* prediction?").  If timestamp is the only option and it's		 * formatted as recommended in RFC 1323 appendix A, we		 * quickly get the values now and not bother calling		 * tcp_dooptions(), etc.		 */		if ((optlen == TCPOLEN_TSTAMP_APPA ||		     (optlen > TCPOLEN_TSTAMP_APPA &&			optp[TCPOLEN_TSTAMP_APPA] == TCPOPT_EOL)) &&		     *(u_long *)optp == htonl(TCPOPT_TSTAMP_HDR) &&		     (ti->ti_flags & TH_SYN) == 0) {			ts_present = 1;			ts_val = ntohl(*(u_long *)(optp + 4));			ts_ecr = ntohl(*(u_long *)(optp + 8));			optp = NULL;	/* we've parsed the options */		}	}	tiflags = ti->ti_flags;	/*	 * Convert TCP protocol specific fields to host format.	 */	NTOHL(ti->ti_seq);	NTOHL(ti->ti_ack);	NTOHS(ti->ti_win);	NTOHS(ti->ti_urp);	/*	 * Locate pcb for segment.	 */findpcb:	inp = tcp_last_inpcb;        if ((inp != NULL) &&            (inp->inp_lport == ti->ti_dport) &&	    (inp->inp_fport == ti->ti_sport) &&	    (inp->inp_faddr.s_addr == ti->ti_src.s_addr) &&            (inp->inp_laddr.s_addr == ti->ti_dst.s_addr))            {            goto pcbMatchFound;            }        else            {            ++tcpstat.tcps_pcbcachemiss;            /*             * Search the hash table of pcbs.             */            inp = in_pcblookuphash (&tcbinfo, ti->ti_src, ti->ti_sport,                                    ti->ti_dst, ti->ti_dport, 1);            /*             * ...and if that fails, drop the packet.             */            if (inp == NULL)                {#ifdef WV_INSTRUMENTATION#ifdef INCLUDE_WVNET    /* WV_NET_WARNING event */            WV_NET_PORTIN_EVENT_4 (NET_CORE_EVENT, WV_NET_WARNING, 11, 4,                                   ti->ti_sport, ti->ti_dport,                                   WV_NETEVENT_TCPIN_SEARCHFAIL, WV_NET_RECV,                                    ti->ti_src.s_addr, ti->ti_sport,                                   ti->ti_dst.s_addr, ti->ti_dport)#endif  /* INCLUDE_WVNET */#endif                /*                 * If the state is CLOSED (i.e., TCB does not exist) then                 * all data in the incoming segment is discarded.                 * If the TCB exists but is in CLOSED state, it is embryonic,                 * but should either do a listen or a connect soon.                 */                goto dropwithreset;                }            }        tcp_last_inpcb = inp;		/* update the cache */pcbMatchFound:	tp = intotcpcb(inp);	if (tp == 0)		goto dropwithreset;	if (tp->t_state == TCPS_CLOSED)		goto drop;		/* Unscale the window into a 32-bit value. */	if ((tiflags & TH_SYN) == 0)		tiwin = ti->ti_win << tp->snd_scale;	else		tiwin = ti->ti_win;	so = inp->inp_socket;	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {		if (so->so_options & SO_DEBUG) {			ostate = tp->t_state;			tcp_saveti = *ti;		}		if (so->so_options & SO_ACCEPTCONN) {			if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {				/*				 * Note: dropwithreset makes sure we don't				 * send a reset in response to a RST.				 */				if (tiflags & TH_ACK) {					tcpstat.tcps_badsyn++;					goto dropwithreset;				}				goto drop;			}			so = sonewconn(so, 0);			if (so == 0)				goto drop;			/*			 * This is ugly, but ....			 *			 * Mark socket as temporary until we're			 * committed to keeping it.  The code at			 * ``drop'' and ``dropwithreset'' check the			 * flag dropsocket to see if the temporary			 * socket created here should be discarded.			 * We mark the socket as discardable until			 * we're committed to it below in TCPS_LISTEN.			 */			dropsocket++;			inp = (struct inpcb *)so->so_pcb;			inp->inp_laddr = ti->ti_dst;			inp->inp_lport = ti->ti_dport;                        in_pcbrehash(inp);#ifdef SRCRT#if BSD>=43			inp->inp_options = ip_srcroute();#endif#endif /* SRCRT */			tp = intotcpcb(inp);			tp->t_state = TCPS_LISTEN;			/* Compute proper scaling value from buffer space			 */			while (tp->request_r_scale < TCP_MAX_WINSHIFT &&			   TCP_MAXWIN << tp->request_r_scale < so->so_rcv.sb_hiwat)				tp->request_r_scale++;		}	}	/*	 * Segment received on connection.	 * Reset idle time and keep-alive timer.	 */	tp->t_idle = 0;	tp->t_timer[TCPT_KEEP] = tcp_keepidle;	/*	 * Process options if not in LISTEN state,	 * else do it below (after getting remote address).	 */	if (optp && tp->t_state != TCPS_LISTEN)		tcp_dooptions(tp, optp, optlen, ti,			&ts_present, &ts_val, &ts_ecr);	/* 	 * Header prediction: check for the two common cases	 * of a uni-directional data xfer.  If the packet has	 * no control flags, is in-sequence, the window didn't	 * change and we're not retransmitting, it's a	 * candidate.  If the length is zero and the ack moved	 * forward, we're the sender side of the xfer.  Just	 * free the data acked & wake any higher level process	 * that was blocked waiting for space.  If the length	 * is non-zero and the ack didn't move, we're the	 * receiver side.  If we're getting packets in-order	 * (the reassembly queue is empty), add the data to	 * the socket buffer and note that we need a delayed ack.	 */	if (tp->t_state == TCPS_ESTABLISHED &&	    (tiflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&	    (!ts_present || TSTMP_GEQ(ts_val, tp->ts_recent)) &&	    ti->ti_seq == tp->rcv_nxt &&	    tiwin && tiwin == tp->snd_wnd &&	    tp->snd_nxt == tp->snd_max) {		/* 		 * If last ACK falls within this segment's sequence numbers,		 *  record the timestamp.		 */		if (ts_present && SEQ_LEQ(ti->ti_seq, tp->last_ack_sent)) {			tp->ts_recent_age = tcp_now;			tp->ts_recent = ts_val;		}		if (ti->ti_len == 0) {			if (SEQ_GT(ti->ti_ack, tp->snd_una) &&			    SEQ_LEQ(ti->ti_ack, tp->snd_max) &&			    tp->snd_cwnd >= tp->snd_wnd) {				/*				 * this is a pure ack for outstanding data.				 */				++tcpstat.tcps_predack;				if (ts_present)					tcp_xmit_timer(tp, tcp_now-ts_ecr+1);				else if (tp->t_rtt &&					    SEQ_GT(ti->ti_ack, tp->t_rtseq))					tcp_xmit_timer(tp, tp->t_rtt);				acked = ti->ti_ack - tp->snd_una;#ifdef WV_INSTRUMENTATION#ifdef INCLUDE_WVNET    /* WV_NET_INFO event */            WV_NET_PORTIN_EVENT_3 (NET_CORE_EVENT, WV_NET_INFO, 27, 9,                                   ti->ti_sport, ti->ti_dport,                                   WV_NETEVENT_TCPIN_PUREACK, WV_NET_RECV,                                    so->so_fd, tp->snd_una, ti->ti_ack)#endif  /* INCLUDE_WVNET */#endif				tcpstat.tcps_rcvackpack++;				tcpstat.tcps_rcvackbyte += acked;				sbdrop(&so->so_snd, acked);				tp->snd_una = ti->ti_ack;				m_freem(m);				/*				 * If all outstanding data are acked, stop				 * retransmit timer, otherwise restart timer				 * using current (possibly backed-off) value.				 * If process is waiting for space,				 * wakeup/selwakeup/signal.  If data				 * are ready to send, let tcp_output				 * decide between more output or persist.				 */				if (tp->snd_una == tp->snd_max)					tp->t_timer[TCPT_REXMT] = 0;				else if (tp->t_timer[TCPT_PERSIST] == 0)					tp->t_timer[TCPT_REXMT] = tp->t_rxtcur;				if ((so->so_snd.sb_want > 0) ||				    (so->so_snd.sb_sel)      ||				    (sowakeupHook != NULL))				    {				    if (sbspace (&so->so_snd) >= 					so->so_snd.sb_lowat) 					sowwakeup(so);				    }				if (so->so_snd.sb_cc)					(void) tcp_output(tp);				return;			}		} else if (ti->ti_ack == tp->snd_una &&		    tp->seg_next == (struct tcpiphdr *)tp &&		    ti->ti_len <= sbspace(&so->so_rcv)) {			/*			 * this is a pure, in-sequence data packet			 * with nothing on the reassembly queue and			 * we have enough buffer space to take it.			 */#ifdef WV_INSTRUMENTATION#ifdef INCLUDE_WVNET    /* WV_NET_INFO event */        WV_NET_PORTIN_EVENT_3 (NET_CORE_EVENT, WV_NET_INFO, 28, 10,                               ti->ti_sport, ti->ti_dport,                               WV_NETEVENT_TCPIN_PUREDATA, WV_NET_RECV,                                so->so_fd, ti->ti_seq, ti->ti_len)#endif  /* INCLUDE_WVNET */#endif			++tcpstat.tcps_preddat;			tp->rcv_nxt += ti->ti_len;			tcpstat.tcps_rcvpack++;			tcpstat.tcps_rcvbyte += ti->ti_len;			/*			 * Drop TCP, IP headers and TCP options then add data			 * to socket buffer.			 */			m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);			m->m_len -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);			sbappend(&so->so_rcv, m);			sorwakeup(so);			if (ti->ti_flags & TH_PUSH)				tp->t_flags |= TF_ACKNOW;			else				tp->t_flags |= TF_DELACK;			return;		}	}	/*	 * Drop TCP, IP headers and TCP options.	 */	m->m_data += sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);	m->m_len  -= sizeof(struct tcpiphdr)+off-sizeof(struct tcphdr);	/*	 * Calculate amount of space in receive window,	 * and then do TCP input processing.	 * Receive window is amount of space in rcv queue,	 * but not less than advertised window.	 */	{ int win;	win = sbspace(&so->so_rcv);	if (win < 0)		win = 0;	tp->rcv_wnd = max(win, (int)(tp->rcv_adv - tp->rcv_nxt));	}	switch (tp->t_state) {	/*	 * If the state is LISTEN then ignore segment if it contains an RST.	 * If the segment contains an ACK then it is bad and send a RST.	 * If it does not contain a SYN then it is not interesting; drop it.	 * Don't bother responding if the destination was a broadcast.	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial	 * tp->iss, and send a segment:	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.	 * Fill in remote peer address fields if not previously specified.	 * Enter SYN_RECEIVED state, and process any other fields of this	 * segment in this state.	 */	case TCPS_LISTEN: {		struct mbuf *am;		register struct sockaddr_in *sin;#ifdef already_done		if (tiflags & TH_RST)			goto drop;		if (tiflags & TH_ACK)			goto dropwithreset;		if ((tiflags & TH_SYN) == 0)			goto drop;#endif		/*		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN		 * in_broadcast() should never return true on a received		 * packet with M_BCAST not set.		 */		if (m->m_flags & (M_BCAST|M_MCAST) ||		    IN_MULTICAST(ntohl(ti->ti_dst.s_addr)))			goto drop;                /* XXX land bug attack fix */                if (_landAttackSafe)                    if ((ti->ti_sport == ti->ti_dport) &&                        (ti->ti_src.s_addr == ti->ti_dst.s_addr))                        goto drop;                		/* XXX */		am = mBufClGet(M_DONTWAIT, MT_SONAME, CL_SIZE_128, TRUE);		if (am == NULL)			goto drop;		am->m_len = sizeof (struct sockaddr_in);		sin = mtod(am, struct sockaddr_in *);		sin->sin_family = AF_INET;		sin->sin_len = sizeof(*sin);		sin->sin_addr = ti->ti_src;		sin->sin_port = ti->ti_sport;		bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));		laddr = inp->inp_laddr;		if (inp->inp_laddr.s_addr == INADDR_ANY)			inp->inp_laddr = ti->ti_dst;		if (in_pcbconnect(inp, am)) {			inp->inp_laddr = laddr;			(void) m_free(am);			goto drop;		}		(void) m_free(am);		tp->t_template = tcp_template(tp);		if (tp->t_template == 0) {			tp = tcp_drop(tp, ENOBUFS);			dropsocket = 0;		/* socket is already gone */			goto drop;		}		if (optp)			tcp_dooptions(tp, optp, optlen, ti,				&ts_present, &ts_val, &ts_ecr);		if (iss)			tp->iss = iss;		else			tp->iss = tcp_iss;		tcp_iss += TCP_ISSINCR/4 + ((0x0000ffff) & (pTcpRandHook() >> 16));		tp->irs = ti->ti_seq;		tcp_sendseqinit(tp);		tcp_rcvseqinit(tp);		tp->t_flags |= TF_ACKNOW;		tp->t_state = TCPS_SYN_RECEIVED;		tp->t_timer[TCPT_KEEP] = tcp_keepinit;		dropsocket = 0;		/* committed to socket */		tcpstat.tcps_accepts++;#ifdef WV_INSTRUMENTATION#ifdef INCLUDE_WVNET    /* WV_NET_INFO event */            WV_NET_PORTIN_EVENT_3 (NET_AUX_EVENT, WV_NET_INFO, 29, 11,                                   ti->ti_sport, ti->ti_dport,                                   WV_NETEVENT_TCPIN_ACCEPT, WV_NET_RECV,                                    so->so_fd, tp->snd_nxt, tp->rcv_nxt)#endif  /* INCLUDE_WVNET */#endif		goto trimthenstep6;		}	/*	 * If the state is SYN_SENT:	 *	if seg contains an ACK, but not for our SYN, drop the input.	 *	if seg contains a RST, then drop the connection.	 *	if seg does not contain SYN, then drop it.	 * Otherwise this is an acceptable SYN segment	 *	initialize tp->rcv_nxt and tp->irs	 *	if seg contains ack then advance tp->snd_una	 *	if SYN has been acked change to ESTABLISHED else SYN_RCVD state	 *	arrange for segment to be acked (eventually)	 *	continue processing rest of data/controls, beginning with URG	 */	case TCPS_SYN_SENT:		if ((tiflags & TH_ACK) &&		    (SEQ_LEQ(ti->ti_ack, tp->iss) ||		     SEQ_GT(ti->ti_ack, tp->snd_max)))			goto dropwithreset;		if (tiflags & TH_RST) {			if (tiflags & TH_ACK)				tp = tcp_drop(tp, ECONNREFUSED);			goto drop;		}