1 /* $OpenBSD: tcp_input.c,v 1.406 2024/06/07 08:02:17 jsg Exp $ */
2 /* $NetBSD: tcp_input.c,v 1.23 1996/02/13 23:43:44 christos Exp $ */
3
4 /*
5 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994
6 * The Regents of the University of California. All rights reserved.
7 *
8 * Redistribution and use in source and binary forms, with or without
9 * modification, are permitted provided that the following conditions
10 * are met:
11 * 1. Redistributions of source code must retain the above copyright
12 * notice, this list of conditions and the following disclaimer.
13 * 2. Redistributions in binary form must reproduce the above copyright
14 * notice, this list of conditions and the following disclaimer in the
15 * documentation and/or other materials provided with the distribution.
16 * 3. Neither the name of the University nor the names of its contributors
17 * may be used to endorse or promote products derived from this software
18 * without specific prior written permission.
19 *
20 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
21 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
22 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
23 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
24 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
25 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
26 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
27 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
28 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
29 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
30 * SUCH DAMAGE.
31 *
32 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
33 *
34 * NRL grants permission for redistribution and use in source and binary
35 * forms, with or without modification, of the software and documentation
36 * created at NRL provided that the following conditions are met:
37 *
38 * 1. Redistributions of source code must retain the above copyright
39 * notice, this list of conditions and the following disclaimer.
40 * 2. Redistributions in binary form must reproduce the above copyright
41 * notice, this list of conditions and the following disclaimer in the
42 * documentation and/or other materials provided with the distribution.
43 * 3. All advertising materials mentioning features or use of this software
44 * must display the following acknowledgements:
45 * This product includes software developed by the University of
46 * California, Berkeley and its contributors.
47 * This product includes software developed at the Information
48 * Technology Division, US Naval Research Laboratory.
49 * 4. Neither the name of the NRL nor the names of its contributors
50 * may be used to endorse or promote products derived from this software
51 * without specific prior written permission.
52 *
53 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
54 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
55 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
56 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
57 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
58 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
59 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
60 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
61 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
62 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
63 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
64 *
65 * The views and conclusions contained in the software and documentation
66 * are those of the authors and should not be interpreted as representing
67 * official policies, either expressed or implied, of the US Naval
68 * Research Laboratory (NRL).
69 */
70
71 #include "pf.h"
72
73 #include <sys/param.h>
74 #include <sys/systm.h>
75 #include <sys/mbuf.h>
76 #include <sys/protosw.h>
77 #include <sys/socket.h>
78 #include <sys/socketvar.h>
79 #include <sys/timeout.h>
80 #include <sys/kernel.h>
81 #include <sys/pool.h>
82
83 #include <net/if.h>
84 #include <net/if_var.h>
85 #include <net/route.h>
86
87 #include <netinet/in.h>
88 #include <netinet/ip.h>
89 #include <netinet/in_pcb.h>
90 #include <netinet/ip_var.h>
91 #include <netinet6/ip6_var.h>
92 #include <netinet/tcp.h>
93 #include <netinet/tcp_fsm.h>
94 #include <netinet/tcp_seq.h>
95 #include <netinet/tcp_timer.h>
96 #include <netinet/tcp_var.h>
97 #include <netinet/tcp_debug.h>
98
99 #if NPF > 0
100 #include <net/pfvar.h>
101 #endif
102
103 int tcp_mss_adv(struct mbuf *, int);
104 int tcp_flush_queue(struct tcpcb *);
105
106 #ifdef INET6
107 #include <netinet6/in6_var.h>
108 #include <netinet6/nd6.h>
109 #endif /* INET6 */
110
111 int tcprexmtthresh = 3;
112 int tcptv_keep_init = TCPTV_KEEP_INIT;
113
114 int tcp_rst_ppslim = 100; /* 100pps */
115 int tcp_rst_ppslim_count = 0;
116 struct timeval tcp_rst_ppslim_last;
117
118 int tcp_ackdrop_ppslim = 100; /* 100pps */
119 int tcp_ackdrop_ppslim_count = 0;
120 struct timeval tcp_ackdrop_ppslim_last;
121
122 #define TCP_PAWS_IDLE TCP_TIME(24 * 24 * 60 * 60)
123
124 /* for modulo comparisons of timestamps */
125 #define TSTMP_LT(a,b) ((int32_t)((a)-(b)) < 0)
126 #define TSTMP_GEQ(a,b) ((int32_t)((a)-(b)) >= 0)
127
128 /* for TCP SACK comparisons */
129 #define SEQ_MIN(a,b) (SEQ_LT(a,b) ? (a) : (b))
130 #define SEQ_MAX(a,b) (SEQ_GT(a,b) ? (a) : (b))
131
132 /*
133 * Neighbor Discovery, Neighbor Unreachability Detection Upper layer hint.
134 */
135 #ifdef INET6
136 #define ND6_HINT(tp) \
137 do { \
138 if (tp && tp->t_inpcb && \
139 ISSET(tp->t_inpcb->inp_flags, INP_IPV6) && \
140 rtisvalid(tp->t_inpcb->inp_route.ro_rt)) { \
141 nd6_nud_hint(tp->t_inpcb->inp_route.ro_rt); \
142 } \
143 } while (0)
144 #else
145 #define ND6_HINT(tp)
146 #endif
147
148 #ifdef TCP_ECN
149 /*
150 * ECN (Explicit Congestion Notification) support based on RFC3168
151 * implementation note:
152 * snd_last is used to track a recovery phase.
153 * when cwnd is reduced, snd_last is set to snd_max.
154 * while snd_last > snd_una, the sender is in a recovery phase and
155 * its cwnd should not be reduced again.
156 * snd_last follows snd_una when not in a recovery phase.
157 */
158 #endif
159
160 /*
161 * Macro to compute ACK transmission behavior. Delay the ACK unless
162 * we have already delayed an ACK (must send an ACK every two segments).
163 * We also ACK immediately if we received a PUSH and the ACK-on-PUSH
164 * option is enabled or when the packet is coming from a loopback
165 * interface.
166 */
167 #define TCP_SETUP_ACK(tp, tiflags, m) \
168 do { \
169 struct ifnet *ifp = NULL; \
170 if (m && (m->m_flags & M_PKTHDR)) \
171 ifp = if_get(m->m_pkthdr.ph_ifidx); \
172 if (TCP_TIMER_ISARMED(tp, TCPT_DELACK) || \
173 (tcp_ack_on_push && (tiflags) & TH_PUSH) || \
174 (ifp && (ifp->if_flags & IFF_LOOPBACK))) \
175 tp->t_flags |= TF_ACKNOW; \
176 else \
177 TCP_TIMER_ARM(tp, TCPT_DELACK, tcp_delack_msecs); \
178 if_put(ifp); \
179 } while (0)
180
181 void tcp_sack_partialack(struct tcpcb *, struct tcphdr *);
182 void tcp_newreno_partialack(struct tcpcb *, struct tcphdr *);
183
184 void syn_cache_put(struct syn_cache *);
185 void syn_cache_rm(struct syn_cache *);
186 int syn_cache_respond(struct syn_cache *, struct mbuf *, uint64_t);
187 void syn_cache_timer(void *);
188 void syn_cache_insert(struct syn_cache *, struct tcpcb *);
189 void syn_cache_reset(struct sockaddr *, struct sockaddr *,
190 struct tcphdr *, u_int);
191 int syn_cache_add(struct sockaddr *, struct sockaddr *, struct tcphdr *,
192 unsigned int, struct socket *, struct mbuf *, u_char *, int,
193 struct tcp_opt_info *, tcp_seq *, uint64_t);
194 struct socket *syn_cache_get(struct sockaddr *, struct sockaddr *,
195 struct tcphdr *, unsigned int, unsigned int, struct socket *,
196 struct mbuf *, uint64_t);
197 struct syn_cache *syn_cache_lookup(const struct sockaddr *,
198 const struct sockaddr *, struct syn_cache_head **, u_int);
199
200 /*
201 * Insert segment ti into reassembly queue of tcp with
202 * control block tp. Return TH_FIN if reassembly now includes
203 * a segment with FIN. The macro form does the common case inline
204 * (segment is the next to be received on an established connection,
205 * and the queue is empty), avoiding linkage into and removal
206 * from the queue and repetition of various conversions.
207 * Set DELACK for segments received in order, but ack immediately
208 * when segments are out of order (so fast retransmit can work).
209 */
210
211 int
tcp_reass(struct tcpcb * tp,struct tcphdr * th,struct mbuf * m,int * tlen)212 tcp_reass(struct tcpcb *tp, struct tcphdr *th, struct mbuf *m, int *tlen)
213 {
214 struct tcpqent *p, *q, *nq, *tiqe;
215
216 /*
217 * Allocate a new queue entry, before we throw away any data.
218 * If we can't, just drop the packet. XXX
219 */
220 tiqe = pool_get(&tcpqe_pool, PR_NOWAIT);
221 if (tiqe == NULL) {
222 tiqe = TAILQ_LAST(&tp->t_segq, tcpqehead);
223 if (tiqe != NULL && th->th_seq == tp->rcv_nxt) {
224 /* Reuse last entry since new segment fills a hole */
225 m_freem(tiqe->tcpqe_m);
226 TAILQ_REMOVE(&tp->t_segq, tiqe, tcpqe_q);
227 }
228 if (tiqe == NULL || th->th_seq != tp->rcv_nxt) {
229 /* Flush segment queue for this connection */
230 tcp_freeq(tp);
231 tcpstat_inc(tcps_rcvmemdrop);
232 m_freem(m);
233 return (0);
234 }
235 }
236
237 /*
238 * Find a segment which begins after this one does.
239 */
240 for (p = NULL, q = TAILQ_FIRST(&tp->t_segq); q != NULL;
241 p = q, q = TAILQ_NEXT(q, tcpqe_q))
242 if (SEQ_GT(q->tcpqe_tcp->th_seq, th->th_seq))
243 break;
244
245 /*
246 * If there is a preceding segment, it may provide some of
247 * our data already. If so, drop the data from the incoming
248 * segment. If it provides all of our data, drop us.
249 */
250 if (p != NULL) {
251 struct tcphdr *phdr = p->tcpqe_tcp;
252 int i;
253
254 /* conversion to int (in i) handles seq wraparound */
255 i = phdr->th_seq + phdr->th_reseqlen - th->th_seq;
256 if (i > 0) {
257 if (i >= *tlen) {
258 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte,
259 *tlen);
260 m_freem(m);
261 pool_put(&tcpqe_pool, tiqe);
262 return (0);
263 }
264 m_adj(m, i);
265 *tlen -= i;
266 th->th_seq += i;
267 }
268 }
269 tcpstat_pkt(tcps_rcvoopack, tcps_rcvoobyte, *tlen);
270 tp->t_rcvoopack++;
271
272 /*
273 * While we overlap succeeding segments trim them or,
274 * if they are completely covered, dequeue them.
275 */
276 for (; q != NULL; q = nq) {
277 struct tcphdr *qhdr = q->tcpqe_tcp;
278 int i = (th->th_seq + *tlen) - qhdr->th_seq;
279
280 if (i <= 0)
281 break;
282 if (i < qhdr->th_reseqlen) {
283 qhdr->th_seq += i;
284 qhdr->th_reseqlen -= i;
285 m_adj(q->tcpqe_m, i);
286 break;
287 }
288 nq = TAILQ_NEXT(q, tcpqe_q);
289 m_freem(q->tcpqe_m);
290 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q);
291 pool_put(&tcpqe_pool, q);
292 }
293
294 /* Insert the new segment queue entry into place. */
295 tiqe->tcpqe_m = m;
296 th->th_reseqlen = *tlen;
297 tiqe->tcpqe_tcp = th;
298 if (p == NULL) {
299 TAILQ_INSERT_HEAD(&tp->t_segq, tiqe, tcpqe_q);
300 } else {
301 TAILQ_INSERT_AFTER(&tp->t_segq, p, tiqe, tcpqe_q);
302 }
303
304 if (th->th_seq != tp->rcv_nxt)
305 return (0);
306
307 return (tcp_flush_queue(tp));
308 }
309
310 int
tcp_flush_queue(struct tcpcb * tp)311 tcp_flush_queue(struct tcpcb *tp)
312 {
313 struct socket *so = tp->t_inpcb->inp_socket;
314 struct tcpqent *q, *nq;
315 int flags;
316
317 /*
318 * Present data to user, advancing rcv_nxt through
319 * completed sequence space.
320 */
321 if (TCPS_HAVEESTABLISHED(tp->t_state) == 0)
322 return (0);
323 q = TAILQ_FIRST(&tp->t_segq);
324 if (q == NULL || q->tcpqe_tcp->th_seq != tp->rcv_nxt)
325 return (0);
326 if (tp->t_state == TCPS_SYN_RECEIVED && q->tcpqe_tcp->th_reseqlen)
327 return (0);
328 do {
329 tp->rcv_nxt += q->tcpqe_tcp->th_reseqlen;
330 flags = q->tcpqe_tcp->th_flags & TH_FIN;
331
332 nq = TAILQ_NEXT(q, tcpqe_q);
333 TAILQ_REMOVE(&tp->t_segq, q, tcpqe_q);
334 ND6_HINT(tp);
335 if (so->so_rcv.sb_state & SS_CANTRCVMORE)
336 m_freem(q->tcpqe_m);
337 else
338 sbappendstream(so, &so->so_rcv, q->tcpqe_m);
339 pool_put(&tcpqe_pool, q);
340 q = nq;
341 } while (q != NULL && q->tcpqe_tcp->th_seq == tp->rcv_nxt);
342 tp->t_flags |= TF_BLOCKOUTPUT;
343 sorwakeup(so);
344 tp->t_flags &= ~TF_BLOCKOUTPUT;
345 return (flags);
346 }
347
348 /*
349 * TCP input routine, follows pages 65-76 of the
350 * protocol specification dated September, 1981 very closely.
351 */
352 int
tcp_input(struct mbuf ** mp,int * offp,int proto,int af)353 tcp_input(struct mbuf **mp, int *offp, int proto, int af)
354 {
355 struct mbuf *m = *mp;
356 int iphlen = *offp;
357 struct ip *ip = NULL;
358 struct inpcb *inp = NULL;
359 u_int8_t *optp = NULL;
360 int optlen = 0;
361 int tlen, off;
362 struct tcpcb *otp = NULL, *tp = NULL;
363 int tiflags;
364 struct socket *so = NULL;
365 int todrop, acked, ourfinisacked;
366 int hdroptlen = 0;
367 short ostate;
368 union {
369 struct tcpiphdr tcpip;
370 #ifdef INET6
371 struct tcpipv6hdr tcpip6;
372 #endif
373 char caddr;
374 } saveti;
375 tcp_seq iss, *reuse = NULL;
376 uint64_t now;
377 u_long tiwin;
378 struct tcp_opt_info opti;
379 struct tcphdr *th;
380 #ifdef INET6
381 struct ip6_hdr *ip6 = NULL;
382 #endif /* INET6 */
383 #ifdef TCP_ECN
384 u_char iptos;
385 #endif
386
387 tcpstat_inc(tcps_rcvtotal);
388
389 opti.ts_present = 0;
390 opti.maxseg = 0;
391 now = tcp_now();
392
393 /*
394 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
395 */
396 if (m->m_flags & (M_BCAST|M_MCAST))
397 goto drop;
398
399 /*
400 * Get IP and TCP header together in first mbuf.
401 * Note: IP leaves IP header in first mbuf.
402 */
403 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, sizeof(*th));
404 if (!th) {
405 tcpstat_inc(tcps_rcvshort);
406 return IPPROTO_DONE;
407 }
408
409 tlen = m->m_pkthdr.len - iphlen;
410 switch (af) {
411 case AF_INET:
412 ip = mtod(m, struct ip *);
413 #ifdef TCP_ECN
414 /* save ip_tos before clearing it for checksum */
415 iptos = ip->ip_tos;
416 #endif
417 break;
418 #ifdef INET6
419 case AF_INET6:
420 ip6 = mtod(m, struct ip6_hdr *);
421 #ifdef TCP_ECN
422 iptos = (ntohl(ip6->ip6_flow) >> 20) & 0xff;
423 #endif
424
425 /*
426 * Be proactive about unspecified IPv6 address in source.
427 * As we use all-zero to indicate unbounded/unconnected pcb,
428 * unspecified IPv6 address can be used to confuse us.
429 *
430 * Note that packets with unspecified IPv6 destination is
431 * already dropped in ip6_input.
432 */
433 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
434 /* XXX stat */
435 goto drop;
436 }
437
438 /* Discard packets to multicast */
439 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst)) {
440 /* XXX stat */
441 goto drop;
442 }
443 break;
444 #endif
445 default:
446 unhandled_af(af);
447 }
448
449 /*
450 * Checksum extended TCP header and data.
451 */
452 if ((m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_OK) == 0) {
453 int sum;
454
455 if (m->m_pkthdr.csum_flags & M_TCP_CSUM_IN_BAD) {
456 tcpstat_inc(tcps_rcvbadsum);
457 goto drop;
458 }
459 tcpstat_inc(tcps_inswcsum);
460 switch (af) {
461 case AF_INET:
462 sum = in4_cksum(m, IPPROTO_TCP, iphlen, tlen);
463 break;
464 #ifdef INET6
465 case AF_INET6:
466 sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
467 tlen);
468 break;
469 #endif
470 }
471 if (sum != 0) {
472 tcpstat_inc(tcps_rcvbadsum);
473 goto drop;
474 }
475 }
476
477 /*
478 * Check that TCP offset makes sense,
479 * pull out TCP options and adjust length. XXX
480 */
481 off = th->th_off << 2;
482 if (off < sizeof(struct tcphdr) || off > tlen) {
483 tcpstat_inc(tcps_rcvbadoff);
484 goto drop;
485 }
486 tlen -= off;
487 if (off > sizeof(struct tcphdr)) {
488 IP6_EXTHDR_GET(th, struct tcphdr *, m, iphlen, off);
489 if (!th) {
490 tcpstat_inc(tcps_rcvshort);
491 return IPPROTO_DONE;
492 }
493 optlen = off - sizeof(struct tcphdr);
494 optp = (u_int8_t *)(th + 1);
495 /*
496 * Do quick retrieval of timestamp options ("options
497 * prediction?"). If timestamp is the only option and it's
498 * formatted as recommended in RFC 1323 appendix A, we
499 * quickly get the values now and not bother calling
500 * tcp_dooptions(), etc.
501 */
502 if ((optlen == TCPOLEN_TSTAMP_APPA ||
503 (optlen > TCPOLEN_TSTAMP_APPA &&
504 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
505 *(u_int32_t *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
506 (th->th_flags & TH_SYN) == 0) {
507 opti.ts_present = 1;
508 opti.ts_val = ntohl(*(u_int32_t *)(optp + 4));
509 opti.ts_ecr = ntohl(*(u_int32_t *)(optp + 8));
510 optp = NULL; /* we've parsed the options */
511 }
512 }
513 tiflags = th->th_flags;
514
515 /*
516 * Convert TCP protocol specific fields to host format.
517 */
518 th->th_seq = ntohl(th->th_seq);
519 th->th_ack = ntohl(th->th_ack);
520 th->th_win = ntohs(th->th_win);
521 th->th_urp = ntohs(th->th_urp);
522
523 if (th->th_dport == 0) {
524 tcpstat_inc(tcps_noport);
525 goto dropwithreset_ratelim;
526 }
527
528 /*
529 * Locate pcb for segment.
530 */
531 #if NPF > 0
532 inp = pf_inp_lookup(m);
533 #endif
534 findpcb:
535 if (inp == NULL) {
536 switch (af) {
537 #ifdef INET6
538 case AF_INET6:
539 inp = in6_pcblookup(&tcb6table, &ip6->ip6_src,
540 th->th_sport, &ip6->ip6_dst, th->th_dport,
541 m->m_pkthdr.ph_rtableid);
542 break;
543 #endif
544 case AF_INET:
545 inp = in_pcblookup(&tcbtable, ip->ip_src,
546 th->th_sport, ip->ip_dst, th->th_dport,
547 m->m_pkthdr.ph_rtableid);
548 break;
549 }
550 }
551 if (inp == NULL) {
552 tcpstat_inc(tcps_pcbhashmiss);
553 switch (af) {
554 #ifdef INET6
555 case AF_INET6:
556 inp = in6_pcblookup_listen(&tcb6table, &ip6->ip6_dst,
557 th->th_dport, m, m->m_pkthdr.ph_rtableid);
558 break;
559 #endif
560 case AF_INET:
561 inp = in_pcblookup_listen(&tcbtable, ip->ip_dst,
562 th->th_dport, m, m->m_pkthdr.ph_rtableid);
563 break;
564 }
565 /*
566 * If the state is CLOSED (i.e., TCB does not exist) then
567 * all data in the incoming segment is discarded.
