1 /**	$MirOS: src/sys/netinet/tcp_output.c,v 1.6 2011/11/20 18:54:51 tg Exp $ */
2 /*	$OpenBSD: tcp_output.c,v 1.79 2005/06/30 08:51:31 markus Exp $	*/
3 /*	$NetBSD: tcp_output.c,v 1.16 1997/06/03 16:17:09 kml Exp $	*/
4 
5 /*
6  * Copyright (c) 1982, 1986, 1988, 1990, 1993
7  *	The Regents of the University of California.  All rights reserved.
8  *
9  * Redistribution and use in source and binary forms, with or without
10  * modification, are permitted provided that the following conditions
11  * are met:
12  * 1. Redistributions of source code must retain the above copyright
13  *    notice, this list of conditions and the following disclaimer.
14  * 2. Redistributions in binary form must reproduce the above copyright
15  *    notice, this list of conditions and the following disclaimer in the
16  *    documentation and/or other materials provided with the distribution.
17  * 3. Neither the name of the University nor the names of its contributors
18  *    may be used to endorse or promote products derived from this software
19  *    without specific prior written permission.
20  *
21  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
22  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
23  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
24  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
25  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
26  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
27  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
28  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
29  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
30  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
31  * SUCH DAMAGE.
32  *
33  *	@(#)COPYRIGHT	1.1 (NRL) 17 January 1995
34  *
35  * NRL grants permission for redistribution and use in source and binary
36  * forms, with or without modification, of the software and documentation
37  * created at NRL provided that the following conditions are met:
38  *
39  * 1. Redistributions of source code must retain the above copyright
40  *    notice, this list of conditions and the following disclaimer.
41  * 2. Redistributions in binary form must reproduce the above copyright
42  *    notice, this list of conditions and the following disclaimer in the
43  *    documentation and/or other materials provided with the distribution.
44  * 3. All advertising materials mentioning features or use of this software
45  *    must display the following acknowledgements:
46  * 	This product includes software developed by the University of
47  * 	California, Berkeley and its contributors.
48  * 	This product includes software developed at the Information
49  * 	Technology Division, US Naval Research Laboratory.
50  * 4. Neither the name of the NRL nor the names of its contributors
51  *    may be used to endorse or promote products derived from this software
52  *    without specific prior written permission.
53  *
54  * THE SOFTWARE PROVIDED BY NRL IS PROVIDED BY NRL AND CONTRIBUTORS ``AS
55  * IS'' AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED
56  * TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A
57  * PARTICULAR PURPOSE ARE DISCLAIMED.  IN NO EVENT SHALL NRL OR
58  * CONTRIBUTORS BE LIABLE FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL,
59  * EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT NOT LIMITED TO,
60  * PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
61  * PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF
62  * LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING
63  * NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS
64  * SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE.
65  *
66  * The views and conclusions contained in the software and documentation
67  * are those of the authors and should not be interpreted as representing
68  * official policies, either expressed or implied, of the US Naval
69  * Research Laboratory (NRL).
70  */
71 
72 /*
73  * Additional improvements
74  * copyright (c) 2005, 2006 by Marco Munari <mar.develops allerta.it>
75  *
76  * Redistribution and use in source and binary forms, with or without
77  * modification, are permitted provided that the following conditions
78  * are met:
79  * 1. Redistributions of source code must retain the above copyright
80  *    notice, this list of conditions and the following disclaimer.
81  * 2. Redistributions in binary form must reproduce the above copyright
82  *    notice, this list of conditions and the following disclaimer in the
83  *    documentation and/or other materials provided with the distribution.
84  * 3. Neither the name of allerta nor the names of its contributors
85  *    may be used to endorse or promote products derived from this software
86  *    without specific prior written permission.
87  *
88  * SOURCE CODE PROVIDED ``AS IS'' WITHOUT WARRANTIES, BUT WITH HAPPY FUN
89  *                                                    AND A SORT OF LOVE.
90  */
91 
92 #include <sys/param.h>
93 #include <sys/systm.h>
94 #include <sys/mbuf.h>
95 #include <sys/protosw.h>
96 #include <sys/socket.h>
97 #include <sys/socketvar.h>
98 #include <sys/kernel.h>
99 
100 #include <net/route.h>
101 #include <net/if.h>
102 
103 #include <netinet/in.h>
104 #include <netinet/in_systm.h>
105 #include <netinet/ip.h>
106 #include <netinet/in_pcb.h>
107 #include <netinet/ip_var.h>
108 #include <netinet/tcp.h>
109 #define	TCPOUTFLAGS
110 #include <netinet/tcp_fsm.h>
111 #include <netinet/tcp_seq.h>
112 #include <netinet/tcp_timer.h>
113 #include <netinet/tcp_var.h>
114 #include <netinet/tcpip.h>
115 #include <netinet/tcp_debug.h>
116 
117 #ifdef TUBA
118 #include <netiso/iso.h>
119 #include <netiso/tuba_table.h>
120 #endif
121 
122 #ifdef INET6
123 #include <netinet6/tcpipv6.h>
124 #include <netinet6/in6_var.h>
125 #endif /* INET6 */
126 
127 #ifdef TCP_SIGNATURE
128 #include <syskern/md5.h>
129 #endif /* TCP_SIGNATURE */
130 
131 #ifdef notyet
132 extern struct mbuf *m_copypack();
133 #endif
134 
135 #ifdef TCP_SACK
136 extern int tcprexmtthresh;
137 #endif
138 int stdbsdtcp=1;
139 
140 #ifdef TCP_SACK
141 #ifdef TCP_SACK_DEBUG
142 void tcp_print_holes(struct tcpcb *tp);
143 
144 void
tcp_print_holes(struct tcpcb * tp)145 tcp_print_holes(struct tcpcb *tp)
146 {
147 	struct sackhole *p = tp->snd_holes;
148 	if (p == 0)
149 		return;
150 	printf("Hole report: start--end dups rxmit\n");
151 	while (p) {
152 		printf("%x--%x d %d r %x\n", p->start, p->end, p->dups,
153 		    p->rxmit);
154 		p = p->next;
155 	}
156 	printf("\n");
157 }
158 #endif /* TCP_SACK_DEBUG */
159 
160 /*
161  * Returns pointer to a sackhole if there are any pending retransmissions;
162  * NULL otherwise.
163  */
164 struct sackhole *
tcp_sack_output(struct tcpcb * tp)165 tcp_sack_output(struct tcpcb *tp)
166 {
167 	struct sackhole *p;
168 
169 	if (!tp->sack_enable)
170 		return (NULL);
171 	p = tp->snd_holes;
172 	while (p) {
173 		/* In FACK, if p->dups is less than tcprexmtthresh, but
174 		 * snd_fack advances more than tcprextmtthresh * tp->t_maxseg,
175 		 * tcp_input() will try fast retransmit. This forces output.
