don't respond to broadcasts
[unix-history] / usr / src / sys / netinet / tcp_input.c
index cf96e45..2e01026 100644 (file)
-/*     tcp_input.c     1.60    82/03/13        */
-
-#include "../h/param.h"
-#include "../h/systm.h"
-#include "../h/mbuf.h"
-#include "../h/protosw.h"
-#include "../h/socket.h"
-#include "../h/socketvar.h"
-#include "../net/in.h"
-#include "../net/in_pcb.h"
-#include "../net/in_systm.h"
+/*
+ * Copyright (c) 1982 Regents of the University of California.
+ * All rights reserved.  The Berkeley software License Agreement
+ * specifies the terms and conditions for redistribution.
+ *
+ *     @(#)tcp_input.c 6.15 (Berkeley) %G%
+ */
+
+#include "param.h"
+#include "systm.h"
+#include "mbuf.h"
+#include "protosw.h"
+#include "socket.h"
+#include "socketvar.h"
+#include "errno.h"
+
 #include "../net/if.h"
 #include "../net/if.h"
-#include "../net/ip.h"
-#include "../net/ip_var.h"
-#include "../net/tcp.h"
-#include "../net/tcp_fsm.h"
-#include "../net/tcp_seq.h"
-#include "../net/tcp_timer.h"
-#include "../net/tcp_var.h"
-#include "../net/tcpip.h"
-#include "../net/tcp_debug.h"
-#include "../errno.h"
-
-#ifdef notdef
+#include "../net/route.h"
+
+#include "in.h"
+#include "in_pcb.h"
+#include "in_systm.h"
+#include "ip.h"
+#include "ip_var.h"
+#include "tcp.h"
+#include "tcp_fsm.h"
+#include "tcp_seq.h"
+#include "tcp_timer.h"
+#include "tcp_var.h"
+#include "tcpip.h"
+#include "tcp_debug.h"
+
 int    tcpprintfs = 0;
 int    tcpprintfs = 0;
-#endif
 int    tcpcksum = 1;
 int    tcpcksum = 1;
-struct sockaddr_in tcp_in = { AF_INET };
 struct tcpiphdr tcp_saveti;
 extern tcpnodelack;
 
 struct tcpcb *tcp_newtcpcb();
 struct tcpiphdr tcp_saveti;
 extern tcpnodelack;
 
 struct tcpcb *tcp_newtcpcb();
+
+/*
+ * Insert segment ti into reassembly queue of tcp with
+ * control block tp.  Return TH_FIN if reassembly now includes
+ * a segment with FIN.  The macro form does the common case inline
+ * (segment is the next to be received on an established connection,
+ * and the queue is empty), avoiding linkage into and removal
+ * from the queue and repetition of various conversions.
+ */
+#define        TCP_REASS(tp, ti, m, so, flags) { \
+       if ((ti)->ti_seq == (tp)->rcv_nxt && \
+           (tp)->seg_next == (struct tcpiphdr *)(tp) && \
+           (tp)->t_state == TCPS_ESTABLISHED) { \
+               (tp)->rcv_nxt += (ti)->ti_len; \
+               flags = (ti)->ti_flags & TH_FIN; \
+               sbappend(&(so)->so_rcv, (m)); \
+               sorwakeup(so); \
+       } else \
+               (flags) = tcp_reass((tp), (ti)); \
+}
+
+tcp_reass(tp, ti)
+       register struct tcpcb *tp;
+       register struct tcpiphdr *ti;
+{
+       register struct tcpiphdr *q;
+       struct socket *so = tp->t_inpcb->inp_socket;
+       struct mbuf *m;
+       int flags;
+
+       /*
+        * Call with ti==0 after become established to
+        * force pre-ESTABLISHED data up to user socket.
+        */
+       if (ti == 0)
+               goto present;
+
+       /*
+        * Find a segment which begins after this one does.
+        */
+       for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
+           q = (struct tcpiphdr *)q->ti_next)
+               if (SEQ_GT(q->ti_seq, ti->ti_seq))
+                       break;
+
+       /*
+        * If there is a preceding segment, it may provide some of
+        * our data already.  If so, drop the data from the incoming
+        * segment.  If it provides all of our data, drop us.
+        */
+       if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
+               register int i;
+               q = (struct tcpiphdr *)q->ti_prev;
+               /* conversion to int (in i) handles seq wraparound */
+               i = q->ti_seq + q->ti_len - ti->ti_seq;
+               if (i > 0) {
+                       if (i >= ti->ti_len)
+                               goto drop;
+                       m_adj(dtom(ti), i);
+                       ti->ti_len -= i;
+                       ti->ti_seq += i;
+               }
+               q = (struct tcpiphdr *)(q->ti_next);
+       }
+
+       /*
+        * While we overlap succeeding segments trim them or,
+        * if they are completely covered, dequeue them.
+        */
+       while (q != (struct tcpiphdr *)tp) {
+               register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
+               if (i <= 0)
+                       break;
+               if (i < q->ti_len) {
+                       q->ti_seq += i;
+                       q->ti_len -= i;
+                       m_adj(dtom(q), i);
+                       break;
+               }
+               q = (struct tcpiphdr *)q->ti_next;
+               m = dtom(q->ti_prev);
+               remque(q->ti_prev);
+               m_freem(m);
+       }
+
+       /*
+        * Stick new segment in its place.
+        */
+       insque(ti, q->ti_prev);
+
+present:
+       /*
+        * Present data to user, advancing rcv_nxt through
+        * completed sequence space.
+        */
+       if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
+               return (0);
+       ti = tp->seg_next;
+       if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
+               return (0);
+       if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
+               return (0);
+       do {
+               tp->rcv_nxt += ti->ti_len;
+               flags = ti->ti_flags & TH_FIN;
+               remque(ti);
+               m = dtom(ti);
+               ti = (struct tcpiphdr *)ti->ti_next;
+               if (so->so_state & SS_CANTRCVMORE)
+                       m_freem(m);
+               else
+                       sbappend(&so->so_rcv, m);
+       } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
+       sorwakeup(so);
+       return (flags);
+drop:
+       m_freem(dtom(ti));
+       return (0);
+}
+
 /*
  * TCP input routine, follows pages 65-76 of the
  * protocol specification dated September, 1981 very closely.
 /*
  * TCP input routine, follows pages 65-76 of the
  * protocol specification dated September, 1981 very closely.
@@ -48,8 +174,8 @@ tcp_input(m0)
        int todrop, acked;
        short ostate;
        struct in_addr laddr;
        int todrop, acked;
        short ostate;
        struct in_addr laddr;
+       int dropsocket = 0;
 