568 * If the TCB exists but is in CLOSED state, it is embryonic,
569 * but should either do a listen or a connect soon.
570 */
571 }
572 #ifdef IPSEC
573 if (ipsec_in_use) {
574 struct m_tag *mtag;
575 struct tdb *tdb = NULL;
576 int error;
577
578 /* Find most recent IPsec tag */
579 mtag = m_tag_find(m, PACKET_TAG_IPSEC_IN_DONE, NULL);
580 if (mtag != NULL) {
581 struct tdb_ident *tdbi;
582
583 tdbi = (struct tdb_ident *)(mtag + 1);
584 tdb = gettdb(tdbi->rdomain, tdbi->spi,
585 &tdbi->dst, tdbi->proto);
586 }
587 error = ipsp_spd_lookup(m, af, iphlen, IPSP_DIRECTION_IN,
588 tdb, inp ? &inp->inp_seclevel : NULL, NULL, NULL);
589 tdb_unref(tdb);
590 if (error) {
591 tcpstat_inc(tcps_rcvnosec);
592 goto drop;
593 }
594 }
595 #endif /* IPSEC */
596
597 if (inp == NULL) {
598 tcpstat_inc(tcps_noport);
599 goto dropwithreset_ratelim;
600 }
601
602 KASSERT(sotoinpcb(inp->inp_socket) == inp);
603 KASSERT(intotcpcb(inp) == NULL || intotcpcb(inp)->t_inpcb == inp);
604 soassertlocked(inp->inp_socket);
605
606 /* Check the minimum TTL for socket. */
607 switch (af) {
608 case AF_INET:
609 if (inp->inp_ip_minttl && inp->inp_ip_minttl > ip->ip_ttl)
610 goto drop;
611 break;
612 #ifdef INET6
613 case AF_INET6:
614 if (inp->inp_ip6_minhlim &&
615 inp->inp_ip6_minhlim > ip6->ip6_hlim)
616 goto drop;
617 break;
618 #endif
619 }
620
621 tp = intotcpcb(inp);
622 if (tp == NULL)
623 goto dropwithreset_ratelim;
624 if (tp->t_state == TCPS_CLOSED)
625 goto drop;
626
627 /* Unscale the window into a 32-bit value. */
628 if ((tiflags & TH_SYN) == 0)
629 tiwin = th->th_win << tp->snd_scale;
630 else
631 tiwin = th->th_win;
632
633 so = inp->inp_socket;
634 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
635 union syn_cache_sa src;
636 union syn_cache_sa dst;
637
638 bzero(&src, sizeof(src));
639 bzero(&dst, sizeof(dst));
640 switch (af) {
641 case AF_INET:
642 src.sin.sin_len = sizeof(struct sockaddr_in);
643 src.sin.sin_family = AF_INET;
644 src.sin.sin_addr = ip->ip_src;
645 src.sin.sin_port = th->th_sport;
646
647 dst.sin.sin_len = sizeof(struct sockaddr_in);
648 dst.sin.sin_family = AF_INET;
649 dst.sin.sin_addr = ip->ip_dst;
650 dst.sin.sin_port = th->th_dport;
651 break;
652 #ifdef INET6
653 case AF_INET6:
654 src.sin6.sin6_len = sizeof(struct sockaddr_in6);
655 src.sin6.sin6_family = AF_INET6;
656 src.sin6.sin6_addr = ip6->ip6_src;
657 src.sin6.sin6_port = th->th_sport;
658
659 dst.sin6.sin6_len = sizeof(struct sockaddr_in6);
660 dst.sin6.sin6_family = AF_INET6;
661 dst.sin6.sin6_addr = ip6->ip6_dst;
662 dst.sin6.sin6_port = th->th_dport;
663 break;
664 #endif /* INET6 */
665 }
666
667 if (so->so_options & SO_DEBUG) {
668 otp = tp;
669 ostate = tp->t_state;
670 switch (af) {
671 #ifdef INET6
672 case AF_INET6:
673 saveti.tcpip6.ti6_i = *ip6;
674 saveti.tcpip6.ti6_t = *th;
675 break;
676 #endif
677 case AF_INET:
678 memcpy(&saveti.tcpip.ti_i, ip, sizeof(*ip));
679 saveti.tcpip.ti_t = *th;
680 break;
681 }
682 }
683 if (so->so_options & SO_ACCEPTCONN) {
684 switch (tiflags & (TH_RST|TH_SYN|TH_ACK)) {
685
686 case TH_SYN|TH_ACK|TH_RST:
687 case TH_SYN|TH_RST:
688 case TH_ACK|TH_RST:
689 case TH_RST:
690 syn_cache_reset(&src.sa, &dst.sa, th,
691 inp->inp_rtableid);
692 goto drop;
693
694 case TH_SYN|TH_ACK:
695 /*
696 * Received a SYN,ACK. This should
697 * never happen while we are in
698 * LISTEN. Send an RST.
699 */
700 goto badsyn;
701
702 case TH_ACK:
703 so = syn_cache_get(&src.sa, &dst.sa,
704 th, iphlen, tlen, so, m, now);
705 if (so == NULL) {
706 /*
707 * We don't have a SYN for
708 * this ACK; send an RST.
709 */
710 goto badsyn;
711 } else if (so == (struct socket *)(-1)) {
712 /*
713 * We were unable to create
714 * the connection. If the
715 * 3-way handshake was
716 * completed, and RST has
717 * been sent to the peer.
718 * Since the mbuf might be
719 * in use for the reply,
720 * do not free it.
721 */
722 m = *mp = NULL;
723 goto drop;
724 } else {
725 /*
726 * We have created a
727 * full-blown connection.
728 */
729 tp = NULL;
730 in_pcbunref(inp);
731 inp = in_pcbref(sotoinpcb(so));
732 tp = intotcpcb(inp);
733 if (tp == NULL)
734 goto badsyn; /*XXX*/
735
736 }
737 break;
738
739 default:
740 /*
741 * None of RST, SYN or ACK was set.
742 * This is an invalid packet for a
743 * TCB in LISTEN state. Send a RST.
744 */
745 goto badsyn;
746
747 case TH_SYN:
748 /*
749 * Received a SYN.
750 */
751 #ifdef INET6
752 /*
753 * If deprecated address is forbidden, we do
754 * not accept SYN to deprecated interface
755 * address to prevent any new inbound
756 * connection from getting established.
757 * When we do not accept SYN, we send a TCP
758 * RST, with deprecated source address (instead
759 * of dropping it). We compromise it as it is
760 * much better for peer to send a RST, and
761 * RST will be the final packet for the
762 * exchange.
763 *
764 * If we do not forbid deprecated addresses, we
765 * accept the SYN packet. RFC2462 does not
766 * suggest dropping SYN in this case.
767 * If we decipher RFC2462 5.5.4, it says like
768 * this:
769 * 1. use of deprecated addr with existing
770 * communication is okay - "SHOULD continue
771 * to be used"
772 * 2. use of it with new communication:
773 * (2a) "SHOULD NOT be used if alternate
774 * address with sufficient scope is
775 * available"
776 * (2b) nothing mentioned otherwise.
777 * Here we fall into (2b) case as we have no
778 * choice in our source address selection - we
779 * must obey the peer.
780 *
781 * The wording in RFC2462 is confusing, and
782 * there are multiple description text for
783 * deprecated address handling - worse, they
784 * are not exactly the same. I believe 5.5.4
785 * is the best one, so we follow 5.5.4.
786 */
787 if (ip6 && !ip6_use_deprecated) {
788 struct in6_ifaddr *ia6;
789 struct ifnet *ifp =
790 if_get(m->m_pkthdr.ph_ifidx);
791
792 if (ifp &&
793 (ia6 = in6ifa_ifpwithaddr(ifp,
794 &ip6->ip6_dst)) &&
795 (ia6->ia6_flags &
796 IN6_IFF_DEPRECATED)) {
797 tp = NULL;
798 if_put(ifp);
799 goto dropwithreset;
800 }
801 if_put(ifp);
802 }
803 #endif
804
805 /*
806 * LISTEN socket received a SYN
807 * from itself? This can't possibly
808 * be valid; drop the packet.
809 */
810 if (th->th_dport == th->th_sport) {
811 switch (af) {
812 #ifdef INET6
813 case AF_INET6:
814 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_src,
815 &ip6->ip6_dst)) {
816 tcpstat_inc(tcps_badsyn);
817 goto drop;
818 }
819 break;
820 #endif /* INET6 */
821 case AF_INET:
822 if (ip->ip_dst.s_addr == ip->ip_src.s_addr) {
823 tcpstat_inc(tcps_badsyn);
824 goto drop;
825 }
826 break;
827 }
828 }
829
830 /*
831 * SYN looks ok; create compressed TCP
832 * state for it.
833 */
834 if (so->so_qlen > so->so_qlimit ||
835 syn_cache_add(&src.sa, &dst.sa, th, iphlen,
836 so, m, optp, optlen, &opti, reuse, now)
837 == -1) {
838 tcpstat_inc(tcps_dropsyn);
839 goto drop;
840 }
841 in_pcbunref(inp);
842 return IPPROTO_DONE;
843 }
844 }
845 }
846
847 #ifdef DIAGNOSTIC
848 /*
849 * Should not happen now that all embryonic connections
850 * are handled with compressed state.
851 */
852 if (tp->t_state == TCPS_LISTEN)
853 panic("tcp_input: TCPS_LISTEN");
854 #endif
855
856 #if NPF > 0
857 pf_inp_link(m, inp);
858 #endif
859
860 /*
861 * Segment received on connection.
862 * Reset idle time and keep-alive timer.
863 */
864 tp->t_rcvtime = now;
865 if (TCPS_HAVEESTABLISHED(tp->t_state))
866 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle);
867
868 if (tp->sack_enable)
869 tcp_del_sackholes(tp, th); /* Delete stale SACK holes */
870
871 /*
872 * Process options.
873 */
874 #ifdef TCP_SIGNATURE
875 if (optp || (tp->t_flags & TF_SIGNATURE))
876 #else
877 if (optp)
878 #endif
879 if (tcp_dooptions(tp, optp, optlen, th, m, iphlen, &opti,
880 m->m_pkthdr.ph_rtableid, now))
881 goto drop;
882
883 if (opti.ts_present && opti.ts_ecr) {
884 int32_t rtt_test;
885
886 /* subtract out the tcp timestamp modulator */
887 opti.ts_ecr -= tp->ts_modulate;
888
889 /* make sure ts_ecr is sensible */
890 rtt_test = now - opti.ts_ecr;
891 if (rtt_test < 0 || rtt_test > TCP_RTT_MAX)
892 opti.ts_ecr = 0;
893 }
894
895 #ifdef TCP_ECN
896 /* if congestion experienced, set ECE bit in subsequent packets. */
897 if ((iptos & IPTOS_ECN_MASK) == IPTOS_ECN_CE) {
898 tp->t_flags |= TF_RCVD_CE;
899 tcpstat_inc(tcps_ecn_rcvce);
900 }
901 #endif
902 /*
903 * Header prediction: check for the two common cases
904 * of a uni-directional data xfer. If the packet has
905 * no control flags, is in-sequence, the window didn't
906 * change and we're not retransmitting, it's a
907 * candidate. If the length is zero and the ack moved
908 * forward, we're the sender side of the xfer. Just
909 * free the data acked & wake any higher level process
910 * that was blocked waiting for space. If the length
911 * is non-zero and the ack didn't move, we're the
912 * receiver side. If we're getting packets in-order
913 * (the reassembly queue is empty), add the data to
914 * the socket buffer and note that we need a delayed ack.
915 */
916 if (tp->t_state == TCPS_ESTABLISHED &&
917 #ifdef TCP_ECN
918 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ECE|TH_CWR|TH_ACK)) == TH_ACK &&
919 #else
920 (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
921 #endif
922 (!opti.ts_present || TSTMP_GEQ(opti.ts_val, tp->ts_recent)) &&
923 th->th_seq == tp->rcv_nxt &&
924 tiwin && tiwin == tp->snd_wnd &&
925 tp->snd_nxt == tp->snd_max) {
926
927 /*
928 * If last ACK falls within this segment's sequence numbers,
929 * record the timestamp.
930 * Fix from Braden, see Stevens p. 870
931 */
932 if (opti.ts_present && SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
933 tp->ts_recent_age = now;
934 tp->ts_recent = opti.ts_val;
935 }
936
937 if (tlen == 0) {
938 if (SEQ_GT(th->th_ack, tp->snd_una) &&
939 SEQ_LEQ(th->th_ack, tp->snd_max) &&
940 tp->snd_cwnd >= tp->snd_wnd &&
941 tp->t_dupacks == 0) {
942 /*
943 * this is a pure ack for outstanding data.
944 */
945 tcpstat_inc(tcps_predack);
946 if (opti.ts_present && opti.ts_ecr)
947 tcp_xmit_timer(tp, now - opti.ts_ecr);
948 else if (tp->t_rtttime &&
949 SEQ_GT(th->th_ack, tp->t_rtseq))
950 tcp_xmit_timer(tp, now - tp->t_rtttime);
951 acked = th->th_ack - tp->snd_una;
952 tcpstat_pkt(tcps_rcvackpack, tcps_rcvackbyte,
953 acked);
954 tp->t_rcvacktime = now;
955 ND6_HINT(tp);
956 sbdrop(so, &so->so_snd, acked);
957
958 /*
959 * If we had a pending ICMP message that
960 * refers to data that have just been
961 * acknowledged, disregard the recorded ICMP
962 * message.
963 */
964 if ((tp->t_flags & TF_PMTUD_PEND) &&
965 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
966 tp->t_flags &= ~TF_PMTUD_PEND;
967
968 /*
969 * Keep track of the largest chunk of data
970 * acknowledged since last PMTU update
971 */
972 if (tp->t_pmtud_mss_acked < acked)
973 tp->t_pmtud_mss_acked = acked;
974
975 tp->snd_una = th->th_ack;
976 /* Pull snd_wl2 up to prevent seq wrap. */
977 tp->snd_wl2 = th->th_ack;
978 /*
979 * We want snd_last to track snd_una so
980 * as to avoid sequence wraparound problems
981 * for very large transfers.
982 */
983 #ifdef TCP_ECN
984 if (SEQ_GT(tp->snd_una, tp->snd_last))
985 #endif
986 tp->snd_last = tp->snd_una;
987 m_freem(m);
988
989 /*
990 * If all outstanding data are acked, stop
991 * retransmit timer, otherwise restart timer
992 * using current (possibly backed-off) value.
993 * If process is waiting for space,
994 * wakeup/selwakeup/signal. If data
995 * are ready to send, let tcp_output
996 * decide between more output or persist.
997 */
998 if (tp->snd_una == tp->snd_max)
999 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1000 else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
1001 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1002
1003 tcp_update_sndspace(tp);
1004 if (sb_notify(so, &so->so_snd)) {
1005 tp->t_flags |= TF_BLOCKOUTPUT;
1006 sowwakeup(so);
1007 tp->t_flags &= ~TF_BLOCKOUTPUT;
1008 }
1009 if (so->so_snd.sb_cc ||
1010 tp->t_flags & TF_NEEDOUTPUT)
1011 (void) tcp_output(tp);
1012 in_pcbunref(inp);
1013 return IPPROTO_DONE;
1014 }
1015 } else if (th->th_ack == tp->snd_una &&
1016 TAILQ_EMPTY(&tp->t_segq) &&
1017 tlen <= sbspace(so, &so->so_rcv)) {
1018 /*
1019 * This is a pure, in-sequence data packet
1020 * with nothing on the reassembly queue and
1021 * we have enough buffer space to take it.
1022 */
1023 /* Clean receiver SACK report if present */
1024 if (tp->sack_enable && tp->rcv_numsacks)
1025 tcp_clean_sackreport(tp);
1026 tcpstat_inc(tcps_preddat);
1027 tp->rcv_nxt += tlen;
1028 /* Pull snd_wl1 and rcv_up up to prevent seq wrap. */
1029 tp->snd_wl1 = th->th_seq;
1030 /* Packet has most recent segment, no urgent exists. */
1031 tp->rcv_up = tp->rcv_nxt;
1032 tcpstat_pkt(tcps_rcvpack, tcps_rcvbyte, tlen);
1033 ND6_HINT(tp);
1034
1035 TCP_SETUP_ACK(tp, tiflags, m);
1036 /*
1037 * Drop TCP, IP headers and TCP options then add data
1038 * to socket buffer.
1039 */
1040 if (so->so_rcv.sb_state & SS_CANTRCVMORE)
1041 m_freem(m);
1042 else {
1043 if (tp->t_srtt != 0 && tp->rfbuf_ts != 0 &&
1044 now - tp->rfbuf_ts > (tp->t_srtt >>
1045 (TCP_RTT_SHIFT + TCP_RTT_BASE_SHIFT))) {
1046 tcp_update_rcvspace(tp);
1047 /* Start over with next RTT. */
1048 tp->rfbuf_cnt = 0;
1049 tp->rfbuf_ts = 0;
1050 } else
1051 tp->rfbuf_cnt += tlen;
1052 m_adj(m, iphlen + off);
1053 sbappendstream(so, &so->so_rcv, m);
1054 }
1055 tp->t_flags |= TF_BLOCKOUTPUT;
1056 sorwakeup(so);
1057 tp->t_flags &= ~TF_BLOCKOUTPUT;
1058 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT))
1059 (void) tcp_output(tp);
1060 in_pcbunref(inp);
1061 return IPPROTO_DONE;
1062 }
1063 }
1064
1065 /*
1066 * Compute mbuf offset to TCP data segment.
1067 */
1068 hdroptlen = iphlen + off;
1069
1070 /*
1071 * Calculate amount of space in receive window,
1072 * and then do TCP input processing.
1073 * Receive window is amount of space in rcv queue,
1074 * but not less than advertised window.
1075 */
1076 {
1077 int win;
1078
1079 win = sbspace(so, &so->so_rcv);
1080 if (win < 0)
1081 win = 0;
1082 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
1083 }
1084
1085 switch (tp->t_state) {
1086
1087 /*
1088 * If the state is SYN_RECEIVED:
1089 * if seg contains SYN/ACK, send an RST.
1090 * if seg contains an ACK, but not for our SYN/ACK, send an RST
1091 */
1092
1093 case TCPS_SYN_RECEIVED:
1094 if (tiflags & TH_ACK) {
1095 if (tiflags & TH_SYN) {
1096 tcpstat_inc(tcps_badsyn);
1097 goto dropwithreset;
1098 }
1099 if (SEQ_LEQ(th->th_ack, tp->snd_una) ||
1100 SEQ_GT(th->th_ack, tp->snd_max))
1101 goto dropwithreset;
1102 }
1103 break;
1104
1105 /*
1106 * If the state is SYN_SENT:
1107 * if seg contains an ACK, but not for our SYN, drop the input.
1108 * if seg contains a RST, then drop the connection.
1109 * if seg does not contain SYN, then drop it.
