root/netinet/tcp_subr.c

DEFINITIONS

1. tcp_init
2. tcp_template
3. tcp_respond
4. tcp_newtcpcb
5. tcp_drop
6. tcp_close
7. tcp_reaper
8. tcp_freeq
9. tcp_drain
10. tcp_rscale
11. tcp_notify
12. tcp6_ctlinput
13. tcp_ctlinput
14. tcp6_mtudisc_callback
15. tcp_mtudisc
16. tcp_mtudisc_increase
17. tcp_set_iss_tsm
18. tcp_signature_tdb_attach
19. tcp_signature_tdb_init
20. tcp_signature_tdb_zeroize
21. tcp_signature_tdb_input
22. tcp_signature_tdb_output
23. tcp_signature_apply
24. tcp_signature
25. tcp_rndiss_encrypt
26. tcp_rndiss_init
27. tcp_rndiss_next

    1 /*      $OpenBSD: tcp_subr.c,v 1.98 2007/06/25 12:17:43 markus Exp $    */
    2 /*      $NetBSD: tcp_subr.c,v 1.22 1996/02/13 23:44:00 christos Exp $   */
    4 /*
    5  * Copyright (c) 1982, 1986, 1988, 1990, 1993
    6  *      The Regents of the University of California.  All rights reserved.
    7  *
    8  * Redistribution and use in source and binary forms, with or without
    9  * modification, are permitted provided that the following conditions
   10  * are met:
   11  * 1. Redistributions of source code must retain the above copyright
   12  *    notice, this list of conditions and the following disclaimer.
   13  * 2. Redistributions in binary form must reproduce the above copyright
   14  *    notice, this list of conditions and the following disclaimer in the
   15  *    documentation and/or other materials provided with the distribution.
   16  * 3. Neither the name of the University nor the names of its contributors
   17  *    may be used to endorse or promote products derived from this software
   18  *    without specific prior written permission.
   19  *
   20  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
   21  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
   22  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
   23  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
   24  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
   25  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
   26  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
   27  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
   28  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
   29  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
   30  * SUCH DAMAGE.
   31  *
   32  *      @(#)COPYRIGHT   1.1 (NRL) 17 January 1995
   33  *
   34  * NRL grants permission for redistribution and use in source and binary
   35  * forms, with or without modification, of the software and documentation
   36  * created at NRL provided that the following conditions are met:
   37  *
   38  * 1. Redistributions of source code must retain the above copyright
   39  *    notice, this list of conditions and the following disclaimer.
   40  * 2. Redistributions in binary form must reproduce the above copyright
   41  *    notice, this list of conditions and the following disclaimer in the
   42  *    documentation and/or other materials provided with the distribution.
   43  * 3. All advertising materials mentioning features or use of this software
   44  *    must display the following acknowledgements:
   45  *      This product includes software developed by the University of
   46  *      California, Berkeley and its contributors.
   47  *      This product includes software developed at the Information
   48  *      Technology Division, US Naval Research Laboratory.
   49  * 4. Neither the name of the NRL nor the names of its contributors
   50  *    may be used to endorse or promote products derived from this software
   51  *    without specific prior written permission.
   52  *
   53  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
   54  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
   55  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
   56  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
   57  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
   58  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
   59  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
   60  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
   61  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
   62  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
   63  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
   64  *
   65  * The views and conclusions contained in the software and documentation
   66  * are those of the authors and should not be interpreted as representing
   67  * official policies, either expressed or implied, of the US Naval
   68  * Research Laboratory (NRL).
   69  */
   71 #include <sys/param.h>
   72 #include <sys/systm.h>
   73 #include <sys/proc.h>
   74 #include <sys/mbuf.h>
   75 #include <sys/socket.h>
   76 #include <sys/socketvar.h>
   77 #include <sys/protosw.h>
   78 #include <sys/kernel.h>
   80 #include <net/route.h>
   81 #include <net/if.h>
   83 #include <netinet/in.h>
   84 #include <netinet/in_systm.h>
   85 #include <netinet/ip.h>
   86 #include <netinet/in_pcb.h>
   87 #include <netinet/ip_var.h>
   88 #include <netinet/ip_icmp.h>
   89 #include <netinet/tcp.h>
   90 #include <netinet/tcp_fsm.h>
   91 #include <netinet/tcp_seq.h>
   92 #include <netinet/tcp_timer.h>
   93 #include <netinet/tcp_var.h>
   94 #include <netinet/tcpip.h>
   95 #include <dev/rndvar.h>
   97 #ifdef INET6
   98 #include <netinet6/in6_var.h>
   99 #include <netinet6/ip6protosw.h>
  100 #endif /* INET6 */
  102 #include <crypto/md5.h>
  104 /* patchable/settable parameters for tcp */
  105 int     tcp_mssdflt = TCP_MSS;
  106 int     tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
  108 /* values controllable via sysctl */
  109 int     tcp_do_rfc1323 = 1;
  110 #ifdef TCP_SACK
  111 int     tcp_do_sack = 1;        /* RFC 2018 selective ACKs */
  112 #endif
  113 int     tcp_ack_on_push = 0;    /* set to enable immediate ACK-on-PUSH */
  114 #ifdef TCP_ECN
  115 int     tcp_do_ecn = 0;         /* RFC3168 ECN enabled/disabled? */
  116 #endif
  117 int     tcp_do_rfc3390 = 1;     /* RFC3390 Increasing TCP's Initial Window */
