1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2009 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #include <sys/types.h> 29 #include <sys/stream.h> 30 #include <sys/strsun.h> 31 #include <sys/strsubr.h> 32 #include <sys/stropts.h> 33 #include <sys/strlog.h> 34 #define _SUN_TPI_VERSION 2 35 #include <sys/tihdr.h> 36 #include <sys/timod.h> 37 #include <sys/ddi.h> 38 #include <sys/sunddi.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/cmn_err.h> 42 #include <sys/debug.h> 43 #include <sys/sdt.h> 44 #include <sys/vtrace.h> 45 #include <sys/kmem.h> 46 #include <sys/ethernet.h> 47 #include <sys/cpuvar.h> 48 #include <sys/dlpi.h> 49 #include <sys/pattr.h> 50 #include <sys/policy.h> 51 #include <sys/priv.h> 52 #include <sys/zone.h> 53 #include <sys/sunldi.h> 54 55 #include <sys/errno.h> 56 #include <sys/signal.h> 57 #include <sys/socket.h> 58 #include <sys/socketvar.h> 59 #include <sys/sockio.h> 60 #include <sys/isa_defs.h> 61 #include <sys/md5.h> 62 #include <sys/random.h> 63 #include <sys/uio.h> 64 #include <sys/systm.h> 65 #include <netinet/in.h> 66 #include <netinet/tcp.h> 67 #include <netinet/ip6.h> 68 #include <netinet/icmp6.h> 69 #include <net/if.h> 70 #include <net/route.h> 71 #include <inet/ipsec_impl.h> 72 73 #include <inet/common.h> 74 #include <inet/ip.h> 75 #include <inet/ip_impl.h> 76 #include <inet/ip6.h> 77 #include <inet/ip_ndp.h> 78 #include <inet/proto_set.h> 79 #include <inet/mib2.h> 80 #include <inet/nd.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <inet/tcp_impl.h> 86 #include <inet/udp_impl.h> 87 #include <net/pfkeyv2.h> 88 #include <inet/ipdrop.h> 89 90 #include <inet/ipclassifier.h> 91 #include <inet/ip_ire.h> 92 #include <inet/ip_ftable.h> 93 #include <inet/ip_if.h> 94 #include <inet/ipp_common.h> 95 #include <inet/ip_rts.h> 96 #include <inet/ip_netinfo.h> 97 #include <sys/squeue_impl.h> 98 #include <sys/squeue.h> 99 #include <inet/kssl/ksslapi.h> 100 #include <sys/tsol/label.h> 101 #include <sys/tsol/tnet.h> 102 #include <rpc/pmap_prot.h> 103 #include <sys/callo.h> 104 105 #include <sys/clock_impl.h> 106 107 /* 108 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 109 * 110 * (Read the detailed design doc in PSARC case directory) 111 * 112 * The entire tcp state is contained in tcp_t and conn_t structure 113 * which are allocated in tandem using ipcl_conn_create() and passing 114 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect 115 * the references on the tcp_t. The tcp_t structure is never compressed 116 * and packets always land on the correct TCP perimeter from the time 117 * eager is created till the time tcp_t dies (as such the old mentat 118 * TCP global queue is not used for detached state and no IPSEC checking 119 * is required). The global queue is still allocated to send out resets 120 * for connection which have no listeners and IP directly calls 121 * tcp_xmit_listeners_reset() which does any policy check. 122 * 123 * Protection and Synchronisation mechanism: 124 * 125 * The tcp data structure does not use any kind of lock for protecting 126 * its state but instead uses 'squeues' for mutual exclusion from various 127 * read and write side threads. To access a tcp member, the thread should 128 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS, 129 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller 130 * can pass any tcp function having prototype of edesc_t as argument 131 * (different from traditional STREAMs model where packets come in only 132 * designated entry points). The list of functions that can be directly 133 * called via squeue are listed before the usual function prototype. 134 * 135 * Referencing: 136 * 137 * TCP is MT-Hot and we use a reference based scheme to make sure that the 138 * tcp structure doesn't disappear when its needed. When the application 139 * creates an outgoing connection or accepts an incoming connection, we 140 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 141 * The IP reference is just a symbolic reference since ip_tcpclose() 142 * looks at tcp structure after tcp_close_output() returns which could 143 * have dropped the last TCP reference. So as long as the connection is 144 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 145 * conn_t. The classifier puts its own reference when the connection is 146 * inserted in listen or connected hash. Anytime a thread needs to enter 147 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 148 * on write side or by doing a classify on read side and then puts a 149 * reference on the conn before doing squeue_enter/tryenter/fill. For 150 * read side, the classifier itself puts the reference under fanout lock 151 * to make sure that tcp can't disappear before it gets processed. The 152 * squeue will drop this reference automatically so the called function 153 * doesn't have to do a DEC_REF. 154 * 155 * Opening a new connection: 156 * 157 * The outgoing connection open is pretty simple. tcp_open() does the 158 * work in creating the conn/tcp structure and initializing it. The 159 * squeue assignment is done based on the CPU the application 160 * is running on. So for outbound connections, processing is always done 161 * on application CPU which might be different from the incoming CPU 162 * being interrupted by the NIC. An optimal way would be to figure out 163 * the NIC <-> CPU binding at listen time, and assign the outgoing 164 * connection to the squeue attached to the CPU that will be interrupted 165 * for incoming packets (we know the NIC based on the bind IP address). 166 * This might seem like a problem if more data is going out but the 167 * fact is that in most cases the transmit is ACK driven transmit where 168 * the outgoing data normally sits on TCP's xmit queue waiting to be 169 * transmitted. 170 * 171 * Accepting a connection: 172 * 173 * This is a more interesting case because of various races involved in 174 * establishing a eager in its own perimeter. Read the meta comment on 175 * top of tcp_input_listener(). But briefly, the squeue is picked by 176 * ip_fanout based on the ring or the sender (if loopback). 177 * 178 * Closing a connection: 179 * 180 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 181 * via squeue to do the close and mark the tcp as detached if the connection 182 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 183 * reference but tcp_close() drop IP's reference always. So if tcp was 184 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 185 * and 1 because it is in classifier's connected hash. This is the condition 186 * we use to determine that its OK to clean up the tcp outside of squeue 187 * when time wait expires (check the ref under fanout and conn_lock and 188 * if it is 2, remove it from fanout hash and kill it). 189 * 190 * Although close just drops the necessary references and marks the 191 * tcp_detached state, tcp_close needs to know the tcp_detached has been 192 * set (under squeue) before letting the STREAM go away (because a 193 * inbound packet might attempt to go up the STREAM while the close 194 * has happened and tcp_detached is not set). So a special lock and 195 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 196 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 197 * tcp_detached. 198 * 199 * Special provisions and fast paths: 200 * 201 * We make special provisions for sockfs by marking tcp_issocket 202 * whenever we have only sockfs on top of TCP. This allows us to skip 203 * putting the tcp in acceptor hash since a sockfs listener can never 204 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 205 * since eager has already been allocated and the accept now happens 206 * on acceptor STREAM. There is a big blob of comment on top of 207 * tcp_input_listener explaining the new accept. When socket is POP'd, 208 * sockfs sends us an ioctl to mark the fact and we go back to old 209 * behaviour. Once tcp_issocket is unset, its never set for the 210 * life of that connection. 211 * 212 * IPsec notes : 213 * 214 * Since a packet is always executed on the correct TCP perimeter 215 * all IPsec processing is defered to IP including checking new 216 * connections and setting IPSEC policies for new connection. The 217 * only exception is tcp_xmit_listeners_reset() which is called 218 * directly from IP and needs to policy check to see if TH_RST 219 * can be sent out. 220 */ 221 222 /* 223 * Values for squeue switch: 224 * 1: SQ_NODRAIN 225 * 2: SQ_PROCESS 226 * 3: SQ_FILL 227 */ 228 int tcp_squeue_wput = 2; /* /etc/systems */ 229 int tcp_squeue_flag; 230 231 /* 232 * This controls how tiny a write must be before we try to copy it 233 * into the mblk on the tail of the transmit queue. Not much 234 * speedup is observed for values larger than sixteen. Zero will 235 * disable the optimisation. 236 */ 237 int tcp_tx_pull_len = 16; 238 239 /* 240 * TCP Statistics. 241 * 242 * How TCP statistics work. 243 * 244 * There are two types of statistics invoked by two macros. 245 * 246 * TCP_STAT(name) does non-atomic increment of a named stat counter. It is 247 * supposed to be used in non MT-hot paths of the code. 248 * 249 * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is 250 * supposed to be used for DEBUG purposes and may be used on a hot path. 251 * 252 * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat 253 * (use "kstat tcp" to get them). 254 * 255 * There is also additional debugging facility that marks tcp_clean_death() 256 * instances and saves them in tcp_t structure. It is triggered by 257 * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for 258 * tcp_clean_death() calls that counts the number of times each tag was hit. It 259 * is triggered by TCP_CLD_COUNTERS define. 260 * 261 * How to add new counters. 262 * 263 * 1) Add a field in the tcp_stat structure describing your counter. 264 * 2) Add a line in the template in tcp_kstat2_init() with the name 265 * of the counter. 266 * 267 * IMPORTANT!! - make sure that both are in sync !! 268 * 3) Use either TCP_STAT or TCP_DBGSTAT with the name. 269 * 270 * Please avoid using private counters which are not kstat-exported. 271 * 272 * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances 273 * in tcp_t structure. 274 * 275 * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags. 276 */ 277 278 #ifndef TCP_DEBUG_COUNTER 279 #ifdef DEBUG 280 #define TCP_DEBUG_COUNTER 1 281 #else 282 #define TCP_DEBUG_COUNTER 0 283 #endif 284 #endif 285 286 #define TCP_CLD_COUNTERS 0 287 288 #define TCP_TAG_CLEAN_DEATH 1 289 #define TCP_MAX_CLEAN_DEATH_TAG 32 290 291 #ifdef lint 292 static int _lint_dummy_; 293 #endif 294 295 #if TCP_CLD_COUNTERS 296 static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG]; 297 #define TCP_CLD_STAT(x) tcp_clean_death_stat[x]++ 298 #elif defined(lint) 299 #define TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0); 300 #else 301 #define TCP_CLD_STAT(x) 302 #endif 303 304 #if TCP_DEBUG_COUNTER 305 #define TCP_DBGSTAT(tcps, x) \ 306 atomic_add_64(&((tcps)->tcps_statistics.x.value.ui64), 1) 307 #define TCP_G_DBGSTAT(x) \ 308 atomic_add_64(&(tcp_g_statistics.x.value.ui64), 1) 309 #elif defined(lint) 310 #define TCP_DBGSTAT(tcps, x) ASSERT(_lint_dummy_ == 0); 311 #define TCP_G_DBGSTAT(x) ASSERT(_lint_dummy_ == 0); 312 #else 313 #define TCP_DBGSTAT(tcps, x) 314 #define TCP_G_DBGSTAT(x) 315 #endif 316 317 #define TCP_G_STAT(x) (tcp_g_statistics.x.value.ui64++) 318 319 tcp_g_stat_t tcp_g_statistics; 320 kstat_t *tcp_g_kstat; 321 322 /* Macros for timestamp comparisons */ 323 #define TSTMP_GEQ(a, b) ((int32_t)((a)-(b)) >= 0) 324 #define TSTMP_LT(a, b) ((int32_t)((a)-(b)) < 0) 325 326 /* 327 * Parameters for TCP Initial Send Sequence number (ISS) generation. When 328 * tcp_strong_iss is set to 1, which is the default, the ISS is calculated 329 * by adding three components: a time component which grows by 1 every 4096 330 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27); 331 * a per-connection component which grows by 125000 for every new connection; 332 * and an "extra" component that grows by a random amount centered 333 * approximately on 64000. This causes the ISS generator to cycle every 334 * 4.89 hours if no TCP connections are made, and faster if connections are 335 * made. 336 * 337 * When tcp_strong_iss is set to 0, ISS is calculated by adding two 338 * components: a time component which grows by 250000 every second; and 339 * a per-connection component which grows by 125000 for every new connections. 340 * 341 * A third method, when tcp_strong_iss is set to 2, for generating ISS is 342 * prescribed by Steve Bellovin. This involves adding time, the 125000 per 343 * connection, and a one-way hash (MD5) of the connection ID <sport, dport, 344 * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered 345 * password. 346 */ 347 #define ISS_INCR 250000 348 #define ISS_NSEC_SHT 12 349 350 static sin_t sin_null; /* Zero address for quick clears */ 351 static sin6_t sin6_null; /* Zero address for quick clears */ 352 353 /* 354 * This implementation follows the 4.3BSD interpretation of the urgent 355 * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause 356 * incompatible changes in protocols like telnet and rlogin. 357 */ 358 #define TCP_OLD_URP_INTERPRETATION 1 359 360 /* 361 * Since tcp_listener is not cleared atomically with tcp_detached 362 * being cleared we need this extra bit to tell a detached connection 363 * apart from one that is in the process of being accepted. 364 */ 365 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 366 (TCP_IS_DETACHED(tcp) && \ 367 (!(tcp)->tcp_hard_binding)) 368 369 /* 370 * TCP reassembly macros. We hide starting and ending sequence numbers in 371 * b_next and b_prev of messages on the reassembly queue. The messages are 372 * chained using b_cont. These macros are used in tcp_reass() so we don't 373 * have to see the ugly casts and assignments. 374 */ 375 #define TCP_REASS_SEQ(mp) ((uint32_t)(uintptr_t)((mp)->b_next)) 376 #define TCP_REASS_SET_SEQ(mp, u) ((mp)->b_next = \ 377 (mblk_t *)(uintptr_t)(u)) 378 #define TCP_REASS_END(mp) ((uint32_t)(uintptr_t)((mp)->b_prev)) 379 #define TCP_REASS_SET_END(mp, u) ((mp)->b_prev = \ 380 (mblk_t *)(uintptr_t)(u)) 381 382 /* 383 * Implementation of TCP Timers. 384 * ============================= 385 * 386 * INTERFACE: 387 * 388 * There are two basic functions dealing with tcp timers: 389 * 390 * timeout_id_t tcp_timeout(connp, func, time) 391 * clock_t tcp_timeout_cancel(connp, timeout_id) 392 * TCP_TIMER_RESTART(tcp, intvl) 393 * 394 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func' 395 * after 'time' ticks passed. The function called by timeout() must adhere to 396 * the same restrictions as a driver soft interrupt handler - it must not sleep 397 * or call other functions that might sleep. The value returned is the opaque 398 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to 399 * cancel the request. The call to tcp_timeout() may fail in which case it 400 * returns zero. This is different from the timeout(9F) function which never 401 * fails. 402 * 403 * The call-back function 'func' always receives 'connp' as its single 404 * argument. It is always executed in the squeue corresponding to the tcp 405 * structure. The tcp structure is guaranteed to be present at the time the 406 * call-back is called. 407 * 408 * NOTE: The call-back function 'func' is never called if tcp is in 409 * the TCPS_CLOSED state. 410 * 411 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout() 412 * request. locks acquired by the call-back routine should not be held across 413 * the call to tcp_timeout_cancel() or a deadlock may result. 414 * 415 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request. 416 * Otherwise, it returns an integer value greater than or equal to 0. In 417 * particular, if the call-back function is already placed on the squeue, it can 418 * not be canceled. 419 * 420 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called 421 * within squeue context corresponding to the tcp instance. Since the 422 * call-back is also called via the same squeue, there are no race 423 * conditions described in untimeout(9F) manual page since all calls are 424 * strictly serialized. 425 * 426 * TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout 427 * stored in tcp_timer_tid and starts a new one using 428 * MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back 429 * and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid 430 * field. 431 * 432 * NOTE: since the timeout cancellation is not guaranteed, the cancelled 433 * call-back may still be called, so it is possible tcp_timer() will be 434 * called several times. This should not be a problem since tcp_timer() 435 * should always check the tcp instance state. 436 * 437 * 438 * IMPLEMENTATION: 439 * 440 * TCP timers are implemented using three-stage process. The call to 441 * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function 442 * when the timer expires. The tcp_timer_callback() arranges the call of the 443 * tcp_timer_handler() function via squeue corresponding to the tcp 444 * instance. The tcp_timer_handler() calls actual requested timeout call-back 445 * and passes tcp instance as an argument to it. Information is passed between 446 * stages using the tcp_timer_t structure which contains the connp pointer, the 447 * tcp call-back to call and the timeout id returned by the timeout(9F). 448 * 449 * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t - 450 * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo 451 * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout() 452 * returns the pointer to this mblk. 453 * 454 * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It 455 * looks like a normal mblk without actual dblk attached to it. 456 * 457 * To optimize performance each tcp instance holds a small cache of timer 458 * mblocks. In the current implementation it caches up to two timer mblocks per 459 * tcp instance. The cache is preserved over tcp frees and is only freed when 460 * the whole tcp structure is destroyed by its kmem destructor. Since all tcp 461 * timer processing happens on a corresponding squeue, the cache manipulation 462 * does not require any locks. Experiments show that majority of timer mblocks 463 * allocations are satisfied from the tcp cache and do not involve kmem calls. 464 * 465 * The tcp_timeout() places a refhold on the connp instance which guarantees 466 * that it will be present at the time the call-back function fires. The 467 * tcp_timer_handler() drops the reference after calling the call-back, so the 468 * call-back function does not need to manipulate the references explicitly. 469 */ 470 471 typedef struct tcp_timer_s { 472 conn_t *connp; 473 void (*tcpt_proc)(void *); 474 callout_id_t tcpt_tid; 475 } tcp_timer_t; 476 477 static kmem_cache_t *tcp_timercache; 478 kmem_cache_t *tcp_sack_info_cache; 479 480 /* 481 * For scalability, we must not run a timer for every TCP connection 482 * in TIME_WAIT state. To see why, consider (for time wait interval of 483 * 4 minutes): 484 * 1000 connections/sec * 240 seconds/time wait = 240,000 active conn's 485 * 486 * This list is ordered by time, so you need only delete from the head 487 * until you get to entries which aren't old enough to delete yet. 488 * The list consists of only the detached TIME_WAIT connections. 489 * 490 * Note that the timer (tcp_time_wait_expire) is started when the tcp_t 491 * becomes detached TIME_WAIT (either by changing the state and already 492 * being detached or the other way around). This means that the TIME_WAIT 493 * state can be extended (up to doubled) if the connection doesn't become 494 * detached for a long time. 495 * 496 * The list manipulations (including tcp_time_wait_next/prev) 497 * are protected by the tcp_time_wait_lock. The content of the 498 * detached TIME_WAIT connections is protected by the normal perimeters. 499 * 500 * This list is per squeue and squeues are shared across the tcp_stack_t's. 501 * Things on tcp_time_wait_head remain associated with the tcp_stack_t 502 * and conn_netstack. 503 * The tcp_t's that are added to tcp_free_list are disassociated and 504 * have NULL tcp_tcps and conn_netstack pointers. 505 */ 506 typedef struct tcp_squeue_priv_s { 507 kmutex_t tcp_time_wait_lock; 508 callout_id_t tcp_time_wait_tid; 509 tcp_t *tcp_time_wait_head; 510 tcp_t *tcp_time_wait_tail; 511 tcp_t *tcp_free_list; 512 uint_t tcp_free_list_cnt; 513 } tcp_squeue_priv_t; 514 515 /* 516 * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs. 517 * Running it every 5 seconds seems to give the best results. 518 */ 519 #define TCP_TIME_WAIT_DELAY drv_usectohz(5000000) 520 521 /* 522 * To prevent memory hog, limit the number of entries in tcp_free_list 523 * to 1% of available memory / number of cpus 524 */ 525 uint_t tcp_free_list_max_cnt = 0; 526 527 #define TCP_XMIT_LOWATER 4096 528 #define TCP_XMIT_HIWATER 49152 529 #define TCP_RECV_LOWATER 2048 530 #define TCP_RECV_HIWATER 128000 531 532 /* 533 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 534 */ 535 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 536 537 #define TIDUSZ 4096 /* transport interface data unit size */ 538 539 /* 540 * Bind hash list size and has function. It has to be a power of 2 for 541 * hashing. 542 */ 543 #define TCP_BIND_FANOUT_SIZE 512 544 #define TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1)) 545 /* 546 * Size of listen and acceptor hash list. It has to be a power of 2 for 547 * hashing. 548 */ 549 #define TCP_FANOUT_SIZE 256 550 551 #ifdef _ILP32 552 #define TCP_ACCEPTOR_HASH(accid) \ 553 (((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1)) 554 #else 555 #define TCP_ACCEPTOR_HASH(accid) \ 556 ((uint_t)(accid) & (TCP_FANOUT_SIZE - 1)) 557 #endif /* _ILP32 */ 558 559 #define IP_ADDR_CACHE_SIZE 2048 560 #define IP_ADDR_CACHE_HASH(faddr) \ 561 (ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1)) 562 563 /* 564 * TCP options struct returned from tcp_parse_options. 565 */ 566 typedef struct tcp_opt_s { 567 uint32_t tcp_opt_mss; 568 uint32_t tcp_opt_wscale; 569 uint32_t tcp_opt_ts_val; 570 uint32_t tcp_opt_ts_ecr; 571 tcp_t *tcp; 572 } tcp_opt_t; 573 574 /* 575 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing 576 */ 577 578 #ifdef _BIG_ENDIAN 579 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 580 (TCPOPT_TSTAMP << 8) | 10) 581 #else 582 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 583 (TCPOPT_NOP << 8) | TCPOPT_NOP) 584 #endif 585 586 /* 587 * Flags returned from tcp_parse_options. 588 */ 589 #define TCP_OPT_MSS_PRESENT 1 590 #define TCP_OPT_WSCALE_PRESENT 2 591 #define TCP_OPT_TSTAMP_PRESENT 4 592 #define TCP_OPT_SACK_OK_PRESENT 8 593 #define TCP_OPT_SACK_PRESENT 16 594 595 /* TCP option length */ 596 #define TCPOPT_NOP_LEN 1 597 #define TCPOPT_MAXSEG_LEN 4 598 #define TCPOPT_WS_LEN 3 599 #define TCPOPT_REAL_WS_LEN (TCPOPT_WS_LEN+1) 600 #define TCPOPT_TSTAMP_LEN 10 601 #define TCPOPT_REAL_TS_LEN (TCPOPT_TSTAMP_LEN+2) 602 #define TCPOPT_SACK_OK_LEN 2 603 #define TCPOPT_REAL_SACK_OK_LEN (TCPOPT_SACK_OK_LEN+2) 604 #define TCPOPT_REAL_SACK_LEN 4 605 #define TCPOPT_MAX_SACK_LEN 36 606 #define TCPOPT_HEADER_LEN 2 607 608 /* TCP cwnd burst factor. */ 609 #define TCP_CWND_INFINITE 65535 610 #define TCP_CWND_SS 3 611 #define TCP_CWND_NORMAL 5 612 613 /* Maximum TCP initial cwin (start/restart). */ 614 #define TCP_MAX_INIT_CWND 8 615 616 /* 617 * Initialize cwnd according to RFC 3390. def_max_init_cwnd is 618 * either tcp_slow_start_initial or tcp_slow_start_after idle 619 * depending on the caller. If the upper layer has not used the 620 * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd 621 * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd. 622 * If the upper layer has changed set the tcp_init_cwnd, just use 623 * it to calculate the tcp_cwnd. 624 */ 625 #define SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd) \ 626 { \ 627 if ((tcp)->tcp_init_cwnd == 0) { \ 628 (tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss), \ 629 MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \ 630 } else { \ 631 (tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss); \ 632 } \ 633 tcp->tcp_cwnd_cnt = 0; \ 634 } 635 636 /* TCP Timer control structure */ 637 typedef struct tcpt_s { 638 pfv_t tcpt_pfv; /* The routine we are to call */ 639 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 640 } tcpt_t; 641 642 /* 643 * Functions called directly via squeue having a prototype of edesc_t. 644 */ 645 void tcp_input_listener(void *arg, mblk_t *mp, void *arg2, 646 ip_recv_attr_t *ira); 647 static void tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2, 648 ip_recv_attr_t *dummy); 649 void tcp_accept_finish(void *arg, mblk_t *mp, void *arg2, 650 ip_recv_attr_t *dummy); 651 static void tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2, 652 ip_recv_attr_t *dummy); 653 static void tcp_wput_proto(void *arg, mblk_t *mp, void *arg2, 654 ip_recv_attr_t *dummy); 655 void tcp_input_data(void *arg, mblk_t *mp, void *arg2, 656 ip_recv_attr_t *ira); 657 static void tcp_close_output(void *arg, mblk_t *mp, void *arg2, 658 ip_recv_attr_t *dummy); 659 void tcp_output(void *arg, mblk_t *mp, void *arg2, 660 ip_recv_attr_t *dummy); 661 void tcp_output_urgent(void *arg, mblk_t *mp, void *arg2, 662 ip_recv_attr_t *dummy); 663 static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, 664 ip_recv_attr_t *dummy); 665 static void tcp_timer_handler(void *arg, mblk_t *mp, void *arg2, 666 ip_recv_attr_t *dummy); 667 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, 668 ip_recv_attr_t *dummy); 669 670 671 /* Prototype for TCP functions */ 672 static void tcp_random_init(void); 673 int tcp_random(void); 674 static void tcp_tli_accept(tcp_t *tcp, mblk_t *mp); 675 static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, 676 tcp_t *eager); 677 static int tcp_set_destination(tcp_t *tcp); 678 static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 679 int reuseaddr, boolean_t quick_connect, boolean_t bind_to_req_port_only, 680 boolean_t user_specified); 681 static void tcp_closei_local(tcp_t *tcp); 682 static void tcp_close_detached(tcp_t *tcp); 683 static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, 684 mblk_t *idmp, mblk_t **defermp, ip_recv_attr_t *ira); 685 static void tcp_tpi_connect(tcp_t *tcp, mblk_t *mp); 686 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, 687 in_port_t dstport, uint_t srcid); 688 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, 689 in_port_t dstport, uint32_t flowinfo, 690 uint_t srcid, uint32_t scope_id); 691 static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag); 692 static void tcp_disconnect(tcp_t *tcp, mblk_t *mp); 693 static char *tcp_display(tcp_t *tcp, char *, char); 694 static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum); 695 static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only); 696 static void tcp_eager_unlink(tcp_t *tcp); 697 static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr, 698 int unixerr); 699 static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 700 int tlierr, int unixerr); 701 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 702 cred_t *cr); 703 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 704 char *value, caddr_t cp, cred_t *cr); 705 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 706 char *value, caddr_t cp, cred_t *cr); 707 static int tcp_tpistate(tcp_t *tcp); 708 static void tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp, 709 int caller_holds_lock); 710 static void tcp_bind_hash_remove(tcp_t *tcp); 711 static tcp_t *tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *); 712 void tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp); 713 static void tcp_acceptor_hash_remove(tcp_t *tcp); 714 static void tcp_capability_req(tcp_t *tcp, mblk_t *mp); 715 static void tcp_info_req(tcp_t *tcp, mblk_t *mp); 716 static void tcp_addr_req(tcp_t *tcp, mblk_t *mp); 717 static void tcp_init_values(tcp_t *tcp); 718 static void tcp_ip_notify(tcp_t *tcp); 719 static void tcp_iss_init(tcp_t *tcp); 720 static void tcp_keepalive_killer(void *arg); 721 static int tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt); 722 static void tcp_mss_set(tcp_t *tcp, uint32_t size); 723 static int tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, 724 int *do_disconnectp, int *t_errorp, int *sys_errorp); 725 static boolean_t tcp_allow_connopt_set(int level, int name); 726 int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr); 727 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 728 static boolean_t tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, 729 tcp_stack_t *); 730 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 731 caddr_t cp, cred_t *cr); 732 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 733 caddr_t cp, cred_t *cr); 734 static void tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *); 735 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 736 caddr_t cp, cred_t *cr); 737 static void tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt); 738 static void tcp_update_xmit_tail(tcp_t *tcp, uint32_t snxt); 739 static mblk_t *tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start); 740 static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp); 741 static void tcp_reinit(tcp_t *tcp); 742 static void tcp_reinit_values(tcp_t *tcp); 743 744 static uint_t tcp_rwnd_reopen(tcp_t *tcp); 745 static uint_t tcp_rcv_drain(tcp_t *tcp); 746 static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags); 747 static boolean_t tcp_send_rst_chk(tcp_stack_t *); 748 static void tcp_ss_rexmit(tcp_t *tcp); 749 static mblk_t *tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp, 750 ip_recv_attr_t *); 751 static void tcp_process_options(tcp_t *, tcpha_t *); 752 static void tcp_rsrv(queue_t *q); 753 static int tcp_snmp_state(tcp_t *tcp); 754 static void tcp_timer(void *arg); 755 static void tcp_timer_callback(void *); 756 static in_port_t tcp_update_next_port(in_port_t port, const tcp_t *tcp, 757 boolean_t random); 758 static in_port_t tcp_get_next_priv_port(const tcp_t *); 759 static void tcp_wput_sock(queue_t *q, mblk_t *mp); 760 static void tcp_wput_fallback(queue_t *q, mblk_t *mp); 761 void tcp_tpi_accept(queue_t *q, mblk_t *mp); 762 static void tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent); 763 static void tcp_wput_flush(tcp_t *tcp, mblk_t *mp); 764 static void tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp); 765 static int tcp_send(tcp_t *tcp, const int mss, 766 const int total_hdr_len, const int tcp_hdr_len, 767 const int num_sack_blk, int *usable, uint_t *snxt, 768 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time); 769 static void tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, 770 int num_sack_blk); 771 static void tcp_wsrv(queue_t *q); 772 static int tcp_xmit_end(tcp_t *tcp); 773 static void tcp_ack_timer(void *arg); 774 static mblk_t *tcp_ack_mp(tcp_t *tcp); 775 static void tcp_xmit_early_reset(char *str, mblk_t *mp, 776 uint32_t seq, uint32_t ack, int ctl, ip_recv_attr_t *, 777 ip_stack_t *, conn_t *); 778 static void tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, 779 uint32_t ack, int ctl); 780 static void tcp_set_rto(tcp_t *, time_t); 781 static void tcp_icmp_input(void *, mblk_t *, void *, ip_recv_attr_t *); 782 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *); 783 static boolean_t tcp_verifyicmp(conn_t *, void *, icmph_t *, icmp6_t *, 784 ip_recv_attr_t *); 785 static int tcp_build_hdrs(tcp_t *); 786 static void tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, 787 uint32_t seg_seq, uint32_t seg_ack, int seg_len, tcpha_t *tcpha, 788 ip_recv_attr_t *ira); 789 boolean_t tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp); 790 static boolean_t tcp_zcopy_check(tcp_t *); 791 static void tcp_zcopy_notify(tcp_t *); 792 static mblk_t *tcp_zcopy_backoff(tcp_t *, mblk_t *, boolean_t); 793 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa); 794 static void tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only); 795 static void tcp_update_zcopy(tcp_t *tcp); 796 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 797 ixa_notify_arg_t); 798 static void tcp_rexmit_after_error(tcp_t *tcp); 799 static void tcp_send_data(tcp_t *, mblk_t *); 800 extern mblk_t *tcp_timermp_alloc(int); 801 extern void tcp_timermp_free(tcp_t *); 802 static void tcp_timer_free(tcp_t *tcp, mblk_t *mp); 803 static void tcp_stop_lingering(tcp_t *tcp); 804 static void tcp_close_linger_timeout(void *arg); 805 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); 806 static void tcp_stack_fini(netstackid_t stackid, void *arg); 807 static void *tcp_g_kstat_init(tcp_g_stat_t *); 808 static void tcp_g_kstat_fini(kstat_t *); 809 static void *tcp_kstat_init(netstackid_t, tcp_stack_t *); 810 static void tcp_kstat_fini(netstackid_t, kstat_t *); 811 static void *tcp_kstat2_init(netstackid_t, tcp_stat_t *); 812 static void tcp_kstat2_fini(netstackid_t, kstat_t *); 813 static int tcp_kstat_update(kstat_t *kp, int rw); 814 static mblk_t *tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 815 ip_recv_attr_t *ira); 816 static mblk_t *tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp, 817 ip_recv_attr_t *ira); 818 static int tcp_squeue_switch(int); 819 820 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); 821 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); 822 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); 823 static int tcp_tpi_close(queue_t *, int); 824 static int tcp_tpi_close_accept(queue_t *); 825 826 static void tcp_squeue_add(squeue_t *); 827 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *); 828 829 extern void tcp_kssl_input(tcp_t *, mblk_t *, cred_t *); 830 831 void tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy); 832 void tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 833 ip_recv_attr_t *dummy); 834 835 static int tcp_accept(sock_lower_handle_t, sock_lower_handle_t, 836 sock_upper_handle_t, cred_t *); 837 static int tcp_listen(sock_lower_handle_t, int, cred_t *); 838 static int tcp_do_listen(conn_t *, struct sockaddr *, socklen_t, int, cred_t *, 839 boolean_t); 840 static int tcp_do_connect(conn_t *, const struct sockaddr *, socklen_t, 841 cred_t *, pid_t); 842 static int tcp_do_bind(conn_t *, struct sockaddr *, socklen_t, cred_t *, 843 boolean_t); 844 static int tcp_do_unbind(conn_t *); 845 static int tcp_bind_check(conn_t *, struct sockaddr *, socklen_t, cred_t *, 846 boolean_t); 847 848 static void tcp_ulp_newconn(conn_t *, conn_t *, mblk_t *); 849 850 /* 851 * Routines related to the TCP_IOC_ABORT_CONN ioctl command. 852 * 853 * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting 854 * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure 855 * (defined in tcp.h) needs to be filled in and passed into the kernel 856 * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t 857 * structure contains the four-tuple of a TCP connection and a range of TCP 858 * states (specified by ac_start and ac_end). The use of wildcard addresses 859 * and ports is allowed. Connections with a matching four tuple and a state 860 * within the specified range will be aborted. The valid states for the 861 * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT, 862 * inclusive. 863 * 864 * An application which has its connection aborted by this ioctl will receive 865 * an error that is dependent on the connection state at the time of the abort. 866 * If the connection state is < TCPS_TIME_WAIT, an application should behave as 867 * though a RST packet has been received. If the connection state is equal to 868 * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel 869 * and all resources associated with the connection will be freed. 870 */ 871 static mblk_t *tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *); 872 static void tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *); 873 static void tcp_ioctl_abort_handler(void *arg, mblk_t *mp, void *arg2, 874 ip_recv_attr_t *dummy); 875 static int tcp_ioctl_abort(tcp_ioc_abort_conn_t *, tcp_stack_t *tcps); 876 static void tcp_ioctl_abort_conn(queue_t *, mblk_t *); 877 static int tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *, 878 boolean_t, tcp_stack_t *); 879 880 static struct module_info tcp_rinfo = { 881 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 882 }; 883 884 static struct module_info tcp_winfo = { 885 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 886 }; 887 888 /* 889 * Entry points for TCP as a device. The normal case which supports 890 * the TCP functionality. 891 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. 892 */ 893 struct qinit tcp_rinitv4 = { 894 NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo 895 }; 896 897 struct qinit tcp_rinitv6 = { 898 NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo 899 }; 900 901 struct qinit tcp_winit = { 902 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 903 }; 904 905 /* Initial entry point for TCP in socket mode. */ 906 struct qinit tcp_sock_winit = { 907 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 908 }; 909 910 /* TCP entry point during fallback */ 911 struct qinit tcp_fallback_sock_winit = { 912 (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo 913 }; 914 915 /* 916 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 917 * an accept. Avoid allocating data structures since eager has already 918 * been created. 919 */ 920 struct qinit tcp_acceptor_rinit = { 921 NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo 922 }; 923 924 struct qinit tcp_acceptor_winit = { 925 (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo 926 }; 927 928 /* For AF_INET aka /dev/tcp */ 929 struct streamtab tcpinfov4 = { 930 &tcp_rinitv4, &tcp_winit 931 }; 932 933 /* For AF_INET6 aka /dev/tcp6 */ 934 struct streamtab tcpinfov6 = { 935 &tcp_rinitv6, &tcp_winit 936 }; 937 938 sock_downcalls_t sock_tcp_downcalls; 939 940 /* Setable only in /etc/system. Move to ndd? */ 941 boolean_t tcp_icmp_source_quench = B_FALSE; 942 943 /* 944 * Following assumes TPI alignment requirements stay along 32 bit 945 * boundaries 946 */ 947 #define ROUNDUP32(x) \ 948 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 949 950 /* Template for response to info request. */ 951 static struct T_info_ack tcp_g_t_info_ack = { 952 T_INFO_ACK, /* PRIM_type */ 953 0, /* TSDU_size */ 954 T_INFINITE, /* ETSDU_size */ 955 T_INVALID, /* CDATA_size */ 956 T_INVALID, /* DDATA_size */ 957 sizeof (sin_t), /* ADDR_size */ 958 0, /* OPT_size - not initialized here */ 959 TIDUSZ, /* TIDU_size */ 960 T_COTS_ORD, /* SERV_type */ 961 TCPS_IDLE, /* CURRENT_state */ 962 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 963 }; 964 965 static struct T_info_ack tcp_g_t_info_ack_v6 = { 966 T_INFO_ACK, /* PRIM_type */ 967 0, /* TSDU_size */ 968 T_INFINITE, /* ETSDU_size */ 969 T_INVALID, /* CDATA_size */ 970 T_INVALID, /* DDATA_size */ 971 sizeof (sin6_t), /* ADDR_size */ 972 0, /* OPT_size - not initialized here */ 973 TIDUSZ, /* TIDU_size */ 974 T_COTS_ORD, /* SERV_type */ 975 TCPS_IDLE, /* CURRENT_state */ 976 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 977 }; 978 979 #define MS 1L 980 #define SECONDS (1000 * MS) 981 #define MINUTES (60 * SECONDS) 982 #define HOURS (60 * MINUTES) 983 #define DAYS (24 * HOURS) 984 985 #define PARAM_MAX (~(uint32_t)0) 986 987 /* Max size IP datagram is 64k - 1 */ 988 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcpha_t))) 989 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcpha_t))) 990 /* Max of the above */ 991 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 992 993 /* Largest TCP port number */ 994 #define TCP_MAX_PORT (64 * 1024 - 1) 995 996 /* 997 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 998 * layer header. It has to be a multiple of 4. 999 */ 1000 static tcpparam_t lcl_tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 1001 #define tcps_wroff_xtra tcps_wroff_xtra_param->tcp_param_val 1002 1003 /* 1004 * All of these are alterable, within the min/max values given, at run time. 1005 * Note that the default value of "tcp_time_wait_interval" is four minutes, 1006 * per the TCP spec. 1007 */ 1008 /* BEGIN CSTYLED */ 1009 static tcpparam_t lcl_tcp_param_arr[] = { 1010 /*min max value name */ 1011 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 1012 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 1013 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 1014 { 1, 1024, 1, "tcp_conn_req_min" }, 1015 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 1016 { 128, (1<<30), 1024*1024, "tcp_cwnd_max" }, 1017 { 0, 10, 0, "tcp_debug" }, 1018 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 1019 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 1020 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 1021 { 500*MS, PARAM_MAX, 8*MINUTES, "tcp_ip_abort_interval"}, 1022 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 1023 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 1024 { 1, 255, 64, "tcp_ipv4_ttl"}, 1025 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 1026 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 1027 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 1028 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 1029 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 1030 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 1031 { 1*MS, 20*SECONDS, 3*SECONDS, "tcp_rexmit_interval_initial"}, 1032 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 1033 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 1034 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 1035 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 1036 { 0, 128000, 0, "tcp_sth_rcv_hiwat" }, 1037 { 0, 128000, 0, "tcp_sth_rcv_lowat" }, 1038 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 1039 { 0, 1, 0, "tcp_ignore_path_mtu" }, 1040 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 1041 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 1042 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 1043 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 1044 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 1045 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 1046 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 1047 { 8192, (1<<30), 1024*1024, "tcp_max_buf"}, 1048 /* 1049 * Question: What default value should I set for tcp_strong_iss? 1050 */ 1051 { 0, 2, 1, "tcp_strong_iss"}, 1052 { 0, 65536, 20, "tcp_rtt_updates"}, 1053 { 0, 1, 1, "tcp_wscale_always"}, 1054 { 0, 1, 0, "tcp_tstamp_always"}, 1055 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 1056 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 1057 { 0, 16, 2, "tcp_deferred_acks_max"}, 1058 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 1059 { 1, 4, 4, "tcp_slow_start_initial"}, 1060 { 0, 2, 2, "tcp_sack_permitted"}, 1061 { 0, 1, 1, "tcp_compression_enabled"}, 1062 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 1063 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 1064 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 1065 { 0, 1, 0, "tcp_rev_src_routes"}, 1066 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 1067 { 0, 16, 8, "tcp_local_dacks_max"}, 1068 { 0, 2, 1, "tcp_ecn_permitted"}, 1069 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 1070 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 1071 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 1072 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 1073 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 1074 { 0, 1, 0, "tcp_dev_flow_ctl"}, 1075 }; 1076 /* END CSTYLED */ 1077 1078 /* Round up the value to the nearest mss. */ 1079 #define MSS_ROUNDUP(value, mss) ((((value) - 1) / (mss) + 1) * (mss)) 1080 1081 /* 1082 * Set ECN capable transport (ECT) code point in IP header. 1083 * 1084 * Note that there are 2 ECT code points '01' and '10', which are called 1085 * ECT(1) and ECT(0) respectively. Here we follow the original ECT code 1086 * point ECT(0) for TCP as described in RFC 2481. 1087 */ 1088 #define SET_ECT(tcp, iph) \ 1089 if ((tcp)->tcp_connp->conn_ipversion == IPV4_VERSION) { \ 1090 /* We need to clear the code point first. */ \ 1091 ((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \ 1092 ((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \ 1093 } else { \ 1094 ((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \ 1095 ((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \ 1096 } 1097 1098 /* 1099 * The format argument to pass to tcp_display(). 1100 * DISP_PORT_ONLY means that the returned string has only port info. 1101 * DISP_ADDR_AND_PORT means that the returned string also contains the 1102 * remote and local IP address. 1103 */ 1104 #define DISP_PORT_ONLY 1 1105 #define DISP_ADDR_AND_PORT 2 1106 1107 #define IS_VMLOANED_MBLK(mp) \ 1108 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 1109 1110 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 1111 1112 /* 1113 * Forces all connections to obey the value of the tcps_maxpsz_multiplier 1114 * tunable settable via NDD. Otherwise, the per-connection behavior is 1115 * determined dynamically during tcp_set_destination(), which is the default. 1116 */ 1117 boolean_t tcp_static_maxpsz = B_FALSE; 1118 1119 /* Setable in /etc/system */ 1120 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */ 1121 uint32_t tcp_random_anon_port = 1; 1122 1123 /* 1124 * To reach to an eager in Q0 which can be dropped due to an incoming 1125 * new SYN request when Q0 is full, a new doubly linked list is 1126 * introduced. This list allows to select an eager from Q0 in O(1) time. 1127 * This is needed to avoid spending too much time walking through the 1128 * long list of eagers in Q0 when tcp_drop_q0() is called. Each member of 1129 * this new list has to be a member of Q0. 1130 * This list is headed by listener's tcp_t. When the list is empty, 1131 * both the pointers - tcp_eager_next_drop_q0 and tcp_eager_prev_drop_q0, 1132 * of listener's tcp_t point to listener's tcp_t itself. 1133 * 1134 * Given an eager in Q0 and a listener, MAKE_DROPPABLE() puts the eager 1135 * in the list. MAKE_UNDROPPABLE() takes the eager out of the list. 1136 * These macros do not affect the eager's membership to Q0. 1137 */ 1138 1139 1140 #define MAKE_DROPPABLE(listener, eager) \ 1141 if ((eager)->tcp_eager_next_drop_q0 == NULL) { \ 1142 (listener)->tcp_eager_next_drop_q0->tcp_eager_prev_drop_q0\ 1143 = (eager); \ 1144 (eager)->tcp_eager_prev_drop_q0 = (listener); \ 1145 (eager)->tcp_eager_next_drop_q0 = \ 1146 (listener)->tcp_eager_next_drop_q0; \ 1147 (listener)->tcp_eager_next_drop_q0 = (eager); \ 1148 } 1149 1150 #define MAKE_UNDROPPABLE(eager) \ 1151 if ((eager)->tcp_eager_next_drop_q0 != NULL) { \ 1152 (eager)->tcp_eager_next_drop_q0->tcp_eager_prev_drop_q0 \ 1153 = (eager)->tcp_eager_prev_drop_q0; \ 1154 (eager)->tcp_eager_prev_drop_q0->tcp_eager_next_drop_q0 \ 1155 = (eager)->tcp_eager_next_drop_q0; \ 1156 (eager)->tcp_eager_prev_drop_q0 = NULL; \ 1157 (eager)->tcp_eager_next_drop_q0 = NULL; \ 1158 } 1159 1160 /* 1161 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 1162 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 1163 * data, TCP will not respond with an ACK. RFC 793 requires that 1164 * TCP responds with an ACK for such a bogus ACK. By not following 1165 * the RFC, we prevent TCP from getting into an ACK storm if somehow 1166 * an attacker successfully spoofs an acceptable segment to our 1167 * peer; or when our peer is "confused." 1168 */ 1169 uint32_t tcp_drop_ack_unsent_cnt = 10; 1170 1171 /* 1172 * Hook functions to enable cluster networking 1173 * On non-clustered systems these vectors must always be NULL. 1174 */ 1175 1176 void (*cl_inet_listen)(netstackid_t stack_id, uint8_t protocol, 1177 sa_family_t addr_family, uint8_t *laddrp, 1178 in_port_t lport, void *args) = NULL; 1179 void (*cl_inet_unlisten)(netstackid_t stack_id, uint8_t protocol, 1180 sa_family_t addr_family, uint8_t *laddrp, 1181 in_port_t lport, void *args) = NULL; 1182 1183 int (*cl_inet_connect2)(netstackid_t stack_id, uint8_t protocol, 1184 boolean_t is_outgoing, 1185 sa_family_t addr_family, 1186 uint8_t *laddrp, in_port_t lport, 1187 uint8_t *faddrp, in_port_t fport, 1188 void *args) = NULL; 1189 void (*cl_inet_disconnect)(netstackid_t stack_id, uint8_t protocol, 1190 sa_family_t addr_family, uint8_t *laddrp, 1191 in_port_t lport, uint8_t *faddrp, 1192 in_port_t fport, void *args) = NULL; 1193 1194 1195 /* 1196 * int CL_INET_CONNECT(conn_t *cp, tcp_t *tcp, boolean_t is_outgoing, int err) 1197 */ 1198 #define CL_INET_CONNECT(connp, is_outgoing, err) { \ 1199 (err) = 0; \ 1200 if (cl_inet_connect2 != NULL) { \ 1201 /* \ 1202 * Running in cluster mode - register active connection \ 1203 * information \ 1204 */ \ 1205 if ((connp)->conn_ipversion == IPV4_VERSION) { \ 1206 if ((connp)->conn_laddr_v4 != 0) { \ 1207 (err) = (*cl_inet_connect2)( \ 1208 (connp)->conn_netstack->netstack_stackid,\ 1209 IPPROTO_TCP, is_outgoing, AF_INET, \ 1210 (uint8_t *)(&((connp)->conn_laddr_v4)),\ 1211 (in_port_t)(connp)->conn_lport, \ 1212 (uint8_t *)(&((connp)->conn_faddr_v4)),\ 1213 (in_port_t)(connp)->conn_fport, NULL); \ 1214 } \ 1215 } else { \ 1216 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1217 &(connp)->conn_laddr_v6)) { \ 1218 (err) = (*cl_inet_connect2)( \ 1219 (connp)->conn_netstack->netstack_stackid,\ 1220 IPPROTO_TCP, is_outgoing, AF_INET6, \ 1221 (uint8_t *)(&((connp)->conn_laddr_v6)),\ 1222 (in_port_t)(connp)->conn_lport, \ 1223 (uint8_t *)(&((connp)->conn_faddr_v6)), \ 1224 (in_port_t)(connp)->conn_fport, NULL); \ 1225 } \ 1226 } \ 1227 } \ 1228 } 1229 1230 #define CL_INET_DISCONNECT(connp) { \ 1231 if (cl_inet_disconnect != NULL) { \ 1232 /* \ 1233 * Running in cluster mode - deregister active \ 1234 * connection information \ 1235 */ \ 1236 if ((connp)->conn_ipversion == IPV4_VERSION) { \ 1237 if ((connp)->conn_laddr_v4 != 0) { \ 1238 (*cl_inet_disconnect)( \ 1239 (connp)->conn_netstack->netstack_stackid,\ 1240 IPPROTO_TCP, AF_INET, \ 1241 (uint8_t *)(&((connp)->conn_laddr_v4)),\ 1242 (in_port_t)(connp)->conn_lport, \ 1243 (uint8_t *)(&((connp)->conn_faddr_v4)),\ 1244 (in_port_t)(connp)->conn_fport, NULL); \ 1245 } \ 1246 } else { \ 1247 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1248 &(connp)->conn_laddr_v6)) { \ 1249 (*cl_inet_disconnect)( \ 1250 (connp)->conn_netstack->netstack_stackid,\ 1251 IPPROTO_TCP, AF_INET6, \ 1252 (uint8_t *)(&((connp)->conn_laddr_v6)),\ 1253 (in_port_t)(connp)->conn_lport, \ 1254 (uint8_t *)(&((connp)->conn_faddr_v6)), \ 1255 (in_port_t)(connp)->conn_fport, NULL); \ 1256 } \ 1257 } \ 1258 } \ 1259 } 1260 1261 /* 1262 * Cluster networking hook for traversing current connection list. 1263 * This routine is used to extract the current list of live connections 1264 * which must continue to to be dispatched to this node. 1265 */ 1266 int cl_tcp_walk_list(netstackid_t stack_id, 1267 int (*callback)(cl_tcp_info_t *, void *), void *arg); 1268 1269 static int cl_tcp_walk_list_stack(int (*callback)(cl_tcp_info_t *, void *), 1270 void *arg, tcp_stack_t *tcps); 1271 1272 static void 1273 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh) 1274 { 1275 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3; 1276 1277 if (IPCL_IS_NONSTR(tcp->tcp_connp)) { 1278 conn_t *connp = tcp->tcp_connp; 1279 struct sock_proto_props sopp; 1280 1281 /* 1282 * only increase rcvthresh upto default_threshold 1283 */ 1284 if (new_rcvthresh > default_threshold) 1285 new_rcvthresh = default_threshold; 1286 1287 sopp.sopp_flags = SOCKOPT_RCVTHRESH; 1288 sopp.sopp_rcvthresh = new_rcvthresh; 1289 1290 (*connp->conn_upcalls->su_set_proto_props) 1291 (connp->conn_upper_handle, &sopp); 1292 } 1293 } 1294 /* 1295 * Figure out the value of window scale opton. Note that the rwnd is 1296 * ASSUMED to be rounded up to the nearest MSS before the calculation. 1297 * We cannot find the scale value and then do a round up of tcp_rwnd 1298 * because the scale value may not be correct after that. 1299 * 1300 * Set the compiler flag to make this function inline. 1301 */ 1302 static void 1303 tcp_set_ws_value(tcp_t *tcp) 1304 { 1305 int i; 1306 uint32_t rwnd = tcp->tcp_rwnd; 1307 1308 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 1309 i++, rwnd >>= 1) 1310 ; 1311 tcp->tcp_rcv_ws = i; 1312 } 1313 1314 /* 1315 * Remove a connection from the list of detached TIME_WAIT connections. 1316 * It returns B_FALSE if it can't remove the connection from the list 1317 * as the connection has already been removed from the list due to an 1318 * earlier call to tcp_time_wait_remove(); otherwise it returns B_TRUE. 1319 */ 1320 static boolean_t 1321 tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait) 1322 { 1323 boolean_t locked = B_FALSE; 1324 1325 if (tcp_time_wait == NULL) { 1326 tcp_time_wait = *((tcp_squeue_priv_t **) 1327 squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); 1328 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1329 locked = B_TRUE; 1330 } else { 1331 ASSERT(MUTEX_HELD(&tcp_time_wait->tcp_time_wait_lock)); 1332 } 1333 1334 if (tcp->tcp_time_wait_expire == 0) { 1335 ASSERT(tcp->tcp_time_wait_next == NULL); 1336 ASSERT(tcp->tcp_time_wait_prev == NULL); 1337 if (locked) 1338 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1339 return (B_FALSE); 1340 } 1341 ASSERT(TCP_IS_DETACHED(tcp)); 1342 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 1343 1344 if (tcp == tcp_time_wait->tcp_time_wait_head) { 1345 ASSERT(tcp->tcp_time_wait_prev == NULL); 1346 tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next; 1347 if (tcp_time_wait->tcp_time_wait_head != NULL) { 1348 tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev = 1349 NULL; 1350 } else { 1351 tcp_time_wait->tcp_time_wait_tail = NULL; 1352 } 1353 } else if (tcp == tcp_time_wait->tcp_time_wait_tail) { 1354 ASSERT(tcp != tcp_time_wait->tcp_time_wait_head); 1355 ASSERT(tcp->tcp_time_wait_next == NULL); 1356 tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev; 1357 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 1358 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL; 1359 } else { 1360 ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp); 1361 ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp); 1362 tcp->tcp_time_wait_prev->tcp_time_wait_next = 1363 tcp->tcp_time_wait_next; 1364 tcp->tcp_time_wait_next->tcp_time_wait_prev = 1365 tcp->tcp_time_wait_prev; 1366 } 1367 tcp->tcp_time_wait_next = NULL; 1368 tcp->tcp_time_wait_prev = NULL; 1369 tcp->tcp_time_wait_expire = 0; 1370 1371 if (locked) 1372 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1373 return (B_TRUE); 1374 } 1375 1376 /* 1377 * Add a connection to the list of detached TIME_WAIT connections 1378 * and set its time to expire. 1379 */ 1380 static void 1381 tcp_time_wait_append(tcp_t *tcp) 1382 { 1383 tcp_stack_t *tcps = tcp->tcp_tcps; 1384 tcp_squeue_priv_t *tcp_time_wait = 1385 *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp, 1386 SQPRIVATE_TCP)); 1387 1388 tcp_timers_stop(tcp); 1389 1390 /* Freed above */ 1391 ASSERT(tcp->tcp_timer_tid == 0); 1392 ASSERT(tcp->tcp_ack_tid == 0); 1393 1394 /* must have happened at the time of detaching the tcp */ 1395 ASSERT(tcp->tcp_ptpahn == NULL); 1396 ASSERT(tcp->tcp_flow_stopped == 0); 1397 ASSERT(tcp->tcp_time_wait_next == NULL); 1398 ASSERT(tcp->tcp_time_wait_prev == NULL); 1399 ASSERT(tcp->tcp_time_wait_expire == NULL); 1400 ASSERT(tcp->tcp_listener == NULL); 1401 1402 tcp->tcp_time_wait_expire = ddi_get_lbolt(); 1403 /* 1404 * The value computed below in tcp->tcp_time_wait_expire may 1405 * appear negative or wrap around. That is ok since our 1406 * interest is only in the difference between the current lbolt 1407 * value and tcp->tcp_time_wait_expire. But the value should not 1408 * be zero, since it means the tcp is not in the TIME_WAIT list. 1409 * The corresponding comparison in tcp_time_wait_collector() uses 1410 * modular arithmetic. 1411 */ 1412 tcp->tcp_time_wait_expire += 1413 drv_usectohz(tcps->tcps_time_wait_interval * 1000); 1414 if (tcp->tcp_time_wait_expire == 0) 1415 tcp->tcp_time_wait_expire = 1; 1416 1417 ASSERT(TCP_IS_DETACHED(tcp)); 1418 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 1419 ASSERT(tcp->tcp_time_wait_next == NULL); 1420 ASSERT(tcp->tcp_time_wait_prev == NULL); 1421 TCP_DBGSTAT(tcps, tcp_time_wait); 1422 1423 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1424 if (tcp_time_wait->tcp_time_wait_head == NULL) { 1425 ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL); 1426 tcp_time_wait->tcp_time_wait_head = tcp; 1427 } else { 1428 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 1429 ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state == 1430 TCPS_TIME_WAIT); 1431 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp; 1432 tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail; 1433 } 1434 tcp_time_wait->tcp_time_wait_tail = tcp; 1435 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1436 } 1437 1438 /* ARGSUSED */ 1439 void 1440 tcp_timewait_output(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 1441 { 1442 conn_t *connp = (conn_t *)arg; 1443 tcp_t *tcp = connp->conn_tcp; 1444 tcp_stack_t *tcps = tcp->tcp_tcps; 1445 1446 ASSERT(tcp != NULL); 1447 if (tcp->tcp_state == TCPS_CLOSED) { 1448 return; 1449 } 1450 1451 ASSERT((connp->conn_family == AF_INET && 1452 connp->conn_ipversion == IPV4_VERSION) || 1453 (connp->conn_family == AF_INET6 && 1454 (connp->conn_ipversion == IPV4_VERSION || 1455 connp->conn_ipversion == IPV6_VERSION))); 1456 ASSERT(!tcp->tcp_listener); 1457 1458 TCP_STAT(tcps, tcp_time_wait_reap); 1459 ASSERT(TCP_IS_DETACHED(tcp)); 1460 1461 /* 1462 * Because they have no upstream client to rebind or tcp_close() 1463 * them later, we axe the connection here and now. 1464 */ 1465 tcp_close_detached(tcp); 1466 } 1467 1468 /* 1469 * Remove cached/latched IPsec references. 1470 */ 1471 void 1472 tcp_ipsec_cleanup(tcp_t *tcp) 1473 { 1474 conn_t *connp = tcp->tcp_connp; 1475 1476 ASSERT(connp->conn_flags & IPCL_TCPCONN); 1477 1478 if (connp->conn_latch != NULL) { 1479 IPLATCH_REFRELE(connp->conn_latch); 1480 connp->conn_latch = NULL; 1481 } 1482 if (connp->conn_latch_in_policy != NULL) { 1483 IPPOL_REFRELE(connp->conn_latch_in_policy); 1484 connp->conn_latch_in_policy = NULL; 1485 } 1486 if (connp->conn_latch_in_action != NULL) { 1487 IPACT_REFRELE(connp->conn_latch_in_action); 1488 connp->conn_latch_in_action = NULL; 1489 } 1490 if (connp->conn_policy != NULL) { 1491 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 1492 connp->conn_policy = NULL; 1493 } 1494 } 1495 1496 /* 1497 * Cleaup before placing on free list. 1498 * Disassociate from the netstack/tcp_stack_t since the freelist 1499 * is per squeue and not per netstack. 1500 */ 1501 void 1502 tcp_cleanup(tcp_t *tcp) 1503 { 1504 mblk_t *mp; 1505 tcp_sack_info_t *tcp_sack_info; 1506 conn_t *connp = tcp->tcp_connp; 1507 tcp_stack_t *tcps = tcp->tcp_tcps; 1508 netstack_t *ns = tcps->tcps_netstack; 1509 mblk_t *tcp_rsrv_mp; 1510 1511 tcp_bind_hash_remove(tcp); 1512 1513 /* Cleanup that which needs the netstack first */ 1514 tcp_ipsec_cleanup(tcp); 1515 ixa_cleanup(connp->conn_ixa); 1516 1517 if (connp->conn_ht_iphc != NULL) { 1518 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 1519 connp->conn_ht_iphc = NULL; 1520 connp->conn_ht_iphc_allocated = 0; 1521 connp->conn_ht_iphc_len = 0; 1522 connp->conn_ht_ulp = NULL; 1523 connp->conn_ht_ulp_len = 0; 1524 tcp->tcp_ipha = NULL; 1525 tcp->tcp_ip6h = NULL; 1526 tcp->tcp_tcpha = NULL; 1527 } 1528 1529 /* We clear any IP_OPTIONS and extension headers */ 1530 ip_pkt_free(&connp->conn_xmit_ipp); 1531 1532 tcp_free(tcp); 1533 1534 /* Release any SSL context */ 1535 if (tcp->tcp_kssl_ent != NULL) { 1536 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 1537 tcp->tcp_kssl_ent = NULL; 1538 } 1539 1540 if (tcp->tcp_kssl_ctx != NULL) { 1541 kssl_release_ctx(tcp->tcp_kssl_ctx); 1542 tcp->tcp_kssl_ctx = NULL; 1543 } 1544 tcp->tcp_kssl_pending = B_FALSE; 1545 1546 /* 1547 * Since we will bzero the entire structure, we need to 1548 * remove it and reinsert it in global hash list. We 1549 * know the walkers can't get to this conn because we 1550 * had set CONDEMNED flag earlier and checked reference 1551 * under conn_lock so walker won't pick it and when we 1552 * go the ipcl_globalhash_remove() below, no walker 1553 * can get to it. 1554 */ 1555 ipcl_globalhash_remove(connp); 1556 1557 /* Save some state */ 1558 mp = tcp->tcp_timercache; 1559 1560 tcp_sack_info = tcp->tcp_sack_info; 1561 tcp_rsrv_mp = tcp->tcp_rsrv_mp; 1562 1563 if (connp->conn_cred != NULL) { 1564 crfree(connp->conn_cred); 1565 connp->conn_cred = NULL; 1566 } 1567 ipcl_conn_cleanup(connp); 1568 connp->conn_flags = IPCL_TCPCONN; 1569 1570 /* 1571 * Now it is safe to decrement the reference counts. 1572 * This might be the last reference on the netstack 1573 * in which case it will cause the freeing of the IP Instance. 1574 */ 1575 connp->conn_netstack = NULL; 1576 connp->conn_ixa->ixa_ipst = NULL; 1577 netstack_rele(ns); 1578 ASSERT(tcps != NULL); 1579 tcp->tcp_tcps = NULL; 1580 1581 bzero(tcp, sizeof (tcp_t)); 1582 1583 /* restore the state */ 1584 tcp->tcp_timercache = mp; 1585 1586 tcp->tcp_sack_info = tcp_sack_info; 1587 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 1588 1589 tcp->tcp_connp = connp; 1590 1591 ASSERT(connp->conn_tcp == tcp); 1592 ASSERT(connp->conn_flags & IPCL_TCPCONN); 1593 connp->conn_state_flags = CONN_INCIPIENT; 1594 ASSERT(connp->conn_proto == IPPROTO_TCP); 1595 ASSERT(connp->conn_ref == 1); 1596 } 1597 1598 /* 1599 * Blows away all tcps whose TIME_WAIT has expired. List traversal 1600 * is done forwards from the head. 1601 * This walks all stack instances since 1602 * tcp_time_wait remains global across all stacks. 1603 */ 1604 /* ARGSUSED */ 1605 void 1606 tcp_time_wait_collector(void *arg) 1607 { 1608 tcp_t *tcp; 1609 clock_t now; 1610 mblk_t *mp; 1611 conn_t *connp; 1612 kmutex_t *lock; 1613 boolean_t removed; 1614 1615 squeue_t *sqp = (squeue_t *)arg; 1616 tcp_squeue_priv_t *tcp_time_wait = 1617 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1618 1619 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1620 tcp_time_wait->tcp_time_wait_tid = 0; 1621 1622 if (tcp_time_wait->tcp_free_list != NULL && 1623 tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) { 1624 TCP_G_STAT(tcp_freelist_cleanup); 1625 while ((tcp = tcp_time_wait->tcp_free_list) != NULL) { 1626 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1627 tcp->tcp_time_wait_next = NULL; 1628 tcp_time_wait->tcp_free_list_cnt--; 1629 ASSERT(tcp->tcp_tcps == NULL); 1630 CONN_DEC_REF(tcp->tcp_connp); 1631 } 1632 ASSERT(tcp_time_wait->tcp_free_list_cnt == 0); 1633 } 1634 1635 /* 1636 * In order to reap time waits reliably, we should use a 1637 * source of time that is not adjustable by the user -- hence 1638 * the call to ddi_get_lbolt(). 1639 */ 1640 now = ddi_get_lbolt(); 1641 while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) { 1642 /* 1643 * Compare times using modular arithmetic, since 1644 * lbolt can wrapover. 1645 */ 1646 if ((now - tcp->tcp_time_wait_expire) < 0) { 1647 break; 1648 } 1649 1650 removed = tcp_time_wait_remove(tcp, tcp_time_wait); 1651 ASSERT(removed); 1652 1653 connp = tcp->tcp_connp; 1654 ASSERT(connp->conn_fanout != NULL); 1655 lock = &connp->conn_fanout->connf_lock; 1656 /* 1657 * This is essentially a TW reclaim fast path optimization for 1658 * performance where the timewait collector checks under the 1659 * fanout lock (so that no one else can get access to the 1660 * conn_t) that the refcnt is 2 i.e. one for TCP and one for 1661 * the classifier hash list. If ref count is indeed 2, we can 1662 * just remove the conn under the fanout lock and avoid 1663 * cleaning up the conn under the squeue, provided that 1664 * clustering callbacks are not enabled. If clustering is 1665 * enabled, we need to make the clustering callback before 1666 * setting the CONDEMNED flag and after dropping all locks and 1667 * so we forego this optimization and fall back to the slow 1668 * path. Also please see the comments in tcp_closei_local 1669 * regarding the refcnt logic. 1670 * 1671 * Since we are holding the tcp_time_wait_lock, its better 1672 * not to block on the fanout_lock because other connections 1673 * can't add themselves to time_wait list. So we do a 1674 * tryenter instead of mutex_enter. 1675 */ 1676 if (mutex_tryenter(lock)) { 1677 mutex_enter(&connp->conn_lock); 1678 if ((connp->conn_ref == 2) && 1679 (cl_inet_disconnect == NULL)) { 1680 ipcl_hash_remove_locked(connp, 1681 connp->conn_fanout); 1682 /* 1683 * Set the CONDEMNED flag now itself so that 1684 * the refcnt cannot increase due to any 1685 * walker. 1686 */ 1687 connp->conn_state_flags |= CONN_CONDEMNED; 1688 mutex_exit(lock); 1689 mutex_exit(&connp->conn_lock); 1690 if (tcp_time_wait->tcp_free_list_cnt < 1691 tcp_free_list_max_cnt) { 1692 /* Add to head of tcp_free_list */ 1693 mutex_exit( 1694 &tcp_time_wait->tcp_time_wait_lock); 1695 tcp_cleanup(tcp); 1696 ASSERT(connp->conn_latch == NULL); 1697 ASSERT(connp->conn_policy == NULL); 1698 ASSERT(tcp->tcp_tcps == NULL); 1699 ASSERT(connp->conn_netstack == NULL); 1700 1701 mutex_enter( 1702 &tcp_time_wait->tcp_time_wait_lock); 1703 tcp->tcp_time_wait_next = 1704 tcp_time_wait->tcp_free_list; 1705 tcp_time_wait->tcp_free_list = tcp; 1706 tcp_time_wait->tcp_free_list_cnt++; 1707 continue; 1708 } else { 1709 /* Do not add to tcp_free_list */ 1710 mutex_exit( 1711 &tcp_time_wait->tcp_time_wait_lock); 1712 tcp_bind_hash_remove(tcp); 1713 ixa_cleanup(tcp->tcp_connp->conn_ixa); 1714 tcp_ipsec_cleanup(tcp); 1715 CONN_DEC_REF(tcp->tcp_connp); 1716 } 1717 } else { 1718 CONN_INC_REF_LOCKED(connp); 1719 mutex_exit(lock); 1720 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1721 mutex_exit(&connp->conn_lock); 1722 /* 1723 * We can reuse the closemp here since conn has 1724 * detached (otherwise we wouldn't even be in 1725 * time_wait list). tcp_closemp_used can safely 1726 * be changed without taking a lock as no other 1727 * thread can concurrently access it at this 1728 * point in the connection lifecycle. 1729 */ 1730 1731 if (tcp->tcp_closemp.b_prev == NULL) 1732 tcp->tcp_closemp_used = B_TRUE; 1733 else 1734 cmn_err(CE_PANIC, 1735 "tcp_timewait_collector: " 1736 "concurrent use of tcp_closemp: " 1737 "connp %p tcp %p\n", (void *)connp, 1738 (void *)tcp); 1739 1740 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1741 mp = &tcp->tcp_closemp; 1742 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 1743 tcp_timewait_output, connp, NULL, 1744 SQ_FILL, SQTAG_TCP_TIMEWAIT); 1745 } 1746 } else { 1747 mutex_enter(&connp->conn_lock); 1748 CONN_INC_REF_LOCKED(connp); 1749 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1750 mutex_exit(&connp->conn_lock); 1751 /* 1752 * We can reuse the closemp here since conn has 1753 * detached (otherwise we wouldn't even be in 1754 * time_wait list). tcp_closemp_used can safely 1755 * be changed without taking a lock as no other 1756 * thread can concurrently access it at this 1757 * point in the connection lifecycle. 1758 */ 1759 1760 if (tcp->tcp_closemp.b_prev == NULL) 1761 tcp->tcp_closemp_used = B_TRUE; 1762 else 1763 cmn_err(CE_PANIC, "tcp_timewait_collector: " 1764 "concurrent use of tcp_closemp: " 1765 "connp %p tcp %p\n", (void *)connp, 1766 (void *)tcp); 1767 1768 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1769 mp = &tcp->tcp_closemp; 1770 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 1771 tcp_timewait_output, connp, NULL, 1772 SQ_FILL, SQTAG_TCP_TIMEWAIT); 1773 } 1774 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1775 } 1776 1777 if (tcp_time_wait->tcp_free_list != NULL) 1778 tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE; 1779 1780 tcp_time_wait->tcp_time_wait_tid = 1781 timeout_generic(CALLOUT_NORMAL, tcp_time_wait_collector, sqp, 1782 TICK_TO_NSEC(TCP_TIME_WAIT_DELAY), CALLOUT_TCP_RESOLUTION, 1783 CALLOUT_FLAG_ROUNDUP); 1784 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1785 } 1786 1787 /* 1788 * Reply to a clients T_CONN_RES TPI message. This function 1789 * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES 1790 * on the acceptor STREAM and processed in tcp_accept_common(). 1791 * Read the block comment on top of tcp_input_listener(). 1792 */ 1793 static void 1794 tcp_tli_accept(tcp_t *listener, mblk_t *mp) 1795 { 1796 tcp_t *acceptor; 1797 tcp_t *eager; 1798 tcp_t *tcp; 1799 struct T_conn_res *tcr; 1800 t_uscalar_t acceptor_id; 1801 t_scalar_t seqnum; 1802 mblk_t *discon_mp = NULL; 1803 mblk_t *ok_mp; 1804 mblk_t *mp1; 1805 tcp_stack_t *tcps = listener->tcp_tcps; 1806 conn_t *econnp; 1807 1808 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 1809 tcp_err_ack(listener, mp, TPROTO, 0); 1810 return; 1811 } 1812 tcr = (struct T_conn_res *)mp->b_rptr; 1813 1814 /* 1815 * Under ILP32 the stream head points tcr->ACCEPTOR_id at the 1816 * read side queue of the streams device underneath us i.e. the 1817 * read side queue of 'ip'. Since we can't deference QUEUE_ptr we 1818 * look it up in the queue_hash. Under LP64 it sends down the 1819 * minor_t of the accepting endpoint. 1820 * 1821 * Once the acceptor/eager are modified (in tcp_accept_swap) the 1822 * fanout hash lock is held. 1823 * This prevents any thread from entering the acceptor queue from 1824 * below (since it has not been hard bound yet i.e. any inbound 1825 * packets will arrive on the listener conn_t and 1826 * go through the classifier). 1827 * The CONN_INC_REF will prevent the acceptor from closing. 1828 * 1829 * XXX It is still possible for a tli application to send down data 1830 * on the accepting stream while another thread calls t_accept. 1831 * This should not be a problem for well-behaved applications since 1832 * the T_OK_ACK is sent after the queue swapping is completed. 1833 * 1834 * If the accepting fd is the same as the listening fd, avoid 1835 * queue hash lookup since that will return an eager listener in a 1836 * already established state. 1837 */ 1838 acceptor_id = tcr->ACCEPTOR_id; 1839 mutex_enter(&listener->tcp_eager_lock); 1840 if (listener->tcp_acceptor_id == acceptor_id) { 1841 eager = listener->tcp_eager_next_q; 1842 /* only count how many T_CONN_INDs so don't count q0 */ 1843 if ((listener->tcp_conn_req_cnt_q != 1) || 1844 (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) { 1845 mutex_exit(&listener->tcp_eager_lock); 1846 tcp_err_ack(listener, mp, TBADF, 0); 1847 return; 1848 } 1849 if (listener->tcp_conn_req_cnt_q0 != 0) { 1850 /* Throw away all the eagers on q0. */ 1851 tcp_eager_cleanup(listener, 1); 1852 } 1853 if (listener->tcp_syn_defense) { 1854 listener->tcp_syn_defense = B_FALSE; 1855 if (listener->tcp_ip_addr_cache != NULL) { 1856 kmem_free(listener->tcp_ip_addr_cache, 1857 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1858 listener->tcp_ip_addr_cache = NULL; 1859 } 1860 } 1861 /* 1862 * Transfer tcp_conn_req_max to the eager so that when 1863 * a disconnect occurs we can revert the endpoint to the 1864 * listen state. 1865 */ 1866 eager->tcp_conn_req_max = listener->tcp_conn_req_max; 1867 ASSERT(listener->tcp_conn_req_cnt_q0 == 0); 1868 /* 1869 * Get a reference on the acceptor just like the 1870 * tcp_acceptor_hash_lookup below. 1871 */ 1872 acceptor = listener; 1873 CONN_INC_REF(acceptor->tcp_connp); 1874 } else { 1875 acceptor = tcp_acceptor_hash_lookup(acceptor_id, tcps); 1876 if (acceptor == NULL) { 1877 if (listener->tcp_connp->conn_debug) { 1878 (void) strlog(TCP_MOD_ID, 0, 1, 1879 SL_ERROR|SL_TRACE, 1880 "tcp_accept: did not find acceptor 0x%x\n", 1881 acceptor_id); 1882 } 1883 mutex_exit(&listener->tcp_eager_lock); 1884 tcp_err_ack(listener, mp, TPROVMISMATCH, 0); 1885 return; 1886 } 1887 /* 1888 * Verify acceptor state. The acceptable states for an acceptor 1889 * include TCPS_IDLE and TCPS_BOUND. 1890 */ 1891 switch (acceptor->tcp_state) { 1892 case TCPS_IDLE: 1893 /* FALLTHRU */ 1894 case TCPS_BOUND: 1895 break; 1896 default: 1897 CONN_DEC_REF(acceptor->tcp_connp); 1898 mutex_exit(&listener->tcp_eager_lock); 1899 tcp_err_ack(listener, mp, TOUTSTATE, 0); 1900 return; 1901 } 1902 } 1903 1904 /* The listener must be in TCPS_LISTEN */ 1905 if (listener->tcp_state != TCPS_LISTEN) { 1906 CONN_DEC_REF(acceptor->tcp_connp); 1907 mutex_exit(&listener->tcp_eager_lock); 1908 tcp_err_ack(listener, mp, TOUTSTATE, 0); 1909 return; 1910 } 1911 1912 /* 1913 * Rendezvous with an eager connection request packet hanging off 1914 * 'tcp' that has the 'seqnum' tag. We tagged the detached open 1915 * tcp structure when the connection packet arrived in 1916 * tcp_input_listener(). 1917 */ 1918 seqnum = tcr->SEQ_number; 1919 eager = listener; 1920 do { 1921 eager = eager->tcp_eager_next_q; 1922 if (eager == NULL) { 1923 CONN_DEC_REF(acceptor->tcp_connp); 1924 mutex_exit(&listener->tcp_eager_lock); 1925 tcp_err_ack(listener, mp, TBADSEQ, 0); 1926 return; 1927 } 1928 } while (eager->tcp_conn_req_seqnum != seqnum); 1929 mutex_exit(&listener->tcp_eager_lock); 1930 1931 /* 1932 * At this point, both acceptor and listener have 2 ref 1933 * that they begin with. Acceptor has one additional ref 1934 * we placed in lookup while listener has 3 additional 1935 * ref for being behind the squeue (tcp_accept() is 1936 * done on listener's squeue); being in classifier hash; 1937 * and eager's ref on listener. 1938 */ 1939 ASSERT(listener->tcp_connp->conn_ref >= 5); 1940 ASSERT(acceptor->tcp_connp->conn_ref >= 3); 1941 1942 /* 1943 * The eager at this point is set in its own squeue and 1944 * could easily have been killed (tcp_accept_finish will 1945 * deal with that) because of a TH_RST so we can only 1946 * ASSERT for a single ref. 1947 */ 1948 ASSERT(eager->tcp_connp->conn_ref >= 1); 1949 1950 /* 1951 * Pre allocate the discon_ind mblk also. tcp_accept_finish will 1952 * use it if something failed. 1953 */ 1954 discon_mp = allocb(MAX(sizeof (struct T_discon_ind), 1955 sizeof (struct stroptions)), BPRI_HI); 1956 if (discon_mp == NULL) { 1957 CONN_DEC_REF(acceptor->tcp_connp); 1958 CONN_DEC_REF(eager->tcp_connp); 1959 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 1960 return; 1961 } 1962 1963 econnp = eager->tcp_connp; 1964 1965 /* Hold a copy of mp, in case reallocb fails */ 1966 if ((mp1 = copymsg(mp)) == NULL) { 1967 CONN_DEC_REF(acceptor->tcp_connp); 1968 CONN_DEC_REF(eager->tcp_connp); 1969 freemsg(discon_mp); 1970 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 1971 return; 1972 } 1973 1974 tcr = (struct T_conn_res *)mp1->b_rptr; 1975 1976 /* 1977 * This is an expanded version of mi_tpi_ok_ack_alloc() 1978 * which allocates a larger mblk and appends the new 1979 * local address to the ok_ack. The address is copied by 1980 * soaccept() for getsockname(). 1981 */ 1982 { 1983 int extra; 1984 1985 extra = (econnp->conn_family == AF_INET) ? 1986 sizeof (sin_t) : sizeof (sin6_t); 1987 1988 /* 1989 * Try to re-use mp, if possible. Otherwise, allocate 1990 * an mblk and return it as ok_mp. In any case, mp 1991 * is no longer usable upon return. 1992 */ 1993 if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) { 1994 CONN_DEC_REF(acceptor->tcp_connp); 1995 CONN_DEC_REF(eager->tcp_connp); 1996 freemsg(discon_mp); 1997 /* Original mp has been freed by now, so use mp1 */ 1998 tcp_err_ack(listener, mp1, TSYSERR, ENOMEM); 1999 return; 2000 } 2001 2002 mp = NULL; /* We should never use mp after this point */ 2003 2004 switch (extra) { 2005 case sizeof (sin_t): { 2006 sin_t *sin = (sin_t *)ok_mp->b_wptr; 2007 2008 ok_mp->b_wptr += extra; 2009 sin->sin_family = AF_INET; 2010 sin->sin_port = econnp->conn_lport; 2011 sin->sin_addr.s_addr = econnp->conn_laddr_v4; 2012 break; 2013 } 2014 case sizeof (sin6_t): { 2015 sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr; 2016 2017 ok_mp->b_wptr += extra; 2018 sin6->sin6_family = AF_INET6; 2019 sin6->sin6_port = econnp->conn_lport; 2020 sin6->sin6_addr = econnp->conn_laddr_v6; 2021 sin6->sin6_flowinfo = econnp->conn_flowinfo; 2022 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6) && 2023 (econnp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) { 2024 sin6->sin6_scope_id = 2025 econnp->conn_ixa->ixa_scopeid; 2026 } else { 2027 sin6->sin6_scope_id = 0; 2028 } 2029 sin6->__sin6_src_id = 0; 2030 break; 2031 } 2032 default: 2033 break; 2034 } 2035 ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim); 2036 } 2037 2038 /* 2039 * If there are no options we know that the T_CONN_RES will 2040 * succeed. However, we can't send the T_OK_ACK upstream until 2041 * the tcp_accept_swap is done since it would be dangerous to 2042 * let the application start using the new fd prior to the swap. 2043 */ 2044 tcp_accept_swap(listener, acceptor, eager); 2045 2046 /* 2047 * tcp_accept_swap unlinks eager from listener but does not drop 2048 * the eager's reference on the listener. 2049 */ 2050 ASSERT(eager->tcp_listener == NULL); 2051 ASSERT(listener->tcp_connp->conn_ref >= 5); 2052 2053 /* 2054 * The eager is now associated with its own queue. Insert in 2055 * the hash so that the connection can be reused for a future 2056 * T_CONN_RES. 2057 */ 2058 tcp_acceptor_hash_insert(acceptor_id, eager); 2059 2060 /* 2061 * We now do the processing of options with T_CONN_RES. 2062 * We delay till now since we wanted to have queue to pass to 2063 * option processing routines that points back to the right 2064 * instance structure which does not happen until after 2065 * tcp_accept_swap(). 2066 * 2067 * Note: 2068 * The sanity of the logic here assumes that whatever options 2069 * are appropriate to inherit from listner=>eager are done 2070 * before this point, and whatever were to be overridden (or not) 2071 * in transfer logic from eager=>acceptor in tcp_accept_swap(). 2072 * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it 2073 * before its ACCEPTOR_id comes down in T_CONN_RES ] 2074 * This may not be true at this point in time but can be fixed 2075 * independently. This option processing code starts with 2076 * the instantiated acceptor instance and the final queue at 2077 * this point. 2078 */ 2079 2080 if (tcr->OPT_length != 0) { 2081 /* Options to process */ 2082 int t_error = 0; 2083 int sys_error = 0; 2084 int do_disconnect = 0; 2085 2086 if (tcp_conprim_opt_process(eager, mp1, 2087 &do_disconnect, &t_error, &sys_error) < 0) { 2088 eager->tcp_accept_error = 1; 2089 if (do_disconnect) { 2090 /* 2091 * An option failed which does not allow 2092 * connection to be accepted. 2093 * 2094 * We allow T_CONN_RES to succeed and 2095 * put a T_DISCON_IND on the eager queue. 2096 */ 2097 ASSERT(t_error == 0 && sys_error == 0); 2098 eager->tcp_send_discon_ind = 1; 2099 } else { 2100 ASSERT(t_error != 0); 2101 freemsg(ok_mp); 2102 /* 2103 * Original mp was either freed or set 2104 * to ok_mp above, so use mp1 instead. 2105 */ 2106 tcp_err_ack(listener, mp1, t_error, sys_error); 2107 goto finish; 2108 } 2109 } 2110 /* 2111 * Most likely success in setting options (except if 2112 * eager->tcp_send_discon_ind set). 2113 * mp1 option buffer represented by OPT_length/offset 2114 * potentially modified and contains results of setting 2115 * options at this point 2116 */ 2117 } 2118 2119 /* We no longer need mp1, since all options processing has passed */ 2120 freemsg(mp1); 2121 2122 putnext(listener->tcp_connp->conn_rq, ok_mp); 2123 2124 mutex_enter(&listener->tcp_eager_lock); 2125 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 2126 tcp_t *tail; 2127 mblk_t *conn_ind; 2128 2129 /* 2130 * This path should not be executed if listener and 2131 * acceptor streams are the same. 2132 */ 2133 ASSERT(listener != acceptor); 2134 2135 tcp = listener->tcp_eager_prev_q0; 2136 /* 2137 * listener->tcp_eager_prev_q0 points to the TAIL of the 2138 * deferred T_conn_ind queue. We need to get to the head of 2139 * the queue in order to send up T_conn_ind the same order as 2140 * how the 3WHS is completed. 2141 */ 2142 while (tcp != listener) { 2143 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 2144 break; 2145 else 2146 tcp = tcp->tcp_eager_prev_q0; 2147 } 2148 ASSERT(tcp != listener); 2149 conn_ind = tcp->tcp_conn.tcp_eager_conn_ind; 2150 ASSERT(conn_ind != NULL); 2151 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 2152 2153 /* Move from q0 to q */ 2154 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 2155 listener->tcp_conn_req_cnt_q0--; 2156 listener->tcp_conn_req_cnt_q++; 2157 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 2158 tcp->tcp_eager_prev_q0; 2159 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 2160 tcp->tcp_eager_next_q0; 2161 tcp->tcp_eager_prev_q0 = NULL; 2162 tcp->tcp_eager_next_q0 = NULL; 2163 tcp->tcp_conn_def_q0 = B_FALSE; 2164 2165 /* Make sure the tcp isn't in the list of droppables */ 2166 ASSERT(tcp->tcp_eager_next_drop_q0 == NULL && 2167 tcp->tcp_eager_prev_drop_q0 == NULL); 2168 2169 /* 2170 * Insert at end of the queue because sockfs sends 2171 * down T_CONN_RES in chronological order. Leaving 2172 * the older conn indications at front of the queue 2173 * helps reducing search time. 2174 */ 2175 tail = listener->tcp_eager_last_q; 2176 if (tail != NULL) 2177 tail->tcp_eager_next_q = tcp; 2178 else 2179 listener->tcp_eager_next_q = tcp; 2180 listener->tcp_eager_last_q = tcp; 2181 tcp->tcp_eager_next_q = NULL; 2182 mutex_exit(&listener->tcp_eager_lock); 2183 putnext(tcp->tcp_connp->conn_rq, conn_ind); 2184 } else { 2185 mutex_exit(&listener->tcp_eager_lock); 2186 } 2187 2188 /* 2189 * Done with the acceptor - free it 2190 * 2191 * Note: from this point on, no access to listener should be made 2192 * as listener can be equal to acceptor. 2193 */ 2194 finish: 2195 ASSERT(acceptor->tcp_detached); 2196 acceptor->tcp_connp->conn_rq = NULL; 2197 ASSERT(!IPCL_IS_NONSTR(acceptor->tcp_connp)); 2198 acceptor->tcp_connp->conn_wq = NULL; 2199 (void) tcp_clean_death(acceptor, 0, 2); 2200 CONN_DEC_REF(acceptor->tcp_connp); 2201 2202 /* 2203 * We pass discon_mp to tcp_accept_finish to get on the right squeue. 2204 * 2205 * It will update the setting for sockfs/stream head and also take 2206 * care of any data that arrived before accept() wad called. 2207 * In case we already received a FIN then tcp_accept_finish will send up 2208 * the ordrel. It will also send up a window update if the window 2209 * has opened up. 2210 */ 2211 2212 /* 2213 * XXX: we currently have a problem if XTI application closes the 2214 * acceptor stream in between. This problem exists in on10-gate also 2215 * and is well know but nothing can be done short of major rewrite 2216 * to fix it. Now it is possible to take care of it by assigning TLI/XTI 2217 * eager same squeue as listener (we can distinguish non socket 2218 * listeners at the time of handling a SYN in tcp_input_listener) 2219 * and do most of the work that tcp_accept_finish does here itself 2220 * and then get behind the acceptor squeue to access the acceptor 2221 * queue. 2222 */ 2223 /* 2224 * We already have a ref on tcp so no need to do one before squeue_enter 2225 */ 2226 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, discon_mp, 2227 tcp_accept_finish, eager->tcp_connp, NULL, SQ_FILL, 2228 SQTAG_TCP_ACCEPT_FINISH); 2229 } 2230 2231 /* 2232 * Swap information between the eager and acceptor for a TLI/XTI client. 2233 * The sockfs accept is done on the acceptor stream and control goes 2234 * through tcp_tli_accept() and tcp_accept()/tcp_accept_swap() is not 2235 * called. In either case, both the eager and listener are in their own 2236 * perimeter (squeue) and the code has to deal with potential race. 2237 * 2238 * See the block comment on top of tcp_accept() and tcp_tli_accept(). 