1110 * Otherwise this is an acceptable SYN segment
1111 * initialize tp->rcv_nxt and tp->irs
1112 * if seg contains ack then advance tp->snd_una
1113 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
1114 * arrange for segment to be acked (eventually)
1115 * continue processing rest of data/controls, beginning with URG
1116 */
1117 case TCPS_SYN_SENT:
1118 if ((tiflags & TH_ACK) &&
1119 (SEQ_LEQ(th->th_ack, tp->iss) ||
1120 SEQ_GT(th->th_ack, tp->snd_max)))
1121 goto dropwithreset;
1122 if (tiflags & TH_RST) {
1123 #ifdef TCP_ECN
1124 /* if ECN is enabled, fall back to non-ecn at rexmit */
1125 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN))
1126 goto drop;
1127 #endif
1128 if (tiflags & TH_ACK)
1129 tp = tcp_drop(tp, ECONNREFUSED);
1130 goto drop;
1131 }
1132 if ((tiflags & TH_SYN) == 0)
1133 goto drop;
1134 if (tiflags & TH_ACK) {
1135 tp->snd_una = th->th_ack;
1136 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1137 tp->snd_nxt = tp->snd_una;
1138 }
1139 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1140 tp->irs = th->th_seq;
1141 tcp_mss(tp, opti.maxseg);
1142 /* Reset initial window to 1 segment for retransmit */
1143 if (tp->t_rxtshift > 0)
1144 tp->snd_cwnd = tp->t_maxseg;
1145 tcp_rcvseqinit(tp);
1146 tp->t_flags |= TF_ACKNOW;
1147 /*
1148 * If we've sent a SACK_PERMITTED option, and the peer
1149 * also replied with one, then TF_SACK_PERMIT should have
1150 * been set in tcp_dooptions(). If it was not, disable SACKs.
1151 */
1152 if (tp->sack_enable)
1153 tp->sack_enable = tp->t_flags & TF_SACK_PERMIT;
1154 #ifdef TCP_ECN
1155 /*
1156 * if ECE is set but CWR is not set for SYN-ACK, or
1157 * both ECE and CWR are set for simultaneous open,
1158 * peer is ECN capable.
1159 */
1160 if (tcp_do_ecn) {
1161 switch (tiflags & (TH_ACK|TH_ECE|TH_CWR)) {
1162 case TH_ACK|TH_ECE:
1163 case TH_ECE|TH_CWR:
1164 tp->t_flags |= TF_ECN_PERMIT;
1165 tiflags &= ~(TH_ECE|TH_CWR);
1166 tcpstat_inc(tcps_ecn_accepts);
1167 }
1168 }
1169 #endif
1170
1171 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
1172 tcpstat_inc(tcps_connects);
1173 tp->t_flags |= TF_BLOCKOUTPUT;
1174 soisconnected(so);
1175 tp->t_flags &= ~TF_BLOCKOUTPUT;
1176 tp->t_state = TCPS_ESTABLISHED;
1177 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle);
1178 /* Do window scaling on this connection? */
1179 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1180 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1181 tp->snd_scale = tp->requested_s_scale;
1182 tp->rcv_scale = tp->request_r_scale;
1183 }
1184 tcp_flush_queue(tp);
1185
1186 /*
1187 * if we didn't have to retransmit the SYN,
1188 * use its rtt as our initial srtt & rtt var.
1189 */
1190 if (tp->t_rtttime)
1191 tcp_xmit_timer(tp, now - tp->t_rtttime);
1192 /*
1193 * Since new data was acked (the SYN), open the
1194 * congestion window by one MSS. We do this
1195 * here, because we won't go through the normal
1196 * ACK processing below. And since this is the
1197 * start of the connection, we know we are in
1198 * the exponential phase of slow-start.
1199 */
1200 tp->snd_cwnd += tp->t_maxseg;
1201 } else
1202 tp->t_state = TCPS_SYN_RECEIVED;
1203
1204 #if 0
1205 trimthenstep6:
1206 #endif
1207 /*
1208 * Advance th->th_seq to correspond to first data byte.
1209 * If data, trim to stay within window,
1210 * dropping FIN if necessary.
1211 */
1212 th->th_seq++;
1213 if (tlen > tp->rcv_wnd) {
1214 todrop = tlen - tp->rcv_wnd;
1215 m_adj(m, -todrop);
1216 tlen = tp->rcv_wnd;
1217 tiflags &= ~TH_FIN;
1218 tcpstat_pkt(tcps_rcvpackafterwin, tcps_rcvbyteafterwin,
1219 todrop);
1220 }
1221 tp->snd_wl1 = th->th_seq - 1;
1222 tp->rcv_up = th->th_seq;
1223 goto step6;
1224 /*
1225 * If a new connection request is received while in TIME_WAIT,
1226 * drop the old connection and start over if the if the
1227 * timestamp or the sequence numbers are above the previous
1228 * ones.
1229 */
1230 case TCPS_TIME_WAIT:
1231 if (((tiflags & (TH_SYN|TH_ACK)) == TH_SYN) &&
1232 ((opti.ts_present &&
1233 TSTMP_LT(tp->ts_recent, opti.ts_val)) ||
1234 SEQ_GT(th->th_seq, tp->rcv_nxt))) {
1235 #if NPF > 0
1236 /*
1237 * The socket will be recreated but the new state
1238 * has already been linked to the socket. Remove the
1239 * link between old socket and new state.
1240 */
1241 pf_inp_unlink(inp);
1242 #endif
1243 /*
1244 * Advance the iss by at least 32768, but
1245 * clear the msb in order to make sure
1246 * that SEG_LT(snd_nxt, iss).
1247 */
1248 iss = tp->snd_nxt +
1249 ((arc4random() & 0x7fffffff) | 0x8000);
1250 reuse = &iss;
1251 tp = tcp_close(tp);
1252 in_pcbunref(inp);
1253 inp = NULL;
1254 goto findpcb;
1255 }
1256 }
1257
1258 /*
1259 * States other than LISTEN or SYN_SENT.
1260 * First check timestamp, if present.
1261 * Then check that at least some bytes of segment are within
1262 * receive window. If segment begins before rcv_nxt,
1263 * drop leading data (and SYN); if nothing left, just ack.
1264 *
1265 * RFC 1323 PAWS: If we have a timestamp reply on this segment
1266 * and it's less than opti.ts_recent, drop it.
1267 */
1268 if (opti.ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent &&
1269 TSTMP_LT(opti.ts_val, tp->ts_recent)) {
1270
1271 /* Check to see if ts_recent is over 24 days old. */
1272 if (now - tp->ts_recent_age > TCP_PAWS_IDLE) {
1273 /*
1274 * Invalidate ts_recent. If this segment updates
1275 * ts_recent, the age will be reset later and ts_recent
1276 * will get a valid value. If it does not, setting
1277 * ts_recent to zero will at least satisfy the
1278 * requirement that zero be placed in the timestamp
1279 * echo reply when ts_recent isn't valid. The
1280 * age isn't reset until we get a valid ts_recent
1281 * because we don't want out-of-order segments to be
1282 * dropped when ts_recent is old.
1283 */
1284 tp->ts_recent = 0;
1285 } else {
1286 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte, tlen);
1287 tcpstat_inc(tcps_pawsdrop);
1288 if (tlen)
1289 goto dropafterack;
1290 goto drop;
1291 }
1292 }
1293
1294 todrop = tp->rcv_nxt - th->th_seq;
1295 if (todrop > 0) {
1296 if (tiflags & TH_SYN) {
1297 tiflags &= ~TH_SYN;
1298 th->th_seq++;
1299 if (th->th_urp > 1)
1300 th->th_urp--;
1301 else
1302 tiflags &= ~TH_URG;
1303 todrop--;
1304 }
1305 if (todrop > tlen ||
1306 (todrop == tlen && (tiflags & TH_FIN) == 0)) {
1307 /*
1308 * Any valid FIN must be to the left of the
1309 * window. At this point, FIN must be a
1310 * duplicate or out-of-sequence, so drop it.
1311 */
1312 tiflags &= ~TH_FIN;
1313 /*
1314 * Send ACK to resynchronize, and drop any data,
1315 * but keep on processing for RST or ACK.
1316 */
1317 tp->t_flags |= TF_ACKNOW;
1318 todrop = tlen;
1319 tcpstat_pkt(tcps_rcvduppack, tcps_rcvdupbyte, todrop);
1320 } else {
1321 tcpstat_pkt(tcps_rcvpartduppack, tcps_rcvpartdupbyte,
1322 todrop);
1323 }
1324 hdroptlen += todrop; /* drop from head afterwards */
1325 th->th_seq += todrop;
1326 tlen -= todrop;
1327 if (th->th_urp > todrop)
1328 th->th_urp -= todrop;
1329 else {
1330 tiflags &= ~TH_URG;
1331 th->th_urp = 0;
1332 }
1333 }
1334
1335 /*
1336 * If new data are received on a connection after the
1337 * user processes are gone, then RST the other end.
1338 */
1339 if ((so->so_state & SS_NOFDREF) &&
1340 tp->t_state > TCPS_CLOSE_WAIT && tlen) {
1341 tp = tcp_close(tp);
1342 tcpstat_inc(tcps_rcvafterclose);
1343 goto dropwithreset;
1344 }
1345
1346 /*
1347 * If segment ends after window, drop trailing data
1348 * (and PUSH and FIN); if nothing left, just ACK.
1349 */
1350 todrop = (th->th_seq + tlen) - (tp->rcv_nxt+tp->rcv_wnd);
1351 if (todrop > 0) {
1352 tcpstat_inc(tcps_rcvpackafterwin);
1353 if (todrop >= tlen) {
1354 tcpstat_add(tcps_rcvbyteafterwin, tlen);
1355 /*
1356 * If window is closed can only take segments at
1357 * window edge, and have to drop data and PUSH from
1358 * incoming segments. Continue processing, but
1359 * remember to ack. Otherwise, drop segment
1360 * and ack.
1361 */
1362 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
1363 tp->t_flags |= TF_ACKNOW;
1364 tcpstat_inc(tcps_rcvwinprobe);
1365 } else
1366 goto dropafterack;
1367 } else
1368 tcpstat_add(tcps_rcvbyteafterwin, todrop);
1369 m_adj(m, -todrop);
1370 tlen -= todrop;
1371 tiflags &= ~(TH_PUSH|TH_FIN);
1372 }
1373
1374 /*
1375 * If last ACK falls within this segment's sequence numbers,
1376 * record its timestamp if it's more recent.
1377 * NOTE that the test is modified according to the latest
1378 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
1379 */
1380 if (opti.ts_present && TSTMP_GEQ(opti.ts_val, tp->ts_recent) &&
1381 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
1382 tp->ts_recent_age = now;
1383 tp->ts_recent = opti.ts_val;
1384 }
1385
1386 /*
1387 * If the RST bit is set examine the state:
1388 * SYN_RECEIVED STATE:
1389 * If passive open, return to LISTEN state.
1390 * If active open, inform user that connection was refused.
1391 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
1392 * Inform user that connection was reset, and close tcb.
1393 * CLOSING, LAST_ACK, TIME_WAIT STATES
1394 * Close the tcb.
1395 */
1396 if (tiflags & TH_RST) {
1397 if (th->th_seq != tp->last_ack_sent &&
1398 th->th_seq != tp->rcv_nxt &&
1399 th->th_seq != (tp->rcv_nxt + 1))
1400 goto drop;
1401
1402 switch (tp->t_state) {
1403 case TCPS_SYN_RECEIVED:
1404 #ifdef TCP_ECN
1405 /* if ECN is enabled, fall back to non-ecn at rexmit */
1406 if (tcp_do_ecn && !(tp->t_flags & TF_DISABLE_ECN))
1407 goto drop;
1408 #endif
1409 so->so_error = ECONNREFUSED;
1410 goto close;
1411
1412 case TCPS_ESTABLISHED:
1413 case TCPS_FIN_WAIT_1:
1414 case TCPS_FIN_WAIT_2:
1415 case TCPS_CLOSE_WAIT:
1416 so->so_error = ECONNRESET;
1417 close:
1418 tp->t_state = TCPS_CLOSED;
1419 tcpstat_inc(tcps_drops);
1420 tp = tcp_close(tp);
1421 goto drop;
1422 case TCPS_CLOSING:
1423 case TCPS_LAST_ACK:
1424 case TCPS_TIME_WAIT:
1425 tp = tcp_close(tp);
1426 goto drop;
1427 }
1428 }
1429
1430 /*
1431 * If a SYN is in the window, then this is an
1432 * error and we ACK and drop the packet.
1433 */
1434 if (tiflags & TH_SYN)
1435 goto dropafterack_ratelim;
1436
1437 /*
1438 * If the ACK bit is off we drop the segment and return.
1439 */
1440 if ((tiflags & TH_ACK) == 0) {
1441 if (tp->t_flags & TF_ACKNOW)
1442 goto dropafterack;
1443 else
1444 goto drop;
1445 }
1446
1447 /*
1448 * Ack processing.
1449 */
1450 switch (tp->t_state) {
1451
1452 /*
1453 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
1454 * ESTABLISHED state and continue processing.
1455 * The ACK was checked above.
1456 */
1457 case TCPS_SYN_RECEIVED:
1458 tcpstat_inc(tcps_connects);
1459 tp->t_flags |= TF_BLOCKOUTPUT;
1460 soisconnected(so);
1461 tp->t_flags &= ~TF_BLOCKOUTPUT;
1462 tp->t_state = TCPS_ESTABLISHED;
1463 TCP_TIMER_ARM(tp, TCPT_KEEP, tcp_keepidle);
1464 /* Do window scaling? */
1465 if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
1466 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
1467 tp->snd_scale = tp->requested_s_scale;
1468 tp->rcv_scale = tp->request_r_scale;
1469 tiwin = th->th_win << tp->snd_scale;
1470 }
1471 tcp_flush_queue(tp);
1472 tp->snd_wl1 = th->th_seq - 1;
1473 /* fall into ... */
1474
1475 /*
1476 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1477 * ACKs. If the ack is in the range
1478 * tp->snd_una < th->th_ack <= tp->snd_max
1479 * then advance tp->snd_una to th->th_ack and drop
1480 * data from the retransmission queue. If this ACK reflects
1481 * more up to date window information we update our window information.
1482 */
1483 case TCPS_ESTABLISHED:
1484 case TCPS_FIN_WAIT_1:
1485 case TCPS_FIN_WAIT_2:
1486 case TCPS_CLOSE_WAIT:
1487 case TCPS_CLOSING:
1488 case TCPS_LAST_ACK:
1489 case TCPS_TIME_WAIT:
1490 #ifdef TCP_ECN
1491 /*
1492 * if we receive ECE and are not already in recovery phase,
1493 * reduce cwnd by half but don't slow-start.
1494 * advance snd_last to snd_max not to reduce cwnd again
1495 * until all outstanding packets are acked.
1496 */
1497 if (tcp_do_ecn && (tiflags & TH_ECE)) {
1498 if ((tp->t_flags & TF_ECN_PERMIT) &&
1499 SEQ_GEQ(tp->snd_una, tp->snd_last)) {
1500 u_int win;
1501
1502 win = min(tp->snd_wnd, tp->snd_cwnd) / tp->t_maxseg;
1503 if (win > 1) {
1504 tp->snd_ssthresh = win / 2 * tp->t_maxseg;
1505 tp->snd_cwnd = tp->snd_ssthresh;
1506 tp->snd_last = tp->snd_max;
1507 tp->t_flags |= TF_SEND_CWR;
1508 tcpstat_inc(tcps_cwr_ecn);
1509 }
1510 }
1511 tcpstat_inc(tcps_ecn_rcvece);
1512 }
1513 /*
1514 * if we receive CWR, we know that the peer has reduced
1515 * its congestion window. stop sending ecn-echo.
1516 */
1517 if ((tiflags & TH_CWR)) {
1518 tp->t_flags &= ~TF_RCVD_CE;
1519 tcpstat_inc(tcps_ecn_rcvcwr);
1520 }
1521 #endif /* TCP_ECN */
1522
1523 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
1524 /*
1525 * Duplicate/old ACK processing.
1526 * Increments t_dupacks:
1527 * Pure duplicate (same seq/ack/window, no data)
1528 * Doesn't affect t_dupacks:
1529 * Data packets.
1530 * Normal window updates (window opens)
1531 * Resets t_dupacks:
1532 * New data ACKed.
1533 * Window shrinks
1534 * Old ACK
1535 */
1536 if (tlen) {
1537 /* Drop very old ACKs unless th_seq matches */
1538 if (th->th_seq != tp->rcv_nxt &&
1539 SEQ_LT(th->th_ack,
1540 tp->snd_una - tp->max_sndwnd)) {
1541 tcpstat_inc(tcps_rcvacktooold);
1542 goto drop;
1543 }
1544 break;
1545 }
1546 /*
1547 * If we get an old ACK, there is probably packet
1548 * reordering going on. Be conservative and reset
1549 * t_dupacks so that we are less aggressive in
1550 * doing a fast retransmit.
1551 */
1552 if (th->th_ack != tp->snd_una) {
1553 tp->t_dupacks = 0;
1554 break;
1555 }
1556 if (tiwin == tp->snd_wnd) {
1557 tcpstat_inc(tcps_rcvdupack);
1558 /*
1559 * If we have outstanding data (other than
1560 * a window probe), this is a completely
1561 * duplicate ack (ie, window info didn't
1562 * change), the ack is the biggest we've
1563 * seen and we've seen exactly our rexmt
1564 * threshold of them, assume a packet
1565 * has been dropped and retransmit it.
1566 * Kludge snd_nxt & the congestion
1567 * window so we send only this one
1568 * packet.
1569 *
1570 * We know we're losing at the current
1571 * window size so do congestion avoidance
1572 * (set ssthresh to half the current window
1573 * and pull our congestion window back to
1574 * the new ssthresh).
1575 *
1576 * Dup acks mean that packets have left the
1577 * network (they're now cached at the receiver)
1578 * so bump cwnd by the amount in the receiver
1579 * to keep a constant cwnd packets in the
1580 * network.
1581 */
1582 if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0)
1583 tp->t_dupacks = 0;
1584 else if (++tp->t_dupacks == tcprexmtthresh) {
1585 tcp_seq onxt = tp->snd_nxt;
1586 u_long win =
1587 ulmin(tp->snd_wnd, tp->snd_cwnd) /
1588 2 / tp->t_maxseg;
1589
1590 if (SEQ_LT(th->th_ack, tp->snd_last)){
1591 /*
1592 * False fast retx after
1593 * timeout. Do not cut window.
1594 */
1595 tp->t_dupacks = 0;
1596 goto drop;
1597 }
1598 if (win < 2)
1599 win = 2;
1600 tp->snd_ssthresh = win * tp->t_maxseg;
1601 tp->snd_last = tp->snd_max;
1602 if (tp->sack_enable) {
1603 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1604 tp->t_rtttime = 0;
1605 #ifdef TCP_ECN
1606 tp->t_flags |= TF_SEND_CWR;
1607 #endif
1608 tcpstat_inc(tcps_cwr_frecovery);
1609 tcpstat_inc(tcps_sack_recovery_episode);
1610 /*
1611 * tcp_output() will send
1612 * oldest SACK-eligible rtx.
1613 */
1614 (void) tcp_output(tp);
1615 tp->snd_cwnd = tp->snd_ssthresh+
1616 tp->t_maxseg * tp->t_dupacks;
1617 goto drop;
1618 }
1619 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1620 tp->t_rtttime = 0;
1621 tp->snd_nxt = th->th_ack;
1622 tp->snd_cwnd = tp->t_maxseg;
1623 #ifdef TCP_ECN
1624 tp->t_flags |= TF_SEND_CWR;
1625 #endif
1626 tcpstat_inc(tcps_cwr_frecovery);
1627 tcpstat_inc(tcps_sndrexmitfast);
1628 (void) tcp_output(tp);
1629
1630 tp->snd_cwnd = tp->snd_ssthresh +
1631 tp->t_maxseg * tp->t_dupacks;
1632 if (SEQ_GT(onxt, tp->snd_nxt))
1633 tp->snd_nxt = onxt;
1634 goto drop;
1635 } else if (tp->t_dupacks > tcprexmtthresh) {
1636 tp->snd_cwnd += tp->t_maxseg;
1637 (void) tcp_output(tp);
1638 goto drop;
1639 }
1640 } else if (tiwin < tp->snd_wnd) {
1641 /*
1642 * The window was retracted! Previous dup
1643 * ACKs may have been due to packets arriving
1644 * after the shrunken window, not a missing
1645 * packet, so play it safe and reset t_dupacks
1646 */
1647 tp->t_dupacks = 0;
1648 }
1649 break;
1650 }
1651 /*
1652 * If the congestion window was inflated to account
1653 * for the other side's cached packets, retract it.
