qemu/slirp/tcp_input.c
<<
>>
Prefs
   1/*
   2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994
   3 *      The Regents of the University of California.  All rights reserved.
   4 *
   5 * Redistribution and use in source and binary forms, with or without
   6 * modification, are permitted provided that the following conditions
   7 * are met:
   8 * 1. Redistributions of source code must retain the above copyright
   9 *    notice, this list of conditions and the following disclaimer.
  10 * 2. Redistributions in binary form must reproduce the above copyright
  11 *    notice, this list of conditions and the following disclaimer in the
  12 *    documentation and/or other materials provided with the distribution.
  13 * 3. Neither the name of the University nor the names of its contributors
  14 *    may be used to endorse or promote products derived from this software
  15 *    without specific prior written permission.
  16 *
  17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  20 * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  27 * SUCH DAMAGE.
  28 *
  29 *      @(#)tcp_input.c 8.5 (Berkeley) 4/10/94
  30 * tcp_input.c,v 1.10 1994/10/13 18:36:32 wollman Exp
  31 */
  32
  33/*
  34 * Changes and additions relating to SLiRP
  35 * Copyright (c) 1995 Danny Gasparovski.
  36 *
  37 * Please read the file COPYRIGHT for the
  38 * terms and conditions of the copyright.
  39 */
  40
  41#include "qemu/osdep.h"
  42#include "slirp.h"
  43#include "ip_icmp.h"
  44
  45#define TCPREXMTTHRESH 3
  46
  47#define TCP_PAWS_IDLE   (24 * 24 * 60 * 60 * PR_SLOWHZ)
  48
  49/* for modulo comparisons of timestamps */
  50#define TSTMP_LT(a,b)   ((int)((a)-(b)) < 0)
  51#define TSTMP_GEQ(a,b)  ((int)((a)-(b)) >= 0)
  52
  53/*
  54 * Insert segment ti into reassembly queue of tcp with
  55 * control block tp.  Return TH_FIN if reassembly now includes
  56 * a segment with FIN.  The macro form does the common case inline
  57 * (segment is the next to be received on an established connection,
  58 * and the queue is empty), avoiding linkage into and removal
  59 * from the queue and repetition of various conversions.
  60 * Set DELACK for segments received in order, but ack immediately
  61 * when segments are out of order (so fast retransmit can work).
  62 */
  63#ifdef TCP_ACK_HACK
  64#define TCP_REASS(tp, ti, m, so, flags) {\
  65       if ((ti)->ti_seq == (tp)->rcv_nxt && \
  66           tcpfrag_list_empty(tp) && \
  67           (tp)->t_state == TCPS_ESTABLISHED) {\
  68               if (ti->ti_flags & TH_PUSH) \
  69                       tp->t_flags |= TF_ACKNOW; \
  70               else \
  71                       tp->t_flags |= TF_DELACK; \
  72               (tp)->rcv_nxt += (ti)->ti_len; \
  73               flags = (ti)->ti_flags & TH_FIN; \
  74               if (so->so_emu) { \
  75                       if (tcp_emu((so),(m))) sbappend((so), (m)); \
  76               } else \
  77                       sbappend((so), (m)); \
  78        } else {\
  79               (flags) = tcp_reass((tp), (ti), (m)); \
  80               tp->t_flags |= TF_ACKNOW; \
  81       } \
  82}
  83#else
  84#define TCP_REASS(tp, ti, m, so, flags) { \
  85        if ((ti)->ti_seq == (tp)->rcv_nxt && \
  86        tcpfrag_list_empty(tp) && \
  87            (tp)->t_state == TCPS_ESTABLISHED) { \
  88                tp->t_flags |= TF_DELACK; \
  89                (tp)->rcv_nxt += (ti)->ti_len; \
  90                flags = (ti)->ti_flags & TH_FIN; \
  91                if (so->so_emu) { \
  92                        if (tcp_emu((so),(m))) sbappend(so, (m)); \
  93                } else \
  94                        sbappend((so), (m)); \
  95        } else { \
  96                (flags) = tcp_reass((tp), (ti), (m)); \
  97                tp->t_flags |= TF_ACKNOW; \
  98        } \
  99}
 100#endif
 101static void tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt,
 102                          struct tcpiphdr *ti);
 103static void tcp_xmit_timer(register struct tcpcb *tp, int rtt);
 104
 105static int
 106tcp_reass(register struct tcpcb *tp, register struct tcpiphdr *ti,
 107          struct mbuf *m)
 108{
 109        register struct tcpiphdr *q;
 110        struct socket *so = tp->t_socket;
 111        int flags;
 112
 113        /*
 114         * Call with ti==NULL after become established to
 115         * force pre-ESTABLISHED data up to user socket.
 116         */
 117        if (ti == NULL)
 118                goto present;
 119
 120        /*
 121         * Find a segment which begins after this one does.
 122         */
 123        for (q = tcpfrag_list_first(tp); !tcpfrag_list_end(q, tp);
 124            q = tcpiphdr_next(q))
 125                if (SEQ_GT(q->ti_seq, ti->ti_seq))
 126                        break;
 127
 128        /*
 129         * If there is a preceding segment, it may provide some of
 130         * our data already.  If so, drop the data from the incoming
 131         * segment.  If it provides all of our data, drop us.
 132         */
 133        if (!tcpfrag_list_end(tcpiphdr_prev(q), tp)) {
 134                register int i;
 135                q = tcpiphdr_prev(q);
 136                /* conversion to int (in i) handles seq wraparound */
 137                i = q->ti_seq + q->ti_len - ti->ti_seq;
 138                if (i > 0) {
 139                        if (i >= ti->ti_len) {
 140                                m_free(m);
 141                                /*
 142                                 * Try to present any queued data
 143                                 * at the left window edge to the user.
 144                                 * This is needed after the 3-WHS
 145                                 * completes.
 146                                 */
 147                                goto present;   /* ??? */
 148                        }
 149                        m_adj(m, i);
 150                        ti->ti_len -= i;
 151                        ti->ti_seq += i;
 152                }
 153                q = tcpiphdr_next(q);
 154        }
 155        ti->ti_mbuf = m;
 156
 157        /*
 158         * While we overlap succeeding segments trim them or,
 159         * if they are completely covered, dequeue them.
 160         */
 161        while (!tcpfrag_list_end(q, tp)) {
 162                register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
 163                if (i <= 0)
 164                        break;
 165                if (i < q->ti_len) {
 166                        q->ti_seq += i;
 167                        q->ti_len -= i;
 168                        m_adj(q->ti_mbuf, i);
 169                        break;
 170                }
 171                q = tcpiphdr_next(q);
 172                m = tcpiphdr_prev(q)->ti_mbuf;
 173                remque(tcpiphdr2qlink(tcpiphdr_prev(q)));
 174                m_free(m);
 175        }
 176
 177        /*
 178         * Stick new segment in its place.
 179         */
 180        insque(tcpiphdr2qlink(ti), tcpiphdr2qlink(tcpiphdr_prev(q)));
 181
 182present:
 183        /*
 184         * Present data to user, advancing rcv_nxt through
 185         * completed sequence space.
 186         */
 187        if (!TCPS_HAVEESTABLISHED(tp->t_state))
 188                return (0);
 189        ti = tcpfrag_list_first(tp);
 190        if (tcpfrag_list_end(ti, tp) || ti->ti_seq != tp->rcv_nxt)
 191                return (0);
 192        if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
 193                return (0);
 194        do {
 195                tp->rcv_nxt += ti->ti_len;
 196                flags = ti->ti_flags & TH_FIN;
 197                remque(tcpiphdr2qlink(ti));
 198                m = ti->ti_mbuf;
 199                ti = tcpiphdr_next(ti);
 200                if (so->so_state & SS_FCANTSENDMORE)
 201                        m_free(m);
 202                else {
 203                        if (so->so_emu) {
 204                                if (tcp_emu(so,m)) sbappend(so, m);
 205                        } else
 206                                sbappend(so, m);
 207                }
 208        } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
 209        return (flags);
 210}
 211
 212/*
 213 * TCP input routine, follows pages 65-76 of the
 214 * protocol specification dated September, 1981 very closely.