 
-COUNT(TCP_INPUT);
        /*
         * Get IP and TCP header together in first mbuf.
         * Note: IP leaves IP header in first mbuf.
        /*
         * Get IP and TCP header together in first mbuf.
         * Note: IP leaves IP header in first mbuf.
@@ -75,12 +201,11 @@ COUNT(TCP_INPUT);
                ti->ti_next = ti->ti_prev = 0;
                ti->ti_x1 = 0;
                ti->ti_len = (u_short)tlen;
                ti->ti_next = ti->ti_prev = 0;
                ti->ti_x1 = 0;
                ti->ti_len = (u_short)tlen;
-#if vax
                ti->ti_len = htons((u_short)ti->ti_len);
                ti->ti_len = htons((u_short)ti->ti_len);
-#endif
                if (ti->ti_sum = in_cksum(m, len)) {
                if (ti->ti_sum = in_cksum(m, len)) {
+                       if (tcpprintfs)
+                               printf("tcp sum: src %x\n", ti->ti_src);
                        tcpstat.tcps_badsum++;
                        tcpstat.tcps_badsum++;
-                       printf("tcp cksum %x\n", ti->ti_sum);
                        goto drop;
                }
        }
                        goto drop;
                }
        }
@@ -91,20 +216,24 @@ COUNT(TCP_INPUT);
         */
        off = ti->ti_off << 2;
        if (off < sizeof (struct tcphdr) || off > tlen) {
         */
        off = ti->ti_off << 2;
        if (off < sizeof (struct tcphdr) || off > tlen) {
+               if (tcpprintfs)
+                       printf("tcp off: src %x off %d\n", ti->ti_src, off);
                tcpstat.tcps_badoff++;
                goto drop;
        }
                tcpstat.tcps_badoff++;
                goto drop;
        }
-       ti->ti_len = tlen - off;
+       tlen -= off;
+       ti->ti_len = tlen;
        if (off > sizeof (struct tcphdr)) {
        if (off > sizeof (struct tcphdr)) {
-               if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
-                       tcpstat.tcps_hdrops++;
-                       goto drop;
+               if (m->m_len < sizeof(struct ip) + off) {
+                       if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
+                               tcpstat.tcps_hdrops++;
+                               return;
+                       }
+                       ti = mtod(m, struct tcpiphdr *);
                }
                }
-               ti = mtod(m, struct tcpiphdr *);
-               om = m_get(M_DONTWAIT);
+               om = m_get(M_DONTWAIT, MT_DATA);
                if (om == 0)
                        goto drop;
                if (om == 0)
                        goto drop;
-               om->m_off = MMINOFF;
                om->m_len = off - sizeof (struct tcphdr);
                { caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
                  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
                om->m_len = off - sizeof (struct tcphdr);
                { caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
                  bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
@@ -116,13 +245,12 @@ COUNT(TCP_INPUT);
        tiflags = ti->ti_flags;
 
        /*
        tiflags = ti->ti_flags;
 
        /*
-        * drop IP header
+        * Drop TCP and IP headers.
         */
        off += sizeof (struct ip);
        m->m_off += off;
        m->m_len -= off;
 
         */
        off += sizeof (struct ip);
        m->m_off += off;
        m->m_len -= off;
 
-#if vax
        /*
         * Convert TCP protocol specific fields to host format.
         */
        /*
         * Convert TCP protocol specific fields to host format.
         */
@@ -130,11 +258,9 @@ COUNT(TCP_INPUT);
        ti->ti_ack = ntohl(ti->ti_ack);
        ti->ti_win = ntohs(ti->ti_win);
        ti->ti_urp = ntohs(ti->ti_urp);
        ti->ti_ack = ntohl(ti->ti_ack);
        ti->ti_win = ntohs(ti->ti_win);
        ti->ti_urp = ntohs(ti->ti_urp);
-#endif
 
