(struct tcphdr *th)
333 {
334
335 HTONL(th->th_seq);
336 HTONL(th->th_ack);
337 HTONS(th->th_win);
338 HTONS(th->th_urp);
339 }
340
341 #ifdef TCP_CSUM_COUNTERS
342 #include <sys/device.h>
343
344 #if defined(INET)
345 extern struct evcnt tcp_hwcsum_ok;
346 extern struct evcnt tcp_hwcsum_bad;
347 extern struct evcnt tcp_hwcsum_data;
348 extern struct evcnt tcp_swcsum;
349 #endif /* defined(INET) */
350 #if defined(INET6)
351 extern struct evcnt tcp6_hwcsum_ok;
352 extern struct evcnt tcp6_hwcsum_bad;
353 extern struct evcnt tcp6_hwcsum_data;
354 extern struct evcnt tcp6_swcsum;
355 #endif /* defined(INET6) */
356
357 #define TCP_CSUM_COUNTER_INCR(ev) (ev)->ev_count++
358
359 #else
360
361 #define TCP_CSUM_COUNTER_INCR(ev) /* nothing */
362
363 #endif /* TCP_CSUM_COUNTERS */
364
365 #ifdef TCP_REASS_COUNTERS
366 #include <sys/device.h>
367
368 extern struct evcnt tcp_reass_;
369 extern struct evcnt tcp_reass_empty;
370 extern struct evcnt tcp_reass_iteration[8];
371 extern struct evcnt tcp_reass_prependfirst;
372 extern struct evcnt tcp_reass_prepend;
373 extern struct evcnt tcp_reass_insert;
374 extern struct evcnt tcp_reass_inserttail;
375 extern struct evcnt tcp_reass_append;
376 extern struct evcnt tcp_reass_appendtail;
377 extern struct evcnt tcp_reass_overlaptail;
378 extern struct evcnt tcp_reass_overlapfront;
379 extern struct evcnt tcp_reass_segdup;
380 extern struct evcnt tcp_reass_fragdup;
381
382 #define TCP_REASS_COUNTER_INCR(ev) (ev)->ev_count++
383
384 #else
385
386 #define TCP_REASS_COUNTER_INCR(ev) /* nothing */
387
388 #endif /* TCP_REASS_COUNTERS */
389
390 static int tcp_reass(struct tcpcb *, const struct tcphdr *, struct mbuf *,
391 int *);
392 static int tcp_dooptions(struct tcpcb *, const u_char *, int,
393 struct tcphdr *, struct mbuf *, int, struct tcp_opt_info *);
394
395 #ifdef INET
396 static void tcp4_log_refused(const struct ip *, const struct tcphdr *);
397 #endif
398 #ifdef INET6
399 static void tcp6_log_refused(const struct ip6_hdr *, const struct tcphdr *);
400 #endif
401
402 #define TRAVERSE(x) while ((x)->m_next) (x) = (x)->m_next
403
404 #if defined(MBUFTRACE)
405 struct mowner tcp_reass_mowner = MOWNER_INIT("tcp", "reass");
406 #endif /* defined(MBUFTRACE) */
407
408 static struct pool tcpipqent_pool;
409
410 void
tcpipqent_init(void)411 tcpipqent_init(void)
412 {
413
414 pool_init(&tcpipqent_pool, sizeof(struct ipqent), 0, 0, 0, "tcpipqepl",
415 NULL, IPL_VM);
416 }
417
418 struct ipqent *
tcpipqent_alloc(void)419 tcpipqent_alloc(void)
420 {
421 struct ipqent *ipqe;
422 int s;
423
424 s = splvm();
425 ipqe = pool_get(&tcpipqent_pool, PR_NOWAIT);
426 splx(s);
427
428 return ipqe;
429 }
430
431 void
tcpipqent_free(struct ipqent * ipqe)432 tcpipqent_free(struct ipqent *ipqe)
433 {
434 int s;
435
436 s = splvm();
437 pool_put(&tcpipqent_pool, ipqe);
438 splx(s);
439 }
440
441 static int
tcp_reass(struct tcpcb * tp,const struct tcphdr * th,struct mbuf * m,int * tlen)442 tcp_reass(struct tcpcb *tp, const struct tcphdr *th, struct mbuf *m, int *tlen)
443 {
444 struct ipqent *p, *q, *nq, *tiqe = NULL;
445 struct socket *so = NULL;
446 int pkt_flags;
447 tcp_seq pkt_seq;
448 unsigned pkt_len;
449 u_long rcvpartdupbyte = 0;
450 u_long rcvoobyte;
451 #ifdef TCP_REASS_COUNTERS
452 u_int count = 0;
453 #endif
454 uint64_t *tcps;
455
456 if (tp->t_inpcb)
457 so = tp->t_inpcb->inp_socket;
458 #ifdef INET6
459 else if (tp->t_in6pcb)
460 so = tp->t_in6pcb->in6p_socket;
461 #endif
462
463 TCP_REASS_LOCK_CHECK(tp);
464
465 /*
466 * Call with th==0 after become established to
467 * force pre-ESTABLISHED data up to user socket.
468 */
469 if (th == 0)
470 goto present;
471
472 m_claimm(m, &tcp_reass_mowner);
473
474 rcvoobyte = *tlen;
475 /*
476 * Copy these to local variables because the tcpiphdr
477 * gets munged while we are collapsing mbufs.
478 */
479 pkt_seq = th->th_seq;
480 pkt_len = *tlen;
481 pkt_flags = th->th_flags;
482
483 TCP_REASS_COUNTER_INCR(&tcp_reass_);
484
485 if ((p = TAILQ_LAST(&tp->segq, ipqehead)) != NULL) {
486 /*
487 * When we miss a packet, the vast majority of time we get
488 * packets that follow it in order. So optimize for that.
489 */
490 if (pkt_seq == p->ipqe_seq + p->ipqe_len) {
491 p->ipqe_len += pkt_len;
492 p->ipqe_flags |= pkt_flags;
493 m_cat(p->ipre_mlast, m);
494 TRAVERSE(p->ipre_mlast);
495 m = NULL;
496 tiqe = p;
497 TAILQ_REMOVE(&tp->timeq, p, ipqe_timeq);
498 TCP_REASS_COUNTER_INCR(&tcp_reass_appendtail);
499 goto skip_replacement;
500 }
501 /*
502 * While we're here, if the pkt is completely beyond
503 * anything we have, just insert it at the tail.
504 */
505 if (SEQ_GT(pkt_seq, p->ipqe_seq + p->ipqe_len)) {
506 TCP_REASS_COUNTER_INCR(&tcp_reass_inserttail);
507 goto insert_it;
508 }
509 }
510
511 q = TAILQ_FIRST(&tp->segq);
512
513 if (q != NULL) {
514 /*
515 * If this segment immediately precedes the first out-of-order
516 * block, simply slap the segment in front of it and (mostly)
517 * skip the complicated logic.
518 */
519 if (pkt_seq + pkt_len == q->ipqe_seq) {
520 q->ipqe_seq = pkt_seq;
521 q->ipqe_len += pkt_len;
522 q->ipqe_flags |= pkt_flags;
523 m_cat(m, q->ipqe_m);
524 q->ipqe_m = m;
525 q->ipre_mlast = m; /* last mbuf may have changed */
526 TRAVERSE(q->ipre_mlast);
527 tiqe = q;
528 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
529 TCP_REASS_COUNTER_INCR(&tcp_reass_prependfirst);
530 goto skip_replacement;
531 }
532 } else {
533 TCP_REASS_COUNTER_INCR(&tcp_reass_empty);
534 }
535
536 /*
537 * Find a segment which begins after this one does.
538 */
539 for (p = NULL; q != NULL; q = nq) {
540 nq = TAILQ_NEXT(q, ipqe_q);
541 #ifdef TCP_REASS_COUNTERS
542 count++;
543 #endif
544 /*
545 * If the received segment is just right after this
546 * fragment, merge the two together and then check
547 * for further overlaps.
548 */
549 if (q->ipqe_seq + q->ipqe_len == pkt_seq) {
550 #ifdef TCPREASS_DEBUG
551 printf("tcp_reass[%p]: concat %u:%u(%u) to %u:%u(%u)\n",
552 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
553 q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len);
554 #endif
555 pkt_len += q->ipqe_len;
556 pkt_flags |= q->ipqe_flags;
557 pkt_seq = q->ipqe_seq;
558 m_cat(q->ipre_mlast, m);
559 TRAVERSE(q->ipre_mlast);
560 m = q->ipqe_m;
561 TCP_REASS_COUNTER_INCR(&tcp_reass_append);
562 goto free_ipqe;
563 }
564 /*
565 * If the received segment is completely past this
566 * fragment, we need to go the next fragment.
567 */
568 if (SEQ_LT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
569 p = q;
570 continue;
571 }
572 /*
573 * If the fragment is past the received segment,
574 * it (or any following) can't be concatenated.
575 */
576 if (SEQ_GT(q->ipqe_seq, pkt_seq + pkt_len)) {
577 TCP_REASS_COUNTER_INCR(&tcp_reass_insert);
578 break;
579 }
580
581 /*
582 * We've received all the data in this segment before.
583 * mark it as a duplicate and return.
584 */
585 if (SEQ_LEQ(q->ipqe_seq, pkt_seq) &&
586 SEQ_GEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
587 tcps = TCP_STAT_GETREF();
588 tcps[TCP_STAT_RCVDUPPACK]++;
589 tcps[TCP_STAT_RCVDUPBYTE] += pkt_len;
590 TCP_STAT_PUTREF();
591 tcp_new_dsack(tp, pkt_seq, pkt_len);
592 m_freem(m);
593 if (tiqe != NULL) {
594 tcpipqent_free(tiqe);
595 }
596 TCP_REASS_COUNTER_INCR(&tcp_reass_segdup);
597 goto out;
598 }
599 /*
600 * Received segment completely overlaps this fragment
601 * so we drop the fragment (this keeps the temporal
602 * ordering of segments correct).
603 */
604 if (SEQ_GEQ(q->ipqe_seq, pkt_seq) &&
605 SEQ_LEQ(q->ipqe_seq + q->ipqe_len, pkt_seq + pkt_len)) {
606 rcvpartdupbyte += q->ipqe_len;
607 m_freem(q->ipqe_m);
608 TCP_REASS_COUNTER_INCR(&tcp_reass_fragdup);
609 goto free_ipqe;
610 }
611 /*
612 * RX'ed segment extends past the end of the
613 * fragment. Drop the overlapping bytes. Then
614 * merge the fragment and segment then treat as
615 * a longer received packet.
616 */
617 if (SEQ_LT(q->ipqe_seq, pkt_seq) &&
618 SEQ_GT(q->ipqe_seq + q->ipqe_len, pkt_seq)) {
619 int overlap = q->ipqe_seq + q->ipqe_len - pkt_seq;
620 #ifdef TCPREASS_DEBUG
621 printf("tcp_reass[%p]: trim starting %d bytes of %u:%u(%u)\n",
622 tp, overlap,
623 pkt_seq, pkt_seq + pkt_len, pkt_len);
624 #endif
625 m_adj(m, overlap);
626 rcvpartdupbyte += overlap;
627 m_cat(q->ipre_mlast, m);
628 TRAVERSE(q->ipre_mlast);
629 m = q->ipqe_m;
630 pkt_seq = q->ipqe_seq;
631 pkt_len += q->ipqe_len - overlap;
632 rcvoobyte -= overlap;
633 TCP_REASS_COUNTER_INCR(&tcp_reass_overlaptail);
634 goto free_ipqe;
635 }
636 /*
637 * RX'ed segment extends past the front of the
638 * fragment. Drop the overlapping bytes on the
639 * received packet. The packet will then be
640 * contatentated with this fragment a bit later.
641 */
642 if (SEQ_GT(q->ipqe_seq, pkt_seq) &&
643 SEQ_LT(q->ipqe_seq, pkt_seq + pkt_len)) {
644 int overlap = pkt_seq + pkt_len - q->ipqe_seq;
645 #ifdef TCPREASS_DEBUG
646 printf("tcp_reass[%p]: trim trailing %d bytes of %u:%u(%u)\n",
647 tp, overlap,
648 pkt_seq, pkt_seq + pkt_len, pkt_len);
649 #endif
650 m_adj(m, -overlap);
651 pkt_len -= overlap;
652 rcvpartdupbyte += overlap;
653 TCP_REASS_COUNTER_INCR(&tcp_reass_overlapfront);
654 rcvoobyte -= overlap;
655 }
656 /*
657 * If the received segment immediates precedes this
658 * fragment then tack the fragment onto this segment
659 * and reinsert the data.
660 */
661 if (q->ipqe_seq == pkt_seq + pkt_len) {
662 #ifdef TCPREASS_DEBUG
663 printf("tcp_reass[%p]: append %u:%u(%u) to %u:%u(%u)\n",
664 tp, q->ipqe_seq, q->ipqe_seq + q->ipqe_len, q->ipqe_len,
665 pkt_seq, pkt_seq + pkt_len, pkt_len);
666 #endif
667 pkt_len += q->ipqe_len;
668 pkt_flags |= q->ipqe_flags;
669 m_cat(m, q->ipqe_m);
670 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
671 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
672 tp->t_segqlen--;
673 KASSERT(tp->t_segqlen >= 0);
674 KASSERT(tp->t_segqlen != 0 ||
675 (TAILQ_EMPTY(&tp->segq) &&
676 TAILQ_EMPTY(&tp->timeq)));
677 if (tiqe == NULL) {
678 tiqe = q;
679 } else {
680 tcpipqent_free(q);
681 }
682 TCP_REASS_COUNTER_INCR(&tcp_reass_prepend);
683 break;
684 }
685 /*
686 * If the fragment is before the segment, remember it.
687 * When this loop is terminated, p will contain the
688 * pointer to fragment that is right before the received
689 * segment.
690 */
691 if (SEQ_LEQ(q->ipqe_seq, pkt_seq))
692 p = q;
693
694 continue;
695
696 /*
697 * This is a common operation. It also will allow
698 * to save doing a malloc/free in most instances.
699 */
700 free_ipqe:
701 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
702 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
703 tp->t_segqlen--;
704 KASSERT(tp->t_segqlen >= 0);
705 KASSERT(tp->t_segqlen != 0 ||
706 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
707 if (tiqe == NULL) {
708 tiqe = q;
709 } else {
710 tcpipqent_free(q);
711 }
712 }
713
714 #ifdef TCP_REASS_COUNTERS
715 if (count > 7)
716 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[0]);
717 else if (count > 0)
718 TCP_REASS_COUNTER_INCR(&tcp_reass_iteration[count]);
719 #endif
720
721 insert_it:
722
723 /*
724 * Allocate a new queue entry since the received segment did not
725 * collapse onto any other out-of-order block; thus we are allocating
726 * a new block. If it had collapsed, tiqe would not be NULL and
727 * we would be reusing it.
728 * XXX If we can't, just drop the packet. XXX
729 */
730 if (tiqe == NULL) {
731 tiqe = tcpipqent_alloc();
732 if (tiqe == NULL) {
733 TCP_STATINC(TCP_STAT_RCVMEMDROP);
734 m_freem(m);
735 goto out;
736 }
737 }
738
739 /*
740 * Update the counters.
741 */
742 tp->t_rcvoopack++;
743 tcps = TCP_STAT_GETREF();
744 tcps[TCP_STAT_RCVOOPACK]++;
745 tcps[TCP_STAT_RCVOOBYTE] += rcvoobyte;
746 if (rcvpartdupbyte) {
747 tcps[TCP_STAT_RCVPARTDUPPACK]++;
748 tcps[TCP_STAT_RCVPARTDUPBYTE] += rcvpartdupbyte;
749 }
750 TCP_STAT_PUTREF();
751
752 /*
753 * Insert the new fragment queue entry into both queues.
754 */
755 tiqe->ipqe_m = m;
756 tiqe->ipre_mlast = m;
757 tiqe->ipqe_seq = pkt_seq;
758 tiqe->ipqe_len = pkt_len;
759 tiqe->ipqe_flags = pkt_flags;
760 if (p == NULL) {
761 TAILQ_INSERT_HEAD(&tp->segq, tiqe, ipqe_q);
762 #ifdef TCPREASS_DEBUG
763 if (tiqe->ipqe_seq != tp->rcv_nxt)
764 printf("tcp_reass[%p]: insert %u:%u(%u) at front\n",
765 tp, pkt_seq, pkt_seq + pkt_len, pkt_len);
766 #endif
767 } else {
768 TAILQ_INSERT_AFTER(&tp->segq, p, tiqe, ipqe_q);
769 #ifdef TCPREASS_DEBUG
770 printf("tcp_reass[%p]: insert %u:%u(%u) after %u:%u(%u)\n",
771 tp, pkt_seq, pkt_seq + pkt_len, pkt_len,
772 p->ipqe_seq, p->ipqe_seq + p->ipqe_len, p->ipqe_len);
773 #endif
774 }
775 tp->t_segqlen++;
776
777 skip_replacement:
778
779 TAILQ_INSERT_HEAD(&tp->timeq, tiqe, ipqe_timeq);
780
781 present:
782 /*
783 * Present data to user, advancing rcv_nxt through
784 * completed sequence space.
785 */
786 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
787 goto out;
788 q = TAILQ_FIRST(&tp->segq);
789 if (q == NULL || q->ipqe_seq != tp->rcv_nxt)
790 goto out;
791 if (tp->t_state == TCPS_SYN_RECEIVED && q->ipqe_len)
792 goto out;
793
794 tp->rcv_nxt += q->ipqe_len;
795 pkt_flags = q->ipqe_flags & TH_FIN;
796 nd6_hint(tp);
797
798 TAILQ_REMOVE(&tp->segq, q, ipqe_q);
799 TAILQ_REMOVE(&tp->timeq, q, ipqe_timeq);
800 tp->t_segqlen--;
801 KASSERT(tp->t_segqlen >= 0);
802 KASSERT(tp->t_segqlen != 0 ||
803 (TAILQ_EMPTY(&tp->segq) && TAILQ_EMPTY(&tp->timeq)));
804 if (so->so_state & SS_CANTRCVMORE)
805 m_freem(q->ipqe_m);
806 else
807 sbappendstream(&so->so_rcv, q->ipqe_m);
808 tcpipqent_free(q);
809 TCP_REASS_UNLOCK(tp);
810 sorwakeup(so);
811 return (pkt_flags);
812 out:
813 TCP_REASS_UNLOCK(tp);
814 return (0);
815 }
816
817 #ifdef INET6
818 int
tcp6_input(struct mbuf ** mp,int * offp,int proto)819 tcp6_input(struct mbuf **mp, int *offp, int proto)
820 {
821 struct mbuf *m = *mp;
822
823 /*
824 * draft-itojun-ipv6-tcp-to-anycast
825 * better place to put this in?
826 */
827 if (m->m_flags & M_ANYCAST6) {
828 struct ip6_hdr *ip6;
829 if (m->m_len < sizeof(struct ip6_hdr)) {
830 if ((m = m_pullup(m, sizeof(struct ip6_hdr))) == NULL) {
831 TCP_STATINC(TCP_STAT_RCVSHORT);
832 return IPPROTO_DONE;
833 }
834 }
835 ip6 = mtod(m, struct ip6_hdr *);
836 icmp6_error(m, ICMP6_DST_UNREACH, ICMP6_DST_UNREACH_ADDR,
837 (char *)&ip6->ip6_dst - (char *)ip6);
838 return IPPROTO_DONE;
839 }
840
841 tcp_input(m, *offp, proto);
842 return IPPROTO_DONE;
843 }
844 #endif
845
846 #ifdef INET
847 static void
tcp4_log_refused(const struct ip * ip,const struct tcphdr * th)848 tcp4_log_refused(const struct ip *ip, const struct tcphdr *th)
849 {
850 char src[INET_ADDRSTRLEN];
851 char dst[INET_ADDRSTRLEN];
852
853 if (ip) {
854 in_print(src, sizeof(src), &ip->ip_src);
855 in_print(dst, sizeof(dst), &ip->ip_dst);
856 }
857 else {
858 strlcpy(src, "(unknown)", sizeof(src));
859 strlcpy(dst, "(unknown)", sizeof(dst));
860 }
861 log(LOG_INFO,
862 "Connection attempt to TCP %s:%d from %s:%d\n",
863 dst, ntohs(th->th_dport),
864 src, ntohs(th->th_sport));
865 }
866 #endif
867
868 #ifdef INET6
869 static void
tcp6_log_refused(const struct ip6_hdr * ip6,const struct tcphdr * th)870 tcp6_log_refused(const struct ip6_hdr *ip6, const struct tcphdr *th)
871 {
872 char src[INET6_ADDRSTRLEN];
873 char dst[INET6_ADDRSTRLEN];
874
875 if (ip6) {
876 in6_print(src, sizeof(src), &ip6->ip6_src);
877 in6_print(dst, sizeof(dst), &ip6->ip6_dst);
878 }
879 else {
880 strlcpy(src, "(unknown v6)", sizeof(src));
881 strlcpy(dst, "(unknown v6)", sizeof(dst));
882 }
883 log(LOG_INFO,
884 "Connection attempt to TCP [%s]:%d from [%s]:%d\n",
885 dst, ntohs(th->th_dport),
886 src, ntohs(th->th_sport));
887 }
888 #endif
889
890 /*
891 * Checksum extended TCP header and data.
