nasty little bug in packet reassembly
[unix-history] / usr / src / sys / netinet / tcp_input.c
index c42be63..d00ead0 100644 (file)
@@ -1,4 +1,4 @@
-/*     tcp_input.c     1.33    81/11/29        */
+/*     tcp_input.c     1.71    82/06/30        */
 
 #include "../h/param.h"
 #include "../h/systm.h"
 
 #include "../h/param.h"
 #include "../h/systm.h"
@@ -7,6 +7,7 @@
 #include "../h/socket.h"
 #include "../h/socketvar.h"
 #include "../net/in.h"
 #include "../h/socket.h"
 #include "../h/socketvar.h"
 #include "../net/in.h"
+#include "../net/route.h"
 #include "../net/in_pcb.h"
 #include "../net/in_systm.h"
 #include "../net/if.h"
 #include "../net/in_pcb.h"
 #include "../net/in_systm.h"
 #include "../net/if.h"
 #include "../net/tcp_timer.h"
 #include "../net/tcp_var.h"
 #include "../net/tcpip.h"
 #include "../net/tcp_timer.h"
 #include "../net/tcp_var.h"
 #include "../net/tcpip.h"
-#include "../errno.h"
+#include "../net/tcp_debug.h"
+#include <errno.h>
 
 
+int    tcpprintfs = 0;
 int    tcpcksum = 1;
 int    tcpcksum = 1;
+struct sockaddr_in tcp_in = { AF_INET };
+struct tcpiphdr tcp_saveti;
+extern tcpnodelack;
 
 
+struct tcpcb *tcp_newtcpcb();
 /*
  * TCP input routine, follows pages 65-76 of the
  * protocol specification dated September, 1981 very closely.
 /*
  * TCP input routine, follows pages 65-76 of the
  * protocol specification dated September, 1981 very closely.
@@ -32,77 +39,110 @@ tcp_input(m0)
        register struct tcpiphdr *ti;
        struct inpcb *inp;
        register struct mbuf *m;
        register struct tcpiphdr *ti;
        struct inpcb *inp;
        register struct mbuf *m;
+       struct mbuf *om = 0;
        int len, tlen, off;
        int len, tlen, off;
-       register struct tcpcb *tp;
+       register struct tcpcb *tp = 0;
        register int tiflags;
        struct socket *so;
        int todrop, acked;
        register int tiflags;
        struct socket *so;
        int todrop, acked;
+       short ostate;
+       struct in_addr laddr;
 
 
-COUNT(TCP_INPUT);
        /*
        /*
-        * Get ip and tcp header together in first mbuf.
+        * Get IP and TCP header together in first mbuf.
+        * Note: IP leaves IP header in first mbuf.
         */
        m = m0;
        ti = mtod(m, struct tcpiphdr *);
         */
        m = m0;
        ti = mtod(m, struct tcpiphdr *);
-       if (ti->ti_len > sizeof (struct ip))
-               ip_stripoptions((struct ip *)ti, (char *)0);
-       if (m->m_len < sizeof (struct tcpiphdr)) {
-               if (m_pullup(m, sizeof (struct tcpiphdr)) == 0) {
+       if (((struct ip *)ti)->ip_hl > (sizeof (struct ip) >> 2))
+               ip_stripoptions((struct ip *)ti, (struct mbuf *)0);
+       if (m->m_off > MMAXOFF || m->m_len < sizeof (struct tcpiphdr)) {
+               if ((m = m_pullup(m, sizeof (struct tcpiphdr))) == 0) {
                        tcpstat.tcps_hdrops++;
                        tcpstat.tcps_hdrops++;
-                       goto drop;
+                       return;
                }
                ti = mtod(m, struct tcpiphdr *);
        }
 
        /*
                }
                ti = mtod(m, struct tcpiphdr *);
        }
 
        /*
-        * Checksum extended tcp header and data.
+        * Checksum extended TCP header and data.
         */
        tlen = ((struct ip *)ti)->ip_len;
        len = sizeof (struct ip) + tlen;
        if (tcpcksum) {
                ti->ti_next = ti->ti_prev = 0;
                ti->ti_x1 = 0;
         */
        tlen = ((struct ip *)ti)->ip_len;
        len = sizeof (struct ip) + tlen;
        if (tcpcksum) {
                ti->ti_next = ti->ti_prev = 0;
                ti->ti_x1 = 0;
-               ti->ti_len = htons((u_short)tlen);
-               if ((ti->ti_sum = in_cksum(m, len)) != 0xffff) {
+               ti->ti_len = (u_short)tlen;
+#if vax || pdp11
+               ti->ti_len = htons((u_short)ti->ti_len);
+#endif
+               if (ti->ti_sum = in_cksum(m, len)) {
                        tcpstat.tcps_badsum++;
                        tcpstat.tcps_badsum++;
-                       printf("tcp cksum %x\n", ti->ti_sum);
+                       if (tcpprintfs)
+                               printf("tcp cksum %x\n", ti->ti_sum);
                        goto drop;
                }
        }
 
        /*
                        goto drop;
                }
        }
 
        /*
-        * Check that tcp offset makes sense,
-        * process tcp options and adjust length.
+        * Check that TCP offset makes sense,
+        * pull out TCP options and adjust length.
         */
        off = ti->ti_off << 2;
         */
        off = ti->ti_off << 2;
-       if (off < sizeof (struct tcphdr) || off > ti->ti_len) {
+       if (off < sizeof (struct tcphdr) || off > tlen) {
                tcpstat.tcps_badoff++;
                goto drop;
        }
                tcpstat.tcps_badoff++;
                goto drop;
        }
-       ti->ti_len = tlen - off;
-#if 0
-       if (off > sizeof (struct tcphdr) >> 2)
-               tcp_options(ti);
-#endif
+       tlen -= off;
+       ti->ti_len = tlen;
+       if (off > sizeof (struct tcphdr)) {
+               if ((m = m_pullup(m, sizeof (struct ip) + off)) == 0) {
+                       tcpstat.tcps_hdrops++;
+                       goto drop;
+               }
+               ti = mtod(m, struct tcpiphdr *);
+               om = m_get(M_DONTWAIT);
+               if (om == 0)
+                       goto drop;
+               om->m_off = MMINOFF;
+               om->m_len = off - sizeof (struct tcphdr);
+               { caddr_t op = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
+                 bcopy(op, mtod(om, caddr_t), (unsigned)om->m_len);
+                 m->m_len -= om->m_len;
+                 bcopy(op+om->m_len, op,
+                  (unsigned)(m->m_len-sizeof (struct tcpiphdr)));
+               }
+       }
        tiflags = ti->ti_flags;
 
