All qlocks are initialized
[akaros.git] / kern / src / net / tcp.c
1 // INFERNO
2 #include <vfs.h>
3 #include <kfs.h>
4 #include <slab.h>
5 #include <kmalloc.h>
6 #include <kref.h>
7 #include <string.h>
8 #include <stdio.h>
9 #include <assert.h>
10 #include <error.h>
11 #include <cpio.h>
12 #include <pmap.h>
13 #include <smp.h>
14 #include <ip.h>
15
16 #include <vfs.h>
17 #include <kfs.h>
18 #include <slab.h>
19 #include <kmalloc.h>
20 #include <kref.h>
21 #include <string.h>
22 #include <stdio.h>
23 #include <assert.h>
24 #include <error.h>
25 #include <cpio.h>
26 #include <pmap.h>
27 #include <smp.h>
28 #include <ip.h>
29
30 enum
31 {
32         QMAX            = 64*1024-1,
33         IP_TCPPROTO     = 6,
34
35         TCP4_IPLEN      = 8,
36         TCP4_PHDRSIZE   = 12,
37         TCP4_HDRSIZE    = 20,
38         TCP4_TCBPHDRSZ  = 40,
39         TCP4_PKT        = TCP4_IPLEN+TCP4_PHDRSIZE,
40
41         TCP6_IPLEN      = 0,
42         TCP6_PHDRSIZE   = 40,
43         TCP6_HDRSIZE    = 20,
44         TCP6_TCBPHDRSZ  = 60,
45         TCP6_PKT        = TCP6_IPLEN+TCP6_PHDRSIZE,
46
47         TcptimerOFF     = 0,
48         TcptimerON      = 1,
49         TcptimerDONE    = 2,
50         MAX_TIME        = (1<<20),      /* Forever */
51         TCP_ACK         = 50,           /* Timed ack sequence in ms */
52         MAXBACKMS       = 9*60*1000,    /* longest backoff time (ms) before hangup */
53
54         URG             = 0x20,         /* Data marked urgent */
55         ACK             = 0x10,         /* Acknowledge is valid */
56         PSH             = 0x08,         /* Whole data pipe is pushed */
57         RST             = 0x04,         /* Reset connection */
58         SYN             = 0x02,         /* Pkt. is synchronise */
59         FIN             = 0x01,         /* Start close down */
60
61         EOLOPT          = 0,
62         NOOPOPT         = 1,
63         MSSOPT          = 2,
64         MSS_LENGTH      = 4,            /* Mean segment size */
65         WSOPT           = 3,
66         WS_LENGTH       = 3,            /* Bits to scale window size by */
67         MSL2            = 10,
68         MSPTICK         = 50,           /* Milliseconds per timer tick */
69         DEF_MSS         = 1460,         /* Default mean segment */
70         DEF_MSS6        = 1280,         /* Default mean segment (min) for v6 */
71         DEF_RTT         = 500,          /* Default round trip */
72         DEF_KAT         = 120000,       /* Default time (ms) between keep alives */
73         TCP_LISTEN      = 0,            /* Listen connection */
74         TCP_CONNECT     = 1,            /* Outgoing connection */
75         SYNACK_RXTIMER  = 250,          /* ms between SYNACK retransmits */
76
77         TCPREXMTTHRESH  = 3,            /* dupack threshhold for rxt */
78
79         FORCE           = 1,
80         CLONE           = 2,
81         RETRAN          = 4,
82         ACTIVE          = 8,
83         SYNACK          = 16,
84
85         LOGAGAIN        = 3,
86         LOGDGAIN        = 2,
87
88         Closed          = 0,            /* Connection states */
89         Listen,
90         Syn_sent,
91         Syn_received,
92         Established,
93         Finwait1,
94         Finwait2,
95         Close_wait,
96         Closing,
97         Last_ack,
98         Time_wait,
99
100         Maxlimbo        = 1000,         /* maximum procs waiting for response to SYN ACK */
101         NLHT            = 256,          /* hash table size, must be a power of 2 */
102         LHTMASK         = NLHT-1,
103
104         HaveWS          = 1<<8,
105 };
106
107 /* Must correspond to the enumeration above */
108 char *tcpstates[] =
109 {
110         "Closed",       "Listen",       "Syn_sent", "Syn_received",
111         "Established",  "Finwait1",     "Finwait2", "Close_wait",
112         "Closing",      "Last_ack",     "Time_wait"
113 };
114
115 typedef struct Tcptimer Tcptimer;
116 struct Tcptimer
117 {
118         Tcptimer        *next;
119         Tcptimer        *prev;
120         Tcptimer        *readynext;
121         int     state;
122         int     start;
123         int     count;
124         void    (*func)(void*);
125         void    *arg;
126 };
127
128 /*
129  *  v4 and v6 pseudo headers used for
130  *  checksuming tcp
131  */
132 typedef struct Tcp4hdr Tcp4hdr;
133 struct Tcp4hdr
134 {
135         uint8_t vihl;           /* Version and header length */
136         uint8_t tos;            /* Type of service */
137         uint8_t length[2];      /* packet length */
138         uint8_t id[2];          /* Identification */
139         uint8_t frag[2];        /* Fragment information */
140         uint8_t Unused;
141         uint8_t proto;
142         uint8_t tcplen[2];
143         uint8_t tcpsrc[4];
144         uint8_t tcpdst[4];
145         uint8_t tcpsport[2];
146         uint8_t tcpdport[2];
147         uint8_t tcpseq[4];
148         uint8_t tcpack[4];
149         uint8_t tcpflag[2];
150         uint8_t tcpwin[2];
151         uint8_t tcpcksum[2];
152         uint8_t tcpurg[2];
153         /* Options segment */
154         uint8_t tcpopt[1];
155 };
156
157 typedef struct Tcp6hdr Tcp6hdr;
158 struct Tcp6hdr
159 {
160         uint8_t vcf[4];
161         uint8_t ploadlen[2];
162         uint8_t proto;
163         uint8_t ttl;
164         uint8_t tcpsrc[IPaddrlen];
165         uint8_t tcpdst[IPaddrlen];
166         uint8_t tcpsport[2];
167         uint8_t tcpdport[2];
168         uint8_t tcpseq[4];
169         uint8_t tcpack[4];
170         uint8_t tcpflag[2];
171         uint8_t tcpwin[2];
172         uint8_t tcpcksum[2];
173         uint8_t tcpurg[2];
174         /* Options segment */
175         uint8_t tcpopt[1];
176 };
177
178 /*
179  *  this represents the control info
180  *  for a single packet.  It is derived from
181  *  a packet in ntohtcp{4,6}() and stuck into
182  *  a packet in htontcp{4,6}().
183  */
184 typedef struct Tcp Tcp;
185 struct  Tcp
186 {
187         uint16_t        source;
188         uint16_t        dest;
189         uint32_t        seq;
190         uint32_t        ack;
191         uint8_t flags;
192         uint16_t        ws;     /* window scale option (if not zero) */
193         uint32_t        wnd;
194         uint16_t        urg;
195         uint16_t        mss;    /* max segment size option (if not zero) */
196         uint16_t        len;    /* size of data */
197 };
198
199 /*
200  *  this header is malloc'd to thread together fragments
201  *  waiting to be coalesced
202  */
203 typedef struct Reseq Reseq;
204 struct Reseq
205 {
206         Reseq   *next;
207         Tcp     seg;
208         struct block    *bp;
209         uint16_t        length;
210 };
211
212 /*
213  *  the qlock in the Conv locks this structure
214  */
215 typedef struct Tcpctl Tcpctl;
216 struct Tcpctl
217 {
218         uint8_t state;                  /* Connection state */
219         uint8_t type;                   /* Listening or active connection */
220         uint8_t code;                   /* Icmp code */
221         struct {
222                 uint32_t        una;            /* Unacked data pointer */
223                 uint32_t        nxt;            /* Next sequence expected */
224                 uint32_t        ptr;            /* Data pointer */
225                 uint32_t        wnd;            /* Tcp send window */
226                 uint32_t        urg;            /* Urgent data pointer */
227                 uint32_t        wl2;
228                 int     scale;          /* how much to right shift window in xmitted packets */
229                 /* to implement tahoe and reno TCP */
230                 uint32_t        dupacks;        /* number of duplicate acks rcvd */
231                 int     recovery;       /* loss recovery flag */
232                 uint32_t        rxt;            /* right window marker for recovery */
233         } snd;
234         struct {
235                 uint32_t        nxt;            /* Receive pointer to next uint8_t slot */
236                 uint32_t        wnd;            /* Receive window incoming */
237                 uint32_t        urg;            /* Urgent pointer */
238                 int     blocked;
239                 int     una;            /* unacked data segs */
240                 int     scale;          /* how much to left shift window in rcved packets */
241         } rcv;
242         uint32_t        iss;                    /* Initial sequence number */
243         int     sawwsopt;               /* true if we saw a wsopt on the incoming SYN */
244         uint32_t        cwind;                  /* Congestion window */
245         int     scale;                  /* desired snd.scale */
246         uint16_t        ssthresh;               /* Slow start threshold */
247         int     resent;                 /* Bytes just resent */
248         int     irs;                    /* Initial received squence */
249         uint16_t        mss;                    /* Mean segment size */
250         int     rerecv;                 /* Overlap of data rerecevived */
251         uint32_t        window;                 /* Recevive window */
252         uint8_t backoff;                /* Exponential backoff counter */
253         int     backedoff;              /* ms we've backed off for rexmits */
254         uint8_t flags;                  /* State flags */
255         Reseq   *reseq;                 /* Resequencing queue */
256         Tcptimer        timer;                  /* Activity timer */
257         Tcptimer        acktimer;               /* Acknowledge timer */
258         Tcptimer        rtt_timer;              /* Round trip timer */
259         Tcptimer        katimer;                /* keep alive timer */
260         uint32_t        rttseq;                 /* Round trip sequence */
261         int     srtt;                   /* Shortened round trip */
262         int     mdev;                   /* Mean deviation of round trip */
263         int     kacounter;              /* count down for keep alive */
264         unsigned int    sndsyntime;             /* time syn sent */
265         uint32_t        time;                   /* time Finwait2 or Syn_received was sent */
266         int     nochecksum;             /* non-zero means don't send checksums */
267         int     flgcnt;                 /* number of flags in the sequence (FIN,SEQ) */
268
269         union {
270                 Tcp4hdr tcp4hdr;
271                 Tcp6hdr tcp6hdr;
272         } protohdr;             /* prototype header */
273 };
274
275 /*
276  *  New calls are put in limbo rather than having a conversation structure
277  *  allocated.  Thus, a SYN attack results in lots of limbo'd calls but not
278  *  any real Conv structures mucking things up.  Calls in limbo rexmit their
279  *  SYN ACK every SYNACK_RXTIMER ms up to 4 times, i.e., they disappear after 1 second.
280  *
281  *  In particular they aren't on a listener's queue so that they don't figure
282  *  in the input queue limit.
283  *
284  *  If 1/2 of a T3 was attacking SYN packets, we'ld have a permanent queue
285  *  of 70000 limbo'd calls.  Not great for a linear list but doable.  Therefore
286  *  there is no hashing of this list.
287  */
288 typedef struct Limbo Limbo;
289 struct Limbo
290 {
291         Limbo   *next;
292
293         uint8_t laddr[IPaddrlen];
294         uint8_t raddr[IPaddrlen];
295         uint16_t        lport;
296         uint16_t        rport;
297         uint32_t        irs;            /* initial received sequence */
298         uint32_t        iss;            /* initial sent sequence */
299         uint16_t        mss;            /* mss from the other end */
300         uint16_t        rcvscale;       /* how much to scale rcvd windows */
301         uint16_t        sndscale;       /* how much to scale sent windows */
302         uint32_t        lastsend;       /* last time we sent a synack */
303         uint8_t version;        /* v4 or v6 */
304         uint8_t rexmits;        /* number of retransmissions */
305 };
306
307 int     tcp_irtt = DEF_RTT;     /* Initial guess at round trip time */
308 uint16_t        tcp_mss = DEF_MSS;      /* Maximum segment size to be sent */
309
310 enum {
311         /* MIB stats */
312         MaxConn,
313         ActiveOpens,
314         PassiveOpens,
315         EstabResets,
316         CurrEstab,
317         InSegs,
318         OutSegs,
319         RetransSegs,
320         RetransTimeouts,
321         InErrs,
322         OutRsts,
323
324         /* non-MIB stats */
325         CsumErrs,
326         HlenErrs,
327         LenErrs,
328         OutOfOrder,
329
330         Nstats
331 };
332
333 static char *statnames[] =
334 {
335 [MaxConn]       "MaxConn",
336 [ActiveOpens]   "ActiveOpens",
337 [PassiveOpens]  "PassiveOpens",
338 [EstabResets]   "EstabResets",
339 [CurrEstab]     "CurrEstab",
340 [InSegs]        "InSegs",
341 [OutSegs]       "OutSegs",
342 [RetransSegs]   "RetransSegs",
343 [RetransTimeouts]       "RetransTimeouts",
344 [InErrs]        "InErrs",
345 [OutRsts]       "OutRsts",
346 [CsumErrs]      "CsumErrs",
347 [HlenErrs]      "HlenErrs",
348 [LenErrs]       "LenErrs",
349 [OutOfOrder]    "OutOfOrder",
350 };
351
352 typedef struct Tcppriv Tcppriv;
353 struct tcppriv
354 {
355         /* List of active timers */
356         qlock_t         tl;
357         Tcptimer *timers;
358
359         /* hash table for matching conversations */
360         struct Ipht     ht;
361
362         /* calls in limbo waiting for an ACK to our SYN ACK */
363         int     nlimbo;
364         Limbo   *lht[NLHT];
365
366         /* for keeping track of tcpackproc */
367         qlock_t apl;
368         int     ackprocstarted;
369
370         uint32_t        stats[Nstats];
371 };
372
373 /*
374  *  Setting tcpporthogdefense to non-zero enables Dong Lin's
375  *  solution to hijacked systems staking out port's as a form
376  *  of DoS attack.
377  *
378  *  To avoid stateless Conv hogs, we pick a sequence number at random.  If
379  *  it that number gets acked by the other end, we shut down the connection.
380  *  Look for tcpporthogedefense in the code.