892 */
893 int
tcp_input_checksum(int af,struct mbuf * m,const struct tcphdr * th,int toff,int off,int tlen)894 tcp_input_checksum(int af, struct mbuf *m, const struct tcphdr *th,
895 int toff, int off, int tlen)
896 {
897 struct ifnet *rcvif;
898 int s;
899
900 /*
901 * XXX it's better to record and check if this mbuf is
902 * already checked.
903 */
904
905 rcvif = m_get_rcvif(m, &s);
906
907 switch (af) {
908 #ifdef INET
909 case AF_INET:
910 switch (m->m_pkthdr.csum_flags &
911 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv4) |
912 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
913 case M_CSUM_TCPv4|M_CSUM_TCP_UDP_BAD:
914 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_bad);
915 goto badcsum;
916
917 case M_CSUM_TCPv4|M_CSUM_DATA: {
918 u_int32_t hw_csum = m->m_pkthdr.csum_data;
919
920 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_data);
921 if (m->m_pkthdr.csum_flags & M_CSUM_NO_PSEUDOHDR) {
922 const struct ip *ip =
923 mtod(m, const struct ip *);
924
925 hw_csum = in_cksum_phdr(ip->ip_src.s_addr,
926 ip->ip_dst.s_addr,
927 htons(hw_csum + tlen + off + IPPROTO_TCP));
928 }
929 if ((hw_csum ^ 0xffff) != 0)
930 goto badcsum;
931 break;
932 }
933
934 case M_CSUM_TCPv4:
935 /* Checksum was okay. */
936 TCP_CSUM_COUNTER_INCR(&tcp_hwcsum_ok);
937 break;
938
939 default:
940 /*
941 * Must compute it ourselves. Maybe skip checksum
942 * on loopback interfaces.
943 */
944 if (__predict_true(!(rcvif->if_flags & IFF_LOOPBACK) ||
945 tcp_do_loopback_cksum)) {
946 TCP_CSUM_COUNTER_INCR(&tcp_swcsum);
947 if (in4_cksum(m, IPPROTO_TCP, toff,
948 tlen + off) != 0)
949 goto badcsum;
950 }
951 break;
952 }
953 break;
954 #endif /* INET4 */
955
956 #ifdef INET6
957 case AF_INET6:
958 switch (m->m_pkthdr.csum_flags &
959 ((rcvif->if_csum_flags_rx & M_CSUM_TCPv6) |
960 M_CSUM_TCP_UDP_BAD | M_CSUM_DATA)) {
961 case M_CSUM_TCPv6|M_CSUM_TCP_UDP_BAD:
962 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_bad);
963 goto badcsum;
964
965 #if 0 /* notyet */
966 case M_CSUM_TCPv6|M_CSUM_DATA:
967 #endif
968
969 case M_CSUM_TCPv6:
970 /* Checksum was okay. */
971 TCP_CSUM_COUNTER_INCR(&tcp6_hwcsum_ok);
972 break;
973
974 default:
975 /*
976 * Must compute it ourselves. Maybe skip checksum
977 * on loopback interfaces.
978 */
979 if (__predict_true((m->m_flags & M_LOOP) == 0 ||
980 tcp_do_loopback_cksum)) {
981 TCP_CSUM_COUNTER_INCR(&tcp6_swcsum);
982 if (in6_cksum(m, IPPROTO_TCP, toff,
983 tlen + off) != 0)
984 goto badcsum;
985 }
986 }
987 break;
988 #endif /* INET6 */
989 }
990 m_put_rcvif(rcvif, &s);
991
992 return 0;
993
994 badcsum:
995 m_put_rcvif(rcvif, &s);
996 TCP_STATINC(TCP_STAT_RCVBADSUM);
997 return -1;
998 }
999
1000 /* When a packet arrives addressed to a vestigial tcpbp, we
1001 * nevertheless have to respond to it per the spec.
1002 */
tcp_vtw_input(struct tcphdr * th,vestigial_inpcb_t * vp,struct mbuf * m,int tlen,int multicast)1003 static void tcp_vtw_input(struct tcphdr *th, vestigial_inpcb_t *vp,
1004 struct mbuf *m, int tlen, int multicast)
1005 {
1006 int tiflags;
1007 int todrop;
1008 uint32_t t_flags = 0;
1009 uint64_t *tcps;
1010
1011 tiflags = th->th_flags;
1012 todrop = vp->rcv_nxt - th->th_seq;
1013
1014 if (todrop > 0) {
1015 if (tiflags & TH_SYN) {
1016 tiflags &= ~TH_SYN;
1017 ++th->th_seq;
1018 if (th->th_urp > 1)
1019 --th->th_urp;
1020 else {
1021 tiflags &= ~TH_URG;
1022 th->th_urp = 0;
1023 }
1024 --todrop;
1025 }
1026 if (todrop > tlen ||
1027 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1028 /*
1029 * Any valid FIN or RST must be to the left of the
1030 * window. At this point the FIN or RST must be a
1031 * duplicate or out of sequence; drop it.
1032 */
1033 if (tiflags & TH_RST)
1034 goto drop;
1035 tiflags &= ~(TH_FIN|TH_RST);
1036 /*
1037 * Send an ACK to resynchronize and drop any data.
1038 * But keep on processing for RST or ACK.
1039 */
1040 t_flags |= TF_ACKNOW;
1041 todrop = tlen;
1042 tcps = TCP_STAT_GETREF();
1043 tcps[TCP_STAT_RCVDUPPACK] += 1;
1044 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
1045 TCP_STAT_PUTREF();
1046 } else if ((tiflags & TH_RST)
1047 && th->th_seq != vp->rcv_nxt) {
1048 /*
1049 * Test for reset before adjusting the sequence
1050 * number for overlapping data.
1051 */
1052 goto dropafterack_ratelim;
1053 } else {
1054 tcps = TCP_STAT_GETREF();
1055 tcps[TCP_STAT_RCVPARTDUPPACK] += 1;
1056 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
1057 TCP_STAT_PUTREF();
1058 }
1059
1060 // tcp_new_dsack(tp, th->th_seq, todrop);
1061 // hdroptlen += todrop; /*drop from head afterwards*/
1062
1063 th->th_seq += todrop;
1064 tlen -= todrop;
1065
1066 if (th->th_urp > todrop)
1067 th->th_urp -= todrop;
1068 else {
1069 tiflags &= ~TH_URG;
1070 th->th_urp = 0;
1071 }
1072 }
1073
1074 /*
1075 * If new data are received on a connection after the
1076 * user processes are gone, then RST the other end.
1077 */
1078 if (tlen) {
1079 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
1080 goto dropwithreset;
1081 }
1082
1083 /*
1084 * If segment ends after window, drop trailing data
1085 * (and PUSH and FIN); if nothing left, just ACK.
1086 */
1087 todrop = (th->th_seq + tlen) - (vp->rcv_nxt+vp->rcv_wnd);
1088
1089 if (todrop > 0) {
1090 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
1091 if (todrop >= tlen) {
1092 /*
1093 * The segment actually starts after the window.
1094 * th->th_seq + tlen - vp->rcv_nxt - vp->rcv_wnd >= tlen
1095 * th->th_seq - vp->rcv_nxt - vp->rcv_wnd >= 0
1096 * th->th_seq >= vp->rcv_nxt + vp->rcv_wnd
1097 */
1098 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
1099 /*
1100 * If a new connection request is received
1101 * while in TIME_WAIT, drop the old connection
1102 * and start over if the sequence numbers
1103 * are above the previous ones.
1104 */
1105 if ((tiflags & TH_SYN)
1106 && SEQ_GT(th->th_seq, vp->rcv_nxt)) {
1107 /* We only support this in the !NOFDREF case, which
1108 * is to say: not here.
1109 */
1110 goto dropwithreset;
1111 }
1112 /*
1113 * If window is closed can only take segments at
1114 * window edge, and have to drop data and PUSH from
1115 * incoming segments. Continue processing, but
1116 * remember to ack. Otherwise, drop segment
1117 * and (if not RST) ack.
1118 */
1119 if (vp->rcv_wnd == 0 && th->th_seq == vp->rcv_nxt) {
1120 t_flags |= TF_ACKNOW;
1121 TCP_STATINC(TCP_STAT_RCVWINPROBE);
1122 } else
1123 goto dropafterack;
1124 } else
1125 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
1126 m_adj(m, -todrop);
1127 tlen -= todrop;
1128 tiflags &= ~(TH_PUSH|TH_FIN);
1129 }
1130
1131 if (tiflags & TH_RST) {
1132 if (th->th_seq != vp->rcv_nxt)
1133 goto dropafterack_ratelim;
1134
1135 vtw_del(vp->ctl, vp->vtw);
1136 goto drop;
1137 }
1138
1139 /*
1140 * If the ACK bit is off we drop the segment and return.
1141 */
1142 if ((tiflags & TH_ACK) == 0) {
1143 if (t_flags & TF_ACKNOW)
1144 goto dropafterack;
1145 else
1146 goto drop;
1147 }
1148
1149 /*
1150 * In TIME_WAIT state the only thing that should arrive
1151 * is a retransmission of the remote FIN. Acknowledge
1152 * it and restart the finack timer.
1153 */
1154 vtw_restart(vp);
1155 goto dropafterack;
1156
1157 dropafterack:
1158 /*
1159 * Generate an ACK dropping incoming segment if it occupies
1160 * sequence space, where the ACK reflects our state.
1161 */
1162 if (tiflags & TH_RST)
1163 goto drop;
1164 goto dropafterack2;
1165
1166 dropafterack_ratelim:
1167 /*
1168 * We may want to rate-limit ACKs against SYN/RST attack.
1169 */
1170 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
1171 tcp_ackdrop_ppslim) == 0) {
1172 /* XXX stat */
1173 goto drop;
1174 }
1175 /* ...fall into dropafterack2... */
1176
1177 dropafterack2:
1178 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, th->th_ack,
1179 TH_ACK);
1180 return;
1181
1182 dropwithreset:
1183 /*
1184 * Generate a RST, dropping incoming segment.
1185 * Make ACK acceptable to originator of segment.
1186 */
1187 if (tiflags & TH_RST)
1188 goto drop;
1189
1190 if (tiflags & TH_ACK)
1191 tcp_respond(0, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
1192 else {
1193 if (tiflags & TH_SYN)
1194 ++tlen;
1195 (void)tcp_respond(0, m, m, th, th->th_seq + tlen, (tcp_seq)0,
1196 TH_RST|TH_ACK);
1197 }
1198 return;
1199 drop:
1200 m_freem(m);
1201 }
1202
1203 /*
1204 * TCP input routine, follows pages 65-76 of RFC 793 very closely.
1205 */
1206 void
tcp_input(struct mbuf * m,...)1207 tcp_input(struct mbuf *m, ...)
1208 {
1209 struct tcphdr *th;
1210 struct ip *ip;
1211 struct inpcb *inp;
1212 #ifdef INET6
1213 struct ip6_hdr *ip6;
1214 struct in6pcb *in6p;
1215 #endif
1216 u_int8_t *optp = NULL;
1217 int optlen = 0;
1218 int len, tlen, toff, hdroptlen = 0;
1219 struct tcpcb *tp = 0;
1220 int tiflags;
1221 struct socket *so = NULL;
1222 int todrop, acked, ourfinisacked, needoutput = 0;
1223 bool dupseg;
1224 #ifdef TCP_DEBUG
1225 short ostate = 0;
1226 #endif
1227 u_long tiwin;
1228 struct tcp_opt_info opti;
1229 int off, iphlen;
1230 va_list ap;
1231 int af; /* af on the wire */
1232 struct mbuf *tcp_saveti = NULL;
1233 uint32_t ts_rtt;
1234 uint8_t iptos;
1235 uint64_t *tcps;
1236 vestigial_inpcb_t vestige;
1237
1238 vestige.valid = 0;
1239
1240 MCLAIM(m, &tcp_rx_mowner);
1241 va_start(ap, m);
1242 toff = va_arg(ap, int);
1243 (void)va_arg(ap, int); /* ignore value, advance ap */
1244 va_end(ap);
1245
1246 TCP_STATINC(TCP_STAT_RCVTOTAL);
1247
1248 memset(&opti, 0, sizeof(opti));
1249 opti.ts_present = 0;
1250 opti.maxseg = 0;
1251
1252 /*
1253 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN.
1254 *
1255 * TCP is, by definition, unicast, so we reject all
1256 * multicast outright.
1257 *
1258 * Note, there are additional src/dst address checks in
1259 * the AF-specific code below.
1260 */
1261 if (m->m_flags & (M_BCAST|M_MCAST)) {
1262 /* XXX stat */
1263 goto drop;
1264 }
1265 #ifdef INET6
1266 if (m->m_flags & M_ANYCAST6) {
1267 /* XXX stat */
1268 goto drop;
1269 }
1270 #endif
1271
1272 /*
1273 * Get IP and TCP header.
1274 * Note: IP leaves IP header in first mbuf.
1275 */
1276 ip = mtod(m, struct ip *);
1277 switch (ip->ip_v) {
1278 #ifdef INET
1279 case 4:
1280 #ifdef INET6
1281 ip6 = NULL;
1282 #endif
1283 af = AF_INET;
1284 iphlen = sizeof(struct ip);
1285 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1286 sizeof(struct tcphdr));
1287 if (th == NULL) {
1288 TCP_STATINC(TCP_STAT_RCVSHORT);
1289 return;
1290 }
1291 /* We do the checksum after PCB lookup... */
1292 len = ntohs(ip->ip_len);
1293 tlen = len - toff;
1294 iptos = ip->ip_tos;
1295 break;
1296 #endif
1297 #ifdef INET6
1298 case 6:
1299 ip = NULL;
1300 iphlen = sizeof(struct ip6_hdr);
1301 af = AF_INET6;
1302 ip6 = mtod(m, struct ip6_hdr *);
1303 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff,
1304 sizeof(struct tcphdr));
1305 if (th == NULL) {
1306 TCP_STATINC(TCP_STAT_RCVSHORT);
1307 return;
1308 }
1309
1310 /* Be proactive about malicious use of IPv4 mapped address */
1311 if (IN6_IS_ADDR_V4MAPPED(&ip6->ip6_src) ||
1312 IN6_IS_ADDR_V4MAPPED(&ip6->ip6_dst)) {
1313 /* XXX stat */
1314 goto drop;
1315 }
1316
1317 /*
1318 * Be proactive about unspecified IPv6 address in source.
1319 * As we use all-zero to indicate unbounded/unconnected pcb,
1320 * unspecified IPv6 address can be used to confuse us.
1321 *
1322 * Note that packets with unspecified IPv6 destination is
1323 * already dropped in ip6_input.
1324 */
1325 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1326 /* XXX stat */
1327 goto drop;
1328 }
1329
1330 /*
1331 * Make sure destination address is not multicast.
1332 * Source address checked in ip6_input().
1333 */
1334 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
1335 /* XXX stat */
1336 goto drop;
1337 }
1338
1339 /* We do the checksum after PCB lookup... */
1340 len = m->m_pkthdr.len;
1341 tlen = len - toff;
1342 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
1343 break;
1344 #endif
1345 default:
1346 m_freem(m);
1347 return;
1348 }
1349
1350 KASSERT(TCP_HDR_ALIGNED_P(th));
1351
1352 /*
1353 * Check that TCP offset makes sense,
1354 * pull out TCP options and adjust length. XXX
1355 */
1356 off = th->th_off << 2;
1357 if (off < sizeof (struct tcphdr) || off > tlen) {
1358 TCP_STATINC(TCP_STAT_RCVBADOFF);
1359 goto drop;
1360 }
1361 tlen -= off;
1362
1363 /*
1364 * tcp_input() has been modified to use tlen to mean the TCP data
1365 * length throughout the function. Other functions can use
1366 * m->m_pkthdr.len as the basis for calculating the TCP data length.
1367 * rja
1368 */
1369
1370 if (off > sizeof (struct tcphdr)) {
1371 IP6_EXTHDR_GET(th, struct tcphdr *, m, toff, off);
1372 if (th == NULL) {
1373 TCP_STATINC(TCP_STAT_RCVSHORT);
1374 return;
1375 }
1376 /*
1377 * NOTE: ip/ip6 will not be affected by m_pulldown()
1378 * (as they're before toff) and we don't need to update those.
1379 */
1380 KASSERT(TCP_HDR_ALIGNED_P(th));
1381 optlen = off - sizeof (struct tcphdr);
1382 optp = ((u_int8_t *)th) + sizeof(struct tcphdr);
1383 /*
1384 * Do quick retrieval of timestamp options ("options
1385 * prediction?"). If timestamp is the only option and it's
1386 * formatted as recommended in RFC 1323 appendix A, we
1387 * quickly get the values now and not bother calling
1388 * tcp_dooptions(), etc.
1389 */
1390 if ((optlen == TCPOLEN_TSTAMP_APPA ||
1391 (optlen > TCPOLEN_TSTAMP_APPA &&
1392 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
1393 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
1394 (th->th_flags & TH_SYN) == 0) {
1395 opti.ts_present = 1;
1396 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
1397 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
1398 optp = NULL; /* we've parsed the options */
1399 }
1400 }
1401 tiflags = th->th_flags;
1402
1403 /*
1404 * Checksum extended TCP header and data
1405 */
1406 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1407 goto badcsum;
1408
1409 /*
1410 * Locate pcb for segment.
1411 */
1412 findpcb:
1413 inp = NULL;
1414 #ifdef INET6
1415 in6p = NULL;
1416 #endif
1417 switch (af) {
1418 #ifdef INET
1419 case AF_INET:
1420 inp = in_pcblookup_connect(&tcbtable, ip->ip_src, th->th_sport,
1421 ip->ip_dst, th->th_dport,
1422 &vestige);
1423 if (inp == 0 && !vestige.valid) {
1424 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1425 inp = in_pcblookup_bind(&tcbtable, ip->ip_dst, th->th_dport);
1426 }
1427 #ifdef INET6
1428 if (inp == 0 && !vestige.valid) {
1429 struct in6_addr s, d;
1430
1431 /* mapped addr case */
1432 in6_in_2_v4mapin6(&ip->ip_src, &s);
1433 in6_in_2_v4mapin6(&ip->ip_dst, &d);
1434 in6p = in6_pcblookup_connect(&tcbtable, &s,
1435 th->th_sport, &d, th->th_dport,
1436 0, &vestige);
1437 if (in6p == 0 && !vestige.valid) {
1438 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1439 in6p = in6_pcblookup_bind(&tcbtable, &d,
1440 th->th_dport, 0);
1441 }
1442 }
1443 #endif
1444 #ifndef INET6
1445 if (inp == 0 && !vestige.valid)
1446 #else
1447 if (inp == 0 && in6p == 0 && !vestige.valid)
1448 #endif
1449 {
1450 TCP_STATINC(TCP_STAT_NOPORT);
1451 if (tcp_log_refused &&
1452 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1453 tcp4_log_refused(ip, th);
1454 }
1455 tcp_fields_to_host(th);
1456 goto dropwithreset_ratelim;
1457 }
1458 #if defined(IPSEC)
1459 if (ipsec_used) {
1460 if (inp &&
1461 (inp->inp_socket->so_options & SO_ACCEPTCONN) == 0
1462 && ipsec4_in_reject(m, inp)) {
1463 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1464 goto drop;
1465 }
1466 #ifdef INET6
1467 else if (in6p &&
1468 (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0
1469 && ipsec6_in_reject_so(m, in6p->in6p_socket)) {
1470 IPSEC_STATINC(IPSEC_STAT_IN_POLVIO);
1471 goto drop;
1472 }
1473 #endif
1474 }
1475 #endif /*IPSEC*/
1476 break;
1477 #endif /*INET*/
1478 #ifdef INET6
1479 case AF_INET6:
1480 {
1481 int faith;
1482
1483 #if defined(NFAITH) && NFAITH > 0
1484 faith = faithprefix(&ip6->ip6_dst);
1485 #else
1486 faith = 0;
1487 #endif
1488 in6p = in6_pcblookup_connect(&tcbtable, &ip6->ip6_src,
1489 th->th_sport, &ip6->ip6_dst, th->th_dport, faith, &vestige);
1490 if (!in6p && !vestige.valid) {
1491 TCP_STATINC(TCP_STAT_PCBHASHMISS);
1492 in6p = in6_pcblookup_bind(&tcbtable, &ip6->ip6_dst,
1493 th->th_dport, faith);
1494 }
1495 if (!in6p && !vestige.valid) {
1496 TCP_STATINC(TCP_STAT_NOPORT);
1497 if (tcp_log_refused &&
1498 (tiflags & (TH_RST|TH_ACK|TH_SYN)) == TH_SYN) {
1499 tcp6_log_refused(ip6, th);
1500 }
1501 tcp_fields_to_host(th);
1502 goto dropwithreset_ratelim;
1503 }
1504 #if defined(IPSEC)
1505 if (ipsec_used && in6p
1506 && (in6p->in6p_socket->so_options & SO_ACCEPTCONN) == 0
1507 && ipsec6_in_reject(m, in6p)) {
1508 IPSEC6_STATINC(IPSEC_STAT_IN_POLVIO);
1509 goto drop;
1510 }
1511 #endif /*IPSEC*/
1512 break;
1513 }
1514 #endif
1515 }
1516
1517 /*
1518 * If the state is CLOSED (i.e., TCB does not exist) then
1519 * all data in the incoming segment is discarded.