2239 */ 2240 static void 2241 tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager) 2242 { 2243 conn_t *econnp, *aconnp; 2244 2245 ASSERT(eager->tcp_connp->conn_rq == listener->tcp_connp->conn_rq); 2246 ASSERT(eager->tcp_detached && !acceptor->tcp_detached); 2247 ASSERT(!TCP_IS_SOCKET(acceptor)); 2248 ASSERT(!TCP_IS_SOCKET(eager)); 2249 ASSERT(!TCP_IS_SOCKET(listener)); 2250 2251 /* 2252 * Trusted Extensions may need to use a security label that is 2253 * different from the acceptor's label on MLP and MAC-Exempt 2254 * sockets. If this is the case, the required security label 2255 * already exists in econnp->conn_ixa->ixa_tsl. Since we make the 2256 * acceptor stream refer to econnp we atomatically get that label. 2257 */ 2258 2259 acceptor->tcp_detached = B_TRUE; 2260 /* 2261 * To permit stream re-use by TLI/XTI, the eager needs a copy of 2262 * the acceptor id. 2263 */ 2264 eager->tcp_acceptor_id = acceptor->tcp_acceptor_id; 2265 2266 /* remove eager from listen list... */ 2267 mutex_enter(&listener->tcp_eager_lock); 2268 tcp_eager_unlink(eager); 2269 ASSERT(eager->tcp_eager_next_q == NULL && 2270 eager->tcp_eager_last_q == NULL); 2271 ASSERT(eager->tcp_eager_next_q0 == NULL && 2272 eager->tcp_eager_prev_q0 == NULL); 2273 mutex_exit(&listener->tcp_eager_lock); 2274 2275 econnp = eager->tcp_connp; 2276 aconnp = acceptor->tcp_connp; 2277 econnp->conn_rq = aconnp->conn_rq; 2278 econnp->conn_wq = aconnp->conn_wq; 2279 econnp->conn_rq->q_ptr = econnp; 2280 econnp->conn_wq->q_ptr = econnp; 2281 2282 /* 2283 * In the TLI/XTI loopback case, we are inside the listener's squeue, 2284 * which might be a different squeue from our peer TCP instance. 2285 * For TCP Fusion, the peer expects that whenever tcp_detached is 2286 * clear, our TCP queues point to the acceptor's queues. Thus, use 2287 * membar_producer() to ensure that the assignments of conn_rq/conn_wq 2288 * above reach global visibility prior to the clearing of tcp_detached. 2289 */ 2290 membar_producer(); 2291 eager->tcp_detached = B_FALSE; 2292 2293 ASSERT(eager->tcp_ack_tid == 0); 2294 2295 econnp->conn_dev = aconnp->conn_dev; 2296 econnp->conn_minor_arena = aconnp->conn_minor_arena; 2297 2298 ASSERT(econnp->conn_minor_arena != NULL); 2299 if (econnp->conn_cred != NULL) 2300 crfree(econnp->conn_cred); 2301 econnp->conn_cred = aconnp->conn_cred; 2302 aconnp->conn_cred = NULL; 2303 econnp->conn_cpid = aconnp->conn_cpid; 2304 ASSERT(econnp->conn_netstack == aconnp->conn_netstack); 2305 ASSERT(eager->tcp_tcps == acceptor->tcp_tcps); 2306 2307 econnp->conn_zoneid = aconnp->conn_zoneid; 2308 econnp->conn_allzones = aconnp->conn_allzones; 2309 econnp->conn_ixa->ixa_zoneid = aconnp->conn_ixa->ixa_zoneid; 2310 2311 econnp->conn_mac_mode = aconnp->conn_mac_mode; 2312 econnp->conn_zone_is_global = aconnp->conn_zone_is_global; 2313 aconnp->conn_mac_mode = CONN_MAC_DEFAULT; 2314 2315 /* Do the IPC initialization */ 2316 CONN_INC_REF(econnp); 2317 2318 econnp->conn_family = aconnp->conn_family; 2319 econnp->conn_ipversion = aconnp->conn_ipversion; 2320 2321 /* Done with old IPC. Drop its ref on its connp */ 2322 CONN_DEC_REF(aconnp); 2323 } 2324 2325 2326 /* 2327 * Adapt to the information, such as rtt and rtt_sd, provided from the 2328 * DCE and IRE maintained by IP. 2329 * 2330 * Checks for multicast and broadcast destination address. 2331 * Returns zero if ok; an errno on failure. 2332 * 2333 * Note that the MSS calculation here is based on the info given in 2334 * the DCE and IRE. We do not do any calculation based on TCP options. They 2335 * will be handled in tcp_input_data() when TCP knows which options to use. 2336 * 2337 * Note on how TCP gets its parameters for a connection. 2338 * 2339 * When a tcp_t structure is allocated, it gets all the default parameters. 2340 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd, 2341 * spipe, rpipe, ... from the route metrics. Route metric overrides the 2342 * default. 2343 * 2344 * An incoming SYN with a multicast or broadcast destination address is dropped 2345 * in ip_fanout_v4/v6. 2346 * 2347 * An incoming SYN with a multicast or broadcast source address is always 2348 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in 2349 * conn_connect. 2350 * The same logic in tcp_set_destination also serves to 2351 * reject an attempt to connect to a broadcast or multicast (destination) 2352 * address. 2353 */ 2354 static int 2355 tcp_set_destination(tcp_t *tcp) 2356 { 2357 uint32_t mss_max; 2358 uint32_t mss; 2359 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 2360 conn_t *connp = tcp->tcp_connp; 2361 tcp_stack_t *tcps = tcp->tcp_tcps; 2362 iulp_t uinfo; 2363 int error; 2364 uint32_t flags; 2365 2366 flags = IPDF_LSO | IPDF_ZCOPY; 2367 /* 2368 * Make sure we have a dce for the destination to avoid dce_ident 2369 * contention for connected sockets. 2370 */ 2371 flags |= IPDF_UNIQUE_DCE; 2372 2373 if (!tcps->tcps_ignore_path_mtu) 2374 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 2375 2376 /* Use conn_lock to satify ASSERT; tcp is already serialized */ 2377 mutex_enter(&connp->conn_lock); 2378 error = conn_connect(connp, &uinfo, flags); 2379 mutex_exit(&connp->conn_lock); 2380 if (error != 0) 2381 return (error); 2382 2383 error = tcp_build_hdrs(tcp); 2384 if (error != 0) 2385 return (error); 2386 2387 tcp->tcp_localnet = uinfo.iulp_localnet; 2388 2389 if (uinfo.iulp_rtt != 0) { 2390 clock_t rto; 2391 2392 tcp->tcp_rtt_sa = uinfo.iulp_rtt; 2393 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd; 2394 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 2395 tcps->tcps_rexmit_interval_extra + 2396 (tcp->tcp_rtt_sa >> 5); 2397 2398 if (rto > tcps->tcps_rexmit_interval_max) { 2399 tcp->tcp_rto = tcps->tcps_rexmit_interval_max; 2400 } else if (rto < tcps->tcps_rexmit_interval_min) { 2401 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 2402 } else { 2403 tcp->tcp_rto = rto; 2404 } 2405 } 2406 if (uinfo.iulp_ssthresh != 0) 2407 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh; 2408 else 2409 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2410 if (uinfo.iulp_spipe > 0) { 2411 connp->conn_sndbuf = MIN(uinfo.iulp_spipe, 2412 tcps->tcps_max_buf); 2413 if (tcps->tcps_snd_lowat_fraction != 0) { 2414 connp->conn_sndlowat = connp->conn_sndbuf / 2415 tcps->tcps_snd_lowat_fraction; 2416 } 2417 (void) tcp_maxpsz_set(tcp, B_TRUE); 2418 } 2419 /* 2420 * Note that up till now, acceptor always inherits receive 2421 * window from the listener. But if there is a metrics 2422 * associated with a host, we should use that instead of 2423 * inheriting it from listener. Thus we need to pass this 2424 * info back to the caller. 2425 */ 2426 if (uinfo.iulp_rpipe > 0) { 2427 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe, 2428 tcps->tcps_max_buf); 2429 } 2430 2431 if (uinfo.iulp_rtomax > 0) { 2432 tcp->tcp_second_timer_threshold = 2433 uinfo.iulp_rtomax; 2434 } 2435 2436 /* 2437 * Use the metric option settings, iulp_tstamp_ok and 2438 * iulp_wscale_ok, only for active open. What this means 2439 * is that if the other side uses timestamp or window 2440 * scale option, TCP will also use those options. That 2441 * is for passive open. If the application sets a 2442 * large window, window scale is enabled regardless of 2443 * the value in iulp_wscale_ok. This is the behavior 2444 * since 2.6. So we keep it. 2445 * The only case left in passive open processing is the 2446 * check for SACK. 2447 * For ECN, it should probably be like SACK. But the 2448 * current value is binary, so we treat it like the other 2449 * cases. The metric only controls active open.For passive 2450 * open, the ndd param, tcp_ecn_permitted, controls the 2451 * behavior. 2452 */ 2453 if (!tcp_detached) { 2454 /* 2455 * The if check means that the following can only 2456 * be turned on by the metrics only IRE, but not off. 2457 */ 2458 if (uinfo.iulp_tstamp_ok) 2459 tcp->tcp_snd_ts_ok = B_TRUE; 2460 if (uinfo.iulp_wscale_ok) 2461 tcp->tcp_snd_ws_ok = B_TRUE; 2462 if (uinfo.iulp_sack == 2) 2463 tcp->tcp_snd_sack_ok = B_TRUE; 2464 if (uinfo.iulp_ecn_ok) 2465 tcp->tcp_ecn_ok = B_TRUE; 2466 } else { 2467 /* 2468 * Passive open. 2469 * 2470 * As above, the if check means that SACK can only be 2471 * turned on by the metric only IRE. 2472 */ 2473 if (uinfo.iulp_sack > 0) { 2474 tcp->tcp_snd_sack_ok = B_TRUE; 2475 } 2476 } 2477 2478 /* 2479 * XXX Note that currently, iulp_mtu can be as small as 68 2480 * because of PMTUd. So tcp_mss may go to negative if combined 2481 * length of all those options exceeds 28 bytes. But because 2482 * of the tcp_mss_min check below, we may not have a problem if 2483 * tcp_mss_min is of a reasonable value. The default is 1 so 2484 * the negative problem still exists. And the check defeats PMTUd. 2485 * In fact, if PMTUd finds that the MSS should be smaller than 2486 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 2487 * value. 2488 * 2489 * We do not deal with that now. All those problems related to 2490 * PMTUd will be fixed later. 2491 */ 2492 ASSERT(uinfo.iulp_mtu != 0); 2493 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu; 2494 2495 /* Sanity check for MSS value. */ 2496 if (connp->conn_ipversion == IPV4_VERSION) 2497 mss_max = tcps->tcps_mss_max_ipv4; 2498 else 2499 mss_max = tcps->tcps_mss_max_ipv6; 2500 2501 if (tcp->tcp_ipsec_overhead == 0) 2502 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 2503 2504 mss -= tcp->tcp_ipsec_overhead; 2505 2506 if (mss < tcps->tcps_mss_min) 2507 mss = tcps->tcps_mss_min; 2508 if (mss > mss_max) 2509 mss = mss_max; 2510 2511 /* Note that this is the maximum MSS, excluding all options. */ 2512 tcp->tcp_mss = mss; 2513 2514 /* 2515 * Update the tcp connection with LSO capability. 2516 */ 2517 tcp_update_lso(tcp, connp->conn_ixa); 2518 2519 /* 2520 * Initialize the ISS here now that we have the full connection ID. 2521 * The RFC 1948 method of initial sequence number generation requires 2522 * knowledge of the full connection ID before setting the ISS. 2523 */ 2524 tcp_iss_init(tcp); 2525 2526 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local); 2527 2528 /* 2529 * Make sure that conn is not marked incipient 2530 * for incoming connections. A blind 2531 * removal of incipient flag is cheaper than 2532 * check and removal. 2533 */ 2534 mutex_enter(&connp->conn_lock); 2535 connp->conn_state_flags &= ~CONN_INCIPIENT; 2536 mutex_exit(&connp->conn_lock); 2537 return (0); 2538 } 2539 2540 static void 2541 tcp_tpi_bind(tcp_t *tcp, mblk_t *mp) 2542 { 2543 int error; 2544 conn_t *connp = tcp->tcp_connp; 2545 struct sockaddr *sa; 2546 mblk_t *mp1; 2547 struct T_bind_req *tbr; 2548 int backlog; 2549 socklen_t len; 2550 sin_t *sin; 2551 sin6_t *sin6; 2552 cred_t *cr; 2553 2554 /* 2555 * All Solaris components should pass a db_credp 2556 * for this TPI message, hence we ASSERT. 2557 * But in case there is some other M_PROTO that looks 2558 * like a TPI message sent by some other kernel 2559 * component, we check and return an error. 2560 */ 2561 cr = msg_getcred(mp, NULL); 2562 ASSERT(cr != NULL); 2563 if (cr == NULL) { 2564 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 2565 return; 2566 } 2567 2568 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 2569 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 2570 if (connp->conn_debug) { 2571 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 2572 "tcp_tpi_bind: bad req, len %u", 2573 (uint_t)(mp->b_wptr - mp->b_rptr)); 2574 } 2575 tcp_err_ack(tcp, mp, TPROTO, 0); 2576 return; 2577 } 2578 /* Make sure the largest address fits */ 2579 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t), 1); 2580 if (mp1 == NULL) { 2581 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 2582 return; 2583 } 2584 mp = mp1; 2585 tbr = (struct T_bind_req *)mp->b_rptr; 2586 2587 backlog = tbr->CONIND_number; 2588 len = tbr->ADDR_length; 2589 2590 switch (len) { 2591 case 0: /* request for a generic port */ 2592 tbr->ADDR_offset = sizeof (struct T_bind_req); 2593 if (connp->conn_family == AF_INET) { 2594 tbr->ADDR_length = sizeof (sin_t); 2595 sin = (sin_t *)&tbr[1]; 2596 *sin = sin_null; 2597 sin->sin_family = AF_INET; 2598 sa = (struct sockaddr *)sin; 2599 len = sizeof (sin_t); 2600 mp->b_wptr = (uchar_t *)&sin[1]; 2601 } else { 2602 ASSERT(connp->conn_family == AF_INET6); 2603 tbr->ADDR_length = sizeof (sin6_t); 2604 sin6 = (sin6_t *)&tbr[1]; 2605 *sin6 = sin6_null; 2606 sin6->sin6_family = AF_INET6; 2607 sa = (struct sockaddr *)sin6; 2608 len = sizeof (sin6_t); 2609 mp->b_wptr = (uchar_t *)&sin6[1]; 2610 } 2611 break; 2612 2613 case sizeof (sin_t): /* Complete IPv4 address */ 2614 sa = (struct sockaddr *)mi_offset_param(mp, tbr->ADDR_offset, 2615 sizeof (sin_t)); 2616 break; 2617 2618 case sizeof (sin6_t): /* Complete IPv6 address */ 2619 sa = (struct sockaddr *)mi_offset_param(mp, 2620 tbr->ADDR_offset, sizeof (sin6_t)); 2621 break; 2622 2623 default: 2624 if (connp->conn_debug) { 2625 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 2626 "tcp_tpi_bind: bad address length, %d", 2627 tbr->ADDR_length); 2628 } 2629 tcp_err_ack(tcp, mp, TBADADDR, 0); 2630 return; 2631 } 2632 2633 if (backlog > 0) { 2634 error = tcp_do_listen(connp, sa, len, backlog, DB_CRED(mp), 2635 tbr->PRIM_type != O_T_BIND_REQ); 2636 } else { 2637 error = tcp_do_bind(connp, sa, len, DB_CRED(mp), 2638 tbr->PRIM_type != O_T_BIND_REQ); 2639 } 2640 done: 2641 if (error > 0) { 2642 tcp_err_ack(tcp, mp, TSYSERR, error); 2643 } else if (error < 0) { 2644 tcp_err_ack(tcp, mp, -error, 0); 2645 } else { 2646 /* 2647 * Update port information as sockfs/tpi needs it for checking 2648 */ 2649 if (connp->conn_family == AF_INET) { 2650 sin = (sin_t *)sa; 2651 sin->sin_port = connp->conn_lport; 2652 } else { 2653 sin6 = (sin6_t *)sa; 2654 sin6->sin6_port = connp->conn_lport; 2655 } 2656 mp->b_datap->db_type = M_PCPROTO; 2657 tbr->PRIM_type = T_BIND_ACK; 2658 putnext(connp->conn_rq, mp); 2659 } 2660 } 2661 2662 /* 2663 * If the "bind_to_req_port_only" parameter is set, if the requested port 2664 * number is available, return it, If not return 0 2665 * 2666 * If "bind_to_req_port_only" parameter is not set and 2667 * If the requested port number is available, return it. If not, return 2668 * the first anonymous port we happen across. If no anonymous ports are 2669 * available, return 0. addr is the requested local address, if any. 2670 * 2671 * In either case, when succeeding update the tcp_t to record the port number 2672 * and insert it in the bind hash table. 2673 * 2674 * Note that TCP over IPv4 and IPv6 sockets can use the same port number 2675 * without setting SO_REUSEADDR. This is needed so that they 2676 * can be viewed as two independent transport protocols. 2677 */ 2678 static in_port_t 2679 tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 2680 int reuseaddr, boolean_t quick_connect, 2681 boolean_t bind_to_req_port_only, boolean_t user_specified) 2682 { 2683 /* number of times we have run around the loop */ 2684 int count = 0; 2685 /* maximum number of times to run around the loop */ 2686 int loopmax; 2687 conn_t *connp = tcp->tcp_connp; 2688 tcp_stack_t *tcps = tcp->tcp_tcps; 2689 2690 /* 2691 * Lookup for free addresses is done in a loop and "loopmax" 2692 * influences how long we spin in the loop 2693 */ 2694 if (bind_to_req_port_only) { 2695 /* 2696 * If the requested port is busy, don't bother to look 2697 * for a new one. Setting loop maximum count to 1 has 2698 * that effect. 2699 */ 2700 loopmax = 1; 2701 } else { 2702 /* 2703 * If the requested port is busy, look for a free one 2704 * in the anonymous port range. 2705 * Set loopmax appropriately so that one does not look 2706 * forever in the case all of the anonymous ports are in use. 2707 */ 2708 if (connp->conn_anon_priv_bind) { 2709 /* 2710 * loopmax = 2711 * (IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1 2712 */ 2713 loopmax = IPPORT_RESERVED - 2714 tcps->tcps_min_anonpriv_port; 2715 } else { 2716 loopmax = (tcps->tcps_largest_anon_port - 2717 tcps->tcps_smallest_anon_port + 1); 2718 } 2719 } 2720 do { 2721 uint16_t lport; 2722 tf_t *tbf; 2723 tcp_t *ltcp; 2724 conn_t *lconnp; 2725 2726 lport = htons(port); 2727 2728 /* 2729 * Ensure that the tcp_t is not currently in the bind hash. 2730 * Hold the lock on the hash bucket to ensure that 2731 * the duplicate check plus the insertion is an atomic 2732 * operation. 2733 * 2734 * This function does an inline lookup on the bind hash list 2735 * Make sure that we access only members of tcp_t 2736 * and that we don't look at tcp_tcp, since we are not 2737 * doing a CONN_INC_REF. 2738 */ 2739 tcp_bind_hash_remove(tcp); 2740 tbf = &tcps->tcps_bind_fanout[TCP_BIND_HASH(lport)]; 2741 mutex_enter(&tbf->tf_lock); 2742 for (ltcp = tbf->tf_tcp; ltcp != NULL; 2743 ltcp = ltcp->tcp_bind_hash) { 2744 if (lport == ltcp->tcp_connp->conn_lport) 2745 break; 2746 } 2747 2748 for (; ltcp != NULL; ltcp = ltcp->tcp_bind_hash_port) { 2749 boolean_t not_socket; 2750 boolean_t exclbind; 2751 2752 lconnp = ltcp->tcp_connp; 2753 2754 /* 2755 * On a labeled system, we must treat bindings to ports 2756 * on shared IP addresses by sockets with MAC exemption 2757 * privilege as being in all zones, as there's 2758 * otherwise no way to identify the right receiver. 2759 */ 2760 if (!IPCL_BIND_ZONE_MATCH(lconnp, connp)) 2761 continue; 2762 2763 /* 2764 * If TCP_EXCLBIND is set for either the bound or 2765 * binding endpoint, the semantics of bind 2766 * is changed according to the following. 2767 * 2768 * spec = specified address (v4 or v6) 2769 * unspec = unspecified address (v4 or v6) 2770 * A = specified addresses are different for endpoints 2771 * 2772 * bound bind to allowed 2773 * ------------------------------------- 2774 * unspec unspec no 2775 * unspec spec no 2776 * spec unspec no 2777 * spec spec yes if A 2778 * 2779 * For labeled systems, SO_MAC_EXEMPT behaves the same 2780 * as TCP_EXCLBIND, except that zoneid is ignored. 2781 * 2782 * Note: 2783 * 2784 * 1. Because of TLI semantics, an endpoint can go 2785 * back from, say TCP_ESTABLISHED to TCPS_LISTEN or 2786 * TCPS_BOUND, depending on whether it is originally 2787 * a listener or not. That is why we need to check 2788 * for states greater than or equal to TCPS_BOUND 2789 * here. 2790 * 2791 * 2. Ideally, we should only check for state equals 2792 * to TCPS_LISTEN. And the following check should be 2793 * added. 2794 * 2795 * if (ltcp->tcp_state == TCPS_LISTEN || 2796 * !reuseaddr || !lconnp->conn_reuseaddr) { 2797 * ... 2798 * } 2799 * 2800 * The semantics will be changed to this. If the 2801 * endpoint on the list is in state not equal to 2802 * TCPS_LISTEN and both endpoints have SO_REUSEADDR 2803 * set, let the bind succeed. 2804 * 2805 * Because of (1), we cannot do that for TLI 2806 * endpoints. But we can do that for socket endpoints. 2807 * If in future, we can change this going back 2808 * semantics, we can use the above check for TLI also. 2809 */ 2810 not_socket = !(TCP_IS_SOCKET(ltcp) && 2811 TCP_IS_SOCKET(tcp)); 2812 exclbind = lconnp->conn_exclbind || 2813 connp->conn_exclbind; 2814 2815 if ((lconnp->conn_mac_mode != CONN_MAC_DEFAULT) || 2816 (connp->conn_mac_mode != CONN_MAC_DEFAULT) || 2817 (exclbind && (not_socket || 2818 ltcp->tcp_state <= TCPS_ESTABLISHED))) { 2819 if (V6_OR_V4_INADDR_ANY( 2820 lconnp->conn_bound_addr_v6) || 2821 V6_OR_V4_INADDR_ANY(*laddr) || 2822 IN6_ARE_ADDR_EQUAL(laddr, 2823 &lconnp->conn_bound_addr_v6)) { 2824 break; 2825 } 2826 continue; 2827 } 2828 2829 /* 2830 * Check ipversion to allow IPv4 and IPv6 sockets to 2831 * have disjoint port number spaces, if *_EXCLBIND 2832 * is not set and only if the application binds to a 2833 * specific port. We use the same autoassigned port 2834 * number space for IPv4 and IPv6 sockets. 2835 */ 2836 if (connp->conn_ipversion != lconnp->conn_ipversion && 2837 bind_to_req_port_only) 2838 continue; 2839 2840 /* 2841 * Ideally, we should make sure that the source 2842 * address, remote address, and remote port in the 2843 * four tuple for this tcp-connection is unique. 2844 * However, trying to find out the local source 2845 * address would require too much code duplication 2846 * with IP, since IP needs needs to have that code 2847 * to support userland TCP implementations. 2848 */ 2849 if (quick_connect && 2850 (ltcp->tcp_state > TCPS_LISTEN) && 2851 ((connp->conn_fport != lconnp->conn_fport) || 2852 !IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, 2853 &lconnp->conn_faddr_v6))) 2854 continue; 2855 2856 if (!reuseaddr) { 2857 /* 2858 * No socket option SO_REUSEADDR. 2859 * If existing port is bound to 2860 * a non-wildcard IP address 2861 * and the requesting stream is 2862 * bound to a distinct 2863 * different IP addresses 2864 * (non-wildcard, also), keep 2865 * going. 2866 */ 2867 if (!V6_OR_V4_INADDR_ANY(*laddr) && 2868 !V6_OR_V4_INADDR_ANY( 2869 lconnp->conn_bound_addr_v6) && 2870 !IN6_ARE_ADDR_EQUAL(laddr, 2871 &lconnp->conn_bound_addr_v6)) 2872 continue; 2873 if (ltcp->tcp_state >= TCPS_BOUND) { 2874 /* 2875 * This port is being used and 2876 * its state is >= TCPS_BOUND, 2877 * so we can't bind to it. 2878 */ 2879 break; 2880 } 2881 } else { 2882 /* 2883 * socket option SO_REUSEADDR is set on the 2884 * binding tcp_t. 2885 * 2886 * If two streams are bound to 2887 * same IP address or both addr 2888 * and bound source are wildcards 2889 * (INADDR_ANY), we want to stop 2890 * searching. 2891 * We have found a match of IP source 2892 * address and source port, which is 2893 * refused regardless of the 2894 * SO_REUSEADDR setting, so we break. 2895 */ 2896 if (IN6_ARE_ADDR_EQUAL(laddr, 2897 &lconnp->conn_bound_addr_v6) && 2898 (ltcp->tcp_state == TCPS_LISTEN || 2899 ltcp->tcp_state == TCPS_BOUND)) 2900 break; 2901 } 2902 } 2903 if (ltcp != NULL) { 2904 /* The port number is busy */ 2905 mutex_exit(&tbf->tf_lock); 2906 } else { 2907 /* 2908 * This port is ours. Insert in fanout and mark as 2909 * bound to prevent others from getting the port 2910 * number. 2911 */ 2912 tcp->tcp_state = TCPS_BOUND; 2913 connp->conn_lport = htons(port); 2914 2915 ASSERT(&tcps->tcps_bind_fanout[TCP_BIND_HASH( 2916 connp->conn_lport)] == tbf); 2917 tcp_bind_hash_insert(tbf, tcp, 1); 2918 2919 mutex_exit(&tbf->tf_lock); 2920 2921 /* 2922 * We don't want tcp_next_port_to_try to "inherit" 2923 * a port number supplied by the user in a bind. 2924 */ 2925 if (user_specified) 2926 return (port); 2927 2928 /* 2929 * This is the only place where tcp_next_port_to_try 2930 * is updated. After the update, it may or may not 2931 * be in the valid range. 2932 */ 2933 if (!connp->conn_anon_priv_bind) 2934 tcps->tcps_next_port_to_try = port + 1; 2935 return (port); 2936 } 2937 2938 if (connp->conn_anon_priv_bind) { 2939 port = tcp_get_next_priv_port(tcp); 2940 } else { 2941 if (count == 0 && user_specified) { 2942 /* 2943 * We may have to return an anonymous port. So 2944 * get one to start with. 2945 */ 2946 port = 2947 tcp_update_next_port( 2948 tcps->tcps_next_port_to_try, 2949 tcp, B_TRUE); 2950 user_specified = B_FALSE; 2951 } else { 2952 port = tcp_update_next_port(port + 1, tcp, 2953 B_FALSE); 2954 } 2955 } 2956 if (port == 0) 2957 break; 2958 2959 /* 2960 * Don't let this loop run forever in the case where 2961 * all of the anonymous ports are in use. 2962 */ 2963 } while (++count < loopmax); 2964 return (0); 2965 } 2966 2967 /* 2968 * tcp_clean_death / tcp_close_detached must not be called more than once 2969 * on a tcp. Thus every function that potentially calls tcp_clean_death 2970 * must check for the tcp state before calling tcp_clean_death. 2971 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper, 2972 * tcp_timer_handler, all check for the tcp state. 2973 */ 2974 /* ARGSUSED */ 2975 void 2976 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 2977 ip_recv_attr_t *dummy) 2978 { 2979 tcp_t *tcp = ((conn_t *)arg)->conn_tcp; 2980 2981 freemsg(mp); 2982 if (tcp->tcp_state > TCPS_BOUND) 2983 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, 2984 ETIMEDOUT, 5); 2985 } 2986 2987 /* 2988 * We are dying for some reason. Try to do it gracefully. (May be called 2989 * as writer.) 2990 * 2991 * Return -1 if the structure was not cleaned up (if the cleanup had to be 2992 * done by a service procedure). 2993 * TBD - Should the return value distinguish between the tcp_t being 2994 * freed and it being reinitialized? 2995 */ 2996 static int 2997 tcp_clean_death(tcp_t *tcp, int err, uint8_t tag) 2998 { 2999 mblk_t *mp; 3000 queue_t *q; 3001 conn_t *connp = tcp->tcp_connp; 3002 tcp_stack_t *tcps = tcp->tcp_tcps; 3003 3004 TCP_CLD_STAT(tag); 3005 3006 #if TCP_TAG_CLEAN_DEATH 3007 tcp->tcp_cleandeathtag = tag; 3008 #endif 3009 3010 if (tcp->tcp_fused) 3011 tcp_unfuse(tcp); 3012 3013 if (tcp->tcp_linger_tid != 0 && 3014 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 3015 tcp_stop_lingering(tcp); 3016 } 3017 3018 ASSERT(tcp != NULL); 3019 ASSERT((connp->conn_family == AF_INET && 3020 connp->conn_ipversion == IPV4_VERSION) || 3021 (connp->conn_family == AF_INET6 && 3022 (connp->conn_ipversion == IPV4_VERSION || 3023 connp->conn_ipversion == IPV6_VERSION))); 3024 3025 if (TCP_IS_DETACHED(tcp)) { 3026 if (tcp->tcp_hard_binding) { 3027 /* 3028 * Its an eager that we are dealing with. We close the 3029 * eager but in case a conn_ind has already gone to the 3030 * listener, let tcp_accept_finish() send a discon_ind 3031 * to the listener and drop the last reference. If the 3032 * listener doesn't even know about the eager i.e. the 3033 * conn_ind hasn't gone up, blow away the eager and drop 3034 * the last reference as well. If the conn_ind has gone 3035 * up, state should be BOUND. tcp_accept_finish 3036 * will figure out that the connection has received a 3037 * RST and will send a DISCON_IND to the application. 3038 */ 3039 tcp_closei_local(tcp); 3040 if (!tcp->tcp_tconnind_started) { 3041 CONN_DEC_REF(connp); 3042 } else { 3043 tcp->tcp_state = TCPS_BOUND; 3044 } 3045 } else { 3046 tcp_close_detached(tcp); 3047 } 3048 return (0); 3049 } 3050 3051 TCP_STAT(tcps, tcp_clean_death_nondetached); 3052 3053 q = connp->conn_rq; 3054 3055 /* Trash all inbound data */ 3056 if (!IPCL_IS_NONSTR(connp)) { 3057 ASSERT(q != NULL); 3058 flushq(q, FLUSHALL); 3059 } 3060 3061 /* 3062 * If we are at least part way open and there is error 3063 * (err==0 implies no error) 3064 * notify our client by a T_DISCON_IND. 3065 */ 3066 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 3067 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3068 !TCP_IS_SOCKET(tcp)) { 3069 /* 3070 * Send M_FLUSH according to TPI. Because sockets will 3071 * (and must) ignore FLUSHR we do that only for TPI 3072 * endpoints and sockets in STREAMS mode. 3073 */ 3074 (void) putnextctl1(q, M_FLUSH, FLUSHR); 3075 } 3076 if (connp->conn_debug) { 3077 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 3078 "tcp_clean_death: discon err %d", err); 3079 } 3080 if (IPCL_IS_NONSTR(connp)) { 3081 /* Direct socket, use upcall */ 3082 (*connp->conn_upcalls->su_disconnected)( 3083 connp->conn_upper_handle, tcp->tcp_connid, err); 3084 } else { 3085 mp = mi_tpi_discon_ind(NULL, err, 0); 3086 if (mp != NULL) { 3087 putnext(q, mp); 3088 } else { 3089 if (connp->conn_debug) { 3090 (void) strlog(TCP_MOD_ID, 0, 1, 3091 SL_ERROR|SL_TRACE, 3092 "tcp_clean_death, sending M_ERROR"); 3093 } 3094 (void) putnextctl1(q, M_ERROR, EPROTO); 3095 } 3096 } 3097 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 3098 /* SYN_SENT or SYN_RCVD */ 3099 BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); 3100 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 3101 /* ESTABLISHED or CLOSE_WAIT */ 3102 BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); 3103 } 3104 } 3105 3106 tcp_reinit(tcp); 3107 if (IPCL_IS_NONSTR(connp)) 3108 (void) tcp_do_unbind(connp); 3109 3110 return (-1); 3111 } 3112 3113 /* 3114 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 3115 * to expire, stop the wait and finish the close. 3116 */ 3117 static void 3118 tcp_stop_lingering(tcp_t *tcp) 3119 { 3120 clock_t delta = 0; 3121 tcp_stack_t *tcps = tcp->tcp_tcps; 3122 conn_t *connp = tcp->tcp_connp; 3123 3124 tcp->tcp_linger_tid = 0; 3125 if (tcp->tcp_state > TCPS_LISTEN) { 3126 tcp_acceptor_hash_remove(tcp); 3127 mutex_enter(&tcp->tcp_non_sq_lock); 3128 if (tcp->tcp_flow_stopped) { 3129 tcp_clrqfull(tcp); 3130 } 3131 mutex_exit(&tcp->tcp_non_sq_lock); 3132 3133 if (tcp->tcp_timer_tid != 0) { 3134 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 3135 tcp->tcp_timer_tid = 0; 3136 } 3137 /* 3138 * Need to cancel those timers which will not be used when 3139 * TCP is detached. This has to be done before the conn_wq 3140 * is cleared. 3141 */ 3142 tcp_timers_stop(tcp); 3143 3144 tcp->tcp_detached = B_TRUE; 3145 connp->conn_rq = NULL; 3146 connp->conn_wq = NULL; 3147 3148 if (tcp->tcp_state == TCPS_TIME_WAIT) { 3149 tcp_time_wait_append(tcp); 3150 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 3151 goto finish; 3152 } 3153 3154 /* 3155 * If delta is zero the timer event wasn't executed and was 3156 * successfully canceled. In this case we need to restart it 3157 * with the minimal delta possible. 3158 */ 3159 if (delta >= 0) { 3160 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 3161 delta ? delta : 1); 3162 } 3163 } else { 3164 tcp_closei_local(tcp); 3165 CONN_DEC_REF(connp); 3166 } 3167 finish: 3168 /* Signal closing thread that it can complete close */ 3169 mutex_enter(&tcp->tcp_closelock); 3170 tcp->tcp_detached = B_TRUE; 3171 connp->conn_rq = NULL; 3172 connp->conn_wq = NULL; 3173 3174 tcp->tcp_closed = 1; 3175 cv_signal(&tcp->tcp_closecv); 3176 mutex_exit(&tcp->tcp_closelock); 3177 } 3178 3179 /* 3180 * Handle lingering timeouts. This function is called when the SO_LINGER timeout 3181 * expires. 3182 */ 3183 static void 3184 tcp_close_linger_timeout(void *arg) 3185 { 3186 conn_t *connp = (conn_t *)arg; 3187 tcp_t *tcp = connp->conn_tcp; 3188 3189 tcp->tcp_client_errno = ETIMEDOUT; 3190 tcp_stop_lingering(tcp); 3191 } 3192 3193 static void 3194 tcp_close_common(conn_t *connp, int flags) 3195 { 3196 tcp_t *tcp = connp->conn_tcp; 3197 mblk_t *mp = &tcp->tcp_closemp; 3198 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 3199 mblk_t *bp; 3200 3201 ASSERT(connp->conn_ref >= 2); 3202 3203 /* 3204 * Mark the conn as closing. ipsq_pending_mp_add will not 3205 * add any mp to the pending mp list, after this conn has 3206 * started closing. 3207 */ 3208 mutex_enter(&connp->conn_lock); 3209 connp->conn_state_flags |= CONN_CLOSING; 3210 if (connp->conn_oper_pending_ill != NULL) 3211 conn_ioctl_cleanup_reqd = B_TRUE; 3212 CONN_INC_REF_LOCKED(connp); 3213 mutex_exit(&connp->conn_lock); 3214 tcp->tcp_closeflags = (uint8_t)flags; 3215 ASSERT(connp->conn_ref >= 3); 3216 3217 /* 3218 * tcp_closemp_used is used below without any protection of a lock 3219 * as we don't expect any one else to use it concurrently at this 3220 * point otherwise it would be a major defect. 3221 */ 3222 3223 if (mp->b_prev == NULL) 3224 tcp->tcp_closemp_used = B_TRUE; 3225 else 3226 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " 3227 "connp %p tcp %p\n", (void *)connp, (void *)tcp); 3228 3229 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 3230 3231 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp, 3232 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 3233 3234 mutex_enter(&tcp->tcp_closelock); 3235 while (!tcp->tcp_closed) { 3236 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 3237 /* 3238 * The cv_wait_sig() was interrupted. We now do the 3239 * following: 3240 * 3241 * 1) If the endpoint was lingering, we allow this 3242 * to be interrupted by cancelling the linger timeout 3243 * and closing normally. 3244 * 3245 * 2) Revert to calling cv_wait() 3246 * 3247 * We revert to using cv_wait() to avoid an 3248 * infinite loop which can occur if the calling 3249 * thread is higher priority than the squeue worker 3250 * thread and is bound to the same cpu. 3251 */ 3252 if (connp->conn_linger && connp->conn_lingertime > 0) { 3253 mutex_exit(&tcp->tcp_closelock); 3254 /* Entering squeue, bump ref count. */ 3255 CONN_INC_REF(connp); 3256 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 3257 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, 3258 tcp_linger_interrupted, connp, NULL, 3259 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 3260 mutex_enter(&tcp->tcp_closelock); 3261 } 3262 break; 3263 } 3264 } 3265 while (!tcp->tcp_closed) 3266 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 3267 mutex_exit(&tcp->tcp_closelock); 3268 3269 /* 3270 * In the case of listener streams that have eagers in the q or q0 3271 * we wait for the eagers to drop their reference to us. conn_rq and 3272 * conn_wq of the eagers point to our queues. By waiting for the 3273 * refcnt to drop to 1, we are sure that the eagers have cleaned 3274 * up their queue pointers and also dropped their references to us. 3275 */ 3276 if (tcp->tcp_wait_for_eagers) { 3277 mutex_enter(&connp->conn_lock); 3278 while (connp->conn_ref != 1) { 3279 cv_wait(&connp->conn_cv, &connp->conn_lock); 3280 } 3281 mutex_exit(&connp->conn_lock); 3282 } 3283 /* 3284 * ioctl cleanup. The mp is queued in the ipx_pending_mp. 3285 */ 3286 if (conn_ioctl_cleanup_reqd) 3287 conn_ioctl_cleanup(connp); 3288 3289 connp->conn_cpid = NOPID; 3290 } 3291 3292 static int 3293 tcp_tpi_close(queue_t *q, int flags) 3294 { 3295 conn_t *connp; 3296 3297 ASSERT(WR(q)->q_next == NULL); 3298 3299 if (flags & SO_FALLBACK) { 3300 /* 3301 * stream is being closed while in fallback 3302 * simply free the resources that were allocated 3303 */ 3304 inet_minor_free(WR(q)->q_ptr, (dev_t)(RD(q)->q_ptr)); 3305 qprocsoff(q); 3306 goto done; 3307 } 3308 3309 connp = Q_TO_CONN(q); 3310 /* 3311 * We are being closed as /dev/tcp or /dev/tcp6. 3312 */ 3313 tcp_close_common(connp, flags); 3314 3315 qprocsoff(q); 3316 inet_minor_free(connp->conn_minor_arena, connp->conn_dev); 3317 3318 /* 3319 * Drop IP's reference on the conn. This is the last reference 3320 * on the connp if the state was less than established. If the 3321 * connection has gone into timewait state, then we will have 3322 * one ref for the TCP and one more ref (total of two) for the 3323 * classifier connected hash list (a timewait connections stays 3324 * in connected hash till closed). 3325 * 3326 * We can't assert the references because there might be other 3327 * transient reference places because of some walkers or queued 3328 * packets in squeue for the timewait state. 3329 */ 3330 CONN_DEC_REF(connp); 3331 done: 3332 q->q_ptr = WR(q)->q_ptr = NULL; 3333 return (0); 3334 } 3335 3336 static int 3337 tcp_tpi_close_accept(queue_t *q) 3338 { 3339 vmem_t *minor_arena; 3340 dev_t conn_dev; 3341 3342 ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit); 3343 3344 /* 3345 * We had opened an acceptor STREAM for sockfs which is 3346 * now being closed due to some error. 3347 */ 3348 qprocsoff(q); 3349 3350 minor_arena = (vmem_t *)WR(q)->q_ptr; 3351 conn_dev = (dev_t)RD(q)->q_ptr; 3352 ASSERT(minor_arena != NULL); 3353 ASSERT(conn_dev != 0); 3354 inet_minor_free(minor_arena, conn_dev); 3355 q->q_ptr = WR(q)->q_ptr = NULL; 3356 return (0); 3357 } 3358 3359 /* 3360 * Called by tcp_close() routine via squeue when lingering is 3361 * interrupted by a signal. 3362 */ 3363 3364 /* ARGSUSED */ 3365 static void 3366 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 3367 { 3368 conn_t *connp = (conn_t *)arg; 3369 tcp_t *tcp = connp->conn_tcp; 3370 3371 freeb(mp); 3372 if (tcp->tcp_linger_tid != 0 && 3373 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 3374 tcp_stop_lingering(tcp); 3375 tcp->tcp_client_errno = EINTR; 3376 } 3377 } 3378 3379 /* 3380 * Called by streams close routine via squeues when our client blows off her 3381 * descriptor, we take this to mean: "close the stream state NOW, close the tcp 3382 * connection politely" When SO_LINGER is set (with a non-zero linger time and 3383 * it is not a nonblocking socket) then this routine sleeps until the FIN is 3384 * acked. 3385 * 3386 * NOTE: tcp_close potentially returns error when lingering. 3387 * However, the stream head currently does not pass these errors 3388 * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK 3389 * errors to the application (from tsleep()) and not errors 3390 * like ECONNRESET caused by receiving a reset packet. 3391 */ 3392 3393 /* ARGSUSED */ 3394 static void 3395 tcp_close_output(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 3396 { 3397 char *msg; 3398 conn_t *connp = (conn_t *)arg; 3399 tcp_t *tcp = connp->conn_tcp; 3400 clock_t delta = 0; 3401 tcp_stack_t *tcps = tcp->tcp_tcps; 3402 3403 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 3404 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 3405 3406 mutex_enter(&tcp->tcp_eager_lock); 3407 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 3408 /* Cleanup for listener */ 3409 tcp_eager_cleanup(tcp, 0); 3410 tcp->tcp_wait_for_eagers = 1; 3411 } 3412 mutex_exit(&tcp->tcp_eager_lock); 3413 3414 tcp->tcp_lso = B_FALSE; 3415 3416 msg = NULL; 3417 switch (tcp->tcp_state) { 3418 case TCPS_CLOSED: 3419 case TCPS_IDLE: 3420 case TCPS_BOUND: 3421 case TCPS_LISTEN: 3422 break; 3423 case TCPS_SYN_SENT: 3424 msg = "tcp_close, during connect"; 3425 break; 3426 case TCPS_SYN_RCVD: 3427 /* 3428 * Close during the connect 3-way handshake 3429 * but here there may or may not be pending data 3430 * already on queue. Process almost same as in 3431 * the ESTABLISHED state. 3432 */ 3433 /* FALLTHRU */ 3434 default: 3435 if (tcp->tcp_fused) 3436 tcp_unfuse(tcp); 3437 3438 /* 3439 * If SO_LINGER has set a zero linger time, abort the 3440 * connection with a reset. 3441 */ 3442 if (connp->conn_linger && connp->conn_lingertime == 0) { 3443 msg = "tcp_close, zero lingertime"; 3444 break; 3445 } 3446 3447 /* 3448 * Abort connection if there is unread data queued. 3449 */ 3450 if (tcp->tcp_rcv_list || tcp->tcp_reass_head) { 3451 msg = "tcp_close, unread data"; 3452 break; 3453 } 3454 /* 3455 * We have done a qwait() above which could have possibly 3456 * drained more messages in turn causing transition to a 3457 * different state. Check whether we have to do the rest 3458 * of the processing or not. 3459 */ 3460 if (tcp->tcp_state <= TCPS_LISTEN) 3461 break; 3462 3463 /* 3464 * Transmit the FIN before detaching the tcp_t. 3465 * After tcp_detach returns this queue/perimeter 3466 * no longer owns the tcp_t thus others can modify it. 3467 */ 3468 (void) tcp_xmit_end(tcp); 3469 3470 /* 3471 * If lingering on close then wait until the fin is acked, 3472 * the SO_LINGER time passes, or a reset is sent/received. 3473 */ 3474 if (connp->conn_linger && connp->conn_lingertime > 0 && 3475 !(tcp->tcp_fin_acked) && 3476 tcp->tcp_state >= TCPS_ESTABLISHED) { 3477 if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) { 3478 tcp->tcp_client_errno = EWOULDBLOCK; 3479 } else if (tcp->tcp_client_errno == 0) { 3480 3481 ASSERT(tcp->tcp_linger_tid == 0); 3482 3483 tcp->tcp_linger_tid = TCP_TIMER(tcp, 3484 tcp_close_linger_timeout, 3485 connp->conn_lingertime * hz); 3486 3487 /* tcp_close_linger_timeout will finish close */ 3488 if (tcp->tcp_linger_tid == 0) 3489 tcp->tcp_client_errno = ENOSR; 3490 else 3491 return; 3492 } 3493 3494 /* 3495 * Check if we need to detach or just close 3496 * the instance. 3497 */ 3498 if (tcp->tcp_state <= TCPS_LISTEN) 3499 break; 3500 } 3501 3502 /* 3503 * Make sure that no other thread will access the conn_rq of 3504 * this instance (through lookups etc.) as conn_rq will go 3505 * away shortly. 3506 */ 3507 tcp_acceptor_hash_remove(tcp); 3508 3509 mutex_enter(&tcp->tcp_non_sq_lock); 3510 if (tcp->tcp_flow_stopped) { 3511 tcp_clrqfull(tcp); 3512 } 3513 mutex_exit(&tcp->tcp_non_sq_lock); 3514 3515 if (tcp->tcp_timer_tid != 0) { 3516 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 3517 tcp->tcp_timer_tid = 0; 3518 } 3519 /* 3520 * Need to cancel those timers which will not be used when 3521 * TCP is detached. This has to be done before the conn_wq 3522 * is set to NULL. 3523 */ 3524 tcp_timers_stop(tcp); 3525 3526 tcp->tcp_detached = B_TRUE; 3527 if (tcp->tcp_state == TCPS_TIME_WAIT) { 3528 tcp_time_wait_append(tcp); 3529 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 3530 ASSERT(connp->conn_ref >= 3); 3531 goto finish; 3532 } 3533 3534 /* 3535 * If delta is zero the timer event wasn't executed and was 3536 * successfully canceled. In this case we need to restart it 3537 * with the minimal delta possible. 3538 */ 3539 if (delta >= 0) 3540 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 3541 delta ? delta : 1); 3542 3543 ASSERT(connp->conn_ref >= 3); 3544 goto finish; 3545 } 3546 3547 /* Detach did not complete. Still need to remove q from stream. */ 3548 if (msg) { 3549 if (tcp->tcp_state == TCPS_ESTABLISHED || 3550 tcp->tcp_state == TCPS_CLOSE_WAIT) 3551 BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); 3552 if (tcp->tcp_state == TCPS_SYN_SENT || 3553 tcp->tcp_state == TCPS_SYN_RCVD) 3554 BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); 3555 tcp_xmit_ctl(msg, tcp, tcp->tcp_snxt, 0, TH_RST); 3556 } 3557 3558 tcp_closei_local(tcp); 3559 CONN_DEC_REF(connp); 3560 ASSERT(connp->conn_ref >= 2); 3561 3562 finish: 3563 mutex_enter(&tcp->tcp_closelock); 3564 /* 3565 * Don't change the queues in the case of a listener that has 3566 * eagers in its q or q0. It could surprise the eagers. 3567 * Instead wait for the eagers outside the squeue. 3568 */ 3569 if (!tcp->tcp_wait_for_eagers) { 3570 tcp->tcp_detached = B_TRUE; 3571 connp->conn_rq = NULL; 3572 connp->conn_wq = NULL; 3573 } 3574 3575 /* Signal tcp_close() to finish closing. */ 3576 tcp->tcp_closed = 1; 3577 cv_signal(&tcp->tcp_closecv); 3578 mutex_exit(&tcp->tcp_closelock); 3579 } 3580 3581 /* 3582 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 3583 * Some stream heads get upset if they see these later on as anything but NULL. 3584 */ 3585 static void 3586 tcp_close_mpp(mblk_t **mpp) 3587 { 3588 mblk_t *mp; 3589 3590 if ((mp = *mpp) != NULL) { 3591 do { 3592 mp->b_next = NULL; 3593 mp->b_prev = NULL; 3594 } while ((mp = mp->b_cont) != NULL); 3595 3596 mp = *mpp; 3597 *mpp = NULL; 3598 freemsg(mp); 3599 } 3600 } 3601 3602 /* Do detached close. */ 3603 static void 3604 tcp_close_detached(tcp_t *tcp) 3605 { 3606 if (tcp->tcp_fused) 3607 tcp_unfuse(tcp); 3608 3609 /* 3610 * Clustering code serializes TCP disconnect callbacks and 3611 * cluster tcp list walks by blocking a TCP disconnect callback 3612 * if a cluster tcp list walk is in progress. This ensures 3613 * accurate accounting of TCPs in the cluster code even though 3614 * the TCP list walk itself is not atomic. 3615 */ 3616 tcp_closei_local(tcp); 3617 CONN_DEC_REF(tcp->tcp_connp); 3618 } 3619 3620 /* 3621 * Stop all TCP timers, and free the timer mblks if requested. 3622 */ 3623 void 3624 tcp_timers_stop(tcp_t *tcp) 3625 { 3626 if (tcp->tcp_timer_tid != 0) { 3627 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 3628 tcp->tcp_timer_tid = 0; 3629 } 3630 if (tcp->tcp_ka_tid != 0) { 3631 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); 3632 tcp->tcp_ka_tid = 0; 3633 } 3634 if (tcp->tcp_ack_tid != 0) { 3635 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 3636 tcp->tcp_ack_tid = 0; 3637 } 3638 if (tcp->tcp_push_tid != 0) { 3639 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 3640 tcp->tcp_push_tid = 0; 3641 } 3642 } 3643 3644 /* 3645 * The tcp_t is going away. Remove it from all lists and set it 3646 * to TCPS_CLOSED. The freeing up of memory is deferred until 3647 * tcp_inactive. This is needed since a thread in tcp_rput might have 3648 * done a CONN_INC_REF on this structure before it was removed from the 3649 * hashes. 3650 */ 3651 static void 3652 tcp_closei_local(tcp_t *tcp) 3653 { 3654 conn_t *connp = tcp->tcp_connp; 3655 tcp_stack_t *tcps = tcp->tcp_tcps; 3656 3657 if (!TCP_IS_SOCKET(tcp)) 3658 tcp_acceptor_hash_remove(tcp); 3659 3660 UPDATE_MIB(&tcps->tcps_mib, tcpHCInSegs, tcp->tcp_ibsegs); 3661 tcp->tcp_ibsegs = 0; 3662 UPDATE_MIB(&tcps->tcps_mib, tcpHCOutSegs, tcp->tcp_obsegs); 3663 tcp->tcp_obsegs = 0; 3664 3665 /* 3666 * If we are an eager connection hanging off a listener that 3667 * hasn't formally accepted the connection yet, get off his 3668 * list and blow off any data that we have accumulated. 3669 */ 3670 if (tcp->tcp_listener != NULL) { 3671 tcp_t *listener = tcp->tcp_listener; 3672 mutex_enter(&listener->tcp_eager_lock); 3673 /* 3674 * tcp_tconnind_started == B_TRUE means that the 3675 * conn_ind has already gone to listener. At 3676 * this point, eager will be closed but we 3677 * leave it in listeners eager list so that 3678 * if listener decides to close without doing 3679 * accept, we can clean this up. In tcp_tli_accept 3680 * we take care of the case of accept on closed 3681 * eager. 3682 */ 3683 if (!tcp->tcp_tconnind_started) { 3684 tcp_eager_unlink(tcp); 3685 mutex_exit(&listener->tcp_eager_lock); 3686 /* 3687 * We don't want to have any pointers to the 3688 * listener queue, after we have released our 3689 * reference on the listener 3690 */ 3691 ASSERT(tcp->tcp_detached); 3692 connp->conn_rq = NULL; 3693 connp->conn_wq = NULL; 3694 CONN_DEC_REF(listener->tcp_connp); 3695 } else { 3696 mutex_exit(&listener->tcp_eager_lock); 3697 } 3698 } 3699 3700 /* Stop all the timers */ 3701 tcp_timers_stop(tcp); 3702 3703 if (tcp->tcp_state == TCPS_LISTEN) { 3704 if (tcp->tcp_ip_addr_cache) { 3705 kmem_free((void *)tcp->tcp_ip_addr_cache, 3706 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 3707 tcp->tcp_ip_addr_cache = NULL; 3708 } 3709 } 3710 mutex_enter(&tcp->tcp_non_sq_lock); 3711 if (tcp->tcp_flow_stopped) 3712 tcp_clrqfull(tcp); 3713 mutex_exit(&tcp->tcp_non_sq_lock); 3714 3715 tcp_bind_hash_remove(tcp); 3716 /* 3717 * If the tcp_time_wait_collector (which runs outside the squeue) 3718 * is trying to remove this tcp from the time wait list, we will 3719 * block in tcp_time_wait_remove while trying to acquire the 3720 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 3721 * requires the ipcl_hash_remove to be ordered after the 3722 * tcp_time_wait_remove for the refcnt checks to work correctly. 3723 */ 3724 if (tcp->tcp_state == TCPS_TIME_WAIT) 3725 (void) tcp_time_wait_remove(tcp, NULL); 3726 CL_INET_DISCONNECT(connp); 3727 ipcl_hash_remove(connp); 3728 ixa_cleanup(connp->conn_ixa); 3729 3730 /* 3731 * Mark the conn as CONDEMNED 3732 */ 3733 mutex_enter(&connp->conn_lock); 3734 connp->conn_state_flags |= CONN_CONDEMNED; 3735 mutex_exit(&connp->conn_lock); 3736 3737 /* Need to cleanup any pending ioctls */ 3738 ASSERT(tcp->tcp_time_wait_next == NULL); 3739 ASSERT(tcp->tcp_time_wait_prev == NULL); 3740 ASSERT(tcp->tcp_time_wait_expire == 0); 3741 tcp->tcp_state = TCPS_CLOSED; 3742 3743 /* Release any SSL context */ 3744 if (tcp->tcp_kssl_ent != NULL) { 3745 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 3746 tcp->tcp_kssl_ent = NULL; 3747 } 3748 if (tcp->tcp_kssl_ctx != NULL) { 3749 kssl_release_ctx(tcp->tcp_kssl_ctx); 3750 tcp->tcp_kssl_ctx = NULL; 3751 } 3752 tcp->tcp_kssl_pending = B_FALSE; 3753 3754 tcp_ipsec_cleanup(tcp); 3755 } 3756 3757 /* 3758 * tcp is dying (called from ipcl_conn_destroy and error cases). 3759 * Free the tcp_t in either case. 3760 */ 3761 void 3762 tcp_free(tcp_t *tcp) 3763 { 3764 mblk_t *mp; 3765 conn_t *connp = tcp->tcp_connp; 3766 3767 ASSERT(tcp != NULL); 3768 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 3769 3770 connp->conn_rq = NULL; 3771 connp->conn_wq = NULL; 3772 3773 tcp_close_mpp(&tcp->tcp_xmit_head); 3774 tcp_close_mpp(&tcp->tcp_reass_head); 3775 if (tcp->tcp_rcv_list != NULL) { 3776 /* Free b_next chain */ 3777 tcp_close_mpp(&tcp->tcp_rcv_list); 3778 } 3779 if ((mp = tcp->tcp_urp_mp) != NULL) { 3780 freemsg(mp); 3781 } 3782 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 3783 freemsg(mp); 3784 } 3785 3786 if (tcp->tcp_fused_sigurg_mp != NULL) { 3787 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 3788 freeb(tcp->tcp_fused_sigurg_mp); 3789 tcp->tcp_fused_sigurg_mp = NULL; 3790 } 3791 3792 if (tcp->tcp_ordrel_mp != NULL) { 3793 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 3794 freeb(tcp->tcp_ordrel_mp); 3795 tcp->tcp_ordrel_mp = NULL; 3796 } 3797 3798 if (tcp->tcp_sack_info != NULL) { 3799 if (tcp->tcp_notsack_list != NULL) { 3800 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 3801 tcp); 3802 } 3803 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 3804 } 3805 3806 if (tcp->tcp_hopopts != NULL) { 3807 mi_free(tcp->tcp_hopopts); 3808 tcp->tcp_hopopts = NULL; 3809 tcp->tcp_hopoptslen = 0; 3810 } 3811 ASSERT(tcp->tcp_hopoptslen == 0); 3812 if (tcp->tcp_dstopts != NULL) { 3813 mi_free(tcp->tcp_dstopts); 3814 tcp->tcp_dstopts = NULL; 3815 tcp->tcp_dstoptslen = 0; 3816 } 3817 ASSERT(tcp->tcp_dstoptslen == 0); 3818 if (tcp->tcp_rthdrdstopts != NULL) { 3819 mi_free(tcp->tcp_rthdrdstopts); 3820 tcp->tcp_rthdrdstopts = NULL; 3821 tcp->tcp_rthdrdstoptslen = 0; 3822 } 3823 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 3824 if (tcp->tcp_rthdr != NULL) { 3825 mi_free(tcp->tcp_rthdr); 3826 tcp->tcp_rthdr = NULL; 3827 tcp->tcp_rthdrlen = 0; 3828 } 3829 ASSERT(tcp->tcp_rthdrlen == 0); 3830 3831 /* 3832 * Following is really a blowing away a union. 3833 * It happens to have exactly two members of identical size 3834 * the following code is enough. 3835 */ 3836 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 3837 } 3838 3839 3840 /* 3841 * Put a connection confirmation message upstream built from the 3842 * address/flowid information with the conn and iph. Report our success or 3843 * failure. 3844 */ 3845 static boolean_t 3846 tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, mblk_t *idmp, 3847 mblk_t **defermp, ip_recv_attr_t *ira) 3848 { 3849 sin_t sin; 3850 sin6_t sin6; 3851 mblk_t *mp; 3852 char *optp = NULL; 3853 int optlen = 0; 3854 conn_t *connp = tcp->tcp_connp; 3855 3856 if (defermp != NULL) 3857 *defermp = NULL; 3858 3859 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) { 3860 /* 3861 * Return in T_CONN_CON results of option negotiation through 3862 * the T_CONN_REQ. Note: If there is an real end-to-end option 3863 * negotiation, then what is received from remote end needs 3864 * to be taken into account but there is no such thing (yet?) 3865 * in our TCP/IP. 3866 * Note: We do not use mi_offset_param() here as 3867 * tcp_opts_conn_req contents do not directly come from 3868 * an application and are either generated in kernel or 3869 * from user input that was already verified. 3870 */ 3871 mp = tcp->tcp_conn.tcp_opts_conn_req; 3872 optp = (char *)(mp->b_rptr + 3873 ((struct T_conn_req *)mp->b_rptr)->OPT_offset); 3874 optlen = (int) 3875 ((struct T_conn_req *)mp->b_rptr)->OPT_length; 3876 } 3877 3878 if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) { 3879 3880 /* packet is IPv4 */ 3881 if (connp->conn_family == AF_INET) { 3882 sin = sin_null; 3883 sin.sin_addr.s_addr = connp->conn_faddr_v4; 3884 sin.sin_port = connp->conn_fport; 3885 sin.sin_family = AF_INET; 3886 mp = mi_tpi_conn_con(NULL, (char *)&sin, 3887 (int)sizeof (sin_t), optp, optlen); 3888 } else { 3889 sin6 = sin6_null; 3890 sin6.sin6_addr = connp->conn_faddr_v6; 3891 sin6.sin6_port = connp->conn_fport; 3892 sin6.sin6_family = AF_INET6; 3893 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 3894 (int)sizeof (sin6_t), optp, optlen); 3895 3896 } 3897 } else { 3898 ip6_t *ip6h = (ip6_t *)iphdr; 3899 3900 ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION); 3901 ASSERT(connp->conn_family == AF_INET6); 3902 sin6 = sin6_null; 3903 sin6.sin6_addr = connp->conn_faddr_v6; 3904 sin6.sin6_port = connp->conn_fport; 3905 sin6.sin6_family = AF_INET6; 3906 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 3907 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 3908 (int)sizeof (sin6_t), optp, optlen); 3909 } 3910 3911 if (!mp) 3912 return (B_FALSE); 3913 3914 mblk_copycred(mp, idmp); 3915 3916 if (defermp == NULL) { 3917 conn_t *connp = tcp->tcp_connp; 3918 if (IPCL_IS_NONSTR(connp)) { 3919 (*connp->conn_upcalls->su_connected) 3920 (connp->conn_upper_handle, tcp->tcp_connid, 3921 ira->ira_cred, ira->ira_cpid); 3922 freemsg(mp); 3923 } else { 3924 if (ira->ira_cred != NULL) { 3925 /* So that getpeerucred works for TPI sockfs */ 3926 mblk_setcred(mp, ira->ira_cred, ira->ira_cpid); 3927 } 3928 putnext(connp->conn_rq, mp); 3929 } 3930 } else { 3931 *defermp = mp; 3932 } 3933 3934 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 3935 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 3936 return (B_TRUE); 3937 } 3938 3939 /* 3940 * Defense for the SYN attack - 3941 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest 3942 * one from the list of droppable eagers. This list is a subset of q0. 3943 * see comments before the definition of MAKE_DROPPABLE(). 3944 * 2. Don't drop a SYN request before its first timeout. This gives every 3945 * request at least til the first timeout to complete its 3-way handshake. 3946 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 3947 * requests currently on the queue that has timed out. This will be used 3948 * as an indicator of whether an attack is under way, so that appropriate 3949 * actions can be taken. (It's incremented in tcp_timer() and decremented 3950 * either when eager goes into ESTABLISHED, or gets freed up.) 3951 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 3952 * # of timeout drops back to <= q0len/32 => SYN alert off 3953 */ 3954 static boolean_t 3955 tcp_drop_q0(tcp_t *tcp) 3956 { 3957 tcp_t *eager; 3958 mblk_t *mp; 3959 tcp_stack_t *tcps = tcp->tcp_tcps; 3960 3961 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 3962 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 3963 3964 /* Pick oldest eager from the list of droppable eagers */ 3965 eager = tcp->tcp_eager_prev_drop_q0; 3966 3967 /* If list is empty. return B_FALSE */ 3968 if (eager == tcp) { 3969 return (B_FALSE); 3970 } 3971 3972 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */ 3973 if ((mp = allocb(0, BPRI_HI)) == NULL) 3974 return (B_FALSE); 3975 3976 /* 3977 * Take this eager out from the list of droppable eagers since we are 3978 * going to drop it. 3979 */ 3980 MAKE_UNDROPPABLE(eager); 3981 3982 if (tcp->tcp_connp->conn_debug) { 3983 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 3984 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 3985 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0, 3986 tcp->tcp_conn_req_cnt_q0, 3987 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 3988 } 3989 3990 BUMP_MIB(&tcps->tcps_mib, tcpHalfOpenDrop); 3991 3992 /* Put a reference on the conn as we are enqueueing it in the sqeue */ 3993 CONN_INC_REF(eager->tcp_connp); 3994 3995 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 3996 tcp_clean_death_wrapper, eager->tcp_connp, NULL, 3997 SQ_FILL, SQTAG_TCP_DROP_Q0); 3998 3999 return (B_TRUE); 4000 } 4001 4002 /* 4003 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6 4004 */ 4005 static mblk_t * 4006 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 4007 ip_recv_attr_t *ira) 4008 { 4009 tcp_t *ltcp = lconnp->conn_tcp; 4010 tcp_t *tcp = connp->conn_tcp; 4011 mblk_t *tpi_mp; 4012 ipha_t *ipha; 4013 ip6_t *ip6h; 4014 sin6_t sin6; 4015 uint_t ifindex = ira->ira_ruifindex; 4016 tcp_stack_t *tcps = tcp->tcp_tcps; 4017 4018 if (ira->ira_flags & IRAF_IS_IPV4) { 4019 ipha = (ipha_t *)mp->b_rptr; 4020 4021 connp->conn_ipversion = IPV4_VERSION; 4022 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 4023 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 4024 connp->conn_saddr_v6 = connp->conn_laddr_v6; 4025 4026 sin6 = sin6_null; 4027 sin6.sin6_addr = connp->conn_faddr_v6; 4028 sin6.sin6_port = connp->conn_fport; 4029 sin6.sin6_family = AF_INET6; 4030 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 4031 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 4032 4033 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 4034 sin6_t sin6d; 4035 4036 sin6d = sin6_null; 4037 sin6d.sin6_addr = connp->conn_laddr_v6; 4038 sin6d.sin6_port = connp->conn_lport; 4039 sin6d.sin6_family = AF_INET; 4040 tpi_mp = mi_tpi_extconn_ind(NULL, 4041 (char *)&sin6d, sizeof (sin6_t), 4042 (char *)&tcp, 4043 (t_scalar_t)sizeof (intptr_t), 4044 (char *)&sin6d, sizeof (sin6_t), 4045 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4046 } else { 4047 tpi_mp = mi_tpi_conn_ind(NULL, 4048 (char *)&sin6, sizeof (sin6_t), 4049 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4050 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4051 } 4052 } else { 4053 ip6h = (ip6_t *)mp->b_rptr; 4054 4055 connp->conn_ipversion = IPV6_VERSION; 4056 connp->conn_laddr_v6 = ip6h->ip6_dst; 4057 connp->conn_faddr_v6 = ip6h->ip6_src; 4058 connp->conn_saddr_v6 = connp->conn_laddr_v6; 4059 4060 sin6 = sin6_null; 4061 sin6.sin6_addr = connp->conn_faddr_v6; 4062 sin6.sin6_port = connp->conn_fport; 4063 sin6.sin6_family = AF_INET6; 4064 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 4065 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 4066 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 4067 4068 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 4069 /* Pass up the scope_id of remote addr */ 4070 sin6.sin6_scope_id = ifindex; 4071 } else { 4072 sin6.sin6_scope_id = 0; 4073 } 4074 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 4075 sin6_t sin6d; 4076 4077 sin6d = sin6_null; 4078 sin6.sin6_addr = connp->conn_laddr_v6; 4079 sin6d.sin6_port = connp->conn_lport; 4080 sin6d.sin6_family = AF_INET6; 4081 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6)) 4082 sin6d.sin6_scope_id = ifindex; 4083 4084 tpi_mp = mi_tpi_extconn_ind(NULL, 4085 (char *)&sin6d, sizeof (sin6_t), 4086 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4087 (char *)&sin6d, sizeof (sin6_t), 4088 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4089 } else { 4090 tpi_mp = mi_tpi_conn_ind(NULL, 4091 (char *)&sin6, sizeof (sin6_t), 4092 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4093 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4094 } 4095 } 4096 4097 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 4098 return (tpi_mp); 4099 } 4100 4101 /* Handle a SYN on an AF_INET socket */ 4102 mblk_t * 4103 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp, 4104 ip_recv_attr_t *ira) 4105 { 4106 tcp_t *ltcp = lconnp->conn_tcp; 4107 tcp_t *tcp = connp->conn_tcp; 4108 sin_t sin; 4109 mblk_t *tpi_mp = NULL; 4110 tcp_stack_t *tcps = tcp->tcp_tcps; 4111 ipha_t *ipha; 4112 4113 ASSERT(ira->ira_flags & IRAF_IS_IPV4); 4114 ipha = (ipha_t *)mp->b_rptr; 4115 4116 connp->conn_ipversion = IPV4_VERSION; 4117 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 4118 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 4119 connp->conn_saddr_v6 = connp->conn_laddr_v6; 4120 4121 sin = sin_null; 4122 sin.sin_addr.s_addr = connp->conn_faddr_v4; 4123 sin.sin_port = connp->conn_fport; 4124 sin.sin_family = AF_INET; 4125 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) { 4126 sin_t sind; 4127 4128 sind = sin_null; 4129 sind.sin_addr.s_addr = connp->conn_laddr_v4; 4130 sind.sin_port = connp->conn_lport; 4131 sind.sin_family = AF_INET; 4132 tpi_mp = mi_tpi_extconn_ind(NULL, 4133 (char *)&sind, sizeof (sin_t), (char *)&tcp, 4134 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 4135 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4136 } else { 4137 tpi_mp = mi_tpi_conn_ind(NULL, 4138 (char *)&sin, sizeof (sin_t), 4139 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4140 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4141 } 4142 4143 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 4144 return (tpi_mp); 4145 } 4146 4147 /* 4148 * tcp_get_conn/tcp_free_conn 4149 * 4150 * tcp_get_conn is used to get a clean tcp connection structure. 4151 * It tries to reuse the connections put on the freelist by the 4152 * time_wait_collector failing which it goes to kmem_cache. This 4153 * way has two benefits compared to just allocating from and 4154 * freeing to kmem_cache. 4155 * 1) The time_wait_collector can free (which includes the cleanup) 4156 * outside the squeue. So when the interrupt comes, we have a clean 4157 * connection sitting in the freelist. Obviously, this buys us 4158 * performance. 4159 * 4160 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener 4161 * has multiple disadvantages - tying up the squeue during alloc. 4162 * But allocating the conn/tcp in IP land is also not the best since 4163 * we can't check the 'q' and 'q0' which are protected by squeue and 4164 * blindly allocate memory which might have to be freed here if we are 4165 * not allowed to accept the connection. By using the freelist and 4166 * putting the conn/tcp back in freelist, we don't pay a penalty for 4167 * allocating memory without checking 'q/q0' and freeing it if we can't 4168 * accept the connection. 4169 * 4170 * Care should be taken to put the conn back in the same squeue's freelist 4171 * from which it was allocated. Best results are obtained if conn is 4172 * allocated from listener's squeue and freed to the same. Time wait 4173 * collector will free up the freelist is the connection ends up sitting 4174 * there for too long. 4175 */ 4176 void * 4177 tcp_get_conn(void *arg, tcp_stack_t *tcps) 4178 { 4179 tcp_t *tcp = NULL; 4180 conn_t *connp = NULL; 4181 squeue_t *sqp = (squeue_t *)arg; 4182 tcp_squeue_priv_t *tcp_time_wait; 4183 netstack_t *ns; 4184 mblk_t *tcp_rsrv_mp = NULL; 4185 4186 tcp_time_wait = 4187 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 4188 4189 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 4190 tcp = tcp_time_wait->tcp_free_list; 4191 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 4192 if (tcp != NULL) { 4193 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 4194 tcp_time_wait->tcp_free_list_cnt--; 4195 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 4196 tcp->tcp_time_wait_next = NULL; 4197 connp = tcp->tcp_connp; 4198 connp->conn_flags |= IPCL_REUSED; 4199 4200 ASSERT(tcp->tcp_tcps == NULL); 4201 ASSERT(connp->conn_netstack == NULL); 4202 ASSERT(tcp->tcp_rsrv_mp != NULL); 4203 ns = tcps->tcps_netstack; 4204 netstack_hold(ns); 4205 connp->conn_netstack = ns; 4206 connp->conn_ixa->ixa_ipst = ns->netstack_ip; 4207 tcp->tcp_tcps = tcps; 4208 ipcl_globalhash_insert(connp); 4209 4210 connp->conn_ixa->ixa_notify_cookie = tcp; 4211 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify); 4212 connp->conn_recv = tcp_input_data; 4213 ASSERT(connp->conn_recvicmp == tcp_icmp_input); 4214 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp); 4215 return ((void *)connp); 4216 } 4217 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 4218 /* 4219 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until 4220 * this conn_t/tcp_t is freed at ipcl_conn_destroy(). 4221 */ 4222 tcp_rsrv_mp = allocb(0, BPRI_HI); 4223 if (tcp_rsrv_mp == NULL) 4224 return (NULL); 4225 4226 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, 4227 tcps->tcps_netstack)) == NULL) { 4228 freeb(tcp_rsrv_mp); 4229 return (NULL); 4230 } 4231 4232 tcp = connp->conn_tcp; 4233 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 4234 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL); 4235 4236 tcp->tcp_tcps = tcps; 4237 4238 connp->conn_recv = tcp_input_data; 4239 connp->conn_recvicmp = tcp_icmp_input; 4240 connp->conn_verifyicmp = tcp_verifyicmp; 4241 4242 /* 4243 * Register tcp_notify to listen to capability changes detected by IP. 4244 * This upcall is made in the context of the call to conn_ip_output 4245 * thus it is inside the squeue. 4246 */ 4247 connp->conn_ixa->ixa_notify = tcp_notify; 4248 connp->conn_ixa->ixa_notify_cookie = tcp; 4249 4250 return ((void *)connp); 4251 } 4252 4253 /* BEGIN CSTYLED */ 4254 /* 4255 * 4256 * The sockfs ACCEPT path: 4257 * ======================= 4258 * 4259 * The eager is now established in its own perimeter as soon as SYN is 4260 * received in tcp_input_listener(). When sockfs receives conn_ind, it 4261 * completes the accept processing on the acceptor STREAM. The sending 4262 * of conn_ind part is common for both sockfs listener and a TLI/XTI 4263 * listener but a TLI/XTI listener completes the accept processing 4264 * on the listener perimeter. 4265 * 4266 * Common control flow for 3 way handshake: 4267 * ---------------------------------------- 4268 * 4269 * incoming SYN (listener perimeter) -> tcp_input_listener() 4270 * 4271 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data() 4272 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 4273 * 4274 * Sockfs ACCEPT Path: 4275 * ------------------- 4276 * 4277 * open acceptor stream (tcp_open allocates tcp_tli_accept() 4278 * as STREAM entry point) 4279 * 4280 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept() 4281 * 4282 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager 4283 * association (we are not behind eager's squeue but sockfs is protecting us 4284 * and no one knows about this stream yet. The STREAMS entry point q->q_info 4285 * is changed to point at tcp_wput(). 4286 * 4287 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to 4288 * listener (done on listener's perimeter). 4289 * 4290 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish 4291 * accept. 4292 * 4293 * TLI/XTI client ACCEPT path: 4294 * --------------------------- 4295 * 4296 * soaccept() sends T_CONN_RES on the listener STREAM. 4297 * 4298 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send 4299 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()). 4300 * 4301 * Locks: 4302 * ====== 4303 * 4304 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 4305 * and listeners->tcp_eager_next_q. 4306 * 4307 * Referencing: 4308 * ============ 4309 * 4310 * 1) We start out in tcp_input_listener by eager placing a ref on 4311 * listener and listener adding eager to listeners->tcp_eager_next_q0. 4312 * 4313 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 4314 * doing so we place a ref on the eager. This ref is finally dropped at the 4315 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 4316 * reference is dropped by the squeue framework. 4317 * 4318 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 4319 * 4320 * The reference must be released by the same entity that added the reference 4321 * In the above scheme, the eager is the entity that adds and releases the 4322 * references. Note that tcp_accept_finish executes in the squeue of the eager 4323 * (albeit after it is attached to the acceptor stream). Though 1. executes 4324 * in the listener's squeue, the eager is nascent at this point and the 4325 * reference can be considered to have been added on behalf of the eager. 4326 * 4327 * Eager getting a Reset or listener closing: 4328 * ========================================== 4329 * 4330 * Once the listener and eager are linked, the listener never does the unlink. 4331 * If the listener needs to close, tcp_eager_cleanup() is called which queues 4332 * a message on all eager perimeter. The eager then does the unlink, clears 4333 * any pointers to the listener's queue and drops the reference to the 4334 * listener. The listener waits in tcp_close outside the squeue until its 4335 * refcount has dropped to 1. This ensures that the listener has waited for 4336 * all eagers to clear their association with the listener. 4337 * 4338 * Similarly, if eager decides to go away, it can unlink itself and close. 4339 * When the T_CONN_RES comes down, we check if eager has closed. Note that 4340 * the reference to eager is still valid because of the extra ref we put 4341 * in tcp_send_conn_ind. 4342 * 4343 * Listener can always locate the eager under the protection 4344 * of the listener->tcp_eager_lock, and then do a refhold 4345 * on the eager during the accept processing. 4346 * 4347 * The acceptor stream accesses the eager in the accept processing 4348 * based on the ref placed on eager before sending T_conn_ind. 4349 * The only entity that can negate this refhold is a listener close 4350 * which is mutually exclusive with an active acceptor stream. 4351 * 4352 * Eager's reference on the listener 4353 * =================================== 4354 * 4355 * If the accept happens (even on a closed eager) the eager drops its 4356 * reference on the listener at the start of tcp_accept_finish. If the 4357 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 4358 * the reference is dropped in tcp_closei_local. If the listener closes, 4359 * the reference is dropped in tcp_eager_kill. In all cases the reference 4360 * is dropped while executing in the eager's context (squeue). 4361 */ 4362 /* END CSTYLED */ 4363 4364 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 4365 4366 /* 4367 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 4368 * tcp_input_data will not see any packets for listeners since the listener 4369 * has conn_recv set to tcp_input_listener. 4370 */ 4371 /* ARGSUSED */ 4372 void 4373 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 4374 { 4375 tcpha_t *tcpha; 4376 uint32_t seg_seq; 4377 tcp_t *eager; 4378 int err; 4379 conn_t *econnp = NULL; 4380 squeue_t *new_sqp; 4381 mblk_t *mp1; 4382 uint_t ip_hdr_len; 4383 conn_t *lconnp = (conn_t *)arg; 4384 tcp_t *listener = lconnp->conn_tcp; 4385 tcp_stack_t *tcps = listener->tcp_tcps; 4386 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 4387 uint_t flags; 4388 mblk_t *tpi_mp; 4389 uint_t ifindex = ira->ira_ruifindex; 4390 4391 ip_hdr_len = ira->ira_ip_hdr_length; 4392 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len]; 4393 flags = (unsigned int)tcpha->tha_flags & 0xFF; 4394 4395 if (!(flags & TH_SYN)) { 4396 if ((flags & TH_RST) || (flags & TH_URG)) { 4397 freemsg(mp); 4398 return; 4399 } 4400 if (flags & TH_ACK) { 4401 /* Note this executes in listener's squeue */ 4402 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp); 4403 return; 4404 } 4405 4406 freemsg(mp); 4407 return; 4408 } 4409 4410 if (listener->tcp_state != TCPS_LISTEN) 4411 goto error2; 4412 4413 ASSERT(IPCL_IS_BOUND(lconnp)); 4414 4415 mutex_enter(&listener->tcp_eager_lock); 4416 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) { 4417 mutex_exit(&listener->tcp_eager_lock); 4418 TCP_STAT(tcps, tcp_listendrop); 4419 BUMP_MIB(&tcps->tcps_mib, tcpListenDrop); 4420 if (lconnp->conn_debug) { 4421 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 4422 "tcp_input_listener: listen backlog (max=%d) " 4423 "overflow (%d pending) on %s", 4424 listener->tcp_conn_req_max, 4425 listener->tcp_conn_req_cnt_q, 4426 tcp_display(listener, NULL, DISP_PORT_ONLY)); 4427 } 4428 goto error2; 4429 } 4430 4431 if (listener->tcp_conn_req_cnt_q0 >= 4432 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) { 4433 /* 4434 * Q0 is full. Drop a pending half-open req from the queue 4435 * to make room for the new SYN req. Also mark the time we 4436 * drop a SYN. 4437 * 4438 * A more aggressive defense against SYN attack will 4439 * be to set the "tcp_syn_defense" flag now. 4440 */ 4441 TCP_STAT(tcps, tcp_listendropq0); 4442 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 4443 if (!tcp_drop_q0(listener)) { 4444 mutex_exit(&listener->tcp_eager_lock); 4445 BUMP_MIB(&tcps->tcps_mib, tcpListenDropQ0); 4446 if (lconnp->conn_debug) { 4447 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 4448 "tcp_input_listener: listen half-open " 4449 "queue (max=%d) full (%d pending) on %s", 4450 tcps->tcps_conn_req_max_q0, 4451 listener->tcp_conn_req_cnt_q0, 4452 tcp_display(listener, NULL, 4453 DISP_PORT_ONLY)); 4454 } 4455 goto error2; 4456 } 4457 } 4458 mutex_exit(&listener->tcp_eager_lock); 4459 4460 /* 4461 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 4462 * or based on the ring (for packets from GLD). Otherwise it is 4463 * set based on lbolt i.e., a somewhat random number. 4464 */ 4465 ASSERT(ira->ira_sqp != NULL); 4466 new_sqp = ira->ira_sqp; 4467 4468 econnp = (conn_t *)tcp_get_conn(arg2, tcps); 4469 if (econnp == NULL) 4470 goto error2; 4471 4472 ASSERT(econnp->conn_netstack == lconnp->conn_netstack); 4473 econnp->conn_sqp = new_sqp; 4474 econnp->conn_initial_sqp = new_sqp; 4475 econnp->conn_ixa->ixa_sqp = new_sqp; 4476 4477 econnp->conn_fport = tcpha->tha_lport; 4478 econnp->conn_lport = tcpha->tha_fport; 4479 4480 err = conn_inherit_parent(lconnp, econnp); 4481 if (err != 0) 4482 goto error3; 4483 4484 ASSERT(OK_32PTR(mp->b_rptr)); 4485 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION || 4486 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION); 4487 4488 if (lconnp->conn_family == AF_INET) { 4489 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION); 4490 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira); 4491 } else { 4492 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira); 4493 } 4494 4495 if (tpi_mp == NULL) 4496 goto error3; 4497 4498 eager = econnp->conn_tcp; 4499 eager->tcp_detached = B_TRUE; 4500 SOCK_CONNID_INIT(eager->tcp_connid); 4501 4502 tcp_init_values(eager); 4503 4504 ASSERT((econnp->conn_ixa->ixa_flags & 4505 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 4506 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) == 4507 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 4508 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)); 4509 4510 if (!tcps->tcps_dev_flow_ctl) 4511 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 4512 4513 /* Prepare for diffing against previous packets */ 4514 eager->tcp_recvifindex = 0; 4515 eager->tcp_recvhops = 0xffffffffU; 4516 4517 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) { 4518 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) || 4519 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) { 4520 econnp->conn_incoming_ifindex = ifindex; 4521 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 4522 econnp->conn_ixa->ixa_scopeid = ifindex; 4523 } 4524 } 4525 4526 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) == 4527 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) && 4528 tcps->tcps_rev_src_routes) { 4529 ipha_t *ipha = (ipha_t *)mp->b_rptr; 4530 ip_pkt_t *ipp = &econnp->conn_xmit_ipp; 4531 4532 /* Source routing option copyover (reverse it) */ 4533 err = ip_find_hdr_v4(ipha, ipp, B_TRUE); 4534 if (err != 0) { 4535 freemsg(tpi_mp); 4536 goto error3; 4537 } 4538 ip_pkt_source_route_reverse_v4(ipp); 4539 } 4540 4541 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL); 4542 ASSERT(!eager->tcp_tconnind_started); 4543 /* 4544 * If the SYN came with a credential, it's a loopback packet or a 4545 * labeled packet; attach the credential to the TPI message. 4546 */ 4547 if (ira->ira_cred != NULL) 4548 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid); 4549 4550 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp; 4551 4552 /* Inherit the listener's SSL protection state */ 4553 if ((eager->tcp_kssl_ent = listener->tcp_kssl_ent) != NULL) { 4554 kssl_hold_ent(eager->tcp_kssl_ent); 4555 eager->tcp_kssl_pending = B_TRUE; 4556 } 4557 4558 /* Inherit the listener's non-STREAMS flag */ 4559 if (IPCL_IS_NONSTR(lconnp)) { 4560 econnp->conn_flags |= IPCL_NONSTR; 4561 } 4562 4563 ASSERT(eager->tcp_ordrel_mp == NULL); 4564 4565 if (!IPCL_IS_NONSTR(econnp)) { 4566 /* 4567 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that 4568 * at close time, we will always have that to send up. 4569 * Otherwise, we need to do special handling in case the 4570 * allocation fails at that time. 4571 */ 4572 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL) 4573 goto error3; 4574 } 4575 /* 4576 * Now that the IP addresses and ports are setup in econnp we 4577 * can do the IPsec policy work. 4578 */ 4579 if (ira->ira_flags & IRAF_IPSEC_SECURE) { 4580 if (lconnp->conn_policy != NULL) { 4581 /* 4582 * Inherit the policy from the listener; use 4583 * actions from ira 4584 */ 4585 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) { 4586 CONN_DEC_REF(econnp); 4587 freemsg(mp); 4588 goto error3; 4589 } 4590 } 4591 } 4592 4593 /* Inherit various TCP parameters from the listener */ 4594 eager->tcp_naglim = listener->tcp_naglim; 4595 eager->tcp_first_timer_threshold = listener->tcp_first_timer_threshold; 4596 eager->tcp_second_timer_threshold = 4597 listener->tcp_second_timer_threshold; 4598 eager->tcp_first_ctimer_threshold = 4599 listener->tcp_first_ctimer_threshold; 4600 eager->tcp_second_ctimer_threshold = 4601 listener->tcp_second_ctimer_threshold; 4602 4603 /* 4604 * tcp_set_destination() may set tcp_rwnd according to the route 4605 * metrics. If it does not, the eager's receive window will be set 4606 * to the listener's receive window later in this function. 4607 */ 4608 eager->tcp_rwnd = 0; 4609 4610 /* 4611 * Inherit listener's tcp_init_cwnd. Need to do this before 4612 * calling tcp_process_options() which set the initial cwnd. 4613 */ 4614 eager->tcp_init_cwnd = listener->tcp_init_cwnd; 4615 4616 if (is_system_labeled()) { 4617 ip_xmit_attr_t *ixa = econnp->conn_ixa; 4618 4619 ASSERT(ira->ira_tsl != NULL); 4620 /* Discard any old label */ 4621 if (ixa->ixa_free_flags & IXA_FREE_TSL) { 4622 ASSERT(ixa->ixa_tsl != NULL); 4623 label_rele(ixa->ixa_tsl); 4624 ixa->ixa_free_flags &= ~IXA_FREE_TSL; 4625 ixa->ixa_tsl = NULL; 4626 } 4627 if ((lconnp->conn_mlp_type != mlptSingle || 4628 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) && 4629 ira->ira_tsl != NULL) { 4630 /* 4631 * If this is an MLP connection or a MAC-Exempt 4632 * connection with an unlabeled node, packets are to be 4633 * exchanged using the security label of the received 4634 * SYN packet instead of the server application's label. 4635 * tsol_check_dest called from ip_set_destination 4636 * might later update TSF_UNLABELED by replacing 4637 * ixa_tsl with a new label. 4638 */ 4639 label_hold(ira->ira_tsl); 4640 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl); 4641 DTRACE_PROBE2(mlp_syn_accept, conn_t *, 4642 econnp, ts_label_t *, ixa->ixa_tsl) 4643 } else { 4644 ixa->ixa_tsl = crgetlabel(econnp->conn_cred); 4645 DTRACE_PROBE2(syn_accept, conn_t *, 4646 econnp, ts_label_t *, ixa->ixa_tsl) 4647 } 4648 /* 4649 * conn_connect() called from tcp_set_destination will verify 4650 * the destination is allowed to receive packets at the 4651 * security label of the SYN-ACK we are generating. As part of 4652 * that, tsol_check_dest() may create a new effective label for 4653 * this connection. 4654 * Finally conn_connect() will call conn_update_label. 4655 * All that remains for TCP to do is to call 4656 * conn_build_hdr_template which is done as part of 4657 * tcp_set_destination. 4658 */ 4659 } 4660 4661 /* 4662 * Since we will clear tcp_listener before we clear tcp_detached 4663 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress 4664 * so we can tell a TCP_DETACHED_NONEAGER apart. 4665 */ 4666 eager->tcp_hard_binding = B_TRUE; 4667 4668 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[ 4669 TCP_BIND_HASH(econnp->conn_lport)], eager, 0); 4670 4671 CL_INET_CONNECT(econnp, B_FALSE, err); 4672 if (err != 0) { 4673 tcp_bind_hash_remove(eager); 4674 goto error3; 4675 } 4676 4677 /* 4678 * No need to check for multicast destination since ip will only pass 4679 * up multicasts to those that have expressed interest 4680 * TODO: what about rejecting broadcasts? 4681 * Also check that source is not a multicast or broadcast address. 4682 */ 4683 eager->tcp_state = TCPS_SYN_RCVD; 4684 SOCK_CONNID_BUMP(eager->tcp_connid); 4685 4686 /* 4687 * Adapt our mss, ttl, ... based on the remote address. 4688 */ 4689 4690 if (tcp_set_destination(eager) != 0) { 4691 BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); 4692 /* Undo the bind_hash_insert */ 4693 tcp_bind_hash_remove(eager); 4694 goto error3; 4695 } 4696 4697 /* Process all TCP options. */ 4698 tcp_process_options(eager, tcpha); 4699 4700 /* Is the other end ECN capable? */ 4701 if (tcps->tcps_ecn_permitted >= 1 && 4702 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 4703 eager->tcp_ecn_ok = B_TRUE; 4704 } 4705 4706 /* 4707 * The listener's conn_rcvbuf should be the default window size or a 4708 * window size changed via SO_RCVBUF option. First round up the 4709 * eager's tcp_rwnd to the nearest MSS. Then find out the window 4710 * scale option value if needed. Call tcp_rwnd_set() to finish the 4711 * setting. 4712 * 4713 * Note if there is a rpipe metric associated with the remote host, 4714 * we should not inherit receive window size from listener. 4715 */ 4716 eager->tcp_rwnd = MSS_ROUNDUP( 4717 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf : 4718 eager->tcp_rwnd), eager->tcp_mss); 4719 if (eager->tcp_snd_ws_ok) 4720 tcp_set_ws_value(eager); 4721 /* 4722 * Note that this is the only place tcp_rwnd_set() is called for 4723 * accepting a connection. We need to call it here instead of 4724 * after the 3-way handshake because we need to tell the other 4725 * side our rwnd in the SYN-ACK segment. 4726 */ 4727 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 4728 4729 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 && 4730 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd); 4731 4732 ASSERT(econnp->conn_rcvbuf != 0 && 4733 econnp->conn_rcvbuf == eager->tcp_rwnd); 4734 4735 /* Put a ref on the listener for the eager. */ 4736 CONN_INC_REF(lconnp); 4737 mutex_enter(&listener->tcp_eager_lock); 4738 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 4739 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0; 4740 listener->tcp_eager_next_q0 = eager; 4741 eager->tcp_eager_prev_q0 = listener; 4742 4743 /* Set tcp_listener before adding it to tcp_conn_fanout */ 4744 eager->tcp_listener = listener; 4745 eager->tcp_saved_listener = listener; 4746 4747 /* 4748 * Tag this detached tcp vector for later retrieval 4749 * by our listener client in tcp_accept(). 4750 */ 4751 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum; 4752 listener->tcp_conn_req_cnt_q0++; 4753 if (++listener->tcp_conn_req_seqnum == -1) { 4754 /* 4755 * -1 is "special" and defined in TPI as something 4756 * that should never be used in T_CONN_IND 4757 */ 4758 ++listener->tcp_conn_req_seqnum; 4759 } 4760 mutex_exit(&listener->tcp_eager_lock); 4761 4762 if (listener->tcp_syn_defense) { 4763 /* Don't drop the SYN that comes from a good IP source */ 4764 ipaddr_t *addr_cache; 4765 4766 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 4767 if (addr_cache != NULL && econnp->conn_faddr_v4 == 4768 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) { 4769 eager->tcp_dontdrop = B_TRUE; 4770 } 4771 } 4772 4773 /* 4774 * We need to insert the eager in its own perimeter but as soon 4775 * as we do that, we expose the eager to the classifier and 4776 * should not touch any field outside the eager's perimeter. 4777 * So do all the work necessary before inserting the eager 4778 * in its own perimeter. Be optimistic that conn_connect() 4779 * will succeed but undo everything if it fails. 4780 */ 4781 seg_seq = ntohl(tcpha->tha_seq); 4782 eager->tcp_irs = seg_seq; 4783 eager->tcp_rack = seg_seq; 4784 eager->tcp_rnxt = seg_seq + 1; 4785 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt); 4786 BUMP_MIB(&tcps->tcps_mib, tcpPassiveOpens); 4787 eager->tcp_state = TCPS_SYN_RCVD; 4788 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 4789 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 4790 if (mp1 == NULL) { 4791 /* 4792 * Increment the ref count as we are going to 4793 * enqueueing an mp in squeue 4794 */ 4795 CONN_INC_REF(econnp); 4796 goto error; 4797 } 4798 4799 /* 4800 * We need to start the rto timer. In normal case, we start 4801 * the timer after sending the packet on the wire (or at 4802 * least believing that packet was sent by waiting for 4803 * conn_ip_output() to return). Since this is the first packet 4804 * being sent on the wire for the eager, our initial tcp_rto 4805 * is at least tcp_rexmit_interval_min which is a fairly 4806 * large value to allow the algorithm to adjust slowly to large 4807 * fluctuations of RTT during first few transmissions. 4808 * 4809 * Starting the timer first and then sending the packet in this 4810 * case shouldn't make much difference since tcp_rexmit_interval_min 4811 * is of the order of several 100ms and starting the timer 4812 * first and then sending the packet will result in difference 4813 * of few micro seconds. 