Introduce a syncache, which enables FreeBSD to withstand a SYN flood

DoS in an improved fashion over the existing code.

Reviewed by: silby  (in a previous iteration)
Sponsored by: DARPA, NAI Labs

13 files changed, 1912 insertions, 1068 deletions

diff --git a/sys/conf/files b/sys/conf/files
index e63074c..abe4bdb 100644
--- a/sys/conf/files
+++ b/sys/conf/files
@@ -1091,6 +1091,7 @@ netinet/tcp_debug.c	optional tcpdebug
 netinet/tcp_input.c	optional inet
 netinet/tcp_output.c	optional inet
 netinet/tcp_subr.c	optional inet
+netinet/tcp_syncache.c	optional inet
 netinet/tcp_timer.c	optional inet
 netinet/tcp_usrreq.c	optional inet
 netinet/udp_usrreq.c	optional inet
diff --git a/sys/net/route.h b/sys/net/route.h
index 1a38ceb..d4de208 100644
--- a/sys/net/route.h
+++ b/sys/net/route.h
@@ -139,7 +139,7 @@ struct ortentry {
 #define	RTF_DYNAMIC	0x10		/* created dynamically (by redirect) */
 #define	RTF_MODIFIED	0x20		/* modified dynamically (by redirect) */
 #define RTF_DONE	0x40		/* message confirmed */
-#define RTF_DELCLONE	0x80		/* delete cloned route */
+/*			0x80		   unused, was RTF_DELCLONE */
 #define RTF_CLONING	0x100		/* generate new routes on use */
 #define RTF_XRESOLVE	0x200		/* external daemon resolves name */
 #define RTF_LLINFO	0x400		/* generated by link layer (e.g. ARP) */
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 4fecd6a..41987af 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -555,7 +555,6 @@ in_pcbdetach(inp)
 {
 	struct socket *so = inp->inp_socket;
 	struct inpcbinfo *ipi = inp->inp_pcbinfo;
-	struct rtentry *rt  = inp->inp_route.ro_rt;
 
 #ifdef IPSEC
 	ipsec4_delete_pcbpolicy(inp);
@@ -566,22 +565,8 @@ in_pcbdetach(inp)
 	sotryfree(so);
 	if (inp->inp_options)
 		(void)m_free(inp->inp_options);
-	if (rt) {
-		/* 
-		 * route deletion requires reference count to be <= zero 
-		 */
-		if ((rt->rt_flags & RTF_DELCLONE) &&
-		    (rt->rt_flags & RTF_WASCLONED) &&
-		    (rt->rt_refcnt <= 1)) {
-			rt->rt_refcnt--;
-			rt->rt_flags &= ~RTF_UP;
-			rtrequest(RTM_DELETE, rt_key(rt),
-				  rt->rt_gateway, rt_mask(rt),
-				  rt->rt_flags, (struct rtentry **)0);
-		}
-		else
-			rtfree(rt);
-	}
+	if (inp->inp_route.ro_rt)
+		rtfree(inp->inp_route.ro_rt);
 	ip_freemoptions(inp->inp_moptions);
 	inp->inp_vflag = 0;
 	zfree(ipi->ipi_zone, inp);
diff --git a/sys/netinet/in_pcb.h b/sys/netinet/in_pcb.h
index 8423462..eb1ac3d 100644
--- a/sys/netinet/in_pcb.h
+++ b/sys/netinet/in_pcb.h
@@ -39,7 +39,6 @@
 
 #include <sys/queue.h>
 
-
 #include <netinet6/ipsec.h> /* for IPSEC */
 
 #define	in6pcb		inpcb	/* for KAME src sync over BSD*'s */
@@ -67,6 +66,58 @@ struct in_addr_4in6 {
 };
 
 /*
+ * NOTE: ipv6 addrs should be 64-bit aligned, per RFC 2553.
+ * in_conninfo has some extra padding to accomplish this.
+ */
+struct in_endpoints {
+	u_int16_t	ie_fport;		/* foreign port */
+	u_int16_t	ie_lport;		/* local port */
+	/* protocol dependent part, local and foreign addr */
+	union {
+		/* foreign host table entry */
+		struct	in_addr_4in6 ie46_foreign;
+		struct	in6_addr ie6_foreign;
+	} ie_dependfaddr;
+	union {
+		/* local host table entry */
+		struct	in_addr_4in6 ie46_local;
+		struct	in6_addr ie6_local;
+	} ie_dependladdr;
+#define	ie_faddr	ie_dependfaddr.ie46_foreign.ia46_addr4
+#define	ie_laddr	ie_dependladdr.ie46_local.ia46_addr4
+#define	ie6_faddr	ie_dependfaddr.ie6_foreign
+#define	ie6_laddr	ie_dependladdr.ie6_local
+};
+
+/*
+ * XXX
+ * At some point struct route should possibly change to:
+ *   struct rtentry *rt
+ *   struct in_endpoints *ie; 
+ */
+struct in_conninfo {
+	u_int8_t	inc_flags;
+	u_int8_t	inc_len;
+	u_int16_t	inc_pad;	/* XXX alignment for in_endpoints */
+	/* protocol dependent part; cached route */
+	struct	in_endpoints inc_ie;
+	union {
+		/* placeholder for routing entry */
+		struct	route inc4_route;
+		struct	route_in6 inc6_route;
+	} inc_dependroute;
+};
+#define inc_isipv6	inc_flags	/* temp compatability */
+#define	inc_fport	inc_ie.ie_fport
+#define	inc_lport	inc_ie.ie_lport
+#define	inc_faddr	inc_ie.ie_faddr
+#define	inc_laddr	inc_ie.ie_laddr
+#define	inc_route	inc_dependroute.inc4_route
+#define	inc6_faddr	inc_ie.ie6_faddr
+#define	inc6_laddr	inc_ie.ie6_laddr
+#define	inc6_route	inc_dependroute.inc6_route
+
+/*
  * NB: the zone allocator is type-stable EXCEPT FOR THE FIRST TWO LONGS
  * of the structure.  Therefore, it is important that the members in
  * that position not contain any information which is required to be
@@ -76,22 +127,11 @@ struct	icmp6_filter;
 
 struct inpcb {
 	LIST_ENTRY(inpcb) inp_hash; /* hash list */
-	u_short	inp_fport;		/* foreign port */
-	u_short	inp_lport;		/* local port */
 	LIST_ENTRY(inpcb) inp_list; /* list for all PCBs of this proto */
 	u_int32_t	inp_flow;
 
-	/* protocol dependent part, local and foreign addr */
-	union {
-		/* foreign host table entry */
-		struct	in_addr_4in6 inp46_foreign;
-		struct	in6_addr inp6_foreign;
-	} inp_dependfaddr;
-	union {
-		/* local host table entry */
-		struct	in_addr_4in6 inp46_local;
-		struct	in6_addr inp6_local;
-	} inp_dependladdr;
+	/* local and foreign ports, local and foreign addr */
+	struct	in_conninfo inp_inc;
 
 	caddr_t	inp_ppcb;		/* pointer to per-protocol pcb */
 	struct	inpcbinfo *inp_pcbinfo;	/* PCB list info */
@@ -99,13 +139,6 @@ struct inpcb {
 					/* list for this PCB's local port */
 	int	inp_flags;		/* generic IP/datagram flags */
 
-	/* protocol dependent part; cached route */
-	union {
-		/* placeholder for routing entry */
-		struct	route inp4_route;
-		struct	route_in6 inp6_route;
-	} inp_dependroute;
-
 	struct	inpcbpolicy *inp_sp; /* for IPSEC */
 	u_char	inp_vflag;
 #define	INP_IPV4	0x1
@@ -119,9 +152,11 @@ struct inpcb {
 		struct	mbuf *inp4_options;	/* IP options */
 		struct	ip_moptions *inp4_moptions; /* IP multicast options */
 	} inp_depend4;
-#define	inp_faddr	inp_dependfaddr.inp46_foreign.ia46_addr4
-#define	inp_laddr	inp_dependladdr.inp46_local.ia46_addr4
-#define	inp_route	inp_dependroute.inp4_route
+#define inp_fport	inp_inc.inc_fport
+#define inp_lport	inp_inc.inc_lport
+#define	inp_faddr	inp_inc.inc_faddr
+#define	inp_laddr	inp_inc.inc_laddr
+#define	inp_route	inp_inc.inc_route
 #define	inp_ip_tos	inp_depend4.inp4_ip_tos
 #define	inp_options	inp_depend4.inp4_options
 #define	inp_moptions	inp_depend4.inp4_moptions
@@ -143,9 +178,9 @@ struct inpcb {
 	LIST_ENTRY(inpcb) inp_portlist;
 	struct	inpcbport *inp_phd;	/* head of this list */
 	inp_gen_t	inp_gencnt;	/* generation count of this instance */
-#define	in6p_faddr	inp_dependfaddr.inp6_foreign
-#define	in6p_laddr	inp_dependladdr.inp6_local
-#define	in6p_route	inp_dependroute.inp6_route
+#define	in6p_faddr	inp_inc.inc6_faddr
+#define	in6p_laddr	inp_inc.inc6_laddr
+#define	in6p_route	inp_inc.inc6_route
 #define	in6p_ip6_hlim	inp_depend6.inp6_hlim
 #define	in6p_hops	inp_depend6.inp6_hops	/* default hop limit */
 #define	in6p_ip6_nxt	inp_ip_p
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 7ab594e..6740ebe 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -120,11 +120,6 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
     &tcp_delack_enabled, 0, 
     "Delay ACK to try and piggyback it onto a data packet");
 
-int tcp_lq_overflow = 1;
-SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcp_lq_overflow, CTLFLAG_RW,
-    &tcp_lq_overflow, 0, 
-    "Listen Queue Overflow");
-
 #ifdef TCP_DROP_SYNFIN
 static int drop_synfin = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
@@ -135,10 +130,9 @@ struct inpcbhead tcb;
 #define	tcb6	tcb  /* for KAME src sync over BSD*'s */
 struct inpcbinfo tcbinfo;
 
-static void	 tcp_dooptions __P((struct tcpcb *,
-	    u_char *, int, struct tcphdr *, struct tcpopt *));
+static void	 tcp_dooptions __P((struct tcpopt *, u_char *, int, int));
 static void	 tcp_pulloutofband __P((struct socket *,
-	    struct tcphdr *, struct mbuf *, int));
+		     struct tcphdr *, struct mbuf *, int));
 static int	 tcp_reass __P((struct tcpcb *, struct tcphdr *, int *,
 				struct mbuf *));
 static void	 tcp_xmit_timer __P((struct tcpcb *, int));
@@ -344,11 +338,6 @@ tcp_input(m, off0)
 	register int thflags;
 	struct socket *so = 0;
 	int todrop, acked, ourfinisacked, needoutput = 0;
-	struct in_addr laddr;
-#ifdef INET6
-	struct in6_addr laddr6;
-#endif
-	int dropsocket = 0;
 	int iss = 0;
 	u_long tiwin;
 	struct tcpopt to;		/* options in this segment */
@@ -643,6 +632,7 @@ findpcb:
 
 	so = inp->inp_socket;
 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
+		struct in_conninfo inc;
 #ifdef TCPDEBUG
 		if (so->so_options & SO_DEBUG) {
 			ostate = tp->t_state;
@@ -656,212 +646,232 @@ findpcb:
 			tcp_savetcp = *th;
 		}
 #endif
-		if (so->so_options & SO_ACCEPTCONN) {
-			register struct tcpcb *tp0 = tp;
-			struct socket *so2;
-#ifdef IPSEC
-			struct socket *oso;
-#endif
+		/* skip if this isn't a listen socket */
+		if ((so->so_options & SO_ACCEPTCONN) == 0)
+			goto after_listen;
 #ifdef INET6
-			struct inpcb *oinp = sotoinpcb(so);
-#endif /* INET6 */
+		inc.inc_isipv6 = isipv6;
+		if (isipv6) {
+			inc.inc6_faddr = ip6->ip6_src;
+			inc.inc6_laddr = ip6->ip6_dst;
+			inc.inc6_route.ro_rt = NULL;		/* XXX */
 
-#ifndef IPSEC
-			/*
-			 * Current IPsec implementation makes incorrect IPsec
-			 * cache if this check is done here.
-			 * So delay this until duplicated socket is created.
-			 */
-			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
-				/*
-				 * Note: dropwithreset makes sure we don't
-				 * send a RST in response to a RST.
-				 */
-				if (thflags & TH_ACK) {
+		} else
+#endif /* INET6 */
+		{
+			inc.inc_faddr = ip->ip_src;
+			inc.inc_laddr = ip->ip_dst;
+			inc.inc_route.ro_rt = NULL;		/* XXX */
+		}
+		inc.inc_fport = th->th_sport;
+		inc.inc_lport = th->th_dport;
+
+	        /*
+	         * If the state is LISTEN then ignore segment if it contains
+		 * a RST.  If the segment contains an ACK then it is bad and
+		 * send a RST.  If it does not contain a SYN then it is not
+		 * interesting; drop it.
+		 *
+		 * If the state is SYN_RECEIVED (syncache) and seg contains
+		 * an ACK, but not for our SYN/ACK, send a RST.  If the seg
+		 * contains a RST, check the sequence number to see if it
+		 * is a valid reset segment.
+		 */
+		if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
+			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
+				if (!syncache_expand(&inc, th, &so, m)) {
+					/*
+					 * No syncache entry, or ACK was not
+					 * for our SYN/ACK.  Send a RST.
+					 */
 					tcpstat.tcps_badsyn++;
 					rstreason = BANDLIM_RST_OPENPORT;
 					goto dropwithreset;
 				}
+				if (so == NULL)
+					/*
+					 * Could not complete 3-way handshake,
+					 * connection is being closed down, and
+					 * syncache will free mbuf.
+					 */
+					return;
+				/*
+				 * Socket is created in state SYN_RECEIVED.
+				 * Continue processing segment.
+				 */
+				inp = sotoinpcb(so);
+				tp = intotcpcb(inp);
+				/*
+				 * This is what would have happened in
+				 * tcp_ouput() when the SYN,ACK was sent.
+				 */
+				tp->snd_up = tp->snd_una;
+				tp->snd_max = tp->snd_nxt = tp->iss + 1;
+				tp->last_ack_sent = tp->rcv_nxt;
+/*
+ * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled
+ * until the _second_ ACK is received:
+ *    rcv SYN (set wscale opts)	 --> send SYN/ACK, set snd_wnd = window.
+ *    rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale,
+ *        move to ESTAB, set snd_wnd to tiwin.
+ */        
+				tp->snd_wnd = tiwin;	/* unscaled */
+				goto after_listen;
+			}
+			if (thflags & TH_RST) {
+				syncache_chkrst(&inc, th);
 				goto drop;
 			}
-#endif
+			if (thflags & TH_ACK) {
+				syncache_badack(&inc);
+				tcpstat.tcps_badsyn++;
+				rstreason = BANDLIM_RST_OPENPORT;
+				goto dropwithreset;
+			}
+			goto drop;
+		}
 
+		/*
+		 * Segment's flags are (SYN) or (SYN|FIN).
+		 */
 #ifdef INET6
-			/*
-			 * If deprecated address is forbidden,
-			 * we do not accept SYN to deprecated interface
-			 * address to prevent any new inbound connection from
-			 * getting established.
-			 * When we do not accept SYN, we send a TCP RST,
-			 * with deprecated source address (instead of dropping
-			 * it).  We compromise it as it is much better for peer
-			 * to send a RST, and RST will be the final packet
-			 * for the exchange.
-			 *
-			 * If we do not forbid deprecated addresses, we accept
-			 * the SYN packet.  RFC2462 does not suggest dropping
-			 * SYN in this case.
-			 * If we decipher RFC2462 5.5.4, it says like this:
-			 * 1. use of deprecated addr with existing
-			 *    communication is okay - "SHOULD continue to be
-			 *    used"
-			 * 2. use of it with new communication:
-			 *   (2a) "SHOULD NOT be used if alternate address
-			 *        with sufficient scope is available"
-			 *   (2b) nothing mentioned otherwise.
-			 * Here we fall into (2b) case as we have no choice in
-			 * our source address selection - we must obey the peer.
-			 *
-			 * The wording in RFC2462 is confusing, and there are
-			 * multiple description text for deprecated address
-			 * handling - worse, they are not exactly the same.
-			 * I believe 5.5.4 is the best one, so we follow 5.5.4.
-			 */
-			if (isipv6 && !ip6_use_deprecated) {
-				struct in6_ifaddr *ia6;
-
-				if ((ia6 = ip6_getdstifaddr(m)) &&
-				    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
-					tp = NULL;
-					rstreason = BANDLIM_RST_OPENPORT;
-					goto dropwithreset;
-				}
-			}
-#endif
+		/*
+		 * If deprecated address is forbidden,
+		 * we do not accept SYN to deprecated interface
+		 * address to prevent any new inbound connection from
+		 * getting established.
+		 * When we do not accept SYN, we send a TCP RST,
+		 * with deprecated source address (instead of dropping
+		 * it).  We compromise it as it is much better for peer
+		 * to send a RST, and RST will be the final packet
+		 * for the exchange.
+		 *
+		 * If we do not forbid deprecated addresses, we accept
+		 * the SYN packet.  RFC2462 does not suggest dropping
+		 * SYN in this case.
+		 * If we decipher RFC2462 5.5.4, it says like this:
+		 * 1. use of deprecated addr with existing
+		 *    communication is okay - "SHOULD continue to be
+		 *    used"
+		 * 2. use of it with new communication:
+		 *   (2a) "SHOULD NOT be used if alternate address
+		 *        with sufficient scope is available"
+		 *   (2b) nothing mentioned otherwise.
+		 * Here we fall into (2b) case as we have no choice in
+		 * our source address selection - we must obey the peer.
+		 *
+		 * The wording in RFC2462 is confusing, and there are
+		 * multiple description text for deprecated address
+		 * handling - worse, they are not exactly the same.
+		 * I believe 5.5.4 is the best one, so we follow 5.5.4.
+		 */
+		if (isipv6 && !ip6_use_deprecated) {
+			struct in6_ifaddr *ia6;
 