1520 * If the TCB exists but is in CLOSED state, it is embryonic,
1521 * but should either do a listen or a connect soon.
1522 */
1523 tp = NULL;
1524 so = NULL;
1525 if (inp) {
1526 /* Check the minimum TTL for socket. */
1527 if (ip->ip_ttl < inp->inp_ip_minttl)
1528 goto drop;
1529
1530 tp = intotcpcb(inp);
1531 so = inp->inp_socket;
1532 }
1533 #ifdef INET6
1534 else if (in6p) {
1535 tp = in6totcpcb(in6p);
1536 so = in6p->in6p_socket;
1537 }
1538 #endif
1539 else if (vestige.valid) {
1540 int mc = 0;
1541
1542 /* We do not support the resurrection of vtw tcpcps.
1543 */
1544 if (tcp_input_checksum(af, m, th, toff, off, tlen))
1545 goto badcsum;
1546
1547 switch (af) {
1548 #ifdef INET6
1549 case AF_INET6:
1550 mc = IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst);
1551 break;
1552 #endif
1553
1554 case AF_INET:
1555 mc = (IN_MULTICAST(ip->ip_dst.s_addr)
1556 || in_broadcast(ip->ip_dst,
1557 m_get_rcvif_NOMPSAFE(m)));
1558 break;
1559 }
1560
1561 tcp_fields_to_host(th);
1562 tcp_vtw_input(th, &vestige, m, tlen, mc);
1563 m = 0;
1564 goto drop;
1565 }
1566
1567 if (tp == 0) {
1568 tcp_fields_to_host(th);
1569 goto dropwithreset_ratelim;
1570 }
1571 if (tp->t_state == TCPS_CLOSED)
1572 goto drop;
1573
1574 KASSERT(so->so_lock == softnet_lock);
1575 KASSERT(solocked(so));
1576
1577 tcp_fields_to_host(th);
1578
1579 /* Unscale the window into a 32-bit value. */
1580 if ((tiflags & TH_SYN) == 0)
1581 tiwin = th->th_win << tp->snd_scale;
1582 else
1583 tiwin = th->th_win;
1584
1585 #ifdef INET6
1586 /* save packet options if user wanted */
1587 if (in6p && (in6p->in6p_flags & IN6P_CONTROLOPTS)) {
1588 if (in6p->in6p_options) {
1589 m_freem(in6p->in6p_options);
1590 in6p->in6p_options = 0;
1591 }
1592 KASSERT(ip6 != NULL);
1593 ip6_savecontrol(in6p, &in6p->in6p_options, ip6, m);
1594 }
1595 #endif
1596
1597 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
1598 union syn_cache_sa src;
1599 union syn_cache_sa dst;
1600
1601 memset(&src, 0, sizeof(src));
1602 memset(&dst, 0, sizeof(dst));
1603 switch (af) {
1604 #ifdef INET
1605 case AF_INET:
1606 src.sin.sin_len = sizeof(struct sockaddr_in);
1607 src.sin.sin_family = AF_INET;
1608 src.sin.sin_addr = ip->ip_src;
1609 src.sin.sin_port = th->th_sport;
1610
1611 dst.sin.sin_len = sizeof(struct sockaddr_in);
1612 dst.sin.sin_family = AF_INET;
1613 dst.sin.sin_addr = ip->ip_dst;
1614 dst.sin.sin_port = th->th_dport;
1615 break;
1616 #endif
1617 #ifdef INET6
1618 case AF_INET6:
1619 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
1620 src.sin6.sin6_family = AF_INET6;
1621 src.sin6.sin6_addr = ip6->ip6_src;
1622 src.sin6.sin6_port = th->th_sport;
1623
1624 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
1625 dst.sin6.sin6_family = AF_INET6;
1626 dst.sin6.sin6_addr = ip6->ip6_dst;
1627 dst.sin6.sin6_port = th->th_dport;
1628 break;
1629 #endif /* INET6 */
1630 default:
1631 goto badsyn; /*sanity*/
1632 }
1633
1634 if (so->so_options & SO_DEBUG) {
1635 #ifdef TCP_DEBUG
1636 ostate = tp->t_state;
1637 #endif
1638
1639 tcp_saveti = NULL;
1640 if (iphlen + sizeof(struct tcphdr) > MHLEN)
1641 goto nosave;
1642
1643 if (m->m_len > iphlen && (m->m_flags & M_EXT) == 0) {
1644 tcp_saveti = m_copym(m, 0, iphlen, M_DONTWAIT);
1645 if (!tcp_saveti)
1646 goto nosave;
1647 } else {
1648 MGETHDR(tcp_saveti, M_DONTWAIT, MT_HEADER);
1649 if (!tcp_saveti)
1650 goto nosave;
1651 MCLAIM(m, &tcp_mowner);
1652 tcp_saveti->m_len = iphlen;
1653 m_copydata(m, 0, iphlen,
1654 mtod(tcp_saveti, void *));
1655 }
1656
1657 if (M_TRAILINGSPACE(tcp_saveti) < sizeof(struct tcphdr)) {
1658 m_freem(tcp_saveti);
1659 tcp_saveti = NULL;
1660 } else {
1661 tcp_saveti->m_len += sizeof(struct tcphdr);
1662 memcpy(mtod(tcp_saveti, char *) + iphlen, th,
1663 sizeof(struct tcphdr));
1664 }
1665 nosave:;
1666 }
1667 if (so->so_options & SO_ACCEPTCONN) {
1668 if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
1669 if (tiflags & TH_RST) {
1670 syn_cache_reset(&src.sa, &dst.sa, th);
1671 } else if ((tiflags & (TH_ACK|TH_SYN)) ==
1672 (TH_ACK|TH_SYN)) {
1673 /*
1674 * Received a SYN,ACK. This should
1675 * never happen while we are in
1676 * LISTEN. Send an RST.
1677 */
1678 goto badsyn;
1679 } else if (tiflags & TH_ACK) {
1680 so = syn_cache_get(&src.sa, &dst.sa,
1681 th, toff, tlen, so, m);
1682 if (so == NULL) {
1683 /*
1684 * We don't have a SYN for
1685 * this ACK; send an RST.
1686 */
1687 goto badsyn;
1688 } else if (so ==
1689 (struct socket *)(-1)) {
1690 /*
1691 * We were unable to create
1692 * the connection. If the
1693 * 3-way handshake was
1694 * completed, and RST has
1695 * been sent to the peer.
1696 * Since the mbuf might be
1697 * in use for the reply,
1698 * do not free it.
1699 */
1700 m = NULL;
1701 } else {
1702 /*
1703 * We have created a
1704 * full-blown connection.
1705 */
1706 tp = NULL;
1707 inp = NULL;
1708 #ifdef INET6
1709 in6p = NULL;
1710 #endif
1711 switch (so->so_proto->pr_domain->dom_family) {
1712 #ifdef INET
1713 case AF_INET:
1714 inp = sotoinpcb(so);
1715 tp = intotcpcb(inp);
1716 break;
1717 #endif
1718 #ifdef INET6
1719 case AF_INET6:
1720 in6p = sotoin6pcb(so);
1721 tp = in6totcpcb(in6p);
1722 break;
1723 #endif
1724 }
1725 if (tp == NULL)
1726 goto badsyn; /*XXX*/
1727 tiwin <<= tp->snd_scale;
1728 goto after_listen;
1729 }
1730 } else {
1731 /*
1732 * None of RST, SYN or ACK was set.
1733 * This is an invalid packet for a
1734 * TCB in LISTEN state. Send a RST.
1735 */
1736 goto badsyn;
1737 }
1738 } else {
1739 /*
1740 * Received a SYN.
1741 *
1742 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
1743 */
1744 if (m->m_flags & (M_BCAST|M_MCAST))
1745 goto drop;
1746
1747 switch (af) {
1748 #ifdef INET6
1749 case AF_INET6:
1750 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
1751 goto drop;
1752 break;
1753 #endif /* INET6 */
1754 case AF_INET:
1755 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
1756 in_broadcast(ip->ip_dst,
1757 m_get_rcvif_NOMPSAFE(m)))
1758 goto drop;
1759 break;
1760 }
1761
1762 #ifdef INET6
1763 /*
1764 * If deprecated address is forbidden, we do
1765 * not accept SYN to deprecated interface
1766 * address to prevent any new inbound
1767 * connection from getting established.
1768 * When we do not accept SYN, we send a TCP
1769 * RST, with deprecated source address (instead
1770 * of dropping it). We compromise it as it is
1771 * much better for peer to send a RST, and
1772 * RST will be the final packet for the
1773 * exchange.
1774 *
1775 * If we do not forbid deprecated addresses, we
1776 * accept the SYN packet. RFC2462 does not
1777 * suggest dropping SYN in this case.
1778 * If we decipher RFC2462 5.5.4, it says like
1779 * this:
1780 * 1. use of deprecated addr with existing
1781 * communication is okay - "SHOULD continue
1782 * to be used"
1783 * 2. use of it with new communication:
1784 * (2a) "SHOULD NOT be used if alternate
1785 * address with sufficient scope is
1786 * available"
1787 * (2b) nothing mentioned otherwise.
1788 * Here we fall into (2b) case as we have no
1789 * choice in our source address selection - we
1790 * must obey the peer.
1791 *
1792 * The wording in RFC2462 is confusing, and
1793 * there are multiple description text for
1794 * deprecated address handling - worse, they
1795 * are not exactly the same. I believe 5.5.4
1796 * is the best one, so we follow 5.5.4.
1797 */
1798 if (af == AF_INET6 && !ip6_use_deprecated) {
1799 struct in6_ifaddr *ia6;
1800 int s;
1801 struct ifnet *rcvif = m_get_rcvif(m, &s);
1802 if (rcvif == NULL)
1803 goto dropwithreset; /* XXX */
1804 if ((ia6 = in6ifa_ifpwithaddr(rcvif,
1805 &ip6->ip6_dst)) &&
1806 (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
1807 tp = NULL;
1808 m_put_rcvif(rcvif, &s);
1809 goto dropwithreset;
1810 }
1811 m_put_rcvif(rcvif, &s);
1812 }
1813 #endif
1814
1815 #if defined(IPSEC)
1816 if (ipsec_used) {
1817 switch (af) {
1818 #ifdef INET
1819 case AF_INET:
1820 if (!ipsec4_in_reject_so(m, so))
1821 break;
1822 IPSEC_STATINC(
1823 IPSEC_STAT_IN_POLVIO);
1824 tp = NULL;
1825 goto dropwithreset;
1826 #endif
1827 #ifdef INET6
1828 case AF_INET6:
1829 if (!ipsec6_in_reject_so(m, so))
1830 break;
1831 IPSEC6_STATINC(
1832 IPSEC_STAT_IN_POLVIO);
1833 tp = NULL;
1834 goto dropwithreset;
1835 #endif /*INET6*/
1836 }
1837 }
1838 #endif /*IPSEC*/
1839
1840 /*
1841 * LISTEN socket received a SYN
1842 * from itself? This can't possibly
1843 * be valid; drop the packet.
1844 */
1845 if (th->th_sport == th->th_dport) {
1846 int i;
1847
1848 switch (af) {
1849 #ifdef INET
1850 case AF_INET:
1851 i = in_hosteq(ip->ip_src, ip->ip_dst);
1852 break;
1853 #endif
1854 #ifdef INET6
1855 case AF_INET6:
1856 i = IN6_ARE_ADDR_EQUAL(&ip6->ip6_src, &ip6->ip6_dst);
1857 break;
1858 #endif
1859 default:
1860 i = 1;
1861 }
1862 if (i) {
1863 TCP_STATINC(TCP_STAT_BADSYN);
1864 goto drop;
1865 }
1866 }
1867
1868 /*
1869 * SYN looks ok; create compressed TCP
1870 * state for it.
1871 */
1872 if (so->so_qlen <= so->so_qlimit &&
1873 syn_cache_add(&src.sa, &dst.sa, th, tlen,
1874 so, m, optp, optlen, &opti))
1875 m = NULL;
1876 }
1877 goto drop;
1878 }
1879 }
1880
1881 after_listen:
1882 #ifdef DIAGNOSTIC
1883 /*
1884 * Should not happen now that all embryonic connections
1885 * are handled with compressed state.
1886 */
1887 if (tp->t_state == TCPS_LISTEN)
1888 panic("tcp_input: TCPS_LISTEN");
1889 #endif
1890
1891 /*
1892 * Segment received on connection.
1893 * Reset idle time and keep-alive timer.
1894 */
1895 tp->t_rcvtime = tcp_now;
1896 if (TCPS_HAVEESTABLISHED(tp->t_state))
1897 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepidle);
1898
1899 /*
1900 * Process options.
1901 */
1902 #ifdef TCP_SIGNATURE
1903 if (optp || (tp->t_flags & TF_SIGNATURE))
1904 #else
1905 if (optp)
1906 #endif
1907 if (tcp_dooptions(tp, optp, optlen, th, m, toff, &opti) < 0)
1908 goto drop;
1909
1910 if (TCP_SACK_ENABLED(tp)) {
1911 tcp_del_sackholes(tp, th);
1912 }
1913
1914 if (TCP_ECN_ALLOWED(tp)) {
1915 if (tiflags & TH_CWR) {
1916 tp->t_flags &= ~TF_ECN_SND_ECE;
1917 }
1918 switch (iptos & IPTOS_ECN_MASK) {
1919 case IPTOS_ECN_CE:
1920 tp->t_flags |= TF_ECN_SND_ECE;
1921 TCP_STATINC(TCP_STAT_ECN_CE);
1922 break;
1923 case IPTOS_ECN_ECT0:
1924 TCP_STATINC(TCP_STAT_ECN_ECT);
1925 break;
1926 case IPTOS_ECN_ECT1:
1927 /* XXX: ignore for now -- rpaulo */
1928 break;
1929 }
1930 /*
1931 * Congestion experienced.
1932 * Ignore if we are already trying to recover.
1933 */
1934 if ((tiflags & TH_ECE) && SEQ_GEQ(tp->snd_una, tp->snd_recover))
1935 tp->t_congctl->cong_exp(tp);
1936 }
1937
1938 if (opti.ts_present && opti.ts_ecr) {
1939 /*
1940 * Calculate the RTT from the returned time stamp and the
1941 * connection's time base. If the time stamp is later than
1942 * the current time, or is extremely old, fall back to non-1323
1943 * RTT calculation. Since ts_rtt is unsigned, we can test both
1944 * at the same time.
1945 *
1946 * Note that ts_rtt is in units of slow ticks (500
1947 * ms). Since most earthbound RTTs are < 500 ms,
1948 * observed values will have large quantization noise.
1949 * Our smoothed RTT is then the fraction of observed
1950 * samples that are 1 tick instead of 0 (times 500
1951 * ms).
1952 *
1953 * ts_rtt is increased by 1 to denote a valid sample,
1954 * with 0 indicating an invalid measurement. This
1955 * extra 1 must be removed when ts_rtt is used, or
1956 * else an an erroneous extra 500 ms will result.
1957 */
1958 ts_rtt = TCP_TIMESTAMP(tp) - opti.ts_ecr + 1;
1959 if (ts_rtt > TCP_PAWS_IDLE)
1960 ts_rtt = 0;
1961 } else {
1962 ts_rtt = 0;
1963 }
1964
1965 /*
1966 * Header prediction: check for the two common cases
1967 * of a uni-directional data xfer. If the packet has
1968 * no control flags, is in-sequence, the window didn't
1969 * change and we're not retransmitting, it's a
1970 * candidate. If the length is zero and the ack moved
1971 * forward, we're the sender side of the xfer. Just
1972 * free the data acked & wake any higher level process
1973 * that was blocked waiting for space. If the length
1974 * is non-zero and the ack didn't move, we're the
1975 * receiver side. If we're getting packets in-order
1976 * (the reassembly queue is empty), add the data to
1977 * the socket buffer and note that we need a delayed ack.
1978 */
1979 if (tp->t_state == TCPS_ESTABLISHED &&
1980 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK))
1981 == TH_ACK &&
1982 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
1983 th->th_seq == tp->rcv_nxt &&
1984 tiwin && tiwin == tp->snd_wnd &&
1985 tp->snd_nxt == tp->snd_max) {
1986
1987 /*
1988 * If last ACK falls within this segment's sequence numbers,
1989 * record the timestamp.
1990 * NOTE that the test is modified according to the latest
1991 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1992 *
1993 * note that we already know
1994 * TSTMP_GEQ(opti.ts_val, tp->ts_recent)
1995 */
1996 if (opti.ts_present &&
1997 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1998 tp->ts_recent_age = tcp_now;
1999 tp->ts_recent = opti.ts_val;
2000 }
2001
2002 if (tlen == 0) {
2003 /* Ack prediction. */
2004 if (SEQ_GT(th->th_ack, tp->snd_una) &&
2005 SEQ_LEQ(th->th_ack, tp->snd_max) &&
2006 tp->snd_cwnd >= tp->snd_wnd &&
2007 tp->t_partialacks < 0) {
2008 /*
2009 * this is a pure ack for outstanding data.
2010 */
2011 if (ts_rtt)
2012 tcp_xmit_timer(tp, ts_rtt - 1);
2013 else if (tp->t_rtttime &&
2014 SEQ_GT(th->th_ack, tp->t_rtseq))
2015 tcp_xmit_timer(tp,
2016 tcp_now - tp->t_rtttime);
2017 acked = th->th_ack - tp->snd_una;
2018 tcps = TCP_STAT_GETREF();
2019 tcps[TCP_STAT_PREDACK]++;
2020 tcps[TCP_STAT_RCVACKPACK]++;
2021 tcps[TCP_STAT_RCVACKBYTE] += acked;
2022 TCP_STAT_PUTREF();
2023 nd6_hint(tp);
2024
2025 if (acked > (tp->t_lastoff - tp->t_inoff))
2026 tp->t_lastm = NULL;
2027 sbdrop(&so->so_snd, acked);
2028 tp->t_lastoff -= acked;
2029
2030 icmp_check(tp, th, acked);
2031
2032 tp->snd_una = th->th_ack;
2033 tp->snd_fack = tp->snd_una;
2034 if (SEQ_LT(tp->snd_high, tp->snd_una))
2035 tp->snd_high = tp->snd_una;
2036 m_freem(m);
2037
2038 /*
2039 * If all outstanding data are acked, stop
2040 * retransmit timer, otherwise restart timer
2041 * using current (possibly backed-off) value.
2042 * If process is waiting for space,
2043 * wakeup/selnotify/signal. If data
2044 * are ready to send, let tcp_output
2045 * decide between more output or persist.
