Second try: get 4.4-Lite-2 into the source tree. The conflicts don't

matter because none of our working source files are on the CSRG branch
any more.

Obtained from:	4.4BSD-Lite-2

19 files changed, 184 insertions, 90 deletions

diff --git a/sys/netinet/if_ether.c b/sys/netinet/if_ether.c
index 41f07c0..1574956 100644
--- a/sys/netinet/if_ether.c
+++ b/sys/netinet/if_ether.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)if_ether.c	8.1 (Berkeley) 6/10/93
+ *	@(#)if_ether.c	8.2 (Berkeley) 9/26/94
  */
 
 /*
@@ -448,7 +448,7 @@ in_arpinput(m)
 		if (sdl->sdl_alen &&
 		    bcmp((caddr_t)ea->arp_sha, LLADDR(sdl), sdl->sdl_alen))
 			log(LOG_INFO, "arp info overwritten for %x by %s\n",
-			    isaddr.s_addr, ether_sprintf(ea->arp_sha));
+			    ntohl(isaddr.s_addr), ether_sprintf(ea->arp_sha));
 		bcopy((caddr_t)ea->arp_sha, LLADDR(sdl),
 			    sdl->sdl_alen = sizeof(ea->arp_sha));
 		if (rt->rt_expire)
@@ -539,7 +539,8 @@ arplookup(addr, create, proxy)
 	if ((rt->rt_flags & RTF_GATEWAY) || (rt->rt_flags & RTF_LLINFO) == 0 ||
 	    rt->rt_gateway->sa_family != AF_LINK) {
 		if (create)
-			log(LOG_DEBUG, "arptnew failed on %x\n", ntohl(addr));
+			log(LOG_DEBUG,
+				"arplookup couldn't create %x\n", ntohl(addr));
 		return (0);
 	}
 	return ((struct llinfo_arp *)rt->rt_llinfo);
diff --git a/sys/netinet/if_ether.h b/sys/netinet/if_ether.h
index 6b4def0..8d44bf5 100644
--- a/sys/netinet/if_ether.h
+++ b/sys/netinet/if_ether.h
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)if_ether.h	8.1 (Berkeley) 6/10/93
+ *	@(#)if_ether.h	8.3 (Berkeley) 5/2/95
  */
 
 /*
@@ -142,14 +142,12 @@ u_char	ether_ipmulticast_min[6];
 u_char	ether_ipmulticast_max[6];
 struct	ifqueue arpintrq;
 
-struct	llinfo_arp *arptnew __P((struct in_addr *));
 struct	llinfo_arp llinfo_arp;		/* head of the llinfo queue */
 
-void	arpwhohas __P((struct arpcom *, struct in_addr *));
+void	arp_rtrequest __P((int, struct rtentry *, struct sockaddr *));
 void	arpintr __P((void));
 int	arpresolve __P((struct arpcom *,
-	   struct rtentry *, struct mbuf *, struct sockaddr *, u_char *));
-void	arp_rtrequest __P((int, struct rtentry *, struct sockaddr *));
+	    struct rtentry *, struct mbuf *, struct sockaddr *, u_char *));
 void	arpwhohas __P((struct arpcom *, struct in_addr *));
 
 int	ether_addmulti __P((struct ifreq *, struct arpcom *));
diff --git a/sys/netinet/igmp.c b/sys/netinet/igmp.c
index 78b426c..f372085 100644
--- a/sys/netinet/igmp.c
+++ b/sys/netinet/igmp.c
@@ -34,7 +34,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)igmp.c	8.1 (Berkeley) 7/19/93
+ *	@(#)igmp.c	8.2 (Berkeley) 5/3/95
  */
 
 /* Internet Group Management Protocol (IGMP) routines. */
@@ -286,12 +286,16 @@ igmp_sendreport(inm)
 	ip->ip_src.s_addr = INADDR_ANY;
 	ip->ip_dst = inm->inm_addr;
 
