1 | /* |
2 | * Copyright (c) 2000-2017 Apple Inc. All rights reserved. |
3 | * |
4 | * @APPLE_OSREFERENCE_LICENSE_HEADER_START@ |
5 | * |
6 | * This file contains Original Code and/or Modifications of Original Code |
7 | * as defined in and that are subject to the Apple Public Source License |
8 | * Version 2.0 (the 'License'). You may not use this file except in |
9 | * compliance with the License. The rights granted to you under the License |
10 | * may not be used to create, or enable the creation or redistribution of, |
11 | * unlawful or unlicensed copies of an Apple operating system, or to |
12 | * circumvent, violate, or enable the circumvention or violation of, any |
13 | * terms of an Apple operating system software license agreement. |
14 | * |
15 | * Please obtain a copy of the License at |
16 | * http://www.opensource.apple.com/apsl/ and read it before using this file. |
17 | * |
18 | * The Original Code and all software distributed under the License are |
19 | * distributed on an 'AS IS' basis, WITHOUT WARRANTY OF ANY KIND, EITHER |
20 | * EXPRESS OR IMPLIED, AND APPLE HEREBY DISCLAIMS ALL SUCH WARRANTIES, |
21 | * INCLUDING WITHOUT LIMITATION, ANY WARRANTIES OF MERCHANTABILITY, |
22 | * FITNESS FOR A PARTICULAR PURPOSE, QUIET ENJOYMENT OR NON-INFRINGEMENT. |
23 | * Please see the License for the specific language governing rights and |
24 | * limitations under the License. |
25 | * |
26 | * @APPLE_OSREFERENCE_LICENSE_HEADER_END@ |
27 | */ |
28 | /* |
29 | * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995 |
30 | * The Regents of the University of California. All rights reserved. |
31 | * |
32 | * Redistribution and use in source and binary forms, with or without |
33 | * modification, are permitted provided that the following conditions |
34 | * are met: |
35 | * 1. Redistributions of source code must retain the above copyright |
36 | * notice, this list of conditions and the following disclaimer. |
37 | * 2. Redistributions in binary form must reproduce the above copyright |
38 | * notice, this list of conditions and the following disclaimer in the |
39 | * documentation and/or other materials provided with the distribution. |
40 | * 3. All advertising materials mentioning features or use of this software |
41 | * must display the following acknowledgement: |
42 | * This product includes software developed by the University of |
43 | * California, Berkeley and its contributors. |
44 | * 4. Neither the name of the University nor the names of its contributors |
45 | * may be used to endorse or promote products derived from this software |
46 | * without specific prior written permission. |
47 | * |
48 | * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND |
49 | * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE |
50 | * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE |
51 | * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE |
52 | * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL |
53 | * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS |
54 | * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) |
55 | * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT |
56 | * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY |
57 | * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF |
58 | * SUCH DAMAGE. |
59 | * |
60 | * @(#)tcp_input.c 8.12 (Berkeley) 5/24/95 |
61 | * $FreeBSD: src/sys/netinet/tcp_input.c,v 1.107.2.16 2001/08/22 00:59:12 silby Exp $ |
62 | */ |
63 | /* |
64 | * NOTICE: This file was modified by SPARTA, Inc. in 2005 to introduce |
65 | * support for mandatory and extensible security protections. This notice |
66 | * is included in support of clause 2.2 (b) of the Apple Public License, |
67 | * Version 2.0. |
68 | */ |
69 | |
70 | #include <sys/param.h> |
71 | #include <sys/systm.h> |
72 | #include <sys/kernel.h> |
73 | #include <sys/sysctl.h> |
74 | #include <sys/malloc.h> |
75 | #include <sys/mbuf.h> |
76 | #include <sys/proc.h> /* for proc0 declaration */ |
77 | #include <sys/protosw.h> |
78 | #include <sys/socket.h> |
79 | #include <sys/socketvar.h> |
80 | #include <sys/syslog.h> |
81 | #include <sys/mcache.h> |
82 | #if !CONFIG_EMBEDDED |
83 | #include <sys/kasl.h> |
84 | #endif |
85 | #include <sys/kauth.h> |
86 | #include <kern/cpu_number.h> /* before tcp_seq.h, for tcp_random18() */ |
87 | |
88 | #include <machine/endian.h> |
89 | |
90 | #include <net/if.h> |
91 | #include <net/if_types.h> |
92 | #include <net/route.h> |
93 | #include <net/ntstat.h> |
94 | #include <net/dlil.h> |
95 | |
96 | #include <netinet/in.h> |
97 | #include <netinet/in_systm.h> |
98 | #include <netinet/ip.h> |
99 | #include <netinet/ip_icmp.h> /* for ICMP_BANDLIM */ |
100 | #include <netinet/in_var.h> |
101 | #include <netinet/icmp_var.h> /* for ICMP_BANDLIM */ |
102 | #include <netinet/in_pcb.h> |
103 | #include <netinet/ip_var.h> |
104 | #include <mach/sdt.h> |
105 | #if INET6 |
106 | #include <netinet/ip6.h> |
107 | #include <netinet/icmp6.h> |
108 | #include <netinet6/nd6.h> |
109 | #include <netinet6/ip6_var.h> |
110 | #include <netinet6/in6_pcb.h> |
111 | #endif |
112 | #include <netinet/tcp.h> |
113 | #include <netinet/tcp_cache.h> |
114 | #include <netinet/tcp_fsm.h> |
115 | #include <netinet/tcp_seq.h> |
116 | #include <netinet/tcp_timer.h> |
117 | #include <netinet/tcp_var.h> |
118 | #include <netinet/tcp_cc.h> |
119 | #include <dev/random/randomdev.h> |
120 | #include <kern/zalloc.h> |
121 | #if INET6 |
122 | #include <netinet6/tcp6_var.h> |
123 | #endif |
124 | #include <netinet/tcpip.h> |
125 | #if TCPDEBUG |
126 | #include <netinet/tcp_debug.h> |
127 | u_char tcp_saveipgen[40]; /* the size must be of max ip header, now IPv6 */ |
128 | struct tcphdr tcp_savetcp; |
129 | #endif /* TCPDEBUG */ |
130 | |
131 | #if IPSEC |
132 | #include <netinet6/ipsec.h> |
133 | #if INET6 |
134 | #include <netinet6/ipsec6.h> |
135 | #endif |
136 | #include <netkey/key.h> |
137 | #endif /*IPSEC*/ |
138 | |
139 | #if CONFIG_MACF_NET || CONFIG_MACF_SOCKET |
140 | #include <security/mac_framework.h> |
141 | #endif /* CONFIG_MACF_NET || CONFIG_MACF_SOCKET */ |
142 | |
143 | #include <sys/kdebug.h> |
144 | #include <netinet/lro_ext.h> |
145 | #if MPTCP |
146 | #include <netinet/mptcp_var.h> |
147 | #include <netinet/mptcp.h> |
148 | #include <netinet/mptcp_opt.h> |
149 | #endif /* MPTCP */ |
150 | |
151 | #include <corecrypto/ccaes.h> |
152 | |
153 | #define DBG_LAYER_BEG NETDBG_CODE(DBG_NETTCP, 0) |
154 | #define DBG_LAYER_END NETDBG_CODE(DBG_NETTCP, 2) |
155 | #define DBG_FNC_TCP_INPUT NETDBG_CODE(DBG_NETTCP, (3 << 8)) |
156 | #define DBG_FNC_TCP_NEWCONN NETDBG_CODE(DBG_NETTCP, (7 << 8)) |
157 | |
158 | #define TCP_RTT_HISTORY_EXPIRE_TIME (60 * TCP_RETRANSHZ) |
159 | #define TCP_RECV_THROTTLE_WIN (5 * TCP_RETRANSHZ) |
160 | #define TCP_STRETCHACK_ENABLE_PKTCNT 2000 |
161 | |
162 | struct tcpstat tcpstat; |
163 | |
164 | static int log_in_vain = 0; |
165 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_in_vain, |
166 | CTLFLAG_RW | CTLFLAG_LOCKED, &log_in_vain, 0, |
167 | "Log all incoming TCP connections" ); |
168 | |
169 | static int blackhole = 0; |
170 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, blackhole, |
171 | CTLFLAG_RW | CTLFLAG_LOCKED, &blackhole, 0, |
172 | "Do not send RST when dropping refused connections" ); |
173 | |
174 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, delayed_ack, |
175 | CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_delack_enabled, 3, |
176 | "Delay ACK to try and piggyback it onto a data packet" ); |
177 | |
178 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, tcp_lq_overflow, |
179 | CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_lq_overflow, 1, |
180 | "Listen Queue Overflow" ); |
181 | |
182 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, recvbg, CTLFLAG_RW | CTLFLAG_LOCKED, |
183 | int, tcp_recv_bg, 0, "Receive background" ); |
184 | |
185 | #if TCP_DROP_SYNFIN |
186 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, drop_synfin, |
187 | CTLFLAG_RW | CTLFLAG_LOCKED, static int, drop_synfin, 1, |
188 | "Drop TCP packets with SYN+FIN set" ); |
189 | #endif |
190 | |
191 | SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW|CTLFLAG_LOCKED, 0, |
192 | "TCP Segment Reassembly Queue" ); |
193 | |
194 | static int tcp_reass_overflows = 0; |
195 | SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, overflows, |
196 | CTLFLAG_RD | CTLFLAG_LOCKED, &tcp_reass_overflows, 0, |
197 | "Global number of TCP Segment Reassembly Queue Overflows" ); |
198 | |
199 | |
200 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, slowlink_wsize, CTLFLAG_RW | CTLFLAG_LOCKED, |
201 | __private_extern__ int, slowlink_wsize, 8192, |
202 | "Maximum advertised window size for slowlink" ); |
203 | |
204 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, maxseg_unacked, |
205 | CTLFLAG_RW | CTLFLAG_LOCKED, int, maxseg_unacked, 8, |
206 | "Maximum number of outstanding segments left unacked" ); |
207 | |
208 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, rfc3465, CTLFLAG_RW | CTLFLAG_LOCKED, |
209 | int, tcp_do_rfc3465, 1, "" ); |
210 | |
211 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, rfc3465_lim2, |
212 | CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_do_rfc3465_lim2, 1, |
213 | "Appropriate bytes counting w/ L=2*SMSS" ); |
214 | |
215 | int rtt_samples_per_slot = 20; |
216 | |
217 | int tcp_acc_iaj_high_thresh = ACC_IAJ_HIGH_THRESH; |
218 | u_int32_t tcp_autorcvbuf_inc_shift = 3; |
219 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, recv_allowed_iaj, |
220 | CTLFLAG_RW | CTLFLAG_LOCKED, int, tcp_allowed_iaj, ALLOWED_IAJ, |
221 | "Allowed inter-packet arrival jiter" ); |
222 | #if (DEVELOPMENT || DEBUG) |
223 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, acc_iaj_high_thresh, |
224 | CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_acc_iaj_high_thresh, 0, |
225 | "Used in calculating maximum accumulated IAJ" ); |
226 | |
227 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, autorcvbufincshift, |
228 | CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_autorcvbuf_inc_shift, 0, |
229 | "Shift for increment in receive socket buffer size" ); |
230 | #endif /* (DEVELOPMENT || DEBUG) */ |
231 | |
232 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, doautorcvbuf, |
233 | CTLFLAG_RW | CTLFLAG_LOCKED, u_int32_t, tcp_do_autorcvbuf, 1, |
234 | "Enable automatic socket buffer tuning" ); |
235 | |
236 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, autorcvbufmax, |
237 | CTLFLAG_RW | CTLFLAG_LOCKED, u_int32_t, tcp_autorcvbuf_max, 512 * 1024, |
238 | "Maximum receive socket buffer size" ); |
239 | |
240 | #if CONFIG_EMBEDDED |
241 | int sw_lro = 1; |
242 | #else |
243 | int sw_lro = 0; |
244 | #endif /* !CONFIG_EMBEDDED */ |
245 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, lro, CTLFLAG_RW | CTLFLAG_LOCKED, |
246 | &sw_lro, 0, "Used to coalesce TCP packets" ); |
247 | |
248 | int lrodebug = 0; |
249 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, lrodbg, |
250 | CTLFLAG_RW | CTLFLAG_LOCKED, &lrodebug, 0, |
251 | "Used to debug SW LRO" ); |
252 | |
253 | int lro_start = 4; |
254 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, lro_startcnt, |
255 | CTLFLAG_RW | CTLFLAG_LOCKED, &lro_start, 0, |
256 | "Segments for starting LRO computed as power of 2" ); |
257 | |
258 | int limited_txmt = 1; |
259 | int early_rexmt = 1; |
260 | int sack_ackadv = 1; |
261 | int tcp_dsack_enable = 1; |
262 | |
263 | #if (DEVELOPMENT || DEBUG) |
264 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, limited_transmit, |
265 | CTLFLAG_RW | CTLFLAG_LOCKED, &limited_txmt, 0, |
266 | "Enable limited transmit" ); |
267 | |
268 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, early_rexmt, |
269 | CTLFLAG_RW | CTLFLAG_LOCKED, &early_rexmt, 0, |
270 | "Enable Early Retransmit" ); |
271 | |
272 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, sack_ackadv, |
273 | CTLFLAG_RW | CTLFLAG_LOCKED, &sack_ackadv, 0, |
274 | "Use SACK with cumulative ack advancement as a dupack" ); |
275 | |
276 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, dsack_enable, |
277 | CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_dsack_enable, 0, |
278 | "use DSACK TCP option to report duplicate segments" ); |
279 | |
280 | #endif /* (DEVELOPMENT || DEBUG) */ |
281 | int tcp_disable_access_to_stats = 1; |
282 | SYSCTL_INT(_net_inet_tcp, OID_AUTO, disable_access_to_stats, |
283 | CTLFLAG_RW | CTLFLAG_LOCKED, &tcp_disable_access_to_stats, 0, |
284 | "Disable access to tcpstat" ); |
285 | |
286 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, challengeack_limit, |
287 | CTLFLAG_RW | CTLFLAG_LOCKED, uint32_t, tcp_challengeack_limit, 10, |
288 | "Maximum number of challenge ACKs per connection per second" ); |
289 | |
290 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, do_rfc5961, |
291 | CTLFLAG_RW | CTLFLAG_LOCKED, static int, tcp_do_rfc5961, 1, |
292 | "Enable/Disable full RFC 5961 compliance" ); |
293 | |
294 | extern int tcp_TCPTV_MIN; |
295 | extern int tcp_acc_iaj_high; |
296 | extern int tcp_acc_iaj_react_limit; |
297 | |
298 | int tcprexmtthresh = 3; |
299 | |
300 | u_int32_t tcp_now; |
301 | struct timeval tcp_uptime; /* uptime when tcp_now was last updated */ |
302 | lck_spin_t *tcp_uptime_lock; /* Used to sychronize updates to tcp_now */ |
303 | |
304 | struct inpcbhead tcb; |
305 | #define tcb6 tcb /* for KAME src sync over BSD*'s */ |
306 | struct inpcbinfo tcbinfo; |
307 | |
308 | static void tcp_dooptions(struct tcpcb *, u_char *, int, struct tcphdr *, |
309 | struct tcpopt *); |
310 | static void tcp_finalize_options(struct tcpcb *, struct tcpopt *, unsigned int); |
311 | static void tcp_pulloutofband(struct socket *, |
312 | struct tcphdr *, struct mbuf *, int); |
313 | static int tcp_reass(struct tcpcb *, struct tcphdr *, int *, struct mbuf *, |
314 | struct ifnet *); |
315 | static void tcp_xmit_timer(struct tcpcb *, int, u_int32_t, tcp_seq); |
316 | static inline unsigned int tcp_maxmtu(struct rtentry *); |
317 | static inline int tcp_stretch_ack_enable(struct tcpcb *tp, int thflags); |
318 | static inline void tcp_adaptive_rwtimo_check(struct tcpcb *, int); |
319 | |
320 | #if TRAFFIC_MGT |
321 | static inline void update_iaj_state(struct tcpcb *tp, uint32_t tlen, |
322 | int reset_size); |
323 | void compute_iaj(struct tcpcb *tp, int nlropkts, int lro_delay_factor); |
324 | static void compute_iaj_meat(struct tcpcb *tp, uint32_t cur_iaj); |
325 | #endif /* TRAFFIC_MGT */ |
326 | |
327 | #if INET6 |
328 | static inline unsigned int tcp_maxmtu6(struct rtentry *); |
329 | #endif |
330 | |
331 | unsigned int get_maxmtu(struct rtentry *); |
332 | |
333 | static void tcp_sbrcv_grow(struct tcpcb *tp, struct sockbuf *sb, |
334 | struct tcpopt *to, u_int32_t tlen, u_int32_t rcvbuf_max); |
335 | void tcp_sbrcv_trim(struct tcpcb *tp, struct sockbuf *sb); |
336 | static void tcp_sbsnd_trim(struct sockbuf *sbsnd); |
337 | static inline void tcp_sbrcv_tstmp_check(struct tcpcb *tp); |
338 | static inline void tcp_sbrcv_reserve(struct tcpcb *tp, struct sockbuf *sb, |
339 | u_int32_t newsize, u_int32_t idealsize, u_int32_t rcvbuf_max); |
340 | static void tcp_bad_rexmt_restore_state(struct tcpcb *tp, struct tcphdr *th); |
341 | static void tcp_compute_rtt(struct tcpcb *tp, struct tcpopt *to, |
342 | struct tcphdr *th); |
343 | static void tcp_early_rexmt_check(struct tcpcb *tp, struct tcphdr *th); |
344 | static void tcp_bad_rexmt_check(struct tcpcb *tp, struct tcphdr *th, |
345 | struct tcpopt *to); |
346 | /* |
347 | * Constants used for resizing receive socket buffer |
348 | * when timestamps are not supported |
349 | */ |
350 | #define TCPTV_RCVNOTS_QUANTUM 100 |
351 | #define TCP_RCVNOTS_BYTELEVEL 204800 |
352 | |
353 | /* |
354 | * Constants used for limiting early retransmits |
355 | * to 10 per minute. |
356 | */ |
357 | #define TCP_EARLY_REXMT_WIN (60 * TCP_RETRANSHZ) /* 60 seconds */ |
358 | #define TCP_EARLY_REXMT_LIMIT 10 |
359 | |
360 | extern void ipfwsyslog( int level, const char *format,...); |
361 | extern int fw_verbose; |
362 | |
363 | #if IPFIREWALL |
364 | extern void ipfw_stealth_stats_incr_tcp(void); |
365 | |
366 | #define log_in_vain_log( a ) { \ |
367 | if ( (log_in_vain == 3 ) && (fw_verbose == 2)) { /* Apple logging, log to ipfw.log */ \ |
368 | ipfwsyslog a ; \ |
369 | } else if ( (log_in_vain == 4 ) && (fw_verbose == 2)) { \ |
370 | ipfw_stealth_stats_incr_tcp(); \ |
371 | } \ |
372 | else log a ; \ |
373 | } |
374 | #else |
375 | #define log_in_vain_log( a ) { log a; } |
376 | #endif |
377 | |
378 | int tcp_rcvunackwin = TCPTV_UNACKWIN; |
379 | int tcp_maxrcvidle = TCPTV_MAXRCVIDLE; |
380 | SYSCTL_SKMEM_TCP_INT(OID_AUTO, rcvsspktcnt, CTLFLAG_RW | CTLFLAG_LOCKED, |
381 | int, tcp_rcvsspktcnt, TCP_RCV_SS_PKTCOUNT, "packets to be seen before receiver stretches acks" ); |
382 | |
383 | #define DELAY_ACK(tp, th) \ |
384 | (CC_ALGO(tp)->delay_ack != NULL && CC_ALGO(tp)->delay_ack(tp, th)) |
385 | |
386 | static int tcp_dropdropablreq(struct socket *head); |
387 | static void tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th); |
388 | static void update_base_rtt(struct tcpcb *tp, uint32_t rtt); |
389 | void tcp_set_background_cc(struct socket *so); |
390 | void tcp_set_foreground_cc(struct socket *so); |
391 | static void tcp_set_new_cc(struct socket *so, uint16_t cc_index); |
392 | static void tcp_bwmeas_check(struct tcpcb *tp); |
393 | |
394 | #if TRAFFIC_MGT |
395 | void |
396 | reset_acc_iaj(struct tcpcb *tp) |
397 | { |
398 | tp->acc_iaj = 0; |
399 | CLEAR_IAJ_STATE(tp); |
400 | } |
401 | |
402 | static inline void |
403 | update_iaj_state(struct tcpcb *tp, uint32_t size, int rst_size) |
404 | { |
405 | if (rst_size > 0) |
406 | tp->iaj_size = 0; |
407 | if (tp->iaj_size == 0 || size >= tp->iaj_size) { |
408 | tp->iaj_size = size; |
409 | tp->iaj_rcv_ts = tcp_now; |
410 | tp->iaj_small_pkt = 0; |
411 | } |
412 | } |
413 | |
414 | /* For every 32 bit unsigned integer(v), this function will find the |
415 | * largest integer n such that (n*n <= v). This takes at most 16 iterations |
416 | * irrespective of the value of v and does not involve multiplications. |
417 | */ |
418 | static inline int |
419 | isqrt(unsigned int val) |
420 | { |
421 | unsigned int sqrt_cache[11] = {0, 1, 4, 9, 16, 25, 36, 49, 64, 81, 100}; |
422 | unsigned int temp, g=0, b=0x8000, bshft=15; |
423 | if ( val <= 100) { |
424 | for (g = 0; g <= 10; ++g) { |
425 | if (sqrt_cache[g] > val) { |
426 | g--; |
427 | break; |
428 | } else if (sqrt_cache[g] == val) { |
429 | break; |
430 | } |
431 | } |
432 | } else { |
433 | do { |
434 | temp = (((g << 1) + b) << (bshft--)); |
435 | if (val >= temp) { |
436 | g += b; |
437 | val -= temp; |
438 | } |
439 | b >>= 1; |
440 | } while ( b > 0 && val > 0); |
441 | } |
442 | return(g); |
443 | } |
444 | |
445 | /* |
446 | * With LRO, roughly estimate the inter arrival time between |
447 | * each sub coalesced packet as an average. Count the delay |
448 | * cur_iaj to be the delay between the last packet received |
449 | * and the first packet of the LRO stream. Due to round off errors |
450 | * cur_iaj may be the same as lro_delay_factor. Averaging has |
451 | * round off errors too. lro_delay_factor may be close to 0 |
452 | * in steady state leading to lower values fed to compute_iaj_meat. |
453 | */ |
454 | void |
455 | compute_iaj(struct tcpcb *tp, int nlropkts, int lro_delay_factor) |
456 | { |
457 | uint32_t cur_iaj = tcp_now - tp->iaj_rcv_ts; |
458 | uint32_t timediff = 0; |
459 | |
460 | if (cur_iaj >= lro_delay_factor) { |
461 | cur_iaj = cur_iaj - lro_delay_factor; |
462 | } |
463 | |
464 | compute_iaj_meat(tp, cur_iaj); |
465 | |
466 | if (nlropkts <= 1) |
467 | return; |
468 | |
469 | nlropkts--; |
470 | |
471 | timediff = lro_delay_factor/nlropkts; |
472 | |
473 | while (nlropkts > 0) |
474 | { |
475 | compute_iaj_meat(tp, timediff); |
476 | nlropkts--; |
477 | } |
478 | } |
479 | |
480 | static |
481 | void compute_iaj_meat(struct tcpcb *tp, uint32_t cur_iaj) |
482 | { |
483 | /* When accumulated IAJ reaches MAX_ACC_IAJ in milliseconds, |
484 | * throttle the receive window to a minimum of MIN_IAJ_WIN packets |
485 | */ |
486 | #define MAX_ACC_IAJ (tcp_acc_iaj_high_thresh + tcp_acc_iaj_react_limit) |
487 | #define IAJ_DIV_SHIFT 4 |
488 | #define IAJ_ROUNDUP_CONST (1 << (IAJ_DIV_SHIFT - 1)) |
489 | |
490 | uint32_t allowed_iaj, acc_iaj = 0; |
491 | |
492 | uint32_t mean, temp; |
493 | int32_t cur_iaj_dev; |
494 | |
495 | cur_iaj_dev = (cur_iaj - tp->avg_iaj); |
496 | |
497 | /* Allow a jitter of "allowed_iaj" milliseconds. Some connections |
498 | * may have a constant jitter more than that. We detect this by |
499 | * using standard deviation. |
500 | */ |
501 | allowed_iaj = tp->avg_iaj + tp->std_dev_iaj; |
502 | if (allowed_iaj < tcp_allowed_iaj) |
503 | allowed_iaj = tcp_allowed_iaj; |
504 | |
505 | /* Initially when the connection starts, the senders congestion |
506 | * window is small. During this period we avoid throttling a |
507 | * connection because we do not have a good starting point for |
508 | * allowed_iaj. IAJ_IGNORE_PKTCNT is used to quietly gloss over |
509 | * the first few packets. |
510 | */ |
511 | if (tp->iaj_pktcnt > IAJ_IGNORE_PKTCNT) { |
512 | if ( cur_iaj <= allowed_iaj ) { |
513 | if (tp->acc_iaj >= 2) |
514 | acc_iaj = tp->acc_iaj - 2; |
515 | else |
516 | acc_iaj = 0; |
517 | |
518 | } else { |
519 | acc_iaj = tp->acc_iaj + (cur_iaj - allowed_iaj); |
520 | } |
521 | |
522 | if (acc_iaj > MAX_ACC_IAJ) |
523 | acc_iaj = MAX_ACC_IAJ; |
524 | tp->acc_iaj = acc_iaj; |
525 | } |
526 | |
527 | /* Compute weighted average where the history has a weight of |
528 | * 15 out of 16 and the current value has a weight of 1 out of 16. |
529 | * This will make the short-term measurements have more weight. |
530 | * |
531 | * The addition of 8 will help to round-up the value |
532 | * instead of round-down |
533 | */ |
534 | tp->avg_iaj = (((tp->avg_iaj << IAJ_DIV_SHIFT) - tp->avg_iaj) |
535 | + cur_iaj + IAJ_ROUNDUP_CONST) >> IAJ_DIV_SHIFT; |
536 | |
537 | /* Compute Root-mean-square of deviation where mean is a weighted |
538 | * average as described above. |
539 | */ |
540 | temp = tp->std_dev_iaj * tp->std_dev_iaj; |
541 | mean = (((temp << IAJ_DIV_SHIFT) - temp) |
542 | + (cur_iaj_dev * cur_iaj_dev) |
543 | + IAJ_ROUNDUP_CONST) >> IAJ_DIV_SHIFT; |
544 | |
545 | tp->std_dev_iaj = isqrt(mean); |
546 | |
547 | DTRACE_TCP3(iaj, struct tcpcb *, tp, uint32_t, cur_iaj, |
548 | uint32_t, allowed_iaj); |
549 | |
550 | return; |
551 | } |
552 | #endif /* TRAFFIC_MGT */ |
553 | |
554 | /* |
555 | * Perform rate limit check per connection per second |
556 | * tp->t_challengeack_last is the last_time diff was greater than 1sec |
557 | * tp->t_challengeack_count is the number of ACKs sent (within 1sec) |
558 | * Return TRUE if we shouldn't send the ACK due to rate limitation |
559 | * Return FALSE if it is still ok to send challenge ACK |
560 | */ |
561 | static boolean_t |
562 | tcp_is_ack_ratelimited(struct tcpcb *tp) |
563 | { |
564 | boolean_t ret = TRUE; |
565 | uint32_t now = tcp_now; |
566 | int32_t diff = 0; |
567 | |
568 | diff = timer_diff(now, 0, tp->t_challengeack_last, 0); |
569 | /* If it is first time or diff > 1000ms, |
570 | * update the challengeack_last and reset the |
571 | * current count of ACKs |
572 | */ |
573 | if (tp->t_challengeack_last == 0 || diff >= 1000) { |
574 | tp->t_challengeack_last = now; |
575 | tp->t_challengeack_count = 0; |
576 | ret = FALSE; |
577 | } else if (tp->t_challengeack_count < tcp_challengeack_limit) { |
578 | ret = FALSE; |
579 | } |
580 | |
581 | /* Careful about wrap-around */ |
582 | if (ret == FALSE && (tp->t_challengeack_count + 1 > 0)) |
583 | tp->t_challengeack_count++; |
584 | |
585 | return (ret); |
586 | } |
587 | |
588 | /* Check if enough amount of data has been acknowledged since |
589 | * bw measurement was started |
590 | */ |
591 | static void |
592 | tcp_bwmeas_check(struct tcpcb *tp) |
593 | { |
594 | int32_t bw_meas_bytes; |
595 | uint32_t bw, bytes, elapsed_time; |
596 | |
597 | if (SEQ_LEQ(tp->snd_una, tp->t_bwmeas->bw_start)) |
598 | return; |
599 | |
600 | bw_meas_bytes = tp->snd_una - tp->t_bwmeas->bw_start; |
601 | if ((tp->t_flagsext & TF_BWMEAS_INPROGRESS) && |
602 | bw_meas_bytes >= (int32_t)(tp->t_bwmeas->bw_size)) { |
603 | bytes = bw_meas_bytes; |
604 | elapsed_time = tcp_now - tp->t_bwmeas->bw_ts; |
605 | if (elapsed_time > 0) { |
606 | bw = bytes / elapsed_time; |
607 | if ( bw > 0) { |
608 | if (tp->t_bwmeas->bw_sndbw > 0) { |
609 | tp->t_bwmeas->bw_sndbw = |
610 | (((tp->t_bwmeas->bw_sndbw << 3) |
611 | - tp->t_bwmeas->bw_sndbw) |
612 | + bw) >> 3; |
613 | } else { |
614 | tp->t_bwmeas->bw_sndbw = bw; |
615 | } |
616 | |
617 | /* Store the maximum value */ |
618 | if (tp->t_bwmeas->bw_sndbw_max == 0) { |
619 | tp->t_bwmeas->bw_sndbw_max = |
620 | tp->t_bwmeas->bw_sndbw; |
621 | } else { |
622 | tp->t_bwmeas->bw_sndbw_max = |
623 | max(tp->t_bwmeas->bw_sndbw, |
624 | tp->t_bwmeas->bw_sndbw_max); |
625 | } |
626 | } |
627 | } |
628 | tp->t_flagsext &= ~(TF_BWMEAS_INPROGRESS); |
629 | } |
630 | } |
631 | |
632 | static int |
633 | tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m, |
634 | struct ifnet *ifp) |
635 | { |
636 | struct tseg_qent *q; |
637 | struct tseg_qent *p = NULL; |
638 | struct tseg_qent *nq; |
639 | struct tseg_qent *te = NULL; |
640 | struct inpcb *inp = tp->t_inpcb; |
641 | struct socket *so = inp->inp_socket; |
642 | int flags = 0; |
643 | int dowakeup = 0; |
644 | struct mbuf *oodata = NULL; |
645 | int copy_oodata = 0; |
646 | u_int16_t qlimit; |
647 | boolean_t cell = IFNET_IS_CELLULAR(ifp); |
648 | boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp)); |
649 | boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp)); |
650 | boolean_t dsack_set = FALSE; |
651 | |
652 | /* |
653 | * Call with th==0 after become established to |
654 | * force pre-ESTABLISHED data up to user socket. |
655 | */ |
656 | if (th == NULL) |
657 | goto present; |
658 | |
659 | /* |
660 | * If the reassembly queue already has entries or if we are going |
661 | * to add a new one, then the connection has reached a loss state. |
662 | * Reset the stretch-ack algorithm at this point. |
663 | */ |
664 | tcp_reset_stretch_ack(tp); |
665 | |
666 | #if TRAFFIC_MGT |
667 | if (tp->acc_iaj > 0) |
668 | reset_acc_iaj(tp); |
669 | #endif /* TRAFFIC_MGT */ |
670 | |
671 | /* |
672 | * Limit the number of segments in the reassembly queue to prevent |
673 | * holding on to too many segments (and thus running out of mbufs). |
674 | * Make sure to let the missing segment through which caused this |
675 | * queue. Always keep one global queue entry spare to be able to |
676 | * process the missing segment. |
677 | */ |
678 | qlimit = min(max(100, so->so_rcv.sb_hiwat >> 10), |
679 | (TCP_AUTORCVBUF_MAX(ifp) >> 10)); |
680 | if (th->th_seq != tp->rcv_nxt && |
681 | (tp->t_reassqlen + 1) >= qlimit) { |
682 | tcp_reass_overflows++; |
683 | tcpstat.tcps_rcvmemdrop++; |
684 | m_freem(m); |
685 | *tlenp = 0; |
686 | return (0); |
687 | } |
688 | |
689 | /* Allocate a new queue entry. If we can't, just drop the pkt. XXX */ |
690 | te = (struct tseg_qent *) zalloc(tcp_reass_zone); |
691 | if (te == NULL) { |
692 | tcpstat.tcps_rcvmemdrop++; |
693 | m_freem(m); |
694 | return (0); |
695 | } |
696 | tp->t_reassqlen++; |
697 | |
698 | /* |
699 | * Find a segment which begins after this one does. |
700 | */ |
701 | LIST_FOREACH(q, &tp->t_segq, tqe_q) { |
702 | if (SEQ_GT(q->tqe_th->th_seq, th->th_seq)) |
703 | break; |
704 | p = q; |
705 | } |
706 | |
707 | /* |
708 | * If there is a preceding segment, it may provide some of |
709 | * our data already. If so, drop the data from the incoming |
710 | * segment. If it provides all of our data, drop us. |
711 | */ |
712 | if (p != NULL) { |
713 | int i; |
714 | /* conversion to int (in i) handles seq wraparound */ |
715 | i = p->tqe_th->th_seq + p->tqe_len - th->th_seq; |
716 | if (i > 0) { |
717 | if (TCP_DSACK_ENABLED(tp) && i > 1) { |
718 | /* |
719 | * Note duplicate data sequnce numbers |
720 | * to report in DSACK option |
721 | */ |
722 | tp->t_dsack_lseq = th->th_seq; |
723 | tp->t_dsack_rseq = th->th_seq + |
724 | min(i, *tlenp); |
725 | |
726 | /* |
727 | * Report only the first part of partial/ |
728 | * non-contiguous duplicate sequence space |
729 | */ |
730 | dsack_set = TRUE; |
731 | } |
732 | if (i >= *tlenp) { |
733 | tcpstat.tcps_rcvduppack++; |
734 | tcpstat.tcps_rcvdupbyte += *tlenp; |
735 | if (nstat_collect) { |
736 | nstat_route_rx(inp->inp_route.ro_rt, |
737 | 1, *tlenp, |
738 | NSTAT_RX_FLAG_DUPLICATE); |
739 | INP_ADD_STAT(inp, cell, wifi, wired, |
740 | rxpackets, 1); |
741 | INP_ADD_STAT(inp, cell, wifi, wired, |
742 | rxbytes, *tlenp); |
743 | tp->t_stat.rxduplicatebytes += *tlenp; |
744 | inp_set_activity_bitmap(inp); |
745 | } |
746 | m_freem(m); |
747 | zfree(tcp_reass_zone, te); |
748 | te = NULL; |
749 | tp->t_reassqlen--; |
750 | /* |
751 | * Try to present any queued data |
752 | * at the left window edge to the user. |
753 | * This is needed after the 3-WHS |
754 | * completes. |
755 | */ |
756 | goto present; |
757 | } |
758 | m_adj(m, i); |
759 | *tlenp -= i; |
760 | th->th_seq += i; |
761 | } |
762 | } |
763 | tp->t_rcvoopack++; |
764 | tcpstat.tcps_rcvoopack++; |
765 | tcpstat.tcps_rcvoobyte += *tlenp; |
766 | if (nstat_collect) { |
767 | nstat_route_rx(inp->inp_route.ro_rt, 1, *tlenp, |
