tcp: accept untimestamped keepalive segments only if flags==TH_ACK

[unleashed.git] / kernel / net / tcp / tcp_input.c

/*
 * CDDL HEADER START
 *
 * The contents of this file are subject to the terms of the
 * Common Development and Distribution License (the "License").
 * You may not use this file except in compliance with the License.
 *
 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
 * or http://www.opensolaris.org/os/licensing.
 * See the License for the specific language governing permissions
 * and limitations under the License.
 *
 * When distributing Covered Code, include this CDDL HEADER in each
 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
 * If applicable, add the following below this CDDL HEADER, with the
 * fields enclosed by brackets "[]" replaced with your own identifying
 * information: Portions Copyright [yyyy] [name of copyright owner]
 *
 * CDDL HEADER END
 */

/*
 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
 * Copyright 2016 Joyent, Inc.
 * Copyright (c) 2014 by Delphix. All rights reserved.
 */

/* This file contains all TCP input processing functions. */

#include <sys/types.h>
#include <sys/stream.h>
#include <sys/strsun.h>
#include <sys/strsubr.h>
#include <sys/stropts.h>
#include <sys/strlog.h>
#define _SUN_TPI_VERSION 2
#include <sys/tihdr.h>
#include <sys/suntpi.h>
#include <sys/xti_inet.h>
#include <sys/squeue_impl.h>
#include <sys/squeue.h>

#include <inet/common.h>
#include <inet/ip.h>
#include <inet/tcp.h>
#include <inet/tcp_impl.h>
#include <inet/proto_set.h>
#include <inet/ipsec_impl.h>

/*
 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
 */

#ifdef _BIG_ENDIAN
#define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
        (TCPOPT_TSTAMP << 8) | 10)
#else
#define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
        (TCPOPT_NOP << 8) | TCPOPT_NOP)
#endif

/*
 *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days
 */
#define PAWS_TIMEOUT    ((clock_t)(24*24*60*60*hz))

/*
 * Since tcp_listener is not cleared atomically with tcp_detached
 * being cleared we need this extra bit to tell a detached connection
 * apart from one that is in the process of being accepted.
 */
#define TCP_IS_DETACHED_NONEAGER(tcp)   \
        (TCP_IS_DETACHED(tcp) &&        \
            (!(tcp)->tcp_hard_binding))

/*
 * Steps to do when a tcp_t moves to TIME-WAIT state.
 *
 * This connection is done, we don't need to account for it.  Decrement
 * the listener connection counter if needed.
 *
 * Decrement the connection counter of the stack.  Note that this counter
 * is per CPU.  So the total number of connections in a stack is the sum of all
 * of them.  Since there is no lock for handling all of them exclusively, the
 * resulting sum is only an approximation.
 *
 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
 * connection won't interfere with new ones.
 *
 * Start the TIME-WAIT timer.  If upper layer has not closed the connection,
 * the timer is handled within the context of this tcp_t.  When the timer
 * fires, tcp_clean_death() is called.  If upper layer closes the connection
 * during this period, tcp_time_wait_append() will be called to add this
 * tcp_t to the global TIME-WAIT list.  Note that this means that the
 * actual wait time in TIME-WAIT state will be longer than the
 * tcps_time_wait_interval since the period before upper layer closes the
 * connection is not accounted for when tcp_time_wait_append() is called.
 *
 * If upper layer has closed the connection, call tcp_time_wait_append()
 * directly.
 *
 */
#define SET_TIME_WAIT(tcps, tcp, connp)                         \
{                                                               \
        (tcp)->tcp_state = TCPS_TIME_WAIT;                      \
        if ((tcp)->tcp_listen_cnt != NULL)                      \
                TCP_DECR_LISTEN_CNT(tcp);                       \
        atomic_dec_64(                                          \
            (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
        (connp)->conn_exclbind = 0;                             \
        if (!TCP_IS_DETACHED(tcp)) {                            \
                TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
        } else {                                                \
                tcp_time_wait_append(tcp);                      \
                TCP_DBGSTAT(tcps, tcp_rput_time_wait);          \
        }                                                       \
}

/*
 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
 * data, TCP will not respond with an ACK.  RFC 793 requires that
 * TCP responds with an ACK for such a bogus ACK.  By not following
 * the RFC, we prevent TCP from getting into an ACK storm if somehow
 * an attacker successfully spoofs an acceptable segment to our
 * peer; or when our peer is "confused."
 */
static uint32_t tcp_drop_ack_unsent_cnt = 10;

/*
 * To protect TCP against attacker using a small window and requesting
 * large amount of data (DoS attack by conuming memory), TCP checks the
 * window advertised in the last ACK of the 3-way handshake.  TCP uses
 * the tcp_mss (the size of one packet) value for comparion.  The window
 * should be larger than tcp_mss.  But while a sane TCP should advertise
 * a receive window larger than or equal to 4*MSS to avoid stop and go
 * tarrfic, not all TCP stacks do that.  This is especially true when
 * tcp_mss is a big value.
 *
 * To work around this issue, an additional fixed value for comparison
 * is also used.  If the advertised window is smaller than both tcp_mss
 * and tcp_init_wnd_chk, the ACK is considered as invalid.  So for large
 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
 * smaller than 8K is considered to be OK.
 */
static uint32_t tcp_init_wnd_chk = 4096;

/* Process ICMP source quench message or not. */
static boolean_t tcp_icmp_source_quench = B_FALSE;

static boolean_t tcp_outbound_squeue_switch = B_FALSE;

static mblk_t   *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
                    ip_recv_attr_t *);
static mblk_t   *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
                    ip_recv_attr_t *);
static boolean_t        tcp_drop_q0(tcp_t *);
static void     tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
static mblk_t   *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
                    ip_recv_attr_t *);
static void     tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
static void     tcp_process_options(tcp_t *, tcpha_t *);
static mblk_t   *tcp_reass(tcp_t *, mblk_t *, uint32_t);
static void     tcp_reass_elim_overlap(tcp_t *, mblk_t *);
static void     tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
static void     tcp_set_rto(tcp_t *, time_t);

/*
 * Set the MSS associated with a particular tcp based on its current value,
 * and a new one passed in. Observe minimums and maximums, and reset other
 * state variables that we want to view as multiples of MSS.
 *
 * The value of MSS could be either increased or descreased.
 */
void
tcp_mss_set(tcp_t *tcp, uint32_t mss)
{
        uint32_t        mss_max;
        tcp_stack_t     *tcps = tcp->tcp_tcps;
        conn_t          *connp = tcp->tcp_connp;

        if (connp->conn_ipversion == IPV4_VERSION)
                mss_max = tcps->tcps_mss_max_ipv4;
        else
                mss_max = tcps->tcps_mss_max_ipv6;

        if (mss < tcps->tcps_mss_min)
                mss = tcps->tcps_mss_min;
        if (mss > mss_max)
                mss = mss_max;
        /*
         * Unless naglim has been set by our client to
         * a non-mss value, force naglim to track mss.
         * This can help to aggregate small writes.
         */
        if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
                tcp->tcp_naglim = mss;
        /*
         * TCP should be able to buffer at least 4 MSS data for obvious
         * performance reason.
         */
        if ((mss << 2) > connp->conn_sndbuf)
                connp->conn_sndbuf = mss << 2;

        /*
         * Set the send lowater to at least twice of MSS.
         */
        if ((mss << 1) > connp->conn_sndlowat)
                connp->conn_sndlowat = mss << 1;

        /*
         * Update tcp_cwnd according to the new value of MSS. Keep the
         * previous ratio to preserve the transmit rate.
         */
        tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
        tcp->tcp_cwnd_cnt = 0;

        tcp->tcp_mss = mss;
        (void) tcp_maxpsz_set(tcp, B_TRUE);
}

/*
 * Extract option values from a tcp header.  We put any found values into the
 * tcpopt struct and return a bitmask saying which options were found.
 */
int
tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
{
        uchar_t         *endp;
        int             len;
        uint32_t        mss;
        uchar_t         *up = (uchar_t *)tcpha;
        int             found = 0;
        int32_t         sack_len;
        tcp_seq         sack_begin, sack_end;
        tcp_t           *tcp;

        endp = up + TCP_HDR_LENGTH(tcpha);
        up += TCP_MIN_HEADER_LENGTH;
        /*
         * If timestamp option is aligned as recommended in RFC 7323 Appendix
         * A, and is the only option, return quickly.
         */
        if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
            TCPOPT_REAL_TS_LEN &&
            OK_32PTR(up) &&
            *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
                tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4));
                tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));

                return (TCP_OPT_TSTAMP_PRESENT);
        }
        while (up < endp) {
                len = endp - up;
                switch (*up) {
                case TCPOPT_EOL:
                        break;

                case TCPOPT_NOP:
                        up++;
                        continue;

                case TCPOPT_MAXSEG:
                        if (len < TCPOPT_MAXSEG_LEN ||
                            up[1] != TCPOPT_MAXSEG_LEN)
                                break;

                        mss = BE16_TO_U16(up+2);
                        /* Caller must handle tcp_mss_min and tcp_mss_max_* */
                        tcpopt->tcp_opt_mss = mss;
                        found |= TCP_OPT_MSS_PRESENT;

                        up += TCPOPT_MAXSEG_LEN;
                        continue;

                case TCPOPT_WSCALE:
                        if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
                                break;

                        if (up[2] > TCP_MAX_WINSHIFT)
                                tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
                        else
                                tcpopt->tcp_opt_wscale = up[2];
                        found |= TCP_OPT_WSCALE_PRESENT;

                        up += TCPOPT_WS_LEN;
                        continue;

                case TCPOPT_SACK_PERMITTED:
                        if (len < TCPOPT_SACK_OK_LEN ||
                            up[1] != TCPOPT_SACK_OK_LEN)
                                break;
                        found |= TCP_OPT_SACK_OK_PRESENT;
                        up += TCPOPT_SACK_OK_LEN;
                        continue;

                case TCPOPT_SACK:
                        if (len <= 2 || up[1] <= 2 || len < up[1])
                                break;

                        /* If TCP is not interested in SACK blks... */
                        if ((tcp = tcpopt->tcp) == NULL) {
                                up += up[1];
                                continue;
                        }
                        sack_len = up[1] - TCPOPT_HEADER_LEN;
                        up += TCPOPT_HEADER_LEN;

                        /*
                         * If the list is empty, allocate one and assume
                         * nothing is sack'ed.
                         */
                        if (tcp->tcp_notsack_list == NULL) {
                                tcp_notsack_update(&(tcp->tcp_notsack_list),
                                    tcp->tcp_suna, tcp->tcp_snxt,
                                    &(tcp->tcp_num_notsack_blk),
                                    &(tcp->tcp_cnt_notsack_list));

                                /*
                                 * Make sure tcp_notsack_list is not NULL.
                                 * This happens when kmem_alloc(KM_NOSLEEP)
                                 * returns NULL.
                                 */
                                if (tcp->tcp_notsack_list == NULL) {
                                        up += sack_len;
                                        continue;
                                }
                                tcp->tcp_fack = tcp->tcp_suna;
                        }

                        while (sack_len > 0) {
                                if (up + 8 > endp) {
                                        up = endp;
                                        break;
                                }
                                sack_begin = BE32_TO_U32(up);
                                up += 4;
                                sack_end = BE32_TO_U32(up);
                                up += 4;
                                sack_len -= 8;
                                /*
                                 * Bounds checking.  Make sure the SACK
                                 * info is within tcp_suna and tcp_snxt.
                                 * If this SACK blk is out of bound, ignore
                                 * it but continue to parse the following
                                 * blks.
                                 */
                                if (SEQ_LEQ(sack_end, sack_begin) ||
                                    SEQ_LT(sack_begin, tcp->tcp_suna) ||
                                    SEQ_GT(sack_end, tcp->tcp_snxt)) {
                                        continue;
                                }
                                tcp_notsack_insert(&(tcp->tcp_notsack_list),
                                    sack_begin, sack_end,
                                    &(tcp->tcp_num_notsack_blk),
                                    &(tcp->tcp_cnt_notsack_list));
                                if (SEQ_GT(sack_end, tcp->tcp_fack)) {
                                        tcp->tcp_fack = sack_end;
                                }
                        }
                        found |= TCP_OPT_SACK_PRESENT;
                        continue;

                case TCPOPT_TSTAMP:
                        if (len < TCPOPT_TSTAMP_LEN ||
                            up[1] != TCPOPT_TSTAMP_LEN)
                                break;

                        tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
                        tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);

                        found |= TCP_OPT_TSTAMP_PRESENT;

                        up += TCPOPT_TSTAMP_LEN;
                        continue;

                default:
                        if (len <= 1 || len < (int)up[1] || up[1] == 0)
                                break;
                        up += up[1];
                        continue;
                }
                break;
        }
        return (found);
}

/*
 * Process all TCP option in SYN segment.  Note that this function should
 * be called after tcp_set_destination() is called so that the necessary info
 * from IRE is already set in the tcp structure.
 *
 * This function sets up the correct tcp_mss value according to the
 * MSS option value and our header size.  It also sets up the window scale
 * and timestamp values, and initialize SACK info blocks.  But it does not
 * change receive window size after setting the tcp_mss value.  The caller
 * should do the appropriate change.
 */
static void
tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
{
        int options;
        tcp_opt_t tcpopt;
        uint32_t mss_max;
        char *tmp_tcph;
        tcp_stack_t     *tcps = tcp->tcp_tcps;
        conn_t          *connp = tcp->tcp_connp;

        tcpopt.tcp = NULL;
        options = tcp_parse_options(tcpha, &tcpopt);

        /*
         * Process MSS option.  Note that MSS option value does not account
         * for IP or TCP options.  This means that it is equal to MTU - minimum
         * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
         * IPv6.
         */
        if (!(options & TCP_OPT_MSS_PRESENT)) {
                if (connp->conn_ipversion == IPV4_VERSION)
                        tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
                else
                        tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
        } else {
                if (connp->conn_ipversion == IPV4_VERSION)
                        mss_max = tcps->tcps_mss_max_ipv4;
                else
                        mss_max = tcps->tcps_mss_max_ipv6;
                if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
                        tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
                else if (tcpopt.tcp_opt_mss > mss_max)
                        tcpopt.tcp_opt_mss = mss_max;
        }

        /* Process Window Scale option. */
        if (options & TCP_OPT_WSCALE_PRESENT) {
                tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
                tcp->tcp_snd_ws_ok = B_TRUE;
        } else {
                tcp->tcp_snd_ws = B_FALSE;
                tcp->tcp_snd_ws_ok = B_FALSE;
                tcp->tcp_rcv_ws = B_FALSE;
        }

        /* Process Timestamp option. */
        if ((options & TCP_OPT_TSTAMP_PRESENT) &&
            (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
                tmp_tcph = (char *)tcp->tcp_tcpha;

                tcp->tcp_snd_ts_ok = B_TRUE;
                tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
                tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
                ASSERT(OK_32PTR(tmp_tcph));
                ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);

                /* Fill in our template header with basic timestamp option. */
                tmp_tcph += connp->conn_ht_ulp_len;
                tmp_tcph[0] = TCPOPT_NOP;
                tmp_tcph[1] = TCPOPT_NOP;
                tmp_tcph[2] = TCPOPT_TSTAMP;
                tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
                connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
                connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
                tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
        } else {
                tcp->tcp_snd_ts_ok = B_FALSE;
        }

        /*
         * Process SACK options.  If SACK is enabled for this connection,
         * then allocate the SACK info structure.  Note the following ways
         * when tcp_snd_sack_ok is set to true.
         *
         * For active connection: in tcp_set_destination() called in
         * tcp_connect().
         *
         * For passive connection: in tcp_set_destination() called in
         * tcp_input_listener().
         *
         * That's the reason why the extra TCP_IS_DETACHED() check is there.
         * That check makes sure that if we did not send a SACK OK option,
         * we will not enable SACK for this connection even though the other
         * side sends us SACK OK option.  For active connection, the SACK
         * info structure has already been allocated.  So we need to free
         * it if SACK is disabled.
         */
        if ((options & TCP_OPT_SACK_OK_PRESENT) &&
            (tcp->tcp_snd_sack_ok ||
            (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
                ASSERT(tcp->tcp_num_sack_blk == 0);
                ASSERT(tcp->tcp_notsack_list == NULL);

                tcp->tcp_snd_sack_ok = B_TRUE;
                if (tcp->tcp_snd_ts_ok) {
                        tcp->tcp_max_sack_blk = 3;
                } else {
                        tcp->tcp_max_sack_blk = 4;
                }
        } else if (tcp->tcp_snd_sack_ok) {
                /*
                 * Resetting tcp_snd_sack_ok to B_FALSE so that
                 * no SACK info will be used for this
                 * connection.  This assumes that SACK usage
                 * permission is negotiated.  This may need
                 * to be changed once this is clarified.
                 */
                ASSERT(tcp->tcp_num_sack_blk == 0);
                ASSERT(tcp->tcp_notsack_list == NULL);
                tcp->tcp_snd_sack_ok = B_FALSE;
        }

        /*
         * Now we know the exact TCP/IP header length, subtract
         * that from tcp_mss to get our side's MSS.
         */
        tcp->tcp_mss -= connp->conn_ht_iphc_len;

        /*
         * Here we assume that the other side's header size will be equal to
         * our header size.  We calculate the real MSS accordingly.  Need to
         * take into additional stuffs IPsec puts in.
         *
         * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
         */
        tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
            tcp->tcp_ipsec_overhead -
            ((connp->conn_ipversion == IPV4_VERSION ?
            IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);

        /*
         * Set MSS to the smaller one of both ends of the connection.
         * We should not have called tcp_mss_set() before, but our
         * side of the MSS should have been set to a proper value
         * by tcp_set_destination().  tcp_mss_set() will also set up the
         * STREAM head parameters properly.
         *
         * If we have a larger-than-16-bit window but the other side
         * didn't want to do window scale, tcp_rwnd_set() will take
         * care of that.
         */
        tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));

        /*
         * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
         * updated properly.
         */
        TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
}

/*
 * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
 * is filled, return as much as we can.  The message passed in may be
 * multi-part, chained using b_cont.  "start" is the starting sequence
 * number for this piece.
 */
static mblk_t *
tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
{
        uint32_t        end;
        mblk_t          *mp1;
        mblk_t          *mp2;
        mblk_t          *next_mp;
        uint32_t        u1;
        tcp_stack_t     *tcps = tcp->tcp_tcps;


        /* Walk through all the new pieces. */
        do {
                ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
                    (uintptr_t)INT_MAX);
                end = start + (int)(mp->b_wptr - mp->b_rptr);
                next_mp = mp->b_cont;
                if (start == end) {
                        /* Empty.  Blast it. */
                        freeb(mp);
                        continue;
                }
                mp->b_cont = NULL;
                TCP_REASS_SET_SEQ(mp, start);
                TCP_REASS_SET_END(mp, end);
                mp1 = tcp->tcp_reass_tail;
                if (!mp1) {
                        tcp->tcp_reass_tail = mp;
                        tcp->tcp_reass_head = mp;
                        TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
                        TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
                            end - start);
                        continue;
                }
                /* New stuff completely beyond tail? */
                if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
                        /* Link it on end. */
                        mp1->b_cont = mp;
                        tcp->tcp_reass_tail = mp;
                        TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
                        TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
                            end - start);
                        continue;
                }
                mp1 = tcp->tcp_reass_head;
                u1 = TCP_REASS_SEQ(mp1);
                /* New stuff at the front? */
                if (SEQ_LT(start, u1)) {
                        /* Yes... Check for overlap. */
                        mp->b_cont = mp1;
                        tcp->tcp_reass_head = mp;
                        tcp_reass_elim_overlap(tcp, mp);
                        continue;
                }
                /*
                 * The new piece fits somewhere between the head and tail.
                 * We find our slot, where mp1 precedes us and mp2 trails.
                 */
                for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
                        u1 = TCP_REASS_SEQ(mp2);
                        if (SEQ_LEQ(start, u1))
                                break;
                }
                /* Link ourselves in */
                mp->b_cont = mp2;
                mp1->b_cont = mp;

                /* Trim overlap with following mblk(s) first */
                tcp_reass_elim_overlap(tcp, mp);

                /* Trim overlap with preceding mblk */
                tcp_reass_elim_overlap(tcp, mp1);

        } while (start = end, mp = next_mp);
        mp1 = tcp->tcp_reass_head;
        /* Anything ready to go? */
        if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
                return (NULL);
        /* Eat what we can off the queue */
        for (;;) {
                mp = mp1->b_cont;
                end = TCP_REASS_END(mp1);
                TCP_REASS_SET_SEQ(mp1, 0);
                TCP_REASS_SET_END(mp1, 0);
                if (!mp) {
                        tcp->tcp_reass_tail = NULL;
                        break;
                }
                if (end != TCP_REASS_SEQ(mp)) {
                        mp1->b_cont = NULL;
                        break;
                }
                mp1 = mp;
        }
        mp1 = tcp->tcp_reass_head;
        tcp->tcp_reass_head = mp;
        return (mp1);
}

/* Eliminate any overlap that mp may have over later mblks */
static void
tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
{
        uint32_t        end;
        mblk_t          *mp1;
        uint32_t        u1;
        tcp_stack_t     *tcps = tcp->tcp_tcps;

        end = TCP_REASS_END(mp);
        while ((mp1 = mp->b_cont) != NULL) {
                u1 = TCP_REASS_SEQ(mp1);
                if (!SEQ_GT(end, u1))
                        break;
                if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
                        mp->b_wptr -= end - u1;
                        TCP_REASS_SET_END(mp, u1);
                        TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
                        TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
                            end - u1);
                        break;
                }
                mp->b_cont = mp1->b_cont;
                TCP_REASS_SET_SEQ(mp1, 0);
                TCP_REASS_SET_END(mp1, 0);
                freeb(mp1);
                TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
                TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
        }
        if (!mp1)
                tcp->tcp_reass_tail = mp;
}

/*
 * This function does PAWS protection check, per RFC 7323 section 5. Requires
 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
 * the segment passes the PAWS test, else returns B_FALSE.
 */
boolean_t
tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp)
{
        if (TSTMP_LT(tcpoptp->tcp_opt_ts_val,
            tcp->tcp_ts_recent)) {
                if (LBOLT_FASTPATH64 <
                    (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
                        /* This segment is not acceptable. */
                        return (B_FALSE);
                } else {
                        /*
                         * Connection has been idle for
                         * too long.  Reset the timestamp
                         */
                        tcp->tcp_ts_recent =
                            tcpoptp->tcp_opt_ts_val;
                }
        }
        return (B_TRUE);
}

