nasty little bug in packet reassembly
[unix-history] / usr / src / sys / netinet / tcp_input.c
index 7da0cbc..d00ead0 100644 (file)
-/* tcp_input.c 1.14 81/10/31 */
+/*     tcp_input.c     1.71    82/06/30        */
 
 #include "../h/param.h"
 #include "../h/systm.h"
 #include "../h/mbuf.h"
 
 #include "../h/param.h"
 #include "../h/systm.h"
 #include "../h/mbuf.h"
+#include "../h/protosw.h"
 #include "../h/socket.h"
 #include "../h/socket.h"
-#include "../inet/inet.h"
-#include "../inet/inet_systm.h"
-#include "../inet/imp.h"
-#include "../inet/inet_host.h"
-#include "../inet/ip.h"
-#include "../inet/tcp.h"
-#include "../inet/tcp_fsm.h"
-
+#include "../h/socketvar.h"
+#include "../net/in.h"
+#include "../net/route.h"
+#include "../net/in_pcb.h"
+#include "../net/in_systm.h"
+#include "../net/if.h"
+#include "../net/ip.h"
+#include "../net/ip_var.h"
+#include "../net/tcp.h"
+#include "../net/tcp_fsm.h"
+#include "../net/tcp_seq.h"
+#include "../net/tcp_timer.h"
+#include "../net/tcp_var.h"
+#include "../net/tcpip.h"
+#include "../net/tcp_debug.h"
+#include <errno.h>
+
+int    tcpprintfs = 0;
 int    tcpcksum = 1;
 int    tcpcksum = 1;
-
-tcp_input(mp)
-       register struct mbuf *mp;
+struct sockaddr_in tcp_in = { AF_INET };
+struct tcpiphdr tcp_saveti;
+extern tcpnodelack;
+
+struct tcpcb *tcp_newtcpcb();
+/*
+ * TCP input routine, follows pages 65-76 of the
+ * protocol specification dated September, 1981 very closely.
+ */
+tcp_input(m0)
+       struct mbuf *m0;
 {
 {
-       register struct th *n;          /* known to be r10 */
-       register int j;                 /* known to be r9 */
-       register struct tcb *tp;
-       int nstate;
-       struct mbuf *m;
-       struct ucb *up;
-       int hlen, tlen;
-       u_short lport, fport;
-#ifdef TCPDEBUG
-       struct tcp_debug tdb;
-#endif
-COUNT(TCP_INPUT);
+       register struct tcpiphdr *ti;
+       struct inpcb *inp;
+       register struct mbuf *m;
+       struct mbuf *om = 0;
+       int len, tlen, off;
+       register struct tcpcb *tp = 0;
+       register int tiflags;
+       struct socket *so;
+       int todrop, acked;
+       short ostate;
+       struct in_addr laddr;
 
        /*
 
        /*
-        * Build extended tcp header
+        * Get IP and TCP header together in first mbuf.
+        * Note: IP leaves IP header in first mbuf.
         */
         */
-       n = (struct th *)((int)mp + mp->m_off);
-       tlen = ((struct ip *)n)->ip_len;
-       n->t_len = htons(tlen);
-       n->t_next = NULL;
-       n->t_prev = NULL;
-       n->t_x1 = 0;
-       lport = ntohs(n->t_dst);
-       fport = ntohs(n->t_src);
-
-       /* WONT BE POSSIBLE WHEN MBUFS ARE 256 BYTES */
-       if ((hlen = n->t_off << 2) > mp->m_len)
-               { printf("tcp header overflow\n"); m_freem(mp); return; }
+       m = m0;
+       ti = mtod(m, struct tcpiphdr *);
+       if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
+               ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
+       if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
+               if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
+                       tcpstat.tcps_hdrops++;
+                       return;
+               }
+               ti = mtod(m, struct tcpiphdr *);
+       }
 
 
+       /*
+        * Checksum extended TCP header and data.
+        */
+       tlen = ((struct ip *)ti)->ip_len;
+       len = sizeof (struct ip) + tlen;
        if (tcpcksum) {
        if (tcpcksum) {
-               /*
-                * Checksum extended header and data
-                */
-               j = n->t_sum; n->t_sum = 0;
-#ifdef vax
-               if (tlen == 20) {
-                       asm("addl3 $8,r10,r0; movl (r0)+,r1; addl2 (r0)+,r1");
-                       asm("adwc (r0)+,r1; adwc (r0)+,r1; adwc (r0)+,r1");
-                       asm("adwc (r0)+,r1; adwc (r0)+,r1; adwc (r0)+,r1");
-                       asm("adwc $0,r1; ashl $-16,r1,r0; addw2 r0,r1");
-                       asm("adwc $0,r1");              /* ### */
-                       asm("mcoml r1,r1; movzwl r1,r1; subl2 r1,r9");
-               } else
+               ti->ti_next = ti->ti_prev = 0;
+               ti->ti_x1 = 0;
+               ti->ti_len = (u_short)tlen;
+#if vax || pdp11
+               ti->ti_len = htons((u_short)ti->ti_len);
 #endif
 #endif
-                       j -= cksum(mp, sizeof (struct ip) + tlen);
-               if (j != 0) {
-                       netstat.t_badsum++;
-                       m_freem(mp);
-                       return;
+               if (ti->ti_sum = in_cksum(m, len)) {
+                       tcpstat.tcps_badsum++;
+                       if (tcpprintfs)
+                               printf("tcp cksum %x\n", ti->ti_sum);
+                       goto drop;
                }
        }
 
        /*
                }
        }
 
        /*
-        * Find tcb for message (SHOULDN'T USE LINEAR SEARCH!)
+        * Check that TCP offset makes sense,
+        * pull out TCP options and adjust length.
         */
         */
-       for (tp = tcb.tcb_next; tp != (struct tcb *)&tcb; tp = tp->tcb_next)
-               if (tp->t_lport == lport && tp->t_fport == fport &&
-                   tp->t_ucb->uc_host->h_addr.s_addr == n->t_s.s_addr)
-                       goto found;
-       for (tp = tcb.tcb_next; tp != (struct tcb *)&tcb; tp = tp->tcb_next)
-               if (tp->t_lport == lport &&
-                   (tp->t_fport==fport || tp->t_fport==0) &&
-                   (tp->t_ucb->uc_host->h_addr.s_addr == n->t_s.s_addr ||
-                    tp->t_ucb->uc_host->h_addr.s_addr == 0))
-                       goto found;
-       goto notwanted;
-found:
+       off = ti->ti_off << 2;
+       if (off < sizeof (struct tcphdr) || off > tlen) {
+               tcpstat.tcps_badoff++;
+               goto drop;
+       }
+       tlen -= off;
+       ti->ti_len = tlen;
+       if (off > sizeof (struct tcphdr)) {
+               if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
+                       tcpstat.tcps_hdrops++;
+                       goto drop;
+               }
+               ti = mtod(m, struct tcpiphdr *);
+               om = m_get(M_DONTWAIT);
+               if (om == 0)
+                       goto drop;
+               om->m_off = MMINOFF;
+               om->m_len = off - sizeof (struct tcphdr);
+               { caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
+                 bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
+                 m->m_len -= om->m_len;
+                 bcopy(op+om->m_len, op,
+                  (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
+               }
+       }
+       tiflags = ti->ti_flags;
+
+       /*
+        * Drop TCP and IP headers.
+        */
+       off += sizeof (struct ip);
+       m->m_off += off;
+       m->m_len -= off;
 