-	igmp = (struct igmp *)(ip + 1);
+	m->m_data += sizeof(struct ip);
+	m->m_len -= sizeof(struct ip);
+	igmp = mtod(m, struct igmp *);
 	igmp->igmp_type = IGMP_HOST_MEMBERSHIP_REPORT;
 	igmp->igmp_code = 0;
 	igmp->igmp_group = inm->inm_addr;
 	igmp->igmp_cksum = 0;
 	igmp->igmp_cksum = in_cksum(m, IGMP_MINLEN);
+	m->m_data -= sizeof(struct ip);
+	m->m_len += sizeof(struct ip);
 
 	imo = &simo;
 	bzero((caddr_t)imo, sizeof(*imo));
diff --git a/sys/netinet/in.c b/sys/netinet/in.c
index e8b481b..374a622 100644
--- a/sys/netinet/in.c
+++ b/sys/netinet/in.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)in.c	8.2 (Berkeley) 11/15/93
+ *	@(#)in.c	8.4 (Berkeley) 1/9/95
  */
 
 #include <sys/param.h>
@@ -141,7 +141,7 @@ struct sockaddr_in *ap;
     register char *cp = (char *) (&ap->sin_addr + 1);
 
     ap->sin_len = 0;
-    while (--cp > cplim)
+    while (--cp >= cplim)
         if (*cp) {
 	    (ap)->sin_len = cp - (char *) (ap) + 1;
 	    break;
@@ -158,7 +158,7 @@ extern	struct ifnet loif;
 /* ARGSUSED */
 in_control(so, cmd, data, ifp)
 	struct socket *so;
-	int cmd;
+	u_long cmd;
 	caddr_t data;
 	register struct ifnet *ifp;
 {
diff --git a/sys/netinet/in_pcb.c b/sys/netinet/in_pcb.c
index 01b6b17..bfc293c 100644
--- a/sys/netinet/in_pcb.c
+++ b/sys/netinet/in_pcb.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1991, 1993
+ * Copyright (c) 1982, 1986, 1991, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)in_pcb.c	8.2 (Berkeley) 1/4/94
+ *	@(#)in_pcb.c	8.4 (Berkeley) 5/24/95
  */
 
 #include <sys/param.h>
@@ -64,7 +64,7 @@ in_pcballoc(so, head)
 {
 	register struct inpcb *inp;
 
-	MALLOC(inp, struct inpcb *, sizeof(*inp), M_PCB, M_WAITOK);
+	MALLOC(inp, struct inpcb *, sizeof(*inp), M_PCB, M_NOWAIT);
 	if (inp == NULL)
 		return (ENOBUFS);
 	bzero((caddr_t)inp, sizeof(*inp));
@@ -130,7 +130,7 @@ in_pcbbind(inp, nam)
 			/* GROSS */
 			if (ntohs(lport) < IPPORT_RESERVED &&
 			    (error = suser(p->p_ucred, &p->p_acflag)))
-				return (error);
+				return (EACCES);
 			t = in_pcblookup(head, zeroin_addr, 0,
 			    sin->sin_addr, lport, wild);
 			if (t && (reuseport & t->inp_socket->so_options) == 0)
diff --git a/sys/netinet/in_proto.c b/sys/netinet/in_proto.c
index 00916b4..c24036d 100644
--- a/sys/netinet/in_proto.c
+++ b/sys/netinet/in_proto.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)in_proto.c	8.1 (Berkeley) 6/10/93
+ *	@(#)in_proto.c	8.2 (Berkeley) 2/9/95
  */
 
 #include <sys/param.h>
@@ -68,8 +68,8 @@ void	idpip_input(), nsip_ctlinput();
 #endif
 
 #ifdef TPIP
-void	tpip_input(), tpip_ctlinput(), tp_ctloutput();
-int	tp_init(), tp_slowtimo(), tp_drain(), tp_usrreq();
+void	tpip_input(), tpip_ctlinput(), tp_init(), tp_slowtimo(), tp_drain();
+int	tp_ctloutput(), tp_usrreq();
 #endif
 
 #ifdef EON
diff --git a/sys/netinet/in_var.h b/sys/netinet/in_var.h
index 8218f0b..f816a71 100644
--- a/sys/netinet/in_var.h
+++ b/sys/netinet/in_var.h
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)in_var.h	8.1 (Berkeley) 6/10/93
+ *	@(#)in_var.h	8.2 (Berkeley) 1/9/95
  */
 
