xref: /freebsd/sys/netinet/tcp_reass.c (revision 39ee7a7a6bdd1557b1c3532abf60d139798ac88b)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1994, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_input.c	8.12 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_inet.h"
36 #include "opt_inet6.h"
37 #include "opt_tcpdebug.h"
38 
39 #include <sys/param.h>
40 #include <sys/kernel.h>
41 #include <sys/malloc.h>
42 #include <sys/mbuf.h>
43 #include <sys/socket.h>
44 #include <sys/socketvar.h>
45 #include <sys/sysctl.h>
46 #include <sys/syslog.h>
47 #include <sys/systm.h>
48 
49 #include <vm/uma.h>
50 
51 #include <net/if.h>
52 #include <net/if_var.h>
53 #include <net/route.h>
54 #include <net/vnet.h>
55 
56 #include <netinet/in.h>
57 #include <netinet/in_pcb.h>
58 #include <netinet/in_systm.h>
59 #include <netinet/in_var.h>
60 #include <netinet/ip.h>
61 #include <netinet/ip_var.h>
62 #include <netinet/ip_options.h>
63 #include <netinet/ip6.h>
64 #include <netinet6/in6_pcb.h>
65 #include <netinet6/ip6_var.h>
66 #include <netinet6/nd6.h>
67 #include <netinet/tcp.h>
68 #include <netinet/tcp_fsm.h>
69 #include <netinet/tcp_seq.h>
70 #include <netinet/tcp_timer.h>
71 #include <netinet/tcp_var.h>
72 #include <netinet6/tcp6_var.h>
73 #include <netinet/tcpip.h>
74 #ifdef TCPDEBUG
75 #include <netinet/tcp_debug.h>
76 #endif /* TCPDEBUG */
77 
78 static SYSCTL_NODE(_net_inet_tcp, OID_AUTO, reass, CTLFLAG_RW, 0,
79     "TCP Segment Reassembly Queue");
80 
81 static int tcp_reass_maxseg = 0;
82 SYSCTL_INT(_net_inet_tcp_reass, OID_AUTO, maxsegments, CTLFLAG_RDTUN,
83     &tcp_reass_maxseg, 0,
84     "Global maximum number of TCP Segments in Reassembly Queue");
85 
86 static uma_zone_t tcp_reass_zone;
87 SYSCTL_UMA_CUR(_net_inet_tcp_reass, OID_AUTO, cursegments, 0,
88     &tcp_reass_zone,
89     "Global number of TCP Segments currently in Reassembly Queue");
90 
91 /* Initialize TCP reassembly queue */
92 static void
93 tcp_reass_zone_change(void *tag)
94 {
95 
96 	/* Set the zone limit and read back the effective value. */
97 	tcp_reass_maxseg = nmbclusters / 16;
98 	tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone,
99 	    tcp_reass_maxseg);
100 }
101 
102 void
103 tcp_reass_global_init(void)
104 {
105 
106 	tcp_reass_maxseg = nmbclusters / 16;
107 	TUNABLE_INT_FETCH("net.inet.tcp.reass.maxsegments",
108 	    &tcp_reass_maxseg);
109 	tcp_reass_zone = uma_zcreate("tcpreass", sizeof (struct tseg_qent),
110 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
111 	/* Set the zone limit and read back the effective value. */
112 	tcp_reass_maxseg = uma_zone_set_max(tcp_reass_zone,
113 	    tcp_reass_maxseg);
114 	EVENTHANDLER_REGISTER(nmbclusters_change,
115 	    tcp_reass_zone_change, NULL, EVENTHANDLER_PRI_ANY);
116 }
117 
118 void
119 tcp_reass_flush(struct tcpcb *tp)
120 {
121 	struct tseg_qent *qe;
122 
123 	INP_WLOCK_ASSERT(tp->t_inpcb);
124 
125 	while ((qe = LIST_FIRST(&tp->t_segq)) != NULL) {
126 		LIST_REMOVE(qe, tqe_q);
127 		m_freem(qe->tqe_m);
128 		uma_zfree(tcp_reass_zone, qe);
129 		tp->t_segqlen--;
130 	}
131 
132 	KASSERT((tp->t_segqlen == 0),
133 	    ("TCP reass queue %p segment count is %d instead of 0 after flush.",
134 	    tp, tp->t_segqlen));
135 }
136 
137 int
138 tcp_reass(struct tcpcb *tp, struct tcphdr *th, int *tlenp, struct mbuf *m)
139 {
140 	struct tseg_qent *q;
141 	struct tseg_qent *p = NULL;
142 	struct tseg_qent *nq;
143 	struct tseg_qent *te = NULL;
144 	struct socket *so = tp->t_inpcb->inp_socket;
145 	char *s = NULL;
146 	int flags;
147 	struct tseg_qent tqs;
148 
149 	INP_WLOCK_ASSERT(tp->t_inpcb);
150 
151 	/*
152 	 * XXX: tcp_reass() is rather inefficient with its data structures
153 	 * and should be rewritten (see NetBSD for optimizations).