 
+#if vax || pdp11
        /*
        /*
-        * Byte swap header
+        * Convert TCP protocol specific fields to host format.
         */
         */
-       n->t_len = tlen - hlen;
-       n->t_src = fport;
-       n->t_dst = lport;
-       n->t_seq = ntohl(n->t_seq);
-       n->t_ackno = ntohl(n->t_ackno);
-       n->t_win = ntohs(n->t_win);
-       n->t_urp = ntohs(n->t_urp);
+       ti->ti_seq = ntohl(ti->ti_seq);
+       ti->ti_ack = ntohl(ti->ti_ack);
+       ti->ti_win = ntohs(ti->ti_win);
+       ti->ti_urp = ntohs(ti->ti_urp);
+#endif
+
+       /*
+        * Locate pcb for segment.  On match, update the local
+        * address stored in the block to reflect anchoring.
+        */
+       inp = in_pcblookup
+               (&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
+               INPLOOKUP_WILDCARD);
 
        /*
 
        /*
-        * Check segment seq # and do rst processing
+        * If the state is CLOSED (i.e., TCB does not exist) then
+        * all data in the incoming segment is discarded.
         */
         */
+       if (inp == 0)
+               goto dropwithreset;
+       tp = intotcpcb(inp);
+       if (tp == 0)
+               goto dropwithreset;
+       so = inp->inp_socket;
+       if (so->so_options & SO_DEBUG) {
+               ostate = tp->t_state;
+               tcp_saveti = *ti;
+       }
+
+       /*
+        * Segment received on connection.
+        * Reset idle time and keep-alive timer.
+        */
+       tp->t_idle = 0;
+       tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
+
+       /*
+        * Process options.
+        */
+       if (om) {
+               tcp_dooptions(tp, om);
+               om = 0;
+       }
+
+       /*
+        * Calculate amount of space in receive window,
+        * and then do TCP input processing.
+        */
+       tp->rcv_wnd = sbspace(&so->so_rcv);
+       if (tp->rcv_wnd < 0)
+               tp->rcv_wnd = 0;
+
        switch (tp->t_state) {
 
        switch (tp->t_state) {
 
-       case LISTEN:
-               if ((n->th_flags&TH_ACK) || !syn_ok(tp, n)) {
-                       tcp_sndrst(tp, n);
-                       goto badseg;
-               }
-               if (n->th_flags&TH_RST)
-                       goto badseg;
-               goto goodseg;
-
-       case SYN_SENT:
-               if (!ack_ok(tp, n) || !syn_ok(tp, n)) {
-                       tcp_sndrst(tp, n);                      /* 71,72,75 */
-                       goto badseg;
+       /*
+        * If the state is LISTEN then ignore segment if it contains an RST.
+        * If the segment contains an ACK then it is bad and send a RST.
+        * If it does not contain a SYN then it is not interesting; drop it.
+        * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
+        * tp->iss, and send a segment:
+        *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
+        * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
+        * Fill in remote peer address fields if not previously specified.
+        * Enter SYN_RECEIVED state, and process any other fields of this
+        * segment in this state.
+        */
+       case TCPS_LISTEN:
+               if (tiflags & TH_RST)
+                       goto drop;
+               if (tiflags & TH_ACK)
+                       goto dropwithreset;
+               if ((tiflags & TH_SYN) == 0)
+                       goto drop;
+               tcp_in.sin_addr = ti->ti_src;
+               tcp_in.sin_port = ti->ti_sport;
+               laddr = inp->inp_laddr;
+               if (inp->inp_laddr.s_addr == 0)
+                       inp->inp_laddr = ti->ti_dst;
+               if (in_pcbconnect(inp, (struct sockaddr_in *)&tcp_in)) {
+                       inp->inp_laddr = laddr;
+                       goto drop;
                }
                }
-               if (n->th_flags&TH_RST) {
-                       tcp_close(tp, URESET);                  /* 70 */
-                       tp->t_state = CLOSED;
-                       goto badseg;
+               tp->t_template = tcp_template(tp);
+               if (tp->t_template == 0) {
+                       in_pcbdisconnect(inp);
+                       inp->inp_laddr = laddr;
+                       tp = 0;
+                       goto drop;
                }
                }
-               goto goodseg;
-
-       default:
-               if ((n->th_flags&TH_RST) == 0)
-                       goto common;
-               if (n->t_seq < tp->rcv_nxt)             /* bad rst */
-                       goto badseg;                            /* 69 */
-               switch (tp->t_state) {
+               tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
+               tp->irs = ti->ti_seq;
+               tcp_sendseqinit(tp);
+               tcp_rcvseqinit(tp);
+               tp->t_state = TCPS_SYN_RECEIVED;
+               tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
+               goto trimthenstep6;
 
 
-               case L_SYN_RCVD:
-                       if (ack_ok(tp, n) == 0)
-                               goto badseg;                    /* 69 */
-                       tp->t_rexmt = 0;
-                       tp->t_rexmttl = 0;
-                       tp->t_persist = 0;
-                       h_free(tp->t_ucb->uc_host);
-                       tp->t_state = LISTEN;
-                       goto badseg;
+       /*
+        * If the state is SYN_SENT:
+        *      if seg contains an ACK, but not for our SYN, drop the input.
+        *      if seg contains a RST, then drop the connection.
+        *      if seg does not contain SYN, then drop it.
+        * Otherwise this is an acceptable SYN segment
+        *      initialize tp->rcv_nxt and tp->irs
+        *      if seg contains ack then advance tp->snd_una
+        *      if SYN has been acked change to ESTABLISHED else SYN_RCVD state
+        *      arrange for segment to be acked (eventually)
+        *      continue processing rest of data/controls, beginning with URG
+        */
+       case TCPS_SYN_SENT:
+               if ((tiflags & TH_ACK) &&
+/* this should be SEQ_LT; is SEQ_LEQ for BBN vax TCP only */
+                   (SEQ_LT(ti->ti_ack, tp->iss) ||
+                    SEQ_GT(ti->ti_ack, tp->snd_max)))
+                       goto dropwithreset;
+               if (tiflags & TH_RST) {
+                       if (tiflags & TH_ACK) {
+                               tcp_drop(tp, ECONNREFUSED);
+                               tp = 0;
+                       }
+                       goto drop;
+               }
+               if ((tiflags & TH_SYN) == 0)
+                       goto drop;
+               tp->snd_una = ti->ti_ack;
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
+               tp->t_timer[TCPT_REXMT] = 0;
+               tp->irs = ti->ti_seq;
+               tcp_rcvseqinit(tp);
+               tp->t_flags |= TF_ACKNOW;
+               if (SEQ_GT(tp->snd_una, tp->iss)) {
+                       if (so->so_options & SO_ACCEPTCONN)
+                               so->so_state |= SS_CONNAWAITING;
+                       soisconnected(so);
+                       tp->t_state = TCPS_ESTABLISHED;
+                       (void) tcp_reass(tp, (struct tcpiphdr *)0);
+               } else
+                       tp->t_state = TCPS_SYN_RECEIVED;
+               goto trimthenstep6;
 