381  */
382 int tcpporthogdefense = 0;
383
384 int     addreseq(Tcpctl*, struct tcppriv*, Tcp*, struct block*, uint16_t);
385 void    getreseq(Tcpctl*, Tcp*, struct block**, uint16_t*);
386 void    localclose(struct conv*, char *unused_char_p_t);
387 void    procsyn(struct conv*, Tcp*);
388 void    tcpiput(struct Proto*, struct Ipifc*, struct block*);
389 void    tcpoutput(struct conv*);
390 int     tcptrim(Tcpctl*, Tcp*, struct block**, uint16_t*);
391 void    tcpstart(struct conv*, int);
392 void    tcptimeout(void*);
393 void    tcpsndsyn(struct conv*, Tcpctl*);
394 void    tcprcvwin(struct conv*);
395 void    tcpacktimer(void*);
396 void    tcpkeepalive(void*);
397 void    tcpsetkacounter(Tcpctl*);
398 void    tcprxmit(struct conv*);
399 void    tcpsettimer(Tcpctl*);
400 void    tcpsynackrtt(struct conv*);
401 void    tcpsetscale(struct conv*, Tcpctl*, uint16_t, uint16_t);
402
403 static void limborexmit(struct Proto*);
404 static void limbo(struct conv*, uint8_t *unused_uint8_p_t, uint8_t*, Tcp*, int);
405
406 void
407 tcpsetstate(struct conv *s, uint8_t newstate)
408 {
409         Tcpctl *tcb;
410         uint8_t oldstate;
411         struct tcppriv *tpriv;
412
413         tpriv = s->p->priv;
414
415         tcb = (Tcpctl*)s->ptcl;
416
417         oldstate = tcb->state;
418         if(oldstate == newstate)
419                 return;
420
421         if(oldstate == Established)
422                 tpriv->stats[CurrEstab]--;
423         if(newstate == Established)
424                 tpriv->stats[CurrEstab]++;
425
426         /**
427         print( "%d/%d %s->%s CurrEstab=%d\n", s->lport, s->rport,
428                 tcpstates[oldstate], tcpstates[newstate], tpriv->tstats.tcpCurrEstab );
429         **/
430
431         switch(newstate) {
432         case Closed:
433                 qclose(s->rq);
434                 qclose(s->wq);
435                 qclose(s->eq);
436                 break;
437
438         case Close_wait:                /* Remote closes */
439                 qhangup(s->rq, NULL);
440                 break;
441         }
442
443         tcb->state = newstate;
444
445         if(oldstate == Syn_sent && newstate != Closed)
446                 Fsconnected(s, NULL);
447 }
448
449 static char*
450 tcpconnect(struct conv *c, char **argv, int argc)
451 {
452         char *e;
453
454         e = Fsstdconnect(c, argv, argc);
455         if(e != NULL)
456                 return e;
457         tcpstart(c, TCP_CONNECT);
458
459         return NULL;
460 }
461
462 static int
463 tcpstate(struct conv *c, char *state, int n)
464 {
465         Tcpctl *s;
466
467         s = (Tcpctl*)(c->ptcl);
468
469         return snprintf(state, n,
470                 "%s qin %d qout %d srtt %d mdev %d cwin %lud swin %lud>>%d rwin %lud>>%d timer.start %d timer.count %d rerecv %d katimer.start %d katimer.count %d\n",
471                 tcpstates[s->state],
472                 c->rq ? qlen(c->rq) : 0,
473                 c->wq ? qlen(c->wq) : 0,
474                 s->srtt, s->mdev,
475                 s->cwind, s->snd.wnd, s->rcv.scale, s->rcv.wnd, s->snd.scale,
476                 s->timer.start, s->timer.count, s->rerecv,
477                 s->katimer.start, s->katimer.count);
478 }
479
480 static int
481 tcpinuse(struct conv *c)
482 {
483         Tcpctl *s;
484
485         s = (Tcpctl*)(c->ptcl);
486         return s->state != Closed;
487 }
488
489 static char*
490 tcpannounce(struct conv *c, char **argv, int argc)
491 {
492         char *e;
493
494         e = Fsstdannounce(c, argv, argc);
495         if(e != NULL)
496                 return e;
497         tcpstart(c, TCP_LISTEN);
498         Fsconnected(c, NULL);
499
500         return NULL;
501 }
502
503 /*
504  *  tcpclose is always called with the q locked
505  */
506 static void
507 tcpclose(struct conv *c)
508 {
509         Tcpctl *tcb;
510
511         tcb = (Tcpctl*)c->ptcl;
512
513         qhangup(c->rq, NULL);
514         qhangup(c->wq, NULL);
515         qhangup(c->eq, NULL);
516         qflush(c->rq);
517
518         switch(tcb->state) {
519         case Listen:
520                 /*
521                  *  reset any incoming calls to this listener
522                  */
523                 Fsconnected(c, "Hangup");
524
525                 localclose(c, NULL);
526                 break;
527         case Closed:
528         case Syn_sent:
529                 localclose(c, NULL);
530                 break;
531         case Syn_received:
532         case Established:
533                 tcb->flgcnt++;
534                 tcb->snd.nxt++;
535                 tcpsetstate(c, Finwait1);
536                 tcpoutput(c);
537                 break;
538         case Close_wait:
539                 tcb->flgcnt++;
540                 tcb->snd.nxt++;
541                 tcpsetstate(c, Last_ack);
542                 tcpoutput(c);
543                 break;
544         }
545 }
546
547 void
548 tcpkick(void *x)
549 {
550         ERRSTACK(1);
551         struct conv *s = x;
552         Tcpctl *tcb;
553
554         tcb = (Tcpctl*)s->ptcl;
555
556         if(waserror()){
557                 qunlock(&s->qlock);
558                 nexterror();
559         }
560         qlock(&s->qlock);
561
562         switch(tcb->state) {
563         case Syn_sent:
564         case Syn_received:
565         case Established:
566         case Close_wait:
567                 /*
568                  * Push data
569                  */
570                 tcprcvwin(s);
571                 tcpoutput(s);
572                 break;
573         default:
574                 localclose(s, "Hangup");
575                 break;
576         }
577
578         qunlock(&s->qlock);
579         poperror();
580 }
581
582 void
583 tcprcvwin(struct conv *s)                               /* Call with tcb locked */
584 {
585         int w;
586         Tcpctl *tcb;
587
588         tcb = (Tcpctl*)s->ptcl;
589         w = tcb->window - qlen(s->rq);
590         if(w < 0)
591                 w = 0;
592         tcb->rcv.wnd = w;
593         if(w == 0)
594                 tcb->rcv.blocked = 1;
595 }
596
597 void
598 tcpacktimer(void *v)
599 {
600         ERRSTACK(1);
601         Tcpctl *tcb;
602         struct conv *s;
603
604         s = v;
605         tcb = (Tcpctl*)s->ptcl;
606
607         if(waserror()){
608                 qunlock(&s->qlock);
609                 nexterror();
610         }
611         qlock(&s->qlock);
612         if(tcb->state != Closed){
613                 tcb->flags |= FORCE;
614                 tcprcvwin(s);
615                 tcpoutput(s);
616         }
617         qunlock(&s->qlock);
618         poperror();
619 }
620
621 static void
622 tcpcreate(struct conv *c)
623 {
624         c->rq = qopen(QMAX, Qcoalesce, tcpacktimer, c);
625         c->wq = qopen((3*QMAX)/2, Qkick, tcpkick, c);
626 }
627
628 static void
629 timerstate(struct tcppriv *priv, Tcptimer *t, int newstate)
630 {
631         if(newstate != TcptimerON){
632                 if(t->state == TcptimerON){
633                         // unchain
634                         if(priv->timers == t){
635                                 priv->timers = t->next;
636                                 if(t->prev != NULL)
637                                         panic("timerstate1");
638                         }
639                         if(t->next)
640                                 t->next->prev = t->prev;
641                         if(t->prev)
642                                 t->prev->next = t->next;
643                         t->next = t->prev = NULL;
644                 }
645         } else {
646                 if(t->state != TcptimerON){
647                         // chain
648                         if(t->prev != NULL || t->next != NULL)
649                                 panic("timerstate2");
650                         t->prev = NULL;
651                         t->next = priv->timers;
652                         if(t->next)
653                                 t->next->prev = t;
654                         priv->timers = t;
655                 }
656         }
657         t->state = newstate;
658 }
659
660 void
661 tcpackproc(void *a)
662 {
663         ERRSTACK(1);
664         Tcptimer *t, *tp, *timeo;
665         struct Proto *tcp;
666         struct tcppriv *priv;
667         int loop;
668
669         tcp = a;
670         priv = tcp->priv;
671
672         for(;;) {
673                 udelay_sched(MSPTICK * 1000);
674
675                 qlock(&priv->tl);
676                 timeo = NULL;
677                 loop = 0;
678                 for(t = priv->timers; t != NULL; t = tp) {
679                         if(loop++ > 10000)
680                                 panic("tcpackproc1");
681                         tp = t->next;
682                         if(t->state == TcptimerON) {
683                                 t->count--;
684                                 if(t->count == 0) {
685                                         timerstate(priv, t, TcptimerDONE);
686                                         t->readynext = timeo;
687                                         timeo = t;
688                                 }
689                         }
690                 }
691                 qunlock(&priv->tl);
692
693                 loop = 0;
694                 for(t = timeo; t != NULL; t = t->readynext) {
695                         if(loop++ > 10000)
696                                 panic("tcpackproc2");
697                         if(t->state == TcptimerDONE && t->func != NULL) {
698                                 /* discard error style */
699                                 if (!waserror())
700                                         (*t->func)(t->arg);
701                                 poperror();
702                         }
703                 }
704
705                 limborexmit(tcp);
706         }
707 }
708
709 void
710 tcpgo(struct tcppriv *priv, Tcptimer *t)
711 {
712         if(t == NULL || t->start == 0)
713                 return;
714
715         qlock(&priv->tl);
716         t->count = t->start;
717         timerstate(priv, t, TcptimerON);
718         qunlock(&priv->tl);
719 }
720
721 void
722 tcphalt(struct tcppriv *priv, Tcptimer *t)
723 {
724         if(t == NULL)
725                 return;
726
727         qlock(&priv->tl);
728         timerstate(priv, t, TcptimerOFF);
729         qunlock(&priv->tl);
730 }
731
732 int
733 backoff(int n)
734 {
735         return 1 << n;
736 }
737
738 void
739 localclose(struct conv *s, char *reason)        /* called with tcb locked */
740 {
741         Tcpctl *tcb;
742         Reseq *rp,*rp1;
743         struct tcppriv *tpriv;
744
745         tpriv = s->p->priv;
746         tcb = (Tcpctl*)s->ptcl;
747
748         iphtrem(&tpriv->ht, s);
749
750         tcphalt(tpriv, &tcb->timer);
751         tcphalt(tpriv, &tcb->rtt_timer);
752         tcphalt(tpriv, &tcb->acktimer);
753         tcphalt(tpriv, &tcb->katimer);
754
755         /* Flush reassembly queue; nothing more can arrive */
756         for(rp = tcb->reseq; rp != NULL; rp = rp1) {
757                 rp1 = rp->next;
758                 freeblist(rp->bp);
759                 kfree(rp);
760         }
761         tcb->reseq = NULL;
762
763         if(tcb->state == Syn_sent)
764                 Fsconnected(s, reason);
765         if(s->state == Announced)
766                 rendez_wakeup(&s->listenr);
767
768         qhangup(s->rq, reason);
769         qhangup(s->wq, reason);
770
771         tcpsetstate(s, Closed);
772 }
773
774 /* mtu (- TCP + IP hdr len) of 1st hop */
775 int
776 tcpmtu(struct Proto *tcp, uint8_t *addr, int version, int *scale)
777 {
778         struct Ipifc *ifc;
779         int mtu;
780
781         ifc = findipifc(tcp->f, addr, 0);
782         switch(version){
783         default:
784         case V4:
785                 mtu = DEF_MSS;
786                 if(ifc != NULL)
787                         mtu = ifc->maxtu - ifc->m->hsize - (TCP4_PKT + TCP4_HDRSIZE);
788                 break;
789         case V6:
790                 mtu = DEF_MSS6;
791                 if(ifc != NULL)
792                         mtu = ifc->maxtu - ifc->m->hsize - (TCP6_PKT + TCP6_HDRSIZE);
793                 break;
794         }
795         if(ifc != NULL){
796                 if(ifc->mbps > 100)
797                         *scale = HaveWS | 3;
798                 else if(ifc->mbps > 10)
799                         *scale = HaveWS | 1;
800                 else
801                         *scale = HaveWS | 0;
802         } else
803                 *scale = HaveWS | 0;
804
805         return mtu;
806 }
807
808 void
809 inittcpctl(struct conv *s, int mode)
810 {
811         Tcpctl *tcb;
812         Tcp4hdr* h4;
813         Tcp6hdr* h6;
814         int mss;
815
816         tcb = (Tcpctl*)s->ptcl;
817
818         memset(tcb, 0, sizeof(Tcpctl));
819
820         tcb->ssthresh = 65535;
821         tcb->srtt = tcp_irtt<<LOGAGAIN;
822         tcb->mdev = 0;
823
824         /* setup timers */
825         tcb->timer.start = tcp_irtt / MSPTICK;
826         tcb->timer.func = tcptimeout;
827         tcb->timer.arg = s;
828         tcb->rtt_timer.start = MAX_TIME;
829         tcb->acktimer.start = TCP_ACK / MSPTICK;
830         tcb->acktimer.func = tcpacktimer;
831         tcb->acktimer.arg = s;
832         tcb->katimer.start = DEF_KAT / MSPTICK;
833         tcb->katimer.func = tcpkeepalive;
834         tcb->katimer.arg = s;
835
836         mss = DEF_MSS;
837