 215 */
 216void
 217tcp_input(struct mbuf *m, int iphlen, struct socket *inso, unsigned short af)
 218{
 219        struct ip save_ip, *ip;
 220        struct ip6 save_ip6, *ip6;
 221        register struct tcpiphdr *ti;
 222        caddr_t optp = NULL;
 223        int optlen = 0;
 224        int len, tlen, off;
 225        register struct tcpcb *tp = NULL;
 226        register int tiflags;
 227        struct socket *so = NULL;
 228        int todrop, acked, ourfinisacked, needoutput = 0;
 229        int iss = 0;
 230        u_long tiwin;
 231        int ret;
 232        struct sockaddr_storage lhost, fhost;
 233        struct sockaddr_in *lhost4, *fhost4;
 234        struct sockaddr_in6 *lhost6, *fhost6;
 235    struct ex_list *ex_ptr;
 236    Slirp *slirp;
 237
 238        DEBUG_CALL("tcp_input");
 239        DEBUG_ARGS((dfd, " m = %p  iphlen = %2d  inso = %p\n",
 240                    m, iphlen, inso));
 241
 242        /*
 243         * If called with m == 0, then we're continuing the connect
 244         */
 245        if (m == NULL) {
 246                so = inso;
 247                slirp = so->slirp;
 248
 249                /* Re-set a few variables */
 250                tp = sototcpcb(so);
 251                m = so->so_m;
 252                so->so_m = NULL;
 253                ti = so->so_ti;
 254                tiwin = ti->ti_win;
 255                tiflags = ti->ti_flags;
 256
 257                goto cont_conn;
 258        }
 259        slirp = m->slirp;
 260
 261        ip = mtod(m, struct ip *);
 262        ip6 = mtod(m, struct ip6 *);
 263
 264        switch (af) {
 265        case AF_INET:
 266            if (iphlen > sizeof(struct ip)) {
 267                ip_stripoptions(m, (struct mbuf *)0);
 268                iphlen = sizeof(struct ip);
 269            }
 270            /* XXX Check if too short */
 271
 272
 273            /*
 274             * Save a copy of the IP header in case we want restore it
 275             * for sending an ICMP error message in response.
 276             */
 277            save_ip = *ip;
 278            save_ip.ip_len += iphlen;
 279
 280            /*
 281             * Get IP and TCP header together in first mbuf.
 282             * Note: IP leaves IP header in first mbuf.
 283             */
 284            m->m_data -= sizeof(struct tcpiphdr) - sizeof(struct ip)
 285                                                 - sizeof(struct tcphdr);
 286            m->m_len += sizeof(struct tcpiphdr) - sizeof(struct ip)
 287                                                - sizeof(struct tcphdr);
 288            ti = mtod(m, struct tcpiphdr *);
 289
 290            /*
 291             * Checksum extended TCP header and data.
 292             */
 293            tlen = ip->ip_len;
 294            tcpiphdr2qlink(ti)->next = tcpiphdr2qlink(ti)->prev = NULL;
 295            memset(&ti->ih_mbuf, 0 , sizeof(struct mbuf_ptr));
 296            memset(&ti->ti, 0, sizeof(ti->ti));
 297            ti->ti_x0 = 0;
 298            ti->ti_src = save_ip.ip_src;
 299            ti->ti_dst = save_ip.ip_dst;
 300            ti->ti_pr = save_ip.ip_p;
 301            ti->ti_len = htons((uint16_t)tlen);
 302            break;
 303
 304        case AF_INET6:
 305            /*
 306             * Save a copy of the IP header in case we want restore it
 307             * for sending an ICMP error message in response.
 308             */
 309            save_ip6 = *ip6;
 310            /*
 311             * Get IP and TCP header together in first mbuf.
 312             * Note: IP leaves IP header in first mbuf.
 313             */
 314            m->m_data -= sizeof(struct tcpiphdr) - (sizeof(struct ip6)
 315                                                 + sizeof(struct tcphdr));
 316            m->m_len  += sizeof(struct tcpiphdr) - (sizeof(struct ip6)
 317                                                 + sizeof(struct tcphdr));
 318            ti = mtod(m, struct tcpiphdr *);
 319
 320            tlen = ip6->ip_pl;
 321            tcpiphdr2qlink(ti)->next = tcpiphdr2qlink(ti)->prev = NULL;
 322            memset(&ti->ih_mbuf, 0 , sizeof(struct mbuf_ptr));
 323            memset(&ti->ti, 0, sizeof(ti->ti));
 324            ti->ti_x0 = 0;
 325            ti->ti_src6 = save_ip6.ip_src;
 326            ti->ti_dst6 = save_ip6.ip_dst;
 327            ti->ti_nh6 = save_ip6.ip_nh;
 328            ti->ti_len = htons((uint16_t)tlen);
 329            break;
 330
 331        default:
 332            g_assert_not_reached();
 333        }
 334
 335        len = ((sizeof(struct tcpiphdr) - sizeof(struct tcphdr)) + tlen);
 336        if (cksum(m, len)) {
 337            goto drop;
 338        }
 339
 340        /*
 341         * Check that TCP offset makes sense,
 342         * pull out TCP options and adjust length.              XXX
 343         */
 344        off = ti->ti_off << 2;
 345        if (off < sizeof (struct tcphdr) || off > tlen) {
 346          goto drop;
 347        }
 348        tlen -= off;
 349        ti->ti_len = tlen;
 350        if (off > sizeof (struct tcphdr)) {
 351          optlen = off - sizeof (struct tcphdr);
 352          optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
 353        }
 354        tiflags = ti->ti_flags;
 355
 356        /*
 357         * Convert TCP protocol specific fields to host format.
 358         */
 359        NTOHL(ti->ti_seq);
 360        NTOHL(ti->ti_ack);
 361        NTOHS(ti->ti_win);
 362        NTOHS(ti->ti_urp);
 363
 364        /*
 365         * Drop TCP, IP headers and TCP options.
 366         */
 367        m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 368        m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 369
 370        /*
 371         * Locate pcb for segment.
 372         */
 373findso:
 374        lhost.ss_family = af;
 375        fhost.ss_family = af;
 376        switch (af) {
 377        case AF_INET:
 378            lhost4 = (struct sockaddr_in *) &lhost;
 379            lhost4->sin_addr = ti->ti_src;
 380            lhost4->sin_port = ti->ti_sport;
 381            fhost4 = (struct sockaddr_in *) &fhost;
 382            fhost4->sin_addr = ti->ti_dst;
 383            fhost4->sin_port = ti->ti_dport;
 384            break;
 385        case AF_INET6:
 386            lhost6 = (struct sockaddr_in6 *) &lhost;
 387            lhost6->sin6_addr = ti->ti_src6;
 388            lhost6->sin6_port = ti->ti_sport;
 389            fhost6 = (struct sockaddr_in6 *) &fhost;
 390            fhost6->sin6_addr = ti->ti_dst6;
 391            fhost6->sin6_port = ti->ti_dport;
 392            break;
 393        default:
 394            g_assert_not_reached();
 395        }
 396
 397        so = solookup(&slirp->tcp_last_so, &slirp->tcb, &lhost, &fhost);
 398
 399        /*
 400         * If the state is CLOSED (i.e., TCB does not exist) then
 401         * all data in the incoming segment is discarded.
 402         * If the TCB exists but is in CLOSED state, it is embryonic,
 403         * but should either do a listen or a connect soon.