        /*
 
        /*
-        * Locate pcb for segment.  On match, update the local
-        * address stored in the block to reflect anchoring.
+        * Locate pcb for segment.
         */
        inp = in_pcblookup
                (&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
         */
        inp = in_pcblookup
                (&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
@@ -154,6 +280,29 @@ COUNT(TCP_INPUT);
                ostate = tp->t_state;
                tcp_saveti = *ti;
        }
                ostate = tp->t_state;
                tcp_saveti = *ti;
        }
+       if (so->so_options & SO_ACCEPTCONN) {
+               so = sonewconn(so);
+               if (so == 0)
+                       goto drop;
+               /*
+                * This is ugly, but ....
+                *
+                * Mark socket as temporary until we're
+                * committed to keeping it.  The code at
+                * ``drop'' and ``dropwithreset'' check the
+                * flag dropsocket to see if the temporary
+                * socket created here should be discarded.
+                * We mark the socket as discardable until
+                * we're committed to it below in TCPS_LISTEN.
+                */
+               dropsocket++;
+               inp = (struct inpcb *)so->so_pcb;
+               inp->inp_laddr = ti->ti_dst;
+               inp->inp_lport = ti->ti_dport;
+               inp->inp_options = ip_srcroute();
+               tp = intotcpcb(inp);
+               tp->t_state = TCPS_LISTEN;
+       }
 
        /*
         * Segment received on connection.
 
        /*
         * Segment received on connection.
@@ -163,20 +312,24 @@ COUNT(TCP_INPUT);
        tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
 
        /*
        tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
 
        /*
-        * Process options.
+        * Process options if not in LISTEN state,
+        * else do it below (after getting remote address).
         */
         */
-       if (om) {
-               tcp_dooptions(tp, om);
+       if (om && tp->t_state != TCPS_LISTEN) {
+               tcp_dooptions(tp, om, ti);
                om = 0;
        }
 
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
                om = 0;
        }
 
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
+        * Receive window is amount of space in rcv queue,
+        * but not less than advertised window.
         */
        tp->rcv_wnd = sbspace(&so->so_rcv);
        if (tp->rcv_wnd < 0)
                tp->rcv_wnd = 0;
         */
        tp->rcv_wnd = sbspace(&so->so_rcv);
        if (tp->rcv_wnd < 0)
                tp->rcv_wnd = 0;
+       tp->rcv_wnd = MAX(tp->rcv_wnd, (short)(tp->rcv_adv - tp->rcv_nxt));
 
        switch (tp->t_state) {
 
 
        switch (tp->t_state) {
 
@@ -184,6 +337,7 @@ COUNT(TCP_INPUT);
         * If the state is LISTEN then ignore segment if it contains an RST.
         * If the segment contains an ACK then it is bad and send a RST.
         * If it does not contain a SYN then it is not interesting; drop it.
         * If the state is LISTEN then ignore segment if it contains an RST.
         * If the segment contains an ACK then it is bad and send a RST.
         * If it does not contain a SYN then it is not interesting; drop it.
+        * Don't bother responding if the destination was a broadcast.
         * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
         * tp->iss, and send a segment:
         *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
         * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
         * tp->iss, and send a segment:
         *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
@@ -192,36 +346,55 @@ COUNT(TCP_INPUT);
         * Enter SYN_RECEIVED state, and process any other fields of this
         * segment in this state.
         */
         * Enter SYN_RECEIVED state, and process any other fields of this
         * segment in this state.
         */
-       case TCPS_LISTEN:
+       case TCPS_LISTEN: {
+               struct mbuf *am;
+               register struct sockaddr_in *sin;
+
                if (tiflags & TH_RST)
                        goto drop;
                if (tiflags & TH_ACK)
                        goto dropwithreset;
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                if (tiflags & TH_RST)
                        goto drop;
                if (tiflags & TH_ACK)
                        goto dropwithreset;
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
-               tcp_in.sin_addr = ti->ti_src;
-               tcp_in.sin_port = ti->ti_sport;
+               if (in_broadcast(ti->ti_dst))
+                       goto drop;
+               am = m_get(M_DONTWAIT, MT_SONAME);
+               if (am == NULL)
+                       goto drop;
+               am->m_len = sizeof (struct sockaddr_in);
+               sin = mtod(am, struct sockaddr_in *);
+               sin->sin_family = AF_INET;
+               sin->sin_addr = ti->ti_src;
+               sin->sin_port = ti->ti_sport;
                laddr = inp->inp_laddr;
                laddr = inp->inp_laddr;
-               if (inp->inp_laddr.s_addr == 0)
+               if (inp->inp_laddr.s_addr == INADDR_ANY)
                        inp->inp_laddr = ti->ti_dst;
                        inp->inp_laddr = ti->ti_dst;
-               if (in_pcbconnect(inp, (struct sockaddr_in *)&tcp_in)) {
+               if (in_pcbconnect(inp, am)) {
                        inp->inp_laddr = laddr;
                        inp->inp_laddr = laddr;
+                       (void) m_free(am);
                        goto drop;
                }
                        goto drop;
                }
+               (void) m_free(am);
                tp->t_template = tcp_template(tp);
                if (tp->t_template == 0) {
                        in_pcbdisconnect(inp);
                tp->t_template = tcp_template(tp);
                if (tp->t_template == 0) {
                        in_pcbdisconnect(inp);
-                       inp->inp_laddr = laddr;
+                       dropsocket = 0;         /* socket is already gone */
+                       tp = 0;
                        goto drop;
                }
                        goto drop;
                }
-               in_setsockaddr(inp);
+               if (om) {
+                       tcp_dooptions(tp, om, ti);
+                       om = 0;
+               }
                tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
                tp->irs = ti->ti_seq;
                tcp_sendseqinit(tp);
                tcp_rcvseqinit(tp);
                tp->t_state = TCPS_SYN_RECEIVED;
                tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
                tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
                tp->irs = ti->ti_seq;
                tcp_sendseqinit(tp);
                tcp_rcvseqinit(tp);
                tp->t_state = TCPS_SYN_RECEIVED;
                tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
+               dropsocket = 0;         /* committed to socket */
                goto trimthenstep6;
                goto trimthenstep6;
+               }
 