        /*
        tiflags = ti->ti_flags;
 
        /*
-        * Convert tcp protocol specific fields to host format.
+        * Drop TCP and IP headers.
+        */
+       off += sizeof (struct ip);
+       m->m_off += off;
+       m->m_len -= off;
+
+#if vax || pdp11
+       /*
+        * Convert TCP protocol specific fields to host format.
         */
        ti->ti_seq = ntohl(ti->ti_seq);
        ti->ti_ack = ntohl(ti->ti_ack);
        ti->ti_win = ntohs(ti->ti_win);
        ti->ti_urp = ntohs(ti->ti_urp);
         */
        ti->ti_seq = ntohl(ti->ti_seq);
        ti->ti_ack = ntohl(ti->ti_ack);
        ti->ti_win = ntohs(ti->ti_win);
        ti->ti_urp = ntohs(ti->ti_urp);
+#endif
 
        /*
 
        /*
-        * Locate pcb for segment.
+        * Locate pcb for segment.  On match, update the local
+        * address stored in the block to reflect anchoring.
         */
        inp = in_pcblookup
         */
        inp = in_pcblookup
-               (&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport);
+               (&tcb, ti->ti_src, ti->ti_sport, ti->ti_dst, ti->ti_dport,
+               INPLOOKUP_WILDCARD);
 
        /*
         * If the state is CLOSED (i.e., TCB does not exist) then
 
        /*
         * If the state is CLOSED (i.e., TCB does not exist) then
-        * all data in the incoming segment is discarded.  (p. 65).
+        * all data in the incoming segment is discarded.
         */
        if (inp == 0)
                goto dropwithreset;
         */
        if (inp == 0)
                goto dropwithreset;
@@ -110,12 +150,33 @@ COUNT(TCP_INPUT);
        if (tp == 0)
                goto dropwithreset;
        so = inp->inp_socket;
        if (tp == 0)
                goto dropwithreset;
        so = inp->inp_socket;
+       if (so->so_options & SO_DEBUG) {
+               ostate = tp->t_state;
+               tcp_saveti = *ti;
+       }
+
+       /*
+        * Segment received on connection.
+        * Reset idle time and keep-alive timer.
+        */
+       tp->t_idle = 0;
+       tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
+
+       /*
+        * Process options.
+        */
+       if (om) {
+               tcp_dooptions(tp, om);
+               om = 0;
+       }
 
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
         */
        tp->rcv_wnd = sbspace(&so->so_rcv);
 
        /*
         * Calculate amount of space in receive window,
         * and then do TCP input processing.
         */
        tp->rcv_wnd = sbspace(&so->so_rcv);
+       if (tp->rcv_wnd < 0)
+               tp->rcv_wnd = 0;
 
        switch (tp->t_state) {
 
 
        switch (tp->t_state) {
 
@@ -129,7 +190,7 @@ COUNT(TCP_INPUT);
         * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
         * Fill in remote peer address fields if not previously specified.
         * Enter SYN_RECEIVED state, and process any other fields of this
         * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
         * Fill in remote peer address fields if not previously specified.
         * Enter SYN_RECEIVED state, and process any other fields of this
-        * segment in this state.  (p. 65)
+        * segment in this state.
         */
        case TCPS_LISTEN:
                if (tiflags & TH_RST)
         */
        case TCPS_LISTEN:
                if (tiflags & TH_RST)
@@ -138,15 +199,28 @@ COUNT(TCP_INPUT);
                        goto dropwithreset;
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                        goto dropwithreset;
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
+               tcp_in.sin_addr = ti->ti_src;
+               tcp_in.sin_port = ti->ti_sport;
+               laddr = inp->inp_laddr;
+               if (inp->inp_laddr.s_addr == 0)
+                       inp->inp_laddr = ti->ti_dst;
+               if (in_pcbconnect(inp, (struct sockaddr_in *)&tcp_in)) {
+                       inp->inp_laddr = laddr;
+                       goto drop;
+               }
+               tp->t_template = tcp_template(tp);
+               if (tp->t_template == 0) {
+                       in_pcbdisconnect(inp);
+                       inp->inp_laddr = laddr;
+                       tp = 0;
+                       goto drop;
+               }
                tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
                tp->irs = ti->ti_seq;
                tcp_sendseqinit(tp);
                tcp_rcvseqinit(tp);
                tp->t_state = TCPS_SYN_RECEIVED;
                tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
                tp->irs = ti->ti_seq;
                tcp_sendseqinit(tp);
                tcp_rcvseqinit(tp);
                tp->t_state = TCPS_SYN_RECEIVED;
-               if (inp->inp_faddr.s_addr == 0) {
-                       inp->inp_faddr = ti->ti_src;
-                       inp->inp_fport = ti->ti_sport;
-               }
+               tp->t_timer[TCPT_KEEP] = TCPTV_KEEP;
                goto trimthenstep6;
 
        /*
                goto trimthenstep6;
 
