1/*
2 * Copyright (c) 2000-2017 Apple Inc. All rights reserved.
3 *
4 * @APPLE_OSREFERENCE_LICENSE_HEADER_START@
5 *
6 * This file contains Original Code and/or Modifications of Original Code
7 * as defined in and that are subject to the Apple Public Source License
8 * Version 2.0 (the 'License'). You may not use this file except in
9 * compliance with the License. The rights granted to you under the License
10 * may not be used to create, or enable the creation or redistribution of,
11 * unlawful or unlicensed copies of an Apple operating system, or to
12 * circumvent, violate, or enable the circumvention or violation of, any
13 * terms of an Apple operating system software license agreement.
14 *
15 * Please obtain a copy of the License at
16 * http://www.opensource.apple.com/apsl/ and read it before using this file.
17 *
18 * The Original Code and all software distributed under the License are
19 * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER
20 * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES,
21 * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY,
22 * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT.
23 * Please see the License for the specific language governing rights and
24 * limitations under the License.
25 *
26 * @APPLE_OSREFERENCE_LICENSE_HEADER_END@
27 */
28/*
29 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
30 * The Regents of the University of California. All rights reserved.
31 *
32 * Redistribution and use in source and binary forms, with or without
33 * modification, are permitted provided that the following conditions
34 * are met:
35 * 1. Redistributions of source code must retain the above copyright
36 * notice, this list of conditions and the following disclaimer.
37 * 2. Redistributions in binary form must reproduce the above copyright
38 * notice, this list of conditions and the following disclaimer in the
39 * documentation and/or other materials provided with the distribution.
40 * 3. All advertising materials mentioning features or use of this software
41 * must display the following acknowledgement:
42 * This product includes software developed by the University of
43 * California, Berkeley and its contributors.
44 * 4. Neither the name of the University nor the names of its contributors
45 * may be used to endorse or promote products derived from this software
46 * without specific prior written permission.
47 *
48 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
49 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
50 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
51 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
52 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
53 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
54 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
55 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
56 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
57 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
58 * SUCH DAMAGE.
59 *
60 * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95
61 * $FreeBSD: src/sys/netinet/tcp_input.c,v 1.107.2.16 2001/08/22 00:59:12 silby Exp $
62 */
63/*
64 * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce
65 * support for mandatory and extensible security protections. This notice
66 * is included in support of clause 2.2 (b) of the Apple Public License,
67 * Version 2.0.
68 */
69
70#include <sys/param.h>
71#include <sys/systm.h>
72#include <sys/kernel.h>
73#include <sys/sysctl.h>
74#include <sys/malloc.h>
75#include <sys/mbuf.h>
76#include <sys/proc.h> /* for proc0 declaration */
77#include <sys/protosw.h>
78#include <sys/socket.h>
79#include <sys/socketvar.h>
80#include <sys/syslog.h>
81#include <sys/mcache.h>
82#if !CONFIG_EMBEDDED
83#include <sys/kasl.h>
84#endif
85#include <sys/kauth.h>
86#include <kern/cpu_number.h> /* before tcp_seq.h, for tcp_random18() */
87
88#include <machine/endian.h>
89
90#include <net/if.h>
91#include <net/if_types.h>
92#include <net/route.h>
93#include <net/ntstat.h>
94#include <net/dlil.h>
95
96#include <netinet/in.h>
97#include <netinet/in_systm.h>
98#include <netinet/ip.h>
99#include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */
100#include <netinet/in_var.h>
101#include <netinet/icmp_var.h> /* for ICMP_BANDLIM */
102#include <netinet/in_pcb.h>
103#include <netinet/ip_var.h>
104#include <mach/sdt.h>
105#if INET6
106#include <netinet/ip6.h>
107#include <netinet/icmp6.h>
108#include <netinet6/nd6.h>
109#include <netinet6/ip6_var.h>
110#include <netinet6/in6_pcb.h>
111#endif
112#include <netinet/tcp.h>
113#include <netinet/tcp_cache.h>
114#include <netinet/tcp_fsm.h>
115#include <netinet/tcp_seq.h>
116#include <netinet/tcp_timer.h>
117#include <netinet/tcp_var.h>
118#include <netinet/tcp_cc.h>
119#include <dev/random/randomdev.h>
120#include <kern/zalloc.h>
121#if INET6
122#include <netinet6/tcp6_var.h>
123#endif
124#include <netinet/tcpip.h>
125#if TCPDEBUG
126#include <netinet/tcp_debug.h>
127u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */
128struct tcphdr tcp_savetcp;
129#endif /* TCPDEBUG */
130
131#if IPSEC
132#include <netinet6/ipsec.h>
133#if INET6
134#include <netinet6/ipsec6.h>
135#endif
136#include <netkey/key.h>
137#endif /*IPSEC*/
138
139#if CONFIG_MACF_NET || CONFIG_MACF_SOCKET
140#include <security/mac_framework.h>
141#endif /* CONFIG_MACF_NET || CONFIG_MACF_SOCKET */
142
143#include <sys/kdebug.h>
144#include <netinet/lro_ext.h>
145#if MPTCP
146#include <netinet/mptcp_var.h>
147#include <netinet/mptcp.h>
148#include <netinet/mptcp_opt.h>
149#endif /* MPTCP */
150
151#include <corecrypto/ccaes.h>
152
153#define DBG_LAYER_BEG NETDBG_CODE(DBG_NETTCP, 0)
154#define DBG_LAYER_END NETDBG_CODE(DBG_NETTCP, 2)
155#define DBG_FNC_TCP_INPUT NETDBG_CODE(DBG_NETTCP, (3 << 8))
156#define DBG_FNC_TCP_NEWCONN NETDBG_CODE(DBG_NETTCP, (7 << 8))
157
158#define TCP_RTT_HISTORY_EXPIRE_TIME (60 * TCP_RETRANSHZ)
159#define TCP_RECV_THROTTLE_WIN (5 * TCP_RETRANSHZ)
160#define TCP_STRETCHACK_ENABLE_PKTCNT 2000
161
162struct tcpstat tcpstat;
163
164static int log_in_vain = 0;
165SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain,
166 CTLFLAG_RW | CTLFLAG_LOCKED, &log_in_vain, 0,
167 "Log all incoming TCP connections");
168
169static int blackhole = 0;
170SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole,
171 CTLFLAG_RW | CTLFLAG_LOCKED, &blackhole, 0,
172 "Do not send RST when dropping refused connections");
173
174SYSCTL_SKMEM_TCP_INT(OID_AUTO, delayed_ack,
175 CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_delack_enabled, 3,
176 "Delay ACK to try and piggyback it onto a data packet");
177
178SYSCTL_SKMEM_TCP_INT(OID_AUTO, tcp_lq_overflow,
179 CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_lq_overflow, 1,
180 "Listen Queue Overflow");
181
182SYSCTL_SKMEM_TCP_INT(OID_AUTO, recvbg, CTLFLAG_RW | CTLFLAG_LOCKED,
183 int, tcp_recv_bg, 0, "Receive background");
184
185#if TCP_DROP_SYNFIN
186SYSCTL_SKMEM_TCP_INT(OID_AUTO, drop_synfin,
187 CTLFLAG_RW | CTLFLAG_LOCKED, static int, drop_synfin, 1,
188 "Drop TCP packets with SYN+FIN set");
189#endif
190
191SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW|CTLFLAG_LOCKED, 0,
192 "TCP Segment Reassembly Queue");
193
194static int tcp_reass_overflows = 0;
195SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows,
196 CTLFLAG_RD | CTLFLAG_LOCKED, &tcp_reass_overflows, 0,
197 "Global number of TCP Segment Reassembly Queue Overflows");
198
199
200SYSCTL_SKMEM_TCP_INT(OID_AUTO, slowlink_wsize, CTLFLAG_RW | CTLFLAG_LOCKED,
201 __private_extern__ int, slowlink_wsize, 8192,
202 "Maximum advertised window size for slowlink");
203
204SYSCTL_SKMEM_TCP_INT(OID_AUTO, maxseg_unacked,
205 CTLFLAG_RW | CTLFLAG_LOCKED, int, maxseg_unacked, 8,
206 "Maximum number of outstanding segments left unacked");
207
208SYSCTL_SKMEM_TCP_INT(OID_AUTO, rfc3465, CTLFLAG_RW | CTLFLAG_LOCKED,
209 int, tcp_do_rfc3465, 1, "");
210
211SYSCTL_SKMEM_TCP_INT(OID_AUTO, rfc3465_lim2,
212 CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_do_rfc3465_lim2, 1,
213 "Appropriate bytes counting w/ L=2*SMSS");
214
215int rtt_samples_per_slot = 20;
216
217int tcp_acc_iaj_high_thresh = ACC_IAJ_HIGH_THRESH;
218u_int32_t tcp_autorcvbuf_inc_shift = 3;
219SYSCTL_SKMEM_TCP_INT(OID_AUTO, recv_allowed_iaj,
220 CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_allowed_iaj, ALLOWED_IAJ,
221 "Allowed inter-packet arrival jiter");
222#if (DEVELOPMENT || DEBUG)
223SYSCTL_INT(_net_inet_tcp, OID_AUTO, acc_iaj_high_thresh,
224 CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_acc_iaj_high_thresh, 0,
225 "Used in calculating maximum accumulated IAJ");
226
227SYSCTL_INT(_net_inet_tcp, OID_AUTO, autorcvbufincshift,
228 CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_autorcvbuf_inc_shift, 0,
229 "Shift for increment in receive socket buffer size");
230#endif /* (DEVELOPMENT || DEBUG) */
231
232SYSCTL_SKMEM_TCP_INT(OID_AUTO, doautorcvbuf,
233 CTLFLAG_RW | CTLFLAG_LOCKED, u_int32_t, tcp_do_autorcvbuf, 1,
234 "Enable automatic socket buffer tuning");
235
236SYSCTL_SKMEM_TCP_INT(OID_AUTO, autorcvbufmax,
237 CTLFLAG_RW | CTLFLAG_LOCKED, u_int32_t, tcp_autorcvbuf_max, 512 * 1024,
238 "Maximum receive socket buffer size");
239
240#if CONFIG_EMBEDDED
241int sw_lro = 1;
242#else
243int sw_lro = 0;
244#endif /* !CONFIG_EMBEDDED */
245SYSCTL_INT(_net_inet_tcp, OID_AUTO, lro, CTLFLAG_RW | CTLFLAG_LOCKED,
246 &sw_lro, 0, "Used to coalesce TCP packets");
247
248int lrodebug = 0;
249SYSCTL_INT(_net_inet_tcp, OID_AUTO, lrodbg,
250 CTLFLAG_RW | CTLFLAG_LOCKED, &lrodebug, 0,
251 "Used to debug SW LRO");
252
253int lro_start = 4;
254SYSCTL_INT(_net_inet_tcp, OID_AUTO, lro_startcnt,
255 CTLFLAG_RW | CTLFLAG_LOCKED, &lro_start, 0,
256 "Segments for starting LRO computed as power of 2");
257
258int limited_txmt = 1;
259int early_rexmt = 1;
260int sack_ackadv = 1;
261int tcp_dsack_enable = 1;
262
263#if (DEVELOPMENT || DEBUG)
264SYSCTL_INT(_net_inet_tcp, OID_AUTO, limited_transmit,
265 CTLFLAG_RW | CTLFLAG_LOCKED, &limited_txmt, 0,
266 "Enable limited transmit");
267
268SYSCTL_INT(_net_inet_tcp, OID_AUTO, early_rexmt,
269 CTLFLAG_RW | CTLFLAG_LOCKED, &early_rexmt, 0,
270 "Enable Early Retransmit");
271
272SYSCTL_INT(_net_inet_tcp, OID_AUTO, sack_ackadv,
273 CTLFLAG_RW | CTLFLAG_LOCKED, &sack_ackadv, 0,
274 "Use SACK with cumulative ack advancement as a dupack");
275
276SYSCTL_INT(_net_inet_tcp, OID_AUTO, dsack_enable,
277 CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_dsack_enable, 0,
278 "use DSACK TCP option to report duplicate segments");
279
280#endif /* (DEVELOPMENT || DEBUG) */
281int tcp_disable_access_to_stats = 1;
282SYSCTL_INT(_net_inet_tcp, OID_AUTO, disable_access_to_stats,
283 CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_disable_access_to_stats, 0,
284 "Disable access to tcpstat");
285
286SYSCTL_SKMEM_TCP_INT(OID_AUTO, challengeack_limit,
287 CTLFLAG_RW | CTLFLAG_LOCKED, uint32_t, tcp_challengeack_limit, 10,
288 "Maximum number of challenge ACKs per connection per second");
289
290SYSCTL_SKMEM_TCP_INT(OID_AUTO, do_rfc5961,
291 CTLFLAG_RW | CTLFLAG_LOCKED, static int, tcp_do_rfc5961, 1,
292 "Enable/Disable full RFC 5961 compliance");
293
294extern int tcp_TCPTV_MIN;
295extern int tcp_acc_iaj_high;
296extern int tcp_acc_iaj_react_limit;
297
298int tcprexmtthresh = 3;
299
300u_int32_t tcp_now;
301struct timeval tcp_uptime; /* uptime when tcp_now was last updated */
302lck_spin_t *tcp_uptime_lock; /* Used to sychronize updates to tcp_now */
303
304struct inpcbhead tcb;
305#define tcb6 tcb /* for KAME src sync over BSD*'s */
306struct inpcbinfo tcbinfo;
307
308static void tcp_dooptions(struct tcpcb *, u_char *, int, struct tcphdr *,
309 struct tcpopt *);
310static void tcp_finalize_options(struct tcpcb *, struct tcpopt *, unsigned int);
311static void tcp_pulloutofband(struct socket *,
312 struct tcphdr *, struct mbuf *, int);
313static int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *,
314 struct ifnet *);
315static void tcp_xmit_timer(struct tcpcb *, int, u_int32_t, tcp_seq);
316static inline unsigned int tcp_maxmtu(struct rtentry *);
317static inline int tcp_stretch_ack_enable(struct tcpcb *tp, int thflags);
318static inline void tcp_adaptive_rwtimo_check(struct tcpcb *, int);
319
320#if TRAFFIC_MGT
321static inline void update_iaj_state(struct tcpcb *tp, uint32_t tlen,
322 int reset_size);
323void compute_iaj(struct tcpcb *tp, int nlropkts, int lro_delay_factor);
324static void compute_iaj_meat(struct tcpcb *tp, uint32_t cur_iaj);
325#endif /* TRAFFIC_MGT */
326
327#if INET6
328static inline unsigned int tcp_maxmtu6(struct rtentry *);
329#endif
330
331unsigned int get_maxmtu(struct rtentry *);
332
333static void tcp_sbrcv_grow(struct tcpcb *tp, struct sockbuf *sb,
334 struct tcpopt *to, u_int32_t tlen, u_int32_t rcvbuf_max);
335void tcp_sbrcv_trim(struct tcpcb *tp, struct sockbuf *sb);
336static void tcp_sbsnd_trim(struct sockbuf *sbsnd);
337static inline void tcp_sbrcv_tstmp_check(struct tcpcb *tp);
338static inline void tcp_sbrcv_reserve(struct tcpcb *tp, struct sockbuf *sb,
339 u_int32_t newsize, u_int32_t idealsize, u_int32_t rcvbuf_max);
340static void tcp_bad_rexmt_restore_state(struct tcpcb *tp, struct tcphdr *th);
341static void tcp_compute_rtt(struct tcpcb *tp, struct tcpopt *to,
342 struct tcphdr *th);
343static void tcp_early_rexmt_check(struct tcpcb *tp, struct tcphdr *th);
344static void tcp_bad_rexmt_check(struct tcpcb *tp, struct tcphdr *th,
345 struct tcpopt *to);
346/*
347 * Constants used for resizing receive socket buffer
348 * when timestamps are not supported
349 */
350#define TCPTV_RCVNOTS_QUANTUM 100
351#define TCP_RCVNOTS_BYTELEVEL 204800
352
353/*
354 * Constants used for limiting early retransmits
355 * to 10 per minute.
356 */
357#define TCP_EARLY_REXMT_WIN (60 * TCP_RETRANSHZ) /* 60 seconds */
358#define TCP_EARLY_REXMT_LIMIT 10
359
360extern void ipfwsyslog( int level, const char *format,...);
361extern int fw_verbose;
362
363#if IPFIREWALL
364extern void ipfw_stealth_stats_incr_tcp(void);
365
366#define log_in_vain_log( a ) { \
367 if ( (log_in_vain == 3 ) && (fw_verbose == 2)) { /* Apple logging, log to ipfw.log */ \
368 ipfwsyslog a ; \
369 } else if ( (log_in_vain == 4 ) && (fw_verbose == 2)) { \
370 ipfw_stealth_stats_incr_tcp(); \
371 } \
372 else log a ; \
373}
374#else
375#define log_in_vain_log( a ) { log a; }
376#endif
377
378int tcp_rcvunackwin = TCPTV_UNACKWIN;
379int tcp_maxrcvidle = TCPTV_MAXRCVIDLE;
380SYSCTL_SKMEM_TCP_INT(OID_AUTO, rcvsspktcnt, CTLFLAG_RW | CTLFLAG_LOCKED,
381 int, tcp_rcvsspktcnt, TCP_RCV_SS_PKTCOUNT, "packets to be seen before receiver stretches acks");
382
383#define DELAY_ACK(tp, th) \
384 (CC_ALGO(tp)->delay_ack != NULL && CC_ALGO(tp)->delay_ack(tp, th))
385
386static int tcp_dropdropablreq(struct socket *head);
387static void tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th);
388static void update_base_rtt(struct tcpcb *tp, uint32_t rtt);
389void tcp_set_background_cc(struct socket *so);
390void tcp_set_foreground_cc(struct socket *so);
391static void tcp_set_new_cc(struct socket *so, uint16_t cc_index);
392static void tcp_bwmeas_check(struct tcpcb *tp);
393
394#if TRAFFIC_MGT
395void
396reset_acc_iaj(struct tcpcb *tp)
397{
398 tp->acc_iaj = 0;
399 CLEAR_IAJ_STATE(tp);
400}
401
402static inline void
403update_iaj_state(struct tcpcb *tp, uint32_t size, int rst_size)
404{
405 if (rst_size > 0)
406 tp->iaj_size = 0;
407 if (tp->iaj_size == 0 || size >= tp->iaj_size) {
408 tp->iaj_size = size;
409 tp->iaj_rcv_ts = tcp_now;
410 tp->iaj_small_pkt = 0;
411 }
412}
413
414/* For every 32 bit unsigned integer(v), this function will find the
415 * largest integer n such that (n*n <= v). This takes at most 16 iterations
416 * irrespective of the value of v and does not involve multiplications.
417 */
418static inline int
419isqrt(unsigned int val)
420{
421 unsigned int sqrt_cache[11] = {0, 1, 4, 9, 16, 25, 36, 49, 64, 81, 100};
422 unsigned int temp, g=0, b=0x8000, bshft=15;
423 if ( val <= 100) {
424 for (g = 0; g <= 10; ++g) {
425 if (sqrt_cache[g] > val) {
426 g--;
427 break;
428 } else if (sqrt_cache[g] == val) {
429 break;
430 }
431 }
432 } else {
433 do {
434 temp = (((g << 1) + b) << (bshft--));
435 if (val >= temp) {
436 g += b;
437 val -= temp;
438 }
439 b >>= 1;
440 } while ( b > 0 && val > 0);
441 }
442 return(g);
443}
444
445/*
446* With LRO, roughly estimate the inter arrival time between
447* each sub coalesced packet as an average. Count the delay
448* cur_iaj to be the delay between the last packet received
449* and the first packet of the LRO stream. Due to round off errors
450* cur_iaj may be the same as lro_delay_factor. Averaging has
451* round off errors too. lro_delay_factor may be close to 0
452* in steady state leading to lower values fed to compute_iaj_meat.
453*/
454void
455compute_iaj(struct tcpcb *tp, int nlropkts, int lro_delay_factor)
456{
457 uint32_t cur_iaj = tcp_now - tp->iaj_rcv_ts;
458 uint32_t timediff = 0;
459
460 if (cur_iaj >= lro_delay_factor) {
461 cur_iaj = cur_iaj - lro_delay_factor;
462 }
463
464 compute_iaj_meat(tp, cur_iaj);
465
466 if (nlropkts <= 1)
467 return;
468
469 nlropkts--;
470
471 timediff = lro_delay_factor/nlropkts;
472
473 while (nlropkts > 0)
474 {
475 compute_iaj_meat(tp, timediff);
476 nlropkts--;
477 }
478}
479
480static
481void compute_iaj_meat(struct tcpcb *tp, uint32_t cur_iaj)
482{
483 /* When accumulated IAJ reaches MAX_ACC_IAJ in milliseconds,
484 * throttle the receive window to a minimum of MIN_IAJ_WIN packets
485 */
486#define MAX_ACC_IAJ (tcp_acc_iaj_high_thresh + tcp_acc_iaj_react_limit)
487#define IAJ_DIV_SHIFT 4
488#define IAJ_ROUNDUP_CONST (1 << (IAJ_DIV_SHIFT - 1))
489
490 uint32_t allowed_iaj, acc_iaj = 0;
491
492 uint32_t mean, temp;
493 int32_t cur_iaj_dev;
494
495 cur_iaj_dev = (cur_iaj - tp->avg_iaj);
496
497 /* Allow a jitter of "allowed_iaj" milliseconds. Some connections
498 * may have a constant jitter more than that. We detect this by
499 * using standard deviation.
500 */
501 allowed_iaj = tp->avg_iaj + tp->std_dev_iaj;
502 if (allowed_iaj < tcp_allowed_iaj)
503 allowed_iaj = tcp_allowed_iaj;
504
505 /* Initially when the connection starts, the senders congestion
506 * window is small. During this period we avoid throttling a
507 * connection because we do not have a good starting point for
508 * allowed_iaj. IAJ_IGNORE_PKTCNT is used to quietly gloss over
509 * the first few packets.
510 */
511 if (tp->iaj_pktcnt > IAJ_IGNORE_PKTCNT) {
512 if ( cur_iaj <= allowed_iaj ) {
513 if (tp->acc_iaj >= 2)
514 acc_iaj = tp->acc_iaj - 2;
515 else
516 acc_iaj = 0;
517
518 } else {
519 acc_iaj = tp->acc_iaj + (cur_iaj - allowed_iaj);
520 }
521
522 if (acc_iaj > MAX_ACC_IAJ)
523 acc_iaj = MAX_ACC_IAJ;
524 tp->acc_iaj = acc_iaj;
525 }
526
527 /* Compute weighted average where the history has a weight of
528 * 15 out of 16 and the current value has a weight of 1 out of 16.
529 * This will make the short-term measurements have more weight.
530 *
531 * The addition of 8 will help to round-up the value
532 * instead of round-down
533 */
534 tp->avg_iaj = (((tp->avg_iaj << IAJ_DIV_SHIFT) - tp->avg_iaj)
535 + cur_iaj + IAJ_ROUNDUP_CONST) >> IAJ_DIV_SHIFT;
536
537 /* Compute Root-mean-square of deviation where mean is a weighted
538 * average as described above.
539 */
540 temp = tp->std_dev_iaj * tp->std_dev_iaj;
541 mean = (((temp << IAJ_DIV_SHIFT) - temp)
542 + (cur_iaj_dev * cur_iaj_dev)
543 + IAJ_ROUNDUP_CONST) >> IAJ_DIV_SHIFT;
544
545 tp->std_dev_iaj = isqrt(mean);
546
547 DTRACE_TCP3(iaj, struct tcpcb *, tp, uint32_t, cur_iaj,
548 uint32_t, allowed_iaj);
549
550 return;
551}
552#endif /* TRAFFIC_MGT */
553
554/*
555 * Perform rate limit check per connection per second
556 * tp->t_challengeack_last is the last_time diff was greater than 1sec
557 * tp->t_challengeack_count is the number of ACKs sent (within 1sec)
558 * Return TRUE if we shouldn't send the ACK due to rate limitation
559 * Return FALSE if it is still ok to send challenge ACK
560 */
561static boolean_t
562tcp_is_ack_ratelimited(struct tcpcb *tp)
563{
564 boolean_t ret = TRUE;
565 uint32_t now = tcp_now;
566 int32_t diff = 0;
567
568 diff = timer_diff(now, 0, tp->t_challengeack_last, 0);
569 /* If it is first time or diff > 1000ms,
570 * update the challengeack_last and reset the
571 * current count of ACKs
572 */
573 if (tp->t_challengeack_last == 0 || diff >= 1000) {
574 tp->t_challengeack_last = now;
575 tp->t_challengeack_count = 0;
576 ret = FALSE;
577 } else if (tp->t_challengeack_count < tcp_challengeack_limit) {
578 ret = FALSE;
579 }
580
581 /* Careful about wrap-around */
582 if (ret == FALSE && (tp->t_challengeack_count + 1 > 0))
583 tp->t_challengeack_count++;
584
585 return (ret);
586}
587
588/* Check if enough amount of data has been acknowledged since
589 * bw measurement was started
590 */
591static void
592tcp_bwmeas_check(struct tcpcb *tp)
593{
594 int32_t bw_meas_bytes;
595 uint32_t bw, bytes, elapsed_time;
596
597 if (SEQ_LEQ(tp->snd_una, tp->t_bwmeas->bw_start))
598 return;
599
600 bw_meas_bytes = tp->snd_una - tp->t_bwmeas->bw_start;
601 if ((tp->t_flagsext & TF_BWMEAS_INPROGRESS) &&
602 bw_meas_bytes >= (int32_t)(tp->t_bwmeas->bw_size)) {
603 bytes = bw_meas_bytes;
604 elapsed_time = tcp_now - tp->t_bwmeas->bw_ts;
605 if (elapsed_time > 0) {
606 bw = bytes / elapsed_time;
607 if ( bw > 0) {
608 if (tp->t_bwmeas->bw_sndbw > 0) {
609 tp->t_bwmeas->bw_sndbw =
610 (((tp->t_bwmeas->bw_sndbw << 3)
611 - tp->t_bwmeas->bw_sndbw)
612 + bw) >> 3;
613 } else {
614 tp->t_bwmeas->bw_sndbw = bw;
615 }
616
617 /* Store the maximum value */
618 if (tp->t_bwmeas->bw_sndbw_max == 0) {
619 tp->t_bwmeas->bw_sndbw_max =
620 tp->t_bwmeas->bw_sndbw;
621 } else {
622 tp->t_bwmeas->bw_sndbw_max =
623 max(tp->t_bwmeas->bw_sndbw,
624 tp->t_bwmeas->bw_sndbw_max);
625 }
626 }
627 }
628 tp->t_flagsext &= ~(TF_BWMEAS_INPROGRESS);
629 }
630}
631
632static int
633tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m,
634 struct ifnet *ifp)
635{
636 struct tseg_qent *q;
637 struct tseg_qent *p = NULL;
638 struct tseg_qent *nq;
639 struct tseg_qent *te = NULL;
640 struct inpcb *inp = tp->t_inpcb;
641 struct socket *so = inp->inp_socket;
642 int flags = 0;
643 int dowakeup = 0;
644 struct mbuf *oodata = NULL;
645 int copy_oodata = 0;
646 u_int16_t qlimit;
647 boolean_t cell = IFNET_IS_CELLULAR(ifp);
648 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
649 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
650 boolean_t dsack_set = FALSE;
651
652 /*
653 * Call with th==0 after become established to
654 * force pre-ESTABLISHED data up to user socket.
655 */
656 if (th == NULL)
657 goto present;
658
659 /*
660 * If the reassembly queue already has entries or if we are going
661 * to add a new one, then the connection has reached a loss state.
662 * Reset the stretch-ack algorithm at this point.
663 */
664 tcp_reset_stretch_ack(tp);
665
666#if TRAFFIC_MGT
667 if (tp->acc_iaj > 0)
668 reset_acc_iaj(tp);
669#endif /* TRAFFIC_MGT */
670
671 /*
672 * Limit the number of segments in the reassembly queue to prevent
673 * holding on to too many segments (and thus running out of mbufs).
674 * Make sure to let the missing segment through which caused this
675 * queue. Always keep one global queue entry spare to be able to
676 * process the missing segment.
677 */
678 qlimit = min(max(100, so->so_rcv.sb_hiwat >> 10),
679 (TCP_AUTORCVBUF_MAX(ifp) >> 10));
680 if (th->th_seq != tp->rcv_nxt &&
681 (tp->t_reassqlen + 1) >= qlimit) {
682 tcp_reass_overflows++;
683 tcpstat.tcps_rcvmemdrop++;
684 m_freem(m);
685 *tlenp = 0;
686 return (0);
687 }
688
689 /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */
690 te = (struct tseg_qent *) zalloc(tcp_reass_zone);
691 if (te == NULL) {
692 tcpstat.tcps_rcvmemdrop++;
693 m_freem(m);
694 return (0);
695 }
696 tp->t_reassqlen++;
697
698 /*
699 * Find a segment which begins after this one does.
700 */
701 LIST_FOREACH(q, &tp->t_segq, tqe_q) {
702 if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
703 break;
704 p = q;
705 }
706
707 /*
708 * If there is a preceding segment, it may provide some of
709 * our data already. If so, drop the data from the incoming
710 * segment. If it provides all of our data, drop us.
711 */
712 if (p != NULL) {
713 int i;
714 /* conversion to int (in i) handles seq wraparound */
715 i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
716 if (i > 0) {
717 if (TCP_DSACK_ENABLED(tp) && i > 1) {
718 /*
719 * Note duplicate data sequnce numbers
720 * to report in DSACK option
721 */
722 tp->t_dsack_lseq = th->th_seq;
723 tp->t_dsack_rseq = th->th_seq +
724 min(i, *tlenp);
725
726 /*
727 * Report only the first part of partial/
728 * non-contiguous duplicate sequence space
729 */
730 dsack_set = TRUE;
731 }
732 if (i >= *tlenp) {
733 tcpstat.tcps_rcvduppack++;
734 tcpstat.tcps_rcvdupbyte += *tlenp;
735 if (nstat_collect) {
736 nstat_route_rx(inp->inp_route.ro_rt,
737 1, *tlenp,
738 NSTAT_RX_FLAG_DUPLICATE);
739 INP_ADD_STAT(inp, cell, wifi, wired,
740 rxpackets, 1);
741 INP_ADD_STAT(inp, cell, wifi, wired,
742 rxbytes, *tlenp);
743 tp->t_stat.rxduplicatebytes += *tlenp;
744 inp_set_activity_bitmap(inp);
745 }
746 m_freem(m);
747 zfree(tcp_reass_zone, te);
748 te = NULL;
749 tp->t_reassqlen--;
750 /*
751 * Try to present any queued data
752 * at the left window edge to the user.
753 * This is needed after the 3-WHS
754 * completes.
755 */
756 goto present;
757 }
758 m_adj(m, i);
759 *tlenp -= i;
760 th->th_seq += i;
761 }
762 }
763 tp->t_rcvoopack++;
764 tcpstat.tcps_rcvoopack++;
765 tcpstat.tcps_rcvoobyte += *tlenp;
766 if (nstat_collect) {
767 nstat_route_rx(inp->inp_route.ro_rt, 1, *tlenp,
768 NSTAT_RX_FLAG_OUT_OF_ORDER);
769 INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
770 INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, *tlenp);
771 tp->t_stat.rxoutoforderbytes += *tlenp;
772 inp_set_activity_bitmap(inp);
773 }
774
775 /*
776 * While we overlap succeeding segments trim them or,
777 * if they are completely covered, dequeue them.
778 */
779 while (q) {
780 int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
781 if (i <= 0)
782 break;
783
784 /*
785 * Report only the first part of partial/non-contiguous
786 * duplicate segment in dsack option. The variable
787 * dsack_set will be true if a previous entry has some of
788 * the duplicate sequence space.
789 */
790 if (TCP_DSACK_ENABLED(tp) && i > 1 && !dsack_set) {
791 if (tp->t_dsack_lseq == 0) {
792 tp->t_dsack_lseq = q->tqe_th->th_seq;
793 tp->t_dsack_rseq =
794 tp->t_dsack_lseq + min(i, q->tqe_len);
795 } else {
796 /*
797 * this segment overlaps data in multple
798 * entries in the reassembly queue, move
799 * the right sequence number further.
800 */
801 tp->t_dsack_rseq =
802 tp->t_dsack_rseq + min(i, q->tqe_len);
803 }
804 }
805 if (i < q->tqe_len) {
806 q->tqe_th->th_seq += i;
807 q->tqe_len -= i;
808 m_adj(q->tqe_m, i);
809 break;
810 }
811
812 nq = LIST_NEXT(q, tqe_q);
813 LIST_REMOVE(q, tqe_q);
814 m_freem(q->tqe_m);
815 zfree(tcp_reass_zone, q);
816 tp->t_reassqlen--;
817 q = nq;
818 }
819
820 /* Insert the new segment queue entry into place. */
821 te->tqe_m = m;
822 te->tqe_th = th;
823 te->tqe_len = *tlenp;
824
825 if (p == NULL) {
826 LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
827 } else {
828 LIST_INSERT_AFTER(p, te, tqe_q);
829 }
830
831 /*
832 * New out-of-order data exists, and is pointed to by
833 * queue entry te. Set copy_oodata to 1 so out-of-order data
834 * can be copied off to sockbuf after in-order data
835 * is copied off.