u_int32_t       tcp_now = 1;
  121 #ifndef TCBHASHSIZE
  122 #define TCBHASHSIZE     128
  123 #endif
  124 int     tcbhashsize = TCBHASHSIZE;
  126 /* syn hash parameters */
  127 #define TCP_SYN_HASH_SIZE       293
  128 #define TCP_SYN_BUCKET_SIZE     35
  129 int     tcp_syn_cache_size = TCP_SYN_HASH_SIZE;
  130 int     tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE;
  131 int     tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE;
  132 struct  syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE];
  134 int tcp_reass_limit = NMBCLUSTERS / 2; /* hardlimit for tcpqe_pool */
  135 #ifdef TCP_SACK
  136 int tcp_sackhole_limit = 32*1024; /* hardlimit for sackhl_pool */
  137 #endif
  139 #ifdef INET6
  140 extern int ip6_defhlim;
  141 #endif /* INET6 */
  143 struct pool tcpcb_pool;
  144 struct pool tcpqe_pool;
  145 #ifdef TCP_SACK
  146 struct pool sackhl_pool;
  147 #endif
  149 struct tcpstat tcpstat;         /* tcp statistics */
tcp_seq  tcp_iss;
  152 /*
  153  * Tcp initialization
  154  */
  155 void
tcp_init()
  157 {
tcp_iss = 1;            /* wrong */
pool_init(&tcpcb_pool, sizeof(struct tcpcb), 0, 0, 0, "tcpcbpl",
NULL);
pool_init(&tcpqe_pool, sizeof(struct tcpqent), 0, 0, 0, "tcpqepl",
NULL);
pool_sethardlimit(&tcpqe_pool, tcp_reass_limit, NULL, 0);
  164 #ifdef TCP_SACK
pool_init(&sackhl_pool, sizeof(struct sackhole), 0, 0, 0, "sackhlpl",
NULL);
pool_sethardlimit(&sackhl_pool, tcp_sackhole_limit, NULL, 0);
  168 #endif /* TCP_SACK */
in_pcbinit(&tcbtable, tcbhashsize);
  171 #ifdef INET6
  172         /*
  173          * Since sizeof(struct ip6_hdr) > sizeof(struct ip), we
  174          * do max length checks/computations only on the former.
  175          */
  176         if (max_protohdr < (sizeof(struct ip6_hdr) + sizeof(struct tcphdr)))
max_protohdr = (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
  178         if ((max_linkhdr + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) >
MHLEN)
panic("tcp_init");
icmp6_mtudisc_callback_register(tcp6_mtudisc_callback);
  183 #endif /* INET6 */
  185         /* Initialize the compressed state engine. */
syn_cache_init();
  188         /* Initialize timer state. */
tcp_timer_init();
  190 }
  192 /*
  193  * Create template to be used to send tcp packets on a connection.
  194  * Call after host entry created, allocates an mbuf and fills
  195  * in a skeletal tcp/ip header, minimizing the amount of work
  196  * necessary when the connection is used.
  197  *
  198  * To support IPv6 in addition to IPv4 and considering that the sizes of
  199  * the IPv4 and IPv6 headers are not the same, we now use a separate pointer
  200  * for the TCP header.  Also, we made the former tcpiphdr header pointer
  201  * into just an IP overlay pointer, with casting as appropriate for v6. rja
  202  */
  203 struct mbuf *
tcp_template(tp)
  205         struct tcpcb *tp;
  206 {
  207         struct inpcb *inp = tp->t_inpcb;
  208         struct mbuf *m;
  209         struct tcphdr *th;
  211         if ((m = tp->t_template) == 0) {
m = m_get(M_DONTWAIT, MT_HEADER);
  213                 if (m == NULL)
  214                         return (0);
  216                 switch (tp->pf) {
  217                 case 0: /*default to PF_INET*/
  218 #ifdef INET
  219                 case AF_INET:
m->m_len = sizeof(struct ip);
  221                         break;
  222 #endif /* INET */
  223 #ifdef INET6
  224                 case AF_INET6:
m->m_len = sizeof(struct ip6_hdr);
  226                         break;
  227 #endif /* INET6 */
  228                 }
m->m_len += sizeof (struct tcphdr);
  231                 /*
  232                  * The link header, network header, TCP header, and TCP options
  233                  * all must fit in this mbuf. For now, assume the worst case of
  234                  * TCP options size. Eventually, compute this from tp flags.
  235                  */
  236                 if (m->m_len + MAX_TCPOPTLEN + max_linkhdr >= MHLEN) {
MCLGET(m, M_DONTWAIT);
  238                         if ((m->m_flags & M_EXT) == 0) {
m_free(m);
  240                                 return (0);
  241                         }
  242                 }
  243         }
  245         switch(tp->pf) {
  246 #ifdef INET
  247         case AF_INET:
  248                 {
  249                         struct ipovly *ipovly;
ipovly = mtod(m, struct ipovly *);
bzero(ipovly->ih_x1, sizeof ipovly->ih_x1);
ipovly->ih_pr = IPPROTO_TCP;
ipovly->ih_len = htons(sizeof (struct tcphdr));
ipovly->ih_src = inp->inp_laddr;
ipovly->ih_dst = inp->inp_faddr;
th = (struct tcphdr *)(mtod(m, caddr_t) +
  260                                 sizeof(struct ip));
th->th_sum = in_cksum_phdr(ipovly->ih_src.s_addr,
ipovly->ih_dst.s_addr,
htons(sizeof (struct tcphdr) + IPPROTO_TCP));
  264                 }
  265                 break;
  266 #endif /* INET */
  267 #ifdef INET6
  268         case AF_INET6:
  269                 {
  270                         struct ip6_hdr *ip6;
ip6 = mtod(m, struct ip6_hdr *);
ip6->ip6_src = inp->inp_laddr6;
ip6->ip6_dst = inp->inp_faddr6;
ip6->ip6_flow = htonl(0x60000000) |
  277                             (inp->inp_flowinfo & IPV6_FLOWLABEL_MASK);
ip6->ip6_nxt = IPPROTO_TCP;
ip6->ip6_plen = htons(sizeof(struct tcphdr)); /*XXX*/
ip6->ip6_hlim = in6_selecthlim(inp, NULL);      /*XXX*/
th = (struct tcphdr *)(mtod(m, caddr_t) +
  284                                 sizeof(struct ip6_hdr));
th->th_sum = 0;
  286                 }
  287                 break;
  288 #endif /* INET6 */
  289         }
th->th_sport = inp->inp_lport;
th->th_dport = inp->inp_fport;
th->th_seq = 0;
th->th_ack = 0;
th->th_x2  = 0;
th->th_off = 5;
th->th_flags = 0;
th->th_win = 0;
th->th_urp = 0;
  300         return (m);
  301 }
  303 /*
  304  * Send a single message to the TCP at address specified by
  305  * the given TCP/IP header.  If m == 0, then we make a copy
  306  * of the tcpiphdr at ti and send directly to the addressed host.