768 | NSTAT_RX_FLAG_OUT_OF_ORDER); |
769 | INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1); |
770 | INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, *tlenp); |
771 | tp->t_stat.rxoutoforderbytes += *tlenp; |
772 | inp_set_activity_bitmap(inp); |
773 | } |
774 | |
775 | /* |
776 | * While we overlap succeeding segments trim them or, |
777 | * if they are completely covered, dequeue them. |
778 | */ |
779 | while (q) { |
780 | int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq; |
781 | if (i <= 0) |
782 | break; |
783 | |
784 | /* |
785 | * Report only the first part of partial/non-contiguous |
786 | * duplicate segment in dsack option. The variable |
787 | * dsack_set will be true if a previous entry has some of |
788 | * the duplicate sequence space. |
789 | */ |
790 | if (TCP_DSACK_ENABLED(tp) && i > 1 && !dsack_set) { |
791 | if (tp->t_dsack_lseq == 0) { |
792 | tp->t_dsack_lseq = q->tqe_th->th_seq; |
793 | tp->t_dsack_rseq = |
794 | tp->t_dsack_lseq + min(i, q->tqe_len); |
795 | } else { |
796 | /* |
797 | * this segment overlaps data in multple |
798 | * entries in the reassembly queue, move |
799 | * the right sequence number further. |
800 | */ |
801 | tp->t_dsack_rseq = |
802 | tp->t_dsack_rseq + min(i, q->tqe_len); |
803 | } |
804 | } |
805 | if (i < q->tqe_len) { |
806 | q->tqe_th->th_seq += i; |
807 | q->tqe_len -= i; |
808 | m_adj(q->tqe_m, i); |
809 | break; |
810 | } |
811 | |
812 | nq = LIST_NEXT(q, tqe_q); |
813 | LIST_REMOVE(q, tqe_q); |
814 | m_freem(q->tqe_m); |
815 | zfree(tcp_reass_zone, q); |
816 | tp->t_reassqlen--; |
817 | q = nq; |
818 | } |
819 | |
820 | /* Insert the new segment queue entry into place. */ |
821 | te->tqe_m = m; |
822 | te->tqe_th = th; |
823 | te->tqe_len = *tlenp; |
824 | |
825 | if (p == NULL) { |
826 | LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q); |
827 | } else { |
828 | LIST_INSERT_AFTER(p, te, tqe_q); |
829 | } |
830 | |
831 | /* |
832 | * New out-of-order data exists, and is pointed to by |
833 | * queue entry te. Set copy_oodata to 1 so out-of-order data |
834 | * can be copied off to sockbuf after in-order data |
835 | * is copied off. |
836 | */ |
837 | if (!(so->so_state & SS_CANTRCVMORE)) |
838 | copy_oodata = 1; |
839 | |
840 | present: |
841 | /* |
842 | * Present data to user, advancing rcv_nxt through |
843 | * completed sequence space. |
844 | */ |
845 | if (!TCPS_HAVEESTABLISHED(tp->t_state)) |
846 | return (0); |
847 | q = LIST_FIRST(&tp->t_segq); |
848 | if (!q || q->tqe_th->th_seq != tp->rcv_nxt) { |
849 | /* Stop using LRO once out of order packets arrive */ |
850 | if (tp->t_flagsext & TF_LRO_OFFLOADED) { |
851 | tcp_lro_remove_state(inp->inp_laddr, inp->inp_faddr, |
852 | th->th_dport, th->th_sport); |
853 | tp->t_flagsext &= ~TF_LRO_OFFLOADED; |
854 | } |
855 | |
856 | /* |
857 | * continue processing if out-of-order data |
858 | * can be delivered |
859 | */ |
860 | if (q && (so->so_flags & SOF_ENABLE_MSGS)) |
861 | goto msg_unordered_delivery; |
862 | |
863 | return (0); |
864 | } |
865 | |
866 | /* |
867 | * If there is already another thread doing reassembly for this |
868 | * connection, it is better to let it finish the job -- |
869 | * (radar 16316196) |
870 | */ |
871 | if (tp->t_flagsext & TF_REASS_INPROG) |
872 | return (0); |
873 | |
874 | tp->t_flagsext |= TF_REASS_INPROG; |
875 | /* lost packet was recovered, so ooo data can be returned */ |
876 | tcpstat.tcps_recovered_pkts++; |
877 | |
878 | do { |
879 | tp->rcv_nxt += q->tqe_len; |
880 | flags = q->tqe_th->th_flags & TH_FIN; |
881 | LIST_REMOVE(q, tqe_q); |
882 | if (so->so_state & SS_CANTRCVMORE) { |
883 | m_freem(q->tqe_m); |
884 | } else { |
885 | so_recv_data_stat(so, q->tqe_m, 0); /* XXXX */ |
886 | if (so->so_flags & SOF_ENABLE_MSGS) { |
887 | /* |
888 | * Append the inorder data as a message to the |
889 | * receive socket buffer. Also check to see if |
890 | * the data we are about to deliver is the same |
891 | * data that we wanted to pass up to the user |
892 | * out of order. If so, reset copy_oodata -- |
893 | * the received data filled a gap, and |
894 | * is now in order! |
895 | */ |
896 | if (q == te) |
897 | copy_oodata = 0; |
898 | } |
899 | if (sbappendstream_rcvdemux(so, q->tqe_m, |
900 | q->tqe_th->th_seq - (tp->irs + 1), 0)) |
901 | dowakeup = 1; |
902 | if (tp->t_flagsext & TF_LRO_OFFLOADED) { |
903 | tcp_update_lro_seq(tp->rcv_nxt, |
904 | inp->inp_laddr, inp->inp_faddr, |
905 | th->th_dport, th->th_sport); |
906 | } |
907 | } |
908 | zfree(tcp_reass_zone, q); |
909 | tp->t_reassqlen--; |
910 | q = LIST_FIRST(&tp->t_segq); |
911 | } while (q && q->tqe_th->th_seq == tp->rcv_nxt); |
912 | tp->t_flagsext &= ~TF_REASS_INPROG; |
913 | |
914 | #if INET6 |
915 | if ((inp->inp_vflag & INP_IPV6) != 0) { |
916 | |
917 | KERNEL_DEBUG(DBG_LAYER_BEG, |
918 | ((inp->inp_fport << 16) | inp->inp_lport), |
919 | (((inp->in6p_laddr.s6_addr16[0] & 0xffff) << 16) | |
920 | (inp->in6p_faddr.s6_addr16[0] & 0xffff)), |
921 | 0,0,0); |
922 | } |
923 | else |
924 | #endif |
925 | { |
926 | KERNEL_DEBUG(DBG_LAYER_BEG, |
927 | ((inp->inp_fport << 16) | inp->inp_lport), |
928 | (((inp->inp_laddr.s_addr & 0xffff) << 16) | |
929 | (inp->inp_faddr.s_addr & 0xffff)), |
930 | 0,0,0); |
931 | } |
932 | |
933 | msg_unordered_delivery: |
934 | /* Deliver out-of-order data as a message */ |
935 | if (te && (so->so_flags & SOF_ENABLE_MSGS) && copy_oodata && te->tqe_len) { |
936 | /* |
937 | * make a copy of the mbuf to be delivered up to |
938 | * the user, and add it to the sockbuf |
939 | */ |
940 | oodata = m_copym(te->tqe_m, 0, M_COPYALL, M_DONTWAIT); |
941 | if (oodata != NULL) { |
942 | if (sbappendmsgstream_rcv(&so->so_rcv, oodata, |
943 | te->tqe_th->th_seq - (tp->irs + 1), 1)) { |
944 | dowakeup = 1; |
945 | tcpstat.tcps_msg_unopkts++; |
946 | } else { |
947 | tcpstat.tcps_msg_unoappendfail++; |
948 | } |
949 | } |
950 | } |
951 | |
952 | if (dowakeup) |
953 | sorwakeup(so); /* done with socket lock held */ |
954 | return (flags); |
955 | } |
956 | |
957 | /* |
958 | * Reduce congestion window -- used when ECN is seen or when a tail loss |
959 | * probe recovers the last packet. |
960 | */ |
961 | static void |
962 | tcp_reduce_congestion_window( |
963 | struct tcpcb *tp) |
964 | { |
965 | /* |
966 | * If the current tcp cc module has |
967 | * defined a hook for tasks to run |
968 | * before entering FR, call it |
969 | */ |
970 | if (CC_ALGO(tp)->pre_fr != NULL) |
971 | CC_ALGO(tp)->pre_fr(tp); |
972 | ENTER_FASTRECOVERY(tp); |
973 | if (tp->t_flags & TF_SENTFIN) |
974 | tp->snd_recover = tp->snd_max - 1; |
975 | else |
976 | tp->snd_recover = tp->snd_max; |
977 | tp->t_timer[TCPT_REXMT] = 0; |
978 | tp->t_timer[TCPT_PTO] = 0; |
979 | tp->t_rtttime = 0; |
980 | if (tp->t_flagsext & TF_CWND_NONVALIDATED) { |
981 | tcp_cc_adjust_nonvalidated_cwnd(tp); |
982 | } else { |
983 | tp->snd_cwnd = tp->snd_ssthresh + |
984 | tp->t_maxseg * tcprexmtthresh; |
985 | } |
986 | } |
987 | |
988 | /* |
989 | * This function is called upon reception of data on a socket. It's purpose is |
990 | * to handle the adaptive keepalive timers that monitor whether the connection |
991 | * is making progress. First the adaptive read-timer, second the TFO probe-timer. |
992 | * |
993 | * The application wants to get an event if there is a stall during read. |
994 | * Set the initial keepalive timeout to be equal to twice RTO. |
995 | * |
996 | * If the outgoing interface is in marginal conditions, we need to |
997 | * enable read probes for that too. |
998 | */ |
999 | static inline void |
1000 | tcp_adaptive_rwtimo_check(struct tcpcb *tp, int tlen) |
1001 | { |
1002 | struct ifnet *outifp = tp->t_inpcb->inp_last_outifp; |
1003 | |
1004 | if ((tp->t_adaptive_rtimo > 0 || |
1005 | (outifp != NULL && |
1006 | (outifp->if_eflags & IFEF_PROBE_CONNECTIVITY))) |
1007 | && tlen > 0 && |
1008 | tp->t_state == TCPS_ESTABLISHED) { |
1009 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, |
1010 | (TCP_REXMTVAL(tp) << 1)); |
1011 | tp->t_flagsext |= TF_DETECT_READSTALL; |
1012 | tp->t_rtimo_probes = 0; |
1013 | } |
1014 | } |
1015 | |
1016 | inline void |
1017 | tcp_keepalive_reset(struct tcpcb *tp) |
1018 | { |
1019 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, |
1020 | TCP_CONN_KEEPIDLE(tp)); |
1021 | tp->t_flagsext &= ~(TF_DETECT_READSTALL); |
1022 | tp->t_rtimo_probes = 0; |
1023 | } |
1024 | |
1025 | /* |
1026 | * TCP input routine, follows pages 65-76 of the |
1027 | * protocol specification dated September, 1981 very closely. |
1028 | */ |
1029 | #if INET6 |
1030 | int |
1031 | tcp6_input(struct mbuf **mp, int *offp, int proto) |
1032 | { |
1033 | #pragma unused(proto) |
1034 | struct mbuf *m = *mp; |
1035 | uint32_t ia6_flags; |
1036 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
1037 | |
1038 | IP6_EXTHDR_CHECK(m, *offp, sizeof(struct tcphdr), return IPPROTO_DONE); |
1039 | |
1040 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
1041 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
1042 | |
1043 | /* |
1044 | * draft-itojun-ipv6-tcp-to-anycast |
1045 | * better place to put this in? |
1046 | */ |
1047 | if (ip6_getdstifaddr_info(m, NULL, &ia6_flags) == 0) { |
1048 | if (ia6_flags & IN6_IFF_ANYCAST) { |
1049 | struct ip6_hdr *ip6; |
1050 | |
1051 | ip6 = mtod(m, struct ip6_hdr *); |
1052 | icmp6_error(m, ICMP6_DST_UNREACH, |
1053 | ICMP6_DST_UNREACH_ADDR, |
1054 | (caddr_t)&ip6->ip6_dst - (caddr_t)ip6); |
1055 | |
1056 | IF_TCP_STATINC(ifp, icmp6unreach); |
1057 | |
1058 | return (IPPROTO_DONE); |
1059 | } |
1060 | } |
1061 | |
1062 | tcp_input(m, *offp); |
1063 | return (IPPROTO_DONE); |
1064 | } |
1065 | #endif |
1066 | |
1067 | /* Depending on the usage of mbuf space in the system, this function |
1068 | * will return true or false. This is used to determine if a socket |
1069 | * buffer can take more memory from the system for auto-tuning or not. |
1070 | */ |
1071 | u_int8_t |
1072 | tcp_cansbgrow(struct sockbuf *sb) |
1073 | { |
1074 | /* Calculate the host level space limit in terms of MSIZE buffers. |
1075 | * We can use a maximum of half of the available mbuf space for |
1076 | * socket buffers. |
1077 | */ |
1078 | u_int32_t mblim = ((nmbclusters >> 1) << (MCLSHIFT - MSIZESHIFT)); |
1079 | |
1080 | /* Calculate per sb limit in terms of bytes. We optimize this limit |
1081 | * for upto 16 socket buffers. |
1082 | */ |
1083 | |
1084 | u_int32_t sbspacelim = ((nmbclusters >> 4) << MCLSHIFT); |
1085 | |
1086 | if ((total_sbmb_cnt < mblim) && |
1087 | (sb->sb_hiwat < sbspacelim)) { |
1088 | return(1); |
1089 | } else { |
1090 | OSIncrementAtomic64(&sbmb_limreached); |
1091 | } |
1092 | return(0); |
1093 | } |
1094 | |
1095 | static void |
1096 | tcp_sbrcv_reserve(struct tcpcb *tp, struct sockbuf *sbrcv, |
1097 | u_int32_t newsize, u_int32_t idealsize, u_int32_t rcvbuf_max) |
1098 | { |
1099 | /* newsize should not exceed max */ |
1100 | newsize = min(newsize, rcvbuf_max); |
1101 | |
1102 | /* The receive window scale negotiated at the |
1103 | * beginning of the connection will also set a |
1104 | * limit on the socket buffer size |
1105 | */ |
1106 | newsize = min(newsize, TCP_MAXWIN << tp->rcv_scale); |
1107 | |
1108 | /* Set new socket buffer size */ |
1109 | if (newsize > sbrcv->sb_hiwat && |
1110 | (sbreserve(sbrcv, newsize) == 1)) { |
1111 | sbrcv->sb_idealsize = min(max(sbrcv->sb_idealsize, |
1112 | (idealsize != 0) ? idealsize : newsize), rcvbuf_max); |
1113 | |
1114 | /* Again check the limit set by the advertised |
1115 | * window scale |
1116 | */ |
1117 | sbrcv->sb_idealsize = min(sbrcv->sb_idealsize, |
1118 | TCP_MAXWIN << tp->rcv_scale); |
1119 | } |
1120 | } |
1121 | |
1122 | /* |
1123 | * This function is used to grow a receive socket buffer. It |
1124 | * will take into account system-level memory usage and the |
1125 | * bandwidth available on the link to make a decision. |
1126 | */ |
1127 | static void |
1128 | tcp_sbrcv_grow(struct tcpcb *tp, struct sockbuf *sbrcv, |
1129 | struct tcpopt *to, u_int32_t pktlen, u_int32_t rcvbuf_max) |
1130 | { |
1131 | struct socket *so = sbrcv->sb_so; |
1132 | |
1133 | /* |
1134 | * Do not grow the receive socket buffer if |
1135 | * - auto resizing is disabled, globally or on this socket |
1136 | * - the high water mark already reached the maximum |
1137 | * - the stream is in background and receive side is being |
1138 | * throttled |
1139 | * - if there are segments in reassembly queue indicating loss, |
1140 | * do not need to increase recv window during recovery as more |
1141 | * data is not going to be sent. A duplicate ack sent during |
1142 | * recovery should not change the receive window |
1143 | */ |
1144 | if (tcp_do_autorcvbuf == 0 || |
1145 | (sbrcv->sb_flags & SB_AUTOSIZE) == 0 || |
1146 | tcp_cansbgrow(sbrcv) == 0 || |
1147 | sbrcv->sb_hiwat >= rcvbuf_max || |
1148 | (tp->t_flagsext & TF_RECV_THROTTLE) || |
1149 | (so->so_flags1 & SOF1_EXTEND_BK_IDLE_WANTED) || |
1150 | !LIST_EMPTY(&tp->t_segq)) { |
1151 | /* Can not resize the socket buffer, just return */ |
1152 | goto out; |
1153 | } |
1154 | |
1155 | if (TSTMP_GT(tcp_now, |
1156 | tp->rfbuf_ts + TCPTV_RCVBUFIDLE)) { |
1157 | /* If there has been an idle period in the |
1158 | * connection, just restart the measurement |
1159 | */ |
1160 | goto out; |
1161 | } |
1162 | |
1163 | if (!TSTMP_SUPPORTED(tp)) { |
1164 | /* |
1165 | * Timestamp option is not supported on this connection. |
1166 | * If the connection reached a state to indicate that |
1167 | * the receive socket buffer needs to grow, increase |
1168 | * the high water mark. |
1169 | */ |
1170 | if (TSTMP_GEQ(tcp_now, |
1171 | tp->rfbuf_ts + TCPTV_RCVNOTS_QUANTUM)) { |
1172 | if (tp->rfbuf_cnt >= TCP_RCVNOTS_BYTELEVEL) { |
1173 | tcp_sbrcv_reserve(tp, sbrcv, |
1174 | tcp_autorcvbuf_max, 0, |
1175 | tcp_autorcvbuf_max); |
1176 | } |
1177 | goto out; |
1178 | } else { |
1179 | tp->rfbuf_cnt += pktlen; |
1180 | return; |
1181 | } |
1182 | } else if (to->to_tsecr != 0) { |
1183 | /* |
1184 | * If the timestamp shows that one RTT has |
1185 | * completed, we can stop counting the |
1186 | * bytes. Here we consider increasing |
1187 | * the socket buffer if the bandwidth measured in |
1188 | * last rtt, is more than half of sb_hiwat, this will |
1189 | * help to scale the buffer according to the bandwidth |
1190 | * on the link. |
1191 | */ |
1192 | if (TSTMP_GEQ(to->to_tsecr, tp->rfbuf_ts)) { |
1193 | if (tp->rfbuf_cnt > (sbrcv->sb_hiwat - |
1194 | (sbrcv->sb_hiwat >> 1))) { |
1195 | int32_t rcvbuf_inc, min_incr; |
1196 | /* |
1197 | * Increment the receive window by a |
1198 | * multiple of maximum sized segments. |
1199 | * This will prevent a connection from |
1200 | * sending smaller segments on wire if it |
1201 | * is limited by the receive window. |
1202 | * |
1203 | * Set the ideal size based on current |
1204 | * bandwidth measurements. We set the |
1205 | * ideal size on receive socket buffer to |
1206 | * be twice the bandwidth delay product. |
1207 | */ |
1208 | rcvbuf_inc = (tp->rfbuf_cnt << 1) |
1209 | - sbrcv->sb_hiwat; |
1210 | |
1211 | /* |
1212 | * Make the increment equal to 8 segments |
1213 | * at least |
1214 | */ |
1215 | min_incr = tp->t_maxseg << tcp_autorcvbuf_inc_shift; |
1216 | if (rcvbuf_inc < min_incr) |
1217 | rcvbuf_inc = min_incr; |
1218 | |
1219 | rcvbuf_inc = |
1220 | (rcvbuf_inc / tp->t_maxseg) * tp->t_maxseg; |
1221 | tcp_sbrcv_reserve(tp, sbrcv, |
1222 | sbrcv->sb_hiwat + rcvbuf_inc, |
1223 | (tp->rfbuf_cnt * 2), rcvbuf_max); |
1224 | } |
1225 | /* Measure instantaneous receive bandwidth */ |
1226 | if (tp->t_bwmeas != NULL && tp->rfbuf_cnt > 0 && |
1227 | TSTMP_GT(tcp_now, tp->rfbuf_ts)) { |
1228 | u_int32_t rcv_bw; |
1229 | rcv_bw = tp->rfbuf_cnt / |
1230 | (int)(tcp_now - tp->rfbuf_ts); |
1231 | if (tp->t_bwmeas->bw_rcvbw_max == 0) { |
1232 | tp->t_bwmeas->bw_rcvbw_max = rcv_bw; |
1233 | } else { |
1234 | tp->t_bwmeas->bw_rcvbw_max = max( |
1235 | tp->t_bwmeas->bw_rcvbw_max, rcv_bw); |
1236 | } |
1237 | } |
1238 | goto out; |
1239 | } else { |
1240 | tp->rfbuf_cnt += pktlen; |
1241 | return; |
1242 | } |
1243 | } |
1244 | out: |
1245 | /* Restart the measurement */ |
1246 | tp->rfbuf_ts = 0; |
1247 | tp->rfbuf_cnt = 0; |
1248 | return; |
1249 | } |
1250 | |
1251 | /* This function will trim the excess space added to the socket buffer |
1252 | * to help a slow-reading app. The ideal-size of a socket buffer depends |
1253 | * on the link bandwidth or it is set by an application and we aim to |
1254 | * reach that size. |
1255 | */ |
1256 | void |
1257 | tcp_sbrcv_trim(struct tcpcb *tp, struct sockbuf *sbrcv) |
1258 | { |
1259 | if (tcp_do_autorcvbuf == 1 && sbrcv->sb_idealsize > 0 && |
1260 | sbrcv->sb_hiwat > sbrcv->sb_idealsize) { |
1261 | int32_t trim; |
1262 | /* compute the difference between ideal and current sizes */ |
1263 | u_int32_t diff = sbrcv->sb_hiwat - sbrcv->sb_idealsize; |
1264 | |
1265 | /* Compute the maximum advertised window for |
1266 | * this connection. |
1267 | */ |
1268 | u_int32_t advwin = tp->rcv_adv - tp->rcv_nxt; |
1269 | |
1270 | /* How much can we trim the receive socket buffer? |
1271 | * 1. it can not be trimmed beyond the max rcv win advertised |
1272 | * 2. if possible, leave 1/16 of bandwidth*delay to |
1273 | * avoid closing the win completely |
1274 | */ |
1275 | u_int32_t leave = max(advwin, (sbrcv->sb_idealsize >> 4)); |
1276 | |
1277 | /* Sometimes leave can be zero, in that case leave at least |
1278 | * a few segments worth of space. |
1279 | */ |
1280 | if (leave == 0) |
1281 | leave = tp->t_maxseg << tcp_autorcvbuf_inc_shift; |
1282 | |
1283 | trim = sbrcv->sb_hiwat - (sbrcv->sb_cc + leave); |
1284 | trim = imin(trim, (int32_t)diff); |
1285 | |
1286 | if (trim > 0) |
1287 | sbreserve(sbrcv, (sbrcv->sb_hiwat - trim)); |
1288 | } |
1289 | } |
1290 | |
1291 | /* We may need to trim the send socket buffer size for two reasons: |
1292 | * 1. if the rtt seen on the connection is climbing up, we do not |
1293 | * want to fill the buffers any more. |
1294 | * 2. if the congestion win on the socket backed off, there is no need |
1295 | * to hold more mbufs for that connection than what the cwnd will allow. |
1296 | */ |
1297 | void |
1298 | tcp_sbsnd_trim(struct sockbuf *sbsnd) |
1299 | { |
1300 | if (tcp_do_autosendbuf == 1 && |
1301 | ((sbsnd->sb_flags & (SB_AUTOSIZE | SB_TRIM)) == |
1302 | (SB_AUTOSIZE | SB_TRIM)) && |
1303 | (sbsnd->sb_idealsize > 0) && |
1304 | (sbsnd->sb_hiwat > sbsnd->sb_idealsize)) { |
1305 | u_int32_t trim = 0; |
1306 | if (sbsnd->sb_cc <= sbsnd->sb_idealsize) { |
1307 | trim = sbsnd->sb_hiwat - sbsnd->sb_idealsize; |
1308 | } else { |
1309 | trim = sbsnd->sb_hiwat - sbsnd->sb_cc; |
1310 | } |
1311 | sbreserve(sbsnd, (sbsnd->sb_hiwat - trim)); |
1312 | } |
1313 | if (sbsnd->sb_hiwat <= sbsnd->sb_idealsize) |
1314 | sbsnd->sb_flags &= ~(SB_TRIM); |
1315 | } |
1316 | |
1317 | /* |
1318 | * If timestamp option was not negotiated on this connection |
1319 | * and this connection is on the receiving side of a stream |
1320 | * then we can not measure the delay on the link accurately. |
1321 | * Instead of enabling automatic receive socket buffer |
1322 | * resizing, just give more space to the receive socket buffer. |
1323 | */ |
1324 | static inline void |
1325 | tcp_sbrcv_tstmp_check(struct tcpcb *tp) |
1326 | { |
1327 | struct socket *so = tp->t_inpcb->inp_socket; |
1328 | u_int32_t newsize = 2 * tcp_recvspace; |
1329 | struct sockbuf *sbrcv = &so->so_rcv; |
1330 | |
1331 | if ((tp->t_flags & (TF_REQ_TSTMP | TF_RCVD_TSTMP)) != |
1332 | (TF_REQ_TSTMP | TF_RCVD_TSTMP) && |
1333 | (sbrcv->sb_flags & SB_AUTOSIZE) != 0) { |
1334 | tcp_sbrcv_reserve(tp, sbrcv, newsize, 0, newsize); |
1335 | } |
1336 | } |
1337 | |
1338 | /* A receiver will evaluate the flow of packets on a connection |
1339 | * to see if it can reduce ack traffic. The receiver will start |
1340 | * stretching acks if all of the following conditions are met: |
1341 | * 1. tcp_delack_enabled is set to 3 |
1342 | * 2. If the bytes received in the last 100ms is greater than a threshold |
1343 | * defined by maxseg_unacked |
1344 | * 3. If the connection has not been idle for tcp_maxrcvidle period. |
1345 | * 4. If the connection has seen enough packets to let the slow-start |
1346 | * finish after connection establishment or after some packet loss. |
1347 | * |
1348 | * The receiver will stop stretching acks if there is congestion/reordering |
1349 | * as indicated by packets on reassembly queue or an ECN. If the delayed-ack |
1350 | * timer fires while stretching acks, it means that the packet flow has gone |
1351 | * below the threshold defined by maxseg_unacked and the receiver will stop |
1352 | * stretching acks. The receiver gets no indication when slow-start is completed |
1353 | * or when the connection reaches an idle state. That is why we use |
1354 | * tcp_rcvsspktcnt to cover slow-start and tcp_maxrcvidle to identify idle |
1355 | * state. |
1356 | */ |
1357 | static inline int |
1358 | tcp_stretch_ack_enable(struct tcpcb *tp, int thflags) |
1359 | { |
1360 | if (tp->rcv_by_unackwin >= (maxseg_unacked * tp->t_maxseg) && |
1361 | TSTMP_GEQ(tp->rcv_unackwin, tcp_now)) |
1362 | tp->t_flags |= TF_STREAMING_ON; |
1363 | else |
1364 | tp->t_flags &= ~TF_STREAMING_ON; |
1365 | |
1366 | /* If there has been an idle time, reset streaming detection */ |
1367 | if (TSTMP_GT(tcp_now, tp->rcv_unackwin + tcp_maxrcvidle)) |
1368 | tp->t_flags &= ~TF_STREAMING_ON; |
1369 | |
1370 | /* |
1371 | * If there are flags other than TH_ACK set, reset streaming |
1372 | * detection |
1373 | */ |
1374 | if (thflags & ~TH_ACK) |
1375 | tp->t_flags &= ~TF_STREAMING_ON; |
1376 | |
1377 | if (tp->t_flagsext & TF_DISABLE_STRETCHACK) { |
1378 | if (tp->rcv_nostrack_pkts >= TCP_STRETCHACK_ENABLE_PKTCNT) { |
1379 | tp->t_flagsext &= ~TF_DISABLE_STRETCHACK; |
1380 | tp->rcv_nostrack_pkts = 0; |
1381 | tp->rcv_nostrack_ts = 0; |
1382 | } else { |
1383 | tp->rcv_nostrack_pkts++; |
1384 | } |
1385 | } |
1386 | |
1387 | if (!(tp->t_flagsext & (TF_NOSTRETCHACK|TF_DISABLE_STRETCHACK)) && |
1388 | (tp->t_flags & TF_STREAMING_ON) && |
1389 | (!(tp->t_flagsext & TF_RCVUNACK_WAITSS) || |
1390 | (tp->rcv_waitforss >= tcp_rcvsspktcnt))) { |
1391 | return(1); |
1392 | } |
1393 | |
1394 | return(0); |
1395 | } |
1396 | |
1397 | /* |
1398 | * Reset the state related to stretch-ack algorithm. This will make |
1399 | * the receiver generate an ack every other packet. The receiver |
1400 | * will start re-evaluating the rate at which packets come to decide |
1401 | * if it can benefit by lowering the ack traffic. |
1402 | */ |
1403 | void |
1404 | tcp_reset_stretch_ack(struct tcpcb *tp) |
1405 | { |
1406 | tp->t_flags &= ~(TF_STRETCHACK|TF_STREAMING_ON); |
1407 | tp->rcv_by_unackwin = 0; |
1408 | tp->rcv_unackwin = tcp_now + tcp_rcvunackwin; |
1409 | |
1410 | /* |
1411 | * When there is packet loss or packet re-ordering or CWR due to |
1412 | * ECN, the sender's congestion window is reduced. In these states, |
1413 | * generate an ack for every other packet for some time to allow |
1414 | * the sender's congestion window to grow. |
1415 | */ |
1416 | tp->t_flagsext |= TF_RCVUNACK_WAITSS; |
1417 | tp->rcv_waitforss = 0; |
1418 | } |
1419 | |
1420 | /* |
1421 | * The last packet was a retransmission, check if this ack |
1422 | * indicates that the retransmission was spurious. |
1423 | * |
1424 | * If the connection supports timestamps, we could use it to |
1425 | * detect if the last retransmit was not needed. Otherwise, |
1426 | * we check if the ACK arrived within RTT/2 window, then it |
1427 | * was a mistake to do the retransmit in the first place. |
1428 | * |
1429 | * This function will return 1 if it is a spurious retransmit, |
1430 | * 0 otherwise. |
1431 | */ |
1432 | int |
1433 | tcp_detect_bad_rexmt(struct tcpcb *tp, struct tcphdr *th, |
1434 | struct tcpopt *to, u_int32_t rxtime) |
1435 | { |
1436 | int32_t tdiff, bad_rexmt_win; |
1437 | bad_rexmt_win = (tp->t_srtt >> (TCP_RTT_SHIFT + 1)); |
1438 | |
1439 | /* If the ack has ECN CE bit, then cwnd has to be adjusted */ |
1440 | if (TCP_ECN_ENABLED(tp) && (th->th_flags & TH_ECE)) |
1441 | return (0); |
1442 | if (TSTMP_SUPPORTED(tp)) { |
1443 | if (rxtime > 0 && (to->to_flags & TOF_TS) |
1444 | && to->to_tsecr != 0 |
1445 | && TSTMP_LT(to->to_tsecr, rxtime)) |
1446 | return (1); |
1447 | } else { |
1448 | if ((tp->t_rxtshift == 1 |
1449 | || (tp->t_flagsext & TF_SENT_TLPROBE)) |
1450 | && rxtime > 0) { |
1451 | tdiff = (int32_t)(tcp_now - rxtime); |
1452 | if (tdiff < bad_rexmt_win) |
1453 | return(1); |
1454 | } |
1455 | } |
1456 | return(0); |
1457 | } |
1458 | |
1459 | |
1460 | /* |
1461 | * Restore congestion window state if a spurious timeout |
1462 | * was detected. |
1463 | */ |
1464 | static void |
1465 | tcp_bad_rexmt_restore_state(struct tcpcb *tp, struct tcphdr *th) |
1466 | { |
1467 | if (TSTMP_SUPPORTED(tp)) { |
1468 | u_int32_t fsize, acked; |
1469 | fsize = tp->snd_max - th->th_ack; |
1470 | acked = BYTES_ACKED(th, tp); |
1471 | |
1472 | /* |
1473 | * Implement bad retransmit recovery as |
1474 | * described in RFC 4015. |
1475 | */ |
1476 | tp->snd_ssthresh = tp->snd_ssthresh_prev; |
1477 | |
1478 | /* Initialize cwnd to the initial window */ |
1479 | if (CC_ALGO(tp)->cwnd_init != NULL) |
1480 | CC_ALGO(tp)->cwnd_init(tp); |
1481 | |
1482 | tp->snd_cwnd = fsize + min(acked, tp->snd_cwnd); |
1483 | |
1484 | } else { |
1485 | tp->snd_cwnd = tp->snd_cwnd_prev; |
1486 | tp->snd_ssthresh = tp->snd_ssthresh_prev; |
1487 | if (tp->t_flags & TF_WASFRECOVERY) |
1488 | ENTER_FASTRECOVERY(tp); |
1489 | |
1490 | /* Do not use the loss flight size in this case */ |
1491 | tp->t_lossflightsize = 0; |
1492 | } |
1493 | tp->snd_cwnd = max(tp->snd_cwnd, TCP_CC_CWND_INIT_BYTES); |
1494 | tp->snd_recover = tp->snd_recover_prev; |
1495 | tp->snd_nxt = tp->snd_max; |
1496 | |
1497 | /* Fix send socket buffer to reflect the change in cwnd */ |
1498 | tcp_bad_rexmt_fix_sndbuf(tp); |
1499 | |
1500 | /* |
1501 | * This RTT might reflect the extra delay induced |
1502 | * by the network. Skip using this sample for RTO |
1503 | * calculation and mark the connection so we can |
1504 | * recompute RTT when the next eligible sample is |
1505 | * found. |
1506 | */ |
1507 | tp->t_flagsext |= TF_RECOMPUTE_RTT; |
1508 | tp->t_badrexmt_time = tcp_now; |
1509 | tp->t_rtttime = 0; |
1510 | } |
1511 | |
1512 | /* |
1513 | * If the previous packet was sent in retransmission timer, and it was |
1514 | * not needed, then restore the congestion window to the state before that |
1515 | * transmission. |
1516 | * |
1517 | * If the last packet was sent in tail loss probe timeout, check if that |
1518 | * recovered the last packet. If so, that will indicate a real loss and |
1519 | * the congestion window needs to be lowered. |
1520 | */ |
1521 | static void |
1522 | tcp_bad_rexmt_check(struct tcpcb *tp, struct tcphdr *th, struct tcpopt *to) |
1523 | { |
1524 | if (tp->t_rxtshift > 0 && |
1525 | tcp_detect_bad_rexmt(tp, th, to, tp->t_rxtstart)) { |
1526 | ++tcpstat.tcps_sndrexmitbad; |
1527 | tcp_bad_rexmt_restore_state(tp, th); |
1528 | tcp_ccdbg_trace(tp, th, TCP_CC_BAD_REXMT_RECOVERY); |
1529 | } else if ((tp->t_flagsext & TF_SENT_TLPROBE) |
1530 | && tp->t_tlphighrxt > 0 |
1531 | && SEQ_GEQ(th->th_ack, tp->t_tlphighrxt) |
1532 | && !tcp_detect_bad_rexmt(tp, th, to, tp->t_tlpstart)) { |
1533 | /* |
1534 | * check DSACK information also to make sure that |
1535 | * the TLP was indeed needed |
1536 | */ |
1537 | if (tcp_rxtseg_dsack_for_tlp(tp)) { |
1538 | /* |
1539 | * received a DSACK to indicate that TLP was |
1540 | * not needed |
1541 | */ |
1542 | tcp_rxtseg_clean(tp); |
1543 | goto out; |
1544 | } |
1545 | |
1546 | /* |
1547 | * The tail loss probe recovered the last packet and |
1548 | * we need to adjust the congestion window to take |
1549 | * this loss into account. |
1550 | */ |
1551 | ++tcpstat.tcps_tlp_recoverlastpkt; |
1552 | if (!IN_FASTRECOVERY(tp)) { |
1553 | tcp_reduce_congestion_window(tp); |
1554 | EXIT_FASTRECOVERY(tp); |
1555 | } |
1556 | tcp_ccdbg_trace(tp, th, TCP_CC_TLP_RECOVER_LASTPACKET); |
1557 | } else if (tcp_rxtseg_detect_bad_rexmt(tp, th->th_ack)) { |
1558 | /* |
1559 | * All of the retransmitted segments were duplicated, this |
1560 | * can be an indication of bad fast retransmit. |
1561 | */ |
1562 | tcpstat.tcps_dsack_badrexmt++; |
1563 | tcp_bad_rexmt_restore_state(tp, th); |
1564 | tcp_ccdbg_trace(tp, th, TCP_CC_DSACK_BAD_REXMT); |
1565 | tcp_rxtseg_clean(tp); |
1566 | } |
1567 | out: |
1568 | tp->t_flagsext &= ~(TF_SENT_TLPROBE); |
1569 | tp->t_tlphighrxt = 0; |
1570 | tp->t_tlpstart = 0; |
1571 | |
1572 | /* |
1573 | * check if the latest ack was for a segment sent during PMTU |
1574 | * blackhole detection. If the timestamp on the ack is before |
1575 | * PMTU blackhole detection, then revert the size of the max |
1576 | * segment to previous size. |
1577 | */ |
1578 | if (tp->t_rxtshift > 0 && (tp->t_flags & TF_BLACKHOLE) && |
1579 | tp->t_pmtud_start_ts > 0 && TSTMP_SUPPORTED(tp)) { |
1580 | if ((to->to_flags & TOF_TS) && to->to_tsecr != 0 |
1581 | && TSTMP_LT(to->to_tsecr, tp->t_pmtud_start_ts)) { |
1582 | tcp_pmtud_revert_segment_size(tp); |
1583 | } |
1584 | } |
1585 | if (tp->t_pmtud_start_ts > 0) |
1586 | tp->t_pmtud_start_ts = 0; |
1587 | } |
1588 | |
1589 | /* |
1590 | * Check if early retransmit can be attempted according to RFC 5827. |
1591 | * |
1592 | * If packet reordering is detected on a connection, fast recovery will |