 /*
@@ -196,5 +196,5 @@ int	in_ifinit __P((struct ifnet *,
 struct	in_multi *in_addmulti __P((struct in_addr *, struct ifnet *));
 int	in_delmulti __P((struct in_multi *));
 void	in_ifscrub __P((struct ifnet *, struct in_ifaddr *));
-int	in_control __P((struct socket *, int, caddr_t, struct ifnet *));
+int	in_control __P((struct socket *, u_long, caddr_t, struct ifnet *));
 #endif
diff --git a/sys/netinet/ip.h b/sys/netinet/ip.h
index 8a31dfa..347cb22 100644
--- a/sys/netinet/ip.h
+++ b/sys/netinet/ip.h
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)ip.h	8.1 (Berkeley) 6/10/93
+ *	@(#)ip.h	8.2 (Berkeley) 6/1/94
  */
 
 /*
@@ -87,7 +87,7 @@ struct ip {
 #define	IPTOS_PREC_FLASH		0x60
 #define	IPTOS_PREC_IMMEDIATE		0x40
 #define	IPTOS_PREC_PRIORITY		0x20
-#define	IPTOS_PREC_ROUTINE		0x10
+#define	IPTOS_PREC_ROUTINE		0x00
 
 /*
  * Definitions for options.
diff --git a/sys/netinet/ip_mroute.h b/sys/netinet/ip_mroute.h
index adb40be..44db850 100644
--- a/sys/netinet/ip_mroute.h
+++ b/sys/netinet/ip_mroute.h
@@ -34,7 +34,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)ip_mroute.h	8.1 (Berkeley) 6/10/93
+ *	@(#)ip_mroute.h	8.2 (Berkeley) 4/28/95
  */
 
 /*
@@ -163,6 +163,7 @@ struct mrtstat {
 	u_long	mrts_no_route;		/* no route for packet's origin */
 	u_long	mrts_bad_tunnel;	/* malformed tunnel options */
 	u_long	mrts_cant_tunnel;	/* no room for tunnel options */
+	u_long	mrts_wrong_if;		/* arrived on the wrong interface */
 };
 
 
@@ -170,4 +171,3 @@ int	ip_mrouter_cmd __P((int, struct socket *, struct mbuf *));
 int	ip_mrouter_done __P((void));
 
 #endif /* KERNEL */
-
diff --git a/sys/netinet/ip_var.h b/sys/netinet/ip_var.h
index 27eda5e..5be4fda 100644
--- a/sys/netinet/ip_var.h
+++ b/sys/netinet/ip_var.h
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)ip_var.h	8.1 (Berkeley) 6/10/93
+ *	@(#)ip_var.h	8.2 (Berkeley) 1/9/95
  */
 
 /*
@@ -152,7 +152,7 @@ struct	ipq	ipq;			/* ip reass. queue */
 u_short	ip_id;				/* ip packet ctr, for ids */
 int	ip_defttl;			/* default IP ttl */
 
-int	 in_control __P((struct socket *, int, caddr_t, struct ifnet *));
+int	 in_control __P((struct socket *, u_long, caddr_t, struct ifnet *));
 int	 ip_ctloutput __P((int, struct socket *, int, int, struct mbuf **));
 void	 ip_deq __P((struct ipasfrag *));
 int	 ip_dooptions __P((struct mbuf *));
diff --git a/sys/netinet/raw_ip.c b/sys/netinet/raw_ip.c
index c8092ee..ad621f0 100644
--- a/sys/netinet/raw_ip.c
+++ b/sys/netinet/raw_ip.c
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)raw_ip.c	8.2 (Berkeley) 1/4/94
+ *	@(#)raw_ip.c	8.7 (Berkeley) 5/15/95
  */
 
 #include <sys/param.h>
@@ -93,16 +93,17 @@ rip_input(m)
 		if (inp->inp_ip.ip_p && inp->inp_ip.ip_p != ip->ip_p)
 			continue;
 		if (inp->inp_laddr.s_addr &&
-		    inp->inp_laddr.s_addr == ip->ip_dst.s_addr)
+		    inp->inp_laddr.s_addr != ip->ip_dst.s_addr)
 			continue;
 		if (inp->inp_faddr.s_addr &&
-		    inp->inp_faddr.s_addr == ip->ip_src.s_addr)
+		    inp->inp_faddr.s_addr != ip->ip_src.s_addr)
 			continue;
 		if (last) {
 			struct mbuf *n;
 			if (n = m_copy(m, 0, (int)M_COPYALL)) {
-				if (sbappendaddr(&last->so_rcv, &ripsrc,
-				    n, (struct mbuf *)0) == 0)
+				if (sbappendaddr(&last->so_rcv,
+				    (struct sockaddr *)&ripsrc, n,
+				    (struct mbuf *)0) == 0)
 					/* should notify about lost packet */
 					m_freem(n);
 				else
@@ -112,7 +113,7 @@ rip_input(m)
 		last = inp->inp_socket;
 	}
 	if (last) {
-		if (sbappendaddr(&last->so_rcv, &ripsrc,
+		if (sbappendaddr(&last->so_rcv, (struct sockaddr *)&ripsrc,
 		    m, (struct mbuf *)0) == 0)
 			m_freem(m);
 		else
@@ -179,28 +180,31 @@ rip_ctloutput(op, so, level, optname, m)
 	register struct inpcb *inp = sotoinpcb(so);
 	register int error;
 
