Merge branch 'freebsd/12-stable/master' into hardened/12-stable/master

* freebsd/12-stable/master:
  MFC r366150: TCP: send full initial window when timestamps are in use
  MFC r366149: TCP newreno: improve after_idle ssthresh

sys/netinet/cc/cc_newreno.c

@@ -213,6 +213,10 @@ newreno_after_idle(struct cc_var *ccv)
 	 * wirespeed, overloading router and switch buffers along the way.
 	 *
 	 * See RFC5681 Section 4.1. "Restarting Idle Connections".
+	 *
+	 * In addition, per RFC2861 Section 2, the ssthresh is set to the
+	 * maximum of the former ssthresh or 3/4 of the old cwnd, to
+	 * not exit slow-start prematurely.
 	 */
 	if (V_tcp_do_rfc3390)
 		rw = min(4 * CCV(ccv, t_maxseg),
@@ -220,6 +224,9 @@ newreno_after_idle(struct cc_var *ccv)
 	else
 		rw = CCV(ccv, t_maxseg) * 2;
 
+	CCV(ccv, snd_ssthresh) = max(CCV(ccv, snd_ssthresh),
+	    CCV(ccv, snd_cwnd)-(CCV(ccv, snd_cwnd)>>2));
+
 	CCV(ccv, snd_cwnd) = min(rw, CCV(ccv, snd_cwnd));
 }
 

sys/netinet/tcp.h

@@ -80,6 +80,8 @@ struct tcphdr {
 	u_short	th_urp;			/* urgent pointer */
 };
 
+#define	PADTCPOLEN(len)		((((len) / 4) + !!((len) % 4)) * 4)
+
 #define	TCPOPT_EOL		0
 #define	   TCPOLEN_EOL			1
 #define	TCPOPT_PAD		0		/* padding after EOL */

sys/netinet/tcp_output.c

@@ -576,6 +576,20 @@ tcp_output(struct tcpcb *tp)
 	if (len) {
 		if (len >= tp->t_maxseg)
 			goto send;
+		/*
+		 * As the TCP header options are now
+		 * considered when setting up the initial
+		 * window, we would not send the last segment
+		 * if we skip considering the option length here.
+		 * Note: this may not work when tcp headers change
+		 * very dynamically in the future.
+		 */
+		if ((((tp->t_flags & TF_SIGNATURE) ?
+			PADTCPOLEN(TCPOLEN_SIGNATURE) : 0) +
+		    ((tp->t_flags & TF_RCVD_TSTMP) ?
+			PADTCPOLEN(TCPOLEN_TIMESTAMP) : 0) +
+		    len) >= tp->t_maxseg)
+			goto send;
 		/*
 		 * NOTE! on localhost connections an 'ack' from the remote
 		 * end may occur synchronously with the output and cause

sys/netinet/tcp_subr.c

@@ -2941,7 +2941,6 @@ tcp_maxseg(const struct tcpcb *tp)
 	 * but this is harmless, since result of tcp_maxseg() is used
 	 * only in cwnd and ssthresh estimations.
 	 */
-#define	PAD(len)	((((len) / 4) + !!((len) % 4)) * 4)
 	if (TCPS_HAVEESTABLISHED(tp->t_state)) {
 		if (tp->t_flags & TF_RCVD_TSTMP)
 			optlen = TCPOLEN_TSTAMP_APPA;
@@ -2949,26 +2948,26 @@ tcp_maxseg(const struct tcpcb *tp)
 			optlen = 0;
 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
 		if (tp->t_flags & TF_SIGNATURE)
-			optlen += PAD(TCPOLEN_SIGNATURE);
+			optlen += PADTCPOLEN(TCPOLEN_SIGNATURE);
 #endif
 		if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks > 0) {
 			optlen += TCPOLEN_SACKHDR;
 			optlen += tp->rcv_numsacks * TCPOLEN_SACK;
-			optlen = PAD(optlen);
+			optlen = PADTCPOLEN(optlen);
 		}
 	} else {
 		if (tp->t_flags & TF_REQ_TSTMP)
 			optlen = TCPOLEN_TSTAMP_APPA;
 		else
-			optlen = PAD(TCPOLEN_MAXSEG);
+			optlen = PADTCPOLEN(TCPOLEN_MAXSEG);
 		if (tp->t_flags & TF_REQ_SCALE)
-			optlen += PAD(TCPOLEN_WINDOW);
+			optlen += PADTCPOLEN(TCPOLEN_WINDOW);
 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
 		if (tp->t_flags & TF_SIGNATURE)
-			optlen += PAD(TCPOLEN_SIGNATURE);
+			optlen += PADTCPOLEN(TCPOLEN_SIGNATURE);
 #endif
 		if (tp->t_flags & TF_SACK_PERMIT)
-			optlen += PAD(TCPOLEN_SACK_PERMITTED);
+			optlen += PADTCPOLEN(TCPOLEN_SACK_PERMITTED);
 	}
 #undef PAD
 	optlen = min(optlen, TCP_MAXOLEN);