838         /* create a prototype(pseudo) header */
839         if(mode != TCP_LISTEN){
840                 if(ipcmp(s->laddr, IPnoaddr) == 0)
841                         findlocalip(s->p->f, s->laddr, s->raddr);
842
843                 switch(s->ipversion){
844                 case V4:
845                         h4 = &tcb->protohdr.tcp4hdr;
846                         memset(h4, 0, sizeof(*h4));
847                         h4->proto = IP_TCPPROTO;
848                         hnputs(h4->tcpsport, s->lport);
849                         hnputs(h4->tcpdport, s->rport);
850                         v6tov4(h4->tcpsrc, s->laddr);
851                         v6tov4(h4->tcpdst, s->raddr);
852                         break;
853                 case V6:
854                         h6 = &tcb->protohdr.tcp6hdr;
855                         memset(h6, 0, sizeof(*h6));
856                         h6->proto = IP_TCPPROTO;
857                         hnputs(h6->tcpsport, s->lport);
858                         hnputs(h6->tcpdport, s->rport);
859                         ipmove(h6->tcpsrc, s->laddr);
860                         ipmove(h6->tcpdst, s->raddr);
861                         mss = DEF_MSS6;
862                         break;
863                 default:
864                         panic("inittcpctl: version %d", s->ipversion);
865                 }
866         }
867
868         tcb->mss = tcb->cwind = mss;
869
870         /* default is no window scaling */
871         tcb->window = QMAX;
872         tcb->rcv.wnd = QMAX;
873         tcb->rcv.scale = 0;
874         tcb->snd.scale = 0;
875         qsetlimit(s->rq, QMAX);
876 }
877
878 /*
879  *  called with s qlocked
880  */
881 void
882 tcpstart(struct conv *s, int mode)
883 {
884         Tcpctl *tcb;
885         struct tcppriv *tpriv;
886         char kpname[KNAMELEN];
887
888         tpriv = s->p->priv;
889
890         if(tpriv->ackprocstarted == 0){
891                 qlock(&tpriv->apl);
892                 if(tpriv->ackprocstarted == 0){
893                         snprintf(kpname, sizeof(kpname), "#I%dtcpack", s->p->f->dev);
894                         ktask(kpname, tcpackproc, s->p);
895                         tpriv->ackprocstarted = 1;
896                 }
897                 qunlock(&tpriv->apl);
898         }
899
900         tcb = (Tcpctl*)s->ptcl;
901
902         inittcpctl(s, mode);
903
904         iphtadd(&tpriv->ht, s);
905         switch(mode) {
906         case TCP_LISTEN:
907                 tpriv->stats[PassiveOpens]++;
908                 tcb->flags |= CLONE;
909                 tcpsetstate(s, Listen);
910                 break;
911
912         case TCP_CONNECT:
913                 tpriv->stats[ActiveOpens]++;
914                 tcb->flags |= ACTIVE;
915                 tcpsndsyn(s, tcb);
916                 tcpsetstate(s, Syn_sent);
917                 tcpoutput(s);
918                 break;
919         }
920 }
921
922 static char*
923 tcpflag(uint16_t flag)
924 {
925         static char buf[128];
926
927         snprintf(buf, sizeof(buf), "%d", flag>>10);     /* Head len */
928         if(flag & URG)
929                 snprintf(buf, sizeof(buf), "%s%s", buf, " URG");
930         if(flag & ACK)
931                 snprintf(buf, sizeof(buf), "%s%s", buf, " ACK");
932         if(flag & PSH)
933                 snprintf(buf, sizeof(buf), "%s%s", buf, " PSH");
934         if(flag & RST)
935                 snprintf(buf, sizeof(buf), "%s%s", buf, " RST");
936         if(flag & SYN)
937                 snprintf(buf, sizeof(buf), "%s%s", buf, " SYN");
938         if(flag & FIN)
939                 snprintf(buf, sizeof(buf), "%s%s", buf, " FIN");
940
941         return buf;
942 }
943
944 struct block *
945 htontcp6(Tcp *tcph, struct block *data, Tcp6hdr *ph, Tcpctl *tcb)
946 {
947         int dlen;
948         Tcp6hdr *h;
949         uint16_t csum;
950         uint16_t hdrlen, optpad = 0;
951         uint8_t *opt;
952
953         hdrlen = TCP6_HDRSIZE;
954         if(tcph->flags & SYN){
955                 if(tcph->mss)
956                         hdrlen += MSS_LENGTH;
957                 if(tcph->ws)
958                         hdrlen += WS_LENGTH;
959                 optpad = hdrlen & 3;
960                 if(optpad)
961                         optpad = 4 - optpad;
962                 hdrlen += optpad;
963         }
964
965         if(data) {
966                 dlen = blocklen(data);
967                 data = padblock(data, hdrlen + TCP6_PKT);
968                 if(data == NULL)
969                         return NULL;
970         }
971         else {
972                 dlen = 0;
973                 data = allocb(hdrlen + TCP6_PKT + 64);  /* the 64 pad is to meet mintu's */
974                 if(data == NULL)
975                         return NULL;
976                 data->wp += hdrlen + TCP6_PKT;
977         }
978
979         /* copy in pseudo ip header plus port numbers */
980         h = (Tcp6hdr *)(data->rp);
981         memmove(h, ph, TCP6_TCBPHDRSZ);
982
983         /* compose pseudo tcp header, do cksum calculation */
984         hnputl(h->vcf, hdrlen + dlen);
985         h->ploadlen[0] = h->ploadlen[1] = h->proto = 0;
986         h->ttl = ph->proto;
987
988         /* copy in variable bits */
989         hnputl(h->tcpseq, tcph->seq);
990         hnputl(h->tcpack, tcph->ack);
991         hnputs(h->tcpflag, (hdrlen<<10) | tcph->flags);
992         hnputs(h->tcpwin, tcph->wnd>>(tcb != NULL ? tcb->snd.scale : 0));
993         hnputs(h->tcpurg, tcph->urg);
994
995         if(tcph->flags & SYN){
996                 opt = h->tcpopt;
997                 if(tcph->mss != 0){
998                         *opt++ = MSSOPT;
999                         *opt++ = MSS_LENGTH;
1000                         hnputs(opt, tcph->mss);
1001                         opt += 2;
1002                 }
1003                 if(tcph->ws != 0){
1004                         *opt++ = WSOPT;
1005                         *opt++ = WS_LENGTH;
1006                         *opt++ = tcph->ws;
1007                 }
1008                 while(optpad-- > 0)
1009                         *opt++ = NOOPOPT;
1010         }
1011
1012         if(tcb != NULL && tcb->nochecksum){
1013                 h->tcpcksum[0] = h->tcpcksum[1] = 0;
1014         } else {
1015                 csum = ptclcsum(data, TCP6_IPLEN, hdrlen+dlen+TCP6_PHDRSIZE);
1016                 hnputs(h->tcpcksum, csum);
1017         }
1018
1019         /* move from pseudo header back to normal ip header */
1020         memset(h->vcf, 0, 4);
1021         h->vcf[0] = IP_VER6;
1022         hnputs(h->ploadlen, hdrlen+dlen);
1023         h->proto = ph->proto;
1024
1025         return data;
1026 }
1027
1028 struct block *
1029 htontcp4(Tcp *tcph, struct block *data, Tcp4hdr *ph, Tcpctl *tcb)
1030 {
1031         int dlen;
1032         Tcp4hdr *h;
1033         uint16_t csum;
1034         uint16_t hdrlen, optpad = 0;
1035         uint8_t *opt;
1036
1037         hdrlen = TCP4_HDRSIZE;
1038         if(tcph->flags & SYN){
1039                 if(tcph->mss)
1040                         hdrlen += MSS_LENGTH;
1041                 if(tcph->ws)
1042                         hdrlen += WS_LENGTH;
1043                 optpad = hdrlen & 3;
1044                 if(optpad)
1045                         optpad = 4 - optpad;
1046                 hdrlen += optpad;
1047         }
1048
1049         if(data) {
1050                 dlen = blocklen(data);
1051                 data = padblock(data, hdrlen + TCP4_PKT);
1052                 if(data == NULL)
1053                         return NULL;
1054         }
1055         else {
1056                 dlen = 0;
1057                 data = allocb(hdrlen + TCP4_PKT + 64);  /* the 64 pad is to meet mintu's */
1058                 if(data == NULL)
1059                         return NULL;
1060                 data->wp += hdrlen + TCP4_PKT;
1061         }
1062
1063         /* copy in pseudo ip header plus port numbers */
1064         h = (Tcp4hdr *)(data->rp);
1065         memmove(h, ph, TCP4_TCBPHDRSZ);
1066
1067         /* copy in variable bits */
1068         hnputs(h->tcplen, hdrlen + dlen);
1069         hnputl(h->tcpseq, tcph->seq);
1070         hnputl(h->tcpack, tcph->ack);
1071         hnputs(h->tcpflag, (hdrlen<<10) | tcph->flags);
1072         hnputs(h->tcpwin, tcph->wnd>>(tcb != NULL ? tcb->snd.scale : 0));
1073         hnputs(h->tcpurg, tcph->urg);
1074
1075         if(tcph->flags & SYN){
1076                 opt = h->tcpopt;
1077                 if(tcph->mss != 0){
1078                         *opt++ = MSSOPT;
1079                         *opt++ = MSS_LENGTH;
1080                         hnputs(opt, tcph->mss);
1081                         opt += 2;
1082                 }
1083                 if(tcph->ws != 0){
1084                         *opt++ = WSOPT;
1085                         *opt++ = WS_LENGTH;
1086                         *opt++ = tcph->ws;
1087                 }
1088                 while(optpad-- > 0)
1089                         *opt++ = NOOPOPT;
1090         }
1091
1092         if(tcb != NULL && tcb->nochecksum){
1093                 h->tcpcksum[0] = h->tcpcksum[1] = 0;
1094         } else {
1095                 csum = ptclcsum(data, TCP4_IPLEN, hdrlen+dlen+TCP4_PHDRSIZE);
1096                 hnputs(h->tcpcksum, csum);
1097         }
1098
1099         return data;
1100 }
1101
1102 int
1103 ntohtcp6(Tcp *tcph, struct block **bpp)
1104 {
1105         Tcp6hdr *h;
1106         uint8_t *optr;
1107         uint16_t hdrlen;
1108         uint16_t optlen;
1109         int n;
1110
1111         *bpp = pullupblock(*bpp, TCP6_PKT+TCP6_HDRSIZE);
1112         if(*bpp == NULL)
1113                 return -1;
1114
1115         h = (Tcp6hdr *)((*bpp)->rp);
1116         tcph->source = nhgets(h->tcpsport);
1117         tcph->dest = nhgets(h->tcpdport);
1118         tcph->seq = nhgetl(h->tcpseq);
1119         tcph->ack = nhgetl(h->tcpack);
1120         hdrlen = (h->tcpflag[0]>>2) & ~3;
1121         if(hdrlen < TCP6_HDRSIZE) {
1122                 freeblist(*bpp);
1123                 return -1;
1124         }
1125
1126         tcph->flags = h->tcpflag[1];
1127         tcph->wnd = nhgets(h->tcpwin);
1128         tcph->urg = nhgets(h->tcpurg);
1129         tcph->mss = 0;
1130         tcph->ws = 0;
1131         tcph->len = nhgets(h->ploadlen) - hdrlen;
1132
1133         *bpp = pullupblock(*bpp, hdrlen+TCP6_PKT);
1134         if(*bpp == NULL)
1135                 return -1;
1136
1137         optr = h->tcpopt;
1138         n = hdrlen - TCP6_HDRSIZE;
1139         while(n > 0 && *optr != EOLOPT) {
1140                 if(*optr == NOOPOPT) {
1141                         n--;
1142                         optr++;
1143                         continue;
1144                 }
1145                 optlen = optr[1];
1146                 if(optlen < 2 || optlen > n)
1147                         break;
1148                 switch(*optr) {
1149                 case MSSOPT:
1150                         if(optlen == MSS_LENGTH)
1151                                 tcph->mss = nhgets(optr+2);
1152                         break;
1153                 case WSOPT:
1154                         if(optlen == WS_LENGTH && *(optr+2) <= 14)
1155                                 tcph->ws = HaveWS | *(optr+2);
1156                         break;
1157                 }
1158                 n -= optlen;
1159                 optr += optlen;
1160         }
1161         return hdrlen;
1162 }
1163
1164 int
1165 ntohtcp4(Tcp *tcph, struct block **bpp)
1166 {
1167         Tcp4hdr *h;
1168         uint8_t *optr;
1169         uint16_t hdrlen;
1170         uint16_t optlen;
1171         int n;
1172
1173         *bpp = pullupblock(*bpp, TCP4_PKT+TCP4_HDRSIZE);
1174         if(*bpp == NULL)
1175                 return -1;
1176
1177         h = (Tcp4hdr *)((*bpp)->rp);
1178         tcph->source = nhgets(h->tcpsport);
1179         tcph->dest = nhgets(h->tcpdport);
1180         tcph->seq = nhgetl(h->tcpseq);
1181         tcph->ack = nhgetl(h->tcpack);
1182
1183         hdrlen = (h->tcpflag[0]>>2) & ~3;
1184         if(hdrlen < TCP4_HDRSIZE) {
1185                 freeblist(*bpp);
1186                 return -1;
1187         }
1188
1189         tcph->flags = h->tcpflag[1];
1190         tcph->wnd = nhgets(h->tcpwin);
1191         tcph->urg = nhgets(h->tcpurg);
1192         tcph->mss = 0;
1193         tcph->ws = 0;
1194         tcph->len = nhgets(h->length) - (hdrlen + TCP4_PKT);
1195
1196         *bpp = pullupblock(*bpp, hdrlen+TCP4_PKT);
1197         if(*bpp == NULL)
1198                 return -1;
1199
1200         optr = h->tcpopt;
1201         n = hdrlen - TCP4_HDRSIZE;
1202         while(n > 0 && *optr != EOLOPT) {
1203                 if(*optr == NOOPOPT) {
1204                         n--;
1205                         optr++;
1206                         continue;
1207                 }
1208                 optlen = optr[1];
1209                 if(optlen < 2 || optlen > n)
1210                         break;
1211                 switch(*optr) {
1212                 case MSSOPT:
1213                         if(optlen == MSS_LENGTH)
1214                                 tcph->mss = nhgets(optr+2);
1215                         break;
1216                 case WSOPT:
1217                         if(optlen == WS_LENGTH && *(optr+2) <= 14)
1218                                 tcph->ws = HaveWS | *(optr+2);
1219                         break;
1220                 }
1221                 n -= optlen;