 
-               default:
-                       tcp_close(tp, URESET);                  /* 66 */
-                       tp->t_state = CLOSED;
-                       goto badseg;
+trimthenstep6:
+               /*
+                * Advance ti->ti_seq to correspond to first data byte.
+                * If data, trim to stay within window,
+                * dropping FIN if necessary.
+                */
+               ti->ti_seq++;
+               if (ti->ti_len > tp->rcv_wnd) {
+                       todrop = ti->ti_len - tp->rcv_wnd;
+                       m_adj(m, -todrop);
+                       ti->ti_len = tp->rcv_wnd;
+                       ti->ti_flags &= ~TH_FIN;
                }
                }
-               /*NOTREACHED*/
+               tp->snd_wl1 = ti->ti_seq - 1;
+               goto step6;
+       }
 
 
-       case SYN_RCVD:
-common:
-               if (ack_ok(tp, n) == 0) {
-                       tcp_sndrst(tp, n);                      /* 74 */
-                       goto badseg;
+       /*
+        * States other than LISTEN or SYN_SENT.
+        * First check that at least some bytes of segment are within 
+        * receive window.
+        */
+       if (tp->rcv_wnd == 0) {
+               /*
+                * If window is closed can only take segments at
+                * window edge, and have to drop data and PUSH from
+                * incoming segments.
+                */
+               if (tp->rcv_nxt != ti->ti_seq)
+                       goto dropafterack;
+               if (ti->ti_len > 0) {
+                       m_adj(m, ti->ti_len);
+                       ti->ti_len = 0;
+                       ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
                }
-               if (syn_ok(tp, n) && n->t_seq != tp->irs) {
-                       tcp_sndnull(tp);                        /* 74 */
-                       goto badseg;
+       } else {
+               /*
+                * If segment begins before rcv_nxt, drop leading
+                * data (and SYN); if nothing left, just ack.
+                */
+               todrop = tp->rcv_nxt - ti->ti_seq;
+               if (todrop > 0) {
+                       if (tiflags & TH_SYN) {
+                               tiflags &= ~TH_SYN;
+                               ti->ti_flags &= ~TH_SYN;
+                               ti->ti_seq++;
+                               if (ti->ti_urp > 1) 
+                                       ti->ti_urp--;
+                               else
+                                       tiflags &= ~TH_URG;
+                               todrop--;
+                       }
+                       if (todrop > ti->ti_len ||
+                           todrop == ti->ti_len && (tiflags&TH_FIN) == 0)
+                               goto dropafterack;
+                       m_adj(m, todrop);
+                       ti->ti_seq += todrop;
+                       ti->ti_len -= todrop;
+                       if (ti->ti_urp > todrop)
+                               ti->ti_urp -= todrop;
+                       else {
+                               tiflags &= ~TH_URG;
+                               ti->ti_flags &= ~TH_URG;
+                               ti->ti_urp = 0;
+                       }
+               }
+               /*
+                * If segment ends after window, drop trailing data
+                * (and PUSH and FIN); if nothing left, just ACK.
+                */
+               todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
+               if (todrop > 0) {
+                       if (todrop >= ti->ti_len)
+                               goto dropafterack;
+                       m_adj(m, -todrop);
+                       ti->ti_len -= todrop;
+                       ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
                }
-               goto goodseg;
        }
        }
-badseg:
-       m_freem(mp);
-       return;
 
 
-goodseg:
-#ifdef notdef
-       /* DO SOMETHING ABOUT UNACK!!! */
        /*
        /*
-        * Defer processing if no buffer space for this connection.
+        * If a segment is received on a connection after the
+        * user processes are gone, then RST the other end.
         */
         */
-       up = tp->t_ucb;
-       if (up->uc_rcc > up->uc_rhiwat && 
-            && n->t_len != 0 && mbstat.m_bufs < mbstat.m_lowat) {
-               mp->m_act = (struct mbuf *)0;
-               if ((m = tp->t_rcv_unack) != NULL) {
-                       while (m->m_act != NULL)
-                               m = m->m_act;
-                       m->m_act = mp;
-               } else
-                       tp->t_rcv_unack = mp;
-               return;
+       if (so->so_state & SS_USERGONE) {
+               tcp_close(tp);
+               tp = 0;
+               goto dropwithreset;
        }
        }
-#endif
 
        /*
 
        /*
-        * Discard ip header, and do tcp input processing.
+        * If the RST bit is set examine the state:
+        *    SYN_RECEIVED STATE:
+        *      If passive open, return to LISTEN state.
+        *      If active open, inform user that connection was refused.
+        *    ESTABLISHED, FIN_WAIT_1, FIN_WAIT2, CLOSE_WAIT STATES:
+        *      Inform user that connection was reset, and close tcb.
+        *    CLOSING, LAST_ACK, TIME_WAIT STATES
+        *      Close the tcb.
+        */
+       if (tiflags&TH_RST) switch (tp->t_state) {
+
+       case TCPS_SYN_RECEIVED:
+               if (inp->inp_socket->so_options & SO_ACCEPTCONN) {
+                       /* a miniature tcp_close, but invisible to user */
+                       (void) m_free(dtom(tp->t_template));
+                       (void) m_free(dtom(tp));
+                       inp->inp_ppcb = 0;
+                       tp = tcp_newtcpcb(inp);
+                       tp->t_state = TCPS_LISTEN;
+                       inp->inp_faddr.s_addr = 0;
+                       inp->inp_fport = 0;
+                       inp->inp_laddr.s_addr = 0;      /* not quite right */
+                       tp = 0;
+                       goto drop;
+               }
+               tcp_drop(tp, ECONNREFUSED);
+               tp = 0;
+               goto drop;
+
+       case TCPS_ESTABLISHED:
+       case TCPS_FIN_WAIT_1:
+       case TCPS_FIN_WAIT_2:
+       case TCPS_CLOSE_WAIT:
+               tcp_drop(tp, ECONNRESET);
+               tp = 0;
+               goto drop;
+
+       case TCPS_CLOSING:
+       case TCPS_LAST_ACK:
+       case TCPS_TIME_WAIT:
+               tcp_close(tp);
+               tp = 0;
+               goto drop;
+       }
+
+       /*
+        * If a SYN is in the window, then this is an
+        * error and we send an RST and drop the connection.
+        */
+       if (tiflags & TH_SYN) {
+               tcp_drop(tp, ECONNRESET);
+               tp = 0;
+               goto dropwithreset;
+       }
+
+       /*
+        * If the ACK bit is off we drop the segment and return.
+        */
+       if ((tiflags & TH_ACK) == 0)
+               goto drop;
+       
+       /*
+        * Ack processing.
         */
         */
-       hlen += sizeof(struct ip);
-       mp->m_off += hlen;
-       mp->m_len -= hlen;
-       nstate = tp->t_state;
-       tp->tc_flags &= ~TC_NET_KEEP;
-       acounts[tp->t_state][INRECV]++;
-#ifdef TCPDEBUG
-       if ((tp->t_ucb->uc_flags & UDEBUG) || tcpconsdebug) {
-               tdb_setup(tp, n, INRECV, &tdb);
-       } else
-               tdb.td_tod = 0;
-#endif
        switch (tp->t_state) {
 