4814 * 4815 * Without this optimization, we are forced to hold the fanout 4816 * lock across the ipcl_bind_insert() and sending the packet 4817 * so that we don't race against an incoming packet (maybe RST) 4818 * for this eager. 4819 * 4820 * It is necessary to acquire an extra reference on the eager 4821 * at this point and hold it until after tcp_send_data() to 4822 * ensure against an eager close race. 4823 */ 4824 4825 CONN_INC_REF(econnp); 4826 4827 TCP_TIMER_RESTART(eager, eager->tcp_rto); 4828 4829 /* 4830 * Insert the eager in its own perimeter now. We are ready to deal 4831 * with any packets on eager. 4832 */ 4833 if (ipcl_conn_insert(econnp) != 0) 4834 goto error; 4835 4836 /* 4837 * Send the SYN-ACK. Can't use tcp_send_data since we can't update 4838 * pmtu etc; we are not on the eager's squeue 4839 */ 4840 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp); 4841 (void) conn_ip_output(mp1, econnp->conn_ixa); 4842 CONN_DEC_REF(econnp); 4843 freemsg(mp); 4844 4845 return; 4846 error: 4847 freemsg(mp1); 4848 eager->tcp_closemp_used = B_TRUE; 4849 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 4850 mp1 = &eager->tcp_closemp; 4851 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill, 4852 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2); 4853 4854 /* 4855 * If a connection already exists, send the mp to that connections so 4856 * that it can be appropriately dealt with. 4857 */ 4858 ipst = tcps->tcps_netstack->netstack_ip; 4859 4860 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) { 4861 if (!IPCL_IS_CONNECTED(econnp)) { 4862 /* 4863 * Something bad happened. ipcl_conn_insert() 4864 * failed because a connection already existed 4865 * in connected hash but we can't find it 4866 * anymore (someone blew it away). Just 4867 * free this message and hopefully remote 4868 * will retransmit at which time the SYN can be 4869 * treated as a new connection or dealth with 4870 * a TH_RST if a connection already exists. 4871 */ 4872 CONN_DEC_REF(econnp); 4873 freemsg(mp); 4874 } else { 4875 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data, 4876 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1); 4877 } 4878 } else { 4879 /* Nobody wants this packet */ 4880 freemsg(mp); 4881 } 4882 return; 4883 error3: 4884 CONN_DEC_REF(econnp); 4885 error2: 4886 freemsg(mp); 4887 } 4888 4889 /* 4890 * In an ideal case of vertical partition in NUMA architecture, its 4891 * beneficial to have the listener and all the incoming connections 4892 * tied to the same squeue. The other constraint is that incoming 4893 * connections should be tied to the squeue attached to interrupted 4894 * CPU for obvious locality reason so this leaves the listener to 4895 * be tied to the same squeue. Our only problem is that when listener 4896 * is binding, the CPU that will get interrupted by the NIC whose 4897 * IP address the listener is binding to is not even known. So 4898 * the code below allows us to change that binding at the time the 4899 * CPU is interrupted by virtue of incoming connection's squeue. 4900 * 4901 * This is usefull only in case of a listener bound to a specific IP 4902 * address. For other kind of listeners, they get bound the 4903 * very first time and there is no attempt to rebind them. 4904 */ 4905 void 4906 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2, 4907 ip_recv_attr_t *ira) 4908 { 4909 conn_t *connp = (conn_t *)arg; 4910 squeue_t *sqp = (squeue_t *)arg2; 4911 squeue_t *new_sqp; 4912 uint32_t conn_flags; 4913 4914 /* 4915 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 4916 * or based on the ring (for packets from GLD). Otherwise it is 4917 * set based on lbolt i.e., a somewhat random number. 4918 */ 4919 ASSERT(ira->ira_sqp != NULL); 4920 new_sqp = ira->ira_sqp; 4921 4922 if (connp->conn_fanout == NULL) 4923 goto done; 4924 4925 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 4926 mutex_enter(&connp->conn_fanout->connf_lock); 4927 mutex_enter(&connp->conn_lock); 4928 /* 4929 * No one from read or write side can access us now 4930 * except for already queued packets on this squeue. 4931 * But since we haven't changed the squeue yet, they 4932 * can't execute. If they are processed after we have 4933 * changed the squeue, they are sent back to the 4934 * correct squeue down below. 4935 * But a listner close can race with processing of 4936 * incoming SYN. If incoming SYN processing changes 4937 * the squeue then the listener close which is waiting 4938 * to enter the squeue would operate on the wrong 4939 * squeue. Hence we don't change the squeue here unless 4940 * the refcount is exactly the minimum refcount. The 4941 * minimum refcount of 4 is counted as - 1 each for 4942 * TCP and IP, 1 for being in the classifier hash, and 4943 * 1 for the mblk being processed. 4944 */ 4945 4946 if (connp->conn_ref != 4 || 4947 connp->conn_tcp->tcp_state != TCPS_LISTEN) { 4948 mutex_exit(&connp->conn_lock); 4949 mutex_exit(&connp->conn_fanout->connf_lock); 4950 goto done; 4951 } 4952 if (connp->conn_sqp != new_sqp) { 4953 while (connp->conn_sqp != new_sqp) 4954 (void) casptr(&connp->conn_sqp, sqp, new_sqp); 4955 /* No special MT issues for outbound ixa_sqp hint */ 4956 connp->conn_ixa->ixa_sqp = new_sqp; 4957 } 4958 4959 do { 4960 conn_flags = connp->conn_flags; 4961 conn_flags |= IPCL_FULLY_BOUND; 4962 (void) cas32(&connp->conn_flags, connp->conn_flags, 4963 conn_flags); 4964 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 4965 4966 mutex_exit(&connp->conn_fanout->connf_lock); 4967 mutex_exit(&connp->conn_lock); 4968 4969 /* 4970 * Assume we have picked a good squeue for the listener. Make 4971 * subsequent SYNs not try to change the squeue. 4972 */ 4973 connp->conn_recv = tcp_input_listener; 4974 } 4975 4976 done: 4977 if (connp->conn_sqp != sqp) { 4978 CONN_INC_REF(connp); 4979 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp, 4980 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND); 4981 } else { 4982 tcp_input_listener(connp, mp, sqp, ira); 4983 } 4984 } 4985 4986 /* 4987 * Successful connect request processing begins when our client passes 4988 * a T_CONN_REQ message into tcp_wput(), which performs function calls into 4989 * IP and the passes a T_OK_ACK (or T_ERROR_ACK upstream). 4990 * 4991 * After various error checks are completed, tcp_tpi_connect() lays 4992 * the target address and port into the composite header template. 4993 * Then we ask IP for information, including a source address if we didn't 4994 * already have one. Finally we prepare to send the SYN packet, and then 4995 * send up the T_OK_ACK reply message. 4996 */ 4997 static void 4998 tcp_tpi_connect(tcp_t *tcp, mblk_t *mp) 4999 { 5000 sin_t *sin; 5001 struct T_conn_req *tcr; 5002 struct sockaddr *sa; 5003 socklen_t len; 5004 int error; 5005 cred_t *cr; 5006 pid_t cpid; 5007 conn_t *connp = tcp->tcp_connp; 5008 queue_t *q = connp->conn_wq; 5009 5010 /* 5011 * All Solaris components should pass a db_credp 5012 * for this TPI message, hence we ASSERT. 5013 * But in case there is some other M_PROTO that looks 5014 * like a TPI message sent by some other kernel 5015 * component, we check and return an error. 5016 */ 5017 cr = msg_getcred(mp, &cpid); 5018 ASSERT(cr != NULL); 5019 if (cr == NULL) { 5020 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 5021 return; 5022 } 5023 5024 tcr = (struct T_conn_req *)mp->b_rptr; 5025 5026 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 5027 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 5028 tcp_err_ack(tcp, mp, TPROTO, 0); 5029 return; 5030 } 5031 5032 /* 5033 * Pre-allocate the T_ordrel_ind mblk so that at close time, we 5034 * will always have that to send up. Otherwise, we need to do 5035 * special handling in case the allocation fails at that time. 5036 * If the end point is TPI, the tcp_t can be reused and the 5037 * tcp_ordrel_mp may be allocated already. 5038 */ 5039 if (tcp->tcp_ordrel_mp == NULL) { 5040 if ((tcp->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL) { 5041 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 5042 return; 5043 } 5044 } 5045 5046 /* 5047 * Determine packet type based on type of address passed in 5048 * the request should contain an IPv4 or IPv6 address. 5049 * Make sure that address family matches the type of 5050 * family of the address passed down. 5051 */ 5052 switch (tcr->DEST_length) { 5053 default: 5054 tcp_err_ack(tcp, mp, TBADADDR, 0); 5055 return; 5056 5057 case (sizeof (sin_t) - sizeof (sin->sin_zero)): { 5058 /* 5059 * XXX: The check for valid DEST_length was not there 5060 * in earlier releases and some buggy 5061 * TLI apps (e.g Sybase) got away with not feeding 5062 * in sin_zero part of address. 5063 * We allow that bug to keep those buggy apps humming. 5064 * Test suites require the check on DEST_length. 5065 * We construct a new mblk with valid DEST_length 5066 * free the original so the rest of the code does 5067 * not have to keep track of this special shorter 5068 * length address case. 5069 */ 5070 mblk_t *nmp; 5071 struct T_conn_req *ntcr; 5072 sin_t *nsin; 5073 5074 nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) + 5075 tcr->OPT_length, BPRI_HI); 5076 if (nmp == NULL) { 5077 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 5078 return; 5079 } 5080 ntcr = (struct T_conn_req *)nmp->b_rptr; 5081 bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */ 5082 ntcr->PRIM_type = T_CONN_REQ; 5083 ntcr->DEST_length = sizeof (sin_t); 5084 ntcr->DEST_offset = sizeof (struct T_conn_req); 5085 5086 nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset); 5087 *nsin = sin_null; 5088 /* Get pointer to shorter address to copy from original mp */ 5089 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 5090 tcr->DEST_length); /* extract DEST_length worth of sin_t */ 5091 if (sin == NULL || !OK_32PTR((char *)sin)) { 5092 freemsg(nmp); 5093 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 5094 return; 5095 } 5096 nsin->sin_family = sin->sin_family; 5097 nsin->sin_port = sin->sin_port; 5098 nsin->sin_addr = sin->sin_addr; 5099 /* Note:nsin->sin_zero zero-fill with sin_null assign above */ 5100 nmp->b_wptr = (uchar_t *)&nsin[1]; 5101 if (tcr->OPT_length != 0) { 5102 ntcr->OPT_length = tcr->OPT_length; 5103 ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr; 5104 bcopy((uchar_t *)tcr + tcr->OPT_offset, 5105 (uchar_t *)ntcr + ntcr->OPT_offset, 5106 tcr->OPT_length); 5107 nmp->b_wptr += tcr->OPT_length; 5108 } 5109 freemsg(mp); /* original mp freed */ 5110 mp = nmp; /* re-initialize original variables */ 5111 tcr = ntcr; 5112 } 5113 /* FALLTHRU */ 5114 5115 case sizeof (sin_t): 5116 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 5117 sizeof (sin_t)); 5118 len = sizeof (sin_t); 5119 break; 5120 5121 case sizeof (sin6_t): 5122 sa = (struct sockaddr *)mi_offset_param(mp, tcr->DEST_offset, 5123 sizeof (sin6_t)); 5124 len = sizeof (sin6_t); 5125 break; 5126 } 5127 5128 error = proto_verify_ip_addr(connp->conn_family, sa, len); 5129 if (error != 0) { 5130 tcp_err_ack(tcp, mp, TSYSERR, error); 5131 return; 5132 } 5133 5134 /* 5135 * TODO: If someone in TCPS_TIME_WAIT has this dst/port we 5136 * should key on their sequence number and cut them loose. 5137 */ 5138 5139 /* 5140 * If options passed in, feed it for verification and handling 5141 */ 5142 if (tcr->OPT_length != 0) { 5143 mblk_t *ok_mp; 5144 mblk_t *discon_mp; 5145 mblk_t *conn_opts_mp; 5146 int t_error, sys_error, do_disconnect; 5147 5148 conn_opts_mp = NULL; 5149 5150 if (tcp_conprim_opt_process(tcp, mp, 5151 &do_disconnect, &t_error, &sys_error) < 0) { 5152 if (do_disconnect) { 5153 ASSERT(t_error == 0 && sys_error == 0); 5154 discon_mp = mi_tpi_discon_ind(NULL, 5155 ECONNREFUSED, 0); 5156 if (!discon_mp) { 5157 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 5158 TSYSERR, ENOMEM); 5159 return; 5160 } 5161 ok_mp = mi_tpi_ok_ack_alloc(mp); 5162 if (!ok_mp) { 5163 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 5164 TSYSERR, ENOMEM); 5165 return; 5166 } 5167 qreply(q, ok_mp); 5168 qreply(q, discon_mp); /* no flush! */ 5169 } else { 5170 ASSERT(t_error != 0); 5171 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error, 5172 sys_error); 5173 } 5174 return; 5175 } 5176 /* 5177 * Success in setting options, the mp option buffer represented 5178 * by OPT_length/offset has been potentially modified and 5179 * contains results of option processing. We copy it in 5180 * another mp to save it for potentially influencing returning 5181 * it in T_CONN_CONN. 5182 */ 5183 if (tcr->OPT_length != 0) { /* there are resulting options */ 5184 conn_opts_mp = copyb(mp); 5185 if (!conn_opts_mp) { 5186 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 5187 TSYSERR, ENOMEM); 5188 return; 5189 } 5190 ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL); 5191 tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp; 5192 /* 5193 * Note: 5194 * These resulting option negotiation can include any 5195 * end-to-end negotiation options but there no such 5196 * thing (yet?) in our TCP/IP. 5197 */ 5198 } 5199 } 5200 5201 /* call the non-TPI version */ 5202 error = tcp_do_connect(tcp->tcp_connp, sa, len, cr, cpid); 5203 if (error < 0) { 5204 mp = mi_tpi_err_ack_alloc(mp, -error, 0); 5205 } else if (error > 0) { 5206 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, error); 5207 } else { 5208 mp = mi_tpi_ok_ack_alloc(mp); 5209 } 5210 5211 /* 5212 * Note: Code below is the "failure" case 5213 */ 5214 /* return error ack and blow away saved option results if any */ 5215 connect_failed: 5216 if (mp != NULL) 5217 putnext(connp->conn_rq, mp); 5218 else { 5219 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 5220 TSYSERR, ENOMEM); 5221 } 5222 } 5223 5224 /* 5225 * Handle connect to IPv4 destinations, including connections for AF_INET6 5226 * sockets connecting to IPv4 mapped IPv6 destinations. 5227 * Returns zero if OK, a positive errno, or a negative TLI error. 5228 */ 5229 static int 5230 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport, 5231 uint_t srcid) 5232 { 5233 ipaddr_t dstaddr = *dstaddrp; 5234 uint16_t lport; 5235 conn_t *connp = tcp->tcp_connp; 5236 tcp_stack_t *tcps = tcp->tcp_tcps; 5237 int error; 5238 5239 ASSERT(connp->conn_ipversion == IPV4_VERSION); 5240 5241 /* Check for attempt to connect to INADDR_ANY */ 5242 if (dstaddr == INADDR_ANY) { 5243 /* 5244 * SunOS 4.x and 4.3 BSD allow an application 5245 * to connect a TCP socket to INADDR_ANY. 5246 * When they do this, the kernel picks the 5247 * address of one interface and uses it 5248 * instead. The kernel usually ends up 5249 * picking the address of the loopback 5250 * interface. This is an undocumented feature. 5251 * However, we provide the same thing here 5252 * in order to have source and binary 5253 * compatibility with SunOS 4.x. 5254 * Update the T_CONN_REQ (sin/sin6) since it is used to 5255 * generate the T_CONN_CON. 5256 */ 5257 dstaddr = htonl(INADDR_LOOPBACK); 5258 *dstaddrp = dstaddr; 5259 } 5260 5261 /* Handle __sin6_src_id if socket not bound to an IP address */ 5262 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) { 5263 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 5264 IPCL_ZONEID(connp), tcps->tcps_netstack); 5265 connp->conn_saddr_v6 = connp->conn_laddr_v6; 5266 } 5267 5268 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6); 5269 connp->conn_fport = dstport; 5270 5271 /* 5272 * At this point the remote destination address and remote port fields 5273 * in the tcp-four-tuple have been filled in the tcp structure. Now we 5274 * have to see which state tcp was in so we can take appropriate action. 5275 */ 5276 if (tcp->tcp_state == TCPS_IDLE) { 5277 /* 5278 * We support a quick connect capability here, allowing 5279 * clients to transition directly from IDLE to SYN_SENT 5280 * tcp_bindi will pick an unused port, insert the connection 5281 * in the bind hash and transition to BOUND state. 5282 */ 5283 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 5284 tcp, B_TRUE); 5285 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 5286 B_FALSE, B_FALSE); 5287 if (lport == 0) 5288 return (-TNOADDR); 5289 } 5290 5291 /* 5292 * Lookup the route to determine a source address and the uinfo. 5293 * If there was a source route we have tcp_ipha->ipha_dst as the first 5294 * hop. 5295 * Setup TCP parameters based on the metrics/DCE. 5296 */ 5297 error = tcp_set_destination(tcp); 5298 if (error != 0) 5299 return (error); 5300 5301 /* 5302 * Don't let an endpoint connect to itself. 5303 */ 5304 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 && 5305 connp->conn_fport == connp->conn_lport) 5306 return (-TBADADDR); 5307 5308 tcp->tcp_state = TCPS_SYN_SENT; 5309 5310 return (ipcl_conn_insert_v4(connp)); 5311 } 5312 5313 /* 5314 * Handle connect to IPv6 destinations. 5315 * Returns zero if OK, a positive errno, or a negative TLI error. 5316 */ 5317 static int 5318 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport, 5319 uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 5320 { 5321 uint16_t lport; 5322 conn_t *connp = tcp->tcp_connp; 5323 tcp_stack_t *tcps = tcp->tcp_tcps; 5324 int error; 5325 5326 ASSERT(connp->conn_family == AF_INET6); 5327 5328 /* 5329 * If we're here, it means that the destination address is a native 5330 * IPv6 address. Return an error if conn_ipversion is not IPv6. A 5331 * reason why it might not be IPv6 is if the socket was bound to an 5332 * IPv4-mapped IPv6 address. 5333 */ 5334 if (connp->conn_ipversion != IPV6_VERSION) 5335 return (-TBADADDR); 5336 5337 /* 5338 * Interpret a zero destination to mean loopback. 5339 * Update the T_CONN_REQ (sin/sin6) since it is used to 5340 * generate the T_CONN_CON. 5341 */ 5342 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) 5343 *dstaddrp = ipv6_loopback; 5344 5345 /* Handle __sin6_src_id if socket not bound to an IP address */ 5346 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) { 5347 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 5348 IPCL_ZONEID(connp), tcps->tcps_netstack); 5349 connp->conn_saddr_v6 = connp->conn_laddr_v6; 5350 } 5351 5352 /* 5353 * Take care of the scope_id now. 5354 */ 5355 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 5356 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 5357 connp->conn_ixa->ixa_scopeid = scope_id; 5358 } else { 5359 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 5360 } 5361 5362 connp->conn_flowinfo = flowinfo; 5363 connp->conn_faddr_v6 = *dstaddrp; 5364 connp->conn_fport = dstport; 5365 5366 /* 5367 * At this point the remote destination address and remote port fields 5368 * in the tcp-four-tuple have been filled in the tcp structure. Now we 5369 * have to see which state tcp was in so we can take appropriate action. 5370 */ 5371 if (tcp->tcp_state == TCPS_IDLE) { 5372 /* 5373 * We support a quick connect capability here, allowing 5374 * clients to transition directly from IDLE to SYN_SENT 5375 * tcp_bindi will pick an unused port, insert the connection 5376 * in the bind hash and transition to BOUND state. 5377 */ 5378 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 5379 tcp, B_TRUE); 5380 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 5381 B_FALSE, B_FALSE); 5382 if (lport == 0) 5383 return (-TNOADDR); 5384 } 5385 5386 /* 5387 * Lookup the route to determine a source address and the uinfo. 5388 * If there was a source route we have tcp_ip6h->ip6_dst as the first 5389 * hop. 5390 * Setup TCP parameters based on the metrics/DCE. 5391 */ 5392 error = tcp_set_destination(tcp); 5393 if (error != 0) 5394 return (error); 5395 5396 /* 5397 * Don't let an endpoint connect to itself. 5398 */ 5399 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) && 5400 connp->conn_fport == connp->conn_lport) 5401 return (-TBADADDR); 5402 5403 tcp->tcp_state = TCPS_SYN_SENT; 5404 5405 return (ipcl_conn_insert_v6(connp)); 5406 } 5407 5408 /* 5409 * Disconnect 5410 * Note that unlike other functions this returns a positive tli error 5411 * when it fails; it never returns an errno. 5412 */ 5413 static int 5414 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum) 5415 { 5416 tcp_t *ltcp = NULL; 5417 conn_t *lconnp; 5418 tcp_stack_t *tcps = tcp->tcp_tcps; 5419 conn_t *connp = tcp->tcp_connp; 5420 5421 /* 5422 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 5423 * when the stream is in BOUND state. Do not send a reset, 5424 * since the destination IP address is not valid, and it can 5425 * be the initialized value of all zeros (broadcast address). 5426 */ 5427 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) { 5428 if (connp->conn_debug) { 5429 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 5430 "tcp_disconnect: bad state, %d", tcp->tcp_state); 5431 } 5432 return (TOUTSTATE); 5433 } 5434 5435 5436 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 5437 5438 /* 5439 * According to TPI, for non-listeners, ignore seqnum 5440 * and disconnect. 5441 * Following interpretation of -1 seqnum is historical 5442 * and implied TPI ? (TPI only states that for T_CONN_IND, 5443 * a valid seqnum should not be -1). 5444 * 5445 * -1 means disconnect everything 5446 * regardless even on a listener. 5447 */ 5448 5449 int old_state = tcp->tcp_state; 5450 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 5451 5452 /* 5453 * The connection can't be on the tcp_time_wait_head list 5454 * since it is not detached. 5455 */ 5456 ASSERT(tcp->tcp_time_wait_next == NULL); 5457 ASSERT(tcp->tcp_time_wait_prev == NULL); 5458 ASSERT(tcp->tcp_time_wait_expire == 0); 5459 ltcp = NULL; 5460 /* 5461 * If it used to be a listener, check to make sure no one else 5462 * has taken the port before switching back to LISTEN state. 5463 */ 5464 if (connp->conn_ipversion == IPV4_VERSION) { 5465 lconnp = ipcl_lookup_listener_v4(connp->conn_lport, 5466 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst); 5467 if (lconnp != NULL) 5468 ltcp = lconnp->conn_tcp; 5469 } else { 5470 uint_t ifindex = 0; 5471 5472 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) 5473 ifindex = connp->conn_ixa->ixa_scopeid; 5474 5475 /* Allow conn_bound_if listeners? */ 5476 lconnp = ipcl_lookup_listener_v6(connp->conn_lport, 5477 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp), 5478 ipst); 5479 if (lconnp != NULL) 5480 ltcp = lconnp->conn_tcp; 5481 } 5482 if (tcp->tcp_conn_req_max && ltcp == NULL) { 5483 tcp->tcp_state = TCPS_LISTEN; 5484 } else if (old_state > TCPS_BOUND) { 5485 tcp->tcp_conn_req_max = 0; 5486 tcp->tcp_state = TCPS_BOUND; 5487 } 5488 if (ltcp != NULL) 5489 CONN_DEC_REF(lconnp); 5490 if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) { 5491 BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); 5492 } else if (old_state == TCPS_ESTABLISHED || 5493 old_state == TCPS_CLOSE_WAIT) { 5494 BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); 5495 } 5496 5497 if (tcp->tcp_fused) 5498 tcp_unfuse(tcp); 5499 5500 mutex_enter(&tcp->tcp_eager_lock); 5501 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 5502 (tcp->tcp_conn_req_cnt_q != 0)) { 5503 tcp_eager_cleanup(tcp, 0); 5504 } 5505 mutex_exit(&tcp->tcp_eager_lock); 5506 5507 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 5508 tcp->tcp_rnxt, TH_RST | TH_ACK); 5509 5510 tcp_reinit(tcp); 5511 5512 return (0); 5513 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 5514 return (TBADSEQ); 5515 } 5516 return (0); 5517 } 5518 5519 /* 5520 * Our client hereby directs us to reject the connection request 5521 * that tcp_input_listener() marked with 'seqnum'. Rejection consists 5522 * of sending the appropriate RST, not an ICMP error. 5523 */ 5524 static void 5525 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 5526 { 5527 t_scalar_t seqnum; 5528 int error; 5529 conn_t *connp = tcp->tcp_connp; 5530 5531 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 5532 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 5533 tcp_err_ack(tcp, mp, TPROTO, 0); 5534 return; 5535 } 5536 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 5537 error = tcp_disconnect_common(tcp, seqnum); 5538 if (error != 0) 5539 tcp_err_ack(tcp, mp, error, 0); 5540 else { 5541 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 5542 /* Send M_FLUSH according to TPI */ 5543 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 5544 } 5545 mp = mi_tpi_ok_ack_alloc(mp); 5546 if (mp != NULL) 5547 putnext(connp->conn_rq, mp); 5548 } 5549 } 5550 5551 /* 5552 * Diagnostic routine used to return a string associated with the tcp state. 5553 * Note that if the caller does not supply a buffer, it will use an internal 5554 * static string. This means that if multiple threads call this function at 5555 * the same time, output can be corrupted... Note also that this function 5556 * does not check the size of the supplied buffer. The caller has to make 5557 * sure that it is big enough. 5558 */ 5559 static char * 5560 tcp_display(tcp_t *tcp, char *sup_buf, char format) 5561 { 5562 char buf1[30]; 5563 static char priv_buf[INET6_ADDRSTRLEN * 2 + 80]; 5564 char *buf; 5565 char *cp; 5566 in6_addr_t local, remote; 5567 char local_addrbuf[INET6_ADDRSTRLEN]; 5568 char remote_addrbuf[INET6_ADDRSTRLEN]; 5569 conn_t *connp; 5570 5571 if (sup_buf != NULL) 5572 buf = sup_buf; 5573 else 5574 buf = priv_buf; 5575 5576 if (tcp == NULL) 5577 return ("NULL_TCP"); 5578 5579 connp = tcp->tcp_connp; 5580 switch (tcp->tcp_state) { 5581 case TCPS_CLOSED: 5582 cp = "TCP_CLOSED"; 5583 break; 5584 case TCPS_IDLE: 5585 cp = "TCP_IDLE"; 5586 break; 5587 case TCPS_BOUND: 5588 cp = "TCP_BOUND"; 5589 break; 5590 case TCPS_LISTEN: 5591 cp = "TCP_LISTEN"; 5592 break; 5593 case TCPS_SYN_SENT: 5594 cp = "TCP_SYN_SENT"; 5595 break; 5596 case TCPS_SYN_RCVD: 5597 cp = "TCP_SYN_RCVD"; 5598 break; 5599 case TCPS_ESTABLISHED: 5600 cp = "TCP_ESTABLISHED"; 5601 break; 5602 case TCPS_CLOSE_WAIT: 5603 cp = "TCP_CLOSE_WAIT"; 5604 break; 5605 case TCPS_FIN_WAIT_1: 5606 cp = "TCP_FIN_WAIT_1"; 5607 break; 5608 case TCPS_CLOSING: 5609 cp = "TCP_CLOSING"; 5610 break; 5611 case TCPS_LAST_ACK: 5612 cp = "TCP_LAST_ACK"; 5613 break; 5614 case TCPS_FIN_WAIT_2: 5615 cp = "TCP_FIN_WAIT_2"; 5616 break; 5617 case TCPS_TIME_WAIT: 5618 cp = "TCP_TIME_WAIT"; 5619 break; 5620 default: 5621 (void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state); 5622 cp = buf1; 5623 break; 5624 } 5625 switch (format) { 5626 case DISP_ADDR_AND_PORT: 5627 if (connp->conn_ipversion == IPV4_VERSION) { 5628 /* 5629 * Note that we use the remote address in the tcp_b 5630 * structure. This means that it will print out 5631 * the real destination address, not the next hop's 5632 * address if source routing is used. 5633 */ 5634 IN6_IPADDR_TO_V4MAPPED(connp->conn_laddr_v4, &local); 5635 IN6_IPADDR_TO_V4MAPPED(connp->conn_faddr_v4, &remote); 5636 5637 } else { 5638 local = connp->conn_laddr_v6; 5639 remote = connp->conn_faddr_v6; 5640 } 5641 (void) inet_ntop(AF_INET6, &local, local_addrbuf, 5642 sizeof (local_addrbuf)); 5643 (void) inet_ntop(AF_INET6, &remote, remote_addrbuf, 5644 sizeof (remote_addrbuf)); 5645 (void) mi_sprintf(buf, "[%s.%u, %s.%u] %s", 5646 local_addrbuf, ntohs(connp->conn_lport), remote_addrbuf, 5647 ntohs(connp->conn_fport), cp); 5648 break; 5649 case DISP_PORT_ONLY: 5650 default: 5651 (void) mi_sprintf(buf, "[%u, %u] %s", 5652 ntohs(connp->conn_lport), ntohs(connp->conn_fport), cp); 5653 break; 5654 } 5655 5656 return (buf); 5657 } 5658 5659 /* 5660 * Called via squeue to get on to eager's perimeter. It sends a 5661 * TH_RST if eager is in the fanout table. The listener wants the 5662 * eager to disappear either by means of tcp_eager_blowoff() or 5663 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be 5664 * called (via squeue) if the eager cannot be inserted in the 5665 * fanout table in tcp_input_listener(). 5666 */ 5667 /* ARGSUSED */ 5668 void 5669 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 5670 { 5671 conn_t *econnp = (conn_t *)arg; 5672 tcp_t *eager = econnp->conn_tcp; 5673 tcp_t *listener = eager->tcp_listener; 5674 5675 /* 5676 * We could be called because listener is closing. Since 5677 * the eager was using listener's queue's, we avoid 5678 * using the listeners queues from now on. 5679 */ 5680 ASSERT(eager->tcp_detached); 5681 econnp->conn_rq = NULL; 5682 econnp->conn_wq = NULL; 5683 5684 /* 5685 * An eager's conn_fanout will be NULL if it's a duplicate 5686 * for an existing 4-tuples in the conn fanout table. 5687 * We don't want to send an RST out in such case. 5688 */ 5689 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) { 5690 tcp_xmit_ctl("tcp_eager_kill, can't wait", 5691 eager, eager->tcp_snxt, 0, TH_RST); 5692 } 5693 5694 /* We are here because listener wants this eager gone */ 5695 if (listener != NULL) { 5696 mutex_enter(&listener->tcp_eager_lock); 5697 tcp_eager_unlink(eager); 5698 if (eager->tcp_tconnind_started) { 5699 /* 5700 * The eager has sent a conn_ind up to the 5701 * listener but listener decides to close 5702 * instead. We need to drop the extra ref 5703 * placed on eager in tcp_input_data() before 5704 * sending the conn_ind to listener. 5705 */ 5706 CONN_DEC_REF(econnp); 5707 } 5708 mutex_exit(&listener->tcp_eager_lock); 5709 CONN_DEC_REF(listener->tcp_connp); 5710 } 5711 5712 if (eager->tcp_state != TCPS_CLOSED) 5713 tcp_close_detached(eager); 5714 } 5715 5716 /* 5717 * Reset any eager connection hanging off this listener marked 5718 * with 'seqnum' and then reclaim it's resources. 5719 */ 5720 static boolean_t 5721 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 5722 { 5723 tcp_t *eager; 5724 mblk_t *mp; 5725 tcp_stack_t *tcps = listener->tcp_tcps; 5726 5727 TCP_STAT(tcps, tcp_eager_blowoff_calls); 5728 eager = listener; 5729 mutex_enter(&listener->tcp_eager_lock); 5730 do { 5731 eager = eager->tcp_eager_next_q; 5732 if (eager == NULL) { 5733 mutex_exit(&listener->tcp_eager_lock); 5734 return (B_FALSE); 5735 } 5736 } while (eager->tcp_conn_req_seqnum != seqnum); 5737 5738 if (eager->tcp_closemp_used) { 5739 mutex_exit(&listener->tcp_eager_lock); 5740 return (B_TRUE); 5741 } 5742 eager->tcp_closemp_used = B_TRUE; 5743 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 5744 CONN_INC_REF(eager->tcp_connp); 5745 mutex_exit(&listener->tcp_eager_lock); 5746 mp = &eager->tcp_closemp; 5747 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 5748 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF); 5749 return (B_TRUE); 5750 } 5751 5752 /* 5753 * Reset any eager connection hanging off this listener 5754 * and then reclaim it's resources. 5755 */ 5756 static void 5757 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 5758 { 5759 tcp_t *eager; 5760 mblk_t *mp; 5761 tcp_stack_t *tcps = listener->tcp_tcps; 5762 5763 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 5764 5765 if (!q0_only) { 5766 /* First cleanup q */ 5767 TCP_STAT(tcps, tcp_eager_blowoff_q); 5768 eager = listener->tcp_eager_next_q; 5769 while (eager != NULL) { 5770 if (!eager->tcp_closemp_used) { 5771 eager->tcp_closemp_used = B_TRUE; 5772 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 5773 CONN_INC_REF(eager->tcp_connp); 5774 mp = &eager->tcp_closemp; 5775 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 5776 tcp_eager_kill, eager->tcp_connp, NULL, 5777 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP); 5778 } 5779 eager = eager->tcp_eager_next_q; 5780 } 5781 } 5782 /* Then cleanup q0 */ 5783 TCP_STAT(tcps, tcp_eager_blowoff_q0); 5784 eager = listener->tcp_eager_next_q0; 5785 while (eager != listener) { 5786 if (!eager->tcp_closemp_used) { 5787 eager->tcp_closemp_used = B_TRUE; 5788 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 5789 CONN_INC_REF(eager->tcp_connp); 5790 mp = &eager->tcp_closemp; 5791 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 5792 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL, 5793 SQTAG_TCP_EAGER_CLEANUP_Q0); 5794 } 5795 eager = eager->tcp_eager_next_q0; 5796 } 5797 } 5798 5799 /* 5800 * If we are an eager connection hanging off a listener that hasn't 5801 * formally accepted the connection yet, get off his list and blow off 5802 * any data that we have accumulated. 5803 */ 5804 static void 5805 tcp_eager_unlink(tcp_t *tcp) 5806 { 5807 tcp_t *listener = tcp->tcp_listener; 5808 5809 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 5810 ASSERT(listener != NULL); 5811 if (tcp->tcp_eager_next_q0 != NULL) { 5812 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 5813 5814 /* Remove the eager tcp from q0 */ 5815 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 5816 tcp->tcp_eager_prev_q0; 5817 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 5818 tcp->tcp_eager_next_q0; 5819 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 5820 listener->tcp_conn_req_cnt_q0--; 5821 5822 tcp->tcp_eager_next_q0 = NULL; 5823 tcp->tcp_eager_prev_q0 = NULL; 5824 5825 /* 5826 * Take the eager out, if it is in the list of droppable 5827 * eagers. 5828 */ 5829 MAKE_UNDROPPABLE(tcp); 5830 5831 if (tcp->tcp_syn_rcvd_timeout != 0) { 5832 /* we have timed out before */ 5833 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 5834 listener->tcp_syn_rcvd_timeout--; 5835 } 5836 } else { 5837 tcp_t **tcpp = &listener->tcp_eager_next_q; 5838 tcp_t *prev = NULL; 5839 5840 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 5841 if (tcpp[0] == tcp) { 5842 if (listener->tcp_eager_last_q == tcp) { 5843 /* 5844 * If we are unlinking the last 5845 * element on the list, adjust 5846 * tail pointer. Set tail pointer 5847 * to nil when list is empty. 5848 */ 5849 ASSERT(tcp->tcp_eager_next_q == NULL); 5850 if (listener->tcp_eager_last_q == 5851 listener->tcp_eager_next_q) { 5852 listener->tcp_eager_last_q = 5853 NULL; 5854 } else { 5855 /* 5856 * We won't get here if there 5857 * is only one eager in the 5858 * list. 5859 */ 5860 ASSERT(prev != NULL); 5861 listener->tcp_eager_last_q = 5862 prev; 5863 } 5864 } 5865 tcpp[0] = tcp->tcp_eager_next_q; 5866 tcp->tcp_eager_next_q = NULL; 5867 tcp->tcp_eager_last_q = NULL; 5868 ASSERT(listener->tcp_conn_req_cnt_q > 0); 5869 listener->tcp_conn_req_cnt_q--; 5870 break; 5871 } 5872 prev = tcpp[0]; 5873 } 5874 } 5875 tcp->tcp_listener = NULL; 5876 } 5877 5878 /* Shorthand to generate and send TPI error acks to our client */ 5879 static void 5880 tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error) 5881 { 5882 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 5883 putnext(tcp->tcp_connp->conn_rq, mp); 5884 } 5885 5886 /* Shorthand to generate and send TPI error acks to our client */ 5887 static void 5888 tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 5889 int t_error, int sys_error) 5890 { 5891 struct T_error_ack *teackp; 5892 5893 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 5894 M_PCPROTO, T_ERROR_ACK)) != NULL) { 5895 teackp = (struct T_error_ack *)mp->b_rptr; 5896 teackp->ERROR_prim = primitive; 5897 teackp->TLI_error = t_error; 5898 teackp->UNIX_error = sys_error; 5899 putnext(tcp->tcp_connp->conn_rq, mp); 5900 } 5901 } 5902 5903 /* 5904 * Note: No locks are held when inspecting tcp_g_*epriv_ports 5905 * but instead the code relies on: 5906 * - the fact that the address of the array and its size never changes 5907 * - the atomic assignment of the elements of the array 5908 */ 5909 /* ARGSUSED */ 5910 static int 5911 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 5912 { 5913 int i; 5914 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 5915 5916 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 5917 if (tcps->tcps_g_epriv_ports[i] != 0) 5918 (void) mi_mpprintf(mp, "%d ", 5919 tcps->tcps_g_epriv_ports[i]); 5920 } 5921 return (0); 5922 } 5923 5924 /* 5925 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 5926 * threads from changing it at the same time. 5927 */ 5928 /* ARGSUSED */ 5929 static int 5930 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 5931 cred_t *cr) 5932 { 5933 long new_value; 5934 int i; 5935 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 5936 5937 /* 5938 * Fail the request if the new value does not lie within the 5939 * port number limits. 5940 */ 5941 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 5942 new_value <= 0 || new_value >= 65536) { 5943 return (EINVAL); 5944 } 5945 5946 mutex_enter(&tcps->tcps_epriv_port_lock); 5947 /* Check if the value is already in the list */ 5948 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 5949 if (new_value == tcps->tcps_g_epriv_ports[i]) { 5950 mutex_exit(&tcps->tcps_epriv_port_lock); 5951 return (EEXIST); 5952 } 5953 } 5954 /* Find an empty slot */ 5955 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 5956 if (tcps->tcps_g_epriv_ports[i] == 0) 5957 break; 5958 } 5959 if (i == tcps->tcps_g_num_epriv_ports) { 5960 mutex_exit(&tcps->tcps_epriv_port_lock); 5961 return (EOVERFLOW); 5962 } 5963 /* Set the new value */ 5964 tcps->tcps_g_epriv_ports[i] = (uint16_t)new_value; 5965 mutex_exit(&tcps->tcps_epriv_port_lock); 5966 return (0); 5967 } 5968 5969 /* 5970 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 5971 * threads from changing it at the same time. 5972 */ 5973 /* ARGSUSED */ 5974 static int 5975 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 5976 cred_t *cr) 5977 { 5978 long new_value; 5979 int i; 5980 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 5981 5982 /* 5983 * Fail the request if the new value does not lie within the 5984 * port number limits. 5985 */ 5986 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 5987 new_value >= 65536) { 5988 return (EINVAL); 5989 } 5990 5991 mutex_enter(&tcps->tcps_epriv_port_lock); 5992 /* Check that the value is already in the list */ 5993 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 5994 if (tcps->tcps_g_epriv_ports[i] == new_value) 5995 break; 5996 } 5997 if (i == tcps->tcps_g_num_epriv_ports) { 5998 mutex_exit(&tcps->tcps_epriv_port_lock); 5999 return (ESRCH); 6000 } 6001 /* Clear the value */ 6002 tcps->tcps_g_epriv_ports[i] = 0; 6003 mutex_exit(&tcps->tcps_epriv_port_lock); 6004 return (0); 6005 } 6006 6007 /* Return the TPI/TLI equivalent of our current tcp_state */ 6008 static int 6009 tcp_tpistate(tcp_t *tcp) 6010 { 6011 switch (tcp->tcp_state) { 6012 case TCPS_IDLE: 6013 return (TS_UNBND); 6014 case TCPS_LISTEN: 6015 /* 6016 * Return whether there are outstanding T_CONN_IND waiting 6017 * for the matching T_CONN_RES. Therefore don't count q0. 6018 */ 6019 if (tcp->tcp_conn_req_cnt_q > 0) 6020 return (TS_WRES_CIND); 6021 else 6022 return (TS_IDLE); 6023 case TCPS_BOUND: 6024 return (TS_IDLE); 6025 case TCPS_SYN_SENT: 6026 return (TS_WCON_CREQ); 6027 case TCPS_SYN_RCVD: 6028 /* 6029 * Note: assumption: this has to the active open SYN_RCVD. 6030 * The passive instance is detached in SYN_RCVD stage of 6031 * incoming connection processing so we cannot get request 6032 * for T_info_ack on it. 6033 */ 6034 return (TS_WACK_CRES); 6035 case TCPS_ESTABLISHED: 6036 return (TS_DATA_XFER); 6037 case TCPS_CLOSE_WAIT: 6038 return (TS_WREQ_ORDREL); 6039 case TCPS_FIN_WAIT_1: 6040 return (TS_WIND_ORDREL); 6041 case TCPS_FIN_WAIT_2: 6042 return (TS_WIND_ORDREL); 6043 6044 case TCPS_CLOSING: 6045 case TCPS_LAST_ACK: 6046 case TCPS_TIME_WAIT: 6047 case TCPS_CLOSED: 6048 /* 6049 * Following TS_WACK_DREQ7 is a rendition of "not 6050 * yet TS_IDLE" TPI state. There is no best match to any 6051 * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we 6052 * choose a value chosen that will map to TLI/XTI level 6053 * state of TSTATECHNG (state is process of changing) which 6054 * captures what this dummy state represents. 6055 */ 6056 return (TS_WACK_DREQ7); 6057 default: 6058 cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s", 6059 tcp->tcp_state, tcp_display(tcp, NULL, 6060 DISP_PORT_ONLY)); 6061 return (TS_UNBND); 6062 } 6063 } 6064 6065 static void 6066 tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp) 6067 { 6068 tcp_stack_t *tcps = tcp->tcp_tcps; 6069 conn_t *connp = tcp->tcp_connp; 6070 6071 if (connp->conn_family == AF_INET6) 6072 *tia = tcp_g_t_info_ack_v6; 6073 else 6074 *tia = tcp_g_t_info_ack; 6075 tia->CURRENT_state = tcp_tpistate(tcp); 6076 tia->OPT_size = tcp_max_optsize; 6077 if (tcp->tcp_mss == 0) { 6078 /* Not yet set - tcp_open does not set mss */ 6079 if (connp->conn_ipversion == IPV4_VERSION) 6080 tia->TIDU_size = tcps->tcps_mss_def_ipv4; 6081 else 6082 tia->TIDU_size = tcps->tcps_mss_def_ipv6; 6083 } else { 6084 tia->TIDU_size = tcp->tcp_mss; 6085 } 6086 /* TODO: Default ETSDU is 1. Is that correct for tcp? */ 6087 } 6088 6089 static void 6090 tcp_do_capability_ack(tcp_t *tcp, struct T_capability_ack *tcap, 6091 t_uscalar_t cap_bits1) 6092 { 6093 tcap->CAP_bits1 = 0; 6094 6095 if (cap_bits1 & TC1_INFO) { 6096 tcp_copy_info(&tcap->INFO_ack, tcp); 6097 tcap->CAP_bits1 |= TC1_INFO; 6098 } 6099 6100 if (cap_bits1 & TC1_ACCEPTOR_ID) { 6101 tcap->ACCEPTOR_id = tcp->tcp_acceptor_id; 6102 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID; 6103 } 6104 6105 } 6106 6107 /* 6108 * This routine responds to T_CAPABILITY_REQ messages. It is called by 6109 * tcp_wput. Much of the T_CAPABILITY_ACK information is copied from 6110 * tcp_g_t_info_ack. The current state of the stream is copied from 6111 * tcp_state. 6112 */ 6113 static void 6114 tcp_capability_req(tcp_t *tcp, mblk_t *mp) 6115 { 6116 t_uscalar_t cap_bits1; 6117 struct T_capability_ack *tcap; 6118 6119 if (MBLKL(mp) < sizeof (struct T_capability_req)) { 6120 freemsg(mp); 6121 return; 6122 } 6123 6124 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 6125 6126 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 6127 mp->b_datap->db_type, T_CAPABILITY_ACK); 6128 if (mp == NULL) 6129 return; 6130 6131 tcap = (struct T_capability_ack *)mp->b_rptr; 6132 tcp_do_capability_ack(tcp, tcap, cap_bits1); 6133 6134 putnext(tcp->tcp_connp->conn_rq, mp); 6135 } 6136 6137 /* 6138 * This routine responds to T_INFO_REQ messages. It is called by tcp_wput. 6139 * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack. 6140 * The current state of the stream is copied from tcp_state. 6141 */ 6142 static void 6143 tcp_info_req(tcp_t *tcp, mblk_t *mp) 6144 { 6145 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 6146 T_INFO_ACK); 6147 if (!mp) { 6148 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 6149 return; 6150 } 6151 tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp); 6152 putnext(tcp->tcp_connp->conn_rq, mp); 6153 } 6154 6155 /* Respond to the TPI addr request */ 6156 static void 6157 tcp_addr_req(tcp_t *tcp, mblk_t *mp) 6158 { 6159 struct sockaddr *sa; 6160 mblk_t *ackmp; 6161 struct T_addr_ack *taa; 6162 conn_t *connp = tcp->tcp_connp; 6163 uint_t addrlen; 6164 6165 /* Make it large enough for worst case */ 6166 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 6167 2 * sizeof (sin6_t), 1); 6168 if (ackmp == NULL) { 6169 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 6170 return; 6171 } 6172 6173 taa = (struct T_addr_ack *)ackmp->b_rptr; 6174 6175 bzero(taa, sizeof (struct T_addr_ack)); 6176 ackmp->b_wptr = (uchar_t *)&taa[1]; 6177 6178 taa->PRIM_type = T_ADDR_ACK; 6179 ackmp->b_datap->db_type = M_PCPROTO; 6180 6181 if (connp->conn_family == AF_INET) 6182 addrlen = sizeof (sin_t); 6183 else 6184 addrlen = sizeof (sin6_t); 6185 6186 /* 6187 * Note: Following code assumes 32 bit alignment of basic 6188 * data structures like sin_t and struct T_addr_ack. 6189 */ 6190 if (tcp->tcp_state >= TCPS_BOUND) { 6191 /* 6192 * Fill in local address first 6193 */ 6194 taa->LOCADDR_offset = sizeof (*taa); 6195 taa->LOCADDR_length = addrlen; 6196 sa = (struct sockaddr *)&taa[1]; 6197 (void) conn_getsockname(connp, sa, &addrlen); 6198 ackmp->b_wptr += addrlen; 6199 } 6200 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 6201 /* 6202 * Fill in Remote address 6203 */ 6204 taa->REMADDR_length = addrlen; 6205 /* assumed 32-bit alignment */ 6206 taa->REMADDR_offset = taa->LOCADDR_offset + taa->LOCADDR_length; 6207 sa = (struct sockaddr *)(ackmp->b_rptr + taa->REMADDR_offset); 6208 (void) conn_getpeername(connp, sa, &addrlen); 6209 ackmp->b_wptr += addrlen; 6210 } 6211 ASSERT(ackmp->b_wptr <= ackmp->b_datap->db_lim); 6212 putnext(tcp->tcp_connp->conn_rq, ackmp); 6213 } 6214 6215 /* 6216 * Handle reinitialization of a tcp structure. 6217 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 6218 */ 6219 static void 6220 tcp_reinit(tcp_t *tcp) 6221 { 6222 mblk_t *mp; 6223 tcp_stack_t *tcps = tcp->tcp_tcps; 6224 conn_t *connp = tcp->tcp_connp; 6225 6226 TCP_STAT(tcps, tcp_reinit_calls); 6227 6228 /* tcp_reinit should never be called for detached tcp_t's */ 6229 ASSERT(tcp->tcp_listener == NULL); 6230 ASSERT((connp->conn_family == AF_INET && 6231 connp->conn_ipversion == IPV4_VERSION) || 6232 (connp->conn_family == AF_INET6 && 6233 (connp->conn_ipversion == IPV4_VERSION || 6234 connp->conn_ipversion == IPV6_VERSION))); 6235 6236 /* Cancel outstanding timers */ 6237 tcp_timers_stop(tcp); 6238 6239 /* 6240 * Reset everything in the state vector, after updating global 6241 * MIB data from instance counters. 6242 */ 6243 UPDATE_MIB(&tcps->tcps_mib, tcpHCInSegs, tcp->tcp_ibsegs); 6244 tcp->tcp_ibsegs = 0; 6245 UPDATE_MIB(&tcps->tcps_mib, tcpHCOutSegs, tcp->tcp_obsegs); 6246 tcp->tcp_obsegs = 0; 6247 6248 tcp_close_mpp(&tcp->tcp_xmit_head); 6249 if (tcp->tcp_snd_zcopy_aware) 6250 tcp_zcopy_notify(tcp); 6251 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 6252 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 6253 mutex_enter(&tcp->tcp_non_sq_lock); 6254 if (tcp->tcp_flow_stopped && 6255 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 6256 tcp_clrqfull(tcp); 6257 } 6258 mutex_exit(&tcp->tcp_non_sq_lock); 6259 tcp_close_mpp(&tcp->tcp_reass_head); 6260 tcp->tcp_reass_tail = NULL; 6261 if (tcp->tcp_rcv_list != NULL) { 6262 /* Free b_next chain */ 6263 tcp_close_mpp(&tcp->tcp_rcv_list); 6264 tcp->tcp_rcv_last_head = NULL; 6265 tcp->tcp_rcv_last_tail = NULL; 6266 tcp->tcp_rcv_cnt = 0; 6267 } 6268 tcp->tcp_rcv_last_tail = NULL; 6269 6270 if ((mp = tcp->tcp_urp_mp) != NULL) { 6271 freemsg(mp); 6272 tcp->tcp_urp_mp = NULL; 6273 } 6274 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 6275 freemsg(mp); 6276 tcp->tcp_urp_mark_mp = NULL; 6277 } 6278 if (tcp->tcp_fused_sigurg_mp != NULL) { 6279 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 6280 freeb(tcp->tcp_fused_sigurg_mp); 6281 tcp->tcp_fused_sigurg_mp = NULL; 6282 } 6283 if (tcp->tcp_ordrel_mp != NULL) { 6284 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 6285 freeb(tcp->tcp_ordrel_mp); 6286 tcp->tcp_ordrel_mp = NULL; 6287 } 6288 6289 /* 6290 * Following is a union with two members which are 6291 * identical types and size so the following cleanup 6292 * is enough. 6293 */ 6294 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 6295 6296 CL_INET_DISCONNECT(connp); 6297 6298 /* 6299 * The connection can't be on the tcp_time_wait_head list 6300 * since it is not detached. 6301 */ 6302 ASSERT(tcp->tcp_time_wait_next == NULL); 6303 ASSERT(tcp->tcp_time_wait_prev == NULL); 6304 ASSERT(tcp->tcp_time_wait_expire == 0); 6305 6306 if (tcp->tcp_kssl_pending) { 6307 tcp->tcp_kssl_pending = B_FALSE; 6308 6309 /* Don't reset if the initialized by bind. */ 6310 if (tcp->tcp_kssl_ent != NULL) { 6311 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 6312 KSSL_NO_PROXY); 6313 } 6314 } 6315 if (tcp->tcp_kssl_ctx != NULL) { 6316 kssl_release_ctx(tcp->tcp_kssl_ctx); 6317 tcp->tcp_kssl_ctx = NULL; 6318 } 6319 6320 /* 6321 * Reset/preserve other values 6322 */ 6323 tcp_reinit_values(tcp); 6324 ipcl_hash_remove(connp); 6325 ixa_cleanup(connp->conn_ixa); 6326 tcp_ipsec_cleanup(tcp); 6327 6328 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 6329 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 6330 6331 if (tcp->tcp_conn_req_max != 0) { 6332 /* 6333 * This is the case when a TLI program uses the same 6334 * transport end point to accept a connection. This 6335 * makes the TCP both a listener and acceptor. When 6336 * this connection is closed, we need to set the state 6337 * back to TCPS_LISTEN. Make sure that the eager list 6338 * is reinitialized. 6339 * 6340 * Note that this stream is still bound to the four 6341 * tuples of the previous connection in IP. If a new 6342 * SYN with different foreign address comes in, IP will 6343 * not find it and will send it to the global queue. In 6344 * the global queue, TCP will do a tcp_lookup_listener() 6345 * to find this stream. This works because this stream 6346 * is only removed from connected hash. 6347 * 6348 */ 6349 tcp->tcp_state = TCPS_LISTEN; 6350 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 6351 tcp->tcp_eager_next_drop_q0 = tcp; 6352 tcp->tcp_eager_prev_drop_q0 = tcp; 6353 /* 6354 * Initially set conn_recv to tcp_input_listener_unbound to try 6355 * to pick a good squeue for the listener when the first SYN 6356 * arrives. tcp_input_listener_unbound sets it to 6357 * tcp_input_listener on that first SYN. 6358 */ 6359 connp->conn_recv = tcp_input_listener_unbound; 6360 6361 connp->conn_proto = IPPROTO_TCP; 6362 connp->conn_faddr_v6 = ipv6_all_zeros; 6363 connp->conn_fport = 0; 6364 6365 (void) ipcl_bind_insert(connp); 6366 } else { 6367 tcp->tcp_state = TCPS_BOUND; 6368 } 6369 6370 /* 6371 * Initialize to default values 6372 */ 6373 tcp_init_values(tcp); 6374 6375 ASSERT(tcp->tcp_ptpbhn != NULL); 6376 tcp->tcp_rwnd = connp->conn_rcvbuf; 6377 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ? 6378 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; 6379 } 6380 6381 /* 6382 * Force values to zero that need be zero. 6383 * Do not touch values asociated with the BOUND or LISTEN state 6384 * since the connection will end up in that state after the reinit. 6385 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 6386 * structure! 6387 */ 6388 static void 6389 tcp_reinit_values(tcp) 6390 tcp_t *tcp; 6391 { 6392 tcp_stack_t *tcps = tcp->tcp_tcps; 6393 conn_t *connp = tcp->tcp_connp; 6394 6395 #ifndef lint 6396 #define DONTCARE(x) 6397 #define PRESERVE(x) 6398 #else 6399 #define DONTCARE(x) ((x) = (x)) 6400 #define PRESERVE(x) ((x) = (x)) 6401 #endif /* lint */ 6402 6403 PRESERVE(tcp->tcp_bind_hash_port); 6404 PRESERVE(tcp->tcp_bind_hash); 6405 PRESERVE(tcp->tcp_ptpbhn); 6406 PRESERVE(tcp->tcp_acceptor_hash); 6407 PRESERVE(tcp->tcp_ptpahn); 6408 6409 /* Should be ASSERT NULL on these with new code! */ 6410 ASSERT(tcp->tcp_time_wait_next == NULL); 6411 ASSERT(tcp->tcp_time_wait_prev == NULL); 6412 ASSERT(tcp->tcp_time_wait_expire == 0); 6413 PRESERVE(tcp->tcp_state); 6414 PRESERVE(connp->conn_rq); 6415 PRESERVE(connp->conn_wq); 6416 6417 ASSERT(tcp->tcp_xmit_head == NULL); 6418 ASSERT(tcp->tcp_xmit_last == NULL); 6419 ASSERT(tcp->tcp_unsent == 0); 6420 ASSERT(tcp->tcp_xmit_tail == NULL); 6421 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 6422 6423 tcp->tcp_snxt = 0; /* Displayed in mib */ 6424 tcp->tcp_suna = 0; /* Displayed in mib */ 6425 tcp->tcp_swnd = 0; 6426 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */ 6427 6428 ASSERT(tcp->tcp_ibsegs == 0); 6429 ASSERT(tcp->tcp_obsegs == 0); 6430 6431 if (connp->conn_ht_iphc != NULL) { 6432 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 6433 connp->conn_ht_iphc = NULL; 6434 connp->conn_ht_iphc_allocated = 0; 6435 connp->conn_ht_iphc_len = 0; 6436 connp->conn_ht_ulp = NULL; 6437 connp->conn_ht_ulp_len = 0; 6438 tcp->tcp_ipha = NULL; 6439 tcp->tcp_ip6h = NULL; 6440 tcp->tcp_tcpha = NULL; 6441 } 6442 6443 /* We clear any IP_OPTIONS and extension headers */ 6444 ip_pkt_free(&connp->conn_xmit_ipp); 6445 6446 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 6447 DONTCARE(tcp->tcp_ipha); 6448 DONTCARE(tcp->tcp_ip6h); 6449 DONTCARE(tcp->tcp_tcpha); 6450 tcp->tcp_valid_bits = 0; 6451 6452 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 6453 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 6454 tcp->tcp_last_rcv_lbolt = 0; 6455 6456 tcp->tcp_init_cwnd = 0; 6457 6458 tcp->tcp_urp_last_valid = 0; 6459 tcp->tcp_hard_binding = 0; 6460 6461 tcp->tcp_fin_acked = 0; 6462 tcp->tcp_fin_rcvd = 0; 6463 tcp->tcp_fin_sent = 0; 6464 tcp->tcp_ordrel_done = 0; 6465 6466 tcp->tcp_detached = 0; 6467 6468 tcp->tcp_snd_ws_ok = B_FALSE; 6469 tcp->tcp_snd_ts_ok = B_FALSE; 6470 tcp->tcp_zero_win_probe = 0; 6471 6472 tcp->tcp_loopback = 0; 6473 tcp->tcp_localnet = 0; 6474 tcp->tcp_syn_defense = 0; 6475 tcp->tcp_set_timer = 0; 6476 6477 tcp->tcp_active_open = 0; 6478 tcp->tcp_rexmit = B_FALSE; 6479 tcp->tcp_xmit_zc_clean = B_FALSE; 6480 6481 tcp->tcp_snd_sack_ok = B_FALSE; 6482 tcp->tcp_hwcksum = B_FALSE; 6483 6484 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */ 6485 6486 tcp->tcp_conn_def_q0 = 0; 6487 tcp->tcp_ip_forward_progress = B_FALSE; 6488 tcp->tcp_ecn_ok = B_FALSE; 6489 6490 tcp->tcp_cwr = B_FALSE; 6491 tcp->tcp_ecn_echo_on = B_FALSE; 6492 tcp->tcp_is_wnd_shrnk = B_FALSE; 6493 6494 if (tcp->tcp_sack_info != NULL) { 6495 if (tcp->tcp_notsack_list != NULL) { 6496 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 6497 tcp); 6498 } 6499 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 6500 tcp->tcp_sack_info = NULL; 6501 } 6502 6503 tcp->tcp_rcv_ws = 0; 6504 tcp->tcp_snd_ws = 0; 6505 tcp->tcp_ts_recent = 0; 6506 tcp->tcp_rnxt = 0; /* Displayed in mib */ 6507 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 6508 tcp->tcp_initial_pmtu = 0; 6509 6510 ASSERT(tcp->tcp_reass_head == NULL); 6511 ASSERT(tcp->tcp_reass_tail == NULL); 6512 6513 tcp->tcp_cwnd_cnt = 0; 6514 6515 ASSERT(tcp->tcp_rcv_list == NULL); 6516 ASSERT(tcp->tcp_rcv_last_head == NULL); 6517 ASSERT(tcp->tcp_rcv_last_tail == NULL); 6518 ASSERT(tcp->tcp_rcv_cnt == 0); 6519 6520 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */ 6521 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 6522 tcp->tcp_csuna = 0; 6523 6524 tcp->tcp_rto = 0; /* Displayed in MIB */ 6525 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 6526 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 6527 tcp->tcp_rtt_update = 0; 6528 6529 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 6530 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 6531 6532 tcp->tcp_rack = 0; /* Displayed in mib */ 6533 tcp->tcp_rack_cnt = 0; 6534 tcp->tcp_rack_cur_max = 0; 6535 tcp->tcp_rack_abs_max = 0; 6536 6537 tcp->tcp_max_swnd = 0; 6538 6539 ASSERT(tcp->tcp_listener == NULL); 6540 6541 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 6542 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 6543 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 6544 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 6545 6546 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 6547 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 6548 PRESERVE(tcp->tcp_conn_req_max); 6549 PRESERVE(tcp->tcp_conn_req_seqnum); 6550 6551 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 6552 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 6553 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 6554 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 6555 6556 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 6557 ASSERT(tcp->tcp_urp_mp == NULL); 6558 ASSERT(tcp->tcp_urp_mark_mp == NULL); 6559 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 6560 6561 ASSERT(tcp->tcp_eager_next_q == NULL); 6562 ASSERT(tcp->tcp_eager_last_q == NULL); 6563 ASSERT((tcp->tcp_eager_next_q0 == NULL && 6564 tcp->tcp_eager_prev_q0 == NULL) || 6565 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 6566 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 6567 6568 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && 6569 tcp->tcp_eager_prev_drop_q0 == NULL) || 6570 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); 6571 6572 tcp->tcp_client_errno = 0; 6573 6574 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */ 6575 6576 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */ 6577 6578 PRESERVE(connp->conn_bound_addr_v6); 6579 tcp->tcp_last_sent_len = 0; 6580 tcp->tcp_dupack_cnt = 0; 6581 6582 connp->conn_fport = 0; /* Displayed in MIB */ 6583 PRESERVE(connp->conn_lport); 6584 6585 PRESERVE(tcp->tcp_acceptor_lockp); 6586 6587 ASSERT(tcp->tcp_ordrel_mp == NULL); 6588 PRESERVE(tcp->tcp_acceptor_id); 6589 DONTCARE(tcp->tcp_ipsec_overhead); 6590 6591 PRESERVE(connp->conn_family); 6592 /* Remove any remnants of mapped address binding */ 6593 if (connp->conn_family == AF_INET6) { 6594 connp->conn_ipversion = IPV6_VERSION; 6595 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 6596 } else { 6597 connp->conn_ipversion = IPV4_VERSION; 6598 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 6599 } 6600 6601 connp->conn_bound_if = 0; 6602 connp->conn_recv_ancillary.crb_all = 0; 6603 tcp->tcp_recvifindex = 0; 6604 tcp->tcp_recvhops = 0; 6605 tcp->tcp_closed = 0; 6606 tcp->tcp_cleandeathtag = 0; 6607 if (tcp->tcp_hopopts != NULL) { 6608 mi_free(tcp->tcp_hopopts); 6609 tcp->tcp_hopopts = NULL; 6610 tcp->tcp_hopoptslen = 0; 6611 } 6612 ASSERT(tcp->tcp_hopoptslen == 0); 6613 if (tcp->tcp_dstopts != NULL) { 6614 mi_free(tcp->tcp_dstopts); 6615 tcp->tcp_dstopts = NULL; 6616 tcp->tcp_dstoptslen = 0; 6617 } 6618 ASSERT(tcp->tcp_dstoptslen == 0); 6619 if (tcp->tcp_rthdrdstopts != NULL) { 6620 mi_free(tcp->tcp_rthdrdstopts); 6621 tcp->tcp_rthdrdstopts = NULL; 6622 tcp->tcp_rthdrdstoptslen = 0; 6623 } 6624 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 6625 if (tcp->tcp_rthdr != NULL) { 6626 mi_free(tcp->tcp_rthdr); 6627 tcp->tcp_rthdr = NULL; 6628 tcp->tcp_rthdrlen = 0; 6629 } 6630 ASSERT(tcp->tcp_rthdrlen == 0); 6631 6632 /* Reset fusion-related fields */ 6633 tcp->tcp_fused = B_FALSE; 6634 tcp->tcp_unfusable = B_FALSE; 6635 tcp->tcp_fused_sigurg = B_FALSE; 6636 tcp->tcp_loopback_peer = NULL; 6637 6638 tcp->tcp_lso = B_FALSE; 6639 6640 tcp->tcp_in_ack_unsent = 0; 6641 tcp->tcp_cork = B_FALSE; 6642 tcp->tcp_tconnind_started = B_FALSE; 6643 6644 PRESERVE(tcp->tcp_squeue_bytes); 6645 6646 ASSERT(tcp->tcp_kssl_ctx == NULL); 6647 ASSERT(!tcp->tcp_kssl_pending); 6648 PRESERVE(tcp->tcp_kssl_ent); 6649 6650 tcp->tcp_closemp_used = B_FALSE; 6651 6652 PRESERVE(tcp->tcp_rsrv_mp); 6653 PRESERVE(tcp->tcp_rsrv_mp_lock); 6654 6655 #ifdef DEBUG 6656 DONTCARE(tcp->tcmp_stk[0]); 6657 #endif 6658 6659 PRESERVE(tcp->tcp_connid); 6660 6661 6662 #undef DONTCARE 6663 #undef PRESERVE 6664 } 6665 6666 static void 6667 tcp_init_values(tcp_t *tcp) 6668 { 6669 tcp_stack_t *tcps = tcp->tcp_tcps; 6670 conn_t *connp = tcp->tcp_connp; 6671 6672 ASSERT((connp->conn_family == AF_INET && 6673 connp->conn_ipversion == IPV4_VERSION) || 6674 (connp->conn_family == AF_INET6 && 6675 (connp->conn_ipversion == IPV4_VERSION || 6676 connp->conn_ipversion == IPV6_VERSION))); 6677 6678 /* 6679 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 6680 * will be close to tcp_rexmit_interval_initial. By doing this, we 6681 * allow the algorithm to adjust slowly to large fluctuations of RTT 6682 * during first few transmissions of a connection as seen in slow 6683 * links. 6684 */ 6685 tcp->tcp_rtt_sa = tcps->tcps_rexmit_interval_initial << 2; 6686 tcp->tcp_rtt_sd = tcps->tcps_rexmit_interval_initial >> 1; 6687 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 6688 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 6689 tcps->tcps_conn_grace_period; 6690 if (tcp->tcp_rto < tcps->tcps_rexmit_interval_min) 6691 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 6692 tcp->tcp_timer_backoff = 0; 6693 tcp->tcp_ms_we_have_waited = 0; 6694 tcp->tcp_last_recv_time = ddi_get_lbolt(); 6695 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; 6696 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 6697 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 6698 6699 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier; 6700 6701 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; 6702 tcp->tcp_first_ctimer_threshold = tcps->tcps_ip_notify_cinterval; 6703 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; 6704 /* 6705 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 6706 * passive open. 6707 */ 6708 tcp->tcp_second_ctimer_threshold = tcps->tcps_ip_abort_cinterval; 6709 6710 tcp->tcp_naglim = tcps->tcps_naglim_def; 6711 6712 /* NOTE: ISS is now set in tcp_set_destination(). */ 6713 6714 /* Reset fusion-related fields */ 6715 tcp->tcp_fused = B_FALSE; 6716 tcp->tcp_unfusable = B_FALSE; 6717 tcp->tcp_fused_sigurg = B_FALSE; 6718 tcp->tcp_loopback_peer = NULL; 6719 6720 /* We rebuild the header template on the next connect/conn_request */ 6721 6722 connp->conn_mlp_type = mlptSingle; 6723 6724 /* 6725 * Init the window scale to the max so tcp_rwnd_set() won't pare 6726 * down tcp_rwnd. tcp_set_destination() will set the right value later. 6727 */ 6728 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 6729 tcp->tcp_rwnd = connp->conn_rcvbuf; 6730 6731 tcp->tcp_cork = B_FALSE; 6732 /* 6733 * Init the tcp_debug option if it wasn't already set. This value 6734 * determines whether TCP 6735 * calls strlog() to print out debug messages. Doing this 6736 * initialization here means that this value is not inherited thru 6737 * tcp_reinit(). 6738 */ 6739 if (!connp->conn_debug) 6740 connp->conn_debug = tcps->tcps_dbg; 6741 6742 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; 6743 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; 6744 } 6745 6746 /* At minimum we need 8 bytes in the TCP header for the lookup */ 6747 #define ICMP_MIN_TCP_HDR 8 6748 6749 /* 6750 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages 6751 * passed up by IP. The message is always received on the correct tcp_t. 6752 * Assumes that IP has pulled up everything up to and including the ICMP header. 6753 */ 6754 /* ARGSUSED2 */ 6755 static void 6756 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 6757 { 6758 conn_t *connp = (conn_t *)arg1; 6759 icmph_t *icmph; 6760 ipha_t *ipha; 6761 int iph_hdr_length; 6762 tcpha_t *tcpha; 6763 uint32_t seg_seq; 6764 tcp_t *tcp = connp->conn_tcp; 6765 6766 /* Assume IP provides aligned packets */ 6767 ASSERT(OK_32PTR(mp->b_rptr)); 6768 ASSERT((MBLKL(mp) >= sizeof (ipha_t))); 6769 6770 /* 6771 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 6772 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 6773 */ 6774 if (!(ira->ira_flags & IRAF_IS_IPV4)) { 6775 tcp_icmp_error_ipv6(tcp, mp, ira); 6776 return; 6777 } 6778 6779 /* Skip past the outer IP and ICMP headers */ 6780 iph_hdr_length = ira->ira_ip_hdr_length; 6781 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 6782 /* 6783 * If we don't have the correct outer IP header length 6784 * or if we don't have a complete inner IP header 6785 * drop it. 6786 */ 6787 if (iph_hdr_length < sizeof (ipha_t) || 6788 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 6789 noticmpv4: 6790 freemsg(mp); 6791 return; 6792 } 6793 ipha = (ipha_t *)&icmph[1]; 6794 6795 /* Skip past the inner IP and find the ULP header */ 6796 iph_hdr_length = IPH_HDR_LENGTH(ipha); 6797 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length); 6798 /* 6799 * If we don't have the correct inner IP header length or if the ULP 6800 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 6801 * bytes of TCP header, drop it. 6802 */ 6803 if (iph_hdr_length < sizeof (ipha_t) || 6804 ipha->ipha_protocol != IPPROTO_TCP || 6805 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) { 6806 goto noticmpv4; 6807 } 6808 6809 seg_seq = ntohl(tcpha->tha_seq); 6810 switch (icmph->icmph_type) { 6811 case ICMP_DEST_UNREACHABLE: 6812 switch (icmph->icmph_code) { 6813 case ICMP_FRAGMENTATION_NEEDED: 6814 /* 6815 * Update Path MTU, then try to send something out. 6816 */ 6817 tcp_update_pmtu(tcp, B_TRUE); 6818 tcp_rexmit_after_error(tcp); 6819 break; 6820 case ICMP_PORT_UNREACHABLE: 6821 case ICMP_PROTOCOL_UNREACHABLE: 6822 switch (tcp->tcp_state) { 6823 case TCPS_SYN_SENT: 6824 case TCPS_SYN_RCVD: 6825 /* 6826 * ICMP can snipe away incipient 6827 * TCP connections as long as 6828 * seq number is same as initial 6829 * send seq number. 6830 */ 6831 if (seg_seq == tcp->tcp_iss) { 6832 (void) tcp_clean_death(tcp, 6833 ECONNREFUSED, 6); 6834 } 6835 break; 6836 } 6837 break; 6838 case ICMP_HOST_UNREACHABLE: 6839 case ICMP_NET_UNREACHABLE: 6840 /* Record the error in case we finally time out. */ 6841 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 6842 tcp->tcp_client_errno = EHOSTUNREACH; 6843 else 6844 tcp->tcp_client_errno = ENETUNREACH; 6845 if (tcp->tcp_state == TCPS_SYN_RCVD) { 6846 if (tcp->tcp_listener != NULL && 6847 tcp->tcp_listener->tcp_syn_defense) { 6848 /* 6849 * Ditch the half-open connection if we 6850 * suspect a SYN attack is under way. 6851 */ 6852 (void) tcp_clean_death(tcp, 6853 tcp->tcp_client_errno, 7); 6854 } 6855 } 6856 break; 6857 default: 6858 break; 6859 } 6860 break; 6861 case ICMP_SOURCE_QUENCH: { 6862 /* 6863 * use a global boolean to control 6864 * whether TCP should respond to ICMP_SOURCE_QUENCH. 6865 * The default is false. 6866 */ 6867 if (tcp_icmp_source_quench) { 6868 /* 6869 * Reduce the sending rate as if we got a 6870 * retransmit timeout 6871 */ 6872 uint32_t npkt; 6873 6874 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 6875 tcp->tcp_mss; 6876 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 6877 tcp->tcp_cwnd = tcp->tcp_mss; 6878 tcp->tcp_cwnd_cnt = 0; 6879 } 6880 break; 6881 } 6882 } 6883 freemsg(mp); 6884 } 6885 6886 /* 6887 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might 6888 * change. But it can refer to fields like tcp_suna and tcp_snxt. 6889 * 6890 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP 6891 * error messages received by IP. The message is always received on the correct 6892 * tcp_t. 6893 */ 6894 /* ARGSUSED */ 6895 static boolean_t 6896 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6, 6897 ip_recv_attr_t *ira) 6898 { 6899 tcpha_t *tcpha = (tcpha_t *)arg2; 6900 uint32_t seq = ntohl(tcpha->tha_seq); 6901 tcp_t *tcp = connp->conn_tcp; 6902 6903 /* 6904 * TCP sequence number contained in payload of the ICMP error message 6905 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise, 6906 * the message is either a stale ICMP error, or an attack from the 6907 * network. Fail the verification. 6908 */ 6909 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 6910 return (B_FALSE); 6911 6912 /* For "too big" we also check the ignore flag */ 6913 if (ira->ira_flags & IRAF_IS_IPV4) { 6914 ASSERT(icmph != NULL); 6915 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE && 6916 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED && 6917 tcp->tcp_tcps->tcps_ignore_path_mtu) 6918 return (B_FALSE); 6919 } else { 6920 ASSERT(icmp6 != NULL); 6921 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG && 6922 tcp->tcp_tcps->tcps_ignore_path_mtu) 6923 return (B_FALSE); 6924 } 6925 return (B_TRUE); 6926 } 6927 6928 /* 6929 * Update the TCP connection according to change of PMTU. 6930 * 6931 * Path MTU might have changed by either increase or decrease, so need to 6932 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny 6933 * or negative MSS, since tcp_mss_set() will do it. 6934 */ 6935 static void 6936 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only) 6937 { 6938 uint32_t pmtu; 6939 int32_t mss; 6940 conn_t *connp = tcp->tcp_connp; 6941 ip_xmit_attr_t *ixa = connp->conn_ixa; 6942 iaflags_t ixaflags; 6943 6944 if (tcp->tcp_tcps->tcps_ignore_path_mtu) 6945 return; 6946 6947 if (tcp->tcp_state < TCPS_ESTABLISHED) 6948 return; 6949 6950 /* 6951 * Always call ip_get_pmtu() to make sure that IP has updated 6952 * ixa_flags properly. 6953 */ 6954 pmtu = ip_get_pmtu(ixa); 6955 ixaflags = ixa->ixa_flags; 6956 6957 /* 6958 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and 6959 * IPsec overhead if applied. Make sure to use the most recent 6960 * IPsec information. 6961 */ 6962 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp); 6963 6964 /* 6965 * Nothing to change, so just return. 6966 */ 6967 if (mss == tcp->tcp_mss) 6968 return; 6969 6970 /* 6971 * Currently, for ICMP errors, only PMTU decrease is handled. 6972 */ 6973 if (mss > tcp->tcp_mss && decrease_only) 6974 return; 6975 6976 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss); 6977 6978 /* 6979 * Update ixa_fragsize and ixa_pmtu. 6980 */ 6981 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 6982 6983 /* 6984 * Adjust MSS and all relevant variables. 6985 */ 6986 tcp_mss_set(tcp, mss); 6987 6988 /* 6989 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu 6990 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP 6991 * has a (potentially different) min size we do the same. Make sure to 6992 * clear IXAF_DONTFRAG, which is used by IP to decide whether to 6993 * fragment the packet. 6994 * 6995 * LSO over IPv6 can not be fragmented. So need to disable LSO 6996 * when IPv6 fragmentation is needed. 6997 */ 6998 if (mss < tcp->tcp_tcps->tcps_mss_min) 6999 ixaflags |= IXAF_PMTU_TOO_SMALL; 7000 7001 if (ixaflags & IXAF_PMTU_TOO_SMALL) 7002 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 7003 7004 if ((connp->conn_ipversion == IPV4_VERSION) && 7005 !(ixaflags & IXAF_PMTU_IPV4_DF)) { 7006 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 7007 } 7008 ixa->ixa_flags = ixaflags; 7009 } 7010 7011 /* 7012 * Do slow start retransmission after ICMP errors of PMTU changes. 7013 */ 7014 static void 7015 tcp_rexmit_after_error(tcp_t *tcp) 7016 { 7017 /* 7018 * All sent data has been acknowledged or no data left to send, just 7019 * to return. 7020 */ 7021 if (!SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) || 7022 (tcp->tcp_xmit_head == NULL)) 7023 return; 7024 7025 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && (tcp->tcp_unsent == 0)) 7026 tcp->tcp_rexmit_max = tcp->tcp_fss; 7027 else 7028 tcp->tcp_rexmit_max = tcp->tcp_snxt; 7029 7030 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 7031 tcp->tcp_rexmit = B_TRUE; 7032 tcp->tcp_dupack_cnt = 0; 7033 tcp->tcp_snd_burst = TCP_CWND_SS; 7034 tcp_ss_rexmit(tcp); 7035 } 7036 7037 /* 7038 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6 7039 * error messages passed up by IP. 7040 * Assumes that IP has pulled up all the extension headers as well 7041 * as the ICMPv6 header. 7042 */ 7043 static void 7044 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira) 7045 { 7046 icmp6_t *icmp6; 7047 ip6_t *ip6h; 7048 uint16_t iph_hdr_length = ira->ira_ip_hdr_length; 7049 tcpha_t *tcpha; 7050 uint8_t *nexthdrp; 7051 uint32_t seg_seq; 7052 7053 /* 7054 * Verify that we have a complete IP header. 7055 */ 7056 ASSERT((MBLKL(mp) >= sizeof (ip6_t))); 7057 7058 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 7059 ip6h = (ip6_t *)&icmp6[1]; 7060 /* 7061 * Verify if we have a complete ICMP and inner IP header. 7062 */ 7063 if ((uchar_t *)&ip6h[1] > mp->b_wptr) { 7064 noticmpv6: 7065 freemsg(mp); 7066 return; 7067 } 7068 7069 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 7070 goto noticmpv6; 7071 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 7072 /* 7073 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 7074 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 7075 * packet. 7076 */ 7077 if ((*nexthdrp != IPPROTO_TCP) || 7078 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 7079 goto noticmpv6; 7080 } 7081 7082 seg_seq = ntohl(tcpha->tha_seq); 7083 switch (icmp6->icmp6_type) { 7084 case ICMP6_PACKET_TOO_BIG: 7085 /* 7086 * Update Path MTU, then try to send something out. 7087 */ 7088 tcp_update_pmtu(tcp, B_TRUE); 7089 tcp_rexmit_after_error(tcp); 7090 break; 7091 case ICMP6_DST_UNREACH: 7092 switch (icmp6->icmp6_code) { 7093 case ICMP6_DST_UNREACH_NOPORT: 7094 if (((tcp->tcp_state == TCPS_SYN_SENT) || 7095 (tcp->tcp_state == TCPS_SYN_RCVD)) && 7096 (seg_seq == tcp->tcp_iss)) { 7097 (void) tcp_clean_death(tcp, 7098 ECONNREFUSED, 8); 7099 } 7100 break; 7101 case ICMP6_DST_UNREACH_ADMIN: 7102 case ICMP6_DST_UNREACH_NOROUTE: 7103 case ICMP6_DST_UNREACH_BEYONDSCOPE: 7104 case ICMP6_DST_UNREACH_ADDR: 7105 /* Record the error in case we finally time out. */ 7106 tcp->tcp_client_errno = EHOSTUNREACH; 7107 if (((tcp->tcp_state == TCPS_SYN_SENT) || 7108 (tcp->tcp_state == TCPS_SYN_RCVD)) && 7109 (seg_seq == tcp->tcp_iss)) { 7110 if (tcp->tcp_listener != NULL && 7111 tcp->tcp_listener->tcp_syn_defense) { 7112 /* 7113 * Ditch the half-open connection if we 7114 * suspect a SYN attack is under way. 7115 */ 7116 (void) tcp_clean_death(tcp, 7117 tcp->tcp_client_errno, 9); 7118 } 7119 } 7120 7121 7122 break; 7123 default: 7124 break; 7125 } 7126 break; 7127 case ICMP6_PARAM_PROB: 7128 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 7129 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 7130 (uchar_t *)ip6h + icmp6->icmp6_pptr == 7131 (uchar_t *)nexthdrp) { 7132 if (tcp->tcp_state == TCPS_SYN_SENT || 7133 tcp->tcp_state == TCPS_SYN_RCVD) { 7134 (void) tcp_clean_death(tcp, 7135 ECONNREFUSED, 10); 7136 } 7137 break; 7138 } 7139 break; 7140 7141 case ICMP6_TIME_EXCEEDED: 7142 default: 7143 break; 7144 } 7145 freemsg(mp); 7146 } 7147 7148 /* 7149 * Notify IP that we are having trouble with this connection. IP should 7150 * make note so it can potentially use a different IRE. 7151 */ 7152 static void 7153 tcp_ip_notify(tcp_t *tcp) 7154 { 7155 conn_t *connp = tcp->tcp_connp; 7156 ire_t *ire; 7157 7158 /* 7159 * Note: in the case of source routing we want to blow away the 7160 * route to the first source route hop. 7161 */ 7162 ire = connp->conn_ixa->ixa_ire; 7163 if (ire != NULL && !(ire->ire_flags & (RTF_REJECT|RTF_BLACKHOLE))) { 7164 if (ire->ire_ipversion == IPV4_VERSION) { 7165 /* 7166 * As per RFC 1122, we send an RTM_LOSING to inform 7167 * routing protocols. 7168 */ 7169 ip_rts_change(RTM_LOSING, ire->ire_addr, 7170 ire->ire_gateway_addr, ire->ire_mask, 7171 connp->conn_laddr_v4, 0, 0, 0, 7172 (RTA_DST | RTA_GATEWAY | RTA_NETMASK | RTA_IFA), 7173 ire->ire_ipst); 7174 } 7175 (void) ire_no_good(ire); 7176 } 7177 } 7178 7179 #pragma inline(tcp_send_data) 7180 7181 /* 7182 * Timer callback routine for keepalive probe. We do a fake resend of 7183 * last ACKed byte. Then set a timer using RTO. When the timer expires, 7184 * check to see if we have heard anything from the other end for the last 7185 * RTO period. If we have, set the timer to expire for another 7186 * tcp_keepalive_intrvl and check again. If we have not, set a timer using 7187 * RTO << 1 and check again when it expires. Keep exponentially increasing 7188 * the timeout if we have not heard from the other side. If for more than 7189 * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything, 7190 * kill the connection unless the keepalive abort threshold is 0. In 7191 * that case, we will probe "forever." 7192 */ 7193 static void 7194 tcp_keepalive_killer(void *arg) 7195 { 7196 mblk_t *mp; 7197 conn_t *connp = (conn_t *)arg; 7198 tcp_t *tcp = connp->conn_tcp; 7199 int32_t firetime; 7200 int32_t idletime; 7201 int32_t ka_intrvl; 7202 tcp_stack_t *tcps = tcp->tcp_tcps; 7203 7204 tcp->tcp_ka_tid = 0; 7205 7206 if (tcp->tcp_fused) 7207 return; 7208 7209 BUMP_MIB(&tcps->tcps_mib, tcpTimKeepalive); 7210 ka_intrvl = tcp->tcp_ka_interval; 7211 7212 /* 7213 * Keepalive probe should only be sent if the application has not 7214 * done a close on the connection. 7215 */ 7216 if (tcp->tcp_state > TCPS_CLOSE_WAIT) { 7217 return; 7218 } 7219 /* Timer fired too early, restart it. */ 7220 if (tcp->tcp_state < TCPS_ESTABLISHED) { 7221 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 7222 MSEC_TO_TICK(ka_intrvl)); 7223 return; 7224 } 7225 7226 idletime = TICK_TO_MSEC(ddi_get_lbolt() - tcp->tcp_last_recv_time); 7227 /* 7228 * If we have not heard from the other side for a long 7229 * time, kill the connection unless the keepalive abort 7230 * threshold is 0. In that case, we will probe "forever." 7231 */ 7232 if (tcp->tcp_ka_abort_thres != 0 && 7233 idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) { 7234 BUMP_MIB(&tcps->tcps_mib, tcpTimKeepaliveDrop); 7235 (void) tcp_clean_death(tcp, tcp->tcp_client_errno ? 7236 tcp->tcp_client_errno : ETIMEDOUT, 11); 7237 return; 7238 } 7239 7240 if (tcp->tcp_snxt == tcp->tcp_suna && 7241 idletime >= ka_intrvl) { 7242 /* Fake resend of last ACKed byte. */ 7243 mblk_t *mp1 = allocb(1, BPRI_LO); 7244 7245 if (mp1 != NULL) { 7246 *mp1->b_wptr++ = '\0'; 7247 mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL, 7248 tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE); 7249 freeb(mp1); 7250 /* 7251 * if allocation failed, fall through to start the 7252 * timer back. 7253 */ 7254 if (mp != NULL) { 7255 tcp_send_data(tcp, mp); 7256 BUMP_MIB(&tcps->tcps_mib, 7257 tcpTimKeepaliveProbe); 7258 if (tcp->tcp_ka_last_intrvl != 0) { 7259 int max; 7260 /* 7261 * We should probe again at least 7262 * in ka_intrvl, but not more than 7263 * tcp_rexmit_interval_max. 7264 */ 7265 max = tcps->tcps_rexmit_interval_max; 7266 firetime = MIN(ka_intrvl - 1, 7267 tcp->tcp_ka_last_intrvl << 1); 7268 if (firetime > max) 7269 firetime = max; 7270 } else { 7271 firetime = tcp->tcp_rto; 7272 } 7273 tcp->tcp_ka_tid = TCP_TIMER(tcp, 7274 tcp_keepalive_killer, 7275 MSEC_TO_TICK(firetime)); 7276 tcp->tcp_ka_last_intrvl = firetime; 7277 return; 7278 } 7279 } 7280 } else { 7281 tcp->tcp_ka_last_intrvl = 0; 7282 } 7283 7284 /* firetime can be negative if (mp1 == NULL || mp == NULL) */ 7285 if ((firetime = ka_intrvl - idletime) < 0) { 7286 firetime = ka_intrvl; 7287 } 7288 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 7289 MSEC_TO_TICK(firetime)); 7290 } 7291 7292 int 7293 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 7294 { 7295 conn_t *connp = tcp->tcp_connp; 7296 queue_t *q = connp->conn_rq; 7297 int32_t mss = tcp->tcp_mss; 7298 int maxpsz; 7299 7300 if (TCP_IS_DETACHED(tcp)) 7301 return (mss); 7302 if (tcp->tcp_fused) { 7303 maxpsz = tcp_fuse_maxpsz(tcp); 7304 mss = INFPSZ; 7305 } else if (tcp->tcp_maxpsz_multiplier == 0) { 7306 /* 7307 * Set the sd_qn_maxpsz according to the socket send buffer 7308 * size, and sd_maxblk to INFPSZ (-1). This will essentially 7309 * instruct the stream head to copyin user data into contiguous 7310 * kernel-allocated buffers without breaking it up into smaller 7311 * chunks. We round up the buffer size to the nearest SMSS. 7312 */ 7313 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss); 7314 if (tcp->tcp_kssl_ctx == NULL) 7315 mss = INFPSZ; 7316 else 7317 mss = SSL3_MAX_RECORD_LEN; 7318 } else { 7319 /* 7320 * Set sd_qn_maxpsz to approx half the (receivers) buffer 7321 * (and a multiple of the mss). This instructs the stream 7322 * head to break down larger than SMSS writes into SMSS- 7323 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 7324 */ 7325 maxpsz = tcp->tcp_maxpsz_multiplier * mss; 7326 if (maxpsz > connp->conn_sndbuf / 2) { 7327 maxpsz = connp->conn_sndbuf / 2; 7328 /* Round up to nearest mss */ 7329 maxpsz = MSS_ROUNDUP(maxpsz, mss); 7330 } 7331 } 7332 7333 (void) proto_set_maxpsz(q, connp, maxpsz); 7334 if (!(IPCL_IS_NONSTR(connp))) 7335 connp->conn_wq->q_maxpsz = maxpsz; 7336 if (set_maxblk) 7337 (void) proto_set_tx_maxblk(q, connp, mss); 7338 return (mss); 7339 } 7340 7341 /* 7342 * Extract option values from a tcp header. We put any found values into the 7343 * tcpopt struct and return a bitmask saying which options were found. 7344 */ 7345 static int 7346 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt) 7347 { 7348 uchar_t *endp; 7349 int len; 7350 uint32_t mss; 7351 uchar_t *up = (uchar_t *)tcpha; 7352 int found = 0; 7353 int32_t sack_len; 7354 tcp_seq sack_begin, sack_end; 7355 tcp_t *tcp; 7356 7357 endp = up + TCP_HDR_LENGTH(tcpha); 7358 up += TCP_MIN_HEADER_LENGTH; 7359 while (up < endp) { 7360 len = endp - up; 7361 switch (*up) { 7362 case TCPOPT_EOL: 7363 break; 7364 7365 case TCPOPT_NOP: 7366 up++; 7367 continue; 7368 7369 case TCPOPT_MAXSEG: 7370 if (len < TCPOPT_MAXSEG_LEN || 7371 up[1] != TCPOPT_MAXSEG_LEN) 7372 break; 7373 7374 mss = BE16_TO_U16(up+2); 7375 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 7376 tcpopt->tcp_opt_mss = mss; 7377 found |= TCP_OPT_MSS_PRESENT; 7378 7379 up += TCPOPT_MAXSEG_LEN; 7380 continue; 7381 7382 case TCPOPT_WSCALE: 7383 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 7384 break; 7385 7386 if (up[2] > TCP_MAX_WINSHIFT) 7387 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 7388 else 7389 tcpopt->tcp_opt_wscale = up[2]; 7390 found |= TCP_OPT_WSCALE_PRESENT; 7391 7392 up += TCPOPT_WS_LEN; 7393 continue; 7394 7395 case TCPOPT_SACK_PERMITTED: 7396 if (len < TCPOPT_SACK_OK_LEN || 7397 up[1] != TCPOPT_SACK_OK_LEN) 7398 break; 7399 found |= TCP_OPT_SACK_OK_PRESENT; 7400 up += TCPOPT_SACK_OK_LEN; 7401 continue; 7402 7403 case TCPOPT_SACK: 7404 if (len <= 2 || up[1] <= 2 || len < up[1]) 7405 break; 7406 7407 /* If TCP is not interested in SACK blks... */ 7408 if ((tcp = tcpopt->tcp) == NULL) { 7409 up += up[1]; 7410 continue; 7411 } 7412 sack_len = up[1] - TCPOPT_HEADER_LEN; 7413 up += TCPOPT_HEADER_LEN; 7414 7415 /* 7416 * If the list is empty, allocate one and assume 7417 * nothing is sack'ed. 7418 */ 7419 ASSERT(tcp->tcp_sack_info != NULL); 7420 if (tcp->tcp_notsack_list == NULL) { 7421 tcp_notsack_update(&(tcp->tcp_notsack_list), 7422 tcp->tcp_suna, tcp->tcp_snxt, 7423 &(tcp->tcp_num_notsack_blk), 7424 &(tcp->tcp_cnt_notsack_list)); 7425 7426 /* 7427 * Make sure tcp_notsack_list is not NULL. 7428 * This happens when kmem_alloc(KM_NOSLEEP) 7429 * returns NULL. 7430 */ 7431 if (tcp->tcp_notsack_list == NULL) { 7432 up += sack_len; 7433 continue; 7434 } 7435 tcp->tcp_fack = tcp->tcp_suna; 7436 } 7437 7438 while (sack_len > 0) { 7439 if (up + 8 > endp) { 7440 up = endp; 7441 break; 7442 } 7443 sack_begin = BE32_TO_U32(up); 7444 up += 4; 7445 sack_end = BE32_TO_U32(up); 7446 up += 4; 7447 sack_len -= 8; 7448 /* 7449 * Bounds checking. Make sure the SACK 7450 * info is within tcp_suna and tcp_snxt. 7451 * If this SACK blk is out of bound, ignore 7452 * it but continue to parse the following 7453 * blks. 7454 */ 7455 if (SEQ_LEQ(sack_end, sack_begin) || 7456 SEQ_LT(sack_begin, tcp->tcp_suna) || 7457 SEQ_GT(sack_end, tcp->tcp_snxt)) { 7458 continue; 7459 } 7460 tcp_notsack_insert(&(tcp->tcp_notsack_list), 7461 sack_begin, sack_end, 7462 &(tcp->tcp_num_notsack_blk), 7463 &(tcp->tcp_cnt_notsack_list)); 7464 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 7465 tcp->tcp_fack = sack_end; 7466 } 7467 } 7468 found |= TCP_OPT_SACK_PRESENT; 7469 continue; 7470 7471 case TCPOPT_TSTAMP: 7472 if (len < TCPOPT_TSTAMP_LEN || 7473 up[1] != TCPOPT_TSTAMP_LEN) 7474 break; 7475 7476 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 7477 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 7478 7479 found |= TCP_OPT_TSTAMP_PRESENT; 7480 7481 up += TCPOPT_TSTAMP_LEN; 7482 continue; 7483 7484 default: 7485 if (len <= 1 || len < (int)up[1] || up[1] == 0) 7486 break; 7487 up += up[1]; 7488 continue; 7489 } 7490 break; 7491 } 7492 return (found); 7493 } 7494 7495 /* 7496 * Set the MSS associated with a particular tcp based on its current value, 7497 * and a new one passed in. Observe minimums and maximums, and reset other 7498 * state variables that we want to view as multiples of MSS. 7499 * 7500 * The value of MSS could be either increased or descreased. 7501 */ 7502 static void 7503 tcp_mss_set(tcp_t *tcp, uint32_t mss) 7504 { 7505 uint32_t mss_max; 7506 tcp_stack_t *tcps = tcp->tcp_tcps; 7507 conn_t *connp = tcp->tcp_connp; 7508 7509 if (connp->conn_ipversion == IPV4_VERSION) 7510 mss_max = tcps->tcps_mss_max_ipv4; 7511 else 7512 mss_max = tcps->tcps_mss_max_ipv6; 7513 7514 if (mss < tcps->tcps_mss_min) 7515 mss = tcps->tcps_mss_min; 7516 if (mss > mss_max) 7517 mss = mss_max; 7518 /* 7519 * Unless naglim has been set by our client to 7520 * a non-mss value, force naglim to track mss. 7521 * This can help to aggregate small writes. 7522 */ 7523 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 7524 tcp->tcp_naglim = mss; 7525 /* 7526 * TCP should be able to buffer at least 4 MSS data for obvious 7527 * performance reason. 