void StreamTcpSackPruneList(TcpStream *stream) { SCEnter(); StreamTcpSackRecord *rec = stream->sack_head; while (rec != NULL) { if (SEQ_LT(rec->re, stream->last_ack)) { SCLogDebug("removing le %u re %u", rec->le, rec->re); if (rec->next != NULL) { stream->sack_head = rec->next; StreamTcpSackRecordFree(rec); rec = stream->sack_head; continue; } else { stream->sack_head = NULL; stream->sack_tail = NULL; StreamTcpSackRecordFree(rec); break; } } else if (SEQ_LT(rec->le, stream->last_ack)) { SCLogDebug("adjusting record to le %u re %u", rec->le, rec->re); /* last ack inside this record, update */ rec->le = stream->last_ack; break; } else { SCLogDebug("record beyond last_ack, nothing to do. Bailing out."); break; } } #ifdef DEBUG StreamTcpSackPrintList(stream); #endif SCReturn; }
/* * After a timeout, the SACK list may be rebuilt. This SACK information * should be used to avoid retransmitting SACKed data. This function * traverses the SACK list to see if snd_nxt should be moved forward. */ void tcp_sack_adjust(struct tcpcb *tp) { struct sackhole *p, *cur = TAILQ_FIRST(&tp->snd_holes); //ScenSim-Port// INP_WLOCK_ASSERT(tp->t_inpcb); if (cur == NULL) return; /* No holes */ if (SEQ_GEQ(tp->snd_nxt, tp->snd_fack)) return; /* We're already beyond any SACKed blocks */ /*- * Two cases for which we want to advance snd_nxt: * i) snd_nxt lies between end of one hole and beginning of another * ii) snd_nxt lies between end of last hole and snd_fack */ while ((p = TAILQ_NEXT(cur, scblink)) != NULL) { if (SEQ_LT(tp->snd_nxt, cur->end)) return; if (SEQ_GEQ(tp->snd_nxt, p->start)) cur = p; else { tp->snd_nxt = p->start; return; } } if (SEQ_LT(tp->snd_nxt, cur->end)) return; tp->snd_nxt = tp->snd_fack; }
/* * POLL PDU / SOS_READY Processor * * Arguments: * sop pointer to sscop connection block * m pointer to PDU buffer (without trailer) * trlr pointer to PDU trailer * * Returns: * none * */ static void sscop_poll_ready(struct sscop *sop, KBuffer *m, caddr_t trlr) { struct poll_pdu *pp = (struct poll_pdu *)trlr; sscop_seq nps; pp->poll_ns = ntohl(pp->poll_ns); /* * If the poll sequence number is less than highest number * we've already seen, something's wrong */ if (SEQ_LT(pp->poll_ns, sop->so_rcvhigh, sop->so_rcvnext)) { /* * Record error condition */ sscop_maa_error(sop, 'Q'); /* * Free buffers */ KB_FREEALL(m); /* * Go into recovery mode */ q2110_error_recovery(sop); return; } /* * Set a new "next highest" sequence number expected */ if (SEQ_LT(pp->poll_ns, sop->so_rcvmax, sop->so_rcvnext)) SEQ_SET(sop->so_rcvhigh, pp->poll_ns); else sop->so_rcvhigh = sop->so_rcvmax; /* * Return a STAT PDU to peer */ SEQ_SET(nps, ntohl(pp->poll_nps)); KB_FREEALL(m); sscop_send_stat(sop, nps); return; }
/* resend una packets */ static int l2tp_ctrl_resend_una_packets(l2tp_ctrl *_this) { uint16_t seq; bytebuffer *bytebuf; struct l2tp_header *header; int nsend; nsend = 0; for (seq = _this->snd_una; SEQ_LT(seq, _this->snd_nxt); seq++) { bytebuf = _this->snd_buffers[seq % _this->winsz]; header = bytebuffer_pointer(bytebuf); header->nr = htons(_this->rcv_nxt); #ifdef L2TP_CTRL_DEBUG if (debuglevel >= 3) { l2tp_ctrl_log(_this, DEBUG_LEVEL_3, "RESEND seq=%u", ntohs(header->ns)); show_hd(debug_get_debugfp(), bytebuffer_pointer(bytebuf), bytebuffer_remaining(bytebuf)); } #endif if (l2tp_ctrl_send(_this, bytebuffer_pointer(bytebuf), bytebuffer_remaining(bytebuf)) < 0) { l2tp_ctrl_log(_this, LOG_ERR, "sendto() failed in %s: %m", __func__); return -1; } nsend++; } return nsend; }
/* * Returns the next hole to retransmit and the number of retransmitted bytes * from the scoreboard. We store both the next hole and the number of * retransmitted bytes as hints (and recompute these on the fly upon SACK/ACK * reception). This avoids scoreboard traversals completely. * * The loop here will traverse *at most* one link. Here's the argument. For * the loop to traverse more than 1 link before finding the next hole to * retransmit, we would need to have at least 1 node following the current * hint with (rxmit == end). But, for all holes following the current hint, * (start == rxmit), since we have not yet retransmitted from them. * Therefore, in order to traverse more 1 link in the loop below, we need to * have at least one node following the current hint with (start == rxmit == * end). But that can't happen, (start == end) means that all the data in * that hole has been sacked, in which case, the hole would have been removed * from the scoreboard. */ struct sackhole * tcp_sack_output(struct tcpcb *tp, int *sack_bytes_rexmt) { struct sackhole *hole = NULL; //ScenSim-Port// INP_WLOCK_ASSERT(tp->t_inpcb); *sack_bytes_rexmt = tp->sackhint.sack_bytes_rexmit; hole = tp->sackhint.nexthole; if (hole == NULL || SEQ_LT(hole->rxmit, hole->end)) goto out; while ((hole = TAILQ_NEXT(hole, scblink)) != NULL) { if (SEQ_LT(hole->rxmit, hole->end)) { tp->sackhint.nexthole = hole; break; } } out: return (hole); }
/** * \brief Replace (part of) the payload portion of a packet by the data * in a TCP segment * * \param p Packet * \param seg TCP segment * * \todo What about reassembled fragments? * \todo What about unwrapped tunnel packets? */ void StreamTcpInlineSegmentReplacePacket(Packet *p, TcpSegment *seg) { SCEnter(); uint32_t pseq = TCP_GET_SEQ(p); uint32_t tseq = seg->seq; /* check if segment is within the packet */ if (tseq + seg->payload_len < pseq) { SCReturn; } else if (pseq + p->payload_len < tseq) { SCReturn; } else { /** \todo review logic */ uint32_t pend = pseq + p->payload_len; uint32_t tend = tseq + seg->payload_len; SCLogDebug("pend %u, tend %u", pend, tend); //SCLogDebug("packet"); //PrintRawDataFp(stdout,p->payload,p->payload_len); //SCLogDebug("seg"); //PrintRawDataFp(stdout,seg->payload,seg->payload_len); /* get the minimal seg*_end */ uint32_t end = (SEQ_GT(pend, tend)) ? tend : pend; /* and the max seq */ uint32_t seq = (SEQ_LT(pseq, tseq)) ? tseq : pseq; SCLogDebug("seq %u, end %u", seq, end); uint16_t poff = seq - pseq; uint16_t toff = seq - tseq; SCLogDebug("poff %u, toff %u", poff, toff); uint32_t range = end - seq; SCLogDebug("range %u", range); BUG_ON(range > 65536); if (range) { /* update the packets payload. As payload is a ptr to either * p->pkt or p->ext_pkt that is updated as well */ memcpy(p->payload+poff, seg->payload+toff, range); /* flag as modified so we can reinject / replace after * recalculating the checksum */ p->flags |= PKT_STREAM_MODIFIED; } } }
/* * This function is called upon receipt of new valid data (while not in header * prediction mode), and it updates the ordered list of sacks. */ void tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_start, tcp_seq rcv_end) { /* * First reported block MUST be the most recent one. Subsequent * blocks SHOULD be in the order in which they arrived at the * receiver. These two conditions make the implementation fully * compliant with RFC 2018. */ struct sackblk head_blk, saved_blks[MAX_SACK_BLKS]; int num_head, num_saved, i; /* SACK block for the received segment. */ head_blk.start = rcv_start; head_blk.end = rcv_end; /* * Merge updated SACK blocks into head_blk, and * save unchanged SACK blocks into saved_blks[]. * num_saved will have the number of the saved SACK blocks. */ num_saved = 0; for (i = 0; i < tp->rcv_numsacks; i++) { tcp_seq start = tp->sackblks[i].start; tcp_seq end = tp->sackblks[i].end; if (SEQ_GEQ(start, end) || SEQ_LEQ(start, tp->rcv_nxt)) { /* * Discard this SACK block. */ } else if (SEQ_LEQ(head_blk.start, end) && SEQ_GEQ(head_blk.end, start)) { /* * Merge this SACK block into head_blk. * This SACK block itself will be discarded. */ if (SEQ_GT(head_blk.start, start)) head_blk.start = start; if (SEQ_LT(head_blk.end, end)) head_blk.end = end; } else { /* * Save this SACK block. */ saved_blks[num_saved].start = start; saved_blks[num_saved].end = end; num_saved++; } } /* * Update SACK list in tp->sackblks[]. */ num_head = 0; if (SEQ_GT(head_blk.start, tp->rcv_nxt)) { /* * The received data segment is an out-of-order segment. * Put head_blk at the top of SACK list. */ tp->sackblks[0] = head_blk; num_head = 1; /* * If the number of saved SACK blocks exceeds its limit, * discard the last SACK block. */ if (num_saved >= MAX_SACK_BLKS) num_saved--; } if (num_saved > 0) { /* * Copy the saved SACK blocks back. */ bcopy(saved_blks, &tp->sackblks[num_head], sizeof(struct sackblk) * num_saved); } /* Save the number of SACK blocks. */ tp->rcv_numsacks = num_head + num_saved; /* If we are requesting SACK recovery, reset the stretch-ack state * so that connection will generate more acks after recovery and * sender's cwnd will open. */ if ((tp->t_flags & TF_STRETCHACK) != 0 && tp->rcv_numsacks > 0) tcp_reset_stretch_ack(tp); #if TRAFFIC_MGT if (tp->acc_iaj > 0 && tp->rcv_numsacks > 0) reset_acc_iaj(tp); #endif /* TRAFFIC_MGT */ }
/* * Tcp output routine: figure out what should be sent and send it. */ int tcp_output(struct tcpcb *tp) { struct inpcb * const inp = tp->t_inpcb; struct socket *so = inp->inp_socket; long len, recvwin, sendwin; int nsacked = 0; int off, flags, error = 0; #ifdef TCP_SIGNATURE int sigoff = 0; #endif struct mbuf *m; struct ip *ip; struct tcphdr *th; u_char opt[TCP_MAXOLEN]; unsigned int ipoptlen, optlen, hdrlen; int idle; boolean_t sendalot; struct ip6_hdr *ip6; #ifdef INET6 const boolean_t isipv6 = INP_ISIPV6(inp); #else const boolean_t isipv6 = FALSE; #endif boolean_t can_tso = FALSE, use_tso; boolean_t report_sack, idle_cwv = FALSE; u_int segsz, tso_hlen, tso_lenmax = 0; int segcnt = 0; boolean_t need_sched = FALSE; KKASSERT(so->so_port == &curthread->td_msgport); /* * Determine length of data that should be transmitted, * and flags that will be used. * If there is some data or critical controls (SYN, RST) * to send, then transmit; otherwise, investigate further. */ /* * If we have been idle for a while, the send congestion window * could be no longer representative of the current state of the * link; need to validate congestion window. However, we should * not perform congestion window validation here, since we could * be asked to send pure ACK. */ if (tp->snd_max == tp->snd_una && (ticks - tp->snd_last) >= tp->t_rxtcur && tcp_idle_restart) idle_cwv = TRUE; /* * Calculate whether the transmit stream was previously idle * and adjust TF_LASTIDLE for the next time. */ idle = (tp->t_flags & TF_LASTIDLE) || (tp->snd_max == tp->snd_una); if (idle && (tp->t_flags & TF_MORETOCOME)) tp->t_flags |= TF_LASTIDLE; else tp->t_flags &= ~TF_LASTIDLE; if (TCP_DO_SACK(tp) && tp->snd_nxt != tp->snd_max && !IN_FASTRECOVERY(tp)) nsacked = tcp_sack_bytes_below(&tp->scb, tp->snd_nxt); /* * Find out whether TSO could be used or not * * For TSO capable devices, the following assumptions apply to * the processing of TCP flags: * - If FIN is set on the large TCP segment, the device must set * FIN on the last segment that it creates from the large TCP * segment. * - If PUSH is set on the large TCP segment, the device must set * PUSH on the last segment that it creates from the large TCP * segment. */ #if !defined(IPSEC) && !defined(FAST_IPSEC) if (tcp_do_tso #ifdef TCP_SIGNATURE && (tp->t_flags & TF_SIGNATURE) == 0 #endif ) { if (!isipv6) { struct rtentry *rt = inp->inp_route.ro_rt; if (rt != NULL && (rt->rt_flags & RTF_UP) && (rt->rt_ifp->if_hwassist & CSUM_TSO)) { can_tso = TRUE; tso_lenmax = rt->rt_ifp->if_tsolen; } } } #endif /* !IPSEC && !FAST_IPSEC */ again: m = NULL; ip = NULL; th = NULL; ip6 = NULL; if ((tp->t_flags & (TF_SACK_PERMITTED | TF_NOOPT)) == TF_SACK_PERMITTED && (!TAILQ_EMPTY(&tp->t_segq) || tp->reportblk.rblk_start != tp->reportblk.rblk_end)) report_sack = TRUE; else report_sack = FALSE; /* Make use of SACK information when slow-starting after a RTO. */ if (TCP_DO_SACK(tp) && tp->snd_nxt != tp->snd_max && !IN_FASTRECOVERY(tp)) { tcp_seq old_snd_nxt = tp->snd_nxt; tcp_sack_skip_sacked(&tp->scb, &tp->snd_nxt); nsacked += tp->snd_nxt - old_snd_nxt; } sendalot = FALSE; off = tp->snd_nxt - tp->snd_una; sendwin = min(tp->snd_wnd, tp->snd_cwnd + nsacked); sendwin = min(sendwin, tp->snd_bwnd); flags = tcp_outflags[tp->t_state]; /* * Get standard flags, and add SYN or FIN if requested by 'hidden' * state flags. */ if (tp->t_flags & TF_NEEDFIN) flags |= TH_FIN; if (tp->t_flags & TF_NEEDSYN) flags |= TH_SYN; /* * If in persist timeout with window of 0, send 1 byte. * Otherwise, if window is small but nonzero * and timer expired, we will send what we can * and go to transmit state. */ if (tp->t_flags & TF_FORCE) { if (sendwin == 0) { /* * If we still have some data to send, then * clear the FIN bit. Usually this would * happen below when it realizes that we * aren't sending all the data. However, * if we have exactly 1 byte of unsent data, * then it won't clear the FIN bit below, * and if we are in persist state, we wind * up sending the packet without recording * that we sent the FIN bit. * * We can't just blindly clear the FIN bit, * because if we don't have any more data * to send then the probe will be the FIN * itself. */ if (off < so->so_snd.ssb_cc) flags &= ~TH_FIN; sendwin = 1; } else { tcp_callout_stop(tp, tp->tt_persist); tp->t_rxtshift = 0; } } /* * If snd_nxt == snd_max and we have transmitted a FIN, the * offset will be > 0 even if so_snd.ssb_cc is 0, resulting in * a negative length. This can also occur when TCP opens up * its congestion window while receiving additional duplicate * acks after fast-retransmit because TCP will reset snd_nxt * to snd_max after the fast-retransmit. * * A negative length can also occur when we are in the * TCPS_SYN_RECEIVED state due to a simultanious connect where * our SYN has not been acked yet. * * In the normal retransmit-FIN-only case, however, snd_nxt will * be set to snd_una, the offset will be 0, and the length may * wind up 0. */ len = (long)ulmin(so->so_snd.ssb_cc, sendwin) - off; /* * Lop off SYN bit if it has already been sent. However, if this * is SYN-SENT state and if segment contains data, suppress sending * segment (sending the segment would be an option if we still * did TAO and the remote host supported it). */ if ((flags & TH_SYN) && SEQ_GT(tp->snd_nxt, tp->snd_una)) { flags &= ~TH_SYN; off--, len++; if (len > 0 && tp->t_state == TCPS_SYN_SENT) { tp->t_flags &= ~(TF_ACKNOW | TF_XMITNOW); return 0; } } /* * Be careful not to send data and/or FIN on SYN segments. * This measure is needed to prevent interoperability problems * with not fully conformant TCP implementations. */ if (flags & TH_SYN) { len = 0; flags &= ~TH_FIN; } if (len < 0) { /* * A negative len can occur if our FIN has been sent but not * acked, or if we are in a simultanious connect in the * TCPS_SYN_RECEIVED state with our SYN sent but not yet * acked. * * If our window has contracted to 0 in the FIN case * (which can only occur if we have NOT been called to * retransmit as per code a few paragraphs up) then we * want to shift the retransmit timer over to the * persist timer. * * However, if we are in the TCPS_SYN_RECEIVED state * (the SYN case) we will be in a simultanious connect and * the window may be zero degeneratively. In this case we * do not want to shift to the persist timer after the SYN * or the SYN+ACK transmission. */ len = 0; if (sendwin == 0 && tp->t_state != TCPS_SYN_RECEIVED) { tcp_callout_stop(tp, tp->tt_rexmt); tp->t_rxtshift = 0; tp->snd_nxt = tp->snd_una; if (!tcp_callout_active(tp, tp->tt_persist)) tcp_setpersist(tp); } } KASSERT(len >= 0, ("%s: len < 0", __func__)); /* * Automatic sizing of send socket buffer. Often the send buffer * size is not optimally adjusted to the actual network conditions * at hand (delay bandwidth product). Setting the buffer size too * small limits throughput on links with high bandwidth and high * delay (eg. trans-continental/oceanic links). Setting the * buffer size too big consumes too much real kernel memory, * especially with many connections on busy servers. * * The criteria to step up the send buffer one notch are: * 1. receive window of remote host is larger than send buffer * (with a fudge factor of 5/4th); * 2. hiwat has not significantly exceeded bwnd (inflight) * (bwnd is a maximal value if inflight is disabled). * 3. send buffer is filled to 7/8th with data (so we actually * have data to make use of it); * 4. hiwat has not hit maximal automatic size; * 5. our send window (slow start and cogestion controlled) is * larger than sent but unacknowledged data in send buffer. * * The remote host receive window scaling factor may limit the * growing of the send buffer before it reaches its allowed * maximum. * * It scales directly with slow start or congestion window * and does at most one step per received ACK. This fast * scaling has the drawback of growing the send buffer beyond * what is strictly necessary to make full use of a given * delay*bandwith product. However testing has shown this not * to be much of an problem. At worst we are trading wasting * of available bandwith (the non-use of it) for wasting some * socket buffer memory. * * The criteria for shrinking the buffer is based solely on * the inflight code (snd_bwnd). If inflight is disabled, * the buffer will not be shrinked. Note that snd_bwnd already * has a fudge factor. Our test adds a little hysteresis. */ if (tcp_do_autosndbuf && (so->so_snd.ssb_flags & SSB_AUTOSIZE)) { const int asbinc = tcp_autosndbuf_inc; const int hiwat = so->so_snd.ssb_hiwat; const int lowat = so->so_snd.ssb_lowat; u_long newsize; if ((tp->snd_wnd / 4 * 5) >= hiwat && so->so_snd.ssb_cc >= (hiwat / 8 * 7) && hiwat < tp->snd_bwnd + hiwat / 10 && hiwat + asbinc < tcp_autosndbuf_max && hiwat < (TCP_MAXWIN << tp->snd_scale) && sendwin >= (so->so_snd.ssb_cc - (tp->snd_nxt - tp->snd_una))) { newsize = ulmin(hiwat + asbinc, tcp_autosndbuf_max); if (!ssb_reserve(&so->so_snd, newsize, so, NULL)) atomic_clear_int(&so->so_snd.ssb_flags, SSB_AUTOSIZE); #if 0 if (newsize >= (TCP_MAXWIN << tp->snd_scale)) atomic_clear_int(&so->so_snd.ssb_flags, SSB_AUTOSIZE); #endif } else if ((long)tp->snd_bwnd < (long)(hiwat * 3 / 4 - lowat - asbinc) && hiwat > tp->t_maxseg * 2 + asbinc && hiwat + asbinc >= tcp_autosndbuf_min && tcp_do_autosndbuf == 1) { newsize = ulmax(hiwat - asbinc, tp->t_maxseg * 2); ssb_reserve(&so->so_snd, newsize, so, NULL); } } /* * Don't use TSO, if: * - Congestion window needs validation * - There are SACK blocks to report * - RST or SYN flags is set * - URG will be set * * XXX * Checking for SYN|RST looks overkill, just to be safe than sorry */ use_tso = can_tso; if (report_sack || idle_cwv || (flags & (TH_RST | TH_SYN))) use_tso = FALSE; if (use_tso) { tcp_seq ugr_nxt = tp->snd_nxt; if ((flags & TH_FIN) && (tp->t_flags & TF_SENTFIN) && tp->snd_nxt == tp->snd_max) --ugr_nxt; if (SEQ_GT(tp->snd_up, ugr_nxt)) use_tso = FALSE; } if (use_tso) { /* * Find out segment size and header length for TSO */ error = tcp_tso_getsize(tp, &segsz, &tso_hlen); if (error) use_tso = FALSE; } if (!use_tso) { segsz = tp->t_maxseg; tso_hlen = 0; /* not used */ } /* * Truncate to the maximum segment length if not TSO, and ensure that * FIN is removed if the length no longer contains the last data byte. */ if (len > segsz) { if (!use_tso) { len = segsz; ++segcnt; } else { int nsegs; if (__predict_false(tso_lenmax < segsz)) tso_lenmax = segsz << 1; /* * Truncate TSO transfers to (IP_MAXPACKET - iphlen - * thoff), and make sure that we send equal size * transfers down the stack (rather than big-small- * big-small-...). */ len = min(len, tso_lenmax); nsegs = min(len, (IP_MAXPACKET - tso_hlen)) / segsz; KKASSERT(nsegs > 0); len = nsegs * segsz; if (len <= segsz) { use_tso = FALSE; ++segcnt; } else { segcnt += nsegs; } } sendalot = TRUE; } else { use_tso = FALSE; if (len > 0) ++segcnt; } if (SEQ_LT(tp->snd_nxt + len, tp->snd_una + so->so_snd.ssb_cc)) flags &= ~TH_FIN; recvwin = ssb_space(&so->so_rcv); /* * Sender silly window avoidance. We transmit under the following * conditions when len is non-zero: * * - We have a full segment * - This is the last buffer in a write()/send() and we are * either idle or running NODELAY * - we've timed out (e.g. persist timer) * - we have more then 1/2 the maximum send window's worth of * data (receiver may be limiting the window size) * - we need to retransmit */ if (len) { if (len >= segsz) goto send; /* * NOTE! on localhost connections an 'ack' from the remote * end may occur synchronously with the output and cause * us to flush a buffer queued with moretocome. XXX * * note: the len + off check is almost certainly unnecessary. */ if (!(tp->t_flags & TF_MORETOCOME) && /* normal case */ (idle || (tp->t_flags & TF_NODELAY)) && len + off >= so->so_snd.ssb_cc && !(tp->t_flags & TF_NOPUSH)) { goto send; } if (tp->t_flags & TF_FORCE) /* typ. timeout case */ goto send; if (len >= tp->max_sndwnd / 2 && tp->max_sndwnd > 0) goto send; if (SEQ_LT(tp->snd_nxt, tp->snd_max)) /* retransmit case */ goto send; if (tp->t_flags & TF_XMITNOW) goto send; } /* * Compare available window to amount of window * known to peer (as advertised window less * next expected input). If the difference is at least two * max size segments, or at least 50% of the maximum possible * window, then want to send a window update to peer. */ if (recvwin > 0) { /* * "adv" is the amount we can increase the window, * taking into account that we are limited by * TCP_MAXWIN << tp->rcv_scale. */ long adv = min(recvwin, (long)TCP_MAXWIN << tp->rcv_scale) - (tp->rcv_adv - tp->rcv_nxt); long hiwat; /* * This ack case typically occurs when the user has drained * the TCP socket buffer sufficiently to warrent an ack * containing a 'pure window update'... that is, an ack that * ONLY updates the tcp window. * * It is unclear why we would need to do a pure window update * past 2 segments if we are going to do one at 1/2 the high * water mark anyway, especially since under normal conditions * the user program will drain the socket buffer quickly. * The 2-segment pure window update will often add a large * number of extra, unnecessary acks to the stream. * * avoid_pure_win_update now defaults to 1. */ if (avoid_pure_win_update == 0 || (tp->t_flags & TF_RXRESIZED)) { if (adv >= (long) (2 * segsz)) { goto send; } } hiwat = (long)(TCP_MAXWIN << tp->rcv_scale); if (hiwat > (long)so->so_rcv.ssb_hiwat) hiwat = (long)so->so_rcv.ssb_hiwat; if (adv >= hiwat / 2) goto send; } /* * Send if we owe the peer an ACK, RST, SYN, or urgent data. ACKNOW * is also a catch-all for the retransmit timer timeout case. */ if (tp->t_flags & TF_ACKNOW) goto send; if ((flags & TH_RST) || ((flags & TH_SYN) && !(tp->t_flags & TF_NEEDSYN))) goto send; if (SEQ_GT(tp->snd_up, tp->snd_una)) goto send; /* * If our state indicates that FIN should be sent * and we have not yet done so, then we need to send. */ if ((flags & TH_FIN) && (!(tp->t_flags & TF_SENTFIN) || tp->snd_nxt == tp->snd_una)) goto send; /* * TCP window updates are not reliable, rather a polling protocol * using ``persist'' packets is used to insure receipt of window * updates. The three ``states'' for the output side are: * idle not doing retransmits or persists * persisting to move a small or zero window * (re)transmitting and thereby not persisting * * tcp_callout_active(tp, tp->tt_persist) * is true when we are in persist state. * The TF_FORCE flag in tp->t_flags * is set when we are called to send a persist packet. * tcp_callout_active(tp, tp->tt_rexmt) * is set when we are retransmitting * The output side is idle when both timers are zero. * * If send window is too small, there is data to transmit, and no * retransmit or persist is pending, then go to persist state. * * If nothing happens soon, send when timer expires: * if window is nonzero, transmit what we can, otherwise force out * a byte. * * Don't try to set the persist state if we are in TCPS_SYN_RECEIVED * with data pending. This situation can occur during a * simultanious connect. */ if (so->so_snd.ssb_cc > 0 && tp->t_state != TCPS_SYN_RECEIVED && !tcp_callout_active(tp, tp->tt_rexmt) && !tcp_callout_active(tp, tp->tt_persist)) { tp->t_rxtshift = 0; tcp_setpersist(tp); } /* * No reason to send a segment, just return. */ tp->t_flags &= ~TF_XMITNOW; return (0); send: if (need_sched && len > 0) { tcp_output_sched(tp); return 0; } /* * Before ESTABLISHED, force sending of initial options * unless TCP set not to do any options. * NOTE: we assume that the IP/TCP header plus TCP options * always fit in a single mbuf, leaving room for a maximum * link header, i.e. * max_linkhdr + sizeof(struct tcpiphdr) + optlen <= MCLBYTES */ optlen = 0; if (isipv6) hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); else hdrlen = sizeof(struct tcpiphdr); if (flags & TH_SYN) { tp->snd_nxt = tp->iss; if (!(tp->t_flags & TF_NOOPT)) { u_short mss; opt[0] = TCPOPT_MAXSEG; opt[1] = TCPOLEN_MAXSEG; mss = htons((u_short) tcp_mssopt(tp)); memcpy(opt + 2, &mss, sizeof mss); optlen = TCPOLEN_MAXSEG; if ((tp->t_flags & TF_REQ_SCALE) && (!(flags & TH_ACK) || (tp->t_flags & TF_RCVD_SCALE))) { *((u_int32_t *)(opt + optlen)) = htonl( TCPOPT_NOP << 24 | TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | tp->request_r_scale); optlen += 4; } if ((tcp_do_sack && !(flags & TH_ACK)) || tp->t_flags & TF_SACK_PERMITTED) { uint32_t *lp = (uint32_t *)(opt + optlen); *lp = htonl(TCPOPT_SACK_PERMITTED_ALIGNED); optlen += TCPOLEN_SACK_PERMITTED_ALIGNED; } } } /* * Send a timestamp and echo-reply if this is a SYN and our side * wants to use timestamps (TF_REQ_TSTMP is set) or both our side * and our peer have sent timestamps in our SYN's. */ if ((tp->t_flags & (TF_REQ_TSTMP | TF_NOOPT)) == TF_REQ_TSTMP && !(flags & TH_RST) && (!(flags & TH_ACK) || (tp->t_flags & TF_RCVD_TSTMP))) { u_int32_t *lp = (u_int32_t *)(opt + optlen); /* Form timestamp option as shown in appendix A of RFC 1323. */ *lp++ = htonl(TCPOPT_TSTAMP_HDR); *lp++ = htonl(ticks); *lp = htonl(tp->ts_recent); optlen += TCPOLEN_TSTAMP_APPA; } /* Set receive buffer autosizing timestamp. */ if (tp->rfbuf_ts == 0 && (so->so_rcv.ssb_flags & SSB_AUTOSIZE)) tp->rfbuf_ts = ticks; /* * If this is a SACK connection and we have a block to report, * fill in the SACK blocks in the TCP options. */ if (report_sack) tcp_sack_fill_report(tp, opt, &optlen); #ifdef TCP_SIGNATURE if (tp->t_flags & TF_SIGNATURE) { int i; u_char *bp; /* * Initialize TCP-MD5 option (RFC2385) */ bp = (u_char *)opt + optlen; *bp++ = TCPOPT_SIGNATURE; *bp++ = TCPOLEN_SIGNATURE; sigoff = optlen + 2; for (i = 0; i < TCP_SIGLEN; i++) *bp++ = 0; optlen += TCPOLEN_SIGNATURE; /* * Terminate options list and maintain 32-bit alignment. */ *bp++ = TCPOPT_NOP; *bp++ = TCPOPT_EOL; optlen += 2; } #endif /* TCP_SIGNATURE */ KASSERT(optlen <= TCP_MAXOLEN, ("too many TCP options")); hdrlen += optlen; if (isipv6) { ipoptlen = ip6_optlen(inp); } else { if (inp->inp_options) { ipoptlen = inp->inp_options->m_len - offsetof(struct ipoption, ipopt_list); } else {