        /*
@@ -163,45 +237,50 @@ COUNT(TCP_INPUT);
         */
        case TCPS_SYN_SENT:
                if ((tiflags & TH_ACK) &&
         */
        case TCPS_SYN_SENT:
                if ((tiflags & TH_ACK) &&
-                   (SEQ_LEQ(ti->ti_ack, tp->iss) ||
-                    SEQ_GT(ti->ti_ack, tp->snd_nxt)))
+/* this should be SEQ_LT; is SEQ_LEQ for BBN vax TCP only */
+                   (SEQ_LT(ti->ti_ack, tp->iss) ||
+                    SEQ_GT(ti->ti_ack, tp->snd_max)))
                        goto dropwithreset;
                if (tiflags & TH_RST) {
                        goto dropwithreset;
                if (tiflags & TH_RST) {
-                       if (tiflags & TH_ACK)
-                               tcp_drop(tp, ECONNRESET);
+                       if (tiflags & TH_ACK) {
+                               tcp_drop(tp, ECONNREFUSED);
+                               tp = 0;
+                       }
                        goto drop;
                }
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
                        goto drop;
                }
                if ((tiflags & TH_SYN) == 0)
                        goto drop;
-               tp->iss = ti->ti_ack;
-               tcp_sendseqinit(tp);
+               tp->snd_una = ti->ti_ack;
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
+               tp->t_timer[TCPT_REXMT] = 0;
                tp->irs = ti->ti_seq;
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
                tp->irs = ti->ti_seq;
                tcp_rcvseqinit(tp);
                tp->t_flags |= TF_ACKNOW;
-               if (SEQ_GT(tp->snd_una, tp->iss))
+               if (SEQ_GT(tp->snd_una, tp->iss)) {
+                       if (so->so_options & SO_ACCEPTCONN)
+                               so->so_state |= SS_CONNAWAITING;
+                       soisconnected(so);
                        tp->t_state = TCPS_ESTABLISHED;
                        tp->t_state = TCPS_ESTABLISHED;
-               else
+                       (void) tcp_reass(tp, (struct tcpiphdr *)0);
+               } else
                        tp->t_state = TCPS_SYN_RECEIVED;
                goto trimthenstep6;
 
 trimthenstep6:
                /*
                        tp->t_state = TCPS_SYN_RECEIVED;
                goto trimthenstep6;
 
 trimthenstep6:
                /*
-                * If had syn, advance ti->ti_seq to correspond
-                * to first data byte.
-                */
-               if (tiflags & TH_SYN)
-                       ti->ti_seq++;
-
-               /*
+                * Advance ti->ti_seq to correspond to first data byte.
                 * If data, trim to stay within window,
                 * dropping FIN if necessary.
                 */
                 * If data, trim to stay within window,
                 * dropping FIN if necessary.
                 */
+               ti->ti_seq++;
                if (ti->ti_len > tp->rcv_wnd) {
                        todrop = ti->ti_len - tp->rcv_wnd;
                        m_adj(m, -todrop);
                        ti->ti_len = tp->rcv_wnd;
                        ti->ti_flags &= ~TH_FIN;
                }
                if (ti->ti_len > tp->rcv_wnd) {
                        todrop = ti->ti_len - tp->rcv_wnd;
                        m_adj(m, -todrop);
                        ti->ti_len = tp->rcv_wnd;
                        ti->ti_flags &= ~TH_FIN;
                }
+               tp->snd_wl1 = ti->ti_seq - 1;
                goto step6;
        }
 
                goto step6;
        }
 
@@ -213,23 +292,26 @@ trimthenstep6:
        if (tp->rcv_wnd == 0) {
                /*
                 * If window is closed can only take segments at
        if (tp->rcv_wnd == 0) {
                /*
                 * If window is closed can only take segments at
-                * window edge, and have to drop data and EOL from
+                * window edge, and have to drop data and PUSH from
                 * incoming segments.
                 */
                if (tp->rcv_nxt != ti->ti_seq)
                        goto dropafterack;
                if (ti->ti_len > 0) {
                 * incoming segments.
                 */
                if (tp->rcv_nxt != ti->ti_seq)
                        goto dropafterack;
                if (ti->ti_len > 0) {
+                       m_adj(m, ti->ti_len);
                        ti->ti_len = 0;
                        ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
        } else {
                /*
                        ti->ti_len = 0;
                        ti->ti_flags &= ~(TH_PUSH|TH_FIN);
                }
        } else {
                /*
-                * If segment begins before rcv_next, drop leading
+                * If segment begins before rcv_nxt, drop leading
                 * data (and SYN); if nothing left, just ack.
                 */
                 * data (and SYN); if nothing left, just ack.
                 */
-               if (SEQ_GT(tp->rcv_nxt, ti->ti_seq)) {
-                       todrop = tp->rcv_nxt - ti->ti_seq;
+               todrop = tp->rcv_nxt - ti->ti_seq;
+               if (todrop > 0) {
                        if (tiflags & TH_SYN) {
                        if (tiflags & TH_SYN) {
+                               tiflags &= ~TH_SYN;
+                               ti->ti_flags &= ~TH_SYN;
                                ti->ti_seq++;
                                if (ti->ti_urp > 1) 
                                        ti->ti_urp--;
                                ti->ti_seq++;
                                if (ti->ti_urp > 1) 
                                        ti->ti_urp--;
@@ -237,7 +319,8 @@ trimthenstep6:
                                        tiflags &= ~TH_URG;
                                todrop--;
                        }
                                        tiflags &= ~TH_URG;
                                todrop--;
                        }
-                       if (todrop > ti->ti_len)
+                       if (todrop > ti->ti_len ||
+                           todrop == ti->ti_len && (tiflags&TH_FIN) == 0)
                                goto dropafterack;
                        m_adj(m, todrop);
                        ti->ti_seq += todrop;
                                goto dropafterack;
                        m_adj(m, todrop);
                        ti->ti_seq += todrop;
@@ -246,20 +329,17 @@ trimthenstep6:
                                ti->ti_urp -= todrop;
                        else {
                                tiflags &= ~TH_URG;
                                ti->ti_urp -= todrop;
                        else {
                                tiflags &= ~TH_URG;
-                               /* ti->ti_flags &= ~TH_URG; */
-                               /* ti->ti_urp = 0; */
+                               ti->ti_flags &= ~TH_URG;
+                               ti->ti_urp = 0;
                        }
                        }
-                       /* tiflags &= ~TH_SYN; */
-                       /* ti->ti_flags &= ~TH_SYN; */
                }
                /*
                 * If segment ends after window, drop trailing data
                 * (and PUSH and FIN); if nothing left, just ACK.
                 */
                }
                /*
                 * If segment ends after window, drop trailing data
                 * (and PUSH and FIN); if nothing left, just ACK.
                 */
-               if (SEQ_GT(ti->ti_seq+ti->ti_len, tp->rcv_nxt+tp->rcv_wnd)) {
-                       todrop =
-                            ti->ti_seq+ti->ti_len - (tp->rcv_nxt+tp->rcv_wnd);
-                       if (todrop > ti->ti_len)
+               todrop = (ti->ti_seq+ti->ti_len) - (tp->rcv_nxt+tp->rcv_wnd);
+               if (todrop > 0) {
+                       if (todrop >= ti->ti_len)
                                goto dropafterack;
                        m_adj(m, -todrop);
                        ti->ti_len -= todrop;
                                goto dropafterack;
                        m_adj(m, -todrop);
                        ti->ti_len -= todrop;
@@ -267,6 +347,16 @@ trimthenstep6:
                }
        }
 