  307  * This is used to force keep alive messages out using the TCP
  308  * template for a connection tp->t_template.  If flags are given
  309  * then we send a message back to the TCP which originated the
  310  * segment ti, and discard the mbuf containing it and any other
  311  * attached mbufs.
  312  *
  313  * In any case the ack and sequence number of the transmitted
  314  * segment are as specified by the parameters.
  315  */
  316 #ifdef INET6
  317 /* This function looks hairy, because it was so IPv4-dependent. */
  318 #endif /* INET6 */
  319 void
tcp_respond(tp, template, m, ack, seq, flags)
  321         struct tcpcb *tp;
caddr_t template;
  323         struct mbuf *m;
tcp_seq ack, seq;
  325         int flags;
  326 {
  327         int tlen;
  328         int win = 0;
  329         struct route *ro = 0;
  330         struct tcphdr *th;
  331         struct tcpiphdr *ti = (struct tcpiphdr *)template;
  332         int af;         /* af on wire */
  334         if (tp) {
win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
  336                 /*
  337                  * If this is called with an unconnected
  338                  * socket/tp/pcb (tp->pf is 0), we lose.
  339                  */
af = tp->pf;
  342                 /*
  343                  * The route/route6 distinction is meaningless
  344                  * unless you're allocating space or passing parameters.
  345                  */
ro = &tp->t_inpcb->inp_route;
  347         } else
af = (((struct ip *)ti)->ip_v == 6) ? AF_INET6 : AF_INET;
  349         if (m == 0) {
m = m_gethdr(M_DONTWAIT, MT_HEADER);
  351                 if (m == NULL)
  352                         return;
  353 #ifdef TCP_COMPAT_42
tlen = 1;
  355 #else
tlen = 0;
  357 #endif
m->m_data += max_linkhdr;
  359                 switch (af) {
  360 #ifdef INET6
  361                 case AF_INET6:
bcopy(ti, mtod(m, caddr_t), sizeof(struct tcphdr) +
  363                             sizeof(struct ip6_hdr));
  364                         break;
  365 #endif /* INET6 */
  366                 case AF_INET:
bcopy(ti, mtod(m, caddr_t), sizeof(struct tcphdr) +
  368                             sizeof(struct ip));
  369                         break;
  370                 }
ti = mtod(m, struct tcpiphdr *);
flags = TH_ACK;
  374         } else {
m_freem(m->m_next);
m->m_next = 0;
m->m_data = (caddr_t)ti;
tlen = 0;
  379 #define xchg(a,b,type) do { type t; t=a; a=b; b=t; } while (0)
  380                 switch (af) {
  381 #ifdef INET6
  382                 case AF_INET6:
m->m_len = sizeof(struct tcphdr) + sizeof(struct ip6_hdr);
xchg(((struct ip6_hdr *)ti)->ip6_dst,
  385                             ((struct ip6_hdr *)ti)->ip6_src, struct in6_addr);
th = (void *)((caddr_t)ti + sizeof(struct ip6_hdr));
  387                         break;
  388 #endif /* INET6 */
  389                 case AF_INET:
m->m_len = sizeof (struct tcpiphdr);
xchg(ti->ti_dst.s_addr, ti->ti_src.s_addr, u_int32_t);
th = (void *)((caddr_t)ti + sizeof(struct ip));
  393                         break;
  394                 }
xchg(th->th_dport, th->th_sport, u_int16_t);
  396 #undef xchg
  397         }
  398         switch (af) {
  399 #ifdef INET6
  400         case AF_INET6:
tlen += sizeof(struct tcphdr) + sizeof(struct ip6_hdr);
th = (struct tcphdr *)((caddr_t)ti + sizeof(struct ip6_hdr));
  403                 break;
  404 #endif /* INET6 */
  405         case AF_INET:
ti->ti_len = htons((u_int16_t)(sizeof (struct tcphdr) + tlen));
tlen += sizeof (struct tcpiphdr);
th = (struct tcphdr *)((caddr_t)ti + sizeof(struct ip));
  409                 break;
  410         }
m->m_len = tlen;
m->m_pkthdr.len = tlen;
m->m_pkthdr.rcvif = (struct ifnet *) 0;
th->th_seq = htonl(seq);
th->th_ack = htonl(ack);
th->th_x2 = 0;
th->th_off = sizeof (struct tcphdr) >> 2;
th->th_flags = flags;
  420         if (tp)
win >>= tp->rcv_scale;
  422         if (win > TCP_MAXWIN)
win = TCP_MAXWIN;
th->th_win = htons((u_int16_t)win);
th->th_urp = 0;
  427         switch (af) {
  428 #ifdef INET6
  429         case AF_INET6:
  430                 ((struct ip6_hdr *)ti)->ip6_flow   = htonl(0x60000000);
  431                 ((struct ip6_hdr *)ti)->ip6_nxt  = IPPROTO_TCP;
  432                 ((struct ip6_hdr *)ti)->ip6_hlim =
in6_selecthlim(tp ? tp->t_inpcb : NULL, NULL);  /*XXX*/
  434                 ((struct ip6_hdr *)ti)->ip6_plen = tlen - sizeof(struct ip6_hdr);
th->th_sum = 0;
th->th_sum = in6_cksum(m, IPPROTO_TCP,
  437                    sizeof(struct ip6_hdr), ((struct ip6_hdr *)ti)->ip6_plen);
HTONS(((struct ip6_hdr *)ti)->ip6_plen);
ip6_output(m, tp ? tp->t_inpcb->inp_outputopts6 : NULL,
  440                     (struct route_in6 *)ro, 0, NULL, NULL,
tp ? tp->t_inpcb : NULL);
  442                 break;
  443 #endif /* INET6 */
  444         case AF_INET:
bzero(ti->ti_x1, sizeof ti->ti_x1);
ti->ti_len = htons((u_short)tlen - sizeof(struct ip));
  448                 /*
  449                  * There's no point deferring to hardware checksum processing
  450                  * here, as we only send a minimal TCP packet whose checksum
  451                  * we need to compute in any case.
