1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved. 25 * Copyright (c) 2013, 2017 by Delphix. All rights reserved. 26 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved. 27 * Copyright 2020 Joyent, Inc. 28 * Copyright 2022 Oxide Computer Company 29 */ 30 /* Copyright (c) 1990 Mentat Inc. */ 31 32 #include <sys/types.h> 33 #include <sys/stream.h> 34 #include <sys/strsun.h> 35 #include <sys/strsubr.h> 36 #include <sys/stropts.h> 37 #include <sys/strlog.h> 38 #define _SUN_TPI_VERSION 2 39 #include <sys/tihdr.h> 40 #include <sys/timod.h> 41 #include <sys/ddi.h> 42 #include <sys/sunddi.h> 43 #include <sys/suntpi.h> 44 #include <sys/xti_inet.h> 45 #include <sys/cmn_err.h> 46 #include <sys/debug.h> 47 #include <sys/sdt.h> 48 #include <sys/vtrace.h> 49 #include <sys/kmem.h> 50 #include <sys/ethernet.h> 51 #include <sys/cpuvar.h> 52 #include <sys/dlpi.h> 53 #include <sys/pattr.h> 54 #include <sys/policy.h> 55 #include <sys/priv.h> 56 #include <sys/zone.h> 57 #include <sys/sunldi.h> 58 59 #include <sys/errno.h> 60 #include <sys/signal.h> 61 #include <sys/socket.h> 62 #include <sys/socketvar.h> 63 #include <sys/sockio.h> 64 #include <sys/isa_defs.h> 65 #include <sys/md5.h> 66 #include <sys/random.h> 67 #include <sys/uio.h> 68 #include <sys/systm.h> 69 #include <netinet/in.h> 70 #include <netinet/tcp.h> 71 #include <netinet/ip6.h> 72 #include <netinet/icmp6.h> 73 #include <net/if.h> 74 #include <net/route.h> 75 #include <inet/ipsec_impl.h> 76 77 #include <inet/common.h> 78 #include <inet/cc.h> 79 #include <inet/ip.h> 80 #include <inet/ip_impl.h> 81 #include <inet/ip6.h> 82 #include <inet/ip_ndp.h> 83 #include <inet/proto_set.h> 84 #include <inet/mib2.h> 85 #include <inet/optcom.h> 86 #include <inet/snmpcom.h> 87 #include <inet/kstatcom.h> 88 #include <inet/tcp.h> 89 #include <inet/tcp_impl.h> 90 #include <inet/tcp_cluster.h> 91 #include <inet/udp_impl.h> 92 #include <net/pfkeyv2.h> 93 #include <inet/ipdrop.h> 94 95 #include <inet/ipclassifier.h> 96 #include <inet/ip_ire.h> 97 #include <inet/ip_ftable.h> 98 #include <inet/ip_if.h> 99 #include <inet/ipp_common.h> 100 #include <inet/ip_rts.h> 101 #include <inet/ip_netinfo.h> 102 #include <sys/squeue_impl.h> 103 #include <sys/squeue.h> 104 #include <sys/tsol/label.h> 105 #include <sys/tsol/tnet.h> 106 #include <rpc/pmap_prot.h> 107 #include <sys/callo.h> 108 109 /* 110 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 111 * 112 * (Read the detailed design doc in PSARC case directory) 113 * 114 * The entire tcp state is contained in tcp_t and conn_t structure 115 * which are allocated in tandem using ipcl_conn_create() and passing 116 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect 117 * the references on the tcp_t. The tcp_t structure is never compressed 118 * and packets always land on the correct TCP perimeter from the time 119 * eager is created till the time tcp_t dies (as such the old mentat 120 * TCP global queue is not used for detached state and no IPSEC checking 121 * is required). The global queue is still allocated to send out resets 122 * for connection which have no listeners and IP directly calls 123 * tcp_xmit_listeners_reset() which does any policy check. 124 * 125 * Protection and Synchronisation mechanism: 126 * 127 * The tcp data structure does not use any kind of lock for protecting 128 * its state but instead uses 'squeues' for mutual exclusion from various 129 * read and write side threads. To access a tcp member, the thread should 130 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS, 131 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller 132 * can pass any tcp function having prototype of edesc_t as argument 133 * (different from traditional STREAMs model where packets come in only 134 * designated entry points). The list of functions that can be directly 135 * called via squeue are listed before the usual function prototype. 136 * 137 * Referencing: 138 * 139 * TCP is MT-Hot and we use a reference based scheme to make sure that the 140 * tcp structure doesn't disappear when its needed. When the application 141 * creates an outgoing connection or accepts an incoming connection, we 142 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 143 * The IP reference is just a symbolic reference since ip_tcpclose() 144 * looks at tcp structure after tcp_close_output() returns which could 145 * have dropped the last TCP reference. So as long as the connection is 146 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 147 * conn_t. The classifier puts its own reference when the connection is 148 * inserted in listen or connected hash. Anytime a thread needs to enter 149 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 150 * on write side or by doing a classify on read side and then puts a 151 * reference on the conn before doing squeue_enter/tryenter/fill. For 152 * read side, the classifier itself puts the reference under fanout lock 153 * to make sure that tcp can't disappear before it gets processed. The 154 * squeue will drop this reference automatically so the called function 155 * doesn't have to do a DEC_REF. 156 * 157 * Opening a new connection: 158 * 159 * The outgoing connection open is pretty simple. tcp_open() does the 160 * work in creating the conn/tcp structure and initializing it. The 161 * squeue assignment is done based on the CPU the application 162 * is running on. So for outbound connections, processing is always done 163 * on application CPU which might be different from the incoming CPU 164 * being interrupted by the NIC. An optimal way would be to figure out 165 * the NIC <-> CPU binding at listen time, and assign the outgoing 166 * connection to the squeue attached to the CPU that will be interrupted 167 * for incoming packets (we know the NIC based on the bind IP address). 168 * This might seem like a problem if more data is going out but the 169 * fact is that in most cases the transmit is ACK driven transmit where 170 * the outgoing data normally sits on TCP's xmit queue waiting to be 171 * transmitted. 172 * 173 * Accepting a connection: 174 * 175 * This is a more interesting case because of various races involved in 176 * establishing a eager in its own perimeter. Read the meta comment on 177 * top of tcp_input_listener(). But briefly, the squeue is picked by 178 * ip_fanout based on the ring or the sender (if loopback). 179 * 180 * Closing a connection: 181 * 182 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 183 * via squeue to do the close and mark the tcp as detached if the connection 184 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 185 * reference but tcp_close() drop IP's reference always. So if tcp was 186 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 187 * and 1 because it is in classifier's connected hash. This is the condition 188 * we use to determine that its OK to clean up the tcp outside of squeue 189 * when time wait expires (check the ref under fanout and conn_lock and 190 * if it is 2, remove it from fanout hash and kill it). 191 * 192 * Although close just drops the necessary references and marks the 193 * tcp_detached state, tcp_close needs to know the tcp_detached has been 194 * set (under squeue) before letting the STREAM go away (because a 195 * inbound packet might attempt to go up the STREAM while the close 196 * has happened and tcp_detached is not set). So a special lock and 197 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 198 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 199 * tcp_detached. 200 * 201 * Special provisions and fast paths: 202 * 203 * We make special provisions for sockfs by marking tcp_issocket 204 * whenever we have only sockfs on top of TCP. This allows us to skip 205 * putting the tcp in acceptor hash since a sockfs listener can never 206 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 207 * since eager has already been allocated and the accept now happens 208 * on acceptor STREAM. There is a big blob of comment on top of 209 * tcp_input_listener explaining the new accept. When socket is POP'd, 210 * sockfs sends us an ioctl to mark the fact and we go back to old 211 * behaviour. Once tcp_issocket is unset, its never set for the 212 * life of that connection. 213 * 214 * IPsec notes : 215 * 216 * Since a packet is always executed on the correct TCP perimeter 217 * all IPsec processing is defered to IP including checking new 218 * connections and setting IPSEC policies for new connection. The 219 * only exception is tcp_xmit_listeners_reset() which is called 220 * directly from IP and needs to policy check to see if TH_RST 221 * can be sent out. 222 */ 223 224 /* 225 * Values for squeue switch: 226 * 1: SQ_NODRAIN 227 * 2: SQ_PROCESS 228 * 3: SQ_FILL 229 */ 230 int tcp_squeue_wput = 2; /* /etc/systems */ 231 int tcp_squeue_flag; 232 233 /* 234 * To prevent memory hog, limit the number of entries in tcp_free_list 235 * to 1% of available memory / number of cpus 236 */ 237 uint_t tcp_free_list_max_cnt = 0; 238 239 #define TIDUSZ 4096 /* transport interface data unit size */ 240 241 /* 242 * Size of acceptor hash list. It has to be a power of 2 for hashing. 243 */ 244 #define TCP_ACCEPTOR_FANOUT_SIZE 512 245 246 #ifdef _ILP32 247 #define TCP_ACCEPTOR_HASH(accid) \ 248 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 249 #else 250 #define TCP_ACCEPTOR_HASH(accid) \ 251 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 252 #endif /* _ILP32 */ 253 254 /* 255 * Minimum number of connections which can be created per listener. Used 256 * when the listener connection count is in effect. 257 */ 258 static uint32_t tcp_min_conn_listener = 2; 259 260 uint32_t tcp_early_abort = 30; 261 262 /* TCP Timer control structure */ 263 typedef struct tcpt_s { 264 pfv_t tcpt_pfv; /* The routine we are to call */ 265 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 266 } tcpt_t; 267 268 /* 269 * Functions called directly via squeue having a prototype of edesc_t. 270 */ 271 void tcp_input_data(void *arg, mblk_t *mp, void *arg2, 272 ip_recv_attr_t *ira); 273 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, 274 ip_recv_attr_t *dummy); 275 276 277 /* Prototype for TCP functions */ 278 static void tcp_random_init(void); 279 int tcp_random(void); 280 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, 281 in_port_t dstport, uint_t srcid); 282 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, 283 in_port_t dstport, uint32_t flowinfo, 284 uint_t srcid, uint32_t scope_id); 285 static void tcp_iss_init(tcp_t *tcp); 286 static void tcp_reinit(tcp_t *tcp); 287 static void tcp_reinit_values(tcp_t *tcp); 288 289 static int tcp_wsrv(queue_t *q); 290 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa); 291 static void tcp_update_zcopy(tcp_t *tcp); 292 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 293 ixa_notify_arg_t); 294 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); 295 static void tcp_stack_fini(netstackid_t stackid, void *arg); 296 297 static int tcp_squeue_switch(int); 298 299 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); 300 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); 301 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); 302 303 static void tcp_squeue_add(squeue_t *); 304 305 struct module_info tcp_rinfo = { 306 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 307 }; 308 309 static struct module_info tcp_winfo = { 310 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 311 }; 312 313 /* 314 * Entry points for TCP as a device. The normal case which supports 315 * the TCP functionality. 316 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. 317 */ 318 struct qinit tcp_rinitv4 = { 319 NULL, tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo 320 }; 321 322 struct qinit tcp_rinitv6 = { 323 NULL, tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo 324 }; 325 326 struct qinit tcp_winit = { 327 tcp_wput, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 328 }; 329 330 /* Initial entry point for TCP in socket mode. */ 331 struct qinit tcp_sock_winit = { 332 tcp_wput_sock, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 333 }; 334 335 /* TCP entry point during fallback */ 336 struct qinit tcp_fallback_sock_winit = { 337 tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo 338 }; 339 340 /* 341 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 342 * an accept. Avoid allocating data structures since eager has already 343 * been created. 344 */ 345 struct qinit tcp_acceptor_rinit = { 346 NULL, tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo 347 }; 348 349 struct qinit tcp_acceptor_winit = { 350 tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo 351 }; 352 353 /* For AF_INET aka /dev/tcp */ 354 struct streamtab tcpinfov4 = { 355 &tcp_rinitv4, &tcp_winit 356 }; 357 358 /* For AF_INET6 aka /dev/tcp6 */ 359 struct streamtab tcpinfov6 = { 360 &tcp_rinitv6, &tcp_winit 361 }; 362 363 /* 364 * Following assumes TPI alignment requirements stay along 32 bit 365 * boundaries 366 */ 367 #define ROUNDUP32(x) \ 368 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 369 370 /* Template for response to info request. */ 371 struct T_info_ack tcp_g_t_info_ack = { 372 T_INFO_ACK, /* PRIM_type */ 373 0, /* TSDU_size */ 374 T_INFINITE, /* ETSDU_size */ 375 T_INVALID, /* CDATA_size */ 376 T_INVALID, /* DDATA_size */ 377 sizeof (sin_t), /* ADDR_size */ 378 0, /* OPT_size - not initialized here */ 379 TIDUSZ, /* TIDU_size */ 380 T_COTS_ORD, /* SERV_type */ 381 TCPS_IDLE, /* CURRENT_state */ 382 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 383 }; 384 385 struct T_info_ack tcp_g_t_info_ack_v6 = { 386 T_INFO_ACK, /* PRIM_type */ 387 0, /* TSDU_size */ 388 T_INFINITE, /* ETSDU_size */ 389 T_INVALID, /* CDATA_size */ 390 T_INVALID, /* DDATA_size */ 391 sizeof (sin6_t), /* ADDR_size */ 392 0, /* OPT_size - not initialized here */ 393 TIDUSZ, /* TIDU_size */ 394 T_COTS_ORD, /* SERV_type */ 395 TCPS_IDLE, /* CURRENT_state */ 396 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 397 }; 398 399 /* 400 * TCP tunables related declarations. Definitions are in tcp_tunables.c 401 */ 402 extern mod_prop_info_t tcp_propinfo_tbl[]; 403 extern int tcp_propinfo_count; 404 405 #define IS_VMLOANED_MBLK(mp) \ 406 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 407 408 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 409 410 /* 411 * Forces all connections to obey the value of the tcps_maxpsz_multiplier 412 * tunable settable via NDD. Otherwise, the per-connection behavior is 413 * determined dynamically during tcp_set_destination(), which is the default. 414 */ 415 boolean_t tcp_static_maxpsz = B_FALSE; 416 417 /* 418 * If the receive buffer size is changed, this function is called to update 419 * the upper socket layer on the new delayed receive wake up threshold. 420 */ 421 static void 422 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh) 423 { 424 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3; 425 426 if (IPCL_IS_NONSTR(tcp->tcp_connp)) { 427 conn_t *connp = tcp->tcp_connp; 428 struct sock_proto_props sopp; 429 430 /* 431 * only increase rcvthresh upto default_threshold 432 */ 433 if (new_rcvthresh > default_threshold) 434 new_rcvthresh = default_threshold; 435 436 sopp.sopp_flags = SOCKOPT_RCVTHRESH; 437 sopp.sopp_rcvthresh = new_rcvthresh; 438 439 (*connp->conn_upcalls->su_set_proto_props) 440 (connp->conn_upper_handle, &sopp); 441 } 442 } 443 444 /* 445 * Figure out the value of window scale opton. Note that the rwnd is 446 * ASSUMED to be rounded up to the nearest MSS before the calculation. 447 * We cannot find the scale value and then do a round up of tcp_rwnd 448 * because the scale value may not be correct after that. 449 * 450 * Set the compiler flag to make this function inline. 451 */ 452 void 453 tcp_set_ws_value(tcp_t *tcp) 454 { 455 int i; 456 uint32_t rwnd = tcp->tcp_rwnd; 457 458 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 459 i++, rwnd >>= 1) 460 ; 461 tcp->tcp_rcv_ws = i; 462 } 463 464 /* 465 * Remove cached/latched IPsec references. 466 */ 467 void 468 tcp_ipsec_cleanup(tcp_t *tcp) 469 { 470 conn_t *connp = tcp->tcp_connp; 471 472 ASSERT(connp->conn_flags & IPCL_TCPCONN); 473 474 if (connp->conn_latch != NULL) { 475 IPLATCH_REFRELE(connp->conn_latch); 476 connp->conn_latch = NULL; 477 } 478 if (connp->conn_latch_in_policy != NULL) { 479 IPPOL_REFRELE(connp->conn_latch_in_policy); 480 connp->conn_latch_in_policy = NULL; 481 } 482 if (connp->conn_latch_in_action != NULL) { 483 IPACT_REFRELE(connp->conn_latch_in_action); 484 connp->conn_latch_in_action = NULL; 485 } 486 if (connp->conn_policy != NULL) { 487 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 488 connp->conn_policy = NULL; 489 } 490 } 491 492 /* 493 * Cleaup before placing on free list. 494 * Disassociate from the netstack/tcp_stack_t since the freelist 495 * is per squeue and not per netstack. 496 */ 497 void 498 tcp_cleanup(tcp_t *tcp) 499 { 500 mblk_t *mp; 501 conn_t *connp = tcp->tcp_connp; 502 tcp_stack_t *tcps = tcp->tcp_tcps; 503 netstack_t *ns = tcps->tcps_netstack; 504 mblk_t *tcp_rsrv_mp; 505 506 tcp_bind_hash_remove(tcp); 507 508 /* Cleanup that which needs the netstack first */ 509 tcp_ipsec_cleanup(tcp); 510 ixa_cleanup(connp->conn_ixa); 511 512 if (connp->conn_ht_iphc != NULL) { 513 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 514 connp->conn_ht_iphc = NULL; 515 connp->conn_ht_iphc_allocated = 0; 516 connp->conn_ht_iphc_len = 0; 517 connp->conn_ht_ulp = NULL; 518 connp->conn_ht_ulp_len = 0; 519 tcp->tcp_ipha = NULL; 520 tcp->tcp_ip6h = NULL; 521 tcp->tcp_tcpha = NULL; 522 } 523 524 /* We clear any IP_OPTIONS and extension headers */ 525 ip_pkt_free(&connp->conn_xmit_ipp); 526 527 tcp_free(tcp); 528 529 /* 530 * Since we will bzero the entire structure, we need to 531 * remove it and reinsert it in global hash list. We 532 * know the walkers can't get to this conn because we 533 * had set CONDEMNED flag earlier and checked reference 534 * under conn_lock so walker won't pick it and when we 535 * go the ipcl_globalhash_remove() below, no walker 536 * can get to it. 537 */ 538 ipcl_globalhash_remove(connp); 539 540 /* Save some state */ 541 mp = tcp->tcp_timercache; 542 543 tcp_rsrv_mp = tcp->tcp_rsrv_mp; 544 545 if (connp->conn_cred != NULL) { 546 crfree(connp->conn_cred); 547 connp->conn_cred = NULL; 548 } 549 ipcl_conn_cleanup(connp); 550 connp->conn_flags = IPCL_TCPCONN; 551 552 /* 553 * Now it is safe to decrement the reference counts. 