1593 | * be delayed until it is clear that the packet was lost and not reordered. |
1594 | * But reordering detection is done only when SACK is enabled. |
1595 | * |
1596 | * On connections that do not support SACK, there is a limit on the number |
1597 | * of early retransmits that can be done per minute. This limit is needed |
1598 | * to make sure that too many packets are not retransmitted when there is |
1599 | * packet reordering. |
1600 | */ |
1601 | static void |
1602 | tcp_early_rexmt_check (struct tcpcb *tp, struct tcphdr *th) |
1603 | { |
1604 | u_int32_t obytes, snd_off; |
1605 | int32_t snd_len; |
1606 | struct socket *so = tp->t_inpcb->inp_socket; |
1607 | |
1608 | if (early_rexmt && (SACK_ENABLED(tp) || |
1609 | tp->t_early_rexmt_count < TCP_EARLY_REXMT_LIMIT) && |
1610 | SEQ_GT(tp->snd_max, tp->snd_una) && |
1611 | (tp->t_dupacks == 1 || |
1612 | (SACK_ENABLED(tp) && |
1613 | !TAILQ_EMPTY(&tp->snd_holes)))) { |
1614 | /* |
1615 | * If there are only a few outstanding |
1616 | * segments on the connection, we might need |
1617 | * to lower the retransmit threshold. This |
1618 | * will allow us to do Early Retransmit as |
1619 | * described in RFC 5827. |
1620 | */ |
1621 | if (SACK_ENABLED(tp) && |
1622 | !TAILQ_EMPTY(&tp->snd_holes)) { |
1623 | obytes = (tp->snd_max - tp->snd_fack) + |
1624 | tp->sackhint.sack_bytes_rexmit; |
1625 | } else { |
1626 | obytes = (tp->snd_max - tp->snd_una); |
1627 | } |
1628 | |
1629 | /* |
1630 | * In order to lower retransmit threshold the |
1631 | * following two conditions must be met. |
1632 | * 1. the amount of outstanding data is less |
1633 | * than 4*SMSS bytes |
1634 | * 2. there is no unsent data ready for |
1635 | * transmission or the advertised window |
1636 | * will limit sending new segments. |
1637 | */ |
1638 | snd_off = tp->snd_max - tp->snd_una; |
1639 | snd_len = min(so->so_snd.sb_cc, tp->snd_wnd) - snd_off; |
1640 | if (obytes < (tp->t_maxseg << 2) && |
1641 | snd_len <= 0) { |
1642 | u_int32_t osegs; |
1643 | |
1644 | osegs = obytes / tp->t_maxseg; |
1645 | if ((osegs * tp->t_maxseg) < obytes) |
1646 | osegs++; |
1647 | |
1648 | /* |
1649 | * Since the connection might have already |
1650 | * received some dupacks, we add them to |
1651 | * to the outstanding segments count to get |
1652 | * the correct retransmit threshold. |
1653 | * |
1654 | * By checking for early retransmit after |
1655 | * receiving some duplicate acks when SACK |
1656 | * is supported, the connection will |
1657 | * enter fast recovery even if multiple |
1658 | * segments are lost in the same window. |
1659 | */ |
1660 | osegs += tp->t_dupacks; |
1661 | if (osegs < 4) { |
1662 | tp->t_rexmtthresh = |
1663 | ((osegs - 1) > 1) ? (osegs - 1) : 1; |
1664 | tp->t_rexmtthresh = |
1665 | min(tp->t_rexmtthresh, tcprexmtthresh); |
1666 | tp->t_rexmtthresh = |
1667 | max(tp->t_rexmtthresh, tp->t_dupacks); |
1668 | |
1669 | if (tp->t_early_rexmt_count == 0) |
1670 | tp->t_early_rexmt_win = tcp_now; |
1671 | |
1672 | if (tp->t_flagsext & TF_SENT_TLPROBE) { |
1673 | tcpstat.tcps_tlp_recovery++; |
1674 | tcp_ccdbg_trace(tp, th, |
1675 | TCP_CC_TLP_RECOVERY); |
1676 | } else { |
1677 | tcpstat.tcps_early_rexmt++; |
1678 | tp->t_early_rexmt_count++; |
1679 | tcp_ccdbg_trace(tp, th, |
1680 | TCP_CC_EARLY_RETRANSMIT); |
1681 | } |
1682 | } |
1683 | } |
1684 | } |
1685 | |
1686 | /* |
1687 | * If we ever sent a TLP probe, the acknowledgement will trigger |
1688 | * early retransmit because the value of snd_fack will be close |
1689 | * to snd_max. This will take care of adjustments to the |
1690 | * congestion window. So we can reset TF_SENT_PROBE flag. |
1691 | */ |
1692 | tp->t_flagsext &= ~(TF_SENT_TLPROBE); |
1693 | tp->t_tlphighrxt = 0; |
1694 | tp->t_tlpstart = 0; |
1695 | } |
1696 | |
1697 | static boolean_t |
1698 | tcp_tfo_syn(struct tcpcb *tp, struct tcpopt *to) |
1699 | { |
1700 | u_char out[CCAES_BLOCK_SIZE]; |
1701 | unsigned char len; |
1702 | |
1703 | if (!(to->to_flags & (TOF_TFO | TOF_TFOREQ)) || |
1704 | !(tcp_fastopen & TCP_FASTOPEN_SERVER)) |
1705 | return (FALSE); |
1706 | |
1707 | if ((to->to_flags & TOF_TFOREQ)) { |
1708 | tp->t_tfo_flags |= TFO_F_OFFER_COOKIE; |
1709 | |
1710 | tp->t_tfo_stats |= TFO_S_COOKIEREQ_RECV; |
1711 | tcpstat.tcps_tfo_cookie_req_rcv++; |
1712 | return (FALSE); |
1713 | } |
1714 | |
1715 | /* Ok, then it must be an offered cookie. We need to check that ... */ |
1716 | tcp_tfo_gen_cookie(tp->t_inpcb, out, sizeof(out)); |
1717 | |
1718 | len = *to->to_tfo - TCPOLEN_FASTOPEN_REQ; |
1719 | to->to_tfo++; |
1720 | if (memcmp(out, to->to_tfo, len)) { |
1721 | /* Cookies are different! Let's return and offer a new cookie */ |
1722 | tp->t_tfo_flags |= TFO_F_OFFER_COOKIE; |
1723 | |
1724 | tp->t_tfo_stats |= TFO_S_COOKIE_INVALID; |
1725 | tcpstat.tcps_tfo_cookie_invalid++; |
1726 | return (FALSE); |
1727 | } |
1728 | |
1729 | if (OSIncrementAtomic(&tcp_tfo_halfcnt) >= tcp_tfo_backlog) { |
1730 | /* Need to decrement again as we just increased it... */ |
1731 | OSDecrementAtomic(&tcp_tfo_halfcnt); |
1732 | return (FALSE); |
1733 | } |
1734 | |
1735 | tp->t_tfo_flags |= TFO_F_COOKIE_VALID; |
1736 | |
1737 | tp->t_tfo_stats |= TFO_S_SYNDATA_RCV; |
1738 | tcpstat.tcps_tfo_syn_data_rcv++; |
1739 | |
1740 | return (TRUE); |
1741 | } |
1742 | |
1743 | static void |
1744 | tcp_tfo_synack(struct tcpcb *tp, struct tcpopt *to) |
1745 | { |
1746 | if (to->to_flags & TOF_TFO) { |
1747 | unsigned char len = *to->to_tfo - TCPOLEN_FASTOPEN_REQ; |
1748 | |
1749 | /* |
1750 | * If this happens, things have gone terribly wrong. len should |
1751 | * have been checked in tcp_dooptions. |
1752 | */ |
1753 | VERIFY(len <= TFO_COOKIE_LEN_MAX); |
1754 | |
1755 | to->to_tfo++; |
1756 | |
1757 | tcp_cache_set_cookie(tp, to->to_tfo, len); |
1758 | tcp_heuristic_tfo_success(tp); |
1759 | |
1760 | tp->t_tfo_stats |= TFO_S_COOKIE_RCV; |
1761 | tcpstat.tcps_tfo_cookie_rcv++; |
1762 | if (tp->t_tfo_flags & TFO_F_COOKIE_SENT) { |
1763 | tcpstat.tcps_tfo_cookie_wrong++; |
1764 | tp->t_tfo_stats |= TFO_S_COOKIE_WRONG; |
1765 | } |
1766 | } else { |
1767 | /* |
1768 | * Thus, no cookie in the response, but we either asked for one |
1769 | * or sent SYN+DATA. Now, we need to check whether we had to |
1770 | * rexmit the SYN. If that's the case, it's better to start |
1771 | * backing of TFO-cookie requests. |
1772 | */ |
1773 | if (tp->t_tfo_flags & TFO_F_SYN_LOSS) { |
1774 | tp->t_tfo_stats |= TFO_S_SYN_LOSS; |
1775 | tcpstat.tcps_tfo_syn_loss++; |
1776 | |
1777 | tcp_heuristic_tfo_loss(tp); |
1778 | } else { |
1779 | if (tp->t_tfo_flags & TFO_F_COOKIE_REQ) { |
1780 | tp->t_tfo_stats |= TFO_S_NO_COOKIE_RCV; |
1781 | tcpstat.tcps_tfo_no_cookie_rcv++; |
1782 | } |
1783 | |
1784 | tcp_heuristic_tfo_success(tp); |
1785 | } |
1786 | } |
1787 | } |
1788 | |
1789 | static void |
1790 | tcp_tfo_rcv_probe(struct tcpcb *tp, int tlen) |
1791 | { |
1792 | if (tlen != 0) |
1793 | return; |
1794 | |
1795 | tp->t_tfo_probe_state = TFO_PROBE_PROBING; |
1796 | |
1797 | /* |
1798 | * We send the probe out rather quickly (after one RTO). It does not |
1799 | * really hurt that much, it's only one additional segment on the wire. |
1800 | */ |
1801 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, (TCP_REXMTVAL(tp))); |
1802 | } |
1803 | |
1804 | static void |
1805 | tcp_tfo_rcv_data(struct tcpcb *tp) |
1806 | { |
1807 | /* Transition from PROBING to NONE as data has been received */ |
1808 | if (tp->t_tfo_probe_state >= TFO_PROBE_PROBING) |
1809 | tp->t_tfo_probe_state = TFO_PROBE_NONE; |
1810 | } |
1811 | |
1812 | static void |
1813 | tcp_tfo_rcv_ack(struct tcpcb *tp, struct tcphdr *th) |
1814 | { |
1815 | if (tp->t_tfo_probe_state == TFO_PROBE_PROBING && |
1816 | tp->t_tfo_probes > 0) { |
1817 | if (th->th_seq == tp->rcv_nxt) { |
1818 | /* No hole, so stop probing */ |
1819 | tp->t_tfo_probe_state = TFO_PROBE_NONE; |
1820 | } else if (SEQ_GT(th->th_seq, tp->rcv_nxt)) { |
1821 | /* There is a hole! Wait a bit for data... */ |
1822 | tp->t_tfo_probe_state = TFO_PROBE_WAIT_DATA; |
1823 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, |
1824 | TCP_REXMTVAL(tp)); |
1825 | } |
1826 | } |
1827 | } |
1828 | |
1829 | /* |
1830 | * Update snd_wnd information. |
1831 | */ |
1832 | static inline bool |
1833 | tcp_update_window(struct tcpcb *tp, int thflags, struct tcphdr * th, |
1834 | u_int32_t tiwin, int tlen) |
1835 | { |
1836 | /* Don't look at the window if there is no ACK flag */ |
1837 | if ((thflags & TH_ACK) && |
1838 | (SEQ_LT(tp->snd_wl1, th->th_seq) || |
1839 | (tp->snd_wl1 == th->th_seq && (SEQ_LT(tp->snd_wl2, th->th_ack) || |
1840 | (tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd))))) { |
1841 | /* keep track of pure window updates */ |
1842 | if (tlen == 0 && |
1843 | tp->snd_wl2 == th->th_ack && tiwin > tp->snd_wnd) |
1844 | tcpstat.tcps_rcvwinupd++; |
1845 | tp->snd_wnd = tiwin; |
1846 | tp->snd_wl1 = th->th_seq; |
1847 | tp->snd_wl2 = th->th_ack; |
1848 | if (tp->snd_wnd > tp->max_sndwnd) |
1849 | tp->max_sndwnd = tp->snd_wnd; |
1850 | |
1851 | if (tp->t_inpcb->inp_socket->so_flags & SOF_MP_SUBFLOW) |
1852 | mptcp_update_window_wakeup(tp); |
1853 | return (true); |
1854 | } |
1855 | return (false); |
1856 | } |
1857 | |
1858 | void |
1859 | tcp_input(struct mbuf *m, int off0) |
1860 | { |
1861 | struct tcphdr *th; |
1862 | struct ip *ip = NULL; |
1863 | struct inpcb *inp; |
1864 | u_char *optp = NULL; |
1865 | int optlen = 0; |
1866 | int tlen, off; |
1867 | int drop_hdrlen; |
1868 | struct tcpcb *tp = 0; |
1869 | int thflags; |
1870 | struct socket *so = 0; |
1871 | int todrop, acked, ourfinisacked, needoutput = 0; |
1872 | struct in_addr laddr; |
1873 | #if INET6 |
1874 | struct in6_addr laddr6; |
1875 | #endif |
1876 | int dropsocket = 0; |
1877 | int iss = 0, nosock = 0; |
1878 | u_int32_t tiwin, sack_bytes_acked = 0; |
1879 | struct tcpopt to; /* options in this segment */ |
1880 | #if TCPDEBUG |
1881 | short ostate = 0; |
1882 | #endif |
1883 | #if IPFIREWALL |
1884 | struct sockaddr_in *next_hop = NULL; |
1885 | struct m_tag *fwd_tag; |
1886 | #endif /* IPFIREWALL */ |
1887 | u_char ip_ecn = IPTOS_ECN_NOTECT; |
1888 | unsigned int ifscope; |
1889 | uint8_t isconnected, isdisconnected; |
1890 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
1891 | int pktf_sw_lro_pkt = (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) ? 1 : 0; |
1892 | int nlropkts = (pktf_sw_lro_pkt == 1) ? m->m_pkthdr.lro_npkts : 1; |
1893 | int turnoff_lro = 0, win; |
1894 | #if MPTCP |
1895 | struct mptcb *mp_tp = NULL; |
1896 | #endif /* MPTCP */ |
1897 | boolean_t cell = IFNET_IS_CELLULAR(ifp); |
1898 | boolean_t wifi = (!cell && IFNET_IS_WIFI(ifp)); |
1899 | boolean_t wired = (!wifi && IFNET_IS_WIRED(ifp)); |
1900 | boolean_t recvd_dsack = FALSE; |
1901 | struct tcp_respond_args tra; |
1902 | |
1903 | #define TCP_INC_VAR(stat, npkts) do { \ |
1904 | stat += npkts; \ |
1905 | } while (0) |
1906 | |
1907 | TCP_INC_VAR(tcpstat.tcps_rcvtotal, nlropkts); |
1908 | #if IPFIREWALL |
1909 | /* Grab info from PACKET_TAG_IPFORWARD tag prepended to the chain. */ |
1910 | if (!SLIST_EMPTY(&m->m_pkthdr.tags)) { |
1911 | fwd_tag = m_tag_locate(m, KERNEL_MODULE_TAG_ID, |
1912 | KERNEL_TAG_TYPE_IPFORWARD, NULL); |
1913 | } else { |
1914 | fwd_tag = NULL; |
1915 | } |
1916 | if (fwd_tag != NULL) { |
1917 | struct ip_fwd_tag *ipfwd_tag = |
1918 | (struct ip_fwd_tag *)(fwd_tag+1); |
1919 | |
1920 | next_hop = ipfwd_tag->next_hop; |
1921 | m_tag_delete(m, fwd_tag); |
1922 | } |
1923 | #endif /* IPFIREWALL */ |
1924 | |
1925 | #if INET6 |
1926 | struct ip6_hdr *ip6 = NULL; |
1927 | int isipv6; |
1928 | #endif /* INET6 */ |
1929 | int rstreason; /* For badport_bandlim accounting purposes */ |
1930 | struct proc *proc0=current_proc(); |
1931 | |
1932 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_START,0,0,0,0,0); |
1933 | |
1934 | #if INET6 |
1935 | isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0; |
1936 | #endif |
1937 | bzero((char *)&to, sizeof(to)); |
1938 | |
1939 | #if INET6 |
1940 | if (isipv6) { |
1941 | /* |
1942 | * Expect 32-bit aligned data pointer on |
1943 | * strict-align platforms |
1944 | */ |
1945 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
1946 | |
1947 | /* IP6_EXTHDR_CHECK() is already done at tcp6_input() */ |
1948 | ip6 = mtod(m, struct ip6_hdr *); |
1949 | tlen = sizeof(*ip6) + ntohs(ip6->ip6_plen) - off0; |
1950 | th = (struct tcphdr *)(void *)((caddr_t)ip6 + off0); |
1951 | |
1952 | if (tcp_input_checksum(AF_INET6, m, th, off0, tlen)) |
1953 | goto dropnosock; |
1954 | |
1955 | KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport), |
1956 | (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])), |
1957 | th->th_seq, th->th_ack, th->th_win); |
1958 | /* |
1959 | * Be proactive about unspecified IPv6 address in source. |
1960 | * As we use all-zero to indicate unbounded/unconnected pcb, |
1961 | * unspecified IPv6 address can be used to confuse us. |
1962 | * |
1963 | * Note that packets with unspecified IPv6 destination is |
1964 | * already dropped in ip6_input. |
1965 | */ |
1966 | if (IN6_IS_ADDR_UNSPECIFIED(&ip6->ip6_src)) { |
1967 | /* XXX stat */ |
1968 | IF_TCP_STATINC(ifp, unspecv6); |
1969 | goto dropnosock; |
1970 | } |
1971 | DTRACE_TCP5(receive, struct mbuf *, m, struct inpcb *, NULL, |
1972 | struct ip6_hdr *, ip6, struct tcpcb *, NULL, |
1973 | struct tcphdr *, th); |
1974 | |
1975 | ip_ecn = (ntohl(ip6->ip6_flow) >> 20) & IPTOS_ECN_MASK; |
1976 | } else |
1977 | #endif /* INET6 */ |
1978 | { |
1979 | /* |
1980 | * Get IP and TCP header together in first mbuf. |
1981 | * Note: IP leaves IP header in first mbuf. |
1982 | */ |
1983 | if (off0 > sizeof (struct ip)) { |
1984 | ip_stripoptions(m); |
1985 | off0 = sizeof(struct ip); |
1986 | } |
1987 | if (m->m_len < sizeof (struct tcpiphdr)) { |
1988 | if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { |
1989 | tcpstat.tcps_rcvshort++; |
1990 | return; |
1991 | } |
1992 | } |
1993 | |
1994 | /* Expect 32-bit aligned data pointer on strict-align platforms */ |
1995 | MBUF_STRICT_DATA_ALIGNMENT_CHECK_32(m); |
1996 | |
1997 | ip = mtod(m, struct ip *); |
1998 | th = (struct tcphdr *)(void *)((caddr_t)ip + off0); |
1999 | tlen = ip->ip_len; |
2000 | |
2001 | if (tcp_input_checksum(AF_INET, m, th, off0, tlen)) |
2002 | goto dropnosock; |
2003 | |
2004 | #if INET6 |
2005 | /* Re-initialization for later version check */ |
2006 | ip->ip_v = IPVERSION; |
2007 | #endif |
2008 | ip_ecn = (ip->ip_tos & IPTOS_ECN_MASK); |
2009 | |
2010 | DTRACE_TCP5(receive, struct mbuf *, m, struct inpcb *, NULL, |
2011 | struct ip *, ip, struct tcpcb *, NULL, struct tcphdr *, th); |
2012 | |
2013 | KERNEL_DEBUG(DBG_LAYER_BEG, ((th->th_dport << 16) | th->th_sport), |
2014 | (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)), |
2015 | th->th_seq, th->th_ack, th->th_win); |
2016 | |
2017 | } |
2018 | |
2019 | /* |
2020 | * Check that TCP offset makes sense, |
2021 | * pull out TCP options and adjust length. |
2022 | */ |
2023 | off = th->th_off << 2; |
2024 | if (off < sizeof (struct tcphdr) || off > tlen) { |
2025 | tcpstat.tcps_rcvbadoff++; |
2026 | IF_TCP_STATINC(ifp, badformat); |
2027 | goto dropnosock; |
2028 | } |
2029 | tlen -= off; /* tlen is used instead of ti->ti_len */ |
2030 | if (off > sizeof (struct tcphdr)) { |
2031 | #if INET6 |
2032 | if (isipv6) { |
2033 | IP6_EXTHDR_CHECK(m, off0, off, return); |
2034 | ip6 = mtod(m, struct ip6_hdr *); |
2035 | th = (struct tcphdr *)(void *)((caddr_t)ip6 + off0); |
2036 | } else |
2037 | #endif /* INET6 */ |
2038 | { |
2039 | if (m->m_len < sizeof(struct ip) + off) { |
2040 | if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) { |
2041 | tcpstat.tcps_rcvshort++; |
2042 | return; |
2043 | } |
2044 | ip = mtod(m, struct ip *); |
2045 | th = (struct tcphdr *)(void *)((caddr_t)ip + off0); |
2046 | } |
2047 | } |
2048 | optlen = off - sizeof (struct tcphdr); |
2049 | optp = (u_char *)(th + 1); |
2050 | /* |
2051 | * Do quick retrieval of timestamp options ("options |
2052 | * prediction?"). If timestamp is the only option and it's |
2053 | * formatted as recommended in RFC 1323 appendix A, we |
2054 | * quickly get the values now and not bother calling |
2055 | * tcp_dooptions(), etc. |
2056 | */ |
2057 | if ((optlen == TCPOLEN_TSTAMP_APPA || |
2058 | (optlen > TCPOLEN_TSTAMP_APPA && |
2059 | optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && |
2060 | *(u_int32_t *)(void *)optp == htonl(TCPOPT_TSTAMP_HDR) && |
2061 | (th->th_flags & TH_SYN) == 0) { |
2062 | to.to_flags |= TOF_TS; |
2063 | to.to_tsval = ntohl(*(u_int32_t *)(void *)(optp + 4)); |
2064 | to.to_tsecr = ntohl(*(u_int32_t *)(void *)(optp + 8)); |
2065 | optp = NULL; /* we've parsed the options */ |
2066 | } |
2067 | } |
2068 | thflags = th->th_flags; |
2069 | |
2070 | #if TCP_DROP_SYNFIN |
2071 | /* |
2072 | * If the drop_synfin option is enabled, drop all packets with |
2073 | * both the SYN and FIN bits set. This prevents e.g. nmap from |
2074 | * identifying the TCP/IP stack. |
2075 | * |
2076 | * This is a violation of the TCP specification. |
2077 | */ |
2078 | if (drop_synfin && (thflags & (TH_SYN|TH_FIN)) == (TH_SYN|TH_FIN)) { |
2079 | IF_TCP_STATINC(ifp, synfin); |
2080 | goto dropnosock; |
2081 | } |
2082 | #endif |
2083 | |
2084 | /* |
2085 | * Delay dropping TCP, IP headers, IPv6 ext headers, and TCP options, |
2086 | * until after ip6_savecontrol() is called and before other functions |
2087 | * which don't want those proto headers. |
2088 | * Because ip6_savecontrol() is going to parse the mbuf to |
2089 | * search for data to be passed up to user-land, it wants mbuf |
2090 | * parameters to be unchanged. |
2091 | */ |
2092 | drop_hdrlen = off0 + off; |
2093 | |
2094 | /* Since this is an entry point for input processing of tcp packets, we |
2095 | * can update the tcp clock here. |
2096 | */ |
2097 | calculate_tcp_clock(); |
2098 | |
2099 | /* |
2100 | * Record the interface where this segment arrived on; this does not |
2101 | * affect normal data output (for non-detached TCP) as it provides a |
2102 | * hint about which route and interface to use for sending in the |
2103 | * absence of a PCB, when scoped routing (and thus source interface |
2104 | * selection) are enabled. |
2105 | */ |
2106 | if ((m->m_pkthdr.pkt_flags & PKTF_LOOP) || m->m_pkthdr.rcvif == NULL) |
2107 | ifscope = IFSCOPE_NONE; |
2108 | else |
2109 | ifscope = m->m_pkthdr.rcvif->if_index; |
2110 | |
2111 | /* |
2112 | * Convert TCP protocol specific fields to host format. |
2113 | */ |
2114 | |
2115 | #if BYTE_ORDER != BIG_ENDIAN |
2116 | NTOHL(th->th_seq); |
2117 | NTOHL(th->th_ack); |
2118 | NTOHS(th->th_win); |
2119 | NTOHS(th->th_urp); |
2120 | #endif |
2121 | |
2122 | /* |
2123 | * Locate pcb for segment. |
2124 | */ |
2125 | findpcb: |
2126 | |
2127 | isconnected = FALSE; |
2128 | isdisconnected = FALSE; |
2129 | |
2130 | #if IPFIREWALL_FORWARD |
2131 | if (next_hop != NULL |
2132 | #if INET6 |
2133 | && isipv6 == 0 /* IPv6 support is not yet */ |
2134 | #endif /* INET6 */ |
2135 | ) { |
2136 | /* |
2137 | * Diverted. Pretend to be the destination. |
2138 | * already got one like this? |
2139 | */ |
2140 | inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport, |
2141 | ip->ip_dst, th->th_dport, 0, m->m_pkthdr.rcvif); |
2142 | if (!inp) { |
2143 | /* |
2144 | * No, then it's new. Try find the ambushing socket |
2145 | */ |
2146 | if (!next_hop->sin_port) { |
2147 | inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, |
2148 | th->th_sport, next_hop->sin_addr, |
2149 | th->th_dport, 1, m->m_pkthdr.rcvif); |
2150 | } else { |
2151 | inp = in_pcblookup_hash(&tcbinfo, |
2152 | ip->ip_src, th->th_sport, |
2153 | next_hop->sin_addr, |
2154 | ntohs(next_hop->sin_port), 1, |
2155 | m->m_pkthdr.rcvif); |
2156 | } |
2157 | } |
2158 | } else |
2159 | #endif /* IPFIREWALL_FORWARD */ |
2160 | { |
2161 | #if INET6 |
2162 | if (isipv6) |
2163 | inp = in6_pcblookup_hash(&tcbinfo, &ip6->ip6_src, th->th_sport, |
2164 | &ip6->ip6_dst, th->th_dport, 1, |
2165 | m->m_pkthdr.rcvif); |
2166 | else |
2167 | #endif /* INET6 */ |
2168 | inp = in_pcblookup_hash(&tcbinfo, ip->ip_src, th->th_sport, |
2169 | ip->ip_dst, th->th_dport, 1, m->m_pkthdr.rcvif); |
2170 | } |
2171 | |
2172 | /* |
2173 | * Use the interface scope information from the PCB for outbound |
2174 | * segments. If the PCB isn't present and if scoped routing is |
2175 | * enabled, tcp_respond will use the scope of the interface where |
2176 | * the segment arrived on. |
2177 | */ |
2178 | if (inp != NULL && (inp->inp_flags & INP_BOUND_IF)) |
2179 | ifscope = inp->inp_boundifp->if_index; |
2180 | |
2181 | /* |
2182 | * If the state is CLOSED (i.e., TCB does not exist) then |
2183 | * all data in the incoming segment is discarded. |
2184 | * If the TCB exists but is in CLOSED state, it is embryonic, |
2185 | * but should either do a listen or a connect soon. |
2186 | */ |
2187 | if (inp == NULL) { |
2188 | if (log_in_vain) { |
2189 | #if INET6 |
2190 | char dbuf[MAX_IPv6_STR_LEN], sbuf[MAX_IPv6_STR_LEN]; |
2191 | #else /* INET6 */ |
2192 | char dbuf[MAX_IPv4_STR_LEN], sbuf[MAX_IPv4_STR_LEN]; |
2193 | #endif /* INET6 */ |
2194 | |
2195 | #if INET6 |
2196 | if (isipv6) { |
2197 | inet_ntop(AF_INET6, &ip6->ip6_dst, dbuf, sizeof(dbuf)); |
2198 | inet_ntop(AF_INET6, &ip6->ip6_src, sbuf, sizeof(sbuf)); |
2199 | } else |
2200 | #endif |
2201 | { |
2202 | inet_ntop(AF_INET, &ip->ip_dst, dbuf, sizeof(dbuf)); |
2203 | inet_ntop(AF_INET, &ip->ip_src, sbuf, sizeof(sbuf)); |
2204 | } |
2205 | switch (log_in_vain) { |
2206 | case 1: |
2207 | if(thflags & TH_SYN) |
2208 | log(LOG_INFO, |
2209 | "Connection attempt to TCP %s:%d from %s:%d\n" , |
2210 | dbuf, ntohs(th->th_dport), |
2211 | sbuf, |
2212 | ntohs(th->th_sport)); |
2213 | break; |
2214 | case 2: |
2215 | log(LOG_INFO, |
2216 | "Connection attempt to TCP %s:%d from %s:%d flags:0x%x\n" , |
2217 | dbuf, ntohs(th->th_dport), sbuf, |
2218 | ntohs(th->th_sport), thflags); |
2219 | break; |
2220 | case 3: |
2221 | case 4: |
2222 | if ((thflags & TH_SYN) && !(thflags & TH_ACK) && |
2223 | !(m->m_flags & (M_BCAST | M_MCAST)) && |
2224 | #if INET6 |
2225 | ((isipv6 && !IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, &ip6->ip6_src)) || |
2226 | (!isipv6 && ip->ip_dst.s_addr != ip->ip_src.s_addr)) |
2227 | #else |
2228 | ip->ip_dst.s_addr != ip->ip_src.s_addr |
2229 | #endif |
2230 | ) |
2231 | log_in_vain_log((LOG_INFO, |
2232 | "Stealth Mode connection attempt to TCP %s:%d from %s:%d\n" , |
2233 | dbuf, ntohs(th->th_dport), |
2234 | sbuf, |
2235 | ntohs(th->th_sport))); |
2236 | break; |
2237 | default: |
2238 | break; |
2239 | } |
2240 | } |
2241 | if (blackhole) { |
2242 | if (m->m_pkthdr.rcvif && m->m_pkthdr.rcvif->if_type != IFT_LOOP) |
2243 | |
2244 | switch (blackhole) { |
2245 | case 1: |
2246 | if (thflags & TH_SYN) |
2247 | goto dropnosock; |
2248 | break; |
2249 | case 2: |
2250 | goto dropnosock; |
2251 | default: |
2252 | goto dropnosock; |
2253 | } |
2254 | } |
2255 | rstreason = BANDLIM_RST_CLOSEDPORT; |
2256 | IF_TCP_STATINC(ifp, noconnnolist); |
2257 | goto dropwithresetnosock; |
2258 | } |
2259 | so = inp->inp_socket; |
2260 | if (so == NULL) { |
2261 | /* This case shouldn't happen as the socket shouldn't be null |
2262 | * if inp_state isn't set to INPCB_STATE_DEAD |
2263 | * But just in case, we pretend we didn't find the socket if we hit this case |
2264 | * as this isn't cause for a panic (the socket might be leaked however)... |
2265 | */ |
2266 | inp = NULL; |
2267 | #if TEMPDEBUG |
2268 | printf("tcp_input: no more socket for inp=%x. This shouldn't happen\n" , inp); |
2269 | #endif |
2270 | goto dropnosock; |
2271 | } |
2272 | |
2273 | socket_lock(so, 1); |
2274 | if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) { |
2275 | socket_unlock(so, 1); |
2276 | inp = NULL; // pretend we didn't find it |
2277 | goto dropnosock; |
2278 | } |
2279 | |
2280 | #if NECP |
2281 | if (so->so_state & SS_ISCONNECTED) { |
2282 | // Connected TCP sockets have a fully-bound local and remote, |
2283 | // so the policy check doesn't need to override addresses |
2284 | if (!necp_socket_is_allowed_to_send_recv(inp, NULL, NULL, NULL)) { |
2285 | IF_TCP_STATINC(ifp, badformat); |
2286 | goto drop; |
2287 | } |
2288 | } else { |
2289 | #if INET6 |
2290 | if (isipv6) { |
2291 | if (!necp_socket_is_allowed_to_send_recv_v6(inp, |
2292 | th->th_dport, th->th_sport, &ip6->ip6_dst, |
2293 | &ip6->ip6_src, ifp, NULL, NULL, NULL)) { |
2294 | IF_TCP_STATINC(ifp, badformat); |
2295 | goto drop; |
2296 | } |
2297 | } else |
2298 | #endif |
2299 | { |
2300 | if (!necp_socket_is_allowed_to_send_recv_v4(inp, |
2301 | th->th_dport, th->th_sport, &ip->ip_dst, &ip->ip_src, |
2302 | ifp, NULL, NULL, NULL)) { |
2303 | IF_TCP_STATINC(ifp, badformat); |
2304 | goto drop; |
2305 | } |
2306 | } |
2307 | } |
2308 | #endif /* NECP */ |
2309 | |
2310 | tp = intotcpcb(inp); |
2311 | if (tp == 0) { |
2312 | rstreason = BANDLIM_RST_CLOSEDPORT; |
2313 | IF_TCP_STATINC(ifp, noconnlist); |
2314 | goto dropwithreset; |
2315 | } |
2316 | if (tp->t_state == TCPS_CLOSED) |
2317 | goto drop; |
2318 | |
2319 | /* If none of the FIN|SYN|RST|ACK flag is set, drop */ |
2320 | if (tcp_do_rfc5961 && (thflags & TH_ACCEPT) == 0) |
2321 | goto drop; |
2322 | |
2323 | /* Unscale the window into a 32-bit value. */ |
2324 | if ((thflags & TH_SYN) == 0) |
2325 | tiwin = th->th_win << tp->snd_scale; |
2326 | else |
2327 | tiwin = th->th_win; |
2328 | |
2329 | #if CONFIG_MACF_NET |
2330 | if (mac_inpcb_check_deliver(inp, m, AF_INET, SOCK_STREAM)) |
2331 | goto drop; |
2332 | #endif |
2333 | |
2334 | /* Avoid processing packets while closing a listen socket */ |
2335 | if (tp->t_state == TCPS_LISTEN && |
2336 | (so->so_options & SO_ACCEPTCONN) == 0) |
2337 | goto drop; |
2338 | |
2339 | if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { |
2340 | #if TCPDEBUG |
2341 | if (so->so_options & SO_DEBUG) { |
2342 | ostate = tp->t_state; |
2343 | #if INET6 |
2344 | if (isipv6) |
2345 | bcopy((char *)ip6, (char *)tcp_saveipgen, |
2346 | sizeof(*ip6)); |
2347 | else |
2348 | #endif /* INET6 */ |
2349 | bcopy((char *)ip, (char *)tcp_saveipgen, sizeof(*ip)); |
2350 | tcp_savetcp = *th; |
2351 | } |
2352 | #endif |
2353 | if (so->so_options & SO_ACCEPTCONN) { |
2354 | struct tcpcb *tp0 = tp; |
2355 | struct socket *so2; |
2356 | struct socket *oso; |
2357 | struct sockaddr_storage from; |
2358 | #if INET6 |
2359 | struct inpcb *oinp = sotoinpcb(so); |
2360 | #endif /* INET6 */ |
2361 | struct ifnet *head_ifscope; |
2362 | unsigned int head_nocell, head_recvanyif, |
2363 | head_noexpensive, head_awdl_unrestricted, |
2364 | head_intcoproc_allowed; |
2365 | |
2366 | /* Get listener's bound-to-interface, if any */ |
2367 | head_ifscope = (inp->inp_flags & INP_BOUND_IF) ? |
2368 | inp->inp_boundifp : NULL; |
2369 | /* Get listener's no-cellular information, if any */ |
2370 | head_nocell = INP_NO_CELLULAR(inp); |
2371 | /* Get listener's recv-any-interface, if any */ |
2372 | head_recvanyif = (inp->inp_flags & INP_RECV_ANYIF); |
2373 | /* Get listener's no-expensive information, if any */ |
2374 | head_noexpensive = INP_NO_EXPENSIVE(inp); |
2375 | head_awdl_unrestricted = INP_AWDL_UNRESTRICTED(inp); |
2376 | head_intcoproc_allowed = INP_INTCOPROC_ALLOWED(inp); |
2377 | |
2378 | /* |
2379 | * If the state is LISTEN then ignore segment if it contains an RST. |
2380 | * If the segment contains an ACK then it is bad and send a RST. |
2381 | * If it does not contain a SYN then it is not interesting; drop it. |
2382 | * If it is from this socket, drop it, it must be forged. |
2383 | */ |
2384 | if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { |
2385 | IF_TCP_STATINC(ifp, listbadsyn); |
2386 | |
2387 | if (thflags & TH_RST) { |
2388 | goto drop; |
2389 | } |
2390 | if (thflags & TH_ACK) { |
2391 | tp = NULL; |
2392 | tcpstat.tcps_badsyn++; |
2393 | rstreason = BANDLIM_RST_OPENPORT; |
2394 | goto dropwithreset; |
2395 | } |
2396 | |
2397 | /* We come here if there is no SYN set */ |
2398 | tcpstat.tcps_badsyn++; |
2399 | goto drop; |
2400 | } |
2401 | KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_START,0,0,0,0,0); |
2402 | if (th->th_dport == th->th_sport) { |
2403 | #if INET6 |
2404 | if (isipv6) { |
2405 | if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst, |
2406 | &ip6->ip6_src)) |
2407 | goto drop; |
2408 | } else |
2409 | #endif /* INET6 */ |
2410 | if (ip->ip_dst.s_addr == ip->ip_src.s_addr) |
2411 | goto drop; |
2412 | } |
2413 | /* |
2414 | * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN |
2415 | * in_broadcast() should never return true on a received |
2416 | * packet with M_BCAST not set. |
2417 | * |
2418 | * Packets with a multicast source address should also |
2419 | * be discarded. |
2420 | */ |
2421 | if (m->m_flags & (M_BCAST|M_MCAST)) |
2422 | goto drop; |
2423 | #if INET6 |
2424 | if (isipv6) { |
2425 | if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || |
2426 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) |
2427 | goto drop; |
2428 | } else |
2429 | #endif |
2430 | if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || |
2431 | IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || |
2432 | ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || |
2433 | in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) |
2434 | goto drop; |
2435 | |
2436 | |
2437 | #if INET6 |
2438 | /* |
2439 | * If deprecated address is forbidden, |
2440 | * we do not accept SYN to deprecated interface |