  452                  */
th->th_sum = 0;
th->th_sum = in_cksum(m, tlen);
  455                 ((struct ip *)ti)->ip_len = htons(tlen);
  456                 ((struct ip *)ti)->ip_ttl = ip_defttl;
ip_output(m, (void *)NULL, ro, ip_mtudisc ? IP_MTUDISC : 0,
  458                         (void *)NULL, tp ? tp->t_inpcb : (void *)NULL);
  459         }
  460 }
  462 /*
  463  * Create a new TCP control block, making an
  464  * empty reassembly queue and hooking it to the argument
  465  * protocol control block.
  466  */
  467 struct tcpcb *
tcp_newtcpcb(struct inpcb *inp)
  469 {
  470         struct tcpcb *tp;
  471         int i;
tp = pool_get(&tcpcb_pool, PR_NOWAIT);
  474         if (tp == NULL)
  475                 return ((struct tcpcb *)0);
bzero((char *) tp, sizeof(struct tcpcb));
TAILQ_INIT(&tp->t_segq);
tp->t_maxseg = tcp_mssdflt;
tp->t_maxopd = 0;
TCP_INIT_DELACK(tp);
  482         for (i = 0; i < TCPT_NTIMERS; i++)
TCP_TIMER_INIT(tp, i);
timeout_set(&tp->t_reap_to, tcp_reaper, tp);
  486 #ifdef TCP_SACK
tp->sack_enable = tcp_do_sack;
  488 #endif
tp->t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
tp->t_inpcb = inp;
  491         /*
  492          * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
  493          * rtt estimate.  Set rttvar so that srtt + 2 * rttvar gives
  494          * reasonable initial retransmit time.
  495          */
tp->t_srtt = TCPTV_SRTTBASE;
tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ <<
  498             (TCP_RTTVAR_SHIFT + TCP_RTT_BASE_SHIFT - 1);
tp->t_rttmin = TCPTV_MIN;
TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
TCPTV_MIN, TCPTV_REXMTMAX);
tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
tp->t_pmtud_mtu_sent = 0;
tp->t_pmtud_mss_acked = 0;
  508 #ifdef INET6
  509         /* we disallow IPv4 mapped address completely. */
  510         if ((inp->inp_flags & INP_IPV6) == 0)
tp->pf = PF_INET;
  512         else
tp->pf = PF_INET6;
  514 #else
tp->pf = PF_INET;
  516 #endif
  518 #ifdef INET6
  519         if (inp->inp_flags & INP_IPV6)
inp->inp_ipv6.ip6_hlim = ip6_defhlim;
  521         else
  522 #endif /* INET6 */
inp->inp_ip.ip_ttl = ip_defttl;
inp->inp_ppcb = (caddr_t)tp;
  526         return (tp);
  527 }
  529 /*
  530  * Drop a TCP connection, reporting
  531  * the specified error.  If connection is synchronized,
  532  * then send a RST to peer.