2046 */
2047 if (tp->snd_una == tp->snd_max)
2048 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2049 else if (TCP_TIMER_ISARMED(tp,
2050 TCPT_PERSIST) == 0)
2051 TCP_TIMER_ARM(tp, TCPT_REXMT,
2052 tp->t_rxtcur);
2053
2054 sowwakeup(so);
2055 if (so->so_snd.sb_cc) {
2056 KERNEL_LOCK(1, NULL);
2057 (void) tcp_output(tp);
2058 KERNEL_UNLOCK_ONE(NULL);
2059 }
2060 if (tcp_saveti)
2061 m_freem(tcp_saveti);
2062 return;
2063 }
2064 } else if (th->th_ack == tp->snd_una &&
2065 TAILQ_FIRST(&tp->segq) == NULL &&
2066 tlen <= sbspace(&so->so_rcv)) {
2067 int newsize = 0; /* automatic sockbuf scaling */
2068
2069 /*
2070 * this is a pure, in-sequence data packet
2071 * with nothing on the reassembly queue and
2072 * we have enough buffer space to take it.
2073 */
2074 tp->rcv_nxt += tlen;
2075 tcps = TCP_STAT_GETREF();
2076 tcps[TCP_STAT_PREDDAT]++;
2077 tcps[TCP_STAT_RCVPACK]++;
2078 tcps[TCP_STAT_RCVBYTE] += tlen;
2079 TCP_STAT_PUTREF();
2080 nd6_hint(tp);
2081
2082 /*
2083 * Automatic sizing enables the performance of large buffers
2084 * and most of the efficiency of small ones by only allocating
2085 * space when it is needed.
2086 *
2087 * On the receive side the socket buffer memory is only rarely
2088 * used to any significant extent. This allows us to be much
2089 * more aggressive in scaling the receive socket buffer. For
2090 * the case that the buffer space is actually used to a large
2091 * extent and we run out of kernel memory we can simply drop
2092 * the new segments; TCP on the sender will just retransmit it
2093 * later. Setting the buffer size too big may only consume too
2094 * much kernel memory if the application doesn't read() from
2095 * the socket or packet loss or reordering makes use of the
2096 * reassembly queue.
2097 *
2098 * The criteria to step up the receive buffer one notch are:
2099 * 1. the number of bytes received during the time it takes
2100 * one timestamp to be reflected back to us (the RTT);
2101 * 2. received bytes per RTT is within seven eighth of the
2102 * current socket buffer size;
2103 * 3. receive buffer size has not hit maximal automatic size;
2104 *
2105 * This algorithm does one step per RTT at most and only if
2106 * we receive a bulk stream w/o packet losses or reorderings.
2107 * Shrinking the buffer during idle times is not necessary as
2108 * it doesn't consume any memory when idle.
2109 *
2110 * TODO: Only step up if the application is actually serving
2111 * the buffer to better manage the socket buffer resources.
2112 */
2113 if (tcp_do_autorcvbuf &&
2114 opti.ts_ecr &&
2115 (so->so_rcv.sb_flags & SB_AUTOSIZE)) {
2116 if (opti.ts_ecr > tp->rfbuf_ts &&
2117 opti.ts_ecr - tp->rfbuf_ts < PR_SLOWHZ) {
2118 if (tp->rfbuf_cnt >
2119 (so->so_rcv.sb_hiwat / 8 * 7) &&
2120 so->so_rcv.sb_hiwat <
2121 tcp_autorcvbuf_max) {
2122 newsize =
2123 min(so->so_rcv.sb_hiwat +
2124 tcp_autorcvbuf_inc,
2125 tcp_autorcvbuf_max);
2126 }
2127 /* Start over with next RTT. */
2128 tp->rfbuf_ts = 0;
2129 tp->rfbuf_cnt = 0;
2130 } else
2131 tp->rfbuf_cnt += tlen; /* add up */
2132 }
2133
2134 /*
2135 * Drop TCP, IP headers and TCP options then add data
2136 * to socket buffer.
2137 */
2138 if (so->so_state & SS_CANTRCVMORE)
2139 m_freem(m);
2140 else {
2141 /*
2142 * Set new socket buffer size.
2143 * Give up when limit is reached.
2144 */
2145 if (newsize)
2146 if (!sbreserve(&so->so_rcv,
2147 newsize, so))
2148 so->so_rcv.sb_flags &= ~SB_AUTOSIZE;
2149 m_adj(m, toff + off);
2150 sbappendstream(&so->so_rcv, m);
2151 }
2152 sorwakeup(so);
2153 tcp_setup_ack(tp, th);
2154 if (tp->t_flags & TF_ACKNOW) {
2155 KERNEL_LOCK(1, NULL);
2156 (void) tcp_output(tp);
2157 KERNEL_UNLOCK_ONE(NULL);
2158 }
2159 if (tcp_saveti)
2160 m_freem(tcp_saveti);
2161 return;
2162 }
2163 }
2164
2165 /*
2166 * Compute mbuf offset to TCP data segment.
2167 */
2168 hdroptlen = toff + off;
2169
2170 /*
2171 * Calculate amount of space in receive window,
2172 * and then do TCP input processing.
2173 * Receive window is amount of space in rcv queue,
2174 * but not less than advertised window.
2175 */
2176 { int win;
2177
2178 win = sbspace(&so->so_rcv);
2179 if (win < 0)
2180 win = 0;
2181 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
2182 }
2183
2184 /* Reset receive buffer auto scaling when not in bulk receive mode. */
2185 tp->rfbuf_ts = 0;
2186 tp->rfbuf_cnt = 0;
2187
2188 switch (tp->t_state) {
2189 /*
2190 * If the state is SYN_SENT:
2191 * if seg contains an ACK, but not for our SYN, drop the input.
2192 * if seg contains a RST, then drop the connection.
2193 * if seg does not contain SYN, then drop it.
2194 * Otherwise this is an acceptable SYN segment
2195 * initialize tp->rcv_nxt and tp->irs
2196 * if seg contains ack then advance tp->snd_una
2197 * if seg contains a ECE and ECN support is enabled, the stream
2198 * is ECN capable.
2199 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
2200 * arrange for segment to be acked (eventually)
2201 * continue processing rest of data/controls, beginning with URG
2202 */
2203 case TCPS_SYN_SENT:
2204 if ((tiflags & TH_ACK) &&
2205 (SEQ_LEQ(th->th_ack, tp->iss) ||
2206 SEQ_GT(th->th_ack, tp->snd_max)))
2207 goto dropwithreset;
2208 if (tiflags & TH_RST) {
2209 if (tiflags & TH_ACK)
2210 tp = tcp_drop(tp, ECONNREFUSED);
2211 goto drop;
2212 }
2213 if ((tiflags & TH_SYN) == 0)
2214 goto drop;
2215 if (tiflags & TH_ACK) {
2216 tp->snd_una = th->th_ack;
2217 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2218 tp->snd_nxt = tp->snd_una;
2219 if (SEQ_LT(tp->snd_high, tp->snd_una))
2220 tp->snd_high = tp->snd_una;
2221 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2222
2223 if ((tiflags & TH_ECE) && tcp_do_ecn) {
2224 tp->t_flags |= TF_ECN_PERMIT;
2225 TCP_STATINC(TCP_STAT_ECN_SHS);
2226 }
2227
2228 }
2229 tp->irs = th->th_seq;
2230 tcp_rcvseqinit(tp);
2231 tp->t_flags |= TF_ACKNOW;
2232 tcp_mss_from_peer(tp, opti.maxseg);
2233
2234 /*
2235 * Initialize the initial congestion window. If we
2236 * had to retransmit the SYN, we must initialize cwnd
2237 * to 1 segment (i.e. the Loss Window).
2238 */
2239 if (tp->t_flags & TF_SYN_REXMT)
2240 tp->snd_cwnd = tp->t_peermss;
2241 else {
2242 int ss = tcp_init_win;
2243 #ifdef INET
2244 if (inp != NULL && in_localaddr(inp->inp_faddr))
2245 ss = tcp_init_win_local;
2246 #endif
2247 #ifdef INET6
2248 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
2249 ss = tcp_init_win_local;
2250 #endif
2251 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
2252 }
2253
2254 tcp_rmx_rtt(tp);
2255 if (tiflags & TH_ACK) {
2256 TCP_STATINC(TCP_STAT_CONNECTS);
2257 /*
2258 * move tcp_established before soisconnected
2259 * because upcall handler can drive tcp_output
2260 * functionality.
2261 * XXX we might call soisconnected at the end of
2262 * all processing
2263 */
2264 tcp_established(tp);
2265 soisconnected(so);
2266 /* Do window scaling on this connection? */
2267 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2268 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2269 tp->snd_scale = tp->requested_s_scale;
2270 tp->rcv_scale = tp->request_r_scale;
2271 }
2272 TCP_REASS_LOCK(tp);
2273 (void) tcp_reass(tp, NULL, NULL, &tlen);
2274 /*
2275 * if we didn't have to retransmit the SYN,
2276 * use its rtt as our initial srtt & rtt var.
2277 */
2278 if (tp->t_rtttime)
2279 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2280 } else
2281 tp->t_state = TCPS_SYN_RECEIVED;
2282
2283 /*
2284 * Advance th->th_seq to correspond to first data byte.
2285 * If data, trim to stay within window,
2286 * dropping FIN if necessary.
2287 */
2288 th->th_seq++;
2289 if (tlen > tp->rcv_wnd) {
2290 todrop = tlen - tp->rcv_wnd;
2291 m_adj(m, -todrop);
2292 tlen = tp->rcv_wnd;
2293 tiflags &= ~TH_FIN;
2294 tcps = TCP_STAT_GETREF();
2295 tcps[TCP_STAT_RCVPACKAFTERWIN]++;
2296 tcps[TCP_STAT_RCVBYTEAFTERWIN] += todrop;
2297 TCP_STAT_PUTREF();
2298 }
2299 tp->snd_wl1 = th->th_seq - 1;
2300 tp->rcv_up = th->th_seq;
2301 goto step6;
2302
2303 /*
2304 * If the state is SYN_RECEIVED:
2305 * If seg contains an ACK, but not for our SYN, drop the input
2306 * and generate an RST. See page 36, rfc793
2307 */
2308 case TCPS_SYN_RECEIVED:
2309 if ((tiflags & TH_ACK) &&
2310 (SEQ_LEQ(th->th_ack, tp->iss) ||
2311 SEQ_GT(th->th_ack, tp->snd_max)))
2312 goto dropwithreset;
2313 break;
2314 }
2315
2316 /*
2317 * States other than LISTEN or SYN_SENT.
2318 * First check timestamp, if present.
2319 * Then check that at least some bytes of segment are within
2320 * receive window. If segment begins before rcv_nxt,
2321 * drop leading data (and SYN); if nothing left, just ack.
2322 *
2323 * RFC 1323 PAWS: If we have a timestamp reply on this segment
2324 * and it's less than ts_recent, drop it.
2325 */
2326 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
2327 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
2328
2329 /* Check to see if ts_recent is over 24 days old. */
2330 if (tcp_now - tp->ts_recent_age > TCP_PAWS_IDLE) {
2331 /*
2332 * Invalidate ts_recent. If this segment updates
2333 * ts_recent, the age will be reset later and ts_recent
2334 * will get a valid value. If it does not, setting
2335 * ts_recent to zero will at least satisfy the
2336 * requirement that zero be placed in the timestamp
2337 * echo reply when ts_recent isn't valid. The
2338 * age isn't reset until we get a valid ts_recent
2339 * because we don't want out-of-order segments to be
2340 * dropped when ts_recent is old.
2341 */
2342 tp->ts_recent = 0;
2343 } else {
2344 tcps = TCP_STAT_GETREF();
2345 tcps[TCP_STAT_RCVDUPPACK]++;
2346 tcps[TCP_STAT_RCVDUPBYTE] += tlen;
2347 tcps[TCP_STAT_PAWSDROP]++;
2348 TCP_STAT_PUTREF();
2349 tcp_new_dsack(tp, th->th_seq, tlen);
2350 goto dropafterack;
2351 }
2352 }
2353
2354 todrop = tp->rcv_nxt - th->th_seq;
2355 dupseg = false;
2356 if (todrop > 0) {
2357 if (tiflags & TH_SYN) {
2358 tiflags &= ~TH_SYN;
2359 th->th_seq++;
2360 if (th->th_urp > 1)
2361 th->th_urp--;
2362 else {
2363 tiflags &= ~TH_URG;
2364 th->th_urp = 0;
2365 }
2366 todrop--;
2367 }
2368 if (todrop > tlen ||
2369 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
2370 /*
2371 * Any valid FIN or RST must be to the left of the
2372 * window. At this point the FIN or RST must be a
2373 * duplicate or out of sequence; drop it.
2374 */
2375 if (tiflags & TH_RST)
2376 goto drop;
2377 tiflags &= ~(TH_FIN|TH_RST);
2378 /*
2379 * Send an ACK to resynchronize and drop any data.
2380 * But keep on processing for RST or ACK.
2381 */
2382 tp->t_flags |= TF_ACKNOW;
2383 todrop = tlen;
2384 dupseg = true;
2385 tcps = TCP_STAT_GETREF();
2386 tcps[TCP_STAT_RCVDUPPACK]++;
2387 tcps[TCP_STAT_RCVDUPBYTE] += todrop;
2388 TCP_STAT_PUTREF();
2389 } else if ((tiflags & TH_RST) &&
2390 th->th_seq != tp->rcv_nxt) {
2391 /*
2392 * Test for reset before adjusting the sequence
2393 * number for overlapping data.
2394 */
2395 goto dropafterack_ratelim;
2396 } else {
2397 tcps = TCP_STAT_GETREF();
2398 tcps[TCP_STAT_RCVPARTDUPPACK]++;
2399 tcps[TCP_STAT_RCVPARTDUPBYTE] += todrop;
2400 TCP_STAT_PUTREF();
2401 }
2402 tcp_new_dsack(tp, th->th_seq, todrop);
2403 hdroptlen += todrop; /*drop from head afterwards*/
2404 th->th_seq += todrop;
2405 tlen -= todrop;
2406 if (th->th_urp > todrop)
2407 th->th_urp -= todrop;
2408 else {
2409 tiflags &= ~TH_URG;
2410 th->th_urp = 0;
2411 }
2412 }
2413
2414 /*
2415 * If new data are received on a connection after the
2416 * user processes are gone, then RST the other end.
2417 */
2418 if ((so->so_state & SS_NOFDREF) &&
2419 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
2420 tp = tcp_close(tp);
2421 TCP_STATINC(TCP_STAT_RCVAFTERCLOSE);
2422 goto dropwithreset;
2423 }
2424
2425 /*
2426 * If segment ends after window, drop trailing data
2427 * (and PUSH and FIN); if nothing left, just ACK.
2428 */
2429 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
2430 if (todrop > 0) {
2431 TCP_STATINC(TCP_STAT_RCVPACKAFTERWIN);
2432 if (todrop >= tlen) {
2433 /*
2434 * The segment actually starts after the window.
2435 * th->th_seq + tlen - tp->rcv_nxt - tp->rcv_wnd >= tlen
2436 * th->th_seq - tp->rcv_nxt - tp->rcv_wnd >= 0
2437 * th->th_seq >= tp->rcv_nxt + tp->rcv_wnd
2438 */
2439 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, tlen);
2440 /*
2441 * If a new connection request is received
2442 * while in TIME_WAIT, drop the old connection
2443 * and start over if the sequence numbers
2444 * are above the previous ones.
2445 *
2446 * NOTE: We will checksum the packet again, and
2447 * so we need to put the header fields back into
2448 * network order!
2449 * XXX This kind of sucks, but we don't expect
2450 * XXX this to happen very often, so maybe it
2451 * XXX doesn't matter so much.
2452 */
2453 if (tiflags & TH_SYN &&
2454 tp->t_state == TCPS_TIME_WAIT &&
2455 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
2456 tp = tcp_close(tp);
2457 tcp_fields_to_net(th);
2458 goto findpcb;
2459 }
2460 /*
2461 * If window is closed can only take segments at
2462 * window edge, and have to drop data and PUSH from
2463 * incoming segments. Continue processing, but
2464 * remember to ack. Otherwise, drop segment
2465 * and (if not RST) ack.
2466 */
2467 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
2468 tp->t_flags |= TF_ACKNOW;
2469 TCP_STATINC(TCP_STAT_RCVWINPROBE);
2470 } else
2471 goto dropafterack;
2472 } else
2473 TCP_STATADD(TCP_STAT_RCVBYTEAFTERWIN, todrop);
2474 m_adj(m, -todrop);
2475 tlen -= todrop;
2476 tiflags &= ~(TH_PUSH|TH_FIN);
2477 }
2478
2479 /*
2480 * If last ACK falls within this segment's sequence numbers,
2481 * record the timestamp.
2482 * NOTE:
2483 * 1) That the test incorporates suggestions from the latest
2484 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
2485 * 2) That updating only on newer timestamps interferes with
2486 * our earlier PAWS tests, so this check should be solely
2487 * predicated on the sequence space of this segment.
2488 * 3) That we modify the segment boundary check to be
2489 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
2490 * instead of RFC1323's
2491 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
2492 * This modified check allows us to overcome RFC1323's
2493 * limitations as described in Stevens TCP/IP Illustrated
2494 * Vol. 2 p.869. In such cases, we can still calculate the
2495 * RTT correctly when RCV.NXT == Last.ACK.Sent.
2496 */
2497 if (opti.ts_present &&
2498 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
2499 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
2500 ((tiflags & (TH_SYN|TH_FIN)) != 0))) {
2501 tp->ts_recent_age = tcp_now;
2502 tp->ts_recent = opti.ts_val;
2503 }
2504
2505 /*
2506 * If the RST bit is set examine the state:
2507 * SYN_RECEIVED STATE:
2508 * If passive open, return to LISTEN state.
2509 * If active open, inform user that connection was refused.
2510 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
2511 * Inform user that connection was reset, and close tcb.
2512 * CLOSING, LAST_ACK, TIME_WAIT STATES
2513 * Close the tcb.
2514 */
2515 if (tiflags & TH_RST) {
2516 if (th->th_seq != tp->rcv_nxt)
2517 goto dropafterack_ratelim;
2518
2519 switch (tp->t_state) {
2520 case TCPS_SYN_RECEIVED:
2521 so->so_error = ECONNREFUSED;
2522 goto close;
2523
2524 case TCPS_ESTABLISHED:
2525 case TCPS_FIN_WAIT_1:
2526 case TCPS_FIN_WAIT_2:
2527 case TCPS_CLOSE_WAIT:
2528 so->so_error = ECONNRESET;
2529 close:
2530 tp->t_state = TCPS_CLOSED;
2531 TCP_STATINC(TCP_STAT_DROPS);
2532 tp = tcp_close(tp);
2533 goto drop;
2534
2535 case TCPS_CLOSING:
2536 case TCPS_LAST_ACK:
2537 case TCPS_TIME_WAIT:
2538 tp = tcp_close(tp);
2539 goto drop;
2540 }
2541 }
2542
2543 /*
2544 * Since we've covered the SYN-SENT and SYN-RECEIVED states above
2545 * we must be in a synchronized state. RFC791 states (under RST
2546 * generation) that any unacceptable segment (an out-of-order SYN
2547 * qualifies) received in a synchronized state must elicit only an
2548 * empty acknowledgment segment ... and the connection remains in
2549 * the same state.
2550 */
2551 if (tiflags & TH_SYN) {
2552 if (tp->rcv_nxt == th->th_seq) {
2553 tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack - 1,
2554 TH_ACK);
2555 if (tcp_saveti)
2556 m_freem(tcp_saveti);
2557 return;
2558 }
2559
2560 goto dropafterack_ratelim;
2561 }
2562
2563 /*
2564 * If the ACK bit is off we drop the segment and return.
2565 */
2566 if ((tiflags & TH_ACK) == 0) {
2567 if (tp->t_flags & TF_ACKNOW)
2568 goto dropafterack;
2569 else
2570 goto drop;
2571 }
2572
2573 /*
2574 * Ack processing.
2575 */
2576 switch (tp->t_state) {
2577
2578 /*
2579 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
2580 * ESTABLISHED state and continue processing, otherwise
2581 * send an RST.
2582 */
2583 case TCPS_SYN_RECEIVED:
2584 if (SEQ_GT(tp->snd_una, th->th_ack) ||
2585 SEQ_GT(th->th_ack, tp->snd_max))
2586 goto dropwithreset;
2587 TCP_STATINC(TCP_STAT_CONNECTS);
2588 soisconnected(so);
2589 tcp_established(tp);
2590 /* Do window scaling? */
2591 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
2592 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
2593 tp->snd_scale = tp->requested_s_scale;
2594 tp->rcv_scale = tp->request_r_scale;
2595 }
2596 TCP_REASS_LOCK(tp);
2597 (void) tcp_reass(tp, NULL, NULL, &tlen);
2598 tp->snd_wl1 = th->th_seq - 1;
2599 /* fall into ... */
2600
2601 /*
2602 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
2603 * ACKs. If the ack is in the range
2604 * tp->snd_una < th->th_ack <= tp->snd_max
2605 * then advance tp->snd_una to th->th_ack and drop
2606 * data from the retransmission queue. If this ACK reflects
2607 * more up to date window information we update our window information.
