1/* SPDX-License-Identifier: BSD-3-Clause */
2/*
3 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994
4 * The Regents of the University of California. All rights reserved.
5 *
6 * Redistribution and use in source and binary forms, with or without
7 * modification, are permitted provided that the following conditions
8 * are met:
9 * 1. Redistributions of source code must retain the above copyright
10 * notice, this list of conditions and the following disclaimer.
11 * 2. Redistributions in binary form must reproduce the above copyright
12 * notice, this list of conditions and the following disclaimer in the
13 * documentation and/or other materials provided with the distribution.
14 * 3. Neither the name of the University nor the names of its contributors
15 * may be used to endorse or promote products derived from this software
16 * without specific prior written permission.
17 *
18 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
19 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
20 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
21 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
22 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
23 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
24 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
25 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
26 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
27 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
28 * SUCH DAMAGE.
29 *
30 * @(#)tcp_input.c 8.5 (Berkeley) 4/10/94
31 * tcp_input.c,v 1.10 1994/10/13 18:36:32 wollman Exp
32 */
33
34/*
35 * Changes and additions relating to SLiRP
36 * Copyright (c) 1995 Danny Gasparovski.
37 */
38
39#include "slirp.h"
40#include "ip_icmp.h"
41
42#define TCPREXMTTHRESH 3
43
44#define TCP_PAWS_IDLE (24 * 24 * 60 * 60 * PR_SLOWHZ)
45
46/* for modulo comparisons of timestamps */
47#define TSTMP_LT(a, b) ((int)((a) - (b)) < 0)
48#define TSTMP_GEQ(a, b) ((int)((a) - (b)) >= 0)
49
50/*
51 * Insert segment ti into reassembly queue of tcp with
52 * control block tp. Return TH_FIN if reassembly now includes
53 * a segment with FIN. The macro form does the common case inline
54 * (segment is the next to be received on an established connection,
55 * and the queue is empty), avoiding linkage into and removal
56 * from the queue and repetition of various conversions.
57 * Set DELACK for segments received in order, but ack immediately
58 * when segments are out of order (so fast retransmit can work).
59 */
60#define TCP_REASS(tp, ti, m, so, flags) \
61 { \
62 if ((ti)->ti_seq == (tp)->rcv_nxt && tcpfrag_list_empty(tp) && \
63 (tp)->t_state == TCPS_ESTABLISHED) { \
64 tp->t_flags |= TF_DELACK; \
65 (tp)->rcv_nxt += (ti)->ti_len; \
66 flags = (ti)->ti_flags & TH_FIN; \
67 if (so->so_emu) { \
68 if (tcp_emu((so), (m))) \
69 sbappend(so, (m)); \
70 } else \
71 sbappend((so), (m)); \
72 } else { \
73 (flags) = tcp_reass((tp), (ti), (m)); \
74 tp->t_flags |= TF_ACKNOW; \
75 } \
76 }
77
78static void tcp_dooptions(struct tcpcb *tp, uint8_t *cp, int cnt,
79 struct tcpiphdr *ti);
80static void tcp_xmit_timer(register struct tcpcb *tp, int rtt);
81
82static int tcp_reass(register struct tcpcb *tp, register struct tcpiphdr *ti,
83 struct mbuf *m)
84{
85 register struct tcpiphdr *q;
86 struct socket *so = tp->t_socket;
87 int flags;
88
89 /*
90 * Call with ti==NULL after become established to
91 * force pre-ESTABLISHED data up to user socket.
92 */
93 if (ti == NULL)
94 goto present;
95
96 /*
97 * Find a segment which begins after this one does.
98 */
99 for (q = tcpfrag_list_first(tp); !tcpfrag_list_end(q, tp);
100 q = tcpiphdr_next(q))
101 if (SEQ_GT(q->ti_seq, ti->ti_seq))
102 break;
103
104 /*
105 * If there is a preceding segment, it may provide some of
106 * our data already. If so, drop the data from the incoming
107 * segment. If it provides all of our data, drop us.
108 */
109 if (!tcpfrag_list_end(tcpiphdr_prev(q), tp)) {
110 register int i;
111 q = tcpiphdr_prev(q);
112 /* conversion to int (in i) handles seq wraparound */
113 i = q->ti_seq + q->ti_len - ti->ti_seq;
114 if (i > 0) {
115 if (i >= ti->ti_len) {
116 m_free(m);
117 /*
118 * Try to present any queued data
119 * at the left window edge to the user.
120 * This is needed after the 3-WHS
121 * completes.
122 */
123 goto present; /* ??? */
124 }
125 m_adj(m, i);
126 ti->ti_len -= i;
127 ti->ti_seq += i;
128 }
129 q = tcpiphdr_next(q);
130 }
131 ti->ti_mbuf = m;
132
133 /*
134 * While we overlap succeeding segments trim them or,
135 * if they are completely covered, dequeue them.
136 */
137 while (!tcpfrag_list_end(q, tp)) {
138 register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
139 if (i <= 0)
140 break;
141 if (i < q->ti_len) {
142 q->ti_seq += i;
143 q->ti_len -= i;
144 m_adj(q->ti_mbuf, i);
145 break;
146 }
147 q = tcpiphdr_next(q);
148 m = tcpiphdr_prev(q)->ti_mbuf;
149 remque(tcpiphdr2qlink(tcpiphdr_prev(q)));
150 m_free(m);
151 }
152
153 /*
154 * Stick new segment in its place.
155 */
156 insque(tcpiphdr2qlink(ti), tcpiphdr2qlink(tcpiphdr_prev(q)));
157
158present:
159 /*
160 * Present data to user, advancing rcv_nxt through
161 * completed sequence space.
162 */
163 if (!TCPS_HAVEESTABLISHED(tp->t_state))
164 return (0);
165 ti = tcpfrag_list_first(tp);
166 if (tcpfrag_list_end(ti, tp) || ti->ti_seq != tp->rcv_nxt)
167 return (0);
168 if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
169 return (0);
170 do {
171 tp->rcv_nxt += ti->ti_len;
172 flags = ti->ti_flags & TH_FIN;
173 remque(tcpiphdr2qlink(ti));
174 m = ti->ti_mbuf;
175 ti = tcpiphdr_next(ti);
176 if (so->so_state & SS_FCANTSENDMORE)
177 m_free(m);
178 else {
179 if (so->so_emu) {
180 if (tcp_emu(so, m))
181 sbappend(so, m);
182 } else
183 sbappend(so, m);
184 }
185 } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
186 return (flags);
187}
188
189/*
190 * TCP input routine, follows pages 65-76 of the
191 * protocol specification dated September, 1981 very closely.