        switch (tp->t_state) {
 
-       case LISTEN:
-               if (!syn_ok(tp, n) ||
-                   ((tp->t_ucb->uc_host = h_make(&n->t_s)) == 0)) {
-                       nstate = EFAILEC;
-                       goto done;
-               }
-               tp->t_fport = n->t_src;
-               tp->t_ucb->uc_template = tcp_template(tp);
-               tcp_ctldat(tp, n, 1);
-               if (tp->tc_flags&TC_FIN_RCVD) {
-                       tp->t_finack = T_2ML;                   /* 3 */
-                       tp->tc_flags &= ~TC_WAITED_2_ML;
-                       nstate = CLOSE_WAIT;
-               } else {
-                       tp->t_init = T_INIT / 2;                /* 4 */
-                       nstate = L_SYN_RCVD;
-               }
-               goto done;
+       /*
+        * In SYN_RECEIVED state if the ack ACKs our SYN then enter
+        * ESTABLISHED state and continue processing, othewise
+        * send an RST.
+        */
+       case TCPS_SYN_RECEIVED:
+               if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
+                   SEQ_GT(ti->ti_ack, tp->snd_max))
+                       goto dropwithreset;
+               tp->snd_una++;                  /* SYN acked */
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
+               tp->t_timer[TCPT_REXMT] = 0;
+               if (so->so_options & SO_ACCEPTCONN)
+                       so->so_state |= SS_CONNAWAITING;
+               soisconnected(so);
+               tp->t_state = TCPS_ESTABLISHED;
+               (void) tcp_reass(tp, (struct tcpiphdr *)0);
+               tp->snd_wl1 = ti->ti_seq - 1;
+               /* fall into ... */
 
 
-       case SYN_SENT:
-               if (!syn_ok(tp, n)) {
-                       nstate = EFAILEC;
-                       goto done;
+       /*
+        * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
+        * ACKs.  If the ack is in the range
+        *      tp->snd_una < ti->ti_ack <= tp->snd_max
+        * then advance tp->snd_una to ti->ti_ack and drop
+        * data from the retransmission queue.  If this ACK reflects
+        * more up to date window information we update our window information.
+        */
+       case TCPS_ESTABLISHED:
+       case TCPS_FIN_WAIT_1:
+       case TCPS_FIN_WAIT_2:
+       case TCPS_CLOSE_WAIT:
+       case TCPS_CLOSING:
+       case TCPS_LAST_ACK:
+       case TCPS_TIME_WAIT:
+#define        ourfinisacked   (acked > 0)
+
+               if (SEQ_LEQ(ti->ti_ack, tp->snd_una))
+                       break;
+               if (SEQ_GT(ti->ti_ack, tp->snd_max))
+                       goto dropafterack;
+               acked = ti->ti_ack - tp->snd_una;
+
+               /*
+                * If transmit timer is running and timed sequence
+                * number was acked, update smoothed round trip time.
+                */
+               if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
+                       if (tp->t_srtt == 0)
+                               tp->t_srtt = tp->t_rtt;
+                       else
+                               tp->t_srtt =
+                                   tcp_alpha * tp->t_srtt +
+                                   (1 - tcp_alpha) * tp->t_rtt;
+/* printf("rtt %d srtt*100 now %d\n", tp->t_rtt, (int)(tp->t_srtt*100)); */
+                       tp->t_rtt = 0;
                }
                }
-               tcp_ctldat(tp, n, 1);
-               if (tp->tc_flags&TC_FIN_RCVD) {
-                       if ((n->th_flags&TH_ACK) == 0) {
-                               tp->t_finack = T_2ML;           /* 9 */
-                               tp->tc_flags &= ~TC_WAITED_2_ML;
-                       }
-                       nstate = CLOSE_WAIT;
-                       goto done;
+
+               if (ti->ti_ack == tp->snd_max)
+                       tp->t_timer[TCPT_REXMT] = 0;
+               else {
+                       TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
+                           tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
+                       tp->t_rtt = 1;
+                       tp->t_rxtshift = 0;
                }
                }
-               nstate = (n->th_flags&TH_ACK) ? ESTAB : SYN_RCVD; /* 11:8 */
-               goto done;
-
-       case SYN_RCVD:
-       case L_SYN_RCVD:
-               if ((n->th_flags&TH_ACK) == 0 ||
-                   (n->th_flags&TH_ACK) && n->t_ackno <= tp->iss) {
-                       nstate = EFAILEC;
-                       goto done;
+               if (acked > so->so_snd.sb_cc) {
+                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
+                       tp->snd_wnd -= so->so_snd.sb_cc;
+               } else {
+                       sbdrop(&so->so_snd, acked);
+                       tp->snd_wnd -= acked;
+                       acked = 0;
                }
                }
-               goto input;
-
-       case ESTAB:
-       case FIN_W1:
-       case FIN_W2:
-       case TIME_WAIT:
-input:
-               tcp_ctldat(tp, n, 1);                           /* 39 */
-               switch (tp->t_state) {
+               if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
+                       sowwakeup(so);
+               tp->snd_una = ti->ti_ack;
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
 
 
-               case ESTAB:
-                       if (tp->tc_flags&TC_FIN_RCVD)
-                               nstate = CLOSE_WAIT;
-                       break;
+               switch (tp->t_state) {
 
 
-               case SYN_RCVD:
-               case L_SYN_RCVD:
-                       nstate = (tp->tc_flags&TC_FIN_RCVD) ?
-                           CLOSE_WAIT : ESTAB;                  /* 33:5 */
+               /*
+                * In FIN_WAIT_1 STATE in addition to the processing
+                * for the ESTABLISHED state if our FIN is now acknowledged
+                * then enter FIN_WAIT_2.
+                */
+               case TCPS_FIN_WAIT_1:
+                       if (ourfinisacked) {
+                               /*
+                                * If we can't receive any more
+                                * data, then closing user can proceed.
+                                */
+                               if (so->so_state & SS_CANTRCVMORE)
+                                       soisdisconnected(so);
+                               tp->t_state = TCPS_FIN_WAIT_2;
+                       }
                        break;
 
                        break;
 