/*
 * Defense for the SYN attack -
 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
 *    one from the list of droppable eagers. This list is a subset of q0.
 *    see comments before the definition of MAKE_DROPPABLE().
 * 2. Don't drop a SYN request before its first timeout. This gives every
 *    request at least til the first timeout to complete its 3-way handshake.
 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
 *    requests currently on the queue that has timed out. This will be used
 *    as an indicator of whether an attack is under way, so that appropriate
 *    actions can be taken. (It's incremented in tcp_timer() and decremented
 *    either when eager goes into ESTABLISHED, or gets freed up.)
 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
 *    # of timeout drops back to <= q0len/32 => SYN alert off
 */
static boolean_t
tcp_drop_q0(tcp_t *tcp)
{
        tcp_t   *eager;
        mblk_t  *mp;
        tcp_stack_t     *tcps = tcp->tcp_tcps;

        ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
        ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);

        /* Pick oldest eager from the list of droppable eagers */
        eager = tcp->tcp_eager_prev_drop_q0;

        /* If list is empty. return B_FALSE */
        if (eager == tcp) {
                return (B_FALSE);
        }

        /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
        if ((mp = allocb(0, BPRI_HI)) == NULL)
                return (B_FALSE);

        /*
         * Take this eager out from the list of droppable eagers since we are
         * going to drop it.
         */
        MAKE_UNDROPPABLE(eager);

        if (tcp->tcp_connp->conn_debug) {
                (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
                    "tcp_drop_q0: listen half-open queue (max=%d) overflow"
                    " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
                    tcp->tcp_conn_req_cnt_q0,
                    tcp_display(tcp, NULL, DISP_PORT_ONLY));
        }

        TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);

        /* Put a reference on the conn as we are enqueueing it in the sqeue */
        CONN_INC_REF(eager->tcp_connp);

        SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
            tcp_clean_death_wrapper, eager->tcp_connp, NULL,
            SQ_FILL, SQTAG_TCP_DROP_Q0);

        return (B_TRUE);
}

/*
 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
 */
static mblk_t *
tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
    ip_recv_attr_t *ira)
{
        tcp_t           *ltcp = lconnp->conn_tcp;
        tcp_t           *tcp = connp->conn_tcp;
        mblk_t          *tpi_mp;
        ipha_t          *ipha;
        ip6_t           *ip6h;
        sin6_t          sin6;
        uint_t          ifindex = ira->ira_ruifindex;
        tcp_stack_t     *tcps = tcp->tcp_tcps;

        if (ira->ira_flags & IRAF_IS_IPV4) {
                ipha = (ipha_t *)mp->b_rptr;

                connp->conn_ipversion = IPV4_VERSION;
                IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
                IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
                connp->conn_saddr_v6 = connp->conn_laddr_v6;

                sin6 = sin6_null;
                sin6.sin6_addr = connp->conn_faddr_v6;
                sin6.sin6_port = connp->conn_fport;
                sin6.sin6_family = AF_INET6;
                sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
                    IPCL_ZONEID(lconnp), tcps->tcps_netstack);

                if (connp->conn_recv_ancillary.crb_recvdstaddr) {
                        sin6_t  sin6d;

                        sin6d = sin6_null;
                        sin6d.sin6_addr = connp->conn_laddr_v6;
                        sin6d.sin6_port = connp->conn_lport;
                        sin6d.sin6_family = AF_INET;
                        tpi_mp = mi_tpi_extconn_ind(NULL,
                            (char *)&sin6d, sizeof (sin6_t),
                            (char *)&tcp,
                            (t_scalar_t)sizeof (intptr_t),
                            (char *)&sin6d, sizeof (sin6_t),
                            (t_scalar_t)ltcp->tcp_conn_req_seqnum);
                } else {
                        tpi_mp = mi_tpi_conn_ind(NULL,
                            (char *)&sin6, sizeof (sin6_t),
                            (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
                            (t_scalar_t)ltcp->tcp_conn_req_seqnum);
                }
        } else {
                ip6h = (ip6_t *)mp->b_rptr;

                connp->conn_ipversion = IPV6_VERSION;
                connp->conn_laddr_v6 = ip6h->ip6_dst;
                connp->conn_faddr_v6 = ip6h->ip6_src;
                connp->conn_saddr_v6 = connp->conn_laddr_v6;

                sin6 = sin6_null;
                sin6.sin6_addr = connp->conn_faddr_v6;
                sin6.sin6_port = connp->conn_fport;
                sin6.sin6_family = AF_INET6;
                sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
                sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
                    IPCL_ZONEID(lconnp), tcps->tcps_netstack);

                if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
                        /* Pass up the scope_id of remote addr */
                        sin6.sin6_scope_id = ifindex;
                } else {
                        sin6.sin6_scope_id = 0;
                }
                if (connp->conn_recv_ancillary.crb_recvdstaddr) {
                        sin6_t  sin6d;

                        sin6d = sin6_null;
                        sin6.sin6_addr = connp->conn_laddr_v6;
                        sin6d.sin6_port = connp->conn_lport;
                        sin6d.sin6_family = AF_INET6;
                        if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
                                sin6d.sin6_scope_id = ifindex;

                        tpi_mp = mi_tpi_extconn_ind(NULL,
                            (char *)&sin6d, sizeof (sin6_t),
                            (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
                            (char *)&sin6d, sizeof (sin6_t),
                            (t_scalar_t)ltcp->tcp_conn_req_seqnum);
                } else {
                        tpi_mp = mi_tpi_conn_ind(NULL,
                            (char *)&sin6, sizeof (sin6_t),
                            (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
                            (t_scalar_t)ltcp->tcp_conn_req_seqnum);
                }
        }

        tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
        return (tpi_mp);
}

/* Handle a SYN on an AF_INET socket */
static mblk_t *
tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
    ip_recv_attr_t *ira)
{
        tcp_t           *ltcp = lconnp->conn_tcp;
        tcp_t           *tcp = connp->conn_tcp;
        sin_t           sin;
        mblk_t          *tpi_mp = NULL;
        tcp_stack_t     *tcps = tcp->tcp_tcps;
        ipha_t          *ipha;

        ASSERT(ira->ira_flags & IRAF_IS_IPV4);
        ipha = (ipha_t *)mp->b_rptr;

        connp->conn_ipversion = IPV4_VERSION;
        IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
        IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
        connp->conn_saddr_v6 = connp->conn_laddr_v6;

        sin = sin_null;
        sin.sin_addr.s_addr = connp->conn_faddr_v4;
        sin.sin_port = connp->conn_fport;
        sin.sin_family = AF_INET;
        if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
                sin_t   sind;

                sind = sin_null;
                sind.sin_addr.s_addr = connp->conn_laddr_v4;
                sind.sin_port = connp->conn_lport;
                sind.sin_family = AF_INET;
                tpi_mp = mi_tpi_extconn_ind(NULL,
                    (char *)&sind, sizeof (sin_t), (char *)&tcp,
                    (t_scalar_t)sizeof (intptr_t), (char *)&sind,
                    sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
        } else {
                tpi_mp = mi_tpi_conn_ind(NULL,
                    (char *)&sin, sizeof (sin_t),
                    (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
                    (t_scalar_t)ltcp->tcp_conn_req_seqnum);
        }

        tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
        return (tpi_mp);
}

/*
 * Called via squeue to get on to eager's perimeter. It sends a
 * TH_RST if eager is in the fanout table. The listener wants the
 * eager to disappear either by means of tcp_eager_blowoff() or
 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
 * called (via squeue) if the eager cannot be inserted in the
 * fanout table in tcp_input_listener().
 */
/* ARGSUSED */
void
tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
{
        conn_t  *econnp = (conn_t *)arg;
        tcp_t   *eager = econnp->conn_tcp;
        tcp_t   *listener = eager->tcp_listener;

        /*
         * We could be called because listener is closing. Since
         * the eager was using listener's queue's, we avoid
         * using the listeners queues from now on.
         */
        ASSERT(eager->tcp_detached);
        econnp->conn_rq = NULL;
        econnp->conn_wq = NULL;

        /*
         * An eager's conn_fanout will be NULL if it's a duplicate
         * for an existing 4-tuples in the conn fanout table.
         * We don't want to send an RST out in such case.
         */
        if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
                tcp_xmit_ctl("tcp_eager_kill, can't wait",
                    eager, eager->tcp_snxt, 0, TH_RST);
        }

        /* We are here because listener wants this eager gone */
        if (listener != NULL) {
                mutex_enter(&listener->tcp_eager_lock);
                tcp_eager_unlink(eager);
                if (eager->tcp_tconnind_started) {
                        /*
                         * The eager has sent a conn_ind up to the
                         * listener but listener decides to close
                         * instead. We need to drop the extra ref
                         * placed on eager in tcp_input_data() before
                         * sending the conn_ind to listener.
                         */
                        CONN_DEC_REF(econnp);
                }
                mutex_exit(&listener->tcp_eager_lock);
                CONN_DEC_REF(listener->tcp_connp);
        }

        if (eager->tcp_state != TCPS_CLOSED)
                tcp_close_detached(eager);
}

/*
 * Reset any eager connection hanging off this listener marked
 * with 'seqnum' and then reclaim it's resources.
 */
boolean_t
tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
{
        tcp_t   *eager;
        mblk_t  *mp;

        eager = listener;
        mutex_enter(&listener->tcp_eager_lock);
        do {
                eager = eager->tcp_eager_next_q;
                if (eager == NULL) {
                        mutex_exit(&listener->tcp_eager_lock);
                        return (B_FALSE);
                }
        } while (eager->tcp_conn_req_seqnum != seqnum);

        if (eager->tcp_closemp_used) {
                mutex_exit(&listener->tcp_eager_lock);
                return (B_TRUE);
        }
        eager->tcp_closemp_used = B_TRUE;
        TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
        CONN_INC_REF(eager->tcp_connp);
        mutex_exit(&listener->tcp_eager_lock);
        mp = &eager->tcp_closemp;
        SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
            eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
        return (B_TRUE);
}

/*
 * Reset any eager connection hanging off this listener
 * and then reclaim it's resources.
 */
void
tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
{
        tcp_t   *eager;
        mblk_t  *mp;
        tcp_stack_t     *tcps = listener->tcp_tcps;

        ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));

        if (!q0_only) {
                /* First cleanup q */
                TCP_STAT(tcps, tcp_eager_blowoff_q);
                eager = listener->tcp_eager_next_q;
                while (eager != NULL) {
                        if (!eager->tcp_closemp_used) {
                                eager->tcp_closemp_used = B_TRUE;
                                TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
                                CONN_INC_REF(eager->tcp_connp);
                                mp = &eager->tcp_closemp;
                                SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
                                    tcp_eager_kill, eager->tcp_connp, NULL,
                                    SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
                        }
                        eager = eager->tcp_eager_next_q;
                }
        }
        /* Then cleanup q0 */
        TCP_STAT(tcps, tcp_eager_blowoff_q0);
        eager = listener->tcp_eager_next_q0;
        while (eager != listener) {
                if (!eager->tcp_closemp_used) {
                        eager->tcp_closemp_used = B_TRUE;
                        TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
                        CONN_INC_REF(eager->tcp_connp);
                        mp = &eager->tcp_closemp;
                        SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
                            tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
                            SQTAG_TCP_EAGER_CLEANUP_Q0);
                }
                eager = eager->tcp_eager_next_q0;
        }
}

/*
 * If we are an eager connection hanging off a listener that hasn't
 * formally accepted the connection yet, get off his list and blow off
 * any data that we have accumulated.
 */
void
tcp_eager_unlink(tcp_t *tcp)
{
        tcp_t   *listener = tcp->tcp_listener;

        ASSERT(listener != NULL);
        ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
        if (tcp->tcp_eager_next_q0 != NULL) {
                ASSERT(tcp->tcp_eager_prev_q0 != NULL);

                /* Remove the eager tcp from q0 */
                tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
                    tcp->tcp_eager_prev_q0;
                tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
                    tcp->tcp_eager_next_q0;
                ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
                listener->tcp_conn_req_cnt_q0--;

                tcp->tcp_eager_next_q0 = NULL;
                tcp->tcp_eager_prev_q0 = NULL;

                /*
                 * Take the eager out, if it is in the list of droppable
                 * eagers.
                 */
                MAKE_UNDROPPABLE(tcp);

                if (tcp->tcp_syn_rcvd_timeout != 0) {
                        /* we have timed out before */
                        ASSERT(listener->tcp_syn_rcvd_timeout > 0);
                        listener->tcp_syn_rcvd_timeout--;
                }
        } else {
                tcp_t   **tcpp = &listener->tcp_eager_next_q;
                tcp_t   *prev = NULL;

                for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
                        if (tcpp[0] == tcp) {
                                if (listener->tcp_eager_last_q == tcp) {
                                        /*
                                         * If we are unlinking the last
                                         * element on the list, adjust
                                         * tail pointer. Set tail pointer
                                         * to nil when list is empty.
                                         */
                                        ASSERT(tcp->tcp_eager_next_q == NULL);
                                        if (listener->tcp_eager_last_q ==
                                            listener->tcp_eager_next_q) {
                                                listener->tcp_eager_last_q =
                                                    NULL;
                                        } else {
                                                /*
                                                 * We won't get here if there
                                                 * is only one eager in the
                                                 * list.
                                                 */
                                                ASSERT(prev != NULL);
                                                listener->tcp_eager_last_q =
                                                    prev;
                                        }
                                }
                                tcpp[0] = tcp->tcp_eager_next_q;
                                tcp->tcp_eager_next_q = NULL;
                                tcp->tcp_eager_last_q = NULL;
                                ASSERT(listener->tcp_conn_req_cnt_q > 0);
                                listener->tcp_conn_req_cnt_q--;
                                break;
                        }
                        prev = tcpp[0];
                }
        }
        tcp->tcp_listener = NULL;
}

/* BEGIN CSTYLED */
/*
 *
 * The sockfs ACCEPT path:
 * =======================
 *
 * The eager is now established in its own perimeter as soon as SYN is
 * received in tcp_input_listener(). When sockfs receives conn_ind, it
 * completes the accept processing on the acceptor STREAM. The sending
 * of conn_ind part is common for both sockfs listener and a TLI/XTI
 * listener but a TLI/XTI listener completes the accept processing
 * on the listener perimeter.
 *
 * Common control flow for 3 way handshake:
 * ----------------------------------------
 *
 * incoming SYN (listener perimeter)    -> tcp_input_listener()
 *
 * incoming SYN-ACK-ACK (eager perim)   -> tcp_input_data()
 * send T_CONN_IND (listener perim)     -> tcp_send_conn_ind()
 *
 * Sockfs ACCEPT Path:
 * -------------------
 *
 * open acceptor stream (tcp_open allocates tcp_tli_accept()
 * as STREAM entry point)
 *
 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
 *
 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
 * association (we are not behind eager's squeue but sockfs is protecting us
 * and no one knows about this stream yet. The STREAMS entry point q->q_info
 * is changed to point at tcp_wput().
 *
 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
 * listener (done on listener's perimeter).
 *
 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
 * accept.
 *
 * TLI/XTI client ACCEPT path:
 * ---------------------------
 *
 * soaccept() sends T_CONN_RES on the listener STREAM.
 *
 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
 *
 * Locks:
 * ======
 *
 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
 * and listeners->tcp_eager_next_q.
 *
 * Referencing:
 * ============
 *
 * 1) We start out in tcp_input_listener by eager placing a ref on
 * listener and listener adding eager to listeners->tcp_eager_next_q0.
 *
 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
 * doing so we place a ref on the eager. This ref is finally dropped at the
 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
 * reference is dropped by the squeue framework.
 *
 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
 *
 * The reference must be released by the same entity that added the reference
 * In the above scheme, the eager is the entity that adds and releases the
 * references. Note that tcp_accept_finish executes in the squeue of the eager
 * (albeit after it is attached to the acceptor stream). Though 1. executes
 * in the listener's squeue, the eager is nascent at this point and the
 * reference can be considered to have been added on behalf of the eager.
 *
 * Eager getting a Reset or listener closing:
 * ==========================================
 *
 * Once the listener and eager are linked, the listener never does the unlink.
 * If the listener needs to close, tcp_eager_cleanup() is called which queues
 * a message on all eager perimeter. The eager then does the unlink, clears
 * any pointers to the listener's queue and drops the reference to the
 * listener. The listener waits in tcp_close outside the squeue until its
 * refcount has dropped to 1. This ensures that the listener has waited for
 * all eagers to clear their association with the listener.
 *
 * Similarly, if eager decides to go away, it can unlink itself and close.
 * When the T_CONN_RES comes down, we check if eager has closed. Note that
 * the reference to eager is still valid because of the extra ref we put
 * in tcp_send_conn_ind.
 *
 * Listener can always locate the eager under the protection
 * of the listener->tcp_eager_lock, and then do a refhold
 * on the eager during the accept processing.
 *
 * The acceptor stream accesses the eager in the accept processing
 * based on the ref placed on eager before sending T_conn_ind.
 * The only entity that can negate this refhold is a listener close
 * which is mutually exclusive with an active acceptor stream.
 *
 * Eager's reference on the listener
 * ===================================
 *
 * If the accept happens (even on a closed eager) the eager drops its
 * reference on the listener at the start of tcp_accept_finish. If the
 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
 * the reference is dropped in tcp_closei_local. If the listener closes,
 * the reference is dropped in tcp_eager_kill. In all cases the reference
 * is dropped while executing in the eager's context (squeue).
 */
/* END CSTYLED */

/* Process the SYN packet, mp, directed at the listener 'tcp' */

/*
 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
 * tcp_input_data will not see any packets for listeners since the listener
 * has conn_recv set to tcp_input_listener.
 */
/* ARGSUSED */
static void
tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
{
        tcpha_t         *tcpha;
        uint32_t        seg_seq;
        tcp_t           *eager;
        int             err;
        conn_t          *econnp = NULL;
        squeue_t        *new_sqp;
        mblk_t          *mp1;
        uint_t          ip_hdr_len;
        conn_t          *lconnp = (conn_t *)arg;
        tcp_t           *listener = lconnp->conn_tcp;
        tcp_stack_t     *tcps = listener->tcp_tcps;
        ip_stack_t      *ipst = tcps->tcps_netstack->netstack_ip;
        uint_t          flags;
        mblk_t          *tpi_mp;
        uint_t          ifindex = ira->ira_ruifindex;
        boolean_t       tlc_set = B_FALSE;

        ip_hdr_len = ira->ira_ip_hdr_length;
        tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
        flags = (unsigned int)tcpha->tha_flags & 0xFF;

        DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
            __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
            __dtrace_tcp_tcph_t *, tcpha);

        if (!(flags & TH_SYN)) {
                if ((flags & TH_RST) || (flags & TH_URG)) {
                        freemsg(mp);
                        return;
                }
                if (flags & TH_ACK) {
                        /* Note this executes in listener's squeue */
                        tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
                        return;
                }

                freemsg(mp);
                return;
        }

        if (listener->tcp_state != TCPS_LISTEN)
                goto error2;

        ASSERT(IPCL_IS_BOUND(lconnp));

        mutex_enter(&listener->tcp_eager_lock);

        /*
         * The system is under memory pressure, so we need to do our part
         * to relieve the pressure.  So we only accept new request if there
         * is nothing waiting to be accepted or waiting to complete the 3-way
         * handshake.  This means that busy listener will not get too many
         * new requests which they cannot handle in time while non-busy
         * listener is still functioning properly.
         */
        if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
            listener->tcp_conn_req_cnt_q0 > 0)) {
                mutex_exit(&listener->tcp_eager_lock);
                TCP_STAT(tcps, tcp_listen_mem_drop);
                goto error2;
        }

        if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
                mutex_exit(&listener->tcp_eager_lock);
                TCP_STAT(tcps, tcp_listendrop);
                TCPS_BUMP_MIB(tcps, tcpListenDrop);
                if (lconnp->conn_debug) {
                        (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
                            "tcp_input_listener: listen backlog (max=%d) "
                            "overflow (%d pending) on %s",
                            listener->tcp_conn_req_max,
                            listener->tcp_conn_req_cnt_q,
                            tcp_display(listener, NULL, DISP_PORT_ONLY));
                }
                goto error2;
        }

        if (listener->tcp_conn_req_cnt_q0 >=
            listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
                /*
                 * Q0 is full. Drop a pending half-open req from the queue
                 * to make room for the new SYN req. Also mark the time we
                 * drop a SYN.
                 *
                 * A more aggressive defense against SYN attack will
                 * be to set the "tcp_syn_defense" flag now.
                 */
                TCP_STAT(tcps, tcp_listendropq0);
                listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
                if (!tcp_drop_q0(listener)) {
                        mutex_exit(&listener->tcp_eager_lock);
                        TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
                        if (lconnp->conn_debug) {
                                (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
                                    "tcp_input_listener: listen half-open "
                                    "queue (max=%d) full (%d pending) on %s",
                                    tcps->tcps_conn_req_max_q0,
                                    listener->tcp_conn_req_cnt_q0,
                                    tcp_display(listener, NULL,
                                    DISP_PORT_ONLY));
                        }
                        goto error2;
                }
        }

        /*
         * Enforce the limit set on the number of connections per listener.
         * Note that tlc_cnt starts with 1.  So need to add 1 to tlc_max
         * for comparison.
         */
        if (listener->tcp_listen_cnt != NULL) {
                tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
                int64_t now;

                if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
                        mutex_exit(&listener->tcp_eager_lock);
                        now = ddi_get_lbolt64();
                        atomic_dec_32(&tlc->tlc_cnt);
                        TCP_STAT(tcps, tcp_listen_cnt_drop);
                        tlc->tlc_drop++;
                        if (now - tlc->tlc_report_time >
                            MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
                                zcmn_err(lconnp->conn_zoneid, CE_WARN,
                                    "Listener (port %d) connection max (%u) "
                                    "reached: %u attempts dropped total\n",
                                    ntohs(listener->tcp_connp->conn_lport),
                                    tlc->tlc_max, tlc->tlc_drop);
                                tlc->tlc_report_time = now;
                        }
                        goto error2;
                }
                tlc_set = B_TRUE;
        }

        mutex_exit(&listener->tcp_eager_lock);

        /*
         * IP sets ira_sqp to either the senders conn_sqp (for loopback)
         * or based on the ring (for packets from GLD). Otherwise it is
         * set based on lbolt i.e., a somewhat random number.
         */
        ASSERT(ira->ira_sqp != NULL);
        new_sqp = ira->ira_sqp;

        econnp = (conn_t *)tcp_get_conn(arg2, tcps);
        if (econnp == NULL)
                goto error2;

        ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
        econnp->conn_sqp = new_sqp;
        econnp->conn_initial_sqp = new_sqp;
        econnp->conn_ixa->ixa_sqp = new_sqp;

        econnp->conn_fport = tcpha->tha_lport;
        econnp->conn_lport = tcpha->tha_fport;

        err = conn_inherit_parent(lconnp, econnp);
        if (err != 0)
                goto error3;