1654 */
1655 if (tp->t_dupacks >= tcprexmtthresh) {
1656 /* Check for a partial ACK */
1657 if (SEQ_LT(th->th_ack, tp->snd_last)) {
1658 if (tp->sack_enable)
1659 tcp_sack_partialack(tp, th);
1660 else
1661 tcp_newreno_partialack(tp, th);
1662 } else {
1663 /* Out of fast recovery */
1664 tp->snd_cwnd = tp->snd_ssthresh;
1665 if (tcp_seq_subtract(tp->snd_max, th->th_ack) <
1666 tp->snd_ssthresh)
1667 tp->snd_cwnd =
1668 tcp_seq_subtract(tp->snd_max,
1669 th->th_ack);
1670 tp->t_dupacks = 0;
1671 }
1672 } else {
1673 /*
1674 * Reset the duplicate ACK counter if we
1675 * were not in fast recovery.
1676 */
1677 tp->t_dupacks = 0;
1678 }
1679 if (SEQ_GT(th->th_ack, tp->snd_max)) {
1680 tcpstat_inc(tcps_rcvacktoomuch);
1681 goto dropafterack_ratelim;
1682 }
1683 acked = th->th_ack - tp->snd_una;
1684 tcpstat_pkt(tcps_rcvackpack, tcps_rcvackbyte, acked);
1685 tp->t_rcvacktime = now;
1686
1687 /*
1688 * If we have a timestamp reply, update smoothed
1689 * round trip time. If no timestamp is present but
1690 * transmit timer is running and timed sequence
1691 * number was acked, update smoothed round trip time.
1692 * Since we now have an rtt measurement, cancel the
1693 * timer backoff (cf., Phil Karn's retransmit alg.).
1694 * Recompute the initial retransmit timer.
1695 */
1696 if (opti.ts_present && opti.ts_ecr)
1697 tcp_xmit_timer(tp, now - opti.ts_ecr);
1698 else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
1699 tcp_xmit_timer(tp, now - tp->t_rtttime);
1700
1701 /*
1702 * If all outstanding data is acked, stop retransmit
1703 * timer and remember to restart (more output or persist).
1704 * If there is more data to be acked, restart retransmit
1705 * timer, using current (possibly backed-off) value.
1706 */
1707 if (th->th_ack == tp->snd_max) {
1708 TCP_TIMER_DISARM(tp, TCPT_REXMT);
1709 tp->t_flags |= TF_NEEDOUTPUT;
1710 } else if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
1711 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1712 /*
1713 * When new data is acked, open the congestion window.
1714 * If the window gives us less than ssthresh packets
1715 * in flight, open exponentially (maxseg per packet).
1716 * Otherwise open linearly: maxseg per window
1717 * (maxseg^2 / cwnd per packet).
1718 */
1719 {
1720 u_int cw = tp->snd_cwnd;
1721 u_int incr = tp->t_maxseg;
1722
1723 if (cw > tp->snd_ssthresh)
1724 incr = max(incr * incr / cw, 1);
1725 if (tp->t_dupacks < tcprexmtthresh)
1726 tp->snd_cwnd = ulmin(cw + incr,
1727 TCP_MAXWIN << tp->snd_scale);
1728 }
1729 ND6_HINT(tp);
1730 if (acked > so->so_snd.sb_cc) {
1731 if (tp->snd_wnd > so->so_snd.sb_cc)
1732 tp->snd_wnd -= so->so_snd.sb_cc;
1733 else
1734 tp->snd_wnd = 0;
1735 sbdrop(so, &so->so_snd, (int)so->so_snd.sb_cc);
1736 ourfinisacked = 1;
1737 } else {
1738 sbdrop(so, &so->so_snd, acked);
1739 if (tp->snd_wnd > acked)
1740 tp->snd_wnd -= acked;
1741 else
1742 tp->snd_wnd = 0;
1743 ourfinisacked = 0;
1744 }
1745
1746 tcp_update_sndspace(tp);
1747 if (sb_notify(so, &so->so_snd)) {
1748 tp->t_flags |= TF_BLOCKOUTPUT;
1749 sowwakeup(so);
1750 tp->t_flags &= ~TF_BLOCKOUTPUT;
1751 }
1752
1753 /*
1754 * If we had a pending ICMP message that referred to data
1755 * that have just been acknowledged, disregard the recorded
1756 * ICMP message.
1757 */
1758 if ((tp->t_flags & TF_PMTUD_PEND) &&
1759 SEQ_GT(th->th_ack, tp->t_pmtud_th_seq))
1760 tp->t_flags &= ~TF_PMTUD_PEND;
1761
1762 /*
1763 * Keep track of the largest chunk of data acknowledged
1764 * since last PMTU update
1765 */
1766 if (tp->t_pmtud_mss_acked < acked)
1767 tp->t_pmtud_mss_acked = acked;
1768
1769 tp->snd_una = th->th_ack;
1770 #ifdef TCP_ECN
1771 /* sync snd_last with snd_una */
1772 if (SEQ_GT(tp->snd_una, tp->snd_last))
1773 tp->snd_last = tp->snd_una;
1774 #endif
1775 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1776 tp->snd_nxt = tp->snd_una;
1777
1778 switch (tp->t_state) {
1779
1780 /*
1781 * In FIN_WAIT_1 STATE in addition to the processing
1782 * for the ESTABLISHED state if our FIN is now acknowledged
1783 * then enter FIN_WAIT_2.
1784 */
1785 case TCPS_FIN_WAIT_1:
1786 if (ourfinisacked) {
1787 /*
1788 * If we can't receive any more
1789 * data, then closing user can proceed.
1790 * Starting the timer is contrary to the
1791 * specification, but if we don't get a FIN
1792 * we'll hang forever.
1793 */
1794 if (so->so_rcv.sb_state & SS_CANTRCVMORE) {
1795 tp->t_flags |= TF_BLOCKOUTPUT;
1796 soisdisconnected(so);
1797 tp->t_flags &= ~TF_BLOCKOUTPUT;
1798 TCP_TIMER_ARM(tp, TCPT_2MSL, tcp_maxidle);
1799 }
1800 tp->t_state = TCPS_FIN_WAIT_2;
1801 }
1802 break;
1803
1804 /*
1805 * In CLOSING STATE in addition to the processing for
1806 * the ESTABLISHED state if the ACK acknowledges our FIN
1807 * then enter the TIME-WAIT state, otherwise ignore
1808 * the segment.
1809 */
1810 case TCPS_CLOSING:
1811 if (ourfinisacked) {
1812 tp->t_state = TCPS_TIME_WAIT;
1813 tcp_canceltimers(tp);
1814 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
1815 tp->t_flags |= TF_BLOCKOUTPUT;
1816 soisdisconnected(so);
1817 tp->t_flags &= ~TF_BLOCKOUTPUT;
1818 }
1819 break;
1820
1821 /*
1822 * In LAST_ACK, we may still be waiting for data to drain
1823 * and/or to be acked, as well as for the ack of our FIN.
1824 * If our FIN is now acknowledged, delete the TCB,
1825 * enter the closed state and return.
1826 */
1827 case TCPS_LAST_ACK:
1828 if (ourfinisacked) {
1829 tp = tcp_close(tp);
1830 goto drop;
1831 }
1832 break;
1833
1834 /*
1835 * In TIME_WAIT state the only thing that should arrive
1836 * is a retransmission of the remote FIN. Acknowledge
1837 * it and restart the finack timer.
1838 */
1839 case TCPS_TIME_WAIT:
1840 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
1841 goto dropafterack;
1842 }
1843 }
1844
1845 step6:
1846 /*
1847 * Update window information.
1848 * Don't look at window if no ACK: TAC's send garbage on first SYN.
1849 */
1850 if ((tiflags & TH_ACK) &&
1851 (SEQ_LT(tp->snd_wl1, th->th_seq) || (tp->snd_wl1 == th->th_seq &&
1852 (SEQ_LT(tp->snd_wl2, th->th_ack) ||
1853 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
1854 /* keep track of pure window updates */
1855 if (tlen == 0 &&
1856 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
1857 tcpstat_inc(tcps_rcvwinupd);
1858 tp->snd_wnd = tiwin;
1859 tp->snd_wl1 = th->th_seq;
1860 tp->snd_wl2 = th->th_ack;
1861 if (tp->snd_wnd > tp->max_sndwnd)
1862 tp->max_sndwnd = tp->snd_wnd;
1863 tp->t_flags |= TF_NEEDOUTPUT;
1864 }
1865
1866 /*
1867 * Process segments with URG.
1868 */
1869 if ((tiflags & TH_URG) && th->th_urp &&
1870 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1871 /*
1872 * This is a kludge, but if we receive and accept
1873 * random urgent pointers, we'll crash in
1874 * soreceive. It's hard to imagine someone
1875 * actually wanting to send this much urgent data.
1876 */
1877 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
1878 th->th_urp = 0; /* XXX */
1879 tiflags &= ~TH_URG; /* XXX */
1880 goto dodata; /* XXX */
1881 }
1882 /*
1883 * If this segment advances the known urgent pointer,
1884 * then mark the data stream. This should not happen
1885 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1886 * a FIN has been received from the remote side.
1887 * In these states we ignore the URG.
1888 *
1889 * According to RFC961 (Assigned Protocols),
1890 * the urgent pointer points to the last octet
1891 * of urgent data. We continue, however,
1892 * to consider it to indicate the first octet
1893 * of data past the urgent section as the original
1894 * spec states (in one of two places).
1895 */
1896 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
1897 tp->rcv_up = th->th_seq + th->th_urp;
1898 so->so_oobmark = so->so_rcv.sb_cc +
1899 (tp->rcv_up - tp->rcv_nxt) - 1;
1900 if (so->so_oobmark == 0)
1901 so->so_rcv.sb_state |= SS_RCVATMARK;
1902 sohasoutofband(so);
1903 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1904 }
1905 /*
1906 * Remove out of band data so doesn't get presented to user.
1907 * This can happen independent of advancing the URG pointer,
1908 * but if two URG's are pending at once, some out-of-band
1909 * data may creep in... ick.
1910 */
1911 if (th->th_urp <= (u_int16_t) tlen &&
1912 (so->so_options & SO_OOBINLINE) == 0)
1913 tcp_pulloutofband(so, th->th_urp, m, hdroptlen);
1914 } else
1915 /*
1916 * If no out of band data is expected,
1917 * pull receive urgent pointer along
1918 * with the receive window.
1919 */
1920 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1921 tp->rcv_up = tp->rcv_nxt;
1922 dodata: /* XXX */
1923
1924 /*
1925 * Process the segment text, merging it into the TCP sequencing queue,
1926 * and arranging for acknowledgment of receipt if necessary.
1927 * This process logically involves adjusting tp->rcv_wnd as data
1928 * is presented to the user (this happens in tcp_usrreq.c,
1929 * case PRU_RCVD). If a FIN has already been received on this
1930 * connection then we just ignore the text.
1931 */
1932 if ((tlen || (tiflags & TH_FIN)) &&
1933 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1934 tcp_seq laststart = th->th_seq;
1935 tcp_seq lastend = th->th_seq + tlen;
1936
1937 if (th->th_seq == tp->rcv_nxt && TAILQ_EMPTY(&tp->t_segq) &&
1938 tp->t_state == TCPS_ESTABLISHED) {
1939 TCP_SETUP_ACK(tp, tiflags, m);
1940 tp->rcv_nxt += tlen;
1941 tiflags = th->th_flags & TH_FIN;
1942 tcpstat_pkt(tcps_rcvpack, tcps_rcvbyte, tlen);
1943 ND6_HINT(tp);
1944 if (so->so_rcv.sb_state & SS_CANTRCVMORE)
1945 m_freem(m);
1946 else {
1947 m_adj(m, hdroptlen);
1948 sbappendstream(so, &so->so_rcv, m);
1949 }
1950 tp->t_flags |= TF_BLOCKOUTPUT;
1951 sorwakeup(so);
1952 tp->t_flags &= ~TF_BLOCKOUTPUT;
1953 } else {
1954 m_adj(m, hdroptlen);
1955 tiflags = tcp_reass(tp, th, m, &tlen);
1956 tp->t_flags |= TF_ACKNOW;
1957 }
1958 if (tp->sack_enable)
1959 tcp_update_sack_list(tp, laststart, lastend);
1960
1961 /*
1962 * variable len never referenced again in modern BSD,
1963 * so why bother computing it ??
1964 */
1965 #if 0
1966 /*
1967 * Note the amount of data that peer has sent into
1968 * our window, in order to estimate the sender's
1969 * buffer size.
1970 */
1971 len = so->so_rcv.sb_hiwat - (tp->rcv_adv - tp->rcv_nxt);
1972 #endif /* 0 */
1973 } else {
1974 m_freem(m);
1975 tiflags &= ~TH_FIN;
1976 }
1977
1978 /*
1979 * If FIN is received ACK the FIN and let the user know
1980 * that the connection is closing. Ignore a FIN received before
1981 * the connection is fully established.
1982 */
1983 if ((tiflags & TH_FIN) && TCPS_HAVEESTABLISHED(tp->t_state)) {
1984 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1985 tp->t_flags |= TF_BLOCKOUTPUT;
1986 socantrcvmore(so);
1987 tp->t_flags &= ~TF_BLOCKOUTPUT;
1988 tp->t_flags |= TF_ACKNOW;
1989 tp->rcv_nxt++;
1990 }
1991 switch (tp->t_state) {
1992
1993 /*
1994 * In ESTABLISHED STATE enter the CLOSE_WAIT state.
1995 */
1996 case TCPS_ESTABLISHED:
1997 tp->t_state = TCPS_CLOSE_WAIT;
1998 break;
1999
2000 /*
2001 * If still in FIN_WAIT_1 STATE FIN has not been acked so
2002 * enter the CLOSING state.
2003 */
2004 case TCPS_FIN_WAIT_1:
2005 tp->t_state = TCPS_CLOSING;
2006 break;
2007
2008 /*
2009 * In FIN_WAIT_2 state enter the TIME_WAIT state,
2010 * starting the time-wait timer, turning off the other
2011 * standard timers.
2012 */
2013 case TCPS_FIN_WAIT_2:
2014 tp->t_state = TCPS_TIME_WAIT;
2015 tcp_canceltimers(tp);
2016 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2017 tp->t_flags |= TF_BLOCKOUTPUT;
2018 soisdisconnected(so);
2019 tp->t_flags &= ~TF_BLOCKOUTPUT;
2020 break;
2021
2022 /*
2023 * In TIME_WAIT state restart the 2 MSL time_wait timer.
2024 */
2025 case TCPS_TIME_WAIT:
2026 TCP_TIMER_ARM(tp, TCPT_2MSL, 2 * TCPTV_MSL);
2027 break;
2028 }
2029 }
2030 if (otp)
2031 tcp_trace(TA_INPUT, ostate, tp, otp, &saveti.caddr, 0, tlen);
2032
2033 /*
2034 * Return any desired output.
2035 */
2036 if (tp->t_flags & (TF_ACKNOW|TF_NEEDOUTPUT))
2037 (void) tcp_output(tp);
2038 in_pcbunref(inp);
2039 return IPPROTO_DONE;
2040
2041 badsyn:
2042 /*
2043 * Received a bad SYN. Increment counters and dropwithreset.
2044 */
2045 tcpstat_inc(tcps_badsyn);
2046 tp = NULL;
2047 goto dropwithreset;
2048
2049 dropafterack_ratelim:
2050 if (ppsratecheck(&tcp_ackdrop_ppslim_last, &tcp_ackdrop_ppslim_count,
2051 tcp_ackdrop_ppslim) == 0) {
2052 /* XXX stat */
2053 goto drop;
2054 }
2055 /* ...fall into dropafterack... */
2056
2057 dropafterack:
2058 /*
2059 * Generate an ACK dropping incoming segment if it occupies
2060 * sequence space, where the ACK reflects our state.
2061 */
2062 if (tiflags & TH_RST)
2063 goto drop;
2064 m_freem(m);
2065 tp->t_flags |= TF_ACKNOW;
2066 (void) tcp_output(tp);
2067 in_pcbunref(inp);
2068 return IPPROTO_DONE;
2069
2070 dropwithreset_ratelim:
2071 /*
2072 * We may want to rate-limit RSTs in certain situations,
2073 * particularly if we are sending an RST in response to
2074 * an attempt to connect to or otherwise communicate with
2075 * a port for which we have no socket.
2076 */
2077 if (ppsratecheck(&tcp_rst_ppslim_last, &tcp_rst_ppslim_count,
2078 tcp_rst_ppslim) == 0) {
2079 /* XXX stat */
2080 goto drop;
2081 }
2082 /* ...fall into dropwithreset... */
2083
2084 dropwithreset:
2085 /*
2086 * Generate a RST, dropping incoming segment.
2087 * Make ACK acceptable to originator of segment.
2088 * Don't bother to respond to RST.
2089 */
2090 if (tiflags & TH_RST)
2091 goto drop;
2092 if (tiflags & TH_ACK) {
2093 tcp_respond(tp, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack,
2094 TH_RST, m->m_pkthdr.ph_rtableid, now);
2095 } else {
2096 if (tiflags & TH_SYN)
2097 tlen++;
2098 tcp_respond(tp, mtod(m, caddr_t), th, th->th_seq + tlen,
2099 (tcp_seq)0, TH_RST|TH_ACK, m->m_pkthdr.ph_rtableid, now);
2100 }
2101 m_freem(m);
2102 in_pcbunref(inp);
2103 return IPPROTO_DONE;
2104
2105 drop:
2106 /*
2107 * Drop space held by incoming segment and return.
2108 */
2109 if (otp)
2110 tcp_trace(TA_DROP, ostate, tp, otp, &saveti.caddr, 0, tlen);
2111
2112 m_freem(m);
2113 in_pcbunref(inp);
2114 return IPPROTO_DONE;
2115 }
2116
2117 int
tcp_dooptions(struct tcpcb * tp,u_char * cp,int cnt,struct tcphdr * th,struct mbuf * m,int iphlen,struct tcp_opt_info * oi,u_int rtableid,uint64_t now)2118 tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th,
2119 struct mbuf *m, int iphlen, struct tcp_opt_info *oi,
2120 u_int rtableid, uint64_t now)
2121 {
2122 u_int16_t mss = 0;
2123 int opt, optlen;
2124 #ifdef TCP_SIGNATURE
2125 caddr_t sigp = NULL;
2126 struct tdb *tdb = NULL;
2127 #endif /* TCP_SIGNATURE */
2128
2129 for (; cp && cnt > 0; cnt -= optlen, cp += optlen) {
2130 opt = cp[0];
2131 if (opt == TCPOPT_EOL)
2132 break;
2133 if (opt == TCPOPT_NOP)
2134 optlen = 1;
2135 else {
2136 if (cnt < 2)
2137 break;
2138 optlen = cp[1];
2139 if (optlen < 2 || optlen > cnt)
2140 break;
2141 }
2142 switch (opt) {
2143
2144 default:
2145 continue;
2146
2147 case TCPOPT_MAXSEG:
2148 if (optlen != TCPOLEN_MAXSEG)
2149 continue;
2150 if (!(th->th_flags & TH_SYN))
2151 continue;
2152 if (TCPS_HAVERCVDSYN(tp->t_state))
2153 continue;
2154 memcpy(&mss, cp + 2, sizeof(mss));
2155 mss = ntohs(mss);
2156 oi->maxseg = mss;
2157 break;
2158
2159 case TCPOPT_WINDOW:
2160 if (optlen != TCPOLEN_WINDOW)
2161 continue;
2162 if (!(th->th_flags & TH_SYN))
2163 continue;
2164 if (TCPS_HAVERCVDSYN(tp->t_state))
2165 continue;
2166 tp->t_flags |= TF_RCVD_SCALE;
2167 tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
2168 break;
2169
2170 case TCPOPT_TIMESTAMP:
2171 if (optlen != TCPOLEN_TIMESTAMP)
2172 continue;
2173 oi->ts_present = 1;
2174 memcpy(&oi->ts_val, cp + 2, sizeof(oi->ts_val));
2175 oi->ts_val = ntohl(oi->ts_val);
2176 memcpy(&oi->ts_ecr, cp + 6, sizeof(oi->ts_ecr));
2177 oi->ts_ecr = ntohl(oi->ts_ecr);
2178
2179 if (!(th->th_flags & TH_SYN))
2180 continue;
2181 if (TCPS_HAVERCVDSYN(tp->t_state))
2182 continue;
2183 /*
2184 * A timestamp received in a SYN makes
2185 * it ok to send timestamp requests and replies.