176 		 */
177 		if ((p->dups >= tcprexmtthresh
178 #ifdef TCP_FACK
179 		    || tp->t_dupacks == tcprexmtthresh
180 #endif /* TCP_FACK */
181 		    ) && SEQ_LT(p->rxmit, p->end)) {
182 
183 			if (SEQ_LT(p->rxmit, tp->snd_una)) {/* old SACK hole */
184 				p = p->next;
185 				continue;
186 			}
187 #ifdef TCP_SACK_DEBUG
188 			if (p)
189 				tcp_print_holes(tp);
190 #endif
191 			return (p);
192 		}
193         	p = p->next;
194 	}
195 	return (NULL);
196 }
197 
198 /*
199  * After a timeout, the SACK list may be rebuilt.  This SACK information
200  * should be used to avoid retransmitting SACKed data.  This function
201  * traverses the SACK list to see if snd_nxt should be moved forward.
202  */
203 
204 void
tcp_sack_adjust(struct tcpcb * tp)205 tcp_sack_adjust(struct tcpcb *tp)
206 {
207 	struct sackhole *cur = tp->snd_holes;
208 	if (cur == NULL)
209 		return; /* No holes */
210 	if (SEQ_GEQ(tp->snd_nxt, tp->rcv_lastsack))
211 		return; /* We're already beyond any SACKed blocks */
212 	/*
213 	 * Two cases for which we want to advance snd_nxt:
214 	 * i) snd_nxt lies between end of one hole and beginning of another
215 	 * ii) snd_nxt lies between end of last hole and rcv_lastsack
216 	 */
217 	while (cur->next) {
218 		if (SEQ_LT(tp->snd_nxt, cur->end))
219 			return;
220 		if (SEQ_GEQ(tp->snd_nxt, cur->next->start))
221 			cur = cur->next;
222 		else {
223 			tp->snd_nxt = cur->next->start;
224 			return;
225 		}
226 	}
227 	if (SEQ_LT(tp->snd_nxt, cur->end))
228 		return;
229 	tp->snd_nxt = tp->rcv_lastsack;
230 	return;
231 }
232 #endif /* TCP_SACK */
233 
234 /*
235  * Tcp output routine: figure out what should be sent and send it.
236  */
237 int
tcp_output(tp)238 tcp_output(tp)
239 	struct tcpcb *tp;
240 {
241 	struct socket *so = tp->t_inpcb->inp_socket;
242 	long len = 0, win, txmaxseg;
243 	int off, flags, error = 0;
244 	struct mbuf *m;
245 	struct tcphdr *th;
246 	u_char opt[MAX_TCPOPTLEN];
247 	unsigned int optlen, hdrlen, packetlen;
248 	int idle, sendalot = 0;
249 	int tstmp_cond;		/* cache a complex condition now used twice */
250 #ifdef TCP_SACK
251 	int tsack_cond = 0;
252 	int i, sack_rxmit = 0;
253 	struct sackhole *p = NULL;
254 #endif
255 #if defined(TCP_SACK)
256 	int maxburst = TCP_MAXBURST;
257 #endif
258 #ifdef TCP_SIGNATURE
259 	unsigned int sigoff;
260 #endif /* TCP_SIGNATURE */
261 #ifdef TCP_ECN
262 	int needect;
263 #endif
264 
265 #if defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC)
266 	if (tp->sack_enable && (tp->t_flags & TF_SIGNATURE))
267 		return (EINVAL);
268 #endif /* defined(TCP_SACK) && defined(TCP_SIGNATURE) && defined(DIAGNOSTIC) */
269 
270 	/*
271 	 * Determine length of data that should be transmitted,
272 	 * and flags that will be used.
273 	 * If there is some data or critical controls (SYN, RST)
274 	 * to send, then transmit; otherwise, investigate further.
275 	 */
276 	idle = (tp->snd_max == tp->snd_una);
277 	if (idle && (tcp_now - tp->t_rcvtime) >= tp->t_rxtcur)
278 		/*
279 		 * We have been idle for "a while" and no acks are
280 		 * expected to clock out any data we send --
281 		 * slow start to get ack "clock" running again.
282 		 */
283 		tp->snd_cwnd = tp->t_maxseg;
284 again:
285 #ifdef TCP_SACK
286 	/*
287 	 * If we've recently taken a timeout, snd_max will be greater than
288 	 * snd_nxt.  There may be SACK information that allows us to avoid
289 	 * resending already delivered data.  Adjust snd_nxt accordingly.
290 	 */
291 	if (tp->sack_enable && SEQ_LT(tp->snd_nxt, tp->snd_max))
292 		tcp_sack_adjust(tp);
293 #endif
294 	off = tp->snd_nxt - tp->snd_una;
295 #if defined(TCP_SACK) && defined(TCP_FACK)
296 	/* Normally, sendable data is limited by off < tp->snd_cwnd.
297 	 * But in FACK, sendable data is limited by snd_awnd < snd_cwnd,
298 	 * regardless of offset.
299 	 */
300 	if (tp->sack_enable && (tp->t_dupacks > tcprexmtthresh))
301 		win = tp->snd_wnd;
302 	else
303 #endif
304 	win = ulmin(tp->snd_wnd, tp->snd_cwnd);
305 
306 	flags = tcp_outflags[tp->t_state];
307 
308 #ifdef TCP_SACK
309 	/*
310 	 * Send any SACK-generated retransmissions.  If we're explicitly trying
311 	 * to send out new data (when sendalot is 1), bypass this function.
312 	 * If we retransmit in fast recovery mode, decrement snd_cwnd, since
313 	 * we're replacing a (future) new transmission with a retransmission
314 	 * now, and we previously incremented snd_cwnd in tcp_input().
315 	 */
316 	if (tp->sack_enable && !sendalot) {
317 		if (tp->t_dupacks >= tcprexmtthresh &&
318 		    (p = tcp_sack_output(tp))) {
319 			off = p->rxmit - tp->snd_una;
320 			sack_rxmit = 1;
321 #if 0
322 			/* Coalesce holes into a single retransmission */
323 #endif
324 			len = min(tp->t_maxseg, p->end - p->rxmit);
325 #ifndef TCP_FACK
326 			/* in FACK, hold snd_cwnd constant during recovery */
327 			if (SEQ_LT(tp->snd_una, tp->snd_last))
328 				tp->snd_cwnd -= tp->t_maxseg;
329 #endif
330     		}
331 	}
332 #endif /* TCP_SACK */
333 
334 	sendalot = 0;
335 	/*
336 	 * If in persist timeout with window of 0, send 1 byte.