2608 */
2609 case TCPS_ESTABLISHED:
2610 case TCPS_FIN_WAIT_1:
2611 case TCPS_FIN_WAIT_2:
2612 case TCPS_CLOSE_WAIT:
2613 case TCPS_CLOSING:
2614 case TCPS_LAST_ACK:
2615 case TCPS_TIME_WAIT:
2616
2617 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
2618 if (tlen == 0 && !dupseg && tiwin == tp->snd_wnd) {
2619 TCP_STATINC(TCP_STAT_RCVDUPACK);
2620 /*
2621 * If we have outstanding data (other than
2622 * a window probe), this is a completely
2623 * duplicate ack (ie, window info didn't
2624 * change), the ack is the biggest we've
2625 * seen and we've seen exactly our rexmt
2626 * threshhold of them, assume a packet
2627 * has been dropped and retransmit it.
2628 * Kludge snd_nxt & the congestion
2629 * window so we send only this one
2630 * packet.
2631 */
2632 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 ||
2633 th->th_ack != tp->snd_una)
2634 tp->t_dupacks = 0;
2635 else if (tp->t_partialacks < 0 &&
2636 (++tp->t_dupacks == tcprexmtthresh ||
2637 TCP_FACK_FASTRECOV(tp))) {
2638 /*
2639 * Do the fast retransmit, and adjust
2640 * congestion control paramenters.
2641 */
2642 if (tp->t_congctl->fast_retransmit(tp, th)) {
2643 /* False fast retransmit */
2644 break;
2645 } else
2646 goto drop;
2647 } else if (tp->t_dupacks > tcprexmtthresh) {
2648 tp->snd_cwnd += tp->t_segsz;
2649 KERNEL_LOCK(1, NULL);
2650 (void) tcp_output(tp);
2651 KERNEL_UNLOCK_ONE(NULL);
2652 goto drop;
2653 }
2654 } else {
2655 /*
2656 * If the ack appears to be very old, only
2657 * allow data that is in-sequence. This
2658 * makes it somewhat more difficult to insert
2659 * forged data by guessing sequence numbers.
2660 * Sent an ack to try to update the send
2661 * sequence number on the other side.
2662 */
2663 if (tlen && th->th_seq != tp->rcv_nxt &&
2664 SEQ_LT(th->th_ack,
2665 tp->snd_una - tp->max_sndwnd))
2666 goto dropafterack;
2667 }
2668 break;
2669 }
2670 /*
2671 * If the congestion window was inflated to account
2672 * for the other side's cached packets, retract it.
2673 */
2674 tp->t_congctl->fast_retransmit_newack(tp, th);
2675
2676 if (SEQ_GT(th->th_ack, tp->snd_max)) {
2677 TCP_STATINC(TCP_STAT_RCVACKTOOMUCH);
2678 goto dropafterack;
2679 }
2680 acked = th->th_ack - tp->snd_una;
2681 tcps = TCP_STAT_GETREF();
2682 tcps[TCP_STAT_RCVACKPACK]++;
2683 tcps[TCP_STAT_RCVACKBYTE] += acked;
2684 TCP_STAT_PUTREF();
2685
2686 /*
2687 * If we have a timestamp reply, update smoothed
2688 * round trip time. If no timestamp is present but
2689 * transmit timer is running and timed sequence
2690 * number was acked, update smoothed round trip time.
2691 * Since we now have an rtt measurement, cancel the
2692 * timer backoff (cf., Phil Karn's retransmit alg.).
2693 * Recompute the initial retransmit timer.
2694 */
2695 if (ts_rtt)
2696 tcp_xmit_timer(tp, ts_rtt - 1);
2697 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
2698 tcp_xmit_timer(tp, tcp_now - tp->t_rtttime);
2699
2700 /*
2701 * If all outstanding data is acked, stop retransmit
2702 * timer and remember to restart (more output or persist).
2703 * If there is more data to be acked, restart retransmit
2704 * timer, using current (possibly backed-off) value.
2705 */
2706 if (th->th_ack == tp->snd_max) {
2707 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2708 needoutput = 1;
2709 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
2710 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
2711
2712 /*
2713 * New data has been acked, adjust the congestion window.
2714 */
2715 tp->t_congctl->newack(tp, th);
2716
2717 nd6_hint(tp);
2718 if (acked > so->so_snd.sb_cc) {
2719 tp->snd_wnd -= so->so_snd.sb_cc;
2720 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
2721 ourfinisacked = 1;
2722 } else {
2723 if (acked > (tp->t_lastoff - tp->t_inoff))
2724 tp->t_lastm = NULL;
2725 sbdrop(&so->so_snd, acked);
2726 tp->t_lastoff -= acked;
2727 if (tp->snd_wnd > acked)
2728 tp->snd_wnd -= acked;
2729 else
2730 tp->snd_wnd = 0;
2731 ourfinisacked = 0;
2732 }
2733 sowwakeup(so);
2734
2735 icmp_check(tp, th, acked);
2736
2737 tp->snd_una = th->th_ack;
2738 if (SEQ_GT(tp->snd_una, tp->snd_fack))
2739 tp->snd_fack = tp->snd_una;
2740 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
2741 tp->snd_nxt = tp->snd_una;
2742 if (SEQ_LT(tp->snd_high, tp->snd_una))
2743 tp->snd_high = tp->snd_una;
2744
2745 switch (tp->t_state) {
2746
2747 /*
2748 * In FIN_WAIT_1 STATE in addition to the processing
2749 * for the ESTABLISHED state if our FIN is now acknowledged
2750 * then enter FIN_WAIT_2.
2751 */
2752 case TCPS_FIN_WAIT_1:
2753 if (ourfinisacked) {
2754 /*
2755 * If we can't receive any more
2756 * data, then closing user can proceed.
2757 * Starting the timer is contrary to the
2758 * specification, but if we don't get a FIN
2759 * we'll hang forever.
2760 */
2761 if (so->so_state & SS_CANTRCVMORE) {
2762 soisdisconnected(so);
2763 if (tp->t_maxidle > 0)
2764 TCP_TIMER_ARM(tp, TCPT_2MSL,
2765 tp->t_maxidle);
2766 }
2767 tp->t_state = TCPS_FIN_WAIT_2;
2768 }
2769 break;
2770
2771 /*
2772 * In CLOSING STATE in addition to the processing for
2773 * the ESTABLISHED state if the ACK acknowledges our FIN
2774 * then enter the TIME-WAIT state, otherwise ignore
2775 * the segment.
2776 */
2777 case TCPS_CLOSING:
2778 if (ourfinisacked) {
2779 tp->t_state = TCPS_TIME_WAIT;
2780 tcp_canceltimers(tp);
2781 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2782 soisdisconnected(so);
2783 }
2784 break;
2785
2786 /*
2787 * In LAST_ACK, we may still be waiting for data to drain
2788 * and/or to be acked, as well as for the ack of our FIN.
2789 * If our FIN is now acknowledged, delete the TCB,
2790 * enter the closed state and return.
2791 */
2792 case TCPS_LAST_ACK:
2793 if (ourfinisacked) {
2794 tp = tcp_close(tp);
2795 goto drop;
2796 }
2797 break;
2798
2799 /*
2800 * In TIME_WAIT state the only thing that should arrive
2801 * is a retransmission of the remote FIN. Acknowledge
2802 * it and restart the finack timer.
2803 */
2804 case TCPS_TIME_WAIT:
2805 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2806 goto dropafterack;
2807 }
2808 }
2809
2810 step6:
2811 /*
2812 * Update window information.
2813 * Don't look at window if no ACK: TAC's send garbage on first SYN.
2814 */
2815 if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, th->th_seq) ||
2816 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
2817 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
2818 /* keep track of pure window updates */
2819 if (tlen == 0 &&
2820 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
2821 TCP_STATINC(TCP_STAT_RCVWINUPD);
2822 tp->snd_wnd = tiwin;
2823 tp->snd_wl1 = th->th_seq;
2824 tp->snd_wl2 = th->th_ack;
2825 if (tp->snd_wnd > tp->max_sndwnd)
2826 tp->max_sndwnd = tp->snd_wnd;
2827 needoutput = 1;
2828 }
2829
2830 /*
2831 * Process segments with URG.
2832 */
2833 if ((tiflags & TH_URG) && th->th_urp &&
2834 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2835 /*
2836 * This is a kludge, but if we receive and accept
2837 * random urgent pointers, we'll crash in
2838 * soreceive. It's hard to imagine someone
2839 * actually wanting to send this much urgent data.
2840 */
2841 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
2842 th->th_urp = 0; /* XXX */
2843 tiflags &= ~TH_URG; /* XXX */
2844 goto dodata; /* XXX */
2845 }
2846 /*
2847 * If this segment advances the known urgent pointer,
2848 * then mark the data stream. This should not happen
2849 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
2850 * a FIN has been received from the remote side.
2851 * In these states we ignore the URG.
2852 *
2853 * According to RFC961 (Assigned Protocols),
2854 * the urgent pointer points to the last octet
2855 * of urgent data. We continue, however,
2856 * to consider it to indicate the first octet
2857 * of data past the urgent section as the original
2858 * spec states (in one of two places).
2859 */
2860 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
2861 tp->rcv_up = th->th_seq + th->th_urp;
2862 so->so_oobmark = so->so_rcv.sb_cc +
2863 (tp->rcv_up - tp->rcv_nxt) - 1;
2864 if (so->so_oobmark == 0)
2865 so->so_state |= SS_RCVATMARK;
2866 sohasoutofband(so);
2867 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
2868 }
2869 /*
2870 * Remove out of band data so doesn't get presented to user.
2871 * This can happen independent of advancing the URG pointer,
2872 * but if two URG's are pending at once, some out-of-band
2873 * data may creep in... ick.
2874 */
2875 if (th->th_urp <= (u_int16_t) tlen
2876 #ifdef SO_OOBINLINE
2877 && (so->so_options & SO_OOBINLINE) == 0
2878 #endif
2879 )
2880 tcp_pulloutofband(so, th, m, hdroptlen);
2881 } else
2882 /*
2883 * If no out of band data is expected,
2884 * pull receive urgent pointer along
2885 * with the receive window.
2886 */
2887 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
2888 tp->rcv_up = tp->rcv_nxt;
2889 dodata: /* XXX */
2890
2891 /*
2892 * Process the segment text, merging it into the TCP sequencing queue,
2893 * and arranging for acknowledgement of receipt if necessary.
2894 * This process logically involves adjusting tp->rcv_wnd as data
2895 * is presented to the user (this happens in tcp_usrreq.c,
2896 * tcp_rcvd()). If a FIN has already been received on this
2897 * connection then we just ignore the text.
2898 */
2899 if ((tlen || (tiflags & TH_FIN)) &&
2900 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2901 /*
2902 * Insert segment ti into reassembly queue of tcp with
2903 * control block tp. Return TH_FIN if reassembly now includes
2904 * a segment with FIN. The macro form does the common case
2905 * inline (segment is the next to be received on an
2906 * established connection, and the queue is empty),
2907 * avoiding linkage into and removal from the queue and
2908 * repetition of various conversions.
2909 * Set DELACK for segments received in order, but ack
2910 * immediately when segments are out of order
2911 * (so fast retransmit can work).
2912 */
2913 /* NOTE: this was TCP_REASS() macro, but used only once */
2914 TCP_REASS_LOCK(tp);
2915 if (th->th_seq == tp->rcv_nxt &&
2916 TAILQ_FIRST(&tp->segq) == NULL &&
2917 tp->t_state == TCPS_ESTABLISHED) {
2918 tcp_setup_ack(tp, th);
2919 tp->rcv_nxt += tlen;
2920 tiflags = th->th_flags & TH_FIN;
2921 tcps = TCP_STAT_GETREF();
2922 tcps[TCP_STAT_RCVPACK]++;
2923 tcps[TCP_STAT_RCVBYTE] += tlen;
2924 TCP_STAT_PUTREF();
2925 nd6_hint(tp);
2926 if (so->so_state & SS_CANTRCVMORE)
2927 m_freem(m);
2928 else {
2929 m_adj(m, hdroptlen);
2930 sbappendstream(&(so)->so_rcv, m);
2931 }
2932 TCP_REASS_UNLOCK(tp);
2933 sorwakeup(so);
2934 } else {
2935 m_adj(m, hdroptlen);
2936 tiflags = tcp_reass(tp, th, m, &tlen);
2937 tp->t_flags |= TF_ACKNOW;
2938 }
2939
2940 /*
2941 * Note the amount of data that peer has sent into
2942 * our window, in order to estimate the sender's
2943 * buffer size.
2944 */
2945 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
2946 } else {
2947 m_freem(m);
2948 m = NULL;
2949 tiflags &= ~TH_FIN;
2950 }
2951
2952 /*
2953 * If FIN is received ACK the FIN and let the user know
2954 * that the connection is closing. Ignore a FIN received before
2955 * the connection is fully established.
2956 */
2957 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
2958 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
2959 socantrcvmore(so);
2960 tp->t_flags |= TF_ACKNOW;
2961 tp->rcv_nxt++;
2962 }
2963 switch (tp->t_state) {
2964
2965 /*
2966 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
2967 */
2968 case TCPS_ESTABLISHED:
2969 tp->t_state = TCPS_CLOSE_WAIT;
2970 break;
2971
2972 /*
2973 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2974 * enter the CLOSING state.
2975 */
2976 case TCPS_FIN_WAIT_1:
2977 tp->t_state = TCPS_CLOSING;
2978 break;
2979
2980 /*
2981 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2982 * starting the time-wait timer, turning off the other
2983 * standard timers.
2984 */
2985 case TCPS_FIN_WAIT_2:
2986 tp->t_state = TCPS_TIME_WAIT;
2987 tcp_canceltimers(tp);
2988 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2989 soisdisconnected(so);
2990 break;
2991
2992 /*
2993 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2994 */
2995 case TCPS_TIME_WAIT:
2996 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * tp->t_msl);
2997 break;
2998 }
2999 }
3000 #ifdef TCP_DEBUG
3001 if (so->so_options & SO_DEBUG)
3002 tcp_trace(TA_INPUT, ostate, tp, tcp_saveti, 0);
3003 #endif
3004
3005 /*
3006 * Return any desired output.
3007 */
3008 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
3009 KERNEL_LOCK(1, NULL);
3010 (void) tcp_output(tp);
3011 KERNEL_UNLOCK_ONE(NULL);
3012 }
3013 if (tcp_saveti)
3014 m_freem(tcp_saveti);
3015
3016 if (tp->t_state == TCPS_TIME_WAIT
3017 && (so->so_state & SS_NOFDREF)
3018 && (tp->t_inpcb || af != AF_INET)
3019 && (tp->t_in6pcb || af != AF_INET6)
3020 && ((af == AF_INET ? tcp4_vtw_enable : tcp6_vtw_enable) & 1) != 0
3021 && TAILQ_EMPTY(&tp->segq)
3022 && vtw_add(af, tp)) {
3023 ;
3024 }
3025 return;
3026
3027 badsyn:
3028 /*
3029 * Received a bad SYN. Increment counters and dropwithreset.
3030 */
3031 TCP_STATINC(TCP_STAT_BADSYN);
3032 tp = NULL;
3033 goto dropwithreset;
3034
3035 dropafterack:
3036 /*
3037 * Generate an ACK dropping incoming segment if it occupies
3038 * sequence space, where the ACK reflects our state.
3039 */
3040 if (tiflags & TH_RST)
3041 goto drop;
3042 goto dropafterack2;
3043
3044 dropafterack_ratelim:
3045 /*
3046 * We may want to rate-limit ACKs against SYN/RST attack.
3047 */
3048 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
3049 tcp_ackdrop_ppslim) == 0) {
3050 /* XXX stat */
3051 goto drop;
3052 }
3053 /* ...fall into dropafterack2... */
3054
3055 dropafterack2:
3056 m_freem(m);
3057 tp->t_flags |= TF_ACKNOW;
3058 KERNEL_LOCK(1, NULL);
3059 (void) tcp_output(tp);
3060 KERNEL_UNLOCK_ONE(NULL);
3061 if (tcp_saveti)
3062 m_freem(tcp_saveti);
3063 return;
3064
3065 dropwithreset_ratelim:
3066 /*
3067 * We may want to rate-limit RSTs in certain situations,
3068 * particularly if we are sending an RST in response to
3069 * an attempt to connect to or otherwise communicate with
3070 * a port for which we have no socket.
3071 */
3072 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
3073 tcp_rst_ppslim) == 0) {
3074 /* XXX stat */
3075 goto drop;
3076 }
3077 /* ...fall into dropwithreset... */
3078
3079 dropwithreset:
3080 /*
3081 * Generate a RST, dropping incoming segment.
3082 * Make ACK acceptable to originator of segment.
3083 */
3084 if (tiflags & TH_RST)
3085 goto drop;
3086
3087 switch (af) {
3088 #ifdef INET6
3089 case AF_INET6:
3090 /* For following calls to tcp_respond */
3091 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst))
3092 goto drop;
3093 break;
3094 #endif /* INET6 */
3095 case AF_INET:
3096 if (IN_MULTICAST(ip->ip_dst.s_addr) ||
3097 in_broadcast(ip->ip_dst, m_get_rcvif_NOMPSAFE(m)))
3098 goto drop;
3099 }
3100
3101 if (tiflags & TH_ACK)
3102 (void)tcp_respond(tp, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
3103 else {
3104 if (tiflags & TH_SYN)
3105 tlen++;
3106 (void)tcp_respond(tp, m, m, th, th->th_seq + tlen, (tcp_seq)0,
3107 TH_RST|TH_ACK);
3108 }
3109 if (tcp_saveti)
3110 m_freem(tcp_saveti);
3111 return;
3112
3113 badcsum:
3114 drop:
3115 /*
3116 * Drop space held by incoming segment and return.
3117 */
3118 if (tp) {
3119 if (tp->t_inpcb)
3120 so = tp->t_inpcb->inp_socket;
3121 #ifdef INET6
3122 else if (tp->t_in6pcb)
3123 so = tp->t_in6pcb->in6p_socket;
3124 #endif
3125 else
3126 so = NULL;
3127 #ifdef TCP_DEBUG
3128 if (so && (so->so_options & SO_DEBUG) != 0)
3129 tcp_trace(TA_DROP, ostate, tp, tcp_saveti, 0);
3130 #endif
3131 }
3132 if (tcp_saveti)
3133 m_freem(tcp_saveti);
3134 m_freem(m);
3135 return;
3136 }
3137
3138 #ifdef TCP_SIGNATURE
3139 int
tcp_signature_apply(void * fstate,void * data,u_int len)3140 tcp_signature_apply(void *fstate, void *data, u_int len)
3141 {
3142
3143 MD5Update(fstate, (u_char *)data, len);
3144 return (0);
3145 }
3146
3147 struct secasvar *
tcp_signature_getsav(struct mbuf * m,struct tcphdr * th)3148 tcp_signature_getsav(struct mbuf *m, struct tcphdr *th)
3149 {
3150 struct ip *ip;
3151 struct ip6_hdr *ip6;
3152
3153 ip = mtod(m, struct ip *);
3154 switch (ip->ip_v) {
3155 case 4:
3156 ip = mtod(m, struct ip *);
3157 ip6 = NULL;
3158 break;
3159 case 6:
3160 ip = NULL;
3161 ip6 = mtod(m, struct ip6_hdr *);
3162 break;
3163 default:
3164 return (NULL);
3165 }
3166
3167 #ifdef IPSEC
3168 if (ipsec_used) {
3169 union sockaddr_union dst;
3170 /* Extract the destination from the IP header in the mbuf. */
3171 memset(&dst, 0, sizeof(union sockaddr_union));
3172 if (ip != NULL) {
3173 dst.sa.sa_len = sizeof(struct sockaddr_in);
3174 dst.sa.sa_family = AF_INET;
3175 dst.sin.sin_addr = ip->ip_dst;
3176 } else {
3177 dst.sa.sa_len = sizeof(struct sockaddr_in6);
3178 dst.sa.sa_family = AF_INET6;
3179 dst.sin6.sin6_addr = ip6->ip6_dst;
3180 }
3181
3182 /*
3183 * Look up an SADB entry which matches the address of the peer.