/* NOTE: in the kernel version [fd] is unused and, if it's a ptr, [arg] will * be in user-space and may need to be fetched into kernel memory. */ static int ci_tcp_ioctl_lk(citp_socket* ep, ci_fd_t fd, int request, void* arg) { ci_netif* netif = ep->netif; ci_sock_cmn* s = ep->s; ci_tcp_state* ts = NULL; int rc = 0; int os_socket_exists = s->b.sb_aflags & CI_SB_AFLAG_OS_BACKED; if( s->b.state != CI_TCP_LISTEN ) ts = SOCK_TO_TCP(s); /* Keep the os socket in sync. If this is a "get" request then the * return will be based on our support, not the os's (except for EFAULT * handling which we get for free). * Exceptions: * - FIONBIO is applied just in time on handover if needed (listening * sockets always have a non-blocking OS socket) * - FIONREAD, TIOCOUTQ, SIOCOUTQNSD and SIOCATMARK are useless on OS * socket, let's avoid syscall. */ if( os_socket_exists && request != FIONREAD && request != SIOCATMARK && request != FIOASYNC && request != TIOCOUTQ && request != SIOCOUTQNSD && request != (int) FIONBIO ) { rc = oo_os_sock_ioctl(netif, s->b.bufid, request, arg, NULL); if( rc < 0 ) return rc; } /* ioctl defines are listed in `man ioctl_list` and the CI equivalent * CI defines are in include/ci/net/ioctls.h */ LOG_TV( ci_log("%s: request = %d, arg = %ld", __FUNCTION__, request, (long)arg)); switch( request ) { case FIONBIO: if( CI_IOCTL_ARG_OK(int, arg) ) { CI_CMN_IOCTL_FIONBIO(ep->s, arg); rc = 0; break; } goto fail_fault; case FIONREAD: /* synonym of SIOCINQ */ if( !CI_IOCTL_ARG_OK(int, arg) ) goto fail_fault; if( s->b.state == CI_TCP_LISTEN ) goto fail_inval; if( s->b.state == CI_TCP_SYN_SENT ) { CI_IOCTL_SETARG((int*)arg, 0); } else { /* In inline mode, return the total number of bytes in the receive queue. If SO_OOBINLINE isn't set then return the number of bytes up to the mark but without counting the mark */ int bytes_in_rxq = tcp_rcv_usr(ts); if (bytes_in_rxq && ! (ts->s.s_flags & CI_SOCK_FLAG_OOBINLINE)) { if (tcp_urg_data(ts) & CI_TCP_URG_PTR_VALID) { /*! \TODO: what if FIN has been received? */ unsigned int readnxt = tcp_rcv_nxt(ts) - bytes_in_rxq; if (SEQ_LT(readnxt, tcp_rcv_up(ts))) { bytes_in_rxq = tcp_rcv_up(ts) - readnxt; } else if (SEQ_EQ(readnxt, tcp_rcv_up(ts))) { bytes_in_rxq--; } } } CI_IOCTL_SETARG((int*)arg, bytes_in_rxq); } break; case TIOCOUTQ: /* synonym of SIOCOUTQ */ case SIOCOUTQNSD: { CI_BUILD_ASSERT(TIOCOUTQ == SIOCOUTQ); int outq_bytes = 0; if( !CI_IOCTL_ARG_OK(int, arg) ) goto fail_fault; if( s->b.state == CI_TCP_LISTEN ) goto fail_inval; if( s->b.state != CI_TCP_SYN_SENT ) { /* TIOCOUTQ counts all unacknowledged data, so includes retrans queue. */ if( request == TIOCOUTQ ) outq_bytes = SEQ_SUB(tcp_enq_nxt(ts), tcp_snd_una(ts)); else outq_bytes = SEQ_SUB(tcp_enq_nxt(ts), tcp_snd_nxt(ts)); } CI_IOCTL_SETARG((int*)arg, outq_bytes); } break; case SIOCATMARK: { if( !CI_IOCTL_ARG_OK(int, arg) ) goto fail_fault; /* return true, if we are at the out-of-band byte */ CI_IOCTL_SETARG((int*)arg, 0); if( s->b.state != CI_TCP_LISTEN ) { int readnxt; readnxt = SEQ_SUB(tcp_rcv_nxt(ts), tcp_rcv_usr(ts)); if( ~ts->s.b.state & CI_TCP_STATE_ACCEPT_DATA ) readnxt = SEQ_SUB(readnxt, 1); if( tcp_urg_data(ts) & CI_TCP_URG_PTR_VALID ) CI_IOCTL_SETARG((int*)arg, readnxt == tcp_rcv_up(ts)); LOG_URG(log(NTS_FMT "SIOCATMARK atmark=%d readnxt=%u rcv_up=%u%s", NTS_PRI_ARGS(ep->netif, ts), readnxt == tcp_rcv_up(ts), readnxt, tcp_rcv_up(SOCK_TO_TCP(ep->s)), (tcp_urg_data(ts)&CI_TCP_URG_PTR_VALID)?"":" (invalid)")); } break; } #ifndef __KERNEL__ case FIOASYNC: /* Need to apply this to [fd] so that our fasync file-op will be * invoked. */ rc = ci_sys_ioctl(fd, request, arg); break; case SIOCSPGRP: if( !CI_IOCTL_ARG_OK(int, arg) ) goto fail_fault; /* Need to apply this to [fd] to get signal delivery to work. However, * SIOCSPGRP is only supported on sockets, so we need to convert to * fcntl(). */ rc = ci_sys_fcntl(fd, F_SETOWN, CI_IOCTL_GETARG(int, arg)); if( rc == 0 ) { rc = ci_cmn_ioctl(netif, ep->s, request, arg, rc, os_socket_exists); } else { CI_SET_ERROR(rc, -rc); } break; #endif default: return ci_cmn_ioctl(netif, ep->s, request, arg, rc, os_socket_exists); }
/** * \brief insert a SACK range * * \param le left edge in host order * \param re right edge in host order * * \retval 0 all is good * \retval -1 error */ static int StreamTcpSackInsertRange(TcpStream *stream, uint32_t le, uint32_t re) { SCLogDebug("le %u, re %u", le, re); #ifdef DEBUG StreamTcpSackPrintList(stream); #endif /* if to the left of last_ack then ignore */ if (SEQ_LT(re, stream->last_ack)) { SCLogDebug("too far left. discarding"); goto end; } /* if to the right of the tcp window then ignore */ if (SEQ_GT(le, (stream->last_ack + stream->window))) { SCLogDebug("too far right. discarding"); goto end; } if (stream->sack_head != NULL) { StreamTcpSackRecord *rec; for (rec = stream->sack_head; rec != NULL; rec = rec->next) { SCLogDebug("rec %p, le %u, re %u", rec, rec->le, rec->re); if (SEQ_LT(le, rec->le)) { SCLogDebug("SEQ_LT(le, rec->le)"); if (SEQ_LT(re, rec->le)) { SCLogDebug("SEQ_LT(re, rec->le)"); // entirely before, prepend StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = stream->sack_head; stream->sack_head = stsr; goto end; } else if (SEQ_EQ(re, rec->le)) { SCLogDebug("SEQ_EQ(re, rec->le)"); // starts before, ends on rec->le, expand rec->le = le; } else if (SEQ_GT(re, rec->le)) { SCLogDebug("SEQ_GT(re, rec->le)"); // starts before, ends beyond rec->le if (SEQ_LEQ(re, rec->re)) { SCLogDebug("SEQ_LEQ(re, rec->re)"); // ends before rec->re, expand rec->le = le; } else { // implied if (re > rec->re) SCLogDebug("implied if (re > rec->re), le set to %u", rec->re); le = rec->re; continue; } } } else if (SEQ_EQ(le, rec->le)) { SCLogDebug("SEQ_EQ(le, rec->le)"); if (SEQ_LEQ(re, rec->re)) { SCLogDebug("SEQ_LEQ(re, rec->re)"); // new record fully overlapped SCReturnInt(0); } else { // implied re > rec->re SCLogDebug("implied re > rec->re"); if (rec->next != NULL) { if (SEQ_LEQ(re, rec->next->le)) { rec->re = re; goto end; } else { rec->re = rec->next->le; le = rec->next->le; SCLogDebug("le is now %u", le); continue; } } else { rec->re = re; goto end; } } } else { // implied (le > rec->le) SCLogDebug("implied (le > rec->le)"); if (SEQ_LT(le, rec->re)) { SCLogDebug("SEQ_LT(le, rec->re))"); // new record fully overlapped if (SEQ_GT(re, rec->re)) { SCLogDebug("SEQ_GT(re, rec->re)"); if (rec->next != NULL) { if (SEQ_LEQ(re, rec->next->le)) { rec->re = re; goto end; } else { rec->re = rec->next->le; le = rec->next->le; continue; } } else { rec->re = re; goto end; } } SCLogDebug("new range fully overlapped"); SCReturnInt(0); } else if (SEQ_EQ(le, rec->re)) { SCLogDebug("here"); // new record fully overlapped //int r = StreamTcpSackInsertRange(stream, rec->re+1, re); //SCReturnInt(r); le = rec->re; continue; } else { /* implied le > rec->re */ SCLogDebug("implied le > rec->re"); if (rec->next == NULL) { SCLogDebug("rec->next == NULL"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = NULL; stream->sack_tail->next = stsr; stream->sack_tail = stsr; goto end; } else { SCLogDebug("implied rec->next != NULL"); if (SEQ_LT(le, rec->next->le) && SEQ_LT(re, rec->next->le)) { SCLogDebug("SEQ_LT(le, rec->next->le) && SEQ_LT(re, rec->next->le)"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = rec->next; rec->next = stsr; } else if (SEQ_LT(le, rec->next->le) && SEQ_GEQ(re, rec->next->le)) { SCLogDebug("SEQ_LT(le, rec->next->le) && SEQ_GEQ(re, rec->next->le)"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = rec->next->le; stsr->next = rec->next; rec->next = stsr; le = rec->next->le; } } } } } } else { SCLogDebug("implied empty list"); StreamTcpSackRecord *stsr = StreamTcpSackRecordAlloc(); if (unlikely(stsr == NULL)) { SCReturnInt(-1); } stsr->le = le; stsr->re = re; stsr->next = NULL; stream->sack_head = stsr; stream->sack_tail = stsr; } StreamTcpSackPruneList(stream); end: SCReturnInt(0); }
int HttpResponseInspection(HI_SESSION *Session, Packet *p, const unsigned char *data, int dsize, HttpSessionData *sd) { HTTPINSPECT_CONF *ServerConf; URI_PTR stat_code_ptr; URI_PTR stat_msg_ptr; HEADER_PTR header_ptr; URI_PTR body_ptr; HI_SERVER *Server; const u_char *start; const u_char *end; const u_char *ptr; int len; int iRet = 0; int resp_header_size = 0; /* Refers to the stream reassembled packets when reassembly is turned on. * Refers to all packets when reassembly is turned off. */ int not_stream_insert = 1; #ifdef ZLIB int parse_cont_encoding = 1; int status; #endif int expected_pkt = 0; int alt_dsize; uint32_t seq_num = 0; if (!Session || !p || !data || (dsize == 0)) return HI_INVALID_ARG; ServerConf = Session->server_conf; if(!ServerConf) return HI_INVALID_ARG; Server = &(Session->server); clearHttpRespBuffer(Server); seq_num = GET_PKT_SEQ(p); if ( (sd != NULL) ) { /* If the previously inspected packet in this session identified as a body * and if the packets are stream inserted wait for reassembled */ if (sd->resp_state.inspect_reassembled) { if(p->packet_flags & PKT_STREAM_INSERT) { #ifdef ZLIB parse_cont_encoding = 0; #endif not_stream_insert = 0; } } /* If this packet is the next expected packet to be inspected and is out of sequence * clear out the resp state*/ #ifdef ZLIB if(( sd->decomp_state && sd->decomp_state->decompress_data) && parse_cont_encoding) { if( sd->resp_state.next_seq && (seq_num == sd->resp_state.next_seq) ) { sd->resp_state.next_seq = seq_num + p->dsize; expected_pkt = 1; } else { ResetGzipState(sd->decomp_state); ResetRespState(&(sd->resp_state)); } } else #endif if(sd->resp_state.inspect_body && not_stream_insert) { /* If the server flow depth is 0 then we need to check if the packet * is in sequence */ if(!ServerConf->server_flow_depth) { if( sd->resp_state.next_seq && (seq_num == sd->resp_state.next_seq) ) { sd->resp_state.next_seq = seq_num + p->dsize; expected_pkt = 1; } else { #ifdef ZLIB ResetGzipState(sd->decomp_state); #endif ResetRespState(&(sd->resp_state)); } } else { /*Check if the sequence number of the packet is within the allowed * flow_depth */ if( (sd->resp_state.is_max_seq) && SEQ_LT(seq_num, (sd->resp_state.max_seq))) { expected_pkt = 1; } else { #ifdef ZLIB ResetGzipState(sd->decomp_state); #endif ResetRespState(&(sd->resp_state)); } } } } memset(&stat_code_ptr, 0x00, sizeof(URI_PTR)); memset(&stat_msg_ptr, 0x00, sizeof(URI_PTR)); memset(&header_ptr, 0x00, sizeof(HEADER_PTR)); memset(&body_ptr, 0x00, sizeof(URI_PTR)); start = data; end = data + dsize; ptr = start; /* moving past the CRLF */ while(hi_util_in_bounds(start, end, ptr)) { if(*ptr < 0x21) { if(*ptr < 0x0E && *ptr > 0x08) { ptr++; continue; } else { if(*ptr == 0x20) { ptr++; continue; } } } break; } /*after doing this we need to basically check for version, status code and status message*/ len = end - ptr; if ( len > 4 ) { if(!IsHttpVersion(&ptr, end)) { if(expected_pkt) { ptr = start; p->packet_flags |= PKT_HTTP_DECODE; } else { p->packet_flags |= PKT_HTTP_DECODE; ApplyFlowDepth(ServerConf, p, sd, resp_header_size, 0, seq_num); if ( not_stream_insert && (sd != NULL)) { #ifdef ZLIB ResetGzipState(sd->decomp_state); #endif ResetRespState(&(sd->resp_state)); } CLR_SERVER_HEADER(Server); return HI_SUCCESS; } } else { p->packet_flags |= PKT_HTTP_DECODE; /* This is a next expected packet to be decompressed but the packet is a * valid HTTP response. So the gzip decompression ends here */ if(expected_pkt) { expected_pkt = 0; #ifdef ZLIB ResetGzipState(sd->decomp_state); #endif ResetRespState(&(sd->resp_state)); } while(hi_util_in_bounds(start, end, ptr)) { if (isspace((int)*ptr)) break; ptr++; } } } else if (!expected_pkt) { return HI_SUCCESS; } /*If this is the next expected packet to be decompressed, send this packet * decompression */ if (expected_pkt) { if (hi_util_in_bounds(start, end, ptr)) { iRet = hi_server_inspect_body(Session, sd, ptr, end, &body_ptr); } } else { iRet = hi_server_extract_status_code(Session, start,ptr,end , &stat_code_ptr); if ( iRet == STAT_END ) { Server->response.status_code = stat_code_ptr.uri; Server->response.status_code_size = stat_code_ptr.uri_end - stat_code_ptr.uri; if ( (int)Server->response.status_code_size <= 0) { CLR_SERVER_STAT(Server); } else { iRet = hi_server_extract_status_msg(start, stat_code_ptr.uri_end , end, &stat_msg_ptr); if ( stat_msg_ptr.uri ) { Server->response.status_msg = stat_msg_ptr.uri; Server->response.status_msg_size = stat_msg_ptr.uri_end - stat_msg_ptr.uri; if ((int)Server->response.status_msg_size <= 0) { CLR_SERVER_STAT(Server); } else { #ifdef ZLIB ptr = hi_server_extract_header(Session, ServerConf, &header_ptr, stat_msg_ptr.uri_end , end, parse_cont_encoding, sd ); #else /* We dont need the content-encoding header when zlib is not enabled */ ptr = hi_server_extract_header(Session, ServerConf, &header_ptr, stat_msg_ptr.uri_end , end, 0, sd ); #endif } } else { CLR_SERVER_STAT(Server); } } if (header_ptr.header.uri) { Server->response.header_raw = header_ptr.header.uri; Server->response.header_raw_size = header_ptr.header.uri_end - header_ptr.header.uri; if(!Server->response.header_raw_size) { CLR_SERVER_HEADER(Server); } else { resp_header_size = (header_ptr.header.uri_end - p->data); hi_stats.resp_headers++; Server->response.header_norm = header_ptr.header.uri; if (header_ptr.cookie.cookie) { hi_stats.resp_cookies++; Server->response.cookie.cookie = header_ptr.cookie.cookie; Server->response.cookie.cookie_end = header_ptr.cookie.cookie_end; Server->response.cookie.next = header_ptr.cookie.next; } else { Server->response.cookie.cookie = NULL; Server->response.cookie.cookie_end = NULL; Server->response.cookie.next = NULL; } if (sd != NULL) { #ifdef ZLIB if( header_ptr.content_encoding.compress_fmt ) { hi_stats.gzip_pkts++; /* We've got gzip data - grab buffer from mempool and attach * to session data if server is configured to do so */ if (sd->decomp_state == NULL) SetGzipBuffers(sd, Session); if (sd->decomp_state != NULL) { sd->decomp_state->decompress_data = 1; sd->decomp_state->compress_fmt = header_ptr.content_encoding.compress_fmt; } } else #endif { sd->resp_state.inspect_body = 1; } sd->resp_state.last_pkt_contlen = header_ptr.content_len.len; if(ServerConf->server_flow_depth == -1) sd->resp_state.is_max_seq = 0; else { sd->resp_state.is_max_seq = 1; sd->resp_state.max_seq = seq_num + (header_ptr.header.uri_end - start)+ ServerConf->server_flow_depth; } if (p->packet_flags & PKT_STREAM_INSERT) { if(header_ptr.content_len.cont_len_start && ((end - (header_ptr.header.uri_end)) >= header_ptr.content_len.len)) { /* change this when the api is fixed to flush correctly */ //stream_api->response_flush_stream(p); expected_pkt = 1; } else sd->resp_state.inspect_reassembled = 1; } else { if(p->packet_flags & PKT_REBUILT_STREAM) sd->resp_state.inspect_reassembled = 1; expected_pkt = 1; } if(expected_pkt) { sd->resp_state.next_seq = seq_num + p->dsize; if(hi_util_in_bounds(start, end, header_ptr.header.uri_end)) { iRet = hi_server_inspect_body(Session, sd, header_ptr.header.uri_end, end, &body_ptr); } } } } } else { CLR_SERVER_HEADER(Server); } } else { CLR_SERVER_STAT(Server); } } if( body_ptr.uri ) { Server->response.body = body_ptr.uri; Server->response.body_size = body_ptr.uri_end - body_ptr.uri; if( Server->response.body_size > 0) { if ( Server->response.body_size < sizeof(DecodeBuffer.data) ) { alt_dsize = Server->response.body_size; } else { alt_dsize = sizeof(DecodeBuffer.data); } #ifdef ZLIB if(sd->decomp_state && sd->decomp_state->decompress_data) { status = SafeMemcpy(DecodeBuffer.data, Server->response.body, alt_dsize, DecodeBuffer.data, DecodeBuffer.data + sizeof(DecodeBuffer.data)); if( status != SAFEMEM_SUCCESS ) return HI_MEM_ALLOC_FAIL; p->data_flags |= DATA_FLAGS_GZIP; SetAltDecode(p, alt_dsize); SetDetectLimit(p, alt_dsize); } else #endif { if(sd->resp_state.last_pkt_chunked) { p->data_flags |= DATA_FLAGS_RESP_BODY; SetAltDecode(p, alt_dsize); SetDetectLimit(p, alt_dsize); } else { p->data_flags |= DATA_FLAGS_RESP_BODY; p->packet_flags |= PKT_HTTP_RESP_BODY; SetDetectLimit(p, (alt_dsize + resp_header_size)); } } if (get_decode_utf_state_charset(&(sd->utf_state)) != CHARSET_DEFAULT) { if ( Server->response.body_size < sizeof(DecodeBuffer.data) ) { alt_dsize = Server->response.body_size; } else { alt_dsize = sizeof(DecodeBuffer.data); } SetDetectLimit(p, alt_dsize); SetAltDecode(p, alt_dsize); } } } else { /* There is no body to the HTTP response. * In this case we need to inspect the entire HTTP response header. */ ApplyFlowDepth(ServerConf, p, sd, resp_header_size, 1, seq_num); } return HI_SUCCESS; }
int tcp_input(struct ifnet * __if, struct iphdr * iph, struct tcphdr * th, int len) { struct tcp_listen_pcb * mux; struct tcp_pcb * tp; #if (ENABLE_NET_TCP_CHECKSUM) unsigned int sum; #endif int ti_len; int acked = 0; int ourfinisacked = 0; int needoutput = 0; unsigned int optlen; int tiflags; int todrop; uint32_t snd_una; uint32_t snd_nxt; uint32_t snd_max; uint32_t ti_seq; uint32_t ti_ack; int rcv_wnd; int tiwin; int hdrlen; uint8_t * data; int ret; #if (ENABLE_TCPDUMP) tcp_dump(iph, th, TCPDUMP_RX); #endif /* get TCP options, if any */ optlen = ((th->th_off << 2) - sizeof(struct tcphdr)); hdrlen = sizeof(struct tcphdr) + optlen; data = (uint8_t *)&th->th_opt[optlen]; ti_len = len - hdrlen; #if (ENABLE_NET_TCP_CHECKSUM) /* initialize checksum */ sum = htons(len) + (IPPROTO_TCP << 8); sum = in_chksum(sum, &iph->saddr, 8); sum = in_chksum(sum, th, hdrlen); if (ti_len) { sum = in_chksum(sum, data, ti_len); } if (sum != 0x0000ffff) { DCC_LOG3(LOG_WARNING, "checksum error: 0x%04x hdrlen=%d, len=%d", sum, hdrlen, len); TCP_PROTO_STAT_ADD(rx_err, 1); goto drop; } #endif tiflags = th->th_flags; /* convert TCP protocol specific fields to host format */ tiwin = ntohs(th->th_win); ti_seq = ntohl(th->th_seq); ti_ack = ntohl(th->th_ack); TCP_PROTO_STAT_ADD(rx_ok, 1); /* Serch in active list first */ if ((tp = tcp_active_lookup(iph->saddr, th->th_sport, iph->daddr, th->th_dport)) == NULL) { /* lookup into listening pcb list */ if ((mux = tcp_listen_lookup(iph->saddr, th->th_sport, iph->daddr, th->th_dport)) == NULL) { DCC_LOG(LOG_WARNING, "invalid peer ???"); goto dropwithreset; } if ((tiflags & TH_ACK)) { DCC_LOG(LOG_WARNING, "listen ACK ?"); goto dropwithreset; } if (ti_len != 0) { DCC_LOG(LOG_WARNING, "ti_len != 0"); goto dropwithreset; } /* Completion of Passive Open Ref.: TCP/IP Illustrated Volume 2, pg. 942 */ if (!(tiflags & TH_SYN)) { DCC_LOG(LOG_WARNING, "listen !SYN ?"); goto drop; } /* In the LISTEN state, we check for incoming SYN segments, creates a new PCB, and responds with a SYN|ACK. */ if ((tiflags & TH_RST)) { DCC_LOG(LOG_WARNING, "listen RST?"); goto drop; } if ((tp = tcp_passive_open(mux, iph, th, optlen)) == NULL) { DCC_LOG(LOG_WARNING, "tcp_passive_open()"); goto dropwithreset; } /* schedule output */ tcp_output_sched(tp); /* packet handled */ return 0; } DCC_LOG1(LOG_MSG, "<%05x> active", (int)tp); snd_una = tp->snd_seq; snd_nxt = tp->snd_seq + tp->snd_off; snd_max = tp->snd_seq + tp->snd_max; /* Remove acknowledged bytes from the send buffer */ /* Wakeup processes waiting on send buffer */ /* Segment received on a connection. Reset the idle detection timer Ref.: TCP/IP Illustrated Volume 2, pg. 932 */ tp->t_conn_tmr = tcp_idle_det_tmo; if (tp->t_flags & TF_IDLE) { /* exits from the idle state */ tp->t_flags &= ~TF_IDLE; DCC_LOG1(LOG_INFO, "<%05x> IDLE exit", (int)tp); } #if 0 /* Process options, we don't need to check if the socket is in the LISTEN state, because only active (non LISTENING) sockets will actually fall into this code. XXX: options after connection stablished ??? */ if (optlen) tcp_parse_options(tp, th, th->th_opt, optlen); #endif /* Ref.: TCP/IP Illustrated Volume 2, pg. 934 */ #if (TCP_ENABLE_HEADER_PREDICTION) if ((tp->t_state == TCPS_ESTABLISHED) && (tiflags & (TH_SYN | TH_FIN | TH_RST | TH_URG | TH_ACK)) == TH_ACK && (ti_seq == tp->rcv_nxt) && (tiwin) && (tiwin == tp->snd_wnd) && (snd_nxt == snd_max)) { if (ti_len == 0) { if (SEQ_GT(ti_ack, snd_una) && SEQ_LEQ(ti_ack, snd_max)) { acked = ti_ack - snd_una; DCC_LOG(LOG_INFO, "header prediction, ACK ..."); mbuf_queue_trim(&tp->snd_q, acked); snd_una = ti_ack; tp->snd_seq = snd_una; tp->snd_off = snd_nxt - tp->snd_seq; tp->snd_max = snd_max - tp->snd_seq; if (snd_una == snd_max) { tp->t_rxmt_tmr = 0; tp->t_rxmt_cnt = 0; DCC_LOG(LOG_INFO, "acked all data, rxmt tmr stopped"); } else { if (tp->t_rxmt_tmr == 0) { DCC_LOG(LOG_INFO, "not all data acked restart rxmt tmr"); tp->t_rxmt_tmr = tcp_rxmtintvl[tp->t_rxmt_cnt / 2]; } } thinkos_cond_broadcast(tp->t_cond); if (tp->snd_q.len) { /* schedule output */ tcp_output_sched(tp); } return 0; } } else { if ((ti_ack == snd_una) && ti_len <= (tcp_maxrcv - tp->rcv_q.len)) { int len; DCC_LOG1(LOG_INFO, "header prediction, data (%d)", ti_len); /* append data */ len = mbuf_queue_add(&tp->rcv_q, data, ti_len); tp->rcv_nxt += len; thinkos_cond_broadcast(tp->t_cond); if (len != ti_len) { DCC_LOG1(LOG_WARNING, "<%05x> no more mbufs", (int)tp); tp->t_flags |= TF_ACKNOW; /* schedule output */ tcp_output_sched(tp); } else { tp->t_flags |= TF_DELACK; } return 0; } } } #endif /* TCP_ENABLE_HEADER_PREDICTION */ /* Slow path input processing Ref.: TCP/IP Illustrated Volume 2, pg. 941 */ /* TODO: Drop TCP, IP headers and TCP options. Well, only if these structures were dynamic allocated... */ if (ti_len == 0) { DCC_LOG(LOG_INFO, "slow path ACK"); } else { DCC_LOG1(LOG_INFO, "slow path (%d)", ti_len); } /* Calculate the amount of space in receive window, and then do TCP input processing. Receive window is amount of space in rcv queue, but not less than advertise window. Ref.: TCP/IP Illustrated Volume 2, pg. 941 */ { int win; /* space left in the input queue */ win = tcp_maxrcv - tp->rcv_q.len; if (win <= 0) { win = 0; DCC_LOG(LOG_INFO, "receive buffer full!"); } // rcv_wnd = MAX(win, tp->rcv_adv_wnd); rcv_wnd = win; DCC_LOG3(LOG_INFO, "adv_wnd=%d rcv_wnd=%d win=%d", tp->rcv_adv_wnd, rcv_wnd, win); } if (tp->t_state == TCPS_SYN_SENT) { /* response to an active open. Ref.: TCP/IP Illustrated Volume 2, pg. 947 */ /* Common proccessing for receipt of SYN. Ref.: TCP/IP Illustrated Volume 2, pg. 950 */ if ((tiflags & TH_RST)) { goto close; } if (!(tiflags & TH_SYN)) { DCC_LOG(LOG_WARNING, "SYN_SENT SYN ?"); /* TODO: reset */ goto close_and_reset; } if (!