836 */
837 if (!(so->so_state & SS_CANTRCVMORE))
838 copy_oodata = 1;
839
840present:
841 /*
842 * Present data to user, advancing rcv_nxt through
843 * completed sequence space.
844 */
845 if (!TCPS_HAVEESTABLISHED(tp->t_state))
846 return (0);
847 q = LIST_FIRST(&tp->t_segq);
848 if (!q || q->tqe_th->th_seq != tp->rcv_nxt) {
849 /* Stop using LRO once out of order packets arrive */
850 if (tp->t_flagsext & TF_LRO_OFFLOADED) {
851 tcp_lro_remove_state(inp->inp_laddr, inp->inp_faddr,
852 th->th_dport, th->th_sport);
853 tp->t_flagsext &= ~TF_LRO_OFFLOADED;
854 }
855
856 /*
857 * continue processing if out-of-order data
858 * can be delivered
859 */
860 if (q && (so->so_flags & SOF_ENABLE_MSGS))
861 goto msg_unordered_delivery;
862
863 return (0);
864 }
865
866 /*
867 * If there is already another thread doing reassembly for this
868 * connection, it is better to let it finish the job --
869 * (radar 16316196)
870 */
871 if (tp->t_flagsext & TF_REASS_INPROG)
872 return (0);
873
874 tp->t_flagsext |= TF_REASS_INPROG;
875 /* lost packet was recovered, so ooo data can be returned */
876 tcpstat.tcps_recovered_pkts++;
877
878 do {
879 tp->rcv_nxt += q->tqe_len;
880 flags = q->tqe_th->th_flags & TH_FIN;
881 LIST_REMOVE(q, tqe_q);
882 if (so->so_state & SS_CANTRCVMORE) {
883 m_freem(q->tqe_m);
884 } else {
885 so_recv_data_stat(so, q->tqe_m, 0); /* XXXX */
886 if (so->so_flags & SOF_ENABLE_MSGS) {
887 /*
888 * Append the inorder data as a message to the
889 * receive socket buffer. Also check to see if
890 * the data we are about to deliver is the same
891 * data that we wanted to pass up to the user
892 * out of order. If so, reset copy_oodata --
893 * the received data filled a gap, and
894 * is now in order!
895 */
896 if (q == te)
897 copy_oodata = 0;
898 }
899 if (sbappendstream_rcvdemux(so, q->tqe_m,
900 q->tqe_th->th_seq - (tp->irs + 1), 0))
901 dowakeup = 1;
902 if (tp->t_flagsext & TF_LRO_OFFLOADED) {
903 tcp_update_lro_seq(tp->rcv_nxt,
904 inp->inp_laddr, inp->inp_faddr,
905 th->th_dport, th->th_sport);
906 }
907 }
908 zfree(tcp_reass_zone, q);
909 tp->t_reassqlen--;
910 q = LIST_FIRST(&tp->t_segq);
911 } while (q && q->tqe_th->th_seq == tp->rcv_nxt);
912 tp->t_flagsext &= ~TF_REASS_INPROG;
913
914#if INET6
915 if ((inp->inp_vflag & INP_IPV6) != 0) {
916
917 KERNEL_DEBUG(DBG_LAYER_BEG,
918 ((inp->inp_fport << 16) | inp->inp_lport),
919 (((inp->in6p_laddr.s6_addr16[0] & 0xffff) << 16) |
920 (inp->in6p_faddr.s6_addr16[0] & 0xffff)),
921 0,0,0);
922 }
923 else
924#endif
925 {
926 KERNEL_DEBUG(DBG_LAYER_BEG,
927 ((inp->inp_fport << 16) | inp->inp_lport),
928 (((inp->inp_laddr.s_addr & 0xffff) << 16) |
929 (inp->inp_faddr.s_addr & 0xffff)),
930 0,0,0);
931 }
932
933msg_unordered_delivery:
934 /* Deliver out-of-order data as a message */
935 if (te && (so->so_flags & SOF_ENABLE_MSGS) && copy_oodata && te->tqe_len) {
936 /*
937 * make a copy of the mbuf to be delivered up to
938 * the user, and add it to the sockbuf
939 */
940 oodata = m_copym(te->tqe_m, 0, M_COPYALL, M_DONTWAIT);
941 if (oodata != NULL) {
942 if (sbappendmsgstream_rcv(&so->so_rcv, oodata,
943 te->tqe_th->th_seq - (tp->irs + 1), 1)) {
944 dowakeup = 1;
945 tcpstat.tcps_msg_unopkts++;
946 } else {
947 tcpstat.tcps_msg_unoappendfail++;
948 }
949 }
950 }
951
952 if (dowakeup)
953 sorwakeup(so); /* done with socket lock held */
954 return (flags);
955}
956
957/*
958 * Reduce congestion window -- used when ECN is seen or when a tail loss
959 * probe recovers the last packet.
960 */
961static void
962tcp_reduce_congestion_window(
963 struct tcpcb *tp)
964{
965 /*
966 * If the current tcp cc module has
967 * defined a hook for tasks to run
968 * before entering FR, call it
969 */
970 if (CC_ALGO(tp)->pre_fr != NULL)
971 CC_ALGO(tp)->pre_fr(tp);
972 ENTER_FASTRECOVERY(tp);
973 if (tp->t_flags & TF_SENTFIN)
974 tp->snd_recover = tp->snd_max - 1;
975 else
976 tp->snd_recover = tp->snd_max;
977 tp->t_timer[TCPT_REXMT] = 0;
978 tp->t_timer[TCPT_PTO] = 0;
979 tp->t_rtttime = 0;
980 if (tp->t_flagsext & TF_CWND_NONVALIDATED) {
981 tcp_cc_adjust_nonvalidated_cwnd(tp);
982 } else {
983 tp->snd_cwnd = tp->snd_ssthresh +
984 tp->t_maxseg * tcprexmtthresh;
985 }
986}
987
988/*
989 * This function is called upon reception of data on a socket. It's purpose is
990 * to handle the adaptive keepalive timers that monitor whether the connection
991 * is making progress. First the adaptive read-timer, second the TFO probe-timer.
992 *
993 * The application wants to get an event if there is a stall during read.
994 * Set the initial keepalive timeout to be equal to twice RTO.
995 *
996 * If the outgoing interface is in marginal conditions, we need to
997 * enable read probes for that too.
998 */
999static inline void
1000tcp_adaptive_rwtimo_check(struct tcpcb *tp, int tlen)
1001{
1002 struct ifnet *outifp = tp->t_inpcb->inp_last_outifp;
1003
1004 if ((tp->t_adaptive_rtimo > 0 ||
1005 (outifp != NULL &&
1006 (outifp->if_eflags & IFEF_PROBE_CONNECTIVITY)))
1007 && tlen > 0 &&
1008 tp->t_state == TCPS_ESTABLISHED) {
1009 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp,
1010 (TCP_REXMTVAL(tp) << 1));
1011 tp->t_flagsext |= TF_DETECT_READSTALL;
1012 tp->t_rtimo_probes = 0;
1013 }
1014}
1015
1016inline void
1017tcp_keepalive_reset(struct tcpcb *tp)
1018{
1019 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp,
1020 TCP_CONN_KEEPIDLE(tp));
1021 tp->t_flagsext &= ~(TF_DETECT_READSTALL);
1022 tp->t_rtimo_probes = 0;
1023}
1024
1025/*
1026 * TCP input routine, follows pages 65-76 of the
1027 * protocol specification dated September, 1981 very closely.
1028 */
1029#if INET6
1030int
1031tcp6_input(struct mbuf **mp, int *offp, int proto)
1032{
1033#pragma unused(proto)
1034 struct mbuf *m = *mp;
1035 uint32_t ia6_flags;
1036 struct ifnet *ifp = m->m_pkthdr.rcvif;
1037
1038 IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), return IPPROTO_DONE);
1039
1040 /* Expect 32-bit aligned data pointer on strict-align platforms */
1041 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1042
1043 /*
1044 * draft-itojun-ipv6-tcp-to-anycast
1045 * better place to put this in?
1046 */
1047 if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) == 0) {
1048 if (ia6_flags & IN6_IFF_ANYCAST) {
1049 struct ip6_hdr *ip6;
1050
1051 ip6 = mtod(m, struct ip6_hdr *);
1052 icmp6_error(m, ICMP6_DST_UNREACH,
1053 ICMP6_DST_UNREACH_ADDR,
1054 (caddr_t)&ip6->ip6_dst - (caddr_t)ip6);
1055
1056 IF_TCP_STATINC(ifp, icmp6unreach);
1057
1058 return (IPPROTO_DONE);
1059 }
1060 }
1061
1062 tcp_input(m, *offp);
1063 return (IPPROTO_DONE);
1064}
1065#endif
1066
1067/* Depending on the usage of mbuf space in the system, this function
1068 * will return true or false. This is used to determine if a socket
1069 * buffer can take more memory from the system for auto-tuning or not.
1070 */
1071u_int8_t
1072tcp_cansbgrow(struct sockbuf *sb)
1073{
1074 /* Calculate the host level space limit in terms of MSIZE buffers.
1075 * We can use a maximum of half of the available mbuf space for
1076 * socket buffers.
1077 */
1078 u_int32_t mblim = ((nmbclusters >> 1) << (MCLSHIFT - MSIZESHIFT));
1079
1080 /* Calculate per sb limit in terms of bytes. We optimize this limit
1081 * for upto 16 socket buffers.
1082 */
1083
1084 u_int32_t sbspacelim = ((nmbclusters >> 4) << MCLSHIFT);
1085
1086 if ((total_sbmb_cnt < mblim) &&
1087 (sb->sb_hiwat < sbspacelim)) {
1088 return(1);
1089 } else {
1090 OSIncrementAtomic64(&sbmb_limreached);
1091 }
1092 return(0);
1093}
1094
1095static void
1096tcp_sbrcv_reserve(struct tcpcb *tp, struct sockbuf *sbrcv,
1097 u_int32_t newsize, u_int32_t idealsize, u_int32_t rcvbuf_max)
1098{
1099 /* newsize should not exceed max */
1100 newsize = min(newsize, rcvbuf_max);
1101
1102 /* The receive window scale negotiated at the
1103 * beginning of the connection will also set a
1104 * limit on the socket buffer size
1105 */
1106 newsize = min(newsize, TCP_MAXWIN << tp->rcv_scale);
1107
1108 /* Set new socket buffer size */
1109 if (newsize > sbrcv->sb_hiwat &&
1110 (sbreserve(sbrcv, newsize) == 1)) {
1111 sbrcv->sb_idealsize = min(max(sbrcv->sb_idealsize,
1112 (idealsize != 0) ? idealsize : newsize), rcvbuf_max);
1113
1114 /* Again check the limit set by the advertised
1115 * window scale
1116 */
1117 sbrcv->sb_idealsize = min(sbrcv->sb_idealsize,
1118 TCP_MAXWIN << tp->rcv_scale);
1119 }
1120}
1121
1122/*
1123 * This function is used to grow a receive socket buffer. It
1124 * will take into account system-level memory usage and the
1125 * bandwidth available on the link to make a decision.
1126 */
1127static void
1128tcp_sbrcv_grow(struct tcpcb *tp, struct sockbuf *sbrcv,
1129 struct tcpopt *to, u_int32_t pktlen, u_int32_t rcvbuf_max)
1130{
1131 struct socket *so = sbrcv->sb_so;
1132
1133 /*
1134 * Do not grow the receive socket buffer if
1135 * - auto resizing is disabled, globally or on this socket
1136 * - the high water mark already reached the maximum
1137 * - the stream is in background and receive side is being
1138 * throttled
1139 * - if there are segments in reassembly queue indicating loss,
1140 * do not need to increase recv window during recovery as more
1141 * data is not going to be sent. A duplicate ack sent during
1142 * recovery should not change the receive window
1143 */
1144 if (tcp_do_autorcvbuf == 0 ||
1145 (sbrcv->sb_flags & SB_AUTOSIZE) == 0 ||
1146 tcp_cansbgrow(sbrcv) == 0 ||
1147 sbrcv->sb_hiwat >= rcvbuf_max ||
1148 (tp->t_flagsext & TF_RECV_THROTTLE) ||
1149 (so->so_flags1 & SOF1_EXTEND_BK_IDLE_WANTED) ||
1150 !LIST_EMPTY(&tp->t_segq)) {
1151 /* Can not resize the socket buffer, just return */
1152 goto out;
1153 }
1154
1155 if (TSTMP_GT(tcp_now,
1156 tp->rfbuf_ts + TCPTV_RCVBUFIDLE)) {
1157 /* If there has been an idle period in the
1158 * connection, just restart the measurement
1159 */
1160 goto out;
1161 }
1162
1163 if (!TSTMP_SUPPORTED(tp)) {
1164 /*
1165 * Timestamp option is not supported on this connection.
1166 * If the connection reached a state to indicate that
1167 * the receive socket buffer needs to grow, increase
1168 * the high water mark.
1169 */
1170 if (TSTMP_GEQ(tcp_now,
1171 tp->rfbuf_ts + TCPTV_RCVNOTS_QUANTUM)) {
1172 if (tp->rfbuf_cnt >= TCP_RCVNOTS_BYTELEVEL) {
1173 tcp_sbrcv_reserve(tp, sbrcv,
1174 tcp_autorcvbuf_max, 0,
1175 tcp_autorcvbuf_max);
1176 }
1177 goto out;
1178 } else {
1179 tp->rfbuf_cnt += pktlen;
1180 return;
1181 }
1182 } else if (to->to_tsecr != 0) {
1183 /*
1184 * If the timestamp shows that one RTT has
1185 * completed, we can stop counting the
1186 * bytes. Here we consider increasing
1187 * the socket buffer if the bandwidth measured in
1188 * last rtt, is more than half of sb_hiwat, this will
1189 * help to scale the buffer according to the bandwidth
1190 * on the link.
1191 */
1192 if (TSTMP_GEQ(to->to_tsecr, tp->rfbuf_ts)) {
1193 if (tp->rfbuf_cnt > (sbrcv->sb_hiwat -
1194 (sbrcv->sb_hiwat >> 1))) {
1195 int32_t rcvbuf_inc, min_incr;
1196 /*
1197 * Increment the receive window by a
1198 * multiple of maximum sized segments.
1199 * This will prevent a connection from
1200 * sending smaller segments on wire if it
1201 * is limited by the receive window.
1202 *
1203 * Set the ideal size based on current
1204 * bandwidth measurements. We set the
1205 * ideal size on receive socket buffer to
1206 * be twice the bandwidth delay product.
1207 */
1208 rcvbuf_inc = (tp->rfbuf_cnt << 1)
1209 - sbrcv->sb_hiwat;
1210
1211 /*
1212 * Make the increment equal to 8 segments
1213 * at least
1214 */
1215 min_incr = tp->t_maxseg << tcp_autorcvbuf_inc_shift;
1216 if (rcvbuf_inc < min_incr)
1217 rcvbuf_inc = min_incr;
1218
1219 rcvbuf_inc =
1220 (rcvbuf_inc / tp->t_maxseg) * tp->t_maxseg;
1221 tcp_sbrcv_reserve(tp, sbrcv,
1222 sbrcv->sb_hiwat + rcvbuf_inc,
1223 (tp->rfbuf_cnt * 2), rcvbuf_max);
1224 }
1225 /* Measure instantaneous receive bandwidth */
1226 if (tp->t_bwmeas != NULL && tp->rfbuf_cnt > 0 &&
1227 TSTMP_GT(tcp_now, tp->rfbuf_ts)) {
1228 u_int32_t rcv_bw;
1229 rcv_bw = tp->rfbuf_cnt /
1230 (int)(tcp_now - tp->rfbuf_ts);
1231 if (tp->t_bwmeas->bw_rcvbw_max == 0) {
1232 tp->t_bwmeas->bw_rcvbw_max = rcv_bw;
1233 } else {
1234 tp->t_bwmeas->bw_rcvbw_max = max(
1235 tp->t_bwmeas->bw_rcvbw_max, rcv_bw);
1236 }
1237 }
1238 goto out;
1239 } else {
1240 tp->rfbuf_cnt += pktlen;
1241 return;
1242 }
1243 }
1244out:
1245 /* Restart the measurement */
1246 tp->rfbuf_ts = 0;
1247 tp->rfbuf_cnt = 0;
1248 return;
1249}
1250
1251/* This function will trim the excess space added to the socket buffer
1252 * to help a slow-reading app. The ideal-size of a socket buffer depends
1253 * on the link bandwidth or it is set by an application and we aim to
1254 * reach that size.
1255 */
1256void
1257tcp_sbrcv_trim(struct tcpcb *tp, struct sockbuf *sbrcv)
1258{
1259 if (tcp_do_autorcvbuf == 1 && sbrcv->sb_idealsize > 0 &&
1260 sbrcv->sb_hiwat > sbrcv->sb_idealsize) {
1261 int32_t trim;
1262 /* compute the difference between ideal and current sizes */
1263 u_int32_t diff = sbrcv->sb_hiwat - sbrcv->sb_idealsize;
1264
1265 /* Compute the maximum advertised window for
1266 * this connection.
1267 */
1268 u_int32_t advwin = tp->rcv_adv - tp->rcv_nxt;
1269
1270 /* How much can we trim the receive socket buffer?
1271 * 1. it can not be trimmed beyond the max rcv win advertised
1272 * 2. if possible, leave 1/16 of bandwidth*delay to
1273 * avoid closing the win completely
1274 */
1275 u_int32_t leave = max(advwin, (sbrcv->sb_idealsize >> 4));
1276
1277 /* Sometimes leave can be zero, in that case leave at least
1278 * a few segments worth of space.
1279 */
1280 if (leave == 0)
1281 leave = tp->t_maxseg << tcp_autorcvbuf_inc_shift;
1282
1283 trim = sbrcv->sb_hiwat - (sbrcv->sb_cc + leave);
1284 trim = imin(trim, (int32_t)diff);
1285
1286 if (trim > 0)
1287 sbreserve(sbrcv, (sbrcv->sb_hiwat - trim));
1288 }
1289}
1290
1291/* We may need to trim the send socket buffer size for two reasons:
1292 * 1. if the rtt seen on the connection is climbing up, we do not
1293 * want to fill the buffers any more.
1294 * 2. if the congestion win on the socket backed off, there is no need
1295 * to hold more mbufs for that connection than what the cwnd will allow.
1296 */
1297void
1298tcp_sbsnd_trim(struct sockbuf *sbsnd)
1299{
1300 if (tcp_do_autosendbuf == 1 &&
1301 ((sbsnd->sb_flags & (SB_AUTOSIZE | SB_TRIM)) ==
1302 (SB_AUTOSIZE | SB_TRIM)) &&
1303 (sbsnd->sb_idealsize > 0) &&
1304 (sbsnd->sb_hiwat > sbsnd->sb_idealsize)) {
1305 u_int32_t trim = 0;
1306 if (sbsnd->sb_cc <= sbsnd->sb_idealsize) {
1307 trim = sbsnd->sb_hiwat - sbsnd->sb_idealsize;
1308 } else {
1309 trim = sbsnd->sb_hiwat - sbsnd->sb_cc;
1310 }
1311 sbreserve(sbsnd, (sbsnd->sb_hiwat - trim));
1312 }
1313 if (sbsnd->sb_hiwat <= sbsnd->sb_idealsize)
1314 sbsnd->sb_flags &= ~(SB_TRIM);
1315}
1316
1317/*
1318 * If timestamp option was not negotiated on this connection
1319 * and this connection is on the receiving side of a stream
1320 * then we can not measure the delay on the link accurately.
1321 * Instead of enabling automatic receive socket buffer
1322 * resizing, just give more space to the receive socket buffer.
1323 */
1324static inline void
1325tcp_sbrcv_tstmp_check(struct tcpcb *tp)
1326{
1327 struct socket *so = tp->t_inpcb->inp_socket;
1328 u_int32_t newsize = 2 * tcp_recvspace;
1329 struct sockbuf *sbrcv = &so->so_rcv;
1330
1331 if ((tp->t_flags & (TF_REQ_TSTMP | TF_RCVD_TSTMP)) !=
1332 (TF_REQ_TSTMP | TF_RCVD_TSTMP) &&
1333 (sbrcv->sb_flags & SB_AUTOSIZE) != 0) {
1334 tcp_sbrcv_reserve(tp, sbrcv, newsize, 0, newsize);
1335 }
1336}
1337
1338/* A receiver will evaluate the flow of packets on a connection
1339 * to see if it can reduce ack traffic. The receiver will start
1340 * stretching acks if all of the following conditions are met:
1341 * 1. tcp_delack_enabled is set to 3
1342 * 2. If the bytes received in the last 100ms is greater than a threshold
1343 * defined by maxseg_unacked
1344 * 3. If the connection has not been idle for tcp_maxrcvidle period.
1345 * 4. If the connection has seen enough packets to let the slow-start
1346 * finish after connection establishment or after some packet loss.
1347 *
1348 * The receiver will stop stretching acks if there is congestion/reordering
1349 * as indicated by packets on reassembly queue or an ECN. If the delayed-ack
1350 * timer fires while stretching acks, it means that the packet flow has gone
1351 * below the threshold defined by maxseg_unacked and the receiver will stop
1352 * stretching acks. The receiver gets no indication when slow-start is completed
1353 * or when the connection reaches an idle state. That is why we use
1354 * tcp_rcvsspktcnt to cover slow-start and tcp_maxrcvidle to identify idle
1355 * state.
1356 */
1357static inline int
1358tcp_stretch_ack_enable(struct tcpcb *tp, int thflags)
1359{
1360 if (tp->rcv_by_unackwin >= (maxseg_unacked * tp->t_maxseg) &&
1361 TSTMP_GEQ(tp->rcv_unackwin, tcp_now))
1362 tp->t_flags |= TF_STREAMING_ON;
1363 else
1364 tp->t_flags &= ~TF_STREAMING_ON;
1365
1366 /* If there has been an idle time, reset streaming detection */
1367 if (TSTMP_GT(tcp_now, tp->rcv_unackwin + tcp_maxrcvidle))
1368 tp->t_flags &= ~TF_STREAMING_ON;
1369
1370 /*
1371 * If there are flags other than TH_ACK set, reset streaming
1372 * detection
1373 */
1374 if (thflags & ~TH_ACK)
1375 tp->t_flags &= ~TF_STREAMING_ON;
1376
1377 if (tp->t_flagsext & TF_DISABLE_STRETCHACK) {
1378 if (tp->rcv_nostrack_pkts >= TCP_STRETCHACK_ENABLE_PKTCNT) {
1379 tp->t_flagsext &= ~TF_DISABLE_STRETCHACK;
1380 tp->rcv_nostrack_pkts = 0;
1381 tp->rcv_nostrack_ts = 0;
1382 } else {
1383 tp->rcv_nostrack_pkts++;
1384 }
1385 }
1386
1387 if (!(tp->t_flagsext & (TF_NOSTRETCHACK|TF_DISABLE_STRETCHACK)) &&
1388 (tp->t_flags & TF_STREAMING_ON) &&
1389 (!(tp->t_flagsext & TF_RCVUNACK_WAITSS) ||
1390 (tp->rcv_waitforss >= tcp_rcvsspktcnt))) {
1391 return(1);
1392 }
1393
1394 return(0);
1395}
1396
1397/*
1398 * Reset the state related to stretch-ack algorithm. This will make
1399 * the receiver generate an ack every other packet. The receiver
1400 * will start re-evaluating the rate at which packets come to decide
1401 * if it can benefit by lowering the ack traffic.
1402 */
1403void
1404tcp_reset_stretch_ack(struct tcpcb *tp)
1405{
1406 tp->t_flags &= ~(TF_STRETCHACK|TF_STREAMING_ON);
1407 tp->rcv_by_unackwin = 0;
1408 tp->rcv_unackwin = tcp_now + tcp_rcvunackwin;
1409
1410 /*
1411 * When there is packet loss or packet re-ordering or CWR due to
1412 * ECN, the sender's congestion window is reduced. In these states,
1413 * generate an ack for every other packet for some time to allow
1414 * the sender's congestion window to grow.
1415 */
1416 tp->t_flagsext |= TF_RCVUNACK_WAITSS;
1417 tp->rcv_waitforss = 0;
1418}
1419
1420/*
1421 * The last packet was a retransmission, check if this ack
1422 * indicates that the retransmission was spurious.
1423 *
1424 * If the connection supports timestamps, we could use it to
1425 * detect if the last retransmit was not needed. Otherwise,
1426 * we check if the ACK arrived within RTT/2 window, then it
1427 * was a mistake to do the retransmit in the first place.
1428 *
1429 * This function will return 1 if it is a spurious retransmit,
1430 * 0 otherwise.
1431 */
1432int
1433tcp_detect_bad_rexmt(struct tcpcb *tp, struct tcphdr *th,
1434 struct tcpopt *to, u_int32_t rxtime)
1435{
1436 int32_t tdiff, bad_rexmt_win;
1437 bad_rexmt_win = (tp->t_srtt >> (TCP_RTT_SHIFT + 1));
1438
1439 /* If the ack has ECN CE bit, then cwnd has to be adjusted */
1440 if (TCP_ECN_ENABLED(tp) && (th->th_flags & TH_ECE))
1441 return (0);
1442 if (TSTMP_SUPPORTED(tp)) {
1443 if (rxtime > 0 && (to->to_flags & TOF_TS)
1444 && to->to_tsecr != 0
1445 && TSTMP_LT(to->to_tsecr, rxtime))
1446 return (1);
1447 } else {
1448 if ((tp->t_rxtshift == 1
1449 || (tp->t_flagsext & TF_SENT_TLPROBE))
1450 && rxtime > 0) {
1451 tdiff = (int32_t)(tcp_now - rxtime);
1452 if (tdiff < bad_rexmt_win)
1453 return(1);
1454 }
1455 }
1456 return(0);
1457}
1458
1459
1460/*
1461 * Restore congestion window state if a spurious timeout
1462 * was detected.
1463 */
1464static void
1465tcp_bad_rexmt_restore_state(struct tcpcb *tp, struct tcphdr *th)
1466{
1467 if (TSTMP_SUPPORTED(tp)) {
1468 u_int32_t fsize, acked;
1469 fsize = tp->snd_max - th->th_ack;
1470 acked = BYTES_ACKED(th, tp);
1471
1472 /*
1473 * Implement bad retransmit recovery as
1474 * described in RFC 4015.
1475 */
1476 tp->snd_ssthresh = tp->snd_ssthresh_prev;
1477
1478 /* Initialize cwnd to the initial window */
1479 if (CC_ALGO(tp)->cwnd_init != NULL)
1480 CC_ALGO(tp)->cwnd_init(tp);
1481
1482 tp->snd_cwnd = fsize + min(acked, tp->snd_cwnd);
1483
1484 } else {
1485 tp->snd_cwnd = tp->snd_cwnd_prev;
1486 tp->snd_ssthresh = tp->snd_ssthresh_prev;
1487 if (tp->t_flags & TF_WASFRECOVERY)
1488 ENTER_FASTRECOVERY(tp);
1489
1490 /* Do not use the loss flight size in this case */
1491 tp->t_lossflightsize = 0;
1492 }
1493 tp->snd_cwnd = max(tp->snd_cwnd, TCP_CC_CWND_INIT_BYTES);
1494 tp->snd_recover = tp->snd_recover_prev;
1495 tp->snd_nxt = tp->snd_max;
1496
1497 /* Fix send socket buffer to reflect the change in cwnd */
1498 tcp_bad_rexmt_fix_sndbuf(tp);
1499
1500 /*
1501 * This RTT might reflect the extra delay induced
1502 * by the network. Skip using this sample for RTO
1503 * calculation and mark the connection so we can
1504 * recompute RTT when the next eligible sample is
1505 * found.
1506 */
1507 tp->t_flagsext |= TF_RECOMPUTE_RTT;
1508 tp->t_badrexmt_time = tcp_now;
1509 tp->t_rtttime = 0;
1510}
1511
1512/*
1513 * If the previous packet was sent in retransmission timer, and it was
1514 * not needed, then restore the congestion window to the state before that
1515 * transmission.
1516 *
1517 * If the last packet was sent in tail loss probe timeout, check if that
1518 * recovered the last packet. If so, that will indicate a real loss and
1519 * the congestion window needs to be lowered.
1520 */
1521static void
1522tcp_bad_rexmt_check(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to)
1523{
1524 if (tp->t_rxtshift > 0 &&
1525 tcp_detect_bad_rexmt(tp, th, to, tp->t_rxtstart)) {
1526 ++tcpstat.tcps_sndrexmitbad;
1527 tcp_bad_rexmt_restore_state(tp, th);
1528 tcp_ccdbg_trace(tp, th, TCP_CC_BAD_REXMT_RECOVERY);
1529 } else if ((tp->t_flagsext & TF_SENT_TLPROBE)
1530 && tp->t_tlphighrxt > 0
1531 && SEQ_GEQ(th->th_ack, tp->t_tlphighrxt)
1532 && !tcp_detect_bad_rexmt(tp, th, to, tp->t_tlpstart)) {
1533 /*
1534 * check DSACK information also to make sure that
1535 * the TLP was indeed needed
1536 */
1537 if (tcp_rxtseg_dsack_for_tlp(tp)) {
1538 /*
1539 * received a DSACK to indicate that TLP was
1540 * not needed
1541 */
1542 tcp_rxtseg_clean(tp);
1543 goto out;
1544 }
1545
1546 /*
1547 * The tail loss probe recovered the last packet and
1548 * we need to adjust the congestion window to take
1549 * this loss into account.
1550 */
1551 ++tcpstat.tcps_tlp_recoverlastpkt;
1552 if (!IN_FASTRECOVERY(tp)) {
1553 tcp_reduce_congestion_window(tp);
1554 EXIT_FASTRECOVERY(tp);
1555 }
1556 tcp_ccdbg_trace(tp, th, TCP_CC_TLP_RECOVER_LASTPACKET);
1557 } else if (tcp_rxtseg_detect_bad_rexmt(tp, th->th_ack)) {
1558 /*
1559 * All of the retransmitted segments were duplicated, this
1560 * can be an indication of bad fast retransmit.
1561 */
1562 tcpstat.tcps_dsack_badrexmt++;
1563 tcp_bad_rexmt_restore_state(tp, th);
1564 tcp_ccdbg_trace(tp, th, TCP_CC_DSACK_BAD_REXMT);
1565 tcp_rxtseg_clean(tp);
1566 }
1567out:
1568 tp->t_flagsext &= ~(TF_SENT_TLPROBE);
1569 tp->t_tlphighrxt = 0;
1570 tp->t_tlpstart = 0;
1571
1572 /*
1573 * check if the latest ack was for a segment sent during PMTU
1574 * blackhole detection. If the timestamp on the ack is before
1575 * PMTU blackhole detection, then revert the size of the max
1576 * segment to previous size.
1577 */
1578 if (tp->t_rxtshift > 0 && (tp->t_flags & TF_BLACKHOLE) &&
1579 tp->t_pmtud_start_ts > 0 && TSTMP_SUPPORTED(tp)) {
1580 if ((to->to_flags & TOF_TS) && to->to_tsecr != 0
1581 && TSTMP_LT(to->to_tsecr, tp->t_pmtud_start_ts)) {
1582 tcp_pmtud_revert_segment_size(tp);
1583 }
1584 }
1585 if (tp->t_pmtud_start_ts > 0)
1586 tp->t_pmtud_start_ts = 0;
1587}
1588
1589/*
1590 * Check if early retransmit can be attempted according to RFC 5827.
1591 *
1592 * If packet reordering is detected on a connection, fast recovery will
1593 * be delayed until it is clear that the packet was lost and not reordered.
1594 * But reordering detection is done only when SACK is enabled.
1595 *
1596 * On connections that do not support SACK, there is a limit on the number
1597 * of early retransmits that can be done per minute. This limit is needed
1598 * to make sure that too many packets are not retransmitted when there is
1599 * packet reordering.
1600 */
1601static void
1602tcp_early_rexmt_check (struct tcpcb *tp, struct tcphdr *th)
1603{
1604 u_int32_t obytes, snd_off;
1605 int32_t snd_len;
1606 struct socket *so = tp->t_inpcb->inp_socket;
1607
1608 if (early_rexmt && (SACK_ENABLED(tp) ||
1609 tp->t_early_rexmt_count < TCP_EARLY_REXMT_LIMIT) &&
1610 SEQ_GT(tp->snd_max, tp->snd_una) &&
1611 (tp->t_dupacks == 1 ||
1612 (SACK_ENABLED(tp) &&
1613 !TAILQ_EMPTY(&tp->snd_holes)))) {
1614 /*
1615 * If there are only a few outstanding
1616 * segments on the connection, we might need
1617 * to lower the retransmit threshold. This
1618 * will allow us to do Early Retransmit as
1619 * described in RFC 5827.