                }
        }
 
+       /*
+        * If a segment is received on a connection after the
+        * user processes are gone, then RST the other end.
+        */
+       if (so->so_state & SS_USERGONE) {
+               tcp_close(tp);
+               tp = 0;
+               goto dropwithreset;
+       }
+
        /*
         * If the RST bit is set examine the state:
         *    SYN_RECEIVED STATE:
        /*
         * If the RST bit is set examine the state:
         *    SYN_RECEIVED STATE:
@@ -278,14 +368,23 @@ trimthenstep6:
         *      Close the tcb.
         */
        if (tiflags&TH_RST) switch (tp->t_state) {
         *      Close the tcb.
         */
        if (tiflags&TH_RST) switch (tp->t_state) {
-               
+
        case TCPS_SYN_RECEIVED:
                if (inp->inp_socket->so_options & SO_ACCEPTCONN) {
        case TCPS_SYN_RECEIVED:
                if (inp->inp_socket->so_options & SO_ACCEPTCONN) {
+                       /* a miniature tcp_close, but invisible to user */
+                       (void) m_free(dtom(tp->t_template));
+                       (void) m_free(dtom(tp));
+                       inp->inp_ppcb = 0;
+                       tp = tcp_newtcpcb(inp);
                        tp->t_state = TCPS_LISTEN;
                        inp->inp_faddr.s_addr = 0;
                        tp->t_state = TCPS_LISTEN;
                        inp->inp_faddr.s_addr = 0;
+                       inp->inp_fport = 0;
+                       inp->inp_laddr.s_addr = 0;      /* not quite right */
+                       tp = 0;
                        goto drop;
                }
                tcp_drop(tp, ECONNREFUSED);
                        goto drop;
                }
                tcp_drop(tp, ECONNREFUSED);
+               tp = 0;
                goto drop;
 
        case TCPS_ESTABLISHED:
                goto drop;
 
        case TCPS_ESTABLISHED:
@@ -293,12 +392,14 @@ trimthenstep6:
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
                tcp_drop(tp, ECONNRESET);
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
                tcp_drop(tp, ECONNRESET);
+               tp = 0;
                goto drop;
 
        case TCPS_CLOSING:
        case TCPS_LAST_ACK:
        case TCPS_TIME_WAIT:
                tcp_close(tp);
                goto drop;
 
        case TCPS_CLOSING:
        case TCPS_LAST_ACK:
        case TCPS_TIME_WAIT:
                tcp_close(tp);
+               tp = 0;
                goto drop;
        }
 
                goto drop;
        }
 
@@ -307,7 +408,8 @@ trimthenstep6:
         * error and we send an RST and drop the connection.
         */
        if (tiflags & TH_SYN) {
         * error and we send an RST and drop the connection.
         */
        if (tiflags & TH_SYN) {
-               tcp_drop(tp, ECONNABORTED);
+               tcp_drop(tp, ECONNRESET);
+               tp = 0;
                goto dropwithreset;
        }
 
                goto dropwithreset;
        }
 
@@ -329,16 +431,24 @@ trimthenstep6:
         */
        case TCPS_SYN_RECEIVED:
                if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
         */
        case TCPS_SYN_RECEIVED:
                if (SEQ_GT(tp->snd_una, ti->ti_ack) ||
-                   SEQ_GT(ti->ti_ack, tp->snd_nxt))
+                   SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropwithreset;
                        goto dropwithreset;
+               tp->snd_una++;                  /* SYN acked */
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
+               tp->t_timer[TCPT_REXMT] = 0;
+               if (so->so_options & SO_ACCEPTCONN)
+                       so->so_state |= SS_CONNAWAITING;
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
                soisconnected(so);
                tp->t_state = TCPS_ESTABLISHED;
+               (void) tcp_reass(tp, (struct tcpiphdr *)0);
+               tp->snd_wl1 = ti->ti_seq - 1;
                /* fall into ... */
 
        /*
         * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
         * ACKs.  If the ack is in the range
                /* fall into ... */
 
        /*
         * In ESTABLISHED state: drop duplicate ACKs; ACK out of range
         * ACKs.  If the ack is in the range
-        *      tp->snd_una < ti->ti_ack <= tp->snd_nxt
+        *      tp->snd_una < ti->ti_ack <= tp->snd_max
         * then advance tp->snd_una to ti->ti_ack and drop
         * data from the retransmission queue.  If this ACK reflects
         * more up to date window information we update our window information.
         * then advance tp->snd_una to ti->ti_ack and drop
         * data from the retransmission queue.  If this ACK reflects
         * more up to date window information we update our window information.
@@ -348,32 +458,52 @@ trimthenstep6:
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
        case TCPS_CLOSING:
        case TCPS_FIN_WAIT_2:
        case TCPS_CLOSE_WAIT:
        case TCPS_CLOSING:
+       case TCPS_LAST_ACK:
+       case TCPS_TIME_WAIT:
 #define        ourfinisacked   (acked > 0)
 
 #define        ourfinisacked   (acked > 0)
 