  533  */
  534 struct tcpcb *
tcp_drop(tp, errno)
  536         struct tcpcb *tp;
  537         int errno;
  538 {
  539         struct socket *so = tp->t_inpcb->inp_socket;
  541         if (TCPS_HAVERCVDSYN(tp->t_state)) {
tp->t_state = TCPS_CLOSED;
  543                 (void) tcp_output(tp);
tcpstat.tcps_drops++;
  545         } else
tcpstat.tcps_conndrops++;
  547         if (errno == ETIMEDOUT && tp->t_softerror)
errno = tp->t_softerror;
so->so_error = errno;
  550         return (tcp_close(tp));
  551 }
  553 /*
  554  * Close a TCP control block:
  555  *      discard all space held by the tcp
  556  *      discard internet protocol block
  557  *      wake up any sleepers
  558  */
  559 struct tcpcb *
tcp_close(struct tcpcb *tp)
  561 {
  562         struct inpcb *inp = tp->t_inpcb;
  563         struct socket *so = inp->inp_socket;
  564 #ifdef TCP_SACK
  565         struct sackhole *p, *q;
  566 #endif
  568         /* free the reassembly queue, if any */
tcp_reass_lock(tp);
tcp_freeq(tp);
tcp_reass_unlock(tp);
tcp_canceltimers(tp);
TCP_CLEAR_DELACK(tp);
syn_cache_cleanup(tp);
  577 #ifdef TCP_SACK
  578         /* Free SACK holes. */
q = p = tp->snd_holes;
  580         while (p != 0) {
q = p->next;
pool_put(&sackhl_pool, p);
p = q;
  584         }
  585 #endif
  586         if (tp->t_template)
  587                 (void) m_free(tp->t_template);
tp->t_flags |= TF_DEAD;
timeout_add(&tp->t_reap_to, 0);
inp->inp_ppcb = 0;
soisdisconnected(so);
in_pcbdetach(inp);
  595         return ((struct tcpcb *)0);
  596 }
  598 void
tcp_reaper(void *arg)
  600 {
  601         struct tcpcb *tp = arg;
  602         int s;
s = splsoftnet();
pool_put(&tcpcb_pool, tp);
splx(s);
tcpstat.tcps_closed++;
  608 }
  610 int
tcp_freeq(struct tcpcb *tp)
  612 {
  613         struct tcpqent *qe;
  614         int rv = 0;
  616         while ((qe = TAILQ_FIRST(&tp->t_segq)) != NULL) {
TAILQ_REMOVE(&tp->t_segq, qe, tcpqe_q);
m_freem(qe->tcpqe_m);
pool_put(&tcpqe_pool, qe);
rv = 1;
  621         }
  622         return (rv);
  623 }
  625 void
tcp_drain()
  627 {
  628         struct inpcb *inp;
  630         /* called at splnet() */
CIRCLEQ_FOREACH(inp, &tcbtable.inpt_queue, inp_queue) {
  632                 struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
  634                 if (tp != NULL) {
  635                         if (tcp_reass_lock_try(tp) == 0)
  636                                 continue;
  637                         if (tcp_freeq(tp))
tcpstat.tcps_conndrained++;
tcp_reass_unlock(tp);
  640                 }
  641         }
  642 }
  644 /*
  645  * Compute proper scaling value for receiver window from buffer space
  646  */
  648 void
tcp_rscale(struct tcpcb *tp, u_long hiwat)
  650 {
tp->request_r_scale = 0;
  652         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
TCP_MAXWIN << tp->request_r_scale < hiwat)
tp->request_r_scale++;
  655 }
  657 /*
  658  * Notify a tcp user of an asynchronous error;
  659  * store error as soft error, but wake up user
  660  * (for now, won't do anything until can select for soft error).
  661  */
  662 void
tcp_notify(inp, error)
  664         struct inpcb *inp;
  665         int error;
  666 {
  667         struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
  668         struct socket *so = inp->inp_socket;
  670         /*
  671          * Ignore some errors if we are hooked up.
  672          * If connection hasn't completed, has retransmitted several times,
  673          * and receives a second error, give up now.  This is better
  674          * than waiting a long time to establish a connection that
  675          * can never complete.
  676          */
  677         if (tp->t_state == TCPS_ESTABLISHED &&
  678              (error == EHOSTUNREACH || error == ENETUNREACH ||
error == EHOSTDOWN)) {
  680                 return;
  681         } else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
tp->t_rxtshift > 3 && tp->t_softerror)
so->so_error = error;
  684         else
tp->t_softerror = error;
wakeup((caddr_t) &so->so_timeo);
sorwakeup(so);
sowwakeup(so);
  689 }
  691 #ifdef INET6
  692 void
tcp6_ctlinput(cmd, sa, d)
  694         int cmd;
  695         struct sockaddr *sa;
  696         void *d;
  697 {
  698         struct tcphdr th;
  699         struct tcpcb *tp;
  700         void (*notify)(struct inpcb *, int) = tcp_notify;
  701         struct ip6_hdr *ip6;
  702         const struct sockaddr_in6 *sa6_src = NULL;
  703         struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)sa;
  704         struct inpcb *inp;
  705         struct mbuf *m;
tcp_seq seq;
  707         int off;
  708         struct {
u_int16_t th_sport;
u_int16_t th_dport;
u_int32_t th_seq;
  712         } *thp;
  714         if (sa->sa_family != AF_INET6 ||
sa->sa_len != sizeof(struct sockaddr_in6) ||
IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr))
  718                 return;
  719         if ((unsigned)cmd >= PRC_NCMDS)
  720                 return;
  721         else if (cmd == PRC_QUENCH) {
  722                 /* 
  723                  * Don't honor ICMP Source Quench messages meant for
  724                  * TCP connections.
  725                  */
  726                 /* XXX there's no PRC_QUENCH in IPv6 */
  727                 return;
  728         } else if (PRC_IS_REDIRECT(cmd))
notify = in_rtchange, d = NULL;
  730         else if (cmd == PRC_MSGSIZE)
  731                 ; /* special code is present, see below */
  732         else if (cmd == PRC_HOSTDEAD)
d = NULL;
  734         else if (inet6ctlerrmap[cmd] == 0)
  735                 return;
  737         /* if the parameter is from icmp6, decode it. */
  738         if (d != NULL) {
  739                 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
m = ip6cp->ip6c_m;
ip6 = ip6cp->ip6c_ip6;
off = ip6cp->ip6c_off;
sa6_src = ip6cp->ip6c_src;
  744         } else {
m = NULL;
ip6 = NULL;
sa6_src = &sa6_any;
  748         }
  750         if (ip6) {
  751                 /*
  752                  * XXX: We assume that when ip6 is non NULL,
  753                  * M and OFF are valid.
  754                  */
  756                 /* check if we can safely examine src and dst ports */
  757                 if (m->m_pkthdr.len < off + sizeof(*thp))
  758                         return;
bzero(&th, sizeof(th));
  761 #ifdef DIAGNOSTIC
  762                 if (sizeof(*thp) > sizeof(th))
panic("assumption failed in tcp6_ctlinput");
  764 #endif
m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
  767                 /*
  768                  * Check to see if we have a valid TCP connection
  769                  * corresponding to the address in the ICMPv6 message
  770                  * payload.
