1 /** $MirOS: src/sys/netinet/tcp_subr.c,v 1.7 2011/11/20 18:54:51 tg Exp $ */
2 /* $OpenBSD: tcp_subr.c,v 1.85 2004/11/25 15:32:08 markus Exp $ */
3 /* $NetBSD: tcp_subr.c,v 1.22 1996/02/13 23:44:00 christos Exp $ */
4
5 /*
6 * Copyright (c) 1982, 1986, 1988, 1990, 1993
7 * The Regents of the University of California. All rights reserved.
8 *
9 * Redistribution and use in source and binary forms, with or without
10 * modification, are permitted provided that the following conditions
11 * are met:
12 * 1. Redistributions of source code must retain the above copyright
13 * notice, this list of conditions and the following disclaimer.
14 * 2. Redistributions in binary form must reproduce the above copyright
15 * notice, this list of conditions and the following disclaimer in the
16 * documentation and/or other materials provided with the distribution.
17 * 3. Neither the name of the University nor the names of its contributors
18 * may be used to endorse or promote products derived from this software
19 * without specific prior written permission.
20 *
21 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31 * SUCH DAMAGE.
32 *
33 * @(#)COPYRIGHT 1.1 (NRL) 17 January 1995
34 *
35 * NRL grants permission for redistribution and use in source and binary
36 * forms, with or without modification, of the software and documentation
37 * created at NRL provided that the following conditions are met:
38 *
39 * 1. Redistributions of source code must retain the above copyright
40 * notice, this list of conditions and the following disclaimer.
41 * 2. Redistributions in binary form must reproduce the above copyright
42 * notice, this list of conditions and the following disclaimer in the
43 * documentation and/or other materials provided with the distribution.
44 * 3. All advertising materials mentioning features or use of this software
45 * must display the following acknowledgements:
46 * This product includes software developed by the University of
47 * California, Berkeley and its contributors.
48 * This product includes software developed at the Information
49 * Technology Division, US Naval Research Laboratory.
50 * 4. Neither the name of the NRL nor the names of its contributors
51 * may be used to endorse or promote products derived from this software
52 * without specific prior written permission.
53 *
54 * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55 * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56 * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57 * PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL NRL OR
58 * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59 * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60 * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61 * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62 * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63 * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64 * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65 *
66 * The views and conclusions contained in the software and documentation
67 * are those of the authors and should not be interpreted as representing
68 * official policies, either expressed or implied, of the US Naval
69 * Research Laboratory (NRL).
70 */
71
72 #include <sys/param.h>
73 #include <sys/systm.h>
74 #include <sys/proc.h>
75 #include <sys/mbuf.h>
76 #include <sys/socket.h>
77 #include <sys/socketvar.h>
78 #include <sys/protosw.h>
79 #include <sys/kernel.h>
80
81 #include <net/route.h>
82 #include <net/if.h>
83
84 #include <netinet/in.h>
85 #include <netinet/in_systm.h>
86 #include <netinet/ip.h>
87 #include <netinet/in_pcb.h>
88 #include <netinet/ip_var.h>
89 #include <netinet/ip_icmp.h>
90 #include <netinet/tcp.h>
91 #include <netinet/tcp_fsm.h>
92 #include <netinet/tcp_seq.h>
93 #include <netinet/tcp_timer.h>
94 #include <netinet/tcp_var.h>
95 #include <netinet/tcpip.h>
96 #include <dev/rndvar.h>
97
98 #ifdef INET6
99 #include <netinet6/in6_var.h>
100 #include <netinet6/ip6protosw.h>
101 #endif /* INET6 */
102
103 #ifdef TCP_SIGNATURE
104 #include <syskern/md5.h>
105 #endif /* TCP_SIGNATURE */
106
107 /* patchable/settable parameters for tcp */
108 int tcp_mssdflt = TCP_MSS;
109 int tcp_rttdflt = TCPTV_SRTTDFLT / PR_SLOWHZ;
110
111 /*
112 * Configure kernel with options "TCP_DO_RFC1323=0" to disable RFC1323 stuff.
113 * This is a good idea over slow SLIP/PPP links, because the timestamp
114 * pretty well destroys the VJ compression (any packet with a timestamp
115 * different from the previous one can't be compressed), as well as adding
116 * more overhead.
117 * XXX And it should be a settable per route characteristic (with this just
118 * used as the default).