        /*
         * If the state is SYN_SENT:
 
        /*
         * If the state is SYN_SENT:
@@ -237,13 +410,12 @@ COUNT(TCP_INPUT);
         */
        case TCPS_SYN_SENT:
                if ((tiflags & TH_ACK) &&
         */
        case TCPS_SYN_SENT:
                if ((tiflags & TH_ACK) &&
-/* this should be SEQ_LT; is SEQ_LEQ for BBN vax TCP only */
-                   (SEQ_LT(ti->ti_ack, tp->iss) ||
+                   (SEQ_LEQ(ti->ti_ack, tp->iss) ||
                     SEQ_GT(ti->ti_ack, tp->snd_max)))
                        goto dropwithreset;
                if (tiflags & TH_RST) {
                        if (tiflags & TH_ACK)
                     SEQ_GT(ti->ti_ack, tp->snd_max)))
                        goto dropwithreset;
                if (tiflags & TH_RST) {
                        if (tiflags & TH_ACK)
-                               tcp_drop(tp, ECONNREFUSED);
+                               tp = tcp_drop(tp, ECONNREFUSED);
                        goto drop;
                }
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                }
                if ((tiflags & TH_SYN) == 0)
@@ -256,10 +428,9 @@ COUNT(TCP_INPUT);
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
                if (SEQ_GT(tp->snd_una, tp->iss)) {
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
                if (SEQ_GT(tp->snd_una, tp->iss)) {
-                       if (so->so_options & SO_ACCEPTCONN)
-                               so->so_state |= SS_CONNAWAITING;
                        soisconnected(so);
                        tp->t_state = TCPS_ESTABLISHED;
                        soisconnected(so);
                        tp->t_state = TCPS_ESTABLISHED;
+                       tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
                        (void) tcp_reass(tp, (struct tcpiphdr *)0);
                } else
                        tp->t_state = TCPS_SYN_RECEIVED;
                        (void) tcp_reass(tp, (struct tcpiphdr *)0);
                } else
                        tp->t_state = TCPS_SYN_RECEIVED;
@@ -282,6 +453,16 @@ trimthenstep6:
                goto step6;
        }
 
                goto step6;
        }
 
+       /*
+        * If data is received on a connection after the
+        * user processes are gone, then RST the other end.
+        */
+       if ((so->so_state & SS_NOFDREF) && tp->t_state > TCPS_CLOSE_WAIT &&
+           ti->ti_len) {
+               tp = tcp_close(tp);
+               goto dropwithreset;
+       }
+
        /*
         * States other than LISTEN or SYN_SENT.
         * First check that at least some bytes of segment are within 
        /*
         * States other than LISTEN or SYN_SENT.
         * First check that at least some bytes of segment are within 
@@ -317,7 +498,8 @@ trimthenstep6:
                                        tiflags &= ~TH_URG;
                                todrop--;
                        }
                                        tiflags &= ~TH_URG;
                                todrop--;
                        }
-                       if (todrop > ti->ti_len)
+                       if (todrop > ti->ti_len ||
+                           todrop == ti->ti_len && (tiflags&TH_FIN) == 0)
                                goto dropafterack;
                        m_adj(m, todrop);
                        ti->ti_seq += todrop;
                                goto dropafterack;
                        m_adj(m, todrop);
                        ti->ti_seq += todrop;
@@ -336,7 +518,7 @@ trimthenstep6:
                 */
                todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
                if (todrop > 0) {
                 */
                todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
                if (todrop > 0) {
-                       if (todrop > ti->ti_len)
+                       if (todrop >= ti->ti_len)
                                goto dropafterack;
                        m_adj(m, -todrop);
                        ti->ti_len -= todrop;
                                goto dropafterack;
                        m_adj(m, -todrop);
                        ti->ti_len -= todrop;
@@ -344,15 +526,6 @@ trimthenstep6:
                }
        }
 