(tiflags & TH_ACK)) { DCC_LOG(LOG_WARNING, "SYN_SENT ACK ?"); /* TODO: reset */ goto close_and_reset; } if (ti_len != 0) { DCC_LOG(LOG_WARNING, "ti_len != 0"); /* TODO: reset */ goto close_and_reset; } /* update the send sequence */ tp->snd_seq++; if (tp->snd_seq != ti_ack) { DCC_LOG3(LOG_WARNING, "<%05x> tp->snd_seq(%d) != ti_ack(%d)", (int)tp, tp->snd_seq, ti_ack); /* TODO: reset */ goto close_and_reset; } tp->snd_off--; tp->snd_max--; // tp->snd_off = 0; // tp->snd_max = 0; if (optlen) tcp_parse_options(tp, th, th->th_opt, optlen); /* Advance tp->ti_seq to correspond to first data byte. */ ti_seq++; if (ti_len > rcv_wnd) { DCC_LOG3(LOG_WARNING, "<%05x> ti_len(%d) > rcv_wnd(%d)", (int)tp, ti_len, rcv_wnd); /* TODO: if data, trim to stay within window. */ ti_len = rcv_wnd; } /* update the sequence number */ tp->rcv_nxt = ti_seq; /* update the window size */ tp->snd_wnd = ntohs(th->th_win); tp->t_state = TCPS_ESTABLISHED; DCC_LOG1(LOG_INFO, "<%05x> [ESTABLISHED]", (int)tp); /* TODO: initialization of receive urgent pointer tcp->rcv_up = ti_seq; */ /* XXX: */ tp->t_flags |= TF_ACKNOW; thinkos_cond_broadcast(tp->t_cond); goto step6; close_and_reset: tp->t_state = TCPS_CLOSED; pcb_move((struct pcb *)tp, &__tcp__.active, &__tcp__.closed); DCC_LOG1(LOG_INFO, "<%05x> [CLOSED]", (int)tp); /* XXX: discard the data */ mbuf_queue_free(&tp->snd_q); mbuf_queue_free(&tp->rcv_q); /* notify the upper layer */ thinkos_cond_broadcast(tp->t_cond); goto dropwithreset; } /* States other than LISTEN or SYN_SENT First check timestamp, if present. Then check that at least some bytes of segment are within receive window. If segment begins before rcv_nxt, drop leading data (and SYN); if nothing left, just ti_ack. */ /* Trim Segment so Data is Within Window Ref.: TCP/IP Illustrated Volume 2, pg. 954 */ todrop = tp->rcv_nxt - ti_seq; if (todrop > 0) { if (tiflags & TH_SYN) { DCC_LOG(LOG_INFO, "SYN"); tiflags &= ~TH_SYN; ti_seq++; todrop--; } if ((todrop > ti_len) || ((todrop == ti_len) && ((tiflags & TH_FIN) == 0))) { tiflags &= ~TH_FIN; tp->t_flags |= TF_ACKNOW; todrop = ti_len; } DCC_LOG4(LOG_WARNING, "<%05x> drop: len=%d drop=%d rem=%d!", (int)tp, ti_len, todrop, ti_len - todrop); /* adjust the data pointer */ data += todrop; ti_seq += todrop; ti_len -= todrop; /* TODO: adjust the urgent pointer */ } /* FIXME: only reset the connection if there are no more application to handle the incomming data, half-close */ if ((tp->t_state > TCPS_FIN_WAIT_1) && (ti_len)) { DCC_LOG1(LOG_INFO, "<%05x> segment received after FIN", (int)tp); /* TODO: stat */ goto dropwithreset; } /* If segment ends after window, drop trailing data and (PUSH and FIN); if nothing left, just ACK. Ref.: TCP/IP Illustrated Volume 2, pg. 958 */ todrop = (ti_seq + ti_len) - (tp->rcv_nxt + rcv_wnd); DCC_LOG4(LOG_INFO, "ti_seq=%u ti_len=%d rcv_nxt=%u rcv_wnd=%d", ti_seq, ti_len, tp->rcv_nxt, rcv_wnd); /* */ if (todrop > 0) { // TCP_LOG(tp, "tcp_input: trailing data drop"); if (todrop >= ti_len) { /* * If a new connection request is received * while in TIME_WAIT, drop the old connection ... * Ref.: TCP/IP Illustrated Volume 2, pg. 958 if ((tiflags & TH_SYN) && (tp->t_state == TCPS_TIMEWAIT) && (SEQ_GT(ti_seq, tp->rcv_nxt))) { __tcp__.iss += tcp_issincr; tcp_rst(tp); goto findpcb; } */ if ((rcv_wnd == 0) && (ti_seq == tp->rcv_nxt)) { tp->t_flags |= TF_ACKNOW; } else goto dropafterack; } DCC_LOG2(LOG_WARNING, "<%05x> data drop: %d!", (int)tp, todrop); ti_len -= todrop; tiflags &= ~(TH_PSH | TH_FIN); } /* If the RST bit is set eximine the state: ... Ref.: TCP/IP Illustrated Volume 2, pg. 964 */ if ((tiflags & TH_RST)) { DCC_LOG1(LOG_WARNING, "<%05x> RST received", (int)tp); switch(tp->t_state) { case TCPS_SYN_RCVD: // tp->errno = ECONNREFUSED; goto close; case TCPS_ESTABLISHED: case TCPS_CLOSE_WAIT: // tp->errno = ECONNRESET; close: /* discard the data */ mbuf_queue_free(&tp->snd_q); mbuf_queue_free(&tp->rcv_q); tp->t_state = TCPS_CLOSED; pcb_move((struct pcb *)tp, &__tcp__.active, &__tcp__.closed); DCC_LOG1(LOG_INFO, "<%05x> [CLOSED]", (int)tp); /* notify the upper layer */ thinkos_cond_broadcast(tp->t_cond); /* PCBs in the close state should be cleared by the application */ goto drop; case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: /* Our side was already closed */ tcp_pcb_free(tp); goto drop; } } /* If a SYN is in the window, then this is an error and we send an RST and drop the connection. Ref.: TCP/IP Illustrated Volume 2, pg. 965 */ if ((tiflags & TH_SYN)) { DCC_LOG1(LOG_WARNING, "<%05x> the SYN bit is set inside the window", (int)tp); goto dropwithreset; } /* If the ACK bit is off we drop the segment and return. */ if ((!(tiflags & TH_ACK))) { DCC_LOG1(LOG_WARNING, "<%05x> the ACK bit is off", (int)tp); goto drop; } /* * ACK processing. * Ref.: TCP/IP Illustrated Volume 2, pg. 969 * */ DCC_LOG4(LOG_INFO, "ack=%u una=%u nxt=%u max=%u", ti_ack, snd_una, snd_nxt, snd_max); switch(tp->t_state) { case TCPS_SYN_RCVD: if (SEQ_GT(snd_una, ti_ack) || SEQ_GT(ti_ack, snd_max)) { DCC_LOG1(LOG_WARNING, "<%05x> ti_ack < snd_una || snd_max < ti_ack", (int)tp); goto dropwithreset; } tp->t_state = TCPS_ESTABLISHED; tp->snd_off--; tp->snd_max--; DCC_LOG1(LOG_INFO, "<%05x> SYN ackd [ESTABLISHED]", (int)tp); /* notify the upper layer*/ // thinkos_cond_signal(tp->t_cond); /* TODO: tcp reassembly tcp_reass(tp); */ case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: /* TODO: tcp reassembly tcp_reass(tp); */ if (SEQ_LEQ(ti_ack, snd_una)) { /* TODO: check for completly duplicated ACKs. Ref.: TCP/IP Illustrated Volume 2, pg. 971 */ if ((ti_len == 0) && (tiwin == tp->snd_wnd)) { if ((tp->t_rxmt_tmr == 0) || ti_ack != snd_una) { // dupacks = 0; } else { DCC_LOG2(LOG_INFO, "duplicated ACK. ti_ack=%u snd_una=%u", ti_ack, snd_una); } } else { // dupacks = 0; } break; } /* Check out of range ACK */ /* Ref.: TCP/IP Illustrated Volume 2, pg. 974 */ if (SEQ_GT(ti_ack, snd_max)) { /* TODO: tcpstat.tcps_rcvacktoomuch++; */ DCC_LOG3(LOG_WARNING, "(%04x) out of range ACK. " "th_ack=%u > snd_max=%u !", (int)tp, ti_ack, snd_max); goto dropafterack; } acked = ti_ack - snd_una; /* TODO: tcpstat.tcps_rcvackpack++; tcpstat.tcps_rcvackbyte += acked; */ DCC_LOG1(LOG_INFO, "acked=%d", acked); /* If all outstanding data is acked, stop retransmit timer else restarts it .... Ref.: TCP/IP Illustrated Volume 2, pg. 976 */ if (ti_ack == snd_max) { tp->t_rxmt_tmr = 0; tp->t_rxmt_cnt = 0; needoutput = 1; DCC_LOG(LOG_INFO, "acked all data, rxmt tmr stopped"); } else { /* TODO: peristent timer */ // if (tp->t_persist_tmr == 0) { DCC_LOG(LOG_INFO, "not all data acked restart rxmt tmr"); tp->t_rxmt_tmr = tcp_rxmtintvl[tp->t_rxmt_cnt / 2]; // } } /* TODO: tcpstat.tcps_rcvackpack++; tcpstat.tcps_rcvackbyte += acked; */ /* TODO: remove acknowledged data from send buffer Ref.: TCP/IP Illustrated Volume 2, pg. 978 */ /* FIXME: send buffer bytes count */ if (acked > tp->snd_q.len) { mbuf_queue_trim(&tp->snd_q, tp->snd_q.len); ourfinisacked = 1; } else { /* TODO: estimate the send window */ mbuf_queue_trim(&tp->snd_q, acked); ourfinisacked = 0; } /* awaken a thread waiting on the send buffer ... */ thinkos_cond_broadcast(tp->t_cond); snd_una = ti_ack; if (SEQ_LT(snd_nxt, snd_una)) { snd_nxt = snd_una; } tp->snd_seq = snd_una; tp->snd_off = snd_nxt - tp->snd_seq; tp->snd_max = snd_max - tp->snd_seq; DCC_LOG4(LOG_INFO, "<%05x> snd_seq=%u snd_max=%u snd_q.len=%d", (int)tp, tp->snd_seq, snd_max, tp->snd_q.len); switch(tp->t_state) { case TCPS_FIN_WAIT_1: if (ourfinisacked) { /* FIXME: If we can't receive any more data.. Ref.: TCP/IP Illustrated Volume 2, pg. 979 */ tp->t_conn_tmr = 4 * tcp_msl; tp->t_state = TCPS_FIN_WAIT_2; DCC_LOG1(LOG_INFO, "<%05x> [FIN_WAIT_2]", (int)tp); } break; case TCPS_CLOSING: if (ourfinisacked) { mbuf_queue_free(&tp->snd_q); mbuf_queue_free(&tp->rcv_q); tp->t_state = TCPS_TIME_WAIT; DCC_LOG1(LOG_INFO, "<%05x> [TIME_WAIT]", (int)tp); tp->t_rxmt_tmr = 0; tp->t_conn_tmr = 2 * tcp_msl; DCC_LOG1(LOG_INFO, "stop rxmt tmr, start 2MSL tmr: %d", tp->t_conn_tmr); } break; case TCPS_LAST_ACK: if (ourfinisacked) { tcp_pcb_free(tp); goto drop; } break; case TCPS_TIME_WAIT: /* restart the finack timer Ref.: TCP/IP Illustrated Volume 2, pg. 981 */ tp->t_conn_tmr = 2 * tcp_msl; goto dropafterack; } break; } DCC_LOG4(LOG_INFO, "<%05x> recvd=%d acked=%d rcv_q.len=%d", (int)tp, ti_len, acked, tp->rcv_q.len); step6: /* Update window information Ref.: TCP/IP Illustrated Volume 2, pg. 982 */ DCC_LOG(LOG_MSG, "setp6"); // if ((tiflags & TH_ACK) && (tiwin > tp->snd_wnd)) { if ((tiflags & TH_ACK) && (tiwin != tp->snd_wnd)) { /* Keep track of pure window updates */ /* TODO: TCP Statistics */ /* TODO: Update window information */ DCC_LOG1(LOG_INFO, "window update, win=%d", tiwin); tp->snd_wnd = tiwin; needoutput = 1; } /* TODO: Urgent mode processing */ /* Process the segment text, merging it into the TCP sequencing queue, dodata: ... Ref.: TCP/IP Illustrated Volume 2, pg. 988 */ if ((ti_len || (tiflags & TH_FIN)) && TCPS_HAVERCVDFIN(tp->t_state) == 0) { if ((ti_seq == tp->rcv_nxt) && (tp->t_state == TCPS_ESTABLISHED)) { /* append data */ int n; tp->t_flags |= TF_DELACK; n = mbuf_queue_add(&tp->rcv_q, data, ti_len); if (n != ti_len) { DCC_LOG2(LOG_WARNING, "no more mbufs, %d != %d", n, ti_len); } ti_len = n; tp->rcv_nxt += ti_len; /* TODO: statistics */ tiflags &= TH_FIN; // if (tp->rcv_q.len == ti_len) { // DCC_LOG3(LOG_INFO, "<%05x> rcvd %d, signaling %d ...", // (int)tp, ti_len, tp->t_cond); /* * notify the upper layer of the data arrival... */ thinkos_cond_signal(tp->t_cond); // } else { // DCC_LOG2(LOG_INFO, "<%05x> rcvd %d", (int)tp, ti_len); // } } else { /* TODO: half-close */ /* TODO: reassembly */ // m = mlink_free(m); if (tp->t_state == TCPS_ESTABLISHED) { // DCC_LOG(LOG_WARNING, "out of order, drop!"); DCC_LOG(LOG_WARNING, "out of order, drop"); TCP_PROTO_STAT_ADD(rx_drop, 1); } tp->t_flags |= TF_ACKNOW; } } else { DCC_LOG(LOG_INFO, "!!!!!!!!!"); tiflags &= ~TH_FIN; } /* FIN Processing */ if (tiflags & TH_FIN) { if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { tp->t_flags |= TF_ACKNOW; tp->rcv_nxt++; } switch(tp->t_state) { case TCPS_SYN_RCVD: case TCPS_ESTABLISHED: tp->t_state = TCPS_CLOSE_WAIT; DCC_LOG1(LOG_INFO, "<%05x> [CLOSE_WAIT]", (int)tp); /* notify the application that our peer has closed its side. Sockets: marks the socket as write-only */ if (tp->rcv_q.len == 0) { thinkos_cond_broadcast(tp->t_cond); } break; case TCPS_FIN_WAIT_1: tp->t_state = TCPS_CLOSING; DCC_LOG1(LOG_INFO, "<%05x> [CLOSING]", (int)tp); break; case TCPS_FIN_WAIT_2: mbuf_queue_free(&tp->rcv_q); mbuf_queue_free(&tp->snd_q); tp->t_state = TCPS_TIME_WAIT; DCC_LOG1(LOG_INFO, "<%05x> [TIME_WAIT]", (int)tp); tp->t_rxmt_tmr = 0; tp->t_conn_tmr = 2 * tcp_msl; DCC_LOG1(LOG_INFO, "stop rxmt tmr, start 2MSL tmr: %d", tp->t_conn_tmr); break; case TCPS_TIME_WAIT: /* restart the counter */ tp->t_conn_tmr = 2 * tcp_msl; break; } } /* Final Processing */ if (needoutput || (tp->t_flags & TF_ACKNOW)) { if (needoutput) { DCC_LOG(LOG_INFO, "needoutput, call tcp_out."); } if (tp->t_flags & TF_ACKNOW) { DCC_LOG(LOG_INFO, "ACKNOW set, call tcp_out."); } /* schedule output */ tcp_output_sched(tp); } return 0; dropafterack: DCC_LOG1(LOG_INFO, "<%05x> drop and ACK", (int)tp); if (tiflags & TH_RST) goto drop; tp->t_flags |= TF_ACKNOW; /* schedule output */ tcp_output_sched(tp); return 0; dropwithreset: DCC_LOG1(LOG_TRACE, "<%05x> drop and RST", (int)tp); ret = 0; /* TODO: check for a broadcast/multicast */ if (!(tiflags & TH_RST)) { if (tiflags & TH_ACK) { ret = tcp_respond(iph, th, 0, ti_ack, TH_RST); } else if (tiflags & TH_SYN) { ti_len++; ret = tcp_respond(iph, th, ti_seq + ti_len, 0, TH_ACK | TH_RST); } } TCP_PROTO_STAT_ADD(rx_drop, 1); return ret; drop: DCC_LOG(LOG_TRACE, "drop"); TCP_PROTO_STAT_ADD(rx_drop, 1); return 0; }
/* * Process cumulative ACK and the TCP SACK option to update the scoreboard. * tp->snd_holes is an ordered list of holes (oldest to newest, in terms of * the sequence space). */ void tcp_sack_doack(struct tcpcb *tp, struct tcpopt *to, tcp_seq th_ack) { struct sackhole *cur, *temp; struct sackblk sack, sack_blocks[TCP_MAX_SACK + 1], *sblkp; int i, j, num_sack_blks; //ScenSim-Port// INP_WLOCK_ASSERT(tp->t_inpcb); num_sack_blks = 0; /* * If SND.UNA will be advanced by SEG.ACK, and if SACK holes exist, * treat [SND.UNA, SEG.ACK) as if it is a SACK block. */ if (SEQ_LT(tp->snd_una, th_ack) && !TAILQ_EMPTY(&tp->snd_holes)) { sack_blocks[num_sack_blks].start = tp->snd_una; sack_blocks[num_sack_blks++].end = th_ack; } /* * Append received valid SACK blocks to sack_blocks[], but only if we * received new blocks from the other side. */ if (to->to_flags & TOF_SACK) { for (i = 0; i < to->to_nsacks; i++) { bcopy((to->to_sacks + i * TCPOLEN_SACK), &sack, sizeof(sack)); sack.start = ntohl(sack.start); sack.end = ntohl(sack.end); if (SEQ_GT(sack.end, sack.start) && SEQ_GT(sack.start, tp->snd_una) && SEQ_GT(sack.start, th_ack) && SEQ_LT(sack.start, tp->snd_max) && SEQ_GT(sack.end, tp->snd_una) && SEQ_LEQ(sack.end, tp->snd_max)) sack_blocks[num_sack_blks++] = sack; } } /* * Return if SND.UNA is not advanced and no valid SACK block is * received. */ if (num_sack_blks == 0) return; /* * Sort the SACK blocks so we can update the scoreboard with just one * pass. The overhead of sorting upto 4+1 elements is less than * making upto 4+1 passes over the scoreboard. */ for (i = 0; i < num_sack_blks; i++) { for (j = i + 1; j < num_sack_blks; j++) { if (SEQ_GT(sack_blocks[i].end, sack_blocks[j].end)) { sack = sack_blocks[i]; sack_blocks[i] = sack_blocks[j]; sack_blocks[j] = sack; } } } if (TAILQ_EMPTY(&tp->snd_holes)) /* * Empty scoreboard. Need to initialize snd_fack (it may be * uninitialized or have a bogus value). Scoreboard holes * (from the sack blocks received) are created later below * (in the logic that adds holes to the tail of the * scoreboard). */ tp->snd_fack = SEQ_MAX(tp->snd_una, th_ack); /* * In the while-loop below, incoming SACK blocks (sack_blocks[]) and * SACK holes (snd_holes) are traversed from their tails with just * one pass in order to reduce the number of compares especially when * the bandwidth-delay product is large. * * Note: Typically, in the first RTT of SACK recovery, the highest * three or four SACK blocks with the same ack number are received. * In the second RTT, if retransmitted data segments are not lost, * the highest three or four SACK blocks with ack number advancing * are received. */ sblkp = &sack_blocks[num_sack_blks - 1]; /* Last SACK block */ tp->sackhint.last_sack_ack = sblkp->end; if (SEQ_LT(tp->snd_fack, sblkp->start)) { /* * The highest SACK block is beyond fack. Append new SACK * hole at the tail. If the second or later highest SACK * blocks are also beyond the current fack, they will be * inserted by way of hole splitting in the while-loop below. */ temp = tcp_sackhole_insert(tp, tp->snd_fack,sblkp->start,NULL); if (temp != NULL) { tp->snd_fack = sblkp->end; /* Go to the previous sack block. */ sblkp--; } else { /* * We failed to add a new hole based on the current * sack block. Skip over all the sack blocks that * fall completely to the right of snd_fack and * proceed to trim the scoreboard based on the * remaining sack blocks. This also trims the * scoreboard for th_ack (which is sack_blocks[0]). */ while (sblkp >= sack_blocks && SEQ_LT(tp->snd_fack, sblkp->start)) sblkp--; if (sblkp >= sack_blocks && SEQ_LT(tp->snd_fack, sblkp->end)) tp->snd_fack = sblkp->end; } } else if (SEQ_LT(tp->snd_fack, sblkp->end)) /* fack is advanced. */ tp->snd_fack = sblkp->end; /* We must have at least one SACK hole in scoreboard. */ //ScenSim-Port// KASSERT(!TAILQ_EMPTY(&tp->snd_holes), //ScenSim-Port// ("SACK scoreboard must not be empty")); cur = TAILQ_LAST(&tp->snd_holes, sackhole_head); /* Last SACK hole. */ /* * Since the incoming sack blocks are sorted, we can process them * making one sweep of the scoreboard. */ while (sblkp >= sack_blocks && cur != NULL) { if (SEQ_GEQ(sblkp->start, cur->end)) { /* * SACKs data beyond the current hole. Go to the * previous sack block. */ sblkp--; continue; } if (SEQ_LEQ(sblkp->end, cur->start)) { /* * SACKs data before the current hole. Go to the * previous hole. */ cur = TAILQ_PREV(cur, sackhole_head, scblink); continue; } tp->sackhint.sack_bytes_rexmit -= (cur->rxmit - cur->start); //ScenSim-Port// KASSERT(tp->sackhint.sack_bytes_rexmit >= 0, //ScenSim-Port// ("sackhint bytes rtx >= 0")); if (SEQ_LEQ(sblkp->start, cur->start)) { /* Data acks at least the beginning of hole. */ if (SEQ_GEQ(sblkp->end, cur->end)) { /* Acks entire hole, so delete hole. */ temp = cur; cur = TAILQ_PREV(cur, sackhole_head, scblink); tcp_sackhole_remove(tp, temp); /* * The sack block may ack all or part of the * next hole too, so continue onto the next * hole. */ continue; } else { /* Move start of hole forward. */ cur->start = sblkp->end; cur->rxmit = SEQ_MAX(cur->rxmit, cur->start); } } else { /* Data acks at least the end of hole. */ if (SEQ_GEQ(sblkp->end, cur->end)) { /* Move end of hole backward. */ cur->end = sblkp->start; cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); } else { /* * ACKs some data in middle of a hole; need * to split current hole */ temp = tcp_sackhole_insert(tp, sblkp->end, cur->end, cur); if (temp != NULL) { if (SEQ_GT(cur->rxmit, temp->rxmit)) { temp->rxmit = cur->rxmit; tp->sackhint.sack_bytes_rexmit += (temp->rxmit - temp->start); } cur->end = sblkp->start; cur->rxmit = SEQ_MIN(cur->rxmit, cur->end); } } } tp->sackhint.sack_bytes_rexmit += (cur->rxmit - cur->start); /* * Testing sblkp->start against cur->start tells us whether * we're done with the sack block or the sack hole. * Accordingly, we advance one or the other. */ if (SEQ_LEQ(sblkp->start, cur->start)) cur = TAILQ_PREV(cur, sackhole_head, scblink); else sblkp--; } }
static #ifndef GPROF inline #endif int tcp_build_datapkt(struct tcpcb *tp, struct socket *so, int off, long len, int hdrlen, struct mbuf **mp) { struct mbuf *m, *m0; uint64_t *tcps; tcps = TCP_STAT_GETREF(); if (tp->t_force && len == 1) tcps[TCP_STAT_SNDPROBE]++; else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) { tcps[TCP_STAT_SNDREXMITPACK]++; tcps[TCP_STAT_SNDREXMITBYTE] += len; } else { tcps[TCP_STAT_SNDPACK]++; tcps[TCP_STAT_SNDBYTE] += len; } TCP_STAT_PUTREF(); #ifdef notyet if ((m = m_copypack(so->so_snd.sb_mb, off, (int)len, max_linkhdr + hdrlen)) == 0) return (ENOBUFS); /* * m_copypack left space for our hdr; use it. */ m->m_len += hdrlen; m->m_data -= hdrlen; #else MGETHDR(m, M_DONTWAIT, MT_HEADER); if (__predict_false(m == NULL)) return (ENOBUFS); MCLAIM(m, &tcp_tx_mowner); /* * XXX Because other code assumes headers will fit in * XXX one header mbuf. * * (This code should almost *never* be run.) */ if (__predict_false((max_linkhdr + hdrlen) > MHLEN)) { TCP_OUTPUT_COUNTER_INCR(&tcp_output_bigheader); MCLGET(m, M_DONTWAIT); if ((m->m_flags & M_EXT) == 0) { m_freem(m); return (ENOBUFS); } } m->m_data += max_linkhdr; m->m_len = hdrlen; /* * To avoid traversing the whole sb_mb chain for correct * data to send, remember last sent mbuf, its offset and * the sent size. When called the next time, see if the * data to send is directly following the previous transfer. * This is important for large TCP windows. */ if (off == 0 || tp->t_lastm == NULL || (tp->t_lastoff + tp->t_lastlen) != off) { TCP_OUTPUT_COUNTER_INCR(&tcp_output_predict_miss); /* * Either a new packet or a retransmit. * Start from the beginning. */ tp->t_lastm = so->so_snd.sb_mb; tp->t_inoff = off; } else { TCP_OUTPUT_COUNTER_INCR(&tcp_output_predict_hit); tp->t_inoff += tp->t_lastlen; } /* Traverse forward to next packet */ while (tp->t_inoff > 0) { if (tp->t_lastm == NULL) panic("tp->t_lastm == NULL"); if (tp->t_inoff < tp->t_lastm->m_len) break; tp->t_inoff -= tp->t_lastm->m_len; tp->t_lastm = tp->t_lastm->m_next; } tp->t_lastoff = off; tp->t_lastlen = len; m0 = tp->t_lastm; off = tp->t_inoff; if (len <= M_TRAILINGSPACE(m)) { m_copydata(m0, off, (int) len, mtod(m, char *) + hdrlen); m->m_len += len; TCP_OUTPUT_COUNTER_INCR(&tcp_output_copysmall); } else {
int tcp_output(struct tcpcb * tp) { struct socket * so = tp->t_inpcb->inp_socket; int len; long win; int off, flags, error; struct mbuf * m; struct tcpiphdr * ti; unsigned optlen = 0; int idle, sendalot; struct mbuf * sendm; /* mbuf which contains data to send */ struct mbuf * tcp_mbuf; /* mbuf containing TCP header */ int bufoff; /* offset of data in sendm->m_data */ #ifdef TCP_SACK int sack_resend; int sack_hole = 0; /* next sack hole to fill */ if(tp->t_flags & TF_SACKREPLY) { /* we are resending based on a received SACK header */ sack_resend = TRUE; tp->t_flags &= ~TF_SACKREPLY; /* clear flag */ } else sack_resend = FALSE; #endif /* TCP_SACK */ /* * Determine length of data that should be transmitted, * and flags that will be used. * If there is some data or critical controls (SYN, RST) * to send, then transmit; otherwise, investigate further. */ idle = (tp->snd_max == tp->snd_una); again: sendalot = 0; off = (int)(tp->snd_nxt - tp->snd_una); win = (long)tp->snd_wnd; /* set basic send window */ if (win > (long)tp->snd_cwnd) /* see if we need congestion control */ { win = (int)(tp->snd_cwnd & ~(ALIGN_TYPE-1)); /* keep data aligned */ } /* * If in persist timeout with window of 0, send 1 byte. * Otherwise, if window is small but nonzero * and timer expired, we will send what we can * and go to transmit state. */ if (tp->t_force) { if (win == 0) win = 1; else { tp->t_timer[TCPT_PERSIST] = 0; tp->t_rxtshift = 0; } } #ifdef TCP_SACK /* See if we need to adjust the offset for a sack resend */ if(sack_resend) { off = (int)(tp->sack_hole_start[sack_hole] - tp->snd_una); /* if this hole's already been acked then punt and move to next hole */ if(off < 0) { /* clear out the acked hole */ tp->sack_hole_start[sack_hole] = tp->sack_hole_end[sack_hole] = 0; /* see if we're done with SACK hole list (2 tests) */ if(++sack_hole >= SACK_BLOCKS) return 0; if(tp->sack_hole_start[sack_hole] == tp->sack_hole_end[sack_hole]) return 0; goto again; } tp->snd_nxt = tp->sack_hole_start[sack_hole]; len = (int)(tp->sack_hole_end[sack_hole] - tp->sack_hole_start[sack_hole]); len = (int)MIN(len, (int)win); } else #endif /* TCP_SACK */ { /* set length of packets which are not sack resends */ len = (int)MIN(so->so_snd.sb_cc, (unsigned)win) - off; } flags = tcp_outflags[tp->t_state]; /* See if we need to build TCP options field. This test should be fast. */ #if (defined(TCP_TIMESTAMP) | defined(TCP_SACK)) if((flags & TH_SYN) || /* !!!??? (so->so_options & SO_TIMESTAMP) || */ (tp->t_flags & TF_SACKNOW) ) { optlen = bld_options(tp, &tcp_optionbuf[optlen], flags, so); } #else /* If other options not defined this build then don't bother to call bld_options() except * on SYN packets */ if(flags & TH_SYN) { optlen = bld_options(tp, &tcp_optionbuf[optlen], flags, so); } #endif if (len < 0) { /* * If FIN has been sent but not acked, * but we haven't been called to retransmit, * len will be -1. Otherwise, window shrank * after we sent into it. If window shrank to 0, * cancel pending retransmit and pull snd_nxt * back to (closed) window. We will enter persist * state below. If the window didn't close completely, * just wait for an ACK. */ len = 0; if (win == 0) { tp->t_timer[TCPT_REXMT] = 0; tp->snd_nxt = tp->snd_una; } } if (len > (int)tp->t_maxseg) { len = tp->t_maxseg; sendalot = 1; } #ifdef IP_V4 #ifdef IP_PMTU { int pmtu = tp->t_inpcb->inp_pmtu - 40; if (len > pmtu) { len = pmtu - 40; sendalot = 1; } } #endif /* IP_PMTU */ /* We don't need a pmtu test for IPv6. V6 code limits t_maxseg to * the Path MTU, so the test above the v4 ifdef above covers us. */ #endif /* IP_V4 */ if (SEQ_LT(tp->snd_nxt + len, tp->snd_una + so->so_snd.sb_cc)) flags &= ~TH_FIN; win = (long)(sbspace(&so->so_rcv)); /* * If our state indicates that FIN should be sent * and we have not yet done so, or we're retransmitting the FIN, * then we need to send. */ if ((flags & TH_FIN) && (so->so_snd.sb_cc == 0) && ((tp->t_flags & TF_SENTFIN) == 0 || tp->snd_nxt == tp->snd_una)) { goto send; } /* * Send if we owe peer an ACK. */ if (tp->t_flags & TF_ACKNOW) goto send; if (flags & (TH_SYN|TH_RST)) goto send; if (SEQ_GT(tp->snd_up, tp->snd_una)) goto send; /* * Sender silly window avoidance. If connection is idle * and can send all data, a maximum segment, * at least a maximum default-size segment do it, * or are forced, do it; otherwise don't bother. * If peer's buffer is tiny, then send * when window is at least half open. * If retransmitting (possibly after persist timer forced us * to send into a small window), then must resend. */ if (len) { if (len == (int)tp->t_maxseg) goto send; if ((idle || tp->t_flags & TF_NODELAY) && len + off >= (int)so->so_snd.sb_cc) { goto send; } if (tp->t_force) goto send; if (len >= (int)(tp->max_sndwnd / 2)) goto send; if (SEQ_LT(tp->snd_nxt, tp->snd_max)) goto send; } /* * Compare available window to amount of window * known to peer (as advertised window less * next expected input). If the difference is at least two * max size segments or at least 35% of the maximum possible * window, then want to send a window update to peer. */ if (win > 0) { int adv = (int)win - (int)(tp->rcv_adv - tp->rcv_nxt); if (so->so_rcv.sb_cc == 0 && adv >= (int)(tp->t_maxseg * 2)) goto send; if (100 * (u_int)adv / so->so_rcv.sb_hiwat >= 35) goto send; } /* * TCP window updates are not reliable, rather a polling protocol * using ``persist'' packets is used to insure receipt of window * updates. The three ``states'' for the output side are: * idle not doing retransmits or persists * persisting to move a small or zero window * (re)transmitting and thereby not persisting * * tp->t_timer[TCPT_PERSIST] * is set when we are in persist state. * tp->t_force * is set when we are called to send a persist packet. * tp->t_timer[TCPT_REXMT] * is set when we are retransmitting * The output side is idle when both timers are zero. * * If send window is too small, there is data to transmit, and no * retransmit or persist is pending, then go to persist state. * If nothing happens soon, send when timer expires: * if window is nonzero, transmit what we can, * otherwise force out a byte. */ if (so->so_snd.sb_cc && tp->t_timer[TCPT_REXMT] == 0 && tp->t_timer[TCPT_PERSIST] == 0) { tp->t_rxtshift = 