119 */
120 #ifndef TCP_DO_RFC1323
121 #define TCP_DO_RFC1323 1
122 #endif
123 int tcp_do_rfc1323 = TCP_DO_RFC1323;
124
125 #ifndef TCP_DO_SACK
126 #ifdef TCP_SACK
127 #define TCP_DO_SACK 1
128 #else
129 #define TCP_DO_SACK 0
130 #endif
131 #endif
132 int tcp_do_sack = TCP_DO_SACK; /* RFC 2018 selective ACKs */
133 int tcp_ack_on_push = 0; /* set to enable immediate ACK-on-PUSH */
134 int tcp_do_ecn = 1; /* RFC3168 ECN enabled/disabled? */
135 int tcp_do_rfc3390 = 0; /* RFC3390 Increasing TCP's Initial Window */
136
137 u_int32_t tcp_now;
138
139 #ifndef TCBHASHSIZE
140 #define TCBHASHSIZE 128
141 #endif
142 int tcbhashsize = TCBHASHSIZE;
143
144 /* syn hash parameters */
145 #define TCP_SYN_HASH_SIZE 293
146 #define TCP_SYN_BUCKET_SIZE 35
147 int tcp_syn_cache_size = TCP_SYN_HASH_SIZE;
148 int tcp_syn_cache_limit = TCP_SYN_HASH_SIZE*TCP_SYN_BUCKET_SIZE;
149 int tcp_syn_bucket_limit = 3*TCP_SYN_BUCKET_SIZE;
150 struct syn_cache_head tcp_syn_cache[TCP_SYN_HASH_SIZE];
151
152 int tcp_reass_limit = NMBCLUSTERS / 2; /* hardlimit for tcpqe_pool */
153 #ifdef TCP_SACK
154 int tcp_sackhole_limit = 32*1024; /* hardlimit for sackhl_pool */
155 #endif
156
157 #ifdef INET6
158 extern int ip6_defhlim;
159 #endif /* INET6 */
160
161 struct pool tcpcb_pool;
162 struct pool tcpqe_pool;
163 #ifdef TCP_SACK
164 struct pool sackhl_pool;
165 #endif
166
167 struct tcpstat tcpstat; /* tcp statistics */
168 tcp_seq tcp_iss;
169
170 /*
171 * Tcp initialization
172 */
173 void
tcp_init()174 tcp_init()
175 {
176 #ifdef TCP_COMPAT_42
177 tcp_iss = 1; /* wrong */
178 #endif /* TCP_COMPAT_42 */
179 pool_init(&tcpcb_pool, sizeof(struct tcpcb), 0, 0, 0, "tcpcbpl",
180 NULL);
181 pool_init(&tcpqe_pool, sizeof(struct ipqent), 0, 0, 0, "tcpqepl",
182 NULL);
183 pool_sethardlimit(&tcpqe_pool, tcp_reass_limit, NULL, 0);
184 #ifdef TCP_SACK
185 pool_init(&sackhl_pool, sizeof(struct sackhole), 0, 0, 0, "sackhlpl",
186 NULL);
187 pool_sethardlimit(&sackhl_pool, tcp_sackhole_limit, NULL, 0);
188 #endif /* TCP_SACK */
189 in_pcbinit(&tcbtable, tcbhashsize);
190 tcp_now = arc4random() / 2;
191
192 #ifdef INET6
193 /*
194 * Since sizeof(struct ip6_hdr) > sizeof(struct ip), we
195 * do max length checks/computations only on the former.
196 */
197 if (max_protohdr < (sizeof(struct ip6_hdr) + sizeof(struct tcphdr)))
198 max_protohdr = (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
199 if ((max_linkhdr + sizeof(struct ip6_hdr) + sizeof(struct tcphdr)) >
200 MHLEN)
201 panic("tcp_init");
202
203 icmp6_mtudisc_callback_register(tcp6_mtudisc_callback);
204 #endif /* INET6 */
205
206 /* Initialize the compressed state engine. */
207 syn_cache_init();
208
209 /* Initialize timer state. */
210 tcp_timer_init();
211 }
212
213 /*
214 * Create template to be used to send tcp packets on a connection.
215 * Call after host entry created, allocates an mbuf and fills
216 * in a skeletal tcp/ip header, minimizing the amount of work
217 * necessary when the connection is used.
218 *
219 * To support IPv6 in addition to IPv4 and considering that the sizes of
220 * the IPv4 and IPv6 headers are not the same, we now use a separate pointer
221 * for the TCP header. Also, we made the former tcpiphdr header pointer
222 * into just an IP overlay pointer, with casting as appropriate for v6. rja
223 */
224 struct mbuf *
tcp_template(tp)225 tcp_template(tp)
226 struct tcpcb *tp;
227 {
228 struct inpcb *inp = tp->t_inpcb;
229 struct mbuf *m;
230 struct tcphdr *th;
231
232 if ((m = tp->t_template) == 0) {
233 m = m_get(M_DONTWAIT, MT_HEADER);
234 if (m == NULL)
235 return (NULL);
236
237 switch (tp->pf) {
238 case 0: /*default to PF_INET*/
239 #ifdef INET
240 case AF_INET:
241 m->m_len = sizeof(struct ip);
242 break;
243 #endif /* INET */
244 #ifdef INET6
245 case AF_INET6:
246 m->m_len = sizeof(struct ip6_hdr);
247 break;
248 #endif /* INET6 */
249 }
250 m->m_len += sizeof (struct tcphdr);
251
252 /*
253 * The link header, network header, TCP header, and TCP options
254 * all must fit in this mbuf. For now, assume the worst case of
255 * TCP options size. Eventually, compute this from tp flags.