337 	 * Otherwise, if window is small but nonzero
338 	 * and timer expired, we will send what we can
339 	 * and go to transmit state.
340 	 */
341 	if (tp->t_force) {
342 		if (win == 0) {
343 			/*
344 			 * If we still have some data to send, then
345 			 * clear the FIN bit.  Usually this would
346 			 * happen below when it realizes that we
347 			 * aren't sending all the data.  However,
348 			 * if we have exactly 1 byte of unset data,
349 			 * then it won't clear the FIN bit below,
350 			 * and if we are in persist state, we wind
351 			 * up sending the packet without recording
352 			 * that we sent the FIN bit.
353 			 *
354 			 * We can't just blindly clear the FIN bit,
355 			 * because if we don't have any more data
356 			 * to send then the probe will be the FIN
357 			 * itself.
358 			 */
359 			if (off < so->so_snd.sb_cc)
360 				flags &= ~TH_FIN;
361 			win = 1;
362 		} else {
363 			TCP_TIMER_DISARM(tp, TCPT_PERSIST);
364 			tp->t_rxtshift = 0;
365 		}
366 	}
367 
368 #ifdef TCP_SACK
369 	if (!sack_rxmit) {
370 #endif
371 	len = ulmin(so->so_snd.sb_cc, win) - off;
372 
373 #if defined(TCP_SACK) && defined(TCP_FACK)
374 	/*
375 	 * If we're in fast recovery (SEQ_GT(tp->snd_last, tp->snd_una)), and
376 	 * amount of outstanding data (snd_awnd) is >= snd_cwnd, then
377 	 * do not send data (like zero window conditions)
378 	 */
379 	if (tp->sack_enable && len && SEQ_GT(tp->snd_last, tp->snd_una) &&
380 	    (tp->snd_awnd >= tp->snd_cwnd))
381 		len = 0;
382 #endif /* TCP_FACK */
383 #ifdef TCP_SACK
384 	}
385 #endif
386 
387 	if (len < 0) {
388 		/*
389 		 * If FIN has been sent but not acked,
390 		 * but we haven't been called to retransmit,
391 		 * len will be -1.  Otherwise, window shrank
392 		 * after we sent into it.  If window shrank to 0,
393 		 * cancel pending retransmit, pull snd_nxt back
394 		 * to (closed) window, and set the persist timer
395 		 * if it isn't already going.  If the window didn't
396 		 * close completely, just wait for an ACK.
397 		 */
398 		len = 0;
399 		if (win == 0) {
400 			TCP_TIMER_DISARM(tp, TCPT_REXMT);
401 			tp->t_rxtshift = 0;
402 			tp->snd_nxt = tp->snd_una;
403 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0)
404 				tcp_setpersist(tp);
405 		}
406 	}
407 
408         /*
409          * Never send more than half a buffer full.  This insures that we can
410          * always keep 2 packets on the wire, no matter what SO_SNDBUF is, and
411          * therefore acks will never be delayed unless we run out of data to
412          * transmit.
413          */
414 	txmaxseg = ulmin(so->so_snd.sb_hiwat / 2, tp->t_maxseg);
415 
416 	if (len > txmaxseg) {
417 		len = txmaxseg;
418 		sendalot = 1;
419 	}
420 	if (off + len < so->so_snd.sb_cc)
421 		flags &= ~TH_FIN;
422 
423 	win = sbspace(&so->so_rcv);
424 
425 	/*
426 	 * Sender silly window avoidance.  If connection is idle
427 	 * and can send all data, a maximum segment,
428 	 * at least a maximum default-size segment do it,
429 	 * or are forced, do it; otherwise don't bother.
430 	 * If peer's buffer is tiny, then send
431 	 * when window is at least half open.
432 	 * If retransmitting (possibly after persist timer forced us
433 	 * to send into a small window), then must resend.
434 	 */
435 	if (len) {
436 		if (len == txmaxseg)
437 			goto send;
438 		if ((idle || tp->t_flags & TF_NODELAY) &&
439 		    len + off >= so->so_snd.sb_cc)
440 			goto send;
441 		if (tp->t_force)
442 			goto send;
443 		if (len >= tp->max_sndwnd / 2 && tp->max_sndwnd > 0)
444 			goto send;
445 		if (SEQ_LT(tp->snd_nxt, tp->snd_max))
446 			goto send;
447 #ifdef TCP_SACK
448 		if (sack_rxmit)
449 			goto send;
450 #endif
451 	}
452 
453 	/*
454 	 * Compare available window to amount of window
455 	 * known to peer (as advertised window less
456 	 * next expected input).  If the difference is at least two
457 	 * max size segments, or at least 50% of the maximum possible
458 	 * window, then want to send a window update to peer.
459 	 */
460 	if (win > 0) {
461 		/*
462 		 * "adv" is the amount we can increase the window,
463 		 * taking into account that we are limited by
464 		 * TCP_MAXWIN << tp->rcv_scale.
465 		 */
466 		long adv = lmin(win, (long)TCP_MAXWIN << tp->rcv_scale) -
467 			(tp->rcv_adv - tp->rcv_nxt);
468 
469 		if (adv >= (long) (2 * tp->t_maxseg))
470 			goto send;
471 		if (2 * adv >= (long) so->so_rcv.sb_hiwat)
472 			goto send;
473 	}
474 
475 	/*
476 	 * Send if we owe peer an ACK.
477 	 */
478 	if (tp->t_flags & TF_ACKNOW)
479 		goto send;
480 	if (flags & (TH_SYN|TH_RST))
481 		goto send;
482 	if (SEQ_GT(tp->snd_up, tp->snd_una))
483 		goto send;
484 	/*
485 	 * If our state indicates that FIN should be sent
486 	 * and we have not yet done so, or we're retransmitting the FIN,
487 	 * then we need to send.
488 	 */
489 	if (flags & TH_FIN &&
490 	    ((tp->t_flags & TF_SENTFIN) == 0 || tp->snd_nxt == tp->snd_una))
491 		goto send;
492 #ifdef TCP_SACK
493 	/*
494 	 * In SACK, it is possible for tcp_output to fail to send a segment
495 	 * after the retransmission timer has been turned off.  Make sure
496 	 * that the retransmission timer is set.
497 	 */
498 	if (SEQ_GT(tp->snd_max, tp->snd_una) &&
499 	    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
500 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
501 		TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
502 		return (0);
503 	}
504 #endif /* TCP_SACK */
505 
506 	/*
507 	 * TCP window updates are not reliable, rather a polling protocol
508 	 * using ``persist'' packets is used to insure receipt of window
509 	 * updates.  The three ``states'' for the output side are:
510 	 *	idle			not doing retransmits or persists
511 	 *	persisting		to move a small or zero window
512 	 *	(re)transmitting	and thereby not persisting
513 	 *
514 	 * tp->t_timer[TCPT_PERSIST]
515 	 *	is set when we are in persist state.