7528 */ 7529 if ((mss << 2) > connp->conn_sndbuf) 7530 connp->conn_sndbuf = mss << 2; 7531 7532 /* 7533 * Set the send lowater to at least twice of MSS. 7534 */ 7535 if ((mss << 1) > connp->conn_sndlowat) 7536 connp->conn_sndlowat = mss << 1; 7537 7538 /* 7539 * Update tcp_cwnd according to the new value of MSS. Keep the 7540 * previous ratio to preserve the transmit rate. 7541 */ 7542 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss; 7543 tcp->tcp_cwnd_cnt = 0; 7544 7545 tcp->tcp_mss = mss; 7546 (void) tcp_maxpsz_set(tcp, B_TRUE); 7547 } 7548 7549 /* For /dev/tcp aka AF_INET open */ 7550 static int 7551 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 7552 { 7553 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); 7554 } 7555 7556 /* For /dev/tcp6 aka AF_INET6 open */ 7557 static int 7558 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 7559 { 7560 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); 7561 } 7562 7563 static conn_t * 7564 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket, 7565 int *errorp) 7566 { 7567 tcp_t *tcp = NULL; 7568 conn_t *connp; 7569 zoneid_t zoneid; 7570 tcp_stack_t *tcps; 7571 squeue_t *sqp; 7572 7573 ASSERT(errorp != NULL); 7574 /* 7575 * Find the proper zoneid and netstack. 7576 */ 7577 /* 7578 * Special case for install: miniroot needs to be able to 7579 * access files via NFS as though it were always in the 7580 * global zone. 7581 */ 7582 if (credp == kcred && nfs_global_client_only != 0) { 7583 zoneid = GLOBAL_ZONEID; 7584 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> 7585 netstack_tcp; 7586 ASSERT(tcps != NULL); 7587 } else { 7588 netstack_t *ns; 7589 7590 ns = netstack_find_by_cred(credp); 7591 ASSERT(ns != NULL); 7592 tcps = ns->netstack_tcp; 7593 ASSERT(tcps != NULL); 7594 7595 /* 7596 * For exclusive stacks we set the zoneid to zero 7597 * to make TCP operate as if in the global zone. 7598 */ 7599 if (tcps->tcps_netstack->netstack_stackid != 7600 GLOBAL_NETSTACKID) 7601 zoneid = GLOBAL_ZONEID; 7602 else 7603 zoneid = crgetzoneid(credp); 7604 } 7605 7606 sqp = IP_SQUEUE_GET((uint_t)gethrtime()); 7607 connp = (conn_t *)tcp_get_conn(sqp, tcps); 7608 /* 7609 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, 7610 * so we drop it by one. 7611 */ 7612 netstack_rele(tcps->tcps_netstack); 7613 if (connp == NULL) { 7614 *errorp = ENOSR; 7615 return (NULL); 7616 } 7617 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto); 7618 7619 connp->conn_sqp = sqp; 7620 connp->conn_initial_sqp = connp->conn_sqp; 7621 connp->conn_ixa->ixa_sqp = connp->conn_sqp; 7622 tcp = connp->conn_tcp; 7623 7624 /* 7625 * Besides asking IP to set the checksum for us, have conn_ip_output 7626 * to do the following checks when necessary: 7627 * 7628 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid 7629 * IXAF_VERIFY_PMTU: verify PMTU changes 7630 * IXAF_VERIFY_LSO: verify LSO capability changes 7631 */ 7632 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 7633 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO; 7634 7635 if (!tcps->tcps_dev_flow_ctl) 7636 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 7637 7638 if (isv6) { 7639 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 7640 connp->conn_ipversion = IPV6_VERSION; 7641 connp->conn_family = AF_INET6; 7642 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 7643 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit; 7644 } else { 7645 connp->conn_ipversion = IPV4_VERSION; 7646 connp->conn_family = AF_INET; 7647 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 7648 connp->conn_default_ttl = tcps->tcps_ipv4_ttl; 7649 } 7650 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 7651 7652 crhold(credp); 7653 connp->conn_cred = credp; 7654 connp->conn_cpid = curproc->p_pid; 7655 connp->conn_open_time = ddi_get_lbolt64(); 7656 7657 connp->conn_zoneid = zoneid; 7658 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 7659 connp->conn_ixa->ixa_zoneid = zoneid; 7660 connp->conn_mlp_type = mlptSingle; 7661 ASSERT(connp->conn_netstack == tcps->tcps_netstack); 7662 ASSERT(tcp->tcp_tcps == tcps); 7663 7664 /* 7665 * If the caller has the process-wide flag set, then default to MAC 7666 * exempt mode. This allows read-down to unlabeled hosts. 7667 */ 7668 if (getpflags(NET_MAC_AWARE, credp) != 0) 7669 connp->conn_mac_mode = CONN_MAC_AWARE; 7670 7671 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 7672 7673 if (issocket) { 7674 tcp->tcp_issocket = 1; 7675 } 7676 7677 connp->conn_rcvbuf = tcps->tcps_recv_hiwat; 7678 connp->conn_sndbuf = tcps->tcps_xmit_hiwat; 7679 connp->conn_sndlowat = tcps->tcps_xmit_lowat; 7680 connp->conn_so_type = SOCK_STREAM; 7681 connp->conn_wroff = connp->conn_ht_iphc_allocated + 7682 tcps->tcps_wroff_xtra; 7683 7684 SOCK_CONNID_INIT(tcp->tcp_connid); 7685 tcp->tcp_state = TCPS_IDLE; 7686 tcp_init_values(tcp); 7687 return (connp); 7688 } 7689 7690 static int 7691 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 7692 boolean_t isv6) 7693 { 7694 tcp_t *tcp = NULL; 7695 conn_t *connp = NULL; 7696 int err; 7697 vmem_t *minor_arena = NULL; 7698 dev_t conn_dev; 7699 boolean_t issocket; 7700 7701 if (q->q_ptr != NULL) 7702 return (0); 7703 7704 if (sflag == MODOPEN) 7705 return (EINVAL); 7706 7707 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 7708 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 7709 minor_arena = ip_minor_arena_la; 7710 } else { 7711 /* 7712 * Either minor numbers in the large arena were exhausted 7713 * or a non socket application is doing the open. 7714 * Try to allocate from the small arena. 7715 */ 7716 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 7717 return (EBUSY); 7718 } 7719 minor_arena = ip_minor_arena_sa; 7720 } 7721 7722 ASSERT(minor_arena != NULL); 7723 7724 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev); 7725 7726 if (flag & SO_FALLBACK) { 7727 /* 7728 * Non streams socket needs a stream to fallback to 7729 */ 7730 RD(q)->q_ptr = (void *)conn_dev; 7731 WR(q)->q_qinfo = &tcp_fallback_sock_winit; 7732 WR(q)->q_ptr = (void *)minor_arena; 7733 qprocson(q); 7734 return (0); 7735 } else if (flag & SO_ACCEPTOR) { 7736 q->q_qinfo = &tcp_acceptor_rinit; 7737 /* 7738 * the conn_dev and minor_arena will be subsequently used by 7739 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out 7740 * the minor device number for this connection from the q_ptr. 7741 */ 7742 RD(q)->q_ptr = (void *)conn_dev; 7743 WR(q)->q_qinfo = &tcp_acceptor_winit; 7744 WR(q)->q_ptr = (void *)minor_arena; 7745 qprocson(q); 7746 return (0); 7747 } 7748 7749 issocket = flag & SO_SOCKSTR; 7750 connp = tcp_create_common(credp, isv6, issocket, &err); 7751 7752 if (connp == NULL) { 7753 inet_minor_free(minor_arena, conn_dev); 7754 q->q_ptr = WR(q)->q_ptr = NULL; 7755 return (err); 7756 } 7757 7758 connp->conn_rq = q; 7759 connp->conn_wq = WR(q); 7760 q->q_ptr = WR(q)->q_ptr = connp; 7761 7762 connp->conn_dev = conn_dev; 7763 connp->conn_minor_arena = minor_arena; 7764 7765 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); 7766 ASSERT(WR(q)->q_qinfo == &tcp_winit); 7767 7768 tcp = connp->conn_tcp; 7769 7770 if (issocket) { 7771 WR(q)->q_qinfo = &tcp_sock_winit; 7772 } else { 7773 #ifdef _ILP32 7774 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 7775 #else 7776 tcp->tcp_acceptor_id = conn_dev; 7777 #endif /* _ILP32 */ 7778 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 7779 } 7780 7781 /* 7782 * Put the ref for TCP. Ref for IP was already put 7783 * by ipcl_conn_create. Also Make the conn_t globally 7784 * visible to walkers 7785 */ 7786 mutex_enter(&connp->conn_lock); 7787 CONN_INC_REF_LOCKED(connp); 7788 ASSERT(connp->conn_ref == 2); 7789 connp->conn_state_flags &= ~CONN_INCIPIENT; 7790 mutex_exit(&connp->conn_lock); 7791 7792 qprocson(q); 7793 return (0); 7794 } 7795 7796 /* 7797 * Some TCP options can be "set" by requesting them in the option 7798 * buffer. This is needed for XTI feature test though we do not 7799 * allow it in general. We interpret that this mechanism is more 7800 * applicable to OSI protocols and need not be allowed in general. 7801 * This routine filters out options for which it is not allowed (most) 7802 * and lets through those (few) for which it is. [ The XTI interface 7803 * test suite specifics will imply that any XTI_GENERIC level XTI_* if 7804 * ever implemented will have to be allowed here ]. 7805 */ 7806 static boolean_t 7807 tcp_allow_connopt_set(int level, int name) 7808 { 7809 7810 switch (level) { 7811 case IPPROTO_TCP: 7812 switch (name) { 7813 case TCP_NODELAY: 7814 return (B_TRUE); 7815 default: 7816 return (B_FALSE); 7817 } 7818 /*NOTREACHED*/ 7819 default: 7820 return (B_FALSE); 7821 } 7822 /*NOTREACHED*/ 7823 } 7824 7825 /* 7826 * This routine gets default values of certain options whose default 7827 * values are maintained by protocol specific code 7828 */ 7829 /* ARGSUSED */ 7830 int 7831 tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr) 7832 { 7833 int32_t *i1 = (int32_t *)ptr; 7834 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 7835 7836 switch (level) { 7837 case IPPROTO_TCP: 7838 switch (name) { 7839 case TCP_NOTIFY_THRESHOLD: 7840 *i1 = tcps->tcps_ip_notify_interval; 7841 break; 7842 case TCP_ABORT_THRESHOLD: 7843 *i1 = tcps->tcps_ip_abort_interval; 7844 break; 7845 case TCP_CONN_NOTIFY_THRESHOLD: 7846 *i1 = tcps->tcps_ip_notify_cinterval; 7847 break; 7848 case TCP_CONN_ABORT_THRESHOLD: 7849 *i1 = tcps->tcps_ip_abort_cinterval; 7850 break; 7851 default: 7852 return (-1); 7853 } 7854 break; 7855 case IPPROTO_IP: 7856 switch (name) { 7857 case IP_TTL: 7858 *i1 = tcps->tcps_ipv4_ttl; 7859 break; 7860 default: 7861 return (-1); 7862 } 7863 break; 7864 case IPPROTO_IPV6: 7865 switch (name) { 7866 case IPV6_UNICAST_HOPS: 7867 *i1 = tcps->tcps_ipv6_hoplimit; 7868 break; 7869 default: 7870 return (-1); 7871 } 7872 break; 7873 default: 7874 return (-1); 7875 } 7876 return (sizeof (int)); 7877 } 7878 7879 /* 7880 * TCP routine to get the values of options. 7881 */ 7882 static int 7883 tcp_opt_get(conn_t *connp, int level, int name, uchar_t *ptr) 7884 { 7885 int *i1 = (int *)ptr; 7886 tcp_t *tcp = connp->conn_tcp; 7887 conn_opt_arg_t coas; 7888 int retval; 7889 7890 coas.coa_connp = connp; 7891 coas.coa_ixa = connp->conn_ixa; 7892 coas.coa_ipp = &connp->conn_xmit_ipp; 7893 coas.coa_ancillary = B_FALSE; 7894 coas.coa_changed = 0; 7895 7896 switch (level) { 7897 case SOL_SOCKET: 7898 switch (name) { 7899 case SO_SND_COPYAVOID: 7900 *i1 = tcp->tcp_snd_zcopy_on ? 7901 SO_SND_COPYAVOID : 0; 7902 return (sizeof (int)); 7903 case SO_ACCEPTCONN: 7904 *i1 = (tcp->tcp_state == TCPS_LISTEN); 7905 return (sizeof (int)); 7906 } 7907 break; 7908 case IPPROTO_TCP: 7909 switch (name) { 7910 case TCP_NODELAY: 7911 *i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0; 7912 return (sizeof (int)); 7913 case TCP_MAXSEG: 7914 *i1 = tcp->tcp_mss; 7915 return (sizeof (int)); 7916 case TCP_NOTIFY_THRESHOLD: 7917 *i1 = (int)tcp->tcp_first_timer_threshold; 7918 return (sizeof (int)); 7919 case TCP_ABORT_THRESHOLD: 7920 *i1 = tcp->tcp_second_timer_threshold; 7921 return (sizeof (int)); 7922 case TCP_CONN_NOTIFY_THRESHOLD: 7923 *i1 = tcp->tcp_first_ctimer_threshold; 7924 return (sizeof (int)); 7925 case TCP_CONN_ABORT_THRESHOLD: 7926 *i1 = tcp->tcp_second_ctimer_threshold; 7927 return (sizeof (int)); 7928 case TCP_INIT_CWND: 7929 *i1 = tcp->tcp_init_cwnd; 7930 return (sizeof (int)); 7931 case TCP_KEEPALIVE_THRESHOLD: 7932 *i1 = tcp->tcp_ka_interval; 7933 return (sizeof (int)); 7934 case TCP_KEEPALIVE_ABORT_THRESHOLD: 7935 *i1 = tcp->tcp_ka_abort_thres; 7936 return (sizeof (int)); 7937 case TCP_CORK: 7938 *i1 = tcp->tcp_cork; 7939 return (sizeof (int)); 7940 } 7941 break; 7942 case IPPROTO_IP: 7943 if (connp->conn_family != AF_INET) 7944 return (-1); 7945 switch (name) { 7946 case IP_OPTIONS: 7947 case T_IP_OPTIONS: 7948 /* Caller ensures enough space */ 7949 return (ip_opt_get_user(connp, ptr)); 7950 default: 7951 break; 7952 } 7953 break; 7954 7955 case IPPROTO_IPV6: 7956 /* 7957 * IPPROTO_IPV6 options are only supported for sockets 7958 * that are using IPv6 on the wire. 7959 */ 7960 if (connp->conn_ipversion != IPV6_VERSION) { 7961 return (-1); 7962 } 7963 switch (name) { 7964 case IPV6_PATHMTU: 7965 if (tcp->tcp_state < TCPS_ESTABLISHED) 7966 return (-1); 7967 break; 7968 } 7969 break; 7970 } 7971 mutex_enter(&connp->conn_lock); 7972 retval = conn_opt_get(&coas, level, name, ptr); 7973 mutex_exit(&connp->conn_lock); 7974 return (retval); 7975 } 7976 7977 /* 7978 * TCP routine to get the values of options. 7979 */ 7980 int 7981 tcp_tpi_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 7982 { 7983 return (tcp_opt_get(Q_TO_CONN(q), level, name, ptr)); 7984 } 7985 7986 /* returns UNIX error, the optlen is a value-result arg */ 7987 int 7988 tcp_getsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 7989 void *optvalp, socklen_t *optlen, cred_t *cr) 7990 { 7991 conn_t *connp = (conn_t *)proto_handle; 7992 squeue_t *sqp = connp->conn_sqp; 7993 int error; 7994 t_uscalar_t max_optbuf_len; 7995 void *optvalp_buf; 7996 int len; 7997 7998 ASSERT(connp->conn_upper_handle != NULL); 7999 8000 error = proto_opt_check(level, option_name, *optlen, &max_optbuf_len, 8001 tcp_opt_obj.odb_opt_des_arr, 8002 tcp_opt_obj.odb_opt_arr_cnt, 8003 B_FALSE, B_TRUE, cr); 8004 if (error != 0) { 8005 if (error < 0) { 8006 error = proto_tlitosyserr(-error); 8007 } 8008 return (error); 8009 } 8010 8011 optvalp_buf = kmem_alloc(max_optbuf_len, KM_SLEEP); 8012 8013 error = squeue_synch_enter(sqp, connp, NULL); 8014 if (error == ENOMEM) { 8015 kmem_free(optvalp_buf, max_optbuf_len); 8016 return (ENOMEM); 8017 } 8018 8019 len = tcp_opt_get(connp, level, option_name, optvalp_buf); 8020 squeue_synch_exit(sqp, connp); 8021 8022 if (len == -1) { 8023 kmem_free(optvalp_buf, max_optbuf_len); 8024 return (EINVAL); 8025 } 8026 8027 /* 8028 * update optlen and copy option value 8029 */ 8030 t_uscalar_t size = MIN(len, *optlen); 8031 8032 bcopy(optvalp_buf, optvalp, size); 8033 bcopy(&size, optlen, sizeof (size)); 8034 8035 kmem_free(optvalp_buf, max_optbuf_len); 8036 return (0); 8037 } 8038 8039 /* 8040 * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements. 8041 * Parameters are assumed to be verified by the caller. 8042 */ 8043 /* ARGSUSED */ 8044 int 8045 tcp_opt_set(conn_t *connp, uint_t optset_context, int level, int name, 8046 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 8047 void *thisdg_attrs, cred_t *cr) 8048 { 8049 tcp_t *tcp = connp->conn_tcp; 8050 int *i1 = (int *)invalp; 8051 boolean_t onoff = (*i1 == 0) ? 0 : 1; 8052 boolean_t checkonly; 8053 int reterr; 8054 tcp_stack_t *tcps = tcp->tcp_tcps; 8055 conn_opt_arg_t coas; 8056 8057 coas.coa_connp = connp; 8058 coas.coa_ixa = connp->conn_ixa; 8059 coas.coa_ipp = &connp->conn_xmit_ipp; 8060 coas.coa_ancillary = B_FALSE; 8061 coas.coa_changed = 0; 8062 8063 switch (optset_context) { 8064 case SETFN_OPTCOM_CHECKONLY: 8065 checkonly = B_TRUE; 8066 /* 8067 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 8068 * inlen != 0 implies value supplied and 8069 * we have to "pretend" to set it. 8070 * inlen == 0 implies that there is no 8071 * value part in T_CHECK request and just validation 8072 * done elsewhere should be enough, we just return here. 8073 */ 8074 if (inlen == 0) { 8075 *outlenp = 0; 8076 return (0); 8077 } 8078 break; 8079 case SETFN_OPTCOM_NEGOTIATE: 8080 checkonly = B_FALSE; 8081 break; 8082 case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */ 8083 case SETFN_CONN_NEGOTIATE: 8084 checkonly = B_FALSE; 8085 /* 8086 * Negotiating local and "association-related" options 8087 * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ) 8088 * primitives is allowed by XTI, but we choose 8089 * to not implement this style negotiation for Internet 8090 * protocols (We interpret it is a must for OSI world but 8091 * optional for Internet protocols) for all options. 8092 * [ Will do only for the few options that enable test 8093 * suites that our XTI implementation of this feature 8094 * works for transports that do allow it ] 8095 */ 8096 if (!tcp_allow_connopt_set(level, name)) { 8097 *outlenp = 0; 8098 return (EINVAL); 8099 } 8100 break; 8101 default: 8102 /* 8103 * We should never get here 8104 */ 8105 *outlenp = 0; 8106 return (EINVAL); 8107 } 8108 8109 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 8110 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 8111 8112 /* 8113 * For TCP, we should have no ancillary data sent down 8114 * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs 8115 * has to be zero. 8116 */ 8117 ASSERT(thisdg_attrs == NULL); 8118 8119 /* 8120 * For fixed length options, no sanity check 8121 * of passed in length is done. It is assumed *_optcom_req() 8122 * routines do the right thing. 8123 */ 8124 switch (level) { 8125 case SOL_SOCKET: 8126 switch (name) { 8127 case SO_KEEPALIVE: 8128 if (checkonly) { 8129 /* check only case */ 8130 break; 8131 } 8132 8133 if (!onoff) { 8134 if (connp->conn_keepalive) { 8135 if (tcp->tcp_ka_tid != 0) { 8136 (void) TCP_TIMER_CANCEL(tcp, 8137 tcp->tcp_ka_tid); 8138 tcp->tcp_ka_tid = 0; 8139 } 8140 connp->conn_keepalive = 0; 8141 } 8142 break; 8143 } 8144 if (!connp->conn_keepalive) { 8145 /* Crank up the keepalive timer */ 8146 tcp->tcp_ka_last_intrvl = 0; 8147 tcp->tcp_ka_tid = TCP_TIMER(tcp, 8148 tcp_keepalive_killer, 8149 MSEC_TO_TICK(tcp->tcp_ka_interval)); 8150 connp->conn_keepalive = 1; 8151 } 8152 break; 8153 case SO_SNDBUF: { 8154 if (*i1 > tcps->tcps_max_buf) { 8155 *outlenp = 0; 8156 return (ENOBUFS); 8157 } 8158 if (checkonly) 8159 break; 8160 8161 connp->conn_sndbuf = *i1; 8162 if (tcps->tcps_snd_lowat_fraction != 0) { 8163 connp->conn_sndlowat = connp->conn_sndbuf / 8164 tcps->tcps_snd_lowat_fraction; 8165 } 8166 (void) tcp_maxpsz_set(tcp, B_TRUE); 8167 /* 8168 * If we are flow-controlled, recheck the condition. 8169 * There are apps that increase SO_SNDBUF size when 8170 * flow-controlled (EWOULDBLOCK), and expect the flow 8171 * control condition to be lifted right away. 8172 */ 8173 mutex_enter(&tcp->tcp_non_sq_lock); 8174 if (tcp->tcp_flow_stopped && 8175 TCP_UNSENT_BYTES(tcp) < connp->conn_sndbuf) { 8176 tcp_clrqfull(tcp); 8177 } 8178 mutex_exit(&tcp->tcp_non_sq_lock); 8179 *outlenp = inlen; 8180 return (0); 8181 } 8182 case SO_RCVBUF: 8183 if (*i1 > tcps->tcps_max_buf) { 8184 *outlenp = 0; 8185 return (ENOBUFS); 8186 } 8187 /* Silently ignore zero */ 8188 if (!checkonly && *i1 != 0) { 8189 *i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss); 8190 (void) tcp_rwnd_set(tcp, *i1); 8191 } 8192 /* 8193 * XXX should we return the rwnd here 8194 * and tcp_opt_get ? 8195 */ 8196 *outlenp = inlen; 8197 return (0); 8198 case SO_SND_COPYAVOID: 8199 if (!checkonly) { 8200 if (tcp->tcp_loopback || 8201 (tcp->tcp_kssl_ctx != NULL) || 8202 (onoff != 1) || !tcp_zcopy_check(tcp)) { 8203 *outlenp = 0; 8204 return (EOPNOTSUPP); 8205 } 8206 tcp->tcp_snd_zcopy_aware = 1; 8207 } 8208 *outlenp = inlen; 8209 return (0); 8210 } 8211 break; 8212 case IPPROTO_TCP: 8213 switch (name) { 8214 case TCP_NODELAY: 8215 if (!checkonly) 8216 tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss; 8217 break; 8218 case TCP_NOTIFY_THRESHOLD: 8219 if (!checkonly) 8220 tcp->tcp_first_timer_threshold = *i1; 8221 break; 8222 case TCP_ABORT_THRESHOLD: 8223 if (!checkonly) 8224 tcp->tcp_second_timer_threshold = *i1; 8225 break; 8226 case TCP_CONN_NOTIFY_THRESHOLD: 8227 if (!checkonly) 8228 tcp->tcp_first_ctimer_threshold = *i1; 8229 break; 8230 case TCP_CONN_ABORT_THRESHOLD: 8231 if (!checkonly) 8232 tcp->tcp_second_ctimer_threshold = *i1; 8233 break; 8234 case TCP_RECVDSTADDR: 8235 if (tcp->tcp_state > TCPS_LISTEN) { 8236 *outlenp = 0; 8237 return (EOPNOTSUPP); 8238 } 8239 /* Setting done in conn_opt_set */ 8240 break; 8241 case TCP_INIT_CWND: { 8242 uint32_t init_cwnd = *((uint32_t *)invalp); 8243 8244 if (checkonly) 8245 break; 8246 8247 /* 8248 * Only allow socket with network configuration 8249 * privilege to set the initial cwnd to be larger 8250 * than allowed by RFC 3390. 8251 */ 8252 if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) { 8253 tcp->tcp_init_cwnd = init_cwnd; 8254 break; 8255 } 8256 if ((reterr = secpolicy_ip_config(cr, B_TRUE)) != 0) { 8257 *outlenp = 0; 8258 return (reterr); 8259 } 8260 if (init_cwnd > TCP_MAX_INIT_CWND) { 8261 *outlenp = 0; 8262 return (EINVAL); 8263 } 8264 tcp->tcp_init_cwnd = init_cwnd; 8265 break; 8266 } 8267 case TCP_KEEPALIVE_THRESHOLD: 8268 if (checkonly) 8269 break; 8270 8271 if (*i1 < tcps->tcps_keepalive_interval_low || 8272 *i1 > tcps->tcps_keepalive_interval_high) { 8273 *outlenp = 0; 8274 return (EINVAL); 8275 } 8276 if (*i1 != tcp->tcp_ka_interval) { 8277 tcp->tcp_ka_interval = *i1; 8278 /* 8279 * Check if we need to restart the 8280 * keepalive timer. 8281 */ 8282 if (tcp->tcp_ka_tid != 0) { 8283 ASSERT(connp->conn_keepalive); 8284 (void) TCP_TIMER_CANCEL(tcp, 8285 tcp->tcp_ka_tid); 8286 tcp->tcp_ka_last_intrvl = 0; 8287 tcp->tcp_ka_tid = TCP_TIMER(tcp, 8288 tcp_keepalive_killer, 8289 MSEC_TO_TICK(tcp->tcp_ka_interval)); 8290 } 8291 } 8292 break; 8293 case TCP_KEEPALIVE_ABORT_THRESHOLD: 8294 if (!checkonly) { 8295 if (*i1 < 8296 tcps->tcps_keepalive_abort_interval_low || 8297 *i1 > 8298 tcps->tcps_keepalive_abort_interval_high) { 8299 *outlenp = 0; 8300 return (EINVAL); 8301 } 8302 tcp->tcp_ka_abort_thres = *i1; 8303 } 8304 break; 8305 case TCP_CORK: 8306 if (!checkonly) { 8307 /* 8308 * if tcp->tcp_cork was set and is now 8309 * being unset, we have to make sure that 8310 * the remaining data gets sent out. Also 8311 * unset tcp->tcp_cork so that tcp_wput_data() 8312 * can send data even if it is less than mss 8313 */ 8314 if (tcp->tcp_cork && onoff == 0 && 8315 tcp->tcp_unsent > 0) { 8316 tcp->tcp_cork = B_FALSE; 8317 tcp_wput_data(tcp, NULL, B_FALSE); 8318 } 8319 tcp->tcp_cork = onoff; 8320 } 8321 break; 8322 default: 8323 break; 8324 } 8325 break; 8326 case IPPROTO_IP: 8327 if (connp->conn_family != AF_INET) { 8328 *outlenp = 0; 8329 return (EINVAL); 8330 } 8331 switch (name) { 8332 case IP_SEC_OPT: 8333 /* 8334 * We should not allow policy setting after 8335 * we start listening for connections. 8336 */ 8337 if (tcp->tcp_state == TCPS_LISTEN) { 8338 return (EINVAL); 8339 } 8340 break; 8341 } 8342 break; 8343 case IPPROTO_IPV6: 8344 /* 8345 * IPPROTO_IPV6 options are only supported for sockets 8346 * that are using IPv6 on the wire. 8347 */ 8348 if (connp->conn_ipversion != IPV6_VERSION) { 8349 *outlenp = 0; 8350 return (EINVAL); 8351 } 8352 8353 switch (name) { 8354 case IPV6_RECVPKTINFO: 8355 if (!checkonly) { 8356 /* Force it to be sent up with the next msg */ 8357 tcp->tcp_recvifindex = 0; 8358 } 8359 break; 8360 case IPV6_RECVTCLASS: 8361 if (!checkonly) { 8362 /* Force it to be sent up with the next msg */ 8363 tcp->tcp_recvtclass = 0xffffffffU; 8364 } 8365 break; 8366 case IPV6_RECVHOPLIMIT: 8367 if (!checkonly) { 8368 /* Force it to be sent up with the next msg */ 8369 tcp->tcp_recvhops = 0xffffffffU; 8370 } 8371 break; 8372 case IPV6_PKTINFO: 8373 /* This is an extra check for TCP */ 8374 if (inlen == sizeof (struct in6_pktinfo)) { 8375 struct in6_pktinfo *pkti; 8376 8377 pkti = (struct in6_pktinfo *)invalp; 8378 /* 8379 * RFC 3542 states that ipi6_addr must be 8380 * the unspecified address when setting the 8381 * IPV6_PKTINFO sticky socket option on a 8382 * TCP socket. 8383 */ 8384 if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr)) 8385 return (EINVAL); 8386 } 8387 break; 8388 case IPV6_SEC_OPT: 8389 /* 8390 * We should not allow policy setting after 8391 * we start listening for connections. 8392 */ 8393 if (tcp->tcp_state == TCPS_LISTEN) { 8394 return (EINVAL); 8395 } 8396 break; 8397 } 8398 break; 8399 } 8400 reterr = conn_opt_set(&coas, level, name, inlen, invalp, 8401 checkonly, cr); 8402 if (reterr != 0) { 8403 *outlenp = 0; 8404 return (reterr); 8405 } 8406 8407 /* 8408 * Common case of OK return with outval same as inval 8409 */ 8410 if (invalp != outvalp) { 8411 /* don't trust bcopy for identical src/dst */ 8412 (void) bcopy(invalp, outvalp, inlen); 8413 } 8414 *outlenp = inlen; 8415 8416 if (coas.coa_changed & COA_HEADER_CHANGED) { 8417 reterr = tcp_build_hdrs(tcp); 8418 if (reterr != 0) 8419 return (reterr); 8420 } 8421 if (coas.coa_changed & COA_ROUTE_CHANGED) { 8422 in6_addr_t nexthop; 8423 8424 /* 8425 * If we are connected we re-cache the information. 8426 * We ignore errors to preserve BSD behavior. 8427 * Note that we don't redo IPsec policy lookup here 8428 * since the final destination (or source) didn't change. 8429 */ 8430 ip_attr_nexthop(&connp->conn_xmit_ipp, connp->conn_ixa, 8431 &connp->conn_faddr_v6, &nexthop); 8432 8433 if (!IN6_IS_ADDR_UNSPECIFIED(&connp->conn_faddr_v6) && 8434 !IN6_IS_ADDR_V4MAPPED_ANY(&connp->conn_faddr_v6)) { 8435 (void) ip_attr_connect(connp, connp->conn_ixa, 8436 &connp->conn_laddr_v6, &connp->conn_faddr_v6, 8437 &nexthop, connp->conn_fport, NULL, NULL, 8438 IPDF_VERIFY_DST); 8439 } 8440 } 8441 if ((coas.coa_changed & COA_SNDBUF_CHANGED) && !IPCL_IS_NONSTR(connp)) { 8442 connp->conn_wq->q_hiwat = connp->conn_sndbuf; 8443 } 8444 if (coas.coa_changed & COA_WROFF_CHANGED) { 8445 connp->conn_wroff = connp->conn_ht_iphc_allocated + 8446 tcps->tcps_wroff_xtra; 8447 (void) proto_set_tx_wroff(connp->conn_rq, connp, 8448 connp->conn_wroff); 8449 } 8450 if (coas.coa_changed & COA_OOBINLINE_CHANGED) { 8451 if (IPCL_IS_NONSTR(connp)) 8452 proto_set_rx_oob_opt(connp, onoff); 8453 } 8454 return (0); 8455 } 8456 8457 /* ARGSUSED */ 8458 int 8459 tcp_tpi_opt_set(queue_t *q, uint_t optset_context, int level, int name, 8460 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 8461 void *thisdg_attrs, cred_t *cr) 8462 { 8463 conn_t *connp = Q_TO_CONN(q); 8464 8465 return (tcp_opt_set(connp, optset_context, level, name, inlen, invalp, 8466 outlenp, outvalp, thisdg_attrs, cr)); 8467 } 8468 8469 int 8470 tcp_setsockopt(sock_lower_handle_t proto_handle, int level, int option_name, 8471 const void *optvalp, socklen_t optlen, cred_t *cr) 8472 { 8473 conn_t *connp = (conn_t *)proto_handle; 8474 squeue_t *sqp = connp->conn_sqp; 8475 int error; 8476 8477 ASSERT(connp->conn_upper_handle != NULL); 8478 /* 8479 * Entering the squeue synchronously can result in a context switch, 8480 * which can cause a rather sever performance degradation. So we try to 8481 * handle whatever options we can without entering the squeue. 8482 */ 8483 if (level == IPPROTO_TCP) { 8484 switch (option_name) { 8485 case TCP_NODELAY: 8486 if (optlen != sizeof (int32_t)) 8487 return (EINVAL); 8488 mutex_enter(&connp->conn_tcp->tcp_non_sq_lock); 8489 connp->conn_tcp->tcp_naglim = *(int *)optvalp ? 1 : 8490 connp->conn_tcp->tcp_mss; 8491 mutex_exit(&connp->conn_tcp->tcp_non_sq_lock); 8492 return (0); 8493 default: 8494 break; 8495 } 8496 } 8497 8498 error = squeue_synch_enter(sqp, connp, NULL); 8499 if (error == ENOMEM) { 8500 return (ENOMEM); 8501 } 8502 8503 error = proto_opt_check(level, option_name, optlen, NULL, 8504 tcp_opt_obj.odb_opt_des_arr, 8505 tcp_opt_obj.odb_opt_arr_cnt, 8506 B_TRUE, B_FALSE, cr); 8507 8508 if (error != 0) { 8509 if (error < 0) { 8510 error = proto_tlitosyserr(-error); 8511 } 8512 squeue_synch_exit(sqp, connp); 8513 return (error); 8514 } 8515 8516 error = tcp_opt_set(connp, SETFN_OPTCOM_NEGOTIATE, level, option_name, 8517 optlen, (uchar_t *)optvalp, (uint_t *)&optlen, (uchar_t *)optvalp, 8518 NULL, cr); 8519 squeue_synch_exit(sqp, connp); 8520 8521 ASSERT(error >= 0); 8522 8523 return (error); 8524 } 8525 8526 /* 8527 * Build/update the tcp header template (in conn_ht_iphc) based on 8528 * conn_xmit_ipp. The headers include ip6_t, any extension 8529 * headers, and the maximum size tcp header (to avoid reallocation 8530 * on the fly for additional tcp options). 8531 * 8532 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}. 8533 * Returns failure if can't allocate memory. 8534 */ 8535 static int 8536 tcp_build_hdrs(tcp_t *tcp) 8537 { 8538 tcp_stack_t *tcps = tcp->tcp_tcps; 8539 conn_t *connp = tcp->tcp_connp; 8540 tcpha_t *tcpha; 8541 uint32_t cksum; 8542 int error; 8543 8544 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */ 8545 mutex_enter(&connp->conn_lock); 8546 error = conn_build_hdr_template(connp, TCP_MIN_HEADER_LENGTH, 8547 TCP_MAX_TCP_OPTIONS_LENGTH, &connp->conn_laddr_v6, 8548 &connp->conn_faddr_v6, connp->conn_flowinfo); 8549 mutex_exit(&connp->conn_lock); 8550 if (error != 0) 8551 return (error); 8552 8553 /* 8554 * Any routing header/option has been massaged. The checksum difference 8555 * is stored in conn_sum for later use. 8556 */ 8557 tcpha = (tcpha_t *)connp->conn_ht_ulp; 8558 tcp->tcp_tcpha = tcpha; 8559 8560 tcpha->tha_lport = connp->conn_lport; 8561 tcpha->tha_fport = connp->conn_fport; 8562 tcpha->tha_sum = 0; 8563 tcpha->tha_offset_and_reserved = (5 << 4); 8564 8565 /* 8566 * IP wants our header length in the checksum field to 8567 * allow it to perform a single pseudo-header+checksum 8568 * calculation on behalf of TCP. 8569 * Include the adjustment for a source route once IP_OPTIONS is set. 8570 */ 8571 cksum = sizeof (tcpha_t) + connp->conn_sum; 8572 cksum = (cksum >> 16) + (cksum & 0xFFFF); 8573 ASSERT(cksum < 0x10000); 8574 tcpha->tha_sum = htons(cksum); 8575 8576 if (connp->conn_ipversion == IPV4_VERSION) 8577 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc; 8578 else 8579 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc; 8580 8581 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra > 8582 connp->conn_wroff) { 8583 connp->conn_wroff = connp->conn_ht_iphc_allocated + 8584 tcps->tcps_wroff_xtra; 8585 (void) proto_set_tx_wroff(connp->conn_rq, connp, 8586 connp->conn_wroff); 8587 } 8588 return (0); 8589 } 8590 8591 /* Get callback routine passed to nd_load by tcp_param_register */ 8592 /* ARGSUSED */ 8593 static int 8594 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 8595 { 8596 tcpparam_t *tcppa = (tcpparam_t *)cp; 8597 8598 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 8599 return (0); 8600 } 8601 8602 /* 8603 * Walk through the param array specified registering each element with the 8604 * named dispatch handler. 8605 */ 8606 static boolean_t 8607 tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, tcp_stack_t *tcps) 8608 { 8609 for (; cnt-- > 0; tcppa++) { 8610 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 8611 if (!nd_load(ndp, tcppa->tcp_param_name, 8612 tcp_param_get, tcp_param_set, 8613 (caddr_t)tcppa)) { 8614 nd_free(ndp); 8615 return (B_FALSE); 8616 } 8617 } 8618 } 8619 tcps->tcps_wroff_xtra_param = kmem_zalloc(sizeof (tcpparam_t), 8620 KM_SLEEP); 8621 bcopy(&lcl_tcp_wroff_xtra_param, tcps->tcps_wroff_xtra_param, 8622 sizeof (tcpparam_t)); 8623 if (!nd_load(ndp, tcps->tcps_wroff_xtra_param->tcp_param_name, 8624 tcp_param_get, tcp_param_set_aligned, 8625 (caddr_t)tcps->tcps_wroff_xtra_param)) { 8626 nd_free(ndp); 8627 return (B_FALSE); 8628 } 8629 if (!nd_load(ndp, "tcp_extra_priv_ports", 8630 tcp_extra_priv_ports_get, NULL, NULL)) { 8631 nd_free(ndp); 8632 return (B_FALSE); 8633 } 8634 if (!nd_load(ndp, "tcp_extra_priv_ports_add", 8635 NULL, tcp_extra_priv_ports_add, NULL)) { 8636 nd_free(ndp); 8637 return (B_FALSE); 8638 } 8639 if (!nd_load(ndp, "tcp_extra_priv_ports_del", 8640 NULL, tcp_extra_priv_ports_del, NULL)) { 8641 nd_free(ndp); 8642 return (B_FALSE); 8643 } 8644 if (!nd_load(ndp, "tcp_1948_phrase", NULL, 8645 tcp_1948_phrase_set, NULL)) { 8646 nd_free(ndp); 8647 return (B_FALSE); 8648 } 8649 /* 8650 * Dummy ndd variables - only to convey obsolescence information 8651 * through printing of their name (no get or set routines) 8652 * XXX Remove in future releases ? 8653 */ 8654 if (!nd_load(ndp, 8655 "tcp_close_wait_interval(obsoleted - " 8656 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 8657 nd_free(ndp); 8658 return (B_FALSE); 8659 } 8660 return (B_TRUE); 8661 } 8662 8663 /* ndd set routine for tcp_wroff_xtra. */ 8664 /* ARGSUSED */ 8665 static int 8666 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 8667 cred_t *cr) 8668 { 8669 long new_value; 8670 tcpparam_t *tcppa = (tcpparam_t *)cp; 8671 8672 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 8673 new_value < tcppa->tcp_param_min || 8674 new_value > tcppa->tcp_param_max) { 8675 return (EINVAL); 8676 } 8677 /* 8678 * Need to make sure new_value is a multiple of 4. If it is not, 8679 * round it up. For future 64 bit requirement, we actually make it 8680 * a multiple of 8. 8681 */ 8682 if (new_value & 0x7) { 8683 new_value = (new_value & ~0x7) + 0x8; 8684 } 8685 tcppa->tcp_param_val = new_value; 8686 return (0); 8687 } 8688 8689 /* Set callback routine passed to nd_load by tcp_param_register */ 8690 /* ARGSUSED */ 8691 static int 8692 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 8693 { 8694 long new_value; 8695 tcpparam_t *tcppa = (tcpparam_t *)cp; 8696 8697 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 8698 new_value < tcppa->tcp_param_min || 8699 new_value > tcppa->tcp_param_max) { 8700 return (EINVAL); 8701 } 8702 tcppa->tcp_param_val = new_value; 8703 return (0); 8704 } 8705 8706 /* 8707 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 8708 * is filled, return as much as we can. The message passed in may be 8709 * multi-part, chained using b_cont. "start" is the starting sequence 8710 * number for this piece. 8711 */ 8712 static mblk_t * 8713 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 8714 { 8715 uint32_t end; 8716 mblk_t *mp1; 8717 mblk_t *mp2; 8718 mblk_t *next_mp; 8719 uint32_t u1; 8720 tcp_stack_t *tcps = tcp->tcp_tcps; 8721 8722 8723 /* Walk through all the new pieces. */ 8724 do { 8725 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 8726 (uintptr_t)INT_MAX); 8727 end = start + (int)(mp->b_wptr - mp->b_rptr); 8728 next_mp = mp->b_cont; 8729 if (start == end) { 8730 /* Empty. Blast it. */ 8731 freeb(mp); 8732 continue; 8733 } 8734 mp->b_cont = NULL; 8735 TCP_REASS_SET_SEQ(mp, start); 8736 TCP_REASS_SET_END(mp, end); 8737 mp1 = tcp->tcp_reass_tail; 8738 if (!mp1) { 8739 tcp->tcp_reass_tail = mp; 8740 tcp->tcp_reass_head = mp; 8741 BUMP_MIB(&tcps->tcps_mib, tcpInDataUnorderSegs); 8742 UPDATE_MIB(&tcps->tcps_mib, 8743 tcpInDataUnorderBytes, end - start); 8744 continue; 8745 } 8746 /* New stuff completely beyond tail? */ 8747 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { 8748 /* Link it on end. */ 8749 mp1->b_cont = mp; 8750 tcp->tcp_reass_tail = mp; 8751 BUMP_MIB(&tcps->tcps_mib, tcpInDataUnorderSegs); 8752 UPDATE_MIB(&tcps->tcps_mib, 8753 tcpInDataUnorderBytes, end - start); 8754 continue; 8755 } 8756 mp1 = tcp->tcp_reass_head; 8757 u1 = TCP_REASS_SEQ(mp1); 8758 /* New stuff at the front? */ 8759 if (SEQ_LT(start, u1)) { 8760 /* Yes... Check for overlap. */ 8761 mp->b_cont = mp1; 8762 tcp->tcp_reass_head = mp; 8763 tcp_reass_elim_overlap(tcp, mp); 8764 continue; 8765 } 8766 /* 8767 * The new piece fits somewhere between the head and tail. 8768 * We find our slot, where mp1 precedes us and mp2 trails. 8769 */ 8770 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 8771 u1 = TCP_REASS_SEQ(mp2); 8772 if (SEQ_LEQ(start, u1)) 8773 break; 8774 } 8775 /* Link ourselves in */ 8776 mp->b_cont = mp2; 8777 mp1->b_cont = mp; 8778 8779 /* Trim overlap with following mblk(s) first */ 8780 tcp_reass_elim_overlap(tcp, mp); 8781 8782 /* Trim overlap with preceding mblk */ 8783 tcp_reass_elim_overlap(tcp, mp1); 8784 8785 } while (start = end, mp = next_mp); 8786 mp1 = tcp->tcp_reass_head; 8787 /* Anything ready to go? */ 8788 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 8789 return (NULL); 8790 /* Eat what we can off the queue */ 8791 for (;;) { 8792 mp = mp1->b_cont; 8793 end = TCP_REASS_END(mp1); 8794 TCP_REASS_SET_SEQ(mp1, 0); 8795 TCP_REASS_SET_END(mp1, 0); 8796 if (!mp) { 8797 tcp->tcp_reass_tail = NULL; 8798 break; 8799 } 8800 if (end != TCP_REASS_SEQ(mp)) { 8801 mp1->b_cont = NULL; 8802 break; 8803 } 8804 mp1 = mp; 8805 } 8806 mp1 = tcp->tcp_reass_head; 8807 tcp->tcp_reass_head = mp; 8808 return (mp1); 8809 } 8810 8811 /* Eliminate any overlap that mp may have over later mblks */ 8812 static void 8813 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 8814 { 8815 uint32_t end; 8816 mblk_t *mp1; 8817 uint32_t u1; 8818 tcp_stack_t *tcps = tcp->tcp_tcps; 8819 8820 end = TCP_REASS_END(mp); 8821 while ((mp1 = mp->b_cont) != NULL) { 8822 u1 = TCP_REASS_SEQ(mp1); 8823 if (!SEQ_GT(end, u1)) 8824 break; 8825 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 8826 mp->b_wptr -= end - u1; 8827 TCP_REASS_SET_END(mp, u1); 8828 BUMP_MIB(&tcps->tcps_mib, tcpInDataPartDupSegs); 8829 UPDATE_MIB(&tcps->tcps_mib, 8830 tcpInDataPartDupBytes, end - u1); 8831 break; 8832 } 8833 mp->b_cont = mp1->b_cont; 8834 TCP_REASS_SET_SEQ(mp1, 0); 8835 TCP_REASS_SET_END(mp1, 0); 8836 freeb(mp1); 8837 BUMP_MIB(&tcps->tcps_mib, tcpInDataDupSegs); 8838 UPDATE_MIB(&tcps->tcps_mib, tcpInDataDupBytes, end - u1); 8839 } 8840 if (!mp1) 8841 tcp->tcp_reass_tail = mp; 8842 } 8843 8844 static uint_t 8845 tcp_rwnd_reopen(tcp_t *tcp) 8846 { 8847 uint_t ret = 0; 8848 uint_t thwin; 8849 conn_t *connp = tcp->tcp_connp; 8850 8851 /* Learn the latest rwnd information that we sent to the other side. */ 8852 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win)) 8853 << tcp->tcp_rcv_ws; 8854 /* This is peer's calculated send window (our receive window). */ 8855 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 8856 /* 8857 * Increase the receive window to max. But we need to do receiver 8858 * SWS avoidance. This means that we need to check the increase of 8859 * of receive window is at least 1 MSS. 8860 */ 8861 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) { 8862 /* 8863 * If the window that the other side knows is less than max 8864 * deferred acks segments, send an update immediately. 8865 */ 8866 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 8867 BUMP_MIB(&tcp->tcp_tcps->tcps_mib, tcpOutWinUpdate); 8868 ret = TH_ACK_NEEDED; 8869 } 8870 tcp->tcp_rwnd = connp->conn_rcvbuf; 8871 } 8872 return (ret); 8873 } 8874 8875 /* 8876 * Send up all messages queued on tcp_rcv_list. 8877 */ 8878 static uint_t 8879 tcp_rcv_drain(tcp_t *tcp) 8880 { 8881 mblk_t *mp; 8882 uint_t ret = 0; 8883 #ifdef DEBUG 8884 uint_t cnt = 0; 8885 #endif 8886 queue_t *q = tcp->tcp_connp->conn_rq; 8887 8888 /* Can't drain on an eager connection */ 8889 if (tcp->tcp_listener != NULL) 8890 return (ret); 8891 8892 /* Can't be a non-STREAMS connection */ 8893 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 8894 8895 /* No need for the push timer now. */ 8896 if (tcp->tcp_push_tid != 0) { 8897 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 8898 tcp->tcp_push_tid = 0; 8899 } 8900 8901 /* 8902 * Handle two cases here: we are currently fused or we were 8903 * previously fused and have some urgent data to be delivered 8904 * upstream. The latter happens because we either ran out of 8905 * memory or were detached and therefore sending the SIGURG was 8906 * deferred until this point. In either case we pass control 8907 * over to tcp_fuse_rcv_drain() since it may need to complete 8908 * some work. 8909 */ 8910 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 8911 ASSERT(IPCL_IS_NONSTR(tcp->tcp_connp) || 8912 tcp->tcp_fused_sigurg_mp != NULL); 8913 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 8914 &tcp->tcp_fused_sigurg_mp)) 8915 return (ret); 8916 } 8917 8918 while ((mp = tcp->tcp_rcv_list) != NULL) { 8919 tcp->tcp_rcv_list = mp->b_next; 8920 mp->b_next = NULL; 8921 #ifdef DEBUG 8922 cnt += msgdsize(mp); 8923 #endif 8924 /* Does this need SSL processing first? */ 8925 if ((tcp->tcp_kssl_ctx != NULL) && (DB_TYPE(mp) == M_DATA)) { 8926 DTRACE_PROBE1(kssl_mblk__ksslinput_rcvdrain, 8927 mblk_t *, mp); 8928 tcp_kssl_input(tcp, mp, NULL); 8929 continue; 8930 } 8931 putnext(q, mp); 8932 } 8933 #ifdef DEBUG 8934 ASSERT(cnt == tcp->tcp_rcv_cnt); 8935 #endif 8936 tcp->tcp_rcv_last_head = NULL; 8937 tcp->tcp_rcv_last_tail = NULL; 8938 tcp->tcp_rcv_cnt = 0; 8939 8940 if (canputnext(q)) 8941 return (tcp_rwnd_reopen(tcp)); 8942 8943 return (ret); 8944 } 8945 8946 /* 8947 * Queue data on tcp_rcv_list which is a b_next chain. 8948 * tcp_rcv_last_head/tail is the last element of this chain. 8949 * Each element of the chain is a b_cont chain. 8950 * 8951 * M_DATA messages are added to the current element. 8952 * Other messages are added as new (b_next) elements. 8953 */ 8954 void 8955 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr) 8956 { 8957 ASSERT(seg_len == msgdsize(mp)); 8958 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 8959 8960 if (is_system_labeled()) { 8961 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL); 8962 /* 8963 * Provide for protocols above TCP such as RPC. NOPID leaves 8964 * db_cpid unchanged. 8965 * The cred could have already been set. 8966 */ 8967 if (cr != NULL) 8968 mblk_setcred(mp, cr, NOPID); 8969 } 8970 8971 if (tcp->tcp_rcv_list == NULL) { 8972 ASSERT(tcp->tcp_rcv_last_head == NULL); 8973 tcp->tcp_rcv_list = mp; 8974 tcp->tcp_rcv_last_head = mp; 8975 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 8976 tcp->tcp_rcv_last_tail->b_cont = mp; 8977 } else { 8978 tcp->tcp_rcv_last_head->b_next = mp; 8979 tcp->tcp_rcv_last_head = mp; 8980 } 8981 8982 while (mp->b_cont) 8983 mp = mp->b_cont; 8984 8985 tcp->tcp_rcv_last_tail = mp; 8986 tcp->tcp_rcv_cnt += seg_len; 8987 tcp->tcp_rwnd -= seg_len; 8988 } 8989 8990 /* The minimum of smoothed mean deviation in RTO calculation. */ 8991 #define TCP_SD_MIN 400 8992 8993 /* 8994 * Set RTO for this connection. The formula is from Jacobson and Karels' 8995 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names 8996 * are the same as those in Appendix A.2 of that paper. 8997 * 8998 * m = new measurement 8999 * sa = smoothed RTT average (8 * average estimates). 9000 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 9001 */ 9002 static void 9003 tcp_set_rto(tcp_t *tcp, clock_t rtt) 9004 { 9005 long m = TICK_TO_MSEC(rtt); 9006 clock_t sa = tcp->tcp_rtt_sa; 9007 clock_t sv = tcp->tcp_rtt_sd; 9008 clock_t rto; 9009 tcp_stack_t *tcps = tcp->tcp_tcps; 9010 9011 BUMP_MIB(&tcps->tcps_mib, tcpRttUpdate); 9012 tcp->tcp_rtt_update++; 9013 9014 /* tcp_rtt_sa is not 0 means this is a new sample. */ 9015 if (sa != 0) { 9016 /* 9017 * Update average estimator: 9018 * new rtt = 7/8 old rtt + 1/8 Error 9019 */ 9020 9021 /* m is now Error in estimate. */ 9022 m -= sa >> 3; 9023 if ((sa += m) <= 0) { 9024 /* 9025 * Don't allow the smoothed average to be negative. 9026 * We use 0 to denote reinitialization of the 9027 * variables. 9028 */ 9029 sa = 1; 9030 } 9031 9032 /* 9033 * Update deviation estimator: 9034 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) 9035 */ 9036 if (m < 0) 9037 m = -m; 9038 m -= sv >> 2; 9039 sv += m; 9040 } else { 9041 /* 9042 * This follows BSD's implementation. So the reinitialized 9043 * RTO is 3 * m. We cannot go less than 2 because if the 9044 * link is bandwidth dominated, doubling the window size 9045 * during slow start means doubling the RTT. We want to be 9046 * more conservative when we reinitialize our estimates. 3 9047 * is just a convenient number. 9048 */ 9049 sa = m << 3; 9050 sv = m << 1; 9051 } 9052 if (sv < TCP_SD_MIN) { 9053 /* 9054 * We do not know that if sa captures the delay ACK 9055 * effect as in a long train of segments, a receiver 9056 * does not delay its ACKs. So set the minimum of sv 9057 * to be TCP_SD_MIN, which is default to 400 ms, twice 9058 * of BSD DATO. That means the minimum of mean 9059 * deviation is 100 ms. 9060 * 9061 */ 9062 sv = TCP_SD_MIN; 9063 } 9064 tcp->tcp_rtt_sa = sa; 9065 tcp->tcp_rtt_sd = sv; 9066 /* 9067 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) 9068 * 9069 * Add tcp_rexmit_interval extra in case of extreme environment 9070 * where the algorithm fails to work. The default value of 9071 * tcp_rexmit_interval_extra should be 0. 9072 * 9073 * As we use a finer grained clock than BSD and update 9074 * RTO for every ACKs, add in another .25 of RTT to the 9075 * deviation of RTO to accomodate burstiness of 1/4 of 9076 * window size. 9077 */ 9078 rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5); 9079 9080 if (rto > tcps->tcps_rexmit_interval_max) { 9081 tcp->tcp_rto = tcps->tcps_rexmit_interval_max; 9082 } else if (rto < tcps->tcps_rexmit_interval_min) { 9083 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 9084 } else { 9085 tcp->tcp_rto = rto; 9086 } 9087 9088 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 9089 tcp->tcp_timer_backoff = 0; 9090 } 9091 9092 /* 9093 * tcp_get_seg_mp() is called to get the pointer to a segment in the 9094 * send queue which starts at the given sequence number. If the given 9095 * sequence number is equal to last valid sequence number (tcp_snxt), the 9096 * returned mblk is the last valid mblk, and off is set to the length of 9097 * that mblk. 9098 * 9099 * send queue which starts at the given seq. no. 9100 * 9101 * Parameters: 9102 * tcp_t *tcp: the tcp instance pointer. 9103 * uint32_t seq: the starting seq. no of the requested segment. 9104 * int32_t *off: after the execution, *off will be the offset to 9105 * the returned mblk which points to the requested seq no. 9106 * It is the caller's responsibility to send in a non-null off. 9107 * 9108 * Return: 9109 * A mblk_t pointer pointing to the requested segment in send queue. 9110 */ 9111 static mblk_t * 9112 tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off) 9113 { 9114 int32_t cnt; 9115 mblk_t *mp; 9116 9117 /* Defensive coding. Make sure we don't send incorrect data. */ 9118 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GT(seq, tcp->tcp_snxt)) 9119 return (NULL); 9120 9121 cnt = seq - tcp->tcp_suna; 9122 mp = tcp->tcp_xmit_head; 9123 while (cnt > 0 && mp != NULL) { 9124 cnt -= mp->b_wptr - mp->b_rptr; 9125 if (cnt <= 0) { 9126 cnt += mp->b_wptr - mp->b_rptr; 9127 break; 9128 } 9129 mp = mp->b_cont; 9130 } 9131 ASSERT(mp != NULL); 9132 *off = cnt; 9133 return (mp); 9134 } 9135 9136 /* 9137 * This function handles all retransmissions if SACK is enabled for this 9138 * connection. First it calculates how many segments can be retransmitted 9139 * based on tcp_pipe. Then it goes thru the notsack list to find eligible 9140 * segments. A segment is eligible if sack_cnt for that segment is greater 9141 * than or equal tcp_dupack_fast_retransmit. After it has retransmitted 9142 * all eligible segments, it checks to see if TCP can send some new segments 9143 * (fast recovery). If it can, set the appropriate flag for tcp_input_data(). 9144 * 9145 * Parameters: 9146 * tcp_t *tcp: the tcp structure of the connection. 9147 * uint_t *flags: in return, appropriate value will be set for 9148 * tcp_input_data(). 9149 */ 9150 static void 9151 tcp_sack_rxmit(tcp_t *tcp, uint_t *flags) 9152 { 9153 notsack_blk_t *notsack_blk; 9154 int32_t usable_swnd; 9155 int32_t mss; 9156 uint32_t seg_len; 9157 mblk_t *xmit_mp; 9158 tcp_stack_t *tcps = tcp->tcp_tcps; 9159 9160 ASSERT(tcp->tcp_sack_info != NULL); 9161 ASSERT(tcp->tcp_notsack_list != NULL); 9162 ASSERT(tcp->tcp_rexmit == B_FALSE); 9163 9164 /* Defensive coding in case there is a bug... */ 9165 if (tcp->tcp_notsack_list == NULL) { 9166 return; 9167 } 9168 notsack_blk = tcp->tcp_notsack_list; 9169 mss = tcp->tcp_mss; 9170 9171 /* 9172 * Limit the num of outstanding data in the network to be 9173 * tcp_cwnd_ssthresh, which is half of the original congestion wnd. 9174 */ 9175 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 9176 9177 /* At least retransmit 1 MSS of data. */ 9178 if (usable_swnd <= 0) { 9179 usable_swnd = mss; 9180 } 9181 9182 /* Make sure no new RTT samples will be taken. */ 9183 tcp->tcp_csuna = tcp->tcp_snxt; 9184 9185 notsack_blk = tcp->tcp_notsack_list; 9186 while (usable_swnd > 0) { 9187 mblk_t *snxt_mp, *tmp_mp; 9188 tcp_seq begin = tcp->tcp_sack_snxt; 9189 tcp_seq end; 9190 int32_t off; 9191 9192 for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) { 9193 if (SEQ_GT(notsack_blk->end, begin) && 9194 (notsack_blk->sack_cnt >= 9195 tcps->tcps_dupack_fast_retransmit)) { 9196 end = notsack_blk->end; 9197 if (SEQ_LT(begin, notsack_blk->begin)) { 9198 begin = notsack_blk->begin; 9199 } 9200 break; 9201 } 9202 } 9203 /* 9204 * All holes are filled. Manipulate tcp_cwnd to send more 9205 * if we can. Note that after the SACK recovery, tcp_cwnd is 9206 * set to tcp_cwnd_ssthresh. 9207 */ 9208 if (notsack_blk == NULL) { 9209 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 9210 if (usable_swnd <= 0 || tcp->tcp_unsent == 0) { 9211 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna; 9212 ASSERT(tcp->tcp_cwnd > 0); 9213 return; 9214 } else { 9215 usable_swnd = usable_swnd / mss; 9216 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna + 9217 MAX(usable_swnd * mss, mss); 9218 *flags |= TH_XMIT_NEEDED; 9219 return; 9220 } 9221 } 9222 9223 /* 9224 * Note that we may send more than usable_swnd allows here 9225 * because of round off, but no more than 1 MSS of data. 9226 */ 9227 seg_len = end - begin; 9228 if (seg_len > mss) 9229 seg_len = mss; 9230 snxt_mp = tcp_get_seg_mp(tcp, begin, &off); 9231 ASSERT(snxt_mp != NULL); 9232 /* This should not happen. Defensive coding again... */ 9233 if (snxt_mp == NULL) { 9234 return; 9235 } 9236 9237 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off, 9238 &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE); 9239 if (xmit_mp == NULL) 9240 return; 9241 9242 usable_swnd -= seg_len; 9243 tcp->tcp_pipe += seg_len; 9244 tcp->tcp_sack_snxt = begin + seg_len; 9245 9246 tcp_send_data(tcp, xmit_mp); 9247 9248 /* 9249 * Update the send timestamp to avoid false retransmission. 9250 */ 9251 snxt_mp->b_prev = (mblk_t *)ddi_get_lbolt(); 9252 9253 BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); 9254 UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, seg_len); 9255 BUMP_MIB(&tcps->tcps_mib, tcpOutSackRetransSegs); 9256 /* 9257 * Update tcp_rexmit_max to extend this SACK recovery phase. 9258 * This happens when new data sent during fast recovery is 9259 * also lost. If TCP retransmits those new data, it needs 9260 * to extend SACK recover phase to avoid starting another 9261 * fast retransmit/recovery unnecessarily. 9262 */ 9263 if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) { 9264 tcp->tcp_rexmit_max = tcp->tcp_sack_snxt; 9265 } 9266 } 9267 } 9268 9269 /* 9270 * tcp_ss_rexmit() is called to do slow start retransmission after a timeout 9271 * or ICMP errors. 9272 * 9273 * To limit the number of duplicate segments, we limit the number of segment 9274 * to be sent in one time to tcp_snd_burst, the burst variable. 9275 */ 9276 static void 9277 tcp_ss_rexmit(tcp_t *tcp) 9278 { 9279 uint32_t snxt; 9280 uint32_t smax; 9281 int32_t win; 9282 int32_t mss; 9283 int32_t off; 9284 int32_t burst = tcp->tcp_snd_burst; 9285 mblk_t *snxt_mp; 9286 tcp_stack_t *tcps = tcp->tcp_tcps; 9287 9288 /* 9289 * Note that tcp_rexmit can be set even though TCP has retransmitted 9290 * all unack'ed segments. 9291 */ 9292 if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) { 9293 smax = tcp->tcp_rexmit_max; 9294 snxt = tcp->tcp_rexmit_nxt; 9295 if (SEQ_LT(snxt, tcp->tcp_suna)) { 9296 snxt = tcp->tcp_suna; 9297 } 9298 win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd); 9299 win -= snxt - tcp->tcp_suna; 9300 mss = tcp->tcp_mss; 9301 snxt_mp = tcp_get_seg_mp(tcp, snxt, &off); 9302 9303 while (SEQ_LT(snxt, smax) && (win > 0) && 9304 (burst > 0) && (snxt_mp != NULL)) { 9305 mblk_t *xmit_mp; 9306 mblk_t *old_snxt_mp = snxt_mp; 9307 uint32_t cnt = mss; 9308 9309 if (win < cnt) { 9310 cnt = win; 9311 } 9312 if (SEQ_GT(snxt + cnt, smax)) { 9313 cnt = smax - snxt; 9314 } 9315 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off, 9316 &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE); 9317 if (xmit_mp == NULL) 9318 return; 9319 9320 tcp_send_data(tcp, xmit_mp); 9321 9322 snxt += cnt; 9323 win -= cnt; 9324 /* 9325 * Update the send timestamp to avoid false 9326 * retransmission. 9327 */ 9328 old_snxt_mp->b_prev = (mblk_t *)ddi_get_lbolt(); 9329 BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); 9330 UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, cnt); 9331 9332 tcp->tcp_rexmit_nxt = snxt; 9333 burst--; 9334 } 9335 /* 9336 * If we have transmitted all we have at the time 9337 * we started the retranmission, we can leave 9338 * the rest of the job to tcp_wput_data(). But we 9339 * need to check the send window first. If the 9340 * win is not 0, go on with tcp_wput_data(). 9341 */ 9342 if (SEQ_LT(snxt, smax) || win == 0) { 9343 return; 9344 } 9345 } 9346 /* Only call tcp_wput_data() if there is data to be sent. */ 9347 if (tcp->tcp_unsent) { 9348 tcp_wput_data(tcp, NULL, B_FALSE); 9349 } 9350 } 9351 9352 /* 9353 * Process all TCP option in SYN segment. Note that this function should 9354 * be called after tcp_set_destination() is called so that the necessary info 9355 * from IRE is already set in the tcp structure. 9356 * 9357 * This function sets up the correct tcp_mss value according to the 9358 * MSS option value and our header size. It also sets up the window scale 9359 * and timestamp values, and initialize SACK info blocks. But it does not 9360 * change receive window size after setting the tcp_mss value. The caller 9361 * should do the appropriate change. 9362 */ 9363 void 9364 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha) 9365 { 9366 int options; 9367 tcp_opt_t tcpopt; 9368 uint32_t mss_max; 9369 char *tmp_tcph; 9370 tcp_stack_t *tcps = tcp->tcp_tcps; 9371 conn_t *connp = tcp->tcp_connp; 9372 9373 tcpopt.tcp = NULL; 9374 options = tcp_parse_options(tcpha, &tcpopt); 9375 9376 /* 9377 * Process MSS option. Note that MSS option value does not account 9378 * for IP or TCP options. This means that it is equal to MTU - minimum 9379 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 9380 * IPv6. 9381 */ 9382 if (!(options & TCP_OPT_MSS_PRESENT)) { 9383 if (connp->conn_ipversion == IPV4_VERSION) 9384 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4; 9385 else 9386 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6; 9387 } else { 9388 if (connp->conn_ipversion == IPV4_VERSION) 9389 mss_max = tcps->tcps_mss_max_ipv4; 9390 else 9391 mss_max = tcps->tcps_mss_max_ipv6; 9392 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min) 9393 tcpopt.tcp_opt_mss = tcps->tcps_mss_min; 9394 else if (tcpopt.tcp_opt_mss > mss_max) 9395 tcpopt.tcp_opt_mss = mss_max; 9396 } 9397 9398 /* Process Window Scale option. */ 9399 if (options & TCP_OPT_WSCALE_PRESENT) { 9400 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 9401 tcp->tcp_snd_ws_ok = B_TRUE; 9402 } else { 9403 tcp->tcp_snd_ws = B_FALSE; 9404 tcp->tcp_snd_ws_ok = B_FALSE; 9405 tcp->tcp_rcv_ws = B_FALSE; 9406 } 9407 9408 /* Process Timestamp option. */ 9409 if ((options & TCP_OPT_TSTAMP_PRESENT) && 9410 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 9411 tmp_tcph = (char *)tcp->tcp_tcpha; 9412 9413 tcp->tcp_snd_ts_ok = B_TRUE; 9414 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 9415 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 9416 ASSERT(OK_32PTR(tmp_tcph)); 9417 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH); 9418 9419 /* Fill in our template header with basic timestamp option. */ 9420 tmp_tcph += connp->conn_ht_ulp_len; 9421 tmp_tcph[0] = TCPOPT_NOP; 9422 tmp_tcph[1] = TCPOPT_NOP; 9423 tmp_tcph[2] = TCPOPT_TSTAMP; 9424 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 9425 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN; 9426 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN; 9427 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4); 9428 } else { 9429 tcp->tcp_snd_ts_ok = B_FALSE; 9430 } 9431 9432 /* 9433 * Process SACK options. If SACK is enabled for this connection, 9434 * then allocate the SACK info structure. Note the following ways 9435 * when tcp_snd_sack_ok is set to true. 9436 * 9437 * For active connection: in tcp_set_destination() called in 9438 * tcp_connect(). 9439 * 9440 * For passive connection: in tcp_set_destination() called in 9441 * tcp_input_listener(). 9442 * 9443 * That's the reason why the extra TCP_IS_DETACHED() check is there. 9444 * That check makes sure that if we did not send a SACK OK option, 9445 * we will not enable SACK for this connection even though the other 9446 * side sends us SACK OK option. For active connection, the SACK 9447 * info structure has already been allocated. So we need to free 9448 * it if SACK is disabled. 9449 */ 9450 if ((options & TCP_OPT_SACK_OK_PRESENT) && 9451 (tcp->tcp_snd_sack_ok || 9452 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 9453 /* This should be true only in the passive case. */ 9454 if (tcp->tcp_sack_info == NULL) { 9455 ASSERT(TCP_IS_DETACHED(tcp)); 9456 tcp->tcp_sack_info = 9457 kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP); 9458 } 9459 if (tcp->tcp_sack_info == NULL) { 9460 tcp->tcp_snd_sack_ok = B_FALSE; 9461 } else { 9462 tcp->tcp_snd_sack_ok = B_TRUE; 9463 if (tcp->tcp_snd_ts_ok) { 9464 tcp->tcp_max_sack_blk = 3; 9465 } else { 9466 tcp->tcp_max_sack_blk = 4; 9467 } 9468 } 9469 } else { 9470 /* 9471 * Resetting tcp_snd_sack_ok to B_FALSE so that 9472 * no SACK info will be used for this 9473 * connection. This assumes that SACK usage 9474 * permission is negotiated. This may need 9475 * to be changed once this is clarified. 9476 */ 9477 if (tcp->tcp_sack_info != NULL) { 9478 ASSERT(tcp->tcp_notsack_list == NULL); 9479 kmem_cache_free(tcp_sack_info_cache, 9480 tcp->tcp_sack_info); 9481 tcp->tcp_sack_info = NULL; 9482 } 9483 tcp->tcp_snd_sack_ok = B_FALSE; 9484 } 9485 9486 /* 9487 * Now we know the exact TCP/IP header length, subtract 9488 * that from tcp_mss to get our side's MSS. 9489 */ 9490 tcp->tcp_mss -= connp->conn_ht_iphc_len; 9491 9492 /* 9493 * Here we assume that the other side's header size will be equal to 9494 * our header size. We calculate the real MSS accordingly. Need to 9495 * take into additional stuffs IPsec puts in. 9496 * 9497 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 9498 */ 9499 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len + 9500 tcp->tcp_ipsec_overhead - 9501 ((connp->conn_ipversion == IPV4_VERSION ? 9502 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 9503 9504 /* 9505 * Set MSS to the smaller one of both ends of the connection. 9506 * We should not have called tcp_mss_set() before, but our 9507 * side of the MSS should have been set to a proper value 9508 * by tcp_set_destination(). tcp_mss_set() will also set up the 9509 * STREAM head parameters properly. 9510 * 9511 * If we have a larger-than-16-bit window but the other side 9512 * didn't want to do window scale, tcp_rwnd_set() will take 9513 * care of that. 9514 */ 9515 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 9516 9517 /* 9518 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been 9519 * updated properly. 9520 */ 9521 SET_TCP_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial); 9522 } 9523 9524 /* 9525 * Sends the T_CONN_IND to the listener. The caller calls this 9526 * functions via squeue to get inside the listener's perimeter 9527 * once the 3 way hand shake is done a T_CONN_IND needs to be 9528 * sent. As an optimization, the caller can call this directly 9529 * if listener's perimeter is same as eager's. 9530 */ 9531 /* ARGSUSED */ 9532 void 9533 tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2) 9534 { 9535 conn_t *lconnp = (conn_t *)arg; 9536 tcp_t *listener = lconnp->conn_tcp; 9537 tcp_t *tcp; 9538 struct T_conn_ind *conn_ind; 9539 ipaddr_t *addr_cache; 9540 boolean_t need_send_conn_ind = B_FALSE; 9541 tcp_stack_t *tcps = listener->tcp_tcps; 9542 9543 /* retrieve the eager */ 9544 conn_ind = (struct T_conn_ind *)mp->b_rptr; 9545 ASSERT(conn_ind->OPT_offset != 0 && 9546 conn_ind->OPT_length == sizeof (intptr_t)); 9547 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 9548 conn_ind->OPT_length); 9549 9550 /* 9551 * TLI/XTI applications will get confused by 9552 * sending eager as an option since it violates 9553 * the option semantics. So remove the eager as 9554 * option since TLI/XTI app doesn't need it anyway. 9555 */ 9556 if (!TCP_IS_SOCKET(listener)) { 9557 conn_ind->OPT_length = 0; 9558 conn_ind->OPT_offset = 0; 9559 } 9560 if (listener->tcp_state != TCPS_LISTEN) { 9561 /* 9562 * If listener has closed, it would have caused a 9563 * a cleanup/blowoff to happen for the eager. We 9564 * just need to return. 9565 */ 9566 freemsg(mp); 9567 return; 9568 } 9569 9570 9571 /* 9572 * if the conn_req_q is full defer passing up the 9573 * T_CONN_IND until space is availabe after t_accept() 9574 * processing 9575 */ 9576 mutex_enter(&listener->tcp_eager_lock); 9577 9578 /* 9579 * Take the eager out, if it is in the list of droppable eagers 9580 * as we are here because the 3W handshake is over. 9581 */ 9582 MAKE_UNDROPPABLE(tcp); 9583 9584 if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) { 9585 tcp_t *tail; 9586 9587 /* 9588 * The eager already has an extra ref put in tcp_input_data 9589 * so that it stays till accept comes back even though it 9590 * might get into TCPS_CLOSED as a result of a TH_RST etc. 9591 */ 9592 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 9593 listener->tcp_conn_req_cnt_q0--; 9594 listener->tcp_conn_req_cnt_q++; 9595 9596 /* Move from SYN_RCVD to ESTABLISHED list */ 9597 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 9598 tcp->tcp_eager_prev_q0; 9599 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 9600 tcp->tcp_eager_next_q0; 9601 tcp->tcp_eager_prev_q0 = NULL; 9602 tcp->tcp_eager_next_q0 = NULL; 9603 9604 /* 9605 * Insert at end of the queue because sockfs 9606 * sends down T_CONN_RES in chronological 9607 * order. Leaving the older conn indications 9608 * at front of the queue helps reducing search 9609 * time. 9610 */ 9611 tail = listener->tcp_eager_last_q; 9612 if (tail != NULL) 9613 tail->tcp_eager_next_q = tcp; 9614 else 9615 listener->tcp_eager_next_q = tcp; 9616 listener->tcp_eager_last_q = tcp; 9617 tcp->tcp_eager_next_q = NULL; 9618 /* 9619 * Delay sending up the T_conn_ind until we are 9620 * done with the eager. Once we have have sent up 9621 * the T_conn_ind, the accept can potentially complete 9622 * any time and release the refhold we have on the eager. 9623 */ 9624 need_send_conn_ind = B_TRUE; 9625 } else { 9626 /* 9627 * Defer connection on q0 and set deferred 9628 * connection bit true 9629 */ 9630 tcp->tcp_conn_def_q0 = B_TRUE; 9631 9632 /* take tcp out of q0 ... */ 9633 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 9634 tcp->tcp_eager_next_q0; 9635 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 9636 tcp->tcp_eager_prev_q0; 9637 9638 /* ... and place it at the end of q0 */ 9639 tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0; 9640 tcp->tcp_eager_next_q0 = listener; 9641 listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp; 9642 listener->tcp_eager_prev_q0 = tcp; 9643 tcp->tcp_conn.tcp_eager_conn_ind = mp; 9644 } 9645 9646 /* we have timed out before */ 9647 if (tcp->tcp_syn_rcvd_timeout != 0) { 9648 tcp->tcp_syn_rcvd_timeout = 0; 9649 listener->tcp_syn_rcvd_timeout--; 9650 if (listener->tcp_syn_defense && 9651 listener->tcp_syn_rcvd_timeout <= 9652 (tcps->tcps_conn_req_max_q0 >> 5) && 9653 10*MINUTES < TICK_TO_MSEC(ddi_get_lbolt64() - 9654 listener->tcp_last_rcv_lbolt)) { 9655 /* 9656 * Turn off the defense mode if we 9657 * believe the SYN attack is over. 9658 */ 9659 listener->tcp_syn_defense = B_FALSE; 9660 if (listener->tcp_ip_addr_cache) { 9661 kmem_free((void *)listener->tcp_ip_addr_cache, 9662 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 9663 listener->tcp_ip_addr_cache = NULL; 9664 } 9665 } 9666 } 9667 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 9668 if (addr_cache != NULL) { 9669 /* 9670 * We have finished a 3-way handshake with this 9671 * remote host. This proves the IP addr is good. 9672 * Cache it! 9673 */ 9674 addr_cache[IP_ADDR_CACHE_HASH(tcp->tcp_connp->conn_faddr_v4)] = 9675 tcp->tcp_connp->conn_faddr_v4; 9676 } 9677 mutex_exit(&listener->tcp_eager_lock); 9678 if (need_send_conn_ind) 9679 tcp_ulp_newconn(lconnp, tcp->tcp_connp, mp); 9680 } 9681 9682 /* 9683 * Send the newconn notification to ulp. The eager is blown off if the 9684 * notification fails. 9685 */ 9686 static void 9687 tcp_ulp_newconn(conn_t *lconnp, conn_t *econnp, mblk_t *mp) 9688 { 9689 if (IPCL_IS_NONSTR(lconnp)) { 9690 cred_t *cr; 9691 pid_t cpid = NOPID; 9692 9693 ASSERT(econnp->conn_tcp->tcp_listener == lconnp->conn_tcp); 9694 ASSERT(econnp->conn_tcp->tcp_saved_listener == 9695 lconnp->conn_tcp); 9696 9697 cr = msg_getcred(mp, &cpid); 9698 9699 /* Keep the message around in case of a fallback to TPI */ 9700 econnp->conn_tcp->tcp_conn.tcp_eager_conn_ind = mp; 9701 /* 9702 * Notify the ULP about the newconn. It is guaranteed that no 9703 * tcp_accept() call will be made for the eager if the 9704 * notification fails, so it's safe to blow it off in that 9705 * case. 9706 * 9707 * The upper handle will be assigned when tcp_accept() is 9708 * called. 9709 */ 9710 if ((*lconnp->conn_upcalls->su_newconn) 9711 (lconnp->conn_upper_handle, 9712 (sock_lower_handle_t)econnp, 9713 &sock_tcp_downcalls, cr, cpid, 9714 &econnp->conn_upcalls) == NULL) { 9715 /* Failed to allocate a socket */ 9716 BUMP_MIB(&lconnp->conn_tcp->tcp_tcps->tcps_mib, 9717 tcpEstabResets); 9718 (void) tcp_eager_blowoff(lconnp->conn_tcp, 9719 econnp->conn_tcp->tcp_conn_req_seqnum); 9720 } 9721 } else { 9722 putnext(lconnp->conn_rq, mp); 9723 } 9724 } 9725 9726 /* 9727 * Handle a packet that has been reclassified by TCP. 9728 * This function drops the ref on connp that the caller had. 9729 */ 9730 static void 9731 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst) 9732 { 9733 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 9734 9735 if (connp->conn_incoming_ifindex != 0 && 9736 connp->conn_incoming_ifindex != ira->ira_ruifindex) { 9737 freemsg(mp); 9738 CONN_DEC_REF(connp); 9739 return; 9740 } 9741 9742 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || 9743 (ira->ira_flags & IRAF_IPSEC_SECURE)) { 9744 ip6_t *ip6h; 9745 ipha_t *ipha; 9746 9747 if (ira->ira_flags & IRAF_IS_IPV4) { 9748 ipha = (ipha_t *)mp->b_rptr; 9749 ip6h = NULL; 9750 } else { 9751 ipha = NULL; 9752 ip6h = (ip6_t *)mp->b_rptr; 9753 } 9754 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira); 9755 if (mp == NULL) { 9756 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); 9757 /* Note that mp is NULL */ 9758 ip_drop_input("ipIfStatsInDiscards", mp, NULL); 9759 CONN_DEC_REF(connp); 9760 return; 9761 } 9762 } 9763 9764 if (IPCL_IS_TCP(connp)) { 9765 /* 9766 * do not drain, certain use cases can blow 9767 * the stack 9768 */ 9769 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 9770 connp->conn_recv, connp, ira, 9771 SQ_NODRAIN, SQTAG_IP_TCP_INPUT); 9772 } else { 9773 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */ 9774 (connp->conn_recv)(connp, mp, NULL, 9775 ira); 9776 CONN_DEC_REF(connp); 9777 } 9778 9779 } 9780 9781 boolean_t tcp_outbound_squeue_switch = B_FALSE; 9782 9783 /* 9784 * Handle M_DATA messages from IP. Its called directly from IP via 9785 * squeue for received IP packets. 9786 * 9787 * The first argument is always the connp/tcp to which the mp belongs. 9788 * There are no exceptions to this rule. The caller has already put 9789 * a reference on this connp/tcp and once tcp_input_data() returns, 9790 * the squeue will do the refrele. 9791 * 9792 * The TH_SYN for the listener directly go to tcp_input_listener via 9793 * squeue. ICMP errors go directly to tcp_icmp_input(). 9794 * 9795 * sqp: NULL = recursive, sqp != NULL means called from squeue 9796 */ 9797 void 9798 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 9799 { 9800 int32_t bytes_acked; 9801 int32_t gap; 9802 mblk_t *mp1; 9803 uint_t flags; 9804 uint32_t new_swnd = 0; 9805 uchar_t *iphdr; 9806 uchar_t *rptr; 9807 int32_t rgap; 9808 uint32_t seg_ack; 9809 int seg_len; 9810 uint_t ip_hdr_len; 9811 uint32_t seg_seq; 9812 tcpha_t *tcpha; 9813 int urp; 9814 tcp_opt_t tcpopt; 9815 ip_pkt_t ipp; 9816 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 9817 uint32_t cwnd; 9818 uint32_t add; 9819 int npkt; 9820 int mss; 9821 conn_t *connp = (conn_t *)arg; 9822 squeue_t *sqp = (squeue_t *)arg2; 9823 tcp_t *tcp = connp->conn_tcp; 9824 tcp_stack_t *tcps = tcp->tcp_tcps; 9825 9826 /* 9827 * RST from fused tcp loopback peer should trigger an unfuse. 9828 */ 9829 if (tcp->tcp_fused) { 9830 TCP_STAT(tcps, tcp_fusion_aborted); 9831 tcp_unfuse(tcp); 9832 } 9833 9834 iphdr = mp->b_rptr; 9835 rptr = mp->b_rptr; 9836 ASSERT(OK_32PTR(rptr)); 9837 9838 ip_hdr_len = ira->ira_ip_hdr_length; 9839 if (connp->conn_recv_ancillary.crb_all != 0) { 9840 /* 9841 * Record packet information in the ip_pkt_t 9842 */ 9843 ipp.ipp_fields = 0; 9844 if (ira->ira_flags & IRAF_IS_IPV4) { 9845 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp, 9846 B_FALSE); 9847 } else { 9848 uint8_t nexthdrp; 9849 9850 /* 9851 * IPv6 packets can only be received by applications 9852 * that are prepared to receive IPv6 addresses. 9853 * The IP fanout must ensure this. 9854 */ 9855 ASSERT(connp->conn_family == AF_INET6); 9856 9857 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp, 9858 &nexthdrp); 9859 ASSERT(nexthdrp == IPPROTO_TCP); 9860 9861 /* Could have caused a pullup? */ 9862 iphdr = mp->b_rptr; 9863 rptr = mp->b_rptr; 9864 } 9865 } 9866 ASSERT(DB_TYPE(mp) == M_DATA); 9867 ASSERT(mp->b_next == NULL); 9868 9869 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 9870 seg_seq = ntohl(tcpha->tha_seq); 9871 seg_ack = ntohl(tcpha->tha_ack); 9872 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 9873 seg_len = (int)(mp->b_wptr - rptr) - 9874 (ip_hdr_len + TCP_HDR_LENGTH(tcpha)); 9875 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 9876 do { 9877 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 9878 (uintptr_t)INT_MAX); 9879 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 9880 } while ((mp1 = mp1->b_cont) != NULL && 9881 mp1->b_datap->db_type == M_DATA); 9882 } 9883 9884 if (tcp->tcp_state == TCPS_TIME_WAIT) { 9885 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 9886 seg_len, tcpha, ira); 9887 return; 9888 } 9889 9890 if (sqp != NULL) { 9891 /* 9892 * This is the correct place to update tcp_last_recv_time. Note 9893 * that it is also updated for tcp structure that belongs to 9894 * global and listener queues which do not really need updating. 9895 * But that should not cause any harm. And it is updated for 9896 * all kinds of incoming segments, not only for data segments. 9897 */ 9898 tcp->tcp_last_recv_time = LBOLT_FASTPATH; 9899 } 9900 9901 flags = (unsigned int)tcpha->tha_flags & 0xFF; 9902 9903 BUMP_LOCAL(tcp->tcp_ibsegs); 9904 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 9905 9906 if ((flags & TH_URG) && sqp != NULL) { 9907 /* 9908 * TCP can't handle urgent pointers that arrive before 9909 * the connection has been accept()ed since it can't 9910 * buffer OOB data. Discard segment if this happens. 9911 * 9912 * We can't just rely on a non-null tcp_listener to indicate 9913 * that the accept() has completed since unlinking of the 9914 * eager and completion of the accept are not atomic. 9915 * tcp_detached, when it is not set (B_FALSE) indicates 9916 * that the accept() has completed. 9917 * 9918 * Nor can it reassemble urgent pointers, so discard 9919 * if it's not the next segment expected. 9920 * 9921 * Otherwise, collapse chain into one mblk (discard if 9922 * that fails). This makes sure the headers, retransmitted 9923 * data, and new data all are in the same mblk. 9924 */ 9925 ASSERT(mp != NULL); 9926 if (tcp->tcp_detached || !pullupmsg(mp, -1)) { 9927 freemsg(mp); 9928 return; 9929 } 9930 /* Update pointers into message */ 9931 iphdr = rptr = mp->b_rptr; 9932 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 9933 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 9934 /* 9935 * Since we can't handle any data with this urgent 9936 * pointer that is out of sequence, we expunge 9937 * the data. This allows us to still register 9938 * the urgent mark and generate the M_PCSIG, 9939 * which we can do. 9940 */ 9941 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 9942 seg_len = 0; 9943 } 9944 } 9945 9946 switch (tcp->tcp_state) { 9947 case TCPS_SYN_SENT: 9948 if (connp->conn_final_sqp == NULL && 9949 tcp_outbound_squeue_switch && sqp != NULL) { 9950 ASSERT(connp->conn_initial_sqp == connp->conn_sqp); 9951 connp->conn_final_sqp = sqp; 9952 if (connp->conn_final_sqp != connp->conn_sqp) { 9953 DTRACE_PROBE1(conn__final__sqp__switch, 9954 conn_t *, connp); 9955 CONN_INC_REF(connp); 9956 SQUEUE_SWITCH(connp, connp->conn_final_sqp); 9957 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 9958 tcp_input_data, connp, ira, ip_squeue_flag, 9959 SQTAG_CONNECT_FINISH); 9960 return; 9961 } 9962 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp); 9963 } 9964 if (flags & TH_ACK) { 9965 /* 9966 * Note that our stack cannot send data before a 9967 * connection is established, therefore the 9968 * following check is valid. Otherwise, it has 9969 * to be changed. 9970 */ 9971 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 9972 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 9973 freemsg(mp); 9974 if (flags & TH_RST) 9975 return; 9976 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 9977 tcp, seg_ack, 0, TH_RST); 9978 return; 9979 } 9980 ASSERT(tcp->tcp_suna + 1 == seg_ack); 9981 } 9982 if (flags & TH_RST) { 9983 freemsg(mp); 9984 if (flags & TH_ACK) 9985 (void) tcp_clean_death(tcp, 9986 ECONNREFUSED, 13); 9987 return; 9988 } 9989 if (!(flags & TH_SYN)) { 9990 freemsg(mp); 9991 return; 9992 } 9993 9994 /* Process all TCP options. */ 9995 tcp_process_options(tcp, tcpha); 9996 /* 9997 * The following changes our rwnd to be a multiple of the 9998 * MIN(peer MSS, our MSS) for performance reason. 9999 */ 10000 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf, 10001 tcp->tcp_mss)); 10002 10003 /* Is the other end ECN capable? */ 10004 if (tcp->tcp_ecn_ok) { 10005 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 10006 tcp->tcp_ecn_ok = B_FALSE; 10007 } 10008 } 10009 /* 10010 * Clear ECN flags because it may interfere with later 10011 * processing. 10012 */ 10013 flags &= ~(TH_ECE|TH_CWR); 10014 10015 tcp->tcp_irs = seg_seq; 10016 tcp->tcp_rack = seg_seq; 10017 tcp->tcp_rnxt = seg_seq + 1; 10018 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt); 10019 if (!TCP_IS_DETACHED(tcp)) { 10020 /* Allocate room for SACK options if needed. */ 10021 connp->conn_wroff = connp->conn_ht_iphc_len; 10022 if (tcp->tcp_snd_sack_ok) 10023 connp->conn_wroff += TCPOPT_MAX_SACK_LEN; 10024 if (!tcp->tcp_loopback) 10025 connp->conn_wroff += tcps->tcps_wroff_xtra; 10026 10027 (void) proto_set_tx_wroff(connp->conn_rq, connp, 10028 connp->conn_wroff); 10029 } 10030 if (flags & TH_ACK) { 10031 /* 10032 * If we can't get the confirmation upstream, pretend 10033 * we didn't even see this one. 10034 * 10035 * XXX: how can we pretend we didn't see it if we 10036 * have updated rnxt et. al. 10037 * 10038 * For loopback we defer sending up the T_CONN_CON 10039 * until after some checks below. 10040 */ 10041 mp1 = NULL; 10042 /* 10043 * tcp_sendmsg() checks tcp_state without entering 10044 * the squeue so tcp_state should be updated before 10045 * sending up connection confirmation 10046 */ 10047 tcp->tcp_state = TCPS_ESTABLISHED; 10048 if (!tcp_conn_con(tcp, iphdr, mp, 10049 tcp->tcp_loopback ? &mp1 : NULL, ira)) { 10050 tcp->tcp_state = TCPS_SYN_SENT; 10051 freemsg(mp); 10052 return; 10053 } 10054 /* SYN was acked - making progress */ 10055 tcp->tcp_ip_forward_progress = B_TRUE; 10056 10057 /* One for the SYN */ 10058 tcp->tcp_suna = tcp->tcp_iss + 1; 10059 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 10060 10061 /* 10062 * If SYN was retransmitted, need to reset all 10063 * retransmission info. This is because this 10064 * segment will be treated as a dup ACK. 10065 */ 10066 if (tcp->tcp_rexmit) { 10067 tcp->tcp_rexmit = B_FALSE; 10068 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 10069 tcp->tcp_rexmit_max = tcp->tcp_snxt; 10070 tcp->tcp_snd_burst = tcp->tcp_localnet ? 10071 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 10072 tcp->tcp_ms_we_have_waited = 0; 10073 10074 /* 10075 * Set tcp_cwnd back to 1 MSS, per 10076 * recommendation from 10077 * draft-floyd-incr-init-win-01.txt, 10078 * Increasing TCP's Initial Window. 10079 */ 10080 tcp->tcp_cwnd = tcp->tcp_mss; 10081 } 10082 10083 tcp->tcp_swl1 = seg_seq; 10084 tcp->tcp_swl2 = seg_ack; 10085 10086 new_swnd = ntohs(tcpha->tha_win); 10087 tcp->tcp_swnd = new_swnd; 10088 if (new_swnd > tcp->tcp_max_swnd) 10089 tcp->tcp_max_swnd = new_swnd; 10090 10091 /* 10092 * Always send the three-way handshake ack immediately 10093 * in order to make the connection complete as soon as 10094 * possible on the accepting host. 10095 */ 10096 flags |= TH_ACK_NEEDED; 10097 10098 /* 10099 * Special case for loopback. At this point we have 10100 * received SYN-ACK from the remote endpoint. In 10101 * order to ensure that both endpoints reach the 10102 * fused state prior to any data exchange, the final 10103 * ACK needs to be sent before we indicate T_CONN_CON 10104 * to the module upstream. 10105 */ 10106 if (tcp->tcp_loopback) { 10107 mblk_t *ack_mp; 10108 10109 ASSERT(!tcp->tcp_unfusable); 10110 ASSERT(mp1 != NULL); 10111 /* 10112 * For loopback, we always get a pure SYN-ACK 10113 * and only need to send back the final ACK 10114 * with no data (this is because the other 10115 * tcp is ours and we don't do T/TCP). This 10116 * final ACK triggers the passive side to 10117 * perform fusion in ESTABLISHED state. 10118 */ 10119 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 10120 if (tcp->tcp_ack_tid != 0) { 10121 (void) TCP_TIMER_CANCEL(tcp, 10122 tcp->tcp_ack_tid); 10123 tcp->tcp_ack_tid = 0; 10124 } 10125 tcp_send_data(tcp, ack_mp); 10126 BUMP_LOCAL(tcp->tcp_obsegs); 10127 BUMP_MIB(&tcps->tcps_mib, tcpOutAck); 10128 10129 if (!IPCL_IS_NONSTR(connp)) { 10130 /* Send up T_CONN_CON */ 10131 if (ira->ira_cred != NULL) { 10132 mblk_setcred(mp1, 10133 ira->ira_cred, 10134 ira->ira_cpid); 10135 } 10136 putnext(connp->conn_rq, mp1); 10137 } else { 10138 (*connp->conn_upcalls-> 10139 su_connected) 10140 (connp->conn_upper_handle, 10141 tcp->tcp_connid, 10142 ira->ira_cred, 10143 ira->ira_cpid); 10144 freemsg(mp1); 10145 } 10146 10147 freemsg(mp); 10148 return; 10149 } 10150 /* 10151 * Forget fusion; we need to handle more 10152 * complex cases below. Send the deferred 10153 * T_CONN_CON message upstream and proceed 10154 * as usual. Mark this tcp as not capable 10155 * of fusion. 10156 */ 10157 TCP_STAT(tcps, tcp_fusion_unfusable); 10158 tcp->tcp_unfusable = B_TRUE; 10159 if (!IPCL_IS_NONSTR(connp)) { 10160 if (ira->ira_cred != NULL) { 10161 mblk_setcred(mp1, ira->ira_cred, 10162 ira->ira_cpid); 10163 } 10164 putnext(connp->conn_rq, mp1); 10165 } else { 10166 (*connp->conn_upcalls->su_connected) 10167 (connp->conn_upper_handle, 10168 tcp->tcp_connid, ira->ira_cred, 10169 ira->ira_cpid); 10170 freemsg(mp1); 10171 } 10172 } 10173 10174 /* 10175 * Check to see if there is data to be sent. If 10176 * yes, set the transmit flag. Then check to see 10177 * if received data processing needs to be done. 10178 * If not, go straight to xmit_check. This short 10179 * cut is OK as we don't support T/TCP. 10180 */ 10181 if (tcp->tcp_unsent) 10182 flags |= TH_XMIT_NEEDED; 10183 10184 if (seg_len == 0 && !(flags & TH_URG)) { 10185 freemsg(mp); 10186 goto xmit_check; 10187 } 10188 10189 flags &= ~TH_SYN; 10190 seg_seq++; 10191 break; 10192 } 10193 tcp->tcp_state = TCPS_SYN_RCVD; 10194 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 10195 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 10196 if (mp1 != NULL) { 10197 tcp_send_data(tcp, mp1); 10198 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 10199 } 10200 freemsg(mp); 10201 return; 10202 case TCPS_SYN_RCVD: 10203 if (flags & TH_ACK) { 10204 /* 10205 * In this state, a SYN|ACK packet is either bogus 10206 * because the other side must be ACKing our SYN which 10207 * indicates it has seen the ACK for their SYN and 10208 * shouldn't retransmit it or we're crossing SYNs 10209 * on active open. 10210 */ 10211 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 10212 freemsg(mp); 10213 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 10214 tcp, seg_ack, 0, TH_RST); 10215 return; 10216 } 10217 /* 10218 * NOTE: RFC 793 pg. 72 says this should be 10219 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 10220 * but that would mean we have an ack that ignored 10221 * our SYN. 10222 */ 10223 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 10224 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 10225 freemsg(mp); 10226 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 10227 tcp, seg_ack, 0, TH_RST); 10228 return; 10229 } 10230 } 10231 break; 10232 case TCPS_LISTEN: 10233 /* 10234 * Only a TLI listener can come through this path when a 10235 * acceptor is going back to be a listener and a packet 10236 * for the acceptor hits the classifier. For a socket 10237 * listener, this can never happen because a listener 10238 * can never accept connection on itself and hence a 10239 * socket acceptor can not go back to being a listener. 10240 */ 10241 ASSERT(!TCP_IS_SOCKET(tcp)); 10242 /*FALLTHRU*/ 10243 case TCPS_CLOSED: 10244 case TCPS_BOUND: { 10245 conn_t *new_connp; 10246 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 10247 10248 /* 10249 * Don't accept any input on a closed tcp as this TCP logically 10250 * does not exist on the system. Don't proceed further with 10251 * this TCP. For instance, this packet could trigger another 10252 * close of this tcp which would be disastrous for tcp_refcnt. 10253 * tcp_close_detached / tcp_clean_death / tcp_closei_local must 10254 * be called at most once on a TCP. In this case we need to 10255 * refeed the packet into the classifier and figure out where 10256 * the packet should go. 10257 */ 10258 new_connp = ipcl_classify(mp, ira, ipst); 10259 if (new_connp != NULL) { 10260 /* Drops ref on new_connp */ 10261 tcp_reinput(new_connp, mp, ira, ipst); 10262 return; 10263 } 10264 /* We failed to classify. For now just drop the packet */ 10265 freemsg(mp); 10266 return; 10267 } 10268 case TCPS_IDLE: 10269 /* 10270 * Handle the case where the tcp_clean_death() has happened 10271 * on a connection (application hasn't closed yet) but a packet 10272 * was already queued on squeue before tcp_clean_death() 10273 * was processed. Calling tcp_clean_death() twice on same 10274 * connection can result in weird behaviour. 10275 */ 10276 freemsg(mp); 10277 return; 10278 default: 10279 break; 10280 } 10281 10282 /* 10283 * Already on the correct queue/perimeter. 10284 * If this is a detached connection and not an eager 10285 * connection hanging off a listener then new data 10286 * (past the FIN) will cause a reset. 10287 * We do a special check here where it 10288 * is out of the main line, rather than check 10289 * if we are detached every time we see new 10290 * data down below. 10291 */ 10292 if (TCP_IS_DETACHED_NONEAGER(tcp) && 10293 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 10294 BUMP_MIB(&tcps->tcps_mib, tcpInClosed); 10295 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 10296 10297 freemsg(mp); 10298 /* 10299 * This could be an SSL closure alert. We're detached so just 10300 * acknowledge it this last time. 10301 */ 10302 if (tcp->tcp_kssl_ctx != NULL) { 10303 kssl_release_ctx(tcp->tcp_kssl_ctx); 10304 tcp->tcp_kssl_ctx = NULL; 10305 10306 tcp->tcp_rnxt += seg_len; 10307 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt); 10308 flags |= TH_ACK_NEEDED; 10309 goto ack_check; 10310 } 10311 10312 tcp_xmit_ctl("new data when detached", tcp, 10313 tcp->tcp_snxt, 0, TH_RST); 10314 (void) tcp_clean_death(tcp, EPROTO, 12); 10315 return; 10316 } 10317 10318 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 10319 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION; 10320 new_swnd = ntohs(tcpha->tha_win) << 10321 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws); 10322 10323 if (tcp->tcp_snd_ts_ok) { 10324 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) { 10325 /* 10326 * This segment is not acceptable. 