2186 */
2187 tp->t_flags |= TF_RCVD_TSTMP;
2188 tp->ts_recent = oi->ts_val;
2189 tp->ts_recent_age = now;
2190 break;
2191
2192 case TCPOPT_SACK_PERMITTED:
2193 if (!tp->sack_enable || optlen!=TCPOLEN_SACK_PERMITTED)
2194 continue;
2195 if (!(th->th_flags & TH_SYN))
2196 continue;
2197 if (TCPS_HAVERCVDSYN(tp->t_state))
2198 continue;
2199 /* MUST only be set on SYN */
2200 tp->t_flags |= TF_SACK_PERMIT;
2201 break;
2202 case TCPOPT_SACK:
2203 tcp_sack_option(tp, th, cp, optlen);
2204 break;
2205 #ifdef TCP_SIGNATURE
2206 case TCPOPT_SIGNATURE:
2207 if (optlen != TCPOLEN_SIGNATURE)
2208 continue;
2209
2210 if (sigp && timingsafe_bcmp(sigp, cp + 2, 16))
2211 goto bad;
2212
2213 sigp = cp + 2;
2214 break;
2215 #endif /* TCP_SIGNATURE */
2216 }
2217 }
2218
2219 #ifdef TCP_SIGNATURE
2220 if (tp->t_flags & TF_SIGNATURE) {
2221 union sockaddr_union src, dst;
2222
2223 memset(&src, 0, sizeof(union sockaddr_union));
2224 memset(&dst, 0, sizeof(union sockaddr_union));
2225
2226 switch (tp->pf) {
2227 case 0:
2228 case AF_INET:
2229 src.sa.sa_len = sizeof(struct sockaddr_in);
2230 src.sa.sa_family = AF_INET;
2231 src.sin.sin_addr = mtod(m, struct ip *)->ip_src;
2232 dst.sa.sa_len = sizeof(struct sockaddr_in);
2233 dst.sa.sa_family = AF_INET;
2234 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst;
2235 break;
2236 #ifdef INET6
2237 case AF_INET6:
2238 src.sa.sa_len = sizeof(struct sockaddr_in6);
2239 src.sa.sa_family = AF_INET6;
2240 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src;
2241 dst.sa.sa_len = sizeof(struct sockaddr_in6);
2242 dst.sa.sa_family = AF_INET6;
2243 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst;
2244 break;
2245 #endif /* INET6 */
2246 }
2247
2248 tdb = gettdbbysrcdst(rtable_l2(rtableid),
2249 0, &src, &dst, IPPROTO_TCP);
2250
2251 /*
2252 * We don't have an SA for this peer, so we turn off
2253 * TF_SIGNATURE on the listen socket
2254 */
2255 if (tdb == NULL && tp->t_state == TCPS_LISTEN)
2256 tp->t_flags &= ~TF_SIGNATURE;
2257
2258 }
2259
2260 if ((sigp ? TF_SIGNATURE : 0) ^ (tp->t_flags & TF_SIGNATURE)) {
2261 tcpstat_inc(tcps_rcvbadsig);
2262 goto bad;
2263 }
2264
2265 if (sigp) {
2266 char sig[16];
2267
2268 if (tdb == NULL) {
2269 tcpstat_inc(tcps_rcvbadsig);
2270 goto bad;
2271 }
2272
2273 if (tcp_signature(tdb, tp->pf, m, th, iphlen, 1, sig) < 0)
2274 goto bad;
2275
2276 if (timingsafe_bcmp(sig, sigp, 16)) {
2277 tcpstat_inc(tcps_rcvbadsig);
2278 goto bad;
2279 }
2280
2281 tcpstat_inc(tcps_rcvgoodsig);
2282 }
2283
2284 tdb_unref(tdb);
2285 #endif /* TCP_SIGNATURE */
2286
2287 return (0);
2288
2289 #ifdef TCP_SIGNATURE
2290 bad:
2291 tdb_unref(tdb);
2292 #endif /* TCP_SIGNATURE */
2293 return (-1);
2294 }
2295
2296 u_long
tcp_seq_subtract(u_long a,u_long b)2297 tcp_seq_subtract(u_long a, u_long b)
2298 {
2299 return ((long)(a - b));
2300 }
2301
2302 /*
2303 * This function is called upon receipt of new valid data (while not in header
2304 * prediction mode), and it updates the ordered list of sacks.
2305 */
2306 void
tcp_update_sack_list(struct tcpcb * tp,tcp_seq rcv_laststart,tcp_seq rcv_lastend)2307 tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_laststart,
2308 tcp_seq rcv_lastend)
2309 {
2310 /*
2311 * First reported block MUST be the most recent one. Subsequent
2312 * blocks SHOULD be in the order in which they arrived at the
2313 * receiver. These two conditions make the implementation fully
2314 * compliant with RFC 2018.
2315 */
2316 int i, j = 0, count = 0, lastpos = -1;
2317 struct sackblk sack, firstsack, temp[MAX_SACK_BLKS];
2318
2319 /* First clean up current list of sacks */
2320 for (i = 0; i < tp->rcv_numsacks; i++) {
2321 sack = tp->sackblks[i];
2322 if (sack.start == 0 && sack.end == 0) {
2323 count++; /* count = number of blocks to be discarded */
2324 continue;
2325 }
2326 if (SEQ_LEQ(sack.end, tp->rcv_nxt)) {
2327 tp->sackblks[i].start = tp->sackblks[i].end = 0;
2328 count++;
2329 } else {
2330 temp[j].start = tp->sackblks[i].start;
2331 temp[j++].end = tp->sackblks[i].end;
2332 }
2333 }
2334 tp->rcv_numsacks -= count;
2335 if (tp->rcv_numsacks == 0) { /* no sack blocks currently (fast path) */
2336 tcp_clean_sackreport(tp);
2337 if (SEQ_LT(tp->rcv_nxt, rcv_laststart)) {
2338 /* ==> need first sack block */
2339 tp->sackblks[0].start = rcv_laststart;
2340 tp->sackblks[0].end = rcv_lastend;
2341 tp->rcv_numsacks = 1;
2342 }
2343 return;
2344 }
2345 /* Otherwise, sack blocks are already present. */
2346 for (i = 0; i < tp->rcv_numsacks; i++)
2347 tp->sackblks[i] = temp[i]; /* first copy back sack list */
2348 if (SEQ_GEQ(tp->rcv_nxt, rcv_lastend))
2349 return; /* sack list remains unchanged */
2350 /*
2351 * From here, segment just received should be (part of) the 1st sack.
2352 * Go through list, possibly coalescing sack block entries.
2353 */
2354 firstsack.start = rcv_laststart;
2355 firstsack.end = rcv_lastend;
2356 for (i = 0; i < tp->rcv_numsacks; i++) {
2357 sack = tp->sackblks[i];
2358 if (SEQ_LT(sack.end, firstsack.start) ||
2359 SEQ_GT(sack.start, firstsack.end))
2360 continue; /* no overlap */
2361 if (sack.start == firstsack.start && sack.end == firstsack.end){
2362 /*
2363 * identical block; delete it here since we will
2364 * move it to the front of the list.
2365 */
2366 tp->sackblks[i].start = tp->sackblks[i].end = 0;
2367 lastpos = i; /* last posn with a zero entry */
2368 continue;
2369 }
2370 if (SEQ_LEQ(sack.start, firstsack.start))
2371 firstsack.start = sack.start; /* merge blocks */
2372 if (SEQ_GEQ(sack.end, firstsack.end))
2373 firstsack.end = sack.end; /* merge blocks */
2374 tp->sackblks[i].start = tp->sackblks[i].end = 0;
2375 lastpos = i; /* last posn with a zero entry */
2376 }
2377 if (lastpos != -1) { /* at least one merge */
2378 for (i = 0, j = 1; i < tp->rcv_numsacks; i++) {
2379 sack = tp->sackblks[i];
2380 if (sack.start == 0 && sack.end == 0)
2381 continue;
2382 temp[j++] = sack;
2383 }
2384 tp->rcv_numsacks = j; /* including first blk (added later) */
2385 for (i = 1; i < tp->rcv_numsacks; i++) /* now copy back */
2386 tp->sackblks[i] = temp[i];
2387 } else { /* no merges -- shift sacks by 1 */
2388 if (tp->rcv_numsacks < MAX_SACK_BLKS)
2389 tp->rcv_numsacks++;
2390 for (i = tp->rcv_numsacks-1; i > 0; i--)
2391 tp->sackblks[i] = tp->sackblks[i-1];
2392 }
2393 tp->sackblks[0] = firstsack;
2394 return;
2395 }
2396
2397 /*
2398 * Process the TCP SACK option. tp->snd_holes is an ordered list
2399 * of holes (oldest to newest, in terms of the sequence space).
2400 */
2401 void
tcp_sack_option(struct tcpcb * tp,struct tcphdr * th,u_char * cp,int optlen)2402 tcp_sack_option(struct tcpcb *tp, struct tcphdr *th, u_char *cp, int optlen)
2403 {
2404 int tmp_olen;
2405 u_char *tmp_cp;
2406 struct sackhole *cur, *p, *temp;
2407
2408 if (!tp->sack_enable)
2409 return;
2410 /* SACK without ACK doesn't make sense. */
2411 if ((th->th_flags & TH_ACK) == 0)
2412 return;
2413 /* Make sure the ACK on this segment is in [snd_una, snd_max]. */
2414 if (SEQ_LT(th->th_ack, tp->snd_una) ||
2415 SEQ_GT(th->th_ack, tp->snd_max))
2416 return;
2417 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */
2418 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
2419 return;
2420 /* Note: TCPOLEN_SACK must be 2*sizeof(tcp_seq) */
2421 tmp_cp = cp + 2;
2422 tmp_olen = optlen - 2;
2423 tcpstat_inc(tcps_sack_rcv_opts);
2424 if (tp->snd_numholes < 0)
2425 tp->snd_numholes = 0;
2426 if (tp->t_maxseg == 0)
2427 panic("tcp_sack_option"); /* Should never happen */
2428 while (tmp_olen > 0) {
2429 struct sackblk sack;
2430
2431 memcpy(&sack.start, tmp_cp, sizeof(tcp_seq));
2432 sack.start = ntohl(sack.start);
2433 memcpy(&sack.end, tmp_cp + sizeof(tcp_seq), sizeof(tcp_seq));
2434 sack.end = ntohl(sack.end);
2435 tmp_olen -= TCPOLEN_SACK;
2436 tmp_cp += TCPOLEN_SACK;
2437 if (SEQ_LEQ(sack.end, sack.start))
2438 continue; /* bad SACK fields */
2439 if (SEQ_LEQ(sack.end, tp->snd_una))
2440 continue; /* old block */
2441 if (SEQ_GT(th->th_ack, tp->snd_una)) {
2442 if (SEQ_LT(sack.start, th->th_ack))
2443 continue;
2444 }
2445 if (SEQ_GT(sack.end, tp->snd_max))
2446 continue;
2447 if (tp->snd_holes == NULL) { /* first hole */
2448 tp->snd_holes = (struct sackhole *)
2449 pool_get(&sackhl_pool, PR_NOWAIT);
2450 if (tp->snd_holes == NULL) {
2451 /* ENOBUFS, so ignore SACKed block for now */
2452 goto dropped;
2453 }
2454 cur = tp->snd_holes;
2455 cur->start = th->th_ack;
2456 cur->end = sack.start;
2457 cur->rxmit = cur->start;
2458 cur->next = NULL;
2459 tp->snd_numholes = 1;
2460 tp->rcv_lastsack = sack.end;
2461 /*
2462 * dups is at least one. If more data has been
2463 * SACKed, it can be greater than one.
2464 */
2465 cur->dups = min(tcprexmtthresh,
2466 ((sack.end - cur->end)/tp->t_maxseg));
2467 if (cur->dups < 1)
2468 cur->dups = 1;
2469 continue; /* with next sack block */
2470 }
2471 /* Go thru list of holes: p = previous, cur = current */
2472 p = cur = tp->snd_holes;
2473 while (cur) {
2474 if (SEQ_LEQ(sack.end, cur->start))
2475 /* SACKs data before the current hole */
2476 break; /* no use going through more holes */
2477 if (SEQ_GEQ(sack.start, cur->end)) {
2478 /* SACKs data beyond the current hole */
2479 cur->dups++;
2480 if (((sack.end - cur->end)/tp->t_maxseg) >=
2481 tcprexmtthresh)
2482 cur->dups = tcprexmtthresh;
2483 p = cur;
2484 cur = cur->next;
2485 continue;
2486 }
2487 if (SEQ_LEQ(sack.start, cur->start)) {
2488 /* Data acks at least the beginning of hole */
2489 if (SEQ_GEQ(sack.end, cur->end)) {
2490 /* Acks entire hole, so delete hole */
2491 if (p != cur) {
2492 p->next = cur->next;
2493 pool_put(&sackhl_pool, cur);
2494 cur = p->next;
2495 } else {
2496 cur = cur->next;
2497 pool_put(&sackhl_pool, p);
2498 p = cur;
2499 tp->snd_holes = p;
2500 }
2501 tp->snd_numholes--;
2502 continue;
2503 }
2504 /* otherwise, move start of hole forward */
2505 cur->start = sack.end;
2506 cur->rxmit = SEQ_MAX(cur->rxmit, cur->start);
2507 p = cur;
2508 cur = cur->next;
2509 continue;
2510 }
2511 /* move end of hole backward */
2512 if (SEQ_GEQ(sack.end, cur->end)) {
2513 cur->end = sack.start;
2514 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end);
2515 cur->dups++;
2516 if (((sack.end - cur->end)/tp->t_maxseg) >=
2517 tcprexmtthresh)
2518 cur->dups = tcprexmtthresh;
2519 p = cur;
2520 cur = cur->next;
2521 continue;
2522 }
2523 if (SEQ_LT(cur->start, sack.start) &&
2524 SEQ_GT(cur->end, sack.end)) {
2525 /*
2526 * ACKs some data in middle of a hole; need to
2527 * split current hole
2528 */
2529 if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT)
2530 goto dropped;
2531 temp = (struct sackhole *)
2532 pool_get(&sackhl_pool, PR_NOWAIT);
2533 if (temp == NULL)
2534 goto dropped; /* ENOBUFS */
2535 temp->next = cur->next;
2536 temp->start = sack.end;
2537 temp->end = cur->end;
2538 temp->dups = cur->dups;
2539 temp->rxmit = SEQ_MAX(cur->rxmit, temp->start);
2540 cur->end = sack.start;
2541 cur->rxmit = SEQ_MIN(cur->rxmit, cur->end);
2542 cur->dups++;
2543 if (((sack.end - cur->end)/tp->t_maxseg) >=
2544 tcprexmtthresh)
2545 cur->dups = tcprexmtthresh;
2546 cur->next = temp;
2547 p = temp;
2548 cur = p->next;
2549 tp->snd_numholes++;
2550 }
2551 }
2552 /* At this point, p points to the last hole on the list */
2553 if (SEQ_LT(tp->rcv_lastsack, sack.start)) {
2554 /*
2555 * Need to append new hole at end.
2556 * Last hole is p (and it's not NULL).
2557 */
2558 if (tp->snd_numholes >= TCP_SACKHOLE_LIMIT)
2559 goto dropped;
2560 temp = (struct sackhole *)
2561 pool_get(&sackhl_pool, PR_NOWAIT);
2562 if (temp == NULL)
2563 goto dropped; /* ENOBUFS */
2564 temp->start = tp->rcv_lastsack;
2565 temp->end = sack.start;
2566 temp->dups = min(tcprexmtthresh,
2567 ((sack.end - sack.start)/tp->t_maxseg));
2568 if (temp->dups < 1)
2569 temp->dups = 1;
2570 temp->rxmit = temp->start;
2571 temp->next = 0;
2572 p->next = temp;
2573 tp->rcv_lastsack = sack.end;
2574 tp->snd_numholes++;
2575 }
2576 }
2577 return;
2578 dropped:
2579 tcpstat_inc(tcps_sack_drop_opts);
2580 }
2581
2582 /*
2583 * Delete stale (i.e, cumulatively ack'd) holes. Hole is deleted only if
2584 * it is completely acked; otherwise, tcp_sack_option(), called from
2585 * tcp_dooptions(), will fix up the hole.
2586 */
2587 void
tcp_del_sackholes(struct tcpcb * tp,struct tcphdr * th)2588 tcp_del_sackholes(struct tcpcb *tp, struct tcphdr *th)
2589 {
2590 if (tp->sack_enable && tp->t_state != TCPS_LISTEN) {
2591 /* max because this could be an older ack just arrived */
2592 tcp_seq lastack = SEQ_GT(th->th_ack, tp->snd_una) ?
2593 th->th_ack : tp->snd_una;
2594 struct sackhole *cur = tp->snd_holes;
2595 struct sackhole *prev;
2596 while (cur)
2597 if (SEQ_LEQ(cur->end, lastack)) {
2598 prev = cur;
2599 cur = cur->next;
2600 pool_put(&sackhl_pool, prev);
2601 tp->snd_numholes--;
2602 } else if (SEQ_LT(cur->start, lastack)) {
2603 cur->start = lastack;
2604 if (SEQ_LT(cur->rxmit, cur->start))
2605 cur->rxmit = cur->start;
2606 break;
2607 } else
2608 break;
2609 tp->snd_holes = cur;
2610 }
2611 }
2612
2613 /*
2614 * Delete all receiver-side SACK information.
2615 */
2616 void
tcp_clean_sackreport(struct tcpcb * tp)2617 tcp_clean_sackreport(struct tcpcb *tp)
2618 {
2619 int i;
2620
2621 tp->rcv_numsacks = 0;
2622 for (i = 0; i < MAX_SACK_BLKS; i++)
2623 tp->sackblks[i].start = tp->sackblks[i].end=0;
2624
2625 }
2626
2627 /*
2628 * Partial ack handling within a sack recovery episode. When a partial ack
2629 * arrives, turn off retransmission timer, deflate the window, do not clear
2630 * tp->t_dupacks.
2631 */
2632 void
tcp_sack_partialack(struct tcpcb * tp,struct tcphdr * th)2633 tcp_sack_partialack(struct tcpcb *tp, struct tcphdr *th)
2634 {
2635 /* Turn off retx. timer (will start again next segment) */
2636 TCP_TIMER_DISARM(tp, TCPT_REXMT);
2637 tp->t_rtttime = 0;
2638 /*
2639 * Partial window deflation. This statement relies on the
2640 * fact that tp->snd_una has not been updated yet.
2641 */
2642 if (tp->snd_cwnd > (th->th_ack - tp->snd_una)) {
2643 tp->snd_cwnd -= th->th_ack - tp->snd_una;
2644 tp->snd_cwnd += tp->t_maxseg;
2645 } else
2646 tp->snd_cwnd = tp->t_maxseg;
2647 tp->snd_cwnd += tp->t_maxseg;
2648 tp->t_flags |= TF_NEEDOUTPUT;
2649 }
2650
2651 /*
2652 * Pull out of band byte out of a segment so
2653 * it doesn't appear in the user's data queue.
2654 * It is still reflected in the segment length for
2655 * sequencing purposes.
2656 */
2657 void
tcp_pulloutofband(struct socket * so,u_int urgent,struct mbuf * m,int off)2658 tcp_pulloutofband(struct socket *so, u_int urgent, struct mbuf *m, int off)
2659 {
2660 int cnt = off + urgent - 1;
2661
2662 while (cnt >= 0) {
2663 if (m->m_len > cnt) {
2664 char *cp = mtod(m, caddr_t) + cnt;
2665 struct tcpcb *tp = sototcpcb(so);
2666
2667 tp->t_iobc = *cp;
2668 tp->t_oobflags |= TCPOOB_HAVEDATA;
2669 memmove(cp, cp + 1, m->m_len - cnt - 1);
2670 m->m_len--;
2671 return;
2672 }
2673 cnt -= m->m_len;
2674 m = m->m_next;
2675 if (m == NULL)
2676 break;
2677 }
2678 panic("tcp_pulloutofband");
2679 }
2680
2681 /*
2682 * Collect new round-trip time estimate
2683 * and update averages and current timeout.