516 	 * tp->t_force
517 	 *	is set when we are called to send a persist packet.
518 	 * tp->t_timer[TCPT_REXMT]
519 	 *	is set when we are retransmitting
520 	 * The output side is idle when both timers are zero.
521 	 *
522 	 * If send window is too small, there is data to transmit, and no
523 	 * retransmit or persist is pending, then go to persist state.
524 	 * If nothing happens soon, send when timer expires:
525 	 * if window is nonzero, transmit what we can,
526 	 * otherwise force out a byte.
527 	 */
528 	if (so->so_snd.sb_cc && TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
529 	    TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
530 		tp->t_rxtshift = 0;
531 		tcp_setpersist(tp);
532 	}
533 
534 	/*
535 	 * No reason to send a segment, just return.
536 	 */
537 	return (0);
538 
539 send:
540 	/*
541 	 * Before ESTABLISHED, force sending of initial options
542 	 * unless TCP set not to do any options.
543 	 * NOTE: we assume that the IP/TCP header plus TCP options
544 	 * always fit in a single mbuf, leaving room for a maximum
545 	 * link header, i.e.
546 	 *	max_linkhdr + sizeof(network header) + sizeof(struct tcphdr +
547 	 * 		optlen <= MHLEN
548 	 */
549 	optlen = 0;
550 
551 	switch (tp->pf) {
552 	case 0:	/*default to PF_INET*/
553 #ifdef INET
554 	case PF_INET:
555 		hdrlen = sizeof(struct ip) + sizeof(struct tcphdr);
556 		break;
557 #endif /* INET */
558 #ifdef INET6
559 	case PF_INET6:
560 		hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
561 		break;
562 #endif /* INET6 */
563 	default:
564 		return (EPFNOSUPPORT);
565 	}
566 
567 	tstmp_cond = ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP &&
568 		       (flags & TH_RST) == 0 &&
569 		       ((flags & (TH_SYN|TH_ACK)) == TH_SYN ||
570 			(tp->t_flags & TF_RCVD_TSTMP)));
571 
572 	if (flags & TH_SYN) {
573 		tp->snd_nxt = tp->iss;
574 		if ((tp->t_flags & TF_NOOPT) == 0) {
575 			u_int16_t mss;
576 
577 			opt[0] = TCPOPT_MAXSEG;
578 			opt[1] = 4;
579 			mss = htons((u_int16_t) tcp_mss(tp, 0));
580 			bcopy((caddr_t)&mss, (caddr_t)(opt + 2), sizeof(mss));
581 			optlen = 4;
582 
583 			if (flags & TH_ACK)
584 				tcp_mss_update(tp);
585 #ifdef TCP_SACK
586 			/*
587 			 * If this is the first SYN of connection (not a SYN
588 			 * ACK), include SACK_PERMIT_HDR option.  If this is a
589 			 * SYN ACK, include SACK_PERMIT_HDR option if peer has
590 			 * already done so.
591 			 */
592 			if (tp->sack_enable && ((flags & TH_ACK) == 0 ||
593 			    (tp->t_flags & TF_SACK_PERMIT))) {
594 				if (stdbsdtcp || !tstmp_cond) {
595 					*((u_int32_t *) (opt + optlen)) =
596 					    htonl(TCPOPT_SACK_PERMIT_HDR);
597 					optlen += 4;
598 				} else
599 					/* sack will be packed in timestamp */
600 					tsack_cond = 1;
601 			}
602 #endif
603 
604 			if ((tp->t_flags & TF_REQ_SCALE) &&
605 			    ((flags & TH_ACK) == 0 ||
606 			    (tp->t_flags & TF_RCVD_SCALE))) {
607 				*((u_int32_t *) (opt + optlen)) = htonl(
608 					TCPOPT_NOP << 24 |
609 					TCPOPT_WINDOW << 16 |
610 					TCPOLEN_WINDOW << 8 |
611 					tp->request_r_scale);
612 				optlen += 4;
613 			}
614 		}
615 	}
616 
617 	/*
618 	 * Send a timestamp and echo-reply if this is a SYN and our side
619 	 * wants to use timestamps (TF_REQ_TSTMP is set) or both our side
620 	 * and our peer have sent timestamps in our SYN's.
621 	 */
622 	if (tstmp_cond) {
623 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
624 
625 		*lp = htonl(TCPOPT_TSTAMP_HDR);
626 		/* Form timestamp option as shown in appendix A of RFC 1323. */
627 #ifdef TCP_SACK
628 		/* if needed sackOK as before but not just done */
629 		if (tsack_cond) {
630 #if 1
631 			*(u_int16_t*)lp = htons(TCPOPT_SACK_PERMITTED << 8 |
632 			    TCPOLEN_SACK_PERMITTED);
633 #else	/* two similar ways, I prefer the first (above) -- MunARi */
634 			*lp &= htonl(0x0000ffff);
635 			*lp |= htonl(TCPOPT_SACK_PERMITTED << 24 |
636 			    TCPOLEN_SACK_PERMITTED << 16);
637 #endif
638 		}
639 #endif
640 		*++lp = htonl(tcp_now);
641 		*++lp = htonl(tp->ts_recent);
642 		optlen += TCPOLEN_TSTAMP_APPA;
643 	}
644 
645 #ifdef TCP_SIGNATURE
646 	if (tp->t_flags & TF_SIGNATURE) {
647 		u_int8_t *bp = (u_int8_t *)(opt + optlen);
648 
649 		/* Send signature option */
650 		*(bp++) = TCPOPT_SIGNATURE;
651 		*(bp++) = TCPOLEN_SIGNATURE;
652 		sigoff = optlen + 2;
653 
654 		{
655 			unsigned int i;
656 
657 			for (i = 0; i < 16; i++)
658 				*(bp++) = 0;
659 		}
660 
661 
662 		/* Pad options list to the next 32 bit boundary and
663 		 * terminate it.
664 		 */
665 		*bp++ = TCPOPT_NOP;
666 		*bp++ = TCPOPT_EOL;
667 
668 		optlen += TCPOLEN_SIGLEN;
669 	}
670 #endif /* TCP_SIGNATURE */
671 
672 #ifdef TCP_SACK
673 	/*
674 	 * Send SACKs if necessary.  This should be the last option processed.
675 	 * Only as many SACKs are sent as are permitted by the maximum options
676 	 * size.  No more than three SACKs are sent.