256 */
257 if (m->m_len + MAX_TCPOPTLEN + max_linkhdr >= MHLEN) {
258 MCLGET(m, M_DONTWAIT);
259 if ((m->m_flags & M_EXT) == 0) {
260 m_free(m);
261 return (0);
262 }
263 }
264 }
265
266 switch(tp->pf) {
267 #ifdef INET
268 case AF_INET:
269 {
270 struct ipovly *ipovly;
271
272 ipovly = mtod(m, struct ipovly *);
273
274 bzero(ipovly->ih_x1, sizeof ipovly->ih_x1);
275 ipovly->ih_pr = IPPROTO_TCP;
276 ipovly->ih_len = htons(sizeof (struct tcphdr));
277 ipovly->ih_src = inp->inp_laddr;
278 ipovly->ih_dst = inp->inp_faddr;
279
280 th = (struct tcphdr *)(mtod(m, caddr_t) +
281 sizeof(struct ip));
282 th->th_sum = in_cksum_phdr(ipovly->ih_src.s_addr,
283 ipovly->ih_dst.s_addr,
284 htons(sizeof (struct tcphdr) + IPPROTO_TCP));
285 }
286 break;
287 #endif /* INET */
288 #ifdef INET6
289 case AF_INET6:
290 {
291 struct ip6_hdr *ip6;
292
293 ip6 = mtod(m, struct ip6_hdr *);
294
295 ip6->ip6_src = inp->inp_laddr6;
296 ip6->ip6_dst = inp->inp_faddr6;
297 ip6->ip6_flow = htonl(0x60000000) |
298 (inp->inp_flowinfo & IPV6_FLOWLABEL_MASK);
299
300 ip6->ip6_nxt = IPPROTO_TCP;
301 ip6->ip6_plen = htons(sizeof(struct tcphdr)); /*XXX*/
302 ip6->ip6_hlim = in6_selecthlim(inp, NULL); /*XXX*/
303
304 th = (struct tcphdr *)(mtod(m, caddr_t) +
305 sizeof(struct ip6_hdr));
306 th->th_sum = 0;
307 }
308 break;
309 #endif /* INET6 */
310 default:
311 return (NULL);
312 }
313
314 th->th_sport = inp->inp_lport;
315 th->th_dport = inp->inp_fport;
316 th->th_seq = 0;
317 th->th_ack = 0;
318 th->th_x2 = 0;
319 th->th_off = 5;
320 th->th_flags = 0;
321 th->th_win = 0;
322 th->th_urp = 0;
323 return (m);
324 }
325
326 /*
327 * Send a single message to the TCP at address specified by
328 * the given TCP/IP header. If m == 0, then we make a copy
329 * of the tcpiphdr at ti and send directly to the addressed host.
330 * This is used to force keep alive messages out using the TCP
331 * template for a connection tp->t_template. If flags are given
332 * then we send a message back to the TCP which originated the
333 * segment ti, and discard the mbuf containing it and any other
334 * attached mbufs.
335 *
336 * In any case the ack and sequence number of the transmitted
337 * segment are as specified by the parameters.
338 */
339 #ifdef INET6
340 /* This function looks hairy, because it was so IPv4-dependent. */
341 #endif /* INET6 */
342 void
tcp_respond(tp,template,th0,ack,seq,flags)343 tcp_respond(tp, template, th0, ack, seq, flags)
344 struct tcpcb *tp;
345 caddr_t template;
346 struct tcphdr *th0;
347 tcp_seq ack, seq;
348 int flags;
349 {
350 int tlen;
351 int win = 0;
352 struct mbuf *m = 0;
353 struct route *ro = 0;
354 struct tcphdr *th;
355 struct ip *ip;
356 struct ipovly *ih;
357 #ifdef INET6
358 struct ip6_hdr *ip6;
359 #endif
360 int af; /* af on wire */
361
362 if (tp) {
363 win = sbspace(&tp->t_inpcb->inp_socket->so_rcv);
364 /*
365 * If this is called with an unconnected
366 * socket/tp/pcb (tp->pf is 0), we lose.
367 */
368 af = tp->pf;
369
370 /*
371 * The route/route6 distinction is meaningless
372 * unless you're allocating space or passing parameters.
373 */
374 ro = &tp->t_inpcb->inp_route;
375 } else
376 af = (((struct ip *)template)->ip_v == 6) ? AF_INET6 : AF_INET;
377
378 m = m_gethdr(M_DONTWAIT, MT_HEADER);
379 if (m == NULL)
380 return;
381 m->m_data += max_linkhdr;
382 #ifdef TCP_COMPAT_42
383 tlen = 1;
384 #else
385 tlen = 0;
386 #endif
387
388 #define xchg(a,b,type) do { type t; t=a; a=b; b=t; } while (0)
389 switch (af) {
390 #ifdef INET6
391 case AF_INET6:
392 ip6 = mtod(m, struct ip6_hdr *);
393 th = (struct tcphdr *)(ip6 + 1);
394 tlen = sizeof(*ip6) + sizeof(*th);
395 if (th0) {
396 bcopy(template, ip6, sizeof(*ip6));
397 bcopy(th0, th, sizeof(*th));
398 xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
399 } else {
400 bcopy(template, ip6, tlen);
401 }
402 break;
403 #endif /* INET6 */
404 case AF_INET:
405 ip = mtod(m, struct ip *);
406 th = (struct tcphdr *)(ip + 1);
407 tlen = sizeof(*ip) + sizeof(*th);
408 if (th0) {
409 bcopy(template, ip, sizeof(*ip));
410 bcopy(th0, th, sizeof(*th));
411 xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, u_int32_t);
412 } else {
413 bcopy(template, ip, tlen);
414 }
415 break;
416 }
417 if (th0)
418 xchg(th->th_dport, th->th_sport, u_int16_t);
419 else
420 flags = TH_ACK;
421 #undef xchg
422
423 m->m_len = tlen;
424 m->m_pkthdr.len = tlen;
425 m->m_pkthdr.rcvif = (struct ifnet *) 0;
426 th->th_seq = htonl(seq);
427 th->th_ack = htonl(ack);
428 th->th_x2 = 0;
429 th->th_off = sizeof (struct tcphdr) >> 2;
430 th->th_flags = flags;
431 if (tp)
432 win >>= tp->rcv_scale;
433 if (win > TCP_MAXWIN)
434 win = TCP_MAXWIN;
435 th->th_win = htons((u_int16_t)win);
436 th->th_urp = 0;
437
438 switch (af) {
439 #ifdef INET6
440 case AF_INET6:
441 ip6->ip6_flow = htonl(0x60000000);
442 ip6->ip6_nxt = IPPROTO_TCP;
443 ip6->ip6_hlim = in6_selecthlim(tp ? tp->t_inpcb : NULL, NULL); /*XXX*/
444 ip6->ip6_plen = tlen - sizeof(struct ip6_hdr);
445 th->th_sum = 0;
446 th->th_sum = in6_cksum(m, IPPROTO_TCP,
447 sizeof(struct ip6_hdr), ip6->ip6_plen);
448 HTONS(ip6->ip6_plen);
449 ip6_output(m, tp ? tp->t_inpcb->inp_outputopts6 : NULL,
450 (struct route_in6 *)ro, 0, NULL, NULL);
451 break;
452 #endif /* INET6 */
453 case AF_INET:
454 ih = (struct ipovly *)ip;
455 bzero(ih->ih_x1, sizeof ih->ih_x1);
456 ih->ih_len = htons((u_short)tlen - sizeof(struct ip));
457
458 /*
459 * There's no point deferring to hardware checksum processing
460 * here, as we only send a minimal TCP packet whose checksum
461 * we need to compute in any case.