192 */
193void tcp_input(struct mbuf *m, int iphlen, struct socket *inso,
194 unsigned short af)
195{
196 struct ip save_ip, *ip;
197 struct ip6 save_ip6, *ip6;
198 register struct tcpiphdr *ti;
199 char *optp = NULL;
200 int optlen = 0;
201 int len, tlen, off;
202 register struct tcpcb *tp = NULL;
203 register int tiflags;
204 struct socket *so = NULL;
205 int todrop, acked, ourfinisacked, needoutput = 0;
206 int iss = 0;
207 uint32_t tiwin;
208 int ret;
209 struct sockaddr_storage lhost, fhost;
210 struct sockaddr_in *lhost4, *fhost4;
211 struct sockaddr_in6 *lhost6, *fhost6;
212 struct gfwd_list *ex_ptr;
213 Slirp *slirp;
214
215 DEBUG_CALL("tcp_input");
216 DEBUG_ARG("m = %p iphlen = %2d inso = %p", m, iphlen, inso);
217
218 /*
219 * If called with m == 0, then we're continuing the connect
220 */
221 if (m == NULL) {
222 so = inso;
223 slirp = so->slirp;
224
225 /* Re-set a few variables */
226 tp = sototcpcb(so);
227 m = so->so_m;
228 so->so_m = NULL;
229 ti = so->so_ti;
230 tiwin = ti->ti_win;
231 tiflags = ti->ti_flags;
232
233 goto cont_conn;
234 }
235 slirp = m->slirp;
236
237 ip = mtod(m, struct ip *);
238 ip6 = mtod(m, struct ip6 *);
239
240 switch (af) {
241 case AF_INET:
242 if (iphlen > sizeof(struct ip)) {
243 ip_stripoptions(m, (struct mbuf *)0);
244 iphlen = sizeof(struct ip);
245 }
246 /* XXX Check if too short */
247
248
249 /*
250 * Save a copy of the IP header in case we want restore it
251 * for sending an ICMP error message in response.
252 */
253 save_ip = *ip;
254 save_ip.ip_len += iphlen;
255
256 /*
257 * Get IP and TCP header together in first mbuf.
258 * Note: IP leaves IP header in first mbuf.
259 */
260 m->m_data -=
261 sizeof(struct tcpiphdr) - sizeof(struct ip) - sizeof(struct tcphdr);
262 m->m_len +=
263 sizeof(struct tcpiphdr) - sizeof(struct ip) - sizeof(struct tcphdr);
264 ti = mtod(m, struct tcpiphdr *);
265
266 /*
267 * Checksum extended TCP header and data.
268 */
269 tlen = ip->ip_len;
270 tcpiphdr2qlink(ti)->next = tcpiphdr2qlink(ti)->prev = NULL;
271 memset(&ti->ih_mbuf, 0, sizeof(struct mbuf_ptr));
272 memset(&ti->ti, 0, sizeof(ti->ti));
273 ti->ti_x0 = 0;
274 ti->ti_src = save_ip.ip_src;
275 ti->ti_dst = save_ip.ip_dst;
276 ti->ti_pr = save_ip.ip_p;
277 ti->ti_len = htons((uint16_t)tlen);
278 break;
279
280 case AF_INET6:
281 /*
282 * Save a copy of the IP header in case we want restore it
283 * for sending an ICMP error message in response.
284 */
285 save_ip6 = *ip6;
286 /*
287 * Get IP and TCP header together in first mbuf.
288 * Note: IP leaves IP header in first mbuf.
289 */
290 m->m_data -= sizeof(struct tcpiphdr) -
291 (sizeof(struct ip6) + sizeof(struct tcphdr));
292 m->m_len += sizeof(struct tcpiphdr) -
293 (sizeof(struct ip6) + sizeof(struct tcphdr));
294 ti = mtod(m, struct tcpiphdr *);
295
296 tlen = ip6->ip_pl;
297 tcpiphdr2qlink(ti)->next = tcpiphdr2qlink(ti)->prev = NULL;
298 memset(&ti->ih_mbuf, 0, sizeof(struct mbuf_ptr));
299 memset(&ti->ti, 0, sizeof(ti->ti));
300 ti->ti_x0 = 0;
301 ti->ti_src6 = save_ip6.ip_src;
302 ti->ti_dst6 = save_ip6.ip_dst;
303 ti->ti_nh6 = save_ip6.ip_nh;
304 ti->ti_len = htons((uint16_t)tlen);
305 break;
306
307 default:
308 g_assert_not_reached();
309 }
310
311 len = ((sizeof(struct tcpiphdr) - sizeof(struct tcphdr)) + tlen);
312 if (cksum(m, len)) {
313 goto drop;
314 }
315
316 /*
317 * Check that TCP offset makes sense,
318 * pull out TCP options and adjust length. XXX
319 */
320 off = ti->ti_off << 2;
321 if (off < sizeof(struct tcphdr) || off > tlen) {
322 goto drop;
323 }
324 tlen -= off;
325 ti->ti_len = tlen;
326 if (off > sizeof(struct tcphdr)) {
327 optlen = off - sizeof(struct tcphdr);
328 optp = mtod(m, char *) + sizeof(struct tcpiphdr);
329 }
330 tiflags = ti->ti_flags;
331
332 /*
333 * Convert TCP protocol specific fields to host format.
334 */
335 NTOHL(ti->ti_seq);
336 NTOHL(ti->ti_ack);
337 NTOHS(ti->ti_win);
338 NTOHS(ti->ti_urp);
339
340 /*
341 * Drop TCP, IP headers and TCP options.
342 */
343 m->m_data += sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
344 m->m_len -= sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
345
346 /*
347 * Locate pcb for segment.
348 */
349findso:
350 lhost.ss_family = af;
351 fhost.ss_family = af;
352 switch (af) {
353 case AF_INET:
354 lhost4 = (struct sockaddr_in *)&lhost;
355 lhost4->sin_addr = ti->ti_src;
356 lhost4->sin_port = ti->ti_sport;
357 fhost4 = (struct sockaddr_in *)&fhost;
358 fhost4->sin_addr = ti->ti_dst;
359 fhost4->sin_port = ti->ti_dport;
360 break;
361 case AF_INET6:
362 lhost6 = (struct sockaddr_in6 *)&lhost;
363 lhost6->sin6_addr = ti->ti_src6;
364 lhost6->sin6_port = ti->ti_sport;
365 fhost6 = (struct sockaddr_in6 *)&fhost;
366 fhost6->sin6_addr = ti->ti_dst6;
367 fhost6->sin6_port = ti->ti_dport;
368 break;
369 default:
370 g_assert_not_reached();
371 }
372
373 so = solookup(&slirp->tcp_last_so, &slirp->tcb, &lhost, &fhost);
374
375 /*
376 * If the state is CLOSED (i.e., TCB does not exist) then
377 * all data in the incoming segment is discarded.
378 * If the TCB exists but is in CLOSED state, it is embryonic,
379 * but should either do a listen or a connect soon.
380 *
381 * state == CLOSED means we've done socreate() but haven't
382 * attached it to a protocol yet...
383 *
384 * XXX If a TCB does not exist, and the TH_SYN flag is
385 * the only flag set, then create a session, mark it
386 * as if it was LISTENING, and continue...