1620 */
1621 if (SACK_ENABLED(tp) &&
1622 !TAILQ_EMPTY(&tp->snd_holes)) {
1623 obytes = (tp->snd_max - tp->snd_fack) +
1624 tp->sackhint.sack_bytes_rexmit;
1625 } else {
1626 obytes = (tp->snd_max - tp->snd_una);
1627 }
1628
1629 /*
1630 * In order to lower retransmit threshold the
1631 * following two conditions must be met.
1632 * 1. the amount of outstanding data is less
1633 * than 4*SMSS bytes
1634 * 2. there is no unsent data ready for
1635 * transmission or the advertised window
1636 * will limit sending new segments.
1637 */
1638 snd_off = tp->snd_max - tp->snd_una;
1639 snd_len = min(so->so_snd.sb_cc, tp->snd_wnd) - snd_off;
1640 if (obytes < (tp->t_maxseg << 2) &&
1641 snd_len <= 0) {
1642 u_int32_t osegs;
1643
1644 osegs = obytes / tp->t_maxseg;
1645 if ((osegs * tp->t_maxseg) < obytes)
1646 osegs++;
1647
1648 /*
1649 * Since the connection might have already
1650 * received some dupacks, we add them to
1651 * to the outstanding segments count to get
1652 * the correct retransmit threshold.
1653 *
1654 * By checking for early retransmit after
1655 * receiving some duplicate acks when SACK
1656 * is supported, the connection will
1657 * enter fast recovery even if multiple
1658 * segments are lost in the same window.
1659 */
1660 osegs += tp->t_dupacks;
1661 if (osegs < 4) {
1662 tp->t_rexmtthresh =
1663 ((osegs - 1) > 1) ? (osegs - 1) : 1;
1664 tp->t_rexmtthresh =
1665 min(tp->t_rexmtthresh, tcprexmtthresh);
1666 tp->t_rexmtthresh =
1667 max(tp->t_rexmtthresh, tp->t_dupacks);
1668
1669 if (tp->t_early_rexmt_count == 0)
1670 tp->t_early_rexmt_win = tcp_now;
1671
1672 if (tp->t_flagsext & TF_SENT_TLPROBE) {
1673 tcpstat.tcps_tlp_recovery++;
1674 tcp_ccdbg_trace(tp, th,
1675 TCP_CC_TLP_RECOVERY);
1676 } else {
1677 tcpstat.tcps_early_rexmt++;
1678 tp->t_early_rexmt_count++;
1679 tcp_ccdbg_trace(tp, th,
1680 TCP_CC_EARLY_RETRANSMIT);
1681 }
1682 }
1683 }
1684 }
1685
1686 /*
1687 * If we ever sent a TLP probe, the acknowledgement will trigger
1688 * early retransmit because the value of snd_fack will be close
1689 * to snd_max. This will take care of adjustments to the
1690 * congestion window. So we can reset TF_SENT_PROBE flag.
1691 */
1692 tp->t_flagsext &= ~(TF_SENT_TLPROBE);
1693 tp->t_tlphighrxt = 0;
1694 tp->t_tlpstart = 0;
1695}
1696
1697static boolean_t
1698tcp_tfo_syn(struct tcpcb *tp, struct tcpopt *to)
1699{
1700 u_char out[CCAES_BLOCK_SIZE];
1701 unsigned char len;
1702
1703 if (!(to->to_flags & (TOF_TFO | TOF_TFOREQ)) ||
1704 !(tcp_fastopen & TCP_FASTOPEN_SERVER))
1705 return (FALSE);
1706
1707 if ((to->to_flags & TOF_TFOREQ)) {
1708 tp->t_tfo_flags |= TFO_F_OFFER_COOKIE;
1709
1710 tp->t_tfo_stats |= TFO_S_COOKIEREQ_RECV;
1711 tcpstat.tcps_tfo_cookie_req_rcv++;
1712 return (FALSE);
1713 }
1714
1715 /* Ok, then it must be an offered cookie. We need to check that ... */
1716 tcp_tfo_gen_cookie(tp->t_inpcb, out, sizeof(out));
1717
1718 len = *to->to_tfo - TCPOLEN_FASTOPEN_REQ;
1719 to->to_tfo++;
1720 if (memcmp(out, to->to_tfo, len)) {
1721 /* Cookies are different! Let's return and offer a new cookie */
1722 tp->t_tfo_flags |= TFO_F_OFFER_COOKIE;
1723
1724 tp->t_tfo_stats |= TFO_S_COOKIE_INVALID;
1725 tcpstat.tcps_tfo_cookie_invalid++;
1726 return (FALSE);
1727 }
1728
1729 if (OSIncrementAtomic(&tcp_tfo_halfcnt) >= tcp_tfo_backlog) {
1730 /* Need to decrement again as we just increased it... */
1731 OSDecrementAtomic(&tcp_tfo_halfcnt);
1732 return (FALSE);
1733 }
1734
1735 tp->t_tfo_flags |= TFO_F_COOKIE_VALID;
1736
1737 tp->t_tfo_stats |= TFO_S_SYNDATA_RCV;
1738 tcpstat.tcps_tfo_syn_data_rcv++;
1739
1740 return (TRUE);
1741}
1742
1743static void
1744tcp_tfo_synack(struct tcpcb *tp, struct tcpopt *to)
1745{
1746 if (to->to_flags & TOF_TFO) {
1747 unsigned char len = *to->to_tfo - TCPOLEN_FASTOPEN_REQ;
1748
1749 /*
1750 * If this happens, things have gone terribly wrong. len should
1751 * have been checked in tcp_dooptions.
1752 */
1753 VERIFY(len <= TFO_COOKIE_LEN_MAX);
1754
1755 to->to_tfo++;
1756
1757 tcp_cache_set_cookie(tp, to->to_tfo, len);
1758 tcp_heuristic_tfo_success(tp);
1759
1760 tp->t_tfo_stats |= TFO_S_COOKIE_RCV;
1761 tcpstat.tcps_tfo_cookie_rcv++;
1762 if (tp->t_tfo_flags & TFO_F_COOKIE_SENT) {
1763 tcpstat.tcps_tfo_cookie_wrong++;
1764 tp->t_tfo_stats |= TFO_S_COOKIE_WRONG;
1765 }
1766 } else {
1767 /*
1768 * Thus, no cookie in the response, but we either asked for one
1769 * or sent SYN+DATA. Now, we need to check whether we had to
1770 * rexmit the SYN. If that's the case, it's better to start
1771 * backing of TFO-cookie requests.
1772 */
1773 if (tp->t_tfo_flags & TFO_F_SYN_LOSS) {
1774 tp->t_tfo_stats |= TFO_S_SYN_LOSS;
1775 tcpstat.tcps_tfo_syn_loss++;
1776
1777 tcp_heuristic_tfo_loss(tp);
1778 } else {
1779 if (tp->t_tfo_flags & TFO_F_COOKIE_REQ) {
1780 tp->t_tfo_stats |= TFO_S_NO_COOKIE_RCV;
1781 tcpstat.tcps_tfo_no_cookie_rcv++;
1782 }
1783
1784 tcp_heuristic_tfo_success(tp);
1785 }
1786 }
1787}
1788
1789static void
1790tcp_tfo_rcv_probe(struct tcpcb *tp, int tlen)
1791{
1792 if (tlen != 0)
1793 return;
1794
1795 tp->t_tfo_probe_state = TFO_PROBE_PROBING;
1796
1797 /*
1798 * We send the probe out rather quickly (after one RTO). It does not
1799 * really hurt that much, it's only one additional segment on the wire.
1800 */
1801 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, (TCP_REXMTVAL(tp)));
1802}
1803
1804static void
1805tcp_tfo_rcv_data(struct tcpcb *tp)
1806{
1807 /* Transition from PROBING to NONE as data has been received */
1808 if (tp->t_tfo_probe_state >= TFO_PROBE_PROBING)
1809 tp->t_tfo_probe_state = TFO_PROBE_NONE;
1810}
1811
1812static void
1813tcp_tfo_rcv_ack(struct tcpcb *tp, struct tcphdr *th)
1814{
1815 if (tp->t_tfo_probe_state == TFO_PROBE_PROBING &&
1816 tp->t_tfo_probes > 0) {
1817 if (th->th_seq == tp->rcv_nxt) {
1818 /* No hole, so stop probing */
1819 tp->t_tfo_probe_state = TFO_PROBE_NONE;
1820 } else if (SEQ_GT(th->th_seq, tp->rcv_nxt)) {
1821 /* There is a hole! Wait a bit for data... */
1822 tp->t_tfo_probe_state = TFO_PROBE_WAIT_DATA;
1823 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp,
1824 TCP_REXMTVAL(tp));
1825 }
1826 }
1827}
1828
1829/*
1830 * Update snd_wnd information.
1831 */
1832static inline bool
1833tcp_update_window(struct tcpcb *tp, int thflags, struct tcphdr * th,
1834 u_int32_t tiwin, int tlen)
1835{
1836 /* Don't look at the window if there is no ACK flag */
1837 if ((thflags & TH_ACK) &&
1838 (SEQ_LT(tp->snd_wl1, th->th_seq) ||
1839 (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) ||
1840 (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) {
1841 /* keep track of pure window updates */
1842 if (tlen == 0 &&
1843 tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd)
1844 tcpstat.tcps_rcvwinupd++;
1845 tp->snd_wnd = tiwin;
1846 tp->snd_wl1 = th->th_seq;
1847 tp->snd_wl2 = th->th_ack;
1848 if (tp->snd_wnd > tp->max_sndwnd)
1849 tp->max_sndwnd = tp->snd_wnd;
1850
1851 if (tp->t_inpcb->inp_socket->so_flags & SOF_MP_SUBFLOW)
1852 mptcp_update_window_wakeup(tp);
1853 return (true);
1854 }
1855 return (false);
1856}
1857
1858void
1859tcp_input(struct mbuf *m, int off0)
1860{
1861 struct tcphdr *th;
1862 struct ip *ip = NULL;
1863 struct inpcb *inp;
1864 u_char *optp = NULL;
1865 int optlen = 0;
1866 int tlen, off;
1867 int drop_hdrlen;
1868 struct tcpcb *tp = 0;
1869 int thflags;
1870 struct socket *so = 0;
1871 int todrop, acked, ourfinisacked, needoutput = 0;
1872 struct in_addr laddr;
1873#if INET6
1874 struct in6_addr laddr6;
1875#endif
1876 int dropsocket = 0;
1877 int iss = 0, nosock = 0;
1878 u_int32_t tiwin, sack_bytes_acked = 0;
1879 struct tcpopt to; /* options in this segment */
1880#if TCPDEBUG
1881 short ostate = 0;
1882#endif
1883#if IPFIREWALL
1884 struct sockaddr_in *next_hop = NULL;
1885 struct m_tag *fwd_tag;
1886#endif /* IPFIREWALL */
1887 u_char ip_ecn = IPTOS_ECN_NOTECT;
1888 unsigned int ifscope;
1889 uint8_t isconnected, isdisconnected;
1890 struct ifnet *ifp = m->m_pkthdr.rcvif;
1891 int pktf_sw_lro_pkt = (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) ? 1 : 0;
1892 int nlropkts = (pktf_sw_lro_pkt == 1) ? m->m_pkthdr.lro_npkts : 1;
1893 int turnoff_lro = 0, win;
1894#if MPTCP
1895 struct mptcb *mp_tp = NULL;
1896#endif /* MPTCP */
1897 boolean_t cell = IFNET_IS_CELLULAR(ifp);
1898 boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp));
1899 boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp));
1900 boolean_t recvd_dsack = FALSE;
1901 struct tcp_respond_args tra;
1902
1903#define TCP_INC_VAR(stat, npkts) do { \
1904 stat += npkts; \
1905} while (0)
1906
1907 TCP_INC_VAR(tcpstat.tcps_rcvtotal, nlropkts);
1908#if IPFIREWALL
1909 /* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */
1910 if (!SLIST_EMPTY(&m->m_pkthdr.tags)) {
1911 fwd_tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID,
1912 KERNEL_TAG_TYPE_IPFORWARD, NULL);
1913 } else {
1914 fwd_tag = NULL;
1915 }
1916 if (fwd_tag != NULL) {
1917 struct ip_fwd_tag *ipfwd_tag =
1918 (struct ip_fwd_tag *)(fwd_tag+1);
1919
1920 next_hop = ipfwd_tag->next_hop;
1921 m_tag_delete(m, fwd_tag);
1922 }
1923#endif /* IPFIREWALL */
1924
1925#if INET6
1926 struct ip6_hdr *ip6 = NULL;
1927 int isipv6;
1928#endif /* INET6 */
1929 int rstreason; /* For badport_bandlim accounting purposes */
1930 struct proc *proc0=current_proc();
1931
1932 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_START,0,0,0,0,0);
1933
1934#if INET6
1935 isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
1936#endif
1937 bzero((char *)&to, sizeof(to));
1938
1939#if INET6
1940 if (isipv6) {
1941 /*
1942 * Expect 32-bit aligned data pointer on
1943 * strict-align platforms
1944 */
1945 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1946
1947 /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */
1948 ip6 = mtod(m, struct ip6_hdr *);
1949 tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0;
1950 th = (struct tcphdr *)(void *)((caddr_t)ip6 + off0);
1951
1952 if (tcp_input_checksum(AF_INET6, m, th, off0, tlen))
1953 goto dropnosock;
1954
1955 KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport),
1956 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
1957 th->th_seq, th->th_ack, th->th_win);
1958 /*
1959 * Be proactive about unspecified IPv6 address in source.
1960 * As we use all-zero to indicate unbounded/unconnected pcb,
1961 * unspecified IPv6 address can be used to confuse us.
1962 *
1963 * Note that packets with unspecified IPv6 destination is
1964 * already dropped in ip6_input.
1965 */
1966 if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) {
1967 /* XXX stat */
1968 IF_TCP_STATINC(ifp, unspecv6);
1969 goto dropnosock;
1970 }
1971 DTRACE_TCP5(receive, struct mbuf *, m, struct inpcb *, NULL,
1972 struct ip6_hdr *, ip6, struct tcpcb *, NULL,
1973 struct tcphdr *, th);
1974
1975 ip_ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK;
1976 } else
1977#endif /* INET6 */
1978 {
1979 /*
1980 * Get IP and TCP header together in first mbuf.
1981 * Note: IP leaves IP header in first mbuf.
1982 */
1983 if (off0 > sizeof (struct ip)) {
1984 ip_stripoptions(m);
1985 off0 = sizeof(struct ip);
1986 }
1987 if (m->m_len < sizeof (struct tcpiphdr)) {
1988 if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
1989 tcpstat.tcps_rcvshort++;
1990 return;
1991 }
1992 }
1993
1994 /* Expect 32-bit aligned data pointer on strict-align platforms */
1995 MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m);
1996
1997 ip = mtod(m, struct ip *);
1998 th = (struct tcphdr *)(void *)((caddr_t)ip + off0);
1999 tlen = ip->ip_len;
2000
2001 if (tcp_input_checksum(AF_INET, m, th, off0, tlen))
2002 goto dropnosock;
2003
2004#if INET6
2005 /* Re-initialization for later version check */
2006 ip->ip_v = IPVERSION;
2007#endif
2008 ip_ecn = (ip->ip_tos & IPTOS_ECN_MASK);
2009
2010 DTRACE_TCP5(receive, struct mbuf *, m, struct inpcb *, NULL,
2011 struct ip *, ip, struct tcpcb *, NULL, struct tcphdr *, th);
2012
2013 KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport),
2014 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
2015 th->th_seq, th->th_ack, th->th_win);
2016
2017 }
2018
2019 /*
2020 * Check that TCP offset makes sense,
2021 * pull out TCP options and adjust length.
2022 */
2023 off = th->th_off << 2;
2024 if (off < sizeof (struct tcphdr) || off > tlen) {
2025 tcpstat.tcps_rcvbadoff++;
2026 IF_TCP_STATINC(ifp, badformat);
2027 goto dropnosock;
2028 }
2029 tlen -= off; /* tlen is used instead of ti->ti_len */
2030 if (off > sizeof (struct tcphdr)) {
2031#if INET6
2032 if (isipv6) {
2033 IP6_EXTHDR_CHECK(m, off0, off, return);
2034 ip6 = mtod(m, struct ip6_hdr *);
2035 th = (struct tcphdr *)(void *)((caddr_t)ip6 + off0);
2036 } else
2037#endif /* INET6 */
2038 {
2039 if (m->m_len < sizeof(struct ip) + off) {
2040 if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
2041 tcpstat.tcps_rcvshort++;
2042 return;
2043 }
2044 ip = mtod(m, struct ip *);
2045 th = (struct tcphdr *)(void *)((caddr_t)ip + off0);
2046 }
2047 }
2048 optlen = off - sizeof (struct tcphdr);
2049 optp = (u_char *)(th + 1);
2050 /*
2051 * Do quick retrieval of timestamp options ("options
2052 * prediction?"). If timestamp is the only option and it's
2053 * formatted as recommended in RFC 1323 appendix A, we
2054 * quickly get the values now and not bother calling
2055 * tcp_dooptions(), etc.
2056 */
2057 if ((optlen == TCPOLEN_TSTAMP_APPA ||
2058 (optlen > TCPOLEN_TSTAMP_APPA &&
2059 optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&
2060 *(u_int32_t *)(void *)optp == htonl(TCPOPT_TSTAMP_HDR) &&
2061 (th->th_flags & TH_SYN) == 0) {
2062 to.to_flags |= TOF_TS;
2063 to.to_tsval = ntohl(*(u_int32_t *)(void *)(optp + 4));
2064 to.to_tsecr = ntohl(*(u_int32_t *)(void *)(optp + 8));
2065 optp = NULL; /* we've parsed the options */
2066 }
2067 }
2068 thflags = th->th_flags;
2069
2070#if TCP_DROP_SYNFIN
2071 /*
2072 * If the drop_synfin option is enabled, drop all packets with
2073 * both the SYN and FIN bits set. This prevents e.g. nmap from
2074 * identifying the TCP/IP stack.
2075 *
2076 * This is a violation of the TCP specification.
2077 */
2078 if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN)) {
2079 IF_TCP_STATINC(ifp, synfin);
2080 goto dropnosock;
2081 }
2082#endif
2083
2084 /*
2085 * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options,
2086 * until after ip6_savecontrol() is called and before other functions
2087 * which don't want those proto headers.
2088 * Because ip6_savecontrol() is going to parse the mbuf to
2089 * search for data to be passed up to user-land, it wants mbuf
2090 * parameters to be unchanged.
2091 */
2092 drop_hdrlen = off0 + off;
2093
2094 /* Since this is an entry point for input processing of tcp packets, we
2095 * can update the tcp clock here.
2096 */
2097 calculate_tcp_clock();
2098
2099 /*
2100 * Record the interface where this segment arrived on; this does not
2101 * affect normal data output (for non-detached TCP) as it provides a
2102 * hint about which route and interface to use for sending in the
2103 * absence of a PCB, when scoped routing (and thus source interface
2104 * selection) are enabled.
2105 */
2106 if ((m->m_pkthdr.pkt_flags & PKTF_LOOP) || m->m_pkthdr.rcvif == NULL)
2107 ifscope = IFSCOPE_NONE;
2108 else
2109 ifscope = m->m_pkthdr.rcvif->if_index;
2110
2111 /*
2112 * Convert TCP protocol specific fields to host format.
2113 */
2114
2115#if BYTE_ORDER != BIG_ENDIAN
2116 NTOHL(th->th_seq);
2117 NTOHL(th->th_ack);
2118 NTOHS(th->th_win);
2119 NTOHS(th->th_urp);
2120#endif
2121
2122 /*
2123 * Locate pcb for segment.
2124 */
2125findpcb:
2126
2127 isconnected = FALSE;
2128 isdisconnected = FALSE;
2129
2130#if IPFIREWALL_FORWARD
2131 if (next_hop != NULL
2132#if INET6
2133 && isipv6 == 0 /* IPv6 support is not yet */
2134#endif /* INET6 */
2135 ) {
2136 /*
2137 * Diverted. Pretend to be the destination.
2138 * already got one like this?
2139 */
2140 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
2141 ip->ip_dst, th->th_dport, 0, m->m_pkthdr.rcvif);
2142 if (!inp) {
2143 /*
2144 * No, then it's new. Try find the ambushing socket
2145 */
2146 if (!next_hop->sin_port) {
2147 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src,
2148 th->th_sport, next_hop->sin_addr,
2149 th->th_dport, 1, m->m_pkthdr.rcvif);
2150 } else {
2151 inp = in_pcblookup_hash(&tcbinfo,
2152 ip->ip_src, th->th_sport,
2153 next_hop->sin_addr,
2154 ntohs(next_hop->sin_port), 1,
2155 m->m_pkthdr.rcvif);
2156 }
2157 }
2158 } else
2159#endif /* IPFIREWALL_FORWARD */
2160 {
2161#if INET6
2162 if (isipv6)
2163 inp = in6_pcblookup_hash(&tcbinfo, &ip6->ip6_src, th->th_sport,
2164 &ip6->ip6_dst, th->th_dport, 1,
2165 m->m_pkthdr.rcvif);
2166 else
2167#endif /* INET6 */
2168 inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport,
2169 ip->ip_dst, th->th_dport, 1, m->m_pkthdr.rcvif);
2170 }
2171
2172 /*
2173 * Use the interface scope information from the PCB for outbound
2174 * segments. If the PCB isn't present and if scoped routing is
2175 * enabled, tcp_respond will use the scope of the interface where
2176 * the segment arrived on.
2177 */
2178 if (inp != NULL && (inp->inp_flags & INP_BOUND_IF))
2179 ifscope = inp->inp_boundifp->if_index;
2180
2181 /*
2182 * If the state is CLOSED (i.e., TCB does not exist) then
2183 * all data in the incoming segment is discarded.
2184 * If the TCB exists but is in CLOSED state, it is embryonic,
2185 * but should either do a listen or a connect soon.
2186 */
2187 if (inp == NULL) {
2188 if (log_in_vain) {
2189#if INET6
2190 char dbuf[MAX_IPv6_STR_LEN], sbuf[MAX_IPv6_STR_LEN];
2191#else /* INET6 */
2192 char dbuf[MAX_IPv4_STR_LEN], sbuf[MAX_IPv4_STR_LEN];
2193#endif /* INET6 */
2194
2195#if INET6
2196 if (isipv6) {
2197 inet_ntop(AF_INET6, &ip6->ip6_dst, dbuf, sizeof(dbuf));
2198 inet_ntop(AF_INET6, &ip6->ip6_src, sbuf, sizeof(sbuf));
2199 } else
2200#endif
2201 {
2202 inet_ntop(AF_INET, &ip->ip_dst, dbuf, sizeof(dbuf));
2203 inet_ntop(AF_INET, &ip->ip_src, sbuf, sizeof(sbuf));
2204 }
2205 switch (log_in_vain) {
2206 case 1:
2207 if(thflags & TH_SYN)
2208 log(LOG_INFO,
2209 "Connection attempt to TCP %s:%d from %s:%d\n",
2210 dbuf, ntohs(th->th_dport),
2211 sbuf,
2212 ntohs(th->th_sport));
2213 break;
2214 case 2:
2215 log(LOG_INFO,
2216 "Connection attempt to TCP %s:%d from %s:%d flags:0x%x\n",
2217 dbuf, ntohs(th->th_dport), sbuf,
2218 ntohs(th->th_sport), thflags);
2219 break;
2220 case 3:
2221 case 4:
2222 if ((thflags & TH_SYN) && !(thflags & TH_ACK) &&
2223 !(m->m_flags & (M_BCAST | M_MCAST)) &&
2224#if INET6
2225 ((isipv6 && !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) ||
2226 (!isipv6 && ip->ip_dst.s_addr != ip->ip_src.s_addr))
2227#else
2228 ip->ip_dst.s_addr != ip->ip_src.s_addr
2229#endif
2230 )
2231 log_in_vain_log((LOG_INFO,
2232 "Stealth Mode connection attempt to TCP %s:%d from %s:%d\n",
2233 dbuf, ntohs(th->th_dport),
2234 sbuf,
2235 ntohs(th->th_sport)));
2236 break;
2237 default:
2238 break;
2239 }
2240 }
2241 if (blackhole) {
2242 if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type != IFT_LOOP)
2243
2244 switch (blackhole) {
2245 case 1:
2246 if (thflags & TH_SYN)
2247 goto dropnosock;
2248 break;
2249 case 2:
2250 goto dropnosock;
2251 default:
2252 goto dropnosock;
2253 }
2254 }
2255 rstreason = BANDLIM_RST_CLOSEDPORT;
2256 IF_TCP_STATINC(ifp, noconnnolist);
2257 goto dropwithresetnosock;
2258 }
2259 so = inp->inp_socket;
2260 if (so == NULL) {
2261 /* This case shouldn't happen as the socket shouldn't be null
2262 * if inp_state isn't set to INPCB_STATE_DEAD
2263 * But just in case, we pretend we didn't find the socket if we hit this case
2264 * as this isn't cause for a panic (the socket might be leaked however)...
2265 */
2266 inp = NULL;
2267#if TEMPDEBUG
2268 printf("tcp_input: no more socket for inp=%x. This shouldn't happen\n", inp);
2269#endif
2270 goto dropnosock;
2271 }
2272
2273 socket_lock(so, 1);
2274 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
2275 socket_unlock(so, 1);
2276 inp = NULL; // pretend we didn't find it
2277 goto dropnosock;
2278 }
2279
2280#if NECP
2281 if (so->so_state & SS_ISCONNECTED) {
2282 // Connected TCP sockets have a fully-bound local and remote,
2283 // so the policy check doesn't need to override addresses
2284 if (!necp_socket_is_allowed_to_send_recv(inp, NULL, NULL, NULL)) {
2285 IF_TCP_STATINC(ifp, badformat);
2286 goto drop;
2287 }
2288 } else {
2289#if INET6
2290 if (isipv6) {
2291 if (!necp_socket_is_allowed_to_send_recv_v6(inp,
2292 th->th_dport, th->th_sport, &ip6->ip6_dst,
2293 &ip6->ip6_src, ifp, NULL, NULL, NULL)) {
2294 IF_TCP_STATINC(ifp, badformat);
2295 goto drop;
2296 }
2297 } else
2298#endif
2299 {
2300 if (!necp_socket_is_allowed_to_send_recv_v4(inp,
2301 th->th_dport, th->th_sport, &ip->ip_dst, &ip->ip_src,
2302 ifp, NULL, NULL, NULL)) {
2303 IF_TCP_STATINC(ifp, badformat);
2304 goto drop;
2305 }
2306 }
2307 }
2308#endif /* NECP */
2309
2310 tp = intotcpcb(inp);
2311 if (tp == 0) {
2312 rstreason = BANDLIM_RST_CLOSEDPORT;
2313 IF_TCP_STATINC(ifp, noconnlist);
2314 goto dropwithreset;
2315 }
2316 if (tp->t_state == TCPS_CLOSED)
2317 goto drop;
2318
2319 /* If none of the FIN|SYN|RST|ACK flag is set, drop */
2320 if (tcp_do_rfc5961 && (thflags & TH_ACCEPT) == 0)
2321 goto drop;
2322
2323 /* Unscale the window into a 32-bit value. */
2324 if ((thflags & TH_SYN) == 0)
2325 tiwin = th->th_win << tp->snd_scale;
2326 else
2327 tiwin = th->th_win;
2328
2329#if CONFIG_MACF_NET
2330 if (mac_inpcb_check_deliver(inp, m, AF_INET, SOCK_STREAM))
2331 goto drop;
2332#endif
2333
2334 /* Avoid processing packets while closing a listen socket */
2335 if (tp->t_state == TCPS_LISTEN &&
2336 (so->so_options & SO_ACCEPTCONN) == 0)
2337 goto drop;
2338
2339 if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
2340#if TCPDEBUG
2341 if (so->so_options & SO_DEBUG) {
2342 ostate = tp->t_state;
2343#if INET6
2344 if (isipv6)
2345 bcopy((char *)ip6, (char *)tcp_saveipgen,
2346 sizeof(*ip6));
2347 else
2348#endif /* INET6 */
2349 bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip));
2350 tcp_savetcp = *th;
2351 }
2352#endif
2353 if (so->so_options & SO_ACCEPTCONN) {
2354 struct tcpcb *tp0 = tp;
2355 struct socket *so2;
2356 struct socket *oso;
2357 struct sockaddr_storage from;
2358#if INET6
2359 struct inpcb *oinp = sotoinpcb(so);
2360#endif /* INET6 */
2361 struct ifnet *head_ifscope;
2362 unsigned int head_nocell, head_recvanyif,
2363 head_noexpensive, head_awdl_unrestricted,
2364 head_intcoproc_allowed;
2365
2366 /* Get listener's bound-to-interface, if any */
2367 head_ifscope = (inp->inp_flags & INP_BOUND_IF) ?
2368 inp->inp_boundifp : NULL;
2369 /* Get listener's no-cellular information, if any */
2370 head_nocell = INP_NO_CELLULAR(inp);
2371 /* Get listener's recv-any-interface, if any */
2372 head_recvanyif = (inp->inp_flags & INP_RECV_ANYIF);
2373 /* Get listener's no-expensive information, if any */
2374 head_noexpensive = INP_NO_EXPENSIVE(inp);
2375 head_awdl_unrestricted = INP_AWDL_UNRESTRICTED(inp);
2376 head_intcoproc_allowed = INP_INTCOPROC_ALLOWED(inp);
2377
2378 /*
2379 * If the state is LISTEN then ignore segment if it contains an RST.
2380 * If the segment contains an ACK then it is bad and send a RST.
2381 * If it does not contain a SYN then it is not interesting; drop it.
2382 * If it is from this socket, drop it, it must be forged.
2383 */
2384 if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
2385 IF_TCP_STATINC(ifp, listbadsyn);
2386
2387 if (thflags & TH_RST) {
2388 goto drop;
2389 }
2390 if (thflags & TH_ACK) {
2391 tp = NULL;
2392 tcpstat.tcps_badsyn++;
2393 rstreason = BANDLIM_RST_OPENPORT;
2394 goto dropwithreset;
2395 }
2396
2397 /* We come here if there is no SYN set */
2398 tcpstat.tcps_badsyn++;
2399 goto drop;
2400 }
2401 KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_START,0,0,0,0,0);
2402 if (th->th_dport == th->th_sport) {
2403#if INET6
2404 if (isipv6) {
2405 if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
2406 &ip6->ip6_src))
2407 goto drop;
2408 } else
2409#endif /* INET6 */
2410 if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
2411 goto drop;
2412 }
2413 /*
2414 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
2415 * in_broadcast() should never return true on a received
2416 * packet with M_BCAST not set.
2417 *
2418 * Packets with a multicast source address should also
2419 * be discarded.
2420 */
2421 if (m->m_flags & (M_BCAST|M_MCAST))
2422 goto drop;
2423#if INET6
2424 if (isipv6) {
2425 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
2426 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
2427 goto drop;
2428 } else
2429#endif
2430 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
2431 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
2432 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
2433 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
2434 goto drop;
2435
2436
2437#if INET6
2438 /*
2439 * If deprecated address is forbidden,
2440 * we do not accept SYN to deprecated interface
2441 * address to prevent any new inbound connection from
2442 * getting established.
2443 * When we do not accept SYN, we send a TCP RST,
2444 * with deprecated source address (instead of dropping
2445 * it). We compromise it as it is much better for peer
2446 * to send a RST, and RST will be the final packet
2447 * for the exchange.
2448 *
2449 * If we do not forbid deprecated addresses, we accept
2450 * the SYN packet. RFC 4862 forbids dropping SYN in
2451 * this case.
2452 */
2453 if (isipv6 && !ip6_use_deprecated) {
2454 uint32_t ia6_flags;
2455
2456 if (ip6_getdstifaddr_info(m, NULL,
2457 &ia6_flags) == 0) {
2458 if (ia6_flags & IN6_IFF_DEPRECATED) {
2459 tp = NULL;
2460 rstreason = BANDLIM_RST_OPENPORT;
2461 IF_TCP_STATINC(ifp, deprecate6);
2462 goto dropwithreset;
2463 }
2464 }
2465 }
2466#endif
2467 if (so->so_filt) {
2468#if INET6
2469 if (isipv6) {
2470 struct sockaddr_in6 *sin6 = (struct sockaddr_in6*)&from;
2471
2472 sin6->sin6_len = sizeof(*sin6);
2473 sin6->sin6_family = AF_INET6;
2474 sin6->sin6_port = th->th_sport;
2475 sin6->sin6_flowinfo = 0;
2476 sin6->sin6_addr = ip6->ip6_src;
2477 sin6->sin6_scope_id = 0;
2478 }
2479 else
2480#endif
2481 {
2482 struct sockaddr_in *sin = (struct sockaddr_in*)&from;
2483
2484 sin->sin_len = sizeof(*sin);
2485 sin->sin_family = AF_INET;
2486 sin->sin_port = th->th_sport;
2487 sin->sin_addr = ip->ip_src;
2488 }
2489 so2 = sonewconn(so, 0, (struct sockaddr*)&from);
2490 } else {
2491 so2 = sonewconn(so, 0, NULL);
2492 }
2493 if (so2 == 0) {
2494 tcpstat.tcps_listendrop++;
2495 if (tcp_dropdropablreq(so)) {
2496 if (so->so_filt)
2497 so2 = sonewconn(so, 0, (struct sockaddr*)&from);
2498 else
2499 so2 = sonewconn(so, 0, NULL);
2500 }
2501 if (!so2)
2502 goto drop;
2503 }
2504
2505 /* Point "inp" and "tp" in tandem to new socket */
2506 inp = (struct inpcb *)so2->so_pcb;
2507 tp = intotcpcb(inp);
2508
2509 oso = so;
2510 socket_unlock(so, 0); /* Unlock but keep a reference on listener for now */
2511
2512 so = so2;
2513 socket_lock(so, 1);
2514 /*
2515 * Mark socket as temporary until we're
2516 * committed to keeping it. The code at
2517 * ``drop'' and ``dropwithreset'' check the
2518 * flag dropsocket to see if the temporary
2519 * socket created here should be discarded.