554 * This might be the last reference on the netstack 555 * in which case it will cause the freeing of the IP Instance. 556 */ 557 connp->conn_netstack = NULL; 558 connp->conn_ixa->ixa_ipst = NULL; 559 netstack_rele(ns); 560 ASSERT(tcps != NULL); 561 tcp->tcp_tcps = NULL; 562 563 bzero(tcp, sizeof (tcp_t)); 564 565 /* restore the state */ 566 tcp->tcp_timercache = mp; 567 568 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 569 570 tcp->tcp_connp = connp; 571 572 ASSERT(connp->conn_tcp == tcp); 573 ASSERT(connp->conn_flags & IPCL_TCPCONN); 574 connp->conn_state_flags = CONN_INCIPIENT; 575 ASSERT(connp->conn_proto == IPPROTO_TCP); 576 ASSERT(connp->conn_ref == 1); 577 } 578 579 /* 580 * Adapt to the information, such as rtt and rtt_sd, provided from the 581 * DCE and IRE maintained by IP. 582 * 583 * Checks for multicast and broadcast destination address. 584 * Returns zero if ok; an errno on failure. 585 * 586 * Note that the MSS calculation here is based on the info given in 587 * the DCE and IRE. We do not do any calculation based on TCP options. They 588 * will be handled in tcp_input_data() when TCP knows which options to use. 589 * 590 * Note on how TCP gets its parameters for a connection. 591 * 592 * When a tcp_t structure is allocated, it gets all the default parameters. 593 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd, 594 * spipe, rpipe, ... from the route metrics. Route metric overrides the 595 * default. 596 * 597 * An incoming SYN with a multicast or broadcast destination address is dropped 598 * in ip_fanout_v4/v6. 599 * 600 * An incoming SYN with a multicast or broadcast source address is always 601 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in 602 * conn_connect. 603 * The same logic in tcp_set_destination also serves to 604 * reject an attempt to connect to a broadcast or multicast (destination) 605 * address. 606 */ 607 int 608 tcp_set_destination(tcp_t *tcp) 609 { 610 uint32_t mss_max; 611 uint32_t mss; 612 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 613 conn_t *connp = tcp->tcp_connp; 614 tcp_stack_t *tcps = tcp->tcp_tcps; 615 iulp_t uinfo; 616 int error; 617 uint32_t flags; 618 619 flags = IPDF_LSO | IPDF_ZCOPY; 620 /* 621 * Make sure we have a dce for the destination to avoid dce_ident 622 * contention for connected sockets. 623 */ 624 flags |= IPDF_UNIQUE_DCE; 625 626 if (!tcps->tcps_ignore_path_mtu) 627 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 628 629 /* Use conn_lock to satify ASSERT; tcp is already serialized */ 630 mutex_enter(&connp->conn_lock); 631 error = conn_connect(connp, &uinfo, flags); 632 mutex_exit(&connp->conn_lock); 633 if (error != 0) 634 return (error); 635 636 error = tcp_build_hdrs(tcp); 637 if (error != 0) 638 return (error); 639 640 tcp->tcp_localnet = uinfo.iulp_localnet; 641 642 if (uinfo.iulp_rtt != 0) { 643 tcp->tcp_rtt_sa = MSEC2NSEC(uinfo.iulp_rtt); 644 tcp->tcp_rtt_sd = MSEC2NSEC(uinfo.iulp_rtt_sd); 645 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0); 646 } 647 if (uinfo.iulp_ssthresh != 0) 648 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh; 649 else 650 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 651 if (uinfo.iulp_spipe > 0) { 652 connp->conn_sndbuf = MIN(uinfo.iulp_spipe, 653 tcps->tcps_max_buf); 654 if (tcps->tcps_snd_lowat_fraction != 0) { 655 connp->conn_sndlowat = connp->conn_sndbuf / 656 tcps->tcps_snd_lowat_fraction; 657 } 658 (void) tcp_maxpsz_set(tcp, B_TRUE); 659 } 660 /* 661 * Note that up till now, acceptor always inherits receive 662 * window from the listener. But if there is a metrics 663 * associated with a host, we should use that instead of 664 * inheriting it from listener. Thus we need to pass this 665 * info back to the caller. 666 */ 667 if (uinfo.iulp_rpipe > 0) { 668 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe, 669 tcps->tcps_max_buf); 670 } 671 672 if (uinfo.iulp_rtomax > 0) { 673 tcp->tcp_second_timer_threshold = 674 uinfo.iulp_rtomax; 675 } 676 677 /* 678 * Use the metric option settings, iulp_tstamp_ok and 679 * iulp_wscale_ok, only for active open. What this means 680 * is that if the other side uses timestamp or window 681 * scale option, TCP will also use those options. That 682 * is for passive open. If the application sets a 683 * large window, window scale is enabled regardless of 684 * the value in iulp_wscale_ok. This is the behavior 685 * since 2.6. So we keep it. 686 * The only case left in passive open processing is the 687 * check for SACK. 688 * For ECN, it should probably be like SACK. But the 689 * current value is binary, so we treat it like the other 690 * cases. The metric only controls active open.For passive 691 * open, the ndd param, tcp_ecn_permitted, controls the 692 * behavior. 693 */ 694 if (!tcp_detached) { 695 /* 696 * The if check means that the following can only 697 * be turned on by the metrics only IRE, but not off. 698 */ 699 if (uinfo.iulp_tstamp_ok) 700 tcp->tcp_snd_ts_ok = B_TRUE; 701 if (uinfo.iulp_wscale_ok) 702 tcp->tcp_snd_ws_ok = B_TRUE; 703 if (uinfo.iulp_sack == 2) 704 tcp->tcp_snd_sack_ok = B_TRUE; 705 if (uinfo.iulp_ecn_ok) 706 tcp->tcp_ecn_ok = B_TRUE; 707 } else { 708 /* 709 * Passive open. 710 * 711 * As above, the if check means that SACK can only be 712 * turned on by the metric only IRE. 713 */ 714 if (uinfo.iulp_sack > 0) { 715 tcp->tcp_snd_sack_ok = B_TRUE; 716 } 717 } 718 719 /* 720 * XXX Note that currently, iulp_mtu can be as small as 68 721 * because of PMTUd. So tcp_mss may go to negative if combined 722 * length of all those options exceeds 28 bytes. But because 723 * of the tcp_mss_min check below, we may not have a problem if 724 * tcp_mss_min is of a reasonable value. The default is 1 so 725 * the negative problem still exists. And the check defeats PMTUd. 726 * In fact, if PMTUd finds that the MSS should be smaller than 727 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 728 * value. 729 * 730 * We do not deal with that now. All those problems related to 731 * PMTUd will be fixed later. 732 */ 733 ASSERT(uinfo.iulp_mtu != 0); 734 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu; 735 736 /* Sanity check for MSS value. */ 737 if (connp->conn_ipversion == IPV4_VERSION) 738 mss_max = tcps->tcps_mss_max_ipv4; 739 else 740 mss_max = tcps->tcps_mss_max_ipv6; 741 742 if (tcp->tcp_ipsec_overhead == 0) 743 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 744 745 mss -= tcp->tcp_ipsec_overhead; 746 747 if (mss < tcps->tcps_mss_min) 748 mss = tcps->tcps_mss_min; 749 if (mss > mss_max) 750 mss = mss_max; 751 752 /* Note that this is the maximum MSS, excluding all options. */ 753 tcp->tcp_mss = mss; 754 755 /* 756 * Update the tcp connection with LSO capability. 757 */ 758 tcp_update_lso(tcp, connp->conn_ixa); 759 760 /* 761 * Initialize the ISS here now that we have the full connection ID. 762 * The RFC 1948 method of initial sequence number generation requires 763 * knowledge of the full connection ID before setting the ISS. 764 */ 765 tcp_iss_init(tcp); 766 767 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local); 768 769 /* 770 * Make sure that conn is not marked incipient 771 * for incoming connections. A blind 772 * removal of incipient flag is cheaper than 773 * check and removal. 774 */ 775 mutex_enter(&connp->conn_lock); 776 connp->conn_state_flags &= ~CONN_INCIPIENT; 777 mutex_exit(&connp->conn_lock); 778 return (0); 779 } 780 781 /* 782 * tcp_clean_death / tcp_close_detached must not be called more than once 783 * on a tcp. Thus every function that potentially calls tcp_clean_death 784 * must check for the tcp state before calling tcp_clean_death. 785 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper, 786 * tcp_timer_handler, all check for the tcp state. 787 */ 788 /* ARGSUSED */ 789 void 790 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 791 ip_recv_attr_t *dummy) 792 { 793 tcp_t *tcp = ((conn_t *)arg)->conn_tcp; 794 795 freemsg(mp); 796 if (tcp->tcp_state > TCPS_BOUND) 797 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT); 798 } 799 800 /* 801 * We are dying for some reason. Try to do it gracefully. (May be called 802 * as writer.) 803 * 804 * Return -1 if the structure was not cleaned up (if the cleanup had to be 805 * done by a service procedure). 806 * TBD - Should the return value distinguish between the tcp_t being 807 * freed and it being reinitialized? 808 */ 809 int 810 tcp_clean_death(tcp_t *tcp, int err) 811 { 812 mblk_t *mp; 813 queue_t *q; 814 conn_t *connp = tcp->tcp_connp; 815 tcp_stack_t *tcps = tcp->tcp_tcps; 816 817 if (tcp->tcp_fused) 818 tcp_unfuse(tcp); 819 820 if (tcp->tcp_linger_tid != 0 && 821 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 822 tcp_stop_lingering(tcp); 823 } 824 825 ASSERT(tcp != NULL); 826 ASSERT((connp->conn_family == AF_INET && 827 connp->conn_ipversion == IPV4_VERSION) || 828 (connp->conn_family == AF_INET6 && 829 (connp->conn_ipversion == IPV4_VERSION || 830 connp->conn_ipversion == IPV6_VERSION))); 831 832 if (TCP_IS_DETACHED(tcp)) { 833 if (tcp->tcp_hard_binding) { 834 /* 835 * Its an eager that we are dealing with. We close the 836 * eager but in case a conn_ind has already gone to the 837 * listener, let tcp_accept_finish() send a discon_ind 838 * to the listener and drop the last reference. If the 839 * listener doesn't even know about the eager i.e. the 840 * conn_ind hasn't gone up, blow away the eager and drop 841 * the last reference as well. If the conn_ind has gone 842 * up, state should be BOUND. tcp_accept_finish 843 * will figure out that the connection has received a 844 * RST and will send a DISCON_IND to the application. 845 */ 846 tcp_closei_local(tcp); 847 if (!tcp->tcp_tconnind_started) { 848 CONN_DEC_REF(connp); 849 } else { 850 tcp->tcp_state = TCPS_BOUND; 851 DTRACE_TCP6(state__change, void, NULL, 852 ip_xmit_attr_t *, connp->conn_ixa, 853 void, NULL, tcp_t *, tcp, void, NULL, 854 int32_t, TCPS_CLOSED); 855 } 856 } else { 857 tcp_close_detached(tcp); 858 } 859 return (0); 860 } 861 862 TCP_STAT(tcps, tcp_clean_death_nondetached); 863 864 /* 865 * The connection is dead. Decrement listener connection counter if 866 * necessary. 867 */ 868 if (tcp->tcp_listen_cnt != NULL) 869 TCP_DECR_LISTEN_CNT(tcp); 870 871 /* 872 * When a connection is moved to TIME_WAIT state, the connection 873 * counter is already decremented. So no need to decrement here 874 * again. See SET_TIME_WAIT() macro. 875 */ 876 if (tcp->tcp_state >= TCPS_ESTABLISHED && 877 tcp->tcp_state < TCPS_TIME_WAIT) { 878 TCPS_CONN_DEC(tcps); 879 } 880 881 q = connp->conn_rq; 882 883 /* Trash all inbound data */ 884 if (!IPCL_IS_NONSTR(connp)) { 885 ASSERT(q != NULL); 886 flushq(q, FLUSHALL); 887 } 888 889 /* 890 * If we are at least part way open and there is error 891 * (err==0 implies no error) 892 * notify our client by a T_DISCON_IND. 893 */ 894 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 895 if (tcp->tcp_state >= TCPS_ESTABLISHED && 896 !TCP_IS_SOCKET(tcp)) { 897 /* 898 * Send M_FLUSH according to TPI. Because sockets will 899 * (and must) ignore FLUSHR we do that only for TPI 900 * endpoints and sockets in STREAMS mode. 901 */ 902 (void) putnextctl1(q, M_FLUSH, FLUSHR); 903 } 904 if (connp->conn_debug) { 905 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 906 "tcp_clean_death: discon err %d", err); 907 } 908 if (IPCL_IS_NONSTR(connp)) { 909 /* Direct socket, use upcall */ 910 (*connp->conn_upcalls->su_disconnected)( 911 connp->conn_upper_handle, tcp->tcp_connid, err); 912 } else { 913 mp = mi_tpi_discon_ind(NULL, err, 0); 914 if (mp != NULL) { 915 putnext(q, mp); 916 } else { 917 if (connp->conn_debug) { 918 (void) strlog(TCP_MOD_ID, 0, 1, 919 SL_ERROR|SL_TRACE, 920 "tcp_clean_death, sending M_ERROR"); 921 } 922 (void) putnextctl1(q, M_ERROR, EPROTO); 923 } 924 } 925 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 926 /* SYN_SENT or SYN_RCVD */ 927 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 928 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 929 /* ESTABLISHED or CLOSE_WAIT */ 930 TCPS_BUMP_MIB(tcps, tcpEstabResets); 931 } 932 } 933 934 /* 935 * ESTABLISHED non-STREAMS eagers are not 'detached' because 936 * an upper handle is obtained when the SYN-ACK comes in. So it 937 * should receive the 'disconnected' upcall, but tcp_reinit should 938 * not be called since this is an eager. 939 */ 940 if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) { 941 tcp_closei_local(tcp); 942 tcp->tcp_state = TCPS_BOUND; 943 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 944 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 945 int32_t, TCPS_CLOSED); 946 return (0); 947 } 948 949 tcp_reinit(tcp); 950 if (IPCL_IS_NONSTR(connp)) 951 (void) tcp_do_unbind(connp); 952 953 return (-1); 954 } 955 956 /* 957 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 958 * to expire, stop the wait and finish the close. 959 */ 960 void 961 tcp_stop_lingering(tcp_t *tcp) 962 { 963 clock_t delta = 0; 964 tcp_stack_t *tcps = tcp->tcp_tcps; 965 conn_t *connp = tcp->tcp_connp; 966 967 tcp->tcp_linger_tid = 0; 968 if (tcp->tcp_state > TCPS_LISTEN) { 969 tcp_acceptor_hash_remove(tcp); 970 mutex_enter(&tcp->tcp_non_sq_lock); 971 if (tcp->tcp_flow_stopped) { 972 tcp_clrqfull(tcp); 973 } 974 mutex_exit(&tcp->tcp_non_sq_lock); 975 976 if (tcp->tcp_timer_tid != 0) { 977 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 978 tcp->tcp_timer_tid = 0; 979 } 980 /* 981 * Need to cancel those timers which will not be used when 982 * TCP is detached. This has to be done before the conn_wq 983 * is cleared. 984 */ 985 tcp_timers_stop(tcp); 986 987 tcp->tcp_detached = B_TRUE; 988 connp->conn_rq = NULL; 989 connp->conn_wq = NULL; 990 991 if (tcp->tcp_state == TCPS_TIME_WAIT) { 992 tcp_time_wait_append(tcp); 993 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 994 goto finish; 995 } 996 997 /* 998 * If delta is zero the timer event wasn't executed and was 999 * successfully canceled. In this case we need to restart it 1000 * with the minimal delta possible. 1001 */ 1002 if (delta >= 0) { 1003 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 1004 delta ? delta : 1); 1005 } 1006 } else { 1007 tcp_closei_local(tcp); 1008 CONN_DEC_REF(connp); 1009 } 1010 finish: 1011 tcp->tcp_detached = B_TRUE; 1012 connp->conn_rq = NULL; 1013 connp->conn_wq = NULL; 1014 1015 /* Signal closing thread that it can complete close */ 1016 mutex_enter(&tcp->tcp_closelock); 1017 tcp->tcp_closed = 1; 1018 cv_signal(&tcp->tcp_closecv); 1019 mutex_exit(&tcp->tcp_closelock); 1020 1021 /* If we have an upper handle (socket), release it */ 1022 if (IPCL_IS_NONSTR(connp)) { 1023 sock_upcalls_t *upcalls = connp->conn_upcalls; 1024 sock_upper_handle_t handle = connp->conn_upper_handle; 1025 1026 ASSERT(upcalls != NULL); 1027 ASSERT(upcalls->su_closed != NULL); 1028 ASSERT(handle != NULL); 1029 /* 1030 * Set these to NULL first because closed() will free upper 1031 * structures. Acquire conn_lock because an external caller 1032 * like conn_get_socket_info() will upcall if these are 1033 * non-NULL. 1034 */ 1035 mutex_enter(&connp->conn_lock); 1036 connp->conn_upper_handle = NULL; 1037 connp->conn_upcalls = NULL; 1038 mutex_exit(&connp->conn_lock); 1039 upcalls->su_closed(handle); 1040 } 1041 } 1042 1043 void 1044 tcp_close_common(conn_t *connp, int flags) 1045 { 1046 tcp_t *tcp = connp->conn_tcp; 1047 mblk_t *mp = &tcp->tcp_closemp; 1048 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 1049 mblk_t *bp; 1050 1051 ASSERT(connp->conn_ref >= 2); 1052 1053 /* 1054 * Mark the conn as closing. ipsq_pending_mp_add will not 1055 * add any mp to the pending mp list, after this conn has 1056 * started closing. 1057 */ 1058 mutex_enter(&connp->conn_lock); 1059 connp->conn_state_flags |= CONN_CLOSING; 1060 if (connp->conn_oper_pending_ill != NULL) 1061 conn_ioctl_cleanup_reqd = B_TRUE; 1062 CONN_INC_REF_LOCKED(connp); 1063 mutex_exit(&connp->conn_lock); 1064 tcp->tcp_closeflags = (uint8_t)flags; 1065 ASSERT(connp->conn_ref >= 3); 1066 1067 /* 1068 * tcp_closemp_used is used below without any protection of a lock 1069 * as we don't expect any one else to use it concurrently at this 1070 * point otherwise it would be a major defect. 1071 */ 1072 1073 if (mp->b_prev == NULL) 1074 tcp->tcp_closemp_used = B_TRUE; 1075 else 1076 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " 1077 "connp %p tcp %p\n", (void *)connp, (void *)tcp); 1078 1079 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1080 1081 /* 1082 * Cleanup any queued ioctls here. This must be done before the wq/rq 1083 * are re-written by tcp_close_output(). 1084 */ 1085 if (conn_ioctl_cleanup_reqd) 1086 conn_ioctl_cleanup(connp); 1087 1088 /* 1089 * As CONN_CLOSING is set, no further ioctls should be passed down to 1090 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and 1091 * tcp_wput_iocdata). If the ioctl was queued on an ipsq, 1092 * conn_ioctl_cleanup should have found it and removed it. If the ioctl 1093 * was still in flight at the time, we wait for it here. See comments 1094 * for CONN_INC_IOCTLREF in ip.h for details. 