387 */
388 if (so == NULL) {
389 /* TODO: IPv6 */
390 if (slirp->restricted) {
391 /* Any hostfwds will have an existing socket, so we only get here
392 * for non-hostfwd connections. These should be dropped, unless it
393 * happens to be a guestfwd.
394 */
395 for (ex_ptr = slirp->guestfwd_list; ex_ptr;
396 ex_ptr = ex_ptr->ex_next) {
397 if (ex_ptr->ex_fport == ti->ti_dport &&
398 ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
399 break;
400 }
401 }
402 if (!ex_ptr) {
403 goto dropwithreset;
404 }
405 }
406
407 if ((tiflags & (TH_SYN | TH_FIN | TH_RST | TH_URG | TH_ACK)) != TH_SYN)
408 goto dropwithreset;
409
410 so = socreate(slirp);
411 if (tcp_attach(so) < 0) {
412 g_free(so); /* Not sofree (if it failed, it's not insqued) */
413 goto dropwithreset;
414 }
415
416 sbreserve(&so->so_snd, TCP_SNDSPACE);
417 sbreserve(&so->so_rcv, TCP_RCVSPACE);
418
419 so->lhost.ss = lhost;
420 so->fhost.ss = fhost;
421
422 so->so_iptos = tcp_tos(so);
423 if (so->so_iptos == 0) {
424 switch (af) {
425 case AF_INET:
426 so->so_iptos = ((struct ip *)ti)->ip_tos;
427 break;
428 case AF_INET6:
429 break;
430 default:
431 g_assert_not_reached();
432 }
433 }
434
435 tp = sototcpcb(so);
436 tp->t_state = TCPS_LISTEN;
437 }
438
439 /*
440 * If this is a still-connecting socket, this probably
441 * a retransmit of the SYN. Whether it's a retransmit SYN
442 * or something else, we nuke it.
443 */
444 if (so->so_state & SS_ISFCONNECTING)
445 goto drop;
446
447 tp = sototcpcb(so);
448
449 /* XXX Should never fail */
450 if (tp == NULL)
451 goto dropwithreset;
452 if (tp->t_state == TCPS_CLOSED)
453 goto drop;
454
455 tiwin = ti->ti_win;
456
457 /*
458 * Segment received on connection.
459 * Reset idle time and keep-alive timer.
460 */
461 tp->t_idle = 0;
462 if (slirp_do_keepalive)
463 tp->t_timer[TCPT_KEEP] = TCPTV_KEEPINTVL;
464 else
465 tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_IDLE;
466
467 /*
468 * Process options if not in LISTEN state,
469 * else do it below (after getting remote address).
470 */
471 if (optp && tp->t_state != TCPS_LISTEN)
472 tcp_dooptions(tp, (uint8_t *)optp, optlen, ti);
473
474 /*
475 * Header prediction: check for the two common cases
476 * of a uni-directional data xfer. If the packet has
477 * no control flags, is in-sequence, the window didn't
478 * change and we're not retransmitting, it's a
479 * candidate. If the length is zero and the ack moved
480 * forward, we're the sender side of the xfer. Just
481 * free the data acked & wake any higher level process
482 * that was blocked waiting for space. If the length
483 * is non-zero and the ack didn't move, we're the
484 * receiver side. If we're getting packets in-order
485 * (the reassembly queue is empty), add the data to
486 * the socket buffer and note that we need a delayed ack.
487 *
488 * XXX Some of these tests are not needed
489 * eg: the tiwin == tp->snd_wnd prevents many more
490 * predictions.. with no *real* advantage..
491 */
492 if (tp->t_state == TCPS_ESTABLISHED &&
493 (tiflags & (TH_SYN | TH_FIN | TH_RST | TH_URG | TH_ACK)) == TH_ACK &&
494 ti->ti_seq == tp->rcv_nxt && tiwin && tiwin == tp->snd_wnd &&
495 tp->snd_nxt == tp->snd_max) {
496 if (ti->ti_len == 0) {
497 if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
498 SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
499 tp->snd_cwnd >= tp->snd_wnd) {
500 /*
501 * this is a pure ack for outstanding data.
502 */
503 if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
504 tcp_xmit_timer(tp, tp->t_rtt);
505 acked = ti->ti_ack - tp->snd_una;
506 sodrop(so, acked);
507 tp->snd_una = ti->ti_ack;
508 m_free(m);
509
510 /*
511 * If all outstanding data are acked, stop
512 * retransmit timer, otherwise restart timer
513 * using current (possibly backed-off) value.
514 * If process is waiting for space,
515 * wakeup/selwakeup/signal. If data
516 * are ready to send, let tcp_output
517 * decide between more output or persist.
518 */
519 if (tp->snd_una == tp->snd_max)
520 tp->t_timer[TCPT_REXMT] = 0;
521 else if (tp->t_timer[TCPT_PERSIST] == 0)
522 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
523
524 /*
525 * This is called because sowwakeup might have
526 * put data into so_snd. Since we don't so sowwakeup,
527 * we don't need this.. XXX???
528 */
529 if (so->so_snd.sb_cc)
530 (void)tcp_output(tp);
531
532 return;
533 }
534 } else if (ti->ti_ack == tp->snd_una && tcpfrag_list_empty(tp) &&
535 ti->ti_len <= sbspace(&so->so_rcv)) {
536 /*
537 * this is a pure, in-sequence data packet
538 * with nothing on the reassembly queue and
539 * we have enough buffer space to take it.
540 */
541 tp->rcv_nxt += ti->ti_len;
542 /*
543 * Add data to socket buffer.
544 */
545 if (so->so_emu) {
546 if (tcp_emu(so, m))
547 sbappend(so, m);
548 } else
549 sbappend(so, m);
550
551 /*
552 * If this is a short packet, then ACK now - with Nagel
553 * congestion avoidance sender won't send more until
554 * he gets an ACK.
555 *
556 * It is better to not delay acks at all to maximize
557 * TCP throughput. See RFC 2581.
558 */
559 tp->t_flags |= TF_ACKNOW;
560 tcp_output(tp);
561 return;
562 }
563 } /* header prediction */
564 /*
565 * Calculate amount of space in receive window,
566 * and then do TCP input processing.
567 * Receive window is amount of space in rcv queue,
568 * but not less than advertised window.
569 */
570 {
571 int win;
572 win = sbspace(&so->so_rcv);
573 if (win < 0)
574 win = 0;
575 tp->rcv_wnd = MAX(win, (int)(tp->rcv_adv - tp->rcv_nxt));
576 }
577
578 switch (tp->t_state) {
579 /*
580 * If the state is LISTEN then ignore segment if it contains an RST.
581 * If the segment contains an ACK then it is bad and send a RST.
582 * If it does not contain a SYN then it is not interesting; drop it.
583 * Don't bother responding if the destination was a broadcast.
584 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
585 * tp->iss, and send a segment:
586 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
587 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
588 * Fill in remote peer address fields if not previously specified.