462 */
463 th->th_sum = 0;
464 th->th_sum = in_cksum(m, tlen);
465 ip->ip_len = htons(tlen);
466 ip->ip_ttl = ip_defttl;
467 ip_output(m, (void *)NULL, ro, ip_mtudisc ? IP_MTUDISC : 0,
468 (void *)NULL, tp ? tp->t_inpcb : (void *)NULL);
469 }
470 }
471
472 /*
473 * Create a new TCP control block, making an
474 * empty reassembly queue and hooking it to the argument
475 * protocol control block.
476 */
477 struct tcpcb *
tcp_newtcpcb(struct inpcb * inp)478 tcp_newtcpcb(struct inpcb *inp)
479 {
480 struct tcpcb *tp;
481 int i;
482
483 tp = pool_get(&tcpcb_pool, PR_NOWAIT);
484 if (tp == NULL)
485 return ((struct tcpcb *)0);
486 bzero((char *) tp, sizeof(struct tcpcb));
487 LIST_INIT(&tp->segq);
488 tp->t_maxseg = tcp_mssdflt;
489 tp->t_maxopd = 0;
490
491 TCP_INIT_DELACK(tp);
492 for (i = 0; i < TCPT_NTIMERS; i++)
493 TCP_TIMER_INIT(tp, i);
494 timeout_set(&tp->t_reap_to, tcp_reaper, tp);
495
496 #ifdef TCP_SACK
497 tp->sack_enable = tcp_do_sack;
498 #endif
499 tp->t_flags = tcp_do_rfc1323 ? (TF_REQ_SCALE|TF_REQ_TSTMP) : 0;
500 tp->t_inpcb = inp;
501 /*
502 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
503 * rtt estimate. Set rttvar so that srtt + 2 * rttvar gives
504 * reasonable initial retransmit time.
505 */
506 tp->t_srtt = TCPTV_SRTTBASE;
507 tp->t_rttvar = tcp_rttdflt * PR_SLOWHZ << (TCP_RTTVAR_SHIFT + 2 - 1);
508 tp->t_rttmin = TCPTV_MIN;
509 TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp),
510 TCPTV_MIN, TCPTV_REXMTMAX);
511 tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
512 tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
513
514 tp->t_pmtud_mtu_sent = 0;
515 tp->t_pmtud_mss_acked = 0;
516
517 #ifdef INET6
518 /* we disallow IPv4 mapped address completely. */
519 if ((inp->inp_flags & INP_IPV6) == 0)
520 tp->pf = PF_INET;
521 else
522 tp->pf = PF_INET6;
523 #else
524 tp->pf = PF_INET;
525 #endif
526
527 #ifdef INET6
528 if (inp->inp_flags & INP_IPV6)
529 inp->inp_ipv6.ip6_hlim = ip6_defhlim;
530 else
531 #endif /* INET6 */
532 inp->inp_ip.ip_ttl = ip_defttl;
533
534 inp->inp_ppcb = (caddr_t)tp;
535 return (tp);
536 }
537
538 /*
539 * Drop a TCP connection, reporting
540 * the specified error. If connection is synchronized,
541 * then send a RST to peer.