1095 */ 1096 mutex_enter(&connp->conn_lock); 1097 while (connp->conn_ioctlref > 0) 1098 cv_wait(&connp->conn_cv, &connp->conn_lock); 1099 ASSERT(connp->conn_ioctlref == 0); 1100 ASSERT(connp->conn_oper_pending_ill == NULL); 1101 mutex_exit(&connp->conn_lock); 1102 1103 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp, 1104 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1105 1106 /* 1107 * For non-STREAMS sockets, the normal case is that the conn makes 1108 * an upcall when it's finally closed, so there is no need to wait 1109 * in the protocol. But in case of SO_LINGER the thread sleeps here 1110 * so it can properly deal with the thread being interrupted. 1111 */ 1112 if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0) 1113 goto nowait; 1114 1115 mutex_enter(&tcp->tcp_closelock); 1116 while (!tcp->tcp_closed) { 1117 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 1118 /* 1119 * The cv_wait_sig() was interrupted. We now do the 1120 * following: 1121 * 1122 * 1) If the endpoint was lingering, we allow this 1123 * to be interrupted by cancelling the linger timeout 1124 * and closing normally. 1125 * 1126 * 2) Revert to calling cv_wait() 1127 * 1128 * We revert to using cv_wait() to avoid an 1129 * infinite loop which can occur if the calling 1130 * thread is higher priority than the squeue worker 1131 * thread and is bound to the same cpu. 1132 */ 1133 if (connp->conn_linger && connp->conn_lingertime > 0) { 1134 mutex_exit(&tcp->tcp_closelock); 1135 /* Entering squeue, bump ref count. */ 1136 CONN_INC_REF(connp); 1137 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 1138 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, 1139 tcp_linger_interrupted, connp, NULL, 1140 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1141 mutex_enter(&tcp->tcp_closelock); 1142 } 1143 break; 1144 } 1145 } 1146 while (!tcp->tcp_closed) 1147 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 1148 mutex_exit(&tcp->tcp_closelock); 1149 1150 /* 1151 * In the case of listener streams that have eagers in the q or q0 1152 * we wait for the eagers to drop their reference to us. conn_rq and 1153 * conn_wq of the eagers point to our queues. By waiting for the 1154 * refcnt to drop to 1, we are sure that the eagers have cleaned 1155 * up their queue pointers and also dropped their references to us. 1156 * 1157 * For non-STREAMS sockets we do not have to wait here; the 1158 * listener will instead make a su_closed upcall when the last 1159 * reference is dropped. 1160 */ 1161 if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) { 1162 mutex_enter(&connp->conn_lock); 1163 while (connp->conn_ref != 1) { 1164 cv_wait(&connp->conn_cv, &connp->conn_lock); 1165 } 1166 mutex_exit(&connp->conn_lock); 1167 } 1168 1169 nowait: 1170 connp->conn_cpid = NOPID; 1171 } 1172 1173 /* 1174 * Called by tcp_close() routine via squeue when lingering is 1175 * interrupted by a signal. 1176 */ 1177 1178 /* ARGSUSED */ 1179 static void 1180 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 1181 { 1182 conn_t *connp = (conn_t *)arg; 1183 tcp_t *tcp = connp->conn_tcp; 1184 1185 freeb(mp); 1186 if (tcp->tcp_linger_tid != 0 && 1187 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 1188 tcp_stop_lingering(tcp); 1189 tcp->tcp_client_errno = EINTR; 1190 } 1191 } 1192 1193 /* 1194 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 1195 * Some stream heads get upset if they see these later on as anything but NULL. 1196 */ 1197 void 1198 tcp_close_mpp(mblk_t **mpp) 1199 { 1200 mblk_t *mp; 1201 1202 if ((mp = *mpp) != NULL) { 1203 do { 1204 mp->b_next = NULL; 1205 mp->b_prev = NULL; 1206 } while ((mp = mp->b_cont) != NULL); 1207 1208 mp = *mpp; 1209 *mpp = NULL; 1210 freemsg(mp); 1211 } 1212 } 1213 1214 /* Do detached close. */ 1215 void 1216 tcp_close_detached(tcp_t *tcp) 1217 { 1218 if (tcp->tcp_fused) 1219 tcp_unfuse(tcp); 1220 1221 /* 1222 * Clustering code serializes TCP disconnect callbacks and 1223 * cluster tcp list walks by blocking a TCP disconnect callback 1224 * if a cluster tcp list walk is in progress. This ensures 1225 * accurate accounting of TCPs in the cluster code even though 1226 * the TCP list walk itself is not atomic. 1227 */ 1228 tcp_closei_local(tcp); 1229 CONN_DEC_REF(tcp->tcp_connp); 1230 } 1231 1232 /* 1233 * The tcp_t is going away. Remove it from all lists and set it 1234 * to TCPS_CLOSED. The freeing up of memory is deferred until 1235 * tcp_inactive. This is needed since a thread in tcp_rput might have 1236 * done a CONN_INC_REF on this structure before it was removed from the 1237 * hashes. 1238 */ 1239 void 1240 tcp_closei_local(tcp_t *tcp) 1241 { 1242 conn_t *connp = tcp->tcp_connp; 1243 tcp_stack_t *tcps = tcp->tcp_tcps; 1244 int32_t oldstate; 1245 1246 if (!TCP_IS_SOCKET(tcp)) 1247 tcp_acceptor_hash_remove(tcp); 1248 1249 /* 1250 * This can be called via tcp_time_wait_processing() if TCP gets a 1251 * SYN with sequence number outside the TIME-WAIT connection's 1252 * window. So we need to check for TIME-WAIT state here as the 1253 * connection counter is already decremented. See SET_TIME_WAIT() 1254 * macro 1255 */ 1256 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1257 tcp->tcp_state < TCPS_TIME_WAIT) { 1258 TCPS_CONN_DEC(tcps); 1259 } 1260 1261 /* 1262 * If we are an eager connection hanging off a listener that 1263 * hasn't formally accepted the connection yet, get off its 1264 * list and blow off any data that we have accumulated. 1265 */ 1266 if (tcp->tcp_listener != NULL) { 1267 tcp_t *listener = tcp->tcp_listener; 1268 mutex_enter(&listener->tcp_eager_lock); 1269 /* 1270 * tcp_tconnind_started == B_TRUE means that the 1271 * conn_ind has already gone to listener. At 1272 * this point, eager will be closed but we 1273 * leave it in listeners eager list so that 1274 * if listener decides to close without doing 1275 * accept, we can clean this up. In tcp_tli_accept 1276 * we take care of the case of accept on closed 1277 * eager. 1278 */ 1279 if (!tcp->tcp_tconnind_started) { 1280 tcp_eager_unlink(tcp); 1281 mutex_exit(&listener->tcp_eager_lock); 1282 /* 1283 * We don't want to have any pointers to the 1284 * listener queue, after we have released our 1285 * reference on the listener 1286 */ 1287 ASSERT(tcp->tcp_detached); 1288 connp->conn_rq = NULL; 1289 connp->conn_wq = NULL; 1290 CONN_DEC_REF(listener->tcp_connp); 1291 } else { 1292 mutex_exit(&listener->tcp_eager_lock); 1293 } 1294 } 1295 1296 /* Stop all the timers */ 1297 tcp_timers_stop(tcp); 1298 1299 if (tcp->tcp_state == TCPS_LISTEN) { 1300 if (tcp->tcp_ip_addr_cache) { 1301 kmem_free((void *)tcp->tcp_ip_addr_cache, 1302 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1303 tcp->tcp_ip_addr_cache = NULL; 1304 } 1305 } 1306 1307 /* Decrement listerner connection counter if necessary. */ 1308 if (tcp->tcp_listen_cnt != NULL) 1309 TCP_DECR_LISTEN_CNT(tcp); 1310 1311 mutex_enter(&tcp->tcp_non_sq_lock); 1312 if (tcp->tcp_flow_stopped) 1313 tcp_clrqfull(tcp); 1314 mutex_exit(&tcp->tcp_non_sq_lock); 1315 1316 tcp_bind_hash_remove(tcp); 1317 /* 1318 * If the tcp_time_wait_collector (which runs outside the squeue) 1319 * is trying to remove this tcp from the time wait list, we will 1320 * block in tcp_time_wait_remove while trying to acquire the 1321 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 1322 * requires the ipcl_hash_remove to be ordered after the 1323 * tcp_time_wait_remove for the refcnt checks to work correctly. 1324 */ 1325 if (tcp->tcp_state == TCPS_TIME_WAIT) 1326 (void) tcp_time_wait_remove(tcp, NULL); 1327 CL_INET_DISCONNECT(connp); 1328 ipcl_hash_remove(connp); 1329 oldstate = tcp->tcp_state; 1330 tcp->tcp_state = TCPS_CLOSED; 1331 /* Need to probe before ixa_cleanup() is called */ 1332 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1333 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 1334 int32_t, oldstate); 1335 ixa_cleanup(connp->conn_ixa); 1336 1337 /* 1338 * Mark the conn as CONDEMNED 1339 */ 1340 mutex_enter(&connp->conn_lock); 1341 connp->conn_state_flags |= CONN_CONDEMNED; 1342 mutex_exit(&connp->conn_lock); 1343 1344 ASSERT(tcp->tcp_time_wait_next == NULL); 1345 ASSERT(tcp->tcp_time_wait_prev == NULL); 1346 ASSERT(tcp->tcp_time_wait_expire == 0); 1347 1348 tcp_ipsec_cleanup(tcp); 1349 } 1350 1351 /* 1352 * tcp is dying (called from ipcl_conn_destroy and error cases). 1353 * Free the tcp_t in either case. 1354 */ 1355 void 1356 tcp_free(tcp_t *tcp) 1357 { 1358 mblk_t *mp; 1359 conn_t *connp = tcp->tcp_connp; 1360 1361 ASSERT(tcp != NULL); 1362 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 1363 1364 connp->conn_rq = NULL; 1365 connp->conn_wq = NULL; 1366 1367 tcp_close_mpp(&tcp->tcp_xmit_head); 1368 tcp_close_mpp(&tcp->tcp_reass_head); 1369 if (tcp->tcp_rcv_list != NULL) { 1370 /* Free b_next chain */ 1371 tcp_close_mpp(&tcp->tcp_rcv_list); 1372 } 1373 if ((mp = tcp->tcp_urp_mp) != NULL) { 1374 freemsg(mp); 1375 } 1376 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1377 freemsg(mp); 1378 } 1379 1380 if (tcp->tcp_fused_sigurg_mp != NULL) { 1381 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1382 freeb(tcp->tcp_fused_sigurg_mp); 1383 tcp->tcp_fused_sigurg_mp = NULL; 1384 } 1385 1386 if (tcp->tcp_ordrel_mp != NULL) { 1387 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1388 freeb(tcp->tcp_ordrel_mp); 1389 tcp->tcp_ordrel_mp = NULL; 1390 } 1391 1392 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 1393 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 1394 1395 if (tcp->tcp_hopopts != NULL) { 1396 mi_free(tcp->tcp_hopopts); 1397 tcp->tcp_hopopts = NULL; 1398 tcp->tcp_hopoptslen = 0; 1399 } 1400 ASSERT(tcp->tcp_hopoptslen == 0); 1401 if (tcp->tcp_dstopts != NULL) { 1402 mi_free(tcp->tcp_dstopts); 1403 tcp->tcp_dstopts = NULL; 1404 tcp->tcp_dstoptslen = 0; 1405 } 1406 ASSERT(tcp->tcp_dstoptslen == 0); 1407 if (tcp->tcp_rthdrdstopts != NULL) { 1408 mi_free(tcp->tcp_rthdrdstopts); 1409 tcp->tcp_rthdrdstopts = NULL; 1410 tcp->tcp_rthdrdstoptslen = 0; 1411 } 1412 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 1413 if (tcp->tcp_rthdr != NULL) { 1414 mi_free(tcp->tcp_rthdr); 1415 tcp->tcp_rthdr = NULL; 1416 tcp->tcp_rthdrlen = 0; 1417 } 1418 ASSERT(tcp->tcp_rthdrlen == 0); 1419 1420 /* 1421 * Following is really a blowing away a union. 1422 * It happens to have exactly two members of identical size 1423 * the following code is enough. 1424 */ 1425 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1426 1427 /* Allow the CC algorithm to clean up after itself. */ 1428 if (tcp->tcp_cc_algo != NULL && tcp->tcp_cc_algo->cb_destroy != NULL) 1429 tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv); 1430 1431 /* 1432 * If this is a non-STREAM socket still holding on to an upper 1433 * handle, release it. As a result of fallback we might also see 1434 * STREAMS based conns with upper handles, in which case there is 1435 * nothing to do other than clearing the field. 1436 */ 1437 if (connp->conn_upper_handle != NULL) { 1438 sock_upcalls_t *upcalls = connp->conn_upcalls; 1439 sock_upper_handle_t handle = connp->conn_upper_handle; 1440 1441 /* 1442 * Set these to NULL first because closed() will free upper 1443 * structures. Acquire conn_lock because an external caller 1444 * like conn_get_socket_info() will upcall if these are 1445 * non-NULL. 1446 */ 1447 mutex_enter(&connp->conn_lock); 1448 connp->conn_upper_handle = NULL; 1449 connp->conn_upcalls = NULL; 1450 mutex_exit(&connp->conn_lock); 1451 if (IPCL_IS_NONSTR(connp)) { 1452 ASSERT(upcalls != NULL); 1453 ASSERT(upcalls->su_closed != NULL); 1454 ASSERT(handle != NULL); 1455 upcalls->su_closed(handle); 1456 tcp->tcp_detached = B_TRUE; 1457 } 1458 } 1459 } 1460 1461 /* 1462 * tcp_get_conn/tcp_free_conn 1463 * 1464 * tcp_get_conn is used to get a clean tcp connection structure. 1465 * It tries to reuse the connections put on the freelist by the 1466 * time_wait_collector failing which it goes to kmem_cache. This 1467 * way has two benefits compared to just allocating from and 1468 * freeing to kmem_cache. 1469 * 1) The time_wait_collector can free (which includes the cleanup) 1470 * outside the squeue. So when the interrupt comes, we have a clean 1471 * connection sitting in the freelist. Obviously, this buys us 1472 * performance. 1473 * 1474 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener 1475 * has multiple disadvantages - tying up the squeue during alloc. 1476 * But allocating the conn/tcp in IP land is also not the best since 1477 * we can't check the 'q' and 'q0' which are protected by squeue and 1478 * blindly allocate memory which might have to be freed here if we are 1479 * not allowed to accept the connection. By using the freelist and 1480 * putting the conn/tcp back in freelist, we don't pay a penalty for 1481 * allocating memory without checking 'q/q0' and freeing it if we can't 1482 * accept the connection. 1483 * 1484 * Care should be taken to put the conn back in the same squeue's freelist 1485 * from which it was allocated. Best results are obtained if conn is 1486 * allocated from listener's squeue and freed to the same. Time wait 1487 * collector will free up the freelist is the connection ends up sitting 1488 * there for too long. 1489 */ 1490 conn_t * 1491 tcp_get_conn(void *arg, tcp_stack_t *tcps) 1492 { 1493 tcp_t *tcp = NULL; 1494 conn_t *connp = NULL; 1495 squeue_t *sqp = (squeue_t *)arg; 1496 tcp_squeue_priv_t *tcp_time_wait; 1497 netstack_t *ns; 1498 mblk_t *tcp_rsrv_mp = NULL; 1499 1500 tcp_time_wait = 1501 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1502 1503 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1504 tcp = tcp_time_wait->tcp_free_list; 1505 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 1506 if (tcp != NULL) { 1507 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1508 tcp_time_wait->tcp_free_list_cnt--; 1509 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1510 tcp->tcp_time_wait_next = NULL; 1511 connp = tcp->tcp_connp; 1512 connp->conn_flags |= IPCL_REUSED; 1513 1514 ASSERT(tcp->tcp_tcps == NULL); 1515 ASSERT(connp->conn_netstack == NULL); 1516 ASSERT(tcp->tcp_rsrv_mp != NULL); 1517 ns = tcps->tcps_netstack; 1518 netstack_hold(ns); 1519 connp->conn_netstack = ns; 1520 connp->conn_ixa->ixa_ipst = ns->netstack_ip; 1521 tcp->tcp_tcps = tcps; 1522 ipcl_globalhash_insert(connp); 1523 1524 connp->conn_ixa->ixa_notify_cookie = tcp; 1525 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify); 1526 connp->conn_recv = tcp_input_data; 1527 ASSERT(connp->conn_recvicmp == tcp_icmp_input); 1528 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp); 1529 return (connp); 1530 } 1531 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1532 /* 1533 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until 1534 * this conn_t/tcp_t is freed at ipcl_conn_destroy(). 1535 */ 1536 tcp_rsrv_mp = allocb(0, BPRI_HI); 1537 if (tcp_rsrv_mp == NULL) 1538 return (NULL); 1539 1540 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, 1541 tcps->tcps_netstack)) == NULL) { 1542 freeb(tcp_rsrv_mp); 1543 return (NULL); 1544 } 1545 1546 tcp = connp->conn_tcp; 1547 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 1548 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL); 1549 1550 tcp->tcp_tcps = tcps; 1551 1552 connp->conn_recv = tcp_input_data; 1553 connp->conn_recvicmp = tcp_icmp_input; 1554 connp->conn_verifyicmp = tcp_verifyicmp; 1555 1556 /* 1557 * Register tcp_notify to listen to capability changes detected by IP. 1558 * This upcall is made in the context of the call to conn_ip_output 1559 * thus it is inside the squeue. 1560 */ 1561 connp->conn_ixa->ixa_notify = tcp_notify; 1562 connp->conn_ixa->ixa_notify_cookie = tcp; 1563 1564 return (connp); 1565 } 1566 1567 /* 1568 * Handle connect to IPv4 destinations, including connections for AF_INET6 1569 * sockets connecting to IPv4 mapped IPv6 destinations. 1570 * Returns zero if OK, a positive errno, or a negative TLI error. 1571 */ 1572 static int 1573 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport, 1574 uint_t srcid) 1575 { 1576 ipaddr_t dstaddr = *dstaddrp; 1577 uint16_t lport; 1578 conn_t *connp = tcp->tcp_connp; 1579 tcp_stack_t *tcps = tcp->tcp_tcps; 1580 int error; 1581 1582 ASSERT(connp->conn_ipversion == IPV4_VERSION); 1583 1584 /* Check for attempt to connect to INADDR_ANY */ 1585 if (dstaddr == INADDR_ANY) { 1586 /* 1587 * SunOS 4.x and 4.3 BSD allow an application 1588 * to connect a TCP socket to INADDR_ANY. 1589 * When they do this, the kernel picks the 1590 * address of one interface and uses it 1591 * instead. The kernel usually ends up 1592 * picking the address of the loopback 1593 * interface. This is an undocumented feature. 1594 * However, we provide the same thing here 1595 * in order to have source and binary 1596 * compatibility with SunOS 4.x. 1597 * Update the T_CONN_REQ (sin/sin6) since it is used to 1598 * generate the T_CONN_CON. 1599 */ 1600 dstaddr = htonl(INADDR_LOOPBACK); 1601 *dstaddrp = dstaddr; 1602 } 1603 1604 /* Handle __sin6_src_id if socket not bound to an IP address */ 1605 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) { 1606 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1607 IPCL_ZONEID(connp), B_TRUE, tcps->tcps_netstack)) { 1608 /* Mismatch - conn_laddr_v6 would be v6 address. */ 1609 return (EADDRNOTAVAIL); 1610 } 1611 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1612 } 1613 1614 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6); 1615 connp->conn_fport = dstport; 1616 1617 /* 1618 * At this point the remote destination address and remote port fields 1619 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1620 * have to see which state tcp was in so we can take appropriate action. 1621 */ 1622 if (tcp->tcp_state == TCPS_IDLE) { 1623 /* 1624 * We support a quick connect capability here, allowing 1625 * clients to transition directly from IDLE to SYN_SENT 1626 * tcp_bindi will pick an unused port, insert the connection 1627 * in the bind hash and transition to BOUND state. 1628 */ 1629 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1630 tcp, B_TRUE); 1631 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1632 B_FALSE, B_FALSE); 1633 if (lport == 0) 1634 return (-TNOADDR); 1635 } 1636 1637 /* 1638 * Lookup the route to determine a source address and the uinfo. 