589 * Enter SYN_RECEIVED state, and process any other fields of this
590 * segment in this state.
591 */
592 case TCPS_LISTEN: {
593 if (tiflags & TH_RST)
594 goto drop;
595 if (tiflags & TH_ACK)
596 goto dropwithreset;
597 if ((tiflags & TH_SYN) == 0)
598 goto drop;
599
600 /*
601 * This has way too many gotos...
602 * But a bit of spaghetti code never hurt anybody :)
603 */
604
605 /*
606 * If this is destined for the control address, then flag to
607 * tcp_ctl once connected, otherwise connect
608 */
609 /* TODO: IPv6 */
610 if (af == AF_INET &&
611 (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) ==
612 slirp->vnetwork_addr.s_addr) {
613 if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr &&
614 so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) {
615 /* May be an add exec */
616 for (ex_ptr = slirp->guestfwd_list; ex_ptr;
617 ex_ptr = ex_ptr->ex_next) {
618 if (ex_ptr->ex_fport == so->so_fport &&
619 so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
620 so->so_state |= SS_CTL;
621 break;
622 }
623 }
624 if (so->so_state & SS_CTL) {
625 goto cont_input;
626 }
627 }
628 /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */
629 }
630
631 if (so->so_emu & EMU_NOCONNECT) {
632 so->so_emu &= ~EMU_NOCONNECT;
633 goto cont_input;
634 }
635
636 if ((tcp_fconnect(so, so->so_ffamily) == -1) && (errno != EAGAIN) &&
637 (errno != EINPROGRESS) && (errno != EWOULDBLOCK)) {
638 uint8_t code;
639 DEBUG_MISC(" tcp fconnect errno = %d-%s", errno, strerror(errno));
640 if (errno == ECONNREFUSED) {
641 /* ACK the SYN, send RST to refuse the connection */
642 tcp_respond(tp, ti, m, ti->ti_seq + 1, (tcp_seq)0,
643 TH_RST | TH_ACK, af);
644 } else {
645 switch (af) {
646 case AF_INET:
647 code = ICMP_UNREACH_NET;
648 if (errno == EHOSTUNREACH) {
649 code = ICMP_UNREACH_HOST;
650 }
651 break;
652 case AF_INET6:
653 code = ICMP6_UNREACH_NO_ROUTE;
654 if (errno == EHOSTUNREACH) {
655 code = ICMP6_UNREACH_ADDRESS;
656 }
657 break;
658 default:
659 g_assert_not_reached();
660 }
661 HTONL(ti->ti_seq); /* restore tcp header */
662 HTONL(ti->ti_ack);
663 HTONS(ti->ti_win);
664 HTONS(ti->ti_urp);
665 m->m_data -=
666 sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
667 m->m_len +=
668 sizeof(struct tcpiphdr) + off - sizeof(struct tcphdr);
669 switch (af) {
670 case AF_INET:
671 m->m_data += sizeof(struct tcpiphdr) - sizeof(struct ip) -
672 sizeof(struct tcphdr);
673 m->m_len -= sizeof(struct tcpiphdr) - sizeof(struct ip) -
674 sizeof(struct tcphdr);
675 *ip = save_ip;
676 icmp_send_error(m, ICMP_UNREACH, code, 0, strerror(errno));
677 break;
678 case AF_INET6:
679 m->m_data += sizeof(struct tcpiphdr) -
680 (sizeof(struct ip6) + sizeof(struct tcphdr));
681 m->m_len -= sizeof(struct tcpiphdr) -
682 (sizeof(struct ip6) + sizeof(struct tcphdr));
683 *ip6 = save_ip6;
684 icmp6_send_error(m, ICMP6_UNREACH, code);
685 break;
686 default:
687 g_assert_not_reached();
688 }
689 }
690 tcp_close(tp);
691 m_free(m);
692 } else {
693 /*
694 * Haven't connected yet, save the current mbuf
695 * and ti, and return
696 * XXX Some OS's don't tell us whether the connect()
697 * succeeded or not. So we must time it out.
698 */
699 so->so_m = m;
700 so->so_ti = ti;
701 tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
702 tp->t_state = TCPS_SYN_RECEIVED;
703 /*
704 * Initialize receive sequence numbers now so that we can send a
705 * valid RST if the remote end rejects our connection.
706 */
707 tp->irs = ti->ti_seq;
708 tcp_rcvseqinit(tp);
709 tcp_template(tp);
710 }
711 return;
712
713 cont_conn:
714 /* m==NULL
715 * Check if the connect succeeded
716 */
717 if (so->so_state & SS_NOFDREF) {
718 tp = tcp_close(tp);
719 goto dropwithreset;
720 }
721 cont_input:
722 tcp_template(tp);
723
724 if (optp)
725 tcp_dooptions(tp, (uint8_t *)optp, optlen, ti);
726
727 if (iss)
728 tp->iss = iss;
729 else
730 tp->iss = slirp->tcp_iss;
731 slirp->tcp_iss += TCP_ISSINCR / 2;
732 tp->irs = ti->ti_seq;
733 tcp_sendseqinit(tp);
734 tcp_rcvseqinit(tp);
735 tp->t_flags |= TF_ACKNOW;
736 tp->t_state = TCPS_SYN_RECEIVED;
737 tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
738 goto trimthenstep6;
739 } /* case TCPS_LISTEN */
740
741 /*
742 * If the state is SYN_SENT:
743 * if seg contains an ACK, but not for our SYN, drop the input.
744 * if seg contains a RST, then drop the connection.
745 * if seg does not contain SYN, then drop it.
746 * Otherwise this is an acceptable SYN segment
747 * initialize tp->rcv_nxt and tp->irs
748 * if seg contains ack then advance tp->snd_una
749 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
750 * arrange for segment to be acked (eventually)
751 * continue processing rest of data/controls, beginning with URG
752 */
753 case TCPS_SYN_SENT:
754 if ((tiflags & TH_ACK) &&
755 (SEQ_LEQ(ti->ti_ack, tp->iss) || SEQ_GT(ti->ti_ack, tp->snd_max)))
756 goto dropwithreset;
757
758 if (tiflags & TH_RST) {
759 if (tiflags & TH_ACK) {
760 tcp_drop(tp, 0); /* XXX Check t_softerror! */
761 }
762 goto drop;
763 }
764
765 if ((tiflags & TH_SYN) == 0)
766 goto drop;
767 if (tiflags & TH_ACK) {
768 tp->snd_una = ti->ti_ack;
769 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
770 tp->snd_nxt = tp->snd_una;
771 }
772
773 tp->t_timer[TCPT_REXMT] = 0;
774 tp->irs = ti->ti_seq;
775 tcp_rcvseqinit(tp);
776 tp->t_flags |= TF_ACKNOW;
777 if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
778 soisfconnected(so);
779 tp->t_state = TCPS_ESTABLISHED;
780
781 (void)tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
782 /*
783 * if we didn't have to retransmit the SYN,
784 * use its rtt as our initial srtt & rtt var.