3184 */
3185 return KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI), 0, 0);
3186 }
3187 return NULL;
3188 #else
3189 if (ip)
3190 return key_allocsa(AF_INET, (void *)&ip->ip_src,
3191 (void *)&ip->ip_dst, IPPROTO_TCP,
3192 htonl(TCP_SIG_SPI), 0, 0);
3193 else
3194 return key_allocsa(AF_INET6, (void *)&ip6->ip6_src,
3195 (void *)&ip6->ip6_dst, IPPROTO_TCP,
3196 htonl(TCP_SIG_SPI), 0, 0);
3197 #endif
3198 }
3199
3200 int
tcp_signature(struct mbuf * m,struct tcphdr * th,int thoff,struct secasvar * sav,char * sig)3201 tcp_signature(struct mbuf *m, struct tcphdr *th, int thoff,
3202 struct secasvar *sav, char *sig)
3203 {
3204 MD5_CTX ctx;
3205 struct ip *ip;
3206 struct ipovly *ipovly;
3207 #ifdef INET6
3208 struct ip6_hdr *ip6;
3209 struct ip6_hdr_pseudo ip6pseudo;
3210 #endif /* INET6 */
3211 struct ippseudo ippseudo;
3212 struct tcphdr th0;
3213 int l, tcphdrlen;
3214
3215 if (sav == NULL)
3216 return (-1);
3217
3218 tcphdrlen = th->th_off * 4;
3219
3220 switch (mtod(m, struct ip *)->ip_v) {
3221 case 4:
3222 MD5Init(&ctx);
3223 ip = mtod(m, struct ip *);
3224 memset(&ippseudo, 0, sizeof(ippseudo));
3225 ipovly = (struct ipovly *)ip;
3226 ippseudo.ippseudo_src = ipovly->ih_src;
3227 ippseudo.ippseudo_dst = ipovly->ih_dst;
3228 ippseudo.ippseudo_pad = 0;
3229 ippseudo.ippseudo_p = IPPROTO_TCP;
3230 ippseudo.ippseudo_len = htons(m->m_pkthdr.len - thoff);
3231 MD5Update(&ctx, (char *)&ippseudo, sizeof(ippseudo));
3232 break;
3233 #if INET6
3234 case 6:
3235 MD5Init(&ctx);
3236 ip6 = mtod(m, struct ip6_hdr *);
3237 memset(&ip6pseudo, 0, sizeof(ip6pseudo));
3238 ip6pseudo.ip6ph_src = ip6->ip6_src;
3239 in6_clearscope(&ip6pseudo.ip6ph_src);
3240 ip6pseudo.ip6ph_dst = ip6->ip6_dst;
3241 in6_clearscope(&ip6pseudo.ip6ph_dst);
3242 ip6pseudo.ip6ph_len = htons(m->m_pkthdr.len - thoff);
3243 ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
3244 MD5Update(&ctx, (char *)&ip6pseudo, sizeof(ip6pseudo));
3245 break;
3246 #endif /* INET6 */
3247 default:
3248 return (-1);
3249 }
3250
3251 th0 = *th;
3252 th0.th_sum = 0;
3253 MD5Update(&ctx, (char *)&th0, sizeof(th0));
3254
3255 l = m->m_pkthdr.len - thoff - tcphdrlen;
3256 if (l > 0)
3257 m_apply(m, thoff + tcphdrlen,
3258 m->m_pkthdr.len - thoff - tcphdrlen,
3259 tcp_signature_apply, &ctx);
3260
3261 MD5Update(&ctx, _KEYBUF(sav->key_auth), _KEYLEN(sav->key_auth));
3262 MD5Final(sig, &ctx);
3263
3264 return (0);
3265 }
3266 #endif
3267
3268 /*
3269 * tcp_dooptions: parse and process tcp options.
3270 *
3271 * returns -1 if this segment should be dropped. (eg. wrong signature)
3272 * otherwise returns 0.
3273 */
3274
3275 static int
tcp_dooptions(struct tcpcb * tp,const u_char * cp,int cnt,struct tcphdr * th,struct mbuf * m,int toff,struct tcp_opt_info * oi)3276 tcp_dooptions(struct tcpcb *tp, const u_char *cp, int cnt,
3277 struct tcphdr *th,
3278 struct mbuf *m, int toff, struct tcp_opt_info *oi)
3279 {
3280 u_int16_t mss;
3281 int opt, optlen = 0;
3282 #ifdef TCP_SIGNATURE
3283 void *sigp = NULL;
3284 char sigbuf[TCP_SIGLEN];
3285 struct secasvar *sav = NULL;
3286 #endif
3287
3288 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
3289 opt = cp[0];
3290 if (opt == TCPOPT_EOL)
3291 break;
3292 if (opt == TCPOPT_NOP)
3293 optlen = 1;
3294 else {
3295 if (cnt < 2)
3296 break;
3297 optlen = cp[1];
3298 if (optlen < 2 || optlen > cnt)
3299 break;
3300 }
3301 switch (opt) {
3302
3303 default:
3304 continue;
3305
3306 case TCPOPT_MAXSEG:
3307 if (optlen != TCPOLEN_MAXSEG)
3308 continue;
3309 if (!(th->th_flags & TH_SYN))
3310 continue;
3311 if (TCPS_HAVERCVDSYN(tp->t_state))
3312 continue;
3313 bcopy(cp + 2, &mss, sizeof(mss));
3314 oi->maxseg = ntohs(mss);
3315 break;
3316
3317 case TCPOPT_WINDOW:
3318 if (optlen != TCPOLEN_WINDOW)
3319 continue;
3320 if (!(th->th_flags & TH_SYN))
3321 continue;
3322 if (TCPS_HAVERCVDSYN(tp->t_state))
3323 continue;
3324 tp->t_flags |= TF_RCVD_SCALE;
3325 tp->requested_s_scale = cp[2];
3326 if (tp->requested_s_scale > TCP_MAX_WINSHIFT) {
3327 char buf[INET6_ADDRSTRLEN];
3328 struct ip *ip = mtod(m, struct ip *);
3329 #ifdef INET6
3330 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
3331 #endif
3332 if (ip)
3333 in_print(buf, sizeof(buf),
3334 &ip->ip_src);
3335 #ifdef INET6
3336 else if (ip6)
3337 in6_print(buf, sizeof(buf),
3338 &ip6->ip6_src);
3339 #endif
3340 else
3341 strlcpy(buf, "(unknown)", sizeof(buf));
3342 log(LOG_ERR, "TCP: invalid wscale %d from %s, "
3343 "assuming %d\n",
3344 tp->requested_s_scale, buf,
3345 TCP_MAX_WINSHIFT);
3346 tp->requested_s_scale = TCP_MAX_WINSHIFT;
3347 }
3348 break;
3349
3350 case TCPOPT_TIMESTAMP:
3351 if (optlen != TCPOLEN_TIMESTAMP)
3352 continue;
3353 oi->ts_present = 1;
3354 bcopy(cp + 2, &oi->ts_val, sizeof(oi->ts_val));
3355 NTOHL(oi->ts_val);
3356 bcopy(cp + 6, &oi->ts_ecr, sizeof(oi->ts_ecr));
3357 NTOHL(oi->ts_ecr);
3358
3359 if (!(th->th_flags & TH_SYN))
3360 continue;
3361 if (TCPS_HAVERCVDSYN(tp->t_state))
3362 continue;
3363 /*
3364 * A timestamp received in a SYN makes
3365 * it ok to send timestamp requests and replies.
3366 */
3367 tp->t_flags |= TF_RCVD_TSTMP;
3368 tp->ts_recent = oi->ts_val;
3369 tp->ts_recent_age = tcp_now;
3370 break;
3371
3372 case TCPOPT_SACK_PERMITTED:
3373 if (optlen != TCPOLEN_SACK_PERMITTED)
3374 continue;
3375 if (!(th->th_flags & TH_SYN))
3376 continue;
3377 if (TCPS_HAVERCVDSYN(tp->t_state))
3378 continue;
3379 if (tcp_do_sack) {
3380 tp->t_flags |= TF_SACK_PERMIT;
3381 tp->t_flags |= TF_WILL_SACK;
3382 }
3383 break;
3384
3385 case TCPOPT_SACK:
3386 tcp_sack_option(tp, th, cp, optlen);
3387 break;
3388 #ifdef TCP_SIGNATURE
3389 case TCPOPT_SIGNATURE:
3390 if (optlen != TCPOLEN_SIGNATURE)
3391 continue;
3392 if (sigp && memcmp(sigp, cp + 2, TCP_SIGLEN))
3393 return (-1);
3394
3395 sigp = sigbuf;
3396 memcpy(sigbuf, cp + 2, TCP_SIGLEN);
3397 tp->t_flags |= TF_SIGNATURE;
3398 break;
3399 #endif
3400 }
3401 }
3402
3403 #ifndef TCP_SIGNATURE
3404 return 0;
3405 #else
3406 if (tp->t_flags & TF_SIGNATURE) {
3407
3408 sav = tcp_signature_getsav(m, th);
3409
3410 if (sav == NULL && tp->t_state == TCPS_LISTEN)
3411 return (-1);
3412 }
3413
3414 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE))
3415 goto out;
3416
3417 if (sigp) {
3418 char sig[TCP_SIGLEN];
3419
3420 tcp_fields_to_net(th);
3421 if (tcp_signature(m, th, toff, sav, sig) < 0) {
3422 tcp_fields_to_host(th);
3423 goto out;
3424 }
3425 tcp_fields_to_host(th);
3426
3427 if (memcmp(sig, sigp, TCP_SIGLEN)) {
3428 TCP_STATINC(TCP_STAT_BADSIG);
3429 goto out;
3430 } else
3431 TCP_STATINC(TCP_STAT_GOODSIG);
3432
3433 key_sa_recordxfer(sav, m);
3434 KEY_FREESAV(&sav);
3435 }
3436 return 0;
3437 out:
3438 if (sav != NULL)
3439 KEY_FREESAV(&sav);
3440 return -1;
3441 #endif
3442 }
3443
3444 /*
3445 * Pull out of band byte out of a segment so
3446 * it doesn't appear in the user's data queue.
3447 * It is still reflected in the segment length for
3448 * sequencing purposes.
3449 */
3450 void
tcp_pulloutofband(struct socket * so,struct tcphdr * th,struct mbuf * m,int off)3451 tcp_pulloutofband(struct socket *so, struct tcphdr *th,
3452 struct mbuf *m, int off)
3453 {
3454 int cnt = off + th->th_urp - 1;
3455
3456 while (cnt >= 0) {
3457 if (m->m_len > cnt) {
3458 char *cp = mtod(m, char *) + cnt;
3459 struct tcpcb *tp = sototcpcb(so);
3460
3461 tp->t_iobc = *cp;
3462 tp->t_oobflags |= TCPOOB_HAVEDATA;
3463 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
3464 m->m_len--;
3465 return;
3466 }
3467 cnt -= m->m_len;
3468 m = m->m_next;
3469 if (m == 0)
3470 break;
3471 }
3472 panic("tcp_pulloutofband");
3473 }
3474
3475 /*
3476 * Collect new round-trip time estimate
3477 * and update averages and current timeout.
3478 *
3479 * rtt is in units of slow ticks (typically 500 ms) -- essentially the
3480 * difference of two timestamps.
3481 */
3482 void
tcp_xmit_timer(struct tcpcb * tp,uint32_t rtt)3483 tcp_xmit_timer(struct tcpcb *tp, uint32_t rtt)
3484 {
3485 int32_t delta;
3486
3487 TCP_STATINC(TCP_STAT_RTTUPDATED);
3488 if (tp->t_srtt != 0) {
3489 /*
3490 * Compute the amount to add to srtt for smoothing,
3491 * *alpha, or 2^(-TCP_RTT_SHIFT). Because
3492 * srtt is stored in 1/32 slow ticks, we conceptually
3493 * shift left 5 bits, subtract srtt to get the
3494 * diference, and then shift right by TCP_RTT_SHIFT
3495 * (3) to obtain 1/8 of the difference.
3496 */
3497 delta = (rtt << 2) - (tp->t_srtt >> TCP_RTT_SHIFT);
3498 /*
3499 * This can never happen, because delta's lowest
3500 * possible value is 1/8 of t_srtt. But if it does,
3501 * set srtt to some reasonable value, here chosen
3502 * as 1/8 tick.
3503 */
3504 if ((tp->t_srtt += delta) <= 0)
3505 tp->t_srtt = 1 << 2;
3506 /*
3507 * RFC2988 requires that rttvar be updated first.
3508 * This code is compliant because "delta" is the old
3509 * srtt minus the new observation (scaled).
3510 *
3511 * RFC2988 says:
3512 * rttvar = (1-beta) * rttvar + beta * |srtt-observed|
3513 *
3514 * delta is in units of 1/32 ticks, and has then been
3515 * divided by 8. This is equivalent to being in 1/16s
3516 * units and divided by 4. Subtract from it 1/4 of
3517 * the existing rttvar to form the (signed) amount to
3518 * adjust.
3519 */
3520 if (delta < 0)
3521 delta = -delta;
3522 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
3523 /*
3524 * As with srtt, this should never happen. There is
3525 * no support in RFC2988 for this operation. But 1/4s
3526 * as rttvar when faced with something arguably wrong
3527 * is ok.
3528 */
3529 if ((tp->t_rttvar += delta) <= 0)
3530 tp->t_rttvar = 1 << 2;
3531
3532 /*
3533 * If srtt exceeds .01 second, ensure we use the 'remote' MSL
3534 * Problem is: it doesn't work. Disabled by defaulting
3535 * tcp_rttlocal to 0; see corresponding code in
3536 * tcp_subr that selects local vs remote in a different way.
3537 *
3538 * The static branch prediction hint here should be removed
3539 * when the rtt estimator is fixed and the rtt_enable code
3540 * is turned back on.
3541 */
3542 if (__predict_false(tcp_rttlocal) && tcp_msl_enable
3543 && tp->t_srtt > tcp_msl_remote_threshold
3544 && tp->t_msl < tcp_msl_remote) {
3545 tp->t_msl = tcp_msl_remote;
3546 }
3547 } else {
3548 /*
3549 * This is the first measurement. Per RFC2988, 2.2,
3550 * set rtt=R and srtt=R/2.
3551 * For srtt, storage representation is 1/32 ticks,
3552 * so shift left by 5.
3553 * For rttvar, storage representation is 1/16 ticks,
3554 * So shift left by 4, but then right by 1 to halve.
3555 */
3556 tp->t_srtt = rtt << (TCP_RTT_SHIFT + 2);
3557 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT + 2 - 1);
3558 }
3559 tp->t_rtttime = 0;
3560 tp->t_rxtshift = 0;
3561
3562 /*
3563 * the retransmit should happen at rtt + 4 * rttvar.
3564 * Because of the way we do the smoothing, srtt and rttvar
3565 * will each average +1/2 tick of bias. When we compute
3566 * the retransmit timer, we want 1/2 tick of rounding and
3567 * 1 extra tick because of +-1/2 tick uncertainty in the
3568 * firing of the timer. The bias will give us exactly the
3569 * 1.5 tick we need. But, because the bias is
3570 * statistical, we have to test that we don't drop below
3571 * the minimum feasible timer (which is 2 ticks).
3572 */
3573 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
3574 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX);
3575
3576 /*
3577 * We received an ack for a packet that wasn't retransmitted;
3578 * it is probably safe to discard any error indications we've
3579 * received recently. This isn't quite right, but close enough
3580 * for now (a route might have failed after we sent a segment,
3581 * and the return path might not be symmetrical).
3582 */
3583 tp->t_softerror = 0;
3584 }
3585
3586
3587 /*
3588 * TCP compressed state engine. Currently used to hold compressed
3589 * state for SYN_RECEIVED.
3590 */
3591
3592 u_long syn_cache_count;
3593 u_int32_t syn_hash1, syn_hash2;
3594
3595 #define SYN_HASH(sa, sp, dp) \
3596 ((((sa)->s_addr^syn_hash1)*(((((u_int32_t)(dp))<<16) + \
3597 ((u_int32_t)(sp)))^syn_hash2)))
3598 #ifndef INET6
3599 #define SYN_HASHALL(hash, src, dst) \
3600 do { \
3601 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3602 ((const struct sockaddr_in *)(src))->sin_port, \
3603 ((const struct sockaddr_in *)(dst))->sin_port); \
3604 } while (/*CONSTCOND*/ 0)
3605 #else
3606 #define SYN_HASH6(sa, sp, dp) \
3607 ((((sa)->s6_addr32[0] ^ (sa)->s6_addr32[3] ^ syn_hash1) * \
3608 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp)))^syn_hash2)) \
3609 & 0x7fffffff)
3610
3611 #define SYN_HASHALL(hash, src, dst) \
3612 do { \
3613 switch ((src)->sa_family) { \
3614 case AF_INET: \
3615 hash = SYN_HASH(&((const struct sockaddr_in *)(src))->sin_addr, \
3616 ((const struct sockaddr_in *)(src))->sin_port, \
3617 ((const struct sockaddr_in *)(dst))->sin_port); \
3618 break; \
3619 case AF_INET6: \
3620 hash = SYN_HASH6(&((const struct sockaddr_in6 *)(src))->sin6_addr, \
3621 ((const struct sockaddr_in6 *)(src))->sin6_port, \
3622 ((const struct sockaddr_in6 *)(dst))->sin6_port); \
3623 break; \
3624 default: \
3625 hash = 0; \
3626 } \
3627 } while (/*CONSTCOND*/0)
3628 #endif /* INET6 */
3629
3630 static struct pool syn_cache_pool;
3631
3632 /*
3633 * We don't estimate RTT with SYNs, so each packet starts with the default
3634 * RTT and each timer step has a fixed timeout value.
3635 */
3636 #define SYN_CACHE_TIMER_ARM(sc) \
3637 do { \
3638 TCPT_RANGESET((sc)->sc_rxtcur, \
3639 TCPTV_SRTTDFLT * tcp_backoff[(sc)->sc_rxtshift], TCPTV_MIN, \
3640 TCPTV_REXMTMAX); \
3641 callout_reset(&(sc)->sc_timer, \
3642 (sc)->sc_rxtcur * (hz / PR_SLOWHZ), syn_cache_timer, (sc)); \
3643 } while (/*CONSTCOND*/0)
3644
3645 #define SYN_CACHE_TIMESTAMP(sc) (tcp_now - (sc)->sc_timebase)
3646
3647 static inline void
syn_cache_rm(struct syn_cache * sc)3648 syn_cache_rm(struct syn_cache *sc)
3649 {
3650 TAILQ_REMOVE(&tcp_syn_cache[sc->sc_bucketidx].sch_bucket,
3651 sc, sc_bucketq);
3652 sc->sc_tp = NULL;
3653 LIST_REMOVE(sc, sc_tpq);
3654 tcp_syn_cache[sc->sc_bucketidx].sch_length--;
3655 callout_stop(&sc->sc_timer);
3656 syn_cache_count--;
3657 }
3658
3659 static inline void
syn_cache_put(struct syn_cache * sc)3660 syn_cache_put(struct syn_cache *sc)
3661 {
3662 if (sc->sc_ipopts)
3663 (void) m_free(sc->sc_ipopts);
3664 rtcache_free(&sc->sc_route);
3665 sc->sc_flags |= SCF_DEAD;
3666 if (!callout_invoking(&sc->sc_timer))
3667 callout_schedule(&(sc)->sc_timer, 1);
3668 }
3669
3670 void
syn_cache_init(void)3671 syn_cache_init(void)
3672 {
3673 int i;
3674
3675 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, 0, 0,
3676 "synpl", NULL, IPL_SOFTNET);
3677
3678 /* Initialize the hash buckets. */
3679 for (i = 0; i < tcp_syn_cache_size; i++)
3680 TAILQ_INIT(&tcp_syn_cache[i].sch_bucket);
3681 }
3682
3683 void
syn_cache_insert(struct syn_cache * sc,struct tcpcb * tp)3684 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
3685 {
3686 struct syn_cache_head *scp;
3687 struct syn_cache *sc2;
3688 int s;
3689
3690 /*
3691 * If there are no entries in the hash table, reinitialize
3692 * the hash secrets.
3693 */
3694 if (syn_cache_count == 0) {
3695 syn_hash1 = cprng_fast32();
3696 syn_hash2 = cprng_fast32();
3697 }
3698
3699 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa);
3700 sc->sc_bucketidx = sc->sc_hash % tcp_syn_cache_size;
3701 scp = &tcp_syn_cache[sc->sc_bucketidx];
3702
3703 /*
3704 * Make sure that we don't overflow the per-bucket
3705 * limit or the total cache size limit.