2520 * We mark the socket as discardable until
2521 * we're committed to it below in TCPS_LISTEN.
2522 * There are some error conditions in which we
2523 * have to drop the temporary socket.
2524 */
2525 dropsocket++;
2526 /*
2527 * Inherit INP_BOUND_IF from listener; testing if
2528 * head_ifscope is non-NULL is sufficient, since it
2529 * can only be set to a non-zero value earlier if
2530 * the listener has such a flag set.
2531 */
2532 if (head_ifscope != NULL) {
2533 inp->inp_flags |= INP_BOUND_IF;
2534 inp->inp_boundifp = head_ifscope;
2535 } else {
2536 inp->inp_flags &= ~INP_BOUND_IF;
2537 }
2538 /*
2539 * Inherit restrictions from listener.
2540 */
2541 if (head_nocell)
2542 inp_set_nocellular(inp);
2543 if (head_noexpensive)
2544 inp_set_noexpensive(inp);
2545 if (head_awdl_unrestricted)
2546 inp_set_awdl_unrestricted(inp);
2547 if (head_intcoproc_allowed)
2548 inp_set_intcoproc_allowed(inp);
2549 /*
2550 * Inherit {IN,IN6}_RECV_ANYIF from listener.
2551 */
2552 if (head_recvanyif)
2553 inp->inp_flags |= INP_RECV_ANYIF;
2554 else
2555 inp->inp_flags &= ~INP_RECV_ANYIF;
2556#if INET6
2557 if (isipv6)
2558 inp->in6p_laddr = ip6->ip6_dst;
2559 else {
2560 inp->inp_vflag &= ~INP_IPV6;
2561 inp->inp_vflag |= INP_IPV4;
2562#endif /* INET6 */
2563 inp->inp_laddr = ip->ip_dst;
2564#if INET6
2565 }
2566#endif /* INET6 */
2567 inp->inp_lport = th->th_dport;
2568 if (in_pcbinshash(inp, 0) != 0) {
2569 /*
2570 * Undo the assignments above if we failed to
2571 * put the PCB on the hash lists.
2572 */
2573#if INET6
2574 if (isipv6)
2575 inp->in6p_laddr = in6addr_any;
2576 else
2577#endif /* INET6 */
2578 inp->inp_laddr.s_addr = INADDR_ANY;
2579 inp->inp_lport = 0;
2580 socket_lock(oso, 0); /* release ref on parent */
2581 socket_unlock(oso, 1);
2582 goto drop;
2583 }
2584#if INET6
2585 if (isipv6) {
2586 /*
2587 * Inherit socket options from the listening
2588 * socket.
2589 * Note that in6p_inputopts are not (even
2590 * should not be) copied, since it stores
2591 * previously received options and is used to
2592 * detect if each new option is different than
2593 * the previous one and hence should be passed
2594 * to a user.
2595 * If we copied in6p_inputopts, a user would
2596 * not be able to receive options just after
2597 * calling the accept system call.
2598 */
2599 inp->inp_flags |=
2600 oinp->inp_flags & INP_CONTROLOPTS;
2601 if (oinp->in6p_outputopts)
2602 inp->in6p_outputopts =
2603 ip6_copypktopts(oinp->in6p_outputopts,
2604 M_NOWAIT);
2605 } else
2606#endif /* INET6 */
2607 {
2608 inp->inp_options = ip_srcroute();
2609 inp->inp_ip_tos = oinp->inp_ip_tos;
2610 }
2611 socket_lock(oso, 0);
2612#if IPSEC
2613 /* copy old policy into new socket's */
2614 if (sotoinpcb(oso)->inp_sp)
2615 {
2616 int error = 0;
2617 /* Is it a security hole here to silently fail to copy the policy? */
2618 if (inp->inp_sp != NULL)
2619 error = ipsec_init_policy(so, &inp->inp_sp);
2620 if (error != 0 || ipsec_copy_policy(sotoinpcb(oso)->inp_sp, inp->inp_sp))
2621 printf("tcp_input: could not copy policy\n");
2622 }
2623#endif
2624 /* inherit states from the listener */
2625 DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp,
2626 struct tcpcb *, tp, int32_t, TCPS_LISTEN);
2627 tp->t_state = TCPS_LISTEN;
2628 tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT|TF_NODELAY);
2629 tp->t_flagsext |= (tp0->t_flagsext & (TF_RXTFINDROP|TF_NOTIMEWAIT|TF_FASTOPEN));
2630 tp->t_keepinit = tp0->t_keepinit;
2631 tp->t_keepcnt = tp0->t_keepcnt;
2632 tp->t_keepintvl = tp0->t_keepintvl;
2633 tp->t_adaptive_wtimo = tp0->t_adaptive_wtimo;
2634 tp->t_adaptive_rtimo = tp0->t_adaptive_rtimo;
2635 tp->t_inpcb->inp_ip_ttl = tp0->t_inpcb->inp_ip_ttl;
2636 if ((so->so_flags & SOF_NOTSENT_LOWAT) != 0)
2637 tp->t_notsent_lowat = tp0->t_notsent_lowat;
2638 tp->t_inpcb->inp_flags2 |=
2639 tp0->t_inpcb->inp_flags2 & INP2_KEEPALIVE_OFFLOAD;
2640
2641 /* now drop the reference on the listener */
2642 socket_unlock(oso, 1);
2643
2644 tcp_set_max_rwinscale(tp, so, ifp);
2645
2646 KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_END,0,0,0,0,0);
2647 }
2648 }
2649 socket_lock_assert_owned(so);
2650
2651 if (tp->t_state == TCPS_ESTABLISHED && tlen > 0) {
2652 /*
2653 * Evaluate the rate of arrival of packets to see if the
2654 * receiver can reduce the ack traffic. The algorithm to
2655 * stretch acks will be enabled if the connection meets
2656 * certain criteria defined in tcp_stretch_ack_enable function.
2657 */
2658 if ((tp->t_flagsext & TF_RCVUNACK_WAITSS) != 0) {
2659 TCP_INC_VAR(tp->rcv_waitforss, nlropkts);
2660 }
2661 if (tcp_stretch_ack_enable(tp, thflags)) {
2662 tp->t_flags |= TF_STRETCHACK;
2663 tp->t_flagsext &= ~(TF_RCVUNACK_WAITSS);
2664 tp->rcv_waitforss = 0;
2665 } else {
2666 tp->t_flags &= ~(TF_STRETCHACK);
2667 }
2668 if (TSTMP_GT(tp->rcv_unackwin, tcp_now)) {
2669 tp->rcv_by_unackwin += (tlen + off);
2670 } else {
2671 tp->rcv_unackwin = tcp_now + tcp_rcvunackwin;
2672 tp->rcv_by_unackwin = tlen + off;
2673 }
2674 }
2675
2676 /*
2677 * Keep track of how many bytes were received in the LRO packet
2678 */
2679 if ((pktf_sw_lro_pkt) && (nlropkts > 2)) {
2680 tp->t_lropktlen += tlen;
2681 }
2682 /*
2683 * Explicit Congestion Notification - Flag that we need to send ECT if
2684 * + The IP Congestion experienced flag was set.
2685 * + Socket is in established state
2686 * + We negotiated ECN in the TCP setup
2687 * + This isn't a pure ack (tlen > 0)
2688 * + The data is in the valid window
2689 *
2690 * TE_SENDECE will be cleared when we receive a packet with TH_CWR set.
2691 */
2692 if (ip_ecn == IPTOS_ECN_CE && tp->t_state == TCPS_ESTABLISHED &&
2693 TCP_ECN_ENABLED(tp) && tlen > 0 &&
2694 SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
2695 SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) {
2696 tp->t_ecn_recv_ce++;
2697 tcpstat.tcps_ecn_recv_ce++;
2698 INP_INC_IFNET_STAT(inp, ecn_recv_ce);
2699 /* Mark this connection as it received CE from network */
2700 tp->ecn_flags |= TE_RECV_ECN_CE;
2701 tp->ecn_flags |= TE_SENDECE;
2702 }
2703
2704 /*
2705 * Clear TE_SENDECE if TH_CWR is set. This is harmless, so we don't
2706 * bother doing extensive checks for state and whatnot.
2707 */
2708 if (thflags & TH_CWR) {
2709 tp->ecn_flags &= ~TE_SENDECE;
2710 tp->t_ecn_recv_cwr++;
2711 }
2712
2713 /*
2714 * If we received an explicit notification of congestion in
2715 * ip tos ecn bits or by the CWR bit in TCP header flags, reset
2716 * the ack-strteching state. We need to handle ECN notification if
2717 * an ECN setup SYN was sent even once.
2718 */
2719 if (tp->t_state == TCPS_ESTABLISHED
2720 && (tp->ecn_flags & TE_SETUPSENT)
2721 && (ip_ecn == IPTOS_ECN_CE || (thflags & TH_CWR))) {
2722 tcp_reset_stretch_ack(tp);
2723 CLEAR_IAJ_STATE(tp);
2724 }
2725
2726 if (ip_ecn == IPTOS_ECN_CE && tp->t_state == TCPS_ESTABLISHED &&
2727 !TCP_ECN_ENABLED(tp) && !(tp->ecn_flags & TE_CEHEURI_SET)) {
2728 tcpstat.tcps_ecn_fallback_ce++;
2729 tcp_heuristic_ecn_aggressive(tp);
2730 tp->ecn_flags |= TE_CEHEURI_SET;
2731 }
2732
2733 if (tp->t_state == TCPS_ESTABLISHED && TCP_ECN_ENABLED(tp) &&
2734 ip_ecn == IPTOS_ECN_CE && !(tp->ecn_flags & TE_CEHEURI_SET)) {
2735 if (inp->inp_stat->rxpackets < ECN_MIN_CE_PROBES) {
2736 tp->t_ecn_recv_ce_pkt++;
2737 } else if (tp->t_ecn_recv_ce_pkt > ECN_MAX_CE_RATIO) {
2738 tcpstat.tcps_ecn_fallback_ce++;
2739 tcp_heuristic_ecn_aggressive(tp);
2740 tp->ecn_flags |= TE_CEHEURI_SET;
2741 INP_INC_IFNET_STAT(inp,ecn_fallback_ce);
2742 } else {
2743 /* We tracked the first ECN_MIN_CE_PROBES segments, we
2744 * now know that the path is good.
2745 */
2746 tp->ecn_flags |= TE_CEHEURI_SET;
2747 }
2748 }
2749
2750 /*
2751 * Try to determine if we are receiving a packet after a long time.
2752 * Use our own approximation of idletime to roughly measure remote
2753 * end's idle time. Since slowstart is used after an idle period
2754 * we want to avoid doing LRO if the remote end is not up to date
2755 * on initial window support and starts with 1 or 2 packets as its IW.
2756 */
2757 if (sw_lro && (tp->t_flagsext & TF_LRO_OFFLOADED) &&
2758 ((tcp_now - tp->t_rcvtime) >= (TCP_IDLETIMEOUT(tp)))) {
2759 turnoff_lro = 1;
2760 }
2761
2762 /* Update rcvtime as a new segment was received on the connection */
2763 tp->t_rcvtime = tcp_now;
2764
2765 /*
2766 * Segment received on connection.
2767 * Reset idle time and keep-alive timer.
2768 */
2769 if (TCPS_HAVEESTABLISHED(tp->t_state)) {
2770 tcp_keepalive_reset(tp);
2771
2772 if (tp->t_mpsub)
2773 mptcp_reset_keepalive(tp);
2774 }
2775
2776 /*
2777 * Process options if not in LISTEN state,
2778 * else do it below (after getting remote address).
2779 */
2780 if (tp->t_state != TCPS_LISTEN && optp) {
2781 tcp_dooptions(tp, optp, optlen, th, &to);
2782 }
2783#if MPTCP
2784 if (tp->t_state != TCPS_LISTEN && (so->so_flags & SOF_MP_SUBFLOW) &&
2785 mptcp_input_preproc(tp, m, th, drop_hdrlen) != 0) {
2786 tp->t_flags |= TF_ACKNOW;
2787 (void) tcp_output(tp);
2788 tcp_check_timer_state(tp);
2789 socket_unlock(so, 1);
2790 KERNEL_DEBUG(DBG_FNC_TCP_INPUT |
2791 DBG_FUNC_END,0,0,0,0,0);
2792 return;
2793 }
2794#endif /* MPTCP */
2795 if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
2796 if (!(thflags & TH_ACK) ||
2797 (SEQ_GT(th->th_ack, tp->iss) &&
2798 SEQ_LEQ(th->th_ack, tp->snd_max)))
2799 tcp_finalize_options(tp, &to, ifscope);
2800 }
2801
2802#if TRAFFIC_MGT
2803 /*
2804 * Compute inter-packet arrival jitter. According to RFC 3550,
2805 * inter-packet arrival jitter is defined as the difference in
2806 * packet spacing at the receiver compared to the sender for a
2807 * pair of packets. When two packets of maximum segment size come
2808 * one after the other with consecutive sequence numbers, we
2809 * consider them as packets sent together at the sender and use
2810 * them as a pair to compute inter-packet arrival jitter. This
2811 * metric indicates the delay induced by the network components due
2812 * to queuing in edge/access routers.
2813 */
2814 if (tp->t_state == TCPS_ESTABLISHED &&
2815 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK|TH_ECE|TH_PUSH)) == TH_ACK &&
2816 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
2817 ((to.to_flags & TOF_TS) == 0 ||
2818 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
2819 th->th_seq == tp->rcv_nxt && LIST_EMPTY(&tp->t_segq)) {
2820 int seg_size = tlen;
2821 if (tp->iaj_pktcnt <= IAJ_IGNORE_PKTCNT) {
2822 TCP_INC_VAR(tp->iaj_pktcnt, nlropkts);
2823 }
2824
2825 if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) {
2826 seg_size = m->m_pkthdr.lro_pktlen;
2827 }
2828 if ( tp->iaj_size == 0 || seg_size > tp->iaj_size ||
2829 (seg_size == tp->iaj_size && tp->iaj_rcv_ts == 0)) {
2830 /*
2831 * State related to inter-arrival jitter is
2832 * uninitialized or we are trying to find a good
2833 * first packet to start computing the metric
2834 */
2835 update_iaj_state(tp, seg_size, 0);
2836 } else {
2837 if (seg_size == tp->iaj_size) {
2838 /*
2839 * Compute inter-arrival jitter taking
2840 * this packet as the second packet
2841 */
2842 if (pktf_sw_lro_pkt)
2843 compute_iaj(tp, nlropkts,
2844 m->m_pkthdr.lro_elapsed);
2845 else
2846 compute_iaj(tp, 1, 0);
2847 }
2848 if (seg_size < tp->iaj_size) {
2849 /*
2850 * There is a smaller packet in the stream.
2851 * Some times the maximum size supported
2852 * on a path can change if there is a new
2853 * link with smaller MTU. The receiver will
2854 * not know about this change. If there
2855 * are too many packets smaller than
2856 * iaj_size, we try to learn the iaj_size
2857 * again.
2858 */
2859 TCP_INC_VAR(tp->iaj_small_pkt, nlropkts);
2860 if (tp->iaj_small_pkt > RESET_IAJ_SIZE_THRESH) {
2861 update_iaj_state(tp, seg_size, 1);
2862 } else {
2863 CLEAR_IAJ_STATE(tp);
2864 }
2865 } else {
2866 update_iaj_state(tp, seg_size, 0);
2867 }
2868 }
2869 } else {
2870 CLEAR_IAJ_STATE(tp);
2871 }
2872#endif /* TRAFFIC_MGT */
2873
2874 /*
2875 * Header prediction: check for the two common cases
2876 * of a uni-directional data xfer. If the packet has
2877 * no control flags, is in-sequence, the window didn't
2878 * change and we're not retransmitting, it's a
2879 * candidate. If the length is zero and the ack moved
2880 * forward, we're the sender side of the xfer. Just
2881 * free the data acked & wake any higher level process
2882 * that was blocked waiting for space. If the length
2883 * is non-zero and the ack didn't move, we're the
2884 * receiver side. If we're getting packets in-order
2885 * (the reassembly queue is empty), add the data to
2886 * the socket buffer and note that we need a delayed ack.
2887 * Make sure that the hidden state-flags are also off.
2888 * Since we check for TCPS_ESTABLISHED above, it can only
2889 * be TH_NEEDSYN.
2890 */
2891 if (tp->t_state == TCPS_ESTABLISHED &&
2892 (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK|TH_ECE|TH_CWR)) == TH_ACK &&
2893 ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
2894 ((to.to_flags & TOF_TS) == 0 ||
2895 TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
2896 th->th_seq == tp->rcv_nxt &&
2897 tiwin && tiwin == tp->snd_wnd &&
2898 tp->snd_nxt == tp->snd_max) {
2899
2900 /*
2901 * If last ACK falls within this segment's sequence numbers,
2902 * record the timestamp.
2903 * NOTE that the test is modified according to the latest
2904 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
2905 */
2906 if ((to.to_flags & TOF_TS) != 0 &&
2907 SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
2908 tp->ts_recent_age = tcp_now;
2909 tp->ts_recent = to.to_tsval;
2910 }
2911
2912 if (tlen == 0) {
2913 if (SEQ_GT(th->th_ack, tp->snd_una) &&
2914 SEQ_LEQ(th->th_ack, tp->snd_max) &&
2915 tp->snd_cwnd >= tp->snd_ssthresh &&
2916 (!IN_FASTRECOVERY(tp) &&
2917 ((!(SACK_ENABLED(tp)) &&
2918 tp->t_dupacks < tp->t_rexmtthresh) ||
2919 (SACK_ENABLED(tp) && to.to_nsacks == 0 &&
2920 TAILQ_EMPTY(&tp->snd_holes))))) {
2921 /*
2922 * this is a pure ack for outstanding data.
2923 */
2924 ++tcpstat.tcps_predack;
2925
2926 tcp_bad_rexmt_check(tp, th, &to);
2927
2928 /* Recalculate the RTT */
2929 tcp_compute_rtt(tp, &to, th);
2930
2931 VERIFY(SEQ_GEQ(th->th_ack, tp->snd_una));
2932 acked = BYTES_ACKED(th, tp);
2933 tcpstat.tcps_rcvackpack++;
2934 tcpstat.tcps_rcvackbyte += acked;
2935
2936 /*
2937 * Handle an ack that is in sequence during
2938 * congestion avoidance phase. The
2939 * calculations in this function
2940 * assume that snd_una is not updated yet.
2941 */
2942 if (CC_ALGO(tp)->congestion_avd != NULL)
2943 CC_ALGO(tp)->congestion_avd(tp, th);
2944 tcp_ccdbg_trace(tp, th, TCP_CC_INSEQ_ACK_RCVD);
2945 sbdrop(&so->so_snd, acked);
2946 if (so->so_flags & SOF_ENABLE_MSGS) {
2947 VERIFY(acked <= so->so_msg_state->msg_serial_bytes);
2948 so->so_msg_state->msg_serial_bytes -= acked;
2949 }
2950 tcp_sbsnd_trim(&so->so_snd);
2951
2952 if (SEQ_GT(tp->snd_una, tp->snd_recover) &&
2953 SEQ_LEQ(th->th_ack, tp->snd_recover))
2954 tp->snd_recover = th->th_ack - 1;
2955 tp->snd_una = th->th_ack;
2956
2957 TCP_RESET_REXMT_STATE(tp);
2958
2959 /*
2960 * pull snd_wl2 up to prevent seq wrap relative
2961 * to th_ack.
2962 */
2963 tp->snd_wl2 = th->th_ack;
2964
2965 if (tp->t_dupacks > 0) {
2966 tp->t_dupacks = 0;
2967 tp->t_rexmtthresh = tcprexmtthresh;
2968 }
2969
2970 m_freem(m);
2971
2972 /*
2973 * If all outstanding data are acked, stop
2974 * retransmit timer, otherwise restart timer
2975 * using current (possibly backed-off) value.
2976 * If process is waiting for space,
2977 * wakeup/selwakeup/signal. If data
2978 * are ready to send, let tcp_output
2979 * decide between more output or persist.
2980 */
2981 if (tp->snd_una == tp->snd_max) {
2982 tp->t_timer[TCPT_REXMT] = 0;
2983 tp->t_timer[TCPT_PTO] = 0;
2984 } else if (tp->t_timer[TCPT_PERSIST] == 0) {
2985 tp->t_timer[TCPT_REXMT] =
2986 OFFSET_FROM_START(tp,
2987 tp->t_rxtcur);
2988 }
2989 if (!SLIST_EMPTY(&tp->t_rxt_segments) &&
2990 !TCP_DSACK_SEQ_IN_WINDOW(tp,
2991 tp->t_dsack_lastuna, tp->snd_una))
2992 tcp_rxtseg_clean(tp);
2993
2994 if ((tp->t_flagsext & TF_MEASURESNDBW) != 0 &&
2995 tp->t_bwmeas != NULL)
2996 tcp_bwmeas_check(tp);
2997
2998 sowwakeup(so); /* has to be done with socket lock held */
2999 if (!SLIST_EMPTY(&tp->t_notify_ack))
3000 tcp_notify_acknowledgement(tp, so);
3001
3002 if ((so->so_snd.sb_cc) || (tp->t_flags & TF_ACKNOW)) {
3003 (void) tcp_output(tp);
3004 }
3005
3006 tcp_tfo_rcv_ack(tp, th);
3007
3008 tcp_check_timer_state(tp);
3009 socket_unlock(so, 1);
3010 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
3011 return;
3012 }
3013 } else if (th->th_ack == tp->snd_una &&
3014 LIST_EMPTY(&tp->t_segq) &&
3015 tlen <= tcp_sbspace(tp)) {
3016 /*
3017 * this is a pure, in-sequence data packet
3018 * with nothing on the reassembly queue and
3019 * we have enough buffer space to take it.
3020 */
3021
3022 /*
3023 * If this is a connection in steady state, start
3024 * coalescing packets belonging to this flow.
3025 */
3026 if (turnoff_lro) {
3027 tcp_lro_remove_state(tp->t_inpcb->inp_laddr,
3028 tp->t_inpcb->inp_faddr,
3029 tp->t_inpcb->inp_lport,
3030 tp->t_inpcb->inp_fport);
3031 tp->t_flagsext &= ~TF_LRO_OFFLOADED;
3032 tp->t_idleat = tp->rcv_nxt;
3033 } else if (sw_lro && !pktf_sw_lro_pkt && !isipv6 &&
3034 (so->so_flags & SOF_USELRO) &&
3035 !IFNET_IS_CELLULAR(m->m_pkthdr.rcvif) &&
3036 (m->m_pkthdr.rcvif->if_type != IFT_LOOP) &&
3037 ((th->th_seq - tp->irs) >
3038 (tp->t_maxseg << lro_start)) &&
3039 ((tp->t_idleat == 0) || ((th->th_seq -
3040 tp->t_idleat) > (tp->t_maxseg << lro_start)))) {
3041 tp->t_flagsext |= TF_LRO_OFFLOADED;
3042 tcp_start_coalescing(ip, th, tlen);
3043 tp->t_idleat = 0;
3044 }
3045
3046 /* Clean receiver SACK report if present */
3047 if (SACK_ENABLED(tp) && tp->rcv_numsacks)
3048 tcp_clean_sackreport(tp);
3049 ++tcpstat.tcps_preddat;
3050 tp->rcv_nxt += tlen;
3051 /*
3052 * Pull snd_wl1 up to prevent seq wrap relative to
3053 * th_seq.
3054 */
3055 tp->snd_wl1 = th->th_seq;
3056 /*
3057 * Pull rcv_up up to prevent seq wrap relative to
3058 * rcv_nxt.
3059 */
3060 tp->rcv_up = tp->rcv_nxt;
3061 TCP_INC_VAR(tcpstat.tcps_rcvpack, nlropkts);
3062 tcpstat.tcps_rcvbyte += tlen;
3063 if (nstat_collect) {
3064 if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) {
3065 INP_ADD_STAT(inp, cell, wifi, wired,
3066 rxpackets, m->m_pkthdr.lro_npkts);
3067 } else {
3068 INP_ADD_STAT(inp, cell, wifi, wired,
3069 rxpackets, 1);
3070 }
3071 INP_ADD_STAT(inp, cell, wifi, wired,rxbytes,
3072 tlen);
3073 inp_set_activity_bitmap(inp);
3074 }
3075
3076 /*
3077 * Calculate the RTT on the receiver only if the
3078 * connection is in streaming mode and the last
3079 * packet was not an end-of-write
3080 */
3081 if (tp->t_flags & TF_STREAMING_ON)
3082 tcp_compute_rtt(tp, &to, th);
3083
3084 tcp_sbrcv_grow(tp, &so->so_rcv, &to, tlen,
3085 TCP_AUTORCVBUF_MAX(ifp));
3086
3087 /*
3088 * Add data to socket buffer.
3089 */
3090 so_recv_data_stat(so, m, 0);
3091 m_adj(m, drop_hdrlen); /* delayed header drop */
3092
3093 /*
3094 * If message delivery (SOF_ENABLE_MSGS) is enabled on
3095 * this socket, deliver the packet received as an
3096 * in-order message with sequence number attached to it.
3097 */
3098 if (sbappendstream_rcvdemux(so, m,
3099 th->th_seq - (tp->irs + 1), 0)) {
3100 sorwakeup(so);
3101 }
3102#if INET6
3103 if (isipv6) {
3104 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
3105 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
3106 th->th_seq, th->th_ack, th->th_win);
3107 }
3108 else
3109#endif
3110 {
3111 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
3112 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
3113 th->th_seq, th->th_ack, th->th_win);
3114 }
3115 TCP_INC_VAR(tp->t_unacksegs, nlropkts);
3116 if (DELAY_ACK(tp, th)) {
3117 if ((tp->t_flags & TF_DELACK) == 0) {
3118 tp->t_flags |= TF_DELACK;
3119 tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack);
3120 }
3121 } else {
3122 tp->t_flags |= TF_ACKNOW;
3123 tcp_output(tp);
3124 }
3125
3126 tcp_adaptive_rwtimo_check(tp, tlen);
3127
3128 if (tlen > 0)
3129 tcp_tfo_rcv_data(tp);
3130
3131 tcp_check_timer_state(tp);
3132 socket_unlock(so, 1);
3133 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
3134 return;
3135 }
3136 }
3137
3138 /*
3139 * Calculate amount of space in receive window,
3140 * and then do TCP input processing.
3141 * Receive window is amount of space in rcv queue,
3142 * but not less than advertised window.
3143 */
3144 socket_lock_assert_owned(so);
3145 win = tcp_sbspace(tp);
3146 if (win < 0)
3147 win = 0;
3148 else { /* clip rcv window to 4K for modems */
3149 if (tp->t_flags & TF_SLOWLINK && slowlink_wsize > 0)
3150 win = min(win, slowlink_wsize);
3151 }
3152 tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt));
3153#if MPTCP
3154 /*
3155 * Ensure that the subflow receive window isn't greater
3156 * than the connection level receive window.
3157 */
3158 if ((tp->t_mpflags & TMPF_MPTCP_TRUE) &&
3159 (mp_tp = tptomptp(tp))) {
3160 mpte_lock_assert_held(mp_tp->mpt_mpte);
3161 if (tp->rcv_wnd > mp_tp->mpt_rcvwnd) {
3162 tp->rcv_wnd = imax(mp_tp->mpt_rcvwnd, (int)(tp->rcv_adv - tp->rcv_nxt));
3163 tcpstat.tcps_mp_reducedwin++;
3164 }
3165 }
3166#endif /* MPTCP */
3167
3168 switch (tp->t_state) {
3169
3170 /*
3171 * Initialize tp->rcv_nxt, and tp->irs, select an initial
3172 * tp->iss, and send a segment:
3173 * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
3174 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
3175 * Fill in remote peer address fields if not previously specified.
3176 * Enter SYN_RECEIVED state, and process any other fields of this
3177 * segment in this state.
3178 */
3179 case TCPS_LISTEN: {
3180 struct sockaddr_in *sin;
3181#if INET6
3182 struct sockaddr_in6 *sin6;
3183#endif
3184
3185 socket_lock_assert_owned(so);
3186#if INET6
3187 if (isipv6) {
3188 MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
3189 M_SONAME, M_NOWAIT);
3190 if (sin6 == NULL)
3191 goto drop;
3192 bzero(sin6, sizeof(*sin6));
3193 sin6->sin6_family = AF_INET6;
3194 sin6->sin6_len = sizeof(*sin6);
3195 sin6->sin6_addr = ip6->ip6_src;
3196 sin6->sin6_port = th->th_sport;
3197 laddr6 = inp->in6p_laddr;
3198 if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
3199 inp->in6p_laddr = ip6->ip6_dst;
3200 if (in6_pcbconnect(inp, (struct sockaddr *)sin6,
3201 proc0)) {
3202 inp->in6p_laddr = laddr6;
3203 FREE(sin6, M_SONAME);
3204 goto drop;
3205 }
3206 FREE(sin6, M_SONAME);
3207 } else
3208#endif
3209 {
3210 socket_lock_assert_owned(so);
3211 MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME,
3212 M_NOWAIT);
3213 if (sin == NULL)
3214 goto drop;
3215 sin->sin_family = AF_INET;
3216 sin->sin_len = sizeof(*sin);
3217 sin->sin_addr = ip->ip_src;
3218 sin->sin_port = th->th_sport;
3219 bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
3220 laddr = inp->inp_laddr;
3221 if (inp->inp_laddr.s_addr == INADDR_ANY)
3222 inp->inp_laddr = ip->ip_dst;
3223 if (in_pcbconnect(inp, (struct sockaddr *)sin, proc0,
3224 IFSCOPE_NONE, NULL)) {
3225 inp->inp_laddr = laddr;
3226 FREE(sin, M_SONAME);
3227 goto drop;
3228 }
3229 FREE(sin, M_SONAME);
3230 }
3231
3232 tcp_dooptions(tp, optp, optlen, th, &to);
3233 tcp_finalize_options(tp, &to, ifscope);
3234
3235 if (tfo_enabled(tp) && tcp_tfo_syn(tp, &to))
3236 isconnected = TRUE;
3237
3238 if (iss)
3239 tp->iss = iss;
3240 else {
3241 tp->iss = tcp_new_isn(tp);
3242 }
3243 tp->irs = th->th_seq;
3244 tcp_sendseqinit(tp);
3245 tcp_rcvseqinit(tp);
3246 tp->snd_recover = tp->snd_una;
3247 /*
3248 * Initialization of the tcpcb for transaction;
3249 * set SND.WND = SEG.WND,
3250 * initialize CCsend and CCrecv.
3251 */
3252 tp->snd_wnd = tiwin; /* initial send-window */
3253 tp->max_sndwnd = tp->snd_wnd;
3254 tp->t_flags |= TF_ACKNOW;
3255 tp->t_unacksegs = 0;
3256 DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp,
3257 struct tcpcb *, tp, int32_t, TCPS_SYN_RECEIVED);
3258 tp->t_state = TCPS_SYN_RECEIVED;
3259 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp,
3260 TCP_CONN_KEEPINIT(tp));
3261 dropsocket = 0; /* committed to socket */
3262
3263 if (inp->inp_flowhash == 0)
3264 inp->inp_flowhash = inp_calc_flowhash(inp);
3265#if INET6
3266 /* update flowinfo - RFC 6437 */
3267 if (inp->inp_flow == 0 &&
3268 inp->in6p_flags & IN6P_AUTOFLOWLABEL) {
3269 inp->inp_flow &= ~IPV6_FLOWLABEL_MASK;
3270 inp->inp_flow |=
3271 (htonl(inp->inp_flowhash) & IPV6_FLOWLABEL_MASK);
3272 }
3273#endif /* INET6 */
3274
3275 /* reset the incomp processing flag */
3276 so->so_flags &= ~(SOF_INCOMP_INPROGRESS);
3277 tcpstat.tcps_accepts++;
3278 if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE | TH_CWR)) {
3279 /* ECN-setup SYN */
3280 tp->ecn_flags |= (TE_SETUPRECEIVED | TE_SENDIPECT);
3281 }
3282
3283 goto trimthenstep6;
3284 }
3285
3286 /*
3287 * If the state is SYN_RECEIVED and the seg contains an ACK,
3288 * but not for our SYN/ACK, send a RST.