677 	 */
678 	if (tp->sack_enable && tp->t_state == TCPS_ESTABLISHED &&
679 	    (tp->t_flags & (TF_SACK_PERMIT|TF_NOOPT)) == TF_SACK_PERMIT &&
680 	    tp->rcv_numsacks) {
681 		u_int32_t *lp = (u_int32_t *)(opt + optlen);
682 		u_int32_t *olp = lp++;
683 		int count = 0;  /* actual number of SACKs inserted */
684 		int maxsack = (MAX_TCPOPTLEN - (optlen + 4))/TCPOLEN_SACK;
685 
686 		maxsack = min(maxsack, TCP_MAX_SACK);
687 		for (i = 0; (i < tp->rcv_numsacks && count < maxsack); i++) {
688 			struct sackblk sack = tp->sackblks[i];
689 			if (sack.start == 0 && sack.end == 0)
690 				continue;
691 			*lp++ = htonl(sack.start);
692 			*lp++ = htonl(sack.end);
693 			count++;
694 		}
695 		*olp = htonl(TCPOPT_SACK_HDR|(TCPOLEN_SACK*count+2));
696 		optlen += TCPOLEN_SACK*count + 4; /* including leading NOPs */
697 	}
698 #endif /* TCP_SACK */
699 
700 #ifdef DIAGNOSTIC
701 	if (optlen > MAX_TCPOPTLEN)
702 		panic("tcp_output: options too long");
703 #endif /* DIAGNOSTIC */
704 
705 	hdrlen += optlen;
706 
707 	/*
708 	 * Adjust data length if insertion of options will
709 	 * bump the packet length beyond the t_maxopd length.
710 	 */
711 	if (len > tp->t_maxopd - optlen) {
712 		len = tp->t_maxopd - optlen;
713 		sendalot = 1;
714 		flags &= ~TH_FIN;
715 	 }
716 
717 #ifdef DIAGNOSTIC
718 	if (max_linkhdr + hdrlen > MCLBYTES)
719 		panic("tcphdr too big");
720 #endif
721 
722 	/*
723 	 * Grab a header mbuf, attaching a copy of data to
724 	 * be transmitted, and initialize the header from
725 	 * the template for sends on this connection.
726 	 */
727 	if (len) {
728 		if (tp->t_force && len == 1)
729 			tcpstat.tcps_sndprobe++;
730 		else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) {
731 			tcpstat.tcps_sndrexmitpack++;
732 			tcpstat.tcps_sndrexmitbyte += len;
733 		} else {
734 			tcpstat.tcps_sndpack++;
735 			tcpstat.tcps_sndbyte += len;
736 		}
737 #ifdef notyet
738 		if ((m = m_copypack(so->so_snd.sb_mb, off,
739 		    (int)len, max_linkhdr + hdrlen)) == 0) {
740 			error = ENOBUFS;
741 			goto out;
742 		}
743 		/*
744 		 * m_copypack left space for our hdr; use it.
745 		 */
746 		m->m_len += hdrlen;
747 		m->m_data -= hdrlen;
748 #else
749 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
750 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
751 			MCLGET(m, M_DONTWAIT);
752 			if ((m->m_flags & M_EXT) == 0) {
753 				m_freem(m);
754 				m = NULL;
755 			}
756 		}
757 		if (m == NULL) {
758 			error = ENOBUFS;
759 			goto out;
760 		}
761 		m->m_data += max_linkhdr;
762 		m->m_len = hdrlen;
763 		if (len <= M_TRAILINGSPACE(m)) {
764 			m_copydata(so->so_snd.sb_mb, off, (int) len,
765 			    mtod(m, caddr_t) + hdrlen);
766 			m->m_len += len;
767 		} else {
768 			m->m_next = m_copy(so->so_snd.sb_mb, off, (int) len);
769 			if (m->m_next == 0) {
770 				(void) m_free(m);
771 				error = ENOBUFS;
772 				goto out;
773 			}
774 		}
775 #endif
776 		/*
777 		 * If we're sending everything we've got, set PUSH.
778 		 * (This will keep happy those implementations which only
779 		 * give data to the user when a buffer fills or
780 		 * a PUSH comes in.)
781 		 */
782 		if (off + len == so->so_snd.sb_cc)
783 			flags |= TH_PUSH;
784 	} else {
785 		if (tp->t_flags & TF_ACKNOW)
786 			tcpstat.tcps_sndacks++;
787 		else if (flags & (TH_SYN|TH_FIN|TH_RST))
788 			tcpstat.tcps_sndctrl++;
789 		else if (SEQ_GT(tp->snd_up, tp->snd_una))
790 			tcpstat.tcps_sndurg++;
791 		else
792 			tcpstat.tcps_sndwinup++;
793 
794 		MGETHDR(m, M_DONTWAIT, MT_HEADER);
795 		if (m != NULL && max_linkhdr + hdrlen > MHLEN) {
796 			MCLGET(m, M_DONTWAIT);
797 			if ((m->m_flags & M_EXT) == 0) {
798 				m_freem(m);
799 				m = NULL;
800 			}
801 		}
802 		if (m == NULL) {
803 			error = ENOBUFS;
804 			goto out;
805 		}
806 		m->m_data += max_linkhdr;
807 		m->m_len = hdrlen;
808 	}
809 	m->m_pkthdr.rcvif = (struct ifnet *)0;
810 
811 	if (!tp->t_template)
812 		panic("tcp_output");
813 #ifdef DIAGNOSTIC
814 	if (tp->t_template->m_len != hdrlen - optlen)
815 		panic("tcp_output: template len != hdrlen - optlen");
816 #endif /* DIAGNOSTIC */
817 	bcopy(mtod(tp->t_template, caddr_t), mtod(m, caddr_t),
818 		tp->t_template->m_len);
819 	th = (struct tcphdr *)(mtod(m, caddr_t) + tp->t_template->m_len -
820 		sizeof(struct tcphdr));
821 
822 	/*
823 	 * Fill in fields, remembering maximum advertised
824 	 * window for use in delaying messages about window sizes.
825 	 * If resending a FIN, be sure not to use a new sequence number.
826 	 */
827 	if ((flags & TH_FIN) && (tp->t_flags & TF_SENTFIN) &&
828 	    (tp->snd_nxt == tp->snd_max))
829 		tp->snd_nxt--;
830 	/*
831 	 * If we are doing retransmissions, then snd_nxt will
832 	 * not reflect the first unsent octet.  For ACK only
833 	 * packets, we do not want the sequence number of the
834 	 * retransmitted packet, we want the sequence number
835 	 * of the next unsent octet.  So, if there is no data
836 	 * (and no SYN or FIN), use snd_max instead of snd_nxt
837 	 * when filling in ti_seq.  But if we are in persist
838 	 * state, snd_max might reflect one byte beyond the
839 	 * right edge of the window, so use snd_nxt in that
840 	 * case, since we know we aren't doing a retransmission.