1222                 optr += optlen;
1223         }
1224         return hdrlen;
1225 }
1226
1227 /*
1228  *  For outgiing calls, generate an initial sequence
1229  *  number and put a SYN on the send queue
1230  */
1231 void
1232 tcpsndsyn(struct conv *s, Tcpctl *tcb)
1233 {
1234         tcb->iss = (nrand(1<<16)<<16)|nrand(1<<16);
1235         tcb->rttseq = tcb->iss;
1236         tcb->snd.wl2 = tcb->iss;
1237         tcb->snd.una = tcb->iss;
1238         tcb->snd.ptr = tcb->rttseq;
1239         tcb->snd.nxt = tcb->rttseq;
1240         tcb->flgcnt++;
1241         tcb->flags |= FORCE;
1242         tcb->sndsyntime = NOW;
1243
1244         /* set desired mss and scale */
1245         tcb->mss = tcpmtu(s->p, s->laddr, s->ipversion, &tcb->scale);
1246 }
1247
1248 void
1249 sndrst(struct Proto *tcp, uint8_t *source, uint8_t *dest,
1250        uint16_t length, Tcp *seg, uint8_t version, char *reason)
1251 {
1252         struct block *hbp;
1253         uint8_t rflags;
1254         struct tcppriv *tpriv;
1255         Tcp4hdr ph4;
1256         Tcp6hdr ph6;
1257
1258         netlog(tcp->f, Logtcp, "sndrst: %s", reason);
1259
1260         tpriv = tcp->priv;
1261
1262         if(seg->flags & RST)
1263                 return;
1264
1265         /* make pseudo header */
1266         switch(version) {
1267         case V4:
1268                 memset(&ph4, 0, sizeof(ph4));
1269                 ph4.vihl = IP_VER4;
1270                 v6tov4(ph4.tcpsrc, dest);
1271                 v6tov4(ph4.tcpdst, source);
1272                 ph4.proto = IP_TCPPROTO;
1273                 hnputs(ph4.tcplen, TCP4_HDRSIZE);
1274                 hnputs(ph4.tcpsport, seg->dest);
1275                 hnputs(ph4.tcpdport, seg->source);
1276                 break;
1277         case V6:
1278                 memset(&ph6, 0, sizeof(ph6));
1279                 ph6.vcf[0] = IP_VER6;
1280                 ipmove(ph6.tcpsrc, dest);
1281                 ipmove(ph6.tcpdst, source);
1282                 ph6.proto = IP_TCPPROTO;
1283                 hnputs(ph6.ploadlen, TCP6_HDRSIZE);
1284                 hnputs(ph6.tcpsport, seg->dest);
1285                 hnputs(ph6.tcpdport, seg->source);
1286                 break;
1287         default:
1288                 panic("sndrst: version %d", version);
1289         }
1290
1291         tpriv->stats[OutRsts]++;
1292         rflags = RST;
1293
1294         /* convince the other end that this reset is in band */
1295         if(seg->flags & ACK) {
1296                 seg->seq = seg->ack;
1297                 seg->ack = 0;
1298         }
1299         else {
1300                 rflags |= ACK;
1301                 seg->ack = seg->seq;
1302                 seg->seq = 0;
1303                 if(seg->flags & SYN)
1304                         seg->ack++;
1305                 seg->ack += length;
1306                 if(seg->flags & FIN)
1307                         seg->ack++;
1308         }
1309         seg->flags = rflags;
1310         seg->wnd = 0;
1311         seg->urg = 0;
1312         seg->mss = 0;
1313         seg->ws = 0;
1314         switch(version) {
1315         case V4:
1316                 hbp = htontcp4(seg, NULL, &ph4, NULL);
1317                 if(hbp == NULL)
1318                         return;
1319                 ipoput4(tcp->f, hbp, 0, MAXTTL, DFLTTOS, NULL);
1320                 break;
1321         case V6:
1322                 hbp = htontcp6(seg, NULL, &ph6, NULL);
1323                 if(hbp == NULL)
1324                         return;
1325                 ipoput6(tcp->f, hbp, 0, MAXTTL, DFLTTOS, NULL);
1326                 break;
1327         default:
1328                 panic("sndrst2: version %d", version);
1329         }
1330 }
1331
1332 /*
1333  *  send a reset to the remote side and close the conversation
1334  *  called with s qlocked
1335  */
1336 char*
1337 tcphangup(struct conv *s)
1338 {
1339         ERRSTACK(2);
1340         Tcp seg;
1341         Tcpctl *tcb;
1342         struct block *hbp;
1343
1344         tcb = (Tcpctl*)s->ptcl;
1345         if(waserror()) {
1346                 poperror();
1347                 return commonerror();
1348         }
1349         if(s->raddr != 0) {
1350                 /* discard error style, poperror regardless */
1351                 if(!waserror()){
1352                         seg.flags = RST | ACK;
1353                         seg.ack = tcb->rcv.nxt;
1354                         tcb->rcv.una = 0;
1355                         seg.seq = tcb->snd.ptr;
1356                         seg.wnd = 0;
1357                         seg.urg = 0;
1358                         seg.mss = 0;
1359                         seg.ws = 0;
1360                         switch(s->ipversion) {
1361                         case V4:
1362                                 tcb->protohdr.tcp4hdr.vihl = IP_VER4;
1363                                 hbp = htontcp4(&seg, NULL, &tcb->protohdr.tcp4hdr, tcb);
1364                                 ipoput4(s->p->f, hbp, 0, s->ttl, s->tos, s);
1365                                 break;
1366                         case V6:
1367                                 tcb->protohdr.tcp6hdr.vcf[0] = IP_VER6;
1368                                 hbp = htontcp6(&seg, NULL, &tcb->protohdr.tcp6hdr, tcb);
1369                                 ipoput6(s->p->f, hbp, 0, s->ttl, s->tos, s);
1370                                 break;
1371                         default:
1372                                 panic("tcphangup: version %d", s->ipversion);
1373                         }
1374                 }
1375                 poperror();
1376         }
1377         localclose(s, NULL);
1378         poperror();
1379         return NULL;
1380 }
1381
1382 /*
1383  *  (re)send a SYN ACK
1384  */
1385 int
1386 sndsynack(struct Proto *tcp, Limbo *lp)
1387 {
1388         struct block *hbp;
1389         Tcp4hdr ph4;
1390         Tcp6hdr ph6;
1391         Tcp seg;
1392         int scale;
1393
1394         /* make pseudo header */
1395         switch(lp->version) {
1396         case V4:
1397                 memset(&ph4, 0, sizeof(ph4));
1398                 ph4.vihl = IP_VER4;
1399                 v6tov4(ph4.tcpsrc, lp->laddr);
1400                 v6tov4(ph4.tcpdst, lp->raddr);
1401                 ph4.proto = IP_TCPPROTO;
1402                 hnputs(ph4.tcplen, TCP4_HDRSIZE);
1403                 hnputs(ph4.tcpsport, lp->lport);
1404                 hnputs(ph4.tcpdport, lp->rport);
1405                 break;
1406         case V6:
1407                 memset(&ph6, 0, sizeof(ph6));
1408                 ph6.vcf[0] = IP_VER6;
1409                 ipmove(ph6.tcpsrc, lp->laddr);
1410                 ipmove(ph6.tcpdst, lp->raddr);
1411                 ph6.proto = IP_TCPPROTO;
1412                 hnputs(ph6.ploadlen, TCP6_HDRSIZE);
1413                 hnputs(ph6.tcpsport, lp->lport);
1414                 hnputs(ph6.tcpdport, lp->rport);
1415                 break;
1416         default:
1417                 panic("sndrst: version %d", lp->version);
1418         }
1419
1420         seg.seq = lp->iss;
1421         seg.ack = lp->irs+1;
1422         seg.flags = SYN|ACK;
1423         seg.urg = 0;
1424         seg.mss = tcpmtu(tcp, lp->laddr, lp->version, &scale);
1425         seg.wnd = QMAX;
1426
1427         /* if the other side set scale, we should too */
1428         if(lp->rcvscale){
1429                 seg.ws = scale;
1430                 lp->sndscale = scale;
1431         } else {
1432                 seg.ws = 0;
1433                 lp->sndscale = 0;
1434         }
1435
1436         switch(lp->version) {
1437         case V4:
1438                 hbp = htontcp4(&seg, NULL, &ph4, NULL);
1439                 if(hbp == NULL)
1440                         return -1;
1441                 ipoput4(tcp->f, hbp, 0, MAXTTL, DFLTTOS, NULL);
1442                 break;
1443         case V6:
1444                 hbp = htontcp6(&seg, NULL, &ph6, NULL);
1445                 if(hbp == NULL)
1446                         return -1;
1447                 ipoput6(tcp->f, hbp, 0, MAXTTL, DFLTTOS, NULL);
1448                 break;
1449         default:
1450                 panic("sndsnack: version %d", lp->version);
1451         }
1452         lp->lastsend = NOW;
1453         return 0;
1454 }
1455
1456 #define hashipa(a, p) ( ( (a)[IPaddrlen-2] + (a)[IPaddrlen-1] + p )&LHTMASK )
1457
1458 /*
1459  *  put a call into limbo and respond with a SYN ACK
1460  *
1461  *  called with proto locked
1462  */
1463 static void
1464 limbo(struct conv *s, uint8_t *source, uint8_t *dest, Tcp *seg, int version)
1465 {
1466         Limbo *lp, **l;
1467         struct tcppriv *tpriv;
1468         int h;
1469
1470         tpriv = s->p->priv;
1471         h = hashipa(source, seg->source);
1472
1473         for(l = &tpriv->lht[h]; *l != NULL; l = &lp->next){
1474                 lp = *l;
1475                 if(lp->lport != seg->dest || lp->rport != seg->source || lp->version != version)
1476                         continue;
1477                 if(ipcmp(lp->raddr, source) != 0)
1478                         continue;
1479                 if(ipcmp(lp->laddr, dest) != 0)
1480                         continue;
1481
1482                 /* each new SYN restarts the retransmits */
1483                 lp->irs = seg->seq;
1484                 break;
1485         }
1486         lp = *l;
1487         if(lp == NULL){
1488                 if(tpriv->nlimbo >= Maxlimbo && tpriv->lht[h]){
1489                         lp = tpriv->lht[h];
1490                         tpriv->lht[h] = lp->next;
1491                         lp->next = NULL;
1492                 } else {
1493                         lp = kzmalloc(sizeof(*lp), 0);
1494                         if(lp == NULL)
1495                                 return;
1496                         tpriv->nlimbo++;
1497                 }
1498                 *l = lp;
1499                 lp->version = version;
1500                 ipmove(lp->laddr, dest);
1501                 ipmove(lp->raddr, source);
1502                 lp->lport = seg->dest;
1503                 lp->rport = seg->source;
1504                 lp->mss = seg->mss;
1505                 lp->rcvscale = seg->ws;
1506                 lp->irs = seg->seq;
1507                 lp->iss = (nrand(1<<16)<<16)|nrand(1<<16);
1508         }
1509
1510         if(sndsynack(s->p, lp) < 0){
1511                 *l = lp->next;
1512                 tpriv->nlimbo--;
1513                 kfree(lp);
1514         }
1515 }
1516
1517 /*
1518  *  resend SYN ACK's once every SYNACK_RXTIMER ms.
1519  */
1520 static void
1521 limborexmit(struct Proto *tcp)
1522 {
1523         struct tcppriv *tpriv;
1524         Limbo **l, *lp;
1525         int h;
1526         int seen;
1527         uint32_t now;
1528
1529         tpriv = tcp->priv;
1530
1531         if(!canqlock(&tcp->qlock))
1532                 return;
1533         seen = 0;
1534         now = NOW;
1535         for(h = 0; h < NLHT && seen < tpriv->nlimbo; h++){
1536                 for(l = &tpriv->lht[h]; *l != NULL && seen < tpriv->nlimbo; ){
1537                         lp = *l;
1538                         seen++;
1539                         if(now - lp->lastsend < (lp->rexmits+1)*SYNACK_RXTIMER)
1540                                 continue;
1541
1542                         /* time it out after 1 second */
1543                         if(++(lp->rexmits) > 5){
1544                                 tpriv->nlimbo--;
1545                                 *l = lp->next;
1546                                 kfree(lp);
1547                                 continue;
1548                         }
1549
1550                         /* if we're being attacked, don't bother resending SYN ACK's */
1551                         if(tpriv->nlimbo > 100)
1552                                 continue;
1553
1554                         if(sndsynack(tcp, lp) < 0){
1555                                 tpriv->nlimbo--;
1556                                 *l = lp->next;
1557                                 kfree(lp);
1558                                 continue;
1559                         }
1560
1561                         l = &lp->next;
1562                 }
1563         }
1564         qunlock(&tcp->qlock);
1565 }
1566
1567 /*
1568  *  lookup call in limbo.  if found, throw it out.
1569  *
1570  *  called with proto locked
1571  */
1572 static void
1573 limborst(struct conv *s, Tcp *segp, uint8_t *src, uint8_t *dst, uint8_t version)
1574 {
1575         Limbo *lp, **l;
1576         int h;
1577         struct tcppriv *tpriv;
1578
1579         tpriv = s->p->priv;
1580
1581         /* find a call in limbo */
1582         h = hashipa(src, segp->source);
1583         for(l = &tpriv->lht[h]; *l != NULL; l = &lp->next){
1584                 lp = *l;
1585                 if(lp->lport != segp->dest || lp->rport != segp->source || lp->version != version)
1586                         continue;
1587                 if(ipcmp(lp->laddr, dst) != 0)
1588                         continue;
1589                 if(ipcmp(lp->raddr, src) != 0)
1590                         continue;
1591
1592                 /* RST can only follow the SYN */
1593                 if(segp->seq == lp->irs+1){
1594                         tpriv->nlimbo--;
1595                         *l = lp->next;
1596                         kfree(lp);
1597                 }
1598                 break;
1599         }
1600 }
1601
1602 /*
1603  *  come here when we finally get an ACK to our SYN-ACK.