3289 */
3290 case TCPS_SYN_RECEIVED:
3291 if ((thflags & TH_ACK) &&
3292 (SEQ_LEQ(th->th_ack, tp->snd_una) ||
3293 SEQ_GT(th->th_ack, tp->snd_max))) {
3294 rstreason = BANDLIM_RST_OPENPORT;
3295 IF_TCP_STATINC(ifp, ooopacket);
3296 goto dropwithreset;
3297 }
3298
3299 /*
3300 * In SYN_RECEIVED state, if we recv some SYNS with
3301 * window scale and others without, window scaling should
3302 * be disabled. Otherwise the window advertised will be
3303 * lower if we assume scaling and the other end does not.
3304 */
3305 if ((thflags & TH_SYN) &&
3306 (tp->irs == th->th_seq) &&
3307 !(to.to_flags & TOF_SCALE))
3308 tp->t_flags &= ~TF_RCVD_SCALE;
3309 break;
3310
3311 /*
3312 * If the state is SYN_SENT:
3313 * if seg contains an ACK, but not for our SYN, drop the input.
3314 * if seg contains a RST, then drop the connection.
3315 * if seg does not contain SYN, then drop it.
3316 * Otherwise this is an acceptable SYN segment
3317 * initialize tp->rcv_nxt and tp->irs
3318 * if seg contains ack then advance tp->snd_una
3319 * if SYN has been acked change to ESTABLISHED else SYN_RCVD state
3320 * arrange for segment to be acked (eventually)
3321 * continue processing rest of data/controls, beginning with URG
3322 */
3323 case TCPS_SYN_SENT:
3324 if ((thflags & TH_ACK) &&
3325 (SEQ_LEQ(th->th_ack, tp->iss) ||
3326 SEQ_GT(th->th_ack, tp->snd_max))) {
3327 rstreason = BANDLIM_UNLIMITED;
3328 IF_TCP_STATINC(ifp, ooopacket);
3329 goto dropwithreset;
3330 }
3331 if (thflags & TH_RST) {
3332 if ((thflags & TH_ACK) != 0) {
3333 if (tfo_enabled(tp))
3334 tcp_heuristic_tfo_rst(tp);
3335 if ((tp->ecn_flags & (TE_SETUPSENT | TE_RCVD_SYN_RST)) == TE_SETUPSENT) {
3336 /*
3337 * On local connections, send
3338 * non-ECN syn one time before
3339 * dropping the connection
3340 */
3341 if (tp->t_flags & TF_LOCAL) {
3342 tp->ecn_flags |= TE_RCVD_SYN_RST;
3343 goto drop;
3344 } else {
3345 tcp_heuristic_ecn_synrst(tp);
3346 }
3347 }
3348 soevent(so,
3349 (SO_FILT_HINT_LOCKED |
3350 SO_FILT_HINT_CONNRESET));
3351 tp = tcp_drop(tp, ECONNREFUSED);
3352 postevent(so, 0, EV_RESET);
3353 }
3354 goto drop;
3355 }
3356 if ((thflags & TH_SYN) == 0)
3357 goto drop;
3358 tp->snd_wnd = th->th_win; /* initial send window */
3359 tp->max_sndwnd = tp->snd_wnd;
3360
3361 tp->irs = th->th_seq;
3362 tcp_rcvseqinit(tp);
3363 if (thflags & TH_ACK) {
3364 tcpstat.tcps_connects++;
3365
3366 if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE)) {
3367 /* ECN-setup SYN-ACK */
3368 tp->ecn_flags |= TE_SETUPRECEIVED;
3369 if (TCP_ECN_ENABLED(tp)) {
3370 tcp_heuristic_ecn_success(tp);
3371 tcpstat.tcps_ecn_client_success++;
3372 }
3373 } else {
3374 if (tp->ecn_flags & TE_SETUPSENT &&
3375 tp->t_rxtshift == 0) {
3376 tcp_heuristic_ecn_success(tp);
3377 tcpstat.tcps_ecn_not_supported++;
3378 }
3379 if (tp->ecn_flags & TE_SETUPSENT &&
3380 tp->t_rxtshift > 0)
3381 tcp_heuristic_ecn_loss(tp);
3382
3383 /* non-ECN-setup SYN-ACK */
3384 tp->ecn_flags &= ~TE_SENDIPECT;
3385 }
3386
3387#if CONFIG_MACF_NET && CONFIG_MACF_SOCKET
3388 /* XXXMAC: recursive lock: SOCK_LOCK(so); */
3389 mac_socketpeer_label_associate_mbuf(m, so);
3390 /* XXXMAC: SOCK_UNLOCK(so); */
3391#endif
3392 /* Do window scaling on this connection? */
3393 if (TCP_WINDOW_SCALE_ENABLED(tp)) {
3394 tp->snd_scale = tp->requested_s_scale;
3395 tp->rcv_scale = tp->request_r_scale;
3396 }
3397
3398 tp->rcv_adv += min(tp->rcv_wnd, TCP_MAXWIN << tp->rcv_scale);
3399 tp->snd_una++; /* SYN is acked */
3400 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
3401 tp->snd_nxt = tp->snd_una;
3402
3403 /*
3404 * We have sent more in the SYN than what is being
3405 * acked. (e.g., TFO)
3406 * We should restart the sending from what the receiver
3407 * has acknowledged immediately.
3408 */
3409 if (SEQ_GT(tp->snd_nxt, th->th_ack)) {
3410 /*
3411 * rdar://problem/33214601
3412 * There is a middlebox that acks all but one
3413 * byte and still drops the data.
3414 */
3415 if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) &&
3416 tp->snd_max == th->th_ack + 1 &&
3417 tp->snd_max > tp->snd_una + 1) {
3418 tcp_heuristic_tfo_middlebox(tp);
3419
3420 so->so_error = ENODATA;
3421
3422 tp->t_tfo_stats |= TFO_S_ONE_BYTE_PROXY;
3423 }
3424
3425 tp->snd_max = tp->snd_nxt = th->th_ack;
3426 }
3427
3428 /*
3429 * If there's data, delay ACK; if there's also a FIN
3430 * ACKNOW will be turned on later.
3431 */
3432 TCP_INC_VAR(tp->t_unacksegs, nlropkts);
3433 if (DELAY_ACK(tp, th) && tlen != 0 ) {
3434 if ((tp->t_flags & TF_DELACK) == 0) {
3435 tp->t_flags |= TF_DELACK;
3436 tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack);
3437 }
3438 }
3439 else {
3440 tp->t_flags |= TF_ACKNOW;
3441 }
3442 /*
3443 * Received <SYN,ACK> in SYN_SENT[*] state.
3444 * Transitions:
3445 * SYN_SENT --> ESTABLISHED
3446 * SYN_SENT* --> FIN_WAIT_1
3447 */
3448 tp->t_starttime = tcp_now;
3449 tcp_sbrcv_tstmp_check(tp);
3450 if (tp->t_flags & TF_NEEDFIN) {
3451 DTRACE_TCP4(state__change, void, NULL,
3452 struct inpcb *, inp,
3453 struct tcpcb *, tp, int32_t,
3454 TCPS_FIN_WAIT_1);
3455 tp->t_state = TCPS_FIN_WAIT_1;
3456 tp->t_flags &= ~TF_NEEDFIN;
3457 thflags &= ~TH_SYN;
3458 } else {
3459 DTRACE_TCP4(state__change, void, NULL,
3460 struct inpcb *, inp, struct tcpcb *,
3461 tp, int32_t, TCPS_ESTABLISHED);
3462 tp->t_state = TCPS_ESTABLISHED;
3463 tp->t_timer[TCPT_KEEP] =
3464 OFFSET_FROM_START(tp,
3465 TCP_CONN_KEEPIDLE(tp));
3466 if (nstat_collect)
3467 nstat_route_connect_success(
3468 inp->inp_route.ro_rt);
3469 /*
3470 * The SYN is acknowledged but una is not
3471 * updated yet. So pass the value of
3472 * ack to compute sndbytes correctly
3473 */
3474 inp_count_sndbytes(inp, th->th_ack);
3475 }
3476#if MPTCP
3477 /*
3478 * Do not send the connect notification for additional
3479 * subflows until ACK for 3-way handshake arrives.
3480 */
3481 if ((!(tp->t_mpflags & TMPF_MPTCP_TRUE)) &&
3482 (tp->t_mpflags & TMPF_SENT_JOIN)) {
3483 isconnected = FALSE;
3484 } else
3485#endif /* MPTCP */
3486 isconnected = TRUE;
3487
3488 if ((tp->t_tfo_flags & (TFO_F_COOKIE_REQ | TFO_F_COOKIE_SENT)) ||
3489 (tp->t_tfo_stats & TFO_S_SYN_DATA_SENT)) {
3490 tcp_tfo_synack(tp, &to);
3491
3492 if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) &&
3493 SEQ_LT(tp->snd_una, th->th_ack)) {
3494 tp->t_tfo_stats |= TFO_S_SYN_DATA_ACKED;
3495 tcpstat.tcps_tfo_syn_data_acked++;
3496#if MPTCP
3497 if (so->so_flags & SOF_MP_SUBFLOW)
3498 so->so_flags1 |= SOF1_TFO_REWIND;
3499#endif
3500 tcp_tfo_rcv_probe(tp, tlen);
3501 }
3502 }
3503 } else {
3504 /*
3505 * Received initial SYN in SYN-SENT[*] state => simul-
3506 * taneous open. If segment contains CC option and there is
3507 * a cached CC, apply TAO test; if it succeeds, connection is
3508 * half-synchronized. Otherwise, do 3-way handshake:
3509 * SYN-SENT -> SYN-RECEIVED
3510 * SYN-SENT* -> SYN-RECEIVED*
3511 */
3512 tp->t_flags |= TF_ACKNOW;
3513 tp->t_timer[TCPT_REXMT] = 0;
3514 DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp,
3515 struct tcpcb *, tp, int32_t, TCPS_SYN_RECEIVED);
3516 tp->t_state = TCPS_SYN_RECEIVED;
3517
3518 /*
3519 * During simultaneous open, TFO should not be used.
3520 * So, we disable it here, to prevent that data gets
3521 * sent on the SYN/ACK.
3522 */
3523 tcp_disable_tfo(tp);
3524 }
3525
3526trimthenstep6:
3527 /*
3528 * Advance th->th_seq to correspond to first data byte.
3529 * If data, trim to stay within window,
3530 * dropping FIN if necessary.
3531 */
3532 th->th_seq++;
3533 if (tlen > tp->rcv_wnd) {
3534 todrop = tlen - tp->rcv_wnd;
3535 m_adj(m, -todrop);
3536 tlen = tp->rcv_wnd;
3537 thflags &= ~TH_FIN;
3538 tcpstat.tcps_rcvpackafterwin++;
3539 tcpstat.tcps_rcvbyteafterwin += todrop;
3540 }
3541 tp->snd_wl1 = th->th_seq - 1;
3542 tp->rcv_up = th->th_seq;
3543 /*
3544 * Client side of transaction: already sent SYN and data.
3545 * If the remote host used T/TCP to validate the SYN,
3546 * our data will be ACK'd; if so, enter normal data segment
3547 * processing in the middle of step 5, ack processing.
3548 * Otherwise, goto step 6.
3549 */
3550 if (thflags & TH_ACK)
3551 goto process_ACK;
3552 goto step6;
3553 /*
3554 * If the state is LAST_ACK or CLOSING or TIME_WAIT:
3555 * do normal processing.
3556 *
3557 * NB: Leftover from RFC1644 T/TCP. Cases to be reused later.
3558 */
3559 case TCPS_LAST_ACK:
3560 case TCPS_CLOSING:
3561 case TCPS_TIME_WAIT:
3562 break; /* continue normal processing */
3563
3564 /* Received a SYN while connection is already established.
3565 * This is a "half open connection and other anomalies" described
3566 * in RFC793 page 34, send an ACK so the remote reset the connection
3567 * or recovers by adjusting its sequence numbering. Sending an ACK is
3568 * in accordance with RFC 5961 Section 4.2
3569 */
3570 case TCPS_ESTABLISHED:
3571 if (thflags & TH_SYN) {
3572 /* Drop the packet silently if we have reached the limit */
3573 if (tcp_do_rfc5961 && tcp_is_ack_ratelimited(tp)) {
3574 goto drop;
3575 } else {
3576 /* Send challenge ACK */
3577 tcpstat.tcps_synchallenge++;
3578 goto dropafterack;
3579 }
3580 }
3581 break;
3582 }
3583
3584 /*
3585 * States other than LISTEN or SYN_SENT.
3586 * First check the RST flag and sequence number since reset segments
3587 * are exempt from the timestamp and connection count tests. This
3588 * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix
3589 * below which allowed reset segments in half the sequence space
3590 * to fall though and be processed (which gives forged reset
3591 * segments with a random sequence number a 50 percent chance of
3592 * killing a connection).
3593 * Then check timestamp, if present.
3594 * Then check the connection count, if present.
3595 * Then check that at least some bytes of segment are within
3596 * receive window. If segment begins before rcv_nxt,
3597 * drop leading data (and SYN); if nothing left, just ack.
3598 *
3599 *
3600 * If the RST bit is set, check the sequence number to see
3601 * if this is a valid reset segment.
3602 * RFC 793 page 37:
3603 * In all states except SYN-SENT, all reset (RST) segments
3604 * are validated by checking their SEQ-fields. A reset is
3605 * valid if its sequence number is in the window.
3606 * Note: this does not take into account delayed ACKs, so
3607 * we should test against last_ack_sent instead of rcv_nxt.
3608 * The sequence number in the reset segment is normally an
3609 * echo of our outgoing acknowlegement numbers, but some hosts
3610 * send a reset with the sequence number at the rightmost edge
3611 * of our receive window, and we have to handle this case.
3612 * Note 2: Paul Watson's paper "Slipping in the Window" has shown
3613 * that brute force RST attacks are possible. To combat this,
3614 * we use a much stricter check while in the ESTABLISHED state,
3615 * only accepting RSTs where the sequence number is equal to
3616 * last_ack_sent. In all other states (the states in which a
3617 * RST is more likely), the more permissive check is used.
3618 * RFC 5961 Section 3.2: if the RST bit is set, sequence # is
3619 * within the receive window and last_ack_sent == seq,
3620 * then reset the connection. Otherwise if the seq doesn't
3621 * match last_ack_sent, TCP must send challenge ACK. Perform
3622 * rate limitation when sending the challenge ACK.
3623 * If we have multiple segments in flight, the intial reset
3624 * segment sequence numbers will be to the left of last_ack_sent,
3625 * but they will eventually catch up.
3626 * In any case, it never made sense to trim reset segments to
3627 * fit the receive window since RFC 1122 says:
3628 * 4.2.2.12 RST Segment: RFC-793 Section 3.4
3629 *
3630 * A TCP SHOULD allow a received RST segment to include data.
3631 *
3632 * DISCUSSION
3633 * It has been suggested that a RST segment could contain
3634 * ASCII text that encoded and explained the cause of the
3635 * RST. No standard has yet been established for such
3636 * data.
3637 *
3638 * If the reset segment passes the sequence number test examine
3639 * the state:
3640 * SYN_RECEIVED STATE:
3641 * If passive open, return to LISTEN state.
3642 * If active open, inform user that connection was refused.
3643 * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES:
3644 * Inform user that connection was reset, and close tcb.
3645 * CLOSING, LAST_ACK STATES:
3646 * Close the tcb.
3647 * TIME_WAIT STATE:
3648 * Drop the segment - see Stevens, vol. 2, p. 964 and
3649 * RFC 1337.
3650 *
3651 * Radar 4803931: Allows for the case where we ACKed the FIN but
3652 * there is already a RST in flight from the peer.
3653 * In that case, accept the RST for non-established
3654 * state if it's one off from last_ack_sent.
3655
3656 */
3657 if (thflags & TH_RST) {
3658 if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) &&
3659 SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) ||
3660 (tp->rcv_wnd == 0 &&
3661 ((tp->last_ack_sent == th->th_seq) ||
3662 ((tp->last_ack_sent -1) == th->th_seq)))) {
3663 if (tcp_do_rfc5961 == 0 || tp->last_ack_sent == th->th_seq) {
3664 switch (tp->t_state) {
3665
3666 case TCPS_SYN_RECEIVED:
3667 IF_TCP_STATINC(ifp, rstinsynrcv);
3668 so->so_error = ECONNREFUSED;
3669 goto close;
3670
3671 case TCPS_ESTABLISHED:
3672 if (tcp_do_rfc5961 == 0 && tp->last_ack_sent != th->th_seq) {
3673 tcpstat.tcps_badrst++;
3674 goto drop;
3675 }
3676 if (TCP_ECN_ENABLED(tp) &&
3677 tp->snd_una == tp->iss + 1 &&
3678 SEQ_GT(tp->snd_max, tp->snd_una)) {
3679 /*
3680 * If the first data packet on an
3681 * ECN connection, receives a RST
3682 * increment the heuristic
3683 */
3684 tcp_heuristic_ecn_droprst(tp);
3685 }
3686 case TCPS_FIN_WAIT_1:
3687 case TCPS_CLOSE_WAIT:
3688 /*
3689 Drop through ...
3690 */
3691 case TCPS_FIN_WAIT_2:
3692 so->so_error = ECONNRESET;
3693 close:
3694 postevent(so, 0, EV_RESET);
3695 soevent(so,
3696 (SO_FILT_HINT_LOCKED |
3697 SO_FILT_HINT_CONNRESET));
3698
3699 tcpstat.tcps_drops++;
3700 tp = tcp_close(tp);
3701 break;
3702
3703 case TCPS_CLOSING:
3704 case TCPS_LAST_ACK:
3705 tp = tcp_close(tp);
3706 break;
3707
3708 case TCPS_TIME_WAIT:
3709 break;
3710 }
3711 } else if (tcp_do_rfc5961) {
3712 tcpstat.tcps_badrst++;
3713 /* Drop if we have reached the ACK limit */
3714 if (tcp_is_ack_ratelimited(tp)) {
3715 goto drop;
3716 } else {
3717 /* Send challenge ACK */
3718 tcpstat.tcps_rstchallenge++;
3719 goto dropafterack;
3720 }
3721 }
3722 }
3723 goto drop;
3724 }
3725
3726 /*
3727 * RFC 1323 PAWS: If we have a timestamp reply on this segment
3728 * and it's less than ts_recent, drop it.
3729 */
3730 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
3731 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
3732
3733 /* Check to see if ts_recent is over 24 days old. */
3734 if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) {
3735 /*
3736 * Invalidate ts_recent. If this segment updates
3737 * ts_recent, the age will be reset later and ts_recent
3738 * will get a valid value. If it does not, setting
3739 * ts_recent to zero will at least satisfy the
3740 * requirement that zero be placed in the timestamp
3741 * echo reply when ts_recent isn't valid. The
3742 * age isn't reset until we get a valid ts_recent
3743 * because we don't want out-of-order segments to be
3744 * dropped when ts_recent is old.
3745 */
3746 tp->ts_recent = 0;
3747 } else {
3748 tcpstat.tcps_rcvduppack++;
3749 tcpstat.tcps_rcvdupbyte += tlen;
3750 tp->t_pawsdrop++;
3751 tcpstat.tcps_pawsdrop++;
3752
3753 /*
3754 * PAWS-drop when ECN is being used? That indicates
3755 * that ECT-marked packets take a different path, with
3756 * different congestion-characteristics.
3757 *
3758 * Only fallback when we did send less than 2GB as PAWS
3759 * really has no reason to kick in earlier.
3760 */
3761 if (TCP_ECN_ENABLED(tp) &&
3762 inp->inp_stat->rxbytes < 2147483648) {
3763 INP_INC_IFNET_STAT(inp, ecn_fallback_reorder);
3764 tcpstat.tcps_ecn_fallback_reorder++;
3765 tcp_heuristic_ecn_aggressive(tp);
3766 }
3767
3768 if (nstat_collect) {
3769 nstat_route_rx(tp->t_inpcb->inp_route.ro_rt,
3770 1, tlen, NSTAT_RX_FLAG_DUPLICATE);
3771 INP_ADD_STAT(inp, cell, wifi, wired,
3772 rxpackets, 1);
3773 INP_ADD_STAT(inp, cell, wifi, wired,
3774 rxbytes, tlen);
3775 tp->t_stat.rxduplicatebytes += tlen;
3776 inp_set_activity_bitmap(inp);
3777 }
3778 if (tlen > 0)
3779 goto dropafterack;
3780 goto drop;
3781 }
3782 }
3783
3784 /*
3785 * In the SYN-RECEIVED state, validate that the packet belongs to
3786 * this connection before trimming the data to fit the receive
3787 * window. Check the sequence number versus IRS since we know
3788 * the sequence numbers haven't wrapped. This is a partial fix
3789 * for the "LAND" DoS attack.
3790 */
3791 if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) {
3792 rstreason = BANDLIM_RST_OPENPORT;
3793 IF_TCP_STATINC(ifp, dospacket);
3794 goto dropwithreset;
3795 }
3796
3797 /*
3798 * Check if there is old data at the beginning of the window
3799 * i.e. the sequence number is before rcv_nxt
3800 */
3801 todrop = tp->rcv_nxt - th->th_seq;
3802 if (todrop > 0) {
3803 boolean_t is_syn_set = FALSE;
3804
3805 if (thflags & TH_SYN) {
3806 is_syn_set = TRUE;
3807 thflags &= ~TH_SYN;
3808 th->th_seq++;
3809 if (th->th_urp > 1)
3810 th->th_urp--;
3811 else
3812 thflags &= ~TH_URG;
3813 todrop--;
3814 }
3815 /*
3816 * Following if statement from Stevens, vol. 2, p. 960.
3817 * The amount of duplicate data is greater than or equal
3818 * to the size of the segment - entire segment is duplicate
3819 */
3820 if (todrop > tlen
3821 || (todrop == tlen && (thflags & TH_FIN) == 0)) {
3822 /*
3823 * Any valid FIN must be to the left of the window.
3824 * At this point the FIN must be a duplicate or out
3825 * of sequence; drop it.
3826 */
3827 thflags &= ~TH_FIN;
3828
3829 /*
3830 * Send an ACK to resynchronize and drop any data.
3831 * But keep on processing for RST or ACK.
3832 *
3833 * If the SYN bit was originally set, then only send
3834 * an ACK if we are not rate-limiting this connection.
3835 */
3836 if (tcp_do_rfc5961 && is_syn_set) {
3837 if (!tcp_is_ack_ratelimited(tp)) {
3838 tcpstat.tcps_synchallenge++;
3839 tp->t_flags |= TF_ACKNOW;
3840 }
3841 } else {
3842 tp->t_flags |= TF_ACKNOW;
3843 }
3844
3845 if (todrop == 1) {
3846 /* This could be a keepalive */
3847 soevent(so, SO_FILT_HINT_LOCKED |
3848 SO_FILT_HINT_KEEPALIVE);
3849 }
3850 todrop = tlen;
3851 tcpstat.tcps_rcvduppack++;
3852 tcpstat.tcps_rcvdupbyte += todrop;
3853 } else {
3854 tcpstat.tcps_rcvpartduppack++;
3855 tcpstat.tcps_rcvpartdupbyte += todrop;
3856 }
3857
3858 if (TCP_DSACK_ENABLED(tp) && todrop > 1) {
3859 /*
3860 * Note the duplicate data sequence space so that
3861 * it can be reported in DSACK option.
3862 */
3863 tp->t_dsack_lseq = th->th_seq;
3864 tp->t_dsack_rseq = th->th_seq + todrop;
3865 tp->t_flags |= TF_ACKNOW;
3866 }
3867 if (nstat_collect) {
3868 nstat_route_rx(tp->t_inpcb->inp_route.ro_rt, 1,
3869 todrop, NSTAT_RX_FLAG_DUPLICATE);
3870 INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1);
3871 INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, todrop);
3872 tp->t_stat.rxduplicatebytes += todrop;
3873 inp_set_activity_bitmap(inp);
3874 }
3875 drop_hdrlen += todrop; /* drop from the top afterwards */
3876 th->th_seq += todrop;
3877 tlen -= todrop;
3878 if (th->th_urp > todrop)
3879 th->th_urp -= todrop;
3880 else {
3881 thflags &= ~TH_URG;
3882 th->th_urp = 0;
3883 }
3884 }
3885
3886 /*
3887 * If new data are received on a connection after the user
3888 * processes are gone, then RST the other end.
3889 * Send also a RST when we received a data segment after we've
3890 * sent our FIN when the socket is defunct.
3891 * Note that an MPTCP subflow socket would have SS_NOFDREF set
3892 * by default. So, if it's an MPTCP-subflow we rather check the
3893 * MPTCP-level's socket state for SS_NOFDREF.
3894 */
3895 if (tlen) {
3896 boolean_t close_it = FALSE;
3897
3898 if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF) &&
3899 tp->t_state > TCPS_CLOSE_WAIT)
3900 close_it = TRUE;
3901
3902 if ((so->so_flags & SOF_MP_SUBFLOW) && (mptetoso(tptomptp(tp)->mpt_mpte)->so_state & SS_NOFDREF) &&
3903 tp->t_state > TCPS_CLOSE_WAIT)
3904 close_it = TRUE;
3905
3906 if ((so->so_flags & SOF_DEFUNCT) && tp->t_state > TCPS_FIN_WAIT_1)
3907 close_it = TRUE;
3908
3909 if (close_it) {
3910 tp = tcp_close(tp);
3911 tcpstat.tcps_rcvafterclose++;
3912 rstreason = BANDLIM_UNLIMITED;
3913 IF_TCP_STATINC(ifp, cleanup);
3914 goto dropwithreset;
3915 }
3916 }
3917
3918 /*
3919 * If segment ends after window, drop trailing data
3920 * (and PUSH and FIN); if nothing left, just ACK.
3921 */
3922 todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd);
3923 if (todrop > 0) {
3924 tcpstat.tcps_rcvpackafterwin++;
3925 if (todrop >= tlen) {
3926 tcpstat.tcps_rcvbyteafterwin += tlen;
3927 /*
3928 * If a new connection request is received
3929 * while in TIME_WAIT, drop the old connection
3930 * and start over if the sequence numbers
3931 * are above the previous ones.
3932 */
3933 if (thflags & TH_SYN &&
3934 tp->t_state == TCPS_TIME_WAIT &&
3935 SEQ_GT(th->th_seq, tp->rcv_nxt)) {
3936 iss = tcp_new_isn(tp);
3937 tp = tcp_close(tp);
3938 socket_unlock(so, 1);
3939 goto findpcb;
3940 }
3941 /*
3942 * If window is closed can only take segments at
3943 * window edge, and have to drop data and PUSH from
3944 * incoming segments. Continue processing, but
3945 * remember to ack. Otherwise, drop segment
3946 * and ack.
3947 */
3948 if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) {
3949 tp->t_flags |= TF_ACKNOW;
3950 tcpstat.tcps_rcvwinprobe++;
3951 } else
3952 goto dropafterack;
3953 } else
3954 tcpstat.tcps_rcvbyteafterwin += todrop;
3955 m_adj(m, -todrop);
3956 tlen -= todrop;
3957 thflags &= ~(TH_PUSH|TH_FIN);
3958 }
3959
3960 /*
3961 * If last ACK falls within this segment's sequence numbers,
3962 * record its timestamp.
3963 * NOTE:
3964 * 1) That the test incorporates suggestions from the latest
3965 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
3966 * 2) That updating only on newer timestamps interferes with
3967 * our earlier PAWS tests, so this check should be solely
3968 * predicated on the sequence space of this segment.
3969 * 3) That we modify the segment boundary check to be
3970 * Last.ACK.Sent <= SEG.SEQ + SEG.Len
3971 * instead of RFC1323's
3972 * Last.ACK.Sent < SEG.SEQ + SEG.Len,
3973 * This modified check allows us to overcome RFC1323's
3974 * limitations as described in Stevens TCP/IP Illustrated
3975 * Vol. 2 p.869. In such cases, we can still calculate the
3976 * RTT correctly when RCV.NXT == Last.ACK.Sent.
3977 */
3978 if ((to.to_flags & TOF_TS) != 0 &&
3979 SEQ_LEQ(th->th_seq, tp->last_ack_sent) &&
3980 SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen +
3981 ((thflags & (TH_SYN|TH_FIN)) != 0))) {
3982 tp->ts_recent_age = tcp_now;
3983 tp->ts_recent = to.to_tsval;
3984 }
3985
3986 /*
3987 * Stevens: If a SYN is in the window, then this is an
3988 * error and we send an RST and drop the connection.
3989 *
3990 * RFC 5961 Section 4.2
3991 * Send challenge ACK for any SYN in synchronized state
3992 * Perform rate limitation in doing so.
3993 */
3994 if (thflags & TH_SYN) {
3995 if (tcp_do_rfc5961) {
3996 tcpstat.tcps_badsyn++;
3997 /* Drop if we have reached ACK limit */
3998 if (tcp_is_ack_ratelimited(tp)) {
3999 goto drop;
4000 } else {
4001 /* Send challenge ACK */
4002 tcpstat.tcps_synchallenge++;
4003 goto dropafterack;
4004 }
4005 } else {
4006 tp = tcp_drop(tp, ECONNRESET);
4007 rstreason = BANDLIM_UNLIMITED;
4008 postevent(so, 0, EV_RESET);
4009 IF_TCP_STATINC(ifp, synwindow);
4010 goto dropwithreset;
4011 }
4012 }
4013
4014 /*
4015 * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN
4016 * flag is on (half-synchronized state), then queue data for
4017 * later processing; else drop segment and return.
4018 */
4019 if ((thflags & TH_ACK) == 0) {
4020 if (tp->t_state == TCPS_SYN_RECEIVED ||
4021 (tp->t_flags & TF_NEEDSYN)) {
4022 if ((tfo_enabled(tp))) {
4023 /*
4024 * So, we received a valid segment while in
4025 * SYN-RECEIVED (TF_NEEDSYN is actually never
4026 * set, so this is dead code).
4027 * As this cannot be an RST (see that if a bit
4028 * higher), and it does not have the ACK-flag
4029 * set, we want to retransmit the SYN/ACK.
4030 * Thus, we have to reset snd_nxt to snd_una to
4031 * trigger the going back to sending of the
4032 * SYN/ACK. This is more consistent with the
4033 * behavior of tcp_output(), which expects
4034 * to send the segment that is pointed to by
4035 * snd_nxt.
4036 */
4037 tp->snd_nxt = tp->snd_una;
4038
4039 /*
4040 * We need to make absolutely sure that we are
4041 * going to reply upon a duplicate SYN-segment.
4042 */
4043 if (th->th_flags & TH_SYN)
4044 needoutput = 1;
4045 }
4046
4047 goto step6;
4048 } else if (tp->t_flags & TF_ACKNOW)
4049 goto dropafterack;
4050 else
4051 goto drop;
4052 }
4053
4054 /*
4055 * Ack processing.
4056 */
4057
4058 switch (tp->t_state) {
4059
4060 /*
4061 * In SYN_RECEIVED state, the ack ACKs our SYN, so enter
4062 * ESTABLISHED state and continue processing.
4063 * The ACK was checked above.
4064 */
4065 case TCPS_SYN_RECEIVED:
4066
4067 tcpstat.tcps_connects++;
4068
4069 /* Do window scaling? */
4070 if (TCP_WINDOW_SCALE_ENABLED(tp)) {
4071 tp->snd_scale = tp->requested_s_scale;
4072 tp->rcv_scale = tp->request_r_scale;
4073 tp->snd_wnd = th->th_win << tp->snd_scale;
4074 tp->max_sndwnd = tp->snd_wnd;
4075 tiwin = tp->snd_wnd;
4076 }
4077 /*
4078 * Make transitions:
4079 * SYN-RECEIVED -> ESTABLISHED
4080 * SYN-RECEIVED* -> FIN-WAIT-1
4081 */
4082 tp->t_starttime = tcp_now;
4083 tcp_sbrcv_tstmp_check(tp);
4084 if (tp->t_flags & TF_NEEDFIN) {
4085 DTRACE_TCP4(state__change, void, NULL,
4086 struct inpcb *, inp,
4087 struct tcpcb *, tp, int32_t, TCPS_FIN_WAIT_1);
4088 tp->t_state = TCPS_FIN_WAIT_1;
4089 tp->t_flags &= ~TF_NEEDFIN;
4090 } else {
4091 DTRACE_TCP4(state__change, void, NULL,
4092 struct inpcb *, inp,
4093 struct tcpcb *, tp, int32_t, TCPS_ESTABLISHED);
4094 tp->t_state = TCPS_ESTABLISHED;
4095 tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp,
4096 TCP_CONN_KEEPIDLE(tp));
4097 if (nstat_collect)
4098 nstat_route_connect_success(
4099 tp->t_inpcb->inp_route.ro_rt);
4100 /*
4101 * The SYN is acknowledged but una is not updated
4102 * yet. So pass the value of ack to compute
4103 * sndbytes correctly
4104 */
4105 inp_count_sndbytes(inp, th->th_ack);
4106 }
4107 /*
4108 * If segment contains data or ACK, will call tcp_reass()
4109 * later; if not, do so now to pass queued data to user.