841 	 * (retransmit and persist are mutually exclusive...)
842 	 */
843 	if (len || (flags & (TH_SYN|TH_FIN)) || TCP_TIMER_ISARMED(tp, TCPT_PERSIST))
844 		th->th_seq = htonl(tp->snd_nxt);
845 	else
846 		th->th_seq = htonl(tp->snd_max);
847 
848 #ifdef TCP_SACK
849 	if (sack_rxmit) {
850 		/*
851 		 * If sendalot was turned on (due to option stuffing), turn it
852 		 * off. Properly set th_seq field.  Advance the ret'x pointer
853 		 * by len.
854 		 */
855 		if (sendalot)
856 			sendalot = 0;
857 		th->th_seq = htonl(p->rxmit);
858 		p->rxmit += len;
859 #if defined(TCP_SACK) && defined(TCP_FACK)
860 		tp->retran_data += len;
861 #endif /* TCP_FACK */
862 	}
863 #endif /* TCP_SACK */
864 
865 	th->th_ack = htonl(tp->rcv_nxt);
866 	if (optlen) {
867 		bcopy((caddr_t)opt, (caddr_t)(th + 1), optlen);
868 		th->th_off = (sizeof (struct tcphdr) + optlen) >> 2;
869 	}
870 #ifdef TCP_ECN
871 	if (tcp_do_ecn) {
872 		/*
873 		 * if we have received congestion experienced segs,
874 		 * set ECE bit.
875 		 */
876 		if (tp->t_flags & TF_RCVD_CE) {
877 			flags |= TH_ECE;
878 			tcpstat.tcps_ecn_sndece++;
879 		}
880 		if (!(tp->t_flags & TF_DISABLE_ECN)) {
881 			/*
882 			 * if this is a SYN seg, set ECE and CWR.
883 			 * set only ECE for SYN-ACK if peer supports ECN.
884 			 */
885 			if ((flags & (TH_SYN|TH_ACK)) == TH_SYN)
886 				flags |= (TH_ECE|TH_CWR);
887 			else if ((tp->t_flags & TF_ECN_PERMIT) &&
888 				 (flags & (TH_SYN|TH_ACK)) == (TH_SYN|TH_ACK))
889 				flags |= TH_ECE;
890 		}
891 		/*
892 		 * if we have reduced the congestion window, notify
893 		 * the peer by setting CWR bit.
894 		 */
895 		if ((tp->t_flags & TF_ECN_PERMIT) &&
896 		    (tp->t_flags & TF_SEND_CWR)) {
897 			flags |= TH_CWR;
898 			tp->t_flags &= ~TF_SEND_CWR;
899 			tcpstat.tcps_ecn_sndcwr++;
900 		}
901 	}
902 #endif
903 	th->th_flags = flags;
904 
905 	/*
906 	 * Calculate receive window.  Don't shrink window,
907 	 * but avoid silly window syndrome.
908 	 */
909 	if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg)
910 		win = 0;
911 	if (win > (long)TCP_MAXWIN << tp->rcv_scale)
912 		win = (long)TCP_MAXWIN << tp->rcv_scale;
913 	if (win < (long)(tp->rcv_adv - tp->rcv_nxt))
914 		win = (long)(tp->rcv_adv - tp->rcv_nxt);
915 	if (flags & TH_RST)
916 		win = 0;
917 	th->th_win = htons((u_int16_t) (win>>tp->rcv_scale));
918 	if (SEQ_GT(tp->snd_up, tp->snd_nxt)) {
919 		u_int32_t urp = tp->snd_up - tp->snd_nxt;
920 		if (urp > IP_MAXPACKET)
921 			urp = IP_MAXPACKET;
922 		th->th_urp = htons((u_int16_t)urp);
923 		th->th_flags |= TH_URG;
924 	} else
925 		/*
926 		 * If no urgent pointer to send, then we pull
927 		 * the urgent pointer to the left edge of the send window
928 		 * so that it doesn't drift into the send window on sequence
929 		 * number wraparound.
930 		 */
931 		tp->snd_up = tp->snd_una;		/* drag it along */
932 
933 #ifdef TCP_SIGNATURE
934 	if (tp->t_flags & TF_SIGNATURE) {
935 		MD5_CTX ctx;
936 		union sockaddr_union src, dst;
937 		struct tdb *tdb;
938 
939 		bzero(&src, sizeof(union sockaddr_union));
940 		bzero(&dst, sizeof(union sockaddr_union));
941 
942 		switch (tp->pf) {
943 		case 0:	/*default to PF_INET*/
944 #ifdef INET
945 		case AF_INET:
946 			src.sa.sa_len = sizeof(struct sockaddr_in);
947 			src.sa.sa_family = AF_INET;
948 			src.sin.sin_addr = mtod(m, struct ip *)->ip_src;
949 			dst.sa.sa_len = sizeof(struct sockaddr_in);
950 			dst.sa.sa_family = AF_INET;
951 			dst.sin.sin_addr = mtod(m, struct ip *)->ip_dst;
952 			break;
953 #endif /* INET */
954 #ifdef INET6
955 		case AF_INET6:
956 			src.sa.sa_len = sizeof(struct sockaddr_in6);
957 			src.sa.sa_family = AF_INET6;
958 			src.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_src;
959 			dst.sa.sa_len = sizeof(struct sockaddr_in6);
960 			dst.sa.sa_family = AF_INET6;
961 			dst.sin6.sin6_addr = mtod(m, struct ip6_hdr *)->ip6_dst;
962 			break;
963 #endif /* INET6 */
964 		}
965 
966 		/* XXX gettdbbysrcdst() should really be called at spltdb().      */
967 		/* XXX this is splsoftnet(), currently they are the same. */
968 		tdb = gettdbbysrcdst(0, &src, &dst, IPPROTO_TCP);
969 		if (tdb == NULL)
970 			return (EPERM);
971 
972 		MD5Init(&ctx);
973 
974 		switch (tp->pf) {
975 		case 0:	/*default to PF_INET*/
976 #ifdef INET
977 		case AF_INET:
978 			{
979 				struct ippseudo ippseudo;
980 				struct ipovly *ipovly;
981 
982 				ipovly = mtod(m, struct ipovly *);
983 
984 				ippseudo.ippseudo_src = ipovly->ih_src;
985 				ippseudo.ippseudo_dst = ipovly->ih_dst;
986 				ippseudo.ippseudo_pad = 0;
987 				ippseudo.ippseudo_p   = IPPROTO_TCP;
988 				ippseudo.ippseudo_len = ntohs(ipovly->ih_len) + len +
989 				    optlen;
990 				ippseudo.ippseudo_len = htons(ippseudo.ippseudo_len);