1604  *  lookup call in limbo.  if found, create a new conversation
1605  *
1606  *  called with proto locked
1607  */
1608 static struct conv*
1609 tcpincoming(struct conv *s, Tcp *segp, uint8_t *src, uint8_t *dst, uint8_t version)
1610 {
1611         struct conv *new;
1612         Tcpctl *tcb;
1613         struct tcppriv *tpriv;
1614         Tcp4hdr *h4;
1615         Tcp6hdr *h6;
1616         Limbo *lp, **l;
1617         int h;
1618
1619         /* unless it's just an ack, it can't be someone coming out of limbo */
1620         if((segp->flags & SYN) || (segp->flags & ACK) == 0)
1621                 return NULL;
1622
1623         tpriv = s->p->priv;
1624
1625         /* find a call in limbo */
1626         h = hashipa(src, segp->source);
1627         for(l = &tpriv->lht[h]; (lp = *l) != NULL; l = &lp->next){
1628                 netlog(s->p->f, Logtcp, "tcpincoming s %I,%ux/%I,%ux d %I,%ux/%I,%ux v %d/%d",
1629                         src, segp->source, lp->raddr, lp->rport,
1630                         dst, segp->dest, lp->laddr, lp->lport,
1631                         version, lp->version
1632                 );
1633
1634                 if(lp->lport != segp->dest || lp->rport != segp->source || lp->version != version)
1635                         continue;
1636                 if(ipcmp(lp->laddr, dst) != 0)
1637                         continue;
1638                 if(ipcmp(lp->raddr, src) != 0)
1639                         continue;
1640
1641                 /* we're assuming no data with the initial SYN */
1642                 if(segp->seq != lp->irs+1 || segp->ack != lp->iss+1){
1643                         netlog(s->p->f, Logtcp, "tcpincoming s %lux/%lux a %lux %lux",
1644                                 segp->seq, lp->irs+1, segp->ack, lp->iss+1);
1645                         lp = NULL;
1646                 } else {
1647                         tpriv->nlimbo--;
1648                         *l = lp->next;
1649                 }
1650                 break;
1651         }
1652         if(lp == NULL)
1653                 return NULL;
1654
1655         new = Fsnewcall(s, src, segp->source, dst, segp->dest, version);
1656         if(new == NULL)
1657                 return NULL;
1658
1659         memmove(new->ptcl, s->ptcl, sizeof(Tcpctl));
1660         tcb = (Tcpctl*)new->ptcl;
1661         tcb->flags &= ~CLONE;
1662         tcb->timer.arg = new;
1663         tcb->timer.state = TcptimerOFF;
1664         tcb->acktimer.arg = new;
1665         tcb->acktimer.state = TcptimerOFF;
1666         tcb->katimer.arg = new;
1667         tcb->katimer.state = TcptimerOFF;
1668         tcb->rtt_timer.arg = new;
1669         tcb->rtt_timer.state = TcptimerOFF;
1670
1671         tcb->irs = lp->irs;
1672         tcb->rcv.nxt = tcb->irs+1;
1673         tcb->rcv.urg = tcb->rcv.nxt;
1674
1675         tcb->iss = lp->iss;
1676         tcb->rttseq = tcb->iss;
1677         tcb->snd.wl2 = tcb->iss;
1678         tcb->snd.una = tcb->iss+1;
1679         tcb->snd.ptr = tcb->iss+1;
1680         tcb->snd.nxt = tcb->iss+1;
1681         tcb->flgcnt = 0;
1682         tcb->flags |= SYNACK;
1683
1684         /* our sending max segment size cannot be bigger than what he asked for */
1685         if(lp->mss != 0 && lp->mss < tcb->mss)
1686                 tcb->mss = lp->mss;
1687
1688         /* window scaling */
1689         tcpsetscale(new, tcb, lp->rcvscale, lp->sndscale);
1690
1691         /* the congestion window always starts out as a single segment */
1692         tcb->snd.wnd = segp->wnd;
1693         tcb->cwind = tcb->mss;
1694
1695         /* set initial round trip time */
1696         tcb->sndsyntime = lp->lastsend+lp->rexmits*SYNACK_RXTIMER;
1697         tcpsynackrtt(new);
1698
1699         kfree(lp);
1700
1701         /* set up proto header */
1702         switch(version){
1703         case V4:
1704                 h4 = &tcb->protohdr.tcp4hdr;
1705                 memset(h4, 0, sizeof(*h4));
1706                 h4->proto = IP_TCPPROTO;
1707                 hnputs(h4->tcpsport, new->lport);
1708                 hnputs(h4->tcpdport, new->rport);
1709                 v6tov4(h4->tcpsrc, dst);
1710                 v6tov4(h4->tcpdst, src);
1711                 break;
1712         case V6:
1713                 h6 = &tcb->protohdr.tcp6hdr;
1714                 memset(h6, 0, sizeof(*h6));
1715                 h6->proto = IP_TCPPROTO;
1716                 hnputs(h6->tcpsport, new->lport);
1717                 hnputs(h6->tcpdport, new->rport);
1718                 ipmove(h6->tcpsrc, dst);
1719                 ipmove(h6->tcpdst, src);
1720                 break;
1721         default:
1722                 panic("tcpincoming: version %d", new->ipversion);
1723         }
1724
1725         tcpsetstate(new, Established);
1726
1727         iphtadd(&tpriv->ht, new);
1728
1729         return new;
1730 }
1731
1732 int
1733 seq_within(uint32_t x, uint32_t low, uint32_t high)
1734 {
1735         if(low <= high){
1736                 if(low <= x && x <= high)
1737                         return 1;
1738         }
1739         else {
1740                 if(x >= low || x <= high)
1741                         return 1;
1742         }
1743         return 0;
1744 }
1745
1746 int
1747 seq_lt(uint32_t x, uint32_t y)
1748 {
1749         return (int)(x-y) < 0;
1750 }
1751
1752 int
1753 seq_le(uint32_t x, uint32_t y)
1754 {
1755         return (int)(x-y) <= 0;
1756 }
1757
1758 int
1759 seq_gt(uint32_t x, uint32_t y)
1760 {
1761         return (int)(x-y) > 0;
1762 }
1763
1764 int
1765 seq_ge(uint32_t x, uint32_t y)
1766 {
1767         return (int)(x-y) >= 0;
1768 }
1769
1770 /*
1771  *  use the time between the first SYN and it's ack as the
1772  *  initial round trip time
1773  */
1774 void
1775 tcpsynackrtt(struct conv *s)
1776 {
1777         Tcpctl *tcb;
1778         int delta;
1779         struct tcppriv *tpriv;
1780
1781         tcb = (Tcpctl*)s->ptcl;
1782         tpriv = s->p->priv;
1783
1784         delta = NOW - tcb->sndsyntime;
1785         tcb->srtt = delta<<LOGAGAIN;
1786         tcb->mdev = delta<<LOGDGAIN;
1787
1788         /* halt round trip timer */
1789         tcphalt(tpriv, &tcb->rtt_timer);
1790 }
1791
1792 void
1793 update(struct conv *s, Tcp *seg)
1794 {
1795         int rtt, delta;
1796         Tcpctl *tcb;
1797         uint32_t acked;
1798         uint32_t expand;
1799         struct tcppriv *tpriv;
1800
1801         tpriv = s->p->priv;
1802         tcb = (Tcpctl*)s->ptcl;
1803
1804         /* if everything has been acked, force output(?) */
1805         if(seq_gt(seg->ack, tcb->snd.nxt)) {
1806                 tcb->flags |= FORCE;
1807                 return;
1808         }
1809
1810         /* added by Dong Lin for fast retransmission */
1811         if(seg->ack == tcb->snd.una
1812         && tcb->snd.una != tcb->snd.nxt
1813         && seg->len == 0
1814         && seg->wnd == tcb->snd.wnd) {
1815
1816                 /* this is a pure ack w/o window update */
1817                 netlog(s->p->f, Logtcprxmt, "dupack %lud ack %lud sndwnd %d advwin %d\n",
1818                         tcb->snd.dupacks, seg->ack, tcb->snd.wnd, seg->wnd);
1819
1820                 if(++tcb->snd.dupacks == TCPREXMTTHRESH) {
1821                         /*
1822                          *  tahoe tcp rxt the packet, half sshthresh,
1823                          *  and set cwnd to one packet
1824                          */
1825                         tcb->snd.recovery = 1;
1826                         tcb->snd.rxt = tcb->snd.nxt;
1827                         netlog(s->p->f, Logtcprxmt, "fast rxt %lud, nxt %lud\n", tcb->snd.una, tcb->snd.nxt);
1828                         tcprxmit(s);
1829                 } else {
1830                         /* do reno tcp here. */
1831                 }
1832         }
1833
1834         /*
1835          *  update window
1836          */
1837         if(seq_gt(seg->ack, tcb->snd.wl2)
1838         || (tcb->snd.wl2 == seg->ack && seg->wnd > tcb->snd.wnd)){
1839                 tcb->snd.wnd = seg->wnd;
1840                 tcb->snd.wl2 = seg->ack;
1841         }
1842
1843         if(!seq_gt(seg->ack, tcb->snd.una)){
1844                 /*
1845                  *  don't let us hangup if sending into a closed window and
1846                  *  we're still getting acks
1847                  */
1848                 if((tcb->flags&RETRAN) && tcb->snd.wnd == 0){
1849                         tcb->backedoff = MAXBACKMS/4;
1850                 }
1851                 return;
1852         }
1853
1854         /*
1855          *  any positive ack turns off fast rxt,
1856          *  (should we do new-reno on partial acks?)
1857          */
1858         if(!tcb->snd.recovery || seq_ge(seg->ack, tcb->snd.rxt)) {
1859                 tcb->snd.dupacks = 0;
1860                 tcb->snd.recovery = 0;
1861         } else
1862                 netlog(s->p->f, Logtcp, "rxt next %lud, cwin %ud\n", seg->ack, tcb->cwind);
1863
1864         /* Compute the new send window size */
1865         acked = seg->ack - tcb->snd.una;
1866
1867         /* avoid slow start and timers for SYN acks */
1868         if((tcb->flags & SYNACK) == 0) {
1869                 tcb->flags |= SYNACK;
1870                 acked--;
1871                 tcb->flgcnt--;
1872                 goto done;
1873         }
1874
1875         /* slow start as long as we're not recovering from lost packets */
1876         if(tcb->cwind < tcb->snd.wnd && !tcb->snd.recovery) {
1877                 if(tcb->cwind < tcb->ssthresh) {
1878                         expand = tcb->mss;
1879                         if(acked < expand)
1880                                 expand = acked;
1881                 }
1882                 else
1883                         expand = ((int)tcb->mss * tcb->mss) / tcb->cwind;
1884
1885                 if(tcb->cwind + expand < tcb->cwind)
1886                         expand = tcb->snd.wnd - tcb->cwind;
1887                 if(tcb->cwind + expand > tcb->snd.wnd)
1888                         expand = tcb->snd.wnd - tcb->cwind;
1889                 tcb->cwind += expand;
1890         }
1891
1892         /* Adjust the timers according to the round trip time */
1893         if(tcb->rtt_timer.state == TcptimerON && seq_ge(seg->ack, tcb->rttseq)) {
1894                 tcphalt(tpriv, &tcb->rtt_timer);
1895                 if((tcb->flags&RETRAN) == 0) {
1896                         tcb->backoff = 0;
1897                         tcb->backedoff = 0;
1898                         rtt = tcb->rtt_timer.start - tcb->rtt_timer.count;
1899                         if(rtt == 0)
1900                                 rtt = 1;        /* otherwise all close systems will rexmit in 0 time */
1901                         rtt *= MSPTICK;
1902                         if(tcb->srtt == 0) {
1903                                 tcb->srtt = rtt << LOGAGAIN;
1904                                 tcb->mdev = rtt << LOGDGAIN;
1905                         } else {
1906                                 delta = rtt - (tcb->srtt>>LOGAGAIN);
1907                                 tcb->srtt += delta;
1908                                 if(tcb->srtt <= 0)
1909                                         tcb->srtt = 1;
1910
1911                                 delta = abs(delta) - (tcb->mdev>>LOGDGAIN);
1912                                 tcb->mdev += delta;
1913                                 if(tcb->mdev <= 0)
1914                                         tcb->mdev = 1;
1915                         }
1916                         tcpsettimer(tcb);
1917                 }
1918         }
1919
1920 done:
1921         if(qdiscard(s->wq, acked) < acked)
1922                 tcb->flgcnt--;
1923
1924         tcb->snd.una = seg->ack;
1925         if(seq_gt(seg->ack, tcb->snd.urg))
1926                 tcb->snd.urg = seg->ack;
1927
1928         if(tcb->snd.una != tcb->snd.nxt)
1929                 tcpgo(tpriv, &tcb->timer);
1930         else
1931                 tcphalt(tpriv, &tcb->timer);
1932
1933         if(seq_lt(tcb->snd.ptr, tcb->snd.una))
1934                 tcb->snd.ptr = tcb->snd.una;
1935
1936         tcb->flags &= ~RETRAN;
1937         tcb->backoff = 0;
1938         tcb->backedoff = 0;
1939 }
1940
1941 void
1942 tcpiput(struct Proto *tcp, struct Ipifc*unused, struct block *bp)
1943 {
1944         ERRSTACK(1);
1945         Tcp seg;
1946         Tcp4hdr *h4;
1947         Tcp6hdr *h6;
1948         int hdrlen;
1949         Tcpctl *tcb;
1950         uint16_t length;
1951         uint8_t source[IPaddrlen], dest[IPaddrlen];
1952         struct conv *s;
1953         struct Fs *f;
1954         struct tcppriv *tpriv;
1955         uint8_t version;
1956
1957         f = tcp->f;
1958         tpriv = tcp->priv;
1959
1960         tpriv->stats[InSegs]++;
1961
1962         h4 = (Tcp4hdr*)(bp->rp);
1963         h6 = (Tcp6hdr*)(bp->rp);
1964
1965         if((h4->vihl&0xF0)==IP_VER4) {
1966                 version = V4;
1967                 length = nhgets(h4->length);
1968                 v4tov6(dest, h4->tcpdst);
1969                 v4tov6(source, h4->tcpsrc);
1970
1971                 h4->Unused = 0;
1972                 hnputs(h4->tcplen, length-TCP4_PKT);
1973                 if(!(bp->flag & Btcpck) && (h4->tcpcksum[0] || h4->tcpcksum[1]) &&
1974                         ptclcsum(bp, TCP4_IPLEN, length-TCP4_IPLEN)) {
1975                         tpriv->stats[CsumErrs]++;
1976                         tpriv->stats[InErrs]++;
1977                         netlog(f, Logtcp, "bad tcp proto cksum\n");
1978                         freeblist(bp);
1979                         return;
1980                 }
1981
1982                 hdrlen = ntohtcp4(&seg, &bp);
1983                 if(hdrlen < 0){
1984                         tpriv->stats[HlenErrs]++;
1985                         tpriv->stats[InErrs]++;
1986                         netlog(f, Logtcp, "bad tcp hdr len\n");
1987                         return;
1988                 }
1989
1990                 /* trim the packet to the size claimed by the datagram */
1991                 length -= hdrlen+TCP4_PKT;
1992                 bp = trimblock(bp, hdrlen+TCP4_PKT, length);
1993                 if(bp == NULL){
1994                         tpriv->stats[LenErrs]++;
1995                         tpriv->stats[InErrs]++;
1996                         netlog(f, Logtcp, "tcp len < 0 after trim\n");
1997                         return;
1998                 }
1999         }
2000         else {
2001                 int ttl = h6->ttl;
2002                 int proto = h6->proto;
2003
2004                 version = V6;
2005                 length = nhgets(h6->ploadlen);
2006                 ipmove(dest, h6->tcpdst);
2007                 ipmove(source, h6->tcpsrc);
2008
2009                 h6->ploadlen[0] = h6->ploadlen[1] = h6->proto = 0;
2010                 h6->ttl = proto;
2011                 hnputl(h6->vcf, length);
2012                 if((h6->tcpcksum[0] || h6->tcpcksum[1]) &&
2013                         ptclcsum(bp, TCP6_IPLEN, length+TCP6_PHDRSIZE)) {
2014                         tpriv->stats[CsumErrs]++;
2015                         tpriv->stats[InErrs]++;
2016                         netlog(f, Logtcp, "bad tcp proto cksum\n");
2017                         freeblist(bp);
2018                         return;
2019                 }
2020                 h6->ttl = ttl;
2021                 h6->proto = proto;
2022                 hnputs(h6->ploadlen, length);
2023
2024                 hdrlen = ntohtcp6(&seg, &bp);
2025                 if(hdrlen < 0){
2026                         tpriv->stats[HlenErrs]++;
2027                         tpriv->stats[InErrs]++;
2028                         netlog(f, Logtcp, "bad tcp hdr len\n");
2029                         return;
2030                 }
2031
2032                 /* trim the packet to the size claimed by the datagram */
2033                 length -= hdrlen;
2034                 bp = trimblock(bp, hdrlen+TCP6_PKT, length);
2035                 if(bp == NULL){
2036                         tpriv->stats[LenErrs]++;
2037                         tpriv->stats[InErrs]++;
2038                         netlog(f, Logtcp, "tcp len < 0 after trim\n");
2039                         return;
2040                 }
2041         }
2042
2043         /* lock protocol while searching for a conversation */
2044         qlock(&tcp->qlock);
2045
2046         /* Look for a matching conversation */
2047         s = iphtlook(&tpriv->ht, source, seg.source, dest, seg.dest);
2048         if(s == NULL){
2049                 netlog(f, Logtcp, "iphtlook failed");
2050 reset:
2051                 qunlock(&tcp->qlock);
2052                 sndrst(tcp, source, dest, length, &seg, version, "no conversation");
2053                 freeblist(bp);
2054                 return;
2055         }
2056
2057         /* if it's a listener, look for the right flags and get a new conv */
2058         tcb = (Tcpctl*)s->ptcl;
2059         if(tcb->state == Listen){
2060                 if(seg.flags & RST){
2061                         limborst(s, &seg, source, dest, version);
2062                         qunlock(&tcp->qlock);
2063                         freeblist(bp);
2064                         return;
2065                 }
2066
2067                 /* if this is a new SYN, put the call into limbo */
2068                 if((seg.flags & SYN) && (seg.flags & ACK) == 0){
2069                         limbo(s, source, dest, &seg, version);
2070                         qunlock(&tcp->qlock);
2071                         freeblist(bp);
2072                         return;
2073                 }
2074
2075                 /*
2076                  *  if there's a matching call in limbo, tcpincoming will
2077                  *  return it in state Syn_received
2078                  */
2079                 s = tcpincoming(s, &seg, source, dest, version);
2080                 if(s == NULL)
2081                         goto reset;
2082         }
2083
2084         /* The rest of the input state machine is run with the control block
2085          * locked and implements the state machine directly out of the RFC.