4110 */
4111 if (tlen == 0 && (thflags & TH_FIN) == 0)
4112 (void) tcp_reass(tp, (struct tcphdr *)0, &tlen,
4113 NULL, ifp);
4114 tp->snd_wl1 = th->th_seq - 1;
4115
4116#if MPTCP
4117 /*
4118 * Do not send the connect notification for additional subflows
4119 * until ACK for 3-way handshake arrives.
4120 */
4121 if ((!(tp->t_mpflags & TMPF_MPTCP_TRUE)) &&
4122 (tp->t_mpflags & TMPF_SENT_JOIN)) {
4123 isconnected = FALSE;
4124 } else
4125#endif /* MPTCP */
4126 isconnected = TRUE;
4127 if ((tp->t_tfo_flags & TFO_F_COOKIE_VALID)) {
4128 /* Done this when receiving the SYN */
4129 isconnected = FALSE;
4130
4131 OSDecrementAtomic(&tcp_tfo_halfcnt);
4132
4133 /* Panic if something has gone terribly wrong. */
4134 VERIFY(tcp_tfo_halfcnt >= 0);
4135
4136 tp->t_tfo_flags &= ~TFO_F_COOKIE_VALID;
4137 }
4138
4139 /*
4140 * In case there is data in the send-queue (e.g., TFO is being
4141 * used, or connectx+data has been done), then if we would
4142 * "FALLTHROUGH", we would handle this ACK as if data has been
4143 * acknowledged. But, we have to prevent this. And this
4144 * can be prevented by increasing snd_una by 1, so that the
4145 * SYN is not considered as data (snd_una++ is actually also
4146 * done in SYN_SENT-state as part of the regular TCP stack).
4147 *
4148 * In case there is data on this ack as well, the data will be
4149 * handled by the label "dodata" right after step6.
4150 */
4151 if (so->so_snd.sb_cc) {
4152 tp->snd_una++; /* SYN is acked */
4153 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
4154 tp->snd_nxt = tp->snd_una;
4155
4156 /*
4157 * No duplicate-ACK handling is needed. So, we
4158 * directly advance to processing the ACK (aka,
4159 * updating the RTT estimation,...)
4160 *
4161 * But, we first need to handle eventual SACKs,
4162 * because TFO will start sending data with the
4163 * SYN/ACK, so it might be that the client
4164 * includes a SACK with its ACK.
4165 */
4166 if (SACK_ENABLED(tp) &&
4167 (to.to_nsacks > 0 ||
4168 !TAILQ_EMPTY(&tp->snd_holes)))
4169 tcp_sack_doack(tp, &to, th,
4170 &sack_bytes_acked);
4171
4172 goto process_ACK;
4173 }
4174
4175 /* FALLTHROUGH */
4176
4177 /*
4178 * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
4179 * ACKs. If the ack is in the range
4180 * tp->snd_una < th->th_ack <= tp->snd_max
4181 * then advance tp->snd_una to th->th_ack and drop
4182 * data from the retransmission queue. If this ACK reflects
4183 * more up to date window information we update our window information.
4184 */
4185 case TCPS_ESTABLISHED:
4186 case TCPS_FIN_WAIT_1:
4187 case TCPS_FIN_WAIT_2:
4188 case TCPS_CLOSE_WAIT:
4189 case TCPS_CLOSING:
4190 case TCPS_LAST_ACK:
4191 case TCPS_TIME_WAIT:
4192 if (SEQ_GT(th->th_ack, tp->snd_max)) {
4193 tcpstat.tcps_rcvacktoomuch++;
4194 if (tcp_do_rfc5961 && tcp_is_ack_ratelimited(tp)) {
4195 goto drop;
4196 } else {
4197 goto dropafterack;
4198 }
4199 }
4200 if (tcp_do_rfc5961 && SEQ_LT(th->th_ack, tp->snd_una - tp->max_sndwnd)) {
4201 if (tcp_is_ack_ratelimited(tp)) {
4202 goto drop;
4203 } else {
4204 goto dropafterack;
4205 }
4206 }
4207 if (SACK_ENABLED(tp) && to.to_nsacks > 0) {
4208 recvd_dsack = tcp_sack_process_dsack(tp, &to, th);
4209 /*
4210 * If DSACK is received and this packet has no
4211 * other SACK information, it can be dropped.
4212 * We do not want to treat it as a duplicate ack.
4213 */
4214 if (recvd_dsack &&
4215 SEQ_LEQ(th->th_ack, tp->snd_una) &&
4216 to.to_nsacks == 0) {
4217 tcp_bad_rexmt_check(tp, th, &to);
4218 goto drop;
4219 }
4220 }
4221
4222 if (SACK_ENABLED(tp) &&
4223 (to.to_nsacks > 0 || !TAILQ_EMPTY(&tp->snd_holes)))
4224 tcp_sack_doack(tp, &to, th, &sack_bytes_acked);
4225
4226#if MPTCP
4227 if (tp->t_mpuna && SEQ_GEQ(th->th_ack, tp->t_mpuna)) {
4228 if (tp->t_mpflags & TMPF_PREESTABLISHED) {
4229 /* MP TCP establishment succeeded */
4230 tp->t_mpuna = 0;
4231 if (tp->t_mpflags & TMPF_JOINED_FLOW) {
4232 if (tp->t_mpflags & TMPF_SENT_JOIN) {
4233 tp->t_mpflags &=
4234 ~TMPF_PREESTABLISHED;
4235 tp->t_mpflags |=
4236 TMPF_MPTCP_TRUE;
4237 mptcplog((LOG_DEBUG, "MPTCP "
4238 "Sockets: %s \n",__func__),
4239 MPTCP_SOCKET_DBG,
4240 MPTCP_LOGLVL_LOG);
4241
4242 tp->t_timer[TCPT_JACK_RXMT] = 0;
4243 tp->t_mprxtshift = 0;
4244 isconnected = TRUE;
4245 } else {
4246 isconnected = FALSE;
4247 }
4248 } else {
4249 isconnected = TRUE;
4250 }
4251 }
4252 }
4253#endif /* MPTCP */
4254
4255 tcp_tfo_rcv_ack(tp, th);
4256
4257 /*
4258 * If we have outstanding data (other than
4259 * a window probe), this is a completely
4260 * duplicate ack and the ack is the biggest we've seen.
4261 *
4262 * Need to accommodate a change in window on duplicate acks
4263 * to allow operating systems that update window during
4264 * recovery with SACK
4265 */
4266 if (SEQ_LEQ(th->th_ack, tp->snd_una)) {
4267 if (tlen == 0 && (tiwin == tp->snd_wnd ||
4268 (to.to_nsacks > 0 && sack_bytes_acked > 0))) {
4269 /*
4270 * If both ends send FIN at the same time,
4271 * then the ack will be a duplicate ack
4272 * but we have to process the FIN. Check
4273 * for this condition and process the FIN
4274 * instead of the dupack
4275 */
4276 if ((thflags & TH_FIN) &&
4277 !TCPS_HAVERCVDFIN(tp->t_state))
4278 break;
4279process_dupack:
4280#if MPTCP
4281 /*
4282 * MPTCP options that are ignored must
4283 * not be treated as duplicate ACKs.
4284 */
4285 if (to.to_flags & TOF_MPTCP) {
4286 goto drop;
4287 }
4288
4289 if ((isconnected) && (tp->t_mpflags & TMPF_JOINED_FLOW)) {
4290 mptcplog((LOG_DEBUG, "MPTCP "
4291 "Sockets: bypass ack recovery\n"),
4292 MPTCP_SOCKET_DBG,
4293 MPTCP_LOGLVL_VERBOSE);
4294 break;
4295 }
4296#endif /* MPTCP */
4297 /*
4298 * If a duplicate acknowledgement was seen
4299 * after ECN, it indicates packet loss in
4300 * addition to ECN. Reset INRECOVERY flag
4301 * so that we can process partial acks
4302 * correctly
4303 */
4304 if (tp->ecn_flags & TE_INRECOVERY)
4305 tp->ecn_flags &= ~TE_INRECOVERY;
4306
4307 tcpstat.tcps_rcvdupack++;
4308 ++tp->t_dupacks;
4309
4310 /*
4311 * Check if we need to reset the limit on
4312 * early retransmit
4313 */
4314 if (tp->t_early_rexmt_count > 0 &&
4315 TSTMP_GEQ(tcp_now,
4316 (tp->t_early_rexmt_win +
4317 TCP_EARLY_REXMT_WIN)))
4318 tp->t_early_rexmt_count = 0;
4319
4320 /*
4321 * Is early retransmit needed? We check for
4322 * this when the connection is waiting for
4323 * duplicate acks to enter fast recovery.
4324 */
4325 if (!IN_FASTRECOVERY(tp))
4326 tcp_early_rexmt_check(tp, th);
4327
4328 /*
4329 * If we've seen exactly rexmt threshold
4330 * of duplicate acks, assume a packet
4331 * has been dropped and retransmit it.
4332 * Kludge snd_nxt & the congestion
4333 * window so we send only this one
4334 * packet.
4335 *
4336 * We know we're losing at the current
4337 * window size so do congestion avoidance
4338 * (set ssthresh to half the current window
4339 * and pull our congestion window back to
4340 * the new ssthresh).
4341 *
4342 * Dup acks mean that packets have left the
4343 * network (they're now cached at the receiver)
4344 * so bump cwnd by the amount in the receiver
4345 * to keep a constant cwnd packets in the
4346 * network.
4347 */
4348 if (tp->t_timer[TCPT_REXMT] == 0 ||
4349 (th->th_ack != tp->snd_una
4350 && sack_bytes_acked == 0)) {
4351 tp->t_dupacks = 0;
4352 tp->t_rexmtthresh = tcprexmtthresh;
4353 } else if (tp->t_dupacks > tp->t_rexmtthresh ||
4354 IN_FASTRECOVERY(tp)) {
4355
4356 /*
4357 * If this connection was seeing packet
4358 * reordering, then recovery might be
4359 * delayed to disambiguate between
4360 * reordering and loss
4361 */
4362 if (SACK_ENABLED(tp) && !IN_FASTRECOVERY(tp) &&
4363 (tp->t_flagsext &
4364 (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) ==
4365 (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) {
4366 /*
4367 * Since the SACK information is already
4368 * updated, this ACK will be dropped
4369 */
4370 break;
4371 }
4372
4373 if (SACK_ENABLED(tp)
4374 && IN_FASTRECOVERY(tp)) {
4375 int awnd;
4376
4377 /*
4378 * Compute the amount of data in flight first.
4379 * We can inject new data into the pipe iff
4380 * we have less than 1/2 the original window's
4381 * worth of data in flight.
4382 */
4383 awnd = (tp->snd_nxt - tp->snd_fack) +
4384 tp->sackhint.sack_bytes_rexmit;
4385 if (awnd < tp->snd_ssthresh) {
4386 tp->snd_cwnd += tp->t_maxseg;
4387 if (tp->snd_cwnd > tp->snd_ssthresh)
4388 tp->snd_cwnd = tp->snd_ssthresh;
4389 }
4390 } else {
4391 tp->snd_cwnd += tp->t_maxseg;
4392 }
4393
4394 /* Process any window updates */
4395 if (tiwin > tp->snd_wnd)
4396 tcp_update_window(tp, thflags,
4397 th, tiwin, tlen);
4398 tcp_ccdbg_trace(tp, th,
4399 TCP_CC_IN_FASTRECOVERY);
4400
4401 (void) tcp_output(tp);
4402
4403 goto drop;
4404 } else if (tp->t_dupacks == tp->t_rexmtthresh) {
4405 tcp_seq onxt = tp->snd_nxt;
4406
4407 /*
4408 * If we're doing sack, check to
4409 * see if we're already in sack
4410 * recovery. If we're not doing sack,
4411 * check to see if we're in newreno
4412 * recovery.
4413 */
4414 if (SACK_ENABLED(tp)) {
4415 if (IN_FASTRECOVERY(tp)) {
4416 tp->t_dupacks = 0;
4417 break;
4418 } else if (tp->t_flagsext & TF_DELAY_RECOVERY) {
4419 break;
4420 }
4421 } else {
4422 if (SEQ_LEQ(th->th_ack,
4423 tp->snd_recover)) {
4424 tp->t_dupacks = 0;
4425 break;
4426 }
4427 }
4428 if (tp->t_flags & TF_SENTFIN)
4429 tp->snd_recover = tp->snd_max - 1;
4430 else
4431 tp->snd_recover = tp->snd_max;
4432 tp->t_timer[TCPT_PTO] = 0;
4433 tp->t_rtttime = 0;
4434
4435 /*
4436 * If the connection has seen pkt
4437 * reordering, delay recovery until
4438 * it is clear that the packet
4439 * was lost.
4440 */
4441 if (SACK_ENABLED(tp) &&
4442 (tp->t_flagsext &
4443 (TF_PKTS_REORDERED|TF_DELAY_RECOVERY))
4444 == TF_PKTS_REORDERED &&
4445 !IN_FASTRECOVERY(tp) &&
4446 tp->t_reorderwin > 0 &&
4447 (tp->t_state == TCPS_ESTABLISHED ||
4448 tp->t_state == TCPS_FIN_WAIT_1)) {
4449 tp->t_timer[TCPT_DELAYFR] =
4450 OFFSET_FROM_START(tp,
4451 tp->t_reorderwin);
4452 tp->t_flagsext |= TF_DELAY_RECOVERY;
4453 tcpstat.tcps_delay_recovery++;
4454 tcp_ccdbg_trace(tp, th,
4455 TCP_CC_DELAY_FASTRECOVERY);
4456 break;
4457 }
4458
4459 tcp_rexmt_save_state(tp);
4460 /*
4461 * If the current tcp cc module has
4462 * defined a hook for tasks to run
4463 * before entering FR, call it
4464 */
4465 if (CC_ALGO(tp)->pre_fr != NULL)
4466 CC_ALGO(tp)->pre_fr(tp);
4467 ENTER_FASTRECOVERY(tp);
4468 tp->t_timer[TCPT_REXMT] = 0;
4469 if (TCP_ECN_ENABLED(tp))
4470 tp->ecn_flags |= TE_SENDCWR;
4471
4472 if (SACK_ENABLED(tp)) {
4473 tcpstat.tcps_sack_recovery_episode++;
4474 tp->t_sack_recovery_episode++;
4475 tp->sack_newdata = tp->snd_nxt;
4476 tp->snd_cwnd = tp->t_maxseg;
4477 tp->t_flagsext &=
4478 ~TF_CWND_NONVALIDATED;
4479
4480 /* Process any window updates */
4481 if (tiwin > tp->snd_wnd)
4482 tcp_update_window(
4483 tp, thflags,
4484 th, tiwin, tlen);
4485
4486 tcp_ccdbg_trace(tp, th,
4487 TCP_CC_ENTER_FASTRECOVERY);
4488 (void) tcp_output(tp);
4489 goto drop;
4490 }
4491 tp->snd_nxt = th->th_ack;
4492 tp->snd_cwnd = tp->t_maxseg;
4493
4494 /* Process any window updates */
4495 if (tiwin > tp->snd_wnd)
4496 tcp_update_window(tp,
4497 thflags,
4498 th, tiwin, tlen);
4499
4500 (void) tcp_output(tp);
4501 if (tp->t_flagsext & TF_CWND_NONVALIDATED) {
4502 tcp_cc_adjust_nonvalidated_cwnd(tp);
4503 } else {
4504 tp->snd_cwnd = tp->snd_ssthresh +
4505 tp->t_maxseg * tp->t_dupacks;
4506 }
4507 if (SEQ_GT(onxt, tp->snd_nxt))
4508 tp->snd_nxt = onxt;
4509
4510 tcp_ccdbg_trace(tp, th,
4511 TCP_CC_ENTER_FASTRECOVERY);
4512 goto drop;
4513 } else if (limited_txmt &&
4514 ALLOW_LIMITED_TRANSMIT(tp) &&
4515 (!(SACK_ENABLED(tp)) || sack_bytes_acked > 0) &&
4516 (so->so_snd.sb_cc - (tp->snd_max - tp->snd_una)) > 0) {
4517 u_int32_t incr = (tp->t_maxseg * tp->t_dupacks);
4518
4519 /* Use Limited Transmit algorithm on the first two
4520 * duplicate acks when there is new data to transmit
4521 */
4522 tp->snd_cwnd += incr;
4523 tcpstat.tcps_limited_txt++;
4524 (void) tcp_output(tp);
4525
4526 tcp_ccdbg_trace(tp, th, TCP_CC_LIMITED_TRANSMIT);
4527
4528 /* Reset snd_cwnd back to normal */
4529 tp->snd_cwnd -= incr;
4530 }
4531 }
4532 break;
4533 }
4534 /*
4535 * If the congestion window was inflated to account
4536 * for the other side's cached packets, retract it.
4537 */
4538 if (IN_FASTRECOVERY(tp)) {
4539 if (SEQ_LT(th->th_ack, tp->snd_recover)) {
4540 /*
4541 * If we received an ECE and entered
4542 * recovery, the subsequent ACKs should
4543 * not be treated as partial acks.
4544 */
4545 if (tp->ecn_flags & TE_INRECOVERY)
4546 goto process_ACK;
4547
4548 if (SACK_ENABLED(tp))
4549 tcp_sack_partialack(tp, th);
4550 else
4551 tcp_newreno_partial_ack(tp, th);
4552 tcp_ccdbg_trace(tp, th, TCP_CC_PARTIAL_ACK);
4553 } else {
4554 EXIT_FASTRECOVERY(tp);
4555 if (CC_ALGO(tp)->post_fr != NULL)
4556 CC_ALGO(tp)->post_fr(tp, th);
4557 tp->t_pipeack = 0;
4558 tcp_clear_pipeack_state(tp);
4559 tcp_ccdbg_trace(tp, th,
4560 TCP_CC_EXIT_FASTRECOVERY);
4561 }
4562 } else if ((tp->t_flagsext &
4563 (TF_PKTS_REORDERED|TF_DELAY_RECOVERY))
4564 == (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) {
4565 /*
4566 * If the ack acknowledges upto snd_recover or if
4567 * it acknowledges all the snd holes, exit
4568 * recovery and cancel the timer. Otherwise,
4569 * this is a partial ack. Wait for recovery timer
4570 * to enter recovery. The snd_holes have already
4571 * been updated.
4572 */
4573 if (SEQ_GEQ(th->th_ack, tp->snd_recover) ||
4574 TAILQ_EMPTY(&tp->snd_holes)) {
4575 tp->t_timer[TCPT_DELAYFR] = 0;
4576 tp->t_flagsext &= ~TF_DELAY_RECOVERY;
4577 EXIT_FASTRECOVERY(tp);
4578 tcp_ccdbg_trace(tp, th,
4579 TCP_CC_EXIT_FASTRECOVERY);
4580 }
4581 } else {
4582 /*
4583 * We were not in fast recovery. Reset the
4584 * duplicate ack counter.
4585 */
4586 tp->t_dupacks = 0;
4587 tp->t_rexmtthresh = tcprexmtthresh;
4588 }
4589
4590
4591 /*
4592 * If we reach this point, ACK is not a duplicate,
4593 * i.e., it ACKs something we sent.
4594 */
4595 if (tp->t_flags & TF_NEEDSYN) {
4596 /*
4597 * T/TCP: Connection was half-synchronized, and our
4598 * SYN has been ACK'd (so connection is now fully
4599 * synchronized). Go to non-starred state,
4600 * increment snd_una for ACK of SYN, and check if
4601 * we can do window scaling.
4602 */
4603 tp->t_flags &= ~TF_NEEDSYN;
4604 tp->snd_una++;
4605 /* Do window scaling? */
4606 if (TCP_WINDOW_SCALE_ENABLED(tp)) {
4607 tp->snd_scale = tp->requested_s_scale;
4608 tp->rcv_scale = tp->request_r_scale;
4609 }
4610 }
4611
4612process_ACK:
4613 VERIFY(SEQ_GEQ(th->th_ack, tp->snd_una));
4614 acked = BYTES_ACKED(th, tp);
4615 tcpstat.tcps_rcvackpack++;
4616 tcpstat.tcps_rcvackbyte += acked;
4617
4618 /*
4619 * If the last packet was a retransmit, make sure
4620 * it was not spurious.
4621 *
4622 * This will also take care of congestion window
4623 * adjustment if a last packet was recovered due to a
4624 * tail loss probe.
4625 */
4626 tcp_bad_rexmt_check(tp, th, &to);
4627
4628 /* Recalculate the RTT */
4629 tcp_compute_rtt(tp, &to, th);
4630
4631 /*
4632 * If all outstanding data is acked, stop retransmit
4633 * timer and remember to restart (more output or persist).
4634 * If there is more data to be acked, restart retransmit
4635 * timer, using current (possibly backed-off) value.
4636 */
4637 TCP_RESET_REXMT_STATE(tp);
4638 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
4639 tp->t_rttmin, TCPTV_REXMTMAX,
4640 TCP_ADD_REXMTSLOP(tp));
4641 if (th->th_ack == tp->snd_max) {
4642 tp->t_timer[TCPT_REXMT] = 0;
4643 tp->t_timer[TCPT_PTO] = 0;
4644 needoutput = 1;
4645 } else if (tp->t_timer[TCPT_PERSIST] == 0)
4646 tp->t_timer[TCPT_REXMT] = OFFSET_FROM_START(tp,
4647 tp->t_rxtcur);
4648
4649 /*
4650 * If no data (only SYN) was ACK'd, skip rest of ACK
4651 * processing.
4652 */
4653 if (acked == 0)
4654 goto step6;
4655
4656 /*
4657 * When outgoing data has been acked (except the SYN+data), we
4658 * mark this connection as "sending good" for TFO.
4659 */
4660 if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) &&
4661 !(tp->t_tfo_flags & TFO_F_NO_SNDPROBING) &&
4662 !(th->th_flags & TH_SYN))
4663 tp->t_tfo_flags |= TFO_F_NO_SNDPROBING;
4664
4665 /*
4666 * If TH_ECE is received, make sure that ECN is enabled
4667 * on that connection and we have sent ECT on data packets.
4668 */
4669 if ((thflags & TH_ECE) != 0 && TCP_ECN_ENABLED(tp) &&
4670 (tp->ecn_flags & TE_SENDIPECT)) {
4671 /*
4672 * Reduce the congestion window if we haven't
4673 * done so.
4674 */
4675 if (!IN_FASTRECOVERY(tp)) {
4676 tcp_reduce_congestion_window(tp);
4677 tp->ecn_flags |= (TE_INRECOVERY|TE_SENDCWR);
4678 /*
4679 * Also note that the connection received
4680 * ECE atleast once
4681 */
4682 tp->ecn_flags |= TE_RECV_ECN_ECE;
4683 INP_INC_IFNET_STAT(inp, ecn_recv_ece);
4684 tcpstat.tcps_ecn_recv_ece++;
4685 tcp_ccdbg_trace(tp, th, TCP_CC_ECN_RCVD);
4686 }
4687 }
4688
4689 /*
4690 * When new data is acked, open the congestion window.
4691 * The specifics of how this is achieved are up to the
4692 * congestion control algorithm in use for this connection.
4693 *
4694 * The calculations in this function assume that snd_una is
4695 * not updated yet.
4696 */
4697 if (!IN_FASTRECOVERY(tp)) {
4698 if (CC_ALGO(tp)->ack_rcvd != NULL)
4699 CC_ALGO(tp)->ack_rcvd(tp, th);
4700 tcp_ccdbg_trace(tp, th, TCP_CC_ACK_RCVD);
4701 }
4702 if (acked > so->so_snd.sb_cc) {
4703 tp->snd_wnd -= so->so_snd.sb_cc;
4704 sbdrop(&so->so_snd, (int)so->so_snd.sb_cc);
4705 if (so->so_flags & SOF_ENABLE_MSGS) {
4706 so->so_msg_state->msg_serial_bytes -=
4707 (int)so->so_snd.sb_cc;
4708 }
4709 ourfinisacked = 1;
4710 } else {
4711 sbdrop(&so->so_snd, acked);
4712 if (so->so_flags & SOF_ENABLE_MSGS) {
4713 so->so_msg_state->msg_serial_bytes -=
4714 acked;
4715 }
4716 tcp_sbsnd_trim(&so->so_snd);
4717 tp->snd_wnd -= acked;
4718 ourfinisacked = 0;
4719 }
4720 /* detect una wraparound */
4721 if ( !IN_FASTRECOVERY(tp) &&
4722 SEQ_GT(tp->snd_una, tp->snd_recover) &&
4723 SEQ_LEQ(th->th_ack, tp->snd_recover))
4724 tp->snd_recover = th->th_ack - 1;
4725
4726 if (IN_FASTRECOVERY(tp) &&
4727 SEQ_GEQ(th->th_ack, tp->snd_recover))
4728 EXIT_FASTRECOVERY(tp);
4729
4730 tp->snd_una = th->th_ack;
4731
4732 if (SACK_ENABLED(tp)) {
4733 if (SEQ_GT(tp->snd_una, tp->snd_recover))
4734 tp->snd_recover = tp->snd_una;
4735 }
4736 if (SEQ_LT(tp->snd_nxt, tp->snd_una))
4737 tp->snd_nxt = tp->snd_una;
4738 if (!SLIST_EMPTY(&tp->t_rxt_segments) &&
4739 !TCP_DSACK_SEQ_IN_WINDOW(tp, tp->t_dsack_lastuna,
4740 tp->snd_una))
4741 tcp_rxtseg_clean(tp);
4742 if ((tp->t_flagsext & TF_MEASURESNDBW) != 0 &&
4743 tp->t_bwmeas != NULL)
4744 tcp_bwmeas_check(tp);
4745
4746 /*
4747 * sowwakeup must happen after snd_una, et al. are
4748 * updated so that the sequence numbers are in sync with
4749 * so_snd
4750 */
4751 sowwakeup(so);
4752
4753 if (!SLIST_EMPTY(&tp->t_notify_ack))
4754 tcp_notify_acknowledgement(tp, so);
4755
4756 switch (tp->t_state) {
4757
4758 /*
4759 * In FIN_WAIT_1 STATE in addition to the processing
4760 * for the ESTABLISHED state if our FIN is now acknowledged
4761 * then enter FIN_WAIT_2.
4762 */
4763 case TCPS_FIN_WAIT_1:
4764 if (ourfinisacked) {
4765 /*
4766 * If we can't receive any more
4767 * data, then closing user can proceed.
4768 * Starting the TCPT_2MSL timer is contrary to the
4769 * specification, but if we don't get a FIN
4770 * we'll hang forever.
4771 */
4772 if (so->so_state & SS_CANTRCVMORE) {
4773 tp->t_timer[TCPT_2MSL] = OFFSET_FROM_START(tp,
4774 TCP_CONN_MAXIDLE(tp));
4775 isconnected = FALSE;
4776 isdisconnected = TRUE;
4777 }
4778 DTRACE_TCP4(state__change, void, NULL,
4779 struct inpcb *, inp,
4780 struct tcpcb *, tp,
4781 int32_t, TCPS_FIN_WAIT_2);
4782 tp->t_state = TCPS_FIN_WAIT_2;
4783 /* fall through and make sure we also recognize
4784 * data ACKed with the FIN
4785 */
4786 }
4787 break;
4788
4789 /*
4790 * In CLOSING STATE in addition to the processing for
4791 * the ESTABLISHED state if the ACK acknowledges our FIN
4792 * then enter the TIME-WAIT state, otherwise ignore
4793 * the segment.
4794 */
4795 case TCPS_CLOSING:
4796 if (ourfinisacked) {
4797 DTRACE_TCP4(state__change, void, NULL,
4798 struct inpcb *, inp,
4799 struct tcpcb *, tp,
4800 int32_t, TCPS_TIME_WAIT);
4801 tp->t_state = TCPS_TIME_WAIT;
4802 tcp_canceltimers(tp);
4803 if (tp->t_flagsext & TF_NOTIMEWAIT) {
4804 tp->t_flags |= TF_CLOSING;
4805 } else {
4806 add_to_time_wait(tp, 2 * tcp_msl);
4807 }
4808 isconnected = FALSE;
4809 isdisconnected = TRUE;
4810 }
4811 break;
4812
4813 /*
4814 * In LAST_ACK, we may still be waiting for data to drain
4815 * and/or to be acked, as well as for the ack of our FIN.
4816 * If our FIN is now acknowledged, delete the TCB,
4817 * enter the closed state and return.
4818 */
4819 case TCPS_LAST_ACK:
4820 if (ourfinisacked) {
4821 tp = tcp_close(tp);
4822 goto drop;
4823 }
4824 break;
4825
4826 /*
4827 * In TIME_WAIT state the only thing that should arrive
4828 * is a retransmission of the remote FIN. Acknowledge
4829 * it and restart the finack timer.
4830 */
4831 case TCPS_TIME_WAIT:
4832 add_to_time_wait(tp, 2 * tcp_msl);
4833 goto dropafterack;
4834 }
4835
4836 /*
4837 * If there is a SACK option on the ACK and we
4838 * haven't seen any duplicate acks before, count
4839 * it as a duplicate ack even if the cumulative
4840 * ack is advanced. If the receiver delayed an
4841 * ack and detected loss afterwards, then the ack
4842 * will advance cumulative ack and will also have
4843 * a SACK option. So counting it as one duplicate
4844 * ack is ok.
4845 */
4846 if (sack_ackadv == 1 &&
4847 tp->t_state == TCPS_ESTABLISHED &&
4848 SACK_ENABLED(tp) && sack_bytes_acked > 0 &&
4849 to.to_nsacks > 0 && tp->t_dupacks == 0 &&
4850 SEQ_LEQ(th->th_ack, tp->snd_una) && tlen == 0 &&
4851 !(tp->t_flagsext & TF_PKTS_REORDERED)) {
4852 tcpstat.tcps_sack_ackadv++;
4853 goto process_dupack;
4854 }
4855 }
4856
4857step6:
4858 /*
4859 * Update window information.
4860 */
4861 if (tcp_update_window(tp, thflags, th, tiwin, tlen))
4862 needoutput = 1;
4863
4864 /*
4865 * Process segments with URG.
4866 */
4867 if ((thflags & TH_URG) && th->th_urp &&
4868 TCPS_HAVERCVDFIN(tp->t_state) == 0) {
4869 /*
4870 * This is a kludge, but if we receive and accept
4871 * random urgent pointers, we'll crash in
4872 * soreceive. It's hard to imagine someone
4873 * actually wanting to send this much urgent data.
4874 */
4875 if (th->th_urp + so->so_rcv.sb_cc > sb_max) {
4876 th->th_urp = 0; /* XXX */
4877 thflags &= ~TH_URG; /* XXX */
4878 goto dodata; /* XXX */
4879 }
4880 /*
4881 * If this segment advances the known urgent pointer,
4882 * then mark the data stream. This should not happen
4883 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
4884 * a FIN has been received from the remote side.
4885 * In these states we ignore the URG.
4886 *
4887 * According to RFC961 (Assigned Protocols),
4888 * the urgent pointer points to the last octet
4889 * of urgent data. We continue, however,
4890 * to consider it to indicate the first octet
4891 * of data past the urgent section as the original
4892 * spec states (in one of two places).
4893 */
4894 if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) {
4895 tp->rcv_up = th->th_seq + th->th_urp;
4896 so->so_oobmark = so->so_rcv.sb_cc +
4897 (tp->rcv_up - tp->rcv_nxt) - 1;
4898 if (so->so_oobmark == 0) {
4899 so->so_state |= SS_RCVATMARK;
4900 postevent(so, 0, EV_OOB);
4901 }
4902 sohasoutofband(so);
4903 tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
4904 }
4905 /*
4906 * Remove out of band data so doesn't get presented to user.
4907 * This can happen independent of advancing the URG pointer,
4908 * but if two URG's are pending at once, some out-of-band
4909 * data may creep in... ick.
4910 */
4911 if (th->th_urp <= (u_int32_t)tlen
4912#if SO_OOBINLINE
4913 && (so->so_options & SO_OOBINLINE) == 0
4914#endif
4915 )
4916 tcp_pulloutofband(so, th, m,
4917 drop_hdrlen); /* hdr drop is delayed */
4918 } else {
4919 /*
4920 * If no out of band data is expected,
4921 * pull receive urgent pointer along
4922 * with the receive window.
4923 */
4924 if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
4925 tp->rcv_up = tp->rcv_nxt;
4926 }
4927dodata:
4928
4929 /* Set socket's connect or disconnect state correcly before doing data.