                }
        }
 
-       /*
-        * If a segment is received on a connection after the
-        * user processes are gone, then RST the other end.
-        */
-       if (so->so_state & SS_USERGONE) {
-               tcp_close(tp);
-               goto dropwithreset;
-       }
-
        /*
         * If the RST bit is set examine the state:
         *    SYN_RECEIVED STATE:
        /*
         * If the RST bit is set examine the state:
         *    SYN_RECEIVED STATE:
@@ -366,32 +539,20 @@ trimthenstep6:
        if (tiflags&TH_RST) switch (tp->t_state) {
 
        case TCPS_SYN_RECEIVED:
        if (tiflags&TH_RST) switch (tp->t_state) {
 
        case TCPS_SYN_RECEIVED:
-               if (inp->inp_socket->so_options & SO_ACCEPTCONN) {
-                       /* a miniature tcp_close, but invisible to user */
-                       (void) m_free(dtom(tp->t_template));
-                       (void) m_free(dtom(tp));
-                       inp->inp_ppcb = 0;
-                       tp = tcp_newtcpcb(inp);
-                       tp->t_state = TCPS_LISTEN;
-                       inp->inp_faddr.s_addr = 0;
-                       inp->inp_fport = 0;
-                       inp->inp_laddr.s_addr = 0;      /* not quite right */
-                       goto drop;
-               }
-               tcp_drop(tp, ECONNREFUSED);
+               tp = tcp_drop(tp, ECONNREFUSED);
                goto drop;
 
        case TCPS_ESTABLISHED:
        case TCPS_FIN_WAIT_1:
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
                goto drop;
 
        case TCPS_ESTABLISHED:
        case TCPS_FIN_WAIT_1:
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
-               tcp_drop(tp, ECONNRESET);
+               tp = tcp_drop(tp, ECONNRESET);
                goto drop;
 
        case TCPS_CLOSING:
        case TCPS_LAST_ACK:
        case TCPS_TIME_WAIT:
                goto drop;
 
        case TCPS_CLOSING:
        case TCPS_LAST_ACK:
        case TCPS_TIME_WAIT:
-               tcp_close(tp);
+               tp = tcp_close(tp);
                goto drop;
        }
 
                goto drop;
        }
 
@@ -400,7 +561,7 @@ trimthenstep6:
         * error and we send an RST and drop the connection.
         */
        if (tiflags & TH_SYN) {
         * error and we send an RST and drop the connection.
         */
        if (tiflags & TH_SYN) {
-               tcp_drop(tp, ECONNRESET);
+               tp = tcp_drop(tp, ECONNRESET);
                goto dropwithreset;
        }
 
                goto dropwithreset;
        }
 
@@ -428,10 +589,9 @@ trimthenstep6:
                if (SEQ_LT(tp->snd_nxt, tp->snd_una))
                        tp->snd_nxt = tp->snd_una;
                tp->t_timer[TCPT_REXMT] = 0;
                if (SEQ_LT(tp->snd_nxt, tp->snd_una))
                        tp->snd_nxt = tp->snd_una;
                tp->t_timer[TCPT_REXMT] = 0;
-               if (so->so_options & SO_ACCEPTCONN)
-                       so->so_state |= SS_CONNAWAITING;
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
+               tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
                (void) tcp_reass(tp, (struct tcpiphdr *)0);
                tp->snd_wl1 = ti->ti_seq - 1;
                /* fall into ... */
                (void) tcp_reass(tp, (struct tcpiphdr *)0);
                tp->snd_wl1 = ti->ti_seq - 1;
                /* fall into ... */
@@ -470,7 +630,6 @@ trimthenstep6:
                                tp->t_srtt =
                                    tcp_alpha * tp->t_srtt +
                                    (1 - tcp_alpha) * tp->t_rtt;
                                tp->t_srtt =
                                    tcp_alpha * tp->t_srtt +
                                    (1 - tcp_alpha) * tp->t_rtt;
-/* printf("rtt %d srtt*100 now %d\n", tp->t_rtt, (int)(tp->t_srtt*100)); */
                        tp->t_rtt = 0;
                }
 
                        tp->t_rtt = 0;
                }
 
@@ -479,18 +638,22 @@ trimthenstep6:
                else {
                        TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
                            tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
                else {
                        TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
                            tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
-                       tp->t_rtt = 1;
                        tp->t_rxtshift = 0;
                }
                        tp->t_rxtshift = 0;
                }
+               /*
+                * When new data is acked, open the congestion window a bit.
+                */
+               if (acked > 0)
+                       tp->snd_cwnd = MIN(11 * tp->snd_cwnd / 10, 65535);
                if (acked > so->so_snd.sb_cc) {
                if (acked > so->so_snd.sb_cc) {
-                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
                        tp->snd_wnd -= so->so_snd.sb_cc;
                        tp->snd_wnd -= so->so_snd.sb_cc;
+                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
                } else {
                        sbdrop(&so->so_snd, acked);
                        tp->snd_wnd -= acked;
                        acked = 0;
                }
                } else {
                        sbdrop(&so->so_snd, acked);
                        tp->snd_wnd -= acked;
                        acked = 0;
                }
-               if (so->so_snd.sb_flags & SB_WAIT)
+               if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
                        sowwakeup(so);
                tp->snd_una = ti->ti_ack;
                if (SEQ_LT(tp->snd_nxt, tp->snd_una))
                        sowwakeup(so);
                tp->snd_una = ti->ti_ack;
                if (SEQ_LT(tp->snd_nxt, tp->snd_una))
@@ -508,9 +671,14 @@ trimthenstep6:
                                /*
                                 * If we can't receive any more
                                 * data, then closing user can proceed.
                                /*
                                 * If we can't receive any more
                                 * data, then closing user can proceed.
+                                * Starting the timer is contrary to the
+                                * specification, but if we don't get a FIN
+                                * we'll hang forever.
                                 */
                                 */
-                               if (so->so_state & SS_CANTRCVMORE)
+                               if (so->so_state & SS_CANTRCVMORE) {
                                        soisdisconnected(so);
                                        soisdisconnected(so);
+                                       tp->t_timer[TCPT_2MSL] = TCPTV_MAXIDLE;
+                               }
                                tp->t_state = TCPS_FIN_WAIT_2;
                        }
                        break;
                                tp->t_state = TCPS_FIN_WAIT_2;
                        }
                        break;
@@ -538,7 +706,7 @@ trimthenstep6:
                 */
                case TCPS_LAST_ACK:
                        if (ourfinisacked)
                 */
                case TCPS_LAST_ACK:
                        if (ourfinisacked)
-                               tcp_close(tp);
+                               tp = tcp_close(tp);
                        goto drop;
 