2086          * Out-of-band data is ignored - it was always a bad idea.
2087          */
2088         tcb = (Tcpctl*)s->ptcl;
2089         if(waserror()){
2090                 qunlock(&s->qlock);
2091                 nexterror();
2092         }
2093         qlock(&s->qlock);
2094         qunlock(&tcp->qlock);
2095
2096         /* fix up window */
2097         seg.wnd <<= tcb->rcv.scale;
2098
2099         /* every input packet in puts off the keep alive time out */
2100         tcpsetkacounter(tcb);
2101
2102         switch(tcb->state) {
2103         case Closed:
2104                 sndrst(tcp, source, dest, length, &seg, version, "sending to Closed");
2105                 goto raise;
2106         case Syn_sent:
2107                 if(seg.flags & ACK) {
2108                         if(!seq_within(seg.ack, tcb->iss+1, tcb->snd.nxt)) {
2109                                 sndrst(tcp, source, dest, length, &seg, version,
2110                                          "bad seq in Syn_sent");
2111                                 goto raise;
2112                         }
2113                 }
2114                 if(seg.flags & RST) {
2115                         if(seg.flags & ACK)
2116                                 localclose(s, Econrefused);
2117                         goto raise;
2118                 }
2119
2120                 if(seg.flags & SYN) {
2121                         procsyn(s, &seg);
2122                         if(seg.flags & ACK){
2123                                 update(s, &seg);
2124                                 tcpsynackrtt(s);
2125                                 tcpsetstate(s, Established);
2126                                 tcpsetscale(s, tcb, seg.ws, tcb->scale);
2127                         }
2128                         else {
2129                                 tcb->time = NOW;
2130                                 tcpsetstate(s, Syn_received);   /* DLP - shouldn't this be a reset? */
2131                         }
2132
2133                         if(length != 0 || (seg.flags & FIN))
2134                                 break;
2135
2136                         freeblist(bp);
2137                         goto output;
2138                 }
2139                 else
2140                         freeblist(bp);
2141
2142                 qunlock(&s->qlock);
2143                 poperror();
2144                 return;
2145         case Syn_received:
2146                 /* doesn't matter if it's the correct ack, we're just trying to set timing */
2147                 if(seg.flags & ACK)
2148                         tcpsynackrtt(s);
2149                 break;
2150         }
2151
2152         /*
2153          *  One DOS attack is to open connections to us and then forget about them,
2154          *  thereby tying up a conv at no long term cost to the attacker.
2155          *  This is an attempt to defeat these stateless DOS attacks.  See
2156          *  corresponding code in tcpsendka().
2157          */
2158         if(tcb->state != Syn_received && (seg.flags & RST) == 0){
2159                 if(tcpporthogdefense
2160                 && seq_within(seg.ack, tcb->snd.una-(1<<31), tcb->snd.una-(1<<29))){
2161                         printd("stateless hog %I.%d->%I.%d f %ux %lux - %lux - %lux\n",
2162                                 source, seg.source, dest, seg.dest, seg.flags,
2163                                 tcb->snd.una-(1<<31), seg.ack, tcb->snd.una-(1<<29));
2164                         localclose(s, "stateless hog");
2165                 }
2166         }
2167
2168         /* Cut the data to fit the receive window */
2169         if(tcptrim(tcb, &seg, &bp, &length) == -1) {
2170                 netlog(f, Logtcp, "tcp len < 0, %lud %d\n", seg.seq, length);
2171                 update(s, &seg);
2172                 if(qlen(s->wq)+tcb->flgcnt == 0 && tcb->state == Closing) {
2173                         tcphalt(tpriv, &tcb->rtt_timer);
2174                         tcphalt(tpriv, &tcb->acktimer);
2175                         tcphalt(tpriv, &tcb->katimer);
2176                         tcpsetstate(s, Time_wait);
2177                         tcb->timer.start = MSL2*(1000 / MSPTICK);
2178                         tcpgo(tpriv, &tcb->timer);
2179                 }
2180                 if(!(seg.flags & RST)) {
2181                         tcb->flags |= FORCE;
2182                         goto output;
2183                 }
2184                 qunlock(&s->qlock);
2185                 poperror();
2186                 return;
2187         }
2188
2189         /* Cannot accept so answer with a rst */
2190         if(length && tcb->state == Closed) {
2191                 sndrst(tcp, source, dest, length, &seg, version, "sending to Closed");
2192                 goto raise;
2193         }
2194
2195         /* The segment is beyond the current receive pointer so
2196          * queue the data in the resequence queue
2197          */
2198         if(seg.seq != tcb->rcv.nxt)
2199         if(length != 0 || (seg.flags & (SYN|FIN))) {
2200                 update(s, &seg);
2201                 if(addreseq(tcb, tpriv, &seg, bp, length) < 0)
2202                         printd("reseq %I.%d -> %I.%d\n", s->raddr, s->rport, s->laddr, s->lport);
2203                 tcb->flags |= FORCE;
2204                 goto output;
2205         }
2206
2207         /*
2208          *  keep looping till we've processed this packet plus any
2209          *  adjacent packets in the resequence queue
2210          */
2211         for(;;) {
2212                 if(seg.flags & RST) {
2213                         if(tcb->state == Established) {
2214                                 tpriv->stats[EstabResets]++;
2215                                 if(tcb->rcv.nxt != seg.seq)
2216                                         printd("out of order RST rcvd: %I.%d -> %I.%d, rcv.nxt %lux seq %lux\n", s->raddr, s->rport, s->laddr, s->lport, tcb->rcv.nxt, seg.seq);
2217                         }
2218                         localclose(s, Econrefused);
2219                         goto raise;
2220                 }
2221
2222                 if((seg.flags&ACK) == 0)
2223                         goto raise;
2224
2225                 switch(tcb->state) {
2226                 case Syn_received:
2227                         if(!seq_within(seg.ack, tcb->snd.una+1, tcb->snd.nxt)){
2228                                 sndrst(tcp, source, dest, length, &seg, version,
2229                                         "bad seq in Syn_received");
2230                                 goto raise;
2231                         }
2232                         update(s, &seg);
2233                         tcpsetstate(s, Established);
2234                 case Established:
2235                 case Close_wait:
2236                         update(s, &seg);
2237                         break;
2238                 case Finwait1:
2239                         update(s, &seg);
2240                         if(qlen(s->wq)+tcb->flgcnt == 0){
2241                                 tcphalt(tpriv, &tcb->rtt_timer);
2242                                 tcphalt(tpriv, &tcb->acktimer);
2243                                 tcpsetkacounter(tcb);
2244                                 tcb->time = NOW;
2245                                 tcpsetstate(s, Finwait2);
2246                                 tcb->katimer.start = MSL2 * (1000 / MSPTICK);
2247                                 tcpgo(tpriv, &tcb->katimer);
2248                         }
2249                         break;
2250                 case Finwait2:
2251                         update(s, &seg);
2252                         break;
2253                 case Closing:
2254                         update(s, &seg);
2255                         if(qlen(s->wq)+tcb->flgcnt == 0) {
2256                                 tcphalt(tpriv, &tcb->rtt_timer);
2257                                 tcphalt(tpriv, &tcb->acktimer);
2258                                 tcphalt(tpriv, &tcb->katimer);
2259                                 tcpsetstate(s, Time_wait);
2260                                 tcb->timer.start = MSL2*(1000 / MSPTICK);
2261                                 tcpgo(tpriv, &tcb->timer);
2262                         }
2263                         break;
2264                 case Last_ack:
2265                         update(s, &seg);
2266                         if(qlen(s->wq)+tcb->flgcnt == 0) {
2267                                 localclose(s, NULL);
2268                                 goto raise;
2269                         }
2270                 case Time_wait:
2271                         tcb->flags |= FORCE;
2272                         if(tcb->timer.state != TcptimerON)
2273                                 tcpgo(tpriv, &tcb->timer);
2274                 }
2275
2276                 if((seg.flags&URG) && seg.urg) {
2277                         if(seq_gt(seg.urg + seg.seq, tcb->rcv.urg)) {
2278                                 tcb->rcv.urg = seg.urg + seg.seq;
2279                                 pullblock(&bp, seg.urg);
2280                         }
2281                 }
2282                 else
2283                 if(seq_gt(tcb->rcv.nxt, tcb->rcv.urg))
2284                         tcb->rcv.urg = tcb->rcv.nxt;
2285
2286                 if(length == 0) {
2287                         if(bp != NULL)
2288                                 freeblist(bp);
2289                 }
2290                 else {
2291                         switch(tcb->state){
2292                         default:
2293                                 /* Ignore segment text */
2294                                 if(bp != NULL)
2295                                         freeblist(bp);
2296                                 break;
2297
2298                         case Syn_received:
2299                         case Established:
2300                         case Finwait1:
2301                                 /* If we still have some data place on
2302                                  * receive queue
2303                                  */
2304                                 if(bp) {
2305                                         bp = packblock(bp);
2306                                         if(bp == NULL)
2307                                                 panic("tcp packblock");
2308                                         qpassnolim(s->rq, bp);
2309                                         bp = NULL;
2310
2311                                         /*
2312                                          *  Force an ack every 2 data messages.  This is
2313                                          *  a hack for rob to make his home system run
2314                                          *  faster.
2315                                          *
2316                                          *  this also keeps the standard TCP congestion
2317                                          *  control working since it needs an ack every
2318                                          *  2 max segs worth.  This is not quite that,
2319                                          *  but under a real stream is equivalent since
2320                                          *  every packet has a max seg in it.
2321                                          */
2322                                         if(++(tcb->rcv.una) >= 2)
2323                                                 tcb->flags |= FORCE;
2324                                 }
2325                                 tcb->rcv.nxt += length;
2326
2327                                 /*
2328                                  *  update our rcv window
2329                                  */
2330                                 tcprcvwin(s);
2331
2332                                 /*
2333                                  *  turn on the acktimer if there's something
2334                                  *  to ack
2335                                  */
2336                                 if(tcb->acktimer.state != TcptimerON)
2337                                         tcpgo(tpriv, &tcb->acktimer);
2338
2339                                 break;
2340                         case Finwait2:
2341                                 /* no process to read the data, send a reset */
2342                                 if(bp != NULL)
2343                                         freeblist(bp);
2344                                 sndrst(tcp, source, dest, length, &seg, version,
2345                                         "send to Finwait2");
2346                                 qunlock(&s->qlock);
2347                                 poperror();
2348                                 return;
2349                         }
2350                 }
2351
2352                 if(seg.flags & FIN) {
2353                         tcb->flags |= FORCE;
2354
2355                         switch(tcb->state) {
2356                         case Syn_received:
2357                         case Established:
2358                                 tcb->rcv.nxt++;
2359                                 tcpsetstate(s, Close_wait);
2360                                 break;
2361                         case Finwait1:
2362                                 tcb->rcv.nxt++;
2363                                 if(qlen(s->wq)+tcb->flgcnt == 0) {
2364                                         tcphalt(tpriv, &tcb->rtt_timer);
2365                                         tcphalt(tpriv, &tcb->acktimer);
2366                                         tcphalt(tpriv, &tcb->katimer);
2367                                         tcpsetstate(s, Time_wait);
2368                                         tcb->timer.start = MSL2*(1000/MSPTICK);
2369                                         tcpgo(tpriv, &tcb->timer);
2370                                 }
2371                                 else
2372                                         tcpsetstate(s, Closing);
2373                                 break;
2374                         case Finwait2:
2375                                 tcb->rcv.nxt++;
2376                                 tcphalt(tpriv, &tcb->rtt_timer);
2377                                 tcphalt(tpriv, &tcb->acktimer);
2378                                 tcphalt(tpriv, &tcb->katimer);
2379                                 tcpsetstate(s, Time_wait);
2380                                 tcb->timer.start = MSL2 * (1000/MSPTICK);
2381                                 tcpgo(tpriv, &tcb->timer);
2382                                 break;
2383                         case Close_wait:
2384                         case Closing:
2385                         case Last_ack:
2386                                 break;
2387                         case Time_wait:
2388                                 tcpgo(tpriv, &tcb->timer);
2389                                 break;
2390                         }
2391                 }
2392
2393                 /*
2394                  *  get next adjacent segment from the resequence queue.