4930 * The following might unlock the socket if there is an upcall or a socket
4931 * filter.
4932 */
4933 if (isconnected) {
4934 soisconnected(so);
4935 } else if (isdisconnected) {
4936 soisdisconnected(so);
4937 }
4938
4939 /* Let's check the state of pcb just to make sure that it did not get closed
4940 * when we unlocked above
4941 */
4942 if (inp->inp_state == INPCB_STATE_DEAD) {
4943 /* Just drop the packet that we are processing and return */
4944 goto drop;
4945 }
4946
4947 /*
4948 * Process the segment text, merging it into the TCP sequencing queue,
4949 * and arranging for acknowledgment of receipt if necessary.
4950 * This process logically involves adjusting tp->rcv_wnd as data
4951 * is presented to the user (this happens in tcp_usrreq.c,
4952 * case PRU_RCVD). If a FIN has already been received on this
4953 * connection then we just ignore the text.
4954 *
4955 * If we are in SYN-received state and got a valid TFO cookie, we want
4956 * to process the data.
4957 */
4958 if ((tlen || (thflags & TH_FIN)) &&
4959 TCPS_HAVERCVDFIN(tp->t_state) == 0 &&
4960 (TCPS_HAVEESTABLISHED(tp->t_state) ||
4961 (tp->t_state == TCPS_SYN_RECEIVED &&
4962 (tp->t_tfo_flags & TFO_F_COOKIE_VALID)))) {
4963 tcp_seq save_start = th->th_seq;
4964 tcp_seq save_end = th->th_seq + tlen;
4965 m_adj(m, drop_hdrlen); /* delayed header drop */
4966 /*
4967 * Insert segment which includes th into TCP reassembly queue
4968 * with control block tp. Set thflags to whether reassembly now
4969 * includes a segment with FIN. This handles the common case
4970 * inline (segment is the next to be received on an established
4971 * connection, and the queue is empty), avoiding linkage into
4972 * and removal from the queue and repetition of various
4973 * conversions.
4974 * Set DELACK for segments received in order, but ack
4975 * immediately when segments are out of order (so
4976 * fast retransmit can work).
4977 */
4978 if (th->th_seq == tp->rcv_nxt && LIST_EMPTY(&tp->t_segq)) {
4979 TCP_INC_VAR(tp->t_unacksegs, nlropkts);
4980 /*
4981 * Calculate the RTT on the receiver only if the
4982 * connection is in streaming mode and the last
4983 * packet was not an end-of-write
4984 */
4985 if (tp->t_flags & TF_STREAMING_ON)
4986 tcp_compute_rtt(tp, &to, th);
4987
4988 if (DELAY_ACK(tp, th) &&
4989 ((tp->t_flags & TF_ACKNOW) == 0) ) {
4990 if ((tp->t_flags & TF_DELACK) == 0) {
4991 tp->t_flags |= TF_DELACK;
4992 tp->t_timer[TCPT_DELACK] =
4993 OFFSET_FROM_START(tp, tcp_delack);
4994 }
4995 }
4996 else {
4997 tp->t_flags |= TF_ACKNOW;
4998 }
4999 tp->rcv_nxt += tlen;
5000 thflags = th->th_flags & TH_FIN;
5001 TCP_INC_VAR(tcpstat.tcps_rcvpack, nlropkts);
5002 tcpstat.tcps_rcvbyte += tlen;
5003 if (nstat_collect) {
5004 if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) {
5005 INP_ADD_STAT(inp, cell, wifi, wired,
5006 rxpackets, m->m_pkthdr.lro_npkts);
5007 } else {
5008 INP_ADD_STAT(inp, cell, wifi, wired,
5009 rxpackets, 1);
5010 }
5011 INP_ADD_STAT(inp, cell, wifi, wired,
5012 rxbytes, tlen);
5013 inp_set_activity_bitmap(inp);
5014 }
5015 tcp_sbrcv_grow(tp, &so->so_rcv, &to, tlen,
5016 TCP_AUTORCVBUF_MAX(ifp));
5017 so_recv_data_stat(so, m, drop_hdrlen);
5018
5019 if (sbappendstream_rcvdemux(so, m,
5020 th->th_seq - (tp->irs + 1), 0)) {
5021 sorwakeup(so);
5022 }
5023 } else {
5024 thflags = tcp_reass(tp, th, &tlen, m, ifp);
5025 tp->t_flags |= TF_ACKNOW;
5026 }
5027
5028 if ((tlen > 0 || (th->th_flags & TH_FIN)) && SACK_ENABLED(tp)) {
5029 if (th->th_flags & TH_FIN)
5030 save_end++;
5031 tcp_update_sack_list(tp, save_start, save_end);
5032 }
5033
5034 tcp_adaptive_rwtimo_check(tp, tlen);
5035
5036 if (tlen > 0)
5037 tcp_tfo_rcv_data(tp);
5038
5039 if (tp->t_flags & TF_DELACK)
5040 {
5041#if INET6
5042 if (isipv6) {
5043 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
5044 (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])),
5045 th->th_seq, th->th_ack, th->th_win);
5046 }
5047 else
5048#endif
5049 {
5050 KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport),
5051 (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)),
5052 th->th_seq, th->th_ack, th->th_win);
5053 }
5054
5055 }
5056 } else {
5057 if ((so->so_flags & SOF_MP_SUBFLOW) && tlen == 0 &&
5058 (m->m_pkthdr.pkt_flags & PKTF_MPTCP_DFIN) &&
5059 (m->m_pkthdr.pkt_flags & PKTF_MPTCP)) {
5060 m_adj(m, drop_hdrlen); /* delayed header drop */
5061 mptcp_input(tptomptp(tp)->mpt_mpte, m);
5062 tp->t_flags |= TF_ACKNOW;
5063 } else {
5064 m_freem(m);
5065 }
5066 thflags &= ~TH_FIN;
5067 }
5068
5069 /*
5070 * If FIN is received ACK the FIN and let the user know
5071 * that the connection is closing.
5072 */
5073 if (thflags & TH_FIN) {
5074 if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
5075 socantrcvmore(so);
5076 postevent(so, 0, EV_FIN);
5077 /*
5078 * If connection is half-synchronized
5079 * (ie NEEDSYN flag on) then delay ACK,
5080 * so it may be piggybacked when SYN is sent.
5081 * Otherwise, since we received a FIN then no
5082 * more input can be expected, send ACK now.
5083 */
5084 TCP_INC_VAR(tp->t_unacksegs, nlropkts);
5085 if (DELAY_ACK(tp, th) && (tp->t_flags & TF_NEEDSYN)) {
5086 if ((tp->t_flags & TF_DELACK) == 0) {
5087 tp->t_flags |= TF_DELACK;
5088 tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack);
5089 }
5090 } else {
5091 tp->t_flags |= TF_ACKNOW;
5092 }
5093 tp->rcv_nxt++;
5094 }
5095 switch (tp->t_state) {
5096
5097 /*
5098 * In SYN_RECEIVED and ESTABLISHED STATES
5099 * enter the CLOSE_WAIT state.
5100 */
5101 case TCPS_SYN_RECEIVED:
5102 tp->t_starttime = tcp_now;
5103 case TCPS_ESTABLISHED:
5104 DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp,
5105 struct tcpcb *, tp, int32_t, TCPS_CLOSE_WAIT);
5106 tp->t_state = TCPS_CLOSE_WAIT;
5107 break;
5108
5109 /*
5110 * If still in FIN_WAIT_1 STATE FIN has not been acked so
5111 * enter the CLOSING state.
5112 */
5113 case TCPS_FIN_WAIT_1:
5114 DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp,
5115 struct tcpcb *, tp, int32_t, TCPS_CLOSING);
5116 tp->t_state = TCPS_CLOSING;
5117 break;
5118
5119 /*
5120 * In FIN_WAIT_2 state enter the TIME_WAIT state,
5121 * starting the time-wait timer, turning off the other
5122 * standard timers.
5123 */
5124 case TCPS_FIN_WAIT_2:
5125 DTRACE_TCP4(state__change, void, NULL,
5126 struct inpcb *, inp,
5127 struct tcpcb *, tp,
5128 int32_t, TCPS_TIME_WAIT);
5129 tp->t_state = TCPS_TIME_WAIT;
5130 tcp_canceltimers(tp);
5131 tp->t_flags |= TF_ACKNOW;
5132 if (tp->t_flagsext & TF_NOTIMEWAIT) {
5133 tp->t_flags |= TF_CLOSING;
5134 } else {
5135 add_to_time_wait(tp, 2 * tcp_msl);
5136 }
5137 soisdisconnected(so);
5138 break;
5139
5140 /*
5141 * In TIME_WAIT state restart the 2 MSL time_wait timer.
5142 */
5143 case TCPS_TIME_WAIT:
5144 add_to_time_wait(tp, 2 * tcp_msl);
5145 break;
5146 }
5147 }
5148#if TCPDEBUG
5149 if (so->so_options & SO_DEBUG)
5150 tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen,
5151 &tcp_savetcp, 0);
5152#endif
5153
5154 /*
5155 * Return any desired output.
5156 */
5157 if (needoutput || (tp->t_flags & TF_ACKNOW)) {
5158 (void) tcp_output(tp);
5159 }
5160
5161 tcp_check_timer_state(tp);
5162
5163
5164 socket_unlock(so, 1);
5165 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
5166 return;
5167
5168dropafterack:
5169 /*
5170 * Generate an ACK dropping incoming segment if it occupies
5171 * sequence space, where the ACK reflects our state.
5172 *
5173 * We can now skip the test for the RST flag since all
5174 * paths to this code happen after packets containing
5175 * RST have been dropped.
5176 *
5177 * In the SYN-RECEIVED state, don't send an ACK unless the
5178 * segment we received passes the SYN-RECEIVED ACK test.
5179 * If it fails send a RST. This breaks the loop in the
5180 * "LAND" DoS attack, and also prevents an ACK storm
5181 * between two listening ports that have been sent forged
5182 * SYN segments, each with the source address of the other.
5183 */
5184 if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) &&
5185 (SEQ_GT(tp->snd_una, th->th_ack) ||
5186 SEQ_GT(th->th_ack, tp->snd_max)) ) {
5187 rstreason = BANDLIM_RST_OPENPORT;
5188 IF_TCP_STATINC(ifp, dospacket);
5189 goto dropwithreset;
5190 }
5191#if TCPDEBUG
5192 if (so->so_options & SO_DEBUG)
5193 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
5194 &tcp_savetcp, 0);
5195#endif
5196 m_freem(m);
5197 tp->t_flags |= TF_ACKNOW;
5198 (void) tcp_output(tp);
5199
5200 /* Don't need to check timer state as we should have done it during tcp_output */
5201 socket_unlock(so, 1);
5202 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
5203 return;
5204dropwithresetnosock:
5205 nosock = 1;
5206dropwithreset:
5207 /*
5208 * Generate a RST, dropping incoming segment.
5209 * Make ACK acceptable to originator of segment.
5210 * Don't bother to respond if destination was broadcast/multicast.
5211 */
5212 if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST))
5213 goto drop;
5214#if INET6
5215 if (isipv6) {
5216 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
5217 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
5218 goto drop;
5219 } else
5220#endif /* INET6 */
5221 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
5222 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
5223 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
5224 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
5225 goto drop;
5226 /* IPv6 anycast check is done at tcp6_input() */
5227
5228 /*
5229 * Perform bandwidth limiting.
5230 */
5231#if ICMP_BANDLIM
5232 if (badport_bandlim(rstreason) < 0)
5233 goto drop;
5234#endif
5235
5236#if TCPDEBUG
5237 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
5238 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
5239 &tcp_savetcp, 0);
5240#endif
5241 bzero(&tra, sizeof(tra));
5242 tra.ifscope = ifscope;
5243 tra.awdl_unrestricted = 1;
5244 tra.intcoproc_allowed = 1;
5245 if (thflags & TH_ACK)
5246 /* mtod() below is safe as long as hdr dropping is delayed */
5247 tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack,
5248 TH_RST, &tra);
5249 else {
5250 if (thflags & TH_SYN)
5251 tlen++;
5252 /* mtod() below is safe as long as hdr dropping is delayed */
5253 tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
5254 (tcp_seq)0, TH_RST|TH_ACK, &tra);
5255 }
5256 /* destroy temporarily created socket */
5257 if (dropsocket) {
5258 (void) soabort(so);
5259 socket_unlock(so, 1);
5260 } else if ((inp != NULL) && (nosock == 0)) {
5261 socket_unlock(so, 1);
5262 }
5263 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
5264 return;
5265dropnosock:
5266 nosock = 1;
5267drop:
5268 /*
5269 * Drop space held by incoming segment and return.
5270 */
5271#if TCPDEBUG
5272 if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
5273 tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen,
5274 &tcp_savetcp, 0);
5275#endif
5276 m_freem(m);
5277 /* destroy temporarily created socket */
5278 if (dropsocket) {
5279 (void) soabort(so);
5280 socket_unlock(so, 1);
5281 }
5282 else if (nosock == 0) {
5283 socket_unlock(so, 1);
5284 }
5285 KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0);
5286 return;
5287}
5288
5289/*
5290 * Parse TCP options and place in tcpopt.
5291 */
5292static void
5293tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th,
5294 struct tcpopt *to)
5295{
5296 u_short mss = 0;
5297 int opt, optlen;
5298
5299 for (; cnt > 0; cnt -= optlen, cp += optlen) {
5300 opt = cp[0];
5301 if (opt == TCPOPT_EOL)
5302 break;
5303 if (opt == TCPOPT_NOP)
5304 optlen = 1;
5305 else {
5306 if (cnt < 2)
5307 break;
5308 optlen = cp[1];
5309 if (optlen < 2 || optlen > cnt)
5310 break;
5311 }
5312 switch (opt) {
5313
5314 default:
5315 continue;
5316
5317 case TCPOPT_MAXSEG:
5318 if (optlen != TCPOLEN_MAXSEG)
5319 continue;
5320 if (!(th->th_flags & TH_SYN))
5321 continue;
5322 bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
5323 NTOHS(mss);
5324 to->to_mss = mss;
5325 to->to_flags |= TOF_MSS;
5326 break;
5327
5328 case TCPOPT_WINDOW:
5329 if (optlen != TCPOLEN_WINDOW)
5330 continue;
5331 if (!(th->th_flags & TH_SYN))
5332 continue;
5333 to->to_flags |= TOF_SCALE;
5334 to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
5335 break;
5336
5337 case TCPOPT_TIMESTAMP:
5338 if (optlen != TCPOLEN_TIMESTAMP)
5339 continue;
5340 to->to_flags |= TOF_TS;
5341 bcopy((char *)cp + 2,
5342 (char *)&to->to_tsval, sizeof(to->to_tsval));
5343 NTOHL(to->to_tsval);
5344 bcopy((char *)cp + 6,
5345 (char *)&to->to_tsecr, sizeof(to->to_tsecr));
5346 NTOHL(to->to_tsecr);
5347 /* Re-enable sending Timestamps if we received them */
5348 if (!(tp->t_flags & TF_REQ_TSTMP) &&
5349 tcp_do_rfc1323 == 1)
5350 tp->t_flags |= TF_REQ_TSTMP;
5351 break;
5352 case TCPOPT_SACK_PERMITTED:
5353 if (!tcp_do_sack ||
5354 optlen != TCPOLEN_SACK_PERMITTED)
5355 continue;
5356 if (th->th_flags & TH_SYN)
5357 to->to_flags |= TOF_SACK;
5358 break;
5359 case TCPOPT_SACK:
5360 if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0)
5361 continue;
5362 to->to_nsacks = (optlen - 2) / TCPOLEN_SACK;
5363 to->to_sacks = cp + 2;
5364 tcpstat.tcps_sack_rcv_blocks++;
5365
5366 break;
5367 case TCPOPT_FASTOPEN:
5368 if (optlen == TCPOLEN_FASTOPEN_REQ) {
5369 if (tp->t_state != TCPS_LISTEN)
5370 continue;
5371
5372 to->to_flags |= TOF_TFOREQ;
5373 } else {
5374 if (optlen < TCPOLEN_FASTOPEN_REQ ||
5375 (optlen - TCPOLEN_FASTOPEN_REQ) > TFO_COOKIE_LEN_MAX ||
5376 (optlen - TCPOLEN_FASTOPEN_REQ) < TFO_COOKIE_LEN_MIN)
5377 continue;
5378 if (tp->t_state != TCPS_LISTEN &&
5379 tp->t_state != TCPS_SYN_SENT)
5380 continue;
5381
5382 to->to_flags |= TOF_TFO;
5383 to->to_tfo = cp + 1;
5384 }
5385
5386 break;
5387#if MPTCP
5388 case TCPOPT_MULTIPATH:
5389 tcp_do_mptcp_options(tp, cp, th, to, optlen);
5390 break;
5391#endif /* MPTCP */
5392 }
5393 }
5394}
5395
5396static void
5397tcp_finalize_options(struct tcpcb *tp, struct tcpopt *to, unsigned int ifscope)
5398{
5399 if (to->to_flags & TOF_TS) {
5400 tp->t_flags |= TF_RCVD_TSTMP;
5401 tp->ts_recent = to->to_tsval;
5402 tp->ts_recent_age = tcp_now;
5403
5404 }
5405 if (to->to_flags & TOF_MSS)
5406 tcp_mss(tp, to->to_mss, ifscope);
5407 if (SACK_ENABLED(tp)) {
5408 if (!(to->to_flags & TOF_SACK))
5409 tp->t_flagsext &= ~(TF_SACK_ENABLE);
5410 else
5411 tp->t_flags |= TF_SACK_PERMIT;
5412 }
5413 if (to->to_flags & TOF_SCALE) {
5414 tp->t_flags |= TF_RCVD_SCALE;
5415 tp->requested_s_scale = to->to_requested_s_scale;
5416
5417 /* Re-enable window scaling, if the option is received */
5418 if (tp->request_r_scale > 0)
5419 tp->t_flags |= TF_REQ_SCALE;
5420 }
5421}
5422
5423/*
5424 * Pull out of band byte out of a segment so
5425 * it doesn't appear in the user's data queue.
5426 * It is still reflected in the segment length for
5427 * sequencing purposes.
5428 *
5429 * @param off delayed to be droped hdrlen
5430 */
5431static void
5432tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m, int off)
5433{
5434 int cnt = off + th->th_urp - 1;
5435
5436 while (cnt >= 0) {
5437 if (m->m_len > cnt) {
5438 char *cp = mtod(m, caddr_t) + cnt;
5439 struct tcpcb *tp = sototcpcb(so);
5440
5441 tp->t_iobc = *cp;
5442 tp->t_oobflags |= TCPOOB_HAVEDATA;
5443 bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
5444 m->m_len--;
5445 if (m->m_flags & M_PKTHDR)
5446 m->m_pkthdr.len--;
5447 return;
5448 }
5449 cnt -= m->m_len;
5450 m = m->m_next;
5451 if (m == 0)
5452 break;
5453 }
5454 panic("tcp_pulloutofband");
5455}
5456
5457uint32_t
5458get_base_rtt(struct tcpcb *tp)
5459{
5460 struct rtentry *rt = tp->t_inpcb->inp_route.ro_rt;
5461 return ((rt == NULL) ? 0 : rt->rtt_min);
5462}
5463
5464/* Each value of RTT base represents the minimum RTT seen in a minute.
5465 * We keep upto N_RTT_BASE minutes worth of history.
5466 */
5467void
5468update_base_rtt(struct tcpcb *tp, uint32_t rtt)
5469{
5470 u_int32_t base_rtt, i;
5471 struct rtentry *rt;
5472
5473 if ((rt = tp->t_inpcb->inp_route.ro_rt) == NULL)
5474 return;
5475 if (rt->rtt_expire_ts == 0) {
5476 RT_LOCK_SPIN(rt);
5477 if (rt->rtt_expire_ts != 0) {
5478 RT_UNLOCK(rt);
5479 goto update;
5480 }
5481 rt->rtt_expire_ts = tcp_now;
5482 rt->rtt_index = 0;
5483 rt->rtt_hist[0] = rtt;
5484 rt->rtt_min = rtt;
5485 RT_UNLOCK(rt);
5486 return;
5487 }
5488update:
5489#if TRAFFIC_MGT
5490 /*
5491 * If the recv side is being throttled, check if the
5492 * current RTT is closer to the base RTT seen in
5493 * first (recent) two slots. If so, unthrottle the stream.
5494 */
5495 if ((tp->t_flagsext & TF_RECV_THROTTLE) &&
5496 (int)(tcp_now - tp->t_recv_throttle_ts) >= TCP_RECV_THROTTLE_WIN) {
5497 base_rtt = rt->rtt_min;
5498 if (tp->t_rttcur <= (base_rtt + target_qdelay)) {
5499 tp->t_flagsext &= ~TF_RECV_THROTTLE;
5500 tp->t_recv_throttle_ts = 0;
5501 }
5502 }
5503#endif /* TRAFFIC_MGT */
5504 if ((int)(tcp_now - rt->rtt_expire_ts) >=
5505 TCP_RTT_HISTORY_EXPIRE_TIME) {
5506 RT_LOCK_SPIN(rt);
5507 /* check the condition again to avoid race */
5508 if ((int)(tcp_now - rt->rtt_expire_ts) >=
5509 TCP_RTT_HISTORY_EXPIRE_TIME) {
5510 rt->rtt_index++;
5511 if (rt->rtt_index >= NRTT_HIST)
5512 rt->rtt_index = 0;
5513 rt->rtt_hist[rt->rtt_index] = rtt;
5514 rt->rtt_expire_ts = tcp_now;
5515 } else {
5516 rt->rtt_hist[rt->rtt_index] =
5517 min(rt->rtt_hist[rt->rtt_index], rtt);
5518 }
5519 /* forget the old value and update minimum */
5520 rt->rtt_min = 0;
5521 for (i = 0; i < NRTT_HIST; ++i) {
5522 if (rt->rtt_hist[i] != 0 &&
5523 (rt->rtt_min == 0 ||
5524 rt->rtt_hist[i] < rt->rtt_min))
5525 rt->rtt_min = rt->rtt_hist[i];
5526 }
5527 RT_UNLOCK(rt);
5528 } else {
5529 rt->rtt_hist[rt->rtt_index] =
5530 min(rt->rtt_hist[rt->rtt_index], rtt);
5531 if (rt->rtt_min == 0)
5532 rt->rtt_min = rtt;
5533 else
5534 rt->rtt_min = min(rt->rtt_min, rtt);
5535 }
5536}
5537
5538/*
5539 * If we have a timestamp reply, update smoothed RTT. If no timestamp is
5540 * present but transmit timer is running and timed sequence number was
5541 * acked, update smoothed RTT.
5542 *
5543 * If timestamps are supported, a receiver can update RTT even if
5544 * there is no outstanding data.
5545 *
5546 * Some boxes send broken timestamp replies during the SYN+ACK phase,
5547 * ignore timestamps of 0or we could calculate a huge RTT and blow up
5548 * the retransmit timer.
5549 */
5550static void
5551tcp_compute_rtt(struct tcpcb *tp, struct tcpopt *to, struct tcphdr *th)
5552{
5553 int rtt = 0;
5554 VERIFY(to != NULL && th != NULL);
5555 if (tp->t_rtttime != 0 && SEQ_GT(th->th_ack, tp->t_rtseq)) {
5556 u_int32_t pipe_ack_val;
5557 rtt = tcp_now - tp->t_rtttime;
5558 /*
5559 * Compute pipe ack -- the amount of data acknowledged
5560 * in the last RTT
5561 */
5562 if (SEQ_GT(th->th_ack, tp->t_pipeack_lastuna)) {
5563 pipe_ack_val = th->th_ack - tp->t_pipeack_lastuna;
5564 /* Update the sample */
5565 tp->t_pipeack_sample[tp->t_pipeack_ind++] =
5566 pipe_ack_val;
5567 tp->t_pipeack_ind %= TCP_PIPEACK_SAMPLE_COUNT;
5568
5569 /* Compute the max of the pipeack samples */
5570 pipe_ack_val = tcp_get_max_pipeack(tp);
5571 tp->t_pipeack = (pipe_ack_val >
5572 TCP_CC_CWND_INIT_BYTES) ?
5573 pipe_ack_val : 0;
5574 }
5575 /* start another measurement */
5576 tp->t_rtttime = 0;
5577 }
5578 if (((to->to_flags & TOF_TS) != 0) &&
5579 (to->to_tsecr != 0) &&
5580 TSTMP_GEQ(tcp_now, to->to_tsecr)) {
5581 tcp_xmit_timer(tp, (tcp_now - to->to_tsecr),
5582 to->to_tsecr, th->th_ack);
5583 } else if (rtt > 0) {
5584 tcp_xmit_timer(tp, rtt, 0, th->th_ack);
5585 }
5586}
5587
5588/*
5589 * Collect new round-trip time estimate and update averages and
5590 * current timeout.
5591 */
5592static void
5593tcp_xmit_timer(struct tcpcb *tp, int rtt,
5594 u_int32_t tsecr, tcp_seq th_ack)
5595{
5596 int delta;
5597
5598 /*
5599 * On AWDL interface, the initial RTT measurement on SYN
5600 * can be wrong due to peer caching. Avoid the first RTT
5601 * measurement as it might skew up the RTO.
5602 * <rdar://problem/28739046>
5603 */
5604 if (tp->t_inpcb->inp_last_outifp != NULL &&
5605 (tp->t_inpcb->inp_last_outifp->if_eflags & IFEF_AWDL) &&
5606 th_ack == tp->iss + 1)
5607 return;
5608
5609 if (tp->t_flagsext & TF_RECOMPUTE_RTT) {
5610 if (SEQ_GT(th_ack, tp->snd_una) &&
5611 SEQ_LEQ(th_ack, tp->snd_max) &&
5612 (tsecr == 0 ||
5613 TSTMP_GEQ(tsecr, tp->t_badrexmt_time))) {
5614 /*
5615 * We received a new ACk after a
5616 * spurious timeout. Adapt retransmission
5617 * timer as described in rfc 4015.
5618 */
5619 tp->t_flagsext &= ~(TF_RECOMPUTE_RTT);
5620 tp->t_badrexmt_time = 0;
5621 tp->t_srtt = max(tp->t_srtt_prev, rtt);
5622 tp->t_srtt = tp->t_srtt << TCP_RTT_SHIFT;
5623 tp->t_rttvar = max(tp->t_rttvar_prev, (rtt >> 1));
5624 tp->t_rttvar = tp->t_rttvar << TCP_RTTVAR_SHIFT;
5625
5626 if (tp->t_rttbest > (tp->t_srtt + tp->t_rttvar))
5627 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
5628
5629 goto compute_rto;
5630 } else {
5631 return;
5632 }
5633 }
5634
5635 tcpstat.tcps_rttupdated++;
5636 tp->t_rttupdated++;
5637
5638 if (rtt > 0) {
5639 tp->t_rttcur = rtt;
5640 update_base_rtt(tp, rtt);
5641 }
5642
5643 if (tp->t_srtt != 0) {
5644 /*
5645 * srtt is stored as fixed point with 5 bits after the
5646 * binary point (i.e., scaled by 32). The following magic
5647 * is equivalent to the smoothing algorithm in rfc793 with
5648 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
5649 * point).
5650 *
5651 * Freebsd adjusts rtt to origin 0 by subtracting 1
5652 * from the provided rtt value. This was required because
5653 * of the way t_rtttime was initiailised to 1 before.
5654 * Since we changed t_rtttime to be based on
5655 * tcp_now, this extra adjustment is not needed.
5656 */
5657 delta = (rtt << TCP_DELTA_SHIFT)
5658 - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT));
5659
5660 if ((tp->t_srtt += delta) <= 0)
5661 tp->t_srtt = 1;
5662
5663 /*
5664 * We accumulate a smoothed rtt variance (actually, a
5665 * smoothed mean difference), then set the retransmit
5666 * timer to smoothed rtt + 4 times the smoothed variance.
5667 * rttvar is stored as fixed point with 4 bits after the
5668 * binary point (scaled by 16). The following is
5669 * equivalent to rfc793 smoothing with an alpha of .75
5670 * (rttvar = rttvar*3/4 + |delta| / 4). This replaces
5671 * rfc793's wired-in beta.
5672 */
5673 if (delta < 0)
5674 delta = -delta;
5675 delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT);
5676 if ((tp->t_rttvar += delta) <= 0)
5677 tp->t_rttvar = 1;
5678 if (tp->t_rttbest == 0 ||
5679 tp->t_rttbest > (tp->t_srtt + tp->t_rttvar))
5680 tp->t_rttbest = tp->t_srtt + tp->t_rttvar;
5681 } else {
5682 /*
5683 * No rtt measurement yet - use the unsmoothed rtt.
5684 * Set the variance to half the rtt (so our first
5685 * retransmit happens at 3*rtt).
5686 */
5687 tp->t_srtt = rtt << TCP_RTT_SHIFT;
5688 tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
5689 }
5690
5691compute_rto:
5692 nstat_route_rtt(tp->t_inpcb->inp_route.ro_rt, tp->t_srtt,
5693 tp->t_rttvar);
5694
5695 /*
5696 * the retransmit should happen at rtt + 4 * rttvar.
5697 * Because of the way we do the smoothing, srtt and rttvar
5698 * will each average +1/2 tick of bias. When we compute
5699 * the retransmit timer, we want 1/2 tick of rounding and
5700 * 1 extra tick because of +-1/2 tick uncertainty in the
5701 * firing of the timer. The bias will give us exactly the
5702 * 1.5 tick we need. But, because the bias is
5703 * statistical, we have to test that we don't drop below
5704 * the minimum feasible timer (which is 2 ticks).
5705 */
5706 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
5707 max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX,
5708 TCP_ADD_REXMTSLOP(tp));
5709
5710 /*
5711 * We received an ack for a packet that wasn't retransmitted;
5712 * it is probably safe to discard any error indications we've
5713 * received recently. This isn't quite right, but close enough
5714 * for now (a route might have failed after we sent a segment,
5715 * and the return path might not be symmetrical).
5716 */
5717 tp->t_softerror = 0;
5718}
5719
5720static inline unsigned int
5721tcp_maxmtu(struct rtentry *rt)
5722{
5723 unsigned int maxmtu;
5724 int interface_mtu = 0;
5725
5726 RT_LOCK_ASSERT_HELD(rt);
5727 interface_mtu = rt->rt_ifp->if_mtu;
5728
5729 if (rt_key(rt)->sa_family == AF_INET &&
5730 INTF_ADJUST_MTU_FOR_CLAT46(rt->rt_ifp)) {
5731 interface_mtu = IN6_LINKMTU(rt->rt_ifp);
5732 /* Further adjust the size for CLAT46 expansion */
5733 interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD;
5734 }
5735
5736 if (rt->rt_rmx.rmx_mtu == 0)
5737 maxmtu = interface_mtu;
5738 else
5739 maxmtu = MIN(rt->rt_rmx.rmx_mtu, interface_mtu);
5740
5741 return (maxmtu);
5742}
5743
5744#if INET6
5745static inline unsigned int
5746tcp_maxmtu6(struct rtentry *rt)
5747{
5748 unsigned int maxmtu;
5749 struct nd_ifinfo *ndi = NULL;
5750
5751 RT_LOCK_ASSERT_HELD(rt);
5752 if ((ndi = ND_IFINFO(rt->rt_ifp)) != NULL && !ndi->initialized)
5753 ndi = NULL;
5754 if (ndi != NULL)
5755 lck_mtx_lock(&ndi->lock);
5756 if (rt->rt_rmx.rmx_mtu == 0)
5757 maxmtu = IN6_LINKMTU(rt->rt_ifp);
5758 else
5759 maxmtu = MIN(rt->rt_rmx.rmx_mtu, IN6_LINKMTU(rt->rt_ifp));
5760 if (ndi != NULL)
5761 lck_mtx_unlock(&ndi->lock);
5762
5763 return (maxmtu);
5764}
5765#endif
5766
5767unsigned int
5768get_maxmtu(struct rtentry *rt)
5769{
5770 unsigned int maxmtu = 0;
5771
5772 RT_LOCK_ASSERT_NOTHELD(rt);
5773
5774 RT_LOCK(rt);
5775
5776 if (rt_key(rt)->sa_family == AF_INET6) {
5777 maxmtu = tcp_maxmtu6(rt);
5778 } else {
5779 maxmtu = tcp_maxmtu(rt);
5780 }
5781
5782 RT_UNLOCK(rt);
5783
5784 return (maxmtu);
5785}
5786
5787/*
5788 * Determine a reasonable value for maxseg size.
5789 * If the route is known, check route for mtu.
5790 * If none, use an mss that can be handled on the outgoing
5791 * interface without forcing IP to fragment; if bigger than
5792 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
5793 * to utilize large mbufs. If no route is found, route has no mtu,
5794 * or the destination isn't local, use a default, hopefully conservative
5795 * size (usually 512 or the default IP max size, but no more than the mtu
5796 * of the interface), as we can't discover anything about intervening
5797 * gateways or networks. We also initialize the congestion/slow start
5798 * window. While looking at the routing entry, we also initialize
5799 * other path-dependent parameters from pre-set or cached values
5800 * in the routing entry.