  771                  */
inp = in6_pcbhashlookup(&tcbtable, &sa6->sin6_addr,
th.th_dport, (struct in6_addr *)&sa6_src->sin6_addr,
th.th_sport);
  775                 if (cmd == PRC_MSGSIZE) {
  776                         /*
  777                          * Depending on the value of "valid" and routing table
  778                          * size (mtudisc_{hi,lo}wat), we will:
  779                          * - recalcurate the new MTU and create the
  780                          *   corresponding routing entry, or
  781                          * - ignore the MTU change notification.
  782                          */
icmp6_mtudisc_update((struct ip6ctlparam *)d, inp != NULL);
  784                         return;
  785                 }
  786                 if (inp) {
seq = ntohl(th.th_seq);
  788                         if (inp->inp_socket &&
  789                             (tp = intotcpcb(inp)) &&
SEQ_GEQ(seq, tp->snd_una) &&
SEQ_LT(seq, tp->snd_max))
notify(inp, inet6ctlerrmap[cmd]);
  793                 } else if (syn_cache_count &&
  794                     (inet6ctlerrmap[cmd] == EHOSTUNREACH ||
inet6ctlerrmap[cmd] == ENETUNREACH ||
inet6ctlerrmap[cmd] == EHOSTDOWN))
syn_cache_unreach((struct sockaddr *)sa6_src,
sa, &th);
  799         } else {
  800                 (void) in6_pcbnotify(&tcbtable, sa, 0,
  801                     (struct sockaddr *)sa6_src, 0, cmd, NULL, notify);
  802         }
  803 }
  804 #endif
  806 void *
tcp_ctlinput(cmd, sa, v)
  808         int cmd;
  809         struct sockaddr *sa;
  810         void *v;
  811 {
  812         struct ip *ip = v;
  813         struct tcphdr *th;
  814         struct tcpcb *tp;
  815         struct inpcb *inp;
  816         struct in_addr faddr;
tcp_seq seq;
u_int mtu;
  819         extern int inetctlerrmap[];
  820         void (*notify)(struct inpcb *, int) = tcp_notify;
  821         int errno;
  823         if (sa->sa_family != AF_INET)
  824                 return NULL;
faddr = satosin(sa)->sin_addr;
  826         if (faddr.s_addr == INADDR_ANY)
  827                 return NULL;
  829         if ((unsigned)cmd >= PRC_NCMDS)
  830                 return NULL;
errno = inetctlerrmap[cmd];
  832         if (cmd == PRC_QUENCH)
  833                 /* 
  834                  * Don't honor ICMP Source Quench messages meant for
  835                  * TCP connections.
  836                  */
  837                 return NULL;
  838         else if (PRC_IS_REDIRECT(cmd))
notify = in_rtchange, ip = 0;
  840         else if (cmd == PRC_MSGSIZE && ip_mtudisc && ip) {
  841                 /*
  842                  * Verify that the packet in the icmp payload refers
  843                  * to an existing TCP connection.
  844                  */
th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
seq = ntohl(th->th_seq);
inp = in_pcbhashlookup(&tcbtable,
ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport);
  849                 if (inp && (tp = intotcpcb(inp)) &&
SEQ_GEQ(seq, tp->snd_una) &&
SEQ_LT(seq, tp->snd_max)) {
  852                         struct icmp *icp;
icp = (struct icmp *)((caddr_t)ip -
offsetof(struct icmp, icmp_ip));
  856                         /* 
  857                          * If the ICMP message advertises a Next-Hop MTU
  858                          * equal or larger than the maximum packet size we have
  859                          * ever sent, drop the message.
  860                          */
mtu = (u_int)ntohs(icp->icmp_nextmtu);
  862                         if (mtu >= tp->t_pmtud_mtu_sent)
  863                                 return NULL;
  864                         if (mtu >= tcp_hdrsz(tp) + tp->t_pmtud_mss_acked) {
  865                                 /* 
  866                                  * Calculate new MTU, and create corresponding
  867                                  * route (traditional PMTUD).
  868                                  */
tp->t_flags &= ~TF_PMTUD_PEND;
icmp_mtudisc(icp);    
  871                         } else {
  872                                 /*
  873                                  * Record the information got in the ICMP
  874                                  * message; act on it later.
  875                                  * If we had already recorded an ICMP message,
  876                                  * replace the old one only if the new message
  877                                  * refers to an older TCP segment
  878                                  */
  879                                 if (tp->t_flags & TF_PMTUD_PEND) {
  880                                         if (SEQ_LT(tp->t_pmtud_th_seq, seq))
  881                                                 return NULL;
  882                                 } else
tp->t_flags |= TF_PMTUD_PEND;
tp->t_pmtud_th_seq = seq;
tp->t_pmtud_nextmtu = icp->icmp_nextmtu;
tp->t_pmtud_ip_len = icp->icmp_ip.ip_len;
tp->t_pmtud_ip_hl = icp->icmp_ip.ip_hl;
  888                                 return NULL;
  889                         }
  890                 } else {
  891                         /* ignore if we don't have a matching connection */
  892                         return NULL;
  893                 }
notify = tcp_mtudisc, ip = 0;
  895         } else if (cmd == PRC_MTUINC)
notify = tcp_mtudisc_increase, ip = 0;
  897         else if (cmd == PRC_HOSTDEAD)
ip = 0;
  899         else if (errno == 0)
  900                 return NULL;
  902         if (ip) {
th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
inp = in_pcbhashlookup(&tcbtable,
ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport);
  906                 if (inp) {
seq = ntohl(th->th_seq);
  908                         if (inp->inp_socket &&
  909                             (tp = intotcpcb(inp)) &&
SEQ_GEQ(seq, tp->snd_una) &&
SEQ_LT(seq, tp->snd_max))
notify(inp, errno);
  913                 } else if (syn_cache_count &&
  914                     (inetctlerrmap[cmd] == EHOSTUNREACH ||
inetctlerrmap[cmd] == ENETUNREACH ||
inetctlerrmap[cmd] == EHOSTDOWN)) {
  917                         struct sockaddr_in sin;
bzero(&sin, sizeof(sin));
sin.sin_len = sizeof(sin);
sin.sin_family = AF_INET;
sin.sin_port = th->th_sport;
sin.sin_addr = ip->ip_src;
syn_cache_unreach((struct sockaddr *)&sin,
sa, th);
  926                 }
  927         } else
in_pcbnotifyall(&tcbtable, sa, errno, notify);
  930         return NULL;
  931 }
  934 #ifdef INET6
  935 /*
  936  * Path MTU Discovery handlers.