-               if (SEQ_LT(ti->ti_ack, tp->snd_una))
+               if (SEQ_LEQ(ti->ti_ack, tp->snd_una))
                        break;
                        break;
-               if (SEQ_GT(ti->ti_ack, tp->snd_nxt))
+               if (SEQ_GT(ti->ti_ack, tp->snd_max))
                        goto dropafterack;
                acked = ti->ti_ack - tp->snd_una;
                        goto dropafterack;
                acked = ti->ti_ack - tp->snd_una;
+
+               /*
+                * If transmit timer is running and timed sequence
+                * number was acked, update smoothed round trip time.
+                */
+               if (tp->t_rtt && SEQ_GT(ti->ti_ack, tp->t_rtseq)) {
+                       if (tp->t_srtt == 0)
+                               tp->t_srtt = tp->t_rtt;
+                       else
+                               tp->t_srtt =
+                                   tcp_alpha * tp->t_srtt +
+                                   (1 - tcp_alpha) * tp->t_rtt;
+/* printf("rtt %d srtt*100 now %d\n", tp->t_rtt, (int)(tp->t_srtt*100)); */
+                       tp->t_rtt = 0;
+               }
+
+               if (ti->ti_ack == tp->snd_max)
+                       tp->t_timer[TCPT_REXMT] = 0;
+               else {
+                       TCPT_RANGESET(tp->t_timer[TCPT_REXMT],
+                           tcp_beta * tp->t_srtt, TCPTV_MIN, TCPTV_MAX);
+                       tp->t_rtt = 1;
+                       tp->t_rxtshift = 0;
+               }
                if (acked > so->so_snd.sb_cc) {
                if (acked > so->so_snd.sb_cc) {
-                       sbflush(&so->so_snd);
-                       acked -= so->so_snd.sb_cc;
+                       sbdrop(&so->so_snd, so->so_snd.sb_cc);
+                       tp->snd_wnd -= so->so_snd.sb_cc;
                } else {
                        sbdrop(&so->so_snd, acked);
                } else {
                        sbdrop(&so->so_snd, acked);
+                       tp->snd_wnd -= acked;
                        acked = 0;
                }
                        acked = 0;
                }
-               /* if acked our FIN is acked */
+               if ((so->so_snd.sb_flags & SB_WAIT) || so->so_snd.sb_sel)
+                       sowwakeup(so);
                tp->snd_una = ti->ti_ack;
                tp->snd_una = ti->ti_ack;
-
-               /*
-                * Update window information.
-                */
-               if (SEQ_LT(tp->snd_wl1, ti->ti_seq) ||
-                   tp->snd_wl1==ti->ti_seq && SEQ_LEQ(tp->snd_wl2,ti->ti_seq)) {
-                       tp->snd_wnd = ti->ti_win;
-                       tp->snd_wl1 = ti->ti_seq;
-                       tp->snd_wl2 = ti->ti_ack;
-               }
+               if (SEQ_LT(tp->snd_nxt, tp->snd_una))
+                       tp->snd_nxt = tp->snd_una;
 
                switch (tp->t_state) {
 
 
                switch (tp->t_state) {
 
@@ -383,8 +513,15 @@ trimthenstep6:
                 * then enter FIN_WAIT_2.
                 */
                case TCPS_FIN_WAIT_1:
                 * then enter FIN_WAIT_2.
                 */
                case TCPS_FIN_WAIT_1:
-                       if (ourfinisacked)
+                       if (ourfinisacked) {
+                               /*
+                                * If we can't receive any more
+                                * data, then closing user can proceed.
+                                */
+                               if (so->so_state & SS_CANTRCVMORE)
+                                       soisdisconnected(so);
                                tp->t_state = TCPS_FIN_WAIT_2;
                                tp->t_state = TCPS_FIN_WAIT_2;
+                       }
                        break;
 
                /*
                        break;
 
                /*
@@ -394,9 +531,13 @@ trimthenstep6:
                 * the segment.
                 */
                case TCPS_CLOSING:
                 * the segment.
                 */
                case TCPS_CLOSING:
-                       if (ourfinisacked)
+                       if (ourfinisacked) {
                                tp->t_state = TCPS_TIME_WAIT;
                                tp->t_state = TCPS_TIME_WAIT;
-                       goto drop;
+                               tcp_canceltimers(tp);
+                               tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                               soisdisconnected(so);
+                       }
+                       break;
 
                /*
                 * The only thing that can arrive in  LAST_ACK state
 
                /*
                 * The only thing that can arrive in  LAST_ACK state
@@ -405,8 +546,10 @@ trimthenstep6:
                 * and return.
                 */
                case TCPS_LAST_ACK:
                 * and return.
                 */
                case TCPS_LAST_ACK:
-                       if (ourfinisacked)
+                       if (ourfinisacked) {
                                tcp_close(tp);
                                tcp_close(tp);
+                               tp = 0;
+                       }
                        goto drop;
 
                /*
                        goto drop;
 
                /*
@@ -415,7 +558,7 @@ trimthenstep6:
                 * it and restart the finack timer.
                 */
                case TCPS_TIME_WAIT:
                 * it and restart the finack timer.
                 */
                case TCPS_TIME_WAIT:
-                       tp->t_timer[TCPT_2MSL] = 2 * TCPSC_MSL;
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
                        goto dropafterack;
                }
 #undef ourfinisacked
                        goto dropafterack;
                }
 #undef ourfinisacked
@@ -423,20 +566,52 @@ trimthenstep6:
 