785 */
786 if (tp->t_rtt)
787 tcp_xmit_timer(tp, tp->t_rtt);
788 } else
789 tp->t_state = TCPS_SYN_RECEIVED;
790
791 trimthenstep6:
792 /*
793 * Advance ti->ti_seq to correspond to first data byte.
794 * If data, trim to stay within window,
795 * dropping FIN if necessary.
796 */
797 ti->ti_seq++;
798 if (ti->ti_len > tp->rcv_wnd) {
799 todrop = ti->ti_len - tp->rcv_wnd;
800 m_adj(m, -todrop);
801 ti->ti_len = tp->rcv_wnd;
802 tiflags &= ~TH_FIN;
803 }
804 tp->snd_wl1 = ti->ti_seq - 1;
805 tp->rcv_up = ti->ti_seq;
806 goto step6;
807 } /* switch tp->t_state */
808 /*
809 * States other than LISTEN or SYN_SENT.
810 * Check that at least some bytes of segment are within
811 * receive window. If segment begins before rcv_nxt,
812 * drop leading data (and SYN); if nothing left, just ack.
813 */
814 todrop = tp->rcv_nxt - ti->ti_seq;
815 if (todrop > 0) {
816 if (tiflags & TH_SYN) {
817 tiflags &= ~TH_SYN;
818 ti->ti_seq++;
819 if (ti->ti_urp > 1)
820 ti->ti_urp--;
821 else
822 tiflags &= ~TH_URG;
823 todrop--;
824 }
825 /*
826 * Following if statement from Stevens, vol. 2, p. 960.
827 */
828 if (todrop > ti->ti_len ||
829 (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) {
830 /*
831 * Any valid FIN must be to the left of the window.
832 * At this point the FIN must be a duplicate or out
833 * of sequence; drop it.
834 */
835 tiflags &= ~TH_FIN;
836
837 /*
838 * Send an ACK to resynchronize and drop any data.
839 * But keep on processing for RST or ACK.
840 */
841 tp->t_flags |= TF_ACKNOW;
842 todrop = ti->ti_len;
843 }
844 m_adj(m, todrop);
845 ti->ti_seq += todrop;
846 ti->ti_len -= todrop;
847 if (ti->ti_urp > todrop)
848 ti->ti_urp -= todrop;
849 else {
850 tiflags &= ~TH_URG;
851 ti->ti_urp = 0;
852 }
853 }
854 /*
855 * If new data are received on a connection after the
856 * user processes are gone, then RST the other end.
857 */
858 if ((so->so_state & SS_NOFDREF) && tp->t_state > TCPS_CLOSE_WAIT &&
859 ti->ti_len) {
860 tp = tcp_close(tp);
861 goto dropwithreset;
862 }
863
864 /*
865 * If segment ends after window, drop trailing data
866 * (and PUSH and FIN); if nothing left, just ACK.
867 */
868 todrop = (ti->ti_seq + ti->ti_len) - (tp->rcv_nxt + tp->rcv_wnd);
869 if (todrop > 0) {
870 if (todrop >= ti->ti_len) {
871 /*
872 * If a new connection request is received
873 * while in TIME_WAIT, drop the old connection
874 * and start over if the sequence numbers
875 * are above the previous ones.
876 */
877 if (tiflags & TH_SYN && tp->t_state == TCPS_TIME_WAIT &&
878 SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
879 iss = tp->rcv_nxt + TCP_ISSINCR;
880 tp = tcp_close(tp);
881 goto findso;
882 }
883 /*
884 * If window is closed can only take segments at
885 * window edge, and have to drop data and PUSH from
886 * incoming segments. Continue processing, but
887 * remember to ack. Otherwise, drop segment
888 * and ack.
889 */
890 if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
891 tp->t_flags |= TF_ACKNOW;
892 } else {
893 goto dropafterack;
894 }
895 }
896 m_adj(m, -todrop);
897 ti->ti_len -= todrop;
898 tiflags &= ~(TH_PUSH | TH_FIN);
899 }
900
901 /*
902 * If the RST bit is set examine the state:
903 * SYN_RECEIVED STATE:
904 * If passive open, return to LISTEN state.
905 * If active open, inform user that connection was refused.
906 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
907 * Inform user that connection was reset, and close tcb.
908 * CLOSING, LAST_ACK, TIME_WAIT STATES
909 * Close the tcb.
910 */
911 if (tiflags & TH_RST)
912 switch (tp->t_state) {
913 case TCPS_SYN_RECEIVED:
914 case TCPS_ESTABLISHED:
915 case TCPS_FIN_WAIT_1:
916 case TCPS_FIN_WAIT_2:
917 case TCPS_CLOSE_WAIT:
918 tp->t_state = TCPS_CLOSED;
919 tcp_close(tp);
920 goto drop;
921
922 case TCPS_CLOSING:
923 case TCPS_LAST_ACK:
924 case TCPS_TIME_WAIT:
925 tcp_close(tp);
926 goto drop;
927 }
928
929 /*
930 * If a SYN is in the window, then this is an
931 * error and we send an RST and drop the connection.
932 */
933 if (tiflags & TH_SYN) {
934 tp = tcp_drop(tp, 0);
935 goto dropwithreset;
936 }
937
938 /*
939 * If the ACK bit is off we drop the segment and return.
940 */
941 if ((tiflags & TH_ACK) == 0)
942 goto drop;
943
944 /*
945 * Ack processing.
946 */
947 switch (tp->t_state) {
948 /*
949 * In SYN_RECEIVED state if the ack ACKs our SYN then enter
950 * ESTABLISHED state and continue processing, otherwise
951 * send an RST. una<=ack<=max
952 */
953 case TCPS_SYN_RECEIVED:
954
955 if (SEQ_GT(tp->snd_una, ti->ti_ack) || SEQ_GT(ti->ti_ack, tp->snd_max))
956 goto dropwithreset;
957 tp->t_state = TCPS_ESTABLISHED;
958 /*
959 * The sent SYN is ack'ed with our sequence number +1
960 * The first data byte already in the buffer will get
961 * lost if no correction is made. This is only needed for
962 * SS_CTL since the buffer is empty otherwise.
963 * tp->snd_una++; or:
964 */
965 tp->snd_una = ti->ti_ack;
966 if (so->so_state & SS_CTL) {
967 /* So tcp_ctl reports the right state */
968 ret = tcp_ctl(so);
969 if (ret == 1) {
970 soisfconnected(so);
971 so->so_state &= ~SS_CTL; /* success XXX */
972 } else if (ret == 2) {
973 so->so_state &= SS_PERSISTENT_MASK;
974 so->so_state |= SS_NOFDREF; /* CTL_CMD */
975 } else {
976 needoutput = 1;
977 tp->t_state = TCPS_FIN_WAIT_1;
978 }
979 } else {
980 soisfconnected(so);
981 }
982
983 (void)tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
984 tp->snd_wl1 = ti->ti_seq - 1;
985 /* Avoid ack processing; snd_una==ti_ack => dup ack */
986 goto synrx_to_est;
987 /* fall into ... */
988
989 /*
990 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
991 * ACKs. If the ack is in the range
992 * tp->snd_una < ti->ti_ack <= tp->snd_max
993 * then advance tp->snd_una to ti->ti_ack and drop
994 * data from the retransmission queue. If this ACK reflects
995 * more up to date window information we update our window information.