                /*
                        goto drop;
 
                /*
@@ -563,14 +731,25 @@ step6:
                tp->snd_wnd = ti->ti_win;
                tp->snd_wl1 = ti->ti_seq;
                tp->snd_wl2 = ti->ti_ack;
                tp->snd_wnd = ti->ti_win;
                tp->snd_wl1 = ti->ti_seq;
                tp->snd_wl2 = ti->ti_ack;
-               if (tp->snd_wnd > 0)
-                       tp->t_timer[TCPT_PERSIST] = 0;
        }
 
        /*
         * Process segments with URG.
         */
        }
 
        /*
         * Process segments with URG.
         */
-       if ((tiflags & TH_URG) && TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+       if ((tiflags & TH_URG) && ti->ti_urp &&
+           TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+               /*
+                * This is a kludge, but if we receive accept
+                * random urgent pointers, we'll crash in
+                * soreceive.  It's hard to imagine someone
+                * actually wanting to send this much urgent data.
+                */
+               if (ti->ti_urp + (unsigned) so->so_rcv.sb_cc > 32767) {
+                       ti->ti_urp = 0;                 /* XXX */
+                       tiflags &= ~TH_URG;             /* XXX */
+                       ti->ti_flags &= ~TH_URG;        /* XXX */
+                       goto badurp;                    /* XXX */
+               }
                /*
                 * If this segment advances the known urgent pointer,
                 * then mark the data stream.  This should not happen
                /*
                 * If this segment advances the known urgent pointer,
                 * then mark the data stream.  This should not happen
@@ -584,11 +763,8 @@ step6:
                            (tp->rcv_up - tp->rcv_nxt) - 1;
                        if (so->so_oobmark == 0)
                                so->so_state |= SS_RCVATMARK;
                            (tp->rcv_up - tp->rcv_nxt) - 1;
                        if (so->so_oobmark == 0)
                                so->so_state |= SS_RCVATMARK;
-#ifdef TCPTRUEOOB
-                       if ((tp->t_flags & TF_DOOOB) == 0)
-#endif
-                               sohasoutofband(so);
-                       tp->t_oobflags &= ~TCPOOB_HAVEDATA;
+                       sohasoutofband(so);
+                       tp->t_oobflags &= ~(TCPOOB_HAVEDATA | TCPOOB_HADDATA);
                }
                /*
                 * Remove out of band data so doesn't get presented to user.
                }
                /*
                 * Remove out of band data so doesn't get presented to user.
@@ -596,10 +772,10 @@ step6:
                 * but if two URG's are pending at once, some out-of-band
                 * data may creep in... ick.
                 */
                 * but if two URG's are pending at once, some out-of-band
                 * data may creep in... ick.
                 */
-               if (ti->ti_urp <= ti->ti_len) {
+               if (ti->ti_urp <= ti->ti_len)
                        tcp_pulloutofband(so, ti);
                        tcp_pulloutofband(so, ti);
-               }
        }
        }
+badurp:                                                        /* XXX */
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
@@ -611,7 +787,7 @@ step6:
         */
        if ((ti->ti_len || (tiflags&TH_FIN)) &&
            TCPS_HAVERCVDFIN(tp->t_state) == 0) {
         */
        if ((ti->ti_len || (tiflags&TH_FIN)) &&
            TCPS_HAVERCVDFIN(tp->t_state) == 0) {
-               tiflags = tcp_reass(tp, ti);
+               TCP_REASS(tp, ti, m, so, tiflags);
                if (tcpnodelack == 0)
                        tp->t_flags |= TF_DELACK;
                else
                if (tcpnodelack == 0)
                        tp->t_flags |= TF_DELACK;
                else
@@ -681,43 +857,61 @@ step6:
 
