Fix two bugs I accidently put into the syn code at the last minute

(yes I had tested the hell out of this).

I've also temporarily disabled the code so that it behaves as it previously
did (tail drop's the syns) pending discussion with fenner about some socket
state flags that I don't fully understand.

Submitted by:	fenner

4 files changed, 40 insertions, 28 deletions

diff --git a/sys/kern/uipc_sockbuf.c b/sys/kern/uipc_sockbuf.c
index 59c8ff1..9548312 100644
--- a/sys/kern/uipc_sockbuf.c
+++ b/sys/kern/uipc_sockbuf.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)uipc_socket2.c	8.1 (Berkeley) 6/10/93
- * $Id: uipc_socket2.c,v 1.14 1996/09/19 00:54:36 pst Exp $
+ * $Id: uipc_socket2.c,v 1.15 1996/10/07 04:32:27 pst Exp $
  */
 
 #include <sys/param.h>
@@ -109,8 +109,8 @@ soisconnected(so)
 	so->so_state |= SS_ISCONNECTED;
 	if (head && (so->so_state & SS_INCOMP)) {
 		TAILQ_REMOVE(&head->so_incomp, so, so_list);
+		head->so_incqlen--;
 		so->so_state &= ~SS_INCOMP;
-		so->so_incqlen--;
 		TAILQ_INSERT_TAIL(&head->so_comp, so, so_list);
 		so->so_state |= SS_COMP;
 		sorwakeup(head);
@@ -148,7 +148,10 @@ soisdisconnected(so)
 
 /*
  * Return a random connection that hasn't been serviced yet and
- * is eligible for discard.
+ * is eligible for discard.  There is a one in qlen chance that
+ * we will return a null, saying that there are no dropable
+ * requests.  In this case, the protocol specific code should drop
+ * the new request.  This insures fairness.
  *
  * This may be used in conjunction with protocol specific queue
  * congestion routines.
@@ -164,18 +167,17 @@ sodropablereq(head)
 	static long old_mono_secs;
 	static unsigned int cur_cnt, old_cnt;
 
-	so = TAILQ_FIRST(&head->so_incomp);
-	if (!so)
-		return (so);
-
-	qlen = head->so_incqlen;
-
 	if ((i = (mono_time.tv_sec - old_mono_secs)) != 0) {
 		old_mono_secs = mono_time.tv_sec;
 		old_cnt = cur_cnt / i;
 		cur_cnt = 0;
 	}
 
+	so = TAILQ_FIRST(&head->so_incomp);
+	if (!so)
+		return (so);
+
+	qlen = head->so_incqlen;
 	if (++cur_cnt > qlen || old_cnt > qlen) {
 		rnd = (314159 * rnd + 66329) & 0xffff;
 		j = ((qlen + 1) * rnd) >> 16;
diff --git a/sys/kern/uipc_socket2.c b/sys/kern/uipc_socket2.c
index 59c8ff1..9548312 100644
--- a/sys/kern/uipc_socket2.c
+++ b/sys/kern/uipc_socket2.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)uipc_socket2.c	8.1 (Berkeley) 6/10/93
- * $Id: uipc_socket2.c,v 1.14 1996/09/19 00:54:36 pst Exp $
+ * $Id: uipc_socket2.c,v 1.15 1996/10/07 04:32:27 pst Exp $
  */
 
 #include <sys/param.h>
@@ -109,8 +109,8 @@ soisconnected(so)
 	so->so_state |= SS_ISCONNECTED;
 	if (head && (so->so_state & SS_INCOMP)) {
 		TAILQ_REMOVE(&head->so_incomp, so, so_list);
+		head->so_incqlen--;
 		so->so_state &= ~SS_INCOMP;
-		so->so_incqlen--;
 		TAILQ_INSERT_TAIL(&head->so_comp, so, so_list);
 		so->so_state |= SS_COMP;
 		sorwakeup(head);
@@ -148,7 +148,10 @@ soisdisconnected(so)
 
 /*
  * Return a random connection that hasn't been serviced yet and
- * is eligible for discard.
+ * is eligible for discard.  There is a one in qlen chance that
+ * we will return a null, saying that there are no dropable
+ * requests.  In this case, the protocol specific code should drop
+ * the new request.  This insures fairness.
  *
  * This may be used in conjunction with protocol specific queue
  * congestion routines.
@@ -164,18 +167,17 @@ sodropablereq(head)
 	static long old_mono_secs;
 	static unsigned int cur_cnt, old_cnt;
 
-	so = TAILQ_FIRST(&head->so_incomp);
-	if (!so)
-		return (so);
-
-	qlen = head->so_incqlen;
-
 	if ((i = (mono_time.tv_sec - old_mono_secs)) != 0) {
 		old_mono_secs = mono_time.tv_sec;
 		old_cnt = cur_cnt / i;
 		cur_cnt = 0;
 	}
 
+	so = TAILQ_FIRST(&head->so_incomp);
+	if (!so)
+		return (so);
+
+	qlen = head->so_incqlen;
 	if (++cur_cnt > qlen || old_cnt > qlen) {
 		rnd = (314159 * rnd + 66329) & 0xffff;
 		j = ((qlen + 1) * rnd) >> 16;
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 3b0bde8..657fef8 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
- *	$Id: tcp_input.c,v 1.52 1996/10/07 04:32:39 pst Exp $
+ *	$Id: tcp_input.c,v 1.53 1996/10/07 19:06:10 davidg Exp $
  */
 
 #ifndef TUBA_INCLUDE
@@ -415,11 +415,15 @@ findpcb:
 			so2 = sonewconn(so, 0);
 			if (so2 == 0) {
 				tcpstat.tcps_listendrop++;
+#ifdef	TCPSYNRED
 				so2 = sodropablereq(so);
-				if (so2)
-				    tcp_drop(sototcpcb(so2), ETIMEDOUT);
-				else
-				    goto drop;
+				if (so2) {
+					tcp_drop(sototcpcb(so2), ETIMEDOUT);
+					so2 = sonewconn(so, 0);
+				}
+				if (!so2)
+#endif
+					goto drop;
 			}
 			so = so2;
 			/*
diff --git a/sys/netinet/tcp_reass.c b/sys/netinet/tcp_reass.c
index 3b0bde8..657fef8 100644
--- a/sys/netinet/tcp_reass.c
+++ b/sys/netinet/tcp_reass.c
@@ -31,7 +31,7 @@
  * SUCH DAMAGE.
  *
  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
- *	$Id: tcp_input.c,v 1.52 1996/10/07 04:32:39 pst Exp $
+ *	$Id: tcp_input.c,v 1.53 1996/10/07 19:06:10 davidg Exp $
  */
 
 #ifndef TUBA_INCLUDE
@@ -415,11 +415,15 @@ findpcb:
 			so2 = sonewconn(so, 0);
 			if (so2 == 0) {
 				tcpstat.tcps_listendrop++;
+#ifdef	TCPSYNRED
 				so2 = sodropablereq(so);
-				if (so2)
-				    tcp_drop(sototcpcb(so2), ETIMEDOUT);
-				else
-				    goto drop;
+				if (so2) {
+					tcp_drop(sototcpcb(so2), ETIMEDOUT);
+					so2 = sonewconn(so, 0);
+				}
+				if (!so2)
+#endif
+					goto drop;
 			}
 			so = so2;
 			/*