        /* We already know the laddr of the new connection is ours */
        econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;

        ASSERT(OK_32PTR(mp->b_rptr));
        ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
            IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);

        if (lconnp->conn_family == AF_INET) {
                ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
                tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
        } else {
                tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
        }

        if (tpi_mp == NULL)
                goto error3;

        eager = econnp->conn_tcp;
        eager->tcp_detached = B_TRUE;
        SOCK_CONNID_INIT(eager->tcp_connid);

        /*
         * Initialize the eager's tcp_t and inherit some parameters from
         * the listener.
         */
        tcp_init_values(eager, listener);

        ASSERT((econnp->conn_ixa->ixa_flags &
            (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
            IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
            (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
            IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));

        if (!tcps->tcps_dev_flow_ctl)
                econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;

        /* Prepare for diffing against previous packets */
        eager->tcp_recvifindex = 0;
        eager->tcp_recvhops = 0xffffffffU;

        if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
                if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
                    IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
                        econnp->conn_incoming_ifindex = ifindex;
                        econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
                        econnp->conn_ixa->ixa_scopeid = ifindex;
                }
        }

        if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
            (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
            tcps->tcps_rev_src_routes) {
                ipha_t *ipha = (ipha_t *)mp->b_rptr;
                ip_pkt_t *ipp = &econnp->conn_xmit_ipp;

                /* Source routing option copyover (reverse it) */
                err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
                if (err != 0) {
                        freemsg(tpi_mp);
                        goto error3;
                }
                ip_pkt_source_route_reverse_v4(ipp);
        }

        ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
        ASSERT(!eager->tcp_tconnind_started);
        /*
         * If the SYN came with a credential, it's a loopback packet; attach
         * the credential to the TPI message.
         */
        if (ira->ira_cred != NULL)
                mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);

        eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
        ASSERT(eager->tcp_ordrel_mp == NULL);

        /* Inherit the listener's non-STREAMS flag */
        if (IPCL_IS_NONSTR(lconnp)) {
                econnp->conn_flags |= IPCL_NONSTR;
                /* All non-STREAMS tcp_ts are sockets */
                eager->tcp_issocket = B_TRUE;
        } else {
                /*
                 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
                 * at close time, we will always have that to send up.
                 * Otherwise, we need to do special handling in case the
                 * allocation fails at that time.
                 */
                if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
                        goto error3;
        }
        /*
         * Now that the IP addresses and ports are setup in econnp we
         * can do the IPsec policy work.
         */
        if (ira->ira_flags & IRAF_IPSEC_SECURE) {
                if (lconnp->conn_policy != NULL) {
                        /*
                         * Inherit the policy from the listener; use
                         * actions from ira
                         */
                        if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
                                CONN_DEC_REF(econnp);
                                freemsg(mp);
                                goto error3;
                        }
                }
        }

        /*
         * tcp_set_destination() may set tcp_rwnd according to the route
         * metrics. If it does not, the eager's receive window will be set
         * to the listener's receive window later in this function.
         */
        eager->tcp_rwnd = 0;

        /*
         * Since we will clear tcp_listener before we clear tcp_detached
         * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
         * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
         */
        eager->tcp_hard_binding = B_TRUE;

        tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
            TCP_BIND_HASH(econnp->conn_lport)], eager, 0);

        SOCK_CONNID_BUMP(eager->tcp_connid);

        /*
         * Adapt our mss, ttl, ... based on the remote address.
         */

        if (tcp_set_destination(eager) != 0) {
                TCPS_BUMP_MIB(tcps, tcpAttemptFails);
                /* Undo the bind_hash_insert */
                tcp_bind_hash_remove(eager);
                goto error3;
        }

        /* Process all TCP options. */
        tcp_process_options(eager, tcpha);

        /* Is the other end ECN capable? */
        if (tcps->tcps_ecn_permitted >= 1 &&
            (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
                eager->tcp_ecn_ok = B_TRUE;
        }

        /*
         * The listener's conn_rcvbuf should be the default window size or a
         * window size changed via SO_RCVBUF option. First round up the
         * eager's tcp_rwnd to the nearest MSS. Then find out the window
         * scale option value if needed. Call tcp_rwnd_set() to finish the
         * setting.
         *
         * Note if there is a rpipe metric associated with the remote host,
         * we should not inherit receive window size from listener.
         */
        eager->tcp_rwnd = MSS_ROUNDUP(
            (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
            eager->tcp_rwnd), eager->tcp_mss);
        if (eager->tcp_snd_ws_ok)
                tcp_set_ws_value(eager);
        /*
         * Note that this is the only place tcp_rwnd_set() is called for
         * accepting a connection.  We need to call it here instead of
         * after the 3-way handshake because we need to tell the other
         * side our rwnd in the SYN-ACK segment.
         */
        (void) tcp_rwnd_set(eager, eager->tcp_rwnd);

        ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
            eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);

        ASSERT(econnp->conn_rcvbuf != 0 &&
            econnp->conn_rcvbuf == eager->tcp_rwnd);

        /* Put a ref on the listener for the eager. */
        CONN_INC_REF(lconnp);
        mutex_enter(&listener->tcp_eager_lock);
        listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
        eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
        listener->tcp_eager_next_q0 = eager;
        eager->tcp_eager_prev_q0 = listener;

        /* Set tcp_listener before adding it to tcp_conn_fanout */
        eager->tcp_listener = listener;
        eager->tcp_saved_listener = listener;

        /*
         * Set tcp_listen_cnt so that when the connection is done, the counter
         * is decremented.
         */
        eager->tcp_listen_cnt = listener->tcp_listen_cnt;

        /*
         * Tag this detached tcp vector for later retrieval
         * by our listener client in tcp_accept().
         */
        eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
        listener->tcp_conn_req_cnt_q0++;
        if (++listener->tcp_conn_req_seqnum == -1) {
                /*
                 * -1 is "special" and defined in TPI as something
                 * that should never be used in T_CONN_IND
                 */
                ++listener->tcp_conn_req_seqnum;
        }
        mutex_exit(&listener->tcp_eager_lock);

        if (listener->tcp_syn_defense) {
                /* Don't drop the SYN that comes from a good IP source */
                ipaddr_t *addr_cache;

                addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
                if (addr_cache != NULL && econnp->conn_faddr_v4 ==
                    addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
                        eager->tcp_dontdrop = B_TRUE;
                }
        }

        /*
         * We need to insert the eager in its own perimeter but as soon
         * as we do that, we expose the eager to the classifier and
         * should not touch any field outside the eager's perimeter.
         * So do all the work necessary before inserting the eager
         * in its own perimeter. Be optimistic that conn_connect()
         * will succeed but undo everything if it fails.
         */
        seg_seq = ntohl(tcpha->tha_seq);
        eager->tcp_irs = seg_seq;
        eager->tcp_rack = seg_seq;
        eager->tcp_rnxt = seg_seq + 1;
        eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
        TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
        eager->tcp_state = TCPS_SYN_RCVD;
        DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
            econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
            int32_t, TCPS_LISTEN);

        mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
            NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
        if (mp1 == NULL) {
                /*
                 * Increment the ref count as we are going to
                 * enqueueing an mp in squeue
                 */
                CONN_INC_REF(econnp);
                goto error;
        }

        /*
         * We need to start the rto timer. In normal case, we start
         * the timer after sending the packet on the wire (or at
         * least believing that packet was sent by waiting for
         * conn_ip_output() to return). Since this is the first packet
         * being sent on the wire for the eager, our initial tcp_rto
         * is at least tcp_rexmit_interval_min which is a fairly
         * large value to allow the algorithm to adjust slowly to large
         * fluctuations of RTT during first few transmissions.
         *
         * Starting the timer first and then sending the packet in this
         * case shouldn't make much difference since tcp_rexmit_interval_min
         * is of the order of several 100ms and starting the timer
         * first and then sending the packet will result in difference
         * of few micro seconds.
         *
         * Without this optimization, we are forced to hold the fanout
         * lock across the ipcl_bind_insert() and sending the packet
         * so that we don't race against an incoming packet (maybe RST)
         * for this eager.
         *
         * It is necessary to acquire an extra reference on the eager
         * at this point and hold it until after tcp_send_data() to
         * ensure against an eager close race.
         */

        CONN_INC_REF(econnp);

        TCP_TIMER_RESTART(eager, eager->tcp_rto);

        /*
         * Insert the eager in its own perimeter now. We are ready to deal
         * with any packets on eager.
         */
        if (ipcl_conn_insert(econnp) != 0)
                goto error;

        ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
        freemsg(mp);
        /*
         * Send the SYN-ACK. Use the right squeue so that conn_ixa is
         * only used by one thread at a time.
         */
        if (econnp->conn_sqp == lconnp->conn_sqp) {
                DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
                    econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
                    tcp_t *, eager, __dtrace_tcp_tcph_t *,
                    &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
                (void) conn_ip_output(mp1, econnp->conn_ixa);
                CONN_DEC_REF(econnp);
        } else {
                SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
                    econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
        }
        return;
error:
        freemsg(mp1);
        eager->tcp_closemp_used = B_TRUE;
        TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
        mp1 = &eager->tcp_closemp;
        SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
            econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);

        /*
         * If a connection already exists, send the mp to that connections so
         * that it can be appropriately dealt with.
         */
        ipst = tcps->tcps_netstack->netstack_ip;

        if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
                if (!IPCL_IS_CONNECTED(econnp)) {
                        /*
                         * Something bad happened. ipcl_conn_insert()
                         * failed because a connection already existed
                         * in connected hash but we can't find it
                         * anymore (someone blew it away). Just
                         * free this message and hopefully remote
                         * will retransmit at which time the SYN can be
                         * treated as a new connection or dealth with
                         * a TH_RST if a connection already exists.
                         */
                        CONN_DEC_REF(econnp);
                        freemsg(mp);
                } else {
                        SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
                            econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
                }
        } else {
                /* Nobody wants this packet */
                freemsg(mp);
        }
        return;
error3:
        CONN_DEC_REF(econnp);
error2:
        freemsg(mp);
        if (tlc_set)
                atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
}

/*
 * In an ideal case of vertical partition in NUMA architecture, its
 * beneficial to have the listener and all the incoming connections
 * tied to the same squeue. The other constraint is that incoming
 * connections should be tied to the squeue attached to interrupted
 * CPU for obvious locality reason so this leaves the listener to
 * be tied to the same squeue. Our only problem is that when listener
 * is binding, the CPU that will get interrupted by the NIC whose
 * IP address the listener is binding to is not even known. So
 * the code below allows us to change that binding at the time the
 * CPU is interrupted by virtue of incoming connection's squeue.
 *
 * This is usefull only in case of a listener bound to a specific IP
 * address. For other kind of listeners, they get bound the
 * very first time and there is no attempt to rebind them.
 */
void
tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
    ip_recv_attr_t *ira)
{
        conn_t          *connp = (conn_t *)arg;
        squeue_t        *sqp = (squeue_t *)arg2;
        squeue_t        *new_sqp;
        uint32_t        conn_flags;

        /*
         * IP sets ira_sqp to either the senders conn_sqp (for loopback)
         * or based on the ring (for packets from GLD). Otherwise it is
         * set based on lbolt i.e., a somewhat random number.
         */
        ASSERT(ira->ira_sqp != NULL);
        new_sqp = ira->ira_sqp;

        if (connp->conn_fanout == NULL)
                goto done;

        if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
                mutex_enter(&connp->conn_fanout->connf_lock);
                mutex_enter(&connp->conn_lock);
                /*
                 * No one from read or write side can access us now
                 * except for already queued packets on this squeue.
                 * But since we haven't changed the squeue yet, they
                 * can't execute. If they are processed after we have
                 * changed the squeue, they are sent back to the
                 * correct squeue down below.
                 * But a listner close can race with processing of
                 * incoming SYN. If incoming SYN processing changes
                 * the squeue then the listener close which is waiting
                 * to enter the squeue would operate on the wrong
                 * squeue. Hence we don't change the squeue here unless
                 * the refcount is exactly the minimum refcount. The
                 * minimum refcount of 4 is counted as - 1 each for
                 * TCP and IP, 1 for being in the classifier hash, and
                 * 1 for the mblk being processed.
                 */

                if (connp->conn_ref != 4 ||
                    connp->conn_tcp->tcp_state != TCPS_LISTEN) {
                        mutex_exit(&connp->conn_lock);
                        mutex_exit(&connp->conn_fanout->connf_lock);
                        goto done;
                }
                if (connp->conn_sqp != new_sqp) {
                        while (connp->conn_sqp != new_sqp)
                                (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
                                    new_sqp);
                        /* No special MT issues for outbound ixa_sqp hint */
                        connp->conn_ixa->ixa_sqp = new_sqp;
                }

                do {
                        conn_flags = connp->conn_flags;
                        conn_flags |= IPCL_FULLY_BOUND;
                        (void) atomic_cas_32(&connp->conn_flags,
                            connp->conn_flags, conn_flags);
                } while (!(connp->conn_flags & IPCL_FULLY_BOUND));

                mutex_exit(&connp->conn_fanout->connf_lock);
                mutex_exit(&connp->conn_lock);

                /*
                 * Assume we have picked a good squeue for the listener. Make
                 * subsequent SYNs not try to change the squeue.
                 */
                connp->conn_recv = tcp_input_listener;
        }

done:
        if (connp->conn_sqp != sqp) {
                CONN_INC_REF(connp);
                SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
                    ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
        } else {
                tcp_input_listener(connp, mp, sqp, ira);
        }
}

/*
 * Send up all messages queued on tcp_rcv_list.
 */
uint_t
tcp_rcv_drain(tcp_t *tcp)
{
        mblk_t *mp;
        uint_t ret = 0;
#ifdef DEBUG
        uint_t cnt = 0;
#endif
        queue_t *q = tcp->tcp_connp->conn_rq;

        /* Can't drain on an eager connection */
        if (tcp->tcp_listener != NULL)
                return (ret);

        /* Can't be a non-STREAMS connection */
        ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));

        /* No need for the push timer now. */
        if (tcp->tcp_push_tid != 0) {
                (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
                tcp->tcp_push_tid = 0;
        }

        /*
         * Handle two cases here: we are currently fused or we were
         * previously fused and have some urgent data to be delivered
         * upstream.  The latter happens because we either ran out of
         * memory or were detached and therefore sending the SIGURG was
         * deferred until this point.  In either case we pass control
         * over to tcp_fuse_rcv_drain() since it may need to complete
         * some work.
         */
        if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
                if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
                    &tcp->tcp_fused_sigurg_mp))
                        return (ret);
        }

        while ((mp = tcp->tcp_rcv_list) != NULL) {
                tcp->tcp_rcv_list = mp->b_next;
                mp->b_next = NULL;
#ifdef DEBUG
                cnt += msgdsize(mp);
#endif
                putnext(q, mp);
        }
#ifdef DEBUG
        ASSERT(cnt == tcp->tcp_rcv_cnt);
#endif
        tcp->tcp_rcv_last_head = NULL;
        tcp->tcp_rcv_last_tail = NULL;
        tcp->tcp_rcv_cnt = 0;

        if (canputnext(q))
                return (tcp_rwnd_reopen(tcp));

        return (ret);
}

/*
 * Queue data on tcp_rcv_list which is a b_next chain.
 * tcp_rcv_last_head/tail is the last element of this chain.
 * Each element of the chain is a b_cont chain.
 *
 * M_DATA messages are added to the current element.
 * Other messages are added as new (b_next) elements.
 */
void
tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
{
        ASSERT(seg_len == msgdsize(mp));
        ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);

        if (tcp->tcp_rcv_list == NULL) {
                ASSERT(tcp->tcp_rcv_last_head == NULL);
                tcp->tcp_rcv_list = mp;
                tcp->tcp_rcv_last_head = mp;
        } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
                tcp->tcp_rcv_last_tail->b_cont = mp;
        } else {
                tcp->tcp_rcv_last_head->b_next = mp;
                tcp->tcp_rcv_last_head = mp;
        }

        while (mp->b_cont)
                mp = mp->b_cont;

        tcp->tcp_rcv_last_tail = mp;
        tcp->tcp_rcv_cnt += seg_len;
        tcp->tcp_rwnd -= seg_len;
}

/* Generate an ACK-only (no data) segment for a TCP endpoint */
mblk_t *
tcp_ack_mp(tcp_t *tcp)
{
        uint32_t        seq_no;
        tcp_stack_t     *tcps = tcp->tcp_tcps;
        conn_t          *connp = tcp->tcp_connp;

        /*
         * There are a few cases to be considered while setting the sequence no.
         * Essentially, we can come here while processing an unacceptable pkt
         * in the TCPS_SYN_RCVD state, in which case we set the sequence number
         * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
         * If we are here for a zero window probe, stick with suna. In all
         * other cases, we check if suna + swnd encompasses snxt and set
         * the sequence number to snxt, if so. If snxt falls outside the
         * window (the receiver probably shrunk its window), we will go with
         * suna + swnd, otherwise the sequence no will be unacceptable to the
         * receiver.
         */
        if (tcp->tcp_zero_win_probe) {
                seq_no = tcp->tcp_suna;
        } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
                ASSERT(tcp->tcp_swnd == 0);
                seq_no = tcp->tcp_snxt;
        } else {
                seq_no = SEQ_GT(tcp->tcp_snxt,
                    (tcp->tcp_suna + tcp->tcp_swnd)) ?
                    (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
        }

        if (tcp->tcp_valid_bits) {
                /*
                 * For the complex case where we have to send some
                 * controls (FIN or SYN), let tcp_xmit_mp do it.
                 */
                return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
                    NULL, B_FALSE));
        } else {
                /* Generate a simple ACK */
                int     data_length;
                uchar_t *rptr;
                tcpha_t *tcpha;
                mblk_t  *mp1;
                int32_t total_hdr_len;
                int32_t tcp_hdr_len;
                int32_t num_sack_blk = 0;
                int32_t sack_opt_len;
                ip_xmit_attr_t *ixa = connp->conn_ixa;

                /*
                 * Allocate space for TCP + IP headers
                 * and link-level header
                 */
                if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
                        num_sack_blk = MIN(tcp->tcp_max_sack_blk,
                            tcp->tcp_num_sack_blk);
                        sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
                            TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
                        total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
                        tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
                } else {
                        total_hdr_len = connp->conn_ht_iphc_len;
                        tcp_hdr_len = connp->conn_ht_ulp_len;
                }
                mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
                if (!mp1)
                        return (NULL);

                /* Update the latest receive window size in TCP header. */
                tcp->tcp_tcpha->tha_win =
                    htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
                /* copy in prototype TCP + IP header */
                rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
                mp1->b_rptr = rptr;
                mp1->b_wptr = rptr + total_hdr_len;
                bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);

                tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];

                /* Set the TCP sequence number. */
                tcpha->tha_seq = htonl(seq_no);

                /* Set up the TCP flag field. */
                tcpha->tha_flags = (uchar_t)TH_ACK;
                if (tcp->tcp_ecn_echo_on)
                        tcpha->tha_flags |= TH_ECE;

                tcp->tcp_rack = tcp->tcp_rnxt;
                tcp->tcp_rack_cnt = 0;

                /* fill in timestamp option if in use */
                if (tcp->tcp_snd_ts_ok) {
                        uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;

                        U32_TO_BE32(llbolt,
                            (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
                        U32_TO_BE32(tcp->tcp_ts_recent,
                            (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
                }

                /* Fill in SACK options */
                if (num_sack_blk > 0) {
                        uchar_t *wptr = (uchar_t *)tcpha +
                            connp->conn_ht_ulp_len;
                        sack_blk_t *tmp;
                        int32_t i;

                        wptr[0] = TCPOPT_NOP;
                        wptr[1] = TCPOPT_NOP;
                        wptr[2] = TCPOPT_SACK;
                        wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
                            sizeof (sack_blk_t);
                        wptr += TCPOPT_REAL_SACK_LEN;

                        tmp = tcp->tcp_sack_list;
                        for (i = 0; i < num_sack_blk; i++) {
                                U32_TO_BE32(tmp[i].begin, wptr);
                                wptr += sizeof (tcp_seq);
                                U32_TO_BE32(tmp[i].end, wptr);
                                wptr += sizeof (tcp_seq);
                        }
                        tcpha->tha_offset_and_reserved +=
                            ((num_sack_blk * 2 + 1) << 4);
                }

                ixa->ixa_pktlen = total_hdr_len;

                if (ixa->ixa_flags & IXAF_IS_IPV4) {
                        ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
                } else {
                        ip6_t *ip6 = (ip6_t *)rptr;

                        ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
                }

                /*
                 * Prime pump for checksum calculation in IP.  Include the
                 * adjustment for a source route if any.
                 */
                data_length = tcp_hdr_len + connp->conn_sum;
                data_length = (data_length >> 16) + (data_length & 0xFFFF);
                tcpha->tha_sum = htons(data_length);

                if (tcp->tcp_ip_forward_progress) {
                        tcp->tcp_ip_forward_progress = B_FALSE;
                        connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
                } else {
                        connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
                }
                return (mp1);
        }
}

/*
 * Dummy socket upcalls for if/when the conn_t gets detached from a
 * direct-callback sonode via a user-driven close().  Easy to catch with
 * DTrace FBT, and should be mostly harmless.
 */

/* ARGSUSED */
static sock_upper_handle_t
tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
    sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
        return (NULL);
}

/* ARGSUSED */
static void
tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
    pid_t pid)
{
        ASSERT(x == NULL);
        /* Normally we'd crhold(cr) and attach it to socket state. */
        /* LINTED */
}

/* ARGSUSED */
static int
tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
        return (-1);
}

/* ARGSUSED */
static void
tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
{
        ASSERT(x == NULL);
        /* We really want this one to be a harmless NOP for now. */
        /* LINTED */
}

/* ARGSUSED */
static ssize_t
tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
    int *error, boolean_t *push)
{
        ASSERT(x == NULL);

        /*
         * Consume the message, set ESHUTDOWN, and return an error.
         * Nobody's home!
         */
        freemsg(mp);
        *error = ESHUTDOWN;
        return (-1);
}

/* ARGSUSED */
static void
tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
}

/* ARGSUSED */
static void
tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
}

/* ARGSUSED */
static void
tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
{
        ASSERT(x == NULL);
        /* Otherwise, this would signal socket state about OOB data. */
}

/* ARGSUSED */
static void
tcp_dummy_set_error(sock_upper_handle_t x, int err)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
}