-			so2 = sonewconn(so, 0);
-			if (so2 == 0) {
-				/*
-				 * If we were unable to create a new socket
-				 * for this SYN, we call sodropablereq to
-				 * see if there are any other sockets we
-				 * can kick out of the listen queue.  If
-				 * so, we'll silently drop the socket
-				 * sodropablereq told us to drop and
-				 * create a new one.
-				 *
-				 * If sodropablereq returns 0, we'll
-				 * simply drop the incoming SYN, as we
-				 * can not allocate a socket for it.
-				 */
-				tcpstat.tcps_listendrop++;
-				so2 = sodropablereq(so);
-				if (so2) {
-					if (tcp_lq_overflow)
-						sototcpcb(so2)->t_flags |= 
-						    TF_LQ_OVERFLOW;
-					tcp_close(sototcpcb(so2));
-					so2 = sonewconn(so, 0);
-				}
-				if (!so2)
-					goto drop;
+			if ((ia6 = ip6_getdstifaddr(m)) &&
+			    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
+				tp = NULL;
+				rstreason = BANDLIM_RST_OPENPORT;
+				goto dropwithreset;
 			}
-#ifdef IPSEC
-			oso = so;
+		}
 #endif
-			so = so2;
-			/*
-			 * This is ugly, but ....
-			 *
-			 * Mark socket as temporary until we're
-			 * committed to keeping it.  The code at
-			 * ``drop'' and ``dropwithreset'' check the
-			 * flag dropsocket to see if the temporary
-			 * socket created here should be discarded.
-			 * We mark the socket as discardable until
-			 * we're committed to it below in TCPS_LISTEN.
-			 */
-			dropsocket++;
-			inp = (struct inpcb *)so->so_pcb;
+		/*
+		 * If it is from this socket, drop it, it must be forged.
+		 * Don't bother responding if the destination was a broadcast.
+		 */
+		if (th->th_dport == th->th_sport) {
 #ifdef INET6
-			if (isipv6)
-				inp->in6p_laddr = ip6->ip6_dst;
-			else {
-				inp->inp_vflag &= ~INP_IPV6;
-				inp->inp_vflag |= INP_IPV4;
+			if (isipv6) {
+				if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
+						       &ip6->ip6_src))
+					goto drop;
+			} else
 #endif /* INET6 */
-			inp->inp_laddr = ip->ip_dst;
+			if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
+				goto drop;
+		}
+		/*
+		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
+		 * in_broadcast() should never return true on a received
+		 * packet with M_BCAST not set.
+ 		 *
+ 		 * Packets with a multicast source address should also
+ 		 * be discarded.
+		 */
+		if (m->m_flags & (M_BCAST|M_MCAST))
+			goto drop;
 #ifdef INET6
-			}
-#endif /* INET6 */
-			inp->inp_lport = th->th_dport;
-			if (in_pcbinshash(inp) != 0) {
+		if (isipv6) {
+			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
+			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
+				goto drop;
+		} else
+#endif
+		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
+		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
+		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST))
+			goto drop;
+		/*
+		 * SYN appears to be valid; create compressed TCP state
+		 * for syncache, or perform t/tcp connection.
+		 */
+		if (so->so_qlen <= so->so_qlimit) {
+			tcp_dooptions(&to, optp, optlen, 1);
+			if (!syncache_add(&inc, &to, th, &so, m))
+				goto drop;
+			if (so == NULL)
 				/*
-				 * Undo the assignments above if we failed to
-				 * put the PCB on the hash lists.
+				 * Entry added to syncache, mbuf used to
+				 * send SYN,ACK packet.
 				 */
-#ifdef INET6
-				if (isipv6)
-					inp->in6p_laddr = in6addr_any;
-				else
-#endif /* INET6 */
-				inp->inp_laddr.s_addr = INADDR_ANY;
-				inp->inp_lport = 0;
-				goto drop;
-			}
-#ifdef IPSEC
+				return;
 			/*
-			 * To avoid creating incorrectly cached IPsec
-			 * association, this is need to be done here.
-			 *
-			 * Subject: (KAME-snap 748)
-			 * From: Wayne Knowles <w.knowles@niwa.cri.nz>
-			 * ftp://ftp.kame.net/pub/mail-list/snap-users/748
+			 * Segment passed TAO tests.
 			 */
-			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
-				/*
-				 * Note: dropwithreset makes sure we don't
-				 * send a RST in response to a RST.
-				 */
-				if (thflags & TH_ACK) {
-					tcpstat.tcps_badsyn++;
-					rstreason = BANDLIM_RST_OPENPORT;
-					goto dropwithreset;
-				}
-				goto drop;
-			}
+			inp = sotoinpcb(so);
+			tp = intotcpcb(inp);
+			tp->snd_wnd = tiwin;
+			tp->t_starttime = ticks;
+			tp->t_state = TCPS_ESTABLISHED;
+
+			/*
+			 * If there is a FIN, or if there is data and the
+			 * connection is local, then delay SYN,ACK(SYN) in
+			 * the hope of piggy-backing it on a response
+			 * segment.  Otherwise must send ACK now in case
+			 * the other side is slow starting.
+			 */
+			if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
+			    (tlen != 0 &&
+#ifdef INET6
+			      ((isipv6 && in6_localaddr(&inp->in6p_faddr))
+			      ||
+			      (!isipv6 &&
 #endif
+			    in_localaddr(inp->inp_faddr)
 #ifdef INET6
-			if (isipv6) {
-  				/*
- 				 * Inherit socket options from the listening
-  				 * socket.
- 				 * Note that in6p_inputopts are not (even
- 				 * should not be) copied, since it stores
-				 * previously received options and is used to
- 				 * detect if each new option is different than
- 				 * the previous one and hence should be passed
- 				 * to a user.
- 				 * If we copied in6p_inputopts, a user would
- 				 * not be able to receive options just after
- 				 * calling the accept system call.
- 				 */
-				inp->inp_flags |=
-					oinp->inp_flags & INP_CONTROLOPTS;
- 				if (oinp->in6p_outputopts)
- 					inp->in6p_outputopts =
- 						ip6_copypktopts(oinp->in6p_outputopts,
- 								M_NOWAIT);
-			} else
-#endif /* INET6 */
-			inp->inp_options = ip_srcroute();
-#ifdef IPSEC
-			/* copy old policy into new socket's */
-			if (ipsec_copy_policy(sotoinpcb(oso)->inp_sp,
-			                      inp->inp_sp))
-				printf("tcp_input: could not copy policy\n");
+			       ))
 #endif
-			tp = intotcpcb(inp);
-			tp->t_state = TCPS_LISTEN;
-			tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT);
-
-			/* Compute proper scaling value from buffer space */
-			while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
-			   TCP_MAXWIN << tp->request_r_scale <
-			   so->so_rcv.sb_hiwat)
-				tp->request_r_scale++;
+			     ))) {
+                                callout_reset(tp->tt_delack, tcp_delacktime,  
+                                    tcp_timer_delack, tp);  
+				tp->t_flags |= TF_NEEDSYN;
+			} else 
+				tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
+
+			tcpstat.tcps_connects++;
+			soisconnected(so);
+			goto trimthenstep6;
 		}
+		goto drop;
 	}
+after_listen:
+
+/* XXX temp debugging */
+	/* should not happen - syncache should pick up these connections */
+	if (tp->t_state == TCPS_LISTEN)
+		panic("tcp_input: TCPS_LISTEN");
 
 	/*
 	 * Segment received on connection.
@@ -872,11 +882,25 @@ findpcb:
 		callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
 
 	/*
-	 * Process options if not in LISTEN state,
-	 * else do it below (after getting remote address).
+	 * Process options.
+	 * XXX this is tradtitional behavior, may need to be cleaned up.
 	 */
-	if (tp->t_state != TCPS_LISTEN)
-		tcp_dooptions(tp, optp, optlen, th, &to);
+	tcp_dooptions(&to, optp, optlen, thflags & TH_SYN);
+	if (thflags & TH_SYN) {
+		if (to.to_flags & TOF_SCALE) {
+			tp->t_flags |= TF_RCVD_SCALE;
+			tp->requested_s_scale = to.to_requested_s_scale;
+		}
+		if (to.to_flags & TOF_TS) {
+			tp->t_flags |= TF_RCVD_TSTMP;
+			tp->ts_recent = to.to_tsval;
+			tp->ts_recent_age = ticks;
+		}
+		if (to.to_flags & (TOF_CC|TOF_CCNEW))
+			tp->t_flags |= TF_RCVD_CC;
+		if (to.to_flags & TOF_MSS)
+			tcp_mss(tp, to.to_mss);
+	}
 
 	/*
 	 * Header prediction: check for the two common cases
@@ -898,7 +922,7 @@ findpcb:
 	if (tp->t_state == TCPS_ESTABLISHED &&
 	    (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
 	    ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
-	    ((to.to_flag & TOF_TS) == 0 ||
+	    ((to.to_flags & TOF_TS) == 0 ||
 	     TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
 	    /*
 	     * Using the CC option is compulsory if once started:
@@ -906,7 +930,7 @@ findpcb:
 	     *   if the segment has a CC option equal to CCrecv
 	     */
 	    ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) ||
-	     ((to.to_flag & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
+	     ((to.to_flags & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
 	    th->th_seq == tp->rcv_nxt &&
 	    tiwin && tiwin == tp->snd_wnd &&
 	    tp->snd_nxt == tp->snd_max) {
@@ -917,7 +941,7 @@ findpcb:
 		 * NOTE that the test is modified according to the latest
 		 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
 		 */
-		if ((to.to_flag & TOF_TS) != 0 &&
+		if ((to.to_flags & TOF_TS) != 0 &&
 		   SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
 			tp->ts_recent_age = ticks;
 			tp->ts_recent = to.to_tsval;
@@ -943,7 +967,7 @@ findpcb:
 					tp->snd_nxt = tp->snd_max;
 					tp->t_badrxtwin = 0;
 				}
-				if ((to.to_flag & TOF_TS) != 0)
+				if ((to.to_flags & TOF_TS) != 0)
 					tcp_xmit_timer(tp,
 					    ticks - to.to_tsecr + 1);
 				else if (tp->t_rtttime &&
@@ -1025,209 +1049,6 @@ findpcb:
 	switch (tp->t_state) {
 
 	/*
-	 * If the state is LISTEN then ignore segment if it contains an RST.
-	 * If the segment contains an ACK then it is bad and send a RST.
-	 * If it does not contain a SYN then it is not interesting; drop it.
-	 * If it is from this socket, drop it, it must be forged.
-	 * Don't bother responding if the destination was a broadcast.
-	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
-	 * tp->iss, and send a segment:
-	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
-	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
-	 * Fill in remote peer address fields if not previously specified.
-	 * Enter SYN_RECEIVED state, and process any other fields of this
-	 * segment in this state.
-	 */
-	case TCPS_LISTEN: {
-		register struct sockaddr_in *sin;
-#ifdef INET6
-		register struct sockaddr_in6 *sin6;
-#endif
-
-		if (thflags & TH_RST)
-			goto drop;
-		if (thflags & TH_ACK) {
-			rstreason = BANDLIM_RST_OPENPORT;
-			goto dropwithreset;
-		}
-		if ((thflags & TH_SYN) == 0)
-			goto drop;
-		if (th->th_dport == th->th_sport) {
-#ifdef INET6
-			if (isipv6) {
-				if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
-						       &ip6->ip6_src))
-					goto drop;
-			} else
-#endif /* INET6 */
-			if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
-				goto drop;
-		}
-		/*
-		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
-		 * in_broadcast() should never return true on a received
-		 * packet with M_BCAST not set.
- 		 *
- 		 * Packets with a multicast source address should also
- 		 * be discarded.
-		 */
-		if (m->m_flags & (M_BCAST|M_MCAST))
-			goto drop;
-#ifdef INET6
-		if (isipv6) {
-			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
-			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
-				goto drop;
-		} else
-#endif
-		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
-		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
-		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST))
-			goto drop;
-#ifdef INET6
-		if (isipv6) {
-			MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
-			       M_SONAME, M_NOWAIT | M_ZERO);
-			if (sin6 == NULL)
-				goto drop;
-			sin6->sin6_family = AF_INET6;
-			sin6->sin6_len = sizeof(*sin6);
-			sin6->sin6_addr = ip6->ip6_src;
-			sin6->sin6_port = th->th_sport;
-			laddr6 = inp->in6p_laddr;
-			if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
-				inp->in6p_laddr = ip6->ip6_dst;
-			if (in6_pcbconnect(inp, (struct sockaddr *)sin6,
-					   thread0)) {
-				inp->in6p_laddr = laddr6;
-				FREE(sin6, M_SONAME);
-				goto drop;
-			}
-			FREE(sin6, M_SONAME);
-		} else
-#endif
-	      {
-		MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME,
-		       M_NOWAIT);
-		if (sin == NULL)
-			goto drop;
-		sin->sin_family = AF_INET;
-		sin->sin_len = sizeof(*sin);
-		sin->sin_addr = ip->ip_src;
-		sin->sin_port = th->th_sport;
-		bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
-		laddr = inp->inp_laddr;
-		if (inp->inp_laddr.s_addr == INADDR_ANY)
-			inp->inp_laddr = ip->ip_dst;
-		if (in_pcbconnect(inp, (struct sockaddr *)sin, thread0)) {
-			inp->inp_laddr = laddr;
-			FREE(sin, M_SONAME);
-			goto drop;
-		}
-		FREE(sin, M_SONAME);
-	      }
-		if ((taop = tcp_gettaocache(inp)) == NULL) {
-			taop = &tao_noncached;
-			bzero(taop, sizeof(*taop));
-		}
-		tcp_dooptions(tp, optp, optlen, th, &to);
-		if (iss)
-			tp->iss = iss;
-		else {
-			tp->iss = tcp_new_isn(tp);
- 		}
-		tp->irs = th->th_seq;
-		tcp_sendseqinit(tp);
-		tcp_rcvseqinit(tp);
-		/*
-		 * Initialization of the tcpcb for transaction;
-		 *   set SND.WND = SEG.WND,
-		 *   initialize CCsend and CCrecv.
-		 */
-		tp->snd_wnd = tiwin;	/* initial send-window */
-		tp->cc_send = CC_INC(tcp_ccgen);
-		tp->cc_recv = to.to_cc;
-		/*
-		 * Perform TAO test on incoming CC (SEG.CC) option, if any.
-		 * - compare SEG.CC against cached CC from the same host,
-		 *	if any.
-		 * - if SEG.CC > chached value, SYN must be new and is accepted
-		 *	immediately: save new CC in the cache, mark the socket
-		 *	connected, enter ESTABLISHED state, turn on flag to
-		 *	send a SYN in the next segment.
-		 *	A virtual advertised window is set in rcv_adv to
-		 *	initialize SWS prevention.  Then enter normal segment
-		 *	processing: drop SYN, process data and FIN.
-		 * - otherwise do a normal 3-way handshake.
-		 */
-		if ((to.to_flag & TOF_CC) != 0) {
-		    if (((tp->t_flags & TF_NOPUSH) != 0) &&
-			taop->tao_cc != 0 && CC_GT(to.to_cc, taop->tao_cc)) {
-
-			taop->tao_cc = to.to_cc;
-			tp->t_starttime = ticks;
-			tp->t_state = TCPS_ESTABLISHED;
-
-			/*
-			 * If there is a FIN, or if there is data and the
-			 * connection is local, then delay SYN,ACK(SYN) in
-			 * the hope of piggy-backing it on a response
-			 * segment.  Otherwise must send ACK now in case
-			 * the other side is slow starting.
-			 */
-			if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
-			    (tlen != 0 &&
-#ifdef INET6
-			      ((isipv6 && in6_localaddr(&inp->in6p_faddr))
-			      ||
-			      (!isipv6 &&
-#endif
-			    in_localaddr(inp->inp_faddr)
-#ifdef INET6
-			       ))
-#endif
-			     ))) {
-                                callout_reset(tp->tt_delack, tcp_delacktime,  
-                                    tcp_timer_delack, tp);  
-				tp->t_flags |= TF_NEEDSYN;
-			} else 
-				tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
-
-			/*
-			 * Limit the `virtual advertised window' to TCP_MAXWIN
-			 * here.  Even if we requested window scaling, it will
-			 * become effective only later when our SYN is acked.
-			 */
-			tp->rcv_adv += min(tp->rcv_wnd, TCP_MAXWIN);
-			tcpstat.tcps_connects++;
-			soisconnected(so);
-			callout_reset(tp->tt_keep, tcp_keepinit,
-				      tcp_timer_keep, tp);
-			dropsocket = 0;		/* committed to socket */
-			tcpstat.tcps_accepts++;
-			goto trimthenstep6;
-		    }
-		/* else do standard 3-way handshake */
-		} else {
-		    /*
-		     * No CC option, but maybe CC.NEW:
-		     *   invalidate cached value.
-		     */
-		     taop->tao_cc = 0;
-		}
-		/*
-		 * TAO test failed or there was no CC option,
-		 *    do a standard 3-way handshake.
-		 */
-		tp->t_flags |= TF_ACKNOW;
-		tp->t_state = TCPS_SYN_RECEIVED;
-		callout_reset(tp->tt_keep, tcp_keepinit, tcp_timer_keep, tp);
-		dropsocket = 0;		/* committed to socket */
-		tcpstat.tcps_accepts++;
-		goto trimthenstep6;
-		}
-
-	/*
 	 * If the state is SYN_RECEIVED:
 	 *	if seg contains an ACK, but not for our SYN/ACK, send a RST.
 	 */
@@ -1253,7 +1074,7 @@ findpcb:
 	 *	continue processing rest of data/controls, beginning with URG
 	 */
 	case TCPS_SYN_SENT:
-		if ((taop = tcp_gettaocache(inp)) == NULL) {
+		if ((taop = tcp_gettaocache(&inp->inp_inc)) == NULL) {
 			taop = &tao_noncached;
 			bzero(taop, sizeof(*taop));
 		}
@@ -1297,7 +1118,7 @@ findpcb:
 			 * by the old rules.  If no CC.ECHO option, make sure
 			 * we don't get fooled into using T/TCP.
 			 */
-			if (to.to_flag & TOF_CCECHO) {
+			if (to.to_flags & TOF_CCECHO) {
 				if (tp->cc_send != to.to_ccecho) {
 					if (taop->tao_ccsent != 0)
 						goto drop;
@@ -1359,7 +1180,7 @@ findpcb:
 		 */
 			tp->t_flags |= TF_ACKNOW;
 			callout_stop(tp->tt_rexmt);
-			if (to.to_flag & TOF_CC) {
+			if (to.to_flags & TOF_CC) {
 				if (taop->tao_cc != 0 &&
 				    CC_GT(to.to_cc, taop->tao_cc)) {
 					/*
@@ -1434,7 +1255,7 @@ trimthenstep6:
 	case TCPS_CLOSING:
 	case TCPS_TIME_WAIT:
 		if ((thflags & TH_SYN) &&
-		    (to.to_flag & TOF_CC) && tp->cc_recv != 0) {
+		    (to.to_flags & TOF_CC) && tp->cc_recv != 0) {
 			if (tp->t_state == TCPS_TIME_WAIT &&
 					(ticks - tp->t_starttime) > tcp_msl) {
 				rstreason = BANDLIM_UNLIMITED;
@@ -1542,7 +1363,7 @@ trimthenstep6:
 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
 	 * and it's less than ts_recent, drop it.
 	 */
-	if ((to.to_flag & TOF_TS) != 0 && tp->ts_recent &&
+	if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
 	    TSTMP_LT(to.to_tsval, tp->ts_recent)) {
 