10327 * Drop it and send back an ACK. 10328 */ 10329 freemsg(mp); 10330 flags |= TH_ACK_NEEDED; 10331 goto ack_check; 10332 } 10333 } else if (tcp->tcp_snd_sack_ok) { 10334 ASSERT(tcp->tcp_sack_info != NULL); 10335 tcpopt.tcp = tcp; 10336 /* 10337 * SACK info in already updated in tcp_parse_options. Ignore 10338 * all other TCP options... 10339 */ 10340 (void) tcp_parse_options(tcpha, &tcpopt); 10341 } 10342 try_again:; 10343 mss = tcp->tcp_mss; 10344 gap = seg_seq - tcp->tcp_rnxt; 10345 rgap = tcp->tcp_rwnd - (gap + seg_len); 10346 /* 10347 * gap is the amount of sequence space between what we expect to see 10348 * and what we got for seg_seq. A positive value for gap means 10349 * something got lost. A negative value means we got some old stuff. 10350 */ 10351 if (gap < 0) { 10352 /* Old stuff present. Is the SYN in there? */ 10353 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 10354 (seg_len != 0)) { 10355 flags &= ~TH_SYN; 10356 seg_seq++; 10357 urp--; 10358 /* Recompute the gaps after noting the SYN. */ 10359 goto try_again; 10360 } 10361 BUMP_MIB(&tcps->tcps_mib, tcpInDataDupSegs); 10362 UPDATE_MIB(&tcps->tcps_mib, tcpInDataDupBytes, 10363 (seg_len > -gap ? -gap : seg_len)); 10364 /* Remove the old stuff from seg_len. */ 10365 seg_len += gap; 10366 /* 10367 * Anything left? 10368 * Make sure to check for unack'd FIN when rest of data 10369 * has been previously ack'd. 10370 */ 10371 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 10372 /* 10373 * Resets are only valid if they lie within our offered 10374 * window. If the RST bit is set, we just ignore this 10375 * segment. 10376 */ 10377 if (flags & TH_RST) { 10378 freemsg(mp); 10379 return; 10380 } 10381 10382 /* 10383 * The arriving of dup data packets indicate that we 10384 * may have postponed an ack for too long, or the other 10385 * side's RTT estimate is out of shape. Start acking 10386 * more often. 10387 */ 10388 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 10389 tcp->tcp_rack_cnt >= 1 && 10390 tcp->tcp_rack_abs_max > 2) { 10391 tcp->tcp_rack_abs_max--; 10392 } 10393 tcp->tcp_rack_cur_max = 1; 10394 10395 /* 10396 * This segment is "unacceptable". None of its 10397 * sequence space lies within our advertized window. 10398 * 10399 * Adjust seg_len to the original value for tracing. 10400 */ 10401 seg_len -= gap; 10402 if (connp->conn_debug) { 10403 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 10404 "tcp_rput: unacceptable, gap %d, rgap %d, " 10405 "flags 0x%x, seg_seq %u, seg_ack %u, " 10406 "seg_len %d, rnxt %u, snxt %u, %s", 10407 gap, rgap, flags, seg_seq, seg_ack, 10408 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 10409 tcp_display(tcp, NULL, 10410 DISP_ADDR_AND_PORT)); 10411 } 10412 10413 /* 10414 * Arrange to send an ACK in response to the 10415 * unacceptable segment per RFC 793 page 69. There 10416 * is only one small difference between ours and the 10417 * acceptability test in the RFC - we accept ACK-only 10418 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 10419 * will be generated. 10420 * 10421 * Note that we have to ACK an ACK-only packet at least 10422 * for stacks that send 0-length keep-alives with 10423 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 10424 * section 4.2.3.6. As long as we don't ever generate 10425 * an unacceptable packet in response to an incoming 10426 * packet that is unacceptable, it should not cause 10427 * "ACK wars". 10428 */ 10429 flags |= TH_ACK_NEEDED; 10430 10431 /* 10432 * Continue processing this segment in order to use the 10433 * ACK information it contains, but skip all other 10434 * sequence-number processing. Processing the ACK 10435 * information is necessary in order to 10436 * re-synchronize connections that may have lost 10437 * synchronization. 10438 * 10439 * We clear seg_len and flag fields related to 10440 * sequence number processing as they are not 10441 * to be trusted for an unacceptable segment. 10442 */ 10443 seg_len = 0; 10444 flags &= ~(TH_SYN | TH_FIN | TH_URG); 10445 goto process_ack; 10446 } 10447 10448 /* Fix seg_seq, and chew the gap off the front. */ 10449 seg_seq = tcp->tcp_rnxt; 10450 urp += gap; 10451 do { 10452 mblk_t *mp2; 10453 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 10454 (uintptr_t)UINT_MAX); 10455 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 10456 if (gap > 0) { 10457 mp->b_rptr = mp->b_wptr - gap; 10458 break; 10459 } 10460 mp2 = mp; 10461 mp = mp->b_cont; 10462 freeb(mp2); 10463 } while (gap < 0); 10464 /* 10465 * If the urgent data has already been acknowledged, we 10466 * should ignore TH_URG below 10467 */ 10468 if (urp < 0) 10469 flags &= ~TH_URG; 10470 } 10471 /* 10472 * rgap is the amount of stuff received out of window. A negative 10473 * value is the amount out of window. 10474 */ 10475 if (rgap < 0) { 10476 mblk_t *mp2; 10477 10478 if (tcp->tcp_rwnd == 0) { 10479 BUMP_MIB(&tcps->tcps_mib, tcpInWinProbe); 10480 } else { 10481 BUMP_MIB(&tcps->tcps_mib, tcpInDataPastWinSegs); 10482 UPDATE_MIB(&tcps->tcps_mib, 10483 tcpInDataPastWinBytes, -rgap); 10484 } 10485 10486 /* 10487 * seg_len does not include the FIN, so if more than 10488 * just the FIN is out of window, we act like we don't 10489 * see it. (If just the FIN is out of window, rgap 10490 * will be zero and we will go ahead and acknowledge 10491 * the FIN.) 10492 */ 10493 flags &= ~TH_FIN; 10494 10495 /* Fix seg_len and make sure there is something left. */ 10496 seg_len += rgap; 10497 if (seg_len <= 0) { 10498 /* 10499 * Resets are only valid if they lie within our offered 10500 * window. If the RST bit is set, we just ignore this 10501 * segment. 10502 */ 10503 if (flags & TH_RST) { 10504 freemsg(mp); 10505 return; 10506 } 10507 10508 /* Per RFC 793, we need to send back an ACK. */ 10509 flags |= TH_ACK_NEEDED; 10510 10511 /* 10512 * Send SIGURG as soon as possible i.e. even 10513 * if the TH_URG was delivered in a window probe 10514 * packet (which will be unacceptable). 10515 * 10516 * We generate a signal if none has been generated 10517 * for this connection or if this is a new urgent 10518 * byte. Also send a zero-length "unmarked" message 10519 * to inform SIOCATMARK that this is not the mark. 10520 * 10521 * tcp_urp_last_valid is cleared when the T_exdata_ind 10522 * is sent up. This plus the check for old data 10523 * (gap >= 0) handles the wraparound of the sequence 10524 * number space without having to always track the 10525 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 10526 * this max in its rcv_up variable). 10527 * 10528 * This prevents duplicate SIGURGS due to a "late" 10529 * zero-window probe when the T_EXDATA_IND has already 10530 * been sent up. 10531 */ 10532 if ((flags & TH_URG) && 10533 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 10534 tcp->tcp_urp_last))) { 10535 if (IPCL_IS_NONSTR(connp)) { 10536 if (!TCP_IS_DETACHED(tcp)) { 10537 (*connp->conn_upcalls-> 10538 su_signal_oob) 10539 (connp->conn_upper_handle, 10540 urp); 10541 } 10542 } else { 10543 mp1 = allocb(0, BPRI_MED); 10544 if (mp1 == NULL) { 10545 freemsg(mp); 10546 return; 10547 } 10548 if (!TCP_IS_DETACHED(tcp) && 10549 !putnextctl1(connp->conn_rq, 10550 M_PCSIG, SIGURG)) { 10551 /* Try again on the rexmit. */ 10552 freemsg(mp1); 10553 freemsg(mp); 10554 return; 10555 } 10556 /* 10557 * If the next byte would be the mark 10558 * then mark with MARKNEXT else mark 10559 * with NOTMARKNEXT. 10560 */ 10561 if (gap == 0 && urp == 0) 10562 mp1->b_flag |= MSGMARKNEXT; 10563 else 10564 mp1->b_flag |= MSGNOTMARKNEXT; 10565 freemsg(tcp->tcp_urp_mark_mp); 10566 tcp->tcp_urp_mark_mp = mp1; 10567 flags |= TH_SEND_URP_MARK; 10568 } 10569 tcp->tcp_urp_last_valid = B_TRUE; 10570 tcp->tcp_urp_last = urp + seg_seq; 10571 } 10572 /* 10573 * If this is a zero window probe, continue to 10574 * process the ACK part. But we need to set seg_len 10575 * to 0 to avoid data processing. Otherwise just 10576 * drop the segment and send back an ACK. 10577 */ 10578 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 10579 flags &= ~(TH_SYN | TH_URG); 10580 seg_len = 0; 10581 goto process_ack; 10582 } else { 10583 freemsg(mp); 10584 goto ack_check; 10585 } 10586 } 10587 /* Pitch out of window stuff off the end. */ 10588 rgap = seg_len; 10589 mp2 = mp; 10590 do { 10591 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 10592 (uintptr_t)INT_MAX); 10593 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 10594 if (rgap < 0) { 10595 mp2->b_wptr += rgap; 10596 if ((mp1 = mp2->b_cont) != NULL) { 10597 mp2->b_cont = NULL; 10598 freemsg(mp1); 10599 } 10600 break; 10601 } 10602 } while ((mp2 = mp2->b_cont) != NULL); 10603 } 10604 ok:; 10605 /* 10606 * TCP should check ECN info for segments inside the window only. 10607 * Therefore the check should be done here. 10608 */ 10609 if (tcp->tcp_ecn_ok) { 10610 if (flags & TH_CWR) { 10611 tcp->tcp_ecn_echo_on = B_FALSE; 10612 } 10613 /* 10614 * Note that both ECN_CE and CWR can be set in the 10615 * same segment. In this case, we once again turn 10616 * on ECN_ECHO. 10617 */ 10618 if (connp->conn_ipversion == IPV4_VERSION) { 10619 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 10620 10621 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 10622 tcp->tcp_ecn_echo_on = B_TRUE; 10623 } 10624 } else { 10625 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 10626 10627 if ((vcf & htonl(IPH_ECN_CE << 20)) == 10628 htonl(IPH_ECN_CE << 20)) { 10629 tcp->tcp_ecn_echo_on = B_TRUE; 10630 } 10631 } 10632 } 10633 10634 /* 10635 * Check whether we can update tcp_ts_recent. This test is 10636 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 10637 * Extensions for High Performance: An Update", Internet Draft. 10638 */ 10639 if (tcp->tcp_snd_ts_ok && 10640 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 10641 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 10642 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 10643 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 10644 } 10645 10646 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 10647 /* 10648 * FIN in an out of order segment. We record this in 10649 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 10650 * Clear the FIN so that any check on FIN flag will fail. 10651 * Remember that FIN also counts in the sequence number 10652 * space. So we need to ack out of order FIN only segments. 10653 */ 10654 if (flags & TH_FIN) { 10655 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 10656 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 10657 flags &= ~TH_FIN; 10658 flags |= TH_ACK_NEEDED; 10659 } 10660 if (seg_len > 0) { 10661 /* Fill in the SACK blk list. */ 10662 if (tcp->tcp_snd_sack_ok) { 10663 ASSERT(tcp->tcp_sack_info != NULL); 10664 tcp_sack_insert(tcp->tcp_sack_list, 10665 seg_seq, seg_seq + seg_len, 10666 &(tcp->tcp_num_sack_blk)); 10667 } 10668 10669 /* 10670 * Attempt reassembly and see if we have something 10671 * ready to go. 10672 */ 10673 mp = tcp_reass(tcp, mp, seg_seq); 10674 /* Always ack out of order packets */ 10675 flags |= TH_ACK_NEEDED | TH_PUSH; 10676 if (mp) { 10677 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 10678 (uintptr_t)INT_MAX); 10679 seg_len = mp->b_cont ? msgdsize(mp) : 10680 (int)(mp->b_wptr - mp->b_rptr); 10681 seg_seq = tcp->tcp_rnxt; 10682 /* 10683 * A gap is filled and the seq num and len 10684 * of the gap match that of a previously 10685 * received FIN, put the FIN flag back in. 10686 */ 10687 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 10688 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 10689 flags |= TH_FIN; 10690 tcp->tcp_valid_bits &= 10691 ~TCP_OFO_FIN_VALID; 10692 } 10693 } else { 10694 /* 10695 * Keep going even with NULL mp. 10696 * There may be a useful ACK or something else 10697 * we don't want to miss. 10698 * 10699 * But TCP should not perform fast retransmit 10700 * because of the ack number. TCP uses 10701 * seg_len == 0 to determine if it is a pure 10702 * ACK. And this is not a pure ACK. 10703 */ 10704 seg_len = 0; 10705 ofo_seg = B_TRUE; 10706 } 10707 } 10708 } else if (seg_len > 0) { 10709 BUMP_MIB(&tcps->tcps_mib, tcpInDataInorderSegs); 10710 UPDATE_MIB(&tcps->tcps_mib, tcpInDataInorderBytes, seg_len); 10711 /* 10712 * If an out of order FIN was received before, and the seq 10713 * num and len of the new segment match that of the FIN, 10714 * put the FIN flag back in. 10715 */ 10716 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 10717 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 10718 flags |= TH_FIN; 10719 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 10720 } 10721 } 10722 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 10723 if (flags & TH_RST) { 10724 freemsg(mp); 10725 switch (tcp->tcp_state) { 10726 case TCPS_SYN_RCVD: 10727 (void) tcp_clean_death(tcp, ECONNREFUSED, 14); 10728 break; 10729 case TCPS_ESTABLISHED: 10730 case TCPS_FIN_WAIT_1: 10731 case TCPS_FIN_WAIT_2: 10732 case TCPS_CLOSE_WAIT: 10733 (void) tcp_clean_death(tcp, ECONNRESET, 15); 10734 break; 10735 case TCPS_CLOSING: 10736 case TCPS_LAST_ACK: 10737 (void) tcp_clean_death(tcp, 0, 16); 10738 break; 10739 default: 10740 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 10741 (void) tcp_clean_death(tcp, ENXIO, 17); 10742 break; 10743 } 10744 return; 10745 } 10746 if (flags & TH_SYN) { 10747 /* 10748 * See RFC 793, Page 71 10749 * 10750 * The seq number must be in the window as it should 10751 * be "fixed" above. If it is outside window, it should 10752 * be already rejected. Note that we allow seg_seq to be 10753 * rnxt + rwnd because we want to accept 0 window probe. 10754 */ 10755 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 10756 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 10757 freemsg(mp); 10758 /* 10759 * If the ACK flag is not set, just use our snxt as the 10760 * seq number of the RST segment. 10761 */ 10762 if (!(flags & TH_ACK)) { 10763 seg_ack = tcp->tcp_snxt; 10764 } 10765 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 10766 TH_RST|TH_ACK); 10767 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 10768 (void) tcp_clean_death(tcp, ECONNRESET, 18); 10769 return; 10770 } 10771 /* 10772 * urp could be -1 when the urp field in the packet is 0 10773 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 10774 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 10775 */ 10776 if (flags & TH_URG && urp >= 0) { 10777 if (!tcp->tcp_urp_last_valid || 10778 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 10779 /* 10780 * Non-STREAMS sockets handle the urgent data a litte 10781 * differently from STREAMS based sockets. There is no 10782 * need to mark any mblks with the MSG{NOT,}MARKNEXT 10783 * flags to keep SIOCATMARK happy. Instead a 10784 * su_signal_oob upcall is made to update the mark. 10785 * Neither is a T_EXDATA_IND mblk needed to be 10786 * prepended to the urgent data. The urgent data is 10787 * delivered using the su_recv upcall, where we set 10788 * the MSG_OOB flag to indicate that it is urg data. 10789 * 10790 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED 10791 * are used by non-STREAMS sockets. 10792 */ 10793 if (IPCL_IS_NONSTR(connp)) { 10794 if (!TCP_IS_DETACHED(tcp)) { 10795 (*connp->conn_upcalls->su_signal_oob) 10796 (connp->conn_upper_handle, urp); 10797 } 10798 } else { 10799 /* 10800 * If we haven't generated the signal yet for 10801 * this urgent pointer value, do it now. Also, 10802 * send up a zero-length M_DATA indicating 10803 * whether or not this is the mark. The latter 10804 * is not needed when a T_EXDATA_IND is sent up. 10805 * However, if there are allocation failures 10806 * this code relies on the sender retransmitting 10807 * and the socket code for determining the mark 10808 * should not block waiting for the peer to 10809 * transmit. Thus, for simplicity we always 10810 * send up the mark indication. 10811 */ 10812 mp1 = allocb(0, BPRI_MED); 10813 if (mp1 == NULL) { 10814 freemsg(mp); 10815 return; 10816 } 10817 if (!TCP_IS_DETACHED(tcp) && 10818 !putnextctl1(connp->conn_rq, M_PCSIG, 10819 SIGURG)) { 10820 /* Try again on the rexmit. */ 10821 freemsg(mp1); 10822 freemsg(mp); 10823 return; 10824 } 10825 /* 10826 * Mark with NOTMARKNEXT for now. 10827 * The code below will change this to MARKNEXT 10828 * if we are at the mark. 10829 * 10830 * If there are allocation failures (e.g. in 10831 * dupmsg below) the next time tcp_rput_data 10832 * sees the urgent segment it will send up the 10833 * MSGMARKNEXT message. 10834 */ 10835 mp1->b_flag |= MSGNOTMARKNEXT; 10836 freemsg(tcp->tcp_urp_mark_mp); 10837 tcp->tcp_urp_mark_mp = mp1; 10838 flags |= TH_SEND_URP_MARK; 10839 #ifdef DEBUG 10840 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 10841 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 10842 "last %x, %s", 10843 seg_seq, urp, tcp->tcp_urp_last, 10844 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 10845 #endif /* DEBUG */ 10846 } 10847 tcp->tcp_urp_last_valid = B_TRUE; 10848 tcp->tcp_urp_last = urp + seg_seq; 10849 } else if (tcp->tcp_urp_mark_mp != NULL) { 10850 /* 10851 * An allocation failure prevented the previous 10852 * tcp_input_data from sending up the allocated 10853 * MSG*MARKNEXT message - send it up this time 10854 * around. 10855 */ 10856 flags |= TH_SEND_URP_MARK; 10857 } 10858 10859 /* 10860 * If the urgent byte is in this segment, make sure that it is 10861 * all by itself. This makes it much easier to deal with the 10862 * possibility of an allocation failure on the T_exdata_ind. 10863 * Note that seg_len is the number of bytes in the segment, and 10864 * urp is the offset into the segment of the urgent byte. 10865 * urp < seg_len means that the urgent byte is in this segment. 10866 */ 10867 if (urp < seg_len) { 10868 if (seg_len != 1) { 10869 uint32_t tmp_rnxt; 10870 /* 10871 * Break it up and feed it back in. 10872 * Re-attach the IP header. 10873 */ 10874 mp->b_rptr = iphdr; 10875 if (urp > 0) { 10876 /* 10877 * There is stuff before the urgent 10878 * byte. 10879 */ 10880 mp1 = dupmsg(mp); 10881 if (!mp1) { 10882 /* 10883 * Trim from urgent byte on. 10884 * The rest will come back. 10885 */ 10886 (void) adjmsg(mp, 10887 urp - seg_len); 10888 tcp_input_data(connp, 10889 mp, NULL, ira); 10890 return; 10891 } 10892 (void) adjmsg(mp1, urp - seg_len); 10893 /* Feed this piece back in. */ 10894 tmp_rnxt = tcp->tcp_rnxt; 10895 tcp_input_data(connp, mp1, NULL, ira); 10896 /* 10897 * If the data passed back in was not 10898 * processed (ie: bad ACK) sending 10899 * the remainder back in will cause a 10900 * loop. In this case, drop the 10901 * packet and let the sender try 10902 * sending a good packet. 10903 */ 10904 if (tmp_rnxt == tcp->tcp_rnxt) { 10905 freemsg(mp); 10906 return; 10907 } 10908 } 10909 if (urp != seg_len - 1) { 10910 uint32_t tmp_rnxt; 10911 /* 10912 * There is stuff after the urgent 10913 * byte. 10914 */ 10915 mp1 = dupmsg(mp); 10916 if (!mp1) { 10917 /* 10918 * Trim everything beyond the 10919 * urgent byte. The rest will 10920 * come back. 10921 */ 10922 (void) adjmsg(mp, 10923 urp + 1 - seg_len); 10924 tcp_input_data(connp, 10925 mp, NULL, ira); 10926 return; 10927 } 10928 (void) adjmsg(mp1, urp + 1 - seg_len); 10929 tmp_rnxt = tcp->tcp_rnxt; 10930 tcp_input_data(connp, mp1, NULL, ira); 10931 /* 10932 * If the data passed back in was not 10933 * processed (ie: bad ACK) sending 10934 * the remainder back in will cause a 10935 * loop. In this case, drop the 10936 * packet and let the sender try 10937 * sending a good packet. 10938 */ 10939 if (tmp_rnxt == tcp->tcp_rnxt) { 10940 freemsg(mp); 10941 return; 10942 } 10943 } 10944 tcp_input_data(connp, mp, NULL, ira); 10945 return; 10946 } 10947 /* 10948 * This segment contains only the urgent byte. We 10949 * have to allocate the T_exdata_ind, if we can. 10950 */ 10951 if (IPCL_IS_NONSTR(connp)) { 10952 int error; 10953 10954 (*connp->conn_upcalls->su_recv) 10955 (connp->conn_upper_handle, mp, seg_len, 10956 MSG_OOB, &error, NULL); 10957 /* 10958 * We should never be in middle of a 10959 * fallback, the squeue guarantees that. 10960 */ 10961 ASSERT(error != EOPNOTSUPP); 10962 mp = NULL; 10963 goto update_ack; 10964 } else if (!tcp->tcp_urp_mp) { 10965 struct T_exdata_ind *tei; 10966 mp1 = allocb(sizeof (struct T_exdata_ind), 10967 BPRI_MED); 10968 if (!mp1) { 10969 /* 10970 * Sigh... It'll be back. 10971 * Generate any MSG*MARK message now. 10972 */ 10973 freemsg(mp); 10974 seg_len = 0; 10975 if (flags & TH_SEND_URP_MARK) { 10976 10977 10978 ASSERT(tcp->tcp_urp_mark_mp); 10979 tcp->tcp_urp_mark_mp->b_flag &= 10980 ~MSGNOTMARKNEXT; 10981 tcp->tcp_urp_mark_mp->b_flag |= 10982 MSGMARKNEXT; 10983 } 10984 goto ack_check; 10985 } 10986 mp1->b_datap->db_type = M_PROTO; 10987 tei = (struct T_exdata_ind *)mp1->b_rptr; 10988 tei->PRIM_type = T_EXDATA_IND; 10989 tei->MORE_flag = 0; 10990 mp1->b_wptr = (uchar_t *)&tei[1]; 10991 tcp->tcp_urp_mp = mp1; 10992 #ifdef DEBUG 10993 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 10994 "tcp_rput: allocated exdata_ind %s", 10995 tcp_display(tcp, NULL, 10996 DISP_PORT_ONLY)); 10997 #endif /* DEBUG */ 10998 /* 10999 * There is no need to send a separate MSG*MARK 11000 * message since the T_EXDATA_IND will be sent 11001 * now. 11002 */ 11003 flags &= ~TH_SEND_URP_MARK; 11004 freemsg(tcp->tcp_urp_mark_mp); 11005 tcp->tcp_urp_mark_mp = NULL; 11006 } 11007 /* 11008 * Now we are all set. On the next putnext upstream, 11009 * tcp_urp_mp will be non-NULL and will get prepended 11010 * to what has to be this piece containing the urgent 11011 * byte. If for any reason we abort this segment below, 11012 * if it comes back, we will have this ready, or it 11013 * will get blown off in close. 11014 */ 11015 } else if (urp == seg_len) { 11016 /* 11017 * The urgent byte is the next byte after this sequence 11018 * number. If this endpoint is non-STREAMS, then there 11019 * is nothing to do here since the socket has already 11020 * been notified about the urg pointer by the 11021 * su_signal_oob call above. 11022 * 11023 * In case of STREAMS, some more work might be needed. 11024 * If there is data it is marked with MSGMARKNEXT and 11025 * and any tcp_urp_mark_mp is discarded since it is not 11026 * needed. Otherwise, if the code above just allocated 11027 * a zero-length tcp_urp_mark_mp message, that message 11028 * is tagged with MSGMARKNEXT. Sending up these 11029 * MSGMARKNEXT messages makes SIOCATMARK work correctly 11030 * even though the T_EXDATA_IND will not be sent up 11031 * until the urgent byte arrives. 11032 */ 11033 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) { 11034 if (seg_len != 0) { 11035 flags |= TH_MARKNEXT_NEEDED; 11036 freemsg(tcp->tcp_urp_mark_mp); 11037 tcp->tcp_urp_mark_mp = NULL; 11038 flags &= ~TH_SEND_URP_MARK; 11039 } else if (tcp->tcp_urp_mark_mp != NULL) { 11040 flags |= TH_SEND_URP_MARK; 11041 tcp->tcp_urp_mark_mp->b_flag &= 11042 ~MSGNOTMARKNEXT; 11043 tcp->tcp_urp_mark_mp->b_flag |= 11044 MSGMARKNEXT; 11045 } 11046 } 11047 #ifdef DEBUG 11048 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 11049 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 11050 seg_len, flags, 11051 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 11052 #endif /* DEBUG */ 11053 } 11054 #ifdef DEBUG 11055 else { 11056 /* Data left until we hit mark */ 11057 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 11058 "tcp_rput: URP %d bytes left, %s", 11059 urp - seg_len, tcp_display(tcp, NULL, 11060 DISP_PORT_ONLY)); 11061 } 11062 #endif /* DEBUG */ 11063 } 11064 11065 process_ack: 11066 if (!(flags & TH_ACK)) { 11067 freemsg(mp); 11068 goto xmit_check; 11069 } 11070 } 11071 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 11072 11073 if (bytes_acked > 0) 11074 tcp->tcp_ip_forward_progress = B_TRUE; 11075 if (tcp->tcp_state == TCPS_SYN_RCVD) { 11076 if ((tcp->tcp_conn.tcp_eager_conn_ind != NULL) && 11077 ((tcp->tcp_kssl_ent == NULL) || !tcp->tcp_kssl_pending)) { 11078 /* 3-way handshake complete - pass up the T_CONN_IND */ 11079 tcp_t *listener = tcp->tcp_listener; 11080 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 11081 11082 tcp->tcp_tconnind_started = B_TRUE; 11083 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 11084 /* 11085 * We are here means eager is fine but it can 11086 * get a TH_RST at any point between now and till 11087 * accept completes and disappear. We need to 11088 * ensure that reference to eager is valid after 11089 * we get out of eager's perimeter. So we do 11090 * an extra refhold. 11091 */ 11092 CONN_INC_REF(connp); 11093 11094 /* 11095 * The listener also exists because of the refhold 11096 * done in tcp_input_listener. Its possible that it 11097 * might have closed. We will check that once we 11098 * get inside listeners context. 11099 */ 11100 CONN_INC_REF(listener->tcp_connp); 11101 if (listener->tcp_connp->conn_sqp == 11102 connp->conn_sqp) { 11103 /* 11104 * We optimize by not calling an SQUEUE_ENTER 11105 * on the listener since we know that the 11106 * listener and eager squeues are the same. 11107 * We are able to make this check safely only 11108 * because neither the eager nor the listener 11109 * can change its squeue. Only an active connect 11110 * can change its squeue 11111 */ 11112 tcp_send_conn_ind(listener->tcp_connp, mp, 11113 listener->tcp_connp->conn_sqp); 11114 CONN_DEC_REF(listener->tcp_connp); 11115 } else if (!tcp->tcp_loopback) { 11116 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 11117 mp, tcp_send_conn_ind, 11118 listener->tcp_connp, NULL, SQ_FILL, 11119 SQTAG_TCP_CONN_IND); 11120 } else { 11121 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 11122 mp, tcp_send_conn_ind, 11123 listener->tcp_connp, NULL, SQ_PROCESS, 11124 SQTAG_TCP_CONN_IND); 11125 } 11126 } 11127 11128 /* 11129 * We are seeing the final ack in the three way 11130 * hand shake of a active open'ed connection 11131 * so we must send up a T_CONN_CON 11132 * 11133 * tcp_sendmsg() checks tcp_state without entering 11134 * the squeue so tcp_state should be updated before 11135 * sending up connection confirmation. 11136 */ 11137 tcp->tcp_state = TCPS_ESTABLISHED; 11138 if (tcp->tcp_active_open) { 11139 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) { 11140 freemsg(mp); 11141 tcp->tcp_state = TCPS_SYN_RCVD; 11142 return; 11143 } 11144 /* 11145 * Don't fuse the loopback endpoints for 11146 * simultaneous active opens. 11147 */ 11148 if (tcp->tcp_loopback) { 11149 TCP_STAT(tcps, tcp_fusion_unfusable); 11150 tcp->tcp_unfusable = B_TRUE; 11151 } 11152 } 11153 11154 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 11155 bytes_acked--; 11156 /* SYN was acked - making progress */ 11157 tcp->tcp_ip_forward_progress = B_TRUE; 11158 11159 /* 11160 * If SYN was retransmitted, need to reset all 11161 * retransmission info as this segment will be 11162 * treated as a dup ACK. 11163 */ 11164 if (tcp->tcp_rexmit) { 11165 tcp->tcp_rexmit = B_FALSE; 11166 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 11167 tcp->tcp_rexmit_max = tcp->tcp_snxt; 11168 tcp->tcp_snd_burst = tcp->tcp_localnet ? 11169 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 11170 tcp->tcp_ms_we_have_waited = 0; 11171 tcp->tcp_cwnd = mss; 11172 } 11173 11174 /* 11175 * We set the send window to zero here. 11176 * This is needed if there is data to be 11177 * processed already on the queue. 11178 * Later (at swnd_update label), the 11179 * "new_swnd > tcp_swnd" condition is satisfied 11180 * the XMIT_NEEDED flag is set in the current 11181 * (SYN_RCVD) state. This ensures tcp_wput_data() is 11182 * called if there is already data on queue in 11183 * this state. 11184 */ 11185 tcp->tcp_swnd = 0; 11186 11187 if (new_swnd > tcp->tcp_max_swnd) 11188 tcp->tcp_max_swnd = new_swnd; 11189 tcp->tcp_swl1 = seg_seq; 11190 tcp->tcp_swl2 = seg_ack; 11191 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 11192 11193 /* Fuse when both sides are in ESTABLISHED state */ 11194 if (tcp->tcp_loopback && do_tcp_fusion) 11195 tcp_fuse(tcp, iphdr, tcpha); 11196 11197 } 11198 /* This code follows 4.4BSD-Lite2 mostly. */ 11199 if (bytes_acked < 0) 11200 goto est; 11201 11202 /* 11203 * If TCP is ECN capable and the congestion experience bit is 11204 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 11205 * done once per window (or more loosely, per RTT). 11206 */ 11207 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 11208 tcp->tcp_cwr = B_FALSE; 11209 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 11210 if (!tcp->tcp_cwr) { 11211 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 11212 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 11213 tcp->tcp_cwnd = npkt * mss; 11214 /* 11215 * If the cwnd is 0, use the timer to clock out 11216 * new segments. This is required by the ECN spec. 11217 */ 11218 if (npkt == 0) { 11219 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 11220 /* 11221 * This makes sure that when the ACK comes 11222 * back, we will increase tcp_cwnd by 1 MSS. 11223 */ 11224 tcp->tcp_cwnd_cnt = 0; 11225 } 11226 tcp->tcp_cwr = B_TRUE; 11227 /* 11228 * This marks the end of the current window of in 11229 * flight data. That is why we don't use 11230 * tcp_suna + tcp_swnd. Only data in flight can 11231 * provide ECN info. 11232 */ 11233 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 11234 tcp->tcp_ecn_cwr_sent = B_FALSE; 11235 } 11236 } 11237 11238 mp1 = tcp->tcp_xmit_head; 11239 if (bytes_acked == 0) { 11240 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 11241 int dupack_cnt; 11242 11243 BUMP_MIB(&tcps->tcps_mib, tcpInDupAck); 11244 /* 11245 * Fast retransmit. When we have seen exactly three 11246 * identical ACKs while we have unacked data 11247 * outstanding we take it as a hint that our peer 11248 * dropped something. 11249 * 11250 * If TCP is retransmitting, don't do fast retransmit. 11251 */ 11252 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 11253 ! tcp->tcp_rexmit) { 11254 /* Do Limited Transmit */ 11255 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 11256 tcps->tcps_dupack_fast_retransmit) { 11257 /* 11258 * RFC 3042 11259 * 11260 * What we need to do is temporarily 11261 * increase tcp_cwnd so that new 11262 * data can be sent if it is allowed 11263 * by the receive window (tcp_rwnd). 11264 * tcp_wput_data() will take care of 11265 * the rest. 11266 * 11267 * If the connection is SACK capable, 11268 * only do limited xmit when there 11269 * is SACK info. 11270 * 11271 * Note how tcp_cwnd is incremented. 11272 * The first dup ACK will increase 11273 * it by 1 MSS. The second dup ACK 11274 * will increase it by 2 MSS. This 11275 * means that only 1 new segment will 11276 * be sent for each dup ACK. 11277 */ 11278 if (tcp->tcp_unsent > 0 && 11279 (!tcp->tcp_snd_sack_ok || 11280 (tcp->tcp_snd_sack_ok && 11281 tcp->tcp_notsack_list != NULL))) { 11282 tcp->tcp_cwnd += mss << 11283 (tcp->tcp_dupack_cnt - 1); 11284 flags |= TH_LIMIT_XMIT; 11285 } 11286 } else if (dupack_cnt == 11287 tcps->tcps_dupack_fast_retransmit) { 11288 11289 /* 11290 * If we have reduced tcp_ssthresh 11291 * because of ECN, do not reduce it again 11292 * unless it is already one window of data 11293 * away. After one window of data, tcp_cwr 11294 * should then be cleared. Note that 11295 * for non ECN capable connection, tcp_cwr 11296 * should always be false. 11297 * 11298 * Adjust cwnd since the duplicate 11299 * ack indicates that a packet was 11300 * dropped (due to congestion.) 11301 */ 11302 if (!tcp->tcp_cwr) { 11303 npkt = ((tcp->tcp_snxt - 11304 tcp->tcp_suna) >> 1) / mss; 11305 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 11306 mss; 11307 tcp->tcp_cwnd = (npkt + 11308 tcp->tcp_dupack_cnt) * mss; 11309 } 11310 if (tcp->tcp_ecn_ok) { 11311 tcp->tcp_cwr = B_TRUE; 11312 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 11313 tcp->tcp_ecn_cwr_sent = B_FALSE; 11314 } 11315 11316 /* 11317 * We do Hoe's algorithm. Refer to her 11318 * paper "Improving the Start-up Behavior 11319 * of a Congestion Control Scheme for TCP," 11320 * appeared in SIGCOMM'96. 11321 * 11322 * Save highest seq no we have sent so far. 11323 * Be careful about the invisible FIN byte. 11324 */ 11325 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 11326 (tcp->tcp_unsent == 0)) { 11327 tcp->tcp_rexmit_max = tcp->tcp_fss; 11328 } else { 11329 tcp->tcp_rexmit_max = tcp->tcp_snxt; 11330 } 11331 11332 /* 11333 * Do not allow bursty traffic during. 11334 * fast recovery. Refer to Fall and Floyd's 11335 * paper "Simulation-based Comparisons of 11336 * Tahoe, Reno and SACK TCP" (in CCR?) 11337 * This is a best current practise. 11338 */ 11339 tcp->tcp_snd_burst = TCP_CWND_SS; 11340 11341 /* 11342 * For SACK: 11343 * Calculate tcp_pipe, which is the 11344 * estimated number of bytes in 11345 * network. 11346 * 11347 * tcp_fack is the highest sack'ed seq num 11348 * TCP has received. 11349 * 11350 * tcp_pipe is explained in the above quoted 11351 * Fall and Floyd's paper. tcp_fack is 11352 * explained in Mathis and Mahdavi's 11353 * "Forward Acknowledgment: Refining TCP 11354 * Congestion Control" in SIGCOMM '96. 11355 */ 11356 if (tcp->tcp_snd_sack_ok) { 11357 ASSERT(tcp->tcp_sack_info != NULL); 11358 if (tcp->tcp_notsack_list != NULL) { 11359 tcp->tcp_pipe = tcp->tcp_snxt - 11360 tcp->tcp_fack; 11361 tcp->tcp_sack_snxt = seg_ack; 11362 flags |= TH_NEED_SACK_REXMIT; 11363 } else { 11364 /* 11365 * Always initialize tcp_pipe 11366 * even though we don't have 11367 * any SACK info. If later 11368 * we get SACK info and 11369 * tcp_pipe is not initialized, 11370 * funny things will happen. 11371 */ 11372 tcp->tcp_pipe = 11373 tcp->tcp_cwnd_ssthresh; 11374 } 11375 } else { 11376 flags |= TH_REXMIT_NEEDED; 11377 } /* tcp_snd_sack_ok */ 11378 11379 } else { 11380 /* 11381 * Here we perform congestion 11382 * avoidance, but NOT slow start. 11383 * This is known as the Fast 11384 * Recovery Algorithm. 11385 */ 11386 if (tcp->tcp_snd_sack_ok && 11387 tcp->tcp_notsack_list != NULL) { 11388 flags |= TH_NEED_SACK_REXMIT; 11389 tcp->tcp_pipe -= mss; 11390 if (tcp->tcp_pipe < 0) 11391 tcp->tcp_pipe = 0; 11392 } else { 11393 /* 11394 * We know that one more packet has 11395 * left the pipe thus we can update 11396 * cwnd. 11397 */ 11398 cwnd = tcp->tcp_cwnd + mss; 11399 if (cwnd > tcp->tcp_cwnd_max) 11400 cwnd = tcp->tcp_cwnd_max; 11401 tcp->tcp_cwnd = cwnd; 11402 if (tcp->tcp_unsent > 0) 11403 flags |= TH_XMIT_NEEDED; 11404 } 11405 } 11406 } 11407 } else if (tcp->tcp_zero_win_probe) { 11408 /* 11409 * If the window has opened, need to arrange 11410 * to send additional data. 11411 */ 11412 if (new_swnd != 0) { 11413 /* tcp_suna != tcp_snxt */ 11414 /* Packet contains a window update */ 11415 BUMP_MIB(&tcps->tcps_mib, tcpInWinUpdate); 11416 tcp->tcp_zero_win_probe = 0; 11417 tcp->tcp_timer_backoff = 0; 11418 tcp->tcp_ms_we_have_waited = 0; 11419 11420 /* 11421 * Transmit starting with tcp_suna since 11422 * the one byte probe is not ack'ed. 11423 * If TCP has sent more than one identical 11424 * probe, tcp_rexmit will be set. That means 11425 * tcp_ss_rexmit() will send out the one 11426 * byte along with new data. Otherwise, 11427 * fake the retransmission. 11428 */ 11429 flags |= TH_XMIT_NEEDED; 11430 if (!tcp->tcp_rexmit) { 11431 tcp->tcp_rexmit = B_TRUE; 11432 tcp->tcp_dupack_cnt = 0; 11433 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 11434 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 11435 } 11436 } 11437 } 11438 goto swnd_update; 11439 } 11440 11441 /* 11442 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 11443 * If the ACK value acks something that we have not yet sent, it might 11444 * be an old duplicate segment. Send an ACK to re-synchronize the 11445 * other side. 11446 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 11447 * state is handled above, so we can always just drop the segment and 11448 * send an ACK here. 11449 * 11450 * In the case where the peer shrinks the window, we see the new window 11451 * update, but all the data sent previously is queued up by the peer. 11452 * To account for this, in tcp_process_shrunk_swnd(), the sequence 11453 * number, which was already sent, and within window, is recorded. 11454 * tcp_snxt is then updated. 11455 * 11456 * If the window has previously shrunk, and an ACK for data not yet 11457 * sent, according to tcp_snxt is recieved, it may still be valid. If 11458 * the ACK is for data within the window at the time the window was 11459 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to 11460 * the sequence number ACK'ed. 11461 * 11462 * If the ACK covers all the data sent at the time the window was 11463 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE. 11464 * 11465 * Should we send ACKs in response to ACK only segments? 11466 */ 11467 11468 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 11469 if ((tcp->tcp_is_wnd_shrnk) && 11470 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) { 11471 uint32_t data_acked_ahead_snxt; 11472 11473 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt; 11474 tcp_update_xmit_tail(tcp, seg_ack); 11475 tcp->tcp_unsent -= data_acked_ahead_snxt; 11476 } else { 11477 BUMP_MIB(&tcps->tcps_mib, tcpInAckUnsent); 11478 /* drop the received segment */ 11479 freemsg(mp); 11480 11481 /* 11482 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 11483 * greater than 0, check if the number of such 11484 * bogus ACks is greater than that count. If yes, 11485 * don't send back any ACK. This prevents TCP from 11486 * getting into an ACK storm if somehow an attacker 11487 * successfully spoofs an acceptable segment to our 11488 * peer. 11489 */ 11490 if (tcp_drop_ack_unsent_cnt > 0 && 11491 ++tcp->tcp_in_ack_unsent > 11492 tcp_drop_ack_unsent_cnt) { 11493 TCP_STAT(tcps, tcp_in_ack_unsent_drop); 11494 return; 11495 } 11496 mp = tcp_ack_mp(tcp); 11497 if (mp != NULL) { 11498 BUMP_LOCAL(tcp->tcp_obsegs); 11499 BUMP_MIB(&tcps->tcps_mib, tcpOutAck); 11500 tcp_send_data(tcp, mp); 11501 } 11502 return; 11503 } 11504 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack, 11505 tcp->tcp_snxt_shrunk)) { 11506 tcp->tcp_is_wnd_shrnk = B_FALSE; 11507 } 11508 11509 /* 11510 * TCP gets a new ACK, update the notsack'ed list to delete those 11511 * blocks that are covered by this ACK. 11512 */ 11513 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 11514 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 11515 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 11516 } 11517 11518 /* 11519 * If we got an ACK after fast retransmit, check to see 11520 * if it is a partial ACK. If it is not and the congestion 11521 * window was inflated to account for the other side's 11522 * cached packets, retract it. If it is, do Hoe's algorithm. 11523 */ 11524 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) { 11525 ASSERT(tcp->tcp_rexmit == B_FALSE); 11526 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 11527 tcp->tcp_dupack_cnt = 0; 11528 /* 11529 * Restore the orig tcp_cwnd_ssthresh after 11530 * fast retransmit phase. 11531 */ 11532 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 11533 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 11534 } 11535 tcp->tcp_rexmit_max = seg_ack; 11536 tcp->tcp_cwnd_cnt = 0; 11537 tcp->tcp_snd_burst = tcp->tcp_localnet ? 11538 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 11539 11540 /* 11541 * Remove all notsack info to avoid confusion with 11542 * the next fast retrasnmit/recovery phase. 11543 */ 11544 if (tcp->tcp_snd_sack_ok && 11545 tcp->tcp_notsack_list != NULL) { 11546 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 11547 tcp); 11548 } 11549 } else { 11550 if (tcp->tcp_snd_sack_ok && 11551 tcp->tcp_notsack_list != NULL) { 11552 flags |= TH_NEED_SACK_REXMIT; 11553 tcp->tcp_pipe -= mss; 11554 if (tcp->tcp_pipe < 0) 11555 tcp->tcp_pipe = 0; 11556 } else { 11557 /* 11558 * Hoe's algorithm: 11559 * 11560 * Retransmit the unack'ed segment and 11561 * restart fast recovery. Note that we 11562 * need to scale back tcp_cwnd to the 11563 * original value when we started fast 11564 * recovery. This is to prevent overly 11565 * aggressive behaviour in sending new 11566 * segments. 11567 */ 11568 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 11569 tcps->tcps_dupack_fast_retransmit * mss; 11570 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 11571 flags |= TH_REXMIT_NEEDED; 11572 } 11573 } 11574 } else { 11575 tcp->tcp_dupack_cnt = 0; 11576 if (tcp->tcp_rexmit) { 11577 /* 11578 * TCP is retranmitting. If the ACK ack's all 11579 * outstanding data, update tcp_rexmit_max and 11580 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 11581 * to the correct value. 11582 * 11583 * Note that SEQ_LEQ() is used. This is to avoid 11584 * unnecessary fast retransmit caused by dup ACKs 11585 * received when TCP does slow start retransmission 11586 * after a time out. During this phase, TCP may 11587 * send out segments which are already received. 11588 * This causes dup ACKs to be sent back. 11589 */ 11590 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 11591 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 11592 tcp->tcp_rexmit_nxt = seg_ack; 11593 } 11594 if (seg_ack != tcp->tcp_rexmit_max) { 11595 flags |= TH_XMIT_NEEDED; 11596 } 11597 } else { 11598 tcp->tcp_rexmit = B_FALSE; 11599 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 11600 tcp->tcp_snd_burst = tcp->tcp_localnet ? 11601 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 11602 } 11603 tcp->tcp_ms_we_have_waited = 0; 11604 } 11605 } 11606 11607 BUMP_MIB(&tcps->tcps_mib, tcpInAckSegs); 11608 UPDATE_MIB(&tcps->tcps_mib, tcpInAckBytes, bytes_acked); 11609 tcp->tcp_suna = seg_ack; 11610 if (tcp->tcp_zero_win_probe != 0) { 11611 tcp->tcp_zero_win_probe = 0; 11612 tcp->tcp_timer_backoff = 0; 11613 } 11614 11615 /* 11616 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 11617 * Note that it cannot be the SYN being ack'ed. The code flow 11618 * will not reach here. 11619 */ 11620 if (mp1 == NULL) { 11621 goto fin_acked; 11622 } 11623 11624 /* 11625 * Update the congestion window. 11626 * 11627 * If TCP is not ECN capable or TCP is ECN capable but the 11628 * congestion experience bit is not set, increase the tcp_cwnd as 11629 * usual. 11630 */ 11631 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 11632 cwnd = tcp->tcp_cwnd; 11633 add = mss; 11634 11635 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 11636 /* 11637 * This is to prevent an increase of less than 1 MSS of 11638 * tcp_cwnd. With partial increase, tcp_wput_data() 11639 * may send out tinygrams in order to preserve mblk 11640 * boundaries. 11641 * 11642 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 11643 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 11644 * increased by 1 MSS for every RTTs. 11645 */ 11646 if (tcp->tcp_cwnd_cnt <= 0) { 11647 tcp->tcp_cwnd_cnt = cwnd + add; 11648 } else { 11649 tcp->tcp_cwnd_cnt -= add; 11650 add = 0; 11651 } 11652 } 11653 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 11654 } 11655 11656 /* See if the latest urgent data has been acknowledged */ 11657 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 11658 SEQ_GT(seg_ack, tcp->tcp_urg)) 11659 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 11660 11661 /* Can we update the RTT estimates? */ 11662 if (tcp->tcp_snd_ts_ok) { 11663 /* Ignore zero timestamp echo-reply. */ 11664 if (tcpopt.tcp_opt_ts_ecr != 0) { 11665 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH - 11666 (int32_t)tcpopt.tcp_opt_ts_ecr); 11667 } 11668 11669 /* If needed, restart the timer. */ 11670 if (tcp->tcp_set_timer == 1) { 11671 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 11672 tcp->tcp_set_timer = 0; 11673 } 11674 /* 11675 * Update tcp_csuna in case the other side stops sending 11676 * us timestamps. 11677 */ 11678 tcp->tcp_csuna = tcp->tcp_snxt; 11679 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 11680 /* 11681 * An ACK sequence we haven't seen before, so get the RTT 11682 * and update the RTO. But first check if the timestamp is 11683 * valid to use. 11684 */ 11685 if ((mp1->b_next != NULL) && 11686 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) 11687 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH - 11688 (int32_t)(intptr_t)mp1->b_prev); 11689 else 11690 BUMP_MIB(&tcps->tcps_mib, tcpRttNoUpdate); 11691 11692 /* Remeber the last sequence to be ACKed */ 11693 tcp->tcp_csuna = seg_ack; 11694 if (tcp->tcp_set_timer == 1) { 11695 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 11696 tcp->tcp_set_timer = 0; 11697 } 11698 } else { 11699 BUMP_MIB(&tcps->tcps_mib, tcpRttNoUpdate); 11700 } 11701 11702 /* Eat acknowledged bytes off the xmit queue. */ 11703 for (;;) { 11704 mblk_t *mp2; 11705 uchar_t *wptr; 11706 11707 wptr = mp1->b_wptr; 11708 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 11709 bytes_acked -= (int)(wptr - mp1->b_rptr); 11710 if (bytes_acked < 0) { 11711 mp1->b_rptr = wptr + bytes_acked; 11712 /* 11713 * Set a new timestamp if all the bytes timed by the 11714 * old timestamp have been ack'ed. 11715 */ 11716 if (SEQ_GT(seg_ack, 11717 (uint32_t)(uintptr_t)(mp1->b_next))) { 11718 mp1->b_prev = 11719 (mblk_t *)(uintptr_t)LBOLT_FASTPATH; 11720 mp1->b_next = NULL; 11721 } 11722 break; 11723 } 11724 mp1->b_next = NULL; 11725 mp1->b_prev = NULL; 11726 mp2 = mp1; 11727 mp1 = mp1->b_cont; 11728 11729 /* 11730 * This notification is required for some zero-copy 11731 * clients to maintain a copy semantic. After the data 11732 * is ack'ed, client is safe to modify or reuse the buffer. 11733 */ 11734 if (tcp->tcp_snd_zcopy_aware && 11735 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 11736 tcp_zcopy_notify(tcp); 11737 freeb(mp2); 11738 if (bytes_acked == 0) { 11739 if (mp1 == NULL) { 11740 /* Everything is ack'ed, clear the tail. */ 11741 tcp->tcp_xmit_tail = NULL; 11742 /* 11743 * Cancel the timer unless we are still 11744 * waiting for an ACK for the FIN packet. 11745 */ 11746 if (tcp->tcp_timer_tid != 0 && 11747 tcp->tcp_snxt == tcp->tcp_suna) { 11748 (void) TCP_TIMER_CANCEL(tcp, 11749 tcp->tcp_timer_tid); 11750 tcp->tcp_timer_tid = 0; 11751 } 11752 goto pre_swnd_update; 11753 } 11754 if (mp2 != tcp->tcp_xmit_tail) 11755 break; 11756 tcp->tcp_xmit_tail = mp1; 11757 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 11758 (uintptr_t)INT_MAX); 11759 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 11760 mp1->b_rptr); 11761 break; 11762 } 11763 if (mp1 == NULL) { 11764 /* 11765 * More was acked but there is nothing more 11766 * outstanding. This means that the FIN was 11767 * just acked or that we're talking to a clown. 11768 */ 11769 fin_acked: 11770 ASSERT(tcp->tcp_fin_sent); 11771 tcp->tcp_xmit_tail = NULL; 11772 if (tcp->tcp_fin_sent) { 11773 /* FIN was acked - making progress */ 11774 if (!tcp->tcp_fin_acked) 11775 tcp->tcp_ip_forward_progress = B_TRUE; 11776 tcp->tcp_fin_acked = B_TRUE; 11777 if (tcp->tcp_linger_tid != 0 && 11778 TCP_TIMER_CANCEL(tcp, 11779 tcp->tcp_linger_tid) >= 0) { 11780 tcp_stop_lingering(tcp); 11781 freemsg(mp); 11782 mp = NULL; 11783 } 11784 } else { 11785 /* 11786 * We should never get here because 11787 * we have already checked that the 11788 * number of bytes ack'ed should be 11789 * smaller than or equal to what we 11790 * have sent so far (it is the 11791 * acceptability check of the ACK). 11792 * We can only get here if the send 11793 * queue is corrupted. 11794 * 11795 * Terminate the connection and 11796 * panic the system. It is better 11797 * for us to panic instead of 11798 * continuing to avoid other disaster. 11799 */ 11800 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 11801 tcp->tcp_rnxt, TH_RST|TH_ACK); 11802 panic("Memory corruption " 11803 "detected for connection %s.", 11804 tcp_display(tcp, NULL, 11805 DISP_ADDR_AND_PORT)); 11806 /*NOTREACHED*/ 11807 } 11808 goto pre_swnd_update; 11809 } 11810 ASSERT(mp2 != tcp->tcp_xmit_tail); 11811 } 11812 if (tcp->tcp_unsent) { 11813 flags |= TH_XMIT_NEEDED; 11814 } 11815 pre_swnd_update: 11816 tcp->tcp_xmit_head = mp1; 11817 swnd_update: 11818 /* 11819 * The following check is different from most other implementations. 11820 * For bi-directional transfer, when segments are dropped, the 11821 * "normal" check will not accept a window update in those 11822 * retransmitted segemnts. Failing to do that, TCP may send out 11823 * segments which are outside receiver's window. As TCP accepts 11824 * the ack in those retransmitted segments, if the window update in 11825 * the same segment is not accepted, TCP will incorrectly calculates 11826 * that it can send more segments. This can create a deadlock 11827 * with the receiver if its window becomes zero. 11828 */ 11829 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 11830 SEQ_LT(tcp->tcp_swl1, seg_seq) || 11831 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 11832 /* 11833 * The criteria for update is: 11834 * 11835 * 1. the segment acknowledges some data. Or 11836 * 2. the segment is new, i.e. it has a higher seq num. Or 11837 * 3. the segment is not old and the advertised window is 11838 * larger than the previous advertised window. 11839 */ 11840 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 11841 flags |= TH_XMIT_NEEDED; 11842 tcp->tcp_swnd = new_swnd; 11843 if (new_swnd > tcp->tcp_max_swnd) 11844 tcp->tcp_max_swnd = new_swnd; 11845 tcp->tcp_swl1 = seg_seq; 11846 tcp->tcp_swl2 = seg_ack; 11847 } 11848 est: 11849 if (tcp->tcp_state > TCPS_ESTABLISHED) { 11850 11851 switch (tcp->tcp_state) { 11852 case TCPS_FIN_WAIT_1: 11853 if (tcp->tcp_fin_acked) { 11854 tcp->tcp_state = TCPS_FIN_WAIT_2; 11855 /* 11856 * We implement the non-standard BSD/SunOS 11857 * FIN_WAIT_2 flushing algorithm. 11858 * If there is no user attached to this 11859 * TCP endpoint, then this TCP struct 11860 * could hang around forever in FIN_WAIT_2 11861 * state if the peer forgets to send us 11862 * a FIN. To prevent this, we wait only 11863 * 2*MSL (a convenient time value) for 11864 * the FIN to arrive. If it doesn't show up, 11865 * we flush the TCP endpoint. This algorithm, 11866 * though a violation of RFC-793, has worked 11867 * for over 10 years in BSD systems. 11868 * Note: SunOS 4.x waits 675 seconds before 11869 * flushing the FIN_WAIT_2 connection. 11870 */ 11871 TCP_TIMER_RESTART(tcp, 11872 tcps->tcps_fin_wait_2_flush_interval); 11873 } 11874 break; 11875 case TCPS_FIN_WAIT_2: 11876 break; /* Shutdown hook? */ 11877 case TCPS_LAST_ACK: 11878 freemsg(mp); 11879 if (tcp->tcp_fin_acked) { 11880 (void) tcp_clean_death(tcp, 0, 19); 11881 return; 11882 } 11883 goto xmit_check; 11884 case TCPS_CLOSING: 11885 if (tcp->tcp_fin_acked) { 11886 tcp->tcp_state = TCPS_TIME_WAIT; 11887 /* 11888 * Unconditionally clear the exclusive binding 11889 * bit so this TIME-WAIT connection won't 11890 * interfere with new ones. 11891 */ 11892 connp->conn_exclbind = 0; 11893 if (!TCP_IS_DETACHED(tcp)) { 11894 TCP_TIMER_RESTART(tcp, 11895 tcps->tcps_time_wait_interval); 11896 } else { 11897 tcp_time_wait_append(tcp); 11898 TCP_DBGSTAT(tcps, tcp_rput_time_wait); 11899 } 11900 } 11901 /*FALLTHRU*/ 11902 case TCPS_CLOSE_WAIT: 11903 freemsg(mp); 11904 goto xmit_check; 11905 default: 11906 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 11907 break; 11908 } 11909 } 11910 if (flags & TH_FIN) { 11911 /* Make sure we ack the fin */ 11912 flags |= TH_ACK_NEEDED; 11913 if (!tcp->tcp_fin_rcvd) { 11914 tcp->tcp_fin_rcvd = B_TRUE; 11915 tcp->tcp_rnxt++; 11916 tcpha = tcp->tcp_tcpha; 11917 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 11918 11919 /* 11920 * Generate the ordrel_ind at the end unless we 11921 * are an eager guy. 11922 * In the eager case tcp_rsrv will do this when run 11923 * after tcp_accept is done. 11924 */ 11925 if (tcp->tcp_listener == NULL && 11926 !TCP_IS_DETACHED(tcp) && !tcp->tcp_hard_binding) 11927 flags |= TH_ORDREL_NEEDED; 11928 switch (tcp->tcp_state) { 11929 case TCPS_SYN_RCVD: 11930 case TCPS_ESTABLISHED: 11931 tcp->tcp_state = TCPS_CLOSE_WAIT; 11932 /* Keepalive? */ 11933 break; 11934 case TCPS_FIN_WAIT_1: 11935 if (!tcp->tcp_fin_acked) { 11936 tcp->tcp_state = TCPS_CLOSING; 11937 break; 11938 } 11939 /* FALLTHRU */ 11940 case TCPS_FIN_WAIT_2: 11941 tcp->tcp_state = TCPS_TIME_WAIT; 11942 /* 11943 * Unconditionally clear the exclusive binding 11944 * bit so this TIME-WAIT connection won't 11945 * interfere with new ones. 11946 */ 11947 connp->conn_exclbind = 0; 11948 if (!TCP_IS_DETACHED(tcp)) { 11949 TCP_TIMER_RESTART(tcp, 11950 tcps->tcps_time_wait_interval); 11951 } else { 11952 tcp_time_wait_append(tcp); 11953 TCP_DBGSTAT(tcps, tcp_rput_time_wait); 11954 } 11955 if (seg_len) { 11956 /* 11957 * implies data piggybacked on FIN. 11958 * break to handle data. 11959 */ 11960 break; 11961 } 11962 freemsg(mp); 11963 goto ack_check; 11964 } 11965 } 11966 } 11967 if (mp == NULL) 11968 goto xmit_check; 11969 if (seg_len == 0) { 11970 freemsg(mp); 11971 goto xmit_check; 11972 } 11973 if (mp->b_rptr == mp->b_wptr) { 11974 /* 11975 * The header has been consumed, so we remove the 11976 * zero-length mblk here. 11977 */ 11978 mp1 = mp; 11979 mp = mp->b_cont; 11980 freeb(mp1); 11981 } 11982 update_ack: 11983 tcpha = tcp->tcp_tcpha; 11984 tcp->tcp_rack_cnt++; 11985 { 11986 uint32_t cur_max; 11987 11988 cur_max = tcp->tcp_rack_cur_max; 11989 if (tcp->tcp_rack_cnt >= cur_max) { 11990 /* 11991 * We have more unacked data than we should - send 11992 * an ACK now. 11993 */ 11994 flags |= TH_ACK_NEEDED; 11995 cur_max++; 11996 if (cur_max > tcp->tcp_rack_abs_max) 11997 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 11998 else 11999 tcp->tcp_rack_cur_max = cur_max; 12000 } else if (TCP_IS_DETACHED(tcp)) { 12001 /* We don't have an ACK timer for detached TCP. */ 12002 flags |= TH_ACK_NEEDED; 12003 } else if (seg_len < mss) { 12004 /* 12005 * If we get a segment that is less than an mss, and we 12006 * already have unacknowledged data, and the amount 12007 * unacknowledged is not a multiple of mss, then we 12008 * better generate an ACK now. Otherwise, this may be 12009 * the tail piece of a transaction, and we would rather 12010 * wait for the response. 12011 */ 12012 uint32_t udif; 12013 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 12014 (uintptr_t)INT_MAX); 12015 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 12016 if (udif && (udif % mss)) 12017 flags |= TH_ACK_NEEDED; 12018 else 12019 flags |= TH_ACK_TIMER_NEEDED; 12020 } else { 12021 /* Start delayed ack timer */ 12022 flags |= TH_ACK_TIMER_NEEDED; 12023 } 12024 } 12025 tcp->tcp_rnxt += seg_len; 12026 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 12027 12028 if (mp == NULL) 12029 goto xmit_check; 12030 12031 /* Update SACK list */ 12032 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 12033 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 12034 &(tcp->tcp_num_sack_blk)); 12035 } 12036 12037 if (tcp->tcp_urp_mp) { 12038 tcp->tcp_urp_mp->b_cont = mp; 12039 mp = tcp->tcp_urp_mp; 12040 tcp->tcp_urp_mp = NULL; 12041 /* Ready for a new signal. */ 12042 tcp->tcp_urp_last_valid = B_FALSE; 12043 #ifdef DEBUG 12044 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 12045 "tcp_rput: sending exdata_ind %s", 12046 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 12047 #endif /* DEBUG */ 12048 } 12049 12050 /* 12051 * Check for ancillary data changes compared to last segment. 12052 */ 12053 if (connp->conn_recv_ancillary.crb_all != 0) { 12054 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira); 12055 if (mp == NULL) 12056 return; 12057 } 12058 12059 if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) { 12060 /* 12061 * Side queue inbound data until the accept happens. 12062 * tcp_accept/tcp_rput drains this when the accept happens. 12063 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 12064 * T_EXDATA_IND) it is queued on b_next. 12065 * XXX Make urgent data use this. Requires: 12066 * Removing tcp_listener check for TH_URG 12067 * Making M_PCPROTO and MARK messages skip the eager case 12068 */ 12069 12070 if (tcp->tcp_kssl_pending) { 12071 DTRACE_PROBE1(kssl_mblk__ksslinput_pending, 12072 mblk_t *, mp); 12073 tcp_kssl_input(tcp, mp, ira->ira_cred); 12074 } else { 12075 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 12076 } 12077 } else if (IPCL_IS_NONSTR(connp)) { 12078 /* 12079 * Non-STREAMS socket 12080 * 12081 * Note that no KSSL processing is done here, because 12082 * KSSL is not supported for non-STREAMS sockets. 12083 */ 12084 boolean_t push = flags & (TH_PUSH|TH_FIN); 12085 int error; 12086 12087 if ((*connp->conn_upcalls->su_recv)( 12088 connp->conn_upper_handle, 12089 mp, seg_len, 0, &error, &push) <= 0) { 12090 /* 12091 * We should never be in middle of a 12092 * fallback, the squeue guarantees that. 12093 */ 12094 ASSERT(error != EOPNOTSUPP); 12095 if (error == ENOSPC) 12096 tcp->tcp_rwnd -= seg_len; 12097 } else if (push) { 12098 /* PUSH bit set and sockfs is not flow controlled */ 12099 flags |= tcp_rwnd_reopen(tcp); 12100 } 12101 } else { 12102 /* STREAMS socket */ 12103 if (mp->b_datap->db_type != M_DATA || 12104 (flags & TH_MARKNEXT_NEEDED)) { 12105 if (tcp->tcp_rcv_list != NULL) { 12106 flags |= tcp_rcv_drain(tcp); 12107 } 12108 ASSERT(tcp->tcp_rcv_list == NULL || 12109 tcp->tcp_fused_sigurg); 12110 12111 if (flags & TH_MARKNEXT_NEEDED) { 12112 #ifdef DEBUG 12113 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 12114 "tcp_rput: sending MSGMARKNEXT %s", 12115 tcp_display(tcp, NULL, 12116 DISP_PORT_ONLY)); 12117 #endif /* DEBUG */ 12118 mp->b_flag |= MSGMARKNEXT; 12119 flags &= ~TH_MARKNEXT_NEEDED; 12120 } 12121 12122 /* Does this need SSL processing first? */ 12123 if ((tcp->tcp_kssl_ctx != NULL) && 12124 (DB_TYPE(mp) == M_DATA)) { 12125 DTRACE_PROBE1(kssl_mblk__ksslinput_data1, 12126 mblk_t *, mp); 12127 tcp_kssl_input(tcp, mp, ira->ira_cred); 12128 } else { 12129 if (is_system_labeled()) 12130 tcp_setcred_data(mp, ira); 12131 12132 putnext(connp->conn_rq, mp); 12133 if (!canputnext(connp->conn_rq)) 12134 tcp->tcp_rwnd -= seg_len; 12135 } 12136 } else if ((tcp->tcp_kssl_ctx != NULL) && 12137 (DB_TYPE(mp) == M_DATA)) { 12138 /* Does this need SSL processing first? */ 12139 DTRACE_PROBE1(kssl_mblk__ksslinput_data2, mblk_t *, mp); 12140 tcp_kssl_input(tcp, mp, ira->ira_cred); 12141 } else if ((flags & (TH_PUSH|TH_FIN)) || 12142 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) { 12143 if (tcp->tcp_rcv_list != NULL) { 12144 /* 12145 * Enqueue the new segment first and then 12146 * call tcp_rcv_drain() to send all data 12147 * up. The other way to do this is to 12148 * send all queued data up and then call 12149 * putnext() to send the new segment up. 12150 * This way can remove the else part later 12151 * on. 12152 * 12153 * We don't do this to avoid one more call to 12154 * canputnext() as tcp_rcv_drain() needs to 12155 * call canputnext(). 12156 */ 12157 tcp_rcv_enqueue(tcp, mp, seg_len, 12158 ira->ira_cred); 12159 flags |= tcp_rcv_drain(tcp); 12160 } else { 12161 if (is_system_labeled()) 12162 tcp_setcred_data(mp, ira); 12163 12164 putnext(connp->conn_rq, mp); 12165 if (!canputnext(connp->conn_rq)) 12166 tcp->tcp_rwnd -= seg_len; 12167 } 12168 } else { 12169 /* 12170 * Enqueue all packets when processing an mblk 12171 * from the co queue and also enqueue normal packets. 12172 */ 12173 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 12174 } 12175 /* 12176 * Make sure the timer is running if we have data waiting 12177 * for a push bit. This provides resiliency against 12178 * implementations that do not correctly generate push bits. 12179 */ 12180 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) { 12181 /* 12182 * The connection may be closed at this point, so don't 12183 * do anything for a detached tcp. 12184 */ 12185 if (!TCP_IS_DETACHED(tcp)) 12186 tcp->tcp_push_tid = TCP_TIMER(tcp, 12187 tcp_push_timer, 12188 MSEC_TO_TICK( 12189 tcps->tcps_push_timer_interval)); 12190 } 12191 } 12192 12193 xmit_check: 12194 /* Is there anything left to do? */ 12195 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 12196 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 12197 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 12198 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 12199 goto done; 12200 12201 /* Any transmit work to do and a non-zero window? */ 12202 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 12203 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 12204 if (flags & TH_REXMIT_NEEDED) { 12205 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 12206 12207 BUMP_MIB(&tcps->tcps_mib, tcpOutFastRetrans); 12208 if (snd_size > mss) 12209 snd_size = mss; 12210 if (snd_size > tcp->tcp_swnd) 12211 snd_size = tcp->tcp_swnd; 12212 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 12213 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 12214 B_TRUE); 12215 12216 if (mp1 != NULL) { 12217 tcp->tcp_xmit_head->b_prev = 12218 (mblk_t *)LBOLT_FASTPATH; 12219 tcp->tcp_csuna = tcp->tcp_snxt; 12220 BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); 12221 UPDATE_MIB(&tcps->tcps_mib, 12222 tcpRetransBytes, snd_size); 12223 tcp_send_data(tcp, mp1); 12224 } 12225 } 12226 if (flags & TH_NEED_SACK_REXMIT) { 12227 tcp_sack_rxmit(tcp, &flags); 12228 } 12229 /* 12230 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 12231 * out new segment. Note that tcp_rexmit should not be 12232 * set, otherwise TH_LIMIT_XMIT should not be set. 12233 */ 12234 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 12235 if (!tcp->tcp_rexmit) { 12236 tcp_wput_data(tcp, NULL, B_FALSE); 12237 } else { 12238 tcp_ss_rexmit(tcp); 12239 } 12240 } 12241 /* 12242 * Adjust tcp_cwnd back to normal value after sending 12243 * new data segments. 12244 */ 12245 if (flags & TH_LIMIT_XMIT) { 12246 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 12247 /* 12248 * This will restart the timer. Restarting the 12249 * timer is used to avoid a timeout before the 12250 * limited transmitted segment's ACK gets back. 12251 */ 12252 if (tcp->tcp_xmit_head != NULL) 12253 tcp->tcp_xmit_head->b_prev = 12254 (mblk_t *)LBOLT_FASTPATH; 12255 } 12256 12257 /* Anything more to do? */ 12258 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 12259 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 12260 goto done; 12261 } 12262 ack_check: 12263 if (flags & TH_SEND_URP_MARK) { 12264 ASSERT(tcp->tcp_urp_mark_mp); 12265 ASSERT(!IPCL_IS_NONSTR(connp)); 12266 /* 12267 * Send up any queued data and then send the mark message 12268 */ 12269 if (tcp->tcp_rcv_list != NULL) { 12270 flags |= tcp_rcv_drain(tcp); 12271 12272 } 12273 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 12274 mp1 = tcp->tcp_urp_mark_mp; 12275 tcp->tcp_urp_mark_mp = NULL; 12276 if (is_system_labeled()) 12277 tcp_setcred_data(mp1, ira); 12278 12279 putnext(connp->conn_rq, mp1); 12280 #ifdef DEBUG 12281 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 12282 "tcp_rput: sending zero-length %s %s", 12283 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 12284 "MSGNOTMARKNEXT"), 12285 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 12286 #endif /* DEBUG */ 12287 flags &= ~TH_SEND_URP_MARK; 12288 } 12289 if (flags & TH_ACK_NEEDED) { 12290 /* 12291 * Time to send an ack for some reason. 12292 */ 12293 mp1 = tcp_ack_mp(tcp); 12294 12295 if (mp1 != NULL) { 12296 tcp_send_data(tcp, mp1); 12297 BUMP_LOCAL(tcp->tcp_obsegs); 12298 BUMP_MIB(&tcps->tcps_mib, tcpOutAck); 12299 } 12300 if (tcp->tcp_ack_tid != 0) { 12301 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 12302 tcp->tcp_ack_tid = 0; 12303 } 12304 } 12305 if (flags & TH_ACK_TIMER_NEEDED) { 12306 /* 12307 * Arrange for deferred ACK or push wait timeout. 12308 * Start timer if it is not already running. 12309 */ 12310 if (tcp->tcp_ack_tid == 0) { 12311 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 12312 MSEC_TO_TICK(tcp->tcp_localnet ? 12313 (clock_t)tcps->tcps_local_dack_interval : 12314 (clock_t)tcps->tcps_deferred_ack_interval)); 12315 } 12316 } 12317 if (flags & TH_ORDREL_NEEDED) { 12318 /* 12319 * Send up the ordrel_ind unless we are an eager guy. 12320 * In the eager case tcp_rsrv will do this when run 12321 * after tcp_accept is done. 12322 */ 12323 ASSERT(tcp->tcp_listener == NULL); 12324 ASSERT(!tcp->tcp_detached); 12325 12326 if (IPCL_IS_NONSTR(connp)) { 12327 ASSERT(tcp->tcp_ordrel_mp == NULL); 12328 tcp->tcp_ordrel_done = B_TRUE; 12329 (*connp->conn_upcalls->su_opctl) 12330 (connp->conn_upper_handle, SOCK_OPCTL_SHUT_RECV, 0); 12331 goto done; 12332 } 12333 12334 if (tcp->tcp_rcv_list != NULL) { 12335 /* 12336 * Push any mblk(s) enqueued from co processing. 12337 */ 12338 flags |= tcp_rcv_drain(tcp); 12339 } 12340 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 12341 12342 mp1 = tcp->tcp_ordrel_mp; 12343 tcp->tcp_ordrel_mp = NULL; 12344 tcp->tcp_ordrel_done = B_TRUE; 12345 putnext(connp->conn_rq, mp1); 12346 } 12347 done: 12348 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 12349 } 12350 12351 /* 12352 * This routine adjusts next-to-send sequence number variables, in the 12353 * case where the reciever has shrunk it's window. 12354 */ 12355 static void 12356 tcp_update_xmit_tail(tcp_t *tcp, uint32_t snxt) 12357 { 12358 mblk_t *xmit_tail; 12359 int32_t offset; 12360 12361 tcp->tcp_snxt = snxt; 12362 12363 /* Get the mblk, and the offset in it, as per the shrunk window */ 12364 xmit_tail = tcp_get_seg_mp(tcp, snxt, &offset); 12365 ASSERT(xmit_tail != NULL); 12366 tcp->tcp_xmit_tail = xmit_tail; 12367 tcp->tcp_xmit_tail_unsent = xmit_tail->b_wptr - 12368 xmit_tail->b_rptr - offset; 12369 } 12370 12371 /* 12372 * This function does PAWS protection check. Returns B_TRUE if the 12373 * segment passes the PAWS test, else returns B_FALSE. 12374 */ 12375 boolean_t 12376 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp) 12377 { 12378 uint8_t flags; 12379 int options; 12380 uint8_t *up; 12381 conn_t *connp = tcp->tcp_connp; 12382 12383 flags = (unsigned int)tcpha->tha_flags & 0xFF; 12384 /* 12385 * If timestamp option is aligned nicely, get values inline, 12386 * otherwise call general routine to parse. Only do that 12387 * if timestamp is the only option. 12388 */ 12389 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH + 12390 TCPOPT_REAL_TS_LEN && 12391 OK_32PTR((up = ((uint8_t *)tcpha) + 12392 TCP_MIN_HEADER_LENGTH)) && 12393 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 12394 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 12395 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 12396 12397 options = TCP_OPT_TSTAMP_PRESENT; 12398 } else { 12399 if (tcp->tcp_snd_sack_ok) { 12400 tcpoptp->tcp = tcp; 12401 } else { 12402 tcpoptp->tcp = NULL; 12403 } 12404 options = tcp_parse_options(tcpha, tcpoptp); 12405 } 12406 12407 if (options & TCP_OPT_TSTAMP_PRESENT) { 12408 /* 12409 * Do PAWS per RFC 1323 section 4.2. Accept RST 12410 * regardless of the timestamp, page 18 RFC 1323.bis. 12411 */ 12412 if ((flags & TH_RST) == 0 && 12413 TSTMP_LT(tcpoptp->tcp_opt_ts_val, 12414 tcp->tcp_ts_recent)) { 12415 if (TSTMP_LT(LBOLT_FASTPATH, 12416 tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) { 12417 /* This segment is not acceptable. */ 12418 return (B_FALSE); 12419 } else { 12420 /* 12421 * Connection has been idle for 12422 * too long. Reset the timestamp 12423 * and assume the segment is valid. 12424 */ 12425 tcp->tcp_ts_recent = 12426 tcpoptp->tcp_opt_ts_val; 12427 } 12428 } 12429 } else { 12430 /* 12431 * If we don't get a timestamp on every packet, we 12432 * figure we can't really trust 'em, so we stop sending 12433 * and parsing them. 12434 */ 12435 tcp->tcp_snd_ts_ok = B_FALSE; 12436 12437 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN; 12438 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN; 12439 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4); 12440 /* 12441 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid 12442 * doing a slow start here so as to not to lose on the 12443 * transfer rate built up so far. 12444 */ 12445 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN); 12446 if (tcp->tcp_snd_sack_ok) { 12447 ASSERT(tcp->tcp_sack_info != NULL); 12448 tcp->tcp_max_sack_blk = 4; 12449 } 12450 } 12451 return (B_TRUE); 12452 } 12453 12454 /* 12455 * Attach ancillary data to a received TCP segments for the 12456 * ancillary pieces requested by the application that are 12457 * different than they were in the previous data segment. 12458 * 12459 * Save the "current" values once memory allocation is ok so that 12460 * when memory allocation fails we can just wait for the next data segment. 12461 */ 12462 static mblk_t * 12463 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp, 12464 ip_recv_attr_t *ira) 12465 { 12466 struct T_optdata_ind *todi; 12467 int optlen; 12468 uchar_t *optptr; 12469 struct T_opthdr *toh; 12470 crb_t addflag; /* Which pieces to add */ 12471 mblk_t *mp1; 12472 conn_t *connp = tcp->tcp_connp; 12473 12474 optlen = 0; 12475 addflag.crb_all = 0; 12476 /* If app asked for pktinfo and the index has changed ... */ 12477 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo && 12478 ira->ira_ruifindex != tcp->tcp_recvifindex) { 12479 optlen += sizeof (struct T_opthdr) + 12480 sizeof (struct in6_pktinfo); 12481 addflag.crb_ip_recvpktinfo = 1; 12482 } 12483 /* If app asked for hoplimit and it has changed ... */ 12484 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit && 12485 ipp->ipp_hoplimit != tcp->tcp_recvhops) { 12486 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 12487 addflag.crb_ipv6_recvhoplimit = 1; 12488 } 12489 /* If app asked for tclass and it has changed ... */ 12490 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass && 12491 ipp->ipp_tclass != tcp->tcp_recvtclass) { 12492 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 12493 addflag.crb_ipv6_recvtclass = 1; 12494 } 12495 /* 12496 * If app asked for hopbyhop headers and it has changed ... 12497 * For security labels, note that (1) security labels can't change on 12498 * a connected socket at all, (2) we're connected to at most one peer, 12499 * (3) if anything changes, then it must be some other extra option. 12500 */ 12501 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts && 12502 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 12503 (ipp->ipp_fields & IPPF_HOPOPTS), 12504 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 12505 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen; 12506 addflag.crb_ipv6_recvhopopts = 1; 12507 if (!ip_allocbuf((void **)&tcp->tcp_hopopts, 12508 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), 12509 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 12510 return (mp); 12511 } 12512 /* If app asked for dst headers before routing headers ... */ 12513 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts && 12514 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen, 12515 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 12516 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) { 12517 optlen += sizeof (struct T_opthdr) + 12518 ipp->ipp_rthdrdstoptslen; 12519 addflag.crb_ipv6_recvrthdrdstopts = 1; 12520 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts, 12521 &tcp->tcp_rthdrdstoptslen, 12522 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 12523 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) 12524 return (mp); 12525 } 12526 /* If app asked for routing headers and it has changed ... */ 12527 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr && 12528 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 12529 (ipp->ipp_fields & IPPF_RTHDR), 12530 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 12531 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 12532 addflag.crb_ipv6_recvrthdr = 1; 12533 if (!ip_allocbuf((void **)&tcp->tcp_rthdr, 12534 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), 12535 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 12536 return (mp); 12537 } 12538 /* If app asked for dest headers and it has changed ... */ 12539 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts || 12540 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) && 12541 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 12542 (ipp->ipp_fields & IPPF_DSTOPTS), 12543 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 12544 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 12545 addflag.crb_ipv6_recvdstopts = 1; 12546 if (!ip_allocbuf((void **)&tcp->tcp_dstopts, 12547 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), 12548 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 12549 return (mp); 12550 } 12551 12552 if (optlen == 0) { 12553 /* Nothing to add */ 12554 return (mp); 12555 } 12556 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 12557 if (mp1 == NULL) { 12558 /* 12559 * Defer sending ancillary data until the next TCP segment 12560 * arrives. 12561 */ 12562 return (mp); 12563 } 12564 mp1->b_cont = mp; 12565 mp = mp1; 12566 mp->b_wptr += sizeof (*todi) + optlen; 12567 mp->b_datap->db_type = M_PROTO; 12568 todi = (struct T_optdata_ind *)mp->b_rptr; 12569 todi->PRIM_type = T_OPTDATA_IND; 12570 todi->DATA_flag = 1; /* MORE data */ 12571 todi->OPT_length = optlen; 12572 todi->OPT_offset = sizeof (*todi); 12573 optptr = (uchar_t *)&todi[1]; 12574 /* 12575 * If app asked for pktinfo and the index has changed ... 12576 * Note that the local address never changes for the connection. 12577 */ 12578 if (addflag.crb_ip_recvpktinfo) { 12579 struct in6_pktinfo *pkti; 12580 uint_t ifindex; 12581 12582 ifindex = ira->ira_ruifindex; 12583 toh = (struct T_opthdr *)optptr; 12584 toh->level = IPPROTO_IPV6; 12585 toh->name = IPV6_PKTINFO; 12586 toh->len = sizeof (*toh) + sizeof (*pkti); 12587 toh->status = 0; 12588 optptr += sizeof (*toh); 12589 pkti = (struct in6_pktinfo *)optptr; 12590 pkti->ipi6_addr = connp->conn_laddr_v6; 12591 pkti->ipi6_ifindex = ifindex; 12592 optptr += sizeof (*pkti); 12593 ASSERT(OK_32PTR(optptr)); 12594 /* Save as "last" value */ 12595 tcp->tcp_recvifindex = ifindex; 12596 } 12597 /* If app asked for hoplimit and it has changed ... */ 12598 if (addflag.crb_ipv6_recvhoplimit) { 12599 toh = (struct T_opthdr *)optptr; 12600 toh->level = IPPROTO_IPV6; 12601 toh->name = IPV6_HOPLIMIT; 12602 toh->len = sizeof (*toh) + sizeof (uint_t); 12603 toh->status = 0; 12604 optptr += sizeof (*toh); 12605 *(uint_t *)optptr = ipp->ipp_hoplimit; 12606 optptr += sizeof (uint_t); 12607 ASSERT(OK_32PTR(optptr)); 12608 /* Save as "last" value */ 12609 tcp->tcp_recvhops = ipp->ipp_hoplimit; 12610 } 12611 /* If app asked for tclass and it has changed ... */ 12612 if (addflag.crb_ipv6_recvtclass) { 12613 toh = (struct T_opthdr *)optptr; 12614 toh->level = IPPROTO_IPV6; 12615 toh->name = IPV6_TCLASS; 12616 toh->len = sizeof (*toh) + sizeof (uint_t); 12617 toh->status = 0; 12618 optptr += sizeof (*toh); 12619 *(uint_t *)optptr = ipp->ipp_tclass; 12620 optptr += sizeof (uint_t); 12621 ASSERT(OK_32PTR(optptr)); 12622 /* Save as "last" value */ 12623 tcp->tcp_recvtclass = ipp->ipp_tclass; 12624 } 12625 if (addflag.crb_ipv6_recvhopopts) { 12626 toh = (struct T_opthdr *)optptr; 12627 toh->level = IPPROTO_IPV6; 12628 toh->name = IPV6_HOPOPTS; 12629 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen; 12630 toh->status = 0; 12631 optptr += sizeof (*toh); 12632 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 12633 optptr += ipp->ipp_hopoptslen; 12634 ASSERT(OK_32PTR(optptr)); 12635 /* Save as last value */ 12636 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, 12637 (ipp->ipp_fields & IPPF_HOPOPTS), 12638 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 12639 } 12640 if (addflag.crb_ipv6_recvrthdrdstopts) { 12641 toh = (struct T_opthdr *)optptr; 12642 toh->level = IPPROTO_IPV6; 12643 toh->name = IPV6_RTHDRDSTOPTS; 12644 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen; 12645 toh->status = 0; 12646 optptr += sizeof (*toh); 12647 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen); 12648 optptr += ipp->ipp_rthdrdstoptslen; 12649 ASSERT(OK_32PTR(optptr)); 12650 /* Save as last value */ 12651 ip_savebuf((void **)&tcp->tcp_rthdrdstopts, 12652 &tcp->tcp_rthdrdstoptslen, 12653 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 12654 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen); 12655 } 12656 if (addflag.crb_ipv6_recvrthdr) { 12657 toh = (struct T_opthdr *)optptr; 12658 toh->level = IPPROTO_IPV6; 12659 toh->name = IPV6_RTHDR; 12660 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 12661 toh->status = 0; 12662 optptr += sizeof (*toh); 12663 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 12664 optptr += ipp->ipp_rthdrlen; 12665 ASSERT(OK_32PTR(optptr)); 12666 /* Save as last value */ 12667 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, 12668 (ipp->ipp_fields & IPPF_RTHDR), 12669 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 12670 } 12671 if (addflag.crb_ipv6_recvdstopts) { 12672 toh = (struct T_opthdr *)optptr; 12673 toh->level = IPPROTO_IPV6; 12674 toh->name = IPV6_DSTOPTS; 12675 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 12676 toh->status = 0; 12677 optptr += sizeof (*toh); 12678 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 12679 optptr += ipp->ipp_dstoptslen; 12680 ASSERT(OK_32PTR(optptr)); 12681 /* Save as last value */ 12682 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, 12683 (ipp->ipp_fields & IPPF_DSTOPTS), 12684 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 12685 } 12686 ASSERT(optptr == mp->b_wptr); 12687 return (mp); 12688 } 12689 12690 /* ARGSUSED */ 12691 static void 12692 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 12693 { 12694 conn_t *connp = (conn_t *)arg; 12695 tcp_t *tcp = connp->conn_tcp; 12696 queue_t *q = connp->conn_rq; 12697 tcp_stack_t *tcps = tcp->tcp_tcps; 12698 12699 ASSERT(!IPCL_IS_NONSTR(connp)); 12700 mutex_enter(&tcp->tcp_rsrv_mp_lock); 12701 tcp->tcp_rsrv_mp = mp; 12702 mutex_exit(&tcp->tcp_rsrv_mp_lock); 12703 12704 TCP_STAT(tcps, tcp_rsrv_calls); 12705 12706 if (TCP_IS_DETACHED(tcp) || q == NULL) { 12707 return; 12708 } 12709 12710 if (tcp->tcp_fused) { 12711 tcp_fuse_backenable(tcp); 12712 return; 12713 } 12714 12715 if (canputnext(q)) { 12716 /* Not flow-controlled, open rwnd */ 12717 tcp->tcp_rwnd = connp->conn_rcvbuf; 12718 12719 /* 12720 * Send back a window update immediately if TCP is above 12721 * ESTABLISHED state and the increase of the rcv window 12722 * that the other side knows is at least 1 MSS after flow 12723 * control is lifted. 12724 */ 12725 if (tcp->tcp_state >= TCPS_ESTABLISHED && 12726 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 12727 tcp_xmit_ctl(NULL, tcp, 12728 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 12729 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 12730 } 12731 } 12732 } 12733 12734 /* 12735 * The read side service routine is called mostly when we get back-enabled as a 12736 * result of flow control relief. Since we don't actually queue anything in 12737 * TCP, we have no data to send out of here. What we do is clear the receive 12738 * window, and send out a window update. 12739 */ 12740 static void 12741 tcp_rsrv(queue_t *q) 12742 { 12743 conn_t *connp = Q_TO_CONN(q); 12744 tcp_t *tcp = connp->conn_tcp; 12745 mblk_t *mp; 12746 12747 /* No code does a putq on the read side */ 12748 ASSERT(q->q_first == NULL); 12749 12750 /* 12751 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already 12752 * been run. So just return. 12753 */ 12754 mutex_enter(&tcp->tcp_rsrv_mp_lock); 12755 if ((mp = tcp->tcp_rsrv_mp) == NULL) { 12756 mutex_exit(&tcp->tcp_rsrv_mp_lock); 12757 return; 12758 } 12759 tcp->tcp_rsrv_mp = NULL; 12760 mutex_exit(&tcp->tcp_rsrv_mp_lock); 12761 12762 CONN_INC_REF(connp); 12763 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp, 12764 NULL, SQ_PROCESS, SQTAG_TCP_RSRV); 12765 } 12766 12767 /* 12768 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 12769 * We do not allow the receive window to shrink. After setting rwnd, 12770 * set the flow control hiwat of the stream. 12771 * 12772 * This function is called in 2 cases: 12773 * 12774 * 1) Before data transfer begins, in tcp_input_listener() for accepting a 12775 * connection (passive open) and in tcp_input_data() for active connect. 12776 * This is called after tcp_mss_set() when the desired MSS value is known. 12777 * This makes sure that our window size is a mutiple of the other side's 12778 * MSS. 12779 * 2) Handling SO_RCVBUF option. 12780 * 12781 * It is ASSUMED that the requested size is a multiple of the current MSS. 12782 * 12783 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 12784 * user requests so. 12785 */ 12786 int 12787 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 12788 { 12789 uint32_t mss = tcp->tcp_mss; 12790 uint32_t old_max_rwnd; 12791 uint32_t max_transmittable_rwnd; 12792 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 12793 tcp_stack_t *tcps = tcp->tcp_tcps; 12794 conn_t *connp = tcp->tcp_connp; 12795 12796 /* 12797 * Insist on a receive window that is at least 12798 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 12799 * funny TCP interactions of Nagle algorithm, SWS avoidance 12800 * and delayed acknowledgement. 12801 */ 12802 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); 12803 12804 if (tcp->tcp_fused) { 12805 size_t sth_hiwat; 12806 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 12807 12808 ASSERT(peer_tcp != NULL); 12809 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 12810 if (!tcp_detached) { 12811 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 12812 sth_hiwat); 12813 tcp_set_recv_threshold(tcp, sth_hiwat >> 3); 12814 } 12815 12816 /* 12817 * In the fusion case, the maxpsz stream head value of 12818 * our peer is set according to its send buffer size 12819 * and our receive buffer size; since the latter may 12820 * have changed we need to update the peer's maxpsz. 12821 */ 12822 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 12823 return (sth_hiwat); 12824 } 12825 12826 if (tcp_detached) 12827 old_max_rwnd = tcp->tcp_rwnd; 12828 else 12829 old_max_rwnd = connp->conn_rcvbuf; 12830 12831 12832 /* 12833 * If window size info has already been exchanged, TCP should not 12834 * shrink the window. Shrinking window is doable if done carefully. 12835 * We may add that support later. But so far there is not a real 12836 * need to do that. 12837 */ 12838 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 12839 /* MSS may have changed, do a round up again. */ 12840 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 12841 } 12842 12843 /* 12844 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 12845 * can be applied even before the window scale option is decided. 12846 */ 12847 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 12848 if (rwnd > max_transmittable_rwnd) { 12849 rwnd = max_transmittable_rwnd - 12850 (max_transmittable_rwnd % mss); 12851 if (rwnd < mss) 12852 rwnd = max_transmittable_rwnd; 12853 /* 12854 * If we're over the limit we may have to back down tcp_rwnd. 12855 * The increment below won't work for us. So we set all three 12856 * here and the increment below will have no effect. 12857 */ 12858 tcp->tcp_rwnd = old_max_rwnd = rwnd; 12859 } 12860 if (tcp->tcp_localnet) { 12861 tcp->tcp_rack_abs_max = 12862 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); 12863 } else { 12864 /* 12865 * For a remote host on a different subnet (through a router), 12866 * we ack every other packet to be conforming to RFC1122. 12867 * tcp_deferred_acks_max is default to 2. 12868 */ 12869 tcp->tcp_rack_abs_max = 12870 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); 12871 } 12872 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 12873 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 12874 else 12875 tcp->tcp_rack_cur_max = 0; 12876 /* 12877 * Increment the current rwnd by the amount the maximum grew (we 12878 * can not overwrite it since we might be in the middle of a 12879 * connection.) 