-	if (level != IPPROTO_IP)
+	if (level != IPPROTO_IP) {
+		if (op == PRCO_SETOPT && *m)
+			(void) m_free(*m);
 		return (EINVAL);
+	}
 
 	switch (optname) {
 
 	case IP_HDRINCL:
-		if (op == PRCO_SETOPT || op == PRCO_GETOPT) {
-			if (m == 0 || *m == 0 || (*m)->m_len < sizeof (int))
-				return (EINVAL);
-			if (op == PRCO_SETOPT) {
-				if (*mtod(*m, int *))
-					inp->inp_flags |= INP_HDRINCL;
-				else
-					inp->inp_flags &= ~INP_HDRINCL;
+		error = 0;
+		if (op == PRCO_SETOPT) {
+			if (*m == 0 || (*m)->m_len < sizeof (int))
+				error = EINVAL;
+			else if (*mtod(*m, int *))
+				inp->inp_flags |= INP_HDRINCL;
+			else
+				inp->inp_flags &= ~INP_HDRINCL;
+			if (*m)
 				(void)m_free(*m);
-			} else {
-				(*m)->m_len = sizeof (int);
-				*mtod(*m, int *) = inp->inp_flags & INP_HDRINCL;
-			}
-			return (0);
+		} else {
+			*m = m_get(M_WAIT, MT_SOOPTS);
+			(*m)->m_len = sizeof (int);
+			*mtod(*m, int *) = inp->inp_flags & INP_HDRINCL;
 		}
-		break;
+		return (error);
 
 	case DVMRP_INIT:
 	case DVMRP_DONE:
@@ -223,6 +227,24 @@ rip_ctloutput(op, so, level, optname, m)
 			(void)m_free(*m);
 		return (EOPNOTSUPP);
 #endif
+
+	default:
+		if (optname >= DVMRP_INIT) {
+#ifdef MROUTING
+			if (op == PRCO_SETOPT) {
+				error = ip_mrouter_cmd(optname, so, *m);
+				if (*m)
+					(void)m_free(*m);
+			} else
+				error = EINVAL;
+			return (error);
+#else
+			if (op == PRCO_SETOPT && *m)
+				(void)m_free(*m);
+			return (EOPNOTSUPP);
+#endif
+		}
+
 	}
 	return (ip_ctloutput(op, so, level, optname, m));
 }
diff --git a/sys/netinet/tcp_input.c b/sys/netinet/tcp_input.c
index 2dd1d74..9bd82ee 100644
--- a/sys/netinet/tcp_input.c
+++ b/sys/netinet/tcp_input.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994
+ * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_input.c	8.5 (Berkeley) 4/10/94
+ *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
  */
 
 #ifndef TUBA_INCLUDE
@@ -43,6 +43,8 @@
 #include <sys/socketvar.h>
 #include <sys/errno.h>
 
+#include <machine/cpu.h>	/* before tcp_seq.h, for tcp_random18() */
+
 #include <net/if.h>
 #include <net/route.h>
 