2395                  *  dump/trim any overlapping segments
2396                  */
2397                 for(;;) {
2398                         if(tcb->reseq == NULL)
2399                                 goto output;
2400
2401                         if(seq_ge(tcb->rcv.nxt, tcb->reseq->seg.seq) == 0)
2402                                 goto output;
2403
2404                         getreseq(tcb, &seg, &bp, &length);
2405
2406                         if(tcptrim(tcb, &seg, &bp, &length) == 0)
2407                                 break;
2408                 }
2409         }
2410 output:
2411         tcpoutput(s);
2412         qunlock(&s->qlock);
2413         poperror();
2414         return;
2415 raise:
2416         qunlock(&s->qlock);
2417         poperror();
2418         freeblist(bp);
2419         tcpkick(s);
2420 }
2421
2422 /*
2423  *  always enters and exits with the s locked.  We drop
2424  *  the lock to ipoput the packet so some care has to be
2425  *  taken by callers.
2426  */
2427 void
2428 tcpoutput(struct conv *s)
2429 {
2430         Tcp seg;
2431         int msgs;
2432         Tcpctl *tcb;
2433         struct block *hbp, *bp;
2434         int sndcnt, n;
2435         uint32_t ssize, dsize, usable, sent;
2436         struct Fs *f;
2437         struct tcppriv *tpriv;
2438         uint8_t version;
2439
2440         f = s->p->f;
2441         tpriv = s->p->priv;
2442         version = s->ipversion;
2443
2444         for(msgs = 0; msgs < 100; msgs++) {
2445                 tcb = (Tcpctl*)s->ptcl;
2446
2447                 switch(tcb->state) {
2448                 case Listen:
2449                 case Closed:
2450                 case Finwait2:
2451                         return;
2452                 }
2453
2454                 /* force an ack when a window has opened up */
2455                 if(tcb->rcv.blocked && tcb->rcv.wnd > 0){
2456                         tcb->rcv.blocked = 0;
2457                         tcb->flags |= FORCE;
2458                 }
2459
2460                 sndcnt = qlen(s->wq)+tcb->flgcnt;
2461                 sent = tcb->snd.ptr - tcb->snd.una;
2462
2463                 /* Don't send anything else until our SYN has been acked */
2464                 if(tcb->snd.ptr != tcb->iss && (tcb->flags & SYNACK) == 0)
2465                         break;
2466
2467                 /* Compute usable segment based on offered window and limit
2468                  * window probes to one
2469                  */
2470                 if(tcb->snd.wnd == 0){
2471                         if(sent != 0) {
2472                                 if((tcb->flags&FORCE) == 0)
2473                                         break;
2474 //                              tcb->snd.ptr = tcb->snd.una;
2475                         }
2476                         usable = 1;
2477                 }
2478                 else {
2479                         usable = tcb->cwind;
2480                         if(tcb->snd.wnd < usable)
2481                                 usable = tcb->snd.wnd;
2482                         usable -= sent;
2483                 }
2484                 ssize = sndcnt-sent;
2485                 if(ssize && usable < 2)
2486                         netlog(s->p->f, Logtcp, "throttled snd.wnd %lud cwind %lud\n",
2487                                 tcb->snd.wnd, tcb->cwind);
2488                 if(usable < ssize)
2489                         ssize = usable;
2490                 if(tcb->mss < ssize)
2491                         ssize = tcb->mss;
2492                 dsize = ssize;
2493                 seg.urg = 0;
2494
2495                 if(ssize == 0)
2496                 if((tcb->flags&FORCE) == 0)
2497                         break;
2498
2499                 tcb->flags &= ~FORCE;
2500                 tcprcvwin(s);
2501
2502                 /* By default we will generate an ack */
2503                 tcphalt(tpriv, &tcb->acktimer);
2504                 tcb->rcv.una = 0;
2505                 seg.source = s->lport;
2506                 seg.dest = s->rport;
2507                 seg.flags = ACK;
2508                 seg.mss = 0;
2509                 seg.ws = 0;
2510                 switch(tcb->state){
2511                 case Syn_sent:
2512                         seg.flags = 0;
2513                         if(tcb->snd.ptr == tcb->iss){
2514                                 seg.flags |= SYN;
2515                                 dsize--;
2516                                 seg.mss = tcb->mss;
2517                                 seg.ws = tcb->scale;
2518                         }
2519                         break;
2520                 case Syn_received:
2521                         /*
2522                          *  don't send any data with a SYN/ACK packet
2523                          *  because Linux rejects the packet in its
2524                          *  attempt to solve the SYN attack problem
2525                          */
2526                         if(tcb->snd.ptr == tcb->iss){
2527                                 seg.flags |= SYN;
2528                                 dsize = 0;
2529                                 ssize = 1;
2530                                 seg.mss = tcb->mss;
2531                                 seg.ws = tcb->scale;
2532                         }
2533                         break;
2534                 }
2535                 seg.seq = tcb->snd.ptr;
2536                 seg.ack = tcb->rcv.nxt;
2537                 seg.wnd = tcb->rcv.wnd;
2538
2539                 /* Pull out data to send */
2540                 bp = NULL;
2541                 if(dsize != 0) {
2542                         bp = qcopy(s->wq, dsize, sent);
2543                         if(BLEN(bp) != dsize) {
2544                                 seg.flags |= FIN;
2545                                 dsize--;
2546                         }
2547                 }
2548
2549                 if(sent+dsize == sndcnt)
2550                         seg.flags |= PSH;
2551
2552                 /* keep track of balance of resent data */
2553                 if(seq_lt(tcb->snd.ptr, tcb->snd.nxt)) {
2554                         n = tcb->snd.nxt - tcb->snd.ptr;
2555                         if(ssize < n)
2556                                 n = ssize;
2557                         tcb->resent += n;
2558                         netlog(f, Logtcp, "rexmit: %I.%d -> %I.%d ptr %lux nxt %lux\n",
2559                                 s->raddr, s->rport, s->laddr, s->lport, tcb->snd.ptr, tcb->snd.nxt);
2560                         tpriv->stats[RetransSegs]++;
2561                 }
2562
2563                 tcb->snd.ptr += ssize;
2564
2565                 /* Pull up the send pointer so we can accept acks
2566                  * for this window
2567                  */
2568                 if(seq_gt(tcb->snd.ptr,tcb->snd.nxt))
2569                         tcb->snd.nxt = tcb->snd.ptr;
2570
2571                 /* Build header, link data and compute cksum */
2572                 switch(version){
2573                 case V4:
2574                         tcb->protohdr.tcp4hdr.vihl = IP_VER4;
2575                         hbp = htontcp4(&seg, bp, &tcb->protohdr.tcp4hdr, tcb);
2576                         if(hbp == NULL) {
2577                                 freeblist(bp);
2578                                 return;
2579                         }
2580                         break;
2581                 case V6:
2582                         tcb->protohdr.tcp6hdr.vcf[0] = IP_VER6;
2583                         hbp = htontcp6(&seg, bp, &tcb->protohdr.tcp6hdr, tcb);
2584                         if(hbp == NULL) {
2585                                 freeblist(bp);
2586                                 return;
2587                         }
2588                         break;
2589                 default:
2590                         hbp = NULL;     /* to suppress a warning */
2591                         panic("tcpoutput: version %d", version);
2592                 }
2593
2594                 /* Start the transmission timers if there is new data and we
2595                  * expect acknowledges
2596                  */
2597                 if(ssize != 0){
2598                         if(tcb->timer.state != TcptimerON)
2599                                 tcpgo(tpriv, &tcb->timer);
2600
2601                         /*  If round trip timer isn't running, start it.
2602                          *  measure the longest packet only in case the
2603                          *  transmission time dominates RTT
2604                          */
2605                         if(tcb->rtt_timer.state != TcptimerON)
2606                         if(ssize == tcb->mss) {
2607                                 tcpgo(tpriv, &tcb->rtt_timer);
2608                                 tcb->rttseq = tcb->snd.ptr;
2609                         }
2610                 }
2611
2612                 tpriv->stats[OutSegs]++;
2613
2614                 /* put off the next keep alive */
2615                 tcpgo(tpriv, &tcb->katimer);
2616
2617                 switch(version){
2618                 case V4:
2619                         if(ipoput4(f, hbp, 0, s->ttl, s->tos, s) < 0){
2620                                 /* a negative return means no route */
2621                                 localclose(s, "no route");
2622                         }
2623                         break;
2624                 case V6:
2625                         if(ipoput6(f, hbp, 0, s->ttl, s->tos, s) < 0){
2626                                 /* a negative return means no route */
2627                                 localclose(s, "no route");
2628                         }
2629                         break;
2630                 default:
2631                         panic("tcpoutput2: version %d", version);
2632                 }
2633                 if((msgs%4) == 1){
2634                         qunlock(&s->qlock);
2635                         kthread_yield();
2636                         qlock(&s->qlock);
2637                 }
2638         }
2639 }
2640
2641 /*
2642  *  the BSD convention (hack?) for keep alives.  resend last uint8_t acked.
2643  */
2644 void
2645 tcpsendka(struct conv *s)
2646 {
2647         Tcp seg;
2648         Tcpctl *tcb;
2649         struct block *hbp,*dbp;
2650
2651         tcb = (Tcpctl*)s->ptcl;
2652
2653         dbp = NULL;
2654         seg.urg = 0;
2655         seg.source = s->lport;
2656         seg.dest = s->rport;
2657         seg.flags = ACK|PSH;
2658         seg.mss = 0;
2659         seg.ws = 0;
2660         if(tcpporthogdefense)
2661                 seg.seq = tcb->snd.una-(1<<30)-nrand(1<<20);
2662         else
2663                 seg.seq = tcb->snd.una-1;
2664         seg.ack = tcb->rcv.nxt;
2665         tcb->rcv.una = 0;
2666         seg.wnd = tcb->rcv.wnd;
2667         if(tcb->state == Finwait2){
2668                 seg.flags |= FIN;
2669         } else {
2670                 dbp = allocb(1);
2671                 dbp->wp++;
2672         }
2673
2674         if(isv4(s->raddr)) {
2675                 /* Build header, link data and compute cksum */
2676                 tcb->protohdr.tcp4hdr.vihl = IP_VER4;
2677                 hbp = htontcp4(&seg, dbp, &tcb->protohdr.tcp4hdr, tcb);
2678                 if(hbp == NULL) {
2679                         freeblist(dbp);
2680                         return;
2681                 }
2682                 ipoput4(s->p->f, hbp, 0, s->ttl, s->tos, s);
2683         }
2684         else {
2685                 /* Build header, link data and compute cksum */
2686                 tcb->protohdr.tcp6hdr.vcf[0] = IP_VER6;
2687                 hbp = htontcp6(&seg, dbp, &tcb->protohdr.tcp6hdr, tcb);
2688                 if(hbp == NULL) {
2689                         freeblist(dbp);
2690                         return;
2691                 }
2692                 ipoput6(s->p->f, hbp, 0, s->ttl, s->tos, s);
2693         }
2694 }
2695
2696 /*
2697  *  set connection to time out after 12 minutes
2698  */
2699 void
2700 tcpsetkacounter(Tcpctl *tcb)
2701 {
2702         tcb->kacounter = (12 * 60 * 1000) / (tcb->katimer.start*MSPTICK);
2703         if(tcb->kacounter < 3)
2704                 tcb->kacounter = 3;
2705 }
2706
2707 /*
2708  *  if we've timed out, close the connection
2709  *  otherwise, send a keepalive and restart the timer
2710  */
2711 void
2712 tcpkeepalive(void *v)
2713 {
2714         ERRSTACK(1);
2715         Tcpctl *tcb;
2716         struct conv *s;
2717
2718         s = v;
2719         tcb = (Tcpctl*)s->ptcl;
2720         if(waserror()){
2721                 qunlock(&s->qlock);
2722                 nexterror();
2723         }
2724         qlock(&s->qlock);
2725         if(tcb->state != Closed){
2726                 if(--(tcb->kacounter) <= 0) {
2727                         localclose(s, Etimedout);
2728                 } else {
2729                         tcpsendka(s);
2730                         tcpgo(s->p->priv, &tcb->katimer);
2731                 }
2732         }
2733         qunlock(&s->qlock);
2734         poperror();
2735 }
2736
2737 /*
2738  *  start keepalive timer
2739  */
2740 char*
2741 tcpstartka(struct conv *s, char **f, int n)
2742 {
2743         Tcpctl *tcb;
2744         int x;
2745
2746         tcb = (Tcpctl*)s->ptcl;
2747         if(tcb->state != Established)
2748                 return "connection must be in Establised state";
2749         if(n > 1){
2750                 x = atoi(f[1]);
2751                 if(x >= MSPTICK)
2752                         tcb->katimer.start = x/MSPTICK;
2753         }
2754         tcpsetkacounter(tcb);
2755         tcpgo(s->p->priv, &tcb->katimer);
2756
2757         return NULL;
2758 }
2759
2760 /*
2761  *  turn checksums on/off
2762  */
2763 char*
2764 tcpsetchecksum(struct conv *s, char **f, int unused)
2765 {
2766         Tcpctl *tcb;
2767
2768         tcb = (Tcpctl*)s->ptcl;
2769         tcb->nochecksum = !atoi(f[1]);
2770
2771         return NULL;
2772 }
2773
2774 void
2775 tcprxmit(struct conv *s)
2776 {
2777         Tcpctl *tcb;
2778
2779         tcb = (Tcpctl*)s->ptcl;
2780
2781         tcb->flags |= RETRAN|FORCE;
2782         tcb->snd.ptr = tcb->snd.una;
2783
2784         /*
2785          *  We should be halving the slow start threshhold (down to one
2786          *  mss) but leaving it at mss seems to work well enough
2787          */
2788         tcb->ssthresh = tcb->mss;
2789
2790         /*
2791          *  pull window down to a single packet
2792          */
2793         tcb->cwind = tcb->mss;
2794         tcpoutput(s);
2795 }
2796
2797 void
2798 tcptimeout(void *arg)
2799 {
2800         ERRSTACK(1);
2801         struct conv *s;
2802         Tcpctl *tcb;
2803         int maxback;
2804         struct tcppriv *tpriv;
2805
2806         s = (struct conv*)arg;
2807         tpriv = s->p->priv;
2808         tcb = (Tcpctl*)s->ptcl;
2809
2810         if(waserror()){
2811                 qunlock(&s->qlock);
2812                 nexterror();
2813         }
2814         qlock(&s->qlock);
2815         switch(tcb->state){
2816         default:
2817                 tcb->backoff++;
2818                 if(tcb->state == Syn_sent)
2819                         maxback = MAXBACKMS/2;
2820                 else
2821                         maxback = MAXBACKMS;
2822                 tcb->backedoff += tcb->timer.start * MSPTICK;
2823                 if(tcb->backedoff >= maxback) {
2824                         localclose(s, Etimedout);
2825                         break;
2826                 }
2827                 netlog(s->p->f, Logtcprxmt, "timeout rexmit 0x%lux %d/%d\n", tcb->snd.una, tcb->timer.start, NOW);
2828                 tcpsettimer(tcb);
2829                 tcprxmit(s);
2830                 tpriv->stats[RetransTimeouts]++;
2831                 tcb->snd.dupacks = 0;
2832                 break;
2833         case Time_wait:
2834                 localclose(s, NULL);
2835                 break;
2836         case Closed:
2837                 break;
2838         }
2839         qunlock(&s->qlock);
2840         poperror();
2841 }
2842
2843 int
2844 inwindow(Tcpctl *tcb, int seq)
2845 {
2846         return seq_within(seq, tcb->rcv.nxt, tcb->rcv.nxt+tcb->rcv.wnd-1);
2847 }
2848
2849 /*
2850  *  set up state for a received SYN (or SYN ACK) packet
2851  */
2852 void
2853 procsyn(struct conv *s, Tcp *seg)
2854 {
2855         Tcpctl *tcb;
2856
2857         tcb = (Tcpctl*)s->ptcl;
2858         tcb->flags |= FORCE;
2859
2860         tcb->rcv.nxt = seg->seq + 1;
2861         tcb->rcv.urg = tcb->rcv.nxt;
2862         tcb->irs = seg->seq;
2863
2864         /* our sending max segment size cannot be bigger than what he asked for */
2865         if(seg->mss != 0 && seg->mss < tcb->mss)
2866                 tcb->mss = seg->mss;
2867
2868         /* the congestion window always starts out as a single segment */
2869         tcb->snd.wnd = seg->wnd;
2870         tcb->cwind = tcb->mss;
2871 }
2872
2873 int
2874 addreseq(Tcpctl *tcb, struct tcppriv *tpriv, Tcp *seg,
2875          struct block *bp, uint16_t length)
2876 {
2877         Reseq *rp, *rp1;
2878         int i, rqlen, qmax;
2879
2880         rp = kzmalloc(sizeof(Reseq), 0);
2881         if(rp == NULL){
2882                 freeblist(bp);  /* bp always consumed by add_reseq */
2883                 return 0;
2884         }
2885
2886         rp->seg = *seg;
2887         rp->bp = bp;
2888         rp->length = length;
2889
2890         /* Place on reassembly list sorting by starting seq number */
2891         rp1 = tcb->reseq;
2892         if(rp1 == NULL || seq_lt(seg->seq, rp1->seg.seq)) {
2893                 rp->next = rp1;
2894                 tcb->reseq = rp;
2895                 if(rp->next != NULL)
2896                         tpriv->stats[OutOfOrder]++;
2897                 return 0;
2898         }
2899
2900         rqlen = 0;
2901         for(i = 0;; i++) {
2902                 rqlen += rp1->length;
2903                 if(rp1->next == NULL || seq_lt(seg->seq, rp1->next->seg.seq)) {
2904                         rp->next = rp1->next;
2905                         rp1->next = rp;
2906                         if(rp->next != NULL)
2907                                 tpriv->stats[OutOfOrder]++;
2908                         break;
2909                 }
2910                 rp1 = rp1->next;
2911         }
2912         qmax = QMAX<<tcb->rcv.scale;
2913         if(rqlen > qmax){
2914                 printd("resequence queue > window: %d > %d\n", rqlen, qmax);
2915                 i = 0;
2916                 for(rp1 = tcb->reseq; rp1 != NULL; rp1 = rp1->next){
2917                         printd("%#lux %#lux %#ux\n", rp1->seg.seq,
2918                                 rp1->seg.ack, rp1->seg.flags);
2919                         if(i++ > 10){
2920                                 printd("...\n");
2921                                 break;
2922                         }
2923                 }
2924
2925                 // delete entire reassembly queue; wait for retransmit.