 404         *
 405         * state == CLOSED means we've done socreate() but haven't
 406         * attached it to a protocol yet...
 407         *
 408         * XXX If a TCB does not exist, and the TH_SYN flag is
 409         * the only flag set, then create a session, mark it
 410         * as if it was LISTENING, and continue...
 411         */
 412        if (so == NULL) {
 413          if (slirp->restricted) {
 414            /* Any hostfwds will have an existing socket, so we only get here
 415             * for non-hostfwd connections. These should be dropped, unless it
 416             * happens to be a guestfwd.
 417             */
 418            for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) {
 419                if (ex_ptr->ex_fport == ti->ti_dport &&
 420                    ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) {
 421                    break;
 422                }
 423            }
 424            if (!ex_ptr) {
 425                goto dropwithreset;
 426            }
 427          }
 428
 429          if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN)
 430            goto dropwithreset;
 431
 432          if ((so = socreate(slirp)) == NULL)
 433            goto dropwithreset;
 434          if (tcp_attach(so) < 0) {
 435            free(so); /* Not sofree (if it failed, it's not insqued) */
 436            goto dropwithreset;
 437          }
 438
 439          sbreserve(&so->so_snd, TCP_SNDSPACE);
 440          sbreserve(&so->so_rcv, TCP_RCVSPACE);
 441
 442          so->lhost.ss = lhost;
 443          so->fhost.ss = fhost;
 444
 445          so->so_iptos = tcp_tos(so);
 446          if (so->so_iptos == 0) {
 447              switch (af) {
 448              case AF_INET:
 449                  so->so_iptos = ((struct ip *)ti)->ip_tos;
 450                  break;
 451              case AF_INET6:
 452                  break;
 453              default:
 454                  g_assert_not_reached();
 455              }
 456          }
 457
 458          tp = sototcpcb(so);
 459          tp->t_state = TCPS_LISTEN;
 460        }
 461
 462        /*
 463         * If this is a still-connecting socket, this probably
 464         * a retransmit of the SYN.  Whether it's a retransmit SYN
 465         * or something else, we nuke it.
 466         */
 467        if (so->so_state & SS_ISFCONNECTING)
 468                goto drop;
 469
 470        tp = sototcpcb(so);
 471
 472        /* XXX Should never fail */
 473        if (tp == NULL)
 474                goto dropwithreset;
 475        if (tp->t_state == TCPS_CLOSED)
 476                goto drop;
 477
 478        tiwin = ti->ti_win;
 479
 480        /*
 481         * Segment received on connection.
 482         * Reset idle time and keep-alive timer.
 483         */
 484        tp->t_idle = 0;
 485        if (SO_OPTIONS)
 486           tp->t_timer[TCPT_KEEP] = TCPTV_KEEPINTVL;
 487        else
 488           tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_IDLE;
 489
 490        /*
 491         * Process options if not in LISTEN state,
 492         * else do it below (after getting remote address).
 493         */
 494        if (optp && tp->t_state != TCPS_LISTEN)
 495                tcp_dooptions(tp, (u_char *)optp, optlen, ti);
 496
 497        /*
 498         * Header prediction: check for the two common cases
 499         * of a uni-directional data xfer.  If the packet has
 500         * no control flags, is in-sequence, the window didn't
 501         * change and we're not retransmitting, it's a
 502         * candidate.  If the length is zero and the ack moved
 503         * forward, we're the sender side of the xfer.  Just
 504         * free the data acked & wake any higher level process
 505         * that was blocked waiting for space.  If the length
 506         * is non-zero and the ack didn't move, we're the
 507         * receiver side.  If we're getting packets in-order
 508         * (the reassembly queue is empty), add the data to
 509         * the socket buffer and note that we need a delayed ack.
 510         *
 511         * XXX Some of these tests are not needed
 512         * eg: the tiwin == tp->snd_wnd prevents many more
 513         * predictions.. with no *real* advantage..
 514         */
 515        if (tp->t_state == TCPS_ESTABLISHED &&
 516            (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
 517            ti->ti_seq == tp->rcv_nxt &&
 518            tiwin && tiwin == tp->snd_wnd &&
 519            tp->snd_nxt == tp->snd_max) {
 520                if (ti->ti_len == 0) {
 521                        if (SEQ_GT(ti->ti_ack, tp->snd_una) &&
 522                            SEQ_LEQ(ti->ti_ack, tp->snd_max) &&
 523                            tp->snd_cwnd >= tp->snd_wnd) {
 524                                /*
 525                                 * this is a pure ack for outstanding data.
 526                                 */
 527                                if (tp->t_rtt &&
 528                                    SEQ_GT(ti->ti_ack, tp->t_rtseq))
 529                                        tcp_xmit_timer(tp, tp->t_rtt);
 530                                acked = ti->ti_ack - tp->snd_una;
 531                                sbdrop(&so->so_snd, acked);
 532                                tp->snd_una = ti->ti_ack;
 533                                m_free(m);
 534
 535                                /*
 536                                 * If all outstanding data are acked, stop
 537                                 * retransmit timer, otherwise restart timer
 538                                 * using current (possibly backed-off) value.
 539                                 * If process is waiting for space,
 540                                 * wakeup/selwakeup/signal.  If data
 541                                 * are ready to send, let tcp_output
 542                                 * decide between more output or persist.
 543                                 */
 544                                if (tp->snd_una == tp->snd_max)
 545                                        tp->t_timer[TCPT_REXMT] = 0;
 546                                else if (tp->t_timer[TCPT_PERSIST] == 0)
 547                                        tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
 548
 549                                /*
 550                                 * This is called because sowwakeup might have
 551                                 * put data into so_snd.  Since we don't so sowwakeup,
 552                                 * we don't need this.. XXX???
 553                                 */
 554                                if (so->so_snd.sb_cc)
 555                                        (void) tcp_output(tp);
 556
 557                                return;
 558                        }
 559                } else if (ti->ti_ack == tp->snd_una &&
 560                    tcpfrag_list_empty(tp) &&
 561                    ti->ti_len <= sbspace(&so->so_rcv)) {
 562                        /*
 563                         * this is a pure, in-sequence data packet
 564                         * with nothing on the reassembly queue and
 565                         * we have enough buffer space to take it.
 566                         */
 567                        tp->rcv_nxt += ti->ti_len;
 568                        /*
 569                         * Add data to socket buffer.
 570                         */
 571                        if (so->so_emu) {
 572                                if (tcp_emu(so,m)) sbappend(so, m);
 573                        } else
 574                                sbappend(so, m);
 575
 576                        /*
 577                         * If this is a short packet, then ACK now - with Nagel
 578                         *      congestion avoidance sender won't send more until
 579                         *      he gets an ACK.
 580                         *
 581                         * It is better to not delay acks at all to maximize
 582                         * TCP throughput.  See RFC 2581.
 583                         */
 584                        tp->t_flags |= TF_ACKNOW;
 585                        tcp_output(tp);
 586                        return;
 587                }
 588        } /* header prediction */
 589        /*
 590         * Calculate amount of space in receive window,
 591         * and then do TCP input processing.
 592         * Receive window is amount of space in rcv queue,
 593         * but not less than advertised window.
 594         */
 595        { int win;
 596          win = sbspace(&so->so_rcv);
 597          if (win < 0)
 598            win = 0;
 599          tp->rcv_wnd = MAX(win, (int)(tp->rcv_adv - tp->rcv_nxt));
 600        }
 601
 602        switch (tp->t_state) {
 603
 604        /*
 605         * If the state is LISTEN then ignore segment if it contains an RST.
 606         * If the segment contains an ACK then it is bad and send a RST.
 607         * If it does not contain a SYN then it is not interesting; drop it.
 608         * Don't bother responding if the destination was a broadcast.