1639 * Setup TCP parameters based on the metrics/DCE. 1640 */ 1641 error = tcp_set_destination(tcp); 1642 if (error != 0) 1643 return (error); 1644 1645 /* 1646 * Don't let an endpoint connect to itself. 1647 */ 1648 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 && 1649 connp->conn_fport == connp->conn_lport) 1650 return (-TBADADDR); 1651 1652 tcp->tcp_state = TCPS_SYN_SENT; 1653 1654 return (ipcl_conn_insert_v4(connp)); 1655 } 1656 1657 /* 1658 * Handle connect to IPv6 destinations. 1659 * Returns zero if OK, a positive errno, or a negative TLI error. 1660 */ 1661 static int 1662 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport, 1663 uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 1664 { 1665 uint16_t lport; 1666 conn_t *connp = tcp->tcp_connp; 1667 tcp_stack_t *tcps = tcp->tcp_tcps; 1668 int error; 1669 1670 ASSERT(connp->conn_family == AF_INET6); 1671 1672 /* 1673 * If we're here, it means that the destination address is a native 1674 * IPv6 address. Return an error if conn_ipversion is not IPv6. A 1675 * reason why it might not be IPv6 is if the socket was bound to an 1676 * IPv4-mapped IPv6 address. 1677 */ 1678 if (connp->conn_ipversion != IPV6_VERSION) 1679 return (-TBADADDR); 1680 1681 /* 1682 * Interpret a zero destination to mean loopback. 1683 * Update the T_CONN_REQ (sin/sin6) since it is used to 1684 * generate the T_CONN_CON. 1685 */ 1686 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) 1687 *dstaddrp = ipv6_loopback; 1688 1689 /* Handle __sin6_src_id if socket not bound to an IP address */ 1690 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) { 1691 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1692 IPCL_ZONEID(connp), B_FALSE, tcps->tcps_netstack)) { 1693 /* Mismatch - conn_laddr_v6 would be v4-mapped. */ 1694 return (EADDRNOTAVAIL); 1695 } 1696 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1697 } 1698 1699 /* 1700 * Take care of the scope_id now. 1701 */ 1702 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 1703 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1704 connp->conn_ixa->ixa_scopeid = scope_id; 1705 } else { 1706 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 1707 } 1708 1709 connp->conn_flowinfo = flowinfo; 1710 connp->conn_faddr_v6 = *dstaddrp; 1711 connp->conn_fport = dstport; 1712 1713 /* 1714 * At this point the remote destination address and remote port fields 1715 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1716 * have to see which state tcp was in so we can take appropriate action. 1717 */ 1718 if (tcp->tcp_state == TCPS_IDLE) { 1719 /* 1720 * We support a quick connect capability here, allowing 1721 * clients to transition directly from IDLE to SYN_SENT 1722 * tcp_bindi will pick an unused port, insert the connection 1723 * in the bind hash and transition to BOUND state. 1724 */ 1725 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1726 tcp, B_TRUE); 1727 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1728 B_FALSE, B_FALSE); 1729 if (lport == 0) 1730 return (-TNOADDR); 1731 } 1732 1733 /* 1734 * Lookup the route to determine a source address and the uinfo. 1735 * Setup TCP parameters based on the metrics/DCE. 1736 */ 1737 error = tcp_set_destination(tcp); 1738 if (error != 0) 1739 return (error); 1740 1741 /* 1742 * Don't let an endpoint connect to itself. 1743 */ 1744 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) && 1745 connp->conn_fport == connp->conn_lport) 1746 return (-TBADADDR); 1747 1748 tcp->tcp_state = TCPS_SYN_SENT; 1749 1750 return (ipcl_conn_insert_v6(connp)); 1751 } 1752 1753 /* 1754 * Disconnect 1755 * Note that unlike other functions this returns a positive tli error 1756 * when it fails; it never returns an errno. 1757 */ 1758 static int 1759 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum) 1760 { 1761 conn_t *lconnp; 1762 tcp_stack_t *tcps = tcp->tcp_tcps; 1763 conn_t *connp = tcp->tcp_connp; 1764 1765 /* 1766 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 1767 * when the stream is in BOUND state. Do not send a reset, 1768 * since the destination IP address is not valid, and it can 1769 * be the initialized value of all zeros (broadcast address). 1770 */ 1771 if (tcp->tcp_state <= TCPS_BOUND) { 1772 if (connp->conn_debug) { 1773 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 1774 "tcp_disconnect: bad state, %d", tcp->tcp_state); 1775 } 1776 return (TOUTSTATE); 1777 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1778 TCPS_CONN_DEC(tcps); 1779 } 1780 1781 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 1782 1783 /* 1784 * According to TPI, for non-listeners, ignore seqnum 1785 * and disconnect. 1786 * Following interpretation of -1 seqnum is historical 1787 * and implied TPI ? (TPI only states that for T_CONN_IND, 1788 * a valid seqnum should not be -1). 1789 * 1790 * -1 means disconnect everything 1791 * regardless even on a listener. 1792 */ 1793 1794 int old_state = tcp->tcp_state; 1795 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1796 1797 /* 1798 * The connection can't be on the tcp_time_wait_head list 1799 * since it is not detached. 1800 */ 1801 ASSERT(tcp->tcp_time_wait_next == NULL); 1802 ASSERT(tcp->tcp_time_wait_prev == NULL); 1803 ASSERT(tcp->tcp_time_wait_expire == 0); 1804 /* 1805 * If it used to be a listener, check to make sure no one else 1806 * has taken the port before switching back to LISTEN state. 1807 */ 1808 if (connp->conn_ipversion == IPV4_VERSION) { 1809 lconnp = ipcl_lookup_listener_v4(connp->conn_lport, 1810 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst); 1811 } else { 1812 uint_t ifindex = 0; 1813 1814 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) 1815 ifindex = connp->conn_ixa->ixa_scopeid; 1816 1817 /* Allow conn_bound_if listeners? */ 1818 lconnp = ipcl_lookup_listener_v6(connp->conn_lport, 1819 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp), 1820 ipst); 1821 } 1822 if (tcp->tcp_conn_req_max && lconnp == NULL) { 1823 tcp->tcp_state = TCPS_LISTEN; 1824 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1825 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, 1826 NULL, int32_t, old_state); 1827 } else if (old_state > TCPS_BOUND) { 1828 tcp->tcp_conn_req_max = 0; 1829 tcp->tcp_state = TCPS_BOUND; 1830 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1831 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, 1832 NULL, int32_t, old_state); 1833 1834 /* 1835 * If this end point is not going to become a listener, 1836 * decrement the listener connection count if 1837 * necessary. Note that we do not do this if it is 1838 * going to be a listner (the above if case) since 1839 * then it may remove the counter struct. 1840 */ 1841 if (tcp->tcp_listen_cnt != NULL) 1842 TCP_DECR_LISTEN_CNT(tcp); 1843 } 1844 if (lconnp != NULL) 1845 CONN_DEC_REF(lconnp); 1846 switch (old_state) { 1847 case TCPS_SYN_SENT: 1848 case TCPS_SYN_RCVD: 1849 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1850 break; 1851 case TCPS_ESTABLISHED: 1852 case TCPS_CLOSE_WAIT: 1853 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1854 break; 1855 } 1856 1857 if (tcp->tcp_fused) 1858 tcp_unfuse(tcp); 1859 1860 mutex_enter(&tcp->tcp_eager_lock); 1861 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 1862 (tcp->tcp_conn_req_cnt_q != 0)) { 1863 tcp_eager_cleanup(tcp, 0); 1864 } 1865 mutex_exit(&tcp->tcp_eager_lock); 1866 1867 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 1868 tcp->tcp_rnxt, TH_RST | TH_ACK); 1869 1870 tcp_reinit(tcp); 1871 1872 return (0); 1873 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 1874 return (TBADSEQ); 1875 } 1876 return (0); 1877 } 1878 1879 /* 1880 * Our client hereby directs us to reject the connection request 1881 * that tcp_input_listener() marked with 'seqnum'. Rejection consists 1882 * of sending the appropriate RST, not an ICMP error. 1883 */ 1884 void 1885 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 1886 { 1887 t_scalar_t seqnum; 1888 int error; 1889 conn_t *connp = tcp->tcp_connp; 1890 1891 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 1892 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 1893 tcp_err_ack(tcp, mp, TPROTO, 0); 1894 return; 1895 } 1896 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 1897 error = tcp_disconnect_common(tcp, seqnum); 1898 if (error != 0) 1899 tcp_err_ack(tcp, mp, error, 0); 1900 else { 1901 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1902 /* Send M_FLUSH according to TPI */ 1903 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 1904 } 1905 mp = mi_tpi_ok_ack_alloc(mp); 1906 if (mp != NULL) 1907 putnext(connp->conn_rq, mp); 1908 } 1909 } 1910 1911 /* 1912 * Handle reinitialization of a tcp structure. 1913 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 1914 */ 1915 static void 1916 tcp_reinit(tcp_t *tcp) 1917 { 1918 mblk_t *mp; 1919 tcp_stack_t *tcps = tcp->tcp_tcps; 1920 conn_t *connp = tcp->tcp_connp; 1921 int32_t oldstate; 1922 1923 /* tcp_reinit should never be called for detached tcp_t's */ 1924 ASSERT(tcp->tcp_listener == NULL); 1925 ASSERT((connp->conn_family == AF_INET && 1926 connp->conn_ipversion == IPV4_VERSION) || 1927 (connp->conn_family == AF_INET6 && 1928 (connp->conn_ipversion == IPV4_VERSION || 1929 connp->conn_ipversion == IPV6_VERSION))); 1930 1931 /* Cancel outstanding timers */ 1932 tcp_timers_stop(tcp); 1933 1934 tcp_close_mpp(&tcp->tcp_xmit_head); 1935 if (tcp->tcp_snd_zcopy_aware) 1936 tcp_zcopy_notify(tcp); 1937 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 1938 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 1939 mutex_enter(&tcp->tcp_non_sq_lock); 1940 if (tcp->tcp_flow_stopped && 1941 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 1942 tcp_clrqfull(tcp); 1943 } 1944 mutex_exit(&tcp->tcp_non_sq_lock); 1945 tcp_close_mpp(&tcp->tcp_reass_head); 1946 tcp->tcp_reass_tail = NULL; 1947 if (tcp->tcp_rcv_list != NULL) { 1948 /* Free b_next chain */ 1949 tcp_close_mpp(&tcp->tcp_rcv_list); 1950 tcp->tcp_rcv_last_head = NULL; 1951 tcp->tcp_rcv_last_tail = NULL; 1952 tcp->tcp_rcv_cnt = 0; 1953 } 1954 tcp->tcp_rcv_last_tail = NULL; 1955 1956 if ((mp = tcp->tcp_urp_mp) != NULL) { 1957 freemsg(mp); 1958 tcp->tcp_urp_mp = NULL; 1959 } 1960 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1961 freemsg(mp); 1962 tcp->tcp_urp_mark_mp = NULL; 1963 } 1964 if (tcp->tcp_fused_sigurg_mp != NULL) { 1965 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1966 freeb(tcp->tcp_fused_sigurg_mp); 1967 tcp->tcp_fused_sigurg_mp = NULL; 1968 } 1969 if (tcp->tcp_ordrel_mp != NULL) { 1970 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1971 freeb(tcp->tcp_ordrel_mp); 1972 tcp->tcp_ordrel_mp = NULL; 1973 } 1974 1975 /* 1976 * Following is a union with two members which are 1977 * identical types and size so the following cleanup 1978 * is enough. 1979 */ 1980 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1981 1982 CL_INET_DISCONNECT(connp); 1983 1984 /* 1985 * The connection can't be on the tcp_time_wait_head list 1986 * since it is not detached. 1987 */ 1988 ASSERT(tcp->tcp_time_wait_next == NULL); 1989 ASSERT(tcp->tcp_time_wait_prev == NULL); 1990 ASSERT(tcp->tcp_time_wait_expire == 0); 1991 1992 /* 1993 * Reset/preserve other values 1994 */ 1995 tcp_reinit_values(tcp); 1996 ipcl_hash_remove(connp); 1997 /* Note that ixa_cred gets cleared in ixa_cleanup */ 1998 ixa_cleanup(connp->conn_ixa); 1999 tcp_ipsec_cleanup(tcp); 2000 2001 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 2002 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 2003 oldstate = tcp->tcp_state; 2004 2005 if (tcp->tcp_conn_req_max != 0) { 2006 /* 2007 * This is the case when a TLI program uses the same 2008 * transport end point to accept a connection. This 2009 * makes the TCP both a listener and acceptor. When 2010 * this connection is closed, we need to set the state 2011 * back to TCPS_LISTEN. Make sure that the eager list 2012 * is reinitialized. 2013 * 2014 * Note that this stream is still bound to the four 2015 * tuples of the previous connection in IP. If a new 2016 * SYN with different foreign address comes in, IP will 2017 * not find it and will send it to the global queue. In 2018 * the global queue, TCP will do a tcp_lookup_listener() 2019 * to find this stream. This works because this stream 2020 * is only removed from connected hash. 2021 * 2022 */ 2023 tcp->tcp_state = TCPS_LISTEN; 2024 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 2025 tcp->tcp_eager_next_drop_q0 = tcp; 2026 tcp->tcp_eager_prev_drop_q0 = tcp; 2027 /* 2028 * Initially set conn_recv to tcp_input_listener_unbound to try 2029 * to pick a good squeue for the listener when the first SYN 2030 * arrives. tcp_input_listener_unbound sets it to 2031 * tcp_input_listener on that first SYN. 2032 */ 2033 connp->conn_recv = tcp_input_listener_unbound; 2034 2035 connp->conn_proto = IPPROTO_TCP; 2036 connp->conn_faddr_v6 = ipv6_all_zeros; 2037 connp->conn_fport = 0; 2038 2039 (void) ipcl_bind_insert(connp); 2040 } else { 2041 tcp->tcp_state = TCPS_BOUND; 2042 } 2043 2044 /* 2045 * Initialize to default values 2046 */ 2047 tcp_init_values(tcp, NULL); 2048 2049 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2050 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 2051 int32_t, oldstate); 2052 2053 ASSERT(tcp->tcp_ptpbhn != NULL); 2054 tcp->tcp_rwnd = connp->conn_rcvbuf; 2055 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ? 2056 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; 2057 } 2058 2059 /* 2060 * Force values to zero that need be zero. 2061 * Do not touch values asociated with the BOUND or LISTEN state 2062 * since the connection will end up in that state after the reinit. 2063 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 2064 * structure! 2065 */ 2066 static void 2067 tcp_reinit_values(tcp_t *tcp) 2068 { 2069 tcp_stack_t *tcps = tcp->tcp_tcps; 2070 conn_t *connp = tcp->tcp_connp; 2071 2072 #ifndef lint 2073 #define DONTCARE(x) 2074 #define PRESERVE(x) 2075 #else 2076 #define DONTCARE(x) ((x) = (x)) 2077 #define PRESERVE(x) ((x) = (x)) 2078 #endif /* lint */ 2079 2080 PRESERVE(tcp->tcp_bind_hash_port); 2081 PRESERVE(tcp->tcp_bind_hash); 2082 PRESERVE(tcp->tcp_ptpbhn); 2083 PRESERVE(tcp->tcp_acceptor_hash); 2084 PRESERVE(tcp->tcp_ptpahn); 2085 2086 /* Should be ASSERT NULL on these with new code! */ 2087 ASSERT(tcp->tcp_time_wait_next == NULL); 2088 ASSERT(tcp->tcp_time_wait_prev == NULL); 2089 ASSERT(tcp->tcp_time_wait_expire == 0); 2090 PRESERVE(tcp->tcp_state); 2091 PRESERVE(connp->conn_rq); 2092 PRESERVE(connp->conn_wq); 2093 2094 ASSERT(tcp->tcp_xmit_head == NULL); 2095 ASSERT(tcp->tcp_xmit_last == NULL); 2096 ASSERT(tcp->tcp_unsent == 0); 2097 ASSERT(tcp->tcp_xmit_tail == NULL); 2098 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 2099 2100 tcp->tcp_snxt = 0; /* Displayed in mib */ 2101 tcp->tcp_suna = 0; /* Displayed in mib */ 2102 tcp->tcp_swnd = 0; 2103 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */ 2104 2105 if (connp->conn_ht_iphc != NULL) { 2106 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 2107 connp->conn_ht_iphc = NULL; 2108 connp->conn_ht_iphc_allocated = 0; 2109 connp->conn_ht_iphc_len = 0; 2110 connp->conn_ht_ulp = NULL; 2111 connp->conn_ht_ulp_len = 0; 2112 tcp->tcp_ipha = NULL; 2113 tcp->tcp_ip6h = NULL; 2114 tcp->tcp_tcpha = NULL; 2115 } 2116 2117 /* We clear any IP_OPTIONS and extension headers */ 2118 ip_pkt_free(&connp->conn_xmit_ipp); 2119 2120 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 2121 DONTCARE(tcp->tcp_ipha); 2122 DONTCARE(tcp->tcp_ip6h); 2123 DONTCARE(tcp->tcp_tcpha); 2124 tcp->tcp_valid_bits = 0; 2125 2126 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 2127 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 2128 tcp->tcp_last_rcv_lbolt = 0; 2129 2130 tcp->tcp_init_cwnd = 0; 2131 2132 tcp->tcp_urp_last_valid = 0; 2133 tcp->tcp_hard_binding = 0; 2134 2135 tcp->tcp_fin_acked = 0; 2136 tcp->tcp_fin_rcvd = 0; 2137 tcp->tcp_fin_sent = 0; 2138 tcp->tcp_ordrel_done = 0; 2139 2140 tcp->tcp_detached = 0; 2141 2142 tcp->tcp_snd_ws_ok = B_FALSE; 2143 tcp->tcp_snd_ts_ok = B_FALSE; 2144 tcp->tcp_zero_win_probe = 0; 2145 2146 tcp->tcp_loopback = 0; 2147 tcp->tcp_localnet = 0; 2148 tcp->tcp_syn_defense = 0; 2149 tcp->tcp_set_timer = 0; 2150 2151 tcp->tcp_active_open = 0; 2152 tcp->tcp_rexmit = B_FALSE; 2153 tcp->tcp_xmit_zc_clean = B_FALSE; 2154 2155 tcp->tcp_snd_sack_ok = B_FALSE; 2156 tcp->tcp_hwcksum = B_FALSE; 2157 2158 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */ 2159 2160 tcp->tcp_conn_def_q0 = 0; 2161 tcp->tcp_ip_forward_progress = B_FALSE; 2162 tcp->tcp_ecn_ok = B_FALSE; 2163 2164 tcp->tcp_cwr = B_FALSE; 2165 tcp->tcp_ecn_echo_on = B_FALSE; 2166 tcp->tcp_is_wnd_shrnk = B_FALSE; 2167 2168 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 2169 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 2170 2171 tcp->tcp_rcv_ws = 0; 2172 tcp->tcp_snd_ws = 0; 2173 tcp->tcp_ts_recent = 0; 2174 tcp->tcp_rnxt = 0; /* Displayed in mib */ 2175 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 2176 tcp->tcp_initial_pmtu = 0; 2177 2178 ASSERT(tcp->tcp_reass_head == NULL); 2179 ASSERT(tcp->tcp_reass_tail == NULL); 2180 2181 tcp->tcp_cwnd_cnt = 0; 2182 2183 ASSERT(tcp->tcp_rcv_list == NULL); 2184 ASSERT(tcp->tcp_rcv_last_head == NULL); 2185 ASSERT(tcp->tcp_rcv_last_tail == NULL); 2186 ASSERT(tcp->tcp_rcv_cnt == 0); 2187 2188 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */ 2189 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 2190 tcp->tcp_csuna = 0; 2191 2192 tcp->tcp_rto = 0; /* Displayed in MIB */ 2193 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 2194 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 2195 tcp->tcp_rtt_update = 0; 2196 tcp->tcp_rtt_sum = 0; 2197 tcp->tcp_rtt_cnt = 0; 2198 2199 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2200 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2201 2202 