542 */
543 struct tcpcb *
tcp_drop(tp,errno)544 tcp_drop(tp, errno)
545 struct tcpcb *tp;
546 int errno;
547 {
548 struct socket *so = tp->t_inpcb->inp_socket;
549
550 if (TCPS_HAVERCVDSYN(tp->t_state)) {
551 tp->t_state = TCPS_CLOSED;
552 (void) tcp_output(tp);
553 tcpstat.tcps_drops++;
554 } else
555 tcpstat.tcps_conndrops++;
556 if (errno == ETIMEDOUT && tp->t_softerror)
557 errno = tp->t_softerror;
558 so->so_error = errno;
559 return (tcp_close(tp));
560 }
561
562 /*
563 * Close a TCP control block:
564 * discard all space held by the tcp
565 * discard internet protocol block
566 * wake up any sleepers
567 */
568 struct tcpcb *
tcp_close(struct tcpcb * tp)569 tcp_close(struct tcpcb *tp)
570 {
571 struct inpcb *inp = tp->t_inpcb;
572 struct socket *so = inp->inp_socket;
573 #ifdef TCP_SACK
574 struct sackhole *p, *q;
575 #endif
576
577 /* free the reassembly queue, if any */
578 tcp_reass_lock(tp);
579 tcp_freeq(tp);
580 tcp_reass_unlock(tp);
581
582 tcp_canceltimers(tp);
583 TCP_CLEAR_DELACK(tp);
584 syn_cache_cleanup(tp);
585
586 #ifdef TCP_SACK
587 /* Free SACK holes. */
588 q = p = tp->snd_holes;
589 while (p != 0) {
590 q = p->next;
591 pool_put(&sackhl_pool, p);
592 p = q;
593 }
594 #endif
595 if (tp->t_template)
596 (void) m_free(tp->t_template);
597
598 tp->t_flags |= TF_DEAD;
599 timeout_add(&tp->t_reap_to, 0);
600
601 inp->inp_ppcb = 0;
602 soisdisconnected(so);
603 in_pcbdetach(inp);
604 return ((struct tcpcb *)0);
605 }
606
607 void
tcp_reaper(void * arg)608 tcp_reaper(void *arg)
609 {
610 struct tcpcb *tp = arg;
611 int s;
612
613 s = splsoftnet();
614 pool_put(&tcpcb_pool, tp);
615 splx(s);
616 tcpstat.tcps_closed++;
617 }
618
619 int
tcp_freeq(struct tcpcb * tp)620 tcp_freeq(struct tcpcb *tp)
621 {
622 struct ipqent *qe;
623 int rv = 0;
624
625 while ((qe = LIST_FIRST(&tp->segq)) != NULL) {
626 LIST_REMOVE(qe, ipqe_q);
627 m_freem(qe->ipqe_m);
628 pool_put(&tcpqe_pool, qe);
629 rv = 1;
630 }
631 return (rv);
632 }
633
634 void
tcp_drain()635 tcp_drain()
636 {
637 struct inpcb *inp;
638
639 /* called at splimp() */
640 CIRCLEQ_FOREACH(inp, &tcbtable.inpt_queue, inp_queue) {
641 struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
642
643 if (tp != NULL) {
644 if (tcp_reass_lock_try(tp) == 0)
645 continue;
646 if (tcp_freeq(tp))
647 tcpstat.tcps_conndrained++;
648 tcp_reass_unlock(tp);
649 }
650 }
651 }
652
653 /*
654 * Compute proper scaling value for receiver window from buffer space
655 */
656
657 void
tcp_rscale(struct tcpcb * tp,u_long hiwat)658 tcp_rscale(struct tcpcb *tp, u_long hiwat)
659 {
660 tp->request_r_scale = 0;
661 while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
662 TCP_MAXWIN << tp->request_r_scale < hiwat)
663 tp->request_r_scale++;
664 }
665
666 /*
667 * Notify a tcp user of an asynchronous error;
668 * store error as soft error, but wake up user
669 * (for now, won't do anything until can select for soft error).
670 */
671 void
tcp_notify(inp,error)672 tcp_notify(inp, error)
673 struct inpcb *inp;
674 int error;
675 {
676 struct tcpcb *tp = (struct tcpcb *)inp->inp_ppcb;
677 struct socket *so = inp->inp_socket;
678
679 /*
680 * Ignore some errors if we are hooked up.
681 * If connection hasn't completed, has retransmitted several times,
682 * and receives a second error, give up now. This is better
683 * than waiting a long time to establish a connection that
684 * can never complete.
685 */
686 if (tp->t_state == TCPS_ESTABLISHED &&
687 (error == EHOSTUNREACH || error == ENETUNREACH ||
688 error == EHOSTDOWN)) {
689 return;
690 } else if (TCPS_HAVEESTABLISHED(tp->t_state) == 0 &&
691 tp->t_rxtshift > 3 && tp->t_softerror)
692 so->so_error = error;
693 else
694 tp->t_softerror = error;
695 wakeup((caddr_t) &so->so_timeo);
696 sorwakeup(so);
697 sowwakeup(so);
698 }
699
700 #ifdef INET6
701 void
tcp6_ctlinput(cmd,sa,d)702 tcp6_ctlinput(cmd, sa, d)
703 int cmd;
704 struct sockaddr *sa;
705 void *d;
706 {
707 struct tcphdr th;
708 struct tcpcb *tp;
709 void (*notify)(struct inpcb *, int) = tcp_notify;
710 struct ip6_hdr *ip6;
711 const struct sockaddr_in6 *sa6_src = NULL;
712 struct sockaddr_in6 *sa6 = (struct sockaddr_in6 *)sa;
713 struct inpcb *inp;
714 struct mbuf *m;
715 tcp_seq seq;
716 int off;
717 struct {
718 u_int16_t th_sport;
719 u_int16_t th_dport;
720 u_int32_t th_seq;
721 } *thp;
722
723 if (sa->sa_family != AF_INET6 ||
724 sa->sa_len != sizeof(struct sockaddr_in6) ||
725 IN6_IS_ADDR_UNSPECIFIED(&sa6->sin6_addr) ||
726 IN6_IS_ADDR_V4MAPPED(&sa6->sin6_addr))
727 return;
728 if ((unsigned)cmd >= PRC_NCMDS)
729 return;
730 else if (cmd == PRC_QUENCH) {
731 /* XXX there's no PRC_QUENCH in IPv6 */
732 notify = tcp_quench;
733 } else if (PRC_IS_REDIRECT(cmd))
734 notify = in_rtchange, d = NULL;
735 else if (cmd == PRC_MSGSIZE)
736 ; /* special code is present, see below */
737 else if (cmd == PRC_HOSTDEAD)
738 d = NULL;
739 else if (inet6ctlerrmap[cmd] == 0)
740 return;
741
742 /* if the parameter is from icmp6, decode it. */
743 if (d != NULL) {
744 struct ip6ctlparam *ip6cp = (struct ip6ctlparam *)d;
745 m = ip6cp->ip6c_m;
746 ip6 = ip6cp->ip6c_ip6;
747 off = ip6cp->ip6c_off;
748 sa6_src = ip6cp->ip6c_src;
749 } else {
750 m = NULL;
751 ip6 = NULL;
752 off = 0;
753 sa6_src = &sa6_any;
754 }
755
756 if (ip6) {
757 /*
758 * XXX: We assume that when ip6 is non NULL,
759 * M and OFF are valid.