-               case FIN_W1:
-                       j = ack_fin(tp, n);
-                       if ((tp->tc_flags & TC_FIN_RCVD) == 0) {
-                               if (j)
-                                       nstate = FIN_W2;        /* 27 */
-                               break;
+               /*
+                * In CLOSING STATE in addition to the processing for
+                * the ESTABLISHED state if the ACK acknowledges our FIN
+                * then enter the TIME-WAIT state, otherwise ignore
+                * the segment.
+                */
+               case TCPS_CLOSING:
+                       if (ourfinisacked) {
+                               tp->t_state = TCPS_TIME_WAIT;
+                               tcp_canceltimers(tp);
+                               tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                               soisdisconnected(so);
                        }
                        }
-                       tp->t_finack = T_2ML;
-                       tp->tc_flags &= ~TC_WAITED_2_ML;
-                       nstate = j ? TIME_WAIT : CLOSING1;      /* 28:26 */
                        break;
 
                        break;
 
-               case FIN_W2:
-                       if (tp->tc_flags&TC_FIN_RCVD) {
-                               tp->t_finack = T_2ML;           /* 29 */
-                               tp->tc_flags &= ~TC_WAITED_2_ML;
-                               nstate = TIME_WAIT;
-                               break;
+               /*
+                * The only thing that can arrive in  LAST_ACK state
+                * is an acknowledgment of our FIN.  If our FIN is now
+                * acknowledged, delete the TCB, enter the closed state
+                * and return.
+                */
+               case TCPS_LAST_ACK:
+                       if (ourfinisacked) {
+                               tcp_close(tp);
+                               tp = 0;
                        }
                        }
-                       break;
-               }
-               goto done;
-
-       case CLOSE_WAIT:
-               if (n->th_flags&TH_FIN) {
-                       if ((n->th_flags&TH_ACK) &&
-                           n->t_ackno <= tp->seq_fin) {
-                               tcp_ctldat(tp, n, 0);           /* 30 */
-                               tp->t_finack = T_2ML;
-                               tp->tc_flags &= ~TC_WAITED_2_ML;
-                       } else
-                               tcp_sndctl(tp);                 /* 31 */
-                       goto done;
-               }
-               goto input;
-
-       case CLOSING1:
-               j = ack_fin(tp, n);
-               if (n->th_flags&TH_FIN) {
-                       tcp_ctldat(tp, n, 0);
-                       tp->t_finack = T_2ML;
-                       tp->tc_flags &= ~TC_WAITED_2_ML;
-                       if (j)
-                               nstate = TIME_WAIT;             /* 23 */
-                       goto done;
-               }
-               if (j) {
-                       if (tp->tc_flags&TC_WAITED_2_ML)
-                               if (rcv_empty(tp)) {
-                                       tcp_close(tp, UCLOSED); /* 15 */
-                                       nstate = CLOSED;
-                               } else
-                                       nstate = RCV_WAIT;      /* 18 */
-                       else
-                               nstate = TIME_WAIT;
-                       goto done;
-               }
-               goto input;
-
-       case CLOSING2:
-               if (ack_fin(tp, n)) {
-                       if (rcv_empty(tp)) {                    /* 16 */
-                               tcp_close(tp, UCLOSED);
-                               nstate = CLOSED;
-                       } else
-                               nstate = RCV_WAIT;              /* 19 */
-                       goto done;
+                       goto drop;
+
+               /*
+                * In TIME_WAIT state the only thing that should arrive
+                * is a retransmission of the remote FIN.  Acknowledge
+                * it and restart the finack timer.
+                */
+               case TCPS_TIME_WAIT:
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                       goto dropafterack;
                }
                }
-               if (n->th_flags&TH_FIN) {
-                       tcp_sndctl(tp);                         /* 31 */
-                       goto done;
+#undef ourfinisacked
+       }
+
+step6:
+       /*
+        * Update window information.
+        */
+       if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
+           (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
+            tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
+               tp->snd_wnd = ti->ti_win;
+               tp->snd_wl1 = ti->ti_seq;
+               tp->snd_wl2 = ti->ti_ack;
+               if (tp->snd_wnd > 0)
+                       tp->t_timer[TCPT_PERSIST] = 0;
+       }
+
+       /*
+        * Process segments with URG.
+        */
+       if ((tiflags & TH_URG) && ti->ti_urp &&
+           TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+               /*
+                * If this segment advances the known urgent pointer,
+                * then mark the data stream.  This should not happen
+                * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
+                * a FIN has been received from the remote side. 
+                * In these states we ignore the URG.
+                */
+               if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
+                       tp->rcv_up = ti->ti_seq + ti->ti_urp;
+                       so->so_oobmark = so->so_rcv.sb_cc +
+                           (tp->rcv_up - tp->rcv_nxt) - 1;
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+#ifdef TCPTRUEOOB
+                       if ((tp->t_flags & TF_DOOOB) == 0)
+#endif
+                               sohasoutofband(so);
+                       tp->t_oobflags &= ~TCPOOB_HAVEDATA;
                }
                }
-               goto input;
-
-       case RCV_WAIT:
-               if ((n->th_flags&TH_FIN) && (n->th_flags&TH_ACK) &&
-                   n->t_ackno <= tp->seq_fin) {
-                       tcp_ctldat(tp, n, 0);
-                       tp->t_finack = T_2ML;
-                       tp->tc_flags &= ~TC_WAITED_2_ML;        /* 30 */
+               /*
+                * Remove out of band data so doesn't get presented to user.
+                * This can happen independent of advancing the URG pointer,
+                * but if two URG's are pending at once, some out-of-band
+                * data may creep in... ick.
+                */
+               if (ti->ti_urp <= ti->ti_len) {
+                       tcp_pulloutofband(so, ti);
                }
                }
-               goto done;
        }
        }
-       panic("tcp_input");
-done:
 
        /*
 
        /*
-        * Done with state*input specific processing.
-        * Form trace records, free input if not needed,
-        * and enter new state.
+        * Process the segment text, merging it into the TCP sequencing queue,
+        * and arranging for acknowledgment of receipt if necessary.
+        * This process logically involves adjusting tp->rcv_wnd as data
+        * is presented to the user (this happens in tcp_usrreq.c,
+        * case PRU_RCVD).  If a FIN has already been received on this
+        * connection then we just ignore the text.
         */
         */
-#ifdef TCPDEBUG
-       if (tdb.td_tod)
-               tdb_stuff(&tdb, nstate);
-#endif
-       switch (nstate) {
+       if ((ti->ti_len || (tiflags&TH_FIN)) &&
+           TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+               tiflags = tcp_reass(tp, ti);
+               if (tcpnodelack == 0)
+                       tp->t_flags |= TF_DELACK;
+               else
+                       tp->t_flags |= TF_ACKNOW;
+       } else {
+               m_freem(m);
+               tiflags &= ~TH_FIN;
+       }
 
 
-       case EFAILEC:
-               m_freem(mp);
-               return;
+       /*
+        * If FIN is received ACK the FIN and let the user know
+        * that the connection is closing.
+        */
+       if (tiflags & TH_FIN) {
+               if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+                       socantrcvmore(so);
+                       tp->t_flags |= TF_ACKNOW;
+                       tp->rcv_nxt++;
+               }
+               switch (tp->t_state) {
 