996 */
997 case TCPS_ESTABLISHED:
998 case TCPS_FIN_WAIT_1:
999 case TCPS_FIN_WAIT_2:
1000 case TCPS_CLOSE_WAIT:
1001 case TCPS_CLOSING:
1002 case TCPS_LAST_ACK:
1003 case TCPS_TIME_WAIT:
1004
1005 if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
1006 if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
1007 DEBUG_MISC(" dup ack m = %p so = %p", m, so);
1008 /*
1009 * If we have outstanding data (other than
1010 * a window probe), this is a completely
1011 * duplicate ack (ie, window info didn't
1012 * change), the ack is the biggest we've
1013 * seen and we've seen exactly our rexmt
1014 * threshold of them, assume a packet
1015 * has been dropped and retransmit it.
1016 * Kludge snd_nxt & the congestion
1017 * window so we send only this one
1018 * packet.
1019 *
1020 * We know we're losing at the current
1021 * window size so do congestion avoidance
1022 * (set ssthresh to half the current window
1023 * and pull our congestion window back to
1024 * the new ssthresh).
1025 *
1026 * Dup acks mean that packets have left the
1027 * network (they're now cached at the receiver)
1028 * so bump cwnd by the amount in the receiver
1029 * to keep a constant cwnd packets in the
1030 * network.
1031 */
1032 if (tp->t_timer[TCPT_REXMT] == 0 || ti->ti_ack != tp->snd_una)
1033 tp->t_dupacks = 0;
1034 else if (++tp->t_dupacks == TCPREXMTTHRESH) {
1035 tcp_seq onxt = tp->snd_nxt;
1036 unsigned win =
1037 MIN(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg;
1038
1039 if (win < 2)
1040 win = 2;
1041 tp->snd_ssthresh = win * tp->t_maxseg;
1042 tp->t_timer[TCPT_REXMT] = 0;
1043 tp->t_rtt = 0;
1044 tp->snd_nxt = ti->ti_ack;
1045 tp->snd_cwnd = tp->t_maxseg;
1046 (void)tcp_output(tp);
1047 tp->snd_cwnd =
1048 tp->snd_ssthresh + tp->t_maxseg * tp->t_dupacks;
1049 if (SEQ_GT(onxt, tp->snd_nxt))
1050 tp->snd_nxt = onxt;
1051 goto drop;
1052 } else if (tp->t_dupacks > TCPREXMTTHRESH) {
1053 tp->snd_cwnd += tp->t_maxseg;
1054 (void)tcp_output(tp);
1055 goto drop;
1056 }
1057 } else
1058 tp->t_dupacks = 0;
1059 break;
1060 }
1061 synrx_to_est:
1062 /*
1063 * If the congestion window was inflated to account
1064 * for the other side's cached packets, retract it.
1065 */
1066 if (tp->t_dupacks > TCPREXMTTHRESH && tp->snd_cwnd > tp->snd_ssthresh)
1067 tp->snd_cwnd = tp->snd_ssthresh;
1068 tp->t_dupacks = 0;
1069 if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
1070 goto dropafterack;
1071 }
1072 acked = ti->ti_ack - tp->snd_una;
1073
1074 /*
1075 * If transmit timer is running and timed sequence
1076 * number was acked, update smoothed round trip time.
1077 * Since we now have an rtt measurement, cancel the
1078 * timer backoff (cf., Phil Karn's retransmit alg.).
1079 * Recompute the initial retransmit timer.
1080 */
1081 if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
1082 tcp_xmit_timer(tp, tp->t_rtt);
1083
1084 /*
1085 * If all outstanding data is acked, stop retransmit
1086 * timer and remember to restart (more output or persist).
1087 * If there is more data to be acked, restart retransmit
1088 * timer, using current (possibly backed-off) value.
1089 */
1090 if (ti->ti_ack == tp->snd_max) {
1091 tp->t_timer[TCPT_REXMT] = 0;
1092 needoutput = 1;
1093 } else if (tp->t_timer[TCPT_PERSIST] == 0)
1094 tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
1095 /*
1096 * When new data is acked, open the congestion window.
1097 * If the window gives us less than ssthresh packets
1098 * in flight, open exponentially (maxseg per packet).
1099 * Otherwise open linearly: maxseg per window
1100 * (maxseg^2 / cwnd per packet).
1101 */
1102 {
1103 register unsigned cw = tp->snd_cwnd;
1104 register unsigned incr = tp->t_maxseg;
1105
1106 if (cw > tp->snd_ssthresh)
1107 incr = incr * incr / cw;
1108 tp->snd_cwnd = MIN(cw + incr, TCP_MAXWIN << tp->snd_scale);
1109 }
1110 if (acked > so->so_snd.sb_cc) {
1111 tp->snd_wnd -= so->so_snd.sb_cc;
1112 sodrop(so, (int)so->so_snd.sb_cc);
1113 ourfinisacked = 1;
1114 } else {
1115 sodrop(so, acked);
1116 tp->snd_wnd -= acked;
1117 ourfinisacked = 0;
1118 }
1119 tp->snd_una = ti->ti_ack;
1120 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1121 tp->snd_nxt = tp->snd_una;
1122
1123 switch (tp->t_state) {
1124 /*
1125 * In FIN_WAIT_1 STATE in addition to the processing
1126 * for the ESTABLISHED state if our FIN is now acknowledged
1127 * then enter FIN_WAIT_2.
1128 */
1129 case TCPS_FIN_WAIT_1:
1130 if (ourfinisacked) {
1131 /*
1132 * If we can't receive any more
1133 * data, then closing user can proceed.
1134 * Starting the timer is contrary to the
1135 * specification, but if we don't get a FIN
1136 * we'll hang forever.
1137 */
1138 if (so->so_state & SS_FCANTRCVMORE) {
1139 tp->t_timer[TCPT_2MSL] = TCP_MAXIDLE;
1140 }
1141 tp->t_state = TCPS_FIN_WAIT_2;
1142 }
1143 break;
1144
1145 /*
1146 * In CLOSING STATE in addition to the processing for
1147 * the ESTABLISHED state if the ACK acknowledges our FIN
1148 * then enter the TIME-WAIT state, otherwise ignore
1149 * the segment.
1150 */
1151 case TCPS_CLOSING:
1152 if (ourfinisacked) {
1153 tp->t_state = TCPS_TIME_WAIT;
1154 tcp_canceltimers(tp);
1155 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1156 }
1157 break;
1158
1159 /*
1160 * In LAST_ACK, we may still be waiting for data to drain
1161 * and/or to be acked, as well as for the ack of our FIN.