12880 */ 12881 tcp->tcp_rwnd += rwnd - old_max_rwnd; 12882 connp->conn_rcvbuf = rwnd; 12883 12884 /* Are we already connected? */ 12885 if (tcp->tcp_tcpha != NULL) { 12886 tcp->tcp_tcpha->tha_win = 12887 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 12888 } 12889 12890 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 12891 tcp->tcp_cwnd_max = rwnd; 12892 12893 if (tcp_detached) 12894 return (rwnd); 12895 12896 tcp_set_recv_threshold(tcp, rwnd >> 3); 12897 12898 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd); 12899 return (rwnd); 12900 } 12901 12902 /* 12903 * Return SNMP stuff in buffer in mpdata. 12904 */ 12905 mblk_t * 12906 tcp_snmp_get(queue_t *q, mblk_t *mpctl) 12907 { 12908 mblk_t *mpdata; 12909 mblk_t *mp_conn_ctl = NULL; 12910 mblk_t *mp_conn_tail; 12911 mblk_t *mp_attr_ctl = NULL; 12912 mblk_t *mp_attr_tail; 12913 mblk_t *mp6_conn_ctl = NULL; 12914 mblk_t *mp6_conn_tail; 12915 mblk_t *mp6_attr_ctl = NULL; 12916 mblk_t *mp6_attr_tail; 12917 struct opthdr *optp; 12918 mib2_tcpConnEntry_t tce; 12919 mib2_tcp6ConnEntry_t tce6; 12920 mib2_transportMLPEntry_t mlp; 12921 connf_t *connfp; 12922 int i; 12923 boolean_t ispriv; 12924 zoneid_t zoneid; 12925 int v4_conn_idx; 12926 int v6_conn_idx; 12927 conn_t *connp = Q_TO_CONN(q); 12928 tcp_stack_t *tcps; 12929 ip_stack_t *ipst; 12930 mblk_t *mp2ctl; 12931 12932 /* 12933 * make a copy of the original message 12934 */ 12935 mp2ctl = copymsg(mpctl); 12936 12937 if (mpctl == NULL || 12938 (mpdata = mpctl->b_cont) == NULL || 12939 (mp_conn_ctl = copymsg(mpctl)) == NULL || 12940 (mp_attr_ctl = copymsg(mpctl)) == NULL || 12941 (mp6_conn_ctl = copymsg(mpctl)) == NULL || 12942 (mp6_attr_ctl = copymsg(mpctl)) == NULL) { 12943 freemsg(mp_conn_ctl); 12944 freemsg(mp_attr_ctl); 12945 freemsg(mp6_conn_ctl); 12946 freemsg(mp6_attr_ctl); 12947 freemsg(mpctl); 12948 freemsg(mp2ctl); 12949 return (NULL); 12950 } 12951 12952 ipst = connp->conn_netstack->netstack_ip; 12953 tcps = connp->conn_netstack->netstack_tcp; 12954 12955 /* build table of connections -- need count in fixed part */ 12956 SET_MIB(tcps->tcps_mib.tcpRtoAlgorithm, 4); /* vanj */ 12957 SET_MIB(tcps->tcps_mib.tcpRtoMin, tcps->tcps_rexmit_interval_min); 12958 SET_MIB(tcps->tcps_mib.tcpRtoMax, tcps->tcps_rexmit_interval_max); 12959 SET_MIB(tcps->tcps_mib.tcpMaxConn, -1); 12960 SET_MIB(tcps->tcps_mib.tcpCurrEstab, 0); 12961 12962 ispriv = 12963 secpolicy_ip_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0; 12964 zoneid = Q_TO_CONN(q)->conn_zoneid; 12965 12966 v4_conn_idx = v6_conn_idx = 0; 12967 mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL; 12968 12969 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 12970 ipst = tcps->tcps_netstack->netstack_ip; 12971 12972 connfp = &ipst->ips_ipcl_globalhash_fanout[i]; 12973 12974 connp = NULL; 12975 12976 while ((connp = 12977 ipcl_get_next_conn(connfp, connp, IPCL_TCPCONN)) != NULL) { 12978 tcp_t *tcp; 12979 boolean_t needattr; 12980 12981 if (connp->conn_zoneid != zoneid) 12982 continue; /* not in this zone */ 12983 12984 tcp = connp->conn_tcp; 12985 UPDATE_MIB(&tcps->tcps_mib, 12986 tcpHCInSegs, tcp->tcp_ibsegs); 12987 tcp->tcp_ibsegs = 0; 12988 UPDATE_MIB(&tcps->tcps_mib, 12989 tcpHCOutSegs, tcp->tcp_obsegs); 12990 tcp->tcp_obsegs = 0; 12991 12992 tce6.tcp6ConnState = tce.tcpConnState = 12993 tcp_snmp_state(tcp); 12994 if (tce.tcpConnState == MIB2_TCP_established || 12995 tce.tcpConnState == MIB2_TCP_closeWait) 12996 BUMP_MIB(&tcps->tcps_mib, tcpCurrEstab); 12997 12998 needattr = B_FALSE; 12999 bzero(&mlp, sizeof (mlp)); 13000 if (connp->conn_mlp_type != mlptSingle) { 13001 if (connp->conn_mlp_type == mlptShared || 13002 connp->conn_mlp_type == mlptBoth) 13003 mlp.tme_flags |= MIB2_TMEF_SHARED; 13004 if (connp->conn_mlp_type == mlptPrivate || 13005 connp->conn_mlp_type == mlptBoth) 13006 mlp.tme_flags |= MIB2_TMEF_PRIVATE; 13007 needattr = B_TRUE; 13008 } 13009 if (connp->conn_anon_mlp) { 13010 mlp.tme_flags |= MIB2_TMEF_ANONMLP; 13011 needattr = B_TRUE; 13012 } 13013 switch (connp->conn_mac_mode) { 13014 case CONN_MAC_DEFAULT: 13015 break; 13016 case CONN_MAC_AWARE: 13017 mlp.tme_flags |= MIB2_TMEF_MACEXEMPT; 13018 needattr = B_TRUE; 13019 break; 13020 case CONN_MAC_IMPLICIT: 13021 mlp.tme_flags |= MIB2_TMEF_MACIMPLICIT; 13022 needattr = B_TRUE; 13023 break; 13024 } 13025 if (connp->conn_ixa->ixa_tsl != NULL) { 13026 ts_label_t *tsl; 13027 13028 tsl = connp->conn_ixa->ixa_tsl; 13029 mlp.tme_flags |= MIB2_TMEF_IS_LABELED; 13030 mlp.tme_doi = label2doi(tsl); 13031 mlp.tme_label = *label2bslabel(tsl); 13032 needattr = B_TRUE; 13033 } 13034 13035 /* Create a message to report on IPv6 entries */ 13036 if (connp->conn_ipversion == IPV6_VERSION) { 13037 tce6.tcp6ConnLocalAddress = connp->conn_laddr_v6; 13038 tce6.tcp6ConnRemAddress = connp->conn_faddr_v6; 13039 tce6.tcp6ConnLocalPort = ntohs(connp->conn_lport); 13040 tce6.tcp6ConnRemPort = ntohs(connp->conn_fport); 13041 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) { 13042 tce6.tcp6ConnIfIndex = 13043 connp->conn_ixa->ixa_scopeid; 13044 } else { 13045 tce6.tcp6ConnIfIndex = connp->conn_bound_if; 13046 } 13047 /* Don't want just anybody seeing these... */ 13048 if (ispriv) { 13049 tce6.tcp6ConnEntryInfo.ce_snxt = 13050 tcp->tcp_snxt; 13051 tce6.tcp6ConnEntryInfo.ce_suna = 13052 tcp->tcp_suna; 13053 tce6.tcp6ConnEntryInfo.ce_rnxt = 13054 tcp->tcp_rnxt; 13055 tce6.tcp6ConnEntryInfo.ce_rack = 13056 tcp->tcp_rack; 13057 } else { 13058 /* 13059 * Netstat, unfortunately, uses this to 13060 * get send/receive queue sizes. How to fix? 13061 * Why not compute the difference only? 13062 */ 13063 tce6.tcp6ConnEntryInfo.ce_snxt = 13064 tcp->tcp_snxt - tcp->tcp_suna; 13065 tce6.tcp6ConnEntryInfo.ce_suna = 0; 13066 tce6.tcp6ConnEntryInfo.ce_rnxt = 13067 tcp->tcp_rnxt - tcp->tcp_rack; 13068 tce6.tcp6ConnEntryInfo.ce_rack = 0; 13069 } 13070 13071 tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd; 13072 tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 13073 tce6.tcp6ConnEntryInfo.ce_rto = tcp->tcp_rto; 13074 tce6.tcp6ConnEntryInfo.ce_mss = tcp->tcp_mss; 13075 tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state; 13076 13077 tce6.tcp6ConnCreationProcess = 13078 (connp->conn_cpid < 0) ? MIB2_UNKNOWN_PROCESS : 13079 connp->conn_cpid; 13080 tce6.tcp6ConnCreationTime = connp->conn_open_time; 13081 13082 (void) snmp_append_data2(mp6_conn_ctl->b_cont, 13083 &mp6_conn_tail, (char *)&tce6, sizeof (tce6)); 13084 13085 mlp.tme_connidx = v6_conn_idx++; 13086 if (needattr) 13087 (void) snmp_append_data2(mp6_attr_ctl->b_cont, 13088 &mp6_attr_tail, (char *)&mlp, sizeof (mlp)); 13089 } 13090 /* 13091 * Create an IPv4 table entry for IPv4 entries and also 13092 * for IPv6 entries which are bound to in6addr_any 13093 * but don't have IPV6_V6ONLY set. 13094 * (i.e. anything an IPv4 peer could connect to) 13095 */ 13096 if (connp->conn_ipversion == IPV4_VERSION || 13097 (tcp->tcp_state <= TCPS_LISTEN && 13098 !connp->conn_ipv6_v6only && 13099 IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6))) { 13100 if (connp->conn_ipversion == IPV6_VERSION) { 13101 tce.tcpConnRemAddress = INADDR_ANY; 13102 tce.tcpConnLocalAddress = INADDR_ANY; 13103 } else { 13104 tce.tcpConnRemAddress = 13105 connp->conn_faddr_v4; 13106 tce.tcpConnLocalAddress = 13107 connp->conn_laddr_v4; 13108 } 13109 tce.tcpConnLocalPort = ntohs(connp->conn_lport); 13110 tce.tcpConnRemPort = ntohs(connp->conn_fport); 13111 /* Don't want just anybody seeing these... */ 13112 if (ispriv) { 13113 tce.tcpConnEntryInfo.ce_snxt = 13114 tcp->tcp_snxt; 13115 tce.tcpConnEntryInfo.ce_suna = 13116 tcp->tcp_suna; 13117 tce.tcpConnEntryInfo.ce_rnxt = 13118 tcp->tcp_rnxt; 13119 tce.tcpConnEntryInfo.ce_rack = 13120 tcp->tcp_rack; 13121 } else { 13122 /* 13123 * Netstat, unfortunately, uses this to 13124 * get send/receive queue sizes. How 13125 * to fix? 13126 * Why not compute the difference only? 13127 */ 13128 tce.tcpConnEntryInfo.ce_snxt = 13129 tcp->tcp_snxt - tcp->tcp_suna; 13130 tce.tcpConnEntryInfo.ce_suna = 0; 13131 tce.tcpConnEntryInfo.ce_rnxt = 13132 tcp->tcp_rnxt - tcp->tcp_rack; 13133 tce.tcpConnEntryInfo.ce_rack = 0; 13134 } 13135 13136 tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd; 13137 tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 13138 tce.tcpConnEntryInfo.ce_rto = tcp->tcp_rto; 13139 tce.tcpConnEntryInfo.ce_mss = tcp->tcp_mss; 13140 tce.tcpConnEntryInfo.ce_state = 13141 tcp->tcp_state; 13142 13143 tce.tcpConnCreationProcess = 13144 (connp->conn_cpid < 0) ? 13145 MIB2_UNKNOWN_PROCESS : 13146 connp->conn_cpid; 13147 tce.tcpConnCreationTime = connp->conn_open_time; 13148 13149 (void) snmp_append_data2(mp_conn_ctl->b_cont, 13150 &mp_conn_tail, (char *)&tce, sizeof (tce)); 13151 13152 mlp.tme_connidx = v4_conn_idx++; 13153 if (needattr) 13154 (void) snmp_append_data2( 13155 mp_attr_ctl->b_cont, 13156 &mp_attr_tail, (char *)&mlp, 13157 sizeof (mlp)); 13158 } 13159 } 13160 } 13161 13162 /* fixed length structure for IPv4 and IPv6 counters */ 13163 SET_MIB(tcps->tcps_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t)); 13164 SET_MIB(tcps->tcps_mib.tcp6ConnTableSize, 13165 sizeof (mib2_tcp6ConnEntry_t)); 13166 /* synchronize 32- and 64-bit counters */ 13167 SYNC32_MIB(&tcps->tcps_mib, tcpInSegs, tcpHCInSegs); 13168 SYNC32_MIB(&tcps->tcps_mib, tcpOutSegs, tcpHCOutSegs); 13169 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 13170 optp->level = MIB2_TCP; 13171 optp->name = 0; 13172 (void) snmp_append_data(mpdata, (char *)&tcps->tcps_mib, 13173 sizeof (tcps->tcps_mib)); 13174 optp->len = msgdsize(mpdata); 13175 qreply(q, mpctl); 13176 13177 /* table of connections... */ 13178 optp = (struct opthdr *)&mp_conn_ctl->b_rptr[ 13179 sizeof (struct T_optmgmt_ack)]; 13180 optp->level = MIB2_TCP; 13181 optp->name = MIB2_TCP_CONN; 13182 optp->len = msgdsize(mp_conn_ctl->b_cont); 13183 qreply(q, mp_conn_ctl); 13184 13185 /* table of MLP attributes... */ 13186 optp = (struct opthdr *)&mp_attr_ctl->b_rptr[ 13187 sizeof (struct T_optmgmt_ack)]; 13188 optp->level = MIB2_TCP; 13189 optp->name = EXPER_XPORT_MLP; 13190 optp->len = msgdsize(mp_attr_ctl->b_cont); 13191 if (optp->len == 0) 13192 freemsg(mp_attr_ctl); 13193 else 13194 qreply(q, mp_attr_ctl); 13195 13196 /* table of IPv6 connections... */ 13197 optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[ 13198 sizeof (struct T_optmgmt_ack)]; 13199 optp->level = MIB2_TCP6; 13200 optp->name = MIB2_TCP6_CONN; 13201 optp->len = msgdsize(mp6_conn_ctl->b_cont); 13202 qreply(q, mp6_conn_ctl); 13203 13204 /* table of IPv6 MLP attributes... */ 13205 optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[ 13206 sizeof (struct T_optmgmt_ack)]; 13207 optp->level = MIB2_TCP6; 13208 optp->name = EXPER_XPORT_MLP; 13209 optp->len = msgdsize(mp6_attr_ctl->b_cont); 13210 if (optp->len == 0) 13211 freemsg(mp6_attr_ctl); 13212 else 13213 qreply(q, mp6_attr_ctl); 13214 return (mp2ctl); 13215 } 13216 13217 /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests */ 13218 /* ARGSUSED */ 13219 int 13220 tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 13221 { 13222 mib2_tcpConnEntry_t *tce = (mib2_tcpConnEntry_t *)ptr; 13223 13224 switch (level) { 13225 case MIB2_TCP: 13226 switch (name) { 13227 case 13: 13228 if (tce->tcpConnState != MIB2_TCP_deleteTCB) 13229 return (0); 13230 /* TODO: delete entry defined by tce */ 13231 return (1); 13232 default: 13233 return (0); 13234 } 13235 default: 13236 return (1); 13237 } 13238 } 13239 13240 /* Translate TCP state to MIB2 TCP state. */ 13241 static int 13242 tcp_snmp_state(tcp_t *tcp) 13243 { 13244 if (tcp == NULL) 13245 return (0); 13246 13247 switch (tcp->tcp_state) { 13248 case TCPS_CLOSED: 13249 case TCPS_IDLE: /* RFC1213 doesn't have analogue for IDLE & BOUND */ 13250 case TCPS_BOUND: 13251 return (MIB2_TCP_closed); 13252 case TCPS_LISTEN: 13253 return (MIB2_TCP_listen); 13254 case TCPS_SYN_SENT: 13255 return (MIB2_TCP_synSent); 13256 case TCPS_SYN_RCVD: 13257 return (MIB2_TCP_synReceived); 13258 case TCPS_ESTABLISHED: 13259 return (MIB2_TCP_established); 13260 case TCPS_CLOSE_WAIT: 13261 return (MIB2_TCP_closeWait); 13262 case TCPS_FIN_WAIT_1: 13263 return (MIB2_TCP_finWait1); 13264 case TCPS_CLOSING: 13265 return (MIB2_TCP_closing); 13266 case TCPS_LAST_ACK: 13267 return (MIB2_TCP_lastAck); 13268 case TCPS_FIN_WAIT_2: 13269 return (MIB2_TCP_finWait2); 13270 case TCPS_TIME_WAIT: 13271 return (MIB2_TCP_timeWait); 13272 default: 13273 return (0); 13274 } 13275 } 13276 13277 /* 13278 * tcp_timer is the timer service routine. It handles the retransmission, 13279 * FIN_WAIT_2 flush, and zero window probe timeout events. It figures out 13280 * from the state of the tcp instance what kind of action needs to be done 13281 * at the time it is called. 13282 */ 13283 static void 13284 tcp_timer(void *arg) 13285 { 13286 mblk_t *mp; 13287 clock_t first_threshold; 13288 clock_t second_threshold; 13289 clock_t ms; 13290 uint32_t mss; 13291 conn_t *connp = (conn_t *)arg; 13292 tcp_t *tcp = connp->conn_tcp; 13293 tcp_stack_t *tcps = tcp->tcp_tcps; 13294 13295 tcp->tcp_timer_tid = 0; 13296 13297 if (tcp->tcp_fused) 13298 return; 13299 13300 first_threshold = tcp->tcp_first_timer_threshold; 13301 second_threshold = tcp->tcp_second_timer_threshold; 13302 switch (tcp->tcp_state) { 13303 case TCPS_IDLE: 13304 case TCPS_BOUND: 13305 case TCPS_LISTEN: 13306 return; 13307 case TCPS_SYN_RCVD: { 13308 tcp_t *listener = tcp->tcp_listener; 13309 13310 if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) { 13311 /* it's our first timeout */ 13312 tcp->tcp_syn_rcvd_timeout = 1; 13313 mutex_enter(&listener->tcp_eager_lock); 13314 listener->tcp_syn_rcvd_timeout++; 13315 if (!tcp->tcp_dontdrop && !tcp->tcp_closemp_used) { 13316 /* 13317 * Make this eager available for drop if we 13318 * need to drop one to accomodate a new 13319 * incoming SYN request. 13320 */ 13321 MAKE_DROPPABLE(listener, tcp); 13322 } 13323 if (!listener->tcp_syn_defense && 13324 (listener->tcp_syn_rcvd_timeout > 13325 (tcps->tcps_conn_req_max_q0 >> 2)) && 13326 (tcps->tcps_conn_req_max_q0 > 200)) { 13327 /* We may be under attack. Put on a defense. */ 13328 listener->tcp_syn_defense = B_TRUE; 13329 cmn_err(CE_WARN, "High TCP connect timeout " 13330 "rate! System (port %d) may be under a " 13331 "SYN flood attack!", 13332 ntohs(listener->tcp_connp->conn_lport)); 13333 13334 listener->tcp_ip_addr_cache = kmem_zalloc( 13335 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t), 13336 KM_NOSLEEP); 13337 } 13338 mutex_exit(&listener->tcp_eager_lock); 13339 } else if (listener != NULL) { 13340 mutex_enter(&listener->tcp_eager_lock); 13341 tcp->tcp_syn_rcvd_timeout++; 13342 if (tcp->tcp_syn_rcvd_timeout > 1 && 13343 !tcp->tcp_closemp_used) { 13344 /* 13345 * This is our second timeout. Put the tcp in 13346 * the list of droppable eagers to allow it to 13347 * be dropped, if needed. We don't check 13348 * whether tcp_dontdrop is set or not to 13349 * protect ourselve from a SYN attack where a 13350 * remote host can spoof itself as one of the 13351 * good IP source and continue to hold 13352 * resources too long. 13353 */ 13354 MAKE_DROPPABLE(listener, tcp); 13355 } 13356 mutex_exit(&listener->tcp_eager_lock); 13357 } 13358 } 13359 /* FALLTHRU */ 13360 case TCPS_SYN_SENT: 13361 first_threshold = tcp->tcp_first_ctimer_threshold; 13362 second_threshold = tcp->tcp_second_ctimer_threshold; 13363 break; 13364 case TCPS_ESTABLISHED: 13365 case TCPS_FIN_WAIT_1: 13366 case TCPS_CLOSING: 13367 case TCPS_CLOSE_WAIT: 13368 case TCPS_LAST_ACK: 13369 /* If we have data to rexmit */ 13370 if (tcp->tcp_suna != tcp->tcp_snxt) { 13371 clock_t time_to_wait; 13372 13373 BUMP_MIB(&tcps->tcps_mib, tcpTimRetrans); 13374 if (!tcp->tcp_xmit_head) 13375 break; 13376 time_to_wait = ddi_get_lbolt() - 13377 (clock_t)tcp->tcp_xmit_head->b_prev; 13378 time_to_wait = tcp->tcp_rto - 13379 TICK_TO_MSEC(time_to_wait); 13380 /* 13381 * If the timer fires too early, 1 clock tick earlier, 13382 * restart the timer. 13383 */ 13384 if (time_to_wait > msec_per_tick) { 13385 TCP_STAT(tcps, tcp_timer_fire_early); 13386 TCP_TIMER_RESTART(tcp, time_to_wait); 13387 return; 13388 } 13389 /* 13390 * When we probe zero windows, we force the swnd open. 13391 * If our peer acks with a closed window swnd will be 13392 * set to zero by tcp_rput(). As long as we are 13393 * receiving acks tcp_rput will 13394 * reset 'tcp_ms_we_have_waited' so as not to trip the 13395 * first and second interval actions. NOTE: the timer 13396 * interval is allowed to continue its exponential 13397 * backoff. 13398 */ 13399 if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) { 13400 if (connp->conn_debug) { 13401 (void) strlog(TCP_MOD_ID, 0, 1, 13402 SL_TRACE, "tcp_timer: zero win"); 13403 } 13404 } else { 13405 /* 13406 * After retransmission, we need to do 13407 * slow start. Set the ssthresh to one 13408 * half of current effective window and 13409 * cwnd to one MSS. Also reset 13410 * tcp_cwnd_cnt. 13411 * 13412 * Note that if tcp_ssthresh is reduced because 13413 * of ECN, do not reduce it again unless it is 13414 * already one window of data away (tcp_cwr 13415 * should then be cleared) or this is a 13416 * timeout for a retransmitted segment. 13417 */ 13418 uint32_t npkt; 13419 13420 if (!tcp->tcp_cwr || tcp->tcp_rexmit) { 13421 npkt = ((tcp->tcp_timer_backoff ? 13422 tcp->tcp_cwnd_ssthresh : 13423 tcp->tcp_snxt - 13424 tcp->tcp_suna) >> 1) / tcp->tcp_mss; 13425 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 13426 tcp->tcp_mss; 13427 } 13428 tcp->tcp_cwnd = tcp->tcp_mss; 13429 tcp->tcp_cwnd_cnt = 0; 13430 if (tcp->tcp_ecn_ok) { 13431 tcp->tcp_cwr = B_TRUE; 13432 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 13433 tcp->tcp_ecn_cwr_sent = B_FALSE; 13434 } 13435 } 13436 break; 13437 } 13438 /* 13439 * We have something to send yet we cannot send. The 13440 * reason can be: 13441 * 13442 * 1. Zero send window: we need to do zero window probe. 13443 * 2. Zero cwnd: because of ECN, we need to "clock out 13444 * segments. 13445 * 3. SWS avoidance: receiver may have shrunk window, 13446 * reset our knowledge. 13447 * 13448 * Note that condition 2 can happen with either 1 or 13449 * 3. But 1 and 3 are exclusive. 13450 */ 13451 if (tcp->tcp_unsent != 0) { 13452 /* 13453 * Should not hold the zero-copy messages for too long. 13454 */ 13455 if (tcp->tcp_snd_zcopy_aware && !tcp->tcp_xmit_zc_clean) 13456 tcp->tcp_xmit_head = tcp_zcopy_backoff(tcp, 13457 tcp->tcp_xmit_head, B_TRUE); 13458 13459 if (tcp->tcp_cwnd == 0) { 13460 /* 13461 * Set tcp_cwnd to 1 MSS so that a 13462 * new segment can be sent out. We 13463 * are "clocking out" new data when 13464 * the network is really congested. 13465 */ 13466 ASSERT(tcp->tcp_ecn_ok); 13467 tcp->tcp_cwnd = tcp->tcp_mss; 13468 } 13469 if (tcp->tcp_swnd == 0) { 13470 /* Extend window for zero window probe */ 13471 tcp->tcp_swnd++; 13472 tcp->tcp_zero_win_probe = B_TRUE; 13473 BUMP_MIB(&tcps->tcps_mib, tcpOutWinProbe); 13474 } else { 13475 /* 13476 * Handle timeout from sender SWS avoidance. 13477 * Reset our knowledge of the max send window 13478 * since the receiver might have reduced its 13479 * receive buffer. Avoid setting tcp_max_swnd 13480 * to one since that will essentially disable 13481 * the SWS checks. 13482 * 13483 * Note that since we don't have a SWS 13484 * state variable, if the timeout is set 13485 * for ECN but not for SWS, this 13486 * code will also be executed. This is 13487 * fine as tcp_max_swnd is updated 13488 * constantly and it will not affect 13489 * anything. 13490 */ 13491 tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2); 13492 } 13493 tcp_wput_data(tcp, NULL, B_FALSE); 13494 return; 13495 } 13496 /* Is there a FIN that needs to be to re retransmitted? */ 13497 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 13498 !tcp->tcp_fin_acked) 13499 break; 13500 /* Nothing to do, return without restarting timer. */ 13501 TCP_STAT(tcps, tcp_timer_fire_miss); 13502 return; 13503 case TCPS_FIN_WAIT_2: 13504 /* 13505 * User closed the TCP endpoint and peer ACK'ed our FIN. 13506 * We waited some time for for peer's FIN, but it hasn't 13507 * arrived. We flush the connection now to avoid 13508 * case where the peer has rebooted. 13509 */ 13510 if (TCP_IS_DETACHED(tcp)) { 13511 (void) tcp_clean_death(tcp, 0, 23); 13512 } else { 13513 TCP_TIMER_RESTART(tcp, 13514 tcps->tcps_fin_wait_2_flush_interval); 13515 } 13516 return; 13517 case TCPS_TIME_WAIT: 13518 (void) tcp_clean_death(tcp, 0, 24); 13519 return; 13520 default: 13521 if (connp->conn_debug) { 13522 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 13523 "tcp_timer: strange state (%d) %s", 13524 tcp->tcp_state, tcp_display(tcp, NULL, 13525 DISP_PORT_ONLY)); 13526 } 13527 return; 13528 } 13529 13530 if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) { 13531 /* 13532 * Should not hold the zero-copy messages for too long. 13533 */ 13534 if (tcp->tcp_snd_zcopy_aware && !tcp->tcp_xmit_zc_clean) 13535 tcp->tcp_xmit_head = tcp_zcopy_backoff(tcp, 13536 tcp->tcp_xmit_head, B_TRUE); 13537 13538 /* 13539 * For zero window probe, we need to send indefinitely, 13540 * unless we have not heard from the other side for some 13541 * time... 13542 */ 13543 if ((tcp->tcp_zero_win_probe == 0) || 13544 (TICK_TO_MSEC(ddi_get_lbolt() - tcp->tcp_last_recv_time) > 13545 second_threshold)) { 13546 BUMP_MIB(&tcps->tcps_mib, tcpTimRetransDrop); 13547 /* 13548 * If TCP is in SYN_RCVD state, send back a 13549 * RST|ACK as BSD does. Note that tcp_zero_win_probe 13550 * should be zero in TCPS_SYN_RCVD state. 13551 */ 13552 if (tcp->tcp_state == TCPS_SYN_RCVD) { 13553 tcp_xmit_ctl("tcp_timer: RST sent on timeout " 13554 "in SYN_RCVD", 13555 tcp, tcp->tcp_snxt, 13556 tcp->tcp_rnxt, TH_RST | TH_ACK); 13557 } 13558 (void) tcp_clean_death(tcp, 13559 tcp->tcp_client_errno ? 13560 tcp->tcp_client_errno : ETIMEDOUT, 25); 13561 return; 13562 } else { 13563 /* 13564 * Set tcp_ms_we_have_waited to second_threshold 13565 * so that in next timeout, we will do the above 13566 * check (ddi_get_lbolt() - tcp_last_recv_time). 13567 * This is also to avoid overflow. 13568 * 13569 * We don't need to decrement tcp_timer_backoff 13570 * to avoid overflow because it will be decremented 13571 * later if new timeout value is greater than 13572 * tcp_rexmit_interval_max. In the case when 13573 * tcp_rexmit_interval_max is greater than 13574 * second_threshold, it means that we will wait 13575 * longer than second_threshold to send the next 13576 * window probe. 13577 */ 13578 tcp->tcp_ms_we_have_waited = second_threshold; 13579 } 13580 } else if (ms > first_threshold) { 13581 /* 13582 * Should not hold the zero-copy messages for too long. 13583 */ 13584 if (tcp->tcp_snd_zcopy_aware && !tcp->tcp_xmit_zc_clean) 13585 tcp->tcp_xmit_head = tcp_zcopy_backoff(tcp, 13586 tcp->tcp_xmit_head, B_TRUE); 13587 13588 /* 13589 * We have been retransmitting for too long... The RTT 13590 * we calculated is probably incorrect. Reinitialize it. 13591 * Need to compensate for 0 tcp_rtt_sa. Reset 13592 * tcp_rtt_update so that we won't accidentally cache a 13593 * bad value. But only do this if this is not a zero 13594 * window probe. 13595 */ 13596 if (tcp->tcp_rtt_sa != 0 && tcp->tcp_zero_win_probe == 0) { 13597 tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) + 13598 (tcp->tcp_rtt_sa >> 5); 13599 tcp->tcp_rtt_sa = 0; 13600 tcp_ip_notify(tcp); 13601 tcp->tcp_rtt_update = 0; 13602 } 13603 } 13604 tcp->tcp_timer_backoff++; 13605 if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 13606 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) < 13607 tcps->tcps_rexmit_interval_min) { 13608 /* 13609 * This means the original RTO is tcp_rexmit_interval_min. 13610 * So we will use tcp_rexmit_interval_min as the RTO value 13611 * and do the backoff. 13612 */ 13613 ms = tcps->tcps_rexmit_interval_min << tcp->tcp_timer_backoff; 13614 } else { 13615 ms <<= tcp->tcp_timer_backoff; 13616 } 13617 if (ms > tcps->tcps_rexmit_interval_max) { 13618 ms = tcps->tcps_rexmit_interval_max; 13619 /* 13620 * ms is at max, decrement tcp_timer_backoff to avoid 13621 * overflow. 13622 */ 13623 tcp->tcp_timer_backoff--; 13624 } 13625 tcp->tcp_ms_we_have_waited += ms; 13626 if (tcp->tcp_zero_win_probe == 0) { 13627 tcp->tcp_rto = ms; 13628 } 13629 TCP_TIMER_RESTART(tcp, ms); 13630 /* 13631 * This is after a timeout and tcp_rto is backed off. Set 13632 * tcp_set_timer to 1 so that next time RTO is updated, we will 13633 * restart the timer with a correct value. 13634 */ 13635 tcp->tcp_set_timer = 1; 13636 mss = tcp->tcp_snxt - tcp->tcp_suna; 13637 if (mss > tcp->tcp_mss) 13638 mss = tcp->tcp_mss; 13639 if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0) 13640 mss = tcp->tcp_swnd; 13641 13642 if ((mp = tcp->tcp_xmit_head) != NULL) 13643 mp->b_prev = (mblk_t *)ddi_get_lbolt(); 13644 mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss, 13645 B_TRUE); 13646 13647 /* 13648 * When slow start after retransmission begins, start with 13649 * this seq no. tcp_rexmit_max marks the end of special slow 13650 * start phase. tcp_snd_burst controls how many segments 13651 * can be sent because of an ack. 13652 */ 13653 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 13654 tcp->tcp_snd_burst = TCP_CWND_SS; 13655 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 13656 (tcp->tcp_unsent == 0)) { 13657 tcp->tcp_rexmit_max = tcp->tcp_fss; 13658 } else { 13659 tcp->tcp_rexmit_max = tcp->tcp_snxt; 13660 } 13661 tcp->tcp_rexmit = B_TRUE; 13662 tcp->tcp_dupack_cnt = 0; 13663 13664 /* 13665 * Remove all rexmit SACK blk to start from fresh. 13666 */ 13667 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) 13668 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 13669 if (mp == NULL) { 13670 return; 13671 } 13672 13673 tcp->tcp_csuna = tcp->tcp_snxt; 13674 BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); 13675 UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, mss); 13676 tcp_send_data(tcp, mp); 13677 13678 } 13679 13680 static int 13681 tcp_do_unbind(conn_t *connp) 13682 { 13683 tcp_t *tcp = connp->conn_tcp; 13684 13685 switch (tcp->tcp_state) { 13686 case TCPS_BOUND: 13687 case TCPS_LISTEN: 13688 break; 13689 default: 13690 return (-TOUTSTATE); 13691 } 13692 13693 /* 13694 * Need to clean up all the eagers since after the unbind, segments 13695 * will no longer be delivered to this listener stream. 13696 */ 13697 mutex_enter(&tcp->tcp_eager_lock); 13698 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 13699 tcp_eager_cleanup(tcp, 0); 13700 } 13701 mutex_exit(&tcp->tcp_eager_lock); 13702 13703 connp->conn_laddr_v6 = ipv6_all_zeros; 13704 connp->conn_saddr_v6 = ipv6_all_zeros; 13705 tcp_bind_hash_remove(tcp); 13706 tcp->tcp_state = TCPS_IDLE; 13707 13708 ip_unbind(connp); 13709 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 13710 13711 return (0); 13712 } 13713 13714 /* tcp_unbind is called by tcp_wput_proto to handle T_UNBIND_REQ messages. */ 13715 static void 13716 tcp_tpi_unbind(tcp_t *tcp, mblk_t *mp) 13717 { 13718 conn_t *connp = tcp->tcp_connp; 13719 int error; 13720 13721 error = tcp_do_unbind(connp); 13722 if (error > 0) { 13723 tcp_err_ack(tcp, mp, TSYSERR, error); 13724 } else if (error < 0) { 13725 tcp_err_ack(tcp, mp, -error, 0); 13726 } else { 13727 /* Send M_FLUSH according to TPI */ 13728 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 13729 13730 mp = mi_tpi_ok_ack_alloc(mp); 13731 if (mp != NULL) 13732 putnext(connp->conn_rq, mp); 13733 } 13734 } 13735 13736 /* 13737 * Don't let port fall into the privileged range. 13738 * Since the extra privileged ports can be arbitrary we also 13739 * ensure that we exclude those from consideration. 13740 * tcp_g_epriv_ports is not sorted thus we loop over it until 13741 * there are no changes. 13742 * 13743 * Note: No locks are held when inspecting tcp_g_*epriv_ports 13744 * but instead the code relies on: 13745 * - the fact that the address of the array and its size never changes 13746 * - the atomic assignment of the elements of the array 13747 * 13748 * Returns 0 if there are no more ports available. 13749 * 13750 * TS note: skip multilevel ports. 13751 */ 13752 static in_port_t 13753 tcp_update_next_port(in_port_t port, const tcp_t *tcp, boolean_t random) 13754 { 13755 int i; 13756 boolean_t restart = B_FALSE; 13757 tcp_stack_t *tcps = tcp->tcp_tcps; 13758 13759 if (random && tcp_random_anon_port != 0) { 13760 (void) random_get_pseudo_bytes((uint8_t *)&port, 13761 sizeof (in_port_t)); 13762 /* 13763 * Unless changed by a sys admin, the smallest anon port 13764 * is 32768 and the largest anon port is 65535. It is 13765 * very likely (50%) for the random port to be smaller 13766 * than the smallest anon port. When that happens, 13767 * add port % (anon port range) to the smallest anon 13768 * port to get the random port. It should fall into the 13769 * valid anon port range. 13770 */ 13771 if (port < tcps->tcps_smallest_anon_port) { 13772 port = tcps->tcps_smallest_anon_port + 13773 port % (tcps->tcps_largest_anon_port - 13774 tcps->tcps_smallest_anon_port); 13775 } 13776 } 13777 13778 retry: 13779 if (port < tcps->tcps_smallest_anon_port) 13780 port = (in_port_t)tcps->tcps_smallest_anon_port; 13781 13782 if (port > tcps->tcps_largest_anon_port) { 13783 if (restart) 13784 return (0); 13785 restart = B_TRUE; 13786 port = (in_port_t)tcps->tcps_smallest_anon_port; 13787 } 13788 13789 if (port < tcps->tcps_smallest_nonpriv_port) 13790 port = (in_port_t)tcps->tcps_smallest_nonpriv_port; 13791 13792 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 13793 if (port == tcps->tcps_g_epriv_ports[i]) { 13794 port++; 13795 /* 13796 * Make sure whether the port is in the 13797 * valid range. 13798 */ 13799 goto retry; 13800 } 13801 } 13802 if (is_system_labeled() && 13803 (i = tsol_next_port(crgetzone(tcp->tcp_connp->conn_cred), port, 13804 IPPROTO_TCP, B_TRUE)) != 0) { 13805 port = i; 13806 goto retry; 13807 } 13808 return (port); 13809 } 13810 13811 /* 13812 * Return the next anonymous port in the privileged port range for 13813 * bind checking. It starts at IPPORT_RESERVED - 1 and goes 13814 * downwards. This is the same behavior as documented in the userland 13815 * library call rresvport(3N). 13816 * 13817 * TS note: skip multilevel ports. 13818 */ 13819 static in_port_t 13820 tcp_get_next_priv_port(const tcp_t *tcp) 13821 { 13822 static in_port_t next_priv_port = IPPORT_RESERVED - 1; 13823 in_port_t nextport; 13824 boolean_t restart = B_FALSE; 13825 tcp_stack_t *tcps = tcp->tcp_tcps; 13826 retry: 13827 if (next_priv_port < tcps->tcps_min_anonpriv_port || 13828 next_priv_port >= IPPORT_RESERVED) { 13829 next_priv_port = IPPORT_RESERVED - 1; 13830 if (restart) 13831 return (0); 13832 restart = B_TRUE; 13833 } 13834 if (is_system_labeled() && 13835 (nextport = tsol_next_port(crgetzone(tcp->tcp_connp->conn_cred), 13836 next_priv_port, IPPROTO_TCP, B_FALSE)) != 0) { 13837 next_priv_port = nextport; 13838 goto retry; 13839 } 13840 return (next_priv_port--); 13841 } 13842 13843 /* The write side r/w procedure. */ 13844 13845 #if CCS_STATS 13846 struct { 13847 struct { 13848 int64_t count, bytes; 13849 } tot, hit; 13850 } wrw_stats; 13851 #endif 13852 13853 /* 13854 * Call by tcp_wput() to handle all non data, except M_PROTO and M_PCPROTO, 13855 * messages. 13856 */ 13857 /* ARGSUSED */ 13858 static void 13859 tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 13860 { 13861 conn_t *connp = (conn_t *)arg; 13862 tcp_t *tcp = connp->conn_tcp; 13863 13864 ASSERT(DB_TYPE(mp) != M_IOCTL); 13865 /* 13866 * TCP is D_MP and qprocsoff() is done towards the end of the tcp_close. 13867 * Once the close starts, streamhead and sockfs will not let any data 13868 * packets come down (close ensures that there are no threads using the 13869 * queue and no new threads will come down) but since qprocsoff() 13870 * hasn't happened yet, a M_FLUSH or some non data message might 13871 * get reflected back (in response to our own FLUSHRW) and get 13872 * processed after tcp_close() is done. The conn would still be valid 13873 * because a ref would have added but we need to check the state 13874 * before actually processing the packet. 13875 */ 13876 if (TCP_IS_DETACHED(tcp) || (tcp->tcp_state == TCPS_CLOSED)) { 13877 freemsg(mp); 13878 return; 13879 } 13880 13881 switch (DB_TYPE(mp)) { 13882 case M_IOCDATA: 13883 tcp_wput_iocdata(tcp, mp); 13884 break; 13885 case M_FLUSH: 13886 tcp_wput_flush(tcp, mp); 13887 break; 13888 default: 13889 ip_wput_nondata(connp->conn_wq, mp); 13890 break; 13891 } 13892 } 13893 13894 /* 13895 * The TCP fast path write put procedure. 13896 * NOTE: the logic of the fast path is duplicated from tcp_wput_data() 13897 */ 13898 /* ARGSUSED */ 13899 void 13900 tcp_output(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 13901 { 13902 int len; 13903 int hdrlen; 13904 int plen; 13905 mblk_t *mp1; 13906 uchar_t *rptr; 13907 uint32_t snxt; 13908 tcpha_t *tcpha; 13909 struct datab *db; 13910 uint32_t suna; 13911 uint32_t mss; 13912 ipaddr_t *dst; 13913 ipaddr_t *src; 13914 uint32_t sum; 13915 int usable; 13916 conn_t *connp = (conn_t *)arg; 13917 tcp_t *tcp = connp->conn_tcp; 13918 uint32_t msize; 13919 tcp_stack_t *tcps = tcp->tcp_tcps; 13920 ip_xmit_attr_t *ixa; 13921 13922 /* 13923 * Try and ASSERT the minimum possible references on the 13924 * conn early enough. Since we are executing on write side, 13925 * the connection is obviously not detached and that means 13926 * there is a ref each for TCP and IP. Since we are behind 13927 * the squeue, the minimum references needed are 3. If the 13928 * conn is in classifier hash list, there should be an 13929 * extra ref for that (we check both the possibilities). 13930 */ 13931 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 13932 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 13933 13934 ASSERT(DB_TYPE(mp) == M_DATA); 13935 msize = (mp->b_cont == NULL) ? MBLKL(mp) : msgdsize(mp); 13936 13937 mutex_enter(&tcp->tcp_non_sq_lock); 13938 tcp->tcp_squeue_bytes -= msize; 13939 mutex_exit(&tcp->tcp_non_sq_lock); 13940 13941 /* Bypass tcp protocol for fused tcp loopback */ 13942 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize)) 13943 return; 13944 13945 mss = tcp->tcp_mss; 13946 /* 13947 * If ZEROCOPY has turned off, try not to send any zero-copy message 13948 * down. Do backoff, now. 13949 */ 13950 if (tcp->tcp_snd_zcopy_aware && !tcp->tcp_snd_zcopy_on) 13951 mp = tcp_zcopy_backoff(tcp, mp, B_FALSE); 13952 13953 13954 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 13955 len = (int)(mp->b_wptr - mp->b_rptr); 13956 13957 /* 13958 * Criteria for fast path: 13959 * 13960 * 1. no unsent data 13961 * 2. single mblk in request 13962 * 3. connection established 13963 * 4. data in mblk 13964 * 5. len <= mss 13965 * 6. no tcp_valid bits 13966 */ 13967 if ((tcp->tcp_unsent != 0) || 13968 (tcp->tcp_cork) || 13969 (mp->b_cont != NULL) || 13970 (tcp->tcp_state != TCPS_ESTABLISHED) || 13971 (len == 0) || 13972 (len > mss) || 13973 (tcp->tcp_valid_bits != 0)) { 13974 tcp_wput_data(tcp, mp, B_FALSE); 13975 return; 13976 } 13977 13978 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 13979 ASSERT(tcp->tcp_fin_sent == 0); 13980 13981 /* queue new packet onto retransmission queue */ 13982 if (tcp->tcp_xmit_head == NULL) { 13983 tcp->tcp_xmit_head = mp; 13984 } else { 13985 tcp->tcp_xmit_last->b_cont = mp; 13986 } 13987 tcp->tcp_xmit_last = mp; 13988 tcp->tcp_xmit_tail = mp; 13989 13990 /* find out how much we can send */ 13991 /* BEGIN CSTYLED */ 13992 /* 13993 * un-acked usable 13994 * |--------------|-----------------| 13995 * tcp_suna tcp_snxt tcp_suna+tcp_swnd 13996 */ 13997 /* END CSTYLED */ 13998 13999 /* start sending from tcp_snxt */ 14000 snxt = tcp->tcp_snxt; 14001 14002 /* 14003 * Check to see if this connection has been idled for some 14004 * time and no ACK is expected. If it is, we need to slow 14005 * start again to get back the connection's "self-clock" as 14006 * described in VJ's paper. 14007 * 14008 * Reinitialize tcp_cwnd after idle. 14009 */ 14010 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 14011 (TICK_TO_MSEC(ddi_get_lbolt() - tcp->tcp_last_recv_time) >= 14012 tcp->tcp_rto)) { 14013 SET_TCP_INIT_CWND(tcp, mss, tcps->tcps_slow_start_after_idle); 14014 } 14015 14016 usable = tcp->tcp_swnd; /* tcp window size */ 14017 if (usable > tcp->tcp_cwnd) 14018 usable = tcp->tcp_cwnd; /* congestion window smaller */ 14019 usable -= snxt; /* subtract stuff already sent */ 14020 suna = tcp->tcp_suna; 14021 usable += suna; 14022 /* usable can be < 0 if the congestion window is smaller */ 14023 if (len > usable) { 14024 /* Can't send complete M_DATA in one shot */ 14025 goto slow; 14026 } 14027 14028 mutex_enter(&tcp->tcp_non_sq_lock); 14029 if (tcp->tcp_flow_stopped && 14030 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 14031 tcp_clrqfull(tcp); 14032 } 14033 mutex_exit(&tcp->tcp_non_sq_lock); 14034 14035 /* 14036 * determine if anything to send (Nagle). 14037 * 14038 * 1. len < tcp_mss (i.e. small) 14039 * 2. unacknowledged data present 14040 * 3. len < nagle limit 14041 * 4. last packet sent < nagle limit (previous packet sent) 14042 */ 14043 if ((len < mss) && (snxt != suna) && 14044 (len < (int)tcp->tcp_naglim) && 14045 (tcp->tcp_last_sent_len < tcp->tcp_naglim)) { 14046 /* 14047 * This was the first unsent packet and normally 14048 * mss < xmit_hiwater so there is no need to worry 14049 * about flow control. The next packet will go 14050 * through the flow control check in tcp_wput_data(). 14051 */ 14052 /* leftover work from above */ 14053 tcp->tcp_unsent = len; 14054 tcp->tcp_xmit_tail_unsent = len; 14055 14056 return; 14057 } 14058 14059 /* len <= tcp->tcp_mss && len == unsent so no silly window */ 14060 14061 if (snxt == suna) { 14062 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14063 } 14064 14065 /* we have always sent something */ 14066 tcp->tcp_rack_cnt = 0; 14067 14068 tcp->tcp_snxt = snxt + len; 14069 tcp->tcp_rack = tcp->tcp_rnxt; 14070 14071 if ((mp1 = dupb(mp)) == 0) 14072 goto no_memory; 14073 mp->b_prev = (mblk_t *)(uintptr_t)ddi_get_lbolt(); 14074 mp->b_next = (mblk_t *)(uintptr_t)snxt; 14075 14076 /* adjust tcp header information */ 14077 tcpha = tcp->tcp_tcpha; 14078 tcpha->tha_flags = (TH_ACK|TH_PUSH); 14079 14080 sum = len + connp->conn_ht_ulp_len + connp->conn_sum; 14081 sum = (sum >> 16) + (sum & 0xFFFF); 14082 tcpha->tha_sum = htons(sum); 14083 14084 tcpha->tha_seq = htonl(snxt); 14085 14086 BUMP_MIB(&tcps->tcps_mib, tcpOutDataSegs); 14087 UPDATE_MIB(&tcps->tcps_mib, tcpOutDataBytes, len); 14088 BUMP_LOCAL(tcp->tcp_obsegs); 14089 14090 /* Update the latest receive window size in TCP header. */ 14091 tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 14092 14093 tcp->tcp_last_sent_len = (ushort_t)len; 14094 14095 plen = len + connp->conn_ht_iphc_len; 14096 14097 ixa = connp->conn_ixa; 14098 ixa->ixa_pktlen = plen; 14099 14100 if (ixa->ixa_flags & IXAF_IS_IPV4) { 14101 tcp->tcp_ipha->ipha_length = htons(plen); 14102 } else { 14103 tcp->tcp_ip6h->ip6_plen = htons(plen - IPV6_HDR_LEN); 14104 } 14105 14106 /* see if we need to allocate a mblk for the headers */ 14107 hdrlen = connp->conn_ht_iphc_len; 14108 rptr = mp1->b_rptr - hdrlen; 14109 db = mp1->b_datap; 14110 if ((db->db_ref != 2) || rptr < db->db_base || 14111 (!OK_32PTR(rptr))) { 14112 /* NOTE: we assume allocb returns an OK_32PTR */ 14113 mp = allocb(hdrlen + tcps->tcps_wroff_xtra, BPRI_MED); 14114 if (!mp) { 14115 freemsg(mp1); 14116 goto no_memory; 14117 } 14118 mp->b_cont = mp1; 14119 mp1 = mp; 14120 /* Leave room for Link Level header */ 14121 rptr = &mp1->b_rptr[tcps->tcps_wroff_xtra]; 14122 mp1->b_wptr = &rptr[hdrlen]; 14123 } 14124 mp1->b_rptr = rptr; 14125 14126 /* Fill in the timestamp option. */ 14127 if (tcp->tcp_snd_ts_ok) { 14128 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH; 14129 14130 U32_TO_BE32(llbolt, 14131 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 14132 U32_TO_BE32(tcp->tcp_ts_recent, 14133 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 14134 } else { 14135 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH); 14136 } 14137 14138 /* copy header into outgoing packet */ 14139 dst = (ipaddr_t *)rptr; 14140 src = (ipaddr_t *)connp->conn_ht_iphc; 14141 dst[0] = src[0]; 14142 dst[1] = src[1]; 14143 dst[2] = src[2]; 14144 dst[3] = src[3]; 14145 dst[4] = src[4]; 14146 dst[5] = src[5]; 14147 dst[6] = src[6]; 14148 dst[7] = src[7]; 14149 dst[8] = src[8]; 14150 dst[9] = src[9]; 14151 if (hdrlen -= 40) { 14152 hdrlen >>= 2; 14153 dst += 10; 14154 src += 10; 14155 do { 14156 *dst++ = *src++; 14157 } while (--hdrlen); 14158 } 14159 14160 /* 14161 * Set the ECN info in the TCP header. Note that this 14162 * is not the template header. 14163 */ 14164 if (tcp->tcp_ecn_ok) { 14165 SET_ECT(tcp, rptr); 14166 14167 tcpha = (tcpha_t *)(rptr + ixa->ixa_ip_hdr_length); 14168 if (tcp->tcp_ecn_echo_on) 14169 tcpha->tha_flags |= TH_ECE; 14170 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 14171 tcpha->tha_flags |= TH_CWR; 14172 tcp->tcp_ecn_cwr_sent = B_TRUE; 14173 } 14174 } 14175 14176 if (tcp->tcp_ip_forward_progress) { 14177 tcp->tcp_ip_forward_progress = B_FALSE; 14178 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF; 14179 } else { 14180 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF; 14181 } 14182 tcp_send_data(tcp, mp1); 14183 return; 14184 14185 /* 14186 * If we ran out of memory, we pretend to have sent the packet 14187 * and that it was lost on the wire. 14188 */ 14189 no_memory: 14190 return; 14191 14192 slow: 14193 /* leftover work from above */ 14194 tcp->tcp_unsent = len; 14195 tcp->tcp_xmit_tail_unsent = len; 14196 tcp_wput_data(tcp, NULL, B_FALSE); 14197 } 14198 14199 /* 14200 * This runs at the tail end of accept processing on the squeue of the 14201 * new connection. 14202 */ 14203 /* ARGSUSED */ 14204 void 14205 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 14206 { 14207 conn_t *connp = (conn_t *)arg; 14208 tcp_t *tcp = connp->conn_tcp; 14209 queue_t *q = connp->conn_rq; 14210 tcp_stack_t *tcps = tcp->tcp_tcps; 14211 /* socket options */ 14212 struct sock_proto_props sopp; 14213 14214 /* We should just receive a single mblk that fits a T_discon_ind */ 14215 ASSERT(mp->b_cont == NULL); 14216 14217 /* 14218 * Drop the eager's ref on the listener, that was placed when 14219 * this eager began life in tcp_input_listener. 14220 */ 14221 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 14222 if (IPCL_IS_NONSTR(connp)) { 14223 /* Safe to free conn_ind message */ 14224 freemsg(tcp->tcp_conn.tcp_eager_conn_ind); 14225 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 14226 } 14227 14228 tcp->tcp_detached = B_FALSE; 14229 14230 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 14231 /* 14232 * Someone blewoff the eager before we could finish 14233 * the accept. 14234 * 14235 * The only reason eager exists it because we put in 14236 * a ref on it when conn ind went up. We need to send 14237 * a disconnect indication up while the last reference 14238 * on the eager will be dropped by the squeue when we 14239 * return. 14240 */ 14241 ASSERT(tcp->tcp_listener == NULL); 14242 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 14243 if (IPCL_IS_NONSTR(connp)) { 14244 ASSERT(tcp->tcp_issocket); 14245 (*connp->conn_upcalls->su_disconnected)( 14246 connp->conn_upper_handle, tcp->tcp_connid, 14247 ECONNREFUSED); 14248 freemsg(mp); 14249 } else { 14250 struct T_discon_ind *tdi; 14251 14252 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 14253 /* 14254 * Let us reuse the incoming mblk to avoid 14255 * memory allocation failure problems. We know 14256 * that the size of the incoming mblk i.e. 14257 * stroptions is greater than sizeof 14258 * T_discon_ind. 14259 */ 14260 ASSERT(DB_REF(mp) == 1); 14261 ASSERT(MBLKSIZE(mp) >= 14262 sizeof (struct T_discon_ind)); 14263 14264 DB_TYPE(mp) = M_PROTO; 14265 ((union T_primitives *)mp->b_rptr)->type = 14266 T_DISCON_IND; 14267 tdi = (struct T_discon_ind *)mp->b_rptr; 14268 if (tcp->tcp_issocket) { 14269 tdi->DISCON_reason = ECONNREFUSED; 14270 tdi->SEQ_number = 0; 14271 } else { 14272 tdi->DISCON_reason = ENOPROTOOPT; 14273 tdi->SEQ_number = 14274 tcp->tcp_conn_req_seqnum; 14275 } 14276 mp->b_wptr = mp->b_rptr + 14277 sizeof (struct T_discon_ind); 14278 putnext(q, mp); 14279 } 14280 } 14281 tcp->tcp_hard_binding = B_FALSE; 14282 return; 14283 } 14284 14285 /* 14286 * Set max window size (conn_rcvbuf) of the acceptor. 14287 */ 14288 if (tcp->tcp_rcv_list == NULL) { 14289 /* 14290 * Recv queue is empty, tcp_rwnd should not have changed. 14291 * That means it should be equal to the listener's tcp_rwnd. 14292 */ 14293 connp->conn_rcvbuf = tcp->tcp_rwnd; 14294 } else { 14295 #ifdef DEBUG 14296 mblk_t *tmp; 14297 mblk_t *mp1; 14298 uint_t cnt = 0; 14299 14300 mp1 = tcp->tcp_rcv_list; 14301 while ((tmp = mp1) != NULL) { 14302 mp1 = tmp->b_next; 14303 cnt += msgdsize(tmp); 14304 } 14305 ASSERT(cnt != 0 && tcp->tcp_rcv_cnt == cnt); 14306 #endif 14307 /* There is some data, add them back to get the max. */ 14308 connp->conn_rcvbuf = tcp->tcp_rwnd + tcp->tcp_rcv_cnt; 14309 } 14310 /* 14311 * This is the first time we run on the correct 14312 * queue after tcp_accept. So fix all the q parameters 14313 * here. 14314 */ 14315 sopp.sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF; 14316 sopp.sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 14317 14318 sopp.sopp_rxhiwat = tcp->tcp_fused ? 14319 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) : 14320 connp->conn_rcvbuf; 14321 14322 /* 14323 * Determine what write offset value to use depending on SACK and 14324 * whether the endpoint is fused or not. 14325 */ 14326 if (tcp->tcp_fused) { 14327 ASSERT(tcp->tcp_loopback); 14328 ASSERT(tcp->tcp_loopback_peer != NULL); 14329 /* 14330 * For fused tcp loopback, set the stream head's write 14331 * offset value to zero since we won't be needing any room 14332 * for TCP/IP headers. This would also improve performance 14333 * since it would reduce the amount of work done by kmem. 14334 * Non-fused tcp loopback case is handled separately below. 14335 */ 14336 sopp.sopp_wroff = 0; 14337 /* 14338 * Update the peer's transmit parameters according to 14339 * our recently calculated high water mark value. 14340 */ 14341 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 14342 } else if (tcp->tcp_snd_sack_ok) { 14343 sopp.sopp_wroff = connp->conn_ht_iphc_allocated + 14344 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 14345 } else { 14346 sopp.sopp_wroff = connp->conn_ht_iphc_len + 14347 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 14348 } 14349 14350 /* 14351 * If this is endpoint is handling SSL, then reserve extra 14352 * offset and space at the end. 14353 * Also have the stream head allocate SSL3_MAX_RECORD_LEN packets, 14354 * overriding the previous setting. The extra cost of signing and 14355 * encrypting multiple MSS-size records (12 of them with Ethernet), 14356 * instead of a single contiguous one by the stream head 14357 * largely outweighs the statistical reduction of ACKs, when 14358 * applicable. The peer will also save on decryption and verification 14359 * costs. 14360 */ 14361 if (tcp->tcp_kssl_ctx != NULL) { 14362 sopp.sopp_wroff += SSL3_WROFFSET; 14363 14364 sopp.sopp_flags |= SOCKOPT_TAIL; 14365 sopp.sopp_tail = SSL3_MAX_TAIL_LEN; 14366 14367 sopp.sopp_flags |= SOCKOPT_ZCOPY; 14368 sopp.sopp_zcopyflag = ZCVMUNSAFE; 14369 14370 sopp.sopp_maxblk = SSL3_MAX_RECORD_LEN; 14371 } 14372 14373 /* Send the options up */ 14374 if (IPCL_IS_NONSTR(connp)) { 14375 if (sopp.sopp_flags & SOCKOPT_TAIL) { 14376 ASSERT(tcp->tcp_kssl_ctx != NULL); 14377 ASSERT(sopp.sopp_flags & SOCKOPT_ZCOPY); 14378 } 14379 if (tcp->tcp_loopback) { 14380 sopp.sopp_flags |= SOCKOPT_LOOPBACK; 14381 sopp.sopp_loopback = B_TRUE; 14382 } 14383 (*connp->conn_upcalls->su_set_proto_props) 14384 (connp->conn_upper_handle, &sopp); 14385 freemsg(mp); 14386 } else { 14387 /* 14388 * Let us reuse the incoming mblk to avoid 14389 * memory allocation failure problems. We know 14390 * that the size of the incoming mblk is at least 14391 * stroptions 14392 */ 14393 struct stroptions *stropt; 14394 14395 ASSERT(DB_REF(mp) == 1); 14396 ASSERT(MBLKSIZE(mp) >= sizeof (struct stroptions)); 14397 14398 DB_TYPE(mp) = M_SETOPTS; 14399 stropt = (struct stroptions *)mp->b_rptr; 14400 mp->b_wptr = mp->b_rptr + sizeof (struct stroptions); 14401 stropt = (struct stroptions *)mp->b_rptr; 14402 stropt->so_flags = SO_HIWAT | SO_WROFF | SO_MAXBLK; 14403 stropt->so_hiwat = sopp.sopp_rxhiwat; 14404 stropt->so_wroff = sopp.sopp_wroff; 14405 stropt->so_maxblk = sopp.sopp_maxblk; 14406 14407 if (sopp.sopp_flags & SOCKOPT_TAIL) { 14408 ASSERT(tcp->tcp_kssl_ctx != NULL); 14409 14410 stropt->so_flags |= SO_TAIL | SO_COPYOPT; 14411 stropt->so_tail = sopp.sopp_tail; 14412 stropt->so_copyopt = sopp.sopp_zcopyflag; 14413 } 14414 14415 /* Send the options up */ 14416 putnext(q, mp); 14417 } 14418 14419 /* 14420 * Pass up any data and/or a fin that has been received. 14421 * 14422 * Adjust receive window in case it had decreased 14423 * (because there is data <=> tcp_rcv_list != NULL) 14424 * while the connection was detached. Note that 14425 * in case the eager was flow-controlled, w/o this 14426 * code, the rwnd may never open up again! 14427 */ 14428 if (tcp->tcp_rcv_list != NULL) { 14429 if (IPCL_IS_NONSTR(connp)) { 14430 mblk_t *mp; 14431 int space_left; 14432 int error; 14433 boolean_t push = B_TRUE; 14434 14435 if (!tcp->tcp_fused && (*connp->conn_upcalls->su_recv) 14436 (connp->conn_upper_handle, NULL, 0, 0, &error, 14437 &push) >= 0) { 14438 tcp->tcp_rwnd = connp->conn_rcvbuf; 14439 if (tcp->tcp_state >= TCPS_ESTABLISHED && 14440 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 14441 tcp_xmit_ctl(NULL, 14442 tcp, (tcp->tcp_swnd == 0) ? 14443 tcp->tcp_suna : tcp->tcp_snxt, 14444 tcp->tcp_rnxt, TH_ACK); 14445 } 14446 } 14447 while ((mp = tcp->tcp_rcv_list) != NULL) { 14448 push = B_TRUE; 14449 tcp->tcp_rcv_list = mp->b_next; 14450 mp->b_next = NULL; 14451 space_left = (*connp->conn_upcalls->su_recv) 14452 (connp->conn_upper_handle, mp, msgdsize(mp), 14453 0, &error, &push); 14454 if (space_left < 0) { 14455 /* 14456 * We should never be in middle of a 14457 * fallback, the squeue guarantees that. 14458 */ 14459 ASSERT(error != EOPNOTSUPP); 14460 } 14461 } 14462 tcp->tcp_rcv_last_head = NULL; 14463 tcp->tcp_rcv_last_tail = NULL; 14464 tcp->tcp_rcv_cnt = 0; 14465 } else { 14466 /* We drain directly in case of fused tcp loopback */ 14467 14468 if (!tcp->tcp_fused && canputnext(q)) { 14469 tcp->tcp_rwnd = connp->conn_rcvbuf; 14470 if (tcp->tcp_state >= TCPS_ESTABLISHED && 14471 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 14472 tcp_xmit_ctl(NULL, 14473 tcp, (tcp->tcp_swnd == 0) ? 14474 tcp->tcp_suna : tcp->tcp_snxt, 14475 tcp->tcp_rnxt, TH_ACK); 14476 } 14477 } 14478 14479 (void) tcp_rcv_drain(tcp); 14480 } 14481 14482 /* 14483 * For fused tcp loopback, back-enable peer endpoint 14484 * if it's currently flow-controlled. 14485 */ 14486 if (tcp->tcp_fused) { 14487 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 14488 14489 ASSERT(peer_tcp != NULL); 14490 ASSERT(peer_tcp->tcp_fused); 14491 14492 mutex_enter(&peer_tcp->tcp_non_sq_lock); 14493 if (peer_tcp->tcp_flow_stopped) { 14494 tcp_clrqfull(peer_tcp); 14495 TCP_STAT(tcps, tcp_fusion_backenabled); 14496 } 14497 mutex_exit(&peer_tcp->tcp_non_sq_lock); 14498 } 14499 } 14500 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 14501 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 14502 tcp->tcp_ordrel_done = B_TRUE; 14503 if (IPCL_IS_NONSTR(connp)) { 14504 ASSERT(tcp->tcp_ordrel_mp == NULL); 14505 (*connp->conn_upcalls->su_opctl)( 14506 connp->conn_upper_handle, 14507 SOCK_OPCTL_SHUT_RECV, 0); 14508 } else { 14509 mp = tcp->tcp_ordrel_mp; 14510 tcp->tcp_ordrel_mp = NULL; 14511 putnext(q, mp); 14512 } 14513 } 14514 tcp->tcp_hard_binding = B_FALSE; 14515 14516 if (connp->conn_keepalive) { 14517 tcp->tcp_ka_last_intrvl = 0; 14518 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 14519 MSEC_TO_TICK(tcp->tcp_ka_interval)); 14520 } 14521 14522 /* 14523 * At this point, eager is fully established and will 14524 * have the following references - 14525 * 14526 * 2 references for connection to exist (1 for TCP and 1 for IP). 14527 * 1 reference for the squeue which will be dropped by the squeue as 14528 * soon as this function returns. 14529 * There will be 1 additonal reference for being in classifier 14530 * hash list provided something bad hasn't happened. 14531 */ 14532 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 14533 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 14534 } 14535 14536 /* 14537 * The function called through squeue to get behind listener's perimeter to 14538 * send a deferred conn_ind. 14539 */ 14540 /* ARGSUSED */ 14541 void 14542 tcp_send_pending(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 14543 { 14544 conn_t *lconnp = (conn_t *)arg; 14545 tcp_t *listener = lconnp->conn_tcp; 14546 struct T_conn_ind *conn_ind; 14547 tcp_t *tcp; 14548 14549 conn_ind = (struct T_conn_ind *)mp->b_rptr; 14550 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 14551 conn_ind->OPT_length); 14552 14553 if (listener->tcp_state != TCPS_LISTEN) { 14554 /* 14555 * If listener has closed, it would have caused a 14556 * a cleanup/blowoff to happen for the eager, so 14557 * we don't need to do anything more. 14558 */ 14559 freemsg(mp); 14560 return; 14561 } 14562 14563 tcp_ulp_newconn(lconnp, tcp->tcp_connp, mp); 14564 } 14565 14566 /* 14567 * Common to TPI and sockfs accept code. 14568 */ 14569 /* ARGSUSED2 */ 14570 static int 14571 tcp_accept_common(conn_t *lconnp, conn_t *econnp, cred_t *cr) 14572 { 14573 tcp_t *listener, *eager; 14574 mblk_t *discon_mp; 14575 14576 listener = lconnp->conn_tcp; 14577 ASSERT(listener->tcp_state == TCPS_LISTEN); 14578 eager = econnp->conn_tcp; 14579 ASSERT(eager->tcp_listener != NULL); 14580 14581 /* 14582 * Pre allocate the discon_ind mblk also. tcp_accept_finish will 14583 * use it if something failed. 14584 */ 14585 discon_mp = allocb(MAX(sizeof (struct T_discon_ind), 14586 sizeof (struct stroptions)), BPRI_HI); 14587 14588 if (discon_mp == NULL) { 14589 return (-TPROTO); 14590 } 14591 eager->tcp_issocket = B_TRUE; 14592 14593 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 14594 econnp->conn_allzones = listener->tcp_connp->conn_allzones; 14595 ASSERT(econnp->conn_netstack == 14596 listener->tcp_connp->conn_netstack); 14597 ASSERT(eager->tcp_tcps == listener->tcp_tcps); 14598 14599 /* Put the ref for IP */ 14600 CONN_INC_REF(econnp); 14601 14602 /* 14603 * We should have minimum of 3 references on the conn 14604 * at this point. One each for TCP and IP and one for 14605 * the T_conn_ind that was sent up when the 3-way handshake 14606 * completed. In the normal case we would also have another 14607 * reference (making a total of 4) for the conn being in the 14608 * classifier hash list. However the eager could have received 14609 * an RST subsequently and tcp_closei_local could have removed 14610 * the eager from the classifier hash list, hence we can't 14611 * assert that reference. 14612 */ 14613 ASSERT(econnp->conn_ref >= 3); 14614 14615 mutex_enter(&listener->tcp_eager_lock); 14616 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 14617 14618 tcp_t *tail; 14619 tcp_t *tcp; 14620 mblk_t *mp1; 14621 14622 tcp = listener->tcp_eager_prev_q0; 14623 /* 14624 * listener->tcp_eager_prev_q0 points to the TAIL of the 14625 * deferred T_conn_ind queue. We need to get to the head 14626 * of the queue in order to send up T_conn_ind the same 14627 * order as how the 3WHS is completed. 14628 */ 14629 while (tcp != listener) { 14630 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0 && 14631 !tcp->tcp_kssl_pending) 14632 break; 14633 else 14634 tcp = tcp->tcp_eager_prev_q0; 14635 } 14636 /* None of the pending eagers can be sent up now */ 14637 if (tcp == listener) 14638 goto no_more_eagers; 14639 14640 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 14641 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 14642 /* Move from q0 to q */ 14643 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 14644 listener->tcp_conn_req_cnt_q0--; 14645 listener->tcp_conn_req_cnt_q++; 14646 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 14647 tcp->tcp_eager_prev_q0; 14648 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 14649 tcp->tcp_eager_next_q0; 14650 tcp->tcp_eager_prev_q0 = NULL; 14651 tcp->tcp_eager_next_q0 = NULL; 14652 tcp->tcp_conn_def_q0 = B_FALSE; 14653 14654 /* Make sure the tcp isn't in the list of droppables */ 14655 ASSERT(tcp->tcp_eager_next_drop_q0 == NULL && 14656 tcp->tcp_eager_prev_drop_q0 == NULL); 14657 14658 /* 14659 * Insert at end of the queue because sockfs sends 14660 * down T_CONN_RES in chronological order. Leaving 14661 * the older conn indications at front of the queue 14662 * helps reducing search time. 14663 */ 14664 tail = listener->tcp_eager_last_q; 14665 if (tail != NULL) { 14666 tail->tcp_eager_next_q = tcp; 14667 } else { 14668 listener->tcp_eager_next_q = tcp; 14669 } 14670 listener->tcp_eager_last_q = tcp; 14671 tcp->tcp_eager_next_q = NULL; 14672 14673 /* Need to get inside the listener perimeter */ 14674 CONN_INC_REF(listener->tcp_connp); 14675 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, mp1, 14676 tcp_send_pending, listener->tcp_connp, NULL, SQ_FILL, 14677 SQTAG_TCP_SEND_PENDING); 14678 } 14679 no_more_eagers: 14680 tcp_eager_unlink(eager); 14681 mutex_exit(&listener->tcp_eager_lock); 14682 14683 /* 14684 * At this point, the eager is detached from the listener 14685 * but we still have an extra refs on eager (apart from the 14686 * usual tcp references). The ref was placed in tcp_rput_data 14687 * before sending the conn_ind in tcp_send_conn_ind. 14688 * The ref will be dropped in tcp_accept_finish(). 14689 */ 14690 SQUEUE_ENTER_ONE(econnp->conn_sqp, discon_mp, tcp_accept_finish, 14691 econnp, NULL, SQ_NODRAIN, SQTAG_TCP_ACCEPT_FINISH_Q0); 14692 return (0); 14693 } 14694 14695 int 14696 tcp_accept(sock_lower_handle_t lproto_handle, 14697 sock_lower_handle_t eproto_handle, sock_upper_handle_t sock_handle, 14698 cred_t *cr) 14699 { 14700 conn_t *lconnp, *econnp; 14701 tcp_t *listener, *eager; 14702 14703 lconnp = (conn_t *)lproto_handle; 14704 listener = lconnp->conn_tcp; 14705 ASSERT(listener->tcp_state == TCPS_LISTEN); 14706 econnp = (conn_t *)eproto_handle; 14707 eager = econnp->conn_tcp; 14708 ASSERT(eager->tcp_listener != NULL); 14709 14710 /* 14711 * It is OK to manipulate these fields outside the eager's squeue 14712 * because they will not start being used until tcp_accept_finish 14713 * has been called. 14714 */ 14715 ASSERT(lconnp->conn_upper_handle != NULL); 14716 ASSERT(econnp->conn_upper_handle == NULL); 14717 econnp->conn_upper_handle = sock_handle; 14718 econnp->conn_upcalls = lconnp->conn_upcalls; 14719 ASSERT(IPCL_IS_NONSTR(econnp)); 14720 return (tcp_accept_common(lconnp, econnp, cr)); 14721 } 14722 14723 14724 /* 14725 * This is the STREAMS entry point for T_CONN_RES coming down on 14726 * Acceptor STREAM when sockfs listener does accept processing. 14727 * Read the block comment on top of tcp_input_listener(). 14728 */ 14729 void 14730 tcp_tpi_accept(queue_t *q, mblk_t *mp) 14731 { 14732 queue_t *rq = RD(q); 14733 struct T_conn_res *conn_res; 14734 tcp_t *eager; 14735 tcp_t *listener; 14736 struct T_ok_ack *ok; 14737 t_scalar_t PRIM_type; 14738 conn_t *econnp; 14739 cred_t *cr; 14740 14741 ASSERT(DB_TYPE(mp) == M_PROTO); 14742 14743 /* 14744 * All Solaris components should pass a db_credp 14745 * for this TPI message, hence we ASSERT. 14746 * But in case there is some other M_PROTO that looks 14747 * like a TPI message sent by some other kernel 14748 * component, we check and return an error. 14749 */ 14750 cr = msg_getcred(mp, NULL); 14751 ASSERT(cr != NULL); 14752 if (cr == NULL) { 14753 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, EINVAL); 14754 if (mp != NULL) 14755 putnext(rq, mp); 14756 return; 14757 } 14758 conn_res = (struct T_conn_res *)mp->b_rptr; 14759 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 14760 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_res)) { 14761 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 14762 if (mp != NULL) 14763 putnext(rq, mp); 14764 return; 14765 } 14766 switch (conn_res->PRIM_type) { 14767 case O_T_CONN_RES: 14768 case T_CONN_RES: 14769 /* 14770 * We pass up an err ack if allocb fails. This will 14771 * cause sockfs to issue a T_DISCON_REQ which will cause 14772 * tcp_eager_blowoff to be called. sockfs will then call 14773 * rq->q_qinfo->qi_qclose to cleanup the acceptor stream. 14774 * we need to do the allocb up here because we have to 14775 * make sure rq->q_qinfo->qi_qclose still points to the 14776 * correct function (tcp_tpi_close_accept) in case allocb 14777 * fails. 14778 */ 14779 bcopy(mp->b_rptr + conn_res->OPT_offset, 14780 &eager, conn_res->OPT_length); 14781 PRIM_type = conn_res->PRIM_type; 14782 mp->b_datap->db_type = M_PCPROTO; 14783 mp->b_wptr = mp->b_rptr + sizeof (struct T_ok_ack); 14784 ok = (struct T_ok_ack *)mp->b_rptr; 14785 ok->PRIM_type = T_OK_ACK; 14786 ok->CORRECT_prim = PRIM_type; 14787 econnp = eager->tcp_connp; 14788 econnp->conn_dev = (dev_t)RD(q)->q_ptr; 14789 econnp->conn_minor_arena = (vmem_t *)(WR(q)->q_ptr); 14790 econnp->conn_rq = rq; 14791 econnp->conn_wq = q; 14792 rq->q_ptr = econnp; 14793 rq->q_qinfo = &tcp_rinitv4; /* No open - same as rinitv6 */ 14794 q->q_ptr = econnp; 14795 q->q_qinfo = &tcp_winit; 14796 listener = eager->tcp_listener; 14797 14798 if (tcp_accept_common(listener->tcp_connp, 14799 econnp, cr) < 0) { 14800 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 14801 if (mp != NULL) 14802 putnext(rq, mp); 14803 return; 14804 } 14805 14806 /* 14807 * Send the new local address also up to sockfs. There 14808 * should already be enough space in the mp that came 14809 * down from soaccept(). 14810 */ 14811 if (econnp->conn_family == AF_INET) { 14812 sin_t *sin; 14813 14814 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 14815 (sizeof (struct T_ok_ack) + sizeof (sin_t))); 14816 sin = (sin_t *)mp->b_wptr; 14817 mp->b_wptr += sizeof (sin_t); 14818 sin->sin_family = AF_INET; 14819 sin->sin_port = econnp->conn_lport; 14820 sin->sin_addr.s_addr = econnp->conn_laddr_v4; 14821 } else { 14822 sin6_t *sin6; 14823 14824 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 14825 sizeof (struct T_ok_ack) + sizeof (sin6_t)); 14826 sin6 = (sin6_t *)mp->b_wptr; 14827 mp->b_wptr += sizeof (sin6_t); 14828 sin6->sin6_family = AF_INET6; 14829 sin6->sin6_port = econnp->conn_lport; 14830 sin6->sin6_addr = econnp->conn_laddr_v6; 14831 if (econnp->conn_ipversion == IPV4_VERSION) { 14832 sin6->sin6_flowinfo = 0; 14833 } else { 14834 ASSERT(eager->tcp_ip6h != NULL); 14835 sin6->sin6_flowinfo = 14836 eager->tcp_ip6h->ip6_vcf & 14837 ~IPV6_VERS_AND_FLOW_MASK; 14838 } 14839 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6) && 14840 (econnp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)) { 14841 sin6->sin6_scope_id = 14842 econnp->conn_ixa->ixa_scopeid; 14843 } else { 14844 sin6->sin6_scope_id = 0; 14845 } 14846 sin6->__sin6_src_id = 0; 14847 } 14848 14849 putnext(rq, mp); 14850 return; 14851 default: 14852 mp = mi_tpi_err_ack_alloc(mp, TNOTSUPPORT, 0); 14853 if (mp != NULL) 14854 putnext(rq, mp); 14855 return; 14856 } 14857 } 14858 14859 /* 14860 * Handle special out-of-band ioctl requests (see PSARC/2008/265). 14861 */ 14862 static void 14863 tcp_wput_cmdblk(queue_t *q, mblk_t *mp) 14864 { 14865 void *data; 14866 mblk_t *datamp = mp->b_cont; 14867 conn_t *connp = Q_TO_CONN(q); 14868 tcp_t *tcp = connp->conn_tcp; 14869 cmdblk_t *cmdp = (cmdblk_t *)mp->b_rptr; 14870 14871 if (datamp == NULL || MBLKL(datamp) < cmdp->cb_len) { 14872 cmdp->cb_error = EPROTO; 14873 qreply(q, mp); 14874 return; 14875 } 14876 14877 data = datamp->b_rptr; 14878 14879 switch (cmdp->cb_cmd) { 14880 case TI_GETPEERNAME: 14881 if (tcp->tcp_state < TCPS_SYN_RCVD) 14882 cmdp->cb_error = ENOTCONN; 14883 else 14884 cmdp->cb_error = conn_getpeername(connp, data, 14885 &cmdp->cb_len); 14886 break; 14887 case TI_GETMYNAME: 14888 cmdp->cb_error = conn_getsockname(connp, data, &cmdp->cb_len); 14889 break; 14890 default: 14891 cmdp->cb_error = EINVAL; 14892 break; 14893 } 14894 14895 qreply(q, mp); 14896 } 14897 14898 void 14899 tcp_wput(queue_t *q, mblk_t *mp) 14900 { 14901 conn_t *connp = Q_TO_CONN(q); 14902 tcp_t *tcp; 14903 void (*output_proc)(); 14904 t_scalar_t type; 14905 uchar_t *rptr; 14906 struct iocblk *iocp; 14907 size_t size; 14908 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 14909 14910 ASSERT(connp->conn_ref >= 2); 14911 14912 switch (DB_TYPE(mp)) { 14913 case M_DATA: 14914 tcp = connp->conn_tcp; 14915 ASSERT(tcp != NULL); 14916 14917 size = msgdsize(mp); 14918 14919 mutex_enter(&tcp->tcp_non_sq_lock); 14920 tcp->tcp_squeue_bytes += size; 14921 if (TCP_UNSENT_BYTES(tcp) > connp->conn_sndbuf) { 14922 tcp_setqfull(tcp); 14923 } 14924 mutex_exit(&tcp->tcp_non_sq_lock); 14925 14926 CONN_INC_REF(connp); 14927 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_output, connp, 14928 NULL, tcp_squeue_flag, SQTAG_TCP_OUTPUT); 14929 return; 14930 14931 case M_CMD: 14932 tcp_wput_cmdblk(q, mp); 14933 return; 14934 14935 case M_PROTO: 14936 case M_PCPROTO: 14937 /* 14938 * if it is a snmp message, don't get behind the squeue 14939 */ 14940 tcp = connp->conn_tcp; 14941 rptr = mp->b_rptr; 14942 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 14943 type = ((union T_primitives *)rptr)->type; 14944 } else { 14945 if (connp->conn_debug) { 14946 (void) strlog(TCP_MOD_ID, 0, 1, 14947 SL_ERROR|SL_TRACE, 14948 "tcp_wput_proto, dropping one..."); 14949 } 14950 freemsg(mp); 14951 return; 14952 } 14953 if (type == T_SVR4_OPTMGMT_REQ) { 14954 /* 14955 * All Solaris components should pass a db_credp 14956 * for this TPI message, hence we ASSERT. 14957 * But in case there is some other M_PROTO that looks 14958 * like a TPI message sent by some other kernel 14959 * component, we check and return an error. 14960 */ 14961 cred_t *cr = msg_getcred(mp, NULL); 14962 14963 ASSERT(cr != NULL); 14964 if (cr == NULL) { 14965 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 14966 return; 14967 } 14968 if (snmpcom_req(q, mp, tcp_snmp_set, ip_snmp_get, 14969 cr)) { 14970 /* 14971 * This was a SNMP request 14972 */ 14973 return; 14974 } else { 14975 output_proc = tcp_wput_proto; 14976 } 14977 } else { 14978 output_proc = tcp_wput_proto; 14979 } 14980 break; 14981 case M_IOCTL: 14982 /* 14983 * Most ioctls can be processed right away without going via 14984 * squeues - process them right here. Those that do require 14985 * squeue (currently _SIOCSOCKFALLBACK) 14986 * are processed by tcp_wput_ioctl(). 14987 */ 14988 iocp = (struct iocblk *)mp->b_rptr; 14989 tcp = connp->conn_tcp; 14990 14991 switch (iocp->ioc_cmd) { 14992 case TCP_IOC_ABORT_CONN: 14993 tcp_ioctl_abort_conn(q, mp); 14994 return; 14995 case TI_GETPEERNAME: 14996 case TI_GETMYNAME: 14997 mi_copyin(q, mp, NULL, 14998 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 14999 return; 15000 case ND_SET: 15001 /* nd_getset does the necessary checks */ 15002 case ND_GET: 15003 if (nd_getset(q, tcps->tcps_g_nd, mp)) { 15004 qreply(q, mp); 15005 return; 15006 } 15007 ip_wput_nondata(q, mp); 15008 return; 15009 15010 default: 15011 output_proc = tcp_wput_ioctl; 15012 break; 15013 } 15014 break; 15015 default: 15016 output_proc = tcp_wput_nondata; 15017 break; 15018 } 15019 15020 CONN_INC_REF(connp); 15021 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, output_proc, connp, 15022 NULL, tcp_squeue_flag, SQTAG_TCP_WPUT_OTHER); 15023 } 15024 15025 /* 15026 * Initial STREAMS write side put() procedure for sockets. It tries to 15027 * handle the T_CAPABILITY_REQ which sockfs sends down while setting 15028 * up the socket without using the squeue. Non T_CAPABILITY_REQ messages 15029 * are handled by tcp_wput() as usual. 15030 * 15031 * All further messages will also be handled by tcp_wput() because we cannot 15032 * be sure that the above short cut is safe later. 15033 */ 15034 static void 15035 tcp_wput_sock(queue_t *wq, mblk_t *mp) 15036 { 15037 conn_t *connp = Q_TO_CONN(wq); 15038 tcp_t *tcp = connp->conn_tcp; 15039 struct T_capability_req *car = (struct T_capability_req *)mp->b_rptr; 15040 15041 ASSERT(wq->q_qinfo == &tcp_sock_winit); 15042 wq->q_qinfo = &tcp_winit; 15043 15044 ASSERT(IPCL_IS_TCP(connp)); 15045 ASSERT(TCP_IS_SOCKET(tcp)); 15046 15047 if (DB_TYPE(mp) == M_PCPROTO && 15048 MBLKL(mp) == sizeof (struct T_capability_req) && 15049 car->PRIM_type == T_CAPABILITY_REQ) { 15050 tcp_capability_req(tcp, mp); 15051 return; 15052 } 15053 15054 tcp_wput(wq, mp); 15055 } 15056 15057 /* ARGSUSED */ 15058 static void 15059 tcp_wput_fallback(queue_t *wq, mblk_t *mp) 15060 { 15061 #ifdef DEBUG 15062 cmn_err(CE_CONT, "tcp_wput_fallback: Message during fallback \n"); 15063 #endif 15064 freemsg(mp); 15065 } 15066 15067 /* 15068 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP. 15069 */ 15070 static boolean_t 15071 tcp_zcopy_check(tcp_t *tcp) 15072 { 15073 conn_t *connp = tcp->tcp_connp; 15074 ip_xmit_attr_t *ixa = connp->conn_ixa; 15075 boolean_t zc_enabled = B_FALSE; 15076 tcp_stack_t *tcps = tcp->tcp_tcps; 15077 15078 if (do_tcpzcopy == 2) 15079 zc_enabled = B_TRUE; 15080 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB)) 15081 zc_enabled = B_TRUE; 15082 15083 tcp->tcp_snd_zcopy_on = zc_enabled; 15084 if (!TCP_IS_DETACHED(tcp)) { 15085 if (zc_enabled) { 15086 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY; 15087 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 15088 ZCVMSAFE); 15089 TCP_STAT(tcps, tcp_zcopy_on); 15090 } else { 15091 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY; 15092 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 15093 ZCVMUNSAFE); 15094 TCP_STAT(tcps, tcp_zcopy_off); 15095 } 15096 } 15097 return (zc_enabled); 15098 } 15099 15100 /* 15101 * Backoff from a zero-copy message by copying data to a new allocated 15102 * message and freeing the original desballoca'ed segmapped message. 15103 * 15104 * This function is called by following two callers: 15105 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free 15106 * the origial desballoca'ed message and notify sockfs. This is in re- 15107 * transmit state. 15108 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need 15109 * to be copied to new message. 15110 */ 15111 static mblk_t * 15112 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist) 15113 { 15114 mblk_t *nbp; 15115 mblk_t *head = NULL; 15116 mblk_t *tail = NULL; 15117 tcp_stack_t *tcps = tcp->tcp_tcps; 15118 15119 ASSERT(bp != NULL); 15120 while (bp != NULL) { 15121 if (IS_VMLOANED_MBLK(bp)) { 15122 TCP_STAT(tcps, tcp_zcopy_backoff); 15123 if ((nbp = copyb(bp)) == NULL) { 15124 tcp->tcp_xmit_zc_clean = B_FALSE; 15125 if (tail != NULL) 15126 tail->b_cont = bp; 15127 return ((head == NULL) ? bp : head); 15128 } 15129 15130 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 15131 if (fix_xmitlist) 15132 tcp_zcopy_notify(tcp); 15133 else 15134 nbp->b_datap->db_struioflag |= 15135 STRUIO_ZCNOTIFY; 15136 } 15137 nbp->b_cont = bp->b_cont; 15138 15139 /* 15140 * Copy saved information and adjust tcp_xmit_tail 15141 * if needed. 15142 */ 15143 if (fix_xmitlist) { 15144 nbp->b_prev = bp->b_prev; 15145 nbp->b_next = bp->b_next; 15146 15147 if (tcp->tcp_xmit_tail == bp) 15148 tcp->tcp_xmit_tail = nbp; 15149 } 15150 15151 /* Free the original message. */ 15152 bp->b_prev = NULL; 15153 bp->b_next = NULL; 15154 freeb(bp); 15155 15156 bp = nbp; 15157 } 15158 15159 if (head == NULL) { 15160 head = bp; 15161 } 15162 if (tail == NULL) { 15163 tail = bp; 15164 } else { 15165 tail->b_cont = bp; 15166 tail = bp; 15167 } 15168 15169 /* Move forward. */ 15170 bp = bp->b_cont; 15171 } 15172 15173 if (fix_xmitlist) { 15174 tcp->tcp_xmit_last = tail; 15175 tcp->tcp_xmit_zc_clean = B_TRUE; 15176 } 15177 15178 return (head); 15179 } 15180 15181 static void 15182 tcp_zcopy_notify(tcp_t *tcp) 15183 { 15184 struct stdata *stp; 15185 conn_t *connp; 15186 15187 if (tcp->tcp_detached) 15188 return; 15189 connp = tcp->tcp_connp; 15190 if (IPCL_IS_NONSTR(connp)) { 15191 (*connp->conn_upcalls->su_zcopy_notify) 15192 (connp->conn_upper_handle); 15193 return; 15194 } 15195 stp = STREAM(connp->conn_rq); 15196 mutex_enter(&stp->sd_lock); 15197 stp->sd_flag |= STZCNOTIFY; 15198 cv_broadcast(&stp->sd_zcopy_wait); 15199 mutex_exit(&stp->sd_lock); 15200 } 15201 15202 /* 15203 * Update the TCP connection according to change of LSO capability. 15204 */ 15205 static void 15206 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa) 15207 { 15208 /* 15209 * We check against IPv4 header length to preserve the old behavior 15210 * of only enabling LSO when there are no IP options. 15211 * But this restriction might not be necessary at all. Before removing 15212 * it, need to verify how LSO is handled for source routing case, with 15213 * which IP does software checksum. 15214 * 15215 * For IPv6, whenever any extension header is needed, LSO is supressed. 15216 */ 15217 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ? 15218 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN)) 15219 return; 15220 15221 /* 15222 * Either the LSO capability newly became usable, or it has changed. 15223 */ 15224 if (ixa->ixa_flags & IXAF_LSO_CAPAB) { 15225 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab; 15226 15227 ASSERT(lsoc->ill_lso_max > 0); 15228 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max); 15229 15230 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 15231 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max); 15232 15233 /* 15234 * If LSO to be enabled, notify the STREAM header with larger 15235 * data block. 15236 */ 15237 if (!tcp->tcp_lso) 15238 tcp->tcp_maxpsz_multiplier = 0; 15239 15240 tcp->tcp_lso = B_TRUE; 15241 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled); 15242 } else { /* LSO capability is not usable any more. */ 15243 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 15244 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max); 15245 15246 /* 15247 * If LSO to be disabled, notify the STREAM header with smaller 15248 * data block. And need to restore fragsize to PMTU. 15249 */ 15250 if (tcp->tcp_lso) { 15251 tcp->tcp_maxpsz_multiplier = 15252 tcp->tcp_tcps->tcps_maxpsz_multiplier; 15253 ixa->ixa_fragsize = ixa->ixa_pmtu; 15254 tcp->tcp_lso = B_FALSE; 15255 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled); 15256 } 15257 } 15258 15259 (void) tcp_maxpsz_set(tcp, B_TRUE); 15260 } 15261 15262 /* 15263 * Update the TCP connection according to change of ZEROCOPY capability. 15264 */ 15265 static void 15266 tcp_update_zcopy(tcp_t *tcp) 15267 { 15268 conn_t *connp = tcp->tcp_connp; 15269 tcp_stack_t *tcps = tcp->tcp_tcps; 15270 15271 if (tcp->tcp_snd_zcopy_on) { 15272 tcp->tcp_snd_zcopy_on = B_FALSE; 15273 if (!TCP_IS_DETACHED(tcp)) { 15274 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 15275 ZCVMUNSAFE); 15276 TCP_STAT(tcps, tcp_zcopy_off); 15277 } 15278 } else { 15279 tcp->tcp_snd_zcopy_on = B_TRUE; 15280 if (!TCP_IS_DETACHED(tcp)) { 15281 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 15282 ZCVMSAFE); 15283 TCP_STAT(tcps, tcp_zcopy_on); 15284 } 15285 } 15286 } 15287 15288 /* 15289 * Notify function registered with ip_xmit_attr_t. It's called in the squeue 15290 * so it's safe to update the TCP connection. 15291 */ 15292 /* ARGSUSED1 */ 15293 static void 15294 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 15295 ixa_notify_arg_t narg) 15296 { 15297 tcp_t *tcp = (tcp_t *)arg; 15298 conn_t *connp = tcp->tcp_connp; 15299 15300 switch (ntype) { 15301 case IXAN_LSO: 15302 tcp_update_lso(tcp, connp->conn_ixa); 15303 break; 15304 case IXAN_PMTU: 15305 tcp_update_pmtu(tcp, B_FALSE); 15306 break; 15307 case IXAN_ZCOPY: 15308 tcp_update_zcopy(tcp); 15309 break; 15310 default: 15311 break; 15312 } 15313 } 15314 15315 static void 15316 tcp_send_data(tcp_t *tcp, mblk_t *mp) 15317 { 15318 conn_t *connp = tcp->tcp_connp; 15319 15320 /* 15321 * Check here to avoid sending zero-copy message down to IP when 15322 * ZEROCOPY capability has turned off. We only need to deal with 15323 * the race condition between sockfs and the notification here. 15324 * Since we have tried to backoff the tcp_xmit_head when turning 15325 * zero-copy off and new messages in tcp_output(), we simply drop 15326 * the dup'ed packet here and let tcp retransmit, if tcp_xmit_zc_clean 15327 * is not true. 15328 */ 15329 if (tcp->tcp_snd_zcopy_aware && !tcp->tcp_snd_zcopy_on && 15330 !tcp->tcp_xmit_zc_clean) { 15331 ip_drop_output("TCP ZC was disabled but not clean", mp, NULL); 15332 freemsg(mp); 15333 return; 15334 } 15335 15336 ASSERT(connp->conn_ixa->ixa_notify_cookie == connp->conn_tcp); 15337 (void) conn_ip_output(mp, connp->conn_ixa); 15338 } 15339 15340 /* 15341 * This handles the case when the receiver has shrunk its win. Per RFC 1122 15342 * if the receiver shrinks the window, i.e. moves the right window to the 15343 * left, the we should not send new data, but should retransmit normally the 15344 * old unacked data between suna and suna + swnd. We might has sent data 15345 * that is now outside the new window, pretend that we didn't send it. 15346 */ 15347 static void 15348 tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_count) 15349 { 15350 uint32_t snxt = tcp->tcp_snxt; 15351 15352 ASSERT(shrunk_count > 0); 15353 15354 if (!tcp->tcp_is_wnd_shrnk) { 15355 tcp->tcp_snxt_shrunk = snxt; 15356 tcp->tcp_is_wnd_shrnk = B_TRUE; 15357 } else if (SEQ_GT(snxt, tcp->tcp_snxt_shrunk)) { 15358 tcp->tcp_snxt_shrunk = snxt; 15359 } 15360 15361 /* Pretend we didn't send the data outside the window */ 15362 snxt -= shrunk_count; 15363 15364 /* Reset all the values per the now shrunk window */ 15365 tcp_update_xmit_tail(tcp, snxt); 15366 tcp->tcp_unsent += shrunk_count; 15367 15368 /* 15369 * If the SACK option is set, delete the entire list of 15370 * notsack'ed blocks. 15371 */ 15372 if (tcp->tcp_sack_info != NULL) { 15373 if (tcp->tcp_notsack_list != NULL) 15374 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 15375 } 15376 15377 if (tcp->tcp_suna == tcp->tcp_snxt && tcp->tcp_swnd == 0) 15378 /* 15379 * Make sure the timer is running so that we will probe a zero 15380 * window. 15381 */ 15382 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15383 } 15384 15385 15386 /* 15387 * The TCP normal data output path. 15388 * NOTE: the logic of the fast path is duplicated from this function. 15389 */ 15390 static void 15391 tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent) 15392 { 15393 int len; 15394 mblk_t *local_time; 15395 mblk_t *mp1; 15396 uint32_t snxt; 15397 int tail_unsent; 15398 int tcpstate; 15399 int usable = 0; 15400 mblk_t *xmit_tail; 15401 int32_t mss; 15402 int32_t num_sack_blk = 0; 15403 int32_t total_hdr_len; 15404 int32_t tcp_hdr_len; 15405 int rc; 15406 tcp_stack_t *tcps = tcp->tcp_tcps; 15407 conn_t *connp = tcp->tcp_connp; 15408 15409 tcpstate = tcp->tcp_state; 15410 if (mp == NULL) { 15411 /* 15412 * tcp_wput_data() with NULL mp should only be called when 15413 * there is unsent data. 15414 */ 15415 ASSERT(tcp->tcp_unsent > 0); 15416 /* Really tacky... but we need this for detached closes. */ 15417 len = tcp->tcp_unsent; 15418 goto data_null; 15419 } 15420 15421 #if CCS_STATS 15422 wrw_stats.tot.count++; 15423 wrw_stats.tot.bytes += msgdsize(mp); 15424 #endif 15425 ASSERT(mp->b_datap->db_type == M_DATA); 15426 /* 15427 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ, 15428 * or before a connection attempt has begun. 15429 */ 15430 if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT || 15431 (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 15432 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 15433 #ifdef DEBUG 15434 cmn_err(CE_WARN, 15435 "tcp_wput_data: data after ordrel, %s", 15436 tcp_display(tcp, NULL, 15437 DISP_ADDR_AND_PORT)); 15438 #else 15439 if (connp->conn_debug) { 15440 (void) strlog(TCP_MOD_ID, 0, 1, 15441 SL_TRACE|SL_ERROR, 15442 "tcp_wput_data: data after ordrel, %s\n", 15443 tcp_display(tcp, NULL, 15444 DISP_ADDR_AND_PORT)); 15445 } 15446 #endif /* DEBUG */ 15447 } 15448 if (tcp->tcp_snd_zcopy_aware && 15449 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 15450 tcp_zcopy_notify(tcp); 15451 freemsg(mp); 15452 mutex_enter(&tcp->tcp_non_sq_lock); 15453 if (tcp->tcp_flow_stopped && 15454 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 15455 tcp_clrqfull(tcp); 15456 } 15457 mutex_exit(&tcp->tcp_non_sq_lock); 15458 return; 15459 } 15460 15461 /* Strip empties */ 15462 for (;;) { 15463 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 15464 (uintptr_t)INT_MAX); 15465 len = (int)(mp->b_wptr - mp->b_rptr); 15466 if (len > 0) 15467 break; 15468 mp1 = mp; 15469 mp = mp->b_cont; 15470 freeb(mp1); 15471 if (!mp) { 15472 return; 15473 } 15474 } 15475 15476 /* If we are the first on the list ... */ 15477 if (tcp->tcp_xmit_head == NULL) { 15478 tcp->tcp_xmit_head = mp; 15479 tcp->tcp_xmit_tail = mp; 15480 tcp->tcp_xmit_tail_unsent = len; 15481 } else { 15482 /* If tiny tx and room in txq tail, pullup to save mblks. */ 15483 struct datab *dp; 15484 15485 mp1 = tcp->tcp_xmit_last; 15486 if (len < tcp_tx_pull_len && 15487 (dp = mp1->b_datap)->db_ref == 1 && 15488 dp->db_lim - mp1->b_wptr >= len) { 15489 ASSERT(len > 0); 15490 ASSERT(!mp1->b_cont); 15491 if (len == 1) { 15492 *mp1->b_wptr++ = *mp->b_rptr; 15493 } else { 15494 bcopy(mp->b_rptr, mp1->b_wptr, len); 15495 mp1->b_wptr += len; 15496 } 15497 if (mp1 == tcp->tcp_xmit_tail) 15498 tcp->tcp_xmit_tail_unsent += len; 15499 mp1->b_cont = mp->b_cont; 15500 if (tcp->tcp_snd_zcopy_aware && 15501 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 15502 mp1->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 15503 freeb(mp); 15504 mp = mp1; 15505 } else { 15506 tcp->tcp_xmit_last->b_cont = mp; 15507 } 15508 len += tcp->tcp_unsent; 15509 } 15510 15511 /* Tack on however many more positive length mblks we have */ 15512 if ((mp1 = mp->b_cont) != NULL) { 15513 do { 15514 int tlen; 15515 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 15516 (uintptr_t)INT_MAX); 15517 tlen = (int)(mp1->b_wptr - mp1->b_rptr); 15518 if (tlen <= 0) { 15519 mp->b_cont = mp1->b_cont; 15520 freeb(mp1); 15521 } else { 15522 len += tlen; 15523 mp = mp1; 15524 } 15525 } while ((mp1 = mp->b_cont) != NULL); 15526 } 15527 tcp->tcp_xmit_last = mp; 15528 tcp->tcp_unsent = len; 15529 15530 if (urgent) 15531 usable = 1; 15532 15533 data_null: 15534 snxt = tcp->tcp_snxt; 15535 xmit_tail = tcp->tcp_xmit_tail; 15536 tail_unsent = tcp->tcp_xmit_tail_unsent; 15537 15538 /* 15539 * Note that tcp_mss has been adjusted to take into account the 15540 * timestamp option if applicable. Because SACK options do not 15541 * appear in every TCP segments and they are of variable lengths, 15542 * they cannot be included in tcp_mss. Thus we need to calculate 15543 * the actual segment length when we need to send a segment which 15544 * includes SACK options. 15545 */ 15546 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 15547 int32_t opt_len; 15548 15549 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 15550 tcp->tcp_num_sack_blk); 15551 opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN * 15552 2 + TCPOPT_HEADER_LEN; 15553 mss = tcp->tcp_mss - opt_len; 15554 total_hdr_len = connp->conn_ht_iphc_len + opt_len; 15555 tcp_hdr_len = connp->conn_ht_ulp_len + opt_len; 15556 } else { 15557 mss = tcp->tcp_mss; 15558 total_hdr_len = connp->conn_ht_iphc_len; 15559 tcp_hdr_len = connp->conn_ht_ulp_len; 15560 } 15561 15562 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 15563 (TICK_TO_MSEC((clock_t)LBOLT_FASTPATH - tcp->tcp_last_recv_time) >= 15564 tcp->tcp_rto)) { 15565 SET_TCP_INIT_CWND(tcp, mss, tcps->tcps_slow_start_after_idle); 15566 } 15567 if (tcpstate == TCPS_SYN_RCVD) { 15568 /* 15569 * The three-way connection establishment handshake is not 15570 * complete yet. We want to queue the data for transmission 15571 * after entering ESTABLISHED state (RFC793). A jump to 15572 * "done" label effectively leaves data on the queue. 