 609         * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
 610         * tp->iss, and send a segment:
 611         *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
 612         * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
 613         * Fill in remote peer address fields if not previously specified.
 614         * Enter SYN_RECEIVED state, and process any other fields of this
 615         * segment in this state.
 616         */
 617        case TCPS_LISTEN: {
 618
 619          if (tiflags & TH_RST)
 620            goto drop;
 621          if (tiflags & TH_ACK)
 622            goto dropwithreset;
 623          if ((tiflags & TH_SYN) == 0)
 624            goto drop;
 625
 626          /*
 627           * This has way too many gotos...
 628           * But a bit of spaghetti code never hurt anybody :)
 629           */
 630
 631          /*
 632           * If this is destined for the control address, then flag to
 633           * tcp_ctl once connected, otherwise connect
 634           */
 635          if (af == AF_INET &&
 636                 (so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) ==
 637                 slirp->vnetwork_addr.s_addr) {
 638            if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr &&
 639                so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) {
 640                /* May be an add exec */
 641                for (ex_ptr = slirp->exec_list; ex_ptr;
 642                     ex_ptr = ex_ptr->ex_next) {
 643                  if(ex_ptr->ex_fport == so->so_fport &&
 644                     so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) {
 645                    so->so_state |= SS_CTL;
 646                    break;
 647                  }
 648                }
 649                if (so->so_state & SS_CTL) {
 650                    goto cont_input;
 651                }
 652            }
 653            /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */
 654          }
 655
 656          if (so->so_emu & EMU_NOCONNECT) {
 657            so->so_emu &= ~EMU_NOCONNECT;
 658            goto cont_input;
 659          }
 660
 661          if ((tcp_fconnect(so, so->so_ffamily) == -1) &&
 662              (errno != EAGAIN) &&
 663              (errno != EINPROGRESS) && (errno != EWOULDBLOCK)
 664          ) {
 665            uint8_t code;
 666            DEBUG_MISC((dfd, " tcp fconnect errno = %d-%s\n",
 667                        errno,strerror(errno)));
 668            if(errno == ECONNREFUSED) {
 669              /* ACK the SYN, send RST to refuse the connection */
 670              tcp_respond(tp, ti, m, ti->ti_seq + 1, (tcp_seq) 0,
 671                          TH_RST | TH_ACK, af);
 672            } else {
 673              switch (af) {
 674              case AF_INET:
 675                code = ICMP_UNREACH_NET;
 676                if (errno == EHOSTUNREACH) {
 677                  code = ICMP_UNREACH_HOST;
 678                }
 679                break;
 680              case AF_INET6:
 681                code = ICMP6_UNREACH_NO_ROUTE;
 682                if (errno == EHOSTUNREACH) {
 683                  code = ICMP6_UNREACH_ADDRESS;
 684                }
 685                break;
 686              default:
 687                g_assert_not_reached();
 688              }
 689              HTONL(ti->ti_seq);             /* restore tcp header */
 690              HTONL(ti->ti_ack);
 691              HTONS(ti->ti_win);
 692              HTONS(ti->ti_urp);
 693              m->m_data -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 694              m->m_len  += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);
 695              switch (af) {
 696              case AF_INET:
 697                m->m_data += sizeof(struct tcpiphdr) - sizeof(struct ip)
 698                                                     - sizeof(struct tcphdr);
 699                m->m_len  -= sizeof(struct tcpiphdr) - sizeof(struct ip)
 700                                                     - sizeof(struct tcphdr);
 701                *ip = save_ip;
 702                icmp_send_error(m, ICMP_UNREACH, code, 0, strerror(errno));
 703                break;
 704              case AF_INET6:
 705                m->m_data += sizeof(struct tcpiphdr) - (sizeof(struct ip6)
 706                                                     + sizeof(struct tcphdr));
 707                m->m_len  -= sizeof(struct tcpiphdr) - (sizeof(struct ip6)
 708                                                     + sizeof(struct tcphdr));
 709                *ip6 = save_ip6;
 710                icmp6_send_error(m, ICMP6_UNREACH, code);
 711                break;
 712              default:
 713                g_assert_not_reached();
 714              }
 715            }
 716            tcp_close(tp);
 717            m_free(m);
 718          } else {
 719            /*
 720             * Haven't connected yet, save the current mbuf
 721             * and ti, and return
 722             * XXX Some OS's don't tell us whether the connect()
 723             * succeeded or not.  So we must time it out.
 724             */
 725            so->so_m = m;
 726            so->so_ti = ti;
 727            tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
 728            tp->t_state = TCPS_SYN_RECEIVED;
 729            /*
 730             * Initialize receive sequence numbers now so that we can send a
 731             * valid RST if the remote end rejects our connection.
 732             */
 733            tp->irs = ti->ti_seq;
 734            tcp_rcvseqinit(tp);
 735            tcp_template(tp);
 736          }
 737          return;
 738
 739        cont_conn:
 740          /* m==NULL
 741           * Check if the connect succeeded
 742           */
 743          if (so->so_state & SS_NOFDREF) {
 744            tp = tcp_close(tp);
 745            goto dropwithreset;
 746          }
 747        cont_input:
 748          tcp_template(tp);
 749
 750          if (optp)
 751            tcp_dooptions(tp, (u_char *)optp, optlen, ti);
 752
 753          if (iss)
 754            tp->iss = iss;
 755          else
 756            tp->iss = slirp->tcp_iss;
 757          slirp->tcp_iss += TCP_ISSINCR/2;
 758          tp->irs = ti->ti_seq;
 759          tcp_sendseqinit(tp);
 760          tcp_rcvseqinit(tp);
 761          tp->t_flags |= TF_ACKNOW;
 762          tp->t_state = TCPS_SYN_RECEIVED;
 763          tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
 764          goto trimthenstep6;
 765        } /* case TCPS_LISTEN */
 766
 767        /*
 768         * If the state is SYN_SENT:
 769         *      if seg contains an ACK, but not for our SYN, drop the input.
 770         *      if seg contains a RST, then drop the connection.
 771         *      if seg does not contain SYN, then drop it.
 772         * Otherwise this is an acceptable SYN segment
 773         *      initialize tp->rcv_nxt and tp->irs
 774         *      if seg contains ack then advance tp->snd_una
 775         *      if SYN has been acked change to ESTABLISHED else SYN_RCVD state
 776         *      arrange for segment to be acked (eventually)
 777         *      continue processing rest of data/controls, beginning with URG
 778         */
 779        case TCPS_SYN_SENT:
 780                if ((tiflags & TH_ACK) &&
 781                    (SEQ_LEQ(ti->ti_ack, tp->iss) ||
 782                     SEQ_GT(ti->ti_ack, tp->snd_max)))
 783                        goto dropwithreset;
 784
 785                if (tiflags & TH_RST) {
 786                        if (tiflags & TH_ACK) {
 787                                tcp_drop(tp, 0); /* XXX Check t_softerror! */
 788                        }
 789                        goto drop;
 790                }
 791
 792                if ((tiflags & TH_SYN) == 0)
 793                        goto drop;
 794                if (tiflags & TH_ACK) {
 795                        tp->snd_una = ti->ti_ack;
 796                        if (SEQ_LT(tp->snd_nxt, tp->snd_una))
 797                                tp->snd_nxt = tp->snd_una;
 798                }
 799
 800                tp->t_timer[TCPT_REXMT] = 0;
 801                tp->irs = ti->ti_seq;
 802                tcp_rcvseqinit(tp);
 803                tp->t_flags |= TF_ACKNOW;
 804                if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) {
 805                        soisfconnected(so);
 806                        tp->t_state = TCPS_ESTABLISHED;
 807
 808                        (void) tcp_reass(tp, (struct tcpiphdr *)0,
 809                                (struct mbuf *)0);
 810                        /*
 811                         * if we didn't have to retransmit the SYN,
 812                         * use its rtt as our initial srtt & rtt var.