tcp->tcp_rack = 0; /* Displayed in mib */ 2203 tcp->tcp_rack_cnt = 0; 2204 tcp->tcp_rack_cur_max = 0; 2205 tcp->tcp_rack_abs_max = 0; 2206 2207 tcp->tcp_max_swnd = 0; 2208 2209 ASSERT(tcp->tcp_listener == NULL); 2210 2211 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 2212 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 2213 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 2214 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 2215 2216 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 2217 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 2218 PRESERVE(tcp->tcp_conn_req_max); 2219 PRESERVE(tcp->tcp_conn_req_seqnum); 2220 2221 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 2222 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 2223 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 2224 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 2225 2226 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 2227 ASSERT(tcp->tcp_urp_mp == NULL); 2228 ASSERT(tcp->tcp_urp_mark_mp == NULL); 2229 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 2230 2231 ASSERT(tcp->tcp_eager_next_q == NULL); 2232 ASSERT(tcp->tcp_eager_last_q == NULL); 2233 ASSERT((tcp->tcp_eager_next_q0 == NULL && 2234 tcp->tcp_eager_prev_q0 == NULL) || 2235 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 2236 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 2237 2238 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && 2239 tcp->tcp_eager_prev_drop_q0 == NULL) || 2240 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); 2241 2242 DONTCARE(tcp->tcp_ka_rinterval); /* Init in tcp_init_values */ 2243 DONTCARE(tcp->tcp_ka_abort_thres); /* Init in tcp_init_values */ 2244 DONTCARE(tcp->tcp_ka_cnt); /* Init in tcp_init_values */ 2245 2246 tcp->tcp_client_errno = 0; 2247 2248 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */ 2249 2250 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */ 2251 2252 PRESERVE(connp->conn_bound_addr_v6); 2253 tcp->tcp_last_sent_len = 0; 2254 tcp->tcp_dupack_cnt = 0; 2255 2256 connp->conn_fport = 0; /* Displayed in MIB */ 2257 PRESERVE(connp->conn_lport); 2258 2259 PRESERVE(tcp->tcp_acceptor_lockp); 2260 2261 ASSERT(tcp->tcp_ordrel_mp == NULL); 2262 PRESERVE(tcp->tcp_acceptor_id); 2263 DONTCARE(tcp->tcp_ipsec_overhead); 2264 2265 PRESERVE(connp->conn_family); 2266 /* Remove any remnants of mapped address binding */ 2267 if (connp->conn_family == AF_INET6) { 2268 connp->conn_ipversion = IPV6_VERSION; 2269 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2270 } else { 2271 connp->conn_ipversion = IPV4_VERSION; 2272 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2273 } 2274 2275 connp->conn_bound_if = 0; 2276 connp->conn_recv_ancillary.crb_all = 0; 2277 tcp->tcp_recvifindex = 0; 2278 tcp->tcp_recvhops = 0; 2279 tcp->tcp_closed = 0; 2280 if (tcp->tcp_hopopts != NULL) { 2281 mi_free(tcp->tcp_hopopts); 2282 tcp->tcp_hopopts = NULL; 2283 tcp->tcp_hopoptslen = 0; 2284 } 2285 ASSERT(tcp->tcp_hopoptslen == 0); 2286 if (tcp->tcp_dstopts != NULL) { 2287 mi_free(tcp->tcp_dstopts); 2288 tcp->tcp_dstopts = NULL; 2289 tcp->tcp_dstoptslen = 0; 2290 } 2291 ASSERT(tcp->tcp_dstoptslen == 0); 2292 if (tcp->tcp_rthdrdstopts != NULL) { 2293 mi_free(tcp->tcp_rthdrdstopts); 2294 tcp->tcp_rthdrdstopts = NULL; 2295 tcp->tcp_rthdrdstoptslen = 0; 2296 } 2297 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 2298 if (tcp->tcp_rthdr != NULL) { 2299 mi_free(tcp->tcp_rthdr); 2300 tcp->tcp_rthdr = NULL; 2301 tcp->tcp_rthdrlen = 0; 2302 } 2303 ASSERT(tcp->tcp_rthdrlen == 0); 2304 2305 /* Reset fusion-related fields */ 2306 tcp->tcp_fused = B_FALSE; 2307 tcp->tcp_unfusable = B_FALSE; 2308 tcp->tcp_fused_sigurg = B_FALSE; 2309 tcp->tcp_loopback_peer = NULL; 2310 2311 tcp->tcp_lso = B_FALSE; 2312 2313 tcp->tcp_in_ack_unsent = 0; 2314 tcp->tcp_cork = B_FALSE; 2315 tcp->tcp_tconnind_started = B_FALSE; 2316 2317 PRESERVE(tcp->tcp_squeue_bytes); 2318 2319 tcp->tcp_closemp_used = B_FALSE; 2320 2321 PRESERVE(tcp->tcp_rsrv_mp); 2322 PRESERVE(tcp->tcp_rsrv_mp_lock); 2323 2324 #ifdef DEBUG 2325 DONTCARE(tcp->tcmp_stk[0]); 2326 #endif 2327 2328 PRESERVE(tcp->tcp_connid); 2329 2330 ASSERT(tcp->tcp_listen_cnt == NULL); 2331 ASSERT(tcp->tcp_reass_tid == 0); 2332 2333 /* Allow the CC algorithm to clean up after itself. */ 2334 if (tcp->tcp_cc_algo->cb_destroy != NULL) 2335 tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv); 2336 tcp->tcp_cc_algo = NULL; 2337 2338 #undef DONTCARE 2339 #undef PRESERVE 2340 } 2341 2342 /* 2343 * Initialize the various fields in tcp_t. If parent (the listener) is non 2344 * NULL, certain values will be inheritted from it. 2345 */ 2346 void 2347 tcp_init_values(tcp_t *tcp, tcp_t *parent) 2348 { 2349 tcp_stack_t *tcps = tcp->tcp_tcps; 2350 conn_t *connp = tcp->tcp_connp; 2351 2352 ASSERT((connp->conn_family == AF_INET && 2353 connp->conn_ipversion == IPV4_VERSION) || 2354 (connp->conn_family == AF_INET6 && 2355 (connp->conn_ipversion == IPV4_VERSION || 2356 connp->conn_ipversion == IPV6_VERSION))); 2357 2358 tcp->tcp_ccv.type = IPPROTO_TCP; 2359 tcp->tcp_ccv.ccvc.tcp = tcp; 2360 2361 if (parent == NULL) { 2362 tcp->tcp_cc_algo = tcps->tcps_default_cc_algo; 2363 2364 tcp->tcp_naglim = tcps->tcps_naglim_def; 2365 2366 tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial; 2367 tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min; 2368 tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max; 2369 2370 tcp->tcp_first_ctimer_threshold = 2371 tcps->tcps_ip_notify_cinterval; 2372 tcp->tcp_second_ctimer_threshold = 2373 tcps->tcps_ip_abort_cinterval; 2374 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; 2375 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; 2376 2377 tcp->tcp_fin_wait_2_flush_interval = 2378 tcps->tcps_fin_wait_2_flush_interval; 2379 2380 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; 2381 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; 2382 tcp->tcp_ka_cnt = 0; 2383 tcp->tcp_ka_rinterval = 0; 2384 2385 /* 2386 * Default value of tcp_init_cwnd is 0, so no need to set here 2387 * if parent is NULL. But we need to inherit it from parent. 2388 */ 2389 } else { 2390 /* Inherit various TCP parameters from the parent. */ 2391 tcp->tcp_cc_algo = parent->tcp_cc_algo; 2392 2393 tcp->tcp_naglim = parent->tcp_naglim; 2394 2395 tcp->tcp_rto_initial = parent->tcp_rto_initial; 2396 tcp->tcp_rto_min = parent->tcp_rto_min; 2397 tcp->tcp_rto_max = parent->tcp_rto_max; 2398 2399 tcp->tcp_first_ctimer_threshold = 2400 parent->tcp_first_ctimer_threshold; 2401 tcp->tcp_second_ctimer_threshold = 2402 parent->tcp_second_ctimer_threshold; 2403 tcp->tcp_first_timer_threshold = 2404 parent->tcp_first_timer_threshold; 2405 tcp->tcp_second_timer_threshold = 2406 parent->tcp_second_timer_threshold; 2407 2408 tcp->tcp_fin_wait_2_flush_interval = 2409 parent->tcp_fin_wait_2_flush_interval; 2410 tcp->tcp_quickack = parent->tcp_quickack; 2411 2412 tcp->tcp_ka_interval = parent->tcp_ka_interval; 2413 tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres; 2414 tcp->tcp_ka_cnt = parent->tcp_ka_cnt; 2415 tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval; 2416 2417 tcp->tcp_init_cwnd = parent->tcp_init_cwnd; 2418 } 2419 2420 if (tcp->tcp_cc_algo->cb_init != NULL) 2421 VERIFY(tcp->tcp_cc_algo->cb_init(&tcp->tcp_ccv) == 0); 2422 2423 /* 2424 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 2425 * will be close to tcp_rexmit_interval_initial. By doing this, we 2426 * allow the algorithm to adjust slowly to large fluctuations of RTT 2427 * during first few transmissions of a connection as seen in slow 2428 * links. 2429 */ 2430 tcp->tcp_rtt_sa = MSEC2NSEC(tcp->tcp_rto_initial) << 2; 2431 tcp->tcp_rtt_sd = MSEC2NSEC(tcp->tcp_rto_initial) >> 1; 2432 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 2433 tcps->tcps_conn_grace_period); 2434 2435 tcp->tcp_timer_backoff = 0; 2436 tcp->tcp_ms_we_have_waited = 0; 2437 tcp->tcp_last_recv_time = ddi_get_lbolt(); 2438 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; 2439 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2440 2441 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier; 2442 2443 /* NOTE: ISS is now set in tcp_set_destination(). */ 2444 2445 /* Reset fusion-related fields */ 2446 tcp->tcp_fused = B_FALSE; 2447 tcp->tcp_unfusable = B_FALSE; 2448 tcp->tcp_fused_sigurg = B_FALSE; 2449 tcp->tcp_loopback_peer = NULL; 2450 2451 /* We rebuild the header template on the next connect/conn_request */ 2452 2453 connp->conn_mlp_type = mlptSingle; 2454 2455 /* 2456 * Init the window scale to the max so tcp_rwnd_set() won't pare 2457 * down tcp_rwnd. tcp_set_destination() will set the right value later. 2458 */ 2459 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 2460 tcp->tcp_rwnd = connp->conn_rcvbuf; 2461 2462 tcp->tcp_cork = B_FALSE; 2463 /* 2464 * Init the tcp_debug option if it wasn't already set. This value 2465 * determines whether TCP 2466 * calls strlog() to print out debug messages. Doing this 2467 * initialization here means that this value is not inherited thru 2468 * tcp_reinit(). 2469 */ 2470 if (!connp->conn_debug) 2471 connp->conn_debug = tcps->tcps_dbg; 2472 } 2473 2474 /* 2475 * Update the TCP connection according to change of PMTU. 2476 * 2477 * Path MTU might have changed by either increase or decrease, so need to 2478 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny 2479 * or negative MSS, since tcp_mss_set() will do it. 2480 */ 2481 void 2482 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only) 2483 { 2484 uint32_t pmtu; 2485 int32_t mss; 2486 conn_t *connp = tcp->tcp_connp; 2487 ip_xmit_attr_t *ixa = connp->conn_ixa; 2488 iaflags_t ixaflags; 2489 2490 if (tcp->tcp_tcps->tcps_ignore_path_mtu) 2491 return; 2492 2493 if (tcp->tcp_state < TCPS_ESTABLISHED) 2494 return; 2495 2496 /* 2497 * Always call ip_get_pmtu() to make sure that IP has updated 2498 * ixa_flags properly. 2499 */ 2500 pmtu = ip_get_pmtu(ixa); 2501 ixaflags = ixa->ixa_flags; 2502 2503 /* 2504 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and 2505 * IPsec overhead if applied. Make sure to use the most recent 2506 * IPsec information. 2507 */ 2508 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp); 2509 2510 /* 2511 * Nothing to change, so just return. 2512 */ 2513 if (mss == tcp->tcp_mss) 2514 return; 2515 2516 /* 2517 * Currently, for ICMP errors, only PMTU decrease is handled. 2518 */ 2519 if (mss > tcp->tcp_mss && decrease_only) 2520 return; 2521 2522 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss); 2523 2524 /* 2525 * Update ixa_fragsize and ixa_pmtu. 2526 */ 2527 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 2528 2529 /* 2530 * Adjust MSS and all relevant variables. 2531 */ 2532 tcp_mss_set(tcp, mss); 2533 2534 /* 2535 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu 2536 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP 2537 * has a (potentially different) min size we do the same. Make sure to 2538 * clear IXAF_DONTFRAG, which is used by IP to decide whether to 2539 * fragment the packet. 2540 * 2541 * LSO over IPv6 can not be fragmented. So need to disable LSO 2542 * when IPv6 fragmentation is needed. 2543 */ 2544 if (mss < tcp->tcp_tcps->tcps_mss_min) 2545 ixaflags |= IXAF_PMTU_TOO_SMALL; 2546 2547 if (ixaflags & IXAF_PMTU_TOO_SMALL) 2548 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 2549 2550 if ((connp->conn_ipversion == IPV4_VERSION) && 2551 !(ixaflags & IXAF_PMTU_IPV4_DF)) { 2552 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 2553 } 2554 ixa->ixa_flags = ixaflags; 2555 } 2556 2557 int 2558 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 2559 { 2560 conn_t *connp = tcp->tcp_connp; 2561 queue_t *q = connp->conn_rq; 2562 int32_t mss = tcp->tcp_mss; 2563 int maxpsz; 2564 2565 if (TCP_IS_DETACHED(tcp)) 2566 return (mss); 2567 if (tcp->tcp_fused) { 2568 maxpsz = tcp_fuse_maxpsz(tcp); 2569 mss = INFPSZ; 2570 } else if (tcp->tcp_maxpsz_multiplier == 0) { 2571 /* 2572 * Set the sd_qn_maxpsz according to the socket send buffer 2573 * size, and sd_maxblk to INFPSZ (-1). This will essentially 2574 * instruct the stream head to copyin user data into contiguous 2575 * kernel-allocated buffers without breaking it up into smaller 2576 * chunks. We round up the buffer size to the nearest SMSS. 2577 */ 2578 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss); 2579 mss = INFPSZ; 2580 } else { 2581 /* 2582 * Set sd_qn_maxpsz to approx half the (receivers) buffer 2583 * (and a multiple of the mss). This instructs the stream 2584 * head to break down larger than SMSS writes into SMSS- 2585 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 2586 */ 2587 maxpsz = tcp->tcp_maxpsz_multiplier * mss; 2588 if (maxpsz > connp->conn_sndbuf / 2) { 2589 maxpsz = connp->conn_sndbuf / 2; 2590 /* Round up to nearest mss */ 2591 maxpsz = MSS_ROUNDUP(maxpsz, mss); 2592 } 2593 } 2594 2595 (void) proto_set_maxpsz(q, connp, maxpsz); 2596 if (!(IPCL_IS_NONSTR(connp))) 2597 connp->conn_wq->q_maxpsz = maxpsz; 2598 if (set_maxblk) 2599 (void) proto_set_tx_maxblk(q, connp, mss); 2600 return (mss); 2601 } 2602 2603 /* For /dev/tcp aka AF_INET open */ 2604 static int 2605 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2606 { 2607 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); 2608 } 2609 2610 /* For /dev/tcp6 aka AF_INET6 open */ 2611 static int 2612 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2613 { 2614 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); 2615 } 2616 2617 conn_t * 2618 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket, 2619 int *errorp) 2620 { 2621 tcp_t *tcp = NULL; 2622 conn_t *connp; 2623 zoneid_t zoneid; 2624 tcp_stack_t *tcps; 2625 squeue_t *sqp; 2626 2627 ASSERT(errorp != NULL); 2628 /* 2629 * Find the proper zoneid and netstack. 2630 */ 2631 /* 2632 * Special case for install: miniroot needs to be able to 2633 * access files via NFS as though it were always in the 2634 * global zone. 2635 */ 2636 if (credp == kcred && nfs_global_client_only != 0) { 2637 zoneid = GLOBAL_ZONEID; 2638 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> 2639 netstack_tcp; 2640 ASSERT(tcps != NULL); 2641 } else { 2642 netstack_t *ns; 2643 int err; 2644 2645 if ((err = secpolicy_basic_net_access(credp)) != 0) { 2646 *errorp = err; 2647 return (NULL); 2648 } 2649 2650 ns = netstack_find_by_cred(credp); 2651 ASSERT(ns != NULL); 2652 tcps = ns->netstack_tcp; 2653 ASSERT(tcps != NULL); 2654 2655 /* 2656 * For exclusive stacks we set the zoneid to zero 2657 * to make TCP operate as if in the global zone. 2658 */ 2659 if (tcps->tcps_netstack->netstack_stackid != 2660 GLOBAL_NETSTACKID) 2661 zoneid = GLOBAL_ZONEID; 2662 else 2663 zoneid = crgetzoneid(credp); 2664 } 2665 2666 sqp = IP_SQUEUE_GET((uint_t)gethrtime()); 2667 connp = tcp_get_conn(sqp, tcps); 2668 /* 2669 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, 2670 * so we drop it by one. 2671 */ 2672 netstack_rele(tcps->tcps_netstack); 2673 if (connp == NULL) { 2674 *errorp = ENOSR; 2675 return (NULL); 2676 } 2677 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto); 2678 2679 connp->conn_sqp = sqp; 2680 connp->conn_initial_sqp = connp->conn_sqp; 2681 connp->conn_ixa->ixa_sqp = connp->conn_sqp; 2682 tcp = connp->conn_tcp; 2683 2684 /* 2685 * Besides asking IP to set the checksum for us, have conn_ip_output 2686 * to do the following checks when necessary: 2687 * 2688 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid 2689 * IXAF_VERIFY_PMTU: verify PMTU changes 2690 * IXAF_VERIFY_LSO: verify LSO capability changes 2691 */ 2692 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 2693 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO; 2694 2695 if (!tcps->tcps_dev_flow_ctl) 2696 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 2697 2698 if (isv6) { 2699 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 2700 connp->conn_ipversion = IPV6_VERSION; 2701 connp->conn_family = AF_INET6; 2702 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2703 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit; 2704 } else { 2705 connp->conn_ipversion = IPV4_VERSION; 2706 connp->conn_family = AF_INET; 2707 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2708 connp->conn_default_ttl = tcps->tcps_ipv4_ttl; 2709 } 2710 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 2711 2712 crhold(credp); 2713 connp->conn_cred = credp; 2714 connp->conn_cpid = curproc->p_pid; 2715 connp->conn_open_time = ddi_get_lbolt64(); 2716 2717 /* Cache things in the ixa without any refhold */ 2718 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 2719 connp->conn_ixa->ixa_cred = credp; 2720 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 2721 2722 connp->conn_zoneid = zoneid; 2723 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 2724 connp->conn_ixa->ixa_zoneid = zoneid; 2725 connp->conn_mlp_type = mlptSingle; 2726 ASSERT(connp->conn_netstack == tcps->tcps_netstack); 2727 ASSERT(tcp->tcp_tcps == tcps); 2728 2729 /* 2730 * If the caller has the process-wide flag set, then default to MAC 2731 * exempt mode. This allows read-down to unlabeled hosts. 2732 */ 2733 if (getpflags(NET_MAC_AWARE, credp) != 0) 2734 connp->conn_mac_mode = CONN_MAC_AWARE; 2735 2736 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 2737 2738 if (issocket) { 2739 tcp->tcp_issocket = 1; 2740 } 2741 2742 connp->conn_rcvbuf = tcps->tcps_recv_hiwat; 2743 connp->conn_sndbuf = tcps->tcps_xmit_hiwat; 2744 if (tcps->tcps_snd_lowat_fraction != 0) { 2745 connp->conn_sndlowat = connp->conn_sndbuf / 2746 tcps->tcps_snd_lowat_fraction; 2747 } else { 2748 connp->conn_sndlowat = tcps->tcps_xmit_lowat; 2749 } 2750 connp->conn_so_type = SOCK_STREAM; 2751 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2752 tcps->tcps_wroff_xtra; 2753 2754 SOCK_CONNID_INIT(tcp->tcp_connid); 2755 /* DTrace ignores this - it isn't a tcp:::state-change */ 2756 tcp->tcp_state = TCPS_IDLE; 2757 tcp_init_values(tcp, NULL); 2758 return (connp); 2759 } 2760 2761 static int 2762 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 2763 boolean_t isv6) 2764 { 2765 tcp_t *tcp = NULL; 2766 conn_t *connp = NULL; 2767 int err; 2768 vmem_t *minor_arena = NULL; 2769 dev_t conn_dev; 2770 boolean_t issocket; 2771 2772 if (q->q_ptr != NULL) 2773 return (0); 2774 2775 if (sflag == MODOPEN) 2776 return (EINVAL); 2777 2778 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 2779 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 2780 minor_arena = ip_minor_arena_la; 2781 } else { 2782 /* 2783 * Either minor numbers in the large arena were exhausted 2784 * or a non socket application is doing the open. 2785 * Try to allocate from the small arena. 