2684 */
2685 void
tcp_xmit_timer(struct tcpcb * tp,int32_t rtt)2686 tcp_xmit_timer(struct tcpcb *tp, int32_t rtt)
2687 {
2688 int delta, rttmin;
2689
2690 if (rtt < 0)
2691 rtt = 0;
2692 else if (rtt > TCP_RTT_MAX)
2693 rtt = TCP_RTT_MAX;
2694
2695 tcpstat_inc(tcps_rttupdated);
2696 if (tp->t_srtt != 0) {
2697 /*
2698 * delta is fixed point with 2 (TCP_RTT_BASE_SHIFT) bits
2699 * after the binary point (scaled by 4), whereas
2700 * srtt is stored as fixed point with 5 bits after the
2701 * binary point (i.e., scaled by 32). The following magic
2702 * is equivalent to the smoothing algorithm in rfc793 with
2703 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
2704 * point).
2705 */
2706 delta = (rtt << TCP_RTT_BASE_SHIFT) -
2707 (tp->t_srtt >> TCP_RTT_SHIFT);
2708 if ((tp->t_srtt += delta) <= 0)
2709 tp->t_srtt = 1 << TCP_RTT_BASE_SHIFT;
2710 /*
2711 * We accumulate a smoothed rtt variance (actually, a
2712 * smoothed mean difference), then set the retransmit
2713 * timer to smoothed rtt + 4 times the smoothed variance.
2714 * rttvar is stored as fixed point with 4 bits after the
2715 * binary point (scaled by 16). The following is
2716 * equivalent to rfc793 smoothing with an alpha of .75
2717 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
2718 * rfc793's wired-in beta.
2719 */
2720 if (delta < 0)
2721 delta = -delta;
2722 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
2723 if ((tp->t_rttvar += delta) <= 0)
2724 tp->t_rttvar = 1 << TCP_RTT_BASE_SHIFT;
2725 } else {
2726 /*
2727 * No rtt measurement yet - use the unsmoothed rtt.
2728 * Set the variance to half the rtt (so our first
2729 * retransmit happens at 3*rtt).
2730 */
2731 tp->t_srtt = (rtt + 1) << (TCP_RTT_SHIFT + TCP_RTT_BASE_SHIFT);
2732 tp->t_rttvar = (rtt + 1) <<
2733 (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1);
2734 }
2735 tp->t_rtttime = 0;
2736 tp->t_rxtshift = 0;
2737
2738 /*
2739 * the retransmit should happen at rtt + 4 * rttvar.
2740 * Because of the way we do the smoothing, srtt and rttvar
2741 * will each average +1/2 tick of bias. When we compute
2742 * the retransmit timer, we want 1/2 tick of rounding and
2743 * 1 extra tick because of +-1/2 tick uncertainty in the
2744 * firing of the timer. The bias will give us exactly the
2745 * 1.5 tick we need. But, because the bias is
2746 * statistical, we have to test that we don't drop below
2747 * the minimum feasible timer (which is 2 ticks).
2748 */
2749 rttmin = min(max(tp->t_rttmin, rtt + 2 * (TCP_TIME(1) / hz)),
2750 TCPTV_REXMTMAX);
2751 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), rttmin, TCPTV_REXMTMAX);
2752
2753 /*
2754 * We received an ack for a packet that wasn't retransmitted;
2755 * it is probably safe to discard any error indications we've
2756 * received recently. This isn't quite right, but close enough
2757 * for now (a route might have failed after we sent a segment,
2758 * and the return path might not be symmetrical).
2759 */
2760 tp->t_softerror = 0;
2761 }
2762
2763 /*
2764 * Determine a reasonable value for maxseg size.
2765 * If the route is known, check route for mtu.
2766 * If none, use an mss that can be handled on the outgoing
2767 * interface without forcing IP to fragment; if bigger than
2768 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
2769 * to utilize large mbufs. If no route is found, route has no mtu,
2770 * or the destination isn't local, use a default, hopefully conservative
2771 * size (usually 512 or the default IP max size, but no more than the mtu
2772 * of the interface), as we can't discover anything about intervening
2773 * gateways or networks. We also initialize the congestion/slow start
2774 * window to be a single segment if the destination isn't local.
2775 * While looking at the routing entry, we also initialize other path-dependent
2776 * parameters from pre-set or cached values in the routing entry.
2777 *
2778 * Also take into account the space needed for options that we
2779 * send regularly. Make maxseg shorter by that amount to assure
2780 * that we can send maxseg amount of data even when the options
2781 * are present. Store the upper limit of the length of options plus
2782 * data in maxopd.
2783 *
2784 * NOTE: offer == -1 indicates that the maxseg size changed due to
2785 * Path MTU discovery.
2786 */
2787 int
tcp_mss(struct tcpcb * tp,int offer)2788 tcp_mss(struct tcpcb *tp, int offer)
2789 {
2790 struct rtentry *rt;
2791 struct ifnet *ifp = NULL;
2792 int mss, mssopt;
2793 int iphlen;
2794 struct inpcb *inp;
2795
2796 inp = tp->t_inpcb;
2797
2798 mssopt = mss = tcp_mssdflt;
2799
2800 rt = in_pcbrtentry(inp);
2801
2802 if (rt == NULL)
2803 goto out;
2804
2805 ifp = if_get(rt->rt_ifidx);
2806 if (ifp == NULL)
2807 goto out;
2808
2809 switch (tp->pf) {
2810 #ifdef INET6
2811 case AF_INET6:
2812 iphlen = sizeof(struct ip6_hdr);
2813 break;
2814 #endif
2815 case AF_INET:
2816 iphlen = sizeof(struct ip);
2817 break;
2818 default:
2819 /* the family does not support path MTU discovery */
2820 goto out;
2821 }
2822
2823 /*
2824 * if there's an mtu associated with the route and we support
2825 * path MTU discovery for the underlying protocol family, use it.
2826 */
2827 if (rt->rt_mtu) {
2828 /*
2829 * One may wish to lower MSS to take into account options,
2830 * especially security-related options.
2831 */
2832 if (tp->pf == AF_INET6 && rt->rt_mtu < IPV6_MMTU) {
2833 /*
2834 * RFC2460 section 5, last paragraph: if path MTU is
2835 * smaller than 1280, use 1280 as packet size and
2836 * attach fragment header.
2837 */
2838 mss = IPV6_MMTU - iphlen - sizeof(struct ip6_frag) -
2839 sizeof(struct tcphdr);
2840 } else {
2841 mss = rt->rt_mtu - iphlen -
2842 sizeof(struct tcphdr);
2843 }
2844 } else if (ifp->if_flags & IFF_LOOPBACK) {
2845 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
2846 } else if (tp->pf == AF_INET) {
2847 if (ip_mtudisc)
2848 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
2849 }
2850 #ifdef INET6
2851 else if (tp->pf == AF_INET6) {
2852 /*
2853 * for IPv6, path MTU discovery is always turned on,
2854 * or the node must use packet size <= 1280.
2855 */
2856 mss = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
2857 }
2858 #endif /* INET6 */
2859
2860 /* Calculate the value that we offer in TCPOPT_MAXSEG */
2861 if (offer != -1) {
2862 mssopt = ifp->if_mtu - iphlen - sizeof(struct tcphdr);
2863 mssopt = max(tcp_mssdflt, mssopt);
2864 }
2865 out:
2866 if_put(ifp);
2867 /*
2868 * The current mss, t_maxseg, is initialized to the default value.
2869 * If we compute a smaller value, reduce the current mss.
2870 * If we compute a larger value, return it for use in sending
2871 * a max seg size option, but don't store it for use
2872 * unless we received an offer at least that large from peer.
2873 *
2874 * However, do not accept offers lower than the minimum of
2875 * the interface MTU and 216.
2876 */
2877 if (offer > 0)
2878 tp->t_peermss = offer;
2879 if (tp->t_peermss)
2880 mss = min(mss, max(tp->t_peermss, 216));
2881
2882 /* sanity - at least max opt. space */
2883 mss = max(mss, 64);
2884
2885 /*
2886 * maxopd stores the maximum length of data AND options
2887 * in a segment; maxseg is the amount of data in a normal
2888 * segment. We need to store this value (maxopd) apart
2889 * from maxseg, because now every segment carries options
2890 * and thus we normally have somewhat less data in segments.
2891 */
2892 tp->t_maxopd = mss;
2893
2894 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2895 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
2896 mss -= TCPOLEN_TSTAMP_APPA;
2897 #ifdef TCP_SIGNATURE
2898 if (tp->t_flags & TF_SIGNATURE)
2899 mss -= TCPOLEN_SIGLEN;
2900 #endif
2901
2902 if (offer == -1) {
2903 /* mss changed due to Path MTU discovery */
2904 tp->t_flags &= ~TF_PMTUD_PEND;
2905 tp->t_pmtud_mtu_sent = 0;
2906 tp->t_pmtud_mss_acked = 0;
2907 if (mss < tp->t_maxseg) {
2908 /*
2909 * Follow suggestion in RFC 2414 to reduce the
2910 * congestion window by the ratio of the old
2911 * segment size to the new segment size.
2912 */
2913 tp->snd_cwnd = ulmax((tp->snd_cwnd / tp->t_maxseg) *
2914 mss, mss);
2915 }
2916 } else if (tcp_do_rfc3390 == 2) {
2917 /* increase initial window */
2918 tp->snd_cwnd = ulmin(10 * mss, ulmax(2 * mss, 14600));
2919 } else if (tcp_do_rfc3390) {
2920 /* increase initial window */
2921 tp->snd_cwnd = ulmin(4 * mss, ulmax(2 * mss, 4380));
2922 } else
2923 tp->snd_cwnd = mss;
2924
2925 tp->t_maxseg = mss;
2926
2927 return (offer != -1 ? mssopt : mss);
2928 }
2929
2930 u_int
tcp_hdrsz(struct tcpcb * tp)2931 tcp_hdrsz(struct tcpcb *tp)
2932 {
2933 u_int hlen;
2934
2935 switch (tp->pf) {
2936 #ifdef INET6
2937 case AF_INET6:
2938 hlen = sizeof(struct ip6_hdr);
2939 break;
2940 #endif
2941 case AF_INET:
2942 hlen = sizeof(struct ip);
2943 break;
2944 default:
2945 hlen = 0;
2946 break;
2947 }
2948 hlen += sizeof(struct tcphdr);
2949
2950 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
2951 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)
2952 hlen += TCPOLEN_TSTAMP_APPA;
2953 #ifdef TCP_SIGNATURE
2954 if (tp->t_flags & TF_SIGNATURE)
2955 hlen += TCPOLEN_SIGLEN;
2956 #endif
2957 return (hlen);
2958 }
2959
2960 /*
2961 * Set connection variables based on the effective MSS.
2962 * We are passed the TCPCB for the actual connection. If we
2963 * are the server, we are called by the compressed state engine
2964 * when the 3-way handshake is complete. If we are the client,
2965 * we are called when we receive the SYN,ACK from the server.
2966 *
2967 * NOTE: The t_maxseg value must be initialized in the TCPCB
2968 * before this routine is called!
2969 */
2970 void
tcp_mss_update(struct tcpcb * tp)2971 tcp_mss_update(struct tcpcb *tp)
2972 {
2973 int mss;
2974 u_long bufsize;
2975 struct rtentry *rt;
2976 struct socket *so;
2977
2978 so = tp->t_inpcb->inp_socket;
2979 mss = tp->t_maxseg;
2980
2981 rt = in_pcbrtentry(tp->t_inpcb);
2982
2983 if (rt == NULL)
2984 return;
2985
2986 bufsize = so->so_snd.sb_hiwat;
2987 if (bufsize < mss) {
2988 mss = bufsize;
2989 /* Update t_maxseg and t_maxopd */
2990 tcp_mss(tp, mss);
2991 } else {
2992 bufsize = roundup(bufsize, mss);
2993 if (bufsize > sb_max)
2994 bufsize = sb_max;
2995 (void)sbreserve(so, &so->so_snd, bufsize);
2996 }
2997
2998 bufsize = so->so_rcv.sb_hiwat;
2999 if (bufsize > mss) {
3000 bufsize = roundup(bufsize, mss);
3001 if (bufsize > sb_max)
3002 bufsize = sb_max;
3003 (void)sbreserve(so, &so->so_rcv, bufsize);
3004 }
3005
3006 }
3007
3008 /*
3009 * When a partial ack arrives, force the retransmission of the
3010 * next unacknowledged segment. Do not clear tp->t_dupacks.
3011 * By setting snd_nxt to ti_ack, this forces retransmission timer
3012 * to be started again.
3013 */
3014 void
tcp_newreno_partialack(struct tcpcb * tp,struct tcphdr * th)3015 tcp_newreno_partialack(struct tcpcb *tp, struct tcphdr *th)
3016 {
3017 /*
3018 * snd_una has not been updated and the socket send buffer
3019 * not yet drained of the acked data, so we have to leave
3020 * snd_una as it was to get the correct data offset in
3021 * tcp_output().
3022 */
3023 tcp_seq onxt = tp->snd_nxt;
3024 u_long ocwnd = tp->snd_cwnd;
3025
3026 TCP_TIMER_DISARM(tp, TCPT_REXMT);
3027 tp->t_rtttime = 0;
3028 tp->snd_nxt = th->th_ack;
3029 /*
3030 * Set snd_cwnd to one segment beyond acknowledged offset
3031 * (tp->snd_una not yet updated when this function is called)
3032 */
3033 tp->snd_cwnd = tp->t_maxseg + (th->th_ack - tp->snd_una);
3034 (void)tcp_output(tp);
3035 tp->snd_cwnd = ocwnd;
3036 if (SEQ_GT(onxt, tp->snd_nxt))
3037 tp->snd_nxt = onxt;
3038 /*
3039 * Partial window deflation. Relies on fact that tp->snd_una
3040 * not updated yet.
3041 */
3042 if (tp->snd_cwnd > th->th_ack - tp->snd_una)
3043 tp->snd_cwnd -= th->th_ack - tp->snd_una;
3044 else
3045 tp->snd_cwnd = 0;
3046 tp->snd_cwnd += tp->t_maxseg;
3047 }
3048
3049 int
tcp_mss_adv(struct mbuf * m,int af)3050 tcp_mss_adv(struct mbuf *m, int af)
3051 {
3052 int mss = 0;
3053 int iphlen;
3054 struct ifnet *ifp = NULL;
3055
3056 if (m && (m->m_flags & M_PKTHDR))
3057 ifp = if_get(m->m_pkthdr.ph_ifidx);
3058
3059 switch (af) {
3060 case AF_INET:
3061 if (ifp != NULL)
3062 mss = ifp->if_mtu;
3063 iphlen = sizeof(struct ip);
3064 break;
3065 #ifdef INET6
3066 case AF_INET6:
3067 if (ifp != NULL)
3068 mss = ifp->if_mtu;
3069 iphlen = sizeof(struct ip6_hdr);
3070 break;
3071 #endif
3072 default:
3073 unhandled_af(af);
3074 }
3075 if_put(ifp);
3076 mss = mss - iphlen - sizeof(struct tcphdr);
3077 return (max(mss, tcp_mssdflt));
3078 }
3079
3080 /*
3081 * TCP compressed state engine. Currently used to hold compressed
3082 * state for SYN_RECEIVED.
3083 */
3084
3085 /*
3086 * Locks used to protect global data and struct members:
3087 * N net lock
3088 * S syn_cache_mtx tcp syn cache global mutex
3089 */
3090
3091 /* syn hash parameters */
3092 int tcp_syn_hash_size = TCP_SYN_HASH_SIZE; /* [N] size of hash table */
3093 int tcp_syn_cache_limit = /* [N] global entry limit */
3094 TCP_SYN_HASH_SIZE * TCP_SYN_BUCKET_SIZE;
3095 int tcp_syn_bucket_limit = /* [N] per bucket limit */
3096 3 * TCP_SYN_BUCKET_SIZE;
3097 int tcp_syn_use_limit = 100000; /* [N] reseed after uses */
3098
3099 struct pool syn_cache_pool;
3100 struct syn_cache_set tcp_syn_cache[2];
3101 int tcp_syn_cache_active;
3102 struct mutex syn_cache_mtx = MUTEX_INITIALIZER(IPL_SOFTNET);
3103
3104 #define SYN_HASH(sa, sp, dp, rand) \
3105 (((sa)->s_addr ^ (rand)[0]) * \
3106 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4]))
3107 #ifndef INET6
3108 #define SYN_HASHALL(hash, src, dst, rand) \
3109 do { \
3110 hash = SYN_HASH(&satosin_const(src)->sin_addr, \
3111 satosin_const(src)->sin_port, \
3112 satosin_const(dst)->sin_port, (rand)); \
3113 } while (/*CONSTCOND*/ 0)
3114 #else
3115 #define SYN_HASH6(sa, sp, dp, rand) \
3116 (((sa)->s6_addr32[0] ^ (rand)[0]) * \
3117 ((sa)->s6_addr32[1] ^ (rand)[1]) * \
3118 ((sa)->s6_addr32[2] ^ (rand)[2]) * \
3119 ((sa)->s6_addr32[3] ^ (rand)[3]) * \
3120 (((((u_int32_t)(dp))<<16) + ((u_int32_t)(sp))) ^ (rand)[4]))
3121
3122 #define SYN_HASHALL(hash, src, dst, rand) \
3123 do { \
3124 switch ((src)->sa_family) { \
3125 case AF_INET: \
3126 hash = SYN_HASH(&satosin_const(src)->sin_addr, \
3127 satosin_const(src)->sin_port, \
3128 satosin_const(dst)->sin_port, (rand)); \
3129 break; \
3130 case AF_INET6: \
3131 hash = SYN_HASH6(&satosin6_const(src)->sin6_addr, \
3132 satosin6_const(src)->sin6_port, \
3133 satosin6_const(dst)->sin6_port, (rand)); \
3134 break; \
3135 default: \
3136 hash = 0; \
3137 } \
3138 } while (/*CONSTCOND*/0)
3139 #endif /* INET6 */
3140
3141 void
syn_cache_rm(struct syn_cache * sc)3142 syn_cache_rm(struct syn_cache *sc)
3143 {
3144 MUTEX_ASSERT_LOCKED(&syn_cache_mtx);
3145
3146 KASSERT(!ISSET(sc->sc_dynflags, SCF_DEAD));
3147 SET(sc->sc_dynflags, SCF_DEAD);
3148 TAILQ_REMOVE(&sc->sc_buckethead->sch_bucket, sc, sc_bucketq);
3149 sc->sc_tp = NULL;
3150 LIST_REMOVE(sc, sc_tpq);
3151 refcnt_rele(&sc->sc_refcnt);
3152 sc->sc_buckethead->sch_length--;
3153 if (timeout_del(&sc->sc_timer))
3154 refcnt_rele(&sc->sc_refcnt);
3155 sc->sc_set->scs_count--;
3156 }
3157
3158 void
syn_cache_put(struct syn_cache * sc)3159 syn_cache_put(struct syn_cache *sc)
3160 {
3161 if (refcnt_rele(&sc->sc_refcnt) == 0)
3162 return;
3163
3164 /* Dealing with last reference, no lock needed. */
3165 m_free(sc->sc_ipopts);
3166 rtfree(sc->sc_route.ro_rt);
3167
3168 pool_put(&syn_cache_pool, sc);
3169 }
3170
3171 void
syn_cache_init(void)3172 syn_cache_init(void)
3173 {
3174 int i;
3175
3176 /* Initialize the hash buckets. */
3177 tcp_syn_cache[0].scs_buckethead = mallocarray(tcp_syn_hash_size,
3178 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO);
3179 tcp_syn_cache[1].scs_buckethead = mallocarray(tcp_syn_hash_size,
3180 sizeof(struct syn_cache_head), M_SYNCACHE, M_WAITOK|M_ZERO);
3181 tcp_syn_cache[0].scs_size = tcp_syn_hash_size;
3182 tcp_syn_cache[1].scs_size = tcp_syn_hash_size;
3183 for (i = 0; i < tcp_syn_hash_size; i++) {
3184 TAILQ_INIT(&tcp_syn_cache[0].scs_buckethead[i].sch_bucket);
3185 TAILQ_INIT(&tcp_syn_cache[1].scs_buckethead[i].sch_bucket);
3186 }
3187
3188 /* Initialize the syn cache pool. */
3189 pool_init(&syn_cache_pool, sizeof(struct syn_cache), 0, IPL_SOFTNET,
3190 0, "syncache", NULL);
3191 }
3192
3193 void
syn_cache_insert(struct syn_cache * sc,struct tcpcb * tp)3194 syn_cache_insert(struct syn_cache *sc, struct tcpcb *tp)
3195 {
3196 struct syn_cache_set *set = &tcp_syn_cache[tcp_syn_cache_active];
3197 struct syn_cache_head *scp;
3198 struct syn_cache *sc2;
3199 int i;
3200
3201 NET_ASSERT_LOCKED();
3202 MUTEX_ASSERT_LOCKED(&syn_cache_mtx);
3203
3204 /*
3205 * If there are no entries in the hash table, reinitialize
3206 * the hash secrets. To avoid useless cache swaps and
3207 * reinitialization, use it until the limit is reached.