 813                         */
 814                        if (tp->t_rtt)
 815                                tcp_xmit_timer(tp, tp->t_rtt);
 816                } else
 817                        tp->t_state = TCPS_SYN_RECEIVED;
 818
 819trimthenstep6:
 820                /*
 821                 * Advance ti->ti_seq to correspond to first data byte.
 822                 * If data, trim to stay within window,
 823                 * dropping FIN if necessary.
 824                 */
 825                ti->ti_seq++;
 826                if (ti->ti_len > tp->rcv_wnd) {
 827                        todrop = ti->ti_len - tp->rcv_wnd;
 828                        m_adj(m, -todrop);
 829                        ti->ti_len = tp->rcv_wnd;
 830                        tiflags &= ~TH_FIN;
 831                }
 832                tp->snd_wl1 = ti->ti_seq - 1;
 833                tp->rcv_up = ti->ti_seq;
 834                goto step6;
 835        } /* switch tp->t_state */
 836        /*
 837         * States other than LISTEN or SYN_SENT.
 838         * Check that at least some bytes of segment are within
 839         * receive window.  If segment begins before rcv_nxt,
 840         * drop leading data (and SYN); if nothing left, just ack.
 841         */
 842        todrop = tp->rcv_nxt - ti->ti_seq;
 843        if (todrop > 0) {
 844                if (tiflags & TH_SYN) {
 845                        tiflags &= ~TH_SYN;
 846                        ti->ti_seq++;
 847                        if (ti->ti_urp > 1)
 848                                ti->ti_urp--;
 849                        else
 850                                tiflags &= ~TH_URG;
 851                        todrop--;
 852                }
 853                /*
 854                 * Following if statement from Stevens, vol. 2, p. 960.
 855                 */
 856                if (todrop > ti->ti_len
 857                    || (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) {
 858                        /*
 859                         * Any valid FIN must be to the left of the window.
 860                         * At this point the FIN must be a duplicate or out
 861                         * of sequence; drop it.
 862                         */
 863                        tiflags &= ~TH_FIN;
 864
 865                        /*
 866                         * Send an ACK to resynchronize and drop any data.
 867                         * But keep on processing for RST or ACK.
 868                         */
 869                        tp->t_flags |= TF_ACKNOW;
 870                        todrop = ti->ti_len;
 871                }
 872                m_adj(m, todrop);
 873                ti->ti_seq += todrop;
 874                ti->ti_len -= todrop;
 875                if (ti->ti_urp > todrop)
 876                        ti->ti_urp -= todrop;
 877                else {
 878                        tiflags &= ~TH_URG;
 879                        ti->ti_urp = 0;
 880                }
 881        }
 882        /*
 883         * If new data are received on a connection after the
 884         * user processes are gone, then RST the other end.
 885         */
 886        if ((so->so_state & SS_NOFDREF) &&
 887            tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) {
 888                tp = tcp_close(tp);
 889                goto dropwithreset;
 890        }
 891
 892        /*
 893         * If segment ends after window, drop trailing data
 894         * (and PUSH and FIN); if nothing left, just ACK.
 895         */
 896        todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
 897        if (todrop > 0) {
 898                if (todrop >= ti->ti_len) {
 899                        /*
 900                         * If a new connection request is received
 901                         * while in TIME_WAIT, drop the old connection
 902                         * and start over if the sequence numbers
 903                         * are above the previous ones.
 904                         */
 905                        if (tiflags & TH_SYN &&
 906                            tp->t_state == TCPS_TIME_WAIT &&
 907                            SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
 908                                iss = tp->rcv_nxt + TCP_ISSINCR;
 909                                tp = tcp_close(tp);
 910                                goto findso;
 911                        }
 912                        /*
 913                         * If window is closed can only take segments at
 914                         * window edge, and have to drop data and PUSH from
 915                         * incoming segments.  Continue processing, but
 916                         * remember to ack.  Otherwise, drop segment
 917                         * and ack.
 918                         */
 919                        if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) {
 920                                tp->t_flags |= TF_ACKNOW;
 921                        } else {
 922                                goto dropafterack;
 923                        }
 924                }
 925                m_adj(m, -todrop);
 926                ti->ti_len -= todrop;
 927                tiflags &= ~(TH_PUSH|TH_FIN);
 928        }
 929
 930        /*
 931         * If the RST bit is set examine the state:
 932         *    SYN_RECEIVED STATE:
 933         *      If passive open, return to LISTEN state.
 934         *      If active open, inform user that connection was refused.
 935         *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
 936         *      Inform user that connection was reset, and close tcb.
 937         *    CLOSING, LAST_ACK, TIME_WAIT STATES
 938         *      Close the tcb.
 939         */
 940        if (tiflags&TH_RST) switch (tp->t_state) {
 941
 942        case TCPS_SYN_RECEIVED:
 943        case TCPS_ESTABLISHED:
 944        case TCPS_FIN_WAIT_1:
 945        case TCPS_FIN_WAIT_2:
 946        case TCPS_CLOSE_WAIT:
 947                tp->t_state = TCPS_CLOSED;
 948                tcp_close(tp);
 949                goto drop;
 950
 951        case TCPS_CLOSING:
 952        case TCPS_LAST_ACK:
 953        case TCPS_TIME_WAIT:
 954                tcp_close(tp);
 955                goto drop;
 956        }
 957
 958        /*
 959         * If a SYN is in the window, then this is an
 960         * error and we send an RST and drop the connection.
 961         */
 962        if (tiflags & TH_SYN) {
 963                tp = tcp_drop(tp,0);
 964                goto dropwithreset;
 965        }
 966
 967        /*
 968         * If the ACK bit is off we drop the segment and return.
 969         */
 970        if ((tiflags & TH_ACK) == 0) goto drop;
 971
 972        /*
 973         * Ack processing.
 974         */
 975        switch (tp->t_state) {
 976        /*
 977         * In SYN_RECEIVED state if the ack ACKs our SYN then enter
 978         * ESTABLISHED state and continue processing, otherwise
 979         * send an RST.  una<=ack<=max
 980         */
 981        case TCPS_SYN_RECEIVED:
 982
 983                if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
 984                    SEQ_GT(ti->ti_ack, tp->snd_max))
 985                        goto dropwithreset;
 986                tp->t_state = TCPS_ESTABLISHED;
 987                /*
 988                 * The sent SYN is ack'ed with our sequence number +1
 989                 * The first data byte already in the buffer will get
 990                 * lost if no correction is made.  This is only needed for
 991                 * SS_CTL since the buffer is empty otherwise.
 992                 * tp->snd_una++; or:
 993                 */
 994                tp->snd_una=ti->ti_ack;
 995                if (so->so_state & SS_CTL) {
 996                  /* So tcp_ctl reports the right state */
 997                  ret = tcp_ctl(so);
 998                  if (ret == 1) {
 999                    soisfconnected(so);
1000                    so->so_state &= ~SS_CTL;   /* success XXX */
1001                  } else if (ret == 2) {
1002                    so->so_state &= SS_PERSISTENT_MASK;
1003                    so->so_state |= SS_NOFDREF; /* CTL_CMD */
1004                  } else {
1005                    needoutput = 1;
1006                    tp->t_state = TCPS_FIN_WAIT_1;
1007                  }
1008                } else {
1009                  soisfconnected(so);
1010                }
1011
1012                (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0);
1013                tp->snd_wl1 = ti->ti_seq - 1;
1014                /* Avoid ack processing; snd_una==ti_ack  =>  dup ack */
1015                goto synrx_to_est;
1016                /* fall into ... */
1017
1018        /*
1019         * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
1020         * ACKs.  If the ack is in the range
1021         *      tp->snd_una < ti->ti_ack <= tp->snd_max
1022         * then advance tp->snd_una to ti->ti_ack and drop
1023         * data from the retransmission queue.  If this ACK reflects
1024         * more up to date window information we update our window information.