/* ARGSUSED */
static void
tcp_dummy_onearg(sock_upper_handle_t x)
{
        ASSERT(0);      /* Panic in debug, otherwise ignore. */
}

static sock_upcalls_t tcp_dummy_upcalls = {
        tcp_dummy_newconn,
        tcp_dummy_connected,
        tcp_dummy_disconnected,
        tcp_dummy_opctl,
        tcp_dummy_recv,
        tcp_dummy_set_proto_props,
        tcp_dummy_txq_full,
        tcp_dummy_signal_oob,
        tcp_dummy_onearg,
        tcp_dummy_set_error,
        tcp_dummy_onearg
};

/*
 * Handle M_DATA messages from IP. Its called directly from IP via
 * squeue for received IP packets.
 *
 * The first argument is always the connp/tcp to which the mp belongs.
 * There are no exceptions to this rule. The caller has already put
 * a reference on this connp/tcp and once tcp_input_data() returns,
 * the squeue will do the refrele.
 *
 * The TH_SYN for the listener directly go to tcp_input_listener via
 * squeue. ICMP errors go directly to tcp_icmp_input().
 *
 * sqp: NULL = recursive, sqp != NULL means called from squeue
 */
void
tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
{
        int32_t         bytes_acked;
        int32_t         gap;
        mblk_t          *mp1;
        uint_t          flags;
        uint32_t        new_swnd = 0;
        uchar_t         *iphdr;
        uchar_t         *rptr;
        int32_t         rgap;
        uint32_t        seg_ack;
        int             seg_len;
        uint_t          ip_hdr_len;
        uint32_t        seg_seq;
        tcpha_t         *tcpha;
        int             urp;
        tcp_opt_t       tcpopt;
        ip_pkt_t        ipp;
        boolean_t       ofo_seg = B_FALSE; /* Out of order segment */
        uint32_t        cwnd;
        uint32_t        add;
        int             npkt;
        int             mss;
        conn_t          *connp = (conn_t *)arg;
        squeue_t        *sqp = (squeue_t *)arg2;
        tcp_t           *tcp = connp->conn_tcp;
        tcp_stack_t     *tcps = tcp->tcp_tcps;
        sock_upcalls_t  *sockupcalls;

        /*
         * RST from fused tcp loopback peer should trigger an unfuse.
         */
        if (tcp->tcp_fused) {
                TCP_STAT(tcps, tcp_fusion_aborted);
                tcp_unfuse(tcp);
        }

        iphdr = mp->b_rptr;
        rptr = mp->b_rptr;
        ASSERT(OK_32PTR(rptr));

        ip_hdr_len = ira->ira_ip_hdr_length;
        if (connp->conn_recv_ancillary.crb_all != 0) {
                /*
                 * Record packet information in the ip_pkt_t
                 */
                ipp.ipp_fields = 0;
                if (ira->ira_flags & IRAF_IS_IPV4) {
                        (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
                            B_FALSE);
                } else {
                        uint8_t nexthdrp;

                        /*
                         * IPv6 packets can only be received by applications
                         * that are prepared to receive IPv6 addresses.
                         * The IP fanout must ensure this.
                         */
                        ASSERT(connp->conn_family == AF_INET6);

                        (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, &ipp,
                            &nexthdrp);
                        ASSERT(nexthdrp == IPPROTO_TCP);

                        /* Could have caused a pullup? */
                        iphdr = mp->b_rptr;
                        rptr = mp->b_rptr;
                }
        }
        ASSERT(DB_TYPE(mp) == M_DATA);
        ASSERT(mp->b_next == NULL);

        tcpha = (tcpha_t *)&rptr[ip_hdr_len];
        seg_seq = ntohl(tcpha->tha_seq);
        seg_ack = ntohl(tcpha->tha_ack);
        ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
        seg_len = (int)(mp->b_wptr - rptr) -
            (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
        if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
                do {
                        ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
                            (uintptr_t)INT_MAX);
                        seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
                } while ((mp1 = mp1->b_cont) != NULL &&
                    mp1->b_datap->db_type == M_DATA);
        }

        DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
            __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
            __dtrace_tcp_tcph_t *, tcpha);

        if (tcp->tcp_state == TCPS_TIME_WAIT) {
                tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
                    seg_len, tcpha, ira);
                return;
        }

        if (sqp != NULL) {
                /*
                 * This is the correct place to update tcp_last_recv_time. Note
                 * that it is also updated for tcp structure that belongs to
                 * global and listener queues which do not really need updating.
                 * But that should not cause any harm.  And it is updated for
                 * all kinds of incoming segments, not only for data segments.
                 */
                tcp->tcp_last_recv_time = LBOLT_FASTPATH;
        }

        flags = (unsigned int)tcpha->tha_flags & 0xFF;

        BUMP_LOCAL(tcp->tcp_ibsegs);
        DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);

        if ((flags & TH_URG) && sqp != NULL) {
                /*
                 * TCP can't handle urgent pointers that arrive before
                 * the connection has been accept()ed since it can't
                 * buffer OOB data.  Discard segment if this happens.
                 *
                 * We can't just rely on a non-null tcp_listener to indicate
                 * that the accept() has completed since unlinking of the
                 * eager and completion of the accept are not atomic.
                 * tcp_detached, when it is not set (B_FALSE) indicates
                 * that the accept() has completed.
                 *
                 * Nor can it reassemble urgent pointers, so discard
                 * if it's not the next segment expected.
                 *
                 * Otherwise, collapse chain into one mblk (discard if
                 * that fails).  This makes sure the headers, retransmitted
                 * data, and new data all are in the same mblk.
                 */
                ASSERT(mp != NULL);
                if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
                        freemsg(mp);
                        return;
                }
                /* Update pointers into message */
                iphdr = rptr = mp->b_rptr;
                tcpha = (tcpha_t *)&rptr[ip_hdr_len];
                if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
                        /*
                         * Since we can't handle any data with this urgent
                         * pointer that is out of sequence, we expunge
                         * the data.  This allows us to still register
                         * the urgent mark and generate the M_PCSIG,
                         * which we can do.
                         */
                        mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
                        seg_len = 0;
                }
        }

        sockupcalls = connp->conn_upcalls;
        /* A conn_t may have belonged to a now-closed socket.  Be careful. */
        if (sockupcalls == NULL)
                sockupcalls = &tcp_dummy_upcalls;

        switch (tcp->tcp_state) {
        case TCPS_SYN_SENT:
                if (connp->conn_final_sqp == NULL &&
                    tcp_outbound_squeue_switch && sqp != NULL) {
                        ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
                        connp->conn_final_sqp = sqp;
                        if (connp->conn_final_sqp != connp->conn_sqp) {
                                DTRACE_PROBE1(conn__final__sqp__switch,
                                    conn_t *, connp);
                                CONN_INC_REF(connp);
                                SQUEUE_SWITCH(connp, connp->conn_final_sqp);
                                SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
                                    tcp_input_data, connp, ira, ip_squeue_flag,
                                    SQTAG_CONNECT_FINISH);
                                return;
                        }
                        DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
                }
                if (flags & TH_ACK) {
                        /*
                         * Note that our stack cannot send data before a
                         * connection is established, therefore the
                         * following check is valid.  Otherwise, it has
                         * to be changed.
                         */
                        if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
                            SEQ_GT(seg_ack, tcp->tcp_snxt)) {
                                freemsg(mp);
                                if (flags & TH_RST)
                                        return;
                                tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
                                    tcp, seg_ack, 0, TH_RST);
                                return;
                        }
                        ASSERT(tcp->tcp_suna + 1 == seg_ack);
                }
                if (flags & TH_RST) {
                        if (flags & TH_ACK) {
                                DTRACE_TCP5(connect__refused, mblk_t *, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa,
                                    void_ip_t *, iphdr, tcp_t *, tcp,
                                    tcph_t *, tcpha);
                                (void) tcp_clean_death(tcp, ECONNREFUSED);
                        }
                        freemsg(mp);
                        return;
                }
                if (!(flags & TH_SYN)) {
                        freemsg(mp);
                        return;
                }

                /* Process all TCP options. */
                tcp_process_options(tcp, tcpha);
                /*
                 * The following changes our rwnd to be a multiple of the
                 * MIN(peer MSS, our MSS) for performance reason.
                 */
                (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
                    tcp->tcp_mss));

                /* Is the other end ECN capable? */
                if (tcp->tcp_ecn_ok) {
                        if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
                                tcp->tcp_ecn_ok = B_FALSE;
                        }
                }
                /*
                 * Clear ECN flags because it may interfere with later
                 * processing.
                 */
                flags &= ~(TH_ECE|TH_CWR);

                tcp->tcp_irs = seg_seq;
                tcp->tcp_rack = seg_seq;
                tcp->tcp_rnxt = seg_seq + 1;
                tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
                if (!TCP_IS_DETACHED(tcp)) {
                        /* Allocate room for SACK options if needed. */
                        connp->conn_wroff = connp->conn_ht_iphc_len;
                        if (tcp->tcp_snd_sack_ok)
                                connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
                        if (!tcp->tcp_loopback)
                                connp->conn_wroff += tcps->tcps_wroff_xtra;

                        (void) proto_set_tx_wroff(connp->conn_rq, connp,
                            connp->conn_wroff);
                }
                if (flags & TH_ACK) {
                        /*
                         * If we can't get the confirmation upstream, pretend
                         * we didn't even see this one.
                         *
                         * XXX: how can we pretend we didn't see it if we
                         * have updated rnxt et. al.
                         *
                         * For loopback we defer sending up the T_CONN_CON
                         * until after some checks below.
                         */
                        mp1 = NULL;
                        /*
                         * tcp_sendmsg() checks tcp_state without entering
                         * the squeue so tcp_state should be updated before
                         * sending up connection confirmation.  Probe the
                         * state change below when we are sure the connection
                         * confirmation has been sent.
                         */
                        tcp->tcp_state = TCPS_ESTABLISHED;
                        if (!tcp_conn_con(tcp, iphdr, mp,
                            tcp->tcp_loopback ? &mp1 : NULL, ira)) {
                                tcp->tcp_state = TCPS_SYN_SENT;
                                freemsg(mp);
                                return;
                        }
                        TCPS_CONN_INC(tcps);
                        /* SYN was acked - making progress */
                        tcp->tcp_ip_forward_progress = B_TRUE;

                        /* One for the SYN */
                        tcp->tcp_suna = tcp->tcp_iss + 1;
                        tcp->tcp_valid_bits &= ~TCP_ISS_VALID;

                        /*
                         * If SYN was retransmitted, need to reset all
                         * retransmission info.  This is because this
                         * segment will be treated as a dup ACK.
                         */
                        if (tcp->tcp_rexmit) {
                                tcp->tcp_rexmit = B_FALSE;
                                tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
                                tcp->tcp_rexmit_max = tcp->tcp_snxt;
                                tcp->tcp_ms_we_have_waited = 0;

                                /*
                                 * Set tcp_cwnd back to 1 MSS, per
                                 * recommendation from
                                 * draft-floyd-incr-init-win-01.txt,
                                 * Increasing TCP's Initial Window.
                                 */
                                tcp->tcp_cwnd = tcp->tcp_mss;
                        }

                        tcp->tcp_swl1 = seg_seq;
                        tcp->tcp_swl2 = seg_ack;

                        new_swnd = ntohs(tcpha->tha_win);
                        tcp->tcp_swnd = new_swnd;
                        if (new_swnd > tcp->tcp_max_swnd)
                                tcp->tcp_max_swnd = new_swnd;

                        /*
                         * Always send the three-way handshake ack immediately
                         * in order to make the connection complete as soon as
                         * possible on the accepting host.
                         */
                        flags |= TH_ACK_NEEDED;

                        /*
                         * Trace connect-established here.
                         */
                        DTRACE_TCP5(connect__established, mblk_t *, NULL,
                            ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
                            void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);

                        /* Trace change from SYN_SENT -> ESTABLISHED here */
                        DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
                            connp->conn_ixa, void, NULL, tcp_t *, tcp,
                            void, NULL, int32_t, TCPS_SYN_SENT);

                        /*
                         * Special case for loopback.  At this point we have
                         * received SYN-ACK from the remote endpoint.  In
                         * order to ensure that both endpoints reach the
                         * fused state prior to any data exchange, the final
                         * ACK needs to be sent before we indicate T_CONN_CON
                         * to the module upstream.
                         */
                        if (tcp->tcp_loopback) {
                                mblk_t *ack_mp;

                                ASSERT(!tcp->tcp_unfusable);
                                ASSERT(mp1 != NULL);
                                /*
                                 * For loopback, we always get a pure SYN-ACK
                                 * and only need to send back the final ACK
                                 * with no data (this is because the other
                                 * tcp is ours and we don't do T/TCP).  This
                                 * final ACK triggers the passive side to
                                 * perform fusion in ESTABLISHED state.
                                 */
                                if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
                                        if (tcp->tcp_ack_tid != 0) {
                                                (void) TCP_TIMER_CANCEL(tcp,
                                                    tcp->tcp_ack_tid);
                                                tcp->tcp_ack_tid = 0;
                                        }
                                        tcp_send_data(tcp, ack_mp);
                                        BUMP_LOCAL(tcp->tcp_obsegs);
                                        TCPS_BUMP_MIB(tcps, tcpOutAck);

                                        if (!IPCL_IS_NONSTR(connp)) {
                                                /* Send up T_CONN_CON */
                                                if (ira->ira_cred != NULL) {
                                                        mblk_setcred(mp1,
                                                            ira->ira_cred,
                                                            ira->ira_cpid);
                                                }
                                                putnext(connp->conn_rq, mp1);
                                        } else {
                                                (*sockupcalls->su_connected)
                                                    (connp->conn_upper_handle,
                                                    tcp->tcp_connid,
                                                    ira->ira_cred,
                                                    ira->ira_cpid);
                                                freemsg(mp1);
                                        }

                                        freemsg(mp);
                                        return;
                                }
                                /*
                                 * Forget fusion; we need to handle more
                                 * complex cases below.  Send the deferred
                                 * T_CONN_CON message upstream and proceed
                                 * as usual.  Mark this tcp as not capable
                                 * of fusion.
                                 */
                                TCP_STAT(tcps, tcp_fusion_unfusable);
                                tcp->tcp_unfusable = B_TRUE;
                                if (!IPCL_IS_NONSTR(connp)) {
                                        if (ira->ira_cred != NULL) {
                                                mblk_setcred(mp1, ira->ira_cred,
                                                    ira->ira_cpid);
                                        }
                                        putnext(connp->conn_rq, mp1);
                                } else {
                                        (*sockupcalls->su_connected)
                                            (connp->conn_upper_handle,
                                            tcp->tcp_connid, ira->ira_cred,
                                            ira->ira_cpid);
                                        freemsg(mp1);
                                }
                        }

                        /*
                         * Check to see if there is data to be sent.  If
                         * yes, set the transmit flag.  Then check to see
                         * if received data processing needs to be done.
                         * If not, go straight to xmit_check.  This short
                         * cut is OK as we don't support T/TCP.
                         */
                        if (tcp->tcp_unsent)
                                flags |= TH_XMIT_NEEDED;

                        if (seg_len == 0 && !(flags & TH_URG)) {
                                freemsg(mp);
                                goto xmit_check;
                        }

                        flags &= ~TH_SYN;
                        seg_seq++;
                        break;
                }
                tcp->tcp_state = TCPS_SYN_RCVD;
                DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
                    connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
                    tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
                mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
                    NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
                if (mp1 != NULL) {
                        tcp_send_data(tcp, mp1);
                        TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
                }
                freemsg(mp);
                return;
        case TCPS_SYN_RCVD:
                if (flags & TH_ACK) {
                        uint32_t pinit_wnd;

                        /*
                         * In this state, a SYN|ACK packet is either bogus
                         * because the other side must be ACKing our SYN which
                         * indicates it has seen the ACK for their SYN and
                         * shouldn't retransmit it or we're crossing SYNs
                         * on active open.
                         */
                        if ((flags & TH_SYN) && !tcp->tcp_active_open) {
                                freemsg(mp);
                                tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
                                    tcp, seg_ack, 0, TH_RST);
                                return;
                        }
                        /*
                         * NOTE: RFC 793 pg. 72 says this should be
                         * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
                         * but that would mean we have an ack that ignored
                         * our SYN.
                         */
                        if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
                            SEQ_GT(seg_ack, tcp->tcp_snxt)) {
                                freemsg(mp);
                                tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
                                    tcp, seg_ack, 0, TH_RST);
                                return;
                        }
                        /*
                         * No sane TCP stack will send such a small window
                         * without receiving any data.  Just drop this invalid
                         * ACK.  We also shorten the abort timeout in case
                         * this is an attack.
                         */
                        pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
                        if (pinit_wnd < tcp->tcp_mss &&
                            pinit_wnd < tcp_init_wnd_chk) {
                                freemsg(mp);
                                TCP_STAT(tcps, tcp_zwin_ack_syn);
                                tcp->tcp_second_ctimer_threshold =
                                    tcp_early_abort * SECONDS;
                                return;
                        }
                }
                break;
        case TCPS_LISTEN:
                /*
                 * Only a TLI listener can come through this path when a
                 * acceptor is going back to be a listener and a packet
                 * for the acceptor hits the classifier. For a socket
                 * listener, this can never happen because a listener
                 * can never accept connection on itself and hence a
                 * socket acceptor can not go back to being a listener.
                 */
                ASSERT(!TCP_IS_SOCKET(tcp));
                /*FALLTHRU*/
        case TCPS_CLOSED:
        case TCPS_BOUND: {
                conn_t  *new_connp;
                ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;

                /*
                 * Don't accept any input on a closed tcp as this TCP logically
                 * does not exist on the system. Don't proceed further with
                 * this TCP. For instance, this packet could trigger another
                 * close of this tcp which would be disastrous for tcp_refcnt.
                 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
                 * be called at most once on a TCP. In this case we need to
                 * refeed the packet into the classifier and figure out where
                 * the packet should go.
                 */
                new_connp = ipcl_classify(mp, ira, ipst);
                if (new_connp != NULL) {
                        /* Drops ref on new_connp */
                        tcp_reinput(new_connp, mp, ira, ipst);
                        return;
                }
                /* We failed to classify. For now just drop the packet */
                freemsg(mp);
                return;
        }
        case TCPS_IDLE:
                /*
                 * Handle the case where the tcp_clean_death() has happened
                 * on a connection (application hasn't closed yet) but a packet
                 * was already queued on squeue before tcp_clean_death()
                 * was processed. Calling tcp_clean_death() twice on same
                 * connection can result in weird behaviour.
                 */
                freemsg(mp);
                return;
        default:
                break;
        }

        /*
         * Already on the correct queue/perimeter.
         * If this is a detached connection and not an eager
         * connection hanging off a listener then new data
         * (past the FIN) will cause a reset.
         * We do a special check here where it
         * is out of the main line, rather than check
         * if we are detached every time we see new
         * data down below.
         */
        if (TCP_IS_DETACHED_NONEAGER(tcp) &&
            (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
                TCPS_BUMP_MIB(tcps, tcpInClosed);
                DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
                freemsg(mp);
                tcp_xmit_ctl("new data when detached", tcp,
                    tcp->tcp_snxt, 0, TH_RST);
                (void) tcp_clean_death(tcp, EPROTO);
                return;
        }

        mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
        urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
        new_swnd = ntohs(tcpha->tha_win) <<
            ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);

        /*
         * We are interested in two TCP options: timestamps (if negotiated) and
         * SACK (if negotiated). Skip option parsing if neither is negotiated.
         */
        if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok) {
                int options;
                if (tcp->tcp_snd_sack_ok)
                        tcpopt.tcp = tcp;
                else
                        tcpopt.tcp = NULL;
                options = tcp_parse_options(tcpha, &tcpopt);
                /*
                 * RST segments must not be subject to PAWS and are not
                 * required to have timestamps.
                 * In addition, some TCP stacks (eg. Microsoft's) send
                 * keepalive segments without timestamps even if timestamps are
                 * negotiated on the connection. Keepalive segments are not
                 * well-specified, but in practice they are ACK segments,
                 * either empty or containing one garbage byte.
                 */
                boolean_t keepalive = (flags == TH_ACK) && (seg_len == 0 ||
                    seg_len == 1) && (seg_seq + 1 == tcp->tcp_rnxt);
                if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) {
                        /*
                         * Per RFC 7323 section 3.2., silently drop non-RST
                         * segments without expected TSopt. This is a 'SHOULD'
                         * requirement.
                         */
                        if (!(options & TCP_OPT_TSTAMP_PRESENT)) {
                                /*
                                 * Leave a breadcrumb for people to detect this
                                 * behavior.
                                 */
                                DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp);
                                freemsg(mp);
                                return;
                        }

                        if (!tcp_paws_check(tcp, &tcpopt)) {
                                /*
                                 * This segment is not acceptable.
                                 * Drop it and send back an ACK.
                                 */
                                freemsg(mp);
                                flags |= TH_ACK_NEEDED;
                                goto ack_check;
                        }
                }
        }
try_again:;
        mss = tcp->tcp_mss;
        gap = seg_seq - tcp->tcp_rnxt;
        rgap = tcp->tcp_rwnd - (gap + seg_len);
        /*
         * gap is the amount of sequence space between what we expect to see
         * and what we got for seg_seq.  A positive value for gap means
         * something got lost.  A negative value means we got some old stuff.
         */
        if (gap < 0) {
                /* Old stuff present.  Is the SYN in there? */
                if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
                    (seg_len != 0)) {
                        flags &= ~TH_SYN;
                        seg_seq++;
                        urp--;
                        /* Recompute the gaps after noting the SYN. */
                        goto try_again;
                }
                TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
                TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
                    (seg_len > -gap ? -gap : seg_len));
                /* Remove the old stuff from seg_len. */
                seg_len += gap;
                /*
                 * Anything left?
                 * Make sure to check for unack'd FIN when rest of data
                 * has been previously ack'd.
                 */
                if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
                        /*
                         * Resets are only valid if they lie within our offered
                         * window.  If the RST bit is set, we just ignore this
                         * segment.
                         */
                        if (flags & TH_RST) {
                                freemsg(mp);
                                return;
                        }

                        /*
                         * The arriving of dup data packets indicate that we
                         * may have postponed an ack for too long, or the other
                         * side's RTT estimate is out of shape. Start acking
                         * more often.
                         */
                        if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
                            tcp->tcp_rack_cnt >= 1 &&
                            tcp->tcp_rack_abs_max > 2) {
                                tcp->tcp_rack_abs_max--;
                        }
                        tcp->tcp_rack_cur_max = 1;