154 	 */
155 
156 	/*
157 	 * Call with th==NULL after become established to
158 	 * force pre-ESTABLISHED data up to user socket.
159 	 */
160 	if (th == NULL)
161 		goto present;
162 
163 	/*
164 	 * Limit the number of segments that can be queued to reduce the
165 	 * potential for mbuf exhaustion. For best performance, we want to be
166 	 * able to queue a full window's worth of segments. The size of the
167 	 * socket receive buffer determines our advertised window and grows
168 	 * automatically when socket buffer autotuning is enabled. Use it as the
169 	 * basis for our queue limit.
170 	 * Always let the missing segment through which caused this queue.
171 	 * NB: Access to the socket buffer is left intentionally unlocked as we
172 	 * can tolerate stale information here.
173 	 *
174 	 * XXXLAS: Using sbspace(so->so_rcv) instead of so->so_rcv.sb_hiwat
175 	 * should work but causes packets to be dropped when they shouldn't.
176 	 * Investigate why and re-evaluate the below limit after the behaviour
177 	 * is understood.
178 	 */
179 	if ((th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) &&
180 	    tp->t_segqlen >= (so->so_rcv.sb_hiwat / tp->t_maxseg) + 1) {
181 		TCPSTAT_INC(tcps_rcvreassfull);
182 		*tlenp = 0;
183 		if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL, NULL))) {
184 			log(LOG_DEBUG, "%s; %s: queue limit reached, "
185 			    "segment dropped\n", s, __func__);
186 			free(s, M_TCPLOG);
187 		}
188 		m_freem(m);
189 		return (0);
190 	}
191 
192 	/*
193 	 * Allocate a new queue entry. If we can't, or hit the zone limit
194 	 * just drop the pkt.
195 	 *
196 	 * Use a temporary structure on the stack for the missing segment
197 	 * when the zone is exhausted. Otherwise we may get stuck.
198 	 */
199 	te = uma_zalloc(tcp_reass_zone, M_NOWAIT);
200 	if (te == NULL) {
201 		if (th->th_seq != tp->rcv_nxt || !TCPS_HAVEESTABLISHED(tp->t_state)) {
202 			TCPSTAT_INC(tcps_rcvmemdrop);
203 			m_freem(m);
204 			*tlenp = 0;
205 			if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL,
206 			    NULL))) {
207 				log(LOG_DEBUG, "%s; %s: global zone limit "
208 				    "reached, segment dropped\n", s, __func__);
209 				free(s, M_TCPLOG);
210 			}
211 			return (0);
212 		} else {
213 			bzero(&tqs, sizeof(struct tseg_qent));
214 			te = &tqs;
215 			if ((s = tcp_log_addrs(&tp->t_inpcb->inp_inc, th, NULL,
216 			    NULL))) {
217 				log(LOG_DEBUG,
218 				    "%s; %s: global zone limit reached, using "
219 				    "stack for missing segment\n", s, __func__);
220 				free(s, M_TCPLOG);
221 			}
222 		}
223 	}
224 	tp->t_segqlen++;
225 
226 	/*
227 	 * Find a segment which begins after this one does.