2786 */ 2787 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 2788 return (EBUSY); 2789 } 2790 minor_arena = ip_minor_arena_sa; 2791 } 2792 2793 ASSERT(minor_arena != NULL); 2794 2795 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev); 2796 2797 if (flag & SO_FALLBACK) { 2798 /* 2799 * Non streams socket needs a stream to fallback to 2800 */ 2801 RD(q)->q_ptr = (void *)conn_dev; 2802 WR(q)->q_qinfo = &tcp_fallback_sock_winit; 2803 WR(q)->q_ptr = (void *)minor_arena; 2804 qprocson(q); 2805 return (0); 2806 } else if (flag & SO_ACCEPTOR) { 2807 q->q_qinfo = &tcp_acceptor_rinit; 2808 /* 2809 * the conn_dev and minor_arena will be subsequently used by 2810 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out 2811 * the minor device number for this connection from the q_ptr. 2812 */ 2813 RD(q)->q_ptr = (void *)conn_dev; 2814 WR(q)->q_qinfo = &tcp_acceptor_winit; 2815 WR(q)->q_ptr = (void *)minor_arena; 2816 qprocson(q); 2817 return (0); 2818 } 2819 2820 issocket = flag & SO_SOCKSTR; 2821 connp = tcp_create_common(credp, isv6, issocket, &err); 2822 2823 if (connp == NULL) { 2824 inet_minor_free(minor_arena, conn_dev); 2825 q->q_ptr = WR(q)->q_ptr = NULL; 2826 return (err); 2827 } 2828 2829 connp->conn_rq = q; 2830 connp->conn_wq = WR(q); 2831 q->q_ptr = WR(q)->q_ptr = connp; 2832 2833 connp->conn_dev = conn_dev; 2834 connp->conn_minor_arena = minor_arena; 2835 2836 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); 2837 ASSERT(WR(q)->q_qinfo == &tcp_winit); 2838 2839 tcp = connp->conn_tcp; 2840 2841 if (issocket) { 2842 WR(q)->q_qinfo = &tcp_sock_winit; 2843 } else { 2844 #ifdef _ILP32 2845 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 2846 #else 2847 tcp->tcp_acceptor_id = conn_dev; 2848 #endif /* _ILP32 */ 2849 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 2850 } 2851 2852 /* 2853 * Put the ref for TCP. Ref for IP was already put 2854 * by ipcl_conn_create. Also Make the conn_t globally 2855 * visible to walkers 2856 */ 2857 mutex_enter(&connp->conn_lock); 2858 CONN_INC_REF_LOCKED(connp); 2859 ASSERT(connp->conn_ref == 2); 2860 connp->conn_state_flags &= ~CONN_INCIPIENT; 2861 mutex_exit(&connp->conn_lock); 2862 2863 qprocson(q); 2864 return (0); 2865 } 2866 2867 /* 2868 * Build/update the tcp header template (in conn_ht_iphc) based on 2869 * conn_xmit_ipp. The headers include ip6_t, any extension 2870 * headers, and the maximum size tcp header (to avoid reallocation 2871 * on the fly for additional tcp options). 2872 * 2873 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}. 2874 * Returns failure if can't allocate memory. 2875 */ 2876 int 2877 tcp_build_hdrs(tcp_t *tcp) 2878 { 2879 tcp_stack_t *tcps = tcp->tcp_tcps; 2880 conn_t *connp = tcp->tcp_connp; 2881 char buf[TCP_MAX_HDR_LENGTH]; 2882 uint_t buflen; 2883 uint_t ulplen = TCP_MIN_HEADER_LENGTH; 2884 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH; 2885 tcpha_t *tcpha; 2886 uint32_t cksum; 2887 int error; 2888 2889 /* 2890 * We might be called after the connection is set up, and we might 2891 * have TS options already in the TCP header. Thus we save any 2892 * existing tcp header. 2893 */ 2894 buflen = connp->conn_ht_ulp_len; 2895 if (buflen != 0) { 2896 bcopy(connp->conn_ht_ulp, buf, buflen); 2897 extralen -= buflen - ulplen; 2898 ulplen = buflen; 2899 } 2900 2901 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */ 2902 mutex_enter(&connp->conn_lock); 2903 error = conn_build_hdr_template(connp, ulplen, extralen, 2904 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo); 2905 mutex_exit(&connp->conn_lock); 2906 if (error != 0) 2907 return (error); 2908 2909 /* 2910 * Any routing header/option has been massaged. The checksum difference 2911 * is stored in conn_sum for later use. 2912 */ 2913 tcpha = (tcpha_t *)connp->conn_ht_ulp; 2914 tcp->tcp_tcpha = tcpha; 2915 2916 /* restore any old tcp header */ 2917 if (buflen != 0) { 2918 bcopy(buf, connp->conn_ht_ulp, buflen); 2919 } else { 2920 tcpha->tha_sum = 0; 2921 tcpha->tha_urp = 0; 2922 tcpha->tha_ack = 0; 2923 tcpha->tha_offset_and_reserved = (5 << 4); 2924 tcpha->tha_lport = connp->conn_lport; 2925 tcpha->tha_fport = connp->conn_fport; 2926 } 2927 2928 /* 2929 * IP wants our header length in the checksum field to 2930 * allow it to perform a single pseudo-header+checksum 2931 * calculation on behalf of TCP. 2932 * Include the adjustment for a source route once IP_OPTIONS is set. 2933 */ 2934 cksum = sizeof (tcpha_t) + connp->conn_sum; 2935 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2936 ASSERT(cksum < 0x10000); 2937 tcpha->tha_sum = htons(cksum); 2938 2939 if (connp->conn_ipversion == IPV4_VERSION) 2940 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc; 2941 else 2942 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc; 2943 2944 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra > 2945 connp->conn_wroff) { 2946 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2947 tcps->tcps_wroff_xtra; 2948 (void) proto_set_tx_wroff(connp->conn_rq, connp, 2949 connp->conn_wroff); 2950 } 2951 return (0); 2952 } 2953 2954 /* 2955 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 2956 * We do not allow the receive window to shrink. After setting rwnd, 2957 * set the flow control hiwat of the stream. 2958 * 2959 * This function is called in 2 cases: 2960 * 2961 * 1) Before data transfer begins, in tcp_input_listener() for accepting a 2962 * connection (passive open) and in tcp_input_data() for active connect. 2963 * This is called after tcp_mss_set() when the desired MSS value is known. 2964 * This makes sure that our window size is a mutiple of the other side's 2965 * MSS. 2966 * 2) Handling SO_RCVBUF option. 2967 * 2968 * It is ASSUMED that the requested size is a multiple of the current MSS. 2969 * 2970 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 2971 * user requests so. 2972 */ 2973 int 2974 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 2975 { 2976 uint32_t mss = tcp->tcp_mss; 2977 uint32_t old_max_rwnd; 2978 uint32_t max_transmittable_rwnd; 2979 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 2980 tcp_stack_t *tcps = tcp->tcp_tcps; 2981 conn_t *connp = tcp->tcp_connp; 2982 2983 /* 2984 * Insist on a receive window that is at least 2985 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 2986 * funny TCP interactions of Nagle algorithm, SWS avoidance 2987 * and delayed acknowledgement. 2988 */ 2989 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); 2990 2991 if (tcp->tcp_fused) { 2992 size_t sth_hiwat; 2993 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2994 2995 ASSERT(peer_tcp != NULL); 2996 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 2997 if (!tcp_detached) { 2998 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2999 sth_hiwat); 3000 tcp_set_recv_threshold(tcp, sth_hiwat >> 3); 3001 } 3002 3003 /* Caller could have changed tcp_rwnd; update tha_win */ 3004 if (tcp->tcp_tcpha != NULL) { 3005 tcp->tcp_tcpha->tha_win = 3006 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3007 } 3008 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3009 tcp->tcp_cwnd_max = rwnd; 3010 3011 /* 3012 * In the fusion case, the maxpsz stream head value of 3013 * our peer is set according to its send buffer size 3014 * and our receive buffer size; since the latter may 3015 * have changed we need to update the peer's maxpsz. 3016 */ 3017 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 3018 return (sth_hiwat); 3019 } 3020 3021 if (tcp_detached) 3022 old_max_rwnd = tcp->tcp_rwnd; 3023 else 3024 old_max_rwnd = connp->conn_rcvbuf; 3025 3026 3027 /* 3028 * If window size info has already been exchanged, TCP should not 3029 * shrink the window. Shrinking window is doable if done carefully. 3030 * We may add that support later. But so far there is not a real 3031 * need to do that. 3032 */ 3033 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 3034 /* MSS may have changed, do a round up again. */ 3035 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 3036 } 3037 3038 /* 3039 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 3040 * can be applied even before the window scale option is decided. 3041 */ 3042 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 3043 if (rwnd > max_transmittable_rwnd) { 3044 rwnd = max_transmittable_rwnd - 3045 (max_transmittable_rwnd % mss); 3046 if (rwnd < mss) 3047 rwnd = max_transmittable_rwnd; 3048 /* 3049 * If we're over the limit we may have to back down tcp_rwnd. 3050 * The increment below won't work for us. So we set all three 3051 * here and the increment below will have no effect. 3052 */ 3053 tcp->tcp_rwnd = old_max_rwnd = rwnd; 3054 } 3055 if (tcp->tcp_localnet) { 3056 tcp->tcp_rack_abs_max = 3057 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); 3058 } else { 3059 /* 3060 * For a remote host on a different subnet (through a router), 3061 * we ack every other packet to be conforming to RFC1122. 3062 * tcp_deferred_acks_max is default to 2. 3063 */ 3064 tcp->tcp_rack_abs_max = 3065 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); 3066 } 3067 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 3068 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 3069 else 3070 tcp->tcp_rack_cur_max = 0; 3071 /* 3072 * Increment the current rwnd by the amount the maximum grew (we 3073 * can not overwrite it since we might be in the middle of a 3074 * connection.) 3075 */ 3076 tcp->tcp_rwnd += rwnd - old_max_rwnd; 3077 connp->conn_rcvbuf = rwnd; 3078 3079 /* Are we already connected? */ 3080 if (tcp->tcp_tcpha != NULL) { 3081 tcp->tcp_tcpha->tha_win = 3082 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3083 } 3084 3085 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3086 tcp->tcp_cwnd_max = rwnd; 3087 3088 if (tcp_detached) 3089 return (rwnd); 3090 3091 tcp_set_recv_threshold(tcp, rwnd >> 3); 3092 3093 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd); 3094 return (rwnd); 3095 } 3096 3097 int 3098 tcp_do_unbind(conn_t *connp) 3099 { 3100 tcp_t *tcp = connp->conn_tcp; 3101 int32_t oldstate; 3102 3103 switch (tcp->tcp_state) { 3104 case TCPS_BOUND: 3105 case TCPS_LISTEN: 3106 break; 3107 default: 3108 return (-TOUTSTATE); 3109 } 3110 3111 /* 3112 * Need to clean up all the eagers since after the unbind, segments 3113 * will no longer be delivered to this listener stream. 3114 */ 3115 mutex_enter(&tcp->tcp_eager_lock); 3116 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 3117 tcp_eager_cleanup(tcp, 0); 3118 } 3119 mutex_exit(&tcp->tcp_eager_lock); 3120 3121 /* Clean up the listener connection counter if necessary. */ 3122 if (tcp->tcp_listen_cnt != NULL) 3123 TCP_DECR_LISTEN_CNT(tcp); 3124 connp->conn_laddr_v6 = ipv6_all_zeros; 3125 connp->conn_saddr_v6 = ipv6_all_zeros; 3126 tcp_bind_hash_remove(tcp); 3127 oldstate = tcp->tcp_state; 3128 tcp->tcp_state = TCPS_IDLE; 3129 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 3130 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 3131 int32_t, oldstate); 3132 3133 ip_unbind(connp); 3134 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 3135 3136 return (0); 3137 } 3138 3139 /* 3140 * Collect protocol properties to send to the upper handle. 3141 */ 3142 void 3143 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp) 3144 { 3145 conn_t *connp = tcp->tcp_connp; 3146 3147 sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF; 3148 sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 3149 3150 sopp->sopp_rxhiwat = tcp->tcp_fused ? 3151 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) : 3152 connp->conn_rcvbuf; 3153 /* 3154 * Determine what write offset value to use depending on SACK and 3155 * whether the endpoint is fused or not. 3156 */ 3157 if (tcp->tcp_fused) { 3158 ASSERT(tcp->tcp_loopback); 3159 ASSERT(tcp->tcp_loopback_peer != NULL); 3160 /* 3161 * For fused tcp loopback, set the stream head's write 3162 * offset value to zero since we won't be needing any room 3163 * for TCP/IP headers. This would also improve performance 3164 * since it would reduce the amount of work done by kmem. 3165 * Non-fused tcp loopback case is handled separately below. 3166 */ 3167 sopp->sopp_wroff = 0; 3168 /* 3169 * Update the peer's transmit parameters according to 3170 * our recently calculated high water mark value. 3171 */ 3172 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 3173 } else if (tcp->tcp_snd_sack_ok) { 3174 sopp->sopp_wroff = connp->conn_ht_iphc_allocated + 3175 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra); 3176 } else { 3177 sopp->sopp_wroff = connp->conn_ht_iphc_len + 3178 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra); 3179 } 3180 3181 if (tcp->tcp_loopback) { 3182 sopp->sopp_flags |= SOCKOPT_LOOPBACK; 3183 sopp->sopp_loopback = B_TRUE; 3184 } 3185 } 3186 3187 /* 3188 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP. 3189 */ 3190 boolean_t 3191 tcp_zcopy_check(tcp_t *tcp) 3192 { 3193 conn_t *connp = tcp->tcp_connp; 3194 ip_xmit_attr_t *ixa = connp->conn_ixa; 3195 boolean_t zc_enabled = B_FALSE; 3196 tcp_stack_t *tcps = tcp->tcp_tcps; 3197 3198 if (do_tcpzcopy == 2) 3199 zc_enabled = B_TRUE; 3200 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB)) 3201 zc_enabled = B_TRUE; 3202 3203 tcp->tcp_snd_zcopy_on = zc_enabled; 3204 if (!TCP_IS_DETACHED(tcp)) { 3205 if (zc_enabled) { 3206 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY; 3207 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3208 ZCVMSAFE); 3209 TCP_STAT(tcps, tcp_zcopy_on); 3210 } else { 3211 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY; 3212 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3213 ZCVMUNSAFE); 3214 TCP_STAT(tcps, tcp_zcopy_off); 3215 } 3216 } 3217 return (zc_enabled); 3218 } 3219 3220 /* 3221 * Backoff from a zero-copy message by copying data to a new allocated 3222 * message and freeing the original desballoca'ed segmapped message. 3223 * 3224 * This function is called by following two callers: 3225 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free 3226 * the origial desballoca'ed message and notify sockfs. This is in re- 3227 * transmit state. 3228 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need 3229 * to be copied to new message. 3230 */ 3231 mblk_t * 3232 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist) 3233 { 3234 mblk_t *nbp; 3235 mblk_t *head = NULL; 3236 mblk_t *tail = NULL; 3237 tcp_stack_t *tcps = tcp->tcp_tcps; 3238 3239 ASSERT(bp != NULL); 3240 while (bp != NULL) { 3241 if (IS_VMLOANED_MBLK(bp)) { 3242 TCP_STAT(tcps, tcp_zcopy_backoff); 3243 if ((nbp = copyb(bp)) == NULL) { 3244 tcp->tcp_xmit_zc_clean = B_FALSE; 3245 if (tail != NULL) 3246 tail->b_cont = bp; 3247 return ((head == NULL) ? bp : head); 3248 } 3249 3250 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 3251 if (fix_xmitlist) 3252 tcp_zcopy_notify(tcp); 3253 else 3254 nbp->b_datap->db_struioflag |= 3255 STRUIO_ZCNOTIFY; 3256 } 3257 nbp->b_cont = bp->b_cont; 3258 3259 /* 3260 * Copy saved information and adjust tcp_xmit_tail 3261 * if needed. 3262 */ 3263 if (fix_xmitlist) { 3264 nbp->b_prev = bp->b_prev; 3265 nbp->b_next = bp->b_next; 3266 3267 if (tcp->tcp_xmit_tail == bp) 3268 tcp->tcp_xmit_tail = nbp; 3269 } 3270 3271 /* Free the original message. */ 3272 bp->b_prev = NULL; 3273 bp->b_next = NULL; 3274 freeb(bp); 3275 3276 bp = nbp; 3277 } 3278 3279 if (head == NULL) { 3280 head = bp; 3281 } 3282 if (tail == NULL) { 3283 tail = bp; 3284 } else { 3285 tail->b_cont = bp; 3286 tail = bp; 3287 } 3288 3289 /* Move forward. */ 3290 bp = bp->b_cont; 3291 } 3292 3293 if (fix_xmitlist) { 3294 tcp->tcp_xmit_last = tail; 3295 tcp->tcp_xmit_zc_clean = B_TRUE; 3296 } 3297 3298 return (head); 3299 } 3300 3301 void 3302 tcp_zcopy_notify(tcp_t *tcp) 3303 { 3304 struct stdata *stp; 3305 conn_t *connp; 3306 3307 if (tcp->tcp_detached) 3308 return; 3309 connp = tcp->tcp_connp; 3310 if (IPCL_IS_NONSTR(connp)) { 3311 (*connp->conn_upcalls->su_zcopy_notify) 3312 (connp->conn_upper_handle); 3313 return; 3314 } 3315 stp = STREAM(connp->conn_rq); 3316 mutex_enter(&stp->sd_lock); 3317 stp->sd_flag |= STZCNOTIFY; 3318 cv_broadcast(&stp->sd_zcopy_wait); 3319 mutex_exit(&stp->sd_lock); 3320 } 3321 3322 /* 3323 * Update the TCP connection according to change of LSO capability. 3324 */ 3325 static void 3326 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa) 3327 { 3328 /* 3329 * We check against IPv4 header length to preserve the old behavior 3330 * of only enabling LSO when there are no IP options. 3331 * But this restriction might not be necessary at all. Before removing 3332 * it, need to verify how LSO is handled for source routing case, with 3333 * which IP does software checksum. 3334 * 3335 * For IPv6, whenever any extension header is needed, LSO is supressed. 3336 */ 3337 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ? 3338 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN)) 3339 return; 3340 3341 /* 3342 * Either the LSO capability newly became usable, or it has changed. 3343 */ 3344 if (ixa->ixa_flags & IXAF_LSO_CAPAB) { 3345 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab; 3346 uint_t lso_max = (ixa->ixa_flags & IXAF_IS_IPV4) ? 