                        /*
                         * This segment is "unacceptable".  None of its
                         * sequence space lies within our advertized window.
                         *
                         * Adjust seg_len to the original value for tracing.
                         */
                        seg_len -= gap;
                        if (connp->conn_debug) {
                                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                                    "tcp_rput: unacceptable, gap %d, rgap %d, "
                                    "flags 0x%x, seg_seq %u, seg_ack %u, "
                                    "seg_len %d, rnxt %u, snxt %u, %s",
                                    gap, rgap, flags, seg_seq, seg_ack,
                                    seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
                                    tcp_display(tcp, NULL,
                                    DISP_ADDR_AND_PORT));
                        }

                        /*
                         * Arrange to send an ACK in response to the
                         * unacceptable segment per RFC 793 page 69. There
                         * is only one small difference between ours and the
                         * acceptability test in the RFC - we accept ACK-only
                         * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
                         * will be generated.
                         *
                         * Note that we have to ACK an ACK-only packet at least
                         * for stacks that send 0-length keep-alives with
                         * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
                         * section 4.2.3.6. As long as we don't ever generate
                         * an unacceptable packet in response to an incoming
                         * packet that is unacceptable, it should not cause
                         * "ACK wars".
                         */
                        flags |=  TH_ACK_NEEDED;

                        /*
                         * Continue processing this segment in order to use the
                         * ACK information it contains, but skip all other
                         * sequence-number processing.  Processing the ACK
                         * information is necessary in order to
                         * re-synchronize connections that may have lost
                         * synchronization.
                         *
                         * We clear seg_len and flag fields related to
                         * sequence number processing as they are not
                         * to be trusted for an unacceptable segment.
                         */
                        seg_len = 0;
                        flags &= ~(TH_SYN | TH_FIN | TH_URG);
                        goto process_ack;
                }

                /* Fix seg_seq, and chew the gap off the front. */
                seg_seq = tcp->tcp_rnxt;
                urp += gap;
                do {
                        mblk_t  *mp2;
                        ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
                            (uintptr_t)UINT_MAX);
                        gap += (uint_t)(mp->b_wptr - mp->b_rptr);
                        if (gap > 0) {
                                mp->b_rptr = mp->b_wptr - gap;
                                break;
                        }
                        mp2 = mp;
                        mp = mp->b_cont;
                        freeb(mp2);
                } while (gap < 0);
                /*
                 * If the urgent data has already been acknowledged, we
                 * should ignore TH_URG below
                 */
                if (urp < 0)
                        flags &= ~TH_URG;
        }
        /*
         * rgap is the amount of stuff received out of window.  A negative
         * value is the amount out of window.
         */
        if (rgap < 0) {
                mblk_t  *mp2;

                if (tcp->tcp_rwnd == 0) {
                        TCPS_BUMP_MIB(tcps, tcpInWinProbe);
                } else {
                        TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
                        TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
                }

                /*
                 * seg_len does not include the FIN, so if more than
                 * just the FIN is out of window, we act like we don't
                 * see it.  (If just the FIN is out of window, rgap
                 * will be zero and we will go ahead and acknowledge
                 * the FIN.)
                 */
                flags &= ~TH_FIN;

                /* Fix seg_len and make sure there is something left. */
                seg_len += rgap;
                if (seg_len <= 0) {
                        /*
                         * Resets are only valid if they lie within our offered
                         * window.  If the RST bit is set, we just ignore this
                         * segment.
                         */
                        if (flags & TH_RST) {
                                freemsg(mp);
                                return;
                        }

                        /* Per RFC 793, we need to send back an ACK. */
                        flags |= TH_ACK_NEEDED;

                        /*
                         * Send SIGURG as soon as possible i.e. even
                         * if the TH_URG was delivered in a window probe
                         * packet (which will be unacceptable).
                         *
                         * We generate a signal if none has been generated
                         * for this connection or if this is a new urgent
                         * byte. Also send a zero-length "unmarked" message
                         * to inform SIOCATMARK that this is not the mark.
                         *
                         * tcp_urp_last_valid is cleared when the T_exdata_ind
                         * is sent up. This plus the check for old data
                         * (gap >= 0) handles the wraparound of the sequence
                         * number space without having to always track the
                         * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
                         * this max in its rcv_up variable).
                         *
                         * This prevents duplicate SIGURGS due to a "late"
                         * zero-window probe when the T_EXDATA_IND has already
                         * been sent up.
                         */
                        if ((flags & TH_URG) &&
                            (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
                            tcp->tcp_urp_last))) {
                                if (IPCL_IS_NONSTR(connp)) {
                                        if (!TCP_IS_DETACHED(tcp)) {
                                                (*sockupcalls->su_signal_oob)
                                                    (connp->conn_upper_handle,
                                                    urp);
                                        }
                                } else {
                                        mp1 = allocb(0, BPRI_MED);
                                        if (mp1 == NULL) {
                                                freemsg(mp);
                                                return;
                                        }
                                        if (!TCP_IS_DETACHED(tcp) &&
                                            !putnextctl1(connp->conn_rq,
                                            M_PCSIG, SIGURG)) {
                                                /* Try again on the rexmit. */
                                                freemsg(mp1);
                                                freemsg(mp);
                                                return;
                                        }
                                        /*
                                         * If the next byte would be the mark
                                         * then mark with MARKNEXT else mark
                                         * with NOTMARKNEXT.
                                         */
                                        if (gap == 0 && urp == 0)
                                                mp1->b_flag |= MSGMARKNEXT;
                                        else
                                                mp1->b_flag |= MSGNOTMARKNEXT;
                                        freemsg(tcp->tcp_urp_mark_mp);
                                        tcp->tcp_urp_mark_mp = mp1;
                                        flags |= TH_SEND_URP_MARK;
                                }
                                tcp->tcp_urp_last_valid = B_TRUE;
                                tcp->tcp_urp_last = urp + seg_seq;
                        }
                        /*
                         * If this is a zero window probe, continue to
                         * process the ACK part.  But we need to set seg_len
                         * to 0 to avoid data processing.  Otherwise just
                         * drop the segment and send back an ACK.
                         */
                        if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
                                flags &= ~(TH_SYN | TH_URG);
                                seg_len = 0;
                                goto process_ack;
                        } else {
                                freemsg(mp);
                                goto ack_check;
                        }
                }
                /* Pitch out of window stuff off the end. */
                rgap = seg_len;
                mp2 = mp;
                do {
                        ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
                            (uintptr_t)INT_MAX);
                        rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
                        if (rgap < 0) {
                                mp2->b_wptr += rgap;
                                if ((mp1 = mp2->b_cont) != NULL) {
                                        mp2->b_cont = NULL;
                                        freemsg(mp1);
                                }
                                break;
                        }
                } while ((mp2 = mp2->b_cont) != NULL);
        }
ok:;
        /*
         * TCP should check ECN info for segments inside the window only.
         * Therefore the check should be done here.
         */
        if (tcp->tcp_ecn_ok) {
                if (flags & TH_CWR) {
                        tcp->tcp_ecn_echo_on = B_FALSE;
                }
                /*
                 * Note that both ECN_CE and CWR can be set in the
                 * same segment.  In this case, we once again turn
                 * on ECN_ECHO.
                 */
                if (connp->conn_ipversion == IPV4_VERSION) {
                        uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;

                        if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
                                tcp->tcp_ecn_echo_on = B_TRUE;
                        }
                } else {
                        uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;

                        if ((vcf & htonl(IPH_ECN_CE << 20)) ==
                            htonl(IPH_ECN_CE << 20)) {
                                tcp->tcp_ecn_echo_on = B_TRUE;
                        }
                }
        }

        /*
         * Check whether we can update tcp_ts_recent. This test is from RFC
         * 7323, section 5.3.
         */
        if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) &&
            TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
            SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
                tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
                tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
        }

        if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
                /*
                 * FIN in an out of order segment.  We record this in
                 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
                 * Clear the FIN so that any check on FIN flag will fail.
                 * Remember that FIN also counts in the sequence number
                 * space.  So we need to ack out of order FIN only segments.
                 */
                if (flags & TH_FIN) {
                        tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
                        tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
                        flags &= ~TH_FIN;
                        flags |= TH_ACK_NEEDED;
                }
                if (seg_len > 0) {
                        /* Fill in the SACK blk list. */
                        if (tcp->tcp_snd_sack_ok) {
                                tcp_sack_insert(tcp->tcp_sack_list,
                                    seg_seq, seg_seq + seg_len,
                                    &(tcp->tcp_num_sack_blk));
                        }

                        /*
                         * Attempt reassembly and see if we have something
                         * ready to go.
                         */
                        mp = tcp_reass(tcp, mp, seg_seq);
                        /* Always ack out of order packets */
                        flags |= TH_ACK_NEEDED | TH_PUSH;
                        if (mp) {
                                ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
                                    (uintptr_t)INT_MAX);
                                seg_len = mp->b_cont ? msgdsize(mp) :
                                    (int)(mp->b_wptr - mp->b_rptr);
                                seg_seq = tcp->tcp_rnxt;
                                /*
                                 * A gap is filled and the seq num and len
                                 * of the gap match that of a previously
                                 * received FIN, put the FIN flag back in.
                                 */
                                if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
                                    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
                                        flags |= TH_FIN;
                                        tcp->tcp_valid_bits &=
                                            ~TCP_OFO_FIN_VALID;
                                }
                                if (tcp->tcp_reass_tid != 0) {
                                        (void) TCP_TIMER_CANCEL(tcp,
                                            tcp->tcp_reass_tid);
                                        /*
                                         * Restart the timer if there is still
                                         * data in the reassembly queue.
                                         */
                                        if (tcp->tcp_reass_head != NULL) {
                                                tcp->tcp_reass_tid = TCP_TIMER(
                                                    tcp, tcp_reass_timer,
                                                    tcps->tcps_reass_timeout);
                                        } else {
                                                tcp->tcp_reass_tid = 0;
                                        }
                                }
                        } else {
                                /*
                                 * Keep going even with NULL mp.
                                 * There may be a useful ACK or something else
                                 * we don't want to miss.
                                 *
                                 * But TCP should not perform fast retransmit
                                 * because of the ack number.  TCP uses
                                 * seg_len == 0 to determine if it is a pure
                                 * ACK.  And this is not a pure ACK.
                                 */
                                seg_len = 0;
                                ofo_seg = B_TRUE;

                                if (tcps->tcps_reass_timeout != 0 &&
                                    tcp->tcp_reass_tid == 0) {
                                        tcp->tcp_reass_tid = TCP_TIMER(tcp,
                                            tcp_reass_timer,
                                            tcps->tcps_reass_timeout);
                                }
                        }
                }
        } else if (seg_len > 0) {
                TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
                TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
                /*
                 * If an out of order FIN was received before, and the seq
                 * num and len of the new segment match that of the FIN,
                 * put the FIN flag back in.
                 */
                if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
                    seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
                        flags |= TH_FIN;
                        tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
                }
        }
        if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
        if (flags & TH_RST) {
                freemsg(mp);
                switch (tcp->tcp_state) {
                case TCPS_SYN_RCVD:
                        (void) tcp_clean_death(tcp, ECONNREFUSED);
                        break;
                case TCPS_ESTABLISHED:
                case TCPS_FIN_WAIT_1:
                case TCPS_FIN_WAIT_2:
                case TCPS_CLOSE_WAIT:
                        (void) tcp_clean_death(tcp, ECONNRESET);
                        break;
                case TCPS_CLOSING:
                case TCPS_LAST_ACK:
                        (void) tcp_clean_death(tcp, 0);
                        break;
                default:
                        ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
                        (void) tcp_clean_death(tcp, ENXIO);
                        break;
                }
                return;
        }
        if (flags & TH_SYN) {
                /*
                 * See RFC 793, Page 71
                 *
                 * The seq number must be in the window as it should
                 * be "fixed" above.  If it is outside window, it should
                 * be already rejected.  Note that we allow seg_seq to be
                 * rnxt + rwnd because we want to accept 0 window probe.
                 */
                ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
                    SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
                freemsg(mp);
                /*
                 * If the ACK flag is not set, just use our snxt as the
                 * seq number of the RST segment.
                 */
                if (!(flags & TH_ACK)) {
                        seg_ack = tcp->tcp_snxt;
                }
                tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
                    TH_RST|TH_ACK);
                ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
                (void) tcp_clean_death(tcp, ECONNRESET);
                return;
        }
        /*
         * urp could be -1 when the urp field in the packet is 0
         * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
         * byte was at seg_seq - 1, in which case we ignore the urgent flag.
         */
        if (flags & TH_URG && urp >= 0) {
                if (!tcp->tcp_urp_last_valid ||
                    SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
                        /*
                         * Non-STREAMS sockets handle the urgent data a litte
                         * differently from STREAMS based sockets. There is no
                         * need to mark any mblks with the MSG{NOT,}MARKNEXT
                         * flags to keep SIOCATMARK happy. Instead a
                         * su_signal_oob upcall is made to update the mark.
                         * Neither is a T_EXDATA_IND mblk needed to be
                         * prepended to the urgent data. The urgent data is
                         * delivered using the su_recv upcall, where we set
                         * the MSG_OOB flag to indicate that it is urg data.
                         *
                         * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
                         * are used by non-STREAMS sockets.
                         */
                        if (IPCL_IS_NONSTR(connp)) {
                                if (!TCP_IS_DETACHED(tcp)) {
                                        (*sockupcalls->su_signal_oob)
                                            (connp->conn_upper_handle, urp);
                                }
                        } else {
                                /*
                                 * If we haven't generated the signal yet for
                                 * this urgent pointer value, do it now.  Also,
                                 * send up a zero-length M_DATA indicating
                                 * whether or not this is the mark. The latter
                                 * is not needed when a T_EXDATA_IND is sent up.
                                 * However, if there are allocation failures
                                 * this code relies on the sender retransmitting
                                 * and the socket code for determining the mark
                                 * should not block waiting for the peer to
                                 * transmit. Thus, for simplicity we always
                                 * send up the mark indication.
                                 */
                                mp1 = allocb(0, BPRI_MED);
                                if (mp1 == NULL) {
                                        freemsg(mp);
                                        return;
                                }
                                if (!TCP_IS_DETACHED(tcp) &&
                                    !putnextctl1(connp->conn_rq, M_PCSIG,
                                    SIGURG)) {
                                        /* Try again on the rexmit. */
                                        freemsg(mp1);
                                        freemsg(mp);
                                        return;
                                }
                                /*
                                 * Mark with NOTMARKNEXT for now.
                                 * The code below will change this to MARKNEXT
                                 * if we are at the mark.
                                 *
                                 * If there are allocation failures (e.g. in
                                 * dupmsg below) the next time tcp_input_data
                                 * sees the urgent segment it will send up the
                                 * MSGMARKNEXT message.
                                 */
                                mp1->b_flag |= MSGNOTMARKNEXT;
                                freemsg(tcp->tcp_urp_mark_mp);
                                tcp->tcp_urp_mark_mp = mp1;
                                flags |= TH_SEND_URP_MARK;
#ifdef DEBUG
                                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                                    "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
                                    "last %x, %s",
                                    seg_seq, urp, tcp->tcp_urp_last,
                                    tcp_display(tcp, NULL, DISP_PORT_ONLY));
#endif /* DEBUG */
                        }
                        tcp->tcp_urp_last_valid = B_TRUE;
                        tcp->tcp_urp_last = urp + seg_seq;
                } else if (tcp->tcp_urp_mark_mp != NULL) {
                        /*
                         * An allocation failure prevented the previous
                         * tcp_input_data from sending up the allocated
                         * MSG*MARKNEXT message - send it up this time
                         * around.
                         */
                        flags |= TH_SEND_URP_MARK;
                }

                /*
                 * If the urgent byte is in this segment, make sure that it is
                 * all by itself.  This makes it much easier to deal with the
                 * possibility of an allocation failure on the T_exdata_ind.
                 * Note that seg_len is the number of bytes in the segment, and
                 * urp is the offset into the segment of the urgent byte.
                 * urp < seg_len means that the urgent byte is in this segment.
                 */
                if (urp < seg_len) {
                        if (seg_len != 1) {
                                uint32_t  tmp_rnxt;
                                /*
                                 * Break it up and feed it back in.
                                 * Re-attach the IP header.
                                 */
                                mp->b_rptr = iphdr;
                                if (urp > 0) {
                                        /*
                                         * There is stuff before the urgent
                                         * byte.
                                         */
                                        mp1 = dupmsg(mp);
                                        if (!mp1) {
                                                /*
                                                 * Trim from urgent byte on.
                                                 * The rest will come back.
                                                 */
                                                (void) adjmsg(mp,
                                                    urp - seg_len);
                                                tcp_input_data(connp,
                                                    mp, NULL, ira);
                                                return;
                                        }
                                        (void) adjmsg(mp1, urp - seg_len);
                                        /* Feed this piece back in. */
                                        tmp_rnxt = tcp->tcp_rnxt;
                                        tcp_input_data(connp, mp1, NULL, ira);
                                        /*
                                         * If the data passed back in was not
                                         * processed (ie: bad ACK) sending
                                         * the remainder back in will cause a
                                         * loop. In this case, drop the
                                         * packet and let the sender try
                                         * sending a good packet.
                                         */
                                        if (tmp_rnxt == tcp->tcp_rnxt) {
                                                freemsg(mp);
                                                return;
                                        }
                                }
                                if (urp != seg_len - 1) {
                                        uint32_t  tmp_rnxt;
                                        /*
                                         * There is stuff after the urgent
                                         * byte.
                                         */
                                        mp1 = dupmsg(mp);
                                        if (!mp1) {
                                                /*
                                                 * Trim everything beyond the
                                                 * urgent byte.  The rest will
                                                 * come back.
                                                 */
                                                (void) adjmsg(mp,
                                                    urp + 1 - seg_len);
                                                tcp_input_data(connp,
                                                    mp, NULL, ira);
                                                return;
                                        }
                                        (void) adjmsg(mp1, urp + 1 - seg_len);
                                        tmp_rnxt = tcp->tcp_rnxt;
                                        tcp_input_data(connp, mp1, NULL, ira);
                                        /*
                                         * If the data passed back in was not
                                         * processed (ie: bad ACK) sending
                                         * the remainder back in will cause a
                                         * loop. In this case, drop the
                                         * packet and let the sender try
                                         * sending a good packet.
                                         */
                                        if (tmp_rnxt == tcp->tcp_rnxt) {
                                                freemsg(mp);
                                                return;
                                        }
                                }
                                tcp_input_data(connp, mp, NULL, ira);
                                return;
                        }
                        /*
                         * This segment contains only the urgent byte.  We
                         * have to allocate the T_exdata_ind, if we can.
                         */
                        if (IPCL_IS_NONSTR(connp)) {
                                int error;

                                (*sockupcalls->su_recv)
                                    (connp->conn_upper_handle, mp, seg_len,
                                    MSG_OOB, &error, NULL);
                                /*
                                 * We should never be in middle of a
                                 * fallback, the squeue guarantees that.
                                 */
                                ASSERT(error != EOPNOTSUPP);
                                mp = NULL;
                                goto update_ack;
                        } else if (!tcp->tcp_urp_mp) {
                                struct T_exdata_ind *tei;
                                mp1 = allocb(sizeof (struct T_exdata_ind),
                                    BPRI_MED);
                                if (!mp1) {
                                        /*
                                         * Sigh... It'll be back.
                                         * Generate any MSG*MARK message now.
                                         */
                                        freemsg(mp);
                                        seg_len = 0;
                                        if (flags & TH_SEND_URP_MARK) {


                                                ASSERT(tcp->tcp_urp_mark_mp);
                                                tcp->tcp_urp_mark_mp->b_flag &=
                                                    ~MSGNOTMARKNEXT;
                                                tcp->tcp_urp_mark_mp->b_flag |=
                                                    MSGMARKNEXT;
                                        }
                                        goto ack_check;
                                }
                                mp1->b_datap->db_type = M_PROTO;
                                tei = (struct T_exdata_ind *)mp1->b_rptr;
                                tei->PRIM_type = T_EXDATA_IND;
                                tei->MORE_flag = 0;
                                mp1->b_wptr = (uchar_t *)&tei[1];
                                tcp->tcp_urp_mp = mp1;
#ifdef DEBUG
                                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                                    "tcp_rput: allocated exdata_ind %s",
                                    tcp_display(tcp, NULL,
                                    DISP_PORT_ONLY));
#endif /* DEBUG */
                                /*
                                 * There is no need to send a separate MSG*MARK
                                 * message since the T_EXDATA_IND will be sent
                                 * now.
                                 */
                                flags &= ~TH_SEND_URP_MARK;
                                freemsg(tcp->tcp_urp_mark_mp);
                                tcp->tcp_urp_mark_mp = NULL;
                        }
                        /*
                         * Now we are all set.  On the next putnext upstream,
                         * tcp_urp_mp will be non-NULL and will get prepended
                         * to what has to be this piece containing the urgent
                         * byte.  If for any reason we abort this segment below,
                         * if it comes back, we will have this ready, or it
                         * will get blown off in close.
                         */
                } else if (urp == seg_len) {
                        /*
                         * The urgent byte is the next byte after this sequence
                         * number. If this endpoint is non-STREAMS, then there
                         * is nothing to do here since the socket has already
                         * been notified about the urg pointer by the
                         * su_signal_oob call above.
                         *
                         * In case of STREAMS, some more work might be needed.
                         * If there is data it is marked with MSGMARKNEXT and
                         * and any tcp_urp_mark_mp is discarded since it is not
                         * needed. Otherwise, if the code above just allocated
                         * a zero-length tcp_urp_mark_mp message, that message
                         * is tagged with MSGMARKNEXT. Sending up these
                         * MSGMARKNEXT messages makes SIOCATMARK work correctly
                         * even though the T_EXDATA_IND will not be sent up
                         * until the urgent byte arrives.
                         */
                        if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
                                if (seg_len != 0) {
                                        flags |= TH_MARKNEXT_NEEDED;
                                        freemsg(tcp->tcp_urp_mark_mp);
                                        tcp->tcp_urp_mark_mp = NULL;
                                        flags &= ~TH_SEND_URP_MARK;
                                } else if (tcp->tcp_urp_mark_mp != NULL) {
                                        flags |= TH_SEND_URP_MARK;
                                        tcp->tcp_urp_mark_mp->b_flag &=
                                            ~MSGNOTMARKNEXT;
                                        tcp->tcp_urp_mark_mp->b_flag |=
                                            MSGMARKNEXT;
                                }
                        }
#ifdef DEBUG
                        (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                            "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
                            seg_len, flags,
                            tcp_display(tcp, NULL, DISP_PORT_ONLY));
#endif /* DEBUG */
                }
#ifdef DEBUG
                else {
                        /* Data left until we hit mark */
                        (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                            "tcp_rput: URP %d bytes left, %s",
                            urp - seg_len, tcp_display(tcp, NULL,
                            DISP_PORT_ONLY));
                }
#endif /* DEBUG */
        }

process_ack:
        if (!(flags & TH_ACK)) {
                freemsg(mp);
                goto xmit_check;
        }
        }
        bytes_acked = (int)(seg_ack - tcp->tcp_suna);

        if (bytes_acked > 0)
                tcp->tcp_ip_forward_progress = B_TRUE;
        if (tcp->tcp_state == TCPS_SYN_RCVD) {
                /*
                 * tcp_sendmsg() checks tcp_state without entering
                 * the squeue so tcp_state should be updated before
                 * sending up a connection confirmation or a new
                 * connection indication.
                 */
                tcp->tcp_state = TCPS_ESTABLISHED;