991 				MD5Update(&ctx, (char *)&ippseudo,
992 				    sizeof(struct ippseudo));
993 			}
994 			break;
995 #endif /* INET */
996 #ifdef INET6
997 		case AF_INET6:
998 			{
999 				struct ip6_hdr_pseudo ip6pseudo;
1000 				struct ip6_hdr *ip6;
1001 
1002 				ip6 = mtod(m, struct ip6_hdr *);
1003 				bzero(&ip6pseudo, sizeof(ip6pseudo));
1004 				ip6pseudo.ip6ph_src = ip6->ip6_src;
1005 				ip6pseudo.ip6ph_dst = ip6->ip6_dst;
1006 				in6_clearscope(&ip6pseudo.ip6ph_src);
1007 				in6_clearscope(&ip6pseudo.ip6ph_dst);
1008 				ip6pseudo.ip6ph_nxt = IPPROTO_TCP;
1009 				ip6pseudo.ip6ph_len =
1010 				    htonl(sizeof(struct tcphdr) + len + optlen);
1011 
1012 				MD5Update(&ctx, (char *)&ip6pseudo,
1013 				    sizeof(ip6pseudo));
1014 			}
1015 			break;
1016 #endif /* INET6 */
1017 		}
1018 
1019 		{
1020 			u_int16_t thsum = th->th_sum;
1021 
1022 			/* RFC 2385 requires th_sum == 0 */
1023 			th->th_sum = 0;
1024 			MD5Update(&ctx, (char *)th, sizeof(struct tcphdr));
1025 			th->th_sum = thsum;
1026 		}
1027 
1028 		if (len && m_apply(m, hdrlen, len, tcp_signature_apply,
1029 		    (caddr_t)&ctx))
1030 			return (EINVAL);
1031 
1032 		MD5Update(&ctx, tdb->tdb_amxkey, tdb->tdb_amxkeylen);
1033 		MD5Final(mtod(m, caddr_t) + hdrlen - optlen + sigoff, &ctx);
1034 	}
1035 #endif /* TCP_SIGNATURE */
1036 
1037 	/*
1038 	 * Put TCP length in extended header, and then
1039 	 * checksum extended header and data.
1040 	 */
1041 	switch (tp->pf) {
1042 	case 0:	/*default to PF_INET*/
1043 #ifdef INET
1044 	case AF_INET:
1045 		/* Defer checksumming until later (ip_output() or hardware) */
1046 		m->m_pkthdr.csum |= M_TCPV4_CSUM_OUT;
1047 		if (len + optlen)
1048 			th->th_sum = in_cksum_addword(th->th_sum,
1049 			    htons((u_int16_t)(len + optlen)));
1050 		break;
1051 #endif /* INET */
1052 #ifdef INET6
1053 	case AF_INET6:
1054 		m->m_pkthdr.len = hdrlen + len;
1055 		th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
1056 			hdrlen - sizeof(struct ip6_hdr) + len);
1057 		break;
1058 #endif /* INET6 */
1059 	}
1060 
1061 	/*
1062 	 * In transmit state, time the transmission and arrange for
1063 	 * the retransmit.  In persist state, just set snd_max.
1064 	 */
1065 	if (tp->t_force == 0 || TCP_TIMER_ISARMED(tp, TCPT_PERSIST) == 0) {
1066 		tcp_seq startseq = tp->snd_nxt;
1067 
1068 		/*
1069 		 * Advance snd_nxt over sequence space of this segment.
1070 		 */
1071 		if (flags & (TH_SYN|TH_FIN)) {
1072 			if (flags & TH_SYN)
1073 				tp->snd_nxt++;
1074 			if (flags & TH_FIN) {
1075 				tp->snd_nxt++;
1076 				tp->t_flags |= TF_SENTFIN;
1077 			}
1078 		}
1079 #ifdef TCP_SACK
1080 		if (tp->sack_enable) {
1081 			if (sack_rxmit && (p->rxmit != tp->snd_nxt)) {
1082 				goto timer;
1083 			}
1084 		}
1085 #endif
1086 		tp->snd_nxt += len;
1087 		if (SEQ_GT(tp->snd_nxt, tp->snd_max)) {
1088 			tp->snd_max = tp->snd_nxt;
1089 			/*
1090 			 * Time this transmission if not a retransmission and
1091 			 * not currently timing anything.
1092 			 */
1093 			if (tp->t_rtttime == 0) {
1094 				tp->t_rtttime = tcp_now;
1095 				tp->t_rtseq = startseq;
1096 				tcpstat.tcps_segstimed++;
1097 			}
1098 		}
1099 
1100 		/*
1101 		 * Set retransmit timer if not currently set,
1102 		 * and not doing an ack or a keep-alive probe.
1103 		 * Initial value for retransmit timer is smoothed
1104 		 * round-trip time + 2 * round-trip time variance.
1105 		 * Initialize shift counter which is used for backoff
1106 		 * of retransmit time.
1107 		 */
1108 #ifdef TCP_SACK
1109  timer:
1110 		if (tp->sack_enable && sack_rxmit &&
1111 		    TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1112 		    tp->snd_nxt != tp->snd_max) {
1113 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1114 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1115 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1116 				tp->t_rxtshift = 0;
1117 			}
1118 		}
1119 #endif
1120 
1121 		if (TCP_TIMER_ISARMED(tp, TCPT_REXMT) == 0 &&
1122 		    tp->snd_nxt != tp->snd_una) {
1123 			TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur);
1124 			if (TCP_TIMER_ISARMED(tp, TCPT_PERSIST)) {
1125 				TCP_TIMER_DISARM(tp, TCPT_PERSIST);
1126 				tp->t_rxtshift = 0;
1127 			}
1128 		}
1129 	} else
1130 		if (SEQ_GT(tp->snd_nxt + len, tp->snd_max))
1131 			tp->snd_max = tp->snd_nxt + len;
1132 
1133 	/*
1134 	 * Trace.
1135 	 */
1136 	if (so->so_options & SO_DEBUG)
1137 		tcp_trace(TA_OUTPUT, tp->t_state, tp, mtod(m, caddr_t), 0,
1138 			len);
1139 
1140 	/*
1141 	 * Fill in IP length and desired time to live and
1142 	 * send to IP level.  There should be a better way
1143 	 * to handle ttl and tos; we could keep them in
1144 	 * the template, but need a way to checksum without them.