0; tcp_setpersist(tp); } /* * No reason to send a segment, just return. */ return (0); send: ENTER_CRIT_SECTION(tp); /* Limit send length to the current buffer so as to * avoid doing the "mbuf shuffle" in m_copy(). */ bufoff = off; sendm = so->so_snd.sb_mb; if (len) { /* find mbuf containing data to send (at "off") */ while (sendm) /* loop through socket send list */ { bufoff -= sendm->m_len; if (bufoff < 0) /* if off is in this buffer, break */ break; sendm = sendm->m_next; } if (!sendm) { dtrap(); /* shouldn't happen */ } bufoff += sendm->m_len; /* index to next data to send in msend */ /* if socket has multiple unsent mbufs, set flag for send to loop */ if ((sendm->m_next) && (len > (int)sendm->m_len)) { flags &= ~TH_FIN; /* don't FIN on segment prior to last */ sendalot = 1; /* set to send more segments */ } if((flags & TH_FIN) && (so->so_snd.sb_cc > (unsigned)len)) { /* This can happen on slow links (PPP) which retry the last * segment - the one with the FIN bit attached to data. */ flags &= ~TH_FIN; /* don't FIN on segment prior to last */ } /* only send the rest of msend */ len = min(len, (int)sendm->m_len); /* if we're not sending starting at sendm->m_data (in which * case bufoff != 0), then we will copy the data; else we would * write IP/TCP headers over sent but un-ack'ed data in sendm. * Similarly, if sendm->m_data is not aligned with respect to * sendm->m_base and ALIGN_TYPE, we will copy the data to * ensure that it (and the then-prepended IP/TCP headers) will * be aligned according to ALIGN_TYPE. */ if ((bufoff != 0) || /* data not front aligned in send mbuf? */ (((sendm->m_data - sendm->m_base) & (ALIGN_TYPE - 1)) != 0)) { len = min(len, (int)(sendm->m_len - bufoff)); /* limit len again */ /* One more test - if this data is not aligned with the front * of the m_data buffer then we can't use it in place, else we * might write the IP/TCP header over data that has not yet * been acked. In this case we must make sure our send * fits into a little buffer and send what we can. */ if ((len > (int)(lilbufsiz - HDRSLEN)) && /* length is bigger the small buffer? */ (bigfreeq.q_len < 2)) /* and we are low on big buffers */ { len = lilbufsiz - HDRSLEN; } } } /* if send data is sufficiently aligned in packet, prepend TCP/IP header * in the space provided. */ if (len && (bufoff == 0) && (sendm->pkt->inuse == 1) && (((sendm->m_data - sendm->m_base) & (ALIGN_TYPE - 1)) == 0) && (optlen == 0)) { /* get an empty mbuf to "clone" the data */ m = m_getnbuf(MT_TXDATA, 0); if (!m) { EXIT_CRIT_SECTION(tp); return (ENOBUFS); } m->pkt = sendm->pkt; /* copy packet location in new mbuf */ m->pkt->inuse++; /* bump packet's use count */ m->m_base = sendm->m_base; /* clone mbuf members */ m->m_memsz = sendm->m_memsz; m->m_len = len + TCPIPHDRSZ; /* adjust clone for header */ m->m_data = sendm->m_data - TCPIPHDRSZ; } else /* either no data or data is not front aligned in mbuf */ { /* Grab a header mbuf, attaching a copy of data to be * transmitted, and initialize the header from * the template for sends on this connection. */ m = m_getwithdata (MT_HEADER, IFNETHDR_SIZE + TCPIPHDRSZ); if (m ==(struct mbuf *)NULL) { EXIT_CRIT_SECTION(tp); return ENOBUFS; } m->m_len = TCPIPHDRSZ; m->m_data += IFNETHDR_SIZE;/* Move this to sizeof tcpip hdr leave*/ /* 14 bytes for ethernet header */ if (len) /* attach any data to send */ { m->m_next = m_copy(so->so_snd.sb_mb, off, (int) len); if (m->m_next == 0) { m_freem(m); EXIT_CRIT_SECTION(tp); return ENOBUFS; } } } EXIT_CRIT_SECTION(tp); if (len) { if (tp->t_force && len == 1) tcpstat.tcps_sndprobe++; else if (SEQ_LT(tp->snd_nxt, tp->snd_max)) { tcpstat.tcps_sndrexmitpack++; tcpstat.tcps_sndrexmitbyte += len; #ifdef TCP_SACK if(sack_resend) tcpstat.tcps_sackresend++; #endif } else { tcpstat.tcps_sndpack++; tcpstat.tcps_sndbyte += len; } } else if (tp->t_flags & TF_ACKNOW) { tcpstat.tcps_sndacks++; } else if (flags & (TH_SYN|TH_FIN|TH_RST)) tcpstat.tcps_sndctrl++; else if (SEQ_GT(tp->snd_up, tp->snd_una)) tcpstat.tcps_sndurg++; else tcpstat.tcps_sndwinup++; ti = (struct tcpiphdr *)(m->m_data+sizeof(struct ip)-sizeof(struct ipovly)); if ((char *)ti < m->pkt->nb_buff) { panic("tcp_out- packet ptr underflow\n"); } tcp_mbuf = m; /* flag TCP header mbuf */ #ifdef IP_V6 /* Dual mode code */ if(so->so_domain == AF_INET6) { m = mbuf_prepend(m, sizeof(struct ipv6)); if(m == NULL) { /* this can happen when we run out of mbufs or pkt buffers * That is, mfreeq is empty or (lilfreeq, bigfreeq) are empty. * One solution is to find out which one is getting full and * then increase them. */ dtrap(); /* This is really rare... */ m_freem(tcp_mbuf); /* Free TCP/data chain */ return ENOBUFS; } /* strip overlay from front of TCP header */ tcp_mbuf->m_data += sizeof(struct ipovly); tcp_mbuf->m_len -= sizeof(struct ipovly); } #endif /* end IP_V6 */ if (tp->t_template == 0) panic("tcp_output"); MEMCPY((char*)ti, (char*)tp->t_template, sizeof(struct tcpiphdr)); /* * Fill in fields, remembering maximum advertised * window for use in delaying messages about window sizes. * If resending a FIN, be sure not to use a new sequence number. */ if (flags & TH_FIN && tp->t_flags & TF_SENTFIN && tp->snd_nxt == tp->snd_max) { tp->snd_nxt--; } ti->ti_seq = htonl(tp->snd_nxt); ti->ti_ack = htonl(tp->rcv_nxt); /* * If we're sending a SYN, check the IP address of the interface * that we will (likely) use to send the IP datagram -- if it's * changed from what is in the template (as it might if this is * a retransmission, and the original SYN caused PPP to start * bringing the interface up, and PPP has got a new IP address * via IPCP), update the template and the inpcb with the new * address. */ if (flags & TH_SYN) { struct inpcb * inp; inp = (struct inpcb *)so->so_pcb; switch(so->so_domain) { #ifdef IP_V4 case AF_INET: { ip_addr src; #ifdef INCLUDE_PPP if(((flags & TH_ACK) == 0) && /* SYN only, not SYN/ACK */ (inp->ifp) && /* Make sure we have iface */ (inp->ifp->mib.ifType == PPP)) /* only PPP type */ { dtrap(); /* remove after confirmed to work in PPP */ src = ip_mymach(ti->ti_dst.s_addr); if (src != ti->ti_src.s_addr) { ti->ti_src.s_addr = src; tp->t_template->ti_src.s_addr = src; tp->t_inpcb->inp_laddr.s_addr = src; } } #endif /* INCLUDE_PPP */ /* If this is a SYN (not a SYN/ACK) then set the pmtu */ if((flags & TH_ACK) == 0) { #ifdef IP_PMTU inp->inp_pmtu = pmtucache_get(inp->inp_faddr.s_addr); #else /* not compiled for pathmtu, guess based on iface */ { NET ifp; /* find iface for route. Pass "src" as nexthop return */ ifp = iproute(ti->ti_dst.s_addr, &src); if(ifp) inp->inp_pmtu = ifp->n_mtu - (ifp->n_lnh + 40); else inp->inp_pmtu = 580; /* Ugh. */ } #endif /* IP_PMTU */ } break; } #endif /* IP_V4 */ #ifdef IP_V6 case AF_INET6: { struct ip6_inaddr * local; local = ip6_myaddr(&tp->t_inpcb->ip6_faddr, inp->ifp); /* If we got a local address & it's not the one in the pcb, then * we assume it changed at the iface and fix it in the pcb. Unlike * v4, we don't have an IP header yet, not do we have a template * to worry about. */ if((local) && (!IP6EQ(&local->addr, &tp->t_inpcb->ip6_laddr))) { IP6CPY(&tp->t_inpcb->ip6_laddr, &local->addr); } /* If this is a SYN (not a SYN/ACK) then set the pmtu */ if((flags & TH_ACK) == 0) { inp->inp_pmtu = ip6_pmtulookup(&inp->ip6_laddr, inp->ifp); } break; } #endif /* IP_V6 */ default: dtrap(); /* bad domain setting */ } } /* fill in options if any are set */ if (optlen) { struct mbuf * mopt; mopt = m_getwithdata(MT_TXDATA, MAXOPTLEN); if (mopt == NULL) { m_freem(m); return (ENOBUFS); } /* insert options mbuf after after tmp_mbuf */ mopt->m_next = tcp_mbuf->m_next; tcp_mbuf->m_next = mopt; /* extend options to aligned address */ while(optlen & 0x03) tcp_optionbuf[optlen++] = TCPOPT_EOL; MEMCPY(mtod(mopt, char *), tcp_optionbuf, optlen); mopt->m_len = optlen; /* use portable macro to set tcp data offset bits */ SET_TH_OFF(ti->ti_t, ((sizeof (struct tcphdr) + optlen) >> 2)); } ti->ti_flags = (u_char)flags; /* * Calculate receive window. Don't shrink window, * but avoid silly window syndrome. */ if (win < (long)(so->so_rcv.sb_hiwat / 4) && win < (long)tp->t_maxseg) win = 0; if (win < (long)(tp->rcv_adv - tp->rcv_nxt)) win = (long)(tp->rcv_adv - tp->rcv_nxt); /* do check for Iniche buffer limits -JB- */ if (bigfreeq.q_len == 0) /* If queue length is 0, set window to 0 */ { win = 0; } else if(win > (((long)bigfreeq.q_len - 1) * (long)bigbufsiz)) { win = ((long)bigfreeq.q_len - 1) * bigbufsiz; } #ifdef TCP_WIN_SCALE if(tp->t_flags & TF_WINSCALE) { ti->ti_win = htons((u_short)(win >> tp->rcv_wind_scale)); /* apply scale */ }
/* * When a new ack with SACK is received, check if it indicates packet * reordering. If there is packet reordering, the socket is marked and * the late time offset by which the packet was reordered with * respect to its closest neighboring packets is computed. */ static void tcp_sack_detect_reordering(struct tcpcb *tp, struct sackhole *s, tcp_seq sacked_seq, tcp_seq snd_fack) { int32_t rext = 0, reordered = 0; /* * If the SACK hole is past snd_fack, this is from new SACK * information, so we can ignore it. */ if (SEQ_GT(s->end, snd_fack)) return; /* * If there has been a retransmit timeout, then the timestamp on * the SACK segment will be newer. This might lead to a * false-positive. Avoid re-ordering detection in this case. */ if (tp->t_rxtshift > 0) return; /* * Detect reordering from SACK information by checking * if recently sacked data was never retransmitted from this hole. */ if (SEQ_LT(s->rxmit, sacked_seq)) { reordered = 1; tcpstat.tcps_avoid_rxmt++; } if (reordered) { if (tcp_detect_reordering == 1 && !(tp->t_flagsext & TF_PKTS_REORDERED)) { tp->t_flagsext |= TF_PKTS_REORDERED; tcpstat.tcps_detect_reordering++; } tcpstat.tcps_reordered_pkts++; tp->t_reordered_pkts++; /* * If reordering is seen on a connection wth ECN enabled, * increment the heuristic */ if (TCP_ECN_ENABLED(tp)) { INP_INC_IFNET_STAT(tp->t_inpcb, ecn_fallback_reorder); tcpstat.tcps_ecn_fallback_reorder++; tcp_heuristic_ecn_aggressive(tp); } VERIFY(SEQ_GEQ(snd_fack, s->rxmit)); if (s->rxmit_start > 0) { rext = timer_diff(tcp_now, 0, s->rxmit_start, 0); if (rext < 0) return; /* * We take the maximum reorder window to schedule * DELAYFR timer as that will take care of jitter * on the network path. * * Computing average and standard deviation seems * to cause unnecessary retransmissions when there * is high jitter. * * We set a maximum of SRTT/2 and a minimum of * 10 ms on the reorder window. */ tp->t_reorderwin = max(tp->t_reorderwin, rext); tp->t_reorderwin = min(tp->t_reorderwin, (tp->t_srtt >> (TCP_RTT_SHIFT - 1))); tp->t_reorderwin = max(tp->t_reorderwin, 10); } }
/* * USTAT PDU / SOS_READY Processor * * Arguments: * sop pointer to sscop connection block * m pointer to PDU buffer (without trailer) * trlr pointer to PDU trailer * * Returns: * none * */ void sscop_ustat_ready(struct sscop *sop, KBuffer *m, caddr_t trlr) { struct ustat_pdu *up = (struct ustat_pdu *)trlr; struct pdu_hdr *php; sscop_seq seq1, seq2; up->ustat_nmr = ntohl(up->ustat_nmr); up->ustat_nr = ntohl(up->ustat_nr); /* * Validate peer's current receive data sequence number */ if (SEQ_GT(sop->so_ack, up->ustat_nr, sop->so_ack) || SEQ_GEQ(up->ustat_nr, sop->so_send, sop->so_ack)) { /* * Bad data sequence number */ goto goterr; } /* * Free acknowledged PDUs */ for (seq1 = sop->so_ack, SEQ_SET(seq2, up->ustat_nr); SEQ_LT(seq1, seq2, sop->so_ack); SEQ_INCR(seq1, 1)) { sscop_pack_free(sop, seq1); } /* * Update transmit state variables */ sop->so_ack = seq2; SEQ_SET(sop->so_sendmax, up->ustat_nmr); /* * Get USTAT list elements */ SEQ_SET(seq1, ntohl(up->ustat_le1)); SEQ_SET(seq2, ntohl(up->ustat_le2)); /* * Validate elements */ if (SEQ_GT(sop->so_ack, seq1, sop->so_ack) || SEQ_GEQ(seq1, seq2, sop->so_ack) || SEQ_GEQ(seq2, sop->so_send, sop->so_ack)) { /* * Bad element sequence number */ goto goterr; } /* * Process each missing sequence number in this gap */ while (SEQ_LT(seq1, seq2, sop->so_ack)) { /* * Find corresponding SD PDU on pending ack queue */ php = sscop_pack_locate(sop, seq1); if (php == NULL) { goto goterr; } /* * Retransmit this SD PDU if it's not * already scheduled for retranmission. */ if ((php->ph_rexmit_lk == NULL) && (sop->so_rexmit_tl != php)) { /* * Put PDU on retransmit queue and schedule * transmit servicing */ sscop_rexmit_insert(sop, php); sop->so_flags |= SOF_XMITSRVC; } /* * Bump to next sequence number */ SEQ_INCR(seq1, 1); } /* * Report retransmitted PDUs */ sscop_maa_error(sop, 'V'); /* * Free PDU buffer chain */ KB_FREEALL(m); /* * See if transmit queues need servicing */ if (sop->so_flags & SOF_XMITSRVC) sscop_service_xmit(sop); return; goterr: /* * Protocol/parameter error encountered */ sscop_maa_error(sop, 'T'); /* * Free PDU buffer chain */ KB_FREEALL(m); if (sop->so_vers == SSCOP_VERS_QSAAL) /* * Reestablish a new connection */ qsaal1_reestablish(sop); else /* * Initiate error recovery */ q2110_error_recovery(sop); return; }
/* * We have received an ACK for a given sequence number (either standalone * or via piggy-back on a regular send) */ void opal_btl_usnic_handle_ack( opal_btl_usnic_endpoint_t *endpoint, opal_btl_usnic_seq_t ack_seq) { opal_btl_usnic_seq_t is; opal_btl_usnic_send_segment_t *sseg; opal_btl_usnic_send_frag_t *frag; opal_btl_usnic_module_t *module; uint32_t bytes_acked; module = endpoint->endpoint_module; /* ignore if this is an old ACK */ if (SEQ_LT(ack_seq, endpoint->endpoint_ack_seq_rcvd)) { #if MSGDEBUG1 opal_output(0, "Got OLD DUP ACK seq %"UDSEQ" < %"UDSEQ"\n", ack_seq, endpoint->endpoint_ack_seq_rcvd); #endif ++module->stats.num_old_dup_acks; return; /* A duplicate ACK means next seg was lost */ } else if (ack_seq == endpoint->endpoint_ack_seq_rcvd) { ++module->stats.num_dup_acks; opal_btl_usnic_force_retrans(endpoint, ack_seq); return; } /* Does this ACK have a new sequence number that we haven't seen before? */ for (is = endpoint->endpoint_ack_seq_rcvd + 1; SEQ_LE(is, ack_seq); ++is) { sseg = endpoint->endpoint_sent_segs[WINDOW_SIZE_MOD(is)]; #if MSGDEBUG1 opal_output(0, " Checking ACK/sent_segs window %p, index %lu, seq %lu, occupied=%p, seg_room=%d", (void*) endpoint->endpoint_sent_segs, WINDOW_SIZE_MOD(is), is, (void*)sseg, (sseg?sseg->ss_hotel_room:-2)); #endif assert(sseg != NULL); assert(sseg->ss_base.us_btl_header->pkt_seq == is); #if MSGDEBUG1 if (sseg->ss_hotel_room == -1) { opal_output(0, "=== ACKed frag in sent_frags array is not in hotel/enqueued, module %p, endpoint %p, seg %p, seq %" UDSEQ ", slot %lu", (void*) module, (void*) endpoint, (void*) sseg, is, WINDOW_SIZE_MOD(is)); } #endif /* Check the sending segment out from the hotel. NOTE: The segment might not actually be in a hotel room if it has already been evicted and queued for resend. If it's not in the hotel, don't check it out! */ if (OPAL_LIKELY(sseg->ss_hotel_room != -1)) { opal_hotel_checkout(&endpoint->endpoint_hotel, sseg->ss_hotel_room); sseg->ss_hotel_room = -1; /* hotel_room == -1 means queued for resend, remove it */ } else { opal_list_remove_item((&module->pending_resend_segs), &sseg->ss_base.us_list.super); } /* update the owning fragment */ bytes_acked = sseg->ss_base.us_btl_header->payload_len; frag = sseg->ss_parent_frag; #if MSGDEBUG1 opal_output(0, " ACKED seg %p frag %p ack_bytes=%"PRIu32" left=%zd dst_seg[0].seg_addr=%p des_flags=0x%x\n", (void*)sseg, (void*)frag, bytes_acked, frag->sf_ack_bytes_left - bytes_acked, frag->sf_base.uf_local_seg[0].seg_addr.pval, frag->sf_base.uf_base.des_flags); #endif /* If all ACKs received, and this is a put or a regular send * that needs a callback, perform the callback now * * NOTE on sf_ack_bytes_left - here we check for * sf_ack_bytes_left == bytes_acked * as opposed to adjusting sf_ack_bytes_left and checking for 0 because * if we don't, the callback function may call usnic_free() and free * the fragment out from under us which we do not want. If the * fragment really needs to be freed, we'll take care of it in a few * lines below. */ if (frag->sf_ack_bytes_left == bytes_acked && ((frag->sf_base.uf_remote_seg[0].seg_addr.pval != NULL) || (frag->sf_base.uf_base.des_flags & MCA_BTL_DES_SEND_ALWAYS_CALLBACK))) { OPAL_BTL_USNIC_DO_SEND_FRAG_CB(module, frag, "send completion"); } /* free this segment */ sseg->ss_ack_pending = false; if (sseg->ss_send_posted == 0) { opal_btl_usnic_release_send_segment(module, frag, sseg); } /* when no bytes left to ACK, fragment send is truly done */ /* see note above on why this is done here as opposed to earlier */ frag->sf_ack_bytes_left -= bytes_acked; /* OK to return this fragment? */ opal_btl_usnic_send_frag_return_cond(module, frag); /* indicate this segment has been ACKed */ endpoint->endpoint_sent_segs[WINDOW_SIZE_MOD(is)] = NULL; } /* update ACK received */ endpoint->endpoint_ack_seq_rcvd = ack_seq; /* send window may have opened, possibly make endpoint ready-to-send */ opal_btl_usnic_check_rts(endpoint); }
/******************************************************************** * Function: DCE2_SetSsnState() * * Purpose: * Checks for missing packets and overlapping data on session * * Arguments: * DCE2_SsnData * - session data pointer * SFSnortPacket * - packet structure * * Returns: * DCE2_RET__SUCCESS * DCE2_RET__ERROR * ********************************************************************/ static DCE2_Ret DCE2_SetSsnState(DCE2_SsnData *sd, SFSnortPacket *p) { uint32_t pkt_seq = ntohl(p->tcp_header->sequence); PROFILE_VARS; PREPROC_PROFILE_START(dce2_pstat_session_state); DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Payload size: %u\n", p->payload_size)); if (DCE2_SsnFromClient(p) && !DCE2_SsnSeenClient(sd)) { uint32_t pkt_ack = ntohl(p->tcp_header->acknowledgement); if (DCE2_SsnSeenServer(sd) && SEQ_LT(sd->cli_seq, pkt_seq) && (sd->trans != DCE2_TRANS_TYPE__HTTP_SERVER)) { DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Missing packets on session - aborting session inspection\n")); DCE2_SetNoInspect(sd); PREPROC_PROFILE_END(dce2_pstat_session_state); return DCE2_RET__ERROR; } DCE2_SsnSetSeenClient(sd); sd->cli_seq = pkt_seq; sd->cli_nseq = pkt_seq + p->payload_size; if (!DCE2_SsnSeenServer(sd)) sd->srv_seq = sd->srv_nseq = pkt_ack; DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Initial client => seq: %u, " "next seq: %u\n", sd->cli_seq, sd->cli_nseq)); } else if (DCE2_SsnFromServer(p) && !DCE2_SsnSeenServer(sd)) { uint32_t pkt_ack = ntohl(p->tcp_header->acknowledgement); if ((DCE2_SsnSeenClient(sd) && SEQ_LT(sd->srv_seq, pkt_seq)) || (!DCE2_SsnSeenClient(sd) && (sd->trans != DCE2_TRANS_TYPE__HTTP_SERVER))) { DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Missing packets on session - aborting session inspection\n")); PREPROC_PROFILE_END(dce2_pstat_session_state); DCE2_SetNoInspect(sd); return DCE2_RET__ERROR; } DCE2_SsnSetSeenServer(sd); sd->srv_seq = pkt_seq; sd->srv_nseq = pkt_seq + p->payload_size; if (!DCE2_SsnSeenClient(sd)) sd->cli_seq = sd->cli_nseq = pkt_ack; DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Initial server => seq: %u, " "next seq: %u\n", sd->srv_seq, sd->srv_nseq)); } else { uint32_t *ssn_seq; uint32_t *ssn_nseq; if (DCE2_SsnFromClient(p)) { ssn_seq = &sd->cli_seq; ssn_nseq = &sd->cli_nseq; DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Client last => seq: %u, " "next seq: %u\n", sd->cli_seq, sd->cli_nseq)); DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "This packet => seq: %u, " "next seq: %u\n", pkt_seq, pkt_seq + p->payload_size)); } else { ssn_seq = &sd->srv_seq; ssn_nseq = &sd->srv_nseq; DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Server last => seq: %u, " "next seq: %u\n", sd->srv_seq, sd->srv_nseq)); DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "This packet => seq: %u, " "next seq: %u\n", pkt_seq, pkt_seq + p->payload_size)); } if (*ssn_nseq != pkt_seq) { if (SEQ_LT(*ssn_nseq, pkt_seq)) { DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Next expected sequence number (%u) is less than " "this sequence number (%u).\n", *ssn_nseq, pkt_seq)); DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Missing packets on session - aborting session inspection\n")); DCE2_SetNoInspect(sd); PREPROC_PROFILE_END(dce2_pstat_session_state); return DCE2_RET__ERROR; } else { /* Got some kind of overlap. This shouldn't happen since we're doing * reassembly on both sides and not looking at non-reassembled packets * Actually this can happen if the stream seg list is empty */ DEBUG_WRAP(DCE2_DebugMsg(DCE2_DEBUG__MAIN, "Overlap => seq: %u, " "next seq: %u - aborting session inspection\n", pkt_seq, pkt_seq + p->payload_size)); DCE2_SetNoInspect(sd); PREPROC_PROFILE_END(dce2_pstat_session_state); return DCE2_RET__ERROR; } } *ssn_seq = pkt_seq; *ssn_nseq = pkt_seq + p->payload_size; } PREPROC_PROFILE_END(dce2_pstat_session_state); return DCE2_RET__SUCCESS; }
int rudp_recv_cb(int fd, void *arg) { rudp_socket_t rsock = (rudp_socket_t)arg; rudp_session_t rsession = NULL; rudp_dgram_t rudp_pkt; struct sockaddr_in from; int i; size_t from_len; int ret; char buf[sizeof(struct _rudp_dgram_t)]; memset((char*)&from, 0, sizeof(struct sockaddr_in)); from_len = sizeof(from); ret = recvfrom(fd, buf, sizeof(struct _rudp_dgram_t), 0, (struct sockaddr*)&from, &from_len); if(ret < 0) { perror("recvfrom:"); return -1; } //drop = 1; rudp_pkt = (rudp_dgram_t) buf; #ifdef DROP ++drop; if((drop % 5 == 0) && (rudp_pkt->hdr.type == RUDP_DATA)) { printf("Dropping.. %d\n", drop); return 0; } #endif /* DROP */ if(rudp_pkt->hdr.type == RUDP_ACK) { rsession = rudp_get_session(rsock, &from); if(NULL == rsession) { printf("rudp_recv_cb: No session found\n"); return -1; } } /* Session not correct return immediatedly */ #ifdef DEB printf("Packet type: %d\n\ Packet version: %d\n\ Packet SeqNo.: %d\n", rudp_pkt->hdr.type, rudp_pkt->hdr.version, rudp_pkt->hdr.seqno); #endif /* DEB */ switch(rudp_pkt->hdr.type) { case RUDP_DATA: for(i = 0; i < recv_session; ++i) { /* Check if correct seq no. */ if((SEQ_EQ(recv_seq_no[i], rudp_pkt->hdr.seqno)) && (rsock->recv_handler != NULL)) { rsock->recv_handler(rsock, &from, rudp_pkt->data, rudp_pkt->data_len); rudp_send_ack(rsock, i, &from); break; } } /* Else drop the packet */ break; case RUDP_ACK: //if(rsession->last_seq + 1 != rudp_pkt->hdr.seqno) break; if(rsession->state == RUDP_SESSION_OPENED) { rsession->state = RUDP_SESSION_SYN; event_timeout_delete(rudp_ack_time_cb, rsession); rsession->wstart = rsession->head->next; rudp_send_dgram(RUDP_DATA, rsession); rsession->wsize = 0; } else if(rsession->state == RUDP_SESSION_SYN) { while(SEQ_LT(rsession->wstart->hdr.seqno, rudp_pkt->hdr.seqno)) { rsession->wstart = rsession->wstart->next; if(NULL == rsession->wstart) { event_timeout_delete(rudp_ack_time_cb, rsession); rsession->state = RUDP_SESSION_DAT; rudp_send_dgram(RUDP_FIN, rsession); break; } ++rsession->wsize; } //printf("Window Size: %d\n", rsession->wsize); if((rsession->wsize == RUDP_WINDOW) && (NULL != rsession->wstart)) { event_timeout_delete(rudp_ack_time_cb, rsession); rsession->wsize = 0; rudp_send_dgram(RUDP_DATA, rsession); } } else if(rsession->state == RUDP_SESSION_DAT) { rudp_socket_t r; rsession->state = RUDP_SESSION_FIN; event_timeout_delete(rudp_ack_time_cb, rsession); r = rsession->rsock; rudp_free_session(rsession); #ifdef DEBL printf("nsessions: %d\n", r->nsessions); #endif /* DEBL */ /* Last session on this socket */ if(r->nsessions == 1) { event_fd_delete(rudp_recv_cb, r); r->event_handler(r, RUDP_EVENT_CLOSED, NULL); close(r->sockfd); free(r); } else { /* Decrement the sessions on this socket */ --r->nsessions; } } break; case RUDP_SYN: recv_seq_no[recv_session] = rudp_pkt->hdr.seqno; rudp_send_ack(rsock, recv_session++, &from); all_close = recv_session; break; case RUDP_FIN: for(i = 0; i < recv_session; ++i) { if(SEQ_EQ(recv_seq_no[i], rudp_pkt->hdr.seqno)) { rudp_send_ack(rsock, i, &from); //recv_seq_no[i] = 0; --all_close; break; } } /* Close the socket on the reciever when all the files are recieved */ if(!all_close) rudp_close(rsock); break; } return 0; }