2441 | * address to prevent any new inbound connection from |
2442 | * getting established. |
2443 | * When we do not accept SYN, we send a TCP RST, |
2444 | * with deprecated source address (instead of dropping |
2445 | * it). We compromise it as it is much better for peer |
2446 | * to send a RST, and RST will be the final packet |
2447 | * for the exchange. |
2448 | * |
2449 | * If we do not forbid deprecated addresses, we accept |
2450 | * the SYN packet. RFC 4862 forbids dropping SYN in |
2451 | * this case. |
2452 | */ |
2453 | if (isipv6 && !ip6_use_deprecated) { |
2454 | uint32_t ia6_flags; |
2455 | |
2456 | if (ip6_getdstifaddr_info(m, NULL, |
2457 | &ia6_flags) == 0) { |
2458 | if (ia6_flags & IN6_IFF_DEPRECATED) { |
2459 | tp = NULL; |
2460 | rstreason = BANDLIM_RST_OPENPORT; |
2461 | IF_TCP_STATINC(ifp, deprecate6); |
2462 | goto dropwithreset; |
2463 | } |
2464 | } |
2465 | } |
2466 | #endif |
2467 | if (so->so_filt) { |
2468 | #if INET6 |
2469 | if (isipv6) { |
2470 | struct sockaddr_in6 *sin6 = (struct sockaddr_in6*)&from; |
2471 | |
2472 | sin6->sin6_len = sizeof(*sin6); |
2473 | sin6->sin6_family = AF_INET6; |
2474 | sin6->sin6_port = th->th_sport; |
2475 | sin6->sin6_flowinfo = 0; |
2476 | sin6->sin6_addr = ip6->ip6_src; |
2477 | sin6->sin6_scope_id = 0; |
2478 | } |
2479 | else |
2480 | #endif |
2481 | { |
2482 | struct sockaddr_in *sin = (struct sockaddr_in*)&from; |
2483 | |
2484 | sin->sin_len = sizeof(*sin); |
2485 | sin->sin_family = AF_INET; |
2486 | sin->sin_port = th->th_sport; |
2487 | sin->sin_addr = ip->ip_src; |
2488 | } |
2489 | so2 = sonewconn(so, 0, (struct sockaddr*)&from); |
2490 | } else { |
2491 | so2 = sonewconn(so, 0, NULL); |
2492 | } |
2493 | if (so2 == 0) { |
2494 | tcpstat.tcps_listendrop++; |
2495 | if (tcp_dropdropablreq(so)) { |
2496 | if (so->so_filt) |
2497 | so2 = sonewconn(so, 0, (struct sockaddr*)&from); |
2498 | else |
2499 | so2 = sonewconn(so, 0, NULL); |
2500 | } |
2501 | if (!so2) |
2502 | goto drop; |
2503 | } |
2504 | |
2505 | /* Point "inp" and "tp" in tandem to new socket */ |
2506 | inp = (struct inpcb *)so2->so_pcb; |
2507 | tp = intotcpcb(inp); |
2508 | |
2509 | oso = so; |
2510 | socket_unlock(so, 0); /* Unlock but keep a reference on listener for now */ |
2511 | |
2512 | so = so2; |
2513 | socket_lock(so, 1); |
2514 | /* |
2515 | * Mark socket as temporary until we're |
2516 | * committed to keeping it. The code at |
2517 | * ``drop'' and ``dropwithreset'' check the |
2518 | * flag dropsocket to see if the temporary |
2519 | * socket created here should be discarded. |
2520 | * We mark the socket as discardable until |
2521 | * we're committed to it below in TCPS_LISTEN. |
2522 | * There are some error conditions in which we |
2523 | * have to drop the temporary socket. |
2524 | */ |
2525 | dropsocket++; |
2526 | /* |
2527 | * Inherit INP_BOUND_IF from listener; testing if |
2528 | * head_ifscope is non-NULL is sufficient, since it |
2529 | * can only be set to a non-zero value earlier if |
2530 | * the listener has such a flag set. |
2531 | */ |
2532 | if (head_ifscope != NULL) { |
2533 | inp->inp_flags |= INP_BOUND_IF; |
2534 | inp->inp_boundifp = head_ifscope; |
2535 | } else { |
2536 | inp->inp_flags &= ~INP_BOUND_IF; |
2537 | } |
2538 | /* |
2539 | * Inherit restrictions from listener. |
2540 | */ |
2541 | if (head_nocell) |
2542 | inp_set_nocellular(inp); |
2543 | if (head_noexpensive) |
2544 | inp_set_noexpensive(inp); |
2545 | if (head_awdl_unrestricted) |
2546 | inp_set_awdl_unrestricted(inp); |
2547 | if (head_intcoproc_allowed) |
2548 | inp_set_intcoproc_allowed(inp); |
2549 | /* |
2550 | * Inherit {IN,IN6}_RECV_ANYIF from listener. |
2551 | */ |
2552 | if (head_recvanyif) |
2553 | inp->inp_flags |= INP_RECV_ANYIF; |
2554 | else |
2555 | inp->inp_flags &= ~INP_RECV_ANYIF; |
2556 | #if INET6 |
2557 | if (isipv6) |
2558 | inp->in6p_laddr = ip6->ip6_dst; |
2559 | else { |
2560 | inp->inp_vflag &= ~INP_IPV6; |
2561 | inp->inp_vflag |= INP_IPV4; |
2562 | #endif /* INET6 */ |
2563 | inp->inp_laddr = ip->ip_dst; |
2564 | #if INET6 |
2565 | } |
2566 | #endif /* INET6 */ |
2567 | inp->inp_lport = th->th_dport; |
2568 | if (in_pcbinshash(inp, 0) != 0) { |
2569 | /* |
2570 | * Undo the assignments above if we failed to |
2571 | * put the PCB on the hash lists. |
2572 | */ |
2573 | #if INET6 |
2574 | if (isipv6) |
2575 | inp->in6p_laddr = in6addr_any; |
2576 | else |
2577 | #endif /* INET6 */ |
2578 | inp->inp_laddr.s_addr = INADDR_ANY; |
2579 | inp->inp_lport = 0; |
2580 | socket_lock(oso, 0); /* release ref on parent */ |
2581 | socket_unlock(oso, 1); |
2582 | goto drop; |
2583 | } |
2584 | #if INET6 |
2585 | if (isipv6) { |
2586 | /* |
2587 | * Inherit socket options from the listening |
2588 | * socket. |
2589 | * Note that in6p_inputopts are not (even |
2590 | * should not be) copied, since it stores |
2591 | * previously received options and is used to |
2592 | * detect if each new option is different than |
2593 | * the previous one and hence should be passed |
2594 | * to a user. |
2595 | * If we copied in6p_inputopts, a user would |
2596 | * not be able to receive options just after |
2597 | * calling the accept system call. |
2598 | */ |
2599 | inp->inp_flags |= |
2600 | oinp->inp_flags & INP_CONTROLOPTS; |
2601 | if (oinp->in6p_outputopts) |
2602 | inp->in6p_outputopts = |
2603 | ip6_copypktopts(oinp->in6p_outputopts, |
2604 | M_NOWAIT); |
2605 | } else |
2606 | #endif /* INET6 */ |
2607 | { |
2608 | inp->inp_options = ip_srcroute(); |
2609 | inp->inp_ip_tos = oinp->inp_ip_tos; |
2610 | } |
2611 | socket_lock(oso, 0); |
2612 | #if IPSEC |
2613 | /* copy old policy into new socket's */ |
2614 | if (sotoinpcb(oso)->inp_sp) |
2615 | { |
2616 | int error = 0; |
2617 | /* Is it a security hole here to silently fail to copy the policy? */ |
2618 | if (inp->inp_sp != NULL) |
2619 | error = ipsec_init_policy(so, &inp->inp_sp); |
2620 | if (error != 0 || ipsec_copy_policy(sotoinpcb(oso)->inp_sp, inp->inp_sp)) |
2621 | printf("tcp_input: could not copy policy\n" ); |
2622 | } |
2623 | #endif |
2624 | /* inherit states from the listener */ |
2625 | DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp, |
2626 | struct tcpcb *, tp, int32_t, TCPS_LISTEN); |
2627 | tp->t_state = TCPS_LISTEN; |
2628 | tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT|TF_NODELAY); |
2629 | tp->t_flagsext |= (tp0->t_flagsext & (TF_RXTFINDROP|TF_NOTIMEWAIT|TF_FASTOPEN)); |
2630 | tp->t_keepinit = tp0->t_keepinit; |
2631 | tp->t_keepcnt = tp0->t_keepcnt; |
2632 | tp->t_keepintvl = tp0->t_keepintvl; |
2633 | tp->t_adaptive_wtimo = tp0->t_adaptive_wtimo; |
2634 | tp->t_adaptive_rtimo = tp0->t_adaptive_rtimo; |
2635 | tp->t_inpcb->inp_ip_ttl = tp0->t_inpcb->inp_ip_ttl; |
2636 | if ((so->so_flags & SOF_NOTSENT_LOWAT) != 0) |
2637 | tp->t_notsent_lowat = tp0->t_notsent_lowat; |
2638 | tp->t_inpcb->inp_flags2 |= |
2639 | tp0->t_inpcb->inp_flags2 & INP2_KEEPALIVE_OFFLOAD; |
2640 | |
2641 | /* now drop the reference on the listener */ |
2642 | socket_unlock(oso, 1); |
2643 | |
2644 | tcp_set_max_rwinscale(tp, so, ifp); |
2645 | |
2646 | KERNEL_DEBUG(DBG_FNC_TCP_NEWCONN | DBG_FUNC_END,0,0,0,0,0); |
2647 | } |
2648 | } |
2649 | socket_lock_assert_owned(so); |
2650 | |
2651 | if (tp->t_state == TCPS_ESTABLISHED && tlen > 0) { |
2652 | /* |
2653 | * Evaluate the rate of arrival of packets to see if the |
2654 | * receiver can reduce the ack traffic. The algorithm to |
2655 | * stretch acks will be enabled if the connection meets |
2656 | * certain criteria defined in tcp_stretch_ack_enable function. |
2657 | */ |
2658 | if ((tp->t_flagsext & TF_RCVUNACK_WAITSS) != 0) { |
2659 | TCP_INC_VAR(tp->rcv_waitforss, nlropkts); |
2660 | } |
2661 | if (tcp_stretch_ack_enable(tp, thflags)) { |
2662 | tp->t_flags |= TF_STRETCHACK; |
2663 | tp->t_flagsext &= ~(TF_RCVUNACK_WAITSS); |
2664 | tp->rcv_waitforss = 0; |
2665 | } else { |
2666 | tp->t_flags &= ~(TF_STRETCHACK); |
2667 | } |
2668 | if (TSTMP_GT(tp->rcv_unackwin, tcp_now)) { |
2669 | tp->rcv_by_unackwin += (tlen + off); |
2670 | } else { |
2671 | tp->rcv_unackwin = tcp_now + tcp_rcvunackwin; |
2672 | tp->rcv_by_unackwin = tlen + off; |
2673 | } |
2674 | } |
2675 | |
2676 | /* |
2677 | * Keep track of how many bytes were received in the LRO packet |
2678 | */ |
2679 | if ((pktf_sw_lro_pkt) && (nlropkts > 2)) { |
2680 | tp->t_lropktlen += tlen; |
2681 | } |
2682 | /* |
2683 | * Explicit Congestion Notification - Flag that we need to send ECT if |
2684 | * + The IP Congestion experienced flag was set. |
2685 | * + Socket is in established state |
2686 | * + We negotiated ECN in the TCP setup |
2687 | * + This isn't a pure ack (tlen > 0) |
2688 | * + The data is in the valid window |
2689 | * |
2690 | * TE_SENDECE will be cleared when we receive a packet with TH_CWR set. |
2691 | */ |
2692 | if (ip_ecn == IPTOS_ECN_CE && tp->t_state == TCPS_ESTABLISHED && |
2693 | TCP_ECN_ENABLED(tp) && tlen > 0 && |
2694 | SEQ_GEQ(th->th_seq, tp->last_ack_sent) && |
2695 | SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) { |
2696 | tp->t_ecn_recv_ce++; |
2697 | tcpstat.tcps_ecn_recv_ce++; |
2698 | INP_INC_IFNET_STAT(inp, ecn_recv_ce); |
2699 | /* Mark this connection as it received CE from network */ |
2700 | tp->ecn_flags |= TE_RECV_ECN_CE; |
2701 | tp->ecn_flags |= TE_SENDECE; |
2702 | } |
2703 | |
2704 | /* |
2705 | * Clear TE_SENDECE if TH_CWR is set. This is harmless, so we don't |
2706 | * bother doing extensive checks for state and whatnot. |
2707 | */ |
2708 | if (thflags & TH_CWR) { |
2709 | tp->ecn_flags &= ~TE_SENDECE; |
2710 | tp->t_ecn_recv_cwr++; |
2711 | } |
2712 | |
2713 | /* |
2714 | * If we received an explicit notification of congestion in |
2715 | * ip tos ecn bits or by the CWR bit in TCP header flags, reset |
2716 | * the ack-strteching state. We need to handle ECN notification if |
2717 | * an ECN setup SYN was sent even once. |
2718 | */ |
2719 | if (tp->t_state == TCPS_ESTABLISHED |
2720 | && (tp->ecn_flags & TE_SETUPSENT) |
2721 | && (ip_ecn == IPTOS_ECN_CE || (thflags & TH_CWR))) { |
2722 | tcp_reset_stretch_ack(tp); |
2723 | CLEAR_IAJ_STATE(tp); |
2724 | } |
2725 | |
2726 | if (ip_ecn == IPTOS_ECN_CE && tp->t_state == TCPS_ESTABLISHED && |
2727 | !TCP_ECN_ENABLED(tp) && !(tp->ecn_flags & TE_CEHEURI_SET)) { |
2728 | tcpstat.tcps_ecn_fallback_ce++; |
2729 | tcp_heuristic_ecn_aggressive(tp); |
2730 | tp->ecn_flags |= TE_CEHEURI_SET; |
2731 | } |
2732 | |
2733 | if (tp->t_state == TCPS_ESTABLISHED && TCP_ECN_ENABLED(tp) && |
2734 | ip_ecn == IPTOS_ECN_CE && !(tp->ecn_flags & TE_CEHEURI_SET)) { |
2735 | if (inp->inp_stat->rxpackets < ECN_MIN_CE_PROBES) { |
2736 | tp->t_ecn_recv_ce_pkt++; |
2737 | } else if (tp->t_ecn_recv_ce_pkt > ECN_MAX_CE_RATIO) { |
2738 | tcpstat.tcps_ecn_fallback_ce++; |
2739 | tcp_heuristic_ecn_aggressive(tp); |
2740 | tp->ecn_flags |= TE_CEHEURI_SET; |
2741 | INP_INC_IFNET_STAT(inp,ecn_fallback_ce); |
2742 | } else { |
2743 | /* We tracked the first ECN_MIN_CE_PROBES segments, we |
2744 | * now know that the path is good. |
2745 | */ |
2746 | tp->ecn_flags |= TE_CEHEURI_SET; |
2747 | } |
2748 | } |
2749 | |
2750 | /* |
2751 | * Try to determine if we are receiving a packet after a long time. |
2752 | * Use our own approximation of idletime to roughly measure remote |
2753 | * end's idle time. Since slowstart is used after an idle period |
2754 | * we want to avoid doing LRO if the remote end is not up to date |
2755 | * on initial window support and starts with 1 or 2 packets as its IW. |
2756 | */ |
2757 | if (sw_lro && (tp->t_flagsext & TF_LRO_OFFLOADED) && |
2758 | ((tcp_now - tp->t_rcvtime) >= (TCP_IDLETIMEOUT(tp)))) { |
2759 | turnoff_lro = 1; |
2760 | } |
2761 | |
2762 | /* Update rcvtime as a new segment was received on the connection */ |
2763 | tp->t_rcvtime = tcp_now; |
2764 | |
2765 | /* |
2766 | * Segment received on connection. |
2767 | * Reset idle time and keep-alive timer. |
2768 | */ |
2769 | if (TCPS_HAVEESTABLISHED(tp->t_state)) { |
2770 | tcp_keepalive_reset(tp); |
2771 | |
2772 | if (tp->t_mpsub) |
2773 | mptcp_reset_keepalive(tp); |
2774 | } |
2775 | |
2776 | /* |
2777 | * Process options if not in LISTEN state, |
2778 | * else do it below (after getting remote address). |
2779 | */ |
2780 | if (tp->t_state != TCPS_LISTEN && optp) { |
2781 | tcp_dooptions(tp, optp, optlen, th, &to); |
2782 | } |
2783 | #if MPTCP |
2784 | if (tp->t_state != TCPS_LISTEN && (so->so_flags & SOF_MP_SUBFLOW) && |
2785 | mptcp_input_preproc(tp, m, th, drop_hdrlen) != 0) { |
2786 | tp->t_flags |= TF_ACKNOW; |
2787 | (void) tcp_output(tp); |
2788 | tcp_check_timer_state(tp); |
2789 | socket_unlock(so, 1); |
2790 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | |
2791 | DBG_FUNC_END,0,0,0,0,0); |
2792 | return; |
2793 | } |
2794 | #endif /* MPTCP */ |
2795 | if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) { |
2796 | if (!(thflags & TH_ACK) || |
2797 | (SEQ_GT(th->th_ack, tp->iss) && |
2798 | SEQ_LEQ(th->th_ack, tp->snd_max))) |
2799 | tcp_finalize_options(tp, &to, ifscope); |
2800 | } |
2801 | |
2802 | #if TRAFFIC_MGT |
2803 | /* |
2804 | * Compute inter-packet arrival jitter. According to RFC 3550, |
2805 | * inter-packet arrival jitter is defined as the difference in |
2806 | * packet spacing at the receiver compared to the sender for a |
2807 | * pair of packets. When two packets of maximum segment size come |
2808 | * one after the other with consecutive sequence numbers, we |
2809 | * consider them as packets sent together at the sender and use |
2810 | * them as a pair to compute inter-packet arrival jitter. This |
2811 | * metric indicates the delay induced by the network components due |
2812 | * to queuing in edge/access routers. |
2813 | */ |
2814 | if (tp->t_state == TCPS_ESTABLISHED && |
2815 | (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK|TH_ECE|TH_PUSH)) == TH_ACK && |
2816 | ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) && |
2817 | ((to.to_flags & TOF_TS) == 0 || |
2818 | TSTMP_GEQ(to.to_tsval, tp->ts_recent)) && |
2819 | th->th_seq == tp->rcv_nxt && LIST_EMPTY(&tp->t_segq)) { |
2820 | int seg_size = tlen; |
2821 | if (tp->iaj_pktcnt <= IAJ_IGNORE_PKTCNT) { |
2822 | TCP_INC_VAR(tp->iaj_pktcnt, nlropkts); |
2823 | } |
2824 | |
2825 | if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) { |
2826 | seg_size = m->m_pkthdr.lro_pktlen; |
2827 | } |
2828 | if ( tp->iaj_size == 0 || seg_size > tp->iaj_size || |
2829 | (seg_size == tp->iaj_size && tp->iaj_rcv_ts == 0)) { |
2830 | /* |
2831 | * State related to inter-arrival jitter is |
2832 | * uninitialized or we are trying to find a good |
2833 | * first packet to start computing the metric |
2834 | */ |
2835 | update_iaj_state(tp, seg_size, 0); |
2836 | } else { |
2837 | if (seg_size == tp->iaj_size) { |
2838 | /* |
2839 | * Compute inter-arrival jitter taking |
2840 | * this packet as the second packet |
2841 | */ |
2842 | if (pktf_sw_lro_pkt) |
2843 | compute_iaj(tp, nlropkts, |
2844 | m->m_pkthdr.lro_elapsed); |
2845 | else |
2846 | compute_iaj(tp, 1, 0); |
2847 | } |
2848 | if (seg_size < tp->iaj_size) { |
2849 | /* |
2850 | * There is a smaller packet in the stream. |
2851 | * Some times the maximum size supported |
2852 | * on a path can change if there is a new |
2853 | * link with smaller MTU. The receiver will |
2854 | * not know about this change. If there |
2855 | * are too many packets smaller than |
2856 | * iaj_size, we try to learn the iaj_size |
2857 | * again. |
2858 | */ |
2859 | TCP_INC_VAR(tp->iaj_small_pkt, nlropkts); |
2860 | if (tp->iaj_small_pkt > RESET_IAJ_SIZE_THRESH) { |
2861 | update_iaj_state(tp, seg_size, 1); |
2862 | } else { |
2863 | CLEAR_IAJ_STATE(tp); |
2864 | } |
2865 | } else { |
2866 | update_iaj_state(tp, seg_size, 0); |
2867 | } |
2868 | } |
2869 | } else { |
2870 | CLEAR_IAJ_STATE(tp); |
2871 | } |
2872 | #endif /* TRAFFIC_MGT */ |
2873 | |
2874 | /* |
2875 | * Header prediction: check for the two common cases |
2876 | * of a uni-directional data xfer. If the packet has |
2877 | * no control flags, is in-sequence, the window didn't |
2878 | * change and we're not retransmitting, it's a |
2879 | * candidate. If the length is zero and the ack moved |
2880 | * forward, we're the sender side of the xfer. Just |
2881 | * free the data acked & wake any higher level process |
2882 | * that was blocked waiting for space. If the length |
2883 | * is non-zero and the ack didn't move, we're the |
2884 | * receiver side. If we're getting packets in-order |
2885 | * (the reassembly queue is empty), add the data to |
2886 | * the socket buffer and note that we need a delayed ack. |
2887 | * Make sure that the hidden state-flags are also off. |
2888 | * Since we check for TCPS_ESTABLISHED above, it can only |
2889 | * be TH_NEEDSYN. |
2890 | */ |
2891 | if (tp->t_state == TCPS_ESTABLISHED && |
2892 | (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK|TH_ECE|TH_CWR)) == TH_ACK && |
2893 | ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) && |
2894 | ((to.to_flags & TOF_TS) == 0 || |
2895 | TSTMP_GEQ(to.to_tsval, tp->ts_recent)) && |
2896 | th->th_seq == tp->rcv_nxt && |
2897 | tiwin && tiwin == tp->snd_wnd && |
2898 | tp->snd_nxt == tp->snd_max) { |
2899 | |
2900 | /* |
2901 | * If last ACK falls within this segment's sequence numbers, |
2902 | * record the timestamp. |
2903 | * NOTE that the test is modified according to the latest |
2904 | * proposal of the tcplw@cray.com list (Braden 1993/04/26). |
2905 | */ |
2906 | if ((to.to_flags & TOF_TS) != 0 && |
2907 | SEQ_LEQ(th->th_seq, tp->last_ack_sent)) { |
2908 | tp->ts_recent_age = tcp_now; |
2909 | tp->ts_recent = to.to_tsval; |
2910 | } |
2911 | |
2912 | if (tlen == 0) { |
2913 | if (SEQ_GT(th->th_ack, tp->snd_una) && |
2914 | SEQ_LEQ(th->th_ack, tp->snd_max) && |
2915 | tp->snd_cwnd >= tp->snd_ssthresh && |
2916 | (!IN_FASTRECOVERY(tp) && |
2917 | ((!(SACK_ENABLED(tp)) && |
2918 | tp->t_dupacks < tp->t_rexmtthresh) || |
2919 | (SACK_ENABLED(tp) && to.to_nsacks == 0 && |
2920 | TAILQ_EMPTY(&tp->snd_holes))))) { |
2921 | /* |
2922 | * this is a pure ack for outstanding data. |
2923 | */ |
2924 | ++tcpstat.tcps_predack; |
2925 | |
2926 | tcp_bad_rexmt_check(tp, th, &to); |
2927 | |
2928 | /* Recalculate the RTT */ |
2929 | tcp_compute_rtt(tp, &to, th); |
2930 | |
2931 | VERIFY(SEQ_GEQ(th->th_ack, tp->snd_una)); |
2932 | acked = BYTES_ACKED(th, tp); |
2933 | tcpstat.tcps_rcvackpack++; |
2934 | tcpstat.tcps_rcvackbyte += acked; |
2935 | |
2936 | /* |
2937 | * Handle an ack that is in sequence during |
2938 | * congestion avoidance phase. The |
2939 | * calculations in this function |
2940 | * assume that snd_una is not updated yet. |
2941 | */ |
2942 | if (CC_ALGO(tp)->congestion_avd != NULL) |
2943 | CC_ALGO(tp)->congestion_avd(tp, th); |
2944 | tcp_ccdbg_trace(tp, th, TCP_CC_INSEQ_ACK_RCVD); |
2945 | sbdrop(&so->so_snd, acked); |
2946 | if (so->so_flags & SOF_ENABLE_MSGS) { |
2947 | VERIFY(acked <= so->so_msg_state->msg_serial_bytes); |
2948 | so->so_msg_state->msg_serial_bytes -= acked; |
2949 | } |
2950 | tcp_sbsnd_trim(&so->so_snd); |
2951 | |
2952 | if (SEQ_GT(tp->snd_una, tp->snd_recover) && |
2953 | SEQ_LEQ(th->th_ack, tp->snd_recover)) |
2954 | tp->snd_recover = th->th_ack - 1; |
2955 | tp->snd_una = th->th_ack; |
2956 | |
2957 | TCP_RESET_REXMT_STATE(tp); |
2958 | |
2959 | /* |
2960 | * pull snd_wl2 up to prevent seq wrap relative |
2961 | * to th_ack. |
2962 | */ |
2963 | tp->snd_wl2 = th->th_ack; |
2964 | |
2965 | if (tp->t_dupacks > 0) { |
2966 | tp->t_dupacks = 0; |
2967 | tp->t_rexmtthresh = tcprexmtthresh; |
2968 | } |
2969 | |
2970 | m_freem(m); |
2971 | |
2972 | /* |
2973 | * If all outstanding data are acked, stop |
2974 | * retransmit timer, otherwise restart timer |
2975 | * using current (possibly backed-off) value. |
2976 | * If process is waiting for space, |
2977 | * wakeup/selwakeup/signal. If data |
2978 | * are ready to send, let tcp_output |
2979 | * decide between more output or persist. |
2980 | */ |
2981 | if (tp->snd_una == tp->snd_max) { |
2982 | tp->t_timer[TCPT_REXMT] = 0; |
2983 | tp->t_timer[TCPT_PTO] = 0; |
2984 | } else if (tp->t_timer[TCPT_PERSIST] == 0) { |
2985 | tp->t_timer[TCPT_REXMT] = |
2986 | OFFSET_FROM_START(tp, |
2987 | tp->t_rxtcur); |
2988 | } |
2989 | if (!SLIST_EMPTY(&tp->t_rxt_segments) && |
2990 | !TCP_DSACK_SEQ_IN_WINDOW(tp, |
2991 | tp->t_dsack_lastuna, tp->snd_una)) |
2992 | tcp_rxtseg_clean(tp); |
2993 | |
2994 | if ((tp->t_flagsext & TF_MEASURESNDBW) != 0 && |
2995 | tp->t_bwmeas != NULL) |
2996 | tcp_bwmeas_check(tp); |
2997 | |
2998 | sowwakeup(so); /* has to be done with socket lock held */ |
2999 | if (!SLIST_EMPTY(&tp->t_notify_ack)) |
3000 | tcp_notify_acknowledgement(tp, so); |
3001 | |
3002 | if ((so->so_snd.sb_cc) || (tp->t_flags & TF_ACKNOW)) { |
3003 | (void) tcp_output(tp); |
3004 | } |
3005 | |
3006 | tcp_tfo_rcv_ack(tp, th); |
3007 | |
3008 | tcp_check_timer_state(tp); |
3009 | socket_unlock(so, 1); |
3010 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
3011 | return; |
3012 | } |
3013 | } else if (th->th_ack == tp->snd_una && |
3014 | LIST_EMPTY(&tp->t_segq) && |
3015 | tlen <= tcp_sbspace(tp)) { |
3016 | /* |
3017 | * this is a pure, in-sequence data packet |
3018 | * with nothing on the reassembly queue and |
3019 | * we have enough buffer space to take it. |
3020 | */ |
3021 | |
3022 | /* |
3023 | * If this is a connection in steady state, start |
3024 | * coalescing packets belonging to this flow. |
3025 | */ |
3026 | if (turnoff_lro) { |
3027 | tcp_lro_remove_state(tp->t_inpcb->inp_laddr, |
3028 | tp->t_inpcb->inp_faddr, |
3029 | tp->t_inpcb->inp_lport, |
3030 | tp->t_inpcb->inp_fport); |
3031 | tp->t_flagsext &= ~TF_LRO_OFFLOADED; |
3032 | tp->t_idleat = tp->rcv_nxt; |
3033 | } else if (sw_lro && !pktf_sw_lro_pkt && !isipv6 && |
3034 | (so->so_flags & SOF_USELRO) && |
3035 | !IFNET_IS_CELLULAR(m->m_pkthdr.rcvif) && |
3036 | (m->m_pkthdr.rcvif->if_type != IFT_LOOP) && |
3037 | ((th->th_seq - tp->irs) > |
3038 | (tp->t_maxseg << lro_start)) && |
3039 | ((tp->t_idleat == 0) || ((th->th_seq - |
3040 | tp->t_idleat) > (tp->t_maxseg << lro_start)))) { |
3041 | tp->t_flagsext |= TF_LRO_OFFLOADED; |
3042 | tcp_start_coalescing(ip, th, tlen); |
3043 | tp->t_idleat = 0; |
3044 | } |
3045 | |
3046 | /* Clean receiver SACK report if present */ |
3047 | if (SACK_ENABLED(tp) && tp->rcv_numsacks) |
3048 | tcp_clean_sackreport(tp); |
3049 | ++tcpstat.tcps_preddat; |
3050 | tp->rcv_nxt += tlen; |
3051 | /* |
3052 | * Pull snd_wl1 up to prevent seq wrap relative to |
3053 | * th_seq. |
3054 | */ |
3055 | tp->snd_wl1 = th->th_seq; |
3056 | /* |
3057 | * Pull rcv_up up to prevent seq wrap relative to |
3058 | * rcv_nxt. |
3059 | */ |
3060 | tp->rcv_up = tp->rcv_nxt; |
3061 | TCP_INC_VAR(tcpstat.tcps_rcvpack, nlropkts); |
3062 | tcpstat.tcps_rcvbyte += tlen; |
3063 | if (nstat_collect) { |
3064 | if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) { |
3065 | INP_ADD_STAT(inp, cell, wifi, wired, |
3066 | rxpackets, m->m_pkthdr.lro_npkts); |
3067 | } else { |
3068 | INP_ADD_STAT(inp, cell, wifi, wired, |
3069 | rxpackets, 1); |
3070 | } |
3071 | INP_ADD_STAT(inp, cell, wifi, wired,rxbytes, |
3072 | tlen); |
3073 | inp_set_activity_bitmap(inp); |
3074 | } |
3075 | |
3076 | /* |
3077 | * Calculate the RTT on the receiver only if the |
3078 | * connection is in streaming mode and the last |
3079 | * packet was not an end-of-write |
3080 | */ |
3081 | if (tp->t_flags & TF_STREAMING_ON) |
3082 | tcp_compute_rtt(tp, &to, th); |
3083 | |
3084 | tcp_sbrcv_grow(tp, &so->so_rcv, &to, tlen, |
3085 | TCP_AUTORCVBUF_MAX(ifp)); |
3086 | |
3087 | /* |
3088 | * Add data to socket buffer. |
3089 | */ |
3090 | so_recv_data_stat(so, m, 0); |
3091 | m_adj(m, drop_hdrlen); /* delayed header drop */ |
3092 | |
3093 | /* |
3094 | * If message delivery (SOF_ENABLE_MSGS) is enabled on |
3095 | * this socket, deliver the packet received as an |
3096 | * in-order message with sequence number attached to it. |
3097 | */ |
3098 | if (sbappendstream_rcvdemux(so, m, |
3099 | th->th_seq - (tp->irs + 1), 0)) { |
3100 | sorwakeup(so); |
3101 | } |
3102 | #if INET6 |
3103 | if (isipv6) { |
3104 | KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport), |
3105 | (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])), |
3106 | th->th_seq, th->th_ack, th->th_win); |
3107 | } |
3108 | else |
3109 | #endif |
3110 | { |
3111 | KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport), |
3112 | (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)), |
3113 | th->th_seq, th->th_ack, th->th_win); |
3114 | } |
3115 | TCP_INC_VAR(tp->t_unacksegs, nlropkts); |
3116 | if (DELAY_ACK(tp, th)) { |
3117 | if ((tp->t_flags & TF_DELACK) == 0) { |
3118 | tp->t_flags |= TF_DELACK; |
3119 | tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack); |
3120 | } |
3121 | } else { |
3122 | tp->t_flags |= TF_ACKNOW; |
3123 | tcp_output(tp); |
3124 | } |
3125 | |
3126 | tcp_adaptive_rwtimo_check(tp, tlen); |
3127 | |
3128 | if (tlen > 0) |
3129 | tcp_tfo_rcv_data(tp); |
3130 | |
3131 | tcp_check_timer_state(tp); |
3132 | socket_unlock(so, 1); |
3133 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
3134 | return; |
3135 | } |
3136 | } |
3137 | |
3138 | /* |
3139 | * Calculate amount of space in receive window, |
3140 | * and then do TCP input processing. |
3141 | * Receive window is amount of space in rcv queue, |
3142 | * but not less than advertised window. |
3143 | */ |
3144 | socket_lock_assert_owned(so); |
3145 | win = tcp_sbspace(tp); |
3146 | if (win < 0) |
3147 | win = 0; |
3148 | else { /* clip rcv window to 4K for modems */ |
3149 | if (tp->t_flags & TF_SLOWLINK && slowlink_wsize > 0) |
3150 | win = min(win, slowlink_wsize); |
3151 | } |
3152 | tp->rcv_wnd = imax(win, (int)(tp->rcv_adv - tp->rcv_nxt)); |
3153 | #if MPTCP |
3154 | /* |
3155 | * Ensure that the subflow receive window isn't greater |
3156 | * than the connection level receive window. |
3157 | */ |
3158 | if ((tp->t_mpflags & TMPF_MPTCP_TRUE) && |
3159 | (mp_tp = tptomptp(tp))) { |
3160 | mpte_lock_assert_held(mp_tp->mpt_mpte); |
3161 | if (tp->rcv_wnd > mp_tp->mpt_rcvwnd) { |
3162 | tp->rcv_wnd = imax(mp_tp->mpt_rcvwnd, (int)(tp->rcv_adv - tp->rcv_nxt)); |
3163 | tcpstat.tcps_mp_reducedwin++; |
3164 | } |
3165 | } |
3166 | #endif /* MPTCP */ |
3167 | |
3168 | switch (tp->t_state) { |
3169 | |
3170 | /* |
3171 | * Initialize tp->rcv_nxt, and tp->irs, select an initial |
3172 | * tp->iss, and send a segment: |
3173 | * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> |
3174 | * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss. |
3175 | * Fill in remote peer address fields if not previously specified. |
3176 | * Enter SYN_RECEIVED state, and process any other fields of this |
3177 | * segment in this state. |
3178 | */ |
3179 | case TCPS_LISTEN: { |
3180 | struct sockaddr_in *sin; |
3181 | #if INET6 |
3182 | struct sockaddr_in6 *sin6; |
3183 | #endif |
3184 | |
3185 | socket_lock_assert_owned(so); |
3186 | #if INET6 |
3187 | if (isipv6) { |
3188 | MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6, |
3189 | M_SONAME, M_NOWAIT); |
3190 | if (sin6 == NULL) |
3191 | goto drop; |
3192 | bzero(sin6, sizeof(*sin6)); |
3193 | sin6->sin6_family = AF_INET6; |
3194 | sin6->sin6_len = sizeof(*sin6); |
3195 | sin6->sin6_addr = ip6->ip6_src; |
3196 | sin6->sin6_port = th->th_sport; |
3197 | laddr6 = inp->in6p_laddr; |
3198 | if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr)) |
3199 | inp->in6p_laddr = ip6->ip6_dst; |
3200 | if (in6_pcbconnect(inp, (struct sockaddr *)sin6, |
3201 | proc0)) { |
3202 | inp->in6p_laddr = laddr6; |
3203 | FREE(sin6, M_SONAME); |
3204 | goto drop; |
3205 | } |
3206 | FREE(sin6, M_SONAME); |
3207 | } else |
3208 | #endif |
3209 | { |
3210 | socket_lock_assert_owned(so); |
3211 | MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME, |
3212 | M_NOWAIT); |
3213 | if (sin == NULL) |
3214 | goto drop; |
3215 | sin->sin_family = AF_INET; |
3216 | sin->sin_len = sizeof(*sin); |
3217 | sin->sin_addr = ip->ip_src; |
3218 | sin->sin_port = th->th_sport; |
3219 | bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero)); |
3220 | laddr = inp->inp_laddr; |
3221 | if (inp->inp_laddr.s_addr == INADDR_ANY) |
3222 | inp->inp_laddr = ip->ip_dst; |
3223 | if (in_pcbconnect(inp, (struct sockaddr *)sin, proc0, |
3224 | IFSCOPE_NONE, NULL)) { |
3225 | inp->inp_laddr = laddr; |
3226 | FREE(sin, M_SONAME); |
3227 | goto drop; |
3228 | } |
3229 | FREE(sin, M_SONAME); |
3230 | } |
3231 | |
3232 | tcp_dooptions(tp, optp, optlen, th, &to); |
3233 | tcp_finalize_options(tp, &to, ifscope); |
3234 | |
3235 | if (tfo_enabled(tp) && tcp_tfo_syn(tp, &to)) |
3236 | isconnected = TRUE; |
3237 | |
3238 | if (iss) |
3239 | tp->iss = iss; |
3240 | else { |
3241 | tp->iss = tcp_new_isn(tp); |
3242 | } |
3243 | tp->irs = th->th_seq; |
3244 | tcp_sendseqinit(tp); |
3245 | tcp_rcvseqinit(tp); |
3246 | tp->snd_recover = tp->snd_una; |
3247 | /* |
3248 | * Initialization of the tcpcb for transaction; |
3249 | * set SND.WND = SEG.WND, |
3250 | * initialize CCsend and CCrecv. |
3251 | */ |
3252 | tp->snd_wnd = tiwin; /* initial send-window */ |
3253 | tp->max_sndwnd = tp->snd_wnd; |
3254 | tp->t_flags |= TF_ACKNOW; |
3255 | tp->t_unacksegs = 0; |
3256 | DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp, |
3257 | struct tcpcb *, tp, int32_t, TCPS_SYN_RECEIVED); |
3258 | tp->t_state = TCPS_SYN_RECEIVED; |
3259 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, |
3260 | TCP_CONN_KEEPINIT(tp)); |
3261 | dropsocket = 0; /* committed to socket */ |