@@ -216,7 +218,7 @@ tcp_input(m, iphlen)
 {
 	register struct tcpiphdr *ti;
 	register struct inpcb *inp;
-	caddr_t optp = NULL;
+	u_char *optp = NULL;
 	int optlen;
 	int len, tlen, off;
 	register struct tcpcb *tp = 0;
@@ -281,7 +283,7 @@ tcp_input(m, iphlen)
 			ti = mtod(m, struct tcpiphdr *);
 		}
 		optlen = off - sizeof (struct tcphdr);
-		optp = mtod(m, caddr_t) + sizeof (struct tcpiphdr);
+		optp = mtod(m, u_char *) + sizeof (struct tcpiphdr);
 		/* 
 		 * Do quick retrieval of timestamp options ("options
 		 * prediction?").  If timestamp is the only option and it's
@@ -353,6 +355,17 @@ findpcb:
 			tcp_saveti = *ti;
 		}
 		if (so->so_options & SO_ACCEPTCONN) {
+			if ((tiflags & (TH_RST|TH_ACK|TH_SYN)) != TH_SYN) {
+				/*
+				 * Note: dropwithreset makes sure we don't
+				 * send a reset in response to a RST.
+				 */
+				if (tiflags & TH_ACK) {
+					tcpstat.tcps_badsyn++;
+					goto dropwithreset;
+				}
+				goto drop;
+			}
 			so = sonewconn(so, 0);
 			if (so == 0)
 				goto drop;
@@ -535,19 +548,21 @@ findpcb:
 		struct mbuf *am;
 		register struct sockaddr_in *sin;
 
+#ifdef already_done
 		if (tiflags & TH_RST)
 			goto drop;
 		if (tiflags & TH_ACK)
 			goto dropwithreset;
 		if ((tiflags & TH_SYN) == 0)
 			goto drop;
+#endif
 		/*
 		 * RFC1122 4.2.3.10, p. 104: discard bcast/mcast SYN
 		 * in_broadcast() should never return true on a received
 		 * packet with M_BCAST not set.
 		 */
 		if (m->m_flags & (M_BCAST|M_MCAST) ||
-		    IN_MULTICAST(ti->ti_dst.s_addr))
+		    IN_MULTICAST(ntohl(ti->ti_dst.s_addr)))
 			goto drop;
 		am = m_get(M_DONTWAIT, MT_SONAME);	/* XXX */
 		if (am == NULL)
@@ -581,7 +596,7 @@ findpcb:
 			tp->iss = iss;
 		else
 			tp->iss = tcp_iss;
-		tcp_iss += TCP_ISSINCR/2;
+		tcp_iss += TCP_ISSINCR/4;
 		tp->irs = ti->ti_seq;
 		tcp_sendseqinit(tp);
 		tcp_rcvseqinit(tp);
@@ -733,7 +748,6 @@ trimthenstep6:
 			   ) {
 				todrop = ti->ti_len;
 				tiflags &= ~TH_FIN;
-				tp->t_flags |= TF_ACKNOW;
 			} else {
 				/*
 				 * Handle the case when a bound socket connects
@@ -743,6 +757,7 @@ trimthenstep6:
 				if (todrop != 0 || (tiflags & TH_ACK) == 0)
 					goto dropafterack;
 			}
+			tp->t_flags |= TF_ACKNOW;
 		} else {
 			tcpstat.tcps_rcvpartduppack++;
 			tcpstat.tcps_rcvpartdupbyte += todrop;
@@ -787,7 +802,7 @@ trimthenstep6:
 			if (tiflags & TH_SYN &&
 			    tp->t_state == TCPS_TIME_WAIT &&
 			    SEQ_GT(ti->ti_seq, tp->rcv_nxt)) {
-				iss = tp->rcv_nxt + TCP_ISSINCR;
+				iss = tp->snd_nxt + TCP_ISSINCR;
 				tp = tcp_close(tp);
 				goto findpcb;
 			}
@@ -1017,16 +1032,14 @@ trimthenstep6:
 		 * If the window gives us less than ssthresh packets
 		 * in flight, open exponentially (maxseg per packet).
 		 * Otherwise open linearly: maxseg per window
-		 * (maxseg^2 / cwnd per packet), plus a constant
-		 * fraction of a packet (maxseg/8) to help larger windows
-		 * open quickly enough.
+		 * (maxseg * (maxseg / cwnd) per packet).
 		 */
 		{
 		register u_int cw = tp->snd_cwnd;
 		register u_int incr = tp->t_maxseg;
 