1162 * If our FIN is now acknowledged, delete the TCB,
1163 * enter the closed state and return.
1164 */
1165 case TCPS_LAST_ACK:
1166 if (ourfinisacked) {
1167 tcp_close(tp);
1168 goto drop;
1169 }
1170 break;
1171
1172 /*
1173 * In TIME_WAIT state the only thing that should arrive
1174 * is a retransmission of the remote FIN. Acknowledge
1175 * it and restart the finack timer.
1176 */
1177 case TCPS_TIME_WAIT:
1178 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1179 goto dropafterack;
1180 }
1181 } /* switch(tp->t_state) */
1182
1183step6:
1184 /*
1185 * Update window information.
1186 * Don't look at window if no ACK: TAC's send garbage on first SYN.
1187 */
1188 if ((tiflags & TH_ACK) &&
1189 (SEQ_LT(tp->snd_wl1, ti->ti_seq) ||
1190 (tp->snd_wl1 == ti->ti_seq &&
1191 (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
1192 (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd))))) {
1193 tp->snd_wnd = tiwin;
1194 tp->snd_wl1 = ti->ti_seq;
1195 tp->snd_wl2 = ti->ti_ack;
1196 if (tp->snd_wnd > tp->max_sndwnd)
1197 tp->max_sndwnd = tp->snd_wnd;
1198 needoutput = 1;
1199 }
1200
1201 /*
1202 * Process segments with URG.
1203 */
1204 if ((tiflags & TH_URG) && ti->ti_urp &&
1205 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1206 /*
1207 * This is a kludge, but if we receive and accept
1208 * random urgent pointers, we'll crash in
1209 * soreceive. It's hard to imagine someone
1210 * actually wanting to send this much urgent data.
1211 */
1212 if (ti->ti_urp + so->so_rcv.sb_cc > so->so_rcv.sb_datalen) {
1213 ti->ti_urp = 0;
1214 tiflags &= ~TH_URG;
1215 goto dodata;
1216 }
1217 /*
1218 * If this segment advances the known urgent pointer,
1219 * then mark the data stream. This should not happen
1220 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1221 * a FIN has been received from the remote side.
1222 * In these states we ignore the URG.
1223 *
1224 * According to RFC961 (Assigned Protocols),
1225 * the urgent pointer points to the last octet
1226 * of urgent data. We continue, however,
1227 * to consider it to indicate the first octet
1228 * of data past the urgent section as the original
1229 * spec states (in one of two places).
1230 */
1231 if (SEQ_GT(ti->ti_seq + ti->ti_urp, tp->rcv_up)) {
1232 tp->rcv_up = ti->ti_seq + ti->ti_urp;
1233 so->so_urgc =
1234 so->so_rcv.sb_cc + (tp->rcv_up - tp->rcv_nxt); /* -1; */
1235 tp->rcv_up = ti->ti_seq + ti->ti_urp;
1236 }
1237 } else
1238 /*
1239 * If no out of band data is expected,
1240 * pull receive urgent pointer along
1241 * with the receive window.
1242 */
1243 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1244 tp->rcv_up = tp->rcv_nxt;
1245dodata:
1246
1247 /*
1248 * If this is a small packet, then ACK now - with Nagel
1249 * congestion avoidance sender won't send more until
1250 * he gets an ACK.
1251 */
1252 if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
1253 ((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
1254 tp->t_flags |= TF_ACKNOW;
1255 }
1256
1257 /*
1258 * Process the segment text, merging it into the TCP sequencing queue,
1259 * and arranging for acknowledgment of receipt if necessary.
1260 * This process logically involves adjusting tp->rcv_wnd as data
1261 * is presented to the user (this happens in tcp_usrreq.c,
1262 * case PRU_RCVD). If a FIN has already been received on this
1263 * connection then we just ignore the text.
1264 */
1265 if ((ti->ti_len || (tiflags & TH_FIN)) &&
1266 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1267 TCP_REASS(tp, ti, m, so, tiflags);
1268 } else {
1269 m_free(m);
1270 tiflags &= ~TH_FIN;
1271 }
1272
1273 /*
1274 * If FIN is received ACK the FIN and let the user know
1275 * that the connection is closing.
1276 */
1277 if (tiflags & TH_FIN) {
1278 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1279 /*
1280 * If we receive a FIN we can't send more data,
1281 * set it SS_FDRAIN
1282 * Shutdown the socket if there is no rx data in the
1283 * buffer.
1284 * soread() is called on completion of shutdown() and
1285 * will got to TCPS_LAST_ACK, and use tcp_output()
1286 * to send the FIN.
1287 */
1288 sofwdrain(so);
1289
1290 tp->t_flags |= TF_ACKNOW;
1291 tp->rcv_nxt++;
1292 }
1293 switch (tp->t_state) {
1294 /*
1295 * In SYN_RECEIVED and ESTABLISHED STATES
1296 * enter the CLOSE_WAIT state.
1297 */
1298 case TCPS_SYN_RECEIVED:
1299 case TCPS_ESTABLISHED:
1300 if (so->so_emu == EMU_CTL) /* no shutdown on socket */
1301 tp->t_state = TCPS_LAST_ACK;
1302 else
1303 tp->t_state = TCPS_CLOSE_WAIT;
1304 break;
1305
1306 /*
1307 * If still in FIN_WAIT_1 STATE FIN has not been acked so
1308 * enter the CLOSING state.
1309 */
1310 case TCPS_FIN_WAIT_1:
1311 tp->t_state = TCPS_CLOSING;
1312 break;
1313
1314 /*
1315 * In FIN_WAIT_2 state enter the TIME_WAIT state,
1316 * starting the time-wait timer, turning off the other
1317 * standard timers.
1318 */
1319 case TCPS_FIN_WAIT_2:
1320 tp->t_state = TCPS_TIME_WAIT;
1321 tcp_canceltimers(tp);
1322 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1323 break;
1324
1325 /*
1326 * In TIME_WAIT state restart the 2 MSL time_wait timer.
1327 */
1328 case TCPS_TIME_WAIT:
1329 tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1330 break;
1331 }
1332 }
1333
1334 /*
1335 * Return any desired output.
1336 */
1337 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
1338 (void)tcp_output(tp);
1339 }
1340 return;
1341
1342dropafterack:
1343 /*
1344 * Generate an ACK dropping incoming segment if it occupies
1345 * sequence space, where the ACK reflects our state.
1346 */
1347 if (tiflags & TH_RST)
1348 goto drop;
1349 m_free(m);
1350 tp->t_flags |= TF_ACKNOW;
1351 (void)tcp_output(tp);
1352 return;
1353
1354dropwithreset:
1355 /* reuses m if m!=NULL, m_free() unnecessary */
1356 if (tiflags & TH_ACK)
1357 tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST, af);
1358 else {
1359 if (tiflags & TH_SYN)
1360 ti->ti_len++;
1361 tcp_respond(tp, ti, m, ti->ti_seq + ti->ti_len, (tcp_seq)0,
1362 TH_RST | TH_ACK, af);
1363 }
1364
1365 return;
1366
1367drop:
1368 /*
1369 * Drop space held by incoming segment and return.