2926                 // - should we be smarter and only delete the tail?
2927                 for(rp = tcb->reseq; rp != NULL; rp = rp1){
2928                         rp1 = rp->next;
2929                         freeblist(rp->bp);
2930                         kfree(rp);
2931                 }
2932                 tcb->reseq = NULL;
2933
2934                 return -1;
2935         }
2936         return 0;
2937 }
2938
2939 void
2940 getreseq(Tcpctl *tcb, Tcp *seg, struct block **bp, uint16_t *length)
2941 {
2942         Reseq *rp;
2943
2944         rp = tcb->reseq;
2945         if(rp == NULL)
2946                 return;
2947
2948         tcb->reseq = rp->next;
2949
2950         *seg = rp->seg;
2951         *bp = rp->bp;
2952         *length = rp->length;
2953
2954         kfree(rp);
2955 }
2956
2957 int
2958 tcptrim(Tcpctl *tcb, Tcp *seg, struct block **bp, uint16_t *length)
2959 {
2960         uint16_t len;
2961         uint8_t accept;
2962         int dupcnt, excess;
2963
2964         accept = 0;
2965         len = *length;
2966         if(seg->flags & SYN)
2967                 len++;
2968         if(seg->flags & FIN)
2969                 len++;
2970
2971         if(tcb->rcv.wnd == 0) {
2972                 if(len == 0 && seg->seq == tcb->rcv.nxt)
2973                         return 0;
2974         }
2975         else {
2976                 /* Some part of the segment should be in the window */
2977                 if(inwindow(tcb,seg->seq))
2978                         accept++;
2979                 else
2980                 if(len != 0) {
2981                         if(inwindow(tcb, seg->seq+len-1) ||
2982                         seq_within(tcb->rcv.nxt, seg->seq,seg->seq+len-1))
2983                                 accept++;
2984                 }
2985         }
2986         if(!accept) {
2987                 freeblist(*bp);
2988                 return -1;
2989         }
2990         dupcnt = tcb->rcv.nxt - seg->seq;
2991         if(dupcnt > 0){
2992                 tcb->rerecv += dupcnt;
2993                 if(seg->flags & SYN){
2994                         seg->flags &= ~SYN;
2995                         seg->seq++;
2996
2997                         if(seg->urg > 1)
2998                                 seg->urg--;
2999                         else
3000                                 seg->flags &= ~URG;
3001                         dupcnt--;
3002                 }
3003                 if(dupcnt > 0){
3004                         pullblock(bp, (uint16_t)dupcnt);
3005                         seg->seq += dupcnt;
3006                         *length -= dupcnt;
3007
3008                         if(seg->urg > dupcnt)
3009                                 seg->urg -= dupcnt;
3010                         else {
3011                                 seg->flags &= ~URG;
3012                                 seg->urg = 0;
3013                         }
3014                 }
3015         }
3016         excess = seg->seq + *length - (tcb->rcv.nxt + tcb->rcv.wnd);
3017         if(excess > 0) {
3018                 tcb->rerecv += excess;
3019                 *length -= excess;
3020                 *bp = trimblock(*bp, 0, *length);
3021                 if(*bp == NULL)
3022                         panic("presotto is a boofhead");
3023                 seg->flags &= ~FIN;
3024         }
3025         return 0;
3026 }
3027
3028 void
3029 tcpadvise(struct Proto *tcp, struct block *bp, char *msg)
3030 {
3031         Tcp4hdr *h4;
3032         Tcp6hdr *h6;
3033         Tcpctl *tcb;
3034         uint8_t source[IPaddrlen];
3035         uint8_t dest[IPaddrlen];
3036         uint16_t psource, pdest;
3037         struct conv *s, **p;
3038
3039         h4 = (Tcp4hdr*)(bp->rp);
3040         h6 = (Tcp6hdr*)(bp->rp);
3041
3042         if((h4->vihl&0xF0)==IP_VER4) {
3043                 v4tov6(dest, h4->tcpdst);
3044                 v4tov6(source, h4->tcpsrc);
3045                 psource = nhgets(h4->tcpsport);
3046                 pdest = nhgets(h4->tcpdport);
3047         }
3048         else {
3049                 ipmove(dest, h6->tcpdst);
3050                 ipmove(source, h6->tcpsrc);
3051                 psource = nhgets(h6->tcpsport);
3052                 pdest = nhgets(h6->tcpdport);
3053         }
3054
3055         /* Look for a connection */
3056         qlock(&tcp->qlock);
3057         for(p = tcp->conv; *p; p++) {
3058                 s = *p;
3059                 tcb = (Tcpctl*)s->ptcl;
3060                 if(s->rport == pdest)
3061                 if(s->lport == psource)
3062                 if(tcb->state != Closed)
3063                 if(ipcmp(s->raddr, dest) == 0)
3064                 if(ipcmp(s->laddr, source) == 0){
3065                         qlock(&s->qlock);
3066                         qunlock(&tcp->qlock);
3067                         switch(tcb->state){
3068                         case Syn_sent:
3069                                 localclose(s, msg);
3070                                 break;
3071                         }
3072                         qunlock(&s->qlock);
3073                         freeblist(bp);
3074                         return;
3075                 }
3076         }
3077         qunlock(&tcp->qlock);
3078         freeblist(bp);
3079 }
3080
3081 static char*
3082 tcpporthogdefensectl(char *val)
3083 {
3084         if(strcmp(val, "on") == 0)
3085                 tcpporthogdefense = 1;
3086         else if(strcmp(val, "off") == 0)
3087                 tcpporthogdefense = 0;
3088         else
3089                 return "unknown value for tcpporthogdefense";
3090         return NULL;
3091 }
3092
3093 /* called with c qlocked */
3094 char*
3095 tcpctl(struct conv* c, char** f, int n)
3096 {
3097         if(n == 1 && strcmp(f[0], "hangup") == 0)
3098                 return tcphangup(c);
3099         if(n >= 1 && strcmp(f[0], "keepalive") == 0)
3100                 return tcpstartka(c, f, n);
3101         if(n >= 1 && strcmp(f[0], "checksum") == 0)
3102                 return tcpsetchecksum(c, f, n);
3103         if(n >= 1 && strcmp(f[0], "tcpporthogdefense") == 0)
3104                 return tcpporthogdefensectl(f[1]);
3105         return "unknown control request";
3106 }
3107
3108 int
3109 tcpstats(struct Proto *tcp, char *buf, int len)
3110 {
3111         struct tcppriv *priv;
3112         char *p, *e;
3113         int i;
3114
3115         priv = tcp->priv;
3116         p = buf;
3117         e = p+len;
3118         for(i = 0; i < Nstats; i++)
3119                 p = seprintf(p, e, "%s: %lud\n", statnames[i], priv->stats[i]);
3120         return p - buf;
3121 }
3122
3123 /*
3124  *  garbage collect any stale conversations:
3125  *      - SYN received but no SYN-ACK after 5 seconds (could be the SYN attack)
3126  *      - Finwait2 after 5 minutes
3127  *
3128  *  this is called whenever we run out of channels.  Both checks are
3129  *  of questionable validity so we try to use them only when we're
3130  *  up against the wall.
3131  */
3132 int
3133 tcpgc(struct Proto *tcp)
3134 {
3135         struct conv *c, **pp, **ep;
3136         int n;
3137         Tcpctl *tcb;
3138
3139
3140         n = 0;
3141         ep = &tcp->conv[tcp->nc];
3142         for(pp = tcp->conv; pp < ep; pp++) {
3143                 c = *pp;
3144                 if(c == NULL)
3145                         break;
3146                 if(!canqlock(&c->qlock))
3147                         continue;
3148                 tcb = (Tcpctl*)c->ptcl;
3149                 switch(tcb->state){
3150                 case Syn_received:
3151                         if(NOW - tcb->time > 5000){
3152                                 localclose(c, "timed out");
3153                                 n++;
3154                         }
3155                         break;
3156                 case Finwait2:
3157                         if(NOW - tcb->time > 5*60*1000){
3158                                 localclose(c, "timed out");
3159                                 n++;
3160                         }
3161                         break;
3162                 }
3163                 qunlock(&c->qlock);
3164         }
3165         return n;
3166 }
3167
3168 void
3169 tcpsettimer(Tcpctl *tcb)
3170 {
3171         int x;
3172
3173         /* round trip dependency */
3174         x = backoff(tcb->backoff) *
3175                 (tcb->mdev + (tcb->srtt>>LOGAGAIN) + MSPTICK) / MSPTICK;
3176
3177         /* bounded twixt 1/2 and 64 seconds */
3178         if(x < 500/MSPTICK)
3179                 x = 500/MSPTICK;
3180         else if(x > (64000/MSPTICK))
3181                 x = 64000/MSPTICK;
3182         tcb->timer.start = x;
3183 }
3184
3185 void
3186 tcpinit(struct Fs *fs)
3187 {
3188         struct Proto *tcp;
3189         struct tcppriv *tpriv;
3190
3191         tcp = kzmalloc(sizeof(struct Proto), 0);
3192         tpriv = tcp->priv = kzmalloc(sizeof(struct tcppriv), 0);
3193         qlock_init(&tpriv->tl);
3194         qlock_init(&tpriv->apl);
3195         tcp->name = "tcp";
3196         tcp->connect = tcpconnect;
3197         tcp->announce = tcpannounce;
3198         tcp->ctl = tcpctl;
3199         tcp->state = tcpstate;
3200         tcp->create = tcpcreate;
3201         tcp->close = tcpclose;
3202         tcp->rcv = tcpiput;
3203         tcp->advise = tcpadvise;
3204         tcp->stats = tcpstats;
3205         tcp->inuse = tcpinuse;
3206         tcp->gc = tcpgc;
3207         tcp->ipproto = IP_TCPPROTO;
3208         tcp->nc = scalednconv();
3209         tcp->ptclsize = sizeof(Tcpctl);
3210         tpriv->stats[MaxConn] = tcp->nc;
3211
3212         Fsproto(fs, tcp);
3213 }
3214
3215 void
3216 tcpsetscale(struct conv *s, Tcpctl *tcb, uint16_t rcvscale, uint16_t sndscale)
3217 {
3218         if(rcvscale){
3219                 tcb->rcv.scale = rcvscale & 0xff;
3220                 tcb->snd.scale = sndscale & 0xff;
3221                 tcb->window = QMAX<<tcb->snd.scale;
3222                 qsetlimit(s->rq, tcb->window);
3223         } else {
3224                 tcb->rcv.scale = 0;
3225                 tcb->snd.scale = 0;
3226                 tcb->window = QMAX;
3227                 qsetlimit(s->rq, tcb->window);
3228         }
3229 }