 		/* Check to see if ts_recent is over 24 days old.  */
@@ -1574,7 +1395,7 @@ trimthenstep6:
 	 *   RST segments do not have to comply with this.
 	 */
 	if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) &&
-	    ((to.to_flag & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
+	    ((to.to_flags & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
  		goto dropafterack;
 
 	/*
@@ -1694,7 +1515,7 @@ trimthenstep6:
 	 * NOTE that the test is modified according to the latest
 	 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
 	 */
-	if ((to.to_flag & TOF_TS) != 0 &&
+	if ((to.to_flags & TOF_TS) != 0 &&
 	    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
 		tp->ts_recent_age = ticks;
 		tp->ts_recent = to.to_tsval;
@@ -1748,7 +1569,7 @@ trimthenstep6:
 		 * update cache.CC if it was undefined, pass any queued
 		 * data to the user, and advance state appropriately.
 		 */
-		if ((taop = tcp_gettaocache(inp)) != NULL &&
+		if ((taop = tcp_gettaocache(&inp->inp_inc)) != NULL &&
 		    taop->tao_cc == 0)
 			taop->tao_cc = tp->cc_recv;
 
@@ -1940,7 +1761,7 @@ process_ACK:
 		 * timer backoff (cf., Phil Karn's retransmit alg.).
 		 * Recompute the initial retransmit timer.
 		 */
-		if (to.to_flag & TOF_TS)
+		if (to.to_flags & TOF_TS)
 			tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
 		else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
 			tcp_xmit_timer(tp, ticks - tp->t_rtttime);
@@ -2371,9 +2192,6 @@ dropwithreset:
 		tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
 			    (tcp_seq)0, TH_RST|TH_ACK);
 	}
-	/* destroy temporarily created socket */
-	if (dropsocket)
-		(void) soabort(so);
 	return;
 
 drop:
@@ -2386,23 +2204,21 @@ drop:
 			  &tcp_savetcp, 0);
 #endif
 	m_freem(m);
-	/* destroy temporarily created socket */
-	if (dropsocket)
-		(void) soabort(so);
 	return;
 }
 
+/*
+ * Parse TCP options and place in tcpopt.
+ */
 static void
-tcp_dooptions(tp, cp, cnt, th, to)
-	struct tcpcb *tp;
+tcp_dooptions(to, cp, cnt, is_syn)
+	struct tcpopt *to;
 	u_char *cp;
 	int cnt;
-	struct tcphdr *th;
-	struct tcpopt *to;
 {
-	u_short mss = 0;
 	int opt, optlen;
 
+	to->to_flags = 0;
 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
 		opt = cp[0];
 		if (opt == TCPOPT_EOL)
@@ -2417,92 +2233,67 @@ tcp_dooptions(tp, cp, cnt, th, to)
 				break;
 		}
 		switch (opt) {
-
-		default:
-			continue;
-
 		case TCPOPT_MAXSEG:
 			if (optlen != TCPOLEN_MAXSEG)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
-			NTOHS(mss);
+			to->to_flags |= TOF_MSS;
+			bcopy((char *)cp + 2,
+			    (char *)&to->to_mss, sizeof(to->to_mss));
+			NTOHS(to->to_mss);
 			break;
-
 		case TCPOPT_WINDOW:
 			if (optlen != TCPOLEN_WINDOW)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (! is_syn)
 				continue;
-			tp->t_flags |= TF_RCVD_SCALE;
-			tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
+			to->to_flags |= TOF_SCALE;
+			to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
 			break;
-
 		case TCPOPT_TIMESTAMP:
 			if (optlen != TCPOLEN_TIMESTAMP)
 				continue;
-			to->to_flag |= TOF_TS;
+			to->to_flags |= TOF_TS;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_tsval, sizeof(to->to_tsval));
 			NTOHL(to->to_tsval);
 			bcopy((char *)cp + 6,
 			    (char *)&to->to_tsecr, sizeof(to->to_tsecr));
 			NTOHL(to->to_tsecr);
-
-			/*
-			 * A timestamp received in a SYN makes
-			 * it ok to send timestamp requests and replies.
-			 */
-			if (th->th_flags & TH_SYN) {
-				tp->t_flags |= TF_RCVD_TSTMP;
-				tp->ts_recent = to->to_tsval;
-				tp->ts_recent_age = ticks;
-			}
 			break;
 		case TCPOPT_CC:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			to->to_flag |= TOF_CC;
+			to->to_flags |= TOF_CC;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_cc, sizeof(to->to_cc));
 			NTOHL(to->to_cc);
-			/*
-			 * A CC or CC.new option received in a SYN makes
-			 * it ok to send CC in subsequent segments.
-			 */
-			if (th->th_flags & TH_SYN)
-				tp->t_flags |= TF_RCVD_CC;
 			break;
 		case TCPOPT_CCNEW:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			to->to_flag |= TOF_CCNEW;
+			to->to_flags |= TOF_CCNEW;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_cc, sizeof(to->to_cc));
 			NTOHL(to->to_cc);
-			/*
-			 * A CC or CC.new option received in a SYN makes
-			 * it ok to send CC in subsequent segments.
-			 */
-			tp->t_flags |= TF_RCVD_CC;
 			break;
 		case TCPOPT_CCECHO:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			to->to_flag |= TOF_CCECHO;
+			to->to_flags |= TOF_CCECHO;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_ccecho, sizeof(to->to_ccecho));
 			NTOHL(to->to_ccecho);
 			break;
+		default:
+			continue;
 		}
 	}
-	if (th->th_flags & TH_SYN)
-		tcp_mss(tp, mss);	/* sets t_maxseg */
 }
 
 /*
@@ -2675,10 +2466,10 @@ tcp_mss(tp, offer)
 #endif
 #ifdef INET6
 	if (isipv6)
-		rt = tcp_rtlookup6(inp);
+		rt = tcp_rtlookup6(&inp->inp_inc);
 	else
 #endif
-	rt = tcp_rtlookup(inp);
+	rt = tcp_rtlookup(&inp->inp_inc);
 	if (rt == NULL) {
 		tp->t_maxopd = tp->t_maxseg =
 #ifdef INET6
@@ -2884,10 +2675,10 @@ tcp_mssopt(tp)
 #endif
 #ifdef INET6
 	if (isipv6)
-		rt = tcp_rtlookup6(tp->t_inpcb);
+		rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc);
 	else
 #endif /* INET6 */
-	rt = tcp_rtlookup(tp->t_inpcb);
+	rt = tcp_rtlookup(&tp->t_inpcb->inp_inc);
 	if (rt == NULL)
 		return
 #ifdef INET6
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index e473b8e..683eeef 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -216,7 +216,7 @@ again:
 
 	len = (long)ulmin(so->so_snd.sb_cc, win) - off;
 
-	if ((taop = tcp_gettaocache(tp->t_inpcb)) == NULL) {
+	if ((taop = tcp_gettaocache(&tp->t_inpcb->inp_inc)) == NULL) {
 		taop = &tao_noncached;
 		bzero(taop, sizeof(*taop));
 	}
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index 7ab594e..6740ebe 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -120,11 +120,6 @@ SYSCTL_INT(_net_inet_tcp, OID_AUTO, delayed_ack, CTLFLAG_RW,
     &tcp_delack_enabled, 0, 
     "Delay ACK to try and piggyback it onto a data packet");
 
-int tcp_lq_overflow = 1;
-SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcp_lq_overflow, CTLFLAG_RW,
-    &tcp_lq_overflow, 0, 
-    "Listen Queue Overflow");
-
 #ifdef TCP_DROP_SYNFIN
 static int drop_synfin = 0;
 SYSCTL_INT(_net_inet_tcp, OID_AUTO, drop_synfin, CTLFLAG_RW,
@@ -135,10 +130,9 @@ struct inpcbhead tcb;
 #define	tcb6	tcb  /* for KAME src sync over BSD*'s */
 struct inpcbinfo tcbinfo;
 
-static void	 tcp_dooptions __P((struct tcpcb *,
-	    u_char *, int, struct tcphdr *, struct tcpopt *));
+static void	 tcp_dooptions __P((struct tcpopt *, u_char *, int, int));
 static void	 tcp_pulloutofband __P((struct socket *,
-	    struct tcphdr *, struct mbuf *, int));
+		     struct tcphdr *, struct mbuf *, int));
 static int	 tcp_reass __P((struct tcpcb *, struct tcphdr *, int *,
 				struct mbuf *));
 static void	 tcp_xmit_timer __P((struct tcpcb *, int));
@@ -344,11 +338,6 @@ tcp_input(m, off0)
 	register int thflags;
 	struct socket *so = 0;
 	int todrop, acked, ourfinisacked, needoutput = 0;
-	struct in_addr laddr;
-#ifdef INET6
-	struct in6_addr laddr6;
-#endif
-	int dropsocket = 0;
 	int iss = 0;
 	u_long tiwin;
 	struct tcpopt to;		/* options in this segment */
@@ -643,6 +632,7 @@ findpcb:
 
 	so = inp->inp_socket;
 	if (so->so_options & (SO_DEBUG|SO_ACCEPTCONN)) {
+		struct in_conninfo inc;
 #ifdef TCPDEBUG
 		if (so->so_options & SO_DEBUG) {
 			ostate = tp->t_state;
@@ -656,212 +646,232 @@ findpcb:
 			tcp_savetcp = *th;
 		}
 #endif
-		if (so->so_options & SO_ACCEPTCONN) {
-			register struct tcpcb *tp0 = tp;
-			struct socket *so2;
-#ifdef IPSEC
-			struct socket *oso;
-#endif
+		/* skip if this isn't a listen socket */
+		if ((so->so_options & SO_ACCEPTCONN) == 0)
+			goto after_listen;
 #ifdef INET6
-			struct inpcb *oinp = sotoinpcb(so);
-#endif /* INET6 */
+		inc.inc_isipv6 = isipv6;
+		if (isipv6) {
+			inc.inc6_faddr = ip6->ip6_src;
+			inc.inc6_laddr = ip6->ip6_dst;
+			inc.inc6_route.ro_rt = NULL;		/* XXX */
 
-#ifndef IPSEC
-			/*
-			 * Current IPsec implementation makes incorrect IPsec
-			 * cache if this check is done here.
-			 * So delay this until duplicated socket is created.
-			 */
-			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
-				/*
-				 * Note: dropwithreset makes sure we don't
-				 * send a RST in response to a RST.
-				 */
-				if (thflags & TH_ACK) {
+		} else
+#endif /* INET6 */
+		{
+			inc.inc_faddr = ip->ip_src;
+			inc.inc_laddr = ip->ip_dst;
+			inc.inc_route.ro_rt = NULL;		/* XXX */
+		}
+		inc.inc_fport = th->th_sport;
+		inc.inc_lport = th->th_dport;
+
+	        /*
+	         * If the state is LISTEN then ignore segment if it contains
+		 * a RST.  If the segment contains an ACK then it is bad and
+		 * send a RST.  If it does not contain a SYN then it is not
+		 * interesting; drop it.
+		 *
+		 * If the state is SYN_RECEIVED (syncache) and seg contains
+		 * an ACK, but not for our SYN/ACK, send a RST.  If the seg
+		 * contains a RST, check the sequence number to see if it
+		 * is a valid reset segment.
+		 */
+		if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
+			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) == TH_ACK) {
+				if (!syncache_expand(&inc, th, &so, m)) {
+					/*
+					 * No syncache entry, or ACK was not
+					 * for our SYN/ACK.  Send a RST.
+					 */
 					tcpstat.tcps_badsyn++;
 					rstreason = BANDLIM_RST_OPENPORT;
 					goto dropwithreset;
 				}
+				if (so == NULL)
+					/*
+					 * Could not complete 3-way handshake,
+					 * connection is being closed down, and
+					 * syncache will free mbuf.
+					 */
+					return;
+				/*
+				 * Socket is created in state SYN_RECEIVED.
+				 * Continue processing segment.
+				 */
+				inp = sotoinpcb(so);
+				tp = intotcpcb(inp);
+				/*
+				 * This is what would have happened in
+				 * tcp_ouput() when the SYN,ACK was sent.
+				 */
+				tp->snd_up = tp->snd_una;
+				tp->snd_max = tp->snd_nxt = tp->iss + 1;
+				tp->last_ack_sent = tp->rcv_nxt;
+/*
+ * XXX possible bug - it doesn't appear that tp->snd_wnd is unscaled
+ * until the _second_ ACK is received:
+ *    rcv SYN (set wscale opts)	 --> send SYN/ACK, set snd_wnd = window.
+ *    rcv ACK, calculate tiwin --> process SYN_RECEIVED, determine wscale,
+ *        move to ESTAB, set snd_wnd to tiwin.
+ */        
+				tp->snd_wnd = tiwin;	/* unscaled */
+				goto after_listen;
+			}
+			if (thflags & TH_RST) {
+				syncache_chkrst(&inc, th);
 				goto drop;
 			}
-#endif
+			if (thflags & TH_ACK) {
+				syncache_badack(&inc);
+				tcpstat.tcps_badsyn++;
+				rstreason = BANDLIM_RST_OPENPORT;
+				goto dropwithreset;
+			}
+			goto drop;
+		}
 
+		/*
+		 * Segment's flags are (SYN) or (SYN|FIN).
+		 */
 #ifdef INET6
-			/*
-			 * If deprecated address is forbidden,
-			 * we do not accept SYN to deprecated interface
-			 * address to prevent any new inbound connection from
-			 * getting established.
-			 * When we do not accept SYN, we send a TCP RST,
-			 * with deprecated source address (instead of dropping
-			 * it).  We compromise it as it is much better for peer
-			 * to send a RST, and RST will be the final packet
-			 * for the exchange.
-			 *
-			 * If we do not forbid deprecated addresses, we accept
-			 * the SYN packet.  RFC2462 does not suggest dropping
-			 * SYN in this case.
-			 * If we decipher RFC2462 5.5.4, it says like this:
-			 * 1. use of deprecated addr with existing
-			 *    communication is okay - "SHOULD continue to be
-			 *    used"
-			 * 2. use of it with new communication:
-			 *   (2a) "SHOULD NOT be used if alternate address
-			 *        with sufficient scope is available"
-			 *   (2b) nothing mentioned otherwise.
-			 * Here we fall into (2b) case as we have no choice in
-			 * our source address selection - we must obey the peer.
-			 *
-			 * The wording in RFC2462 is confusing, and there are
-			 * multiple description text for deprecated address
-			 * handling - worse, they are not exactly the same.
-			 * I believe 5.5.4 is the best one, so we follow 5.5.4.
-			 */
-			if (isipv6 && !ip6_use_deprecated) {
-				struct in6_ifaddr *ia6;
-
-				if ((ia6 = ip6_getdstifaddr(m)) &&
-				    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
-					tp = NULL;
-					rstreason = BANDLIM_RST_OPENPORT;
-					goto dropwithreset;
-				}
-			}
-#endif
+		/*
+		 * If deprecated address is forbidden,
+		 * we do not accept SYN to deprecated interface
+		 * address to prevent any new inbound connection from
+		 * getting established.
+		 * When we do not accept SYN, we send a TCP RST,
+		 * with deprecated source address (instead of dropping
+		 * it).  We compromise it as it is much better for peer
+		 * to send a RST, and RST will be the final packet
+		 * for the exchange.
+		 *
+		 * If we do not forbid deprecated addresses, we accept
+		 * the SYN packet.  RFC2462 does not suggest dropping
+		 * SYN in this case.
+		 * If we decipher RFC2462 5.5.4, it says like this:
+		 * 1. use of deprecated addr with existing
+		 *    communication is okay - "SHOULD continue to be
+		 *    used"
+		 * 2. use of it with new communication:
+		 *   (2a) "SHOULD NOT be used if alternate address
+		 *        with sufficient scope is available"
+		 *   (2b) nothing mentioned otherwise.
+		 * Here we fall into (2b) case as we have no choice in
+		 * our source address selection - we must obey the peer.
+		 *
+		 * The wording in RFC2462 is confusing, and there are
+		 * multiple description text for deprecated address
+		 * handling - worse, they are not exactly the same.
+		 * I believe 5.5.4 is the best one, so we follow 5.5.4.
+		 */
+		if (isipv6 && !ip6_use_deprecated) {
+			struct in6_ifaddr *ia6;
 