 		if (cw > tp->snd_ssthresh)
-			incr = incr * incr / cw + incr / 8;
+			incr = incr * incr / cw;
 		tp->snd_cwnd = min(cw + incr, TCP_MAXWIN<<tp->snd_scale);
 		}
 		if (acked > so->so_snd.sb_cc) {
@@ -1289,7 +1302,7 @@ dropwithreset:
 	 * Don't bother to respond if destination was broadcast/multicast.
 	 */
 	if ((tiflags & TH_RST) || m->m_flags & (M_BCAST|M_MCAST) ||
-	    IN_MULTICAST(ti->ti_dst.s_addr))
+	    IN_MULTICAST(ntohl(ti->ti_dst.s_addr)))
 		goto drop;
 	if (tiflags & TH_ACK)
 		tcp_respond(tp, ti, m, (tcp_seq)0, ti->ti_ack, TH_RST);
diff --git a/sys/netinet/tcp_output.c b/sys/netinet/tcp_output.c
index 667579f..84f71d9 100644
--- a/sys/netinet/tcp_output.c
+++ b/sys/netinet/tcp_output.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1990, 1993
+ * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_output.c	8.3 (Berkeley) 12/30/93
+ *	@(#)tcp_output.c	8.4 (Berkeley) 5/24/95
  */
 
 #include <sys/param.h>
@@ -318,9 +318,10 @@ send:
 	 * Adjust data length if insertion of options will
 	 * bump the packet length beyond the t_maxseg length.
 	 */
-	 if (len > tp->t_maxseg - optlen) {
+	if (len > tp->t_maxseg - optlen) {
 		len = tp->t_maxseg - optlen;
 		sendalot = 1;
+		flags &= ~TH_FIN;
 	 }
 
 
@@ -369,8 +370,11 @@ send:
 			m->m_len += len;
 		} else {
 			m->m_next = m_copy(so->so_snd.sb_mb, off, (int) len);
-			if (m->m_next == 0)
-				len = 0;
+			if (m->m_next == 0) {
+				(void) m_free(m);
+				error = ENOBUFS;
+				goto out;
+			}
 		}
 #endif
 		/*
diff --git a/sys/netinet/tcp_seq.h b/sys/netinet/tcp_seq.h
index 8912299..08a6331 100644
--- a/sys/netinet/tcp_seq.h
+++ b/sys/netinet/tcp_seq.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1993
+ * Copyright (c) 1982, 1986, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_seq.h	8.1 (Berkeley) 6/10/93
+ *	@(#)tcp_seq.h	8.3 (Berkeley) 6/21/95
  */
 
 /*
@@ -55,8 +55,22 @@
 	(tp)->snd_una = (tp)->snd_nxt = (tp)->snd_max = (tp)->snd_up = \
 	    (tp)->iss
 
-#define	TCP_ISSINCR	(125*1024)	/* increment for tcp_iss each second */
-
 #ifdef KERNEL
+/*
+ * Increment for tcp_iss each second.
+ * This is designed to increment at the standard 250 KB/s,
+ * but with a random component averaging 128 KB.
+ * We also increment tcp_iss by a quarter of this amount
+ * each time we use the value for a new connection.
+ * If defined, the tcp_random18() macro should produce a
+ * number in the range [0-0x3ffff] that is hard to predict.
+ */
+#ifndef tcp_random18
+#define	tcp_random18()	((random() >> 14) & 0x3ffff)
+#endif
+#define	TCP_ISSINCR	(122*1024 + tcp_random18())
+
 tcp_seq	tcp_iss;		/* tcp initial send seq # */
+#else
+#define	TCP_ISSINCR	(250*1024)	/* increment for tcp_iss each second */
 #endif
diff --git a/sys/netinet/tcp_subr.c b/sys/netinet/tcp_subr.c
index 8edb853..9803ec9 100644
--- a/sys/netinet/tcp_subr.c
+++ b/sys/netinet/tcp_subr.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1990, 1993
+ * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_subr.c	8.1 (Berkeley) 6/10/93
+ *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
  */
 
 #include <sys/param.h>
@@ -73,7 +73,7 @@ void
 tcp_init()
 {
 
-	tcp_iss = 1;		/* wrong */
+	tcp_iss = random();	/* wrong, but better than a constant */
 	tcb.inp_next = tcb.inp_prev = &tcb;
 	if (max_protohdr < sizeof(struct tcpiphdr))
 		max_protohdr = sizeof(struct tcpiphdr);
diff --git a/sys/netinet/tcp_timer.c b/sys/netinet/tcp_timer.c
index 0c0f0f8..5883d74 100644
--- a/sys/netinet/tcp_timer.c
+++ b/sys/netinet/tcp_timer.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1990, 1993
+ * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_timer.c	8.1 (Berkeley) 6/10/93
+ *	@(#)tcp_timer.c	8.2 (Berkeley) 5/24/95
  */
 