                /*
                 * We are seeing the final ack in the three way
                 * hand shake of a active open'ed connection
                 * so we must send up a T_CONN_CON
                 */
                if (tcp->tcp_active_open) {
                        if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
                                freemsg(mp);
                                tcp->tcp_state = TCPS_SYN_RCVD;
                                return;
                        }
                        /*
                         * Don't fuse the loopback endpoints for
                         * simultaneous active opens.
                         */
                        if (tcp->tcp_loopback) {
                                TCP_STAT(tcps, tcp_fusion_unfusable);
                                tcp->tcp_unfusable = B_TRUE;
                        }
                        /*
                         * For simultaneous active open, trace receipt of final
                         * ACK as tcp:::connect-established.
                         */
                        DTRACE_TCP5(connect__established, mblk_t *, NULL,
                            ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
                            iphdr, tcp_t *, tcp, tcph_t *, tcpha);
                } else if (IPCL_IS_NONSTR(connp)) {
                        /*
                         * 3-way handshake has completed, so notify socket
                         * of the new connection.
                         *
                         * We are here means eager is fine but it can
                         * get a TH_RST at any point between now and till
                         * accept completes and disappear. We need to
                         * ensure that reference to eager is valid after
                         * we get out of eager's perimeter. So we do
                         * an extra refhold.
                         */
                        CONN_INC_REF(connp);

                        if (!tcp_newconn_notify(tcp, ira)) {
                                /*
                                 * The state-change probe for SYN_RCVD ->
                                 * ESTABLISHED has not fired yet. We reset
                                 * the state to SYN_RCVD so that future
                                 * state-change probes report correct state
                                 * transistions.
                                 */
                                tcp->tcp_state = TCPS_SYN_RCVD;
                                freemsg(mp);
                                /* notification did not go up, so drop ref */
                                CONN_DEC_REF(connp);
                                /* ... and close the eager */
                                ASSERT(TCP_IS_DETACHED(tcp));
                                (void) tcp_close_detached(tcp);
                                return;
                        }
                        /*
                         * tcp_newconn_notify() changes conn_upcalls and
                         * connp->conn_upper_handle.  Fix things now, in case
                         * there's data attached to this ack.
                         */
                        if (connp->conn_upcalls != NULL)
                                sockupcalls = connp->conn_upcalls;
                        /*
                         * For passive open, trace receipt of final ACK as
                         * tcp:::accept-established.
                         */
                        DTRACE_TCP5(accept__established, mlbk_t *, NULL,
                            ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
                            iphdr, tcp_t *, tcp, tcph_t *, tcpha);
                } else {
                        /*
                         * 3-way handshake complete - this is a STREAMS based
                         * socket, so pass up the T_CONN_IND.
                         */
                        tcp_t   *listener = tcp->tcp_listener;
                        mblk_t  *mp = tcp->tcp_conn.tcp_eager_conn_ind;

                        tcp->tcp_tconnind_started = B_TRUE;
                        tcp->tcp_conn.tcp_eager_conn_ind = NULL;
                        ASSERT(mp != NULL);
                        /*
                         * We are here means eager is fine but it can
                         * get a TH_RST at any point between now and till
                         * accept completes and disappear. We need to
                         * ensure that reference to eager is valid after
                         * we get out of eager's perimeter. So we do
                         * an extra refhold.
                         */
                        CONN_INC_REF(connp);

                        /*
                         * The listener also exists because of the refhold
                         * done in tcp_input_listener. Its possible that it
                         * might have closed. We will check that once we
                         * get inside listeners context.
                         */
                        CONN_INC_REF(listener->tcp_connp);
                        if (listener->tcp_connp->conn_sqp ==
                            connp->conn_sqp) {
                                /*
                                 * We optimize by not calling an SQUEUE_ENTER
                                 * on the listener since we know that the
                                 * listener and eager squeues are the same.
                                 * We are able to make this check safely only
                                 * because neither the eager nor the listener
                                 * can change its squeue. Only an active connect
                                 * can change its squeue
                                 */
                                tcp_send_conn_ind(listener->tcp_connp, mp,
                                    listener->tcp_connp->conn_sqp);
                                CONN_DEC_REF(listener->tcp_connp);
                        } else if (!tcp->tcp_loopback) {
                                SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
                                    mp, tcp_send_conn_ind,
                                    listener->tcp_connp, NULL, SQ_FILL,
                                    SQTAG_TCP_CONN_IND);
                        } else {
                                SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
                                    mp, tcp_send_conn_ind,
                                    listener->tcp_connp, NULL, SQ_NODRAIN,
                                    SQTAG_TCP_CONN_IND);
                        }
                        /*
                         * For passive open, trace receipt of final ACK as
                         * tcp:::accept-established.
                         */
                        DTRACE_TCP5(accept__established, mlbk_t *, NULL,
                            ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
                            iphdr, tcp_t *, tcp, tcph_t *, tcpha);
                }
                TCPS_CONN_INC(tcps);

                tcp->tcp_suna = tcp->tcp_iss + 1;       /* One for the SYN */
                bytes_acked--;
                /* SYN was acked - making progress */
                tcp->tcp_ip_forward_progress = B_TRUE;

                /*
                 * If SYN was retransmitted, need to reset all
                 * retransmission info as this segment will be
                 * treated as a dup ACK.
                 */
                if (tcp->tcp_rexmit) {
                        tcp->tcp_rexmit = B_FALSE;
                        tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
                        tcp->tcp_rexmit_max = tcp->tcp_snxt;
                        tcp->tcp_ms_we_have_waited = 0;
                        tcp->tcp_cwnd = mss;
                }

                /*
                 * We set the send window to zero here.
                 * This is needed if there is data to be
                 * processed already on the queue.
                 * Later (at swnd_update label), the
                 * "new_swnd > tcp_swnd" condition is satisfied
                 * the XMIT_NEEDED flag is set in the current
                 * (SYN_RCVD) state. This ensures tcp_wput_data() is
                 * called if there is already data on queue in
                 * this state.
                 */
                tcp->tcp_swnd = 0;

                if (new_swnd > tcp->tcp_max_swnd)
                        tcp->tcp_max_swnd = new_swnd;
                tcp->tcp_swl1 = seg_seq;
                tcp->tcp_swl2 = seg_ack;
                tcp->tcp_valid_bits &= ~TCP_ISS_VALID;

                /* Trace change from SYN_RCVD -> ESTABLISHED here */
                DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
                    connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
                    int32_t, TCPS_SYN_RCVD);

                /* Fuse when both sides are in ESTABLISHED state */
                if (tcp->tcp_loopback && do_tcp_fusion)
                        tcp_fuse(tcp, iphdr, tcpha);

        }
        /* This code follows 4.4BSD-Lite2 mostly. */
        if (bytes_acked < 0)
                goto est;

        /*
         * If TCP is ECN capable and the congestion experience bit is
         * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
         * done once per window (or more loosely, per RTT).
         */
        if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
                tcp->tcp_cwr = B_FALSE;
        if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
                if (!tcp->tcp_cwr) {
                        npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
                        tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
                        tcp->tcp_cwnd = npkt * mss;
                        /*
                         * If the cwnd is 0, use the timer to clock out
                         * new segments.  This is required by the ECN spec.
                         */
                        if (npkt == 0) {
                                TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
                                /*
                                 * This makes sure that when the ACK comes
                                 * back, we will increase tcp_cwnd by 1 MSS.
                                 */
                                tcp->tcp_cwnd_cnt = 0;
                        }
                        tcp->tcp_cwr = B_TRUE;
                        /*
                         * This marks the end of the current window of in
                         * flight data.  That is why we don't use
                         * tcp_suna + tcp_swnd.  Only data in flight can
                         * provide ECN info.
                         */
                        tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
                        tcp->tcp_ecn_cwr_sent = B_FALSE;
                }
        }

        mp1 = tcp->tcp_xmit_head;
        if (bytes_acked == 0) {
                if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
                        int dupack_cnt;

                        TCPS_BUMP_MIB(tcps, tcpInDupAck);
                        /*
                         * Fast retransmit.  When we have seen exactly three
                         * identical ACKs while we have unacked data
                         * outstanding we take it as a hint that our peer
                         * dropped something.
                         *
                         * If TCP is retransmitting, don't do fast retransmit.
                         */
                        if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
                            ! tcp->tcp_rexmit) {
                                /* Do Limited Transmit */
                                if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
                                    tcps->tcps_dupack_fast_retransmit) {
                                        /*
                                         * RFC 3042
                                         *
                                         * What we need to do is temporarily
                                         * increase tcp_cwnd so that new
                                         * data can be sent if it is allowed
                                         * by the receive window (tcp_rwnd).
                                         * tcp_wput_data() will take care of
                                         * the rest.
                                         *
                                         * If the connection is SACK capable,
                                         * only do limited xmit when there
                                         * is SACK info.
                                         *
                                         * Note how tcp_cwnd is incremented.
                                         * The first dup ACK will increase
                                         * it by 1 MSS.  The second dup ACK
                                         * will increase it by 2 MSS.  This
                                         * means that only 1 new segment will
                                         * be sent for each dup ACK.
                                         */
                                        if (tcp->tcp_unsent > 0 &&
                                            (!tcp->tcp_snd_sack_ok ||
                                            (tcp->tcp_snd_sack_ok &&
                                            tcp->tcp_notsack_list != NULL))) {
                                                tcp->tcp_cwnd += mss <<
                                                    (tcp->tcp_dupack_cnt - 1);
                                                flags |= TH_LIMIT_XMIT;
                                        }
                                } else if (dupack_cnt ==
                                    tcps->tcps_dupack_fast_retransmit) {

                                /*
                                 * If we have reduced tcp_ssthresh
                                 * because of ECN, do not reduce it again
                                 * unless it is already one window of data
                                 * away.  After one window of data, tcp_cwr
                                 * should then be cleared.  Note that
                                 * for non ECN capable connection, tcp_cwr
                                 * should always be false.
                                 *
                                 * Adjust cwnd since the duplicate
                                 * ack indicates that a packet was
                                 * dropped (due to congestion.)
                                 */
                                if (!tcp->tcp_cwr) {
                                        npkt = ((tcp->tcp_snxt -
                                            tcp->tcp_suna) >> 1) / mss;
                                        tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
                                            mss;
                                        tcp->tcp_cwnd = (npkt +
                                            tcp->tcp_dupack_cnt) * mss;
                                }
                                if (tcp->tcp_ecn_ok) {
                                        tcp->tcp_cwr = B_TRUE;
                                        tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
                                        tcp->tcp_ecn_cwr_sent = B_FALSE;
                                }

                                /*
                                 * We do Hoe's algorithm.  Refer to her
                                 * paper "Improving the Start-up Behavior
                                 * of a Congestion Control Scheme for TCP,"
                                 * appeared in SIGCOMM'96.
                                 *
                                 * Save highest seq no we have sent so far.
                                 * Be careful about the invisible FIN byte.
                                 */
                                if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
                                    (tcp->tcp_unsent == 0)) {
                                        tcp->tcp_rexmit_max = tcp->tcp_fss;
                                } else {
                                        tcp->tcp_rexmit_max = tcp->tcp_snxt;
                                }

                                /*
                                 * For SACK:
                                 * Calculate tcp_pipe, which is the
                                 * estimated number of bytes in
                                 * network.
                                 *
                                 * tcp_fack is the highest sack'ed seq num
                                 * TCP has received.
                                 *
                                 * tcp_pipe is explained in the above quoted
                                 * Fall and Floyd's paper.  tcp_fack is
                                 * explained in Mathis and Mahdavi's
                                 * "Forward Acknowledgment: Refining TCP
                                 * Congestion Control" in SIGCOMM '96.
                                 */
                                if (tcp->tcp_snd_sack_ok) {
                                        if (tcp->tcp_notsack_list != NULL) {
                                                tcp->tcp_pipe = tcp->tcp_snxt -
                                                    tcp->tcp_fack;
                                                tcp->tcp_sack_snxt = seg_ack;
                                                flags |= TH_NEED_SACK_REXMIT;
                                        } else {
                                                /*
                                                 * Always initialize tcp_pipe
                                                 * even though we don't have
                                                 * any SACK info.  If later
                                                 * we get SACK info and
                                                 * tcp_pipe is not initialized,
                                                 * funny things will happen.
                                                 */
                                                tcp->tcp_pipe =
                                                    tcp->tcp_cwnd_ssthresh;
                                        }
                                } else {
                                        flags |= TH_REXMIT_NEEDED;
                                } /* tcp_snd_sack_ok */

                                } else {
                                        /*
                                         * Here we perform congestion
                                         * avoidance, but NOT slow start.
                                         * This is known as the Fast
                                         * Recovery Algorithm.
                                         */
                                        if (tcp->tcp_snd_sack_ok &&
                                            tcp->tcp_notsack_list != NULL) {
                                                flags |= TH_NEED_SACK_REXMIT;
                                                tcp->tcp_pipe -= mss;
                                                if (tcp->tcp_pipe < 0)
                                                        tcp->tcp_pipe = 0;
                                        } else {
                                        /*
                                         * We know that one more packet has
                                         * left the pipe thus we can update
                                         * cwnd.
                                         */
                                        cwnd = tcp->tcp_cwnd + mss;
                                        if (cwnd > tcp->tcp_cwnd_max)
                                                cwnd = tcp->tcp_cwnd_max;
                                        tcp->tcp_cwnd = cwnd;
                                        if (tcp->tcp_unsent > 0)
                                                flags |= TH_XMIT_NEEDED;
                                        }
                                }
                        }
                } else if (tcp->tcp_zero_win_probe) {
                        /*
                         * If the window has opened, need to arrange
                         * to send additional data.
                         */
                        if (new_swnd != 0) {
                                /* tcp_suna != tcp_snxt */
                                /* Packet contains a window update */
                                TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
                                tcp->tcp_zero_win_probe = 0;
                                tcp->tcp_timer_backoff = 0;
                                tcp->tcp_ms_we_have_waited = 0;

                                /*
                                 * Transmit starting with tcp_suna since
                                 * the one byte probe is not ack'ed.
                                 * If TCP has sent more than one identical
                                 * probe, tcp_rexmit will be set.  That means
                                 * tcp_ss_rexmit() will send out the one
                                 * byte along with new data.  Otherwise,
                                 * fake the retransmission.
                                 */
                                flags |= TH_XMIT_NEEDED;
                                if (!tcp->tcp_rexmit) {
                                        tcp->tcp_rexmit = B_TRUE;
                                        tcp->tcp_dupack_cnt = 0;
                                        tcp->tcp_rexmit_nxt = tcp->tcp_suna;
                                        tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
                                }
                        }
                }
                goto swnd_update;
        }

        /*
         * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
         * If the ACK value acks something that we have not yet sent, it might
         * be an old duplicate segment.  Send an ACK to re-synchronize the
         * other side.
         * Note: reset in response to unacceptable ACK in SYN_RECEIVE
         * state is handled above, so we can always just drop the segment and
         * send an ACK here.
         *
         * In the case where the peer shrinks the window, we see the new window
         * update, but all the data sent previously is queued up by the peer.
         * To account for this, in tcp_process_shrunk_swnd(), the sequence
         * number, which was already sent, and within window, is recorded.
         * tcp_snxt is then updated.
         *
         * If the window has previously shrunk, and an ACK for data not yet
         * sent, according to tcp_snxt is recieved, it may still be valid. If
         * the ACK is for data within the window at the time the window was
         * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
         * the sequence number ACK'ed.
         *
         * If the ACK covers all the data sent at the time the window was
         * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
         *
         * Should we send ACKs in response to ACK only segments?
         */

        if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
                if ((tcp->tcp_is_wnd_shrnk) &&
                    (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
                        uint32_t data_acked_ahead_snxt;

                        data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
                        tcp_update_xmit_tail(tcp, seg_ack);
                        tcp->tcp_unsent -= data_acked_ahead_snxt;
                } else {
                        TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
                        /* drop the received segment */
                        freemsg(mp);

                        /*
                         * Send back an ACK.  If tcp_drop_ack_unsent_cnt is
                         * greater than 0, check if the number of such
                         * bogus ACks is greater than that count.  If yes,
                         * don't send back any ACK.  This prevents TCP from
                         * getting into an ACK storm if somehow an attacker
                         * successfully spoofs an acceptable segment to our
                         * peer.  If this continues (count > 2 X threshold),
                         * we should abort this connection.
                         */
                        if (tcp_drop_ack_unsent_cnt > 0 &&
                            ++tcp->tcp_in_ack_unsent >
                            tcp_drop_ack_unsent_cnt) {
                                TCP_STAT(tcps, tcp_in_ack_unsent_drop);
                                if (tcp->tcp_in_ack_unsent > 2 *
                                    tcp_drop_ack_unsent_cnt) {
                                        (void) tcp_clean_death(tcp, EPROTO);
                                }
                                return;
                        }
                        mp = tcp_ack_mp(tcp);
                        if (mp != NULL) {
                                BUMP_LOCAL(tcp->tcp_obsegs);
                                TCPS_BUMP_MIB(tcps, tcpOutAck);
                                tcp_send_data(tcp, mp);
                        }
                        return;
                }
        } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
            tcp->tcp_snxt_shrunk)) {
                        tcp->tcp_is_wnd_shrnk = B_FALSE;
        }

        /*
         * TCP gets a new ACK, update the notsack'ed list to delete those
         * blocks that are covered by this ACK.
         */
        if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
                tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
                    &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
        }

        /*
         * If we got an ACK after fast retransmit, check to see
         * if it is a partial ACK.  If it is not and the congestion
         * window was inflated to account for the other side's
         * cached packets, retract it.  If it is, do Hoe's algorithm.
         */
        if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
                ASSERT(tcp->tcp_rexmit == B_FALSE);
                if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
                        tcp->tcp_dupack_cnt = 0;
                        /*
                         * Restore the orig tcp_cwnd_ssthresh after
                         * fast retransmit phase.
                         */
                        if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
                                tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
                        }
                        tcp->tcp_rexmit_max = seg_ack;
                        tcp->tcp_cwnd_cnt = 0;

                        /*
                         * Remove all notsack info to avoid confusion with
                         * the next fast retrasnmit/recovery phase.
                         */
                        if (tcp->tcp_snd_sack_ok) {
                                TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
                                    tcp);
                        }
                } else {
                        if (tcp->tcp_snd_sack_ok &&
                            tcp->tcp_notsack_list != NULL) {
                                flags |= TH_NEED_SACK_REXMIT;
                                tcp->tcp_pipe -= mss;
                                if (tcp->tcp_pipe < 0)
                                        tcp->tcp_pipe = 0;
                        } else {
                                /*
                                 * Hoe's algorithm:
                                 *
                                 * Retransmit the unack'ed segment and
                                 * restart fast recovery.  Note that we
                                 * need to scale back tcp_cwnd to the
                                 * original value when we started fast
                                 * recovery.  This is to prevent overly
                                 * aggressive behaviour in sending new
                                 * segments.
                                 */
                                tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
                                    tcps->tcps_dupack_fast_retransmit * mss;
                                tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
                                flags |= TH_REXMIT_NEEDED;
                        }
                }
        } else {
                tcp->tcp_dupack_cnt = 0;
                if (tcp->tcp_rexmit) {
                        /*
                         * TCP is retranmitting.  If the ACK ack's all
                         * outstanding data, update tcp_rexmit_max and
                         * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
                         * to the correct value.
                         *
                         * Note that SEQ_LEQ() is used.  This is to avoid
                         * unnecessary fast retransmit caused by dup ACKs
                         * received when TCP does slow start retransmission
                         * after a time out.  During this phase, TCP may
                         * send out segments which are already received.
                         * This causes dup ACKs to be sent back.
                         */
                        if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
                                if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
                                        tcp->tcp_rexmit_nxt = seg_ack;
                                }
                                if (seg_ack != tcp->tcp_rexmit_max) {
                                        flags |= TH_XMIT_NEEDED;
                                }
                        } else {
                                tcp->tcp_rexmit = B_FALSE;
                                tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
                        }
                        tcp->tcp_ms_we_have_waited = 0;
                }
        }

        TCPS_BUMP_MIB(tcps, tcpInAckSegs);
        TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
        tcp->tcp_suna = seg_ack;
        if (tcp->tcp_zero_win_probe != 0) {
                tcp->tcp_zero_win_probe = 0;
                tcp->tcp_timer_backoff = 0;
        }

        /*
         * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
         * Note that it cannot be the SYN being ack'ed.  The code flow
         * will not reach here.
         */
        if (mp1 == NULL) {
                goto fin_acked;
        }

        /*
         * Update the congestion window.
         *
         * If TCP is not ECN capable or TCP is ECN capable but the
         * congestion experience bit is not set, increase the tcp_cwnd as
         * usual.
         */
        if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
                cwnd = tcp->tcp_cwnd;
                add = mss;

                if (cwnd >= tcp->tcp_cwnd_ssthresh) {
                        /*
                         * This is to prevent an increase of less than 1 MSS of
                         * tcp_cwnd.  With partial increase, tcp_wput_data()
                         * may send out tinygrams in order to preserve mblk
                         * boundaries.
                         *
                         * By initializing tcp_cwnd_cnt to new tcp_cwnd and
                         * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
                         * increased by 1 MSS for every RTTs.
                         */
                        if (tcp->tcp_cwnd_cnt <= 0) {
                                tcp->tcp_cwnd_cnt = cwnd + add;
                        } else {
                                tcp->tcp_cwnd_cnt -= add;
                                add = 0;
                        }
                }
                tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
        }

        /* See if the latest urgent data has been acknowledged */
        if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
            SEQ_GT(seg_ack, tcp->tcp_urg))
                tcp->tcp_valid_bits &= ~TCP_URG_VALID;

        /* Can we update the RTT estimates? */
        if (tcp->tcp_snd_ts_ok) {
                /* Ignore zero timestamp echo-reply. */
                if (tcpopt.tcp_opt_ts_ecr != 0) {
                        tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
                            (int32_t)tcpopt.tcp_opt_ts_ecr);
                }