3706 */
3707 s = splsoftnet();
3708 if (scp->sch_length >= tcp_syn_bucket_limit) {
3709 TCP_STATINC(TCP_STAT_SC_BUCKETOVERFLOW);
3710 /*
3711 * The bucket is full. Toss the oldest element in the
3712 * bucket. This will be the first entry in the bucket.
3713 */
3714 sc2 = TAILQ_FIRST(&scp->sch_bucket);
3715 #ifdef DIAGNOSTIC
3716 /*
3717 * This should never happen; we should always find an
3718 * entry in our bucket.
3719 */
3720 if (sc2 == NULL)
3721 panic("syn_cache_insert: bucketoverflow: impossible");
3722 #endif
3723 syn_cache_rm(sc2);
3724 syn_cache_put(sc2); /* calls pool_put but see spl above */
3725 } else if (syn_cache_count >= tcp_syn_cache_limit) {
3726 struct syn_cache_head *scp2, *sce;
3727
3728 TCP_STATINC(TCP_STAT_SC_OVERFLOWED);
3729 /*
3730 * The cache is full. Toss the oldest entry in the
3731 * first non-empty bucket we can find.
3732 *
3733 * XXX We would really like to toss the oldest
3734 * entry in the cache, but we hope that this
3735 * condition doesn't happen very often.
3736 */
3737 scp2 = scp;
3738 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
3739 sce = &tcp_syn_cache[tcp_syn_cache_size];
3740 for (++scp2; scp2 != scp; scp2++) {
3741 if (scp2 >= sce)
3742 scp2 = &tcp_syn_cache[0];
3743 if (! TAILQ_EMPTY(&scp2->sch_bucket))
3744 break;
3745 }
3746 #ifdef DIAGNOSTIC
3747 /*
3748 * This should never happen; we should always find a
3749 * non-empty bucket.
3750 */
3751 if (scp2 == scp)
3752 panic("syn_cache_insert: cacheoverflow: "
3753 "impossible");
3754 #endif
3755 }
3756 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
3757 syn_cache_rm(sc2);
3758 syn_cache_put(sc2); /* calls pool_put but see spl above */
3759 }
3760
3761 /*
3762 * Initialize the entry's timer.
3763 */
3764 sc->sc_rxttot = 0;
3765 sc->sc_rxtshift = 0;
3766 SYN_CACHE_TIMER_ARM(sc);
3767
3768 /* Link it from tcpcb entry */
3769 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
3770
3771 /* Put it into the bucket. */
3772 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
3773 scp->sch_length++;
3774 syn_cache_count++;
3775
3776 TCP_STATINC(TCP_STAT_SC_ADDED);
3777 splx(s);
3778 }
3779
3780 /*
3781 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
3782 * If we have retransmitted an entry the maximum number of times, expire
3783 * that entry.
3784 */
3785 void
syn_cache_timer(void * arg)3786 syn_cache_timer(void *arg)
3787 {
3788 struct syn_cache *sc = arg;
3789
3790 mutex_enter(softnet_lock);
3791 KERNEL_LOCK(1, NULL);
3792 callout_ack(&sc->sc_timer);
3793
3794 if (__predict_false(sc->sc_flags & SCF_DEAD)) {
3795 TCP_STATINC(TCP_STAT_SC_DELAYED_FREE);
3796 callout_destroy(&sc->sc_timer);
3797 pool_put(&syn_cache_pool, sc);
3798 KERNEL_UNLOCK_ONE(NULL);
3799 mutex_exit(softnet_lock);
3800 return;
3801 }
3802
3803 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3804 /* Drop it -- too many retransmissions. */
3805 goto dropit;
3806 }
3807
3808 /*
3809 * Compute the total amount of time this entry has
3810 * been on a queue. If this entry has been on longer
3811 * than the keep alive timer would allow, expire it.
3812 */
3813 sc->sc_rxttot += sc->sc_rxtcur;
3814 if (sc->sc_rxttot >= tcp_keepinit)
3815 goto dropit;
3816
3817 TCP_STATINC(TCP_STAT_SC_RETRANSMITTED);
3818 (void) syn_cache_respond(sc, NULL);
3819
3820 /* Advance the timer back-off. */
3821 sc->sc_rxtshift++;
3822 SYN_CACHE_TIMER_ARM(sc);
3823
3824 KERNEL_UNLOCK_ONE(NULL);
3825 mutex_exit(softnet_lock);
3826 return;
3827
3828 dropit:
3829 TCP_STATINC(TCP_STAT_SC_TIMED_OUT);
3830 syn_cache_rm(sc);
3831 if (sc->sc_ipopts)
3832 (void) m_free(sc->sc_ipopts);
3833 rtcache_free(&sc->sc_route);
3834 callout_destroy(&sc->sc_timer);
3835 pool_put(&syn_cache_pool, sc);
3836 KERNEL_UNLOCK_ONE(NULL);
3837 mutex_exit(softnet_lock);
3838 }
3839
3840 /*
3841 * Remove syn cache created by the specified tcb entry,
3842 * because this does not make sense to keep them
3843 * (if there's no tcb entry, syn cache entry will never be used)
3844 */
3845 void
syn_cache_cleanup(struct tcpcb * tp)3846 syn_cache_cleanup(struct tcpcb *tp)
3847 {
3848 struct syn_cache *sc, *nsc;
3849 int s;
3850
3851 s = splsoftnet();
3852
3853 for (sc = LIST_FIRST(&tp->t_sc); sc != NULL; sc = nsc) {
3854 nsc = LIST_NEXT(sc, sc_tpq);
3855
3856 #ifdef DIAGNOSTIC
3857 if (sc->sc_tp != tp)
3858 panic("invalid sc_tp in syn_cache_cleanup");
3859 #endif
3860 syn_cache_rm(sc);
3861 syn_cache_put(sc); /* calls pool_put but see spl above */
3862 }
3863 /* just for safety */
3864 LIST_INIT(&tp->t_sc);
3865
3866 splx(s);
3867 }
3868
3869 /*
3870 * Find an entry in the syn cache.
3871 */
3872 struct syn_cache *
syn_cache_lookup(const struct sockaddr * src,const struct sockaddr * dst,struct syn_cache_head ** headp)3873 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
3874 struct syn_cache_head **headp)
3875 {
3876 struct syn_cache *sc;
3877 struct syn_cache_head *scp;
3878 u_int32_t hash;
3879 int s;
3880
3881 SYN_HASHALL(hash, src, dst);
3882
3883 scp = &tcp_syn_cache[hash % tcp_syn_cache_size];
3884 *headp = scp;
3885 s = splsoftnet();
3886 for (sc = TAILQ_FIRST(&scp->sch_bucket); sc != NULL;
3887 sc = TAILQ_NEXT(sc, sc_bucketq)) {
3888 if (sc->sc_hash != hash)
3889 continue;
3890 if (!memcmp(&sc->sc_src, src, src->sa_len) &&
3891 !memcmp(&sc->sc_dst, dst, dst->sa_len)) {
3892 splx(s);
3893 return (sc);
3894 }
3895 }
3896 splx(s);
3897 return (NULL);
3898 }
3899
3900 /*
3901 * This function gets called when we receive an ACK for a
3902 * socket in the LISTEN state. We look up the connection
3903 * in the syn cache, and if its there, we pull it out of
3904 * the cache and turn it into a full-blown connection in
3905 * the SYN-RECEIVED state.
3906 *
3907 * The return values may not be immediately obvious, and their effects
3908 * can be subtle, so here they are:
3909 *
3910 * NULL SYN was not found in cache; caller should drop the
3911 * packet and send an RST.
3912 *
3913 * -1 We were unable to create the new connection, and are
3914 * aborting it. An ACK,RST is being sent to the peer
3915 * (unless we got screwey sequence numbners; see below),
3916 * because the 3-way handshake has been completed. Caller
3917 * should not free the mbuf, since we may be using it. If
3918 * we are not, we will free it.
3919 *
3920 * Otherwise, the return value is a pointer to the new socket
3921 * associated with the connection.
3922 */
3923 struct socket *
syn_cache_get(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th,unsigned int hlen,unsigned int tlen,struct socket * so,struct mbuf * m)3924 syn_cache_get(struct sockaddr *src, struct sockaddr *dst,
3925 struct tcphdr *th, unsigned int hlen, unsigned int tlen,
3926 struct socket *so, struct mbuf *m)
3927 {
3928 struct syn_cache *sc;
3929 struct syn_cache_head *scp;
3930 struct inpcb *inp = NULL;
3931 #ifdef INET6
3932 struct in6pcb *in6p = NULL;
3933 #endif
3934 struct tcpcb *tp = 0;
3935 int s;
3936 struct socket *oso;
3937
3938 s = splsoftnet();
3939 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
3940 splx(s);
3941 return (NULL);
3942 }
3943
3944 /*
3945 * Verify the sequence and ack numbers. Try getting the correct
3946 * response again.
3947 */
3948 if ((th->th_ack != sc->sc_iss + 1) ||
3949 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3950 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3951 (void) syn_cache_respond(sc, m);
3952 splx(s);
3953 return ((struct socket *)(-1));
3954 }
3955
3956 /* Remove this cache entry */
3957 syn_cache_rm(sc);
3958 splx(s);
3959
3960 /*
3961 * Ok, create the full blown connection, and set things up
3962 * as they would have been set up if we had created the
3963 * connection when the SYN arrived. If we can't create
3964 * the connection, abort it.
3965 */
3966 /*
3967 * inp still has the OLD in_pcb stuff, set the
3968 * v6-related flags on the new guy, too. This is
3969 * done particularly for the case where an AF_INET6
3970 * socket is bound only to a port, and a v4 connection
3971 * comes in on that port.
3972 * we also copy the flowinfo from the original pcb
3973 * to the new one.
3974 */
3975 oso = so;
3976 so = sonewconn(so, true);
3977 if (so == NULL)
3978 goto resetandabort;
3979
3980 switch (so->so_proto->pr_domain->dom_family) {
3981 #ifdef INET
3982 case AF_INET:
3983 inp = sotoinpcb(so);
3984 break;
3985 #endif
3986 #ifdef INET6
3987 case AF_INET6:
3988 in6p = sotoin6pcb(so);
3989 break;
3990 #endif
3991 }
3992 switch (src->sa_family) {
3993 #ifdef INET
3994 case AF_INET:
3995 if (inp) {
3996 inp->inp_laddr = ((struct sockaddr_in *)dst)->sin_addr;
3997 inp->inp_lport = ((struct sockaddr_in *)dst)->sin_port;
3998 inp->inp_options = ip_srcroute();
3999 in_pcbstate(inp, INP_BOUND);
4000 if (inp->inp_options == NULL) {
4001 inp->inp_options = sc->sc_ipopts;
4002 sc->sc_ipopts = NULL;
4003 }
4004 }
4005 #ifdef INET6
4006 else if (in6p) {
4007 /* IPv4 packet to AF_INET6 socket */
4008 memset(&in6p->in6p_laddr, 0, sizeof(in6p->in6p_laddr));
4009 in6p->in6p_laddr.s6_addr16[5] = htons(0xffff);
4010 bcopy(&((struct sockaddr_in *)dst)->sin_addr,
4011 &in6p->in6p_laddr.s6_addr32[3],
4012 sizeof(((struct sockaddr_in *)dst)->sin_addr));
4013 in6p->in6p_lport = ((struct sockaddr_in *)dst)->sin_port;
4014 in6totcpcb(in6p)->t_family = AF_INET;
4015 if (sotoin6pcb(oso)->in6p_flags & IN6P_IPV6_V6ONLY)
4016 in6p->in6p_flags |= IN6P_IPV6_V6ONLY;
4017 else
4018 in6p->in6p_flags &= ~IN6P_IPV6_V6ONLY;
4019 in6_pcbstate(in6p, IN6P_BOUND);
4020 }
4021 #endif
4022 break;
4023 #endif
4024 #ifdef INET6
4025 case AF_INET6:
4026 if (in6p) {
4027 in6p->in6p_laddr = ((struct sockaddr_in6 *)dst)->sin6_addr;
4028 in6p->in6p_lport = ((struct sockaddr_in6 *)dst)->sin6_port;
4029 in6_pcbstate(in6p, IN6P_BOUND);
4030 }
4031 break;
4032 #endif
4033 }
4034 #ifdef INET6
4035 if (in6p && in6totcpcb(in6p)->t_family == AF_INET6 && sotoinpcb(oso)) {
4036 struct in6pcb *oin6p = sotoin6pcb(oso);
4037 /* inherit socket options from the listening socket */
4038 in6p->in6p_flags |= (oin6p->in6p_flags & IN6P_CONTROLOPTS);
4039 if (in6p->in6p_flags & IN6P_CONTROLOPTS) {
4040 m_freem(in6p->in6p_options);
4041 in6p->in6p_options = 0;
4042 }
4043 ip6_savecontrol(in6p, &in6p->in6p_options,
4044 mtod(m, struct ip6_hdr *), m);
4045 }
4046 #endif
4047
4048 #if defined(IPSEC)
4049 if (ipsec_used) {
4050 /*
4051 * we make a copy of policy, instead of sharing the policy, for
4052 * better behavior in terms of SA lookup and dead SA removal.
4053 */
4054 if (inp) {
4055 /* copy old policy into new socket's */
4056 if (ipsec_copy_pcbpolicy(sotoinpcb(oso)->inp_sp,
4057 inp->inp_sp))
4058 printf("tcp_input: could not copy policy\n");
4059 }
4060 #ifdef INET6
4061 else if (in6p) {
4062 /* copy old policy into new socket's */
4063 if (ipsec_copy_pcbpolicy(sotoin6pcb(oso)->in6p_sp,
4064 in6p->in6p_sp))
4065 printf("tcp_input: could not copy policy\n");
4066 }
4067 #endif
4068 }
4069 #endif
4070
4071 /*
4072 * Give the new socket our cached route reference.
4073 */
4074 if (inp) {
4075 rtcache_copy(&inp->inp_route, &sc->sc_route);
4076 rtcache_free(&sc->sc_route);
4077 }
4078 #ifdef INET6
4079 else {
4080 rtcache_copy(&in6p->in6p_route, &sc->sc_route);
4081 rtcache_free(&sc->sc_route);
4082 }
4083 #endif
4084
4085 if (inp) {
4086 struct sockaddr_in sin;
4087 memcpy(&sin, src, src->sa_len);
4088 if (in_pcbconnect(inp, &sin, &lwp0)) {
4089 goto resetandabort;
4090 }
4091 }
4092 #ifdef INET6
4093 else if (in6p) {
4094 struct sockaddr_in6 sin6;
4095 memcpy(&sin6, src, src->sa_len);
4096 if (src->sa_family == AF_INET) {
4097 /* IPv4 packet to AF_INET6 socket */
4098 in6_sin_2_v4mapsin6((struct sockaddr_in *)src, &sin6);
4099 }
4100 if (in6_pcbconnect(in6p, &sin6, NULL)) {
4101 goto resetandabort;
4102 }
4103 }
4104 #endif
4105 else {
4106 goto resetandabort;
4107 }
4108
4109 if (inp)
4110 tp = intotcpcb(inp);
4111 #ifdef INET6
4112 else if (in6p)
4113 tp = in6totcpcb(in6p);
4114 #endif
4115 else
4116 tp = NULL;
4117 tp->t_flags = sototcpcb(oso)->t_flags & TF_NODELAY;
4118 if (sc->sc_request_r_scale != 15) {
4119 tp->requested_s_scale = sc->sc_requested_s_scale;
4120 tp->request_r_scale = sc->sc_request_r_scale;
4121 tp->snd_scale = sc->sc_requested_s_scale;
4122 tp->rcv_scale = sc->sc_request_r_scale;
4123 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
4124 }
4125 if (sc->sc_flags & SCF_TIMESTAMP)
4126 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
4127 tp->ts_timebase = sc->sc_timebase;
4128
4129 tp->t_template = tcp_template(tp);
4130 if (tp->t_template == 0) {
4131 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
4132 so = NULL;
4133 m_freem(m);
4134 goto abort;
4135 }
4136
4137 tp->iss = sc->sc_iss;
4138 tp->irs = sc->sc_irs;
4139 tcp_sendseqinit(tp);
4140 tcp_rcvseqinit(tp);
4141 tp->t_state = TCPS_SYN_RECEIVED;
4142 TCP_TIMER_ARM(tp, TCPT_KEEP, tp->t_keepinit);
4143 TCP_STATINC(TCP_STAT_ACCEPTS);
4144
4145 if ((sc->sc_flags & SCF_SACK_PERMIT) && tcp_do_sack)
4146 tp->t_flags |= TF_WILL_SACK;
4147
4148 if ((sc->sc_flags & SCF_ECN_PERMIT) && tcp_do_ecn)
4149 tp->t_flags |= TF_ECN_PERMIT;
4150
4151 #ifdef TCP_SIGNATURE
4152 if (sc->sc_flags & SCF_SIGNATURE)
4153 tp->t_flags |= TF_SIGNATURE;
4154 #endif
4155
4156 /* Initialize tp->t_ourmss before we deal with the peer's! */
4157 tp->t_ourmss = sc->sc_ourmaxseg;
4158 tcp_mss_from_peer(tp, sc->sc_peermaxseg);
4159
4160 /*
4161 * Initialize the initial congestion window. If we
4162 * had to retransmit the SYN,ACK, we must initialize cwnd
4163 * to 1 segment (i.e. the Loss Window).
4164 */
4165 if (sc->sc_rxtshift)
4166 tp->snd_cwnd = tp->t_peermss;
4167 else {
4168 int ss = tcp_init_win;
4169 #ifdef INET
4170 if (inp != NULL && in_localaddr(inp->inp_faddr))
4171 ss = tcp_init_win_local;
4172 #endif
4173 #ifdef INET6
4174 if (in6p != NULL && in6_localaddr(&in6p->in6p_faddr))
4175 ss = tcp_init_win_local;
4176 #endif
4177 tp->snd_cwnd = TCP_INITIAL_WINDOW(ss, tp->t_peermss);
4178 }
4179
4180 tcp_rmx_rtt(tp);
4181 tp->snd_wl1 = sc->sc_irs;
4182 tp->rcv_up = sc->sc_irs + 1;
4183
4184 /*
4185 * This is what whould have happened in tcp_output() when
4186 * the SYN,ACK was sent.
4187 */
4188 tp->snd_up = tp->snd_una;
4189 tp->snd_max = tp->snd_nxt = tp->iss+1;
4190 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
4191 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
4192 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
4193 tp->last_ack_sent = tp->rcv_nxt;
4194 tp->t_partialacks = -1;
4195 tp->t_dupacks = 0;
4196
4197 TCP_STATINC(TCP_STAT_SC_COMPLETED);
4198 s = splsoftnet();
4199 syn_cache_put(sc);
4200 splx(s);
4201 return (so);
4202
4203 resetandabort:
4204 (void)tcp_respond(NULL, m, m, th, (tcp_seq)0, th->th_ack, TH_RST);
4205 abort:
4206 if (so != NULL) {
4207 (void) soqremque(so, 1);
4208 (void) soabort(so);
4209 mutex_enter(softnet_lock);
4210 }
4211 s = splsoftnet();
4212 syn_cache_put(sc);
4213 splx(s);
4214 TCP_STATINC(TCP_STAT_SC_ABORTED);
4215 return ((struct socket *)(-1));
4216 }
4217
4218 /*
4219 * This function is called when we get a RST for a
4220 * non-existent connection, so that we can see if the
4221 * connection is in the syn cache. If it is, zap it.
4222 */
4223
4224 void
syn_cache_reset(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th)4225 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th)
4226 {
4227 struct syn_cache *sc;
4228 struct syn_cache_head *scp;
4229 int s = splsoftnet();
4230
4231 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4232 splx(s);
4233 return;
4234 }
4235 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
4236 SEQ_GT(th->th_seq, sc->sc_irs+1)) {
4237 splx(s);
4238 return;
4239 }
4240 syn_cache_rm(sc);
4241 TCP_STATINC(TCP_STAT_SC_RESET);
4242 syn_cache_put(sc); /* calls pool_put but see spl above */
4243 splx(s);
4244 }
4245
4246 void
syn_cache_unreach(const struct sockaddr * src,const struct sockaddr * dst,struct tcphdr * th)4247 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
4248 struct tcphdr *th)
4249 {
4250 struct syn_cache *sc;
4251 struct syn_cache_head *scp;
4252 int s;
4253
4254 s = splsoftnet();
4255 if ((sc = syn_cache_lookup(src, dst, &scp)) == NULL) {
4256 splx(s);
4257 return;
4258 }
4259 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
4260 if (ntohl (th->th_seq) != sc->sc_iss) {
4261 splx(s);
4262 return;
4263 }
4264
4265 /*
4266 * If we've retransmitted 3 times and this is our second error,
4267 * we remove the entry. Otherwise, we allow it to continue on.