static int do_fw4_ack(struct sge_iq *iq, const struct rss_header *rss, struct mbuf *m) { struct adapter *sc = iq->adapter; const struct cpl_fw4_ack *cpl = (const void *)(rss + 1); unsigned int tid = G_CPL_FW4_ACK_FLOWID(be32toh(OPCODE_TID(cpl))); struct toepcb *toep = lookup_tid(sc, tid); struct inpcb *inp; struct tcpcb *tp; struct socket *so; uint8_t credits = cpl->credits; struct ofld_tx_sdesc *txsd; int plen; #ifdef INVARIANTS unsigned int opcode = G_CPL_FW4_ACK_OPCODE(be32toh(OPCODE_TID(cpl))); #endif /* * Very unusual case: we'd sent a flowc + abort_req for a synq entry and * now this comes back carrying the credits for the flowc. */ if (__predict_false(toep->flags & TPF_SYNQE)) { KASSERT(toep->flags & TPF_ABORT_SHUTDOWN, ("%s: credits for a synq entry %p", __func__, toep)); return (0); } inp = toep->inp; KASSERT(opcode == CPL_FW4_ACK, ("%s: unexpected opcode 0x%x", __func__, opcode)); KASSERT(m == NULL, ("%s: wasn't expecting payload", __func__)); KASSERT(toep->tid == tid, ("%s: toep tid mismatch", __func__)); INP_WLOCK(inp); if (__predict_false(toep->flags & TPF_ABORT_SHUTDOWN)) { INP_WUNLOCK(inp); return (0); } KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0, ("%s: inp_flags 0x%x", __func__, inp->inp_flags)); tp = intotcpcb(inp); if (cpl->flags & CPL_FW4_ACK_FLAGS_SEQVAL) { tcp_seq snd_una = be32toh(cpl->snd_una); #ifdef INVARIANTS if (__predict_false(SEQ_LT(snd_una, tp->snd_una))) { log(LOG_ERR, "%s: unexpected seq# %x for TID %u, snd_una %x\n", __func__, snd_una, toep->tid, tp->snd_una); } #endif if (tp->snd_una != snd_una) { tp->snd_una = snd_una; tp->ts_recent_age = tcp_ts_getticks(); } } so = inp->inp_socket; txsd = &toep->txsd[toep->txsd_cidx]; plen = 0; while (credits) { KASSERT(credits >= txsd->tx_credits, ("%s: too many (or partial) credits", __func__)); credits -= txsd->tx_credits; toep->tx_credits += txsd->tx_credits; plen += txsd->plen; txsd++; toep->txsd_avail++; KASSERT(toep->txsd_avail <= toep->txsd_total, ("%s: txsd avail > total", __func__)); if (__predict_false(++toep->txsd_cidx == toep->txsd_total)) { txsd = &toep->txsd[0]; toep->txsd_cidx = 0; } } if (plen > 0) { struct sockbuf *sb = &so->so_snd; SOCKBUF_LOCK(sb); sbdrop_locked(sb, plen); sowwakeup_locked(so); SOCKBUF_UNLOCK_ASSERT(sb); } /* XXX */ if ((toep->flags & TPF_TX_SUSPENDED && toep->tx_credits >= MIN_OFLD_TX_CREDITS) || toep->tx_credits == toep->txsd_total * howmany((sizeof(struct fw_ofld_tx_data_wr) + 1), 16)) { toep->flags &= ~TPF_TX_SUSPENDED; t4_push_frames(sc, toep); } INP_WUNLOCK(inp); return (0); }
/* * SD PDU / SOS_READY Processor * * Arguments: * sop pointer to sscop connection block * m pointer to PDU buffer (without trailer) * trlr pointer to PDU trailer * * Returns: * none * */ static void sscop_sd_ready(struct sscop *sop, KBuffer *m, caddr_t trlr) { struct sd_pdu *sp = (struct sd_pdu *)trlr; struct pdu_hdr *php; KBuffer *n; sscop_seq ns; int err, space; /* * Get PDU sequence number */ SEQ_SET(ns, ntohl(sp->sd_ns)); /* * Ensure that the sequence number fits within the window */ if (SEQ_GEQ(ns, sop->so_rcvmax, sop->so_rcvnext)) { /* * It doesn't, drop received data */ KB_FREEALL(m); /* * If next highest PDU hasn't reached window end yet, * then send a USTAT to inform transmitter of this gap */ if (SEQ_LT(sop->so_rcvhigh, sop->so_rcvmax, sop->so_rcvnext)) { sscop_send_ustat(sop, sop->so_rcvmax); sop->so_rcvhigh = sop->so_rcvmax; } return; } /* * If this is the next in-sequence PDU, hand it to user */ if (ns == sop->so_rcvnext) { STACK_CALL(SSCOP_DATA_IND, sop->so_upper, sop->so_toku, sop->so_connvc, (int)m, ns, err); if (err) { KB_FREEALL(m); return; } /* * Bump next expected sequence number */ SEQ_INCR(sop->so_rcvnext, 1); /* * Slide receive window down */ SEQ_INCR(sop->so_rcvmax, 1); /* * Is this the highest sequence PDU we've received?? */ if (ns == sop->so_rcvhigh) { /* * Yes, bump the limit and exit */ sop->so_rcvhigh = sop->so_rcvnext; return; } /* * This is a retransmitted PDU, so see if we have * more in-sequence PDUs already queued up */ while ((php = sop->so_recv_hd) && (php->ph_ns == sop->so_rcvnext)) { /* * Yup we do, so remove next PDU from queue and * pass it up to the user as well */ sop->so_recv_hd = php->ph_recv_lk; if (sop->so_recv_hd == NULL) sop->so_recv_tl = NULL; STACK_CALL(SSCOP_DATA_IND, sop->so_upper, sop->so_toku, sop->so_connvc, (int)php->ph_buf, php->ph_ns, err); if (err) { /* * Should never happen, but... */ KB_FREEALL(php->ph_buf); sscop_abort(sop, "stack memory\n"); return; } /* * Bump next expected sequence number */ SEQ_INCR(sop->so_rcvnext, 1); /* * Slide receive window down */ SEQ_INCR(sop->so_rcvmax, 1); } /* * Finished with data delivery... */ return; } /* * We're gonna have to queue this PDU, so find space * for the PDU header */ KB_HEADROOM(m, space); /* * If there's not enough room in the received buffer, * allocate & link a new buffer for the header */ if (space < sizeof(struct pdu_hdr)) { KB_ALLOC(n, sizeof(struct pdu_hdr), KB_F_NOWAIT, KB_T_HEADER); if (n == NULL) { KB_FREEALL(m); return; } KB_HEADSET(n, sizeof(struct pdu_hdr)); KB_LEN(n) = 0; KB_LINKHEAD(n, m); m = n; } /* * Build PDU header * * We can at least assume/require that the start of * the user data is aligned. Also note that we don't * include this header in the buffer len/offset fields. */ KB_DATASTART(m, php, struct pdu_hdr *); php--; php->ph_ns = ns; php->ph_buf = m; /* * Insert PDU into the receive queue */ if (sscop_recv_insert(sop, php)) { /* * Oops, a duplicate sequence number PDU is already on * the queue, somethings wrong here. */ sscop_maa_error(sop, 'Q'); /* * Free buffers */ KB_FREEALL(m); /* * Go into recovery mode */ q2110_error_recovery(sop); return; } /* * Are we at the high-water mark?? */ if (ns == sop->so_rcvhigh) { /* * Yes, just bump the mark */ SEQ_INCR(sop->so_rcvhigh, 1); return; } /* * Are we beyond the high-water mark?? */ if (SEQ_GT(ns, sop->so_rcvhigh, sop->so_rcvnext)) { /* * Yes, then there's a missing PDU, so inform the transmitter */ sscop_send_ustat(sop, ns); /* * Update high-water mark */ sop->so_rcvhigh = SEQ_ADD(ns, 1); } return; }
/* * STAT PDU / SOS_READY Processor * * Arguments: * sop pointer to sscop connection block * m pointer to PDU buffer (without trailer) * trlr pointer to PDU trailer * * Returns: * none * */ void sscop_stat_ready(struct sscop *sop, KBuffer *m, caddr_t trlr) { struct stat_pdu *sp = (struct stat_pdu *)trlr; struct pdu_hdr *php; KBuffer *m0 = m; sscop_seq seq1, seq2, opa; int cnt = 0; sp->stat_nps = ntohl(sp->stat_nps); sp->stat_nmr = ntohl(sp->stat_nmr); sp->stat_nr = ntohl(sp->stat_nr); /* * Validate peer's received poll sequence number */ if (SEQ_GT(sop->so_pollack, sp->stat_nps, sop->so_pollack) || SEQ_GT(sp->stat_nps, sop->so_pollsend, sop->so_pollack)) { /* * Bad poll sequence number */ sscop_maa_error(sop, 'R'); goto goterr; } /* * Validate peer's current receive data sequence number */ if (SEQ_GT(sop->so_ack, sp->stat_nr, sop->so_ack) || SEQ_GT(sp->stat_nr, sop->so_send, sop->so_ack)) { /* * Bad data sequence number */ sscop_maa_error(sop, 'S'); goto goterr; } /* * Free acknowledged PDUs */ for (seq1 = sop->so_ack, SEQ_SET(seq2, sp->stat_nr); SEQ_LT(seq1, seq2, sop->so_ack); SEQ_INCR(seq1, 1)) { sscop_pack_free(sop, seq1); } /* * Update transmit state variables */ opa = sop->so_pollack; sop->so_ack = seq2; SEQ_SET(sop->so_pollack, sp->stat_nps); SEQ_SET(sop->so_sendmax, sp->stat_nmr); /* * Get first element in STAT list */ while (m && (KB_LEN(m) == 0)) m = KB_NEXT(m); if (m == NULL) goto done; m = sscop_stat_getelem(m, &seq1); /* * Make sure there's a second element too */ if (m == NULL) goto done; /* * Validate first element (start of missing pdus) */ if (SEQ_GT(sop->so_ack, seq1, sop->so_ack) || SEQ_GEQ(seq1, sop->so_send, sop->so_ack)) { /* * Bad element sequence number */ sscop_maa_error(sop, 'S'); goto goterr; } /* * Loop thru all STAT elements in list */ while (m) { /* * Get next even element (start of received pdus) */ m = sscop_stat_getelem(m, &seq2); /* * Validate seqence number */ if (SEQ_GEQ(seq1, seq2, sop->so_ack) || SEQ_GT(seq2, sop->so_send, sop->so_ack)) { /* * Bad element sequence number */ sscop_maa_error(sop, 'S'); goto goterr; } /* * Process each missing sequence number in this gap */ while (SEQ_LT(seq1, seq2, sop->so_ack)) { /* * Find corresponding SD PDU on pending ack queue */ php = sscop_pack_locate(sop, seq1); if (php == NULL) { sscop_maa_error(sop, 'S'); goto goterr; } /* * Retransmit this SD PDU only if it was last sent * during an earlier poll sequence and it's not * already scheduled for retranmission. */ if (SEQ_LT(php->ph_nps, sp->stat_nps, opa) && (php->ph_rexmit_lk == NULL) && (sop->so_rexmit_tl != php)) { /* * Put PDU on retransmit queue and schedule * transmit servicing */ sscop_rexmit_insert(sop, php); sop->so_flags |= SOF_XMITSRVC; cnt++; } /* * Bump to next sequence number */ SEQ_INCR(seq1, 1); } /* * Now process series of acknowledged PDUs * * Get next odd element (start of missing pdus), * but make sure there is one and that it's valid */ if (m == NULL) goto done; m = sscop_stat_getelem(m, &seq2); if (SEQ_GEQ(seq1, seq2, sop->so_ack) || SEQ_GT(seq2, sop->so_send, sop->so_ack)) { /* * Bad element sequence number */ sscop_maa_error(sop, 'S'); goto goterr; } /* * Process each acked sequence number */ while (SEQ_LT(seq1, seq2, sop->so_ack)) { /* * Can we clear transmit buffers ?? */ if ((sop->so_flags & SOF_NOCLRBUF) == 0) { /* * Yes, free acked buffers */ sscop_pack_free(sop, seq1); } /* * Bump to next sequence number */ SEQ_INCR(seq1, 1); } } done: /* * Free PDU buffer chain */ KB_FREEALL(m0); /* * Report retransmitted PDUs */ if (cnt) sscop_maa_error(sop, 'V'); /* * Record transmit window closed transitions */ if (SEQ_LT(sop->so_send, sop->so_sendmax, sop->so_ack)) { if (sop->so_flags & SOF_NOCREDIT) { sop->so_flags &= ~SOF_NOCREDIT; sscop_maa_error(sop, 'X'); } } else { if ((sop->so_flags & SOF_NOCREDIT) == 0) { sop->so_flags |= SOF_NOCREDIT; sscop_maa_error(sop, 'W'); } } if (sop->so_vers == SSCOP_VERS_QSAAL) /* * Restart lost poll/stat timer */ sop->so_timer[SSCOP_T_NORESP] = sop->so_parm.sp_timeresp; else { /* * Determine new polling phase */ if ((sop->so_timer[SSCOP_T_POLL] != 0) && ((sop->so_flags & SOF_KEEPALIVE) == 0)) { /* * Remain in active phase - reset NO-RESPONSE timer */ sop->so_timer[SSCOP_T_NORESP] = sop->so_parm.sp_timeresp; } else if (sop->so_timer[SSCOP_T_IDLE] == 0) { /* * Go from transient to idle phase */ sop->so_timer[SSCOP_T_POLL] = 0; sop->so_flags &= ~SOF_KEEPALIVE; sop->so_timer[SSCOP_T_NORESP] = 0; sop->so_timer[SSCOP_T_IDLE] = sop->so_parm.sp_timeidle; } } /* * See if transmit queues need servicing */ if (sop->so_flags & SOF_XMITSRVC) sscop_service_xmit(sop); return; goterr: /* * Protocol/parameter error encountered */ /* * Free PDU buffer chain */ KB_FREEALL(m0); if (sop->so_vers == SSCOP_VERS_QSAAL) /* * Reestablish a new connection */ qsaal1_reestablish(sop); else /* * Initiate error recovery */ q2110_error_recovery(sop); return; }
/* Receive packet */ void l2tp_ctrl_input(l2tpd *_this, int listener_index, struct sockaddr *peer, struct sockaddr *sock, void *nat_t_ctx, u_char *pkt, int pktlen) { int i, len, offsiz, reqlen, is_ctrl; uint16_t mestype; struct l2tp_avp *avp, *avp0; l2tp_ctrl *ctrl; l2tp_call *call; char buf[L2TP_AVP_MAXSIZ], errmsg[256]; time_t curr_time; u_char *pkt0; struct l2tp_header hdr; char hbuf[NI_MAXHOST + NI_MAXSERV + 16]; ctrl = NULL; curr_time = get_monosec(); pkt0 = pkt; L2TP_CTRL_ASSERT(peer->sa_family == sock->sa_family); L2TP_CTRL_ASSERT(peer->sa_family == AF_INET || peer->sa_family == AF_INET6) /* * Parse L2TP Header */ memset(&hdr, 0, sizeof(hdr)); if (pktlen < 2) { snprintf(errmsg, sizeof(errmsg), "a short packet. " "length=%d", pktlen); goto bad_packet; } memcpy(&hdr, pkt, 2); pkt += 2; if (hdr.ver != L2TP_HEADER_VERSION_RFC2661) { /* XXX: only RFC2661 is supported */ snprintf(errmsg, sizeof(errmsg), "Unsupported version at header = %d", hdr.ver); goto bad_packet; } is_ctrl = (hdr.t != 0)? 1 : 0; /* calc required length */ reqlen = 6; /* for Flags, Tunnel-Id, Session-Id field */ if (hdr.l) reqlen += 2; /* for Length field (opt) */ if (hdr.s) reqlen += 4; /* for Ns, Nr field (opt) */ if (hdr.o) reqlen += 2; /* for Offset Size field (opt) */ if (reqlen > pktlen) { snprintf(errmsg, sizeof(errmsg), "a short packet. length=%d", pktlen); goto bad_packet; } if (hdr.l != 0) { GETSHORT(hdr.length, pkt); if (hdr.length > pktlen) { snprintf(errmsg, sizeof(errmsg), "Actual packet size is smaller than the length " "field %d < %d", pktlen, hdr.length); goto bad_packet; } pktlen = hdr.length; /* remove trailing trash */ } GETSHORT(hdr.tunnel_id, pkt); GETSHORT(hdr.session_id, pkt); if (hdr.s != 0) { GETSHORT(hdr.ns, pkt); GETSHORT(hdr.nr, pkt); } if (hdr.o != 0) { GETSHORT(offsiz, pkt); if (pktlen < offsiz) { snprintf(errmsg, sizeof(errmsg), "offset field is bigger than remaining packet " "length %d > %d", offsiz, pktlen); goto bad_packet; } pkt += offsiz; } L2TP_CTRL_ASSERT(pkt - pkt0 == reqlen); pktlen -= (pkt - pkt0); /* cut down the length of header */ ctrl = NULL; memset(buf, 0, sizeof(buf)); mestype = 0; avp = NULL; if (is_ctrl) { avp0 = (struct l2tp_avp *)buf; avp = avp_find_message_type_avp(avp0, pkt, pktlen); if (avp != NULL) mestype = avp->attr_value[0] << 8 | avp->attr_value[1]; } ctrl = l2tpd_get_ctrl(_this, hdr.tunnel_id); if (ctrl == NULL) { /* new control */ if (!is_ctrl) { snprintf(errmsg, sizeof(errmsg), "bad data message: tunnelId=%d is not " "found.", hdr.tunnel_id); goto bad_packet; } if (mestype != L2TP_AVP_MESSAGE_TYPE_SCCRQ) { snprintf(errmsg, sizeof(errmsg), "bad control message: tunnelId=%d is not " "found. mestype=%s", hdr.tunnel_id, avp_mes_type_string(mestype)); goto bad_packet; } if ((ctrl = l2tp_ctrl_create()) == NULL) { l2tp_ctrl_log(ctrl, LOG_ERR, "l2tp_ctrl_create() failed: %m"); goto fail; } if (l2tp_ctrl_init(ctrl, _this, peer, sock, nat_t_ctx) != 0) { l2tp_ctrl_log(ctrl, LOG_ERR, "l2tp_ctrl_start() failed: %m"); goto fail; } ctrl->listener_index = listener_index; l2tp_ctrl_reload(ctrl); } else { /* * treat as an error if src address and port is not * match. (because it is potentially DoS attach) */ int notmatch = 0; if (ctrl->peer.ss_family != peer->sa_family) notmatch = 1; else if (peer->sa_family == AF_INET) { if (SIN(peer)->sin_addr.s_addr != SIN(&ctrl->peer)->sin_addr.s_addr || SIN(peer)->sin_port != SIN(&ctrl->peer)->sin_port) notmatch = 1; } else if (peer->sa_family == AF_INET6) { if (!IN6_ARE_ADDR_EQUAL(&(SIN6(peer)->sin6_addr), &(SIN6(&ctrl->peer)->sin6_addr)) || SIN6(peer)->sin6_port != SIN6(&ctrl->peer)->sin6_port) notmatch = 1; } if (notmatch) { snprintf(errmsg, sizeof(errmsg), "tunnelId=%u is already assigned for %s", hdr.tunnel_id, addrport_tostring( (struct sockaddr *)&ctrl->peer, ctrl->peer.ss_len, hbuf, sizeof(hbuf))); goto bad_packet; } } ctrl->last_rcv = curr_time; call = NULL; if (hdr.session_id != 0) { /* search l2tp_call by Session ID */ /* linear search is enough for this purpose */ len = slist_length(&ctrl->call_list); for (i = 0; i < len; i++) { call = slist_get(&ctrl->call_list, i); if (call->session_id == hdr.session_id) break; call = NULL; } } if (!is_ctrl) { int delayed = 0; /* L2TP data */ if (ctrl->state != L2TP_CTRL_STATE_ESTABLISHED) { l2tp_ctrl_log(ctrl, LOG_WARNING, "Received Data packet in '%s'", l2tp_ctrl_state_string(ctrl)); goto fail; } if (call == NULL) { l2tp_ctrl_log(ctrl, LOG_WARNING, "Received a data packet but it has no call. " "session_id=%u", hdr.session_id); goto fail; } L2TP_CTRL_DBG((ctrl, DEBUG_LEVEL_2, "call=%u RECV ns=%u nr=%u snd_nxt=%u rcv_nxt=%u len=%d", call->id, hdr.ns, hdr.nr, call->snd_nxt, call->rcv_nxt, pktlen)); if (call->state != L2TP_CALL_STATE_ESTABLISHED){ l2tp_ctrl_log(ctrl, LOG_WARNING, "Received a data packet but call is not " "established"); goto fail; } if (hdr.s != 0) { if (SEQ_LT(hdr.ns, call->rcv_nxt)) { if (SEQ_LT(hdr.ns, call->rcv_nxt - L2TP_CALL_DELAY_LIMIT)) { /* sequence number seems to be delayed */ /* XXX: need to log? */ L2TP_CTRL_DBG((ctrl, LOG_DEBUG, "receive a out of sequence " "data packet: %u < %u.", hdr.ns, call->rcv_nxt)); return; } delayed = 1; } else { call->rcv_nxt = hdr.ns + 1; } } l2tp_call_ppp_input(call, pkt, pktlen, delayed); return; } if (hdr.s != 0) { L2TP_CTRL_DBG((ctrl, DEBUG_LEVEL_2, "RECV %s ns=%u nr=%u snd_nxt=%u snd_una=%u rcv_nxt=%u " "len=%d", (is_ctrl)? "C" : "", hdr.ns, hdr.nr, ctrl->snd_nxt, ctrl->snd_una, ctrl->rcv_nxt, pktlen)); if (pktlen <= 0) l2tp_ctrl_log(ctrl, LOG_INFO, "RecvZLB"); if (SEQ_GT(hdr.nr, ctrl->snd_una)) { if (hdr.nr == ctrl->snd_nxt || SEQ_LT(hdr.nr, ctrl->snd_nxt)) ctrl->snd_una = hdr.nr; else { l2tp_ctrl_log(ctrl, LOG_INFO, "Received message has bad Nr field: " "%u < %u.", hdr.ns, ctrl->snd_nxt); /* XXX Drop with ZLB? */ goto fail; } } if (l2tp_ctrl_txwin_size(ctrl) <= 0) { /* no waiting ack */ if (ctrl->hello_wait_ack != 0) { /* * Reset Hello state, as an ack for the Hello * is recived. */ ctrl->hello_wait_ack = 0; ctrl->hello_io_time = curr_time; } switch (ctrl->state) { case L2TP_CTRL_STATE_CLEANUP_WAIT: l2tp_ctrl_stop(ctrl, 0); return; } } if (hdr.ns != ctrl->rcv_nxt) { /* there are remaining packet */ if (l2tp_ctrl_resend_una_packets(ctrl) <= 0) { /* resend or sent ZLB */ l2tp_ctrl_send_ZLB(ctrl); } #ifdef L2TP_CTRL_DEBUG if (pktlen != 0) { /* not ZLB */ L2TP_CTRL_DBG((ctrl, LOG_DEBUG, "receive out of sequence %u must be %u. " "mestype=%s", hdr.ns, ctrl->rcv_nxt, avp_mes_type_string(mestype))); } #endif return; } if (pktlen <= 0) return; /* ZLB */ if (l2tp_ctrl_txwin_is_full(ctrl)) { L2TP_CTRL_DBG((ctrl, LOG_DEBUG, "Received message cannot be handled. " "Transmission window is full.")); l2tp_ctrl_send_ZLB(ctrl); return; } ctrl->rcv_nxt++; if (avp == NULL) { l2tpd_log(_this, LOG_WARNING, "bad control message: no message-type AVP."); goto fail; } } /* * state machine (RFC2661 pp. 56-57) */ switch (ctrl->state) { case L2TP_CTRL_STATE_IDLE: switch (mestype) { case L2TP_AVP_MESSAGE_TYPE_SCCRQ: if (l2tp_ctrl_recv_SCCRQ(ctrl, pkt, pktlen, _this, peer) == 0) { /* acceptable */ l2tp_ctrl_send_SCCRP(ctrl); ctrl->state = L2TP_CTRL_STATE_WAIT_CTL_CONN; return; } /* * in case un-acceptable, it was already processed * at l2tcp_ctrl_recv_SCCRQ */ return; case L2TP_AVP_MESSAGE_TYPE_SCCRP: /* * RFC specifies that sent of StopCCN in the state, * However as this implementation only support Passive * open, this packet will not received. */ /* FALLTHROUGH */ case L2TP_AVP_MESSAGE_TYPE_SCCCN: default: break; } goto fsm_fail; case L2TP_CTRL_STATE_WAIT_CTL_CONN: /* Wait-Ctl-Conn */ switch (mestype) { case L2TP_AVP_MESSAGE_TYPE_SCCCN: l2tp_ctrl_log(ctrl, LOG_INFO, "RecvSCCN"); if (l2tp_ctrl_send_ZLB(ctrl) == 0) { ctrl->state = L2TP_CTRL_STATE_ESTABLISHED; } return; case L2TP_AVP_MESSAGE_TYPE_StopCCN: goto receive_stop_ccn; case L2TP_AVP_MESSAGE_TYPE_SCCRQ: case L2TP_AVP_MESSAGE_TYPE_SCCRP: default: break; } break; /* fsm_fail */ case L2TP_CTRL_STATE_ESTABLISHED: /* Established */ switch (mestype) { case L2TP_AVP_MESSAGE_TYPE_SCCCN: case L2TP_AVP_MESSAGE_TYPE_SCCRQ: case L2TP_AVP_MESSAGE_TYPE_SCCRP: break; receive_stop_ccn: case L2TP_AVP_MESSAGE_TYPE_StopCCN: if (l2tp_ctrl_recv_StopCCN(ctrl, pkt, pktlen) == 0) { if (l2tp_ctrl_resend_una_packets(ctrl) <= 0) l2tp_ctrl_send_ZLB(ctrl); l2tp_ctrl_stop(ctrl, 0); return; } l2tp_ctrl_log(ctrl, LOG_ERR, "Received bad StopCCN"); l2tp_ctrl_send_ZLB(ctrl); l2tp_ctrl_stop(ctrl, 0); return; case L2TP_AVP_MESSAGE_TYPE_HELLO: if (l2tp_ctrl_resend_una_packets(ctrl) <= 0) l2tp_ctrl_send_ZLB(ctrl); return; case L2TP_AVP_MESSAGE_TYPE_CDN: case L2TP_AVP_MESSAGE_TYPE_ICRP: case L2TP_AVP_MESSAGE_TYPE_ICCN: if (call == NULL) { l2tp_ctrl_log(ctrl, LOG_INFO, "Unknown call message: %s", avp_mes_type_string(mestype)); goto fail; } /* FALLTHROUGH */ case L2TP_AVP_MESSAGE_TYPE_ICRQ: l2tp_call_recv_packet(ctrl, call, mestype, pkt, pktlen); return; default: break; } break; /* fsm_fail */ case L2TP_CTRL_STATE_CLEANUP_WAIT: if (mestype == L2TP_AVP_MESSAGE_TYPE_StopCCN) { /* * We left ESTABLISHED state, but the peer sent StopCCN. */ goto receive_stop_ccn; } break; /* fsm_fail */ } fsm_fail: /* state machine error */ l2tp_ctrl_log(ctrl, LOG_WARNING, "Received %s in '%s' state", avp_mes_type_string(mestype), l2tp_ctrl_state_string(ctrl)); l2tp_ctrl_stop(ctrl, L2TP_STOP_CCN_RCODE_FSM_ERROR); return; fail: if (ctrl != NULL && mestype != 0) { l2tp_ctrl_log(ctrl, LOG_WARNING, "Received %s in '%s' state", avp_mes_type_string(mestype), l2tp_ctrl_state_string(ctrl)); l2tp_ctrl_stop(ctrl, L2TP_STOP_CCN_RCODE_GENERAL_ERROR); } return; bad_packet: l2tpd_log(_this, LOG_INFO, "Received from=%s: %s", addrport_tostring(peer, peer->sa_len, hbuf, sizeof(hbuf)), errmsg); return; }
void tcp_timer_rexmt(void *arg) { struct tcpcb *tp = arg; uint32_t rto; #ifdef TCP_DEBUG struct socket *so = NULL; short ostate; #endif mutex_enter(softnet_lock); if ((tp->t_flags & TF_DEAD) != 0) { mutex_exit(softnet_lock); return; } if (!callout_expired(&tp->t_timer[TCPT_REXMT])) { mutex_exit(softnet_lock); return; } KERNEL_LOCK(1, NULL); if ((tp->t_flags & TF_PMTUD_PEND) && tp->t_inpcb && SEQ_GEQ(tp->t_pmtud_th_seq, tp->snd_una) && SEQ_LT(tp->t_pmtud_th_seq, (int)(tp->snd_una + tp->t_ourmss))) { extern struct sockaddr_in icmpsrc; struct icmp icmp; tp->t_flags &= ~TF_PMTUD_PEND; /* XXX create fake icmp message with relevant entries */ icmp.icmp_nextmtu = tp->t_pmtud_nextmtu; icmp.icmp_ip.ip_len = tp->t_pmtud_ip_len; icmp.icmp_ip.ip_hl = tp->t_pmtud_ip_hl; icmpsrc.sin_addr = tp->t_inpcb->inp_faddr; icmp_mtudisc(&icmp, icmpsrc.sin_addr); /* * Notify all connections to the same peer about * new mss and trigger retransmit. */ in_pcbnotifyall(&tcbtable, icmpsrc.sin_addr, EMSGSIZE, tcp_mtudisc); KERNEL_UNLOCK_ONE(NULL); mutex_exit(softnet_lock); return; } #ifdef TCP_DEBUG #ifdef INET if (tp->t_inpcb) so = tp->t_inpcb->inp_socket; #endif #ifdef INET6 if (tp->t_in6pcb) so = tp->t_in6pcb->in6p_socket; #endif ostate = tp->t_state; #endif /* TCP_DEBUG */ /* * Clear the SACK scoreboard, reset FACK estimate. */ tcp_free_sackholes(tp); tp->snd_fack = tp->snd_una; /* * Retransmission timer went off. Message has not * been acked within retransmit interval. Back off * to a longer retransmit interval and retransmit one segment. */ if (++tp->t_rxtshift > TCP_MAXRXTSHIFT) { tp->t_rxtshift = TCP_MAXRXTSHIFT; TCP_STATINC(TCP_STAT_TIMEOUTDROP); tp = tcp_drop(tp, tp->t_softerror ? tp->t_softerror : ETIMEDOUT); goto out; } TCP_STATINC(TCP_STAT_REXMTTIMEO); rto = TCP_REXMTVAL(tp); if (rto < tp->t_rttmin) rto = tp->t_rttmin; TCPT_RANGESET(tp->t_rxtcur, rto * tcp_backoff[tp->t_rxtshift], tp->t_rttmin, TCPTV_REXMTMAX); TCP_TIMER_ARM(tp, TCPT_REXMT, tp->t_rxtcur); /* * If we are losing and we are trying path MTU discovery, * try turning it off. This will avoid black holes in * the network which suppress or fail to send "packet * too big" ICMP messages. We should ideally do * lots more sophisticated searching to find the right * value here... */ if (tp->t_mtudisc && tp->t_rxtshift > TCP_MAXRXTSHIFT / 6) { TCP_STATINC(TCP_STAT_PMTUBLACKHOLE); #ifdef INET /* try turning PMTUD off */ if (tp->t_inpcb) tp->t_mtudisc = 0; #endif #ifdef INET6 /* try using IPv6 minimum MTU */ if (tp->t_in6pcb) tp->t_mtudisc = 0; #endif /* XXX: more sophisticated Black hole recovery code? */ } /* * If losing, let the lower level know and try for * a better route. Also, if we backed off this far, * our srtt estimate is probably bogus. Clobber it * so we'll take the next rtt measurement as our srtt; * move the current srtt into rttvar to keep the current * retransmit times until then. */ if (tp->t_rxtshift > TCP_MAXRXTSHIFT / 4) { #ifdef INET if (tp->t_inpcb) in_losing(tp->t_inpcb); #endif #ifdef INET6 if (tp->t_in6pcb) in6_losing(tp->t_in6pcb); #endif /* * This operation is not described in RFC2988. The * point is to keep srtt+4*rttvar constant, so we * should shift right 2 bits to divide by 4, and then * shift right one bit because the storage * representation of rttvar is 1/16s vs 1/32s for * srtt. */ tp->t_rttvar += (tp->t_srtt >> TCP_RTT_SHIFT); tp->t_srtt = 0; } tp->snd_nxt = tp->snd_una; tp->snd_high = tp->snd_max; /* * If timing a segment in this window, stop the timer. */ tp->t_rtttime = 0; /* * Remember if we are retransmitting a SYN, because if * we do, set the initial congestion window must be set * to 1 segment. */ if (tp->t_state == TCPS_SYN_SENT) tp->t_flags |= TF_SYN_REXMT; /* * Adjust congestion control parameters. */ tp->t_congctl->slow_retransmit(tp); (void) tcp_output(tp); out: #ifdef TCP_DEBUG if (tp && so->so_options & SO_DEBUG) tcp_trace(TA_USER, ostate, tp, NULL, PRU_SLOWTIMO | (TCPT_REXMT << 8)); #endif KERNEL_UNLOCK_ONE(NULL); mutex_exit(softnet_lock); }
/* * To insert a new blk to the array of SACK blk in receiver. * * Parameters: * sack_blk_t *head: pointer to the array of SACK blks. * tcp_seq begin: starting seq num of the new blk. * tcp_seq end: ending seq num of the new blk. * int32_t *num: (referenced) total num of SACK blks on the list. */ void tcp_sack_insert(sack_blk_t *head, tcp_seq begin, tcp_seq end, int32_t *num) { int32_t i, j, old_num, new_num; sack_blk_t tmp[MAX_SACK_BLK - 1]; /* The array is empty, just add the new one. */ if (*num == 0) { head[0].begin = begin; head[0].end = end; *num = 1; return; } /* * Check for overlap. There are five cases. * * 1. there is no overlap with any other SACK blks. * 2. new SACK blk is completely contained in another blk. * 3. tail part of new SACK blk overlaps with another blk. * 4. head part of new SACK blk overlaps with another blk. * 5. new SACK blk completely contains another blk. * * Use tmp to hold old SACK blks. After the loop, copy them back * to head. */ old_num = *num; if (old_num > MAX_SACK_BLK - 1) { old_num = MAX_SACK_BLK - 1; } new_num = old_num; j = 0; for (i = 0; i < old_num; i++) { if (SEQ_LT(end, head[i].begin) || SEQ_GT(begin, head[i].end)) { /* Case 1: continue to check. */ tmp[j].begin = head[i].begin; tmp[j].end = head[i].end; j++; continue; } else if (SEQ_GEQ(begin, head[i].begin) && SEQ_LEQ(end, head[i].end)) { /* Case 2: re-insert the old blk to the head. */ begin = head[i].begin; end = head[i].end; } else if (SEQ_LEQ(end, head[i].end) && SEQ_GEQ(end, head[i].begin)) { /* * Case 3: Extend the new blk, remove the old one * and continue to check. */ end = head[i].end; } else if (SEQ_GEQ(begin, head[i].begin) && SEQ_LEQ(begin, head[i].end)) { /* Case 4 */ begin = head[i].begin; } /* * Common code for all cases except the first one, which * copies the original SACK blk into the tmp storage. Other * cases remove the original SACK blk by not copying into * tmp storage. */ new_num--; } head[0].begin = begin; head[0].end = end; for (i = 0; i < new_num; i++) { head[i+1].begin = tmp[i].begin; head[i+1].end = tmp[i].end; } *num = new_num + 1; }