3262 | |
3263 | if (inp->inp_flowhash == 0) |
3264 | inp->inp_flowhash = inp_calc_flowhash(inp); |
3265 | #if INET6 |
3266 | /* update flowinfo - RFC 6437 */ |
3267 | if (inp->inp_flow == 0 && |
3268 | inp->in6p_flags & IN6P_AUTOFLOWLABEL) { |
3269 | inp->inp_flow &= ~IPV6_FLOWLABEL_MASK; |
3270 | inp->inp_flow |= |
3271 | (htonl(inp->inp_flowhash) & IPV6_FLOWLABEL_MASK); |
3272 | } |
3273 | #endif /* INET6 */ |
3274 | |
3275 | /* reset the incomp processing flag */ |
3276 | so->so_flags &= ~(SOF_INCOMP_INPROGRESS); |
3277 | tcpstat.tcps_accepts++; |
3278 | if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE | TH_CWR)) { |
3279 | /* ECN-setup SYN */ |
3280 | tp->ecn_flags |= (TE_SETUPRECEIVED | TE_SENDIPECT); |
3281 | } |
3282 | |
3283 | goto trimthenstep6; |
3284 | } |
3285 | |
3286 | /* |
3287 | * If the state is SYN_RECEIVED and the seg contains an ACK, |
3288 | * but not for our SYN/ACK, send a RST. |
3289 | */ |
3290 | case TCPS_SYN_RECEIVED: |
3291 | if ((thflags & TH_ACK) && |
3292 | (SEQ_LEQ(th->th_ack, tp->snd_una) || |
3293 | SEQ_GT(th->th_ack, tp->snd_max))) { |
3294 | rstreason = BANDLIM_RST_OPENPORT; |
3295 | IF_TCP_STATINC(ifp, ooopacket); |
3296 | goto dropwithreset; |
3297 | } |
3298 | |
3299 | /* |
3300 | * In SYN_RECEIVED state, if we recv some SYNS with |
3301 | * window scale and others without, window scaling should |
3302 | * be disabled. Otherwise the window advertised will be |
3303 | * lower if we assume scaling and the other end does not. |
3304 | */ |
3305 | if ((thflags & TH_SYN) && |
3306 | (tp->irs == th->th_seq) && |
3307 | !(to.to_flags & TOF_SCALE)) |
3308 | tp->t_flags &= ~TF_RCVD_SCALE; |
3309 | break; |
3310 | |
3311 | /* |
3312 | * If the state is SYN_SENT: |
3313 | * if seg contains an ACK, but not for our SYN, drop the input. |
3314 | * if seg contains a RST, then drop the connection. |
3315 | * if seg does not contain SYN, then drop it. |
3316 | * Otherwise this is an acceptable SYN segment |
3317 | * initialize tp->rcv_nxt and tp->irs |
3318 | * if seg contains ack then advance tp->snd_una |
3319 | * if SYN has been acked change to ESTABLISHED else SYN_RCVD state |
3320 | * arrange for segment to be acked (eventually) |
3321 | * continue processing rest of data/controls, beginning with URG |
3322 | */ |
3323 | case TCPS_SYN_SENT: |
3324 | if ((thflags & TH_ACK) && |
3325 | (SEQ_LEQ(th->th_ack, tp->iss) || |
3326 | SEQ_GT(th->th_ack, tp->snd_max))) { |
3327 | rstreason = BANDLIM_UNLIMITED; |
3328 | IF_TCP_STATINC(ifp, ooopacket); |
3329 | goto dropwithreset; |
3330 | } |
3331 | if (thflags & TH_RST) { |
3332 | if ((thflags & TH_ACK) != 0) { |
3333 | if (tfo_enabled(tp)) |
3334 | tcp_heuristic_tfo_rst(tp); |
3335 | if ((tp->ecn_flags & (TE_SETUPSENT | TE_RCVD_SYN_RST)) == TE_SETUPSENT) { |
3336 | /* |
3337 | * On local connections, send |
3338 | * non-ECN syn one time before |
3339 | * dropping the connection |
3340 | */ |
3341 | if (tp->t_flags & TF_LOCAL) { |
3342 | tp->ecn_flags |= TE_RCVD_SYN_RST; |
3343 | goto drop; |
3344 | } else { |
3345 | tcp_heuristic_ecn_synrst(tp); |
3346 | } |
3347 | } |
3348 | soevent(so, |
3349 | (SO_FILT_HINT_LOCKED | |
3350 | SO_FILT_HINT_CONNRESET)); |
3351 | tp = tcp_drop(tp, ECONNREFUSED); |
3352 | postevent(so, 0, EV_RESET); |
3353 | } |
3354 | goto drop; |
3355 | } |
3356 | if ((thflags & TH_SYN) == 0) |
3357 | goto drop; |
3358 | tp->snd_wnd = th->th_win; /* initial send window */ |
3359 | tp->max_sndwnd = tp->snd_wnd; |
3360 | |
3361 | tp->irs = th->th_seq; |
3362 | tcp_rcvseqinit(tp); |
3363 | if (thflags & TH_ACK) { |
3364 | tcpstat.tcps_connects++; |
3365 | |
3366 | if ((thflags & (TH_ECE | TH_CWR)) == (TH_ECE)) { |
3367 | /* ECN-setup SYN-ACK */ |
3368 | tp->ecn_flags |= TE_SETUPRECEIVED; |
3369 | if (TCP_ECN_ENABLED(tp)) { |
3370 | tcp_heuristic_ecn_success(tp); |
3371 | tcpstat.tcps_ecn_client_success++; |
3372 | } |
3373 | } else { |
3374 | if (tp->ecn_flags & TE_SETUPSENT && |
3375 | tp->t_rxtshift == 0) { |
3376 | tcp_heuristic_ecn_success(tp); |
3377 | tcpstat.tcps_ecn_not_supported++; |
3378 | } |
3379 | if (tp->ecn_flags & TE_SETUPSENT && |
3380 | tp->t_rxtshift > 0) |
3381 | tcp_heuristic_ecn_loss(tp); |
3382 | |
3383 | /* non-ECN-setup SYN-ACK */ |
3384 | tp->ecn_flags &= ~TE_SENDIPECT; |
3385 | } |
3386 | |
3387 | #if CONFIG_MACF_NET && CONFIG_MACF_SOCKET |
3388 | /* XXXMAC: recursive lock: SOCK_LOCK(so); */ |
3389 | mac_socketpeer_label_associate_mbuf(m, so); |
3390 | /* XXXMAC: SOCK_UNLOCK(so); */ |
3391 | #endif |
3392 | /* Do window scaling on this connection? */ |
3393 | if (TCP_WINDOW_SCALE_ENABLED(tp)) { |
3394 | tp->snd_scale = tp->requested_s_scale; |
3395 | tp->rcv_scale = tp->request_r_scale; |
3396 | } |
3397 | |
3398 | tp->rcv_adv += min(tp->rcv_wnd, TCP_MAXWIN << tp->rcv_scale); |
3399 | tp->snd_una++; /* SYN is acked */ |
3400 | if (SEQ_LT(tp->snd_nxt, tp->snd_una)) |
3401 | tp->snd_nxt = tp->snd_una; |
3402 | |
3403 | /* |
3404 | * We have sent more in the SYN than what is being |
3405 | * acked. (e.g., TFO) |
3406 | * We should restart the sending from what the receiver |
3407 | * has acknowledged immediately. |
3408 | */ |
3409 | if (SEQ_GT(tp->snd_nxt, th->th_ack)) { |
3410 | /* |
3411 | * rdar://problem/33214601 |
3412 | * There is a middlebox that acks all but one |
3413 | * byte and still drops the data. |
3414 | */ |
3415 | if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) && |
3416 | tp->snd_max == th->th_ack + 1 && |
3417 | tp->snd_max > tp->snd_una + 1) { |
3418 | tcp_heuristic_tfo_middlebox(tp); |
3419 | |
3420 | so->so_error = ENODATA; |
3421 | |
3422 | tp->t_tfo_stats |= TFO_S_ONE_BYTE_PROXY; |
3423 | } |
3424 | |
3425 | tp->snd_max = tp->snd_nxt = th->th_ack; |
3426 | } |
3427 | |
3428 | /* |
3429 | * If there's data, delay ACK; if there's also a FIN |
3430 | * ACKNOW will be turned on later. |
3431 | */ |
3432 | TCP_INC_VAR(tp->t_unacksegs, nlropkts); |
3433 | if (DELAY_ACK(tp, th) && tlen != 0 ) { |
3434 | if ((tp->t_flags & TF_DELACK) == 0) { |
3435 | tp->t_flags |= TF_DELACK; |
3436 | tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack); |
3437 | } |
3438 | } |
3439 | else { |
3440 | tp->t_flags |= TF_ACKNOW; |
3441 | } |
3442 | /* |
3443 | * Received <SYN,ACK> in SYN_SENT[*] state. |
3444 | * Transitions: |
3445 | * SYN_SENT --> ESTABLISHED |
3446 | * SYN_SENT* --> FIN_WAIT_1 |
3447 | */ |
3448 | tp->t_starttime = tcp_now; |
3449 | tcp_sbrcv_tstmp_check(tp); |
3450 | if (tp->t_flags & TF_NEEDFIN) { |
3451 | DTRACE_TCP4(state__change, void, NULL, |
3452 | struct inpcb *, inp, |
3453 | struct tcpcb *, tp, int32_t, |
3454 | TCPS_FIN_WAIT_1); |
3455 | tp->t_state = TCPS_FIN_WAIT_1; |
3456 | tp->t_flags &= ~TF_NEEDFIN; |
3457 | thflags &= ~TH_SYN; |
3458 | } else { |
3459 | DTRACE_TCP4(state__change, void, NULL, |
3460 | struct inpcb *, inp, struct tcpcb *, |
3461 | tp, int32_t, TCPS_ESTABLISHED); |
3462 | tp->t_state = TCPS_ESTABLISHED; |
3463 | tp->t_timer[TCPT_KEEP] = |
3464 | OFFSET_FROM_START(tp, |
3465 | TCP_CONN_KEEPIDLE(tp)); |
3466 | if (nstat_collect) |
3467 | nstat_route_connect_success( |
3468 | inp->inp_route.ro_rt); |
3469 | /* |
3470 | * The SYN is acknowledged but una is not |
3471 | * updated yet. So pass the value of |
3472 | * ack to compute sndbytes correctly |
3473 | */ |
3474 | inp_count_sndbytes(inp, th->th_ack); |
3475 | } |
3476 | #if MPTCP |
3477 | /* |
3478 | * Do not send the connect notification for additional |
3479 | * subflows until ACK for 3-way handshake arrives. |
3480 | */ |
3481 | if ((!(tp->t_mpflags & TMPF_MPTCP_TRUE)) && |
3482 | (tp->t_mpflags & TMPF_SENT_JOIN)) { |
3483 | isconnected = FALSE; |
3484 | } else |
3485 | #endif /* MPTCP */ |
3486 | isconnected = TRUE; |
3487 | |
3488 | if ((tp->t_tfo_flags & (TFO_F_COOKIE_REQ | TFO_F_COOKIE_SENT)) || |
3489 | (tp->t_tfo_stats & TFO_S_SYN_DATA_SENT)) { |
3490 | tcp_tfo_synack(tp, &to); |
3491 | |
3492 | if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) && |
3493 | SEQ_LT(tp->snd_una, th->th_ack)) { |
3494 | tp->t_tfo_stats |= TFO_S_SYN_DATA_ACKED; |
3495 | tcpstat.tcps_tfo_syn_data_acked++; |
3496 | #if MPTCP |
3497 | if (so->so_flags & SOF_MP_SUBFLOW) |
3498 | so->so_flags1 |= SOF1_TFO_REWIND; |
3499 | #endif |
3500 | tcp_tfo_rcv_probe(tp, tlen); |
3501 | } |
3502 | } |
3503 | } else { |
3504 | /* |
3505 | * Received initial SYN in SYN-SENT[*] state => simul- |
3506 | * taneous open. If segment contains CC option and there is |
3507 | * a cached CC, apply TAO test; if it succeeds, connection is |
3508 | * half-synchronized. Otherwise, do 3-way handshake: |
3509 | * SYN-SENT -> SYN-RECEIVED |
3510 | * SYN-SENT* -> SYN-RECEIVED* |
3511 | */ |
3512 | tp->t_flags |= TF_ACKNOW; |
3513 | tp->t_timer[TCPT_REXMT] = 0; |
3514 | DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp, |
3515 | struct tcpcb *, tp, int32_t, TCPS_SYN_RECEIVED); |
3516 | tp->t_state = TCPS_SYN_RECEIVED; |
3517 | |
3518 | /* |
3519 | * During simultaneous open, TFO should not be used. |
3520 | * So, we disable it here, to prevent that data gets |
3521 | * sent on the SYN/ACK. |
3522 | */ |
3523 | tcp_disable_tfo(tp); |
3524 | } |
3525 | |
3526 | trimthenstep6: |
3527 | /* |
3528 | * Advance th->th_seq to correspond to first data byte. |
3529 | * If data, trim to stay within window, |
3530 | * dropping FIN if necessary. |
3531 | */ |
3532 | th->th_seq++; |
3533 | if (tlen > tp->rcv_wnd) { |
3534 | todrop = tlen - tp->rcv_wnd; |
3535 | m_adj(m, -todrop); |
3536 | tlen = tp->rcv_wnd; |
3537 | thflags &= ~TH_FIN; |
3538 | tcpstat.tcps_rcvpackafterwin++; |
3539 | tcpstat.tcps_rcvbyteafterwin += todrop; |
3540 | } |
3541 | tp->snd_wl1 = th->th_seq - 1; |
3542 | tp->rcv_up = th->th_seq; |
3543 | /* |
3544 | * Client side of transaction: already sent SYN and data. |
3545 | * If the remote host used T/TCP to validate the SYN, |
3546 | * our data will be ACK'd; if so, enter normal data segment |
3547 | * processing in the middle of step 5, ack processing. |
3548 | * Otherwise, goto step 6. |
3549 | */ |
3550 | if (thflags & TH_ACK) |
3551 | goto process_ACK; |
3552 | goto step6; |
3553 | /* |
3554 | * If the state is LAST_ACK or CLOSING or TIME_WAIT: |
3555 | * do normal processing. |
3556 | * |
3557 | * NB: Leftover from RFC1644 T/TCP. Cases to be reused later. |
3558 | */ |
3559 | case TCPS_LAST_ACK: |
3560 | case TCPS_CLOSING: |
3561 | case TCPS_TIME_WAIT: |
3562 | break; /* continue normal processing */ |
3563 | |
3564 | /* Received a SYN while connection is already established. |
3565 | * This is a "half open connection and other anomalies" described |
3566 | * in RFC793 page 34, send an ACK so the remote reset the connection |
3567 | * or recovers by adjusting its sequence numbering. Sending an ACK is |
3568 | * in accordance with RFC 5961 Section 4.2 |
3569 | */ |
3570 | case TCPS_ESTABLISHED: |
3571 | if (thflags & TH_SYN) { |
3572 | /* Drop the packet silently if we have reached the limit */ |
3573 | if (tcp_do_rfc5961 && tcp_is_ack_ratelimited(tp)) { |
3574 | goto drop; |
3575 | } else { |
3576 | /* Send challenge ACK */ |
3577 | tcpstat.tcps_synchallenge++; |
3578 | goto dropafterack; |
3579 | } |
3580 | } |
3581 | break; |
3582 | } |
3583 | |
3584 | /* |
3585 | * States other than LISTEN or SYN_SENT. |
3586 | * First check the RST flag and sequence number since reset segments |
3587 | * are exempt from the timestamp and connection count tests. This |
3588 | * fixes a bug introduced by the Stevens, vol. 2, p. 960 bugfix |
3589 | * below which allowed reset segments in half the sequence space |
3590 | * to fall though and be processed (which gives forged reset |
3591 | * segments with a random sequence number a 50 percent chance of |
3592 | * killing a connection). |
3593 | * Then check timestamp, if present. |
3594 | * Then check the connection count, if present. |
3595 | * Then check that at least some bytes of segment are within |
3596 | * receive window. If segment begins before rcv_nxt, |
3597 | * drop leading data (and SYN); if nothing left, just ack. |
3598 | * |
3599 | * |
3600 | * If the RST bit is set, check the sequence number to see |
3601 | * if this is a valid reset segment. |
3602 | * RFC 793 page 37: |
3603 | * In all states except SYN-SENT, all reset (RST) segments |
3604 | * are validated by checking their SEQ-fields. A reset is |
3605 | * valid if its sequence number is in the window. |
3606 | * Note: this does not take into account delayed ACKs, so |
3607 | * we should test against last_ack_sent instead of rcv_nxt. |
3608 | * The sequence number in the reset segment is normally an |
3609 | * echo of our outgoing acknowlegement numbers, but some hosts |
3610 | * send a reset with the sequence number at the rightmost edge |
3611 | * of our receive window, and we have to handle this case. |
3612 | * Note 2: Paul Watson's paper "Slipping in the Window" has shown |
3613 | * that brute force RST attacks are possible. To combat this, |
3614 | * we use a much stricter check while in the ESTABLISHED state, |
3615 | * only accepting RSTs where the sequence number is equal to |
3616 | * last_ack_sent. In all other states (the states in which a |
3617 | * RST is more likely), the more permissive check is used. |
3618 | * RFC 5961 Section 3.2: if the RST bit is set, sequence # is |
3619 | * within the receive window and last_ack_sent == seq, |
3620 | * then reset the connection. Otherwise if the seq doesn't |
3621 | * match last_ack_sent, TCP must send challenge ACK. Perform |
3622 | * rate limitation when sending the challenge ACK. |
3623 | * If we have multiple segments in flight, the intial reset |
3624 | * segment sequence numbers will be to the left of last_ack_sent, |
3625 | * but they will eventually catch up. |
3626 | * In any case, it never made sense to trim reset segments to |
3627 | * fit the receive window since RFC 1122 says: |
3628 | * 4.2.2.12 RST Segment: RFC-793 Section 3.4 |
3629 | * |
3630 | * A TCP SHOULD allow a received RST segment to include data. |
3631 | * |
3632 | * DISCUSSION |
3633 | * It has been suggested that a RST segment could contain |
3634 | * ASCII text that encoded and explained the cause of the |
3635 | * RST. No standard has yet been established for such |
3636 | * data. |
3637 | * |
3638 | * If the reset segment passes the sequence number test examine |
3639 | * the state: |
3640 | * SYN_RECEIVED STATE: |
3641 | * If passive open, return to LISTEN state. |
3642 | * If active open, inform user that connection was refused. |
3643 | * ESTABLISHED, FIN_WAIT_1, FIN_WAIT_2, CLOSE_WAIT STATES: |
3644 | * Inform user that connection was reset, and close tcb. |
3645 | * CLOSING, LAST_ACK STATES: |
3646 | * Close the tcb. |
3647 | * TIME_WAIT STATE: |
3648 | * Drop the segment - see Stevens, vol. 2, p. 964 and |
3649 | * RFC 1337. |
3650 | * |
3651 | * Radar 4803931: Allows for the case where we ACKed the FIN but |
3652 | * there is already a RST in flight from the peer. |
3653 | * In that case, accept the RST for non-established |
3654 | * state if it's one off from last_ack_sent. |
3655 | |
3656 | */ |
3657 | if (thflags & TH_RST) { |
3658 | if ((SEQ_GEQ(th->th_seq, tp->last_ack_sent) && |
3659 | SEQ_LT(th->th_seq, tp->last_ack_sent + tp->rcv_wnd)) || |
3660 | (tp->rcv_wnd == 0 && |
3661 | ((tp->last_ack_sent == th->th_seq) || |
3662 | ((tp->last_ack_sent -1) == th->th_seq)))) { |
3663 | if (tcp_do_rfc5961 == 0 || tp->last_ack_sent == th->th_seq) { |
3664 | switch (tp->t_state) { |
3665 | |
3666 | case TCPS_SYN_RECEIVED: |
3667 | IF_TCP_STATINC(ifp, rstinsynrcv); |
3668 | so->so_error = ECONNREFUSED; |
3669 | goto close; |
3670 | |
3671 | case TCPS_ESTABLISHED: |
3672 | if (tcp_do_rfc5961 == 0 && tp->last_ack_sent != th->th_seq) { |
3673 | tcpstat.tcps_badrst++; |
3674 | goto drop; |
3675 | } |
3676 | if (TCP_ECN_ENABLED(tp) && |
3677 | tp->snd_una == tp->iss + 1 && |
3678 | SEQ_GT(tp->snd_max, tp->snd_una)) { |
3679 | /* |
3680 | * If the first data packet on an |
3681 | * ECN connection, receives a RST |
3682 | * increment the heuristic |
3683 | */ |
3684 | tcp_heuristic_ecn_droprst(tp); |
3685 | } |
3686 | case TCPS_FIN_WAIT_1: |
3687 | case TCPS_CLOSE_WAIT: |
3688 | /* |
3689 | Drop through ... |
3690 | */ |
3691 | case TCPS_FIN_WAIT_2: |
3692 | so->so_error = ECONNRESET; |
3693 | close: |
3694 | postevent(so, 0, EV_RESET); |
3695 | soevent(so, |
3696 | (SO_FILT_HINT_LOCKED | |
3697 | SO_FILT_HINT_CONNRESET)); |
3698 | |
3699 | tcpstat.tcps_drops++; |
3700 | tp = tcp_close(tp); |
3701 | break; |
3702 | |
3703 | case TCPS_CLOSING: |
3704 | case TCPS_LAST_ACK: |
3705 | tp = tcp_close(tp); |
3706 | break; |
3707 | |
3708 | case TCPS_TIME_WAIT: |
3709 | break; |
3710 | } |
3711 | } else if (tcp_do_rfc5961) { |
3712 | tcpstat.tcps_badrst++; |
3713 | /* Drop if we have reached the ACK limit */ |
3714 | if (tcp_is_ack_ratelimited(tp)) { |
3715 | goto drop; |
3716 | } else { |
3717 | /* Send challenge ACK */ |
3718 | tcpstat.tcps_rstchallenge++; |
3719 | goto dropafterack; |
3720 | } |
3721 | } |
3722 | } |
3723 | goto drop; |
3724 | } |
3725 | |
3726 | /* |
3727 | * RFC 1323 PAWS: If we have a timestamp reply on this segment |
3728 | * and it's less than ts_recent, drop it. |
3729 | */ |
3730 | if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent && |
3731 | TSTMP_LT(to.to_tsval, tp->ts_recent)) { |
3732 | |
3733 | /* Check to see if ts_recent is over 24 days old. */ |
3734 | if ((int)(tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { |
3735 | /* |
3736 | * Invalidate ts_recent. If this segment updates |
3737 | * ts_recent, the age will be reset later and ts_recent |
3738 | * will get a valid value. If it does not, setting |
3739 | * ts_recent to zero will at least satisfy the |
3740 | * requirement that zero be placed in the timestamp |
3741 | * echo reply when ts_recent isn't valid. The |
3742 | * age isn't reset until we get a valid ts_recent |
3743 | * because we don't want out-of-order segments to be |
3744 | * dropped when ts_recent is old. |
3745 | */ |
3746 | tp->ts_recent = 0; |
3747 | } else { |
3748 | tcpstat.tcps_rcvduppack++; |
3749 | tcpstat.tcps_rcvdupbyte += tlen; |
3750 | tp->t_pawsdrop++; |
3751 | tcpstat.tcps_pawsdrop++; |
3752 | |
3753 | /* |
3754 | * PAWS-drop when ECN is being used? That indicates |
3755 | * that ECT-marked packets take a different path, with |
3756 | * different congestion-characteristics. |
3757 | * |
3758 | * Only fallback when we did send less than 2GB as PAWS |
3759 | * really has no reason to kick in earlier. |
3760 | */ |
3761 | if (TCP_ECN_ENABLED(tp) && |
3762 | inp->inp_stat->rxbytes < 2147483648) { |
3763 | INP_INC_IFNET_STAT(inp, ecn_fallback_reorder); |
3764 | tcpstat.tcps_ecn_fallback_reorder++; |
3765 | tcp_heuristic_ecn_aggressive(tp); |
3766 | } |
3767 | |
3768 | if (nstat_collect) { |
3769 | nstat_route_rx(tp->t_inpcb->inp_route.ro_rt, |
3770 | 1, tlen, NSTAT_RX_FLAG_DUPLICATE); |
3771 | INP_ADD_STAT(inp, cell, wifi, wired, |
3772 | rxpackets, 1); |
3773 | INP_ADD_STAT(inp, cell, wifi, wired, |
3774 | rxbytes, tlen); |
3775 | tp->t_stat.rxduplicatebytes += tlen; |
3776 | inp_set_activity_bitmap(inp); |
3777 | } |
3778 | if (tlen > 0) |
3779 | goto dropafterack; |
3780 | goto drop; |
3781 | } |
3782 | } |
3783 | |
3784 | /* |
3785 | * In the SYN-RECEIVED state, validate that the packet belongs to |
3786 | * this connection before trimming the data to fit the receive |
3787 | * window. Check the sequence number versus IRS since we know |
3788 | * the sequence numbers haven't wrapped. This is a partial fix |
3789 | * for the "LAND" DoS attack. |
3790 | */ |
3791 | if (tp->t_state == TCPS_SYN_RECEIVED && SEQ_LT(th->th_seq, tp->irs)) { |
3792 | rstreason = BANDLIM_RST_OPENPORT; |
3793 | IF_TCP_STATINC(ifp, dospacket); |
3794 | goto dropwithreset; |
3795 | } |
3796 | |
3797 | /* |
3798 | * Check if there is old data at the beginning of the window |
3799 | * i.e. the sequence number is before rcv_nxt |
3800 | */ |
3801 | todrop = tp->rcv_nxt - th->th_seq; |
3802 | if (todrop > 0) { |
3803 | boolean_t is_syn_set = FALSE; |
3804 | |
3805 | if (thflags & TH_SYN) { |
3806 | is_syn_set = TRUE; |
3807 | thflags &= ~TH_SYN; |
3808 | th->th_seq++; |
3809 | if (th->th_urp > 1) |
3810 | th->th_urp--; |
3811 | else |
3812 | thflags &= ~TH_URG; |
3813 | todrop--; |
3814 | } |
3815 | /* |
3816 | * Following if statement from Stevens, vol. 2, p. 960. |
3817 | * The amount of duplicate data is greater than or equal |
3818 | * to the size of the segment - entire segment is duplicate |
3819 | */ |
3820 | if (todrop > tlen |
3821 | || (todrop == tlen && (thflags & TH_FIN) == 0)) { |
3822 | /* |
3823 | * Any valid FIN must be to the left of the window. |
3824 | * At this point the FIN must be a duplicate or out |
3825 | * of sequence; drop it. |
3826 | */ |
3827 | thflags &= ~TH_FIN; |
3828 | |
3829 | /* |
3830 | * Send an ACK to resynchronize and drop any data. |
3831 | * But keep on processing for RST or ACK. |
3832 | * |
3833 | * If the SYN bit was originally set, then only send |
3834 | * an ACK if we are not rate-limiting this connection. |
3835 | */ |
3836 | if (tcp_do_rfc5961 && is_syn_set) { |
3837 | if (!tcp_is_ack_ratelimited(tp)) { |
3838 | tcpstat.tcps_synchallenge++; |
3839 | tp->t_flags |= TF_ACKNOW; |
3840 | } |
3841 | } else { |
3842 | tp->t_flags |= TF_ACKNOW; |
3843 | } |
3844 | |
3845 | if (todrop == 1) { |
3846 | /* This could be a keepalive */ |
3847 | soevent(so, SO_FILT_HINT_LOCKED | |
3848 | SO_FILT_HINT_KEEPALIVE); |
3849 | } |
3850 | todrop = tlen; |
3851 | tcpstat.tcps_rcvduppack++; |
3852 | tcpstat.tcps_rcvdupbyte += todrop; |
3853 | } else { |
3854 | tcpstat.tcps_rcvpartduppack++; |
3855 | tcpstat.tcps_rcvpartdupbyte += todrop; |
3856 | } |
3857 | |
3858 | if (TCP_DSACK_ENABLED(tp) && todrop > 1) { |
3859 | /* |
3860 | * Note the duplicate data sequence space so that |
3861 | * it can be reported in DSACK option. |
3862 | */ |
3863 | tp->t_dsack_lseq = th->th_seq; |
3864 | tp->t_dsack_rseq = th->th_seq + todrop; |
3865 | tp->t_flags |= TF_ACKNOW; |
3866 | } |
3867 | if (nstat_collect) { |
3868 | nstat_route_rx(tp->t_inpcb->inp_route.ro_rt, 1, |
3869 | todrop, NSTAT_RX_FLAG_DUPLICATE); |
3870 | INP_ADD_STAT(inp, cell, wifi, wired, rxpackets, 1); |
3871 | INP_ADD_STAT(inp, cell, wifi, wired, rxbytes, todrop); |
3872 | tp->t_stat.rxduplicatebytes += todrop; |
3873 | inp_set_activity_bitmap(inp); |
3874 | } |
3875 | drop_hdrlen += todrop; /* drop from the top afterwards */ |
3876 | th->th_seq += todrop; |
3877 | tlen -= todrop; |
3878 | if (th->th_urp > todrop) |
3879 | th->th_urp -= todrop; |
3880 | else { |
3881 | thflags &= ~TH_URG; |
3882 | th->th_urp = 0; |
3883 | } |
3884 | } |
3885 | |
3886 | /* |
3887 | * If new data are received on a connection after the user |
3888 | * processes are gone, then RST the other end. |
3889 | * Send also a RST when we received a data segment after we've |
3890 | * sent our FIN when the socket is defunct. |
3891 | * Note that an MPTCP subflow socket would have SS_NOFDREF set |
3892 | * by default. So, if it's an MPTCP-subflow we rather check the |
3893 | * MPTCP-level's socket state for SS_NOFDREF. |
3894 | */ |
3895 | if (tlen) { |
3896 | boolean_t close_it = FALSE; |
3897 | |
3898 | if (!(so->so_flags & SOF_MP_SUBFLOW) && (so->so_state & SS_NOFDREF) && |
3899 | tp->t_state > TCPS_CLOSE_WAIT) |
3900 | close_it = TRUE; |
3901 | |
3902 | if ((so->so_flags & SOF_MP_SUBFLOW) && (mptetoso(tptomptp(tp)->mpt_mpte)->so_state & SS_NOFDREF) && |
3903 | tp->t_state > TCPS_CLOSE_WAIT) |
3904 | close_it = TRUE; |
3905 | |
3906 | if ((so->so_flags & SOF_DEFUNCT) && tp->t_state > TCPS_FIN_WAIT_1) |
3907 | close_it = TRUE; |
3908 | |
3909 | if (close_it) { |
3910 | tp = tcp_close(tp); |
3911 | tcpstat.tcps_rcvafterclose++; |
3912 | rstreason = BANDLIM_UNLIMITED; |
3913 | IF_TCP_STATINC(ifp, cleanup); |
3914 | goto dropwithreset; |
3915 | } |
3916 | } |
3917 | |
3918 | /* |
3919 | * If segment ends after window, drop trailing data |
3920 | * (and PUSH and FIN); if nothing left, just ACK. |
3921 | */ |
3922 | todrop = (th->th_seq+tlen) - (tp->rcv_nxt+tp->rcv_wnd); |
3923 | if (todrop > 0) { |
3924 | tcpstat.tcps_rcvpackafterwin++; |
3925 | if (todrop >= tlen) { |
3926 | tcpstat.tcps_rcvbyteafterwin += tlen; |
3927 | /* |
3928 | * If a new connection request is received |
3929 | * while in TIME_WAIT, drop the old connection |
3930 | * and start over if the sequence numbers |
3931 | * are above the previous ones. |
3932 | */ |
3933 | if (thflags & TH_SYN && |
3934 | tp->t_state == TCPS_TIME_WAIT && |
3935 | SEQ_GT(th->th_seq, tp->rcv_nxt)) { |
3936 | iss = tcp_new_isn(tp); |
3937 | tp = tcp_close(tp); |
3938 | socket_unlock(so, 1); |
3939 | goto findpcb; |
3940 | } |
3941 | /* |
3942 | * If window is closed can only take segments at |
3943 | * window edge, and have to drop data and PUSH from |
3944 | * incoming segments. Continue processing, but |
3945 | * remember to ack. Otherwise, drop segment |
3946 | * and ack. |
3947 | */ |
3948 | if (tp->rcv_wnd == 0 && th->th_seq == tp->rcv_nxt) { |
3949 | tp->t_flags |= TF_ACKNOW; |
3950 | tcpstat.tcps_rcvwinprobe++; |
3951 | } else |
3952 | goto dropafterack; |
3953 | } else |
3954 | tcpstat.tcps_rcvbyteafterwin += todrop; |
3955 | m_adj(m, -todrop); |
3956 | tlen -= todrop; |
3957 | thflags &= ~(TH_PUSH|TH_FIN); |
3958 | } |
3959 | |
3960 | /* |
3961 | * If last ACK falls within this segment's sequence numbers, |
3962 | * record its timestamp. |
3963 | * NOTE: |
3964 | * 1) That the test incorporates suggestions from the latest |
3965 | * proposal of the tcplw@cray.com list (Braden 1993/04/26). |
3966 | * 2) That updating only on newer timestamps interferes with |
3967 | * our earlier PAWS tests, so this check should be solely |
3968 | * predicated on the sequence space of this segment. |
3969 | * 3) That we modify the segment boundary check to be |
3970 | * Last.ACK.Sent <= SEG.SEQ + SEG.Len |
3971 | * instead of RFC1323's |
3972 | * Last.ACK.Sent < SEG.SEQ + SEG.Len, |
3973 | * This modified check allows us to overcome RFC1323's |
3974 | * limitations as described in Stevens TCP/IP Illustrated |
3975 | * Vol. 2 p.869. In such cases, we can still calculate the |
3976 | * RTT correctly when RCV.NXT == Last.ACK.Sent. |
3977 | */ |
3978 | if ((to.to_flags & TOF_TS) != 0 && |
3979 | SEQ_LEQ(th->th_seq, tp->last_ack_sent) && |
3980 | SEQ_LEQ(tp->last_ack_sent, th->th_seq + tlen + |
3981 | ((thflags & (TH_SYN|TH_FIN)) != 0))) { |
3982 | tp->ts_recent_age = tcp_now; |
3983 | tp->ts_recent = to.to_tsval; |
3984 | } |
3985 | |
3986 | /* |
3987 | * Stevens: If a SYN is in the window, then this is an |
3988 | * error and we send an RST and drop the connection. |
3989 | * |
3990 | * RFC 5961 Section 4.2 |
3991 | * Send challenge ACK for any SYN in synchronized state |
3992 | * Perform rate limitation in doing so. |
3993 | */ |
3994 | if (thflags & TH_SYN) { |
3995 | if (tcp_do_rfc5961) { |
3996 | tcpstat.tcps_badsyn++; |
3997 | /* Drop if we have reached ACK limit */ |
3998 | if (tcp_is_ack_ratelimited(tp)) { |
3999 | goto drop; |
4000 | } else { |
4001 | /* Send challenge ACK */ |
4002 | tcpstat.tcps_synchallenge++; |
4003 | goto dropafterack; |
4004 | } |
4005 | } else { |
4006 | tp = tcp_drop(tp, ECONNRESET); |
4007 | rstreason = BANDLIM_UNLIMITED; |
4008 | postevent(so, 0, EV_RESET); |
4009 | IF_TCP_STATINC(ifp, synwindow); |
4010 | goto dropwithreset; |
4011 | } |
4012 | } |
4013 | |
4014 | /* |
4015 | * If the ACK bit is off: if in SYN-RECEIVED state or SENDSYN |
4016 | * flag is on (half-synchronized state), then queue data for |
4017 | * later processing; else drop segment and return. |
4018 | */ |
4019 | if ((thflags & TH_ACK) == 0) { |
4020 | if (tp->t_state == TCPS_SYN_RECEIVED || |
4021 | (tp->t_flags & TF_NEEDSYN)) { |
4022 | if ((tfo_enabled(tp))) { |
4023 | /* |
4024 | * So, we received a valid segment while in |
4025 | * SYN-RECEIVED (TF_NEEDSYN is actually never |
4026 | * set, so this is dead code). |
4027 | * As this cannot be an RST (see that if a bit |
4028 | * higher), and it does not have the ACK-flag |
4029 | * set, we want to retransmit the SYN/ACK. |
4030 | * Thus, we have to reset snd_nxt to snd_una to |
4031 | * trigger the going back to sending of the |
4032 | * SYN/ACK. This is more consistent with the |
4033 | * behavior of tcp_output(), which expects |
4034 | * to send the segment that is pointed to by |
4035 | * snd_nxt. |
4036 | */ |
4037 | tp->snd_nxt = tp->snd_una; |
4038 | |
4039 | /* |
4040 | * We need to make absolutely sure that we are |
4041 | * going to reply upon a duplicate SYN-segment. |
4042 | */ |
4043 | if (th->th_flags & TH_SYN) |
4044 | needoutput = 1; |
4045 | } |
4046 | |
4047 | goto step6; |
4048 | } else if (tp->t_flags & TF_ACKNOW) |
4049 | goto dropafterack; |
4050 | else |
4051 | goto drop; |
4052 | } |
4053 | |
4054 | /* |
4055 | * Ack processing. |
4056 | */ |
4057 | |
4058 | switch (tp->t_state) { |
4059 | |
4060 | /* |
4061 | * In SYN_RECEIVED state, the ack ACKs our SYN, so enter |
4062 | * ESTABLISHED state and continue processing. |
4063 | * The ACK was checked above. |
4064 | */ |
4065 | case TCPS_SYN_RECEIVED: |
4066 | |
4067 | tcpstat.tcps_connects++; |
4068 | |
4069 | /* Do window scaling? */ |
4070 | if (TCP_WINDOW_SCALE_ENABLED(tp)) { |
4071 | tp->snd_scale = tp->requested_s_scale; |
4072 | tp->rcv_scale = tp->request_r_scale; |
4073 | tp->snd_wnd = th->th_win << tp->snd_scale; |
4074 | tp->max_sndwnd = tp->snd_wnd; |
4075 | tiwin = tp->snd_wnd; |
4076 | } |
4077 | /* |
4078 | * Make transitions: |
4079 | * SYN-RECEIVED -> ESTABLISHED |