4268 * This prevents us from incorrectly nuking an entry during a
4269 * spurious network outage.
4270 *
4271 * See tcp_notify().
4272 */
4273 if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtshift < 3) {
4274 sc->sc_flags |= SCF_UNREACH;
4275 splx(s);
4276 return;
4277 }
4278
4279 syn_cache_rm(sc);
4280 TCP_STATINC(TCP_STAT_SC_UNREACH);
4281 syn_cache_put(sc); /* calls pool_put but see spl above */
4282 splx(s);
4283 }
4284
4285 /*
4286 * Given a LISTEN socket and an inbound SYN request, add
4287 * this to the syn cache, and send back a segment:
4288 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
4289 * to the source.
4290 *
4291 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
4292 * Doing so would require that we hold onto the data and deliver it
4293 * to the application. However, if we are the target of a SYN-flood
4294 * DoS attack, an attacker could send data which would eventually
4295 * consume all available buffer space if it were ACKed. By not ACKing
4296 * the data, we avoid this DoS scenario.
4297 */
4298
4299 int
syn_cache_add(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th,unsigned int hlen,struct socket * so,struct mbuf * m,u_char * optp,int optlen,struct tcp_opt_info * oi)4300 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
4301 unsigned int hlen, struct socket *so, struct mbuf *m, u_char *optp,
4302 int optlen, struct tcp_opt_info *oi)
4303 {
4304 struct tcpcb tb, *tp;
4305 long win;
4306 struct syn_cache *sc;
4307 struct syn_cache_head *scp;
4308 struct mbuf *ipopts;
4309 struct tcp_opt_info opti;
4310 int s;
4311
4312 tp = sototcpcb(so);
4313
4314 memset(&opti, 0, sizeof(opti));
4315
4316 /*
4317 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
4318 *
4319 * Note this check is performed in tcp_input() very early on.
4320 */
4321
4322 /*
4323 * Initialize some local state.
4324 */
4325 win = sbspace(&so->so_rcv);
4326 if (win > TCP_MAXWIN)
4327 win = TCP_MAXWIN;
4328
4329 switch (src->sa_family) {
4330 #ifdef INET
4331 case AF_INET:
4332 /*
4333 * Remember the IP options, if any.
4334 */
4335 ipopts = ip_srcroute();
4336 break;
4337 #endif
4338 default:
4339 ipopts = NULL;
4340 }
4341
4342 #ifdef TCP_SIGNATURE
4343 if (optp || (tp->t_flags & TF_SIGNATURE))
4344 #else
4345 if (optp)
4346 #endif
4347 {
4348 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
4349 #ifdef TCP_SIGNATURE
4350 tb.t_flags |= (tp->t_flags & TF_SIGNATURE);
4351 #endif
4352 tb.t_state = TCPS_LISTEN;
4353 if (tcp_dooptions(&tb, optp, optlen, th, m, m->m_pkthdr.len -
4354 sizeof(struct tcphdr) - optlen - hlen, oi) < 0)
4355 return (0);
4356 } else
4357 tb.t_flags = 0;
4358
4359 /*
4360 * See if we already have an entry for this connection.
4361 * If we do, resend the SYN,ACK. We do not count this
4362 * as a retransmission (XXX though maybe we should).
4363 */
4364 if ((sc = syn_cache_lookup(src, dst, &scp)) != NULL) {
4365 TCP_STATINC(TCP_STAT_SC_DUPESYN);
4366 if (ipopts) {
4367 /*
4368 * If we were remembering a previous source route,
4369 * forget it and use the new one we've been given.
4370 */
4371 if (sc->sc_ipopts)
4372 (void) m_free(sc->sc_ipopts);
4373 sc->sc_ipopts = ipopts;
4374 }
4375 sc->sc_timestamp = tb.ts_recent;
4376 if (syn_cache_respond(sc, m) == 0) {
4377 uint64_t *tcps = TCP_STAT_GETREF();
4378 tcps[TCP_STAT_SNDACKS]++;
4379 tcps[TCP_STAT_SNDTOTAL]++;
4380 TCP_STAT_PUTREF();
4381 }
4382 return (1);
4383 }
4384
4385 s = splsoftnet();
4386 sc = pool_get(&syn_cache_pool, PR_NOWAIT);
4387 splx(s);
4388 if (sc == NULL) {
4389 if (ipopts)
4390 (void) m_free(ipopts);
4391 return (0);
4392 }
4393
4394 /*
4395 * Fill in the cache, and put the necessary IP and TCP
4396 * options into the reply.
4397 */
4398 memset(sc, 0, sizeof(struct syn_cache));
4399 callout_init(&sc->sc_timer, CALLOUT_MPSAFE);
4400 bcopy(src, &sc->sc_src, src->sa_len);
4401 bcopy(dst, &sc->sc_dst, dst->sa_len);
4402 sc->sc_flags = 0;
4403 sc->sc_ipopts = ipopts;
4404 sc->sc_irs = th->th_seq;
4405 switch (src->sa_family) {
4406 #ifdef INET
4407 case AF_INET:
4408 {
4409 struct sockaddr_in *srcin = (void *) src;
4410 struct sockaddr_in *dstin = (void *) dst;
4411
4412 sc->sc_iss = tcp_new_iss1(&dstin->sin_addr,
4413 &srcin->sin_addr, dstin->sin_port,
4414 srcin->sin_port, sizeof(dstin->sin_addr), 0);
4415 break;
4416 }
4417 #endif /* INET */
4418 #ifdef INET6
4419 case AF_INET6:
4420 {
4421 struct sockaddr_in6 *srcin6 = (void *) src;
4422 struct sockaddr_in6 *dstin6 = (void *) dst;
4423
4424 sc->sc_iss = tcp_new_iss1(&dstin6->sin6_addr,
4425 &srcin6->sin6_addr, dstin6->sin6_port,
4426 srcin6->sin6_port, sizeof(dstin6->sin6_addr), 0);
4427 break;
4428 }
4429 #endif /* INET6 */
4430 }
4431 sc->sc_peermaxseg = oi->maxseg;
4432 sc->sc_ourmaxseg = tcp_mss_to_advertise(m->m_flags & M_PKTHDR ?
4433 m_get_rcvif_NOMPSAFE(m) : NULL,
4434 sc->sc_src.sa.sa_family);
4435 sc->sc_win = win;
4436 sc->sc_timebase = tcp_now - 1; /* see tcp_newtcpcb() */
4437 sc->sc_timestamp = tb.ts_recent;
4438 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
4439 (TF_REQ_TSTMP|TF_RCVD_TSTMP))
4440 sc->sc_flags |= SCF_TIMESTAMP;
4441 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
4442 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
4443 sc->sc_requested_s_scale = tb.requested_s_scale;
4444 sc->sc_request_r_scale = 0;
4445 /*
4446 * Pick the smallest possible scaling factor that
4447 * will still allow us to scale up to sb_max.
4448 *
4449 * We do this because there are broken firewalls that
4450 * will corrupt the window scale option, leading to
4451 * the other endpoint believing that our advertised
4452 * window is unscaled. At scale factors larger than
4453 * 5 the unscaled window will drop below 1500 bytes,
4454 * leading to serious problems when traversing these
4455 * broken firewalls.
4456 *
4457 * With the default sbmax of 256K, a scale factor
4458 * of 3 will be chosen by this algorithm. Those who
4459 * choose a larger sbmax should watch out
4460 * for the compatiblity problems mentioned above.
4461 *
4462 * RFC1323: The Window field in a SYN (i.e., a <SYN>
4463 * or <SYN,ACK>) segment itself is never scaled.
4464 */
4465 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
4466 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
4467 sc->sc_request_r_scale++;
4468 } else {
4469 sc->sc_requested_s_scale = 15;
4470 sc->sc_request_r_scale = 15;
4471 }
4472 if ((tb.t_flags & TF_SACK_PERMIT) && tcp_do_sack)
4473 sc->sc_flags |= SCF_SACK_PERMIT;
4474
4475 /*
4476 * ECN setup packet recieved.
4477 */
4478 if ((th->th_flags & (TH_ECE|TH_CWR)) && tcp_do_ecn)
4479 sc->sc_flags |= SCF_ECN_PERMIT;
4480
4481 #ifdef TCP_SIGNATURE
4482 if (tb.t_flags & TF_SIGNATURE)
4483 sc->sc_flags |= SCF_SIGNATURE;
4484 #endif
4485 sc->sc_tp = tp;
4486 if (syn_cache_respond(sc, m) == 0) {
4487 uint64_t *tcps = TCP_STAT_GETREF();
4488 tcps[TCP_STAT_SNDACKS]++;
4489 tcps[TCP_STAT_SNDTOTAL]++;
4490 TCP_STAT_PUTREF();
4491 syn_cache_insert(sc, tp);
4492 } else {
4493 s = splsoftnet();
4494 /*
4495 * syn_cache_put() will try to schedule the timer, so
4496 * we need to initialize it
4497 */
4498 SYN_CACHE_TIMER_ARM(sc);
4499 syn_cache_put(sc);
4500 splx(s);
4501 TCP_STATINC(TCP_STAT_SC_DROPPED);
4502 }
4503 return (1);
4504 }
4505
4506 /*
4507 * syn_cache_respond: (re)send SYN+ACK.
4508 *
4509 * returns 0 on success. otherwise returns an errno, typically ENOBUFS.
4510 */
4511
4512 int
syn_cache_respond(struct syn_cache * sc,struct mbuf * m)4513 syn_cache_respond(struct syn_cache *sc, struct mbuf *m)
4514 {
4515 #ifdef INET6
4516 struct rtentry *rt;
4517 #endif
4518 struct route *ro;
4519 u_int8_t *optp;
4520 int optlen, error;
4521 u_int16_t tlen;
4522 struct ip *ip = NULL;
4523 #ifdef INET6
4524 struct ip6_hdr *ip6 = NULL;
4525 #endif
4526 struct tcpcb *tp = NULL;
4527 struct tcphdr *th;
4528 u_int hlen;
4529 struct socket *so;
4530
4531 ro = &sc->sc_route;
4532 switch (sc->sc_src.sa.sa_family) {
4533 case AF_INET:
4534 hlen = sizeof(struct ip);
4535 break;
4536 #ifdef INET6
4537 case AF_INET6:
4538 hlen = sizeof(struct ip6_hdr);
4539 break;
4540 #endif
4541 default:
4542 if (m)
4543 m_freem(m);
4544 return (EAFNOSUPPORT);
4545 }
4546
4547 /* Compute the size of the TCP options. */
4548 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
4549 ((sc->sc_flags & SCF_SACK_PERMIT) ? (TCPOLEN_SACK_PERMITTED + 2) : 0) +
4550 #ifdef TCP_SIGNATURE
4551 ((sc->sc_flags & SCF_SIGNATURE) ? (TCPOLEN_SIGNATURE + 2) : 0) +
4552 #endif
4553 ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
4554
4555 tlen = hlen + sizeof(struct tcphdr) + optlen;
4556
4557 /*
4558 * Create the IP+TCP header from scratch.
4559 */
4560 if (m)
4561 m_freem(m);
4562 #ifdef DIAGNOSTIC
4563 if (max_linkhdr + tlen > MCLBYTES)
4564 return (ENOBUFS);
4565 #endif
4566 MGETHDR(m, M_DONTWAIT, MT_DATA);
4567 if (m && (max_linkhdr + tlen) > MHLEN) {
4568 MCLGET(m, M_DONTWAIT);
4569 if ((m->m_flags & M_EXT) == 0) {
4570 m_freem(m);
4571 m = NULL;
4572 }
4573 }
4574 if (m == NULL)
4575 return (ENOBUFS);
4576 MCLAIM(m, &tcp_tx_mowner);
4577
4578 /* Fixup the mbuf. */
4579 m->m_data += max_linkhdr;
4580 m->m_len = m->m_pkthdr.len = tlen;
4581 if (sc->sc_tp) {
4582 tp = sc->sc_tp;
4583 if (tp->t_inpcb)
4584 so = tp->t_inpcb->inp_socket;
4585 #ifdef INET6
4586 else if (tp->t_in6pcb)
4587 so = tp->t_in6pcb->in6p_socket;
4588 #endif
4589 else
4590 so = NULL;
4591 } else
4592 so = NULL;
4593 m_reset_rcvif(m);
4594 memset(mtod(m, u_char *), 0, tlen);
4595
4596 switch (sc->sc_src.sa.sa_family) {
4597 case AF_INET:
4598 ip = mtod(m, struct ip *);
4599 ip->ip_v = 4;
4600 ip->ip_dst = sc->sc_src.sin.sin_addr;
4601 ip->ip_src = sc->sc_dst.sin.sin_addr;
4602 ip->ip_p = IPPROTO_TCP;
4603 th = (struct tcphdr *)(ip + 1);
4604 th->th_dport = sc->sc_src.sin.sin_port;
4605 th->th_sport = sc->sc_dst.sin.sin_port;
4606 break;
4607 #ifdef INET6
4608 case AF_INET6:
4609 ip6 = mtod(m, struct ip6_hdr *);
4610 ip6->ip6_vfc = IPV6_VERSION;
4611 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
4612 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
4613 ip6->ip6_nxt = IPPROTO_TCP;
4614 /* ip6_plen will be updated in ip6_output() */
4615 th = (struct tcphdr *)(ip6 + 1);
4616 th->th_dport = sc->sc_src.sin6.sin6_port;
4617 th->th_sport = sc->sc_dst.sin6.sin6_port;
4618 break;
4619 #endif
4620 default:
4621 th = NULL;
4622 }
4623
4624 th->th_seq = htonl(sc->sc_iss);
4625 th->th_ack = htonl(sc->sc_irs + 1);
4626 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
4627 th->th_flags = TH_SYN|TH_ACK;
4628 th->th_win = htons(sc->sc_win);
4629 /* th_sum already 0 */
4630 /* th_urp already 0 */
4631
4632 /* Tack on the TCP options. */
4633 optp = (u_int8_t *)(th + 1);
4634 *optp++ = TCPOPT_MAXSEG;
4635 *optp++ = 4;
4636 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
4637 *optp++ = sc->sc_ourmaxseg & 0xff;
4638
4639 if (sc->sc_request_r_scale != 15) {
4640 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
4641 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
4642 sc->sc_request_r_scale);
4643 optp += 4;
4644 }
4645
4646 if (sc->sc_flags & SCF_TIMESTAMP) {
4647 u_int32_t *lp = (u_int32_t *)(optp);
4648 /* Form timestamp option as shown in appendix A of RFC 1323. */
4649 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
4650 *lp++ = htonl(SYN_CACHE_TIMESTAMP(sc));
4651 *lp = htonl(sc->sc_timestamp);
4652 optp += TCPOLEN_TSTAMP_APPA;
4653 }
4654
4655 if (sc->sc_flags & SCF_SACK_PERMIT) {
4656 u_int8_t *p = optp;
4657
4658 /* Let the peer know that we will SACK. */
4659 p[0] = TCPOPT_SACK_PERMITTED;
4660 p[1] = 2;
4661 p[2] = TCPOPT_NOP;
4662 p[3] = TCPOPT_NOP;
4663 optp += 4;
4664 }
4665
4666 /*
4667 * Send ECN SYN-ACK setup packet.
4668 * Routes can be asymetric, so, even if we receive a packet
4669 * with ECE and CWR set, we must not assume no one will block
4670 * the ECE packet we are about to send.
4671 */
4672 if ((sc->sc_flags & SCF_ECN_PERMIT) && tp &&
4673 SEQ_GEQ(tp->snd_nxt, tp->snd_max)) {
4674 th->th_flags |= TH_ECE;
4675 TCP_STATINC(TCP_STAT_ECN_SHS);
4676
4677 /*
4678 * draft-ietf-tcpm-ecnsyn-00.txt
4679 *
4680 * "[...] a TCP node MAY respond to an ECN-setup
4681 * SYN packet by setting ECT in the responding
4682 * ECN-setup SYN/ACK packet, indicating to routers
4683 * that the SYN/ACK packet is ECN-Capable.
4684 * This allows a congested router along the path
4685 * to mark the packet instead of dropping the
4686 * packet as an indication of congestion."
4687 *
4688 * "[...] There can be a great benefit in setting
4689 * an ECN-capable codepoint in SYN/ACK packets [...]
4690 * Congestion is most likely to occur in
4691 * the server-to-client direction. As a result,
4692 * setting an ECN-capable codepoint in SYN/ACK
4693 * packets can reduce the occurence of three-second
4694 * retransmit timeouts resulting from the drop
4695 * of SYN/ACK packets."
4696 *
4697 * Page 4 and 6, January 2006.
4698 */
4699
4700 switch (sc->sc_src.sa.sa_family) {
4701 #ifdef INET
4702 case AF_INET:
4703 ip->ip_tos |= IPTOS_ECN_ECT0;
4704 break;
4705 #endif
4706 #ifdef INET6
4707 case AF_INET6:
4708 ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
4709 break;
4710 #endif
4711 }
4712 TCP_STATINC(TCP_STAT_ECN_ECT);
4713 }
4714
4715 #ifdef TCP_SIGNATURE
4716 if (sc->sc_flags & SCF_SIGNATURE) {
4717 struct secasvar *sav;
4718 u_int8_t *sigp;
4719
4720 sav = tcp_signature_getsav(m, th);
4721
4722 if (sav == NULL) {
4723 if (m)
4724 m_freem(m);
4725 return (EPERM);
4726 }
4727
4728 *optp++ = TCPOPT_SIGNATURE;
4729 *optp++ = TCPOLEN_SIGNATURE;
4730 sigp = optp;
4731 memset(optp, 0, TCP_SIGLEN);
4732 optp += TCP_SIGLEN;
4733 *optp++ = TCPOPT_NOP;
4734 *optp++ = TCPOPT_EOL;
4735
4736 (void)tcp_signature(m, th, hlen, sav, sigp);
4737
4738 key_sa_recordxfer(sav, m);
4739 KEY_FREESAV(&sav);
4740 }
4741 #endif
4742
4743 /* Compute the packet's checksum. */
4744 switch (sc->sc_src.sa.sa_family) {
4745 case AF_INET:
4746 ip->ip_len = htons(tlen - hlen);
4747 th->th_sum = 0;
4748 th->th_sum = in4_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4749 break;
4750 #ifdef INET6
4751 case AF_INET6:
4752 ip6->ip6_plen = htons(tlen - hlen);
4753 th->th_sum = 0;
4754 th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
4755 break;
4756 #endif
4757 }
4758
4759 /*
4760 * Fill in some straggling IP bits. Note the stack expects
4761 * ip_len to be in host order, for convenience.
4762 */
4763 switch (sc->sc_src.sa.sa_family) {
4764 #ifdef INET
4765 case AF_INET:
4766 ip->ip_len = htons(tlen);
4767 ip->ip_ttl = ip_defttl;
4768 /* XXX tos? */
4769 break;
4770 #endif
4771 #ifdef INET6
4772 case AF_INET6:
4773 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
4774 ip6->ip6_vfc |= IPV6_VERSION;
4775 ip6->ip6_plen = htons(tlen - hlen);
4776 /* ip6_hlim will be initialized afterwards */
4777 /* XXX flowlabel? */
4778 break;
4779 #endif
4780 }
4781
4782 /* XXX use IPsec policy on listening socket, on SYN ACK */
4783 tp = sc->sc_tp;
4784
4785 switch (sc->sc_src.sa.sa_family) {
4786 #ifdef INET
4787 case AF_INET:
4788 error = ip_output(m, sc->sc_ipopts, ro,
4789 (ip_mtudisc ? IP_MTUDISC : 0),
4790 NULL, so);
4791 break;
4792 #endif
4793 #ifdef INET6
4794 case AF_INET6:
4795 ip6->ip6_hlim = in6_selecthlim(NULL,
4796 (rt = rtcache_validate(ro)) != NULL ? rt->rt_ifp : NULL);
4797
4798 error = ip6_output(m, NULL /*XXX*/, ro, 0, NULL, so, NULL);
4799 break;
4800 #endif
4801 default:
4802 error = EAFNOSUPPORT;
4803 break;
4804 }
4805 return (error);
4806 }
4807