/* * Tcp output routine: figure out what should be sent and send it. */ int tcp_output(struct tcpcb *tp) { struct inpcb * const inp = tp->t_inpcb; struct socket *so = inp->inp_socket; long len, recvwin, sendwin; int nsacked = 0; int off, flags, error; #ifdef TCP_SIGNATURE int sigoff = 0; #endif struct mbuf *m; struct ip *ip = NULL; struct ipovly *ipov = NULL; struct tcphdr *th; u_char opt[TCP_MAXOLEN]; unsigned int ipoptlen, optlen, hdrlen; int idle; boolean_t sendalot; struct ip6_hdr *ip6 = NULL; #ifdef INET6 const boolean_t isipv6 = (inp->inp_vflag & INP_IPV6) != 0; #else const boolean_t isipv6 = FALSE; #endif KKASSERT(so->so_port == &curthread->td_msgport); /* * Determine length of data that should be transmitted, * and flags that will be used. * If there is some data or critical controls (SYN, RST) * to send, then transmit; otherwise, investigate further. */ /* * If we have been idle for a while, the send congestion window * could be no longer representative of the current state of the link. * So unless we are expecting more acks to come in, slow-start from * scratch to re-determine the send congestion window. */ if (tp->snd_max == tp->snd_una && (ticks - tp->t_rcvtime) >= tp->t_rxtcur) { if (tcp_do_rfc3390) { int initial_cwnd = min(4 * tp->t_maxseg, max(2 * tp->t_maxseg, 4380)); tp->snd_cwnd = min(tp->snd_cwnd, initial_cwnd); } else { tp->snd_cwnd = tp->t_maxseg; } tp->snd_wacked = 0; } /* * Calculate whether the transmit stream was previously idle * and adjust TF_LASTIDLE for the next time. */ idle = (tp->t_flags & TF_LASTIDLE) || (tp->snd_max == tp->snd_una); if (idle && (tp->t_flags & TF_MORETOCOME)) tp->t_flags |= TF_LASTIDLE; else tp->t_flags &= ~TF_LASTIDLE; if (TCP_DO_SACK(tp) && tp->snd_nxt != tp->snd_max && !IN_FASTRECOVERY(tp)) nsacked = tcp_sack_bytes_below(&tp->scb, tp->snd_nxt); again: /* Make use of SACK information when slow-starting after a RTO. */ if (TCP_DO_SACK(tp) && tp->snd_nxt != tp->snd_max && !IN_FASTRECOVERY(tp)) { tcp_seq old_snd_nxt = tp->snd_nxt; tcp_sack_skip_sacked(&tp->scb, &tp->snd_nxt); nsacked += tp->snd_nxt - old_snd_nxt; } sendalot = FALSE; off = tp->snd_nxt - tp->snd_una; sendwin = min(tp->snd_wnd, tp->snd_cwnd + nsacked); sendwin = min(sendwin, tp->snd_bwnd); flags = tcp_outflags[tp->t_state]; /* * Get standard flags, and add SYN or FIN if requested by 'hidden' * state flags. */ if (tp->t_flags & TF_NEEDFIN) flags |= TH_FIN; if (tp->t_flags & TF_NEEDSYN) flags |= TH_SYN; /* * If in persist timeout with window of 0, send 1 byte. * Otherwise, if window is small but nonzero * and timer expired, we will send what we can * and go to transmit state. */ if (tp->t_flags & TF_FORCE) { if (sendwin == 0) { /* * If we still have some data to send, then * clear the FIN bit. Usually this would * happen below when it realizes that we * aren't sending all the data. However, * if we have exactly 1 byte of unsent data, * then it won't clear the FIN bit below, * and if we are in persist state, we wind * up sending the packet without recording * that we sent the FIN bit. * * We can't just blindly clear the FIN bit, * because if we don't have any more data * to send then the probe will be the FIN * itself. */ if (off < so->so_snd.ssb_cc) flags &= ~TH_FIN; sendwin = 1; } else { tcp_callout_stop(tp, tp->tt_persist); tp->t_rxtshift = 0; } } /* * If snd_nxt == snd_max and we have transmitted a FIN, the * offset will be > 0 even if so_snd.ssb_cc is 0, resulting in * a negative length. This can also occur when TCP opens up * its congestion window while receiving additional duplicate * acks after fast-retransmit because TCP will reset snd_nxt * to snd_max after the fast-retransmit. * * In the normal retransmit-FIN-only case, however, snd_nxt will * be set to snd_una, the offset will be 0, and the length may * wind up 0. */ len = (long)ulmin(so->so_snd.ssb_cc, sendwin) - off; /* * Lop off SYN bit if it has already been sent. However, if this * is SYN-SENT state and if segment contains data, suppress sending * segment (sending the segment would be an option if we still * did TAO and the remote host supported it). */ if ((flags & TH_SYN) && SEQ_GT(tp->snd_nxt, tp->snd_una)) { flags &= ~TH_SYN; off--, len++; if (len > 0 && tp->t_state == TCPS_SYN_SENT) return 0; } /* * Be careful not to send data and/or FIN on SYN segments. * This measure is needed to prevent interoperability problems * with not fully conformant TCP implementations. */ if (flags & TH_SYN) { len = 0; flags &= ~TH_FIN; } if (len < 0) { /* * If FIN has been sent but not acked, * but we haven't been called to retransmit, * len will be < 0. Otherwise, window shrank * after we sent into it. If window shrank to 0, * cancel pending retransmit, pull snd_nxt back * to (closed) window, and set the persist timer * if it isn't already going. If the window didn't * close completely, just wait for an ACK. */ len = 0; if (sendwin == 0) { tcp_callout_stop(tp, tp->tt_rexmt); tp->t_rxtshift = 0; tp->snd_nxt = tp->snd_una; if (!tcp_callout_active(tp, tp->tt_persist)) tcp_setpersist(tp); } } KASSERT(len >= 0, ("%s: len < 0", __func__)); /* * Automatic sizing of send socket buffer. Often the send buffer * size is not optimally adjusted to the actual network conditions * at hand (delay bandwidth product). Setting the buffer size too * small limits throughput on links with high bandwidth and high * delay (eg. trans-continental/oceanic links). Setting the * buffer size too big consumes too much real kernel memory, * especially with many connections on busy servers. * * The criteria to step up the send buffer one notch are: * 1. receive window of remote host is larger than send buffer * (with a fudge factor of 5/4th); * 2. send buffer is filled to 7/8th with data (so we actually * have data to make use of it); * 3. send buffer fill has not hit maximal automatic size; * 4. our send window (slow start and cogestion controlled) is * larger than sent but unacknowledged data in send buffer. * * The remote host receive window scaling factor may limit the * growing of the send buffer before it reaches its allowed * maximum. * * It scales directly with slow start or congestion window * and does at most one step per received ACK. This fast * scaling has the drawback of growing the send buffer beyond * what is strictly necessary to make full use of a given * delay*bandwith product. However testing has shown this not * to be much of an problem. At worst we are trading wasting * of available bandwith (the non-use of it) for wasting some * socket buffer memory. * * TODO: Shrink send buffer during idle periods together * with congestion window. Requires another timer. Has to * wait for upcoming tcp timer rewrite. */ if (tcp_do_autosndbuf && so->so_snd.ssb_flags & SSB_AUTOSIZE) { if ((tp->snd_wnd / 4 * 5) >= so->so_snd.ssb_hiwat && so->so_snd.ssb_cc >= (so->so_snd.ssb_hiwat / 8 * 7) && so->so_snd.ssb_cc < tcp_autosndbuf_max && sendwin >= (so->so_snd.ssb_cc - (tp->snd_nxt - tp->snd_una))) { u_long newsize; newsize = ulmin(so->so_snd.ssb_hiwat + tcp_autosndbuf_inc, tcp_autosndbuf_max); if (!ssb_reserve(&so->so_snd, newsize, so, NULL)) atomic_clear_int(&so->so_snd.ssb_flags, SSB_AUTOSIZE); if (newsize >= (TCP_MAXWIN << tp->snd_scale)) atomic_clear_int(&so->so_snd.ssb_flags, SSB_AUTOSIZE); } } /* * Truncate to the maximum segment length and ensure that FIN is * removed if the length no longer contains the last data byte. */ if (len > tp->t_maxseg) { len = tp->t_maxseg; sendalot = TRUE; } if (SEQ_LT(tp->snd_nxt + len, tp->snd_una + so->so_snd.ssb_cc)) flags &= ~TH_FIN; recvwin = ssb_space(&so->so_rcv); /* * Sender silly window avoidance. We transmit under the following * conditions when len is non-zero: * * - We have a full segment * - This is the last buffer in a write()/send() and we are * either idle or running NODELAY * - we've timed out (e.g. persist timer) * - we have more then 1/2 the maximum send window's worth of * data (receiver may be limiting the window size) * - we need to retransmit */ if (len) { if (len == tp->t_maxseg) goto send; /* * NOTE! on localhost connections an 'ack' from the remote * end may occur synchronously with the output and cause * us to flush a buffer queued with moretocome. XXX * * note: the len + off check is almost certainly unnecessary. */ if (!(tp->t_flags & TF_MORETOCOME) && /* normal case */ (idle || (tp->t_flags & TF_NODELAY)) && len + off >= so->so_snd.ssb_cc && !(tp->t_flags & TF_NOPUSH)) { goto send; } if (tp->t_flags & TF_FORCE) /* typ. timeout case */ goto send; if (len >= tp->max_sndwnd / 2 && tp->max_sndwnd > 0) goto send; if (SEQ_LT(tp->snd_nxt, tp->snd_max)) /* retransmit case */ goto send; } /* * Compare available window to amount of window * known to peer (as advertised window less * next expected input). If the difference is at least two * max size segments, or at least 50% of the maximum possible * window, then want to send a window update to peer. */ if (recvwin > 0) { /* * "adv" is the amount we can increase the window, * taking into account that we are limited by * TCP_MAXWIN << tp->rcv_scale. */ long adv = min(recvwin, (long)TCP_MAXWIN << tp->rcv_scale) - (tp->rcv_adv - tp->rcv_nxt); long hiwat; /* * This ack case typically occurs when the user has drained * the TCP socket buffer sufficiently to warrent an ack * containing a 'pure window update'... that is, an ack that * ONLY updates the tcp window. * * It is unclear why we would need to do a pure window update * past 2 segments if we are going to do one at 1/2 the high * water mark anyway, especially since under normal conditions * the user program will drain the socket buffer quickly. * The 2-segment pure window update will often add a large * number of extra, unnecessary acks to the stream. * * avoid_pure_win_update now defaults to 1. */ if (avoid_pure_win_update == 0 || (tp->t_flags & TF_RXRESIZED)) { if (adv >= (long) (2 * tp->t_maxseg)) { goto send; } } hiwat = (long)(TCP_MAXWIN << tp->rcv_scale); if (hiwat > (long)so->so_rcv.ssb_hiwat) hiwat = (long)so->so_rcv.ssb_hiwat; if (adv >= hiwat / 2) goto send; } /* * Send if we owe the peer an ACK, RST, SYN, or urgent data. ACKNOW * is also a catch-all for the retransmit timer timeout case. */ if (tp->t_flags & TF_ACKNOW) goto send; if ((flags & TH_RST) || ((flags & TH_SYN) && !(tp->t_flags & TF_NEEDSYN))) goto send; if (SEQ_GT(tp->snd_up, tp->snd_una)) goto send; /* * If our state indicates that FIN should be sent * and we have not yet done so, then we need to send. */ if (flags & TH_FIN && (!(tp->t_flags & TF_SENTFIN) || tp->snd_nxt == tp->snd_una)) goto send; /* * TCP window updates are not reliable, rather a polling protocol * using ``persist'' packets is used to insure receipt of window * updates. The three ``states'' for the output side are: * idle not doing retransmits or persists * persisting to move a small or zero window * (re)transmitting and thereby not persisting * * tcp_callout_active(tp, tp->tt_persist) * is true when we are in persist state. * The TF_FORCE flag in tp->t_flags * is set when we are called to send a persist packet. * tcp_callout_active(tp, tp->tt_rexmt) * is set when we are retransmitting * The output side is idle when both timers are zero. * * If send window is too small, there is data to transmit, and no * retransmit or persist is pending, then go to persist state. * If nothing happens soon, send when timer expires: * if window is nonzero, transmit what we can, * otherwise force out a byte. */ if (so->so_snd.ssb_cc > 0 && !tcp_callout_active(tp, tp->tt_rexmt) && !tcp_callout_active(tp, tp->tt_persist)) { tp->t_rxtshift = 0; tcp_setpersist(tp); } /* * No reason to send a segment, just return. */ return (0); send: /* * Before ESTABLISHED, force sending of initial options * unless TCP set not to do any options. * NOTE: we assume that the IP/TCP header plus TCP options * always fit in a single mbuf, leaving room for a maximum * link header, i.e. * max_linkhdr + sizeof(struct tcpiphdr) + optlen <= MCLBYTES */ optlen = 0; if (isipv6) hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr); else hdrlen = sizeof(struct tcpiphdr); if (flags & TH_SYN) { tp->snd_nxt = tp->iss; if (!(tp->t_flags & TF_NOOPT)) { u_short mss; opt[0] = TCPOPT_MAXSEG; opt[1] = TCPOLEN_MAXSEG; mss = htons((u_short) tcp_mssopt(tp)); memcpy(opt + 2, &mss, sizeof mss); optlen = TCPOLEN_MAXSEG; if ((tp->t_flags & TF_REQ_SCALE) && (!(flags & TH_ACK) || (tp->t_flags & TF_RCVD_SCALE))) { *((u_int32_t *)(opt + optlen)) = htonl( TCPOPT_NOP << 24 | TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 | tp->request_r_scale); optlen += 4; } if ((tcp_do_sack && !(flags & TH_ACK)) || tp->t_flags & TF_SACK_PERMITTED) { uint32_t *lp = (uint32_t *)(opt + optlen); *lp = htonl(TCPOPT_SACK_PERMITTED_ALIGNED); optlen += TCPOLEN_SACK_PERMITTED_ALIGNED; } } } /* * Send a timestamp and echo-reply if this is a SYN and our side * wants to use timestamps (TF_REQ_TSTMP is set) or both our side * and our peer have sent timestamps in our SYN's. */ if ((tp->t_flags & (TF_REQ_TSTMP | TF_NOOPT)) == TF_REQ_TSTMP && !(flags & TH_RST) && (!(flags & TH_ACK) || (tp->t_flags & TF_RCVD_TSTMP))) { u_int32_t *lp = (u_int32_t *)(opt + optlen); /* Form timestamp option as shown in appendix A of RFC 1323. */ *lp++ = htonl(TCPOPT_TSTAMP_HDR); *lp++ = htonl(ticks); *lp = htonl(tp->ts_recent); optlen += TCPOLEN_TSTAMP_APPA; } /* Set receive buffer autosizing timestamp. */ if (tp->rfbuf_ts == 0 && (so->so_rcv.ssb_flags & SSB_AUTOSIZE)) tp->rfbuf_ts = ticks; /* * If this is a SACK connection and we have a block to report, * fill in the SACK blocks in the TCP options. */ if ((tp->t_flags & (TF_SACK_PERMITTED | TF_NOOPT)) == TF_SACK_PERMITTED && (!LIST_EMPTY(&tp->t_segq) || tp->reportblk.rblk_start != tp->reportblk.rblk_end)) tcp_sack_fill_report(tp, opt, &optlen); #ifdef TCP_SIGNATURE if (tp->t_flags & TF_SIGNATURE) { int i; u_char *bp; /* * Initialize TCP-MD5 option (RFC2385) */ bp = (u_char *)opt + optlen; *bp++ = TCPOPT_SIGNATURE; *bp++ = TCPOLEN_SIGNATURE; sigoff = optlen + 2; for (i = 0; i < TCP_SIGLEN; i++) *bp++ = 0; optlen += TCPOLEN_SIGNATURE; /* * Terminate options list and maintain 32-bit alignment. */ *bp++ = TCPOPT_NOP; *bp++ = TCPOPT_EOL; optlen += 2; } #endif /* TCP_SIGNATURE */ KASSERT(optlen <= TCP_MAXOLEN, ("too many TCP options")); hdrlen += optlen; if (isipv6) { ipoptlen = ip6_optlen(inp); } else { if (inp->inp_options) { ipoptlen = inp->inp_options->m_len - offsetof(struct ipoption, ipopt_list); } else {
/* * TCP input routine, follows pages 65-76 of the * protocol specification dated September, 1981 very closely. */ void tcp_input(usn_mbuf_t *m, int iphlen) { struct tcpiphdr *ti; struct inpcb *inp; u_char *optp = NULL; int optlen; int len, tlen, off; struct tcpcb *tp = 0; int tiflags; struct usn_socket *so = 0; int todrop, acked, ourfinisacked; int needoutput = 0; short ostate; struct usn_in_addr laddr; int dropsocket = 0; int iss = 0; u_long tiwin, ts_val, ts_ecr; int ts_present = 0; (void)needoutput; g_tcpstat.tcps_rcvtotal++; // Get IP and TCP header together in first mbuf. // Note: IP leaves IP header in first mbuf. ti = mtod(m, struct tcpiphdr *); if (iphlen > sizeof (usn_ip_t)) ip_stripoptions(m, (usn_mbuf_t *)0); if (m->mlen < sizeof (struct tcpiphdr)) { if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) { g_tcpstat.tcps_rcvshort++; return; } ti = mtod(m, struct tcpiphdr *); } #ifdef DUMP_PAYLOAD dump_chain(m,"tcp"); #endif /* * Checksum extended TCP header and data. */ tlen = ntohs(((usn_ip_t *)ti)->ip_len); len = sizeof (usn_ip_t) + tlen; ti->ti_next = ti->ti_prev = 0; ti->ti_x1 = 0; ti->ti_len = (u_short)tlen; HTONS(ti->ti_len); ti->ti_sum = in_cksum(m, len); if (ti->ti_sum) { g_tcpstat.tcps_rcvbadsum++; goto drop; } /* * Check that TCP offset makes sense, * pull out TCP options and adjust length. XXX */ off = ti->ti_off << 2; if (off < sizeof (struct tcphdr) || off > tlen) { g_tcpstat.tcps_rcvbadoff++; goto drop; } tlen -= off; ti->ti_len = tlen; if (off > sizeof (struct tcphdr)) { if (m->mlen < sizeof(usn_ip_t) + off) { if ((m = m_pullup(m, sizeof (usn_ip_t) + off)) == 0) { g_tcpstat.tcps_rcvshort++; return; } ti = mtod(m, struct tcpiphdr *); } optlen = off - sizeof (struct tcphdr); optp = mtod(m, u_char *) + sizeof (struct tcpiphdr); // Do quick retrieval of timestamp options ("options // prediction?"). If timestamp is the only option and it's // formatted as recommended in RFC 1323 appendix A, we // quickly get the values now and not bother calling // tcp_dooptions(), etc. if ((optlen == TCPOLEN_TSTAMP_APPA || (optlen > TCPOLEN_TSTAMP_APPA && optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) && *(u_int *)optp == htonl(TCPOPT_TSTAMP_HDR) && (ti->ti_flags & TH_SYN) == 0) { ts_present = 1; ts_val = ntohl(*(u_long *)(optp + 4)); ts_ecr = ntohl(*(u_long *)(optp + 8)); optp = NULL; // we've parsed the options } } tiflags = ti->ti_flags; // Convert TCP protocol specific fields to host format. NTOHL(ti->ti_seq); NTOHL(ti->ti_ack); NTOHS(ti->ti_win); NTOHS(ti->ti_urp); // Locate pcb for segment. findpcb: inp = g_tcp_last_inpcb; if (inp->inp_lport != ti->ti_dport || inp->inp_fport != ti->ti_sport || inp->inp_faddr.s_addr != ti->ti_src.s_addr || inp->inp_laddr.s_addr != ti->ti_dst.s_addr) { inp = in_pcblookup(&g_tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport, INPLOOKUP_WILDCARD); if (inp) g_tcp_last_inpcb = inp; ++g_tcpstat.tcps_pcbcachemiss; } // If the state is CLOSED (i.e., TCB does not exist) then // all data in the incoming segment is discarded. // If the TCB exists but is in CLOSED state, it is embryonic, // but should either do a listen or a connect soon. if (inp == 0) goto dropwithreset; tp = intotcpcb(inp); DEBUG("found inp cb, laddr=%x, lport=%d, faddr=%x," " fport=%d, tp_state=%d, tp_flags=%d", inp->inp_laddr.s_addr, inp->inp_lport, inp->inp_faddr.s_addr, inp->inp_fport, tp->t_state, tp->t_flags); if (tp == 0) goto dropwithreset; if (tp->t_state == TCPS_CLOSED) goto drop; // Unscale the window into a 32-bit value. if ((tiflags & TH_SYN) == 0) tiwin = ti->ti_win << tp->snd_scale; else tiwin = ti->ti_win; so = inp->inp_socket; DEBUG("socket info, options=%x", so->so_options); if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) { if (so->so_options & SO_DEBUG) { ostate = tp->t_state; g_tcp_saveti = *ti; } if (so->so_options & SO_ACCEPTCONN) { if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) { // Note: dropwithreset makes sure we don't // send a reset in response to a RST. if (tiflags & TH_ACK) { g_tcpstat.tcps_badsyn++; goto dropwithreset; } DEBUG("SYN is expected, tiflags=%d", tiflags); goto drop; } so = sonewconn(so, 0); if (so == 0) { DEBUG("failed to create new connection, tiflags=%d", tiflags); goto drop; } // Mark socket as temporary until we're // committed to keeping it. The code at // ``drop'' and ``dropwithreset'' check the // flag dropsocket to see if the temporary // socket created here should be discarded. // We mark the socket as discardable until // we're committed to it below in TCPS_LISTEN. dropsocket++; inp = (struct inpcb *)so->so_pcb; inp->inp_laddr = ti->ti_dst; inp->inp_lport = ti->ti_dport; // BSD >= 4.3 inp->inp_options = ip_srcroute(); tp = intotcpcb(inp); tp->t_state = TCPS_LISTEN; // Compute proper scaling value from buffer space while (tp->request_r_scale < TCP_MAX_WINSHIFT && TCP_MAXWIN << tp->request_r_scale < so->so_rcv->sb_hiwat) tp->request_r_scale++; } } // Segment received on connection. // Reset idle time and keep-alive timer. tp->t_idle = 0; tp->t_timer[TCPT_KEEP] = g_tcp_keepidle; // Process options if not in LISTEN state, // else do it below (after getting remote address). if (optp && tp->t_state != TCPS_LISTEN) tcp_dooptions(tp, optp, optlen, ti, &ts_present, &ts_val, &ts_ecr); // Header prediction: check for the two common cases // of a uni-directional data xfer. If the packet has // no control flags, is in-sequence, the window didn't // change and we're not retransmitting, it's a // candidate. If the length is zero and the ack moved // forward, we're the sender side of the xfer. Just // free the data acked & wake any higher level process // that was blocked waiting for space. If the length // is non-zero and the ack didn't move, we're the // receiver side. If we're getting packets in-order // (the reassembly queue is empty), add the data to // the socket buffer and note that we need a delayed ack. if (tp->t_state == TCPS_ESTABLISHED && (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && (!ts_present || TSTMP_GEQ(ts_val, tp->ts_recent)) && ti->ti_seq == tp->rcv_nxt && tiwin && tiwin == tp->snd_wnd && tp->snd_nxt == tp->snd_max) { // If last ACK falls within this segment's sequence numbers, // record the timestamp. if ( ts_present && TSTMP_GEQ(ts_val, tp->ts_recent) && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) ){ tp->ts_recent_age = g_tcp_now; tp->ts_recent = ts_val; } if (ti->ti_len == 0) { if (SEQ_GT(ti->ti_ack, tp->snd_una) && SEQ_LEQ(ti->ti_ack, tp->snd_max) && tp->snd_cwnd >= tp->snd_wnd) { // this is a pure ack for outstanding data. ++g_tcpstat.tcps_predack; if (ts_present) tcp_xmit_timer(tp, g_tcp_now-ts_ecr+1); else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) tcp_xmit_timer(tp, tp->t_rtt); acked = ti->ti_ack - tp->snd_una; g_tcpstat.tcps_rcvackpack++; g_tcpstat.tcps_rcvackbyte += acked; TRACE("drop so_snd buffer, drop_bytes=%d, len=%d", acked, so->so_snd.sb_cc); sbdrop(so->so_snd, acked); tp->snd_una = ti->ti_ack; usn_free_cmbuf(m); // If all outstanding data are acked, stop // retransmit timer, otherwise restart timer // using current (possibly backed-off) value. // If process is waiting for space, // wakeup/selwakeup/signal. If data // are ready to send, let tcp_output // decide between more output or persist. if (tp->snd_una == tp->snd_max) tp->t_timer[TCPT_REXMT] = 0; else if (tp->t_timer[TCPT_PERSIST] == 0) tp->t_timer[TCPT_REXMT] = tp->t_rxtcur; if (so->so_options & SO_DEBUG) tcp_trace(TA_INPUT, ostate, tp, &g_tcp_saveti, 0); //if (so->so_snd->sb_flags & SB_NOTIFY) { // usnet_tcpin_wwakeup(so, USN_TCP_IN, usn_tcpev_sbnotify, 0); // sowwakeup(so); //} // send buffer is available for app thread. usnet_tcpin_wwakeup(so, USN_TCP_IN, USN_TCPEV_WRITE, 0); if (so->so_snd->sb_cc) tcp_output(tp); return; } } else if (ti->ti_ack == tp->snd_una && tp->seg_next == (struct tcpiphdr *)tp && ti->ti_len <= sbspace(so->so_rcv)) { // this is a pure, in-sequence data packet // with nothing on the reassembly queue and // we have enough buffer space to take it. ++g_tcpstat.tcps_preddat; tp->rcv_nxt += ti->ti_len; g_tcpstat.tcps_rcvpack++; g_tcpstat.tcps_rcvbyte += ti->ti_len; // Drop TCP, IP headers and TCP options then add data // to socket buffer. m->head += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->mlen -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); TRACE("add data to rcv buf"); sbappend(so->so_rcv, m); sorwakeup(so); // new data is available for app threads. usnet_tcpin_rwakeup(so, USN_TCP_IN, USN_TCPEV_READ, m); if (so->so_options & SO_DEBUG) { TRACE("tcp trace, so_options=%d", so->so_options); tcp_trace(TA_INPUT, ostate, tp, &g_tcp_saveti, 0); } tp->t_flags |= TF_DELACK; return; } } // Drop TCP, IP headers and TCP options. m->head += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->mlen -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); // Calculate amount of space in receive window, // and then do TCP input processing. // Receive window is amount of space in rcv queue, // but not less than advertised window. { int win; win = sbspace(so->so_rcv); if (win < 0) win = 0; tp->rcv_wnd = max(win, (int)(tp->rcv_adv - tp->rcv_nxt)); } switch (tp->t_state) { // If the state is LISTEN then ignore segment if it contains an RST. // If the segment contains an ACK then it is bad and send a RST. // If it does not contain a SYN then it is not interesting; drop it. // Don't bother responding if the destination was a broadcast. // Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial // tp->iss, and send a segment: // <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> // Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss. // Fill in remote peer address fields if not previously specified. // Enter SYN_RECEIVED state, and process any other fields of this // segment in this state. case TCPS_LISTEN: { usn_mbuf_t *am; struct usn_sockaddr_in *sin; if (tiflags & TH_RST) goto drop; if (tiflags & TH_ACK) goto dropwithreset; if ((tiflags & TH_SYN) == 0) goto drop; // RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN // in_broadcast() should never return true on a received // packet with M_BCAST not set. //if (m->m_flags & (M_BCAST|M_MCAST) || // IN_MULTICAST(ntohl(ti->ti_dst.s_addr))) // goto