15573 */ 15574 goto done; 15575 } else { 15576 int usable_r; 15577 15578 /* 15579 * In the special case when cwnd is zero, which can only 15580 * happen if the connection is ECN capable, return now. 15581 * New segments is sent using tcp_timer(). The timer 15582 * is set in tcp_input_data(). 15583 */ 15584 if (tcp->tcp_cwnd == 0) { 15585 /* 15586 * Note that tcp_cwnd is 0 before 3-way handshake is 15587 * finished. 15588 */ 15589 ASSERT(tcp->tcp_ecn_ok || 15590 tcp->tcp_state < TCPS_ESTABLISHED); 15591 return; 15592 } 15593 15594 /* NOTE: trouble if xmitting while SYN not acked? */ 15595 usable_r = snxt - tcp->tcp_suna; 15596 usable_r = tcp->tcp_swnd - usable_r; 15597 15598 /* 15599 * Check if the receiver has shrunk the window. If 15600 * tcp_wput_data() with NULL mp is called, tcp_fin_sent 15601 * cannot be set as there is unsent data, so FIN cannot 15602 * be sent out. Otherwise, we need to take into account 15603 * of FIN as it consumes an "invisible" sequence number. 15604 */ 15605 ASSERT(tcp->tcp_fin_sent == 0); 15606 if (usable_r < 0) { 15607 /* 15608 * The receiver has shrunk the window and we have sent 15609 * -usable_r date beyond the window, re-adjust. 15610 * 15611 * If TCP window scaling is enabled, there can be 15612 * round down error as the advertised receive window 15613 * is actually right shifted n bits. This means that 15614 * the lower n bits info is wiped out. It will look 15615 * like the window is shrunk. Do a check here to 15616 * see if the shrunk amount is actually within the 15617 * error in window calculation. If it is, just 15618 * return. Note that this check is inside the 15619 * shrunk window check. This makes sure that even 15620 * though tcp_process_shrunk_swnd() is not called, 15621 * we will stop further processing. 15622 */ 15623 if ((-usable_r >> tcp->tcp_snd_ws) > 0) { 15624 tcp_process_shrunk_swnd(tcp, -usable_r); 15625 } 15626 return; 15627 } 15628 15629 /* usable = MIN(swnd, cwnd) - unacked_bytes */ 15630 if (tcp->tcp_swnd > tcp->tcp_cwnd) 15631 usable_r -= tcp->tcp_swnd - tcp->tcp_cwnd; 15632 15633 /* usable = MIN(usable, unsent) */ 15634 if (usable_r > len) 15635 usable_r = len; 15636 15637 /* usable = MAX(usable, {1 for urgent, 0 for data}) */ 15638 if (usable_r > 0) { 15639 usable = usable_r; 15640 } else { 15641 /* Bypass all other unnecessary processing. */ 15642 goto done; 15643 } 15644 } 15645 15646 local_time = (mblk_t *)LBOLT_FASTPATH; 15647 15648 /* 15649 * "Our" Nagle Algorithm. This is not the same as in the old 15650 * BSD. This is more in line with the true intent of Nagle. 15651 * 15652 * The conditions are: 15653 * 1. The amount of unsent data (or amount of data which can be 15654 * sent, whichever is smaller) is less than Nagle limit. 15655 * 2. The last sent size is also less than Nagle limit. 15656 * 3. There is unack'ed data. 15657 * 4. Urgent pointer is not set. Send urgent data ignoring the 15658 * Nagle algorithm. This reduces the probability that urgent 15659 * bytes get "merged" together. 15660 * 5. The app has not closed the connection. This eliminates the 15661 * wait time of the receiving side waiting for the last piece of 15662 * (small) data. 15663 * 15664 * If all are satisified, exit without sending anything. Note 15665 * that Nagle limit can be smaller than 1 MSS. Nagle limit is 15666 * the smaller of 1 MSS and global tcp_naglim_def (default to be 15667 * 4095). 15668 */ 15669 if (usable < (int)tcp->tcp_naglim && 15670 tcp->tcp_naglim > tcp->tcp_last_sent_len && 15671 snxt != tcp->tcp_suna && 15672 !(tcp->tcp_valid_bits & TCP_URG_VALID) && 15673 !(tcp->tcp_valid_bits & TCP_FSS_VALID)) { 15674 goto done; 15675 } 15676 15677 /* 15678 * If tcp_zero_win_probe is not set and the tcp->tcp_cork option 15679 * is set, then we have to force TCP not to send partial segment 15680 * (smaller than MSS bytes). We are calculating the usable now 15681 * based on full mss and will save the rest of remaining data for 15682 * later. When tcp_zero_win_probe is set, TCP needs to send out 15683 * something to do zero window probe. 15684 */ 15685 if (tcp->tcp_cork && !tcp->tcp_zero_win_probe) { 15686 if (usable < mss) 15687 goto done; 15688 usable = (usable / mss) * mss; 15689 } 15690 15691 /* Update the latest receive window size in TCP header. */ 15692 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 15693 15694 /* Send the packet. */ 15695 rc = tcp_send(tcp, mss, total_hdr_len, tcp_hdr_len, 15696 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 15697 local_time); 15698 15699 /* Pretend that all we were trying to send really got sent */ 15700 if (rc < 0 && tail_unsent < 0) { 15701 do { 15702 xmit_tail = xmit_tail->b_cont; 15703 xmit_tail->b_prev = local_time; 15704 ASSERT((uintptr_t)(xmit_tail->b_wptr - 15705 xmit_tail->b_rptr) <= (uintptr_t)INT_MAX); 15706 tail_unsent += (int)(xmit_tail->b_wptr - 15707 xmit_tail->b_rptr); 15708 } while (tail_unsent < 0); 15709 } 15710 done:; 15711 tcp->tcp_xmit_tail = xmit_tail; 15712 tcp->tcp_xmit_tail_unsent = tail_unsent; 15713 len = tcp->tcp_snxt - snxt; 15714 if (len) { 15715 /* 15716 * If new data was sent, need to update the notsack 15717 * list, which is, afterall, data blocks that have 15718 * not been sack'ed by the receiver. New data is 15719 * not sack'ed. 15720 */ 15721 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 15722 /* len is a negative value. */ 15723 tcp->tcp_pipe -= len; 15724 tcp_notsack_update(&(tcp->tcp_notsack_list), 15725 tcp->tcp_snxt, snxt, 15726 &(tcp->tcp_num_notsack_blk), 15727 &(tcp->tcp_cnt_notsack_list)); 15728 } 15729 tcp->tcp_snxt = snxt + tcp->tcp_fin_sent; 15730 tcp->tcp_rack = tcp->tcp_rnxt; 15731 tcp->tcp_rack_cnt = 0; 15732 if ((snxt + len) == tcp->tcp_suna) { 15733 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15734 } 15735 } else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) { 15736 /* 15737 * Didn't send anything. Make sure the timer is running 15738 * so that we will probe a zero window. 15739 */ 15740 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15741 } 15742 /* Note that len is the amount we just sent but with a negative sign */ 15743 tcp->tcp_unsent += len; 15744 mutex_enter(&tcp->tcp_non_sq_lock); 15745 if (tcp->tcp_flow_stopped) { 15746 if (TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 15747 tcp_clrqfull(tcp); 15748 } 15749 } else if (TCP_UNSENT_BYTES(tcp) >= connp->conn_sndbuf) { 15750 if (!(tcp->tcp_detached)) 15751 tcp_setqfull(tcp); 15752 } 15753 mutex_exit(&tcp->tcp_non_sq_lock); 15754 } 15755 15756 /* 15757 * tcp_fill_header is called by tcp_send() to fill the outgoing TCP header 15758 * with the template header, as well as other options such as time-stamp, 15759 * ECN and/or SACK. 15760 */ 15761 static void 15762 tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk) 15763 { 15764 tcpha_t *tcp_tmpl, *tcpha; 15765 uint32_t *dst, *src; 15766 int hdrlen; 15767 conn_t *connp = tcp->tcp_connp; 15768 15769 ASSERT(OK_32PTR(rptr)); 15770 15771 /* Template header */ 15772 tcp_tmpl = tcp->tcp_tcpha; 15773 15774 /* Header of outgoing packet */ 15775 tcpha = (tcpha_t *)(rptr + connp->conn_ixa->ixa_ip_hdr_length); 15776 15777 /* dst and src are opaque 32-bit fields, used for copying */ 15778 dst = (uint32_t *)rptr; 15779 src = (uint32_t *)connp->conn_ht_iphc; 15780 hdrlen = connp->conn_ht_iphc_len; 15781 15782 /* Fill time-stamp option if needed */ 15783 if (tcp->tcp_snd_ts_ok) { 15784 U32_TO_BE32((uint32_t)now, 15785 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 4); 15786 U32_TO_BE32(tcp->tcp_ts_recent, 15787 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 8); 15788 } else { 15789 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH); 15790 } 15791 15792 /* 15793 * Copy the template header; is this really more efficient than 15794 * calling bcopy()? For simple IPv4/TCP, it may be the case, 15795 * but perhaps not for other scenarios. 15796 */ 15797 dst[0] = src[0]; 15798 dst[1] = src[1]; 15799 dst[2] = src[2]; 15800 dst[3] = src[3]; 15801 dst[4] = src[4]; 15802 dst[5] = src[5]; 15803 dst[6] = src[6]; 15804 dst[7] = src[7]; 15805 dst[8] = src[8]; 15806 dst[9] = src[9]; 15807 if (hdrlen -= 40) { 15808 hdrlen >>= 2; 15809 dst += 10; 15810 src += 10; 15811 do { 15812 *dst++ = *src++; 15813 } while (--hdrlen); 15814 } 15815 15816 /* 15817 * Set the ECN info in the TCP header if it is not a zero 15818 * window probe. Zero window probe is only sent in 15819 * tcp_wput_data() and tcp_timer(). 15820 */ 15821 if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) { 15822 SET_ECT(tcp, rptr); 15823 15824 if (tcp->tcp_ecn_echo_on) 15825 tcpha->tha_flags |= TH_ECE; 15826 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 15827 tcpha->tha_flags |= TH_CWR; 15828 tcp->tcp_ecn_cwr_sent = B_TRUE; 15829 } 15830 } 15831 15832 /* Fill in SACK options */ 15833 if (num_sack_blk > 0) { 15834 uchar_t *wptr = rptr + connp->conn_ht_iphc_len; 15835 sack_blk_t *tmp; 15836 int32_t i; 15837 15838 wptr[0] = TCPOPT_NOP; 15839 wptr[1] = TCPOPT_NOP; 15840 wptr[2] = TCPOPT_SACK; 15841 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 15842 sizeof (sack_blk_t); 15843 wptr += TCPOPT_REAL_SACK_LEN; 15844 15845 tmp = tcp->tcp_sack_list; 15846 for (i = 0; i < num_sack_blk; i++) { 15847 U32_TO_BE32(tmp[i].begin, wptr); 15848 wptr += sizeof (tcp_seq); 15849 U32_TO_BE32(tmp[i].end, wptr); 15850 wptr += sizeof (tcp_seq); 15851 } 15852 tcpha->tha_offset_and_reserved += 15853 ((num_sack_blk * 2 + 1) << 4); 15854 } 15855 } 15856 15857 /* 15858 * tcp_send() is called by tcp_wput_data() and returns one of the following: 15859 * 15860 * -1 = failed allocation. 15861 * 0 = success; burst count reached, or usable send window is too small, 15862 * and that we'd rather wait until later before sending again. 15863 */ 15864 static int 15865 tcp_send(tcp_t *tcp, const int mss, const int total_hdr_len, 15866 const int tcp_hdr_len, const int num_sack_blk, int *usable, 15867 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time) 15868 { 15869 int num_burst_seg = tcp->tcp_snd_burst; 15870 int num_lso_seg = 1; 15871 uint_t lso_usable; 15872 boolean_t do_lso_send = B_FALSE; 15873 tcp_stack_t *tcps = tcp->tcp_tcps; 15874 conn_t *connp = tcp->tcp_connp; 15875 ip_xmit_attr_t *ixa = connp->conn_ixa; 15876 15877 /* 15878 * Check LSO possibility. The value of tcp->tcp_lso indicates whether 15879 * the underlying connection is LSO capable. Will check whether having 15880 * enough available data to initiate LSO transmission in the for(){} 15881 * loops. 15882 */ 15883 if (tcp->tcp_lso && (tcp->tcp_valid_bits & ~TCP_FSS_VALID) == 0) 15884 do_lso_send = B_TRUE; 15885 15886 for (;;) { 15887 struct datab *db; 15888 tcpha_t *tcpha; 15889 uint32_t sum; 15890 mblk_t *mp, *mp1; 15891 uchar_t *rptr; 15892 int len; 15893 15894 /* 15895 * Burst count reached, return successfully. 15896 */ 15897 if (num_burst_seg == 0) 15898 break; 15899 15900 /* 15901 * Calculate the maximum payload length we can send at one 15902 * time. 15903 */ 15904 if (do_lso_send) { 15905 /* 15906 * Check whether be able to to do LSO for the current 15907 * available data. 15908 */ 15909 if (num_burst_seg >= 2 && (*usable - 1) / mss >= 1) { 15910 lso_usable = MIN(tcp->tcp_lso_max, *usable); 15911 lso_usable = MIN(lso_usable, 15912 num_burst_seg * mss); 15913 15914 num_lso_seg = lso_usable / mss; 15915 if (lso_usable % mss) { 15916 num_lso_seg++; 15917 tcp->tcp_last_sent_len = (ushort_t) 15918 (lso_usable % mss); 15919 } else { 15920 tcp->tcp_last_sent_len = (ushort_t)mss; 15921 } 15922 } else { 15923 do_lso_send = B_FALSE; 15924 num_lso_seg = 1; 15925 lso_usable = mss; 15926 } 15927 } 15928 15929 ASSERT(num_lso_seg <= IP_MAXPACKET / mss + 1); 15930 #ifdef DEBUG 15931 DTRACE_PROBE2(tcp_send_lso, int, num_lso_seg, boolean_t, 15932 do_lso_send); 15933 #endif 15934 /* 15935 * Adjust num_burst_seg here. 15936 */ 15937 num_burst_seg -= num_lso_seg; 15938 15939 len = mss; 15940 if (len > *usable) { 15941 ASSERT(do_lso_send == B_FALSE); 15942 15943 len = *usable; 15944 if (len <= 0) { 15945 /* Terminate the loop */ 15946 break; /* success; too small */ 15947 } 15948 /* 15949 * Sender silly-window avoidance. 15950 * Ignore this if we are going to send a 15951 * zero window probe out. 15952 * 15953 * TODO: force data into microscopic window? 15954 * ==> (!pushed || (unsent > usable)) 15955 */ 15956 if (len < (tcp->tcp_max_swnd >> 1) && 15957 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) > len && 15958 !((tcp->tcp_valid_bits & TCP_URG_VALID) && 15959 len == 1) && (! tcp->tcp_zero_win_probe)) { 15960 /* 15961 * If the retransmit timer is not running 15962 * we start it so that we will retransmit 15963 * in the case when the receiver has 15964 * decremented the window. 15965 */ 15966 if (*snxt == tcp->tcp_snxt && 15967 *snxt == tcp->tcp_suna) { 15968 /* 15969 * We are not supposed to send 15970 * anything. So let's wait a little 15971 * bit longer before breaking SWS 15972 * avoidance. 15973 * 15974 * What should the value be? 15975 * Suggestion: MAX(init rexmit time, 15976 * tcp->tcp_rto) 15977 */ 15978 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15979 } 15980 break; /* success; too small */ 15981 } 15982 } 15983 15984 tcpha = tcp->tcp_tcpha; 15985 15986 /* 15987 * The reason to adjust len here is that we need to set flags 15988 * and calculate checksum. 15989 */ 15990 if (do_lso_send) 15991 len = lso_usable; 15992 15993 *usable -= len; /* Approximate - can be adjusted later */ 15994 if (*usable > 0) 15995 tcpha->tha_flags = TH_ACK; 15996 else 15997 tcpha->tha_flags = (TH_ACK | TH_PUSH); 15998 15999 /* 16000 * Prime pump for IP's checksumming on our behalf. 16001 * Include the adjustment for a source route if any. 16002 * In case of LSO, the partial pseudo-header checksum should 16003 * exclusive TCP length, so zero tha_sum before IP calculate 16004 * pseudo-header checksum for partial checksum offload. 16005 */ 16006 if (do_lso_send) { 16007 sum = 0; 16008 } else { 16009 sum = len + tcp_hdr_len + connp->conn_sum; 16010 sum = (sum >> 16) + (sum & 0xFFFF); 16011 } 16012 tcpha->tha_sum = htons(sum); 16013 tcpha->tha_seq = htonl(*snxt); 16014 16015 /* 16016 * Branch off to tcp_xmit_mp() if any of the VALID bits is 16017 * set. For the case when TCP_FSS_VALID is the only valid 16018 * bit (normal active close), branch off only when we think 16019 * that the FIN flag needs to be set. Note for this case, 16020 * that (snxt + len) may not reflect the actual seg_len, 16021 * as len may be further reduced in tcp_xmit_mp(). If len 16022 * gets modified, we will end up here again. 16023 */ 16024 if (tcp->tcp_valid_bits != 0 && 16025 (tcp->tcp_valid_bits != TCP_FSS_VALID || 16026 ((*snxt + len) == tcp->tcp_fss))) { 16027 uchar_t *prev_rptr; 16028 uint32_t prev_snxt = tcp->tcp_snxt; 16029 16030 if (*tail_unsent == 0) { 16031 ASSERT((*xmit_tail)->b_cont != NULL); 16032 *xmit_tail = (*xmit_tail)->b_cont; 16033 prev_rptr = (*xmit_tail)->b_rptr; 16034 *tail_unsent = (int)((*xmit_tail)->b_wptr - 16035 (*xmit_tail)->b_rptr); 16036 } else { 16037 prev_rptr = (*xmit_tail)->b_rptr; 16038 (*xmit_tail)->b_rptr = (*xmit_tail)->b_wptr - 16039 *tail_unsent; 16040 } 16041 mp = tcp_xmit_mp(tcp, *xmit_tail, len, NULL, NULL, 16042 *snxt, B_FALSE, (uint32_t *)&len, B_FALSE); 16043 /* Restore tcp_snxt so we get amount sent right. */ 16044 tcp->tcp_snxt = prev_snxt; 16045 if (prev_rptr == (*xmit_tail)->b_rptr) { 16046 /* 16047 * If the previous timestamp is still in use, 16048 * don't stomp on it. 16049 */ 16050 if ((*xmit_tail)->b_next == NULL) { 16051 (*xmit_tail)->b_prev = local_time; 16052 (*xmit_tail)->b_next = 16053 (mblk_t *)(uintptr_t)(*snxt); 16054 } 16055 } else 16056 (*xmit_tail)->b_rptr = prev_rptr; 16057 16058 if (mp == NULL) { 16059 return (-1); 16060 } 16061 mp1 = mp->b_cont; 16062 16063 if (len <= mss) /* LSO is unusable (!do_lso_send) */ 16064 tcp->tcp_last_sent_len = (ushort_t)len; 16065 while (mp1->b_cont) { 16066 *xmit_tail = (*xmit_tail)->b_cont; 16067 (*xmit_tail)->b_prev = local_time; 16068 (*xmit_tail)->b_next = 16069 (mblk_t *)(uintptr_t)(*snxt); 16070 mp1 = mp1->b_cont; 16071 } 16072 *snxt += len; 16073 *tail_unsent = (*xmit_tail)->b_wptr - mp1->b_wptr; 16074 BUMP_LOCAL(tcp->tcp_obsegs); 16075 BUMP_MIB(&tcps->tcps_mib, tcpOutDataSegs); 16076 UPDATE_MIB(&tcps->tcps_mib, tcpOutDataBytes, len); 16077 tcp_send_data(tcp, mp); 16078 continue; 16079 } 16080 16081 *snxt += len; /* Adjust later if we don't send all of len */ 16082 BUMP_MIB(&tcps->tcps_mib, tcpOutDataSegs); 16083 UPDATE_MIB(&tcps->tcps_mib, tcpOutDataBytes, len); 16084 16085 if (*tail_unsent) { 16086 /* Are the bytes above us in flight? */ 16087 rptr = (*xmit_tail)->b_wptr - *tail_unsent; 16088 if (rptr != (*xmit_tail)->b_rptr) { 16089 *tail_unsent -= len; 16090 if (len <= mss) /* LSO is unusable */ 16091 tcp->tcp_last_sent_len = (ushort_t)len; 16092 len += total_hdr_len; 16093 ixa->ixa_pktlen = len; 16094 16095 if (ixa->ixa_flags & IXAF_IS_IPV4) { 16096 tcp->tcp_ipha->ipha_length = htons(len); 16097 } else { 16098 tcp->tcp_ip6h->ip6_plen = 16099 htons(len - IPV6_HDR_LEN); 16100 } 16101 16102 mp = dupb(*xmit_tail); 16103 if (mp == NULL) { 16104 return (-1); /* out_of_mem */ 16105 } 16106 mp->b_rptr = rptr; 16107 /* 16108 * If the old timestamp is no longer in use, 16109 * sample a new timestamp now. 16110 */ 16111 if ((*xmit_tail)->b_next == NULL) { 16112 (*xmit_tail)->b_prev = local_time; 16113 (*xmit_tail)->b_next = 16114 (mblk_t *)(uintptr_t)(*snxt-len); 16115 } 16116 goto must_alloc; 16117 } 16118 } else { 16119 *xmit_tail = (*xmit_tail)->b_cont; 16120 ASSERT((uintptr_t)((*xmit_tail)->b_wptr - 16121 (*xmit_tail)->b_rptr) <= (uintptr_t)INT_MAX); 16122 *tail_unsent = (int)((*xmit_tail)->b_wptr - 16123 (*xmit_tail)->b_rptr); 16124 } 16125 16126 (*xmit_tail)->b_prev = local_time; 16127 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)(*snxt - len); 16128 16129 *tail_unsent -= len; 16130 if (len <= mss) /* LSO is unusable (!do_lso_send) */ 16131 tcp->tcp_last_sent_len = (ushort_t)len; 16132 16133 len += total_hdr_len; 16134 ixa->ixa_pktlen = len; 16135 16136 if (ixa->ixa_flags & IXAF_IS_IPV4) { 16137 tcp->tcp_ipha->ipha_length = htons(len); 16138 } else { 16139 tcp->tcp_ip6h->ip6_plen = htons(len - IPV6_HDR_LEN); 16140 } 16141 16142 mp = dupb(*xmit_tail); 16143 if (mp == NULL) { 16144 return (-1); /* out_of_mem */ 16145 } 16146 16147 len = total_hdr_len; 16148 /* 16149 * There are four reasons to allocate a new hdr mblk: 16150 * 1) The bytes above us are in use by another packet 16151 * 2) We don't have good alignment 16152 * 3) The mblk is being shared 16153 * 4) We don't have enough room for a header 16154 */ 16155 rptr = mp->b_rptr - len; 16156 if (!OK_32PTR(rptr) || 16157 ((db = mp->b_datap), db->db_ref != 2) || 16158 rptr < db->db_base) { 16159 /* NOTE: we assume allocb returns an OK_32PTR */ 16160 16161 must_alloc:; 16162 mp1 = allocb(connp->conn_ht_iphc_allocated + 16163 tcps->tcps_wroff_xtra, BPRI_MED); 16164 if (mp1 == NULL) { 16165 freemsg(mp); 16166 return (-1); /* out_of_mem */ 16167 } 16168 mp1->b_cont = mp; 16169 mp = mp1; 16170 /* Leave room for Link Level header */ 16171 len = total_hdr_len; 16172 rptr = &mp->b_rptr[tcps->tcps_wroff_xtra]; 16173 mp->b_wptr = &rptr[len]; 16174 } 16175 16176 /* 16177 * Fill in the header using the template header, and add 16178 * options such as time-stamp, ECN and/or SACK, as needed. 16179 */ 16180 tcp_fill_header(tcp, rptr, (clock_t)local_time, num_sack_blk); 16181 16182 mp->b_rptr = rptr; 16183 16184 if (*tail_unsent) { 16185 int spill = *tail_unsent; 16186 16187 mp1 = mp->b_cont; 16188 if (mp1 == NULL) 16189 mp1 = mp; 16190 16191 /* 16192 * If we're a little short, tack on more mblks until 16193 * there is no more spillover. 16194 */ 16195 while (spill < 0) { 16196 mblk_t *nmp; 16197 int nmpsz; 16198 16199 nmp = (*xmit_tail)->b_cont; 16200 nmpsz = MBLKL(nmp); 16201 16202 /* 16203 * Excess data in mblk; can we split it? 16204 * If LSO is enabled for the connection, 16205 * keep on splitting as this is a transient 16206 * send path. 16207 */ 16208 if (!do_lso_send && (spill + nmpsz > 0)) { 16209 /* 16210 * Don't split if stream head was 16211 * told to break up larger writes 16212 * into smaller ones. 16213 */ 16214 if (tcp->tcp_maxpsz_multiplier > 0) 16215 break; 16216 16217 /* 16218 * Next mblk is less than SMSS/2 16219 * rounded up to nearest 64-byte; 16220 * let it get sent as part of the 16221 * next segment. 16222 */ 16223 if (tcp->tcp_localnet && 16224 !tcp->tcp_cork && 16225 (nmpsz < roundup((mss >> 1), 64))) 16226 break; 16227 } 16228 16229 *xmit_tail = nmp; 16230 ASSERT((uintptr_t)nmpsz <= (uintptr_t)INT_MAX); 16231 /* Stash for rtt use later */ 16232 (*xmit_tail)->b_prev = local_time; 16233 (*xmit_tail)->b_next = 16234 (mblk_t *)(uintptr_t)(*snxt - len); 16235 mp1->b_cont = dupb(*xmit_tail); 16236 mp1 = mp1->b_cont; 16237 16238 spill += nmpsz; 16239 if (mp1 == NULL) { 16240 *tail_unsent = spill; 16241 freemsg(mp); 16242 return (-1); /* out_of_mem */ 16243 } 16244 } 16245 16246 /* Trim back any surplus on the last mblk */ 16247 if (spill >= 0) { 16248 mp1->b_wptr -= spill; 16249 *tail_unsent = spill; 16250 } else { 16251 /* 16252 * We did not send everything we could in 16253 * order to remain within the b_cont limit. 16254 */ 16255 *usable -= spill; 16256 *snxt += spill; 16257 tcp->tcp_last_sent_len += spill; 16258 UPDATE_MIB(&tcps->tcps_mib, 16259 tcpOutDataBytes, spill); 16260 /* 16261 * Adjust the checksum 16262 */ 16263 tcpha = (tcpha_t *)(rptr + 16264 ixa->ixa_ip_hdr_length); 16265 sum += spill; 16266 sum = (sum >> 16) + (sum & 0xFFFF); 16267 tcpha->tha_sum = htons(sum); 16268 if (connp->conn_ipversion == IPV4_VERSION) { 16269 sum = ntohs( 16270 ((ipha_t *)rptr)->ipha_length) + 16271 spill; 16272 ((ipha_t *)rptr)->ipha_length = 16273 htons(sum); 16274 } else { 16275 sum = ntohs( 16276 ((ip6_t *)rptr)->ip6_plen) + 16277 spill; 16278 ((ip6_t *)rptr)->ip6_plen = 16279 htons(sum); 16280 } 16281 ixa->ixa_pktlen += spill; 16282 *tail_unsent = 0; 16283 } 16284 } 16285 if (tcp->tcp_ip_forward_progress) { 16286 tcp->tcp_ip_forward_progress = B_FALSE; 16287 ixa->ixa_flags |= IXAF_REACH_CONF; 16288 } else { 16289 ixa->ixa_flags &= ~IXAF_REACH_CONF; 16290 } 16291 16292 /* 16293 * Append LSO information, both flags and mss, to the mp. 16294 */ 16295 if (do_lso_send) { 16296 lso_info_set(mp, mss, HW_LSO); 16297 ixa->ixa_fragsize = IP_MAXPACKET; 16298 ixa->ixa_extra_ident = num_lso_seg - 1; 16299 16300 DTRACE_PROBE2(tcp_send_lso, int, num_lso_seg, 16301 boolean_t, B_TRUE); 16302 16303 tcp_send_data(tcp, mp); 16304 16305 /* 16306 * Restore values of ixa_fragsize and ixa_extra_ident. 16307 */ 16308 ixa->ixa_fragsize = ixa->ixa_pmtu; 16309 ixa->ixa_extra_ident = 0; 16310 tcp->tcp_obsegs += num_lso_seg; 16311 TCP_STAT(tcps, tcp_lso_times); 16312 TCP_STAT_UPDATE(tcps, tcp_lso_pkt_out, num_lso_seg); 16313 } else { 16314 tcp_send_data(tcp, mp); 16315 BUMP_LOCAL(tcp->tcp_obsegs); 16316 } 16317 } 16318 16319 return (0); 16320 } 16321 16322 /* tcp_wput_flush is called by tcp_wput_nondata to handle M_FLUSH messages. */ 16323 static void 16324 tcp_wput_flush(tcp_t *tcp, mblk_t *mp) 16325 { 16326 uchar_t fval = *mp->b_rptr; 16327 mblk_t *tail; 16328 conn_t *connp = tcp->tcp_connp; 16329 queue_t *q = connp->conn_wq; 16330 16331 /* TODO: How should flush interact with urgent data? */ 16332 if ((fval & FLUSHW) && tcp->tcp_xmit_head && 16333 !(tcp->tcp_valid_bits & TCP_URG_VALID)) { 16334 /* 16335 * Flush only data that has not yet been put on the wire. If 16336 * we flush data that we have already transmitted, life, as we 16337 * know it, may come to an end. 16338 */ 16339 tail = tcp->tcp_xmit_tail; 16340 tail->b_wptr -= tcp->tcp_xmit_tail_unsent; 16341 tcp->tcp_xmit_tail_unsent = 0; 16342 tcp->tcp_unsent = 0; 16343 if (tail->b_wptr != tail->b_rptr) 16344 tail = tail->b_cont; 16345 if (tail) { 16346 mblk_t **excess = &tcp->tcp_xmit_head; 16347 for (;;) { 16348 mblk_t *mp1 = *excess; 16349 if (mp1 == tail) 16350 break; 16351 tcp->tcp_xmit_tail = mp1; 16352 tcp->tcp_xmit_last = mp1; 16353 excess = &mp1->b_cont; 16354 } 16355 *excess = NULL; 16356 tcp_close_mpp(&tail); 16357 if (tcp->tcp_snd_zcopy_aware) 16358 tcp_zcopy_notify(tcp); 16359 } 16360 /* 16361 * We have no unsent data, so unsent must be less than 16362 * conn_sndlowat, so re-enable flow. 16363 */ 16364 mutex_enter(&tcp->tcp_non_sq_lock); 16365 if (tcp->tcp_flow_stopped) { 16366 tcp_clrqfull(tcp); 16367 } 16368 mutex_exit(&tcp->tcp_non_sq_lock); 16369 } 16370 /* 16371 * TODO: you can't just flush these, you have to increase rwnd for one 16372 * thing. For another, how should urgent data interact? 16373 */ 16374 if (fval & FLUSHR) { 16375 *mp->b_rptr = fval & ~FLUSHW; 16376 /* XXX */ 16377 qreply(q, mp); 16378 return; 16379 } 16380 freemsg(mp); 16381 } 16382 16383 /* 16384 * tcp_wput_iocdata is called by tcp_wput_nondata to handle all M_IOCDATA 16385 * messages. 16386 */ 16387 static void 16388 tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp) 16389 { 16390 mblk_t *mp1; 16391 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 16392 STRUCT_HANDLE(strbuf, sb); 16393 uint_t addrlen; 16394 conn_t *connp = tcp->tcp_connp; 16395 queue_t *q = connp->conn_wq; 16396 16397 /* Make sure it is one of ours. */ 16398 switch (iocp->ioc_cmd) { 16399 case TI_GETMYNAME: 16400 case TI_GETPEERNAME: 16401 break; 16402 default: 16403 ip_wput_nondata(q, mp); 16404 return; 16405 } 16406 switch (mi_copy_state(q, mp, &mp1)) { 16407 case -1: 16408 return; 16409 case MI_COPY_CASE(MI_COPY_IN, 1): 16410 break; 16411 case MI_COPY_CASE(MI_COPY_OUT, 1): 16412 /* Copy out the strbuf. */ 16413 mi_copyout(q, mp); 16414 return; 16415 case MI_COPY_CASE(MI_COPY_OUT, 2): 16416 /* All done. */ 16417 mi_copy_done(q, mp, 0); 16418 return; 16419 default: 16420 mi_copy_done(q, mp, EPROTO); 16421 return; 16422 } 16423 /* Check alignment of the strbuf */ 16424 if (!OK_32PTR(mp1->b_rptr)) { 16425 mi_copy_done(q, mp, EINVAL); 16426 return; 16427 } 16428 16429 STRUCT_SET_HANDLE(sb, iocp->ioc_flag, (void *)mp1->b_rptr); 16430 16431 if (connp->conn_family == AF_INET) 16432 addrlen = sizeof (sin_t); 16433 else 16434 addrlen = sizeof (sin6_t); 16435 16436 if (STRUCT_FGET(sb, maxlen) < addrlen) { 16437 mi_copy_done(q, mp, EINVAL); 16438 return; 16439 } 16440 16441 switch (iocp->ioc_cmd) { 16442 case TI_GETMYNAME: 16443 break; 16444 case TI_GETPEERNAME: 16445 if (tcp->tcp_state < TCPS_SYN_RCVD) { 16446 mi_copy_done(q, mp, ENOTCONN); 16447 return; 16448 } 16449 break; 16450 } 16451 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 16452 if (!mp1) 16453 return; 16454 16455 STRUCT_FSET(sb, len, addrlen); 16456 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 16457 case TI_GETMYNAME: 16458 (void) conn_getsockname(connp, (struct sockaddr *)mp1->b_wptr, 16459 &addrlen); 16460 break; 16461 case TI_GETPEERNAME: 16462 (void) conn_getpeername(connp, (struct sockaddr *)mp1->b_wptr, 16463 &addrlen); 16464 break; 16465 } 16466 mp1->b_wptr += addrlen; 16467 /* Copy out the address */ 16468 mi_copyout(q, mp); 16469 } 16470 16471 static void 16472 tcp_use_pure_tpi(tcp_t *tcp) 16473 { 16474 conn_t *connp = tcp->tcp_connp; 16475 16476 #ifdef _ILP32 16477 tcp->tcp_acceptor_id = (t_uscalar_t)connp->conn_rq; 16478 #else 16479 tcp->tcp_acceptor_id = connp->conn_dev; 16480 #endif 16481 /* 16482 * Insert this socket into the acceptor hash. 16483 * We might need it for T_CONN_RES message 16484 */ 16485 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 16486 16487 tcp->tcp_issocket = B_FALSE; 16488 TCP_STAT(tcp->tcp_tcps, tcp_sock_fallback); 16489 } 16490 16491 /* 16492 * tcp_wput_ioctl is called by tcp_wput_nondata() to handle all M_IOCTL 16493 * messages. 16494 */ 16495 /* ARGSUSED */ 16496 static void 16497 tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 16498 { 16499 conn_t *connp = (conn_t *)arg; 16500 tcp_t *tcp = connp->conn_tcp; 16501 queue_t *q = connp->conn_wq; 16502 struct iocblk *iocp; 16503 16504 ASSERT(DB_TYPE(mp) == M_IOCTL); 16505 /* 16506 * Try and ASSERT the minimum possible references on the 16507 * conn early enough. Since we are executing on write side, 16508 * the connection is obviously not detached and that means 16509 * there is a ref each for TCP and IP. Since we are behind 16510 * the squeue, the minimum references needed are 3. If the 16511 * conn is in classifier hash list, there should be an 16512 * extra ref for that (we check both the possibilities). 16513 */ 16514 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 16515 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 16516 16517 iocp = (struct iocblk *)mp->b_rptr; 16518 switch (iocp->ioc_cmd) { 16519 case _SIOCSOCKFALLBACK: 16520 /* 16521 * Either sockmod is about to be popped and the socket 16522 * would now be treated as a plain stream, or a module 16523 * is about to be pushed so we could no longer use read- 16524 * side synchronous streams for fused loopback tcp. 16525 * Drain any queued data and disable direct sockfs 16526 * interface from now on. 16527 */ 16528 if (!tcp->tcp_issocket) { 16529 DB_TYPE(mp) = M_IOCNAK; 16530 iocp->ioc_error = EINVAL; 16531 } else { 16532 tcp_use_pure_tpi(tcp); 16533 DB_TYPE(mp) = M_IOCACK; 16534 iocp->ioc_error = 0; 16535 } 16536 iocp->ioc_count = 0; 16537 iocp->ioc_rval = 0; 16538 qreply(q, mp); 16539 return; 16540 } 16541 ip_wput_nondata(q, mp); 16542 } 16543 16544 /* 16545 * This routine is called by tcp_wput() to handle all TPI requests. 16546 */ 16547 /* ARGSUSED */ 16548 static void 16549 tcp_wput_proto(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 16550 { 16551 conn_t *connp = (conn_t *)arg; 16552 tcp_t *tcp = connp->conn_tcp; 16553 union T_primitives *tprim = (union T_primitives *)mp->b_rptr; 16554 uchar_t *rptr; 16555 t_scalar_t type; 16556 cred_t *cr; 16557 16558 /* 16559 * Try and ASSERT the minimum possible references on the 16560 * conn early enough. Since we are executing on write side, 16561 * the connection is obviously not detached and that means 16562 * there is a ref each for TCP and IP. Since we are behind 16563 * the squeue, the minimum references needed are 3. If the 16564 * conn is in classifier hash list, there should be an 16565 * extra ref for that (we check both the possibilities). 16566 */ 16567 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 16568 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 16569 16570 rptr = mp->b_rptr; 16571 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 16572 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 16573 type = ((union T_primitives *)rptr)->type; 16574 if (type == T_EXDATA_REQ) { 16575 tcp_output_urgent(connp, mp, arg2, NULL); 16576 } else if (type != T_DATA_REQ) { 16577 goto non_urgent_data; 16578 } else { 16579 /* TODO: options, flags, ... from user */ 16580 /* Set length to zero for reclamation below */ 16581 tcp_wput_data(tcp, mp->b_cont, B_TRUE); 16582 freeb(mp); 16583 } 16584 return; 16585 } else { 16586 if (connp->conn_debug) { 16587 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 16588 "tcp_wput_proto, dropping one..."); 16589 } 16590 freemsg(mp); 16591 return; 16592 } 16593 16594 non_urgent_data: 16595 16596 switch ((int)tprim->type) { 16597 case T_SSL_PROXY_BIND_REQ: /* an SSL proxy endpoint bind request */ 16598 /* 16599 * save the kssl_ent_t from the next block, and convert this 16600 * back to a normal bind_req. 16601 */ 16602 if (mp->b_cont != NULL) { 16603 ASSERT(MBLKL(mp->b_cont) >= sizeof (kssl_ent_t)); 16604 16605 if (tcp->tcp_kssl_ent != NULL) { 16606 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 16607 KSSL_NO_PROXY); 16608 tcp->tcp_kssl_ent = NULL; 16609 } 16610 bcopy(mp->b_cont->b_rptr, &tcp->tcp_kssl_ent, 16611 sizeof (kssl_ent_t)); 16612 kssl_hold_ent(tcp->tcp_kssl_ent); 16613 freemsg(mp->b_cont); 16614 mp->b_cont = NULL; 16615 } 16616 tprim->type = T_BIND_REQ; 16617 16618 /* FALLTHROUGH */ 16619 case O_T_BIND_REQ: /* bind request */ 16620 case T_BIND_REQ: /* new semantics bind request */ 16621 tcp_tpi_bind(tcp, mp); 16622 break; 16623 case T_UNBIND_REQ: /* unbind request */ 16624 tcp_tpi_unbind(tcp, mp); 16625 break; 16626 case O_T_CONN_RES: /* old connection response XXX */ 16627 case T_CONN_RES: /* connection response */ 16628 tcp_tli_accept(tcp, mp); 16629 break; 16630 case T_CONN_REQ: /* connection request */ 16631 tcp_tpi_connect(tcp, mp); 16632 break; 16633 case T_DISCON_REQ: /* disconnect request */ 16634 tcp_disconnect(tcp, mp); 16635 break; 16636 case T_CAPABILITY_REQ: 16637 tcp_capability_req(tcp, mp); /* capability request */ 16638 break; 16639 case T_INFO_REQ: /* information request */ 16640 tcp_info_req(tcp, mp); 16641 break; 16642 case T_SVR4_OPTMGMT_REQ: /* manage options req */ 16643 case T_OPTMGMT_REQ: 16644 /* 16645 * Note: no support for snmpcom_req() through new 16646 * T_OPTMGMT_REQ. See comments in ip.c 16647 */ 16648 16649 /* 16650 * All Solaris components should pass a db_credp 16651 * for this TPI message, hence we ASSERT. 16652 * But in case there is some other M_PROTO that looks 16653 * like a TPI message sent by some other kernel 16654 * component, we check and return an error. 16655 */ 16656 cr = msg_getcred(mp, NULL); 16657 ASSERT(cr != NULL); 16658 if (cr == NULL) { 16659 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 16660 return; 16661 } 16662 /* 16663 * If EINPROGRESS is returned, the request has been queued 16664 * for subsequent processing by ip_restart_optmgmt(), which 16665 * will do the CONN_DEC_REF(). 16666 */ 16667 if ((int)tprim->type == T_SVR4_OPTMGMT_REQ) { 16668 svr4_optcom_req(connp->conn_wq, mp, cr, &tcp_opt_obj); 16669 } else { 16670 tpi_optcom_req(connp->conn_wq, mp, cr, &tcp_opt_obj); 16671 } 16672 break; 16673 16674 case T_UNITDATA_REQ: /* unitdata request */ 16675 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 16676 break; 16677 case T_ORDREL_REQ: /* orderly release req */ 16678 freemsg(mp); 16679 16680 if (tcp->tcp_fused) 16681 tcp_unfuse(tcp); 16682 16683 if (tcp_xmit_end(tcp) != 0) { 16684 /* 16685 * We were crossing FINs and got a reset from 16686 * the other side. Just ignore it. 16687 */ 16688 if (connp->conn_debug) { 16689 (void) strlog(TCP_MOD_ID, 0, 1, 16690 SL_ERROR|SL_TRACE, 16691 "tcp_wput_proto, T_ORDREL_REQ out of " 16692 "state %s", 16693 tcp_display(tcp, NULL, 16694 DISP_ADDR_AND_PORT)); 16695 } 16696 } 16697 break; 16698 case T_ADDR_REQ: 16699 tcp_addr_req(tcp, mp); 16700 break; 16701 default: 16702 if (connp->conn_debug) { 16703 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 16704 "tcp_wput_proto, bogus TPI msg, type %d", 16705 tprim->type); 16706 } 16707 /* 16708 * We used to M_ERROR. Sending TNOTSUPPORT gives the user 16709 * to recover. 16710 */ 16711 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 16712 break; 16713 } 16714 } 16715 16716 /* 16717 * The TCP write service routine should never be called... 16718 */ 16719 /* ARGSUSED */ 16720 static void 16721 tcp_wsrv(queue_t *q) 16722 { 16723 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 16724 16725 TCP_STAT(tcps, tcp_wsrv_called); 16726 } 16727 16728 /* 16729 * Send out a control packet on the tcp connection specified. This routine 16730 * is typically called where we need a simple ACK or RST generated. 16731 */ 16732 static void 16733 tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl) 16734 { 16735 uchar_t *rptr; 16736 tcpha_t *tcpha; 16737 ipha_t *ipha = NULL; 16738 ip6_t *ip6h = NULL; 16739 uint32_t sum; 16740 int total_hdr_len; 16741 int ip_hdr_len; 16742 mblk_t *mp; 16743 tcp_stack_t *tcps = tcp->tcp_tcps; 16744 conn_t *connp = tcp->tcp_connp; 16745 ip_xmit_attr_t *ixa = connp->conn_ixa; 16746 16747 /* 16748 * Save sum for use in source route later. 16749 */ 16750 sum = connp->conn_ht_ulp_len + connp->conn_sum; 16751 total_hdr_len = connp->conn_ht_iphc_len; 16752 ip_hdr_len = ixa->ixa_ip_hdr_length; 16753 16754 /* If a text string is passed in with the request, pass it to strlog. */ 16755 if (str != NULL && connp->conn_debug) { 16756 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 16757 "tcp_xmit_ctl: '%s', seq 0x%x, ack 0x%x, ctl 0x%x", 16758 str, seq, ack, ctl); 16759 } 16760 mp = allocb(connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra, 16761 BPRI_MED); 16762 if (mp == NULL) { 16763 return; 16764 } 16765 rptr = &mp->b_rptr[tcps->tcps_wroff_xtra]; 16766 mp->b_rptr = rptr; 16767 mp->b_wptr = &rptr[total_hdr_len]; 16768 bcopy(connp->conn_ht_iphc, rptr, total_hdr_len); 16769 16770 ixa->ixa_pktlen = total_hdr_len; 16771 16772 if (ixa->ixa_flags & IXAF_IS_IPV4) { 16773 ipha = (ipha_t *)rptr; 16774 ipha->ipha_length = htons(total_hdr_len); 16775 } else { 16776 ip6h = (ip6_t *)rptr; 16777 ip6h->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN); 16778 } 16779 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 16780 tcpha->tha_flags = (uint8_t)ctl; 16781 if (ctl & TH_RST) { 16782 BUMP_MIB(&tcps->tcps_mib, tcpOutRsts); 16783 BUMP_MIB(&tcps->tcps_mib, tcpOutControl); 16784 /* 16785 * Don't send TSopt w/ TH_RST packets per RFC 1323. 16786 */ 16787 if (tcp->tcp_snd_ts_ok && 16788 tcp->tcp_state > TCPS_SYN_SENT) { 16789 mp->b_wptr = &rptr[total_hdr_len - TCPOPT_REAL_TS_LEN]; 16790 *(mp->b_wptr) = TCPOPT_EOL; 16791 16792 ixa->ixa_pktlen = total_hdr_len - TCPOPT_REAL_TS_LEN; 16793 16794 if (connp->conn_ipversion == IPV4_VERSION) { 16795 ipha->ipha_length = htons(total_hdr_len - 16796 TCPOPT_REAL_TS_LEN); 16797 } else { 16798 ip6h->ip6_plen = htons(total_hdr_len - 16799 IPV6_HDR_LEN - TCPOPT_REAL_TS_LEN); 16800 } 16801 tcpha->tha_offset_and_reserved -= (3 << 4); 16802 sum -= TCPOPT_REAL_TS_LEN; 16803 } 16804 } 16805 if (ctl & TH_ACK) { 16806 if (tcp->tcp_snd_ts_ok) { 16807 uint32_t llbolt = (uint32_t)ddi_get_lbolt(); 16808 16809 U32_TO_BE32(llbolt, 16810 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 16811 U32_TO_BE32(tcp->tcp_ts_recent, 16812 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 16813 } 16814 16815 /* Update the latest receive window size in TCP header. */ 16816 tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 16817 tcp->tcp_rack = ack; 16818 tcp->tcp_rack_cnt = 0; 16819 BUMP_MIB(&tcps->tcps_mib, tcpOutAck); 16820 } 16821 BUMP_LOCAL(tcp->tcp_obsegs); 16822 tcpha->tha_seq = htonl(seq); 16823 tcpha->tha_ack = htonl(ack); 16824 /* 16825 * Include the adjustment for a source route if any. 16826 */ 16827 sum = (sum >> 16) + (sum & 0xFFFF); 16828 tcpha->tha_sum = htons(sum); 16829 tcp_send_data(tcp, mp); 16830 } 16831 16832 /* 16833 * If this routine returns B_TRUE, TCP can generate a RST in response 16834 * to a segment. If it returns B_FALSE, TCP should not respond. 16835 */ 16836 static boolean_t 16837 tcp_send_rst_chk(tcp_stack_t *tcps) 16838 { 16839 clock_t now; 16840 16841 /* 16842 * TCP needs to protect itself from generating too many RSTs. 16843 * This can be a DoS attack by sending us random segments 16844 * soliciting RSTs. 16845 * 16846 * What we do here is to have a limit of tcp_rst_sent_rate RSTs 16847 * in each 1 second interval. In this way, TCP still generate 16848 * RSTs in normal cases but when under attack, the impact is 16849 * limited. 16850 */ 16851 if (tcps->tcps_rst_sent_rate_enabled != 0) { 16852 now = ddi_get_lbolt(); 16853 /* lbolt can wrap around. */ 16854 if ((tcps->tcps_last_rst_intrvl > now) || 16855 (TICK_TO_MSEC(now - tcps->tcps_last_rst_intrvl) > 16856 1*SECONDS)) { 16857 tcps->tcps_last_rst_intrvl = now; 16858 tcps->tcps_rst_cnt = 1; 16859 } else if (++tcps->tcps_rst_cnt > tcps->tcps_rst_sent_rate) { 16860 return (B_FALSE); 16861 } 16862 } 16863 return (B_TRUE); 16864 } 16865 16866 /* 16867 * Generate a reset based on an inbound packet, connp is set by caller 16868 * when RST is in response to an unexpected inbound packet for which 16869 * there is active tcp state in the system. 16870 * 16871 * IPSEC NOTE : Try to send the reply with the same protection as it came 16872 * in. We have the ip_recv_attr_t which is reversed to form the ip_xmit_attr_t. 16873 * That way the packet will go out at the same level of protection as it 16874 * came in with. 16875 */ 16876 static void 16877 tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq, uint32_t ack, int ctl, 16878 ip_recv_attr_t *ira, ip_stack_t *ipst, conn_t *connp) 16879 { 16880 ipha_t *ipha = NULL; 16881 ip6_t *ip6h = NULL; 16882 ushort_t len; 16883 tcpha_t *tcpha; 16884 int i; 16885 ipaddr_t v4addr; 16886 in6_addr_t v6addr; 16887 netstack_t *ns = ipst->ips_netstack; 16888 tcp_stack_t *tcps = ns->netstack_tcp; 16889 ip_xmit_attr_t ixas, *ixa; 16890 uint_t ip_hdr_len = ira->ira_ip_hdr_length; 16891 boolean_t need_refrele = B_FALSE; /* ixa_refrele(ixa) */ 16892 ushort_t port; 16893 16894 if (!tcp_send_rst_chk(tcps)) { 16895 tcps->tcps_rst_unsent++; 16896 freemsg(mp); 16897 return; 16898 } 16899 16900 /* 16901 * If connp != NULL we use conn_ixa to keep IP_NEXTHOP and other 16902 * options from the listener. In that case the caller must ensure that 16903 * we are running on the listener = connp squeue. 16904 * 16905 * We get a safe copy of conn_ixa so we don't need to restore anything 16906 * we or ip_output_simple might change in the ixa. 16907 */ 16908 if (connp != NULL) { 16909 ASSERT(connp->conn_on_sqp); 16910 16911 ixa = conn_get_ixa_exclusive(connp); 16912 if (ixa == NULL) { 16913 tcps->tcps_rst_unsent++; 16914 freemsg(mp); 16915 return; 16916 } 16917 need_refrele = B_TRUE; 16918 } else { 16919 bzero(&ixas, sizeof (ixas)); 16920 ixa = &ixas; 16921 /* 16922 * IXAF_VERIFY_SOURCE is overkill since we know the 16923 * packet was for us. 16924 */ 16925 ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE; 16926 ixa->ixa_protocol = IPPROTO_TCP; 16927 ixa->ixa_zoneid = ira->ira_zoneid; 16928 ixa->ixa_ifindex = 0; 16929 ixa->ixa_ipst = ipst; 16930 ixa->ixa_cred = kcred; 16931 ixa->ixa_cpid = NOPID; 16932 } 16933 16934 if (str && tcps->tcps_dbg) { 16935 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 16936 "tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, " 16937 "flags 0x%x", 16938 str, seq, ack, ctl); 16939 } 16940 if (mp->b_datap->db_ref != 1) { 16941 mblk_t *mp1 = copyb(mp); 16942 freemsg(mp); 16943 mp = mp1; 16944 if (mp == NULL) 16945 goto done; 16946 } else if (mp->b_cont) { 16947 freemsg(mp->b_cont); 16948 mp->b_cont = NULL; 16949 DB_CKSUMFLAGS(mp) = 0; 16950 } 16951 /* 16952 * We skip reversing source route here. 16953 * (for now we replace all IP options with EOL) 16954 */ 16955 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 16956 ipha = (ipha_t *)mp->b_rptr; 16957 for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++) 16958 mp->b_rptr[i] = IPOPT_EOL; 16959 /* 16960 * Make sure that src address isn't flagrantly invalid. 16961 * Not all broadcast address checking for the src address 16962 * is possible, since we don't know the netmask of the src 16963 * addr. No check for destination address is done, since 16964 * IP will not pass up a packet with a broadcast dest 16965 * address to TCP. Similar checks are done below for IPv6. 16966 */ 16967 if (ipha->ipha_src == 0 || ipha->ipha_src == INADDR_BROADCAST || 16968 CLASSD(ipha->ipha_src)) { 16969 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); 16970 ip_drop_input("ipIfStatsInDiscards", mp, NULL); 16971 freemsg(mp); 16972 goto done; 16973 } 16974 } else { 16975 ip6h = (ip6_t *)mp->b_rptr; 16976 16977 if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) || 16978 IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src)) { 16979 BUMP_MIB(&ipst->ips_ip6_mib, ipIfStatsInDiscards); 16980 ip_drop_input("ipIfStatsInDiscards", mp, NULL); 16981 freemsg(mp); 16982 goto done; 16983 } 16984 16985 /* Remove any extension headers assuming partial overlay */ 16986 if (ip_hdr_len > IPV6_HDR_LEN) { 16987 uint8_t *to; 16988 16989 to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN; 16990 ovbcopy(ip6h, to, IPV6_HDR_LEN); 16991 mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN; 16992 ip_hdr_len = IPV6_HDR_LEN; 16993 ip6h = (ip6_t *)mp->b_rptr; 16994 ip6h->ip6_nxt = IPPROTO_TCP; 16995 } 16996 } 16997 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len]; 16998 if (tcpha->tha_flags & TH_RST) { 16999 freemsg(mp); 17000 goto done; 17001 } 17002 tcpha->tha_offset_and_reserved = (5 << 4); 17003 len = ip_hdr_len + sizeof (tcpha_t); 17004 mp->b_wptr = &mp->b_rptr[len]; 17005 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 17006 ipha->ipha_length = htons(len); 17007 /* Swap addresses */ 17008 v4addr = ipha->ipha_src; 17009 ipha->ipha_src = ipha->ipha_dst; 17010 ipha->ipha_dst = v4addr; 17011 ipha->ipha_ident = 0; 17012 ipha->ipha_ttl = (uchar_t)tcps->tcps_ipv4_ttl; 17013 ixa->ixa_flags |= IXAF_IS_IPV4; 17014 ixa->ixa_ip_hdr_length = ip_hdr_len; 17015 } else { 17016 ip6h->ip6_plen = htons(len - IPV6_HDR_LEN); 17017 /* Swap addresses */ 17018 v6addr = ip6h->ip6_src; 17019 ip6h->ip6_src = ip6h->ip6_dst; 17020 ip6h->ip6_dst = v6addr; 17021 ip6h->ip6_hops = (uchar_t)tcps->tcps_ipv6_hoplimit; 17022 ixa->ixa_flags &= ~IXAF_IS_IPV4; 17023 17024 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_dst)) { 17025 ixa->ixa_flags |= IXAF_SCOPEID_SET; 17026 ixa->ixa_scopeid = ira->ira_ruifindex; 17027 } 17028 ixa->ixa_ip_hdr_length = IPV6_HDR_LEN; 17029 } 17030 ixa->ixa_pktlen = len; 17031 17032 /* Swap the ports */ 17033 port = tcpha->tha_fport; 17034 tcpha->tha_fport = tcpha->tha_lport; 17035 tcpha->tha_lport = port; 17036 17037 tcpha->tha_ack = htonl(ack); 17038 tcpha->tha_seq = htonl(seq); 17039 tcpha->tha_win = 0; 17040 tcpha->tha_sum = htons(sizeof (tcpha_t)); 17041 tcpha->tha_flags = (uint8_t)ctl; 17042 if (ctl & TH_RST) { 17043 BUMP_MIB(&tcps->tcps_mib, tcpOutRsts); 17044 BUMP_MIB(&tcps->tcps_mib, tcpOutControl); 17045 } 17046 17047 /* Discard any old label */ 17048 if (ixa->ixa_free_flags & IXA_FREE_TSL) { 17049 ASSERT(ixa->ixa_tsl != NULL); 17050 label_rele(ixa->ixa_tsl); 17051 ixa->ixa_free_flags &= ~IXA_FREE_TSL; 17052 } 17053 ixa->ixa_tsl = ira->ira_tsl; /* Behave as a multi-level responder */ 17054 17055 if (ira->ira_flags & IRAF_IPSEC_SECURE) { 17056 /* 17057 * Apply IPsec based on how IPsec was applied to 17058 * the packet that caused the RST. 17059 */ 17060 if (!ipsec_in_to_out(ira, ixa, mp, ipha, ip6h)) { 17061 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsOutDiscards); 17062 /* Note: mp already consumed and ip_drop_packet done */ 17063 goto done; 17064 } 17065 } else { 17066 /* 17067 * This is in clear. The RST message we are building 17068 * here should go out in clear, independent of our policy. 17069 */ 17070 ixa->ixa_flags |= IXAF_NO_IPSEC; 17071 } 17072 17073 /* 17074 * NOTE: one might consider tracing a TCP packet here, but 17075 * this function has no active TCP state and no tcp structure 17076 * that has a trace buffer. If we traced here, we would have 17077 * to keep a local trace buffer in tcp_record_trace(). 17078 */ 17079 17080 (void) ip_output_simple(mp, ixa); 17081 done: 17082 ixa_cleanup(ixa); 17083 if (need_refrele) { 17084 ASSERT(ixa != &ixas); 17085 ixa_refrele(ixa); 17086 } 17087 } 17088 17089 /* 17090 * Initiate closedown sequence on an active connection. (May be called as 17091 * writer.) Return value zero for OK return, non-zero for error return. 17092 */ 17093 static int 17094 tcp_xmit_end(tcp_t *tcp) 17095 { 17096 mblk_t *mp; 17097 tcp_stack_t *tcps = tcp->tcp_tcps; 17098 iulp_t uinfo; 17099 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 17100 conn_t *connp = tcp->tcp_connp; 17101 17102 if (tcp->tcp_state < TCPS_SYN_RCVD || 17103 tcp->tcp_state > TCPS_CLOSE_WAIT) { 17104 /* 17105 * Invalid state, only states TCPS_SYN_RCVD, 17106 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid 17107 */ 17108 return (-1); 17109 } 17110 17111 tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent; 17112 tcp->tcp_valid_bits |= TCP_FSS_VALID; 17113 /* 17114 * If there is nothing more unsent, send the FIN now. 17115 * Otherwise, it will go out with the last segment. 17116 */ 17117 if (tcp->tcp_unsent == 0) { 17118 mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 17119 tcp->tcp_fss, B_FALSE, NULL, B_FALSE); 17120 17121 if (mp) { 17122 tcp_send_data(tcp, mp); 17123 } else { 17124 /* 17125 * Couldn't allocate msg. Pretend we got it out. 17126 * Wait for rexmit timeout. 17127 */ 17128 tcp->tcp_snxt = tcp->tcp_fss + 1; 17129 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 17130 } 17131 17132 /* 17133 * If needed, update tcp_rexmit_snxt as tcp_snxt is 17134 * changed. 17135 */ 17136 if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) { 17137 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 17138 } 17139 } else { 17140 /* 17141 * If tcp->tcp_cork is set, then the data will not get sent, 17142 * so we have to check that and unset it first. 17143 */ 17144 if (tcp->tcp_cork) 17145 tcp->tcp_cork = B_FALSE; 17146 tcp_wput_data(tcp, NULL, B_FALSE); 17147 } 17148 17149 /* 17150 * If TCP does not get enough samples of RTT or tcp_rtt_updates 17151 * is 0, don't update the cache. 17152 */ 17153 if (tcps->tcps_rtt_updates == 0 || 17154 tcp->tcp_rtt_update < tcps->tcps_rtt_updates) 17155 return (0); 17156 17157 /* 17158 * We do not have a good algorithm to update ssthresh at this time. 17159 * So don't do any update. 17160 */ 17161 bzero(&uinfo, sizeof (uinfo)); 17162 uinfo.iulp_rtt = tcp->tcp_rtt_sa; 17163 uinfo.iulp_rtt_sd = tcp->tcp_rtt_sd; 17164 17165 /* 17166 * Note that uinfo is kept for conn_faddr in the DCE. Could update even 17167 * if source routed but we don't. 17168 */ 17169 if (connp->conn_ipversion == IPV4_VERSION) { 17170 if (connp->conn_faddr_v4 != tcp->tcp_ipha->ipha_dst) { 17171 return (0); 17172 } 17173 (void) dce_update_uinfo_v4(connp->conn_faddr_v4, &uinfo, ipst); 17174 } else { 17175 uint_t ifindex; 17176 17177 if (!(IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, 17178 &tcp->tcp_ip6h->ip6_dst))) { 17179 return (0); 17180 } 17181 ifindex = 0; 17182 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_faddr_v6)) { 17183 ip_xmit_attr_t *ixa = connp->conn_ixa; 17184 17185 /* 17186 * If we are going to create a DCE we'd better have 17187 * an ifindex 17188 */ 17189 if (ixa->ixa_nce != NULL) { 17190 ifindex = ixa->ixa_nce->nce_common->ncec_ill-> 17191 ill_phyint->phyint_ifindex; 17192 } else { 17193 return (0); 17194 } 17195 } 17196 17197 (void) dce_update_uinfo(&connp->conn_faddr_v6, ifindex, &uinfo, 17198 ipst); 17199 } 17200 return (0); 17201 } 17202 17203 /* 17204 * Generate a "no listener here" RST in response to an "unknown" segment. 17205 * connp is set by caller when RST is in response to an unexpected 17206 * inbound packet for which there is active tcp state in the system. 17207 * Note that we are reusing the incoming mp to construct the outgoing RST. 17208 */ 17209 void 17210 tcp_xmit_listeners_reset(mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst, 17211 conn_t *connp) 17212 { 17213 uchar_t *rptr; 17214 uint32_t seg_len; 17215 tcpha_t *tcpha; 17216 uint32_t seg_seq; 17217 uint32_t seg_ack; 17218 uint_t flags; 17219 ipha_t *ipha; 17220 ip6_t *ip6h; 17221 boolean_t policy_present; 17222 netstack_t *ns = ipst->ips_netstack; 17223 tcp_stack_t *tcps = ns->netstack_tcp; 17224 ipsec_stack_t *ipss = tcps->tcps_netstack->netstack_ipsec; 17225 uint_t ip_hdr_len = ira->ira_ip_hdr_length; 17226 17227 TCP_STAT(tcps, tcp_no_listener); 17228 17229 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 17230 policy_present = ipss->ipsec_inbound_v4_policy_present; 17231 ipha = (ipha_t *)mp->b_rptr; 17232 ip6h = NULL; 17233 } else { 17234 policy_present = ipss->ipsec_inbound_v6_policy_present; 17235 ipha = NULL; 17236 ip6h = (ip6_t *)mp->b_rptr; 17237 } 17238 17239 if (policy_present) { 17240 /* 17241 * The conn_t parameter is NULL because we already know 17242 * nobody's home. 17243 */ 17244 mp = ipsec_check_global_policy(mp, (conn_t *)NULL, ipha, ip6h, 17245 ira, ns); 17246 if (mp == NULL) 17247 return; 17248 } 17249 if (is_system_labeled() && !tsol_can_reply_error(mp, ira)) { 17250 DTRACE_PROBE2( 17251 tx__ip__log__error__nolistener__tcp, 17252 char *, "Could not reply with RST to mp(1)", 17253 mblk_t *, mp); 17254 ip2dbg(("tcp_xmit_listeners_reset: not permitted to reply\n")); 17255 freemsg(mp); 17256 return; 17257 } 17258 17259 rptr = mp->b_rptr; 17260 17261 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 17262 seg_seq = ntohl(tcpha->tha_seq); 17263 seg_ack = ntohl(tcpha->tha_ack); 17264 flags = tcpha->tha_flags; 17265 17266 seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcpha) + ip_hdr_len); 17267 if (flags & TH_RST) { 17268 freemsg(mp); 17269 } else if (flags & TH_ACK) { 17270 tcp_xmit_early_reset("no tcp, reset", mp, seg_ack, 0, TH_RST, 17271 ira, ipst, connp); 17272 } else { 17273 if (flags & TH_SYN) { 17274 seg_len++; 17275 } else { 17276 /* 17277 * Here we violate the RFC. Note that a normal 17278 * TCP will never send a segment without the ACK 17279 * flag, except for RST or SYN segment. This 17280 * segment is neither. Just drop it on the 17281 * floor. 17282 */ 17283 freemsg(mp); 17284 tcps->tcps_rst_unsent++; 17285 return; 17286 } 17287 17288 tcp_xmit_early_reset("no tcp, reset/ack", mp, 0, 17289 seg_seq + seg_len, TH_RST | TH_ACK, ira, ipst, connp); 17290 } 17291 } 17292 17293 /* 17294 * tcp_xmit_mp is called to return a pointer to an mblk chain complete with 17295 * ip and tcp header ready to pass down to IP. If the mp passed in is 17296 * non-NULL, then up to max_to_send bytes of data will be dup'ed off that 17297 * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary 17298 * otherwise it will dup partial mblks.) 17299 * Otherwise, an appropriate ACK packet will be generated. This 17300 * routine is not usually called to send new data for the first time. It 17301 * is mostly called out of the timer for retransmits, and to generate ACKs. 17302 * 17303 * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will 17304 * be adjusted by *offset. And after dupb(), the offset and the ending mblk 17305 * of the original mblk chain will be returned in *offset and *end_mp. 17306 */ 17307 mblk_t * 17308 tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset, 17309 mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len, 17310 boolean_t rexmit) 17311 { 17312 int data_length; 17313 int32_t off = 0; 17314 uint_t flags; 17315 mblk_t *mp1; 17316 mblk_t *mp2; 17317 uchar_t *rptr; 17318 tcpha_t *tcpha; 17319 int32_t num_sack_blk = 0; 17320 int32_t sack_opt_len = 0; 17321 tcp_stack_t *tcps = tcp->tcp_tcps; 17322 conn_t *connp = tcp->tcp_connp; 17323 ip_xmit_attr_t *ixa = connp->conn_ixa; 17324 17325 /* Allocate for our maximum TCP header + link-level */ 17326 mp1 = allocb(connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra, 17327 BPRI_MED); 17328 if (!mp1) 17329 return (NULL); 17330 data_length = 0; 17331 17332 /* 17333 * Note that tcp_mss has been adjusted to take into account the 17334 * timestamp option if applicable. Because SACK options do not 17335 * appear in every TCP segments and they are of variable lengths, 17336 * they cannot be included in tcp_mss. Thus we need to calculate 17337 * the actual segment length when we need to send a segment which 17338 * includes SACK options. 17339 */ 17340 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 17341 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 17342 tcp->tcp_num_sack_blk); 17343 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 17344 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 17345 if (max_to_send + sack_opt_len > tcp->tcp_mss) 17346 max_to_send -= sack_opt_len; 17347 } 17348 17349 if (offset != NULL) { 17350 off = *offset; 17351 /* We use offset as an indicator that end_mp is not NULL. */ 17352 *end_mp = NULL; 17353 } 17354 for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) { 17355 /* This could be faster with cooperation from downstream */ 17356 if (mp2 != mp1 && !sendall && 17357 data_length + (int)(mp->b_wptr - mp->b_rptr) > 17358 max_to_send) 17359 /* 17360 * Don't send the next mblk since the whole mblk 17361 * does not fit. 17362 */ 17363 break; 17364 mp2->b_cont = dupb(mp); 17365 mp2 = mp2->b_cont; 17366 if (!mp2) { 17367 freemsg(mp1); 17368 return (NULL); 17369 } 17370 mp2->b_rptr += off; 17371 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 17372 (uintptr_t)INT_MAX); 17373 17374 data_length += (int)(mp2->b_wptr - mp2->b_rptr); 17375 if (data_length > max_to_send) { 17376 mp2->b_wptr -= data_length - max_to_send; 17377 data_length = max_to_send; 17378 off = mp2->b_wptr - mp->b_rptr; 17379 break; 17380 } else { 17381 off = 0; 17382 } 17383 } 17384 if (offset != NULL) { 17385 *offset = off; 17386 *end_mp = mp; 17387 } 17388 if (seg_len != NULL) { 17389 *seg_len = data_length; 17390 } 17391 17392 /* Update the latest receive window size in TCP header. */ 17393 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 17394 17395 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra; 17396 mp1->b_rptr = rptr; 17397 mp1->b_wptr = rptr + connp->conn_ht_iphc_len + sack_opt_len; 17398 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len); 17399 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length]; 17400 tcpha->tha_seq = htonl(seq); 17401 17402 /* 17403 * Use tcp_unsent to determine if the PUSH bit should be used assumes 17404 * that this function was called from tcp_wput_data. Thus, when called 17405 * to retransmit data the setting of the PUSH bit may appear some 17406 * what random in that it might get set when it should not. This 17407 * should not pose any performance issues. 17408 */ 17409 if (data_length != 0 && (tcp->tcp_unsent == 0 || 17410 tcp->tcp_unsent == data_length)) { 17411 flags = TH_ACK | TH_PUSH; 17412 } else { 17413 flags = TH_ACK; 17414 } 17415 17416 if (tcp->tcp_ecn_ok) { 17417 if (tcp->tcp_ecn_echo_on) 17418 flags |= TH_ECE; 17419 17420 /* 17421 * Only set ECT bit and ECN_CWR if a segment contains new data. 17422 * There is no TCP flow control for non-data segments, and 17423 * only data segment is transmitted reliably. 17424 */ 17425 if (data_length > 0 && !rexmit) { 17426 SET_ECT(tcp, rptr); 17427 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 17428 flags |= TH_CWR; 17429 tcp->tcp_ecn_cwr_sent = B_TRUE; 17430 } 17431 } 17432 } 17433 17434 if (tcp->tcp_valid_bits) { 17435 uint32_t u1; 17436 17437 if ((tcp->tcp_valid_bits & TCP_ISS_VALID) && 17438 seq == tcp->tcp_iss) { 17439 uchar_t *wptr; 17440 17441 /* 17442 * If TCP_ISS_VALID and the seq number is tcp_iss, 17443 * TCP can only be in SYN-SENT, SYN-RCVD or 17444 * FIN-WAIT-1 state. It can be FIN-WAIT-1 if 17445 * our SYN is not ack'ed but the app closes this 17446 * TCP connection. 17447 */ 17448 ASSERT(tcp->tcp_state == TCPS_SYN_SENT || 17449 tcp->tcp_state == TCPS_SYN_RCVD || 17450 tcp->tcp_state == TCPS_FIN_WAIT_1); 17451 17452 /* 17453 * Tack on the MSS option. It is always needed 17454 * for both active and passive open. 17455 * 17456 * MSS option value should be interface MTU - MIN 17457 * TCP/IP header according to RFC 793 as it means 17458 * the maximum segment size TCP can receive. But 17459 * to get around some broken middle boxes/end hosts 17460 * out there, we allow the option value to be the 17461 * same as the MSS option size on the peer side. 17462 * In this way, the other side will not send 17463 * anything larger than they can receive. 17464 * 17465 * Note that for SYN_SENT state, the ndd param 17466 * tcp_use_smss_as_mss_opt has no effect as we 17467 * don't know the peer's MSS option value. So 17468 * the only case we need to take care of is in 17469 * SYN_RCVD state, which is done later. 17470 */ 17471 wptr = mp1->b_wptr; 17472 wptr[0] = TCPOPT_MAXSEG; 17473 wptr[1] = TCPOPT_MAXSEG_LEN; 17474 wptr += 2; 17475 u1 = tcp->tcp_initial_pmtu - 17476 (connp->conn_ipversion == IPV4_VERSION ? 17477 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) - 17478 TCP_MIN_HEADER_LENGTH; 17479 U16_TO_BE16(u1, wptr); 17480 mp1->b_wptr = wptr + 2; 17481 /* Update the offset to cover the additional word */ 17482 tcpha->tha_offset_and_reserved += (1 << 4); 17483 17484 /* 17485 * Note that the following way of filling in 17486 * TCP options are not optimal. Some NOPs can 17487 * be saved. But there is no need at this time 17488 * to optimize it. When it is needed, we will 17489 * do it. 17490 */ 17491 switch (tcp->tcp_state) { 17492 case TCPS_SYN_SENT: 17493 flags = TH_SYN; 17494 17495 if (tcp->tcp_snd_ts_ok) { 17496 uint32_t llbolt = 17497 (uint32_t)ddi_get_lbolt(); 17498 17499 wptr = mp1->b_wptr; 17500 wptr[0] = TCPOPT_NOP; 17501 wptr[1] = TCPOPT_NOP; 17502 wptr[2] = TCPOPT_TSTAMP; 17503 wptr[3] = TCPOPT_TSTAMP_LEN; 17504 wptr += 4; 17505 U32_TO_BE32(llbolt, wptr); 17506 wptr += 4; 17507 ASSERT(tcp->tcp_ts_recent == 0); 17508 U32_TO_BE32(0L, wptr); 17509 mp1->b_wptr += TCPOPT_REAL_TS_LEN; 17510 tcpha->tha_offset_and_reserved += 17511 (3 << 4); 17512 } 17513 17514 /* 17515 * Set up all the bits to tell other side 17516 * we are ECN capable. 17517 */ 17518 if (tcp->tcp_ecn_ok) { 17519 flags |= (TH_ECE | TH_CWR); 17520 } 17521 break; 17522 case TCPS_SYN_RCVD: 17523 flags |= TH_SYN; 17524 17525 /* 17526 * Reset the MSS option value to be SMSS 17527 * We should probably add back the bytes 17528 * for timestamp option and IPsec. We 17529 * don't do that as this is a workaround 17530 * for broken middle boxes/end hosts, it 17531 * is better for us to be more cautious. 17532 * They may not take these things into 17533 * account in their SMSS calculation. Thus 17534 * the peer's calculated SMSS may be smaller 17535 * than what it can be. This should be OK. 17536 */ 17537 if (tcps->tcps_use_smss_as_mss_opt) { 17538 u1 = tcp->tcp_mss; 17539 U16_TO_BE16(u1, wptr); 17540 } 17541 17542 /* 17543 * If the other side is ECN capable, reply 17544 * that we are also ECN capable. 17545 */ 17546 if (tcp->tcp_ecn_ok) 17547 flags |= TH_ECE; 17548 break; 17549 default: 17550 /* 17551 * The above ASSERT() makes sure that this 17552 * must be FIN-WAIT-1 state. Our SYN has 17553 * not been ack'ed so retransmit it. 17554 */ 17555 flags |= TH_SYN; 17556 break; 17557 } 17558 17559 if (tcp->tcp_snd_ws_ok) { 17560 wptr = mp1->b_wptr; 17561 wptr[0] = TCPOPT_NOP; 17562 wptr[1] = TCPOPT_WSCALE; 17563 wptr[2] = TCPOPT_WS_LEN; 17564 wptr[3] = (uchar_t)tcp->tcp_rcv_ws; 17565 mp1->b_wptr += TCPOPT_REAL_WS_LEN; 17566 tcpha->tha_offset_and_reserved += (1 << 4); 17567 } 17568 17569 if (tcp->tcp_snd_sack_ok) { 17570 wptr = mp1->b_wptr; 17571 wptr[0] = TCPOPT_NOP; 17572 wptr[1] = TCPOPT_NOP; 17573 wptr[2] = TCPOPT_SACK_PERMITTED; 17574 wptr[3] = TCPOPT_SACK_OK_LEN; 17575 mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN; 17576 tcpha->tha_offset_and_reserved += (1 << 4); 17577 } 17578 17579 /* allocb() of adequate mblk assures space */ 17580 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 17581 (uintptr_t)INT_MAX); 17582 u1 = (int)(mp1->b_wptr - mp1->b_rptr); 17583 /* 17584 * Get IP set to checksum on our behalf 17585 * Include the adjustment for a source route if any. 17586 */ 17587 u1 += connp->conn_sum; 17588 u1 = (u1 >> 16) + (u1 & 0xFFFF); 17589 tcpha->tha_sum = htons(u1); 17590 BUMP_MIB(&tcps->tcps_mib, tcpOutControl); 17591 } 17592 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 17593 (seq + data_length) == tcp->tcp_fss) { 17594 if (!tcp->tcp_fin_acked) { 17595 flags |= TH_FIN; 17596 BUMP_MIB(&tcps->tcps_mib, tcpOutControl); 17597 } 17598 if (!tcp->tcp_fin_sent) { 17599 tcp->tcp_fin_sent = B_TRUE; 17600 switch (tcp->tcp_state) { 17601 case TCPS_SYN_RCVD: 17602 case TCPS_ESTABLISHED: 17603 tcp->tcp_state = TCPS_FIN_WAIT_1; 17604 break; 17605 case TCPS_CLOSE_WAIT: 17606 tcp->tcp_state = TCPS_LAST_ACK; 17607 break; 17608 } 17609 if (tcp->tcp_suna == tcp->tcp_snxt) 17610 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 17611 tcp->tcp_snxt = tcp->tcp_fss + 1; 17612 } 17613 } 17614 /* 17615 * Note the trick here. u1 is unsigned. When tcp_urg 17616 * is smaller than seq, u1 will become a very huge value. 17617 * So the comparison will fail. Also note that tcp_urp 17618 * should be positive, see RFC 793 page 17. 17619 */ 17620 u1 = tcp->tcp_urg - seq + TCP_OLD_URP_INTERPRETATION; 17621 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && u1 != 0 && 17622 u1 < (uint32_t)(64 * 1024)) { 17623 flags |= TH_URG; 17624 BUMP_MIB(&tcps->tcps_mib, tcpOutUrg); 17625 tcpha->tha_urp = htons(u1); 17626 } 17627 } 17628 tcpha->tha_flags = (uchar_t)flags; 17629 tcp->tcp_rack = tcp->tcp_rnxt; 17630 tcp->tcp_rack_cnt = 0; 17631 17632 if (tcp->tcp_snd_ts_ok) { 17633 if (tcp->tcp_state != TCPS_SYN_SENT) { 17634 uint32_t llbolt = (uint32_t)ddi_get_lbolt(); 17635 17636 U32_TO_BE32(llbolt, 17637 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 17638 U32_TO_BE32(tcp->tcp_ts_recent, 17639 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 17640 } 17641 } 17642 17643 if (num_sack_blk > 0) { 17644 uchar_t *wptr = (uchar_t *)tcpha + connp->conn_ht_ulp_len; 17645 sack_blk_t *tmp; 17646 int32_t i; 17647 17648 wptr[0] = TCPOPT_NOP; 17649 wptr[1] = TCPOPT_NOP; 17650 wptr[2] = TCPOPT_SACK; 17651 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 17652 sizeof (sack_blk_t); 17653 wptr += TCPOPT_REAL_SACK_LEN; 17654 17655 tmp = tcp->tcp_sack_list; 17656 for (i = 0; i < num_sack_blk; i++) { 17657 U32_TO_BE32(tmp[i].begin, wptr); 17658 wptr += sizeof (tcp_seq); 17659 U32_TO_BE32(tmp[i].end, wptr); 17660 wptr += sizeof (tcp_seq); 17661 } 17662 tcpha->tha_offset_and_reserved += ((num_sack_blk * 2 + 1) << 4); 17663 } 17664 ASSERT((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX); 17665 data_length += (int)(mp1->b_wptr - rptr); 17666 17667 ixa->ixa_pktlen = data_length; 17668 17669 if (ixa->ixa_flags & IXAF_IS_IPV4) { 17670 ((ipha_t *)rptr)->ipha_length = htons(data_length); 17671 } else { 17672 ip6_t *ip6 = (ip6_t *)rptr; 17673 17674 ip6->ip6_plen = htons(data_length - IPV6_HDR_LEN); 17675 } 17676 17677 /* 17678 * Prime pump for IP 17679 * Include the adjustment for a source route if any. 17680 */ 17681 data_length -= ixa->ixa_ip_hdr_length; 17682 data_length += connp->conn_sum; 17683 data_length = (data_length >> 16) + (data_length & 0xFFFF); 17684 tcpha->tha_sum = htons(data_length); 17685 if (tcp->tcp_ip_forward_progress) { 17686 tcp->tcp_ip_forward_progress = B_FALSE; 17687 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF; 17688 } else { 17689 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF; 17690 } 17691 return (mp1); 17692 } 17693 17694 /* This function handles the push timeout. */ 17695 void 17696 tcp_push_timer(void *arg) 17697 { 17698 conn_t *connp = (conn_t *)arg; 17699 tcp_t *tcp = connp->conn_tcp; 17700 17701 TCP_DBGSTAT(tcp->tcp_tcps, tcp_push_timer_cnt); 17702 17703 ASSERT(tcp->tcp_listener == NULL); 17704 17705 ASSERT(!IPCL_IS_NONSTR(connp)); 17706 17707 tcp->tcp_push_tid = 0; 17708 17709 if (tcp->tcp_rcv_list != NULL && 17710 tcp_rcv_drain(tcp) == TH_ACK_NEEDED) 17711 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 17712 } 17713 17714 /* 17715 * This function handles delayed ACK timeout. 17716 */ 17717 static void 17718 tcp_ack_timer(void *arg) 17719 { 17720 conn_t *connp = (conn_t *)arg; 17721 tcp_t *tcp = connp->conn_tcp; 17722 mblk_t *mp; 17723 tcp_stack_t *tcps = tcp->tcp_tcps; 17724 17725 TCP_DBGSTAT(tcps, tcp_ack_timer_cnt); 17726 17727 tcp->tcp_ack_tid = 0; 17728 17729 if (tcp->tcp_fused) 17730 return; 17731 17732 /* 17733 * Do not send ACK if there is no outstanding unack'ed data. 17734 */ 17735 if (tcp->tcp_rnxt == tcp->tcp_rack) { 17736 return; 17737 } 17738 17739 if ((tcp->tcp_rnxt - tcp->tcp_rack) > tcp->tcp_mss) { 17740 /* 17741 * Make sure we don't allow deferred ACKs to result in 17742 * timer-based ACKing. If we have held off an ACK 17743 * when there was more than an mss here, and the timer 17744 * goes off, we have to worry about the possibility 17745 * that the sender isn't doing slow-start, or is out 17746 * of step with us for some other reason. We fall 17747 * permanently back in the direction of 17748 * ACK-every-other-packet as suggested in RFC 1122. 17749 */ 17750 if (tcp->tcp_rack_abs_max > 2) 17751 tcp->tcp_rack_abs_max--; 17752 tcp->tcp_rack_cur_max = 2; 17753 } 17754 mp = tcp_ack_mp(tcp); 17755 17756 if (mp != NULL) { 17757 BUMP_LOCAL(tcp->tcp_obsegs); 17758 BUMP_MIB(&tcps->tcps_mib, tcpOutAck); 17759 BUMP_MIB(&tcps->tcps_mib, tcpOutAckDelayed); 17760 tcp_send_data(tcp, mp); 17761 } 17762 } 17763 17764 17765 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 17766 static mblk_t * 17767 tcp_ack_mp(tcp_t *tcp) 17768 { 17769 uint32_t seq_no; 17770 tcp_stack_t *tcps = tcp->tcp_tcps; 17771 conn_t *connp = tcp->tcp_connp; 17772 17773 /* 17774 * There are a few cases to be considered while setting the sequence no. 17775 * Essentially, we can come here while processing an unacceptable pkt 17776 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 17777 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 17778 * If we are here for a zero window probe, stick with suna. In all 17779 * other cases, we check if suna + swnd encompasses snxt and set 17780 * the sequence number to snxt, if so. If snxt falls outside the 17781 * window (the receiver probably shrunk its window), we will go with 17782 * suna + swnd, otherwise the sequence no will be unacceptable to the 17783 * receiver. 17784 */ 17785 if (tcp->tcp_zero_win_probe) { 17786 seq_no = tcp->tcp_suna; 17787 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 17788 ASSERT(tcp->tcp_swnd == 0); 17789 seq_no = tcp->tcp_snxt; 17790 } else { 17791 seq_no = SEQ_GT(tcp->tcp_snxt, 17792 (tcp->tcp_suna + tcp->tcp_swnd)) ? 17793 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 17794 } 17795 17796 if (tcp->tcp_valid_bits) { 17797 /* 17798 * For the complex case where we have to send some 17799 * controls (FIN or SYN), let tcp_xmit_mp do it. 17800 */ 17801 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 17802 NULL, B_FALSE)); 17803 } else { 17804 /* Generate a simple ACK */ 17805 int data_length; 17806 uchar_t *rptr; 17807 tcpha_t *tcpha; 17808 mblk_t *mp1; 17809 int32_t total_hdr_len; 17810 int32_t tcp_hdr_len; 17811 int32_t num_sack_blk = 0; 17812 int32_t sack_opt_len; 17813 ip_xmit_attr_t *ixa = connp->conn_ixa; 17814 17815 /* 17816 * Allocate space for TCP + IP headers 17817 * and link-level header 17818 */ 17819 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 17820 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 17821 tcp->tcp_num_sack_blk); 17822 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 17823 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 17824 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len; 17825 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len; 17826 } else { 17827 total_hdr_len = connp->conn_ht_iphc_len; 17828 tcp_hdr_len = connp->conn_ht_ulp_len; 17829 } 17830 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED); 17831 if (!mp1) 17832 return (NULL); 17833 17834 /* Update the latest receive window size in TCP header. */ 17835 tcp->tcp_tcpha->tha_win = 17836 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 17837 /* copy in prototype TCP + IP header */ 17838 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra; 17839 mp1->b_rptr = rptr; 17840 mp1->b_wptr = rptr + total_hdr_len; 17841 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len); 17842 17843 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length]; 17844 17845 /* Set the TCP sequence number. */ 17846 tcpha->tha_seq = htonl(seq_no); 17847 17848 /* Set up the TCP flag field. */ 17849 tcpha->tha_flags = (uchar_t)TH_ACK; 17850 if (tcp->tcp_ecn_echo_on) 17851 tcpha->tha_flags |= TH_ECE; 17852 17853 tcp->tcp_rack = tcp->tcp_rnxt; 17854 tcp->tcp_rack_cnt = 0; 17855 17856 /* fill in timestamp option if in use */ 17857 if (tcp->tcp_snd_ts_ok) { 17858 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH; 17859 17860 U32_TO_BE32(llbolt, 17861 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 17862 U32_TO_BE32(tcp->tcp_ts_recent, 17863 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 17864 } 17865 17866 /* Fill in SACK options */ 17867 if (num_sack_blk > 0) { 17868 uchar_t *wptr = (uchar_t *)tcpha + 17869 connp->conn_ht_ulp_len; 17870 sack_blk_t *tmp; 17871 int32_t i; 17872 17873 wptr[0] = TCPOPT_NOP; 17874 wptr[1] = TCPOPT_NOP; 17875 wptr[2] = TCPOPT_SACK; 17876 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 17877 sizeof (sack_blk_t); 17878 wptr += TCPOPT_REAL_SACK_LEN; 17879 17880 tmp = tcp->tcp_sack_list; 17881 for (i = 0; i < num_sack_blk; i++) { 17882 U32_TO_BE32(tmp[i].begin, wptr); 17883 wptr += sizeof (tcp_seq); 17884 U32_TO_BE32(tmp[i].end, wptr); 17885 wptr += sizeof (tcp_seq); 17886 } 17887 tcpha->tha_offset_and_reserved += 17888 ((num_sack_blk * 2 + 1) << 4); 17889 } 17890 17891 ixa->ixa_pktlen = total_hdr_len; 17892 17893 if (ixa->ixa_flags & IXAF_IS_IPV4) { 17894 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len); 17895 } else { 17896 ip6_t *ip6 = (ip6_t *)rptr; 17897 17898 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN); 17899 } 17900 17901 /* 17902 * Prime pump for checksum calculation in IP. Include the 17903 * adjustment for a source route if any. 17904 */ 17905 data_length = tcp_hdr_len + connp->conn_sum; 17906 data_length = (data_length >> 16) + (data_length & 0xFFFF); 17907 tcpha->tha_sum = htons(data_length); 17908 17909 if (tcp->tcp_ip_forward_progress) { 17910 tcp->tcp_ip_forward_progress = B_FALSE; 17911 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF; 17912 } else { 17913 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF; 17914 } 17915 return (mp1); 17916 } 17917 } 17918 17919 /* 17920 * Hash list insertion routine for tcp_t structures. Each hash bucket 17921 * contains a list of tcp_t entries, and each entry is bound to a unique 17922 * port. If there are multiple tcp_t's that are bound to the same port, then 17923 * one of them will be linked into the hash bucket list, and the rest will 17924 * hang off of that one entry. For each port, entries bound to a specific IP 17925 * address will be inserted before those those bound to INADDR_ANY. 17926 */ 17927 static void 17928 tcp_bind_hash_insert(tf_t *tbf, tcp_t *tcp, int caller_holds_lock) 17929 { 17930 tcp_t **tcpp; 17931 tcp_t *tcpnext; 17932 tcp_t *tcphash; 17933 conn_t *connp = tcp->tcp_connp; 17934 conn_t *connext; 17935 17936 if (tcp->tcp_ptpbhn != NULL) { 17937 ASSERT(!caller_holds_lock); 17938 tcp_bind_hash_remove(tcp); 17939 } 17940 tcpp = &tbf->tf_tcp; 17941 if (!caller_holds_lock) { 17942 mutex_enter(&tbf->tf_lock); 17943 } else { 17944 ASSERT(MUTEX_HELD(&tbf->tf_lock)); 17945 } 17946 tcphash = tcpp[0]; 17947 tcpnext = NULL; 17948 if (tcphash != NULL) { 17949 /* Look for an entry using the same port */ 17950 while ((tcphash = tcpp[0]) != NULL && 17951 connp->conn_lport != tcphash->tcp_connp->conn_lport) 17952 tcpp = &(tcphash->tcp_bind_hash); 17953 17954 /* The port was not found, just add to the end */ 17955 if (tcphash == NULL) 17956 goto insert; 17957 17958 /* 17959 * OK, there already exists an entry bound to the 17960 * same port. 17961 * 17962 * If the new tcp bound to the INADDR_ANY address 17963 * and the first one in the list is not bound to 17964 * INADDR_ANY we skip all entries until we find the 17965 * first one bound to INADDR_ANY. 17966 * This makes sure that applications binding to a 17967 * specific address get preference over those binding to 17968 * INADDR_ANY. 17969 */ 17970 tcpnext = tcphash; 17971 connext = tcpnext->tcp_connp; 17972 tcphash = NULL; 17973 if (V6_OR_V4_INADDR_ANY(connp->conn_bound_addr_v6) && 17974 !V6_OR_V4_INADDR_ANY(connext->conn_bound_addr_v6)) { 17975 while ((tcpnext = tcpp[0]) != NULL) { 17976 connext = tcpnext->tcp_connp; 17977 if (!V6_OR_V4_INADDR_ANY( 17978 connext->conn_bound_addr_v6)) 17979 tcpp = &(tcpnext->tcp_bind_hash_port); 17980 else 17981 break; 17982 } 17983 if (tcpnext != NULL) { 17984 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash_port; 17985 tcphash = tcpnext->tcp_bind_hash; 17986 if (tcphash != NULL) { 17987 tcphash->tcp_ptpbhn = 17988 &(tcp->tcp_bind_hash); 17989 tcpnext->tcp_bind_hash = NULL; 17990 } 17991 } 17992 } else { 17993 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash_port; 17994 tcphash = tcpnext->tcp_bind_hash; 17995 if (tcphash != NULL) { 17996 tcphash->tcp_ptpbhn = 17997 &(tcp->tcp_bind_hash); 17998 tcpnext->tcp_bind_hash = NULL; 17999 } 18000 } 18001 } 18002 insert: 18003 tcp->tcp_bind_hash_port = tcpnext; 18004 tcp->tcp_bind_hash = tcphash; 18005 tcp->tcp_ptpbhn = tcpp; 18006 tcpp[0] = tcp; 18007 if (!caller_holds_lock) 18008 mutex_exit(&tbf->tf_lock); 18009 } 18010 18011 /* 18012 * Hash list removal routine for tcp_t structures. 18013 */ 18014 static void 18015 tcp_bind_hash_remove(tcp_t *tcp) 18016 { 18017 tcp_t *tcpnext; 18018 kmutex_t *lockp; 18019 tcp_stack_t *tcps = tcp->tcp_tcps; 18020 conn_t *connp = tcp->tcp_connp; 18021 18022 if (tcp->tcp_ptpbhn == NULL) 18023 return; 18024 18025 /* 18026 * Extract the lock pointer in case there are concurrent 18027 * hash_remove's for this instance. 18028 */ 18029 ASSERT(connp->conn_lport != 0); 18030 lockp = &tcps->tcps_bind_fanout[TCP_BIND_HASH( 18031 connp->conn_lport)].tf_lock; 18032 18033 ASSERT(lockp != NULL); 18034 mutex_enter(lockp); 18035 if (tcp->tcp_ptpbhn) { 18036 tcpnext = tcp->tcp_bind_hash_port; 18037 if (tcpnext != NULL) { 18038 tcp->tcp_bind_hash_port = NULL; 18039 tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn; 18040 tcpnext->tcp_bind_hash = tcp->tcp_bind_hash; 18041 if (tcpnext->tcp_bind_hash != NULL) { 18042 tcpnext->tcp_bind_hash->tcp_ptpbhn = 18043 &(tcpnext->tcp_bind_hash); 18044 tcp->tcp_bind_hash = NULL; 18045 } 18046 } else if ((tcpnext = tcp->tcp_bind_hash) != NULL) { 18047 tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn; 18048 tcp->tcp_bind_hash = NULL; 18049 } 18050 *tcp->tcp_ptpbhn = tcpnext; 18051 tcp->tcp_ptpbhn = NULL; 18052 } 18053 mutex_exit(lockp); 18054 } 18055 18056 18057 /* 18058 * Hash list lookup routine for tcp_t structures. 18059 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 18060 */ 18061 static tcp_t * 18062 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps) 18063 { 18064 tf_t *tf; 18065 tcp_t *tcp; 18066 18067 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 18068 mutex_enter(&tf->tf_lock); 18069 for (tcp = tf->tf_tcp; tcp != NULL; 18070 tcp = tcp->tcp_acceptor_hash) { 18071 if (tcp->tcp_acceptor_id == id) { 18072 CONN_INC_REF(tcp->tcp_connp); 18073 mutex_exit(&tf->tf_lock); 18074 return (tcp); 18075 } 18076 } 18077 mutex_exit(&tf->tf_lock); 18078 return (NULL); 18079 } 18080 18081 18082 /* 18083 * Hash list insertion routine for tcp_t structures. 18084 */ 18085 void 18086 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 18087 { 18088 tf_t *tf; 18089 tcp_t **tcpp; 18090 tcp_t *tcpnext; 18091 tcp_stack_t *tcps = tcp->tcp_tcps; 18092 18093 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 18094 18095 if (tcp->tcp_ptpahn != NULL) 18096 tcp_acceptor_hash_remove(tcp); 18097 tcpp = &tf->tf_tcp; 18098 mutex_enter(&tf->tf_lock); 18099 tcpnext = tcpp[0]; 18100 if (tcpnext) 18101 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 18102 tcp->tcp_acceptor_hash = tcpnext; 18103 tcp->tcp_ptpahn = tcpp; 18104 tcpp[0] = tcp; 18105 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 18106 mutex_exit(&tf->tf_lock); 18107 } 18108 18109 /* 18110 * Hash list removal routine for tcp_t structures. 18111 */ 18112 static void 18113 tcp_acceptor_hash_remove(tcp_t *tcp) 18114 { 18115 tcp_t *tcpnext; 18116 kmutex_t *lockp; 18117 18118 /* 18119 * Extract the lock pointer in case there are concurrent 18120 * hash_remove's for this instance. 18121 */ 18122 lockp = tcp->tcp_acceptor_lockp; 18123 18124 if (tcp->tcp_ptpahn == NULL) 18125 return; 18126 18127 ASSERT(lockp != NULL); 18128 mutex_enter(lockp); 18129 if (tcp->tcp_ptpahn) { 18130 tcpnext = tcp->tcp_acceptor_hash; 18131 if (tcpnext) { 18132 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 18133 tcp->tcp_acceptor_hash = NULL; 18134 } 18135 *tcp->tcp_ptpahn = tcpnext; 18136 tcp->tcp_ptpahn = NULL; 18137 } 18138 mutex_exit(lockp); 18139 tcp->tcp_acceptor_lockp = NULL; 18140 } 18141 18142 /* 18143 * Type three generator adapted from the random() function in 4.4 BSD: 18144 */ 18145 18146 /* 18147 * Copyright (c) 1983, 1993 18148 * The Regents of the University of California. All rights reserved. 18149 * 18150 * Redistribution and use in source and binary forms, with or without 18151 * modification, are permitted provided that the following conditions 18152 * are met: 18153 * 1. Redistributions of source code must retain the above copyright 18154 * notice, this list of conditions and the following disclaimer. 18155 * 2. Redistributions in binary form must reproduce the above copyright 18156 * notice, this list of conditions and the following disclaimer in the 18157 * documentation and/or other materials provided with the distribution. 18158 * 3. All advertising materials mentioning features or use of this software 18159 * must display the following acknowledgement: 18160 * This product includes software developed by the University of 18161 * California, Berkeley and its contributors. 18162 * 4. Neither the name of the University nor the names of its contributors 18163 * may be used to endorse or promote products derived from this software 18164 * without specific prior written permission. 18165 * 18166 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 18167 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 18168 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 18169 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 18170 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 18171 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 18172 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 18173 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 18174 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 18175 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 18176 * SUCH DAMAGE. 18177 */ 18178 18179 /* Type 3 -- x**31 + x**3 + 1 */ 18180 #define DEG_3 31 18181 #define SEP_3 3 18182 18183 18184 /* Protected by tcp_random_lock */ 18185 static int tcp_randtbl[DEG_3 + 1]; 18186 18187 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 18188 static int *tcp_random_rptr = &tcp_randtbl[1]; 18189 18190 static int *tcp_random_state = &tcp_randtbl[1]; 18191 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 18192 18193 kmutex_t tcp_random_lock; 18194 18195 void 18196 tcp_random_init(void) 18197 { 18198 int i; 18199 hrtime_t hrt; 18200 time_t wallclock; 18201 uint64_t result; 18202 18203 /* 18204 * Use high-res timer and current time for seed. Gethrtime() returns 18205 * a longlong, which may contain resolution down to nanoseconds. 18206 * The current time will either be a 32-bit or a 64-bit quantity. 18207 * XOR the two together in a 64-bit result variable. 