1025         */
1026        case TCPS_ESTABLISHED:
1027        case TCPS_FIN_WAIT_1:
1028        case TCPS_FIN_WAIT_2:
1029        case TCPS_CLOSE_WAIT:
1030        case TCPS_CLOSING:
1031        case TCPS_LAST_ACK:
1032        case TCPS_TIME_WAIT:
1033
1034                if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) {
1035                        if (ti->ti_len == 0 && tiwin == tp->snd_wnd) {
1036                          DEBUG_MISC((dfd, " dup ack  m = %p  so = %p\n",
1037                                      m, so));
1038                                /*
1039                                 * If we have outstanding data (other than
1040                                 * a window probe), this is a completely
1041                                 * duplicate ack (ie, window info didn't
1042                                 * change), the ack is the biggest we've
1043                                 * seen and we've seen exactly our rexmt
1044                                 * threshold of them, assume a packet
1045                                 * has been dropped and retransmit it.
1046                                 * Kludge snd_nxt & the congestion
1047                                 * window so we send only this one
1048                                 * packet.
1049                                 *
1050                                 * We know we're losing at the current
1051                                 * window size so do congestion avoidance
1052                                 * (set ssthresh to half the current window
1053                                 * and pull our congestion window back to
1054                                 * the new ssthresh).
1055                                 *
1056                                 * Dup acks mean that packets have left the
1057                                 * network (they're now cached at the receiver)
1058                                 * so bump cwnd by the amount in the receiver
1059                                 * to keep a constant cwnd packets in the
1060                                 * network.
1061                                 */
1062                                if (tp->t_timer[TCPT_REXMT] == 0 ||
1063                                    ti->ti_ack != tp->snd_una)
1064                                        tp->t_dupacks = 0;
1065                                else if (++tp->t_dupacks == TCPREXMTTHRESH) {
1066                                        tcp_seq onxt = tp->snd_nxt;
1067                                        u_int win =
1068                                                MIN(tp->snd_wnd, tp->snd_cwnd) /
1069                                                2 / tp->t_maxseg;
1070
1071                                        if (win < 2)
1072                                                win = 2;
1073                                        tp->snd_ssthresh = win * tp->t_maxseg;
1074                                        tp->t_timer[TCPT_REXMT] = 0;
1075                                        tp->t_rtt = 0;
1076                                        tp->snd_nxt = ti->ti_ack;
1077                                        tp->snd_cwnd = tp->t_maxseg;
1078                                        (void) tcp_output(tp);
1079                                        tp->snd_cwnd = tp->snd_ssthresh +
1080                                               tp->t_maxseg * tp->t_dupacks;
1081                                        if (SEQ_GT(onxt, tp->snd_nxt))
1082                                                tp->snd_nxt = onxt;
1083                                        goto drop;
1084                                } else if (tp->t_dupacks > TCPREXMTTHRESH) {
1085                                        tp->snd_cwnd += tp->t_maxseg;
1086                                        (void) tcp_output(tp);
1087                                        goto drop;
1088                                }
1089                        } else
1090                                tp->t_dupacks = 0;
1091                        break;
1092                }
1093        synrx_to_est:
1094                /*
1095                 * If the congestion window was inflated to account
1096                 * for the other side's cached packets, retract it.
1097                 */
1098                if (tp->t_dupacks > TCPREXMTTHRESH &&
1099                    tp->snd_cwnd > tp->snd_ssthresh)
1100                        tp->snd_cwnd = tp->snd_ssthresh;
1101                tp->t_dupacks = 0;
1102                if (SEQ_GT(ti->ti_ack, tp->snd_max)) {
1103                        goto dropafterack;
1104                }
1105                acked = ti->ti_ack - tp->snd_una;
1106
1107                /*
1108                 * If transmit timer is running and timed sequence
1109                 * number was acked, update smoothed round trip time.
1110                 * Since we now have an rtt measurement, cancel the
1111                 * timer backoff (cf., Phil Karn's retransmit alg.).
1112                 * Recompute the initial retransmit timer.
1113                 */
1114                if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq))
1115                        tcp_xmit_timer(tp,tp->t_rtt);
1116
1117                /*
1118                 * If all outstanding data is acked, stop retransmit
1119                 * timer and remember to restart (more output or persist).
1120                 * If there is more data to be acked, restart retransmit
1121                 * timer, using current (possibly backed-off) value.
1122                 */
1123                if (ti->ti_ack == tp->snd_max) {
1124                        tp->t_timer[TCPT_REXMT] = 0;
1125                        needoutput = 1;
1126                } else if (tp->t_timer[TCPT_PERSIST] == 0)
1127                        tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;
1128                /*
1129                 * When new data is acked, open the congestion window.
1130                 * If the window gives us less than ssthresh packets
1131                 * in flight, open exponentially (maxseg per packet).
1132                 * Otherwise open linearly: maxseg per window
1133                 * (maxseg^2 / cwnd per packet).
1134                 */
1135                {
1136                  register u_int cw = tp->snd_cwnd;
1137                  register u_int incr = tp->t_maxseg;
1138
1139                  if (cw > tp->snd_ssthresh)
1140                    incr = incr * incr / cw;
1141                  tp->snd_cwnd = MIN(cw + incr, TCP_MAXWIN << tp->snd_scale);
1142                }
1143                if (acked > so->so_snd.sb_cc) {
1144                        tp->snd_wnd -= so->so_snd.sb_cc;
1145                        sbdrop(&so->so_snd, (int )so->so_snd.sb_cc);
1146                        ourfinisacked = 1;
1147                } else {
1148                        sbdrop(&so->so_snd, acked);
1149                        tp->snd_wnd -= acked;
1150                        ourfinisacked = 0;
1151                }
1152                tp->snd_una = ti->ti_ack;
1153                if (SEQ_LT(tp->snd_nxt, tp->snd_una))
1154                        tp->snd_nxt = tp->snd_una;
1155
1156                switch (tp->t_state) {
1157
1158                /*
1159                 * In FIN_WAIT_1 STATE in addition to the processing
1160                 * for the ESTABLISHED state if our FIN is now acknowledged
1161                 * then enter FIN_WAIT_2.
1162                 */
1163                case TCPS_FIN_WAIT_1:
1164                        if (ourfinisacked) {
1165                                /*
1166                                 * If we can't receive any more
1167                                 * data, then closing user can proceed.
1168                                 * Starting the timer is contrary to the
1169                                 * specification, but if we don't get a FIN
1170                                 * we'll hang forever.
1171                                 */
1172                                if (so->so_state & SS_FCANTRCVMORE) {
1173                                        tp->t_timer[TCPT_2MSL] = TCP_MAXIDLE;
1174                                }
1175                                tp->t_state = TCPS_FIN_WAIT_2;
1176                        }
1177                        break;
1178
1179                /*
1180                 * In CLOSING STATE in addition to the processing for
1181                 * the ESTABLISHED state if the ACK acknowledges our FIN
1182                 * then enter the TIME-WAIT state, otherwise ignore
1183                 * the segment.
1184                 */
1185                case TCPS_CLOSING:
1186                        if (ourfinisacked) {
1187                                tp->t_state = TCPS_TIME_WAIT;
1188                                tcp_canceltimers(tp);
1189                                tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1190                        }
1191                        break;
1192
1193                /*
1194                 * In LAST_ACK, we may still be waiting for data to drain
1195                 * and/or to be acked, as well as for the ack of our FIN.
1196                 * If our FIN is now acknowledged, delete the TCB,
1197                 * enter the closed state and return.