drop; am = usn_get_mbuf(0, BUF_MSIZE, 0); // XXX: the size! if (am == NULL) goto drop; am->mlen = sizeof (struct usn_sockaddr_in); sin = mtod(am, struct usn_sockaddr_in *); sin->sin_family = AF_INET; sin->sin_len = sizeof(*sin); sin->sin_addr = ti->ti_src; sin->sin_port = ti->ti_sport; bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero)); laddr = inp->inp_laddr; if (inp->inp_laddr.s_addr == USN_INADDR_ANY) inp->inp_laddr = ti->ti_dst; if (in_pcbconnect(inp, am)) { inp->inp_laddr = laddr; usn_free_mbuf(am); goto drop; } usn_free_mbuf(am); tp->t_template = tcp_template(tp); if (tp->t_template == 0) { tp = tcp_drop(tp, ENOBUFS); dropsocket = 0; // socket is already gone goto drop; } if (optp) tcp_dooptions(tp, optp, optlen, ti, &ts_present, &ts_val, &ts_ecr); if (iss) tp->iss = iss; else tp->iss = g_tcp_iss; g_tcp_iss += TCP_ISSINCR/4; tp->irs = ti->ti_seq; tcp_sendseqinit(tp); tcp_rcvseqinit(tp); tp->t_flags |= TF_ACKNOW; TRACE("change tcp state to TCPS_SYN_RECEIVED, state=%d, tp_flags=%d", tp->t_state, tp->t_flags); tp->t_state = TCPS_SYN_RECEIVED; // tcp event usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_SYN_RECEIVED, 0); tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT; dropsocket = 0; // committed to socket g_tcpstat.tcps_accepts++; goto trimthenstep6; } // If the state is SYN_SENT: // if seg contains an ACK, but not for our SYN, drop the input. // if seg contains a RST, then drop the connection. // if seg does not contain SYN, then drop it. // Otherwise this is an acceptable SYN segment // initialize tp->rcv_nxt and tp->irs // if seg contains ack then advance tp->snd_una // if SYN has been acked change to ESTABLISHED else SYN_RCVD state // arrange for segment to be acked (eventually) // continue processing rest of data/controls, beginning with URG case TCPS_SYN_SENT: if ((tiflags & TH_ACK) && (SEQ_LEQ(ti->ti_ack, tp->iss) || SEQ_GT(ti->ti_ack, tp->snd_max))) goto dropwithreset; if (tiflags & TH_RST) { if (tiflags & TH_ACK) tp = tcp_drop(tp, ECONNREFUSED); goto drop; } if ((tiflags & TH_SYN) == 0) goto drop; if (tiflags & TH_ACK) { tp->snd_una = ti->ti_ack; if (SEQ_LT(tp->snd_nxt, tp->snd_una)) tp->snd_nxt = tp->snd_una; tp->t_timer[TCPT_REXMT] = 0; } tp->irs = ti->ti_seq; tcp_rcvseqinit(tp); tp->t_flags |= TF_ACKNOW; TRACE("ack now, tp flags=%d", tp->t_flags); // XXX: remove second test. if (tiflags & TH_ACK /*&& SEQ_GT(tp->snd_una, tp->iss)*/) { g_tcpstat.tcps_connects++; soisconnected(so); TRACE("change tcp state to TCPS_ESTABLISHED," " state=%d, tp_flags=%d", tp->t_state, tp->t_flags); tp->t_state = TCPS_ESTABLISHED; // Do window scaling on this connection? if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == (TF_RCVD_SCALE|TF_REQ_SCALE)) { tp->snd_scale = tp->requested_s_scale; tp->rcv_scale = tp->request_r_scale; } tcp_reass(tp, (struct tcpiphdr *)0, (usn_mbuf_t *)0); // if we didn't have to retransmit the SYN, // use its rtt as our initial srtt & rtt var. if (tp->t_rtt) tcp_xmit_timer(tp, tp->t_rtt); } else { TRACE("change tcp state to TCPS_SYN_RECEIVED, state=%d, tp_flags=%d", tp->t_state, tp->t_flags); tp->t_state = TCPS_SYN_RECEIVED; // tcp event usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_SYN_RECEIVED, 0); } trimthenstep6: // Advance ti->ti_seq to correspond to first data byte. // If data, trim to stay within window, // dropping FIN if necessary. ti->ti_seq++; if (ti->ti_len > tp->rcv_wnd) { todrop = ti->ti_len - tp->rcv_wnd; m_adj(m, -todrop); ti->ti_len = tp->rcv_wnd; tiflags &= ~TH_FIN; g_tcpstat.tcps_rcvpackafterwin++; g_tcpstat.tcps_rcvbyteafterwin += todrop; } tp->snd_wl1 = ti->ti_seq - 1; tp->rcv_up = ti->ti_seq; goto step6; } // States other than LISTEN or SYN_SENT. // First check timestamp, if present. // Then check that at least some bytes of segment are within // receive window. If segment begins before rcv_nxt, // drop leading data (and SYN); if nothing left, just ack. // // RFC 1323 PAWS: If we have a timestamp reply on this segment // and it's less than ts_recent, drop it. if (ts_present && (tiflags & TH_RST) == 0 && tp->ts_recent && TSTMP_LT(ts_val, tp->ts_recent)) { // Check to see if ts_recent is over 24 days old. if ((int)(g_tcp_now - tp->ts_recent_age) > TCP_PAWS_IDLE) { // Invalidate ts_recent. If this segment updates // ts_recent, the age will be reset later and ts_recent // will get a valid value. If it does not, setting // ts_recent to zero will at least satisfy the // requirement that zero be placed in the timestamp // echo reply when ts_recent isn't valid. The // age isn't reset until we get a valid ts_recent // because we don't want out-of-order segments to be // dropped when ts_recent is old. tp->ts_recent = 0; } else { g_tcpstat.tcps_rcvduppack++; g_tcpstat.tcps_rcvdupbyte += ti->ti_len; g_tcpstat.tcps_pawsdrop++; goto dropafterack; } } todrop = tp->rcv_nxt - ti->ti_seq; if (todrop > 0) { if (tiflags & TH_SYN) { tiflags &= ~TH_SYN; ti->ti_seq++; if (ti->ti_urp > 1) ti->ti_urp--; else tiflags &= ~TH_URG; todrop--; } if ( todrop >= ti->ti_len || ( todrop == ti->ti_len && (tiflags & TH_FIN ) == 0 ) ) { // Any valid FIN must be to the left of the window. // At this point the FIN must be a duplicate or // out of sequence; drop it. tiflags &= ~TH_FIN; // Send an ACK to resynchronize and drop any data // But keep on processing for RST or ACK. tp->t_flags |= TF_ACKNOW; TRACE("send ack now to resync, tp_flags=%d", tp->t_flags); todrop = ti->ti_len; g_tcpstat.tcps_rcvdupbyte += ti->ti_len; g_tcpstat.tcps_rcvduppack++; } else { g_tcpstat.tcps_rcvpartduppack++; g_tcpstat.tcps_rcvpartdupbyte += ti->ti_len; } m_adj(m, todrop); ti->ti_seq += todrop; ti->ti_len -= todrop; if (ti->ti_urp > todrop) ti->ti_urp -= todrop; else { tiflags &= ~TH_URG; ti->ti_urp = 0; } } // If new data are received on a connection after the // user processes are gone, then RST the other end. if ((so->so_state & USN_NOFDREF) && tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) { tp = tcp_close(tp); g_tcpstat.tcps_rcvafterclose++; goto dropwithreset; } // If segment ends after window, drop trailing data // (and PUSH and FIN); if nothing left, just ACK. todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd); if (todrop > 0) { g_tcpstat.tcps_rcvpackafterwin++; if (todrop >= ti->ti_len) { g_tcpstat.tcps_rcvbyteafterwin += ti->ti_len; // If a new connection request is received // while in TIME_WAIT, drop the old connection // and start over if the sequence numbers // are above the previous ones. if (tiflags & TH_SYN && tp->t_state == TCPS_TIME_WAIT && SEQ_GT(ti->ti_seq, tp->rcv_nxt)) { iss = tp->snd_nxt + TCP_ISSINCR; tp = tcp_close(tp); goto findpcb; } // If window is closed can only take segments at // window edge, and have to drop data and PUSH from // incoming segments. Continue processing, but // remember to ack. Otherwise, drop segment // and ack. if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) { tp->t_flags |= TF_ACKNOW; g_tcpstat.tcps_rcvwinprobe++; } else goto dropafterack; } else g_tcpstat.tcps_rcvbyteafterwin += todrop; m_adj(m, -todrop); ti->ti_len -= todrop; tiflags &= ~(TH_PUSH|TH_FIN); } // check valid timestamp. Replace code above. if (ts_present && TSTMP_GEQ(ts_val, tp->ts_recent) && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent) ) { tp->ts_recent_age = g_tcp_now; tp->ts_recent = ts_val; } // If the RST bit is set examine the state: // SYN_RECEIVED STATE: // If passive open, return to LISTEN state. // If active open, inform user that connection was refused. // ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: // Inform user that connection was reset, and close tcb. // CLOSING, LAST_ACK, TIME_WAIT STATES // Close the tcb. if (tiflags&TH_RST) switch (tp->t_state) { case TCPS_SYN_RECEIVED: so->so_error = ECONNREFUSED; goto close; case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: so->so_error = ECONNRESET; close: DEBUG("change tcp state to TCPS_CLOSED, state=%d", tp->t_state); tp->t_state = TCPS_CLOSED; // tcp event usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_CLOSED, 0); g_tcpstat.tcps_drops++; tp = tcp_close(tp); goto drop; case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: tp = tcp_close(tp); goto drop; } // If a SYN is in the window, then this is an // error and we send an RST and drop the connection. if (tiflags & TH_SYN) { tp = tcp_drop(tp, ECONNRESET); goto dropwithreset; } // If the ACK bit is off we drop the segment and return. if ((tiflags & TH_ACK) == 0) goto drop; // Ack processing. switch (tp->t_state) { // In SYN_RECEIVED state if the ack ACKs our SYN then enter // ESTABLISHED state and continue processing, otherwise // send an RST. case TCPS_SYN_RECEIVED: if (SEQ_GT(tp->snd_una, ti->ti_ack) || SEQ_GT(ti->ti_ack, tp->snd_max)) goto dropwithreset; g_tcpstat.tcps_connects++; DEBUG("change tcp state to TCPS_ESTABLISHED, state=%d", tp->t_state); tp->t_state = TCPS_ESTABLISHED; soisconnected(so); // Do window scaling? if ((tp->t_flags & (TF_RCVD_SCALE|TF_REQ_SCALE)) == (TF_RCVD_SCALE|TF_REQ_SCALE)) { tp->snd_scale = tp->requested_s_scale; tp->rcv_scale = tp->request_r_scale; } tcp_reass(tp, (struct tcpiphdr *)0, (usn_mbuf_t *)0); tp->snd_wl1 = ti->ti_seq - 1; // fall into ... // In ESTABLISHED state: drop duplicate ACKs; ACK out of range // ACKs. If the ack is in the range // tp->snd_una < ti->ti_ack <= tp->snd_max // then advance tp->snd_una to ti->ti_ack and drop // data from the retransmission queue. If this ACK reflects // more up to date window information we update our window information. case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) { if (ti->ti_len == 0 && tiwin == tp->snd_wnd) { g_tcpstat.tcps_rcvdupack++; // If we have outstanding data (other than // a window probe), this is a completely // duplicate ack (ie, window info didn't // change), the ack is the biggest we've // seen and we've seen exactly our rexmt // threshhold of them, assume a packet // has been dropped and retransmit it. // Kludge snd_nxt & the congestion // window so we send only this one // packet. // // We know we're losing at the current // window size so do congestion avoidance // (set ssthresh to half the current window // and pull our congestion window back to // the new ssthresh). // // Dup acks mean that packets have left the // network (they're now cached at the receiver) // so bump cwnd by the amount in the receiver // to keep a constant cwnd packets in the // network. if (tp->t_timer[TCPT_REXMT] == 0 || ti->ti_ack != tp->snd_una) tp->t_dupacks = 0; else if (++tp->t_dupacks == g_tcprexmtthresh) { // congestion avoidance tcp_seq onxt = tp->snd_nxt; u_int win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg; if (win < 2) win = 2; tp->snd_ssthresh = win * tp->t_maxseg; tp->t_timer[TCPT_REXMT] = 0; tp->t_rtt = 0; tp->snd_nxt = ti->ti_ack; tp->snd_cwnd = tp->t_maxseg; tcp_output(tp); tp->snd_cwnd = tp->snd_ssthresh + tp->t_maxseg * tp->t_dupacks; if (SEQ_GT(onxt, tp->snd_nxt)) tp->snd_nxt = onxt; goto drop; } else if (tp->t_dupacks > g_tcprexmtthresh) { tp->snd_cwnd += tp->t_maxseg; tcp_output(tp); goto drop; } } else tp->t_dupacks = 0; break; } // If the congestion window was inflated to account // for the other side's cached packets, retract it. if (tp->t_dupacks > g_tcprexmtthresh && tp->snd_cwnd > tp->snd_ssthresh) tp->snd_cwnd = tp->snd_ssthresh; tp->t_dupacks = 0; if (SEQ_GT(ti->ti_ack, tp->snd_max)) { g_tcpstat.tcps_rcvacktoomuch++; goto dropafterack; } acked = ti->ti_ack - tp->snd_una; g_tcpstat.tcps_rcvackpack++; g_tcpstat.tcps_rcvackbyte += acked; // If we have a timestamp reply, update smoothed // round trip time. If no timestamp is present but // transmit timer is running and timed sequence // number was acked, update smoothed round trip time. // Since we now have an rtt measurement, cancel the // timer backoff (cf., Phil Karn's retransmit alg.). // Recompute the initial retransmit timer. if (ts_present) tcp_xmit_timer(tp, g_tcp_now-ts_ecr+1); else if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) tcp_xmit_timer(tp,tp->t_rtt); // If all outstanding data is acked, stop retransmit // timer and remember to restart (more output or persist). // If there is more data to be acked, restart retransmit // timer, using current (possibly backed-off) value. if (ti->ti_ack == tp->snd_max) { tp->t_timer[TCPT_REXMT] = 0; DEBUG("change needoutput to 1"); needoutput = 1; tp->t_flags |= TF_NEEDOUTPUT; } else if (tp->t_timer[TCPT_PERSIST] == 0) tp->t_timer[TCPT_REXMT] = tp->t_rxtcur; // When new data is acked, open the congestion window. // If the window gives us less than ssthresh packets // in flight, open exponentially (maxseg per packet). // Otherwise open linearly: maxseg per window // (maxseg * (maxseg / cwnd) per packet). { u_int cw = tp->snd_cwnd; u_int incr = tp->t_maxseg; if (cw > tp->snd_ssthresh) incr = incr * incr / cw; tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale); } if (acked > so->so_snd->sb_cc) { tp->snd_wnd -= so->so_snd->sb_cc; DEBUG("drop all so_snd buffer, drop_bytes=%d, acked=%d", so->so_snd->sb_cc, acked); sbdrop(so->so_snd, (int)so->so_snd->sb_cc); ourfinisacked = 1; } else { DEBUG("drop so_snd buffer, drop_bytes=%d, len=%d", acked, so->so_snd->sb_cc); sbdrop(so->so_snd, acked); tp->snd_wnd -= acked; ourfinisacked = 0; } //if (so->so_snd->sb_flags & SB_NOTIFY) { sowwakeup(so); usnet_tcpin_wwakeup(so, USN_TCP_IN, USN_TCPEV_WRITE, 0); //} tp->snd_una = ti->ti_ack; if (SEQ_LT(tp->snd_nxt, tp->snd_una)) tp->snd_nxt = tp->snd_una; switch (tp->t_state) { // In FIN_WAIT_1 STATE in addition to the processing // for the ESTABLISHED state if our FIN is now acknowledged // then enter FIN_WAIT_2. case TCPS_FIN_WAIT_1: if (ourfinisacked) { // If we can't receive any more // data, then closing user can proceed. // Starting the timer is contrary to the // specification, but if we don't get a FIN // we'll hang forever. if (so->so_state & USN_CANTRCVMORE) { soisdisconnected(so); tp->t_timer[TCPT_2MSL] = g_tcp_maxidle; } DEBUG("change tcp state to TCPS_FIN_WAIT_2, state=%d", tp->t_state); tp->t_state = TCPS_FIN_WAIT_2; usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_FIN_WAIT2, 0); } break; // In CLOSING STATE in addition to the processing for // the ESTABLISHED state if the ACK acknowledges our FIN // then enter the TIME-WAIT state, otherwise ignore // the segment. case TCPS_CLOSING: if (ourfinisacked) { DEBUG("change tcp state to TCPS_TIME_WAIT, state=%d", tp->t_state); tp->t_state = TCPS_TIME_WAIT; usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_TIME_WAIT, 0); tcp_canceltimers(tp); tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; soisdisconnected(so); } break; // In LAST_ACK, we may still be waiting for data to drain // and/or to be acked, as well as for the ack of our FIN. // If our FIN is now acknowledged, delete the TCB, // enter the closed state and return. case TCPS_LAST_ACK: if (ourfinisacked) { tp = tcp_close(tp); goto drop; } break; // In TIME_WAIT state the only thing that should arrive // is a retransmission of the remote FIN. Acknowledge // it and restart the finack timer. case TCPS_TIME_WAIT: tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; goto dropafterack; } } step6: // Update window information. // Don't look at window if no ACK: TAC's send garbage on first SYN. if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, ti->ti_seq) || (tp->snd_wl1 == ti->ti_seq && (SEQ_LT(tp->snd_wl2, ti->ti_ack) || (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd) )) )) { // keep track of pure window updates if (ti->ti_len == 0 && tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd) g_tcpstat.tcps_rcvwinupd++; tp->snd_wnd = tiwin; tp->snd_wl1 = ti->ti_seq; tp->snd_wl2 = ti->ti_ack; if (tp->snd_wnd > tp->max_sndwnd) tp->max_sndwnd = tp->snd_wnd; DEBUG("change needoutput to 1"); tp->t_flags |= TF_NEEDOUTPUT; needoutput = 1; } // Process segments with URG. if ((tiflags & TH_URG) && ti->ti_urp && TCPS_HAVERCVDFIN(tp->t_state) == 0) { // This is a kludge, but if we receive and accept // random urgent pointers, we'll crash in // soreceive. It's hard to imagine someone // actually wanting to send this much urgent data. if (ti->ti_urp + so->so_rcv->sb_cc > g_sb_max) { ti->ti_urp = 0; // XXX tiflags &= ~TH_URG; // XXX goto dodata; // XXX } // If this segment advances the known urgent pointer, // then mark the data stream. This should not happen // in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since // a FIN has been received from the remote side. // In these states we ignore the URG. // // According to RFC961 (Assigned Protocols), // the urgent pointer points to the last octet // of urgent data. We continue, however, // to consider it to indicate the first octet // of data past the urgent section as the original // spec states (in one of two places). if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) { tp->rcv_up = ti->ti_seq + ti->ti_urp; so->so_oobmark = so->so_rcv->sb_cc + (tp->rcv_up - tp->rcv_nxt) - 1; if (so->so_oobmark == 0) so->so_state |= USN_RCVATMARK; sohasoutofband(so); // send async event to app threads. usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPEV_OUTOFBOUND, 0); tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA); } // Remove out of band data so doesn't get presented to user. // This can happen independent of advancing the URG pointer, // but if two URG's are pending at once, some out-of-band // data may creep in... ick. if (ti->ti_urp <= ti->ti_len #ifdef SO_OOBINLINE && (so->so_options & SO_OOBINLINE) == 0 #endif ) tcp_pulloutofband(so, ti, m); } else // If no out of band data is expected, // pull receive urgent pointer along // with the receive window. if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) tp->rcv_up = tp->rcv_nxt; dodata: // XXX #ifdef DUMP_PAYLOAD DEBUG("Handle data"); dump_chain(m,"tcp"); #endif // Process the segment text, merging it into the TCP sequencing queue, // and arranging for acknowledgment of receipt if necessary. // This process logically involves adjusting tp->rcv_wnd as data // is presented to the user (this happens in tcp_usrreq.c, // case PRU_RCVD). If a FIN has already been received on this // connection then we just ignore the text. if ((ti->ti_len || (tiflags&TH_FIN)) && TCPS_HAVERCVDFIN(tp->t_state) == 0) { TCP_REASS(tp, ti, m, so, tiflags); // Note the amount of data that peer has sent into // our window, in order to estimate the sender's // buffer size. len = so->so_rcv->sb_hiwat - (tp->rcv_adv - tp->rcv_nxt); } else { usn_free_cmbuf(m); tiflags &= ~TH_FIN; } // If FIN is received ACK the FIN and let the user know // that the connection is closing. if (tiflags & TH_FIN) { if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { socantrcvmore(so); tp->t_flags |= TF_ACKNOW; TRACE("ack FIN now, tp flags=%d", tp->t_flags); tp->rcv_nxt++; } switch (tp->t_state) { // In SYN_RECEIVED and ESTABLISHED STATES // enter the CLOSE_WAIT state. case TCPS_SYN_RECEIVED: case TCPS_ESTABLISHED: TRACE("change tcp state to TCPS_CLOSE_WAIT, state=%d", tp->t_state); tp->t_state = TCPS_CLOSE_WAIT; soewakeup(so, 0); usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_CLOSE_WAIT, 0); break; // If still in FIN_WAIT_1 STATE FIN has not been acked so // enter the CLOSING state. case TCPS_FIN_WAIT_1: TRACE("change tcp state to TCPS_CLOSING, state=%d", tp->t_state); tp->t_state = TCPS_CLOSING; usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_CLOSING, 0); break; // In FIN_WAIT_2 state enter the TIME_WAIT state, // starting the time-wait timer, turning off the other // standard timers. case TCPS_FIN_WAIT_2: TRACE("change tcp state to TCPS_TIME_WAIT, state=%d", tp->t_state); tp->t_state = TCPS_TIME_WAIT; tcp_canceltimers(tp); tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; soisdisconnected(so); usnet_tcpin_ewakeup(so, USN_TCP_IN, USN_TCPST_TIME_WAIT, 0); break; // In TIME_WAIT state restart the 2 MSL time_wait timer. case TCPS_TIME_WAIT: tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; break; } } if (so->so_options & SO_DEBUG) { TRACE("tcp trace, so_options=%d", so->so_options); tcp_trace(TA_INPUT, ostate, tp, &g_tcp_saveti, 0); } // Return any desired output. //if (needoutput || (tp->t_flags & TF_ACKNOW)){ if (tp->t_flags & TF_NEEDOUTPUT || (tp->t_flags & TF_ACKNOW)){ TRACE("ack now or need to ouput, tp->t_flags=%d", tp->t_flags); tcp_output(tp); } return; dropafterack: TRACE("dropafterack"); // Generate an ACK dropping incoming segment if it occupies // sequence space, where the ACK reflects our state. if (tiflags & TH_RST) goto drop; usn_free_cmbuf(m); tp->t_flags |= TF_ACKNOW; TRACE("ack now, tp flags=%d", tp->t_flags); tcp_output(tp); return; dropwithreset: TRACE("dropwithreset"); // Generate a RST, dropping incoming segment. // Make ACK acceptable to originator of segment. // Don't bother to respond if destination was broadcast/multicast. #define USN_MULTICAST(i) (((u_int)(i) & 0xf0000000) == 0xe0000000) if ((tiflags & TH_RST) || m->flags & (BUF_BCAST|BUF_MCAST) || USN_MULTICAST(ntohl(ti->ti_dst.s_addr))) goto drop; if (tiflags & TH_ACK) tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST); else { if (tiflags & TH_SYN) ti->ti_len++; tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK); } // destroy temporarily created socket if (dropsocket) soabort(so); return; drop: TRACE("drop"); // Drop space held by incoming segment and return. if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)) { TRACE("tcp trace: drop a socket"); tcp_trace(TA_DROP, ostate, tp, &g_tcp_saveti, 0); } usn_free_cmbuf(m); // destroy temporarily created socket if (dropsocket) soabort(so); return; }