 
-       default:
-               tp->t_state = nstate;
-               /* fall into ... */
+               /*
+                * In SYN_RECEIVED and ESTABLISHED STATES
+                * enter the CLOSE_WAIT state.
+                */
+               case TCPS_SYN_RECEIVED:
+               case TCPS_ESTABLISHED:
+                       tp->t_state = TCPS_CLOSE_WAIT;
+                       break;
 
 
-       case CLOSED:
-               /* IF CLOSED CANT LOOK AT tc_flags */
-               if ((tp->tc_flags&TC_NET_KEEP) == 0)
-                       /* inline expansion of m_freem */
-                       while (mp) {
-                               MFREE(mp, m);
-                               mp = m;
-                       }
-               return;
+               /*
+                * If still in FIN_WAIT_1 STATE FIN has not been acked so
+                * enter the CLOSING state.
+                */
+               case TCPS_FIN_WAIT_1:
+                       tp->t_state = TCPS_CLOSING;
+                       break;
+
+               /*
+                * In FIN_WAIT_2 state enter the TIME_WAIT state,
+                * starting the time-wait timer, turning off the other 
+                * standard timers.
+                */
+               case TCPS_FIN_WAIT_2:
+                       tp->t_state = TCPS_TIME_WAIT;
+                       tcp_canceltimers(tp);
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                       soisdisconnected(so);
+                       break;
+
+               /*
+                * In TIME_WAIT state restart the 2 MSL time_wait timer.
+                */
+               case TCPS_TIME_WAIT:
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                       break;
+               }
        }
        }
-       /* NOTREACHED */
+       if (so->so_options & SO_DEBUG)
+               tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
+
+       /*
+        * Return any desired output.
+        */
+       (void) tcp_output(tp);
+       return;
+
+dropafterack:
+       /*
+        * Generate an ACK dropping incoming segment if it occupies
+        * sequence space, where the ACK reflects our state.
+        */
+       if ((tiflags&TH_RST) ||
+           tlen == 0 && (tiflags&(TH_SYN|TH_FIN)) == 0)
+               goto drop;
+       if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
+               tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
+       tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+       return;
 
 
+dropwithreset:
+       if (om)
+               (void) m_free(om);
        /*
        /*
-        * Unwanted packed; free everything
-        * but the header and return an rst.
+        * Generate a RST, dropping incoming segment.
+        * Make ACK acceptable to originator of segment.
         */
         */
-notwanted:
-       m_freem(mp->m_next);
-       mp->m_next = NULL;
-       mp->m_len = sizeof(struct th);
-#define xchg(a,b) j=a; a=b; b=j
-       xchg(n->t_d.s_addr, n->t_s.s_addr); xchg(n->t_dst, n->t_src);
-#undef xchg
-       if (n->th_flags&TH_ACK)
-               n->t_seq = n->t_ackno;
+       if (tiflags & TH_RST)
+               goto drop;
+       if (tiflags & TH_ACK)
+               tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
        else {
        else {
-               n->t_ackno = htonl(ntohl(n->t_seq) + tlen - hlen);
-               n->t_seq = 0;
+               if (tiflags & TH_SYN)
+                       ti->ti_len++;
+               tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
+                   TH_RST|TH_ACK);
        }
        }
-       n->th_flags = TH_RST; /* not TH_FIN, TH_SYN */
-       n->th_flags ^= TH_ACK;
-       n->t_len = htons(TCPSIZE);
-       n->t_off = 5;
-       n->t_sum = cksum(mp, sizeof(struct th));
-       ((struct ip *)n)->ip_len = sizeof(struct th);
-       ip_output(mp);
-       netstat.t_badsegs++;
+       return;
+
+drop:
+       /*
+        * Drop space held by incoming segment and return.
+        */
+       if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
+               tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
+       m_freem(m);
+       return;
 }
 
 }
 
-tcp_ctldat(tp, n, dataok)
-       register struct tcb *tp;
-       register struct th *n;
+tcp_dooptions(tp, om)
+       struct tcpcb *tp;
+       struct mbuf *om;
 {
 {
-       register struct mbuf *m;
-       int sent;
-COUNT(TCP_CTLDAT);
-
-       tp->tc_flags &= ~(TC_DROPPED_TXT|TC_ACK_DUE|TC_NEW_WINDOW);
-/* syn */
-       if ((tp->tc_flags&TC_SYN_RCVD) == 0 && (n->th_flags&TH_SYN)) {
-               tp->irs = n->t_seq;
-               tp->rcv_nxt = n->t_seq + 1;
-               tp->snd_wl = tp->rcv_urp = tp->irs;
-               tp->tc_flags |= (TC_SYN_RCVD|TC_ACK_DUE);
-       }
-/* ack */
-       if ((n->th_flags&TH_ACK) && (tp->tc_flags&TC_SYN_RCVD) &&
-           n->t_ackno > tp->snd_una) {
-               register struct mbuf *mn;
-               register struct ucb *up;
-               int len;
-
-               up = tp->t_ucb;
-
-               /* update snd_una and snd_nxt */
-               tp->snd_una = n->t_ackno;
-               if (tp->snd_una > tp->snd_nxt)
-                       tp->snd_nxt = tp->snd_una;
-               /* if timed msg acked, set retrans time value */
-               if ((tp->tc_flags&TC_SYN_ACKED) &&
-                   tp->snd_una > tp->t_xmt_val) {
-                       tp->t_xmtime = (tp->t_xmt != 0 ? tp->t_xmt : T_REXMT);
-                       if (tp->t_xmtime > T_REMAX)
-                               tp->t_xmtime = T_REMAX;
+       register u_char *cp;
+       int opt, optlen, cnt;
+
+       cp = mtod(om, u_char *);
+       cnt = om->m_len;
+       for (; cnt > 0; cnt -= optlen, cp += optlen) {
+               opt = cp[0];
+               if (opt == TCPOPT_EOL)
+                       break;
+               if (opt == TCPOPT_NOP)
+                       optlen = 1;
+               else
+                       optlen = cp[1];
+               switch (opt) {
+
+               default:
+                       break;
+
+               case TCPOPT_MAXSEG:
+                       if (optlen != 4)
+                               continue;
+                       tp->t_maxseg = *(u_short *)(cp + 2);
+#if vax || pdp11
+                       tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
+#endif
+                       break;
+                       
+#ifdef TCPTRUEOOB
+               case TCPOPT_WILLOOB:
+                       tp->t_flags |= TF_DOOOB;
+printf("tp %x dooob\n", tp);
+                       break;
+
+               case TCPOPT_OOBDATA: {
+                       int seq;
+                       register struct socket *so = tp->t_inpcb->inp_socket;
+                       tcp_seq mark;
+
+                       if (optlen != 8)
+                               continue;
+                       seq = cp[2];
+                       if (seq < tp->t_iobseq)
+                               seq += 256;
+printf("oobdata cp[2] %d iobseq %d seq %d\n", cp[2], tp->t_iobseq, seq);
+                       if (seq - tp->t_iobseq > 128) {
+printf("bad seq\n");
+                               tp->t_oobflags |= TCPOOB_OWEACK;
+                               break;
+                       }
+                       tp->t_iobseq = cp[2];
+                       tp->t_iobc = cp[3];
+                       mark = *(tcp_seq *)(cp + 4);
+#if vax || pdp11
+                       mark = ntohl(mark);
+#endif
+                       so->so_oobmark = so->so_rcv.sb_cc + (mark-tp->rcv_nxt);
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+printf("take oob data %x input iobseq now %x\n", tp->t_iobc, tp->t_iobseq);
+                       sohasoutofband(so);
+                       break;
                }
 