4080 | * SYN-RECEIVED* -> FIN-WAIT-1 |
4081 | */ |
4082 | tp->t_starttime = tcp_now; |
4083 | tcp_sbrcv_tstmp_check(tp); |
4084 | if (tp->t_flags & TF_NEEDFIN) { |
4085 | DTRACE_TCP4(state__change, void, NULL, |
4086 | struct inpcb *, inp, |
4087 | struct tcpcb *, tp, int32_t, TCPS_FIN_WAIT_1); |
4088 | tp->t_state = TCPS_FIN_WAIT_1; |
4089 | tp->t_flags &= ~TF_NEEDFIN; |
4090 | } else { |
4091 | DTRACE_TCP4(state__change, void, NULL, |
4092 | struct inpcb *, inp, |
4093 | struct tcpcb *, tp, int32_t, TCPS_ESTABLISHED); |
4094 | tp->t_state = TCPS_ESTABLISHED; |
4095 | tp->t_timer[TCPT_KEEP] = OFFSET_FROM_START(tp, |
4096 | TCP_CONN_KEEPIDLE(tp)); |
4097 | if (nstat_collect) |
4098 | nstat_route_connect_success( |
4099 | tp->t_inpcb->inp_route.ro_rt); |
4100 | /* |
4101 | * The SYN is acknowledged but una is not updated |
4102 | * yet. So pass the value of ack to compute |
4103 | * sndbytes correctly |
4104 | */ |
4105 | inp_count_sndbytes(inp, th->th_ack); |
4106 | } |
4107 | /* |
4108 | * If segment contains data or ACK, will call tcp_reass() |
4109 | * later; if not, do so now to pass queued data to user. |
4110 | */ |
4111 | if (tlen == 0 && (thflags & TH_FIN) == 0) |
4112 | (void) tcp_reass(tp, (struct tcphdr *)0, &tlen, |
4113 | NULL, ifp); |
4114 | tp->snd_wl1 = th->th_seq - 1; |
4115 | |
4116 | #if MPTCP |
4117 | /* |
4118 | * Do not send the connect notification for additional subflows |
4119 | * until ACK for 3-way handshake arrives. |
4120 | */ |
4121 | if ((!(tp->t_mpflags & TMPF_MPTCP_TRUE)) && |
4122 | (tp->t_mpflags & TMPF_SENT_JOIN)) { |
4123 | isconnected = FALSE; |
4124 | } else |
4125 | #endif /* MPTCP */ |
4126 | isconnected = TRUE; |
4127 | if ((tp->t_tfo_flags & TFO_F_COOKIE_VALID)) { |
4128 | /* Done this when receiving the SYN */ |
4129 | isconnected = FALSE; |
4130 | |
4131 | OSDecrementAtomic(&tcp_tfo_halfcnt); |
4132 | |
4133 | /* Panic if something has gone terribly wrong. */ |
4134 | VERIFY(tcp_tfo_halfcnt >= 0); |
4135 | |
4136 | tp->t_tfo_flags &= ~TFO_F_COOKIE_VALID; |
4137 | } |
4138 | |
4139 | /* |
4140 | * In case there is data in the send-queue (e.g., TFO is being |
4141 | * used, or connectx+data has been done), then if we would |
4142 | * "FALLTHROUGH", we would handle this ACK as if data has been |
4143 | * acknowledged. But, we have to prevent this. And this |
4144 | * can be prevented by increasing snd_una by 1, so that the |
4145 | * SYN is not considered as data (snd_una++ is actually also |
4146 | * done in SYN_SENT-state as part of the regular TCP stack). |
4147 | * |
4148 | * In case there is data on this ack as well, the data will be |
4149 | * handled by the label "dodata" right after step6. |
4150 | */ |
4151 | if (so->so_snd.sb_cc) { |
4152 | tp->snd_una++; /* SYN is acked */ |
4153 | if (SEQ_LT(tp->snd_nxt, tp->snd_una)) |
4154 | tp->snd_nxt = tp->snd_una; |
4155 | |
4156 | /* |
4157 | * No duplicate-ACK handling is needed. So, we |
4158 | * directly advance to processing the ACK (aka, |
4159 | * updating the RTT estimation,...) |
4160 | * |
4161 | * But, we first need to handle eventual SACKs, |
4162 | * because TFO will start sending data with the |
4163 | * SYN/ACK, so it might be that the client |
4164 | * includes a SACK with its ACK. |
4165 | */ |
4166 | if (SACK_ENABLED(tp) && |
4167 | (to.to_nsacks > 0 || |
4168 | !TAILQ_EMPTY(&tp->snd_holes))) |
4169 | tcp_sack_doack(tp, &to, th, |
4170 | &sack_bytes_acked); |
4171 | |
4172 | goto process_ACK; |
4173 | } |
4174 | |
4175 | /* FALLTHROUGH */ |
4176 | |
4177 | /* |
4178 | * In ESTABLISHED state: drop duplicate ACKs; ACK out of range |
4179 | * ACKs. If the ack is in the range |
4180 | * tp->snd_una < th->th_ack <= tp->snd_max |
4181 | * then advance tp->snd_una to th->th_ack and drop |
4182 | * data from the retransmission queue. If this ACK reflects |
4183 | * more up to date window information we update our window information. |
4184 | */ |
4185 | case TCPS_ESTABLISHED: |
4186 | case TCPS_FIN_WAIT_1: |
4187 | case TCPS_FIN_WAIT_2: |
4188 | case TCPS_CLOSE_WAIT: |
4189 | case TCPS_CLOSING: |
4190 | case TCPS_LAST_ACK: |
4191 | case TCPS_TIME_WAIT: |
4192 | if (SEQ_GT(th->th_ack, tp->snd_max)) { |
4193 | tcpstat.tcps_rcvacktoomuch++; |
4194 | if (tcp_do_rfc5961 && tcp_is_ack_ratelimited(tp)) { |
4195 | goto drop; |
4196 | } else { |
4197 | goto dropafterack; |
4198 | } |
4199 | } |
4200 | if (tcp_do_rfc5961 && SEQ_LT(th->th_ack, tp->snd_una - tp->max_sndwnd)) { |
4201 | if (tcp_is_ack_ratelimited(tp)) { |
4202 | goto drop; |
4203 | } else { |
4204 | goto dropafterack; |
4205 | } |
4206 | } |
4207 | if (SACK_ENABLED(tp) && to.to_nsacks > 0) { |
4208 | recvd_dsack = tcp_sack_process_dsack(tp, &to, th); |
4209 | /* |
4210 | * If DSACK is received and this packet has no |
4211 | * other SACK information, it can be dropped. |
4212 | * We do not want to treat it as a duplicate ack. |
4213 | */ |
4214 | if (recvd_dsack && |
4215 | SEQ_LEQ(th->th_ack, tp->snd_una) && |
4216 | to.to_nsacks == 0) { |
4217 | tcp_bad_rexmt_check(tp, th, &to); |
4218 | goto drop; |
4219 | } |
4220 | } |
4221 | |
4222 | if (SACK_ENABLED(tp) && |
4223 | (to.to_nsacks > 0 || !TAILQ_EMPTY(&tp->snd_holes))) |
4224 | tcp_sack_doack(tp, &to, th, &sack_bytes_acked); |
4225 | |
4226 | #if MPTCP |
4227 | if (tp->t_mpuna && SEQ_GEQ(th->th_ack, tp->t_mpuna)) { |
4228 | if (tp->t_mpflags & TMPF_PREESTABLISHED) { |
4229 | /* MP TCP establishment succeeded */ |
4230 | tp->t_mpuna = 0; |
4231 | if (tp->t_mpflags & TMPF_JOINED_FLOW) { |
4232 | if (tp->t_mpflags & TMPF_SENT_JOIN) { |
4233 | tp->t_mpflags &= |
4234 | ~TMPF_PREESTABLISHED; |
4235 | tp->t_mpflags |= |
4236 | TMPF_MPTCP_TRUE; |
4237 | mptcplog((LOG_DEBUG, "MPTCP " |
4238 | "Sockets: %s \n" ,__func__), |
4239 | MPTCP_SOCKET_DBG, |
4240 | MPTCP_LOGLVL_LOG); |
4241 | |
4242 | tp->t_timer[TCPT_JACK_RXMT] = 0; |
4243 | tp->t_mprxtshift = 0; |
4244 | isconnected = TRUE; |
4245 | } else { |
4246 | isconnected = FALSE; |
4247 | } |
4248 | } else { |
4249 | isconnected = TRUE; |
4250 | } |
4251 | } |
4252 | } |
4253 | #endif /* MPTCP */ |
4254 | |
4255 | tcp_tfo_rcv_ack(tp, th); |
4256 | |
4257 | /* |
4258 | * If we have outstanding data (other than |
4259 | * a window probe), this is a completely |
4260 | * duplicate ack and the ack is the biggest we've seen. |
4261 | * |
4262 | * Need to accommodate a change in window on duplicate acks |
4263 | * to allow operating systems that update window during |
4264 | * recovery with SACK |
4265 | */ |
4266 | if (SEQ_LEQ(th->th_ack, tp->snd_una)) { |
4267 | if (tlen == 0 && (tiwin == tp->snd_wnd || |
4268 | (to.to_nsacks > 0 && sack_bytes_acked > 0))) { |
4269 | /* |
4270 | * If both ends send FIN at the same time, |
4271 | * then the ack will be a duplicate ack |
4272 | * but we have to process the FIN. Check |
4273 | * for this condition and process the FIN |
4274 | * instead of the dupack |
4275 | */ |
4276 | if ((thflags & TH_FIN) && |
4277 | !TCPS_HAVERCVDFIN(tp->t_state)) |
4278 | break; |
4279 | process_dupack: |
4280 | #if MPTCP |
4281 | /* |
4282 | * MPTCP options that are ignored must |
4283 | * not be treated as duplicate ACKs. |
4284 | */ |
4285 | if (to.to_flags & TOF_MPTCP) { |
4286 | goto drop; |
4287 | } |
4288 | |
4289 | if ((isconnected) && (tp->t_mpflags & TMPF_JOINED_FLOW)) { |
4290 | mptcplog((LOG_DEBUG, "MPTCP " |
4291 | "Sockets: bypass ack recovery\n" ), |
4292 | MPTCP_SOCKET_DBG, |
4293 | MPTCP_LOGLVL_VERBOSE); |
4294 | break; |
4295 | } |
4296 | #endif /* MPTCP */ |
4297 | /* |
4298 | * If a duplicate acknowledgement was seen |
4299 | * after ECN, it indicates packet loss in |
4300 | * addition to ECN. Reset INRECOVERY flag |
4301 | * so that we can process partial acks |
4302 | * correctly |
4303 | */ |
4304 | if (tp->ecn_flags & TE_INRECOVERY) |
4305 | tp->ecn_flags &= ~TE_INRECOVERY; |
4306 | |
4307 | tcpstat.tcps_rcvdupack++; |
4308 | ++tp->t_dupacks; |
4309 | |
4310 | /* |
4311 | * Check if we need to reset the limit on |
4312 | * early retransmit |
4313 | */ |
4314 | if (tp->t_early_rexmt_count > 0 && |
4315 | TSTMP_GEQ(tcp_now, |
4316 | (tp->t_early_rexmt_win + |
4317 | TCP_EARLY_REXMT_WIN))) |
4318 | tp->t_early_rexmt_count = 0; |
4319 | |
4320 | /* |
4321 | * Is early retransmit needed? We check for |
4322 | * this when the connection is waiting for |
4323 | * duplicate acks to enter fast recovery. |
4324 | */ |
4325 | if (!IN_FASTRECOVERY(tp)) |
4326 | tcp_early_rexmt_check(tp, th); |
4327 | |
4328 | /* |
4329 | * If we've seen exactly rexmt threshold |
4330 | * of duplicate acks, assume a packet |
4331 | * has been dropped and retransmit it. |
4332 | * Kludge snd_nxt & the congestion |
4333 | * window so we send only this one |
4334 | * packet. |
4335 | * |
4336 | * We know we're losing at the current |
4337 | * window size so do congestion avoidance |
4338 | * (set ssthresh to half the current window |
4339 | * and pull our congestion window back to |
4340 | * the new ssthresh). |
4341 | * |
4342 | * Dup acks mean that packets have left the |
4343 | * network (they're now cached at the receiver) |
4344 | * so bump cwnd by the amount in the receiver |
4345 | * to keep a constant cwnd packets in the |
4346 | * network. |
4347 | */ |
4348 | if (tp->t_timer[TCPT_REXMT] == 0 || |
4349 | (th->th_ack != tp->snd_una |
4350 | && sack_bytes_acked == 0)) { |
4351 | tp->t_dupacks = 0; |
4352 | tp->t_rexmtthresh = tcprexmtthresh; |
4353 | } else if (tp->t_dupacks > tp->t_rexmtthresh || |
4354 | IN_FASTRECOVERY(tp)) { |
4355 | |
4356 | /* |
4357 | * If this connection was seeing packet |
4358 | * reordering, then recovery might be |
4359 | * delayed to disambiguate between |
4360 | * reordering and loss |
4361 | */ |
4362 | if (SACK_ENABLED(tp) && !IN_FASTRECOVERY(tp) && |
4363 | (tp->t_flagsext & |
4364 | (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) == |
4365 | (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) { |
4366 | /* |
4367 | * Since the SACK information is already |
4368 | * updated, this ACK will be dropped |
4369 | */ |
4370 | break; |
4371 | } |
4372 | |
4373 | if (SACK_ENABLED(tp) |
4374 | && IN_FASTRECOVERY(tp)) { |
4375 | int awnd; |
4376 | |
4377 | /* |
4378 | * Compute the amount of data in flight first. |
4379 | * We can inject new data into the pipe iff |
4380 | * we have less than 1/2 the original window's |
4381 | * worth of data in flight. |
4382 | */ |
4383 | awnd = (tp->snd_nxt - tp->snd_fack) + |
4384 | tp->sackhint.sack_bytes_rexmit; |
4385 | if (awnd < tp->snd_ssthresh) { |
4386 | tp->snd_cwnd += tp->t_maxseg; |
4387 | if (tp->snd_cwnd > tp->snd_ssthresh) |
4388 | tp->snd_cwnd = tp->snd_ssthresh; |
4389 | } |
4390 | } else { |
4391 | tp->snd_cwnd += tp->t_maxseg; |
4392 | } |
4393 | |
4394 | /* Process any window updates */ |
4395 | if (tiwin > tp->snd_wnd) |
4396 | tcp_update_window(tp, thflags, |
4397 | th, tiwin, tlen); |
4398 | tcp_ccdbg_trace(tp, th, |
4399 | TCP_CC_IN_FASTRECOVERY); |
4400 | |
4401 | (void) tcp_output(tp); |
4402 | |
4403 | goto drop; |
4404 | } else if (tp->t_dupacks == tp->t_rexmtthresh) { |
4405 | tcp_seq onxt = tp->snd_nxt; |
4406 | |
4407 | /* |
4408 | * If we're doing sack, check to |
4409 | * see if we're already in sack |
4410 | * recovery. If we're not doing sack, |
4411 | * check to see if we're in newreno |
4412 | * recovery. |
4413 | */ |
4414 | if (SACK_ENABLED(tp)) { |
4415 | if (IN_FASTRECOVERY(tp)) { |
4416 | tp->t_dupacks = 0; |
4417 | break; |
4418 | } else if (tp->t_flagsext & TF_DELAY_RECOVERY) { |
4419 | break; |
4420 | } |
4421 | } else { |
4422 | if (SEQ_LEQ(th->th_ack, |
4423 | tp->snd_recover)) { |
4424 | tp->t_dupacks = 0; |
4425 | break; |
4426 | } |
4427 | } |
4428 | if (tp->t_flags & TF_SENTFIN) |
4429 | tp->snd_recover = tp->snd_max - 1; |
4430 | else |
4431 | tp->snd_recover = tp->snd_max; |
4432 | tp->t_timer[TCPT_PTO] = 0; |
4433 | tp->t_rtttime = 0; |
4434 | |
4435 | /* |
4436 | * If the connection has seen pkt |
4437 | * reordering, delay recovery until |
4438 | * it is clear that the packet |
4439 | * was lost. |
4440 | */ |
4441 | if (SACK_ENABLED(tp) && |
4442 | (tp->t_flagsext & |
4443 | (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) |
4444 | == TF_PKTS_REORDERED && |
4445 | !IN_FASTRECOVERY(tp) && |
4446 | tp->t_reorderwin > 0 && |
4447 | (tp->t_state == TCPS_ESTABLISHED || |
4448 | tp->t_state == TCPS_FIN_WAIT_1)) { |
4449 | tp->t_timer[TCPT_DELAYFR] = |
4450 | OFFSET_FROM_START(tp, |
4451 | tp->t_reorderwin); |
4452 | tp->t_flagsext |= TF_DELAY_RECOVERY; |
4453 | tcpstat.tcps_delay_recovery++; |
4454 | tcp_ccdbg_trace(tp, th, |
4455 | TCP_CC_DELAY_FASTRECOVERY); |
4456 | break; |
4457 | } |
4458 | |
4459 | tcp_rexmt_save_state(tp); |
4460 | /* |
4461 | * If the current tcp cc module has |
4462 | * defined a hook for tasks to run |
4463 | * before entering FR, call it |
4464 | */ |
4465 | if (CC_ALGO(tp)->pre_fr != NULL) |
4466 | CC_ALGO(tp)->pre_fr(tp); |
4467 | ENTER_FASTRECOVERY(tp); |
4468 | tp->t_timer[TCPT_REXMT] = 0; |
4469 | if (TCP_ECN_ENABLED(tp)) |
4470 | tp->ecn_flags |= TE_SENDCWR; |
4471 | |
4472 | if (SACK_ENABLED(tp)) { |
4473 | tcpstat.tcps_sack_recovery_episode++; |
4474 | tp->t_sack_recovery_episode++; |
4475 | tp->sack_newdata = tp->snd_nxt; |
4476 | tp->snd_cwnd = tp->t_maxseg; |
4477 | tp->t_flagsext &= |
4478 | ~TF_CWND_NONVALIDATED; |
4479 | |
4480 | /* Process any window updates */ |
4481 | if (tiwin > tp->snd_wnd) |
4482 | tcp_update_window( |
4483 | tp, thflags, |
4484 | th, tiwin, tlen); |
4485 | |
4486 | tcp_ccdbg_trace(tp, th, |
4487 | TCP_CC_ENTER_FASTRECOVERY); |
4488 | (void) tcp_output(tp); |
4489 | goto drop; |
4490 | } |
4491 | tp->snd_nxt = th->th_ack; |
4492 | tp->snd_cwnd = tp->t_maxseg; |
4493 | |
4494 | /* Process any window updates */ |
4495 | if (tiwin > tp->snd_wnd) |
4496 | tcp_update_window(tp, |
4497 | thflags, |
4498 | th, tiwin, tlen); |
4499 | |
4500 | (void) tcp_output(tp); |
4501 | if (tp->t_flagsext & TF_CWND_NONVALIDATED) { |
4502 | tcp_cc_adjust_nonvalidated_cwnd(tp); |
4503 | } else { |
4504 | tp->snd_cwnd = tp->snd_ssthresh + |
4505 | tp->t_maxseg * tp->t_dupacks; |
4506 | } |
4507 | if (SEQ_GT(onxt, tp->snd_nxt)) |
4508 | tp->snd_nxt = onxt; |
4509 | |
4510 | tcp_ccdbg_trace(tp, th, |
4511 | TCP_CC_ENTER_FASTRECOVERY); |
4512 | goto drop; |
4513 | } else if (limited_txmt && |
4514 | ALLOW_LIMITED_TRANSMIT(tp) && |
4515 | (!(SACK_ENABLED(tp)) || sack_bytes_acked > 0) && |
4516 | (so->so_snd.sb_cc - (tp->snd_max - tp->snd_una)) > 0) { |
4517 | u_int32_t incr = (tp->t_maxseg * tp->t_dupacks); |
4518 | |
4519 | /* Use Limited Transmit algorithm on the first two |
4520 | * duplicate acks when there is new data to transmit |
4521 | */ |
4522 | tp->snd_cwnd += incr; |
4523 | tcpstat.tcps_limited_txt++; |
4524 | (void) tcp_output(tp); |
4525 | |
4526 | tcp_ccdbg_trace(tp, th, TCP_CC_LIMITED_TRANSMIT); |
4527 | |
4528 | /* Reset snd_cwnd back to normal */ |
4529 | tp->snd_cwnd -= incr; |
4530 | } |
4531 | } |
4532 | break; |
4533 | } |
4534 | /* |
4535 | * If the congestion window was inflated to account |
4536 | * for the other side's cached packets, retract it. |
4537 | */ |
4538 | if (IN_FASTRECOVERY(tp)) { |
4539 | if (SEQ_LT(th->th_ack, tp->snd_recover)) { |
4540 | /* |
4541 | * If we received an ECE and entered |
4542 | * recovery, the subsequent ACKs should |
4543 | * not be treated as partial acks. |
4544 | */ |
4545 | if (tp->ecn_flags & TE_INRECOVERY) |
4546 | goto process_ACK; |
4547 | |
4548 | if (SACK_ENABLED(tp)) |
4549 | tcp_sack_partialack(tp, th); |
4550 | else |
4551 | tcp_newreno_partial_ack(tp, th); |
4552 | tcp_ccdbg_trace(tp, th, TCP_CC_PARTIAL_ACK); |
4553 | } else { |
4554 | EXIT_FASTRECOVERY(tp); |
4555 | if (CC_ALGO(tp)->post_fr != NULL) |
4556 | CC_ALGO(tp)->post_fr(tp, th); |
4557 | tp->t_pipeack = 0; |
4558 | tcp_clear_pipeack_state(tp); |
4559 | tcp_ccdbg_trace(tp, th, |
4560 | TCP_CC_EXIT_FASTRECOVERY); |
4561 | } |
4562 | } else if ((tp->t_flagsext & |
4563 | (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) |
4564 | == (TF_PKTS_REORDERED|TF_DELAY_RECOVERY)) { |
4565 | /* |
4566 | * If the ack acknowledges upto snd_recover or if |
4567 | * it acknowledges all the snd holes, exit |
4568 | * recovery and cancel the timer. Otherwise, |
4569 | * this is a partial ack. Wait for recovery timer |
4570 | * to enter recovery. The snd_holes have already |
4571 | * been updated. |
4572 | */ |
4573 | if (SEQ_GEQ(th->th_ack, tp->snd_recover) || |
4574 | TAILQ_EMPTY(&tp->snd_holes)) { |
4575 | tp->t_timer[TCPT_DELAYFR] = 0; |
4576 | tp->t_flagsext &= ~TF_DELAY_RECOVERY; |
4577 | EXIT_FASTRECOVERY(tp); |
4578 | tcp_ccdbg_trace(tp, th, |
4579 | TCP_CC_EXIT_FASTRECOVERY); |
4580 | } |
4581 | } else { |
4582 | /* |
4583 | * We were not in fast recovery. Reset the |
4584 | * duplicate ack counter. |
4585 | */ |
4586 | tp->t_dupacks = 0; |
4587 | tp->t_rexmtthresh = tcprexmtthresh; |
4588 | } |
4589 | |
4590 | |
4591 | /* |
4592 | * If we reach this point, ACK is not a duplicate, |
4593 | * i.e., it ACKs something we sent. |
4594 | */ |
4595 | if (tp->t_flags & TF_NEEDSYN) { |
4596 | /* |
4597 | * T/TCP: Connection was half-synchronized, and our |
4598 | * SYN has been ACK'd (so connection is now fully |
4599 | * synchronized). Go to non-starred state, |
4600 | * increment snd_una for ACK of SYN, and check if |
4601 | * we can do window scaling. |
4602 | */ |
4603 | tp->t_flags &= ~TF_NEEDSYN; |
4604 | tp->snd_una++; |
4605 | /* Do window scaling? */ |
4606 | if (TCP_WINDOW_SCALE_ENABLED(tp)) { |
4607 | tp->snd_scale = tp->requested_s_scale; |
4608 | tp->rcv_scale = tp->request_r_scale; |
4609 | } |
4610 | } |
4611 | |
4612 | process_ACK: |
4613 | VERIFY(SEQ_GEQ(th->th_ack, tp->snd_una)); |
4614 | acked = BYTES_ACKED(th, tp); |
4615 | tcpstat.tcps_rcvackpack++; |
4616 | tcpstat.tcps_rcvackbyte += acked; |
4617 | |
4618 | /* |
4619 | * If the last packet was a retransmit, make sure |
4620 | * it was not spurious. |
4621 | * |
4622 | * This will also take care of congestion window |
4623 | * adjustment if a last packet was recovered due to a |
4624 | * tail loss probe. |
4625 | */ |
4626 | tcp_bad_rexmt_check(tp, th, &to); |
4627 | |
4628 | /* Recalculate the RTT */ |
4629 | tcp_compute_rtt(tp, &to, th); |
4630 | |
4631 | /* |
4632 | * If all outstanding data is acked, stop retransmit |
4633 | * timer and remember to restart (more output or persist). |
4634 | * If there is more data to be acked, restart retransmit |
4635 | * timer, using current (possibly backed-off) value. |
4636 | */ |
4637 | TCP_RESET_REXMT_STATE(tp); |
4638 | TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), |
4639 | tp->t_rttmin, TCPTV_REXMTMAX, |
4640 | TCP_ADD_REXMTSLOP(tp)); |
4641 | if (th->th_ack == tp->snd_max) { |
4642 | tp->t_timer[TCPT_REXMT] = 0; |
4643 | tp->t_timer[TCPT_PTO] = 0; |
4644 | needoutput = 1; |
4645 | } else if (tp->t_timer[TCPT_PERSIST] == 0) |
4646 | tp->t_timer[TCPT_REXMT] = OFFSET_FROM_START(tp, |
4647 | tp->t_rxtcur); |
4648 | |
4649 | /* |
4650 | * If no data (only SYN) was ACK'd, skip rest of ACK |
4651 | * processing. |
4652 | */ |
4653 | if (acked == 0) |
4654 | goto step6; |
4655 | |
4656 | /* |
4657 | * When outgoing data has been acked (except the SYN+data), we |
4658 | * mark this connection as "sending good" for TFO. |
4659 | */ |
4660 | if ((tp->t_tfo_stats & TFO_S_SYN_DATA_SENT) && |
4661 | !(tp->t_tfo_flags & TFO_F_NO_SNDPROBING) && |
4662 | !(th->th_flags & TH_SYN)) |
4663 | tp->t_tfo_flags |= TFO_F_NO_SNDPROBING; |
4664 | |
4665 | /* |
4666 | * If TH_ECE is received, make sure that ECN is enabled |
4667 | * on that connection and we have sent ECT on data packets. |
4668 | */ |
4669 | if ((thflags & TH_ECE) != 0 && TCP_ECN_ENABLED(tp) && |
4670 | (tp->ecn_flags & TE_SENDIPECT)) { |
4671 | /* |
4672 | * Reduce the congestion window if we haven't |
4673 | * done so. |
4674 | */ |
4675 | if (!IN_FASTRECOVERY(tp)) { |
4676 | tcp_reduce_congestion_window(tp); |
4677 | tp->ecn_flags |= (TE_INRECOVERY|TE_SENDCWR); |
4678 | /* |
4679 | * Also note that the connection received |
4680 | * ECE atleast once |
4681 | */ |
4682 | tp->ecn_flags |= TE_RECV_ECN_ECE; |
4683 | INP_INC_IFNET_STAT(inp, ecn_recv_ece); |
4684 | tcpstat.tcps_ecn_recv_ece++; |
4685 | tcp_ccdbg_trace(tp, th, TCP_CC_ECN_RCVD); |
4686 | } |
4687 | } |
4688 | |
4689 | /* |
4690 | * When new data is acked, open the congestion window. |
4691 | * The specifics of how this is achieved are up to the |
4692 | * congestion control algorithm in use for this connection. |
4693 | * |
4694 | * The calculations in this function assume that snd_una is |
4695 | * not updated yet. |
4696 | */ |
4697 | if (!IN_FASTRECOVERY(tp)) { |
4698 | if (CC_ALGO(tp)->ack_rcvd != NULL) |
4699 | CC_ALGO(tp)->ack_rcvd(tp, th); |
4700 | tcp_ccdbg_trace(tp, th, TCP_CC_ACK_RCVD); |
4701 | } |
4702 | if (acked > so->so_snd.sb_cc) { |
4703 | tp->snd_wnd -= so->so_snd.sb_cc; |
4704 | sbdrop(&so->so_snd, (int)so->so_snd.sb_cc); |
4705 | if (so->so_flags & SOF_ENABLE_MSGS) { |
4706 | so->so_msg_state->msg_serial_bytes -= |
4707 | (int)so->so_snd.sb_cc; |
4708 | } |
4709 | ourfinisacked = 1; |
4710 | } else { |
4711 | sbdrop(&so->so_snd, acked); |
4712 | if (so->so_flags & SOF_ENABLE_MSGS) { |
4713 | so->so_msg_state->msg_serial_bytes -= |
4714 | acked; |
4715 | } |
4716 | tcp_sbsnd_trim(&so->so_snd); |
4717 | tp->snd_wnd -= acked; |
4718 | ourfinisacked = 0; |
4719 | } |
4720 | /* detect una wraparound */ |
4721 | if ( !IN_FASTRECOVERY(tp) && |
4722 | SEQ_GT(tp->snd_una, tp->snd_recover) && |
4723 | SEQ_LEQ(th->th_ack, tp->snd_recover)) |
4724 | tp->snd_recover = th->th_ack - 1; |
4725 | |
4726 | if (IN_FASTRECOVERY(tp) && |
4727 | SEQ_GEQ(th->th_ack, tp->snd_recover)) |
4728 | EXIT_FASTRECOVERY(tp); |
4729 | |
4730 | tp->snd_una = th->th_ack; |
4731 | |
4732 | if (SACK_ENABLED(tp)) { |
4733 | if (SEQ_GT(tp->snd_una, tp->snd_recover)) |
4734 | tp->snd_recover = tp->snd_una; |
4735 | } |
4736 | if (SEQ_LT(tp->snd_nxt, tp->snd_una)) |
4737 | tp->snd_nxt = tp->snd_una; |
4738 | if (!SLIST_EMPTY(&tp->t_rxt_segments) && |
4739 | !TCP_DSACK_SEQ_IN_WINDOW(tp, tp->t_dsack_lastuna, |
4740 | tp->snd_una)) |
4741 | tcp_rxtseg_clean(tp); |
4742 | if ((tp->t_flagsext & TF_MEASURESNDBW) != 0 && |
4743 | tp->t_bwmeas != NULL) |
4744 | tcp_bwmeas_check(tp); |
4745 | |
4746 | /* |
4747 | * sowwakeup must happen after snd_una, et al. are |
4748 | * updated so that the sequence numbers are in sync with |
4749 | * so_snd |
4750 | */ |
4751 | sowwakeup(so); |
4752 | |
4753 | if (!SLIST_EMPTY(&tp->t_notify_ack)) |
4754 | tcp_notify_acknowledgement(tp, so); |
4755 | |
4756 | switch (tp->t_state) { |
4757 | |
4758 | /* |
4759 | * In FIN_WAIT_1 STATE in addition to the processing |
4760 | * for the ESTABLISHED state if our FIN is now acknowledged |
4761 | * then enter FIN_WAIT_2. |
4762 | */ |
4763 | case TCPS_FIN_WAIT_1: |
4764 | if (ourfinisacked) { |
4765 | /* |
4766 | * If we can't receive any more |
4767 | * data, then closing user can proceed. |
4768 | * Starting the TCPT_2MSL timer is contrary to the |
4769 | * specification, but if we don't get a FIN |
4770 | * we'll hang forever. |
4771 | */ |
4772 | if (so->so_state & SS_CANTRCVMORE) { |
4773 | tp->t_timer[TCPT_2MSL] = OFFSET_FROM_START(tp, |
4774 | TCP_CONN_MAXIDLE(tp)); |
4775 | isconnected = FALSE; |
4776 | isdisconnected = TRUE; |
4777 | } |
4778 | DTRACE_TCP4(state__change, void, NULL, |
4779 | struct inpcb *, inp, |
4780 | struct tcpcb *, tp, |
4781 | int32_t, TCPS_FIN_WAIT_2); |
4782 | tp->t_state = TCPS_FIN_WAIT_2; |
4783 | /* fall through and make sure we also recognize |
4784 | * data ACKed with the FIN |
4785 | */ |
4786 | } |
4787 | break; |
4788 | |
4789 | /* |
4790 | * In CLOSING STATE in addition to the processing for |
4791 | * the ESTABLISHED state if the ACK acknowledges our FIN |
4792 | * then enter the TIME-WAIT state, otherwise ignore |
4793 | * the segment. |
4794 | */ |
4795 | case TCPS_CLOSING: |
4796 | if (ourfinisacked) { |
4797 | DTRACE_TCP4(state__change, void, NULL, |
4798 | struct inpcb *, inp, |
4799 | struct tcpcb *, tp, |
4800 | int32_t, TCPS_TIME_WAIT); |
4801 | tp->t_state = TCPS_TIME_WAIT; |
4802 | tcp_canceltimers(tp); |
4803 | if (tp->t_flagsext & TF_NOTIMEWAIT) { |
4804 | tp->t_flags |= TF_CLOSING; |
4805 | } else { |
4806 | add_to_time_wait(tp, 2 * tcp_msl); |
4807 | } |
4808 | isconnected = FALSE; |
4809 | isdisconnected = TRUE; |
4810 | } |
4811 | break; |
4812 | |
4813 | /* |
4814 | * In LAST_ACK, we may still be waiting for data to drain |
4815 | * and/or to be acked, as well as for the ack of our FIN. |
4816 | * If our FIN is now acknowledged, delete the TCB, |
4817 | * enter the closed state and return. |
4818 | */ |
4819 | case TCPS_LAST_ACK: |
4820 | if (ourfinisacked) { |
4821 | tp = tcp_close(tp); |
4822 | goto drop; |
4823 | } |
4824 | break; |
4825 | |
4826 | /* |
4827 | * In TIME_WAIT state the only thing that should arrive |
4828 | * is a retransmission of the remote FIN. Acknowledge |
4829 | * it and restart the finack timer. |
4830 | */ |
4831 | case TCPS_TIME_WAIT: |
4832 | add_to_time_wait(tp, 2 * tcp_msl); |
4833 | goto dropafterack; |
4834 | } |
4835 | |
4836 | /* |
4837 | * If there is a SACK option on the ACK and we |
4838 | * haven't seen any duplicate acks before, count |
4839 | * it as a duplicate ack even if the cumulative |
4840 | * ack is advanced. If the receiver delayed an |
4841 | * ack and detected loss afterwards, then the ack |
4842 | * will advance cumulative ack and will also have |
4843 | * a SACK option. So counting it as one duplicate |
4844 | * ack is ok. |
4845 | */ |
4846 | if (sack_ackadv == 1 && |
4847 | tp->t_state == TCPS_ESTABLISHED && |
4848 | SACK_ENABLED(tp) && sack_bytes_acked > 0 && |
4849 | to.to_nsacks > 0 && tp->t_dupacks == 0 && |
4850 | SEQ_LEQ(th->th_ack, tp->snd_una) && tlen == 0 && |
4851 | !(tp->t_flagsext & TF_PKTS_REORDERED)) { |
4852 | tcpstat.tcps_sack_ackadv++; |
4853 | goto process_dupack; |
4854 | } |
4855 | } |
4856 | |
4857 | step6: |
4858 | /* |
4859 | * Update window information. |
4860 | */ |
4861 | if (tcp_update_window(tp, thflags, th, tiwin, tlen)) |
4862 | needoutput = 1; |
4863 | |
4864 | /* |
4865 | * Process segments with URG. |
4866 | */ |
4867 | if ((thflags & TH_URG) && th->th_urp && |
4868 | TCPS_HAVERCVDFIN(tp->t_state) == 0) { |
4869 | /* |
4870 | * This is a kludge, but if we receive and accept |
4871 | * random urgent pointers, we'll crash in |
4872 | * soreceive. It's hard to imagine someone |
4873 | * actually wanting to send this much urgent data. |
4874 | */ |
4875 | if (th->th_urp + so->so_rcv.sb_cc > sb_max) { |
4876 | th->th_urp = 0; /* XXX */ |
4877 | thflags &= ~TH_URG; /* XXX */ |
4878 | goto dodata; /* XXX */ |
4879 | } |
4880 | /* |
4881 | * If this segment advances the known urgent pointer, |
4882 | * then mark the data stream. This should not happen |
4883 | * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since |
4884 | * a FIN has been received from the remote side. |
4885 | * In these states we ignore the URG. |
4886 | * |
4887 | * According to RFC961 (Assigned Protocols), |
4888 | * the urgent pointer points to the last octet |
4889 | * of urgent data. We continue, however, |
4890 | * to consider it to indicate the first octet |
4891 | * of data past the urgent section as the original |
4892 | * spec states (in one of two places). |
4893 | */ |
4894 | if (SEQ_GT(th->th_seq+th->th_urp, tp->rcv_up)) { |
4895 | tp->rcv_up = th->th_seq + th->th_urp; |
4896 | so->so_oobmark = so->so_rcv.sb_cc + |
4897 | (tp->rcv_up - tp->rcv_nxt) - 1; |
4898 | if (so->so_oobmark == 0) { |
4899 | so->so_state |= SS_RCVATMARK; |
4900 | postevent(so, 0, EV_OOB); |
4901 | } |
4902 | sohasoutofband(so); |
4903 | tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); |
4904 | } |
4905 | /* |
4906 | * Remove out of band data so doesn't get presented to user. |
4907 | * This can happen independent of advancing the URG pointer, |
4908 | * but if two URG's are pending at once, some out-of-band |
4909 | * data may creep in... ick. |
4910 | */ |
4911 | if (th->th_urp <= (u_int32_t)tlen |
4912 | #if SO_OOBINLINE |
4913 | && (so->so_options & SO_OOBINLINE) == 0 |
4914 | #endif |
4915 | ) |
4916 | tcp_pulloutofband(so, th, m, |
4917 | drop_hdrlen); /* hdr drop is delayed */ |
4918 | } else { |
4919 | /* |
4920 | * If no out of band data is expected, |
4921 | * pull receive urgent pointer along |
4922 | * with the receive window. |
4923 | */ |
4924 | if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) |
4925 | tp->rcv_up = tp->rcv_nxt; |
4926 | } |
4927 | dodata: |
4928 | |
4929 | /* Set socket's connect or disconnect state correcly before doing data. |
4930 | * The following might unlock the socket if there is an upcall or a socket |
4931 | * filter. |
4932 | */ |
4933 | if (isconnected) { |
4934 | soisconnected(so); |
4935 | } else if (isdisconnected) { |
4936 | soisdisconnected(so); |
4937 | } |
4938 | |
4939 | /* Let's check the state of pcb just to make sure that it did not get closed |
4940 | * when we unlocked above |
4941 | */ |
4942 | if (inp->inp_state == INPCB_STATE_DEAD) { |
4943 | /* Just drop the packet that we are processing and return */ |
4944 | goto drop; |
4945 | } |
4946 | |
4947 | /* |
4948 | * Process the segment text, merging it into the TCP sequencing queue, |
4949 | * and arranging for acknowledgment of receipt if necessary. |
4950 | * This process logically involves adjusting tp->rcv_wnd as data |
4951 | * is presented to the user (this happens in tcp_usrreq.c, |
4952 | * case PRU_RCVD). If a FIN has already been received on this |