/* * TCP input routine, follows pages 65-76 of the * protocol specification dated September, 1981 very closely. */ void tcp_input(struct mbuf *m, int iphlen, struct socket *inso) { struct ip save_ip, *ip; register struct tcpiphdr *ti; caddr_t optp = NULL; int optlen = 0; int len, tlen, off; register struct tcpcb *tp = NULL; register int tiflags; struct socket *so = NULL; int todrop, acked, ourfinisacked, needoutput = 0; int iss = 0; u_long tiwin; int ret; struct ex_list *ex_ptr; Slirp *slirp; DEBUG_CALL("tcp_input"); DEBUG_ARGS((dfd, " m = %8lx iphlen = %2d inso = %lx\n", (long )m, iphlen, (long )inso )); /* * If called with m == 0, then we're continuing the connect */ if (m == NULL) { so = inso; slirp = so->slirp; /* Re-set a few variables */ tp = sototcpcb(so); m = so->so_m; so->so_m = NULL; ti = so->so_ti; tiwin = ti->ti_win; tiflags = ti->ti_flags; goto cont_conn; } slirp = m->slirp; /* * Get IP and TCP header together in first mbuf. * Note: IP leaves IP header in first mbuf. */ ti = mtod(m, struct tcpiphdr *); if (iphlen > sizeof(struct ip )) { ip_stripoptions(m, (struct mbuf *)0); iphlen=sizeof(struct ip ); } /* XXX Check if too short */ /* * Save a copy of the IP header in case we want restore it * for sending an ICMP error message in response. */ ip=mtod(m, struct ip *); save_ip = *ip; save_ip.ip_len+= iphlen; /* * Checksum extended TCP header and data. */ tlen = ((struct ip *)ti)->ip_len; tcpiphdr2qlink(ti)->next = tcpiphdr2qlink(ti)->prev = NULL; memset(&ti->ti_i.ih_mbuf, 0 , sizeof(struct mbuf_ptr)); ti->ti_x1 = 0; ti->ti_len = htons((uint16_t)tlen); len = sizeof(struct ip ) + tlen; if(cksum(m, len)) { goto drop; } /* * Check that TCP offset makes sense, * pull out TCP options and adjust length. XXX */ off = ti->ti_off << 2; if (off < sizeof (struct tcphdr) || off > tlen) { goto drop; } tlen -= off; ti->ti_len = tlen; if (off > sizeof (struct tcphdr)) { optlen = off - sizeof (struct tcphdr); optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr); } tiflags = ti->ti_flags; /* * Convert TCP protocol specific fields to host format. */ NTOHL(ti->ti_seq); NTOHL(ti->ti_ack); NTOHS(ti->ti_win); NTOHS(ti->ti_urp); /* * Drop TCP, IP headers and TCP options. */ m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); /* * Locate pcb for segment. */ findso: so = slirp->tcp_last_so; if (so->so_fport != ti->ti_dport || so->so_lport != ti->ti_sport || so->so_laddr.s_addr != ti->ti_src.s_addr || so->so_faddr.s_addr != ti->ti_dst.s_addr) { so = solookup(&slirp->tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport); if (so) slirp->tcp_last_so = so; } /* * If the state is CLOSED (i.e., TCB does not exist) then * all data in the incoming segment is discarded. * If the TCB exists but is in CLOSED state, it is embryonic, * but should either do a listen or a connect soon. * * state == CLOSED means we've done socreate() but haven't * attached it to a protocol yet... * * XXX If a TCB does not exist, and the TH_SYN flag is * the only flag set, then create a session, mark it * as if it was LISTENING, and continue... */ if (so == NULL) { if (slirp->restricted) { /* Any hostfwds will have an existing socket, so we only get here * for non-hostfwd connections. These should be dropped, unless it * happens to be a guestfwd. */ for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { if (ex_ptr->ex_fport == ti->ti_dport && ti->ti_dst.s_addr == ex_ptr->ex_addr.s_addr) { break; } } if (!ex_ptr) { goto dropwithreset; } } if ((tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) != TH_SYN) goto dropwithreset; if ((so = socreate(slirp)) == NULL) goto dropwithreset; if (tcp_attach(so) < 0) { free(so); /* Not sofree (if it failed, it's not insqued) */ goto dropwithreset; } sbreserve(&so->so_snd, TCP_SNDSPACE); sbreserve(&so->so_rcv, TCP_RCVSPACE); so->so_laddr = ti->ti_src; so->so_lport = ti->ti_sport; so->so_faddr = ti->ti_dst; so->so_fport = ti->ti_dport; if ((so->so_iptos = tcp_tos(so)) == 0) so->so_iptos = ((struct ip *)ti)->ip_tos; tp = sototcpcb(so); tp->t_state = TCPS_LISTEN; } /* * If this is a still-connecting socket, this probably * a retransmit of the SYN. Whether it's a retransmit SYN * or something else, we nuke it. */ if (so->so_state & SS_ISFCONNECTING) goto drop; tp = sototcpcb(so); /* XXX Should never fail */ if (tp == NULL) goto dropwithreset; if (tp->t_state == TCPS_CLOSED) goto drop; tiwin = ti->ti_win; /* * Segment received on connection. * Reset idle time and keep-alive timer. */ tp->t_idle = 0; if (SO_OPTIONS) tp->t_timer[TCPT_KEEP] = TCPTV_KEEPINTVL; else tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_IDLE; /* * Process options if not in LISTEN state, * else do it below (after getting remote address). */ if (optp && tp->t_state != TCPS_LISTEN) tcp_dooptions(tp, (u_char *)optp, optlen, ti); /* * Header prediction: check for the two common cases * of a uni-directional data xfer. If the packet has * no control flags, is in-sequence, the window didn't * change and we're not retransmitting, it's a * candidate. If the length is zero and the ack moved * forward, we're the sender side of the xfer. Just * free the data acked & wake any higher level process * that was blocked waiting for space. If the length * is non-zero and the ack didn't move, we're the * receiver side. If we're getting packets in-order * (the reassembly queue is empty), add the data to * the socket buffer and note that we need a delayed ack. * * XXX Some of these tests are not needed * eg: the tiwin == tp->snd_wnd prevents many more * predictions.. with no *real* advantage.. */ if (tp->t_state == TCPS_ESTABLISHED && (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK && ti->ti_seq == tp->rcv_nxt && tiwin && tiwin == tp->snd_wnd && tp->snd_nxt == tp->snd_max) { if (ti->ti_len == 0) { if (SEQ_GT(ti->ti_ack, tp->snd_una) && SEQ_LEQ(ti->ti_ack, tp->snd_max) && tp->snd_cwnd >= tp->snd_wnd) { /* * this is a pure ack for outstanding data. */ if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) tcp_xmit_timer(tp, tp->t_rtt); acked = ti->ti_ack - tp->snd_una; sbdrop(&so->so_snd, acked); tp->snd_una = ti->ti_ack; m_free(m); /* * If all outstanding data are acked, stop * retransmit timer, otherwise restart timer * using current (possibly backed-off) value. * If process is waiting for space, * wakeup/selwakeup/signal. If data * are ready to send, let tcp_output * decide between more output or persist. */ if (tp->snd_una == tp->snd_max) tp->t_timer[TCPT_REXMT] = 0; else if (tp->t_timer[TCPT_PERSIST] == 0) tp->t_timer[TCPT_REXMT] = tp->t_rxtcur; /* * This is called because sowwakeup might have * put data into so_snd. Since we don't so sowwakeup, * we don't need this.. XXX??? */ if (so->so_snd.sb_cc) (void) tcp_output(tp); return; } } else if (ti->ti_ack == tp->snd_una && tcpfrag_list_empty(tp) && ti->ti_len <= sbspace(&so->so_rcv)) { /* * this is a pure, in-sequence data packet * with nothing on the reassembly queue and * we have enough buffer space to take it. */ tp->rcv_nxt += ti->ti_len; /* * Add data to socket buffer. */ if (so->so_emu) { if (tcp_emu(so,m)) sbappend(so, m); } else sbappend(so, m); /* * If this is a short packet, then ACK now - with Nagel * congestion avoidance sender won't send more until * he gets an ACK. * * It is better to not delay acks at all to maximize * TCP throughput. See RFC 2581. */ tp->t_flags |= TF_ACKNOW; tcp_output(tp); return; } } /* header prediction */ /* * Calculate amount of space in receive window, * and then do TCP input processing. * Receive window is amount of space in rcv queue, * but not less than advertised window. */ { int win; win = sbspace(&so->so_rcv); if (win < 0) win = 0; tp->rcv_wnd = max(win, (int)(tp->rcv_adv - tp->rcv_nxt)); } switch (tp->t_state) { /* * If the state is LISTEN then ignore segment if it contains an RST. * If the segment contains an ACK then it is bad and send a RST. * If it does not contain a SYN then it is not interesting; drop it. * Don't bother responding if the destination was a broadcast. * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial * tp->iss, and send a segment: * <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK> * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss. * Fill in remote peer address fields if not previously specified. * Enter SYN_RECEIVED state, and process any other fields of this * segment in this state. */ case TCPS_LISTEN: { if (tiflags & TH_RST) goto drop; if (tiflags & TH_ACK) goto dropwithreset; if ((tiflags & TH_SYN) == 0) goto drop; /* * This has way too many gotos... * But a bit of spaghetti code never hurt anybody :) */ /* * If this is destined for the control address, then flag to * tcp_ctl once connected, otherwise connect */ if ((so->so_faddr.s_addr & slirp->vnetwork_mask.s_addr) == slirp->vnetwork_addr.s_addr) { if (so->so_faddr.s_addr != slirp->vhost_addr.s_addr && so->so_faddr.s_addr != slirp->vnameserver_addr.s_addr) { /* May be an add exec */ for (ex_ptr = slirp->exec_list; ex_ptr; ex_ptr = ex_ptr->ex_next) { if(ex_ptr->ex_fport == so->so_fport && so->so_faddr.s_addr == ex_ptr->ex_addr.s_addr) { so->so_state |= SS_CTL; break; } } if (so->so_state & SS_CTL) { goto cont_input; } } /* CTL_ALIAS: Do nothing, tcp_fconnect will be called on it */ } if (so->so_emu & EMU_NOCONNECT) { so->so_emu &= ~EMU_NOCONNECT; goto cont_input; } if ((tcp_fconnect(so) == -1) && #if defined(_WIN32) socket_error() != WSAEWOULDBLOCK #else (errno != EINPROGRESS) && (errno != EWOULDBLOCK) #endif ) { u_char code=ICMP_UNREACH_NET; DEBUG_MISC((dfd, " tcp fconnect errno = %d-%s\n", errno,strerror(errno))); if(errno == ECONNREFUSED) { /* ACK the SYN, send RST to refuse the connection */ tcp_respond(tp, ti, m, ti->ti_seq+1, (tcp_seq)0, TH_RST|TH_ACK); } else { if(errno == EHOSTUNREACH) code=ICMP_UNREACH_HOST; HTONL(ti->ti_seq); /* restore tcp header */ HTONL(ti->ti_ack); HTONS(ti->ti_win); HTONS(ti->ti_urp); m->m_data -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); m->m_len += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr); *ip=save_ip; icmp_error(m, ICMP_UNREACH,code, 0,strerror(errno)); } tcp_close(tp); m_free(m); } else { /* * Haven't connected yet, save the current mbuf * and ti, and return * XXX Some OS's don't tell us whether the connect() * succeeded or not. So we must time it out. */ so->so_m = m; so->so_ti = ti; tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT; tp->t_state = TCPS_SYN_RECEIVED; tcp_template(tp); } return; cont_conn: /* m==NULL * Check if the connect succeeded */ if (so->so_state & SS_NOFDREF) { tp = tcp_close(tp); goto dropwithreset; } cont_input: tcp_template(tp); if (optp) tcp_dooptions(tp, (u_char *)optp, optlen, ti); if (iss) tp->iss = iss; else tp->iss = slirp->tcp_iss; slirp->tcp_iss += TCP_ISSINCR/2; tp->irs = ti->ti_seq; tcp_sendseqinit(tp); tcp_rcvseqinit(tp); tp->t_flags |= TF_ACKNOW; tp->t_state = TCPS_SYN_RECEIVED; tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT; goto trimthenstep6; } /* case TCPS_LISTEN */ /* * If the state is SYN_SENT: * if seg contains an ACK, but not for our SYN, drop the input. * if seg contains a RST, then drop the connection. * if seg does not contain SYN, then drop it. * Otherwise this is an acceptable SYN segment * initialize tp->rcv_nxt and tp->irs * if seg contains ack then advance tp->snd_una * if SYN has been acked change to ESTABLISHED else SYN_RCVD state * arrange for segment to be acked (eventually) * continue processing rest of data/controls, beginning with URG */ case TCPS_SYN_SENT: if ((tiflags & TH_ACK) && (SEQ_LEQ(ti->ti_ack, tp->iss) || SEQ_GT(ti->ti_ack, tp->snd_max))) goto dropwithreset; if (tiflags & TH_RST) { if (tiflags & TH_ACK) { tcp_drop(tp, 0); /* XXX Check t_softerror! */ } goto drop; } if ((tiflags & TH_SYN) == 0) goto drop; if (tiflags & TH_ACK) { tp->snd_una = ti->ti_ack; if (SEQ_LT(tp->snd_nxt, tp->snd_una)) tp->snd_nxt = tp->snd_una; } tp->t_timer[TCPT_REXMT] = 0; tp->irs = ti->ti_seq; tcp_rcvseqinit(tp); tp->t_flags |= TF_ACKNOW; if (tiflags & TH_ACK && SEQ_GT(tp->snd_una, tp->iss)) { soisfconnected(so); tp->t_state = TCPS_ESTABLISHED; (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0); /* * if we didn't have to retransmit the SYN, * use its rtt as our initial srtt & rtt var. */ if (tp->t_rtt) tcp_xmit_timer(tp, tp->t_rtt); } else tp->t_state = TCPS_SYN_RECEIVED; trimthenstep6: /* * Advance ti->ti_seq to correspond to first data byte. * If data, trim to stay within window, * dropping FIN if necessary. */ ti->ti_seq++; if (ti->ti_len > tp->rcv_wnd) { todrop = ti->ti_len - tp->rcv_wnd; m_adj(m, -todrop); ti->ti_len = tp->rcv_wnd; tiflags &= ~TH_FIN; } tp->snd_wl1 = ti->ti_seq - 1; tp->rcv_up = ti->ti_seq; goto step6; } /* switch tp->t_state */ /* * States other than LISTEN or SYN_SENT. * Check that at least some bytes of segment are within * receive window. If segment begins before rcv_nxt, * drop leading data (and SYN); if nothing left, just ack. */ todrop = tp->rcv_nxt - ti->ti_seq; if (todrop > 0) { if (tiflags & TH_SYN) { tiflags &= ~TH_SYN; ti->ti_seq++; if (ti->ti_urp > 1) ti->ti_urp--; else tiflags &= ~TH_URG; todrop--; } /* * Following if statement from Stevens, vol. 2, p. 960. */ if (todrop > ti->ti_len || (todrop == ti->ti_len && (tiflags & TH_FIN) == 0)) { /* * Any valid FIN must be to the left of the window. * At this point the FIN must be a duplicate or out * of sequence; drop it. */ tiflags &= ~TH_FIN; /* * Send an ACK to resynchronize and drop any data. * But keep on processing for RST or ACK. */ tp->t_flags |= TF_ACKNOW; todrop = ti->ti_len; } m_adj(m, todrop); ti->ti_seq += todrop; ti->ti_len -= todrop; if (ti->ti_urp > todrop) ti->ti_urp -= todrop; else { tiflags &= ~TH_URG; ti->ti_urp = 0; } } /* * If new data are received on a connection after the * user processes are gone, then RST the other end. */ if ((so->so_state & SS_NOFDREF) && tp->t_state > TCPS_CLOSE_WAIT && ti->ti_len) { tp = tcp_close(tp); goto dropwithreset; } /* * If segment ends after window, drop trailing data * (and PUSH and FIN); if nothing left, just ACK. */ todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd); if (todrop > 0) { if (todrop >= ti->ti_len) { /* * If a new connection request is received * while in TIME_WAIT, drop the old connection * and start over if the sequence numbers * are above the previous ones. */ if (tiflags & TH_SYN && tp->t_state == TCPS_TIME_WAIT && SEQ_GT(ti->ti_seq, tp->rcv_nxt)) { iss = tp->rcv_nxt + TCP_ISSINCR; tp = tcp_close(tp); goto findso; } /* * If window is closed can only take segments at * window edge, and have to drop data and PUSH from * incoming segments. Continue processing, but * remember to ack. Otherwise, drop segment * and ack. */ if (tp->rcv_wnd == 0 && ti->ti_seq == tp->rcv_nxt) { tp->t_flags |= TF_ACKNOW; } else { goto dropafterack; } } m_adj(m, -todrop); ti->ti_len -= todrop; tiflags &= ~(TH_PUSH|TH_FIN); } /* * If the RST bit is set examine the state: * SYN_RECEIVED STATE: * If passive open, return to LISTEN state. * If active open, inform user that connection was refused. * ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES: * Inform user that connection was reset, and close tcb. * CLOSING, LAST_ACK, TIME_WAIT STATES * Close the tcb. */ if (tiflags&TH_RST) switch (tp->t_state) { case TCPS_SYN_RECEIVED: case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: tp->t_state = TCPS_CLOSED; tcp_close(tp); goto drop; case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: tcp_close(tp); goto drop; } /* * If a SYN is in the window, then this is an * error and we send an RST and drop the connection. */ if (tiflags & TH_SYN) { tp = tcp_drop(tp,0); goto dropwithreset; } /* * If the ACK bit is off we drop the segment and return. */ if ((tiflags & TH_ACK) == 0) goto drop; /* * Ack processing. */ switch (tp->t_state) { /* * In SYN_RECEIVED state if the ack ACKs our SYN then enter * ESTABLISHED state and continue processing, otherwise * send an RST. una<=ack<=max */ case TCPS_SYN_RECEIVED: if (SEQ_GT(tp->snd_una, ti->ti_ack) || SEQ_GT(ti->ti_ack, tp->snd_max)) goto dropwithreset; tp->t_state = TCPS_ESTABLISHED; /* * The sent SYN is ack'ed with our sequence number +1 * The first data byte already in the buffer will get * lost if no correction is made. This is only needed for * SS_CTL since the buffer is empty otherwise. * tp->snd_una++; or: */ tp->snd_una=ti->ti_ack; if (so->so_state & SS_CTL) { /* So tcp_ctl reports the right state */ ret = tcp_ctl(so); if (ret == 1) { soisfconnected(so); so->so_state &= ~SS_CTL; /* success XXX */ } else if (ret == 2) { so->so_state &= SS_PERSISTENT_MASK; so->so_state |= SS_NOFDREF; /* CTL_CMD */ } else { needoutput = 1; tp->t_state = TCPS_FIN_WAIT_1; } } else { soisfconnected(so); } (void) tcp_reass(tp, (struct tcpiphdr *)0, (struct mbuf *)0); tp->snd_wl1 = ti->ti_seq - 1; /* Avoid ack processing; snd_una==ti_ack => dup ack */ goto synrx_to_est; /* fall into ... */ /* * In ESTABLISHED state: drop duplicate ACKs; ACK out of range * ACKs. If the ack is in the range * tp->snd_una < ti->ti_ack <= tp->snd_max * then advance tp->snd_una to ti->ti_ack and drop * data from the retransmission queue. If this ACK reflects * more up to date window information we update our window information. */ case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: if (SEQ_LEQ(ti->ti_ack, tp->snd_una)) { if (ti->ti_len == 0 && tiwin == tp->snd_wnd) { DEBUG_MISC((dfd, " dup ack m = %lx so = %lx\n", (long )m, (long )so)); /* * If we have outstanding data (other than * a window probe), this is a completely * duplicate ack (ie, window info didn't * change), the ack is the biggest we've * seen and we've seen exactly our rexmt * threshold of them, assume a packet * has been dropped and retransmit it. * Kludge snd_nxt & the congestion * window so we send only this one * packet. * * We know we're losing at the current * window size so do congestion avoidance * (set ssthresh to half the current window * and pull our congestion window back to * the new ssthresh). * * Dup acks mean that packets have left the * network (they're now cached at the receiver) * so bump cwnd by the amount in the receiver * to keep a constant cwnd packets in the * network. */ if (tp->t_timer[TCPT_REXMT] == 0 || ti->ti_ack != tp->snd_una) tp->t_dupacks = 0; else if (++tp->t_dupacks == TCPREXMTTHRESH) { tcp_seq onxt = tp->snd_nxt; u_int win = min(tp->snd_wnd, tp->snd_cwnd) / 2 / tp->t_maxseg; if (win < 2) win = 2; tp->snd_ssthresh = win * tp->t_maxseg; tp->t_timer[TCPT_REXMT] = 0; tp->t_rtt = 0; tp->snd_nxt = ti->ti_ack; tp->snd_cwnd = tp->t_maxseg; (void) tcp_output(tp); tp->snd_cwnd = tp->snd_ssthresh + tp->t_maxseg * tp->t_dupacks; if (SEQ_GT(onxt, tp->snd_nxt)) tp->snd_nxt = onxt; goto drop; } else if (tp->t_dupacks > TCPREXMTTHRESH) { tp->snd_cwnd += tp->t_maxseg; (void) tcp_output(tp); goto drop; } } else tp->t_dupacks = 0; break; } synrx_to_est: /* * If the congestion window was inflated to account * for the other side's cached packets, retract it. */ if (tp->t_dupacks > TCPREXMTTHRESH && tp->snd_cwnd > tp->snd_ssthresh) tp->snd_cwnd = tp->snd_ssthresh; tp->t_dupacks = 0; if (SEQ_GT(ti->ti_ack, tp->snd_max)) { goto dropafterack; } acked = ti->ti_ack - tp->snd_una; /* * If transmit timer is running and timed sequence * number was acked, update smoothed round trip time. * Since we now have an rtt measurement, cancel the * timer backoff (cf., Phil Karn's retransmit alg.). * Recompute the initial retransmit timer. */ if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) tcp_xmit_timer(tp,tp->t_rtt); /* * If all outstanding data is acked, stop retransmit * timer and remember to restart (more output or persist). * If there is more data to be acked, restart retransmit * timer, using current (possibly backed-off) value. */ if (ti->ti_ack == tp->snd_max) { tp->t_timer[TCPT_REXMT] = 0; needoutput = 1; } else if (tp->t_timer[TCPT_PERSIST] == 0) tp->t_timer[TCPT_REXMT] = tp->t_rxtcur; /* * When new data is acked, open the congestion window. * If the window gives us less than ssthresh packets * in flight, open exponentially (maxseg per packet). * Otherwise open linearly: maxseg per window * (maxseg^2 / cwnd per packet). */ { register u_int cw = tp->snd_cwnd; register u_int incr = tp->t_maxseg; if (cw > tp->snd_ssthresh) incr = incr * incr / cw; tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale); } if (acked > so->so_snd.sb_cc) { tp->snd_wnd -= so->so_snd.sb_cc; sbdrop(&so->so_snd, (int )so->so_snd.sb_cc); ourfinisacked = 1; } else { sbdrop(&so->so_snd, acked); tp->snd_wnd -= acked; ourfinisacked = 0; } tp->snd_una = ti->ti_ack; if (SEQ_LT(tp->snd_nxt, tp->snd_una)) tp->snd_nxt = tp->snd_una; switch (tp->t_state) { /* * In FIN_WAIT_1 STATE in addition to the processing * for the ESTABLISHED state if our FIN is now acknowledged * then enter FIN_WAIT_2. */ case TCPS_FIN_WAIT_1: if (ourfinisacked) { /* * If we can't receive any more * data, then closing user can proceed. * Starting the timer is contrary to the * specification, but if we don't get a FIN * we'll hang forever. */ if (so->so_state & SS_FCANTRCVMORE) { tp->t_timer[TCPT_2MSL] = TCP_MAXIDLE; } tp->t_state = TCPS_FIN_WAIT_2; } break; /* * In CLOSING STATE in addition to the processing for * the ESTABLISHED state if the ACK acknowledges our FIN * then enter the TIME-WAIT state, otherwise ignore * the segment. */ case TCPS_CLOSING: if (ourfinisacked) { tp->t_state = TCPS_TIME_WAIT; tcp_canceltimers(tp); tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; } break; /* * In LAST_ACK, we may still be waiting for data to drain * and/or to be acked, as well as for the ack of our FIN. * If our FIN is now acknowledged, delete the TCB, * enter the closed state and return. */ case TCPS_LAST_ACK: if (ourfinisacked) { tcp_close(tp); goto drop; } break; /* * In TIME_WAIT state the only thing that should arrive * is a retransmission of the remote FIN. Acknowledge * it and restart the finack timer. */ case TCPS_TIME_WAIT: tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; goto dropafterack; } } /* switch(tp->t_state) */ step6: /* * Update window information. * Don't look at window if no ACK: TAC's send garbage on first SYN. */ if ((tiflags & TH_ACK) && (SEQ_LT(tp->snd_wl1, ti->ti_seq) || (tp->snd_wl1 == ti->ti_seq && (SEQ_LT(tp->snd_wl2, ti->ti_ack) || (tp->snd_wl2 == ti->ti_ack && tiwin > tp->snd_wnd))))) { tp->snd_wnd = tiwin; tp->snd_wl1 = ti->ti_seq; tp->snd_wl2 = ti->ti_ack; if (tp->snd_wnd > tp->max_sndwnd) tp->max_sndwnd = tp->snd_wnd; needoutput = 1; } /* * Process segments with URG. */ if ((tiflags & TH_URG) && ti->ti_urp && TCPS_HAVERCVDFIN(tp->t_state) == 0) { /* * This is a kludge, but if we receive and accept * random urgent pointers, we'll crash in * soreceive. It's hard to imagine someone * actually wanting to send this much urgent data. */ if (ti->ti_urp + so->so_rcv.sb_cc > so->so_rcv.sb_datalen) { ti->ti_urp = 0; tiflags &= ~TH_URG; goto dodata; } /* * If this segment advances the known urgent pointer, * then mark the data stream. This should not happen * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since * a FIN has been received from the remote side. * In these states we ignore the URG. * * According to RFC961 (Assigned Protocols), * the urgent pointer points to the last octet * of urgent data. We continue, however, * to consider it to indicate the first octet * of data past the urgent section as the original * spec states (in one of two places). */ if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) { tp->rcv_up = ti->ti_seq + ti->ti_urp; so->so_urgc = so->so_rcv.sb_cc + (tp->rcv_up - tp->rcv_nxt); /* -1; */ tp->rcv_up = ti->ti_seq + ti->ti_urp; } } else /* * If no out of band data is expected, * pull receive urgent pointer along * with the receive window. */ if (SEQ_GT(tp->rcv_nxt, tp->rcv_up)) tp->rcv_up = tp->rcv_nxt; dodata: /* * If this is a small packet, then ACK now - with Nagel * congestion avoidance sender won't send more until * he gets an ACK. */ if (ti->ti_len && (unsigned)ti->ti_len <= 5 && ((struct tcpiphdr_2 *)ti)->first_char == (char)27) { tp->t_flags |= TF_ACKNOW; } /* * Process the segment text, merging it into the TCP sequencing queue, * and arranging for acknowledgment of receipt if necessary. * This process logically involves adjusting tp->rcv_wnd as data * is presented to the user (this happens in tcp_usrreq.c, * case PRU_RCVD). If a FIN has already been received on this * connection then we just ignore the text. */ if ((ti->ti_len || (tiflags&TH_FIN)) && TCPS_HAVERCVDFIN(tp->t_state) == 0) { TCP_REASS(tp, ti, m, so, tiflags); } else { m_free(m); tiflags &= ~TH_FIN; } /* * If FIN is received ACK the FIN and let the user know * that the connection is closing. */ if (tiflags & TH_FIN) { if (TCPS_HAVERCVDFIN(tp->t_state) == 0) { /* * If we receive a FIN we can't send more data, * set it SS_FDRAIN * Shutdown the socket if there is no rx data in the * buffer. * soread() is called on completion of shutdown() and * will got to TCPS_LAST_ACK, and use tcp_output() * to send the FIN. */ sofwdrain(so); tp->t_flags |= TF_ACKNOW; tp->rcv_nxt++; } switch (tp->t_state) { /* * In SYN_RECEIVED and ESTABLISHED STATES * enter the CLOSE_WAIT state. */ case TCPS_SYN_RECEIVED: case TCPS_ESTABLISHED: if(so->so_emu == EMU_CTL) /* no shutdown on socket */ tp->t_state = TCPS_LAST_ACK; else tp->t_state = TCPS_CLOSE_WAIT; break; /* * If still in FIN_WAIT_1 STATE FIN has not been acked so * enter the CLOSING state. */ case TCPS_FIN_WAIT_1: tp->t_state = TCPS_CLOSING; break; /* * In FIN_WAIT_2 state enter the TIME_WAIT state, * starting the time-wait timer, turning off the other * standard timers. */ case TCPS_FIN_WAIT_2: tp->t_state = TCPS_TIME_WAIT; tcp_canceltimers(tp); tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; break; /* * In TIME_WAIT state restart the 2 MSL time_wait timer. */ case TCPS_TIME_WAIT: tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL; break; } } /* * Return any desired output. */ if (needoutput || (tp->t_flags & TF_ACKNOW)) { (void) tcp_output(tp); } return; dropafterack: /* * Generate an ACK dropping incoming segment if it occupies * sequence space, where the ACK reflects our state. */ if (tiflags & TH_RST) goto drop; m_free(m); tp->t_flags |= TF_ACKNOW; (void) tcp_output(tp); return; dropwithreset: /* reuses m if m!=NULL, m_free() unnecessary */ if (tiflags & TH_ACK) tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST); else { if (tiflags & TH_SYN) ti->ti_len++; tcp_respond(tp, ti, m, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK); } return; drop: /* * Drop space held by incoming segment and return. */ m_free(m); }
/* * This function is called upon receipt of new valid data (while not in * header prediction mode), and it updates the ordered list of sacks. */ void tcp_update_sack_list(struct tcpcb *tp, tcp_seq rcv_start, tcp_seq rcv_end) { /* * First reported block MUST be the most recent one. Subsequent * blocks SHOULD be in the order in which they arrived at the * receiver. These two conditions make the implementation fully * compliant with RFC 2018. */ struct sackblk head_blk, saved_blks[MAX_SACK_BLKS]; int num_head, num_saved, i; //ScenSim-Port// INP_WLOCK_ASSERT(tp->t_inpcb); /* Check arguments. */ //ScenSim-Port// KASSERT(SEQ_LT(rcv_start, rcv_end), ("rcv_start < rcv_end")); /* SACK block for the received segment. */ head_blk.start = rcv_start; head_blk.end = rcv_end; /* * Merge updated SACK blocks into head_blk, and save unchanged SACK * blocks into saved_blks[]. num_saved will have the number of the * saved SACK blocks. */ num_saved = 0; for (i = 0; i < tp->rcv_numsacks; i++) { tcp_seq start = tp->sackblks[i].start; tcp_seq end = tp->sackblks[i].end; if (SEQ_GEQ(start, end) || SEQ_LEQ(start, tp->rcv_nxt)) { /* * Discard this SACK block. */ } else if (SEQ_LEQ(head_blk.start, end) && SEQ_GEQ(head_blk.end, start)) { /* * Merge this SACK block into head_blk. This SACK * block itself will be discarded. */ if (SEQ_GT(head_blk.start, start)) head_blk.start = start; if (SEQ_LT(head_blk.end, end)) head_blk.end = end; } else { /* * Save this SACK block. */ saved_blks[num_saved].start = start; saved_blks[num_saved].end = end; num_saved++; } } /* * Update SACK list in tp->sackblks[]. */ num_head = 0; if (SEQ_GT(head_blk.start, tp->rcv_nxt)) { /* * The received data segment is an out-of-order segment. Put * head_blk at the top of SACK list. */ tp->sackblks[0] = head_blk; num_head = 1; /* * If the number of saved SACK blocks exceeds its limit, * discard the last SACK block. */ if (num_saved >= MAX_SACK_BLKS) num_saved--; } if (num_saved > 0) { /* * Copy the saved SACK blocks back. */ bcopy(saved_blks, &tp->sackblks[num_head], sizeof(struct sackblk) * num_saved); } /* Save the number of SACK blocks. */ tp->rcv_numsacks = num_head + num_saved; }