-			so2 = sonewconn(so, 0);
-			if (so2 == 0) {
-				/*
-				 * If we were unable to create a new socket
-				 * for this SYN, we call sodropablereq to
-				 * see if there are any other sockets we
-				 * can kick out of the listen queue.  If
-				 * so, we'll silently drop the socket
-				 * sodropablereq told us to drop and
-				 * create a new one.
-				 *
-				 * If sodropablereq returns 0, we'll
-				 * simply drop the incoming SYN, as we
-				 * can not allocate a socket for it.
-				 */
-				tcpstat.tcps_listendrop++;
-				so2 = sodropablereq(so);
-				if (so2) {
-					if (tcp_lq_overflow)
-						sototcpcb(so2)->t_flags |= 
-						    TF_LQ_OVERFLOW;
-					tcp_close(sototcpcb(so2));
-					so2 = sonewconn(so, 0);
-				}
-				if (!so2)
-					goto drop;
+			if ((ia6 = ip6_getdstifaddr(m)) &&
+			    (ia6->ia6_flags & IN6_IFF_DEPRECATED)) {
+				tp = NULL;
+				rstreason = BANDLIM_RST_OPENPORT;
+				goto dropwithreset;
 			}
-#ifdef IPSEC
-			oso = so;
+		}
 #endif
-			so = so2;
-			/*
-			 * This is ugly, but ....
-			 *
-			 * Mark socket as temporary until we're
-			 * committed to keeping it.  The code at
-			 * ``drop'' and ``dropwithreset'' check the
-			 * flag dropsocket to see if the temporary
-			 * socket created here should be discarded.
-			 * We mark the socket as discardable until
-			 * we're committed to it below in TCPS_LISTEN.
-			 */
-			dropsocket++;
-			inp = (struct inpcb *)so->so_pcb;
+		/*
+		 * If it is from this socket, drop it, it must be forged.
+		 * Don't bother responding if the destination was a broadcast.
+		 */
+		if (th->th_dport == th->th_sport) {
 #ifdef INET6
-			if (isipv6)
-				inp->in6p_laddr = ip6->ip6_dst;
-			else {
-				inp->inp_vflag &= ~INP_IPV6;
-				inp->inp_vflag |= INP_IPV4;
+			if (isipv6) {
+				if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
+						       &ip6->ip6_src))
+					goto drop;
+			} else
 #endif /* INET6 */
-			inp->inp_laddr = ip->ip_dst;
+			if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
+				goto drop;
+		}
+		/*
+		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
+		 * in_broadcast() should never return true on a received
+		 * packet with M_BCAST not set.
+ 		 *
+ 		 * Packets with a multicast source address should also
+ 		 * be discarded.
+		 */
+		if (m->m_flags & (M_BCAST|M_MCAST))
+			goto drop;
 #ifdef INET6
-			}
-#endif /* INET6 */
-			inp->inp_lport = th->th_dport;
-			if (in_pcbinshash(inp) != 0) {
+		if (isipv6) {
+			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
+			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
+				goto drop;
+		} else
+#endif
+		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
+		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
+		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST))
+			goto drop;
+		/*
+		 * SYN appears to be valid; create compressed TCP state
+		 * for syncache, or perform t/tcp connection.
+		 */
+		if (so->so_qlen <= so->so_qlimit) {
+			tcp_dooptions(&to, optp, optlen, 1);
+			if (!syncache_add(&inc, &to, th, &so, m))
+				goto drop;
+			if (so == NULL)
 				/*
-				 * Undo the assignments above if we failed to
-				 * put the PCB on the hash lists.
+				 * Entry added to syncache, mbuf used to
+				 * send SYN,ACK packet.
 				 */
-#ifdef INET6
-				if (isipv6)
-					inp->in6p_laddr = in6addr_any;
-				else
-#endif /* INET6 */
-				inp->inp_laddr.s_addr = INADDR_ANY;
-				inp->inp_lport = 0;
-				goto drop;
-			}
-#ifdef IPSEC
+				return;
 			/*
-			 * To avoid creating incorrectly cached IPsec
-			 * association, this is need to be done here.
-			 *
-			 * Subject: (KAME-snap 748)
-			 * From: Wayne Knowles <w.knowles@niwa.cri.nz>
-			 * ftp://ftp.kame.net/pub/mail-list/snap-users/748
+			 * Segment passed TAO tests.
 			 */
-			if ((thflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
-				/*
-				 * Note: dropwithreset makes sure we don't
-				 * send a RST in response to a RST.
-				 */
-				if (thflags & TH_ACK) {
-					tcpstat.tcps_badsyn++;
-					rstreason = BANDLIM_RST_OPENPORT;
-					goto dropwithreset;
-				}
-				goto drop;
-			}
+			inp = sotoinpcb(so);
+			tp = intotcpcb(inp);
+			tp->snd_wnd = tiwin;
+			tp->t_starttime = ticks;
+			tp->t_state = TCPS_ESTABLISHED;
+
+			/*
+			 * If there is a FIN, or if there is data and the
+			 * connection is local, then delay SYN,ACK(SYN) in
+			 * the hope of piggy-backing it on a response
+			 * segment.  Otherwise must send ACK now in case
+			 * the other side is slow starting.
+			 */
+			if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
+			    (tlen != 0 &&
+#ifdef INET6
+			      ((isipv6 && in6_localaddr(&inp->in6p_faddr))
+			      ||
+			      (!isipv6 &&
 #endif
+			    in_localaddr(inp->inp_faddr)
 #ifdef INET6
-			if (isipv6) {
-  				/*
- 				 * Inherit socket options from the listening
-  				 * socket.
- 				 * Note that in6p_inputopts are not (even
- 				 * should not be) copied, since it stores
-				 * previously received options and is used to
- 				 * detect if each new option is different than
- 				 * the previous one and hence should be passed
- 				 * to a user.
- 				 * If we copied in6p_inputopts, a user would
- 				 * not be able to receive options just after
- 				 * calling the accept system call.
- 				 */
-				inp->inp_flags |=
-					oinp->inp_flags & INP_CONTROLOPTS;
- 				if (oinp->in6p_outputopts)
- 					inp->in6p_outputopts =
- 						ip6_copypktopts(oinp->in6p_outputopts,
- 								M_NOWAIT);
-			} else
-#endif /* INET6 */
-			inp->inp_options = ip_srcroute();
-#ifdef IPSEC
-			/* copy old policy into new socket's */
-			if (ipsec_copy_policy(sotoinpcb(oso)->inp_sp,
-			                      inp->inp_sp))
-				printf("tcp_input: could not copy policy\n");
+			       ))
 #endif
-			tp = intotcpcb(inp);
-			tp->t_state = TCPS_LISTEN;
-			tp->t_flags |= tp0->t_flags & (TF_NOPUSH|TF_NOOPT);
-
-			/* Compute proper scaling value from buffer space */
-			while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
-			   TCP_MAXWIN << tp->request_r_scale <
-			   so->so_rcv.sb_hiwat)
-				tp->request_r_scale++;
+			     ))) {
+                                callout_reset(tp->tt_delack, tcp_delacktime,  
+                                    tcp_timer_delack, tp);  
+				tp->t_flags |= TF_NEEDSYN;
+			} else 
+				tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
+
+			tcpstat.tcps_connects++;
+			soisconnected(so);
+			goto trimthenstep6;
 		}
+		goto drop;
 	}
+after_listen:
+
+/* XXX temp debugging */
+	/* should not happen - syncache should pick up these connections */
+	if (tp->t_state == TCPS_LISTEN)
+		panic("tcp_input: TCPS_LISTEN");
 
 	/*
 	 * Segment received on connection.
@@ -872,11 +882,25 @@ findpcb:
 		callout_reset(tp->tt_keep, tcp_keepidle, tcp_timer_keep, tp);
 
 	/*
-	 * Process options if not in LISTEN state,
-	 * else do it below (after getting remote address).
+	 * Process options.
+	 * XXX this is tradtitional behavior, may need to be cleaned up.
 	 */
-	if (tp->t_state != TCPS_LISTEN)
-		tcp_dooptions(tp, optp, optlen, th, &to);
+	tcp_dooptions(&to, optp, optlen, thflags & TH_SYN);
+	if (thflags & TH_SYN) {
+		if (to.to_flags & TOF_SCALE) {
+			tp->t_flags |= TF_RCVD_SCALE;
+			tp->requested_s_scale = to.to_requested_s_scale;
+		}
+		if (to.to_flags & TOF_TS) {
+			tp->t_flags |= TF_RCVD_TSTMP;
+			tp->ts_recent = to.to_tsval;
+			tp->ts_recent_age = ticks;
+		}
+		if (to.to_flags & (TOF_CC|TOF_CCNEW))
+			tp->t_flags |= TF_RCVD_CC;
+		if (to.to_flags & TOF_MSS)
+			tcp_mss(tp, to.to_mss);
+	}
 
 	/*
 	 * Header prediction: check for the two common cases
@@ -898,7 +922,7 @@ findpcb:
 	if (tp->t_state == TCPS_ESTABLISHED &&
 	    (thflags & (TH_SYN|TH_FIN|TH_RST|TH_URG|TH_ACK)) == TH_ACK &&
 	    ((tp->t_flags & (TF_NEEDSYN|TF_NEEDFIN)) == 0) &&
-	    ((to.to_flag & TOF_TS) == 0 ||
+	    ((to.to_flags & TOF_TS) == 0 ||
 	     TSTMP_GEQ(to.to_tsval, tp->ts_recent)) &&
 	    /*
 	     * Using the CC option is compulsory if once started:
@@ -906,7 +930,7 @@ findpcb:
 	     *   if the segment has a CC option equal to CCrecv
 	     */
 	    ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) != (TF_REQ_CC|TF_RCVD_CC) ||
-	     ((to.to_flag & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
+	     ((to.to_flags & TOF_CC) != 0 && to.to_cc == tp->cc_recv)) &&
 	    th->th_seq == tp->rcv_nxt &&
 	    tiwin && tiwin == tp->snd_wnd &&
 	    tp->snd_nxt == tp->snd_max) {
@@ -917,7 +941,7 @@ findpcb:
 		 * NOTE that the test is modified according to the latest
 		 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
 		 */
-		if ((to.to_flag & TOF_TS) != 0 &&
+		if ((to.to_flags & TOF_TS) != 0 &&
 		   SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
 			tp->ts_recent_age = ticks;
 			tp->ts_recent = to.to_tsval;
@@ -943,7 +967,7 @@ findpcb:
 					tp->snd_nxt = tp->snd_max;
 					tp->t_badrxtwin = 0;
 				}
-				if ((to.to_flag & TOF_TS) != 0)
+				if ((to.to_flags & TOF_TS) != 0)
 					tcp_xmit_timer(tp,
 					    ticks - to.to_tsecr + 1);
 				else if (tp->t_rtttime &&
@@ -1025,209 +1049,6 @@ findpcb:
 	switch (tp->t_state) {
 
 	/*
-	 * If the state is LISTEN then ignore segment if it contains an RST.
-	 * If the segment contains an ACK then it is bad and send a RST.
-	 * If it does not contain a SYN then it is not interesting; drop it.
-	 * If it is from this socket, drop it, it must be forged.
-	 * Don't bother responding if the destination was a broadcast.
-	 * Otherwise initialize tp->rcv_nxt, and tp->irs, select an initial
-	 * tp->iss, and send a segment:
-	 *     <SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
-	 * Also initialize tp->snd_nxt to tp->iss+1 and tp->snd_una to tp->iss.
-	 * Fill in remote peer address fields if not previously specified.
-	 * Enter SYN_RECEIVED state, and process any other fields of this
-	 * segment in this state.
-	 */
-	case TCPS_LISTEN: {
-		register struct sockaddr_in *sin;
-#ifdef INET6
-		register struct sockaddr_in6 *sin6;
-#endif
-
-		if (thflags & TH_RST)
-			goto drop;
-		if (thflags & TH_ACK) {
-			rstreason = BANDLIM_RST_OPENPORT;
-			goto dropwithreset;
-		}
-		if ((thflags & TH_SYN) == 0)
-			goto drop;
-		if (th->th_dport == th->th_sport) {
-#ifdef INET6
-			if (isipv6) {
-				if (IN6_ARE_ADDR_EQUAL(&ip6->ip6_dst,
-						       &ip6->ip6_src))
-					goto drop;
-			} else
-#endif /* INET6 */
-			if (ip->ip_dst.s_addr == ip->ip_src.s_addr)
-				goto drop;
-		}
-		/*
-		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
-		 * in_broadcast() should never return true on a received
-		 * packet with M_BCAST not set.
- 		 *
- 		 * Packets with a multicast source address should also
- 		 * be discarded.
-		 */
-		if (m->m_flags & (M_BCAST|M_MCAST))
-			goto drop;
-#ifdef INET6
-		if (isipv6) {
-			if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
-			    IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
-				goto drop;
-		} else
-#endif
-		if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
-		    IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
-		    ip->ip_src.s_addr == htonl(INADDR_BROADCAST))
-			goto drop;
-#ifdef INET6
-		if (isipv6) {
-			MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
-			       M_SONAME, M_NOWAIT | M_ZERO);
-			if (sin6 == NULL)
-				goto drop;
-			sin6->sin6_family = AF_INET6;
-			sin6->sin6_len = sizeof(*sin6);
-			sin6->sin6_addr = ip6->ip6_src;
-			sin6->sin6_port = th->th_sport;
-			laddr6 = inp->in6p_laddr;
-			if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
-				inp->in6p_laddr = ip6->ip6_dst;
-			if (in6_pcbconnect(inp, (struct sockaddr *)sin6,
-					   thread0)) {
-				inp->in6p_laddr = laddr6;
-				FREE(sin6, M_SONAME);
-				goto drop;
-			}
-			FREE(sin6, M_SONAME);
-		} else
-#endif
-	      {
-		MALLOC(sin, struct sockaddr_in *, sizeof *sin, M_SONAME,
-		       M_NOWAIT);
-		if (sin == NULL)
-			goto drop;
-		sin->sin_family = AF_INET;
-		sin->sin_len = sizeof(*sin);
-		sin->sin_addr = ip->ip_src;
-		sin->sin_port = th->th_sport;
-		bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
-		laddr = inp->inp_laddr;
-		if (inp->inp_laddr.s_addr == INADDR_ANY)
-			inp->inp_laddr = ip->ip_dst;
-		if (in_pcbconnect(inp, (struct sockaddr *)sin, thread0)) {
-			inp->inp_laddr = laddr;
-			FREE(sin, M_SONAME);
-			goto drop;
-		}
-		FREE(sin, M_SONAME);
-	      }
-		if ((taop = tcp_gettaocache(inp)) == NULL) {
-			taop = &tao_noncached;
-			bzero(taop, sizeof(*taop));
-		}
-		tcp_dooptions(tp, optp, optlen, th, &to);
-		if (iss)
-			tp->iss = iss;
-		else {
-			tp->iss = tcp_new_isn(tp);
- 		}
-		tp->irs = th->th_seq;
-		tcp_sendseqinit(tp);
-		tcp_rcvseqinit(tp);
-		/*
-		 * Initialization of the tcpcb for transaction;
-		 *   set SND.WND = SEG.WND,
-		 *   initialize CCsend and CCrecv.
-		 */
-		tp->snd_wnd = tiwin;	/* initial send-window */
-		tp->cc_send = CC_INC(tcp_ccgen);
-		tp->cc_recv = to.to_cc;
-		/*
-		 * Perform TAO test on incoming CC (SEG.CC) option, if any.
-		 * - compare SEG.CC against cached CC from the same host,
-		 *	if any.
-		 * - if SEG.CC > chached value, SYN must be new and is accepted
-		 *	immediately: save new CC in the cache, mark the socket
-		 *	connected, enter ESTABLISHED state, turn on flag to
-		 *	send a SYN in the next segment.
-		 *	A virtual advertised window is set in rcv_adv to
-		 *	initialize SWS prevention.  Then enter normal segment
-		 *	processing: drop SYN, process data and FIN.
-		 * - otherwise do a normal 3-way handshake.
-		 */
-		if ((to.to_flag & TOF_CC) != 0) {
-		    if (((tp->t_flags & TF_NOPUSH) != 0) &&
-			taop->tao_cc != 0 && CC_GT(to.to_cc, taop->tao_cc)) {
-
-			taop->tao_cc = to.to_cc;
-			tp->t_starttime = ticks;
-			tp->t_state = TCPS_ESTABLISHED;
-
-			/*
-			 * If there is a FIN, or if there is data and the
-			 * connection is local, then delay SYN,ACK(SYN) in
-			 * the hope of piggy-backing it on a response
-			 * segment.  Otherwise must send ACK now in case
-			 * the other side is slow starting.
-			 */
-			if (DELAY_ACK(tp) && ((thflags & TH_FIN) ||
-			    (tlen != 0 &&
-#ifdef INET6
-			      ((isipv6 && in6_localaddr(&inp->in6p_faddr))
-			      ||
-			      (!isipv6 &&
-#endif
-			    in_localaddr(inp->inp_faddr)
-#ifdef INET6
-			       ))
-#endif
-			     ))) {
-                                callout_reset(tp->tt_delack, tcp_delacktime,  
-                                    tcp_timer_delack, tp);  
-				tp->t_flags |= TF_NEEDSYN;
-			} else 
-				tp->t_flags |= (TF_ACKNOW | TF_NEEDSYN);
-
-			/*
-			 * Limit the `virtual advertised window' to TCP_MAXWIN
-			 * here.  Even if we requested window scaling, it will
-			 * become effective only later when our SYN is acked.
-			 */
-			tp->rcv_adv += min(tp->rcv_wnd, TCP_MAXWIN);
-			tcpstat.tcps_connects++;
-			soisconnected(so);
-			callout_reset(tp->tt_keep, tcp_keepinit,
-				      tcp_timer_keep, tp);
-			dropsocket = 0;		/* committed to socket */
-			tcpstat.tcps_accepts++;
-			goto trimthenstep6;
-		    }
-		/* else do standard 3-way handshake */
-		} else {
-		    /*
-		     * No CC option, but maybe CC.NEW:
-		     *   invalidate cached value.
-		     */
-		     taop->tao_cc = 0;
-		}
-		/*
-		 * TAO test failed or there was no CC option,
-		 *    do a standard 3-way handshake.
-		 */
-		tp->t_flags |= TF_ACKNOW;
-		tp->t_state = TCPS_SYN_RECEIVED;
-		callout_reset(tp->tt_keep, tcp_keepinit, tcp_timer_keep, tp);
-		dropsocket = 0;		/* committed to socket */
-		tcpstat.tcps_accepts++;
-		goto trimthenstep6;
-		}
-
-	/*
 	 * If the state is SYN_RECEIVED:
 	 *	if seg contains an ACK, but not for our SYN/ACK, send a RST.
 	 */
@@ -1253,7 +1074,7 @@ findpcb:
 	 *	continue processing rest of data/controls, beginning with URG
 	 */
 	case TCPS_SYN_SENT:
-		if ((taop = tcp_gettaocache(inp)) == NULL) {
+		if ((taop = tcp_gettaocache(&inp->inp_inc)) == NULL) {
 			taop = &tao_noncached;
 			bzero(taop, sizeof(*taop));
 		}
@@ -1297,7 +1118,7 @@ findpcb:
 			 * by the old rules.  If no CC.ECHO option, make sure
 			 * we don't get fooled into using T/TCP.
 			 */
-			if (to.to_flag & TOF_CCECHO) {
+			if (to.to_flags & TOF_CCECHO) {
 				if (tp->cc_send != to.to_ccecho) {
 					if (taop->tao_ccsent != 0)
 						goto drop;
@@ -1359,7 +1180,7 @@ findpcb:
 		 */
 			tp->t_flags |= TF_ACKNOW;
 			callout_stop(tp->tt_rexmt);
-			if (to.to_flag & TOF_CC) {
+			if (to.to_flags & TOF_CC) {
 				if (taop->tao_cc != 0 &&
 				    CC_GT(to.to_cc, taop->tao_cc)) {
 					/*
@@ -1434,7 +1255,7 @@ trimthenstep6:
 	case TCPS_CLOSING:
 	case TCPS_TIME_WAIT:
 		if ((thflags & TH_SYN) &&
-		    (to.to_flag & TOF_CC) && tp->cc_recv != 0) {
+		    (to.to_flags & TOF_CC) && tp->cc_recv != 0) {
 			if (tp->t_state == TCPS_TIME_WAIT &&
 					(ticks - tp->t_starttime) > tcp_msl) {
 				rstreason = BANDLIM_UNLIMITED;
@@ -1542,7 +1363,7 @@ trimthenstep6:
 	 * RFC 1323 PAWS: If we have a timestamp reply on this segment
 	 * and it's less than ts_recent, drop it.
 	 */
-	if ((to.to_flag & TOF_TS) != 0 && tp->ts_recent &&
+	if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
 	    TSTMP_LT(to.to_tsval, tp->ts_recent)) {
 