760 */
761
762 /* check if we can safely examine src and dst ports */
763 if (m->m_pkthdr.len < off + sizeof(*thp))
764 return;
765
766 bzero(&th, sizeof(th));
767 #ifdef DIAGNOSTIC
768 if (sizeof(*thp) > sizeof(th))
769 panic("assumption failed in tcp6_ctlinput");
770 #endif
771 m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
772
773 /*
774 * Check to see if we have a valid TCP connection
775 * corresponding to the address in the ICMPv6 message
776 * payload.
777 */
778 inp = in6_pcbhashlookup(&tcbtable, &sa6->sin6_addr,
779 th.th_dport, (struct in6_addr *)&sa6_src->sin6_addr,
780 th.th_sport);
781 if (cmd == PRC_MSGSIZE) {
782 /*
783 * Depending on the value of "valid" and routing table
784 * size (mtudisc_{hi,lo}wat), we will:
785 * - recalcurate the new MTU and create the
786 * corresponding routing entry, or
787 * - ignore the MTU change notification.
788 */
789 icmp6_mtudisc_update((struct ip6ctlparam *)d, inp != NULL);
790 return;
791 }
792 if (inp) {
793 seq = ntohl(th.th_seq);
794 if (inp->inp_socket &&
795 (tp = intotcpcb(inp)) &&
796 SEQ_GEQ(seq, tp->snd_una) &&
797 SEQ_LT(seq, tp->snd_max))
798 notify(inp, inet6ctlerrmap[cmd]);
799 } else if (syn_cache_count &&
800 (inet6ctlerrmap[cmd] == EHOSTUNREACH ||
801 inet6ctlerrmap[cmd] == ENETUNREACH ||
802 inet6ctlerrmap[cmd] == EHOSTDOWN))
803 syn_cache_unreach((struct sockaddr *)sa6_src,
804 sa, &th);
805 } else {
806 (void) in6_pcbnotify(&tcbtable, sa, 0,
807 (struct sockaddr *)sa6_src, 0, cmd, NULL, notify);
808 }
809 }
810 #endif
811
812 void *
tcp_ctlinput(cmd,sa,v)813 tcp_ctlinput(cmd, sa, v)
814 int cmd;
815 struct sockaddr *sa;
816 void *v;
817 {
818 struct ip *ip = v;
819 struct tcphdr *th;
820 struct tcpcb *tp;
821 struct inpcb *inp;
822 struct in_addr faddr;
823 tcp_seq seq;
824 extern int inetctlerrmap[];
825 void (*notify)(struct inpcb *, int) = tcp_notify;
826 u_int mtu;
827 int errno;
828
829 if (sa->sa_family != AF_INET)
830 return NULL;
831 faddr = satosin(sa)->sin_addr;
832 if (faddr.s_addr == INADDR_ANY)
833 return NULL;
834
835 if ((unsigned)cmd >= PRC_NCMDS)
836 return NULL;
837 errno = inetctlerrmap[cmd];
838 if (cmd == PRC_QUENCH)
839 notify = tcp_quench;
840 else if (PRC_IS_REDIRECT(cmd))
841 notify = in_rtchange, ip = 0;
842 else if (cmd == PRC_MSGSIZE && ip_mtudisc && ip) {
843 /*
844 * Verify that the packet in the icmp payload refers
845 * to an existing TCP connection.
846 */
847 th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
848 seq = ntohl(th->th_seq);
849 inp = in_pcbhashlookup(&tcbtable,
850 ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport);
851 if (inp && (tp = intotcpcb(inp)) &&
852 SEQ_GEQ(seq, tp->snd_una) &&
853 SEQ_LT(seq, tp->snd_max)) {
854 struct icmp *icp;
855 icp = (struct icmp *)((caddr_t)ip -
856 offsetof(struct icmp, icmp_ip));
857
858 /*
859 * If the ICMP message advertises a Next-Hop MTU
860 * equal or larger than the maximum packet size we have
861 * ever sent, drop the message.