 #ifndef TUBA_INCLUDE
@@ -43,6 +43,8 @@
 #include <sys/protosw.h>
 #include <sys/errno.h>
 
+#include <machine/cpu.h>	/* before tcp_seq.h, for tcp_random18() */
+
 #include <net/if.h>
 #include <net/route.h>
 
@@ -60,8 +62,14 @@
 
 int	tcp_keepidle = TCPTV_KEEP_IDLE;
 int	tcp_keepintvl = TCPTV_KEEPINTVL;
+int	tcp_keepcnt = TCPTV_KEEPCNT;		/* max idle probes */
+int	tcp_maxpersistidle = TCPTV_KEEP_IDLE;	/* max idle time in persist */
 int	tcp_maxidle;
+#else /* TUBA_INCLUDE */
+
+extern	int tcp_maxpersistidle;
 #endif /* TUBA_INCLUDE */
+
 /*
  * Fast timeout routine for processing delayed acks
  */
@@ -98,7 +106,7 @@ tcp_slowtimo()
 	int s = splnet();
 	register int i;
 
-	tcp_maxidle = TCPTV_KEEPCNT * tcp_keepintvl;
+	tcp_maxidle = tcp_keepcnt * tcp_keepintvl;
 	/*
 	 * Search through tcb's and update active timers.
 	 */
@@ -110,7 +118,7 @@ tcp_slowtimo()
 	for (; ip != &tcb; ip = ipnxt) {
 		ipnxt = ip->inp_next;
 		tp = intotcpcb(ip);
-		if (tp == 0)
+		if (tp == 0 || tp->t_state == TCPS_LISTEN)
 			continue;
 		for (i = 0; i < TCPT_NTIMERS; i++) {
 			if (tp->t_timer[i] && --tp->t_timer[i] == 0) {
@@ -130,7 +138,7 @@ tpgone:
 	tcp_iss += TCP_ISSINCR/PR_SLOWHZ;		/* increment iss */
 #ifdef TCP_COMPAT_42
 	if ((int)tcp_iss < 0)
-		tcp_iss = 0;				/* XXX */
+		tcp_iss = TCP_ISSINCR;			/* XXX */
 #endif
 	tcp_now++;					/* for timestamps */
 	splx(s);
@@ -153,6 +161,8 @@ tcp_canceltimers(tp)
 int	tcp_backoff[TCP_MAXRXTSHIFT + 1] =
     { 1, 2, 4, 8, 16, 32, 64, 64, 64, 64, 64, 64, 64 };
 
+int tcp_totbackoff = 511;	/* sum of tcp_backoff[] */
+
 /*
  * TCP timer processing.
  */
@@ -256,6 +266,20 @@ tcp_timers(tp, timer)
 	 */
 	case TCPT_PERSIST:
 		tcpstat.tcps_persisttimeo++;
+		/*
+		 * Hack: if the peer is dead/unreachable, we do not
+		 * time out if the window is closed.  After a full
+		 * backoff, drop the connection if the idle time
+		 * (no responses to probes) reaches the maximum
+		 * backoff that we would use if retransmitting.
+		 */
+		if (tp->t_rxtshift == TCP_MAXRXTSHIFT &&
+		    (tp->t_idle >= tcp_maxpersistidle ||
+		    tp->t_idle >= TCP_REXMTVAL(tp) * tcp_totbackoff)) {
+			tcpstat.tcps_persistdrop++;
+			tp = tcp_drop(tp, ETIMEDOUT);
+			break;
+		}
 		tcp_setpersist(tp);
 		tp->t_force = 1;
 		(void) tcp_output(tp);
diff --git a/sys/netinet/tcp_usrreq.c b/sys/netinet/tcp_usrreq.c
index 38a08d6..cf9ffff 100644
--- a/sys/netinet/tcp_usrreq.c
+++ b/sys/netinet/tcp_usrreq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1993
+ * Copyright (c) 1982, 1986, 1988, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_usrreq.c	8.2 (Berkeley) 1/3/94
+ *	@(#)tcp_usrreq.c	8.5 (Berkeley) 6/21/95
  */
 