 		/* Check to see if ts_recent is over 24 days old.  */
@@ -1574,7 +1395,7 @@ trimthenstep6:
 	 *   RST segments do not have to comply with this.
 	 */
 	if ((tp->t_flags & (TF_REQ_CC|TF_RCVD_CC)) == (TF_REQ_CC|TF_RCVD_CC) &&
-	    ((to.to_flag & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
+	    ((to.to_flags & TOF_CC) == 0 || tp->cc_recv != to.to_cc))
  		goto dropafterack;
 
 	/*
@@ -1694,7 +1515,7 @@ trimthenstep6:
 	 * NOTE that the test is modified according to the latest
 	 * proposal of the tcplw@cray.com list (Braden 1993/04/26).
 	 */
-	if ((to.to_flag & TOF_TS) != 0 &&
+	if ((to.to_flags & TOF_TS) != 0 &&
 	    SEQ_LEQ(th->th_seq, tp->last_ack_sent)) {
 		tp->ts_recent_age = ticks;
 		tp->ts_recent = to.to_tsval;
@@ -1748,7 +1569,7 @@ trimthenstep6:
 		 * update cache.CC if it was undefined, pass any queued
 		 * data to the user, and advance state appropriately.
 		 */
-		if ((taop = tcp_gettaocache(inp)) != NULL &&
+		if ((taop = tcp_gettaocache(&inp->inp_inc)) != NULL &&
 		    taop->tao_cc == 0)
 			taop->tao_cc = tp->cc_recv;
 
@@ -1940,7 +1761,7 @@ process_ACK:
 		 * timer backoff (cf., Phil Karn's retransmit alg.).
 		 * Recompute the initial retransmit timer.
 		 */
-		if (to.to_flag & TOF_TS)
+		if (to.to_flags & TOF_TS)
 			tcp_xmit_timer(tp, ticks - to.to_tsecr + 1);
 		else if (tp->t_rtttime && SEQ_GT(th->th_ack, tp->t_rtseq))
 			tcp_xmit_timer(tp, ticks - tp->t_rtttime);
@@ -2371,9 +2192,6 @@ dropwithreset:
 		tcp_respond(tp, mtod(m, void *), th, m, th->th_seq+tlen,
 			    (tcp_seq)0, TH_RST|TH_ACK);
 	}
-	/* destroy temporarily created socket */
-	if (dropsocket)
-		(void) soabort(so);
 	return;
 
 drop:
@@ -2386,23 +2204,21 @@ drop:
 			  &tcp_savetcp, 0);
 #endif
 	m_freem(m);
-	/* destroy temporarily created socket */
-	if (dropsocket)
-		(void) soabort(so);
 	return;
 }
 
+/*
+ * Parse TCP options and place in tcpopt.
+ */
 static void
-tcp_dooptions(tp, cp, cnt, th, to)
-	struct tcpcb *tp;
+tcp_dooptions(to, cp, cnt, is_syn)
+	struct tcpopt *to;
 	u_char *cp;
 	int cnt;
-	struct tcphdr *th;
-	struct tcpopt *to;
 {
-	u_short mss = 0;
 	int opt, optlen;
 
+	to->to_flags = 0;
 	for (; cnt > 0; cnt -= optlen, cp += optlen) {
 		opt = cp[0];
 		if (opt == TCPOPT_EOL)
@@ -2417,92 +2233,67 @@ tcp_dooptions(tp, cp, cnt, th, to)
 				break;
 		}
 		switch (opt) {
-
-		default:
-			continue;
-
 		case TCPOPT_MAXSEG:
 			if (optlen != TCPOLEN_MAXSEG)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			bcopy((char *) cp + 2, (char *) &mss, sizeof(mss));
-			NTOHS(mss);
+			to->to_flags |= TOF_MSS;
+			bcopy((char *)cp + 2,
+			    (char *)&to->to_mss, sizeof(to->to_mss));
+			NTOHS(to->to_mss);
 			break;
-
 		case TCPOPT_WINDOW:
 			if (optlen != TCPOLEN_WINDOW)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (! is_syn)
 				continue;
-			tp->t_flags |= TF_RCVD_SCALE;
-			tp->requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
+			to->to_flags |= TOF_SCALE;
+			to->to_requested_s_scale = min(cp[2], TCP_MAX_WINSHIFT);
 			break;
-
 		case TCPOPT_TIMESTAMP:
 			if (optlen != TCPOLEN_TIMESTAMP)
 				continue;
-			to->to_flag |= TOF_TS;
+			to->to_flags |= TOF_TS;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_tsval, sizeof(to->to_tsval));
 			NTOHL(to->to_tsval);
 			bcopy((char *)cp + 6,
 			    (char *)&to->to_tsecr, sizeof(to->to_tsecr));
 			NTOHL(to->to_tsecr);
-
-			/*
-			 * A timestamp received in a SYN makes
-			 * it ok to send timestamp requests and replies.
-			 */
-			if (th->th_flags & TH_SYN) {
-				tp->t_flags |= TF_RCVD_TSTMP;
-				tp->ts_recent = to->to_tsval;
-				tp->ts_recent_age = ticks;
-			}
 			break;
 		case TCPOPT_CC:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			to->to_flag |= TOF_CC;
+			to->to_flags |= TOF_CC;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_cc, sizeof(to->to_cc));
 			NTOHL(to->to_cc);
-			/*
-			 * A CC or CC.new option received in a SYN makes
-			 * it ok to send CC in subsequent segments.
-			 */
-			if (th->th_flags & TH_SYN)
-				tp->t_flags |= TF_RCVD_CC;
 			break;
 		case TCPOPT_CCNEW:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			to->to_flag |= TOF_CCNEW;
+			to->to_flags |= TOF_CCNEW;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_cc, sizeof(to->to_cc));
 			NTOHL(to->to_cc);
-			/*
-			 * A CC or CC.new option received in a SYN makes
-			 * it ok to send CC in subsequent segments.
-			 */
-			tp->t_flags |= TF_RCVD_CC;
 			break;
 		case TCPOPT_CCECHO:
 			if (optlen != TCPOLEN_CC)
 				continue;
-			if (!(th->th_flags & TH_SYN))
+			if (!is_syn)
 				continue;
-			to->to_flag |= TOF_CCECHO;
+			to->to_flags |= TOF_CCECHO;
 			bcopy((char *)cp + 2,
 			    (char *)&to->to_ccecho, sizeof(to->to_ccecho));
 			NTOHL(to->to_ccecho);
 			break;
+		default:
+			continue;
 		}
 	}
-	if (th->th_flags & TH_SYN)
-		tcp_mss(tp, mss);	/* sets t_maxseg */
 }
 
 /*
@@ -2675,10 +2466,10 @@ tcp_mss(tp, offer)
 #endif
 #ifdef INET6
 	if (isipv6)
-		rt = tcp_rtlookup6(inp);
+		rt = tcp_rtlookup6(&inp->inp_inc);
 	else
 #endif
-	rt = tcp_rtlookup(inp);
+	rt = tcp_rtlookup(&inp->inp_inc);
 	if (rt == NULL) {
 		tp->t_maxopd = tp->t_maxseg =
 #ifdef INET6
@@ -2884,10 +2675,10 @@ tcp_mssopt(tp)
 #endif
 #ifdef INET6
 	if (isipv6)
-		rt = tcp_rtlookup6(tp->t_inpcb);
+		rt = tcp_rtlookup6(&tp->t_inpcb->inp_inc);
 	else
 #endif /* INET6 */
-	rt = tcp_rtlookup(tp->t_inpcb);
+	rt = tcp_rtlookup(&tp->t_inpcb->inp_inc);
 	if (rt == NULL)
 		return
 #ifdef INET6
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index 6a6c9f8..27d54eb 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -117,11 +117,11 @@ SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
     &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
 #endif
 
-static int	tcp_do_rfc1323 = 1;
+int	tcp_do_rfc1323 = 1;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW, 
     &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
 
-static int	tcp_do_rfc1644 = 0;
+int	tcp_do_rfc1644 = 0;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW, 
     &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
 
@@ -224,6 +224,8 @@ tcp_init()
 	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
 		panic("tcp_init");
 #undef TCP_MINPROTOHDR
+
+	syncache_init();
 }
 
 /*
@@ -710,18 +712,6 @@ tcp_close(tp)
 			tcpstat.tcps_cachedssthresh++;
 		}
 	}
-	rt = inp->inp_route.ro_rt;
-	if (rt) {
-		/* 
-		 * mark route for deletion if no information is
-		 * cached.
-		 */
-		if ((tp->t_flags & TF_LQ_OVERFLOW) &&
-		    ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0)){
-			if (rt->rt_rmx.rmx_rtt == 0)
-				rt->rt_flags |= RTF_DELCLONE;
-		}
-	}
     no_valid_rt:
 	/* free the reassembly queue, if any */
 	while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
@@ -1047,6 +1037,17 @@ tcp_ctlinput(cmd, sa, vip)
 			if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
 			    SEQ_LT(icmp_seq, tp->snd_max))
 				(*notify)(inp, inetctlerrmap[cmd]);
+		} else {
+			struct in_conninfo inc;
+
+			inc.inc_fport = th->th_dport;
+			inc.inc_lport = th->th_sport;
+			inc.inc_faddr = faddr;
+			inc.inc_laddr = ip->ip_src;
+#ifdef INET6
+			inc.inc_isipv6 = 0;
+#endif
+			syncache_unreach(&inc, th);
 		}
 		splx(s);
 	} else
@@ -1099,6 +1100,7 @@ tcp6_ctlinput(cmd, sa, d)
 	}
 
 	if (ip6) {
+		struct in_conninfo inc;
 		/*
 		 * XXX: We assume that when IPV6 is non NULL,
 		 * M and OFF are valid.
@@ -1114,6 +1116,13 @@ tcp6_ctlinput(cmd, sa, d)
 		in6_pcbnotify(&tcb, sa, th.th_dport,
 		    (struct sockaddr *)ip6cp->ip6c_src,
 		    th.th_sport, cmd, notify);
+
+		inc.inc_fport = th.th_dport;
+		inc.inc_lport = th.th_sport;
+		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
+		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
+		inc.inc_isipv6 = 1;
+		syncache_unreach(&inc, &th);
 	} else
 		in6_pcbnotify(&tcb, sa, 0, (struct sockaddr *)sa6_src,
 			      0, cmd, notify);
@@ -1271,10 +1280,10 @@ tcp_mtudisc(inp, errno)
 	if (tp) {
 #ifdef INET6
 		if (isipv6)
-			rt = tcp_rtlookup6(inp);
+			rt = tcp_rtlookup6(&inp->inp_inc);
 		else
 #endif /* INET6 */
-		rt = tcp_rtlookup(inp);
+		rt = tcp_rtlookup(&inp->inp_inc);
 		if (!rt || !rt->rt_rmx.rmx_mtu) {
 			tp->t_maxopd = tp->t_maxseg =
 #ifdef INET6
@@ -1351,21 +1360,21 @@ tcp_mtudisc(inp, errno)
  * to get the interface MTU.
  */
 struct rtentry *
-tcp_rtlookup(inp)
-	struct inpcb *inp;
+tcp_rtlookup(inc)
+	struct in_conninfo *inc;
 {
 	struct route *ro;
 	struct rtentry *rt;
 
-	ro = &inp->inp_route;
+	ro = &inc->inc_route;
 	rt = ro->ro_rt;
 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
 		/* No route yet, so try to acquire one */
-		if (inp->inp_faddr.s_addr != INADDR_ANY) {
+		if (inc->inc_faddr.s_addr != INADDR_ANY) {
 			ro->ro_dst.sa_family = AF_INET;
 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
-				inp->inp_faddr;
+			    inc->inc_faddr;
 			rtalloc(ro);
 			rt = ro->ro_rt;
 		}
@@ -1375,23 +1384,20 @@ tcp_rtlookup(inp)
 
 #ifdef INET6
 struct rtentry *
-tcp_rtlookup6(inp)
-	struct inpcb *inp;
+tcp_rtlookup6(inc)
+	struct in_conninfo *inc;
 {
 	struct route_in6 *ro6;
 	struct rtentry *rt;
 
-	ro6 = &inp->in6p_route;
+	ro6 = &inc->inc6_route;
 	rt = ro6->ro_rt;
 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
 		/* No route yet, so try to acquire one */
-		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
-			struct sockaddr_in6 *dst6;
-
-			dst6 = (struct sockaddr_in6 *)&ro6->ro_dst;
-			dst6->sin6_family = AF_INET6;
-			dst6->sin6_len = sizeof(*dst6);
-			dst6->sin6_addr = inp->in6p_faddr;
+		if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
+			ro6->ro_dst.sin6_family = AF_INET6;
+			ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
+			ro6->ro_dst.sin6_addr = inc->inc6_faddr;
 			rtalloc((struct route *)ro6);
 			rt = ro6->ro_rt;
 		}
@@ -1450,17 +1456,17 @@ ipsec_hdrsiz_tcp(tp)
  * the route metrics.
  */
 struct rmxp_tao *
-tcp_gettaocache(inp)
-	struct inpcb *inp;
+tcp_gettaocache(inc)
+	struct in_conninfo *inc;
 {
 	struct rtentry *rt;
 
 #ifdef INET6
-	if ((inp->inp_vflag & INP_IPV6) != 0)
-		rt = tcp_rtlookup6(inp);
+	if (inc->inc_isipv6)
+		rt = tcp_rtlookup6(inc);
 	else
 #endif /* INET6 */
-	rt = tcp_rtlookup(inp);
+	rt = tcp_rtlookup(inc);
 