  937  */
  938 void
tcp6_mtudisc_callback(faddr)
  940         struct in6_addr *faddr;
  941 {
  942         struct sockaddr_in6 sin6;
bzero(&sin6, sizeof(sin6));
sin6.sin6_family = AF_INET6;
sin6.sin6_len = sizeof(struct sockaddr_in6);
sin6.sin6_addr = *faddr;
  948         (void) in6_pcbnotify(&tcbtable, (struct sockaddr *)&sin6, 0,
  949             (struct sockaddr *)&sa6_any, 0, PRC_MSGSIZE, NULL, tcp_mtudisc);
  950 }
  951 #endif /* INET6 */
  953 /*
  954  * On receipt of path MTU corrections, flush old route and replace it
  955  * with the new one.  Retransmit all unacknowledged packets, to ensure
  956  * that all packets will be received.
  957  */
  958 void
tcp_mtudisc(inp, errno)
  960         struct inpcb *inp;
  961         int errno;
  962 {
  963         struct tcpcb *tp = intotcpcb(inp);
  964         struct rtentry *rt = in_pcbrtentry(inp);
  965         int change = 0;
  967         if (tp != 0) {
  968                 int orig_maxseg = tp->t_maxseg;
  969                 if (rt != 0) {
  970                         /*
  971                          * If this was not a host route, remove and realloc.
  972                          */
  973                         if ((rt->rt_flags & RTF_HOST) == 0) {
in_rtchange(inp, errno);
  975                                 if ((rt = in_pcbrtentry(inp)) == 0)
  976                                         return;
  977                         }
  978                         if (orig_maxseg != tp->t_maxseg ||
  979                             (rt->rt_rmx.rmx_locks & RTV_MTU))
change = 1;
  981                 }
tcp_mss(tp, -1);
  984                 /*
  985                  * Resend unacknowledged packets
  986                  */
tp->snd_nxt = tp->snd_una;
  988                 if (change || errno > 0)
tcp_output(tp);
  990         }
  991 }
  993 void
tcp_mtudisc_increase(inp, errno)
  995         struct inpcb *inp;
  996         int errno;
  997 {
  998         struct tcpcb *tp = intotcpcb(inp);
  999         struct rtentry *rt = in_pcbrtentry(inp);
 1001         if (tp != 0 && rt != 0) {
 1002                 /*
 1003                  * If this was a host route, remove and realloc.
 1004                  */
 1005                 if (rt->rt_flags & RTF_HOST)
in_rtchange(inp, errno);
 1008                 /* also takes care of congestion window */
tcp_mss(tp, -1);
 1010         }
 1011 }
 1013 #define TCP_ISS_CONN_INC 4096
 1014 int tcp_secret_init;
u_char tcp_secret[16];
MD5_CTX tcp_secret_ctx;
 1018 void
tcp_set_iss_tsm(struct tcpcb *tp)
 1020 {
MD5_CTX ctx;
u_int32_t digest[4];
 1024         if (tcp_secret_init == 0) {
arc4random_bytes(tcp_secret, sizeof(tcp_secret));
MD5Init(&tcp_secret_ctx);
MD5Update(&tcp_secret_ctx, tcp_secret, sizeof(tcp_secret));
tcp_secret_init = 1;
 1029         }
ctx = tcp_secret_ctx;
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_lport, sizeof(u_short));
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_fport, sizeof(u_short));
 1033         if (tp->pf == AF_INET6) {
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_laddr6,
 1035                     sizeof(struct in6_addr));
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_faddr6,
 1037                     sizeof(struct in6_addr));
 1038         } else {
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_laddr,
 1040                     sizeof(struct in_addr));
MD5Update(&ctx, (char *)&tp->t_inpcb->inp_faddr,
 1042                     sizeof(struct in_addr));
 1043         }
MD5Final((u_char *)digest, &ctx);
tcp_iss += TCP_ISS_CONN_INC;
tp->iss = digest[0] + tcp_iss;
tp->ts_modulate = digest[1];
 1048 }
 1050 #ifdef TCP_SIGNATURE
 1051 int
tcp_signature_tdb_attach()
 1053 {
 1054         return (0);
 1055 }
 1057 int
tcp_signature_tdb_init(tdbp, xsp, ii)
 1059         struct tdb *tdbp;
 1060         struct xformsw *xsp;
 1061         struct ipsecinit *ii;
 1062 {
 1063         if ((ii->ii_authkeylen < 1) || (ii->ii_authkeylen > 80))
 1064                 return (EINVAL);
tdbp->tdb_amxkey = malloc(ii->ii_authkeylen, M_XDATA, M_DONTWAIT);
 1067         if (tdbp->tdb_amxkey == NULL)
 1068                 return (ENOMEM);