3208 * An empty cache is also the opportunity to resize the hash.
3209 */
3210 if (set->scs_count == 0 && set->scs_use <= 0) {
3211 set->scs_use = tcp_syn_use_limit;
3212 if (set->scs_size != tcp_syn_hash_size) {
3213 scp = mallocarray(tcp_syn_hash_size, sizeof(struct
3214 syn_cache_head), M_SYNCACHE, M_NOWAIT|M_ZERO);
3215 if (scp == NULL) {
3216 /* Try again next time. */
3217 set->scs_use = 0;
3218 } else {
3219 free(set->scs_buckethead, M_SYNCACHE,
3220 set->scs_size *
3221 sizeof(struct syn_cache_head));
3222 set->scs_buckethead = scp;
3223 set->scs_size = tcp_syn_hash_size;
3224 for (i = 0; i < tcp_syn_hash_size; i++)
3225 TAILQ_INIT(&scp[i].sch_bucket);
3226 }
3227 }
3228 arc4random_buf(set->scs_random, sizeof(set->scs_random));
3229 tcpstat_inc(tcps_sc_seedrandom);
3230 }
3231
3232 SYN_HASHALL(sc->sc_hash, &sc->sc_src.sa, &sc->sc_dst.sa,
3233 set->scs_random);
3234 scp = &set->scs_buckethead[sc->sc_hash % set->scs_size];
3235 sc->sc_buckethead = scp;
3236
3237 /*
3238 * Make sure that we don't overflow the per-bucket
3239 * limit or the total cache size limit.
3240 */
3241 if (scp->sch_length >= tcp_syn_bucket_limit) {
3242 tcpstat_inc(tcps_sc_bucketoverflow);
3243 /*
3244 * Someone might attack our bucket hash function. Reseed
3245 * with random as soon as the passive syn cache gets empty.
3246 */
3247 set->scs_use = 0;
3248 /*
3249 * The bucket is full. Toss the oldest element in the
3250 * bucket. This will be the first entry in the bucket.
3251 */
3252 sc2 = TAILQ_FIRST(&scp->sch_bucket);
3253 #ifdef DIAGNOSTIC
3254 /*
3255 * This should never happen; we should always find an
3256 * entry in our bucket.
3257 */
3258 if (sc2 == NULL)
3259 panic("%s: bucketoverflow: impossible", __func__);
3260 #endif
3261 syn_cache_rm(sc2);
3262 syn_cache_put(sc2);
3263 } else if (set->scs_count >= tcp_syn_cache_limit) {
3264 struct syn_cache_head *scp2, *sce;
3265
3266 tcpstat_inc(tcps_sc_overflowed);
3267 /*
3268 * The cache is full. Toss the oldest entry in the
3269 * first non-empty bucket we can find.
3270 *
3271 * XXX We would really like to toss the oldest
3272 * entry in the cache, but we hope that this
3273 * condition doesn't happen very often.
3274 */
3275 scp2 = scp;
3276 if (TAILQ_EMPTY(&scp2->sch_bucket)) {
3277 sce = &set->scs_buckethead[set->scs_size];
3278 for (++scp2; scp2 != scp; scp2++) {
3279 if (scp2 >= sce)
3280 scp2 = &set->scs_buckethead[0];
3281 if (! TAILQ_EMPTY(&scp2->sch_bucket))
3282 break;
3283 }
3284 #ifdef DIAGNOSTIC
3285 /*
3286 * This should never happen; we should always find a
3287 * non-empty bucket.
3288 */
3289 if (scp2 == scp)
3290 panic("%s: cacheoverflow: impossible",
3291 __func__);
3292 #endif
3293 }
3294 sc2 = TAILQ_FIRST(&scp2->sch_bucket);
3295 syn_cache_rm(sc2);
3296 syn_cache_put(sc2);
3297 }
3298
3299 /*
3300 * Initialize the entry's timer. We don't estimate RTT
3301 * with SYNs, so each packet starts with the default RTT
3302 * and each timer step has a fixed timeout value.
3303 */
3304 sc->sc_rxttot = 0;
3305 sc->sc_rxtshift = 0;
3306 TCPT_RANGESET(sc->sc_rxtcur,
3307 TCPTV_SRTTDFLT * tcp_backoff[sc->sc_rxtshift], TCPTV_MIN,
3308 TCPTV_REXMTMAX);
3309 if (timeout_add_msec(&sc->sc_timer, sc->sc_rxtcur))
3310 refcnt_take(&sc->sc_refcnt);
3311
3312 /* Link it from tcpcb entry */
3313 refcnt_take(&sc->sc_refcnt);
3314 LIST_INSERT_HEAD(&tp->t_sc, sc, sc_tpq);
3315
3316 /* Put it into the bucket. */
3317 TAILQ_INSERT_TAIL(&scp->sch_bucket, sc, sc_bucketq);
3318 scp->sch_length++;
3319 sc->sc_set = set;
3320 set->scs_count++;
3321 set->scs_use--;
3322
3323 tcpstat_inc(tcps_sc_added);
3324
3325 /*
3326 * If the active cache has exceeded its use limit and
3327 * the passive syn cache is empty, exchange their roles.
3328 */
3329 if (set->scs_use <= 0 &&
3330 tcp_syn_cache[!tcp_syn_cache_active].scs_count == 0)
3331 tcp_syn_cache_active = !tcp_syn_cache_active;
3332 }
3333
3334 /*
3335 * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
3336 * If we have retransmitted an entry the maximum number of times, expire
3337 * that entry.
3338 */
3339 void
syn_cache_timer(void * arg)3340 syn_cache_timer(void *arg)
3341 {
3342 struct syn_cache *sc = arg;
3343 uint64_t now;
3344 int lastref;
3345
3346 mtx_enter(&syn_cache_mtx);
3347 if (ISSET(sc->sc_dynflags, SCF_DEAD))
3348 goto freeit;
3349
3350 if (__predict_false(sc->sc_rxtshift == TCP_MAXRXTSHIFT)) {
3351 /* Drop it -- too many retransmissions. */
3352 goto dropit;
3353 }
3354
3355 /*
3356 * Compute the total amount of time this entry has
3357 * been on a queue. If this entry has been on longer
3358 * than the keep alive timer would allow, expire it.
3359 */
3360 sc->sc_rxttot += sc->sc_rxtcur;
3361 if (sc->sc_rxttot >= READ_ONCE(tcptv_keep_init))
3362 goto dropit;
3363
3364 /* Advance the timer back-off. */
3365 sc->sc_rxtshift++;
3366 TCPT_RANGESET(sc->sc_rxtcur,
3367 TCPTV_SRTTDFLT * tcp_backoff[sc->sc_rxtshift], TCPTV_MIN,
3368 TCPTV_REXMTMAX);
3369 if (timeout_add_msec(&sc->sc_timer, sc->sc_rxtcur))
3370 refcnt_take(&sc->sc_refcnt);
3371 mtx_leave(&syn_cache_mtx);
3372
3373 NET_LOCK();
3374 now = tcp_now();
3375 (void) syn_cache_respond(sc, NULL, now);
3376 tcpstat_inc(tcps_sc_retransmitted);
3377 NET_UNLOCK();
3378
3379 syn_cache_put(sc);
3380 return;
3381
3382 dropit:
3383 tcpstat_inc(tcps_sc_timed_out);
3384 syn_cache_rm(sc);
3385 /* Decrement reference of the timer and free object after remove. */
3386 lastref = refcnt_rele(&sc->sc_refcnt);
3387 KASSERT(lastref == 0);
3388 (void)lastref;
3389 freeit:
3390 mtx_leave(&syn_cache_mtx);
3391 syn_cache_put(sc);
3392 }
3393
3394 /*
3395 * Remove syn cache created by the specified tcb entry,
3396 * because this does not make sense to keep them
3397 * (if there's no tcb entry, syn cache entry will never be used)
3398 */
3399 void
syn_cache_cleanup(struct tcpcb * tp)3400 syn_cache_cleanup(struct tcpcb *tp)
3401 {
3402 struct syn_cache *sc, *nsc;
3403
3404 NET_ASSERT_LOCKED();
3405
3406 mtx_enter(&syn_cache_mtx);
3407 LIST_FOREACH_SAFE(sc, &tp->t_sc, sc_tpq, nsc) {
3408 #ifdef DIAGNOSTIC
3409 if (sc->sc_tp != tp)
3410 panic("invalid sc_tp in syn_cache_cleanup");
3411 #endif
3412 syn_cache_rm(sc);
3413 syn_cache_put(sc);
3414 }
3415 mtx_leave(&syn_cache_mtx);
3416
3417 KASSERT(LIST_EMPTY(&tp->t_sc));
3418 }
3419
3420 /*
3421 * Find an entry in the syn cache.
3422 */
3423 struct syn_cache *
syn_cache_lookup(const struct sockaddr * src,const struct sockaddr * dst,struct syn_cache_head ** headp,u_int rtableid)3424 syn_cache_lookup(const struct sockaddr *src, const struct sockaddr *dst,
3425 struct syn_cache_head **headp, u_int rtableid)
3426 {
3427 struct syn_cache_set *sets[2];
3428 struct syn_cache *sc;
3429 struct syn_cache_head *scp;
3430 u_int32_t hash;
3431 int i;
3432
3433 NET_ASSERT_LOCKED();
3434 MUTEX_ASSERT_LOCKED(&syn_cache_mtx);
3435
3436 /* Check the active cache first, the passive cache is likely empty. */
3437 sets[0] = &tcp_syn_cache[tcp_syn_cache_active];
3438 sets[1] = &tcp_syn_cache[!tcp_syn_cache_active];
3439 for (i = 0; i < 2; i++) {
3440 if (sets[i]->scs_count == 0)
3441 continue;
3442 SYN_HASHALL(hash, src, dst, sets[i]->scs_random);
3443 scp = &sets[i]->scs_buckethead[hash % sets[i]->scs_size];
3444 *headp = scp;
3445 TAILQ_FOREACH(sc, &scp->sch_bucket, sc_bucketq) {
3446 if (sc->sc_hash != hash)
3447 continue;
3448 if (!bcmp(&sc->sc_src, src, src->sa_len) &&
3449 !bcmp(&sc->sc_dst, dst, dst->sa_len) &&
3450 rtable_l2(rtableid) == rtable_l2(sc->sc_rtableid))
3451 return (sc);
3452 }
3453 }
3454 return (NULL);
3455 }
3456
3457 /*
3458 * This function gets called when we receive an ACK for a
3459 * socket in the LISTEN state. We look up the connection
3460 * in the syn cache, and if its there, we pull it out of
3461 * the cache and turn it into a full-blown connection in
3462 * the SYN-RECEIVED state.
3463 *
3464 * The return values may not be immediately obvious, and their effects
3465 * can be subtle, so here they are:
3466 *
3467 * NULL SYN was not found in cache; caller should drop the
3468 * packet and send an RST.
3469 *
3470 * -1 We were unable to create the new connection, and are
3471 * aborting it. An ACK,RST is being sent to the peer
3472 * (unless we got screwy sequence numbers; see below),
3473 * because the 3-way handshake has been completed. Caller
3474 * should not free the mbuf, since we may be using it. If
3475 * we are not, we will free it.
3476 *
3477 * Otherwise, the return value is a pointer to the new socket
3478 * associated with the connection.
3479 */
3480 struct socket *
syn_cache_get(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th,u_int hlen,u_int tlen,struct socket * so,struct mbuf * m,uint64_t now)3481 syn_cache_get(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
3482 u_int hlen, u_int tlen, struct socket *so, struct mbuf *m, uint64_t now)
3483 {
3484 struct syn_cache *sc;
3485 struct syn_cache_head *scp;
3486 struct inpcb *inp, *oldinp;
3487 struct tcpcb *tp = NULL;
3488 struct mbuf *am;
3489 struct socket *oso;
3490 u_int rtableid;
3491
3492 NET_ASSERT_LOCKED();
3493
3494 mtx_enter(&syn_cache_mtx);
3495 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid);
3496 if (sc == NULL) {
3497 mtx_leave(&syn_cache_mtx);
3498 return (NULL);
3499 }
3500
3501 /*
3502 * Verify the sequence and ack numbers. Try getting the correct
3503 * response again.
3504 */
3505 if ((th->th_ack != sc->sc_iss + 1) ||
3506 SEQ_LEQ(th->th_seq, sc->sc_irs) ||
3507 SEQ_GT(th->th_seq, sc->sc_irs + 1 + sc->sc_win)) {
3508 refcnt_take(&sc->sc_refcnt);
3509 mtx_leave(&syn_cache_mtx);
3510 (void) syn_cache_respond(sc, m, now);
3511 syn_cache_put(sc);
3512 return ((struct socket *)(-1));
3513 }
3514
3515 /* Remove this cache entry */
3516 syn_cache_rm(sc);
3517 mtx_leave(&syn_cache_mtx);
3518
3519 /*
3520 * Ok, create the full blown connection, and set things up
3521 * as they would have been set up if we had created the
3522 * connection when the SYN arrived. If we can't create
3523 * the connection, abort it.
3524 */
3525 oso = so;
3526 so = sonewconn(so, SS_ISCONNECTED, M_DONTWAIT);
3527 if (so == NULL)
3528 goto resetandabort;
3529
3530 oldinp = sotoinpcb(oso);
3531 inp = sotoinpcb(so);
3532
3533 #ifdef IPSEC
3534 /*
3535 * We need to copy the required security levels
3536 * from the old pcb. Ditto for any other
3537 * IPsec-related information.
3538 */
3539 inp->inp_seclevel = oldinp->inp_seclevel;
3540 #endif /* IPSEC */
3541 #ifdef INET6
3542 if (ISSET(inp->inp_flags, INP_IPV6)) {
3543 KASSERT(ISSET(oldinp->inp_flags, INP_IPV6));
3544
3545 inp->inp_ipv6.ip6_hlim = oldinp->inp_ipv6.ip6_hlim;
3546 inp->inp_hops = oldinp->inp_hops;
3547 } else
3548 #endif
3549 {
3550 KASSERT(!ISSET(oldinp->inp_flags, INP_IPV6));
3551
3552 inp->inp_ip.ip_ttl = oldinp->inp_ip.ip_ttl;
3553 inp->inp_options = ip_srcroute(m);
3554 if (inp->inp_options == NULL) {
3555 inp->inp_options = sc->sc_ipopts;
3556 sc->sc_ipopts = NULL;
3557 }
3558 }
3559
3560 /* inherit rtable from listening socket */
3561 rtableid = sc->sc_rtableid;
3562 #if NPF > 0
3563 if (m->m_pkthdr.pf.flags & PF_TAG_DIVERTED) {
3564 struct pf_divert *divert;
3565
3566 divert = pf_find_divert(m);
3567 KASSERT(divert != NULL);
3568 rtableid = divert->rdomain;
3569 }
3570 #endif
3571 in_pcbset_laddr(inp, dst, rtableid);
3572
3573 /*
3574 * Give the new socket our cached route reference.
3575 */
3576 inp->inp_route = sc->sc_route; /* struct assignment */
3577 sc->sc_route.ro_rt = NULL;
3578
3579 am = m_get(M_DONTWAIT, MT_SONAME); /* XXX */
3580 if (am == NULL)
3581 goto resetandabort;
3582 am->m_len = src->sa_len;
3583 memcpy(mtod(am, caddr_t), src, src->sa_len);
3584 if (in_pcbconnect(inp, am)) {
3585 (void) m_free(am);
3586 goto resetandabort;
3587 }
3588 (void) m_free(am);
3589
3590 tp = intotcpcb(inp);
3591 tp->t_flags = sototcpcb(oso)->t_flags & (TF_NOPUSH|TF_NODELAY);
3592 if (sc->sc_request_r_scale != 15) {
3593 tp->requested_s_scale = sc->sc_requested_s_scale;
3594 tp->request_r_scale = sc->sc_request_r_scale;
3595 tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
3596 }
3597 if (ISSET(sc->sc_fixflags, SCF_TIMESTAMP))
3598 tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
3599
3600 tp->t_template = tcp_template(tp);
3601 if (tp->t_template == 0) {
3602 tp = tcp_drop(tp, ENOBUFS); /* destroys socket */
3603 so = NULL;
3604 goto abort;
3605 }
3606 tp->sack_enable = ISSET(sc->sc_fixflags, SCF_SACK_PERMIT);
3607 tp->ts_modulate = sc->sc_modulate;
3608 tp->ts_recent = sc->sc_timestamp;
3609 tp->iss = sc->sc_iss;
3610 tp->irs = sc->sc_irs;
3611 tcp_sendseqinit(tp);
3612 tp->snd_last = tp->snd_una;
3613 #ifdef TCP_ECN
3614 if (ISSET(sc->sc_fixflags, SCF_ECN_PERMIT)) {
3615 tp->t_flags |= TF_ECN_PERMIT;
3616 tcpstat_inc(tcps_ecn_accepts);
3617 }
3618 #endif
3619 if (ISSET(sc->sc_fixflags, SCF_SACK_PERMIT))
3620 tp->t_flags |= TF_SACK_PERMIT;
3621 #ifdef TCP_SIGNATURE
3622 if (ISSET(sc->sc_fixflags, SCF_SIGNATURE))
3623 tp->t_flags |= TF_SIGNATURE;
3624 #endif
3625 tcp_rcvseqinit(tp);
3626 tp->t_state = TCPS_SYN_RECEIVED;
3627 tp->t_rcvtime = now;
3628 tp->t_sndtime = now;
3629 tp->t_rcvacktime = now;
3630 tp->t_sndacktime = now;
3631 TCP_TIMER_ARM(tp, TCPT_KEEP, tcptv_keep_init);
3632 tcpstat_inc(tcps_accepts);
3633
3634 tcp_mss(tp, sc->sc_peermaxseg); /* sets t_maxseg */
3635 if (sc->sc_peermaxseg)
3636 tcp_mss_update(tp);
3637 /* Reset initial window to 1 segment for retransmit */
3638 if (READ_ONCE(sc->sc_rxtshift) > 0)
3639 tp->snd_cwnd = tp->t_maxseg;
3640 tp->snd_wl1 = sc->sc_irs;
3641 tp->rcv_up = sc->sc_irs + 1;
3642
3643 /*
3644 * This is what would have happened in tcp_output() when
3645 * the SYN,ACK was sent.
3646 */
3647 tp->snd_up = tp->snd_una;
3648 tp->snd_max = tp->snd_nxt = tp->iss+1;
3649 TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
3650 if (sc->sc_win > 0 && SEQ_GT(tp->rcv_nxt + sc->sc_win, tp->rcv_adv))
3651 tp->rcv_adv = tp->rcv_nxt + sc->sc_win;
3652 tp->last_ack_sent = tp->rcv_nxt;
3653
3654 tcpstat_inc(tcps_sc_completed);
3655 syn_cache_put(sc);
3656 return (so);
3657
3658 resetandabort:
3659 tcp_respond(NULL, mtod(m, caddr_t), th, (tcp_seq)0, th->th_ack, TH_RST,
3660 m->m_pkthdr.ph_rtableid, now);
3661 abort:
3662 m_freem(m);
3663 if (so != NULL)
3664 soabort(so);
3665 syn_cache_put(sc);
3666 tcpstat_inc(tcps_sc_aborted);
3667 return ((struct socket *)(-1));
3668 }
3669
3670 /*
3671 * This function is called when we get a RST for a
3672 * non-existent connection, so that we can see if the
3673 * connection is in the syn cache. If it is, zap it.