 	/* Make sure this is a host route and is up. */
 	if (rt == NULL ||
diff --git a/sys/netinet/tcp_syncache.c b/sys/netinet/tcp_syncache.c
new file mode 100644
index 0000000..73860e0
--- /dev/null
+++ b/sys/netinet/tcp_syncache.c
@@ -0,0 +1,1161 @@
+/*-
+ * Copyright (c) 2001 Networks Associates Technologies, Inc.
+ * All rights reserved.
+ *
+ * This software was developed for the FreeBSD Project by Jonathan Lemon
+ * and NAI Labs, the Security Research Division of Network Associates, Inc.
+ * under DARPA/SPAWAR contract N66001-01-C-8035 ("CBOSS"), as part of the
+ * DARPA CHATS research program.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 3. The name of the author may not be used to endorse or promote
+ *    products derived from this software without specific prior written
+ *    permission.
+ *
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#include "opt_inet6.h"
+#include "opt_ipsec.h"
+
+#include <sys/param.h>
+#include <sys/systm.h>
+#include <sys/kernel.h>
+#include <sys/sysctl.h>
+#include <sys/malloc.h>
+#include <sys/mbuf.h>
+#include <sys/md5.h>
+#include <sys/proc.h>		/* for proc0 declaration */
+#include <sys/random.h>
+#include <sys/socket.h>
+#include <sys/socketvar.h>
+
+#include <net/if.h>
+#include <net/route.h>
+
+#include <netinet/in.h>
+#include <netinet/in_systm.h>
+#include <netinet/ip.h>
+#include <netinet/in_var.h>
+#include <netinet/in_pcb.h>
+#include <netinet/ip_var.h>
+#ifdef INET6
+#include <netinet/ip6.h>
+#include <netinet/icmp6.h>
+#include <netinet6/nd6.h>
+#include <netinet6/ip6_var.h>
+#include <netinet6/in6_pcb.h>
+#endif
+#include <netinet/tcp.h>
+#include <netinet/tcp_fsm.h>
+#include <netinet/tcp_seq.h>
+#include <netinet/tcp_timer.h>
+#include <netinet/tcp_var.h>
+#ifdef INET6
+#include <netinet6/tcp6_var.h>
+#endif
+
+#ifdef IPSEC
+#include <netinet6/ipsec.h>
+#ifdef INET6
+#include <netinet6/ipsec6.h>
+#endif
+#include <netkey/key.h>
+#endif /*IPSEC*/
+
+#include <machine/in_cksum.h>
+#include <vm/vm_zone.h>
+
+static void	 syncache_drop(struct syncache *, struct syncache_head *);
+static void	 syncache_free(struct syncache *);
+static int	 syncache_insert(struct syncache *, struct syncache_head *);
+struct syncache *syncache_lookup(struct in_conninfo *, struct syncache_head **);
+static int	 syncache_respond(struct syncache *, struct mbuf *);
+static struct 	 socket *syncache_socket(struct syncache *, struct socket *);
+static void	 syncache_timer(void *);
+
+/*
+ * Transmit the SYN,ACK fewer times than TCP_MAXRXTSHIFT specifies.
+ * 3 retransmits corresponds to a timeout of (1 + 2 + 4 + 8 == 15) seconds,
+ * the odds are that the user has given up attempting to connect by then.
+ */
+#define SYNCACHE_MAXREXMTS		3
+
+/* Arbitrary values */
+#define TCP_SYNCACHE_HASHSIZE		512
+#define TCP_SYNCACHE_BUCKETLIMIT	30
+
+struct tcp_syncache {
+	struct	syncache_head *hashbase;
+	struct	vm_zone *zone;
+	u_int	hashsize;
+	u_int	hashmask;
+	u_int	bucket_limit;
+	u_int	cache_count;
+	u_int	cache_limit;
+	u_int	rexmt_limit;
+	u_int	hash_secret;
+	u_int	next_reseed;
+	TAILQ_HEAD(, syncache) timerq[SYNCACHE_MAXREXMTS + 1];
+	struct	callout tt_timerq[SYNCACHE_MAXREXMTS + 1];
+};
+static struct tcp_syncache tcp_syncache;
+
+SYSCTL_NODE(_net_inet_tcp, OID_AUTO, syncache, CTLFLAG_RW, 0, "TCP SYN cache");
+
+SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, bucketlimit, CTLFLAG_RD,
+     &tcp_syncache.bucket_limit, 0, "Per-bucket hash limit for syncache");
+
+SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, cachelimit, CTLFLAG_RD,
+     &tcp_syncache.cache_limit, 0, "Overall entry limit for syncache");
+
+SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, count, CTLFLAG_RD,
+     &tcp_syncache.cache_count, 0, "Current number of entries in syncache");
+
+SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, hashsize, CTLFLAG_RD,
+     &tcp_syncache.hashsize, 0, "Size of TCP syncache hashtable");
+
+SYSCTL_INT(_net_inet_tcp_syncache, OID_AUTO, rexmtlimit, CTLFLAG_RW,
+     &tcp_syncache.rexmt_limit, 0, "Limit on SYN/ACK retransmissions");
+
+static MALLOC_DEFINE(M_SYNCACHE, "syncache", "TCP syncache");
+
+#define SYNCACHE_HASH(inc, mask) 					\
+	((tcp_syncache.hash_secret ^					\
+	  (inc)->inc_faddr.s_addr ^					\
+	  ((inc)->inc_faddr.s_addr >> 16) ^ 				\
+	  (inc)->inc_fport ^ (inc)->inc_lport) & mask)
+
+#define SYNCACHE_HASH6(inc, mask) 					\
+	((tcp_syncache.hash_secret ^					\
+	  (inc)->inc6_faddr.s6_addr32[0] ^ 				\
+	  (inc)->inc6_faddr.s6_addr32[3] ^ 				\
+	  (inc)->inc_fport ^ (inc)->inc_lport) & mask)
+
+#define ENDPTS_EQ(a, b) (						\
+	(a)->ie_fport == (a)->ie_fport &&				\
+	(a)->ie_lport == (b)->ie_lport &&				\
+	(a)->ie_faddr.s_addr == (b)->ie_faddr.s_addr &&			\
+	(a)->ie_laddr.s_addr == (b)->ie_laddr.s_addr			\
+)
+
+#define ENDPTS6_EQ(a, b) (memcmp(a, b, sizeof(*a)) == 0)
+
+#define SYNCACHE_TIMEOUT(sc, slot) do {					\
+	sc->sc_rxtslot = slot;						\
+	sc->sc_rxttime = ticks + TCPTV_RTOBASE * tcp_backoff[slot];	\
+	TAILQ_INSERT_TAIL(&tcp_syncache.timerq[slot], sc, sc_timerq);	\
+	if (!callout_active(&tcp_syncache.tt_timerq[slot]))		\
+		callout_reset(&tcp_syncache.tt_timerq[slot],		\
+		    TCPTV_RTOBASE * tcp_backoff[slot],			\
+		    syncache_timer, (void *)((int)slot));		\
+} while (0)
+
+static void
+syncache_free(struct syncache *sc)
+{
+	struct rtentry *rt;
+
+	if (sc->sc_ipopts)
+		(void) m_free(sc->sc_ipopts);
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6)
+		rt = sc->sc_route6.ro_rt;
+	else
+#endif
+		rt = sc->sc_route.ro_rt;
+	if (rt != NULL) {
+		/*
+		 * If this is the only reference to a protocol cloned 
+		 * route, remove it immediately.
+		 */
+		if (rt->rt_flags & RTF_WASCLONED &&
+		    (sc->sc_flags & SCF_KEEPROUTE) == 0 &&
+		    rt->rt_refcnt == 1)
+			rtrequest(RTM_DELETE, rt_key(rt),
+			    rt->rt_gateway, rt_mask(rt),
+			    rt->rt_flags, NULL);
+		RTFREE(rt);
+	}
+	zfree(tcp_syncache.zone, sc);
+}
+
+void
+syncache_init(void)
+{
+	int i;
+
+	tcp_syncache.cache_count = 0;
+	tcp_syncache.hashsize = TCP_SYNCACHE_HASHSIZE;
+	tcp_syncache.bucket_limit = TCP_SYNCACHE_BUCKETLIMIT;
+	tcp_syncache.cache_limit =
+	    tcp_syncache.hashsize * tcp_syncache.bucket_limit;
+	tcp_syncache.rexmt_limit = SYNCACHE_MAXREXMTS;
+	tcp_syncache.next_reseed = 0;
+	tcp_syncache.hash_secret = arc4random();
+
+        TUNABLE_INT_FETCH("net.inet.tcp.syncache.hashsize",
+	    &tcp_syncache.hashsize);
+        TUNABLE_INT_FETCH("net.inet.tcp.syncache.cachelimit",
+	    &tcp_syncache.cache_limit);
+        TUNABLE_INT_FETCH("net.inet.tcp.syncache.bucketlimit",
+	    &tcp_syncache.bucket_limit);
+	if (!powerof2(tcp_syncache.hashsize)) {
+                printf("WARNING: syncache hash size is not a power of 2.\n");
+		tcp_syncache.hashsize = 512;	/* safe default */
+        }
+	tcp_syncache.hashmask = tcp_syncache.hashsize - 1;
+
+	/* Allocate the hash table. */
+	MALLOC(tcp_syncache.hashbase, struct syncache_head *,
+	    tcp_syncache.hashsize * sizeof(struct syncache_head),
+	    M_SYNCACHE, M_WAITOK);
+
+	/* Initialize the hash buckets. */
+	for (i = 0; i < tcp_syncache.hashsize; i++) {
+		TAILQ_INIT(&tcp_syncache.hashbase[i].sch_bucket);
+		tcp_syncache.hashbase[i].sch_length = 0;
+	}
+
+	/* Initialize the timer queues. */
+	for (i = 0; i <= TCP_MAXRXTSHIFT; i++) {
+		TAILQ_INIT(&tcp_syncache.timerq[i]);
+		callout_init(&tcp_syncache.tt_timerq[i], 0);
+	}
+
+	/*
+	 * Allocate the syncache entries.  Allow the zone to allocate one
+	 * more entry than cache limit, so a new entry can bump out an
+	 * older one.
+	 */
+	tcp_syncache.cache_limit -= 1;
+	tcp_syncache.zone = zinit("syncache", sizeof(struct syncache),
+	    tcp_syncache.cache_limit, ZONE_INTERRUPT, 0);
+}
+
+static int
+syncache_insert(sc, sch)
+	struct syncache *sc;
+	struct syncache_head *sch;
+{
+	struct syncache *sc2;
+	int s, i;
+
+	/*
+	 * Make sure that we don't overflow the per-bucket
+	 * limit or the total cache size limit.
+	 */
+	s = splnet();
+	if (sch->sch_length >= tcp_syncache.bucket_limit) {
+		/*
+		 * The bucket is full, toss the oldest element.
+		 */
+		sc2 = TAILQ_FIRST(&sch->sch_bucket);
+		syncache_drop(sc2, sch);
+		tcpstat.tcps_sc_bucketoverflow++;
+	} else if (tcp_syncache.cache_count >= tcp_syncache.cache_limit) {
+		/*
+		 * The cache is full.  Toss the oldest entry in the
+		 * entire cache.  This is the front entry in the
+		 * first non-empty timer queue with the largest
+		 * timeout value.
+		 */
+		for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
+			sc2 = TAILQ_FIRST(&tcp_syncache.timerq[i]);
+			if (sc2 != NULL)
+				break;
+		}
+		syncache_drop(sc2, NULL);
+		tcpstat.tcps_sc_cacheoverflow++;
+	}
+
+	/* Initialize the entry's timer. */
+	SYNCACHE_TIMEOUT(sc, 0);
+
+	/* Put it into the bucket. */
+	TAILQ_INSERT_TAIL(&sch->sch_bucket, sc, sc_hash);
+	sch->sch_length++;
+	tcp_syncache.cache_count++;
+	tcpstat.tcps_sc_added++;
+	splx(s);
+	return (1);
+}
+
+static void
+syncache_drop(sc, sch)
+	struct syncache *sc;
+	struct syncache_head *sch;
+{
+	int s;
+
+	if (sch == NULL) {
+#ifdef INET6
+		if (sc->sc_inc.inc_isipv6) {
+			sch = &tcp_syncache.hashbase[
+			    SYNCACHE_HASH6(&sc->sc_inc, tcp_syncache.hashmask)];
+		} else
+#endif
+		{
+			sch = &tcp_syncache.hashbase[
+			    SYNCACHE_HASH(&sc->sc_inc, tcp_syncache.hashmask)];
+		}
+	}
+
+	s = splnet();
+
+	TAILQ_REMOVE(&sch->sch_bucket, sc, sc_hash);
+	sch->sch_length--;
+	tcp_syncache.cache_count--;
+
+	TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot], sc, sc_timerq);
+	if (TAILQ_EMPTY(&tcp_syncache.timerq[sc->sc_rxtslot]))
+		callout_stop(&tcp_syncache.tt_timerq[sc->sc_rxtslot]);
+	splx(s);
+
+	syncache_free(sc);
+}
+
+/*
+ * Walk the timer queues, looking for SYN,ACKs that need to be retransmitted.
+ * If we have retransmitted an entry the maximum number of times, expire it.
+ */
+static void
+syncache_timer(xslot)
+	void *xslot;
+{
+	int slot = (int)xslot;
+	struct syncache *sc, *nsc;
+	struct inpcb *inp;
+	int s;
+
+	s = splnet();
+        if (callout_pending(&tcp_syncache.tt_timerq[slot]) ||
+            !callout_active(&tcp_syncache.tt_timerq[slot])) {
+                splx(s);
+                return;
+        }
+        callout_deactivate(&tcp_syncache.tt_timerq[slot]);
+
+        nsc = TAILQ_FIRST(&tcp_syncache.timerq[slot]);
+	while (nsc != NULL) {
+		if (ticks < nsc->sc_rxttime)
+			break;
+		sc = nsc;
+		nsc = TAILQ_NEXT(sc, sc_timerq);
+		inp = sc->sc_tp->t_inpcb;
+		if (slot == SYNCACHE_MAXREXMTS ||
+		    slot >= tcp_syncache.rexmt_limit ||
+		    inp->inp_gencnt != sc->sc_inp_gencnt) {
+			syncache_drop(sc, NULL);
+			tcpstat.tcps_sc_stale++;
+			continue;
+		}
+		(void) syncache_respond(sc, NULL);
+		tcpstat.tcps_sc_retransmitted++;
+		TAILQ_REMOVE(&tcp_syncache.timerq[slot], sc, sc_timerq);
+		SYNCACHE_TIMEOUT(sc, slot + 1);
+	}
+	if (nsc != NULL)
+		callout_reset(&tcp_syncache.tt_timerq[slot],
+		    nsc->sc_rxttime - ticks, syncache_timer, (void *)(slot));
+	splx(s);
+}
+
+/*
+ * Find an entry in the syncache.
+ */
+struct syncache *
+syncache_lookup(inc, schp)
+	struct in_conninfo *inc;
+	struct syncache_head **schp;
+{
+	struct syncache *sc;
+	struct syncache_head *sch;
+	int s;
+
+#ifdef INET6
+	if (inc->inc_isipv6) {
+		sch = &tcp_syncache.hashbase[
+		    SYNCACHE_HASH6(inc, tcp_syncache.hashmask)];
+		*schp = sch;
+		s = splnet();
+		TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
+			if (ENDPTS6_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
+				splx(s);
+				return (sc);
+			}
+		}
+		splx(s);
+	} else
+#endif
+	{
+		sch = &tcp_syncache.hashbase[
+		    SYNCACHE_HASH(inc, tcp_syncache.hashmask)];
+		*schp = sch;
+		s = splnet();
+		TAILQ_FOREACH(sc, &sch->sch_bucket, sc_hash) {
+#ifdef INET6
+			if (sc->sc_inc.inc_isipv6)
+				continue;
+#endif
+			if (ENDPTS_EQ(&inc->inc_ie, &sc->sc_inc.inc_ie)) {
+				splx(s);
+				return (sc);
+			}
+		}
+		splx(s);
+	}
+	return (NULL);
+}
+
+/*
+ * This function is called when we get a RST for a
+ * non-existent connection, so that we can see if the
+ * connection is in the syn cache.  If it is, zap it.
+ */
+void
+syncache_chkrst(inc, th)
+	struct in_conninfo *inc;
+	struct tcphdr *th;
+{
+	struct syncache *sc;
+	struct syncache_head *sch;
+
+	sc = syncache_lookup(inc, &sch);
+	if (sc == NULL)
+		return;
+	/*
+	 * If the RST bit is set, check the sequence number to see
+	 * if this is a valid reset segment.
+	 * RFC 793 page 37:
+	 *   In all states except SYN-SENT, all reset (RST) segments
+	 *   are validated by checking their SEQ-fields.  A reset is
+	 *   valid if its sequence number is in the window.
+	 *
+	 *   The sequence number in the reset segment is normally an
+	 *   echo of our outgoing acknowlegement numbers, but some hosts
+	 *   send a reset with the sequence number at the rightmost edge
+	 *   of our receive window, and we have to handle this case.
+	 */
+	if (SEQ_GEQ(th->th_seq, sc->sc_irs) &&
+	    SEQ_LEQ(th->th_seq, sc->sc_irs + sc->sc_wnd)) {
+		syncache_drop(sc, sch);
+		tcpstat.tcps_sc_reset++;
+	}
+}
+
+void
+syncache_badack(inc)
+	struct in_conninfo *inc;
+{
+	struct syncache *sc;
+	struct syncache_head *sch;
+
+	sc = syncache_lookup(inc, &sch);
+	if (sc != NULL) {
+		syncache_drop(sc, sch);
+		tcpstat.tcps_sc_badack++;
+	}
+}
+
+void
+syncache_unreach(inc, th)
+	struct in_conninfo *inc;
+	struct tcphdr *th;
+{
+	struct syncache *sc;
+	struct syncache_head *sch;
+
+	/* we are called at splnet() here */
+	sc = syncache_lookup(inc, &sch);
+	if (sc == NULL)
+		return;
+
+	/* If the sequence number != sc_iss, then it's a bogus ICMP msg */
+	if (ntohl(th->th_seq) != sc->sc_iss)
+		return;
+
+	/*
+	 * If we've rertransmitted 3 times and this is our second error,
+	 * we remove the entry.  Otherwise, we allow it to continue on.
+	 * This prevents us from incorrectly nuking an entry during a
+	 * spurious network outage.
+	 *
+	 * See tcp_notify().
+	 */
+	if ((sc->sc_flags & SCF_UNREACH) == 0 || sc->sc_rxtslot < 3) {
+		sc->sc_flags |= SCF_UNREACH;
+		return;
+	}
+	syncache_drop(sc, sch);
+	tcpstat.tcps_sc_unreach++;
+}
+
+/*
+ * Build a new TCP socket structure from a syncache entry.
+ */
+static struct socket *
+syncache_socket(sc, lso)
+	struct syncache *sc;
+	struct socket *lso;
+{
+	struct inpcb *inp = NULL;
+	struct socket *so;
+	struct tcpcb *tp;
+
+	/*
+	 * Ok, create the full blown connection, and set things up
+	 * as they would have been set up if we had created the
+	 * connection when the SYN arrived.  If we can't create
+	 * the connection, abort it.
+	 */
+	so = sonewconn(lso, SS_ISCONNECTED);
+	if (so == NULL) {
+		/*
+		 * Drop the connection; we will send a RST if the peer
+		 * retransmits the ACK,
+		 */
+		tcpstat.tcps_listendrop++;
+		goto abort;
+	}
+
+	inp = sotoinpcb(so);
+
+	/*
+	 * Insert new socket into hash list.
+	 */
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6) {
+		inp->in6p_laddr = sc->sc_inc.inc6_laddr;
+	} else {
+		inp->inp_vflag &= ~INP_IPV6;
+		inp->inp_vflag |= INP_IPV4;
+#endif
+		inp->inp_laddr = sc->sc_inc.inc_laddr;
+#ifdef INET6
+	}
+#endif
+	inp->inp_lport = sc->sc_inc.inc_lport;
+	if (in_pcbinshash(inp) != 0) {
+		/*
+		 * Undo the assignments above if we failed to
+		 * put the PCB on the hash lists.
+		 */
+#ifdef INET6
+		if (sc->sc_inc.inc_isipv6)
+			inp->in6p_laddr = in6addr_any;
+       		else
+#endif
+			inp->inp_laddr.s_addr = INADDR_ANY;
+		inp->inp_lport = 0;
+		goto abort;
+	}
+#ifdef IPSEC
+	/* copy old policy into new socket's */
+	if (ipsec_copy_policy(sotoinpcb(lso)->inp_sp, inp->inp_sp))
+		printf("syncache_expand: could not copy policy\n");
+#endif
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6) {
+		struct inpcb *oinp = sotoinpcb(lso);
+		struct in6_addr laddr6;
+		struct sockaddr_in6 *sin6;
+		/*
+		 * Inherit socket options from the listening socket.
+		 * Note that in6p_inputopts are not (and should not be)