 step6:
        /*
 
 step6:
        /*
-        * If an URG bit is set in the segment and is greater than the
-        * current known urgent pointer, then signal the user that the
-        * remote side has urgent data.  This should not happen
-        * in CLOSE_WAIT, CLOSING, LAST-ACK or TIME_WAIT STATES since
-        * a FIN has been received from the remote side.  In these states
-        * we ignore the URG.
-        */
-       if ((tiflags & TH_URG) == 0 && TCPS_HAVERCVDFIN(tp->t_state) == 0)
-               if (SEQ_GT(ti->ti_urp, tp->rcv_up)) {
-                       tp->rcv_up = ti->ti_urp;
-#if 0
-                       soisurgendata(so);              /* XXX */
+        * Update window information.
+        */
+       if (SEQ_LT(tp->snd_wl1, ti->ti_seq) || tp->snd_wl1 == ti->ti_seq &&
+           (SEQ_LT(tp->snd_wl2, ti->ti_ack) ||
+            tp->snd_wl2 == ti->ti_ack && ti->ti_win > tp->snd_wnd)) {
+               tp->snd_wnd = ti->ti_win;
+               tp->snd_wl1 = ti->ti_seq;
+               tp->snd_wl2 = ti->ti_ack;
+               if (tp->snd_wnd > 0)
+                       tp->t_timer[TCPT_PERSIST] = 0;
+       }
+
+       /*
+        * Process segments with URG.
+        */
+       if ((tiflags & TH_URG) && ti->ti_urp &&
+           TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+               /*
+                * If this segment advances the known urgent pointer,
+                * then mark the data stream.  This should not happen
+                * in CLOSE_WAIT, CLOSING, LAST_ACK or TIME_WAIT STATES since
+                * a FIN has been received from the remote side. 
+                * In these states we ignore the URG.
+                */
+               if (SEQ_GT(ti->ti_seq+ti->ti_urp, tp->rcv_up)) {
+                       tp->rcv_up = ti->ti_seq + ti->ti_urp;
+                       so->so_oobmark = so->so_rcv.sb_cc +
+                           (tp->rcv_up - tp->rcv_nxt) - 1;
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+#ifdef TCPTRUEOOB
+                       if ((tp->t_flags & TF_DOOOB) == 0)
 #endif
 #endif
+                               sohasoutofband(so);
+                       tp->t_oobflags &= ~TCPOOB_HAVEDATA;
+               }
+               /*
+                * Remove out of band data so doesn't get presented to user.
+                * This can happen independent of advancing the URG pointer,
+                * but if two URG's are pending at once, some out-of-band
+                * data may creep in... ick.
+                */
+               if (ti->ti_urp <= ti->ti_len) {
+                       tcp_pulloutofband(so, ti);
                }
                }
+       }
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
 
        /*
         * Process the segment text, merging it into the TCP sequencing queue,
@@ -446,28 +621,28 @@ step6:
         * case PRU_RCVD).  If a FIN has already been received on this
         * connection then we just ignore the text.
         */
         * case PRU_RCVD).  If a FIN has already been received on this
         * connection then we just ignore the text.
         */
-       if (ti->ti_len) {
-               if (TCPS_HAVERCVDFIN(tp->t_state))
-                       goto drop;
-               off += sizeof (struct ip);              /* drop IP header */
-               m->m_off += off;
-               m->m_len -= off;
+       if ((ti->ti_len || (tiflags&TH_FIN)) &&
+           TCPS_HAVERCVDFIN(tp->t_state) == 0) {
                tiflags = tcp_reass(tp, ti);
                tiflags = tcp_reass(tp, ti);
-               tp->t_flags |= TF_ACKNOW;               /* XXX TF_DELACK */
-       } else
+               if (tcpnodelack == 0)
+                       tp->t_flags |= TF_DELACK;
+               else
+                       tp->t_flags |= TF_ACKNOW;
+       } else {
                m_freem(m);
                m_freem(m);
+               tiflags &= ~TH_FIN;
+       }
 
        /*
 
        /*
-        * If FIN is received then if we haven't received SYN and
-        * therefore can't validate drop the segment.  Otherwise ACK
-        * the FIN and let the user know that the connection is closing.
+        * If FIN is received ACK the FIN and let the user know
+        * that the connection is closing.
         */
         */
-       if ((tiflags & TH_FIN)) {
-               if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
-                       goto drop;
-               socantrcvmore(so);
-               tp->t_flags |= TF_ACKNOW;
-               tp->rcv_nxt++;
+       if (tiflags & TH_FIN) {
+               if (TCPS_HAVERCVDFIN(tp->t_state) == 0) {
+                       socantrcvmore(so);
+                       tp->t_flags |= TF_ACKNOW;
+                       tp->rcv_nxt++;
+               }
                switch (tp->t_state) {
 
                /*
                switch (tp->t_state) {
 
                /*
@@ -493,57 +668,189 @@ step6:
                 * standard timers.
                 */
                case TCPS_FIN_WAIT_2:
                 * standard timers.
                 */
                case TCPS_FIN_WAIT_2:
-                       tp->t_state = TCPS_TIME_WAIT;;
+                       tp->t_state = TCPS_TIME_WAIT;
                        tcp_canceltimers(tp);
                        tcp_canceltimers(tp);
-                       tp->t_timer[TCPT_2MSL] = TCPSC_2MSL;
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
+                       soisdisconnected(so);
                        break;
 
                /*
                 * In TIME_WAIT state restart the 2 MSL time_wait timer.
                 */
                case TCPS_TIME_WAIT:
                        break;
 
                /*
                 * In TIME_WAIT state restart the 2 MSL time_wait timer.
                 */
                case TCPS_TIME_WAIT:
-                       tp->t_timer[TCPT_2MSL] = TCPSC_2MSL;
+                       tp->t_timer[TCPT_2MSL] = 2 * TCPTV_MSL;
                        break;
                }
        }
                        break;
                }
        }
+       if (so->so_options & SO_DEBUG)
+               tcp_trace(TA_INPUT, ostate, tp, &tcp_saveti, 0);
 