 dropafterack:
        /*
 
 dropafterack:
        /*
-        * Generate an ACK dropping incoming segment.
-        * Make ACK reflect our state.
+        * Generate an ACK dropping incoming segment if it occupies
+        * sequence space, where the ACK reflects our state.
         */
         */
-       if (tiflags & TH_RST)
+       if ((tiflags&TH_RST) ||
+           tlen == 0 && (tiflags&(TH_SYN|TH_FIN)) == 0)
                goto drop;
                goto drop;
+       if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
+               tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
        tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
        return;
 
 dropwithreset:
        tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
        return;
 
 dropwithreset:
-       if (om)
+       if (om) {
                (void) m_free(om);
                (void) m_free(om);
+               om = 0;
+       }
        /*
         * Generate a RST, dropping incoming segment.
         * Make ACK acceptable to originator of segment.
        /*
         * Generate a RST, dropping incoming segment.
         * Make ACK acceptable to originator of segment.
+        * Don't bother to respond if destination was broadcast.
         */
         */
-       if (tiflags & TH_RST)
+       if ((tiflags & TH_RST) || in_broadcast(ti->ti_dst))
                goto drop;
        if (tiflags & TH_ACK)
                tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
                goto drop;
        if (tiflags & TH_ACK)
                tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
-               tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK);
+               tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
+                   TH_RST|TH_ACK);
        }
        }
+       /* destroy temporarily created socket */
+       if (dropsocket)
+               (void) soabort(so);
        return;
 
 drop:
        return;
 
 drop:
+       if (om)
+               (void) m_free(om);
        /*
         * Drop space held by incoming segment and return.
         */
        /*
         * Drop space held by incoming segment and return.
         */
+       if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
+               tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
        m_freem(m);
        m_freem(m);
+       /* destroy temporarily created socket */
+       if (dropsocket)
+               (void) soabort(so);
        return;
 }
 
        return;
 }
 
-tcp_dooptions(tp, om)
+tcp_dooptions(tp, om, ti)
        struct tcpcb *tp;
        struct mbuf *om;
        struct tcpcb *tp;
        struct mbuf *om;
+       struct tcpiphdr *ti;
 {
        register u_char *cp;
        int opt, optlen, cnt;
 {
        register u_char *cp;
        int opt, optlen, cnt;
@@ -730,8 +924,11 @@ tcp_dooptions(tp, om)
                        break;
                if (opt == TCPOPT_NOP)
                        optlen = 1;
                        break;
                if (opt == TCPOPT_NOP)
                        optlen = 1;
-               else
+               else {
                        optlen = cp[1];
                        optlen = cp[1];
+                       if (optlen <= 0)
+                               break;
+               }
                switch (opt) {
 
                default:
                switch (opt) {
 
                default:
@@ -740,64 +937,13 @@ tcp_dooptions(tp, om)
                case TCPOPT_MAXSEG:
                        if (optlen != 4)
                                continue;
                case TCPOPT_MAXSEG:
                        if (optlen != 4)
                                continue;
+                       if (!(ti->ti_flags & TH_SYN))
+                               continue;
                        tp->t_maxseg = *(u_short *)(cp + 2);
                        tp->t_maxseg = *(u_short *)(cp + 2);
-#if vax
                        tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
                        tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
-#endif
-                       break;
-                       
-#ifdef TCPTRUEOOB
-               case TCPOPT_WILLOOB:
-                       tp->t_flags |= TF_DOOOB;
-printf("tp %x dooob\n", tp);
-                       break;
-
-               case TCPOPT_OOBDATA: {
-                       int seq;
-                       register struct socket *so = tp->t_inpcb->inp_socket;
-                       tcp_seq mark;
-
-                       if (optlen != 8)
-                               continue;
-                       seq = cp[2];
-                       if (seq < tp->t_iobseq)
-                               seq += 256;
-printf("oobdata cp[2] %d iobseq %d seq %d\n", cp[2], tp->t_iobseq, seq);
-                       if (seq - tp->t_iobseq > 128) {
-printf("bad seq\n");
-                               tp->t_oobflags |= TCPOOB_OWEACK;
-                               break;
-                       }
-                       tp->t_iobseq = cp[2];
-                       tp->t_iobc = cp[3];
-                       mark = *(tcp_seq *)(cp + 4);
-#if vax
-                       mark = ntohl(mark);
-#endif
-                       so->so_oobmark = so->so_rcv.sb_cc + (mark-tp->rcv_nxt);
-                       if (so->so_oobmark == 0)
-                               so->so_state |= SS_RCVATMARK;
-printf("take oob data %x input iobseq now %x\n", tp->t_iobc, tp->t_iobseq);
-                       sohasoutofband(so);
-                       break;
-               }
-
-               case TCPOPT_OOBACK: {
-                       int seq;
-
-                       if (optlen != 4)
-                               continue;
-                       if (tp->t_oobseq != cp[2]) {
-printf("wrong ack\n");
-                               break;
-                       }
-printf("take oob ack %x and cancel rexmt\n", cp[2]);
-                       tp->t_oobflags &= ~TCPOOB_NEEDACK;
-                       tp->t_timer[TCPT_OOBREXMT] = 0;
+                       tp->t_maxseg = MIN(tp->t_maxseg, tcp_mss(tp));
                        break;
                }
                        break;
                }
-#endif TCPTRUEOOB
-               }
        }
        (void) m_free(om);
 }
        }
        (void) m_free(om);
 }
@@ -836,106 +982,50 @@ tcp_pulloutofband(so, ti)
 }
 