862 */
863 mtu = (u_int)ntohs(icp->icmp_nextmtu);
864 if (mtu >= tp->t_pmtud_mtu_sent)
865 return NULL;
866 if (mtu >= tcp_hdrsz(tp) + tp->t_pmtud_mss_acked) {
867 /*
868 * Calculate new MTU, and create corresponding
869 * route (traditional PMTUD).
870 */
871 tp->t_flags &= ~TF_PMTUD_PEND;
872 icmp_mtudisc(icp);
873 } else {
874 /*
875 * Record the information got in the ICMP
876 * message; act on it later.
877 * If we had already recorded an ICMP message,
878 * replace the old one only if the new message
879 * refers to an older TCP segment
880 */
881 if (tp->t_flags & TF_PMTUD_PEND) {
882 if (SEQ_LT(tp->t_pmtud_th_seq, seq))
883 return NULL;
884 } else
885 tp->t_flags |= TF_PMTUD_PEND;
886 tp->t_pmtud_th_seq = seq;
887 tp->t_pmtud_nextmtu = icp->icmp_nextmtu;
888 tp->t_pmtud_ip_len = icp->icmp_ip.ip_len;
889 tp->t_pmtud_ip_hl = icp->icmp_ip.ip_hl;
890 return NULL;
891 }
892 }
893 notify = tcp_mtudisc, ip = 0;
894 } else if (cmd == PRC_MTUINC)
895 notify = tcp_mtudisc_increase, ip = 0;
896 else if (cmd == PRC_HOSTDEAD)
897 ip = 0;
898 else if (errno == 0)
899 return NULL;
900
901 if (ip) {
902 th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
903 inp = in_pcbhashlookup(&tcbtable,
904 ip->ip_dst, th->th_dport, ip->ip_src, th->th_sport);
905 if (inp) {
906 seq = ntohl(th->th_seq);
907 if (inp->inp_socket &&
908 (tp = intotcpcb(inp)) &&
909 SEQ_GEQ(seq, tp->snd_una) &&
910 SEQ_LT(seq, tp->snd_max))
911 notify(inp, errno);
912 } else if (syn_cache_count &&
913 (inetctlerrmap[cmd] == EHOSTUNREACH ||
914 inetctlerrmap[cmd] == ENETUNREACH ||
915 inetctlerrmap[cmd] == EHOSTDOWN)) {
916 struct sockaddr_in sin;
917
918 bzero(&sin, sizeof(sin));
919 sin.sin_len = sizeof(sin);
920 sin.sin_family = AF_INET;
921 sin.sin_port = th->th_sport;
922 sin.sin_addr = ip->ip_src;
923 syn_cache_unreach((struct sockaddr *)&sin,
924 sa, th);
925 }
926 } else
927 in_pcbnotifyall(&tcbtable, sa, errno, notify);
928
929 return NULL;
930 }
931
932 /*
933 * When a source quench is received, close congestion window
934 * to one segment. We will gradually open it again as we proceed.
935 */
936 void
tcp_quench(inp,errno)937 tcp_quench(inp, errno)
938 struct inpcb *inp;
939 int errno;
940 {
941 struct tcpcb *tp = intotcpcb(inp);
942
943 if (tp)
944 tp->snd_cwnd = tp->t_maxseg;
945 }
946
947 #ifdef INET6
948 /*
949 * Path MTU Discovery handlers.
950 */
951 void
tcp6_mtudisc_callback(faddr)952 tcp6_mtudisc_callback(faddr)
953 struct in6_addr *faddr;
954 {
955 struct sockaddr_in6 sin6;
956
957 bzero(&sin6, sizeof(sin6));
958 sin6.sin6_family = AF_INET6;
959 sin6.sin6_len = sizeof(struct sockaddr_in6);
960 sin6.sin6_addr = *faddr;
961 (void) in6_pcbnotify(&tcbtable, (struct sockaddr *)&sin6, 0,
962 (struct sockaddr *)&sa6_any, 0, PRC_MSGSIZE, NULL, tcp_mtudisc);
963 }
964 #endif /* INET6 */
965
966 /*
967 * On receipt of path MTU corrections, flush old route and replace it
968 * with the new one. Retransmit all unacknowledged packets, to ensure
969 * that all packets will be received.
970 */
971 void
tcp_mtudisc(inp,errno)972 tcp_mtudisc(inp, errno)
973 struct inpcb *inp;
974 int errno;
975 {
976 struct tcpcb *tp = intotcpcb(inp);
977 struct rtentry *rt = in_pcbrtentry(inp);
978 int change = 0;
979
980 if (tp != 0) {
981 int orig_maxseg = tp->t_maxseg;
982 if (rt != 0) {
983 /*
984 * If this was not a host route, remove and realloc.
985 */
986 if ((rt->rt_flags & RTF_HOST) == 0) {
987 in_rtchange(inp, errno);
988 if ((rt = in_pcbrtentry(inp)) == 0)
989 return;
990 }
991 if (orig_maxseg != tp->t_maxseg ||
992 (rt->rt_rmx.rmx_locks & RTV_MTU))
993 change = 1;
994 }
995 tcp_mss(tp, -1);
996
997 /*
998 * Resend unacknowledged packets
999 */
1000 tp->snd_nxt = tp->snd_una;
1001 if (change || errno > 0)
1002 tcp_output(tp);
1003 }
1004 }
1005
1006 void
tcp_mtudisc_increase(inp,errno)1007 tcp_mtudisc_increase(inp, errno)
1008 struct inpcb *inp;
1009 int errno;
1010 {
1011 struct tcpcb *tp = intotcpcb(inp);
1012 struct rtentry *rt = in_pcbrtentry(inp);
1013
1014 if (tp != 0 && rt != 0) {
1015 /*
1016 * If this was a host route, remove and realloc.