                /* If needed, restart the timer. */
                if (tcp->tcp_set_timer == 1) {
                        TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
                        tcp->tcp_set_timer = 0;
                }
                /*
                 * Update tcp_csuna in case the other side stops sending
                 * us timestamps.
                 */
                tcp->tcp_csuna = tcp->tcp_snxt;
        } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
                /*
                 * An ACK sequence we haven't seen before, so get the RTT
                 * and update the RTO. But first check if the timestamp is
                 * valid to use.
                 */
                if ((mp1->b_next != NULL) &&
                    SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
                        tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
                            (int32_t)(intptr_t)mp1->b_prev);
                else
                        TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);

                /* Remeber the last sequence to be ACKed */
                tcp->tcp_csuna = seg_ack;
                if (tcp->tcp_set_timer == 1) {
                        TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
                        tcp->tcp_set_timer = 0;
                }
        } else {
                TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
        }

        /* Eat acknowledged bytes off the xmit queue. */
        for (;;) {
                mblk_t  *mp2;
                uchar_t *wptr;

                wptr = mp1->b_wptr;
                ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
                bytes_acked -= (int)(wptr - mp1->b_rptr);
                if (bytes_acked < 0) {
                        mp1->b_rptr = wptr + bytes_acked;
                        /*
                         * Set a new timestamp if all the bytes timed by the
                         * old timestamp have been ack'ed.
                         */
                        if (SEQ_GT(seg_ack,
                            (uint32_t)(uintptr_t)(mp1->b_next))) {
                                mp1->b_prev =
                                    (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
                                mp1->b_next = NULL;
                        }
                        break;
                }
                mp1->b_next = NULL;
                mp1->b_prev = NULL;
                mp2 = mp1;
                mp1 = mp1->b_cont;

                /*
                 * This notification is required for some zero-copy
                 * clients to maintain a copy semantic. After the data
                 * is ack'ed, client is safe to modify or reuse the buffer.
                 */
                if (tcp->tcp_snd_zcopy_aware &&
                    (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
                        tcp_zcopy_notify(tcp);
                freeb(mp2);
                if (bytes_acked == 0) {
                        if (mp1 == NULL) {
                                /* Everything is ack'ed, clear the tail. */
                                tcp->tcp_xmit_tail = NULL;
                                /*
                                 * Cancel the timer unless we are still
                                 * waiting for an ACK for the FIN packet.
                                 */
                                if (tcp->tcp_timer_tid != 0 &&
                                    tcp->tcp_snxt == tcp->tcp_suna) {
                                        (void) TCP_TIMER_CANCEL(tcp,
                                            tcp->tcp_timer_tid);
                                        tcp->tcp_timer_tid = 0;
                                }
                                goto pre_swnd_update;
                        }
                        if (mp2 != tcp->tcp_xmit_tail)
                                break;
                        tcp->tcp_xmit_tail = mp1;
                        ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
                            (uintptr_t)INT_MAX);
                        tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
                            mp1->b_rptr);
                        break;
                }
                if (mp1 == NULL) {
                        /*
                         * More was acked but there is nothing more
                         * outstanding.  This means that the FIN was
                         * just acked or that we're talking to a clown.
                         */
fin_acked:
                        ASSERT(tcp->tcp_fin_sent);
                        tcp->tcp_xmit_tail = NULL;
                        if (tcp->tcp_fin_sent) {
                                /* FIN was acked - making progress */
                                if (!tcp->tcp_fin_acked)
                                        tcp->tcp_ip_forward_progress = B_TRUE;
                                tcp->tcp_fin_acked = B_TRUE;
                                if (tcp->tcp_linger_tid != 0 &&
                                    TCP_TIMER_CANCEL(tcp,
                                    tcp->tcp_linger_tid) >= 0) {
                                        tcp_stop_lingering(tcp);
                                        freemsg(mp);
                                        mp = NULL;
                                }
                        } else {
                                /*
                                 * We should never get here because
                                 * we have already checked that the
                                 * number of bytes ack'ed should be
                                 * smaller than or equal to what we
                                 * have sent so far (it is the
                                 * acceptability check of the ACK).
                                 * We can only get here if the send
                                 * queue is corrupted.
                                 *
                                 * Terminate the connection and
                                 * panic the system.  It is better
                                 * for us to panic instead of
                                 * continuing to avoid other disaster.
                                 */
                                tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
                                    tcp->tcp_rnxt, TH_RST|TH_ACK);
                                panic("Memory corruption "
                                    "detected for connection %s.",
                                    tcp_display(tcp, NULL,
                                    DISP_ADDR_AND_PORT));
                                /*NOTREACHED*/
                        }
                        goto pre_swnd_update;
                }
                ASSERT(mp2 != tcp->tcp_xmit_tail);
        }
        if (tcp->tcp_unsent) {
                flags |= TH_XMIT_NEEDED;
        }
pre_swnd_update:
        tcp->tcp_xmit_head = mp1;
swnd_update:
        /*
         * The following check is different from most other implementations.
         * For bi-directional transfer, when segments are dropped, the
         * "normal" check will not accept a window update in those
         * retransmitted segemnts.  Failing to do that, TCP may send out
         * segments which are outside receiver's window.  As TCP accepts
         * the ack in those retransmitted segments, if the window update in
         * the same segment is not accepted, TCP will incorrectly calculates
         * that it can send more segments.  This can create a deadlock
         * with the receiver if its window becomes zero.
         */
        if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
            SEQ_LT(tcp->tcp_swl1, seg_seq) ||
            (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
                /*
                 * The criteria for update is:
                 *
                 * 1. the segment acknowledges some data.  Or
                 * 2. the segment is new, i.e. it has a higher seq num. Or
                 * 3. the segment is not old and the advertised window is
                 * larger than the previous advertised window.
                 */
                if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
                        flags |= TH_XMIT_NEEDED;
                tcp->tcp_swnd = new_swnd;
                if (new_swnd > tcp->tcp_max_swnd)
                        tcp->tcp_max_swnd = new_swnd;
                tcp->tcp_swl1 = seg_seq;
                tcp->tcp_swl2 = seg_ack;
        }
est:
        if (tcp->tcp_state > TCPS_ESTABLISHED) {

                switch (tcp->tcp_state) {
                case TCPS_FIN_WAIT_1:
                        if (tcp->tcp_fin_acked) {
                                tcp->tcp_state = TCPS_FIN_WAIT_2;
                                DTRACE_TCP6(state__change, void, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa,
                                    void, NULL, tcp_t *, tcp, void, NULL,
                                    int32_t, TCPS_FIN_WAIT_1);
                                /*
                                 * We implement the non-standard BSD/SunOS
                                 * FIN_WAIT_2 flushing algorithm.
                                 * If there is no user attached to this
                                 * TCP endpoint, then this TCP struct
                                 * could hang around forever in FIN_WAIT_2
                                 * state if the peer forgets to send us
                                 * a FIN.  To prevent this, we wait only
                                 * 2*MSL (a convenient time value) for
                                 * the FIN to arrive.  If it doesn't show up,
                                 * we flush the TCP endpoint.  This algorithm,
                                 * though a violation of RFC-793, has worked
                                 * for over 10 years in BSD systems.
                                 * Note: SunOS 4.x waits 675 seconds before
                                 * flushing the FIN_WAIT_2 connection.
                                 */
                                TCP_TIMER_RESTART(tcp,
                                    tcp->tcp_fin_wait_2_flush_interval);
                        }
                        break;
                case TCPS_FIN_WAIT_2:
                        break;  /* Shutdown hook? */
                case TCPS_LAST_ACK:
                        freemsg(mp);
                        if (tcp->tcp_fin_acked) {
                                (void) tcp_clean_death(tcp, 0);
                                return;
                        }
                        goto xmit_check;
                case TCPS_CLOSING:
                        if (tcp->tcp_fin_acked) {
                                SET_TIME_WAIT(tcps, tcp, connp);
                                DTRACE_TCP6(state__change, void, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa, void,
                                    NULL, tcp_t *, tcp, void, NULL, int32_t,
                                    TCPS_CLOSING);
                        }
                        /*FALLTHRU*/
                case TCPS_CLOSE_WAIT:
                        freemsg(mp);
                        goto xmit_check;
                default:
                        ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
                        break;
                }
        }
        if (flags & TH_FIN) {
                /* Make sure we ack the fin */
                flags |= TH_ACK_NEEDED;
                if (!tcp->tcp_fin_rcvd) {
                        tcp->tcp_fin_rcvd = B_TRUE;
                        tcp->tcp_rnxt++;
                        tcpha = tcp->tcp_tcpha;
                        tcpha->tha_ack = htonl(tcp->tcp_rnxt);

                        /*
                         * Generate the ordrel_ind at the end unless the
                         * conn is detached or it is a STREAMS based eager.
                         * In the eager case we defer the notification until
                         * tcp_accept_finish has run.
                         */
                        if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
                            (tcp->tcp_listener == NULL &&
                            !tcp->tcp_hard_binding)))
                                flags |= TH_ORDREL_NEEDED;
                        switch (tcp->tcp_state) {
                        case TCPS_SYN_RCVD:
                                tcp->tcp_state = TCPS_CLOSE_WAIT;
                                DTRACE_TCP6(state__change, void, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa,
                                    void, NULL, tcp_t *, tcp, void, NULL,
                                    int32_t, TCPS_SYN_RCVD);
                                /* Keepalive? */
                                break;
                        case TCPS_ESTABLISHED:
                                tcp->tcp_state = TCPS_CLOSE_WAIT;
                                DTRACE_TCP6(state__change, void, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa,
                                    void, NULL, tcp_t *, tcp, void, NULL,
                                    int32_t, TCPS_ESTABLISHED);
                                /* Keepalive? */
                                break;
                        case TCPS_FIN_WAIT_1:
                                if (!tcp->tcp_fin_acked) {
                                        tcp->tcp_state = TCPS_CLOSING;
                                        DTRACE_TCP6(state__change, void, NULL,
                                            ip_xmit_attr_t *, connp->conn_ixa,
                                            void, NULL, tcp_t *, tcp, void,
                                            NULL, int32_t, TCPS_FIN_WAIT_1);
                                        break;
                                }
                                /* FALLTHRU */
                        case TCPS_FIN_WAIT_2:
                                SET_TIME_WAIT(tcps, tcp, connp);
                                DTRACE_TCP6(state__change, void, NULL,
                                    ip_xmit_attr_t *, connp->conn_ixa, void,
                                    NULL, tcp_t *, tcp, void, NULL, int32_t,
                                    TCPS_FIN_WAIT_2);
                                if (seg_len) {
                                        /*
                                         * implies data piggybacked on FIN.
                                         * break to handle data.
                                         */
                                        break;
                                }
                                freemsg(mp);
                                goto ack_check;
                        }
                }
        }
        if (mp == NULL)
                goto xmit_check;
        if (seg_len == 0) {
                freemsg(mp);
                goto xmit_check;
        }
        if (mp->b_rptr == mp->b_wptr) {
                /*
                 * The header has been consumed, so we remove the
                 * zero-length mblk here.
                 */
                mp1 = mp;
                mp = mp->b_cont;
                freeb(mp1);
        }
update_ack:
        tcpha = tcp->tcp_tcpha;
        tcp->tcp_rack_cnt++;
        {
                uint32_t cur_max;

                cur_max = tcp->tcp_rack_cur_max;
                if (tcp->tcp_rack_cnt >= cur_max) {
                        /*
                         * We have more unacked data than we should - send
                         * an ACK now.
                         */
                        flags |= TH_ACK_NEEDED;
                        cur_max++;
                        if (cur_max > tcp->tcp_rack_abs_max)
                                tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
                        else
                                tcp->tcp_rack_cur_max = cur_max;
                } else if (TCP_IS_DETACHED(tcp)) {
                        /* We don't have an ACK timer for detached TCP. */
                        flags |= TH_ACK_NEEDED;
                } else if (seg_len < mss) {
                        /*
                         * If we get a segment that is less than an mss, and we
                         * already have unacknowledged data, and the amount
                         * unacknowledged is not a multiple of mss, then we
                         * better generate an ACK now.  Otherwise, this may be
                         * the tail piece of a transaction, and we would rather
                         * wait for the response.
                         */
                        uint32_t udif;
                        ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
                            (uintptr_t)INT_MAX);
                        udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
                        if (udif && (udif % mss))
                                flags |= TH_ACK_NEEDED;
                        else
                                flags |= TH_ACK_TIMER_NEEDED;
                } else {
                        /* Start delayed ack timer */
                        flags |= TH_ACK_TIMER_NEEDED;
                }
        }
        tcp->tcp_rnxt += seg_len;
        tcpha->tha_ack = htonl(tcp->tcp_rnxt);

        if (mp == NULL)
                goto xmit_check;

        /* Update SACK list */
        if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
                tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
                    &(tcp->tcp_num_sack_blk));
        }

        if (tcp->tcp_urp_mp) {
                tcp->tcp_urp_mp->b_cont = mp;
                mp = tcp->tcp_urp_mp;
                tcp->tcp_urp_mp = NULL;
                /* Ready for a new signal. */
                tcp->tcp_urp_last_valid = B_FALSE;
#ifdef DEBUG
                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                    "tcp_rput: sending exdata_ind %s",
                    tcp_display(tcp, NULL, DISP_PORT_ONLY));
#endif /* DEBUG */
        }

        /*
         * Check for ancillary data changes compared to last segment.
         */
        if (connp->conn_recv_ancillary.crb_all != 0) {
                mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
                if (mp == NULL)
                        return;
        }

        if (IPCL_IS_NONSTR(connp)) {
                /*
                 * Non-STREAMS socket
                 */
                boolean_t push = flags & (TH_PUSH|TH_FIN);
                int error;

                if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
                    mp, seg_len, 0, &error, &push) <= 0) {
                        /*
                         * We should never be in middle of a
                         * fallback, the squeue guarantees that.
                         */
                        ASSERT(error != EOPNOTSUPP);
                        if (error == ENOSPC)
                                tcp->tcp_rwnd -= seg_len;
                } else if (push) {
                        /* PUSH bit set and sockfs is not flow controlled */
                        flags |= tcp_rwnd_reopen(tcp);
                }
        } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
                /*
                 * Side queue inbound data until the accept happens.
                 * tcp_accept/tcp_rput drains this when the accept happens.
                 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
                 * T_EXDATA_IND) it is queued on b_next.
                 * XXX Make urgent data use this. Requires:
                 *      Removing tcp_listener check for TH_URG
                 *      Making M_PCPROTO and MARK messages skip the eager case
                 */

                tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
        } else {
                /* Active STREAMS socket */
                if (mp->b_datap->db_type != M_DATA ||
                    (flags & TH_MARKNEXT_NEEDED)) {
                        if (tcp->tcp_rcv_list != NULL) {
                                flags |= tcp_rcv_drain(tcp);
                        }
                        ASSERT(tcp->tcp_rcv_list == NULL ||
                            tcp->tcp_fused_sigurg);

                        if (flags & TH_MARKNEXT_NEEDED) {
#ifdef DEBUG
                                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                                    "tcp_rput: sending MSGMARKNEXT %s",
                                    tcp_display(tcp, NULL,
                                    DISP_PORT_ONLY));
#endif /* DEBUG */
                                mp->b_flag |= MSGMARKNEXT;
                                flags &= ~TH_MARKNEXT_NEEDED;
                        }

                        putnext(connp->conn_rq, mp);
                        if (!canputnext(connp->conn_rq))
                                tcp->tcp_rwnd -= seg_len;
                } else if ((flags & (TH_PUSH|TH_FIN)) ||
                    tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
                        if (tcp->tcp_rcv_list != NULL) {
                                /*
                                 * Enqueue the new segment first and then
                                 * call tcp_rcv_drain() to send all data
                                 * up.  The other way to do this is to
                                 * send all queued data up and then call
                                 * putnext() to send the new segment up.
                                 * This way can remove the else part later
                                 * on.
                                 *
                                 * We don't do this to avoid one more call to
                                 * canputnext() as tcp_rcv_drain() needs to
                                 * call canputnext().
                                 */
                                tcp_rcv_enqueue(tcp, mp, seg_len,
                                    ira->ira_cred);
                                flags |= tcp_rcv_drain(tcp);
                        } else {
                                putnext(connp->conn_rq, mp);
                                if (!canputnext(connp->conn_rq))
                                        tcp->tcp_rwnd -= seg_len;
                        }
                } else {
                        /*
                         * Enqueue all packets when processing an mblk
                         * from the co queue and also enqueue normal packets.
                         */
                        tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
                }
                /*
                 * Make sure the timer is running if we have data waiting
                 * for a push bit. This provides resiliency against
                 * implementations that do not correctly generate push bits.
                 */
                if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
                        /*
                         * The connection may be closed at this point, so don't
                         * do anything for a detached tcp.
                         */
                        if (!TCP_IS_DETACHED(tcp))
                                tcp->tcp_push_tid = TCP_TIMER(tcp,
                                    tcp_push_timer,
                                    tcps->tcps_push_timer_interval);
                }
        }

xmit_check:
        /* Is there anything left to do? */
        ASSERT(!(flags & TH_MARKNEXT_NEEDED));
        if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
            TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
            TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
                goto done;

        /* Any transmit work to do and a non-zero window? */
        if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
            TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
                if (flags & TH_REXMIT_NEEDED) {
                        uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;

                        TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
                        if (snd_size > mss)
                                snd_size = mss;
                        if (snd_size > tcp->tcp_swnd)
                                snd_size = tcp->tcp_swnd;
                        mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
                            NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
                            B_TRUE);

                        if (mp1 != NULL) {
                                tcp->tcp_xmit_head->b_prev =
                                    (mblk_t *)LBOLT_FASTPATH;
                                tcp->tcp_csuna = tcp->tcp_snxt;
                                TCPS_BUMP_MIB(tcps, tcpRetransSegs);
                                TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
                                    snd_size);
                                tcp_send_data(tcp, mp1);
                        }
                }
                if (flags & TH_NEED_SACK_REXMIT) {
                        tcp_sack_rexmit(tcp, &flags);
                }
                /*
                 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
                 * out new segment.  Note that tcp_rexmit should not be
                 * set, otherwise TH_LIMIT_XMIT should not be set.
                 */
                if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
                        if (!tcp->tcp_rexmit) {
                                tcp_wput_data(tcp, NULL, B_FALSE);
                        } else {
                                tcp_ss_rexmit(tcp);
                        }
                }
                /*
                 * Adjust tcp_cwnd back to normal value after sending
                 * new data segments.
                 */
                if (flags & TH_LIMIT_XMIT) {
                        tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
                        /*
                         * This will restart the timer.  Restarting the
                         * timer is used to avoid a timeout before the
                         * limited transmitted segment's ACK gets back.
                         */
                        if (tcp->tcp_xmit_head != NULL)
                                tcp->tcp_xmit_head->b_prev =
                                    (mblk_t *)LBOLT_FASTPATH;
                }

                /* Anything more to do? */
                if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
                    TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
                        goto done;
        }
ack_check:
        if (flags & TH_SEND_URP_MARK) {
                ASSERT(tcp->tcp_urp_mark_mp);
                ASSERT(!IPCL_IS_NONSTR(connp));
                /*
                 * Send up any queued data and then send the mark message
                 */
                if (tcp->tcp_rcv_list != NULL) {
                        flags |= tcp_rcv_drain(tcp);

                }
                ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
                mp1 = tcp->tcp_urp_mark_mp;
                tcp->tcp_urp_mark_mp = NULL;

                putnext(connp->conn_rq, mp1);
#ifdef DEBUG
                (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
                    "tcp_rput: sending zero-length %s %s",
                    ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
                    "MSGNOTMARKNEXT"),
                    tcp_display(tcp, NULL, DISP_PORT_ONLY));
#endif /* DEBUG */
                flags &= ~TH_SEND_URP_MARK;
        }
        if (flags & TH_ACK_NEEDED) {
                /*
                 * Time to send an ack for some reason.
                 */
                mp1 = tcp_ack_mp(tcp);

                if (mp1 != NULL) {
                        tcp_send_data(tcp, mp1);
                        BUMP_LOCAL(tcp->tcp_obsegs);
                        TCPS_BUMP_MIB(tcps, tcpOutAck);
                }
                if (tcp->tcp_ack_tid != 0) {
                        (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
                        tcp->tcp_ack_tid = 0;
                }
        }
        if (flags & TH_ACK_TIMER_NEEDED) {
                /*
                 * Arrange for deferred ACK or push wait timeout.
                 * Start timer if it is not already running.
                 */
                if (tcp->tcp_ack_tid == 0) {
                        tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
                            tcp->tcp_localnet ?
                            tcps->tcps_local_dack_interval :
                            tcps->tcps_deferred_ack_interval);
                }
        }
        if (flags & TH_ORDREL_NEEDED) {
                /*
                 * Notify upper layer about an orderly release. If this is
                 * a non-STREAMS socket, then just make an upcall. For STREAMS
                 * we send up an ordrel_ind, unless this is an eager, in which
                 * case the ordrel will be sent when tcp_accept_finish runs.
                 * Note that for non-STREAMS we make an upcall even if it is an
                 * eager, because we have an upper handle to send it to.
                 */
                ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
                ASSERT(!tcp->tcp_detached);

                if (IPCL_IS_NONSTR(connp)) {
                        ASSERT(tcp->tcp_ordrel_mp == NULL);
                        tcp->tcp_ordrel_done = B_TRUE;
                        (*sockupcalls->su_opctl)(connp->conn_upper_handle,
                            SOCK_OPCTL_SHUT_RECV, 0);
                        goto done;
                }

                if (tcp->tcp_rcv_list != NULL) {
                        /*
                         * Push any mblk(s) enqueued from co processing.
                         */
                        flags |= tcp_rcv_drain(tcp);
                }
                ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);

                mp1 = tcp->tcp_ordrel_mp;
                tcp->tcp_ordrel_mp = NULL;
                tcp->tcp_ordrel_done = B_TRUE;
                putnext(connp->conn_rq, mp1);
        }
done:
        ASSERT(!(flags & TH_MARKNEXT_NEEDED));
}