1198                 */
1199                case TCPS_LAST_ACK:
1200                        if (ourfinisacked) {
1201                                tcp_close(tp);
1202                                goto drop;
1203                        }
1204                        break;
1205
1206                /*
1207                 * In TIME_WAIT state the only thing that should arrive
1208                 * is a retransmission of the remote FIN.  Acknowledge
1209                 * it and restart the finack timer.
1210                 */
1211                case TCPS_TIME_WAIT:
1212                        tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1213                        goto dropafterack;
1214                }
1215        } /* switch(tp->t_state) */
1216
1217step6:
1218        /*
1219         * Update window information.
1220         * Don't look at window if no ACK: TAC's send garbage on first SYN.
1221         */
1222        if ((tiflags & TH_ACK) &&
1223            (SEQ_LT(tp->snd_wl1, ti->ti_seq) ||
1224            (tp->snd_wl1 == ti->ti_seq && (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
1225            (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd))))) {
1226                tp->snd_wnd = tiwin;
1227                tp->snd_wl1 = ti->ti_seq;
1228                tp->snd_wl2 = ti->ti_ack;
1229                if (tp->snd_wnd > tp->max_sndwnd)
1230                        tp->max_sndwnd = tp->snd_wnd;
1231                needoutput = 1;
1232        }
1233
1234        /*
1235         * Process segments with URG.
1236         */
1237        if ((tiflags & TH_URG) && ti->ti_urp &&
1238            TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1239                /*
1240                 * This is a kludge, but if we receive and accept
1241                 * random urgent pointers, we'll crash in
1242                 * soreceive.  It's hard to imagine someone
1243                 * actually wanting to send this much urgent data.
1244                 */
1245                if (ti->ti_urp + so->so_rcv.sb_cc > so->so_rcv.sb_datalen) {
1246                        ti->ti_urp = 0;
1247                        tiflags &= ~TH_URG;
1248                        goto dodata;
1249                }
1250                /*
1251                 * If this segment advances the known urgent pointer,
1252                 * then mark the data stream.  This should not happen
1253                 * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
1254                 * a FIN has been received from the remote side.
1255                 * In these states we ignore the URG.
1256                 *
1257                 * According to RFC961 (Assigned Protocols),
1258                 * the urgent pointer points to the last octet
1259                 * of urgent data.  We continue, however,
1260                 * to consider it to indicate the first octet
1261                 * of data past the urgent section as the original
1262                 * spec states (in one of two places).
1263                 */
1264                if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
1265                        tp->rcv_up = ti->ti_seq + ti->ti_urp;
1266                        so->so_urgc =  so->so_rcv.sb_cc +
1267                                (tp->rcv_up - tp->rcv_nxt); /* -1; */
1268                        tp->rcv_up = ti->ti_seq + ti->ti_urp;
1269
1270                }
1271        } else
1272                /*
1273                 * If no out of band data is expected,
1274                 * pull receive urgent pointer along
1275                 * with the receive window.
1276                 */
1277                if (SEQ_GT(tp->rcv_nxt, tp->rcv_up))
1278                        tp->rcv_up = tp->rcv_nxt;
1279dodata:
1280
1281        /*
1282         * If this is a small packet, then ACK now - with Nagel
1283         *      congestion avoidance sender won't send more until
1284         *      he gets an ACK.
1285         */
1286        if (ti->ti_len && (unsigned)ti->ti_len <= 5 &&
1287            ((struct tcpiphdr_2 *)ti)->first_char == (char)27) {
1288                tp->t_flags |= TF_ACKNOW;
1289        }
1290
1291        /*
1292         * Process the segment text, merging it into the TCP sequencing queue,
1293         * and arranging for acknowledgment of receipt if necessary.
1294         * This process logically involves adjusting tp->rcv_wnd as data
1295         * is presented to the user (this happens in tcp_usrreq.c,
1296         * case PRU_RCVD).  If a FIN has already been received on this
1297         * connection then we just ignore the text.
1298         */
1299        if ((ti->ti_len || (tiflags&TH_FIN)) &&
1300            TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1301                TCP_REASS(tp, ti, m, so, tiflags);
1302        } else {
1303                m_free(m);
1304                tiflags &= ~TH_FIN;
1305        }
1306
1307        /*
1308         * If FIN is received ACK the FIN and let the user know
1309         * that the connection is closing.
1310         */
1311        if (tiflags & TH_FIN) {
1312                if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
1313                        /*
1314                         * If we receive a FIN we can't send more data,
1315                         * set it SS_FDRAIN
1316                         * Shutdown the socket if there is no rx data in the
1317                         * buffer.
1318                         * soread() is called on completion of shutdown() and
1319                         * will got to TCPS_LAST_ACK, and use tcp_output()
1320                         * to send the FIN.
1321                         */
1322                        sofwdrain(so);
1323
1324                        tp->t_flags |= TF_ACKNOW;
1325                        tp->rcv_nxt++;
1326                }
1327                switch (tp->t_state) {
1328
1329                /*
1330                 * In SYN_RECEIVED and ESTABLISHED STATES
1331                 * enter the CLOSE_WAIT state.
1332                 */
1333                case TCPS_SYN_RECEIVED:
1334                case TCPS_ESTABLISHED:
1335                  if(so->so_emu == EMU_CTL)        /* no shutdown on socket */
1336                    tp->t_state = TCPS_LAST_ACK;
1337                  else
1338                    tp->t_state = TCPS_CLOSE_WAIT;
1339                  break;
1340
1341                /*
1342                 * If still in FIN_WAIT_1 STATE FIN has not been acked so
1343                 * enter the CLOSING state.
1344                 */
1345                case TCPS_FIN_WAIT_1:
1346                        tp->t_state = TCPS_CLOSING;
1347                        break;
1348
1349                /*
1350                 * In FIN_WAIT_2 state enter the TIME_WAIT state,
1351                 * starting the time-wait timer, turning off the other
1352                 * standard timers.
1353                 */
1354                case TCPS_FIN_WAIT_2:
1355                        tp->t_state = TCPS_TIME_WAIT;
1356                        tcp_canceltimers(tp);
1357                        tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1358                        break;
1359
1360                /*
1361                 * In TIME_WAIT state restart the 2 MSL time_wait timer.
1362                 */
1363                case TCPS_TIME_WAIT:
1364                        tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
1365                        break;
1366                }
1367        }
1368
1369        /*
1370         * Return any desired output.
1371         */
1372        if (needoutput || (tp->t_flags & TF_ACKNOW)) {
1373                (void) tcp_output(tp);
1374        }
1375        return;
1376
1377dropafterack:
1378        /*
1379         * Generate an ACK dropping incoming segment if it occupies
1380         * sequence space, where the ACK reflects our state.
1381         */
1382        if (tiflags & TH_RST)
1383                goto drop;
1384        m_free(m);
1385        tp->t_flags |= TF_ACKNOW;
1386        (void) tcp_output(tp);
1387        return;
1388
1389dropwithreset:
1390        /* reuses m if m!=NULL, m_free() unnecessary */
1391        if (tiflags & TH_ACK)
1392                tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST, af);
1393        else {
1394                if (tiflags & TH_SYN) ti->ti_len++;
1395                tcp_respond(tp, ti, m, ti->ti_seq + ti->ti_len, (tcp_seq) 0,
1396                    TH_RST | TH_ACK, af);
1397        }
1398
1399        return;
1400
1401drop:
1402        /*
1403         * Drop space held by incoming segment and return.