3674 */
3675
3676 void
syn_cache_reset(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th,u_int rtableid)3677 syn_cache_reset(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
3678 u_int rtableid)
3679 {
3680 struct syn_cache *sc;
3681 struct syn_cache_head *scp;
3682
3683 NET_ASSERT_LOCKED();
3684
3685 mtx_enter(&syn_cache_mtx);
3686 sc = syn_cache_lookup(src, dst, &scp, rtableid);
3687 if (sc == NULL) {
3688 mtx_leave(&syn_cache_mtx);
3689 return;
3690 }
3691 if (SEQ_LT(th->th_seq, sc->sc_irs) ||
3692 SEQ_GT(th->th_seq, sc->sc_irs + 1)) {
3693 mtx_leave(&syn_cache_mtx);
3694 return;
3695 }
3696 syn_cache_rm(sc);
3697 mtx_leave(&syn_cache_mtx);
3698 tcpstat_inc(tcps_sc_reset);
3699 syn_cache_put(sc);
3700 }
3701
3702 void
syn_cache_unreach(const struct sockaddr * src,const struct sockaddr * dst,struct tcphdr * th,u_int rtableid)3703 syn_cache_unreach(const struct sockaddr *src, const struct sockaddr *dst,
3704 struct tcphdr *th, u_int rtableid)
3705 {
3706 struct syn_cache *sc;
3707 struct syn_cache_head *scp;
3708
3709 NET_ASSERT_LOCKED();
3710
3711 mtx_enter(&syn_cache_mtx);
3712 sc = syn_cache_lookup(src, dst, &scp, rtableid);
3713 if (sc == NULL) {
3714 mtx_leave(&syn_cache_mtx);
3715 return;
3716 }
3717 /* If the sequence number != sc_iss, then it's a bogus ICMP msg */
3718 if (ntohl (th->th_seq) != sc->sc_iss) {
3719 mtx_leave(&syn_cache_mtx);
3720 return;
3721 }
3722
3723 /*
3724 * If we've retransmitted 3 times and this is our second error,
3725 * we remove the entry. Otherwise, we allow it to continue on.
3726 * This prevents us from incorrectly nuking an entry during a
3727 * spurious network outage.
3728 *
3729 * See tcp_notify().
3730 */
3731 if (!ISSET(sc->sc_dynflags, SCF_UNREACH) || sc->sc_rxtshift < 3) {
3732 SET(sc->sc_dynflags, SCF_UNREACH);
3733 mtx_leave(&syn_cache_mtx);
3734 return;
3735 }
3736
3737 syn_cache_rm(sc);
3738 mtx_leave(&syn_cache_mtx);
3739 tcpstat_inc(tcps_sc_unreach);
3740 syn_cache_put(sc);
3741 }
3742
3743 /*
3744 * Given a LISTEN socket and an inbound SYN request, add
3745 * this to the syn cache, and send back a segment:
3746 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
3747 * to the source.
3748 *
3749 * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
3750 * Doing so would require that we hold onto the data and deliver it
3751 * to the application. However, if we are the target of a SYN-flood
3752 * DoS attack, an attacker could send data which would eventually
3753 * consume all available buffer space if it were ACKed. By not ACKing
3754 * the data, we avoid this DoS scenario.
3755 */
3756
3757 int
syn_cache_add(struct sockaddr * src,struct sockaddr * dst,struct tcphdr * th,u_int iphlen,struct socket * so,struct mbuf * m,u_char * optp,int optlen,struct tcp_opt_info * oi,tcp_seq * issp,uint64_t now)3758 syn_cache_add(struct sockaddr *src, struct sockaddr *dst, struct tcphdr *th,
3759 u_int iphlen, struct socket *so, struct mbuf *m, u_char *optp, int optlen,
3760 struct tcp_opt_info *oi, tcp_seq *issp, uint64_t now)
3761 {
3762 struct tcpcb tb, *tp;
3763 long win;
3764 struct syn_cache *sc;
3765 struct syn_cache_head *scp;
3766 struct mbuf *ipopts;
3767
3768 NET_ASSERT_LOCKED();
3769
3770 tp = sototcpcb(so);
3771
3772 /*
3773 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
3774 *
3775 * Note this check is performed in tcp_input() very early on.
3776 */
3777
3778 /*
3779 * Initialize some local state.
3780 */
3781 win = sbspace(so, &so->so_rcv);
3782 if (win > TCP_MAXWIN)
3783 win = TCP_MAXWIN;
3784
3785 bzero(&tb, sizeof(tb));
3786 #ifdef TCP_SIGNATURE
3787 if (optp || (tp->t_flags & TF_SIGNATURE)) {
3788 #else
3789 if (optp) {
3790 #endif
3791 tb.pf = tp->pf;
3792 tb.sack_enable = tp->sack_enable;
3793 tb.t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
3794 #ifdef TCP_SIGNATURE
3795 if (tp->t_flags & TF_SIGNATURE)
3796 tb.t_flags |= TF_SIGNATURE;
3797 #endif
3798 tb.t_state = TCPS_LISTEN;
3799 if (tcp_dooptions(&tb, optp, optlen, th, m, iphlen, oi,
3800 sotoinpcb(so)->inp_rtableid, now))
3801 return (-1);
3802 }
3803
3804 switch (src->sa_family) {
3805 case AF_INET:
3806 /*
3807 * Remember the IP options, if any.
3808 */
3809 ipopts = ip_srcroute(m);
3810 break;
3811 default:
3812 ipopts = NULL;
3813 }
3814
3815 /*
3816 * See if we already have an entry for this connection.
3817 * If we do, resend the SYN,ACK. We do not count this
3818 * as a retransmission (XXX though maybe we should).
3819 */
3820 mtx_enter(&syn_cache_mtx);
3821 sc = syn_cache_lookup(src, dst, &scp, sotoinpcb(so)->inp_rtableid);
3822 if (sc != NULL) {
3823 refcnt_take(&sc->sc_refcnt);
3824 mtx_leave(&syn_cache_mtx);
3825 tcpstat_inc(tcps_sc_dupesyn);
3826 if (ipopts) {
3827 /*
3828 * If we were remembering a previous source route,
3829 * forget it and use the new one we've been given.
3830 */
3831 m_free(sc->sc_ipopts);
3832 sc->sc_ipopts = ipopts;
3833 }
3834 sc->sc_timestamp = tb.ts_recent;
3835 if (syn_cache_respond(sc, m, now) == 0) {
3836 tcpstat_inc(tcps_sndacks);
3837 tcpstat_inc(tcps_sndtotal);
3838 }
3839 syn_cache_put(sc);
3840 return (0);
3841 }
3842 mtx_leave(&syn_cache_mtx);
3843
3844 sc = pool_get(&syn_cache_pool, PR_NOWAIT|PR_ZERO);
3845 if (sc == NULL) {
3846 m_free(ipopts);
3847 return (-1);
3848 }
3849 refcnt_init_trace(&sc->sc_refcnt, DT_REFCNT_IDX_SYNCACHE);
3850 timeout_set_flags(&sc->sc_timer, syn_cache_timer, sc,
3851 KCLOCK_NONE, TIMEOUT_PROC | TIMEOUT_MPSAFE);
3852
3853 /*
3854 * Fill in the cache, and put the necessary IP and TCP
3855 * options into the reply.
3856 */
3857 memcpy(&sc->sc_src, src, src->sa_len);
3858 memcpy(&sc->sc_dst, dst, dst->sa_len);
3859 sc->sc_rtableid = sotoinpcb(so)->inp_rtableid;
3860 sc->sc_ipopts = ipopts;
3861 sc->sc_irs = th->th_seq;
3862
3863 sc->sc_iss = issp ? *issp : arc4random();
3864 sc->sc_peermaxseg = oi->maxseg;
3865 sc->sc_ourmaxseg = tcp_mss_adv(m, sc->sc_src.sa.sa_family);
3866 sc->sc_win = win;
3867 sc->sc_timestamp = tb.ts_recent;
3868 if ((tb.t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP)) ==
3869 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) {
3870 SET(sc->sc_fixflags, SCF_TIMESTAMP);
3871 sc->sc_modulate = arc4random();
3872 }
3873 if ((tb.t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) ==
3874 (TF_RCVD_SCALE|TF_REQ_SCALE)) {
3875 sc->sc_requested_s_scale = tb.requested_s_scale;
3876 sc->sc_request_r_scale = 0;
3877 /*
3878 * Pick the smallest possible scaling factor that
3879 * will still allow us to scale up to sb_max.
3880 *
3881 * We do this because there are broken firewalls that
3882 * will corrupt the window scale option, leading to
3883 * the other endpoint believing that our advertised
3884 * window is unscaled. At scale factors larger than
3885 * 5 the unscaled window will drop below 1500 bytes,
3886 * leading to serious problems when traversing these
3887 * broken firewalls.
3888 *
3889 * With the default sbmax of 256K, a scale factor
3890 * of 3 will be chosen by this algorithm. Those who
3891 * choose a larger sbmax should watch out
3892 * for the compatibility problems mentioned above.
3893 *
3894 * RFC1323: The Window field in a SYN (i.e., a <SYN>
3895 * or <SYN,ACK>) segment itself is never scaled.
3896 */
3897 while (sc->sc_request_r_scale < TCP_MAX_WINSHIFT &&
3898 (TCP_MAXWIN << sc->sc_request_r_scale) < sb_max)
3899 sc->sc_request_r_scale++;
3900 } else {
3901 sc->sc_requested_s_scale = 15;
3902 sc->sc_request_r_scale = 15;
3903 }
3904 #ifdef TCP_ECN
3905 /*
3906 * if both ECE and CWR flag bits are set, peer is ECN capable.
3907 */
3908 if (tcp_do_ecn &&
3909 (th->th_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR))
3910 SET(sc->sc_fixflags, SCF_ECN_PERMIT);
3911 #endif
3912 /*
3913 * Set SCF_SACK_PERMIT if peer did send a SACK_PERMITTED option
3914 * (i.e., if tcp_dooptions() did set TF_SACK_PERMIT).
3915 */
3916 if (tb.sack_enable && (tb.t_flags & TF_SACK_PERMIT))
3917 SET(sc->sc_fixflags, SCF_SACK_PERMIT);
3918 #ifdef TCP_SIGNATURE
3919 if (tb.t_flags & TF_SIGNATURE)
3920 SET(sc->sc_fixflags, SCF_SIGNATURE);
3921 #endif
3922 sc->sc_tp = tp;
3923 if (syn_cache_respond(sc, m, now) == 0) {
3924 mtx_enter(&syn_cache_mtx);
3925 /*
3926 * XXXSMP Currently exclusive netlock prevents another insert
3927 * after our syn_cache_lookup() and before syn_cache_insert().
3928 * Double insert should be handled and not rely on netlock.
3929 */
3930 syn_cache_insert(sc, tp);
3931 mtx_leave(&syn_cache_mtx);
3932 tcpstat_inc(tcps_sndacks);
3933 tcpstat_inc(tcps_sndtotal);
3934 } else {
3935 syn_cache_put(sc);
3936 tcpstat_inc(tcps_sc_dropped);
3937 }
3938
3939 return (0);
3940 }
3941
3942 int
3943 syn_cache_respond(struct syn_cache *sc, struct mbuf *m, uint64_t now)
3944 {
3945 u_int8_t *optp;
3946 int optlen, error;
3947 u_int16_t tlen;
3948 struct ip *ip = NULL;
3949 #ifdef INET6
3950 struct ip6_hdr *ip6 = NULL;
3951 #endif
3952 struct tcphdr *th;
3953 u_int hlen;
3954 struct inpcb *inp;
3955
3956 NET_ASSERT_LOCKED();
3957
3958 switch (sc->sc_src.sa.sa_family) {
3959 case AF_INET:
3960 hlen = sizeof(struct ip);
3961 break;
3962 #ifdef INET6
3963 case AF_INET6:
3964 hlen = sizeof(struct ip6_hdr);
3965 break;
3966 #endif
3967 default:
3968 m_freem(m);
3969 return (EAFNOSUPPORT);
3970 }
3971
3972 /* Compute the size of the TCP options. */
3973 optlen = 4 + (sc->sc_request_r_scale != 15 ? 4 : 0) +
3974 (ISSET(sc->sc_fixflags, SCF_SACK_PERMIT) ? 4 : 0) +
3975 #ifdef TCP_SIGNATURE
3976 (ISSET(sc->sc_fixflags, SCF_SIGNATURE) ? TCPOLEN_SIGLEN : 0) +
3977 #endif
3978 (ISSET(sc->sc_fixflags, SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0);
3979
3980 tlen = hlen + sizeof(struct tcphdr) + optlen;
3981
3982 /*
3983 * Create the IP+TCP header from scratch.
3984 */
3985 m_freem(m);
3986 #ifdef DIAGNOSTIC
3987 if (max_linkhdr + tlen > MCLBYTES)
3988 return (ENOBUFS);
3989 #endif
3990 MGETHDR(m, M_DONTWAIT, MT_DATA);
3991 if (m && max_linkhdr + tlen > MHLEN) {
3992 MCLGET(m, M_DONTWAIT);
3993 if ((m->m_flags & M_EXT) == 0) {
3994 m_freem(m);
3995 m = NULL;
3996 }
3997 }
3998 if (m == NULL)
3999 return (ENOBUFS);
4000
4001 /* Fixup the mbuf. */
4002 m->m_data += max_linkhdr;
4003 m->m_len = m->m_pkthdr.len = tlen;
4004 m->m_pkthdr.ph_ifidx = 0;
4005 m->m_pkthdr.ph_rtableid = sc->sc_rtableid;
4006 memset(mtod(m, u_char *), 0, tlen);
4007
4008 switch (sc->sc_src.sa.sa_family) {
4009 case AF_INET:
4010 ip = mtod(m, struct ip *);
4011 ip->ip_dst = sc->sc_src.sin.sin_addr;
4012 ip->ip_src = sc->sc_dst.sin.sin_addr;
4013 ip->ip_p = IPPROTO_TCP;
4014 th = (struct tcphdr *)(ip + 1);
4015 th->th_dport = sc->sc_src.sin.sin_port;
4016 th->th_sport = sc->sc_dst.sin.sin_port;
4017 break;
4018 #ifdef INET6
4019 case AF_INET6:
4020 ip6 = mtod(m, struct ip6_hdr *);
4021 ip6->ip6_dst = sc->sc_src.sin6.sin6_addr;
4022 ip6->ip6_src = sc->sc_dst.sin6.sin6_addr;
4023 ip6->ip6_nxt = IPPROTO_TCP;
4024 th = (struct tcphdr *)(ip6 + 1);
4025 th->th_dport = sc->sc_src.sin6.sin6_port;
4026 th->th_sport = sc->sc_dst.sin6.sin6_port;
4027 break;
4028 #endif
4029 }
4030
4031 th->th_seq = htonl(sc->sc_iss);
4032 th->th_ack = htonl(sc->sc_irs + 1);
4033 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
4034 th->th_flags = TH_SYN|TH_ACK;
4035 #ifdef TCP_ECN
4036 /* Set ECE for SYN-ACK if peer supports ECN. */
4037 if (tcp_do_ecn && ISSET(sc->sc_fixflags, SCF_ECN_PERMIT))
4038 th->th_flags |= TH_ECE;
4039 #endif
4040 th->th_win = htons(sc->sc_win);
4041 /* th_sum already 0 */
4042 /* th_urp already 0 */
4043
4044 /* Tack on the TCP options. */
4045 optp = (u_int8_t *)(th + 1);
4046 *optp++ = TCPOPT_MAXSEG;
4047 *optp++ = 4;
4048 *optp++ = (sc->sc_ourmaxseg >> 8) & 0xff;
4049 *optp++ = sc->sc_ourmaxseg & 0xff;
4050
4051 /* Include SACK_PERMIT_HDR option if peer has already done so. */
4052 if (ISSET(sc->sc_fixflags, SCF_SACK_PERMIT)) {
4053 *((u_int32_t *)optp) = htonl(TCPOPT_SACK_PERMIT_HDR);
4054 optp += 4;
4055 }
4056
4057 if (sc->sc_request_r_scale != 15) {
4058 *((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
4059 TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
4060 sc->sc_request_r_scale);
4061 optp += 4;
4062 }
4063
4064 if (ISSET(sc->sc_fixflags, SCF_TIMESTAMP)) {
4065 u_int32_t *lp = (u_int32_t *)(optp);
4066 /* Form timestamp option as shown in appendix A of RFC 1323. */
4067 *lp++ = htonl(TCPOPT_TSTAMP_HDR);
4068 *lp++ = htonl(now + sc->sc_modulate);
4069 *lp = htonl(sc->sc_timestamp);
4070 optp += TCPOLEN_TSTAMP_APPA;
4071 }
4072
4073 #ifdef TCP_SIGNATURE
4074 if (ISSET(sc->sc_fixflags, SCF_SIGNATURE)) {
4075 union sockaddr_union src, dst;
4076 struct tdb *tdb;
4077
4078 bzero(&src, sizeof(union sockaddr_union));
4079 bzero(&dst, sizeof(union sockaddr_union));
4080 src.sa.sa_len = sc->sc_src.sa.sa_len;
4081 src.sa.sa_family = sc->sc_src.sa.sa_family;
4082 dst.sa.sa_len = sc->sc_dst.sa.sa_len;
4083 dst.sa.sa_family = sc->sc_dst.sa.sa_family;
4084
4085 switch (sc->sc_src.sa.sa_family) {
4086 case 0: /*default to PF_INET*/
4087 case AF_INET:
4088 src.sin.sin_addr = mtod(m, struct ip *)->ip_src;
4089 dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst;
4090 break;
4091 #ifdef INET6
4092 case AF_INET6:
4093 src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src;
4094 dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst;
4095 break;
4096 #endif /* INET6 */
4097 }
4098
4099 tdb = gettdbbysrcdst(rtable_l2(sc->sc_rtableid),
4100 0, &src, &dst, IPPROTO_TCP);
4101 if (tdb == NULL) {
4102 m_freem(m);
4103 return (EPERM);
4104 }
4105
4106 /* Send signature option */
4107 *(optp++) = TCPOPT_SIGNATURE;
4108 *(optp++) = TCPOLEN_SIGNATURE;
4109
4110 if (tcp_signature(tdb, sc->sc_src.sa.sa_family, m, th,
4111 hlen, 0, optp) < 0) {
4112 m_freem(m);
4113 tdb_unref(tdb);
4114 return (EINVAL);
4115 }
4116 tdb_unref(tdb);
4117 optp += 16;
4118
4119 /* Pad options list to the next 32 bit boundary and
4120 * terminate it.
4121 */
4122 *optp++ = TCPOPT_NOP;
4123 *optp++ = TCPOPT_EOL;
4124 }
4125 #endif /* TCP_SIGNATURE */
4126
4127 SET(m->m_pkthdr.csum_flags, M_TCP_CSUM_OUT);
4128
4129 /* use IPsec policy and ttl from listening socket, on SYN ACK */
4130 mtx_enter(&syn_cache_mtx);
4131 inp = sc->sc_tp ? sc->sc_tp->t_inpcb : NULL;
4132 mtx_leave(&syn_cache_mtx);
4133
4134 /*
4135 * Fill in some straggling IP bits. Note the stack expects
4136 * ip_len to be in host order, for convenience.
4137 */
4138 switch (sc->sc_src.sa.sa_family) {
4139 case AF_INET:
4140 ip->ip_len = htons(tlen);
4141 ip->ip_ttl = inp ? inp->inp_ip.ip_ttl : ip_defttl;
4142 if (inp != NULL)
4143 ip->ip_tos = inp->inp_ip.ip_tos;
4144
4145 error = ip_output(m, sc->sc_ipopts, &sc->sc_route,
4146 (ip_mtudisc ? IP_MTUDISC : 0), NULL,
4147 inp ? &inp->inp_seclevel : NULL, 0);
4148 break;
4149 #ifdef INET6
4150 case AF_INET6:
4151 ip6->ip6_vfc &= ~IPV6_VERSION_MASK;
4152 ip6->ip6_vfc |= IPV6_VERSION;
4153 /* ip6_plen will be updated in ip6_output() */
4154 ip6->ip6_hlim = in6_selecthlim(inp);
4155 /* leave flowlabel = 0, it is legal and require no state mgmt */
4156
4157 error = ip6_output(m, NULL /*XXX*/, &sc->sc_route, 0,
4158 NULL, inp ? &inp->inp_seclevel : NULL);
4159 break;
4160 #endif
4161 }
4162 return (error);
4163 }
4164