                }
 
-               /* remove acked data from send buf */
-               len = tp->snd_una - tp->snd_off;
-               m = up->uc_sbuf;
-               while (len > 0 && m != NULL)
-                       if (m->m_len <= len) {
-                               len -= m->m_len;
-                               if (m->m_off > MMAXOFF)
-                                       up->uc_ssize -= NMBPG;
-                               MFREE(m, mn);
-                               m = mn;
-                               up->uc_ssize--;
-                       } else {
-                               m->m_len -= len;
-                               m->m_off += len;
+               case TCPOPT_OOBACK: {
+                       int seq;
+
+                       if (optlen != 4)
+                               continue;
+                       if (tp->t_oobseq != cp[2]) {
+printf("wrong ack\n");
                                break;
                        }
                                break;
                        }
-               up->uc_sbuf = m;
-               tp->snd_off = tp->snd_una;
-               if ((tp->tc_flags&TC_SYN_ACKED) == 0 &&
-                   (tp->snd_una > tp->iss)) {
-                       tp->tc_flags |= TC_SYN_ACKED;
-                       tp->t_init = 0;
+printf("take oob ack %x and cancel rexmt\n", cp[2]);
+                       tp->t_oobflags &= ~TCPOOB_NEEDACK;
+                       tp->t_timer[TCPT_OOBREXMT] = 0;
+                       break;
+               }
+#endif TCPTRUEOOB
                }
                }
-               if (tp->seq_fin != tp->iss && tp->snd_una > tp->seq_fin)
-                       tp->tc_flags &= ~TC_SND_FIN;
-               tp->t_rexmt = 0;
-               tp->t_rexmttl = 0;
-               tp->tc_flags |= TC_CANCELLED;
-               netwakeup(tp->t_ucb);           /* wasteful */
-       }
-/* win */
-       if ((tp->tc_flags & TC_SYN_RCVD) && n->t_seq >= tp->snd_wl) {
-               tp->snd_wl = n->t_seq;
-               tp->snd_wnd = n->t_win;
-               tp->tc_flags |= TC_NEW_WINDOW;
-               tp->t_persist = 0;
        }
        }
-       if (dataok == 0)
-               goto ctlonly;
-/* text */
-       if (n->t_len == 0)
-               goto notext;
-       { register int i;
-         register struct th *p, *q;
-         register struct mbuf *m;
-         int overage;
-
-       /*
-        * Discard duplicate data already passed to user.
-        */
-       if (SEQ_LT(n->t_seq, tp->rcv_nxt)) {
-               i = tp->rcv_nxt - n->t_seq;
-               if (i >= n->t_len)
-                       goto notext;
-               n->t_seq += i;
-               n->t_len -= i;
-               m_adj(dtom(n), i);
+       (void) m_free(om);
+}
+
+/*
+ * Pull out of band byte out of a segment so
+ * it doesn't appear in the user's data queue.
+ * It is still reflected in the segment length for
+ * sequencing purposes.
+ */
+tcp_pulloutofband(so, ti)
+       struct socket *so;
+       struct tcpiphdr *ti;
+{
+       register struct mbuf *m;
+       int cnt = ti->ti_urp - 1;
+       
+       m = dtom(ti);
+       while (cnt >= 0) {
+               if (m->m_len > cnt) {
+                       char *cp = mtod(m, caddr_t) + cnt;
+                       struct tcpcb *tp = sototcpcb(so);
+
+                       tp->t_iobc = *cp;
+                       tp->t_oobflags |= TCPOOB_HAVEDATA;
+                       bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
+                       m->m_len--;
+                       return;
+               }
+               cnt -= m->m_len;
+               m = m->m_next;
+               if (m == 0)
+                       break;
        }
        }
+       panic("tcp_pulloutofband");
+}
+
+/*
+ * Insert segment ti into reassembly queue of tcp with
+ * control block tp.  Return TH_FIN if reassembly now includes
+ * a segment with FIN.
+ */
+tcp_reass(tp, ti)
+       register struct tcpcb *tp;
+       register struct tcpiphdr *ti;
+{
+       register struct tcpiphdr *q;
+       struct socket *so = tp->t_inpcb->inp_socket;
+       struct mbuf *m;
+       int flags;
+
+       /*
+        * Call with ti==0 after become established to
+        * force pre-ESTABLISHED data up to user socket.
+        */
+       if (ti == 0)
+               goto present;
 
        /*
         * Find a segment which begins after this one does.
         */
 
        /*
         * Find a segment which begins after this one does.
         */
-       for (q = tp->t_rcv_next; q != (struct th *)tp; q = q->t_next)
-               if (SEQ_GT(q->t_seq, n->t_seq))
+       for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
+           q = (struct tcpiphdr *)q->ti_next)
+               if (SEQ_GT(q->ti_seq, ti->ti_seq))
                        break;
 
        /*
                        break;
 
        /*
@@ -515,183 +887,72 @@ COUNT(TCP_CTLDAT);
         * our data already.  If so, drop the data from the incoming
         * segment.  If it provides all of our data, drop us.
         */
         * our data already.  If so, drop the data from the incoming
         * segment.  If it provides all of our data, drop us.
         */
-       if (q->t_prev != (struct th *)tp) {
+       if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
+               register int i;
+               q = (struct tcpiphdr *)q->ti_prev;
                /* conversion to int (in i) handles seq wraparound */
                /* conversion to int (in i) handles seq wraparound */
-               i = q->t_prev->t_seq + q->t_prev->t_len - n->t_seq;
+               i = q->ti_seq + q->ti_len - ti->ti_seq;
                if (i > 0) {
                if (i > 0) {
-                       if (i >= n->t_len)
-                               goto notext;    /* w/o setting TC_NET_KEEP */
-                       m_adj(dtom(tp), i);
-                       n->t_len -= i;
-                       n->t_seq += i;
+                       if (i >= ti->ti_len)
+                               goto drop;
+                       m_adj(dtom(ti), i);
+                       ti->ti_len -= i;
+                       ti->ti_seq += i;
                }
                }
+               q = (struct tcpiphdr *)(q->ti_next);
        }
 