3347 lsoc->ill_lso_max_tcpv4 : lsoc->ill_lso_max_tcpv6; 3348 3349 ASSERT3U(lso_max, >, 0); 3350 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lso_max); 3351 3352 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3353 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max); 3354 3355 /* 3356 * If LSO to be enabled, notify the STREAM header with larger 3357 * data block. 3358 */ 3359 if (!tcp->tcp_lso) 3360 tcp->tcp_maxpsz_multiplier = 0; 3361 3362 tcp->tcp_lso = B_TRUE; 3363 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled); 3364 } else { /* LSO capability is not usable any more. */ 3365 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3366 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max); 3367 3368 /* 3369 * If LSO to be disabled, notify the STREAM header with smaller 3370 * data block. And need to restore fragsize to PMTU. 3371 */ 3372 if (tcp->tcp_lso) { 3373 tcp->tcp_maxpsz_multiplier = 3374 tcp->tcp_tcps->tcps_maxpsz_multiplier; 3375 ixa->ixa_fragsize = ixa->ixa_pmtu; 3376 tcp->tcp_lso = B_FALSE; 3377 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled); 3378 } 3379 } 3380 3381 (void) tcp_maxpsz_set(tcp, B_TRUE); 3382 } 3383 3384 /* 3385 * Update the TCP connection according to change of ZEROCOPY capability. 3386 */ 3387 static void 3388 tcp_update_zcopy(tcp_t *tcp) 3389 { 3390 conn_t *connp = tcp->tcp_connp; 3391 tcp_stack_t *tcps = tcp->tcp_tcps; 3392 3393 if (tcp->tcp_snd_zcopy_on) { 3394 tcp->tcp_snd_zcopy_on = B_FALSE; 3395 if (!TCP_IS_DETACHED(tcp)) { 3396 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3397 ZCVMUNSAFE); 3398 TCP_STAT(tcps, tcp_zcopy_off); 3399 } 3400 } else { 3401 tcp->tcp_snd_zcopy_on = B_TRUE; 3402 if (!TCP_IS_DETACHED(tcp)) { 3403 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3404 ZCVMSAFE); 3405 TCP_STAT(tcps, tcp_zcopy_on); 3406 } 3407 } 3408 } 3409 3410 /* 3411 * Notify function registered with ip_xmit_attr_t. It's called in the squeue 3412 * so it's safe to update the TCP connection. 3413 */ 3414 /* ARGSUSED1 */ 3415 static void 3416 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 3417 ixa_notify_arg_t narg) 3418 { 3419 tcp_t *tcp = (tcp_t *)arg; 3420 conn_t *connp = tcp->tcp_connp; 3421 3422 switch (ntype) { 3423 case IXAN_LSO: 3424 tcp_update_lso(tcp, connp->conn_ixa); 3425 break; 3426 case IXAN_PMTU: 3427 tcp_update_pmtu(tcp, B_FALSE); 3428 break; 3429 case IXAN_ZCOPY: 3430 tcp_update_zcopy(tcp); 3431 break; 3432 default: 3433 break; 3434 } 3435 } 3436 3437 /* 3438 * The TCP write service routine should never be called... 3439 */ 3440 /* ARGSUSED */ 3441 static int 3442 tcp_wsrv(queue_t *q) 3443 { 3444 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 3445 3446 TCP_STAT(tcps, tcp_wsrv_called); 3447 return (0); 3448 } 3449 3450 /* 3451 * Hash list lookup routine for tcp_t structures. 3452 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 3453 */ 3454 tcp_t * 3455 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps) 3456 { 3457 tf_t *tf; 3458 tcp_t *tcp; 3459 3460 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 3461 mutex_enter(&tf->tf_lock); 3462 for (tcp = tf->tf_tcp; tcp != NULL; 3463 tcp = tcp->tcp_acceptor_hash) { 3464 if (tcp->tcp_acceptor_id == id) { 3465 CONN_INC_REF(tcp->tcp_connp); 3466 mutex_exit(&tf->tf_lock); 3467 return (tcp); 3468 } 3469 } 3470 mutex_exit(&tf->tf_lock); 3471 return (NULL); 3472 } 3473 3474 /* 3475 * Hash list insertion routine for tcp_t structures. 3476 */ 3477 void 3478 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 3479 { 3480 tf_t *tf; 3481 tcp_t **tcpp; 3482 tcp_t *tcpnext; 3483 tcp_stack_t *tcps = tcp->tcp_tcps; 3484 3485 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 3486 3487 if (tcp->tcp_ptpahn != NULL) 3488 tcp_acceptor_hash_remove(tcp); 3489 tcpp = &tf->tf_tcp; 3490 mutex_enter(&tf->tf_lock); 3491 tcpnext = tcpp[0]; 3492 if (tcpnext) 3493 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 3494 tcp->tcp_acceptor_hash = tcpnext; 3495 tcp->tcp_ptpahn = tcpp; 3496 tcpp[0] = tcp; 3497 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 3498 mutex_exit(&tf->tf_lock); 3499 } 3500 3501 /* 3502 * Hash list removal routine for tcp_t structures. 3503 */ 3504 void 3505 tcp_acceptor_hash_remove(tcp_t *tcp) 3506 { 3507 tcp_t *tcpnext; 3508 kmutex_t *lockp; 3509 3510 /* 3511 * Extract the lock pointer in case there are concurrent 3512 * hash_remove's for this instance. 3513 */ 3514 lockp = tcp->tcp_acceptor_lockp; 3515 3516 if (tcp->tcp_ptpahn == NULL) 3517 return; 3518 3519 ASSERT(lockp != NULL); 3520 mutex_enter(lockp); 3521 if (tcp->tcp_ptpahn) { 3522 tcpnext = tcp->tcp_acceptor_hash; 3523 if (tcpnext) { 3524 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 3525 tcp->tcp_acceptor_hash = NULL; 3526 } 3527 *tcp->tcp_ptpahn = tcpnext; 3528 tcp->tcp_ptpahn = NULL; 3529 } 3530 mutex_exit(lockp); 3531 tcp->tcp_acceptor_lockp = NULL; 3532 } 3533 3534 /* 3535 * Type three generator adapted from the random() function in 4.4 BSD: 3536 */ 3537 3538 /* 3539 * Copyright (c) 1983, 1993 3540 * The Regents of the University of California. All rights reserved. 3541 * 3542 * Redistribution and use in source and binary forms, with or without 3543 * modification, are permitted provided that the following conditions 3544 * are met: 3545 * 1. Redistributions of source code must retain the above copyright 3546 * notice, this list of conditions and the following disclaimer. 3547 * 2. Redistributions in binary form must reproduce the above copyright 3548 * notice, this list of conditions and the following disclaimer in the 3549 * documentation and/or other materials provided with the distribution. 3550 * 3. All advertising materials mentioning features or use of this software 3551 * must display the following acknowledgement: 3552 * This product includes software developed by the University of 3553 * California, Berkeley and its contributors. 3554 * 4. Neither the name of the University nor the names of its contributors 3555 * may be used to endorse or promote products derived from this software 3556 * without specific prior written permission. 3557 * 3558 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 3559 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 3560 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 3561 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 3562 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 3563 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 3564 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 3565 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3566 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3567 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3568 * SUCH DAMAGE. 3569 */ 3570 3571 /* Type 3 -- x**31 + x**3 + 1 */ 3572 #define DEG_3 31 3573 #define SEP_3 3 3574 3575 3576 /* Protected by tcp_random_lock */ 3577 static int tcp_randtbl[DEG_3 + 1]; 3578 3579 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 3580 static int *tcp_random_rptr = &tcp_randtbl[1]; 3581 3582 static int *tcp_random_state = &tcp_randtbl[1]; 3583 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 3584 3585 kmutex_t tcp_random_lock; 3586 3587 void 3588 tcp_random_init(void) 3589 { 3590 int i; 3591 hrtime_t hrt; 3592 time_t wallclock; 3593 uint64_t result; 3594 3595 /* 3596 * Use high-res timer and current time for seed. Gethrtime() returns 3597 * a longlong, which may contain resolution down to nanoseconds. 3598 * The current time will either be a 32-bit or a 64-bit quantity. 3599 * XOR the two together in a 64-bit result variable. 3600 * Convert the result to a 32-bit value by multiplying the high-order 3601 * 32-bits by the low-order 32-bits. 3602 */ 3603 3604 hrt = gethrtime(); 3605 (void) drv_getparm(TIME, &wallclock); 3606 result = (uint64_t)wallclock ^ (uint64_t)hrt; 3607 mutex_enter(&tcp_random_lock); 3608 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 3609 (result & 0xffffffff); 3610 3611 for (i = 1; i < DEG_3; i++) 3612 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 3613 + 12345; 3614 tcp_random_fptr = &tcp_random_state[SEP_3]; 3615 tcp_random_rptr = &tcp_random_state[0]; 3616 mutex_exit(&tcp_random_lock); 3617 for (i = 0; i < 10 * DEG_3; i++) 3618 (void) tcp_random(); 3619 } 3620 3621 /* 3622 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 3623 * This range is selected to be approximately centered on TCP_ISS / 2, 3624 * and easy to compute. We get this value by generating a 32-bit random 3625 * number, selecting out the high-order 17 bits, and then adding one so 3626 * that we never return zero. 3627 */ 3628 int 3629 tcp_random(void) 3630 { 3631 int i; 3632 3633 mutex_enter(&tcp_random_lock); 3634 *tcp_random_fptr += *tcp_random_rptr; 3635 3636 /* 3637 * The high-order bits are more random than the low-order bits, 3638 * so we select out the high-order 17 bits and add one so that 3639 * we never return zero. 3640 */ 3641 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 3642 if (++tcp_random_fptr >= tcp_random_end_ptr) { 3643 tcp_random_fptr = tcp_random_state; 3644 ++tcp_random_rptr; 3645 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 3646 tcp_random_rptr = tcp_random_state; 3647 3648 mutex_exit(&tcp_random_lock); 3649 return (i); 3650 } 3651 3652 /* 3653 * Split this function out so that if the secret changes, I'm okay. 3654 * 3655 * Initialize the tcp_iss_cookie and tcp_iss_key. 3656 */ 3657 3658 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 3659 3660 void 3661 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps) 3662 { 3663 struct { 3664 int32_t current_time; 3665 uint32_t randnum; 3666 uint16_t pad; 3667 uint8_t ether[6]; 3668 uint8_t passwd[PASSWD_SIZE]; 3669 } tcp_iss_cookie; 3670 time_t t; 3671 3672 /* 3673 * Start with the current absolute time. 3674 */ 3675 (void) drv_getparm(TIME, &t); 3676 tcp_iss_cookie.current_time = t; 3677 3678 /* 3679 * XXX - Need a more random number per RFC 1750, not this crap. 3680 * OTOH, if what follows is pretty random, then I'm in better shape. 3681 */ 3682 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 3683 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 3684 3685 /* 3686 * The cpu_type_info is pretty non-random. Ugggh. It does serve 3687 * as a good template. 3688 */ 3689 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 3690 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 3691 3692 /* 3693 * The pass-phrase. Normally this is supplied by user-called NDD. 3694 */ 3695 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 3696 3697 /* 3698 * See 4010593 if this section becomes a problem again, 3699 * but the local ethernet address is useful here. 3700 */ 3701 (void) localetheraddr(NULL, 3702 (struct ether_addr *)&tcp_iss_cookie.ether); 3703 3704 /* 3705 * Hash 'em all together. The MD5Final is called per-connection. 3706 */ 3707 mutex_enter(&tcps->tcps_iss_key_lock); 3708 MD5Init(&tcps->tcps_iss_key); 3709 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie, 3710 sizeof (tcp_iss_cookie)); 3711 mutex_exit(&tcps->tcps_iss_key_lock); 3712 } 3713 3714 /* 3715 * Called by IP when IP is loaded into the kernel 3716 */ 3717 void 3718 tcp_ddi_g_init(void) 3719 { 3720 tcp_timercache = kmem_cache_create("tcp_timercache", 3721 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 3722 NULL, NULL, NULL, NULL, NULL, 0); 3723 3724 tcp_notsack_blk_cache = kmem_cache_create("tcp_notsack_blk_cache", 3725 sizeof (notsack_blk_t), 0, NULL, NULL, NULL, NULL, NULL, 0); 3726 3727 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 3728 3729 /* Initialize the random number generator */ 3730 tcp_random_init(); 3731 3732 /* A single callback independently of how many netstacks we have */ 3733 ip_squeue_init(tcp_squeue_add); 3734 3735 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics); 3736 3737 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput); 3738 3739 /* 3740 * We want to be informed each time a stack is created or 3741 * destroyed in the kernel, so we can maintain the 3742 * set of tcp_stack_t's. 3743 */ 3744 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini); 3745 } 3746 3747 3748 #define INET_NAME "ip" 3749 3750 /* 3751 * Initialize the TCP stack instance. 3752 */ 3753 static void * 3754 tcp_stack_init(netstackid_t stackid, netstack_t *ns) 3755 { 3756 tcp_stack_t *tcps; 3757 int i; 3758 int error = 0; 3759 major_t major; 3760 size_t arrsz; 3761 3762 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP); 3763 tcps->tcps_netstack = ns; 3764 3765 /* Initialize locks */ 3766 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 3767 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 3768 3769 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 3770 tcps->tcps_g_epriv_ports[0] = ULP_DEF_EPRIV_PORT1; 3771 tcps->tcps_g_epriv_ports[1] = ULP_DEF_EPRIV_PORT2; 3772 tcps->tcps_min_anonpriv_port = 512; 3773 3774 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) * 3775 TCP_BIND_FANOUT_SIZE, KM_SLEEP); 3776 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) * 3777 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP); 3778 3779 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 3780 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL, 3781 MUTEX_DEFAULT, NULL); 3782 } 3783 3784 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 3785 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL, 3786 MUTEX_DEFAULT, NULL); 3787 } 3788 3789 /* TCP's IPsec code calls the packet dropper. */ 3790 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement"); 3791 3792 arrsz = tcp_propinfo_count * sizeof (mod_prop_info_t); 3793 tcps->tcps_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, 3794 KM_SLEEP); 3795 bcopy(tcp_propinfo_tbl, tcps->tcps_propinfo_tbl, arrsz); 3796 3797 /* 3798 * Note: To really walk the device tree you need the devinfo 3799 * pointer to your device which is only available after probe/attach. 3800 * The following is safe only because it uses ddi_root_node() 3801 */ 3802 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 3803 tcp_opt_obj.odb_opt_arr_cnt); 3804 3805 /* 3806 * Initialize RFC 1948 secret values. This will probably be reset once 3807 * by the boot scripts. 3808 * 3809 * Use NULL name, as the name is caught by the new lockstats. 3810 * 3811 * Initialize with some random, non-guessable string, like the global 3812 * T_INFO_ACK. 3813 */ 3814 3815 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 3816 sizeof (tcp_g_t_info_ack), tcps); 3817 3818 tcps->tcps_kstat = tcp_kstat2_init(stackid); 3819 tcps->tcps_mibkp = tcp_kstat_init(stackid); 3820 3821 major = mod_name_to_major(INET_NAME); 3822 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident); 3823 ASSERT(error == 0); 3824 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL); 3825 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL); 3826 cv_init(&tcps->tcps_ixa_cleanup_ready_cv, NULL, CV_DEFAULT, NULL); 3827 cv_init(&tcps->tcps_ixa_cleanup_done_cv, NULL, CV_DEFAULT, NULL); 3828 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL); 3829 3830 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL); 3831 tcps->tcps_reclaim = B_FALSE; 3832 tcps->tcps_reclaim_tid = 0; 3833 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max; 3834 3835 /* 3836 * ncpus is the current number of CPUs, which can be bigger than 3837 * boot_ncpus. But we don't want to use ncpus to allocate all the 3838 * tcp_stats_cpu_t at system boot up time since it will be 1. While 3839 * we handle adding CPU in tcp_cpu_update(), it will be slow if 3840 * there are many CPUs as we will be adding them 1 by 1. 3841 * 3842 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers 3843 * are not freed until the stack is going away. So there is no need 3844 * to grab a lock to access the per CPU tcps_sc[x] pointer. 3845 */ 3846 mutex_enter(&cpu_lock); 3847 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus); 3848 mutex_exit(&cpu_lock); 3849 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *), 3850 KM_SLEEP); 3851 for (i = 0; i < tcps->tcps_sc_cnt; i++) { 3852 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t), 3853 KM_SLEEP); 3854 } 3855 3856 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL); 3857 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t), 3858 offsetof(tcp_listener_t, tl_link)); 3859 3860 tcps->tcps_default_cc_algo = cc_load_algo(CC_DEFAULT_ALGO_NAME); 3861 VERIFY3P(tcps->tcps_default_cc_algo, !=, NULL); 3862 3863 return (tcps); 3864 } 3865 3866 /* 3867 * Called when the IP module is about to be unloaded. 3868 */ 3869 void 3870 tcp_ddi_g_destroy(void) 3871 { 3872 tcp_g_kstat_fini(tcp_g_kstat); 3873 tcp_g_kstat = NULL; 3874 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics)); 3875 3876 mutex_destroy(&tcp_random_lock); 3877 3878 kmem_cache_destroy(tcp_timercache); 3879 kmem_cache_destroy(tcp_notsack_blk_cache); 3880 3881 netstack_unregister(NS_TCP); 3882 } 3883 3884 /* 3885 * Free the TCP stack instance. 3886 */ 3887 static void 3888 tcp_stack_fini(netstackid_t stackid, void *arg) 3889 { 3890 tcp_stack_t *tcps = (tcp_stack_t *)arg; 3891 int i; 3892 3893 freeb(tcps->tcps_ixa_cleanup_mp); 3894 tcps->tcps_ixa_cleanup_mp = NULL; 3895 cv_destroy(&tcps->tcps_ixa_cleanup_ready_cv); 3896 cv_destroy(&tcps->tcps_ixa_cleanup_done_cv); 3897 mutex_destroy(&tcps->tcps_ixa_cleanup_lock); 3898 3899 /* 3900 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart 3901 * the timer. 