4953 | * connection then we just ignore the text. |
4954 | * |
4955 | * If we are in SYN-received state and got a valid TFO cookie, we want |
4956 | * to process the data. |
4957 | */ |
4958 | if ((tlen || (thflags & TH_FIN)) && |
4959 | TCPS_HAVERCVDFIN(tp->t_state) == 0 && |
4960 | (TCPS_HAVEESTABLISHED(tp->t_state) || |
4961 | (tp->t_state == TCPS_SYN_RECEIVED && |
4962 | (tp->t_tfo_flags & TFO_F_COOKIE_VALID)))) { |
4963 | tcp_seq save_start = th->th_seq; |
4964 | tcp_seq save_end = th->th_seq + tlen; |
4965 | m_adj(m, drop_hdrlen); /* delayed header drop */ |
4966 | /* |
4967 | * Insert segment which includes th into TCP reassembly queue |
4968 | * with control block tp. Set thflags to whether reassembly now |
4969 | * includes a segment with FIN. This handles the common case |
4970 | * inline (segment is the next to be received on an established |
4971 | * connection, and the queue is empty), avoiding linkage into |
4972 | * and removal from the queue and repetition of various |
4973 | * conversions. |
4974 | * Set DELACK for segments received in order, but ack |
4975 | * immediately when segments are out of order (so |
4976 | * fast retransmit can work). |
4977 | */ |
4978 | if (th->th_seq == tp->rcv_nxt && LIST_EMPTY(&tp->t_segq)) { |
4979 | TCP_INC_VAR(tp->t_unacksegs, nlropkts); |
4980 | /* |
4981 | * Calculate the RTT on the receiver only if the |
4982 | * connection is in streaming mode and the last |
4983 | * packet was not an end-of-write |
4984 | */ |
4985 | if (tp->t_flags & TF_STREAMING_ON) |
4986 | tcp_compute_rtt(tp, &to, th); |
4987 | |
4988 | if (DELAY_ACK(tp, th) && |
4989 | ((tp->t_flags & TF_ACKNOW) == 0) ) { |
4990 | if ((tp->t_flags & TF_DELACK) == 0) { |
4991 | tp->t_flags |= TF_DELACK; |
4992 | tp->t_timer[TCPT_DELACK] = |
4993 | OFFSET_FROM_START(tp, tcp_delack); |
4994 | } |
4995 | } |
4996 | else { |
4997 | tp->t_flags |= TF_ACKNOW; |
4998 | } |
4999 | tp->rcv_nxt += tlen; |
5000 | thflags = th->th_flags & TH_FIN; |
5001 | TCP_INC_VAR(tcpstat.tcps_rcvpack, nlropkts); |
5002 | tcpstat.tcps_rcvbyte += tlen; |
5003 | if (nstat_collect) { |
5004 | if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_PKT) { |
5005 | INP_ADD_STAT(inp, cell, wifi, wired, |
5006 | rxpackets, m->m_pkthdr.lro_npkts); |
5007 | } else { |
5008 | INP_ADD_STAT(inp, cell, wifi, wired, |
5009 | rxpackets, 1); |
5010 | } |
5011 | INP_ADD_STAT(inp, cell, wifi, wired, |
5012 | rxbytes, tlen); |
5013 | inp_set_activity_bitmap(inp); |
5014 | } |
5015 | tcp_sbrcv_grow(tp, &so->so_rcv, &to, tlen, |
5016 | TCP_AUTORCVBUF_MAX(ifp)); |
5017 | so_recv_data_stat(so, m, drop_hdrlen); |
5018 | |
5019 | if (sbappendstream_rcvdemux(so, m, |
5020 | th->th_seq - (tp->irs + 1), 0)) { |
5021 | sorwakeup(so); |
5022 | } |
5023 | } else { |
5024 | thflags = tcp_reass(tp, th, &tlen, m, ifp); |
5025 | tp->t_flags |= TF_ACKNOW; |
5026 | } |
5027 | |
5028 | if ((tlen > 0 || (th->th_flags & TH_FIN)) && SACK_ENABLED(tp)) { |
5029 | if (th->th_flags & TH_FIN) |
5030 | save_end++; |
5031 | tcp_update_sack_list(tp, save_start, save_end); |
5032 | } |
5033 | |
5034 | tcp_adaptive_rwtimo_check(tp, tlen); |
5035 | |
5036 | if (tlen > 0) |
5037 | tcp_tfo_rcv_data(tp); |
5038 | |
5039 | if (tp->t_flags & TF_DELACK) |
5040 | { |
5041 | #if INET6 |
5042 | if (isipv6) { |
5043 | KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport), |
5044 | (((ip6->ip6_src.s6_addr16[0]) << 16) | (ip6->ip6_dst.s6_addr16[0])), |
5045 | th->th_seq, th->th_ack, th->th_win); |
5046 | } |
5047 | else |
5048 | #endif |
5049 | { |
5050 | KERNEL_DEBUG(DBG_LAYER_END, ((th->th_dport << 16) | th->th_sport), |
5051 | (((ip->ip_src.s_addr & 0xffff) << 16) | (ip->ip_dst.s_addr & 0xffff)), |
5052 | th->th_seq, th->th_ack, th->th_win); |
5053 | } |
5054 | |
5055 | } |
5056 | } else { |
5057 | if ((so->so_flags & SOF_MP_SUBFLOW) && tlen == 0 && |
5058 | (m->m_pkthdr.pkt_flags & PKTF_MPTCP_DFIN) && |
5059 | (m->m_pkthdr.pkt_flags & PKTF_MPTCP)) { |
5060 | m_adj(m, drop_hdrlen); /* delayed header drop */ |
5061 | mptcp_input(tptomptp(tp)->mpt_mpte, m); |
5062 | tp->t_flags |= TF_ACKNOW; |
5063 | } else { |
5064 | m_freem(m); |
5065 | } |
5066 | thflags &= ~TH_FIN; |
5067 | } |
5068 | |
5069 | /* |
5070 | * If FIN is received ACK the FIN and let the user know |
5071 | * that the connection is closing. |
5072 | */ |
5073 | if (thflags & TH_FIN) { |
5074 | if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { |
5075 | socantrcvmore(so); |
5076 | postevent(so, 0, EV_FIN); |
5077 | /* |
5078 | * If connection is half-synchronized |
5079 | * (ie NEEDSYN flag on) then delay ACK, |
5080 | * so it may be piggybacked when SYN is sent. |
5081 | * Otherwise, since we received a FIN then no |
5082 | * more input can be expected, send ACK now. |
5083 | */ |
5084 | TCP_INC_VAR(tp->t_unacksegs, nlropkts); |
5085 | if (DELAY_ACK(tp, th) && (tp->t_flags & TF_NEEDSYN)) { |
5086 | if ((tp->t_flags & TF_DELACK) == 0) { |
5087 | tp->t_flags |= TF_DELACK; |
5088 | tp->t_timer[TCPT_DELACK] = OFFSET_FROM_START(tp, tcp_delack); |
5089 | } |
5090 | } else { |
5091 | tp->t_flags |= TF_ACKNOW; |
5092 | } |
5093 | tp->rcv_nxt++; |
5094 | } |
5095 | switch (tp->t_state) { |
5096 | |
5097 | /* |
5098 | * In SYN_RECEIVED and ESTABLISHED STATES |
5099 | * enter the CLOSE_WAIT state. |
5100 | */ |
5101 | case TCPS_SYN_RECEIVED: |
5102 | tp->t_starttime = tcp_now; |
5103 | case TCPS_ESTABLISHED: |
5104 | DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp, |
5105 | struct tcpcb *, tp, int32_t, TCPS_CLOSE_WAIT); |
5106 | tp->t_state = TCPS_CLOSE_WAIT; |
5107 | break; |
5108 | |
5109 | /* |
5110 | * If still in FIN_WAIT_1 STATE FIN has not been acked so |
5111 | * enter the CLOSING state. |
5112 | */ |
5113 | case TCPS_FIN_WAIT_1: |
5114 | DTRACE_TCP4(state__change, void, NULL, struct inpcb *, inp, |
5115 | struct tcpcb *, tp, int32_t, TCPS_CLOSING); |
5116 | tp->t_state = TCPS_CLOSING; |
5117 | break; |
5118 | |
5119 | /* |
5120 | * In FIN_WAIT_2 state enter the TIME_WAIT state, |
5121 | * starting the time-wait timer, turning off the other |
5122 | * standard timers. |
5123 | */ |
5124 | case TCPS_FIN_WAIT_2: |
5125 | DTRACE_TCP4(state__change, void, NULL, |
5126 | struct inpcb *, inp, |
5127 | struct tcpcb *, tp, |
5128 | int32_t, TCPS_TIME_WAIT); |
5129 | tp->t_state = TCPS_TIME_WAIT; |
5130 | tcp_canceltimers(tp); |
5131 | tp->t_flags |= TF_ACKNOW; |
5132 | if (tp->t_flagsext & TF_NOTIMEWAIT) { |
5133 | tp->t_flags |= TF_CLOSING; |
5134 | } else { |
5135 | add_to_time_wait(tp, 2 * tcp_msl); |
5136 | } |
5137 | soisdisconnected(so); |
5138 | break; |
5139 | |
5140 | /* |
5141 | * In TIME_WAIT state restart the 2 MSL time_wait timer. |
5142 | */ |
5143 | case TCPS_TIME_WAIT: |
5144 | add_to_time_wait(tp, 2 * tcp_msl); |
5145 | break; |
5146 | } |
5147 | } |
5148 | #if TCPDEBUG |
5149 | if (so->so_options & SO_DEBUG) |
5150 | tcp_trace(TA_INPUT, ostate, tp, (void *)tcp_saveipgen, |
5151 | &tcp_savetcp, 0); |
5152 | #endif |
5153 | |
5154 | /* |
5155 | * Return any desired output. |
5156 | */ |
5157 | if (needoutput || (tp->t_flags & TF_ACKNOW)) { |
5158 | (void) tcp_output(tp); |
5159 | } |
5160 | |
5161 | tcp_check_timer_state(tp); |
5162 | |
5163 | |
5164 | socket_unlock(so, 1); |
5165 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
5166 | return; |
5167 | |
5168 | dropafterack: |
5169 | /* |
5170 | * Generate an ACK dropping incoming segment if it occupies |
5171 | * sequence space, where the ACK reflects our state. |
5172 | * |
5173 | * We can now skip the test for the RST flag since all |
5174 | * paths to this code happen after packets containing |
5175 | * RST have been dropped. |
5176 | * |
5177 | * In the SYN-RECEIVED state, don't send an ACK unless the |
5178 | * segment we received passes the SYN-RECEIVED ACK test. |
5179 | * If it fails send a RST. This breaks the loop in the |
5180 | * "LAND" DoS attack, and also prevents an ACK storm |
5181 | * between two listening ports that have been sent forged |
5182 | * SYN segments, each with the source address of the other. |
5183 | */ |
5184 | if (tp->t_state == TCPS_SYN_RECEIVED && (thflags & TH_ACK) && |
5185 | (SEQ_GT(tp->snd_una, th->th_ack) || |
5186 | SEQ_GT(th->th_ack, tp->snd_max)) ) { |
5187 | rstreason = BANDLIM_RST_OPENPORT; |
5188 | IF_TCP_STATINC(ifp, dospacket); |
5189 | goto dropwithreset; |
5190 | } |
5191 | #if TCPDEBUG |
5192 | if (so->so_options & SO_DEBUG) |
5193 | tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, |
5194 | &tcp_savetcp, 0); |
5195 | #endif |
5196 | m_freem(m); |
5197 | tp->t_flags |= TF_ACKNOW; |
5198 | (void) tcp_output(tp); |
5199 | |
5200 | /* Don't need to check timer state as we should have done it during tcp_output */ |
5201 | socket_unlock(so, 1); |
5202 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
5203 | return; |
5204 | dropwithresetnosock: |
5205 | nosock = 1; |
5206 | dropwithreset: |
5207 | /* |
5208 | * Generate a RST, dropping incoming segment. |
5209 | * Make ACK acceptable to originator of segment. |
5210 | * Don't bother to respond if destination was broadcast/multicast. |
5211 | */ |
5212 | if ((thflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST)) |
5213 | goto drop; |
5214 | #if INET6 |
5215 | if (isipv6) { |
5216 | if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) || |
5217 | IN6_IS_ADDR_MULTICAST(&ip6->ip6_src)) |
5218 | goto drop; |
5219 | } else |
5220 | #endif /* INET6 */ |
5221 | if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) || |
5222 | IN_MULTICAST(ntohl(ip->ip_src.s_addr)) || |
5223 | ip->ip_src.s_addr == htonl(INADDR_BROADCAST) || |
5224 | in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif)) |
5225 | goto drop; |
5226 | /* IPv6 anycast check is done at tcp6_input() */ |
5227 | |
5228 | /* |
5229 | * Perform bandwidth limiting. |
5230 | */ |
5231 | #if ICMP_BANDLIM |
5232 | if (badport_bandlim(rstreason) < 0) |
5233 | goto drop; |
5234 | #endif |
5235 | |
5236 | #if TCPDEBUG |
5237 | if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) |
5238 | tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, |
5239 | &tcp_savetcp, 0); |
5240 | #endif |
5241 | bzero(&tra, sizeof(tra)); |
5242 | tra.ifscope = ifscope; |
5243 | tra.awdl_unrestricted = 1; |
5244 | tra.intcoproc_allowed = 1; |
5245 | if (thflags & TH_ACK) |
5246 | /* mtod() below is safe as long as hdr dropping is delayed */ |
5247 | tcp_respond(tp, mtod(m, void *), th, m, (tcp_seq)0, th->th_ack, |
5248 | TH_RST, &tra); |
5249 | else { |
5250 | if (thflags & TH_SYN) |
5251 | tlen++; |
5252 | /* mtod() below is safe as long as hdr dropping is delayed */ |
5253 | tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen, |
5254 | (tcp_seq)0, TH_RST|TH_ACK, &tra); |
5255 | } |
5256 | /* destroy temporarily created socket */ |
5257 | if (dropsocket) { |
5258 | (void) soabort(so); |
5259 | socket_unlock(so, 1); |
5260 | } else if ((inp != NULL) && (nosock == 0)) { |
5261 | socket_unlock(so, 1); |
5262 | } |
5263 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
5264 | return; |
5265 | dropnosock: |
5266 | nosock = 1; |
5267 | drop: |
5268 | /* |
5269 | * Drop space held by incoming segment and return. |
5270 | */ |
5271 | #if TCPDEBUG |
5272 | if (tp == 0 || (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) |
5273 | tcp_trace(TA_DROP, ostate, tp, (void *)tcp_saveipgen, |
5274 | &tcp_savetcp, 0); |
5275 | #endif |
5276 | m_freem(m); |
5277 | /* destroy temporarily created socket */ |
5278 | if (dropsocket) { |
5279 | (void) soabort(so); |
5280 | socket_unlock(so, 1); |
5281 | } |
5282 | else if (nosock == 0) { |
5283 | socket_unlock(so, 1); |
5284 | } |
5285 | KERNEL_DEBUG(DBG_FNC_TCP_INPUT | DBG_FUNC_END,0,0,0,0,0); |
5286 | return; |
5287 | } |
5288 | |
5289 | /* |
5290 | * Parse TCP options and place in tcpopt. |
5291 | */ |
5292 | static void |
5293 | tcp_dooptions(struct tcpcb *tp, u_char *cp, int cnt, struct tcphdr *th, |
5294 | struct tcpopt *to) |
5295 | { |
5296 | u_short mss = 0; |
5297 | int opt, optlen; |
5298 | |
5299 | for (; cnt > 0; cnt -= optlen, cp += optlen) { |
5300 | opt = cp[0]; |
5301 | if (opt == TCPOPT_EOL) |
5302 | break; |
5303 | if (opt == TCPOPT_NOP) |
5304 | optlen = 1; |
5305 | else { |
5306 | if (cnt < 2) |
5307 | break; |
5308 | optlen = cp[1]; |
5309 | if (optlen < 2 || optlen > cnt) |
5310 | break; |
5311 | } |
5312 | switch (opt) { |
5313 | |
5314 | default: |
5315 | continue; |
5316 | |
5317 | case TCPOPT_MAXSEG: |
5318 | if (optlen != TCPOLEN_MAXSEG) |
5319 | continue; |
5320 | if (!(th->th_flags & TH_SYN)) |
5321 | continue; |
5322 | bcopy((char *) cp + 2, (char *) &mss, sizeof(mss)); |
5323 | NTOHS(mss); |
5324 | to->to_mss = mss; |
5325 | to->to_flags |= TOF_MSS; |
5326 | break; |
5327 | |
5328 | case TCPOPT_WINDOW: |
5329 | if (optlen != TCPOLEN_WINDOW) |
5330 | continue; |
5331 | if (!(th->th_flags & TH_SYN)) |
5332 | continue; |
5333 | to->to_flags |= TOF_SCALE; |
5334 | to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT); |
5335 | break; |
5336 | |
5337 | case TCPOPT_TIMESTAMP: |
5338 | if (optlen != TCPOLEN_TIMESTAMP) |
5339 | continue; |
5340 | to->to_flags |= TOF_TS; |
5341 | bcopy((char *)cp + 2, |
5342 | (char *)&to->to_tsval, sizeof(to->to_tsval)); |
5343 | NTOHL(to->to_tsval); |
5344 | bcopy((char *)cp + 6, |
5345 | (char *)&to->to_tsecr, sizeof(to->to_tsecr)); |
5346 | NTOHL(to->to_tsecr); |
5347 | /* Re-enable sending Timestamps if we received them */ |
5348 | if (!(tp->t_flags & TF_REQ_TSTMP) && |
5349 | tcp_do_rfc1323 == 1) |
5350 | tp->t_flags |= TF_REQ_TSTMP; |
5351 | break; |
5352 | case TCPOPT_SACK_PERMITTED: |
5353 | if (!tcp_do_sack || |
5354 | optlen != TCPOLEN_SACK_PERMITTED) |
5355 | continue; |
5356 | if (th->th_flags & TH_SYN) |
5357 | to->to_flags |= TOF_SACK; |
5358 | break; |
5359 | case TCPOPT_SACK: |
5360 | if (optlen <= 2 || (optlen - 2) % TCPOLEN_SACK != 0) |
5361 | continue; |
5362 | to->to_nsacks = (optlen - 2) / TCPOLEN_SACK; |
5363 | to->to_sacks = cp + 2; |
5364 | tcpstat.tcps_sack_rcv_blocks++; |
5365 | |
5366 | break; |
5367 | case TCPOPT_FASTOPEN: |
5368 | if (optlen == TCPOLEN_FASTOPEN_REQ) { |
5369 | if (tp->t_state != TCPS_LISTEN) |
5370 | continue; |
5371 | |
5372 | to->to_flags |= TOF_TFOREQ; |
5373 | } else { |
5374 | if (optlen < TCPOLEN_FASTOPEN_REQ || |
5375 | (optlen - TCPOLEN_FASTOPEN_REQ) > TFO_COOKIE_LEN_MAX || |
5376 | (optlen - TCPOLEN_FASTOPEN_REQ) < TFO_COOKIE_LEN_MIN) |
5377 | continue; |
5378 | if (tp->t_state != TCPS_LISTEN && |
5379 | tp->t_state != TCPS_SYN_SENT) |
5380 | continue; |
5381 | |
5382 | to->to_flags |= TOF_TFO; |
5383 | to->to_tfo = cp + 1; |
5384 | } |
5385 | |
5386 | break; |
5387 | #if MPTCP |
5388 | case TCPOPT_MULTIPATH: |
5389 | tcp_do_mptcp_options(tp, cp, th, to, optlen); |
5390 | break; |
5391 | #endif /* MPTCP */ |
5392 | } |
5393 | } |
5394 | } |
5395 | |
5396 | static void |
5397 | tcp_finalize_options(struct tcpcb *tp, struct tcpopt *to, unsigned int ifscope) |
5398 | { |
5399 | if (to->to_flags & TOF_TS) { |
5400 | tp->t_flags |= TF_RCVD_TSTMP; |
5401 | tp->ts_recent = to->to_tsval; |
5402 | tp->ts_recent_age = tcp_now; |
5403 | |
5404 | } |
5405 | if (to->to_flags & TOF_MSS) |
5406 | tcp_mss(tp, to->to_mss, ifscope); |
5407 | if (SACK_ENABLED(tp)) { |
5408 | if (!(to->to_flags & TOF_SACK)) |
5409 | tp->t_flagsext &= ~(TF_SACK_ENABLE); |
5410 | else |
5411 | tp->t_flags |= TF_SACK_PERMIT; |
5412 | } |
5413 | if (to->to_flags & TOF_SCALE) { |
5414 | tp->t_flags |= TF_RCVD_SCALE; |
5415 | tp->requested_s_scale = to->to_requested_s_scale; |
5416 | |
5417 | /* Re-enable window scaling, if the option is received */ |
5418 | if (tp->request_r_scale > 0) |
5419 | tp->t_flags |= TF_REQ_SCALE; |
5420 | } |
5421 | } |
5422 | |
5423 | /* |
5424 | * Pull out of band byte out of a segment so |
5425 | * it doesn't appear in the user's data queue. |
5426 | * It is still reflected in the segment length for |
5427 | * sequencing purposes. |
5428 | * |
5429 | * @param off delayed to be droped hdrlen |
5430 | */ |
5431 | static void |
5432 | tcp_pulloutofband(struct socket *so, struct tcphdr *th, struct mbuf *m, int off) |
5433 | { |
5434 | int cnt = off + th->th_urp - 1; |
5435 | |
5436 | while (cnt >= 0) { |
5437 | if (m->m_len > cnt) { |
5438 | char *cp = mtod(m, caddr_t) + cnt; |
5439 | struct tcpcb *tp = sototcpcb(so); |
5440 | |
5441 | tp->t_iobc = *cp; |
5442 | tp->t_oobflags |= TCPOOB_HAVEDATA; |
5443 | bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1)); |
5444 | m->m_len--; |
5445 | if (m->m_flags & M_PKTHDR) |
5446 | m->m_pkthdr.len--; |
5447 | return; |
5448 | } |
5449 | cnt -= m->m_len; |
5450 | m = m->m_next; |
5451 | if (m == 0) |
5452 | break; |
5453 | } |
5454 | panic("tcp_pulloutofband" ); |
5455 | } |
5456 | |
5457 | uint32_t |
5458 | get_base_rtt(struct tcpcb *tp) |
5459 | { |
5460 | struct rtentry *rt = tp->t_inpcb->inp_route.ro_rt; |
5461 | return ((rt == NULL) ? 0 : rt->rtt_min); |
5462 | } |
5463 | |
5464 | /* Each value of RTT base represents the minimum RTT seen in a minute. |
5465 | * We keep upto N_RTT_BASE minutes worth of history. |
5466 | */ |
5467 | void |
5468 | update_base_rtt(struct tcpcb *tp, uint32_t rtt) |
5469 | { |
5470 | u_int32_t base_rtt, i; |
5471 | struct rtentry *rt; |
5472 | |
5473 | if ((rt = tp->t_inpcb->inp_route.ro_rt) == NULL) |
5474 | return; |
5475 | if (rt->rtt_expire_ts == 0) { |
5476 | RT_LOCK_SPIN(rt); |
5477 | if (rt->rtt_expire_ts != 0) { |
5478 | RT_UNLOCK(rt); |
5479 | goto update; |
5480 | } |
5481 | rt->rtt_expire_ts = tcp_now; |
5482 | rt->rtt_index = 0; |
5483 | rt->rtt_hist[0] = rtt; |
5484 | rt->rtt_min = rtt; |
5485 | RT_UNLOCK(rt); |
5486 | return; |
5487 | } |
5488 | update: |
5489 | #if TRAFFIC_MGT |
5490 | /* |
5491 | * If the recv side is being throttled, check if the |
5492 | * current RTT is closer to the base RTT seen in |
5493 | * first (recent) two slots. If so, unthrottle the stream. |
5494 | */ |
5495 | if ((tp->t_flagsext & TF_RECV_THROTTLE) && |
5496 | (int)(tcp_now - tp->t_recv_throttle_ts) >= TCP_RECV_THROTTLE_WIN) { |
5497 | base_rtt = rt->rtt_min; |
5498 | if (tp->t_rttcur <= (base_rtt + target_qdelay)) { |
5499 | tp->t_flagsext &= ~TF_RECV_THROTTLE; |
5500 | tp->t_recv_throttle_ts = 0; |
5501 | } |
5502 | } |
5503 | #endif /* TRAFFIC_MGT */ |
5504 | if ((int)(tcp_now - rt->rtt_expire_ts) >= |
5505 | TCP_RTT_HISTORY_EXPIRE_TIME) { |
5506 | RT_LOCK_SPIN(rt); |
5507 | /* check the condition again to avoid race */ |
5508 | if ((int)(tcp_now - rt->rtt_expire_ts) >= |
5509 | TCP_RTT_HISTORY_EXPIRE_TIME) { |
5510 | rt->rtt_index++; |
5511 | if (rt->rtt_index >= NRTT_HIST) |
5512 | rt->rtt_index = 0; |
5513 | rt->rtt_hist[rt->rtt_index] = rtt; |
5514 | rt->rtt_expire_ts = tcp_now; |
5515 | } else { |
5516 | rt->rtt_hist[rt->rtt_index] = |
5517 | min(rt->rtt_hist[rt->rtt_index], rtt); |
5518 | } |
5519 | /* forget the old value and update minimum */ |
5520 | rt->rtt_min = 0; |
5521 | for (i = 0; i < NRTT_HIST; ++i) { |
5522 | if (rt->rtt_hist[i] != 0 && |
5523 | (rt->rtt_min == 0 || |
5524 | rt->rtt_hist[i] < rt->rtt_min)) |
5525 | rt->rtt_min = rt->rtt_hist[i]; |
5526 | } |
5527 | RT_UNLOCK(rt); |
5528 | } else { |
5529 | rt->rtt_hist[rt->rtt_index] = |
5530 | min(rt->rtt_hist[rt->rtt_index], rtt); |
5531 | if (rt->rtt_min == 0) |
5532 | rt->rtt_min = rtt; |
5533 | else |
5534 | rt->rtt_min = min(rt->rtt_min, rtt); |
5535 | } |
5536 | } |
5537 | |
5538 | /* |
5539 | * If we have a timestamp reply, update smoothed RTT. If no timestamp is |
5540 | * present but transmit timer is running and timed sequence number was |
5541 | * acked, update smoothed RTT. |
5542 | * |
5543 | * If timestamps are supported, a receiver can update RTT even if |
5544 | * there is no outstanding data. |
5545 | * |
5546 | * Some boxes send broken timestamp replies during the SYN+ACK phase, |
5547 | * ignore timestamps of 0or we could calculate a huge RTT and blow up |
5548 | * the retransmit timer. |
5549 | */ |
5550 | static void |
5551 | tcp_compute_rtt(struct tcpcb *tp, struct tcpopt *to, struct tcphdr *th) |
5552 | { |
5553 | int rtt = 0; |
5554 | VERIFY(to != NULL && th != NULL); |
5555 | if (tp->t_rtttime != 0 && SEQ_GT(th->th_ack, tp->t_rtseq)) { |
5556 | u_int32_t pipe_ack_val; |
5557 | rtt = tcp_now - tp->t_rtttime; |
5558 | /* |
5559 | * Compute pipe ack -- the amount of data acknowledged |
5560 | * in the last RTT |
5561 | */ |
5562 | if (SEQ_GT(th->th_ack, tp->t_pipeack_lastuna)) { |
5563 | pipe_ack_val = th->th_ack - tp->t_pipeack_lastuna; |
5564 | /* Update the sample */ |
5565 | tp->t_pipeack_sample[tp->t_pipeack_ind++] = |
5566 | pipe_ack_val; |
5567 | tp->t_pipeack_ind %= TCP_PIPEACK_SAMPLE_COUNT; |
5568 | |
5569 | /* Compute the max of the pipeack samples */ |
5570 | pipe_ack_val = tcp_get_max_pipeack(tp); |
5571 | tp->t_pipeack = (pipe_ack_val > |
5572 | TCP_CC_CWND_INIT_BYTES) ? |
5573 | pipe_ack_val : 0; |
5574 | } |
5575 | /* start another measurement */ |
5576 | tp->t_rtttime = 0; |
5577 | } |
5578 | if (((to->to_flags & TOF_TS) != 0) && |
5579 | (to->to_tsecr != 0) && |
5580 | TSTMP_GEQ(tcp_now, to->to_tsecr)) { |
5581 | tcp_xmit_timer(tp, (tcp_now - to->to_tsecr), |
5582 | to->to_tsecr, th->th_ack); |
5583 | } else if (rtt > 0) { |
5584 | tcp_xmit_timer(tp, rtt, 0, th->th_ack); |
5585 | } |
5586 | } |
5587 | |
5588 | /* |
5589 | * Collect new round-trip time estimate and update averages and |
5590 | * current timeout. |
5591 | */ |
5592 | static void |
5593 | tcp_xmit_timer(struct tcpcb *tp, int rtt, |
5594 | u_int32_t tsecr, tcp_seq th_ack) |
5595 | { |
5596 | int delta; |
5597 | |
5598 | /* |
5599 | * On AWDL interface, the initial RTT measurement on SYN |
5600 | * can be wrong due to peer caching. Avoid the first RTT |
5601 | * measurement as it might skew up the RTO. |
5602 | * <rdar://problem/28739046> |
5603 | */ |
5604 | if (tp->t_inpcb->inp_last_outifp != NULL && |
5605 | (tp->t_inpcb->inp_last_outifp->if_eflags & IFEF_AWDL) && |
5606 | th_ack == tp->iss + 1) |
5607 | return; |
5608 | |
5609 | if (tp->t_flagsext & TF_RECOMPUTE_RTT) { |
5610 | if (SEQ_GT(th_ack, tp->snd_una) && |
5611 | SEQ_LEQ(th_ack, tp->snd_max) && |
5612 | (tsecr == 0 || |
5613 | TSTMP_GEQ(tsecr, tp->t_badrexmt_time))) { |
5614 | /* |
5615 | * We received a new ACk after a |
5616 | * spurious timeout. Adapt retransmission |
5617 | * timer as described in rfc 4015. |
5618 | */ |
5619 | tp->t_flagsext &= ~(TF_RECOMPUTE_RTT); |
5620 | tp->t_badrexmt_time = 0; |
5621 | tp->t_srtt = max(tp->t_srtt_prev, rtt); |
5622 | tp->t_srtt = tp->t_srtt << TCP_RTT_SHIFT; |
5623 | tp->t_rttvar = max(tp->t_rttvar_prev, (rtt >> 1)); |
5624 | tp->t_rttvar = tp->t_rttvar << TCP_RTTVAR_SHIFT; |
5625 | |
5626 | if (tp->t_rttbest > (tp->t_srtt + tp->t_rttvar)) |
5627 | tp->t_rttbest = tp->t_srtt + tp->t_rttvar; |
5628 | |
5629 | goto compute_rto; |
5630 | } else { |
5631 | return; |
5632 | } |
5633 | } |
5634 | |
5635 | tcpstat.tcps_rttupdated++; |
5636 | tp->t_rttupdated++; |
5637 | |
5638 | if (rtt > 0) { |
5639 | tp->t_rttcur = rtt; |
5640 | update_base_rtt(tp, rtt); |
5641 | } |
5642 | |
5643 | if (tp->t_srtt != 0) { |
5644 | /* |
5645 | * srtt is stored as fixed point with 5 bits after the |
5646 | * binary point (i.e., scaled by 32). The following magic |
5647 | * is equivalent to the smoothing algorithm in rfc793 with |
5648 | * an alpha of .875 (srtt = rtt/8 + srtt*7/8 in fixed |
5649 | * point). |
5650 | * |
5651 | * Freebsd adjusts rtt to origin 0 by subtracting 1 |
5652 | * from the provided rtt value. This was required because |
5653 | * of the way t_rtttime was initiailised to 1 before. |
5654 | * Since we changed t_rtttime to be based on |
5655 | * tcp_now, this extra adjustment is not needed. |
5656 | */ |
5657 | delta = (rtt << TCP_DELTA_SHIFT) |
5658 | - (tp->t_srtt >> (TCP_RTT_SHIFT - TCP_DELTA_SHIFT)); |
5659 | |
5660 | if ((tp->t_srtt += delta) <= 0) |
5661 | tp->t_srtt = 1; |
5662 | |
5663 | /* |
5664 | * We accumulate a smoothed rtt variance (actually, a |
5665 | * smoothed mean difference), then set the retransmit |
5666 | * timer to smoothed rtt + 4 times the smoothed variance. |
5667 | * rttvar is stored as fixed point with 4 bits after the |
5668 | * binary point (scaled by 16). The following is |
5669 | * equivalent to rfc793 smoothing with an alpha of .75 |
5670 | * (rttvar = rttvar*3/4 + |delta| / 4). This replaces |
5671 | * rfc793's wired-in beta. |
5672 | */ |
5673 | if (delta < 0) |
5674 | delta = -delta; |
5675 | delta -= tp->t_rttvar >> (TCP_RTTVAR_SHIFT - TCP_DELTA_SHIFT); |
5676 | if ((tp->t_rttvar += delta) <= 0) |
5677 | tp->t_rttvar = 1; |
5678 | if (tp->t_rttbest == 0 || |
5679 | tp->t_rttbest > (tp->t_srtt + tp->t_rttvar)) |
5680 | tp->t_rttbest = tp->t_srtt + tp->t_rttvar; |
5681 | } else { |
5682 | /* |
5683 | * No rtt measurement yet - use the unsmoothed rtt. |
5684 | * Set the variance to half the rtt (so our first |
5685 | * retransmit happens at 3*rtt). |
5686 | */ |
5687 | tp->t_srtt = rtt << TCP_RTT_SHIFT; |
5688 | tp->t_rttvar = rtt << (TCP_RTTVAR_SHIFT - 1); |
5689 | } |
5690 | |
5691 | compute_rto: |
5692 | nstat_route_rtt(tp->t_inpcb->inp_route.ro_rt, tp->t_srtt, |
5693 | tp->t_rttvar); |
5694 | |
5695 | /* |
5696 | * the retransmit should happen at rtt + 4 * rttvar. |
5697 | * Because of the way we do the smoothing, srtt and rttvar |
5698 | * will each average +1/2 tick of bias. When we compute |
5699 | * the retransmit timer, we want 1/2 tick of rounding and |
5700 | * 1 extra tick because of +-1/2 tick uncertainty in the |
5701 | * firing of the timer. The bias will give us exactly the |
5702 | * 1.5 tick we need. But, because the bias is |
5703 | * statistical, we have to test that we don't drop below |
5704 | * the minimum feasible timer (which is 2 ticks). |
5705 | */ |
5706 | TCPT_RANGESET(tp->t_rxtcur, TCP_REXMTVAL(tp), |
5707 | max(tp->t_rttmin, rtt + 2), TCPTV_REXMTMAX, |
5708 | TCP_ADD_REXMTSLOP(tp)); |
5709 | |
5710 | /* |
5711 | * We received an ack for a packet that wasn't retransmitted; |
5712 | * it is probably safe to discard any error indications we've |
5713 | * received recently. This isn't quite right, but close enough |
5714 | * for now (a route might have failed after we sent a segment, |
5715 | * and the return path might not be symmetrical). |
5716 | */ |
5717 | tp->t_softerror = 0; |
5718 | } |
5719 | |
5720 | static inline unsigned int |
5721 | tcp_maxmtu(struct rtentry *rt) |
5722 | { |
5723 | unsigned int maxmtu; |
5724 | int interface_mtu = 0; |
5725 | |
5726 | RT_LOCK_ASSERT_HELD(rt); |
5727 | interface_mtu = rt->rt_ifp->if_mtu; |
5728 | |
5729 | if (rt_key(rt)->sa_family == AF_INET && |
5730 | INTF_ADJUST_MTU_FOR_CLAT46(rt->rt_ifp)) { |
5731 | interface_mtu = IN6_LINKMTU(rt->rt_ifp); |
5732 | /* Further adjust the size for CLAT46 expansion */ |
5733 | interface_mtu -= CLAT46_HDR_EXPANSION_OVERHD; |
5734 | } |
5735 | |
5736 | if (rt->rt_rmx.rmx_mtu == 0) |
5737 | maxmtu = interface_mtu; |
5738 | else |
5739 | maxmtu = MIN(rt->rt_rmx.rmx_mtu, interface_mtu); |
5740 | |
5741 | return (maxmtu); |
5742 | } |
5743 | |
5744 | #if INET6 |
5745 | static inline unsigned int |
5746 | tcp_maxmtu6(struct rtentry *rt) |
5747 | { |
5748 | unsigned int maxmtu; |
5749 | struct nd_ifinfo *ndi = NULL; |
5750 | |
5751 | RT_LOCK_ASSERT_HELD(rt); |
5752 | if ((ndi = ND_IFINFO(rt->rt_ifp)) != NULL && !ndi->initialized) |
5753 | ndi = NULL; |
5754 | if (ndi != NULL) |
5755 | lck_mtx_lock(&ndi->lock); |
5756 | if (rt->rt_rmx.rmx_mtu == 0) |
5757 | maxmtu = IN6_LINKMTU(rt->rt_ifp); |
5758 | else |
5759 | maxmtu = MIN(rt->rt_rmx.rmx_mtu, IN6_LINKMTU(rt->rt_ifp)); |
5760 | if (ndi != NULL) |
5761 | lck_mtx_unlock(&ndi->lock); |
5762 | |
5763 | return (maxmtu); |
5764 | } |
5765 | #endif |
5766 | |
5767 | unsigned int |
5768 | get_maxmtu(struct rtentry *rt) |
5769 | { |
5770 | unsigned int maxmtu = 0; |
5771 | |
5772 | RT_LOCK_ASSERT_NOTHELD(rt); |
5773 | |
5774 | RT_LOCK(rt); |
5775 | |
5776 | if (rt_key(rt)->sa_family == AF_INET6) { |
5777 | maxmtu = tcp_maxmtu6(rt); |
5778 | } else { |
5779 | maxmtu = tcp_maxmtu(rt); |
5780 | } |
5781 | |
5782 | RT_UNLOCK(rt); |
5783 | |
5784 | return (maxmtu); |
5785 | } |
5786 | |
5787 | /* |
5788 | * Determine a reasonable value for maxseg size. |
5789 | * If the route is known, check route for mtu. |
5790 | * If none, use an mss that can be handled on the outgoing |
5791 | * interface without forcing IP to fragment; if bigger than |
5792 | * an mbuf cluster (MCLBYTES), round down to nearest multiple of MCLBYTES |
5793 | * to utilize large mbufs. If no route is found, route has no mtu, |
5794 | * or the destination isn't local, use a default, hopefully conservative |
5795 | * size (usually 512 or the default IP max size, but no more than the mtu |
5796 | * of the interface), as we can't discover anything about intervening |
5797 | * gateways or networks. We also initialize the congestion/slow start |
5798 | * window. While looking at the routing entry, we also initialize |
5799 | * other path-dependent parameters from pre-set or cached values |
5800 | * in the routing entry. |
5801 | * |
5802 | * Also take into account the space needed for options that we |
5803 | * send regularly. Make maxseg shorter by that amount to assure |
5804 | * that we can send maxseg amount of data even when the options |
5805 | * are present. Store the upper limit of the length of options plus |
5806 | * data in maxopd. |
5807 | * |
5808 | * NOTE that this routine is only called when we process an incoming |
5809 | * segment, for outgoing segments only tcp_mssopt is called. |
5810 | * |
5811 | */ |
5812 | void |