        /*
         * Return any desired output.
         */
 
        /*
         * Return any desired output.
         */
-       tcp_output(tp);
+       (void) tcp_output(tp);
        return;
 
 dropafterack:
        /*
        return;
 
 dropafterack:
        /*
-        * Generate an ACK, then drop incoming segment.
-        * Make ACK reflect our state.
+        * Generate an ACK dropping incoming segment if it occupies
+        * sequence space, where the ACK reflects our state.
         */
         */
-       if (tiflags & TH_RST)
+       if ((tiflags&TH_RST) ||
+           tlen == 0 && (tiflags&(TH_SYN|TH_FIN)) == 0)
                goto drop;
                goto drop;
-       tcp_respond(ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
-       goto drop;
+       if (tp->t_inpcb->inp_socket->so_options & SO_DEBUG)
+               tcp_trace(TA_RESPOND, ostate, tp, &tcp_saveti, 0);
+       tcp_respond(tp, ti, tp->rcv_nxt, tp->snd_nxt, TH_ACK);
+       return;
 
 dropwithreset:
 
 dropwithreset:
+       if (om)
+               (void) m_free(om);
        /*
        /*
-        * Generate a RST, then drop incoming segment.
+        * Generate a RST, dropping incoming segment.
         * Make ACK acceptable to originator of segment.
         */
        if (tiflags & TH_RST)
                goto drop;
        if (tiflags & TH_ACK)
         * Make ACK acceptable to originator of segment.
         */
        if (tiflags & TH_RST)
                goto drop;
        if (tiflags & TH_ACK)
-               tcp_respond(ti, (tcp_seq)0, ti->ti_ack, TH_RST);
+               tcp_respond(tp, ti, (tcp_seq)0, ti->ti_ack, TH_RST);
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
        else {
                if (tiflags & TH_SYN)
                        ti->ti_len++;
-               tcp_respond(ti, ti->ti_seq+ti->ti_len, (tcp_seq)0, TH_RST|TH_ACK);
+               tcp_respond(tp, ti, ti->ti_seq+ti->ti_len, (tcp_seq)0,
+                   TH_RST|TH_ACK);
        }
        }
-       goto drop;
+       return;
 
 drop:
        /*
         * Drop space held by incoming segment and return.
         */
 
 drop:
        /*
         * Drop space held by incoming segment and return.
         */
+       if (tp && (tp->t_inpcb->inp_socket->so_options & SO_DEBUG))
+               tcp_trace(TA_DROP, ostate, tp, &tcp_saveti, 0);
        m_freem(m);
        m_freem(m);
+       return;
+}
+
+tcp_dooptions(tp, om)
+       struct tcpcb *tp;
+       struct mbuf *om;
+{
+       register u_char *cp;
+       int opt, optlen, cnt;
+
+       cp = mtod(om, u_char *);
+       cnt = om->m_len;
+       for (; cnt > 0; cnt -= optlen, cp += optlen) {
+               opt = cp[0];
+               if (opt == TCPOPT_EOL)
+                       break;
+               if (opt == TCPOPT_NOP)
+                       optlen = 1;
+               else
+                       optlen = cp[1];
+               switch (opt) {
+
+               default:
+                       break;
+
+               case TCPOPT_MAXSEG:
+                       if (optlen != 4)
+                               continue;
+                       tp->t_maxseg = *(u_short *)(cp + 2);
+#if vax || pdp11
+                       tp->t_maxseg = ntohs((u_short)tp->t_maxseg);
+#endif
+                       break;
+                       
+#ifdef TCPTRUEOOB
+               case TCPOPT_WILLOOB:
+                       tp->t_flags |= TF_DOOOB;
+printf("tp %x dooob\n", tp);
+                       break;
+
+               case TCPOPT_OOBDATA: {
+                       int seq;
+                       register struct socket *so = tp->t_inpcb->inp_socket;
+                       tcp_seq mark;
+
+                       if (optlen != 8)
+                               continue;
+                       seq = cp[2];
+                       if (seq < tp->t_iobseq)
+                               seq += 256;
+printf("oobdata cp[2] %d iobseq %d seq %d\n", cp[2], tp->t_iobseq, seq);
+                       if (seq - tp->t_iobseq > 128) {
+printf("bad seq\n");
+                               tp->t_oobflags |= TCPOOB_OWEACK;
+                               break;
+                       }
+                       tp->t_iobseq = cp[2];
+                       tp->t_iobc = cp[3];
+                       mark = *(tcp_seq *)(cp + 4);
+#if vax || pdp11
+                       mark = ntohl(mark);
+#endif
+                       so->so_oobmark = so->so_rcv.sb_cc + (mark-tp->rcv_nxt);
+                       if (so->so_oobmark == 0)
+                               so->so_state |= SS_RCVATMARK;
+printf("take oob data %x input iobseq now %x\n", tp->t_iobc, tp->t_iobseq);
+                       sohasoutofband(so);
+                       break;
+               }
+
+               case TCPOPT_OOBACK: {
+                       int seq;
+
+                       if (optlen != 4)
+                               continue;
+                       if (tp->t_oobseq != cp[2]) {
+printf("wrong ack\n");
+                               break;
+                       }
+printf("take oob ack %x and cancel rexmt\n", cp[2]);
+                       tp->t_oobflags &= ~TCPOOB_NEEDACK;
+                       tp->t_timer[TCPT_OOBREXMT] = 0;
+                       break;
+               }
+#endif TCPTRUEOOB
+               }
+       }
+       (void) m_free(om);
+}
+
+/*
+ * Pull out of band byte out of a segment so
+ * it doesn't appear in the user's data queue.
+ * It is still reflected in the segment length for
+ * sequencing purposes.
+ */
+tcp_pulloutofband(so, ti)
+       struct socket *so;
+       struct tcpiphdr *ti;
+{
+       register struct mbuf *m;
+       int cnt = ti->ti_urp - 1;
+       
+       m = dtom(ti);
+       while (cnt >= 0) {
+               if (m->m_len > cnt) {
+                       char *cp = mtod(m, caddr_t) + cnt;
+                       struct tcpcb *tp = sototcpcb(so);
+
+                       tp->t_iobc = *cp;
+                       tp->t_oobflags |= TCPOOB_HAVEDATA;
+                       bcopy(cp+1, cp, (unsigned)(m->m_len - cnt - 1));
+                       m->m_len--;
+                       return;
+               }
+               cnt -= m->m_len;
+               m = m->m_next;
+               if (m == 0)
+                       break;
+       }
+       panic("tcp_pulloutofband");
 }
 
 /*
 }
 
 /*
@@ -557,19 +864,15 @@ tcp_reass(tp, ti)
 {
        register struct tcpiphdr *q;
        struct socket *so = tp->t_inpcb->inp_socket;
 {
        register struct tcpiphdr *q;
        struct socket *so = tp->t_inpcb->inp_socket;
-       int flags = 0;          /* no FIN */
-       int overage;
-COUNT(TCP_REASS);
+       struct mbuf *m;
+       int flags;
 
        /*
 
        /*
-        * If no data in this segment may want
-        * to move data up to socket structure (if
-        * connection is now established).
+        * Call with ti==0 after become established to
+        * force pre-ESTABLISHED data up to user socket.
         */
         */
-       if (ti->ti_len == 0) {
-               m_freem(dtom(ti));
+       if (ti == 0)
                goto present;
                goto present;
-       }
 
        /*
         * Find a segment which begins after this one does.
 