+		 * copied, since it stores previously received options and is
+		 * used to detect if each new option is different than the
+		 * previous one and hence should be passed to a user.
+                 * If we copied in6p_inputopts, a user would not be able to
+		 * receive options just after calling the accept system call.
+		 */
+		inp->inp_flags |= oinp->inp_flags & INP_CONTROLOPTS;
+		if (oinp->in6p_outputopts)
+			inp->in6p_outputopts =
+			    ip6_copypktopts(oinp->in6p_outputopts, M_NOWAIT);
+		inp->in6p_route = sc->sc_route6;
+		sc->sc_route6.ro_rt = NULL;
+
+		MALLOC(sin6, struct sockaddr_in6 *, sizeof *sin6,
+		    M_SONAME, M_NOWAIT);
+		if (sin6 == NULL)
+			goto abort;
+		bzero(sin6, sizeof(*sin6));
+		sin6->sin6_family = AF_INET6;
+		sin6->sin6_len = sizeof(*sin6);
+		sin6->sin6_addr = sc->sc_inc.inc6_faddr;
+		sin6->sin6_port = sc->sc_inc.inc_fport;
+		laddr6 = inp->in6p_laddr;
+		if (IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_laddr))
+			inp->in6p_laddr = sc->sc_inc.inc6_laddr;
+		if (in6_pcbconnect(inp, (struct sockaddr *)sin6, thread0)) {
+			inp->in6p_laddr = laddr6;
+			FREE(sin6, M_SONAME);
+			goto abort;
+		}
+		FREE(sin6, M_SONAME);
+	} else
+#endif
+	{
+		struct in_addr laddr;
+		struct sockaddr_in *sin;
+
+		inp->inp_options = ip_srcroute();
+		if (inp->inp_options == NULL) {
+			inp->inp_options = sc->sc_ipopts;
+			sc->sc_ipopts = NULL;
+		}
+		inp->inp_route = sc->sc_route;
+		sc->sc_route.ro_rt = NULL;
+
+		MALLOC(sin, struct sockaddr_in *, sizeof *sin,
+		    M_SONAME, M_NOWAIT);
+		if (sin == NULL)
+			goto abort;
+		sin->sin_family = AF_INET;
+		sin->sin_len = sizeof(*sin);
+		sin->sin_addr = sc->sc_inc.inc_faddr;
+		sin->sin_port = sc->sc_inc.inc_fport;
+		bzero((caddr_t)sin->sin_zero, sizeof(sin->sin_zero));
+		laddr = inp->inp_laddr;
+		if (inp->inp_laddr.s_addr == INADDR_ANY)
+			inp->inp_laddr = sc->sc_inc.inc_laddr;
+		if (in_pcbconnect(inp, (struct sockaddr *)sin, thread0)) {
+			inp->inp_laddr = laddr;
+			FREE(sin, M_SONAME);
+			goto abort;
+		}
+		FREE(sin, M_SONAME);
+	}
+
+	tp = intotcpcb(inp);
+	tp->t_state = TCPS_SYN_RECEIVED;
+	tp->iss = sc->sc_iss;
+	tp->irs = sc->sc_irs;
+	tcp_rcvseqinit(tp);
+	tcp_sendseqinit(tp);
+	tp->snd_wl1 = sc->sc_irs;
+	tp->rcv_up = sc->sc_irs + 1;
+	tp->rcv_wnd = sc->sc_wnd;
+	tp->rcv_adv += tp->rcv_wnd;
+
+	tp->t_flags = sc->sc_tp->t_flags & TF_NOPUSH;
+	if (sc->sc_flags & SCF_NOOPT)
+		tp->t_flags |= TF_NOOPT;
+	if (sc->sc_flags & SCF_WINSCALE) {
+		tp->t_flags |= TF_REQ_SCALE|TF_RCVD_SCALE;
+		tp->requested_s_scale = sc->sc_requested_s_scale;
+		tp->request_r_scale = sc->sc_request_r_scale;
+	}
+	if (sc->sc_flags & SCF_TIMESTAMP) {
+		tp->t_flags |= TF_REQ_TSTMP|TF_RCVD_TSTMP;
+		tp->ts_recent = sc->sc_tsrecent;
+		tp->ts_recent_age = ticks;
+	}
+	if (sc->sc_flags & SCF_CC) {
+		/*
+		 * Initialization of the tcpcb for transaction;
+		 *   set SND.WND = SEG.WND,
+		 *   initialize CCsend and CCrecv.
+		 */
+		tp->t_flags |= TF_REQ_CC|TF_RCVD_CC;
+		tp->cc_send = sc->sc_cc_send;
+		tp->cc_recv = sc->sc_cc_recv;
+	}
+
+	tcp_mss(tp, sc->sc_peer_mss);
+
+	/*
+	 * If the SYN,ACK was retransmitted, reset cwnd to 1 segment.
+	 */
+	if (sc->sc_rxtslot != 0)
+                tp->snd_cwnd = tp->t_maxseg;
+	callout_reset(tp->tt_keep, tcp_keepinit, tcp_timer_keep, tp);
+
+	tcpstat.tcps_accepts++;
+	return (so);
+
+abort:
+	if (so != NULL)
+		(void) soabort(so);
+	return (NULL);
+}
+
+/*
+ * This function gets called when we receive an ACK for a
+ * socket in the LISTEN state.  We look up the connection
+ * in the syncache, and if its there, we pull it out of
+ * the cache and turn it into a full-blown connection in
+ * the SYN-RECEIVED state.
+ */
+int
+syncache_expand(inc, th, sop, m)
+	struct in_conninfo *inc;
+	struct tcphdr *th;
+	struct socket **sop;
+	struct mbuf *m;
+{
+	struct syncache *sc;
+	struct syncache_head *sch;
+	struct socket *so;
+
+	sc = syncache_lookup(inc, &sch);
+	if (sc == NULL)
+		return (0);
+
+	/*
+	 * If seg contains an ACK, but not for our SYN/ACK, send a RST.
+	 */
+	if (th->th_ack != sc->sc_iss + 1)
+		return (0);
+
+	so = syncache_socket(sc, *sop);
+	if (so == NULL) {
+#if 0
+resetandabort:
+		/* XXXjlemon check this - is this correct? */
+		(void) tcp_respond(NULL, m, m, th,
+		    th->th_seq + tlen, (tcp_seq)0, TH_RST|TH_ACK);
+#endif
+		m_freem(m);			/* XXX only needed for above */
+		tcpstat.tcps_sc_aborted++;
+	} else {
+		sc->sc_flags |= SCF_KEEPROUTE;
+		tcpstat.tcps_sc_completed++;
+	}
+	if (sch == NULL)
+		syncache_free(sc);
+	else
+		syncache_drop(sc, sch);
+	*sop = so;
+	return (1);
+}
+
+/*
+ * Given a LISTEN socket and an inbound SYN request, add
+ * this to the syn cache, and send back a segment:
+ *	<SEQ=ISS><ACK=RCV_NXT><CTL=SYN,ACK>
+ * to the source.
+ *
+ * IMPORTANT NOTE: We do _NOT_ ACK data that might accompany the SYN.
+ * Doing so would require that we hold onto the data and deliver it
+ * to the application.  However, if we are the target of a SYN-flood
+ * DoS attack, an attacker could send data which would eventually
+ * consume all available buffer space if it were ACKed.  By not ACKing
+ * the data, we avoid this DoS scenario.
+ */
+int
+syncache_add(inc, to, th, sop, m)
+	struct in_conninfo *inc;
+	struct tcpopt *to;
+	struct tcphdr *th;
+	struct socket **sop;
+	struct mbuf *m;
+{
+	struct tcpcb *tp;
+	struct socket *so;
+	struct syncache *sc = NULL;
+	struct syncache_head *sch;
+	struct mbuf *ipopts = NULL;
+	struct rmxp_tao *taop;
+	int i, s, win;
+
+	so = *sop;
+	tp = sototcpcb(so);
+
+	/*
+	 * Remember the IP options, if any.
+	 */
+#ifdef INET6
+	if (!inc->inc_isipv6)
+#endif
+		ipopts = ip_srcroute();
+
+	/*
+	 * See if we already have an entry for this connection.
+	 * If we do, resend the SYN,ACK, and reset the retransmit timer.
+	 *
+	 * XXX
+	 * should the syncache be re-initialized with the contents
+	 * of the new SYN here (which may have different options?)
+	 */
+	sc = syncache_lookup(inc, &sch);
+	if (sc != NULL) {
+		tcpstat.tcps_sc_dupsyn++;
+		if (ipopts) {
+			/*
+			 * If we were remembering a previous source route,
+			 * forget it and use the new one we've been given.
+			 */
+			if (sc->sc_ipopts)
+				(void) m_free(sc->sc_ipopts);
+			sc->sc_ipopts = ipopts;
+		}
+		/*
+		 * Update timestamp if present.
+		 */
+		if (sc->sc_flags & SCF_TIMESTAMP)
+			sc->sc_tsrecent = to->to_tsval;
+		if (syncache_respond(sc, m) == 0) {
+		        s = splnet();
+			TAILQ_REMOVE(&tcp_syncache.timerq[sc->sc_rxtslot],
+			    sc, sc_timerq);
+			SYNCACHE_TIMEOUT(sc, sc->sc_rxtslot);
+		        splx(s);
+		 	tcpstat.tcps_sndacks++;
+			tcpstat.tcps_sndtotal++;
+		}
+		*sop = NULL;
+		return (1);
+	}
+
+	sc = zalloc(tcp_syncache.zone);
+	if (sc == NULL) {
+		/*
+		 * The zone allocator couldn't provide more entries.
+		 * Treat this as if the cache was full; drop the oldest 
+		 * entry and insert the new one.
+		 */
+		s = splnet();
+		for (i = SYNCACHE_MAXREXMTS; i >= 0; i--) {
+			sc = TAILQ_FIRST(&tcp_syncache.timerq[i]);
+			if (sc != NULL)
+				break;
+		}
+		syncache_drop(sc, NULL);
+		splx(s);
+		tcpstat.tcps_sc_zonefail++;
+		sc = zalloc(tcp_syncache.zone);
+		if (sc == NULL) {
+			if (ipopts)
+				(void) m_free(ipopts);
+			return (0);
+		}
+	}
+
+	/*
+	 * Fill in the syncache values.
+	 */
+	sc->sc_tp = tp;
+	sc->sc_inp_gencnt = tp->t_inpcb->inp_gencnt;
+	sc->sc_ipopts = ipopts;
+	sc->sc_inc.inc_fport = inc->inc_fport;
+	sc->sc_inc.inc_lport = inc->inc_lport;
+#ifdef INET6
+	sc->sc_inc.inc_isipv6 = inc->inc_isipv6;
+	if (inc->inc_isipv6) {
+		sc->sc_inc.inc6_faddr = inc->inc6_faddr;
+		sc->sc_inc.inc6_laddr = inc->inc6_laddr;
+		sc->sc_route6.ro_rt = NULL;
+	} else
+#endif
+	{
+		sc->sc_inc.inc_faddr = inc->inc_faddr;
+		sc->sc_inc.inc_laddr = inc->inc_laddr;
+		sc->sc_route.ro_rt = NULL;
+	}
+	sc->sc_irs = th->th_seq;
+
+	/* Initial receive window: clip sbspace to [0 .. TCP_MAXWIN] */
+	win = sbspace(&so->so_rcv);
+	win = imax(win, 0);
+	win = imin(win, TCP_MAXWIN);
+	sc->sc_wnd = win;
+
+	sc->sc_flags = 0;
+	sc->sc_peer_mss = to->to_flags & TOF_MSS ? to->to_mss : 0;
+	if (tcp_do_rfc1323) {
+		/*
+		 * A timestamp received in a SYN makes
+		 * it ok to send timestamp requests and replies.
+		 */
+		if (to->to_flags & TOF_TS) {
+			sc->sc_tsrecent = to->to_tsval;
+			sc->sc_flags |= SCF_TIMESTAMP;
+		}
+		if (to->to_flags & TOF_SCALE) {
+			int wscale = 0;
+
+			/* Compute proper scaling value from buffer space */
+			while (wscale < TCP_MAX_WINSHIFT &&
+			    (TCP_MAXWIN << wscale) < so->so_rcv.sb_hiwat)
+				wscale++;
+			sc->sc_request_r_scale = wscale;
+			sc->sc_requested_s_scale = to->to_requested_s_scale;
+			sc->sc_flags |= SCF_WINSCALE;
+		}
+	}
+	if (tcp_do_rfc1644) {
+		/*
+		 * A CC or CC.new option received in a SYN makes
+		 * it ok to send CC in subsequent segments.
+		 */
+		if (to->to_flags & (TOF_CC|TOF_CCNEW)) {
+			sc->sc_cc_recv = to->to_cc;
+			sc->sc_cc_send = CC_INC(tcp_ccgen);
+			sc->sc_flags |= SCF_CC;
+		}
+	}
+	if (tp->t_flags & TF_NOOPT)
+		sc->sc_flags = SCF_NOOPT;
+
+	/*
+	 * XXX
+	 * We have the option here of not doing TAO (even if the segment
+	 * qualifies) and instead fall back to a normal 3WHS via the syncache.
+	 * This allows us to apply synflood protection to TAO-qualifying SYNs
+	 * also. However, there should be a hueristic to determine when to
+	 * do this, and is not present at the moment.
+	 */
+
+	/*
+	 * Perform TAO test on incoming CC (SEG.CC) option, if any.
+	 * - compare SEG.CC against cached CC from the same host, if any.
+	 * - if SEG.CC > chached value, SYN must be new and is accepted
+	 *	immediately: save new CC in the cache, mark the socket
+	 *	connected, enter ESTABLISHED state, turn on flag to
+	 *	send a SYN in the next segment.
+	 *	A virtual advertised window is set in rcv_adv to
+	 *	initialize SWS prevention.  Then enter normal segment
+	 *	processing: drop SYN, process data and FIN.
+	 * - otherwise do a normal 3-way handshake.
+	 */
+	taop = tcp_gettaocache(&sc->sc_inc);
+	if ((to->to_flags & TOF_CC) != 0) {
+		if (((tp->t_flags & TF_NOPUSH) != 0) &&
+		    sc->sc_flags & SCF_CC && 
+		    taop != NULL && taop->tao_cc != 0 &&
+		    CC_GT(to->to_cc, taop->tao_cc)) {
+			sc->sc_rxtslot = 0;
+			so = syncache_socket(sc, *sop);
+			if (so != NULL) {
+				sc->sc_flags |= SCF_KEEPROUTE;
+				taop->tao_cc = to->to_cc;
+				*sop = so;
+			}
+			syncache_free(sc);
+			return (so != NULL);
+		}
+	} else {
+		/*
+		 * No CC option, but maybe CC.NEW: invalidate cached value.
+		 */
+		if (taop != NULL)
+			taop->tao_cc = 0;
+	}
+	/*
+	 * TAO test failed or there was no CC option,
+	 *    do a standard 3-way handshake.
+	 */
+	sc->sc_iss = arc4random();
+	if (syncache_insert(sc, sch)) {
+		if (syncache_respond(sc, m) == 0) {
+			tcpstat.tcps_sndacks++;
+			tcpstat.tcps_sndtotal++;
+		} else {
+			syncache_drop(sc, sch);
+			tcpstat.tcps_sc_dropped++;
+		}
+	} else {
+		syncache_free(sc);
+	}
+	*sop = NULL;
+	return (1);
+}
+
+static int
+syncache_respond(sc, m)
+	struct syncache *sc;
+	struct mbuf *m;
+{
+	u_int8_t *optp;
+	int optlen, error;
+	u_int16_t tlen, hlen, mssopt;
+	struct ip *ip = NULL;
+	struct rtentry *rt;
+	struct tcphdr *th;
+#ifdef INET6
+	struct ip6_hdr *ip6 = NULL;
+#endif
+
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6) {
+		rt = tcp_rtlookup6(&sc->sc_inc);
+		if (rt != NULL)
+			mssopt = rt->rt_ifp->if_mtu -
+			     (sizeof(struct ip6_hdr) + sizeof(struct tcphdr));
+		else 
+			mssopt = tcp_v6mssdflt;
+		hlen = sizeof(struct ip6_hdr);
+	} else
+#endif
+	{
+		rt = tcp_rtlookup(&sc->sc_inc);
+		if (rt != NULL)
+			mssopt = rt->rt_ifp->if_mtu -
+			     (sizeof(struct ip) + sizeof(struct tcphdr));
+		else 
+			mssopt = tcp_mssdflt;
+		hlen = sizeof(struct ip);
+	}
+
+	/* Compute the size of the TCP options. */
+	if (sc->sc_flags & SCF_NOOPT) {
+		optlen = 0;
+	} else {
+		optlen = TCPOLEN_MAXSEG +
+		    ((sc->sc_flags & SCF_WINSCALE) ? 4 : 0) +
+		    ((sc->sc_flags & SCF_TIMESTAMP) ? TCPOLEN_TSTAMP_APPA : 0) +
+		    ((sc->sc_flags & SCF_CC) ? TCPOLEN_CC_APPA * 2 : 0);
+	}
+	tlen = hlen + sizeof(struct tcphdr) + optlen;
+
+	/*
+	 * XXX
+	 * assume that the entire packet will fit in a header mbuf
+	 */
+	KASSERT(max_linkhdr + tlen <= MHLEN, ("syncache: mbuf too small"));
+
+	/*
+	 * XXX shouldn't this reuse the mbuf if possible ?
+	 * Create the IP+TCP header from scratch.
+	 */
+	if (m)
+		m_freem(m);
+
+	m = m_gethdr(M_DONTWAIT, MT_HEADER);
+	if (m == NULL)
+		return (ENOBUFS);
+	m->m_data += max_linkhdr;
+	m->m_len = tlen;
+	m->m_pkthdr.len = tlen;
+	m->m_pkthdr.rcvif = NULL;
+
+#ifdef IPSEC
+	/* use IPsec policy on listening socket to send SYN,ACK */
+	if (ipsec_setsocket(m, sc->sc_tp->t_inpcb->inp_socket) != 0) {
+		m_freem(m);
+		return (ENOBUFS);
+	}
+#endif
+
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6) {
+		ip6 = mtod(m, struct ip6_hdr *);
+		ip6->ip6_vfc = IPV6_VERSION;
+		ip6->ip6_nxt = IPPROTO_TCP;
+		ip6->ip6_src = sc->sc_inc.inc6_laddr;
+		ip6->ip6_dst = sc->sc_inc.inc6_faddr;
+		ip6->ip6_plen = htons(tlen - hlen);
+		/* ip6_hlim is set after checksum */
+		/* ip6_flow = ??? */
+
+		th = (struct tcphdr *)(ip6 + 1);
+	} else
+#endif
+	{
+		ip = mtod(m, struct ip *);
+		ip->ip_v = IPVERSION;
+		ip->ip_hl = sizeof(struct ip) >> 2;
+		ip->ip_tos = 0;
+		ip->ip_len = tlen;
+		ip->ip_id = 0;
+		ip->ip_off = 0;
+		ip->ip_ttl = ip_defttl;
+		ip->ip_sum = 0;
+		ip->ip_p = IPPROTO_TCP;
+		ip->ip_src = sc->sc_inc.inc_laddr;
+		ip->ip_dst = sc->sc_inc.inc_faddr;
+
+		th = (struct tcphdr *)(ip + 1);
+	}
+	th->th_sport = sc->sc_inc.inc_lport;
+	th->th_dport = sc->sc_inc.inc_fport;
+
+	th->th_seq = htonl(sc->sc_iss);
+	th->th_ack = htonl(sc->sc_irs + 1);
+	th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
+	th->th_x2 = 0;
+	th->th_flags = TH_SYN|TH_ACK;
+	th->th_win = htons(sc->sc_wnd);
+	th->th_urp = 0;
+
+	/* Tack on the TCP options. */
+	if (optlen == 0)
+		goto no_options;
+	optp = (u_int8_t *)(th + 1);
+	*optp++ = TCPOPT_MAXSEG;
+	*optp++ = TCPOLEN_MAXSEG;
+	*optp++ = (mssopt >> 8) & 0xff;
+	*optp++ = mssopt & 0xff;
+
+	if (sc->sc_flags & SCF_WINSCALE) {
+		*((u_int32_t *)optp) = htonl(TCPOPT_NOP << 24 |
+		    TCPOPT_WINDOW << 16 | TCPOLEN_WINDOW << 8 |
+		    sc->sc_request_r_scale);
+		optp += 4;
+	}
+
+	if (sc->sc_flags & SCF_TIMESTAMP) {
+		u_int32_t *lp = (u_int32_t *)(optp);
+
+		/* Form timestamp option as shown in appendix A of RFC 1323. */
+		*lp++ = htonl(TCPOPT_TSTAMP_HDR);
+		*lp++ = htonl(ticks);
+		*lp   = htonl(sc->sc_tsrecent);
+		optp += TCPOLEN_TSTAMP_APPA;
+	}
+
+	/*
+         * Send CC and CC.echo if we received CC from our peer.
+         */
+        if (sc->sc_flags & SCF_CC) {
+		u_int32_t *lp = (u_int32_t *)(optp);
+
+		*lp++ = htonl(TCPOPT_CC_HDR(TCPOPT_CC));
+		*lp++ = htonl(sc->sc_cc_send);
+		*lp++ = htonl(TCPOPT_CC_HDR(TCPOPT_CCECHO));
+		*lp   = htonl(sc->sc_cc_recv);
+		optp += TCPOLEN_CC_APPA * 2;
+	}
+no_options:
+
+#ifdef INET6
+	if (sc->sc_inc.inc_isipv6) {
+		struct route_in6 *ro6 = &sc->sc_route6;
+
+		th->th_sum = 0;
+		th->th_sum = in6_cksum(m, IPPROTO_TCP, hlen, tlen - hlen);
+		ip6->ip6_hlim = in6_selecthlim(NULL,
+		    ro6->ro_rt ? ro6->ro_rt->rt_ifp : NULL);
+		error = ip6_output(m, NULL, ro6, 0, NULL, NULL);
+	} else
+#endif
+	{
+        	th->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
+		    htons(tlen - hlen + IPPROTO_TCP));
+		m->m_pkthdr.csum_flags = CSUM_TCP;
+		m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
+		error = ip_output(m, sc->sc_ipopts, &sc->sc_route, 0, NULL);
+	}
+	return (error);
+}
diff --git a/sys/netinet/tcp_timewait.c b/sys/netinet/tcp_timewait.c
index 6a6c9f8..27d54eb 100644
--- a/sys/netinet/tcp_timewait.c
+++ b/sys/netinet/tcp_timewait.c
@@ -117,11 +117,11 @@ SYSCTL_INT(_net_inet_tcp, TCPCTL_RTTDFLT, rttdflt, CTLFLAG_RW,
     &tcp_rttdflt , 0, "Default maximum TCP Round Trip Time");
 #endif
 