/*
 * Attach ancillary data to a received TCP segments for the
 * ancillary pieces requested by the application that are
 * different than they were in the previous data segment.
 *
 * Save the "current" values once memory allocation is ok so that
 * when memory allocation fails we can just wait for the next data segment.
 */
static mblk_t *
tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
    ip_recv_attr_t *ira)
{
        struct T_optdata_ind *todi;
        int optlen;
        uchar_t *optptr;
        struct T_opthdr *toh;
        crb_t addflag;  /* Which pieces to add */
        mblk_t *mp1;
        conn_t  *connp = tcp->tcp_connp;

        optlen = 0;
        addflag.crb_all = 0;
        /* If app asked for pktinfo and the index has changed ... */
        if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
            ira->ira_ruifindex != tcp->tcp_recvifindex) {
                optlen += sizeof (struct T_opthdr) +
                    sizeof (struct in6_pktinfo);
                addflag.crb_ip_recvpktinfo = 1;
        }
        /* If app asked for hoplimit and it has changed ... */
        if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
            ipp->ipp_hoplimit != tcp->tcp_recvhops) {
                optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
                addflag.crb_ipv6_recvhoplimit = 1;
        }
        /* If app asked for tclass and it has changed ... */
        if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
            ipp->ipp_tclass != tcp->tcp_recvtclass) {
                optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
                addflag.crb_ipv6_recvtclass = 1;
        }
        /*
         * If app asked for hopbyhop headers and it has changed ...
         */
        if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
            ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
            (ipp->ipp_fields & IPPF_HOPOPTS),
            ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
                optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
                addflag.crb_ipv6_recvhopopts = 1;
                if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
                    &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
                    ipp->ipp_hopopts, ipp->ipp_hopoptslen))
                        return (mp);
        }
        /* If app asked for dst headers before routing headers ... */
        if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
            ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
            (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
            ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
                optlen += sizeof (struct T_opthdr) +
                    ipp->ipp_rthdrdstoptslen;
                addflag.crb_ipv6_recvrthdrdstopts = 1;
                if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
                    &tcp->tcp_rthdrdstoptslen,
                    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
                    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
                        return (mp);
        }
        /* If app asked for routing headers and it has changed ... */
        if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
            ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
            (ipp->ipp_fields & IPPF_RTHDR),
            ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
                optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
                addflag.crb_ipv6_recvrthdr = 1;
                if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
                    &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
                    ipp->ipp_rthdr, ipp->ipp_rthdrlen))
                        return (mp);
        }
        /* If app asked for dest headers and it has changed ... */
        if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
            connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
            ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
            (ipp->ipp_fields & IPPF_DSTOPTS),
            ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
                optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
                addflag.crb_ipv6_recvdstopts = 1;
                if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
                    &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
                    ipp->ipp_dstopts, ipp->ipp_dstoptslen))
                        return (mp);
        }

        if (optlen == 0) {
                /* Nothing to add */
                return (mp);
        }
        mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
        if (mp1 == NULL) {
                /*
                 * Defer sending ancillary data until the next TCP segment
                 * arrives.
                 */
                return (mp);
        }
        mp1->b_cont = mp;
        mp = mp1;
        mp->b_wptr += sizeof (*todi) + optlen;
        mp->b_datap->db_type = M_PROTO;
        todi = (struct T_optdata_ind *)mp->b_rptr;
        todi->PRIM_type = T_OPTDATA_IND;
        todi->DATA_flag = 1;    /* MORE data */
        todi->OPT_length = optlen;
        todi->OPT_offset = sizeof (*todi);
        optptr = (uchar_t *)&todi[1];
        /*
         * If app asked for pktinfo and the index has changed ...
         * Note that the local address never changes for the connection.
         */
        if (addflag.crb_ip_recvpktinfo) {
                struct in6_pktinfo *pkti;
                uint_t ifindex;

                ifindex = ira->ira_ruifindex;
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_PKTINFO;
                toh->len = sizeof (*toh) + sizeof (*pkti);
                toh->status = 0;
                optptr += sizeof (*toh);
                pkti = (struct in6_pktinfo *)optptr;
                pkti->ipi6_addr = connp->conn_laddr_v6;
                pkti->ipi6_ifindex = ifindex;
                optptr += sizeof (*pkti);
                ASSERT(OK_32PTR(optptr));
                /* Save as "last" value */
                tcp->tcp_recvifindex = ifindex;
        }
        /* If app asked for hoplimit and it has changed ... */
        if (addflag.crb_ipv6_recvhoplimit) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_HOPLIMIT;
                toh->len = sizeof (*toh) + sizeof (uint_t);
                toh->status = 0;
                optptr += sizeof (*toh);
                *(uint_t *)optptr = ipp->ipp_hoplimit;
                optptr += sizeof (uint_t);
                ASSERT(OK_32PTR(optptr));
                /* Save as "last" value */
                tcp->tcp_recvhops = ipp->ipp_hoplimit;
        }
        /* If app asked for tclass and it has changed ... */
        if (addflag.crb_ipv6_recvtclass) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_TCLASS;
                toh->len = sizeof (*toh) + sizeof (uint_t);
                toh->status = 0;
                optptr += sizeof (*toh);
                *(uint_t *)optptr = ipp->ipp_tclass;
                optptr += sizeof (uint_t);
                ASSERT(OK_32PTR(optptr));
                /* Save as "last" value */
                tcp->tcp_recvtclass = ipp->ipp_tclass;
        }
        if (addflag.crb_ipv6_recvhopopts) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_HOPOPTS;
                toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
                toh->status = 0;
                optptr += sizeof (*toh);
                bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
                optptr += ipp->ipp_hopoptslen;
                ASSERT(OK_32PTR(optptr));
                /* Save as last value */
                ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
                    (ipp->ipp_fields & IPPF_HOPOPTS),
                    ipp->ipp_hopopts, ipp->ipp_hopoptslen);
        }
        if (addflag.crb_ipv6_recvrthdrdstopts) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_RTHDRDSTOPTS;
                toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
                toh->status = 0;
                optptr += sizeof (*toh);
                bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
                optptr += ipp->ipp_rthdrdstoptslen;
                ASSERT(OK_32PTR(optptr));
                /* Save as last value */
                ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
                    &tcp->tcp_rthdrdstoptslen,
                    (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
                    ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
        }
        if (addflag.crb_ipv6_recvrthdr) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_RTHDR;
                toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
                toh->status = 0;
                optptr += sizeof (*toh);
                bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
                optptr += ipp->ipp_rthdrlen;
                ASSERT(OK_32PTR(optptr));
                /* Save as last value */
                ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
                    (ipp->ipp_fields & IPPF_RTHDR),
                    ipp->ipp_rthdr, ipp->ipp_rthdrlen);
        }
        if (addflag.crb_ipv6_recvdstopts) {
                toh = (struct T_opthdr *)optptr;
                toh->level = IPPROTO_IPV6;
                toh->name = IPV6_DSTOPTS;
                toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
                toh->status = 0;
                optptr += sizeof (*toh);
                bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
                optptr += ipp->ipp_dstoptslen;
                ASSERT(OK_32PTR(optptr));
                /* Save as last value */
                ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
                    (ipp->ipp_fields & IPPF_DSTOPTS),
                    ipp->ipp_dstopts, ipp->ipp_dstoptslen);
        }
        ASSERT(optptr == mp->b_wptr);
        return (mp);
}

/* The minimum of smoothed mean deviation in RTO calculation. */
#define TCP_SD_MIN      400

/*
 * Set RTO for this connection.  The formula is from Jacobson and Karels'
 * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
 * are the same as those in Appendix A.2 of that paper.
 *
 * m = new measurement
 * sa = smoothed RTT average (8 * average estimates).
 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
 */
static void
tcp_set_rto(tcp_t *tcp, clock_t rtt)
{
        long m = TICK_TO_MSEC(rtt);
        clock_t sa = tcp->tcp_rtt_sa;
        clock_t sv = tcp->tcp_rtt_sd;
        clock_t rto;
        tcp_stack_t     *tcps = tcp->tcp_tcps;

        TCPS_BUMP_MIB(tcps, tcpRttUpdate);
        tcp->tcp_rtt_update++;

        /* tcp_rtt_sa is not 0 means this is a new sample. */
        if (sa != 0) {
                /*
                 * Update average estimator:
                 *      new rtt = 7/8 old rtt + 1/8 Error
                 */

                /* m is now Error in estimate. */
                m -= sa >> 3;
                if ((sa += m) <= 0) {
                        /*
                         * Don't allow the smoothed average to be negative.
                         * We use 0 to denote reinitialization of the
                         * variables.
                         */
                        sa = 1;
                }

                /*
                 * Update deviation estimator:
                 *      new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
                 */
                if (m < 0)
                        m = -m;
                m -= sv >> 2;
                sv += m;
        } else {
                /*
                 * This follows BSD's implementation.  So the reinitialized
                 * RTO is 3 * m.  We cannot go less than 2 because if the
                 * link is bandwidth dominated, doubling the window size
                 * during slow start means doubling the RTT.  We want to be
                 * more conservative when we reinitialize our estimates.  3
                 * is just a convenient number.
                 */
                sa = m << 3;
                sv = m << 1;
        }
        if (sv < TCP_SD_MIN) {
                /*
                 * We do not know that if sa captures the delay ACK
                 * effect as in a long train of segments, a receiver
                 * does not delay its ACKs.  So set the minimum of sv
                 * to be TCP_SD_MIN, which is default to 400 ms, twice
                 * of BSD DATO.  That means the minimum of mean
                 * deviation is 100 ms.
                 *
                 */
                sv = TCP_SD_MIN;
        }
        tcp->tcp_rtt_sa = sa;
        tcp->tcp_rtt_sd = sv;
        /*
         * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
         *
         * Add tcp_rexmit_interval extra in case of extreme environment
         * where the algorithm fails to work.  The default value of
         * tcp_rexmit_interval_extra should be 0.
         *
         * As we use a finer grained clock than BSD and update
         * RTO for every ACKs, add in another .25 of RTT to the
         * deviation of RTO to accomodate burstiness of 1/4 of
         * window size.
         */
        rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);

        TCP_SET_RTO(tcp, rto);

        /* Now, we can reset tcp_timer_backoff to use the new RTO... */
        tcp->tcp_timer_backoff = 0;
}

uint_t
tcp_rwnd_reopen(tcp_t *tcp)
{
        uint_t ret = 0;
        uint_t thwin;
        conn_t *connp = tcp->tcp_connp;

        /* Learn the latest rwnd information that we sent to the other side. */
        thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
            << tcp->tcp_rcv_ws;
        /* This is peer's calculated send window (our receive window). */
        thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
        /*
         * Increase the receive window to max.  But we need to do receiver
         * SWS avoidance.  This means that we need to check the increase of
         * of receive window is at least 1 MSS.
         */
        if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
                /*
                 * If the window that the other side knows is less than max
                 * deferred acks segments, send an update immediately.
                 */
                if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
                        TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
                        ret = TH_ACK_NEEDED;
                }
                tcp->tcp_rwnd = connp->conn_rcvbuf;
        }
        return (ret);
}

/*
 * Handle a packet that has been reclassified by TCP.
 * This function drops the ref on connp that the caller had.
 */
void
tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
{
        ipsec_stack_t   *ipss = ipst->ips_netstack->netstack_ipsec;

        if (connp->conn_incoming_ifindex != 0 &&
            connp->conn_incoming_ifindex != ira->ira_ruifindex) {
                freemsg(mp);
                CONN_DEC_REF(connp);
                return;
        }

        if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
            (ira->ira_flags & IRAF_IPSEC_SECURE)) {
                ip6_t *ip6h;
                ipha_t *ipha;

                if (ira->ira_flags & IRAF_IS_IPV4) {
                        ipha = (ipha_t *)mp->b_rptr;
                        ip6h = NULL;
                } else {
                        ipha = NULL;
                        ip6h = (ip6_t *)mp->b_rptr;
                }
                mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
                if (mp == NULL) {
                        BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
                        /* Note that mp is NULL */
                        ip_drop_input("ipIfStatsInDiscards", mp, NULL);
                        CONN_DEC_REF(connp);
                        return;
                }
        }

        if (IPCL_IS_TCP(connp)) {
                /*
                 * do not drain, certain use cases can blow
                 * the stack
                 */
                SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
                    connp->conn_recv, connp, ira,
                    SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
        } else {
                /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
                (connp->conn_recv)(connp, mp, NULL,
                    ira);
                CONN_DEC_REF(connp);
        }

}

/* ARGSUSED */
static void
tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
{
        conn_t  *connp = (conn_t *)arg;
        tcp_t   *tcp = connp->conn_tcp;
        queue_t *q = connp->conn_rq;

        ASSERT(!IPCL_IS_NONSTR(connp));
        mutex_enter(&tcp->tcp_rsrv_mp_lock);
        tcp->tcp_rsrv_mp = mp;
        mutex_exit(&tcp->tcp_rsrv_mp_lock);

        if (TCP_IS_DETACHED(tcp) || q == NULL) {
                return;
        }

        if (tcp->tcp_fused) {
                tcp_fuse_backenable(tcp);
                return;
        }

        if (canputnext(q)) {
                /* Not flow-controlled, open rwnd */
                tcp->tcp_rwnd = connp->conn_rcvbuf;

                /*
                 * Send back a window update immediately if TCP is above
                 * ESTABLISHED state and the increase of the rcv window
                 * that the other side knows is at least 1 MSS after flow
                 * control is lifted.
                 */
                if (tcp->tcp_state >= TCPS_ESTABLISHED &&
                    tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
                        tcp_xmit_ctl(NULL, tcp,
                            (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
                            tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
                }
        }
}

/*
 * The read side service routine is called mostly when we get back-enabled as a
 * result of flow control relief.  Since we don't actually queue anything in
 * TCP, we have no data to send out of here.  What we do is clear the receive
 * window, and send out a window update.
 */
void
tcp_rsrv(queue_t *q)
{
        conn_t          *connp = Q_TO_CONN(q);
        tcp_t           *tcp = connp->conn_tcp;
        mblk_t          *mp;

        /* No code does a putq on the read side */
        ASSERT(q->q_first == NULL);

        /*
         * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
         * been run.  So just return.
         */
        mutex_enter(&tcp->tcp_rsrv_mp_lock);
        if ((mp = tcp->tcp_rsrv_mp) == NULL) {
                mutex_exit(&tcp->tcp_rsrv_mp_lock);
                return;
        }
        tcp->tcp_rsrv_mp = NULL;
        mutex_exit(&tcp->tcp_rsrv_mp_lock);

        CONN_INC_REF(connp);
        SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
            NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
}

/* At minimum we need 8 bytes in the TCP header for the lookup */
#define ICMP_MIN_TCP_HDR        8

/*
 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
 * passed up by IP. The message is always received on the correct tcp_t.
 * Assumes that IP has pulled up everything up to and including the ICMP header.
 */
/* ARGSUSED2 */
void
tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
{
        conn_t          *connp = (conn_t *)arg1;
        icmph_t         *icmph;
        ipha_t          *ipha;
        int             iph_hdr_length;
        tcpha_t         *tcpha;
        uint32_t        seg_seq;
        tcp_t           *tcp = connp->conn_tcp;

        /* Assume IP provides aligned packets */
        ASSERT(OK_32PTR(mp->b_rptr));
        ASSERT((MBLKL(mp) >= sizeof (ipha_t)));

        /*
         * It's possible we have a closed, but not yet destroyed, TCP
         * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
         * in the closed state, so don't take any chances and drop the packet.
         */
        if (tcp->tcp_state == TCPS_CLOSED) {
                freemsg(mp);
                return;
        }

        /*
         * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
         * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
         */
        if (!(ira->ira_flags & IRAF_IS_IPV4)) {
                tcp_icmp_error_ipv6(tcp, mp, ira);
                return;
        }

        /* Skip past the outer IP and ICMP headers */
        iph_hdr_length = ira->ira_ip_hdr_length;
        icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
        /*
         * If we don't have the correct outer IP header length
         * or if we don't have a complete inner IP header
         * drop it.
         */
        if (iph_hdr_length < sizeof (ipha_t) ||
            (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
noticmpv4:
                freemsg(mp);
                return;
        }
        ipha = (ipha_t *)&icmph[1];

        /* Skip past the inner IP and find the ULP header */
        iph_hdr_length = IPH_HDR_LENGTH(ipha);
        tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
        /*
         * If we don't have the correct inner IP header length or if the ULP
         * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
         * bytes of TCP header, drop it.
         */
        if (iph_hdr_length < sizeof (ipha_t) ||
            ipha->ipha_protocol != IPPROTO_TCP ||
            (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
                goto noticmpv4;
        }

        seg_seq = ntohl(tcpha->tha_seq);
        switch (icmph->icmph_type) {
        case ICMP_DEST_UNREACHABLE:
                switch (icmph->icmph_code) {
                case ICMP_FRAGMENTATION_NEEDED:
                        /*
                         * Update Path MTU, then try to send something out.
                         */
                        tcp_update_pmtu(tcp, B_TRUE);
                        tcp_rexmit_after_error(tcp);
                        break;
                case ICMP_PORT_UNREACHABLE:
                case ICMP_PROTOCOL_UNREACHABLE:
                        switch (tcp->tcp_state) {
                        case TCPS_SYN_SENT:
                        case TCPS_SYN_RCVD:
                                /*
                                 * ICMP can snipe away incipient
                                 * TCP connections as long as
                                 * seq number is same as initial
                                 * send seq number.
                                 */
                                if (seg_seq == tcp->tcp_iss) {
                                        (void) tcp_clean_death(tcp,
                                            ECONNREFUSED);
                                }
                                break;
                        }
                        break;
                case ICMP_HOST_UNREACHABLE:
                case ICMP_NET_UNREACHABLE:
                        /* Record the error in case we finally time out. */
                        if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
                                tcp->tcp_client_errno = EHOSTUNREACH;
                        else
                                tcp->tcp_client_errno = ENETUNREACH;
                        if (tcp->tcp_state == TCPS_SYN_RCVD) {
                                if (tcp->tcp_listener != NULL &&
                                    tcp->tcp_listener->tcp_syn_defense) {
                                        /*
                                         * Ditch the half-open connection if we
                                         * suspect a SYN attack is under way.
                                         */
                                        (void) tcp_clean_death(tcp,
                                            tcp->tcp_client_errno);
                                }
                        }
                        break;
                default:
                        break;
                }
                break;
        case ICMP_SOURCE_QUENCH: {
                /*
                 * use a global boolean to control
                 * whether TCP should respond to ICMP_SOURCE_QUENCH.
                 * The default is false.
                 */
                if (tcp_icmp_source_quench) {
                        /*
                         * Reduce the sending rate as if we got a
                         * retransmit timeout
                         */
                        uint32_t npkt;

                        npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
                            tcp->tcp_mss;
                        tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
                        tcp->tcp_cwnd = tcp->tcp_mss;
                        tcp->tcp_cwnd_cnt = 0;
                }
                break;
        }
        }
        freemsg(mp);
}

/*
 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
 * error messages passed up by IP.
 * Assumes that IP has pulled up all the extension headers as well
 * as the ICMPv6 header.
 */
static void
tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
{
        icmp6_t         *icmp6;
        ip6_t           *ip6h;
        uint16_t        iph_hdr_length = ira->ira_ip_hdr_length;
        tcpha_t         *tcpha;
        uint8_t         *nexthdrp;
        uint32_t        seg_seq;

        /*
         * Verify that we have a complete IP header.
         */
        ASSERT((MBLKL(mp) >= sizeof (ip6_t)));

        icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
        ip6h = (ip6_t *)&icmp6[1];
        /*
         * Verify if we have a complete ICMP and inner IP header.
         */
        if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
noticmpv6:
                freemsg(mp);
                return;
        }

        if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
                goto noticmpv6;
        tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
        /*
         * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
         * have at least ICMP_MIN_TCP_HDR bytes of  TCP header drop the
         * packet.
         */
        if ((*nexthdrp != IPPROTO_TCP) ||
            ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
                goto noticmpv6;
        }

        seg_seq = ntohl(tcpha->tha_seq);
        switch (icmp6->icmp6_type) {
        case ICMP6_PACKET_TOO_BIG:
                /*
                 * Update Path MTU, then try to send something out.
                 */
                tcp_update_pmtu(tcp, B_TRUE);
                tcp_rexmit_after_error(tcp);
                break;
        case ICMP6_DST_UNREACH:
                switch (icmp6->icmp6_code) {
                case ICMP6_DST_UNREACH_NOPORT:
                        if (((tcp->tcp_state == TCPS_SYN_SENT) ||
                            (tcp->tcp_state == TCPS_SYN_RCVD)) &&
                            (seg_seq == tcp->tcp_iss)) {
                                (void) tcp_clean_death(tcp, ECONNREFUSED);
                        }
                        break;
                case ICMP6_DST_UNREACH_ADMIN:
                case ICMP6_DST_UNREACH_NOROUTE:
                case ICMP6_DST_UNREACH_BEYONDSCOPE:
                case ICMP6_DST_UNREACH_ADDR:
                        /* Record the error in case we finally time out. */
                        tcp->tcp_client_errno = EHOSTUNREACH;
                        if (((tcp->tcp_state == TCPS_SYN_SENT) ||
                            (tcp->tcp_state == TCPS_SYN_RCVD)) &&
                            (seg_seq == tcp->tcp_iss)) {
                                if (tcp->tcp_listener != NULL &&
                                    tcp->tcp_listener->tcp_syn_defense) {
                                        /*
                                         * Ditch the half-open connection if we
                                         * suspect a SYN attack is under way.
                                         */
                                        (void) tcp_clean_death(tcp,
                                            tcp->tcp_client_errno);
                                }
                        }


                        break;
                default:
                        break;
                }
                break;
        case ICMP6_PARAM_PROB:
                /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
                if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
                    (uchar_t *)ip6h + icmp6->icmp6_pptr ==
                    (uchar_t *)nexthdrp) {
                        if (tcp->tcp_state == TCPS_SYN_SENT ||
                            tcp->tcp_state == TCPS_SYN_RCVD) {
                                (void) tcp_clean_death(tcp, ECONNREFUSED);
                        }
                        break;
                }
                break;

        case ICMP6_TIME_EXCEEDED:
        default:
                break;
        }
        freemsg(mp);
}

/*
 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
 * change. But it can refer to fields like tcp_suna and tcp_snxt.
 *
 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
 * error messages received by IP. The message is always received on the correct
 * tcp_t.
 */
/* ARGSUSED */
boolean_t
tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
    ip_recv_attr_t *ira)
{
        tcpha_t         *tcpha = (tcpha_t *)arg2;
        uint32_t        seq = ntohl(tcpha->tha_seq);
        tcp_t           *tcp = connp->conn_tcp;

        /*
         * TCP sequence number contained in payload of the ICMP error message
         * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
         * the message is either a stale ICMP error, or an attack from the
         * network. Fail the verification.
         */
        if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
                return (B_FALSE);

        /* For "too big" we also check the ignore flag */
        if (ira->ira_flags & IRAF_IS_IPV4) {
                ASSERT(icmph != NULL);
                if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
                    icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
                    tcp->tcp_tcps->tcps_ignore_path_mtu)
                        return (B_FALSE);
        } else {
                ASSERT(icmp6 != NULL);
                if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
                    tcp->tcp_tcps->tcps_ignore_path_mtu)
                        return (B_FALSE);
        }
        return (B_TRUE);
}