From owner-freebsd-net@FreeBSD.ORG  Fri Jun  8 15:03:23 2007
Return-Path: <owner-freebsd-net@FreeBSD.ORG>
X-Original-To: net@freebsd.org
Delivered-To: freebsd-net@FreeBSD.ORG
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
	by hub.freebsd.org (Postfix) with ESMTP id EF4E716A49E;
	Fri,  8 Jun 2007 15:03:23 +0000 (UTC)
	(envelope-from yar@comp.chem.msu.su)
Received: from comp.chem.msu.su (comp.chem.msu.su [158.250.32.97])
	by mx1.freebsd.org (Postfix) with ESMTP id 88B1413C44C;
	Fri,  8 Jun 2007 15:03:21 +0000 (UTC)
	(envelope-from yar@comp.chem.msu.su)
Received: from comp.chem.msu.su (localhost [127.0.0.1])
	by comp.chem.msu.su (8.13.4/8.13.4) with ESMTP id l58EQgrf076047;
	Fri, 8 Jun 2007 18:26:42 +0400 (MSD)
	(envelope-from yar@comp.chem.msu.su)
Received: (from yar@localhost)
	by comp.chem.msu.su (8.13.4/8.13.4/Submit) id l58EQf9E076046;
	Fri, 8 Jun 2007 18:26:41 +0400 (MSD) (envelope-from yar)
Date: Fri, 8 Jun 2007 18:26:41 +0400
From: Yar Tikhiy <yar@comp.chem.msu.su>
To: andre@freebsd.org, net@freebsd.org
Message-ID: <20070608142641.GA25127@comp.chem.msu.su>
Mime-Version: 1.0
Content-Type: text/plain; charset=us-ascii
Content-Disposition: inline
User-Agent: Mutt/1.5.9i
Cc: 
Subject: A small window-related bug in tcp_input.c?
X-BeenThere: freebsd-net@freebsd.org
X-Mailman-Version: 2.1.5
Precedence: list
List-Id: Networking and TCP/IP with FreeBSD <freebsd-net.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-net>
List-Post: <mailto:freebsd-net@freebsd.org>
List-Help: <mailto:freebsd-net-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/freebsd-net>,
	<mailto:freebsd-net-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Fri, 08 Jun 2007 15:03:24 -0000

There is the following code in tcp_input.c (I "underlined" two
questionable lines):

        /*
         * Process options only when we get SYN/ACK back. The SYN case
         * for incoming connections is handled in tcp_syncache.
         * XXX this is traditional behavior, may need to be cleaned up.
         */
        if (tp->t_state == TCPS_SYN_SENT && (thflags & TH_SYN)) {
                if ((to.to_flags & TOF_SCALE) &&
                    (tp->t_flags & TF_REQ_SCALE)) {
                        tp->t_flags |= TF_RCVD_SCALE;
                        tp->snd_scale = to.to_wscale;
                        tp->snd_wnd = th->th_win << tp->snd_scale;
                        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
                        tiwin = tp->snd_wnd;
                }
                if (to.to_flags & TOF_TS) {
                        tp->t_flags |= TF_RCVD_TSTMP;
                        tp->ts_recent = to.to_tsval;
                        tp->ts_recent_age = ticks;
                }
                /* Initial send window, already scaled. */
                tp->snd_wnd = th->th_win;
                ^^^^^^^^^^^^^^^^^^^^^^^^^
                if (to.to_flags & TOF_MSS)
                        tcp_mss(tp, to.to_mss);
                if ((tp->t_flags & TF_SACK_PERMIT) &&
                    (to.to_flags & TOF_SACKPERM) == 0)
                        tp->t_flags &= ~TF_SACK_PERMIT;
        }

Is it correct that the scaled value in tp->snd_wnd is later overwritten
with the unscaled value from th->th_win?

-- 
Yar