 /*
 }
 
 /*
- * Insert segment ti into reassembly queue of tcp with
- * control block tp.  Return TH_FIN if reassembly now includes
- * a segment with FIN.
+ *  Determine a reasonable value for maxseg size.
+ *  If the route is known, use one that can be handled
+ *  on the given interface without forcing IP to fragment.
+ *  If bigger than a page (CLBYTES), round down to nearest pagesize
+ *  to utilize pagesize mbufs.
+ *  If interface pointer is unavailable, or the destination isn't local,
+ *  use a conservative size (512 or the default IP max size, but no more
+ *  than the mtu of the interface through which we route),
+ *  as we can't discover anything about intervening gateways or networks.
+ *
+ *  This is ugly, and doesn't belong at this level, but has to happen somehow.
  */
  */
-tcp_reass(tp, ti)
+tcp_mss(tp)
        register struct tcpcb *tp;
        register struct tcpcb *tp;
-       register struct tcpiphdr *ti;
 {
 {
-       register struct tcpiphdr *q;
-       struct socket *so = tp->t_inpcb->inp_socket;
-       struct mbuf *m;
-       int flags;
-COUNT(TCP_REASS);
-
-       /*
-        * Call with ti==0 after become established to
-        * force pre-ESTABLISHED data up to user socket.
-        */
-       if (ti == 0)
-               goto present;
-
-       /*
-        * Find a segment which begins after this one does.
-        */
-       for (q = tp->seg_next; q != (struct tcpiphdr *)tp;
-           q = (struct tcpiphdr *)q->ti_next)
-               if (SEQ_GT(q->ti_seq, ti->ti_seq))
-                       break;
-
-       /*
-        * If there is a preceding segment, it may provide some of
-        * our data already.  If so, drop the data from the incoming
-        * segment.  If it provides all of our data, drop us.
-        */
-       if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
-               register int i;
-               q = (struct tcpiphdr *)q->ti_prev;
-               /* conversion to int (in i) handles seq wraparound */
-               i = q->ti_seq + q->ti_len - ti->ti_seq;
-               if (i > 0) {
-                       if (i >= ti->ti_len)
-                               goto drop;
-                       m_adj(dtom(tp), i);
-                       ti->ti_len -= i;
-                       ti->ti_seq += i;
-               }
-               q = (struct tcpiphdr *)(q->ti_next);
-       }
+       struct route *ro;
+       struct ifnet *ifp;
+       int mss;
+       struct inpcb *inp;
 
 
-       /*
-        * While we overlap succeeding segments trim them or,
-        * if they are completely covered, dequeue them.
-        */
-       while (q != (struct tcpiphdr *)tp) {
-               register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
-               if (i <= 0)
-                       break;
-               if (i < q->ti_len) {
-                       q->ti_seq += i;
-                       q->ti_len -= i;
-                       m_adj(dtom(q), i);
-                       break;
+       inp = tp->t_inpcb;
+       ro = &inp->inp_route;
+       if ((ro->ro_rt == (struct rtentry *)0) ||
+           (ifp = ro->ro_rt->rt_ifp) == (struct ifnet *)0) {
+               /* No route yet, so try to acquire one */
+               if (inp->inp_faddr.s_addr != INADDR_ANY) {
+                       ro->ro_dst.sa_family = AF_INET;
+                       ((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
+                               inp->inp_faddr;
+                       rtalloc(ro);
                }
                }
-               q = (struct tcpiphdr *)q->ti_next;
-               m = dtom(q->ti_prev);
-               remque(q->ti_prev);
-               m_freem(m);
+               if ((ro->ro_rt == 0) || (ifp = ro->ro_rt->rt_ifp) == 0)
+                       return (TCP_MSS);
        }
 
        }
 
-       /*
-        * Stick new segment in its place.
-        */
-       insque(ti, q->ti_prev);
-
-present:
-       /*
-        * Present data to user, advancing rcv_nxt through
-        * completed sequence space.
-        */
-       if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
-               return (0);
-       ti = tp->seg_next;
-       if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
-               return (0);
-       if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
-               return (0);
-       do {
-               tp->rcv_nxt += ti->ti_len;
-               flags = ti->ti_flags & TH_FIN;
-               remque(ti);
-               m = dtom(ti);
-               ti = (struct tcpiphdr *)ti->ti_next;
-               if (so->so_state & SS_CANTRCVMORE)
-                       m_freem(m);
-               else
-                       sbappend(&so->so_rcv, m);
-       } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
-       sorwakeup(so);
-       return (flags);
-drop:
-       m_freem(dtom(ti));
-       return (0);
+       mss = ifp->if_mtu - sizeof(struct tcpiphdr);
+#if    (CLBYTES & (CLBYTES - 1)) == 0
+       if (mss > CLBYTES)
+               mss &= ~(CLBYTES-1);
+#else
+       if (mss > CLBYTES)
+               mss = mss / CLBYTES * CLBYTES;
+#endif
+       if (in_localaddr(inp->inp_faddr))
+               return (mss);
+       return (MIN(mss, TCP_MSS));
 }
 }