228 	 */
229 	LIST_FOREACH(q, &tp->t_segq, tqe_q) {
230 		if (SEQ_GT(q->tqe_th->th_seq, th->th_seq))
231 			break;
232 		p = q;
233 	}
234 
235 	/*
236 	 * If there is a preceding segment, it may provide some of
237 	 * our data already.  If so, drop the data from the incoming
238 	 * segment.  If it provides all of our data, drop us.
239 	 */
240 	if (p != NULL) {
241 		int i;
242 		/* conversion to int (in i) handles seq wraparound */
243 		i = p->tqe_th->th_seq + p->tqe_len - th->th_seq;
244 		if (i > 0) {
245 			if (i >= *tlenp) {
246 				TCPSTAT_INC(tcps_rcvduppack);
247 				TCPSTAT_ADD(tcps_rcvdupbyte, *tlenp);
248 				m_freem(m);
249 				if (te != &tqs)
250 					uma_zfree(tcp_reass_zone, te);
251 				tp->t_segqlen--;
252 				/*
253 				 * Try to present any queued data
254 				 * at the left window edge to the user.
255 				 * This is needed after the 3-WHS
256 				 * completes.
257 				 */
258 				goto present;	/* ??? */
259 			}
260 			m_adj(m, i);
261 			*tlenp -= i;
262 			th->th_seq += i;
263 		}
264 	}
265 	tp->t_rcvoopack++;
266 	TCPSTAT_INC(tcps_rcvoopack);
267 	TCPSTAT_ADD(tcps_rcvoobyte, *tlenp);
268 
269 	/*
270 	 * While we overlap succeeding segments trim them or,
271 	 * if they are completely covered, dequeue them.
272 	 */
273 	while (q) {
274 		int i = (th->th_seq + *tlenp) - q->tqe_th->th_seq;
275 		if (i <= 0)
276 			break;
277 		if (i < q->tqe_len) {
278 			q->tqe_th->th_seq += i;
279 			q->tqe_len -= i;
280 			m_adj(q->tqe_m, i);
281 			break;
282 		}
283 
284 		nq = LIST_NEXT(q, tqe_q);
285 		LIST_REMOVE(q, tqe_q);
286 		m_freem(q->tqe_m);
287 		uma_zfree(tcp_reass_zone, q);
288 		tp->t_segqlen--;
289 		q = nq;
290 	}
291 
292 	/* Insert the new segment queue entry into place. */
293 	te->tqe_m = m;
294 	te->tqe_th = th;
295 	te->tqe_len = *tlenp;
296 
297 	if (p == NULL) {
298 		LIST_INSERT_HEAD(&tp->t_segq, te, tqe_q);
299 	} else {
300 		KASSERT(te != &tqs, ("%s: temporary stack based entry not "
301 		    "first element in queue", __func__));
302 		LIST_INSERT_AFTER(p, te, tqe_q);
303 	}
304 
305 present:
306 	/*
307 	 * Present data to user, advancing rcv_nxt through
308 	 * completed sequence space.
309 	 */
310 	if (!TCPS_HAVEESTABLISHED(tp->t_state))
311 		return (0);
312 	q = LIST_FIRST(&tp->t_segq);
313 	if (!q || q->tqe_th->th_seq != tp->rcv_nxt)
314 		return (0);
315 	SOCKBUF_LOCK(&so->so_rcv);
316 	do {
317 		tp->rcv_nxt += q->tqe_len;
318 		flags = q->tqe_th->th_flags & TH_FIN;
319 		nq = LIST_NEXT(q, tqe_q);
320 		LIST_REMOVE(q, tqe_q);
321 		if (so->so_rcv.sb_state & SBS_CANTRCVMORE)
322 			m_freem(q->tqe_m);
323 		else
324 			sbappendstream_locked(&so->so_rcv, q->tqe_m, 0);
325 		if (q != &tqs)
326 			uma_zfree(tcp_reass_zone, q);
327 		tp->t_segqlen--;
328 		q = nq;
329 	} while (q && q->tqe_th->th_seq == tp->rcv_nxt);
330 	sorwakeup_locked(so);
331 	return (flags);
332 }
333