1370 */
1371 m_free(m);
1372}
1373
1374static void tcp_dooptions(struct tcpcb *tp, uint8_t *cp, int cnt,
1375 struct tcpiphdr *ti)
1376{
1377 uint16_t mss;
1378 int opt, optlen;
1379
1380 DEBUG_CALL("tcp_dooptions");
1381 DEBUG_ARG("tp = %p cnt=%i", tp, cnt);
1382
1383 for (; cnt > 0; cnt -= optlen, cp += optlen) {
1384 opt = cp[0];
1385 if (opt == TCPOPT_EOL)
1386 break;
1387 if (opt == TCPOPT_NOP)
1388 optlen = 1;
1389 else {
1390 optlen = cp[1];
1391 if (optlen <= 0)
1392 break;
1393 }
1394 switch (opt) {
1395 default:
1396 continue;
1397
1398 case TCPOPT_MAXSEG:
1399 if (optlen != TCPOLEN_MAXSEG)
1400 continue;
1401 if (!(ti->ti_flags & TH_SYN))
1402 continue;
1403 memcpy((char *)&mss, (char *)cp + 2, sizeof(mss));
1404 NTOHS(mss);
1405 (void)tcp_mss(tp, mss); /* sets t_maxseg */
1406 break;
1407 }
1408 }
1409}
1410
1411/*
1412 * Collect new round-trip time estimate
1413 * and update averages and current timeout.
1414 */
1415
1416static void tcp_xmit_timer(register struct tcpcb *tp, int rtt)
1417{
1418 register short delta;
1419
1420 DEBUG_CALL("tcp_xmit_timer");
1421 DEBUG_ARG("tp = %p", tp);
1422 DEBUG_ARG("rtt = %d", rtt);
1423
1424 if (tp->t_srtt != 0) {
1425 /*
1426 * srtt is stored as fixed point with 3 bits after the
1427 * binary point (i.e., scaled by 8). The following magic
1428 * is equivalent to the smoothing algorithm in rfc793 with
1429 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
1430 * point). Adjust rtt to origin 0.
1431 */
1432 delta = rtt - 1 - (tp->t_srtt >> TCP_RTT_SHIFT);
1433 if ((tp->t_srtt += delta) <= 0)
1434 tp->t_srtt = 1;
1435 /*
1436 * We accumulate a smoothed rtt variance (actually, a
1437 * smoothed mean difference), then set the retransmit
1438 * timer to smoothed rtt + 4 times the smoothed variance.
1439 * rttvar is stored as fixed point with 2 bits after the
1440 * binary point (scaled by 4). The following is
1441 * equivalent to rfc793 smoothing with an alpha of .75
1442 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
1443 * rfc793's wired-in beta.
1444 */
1445 if (delta < 0)
1446 delta = -delta;
1447 delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
1448 if ((tp->t_rttvar += delta) <= 0)
1449 tp->t_rttvar = 1;
1450 } else {
1451 /*
1452 * No rtt measurement yet - use the unsmoothed rtt.
1453 * Set the variance to half the rtt (so our first
1454 * retransmit happens at 3*rtt).
1455 */
1456 tp->t_srtt = rtt << TCP_RTT_SHIFT;
1457 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
1458 }
1459 tp->t_rtt = 0;
1460 tp->t_rxtshift = 0;
1461
1462 /*
1463 * the retransmit should happen at rtt + 4 * rttvar.
1464 * Because of the way we do the smoothing, srtt and rttvar
1465 * will each average +1/2 tick of bias. When we compute
1466 * the retransmit timer, we want 1/2 tick of rounding and
1467 * 1 extra tick because of +-1/2 tick uncertainty in the
1468 * firing of the timer. The bias will give us exactly the
1469 * 1.5 tick we need. But, because the bias is
1470 * statistical, we have to test that we don't drop below
1471 * the minimum feasible timer (which is 2 ticks).
1472 */
1473 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), (short)tp->t_rttmin,
1474 TCPTV_REXMTMAX); /* XXX */
1475
1476 /*
1477 * We received an ack for a packet that wasn't retransmitted;
1478 * it is probably safe to discard any error indications we've
1479 * received recently. This isn't quite right, but close enough
1480 * for now (a route might have failed after we sent a segment,
1481 * and the return path might not be symmetrical).
1482 */
1483 tp->t_softerror = 0;
1484}
1485
1486/*
1487 * Determine a reasonable value for maxseg size.
1488 * If the route is known, check route for mtu.
1489 * If none, use an mss that can be handled on the outgoing
1490 * interface without forcing IP to fragment; if bigger than
1491 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
1492 * to utilize large mbufs. If no route is found, route has no mtu,
1493 * or the destination isn't local, use a default, hopefully conservative
1494 * size (usually 512 or the default IP max size, but no more than the mtu
1495 * of the interface), as we can't discover anything about intervening
1496 * gateways or networks. We also initialize the congestion/slow start
1497 * window to be a single segment if the destination isn't local.
1498 * While looking at the routing entry, we also initialize other path-dependent
1499 * parameters from pre-set or cached values in the routing entry.
1500 */
1501
1502int tcp_mss(struct tcpcb *tp, unsigned offer)
1503{
1504 struct socket *so = tp->t_socket;
1505 int mss;
1506
1507 DEBUG_CALL("tcp_mss");
1508 DEBUG_ARG("tp = %p", tp);
1509 DEBUG_ARG("offer = %d", offer);
1510
1511 switch (so->so_ffamily) {
1512 case AF_INET:
1513 mss = MIN(IF_MTU, IF_MRU) - sizeof(struct tcphdr) - sizeof(struct ip);
1514 break;
1515 case AF_INET6:
1516 mss = MIN(IF_MTU, IF_MRU) - sizeof(struct tcphdr) - sizeof(struct ip6);
1517 break;
1518 default:
1519 g_assert_not_reached();
1520 }
1521
1522 if (offer)
1523 mss = MIN(mss, offer);
1524 mss = MAX(mss, 32);
1525 if (mss < tp->t_maxseg || offer != 0)
1526 tp->t_maxseg = mss;
1527
1528 tp->snd_cwnd = mss;
1529
1530 sbreserve(&so->so_snd,
1531 TCP_SNDSPACE +
1532 ((TCP_SNDSPACE % mss) ? (mss - (TCP_SNDSPACE % mss)) : 0));
1533 sbreserve(&so->so_rcv,
1534 TCP_RCVSPACE +
1535 ((TCP_RCVSPACE % mss) ? (mss - (TCP_RCVSPACE % mss)) : 0));
1536
1537 DEBUG_MISC(" returning mss = %d", mss);
1538
1539 return mss;
1540}
1541