1404         */
1405        m_free(m);
1406}
1407
1408static void
1409tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcpiphdr *ti)
1410{
1411        uint16_t mss;
1412        int opt, optlen;
1413
1414        DEBUG_CALL("tcp_dooptions");
1415        DEBUG_ARGS((dfd, " tp = %p  cnt=%i\n", tp, cnt));
1416
1417        for (; cnt > 0; cnt -= optlen, cp += optlen) {
1418                opt = cp[0];
1419                if (opt == TCPOPT_EOL)
1420                        break;
1421                if (opt == TCPOPT_NOP)
1422                        optlen = 1;
1423                else {
1424                        optlen = cp[1];
1425                        if (optlen <= 0)
1426                                break;
1427                }
1428                switch (opt) {
1429
1430                default:
1431                        continue;
1432
1433                case TCPOPT_MAXSEG:
1434                        if (optlen != TCPOLEN_MAXSEG)
1435                                continue;
1436                        if (!(ti->ti_flags & TH_SYN))
1437                                continue;
1438                        memcpy((char *) &mss, (char *) cp + 2, sizeof(mss));
1439                        NTOHS(mss);
1440                        (void) tcp_mss(tp, mss);        /* sets t_maxseg */
1441                        break;
1442                }
1443        }
1444}
1445
1446
1447/*
1448 * Pull out of band byte out of a segment so
1449 * it doesn't appear in the user's data queue.
1450 * It is still reflected in the segment length for
1451 * sequencing purposes.
1452 */
1453
1454#ifdef notdef
1455
1456void
1457tcp_pulloutofband(so, ti, m)
1458        struct socket *so;
1459        struct tcpiphdr *ti;
1460        register struct mbuf *m;
1461{
1462        int cnt = ti->ti_urp - 1;
1463
1464        while (cnt >= 0) {
1465                if (m->m_len > cnt) {
1466                        char *cp = mtod(m, caddr_t) + cnt;
1467                        struct tcpcb *tp = sototcpcb(so);
1468
1469                        tp->t_iobc = *cp;
1470                        tp->t_oobflags |= TCPOOB_HAVEDATA;
1471                        memcpy(sp, cp+1, (unsigned)(m->m_len - cnt - 1));
1472                        m->m_len--;
1473                        return;
1474                }
1475                cnt -= m->m_len;
1476                m = m->m_next; /* XXX WRONG! Fix it! */
1477                if (m == 0)
1478                        break;
1479        }
1480        panic("tcp_pulloutofband");
1481}
1482
1483#endif /* notdef */
1484
1485/*
1486 * Collect new round-trip time estimate
1487 * and update averages and current timeout.
1488 */
1489
1490static void
1491tcp_xmit_timer(register struct tcpcb *tp, int rtt)
1492{
1493        register short delta;
1494
1495        DEBUG_CALL("tcp_xmit_timer");
1496        DEBUG_ARG("tp = %p", tp);
1497        DEBUG_ARG("rtt = %d", rtt);
1498
1499        if (tp->t_srtt != 0) {
1500                /*
1501                 * srtt is stored as fixed point with 3 bits after the
1502                 * binary point (i.e., scaled by 8).  The following magic
1503                 * is equivalent to the smoothing algorithm in rfc793 with
1504                 * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed
1505                 * point).  Adjust rtt to origin 0.
1506                 */
1507                delta = rtt - 1 - (tp->t_srtt >> TCP_RTT_SHIFT);
1508                if ((tp->t_srtt += delta) <= 0)
1509                        tp->t_srtt = 1;
1510                /*
1511                 * We accumulate a smoothed rtt variance (actually, a
1512                 * smoothed mean difference), then set the retransmit
1513                 * timer to smoothed rtt + 4 times the smoothed variance.
1514                 * rttvar is stored as fixed point with 2 bits after the
1515                 * binary point (scaled by 4).  The following is
1516                 * equivalent to rfc793 smoothing with an alpha of .75
1517                 * (rttvar = rttvar*3/4 + |delta| / 4).  This replaces
1518                 * rfc793's wired-in beta.
1519                 */
1520                if (delta < 0)
1521                        delta = -delta;
1522                delta -= (tp->t_rttvar >> TCP_RTTVAR_SHIFT);
1523                if ((tp->t_rttvar += delta) <= 0)
1524                        tp->t_rttvar = 1;
1525        } else {
1526                /*
1527                 * No rtt measurement yet - use the unsmoothed rtt.
1528                 * Set the variance to half the rtt (so our first
1529                 * retransmit happens at 3*rtt).
1530                 */
1531                tp->t_srtt = rtt << TCP_RTT_SHIFT;
1532                tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1);
1533        }
1534        tp->t_rtt = 0;
1535        tp->t_rxtshift = 0;
1536
1537        /*
1538         * the retransmit should happen at rtt + 4 * rttvar.
1539         * Because of the way we do the smoothing, srtt and rttvar
1540         * will each average +1/2 tick of bias.  When we compute
1541         * the retransmit timer, we want 1/2 tick of rounding and
1542         * 1 extra tick because of +-1/2 tick uncertainty in the
1543         * firing of the timer.  The bias will give us exactly the
1544         * 1.5 tick we need.  But, because the bias is
1545         * statistical, we have to test that we don't drop below
1546         * the minimum feasible timer (which is 2 ticks).
1547         */
1548        TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
1549            (short)tp->t_rttmin, TCPTV_REXMTMAX); /* XXX */
1550
1551        /*
1552         * We received an ack for a packet that wasn't retransmitted;
1553         * it is probably safe to discard any error indications we've
1554         * received recently.  This isn't quite right, but close enough
1555         * for now (a route might have failed after we sent a segment,
1556         * and the return path might not be symmetrical).
1557         */
1558        tp->t_softerror = 0;
1559}
1560
1561/*
1562 * Determine a reasonable value for maxseg size.
1563 * If the route is known, check route for mtu.
1564 * If none, use an mss that can be handled on the outgoing
1565 * interface without forcing IP to fragment; if bigger than
1566 * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES
1567 * to utilize large mbufs.  If no route is found, route has no mtu,
1568 * or the destination isn't local, use a default, hopefully conservative
1569 * size (usually 512 or the default IP max size, but no more than the mtu
1570 * of the interface), as we can't discover anything about intervening
1571 * gateways or networks.  We also initialize the congestion/slow start
1572 * window to be a single segment if the destination isn't local.
1573 * While looking at the routing entry, we also initialize other path-dependent
1574 * parameters from pre-set or cached values in the routing entry.
1575 */
1576
1577int
1578tcp_mss(struct tcpcb *tp, u_int offer)
1579{
1580        struct socket *so = tp->t_socket;
1581        int mss;
1582
1583        DEBUG_CALL("tcp_mss");
1584        DEBUG_ARG("tp = %p", tp);
1585        DEBUG_ARG("offer = %d", offer);
1586
1587        switch (so->so_ffamily) {
1588        case AF_INET:
1589            mss = MIN(IF_MTU, IF_MRU) - sizeof(struct tcphdr)
1590                                      - sizeof(struct ip);
1591            break;
1592        case AF_INET6:
1593            mss = MIN(IF_MTU, IF_MRU) - sizeof(struct tcphdr)
1594                                      - sizeof(struct ip6);
1595            break;
1596        default:
1597            g_assert_not_reached();
1598        }
1599
1600        if (offer)
1601            mss = MIN(mss, offer);
1602        mss = MAX(mss, 32);
1603        if (mss < tp->t_maxseg || offer != 0)
1604           tp->t_maxseg = mss;
1605
1606        tp->snd_cwnd = mss;
1607
1608        sbreserve(&so->so_snd, TCP_SNDSPACE + ((TCP_SNDSPACE % mss) ?
1609                                               (mss - (TCP_SNDSPACE % mss)) :
1610                                               0));
1611        sbreserve(&so->so_rcv, TCP_RCVSPACE + ((TCP_RCVSPACE % mss) ?
1612                                               (mss - (TCP_RCVSPACE % mss)) :
1613                                               0));
1614
1615        DEBUG_MISC((dfd, " returning mss = %d\n", mss));
1616
1617        return mss;
1618}
1619