1017 */
1018 if (rt->rt_flags & RTF_HOST)
1019 in_rtchange(inp, errno);
1020
1021 /* also takes care of congestion window */
1022 tcp_mss(tp, -1);
1023 }
1024 }
1025
1026 #ifdef TCP_SIGNATURE
1027 int
tcp_signature_tdb_attach()1028 tcp_signature_tdb_attach()
1029 {
1030 return (0);
1031 }
1032
1033 int
tcp_signature_tdb_init(tdbp,xsp,ii)1034 tcp_signature_tdb_init(tdbp, xsp, ii)
1035 struct tdb *tdbp;
1036 struct xformsw *xsp;
1037 struct ipsecinit *ii;
1038 {
1039 if ((ii->ii_authkeylen < 1) || (ii->ii_authkeylen > 80))
1040 return (EINVAL);
1041
1042 tdbp->tdb_amxkey = malloc(ii->ii_authkeylen, M_XDATA, M_DONTWAIT);
1043 if (tdbp->tdb_amxkey == NULL)
1044 return (ENOMEM);
1045 bcopy(ii->ii_authkey, tdbp->tdb_amxkey, ii->ii_authkeylen);
1046 tdbp->tdb_amxkeylen = ii->ii_authkeylen;
1047
1048 return (0);
1049 }
1050
1051 int
tcp_signature_tdb_zeroize(tdbp)1052 tcp_signature_tdb_zeroize(tdbp)
1053 struct tdb *tdbp;
1054 {
1055 if (tdbp->tdb_amxkey) {
1056 bzero(tdbp->tdb_amxkey, tdbp->tdb_amxkeylen);
1057 free(tdbp->tdb_amxkey, M_XDATA);
1058 tdbp->tdb_amxkey = NULL;
1059 }
1060
1061 return (0);
1062 }
1063
1064 int
tcp_signature_tdb_input(m,tdbp,skip,protoff)1065 tcp_signature_tdb_input(m, tdbp, skip, protoff)
1066 struct mbuf *m;
1067 struct tdb *tdbp;
1068 int skip, protoff;
1069 {
1070 return (0);
1071 }
1072
1073 int
tcp_signature_tdb_output(m,tdbp,mp,skip,protoff)1074 tcp_signature_tdb_output(m, tdbp, mp, skip, protoff)
1075 struct mbuf *m;
1076 struct tdb *tdbp;
1077 struct mbuf **mp;
1078 int skip, protoff;
1079 {
1080 return (EINVAL);
1081 }
1082
1083 int
tcp_signature_apply(fstate,data,len)1084 tcp_signature_apply(fstate, data, len)
1085 caddr_t fstate;
1086 caddr_t data;
1087 unsigned int len;
1088 {
1089 MD5Update((MD5_CTX *)fstate, (char *)data, len);
1090 return 0;
1091 }
1092 #endif /* TCP_SIGNATURE */
1093
1094 #define TCP_RNDISS_ROUNDS 16
1095 #define TCP_RNDISS_OUT 7200
1096 #define TCP_RNDISS_MAX 30000
1097
1098 u_int8_t tcp_rndiss_sbox[128];
1099 u_int16_t tcp_rndiss_msb;
1100 u_int16_t tcp_rndiss_cnt;
1101 time_t tcp_rndiss_reseed;
1102
1103 u_int16_t
tcp_rndiss_encrypt(val)1104 tcp_rndiss_encrypt(val)
1105 u_int16_t val;
1106 {
1107 u_int16_t sum = 0, i;
1108
1109 for (i = 0; i < TCP_RNDISS_ROUNDS; i++) {
1110 sum += 0x79b9;
1111 val ^= ((u_int16_t)tcp_rndiss_sbox[(val^sum) & 0x7f]) << 7;
1112 val = ((val & 0xff) << 7) | (val >> 8);
1113 }
1114
1115 return val;
1116 }
1117
1118 void
tcp_rndiss_init()1119 tcp_rndiss_init()
1120 {
1121 get_random_bytes(tcp_rndiss_sbox, sizeof(tcp_rndiss_sbox));
1122
1123 tcp_rndiss_reseed = time.tv_sec + TCP_RNDISS_OUT;
1124 tcp_rndiss_msb = tcp_rndiss_msb == 0x8000 ? 0 : 0x8000;
1125 tcp_rndiss_cnt = 0;
1126 }
1127
1128 tcp_seq
tcp_rndiss_next()1129 tcp_rndiss_next()
1130 {
1131 if (tcp_rndiss_cnt >= TCP_RNDISS_MAX ||
1132 time.tv_sec > tcp_rndiss_reseed)
1133 tcp_rndiss_init();
1134
1135 /* (arc4random() & 0x7fff) ensures a 32768 byte gap between ISS */
1136 return ((tcp_rndiss_encrypt(tcp_rndiss_cnt++) | tcp_rndiss_msb) <<16) |
1137 (arc4random() & 0x7fff);
1138 }
1139