5801 *
5802 * Also take into account the space needed for options that we
5803 * send regularly. Make maxseg shorter by that amount to assure
5804 * that we can send maxseg amount of data even when the options
5805 * are present. Store the upper limit of the length of options plus
5806 * data in maxopd.
5807 *
5808 * NOTE that this routine is only called when we process an incoming
5809 * segment, for outgoing segments only tcp_mssopt is called.
5810 *
5811 */
5812void
5813tcp_mss(struct tcpcb *tp, int offer, unsigned int input_ifscope)
5814{
5815 struct rtentry *rt;
5816 struct ifnet *ifp;
5817 int rtt, mss;
5818 u_int32_t bufsize;
5819 struct inpcb *inp;
5820 struct socket *so;
5821 struct rmxp_tao *taop;
5822 int origoffer = offer;
5823 u_int32_t sb_max_corrected;
5824 int isnetlocal = 0;
5825#if INET6
5826 int isipv6;
5827 int min_protoh;
5828#endif
5829
5830 inp = tp->t_inpcb;
5831#if INET6
5832 isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
5833 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
5834 : sizeof (struct tcpiphdr);
5835#else
5836#define min_protoh (sizeof (struct tcpiphdr))
5837#endif
5838
5839#if INET6
5840 if (isipv6) {
5841 rt = tcp_rtlookup6(inp, input_ifscope);
5842 }
5843 else
5844#endif /* INET6 */
5845 {
5846 rt = tcp_rtlookup(inp, input_ifscope);
5847 }
5848 isnetlocal = (tp->t_flags & TF_LOCAL);
5849
5850 if (rt == NULL) {
5851 tp->t_maxopd = tp->t_maxseg =
5852#if INET6
5853 isipv6 ? tcp_v6mssdflt :
5854#endif /* INET6 */
5855 tcp_mssdflt;
5856 return;
5857 }
5858 ifp = rt->rt_ifp;
5859 /*
5860 * Slower link window correction:
5861 * If a value is specificied for slowlink_wsize use it for
5862 * PPP links believed to be on a serial modem (speed <128Kbps).
5863 * Excludes 9600bps as it is the default value adversized
5864 * by pseudo-devices over ppp.
5865 */
5866 if (ifp->if_type == IFT_PPP && slowlink_wsize > 0 &&
5867 ifp->if_baudrate > 9600 && ifp->if_baudrate <= 128000) {
5868 tp->t_flags |= TF_SLOWLINK;
5869 }
5870 so = inp->inp_socket;
5871
5872 taop = rmx_taop(rt->rt_rmx);
5873 /*
5874 * Offer == -1 means that we didn't receive SYN yet,
5875 * use cached value in that case;
5876 */
5877 if (offer == -1)
5878 offer = taop->tao_mssopt;
5879 /*
5880 * Offer == 0 means that there was no MSS on the SYN segment,
5881 * in this case we use tcp_mssdflt.
5882 */
5883 if (offer == 0)
5884 offer =
5885#if INET6
5886 isipv6 ? tcp_v6mssdflt :
5887#endif /* INET6 */
5888 tcp_mssdflt;
5889 else {
5890 /*
5891 * Prevent DoS attack with too small MSS. Round up
5892 * to at least minmss.
5893 */
5894 offer = max(offer, tcp_minmss);
5895 /*
5896 * Sanity check: make sure that maxopd will be large
5897 * enough to allow some data on segments even is the
5898 * all the option space is used (40bytes). Otherwise
5899 * funny things may happen in tcp_output.
5900 */
5901 offer = max(offer, 64);
5902 }
5903 taop->tao_mssopt = offer;
5904
5905 /*
5906 * While we're here, check if there's an initial rtt
5907 * or rttvar. Convert from the route-table units
5908 * to scaled multiples of the slow timeout timer.
5909 */
5910 if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt) != 0) {
5911 tcp_getrt_rtt(tp, rt);
5912 } else {
5913 tp->t_rttmin = isnetlocal ? tcp_TCPTV_MIN : TCPTV_REXMTMIN;
5914 }
5915
5916#if INET6
5917 mss = (isipv6 ? tcp_maxmtu6(rt) : tcp_maxmtu(rt));
5918#else
5919 mss = tcp_maxmtu(rt);
5920#endif
5921
5922#if NECP
5923 // At this point, the mss is just the MTU. Adjust if necessary.
5924 mss = necp_socket_get_effective_mtu(inp, mss);
5925#endif /* NECP */
5926
5927 mss -= min_protoh;
5928
5929 if (rt->rt_rmx.rmx_mtu == 0) {
5930#if INET6
5931 if (isipv6) {
5932 if (!isnetlocal)
5933 mss = min(mss, tcp_v6mssdflt);
5934 } else
5935#endif /* INET6 */
5936 if (!isnetlocal)
5937 mss = min(mss, tcp_mssdflt);
5938 }
5939
5940 mss = min(mss, offer);
5941 /*
5942 * maxopd stores the maximum length of data AND options
5943 * in a segment; maxseg is the amount of data in a normal
5944 * segment. We need to store this value (maxopd) apart
5945 * from maxseg, because now every segment carries options
5946 * and thus we normally have somewhat less data in segments.
5947 */
5948 tp->t_maxopd = mss;
5949
5950 /*
5951 * origoffer==-1 indicates, that no segments were received yet.
5952 * In this case we just guess.
5953 */
5954 if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
5955 (origoffer == -1 ||
5956 (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP))
5957 mss -= TCPOLEN_TSTAMP_APPA;
5958
5959#if MPTCP
5960 mss -= mptcp_adj_mss(tp, FALSE);
5961#endif /* MPTCP */
5962 tp->t_maxseg = mss;
5963
5964 /*
5965 * Calculate corrected value for sb_max; ensure to upgrade the
5966 * numerator for large sb_max values else it will overflow.
5967 */
5968 sb_max_corrected = (sb_max * (u_int64_t)MCLBYTES) / (MSIZE + MCLBYTES);
5969
5970 /*
5971 * If there's a pipesize (ie loopback), change the socket
5972 * buffer to that size only if it's bigger than the current
5973 * sockbuf size. Make the socket buffers an integral
5974 * number of mss units; if the mss is larger than
5975 * the socket buffer, decrease the mss.
5976 */
5977#if RTV_SPIPE
5978 bufsize = rt->rt_rmx.rmx_sendpipe;
5979 if (bufsize < so->so_snd.sb_hiwat)
5980#endif
5981 bufsize = so->so_snd.sb_hiwat;
5982 if (bufsize < mss)
5983 mss = bufsize;
5984 else {
5985 bufsize = (((bufsize + (u_int64_t)mss - 1) / (u_int64_t)mss) * (u_int64_t)mss);
5986 if (bufsize > sb_max_corrected)
5987 bufsize = sb_max_corrected;
5988 (void)sbreserve(&so->so_snd, bufsize);
5989 }
5990 tp->t_maxseg = mss;
5991
5992 ASSERT(tp->t_maxseg);
5993
5994 /*
5995 * Update MSS using recommendation from link status report. This is
5996 * temporary
5997 */
5998 tcp_update_mss_locked(so, ifp);
5999
6000#if RTV_RPIPE
6001 bufsize = rt->rt_rmx.rmx_recvpipe;
6002 if (bufsize < so->so_rcv.sb_hiwat)
6003#endif
6004 bufsize = so->so_rcv.sb_hiwat;
6005 if (bufsize > mss) {
6006 bufsize = (((bufsize + (u_int64_t)mss - 1) / (u_int64_t)mss) * (u_int64_t)mss);
6007 if (bufsize > sb_max_corrected)
6008 bufsize = sb_max_corrected;
6009 (void)sbreserve(&so->so_rcv, bufsize);
6010 }
6011
6012 set_tcp_stream_priority(so);
6013
6014 if (rt->rt_rmx.rmx_ssthresh) {
6015 /*
6016 * There's some sort of gateway or interface
6017 * buffer limit on the path. Use this to set
6018 * slow-start threshold, but set the threshold to
6019 * no less than 2*mss.
6020 */
6021 tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh);
6022 tcpstat.tcps_usedssthresh++;
6023 } else {
6024 tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
6025 }
6026
6027 /*
6028 * Set the slow-start flight size depending on whether this
6029 * is a local network or not.
6030 */
6031 if (CC_ALGO(tp)->cwnd_init != NULL)
6032 CC_ALGO(tp)->cwnd_init(tp);
6033
6034 tcp_ccdbg_trace(tp, NULL, TCP_CC_CWND_INIT);
6035
6036 /* Route locked during lookup above */
6037 RT_UNLOCK(rt);
6038}
6039
6040/*
6041 * Determine the MSS option to send on an outgoing SYN.
6042 */
6043int
6044tcp_mssopt(struct tcpcb *tp)
6045{
6046 struct rtentry *rt;
6047 int mss;
6048#if INET6
6049 int isipv6;
6050 int min_protoh;
6051#endif
6052
6053#if INET6
6054 isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0;
6055 min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr)
6056 : sizeof (struct tcpiphdr);
6057#else
6058#define min_protoh (sizeof (struct tcpiphdr))
6059#endif
6060
6061#if INET6
6062 if (isipv6)
6063 rt = tcp_rtlookup6(tp->t_inpcb, IFSCOPE_NONE);
6064 else
6065#endif /* INET6 */
6066 rt = tcp_rtlookup(tp->t_inpcb, IFSCOPE_NONE);
6067 if (rt == NULL) {
6068 return (
6069#if INET6
6070 isipv6 ? tcp_v6mssdflt :
6071#endif /* INET6 */
6072 tcp_mssdflt);
6073 }
6074 /*
6075 * Slower link window correction:
6076 * If a value is specificied for slowlink_wsize use it for PPP links
6077 * believed to be on a serial modem (speed <128Kbps). Excludes 9600bps as
6078 * it is the default value adversized by pseudo-devices over ppp.
6079 */
6080 if (rt->rt_ifp->if_type == IFT_PPP && slowlink_wsize > 0 &&
6081 rt->rt_ifp->if_baudrate > 9600 && rt->rt_ifp->if_baudrate <= 128000) {
6082 tp->t_flags |= TF_SLOWLINK;
6083 }
6084
6085#if INET6
6086 mss = (isipv6 ? tcp_maxmtu6(rt) : tcp_maxmtu(rt));
6087#else
6088 mss = tcp_maxmtu(rt);
6089#endif
6090 /* Route locked during lookup above */
6091 RT_UNLOCK(rt);
6092
6093#if NECP
6094 // At this point, the mss is just the MTU. Adjust if necessary.
6095 mss = necp_socket_get_effective_mtu(tp->t_inpcb, mss);
6096#endif /* NECP */
6097
6098 return (mss - min_protoh);
6099}
6100
6101/*
6102 * On a partial ack arrives, force the retransmission of the
6103 * next unacknowledged segment. Do not clear tp->t_dupacks.
6104 * By setting snd_nxt to th_ack, this forces retransmission timer to
6105 * be started again.
6106 */
6107static void
6108tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th)
6109{
6110 tcp_seq onxt = tp->snd_nxt;
6111 u_int32_t ocwnd = tp->snd_cwnd;
6112 tp->t_timer[TCPT_REXMT] = 0;
6113 tp->t_timer[TCPT_PTO] = 0;
6114 tp->t_rtttime = 0;
6115 tp->snd_nxt = th->th_ack;
6116 /*
6117 * Set snd_cwnd to one segment beyond acknowledged offset
6118 * (tp->snd_una has not yet been updated when this function
6119 * is called)
6120 */
6121 tp->snd_cwnd = tp->t_maxseg + BYTES_ACKED(th, tp);
6122 tp->t_flags |= TF_ACKNOW;
6123 (void) tcp_output(tp);
6124 tp->snd_cwnd = ocwnd;
6125 if (SEQ_GT(onxt, tp->snd_nxt))
6126 tp->snd_nxt = onxt;
6127 /*
6128 * Partial window deflation. Relies on fact that tp->snd_una
6129 * not updated yet.
6130 */
6131 if (tp->snd_cwnd > BYTES_ACKED(th, tp))
6132 tp->snd_cwnd -= BYTES_ACKED(th, tp);
6133 else
6134 tp->snd_cwnd = 0;
6135 tp->snd_cwnd += tp->t_maxseg;
6136}
6137
6138/*
6139 * Drop a random TCP connection that hasn't been serviced yet and
6140 * is eligible for discard. There is a one in qlen chance that
6141 * we will return a null, saying that there are no dropable
6142 * requests. In this case, the protocol specific code should drop
6143 * the new request. This insures fairness.
6144 *
6145 * The listening TCP socket "head" must be locked
6146 */
6147static int
6148tcp_dropdropablreq(struct socket *head)
6149{
6150 struct socket *so, *sonext;
6151 unsigned int i, j, qlen;
6152 static u_int32_t rnd = 0;
6153 static u_int64_t old_runtime;
6154 static unsigned int cur_cnt, old_cnt;
6155 u_int64_t now_sec;
6156 struct inpcb *inp = NULL;
6157 struct tcpcb *tp;
6158
6159 if ((head->so_options & SO_ACCEPTCONN) == 0)
6160 return (0);
6161
6162 if (TAILQ_EMPTY(&head->so_incomp))
6163 return (0);
6164
6165 so_acquire_accept_list(head, NULL);
6166 socket_unlock(head, 0);
6167
6168 /*
6169 * Check if there is any socket in the incomp queue
6170 * that is closed because of a reset from the peer and is
6171 * waiting to be garbage collected. If so, pick that as
6172 * the victim
6173 */
6174 TAILQ_FOREACH_SAFE(so, &head->so_incomp, so_list, sonext) {
6175 inp = sotoinpcb(so);
6176 tp = intotcpcb(inp);
6177 if (tp != NULL && tp->t_state == TCPS_CLOSED &&
6178 so->so_head != NULL &&
6179 (so->so_state & (SS_INCOMP|SS_CANTSENDMORE|SS_CANTRCVMORE)) ==
6180 (SS_INCOMP|SS_CANTSENDMORE|SS_CANTRCVMORE)) {
6181 /*
6182 * The listen socket is already locked but we
6183 * can lock this socket here without lock ordering
6184 * issues because it is in the incomp queue and
6185 * is not visible to others.
6186 */
6187 if (socket_try_lock(so)) {
6188 so->so_usecount++;
6189 goto found_victim;
6190 } else {
6191 continue;
6192 }
6193 }
6194 }
6195
6196 so = TAILQ_FIRST(&head->so_incomp);
6197
6198 now_sec = net_uptime();
6199 if ((i = (now_sec - old_runtime)) != 0) {
6200 old_runtime = now_sec;
6201 old_cnt = cur_cnt / i;
6202 cur_cnt = 0;
6203 }
6204
6205 qlen = head->so_incqlen;
6206 if (rnd == 0)
6207 rnd = RandomULong();
6208
6209 if (++cur_cnt > qlen || old_cnt > qlen) {
6210 rnd = (314159 * rnd + 66329) & 0xffff;
6211 j = ((qlen + 1) * rnd) >> 16;
6212
6213 while (j-- && so)
6214 so = TAILQ_NEXT(so, so_list);
6215 }
6216 /* Find a connection that is not already closing (or being served) */
6217 while (so) {
6218 inp = (struct inpcb *)so->so_pcb;
6219
6220 sonext = TAILQ_NEXT(so, so_list);
6221
6222 if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) != WNT_STOPUSING) {
6223 /*
6224 * Avoid the issue of a socket being accepted
6225 * by one input thread and being dropped by
6226 * another input thread. If we can't get a hold
6227 * on this mutex, then grab the next socket in
6228 * line.
6229 */
6230 if (socket_try_lock(so)) {
6231 so->so_usecount++;
6232 if ((so->so_usecount == 2) &&
6233 (so->so_state & SS_INCOMP) &&
6234 !(so->so_flags & SOF_INCOMP_INPROGRESS)) {
6235 break;
6236 } else {
6237 /*
6238 * don't use if being accepted or
6239 * used in any other way
6240 */
6241 in_pcb_checkstate(inp, WNT_RELEASE, 1);
6242 socket_unlock(so, 1);
6243 }
6244 } else {
6245 /*
6246 * do not try to lock the inp in
6247 * in_pcb_checkstate because the lock
6248 * is already held in some other thread.
6249 * Only drop the inp_wntcnt reference.
6250 */
6251 in_pcb_checkstate(inp, WNT_RELEASE, 1);
6252 }
6253 }
6254 so = sonext;
6255 }
6256 if (so == NULL) {
6257 socket_lock(head, 0);
6258 so_release_accept_list(head);
6259 return (0);
6260 }
6261
6262 /* Makes sure socket is still in the right state to be discarded */
6263
6264 if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) {
6265 socket_unlock(so, 1);
6266 socket_lock(head, 0);
6267 so_release_accept_list(head);
6268 return (0);
6269 }
6270
6271found_victim:
6272 if (so->so_usecount != 2 || !(so->so_state & SS_INCOMP)) {
6273 /* do not discard: that socket is being accepted */
6274 socket_unlock(so, 1);
6275 socket_lock(head, 0);
6276 so_release_accept_list(head);
6277 return (0);
6278 }
6279
6280 socket_lock(head, 0);
6281 TAILQ_REMOVE(&head->so_incomp, so, so_list);
6282 head->so_incqlen--;
6283 head->so_qlen--;
6284 so->so_state &= ~SS_INCOMP;
6285 so->so_flags |= SOF_OVERFLOW;
6286 so->so_head = NULL;
6287 so_release_accept_list(head);
6288 socket_unlock(head, 0);
6289
6290 socket_lock_assert_owned(so);
6291 tp = sototcpcb(so);
6292
6293 tcp_close(tp);
6294 if (inp->inp_wantcnt > 0 && inp->inp_wantcnt != WNT_STOPUSING) {
6295 /*
6296 * Some one has a wantcnt on this pcb. Since WNT_ACQUIRE
6297 * doesn't require a lock, it could have happened while
6298 * we are holding the lock. This pcb will have to
6299 * be garbage collected later.
6300 * Release the reference held for so_incomp queue
6301 */
6302 VERIFY(so->so_usecount > 0);
6303 so->so_usecount--;
6304 socket_unlock(so, 1);
6305 } else {
6306 /*
6307 * Unlock this socket and leave the reference on.
6308 * We need to acquire the pcbinfo lock in order to
6309 * fully dispose it off
6310 */
6311 socket_unlock(so, 0);
6312
6313 lck_rw_lock_exclusive(tcbinfo.ipi_lock);
6314
6315 socket_lock(so, 0);
6316 /* Release the reference held for so_incomp queue */
6317 VERIFY(so->so_usecount > 0);
6318 so->so_usecount--;
6319
6320 if (so->so_usecount != 1 ||
6321 (inp->inp_wantcnt > 0 &&
6322 inp->inp_wantcnt != WNT_STOPUSING)) {
6323 /*
6324 * There is an extra wantcount or usecount
6325 * that must have been added when the socket
6326 * was unlocked. This socket will have to be
6327 * garbage collected later
6328 */
6329 socket_unlock(so, 1);
6330 } else {
6331 /* Drop the reference held for this function */
6332 VERIFY(so->so_usecount > 0);
6333 so->so_usecount--;
6334
6335 in_pcbdispose(inp);
6336 }
6337 lck_rw_done(tcbinfo.ipi_lock);
6338 }
6339 tcpstat.tcps_drops++;
6340
6341 socket_lock(head, 0);
6342 return(1);
6343}
6344
6345/* Set background congestion control on a socket */
6346void
6347tcp_set_background_cc(struct socket *so)
6348{
6349 tcp_set_new_cc(so, TCP_CC_ALGO_BACKGROUND_INDEX);
6350}
6351
6352/* Set foreground congestion control on a socket */
6353void
6354tcp_set_foreground_cc(struct socket *so)
6355{
6356 if (tcp_use_newreno)
6357 tcp_set_new_cc(so, TCP_CC_ALGO_NEWRENO_INDEX);
6358 else
6359 tcp_set_new_cc(so, TCP_CC_ALGO_CUBIC_INDEX);
6360}
6361
6362static void
6363tcp_set_new_cc(struct socket *so, uint16_t cc_index)
6364{
6365 struct inpcb *inp = sotoinpcb(so);
6366 struct tcpcb *tp = intotcpcb(inp);
6367 u_char old_cc_index = 0;
6368 if (tp->tcp_cc_index != cc_index) {
6369
6370 old_cc_index = tp->tcp_cc_index;
6371
6372 if (CC_ALGO(tp)->cleanup != NULL)
6373 CC_ALGO(tp)->cleanup(tp);
6374 tp->tcp_cc_index = cc_index;
6375
6376 tcp_cc_allocate_state(tp);
6377
6378 if (CC_ALGO(tp)->switch_to != NULL)
6379 CC_ALGO(tp)->switch_to(tp, old_cc_index);
6380
6381 tcp_ccdbg_trace(tp, NULL, TCP_CC_CHANGE_ALGO);
6382 }
6383}
6384
6385void
6386tcp_set_recv_bg(struct socket *so)
6387{
6388 if (!IS_TCP_RECV_BG(so))
6389 so->so_flags1 |= SOF1_TRAFFIC_MGT_TCP_RECVBG;
6390
6391 /* Unset Large Receive Offload on background sockets */
6392 so_set_lro(so, SO_TC_BK);
6393}
6394
6395void
6396tcp_clear_recv_bg(struct socket *so)
6397{
6398 if (IS_TCP_RECV_BG(so))
6399 so->so_flags1 &= ~(SOF1_TRAFFIC_MGT_TCP_RECVBG);
6400
6401 /*
6402 * Set/unset use of Large Receive Offload depending on
6403 * the traffic class
6404 */
6405 so_set_lro(so, so->so_traffic_class);
6406}
6407
6408void
6409inp_fc_unthrottle_tcp(struct inpcb *inp)
6410{
6411 struct tcpcb *tp = inp->inp_ppcb;
6412 /*
6413 * Back off the slow-start threshold and enter
6414 * congestion avoidance phase
6415 */
6416 if (CC_ALGO(tp)->pre_fr != NULL)
6417 CC_ALGO(tp)->pre_fr(tp);
6418
6419 tp->snd_cwnd = tp->snd_ssthresh;
6420 tp->t_flagsext &= ~TF_CWND_NONVALIDATED;
6421 /*
6422 * Restart counting for ABC as we changed the
6423 * congestion window just now.
6424 */
6425 tp->t_bytes_acked = 0;
6426
6427 /* Reset retransmit shift as we know that the reason
6428 * for delay in sending a packet is due to flow
6429 * control on the outgoing interface. There is no need
6430 * to backoff retransmit timer.
6431 */
6432 TCP_RESET_REXMT_STATE(tp);
6433
6434 /*
6435 * Start the output stream again. Since we are
6436 * not retransmitting data, do not reset the
6437 * retransmit timer or rtt calculation.
6438 */
6439 tcp_output(tp);
6440}
6441
6442static int
6443tcp_getstat SYSCTL_HANDLER_ARGS
6444{
6445#pragma unused(oidp, arg1, arg2)
6446
6447 int error;
6448 struct tcpstat *stat;
6449 stat = &tcpstat;
6450#if !CONFIG_EMBEDDED
6451 proc_t caller = PROC_NULL;
6452 proc_t caller_parent = PROC_NULL;
6453 char command_name[MAXCOMLEN + 1] = "";
6454 char parent_name[MAXCOMLEN + 1] = "";
6455 struct tcpstat zero_stat;
6456 if ((caller = proc_self()) != PROC_NULL) {
6457 /* get process name */
6458 strlcpy(command_name, caller->p_comm, sizeof(command_name));
6459
6460 /* get parent process name if possible */
6461 if ((caller_parent = proc_find(caller->p_ppid)) != PROC_NULL) {
6462 strlcpy(parent_name, caller_parent->p_comm,
6463 sizeof(parent_name));
6464 proc_rele(caller_parent);
6465 }
6466
6467 if ((escape_str(command_name, strlen(command_name) + 1,
6468 sizeof(command_name)) == 0) &&
6469 (escape_str(parent_name, strlen(parent_name) + 1,
6470 sizeof(parent_name)) == 0)) {
6471 kern_asl_msg(LOG_DEBUG, "messagetracer",
6472 5,
6473 "com.apple.message.domain",
6474 "com.apple.kernel.tcpstat", /* 1 */
6475 "com.apple.message.signature",
6476 "tcpstat", /* 2 */
6477 "com.apple.message.signature2", command_name, /* 3 */
6478 "com.apple.message.signature3", parent_name, /* 4 */
6479 "com.apple.message.summarize", "YES", /* 5 */
6480 NULL);
6481 }
6482 }
6483 if (caller != PROC_NULL)
6484 proc_rele(caller);
6485 if (tcp_disable_access_to_stats &&
6486 !kauth_cred_issuser(kauth_cred_get())) {
6487 bzero(&zero_stat, sizeof(zero_stat));
6488 stat = &zero_stat;
6489 }
6490
6491#endif /* !CONFIG_EMBEDDED */
6492
6493 if (req->oldptr == 0) {
6494 req->oldlen= (size_t)sizeof(struct tcpstat);
6495 }
6496
6497 error = SYSCTL_OUT(req, stat, MIN(sizeof (tcpstat), req->oldlen));
6498
6499 return (error);
6500
6501}
6502
6503/*
6504 * Checksum extended TCP header and data.
6505 */
6506int
6507tcp_input_checksum(int af, struct mbuf *m, struct tcphdr *th, int off, int tlen)
6508{
6509 struct ifnet *ifp = m->m_pkthdr.rcvif;
6510
6511 switch (af) {
6512 case AF_INET: {
6513 struct ip *ip = mtod(m, struct ip *);
6514 struct ipovly *ipov = (struct ipovly *)ip;
6515
6516 if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_DID_CSUM)
6517 return (0);
6518
6519 /* ip_stripoptions() must have been called before we get here */
6520 ASSERT((ip->ip_hl << 2) == sizeof (*ip));
6521
6522 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
6523 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
6524 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
6525 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
6526 th->th_sum = m->m_pkthdr.csum_rx_val;
6527 } else {
6528 uint32_t sum = m->m_pkthdr.csum_rx_val;
6529 uint32_t start = m->m_pkthdr.csum_rx_start;
6530 int32_t trailer = (m_pktlen(m) - (off + tlen));
6531
6532 /*
6533 * Perform 1's complement adjustment of octets
6534 * that got included/excluded in the hardware-
6535 * calculated checksum value. Ignore cases
6536 * where the value already includes the entire
6537 * IP header span, as the sum for those octets
6538 * would already be 0 by the time we get here;
6539 * IP has already performed its header checksum
6540 * checks. If we do need to adjust, restore
6541 * the original fields in the IP header when
6542 * computing the adjustment value. Also take
6543 * care of any trailing bytes and subtract out
6544 * their partial sum.
6545 */
6546 ASSERT(trailer >= 0);
6547 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
6548 ((start != 0 && start != off) || trailer)) {
6549 uint32_t swbytes = (uint32_t)trailer;
6550
6551 if (start < off) {
6552 ip->ip_len += sizeof (*ip);
6553#if BYTE_ORDER != BIG_ENDIAN
6554 HTONS(ip->ip_len);
6555 HTONS(ip->ip_off);
6556#endif /* BYTE_ORDER != BIG_ENDIAN */
6557 }
6558 /* callee folds in sum */
6559 sum = m_adj_sum16(m, start, off,
6560 tlen, sum);
6561 if (off > start)
6562 swbytes += (off - start);
6563 else
6564 swbytes += (start - off);
6565
6566 if (start < off) {
6567#if BYTE_ORDER != BIG_ENDIAN
6568 NTOHS(ip->ip_off);
6569 NTOHS(ip->ip_len);
6570#endif /* BYTE_ORDER != BIG_ENDIAN */
6571 ip->ip_len -= sizeof (*ip);
6572 }
6573
6574 if (swbytes != 0)
6575 tcp_in_cksum_stats(swbytes);
6576 if (trailer != 0)
6577 m_adj(m, -trailer);
6578 }
6579
6580 /* callee folds in sum */
6581 th->th_sum = in_pseudo(ip->ip_src.s_addr,
6582 ip->ip_dst.s_addr,
6583 sum + htonl(tlen + IPPROTO_TCP));
6584 }
6585 th->th_sum ^= 0xffff;
6586 } else {
6587 uint16_t ip_sum;
6588 int len;
6589 char b[9];
6590
6591 bcopy(ipov->ih_x1, b, sizeof (ipov->ih_x1));
6592 bzero(ipov->ih_x1, sizeof (ipov->ih_x1));
6593 ip_sum = ipov->ih_len;
6594 ipov->ih_len = (u_short)tlen;
6595#if BYTE_ORDER != BIG_ENDIAN
6596 HTONS(ipov->ih_len);
6597#endif
6598 len = sizeof (struct ip) + tlen;
6599 th->th_sum = in_cksum(m, len);
6600 bcopy(b, ipov->ih_x1, sizeof (ipov->ih_x1));
6601 ipov->ih_len = ip_sum;
6602
6603 tcp_in_cksum_stats(len);
6604 }
6605 break;
6606 }
6607#if INET6
6608 case AF_INET6: {
6609 struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *);
6610
6611 if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_DID_CSUM)
6612 return (0);
6613
6614 if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) ||
6615 (m->m_pkthdr.pkt_flags & PKTF_LOOP)) &&
6616 (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) {
6617 if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) {
6618 th->th_sum = m->m_pkthdr.csum_rx_val;
6619 } else {
6620 uint32_t sum = m->m_pkthdr.csum_rx_val;
6621 uint32_t start = m->m_pkthdr.csum_rx_start;
6622 int32_t trailer = (m_pktlen(m) - (off + tlen));
6623
6624 /*
6625 * Perform 1's complement adjustment of octets
6626 * that got included/excluded in the hardware-
6627 * calculated checksum value. Also take care
6628 * of any trailing bytes and subtract out their
6629 * partial sum.
6630 */
6631 ASSERT(trailer >= 0);
6632 if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) &&
6633 (start != off || trailer != 0)) {
6634 uint16_t s = 0, d = 0;
6635 uint32_t swbytes = (uint32_t)trailer;
6636
6637 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) {
6638 s = ip6->ip6_src.s6_addr16[1];
6639 ip6->ip6_src.s6_addr16[1] = 0 ;
6640 }
6641 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) {
6642 d = ip6->ip6_dst.s6_addr16[1];
6643 ip6->ip6_dst.s6_addr16[1] = 0;
6644 }
6645
6646 /* callee folds in sum */
6647 sum = m_adj_sum16(m, start, off,
6648 tlen, sum);
6649 if (off > start)
6650 swbytes += (off - start);
6651 else
6652 swbytes += (start - off);
6653
6654 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src))
6655 ip6->ip6_src.s6_addr16[1] = s;
6656 if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst))
6657 ip6->ip6_dst.s6_addr16[1] = d;
6658
6659 if (swbytes != 0)
6660 tcp_in6_cksum_stats(swbytes);
6661 if (trailer != 0)
6662 m_adj(m, -trailer);
6663 }
6664
6665 th->th_sum = in6_pseudo(
6666 &ip6->ip6_src, &ip6->ip6_dst,
6667 sum + htonl(tlen + IPPROTO_TCP));
6668 }
6669 th->th_sum ^= 0xffff;
6670 } else {
6671 tcp_in6_cksum_stats(tlen);
6672 th->th_sum = in6_cksum(m, IPPROTO_TCP, off, tlen);
6673 }
6674 break;
6675 }
6676#endif /* INET6 */
6677 default:
6678 VERIFY(0);
6679 /* NOTREACHED */
6680 }
6681
6682 if (th->th_sum != 0) {
6683 tcpstat.tcps_rcvbadsum++;
6684 IF_TCP_STATINC(ifp, badformat);
6685 return (-1);
6686 }
6687
6688 return (0);
6689}
6690
6691
6692SYSCTL_PROC(_net_inet_tcp, TCPCTL_STATS, stats,
6693 CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, tcp_getstat,
6694 "S,tcpstat", "TCP statistics (struct tcpstat, netinet/tcp_var.h)");
6695
6696static int
6697sysctl_rexmtthresh SYSCTL_HANDLER_ARGS
6698{
6699#pragma unused(arg1, arg2)
6700
6701 int error, val = tcprexmtthresh;
6702
6703 error = sysctl_handle_int(oidp, &val, 0, req);
6704 if (error || !req->newptr)
6705 return (error);
6706
6707 /*
6708 * Constrain the number of duplicate ACKs
6709 * to consider for TCP fast retransmit
6710 * to either 2 or 3
6711 */
6712
6713 if (val < 2 || val > 3)
6714 return (EINVAL);
6715
6716 tcprexmtthresh = val;
6717
6718 return (0);
6719}
6720
6721SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmt_thresh, CTLTYPE_INT | CTLFLAG_RW |
6722 CTLFLAG_LOCKED, &tcprexmtthresh, 0, &sysctl_rexmtthresh, "I",
6723 "Duplicate ACK Threshold for Fast Retransmit");
6724