 #include <sys/param.h>
@@ -83,7 +83,7 @@ tcp_usrreq(so, req, m, nam, control)
 	int ostate;
 
 	if (req == PRU_CONTROL)
-		return (in_control(so, (int)m, (caddr_t)nam,
+		return (in_control(so, (u_long)m, (caddr_t)nam,
 			(struct ifnet *)control));
 	if (control && control->m_len) {
 		m_freem(control);
@@ -101,6 +101,18 @@ tcp_usrreq(so, req, m, nam, control)
 	 */
 	if (inp == 0 && req != PRU_ATTACH) {
 		splx(s);
+#if 0
+		/*
+		 * The following corrects an mbuf leak under rare
+		 * circumstances, but has not been fully tested.
+		 */
+		if (m && req != PRU_SENSE)
+			m_freem(m);
+#else
+		/* safer version of fix for mbuf leak */
+		if (m && (req == PRU_SEND || req == PRU_SENDOOB))
+			m_freem(m);
+#endif
 		return (EINVAL);		/* XXX */
 	}
 	if (inp) {
@@ -194,7 +206,7 @@ tcp_usrreq(so, req, m, nam, control)
 		tcpstat.tcps_connattempt++;
 		tp->t_state = TCPS_SYN_SENT;
 		tp->t_timer[TCPT_KEEP] = TCPTV_KEEP_INIT;
-		tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/2;
+		tp->iss = tcp_iss; tcp_iss += TCP_ISSINCR/4;
 		tcp_sendseqinit(tp);
 		error = tcp_output(tp);
 		break;
diff --git a/sys/netinet/tcp_var.h b/sys/netinet/tcp_var.h
index 8a8e751..0ed9517 100644
--- a/sys/netinet/tcp_var.h
+++ b/sys/netinet/tcp_var.h
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1993, 1994
+ * Copyright (c) 1982, 1986, 1993, 1994, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)tcp_var.h	8.3 (Berkeley) 4/10/94
+ *	@(#)tcp_var.h	8.4 (Berkeley) 5/24/95
  */
 
 /*
@@ -100,7 +100,7 @@ struct tcpcb {
  * transmit timing stuff.  See below for scale of srtt and rttvar.
  * "Variance" is actually smoothed difference.
  */
-	short	t_idle;			/* inactivity time */
+	u_short	t_idle;			/* inactivity time */
 	short	t_rtt;			/* round trip time */
 	tcp_seq	t_rtseq;		/* sequence number being timed */
 	short	t_srtt;			/* smoothed round-trip time */
@@ -229,6 +229,8 @@ struct	tcpstat {
 	u_long	tcps_predack;		/* times hdr predict ok for acks */
 	u_long	tcps_preddat;		/* times hdr predict ok for data pkts */
 	u_long	tcps_pcbcachemiss;
+	u_long	tcps_persistdrop;	/* timeout in persist state */
+	u_long	tcps_badsyn;		/* bogus SYN, e.g. premature ACK */
 };
 
 #ifdef KERNEL
diff --git a/sys/netinet/udp_usrreq.c b/sys/netinet/udp_usrreq.c
index 95b1895..07c26fc 100644
--- a/sys/netinet/udp_usrreq.c
+++ b/sys/netinet/udp_usrreq.c
@@ -1,5 +1,5 @@
 /*
- * Copyright (c) 1982, 1986, 1988, 1990, 1993
+ * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
  *	The Regents of the University of California.  All rights reserved.
  *
  * Redistribution and use in source and binary forms, with or without
@@ -30,7 +30,7 @@
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  *
- *	@(#)udp_usrreq.c	8.4 (Berkeley) 1/21/94
+ *	@(#)udp_usrreq.c	8.6 (Berkeley) 5/23/95
  */
 
 #include <sys/param.h>
@@ -137,7 +137,7 @@ udp_input(m, iphlen)
 	/*
 	 * Checksum extended UDP header and data.
 	 */
-	if (udpcksum && uh->uh_sum) {
+	if (uh->uh_sum) {
 		((struct ipovly *)ip)->ih_next = 0;
 		((struct ipovly *)ip)->ih_prev = 0;
 		((struct ipovly *)ip)->ih_x1 = 0;
@@ -477,7 +477,7 @@ udp_usrreq(so, req, m, addr, control)
 	int s;
 
 	if (req == PRU_CONTROL)
-		return (in_control(so, (int)m, (caddr_t)addr,
+		return (in_control(so, (u_long)m, (caddr_t)addr,
 			(struct ifnet *)control));
 	if (inp == NULL && req != PRU_ATTACH) {
 		error = EINVAL;