        /*
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
        }
 
        /*
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
-       while (q != (struct th *)tp && SEQ_GT(n->t_seq + n->t_len, q->t_seq)) {
-               i = (n->t_seq + n->t_len) - q->t_seq;
-               if (i < q->t_len) {
-                       q->t_len -= i;
+       while (q != (struct tcpiphdr *)tp) {
+               register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
+               if (i <= 0)
+                       break;
+               if (i < q->ti_len) {
+                       q->ti_seq += i;
+                       q->ti_len -= i;
                        m_adj(dtom(q), i);
                        break;
                }
                        m_adj(dtom(q), i);
                        break;
                }
-               q = q->t_next;
-               m_freem(dtom(q->t_prev));
-               remque(q->t_prev);
+               q = (struct tcpiphdr *)q->ti_next;
+               m = dtom(q->ti_prev);
+               remque(q->ti_prev);
+               m_freem(m);
        }
 
        /*
         * Stick new segment in its place.
         */
        }
 
        /*
         * Stick new segment in its place.
         */
-       insque(n, q->t_prev);
-       tp->seqcnt += n->t_len;
-
-#ifdef notdef
-       /*
-        * Calculate available space and discard segments for
-        * which there is too much.
-        */
-       q = tp->t_rcv_prev;
-       overage = 
-           (tp->t_ucb->uc_rcc + tp->rcv_seqcnt) - tp->t_ucb->uc_rhiwat;
-       if (overage > 0)
-               for (;;) {
-                       i = MIN(q->t_len, overage);
-                       overage -= i;
-                       q->t_len -= i;
-                       m_adj(q, -i);
-                       if (q == n)
-                               tp->tc_flags |= TC_DROPPED_TXT;
-                       if (q->t_len)
-                               break;
-                       if (q == n)
-                               panic("tcp_text dropall");
-                       q = q->t_prev;
-                       remque(q->t_next);
-               }
-#endif
+       insque(ti, q->ti_prev);
 
 
+present:
        /*
        /*
-        * Advance rcv_next through
-        * newly completed sequence space
-        * and return forcing an ack.
+        * Present data to user, advancing rcv_nxt through
+        * completed sequence space.
         */
         */
-       while (n->t_seq == tp->rcv_nxt) {
-               /* present data belongs here */
-               tp->rcv_nxt += n->t_len;
-               n = n->t_next;
-               if (n == (struct th *)tp)
-                       break;
-       }
-       tp->tc_flags |= (TC_ACK_DUE|TC_NET_KEEP);
-       }
-notext:
-urgeolfin:
-/* urg */
-       if (n->th_flags&TH_URG) {
-               unsigned urgent;
-
-               urgent = n->t_urp + n->t_seq;
-               if (tp->rcv_nxt < urgent) {
-                       if (tp->rcv_urp <= tp->rcv_nxt)
-                               to_user(tp->t_ucb, UURGENT);
-                       tp->rcv_urp = urgent;
-               }
-       }
-/* eol */
-       if ((n->th_flags&TH_EOL) &&
-           (tp->tc_flags&TC_DROPPED_TXT) == 0 &&
-           tp->t_rcv_prev != (struct th *)tp) {
-               /* mark last mbuf */
-               m = dtom(tp->t_rcv_prev);
-               if (m != NULL) {
-                       while (m->m_next != NULL)
-                               m = m->m_next;
-                       m->m_act =
-                           (struct mbuf *)(m->m_off + m->m_len - 1);
-               }
-       }
-ctlonly:
-/* fin */
-       if ((n->th_flags&TH_FIN) && (tp->tc_flags&TC_DROPPED_TXT) == 0) {
-               seq_t last;
-
-               if ((tp->tc_flags&TC_FIN_RCVD) == 0) {
-                       /* do we really have fin ? */
-                       last = firstempty(tp);
-                       if (tp->t_rcv_prev == (struct th *)tp ||
-                           last == t_end(tp->t_rcv_prev)) {
-                               tp->tc_flags |= TC_FIN_RCVD;
-                               netwakeup(tp->t_ucb);           /* poke */
-                       }
-                       if ((tp->tc_flags&TC_FIN_RCVD) &&
-                           tp->rcv_nxt >= last) {
-                               tp->rcv_nxt = last + 1;         /* fin seq */
-                               tp->tc_flags |= TC_ACK_DUE;
-                       }
-               } else
-                       tp->tc_flags |= TC_ACK_DUE;
-       }
-
-/* respond */
-       sent = 0;
-       if (tp->tc_flags&TC_ACK_DUE)
-               sent = tcp_sndctl(tp);
-       else if (tp->tc_flags&TC_NEW_WINDOW) {
-               seq_t last = tp->snd_off;
-               for (m = tp->t_ucb->uc_sbuf; m != NULL; m = m->m_next)  /*###*/
-                       last += m->m_len;                               /*###*/
-               if (tp->snd_nxt <= last || (tp->tc_flags&TC_SND_FIN))
-                       sent = tcp_send(tp);
-       }
-
-/* set for retrans */
-       if (!sent && tp->snd_una < tp->snd_nxt &&
-           (tp->tc_flags&TC_CANCELLED)) {
-               tp->t_rexmt = tp->t_xmtime;
-               tp->t_rexmttl = T_REXMTTL;
-               tp->t_rexmt_val = tp->t_rtl_val = tp->snd_lst;
-               tp->tc_flags &= ~TC_CANCELLED;
-       }
-/* present data to user */
-       { register struct mbuf **mp;
-         register struct ucb *up = tp->t_ucb;
-         seq_t ready;
-
-       /* connection must be synced and data available for user */
-       if ((tp->tc_flags&TC_SYN_ACKED) == 0)
-               return;
-       up = tp->t_ucb;
-       mp = &up->uc_rbuf;
-       while (*mp)
-               mp = &(*mp)->m_next;
-       n = tp->t_rcv_next;
-       /* SHOULD PACK DATA IN HERE */
-       while (n != (struct th *)tp && n->t_seq < tp->rcv_nxt) {
-               remque(n);
-               m = dtom(n);
-               up->uc_rcc += n->t_len;
-               tp->seqcnt -= n->t_len;
-               if (tp->seqcnt < 0) panic("present_data");
-               n = n->t_next;
-               while (m) {
-                       if (m->m_len == 0) {
-                               m = m_free(m);
-                               continue;
-                       }
-                       *mp = m;
-                       mp = &m->m_next;
-                       m = *mp;
-               }
-       }
-       if (up->uc_rcc != 0)
-               netwakeup(up);
-       if ((tp->tc_flags&TC_FIN_RCVD) &&                       /* ### */
-           (tp->tc_flags&TC_USR_CLOSED) == 0 &&                /* ### */
-           rcv_empty(tp))                                      /* ### */
-               to_user(up, UCLOSED);                           /* ### */
-       }
+       if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
+               return (0);
+       ti = tp->seg_next;
+       if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
+               return (0);
+       if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
+               return (0);
+       do {
+               tp->rcv_nxt += ti->ti_len;
+               flags = ti->ti_flags & TH_FIN;
+               remque(ti);
+               m = dtom(ti);
+               ti = (struct tcpiphdr *)ti->ti_next;
+               if (so->so_state & SS_CANTRCVMORE)
+                       m_freem(m);
+               else
+                       sbappend(&so->so_rcv, m);
+       } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
+       sorwakeup(so);
+       return (flags);
+drop:
+       m_freem(dtom(ti));
+       return (0);
 }
 }