bcopy(ii->ii_authkey, tdbp->tdb_amxkey, ii->ii_authkeylen);
tdbp->tdb_amxkeylen = ii->ii_authkeylen;
 1072         return (0);
 1073 }
 1075 int
tcp_signature_tdb_zeroize(tdbp)
 1077         struct tdb *tdbp;
 1078 {
 1079         if (tdbp->tdb_amxkey) {
bzero(tdbp->tdb_amxkey, tdbp->tdb_amxkeylen);
free(tdbp->tdb_amxkey, M_XDATA);
tdbp->tdb_amxkey = NULL;
 1083         }
 1085         return (0);
 1086 }
 1088 int
tcp_signature_tdb_input(m, tdbp, skip, protoff)
 1090         struct mbuf *m;
 1091         struct tdb *tdbp;
 1092         int skip, protoff;
 1093 {
 1094         return (0);
 1095 }
 1097 int
tcp_signature_tdb_output(m, tdbp, mp, skip, protoff)
 1099         struct mbuf *m;
 1100         struct tdb *tdbp;
 1101         struct mbuf **mp;
 1102         int skip, protoff;
 1103 {
 1104         return (EINVAL);
 1105 }
 1107 int
tcp_signature_apply(fstate, data, len)
caddr_t fstate;
caddr_t data;
 1111         unsigned int len;
 1112 {
MD5Update((MD5_CTX *)fstate, (char *)data, len);
 1114         return 0;
 1115 }
 1117 int
tcp_signature(struct tdb *tdb, int af, struct mbuf *m, struct tcphdr *th,
 1119     int iphlen, int doswap, char *sig)
 1120 {
MD5_CTX ctx;
 1122         int len;
 1123         struct tcphdr th0;
MD5Init(&ctx);
 1127         switch(af) {
 1128         case 0:
 1129 #ifdef INET
 1130         case AF_INET: {
 1131                 struct ippseudo ippseudo;
 1132                 struct ip *ip;
ip = mtod(m, struct ip *);
ippseudo.ippseudo_src = ip->ip_src;
ippseudo.ippseudo_dst = ip->ip_dst;
ippseudo.ippseudo_pad = 0;
ippseudo.ippseudo_p = IPPROTO_TCP;
ippseudo.ippseudo_len = htons(m->m_pkthdr.len - iphlen);
MD5Update(&ctx, (char *)&ippseudo,
 1143                     sizeof(struct ippseudo));
 1144                 break;
 1145                 }
 1146 #endif
 1147 #ifdef INET6
 1148         case AF_INET6: {
 1149                 struct ip6_hdr_pseudo ip6pseudo;
 1150                 struct ip6_hdr *ip6;
ip6 = mtod(m, struct ip6_hdr *);
bzero(&ip6pseudo, sizeof(ip6pseudo));
ip6pseudo.ip6ph_src = ip6->ip6_src;
ip6pseudo.ip6ph_dst = ip6->ip6_dst;
in6_clearscope(&ip6pseudo.ip6ph_src);
in6_clearscope(&ip6pseudo.ip6ph_dst);
ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
ip6pseudo.ip6ph_len = htonl(m->m_pkthdr.len - iphlen);
MD5Update(&ctx, (char *)&ip6pseudo,
 1162                     sizeof(ip6pseudo));
 1163                 break;
 1164                 }
 1165 #endif
 1166         }
th0 = *th;
th0.th_sum = 0;
 1171         if (doswap) {
HTONL(th0.th_seq);
HTONL(th0.th_ack);
HTONS(th0.th_win);
HTONS(th0.th_urp);
 1176         }
MD5Update(&ctx, (char *)&th0, sizeof(th0));
len = m->m_pkthdr.len - iphlen - th->th_off * sizeof(uint32_t);
 1181         if (len > 0 &&
m_apply(m, iphlen + th->th_off * sizeof(uint32_t), len,
tcp_signature_apply, (caddr_t)&ctx))
 1184                 return (-1); 
MD5Update(&ctx, tdb->tdb_amxkey, tdb->tdb_amxkeylen);
MD5Final(sig, &ctx);
 1189         return (0);
 1190 }
 1191 #endif /* TCP_SIGNATURE */
 1193 #define TCP_RNDISS_ROUNDS       16
 1194 #define TCP_RNDISS_OUT  7200
 1195 #define TCP_RNDISS_MAX  30000
u_int8_t tcp_rndiss_sbox[128];
u_int16_t tcp_rndiss_msb;
u_int16_t tcp_rndiss_cnt;
 1200 long tcp_rndiss_reseed;
u_int16_t
tcp_rndiss_encrypt(val)
u_int16_t val;
 1205 {
u_int16_t sum = 0, i;
 1208         for (i = 0; i < TCP_RNDISS_ROUNDS; i++) {
sum += 0x79b9;
val ^= ((u_int16_t)tcp_rndiss_sbox[(val^sum) & 0x7f]) << 7;
val = ((val & 0xff) << 7) | (val >> 8);
 1212         }
 1214         return val;
 1215 }
 1217 void
tcp_rndiss_init()
 1219 {
get_random_bytes(tcp_rndiss_sbox, sizeof(tcp_rndiss_sbox));
tcp_rndiss_reseed = time_second + TCP_RNDISS_OUT;
tcp_rndiss_msb = tcp_rndiss_msb == 0x8000 ? 0 : 0x8000;
tcp_rndiss_cnt = 0;
 1225 }
tcp_seq
tcp_rndiss_next()
 1229 {
 1230         if (tcp_rndiss_cnt >= TCP_RNDISS_MAX ||
time_second > tcp_rndiss_reseed)
tcp_rndiss_init();
 1234         /* (arc4random() & 0x7fff) ensures a 32768 byte gap between ISS */
 1235         return ((tcp_rndiss_encrypt(tcp_rndiss_cnt++) | tcp_rndiss_msb) <<16) |
 1236                 (arc4random() & 0x7fff);
 1237 }