-static int	tcp_do_rfc1323 = 1;
+int	tcp_do_rfc1323 = 1;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_RW, 
     &tcp_do_rfc1323 , 0, "Enable rfc1323 (high performance TCP) extensions");
 
-static int	tcp_do_rfc1644 = 0;
+int	tcp_do_rfc1644 = 0;
 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1644, rfc1644, CTLFLAG_RW, 
     &tcp_do_rfc1644 , 0, "Enable rfc1644 (TTCP) extensions");
 
@@ -224,6 +224,8 @@ tcp_init()
 	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
 		panic("tcp_init");
 #undef TCP_MINPROTOHDR
+
+	syncache_init();
 }
 
 /*
@@ -710,18 +712,6 @@ tcp_close(tp)
 			tcpstat.tcps_cachedssthresh++;
 		}
 	}
-	rt = inp->inp_route.ro_rt;
-	if (rt) {
-		/* 
-		 * mark route for deletion if no information is
-		 * cached.
-		 */
-		if ((tp->t_flags & TF_LQ_OVERFLOW) &&
-		    ((rt->rt_rmx.rmx_locks & RTV_RTT) == 0)){
-			if (rt->rt_rmx.rmx_rtt == 0)
-				rt->rt_flags |= RTF_DELCLONE;
-		}
-	}
     no_valid_rt:
 	/* free the reassembly queue, if any */
 	while((q = LIST_FIRST(&tp->t_segq)) != NULL) {
@@ -1047,6 +1037,17 @@ tcp_ctlinput(cmd, sa, vip)
 			if (SEQ_GEQ(icmp_seq, tp->snd_una) &&
 			    SEQ_LT(icmp_seq, tp->snd_max))
 				(*notify)(inp, inetctlerrmap[cmd]);
+		} else {
+			struct in_conninfo inc;
+
+			inc.inc_fport = th->th_dport;
+			inc.inc_lport = th->th_sport;
+			inc.inc_faddr = faddr;
+			inc.inc_laddr = ip->ip_src;
+#ifdef INET6
+			inc.inc_isipv6 = 0;
+#endif
+			syncache_unreach(&inc, th);
 		}
 		splx(s);
 	} else
@@ -1099,6 +1100,7 @@ tcp6_ctlinput(cmd, sa, d)
 	}
 
 	if (ip6) {
+		struct in_conninfo inc;
 		/*
 		 * XXX: We assume that when IPV6 is non NULL,
 		 * M and OFF are valid.
@@ -1114,6 +1116,13 @@ tcp6_ctlinput(cmd, sa, d)
 		in6_pcbnotify(&tcb, sa, th.th_dport,
 		    (struct sockaddr *)ip6cp->ip6c_src,
 		    th.th_sport, cmd, notify);
+
+		inc.inc_fport = th.th_dport;
+		inc.inc_lport = th.th_sport;
+		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
+		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
+		inc.inc_isipv6 = 1;
+		syncache_unreach(&inc, &th);
 	} else
 		in6_pcbnotify(&tcb, sa, 0, (struct sockaddr *)sa6_src,
 			      0, cmd, notify);
@@ -1271,10 +1280,10 @@ tcp_mtudisc(inp, errno)
 	if (tp) {
 #ifdef INET6
 		if (isipv6)
-			rt = tcp_rtlookup6(inp);
+			rt = tcp_rtlookup6(&inp->inp_inc);
 		else
 #endif /* INET6 */
-		rt = tcp_rtlookup(inp);
+		rt = tcp_rtlookup(&inp->inp_inc);
 		if (!rt || !rt->rt_rmx.rmx_mtu) {
 			tp->t_maxopd = tp->t_maxseg =
 #ifdef INET6
@@ -1351,21 +1360,21 @@ tcp_mtudisc(inp, errno)
  * to get the interface MTU.
  */
 struct rtentry *
-tcp_rtlookup(inp)
-	struct inpcb *inp;
+tcp_rtlookup(inc)
+	struct in_conninfo *inc;
 {
 	struct route *ro;
 	struct rtentry *rt;
 
-	ro = &inp->inp_route;
+	ro = &inc->inc_route;
 	rt = ro->ro_rt;
 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
 		/* No route yet, so try to acquire one */
-		if (inp->inp_faddr.s_addr != INADDR_ANY) {
+		if (inc->inc_faddr.s_addr != INADDR_ANY) {
 			ro->ro_dst.sa_family = AF_INET;
 			ro->ro_dst.sa_len = sizeof(struct sockaddr_in);
 			((struct sockaddr_in *) &ro->ro_dst)->sin_addr =
-				inp->inp_faddr;
+			    inc->inc_faddr;
 			rtalloc(ro);
 			rt = ro->ro_rt;
 		}
@@ -1375,23 +1384,20 @@ tcp_rtlookup(inp)
 
 #ifdef INET6
 struct rtentry *
-tcp_rtlookup6(inp)
-	struct inpcb *inp;
+tcp_rtlookup6(inc)
+	struct in_conninfo *inc;
 {
 	struct route_in6 *ro6;
 	struct rtentry *rt;
 
-	ro6 = &inp->in6p_route;
+	ro6 = &inc->inc6_route;
 	rt = ro6->ro_rt;
 	if (rt == NULL || !(rt->rt_flags & RTF_UP)) {
 		/* No route yet, so try to acquire one */
-		if (!IN6_IS_ADDR_UNSPECIFIED(&inp->in6p_faddr)) {
-			struct sockaddr_in6 *dst6;
-
-			dst6 = (struct sockaddr_in6 *)&ro6->ro_dst;
-			dst6->sin6_family = AF_INET6;
-			dst6->sin6_len = sizeof(*dst6);
-			dst6->sin6_addr = inp->in6p_faddr;
+		if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
+			ro6->ro_dst.sin6_family = AF_INET6;
+			ro6->ro_dst.sin6_len = sizeof(struct sockaddr_in6);
+			ro6->ro_dst.sin6_addr = inc->inc6_faddr;
 			rtalloc((struct route *)ro6);
 			rt = ro6->ro_rt;
 		}
@@ -1450,17 +1456,17 @@ ipsec_hdrsiz_tcp(tp)
  * the route metrics.
  */
 struct rmxp_tao *
-tcp_gettaocache(inp)
-	struct inpcb *inp;
+tcp_gettaocache(inc)
+	struct in_conninfo *inc;
 {
 	struct rtentry *rt;
 
 #ifdef INET6
-	if ((inp->inp_vflag & INP_IPV6) != 0)
-		rt = tcp_rtlookup6(inp);
+	if (inc->inc_isipv6)
+		rt = tcp_rtlookup6(inc);
 	else
 #endif /* INET6 */
-	rt = tcp_rtlookup(inp);
+	rt = tcp_rtlookup(inc);
 
 	/* Make sure this is a host route and is up. */
 	if (rt == NULL ||
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index 2485a91..e3a35d7 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -765,7 +765,7 @@ tcp_connect(tp, nam, td)
 	 * Generate a CC value for this connection and
 	 * check whether CC or CCnew should be used.
 	 */
-	if ((taop = tcp_gettaocache(tp->t_inpcb)) == NULL) {
+	if ((taop = tcp_gettaocache(&tp->t_inpcb->inp_inc)) == NULL) {
 		taop = &tao_noncached;
 		bzero(taop, sizeof(*taop));
 	}
@@ -851,7 +851,7 @@ tcp6_connect(tp, nam, td)
 	 * Generate a CC value for this connection and
 	 * check whether CC or CCnew should be used.
 	 */
-	if ((taop = tcp_gettaocache(tp->t_inpcb)) == NULL) {
+	if ((taop = tcp_gettaocache(&tp->t_inpcb->inp_inc)) == NULL) {
 		taop = &tao_noncached;
 		bzero(taop, sizeof(*taop));
 	}
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index 7dc1bac..0f71278 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -36,9 +36,14 @@
 
 #ifndef _NETINET_TCP_VAR_H_
 #define _NETINET_TCP_VAR_H_
+
+#include <netinet/in_pcb.h>		/* needed for in_conninfo, inp_gen_t */
+
 /*
  * Kernel variables for tcp.
  */
+extern int	tcp_do_rfc1323;
+extern int	tcp_do_rfc1644;
 
 /* TCP segment queue entry */
 struct tseg_qent {
@@ -171,17 +176,56 @@ struct tcpcb {
  * to tcp_dooptions.
  */
 struct tcpopt {
-	u_long	to_flag;		/* which options are present */
+	u_long		to_flags;	/* which options are present */
 #define TOF_TS		0x0001		/* timestamp */
 #define TOF_CC		0x0002		/* CC and CCnew are exclusive */
 #define TOF_CCNEW	0x0004
 #define	TOF_CCECHO	0x0008
-	u_long	to_tsval;
-	u_long	to_tsecr;
-	tcp_cc	to_cc;		/* holds CC or CCnew */
-	tcp_cc	to_ccecho;
+#define	TOF_MSS		0x0010
+#define	TOF_SCALE	0x0020
+	u_int32_t	to_tsval;
+	u_int32_t	to_tsecr;
+	tcp_cc		to_cc;		/* holds CC or CCnew */
+	tcp_cc		to_ccecho;
+	u_int16_t	to_mss;
+	u_int8_t 	to_requested_s_scale;
+	u_int8_t 	to_pad;
+};
+
+struct syncache {
+	inp_gen_t	sc_inp_gencnt;		/* pointer check */
+	struct 		tcpcb *sc_tp;		/* tcb for listening socket */
+	struct		mbuf *sc_ipopts;	/* source route */
+	struct 		in_conninfo sc_inc;	/* addresses */
+#define sc_route	sc_inc.inc_route
+#define sc_route6	sc_inc.inc6_route
+	u_int32_t	sc_tsrecent;
+	tcp_cc		sc_cc_send;		/* holds CC or CCnew */
+	tcp_cc		sc_cc_recv;
+	tcp_seq 	sc_irs;			/* seq from peer */
+	tcp_seq 	sc_iss;			/* our ISS */
+	u_long		sc_rxttime;		/* retransmit time */
+	u_int16_t	sc_rxtslot; 		/* retransmit counter */
+	u_int16_t	sc_peer_mss;		/* peer's MSS */
+	u_int16_t	sc_wnd;			/* advertised window */
+	u_int8_t 	sc_requested_s_scale:4,
+			sc_request_r_scale:4;
+	u_int8_t	sc_flags;
+#define SCF_NOOPT	0x01			/* no TCP options */
+#define SCF_WINSCALE	0x02			/* negotiated window scaling */
+#define SCF_TIMESTAMP	0x04			/* negotiated timestamps */
+#define SCF_CC		0x08			/* negotiated CC */
+#define SCF_UNREACH	0x10			/* icmp unreachable received */
+#define SCF_KEEPROUTE	0x20			/* keep cloned route */
+	TAILQ_ENTRY(syncache)	sc_hash;
+	TAILQ_ENTRY(syncache)	sc_timerq;
 };
 
+struct syncache_head {
+	TAILQ_HEAD(, syncache)	sch_bucket;
+	u_int		sch_length;
+};
+ 
 /*
  * The TAO cache entry which is stored in the protocol family specific
  * portion of the route metrics.
@@ -306,6 +350,22 @@ struct	tcpstat {
 	u_long	tcps_badsyn;		/* bogus SYN, e.g. premature ACK */
 	u_long	tcps_mturesent;		/* resends due to MTU discovery */
 	u_long	tcps_listendrop;	/* listen queue overflows */
+
+	u_long	tcps_sc_added;		/* entry added to syncache */
+	u_long	tcps_sc_retransmitted;	/* syncache entry was retransmitted */
+	u_long	tcps_sc_dupsyn;		/* duplicate SYN packet */
+	u_long	tcps_sc_dropped;	/* could not reply to packet */
+	u_long	tcps_sc_completed;	/* successful extraction of entry */
+	u_long	tcps_sc_bucketoverflow;	/* syncache per-bucket limit hit */
+	u_long	tcps_sc_cacheoverflow;	/* syncache cache limit hit */
+	u_long	tcps_sc_reset;		/* RST removed entry from syncache */
+	u_long	tcps_sc_stale;		/* timed out or listen socket gone */
+	u_long	tcps_sc_aborted;	/* syncache entry aborted */
+	u_long	tcps_sc_badack;		/* removed due to bad ACK */
+	u_long	tcps_sc_unreach;	/* ICMP unreachable received */
+	u_long	tcps_sc_zonefail;	/* zalloc() failed */
+	u_long	tcps_sc_sendcookie;	/* SYN cookie sent */
+	u_long	tcps_sc_recvcookie;	/* SYN cookie received */
 };
 
 /*
@@ -383,7 +443,7 @@ struct tcpcb *
 void	 tcp_drain __P((void));
 void	 tcp_fasttimo __P((void));
 struct rmxp_tao *
-	 tcp_gettaocache __P((struct inpcb *));
+	 tcp_gettaocache __P((struct in_conninfo *));
 void	 tcp_init __P((void));
 void	 tcp_input __P((struct mbuf *, int));
 void	 tcp_mss __P((struct tcpcb *, int));
@@ -397,7 +457,7 @@ void	 tcp_quench __P((struct inpcb *, int));
 void	 tcp_respond __P((struct tcpcb *, void *,
 	    struct tcphdr *, struct mbuf *, tcp_seq, tcp_seq, int));
 struct rtentry *
-	 tcp_rtlookup __P((struct inpcb *));
+	 tcp_rtlookup __P((struct in_conninfo *));
 void	 tcp_setpersist __P((struct tcpcb *));
 void	 tcp_slowtimo __P((void));
 struct tcptemp *
@@ -407,6 +467,14 @@ struct tcpcb *
 	 tcp_timers __P((struct tcpcb *, int));
 void	 tcp_trace __P((int, int, struct tcpcb *, void *, struct tcphdr *,
 			int));
+void	 syncache_init(void);
+void	 syncache_unreach(struct in_conninfo *, struct tcphdr *);
+int	 syncache_expand(struct in_conninfo *, struct tcphdr *,
+	     struct socket **, struct mbuf *);
+int	 syncache_add(struct in_conninfo *, struct tcpopt *,
+	     struct tcphdr *, struct socket **, struct mbuf *);
+void	 syncache_chkrst(struct in_conninfo *, struct tcphdr *);
+void	 syncache_badack(struct in_conninfo *);
 
 extern	struct pr_usrreqs tcp_usrreqs;
 extern	u_long tcp_sendspace;
diff --git a/sys/netinet6/tcp6_var.h b/sys/netinet6/tcp6_var.h
index e283212..d911167 100644
--- a/sys/netinet6/tcp6_var.h
+++ b/sys/netinet6/tcp6_var.h
@@ -79,7 +79,7 @@ struct	ip6_hdr;
 void	tcp6_ctlinput __P((int, struct sockaddr *, void *));
 void	tcp6_init __P((void));
 int	tcp6_input __P((struct mbuf **, int *, int));
-struct	rtentry *tcp_rtlookup6 __P((struct inpcb *));
+struct	rtentry *tcp_rtlookup6(struct in_conninfo *);
 
 extern struct	pr_usrreqs tcp6_usrreqs;