5813 | tcp_mss(struct tcpcb *tp, int offer, unsigned int input_ifscope) |
5814 | { |
5815 | struct rtentry *rt; |
5816 | struct ifnet *ifp; |
5817 | int rtt, mss; |
5818 | u_int32_t bufsize; |
5819 | struct inpcb *inp; |
5820 | struct socket *so; |
5821 | struct rmxp_tao *taop; |
5822 | int origoffer = offer; |
5823 | u_int32_t sb_max_corrected; |
5824 | int isnetlocal = 0; |
5825 | #if INET6 |
5826 | int isipv6; |
5827 | int min_protoh; |
5828 | #endif |
5829 | |
5830 | inp = tp->t_inpcb; |
5831 | #if INET6 |
5832 | isipv6 = ((inp->inp_vflag & INP_IPV6) != 0) ? 1 : 0; |
5833 | min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr) |
5834 | : sizeof (struct tcpiphdr); |
5835 | #else |
5836 | #define min_protoh (sizeof (struct tcpiphdr)) |
5837 | #endif |
5838 | |
5839 | #if INET6 |
5840 | if (isipv6) { |
5841 | rt = tcp_rtlookup6(inp, input_ifscope); |
5842 | } |
5843 | else |
5844 | #endif /* INET6 */ |
5845 | { |
5846 | rt = tcp_rtlookup(inp, input_ifscope); |
5847 | } |
5848 | isnetlocal = (tp->t_flags & TF_LOCAL); |
5849 | |
5850 | if (rt == NULL) { |
5851 | tp->t_maxopd = tp->t_maxseg = |
5852 | #if INET6 |
5853 | isipv6 ? tcp_v6mssdflt : |
5854 | #endif /* INET6 */ |
5855 | tcp_mssdflt; |
5856 | return; |
5857 | } |
5858 | ifp = rt->rt_ifp; |
5859 | /* |
5860 | * Slower link window correction: |
5861 | * If a value is specificied for slowlink_wsize use it for |
5862 | * PPP links believed to be on a serial modem (speed <128Kbps). |
5863 | * Excludes 9600bps as it is the default value adversized |
5864 | * by pseudo-devices over ppp. |
5865 | */ |
5866 | if (ifp->if_type == IFT_PPP && slowlink_wsize > 0 && |
5867 | ifp->if_baudrate > 9600 && ifp->if_baudrate <= 128000) { |
5868 | tp->t_flags |= TF_SLOWLINK; |
5869 | } |
5870 | so = inp->inp_socket; |
5871 | |
5872 | taop = rmx_taop(rt->rt_rmx); |
5873 | /* |
5874 | * Offer == -1 means that we didn't receive SYN yet, |
5875 | * use cached value in that case; |
5876 | */ |
5877 | if (offer == -1) |
5878 | offer = taop->tao_mssopt; |
5879 | /* |
5880 | * Offer == 0 means that there was no MSS on the SYN segment, |
5881 | * in this case we use tcp_mssdflt. |
5882 | */ |
5883 | if (offer == 0) |
5884 | offer = |
5885 | #if INET6 |
5886 | isipv6 ? tcp_v6mssdflt : |
5887 | #endif /* INET6 */ |
5888 | tcp_mssdflt; |
5889 | else { |
5890 | /* |
5891 | * Prevent DoS attack with too small MSS. Round up |
5892 | * to at least minmss. |
5893 | */ |
5894 | offer = max(offer, tcp_minmss); |
5895 | /* |
5896 | * Sanity check: make sure that maxopd will be large |
5897 | * enough to allow some data on segments even is the |
5898 | * all the option space is used (40bytes). Otherwise |
5899 | * funny things may happen in tcp_output. |
5900 | */ |
5901 | offer = max(offer, 64); |
5902 | } |
5903 | taop->tao_mssopt = offer; |
5904 | |
5905 | /* |
5906 | * While we're here, check if there's an initial rtt |
5907 | * or rttvar. Convert from the route-table units |
5908 | * to scaled multiples of the slow timeout timer. |
5909 | */ |
5910 | if (tp->t_srtt == 0 && (rtt = rt->rt_rmx.rmx_rtt) != 0) { |
5911 | tcp_getrt_rtt(tp, rt); |
5912 | } else { |
5913 | tp->t_rttmin = isnetlocal ? tcp_TCPTV_MIN : TCPTV_REXMTMIN; |
5914 | } |
5915 | |
5916 | #if INET6 |
5917 | mss = (isipv6 ? tcp_maxmtu6(rt) : tcp_maxmtu(rt)); |
5918 | #else |
5919 | mss = tcp_maxmtu(rt); |
5920 | #endif |
5921 | |
5922 | #if NECP |
5923 | // At this point, the mss is just the MTU. Adjust if necessary. |
5924 | mss = necp_socket_get_effective_mtu(inp, mss); |
5925 | #endif /* NECP */ |
5926 | |
5927 | mss -= min_protoh; |
5928 | |
5929 | if (rt->rt_rmx.rmx_mtu == 0) { |
5930 | #if INET6 |
5931 | if (isipv6) { |
5932 | if (!isnetlocal) |
5933 | mss = min(mss, tcp_v6mssdflt); |
5934 | } else |
5935 | #endif /* INET6 */ |
5936 | if (!isnetlocal) |
5937 | mss = min(mss, tcp_mssdflt); |
5938 | } |
5939 | |
5940 | mss = min(mss, offer); |
5941 | /* |
5942 | * maxopd stores the maximum length of data AND options |
5943 | * in a segment; maxseg is the amount of data in a normal |
5944 | * segment. We need to store this value (maxopd) apart |
5945 | * from maxseg, because now every segment carries options |
5946 | * and thus we normally have somewhat less data in segments. |
5947 | */ |
5948 | tp->t_maxopd = mss; |
5949 | |
5950 | /* |
5951 | * origoffer==-1 indicates, that no segments were received yet. |
5952 | * In this case we just guess. |
5953 | */ |
5954 | if ((tp->t_flags & (TF_REQ_TSTMP|TF_NOOPT)) == TF_REQ_TSTMP && |
5955 | (origoffer == -1 || |
5956 | (tp->t_flags & TF_RCVD_TSTMP) == TF_RCVD_TSTMP)) |
5957 | mss -= TCPOLEN_TSTAMP_APPA; |
5958 | |
5959 | #if MPTCP |
5960 | mss -= mptcp_adj_mss(tp, FALSE); |
5961 | #endif /* MPTCP */ |
5962 | tp->t_maxseg = mss; |
5963 | |
5964 | /* |
5965 | * Calculate corrected value for sb_max; ensure to upgrade the |
5966 | * numerator for large sb_max values else it will overflow. |
5967 | */ |
5968 | sb_max_corrected = (sb_max * (u_int64_t)MCLBYTES) / (MSIZE + MCLBYTES); |
5969 | |
5970 | /* |
5971 | * If there's a pipesize (ie loopback), change the socket |
5972 | * buffer to that size only if it's bigger than the current |
5973 | * sockbuf size. Make the socket buffers an integral |
5974 | * number of mss units; if the mss is larger than |
5975 | * the socket buffer, decrease the mss. |
5976 | */ |
5977 | #if RTV_SPIPE |
5978 | bufsize = rt->rt_rmx.rmx_sendpipe; |
5979 | if (bufsize < so->so_snd.sb_hiwat) |
5980 | #endif |
5981 | bufsize = so->so_snd.sb_hiwat; |
5982 | if (bufsize < mss) |
5983 | mss = bufsize; |
5984 | else { |
5985 | bufsize = (((bufsize + (u_int64_t)mss - 1) / (u_int64_t)mss) * (u_int64_t)mss); |
5986 | if (bufsize > sb_max_corrected) |
5987 | bufsize = sb_max_corrected; |
5988 | (void)sbreserve(&so->so_snd, bufsize); |
5989 | } |
5990 | tp->t_maxseg = mss; |
5991 | |
5992 | ASSERT(tp->t_maxseg); |
5993 | |
5994 | /* |
5995 | * Update MSS using recommendation from link status report. This is |
5996 | * temporary |
5997 | */ |
5998 | tcp_update_mss_locked(so, ifp); |
5999 | |
6000 | #if RTV_RPIPE |
6001 | bufsize = rt->rt_rmx.rmx_recvpipe; |
6002 | if (bufsize < so->so_rcv.sb_hiwat) |
6003 | #endif |
6004 | bufsize = so->so_rcv.sb_hiwat; |
6005 | if (bufsize > mss) { |
6006 | bufsize = (((bufsize + (u_int64_t)mss - 1) / (u_int64_t)mss) * (u_int64_t)mss); |
6007 | if (bufsize > sb_max_corrected) |
6008 | bufsize = sb_max_corrected; |
6009 | (void)sbreserve(&so->so_rcv, bufsize); |
6010 | } |
6011 | |
6012 | set_tcp_stream_priority(so); |
6013 | |
6014 | if (rt->rt_rmx.rmx_ssthresh) { |
6015 | /* |
6016 | * There's some sort of gateway or interface |
6017 | * buffer limit on the path. Use this to set |
6018 | * slow-start threshold, but set the threshold to |
6019 | * no less than 2*mss. |
6020 | */ |
6021 | tp->snd_ssthresh = max(2 * mss, rt->rt_rmx.rmx_ssthresh); |
6022 | tcpstat.tcps_usedssthresh++; |
6023 | } else { |
6024 | tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT; |
6025 | } |
6026 | |
6027 | /* |
6028 | * Set the slow-start flight size depending on whether this |
6029 | * is a local network or not. |
6030 | */ |
6031 | if (CC_ALGO(tp)->cwnd_init != NULL) |
6032 | CC_ALGO(tp)->cwnd_init(tp); |
6033 | |
6034 | tcp_ccdbg_trace(tp, NULL, TCP_CC_CWND_INIT); |
6035 | |
6036 | /* Route locked during lookup above */ |
6037 | RT_UNLOCK(rt); |
6038 | } |
6039 | |
6040 | /* |
6041 | * Determine the MSS option to send on an outgoing SYN. |
6042 | */ |
6043 | int |
6044 | tcp_mssopt(struct tcpcb *tp) |
6045 | { |
6046 | struct rtentry *rt; |
6047 | int mss; |
6048 | #if INET6 |
6049 | int isipv6; |
6050 | int min_protoh; |
6051 | #endif |
6052 | |
6053 | #if INET6 |
6054 | isipv6 = ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) ? 1 : 0; |
6055 | min_protoh = isipv6 ? sizeof (struct ip6_hdr) + sizeof (struct tcphdr) |
6056 | : sizeof (struct tcpiphdr); |
6057 | #else |
6058 | #define min_protoh (sizeof (struct tcpiphdr)) |
6059 | #endif |
6060 | |
6061 | #if INET6 |
6062 | if (isipv6) |
6063 | rt = tcp_rtlookup6(tp->t_inpcb, IFSCOPE_NONE); |
6064 | else |
6065 | #endif /* INET6 */ |
6066 | rt = tcp_rtlookup(tp->t_inpcb, IFSCOPE_NONE); |
6067 | if (rt == NULL) { |
6068 | return ( |
6069 | #if INET6 |
6070 | isipv6 ? tcp_v6mssdflt : |
6071 | #endif /* INET6 */ |
6072 | tcp_mssdflt); |
6073 | } |
6074 | /* |
6075 | * Slower link window correction: |
6076 | * If a value is specificied for slowlink_wsize use it for PPP links |
6077 | * believed to be on a serial modem (speed <128Kbps). Excludes 9600bps as |
6078 | * it is the default value adversized by pseudo-devices over ppp. |
6079 | */ |
6080 | if (rt->rt_ifp->if_type == IFT_PPP && slowlink_wsize > 0 && |
6081 | rt->rt_ifp->if_baudrate > 9600 && rt->rt_ifp->if_baudrate <= 128000) { |
6082 | tp->t_flags |= TF_SLOWLINK; |
6083 | } |
6084 | |
6085 | #if INET6 |
6086 | mss = (isipv6 ? tcp_maxmtu6(rt) : tcp_maxmtu(rt)); |
6087 | #else |
6088 | mss = tcp_maxmtu(rt); |
6089 | #endif |
6090 | /* Route locked during lookup above */ |
6091 | RT_UNLOCK(rt); |
6092 | |
6093 | #if NECP |
6094 | // At this point, the mss is just the MTU. Adjust if necessary. |
6095 | mss = necp_socket_get_effective_mtu(tp->t_inpcb, mss); |
6096 | #endif /* NECP */ |
6097 | |
6098 | return (mss - min_protoh); |
6099 | } |
6100 | |
6101 | /* |
6102 | * On a partial ack arrives, force the retransmission of the |
6103 | * next unacknowledged segment. Do not clear tp->t_dupacks. |
6104 | * By setting snd_nxt to th_ack, this forces retransmission timer to |
6105 | * be started again. |
6106 | */ |
6107 | static void |
6108 | tcp_newreno_partial_ack(struct tcpcb *tp, struct tcphdr *th) |
6109 | { |
6110 | tcp_seq onxt = tp->snd_nxt; |
6111 | u_int32_t ocwnd = tp->snd_cwnd; |
6112 | tp->t_timer[TCPT_REXMT] = 0; |
6113 | tp->t_timer[TCPT_PTO] = 0; |
6114 | tp->t_rtttime = 0; |
6115 | tp->snd_nxt = th->th_ack; |
6116 | /* |
6117 | * Set snd_cwnd to one segment beyond acknowledged offset |
6118 | * (tp->snd_una has not yet been updated when this function |
6119 | * is called) |
6120 | */ |
6121 | tp->snd_cwnd = tp->t_maxseg + BYTES_ACKED(th, tp); |
6122 | tp->t_flags |= TF_ACKNOW; |
6123 | (void) tcp_output(tp); |
6124 | tp->snd_cwnd = ocwnd; |
6125 | if (SEQ_GT(onxt, tp->snd_nxt)) |
6126 | tp->snd_nxt = onxt; |
6127 | /* |
6128 | * Partial window deflation. Relies on fact that tp->snd_una |
6129 | * not updated yet. |
6130 | */ |
6131 | if (tp->snd_cwnd > BYTES_ACKED(th, tp)) |
6132 | tp->snd_cwnd -= BYTES_ACKED(th, tp); |
6133 | else |
6134 | tp->snd_cwnd = 0; |
6135 | tp->snd_cwnd += tp->t_maxseg; |
6136 | } |
6137 | |
6138 | /* |
6139 | * Drop a random TCP connection that hasn't been serviced yet and |
6140 | * is eligible for discard. There is a one in qlen chance that |
6141 | * we will return a null, saying that there are no dropable |
6142 | * requests. In this case, the protocol specific code should drop |
6143 | * the new request. This insures fairness. |
6144 | * |
6145 | * The listening TCP socket "head" must be locked |
6146 | */ |
6147 | static int |
6148 | tcp_dropdropablreq(struct socket *head) |
6149 | { |
6150 | struct socket *so, *sonext; |
6151 | unsigned int i, j, qlen; |
6152 | static u_int32_t rnd = 0; |
6153 | static u_int64_t old_runtime; |
6154 | static unsigned int cur_cnt, old_cnt; |
6155 | u_int64_t now_sec; |
6156 | struct inpcb *inp = NULL; |
6157 | struct tcpcb *tp; |
6158 | |
6159 | if ((head->so_options & SO_ACCEPTCONN) == 0) |
6160 | return (0); |
6161 | |
6162 | if (TAILQ_EMPTY(&head->so_incomp)) |
6163 | return (0); |
6164 | |
6165 | so_acquire_accept_list(head, NULL); |
6166 | socket_unlock(head, 0); |
6167 | |
6168 | /* |
6169 | * Check if there is any socket in the incomp queue |
6170 | * that is closed because of a reset from the peer and is |
6171 | * waiting to be garbage collected. If so, pick that as |
6172 | * the victim |
6173 | */ |
6174 | TAILQ_FOREACH_SAFE(so, &head->so_incomp, so_list, sonext) { |
6175 | inp = sotoinpcb(so); |
6176 | tp = intotcpcb(inp); |
6177 | if (tp != NULL && tp->t_state == TCPS_CLOSED && |
6178 | so->so_head != NULL && |
6179 | (so->so_state & (SS_INCOMP|SS_CANTSENDMORE|SS_CANTRCVMORE)) == |
6180 | (SS_INCOMP|SS_CANTSENDMORE|SS_CANTRCVMORE)) { |
6181 | /* |
6182 | * The listen socket is already locked but we |
6183 | * can lock this socket here without lock ordering |
6184 | * issues because it is in the incomp queue and |
6185 | * is not visible to others. |
6186 | */ |
6187 | if (socket_try_lock(so)) { |
6188 | so->so_usecount++; |
6189 | goto found_victim; |
6190 | } else { |
6191 | continue; |
6192 | } |
6193 | } |
6194 | } |
6195 | |
6196 | so = TAILQ_FIRST(&head->so_incomp); |
6197 | |
6198 | now_sec = net_uptime(); |
6199 | if ((i = (now_sec - old_runtime)) != 0) { |
6200 | old_runtime = now_sec; |
6201 | old_cnt = cur_cnt / i; |
6202 | cur_cnt = 0; |
6203 | } |
6204 | |
6205 | qlen = head->so_incqlen; |
6206 | if (rnd == 0) |
6207 | rnd = RandomULong(); |
6208 | |
6209 | if (++cur_cnt > qlen || old_cnt > qlen) { |
6210 | rnd = (314159 * rnd + 66329) & 0xffff; |
6211 | j = ((qlen + 1) * rnd) >> 16; |
6212 | |
6213 | while (j-- && so) |
6214 | so = TAILQ_NEXT(so, so_list); |
6215 | } |
6216 | /* Find a connection that is not already closing (or being served) */ |
6217 | while (so) { |
6218 | inp = (struct inpcb *)so->so_pcb; |
6219 | |
6220 | sonext = TAILQ_NEXT(so, so_list); |
6221 | |
6222 | if (in_pcb_checkstate(inp, WNT_ACQUIRE, 0) != WNT_STOPUSING) { |
6223 | /* |
6224 | * Avoid the issue of a socket being accepted |
6225 | * by one input thread and being dropped by |
6226 | * another input thread. If we can't get a hold |
6227 | * on this mutex, then grab the next socket in |
6228 | * line. |
6229 | */ |
6230 | if (socket_try_lock(so)) { |
6231 | so->so_usecount++; |
6232 | if ((so->so_usecount == 2) && |
6233 | (so->so_state & SS_INCOMP) && |
6234 | !(so->so_flags & SOF_INCOMP_INPROGRESS)) { |
6235 | break; |
6236 | } else { |
6237 | /* |
6238 | * don't use if being accepted or |
6239 | * used in any other way |
6240 | */ |
6241 | in_pcb_checkstate(inp, WNT_RELEASE, 1); |
6242 | socket_unlock(so, 1); |
6243 | } |
6244 | } else { |
6245 | /* |
6246 | * do not try to lock the inp in |
6247 | * in_pcb_checkstate because the lock |
6248 | * is already held in some other thread. |
6249 | * Only drop the inp_wntcnt reference. |
6250 | */ |
6251 | in_pcb_checkstate(inp, WNT_RELEASE, 1); |
6252 | } |
6253 | } |
6254 | so = sonext; |
6255 | } |
6256 | if (so == NULL) { |
6257 | socket_lock(head, 0); |
6258 | so_release_accept_list(head); |
6259 | return (0); |
6260 | } |
6261 | |
6262 | /* Makes sure socket is still in the right state to be discarded */ |
6263 | |
6264 | if (in_pcb_checkstate(inp, WNT_RELEASE, 1) == WNT_STOPUSING) { |
6265 | socket_unlock(so, 1); |
6266 | socket_lock(head, 0); |
6267 | so_release_accept_list(head); |
6268 | return (0); |
6269 | } |
6270 | |
6271 | found_victim: |
6272 | if (so->so_usecount != 2 || !(so->so_state & SS_INCOMP)) { |
6273 | /* do not discard: that socket is being accepted */ |
6274 | socket_unlock(so, 1); |
6275 | socket_lock(head, 0); |
6276 | so_release_accept_list(head); |
6277 | return (0); |
6278 | } |
6279 | |
6280 | socket_lock(head, 0); |
6281 | TAILQ_REMOVE(&head->so_incomp, so, so_list); |
6282 | head->so_incqlen--; |
6283 | head->so_qlen--; |
6284 | so->so_state &= ~SS_INCOMP; |
6285 | so->so_flags |= SOF_OVERFLOW; |
6286 | so->so_head = NULL; |
6287 | so_release_accept_list(head); |
6288 | socket_unlock(head, 0); |
6289 | |
6290 | socket_lock_assert_owned(so); |
6291 | tp = sototcpcb(so); |
6292 | |
6293 | tcp_close(tp); |
6294 | if (inp->inp_wantcnt > 0 && inp->inp_wantcnt != WNT_STOPUSING) { |
6295 | /* |
6296 | * Some one has a wantcnt on this pcb. Since WNT_ACQUIRE |
6297 | * doesn't require a lock, it could have happened while |
6298 | * we are holding the lock. This pcb will have to |
6299 | * be garbage collected later. |
6300 | * Release the reference held for so_incomp queue |
6301 | */ |
6302 | VERIFY(so->so_usecount > 0); |
6303 | so->so_usecount--; |
6304 | socket_unlock(so, 1); |
6305 | } else { |
6306 | /* |
6307 | * Unlock this socket and leave the reference on. |
6308 | * We need to acquire the pcbinfo lock in order to |
6309 | * fully dispose it off |
6310 | */ |
6311 | socket_unlock(so, 0); |
6312 | |
6313 | lck_rw_lock_exclusive(tcbinfo.ipi_lock); |
6314 | |
6315 | socket_lock(so, 0); |
6316 | /* Release the reference held for so_incomp queue */ |
6317 | VERIFY(so->so_usecount > 0); |
6318 | so->so_usecount--; |
6319 | |
6320 | if (so->so_usecount != 1 || |
6321 | (inp->inp_wantcnt > 0 && |
6322 | inp->inp_wantcnt != WNT_STOPUSING)) { |
6323 | /* |
6324 | * There is an extra wantcount or usecount |
6325 | * that must have been added when the socket |
6326 | * was unlocked. This socket will have to be |
6327 | * garbage collected later |
6328 | */ |
6329 | socket_unlock(so, 1); |
6330 | } else { |
6331 | /* Drop the reference held for this function */ |
6332 | VERIFY(so->so_usecount > 0); |
6333 | so->so_usecount--; |
6334 | |
6335 | in_pcbdispose(inp); |
6336 | } |
6337 | lck_rw_done(tcbinfo.ipi_lock); |
6338 | } |
6339 | tcpstat.tcps_drops++; |
6340 | |
6341 | socket_lock(head, 0); |
6342 | return(1); |
6343 | } |
6344 | |
6345 | /* Set background congestion control on a socket */ |
6346 | void |
6347 | tcp_set_background_cc(struct socket *so) |
6348 | { |
6349 | tcp_set_new_cc(so, TCP_CC_ALGO_BACKGROUND_INDEX); |
6350 | } |
6351 | |
6352 | /* Set foreground congestion control on a socket */ |
6353 | void |
6354 | tcp_set_foreground_cc(struct socket *so) |
6355 | { |
6356 | if (tcp_use_newreno) |
6357 | tcp_set_new_cc(so, TCP_CC_ALGO_NEWRENO_INDEX); |
6358 | else |
6359 | tcp_set_new_cc(so, TCP_CC_ALGO_CUBIC_INDEX); |
6360 | } |
6361 | |
6362 | static void |
6363 | tcp_set_new_cc(struct socket *so, uint16_t cc_index) |
6364 | { |
6365 | struct inpcb *inp = sotoinpcb(so); |
6366 | struct tcpcb *tp = intotcpcb(inp); |
6367 | u_char old_cc_index = 0; |
6368 | if (tp->tcp_cc_index != cc_index) { |
6369 | |
6370 | old_cc_index = tp->tcp_cc_index; |
6371 | |
6372 | if (CC_ALGO(tp)->cleanup != NULL) |
6373 | CC_ALGO(tp)->cleanup(tp); |
6374 | tp->tcp_cc_index = cc_index; |
6375 | |
6376 | tcp_cc_allocate_state(tp); |
6377 | |
6378 | if (CC_ALGO(tp)->switch_to != NULL) |
6379 | CC_ALGO(tp)->switch_to(tp, old_cc_index); |
6380 | |
6381 | tcp_ccdbg_trace(tp, NULL, TCP_CC_CHANGE_ALGO); |
6382 | } |
6383 | } |
6384 | |
6385 | void |
6386 | tcp_set_recv_bg(struct socket *so) |
6387 | { |
6388 | if (!IS_TCP_RECV_BG(so)) |
6389 | so->so_flags1 |= SOF1_TRAFFIC_MGT_TCP_RECVBG; |
6390 | |
6391 | /* Unset Large Receive Offload on background sockets */ |
6392 | so_set_lro(so, SO_TC_BK); |
6393 | } |
6394 | |
6395 | void |
6396 | tcp_clear_recv_bg(struct socket *so) |
6397 | { |
6398 | if (IS_TCP_RECV_BG(so)) |
6399 | so->so_flags1 &= ~(SOF1_TRAFFIC_MGT_TCP_RECVBG); |
6400 | |
6401 | /* |
6402 | * Set/unset use of Large Receive Offload depending on |
6403 | * the traffic class |
6404 | */ |
6405 | so_set_lro(so, so->so_traffic_class); |
6406 | } |
6407 | |
6408 | void |
6409 | inp_fc_unthrottle_tcp(struct inpcb *inp) |
6410 | { |
6411 | struct tcpcb *tp = inp->inp_ppcb; |
6412 | /* |
6413 | * Back off the slow-start threshold and enter |
6414 | * congestion avoidance phase |
6415 | */ |
6416 | if (CC_ALGO(tp)->pre_fr != NULL) |
6417 | CC_ALGO(tp)->pre_fr(tp); |
6418 | |
6419 | tp->snd_cwnd = tp->snd_ssthresh; |
6420 | tp->t_flagsext &= ~TF_CWND_NONVALIDATED; |
6421 | /* |
6422 | * Restart counting for ABC as we changed the |
6423 | * congestion window just now. |
6424 | */ |
6425 | tp->t_bytes_acked = 0; |
6426 | |
6427 | /* Reset retransmit shift as we know that the reason |
6428 | * for delay in sending a packet is due to flow |
6429 | * control on the outgoing interface. There is no need |
6430 | * to backoff retransmit timer. |
6431 | */ |
6432 | TCP_RESET_REXMT_STATE(tp); |
6433 | |
6434 | /* |
6435 | * Start the output stream again. Since we are |
6436 | * not retransmitting data, do not reset the |
6437 | * retransmit timer or rtt calculation. |
6438 | */ |
6439 | tcp_output(tp); |
6440 | } |
6441 | |
6442 | static int |
6443 | tcp_getstat SYSCTL_HANDLER_ARGS |
6444 | { |
6445 | #pragma unused(oidp, arg1, arg2) |
6446 | |
6447 | int error; |
6448 | struct tcpstat *stat; |
6449 | stat = &tcpstat; |
6450 | #if !CONFIG_EMBEDDED |
6451 | proc_t caller = PROC_NULL; |
6452 | proc_t caller_parent = PROC_NULL; |
6453 | char command_name[MAXCOMLEN + 1] = "" ; |
6454 | char parent_name[MAXCOMLEN + 1] = "" ; |
6455 | struct tcpstat zero_stat; |
6456 | if ((caller = proc_self()) != PROC_NULL) { |
6457 | /* get process name */ |
6458 | strlcpy(command_name, caller->p_comm, sizeof(command_name)); |
6459 | |
6460 | /* get parent process name if possible */ |
6461 | if ((caller_parent = proc_find(caller->p_ppid)) != PROC_NULL) { |
6462 | strlcpy(parent_name, caller_parent->p_comm, |
6463 | sizeof(parent_name)); |
6464 | proc_rele(caller_parent); |
6465 | } |
6466 | |
6467 | if ((escape_str(command_name, strlen(command_name) + 1, |
6468 | sizeof(command_name)) == 0) && |
6469 | (escape_str(parent_name, strlen(parent_name) + 1, |
6470 | sizeof(parent_name)) == 0)) { |
6471 | kern_asl_msg(LOG_DEBUG, "messagetracer" , |
6472 | 5, |
6473 | "com.apple.message.domain" , |
6474 | "com.apple.kernel.tcpstat" , /* 1 */ |
6475 | "com.apple.message.signature" , |
6476 | "tcpstat" , /* 2 */ |
6477 | "com.apple.message.signature2" , command_name, /* 3 */ |
6478 | "com.apple.message.signature3" , parent_name, /* 4 */ |
6479 | "com.apple.message.summarize" , "YES" , /* 5 */ |
6480 | NULL); |
6481 | } |
6482 | } |
6483 | if (caller != PROC_NULL) |
6484 | proc_rele(caller); |
6485 | if (tcp_disable_access_to_stats && |
6486 | !kauth_cred_issuser(kauth_cred_get())) { |
6487 | bzero(&zero_stat, sizeof(zero_stat)); |
6488 | stat = &zero_stat; |
6489 | } |
6490 | |
6491 | #endif /* !CONFIG_EMBEDDED */ |
6492 | |
6493 | if (req->oldptr == 0) { |
6494 | req->oldlen= (size_t)sizeof(struct tcpstat); |
6495 | } |
6496 | |
6497 | error = SYSCTL_OUT(req, stat, MIN(sizeof (tcpstat), req->oldlen)); |
6498 | |
6499 | return (error); |
6500 | |
6501 | } |
6502 | |
6503 | /* |
6504 | * Checksum extended TCP header and data. |
6505 | */ |
6506 | int |
6507 | tcp_input_checksum(int af, struct mbuf *m, struct tcphdr *th, int off, int tlen) |
6508 | { |
6509 | struct ifnet *ifp = m->m_pkthdr.rcvif; |
6510 | |
6511 | switch (af) { |
6512 | case AF_INET: { |
6513 | struct ip *ip = mtod(m, struct ip *); |
6514 | struct ipovly *ipov = (struct ipovly *)ip; |
6515 | |
6516 | if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_DID_CSUM) |
6517 | return (0); |
6518 | |
6519 | /* ip_stripoptions() must have been called before we get here */ |
6520 | ASSERT((ip->ip_hl << 2) == sizeof (*ip)); |
6521 | |
6522 | if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) || |
6523 | (m->m_pkthdr.pkt_flags & PKTF_LOOP)) && |
6524 | (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) { |
6525 | if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) { |
6526 | th->th_sum = m->m_pkthdr.csum_rx_val; |
6527 | } else { |
6528 | uint32_t sum = m->m_pkthdr.csum_rx_val; |
6529 | uint32_t start = m->m_pkthdr.csum_rx_start; |
6530 | int32_t trailer = (m_pktlen(m) - (off + tlen)); |
6531 | |
6532 | /* |
6533 | * Perform 1's complement adjustment of octets |
6534 | * that got included/excluded in the hardware- |
6535 | * calculated checksum value. Ignore cases |
6536 | * where the value already includes the entire |
6537 | * IP header span, as the sum for those octets |
6538 | * would already be 0 by the time we get here; |
6539 | * IP has already performed its header checksum |
6540 | * checks. If we do need to adjust, restore |
6541 | * the original fields in the IP header when |
6542 | * computing the adjustment value. Also take |
6543 | * care of any trailing bytes and subtract out |
6544 | * their partial sum. |
6545 | */ |
6546 | ASSERT(trailer >= 0); |
6547 | if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) && |
6548 | ((start != 0 && start != off) || trailer)) { |
6549 | uint32_t swbytes = (uint32_t)trailer; |
6550 | |
6551 | if (start < off) { |
6552 | ip->ip_len += sizeof (*ip); |
6553 | #if BYTE_ORDER != BIG_ENDIAN |
6554 | HTONS(ip->ip_len); |
6555 | HTONS(ip->ip_off); |
6556 | #endif /* BYTE_ORDER != BIG_ENDIAN */ |
6557 | } |
6558 | /* callee folds in sum */ |
6559 | sum = m_adj_sum16(m, start, off, |
6560 | tlen, sum); |
6561 | if (off > start) |
6562 | swbytes += (off - start); |
6563 | else |
6564 | swbytes += (start - off); |
6565 | |
6566 | if (start < off) { |
6567 | #if BYTE_ORDER != BIG_ENDIAN |
6568 | NTOHS(ip->ip_off); |
6569 | NTOHS(ip->ip_len); |
6570 | #endif /* BYTE_ORDER != BIG_ENDIAN */ |
6571 | ip->ip_len -= sizeof (*ip); |
6572 | } |
6573 | |
6574 | if (swbytes != 0) |
6575 | tcp_in_cksum_stats(swbytes); |
6576 | if (trailer != 0) |
6577 | m_adj(m, -trailer); |
6578 | } |
6579 | |
6580 | /* callee folds in sum */ |
6581 | th->th_sum = in_pseudo(ip->ip_src.s_addr, |
6582 | ip->ip_dst.s_addr, |
6583 | sum + htonl(tlen + IPPROTO_TCP)); |
6584 | } |
6585 | th->th_sum ^= 0xffff; |
6586 | } else { |
6587 | uint16_t ip_sum; |
6588 | int len; |
6589 | char b[9]; |
6590 | |
6591 | bcopy(ipov->ih_x1, b, sizeof (ipov->ih_x1)); |
6592 | bzero(ipov->ih_x1, sizeof (ipov->ih_x1)); |
6593 | ip_sum = ipov->ih_len; |
6594 | ipov->ih_len = (u_short)tlen; |
6595 | #if BYTE_ORDER != BIG_ENDIAN |
6596 | HTONS(ipov->ih_len); |
6597 | #endif |
6598 | len = sizeof (struct ip) + tlen; |
6599 | th->th_sum = in_cksum(m, len); |
6600 | bcopy(b, ipov->ih_x1, sizeof (ipov->ih_x1)); |
6601 | ipov->ih_len = ip_sum; |
6602 | |
6603 | tcp_in_cksum_stats(len); |
6604 | } |
6605 | break; |
6606 | } |
6607 | #if INET6 |
6608 | case AF_INET6: { |
6609 | struct ip6_hdr *ip6 = mtod(m, struct ip6_hdr *); |
6610 | |
6611 | if (m->m_pkthdr.pkt_flags & PKTF_SW_LRO_DID_CSUM) |
6612 | return (0); |
6613 | |
6614 | if ((hwcksum_rx || (ifp->if_flags & IFF_LOOPBACK) || |
6615 | (m->m_pkthdr.pkt_flags & PKTF_LOOP)) && |
6616 | (m->m_pkthdr.csum_flags & CSUM_DATA_VALID)) { |
6617 | if (m->m_pkthdr.csum_flags & CSUM_PSEUDO_HDR) { |
6618 | th->th_sum = m->m_pkthdr.csum_rx_val; |
6619 | } else { |
6620 | uint32_t sum = m->m_pkthdr.csum_rx_val; |
6621 | uint32_t start = m->m_pkthdr.csum_rx_start; |
6622 | int32_t trailer = (m_pktlen(m) - (off + tlen)); |
6623 | |
6624 | /* |
6625 | * Perform 1's complement adjustment of octets |
6626 | * that got included/excluded in the hardware- |
6627 | * calculated checksum value. Also take care |
6628 | * of any trailing bytes and subtract out their |
6629 | * partial sum. |
6630 | */ |
6631 | ASSERT(trailer >= 0); |
6632 | if ((m->m_pkthdr.csum_flags & CSUM_PARTIAL) && |
6633 | (start != off || trailer != 0)) { |
6634 | uint16_t s = 0, d = 0; |
6635 | uint32_t swbytes = (uint32_t)trailer; |
6636 | |
6637 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) { |
6638 | s = ip6->ip6_src.s6_addr16[1]; |
6639 | ip6->ip6_src.s6_addr16[1] = 0 ; |
6640 | } |
6641 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) { |
6642 | d = ip6->ip6_dst.s6_addr16[1]; |
6643 | ip6->ip6_dst.s6_addr16[1] = 0; |
6644 | } |
6645 | |
6646 | /* callee folds in sum */ |
6647 | sum = m_adj_sum16(m, start, off, |
6648 | tlen, sum); |
6649 | if (off > start) |
6650 | swbytes += (off - start); |
6651 | else |
6652 | swbytes += (start - off); |
6653 | |
6654 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_src)) |
6655 | ip6->ip6_src.s6_addr16[1] = s; |
6656 | if (IN6_IS_SCOPE_EMBED(&ip6->ip6_dst)) |
6657 | ip6->ip6_dst.s6_addr16[1] = d; |
6658 | |
6659 | if (swbytes != 0) |
6660 | tcp_in6_cksum_stats(swbytes); |
6661 | if (trailer != 0) |
6662 | m_adj(m, -trailer); |
6663 | } |
6664 | |
6665 | th->th_sum = in6_pseudo( |
6666 | &ip6->ip6_src, &ip6->ip6_dst, |
6667 | sum + htonl(tlen + IPPROTO_TCP)); |
6668 | } |
6669 | th->th_sum ^= 0xffff; |
6670 | } else { |
6671 | tcp_in6_cksum_stats(tlen); |
6672 | th->th_sum = in6_cksum(m, IPPROTO_TCP, off, tlen); |
6673 | } |
6674 | break; |
6675 | } |
6676 | #endif /* INET6 */ |
6677 | default: |
6678 | VERIFY(0); |
6679 | /* NOTREACHED */ |
6680 | } |
6681 | |
6682 | if (th->th_sum != 0) { |
6683 | tcpstat.tcps_rcvbadsum++; |
6684 | IF_TCP_STATINC(ifp, badformat); |
6685 | return (-1); |
6686 | } |
6687 | |
6688 | return (0); |
6689 | } |
6690 | |
6691 | |
6692 | SYSCTL_PROC(_net_inet_tcp, TCPCTL_STATS, stats, |
6693 | CTLTYPE_STRUCT | CTLFLAG_RD | CTLFLAG_LOCKED, 0, 0, tcp_getstat, |
6694 | "S,tcpstat" , "TCP statistics (struct tcpstat, netinet/tcp_var.h)" ); |
6695 | |
6696 | static int |
6697 | sysctl_rexmtthresh SYSCTL_HANDLER_ARGS |
6698 | { |
6699 | #pragma unused(arg1, arg2) |
6700 | |
6701 | int error, val = tcprexmtthresh; |
6702 | |
6703 | error = sysctl_handle_int(oidp, &val, 0, req); |
6704 | if (error || !req->newptr) |
6705 | return (error); |
6706 | |
6707 | /* |
6708 | * Constrain the number of duplicate ACKs |
6709 | * to consider for TCP fast retransmit |
6710 | * to either 2 or 3 |
6711 | */ |
6712 | |
6713 | if (val < 2 || val > 3) |
6714 | return (EINVAL); |
6715 | |
6716 | tcprexmtthresh = val; |
6717 | |
6718 | return (0); |
6719 | } |
6720 | |
6721 | SYSCTL_PROC(_net_inet_tcp, OID_AUTO, rexmt_thresh, CTLTYPE_INT | CTLFLAG_RW | |
6722 | CTLFLAG_LOCKED, &tcprexmtthresh, 0, &sysctl_rexmtthresh, "I" , |
6723 | "Duplicate ACK Threshold for Fast Retransmit" ); |
6724 | |