3902 */ 3903 mutex_enter(&tcps->tcps_reclaim_lock); 3904 tcps->tcps_reclaim = B_FALSE; 3905 mutex_exit(&tcps->tcps_reclaim_lock); 3906 if (tcps->tcps_reclaim_tid != 0) 3907 (void) untimeout(tcps->tcps_reclaim_tid); 3908 mutex_destroy(&tcps->tcps_reclaim_lock); 3909 3910 tcp_listener_conf_cleanup(tcps); 3911 3912 for (i = 0; i < tcps->tcps_sc_cnt; i++) 3913 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t)); 3914 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *)); 3915 3916 kmem_free(tcps->tcps_propinfo_tbl, 3917 tcp_propinfo_count * sizeof (mod_prop_info_t)); 3918 tcps->tcps_propinfo_tbl = NULL; 3919 3920 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 3921 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL); 3922 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock); 3923 } 3924 3925 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 3926 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL); 3927 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock); 3928 } 3929 3930 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE); 3931 tcps->tcps_bind_fanout = NULL; 3932 3933 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) * 3934 TCP_ACCEPTOR_FANOUT_SIZE); 3935 tcps->tcps_acceptor_fanout = NULL; 3936 3937 mutex_destroy(&tcps->tcps_iss_key_lock); 3938 mutex_destroy(&tcps->tcps_epriv_port_lock); 3939 3940 ip_drop_unregister(&tcps->tcps_dropper); 3941 3942 tcp_kstat2_fini(stackid, tcps->tcps_kstat); 3943 tcps->tcps_kstat = NULL; 3944 3945 tcp_kstat_fini(stackid, tcps->tcps_mibkp); 3946 tcps->tcps_mibkp = NULL; 3947 3948 ldi_ident_release(tcps->tcps_ldi_ident); 3949 kmem_free(tcps, sizeof (*tcps)); 3950 } 3951 3952 /* 3953 * Generate ISS, taking into account NDD changes may happen halfway through. 3954 * (If the iss is not zero, set it.) 3955 */ 3956 3957 static void 3958 tcp_iss_init(tcp_t *tcp) 3959 { 3960 MD5_CTX context; 3961 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 3962 uint32_t answer[4]; 3963 tcp_stack_t *tcps = tcp->tcp_tcps; 3964 conn_t *connp = tcp->tcp_connp; 3965 3966 tcps->tcps_iss_incr_extra += (tcps->tcps_iss_incr >> 1); 3967 tcp->tcp_iss = tcps->tcps_iss_incr_extra; 3968 switch (tcps->tcps_strong_iss) { 3969 case 2: 3970 mutex_enter(&tcps->tcps_iss_key_lock); 3971 context = tcps->tcps_iss_key; 3972 mutex_exit(&tcps->tcps_iss_key_lock); 3973 arg.ports = connp->conn_ports; 3974 arg.src = connp->conn_laddr_v6; 3975 arg.dst = connp->conn_faddr_v6; 3976 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 3977 MD5Final((uchar_t *)answer, &context); 3978 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 3979 /* 3980 * Now that we've hashed into a unique per-connection sequence 3981 * space, add a random increment per strong_iss == 1. So I 3982 * guess we'll have to... 3983 */ 3984 /* FALLTHRU */ 3985 case 1: 3986 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 3987 break; 3988 default: 3989 tcp->tcp_iss += (uint32_t)gethrestime_sec() * 3990 tcps->tcps_iss_incr; 3991 break; 3992 } 3993 tcp->tcp_valid_bits = TCP_ISS_VALID; 3994 tcp->tcp_fss = tcp->tcp_iss - 1; 3995 tcp->tcp_suna = tcp->tcp_iss; 3996 tcp->tcp_snxt = tcp->tcp_iss + 1; 3997 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 3998 tcp->tcp_csuna = tcp->tcp_snxt; 3999 } 4000 4001 /* 4002 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 4003 * on the specified backing STREAMS q. Note, the caller may make the 4004 * decision to call based on the tcp_t.tcp_flow_stopped value which 4005 * when check outside the q's lock is only an advisory check ... 4006 */ 4007 void 4008 tcp_setqfull(tcp_t *tcp) 4009 { 4010 tcp_stack_t *tcps = tcp->tcp_tcps; 4011 conn_t *connp = tcp->tcp_connp; 4012 4013 if (tcp->tcp_closed) 4014 return; 4015 4016 conn_setqfull(connp, &tcp->tcp_flow_stopped); 4017 if (tcp->tcp_flow_stopped) 4018 TCP_STAT(tcps, tcp_flwctl_on); 4019 } 4020 4021 void 4022 tcp_clrqfull(tcp_t *tcp) 4023 { 4024 conn_t *connp = tcp->tcp_connp; 4025 4026 if (tcp->tcp_closed) 4027 return; 4028 conn_clrqfull(connp, &tcp->tcp_flow_stopped); 4029 } 4030 4031 static int 4032 tcp_squeue_switch(int val) 4033 { 4034 int rval = SQ_FILL; 4035 4036 switch (val) { 4037 case 1: 4038 rval = SQ_NODRAIN; 4039 break; 4040 case 2: 4041 rval = SQ_PROCESS; 4042 break; 4043 default: 4044 break; 4045 } 4046 return (rval); 4047 } 4048 4049 /* 4050 * This is called once for each squeue - globally for all stack 4051 * instances. 4052 */ 4053 static void 4054 tcp_squeue_add(squeue_t *sqp) 4055 { 4056 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 4057 sizeof (tcp_squeue_priv_t), KM_SLEEP); 4058 4059 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 4060 if (tcp_free_list_max_cnt == 0) { 4061 int tcp_ncpus = ((boot_max_ncpus == -1) ? 4062 max_ncpus : boot_max_ncpus); 4063 4064 /* 4065 * Limit number of entries to 1% of availble memory / tcp_ncpus 4066 */ 4067 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 4068 (tcp_ncpus * sizeof (tcp_t) * 100); 4069 } 4070 tcp_time_wait->tcp_free_list_cnt = 0; 4071 } 4072 /* 4073 * Return unix error is tli error is TSYSERR, otherwise return a negative 4074 * tli error. 4075 */ 4076 int 4077 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 4078 boolean_t bind_to_req_port_only) 4079 { 4080 int error; 4081 tcp_t *tcp = connp->conn_tcp; 4082 4083 if (tcp->tcp_state >= TCPS_BOUND) { 4084 if (connp->conn_debug) { 4085 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4086 "tcp_bind: bad state, %d", tcp->tcp_state); 4087 } 4088 return (-TOUTSTATE); 4089 } 4090 4091 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only); 4092 if (error != 0) 4093 return (error); 4094 4095 ASSERT(tcp->tcp_state == TCPS_BOUND); 4096 tcp->tcp_conn_req_max = 0; 4097 return (0); 4098 } 4099 4100 /* 4101 * If the return value from this function is positive, it's a UNIX error. 4102 * Otherwise, if it's negative, then the absolute value is a TLI error. 4103 * the TPI routine tcp_tpi_connect() is a wrapper function for this. 4104 */ 4105 int 4106 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 4107 cred_t *cr, pid_t pid) 4108 { 4109 tcp_t *tcp = connp->conn_tcp; 4110 sin_t *sin = (sin_t *)sa; 4111 sin6_t *sin6 = (sin6_t *)sa; 4112 ipaddr_t *dstaddrp; 4113 in_port_t dstport; 4114 uint_t srcid; 4115 int error; 4116 uint32_t mss; 4117 mblk_t *syn_mp; 4118 tcp_stack_t *tcps = tcp->tcp_tcps; 4119 int32_t oldstate; 4120 ip_xmit_attr_t *ixa = connp->conn_ixa; 4121 4122 oldstate = tcp->tcp_state; 4123 4124 switch (len) { 4125 default: 4126 /* 4127 * Should never happen 4128 */ 4129 return (EINVAL); 4130 4131 case sizeof (sin_t): 4132 sin = (sin_t *)sa; 4133 if (sin->sin_port == 0) { 4134 return (-TBADADDR); 4135 } 4136 if (connp->conn_ipv6_v6only) { 4137 return (EAFNOSUPPORT); 4138 } 4139 break; 4140 4141 case sizeof (sin6_t): 4142 sin6 = (sin6_t *)sa; 4143 if (sin6->sin6_port == 0) { 4144 return (-TBADADDR); 4145 } 4146 break; 4147 } 4148 /* 4149 * If we're connecting to an IPv4-mapped IPv6 address, we need to 4150 * make sure that the conn_ipversion is IPV4_VERSION. We 4151 * need to this before we call tcp_bindi() so that the port lookup 4152 * code will look for ports in the correct port space (IPv4 and 4153 * IPv6 have separate port spaces). 4154 */ 4155 if (connp->conn_family == AF_INET6 && 4156 connp->conn_ipversion == IPV6_VERSION && 4157 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4158 if (connp->conn_ipv6_v6only) 4159 return (EADDRNOTAVAIL); 4160 4161 connp->conn_ipversion = IPV4_VERSION; 4162 } 4163 4164 switch (tcp->tcp_state) { 4165 case TCPS_LISTEN: 4166 /* 4167 * Listening sockets are not allowed to issue connect(). 4168 */ 4169 if (IPCL_IS_NONSTR(connp)) 4170 return (EOPNOTSUPP); 4171 /* FALLTHRU */ 4172 case TCPS_IDLE: 4173 /* 4174 * We support quick connect, refer to comments in 4175 * tcp_connect_*() 4176 */ 4177 /* FALLTHRU */ 4178 case TCPS_BOUND: 4179 break; 4180 default: 4181 return (-TOUTSTATE); 4182 } 4183 4184 /* 4185 * We update our cred/cpid based on the caller of connect 4186 */ 4187 if (connp->conn_cred != cr) { 4188 crhold(cr); 4189 crfree(connp->conn_cred); 4190 connp->conn_cred = cr; 4191 } 4192 connp->conn_cpid = pid; 4193 4194 /* Cache things in the ixa without any refhold */ 4195 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4196 ixa->ixa_cred = cr; 4197 ixa->ixa_cpid = pid; 4198 if (is_system_labeled()) { 4199 /* We need to restart with a label based on the cred */ 4200 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4201 } 4202 4203 if (connp->conn_family == AF_INET6) { 4204 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4205 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr, 4206 sin6->sin6_port, sin6->sin6_flowinfo, 4207 sin6->__sin6_src_id, sin6->sin6_scope_id); 4208 } else { 4209 /* 4210 * Destination adress is mapped IPv6 address. 4211 * Source bound address should be unspecified or 4212 * IPv6 mapped address as well. 4213 */ 4214 if (!IN6_IS_ADDR_UNSPECIFIED( 4215 &connp->conn_bound_addr_v6) && 4216 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) { 4217 return (EADDRNOTAVAIL); 4218 } 4219 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 4220 dstport = sin6->sin6_port; 4221 srcid = sin6->__sin6_src_id; 4222 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, 4223 srcid); 4224 } 4225 } else { 4226 dstaddrp = &sin->sin_addr.s_addr; 4227 dstport = sin->sin_port; 4228 srcid = 0; 4229 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid); 4230 } 4231 4232 if (error != 0) 4233 goto connect_failed; 4234 4235 CL_INET_CONNECT(connp, B_TRUE, error); 4236 if (error != 0) 4237 goto connect_failed; 4238 4239 /* connect succeeded */ 4240 TCPS_BUMP_MIB(tcps, tcpActiveOpens); 4241 tcp->tcp_active_open = 1; 4242 4243 /* 4244 * tcp_set_destination() does not adjust for TCP/IP header length. 4245 */ 4246 mss = tcp->tcp_mss - connp->conn_ht_iphc_len; 4247 4248 /* 4249 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up 4250 * to the nearest MSS. 4251 * 4252 * We do the round up here because we need to get the interface MTU 4253 * first before we can do the round up. 4254 */ 4255 tcp->tcp_rwnd = connp->conn_rcvbuf; 4256 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 4257 tcps->tcps_recv_hiwat_minmss * mss); 4258 connp->conn_rcvbuf = tcp->tcp_rwnd; 4259 tcp_set_ws_value(tcp); 4260 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 4261 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) 4262 tcp->tcp_snd_ws_ok = B_TRUE; 4263 4264 /* 4265 * Set tcp_snd_ts_ok to true 4266 * so that tcp_xmit_mp will 4267 * include the timestamp 4268 * option in the SYN segment. 4269 */ 4270 if (tcps->tcps_tstamp_always || 4271 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { 4272 tcp->tcp_snd_ts_ok = B_TRUE; 4273 } 4274 4275 /* 4276 * Note that tcp_snd_sack_ok can be set in tcp_set_destination() if 4277 * the SACK metric is set. So here we just check the per stack SACK 4278 * permitted param. 4279 */ 4280 if (tcps->tcps_sack_permitted == 2) { 4281 ASSERT(tcp->tcp_num_sack_blk == 0); 4282 ASSERT(tcp->tcp_notsack_list == NULL); 4283 tcp->tcp_snd_sack_ok = B_TRUE; 4284 } 4285 4286 /* 4287 * Should we use ECN? Note that the current 4288 * default value (SunOS 5.9) of tcp_ecn_permitted 4289 * is 1. The reason for doing this is that there 4290 * are equipments out there that will drop ECN 4291 * enabled IP packets. Setting it to 1 avoids 4292 * compatibility problems. 4293 */ 4294 if (tcps->tcps_ecn_permitted == 2) 4295 tcp->tcp_ecn_ok = B_TRUE; 4296 4297 /* Trace change from BOUND -> SYN_SENT here */ 4298 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4299 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 4300 int32_t, TCPS_BOUND); 4301 4302 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4303 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 4304 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 4305 if (syn_mp != NULL) { 4306 /* 4307 * We must bump the generation before sending the syn 4308 * to ensure that we use the right generation in case 4309 * this thread issues a "connected" up call. 4310 */ 4311 SOCK_CONNID_BUMP(tcp->tcp_connid); 4312 /* 4313 * DTrace sending the first SYN as a 4314 * tcp:::connect-request event. 4315 */ 4316 DTRACE_TCP5(connect__request, mblk_t *, NULL, 4317 ip_xmit_attr_t *, connp->conn_ixa, 4318 void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp, 4319 tcph_t *, 4320 &syn_mp->b_rptr[connp->conn_ixa->ixa_ip_hdr_length]); 4321 tcp_send_data(tcp, syn_mp); 4322 } 4323 4324 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4325 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4326 return (0); 4327 4328 connect_failed: 4329 connp->conn_faddr_v6 = ipv6_all_zeros; 4330 connp->conn_fport = 0; 4331 tcp->tcp_state = oldstate; 4332 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4333 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4334 return (error); 4335 } 4336 4337 int 4338 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len, 4339 int backlog, cred_t *cr, boolean_t bind_to_req_port_only) 4340 { 4341 tcp_t *tcp = connp->conn_tcp; 4342 int error = 0; 4343 tcp_stack_t *tcps = tcp->tcp_tcps; 4344 int32_t oldstate; 4345 4346 /* All Solaris components should pass a cred for this operation. */ 4347 ASSERT(cr != NULL); 4348 4349 if (tcp->tcp_state >= TCPS_BOUND) { 4350 if ((tcp->tcp_state == TCPS_BOUND || 4351 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) { 4352 /* 4353 * Handle listen() increasing backlog. 4354 * This is more "liberal" then what the TPI spec 4355 * requires but is needed to avoid a t_unbind 4356 * when handling listen() since the port number 4357 * might be "stolen" between the unbind and bind. 4358 */ 4359 goto do_listen; 4360 } 4361 if (connp->conn_debug) { 4362 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4363 "tcp_listen: bad state, %d", tcp->tcp_state); 4364 } 4365 return (-TOUTSTATE); 4366 } else { 4367 sin6_t addr; 4368 sin_t *sin; 4369 sin6_t *sin6; 4370 4371 if (sa == NULL) { 4372 ASSERT(IPCL_IS_NONSTR(connp)); 4373 /* Do an implicit bind: Request for a generic port. */ 4374 if (connp->conn_family == AF_INET) { 4375 len = sizeof (sin_t); 4376 sin = (sin_t *)&addr; 4377 *sin = sin_null; 4378 sin->sin_family = AF_INET; 4379 } else { 4380 ASSERT(connp->conn_family == AF_INET6); 4381 len = sizeof (sin6_t); 4382 sin6 = (sin6_t *)&addr; 4383 *sin6 = sin6_null; 4384 sin6->sin6_family = AF_INET6; 4385 } 4386 sa = (struct sockaddr *)&addr; 4387 } 4388 4389 error = tcp_bind_check(connp, sa, len, cr, 4390 bind_to_req_port_only); 4391 if (error) 4392 return (error); 4393 /* Fall through and do the fanout insertion */ 4394 } 4395 4396 do_listen: 4397 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN); 4398 tcp->tcp_conn_req_max = backlog; 4399 if (tcp->tcp_conn_req_max) { 4400 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) 4401 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; 4402 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) 4403 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; 4404 /* 4405 * If this is a listener, do not reset the eager list 4406 * and other stuffs. Note that we don't check if the 4407 * existing eager list meets the new tcp_conn_req_max 4408 * requirement. 4409 */ 4410 if (tcp->tcp_state != TCPS_LISTEN) { 4411 tcp->tcp_state = TCPS_LISTEN; 4412 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4413 connp->conn_ixa, void, NULL, tcp_t *, tcp, 4414 void, NULL, int32_t, TCPS_BOUND); 4415 /* Initialize the chain. Don't need the eager_lock */ 4416 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 4417 tcp->tcp_eager_next_drop_q0 = tcp; 4418 tcp->tcp_eager_prev_drop_q0 = tcp; 4419 tcp->tcp_second_ctimer_threshold = 4420 tcps->tcps_ip_abort_linterval; 4421 } 4422 } 4423 4424 /* 4425 * We need to make sure that the conn_recv is set to a non-null 4426 * value before we insert the conn into the classifier table. 4427 * This is to avoid a race with an incoming packet which does an 4428 * ipcl_classify(). 4429 * We initially set it to tcp_input_listener_unbound to try to 4430 * pick a good squeue for the listener when the first SYN arrives. 4431 * tcp_input_listener_unbound sets it to tcp_input_listener on that 4432 * first SYN. 4433 */ 4434 connp->conn_recv = tcp_input_listener_unbound; 4435 4436 /* Insert the listener in the classifier table */ 4437 error = ip_laddr_fanout_insert(connp); 4438 if (error != 0) { 4439 /* Undo the bind - release the port number */ 4440 oldstate = tcp->tcp_state; 4441 tcp->tcp_state = TCPS_IDLE; 4442 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4443 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 4444 int32_t, oldstate); 4445 connp->conn_bound_addr_v6 = ipv6_all_zeros; 4446 4447 connp->conn_laddr_v6 = ipv6_all_zeros; 4448 connp->conn_saddr_v6 = ipv6_all_zeros; 4449 connp->conn_ports = 0; 4450 4451 if (connp->conn_anon_port) { 4452 zone_t *zone; 4453 4454 zone = crgetzone(cr); 4455 connp->conn_anon_port = B_FALSE; 4456 (void) tsol_mlp_anon(zone, connp->conn_mlp_type, 4457 connp->conn_proto, connp->conn_lport, B_FALSE); 4458 } 4459 connp->conn_mlp_type = mlptSingle; 4460 4461 tcp_bind_hash_remove(tcp); 4462 return (error); 4463 } else { 4464 /* 4465 * If there is a connection limit, allocate and initialize 4466 * the counter struct. Note that since listen can be called 4467 * multiple times, the struct may have been allready allocated. 4468 */ 4469 if (!list_is_empty(&tcps->tcps_listener_conf) && 4470 tcp->tcp_listen_cnt == NULL) { 4471 tcp_listen_cnt_t *tlc; 4472 uint32_t ratio; 4473 4474 ratio = tcp_find_listener_conf(tcps, 4475 ntohs(connp->conn_lport)); 4476 if (ratio != 0) { 4477 uint32_t mem_ratio, tot_buf; 4478 4479 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t), 4480 KM_SLEEP); 4481 /* 4482 * Calculate the connection limit based on 4483 * the configured ratio and maxusers. Maxusers 4484 * are calculated based on memory size, 4485 * ~ 1 user per MB. Note that the conn_rcvbuf 4486 * and conn_sndbuf may change after a 4487 * connection is accepted. So what we have 4488 * is only an approximation. 4489 */ 4490 if ((tot_buf = connp->conn_rcvbuf + 4491 connp->conn_sndbuf) < MB) { 4492 mem_ratio = MB / tot_buf; 4493 tlc->tlc_max = maxusers / ratio * 4494 mem_ratio; 4495 } else { 4496 mem_ratio = tot_buf / MB; 4497 tlc->tlc_max = maxusers / ratio / 4498 mem_ratio; 4499 } 4500 /* At least we should allow two connections! */ 4501 if (tlc->tlc_max <= tcp_min_conn_listener) 4502 tlc->tlc_max = tcp_min_conn_listener; 4503 tlc->tlc_cnt = 1; 4504 tlc->tlc_drop = 0; 4505 tcp->tcp_listen_cnt = tlc; 4506 } 4507 } 4508 } 4509 return (error); 4510 } 4511