1145 	 */
1146 	m->m_pkthdr.len = hdrlen + len;
1147 
1148 #ifdef TCP_ECN
1149 	/*
1150 	 * if peer is ECN capable, set the ECT bit in the IP header.
1151 	 * but don't set ECT for a pure ack, a retransmit or a window probe.
1152 	 */
1153 	needect = 0;
1154 	if (tcp_do_ecn && (tp->t_flags & TF_ECN_PERMIT)) {
1155 		if (len == 0 || SEQ_LT(tp->snd_nxt, tp->snd_max) ||
1156 		    (tp->t_force && len == 1)) {
1157 			/* don't set ECT */
1158 		} else {
1159 			needect = 1;
1160 			tcpstat.tcps_ecn_sndect++;
1161 		}
1162 	}
1163 #endif
1164 
1165 	switch (tp->pf) {
1166 	case 0:	/*default to PF_INET*/
1167 #ifdef INET
1168 	case AF_INET:
1169 		{
1170 			struct ip *ip;
1171 
1172 			ip = mtod(m, struct ip *);
1173 			ip->ip_len = htons(m->m_pkthdr.len);
1174 			packetlen = m->m_pkthdr.len;
1175 			ip->ip_ttl = tp->t_inpcb->inp_ip.ip_ttl;
1176 			ip->ip_tos = tp->t_inpcb->inp_ip.ip_tos;
1177 #ifdef TCP_ECN
1178 			if (needect)
1179 				ip->ip_tos |= IPTOS_ECN_ECT0;
1180 #endif
1181 		}
1182 		error = ip_output(m, tp->t_inpcb->inp_options,
1183 			&tp->t_inpcb->inp_route,
1184 			(ip_mtudisc ? IP_MTUDISC : 0) |
1185 				  (so->so_options & SO_DONTROUTE),
1186 			(void *)NULL, tp->t_inpcb);
1187 		break;
1188 #endif /* INET */
1189 #ifdef INET6
1190 	case AF_INET6:
1191 		{
1192 			struct ip6_hdr *ip6;
1193 
1194 			ip6 = mtod(m, struct ip6_hdr *);
1195 			ip6->ip6_plen = m->m_pkthdr.len -
1196 				sizeof(struct ip6_hdr);
1197 			packetlen = m->m_pkthdr.len;
1198 			ip6->ip6_nxt = IPPROTO_TCP;
1199 			ip6->ip6_hlim = in6_selecthlim(tp->t_inpcb, NULL);
1200 #ifdef TCP_ECN
1201 			if (needect)
1202 				ip6->ip6_flow |= htonl(IPTOS_ECN_ECT0 << 20);
1203 #endif
1204 		}
1205 		error = ip6_output(m, tp->t_inpcb->inp_outputopts6,
1206 			  &tp->t_inpcb->inp_route6,
1207 			  (so->so_options & SO_DONTROUTE), NULL, NULL);
1208 		break;
1209 #endif /* INET6 */
1210 #ifdef TUBA
1211 	case AF_ISO:
1212 		if (tp->t_tuba_pcb)
1213 			error = tuba_output(m, tp);
1214 		break;
1215 #endif /* TUBA */
1216 	}
1217 
1218 #if defined(TCP_SACK) && defined(TCP_FACK)
1219 	/* Update snd_awnd to reflect the new data that was sent.  */
1220 	tp->snd_awnd = tcp_seq_subtract(tp->snd_max, tp->snd_fack) +
1221 		tp->retran_data;
1222 #endif /* defined(TCP_SACK) && defined(TCP_FACK) */
1223 
1224 	if (error) {
1225 out:
1226 		if (error == ENOBUFS) {
1227 			tcp_quench(tp->t_inpcb, 0);
1228 			return (0);
1229 		}
1230 		if (error == EMSGSIZE) {
1231 			/*
1232 			 * ip_output() will have already fixed the route
1233 			 * for us.  tcp_mtudisc() will, as its last action,
1234 			 * initiate retransmission, so it is important to
1235 			 * not do so here.
1236 			 */
1237 			tcp_mtudisc(tp->t_inpcb, -1);
1238 			return (0);
1239 		}
1240 		if ((error == EHOSTUNREACH || error == ENETDOWN) &&
1241 		    TCPS_HAVERCVDSYN(tp->t_state)) {
1242 			tp->t_softerror = error;
1243 			return (0);
1244 		}
1245 
1246 		/* Restart the delayed ACK timer, if necessary. */
1247 		if (tp->t_flags & TF_DELACK)
1248 			TCP_RESTART_DELACK(tp);
1249 
1250 		return (error);
1251 	}
1252 
1253 	if (packetlen > tp->t_pmtud_mtu_sent)
1254 		tp->t_pmtud_mtu_sent = packetlen;
1255 
1256 	tcpstat.tcps_sndtotal++;
1257 	if (tp->t_flags & TF_DELACK)
1258 		tcpstat.tcps_delack++;
1259 
1260 	/*
1261 	 * Data sent (as far as we can tell).
1262 	 * If this advertises a larger window than any other segment,
1263 	 * then remember the size of the advertised window.
1264 	 * Any pending ACK has now been sent.
1265 	 */
1266 	if (win > 0 && SEQ_GT(tp->rcv_nxt+win, tp->rcv_adv))
1267 		tp->rcv_adv = tp->rcv_nxt + win;
1268 	tp->last_ack_sent = tp->rcv_nxt;
1269 	tp->t_flags &= ~TF_ACKNOW;
1270 	TCP_CLEAR_DELACK(tp);
1271 #if defined(TCP_SACK)
1272 	if (sendalot && --maxburst)
1273 #else
1274 	if (sendalot)
1275 #endif
1276 		goto again;
1277 	return (0);
1278 }
1279 
1280 void
tcp_setpersist(struct tcpcb * tp)1281 tcp_setpersist(struct tcpcb *tp)
1282 {
1283 	int t = ((tp->t_srtt >> 2) + tp->t_rttvar) >> 1;
1284 	int nticks;
1285 
1286 	if (TCP_TIMER_ISARMED(tp, TCPT_REXMT))
1287 		panic("tcp_output REXMT");
1288 	/*
1289 	 * Start/restart persistance timer.
1290 	 */
1291 	if (t < tp->t_rttmin)
1292 		t = tp->t_rttmin;
1293 	TCPT_RANGESET(nticks, t * tcp_backoff[tp->t_rxtshift],
1294 	    TCPTV_PERSMIN, TCPTV_PERSMAX);
1295 	TCP_TIMER_ARM(tp, TCPT_PERSIST, nticks);
1296 	if (tp->t_rxtshift < TCP_MAXRXTSHIFT)
1297 		tp->t_rxtshift++;
1298 }
1299