        /*
         * Find a segment which begins after this one does.
@@ -586,13 +889,13 @@ COUNT(TCP_REASS);
         */
        if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
                register int i;
         */
        if ((struct tcpiphdr *)q->ti_prev != (struct tcpiphdr *)tp) {
                register int i;
-               q = (struct tcpiphdr *)(q->ti_prev);
+               q = (struct tcpiphdr *)q->ti_prev;
                /* conversion to int (in i) handles seq wraparound */
                i = q->ti_seq + q->ti_len - ti->ti_seq;
                if (i > 0) {
                        if (i >= ti->ti_len)
                                goto drop;
                /* conversion to int (in i) handles seq wraparound */
                i = q->ti_seq + q->ti_len - ti->ti_seq;
                if (i > 0) {
                        if (i >= ti->ti_len)
                                goto drop;
-                       m_adj(dtom(tp), i);
+                       m_adj(dtom(ti), i);
                        ti->ti_len -= i;
                        ti->ti_seq += i;
                }
                        ti->ti_len -= i;
                        ti->ti_seq += i;
                }
@@ -603,80 +906,53 @@ COUNT(TCP_REASS);
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
         * While we overlap succeeding segments trim them or,
         * if they are completely covered, dequeue them.
         */
-       while (q != (struct tcpiphdr *)tp &&
-           SEQ_GT(ti->ti_seq + ti->ti_len, q->ti_seq)) {
+       while (q != (struct tcpiphdr *)tp) {
                register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
                register int i = (ti->ti_seq + ti->ti_len) - q->ti_seq;
+               if (i <= 0)
+                       break;
                if (i < q->ti_len) {
                if (i < q->ti_len) {
+                       q->ti_seq += i;
                        q->ti_len -= i;
                        m_adj(dtom(q), i);
                        break;
                }
                q = (struct tcpiphdr *)q->ti_next;
                        q->ti_len -= i;
                        m_adj(dtom(q), i);
                        break;
                }
                q = (struct tcpiphdr *)q->ti_next;
-               m_freem(dtom(q->ti_prev));
+               m = dtom(q->ti_prev);
                remque(q->ti_prev);
                remque(q->ti_prev);
+               m_freem(m);
        }
 
        /*
         * Stick new segment in its place.
         */
        insque(ti, q->ti_prev);
        }
 
        /*
         * Stick new segment in its place.
         */
        insque(ti, q->ti_prev);
-       tp->t_seqcnt += ti->ti_len;
-
-       /*
-        * Calculate available space and discard segments for
-        * which there is too much.
-        */
-       overage = 
-           (so->so_rcv.sb_cc + tp->t_seqcnt) - so->so_rcv.sb_hiwat;
-       if (overage > 0) {
-               q = tp->seg_prev;
-               for (;;) {
-                       register int i = MIN(q->ti_len, overage);
-                       overage -= i;
-                       tp->t_seqcnt -= i;
-                       q->ti_len -= i;
-                       m_adj(dtom(q), -i);
-                       if (q->ti_len)
-                               break;
-                       if (q == ti)
-                               panic("tcp_reass dropall");
-                       q = (struct tcpiphdr *)q->ti_prev;
-                       remque(q->ti_next);
-               }
-       }
-
-       /*
-        * Advance rcv_next through newly completed sequence space.
-        */
-       while (ti->ti_seq == tp->rcv_nxt) {
-               tp->rcv_nxt += ti->ti_len;
-               flags = ti->ti_flags & TH_FIN;
-               ti = (struct tcpiphdr *)ti->ti_next;
-               if (ti == (struct tcpiphdr *)tp)
-                       break;
-       }
 
 present:
        /*
 
 present:
        /*
-        * Present data to user.
+        * Present data to user, advancing rcv_nxt through
+        * completed sequence space.
         */
         */
-       if (tp->t_state < TCPS_ESTABLISHED)
-               return (flags);
+       if (TCPS_HAVERCVDSYN(tp->t_state) == 0)
+               return (0);
        ti = tp->seg_next;
        ti = tp->seg_next;
-       while (ti != (struct tcpiphdr *)tp && ti->ti_seq < tp->rcv_nxt) {
+       if (ti == (struct tcpiphdr *)tp || ti->ti_seq != tp->rcv_nxt)
+               return (0);
+       if (tp->t_state == TCPS_SYN_RECEIVED && ti->ti_len)
+               return (0);
+       do {
+               tp->rcv_nxt += ti->ti_len;
+               flags = ti->ti_flags & TH_FIN;
                remque(ti);
                remque(ti);
-               sbappend(&so->so_rcv, dtom(ti));
-               tp->t_seqcnt -= ti->ti_len;
-               if (tp->t_seqcnt < 0)
-                       panic("tcp_reass");
+               m = dtom(ti);
                ti = (struct tcpiphdr *)ti->ti_next;
                ti = (struct tcpiphdr *)ti->ti_next;
-       }
-       if (so->so_state & SS_CANTRCVMORE)
-               sbflush(&so->so_rcv);
-       else
-               sorwakeup(so);
+               if (so->so_state & SS_CANTRCVMORE)
+                       m_freem(m);
+               else
+                       sbappend(&so->so_rcv, m);
+       } while (ti != (struct tcpiphdr *)tp && ti->ti_seq == tp->rcv_nxt);
+       sorwakeup(so);
        return (flags);
 drop:
        m_freem(dtom(ti));
        return (flags);
 drop:
        m_freem(dtom(ti));
-       return (flags);
+       return (0);
 }
 }