18208 * Convert the result to a 32-bit value by multiplying the high-order 18209 * 32-bits by the low-order 32-bits. 18210 */ 18211 18212 hrt = gethrtime(); 18213 (void) drv_getparm(TIME, &wallclock); 18214 result = (uint64_t)wallclock ^ (uint64_t)hrt; 18215 mutex_enter(&tcp_random_lock); 18216 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 18217 (result & 0xffffffff); 18218 18219 for (i = 1; i < DEG_3; i++) 18220 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 18221 + 12345; 18222 tcp_random_fptr = &tcp_random_state[SEP_3]; 18223 tcp_random_rptr = &tcp_random_state[0]; 18224 mutex_exit(&tcp_random_lock); 18225 for (i = 0; i < 10 * DEG_3; i++) 18226 (void) tcp_random(); 18227 } 18228 18229 /* 18230 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 18231 * This range is selected to be approximately centered on TCP_ISS / 2, 18232 * and easy to compute. We get this value by generating a 32-bit random 18233 * number, selecting out the high-order 17 bits, and then adding one so 18234 * that we never return zero. 18235 */ 18236 int 18237 tcp_random(void) 18238 { 18239 int i; 18240 18241 mutex_enter(&tcp_random_lock); 18242 *tcp_random_fptr += *tcp_random_rptr; 18243 18244 /* 18245 * The high-order bits are more random than the low-order bits, 18246 * so we select out the high-order 17 bits and add one so that 18247 * we never return zero. 18248 */ 18249 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 18250 if (++tcp_random_fptr >= tcp_random_end_ptr) { 18251 tcp_random_fptr = tcp_random_state; 18252 ++tcp_random_rptr; 18253 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 18254 tcp_random_rptr = tcp_random_state; 18255 18256 mutex_exit(&tcp_random_lock); 18257 return (i); 18258 } 18259 18260 static int 18261 tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp, 18262 int *t_errorp, int *sys_errorp) 18263 { 18264 int error; 18265 int is_absreq_failure; 18266 t_scalar_t *opt_lenp; 18267 t_scalar_t opt_offset; 18268 int prim_type; 18269 struct T_conn_req *tcreqp; 18270 struct T_conn_res *tcresp; 18271 cred_t *cr; 18272 18273 /* 18274 * All Solaris components should pass a db_credp 18275 * for this TPI message, hence we ASSERT. 18276 * But in case there is some other M_PROTO that looks 18277 * like a TPI message sent by some other kernel 18278 * component, we check and return an error. 18279 */ 18280 cr = msg_getcred(mp, NULL); 18281 ASSERT(cr != NULL); 18282 if (cr == NULL) 18283 return (-1); 18284 18285 prim_type = ((union T_primitives *)mp->b_rptr)->type; 18286 ASSERT(prim_type == T_CONN_REQ || prim_type == O_T_CONN_RES || 18287 prim_type == T_CONN_RES); 18288 18289 switch (prim_type) { 18290 case T_CONN_REQ: 18291 tcreqp = (struct T_conn_req *)mp->b_rptr; 18292 opt_offset = tcreqp->OPT_offset; 18293 opt_lenp = (t_scalar_t *)&tcreqp->OPT_length; 18294 break; 18295 case O_T_CONN_RES: 18296 case T_CONN_RES: 18297 tcresp = (struct T_conn_res *)mp->b_rptr; 18298 opt_offset = tcresp->OPT_offset; 18299 opt_lenp = (t_scalar_t *)&tcresp->OPT_length; 18300 break; 18301 } 18302 18303 *t_errorp = 0; 18304 *sys_errorp = 0; 18305 *do_disconnectp = 0; 18306 18307 error = tpi_optcom_buf(tcp->tcp_connp->conn_wq, mp, opt_lenp, 18308 opt_offset, cr, &tcp_opt_obj, 18309 NULL, &is_absreq_failure); 18310 18311 switch (error) { 18312 case 0: /* no error */ 18313 ASSERT(is_absreq_failure == 0); 18314 return (0); 18315 case ENOPROTOOPT: 18316 *t_errorp = TBADOPT; 18317 break; 18318 case EACCES: 18319 *t_errorp = TACCES; 18320 break; 18321 default: 18322 *t_errorp = TSYSERR; *sys_errorp = error; 18323 break; 18324 } 18325 if (is_absreq_failure != 0) { 18326 /* 18327 * The connection request should get the local ack 18328 * T_OK_ACK and then a T_DISCON_IND. 18329 */ 18330 *do_disconnectp = 1; 18331 } 18332 return (-1); 18333 } 18334 18335 /* 18336 * Split this function out so that if the secret changes, I'm okay. 18337 * 18338 * Initialize the tcp_iss_cookie and tcp_iss_key. 18339 */ 18340 18341 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 18342 18343 static void 18344 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps) 18345 { 18346 struct { 18347 int32_t current_time; 18348 uint32_t randnum; 18349 uint16_t pad; 18350 uint8_t ether[6]; 18351 uint8_t passwd[PASSWD_SIZE]; 18352 } tcp_iss_cookie; 18353 time_t t; 18354 18355 /* 18356 * Start with the current absolute time. 18357 */ 18358 (void) drv_getparm(TIME, &t); 18359 tcp_iss_cookie.current_time = t; 18360 18361 /* 18362 * XXX - Need a more random number per RFC 1750, not this crap. 18363 * OTOH, if what follows is pretty random, then I'm in better shape. 18364 */ 18365 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 18366 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 18367 18368 /* 18369 * The cpu_type_info is pretty non-random. Ugggh. It does serve 18370 * as a good template. 18371 */ 18372 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 18373 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 18374 18375 /* 18376 * The pass-phrase. Normally this is supplied by user-called NDD. 18377 */ 18378 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 18379 18380 /* 18381 * See 4010593 if this section becomes a problem again, 18382 * but the local ethernet address is useful here. 18383 */ 18384 (void) localetheraddr(NULL, 18385 (struct ether_addr *)&tcp_iss_cookie.ether); 18386 18387 /* 18388 * Hash 'em all together. The MD5Final is called per-connection. 18389 */ 18390 mutex_enter(&tcps->tcps_iss_key_lock); 18391 MD5Init(&tcps->tcps_iss_key); 18392 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie, 18393 sizeof (tcp_iss_cookie)); 18394 mutex_exit(&tcps->tcps_iss_key_lock); 18395 } 18396 18397 /* 18398 * Set the RFC 1948 pass phrase 18399 */ 18400 /* ARGSUSED */ 18401 static int 18402 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 18403 cred_t *cr) 18404 { 18405 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 18406 18407 /* 18408 * Basically, value contains a new pass phrase. Pass it along! 18409 */ 18410 tcp_iss_key_init((uint8_t *)value, strlen(value), tcps); 18411 return (0); 18412 } 18413 18414 /* ARGSUSED */ 18415 static int 18416 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 18417 { 18418 bzero(buf, sizeof (tcp_sack_info_t)); 18419 return (0); 18420 } 18421 18422 /* 18423 * Called by IP when IP is loaded into the kernel 18424 */ 18425 void 18426 tcp_ddi_g_init(void) 18427 { 18428 tcp_timercache = kmem_cache_create("tcp_timercache", 18429 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 18430 NULL, NULL, NULL, NULL, NULL, 0); 18431 18432 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 18433 sizeof (tcp_sack_info_t), 0, 18434 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 18435 18436 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 18437 18438 /* Initialize the random number generator */ 18439 tcp_random_init(); 18440 18441 /* A single callback independently of how many netstacks we have */ 18442 ip_squeue_init(tcp_squeue_add); 18443 18444 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics); 18445 18446 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput); 18447 18448 /* 18449 * We want to be informed each time a stack is created or 18450 * destroyed in the kernel, so we can maintain the 18451 * set of tcp_stack_t's. 18452 */ 18453 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini); 18454 } 18455 18456 18457 #define INET_NAME "ip" 18458 18459 /* 18460 * Initialize the TCP stack instance. 18461 */ 18462 static void * 18463 tcp_stack_init(netstackid_t stackid, netstack_t *ns) 18464 { 18465 tcp_stack_t *tcps; 18466 tcpparam_t *pa; 18467 int i; 18468 int error = 0; 18469 major_t major; 18470 18471 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP); 18472 tcps->tcps_netstack = ns; 18473 18474 /* Initialize locks */ 18475 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 18476 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 18477 18478 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 18479 tcps->tcps_g_epriv_ports[0] = 2049; 18480 tcps->tcps_g_epriv_ports[1] = 4045; 18481 tcps->tcps_min_anonpriv_port = 512; 18482 18483 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) * 18484 TCP_BIND_FANOUT_SIZE, KM_SLEEP); 18485 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) * 18486 TCP_FANOUT_SIZE, KM_SLEEP); 18487 18488 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 18489 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL, 18490 MUTEX_DEFAULT, NULL); 18491 } 18492 18493 for (i = 0; i < TCP_FANOUT_SIZE; i++) { 18494 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL, 18495 MUTEX_DEFAULT, NULL); 18496 } 18497 18498 /* TCP's IPsec code calls the packet dropper. */ 18499 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement"); 18500 18501 pa = (tcpparam_t *)kmem_alloc(sizeof (lcl_tcp_param_arr), KM_SLEEP); 18502 tcps->tcps_params = pa; 18503 bcopy(lcl_tcp_param_arr, tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 18504 18505 (void) tcp_param_register(&tcps->tcps_g_nd, tcps->tcps_params, 18506 A_CNT(lcl_tcp_param_arr), tcps); 18507 18508 /* 18509 * Note: To really walk the device tree you need the devinfo 18510 * pointer to your device which is only available after probe/attach. 18511 * The following is safe only because it uses ddi_root_node() 18512 */ 18513 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 18514 tcp_opt_obj.odb_opt_arr_cnt); 18515 18516 /* 18517 * Initialize RFC 1948 secret values. This will probably be reset once 18518 * by the boot scripts. 18519 * 18520 * Use NULL name, as the name is caught by the new lockstats. 18521 * 18522 * Initialize with some random, non-guessable string, like the global 18523 * T_INFO_ACK. 18524 */ 18525 18526 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 18527 sizeof (tcp_g_t_info_ack), tcps); 18528 18529 tcps->tcps_kstat = tcp_kstat2_init(stackid, &tcps->tcps_statistics); 18530 tcps->tcps_mibkp = tcp_kstat_init(stackid, tcps); 18531 18532 major = mod_name_to_major(INET_NAME); 18533 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident); 18534 ASSERT(error == 0); 18535 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL); 18536 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL); 18537 cv_init(&tcps->tcps_ixa_cleanup_cv, NULL, CV_DEFAULT, NULL); 18538 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL); 18539 18540 return (tcps); 18541 } 18542 18543 /* 18544 * Called when the IP module is about to be unloaded. 18545 */ 18546 void 18547 tcp_ddi_g_destroy(void) 18548 { 18549 tcp_g_kstat_fini(tcp_g_kstat); 18550 tcp_g_kstat = NULL; 18551 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics)); 18552 18553 mutex_destroy(&tcp_random_lock); 18554 18555 kmem_cache_destroy(tcp_timercache); 18556 kmem_cache_destroy(tcp_sack_info_cache); 18557 18558 netstack_unregister(NS_TCP); 18559 } 18560 18561 /* 18562 * Free the TCP stack instance. 18563 */ 18564 static void 18565 tcp_stack_fini(netstackid_t stackid, void *arg) 18566 { 18567 tcp_stack_t *tcps = (tcp_stack_t *)arg; 18568 int i; 18569 18570 freeb(tcps->tcps_ixa_cleanup_mp); 18571 tcps->tcps_ixa_cleanup_mp = NULL; 18572 cv_destroy(&tcps->tcps_ixa_cleanup_cv); 18573 mutex_destroy(&tcps->tcps_ixa_cleanup_lock); 18574 18575 nd_free(&tcps->tcps_g_nd); 18576 kmem_free(tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 18577 tcps->tcps_params = NULL; 18578 kmem_free(tcps->tcps_wroff_xtra_param, sizeof (tcpparam_t)); 18579 tcps->tcps_wroff_xtra_param = NULL; 18580 18581 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 18582 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL); 18583 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock); 18584 } 18585 18586 for (i = 0; i < TCP_FANOUT_SIZE; i++) { 18587 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL); 18588 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock); 18589 } 18590 18591 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE); 18592 tcps->tcps_bind_fanout = NULL; 18593 18594 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) * TCP_FANOUT_SIZE); 18595 tcps->tcps_acceptor_fanout = NULL; 18596 18597 mutex_destroy(&tcps->tcps_iss_key_lock); 18598 mutex_destroy(&tcps->tcps_epriv_port_lock); 18599 18600 ip_drop_unregister(&tcps->tcps_dropper); 18601 18602 tcp_kstat2_fini(stackid, tcps->tcps_kstat); 18603 tcps->tcps_kstat = NULL; 18604 bzero(&tcps->tcps_statistics, sizeof (tcps->tcps_statistics)); 18605 18606 tcp_kstat_fini(stackid, tcps->tcps_mibkp); 18607 tcps->tcps_mibkp = NULL; 18608 18609 ldi_ident_release(tcps->tcps_ldi_ident); 18610 kmem_free(tcps, sizeof (*tcps)); 18611 } 18612 18613 /* 18614 * Generate ISS, taking into account NDD changes may happen halfway through. 18615 * (If the iss is not zero, set it.) 18616 */ 18617 18618 static void 18619 tcp_iss_init(tcp_t *tcp) 18620 { 18621 MD5_CTX context; 18622 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 18623 uint32_t answer[4]; 18624 tcp_stack_t *tcps = tcp->tcp_tcps; 18625 conn_t *connp = tcp->tcp_connp; 18626 18627 tcps->tcps_iss_incr_extra += (ISS_INCR >> 1); 18628 tcp->tcp_iss = tcps->tcps_iss_incr_extra; 18629 switch (tcps->tcps_strong_iss) { 18630 case 2: 18631 mutex_enter(&tcps->tcps_iss_key_lock); 18632 context = tcps->tcps_iss_key; 18633 mutex_exit(&tcps->tcps_iss_key_lock); 18634 arg.ports = connp->conn_ports; 18635 arg.src = connp->conn_laddr_v6; 18636 arg.dst = connp->conn_faddr_v6; 18637 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 18638 MD5Final((uchar_t *)answer, &context); 18639 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 18640 /* 18641 * Now that we've hashed into a unique per-connection sequence 18642 * space, add a random increment per strong_iss == 1. So I 18643 * guess we'll have to... 18644 */ 18645 /* FALLTHRU */ 18646 case 1: 18647 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 18648 break; 18649 default: 18650 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 18651 break; 18652 } 18653 tcp->tcp_valid_bits = TCP_ISS_VALID; 18654 tcp->tcp_fss = tcp->tcp_iss - 1; 18655 tcp->tcp_suna = tcp->tcp_iss; 18656 tcp->tcp_snxt = tcp->tcp_iss + 1; 18657 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 18658 tcp->tcp_csuna = tcp->tcp_snxt; 18659 } 18660 18661 /* 18662 * Exported routine for extracting active tcp connection status. 18663 * 18664 * This is used by the Solaris Cluster Networking software to 18665 * gather a list of connections that need to be forwarded to 18666 * specific nodes in the cluster when configuration changes occur. 18667 * 18668 * The callback is invoked for each tcp_t structure from all netstacks, 18669 * if 'stack_id' is less than 0. Otherwise, only for tcp_t structures 18670 * from the netstack with the specified stack_id. Returning 18671 * non-zero from the callback routine terminates the search. 18672 */ 18673 int 18674 cl_tcp_walk_list(netstackid_t stack_id, 18675 int (*cl_callback)(cl_tcp_info_t *, void *), void *arg) 18676 { 18677 netstack_handle_t nh; 18678 netstack_t *ns; 18679 int ret = 0; 18680 18681 if (stack_id >= 0) { 18682 if ((ns = netstack_find_by_stackid(stack_id)) == NULL) 18683 return (EINVAL); 18684 18685 ret = cl_tcp_walk_list_stack(cl_callback, arg, 18686 ns->netstack_tcp); 18687 netstack_rele(ns); 18688 return (ret); 18689 } 18690 18691 netstack_next_init(&nh); 18692 while ((ns = netstack_next(&nh)) != NULL) { 18693 ret = cl_tcp_walk_list_stack(cl_callback, arg, 18694 ns->netstack_tcp); 18695 netstack_rele(ns); 18696 } 18697 netstack_next_fini(&nh); 18698 return (ret); 18699 } 18700 18701 static int 18702 cl_tcp_walk_list_stack(int (*callback)(cl_tcp_info_t *, void *), void *arg, 18703 tcp_stack_t *tcps) 18704 { 18705 tcp_t *tcp; 18706 cl_tcp_info_t cl_tcpi; 18707 connf_t *connfp; 18708 conn_t *connp; 18709 int i; 18710 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 18711 18712 ASSERT(callback != NULL); 18713 18714 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 18715 connfp = &ipst->ips_ipcl_globalhash_fanout[i]; 18716 connp = NULL; 18717 18718 while ((connp = 18719 ipcl_get_next_conn(connfp, connp, IPCL_TCPCONN)) != NULL) { 18720 18721 tcp = connp->conn_tcp; 18722 cl_tcpi.cl_tcpi_version = CL_TCPI_V1; 18723 cl_tcpi.cl_tcpi_ipversion = connp->conn_ipversion; 18724 cl_tcpi.cl_tcpi_state = tcp->tcp_state; 18725 cl_tcpi.cl_tcpi_lport = connp->conn_lport; 18726 cl_tcpi.cl_tcpi_fport = connp->conn_fport; 18727 cl_tcpi.cl_tcpi_laddr_v6 = connp->conn_laddr_v6; 18728 cl_tcpi.cl_tcpi_faddr_v6 = connp->conn_faddr_v6; 18729 18730 /* 18731 * If the callback returns non-zero 18732 * we terminate the traversal. 18733 */ 18734 if ((*callback)(&cl_tcpi, arg) != 0) { 18735 CONN_DEC_REF(tcp->tcp_connp); 18736 return (1); 18737 } 18738 } 18739 } 18740 18741 return (0); 18742 } 18743 18744 /* 18745 * Macros used for accessing the different types of sockaddr 18746 * structures inside a tcp_ioc_abort_conn_t. 18747 */ 18748 #define TCP_AC_V4LADDR(acp) ((sin_t *)&(acp)->ac_local) 18749 #define TCP_AC_V4RADDR(acp) ((sin_t *)&(acp)->ac_remote) 18750 #define TCP_AC_V4LOCAL(acp) (TCP_AC_V4LADDR(acp)->sin_addr.s_addr) 18751 #define TCP_AC_V4REMOTE(acp) (TCP_AC_V4RADDR(acp)->sin_addr.s_addr) 18752 #define TCP_AC_V4LPORT(acp) (TCP_AC_V4LADDR(acp)->sin_port) 18753 #define TCP_AC_V4RPORT(acp) (TCP_AC_V4RADDR(acp)->sin_port) 18754 #define TCP_AC_V6LADDR(acp) ((sin6_t *)&(acp)->ac_local) 18755 #define TCP_AC_V6RADDR(acp) ((sin6_t *)&(acp)->ac_remote) 18756 #define TCP_AC_V6LOCAL(acp) (TCP_AC_V6LADDR(acp)->sin6_addr) 18757 #define TCP_AC_V6REMOTE(acp) (TCP_AC_V6RADDR(acp)->sin6_addr) 18758 #define TCP_AC_V6LPORT(acp) (TCP_AC_V6LADDR(acp)->sin6_port) 18759 #define TCP_AC_V6RPORT(acp) (TCP_AC_V6RADDR(acp)->sin6_port) 18760 18761 /* 18762 * Return the correct error code to mimic the behavior 18763 * of a connection reset. 18764 */ 18765 #define TCP_AC_GET_ERRCODE(state, err) { \ 18766 switch ((state)) { \ 18767 case TCPS_SYN_SENT: \ 18768 case TCPS_SYN_RCVD: \ 18769 (err) = ECONNREFUSED; \ 18770 break; \ 18771 case TCPS_ESTABLISHED: \ 18772 case TCPS_FIN_WAIT_1: \ 18773 case TCPS_FIN_WAIT_2: \ 18774 case TCPS_CLOSE_WAIT: \ 18775 (err) = ECONNRESET; \ 18776 break; \ 18777 case TCPS_CLOSING: \ 18778 case TCPS_LAST_ACK: \ 18779 case TCPS_TIME_WAIT: \ 18780 (err) = 0; \ 18781 break; \ 18782 default: \ 18783 (err) = ENXIO; \ 18784 } \ 18785 } 18786 18787 /* 18788 * Check if a tcp structure matches the info in acp. 18789 */ 18790 #define TCP_AC_ADDR_MATCH(acp, connp, tcp) \ 18791 (((acp)->ac_local.ss_family == AF_INET) ? \ 18792 ((TCP_AC_V4LOCAL((acp)) == INADDR_ANY || \ 18793 TCP_AC_V4LOCAL((acp)) == (connp)->conn_laddr_v4) && \ 18794 (TCP_AC_V4REMOTE((acp)) == INADDR_ANY || \ 18795 TCP_AC_V4REMOTE((acp)) == (connp)->conn_faddr_v4) && \ 18796 (TCP_AC_V4LPORT((acp)) == 0 || \ 18797 TCP_AC_V4LPORT((acp)) == (connp)->conn_lport) && \ 18798 (TCP_AC_V4RPORT((acp)) == 0 || \ 18799 TCP_AC_V4RPORT((acp)) == (connp)->conn_fport) && \ 18800 (acp)->ac_start <= (tcp)->tcp_state && \ 18801 (acp)->ac_end >= (tcp)->tcp_state) : \ 18802 ((IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL((acp))) || \ 18803 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6LOCAL((acp)), \ 18804 &(connp)->conn_laddr_v6)) && \ 18805 (IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE((acp))) || \ 18806 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6REMOTE((acp)), \ 18807 &(connp)->conn_faddr_v6)) && \ 18808 (TCP_AC_V6LPORT((acp)) == 0 || \ 18809 TCP_AC_V6LPORT((acp)) == (connp)->conn_lport) && \ 18810 (TCP_AC_V6RPORT((acp)) == 0 || \ 18811 TCP_AC_V6RPORT((acp)) == (connp)->conn_fport) && \ 18812 (acp)->ac_start <= (tcp)->tcp_state && \ 18813 (acp)->ac_end >= (tcp)->tcp_state)) 18814 18815 #define TCP_AC_MATCH(acp, connp, tcp) \ 18816 (((acp)->ac_zoneid == ALL_ZONES || \ 18817 (acp)->ac_zoneid == (connp)->conn_zoneid) ? \ 18818 TCP_AC_ADDR_MATCH(acp, connp, tcp) : 0) 18819 18820 /* 18821 * Build a message containing a tcp_ioc_abort_conn_t structure 18822 * which is filled in with information from acp and tp. 18823 */ 18824 static mblk_t * 18825 tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *acp, tcp_t *tp) 18826 { 18827 mblk_t *mp; 18828 tcp_ioc_abort_conn_t *tacp; 18829 18830 mp = allocb(sizeof (uint32_t) + sizeof (*acp), BPRI_LO); 18831 if (mp == NULL) 18832 return (NULL); 18833 18834 *((uint32_t *)mp->b_rptr) = TCP_IOC_ABORT_CONN; 18835 tacp = (tcp_ioc_abort_conn_t *)((uchar_t *)mp->b_rptr + 18836 sizeof (uint32_t)); 18837 18838 tacp->ac_start = acp->ac_start; 18839 tacp->ac_end = acp->ac_end; 18840 tacp->ac_zoneid = acp->ac_zoneid; 18841 18842 if (acp->ac_local.ss_family == AF_INET) { 18843 tacp->ac_local.ss_family = AF_INET; 18844 tacp->ac_remote.ss_family = AF_INET; 18845 TCP_AC_V4LOCAL(tacp) = tp->tcp_connp->conn_laddr_v4; 18846 TCP_AC_V4REMOTE(tacp) = tp->tcp_connp->conn_faddr_v4; 18847 TCP_AC_V4LPORT(tacp) = tp->tcp_connp->conn_lport; 18848 TCP_AC_V4RPORT(tacp) = tp->tcp_connp->conn_fport; 18849 } else { 18850 tacp->ac_local.ss_family = AF_INET6; 18851 tacp->ac_remote.ss_family = AF_INET6; 18852 TCP_AC_V6LOCAL(tacp) = tp->tcp_connp->conn_laddr_v6; 18853 TCP_AC_V6REMOTE(tacp) = tp->tcp_connp->conn_faddr_v6; 18854 TCP_AC_V6LPORT(tacp) = tp->tcp_connp->conn_lport; 18855 TCP_AC_V6RPORT(tacp) = tp->tcp_connp->conn_fport; 18856 } 18857 mp->b_wptr = (uchar_t *)mp->b_rptr + sizeof (uint32_t) + sizeof (*acp); 18858 return (mp); 18859 } 18860 18861 /* 18862 * Print a tcp_ioc_abort_conn_t structure. 18863 */ 18864 static void 18865 tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *acp) 18866 { 18867 char lbuf[128]; 18868 char rbuf[128]; 18869 sa_family_t af; 18870 in_port_t lport, rport; 18871 ushort_t logflags; 18872 18873 af = acp->ac_local.ss_family; 18874 18875 if (af == AF_INET) { 18876 (void) inet_ntop(af, (const void *)&TCP_AC_V4LOCAL(acp), 18877 lbuf, 128); 18878 (void) inet_ntop(af, (const void *)&TCP_AC_V4REMOTE(acp), 18879 rbuf, 128); 18880 lport = ntohs(TCP_AC_V4LPORT(acp)); 18881 rport = ntohs(TCP_AC_V4RPORT(acp)); 18882 } else { 18883 (void) inet_ntop(af, (const void *)&TCP_AC_V6LOCAL(acp), 18884 lbuf, 128); 18885 (void) inet_ntop(af, (const void *)&TCP_AC_V6REMOTE(acp), 18886 rbuf, 128); 18887 lport = ntohs(TCP_AC_V6LPORT(acp)); 18888 rport = ntohs(TCP_AC_V6RPORT(acp)); 18889 } 18890 18891 logflags = SL_TRACE | SL_NOTE; 18892 /* 18893 * Don't print this message to the console if the operation was done 18894 * to a non-global zone. 18895 */ 18896 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 18897 logflags |= SL_CONSOLE; 18898 (void) strlog(TCP_MOD_ID, 0, 1, logflags, 18899 "TCP_IOC_ABORT_CONN: local = %s:%d, remote = %s:%d, " 18900 "start = %d, end = %d\n", lbuf, lport, rbuf, rport, 18901 acp->ac_start, acp->ac_end); 18902 } 18903 18904 /* 18905 * Called using SQ_FILL when a message built using 18906 * tcp_ioctl_abort_build_msg is put into a queue. 18907 * Note that when we get here there is no wildcard in acp any more. 18908 */ 18909 /* ARGSUSED2 */ 18910 static void 18911 tcp_ioctl_abort_handler(void *arg, mblk_t *mp, void *arg2, 18912 ip_recv_attr_t *dummy) 18913 { 18914 conn_t *connp = (conn_t *)arg; 18915 tcp_t *tcp = connp->conn_tcp; 18916 tcp_ioc_abort_conn_t *acp; 18917 18918 /* 18919 * Don't accept any input on a closed tcp as this TCP logically does 18920 * not exist on the system. Don't proceed further with this TCP. 18921 * For eg. this packet could trigger another close of this tcp 18922 * which would be disastrous for tcp_refcnt. tcp_close_detached / 18923 * tcp_clean_death / tcp_closei_local must be called at most once 18924 * on a TCP. 18925 */ 18926 if (tcp->tcp_state == TCPS_CLOSED || 18927 tcp->tcp_state == TCPS_BOUND) { 18928 freemsg(mp); 18929 return; 18930 } 18931 18932 acp = (tcp_ioc_abort_conn_t *)(mp->b_rptr + sizeof (uint32_t)); 18933 if (tcp->tcp_state <= acp->ac_end) { 18934 /* 18935 * If we get here, we are already on the correct 18936 * squeue. This ioctl follows the following path 18937 * tcp_wput -> tcp_wput_ioctl -> tcp_ioctl_abort_conn 18938 * ->tcp_ioctl_abort->squeue_enter (if on a 18939 * different squeue) 18940 */ 18941 int errcode; 18942 18943 TCP_AC_GET_ERRCODE(tcp->tcp_state, errcode); 18944 (void) tcp_clean_death(tcp, errcode, 26); 18945 } 18946 freemsg(mp); 18947 } 18948 18949 /* 18950 * Abort all matching connections on a hash chain. 18951 */ 18952 static int 18953 tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *acp, int index, int *count, 18954 boolean_t exact, tcp_stack_t *tcps) 18955 { 18956 int nmatch, err = 0; 18957 tcp_t *tcp; 18958 MBLKP mp, last, listhead = NULL; 18959 conn_t *tconnp; 18960 connf_t *connfp; 18961 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 18962 18963 connfp = &ipst->ips_ipcl_conn_fanout[index]; 18964 18965 startover: 18966 nmatch = 0; 18967 18968 mutex_enter(&connfp->connf_lock); 18969 for (tconnp = connfp->connf_head; tconnp != NULL; 18970 tconnp = tconnp->conn_next) { 18971 tcp = tconnp->conn_tcp; 18972 /* 18973 * We are missing a check on sin6_scope_id for linklocals here, 18974 * but current usage is just for aborting based on zoneid 18975 * for shared-IP zones. 18976 */ 18977 if (TCP_AC_MATCH(acp, tconnp, tcp)) { 18978 CONN_INC_REF(tconnp); 18979 mp = tcp_ioctl_abort_build_msg(acp, tcp); 18980 if (mp == NULL) { 18981 err = ENOMEM; 18982 CONN_DEC_REF(tconnp); 18983 break; 18984 } 18985 mp->b_prev = (mblk_t *)tcp; 18986 18987 if (listhead == NULL) { 18988 listhead = mp; 18989 last = mp; 18990 } else { 18991 last->b_next = mp; 18992 last = mp; 18993 } 18994 nmatch++; 18995 if (exact) 18996 break; 18997 } 18998 18999 /* Avoid holding lock for too long. */ 19000 if (nmatch >= 500) 19001 break; 19002 } 19003 mutex_exit(&connfp->connf_lock); 19004 19005 /* Pass mp into the correct tcp */ 19006 while ((mp = listhead) != NULL) { 19007 listhead = listhead->b_next; 19008 tcp = (tcp_t *)mp->b_prev; 19009 mp->b_next = mp->b_prev = NULL; 19010 SQUEUE_ENTER_ONE(tcp->tcp_connp->conn_sqp, mp, 19011 tcp_ioctl_abort_handler, tcp->tcp_connp, NULL, 19012 SQ_FILL, SQTAG_TCP_ABORT_BUCKET); 19013 } 19014 19015 *count += nmatch; 19016 if (nmatch >= 500 && err == 0) 19017 goto startover; 19018 return (err); 19019 } 19020 19021 /* 19022 * Abort all connections that matches the attributes specified in acp. 19023 */ 19024 static int 19025 tcp_ioctl_abort(tcp_ioc_abort_conn_t *acp, tcp_stack_t *tcps) 19026 { 19027 sa_family_t af; 19028 uint32_t ports; 19029 uint16_t *pports; 19030 int err = 0, count = 0; 19031 boolean_t exact = B_FALSE; /* set when there is no wildcard */ 19032 int index = -1; 19033 ushort_t logflags; 19034 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 19035 19036 af = acp->ac_local.ss_family; 19037 19038 if (af == AF_INET) { 19039 if (TCP_AC_V4REMOTE(acp) != INADDR_ANY && 19040 TCP_AC_V4LPORT(acp) != 0 && TCP_AC_V4RPORT(acp) != 0) { 19041 pports = (uint16_t *)&ports; 19042 pports[1] = TCP_AC_V4LPORT(acp); 19043 pports[0] = TCP_AC_V4RPORT(acp); 19044 exact = (TCP_AC_V4LOCAL(acp) != INADDR_ANY); 19045 } 19046 } else { 19047 if (!IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE(acp)) && 19048 TCP_AC_V6LPORT(acp) != 0 && TCP_AC_V6RPORT(acp) != 0) { 19049 pports = (uint16_t *)&ports; 19050 pports[1] = TCP_AC_V6LPORT(acp); 19051 pports[0] = TCP_AC_V6RPORT(acp); 19052 exact = !IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL(acp)); 19053 } 19054 } 19055 19056 /* 19057 * For cases where remote addr, local port, and remote port are non- 19058 * wildcards, tcp_ioctl_abort_bucket will only be called once. 19059 */ 19060 if (index != -1) { 19061 err = tcp_ioctl_abort_bucket(acp, index, 19062 &count, exact, tcps); 19063 } else { 19064 /* 19065 * loop through all entries for wildcard case 19066 */ 19067 for (index = 0; 19068 index < ipst->ips_ipcl_conn_fanout_size; 19069 index++) { 19070 err = tcp_ioctl_abort_bucket(acp, index, 19071 &count, exact, tcps); 19072 if (err != 0) 19073 break; 19074 } 19075 } 19076 19077 logflags = SL_TRACE | SL_NOTE; 19078 /* 19079 * Don't print this message to the console if the operation was done 19080 * to a non-global zone. 19081 */ 19082 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 19083 logflags |= SL_CONSOLE; 19084 (void) strlog(TCP_MOD_ID, 0, 1, logflags, "TCP_IOC_ABORT_CONN: " 19085 "aborted %d connection%c\n", count, ((count > 1) ? 's' : ' ')); 19086 if (err == 0 && count == 0) 19087 err = ENOENT; 19088 return (err); 19089 } 19090 19091 /* 19092 * Process the TCP_IOC_ABORT_CONN ioctl request. 19093 */ 19094 static void 19095 tcp_ioctl_abort_conn(queue_t *q, mblk_t *mp) 19096 { 19097 int err; 19098 IOCP iocp; 19099 MBLKP mp1; 19100 sa_family_t laf, raf; 19101 tcp_ioc_abort_conn_t *acp; 19102 zone_t *zptr; 19103 conn_t *connp = Q_TO_CONN(q); 19104 zoneid_t zoneid = connp->conn_zoneid; 19105 tcp_t *tcp = connp->conn_tcp; 19106 tcp_stack_t *tcps = tcp->tcp_tcps; 19107 19108 iocp = (IOCP)mp->b_rptr; 19109 19110 if ((mp1 = mp->b_cont) == NULL || 19111 iocp->ioc_count != sizeof (tcp_ioc_abort_conn_t)) { 19112 err = EINVAL; 19113 goto out; 19114 } 19115 19116 /* check permissions */ 19117 if (secpolicy_ip_config(iocp->ioc_cr, B_FALSE) != 0) { 19118 err = EPERM; 19119 goto out; 19120 } 19121 19122 if (mp1->b_cont != NULL) { 19123 freemsg(mp1->b_cont); 19124 mp1->b_cont = NULL; 19125 } 19126 19127 acp = (tcp_ioc_abort_conn_t *)mp1->b_rptr; 19128 laf = acp->ac_local.ss_family; 19129 raf = acp->ac_remote.ss_family; 19130 19131 /* check that a zone with the supplied zoneid exists */ 19132 if (acp->ac_zoneid != GLOBAL_ZONEID && acp->ac_zoneid != ALL_ZONES) { 19133 zptr = zone_find_by_id(zoneid); 19134 if (zptr != NULL) { 19135 zone_rele(zptr); 19136 } else { 19137 err = EINVAL; 19138 goto out; 19139 } 19140 } 19141 19142 /* 19143 * For exclusive stacks we set the zoneid to zero 19144 * to make TCP operate as if in the global zone. 19145 */ 19146 if (tcps->tcps_netstack->netstack_stackid != GLOBAL_NETSTACKID) 19147 acp->ac_zoneid = GLOBAL_ZONEID; 19148 19149 if (acp->ac_start < TCPS_SYN_SENT || acp->ac_end > TCPS_TIME_WAIT || 19150 acp->ac_start > acp->ac_end || laf != raf || 19151 (laf != AF_INET && laf != AF_INET6)) { 19152 err = EINVAL; 19153 goto out; 19154 } 19155 19156 tcp_ioctl_abort_dump(acp); 19157 err = tcp_ioctl_abort(acp, tcps); 19158 19159 out: 19160 if (mp1 != NULL) { 19161 freemsg(mp1); 19162 mp->b_cont = NULL; 19163 } 19164 19165 if (err != 0) 19166 miocnak(q, mp, 0, err); 19167 else 19168 miocack(q, mp, 0, 0); 19169 } 19170 19171 /* 19172 * tcp_time_wait_processing() handles processing of incoming packets when 19173 * the tcp is in the TIME_WAIT state. 19174 * A TIME_WAIT tcp that has an associated open TCP stream is never put 19175 * on the time wait list. 19176 */ 19177 void 19178 tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq, 19179 uint32_t seg_ack, int seg_len, tcpha_t *tcpha, ip_recv_attr_t *ira) 19180 { 19181 int32_t bytes_acked; 19182 int32_t gap; 19183 int32_t rgap; 19184 tcp_opt_t tcpopt; 19185 uint_t flags; 19186 uint32_t new_swnd = 0; 19187 conn_t *nconnp; 19188 conn_t *connp = tcp->tcp_connp; 19189 tcp_stack_t *tcps = tcp->tcp_tcps; 19190 19191 BUMP_LOCAL(tcp->tcp_ibsegs); 19192 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 19193 19194 flags = (unsigned int)tcpha->tha_flags & 0xFF; 19195 new_swnd = ntohs(tcpha->tha_win) << 19196 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws); 19197 if (tcp->tcp_snd_ts_ok) { 19198 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) { 19199 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 19200 tcp->tcp_rnxt, TH_ACK); 19201 goto done; 19202 } 19203 } 19204 gap = seg_seq - tcp->tcp_rnxt; 19205 rgap = tcp->tcp_rwnd - (gap + seg_len); 19206 if (gap < 0) { 19207 BUMP_MIB(&tcps->tcps_mib, tcpInDataDupSegs); 19208 UPDATE_MIB(&tcps->tcps_mib, tcpInDataDupBytes, 19209 (seg_len > -gap ? -gap : seg_len)); 19210 seg_len += gap; 19211 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 19212 if (flags & TH_RST) { 19213 goto done; 19214 } 19215 if ((flags & TH_FIN) && seg_len == -1) { 19216 /* 19217 * When TCP receives a duplicate FIN in 19218 * TIME_WAIT state, restart the 2 MSL timer. 19219 * See page 73 in RFC 793. Make sure this TCP 19220 * is already on the TIME_WAIT list. If not, 19221 * just restart the timer. 19222 */ 19223 if (TCP_IS_DETACHED(tcp)) { 19224 if (tcp_time_wait_remove(tcp, NULL) == 19225 B_TRUE) { 19226 tcp_time_wait_append(tcp); 19227 TCP_DBGSTAT(tcps, 19228 tcp_rput_time_wait); 19229 } 19230 } else { 19231 ASSERT(tcp != NULL); 19232 TCP_TIMER_RESTART(tcp, 19233 tcps->tcps_time_wait_interval); 19234 } 19235 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 19236 tcp->tcp_rnxt, TH_ACK); 19237 goto done; 19238 } 19239 flags |= TH_ACK_NEEDED; 19240 seg_len = 0; 19241 goto process_ack; 19242 } 19243 19244 /* Fix seg_seq, and chew the gap off the front. */ 19245 seg_seq = tcp->tcp_rnxt; 19246 } 19247 19248 if ((flags & TH_SYN) && gap > 0 && rgap < 0) { 19249 /* 19250 * Make sure that when we accept the connection, pick 19251 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the 19252 * old connection. 19253 * 19254 * The next ISS generated is equal to tcp_iss_incr_extra 19255 * + ISS_INCR/2 + other components depending on the 19256 * value of tcp_strong_iss. We pre-calculate the new 19257 * ISS here and compare with tcp_snxt to determine if 19258 * we need to make adjustment to tcp_iss_incr_extra. 19259 * 19260 * The above calculation is ugly and is a 19261 * waste of CPU cycles... 19262 */ 19263 uint32_t new_iss = tcps->tcps_iss_incr_extra; 19264 int32_t adj; 19265 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 19266 19267 switch (tcps->tcps_strong_iss) { 19268 case 2: { 19269 /* Add time and MD5 components. */ 19270 uint32_t answer[4]; 19271 struct { 19272 uint32_t ports; 19273 in6_addr_t src; 19274 in6_addr_t dst; 19275 } arg; 19276 MD5_CTX context; 19277 19278 mutex_enter(&tcps->tcps_iss_key_lock); 19279 context = tcps->tcps_iss_key; 19280 mutex_exit(&tcps->tcps_iss_key_lock); 19281 arg.ports = connp->conn_ports; 19282 /* We use MAPPED addresses in tcp_iss_init */ 19283 arg.src = connp->conn_laddr_v6; 19284 arg.dst = connp->conn_faddr_v6; 19285 MD5Update(&context, (uchar_t *)&arg, 19286 sizeof (arg)); 19287 MD5Final((uchar_t *)answer, &context); 19288 answer[0] ^= answer[1] ^ answer[2] ^ answer[3]; 19289 new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0]; 19290 break; 19291 } 19292 case 1: 19293 /* Add time component and min random (i.e. 1). */ 19294 new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1; 19295 break; 19296 default: 19297 /* Add only time component. */ 19298 new_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 19299 break; 19300 } 19301 if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) { 19302 /* 19303 * New ISS not guaranteed to be ISS_INCR/2 19304 * ahead of the current tcp_snxt, so add the 19305 * difference to tcp_iss_incr_extra. 19306 */ 19307 tcps->tcps_iss_incr_extra += adj; 19308 } 19309 /* 19310 * If tcp_clean_death() can not perform the task now, 19311 * drop the SYN packet and let the other side re-xmit. 19312 * Otherwise pass the SYN packet back in, since the 19313 * old tcp state has been cleaned up or freed. 19314 */ 19315 if (tcp_clean_death(tcp, 0, 27) == -1) 19316 goto done; 19317 nconnp = ipcl_classify(mp, ira, ipst); 19318 if (nconnp != NULL) { 19319 TCP_STAT(tcps, tcp_time_wait_syn_success); 19320 /* Drops ref on nconnp */ 19321 tcp_reinput(nconnp, mp, ira, ipst); 19322 return; 19323 } 19324 goto done; 19325 } 19326 19327 /* 19328 * rgap is the amount of stuff received out of window. A negative 19329 * value is the amount out of window. 19330 */ 19331 if (rgap < 0) { 19332 BUMP_MIB(&tcps->tcps_mib, tcpInDataPastWinSegs); 19333 UPDATE_MIB(&tcps->tcps_mib, tcpInDataPastWinBytes, -rgap); 19334 /* Fix seg_len and make sure there is something left. */ 19335 seg_len += rgap; 19336 if (seg_len <= 0) { 19337 if (flags & TH_RST) { 19338 goto done; 19339 } 19340 flags |= TH_ACK_NEEDED; 19341 seg_len = 0; 19342 goto process_ack; 19343 } 19344 } 19345 /* 19346 * Check whether we can update tcp_ts_recent. This test is 19347 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 19348 * Extensions for High Performance: An Update", Internet Draft. 19349 */ 19350 if (tcp->tcp_snd_ts_ok && 19351 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 19352 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 19353 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 19354 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 19355 } 19356 19357 if (seg_seq != tcp->tcp_rnxt && seg_len > 0) { 19358 /* Always ack out of order packets */ 19359 flags |= TH_ACK_NEEDED; 19360 seg_len = 0; 19361 } else if (seg_len > 0) { 19362 BUMP_MIB(&tcps->tcps_mib, tcpInClosed); 19363 BUMP_MIB(&tcps->tcps_mib, tcpInDataInorderSegs); 19364 UPDATE_MIB(&tcps->tcps_mib, tcpInDataInorderBytes, seg_len); 19365 } 19366 if (flags & TH_RST) { 19367 (void) tcp_clean_death(tcp, 0, 28); 19368 goto done; 19369 } 19370 if (flags & TH_SYN) { 19371 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 19372 TH_RST|TH_ACK); 19373 /* 19374 * Do not delete the TCP structure if it is in 19375 * TIME_WAIT state. Refer to RFC 1122, 4.2.2.13. 19376 */ 19377 goto done; 19378 } 19379 process_ack: 19380 if (flags & TH_ACK) { 19381 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 19382 if (bytes_acked <= 0) { 19383 if (bytes_acked == 0 && seg_len == 0 && 19384 new_swnd == tcp->tcp_swnd) 19385 BUMP_MIB(&tcps->tcps_mib, tcpInDupAck); 19386 } else { 19387 /* Acks something not sent */ 19388 flags |= TH_ACK_NEEDED; 19389 } 19390 } 19391 if (flags & TH_ACK_NEEDED) { 19392 /* 19393 * Time to send an ack for some reason. 19394 */ 19395 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 19396 tcp->tcp_rnxt, TH_ACK); 19397 } 19398 done: 19399 freemsg(mp); 19400 } 19401 19402 /* 19403 * TCP Timers Implementation. 19404 */ 19405 timeout_id_t 19406 tcp_timeout(conn_t *connp, void (*f)(void *), clock_t tim) 19407 { 19408 mblk_t *mp; 19409 tcp_timer_t *tcpt; 19410 tcp_t *tcp = connp->conn_tcp; 19411 19412 ASSERT(connp->conn_sqp != NULL); 19413 19414 TCP_DBGSTAT(tcp->tcp_tcps, tcp_timeout_calls); 19415 19416 if (tcp->tcp_timercache == NULL) { 19417 mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC); 19418 } else { 19419 TCP_DBGSTAT(tcp->tcp_tcps, tcp_timeout_cached_alloc); 19420 mp = tcp->tcp_timercache; 19421 tcp->tcp_timercache = mp->b_next; 19422 mp->b_next = NULL; 19423 ASSERT(mp->b_wptr == NULL); 19424 } 19425 19426 CONN_INC_REF(connp); 19427 tcpt = (tcp_timer_t *)mp->b_rptr; 19428 tcpt->connp = connp; 19429 tcpt->tcpt_proc = f; 19430 /* 19431 * TCP timers are normal timeouts. Plus, they do not require more than 19432 * a 10 millisecond resolution. By choosing a coarser resolution and by 19433 * rounding up the expiration to the next resolution boundary, we can 19434 * batch timers in the callout subsystem to make TCP timers more 19435 * efficient. The roundup also protects short timers from expiring too 19436 * early before they have a chance to be cancelled. 19437 */ 19438 tcpt->tcpt_tid = timeout_generic(CALLOUT_NORMAL, tcp_timer_callback, mp, 19439 TICK_TO_NSEC(tim), CALLOUT_TCP_RESOLUTION, CALLOUT_FLAG_ROUNDUP); 19440 19441 return ((timeout_id_t)mp); 19442 } 19443 19444 static void 19445 tcp_timer_callback(void *arg) 19446 { 19447 mblk_t *mp = (mblk_t *)arg; 19448 tcp_timer_t *tcpt; 19449 conn_t *connp; 19450 19451 tcpt = (tcp_timer_t *)mp->b_rptr; 19452 connp = tcpt->connp; 19453 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_timer_handler, connp, 19454 NULL, SQ_FILL, SQTAG_TCP_TIMER); 19455 } 19456 19457 /* ARGSUSED */ 19458 static void 19459 tcp_timer_handler(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 19460 { 19461 tcp_timer_t *tcpt; 19462 conn_t *connp = (conn_t *)arg; 19463 tcp_t *tcp = connp->conn_tcp; 19464 19465 tcpt = (tcp_timer_t *)mp->b_rptr; 19466 ASSERT(connp == tcpt->connp); 19467 ASSERT((squeue_t *)arg2 == connp->conn_sqp); 19468 19469 /* 19470 * If the TCP has reached the closed state, don't proceed any 19471 * further. This TCP logically does not exist on the system. 19472 * tcpt_proc could for example access queues, that have already 19473 * been qprocoff'ed off. 19474 */ 19475 if (tcp->tcp_state != TCPS_CLOSED) { 19476 (*tcpt->tcpt_proc)(connp); 19477 } else { 19478 tcp->tcp_timer_tid = 0; 19479 } 19480 tcp_timer_free(connp->conn_tcp, mp); 19481 } 19482 19483 /* 19484 * There is potential race with untimeout and the handler firing at the same 19485 * time. The mblock may be freed by the handler while we are trying to use 19486 * it. But since both should execute on the same squeue, this race should not 19487 * occur. 19488 */ 19489 clock_t 19490 tcp_timeout_cancel(conn_t *connp, timeout_id_t id) 19491 { 19492 mblk_t *mp = (mblk_t *)id; 19493 tcp_timer_t *tcpt; 19494 clock_t delta; 19495 19496 TCP_DBGSTAT(connp->conn_tcp->tcp_tcps, tcp_timeout_cancel_reqs); 19497 19498 if (mp == NULL) 19499 return (-1); 19500 19501 tcpt = (tcp_timer_t *)mp->b_rptr; 19502 ASSERT(tcpt->connp == connp); 19503 19504 delta = untimeout_default(tcpt->tcpt_tid, 0); 19505 19506 if (delta >= 0) { 19507 TCP_DBGSTAT(connp->conn_tcp->tcp_tcps, tcp_timeout_canceled); 19508 tcp_timer_free(connp->conn_tcp, mp); 19509 CONN_DEC_REF(connp); 19510 } 19511 19512 return (delta); 19513 } 19514 19515 /* 19516 * Allocate space for the timer event. The allocation looks like mblk, but it is 19517 * not a proper mblk. To avoid confusion we set b_wptr to NULL. 19518 * 19519 * Dealing with failures: If we can't allocate from the timer cache we try 19520 * allocating from dblock caches using allocb_tryhard(). In this case b_wptr 19521 * points to b_rptr. 19522 * If we can't allocate anything using allocb_tryhard(), we perform a last 19523 * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and 19524 * save the actual allocation size in b_datap. 19525 */ 19526 mblk_t * 19527 tcp_timermp_alloc(int kmflags) 19528 { 19529 mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache, 19530 kmflags & ~KM_PANIC); 19531 19532 if (mp != NULL) { 19533 mp->b_next = mp->b_prev = NULL; 19534 mp->b_rptr = (uchar_t *)(&mp[1]); 19535 mp->b_wptr = NULL; 19536 mp->b_datap = NULL; 19537 mp->b_queue = NULL; 19538 mp->b_cont = NULL; 19539 } else if (kmflags & KM_PANIC) { 19540 /* 19541 * Failed to allocate memory for the timer. Try allocating from 19542 * dblock caches. 19543 */ 19544 /* ipclassifier calls this from a constructor - hence no tcps */ 19545 TCP_G_STAT(tcp_timermp_allocfail); 19546 mp = allocb_tryhard(sizeof (tcp_timer_t)); 19547 if (mp == NULL) { 19548 size_t size = 0; 19549 /* 19550 * Memory is really low. Try tryhard allocation. 19551 * 19552 * ipclassifier calls this from a constructor - 19553 * hence no tcps 19554 */ 19555 TCP_G_STAT(tcp_timermp_allocdblfail); 19556 mp = kmem_alloc_tryhard(sizeof (mblk_t) + 19557 sizeof (tcp_timer_t), &size, kmflags); 19558 mp->b_rptr = (uchar_t *)(&mp[1]); 19559 mp->b_next = mp->b_prev = NULL; 19560 mp->b_wptr = (uchar_t *)-1; 19561 mp->b_datap = (dblk_t *)size; 19562 mp->b_queue = NULL; 19563 mp->b_cont = NULL; 19564 } 19565 ASSERT(mp->b_wptr != NULL); 19566 } 19567 /* ipclassifier calls this from a constructor - hence no tcps */ 19568 TCP_G_DBGSTAT(tcp_timermp_alloced); 19569 19570 return (mp); 19571 } 19572 19573 /* 19574 * Free per-tcp timer cache. 19575 * It can only contain entries from tcp_timercache. 19576 */ 19577 void 19578 tcp_timermp_free(tcp_t *tcp) 19579 { 19580 mblk_t *mp; 19581 19582 while ((mp = tcp->tcp_timercache) != NULL) { 19583 ASSERT(mp->b_wptr == NULL); 19584 tcp->tcp_timercache = tcp->tcp_timercache->b_next; 19585 kmem_cache_free(tcp_timercache, mp); 19586 } 19587 } 19588 19589 /* 19590 * Free timer event. Put it on the per-tcp timer cache if there is not too many 19591 * events there already (currently at most two events are cached). 19592 * If the event is not allocated from the timer cache, free it right away. 19593 */ 19594 static void 19595 tcp_timer_free(tcp_t *tcp, mblk_t *mp) 19596 { 19597 mblk_t *mp1 = tcp->tcp_timercache; 19598 19599 if (mp->b_wptr != NULL) { 19600 /* 19601 * This allocation is not from a timer cache, free it right 19602 * away. 19603 */ 19604 if (mp->b_wptr != (uchar_t *)-1) 19605 freeb(mp); 19606 else 19607 kmem_free(mp, (size_t)mp->b_datap); 19608 } else if (mp1 == NULL || mp1->b_next == NULL) { 19609 /* Cache this timer block for future allocations */ 19610 mp->b_rptr = (uchar_t *)(&mp[1]); 19611 mp->b_next = mp1; 19612 tcp->tcp_timercache = mp; 19613 } else { 19614 kmem_cache_free(tcp_timercache, mp); 19615 TCP_DBGSTAT(tcp->tcp_tcps, tcp_timermp_freed); 19616 } 19617 } 19618 19619 /* 19620 * End of TCP Timers implementation. 19621 */ 19622 19623 /* 19624 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 19625 * on the specified backing STREAMS q. Note, the caller may make the 19626 * decision to call based on the tcp_t.tcp_flow_stopped value which 19627 * when check outside the q's lock is only an advisory check ... 19628 */ 19629 void 19630 tcp_setqfull(tcp_t *tcp) 19631 { 19632 tcp_stack_t *tcps = tcp->tcp_tcps; 19633 conn_t *connp = tcp->tcp_connp; 19634 19635 if (tcp->tcp_closed) 19636 return; 19637 19638 conn_setqfull(connp, &tcp->tcp_flow_stopped); 19639 if (tcp->tcp_flow_stopped) 19640 TCP_STAT(tcps, tcp_flwctl_on); 19641 } 19642 19643 void 19644 tcp_clrqfull(tcp_t *tcp) 19645 { 19646 conn_t *connp = tcp->tcp_connp; 19647 19648 if (tcp->tcp_closed) 19649 return; 19650 conn_clrqfull(connp, &tcp->tcp_flow_stopped); 19651 } 19652 19653 /* 19654 * kstats related to squeues i.e. not per IP instance 19655 */ 19656 static void * 19657 tcp_g_kstat_init(tcp_g_stat_t *tcp_g_statp) 19658 { 19659 kstat_t *ksp; 19660 19661 tcp_g_stat_t template = { 19662 { "tcp_timermp_alloced", KSTAT_DATA_UINT64 }, 19663 { "tcp_timermp_allocfail", KSTAT_DATA_UINT64 }, 19664 { "tcp_timermp_allocdblfail", KSTAT_DATA_UINT64 }, 19665 { "tcp_freelist_cleanup", KSTAT_DATA_UINT64 }, 19666 }; 19667 19668 ksp = kstat_create(TCP_MOD_NAME, 0, "tcpstat_g", "net", 19669 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t), 19670 KSTAT_FLAG_VIRTUAL); 19671 19672 if (ksp == NULL) 19673 return (NULL); 19674 19675 bcopy(&template, tcp_g_statp, sizeof (template)); 19676 ksp->ks_data = (void *)tcp_g_statp; 19677 19678 kstat_install(ksp); 19679 return (ksp); 19680 } 19681 19682 static void 19683 tcp_g_kstat_fini(kstat_t *ksp) 19684 { 19685 if (ksp != NULL) { 19686 kstat_delete(ksp); 19687 } 19688 } 19689 19690 19691 static void * 19692 tcp_kstat2_init(netstackid_t stackid, tcp_stat_t *tcps_statisticsp) 19693 { 19694 kstat_t *ksp; 19695 19696 tcp_stat_t template = { 19697 { "tcp_time_wait", KSTAT_DATA_UINT64 }, 19698 { "tcp_time_wait_syn", KSTAT_DATA_UINT64 }, 19699 { "tcp_time_wait_syn_success", KSTAT_DATA_UINT64 }, 19700 { "tcp_detach_non_time_wait", KSTAT_DATA_UINT64 }, 19701 { "tcp_detach_time_wait", KSTAT_DATA_UINT64 }, 19702 { "tcp_time_wait_reap", KSTAT_DATA_UINT64 }, 19703 { "tcp_clean_death_nondetached", KSTAT_DATA_UINT64 }, 19704 { "tcp_reinit_calls", KSTAT_DATA_UINT64 }, 19705 { "tcp_eager_err1", KSTAT_DATA_UINT64 }, 19706 { "tcp_eager_err2", KSTAT_DATA_UINT64 }, 19707 { "tcp_eager_blowoff_calls", KSTAT_DATA_UINT64 }, 19708 { "tcp_eager_blowoff_q", KSTAT_DATA_UINT64 }, 19709 { "tcp_eager_blowoff_q0", KSTAT_DATA_UINT64 }, 19710 { "tcp_not_hard_bound", KSTAT_DATA_UINT64 }, 19711 { "tcp_no_listener", KSTAT_DATA_UINT64 }, 19712 { "tcp_found_eager", KSTAT_DATA_UINT64 }, 19713 { "tcp_wrong_queue", KSTAT_DATA_UINT64 }, 19714 { "tcp_found_eager_binding1", KSTAT_DATA_UINT64 }, 19715 { "tcp_found_eager_bound1", KSTAT_DATA_UINT64 }, 19716 { "tcp_eager_has_listener1", KSTAT_DATA_UINT64 }, 19717 { "tcp_open_alloc", KSTAT_DATA_UINT64 }, 19718 { "tcp_open_detached_alloc", KSTAT_DATA_UINT64 }, 19719 { "tcp_rput_time_wait", KSTAT_DATA_UINT64 }, 19720 { "tcp_listendrop", KSTAT_DATA_UINT64 }, 19721 { "tcp_listendropq0", KSTAT_DATA_UINT64 }, 19722 { "tcp_wrong_rq", KSTAT_DATA_UINT64 }, 19723 { "tcp_rsrv_calls", KSTAT_DATA_UINT64 }, 19724 { "tcp_eagerfree2", KSTAT_DATA_UINT64 }, 19725 { "tcp_eagerfree3", KSTAT_DATA_UINT64 }, 19726 { "tcp_eagerfree4", KSTAT_DATA_UINT64 }, 19727 { "tcp_eagerfree5", KSTAT_DATA_UINT64 }, 19728 { "tcp_timewait_syn_fail", KSTAT_DATA_UINT64 }, 19729 { "tcp_listen_badflags", KSTAT_DATA_UINT64 }, 19730 { "tcp_timeout_calls", KSTAT_DATA_UINT64 }, 19731 { "tcp_timeout_cached_alloc", KSTAT_DATA_UINT64 }, 19732 { "tcp_timeout_cancel_reqs", KSTAT_DATA_UINT64 }, 19733 { "tcp_timeout_canceled", KSTAT_DATA_UINT64 }, 19734 { "tcp_timermp_freed", KSTAT_DATA_UINT64 }, 19735 { "tcp_push_timer_cnt", KSTAT_DATA_UINT64 }, 19736 { "tcp_ack_timer_cnt", KSTAT_DATA_UINT64 }, 19737 { "tcp_wsrv_called", KSTAT_DATA_UINT64 }, 19738 { "tcp_flwctl_on", KSTAT_DATA_UINT64 }, 19739 { "tcp_timer_fire_early", KSTAT_DATA_UINT64 }, 19740 { "tcp_timer_fire_miss", KSTAT_DATA_UINT64 }, 19741 { "tcp_rput_v6_error", KSTAT_DATA_UINT64 }, 19742 { "tcp_zcopy_on", KSTAT_DATA_UINT64 }, 19743 { "tcp_zcopy_off", KSTAT_DATA_UINT64 }, 19744 { "tcp_zcopy_backoff", KSTAT_DATA_UINT64 }, 19745 { "tcp_fusion_flowctl", KSTAT_DATA_UINT64 }, 19746 { "tcp_fusion_backenabled", KSTAT_DATA_UINT64 }, 19747 { "tcp_fusion_urg", KSTAT_DATA_UINT64 }, 19748 { "tcp_fusion_putnext", KSTAT_DATA_UINT64 }, 19749 { "tcp_fusion_unfusable", KSTAT_DATA_UINT64 }, 19750 { "tcp_fusion_aborted", KSTAT_DATA_UINT64 }, 19751 { "tcp_fusion_unqualified", KSTAT_DATA_UINT64 }, 19752 { "tcp_fusion_rrw_busy", KSTAT_DATA_UINT64 }, 19753 { "tcp_fusion_rrw_msgcnt", KSTAT_DATA_UINT64 }, 19754 { "tcp_fusion_rrw_plugged", KSTAT_DATA_UINT64 }, 19755 { "tcp_in_ack_unsent_drop", KSTAT_DATA_UINT64 }, 19756 { "tcp_sock_fallback", KSTAT_DATA_UINT64 }, 19757 { "tcp_lso_enabled", KSTAT_DATA_UINT64 }, 19758 { "tcp_lso_disabled", KSTAT_DATA_UINT64 }, 19759 { "tcp_lso_times", KSTAT_DATA_UINT64 }, 19760 { "tcp_lso_pkt_out", KSTAT_DATA_UINT64 }, 19761 }; 19762 19763 ksp = kstat_create_netstack(TCP_MOD_NAME, 0, "tcpstat", "net", 19764 KSTAT_TYPE_NAMED, sizeof (template) / sizeof (kstat_named_t), 19765 KSTAT_FLAG_VIRTUAL, stackid); 19766 19767 if (ksp == NULL) 19768 return (NULL); 19769 19770 bcopy(&template, tcps_statisticsp, sizeof (template)); 19771 ksp->ks_data = (void *)tcps_statisticsp; 19772 ksp->ks_private = (void *)(uintptr_t)stackid; 19773 19774 kstat_install(ksp); 19775 return (ksp); 19776 } 19777 19778 static void 19779 tcp_kstat2_fini(netstackid_t stackid, kstat_t *ksp) 19780 { 19781 if (ksp != NULL) { 19782 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 19783 kstat_delete_netstack(ksp, stackid); 19784 } 19785 } 19786 19787 /* 19788 * TCP Kstats implementation 19789 */ 19790 static void * 19791 tcp_kstat_init(netstackid_t stackid, tcp_stack_t *tcps) 19792 { 19793 kstat_t *ksp; 19794 19795 tcp_named_kstat_t template = { 19796 { "rtoAlgorithm", KSTAT_DATA_INT32, 0 }, 19797 { "rtoMin", KSTAT_DATA_INT32, 0 }, 19798 { "rtoMax", KSTAT_DATA_INT32, 0 }, 19799 { "maxConn", KSTAT_DATA_INT32, 0 }, 19800 { "activeOpens", KSTAT_DATA_UINT32, 0 }, 19801 { "passiveOpens", KSTAT_DATA_UINT32, 0 }, 19802 { "attemptFails", KSTAT_DATA_UINT32, 0 }, 19803 { "estabResets", KSTAT_DATA_UINT32, 0 }, 19804 { "currEstab", KSTAT_DATA_UINT32, 0 }, 19805 { "inSegs", KSTAT_DATA_UINT64, 0 }, 19806 { "outSegs", KSTAT_DATA_UINT64, 0 }, 19807 { "retransSegs", KSTAT_DATA_UINT32, 0 }, 19808 { "connTableSize", KSTAT_DATA_INT32, 0 }, 19809 { "outRsts", KSTAT_DATA_UINT32, 0 }, 19810 { "outDataSegs", KSTAT_DATA_UINT32, 0 }, 19811 { "outDataBytes", KSTAT_DATA_UINT32, 0 }, 19812 { "retransBytes", KSTAT_DATA_UINT32, 0 }, 19813 { "outAck", KSTAT_DATA_UINT32, 0 }, 19814 { "outAckDelayed", KSTAT_DATA_UINT32, 0 }, 19815 { "outUrg", KSTAT_DATA_UINT32, 0 }, 19816 { "outWinUpdate", KSTAT_DATA_UINT32, 0 }, 19817 { "outWinProbe", KSTAT_DATA_UINT32, 0 }, 19818 { "outControl", KSTAT_DATA_UINT32, 0 }, 19819 { "outFastRetrans", KSTAT_DATA_UINT32, 0 }, 19820 { "inAckSegs", KSTAT_DATA_UINT32, 0 }, 19821 { "inAckBytes", KSTAT_DATA_UINT32, 0 }, 19822 { "inDupAck", KSTAT_DATA_UINT32, 0 }, 19823 { "inAckUnsent", KSTAT_DATA_UINT32, 0 }, 19824 { "inDataInorderSegs", KSTAT_DATA_UINT32, 0 }, 19825 { "inDataInorderBytes", KSTAT_DATA_UINT32, 0 }, 19826 { "inDataUnorderSegs", KSTAT_DATA_UINT32, 0 }, 19827 { "inDataUnorderBytes", KSTAT_DATA_UINT32, 0 }, 19828 { "inDataDupSegs", KSTAT_DATA_UINT32, 0 }, 19829 { "inDataDupBytes", KSTAT_DATA_UINT32, 0 }, 19830 { "inDataPartDupSegs", KSTAT_DATA_UINT32, 0 }, 19831 { "inDataPartDupBytes", KSTAT_DATA_UINT32, 0 }, 19832 { "inDataPastWinSegs", KSTAT_DATA_UINT32, 0 }, 19833 { "inDataPastWinBytes", KSTAT_DATA_UINT32, 0 }, 19834 { "inWinProbe", KSTAT_DATA_UINT32, 0 }, 19835 { "inWinUpdate", KSTAT_DATA_UINT32, 0 }, 19836 { "inClosed", KSTAT_DATA_UINT32, 0 }, 19837 { "rttUpdate", KSTAT_DATA_UINT32, 0 }, 19838 { "rttNoUpdate", KSTAT_DATA_UINT32, 0 }, 19839 { "timRetrans", KSTAT_DATA_UINT32, 0 }, 19840 { "timRetransDrop", KSTAT_DATA_UINT32, 0 }, 19841 { "timKeepalive", KSTAT_DATA_UINT32, 0 }, 19842 { "timKeepaliveProbe", KSTAT_DATA_UINT32, 0 }, 19843 { "timKeepaliveDrop", KSTAT_DATA_UINT32, 0 }, 19844 { "listenDrop", KSTAT_DATA_UINT32, 0 }, 19845 { "listenDropQ0", KSTAT_DATA_UINT32, 0 }, 19846 { "halfOpenDrop", KSTAT_DATA_UINT32, 0 }, 19847 { "outSackRetransSegs", KSTAT_DATA_UINT32, 0 }, 19848 { "connTableSize6", KSTAT_DATA_INT32, 0 } 19849 }; 19850 19851 ksp = kstat_create_netstack(TCP_MOD_NAME, 0, TCP_MOD_NAME, "mib2", 19852 KSTAT_TYPE_NAMED, NUM_OF_FIELDS(tcp_named_kstat_t), 0, stackid); 19853 19854 if (ksp == NULL) 19855 return (NULL); 19856 19857 template.rtoAlgorithm.value.ui32 = 4; 19858 template.rtoMin.value.ui32 = tcps->tcps_rexmit_interval_min; 19859 template.rtoMax.value.ui32 = tcps->tcps_rexmit_interval_max; 19860 template.maxConn.value.i32 = -1; 19861 19862 bcopy(&template, ksp->ks_data, sizeof (template)); 19863 ksp->ks_update = tcp_kstat_update; 19864 ksp->ks_private = (void *)(uintptr_t)stackid; 19865 19866 kstat_install(ksp); 19867 return (ksp); 19868 } 19869 19870 static void 19871 tcp_kstat_fini(netstackid_t stackid, kstat_t *ksp) 19872 { 19873 if (ksp != NULL) { 19874 ASSERT(stackid == (netstackid_t)(uintptr_t)ksp->ks_private); 19875 kstat_delete_netstack(ksp, stackid); 19876 } 19877 } 19878 19879 static int 19880 tcp_kstat_update(kstat_t *kp, int rw) 19881 { 19882 tcp_named_kstat_t *tcpkp; 19883 tcp_t *tcp; 19884 connf_t *connfp; 19885 conn_t *connp; 19886 int i; 19887 netstackid_t stackid = (netstackid_t)(uintptr_t)kp->ks_private; 19888 netstack_t *ns; 19889 tcp_stack_t *tcps; 19890 ip_stack_t *ipst; 19891 19892 if ((kp == NULL) || (kp->ks_data == NULL)) 19893 return (EIO); 19894 19895 if (rw == KSTAT_WRITE) 19896 return (EACCES); 19897 19898 ns = netstack_find_by_stackid(stackid); 19899 if (ns == NULL) 19900 return (-1); 19901 tcps = ns->netstack_tcp; 19902 if (tcps == NULL) { 19903 netstack_rele(ns); 19904 return (-1); 19905 } 19906 19907 tcpkp = (tcp_named_kstat_t *)kp->ks_data; 19908 19909 tcpkp->currEstab.value.ui32 = 0; 19910 19911 ipst = ns->netstack_ip; 19912 19913 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 19914 connfp = &ipst->ips_ipcl_globalhash_fanout[i]; 19915 connp = NULL; 19916 while ((connp = 19917 ipcl_get_next_conn(connfp, connp, IPCL_TCPCONN)) != NULL) { 19918 tcp = connp->conn_tcp; 19919 switch (tcp_snmp_state(tcp)) { 19920 case MIB2_TCP_established: 19921 case MIB2_TCP_closeWait: 19922 tcpkp->currEstab.value.ui32++; 19923 break; 19924 } 19925 } 19926 } 19927 19928 tcpkp->activeOpens.value.ui32 = tcps->tcps_mib.tcpActiveOpens; 19929 tcpkp->passiveOpens.value.ui32 = tcps->tcps_mib.tcpPassiveOpens; 19930 tcpkp->attemptFails.value.ui32 = tcps->tcps_mib.tcpAttemptFails; 19931 tcpkp->estabResets.value.ui32 = tcps->tcps_mib.tcpEstabResets; 19932 tcpkp->inSegs.value.ui64 = tcps->tcps_mib.tcpHCInSegs; 19933 tcpkp->outSegs.value.ui64 = tcps->tcps_mib.tcpHCOutSegs; 19934 tcpkp->retransSegs.value.ui32 = tcps->tcps_mib.tcpRetransSegs; 19935 tcpkp->connTableSize.value.i32 = tcps->tcps_mib.tcpConnTableSize; 19936 tcpkp->outRsts.value.ui32 = tcps->tcps_mib.tcpOutRsts; 19937 tcpkp->outDataSegs.value.ui32 = tcps->tcps_mib.tcpOutDataSegs; 19938 tcpkp->outDataBytes.value.ui32 = tcps->tcps_mib.tcpOutDataBytes; 19939 tcpkp->retransBytes.value.ui32 = tcps->tcps_mib.tcpRetransBytes; 19940 tcpkp->outAck.value.ui32 = tcps->tcps_mib.tcpOutAck; 19941 tcpkp->outAckDelayed.value.ui32 = tcps->tcps_mib.tcpOutAckDelayed; 19942 tcpkp->outUrg.value.ui32 = tcps->tcps_mib.tcpOutUrg; 19943 tcpkp->outWinUpdate.value.ui32 = tcps->tcps_mib.tcpOutWinUpdate; 19944 tcpkp->outWinProbe.value.ui32 = tcps->tcps_mib.tcpOutWinProbe; 19945 tcpkp->outControl.value.ui32 = tcps->tcps_mib.tcpOutControl; 19946 tcpkp->outFastRetrans.value.ui32 = tcps->tcps_mib.tcpOutFastRetrans; 19947 tcpkp->inAckSegs.value.ui32 = tcps->tcps_mib.tcpInAckSegs; 19948 tcpkp->inAckBytes.value.ui32 = tcps->tcps_mib.tcpInAckBytes; 19949 tcpkp->inDupAck.value.ui32 = tcps->tcps_mib.tcpInDupAck; 19950 tcpkp->inAckUnsent.value.ui32 = tcps->tcps_mib.tcpInAckUnsent; 19951 tcpkp->inDataInorderSegs.value.ui32 = 19952 tcps->tcps_mib.tcpInDataInorderSegs; 19953 tcpkp->inDataInorderBytes.value.ui32 = 19954 tcps->tcps_mib.tcpInDataInorderBytes; 19955 tcpkp->inDataUnorderSegs.value.ui32 = 19956 tcps->tcps_mib.tcpInDataUnorderSegs; 19957 tcpkp->inDataUnorderBytes.value.ui32 = 19958 tcps->tcps_mib.tcpInDataUnorderBytes; 19959 tcpkp->inDataDupSegs.value.ui32 = tcps->tcps_mib.tcpInDataDupSegs; 19960 tcpkp->inDataDupBytes.value.ui32 = tcps->tcps_mib.tcpInDataDupBytes; 19961 tcpkp->inDataPartDupSegs.value.ui32 = 19962 tcps->tcps_mib.tcpInDataPartDupSegs; 19963 tcpkp->inDataPartDupBytes.value.ui32 = 19964 tcps->tcps_mib.tcpInDataPartDupBytes; 19965 tcpkp->inDataPastWinSegs.value.ui32 = 19966 tcps->tcps_mib.tcpInDataPastWinSegs; 19967 tcpkp->inDataPastWinBytes.value.ui32 = 19968 tcps->tcps_mib.tcpInDataPastWinBytes; 19969 tcpkp->inWinProbe.value.ui32 = tcps->tcps_mib.tcpInWinProbe; 19970 tcpkp->inWinUpdate.value.ui32 = tcps->tcps_mib.tcpInWinUpdate; 19971 tcpkp->inClosed.value.ui32 = tcps->tcps_mib.tcpInClosed; 19972 tcpkp->rttNoUpdate.value.ui32 = tcps->tcps_mib.tcpRttNoUpdate; 19973 tcpkp->rttUpdate.value.ui32 = tcps->tcps_mib.tcpRttUpdate; 19974 tcpkp->timRetrans.value.ui32 = tcps->tcps_mib.tcpTimRetrans; 19975 tcpkp->timRetransDrop.value.ui32 = tcps->tcps_mib.tcpTimRetransDrop; 19976 tcpkp->timKeepalive.value.ui32 = tcps->tcps_mib.tcpTimKeepalive; 19977 tcpkp->timKeepaliveProbe.value.ui32 = 19978 tcps->tcps_mib.tcpTimKeepaliveProbe; 19979 tcpkp->timKeepaliveDrop.value.ui32 = 19980 tcps->tcps_mib.tcpTimKeepaliveDrop; 19981 tcpkp->listenDrop.value.ui32 = tcps->tcps_mib.tcpListenDrop; 19982 tcpkp->listenDropQ0.value.ui32 = tcps->tcps_mib.tcpListenDropQ0; 19983 tcpkp->halfOpenDrop.value.ui32 = tcps->tcps_mib.tcpHalfOpenDrop; 19984 tcpkp->outSackRetransSegs.value.ui32 = 19985 tcps->tcps_mib.tcpOutSackRetransSegs; 19986 tcpkp->connTableSize6.value.i32 = tcps->tcps_mib.tcp6ConnTableSize; 19987 19988 netstack_rele(ns); 19989 return (0); 19990 } 19991 19992 static int 19993 tcp_squeue_switch(int val) 19994 { 19995 int rval = SQ_FILL; 19996 19997 switch (val) { 19998 case 1: 19999 rval = SQ_NODRAIN; 20000 break; 20001 case 2: 20002 rval = SQ_PROCESS; 20003 break; 20004 default: 20005 break; 20006 } 20007 return (rval); 20008 } 20009 20010 /* 20011 * This is called once for each squeue - globally for all stack 20012 * instances. 20013 */ 20014 static void 20015 tcp_squeue_add(squeue_t *sqp) 20016 { 20017 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 20018 sizeof (tcp_squeue_priv_t), KM_SLEEP); 20019 20020 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 20021 tcp_time_wait->tcp_time_wait_tid = 20022 timeout_generic(CALLOUT_NORMAL, tcp_time_wait_collector, sqp, 20023 TICK_TO_NSEC(TCP_TIME_WAIT_DELAY), CALLOUT_TCP_RESOLUTION, 20024 CALLOUT_FLAG_ROUNDUP); 20025 if (tcp_free_list_max_cnt == 0) { 20026 int tcp_ncpus = ((boot_max_ncpus == -1) ? 20027 max_ncpus : boot_max_ncpus); 20028 20029 /* 20030 * Limit number of entries to 1% of availble memory / tcp_ncpus 20031 */ 20032 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 20033 (tcp_ncpus * sizeof (tcp_t) * 100); 20034 } 20035 tcp_time_wait->tcp_free_list_cnt = 0; 20036 } 20037 20038 /* 20039 * On a labeled system we have some protocols above TCP, such as RPC, which 20040 * appear to assume that every mblk in a chain has a db_credp. 20041 */ 20042 static void 20043 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira) 20044 { 20045 ASSERT(is_system_labeled()); 20046 ASSERT(ira->ira_cred != NULL); 20047 20048 while (mp != NULL) { 20049 mblk_setcred(mp, ira->ira_cred, NOPID); 20050 mp = mp->b_cont; 20051 } 20052 } 20053 20054 static int 20055 tcp_bind_select_lport(tcp_t *tcp, in_port_t *requested_port_ptr, 20056 boolean_t bind_to_req_port_only, cred_t *cr) 20057 { 20058 in_port_t mlp_port; 20059 mlp_type_t addrtype, mlptype; 20060 boolean_t user_specified; 20061 in_port_t allocated_port; 20062 in_port_t requested_port = *requested_port_ptr; 20063 conn_t *connp = tcp->tcp_connp; 20064 zone_t *zone; 20065 tcp_stack_t *tcps = tcp->tcp_tcps; 20066 in6_addr_t v6addr = connp->conn_laddr_v6; 20067 20068 /* 20069 * XXX It's up to the caller to specify bind_to_req_port_only or not. 20070 */ 20071 ASSERT(cr != NULL); 20072 20073 /* 20074 * Get a valid port (within the anonymous range and should not 20075 * be a privileged one) to use if the user has not given a port. 20076 * If multiple threads are here, they may all start with 20077 * with the same initial port. But, it should be fine as long as 20078 * tcp_bindi will ensure that no two threads will be assigned 20079 * the same port. 20080 * 20081 * NOTE: XXX If a privileged process asks for an anonymous port, we 20082 * still check for ports only in the range > tcp_smallest_non_priv_port, 20083 * unless TCP_ANONPRIVBIND option is set. 20084 */ 20085 mlptype = mlptSingle; 20086 mlp_port = requested_port; 20087 if (requested_port == 0) { 20088 requested_port = connp->conn_anon_priv_bind ? 20089 tcp_get_next_priv_port(tcp) : 20090 tcp_update_next_port(tcps->tcps_next_port_to_try, 20091 tcp, B_TRUE); 20092 if (requested_port == 0) { 20093 return (-TNOADDR); 20094 } 20095 user_specified = B_FALSE; 20096 20097 /* 20098 * If the user went through one of the RPC interfaces to create 20099 * this socket and RPC is MLP in this zone, then give him an 20100 * anonymous MLP. 20101 */ 20102 if (connp->conn_anon_mlp && is_system_labeled()) { 20103 zone = crgetzone(cr); 20104 addrtype = tsol_mlp_addr_type( 20105 connp->conn_allzones ? ALL_ZONES : zone->zone_id, 20106 IPV6_VERSION, &v6addr, 20107 tcps->tcps_netstack->netstack_ip); 20108 if (addrtype == mlptSingle) { 20109 return (-TNOADDR); 20110 } 20111 mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, 20112 PMAPPORT, addrtype); 20113 mlp_port = PMAPPORT; 20114 } 20115 } else { 20116 int i; 20117 boolean_t priv = B_FALSE; 20118 20119 /* 20120 * If the requested_port is in the well-known privileged range, 20121 * verify that the stream was opened by a privileged user. 20122 * Note: No locks are held when inspecting tcp_g_*epriv_ports 20123 * but instead the code relies on: 20124 * - the fact that the address of the array and its size never 20125 * changes 20126 * - the atomic assignment of the elements of the array 20127 */ 20128 if (requested_port < tcps->tcps_smallest_nonpriv_port) { 20129 priv = B_TRUE; 20130 } else { 20131 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 20132 if (requested_port == 20133 tcps->tcps_g_epriv_ports[i]) { 20134 priv = B_TRUE; 20135 break; 20136 } 20137 } 20138 } 20139 if (priv) { 20140 if (secpolicy_net_privaddr(cr, requested_port, 20141 IPPROTO_TCP) != 0) { 20142 if (connp->conn_debug) { 20143 (void) strlog(TCP_MOD_ID, 0, 1, 20144 SL_ERROR|SL_TRACE, 20145 "tcp_bind: no priv for port %d", 20146 requested_port); 20147 } 20148 return (-TACCES); 20149 } 20150 } 20151 user_specified = B_TRUE; 20152 20153 connp = tcp->tcp_connp; 20154 if (is_system_labeled()) { 20155 zone = crgetzone(cr); 20156 addrtype = tsol_mlp_addr_type( 20157 connp->conn_allzones ? ALL_ZONES : zone->zone_id, 20158 IPV6_VERSION, &v6addr, 20159 tcps->tcps_netstack->netstack_ip); 20160 if (addrtype == mlptSingle) { 20161 return (-TNOADDR); 20162 } 20163 mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, 20164 requested_port, addrtype); 20165 } 20166 } 20167 20168 if (mlptype != mlptSingle) { 20169 if (secpolicy_net_bindmlp(cr) != 0) { 20170 if (connp->conn_debug) { 20171 (void) strlog(TCP_MOD_ID, 0, 1, 20172 SL_ERROR|SL_TRACE, 20173 "tcp_bind: no priv for multilevel port %d", 20174 requested_port); 20175 } 20176 return (-TACCES); 20177 } 20178 20179 /* 20180 * If we're specifically binding a shared IP address and the 20181 * port is MLP on shared addresses, then check to see if this 20182 * zone actually owns the MLP. Reject if not. 20183 */ 20184 if (mlptype == mlptShared && addrtype == mlptShared) { 20185 /* 20186 * No need to handle exclusive-stack zones since 20187 * ALL_ZONES only applies to the shared stack. 20188 */ 20189 zoneid_t mlpzone; 20190 20191 mlpzone = tsol_mlp_findzone(IPPROTO_TCP, 20192 htons(mlp_port)); 20193 if (connp->conn_zoneid != mlpzone) { 20194 if (connp->conn_debug) { 20195 (void) strlog(TCP_MOD_ID, 0, 1, 20196 SL_ERROR|SL_TRACE, 20197 "tcp_bind: attempt to bind port " 20198 "%d on shared addr in zone %d " 20199 "(should be %d)", 20200 mlp_port, connp->conn_zoneid, 20201 mlpzone); 20202 } 20203 return (-TACCES); 20204 } 20205 } 20206 20207 if (!user_specified) { 20208 int err; 20209 err = tsol_mlp_anon(zone, mlptype, connp->conn_proto, 20210 requested_port, B_TRUE); 20211 if (err != 0) { 20212 if (connp->conn_debug) { 20213 (void) strlog(TCP_MOD_ID, 0, 1, 20214 SL_ERROR|SL_TRACE, 20215 "tcp_bind: cannot establish anon " 20216 "MLP for port %d", 20217 requested_port); 20218 } 20219 return (err); 20220 } 20221 connp->conn_anon_port = B_TRUE; 20222 } 20223 connp->conn_mlp_type = mlptype; 20224 } 20225 20226 allocated_port = tcp_bindi(tcp, requested_port, &v6addr, 20227 connp->conn_reuseaddr, B_FALSE, bind_to_req_port_only, 20228 user_specified); 20229 20230 if (allocated_port == 0) { 20231 connp->conn_mlp_type = mlptSingle; 20232 if (connp->conn_anon_port) { 20233 connp->conn_anon_port = B_FALSE; 20234 (void) tsol_mlp_anon(zone, mlptype, connp->conn_proto, 20235 requested_port, B_FALSE); 20236 } 20237 if (bind_to_req_port_only) { 20238 if (connp->conn_debug) { 20239 (void) strlog(TCP_MOD_ID, 0, 1, 20240 SL_ERROR|SL_TRACE, 20241 "tcp_bind: requested addr busy"); 20242 } 20243 return (-TADDRBUSY); 20244 } else { 20245 /* If we are out of ports, fail the bind. */ 20246 if (connp->conn_debug) { 20247 (void) strlog(TCP_MOD_ID, 0, 1, 20248 SL_ERROR|SL_TRACE, 20249 "tcp_bind: out of ports?"); 20250 } 20251 return (-TNOADDR); 20252 } 20253 } 20254 20255 /* Pass the allocated port back */ 20256 *requested_port_ptr = allocated_port; 20257 return (0); 20258 } 20259 20260 /* 20261 * Check the address and check/pick a local port number. 20262 */ 20263 static int 20264 tcp_bind_check(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 20265 boolean_t bind_to_req_port_only) 20266 { 20267 tcp_t *tcp = connp->conn_tcp; 20268 sin_t *sin; 20269 sin6_t *sin6; 20270 in_port_t requested_port; 20271 ipaddr_t v4addr; 20272 in6_addr_t v6addr; 20273 ip_laddr_t laddr_type = IPVL_UNICAST_UP; /* INADDR_ANY */ 20274 zoneid_t zoneid = IPCL_ZONEID(connp); 20275 ip_stack_t *ipst = connp->conn_netstack->netstack_ip; 20276 uint_t scopeid = 0; 20277 int error = 0; 20278 ip_xmit_attr_t *ixa = connp->conn_ixa; 20279 20280 ASSERT((uintptr_t)len <= (uintptr_t)INT_MAX); 20281 20282 if (tcp->tcp_state == TCPS_BOUND) { 20283 return (0); 20284 } else if (tcp->tcp_state > TCPS_BOUND) { 20285 if (connp->conn_debug) { 20286 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 20287 "tcp_bind: bad state, %d", tcp->tcp_state); 20288 } 20289 return (-TOUTSTATE); 20290 } 20291 20292 ASSERT(sa != NULL && len != 0); 20293 20294 if (!OK_32PTR((char *)sa)) { 20295 if (connp->conn_debug) { 20296 (void) strlog(TCP_MOD_ID, 0, 1, 20297 SL_ERROR|SL_TRACE, 20298 "tcp_bind: bad address parameter, " 20299 "address %p, len %d", 20300 (void *)sa, len); 20301 } 20302 return (-TPROTO); 20303 } 20304 20305 error = proto_verify_ip_addr(connp->conn_family, sa, len); 20306 if (error != 0) { 20307 return (error); 20308 } 20309 20310 switch (len) { 20311 case sizeof (sin_t): /* Complete IPv4 address */ 20312 sin = (sin_t *)sa; 20313 requested_port = ntohs(sin->sin_port); 20314 v4addr = sin->sin_addr.s_addr; 20315 IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr); 20316 if (v4addr != INADDR_ANY) { 20317 laddr_type = ip_laddr_verify_v4(v4addr, zoneid, ipst, 20318 B_FALSE); 20319 } 20320 break; 20321 20322 case sizeof (sin6_t): /* Complete IPv6 address */ 20323 sin6 = (sin6_t *)sa; 20324 v6addr = sin6->sin6_addr; 20325 requested_port = ntohs(sin6->sin6_port); 20326 if (IN6_IS_ADDR_V4MAPPED(&v6addr)) { 20327 if (connp->conn_ipv6_v6only) 20328 return (EADDRNOTAVAIL); 20329 20330 IN6_V4MAPPED_TO_IPADDR(&v6addr, v4addr); 20331 if (v4addr != INADDR_ANY) { 20332 laddr_type = ip_laddr_verify_v4(v4addr, 20333 zoneid, ipst, B_FALSE); 20334 } 20335 } else { 20336 if (!IN6_IS_ADDR_UNSPECIFIED(&v6addr)) { 20337 if (IN6_IS_ADDR_LINKSCOPE(&v6addr)) 20338 scopeid = sin6->sin6_scope_id; 20339 laddr_type = ip_laddr_verify_v6(&v6addr, 20340 zoneid, ipst, B_FALSE, scopeid); 20341 } 20342 } 20343 break; 20344 20345 default: 20346 if (connp->conn_debug) { 20347 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 20348 "tcp_bind: bad address length, %d", len); 20349 } 20350 return (EAFNOSUPPORT); 20351 /* return (-TBADADDR); */ 20352 } 20353 20354 /* Is the local address a valid unicast address? */ 20355 if (laddr_type == IPVL_BAD) 20356 return (EADDRNOTAVAIL); 20357 20358 connp->conn_bound_addr_v6 = v6addr; 20359 if (scopeid != 0) { 20360 ixa->ixa_flags |= IXAF_SCOPEID_SET; 20361 ixa->ixa_scopeid = scopeid; 20362 connp->conn_incoming_ifindex = scopeid; 20363 } else { 20364 ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 20365 connp->conn_incoming_ifindex = connp->conn_bound_if; 20366 } 20367 20368 connp->conn_laddr_v6 = v6addr; 20369 connp->conn_saddr_v6 = v6addr; 20370 20371 bind_to_req_port_only = requested_port != 0 && bind_to_req_port_only; 20372 20373 error = tcp_bind_select_lport(tcp, &requested_port, 20374 bind_to_req_port_only, cr); 20375 if (error != 0) { 20376 connp->conn_laddr_v6 = ipv6_all_zeros; 20377 connp->conn_saddr_v6 = ipv6_all_zeros; 20378 connp->conn_bound_addr_v6 = ipv6_all_zeros; 20379 } 20380 return (error); 20381 } 20382 20383 /* 20384 * Return unix error is tli error is TSYSERR, otherwise return a negative 20385 * tli error. 20386 */ 20387 int 20388 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 20389 boolean_t bind_to_req_port_only) 20390 { 20391 int error; 20392 tcp_t *tcp = connp->conn_tcp; 20393 20394 if (tcp->tcp_state >= TCPS_BOUND) { 20395 if (connp->conn_debug) { 20396 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 20397 "tcp_bind: bad state, %d", tcp->tcp_state); 20398 } 20399 return (-TOUTSTATE); 20400 } 20401 20402 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only); 20403 if (error != 0) 20404 return (error); 20405 20406 ASSERT(tcp->tcp_state == TCPS_BOUND); 20407 tcp->tcp_conn_req_max = 0; 20408 return (0); 20409 } 20410 20411 int 20412 tcp_bind(sock_lower_handle_t proto_handle, struct sockaddr *sa, 20413 socklen_t len, cred_t *cr) 20414 { 20415 int error; 20416 conn_t *connp = (conn_t *)proto_handle; 20417 squeue_t *sqp = connp->conn_sqp; 20418 20419 /* All Solaris components should pass a cred for this operation. */ 20420 ASSERT(cr != NULL); 20421 20422 ASSERT(sqp != NULL); 20423 ASSERT(connp->conn_upper_handle != NULL); 20424 20425 error = squeue_synch_enter(sqp, connp, NULL); 20426 if (error != 0) { 20427 /* failed to enter */ 20428 return (ENOSR); 20429 } 20430 20431 /* binding to a NULL address really means unbind */ 20432 if (sa == NULL) { 20433 if (connp->conn_tcp->tcp_state < TCPS_LISTEN) 20434 error = tcp_do_unbind(connp); 20435 else 20436 error = EINVAL; 20437 } else { 20438 error = tcp_do_bind(connp, sa, len, cr, B_TRUE); 20439 } 20440 20441 squeue_synch_exit(sqp, connp); 20442 20443 if (error < 0) { 20444 if (error == -TOUTSTATE) 20445 error = EINVAL; 20446 else 20447 error = proto_tlitosyserr(-error); 20448 } 20449 20450 return (error); 20451 } 20452 20453 /* 20454 * If the return value from this function is positive, it's a UNIX error. 20455 * Otherwise, if it's negative, then the absolute value is a TLI error. 20456 * the TPI routine tcp_tpi_connect() is a wrapper function for this. 20457 */ 20458 int 20459 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 20460 cred_t *cr, pid_t pid) 20461 { 20462 tcp_t *tcp = connp->conn_tcp; 20463 sin_t *sin = (sin_t *)sa; 20464 sin6_t *sin6 = (sin6_t *)sa; 20465 ipaddr_t *dstaddrp; 20466 in_port_t dstport; 20467 uint_t srcid; 20468 int error; 20469 uint32_t mss; 20470 mblk_t *syn_mp; 20471 tcp_stack_t *tcps = tcp->tcp_tcps; 20472 int32_t oldstate; 20473 ip_xmit_attr_t *ixa = connp->conn_ixa; 20474 20475 oldstate = tcp->tcp_state; 20476 20477 switch (len) { 20478 default: 20479 /* 20480 * Should never happen 20481 */ 20482 return (EINVAL); 20483 20484 case sizeof (sin_t): 20485 sin = (sin_t *)sa; 20486 if (sin->sin_port == 0) { 20487 return (-TBADADDR); 20488 } 20489 if (connp->conn_ipv6_v6only) { 20490 return (EAFNOSUPPORT); 20491 } 20492 break; 20493 20494 case sizeof (sin6_t): 20495 sin6 = (sin6_t *)sa; 20496 if (sin6->sin6_port == 0) { 20497 return (-TBADADDR); 20498 } 20499 break; 20500 } 20501 /* 20502 * If we're connecting to an IPv4-mapped IPv6 address, we need to 20503 * make sure that the conn_ipversion is IPV4_VERSION. We 20504 * need to this before we call tcp_bindi() so that the port lookup 20505 * code will look for ports in the correct port space (IPv4 and 20506 * IPv6 have separate port spaces). 20507 */ 20508 if (connp->conn_family == AF_INET6 && 20509 connp->conn_ipversion == IPV6_VERSION && 20510 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 20511 if (connp->conn_ipv6_v6only) 20512 return (EADDRNOTAVAIL); 20513 20514 connp->conn_ipversion = IPV4_VERSION; 20515 } 20516 20517 switch (tcp->tcp_state) { 20518 case TCPS_LISTEN: 20519 /* 20520 * Listening sockets are not allowed to issue connect(). 20521 */ 20522 if (IPCL_IS_NONSTR(connp)) 20523 return (EOPNOTSUPP); 20524 /* FALLTHRU */ 20525 case TCPS_IDLE: 20526 /* 20527 * We support quick connect, refer to comments in 20528 * tcp_connect_*() 20529 */ 20530 /* FALLTHRU */ 20531 case TCPS_BOUND: 20532 break; 20533 default: 20534 return (-TOUTSTATE); 20535 } 20536 20537 /* 20538 * We update our cred/cpid based on the caller of connect 20539 */ 20540 if (connp->conn_cred != cr) { 20541 crhold(cr); 20542 crfree(connp->conn_cred); 20543 connp->conn_cred = cr; 20544 } 20545 connp->conn_cpid = pid; 20546 20547 /* Cache things in the ixa without any refhold */ 20548 ixa->ixa_cred = cr; 20549 ixa->ixa_cpid = pid; 20550 if (is_system_labeled()) { 20551 /* We need to restart with a label based on the cred */ 20552 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 20553 } 20554 20555 if (connp->conn_family == AF_INET6) { 20556 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 20557 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr, 20558 sin6->sin6_port, sin6->sin6_flowinfo, 20559 sin6->__sin6_src_id, sin6->sin6_scope_id); 20560 } else { 20561 /* 20562 * Destination adress is mapped IPv6 address. 20563 * Source bound address should be unspecified or 20564 * IPv6 mapped address as well. 20565 */ 20566 if (!IN6_IS_ADDR_UNSPECIFIED( 20567 &connp->conn_bound_addr_v6) && 20568 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) { 20569 return (EADDRNOTAVAIL); 20570 } 20571 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 20572 dstport = sin6->sin6_port; 20573 srcid = sin6->__sin6_src_id; 20574 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, 20575 srcid); 20576 } 20577 } else { 20578 dstaddrp = &sin->sin_addr.s_addr; 20579 dstport = sin->sin_port; 20580 srcid = 0; 20581 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid); 20582 } 20583 20584 if (error != 0) 20585 goto connect_failed; 20586 20587 CL_INET_CONNECT(connp, B_TRUE, error); 20588 if (error != 0) 20589 goto connect_failed; 20590 20591 /* connect succeeded */ 20592 BUMP_MIB(&tcps->tcps_mib, tcpActiveOpens); 20593 tcp->tcp_active_open = 1; 20594 20595 /* 20596 * tcp_set_destination() does not adjust for TCP/IP header length. 20597 */ 20598 mss = tcp->tcp_mss - connp->conn_ht_iphc_len; 20599 20600 /* 20601 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up 20602 * to the nearest MSS. 20603 * 20604 * We do the round up here because we need to get the interface MTU 20605 * first before we can do the round up. 20606 */ 20607 tcp->tcp_rwnd = connp->conn_rcvbuf; 20608 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 20609 tcps->tcps_recv_hiwat_minmss * mss); 20610 connp->conn_rcvbuf = tcp->tcp_rwnd; 20611 tcp_set_ws_value(tcp); 20612 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 20613 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) 20614 tcp->tcp_snd_ws_ok = B_TRUE; 20615 20616 /* 20617 * Set tcp_snd_ts_ok to true 20618 * so that tcp_xmit_mp will 20619 * include the timestamp 20620 * option in the SYN segment. 20621 */ 20622 if (tcps->tcps_tstamp_always || 20623 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { 20624 tcp->tcp_snd_ts_ok = B_TRUE; 20625 } 20626 20627 /* 20628 * tcp_snd_sack_ok can be set in 20629 * tcp_set_destination() if the sack metric 20630 * is set. So check it here also. 20631 */ 20632 if (tcps->tcps_sack_permitted == 2 || 20633 tcp->tcp_snd_sack_ok) { 20634 if (tcp->tcp_sack_info == NULL) { 20635 tcp->tcp_sack_info = kmem_cache_alloc( 20636 tcp_sack_info_cache, KM_SLEEP); 20637 } 20638 tcp->tcp_snd_sack_ok = B_TRUE; 20639 } 20640 20641 /* 20642 * Should we use ECN? Note that the current 20643 * default value (SunOS 5.9) of tcp_ecn_permitted 20644 * is 1. The reason for doing this is that there 20645 * are equipments out there that will drop ECN 20646 * enabled IP packets. Setting it to 1 avoids 20647 * compatibility problems. 20648 */ 20649 if (tcps->tcps_ecn_permitted == 2) 20650 tcp->tcp_ecn_ok = B_TRUE; 20651 20652 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20653 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 20654 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 20655 if (syn_mp != NULL) { 20656 /* 20657 * We must bump the generation before sending the syn 20658 * to ensure that we use the right generation in case 20659 * this thread issues a "connected" up call. 20660 */ 20661 SOCK_CONNID_BUMP(tcp->tcp_connid); 20662 tcp_send_data(tcp, syn_mp); 20663 } 20664 20665 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 20666 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 20667 return (0); 20668 20669 connect_failed: 20670 connp->conn_faddr_v6 = ipv6_all_zeros; 20671 connp->conn_fport = 0; 20672 tcp->tcp_state = oldstate; 20673 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 20674 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 20675 return (error); 20676 } 20677 20678 int 20679 tcp_connect(sock_lower_handle_t proto_handle, const struct sockaddr *sa, 20680 socklen_t len, sock_connid_t *id, cred_t *cr) 20681 { 20682 conn_t *connp = (conn_t *)proto_handle; 20683 squeue_t *sqp = connp->conn_sqp; 20684 int error; 20685 20686 ASSERT(connp->conn_upper_handle != NULL); 20687 20688 /* All Solaris components should pass a cred for this operation. */ 20689 ASSERT(cr != NULL); 20690 20691 error = proto_verify_ip_addr(connp->conn_family, sa, len); 20692 if (error != 0) { 20693 return (error); 20694 } 20695 20696 error = squeue_synch_enter(sqp, connp, NULL); 20697 if (error != 0) { 20698 /* failed to enter */ 20699 return (ENOSR); 20700 } 20701 20702 /* 20703 * TCP supports quick connect, so no need to do an implicit bind 20704 */ 20705 error = tcp_do_connect(connp, sa, len, cr, curproc->p_pid); 20706 if (error == 0) { 20707 *id = connp->conn_tcp->tcp_connid; 20708 } else if (error < 0) { 20709 if (error == -TOUTSTATE) { 20710 switch (connp->conn_tcp->tcp_state) { 20711 case TCPS_SYN_SENT: 20712 error = EALREADY; 20713 break; 20714 case TCPS_ESTABLISHED: 20715 error = EISCONN; 20716 break; 20717 case TCPS_LISTEN: 20718 error = EOPNOTSUPP; 20719 break; 20720 default: 20721 error = EINVAL; 20722 break; 20723 } 20724 } else { 20725 error = proto_tlitosyserr(-error); 20726 } 20727 } 20728 20729 if (connp->conn_tcp->tcp_loopback) { 20730 struct sock_proto_props sopp; 20731 20732 sopp.sopp_flags = SOCKOPT_LOOPBACK; 20733 sopp.sopp_loopback = B_TRUE; 20734 20735 (*connp->conn_upcalls->su_set_proto_props)( 20736 connp->conn_upper_handle, &sopp); 20737 } 20738 done: 20739 squeue_synch_exit(sqp, connp); 20740 20741 return ((error == 0) ? EINPROGRESS : error); 20742 } 20743 20744 /* ARGSUSED */ 20745 sock_lower_handle_t 20746 tcp_create(int family, int type, int proto, sock_downcalls_t **sock_downcalls, 20747 uint_t *smodep, int *errorp, int flags, cred_t *credp) 20748 { 20749 conn_t *connp; 20750 boolean_t isv6 = family == AF_INET6; 20751 if (type != SOCK_STREAM || (family != AF_INET && family != AF_INET6) || 20752 (proto != 0 && proto != IPPROTO_TCP)) { 20753 *errorp = EPROTONOSUPPORT; 20754 return (NULL); 20755 } 20756 20757 connp = tcp_create_common(credp, isv6, B_TRUE, errorp); 20758 if (connp == NULL) { 20759 return (NULL); 20760 } 20761 20762 /* 20763 * Put the ref for TCP. Ref for IP was already put 20764 * by ipcl_conn_create. Also Make the conn_t globally 20765 * visible to walkers 20766 */ 20767 mutex_enter(&connp->conn_lock); 20768 CONN_INC_REF_LOCKED(connp); 20769 ASSERT(connp->conn_ref == 2); 20770 connp->conn_state_flags &= ~CONN_INCIPIENT; 20771 20772 connp->conn_flags |= IPCL_NONSTR; 20773 mutex_exit(&connp->conn_lock); 20774 20775 ASSERT(errorp != NULL); 20776 *errorp = 0; 20777 *sock_downcalls = &sock_tcp_downcalls; 20778 *smodep = SM_CONNREQUIRED | SM_EXDATA | SM_ACCEPTSUPP | 20779 SM_SENDFILESUPP; 20780 20781 return ((sock_lower_handle_t)connp); 20782 } 20783 20784 /* ARGSUSED */ 20785 void 20786 tcp_activate(sock_lower_handle_t proto_handle, sock_upper_handle_t sock_handle, 20787 sock_upcalls_t *sock_upcalls, int flags, cred_t *cr) 20788 { 20789 conn_t *connp = (conn_t *)proto_handle; 20790 struct sock_proto_props sopp; 20791 20792 ASSERT(connp->conn_upper_handle == NULL); 20793 20794 /* All Solaris components should pass a cred for this operation. */ 20795 ASSERT(cr != NULL); 20796 20797 sopp.sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_RCVLOWAT | 20798 SOCKOPT_MAXPSZ | SOCKOPT_MAXBLK | SOCKOPT_RCVTIMER | 20799 SOCKOPT_RCVTHRESH | SOCKOPT_MAXADDRLEN | SOCKOPT_MINPSZ; 20800 20801 sopp.sopp_rxhiwat = SOCKET_RECVHIWATER; 20802 sopp.sopp_rxlowat = SOCKET_RECVLOWATER; 20803 sopp.sopp_maxpsz = INFPSZ; 20804 sopp.sopp_maxblk = INFPSZ; 20805 sopp.sopp_rcvtimer = SOCKET_TIMER_INTERVAL; 20806 sopp.sopp_rcvthresh = SOCKET_RECVHIWATER >> 3; 20807 sopp.sopp_maxaddrlen = sizeof (sin6_t); 20808 sopp.sopp_minpsz = (tcp_rinfo.mi_minpsz == 1) ? 0 : 20809 tcp_rinfo.mi_minpsz; 20810 20811 connp->conn_upcalls = sock_upcalls; 20812 connp->conn_upper_handle = sock_handle; 20813 20814 ASSERT(connp->conn_rcvbuf != 0 && 20815 connp->conn_rcvbuf == connp->conn_tcp->tcp_rwnd); 20816 (*sock_upcalls->su_set_proto_props)(sock_handle, &sopp); 20817 } 20818 20819 /* ARGSUSED */ 20820 int 20821 tcp_close(sock_lower_handle_t proto_handle, int flags, cred_t *cr) 20822 { 20823 conn_t *connp = (conn_t *)proto_handle; 20824 20825 ASSERT(connp->conn_upper_handle != NULL); 20826 20827 /* All Solaris components should pass a cred for this operation. */ 20828 ASSERT(cr != NULL); 20829 20830 tcp_close_common(connp, flags); 20831 20832 ip_free_helper_stream(connp); 20833 20834 /* 20835 * Drop IP's reference on the conn. This is the last reference 20836 * on the connp if the state was less than established. If the 20837 * connection has gone into timewait state, then we will have 20838 * one ref for the TCP and one more ref (total of two) for the 20839 * classifier connected hash list (a timewait connections stays 20840 * in connected hash till closed). 20841 * 20842 * We can't assert the references because there might be other 20843 * transient reference places because of some walkers or queued 20844 * packets in squeue for the timewait state. 20845 */ 20846 CONN_DEC_REF(connp); 20847 return (0); 20848 } 20849 20850 /* ARGSUSED */ 20851 int 20852 tcp_sendmsg(sock_lower_handle_t proto_handle, mblk_t *mp, struct nmsghdr *msg, 20853 cred_t *cr) 20854 { 20855 tcp_t *tcp; 20856 uint32_t msize; 20857 conn_t *connp = (conn_t *)proto_handle; 20858 int32_t tcpstate; 20859 20860 /* All Solaris components should pass a cred for this operation. */ 20861 ASSERT(cr != NULL); 20862 20863 ASSERT(connp->conn_ref >= 2); 20864 ASSERT(connp->conn_upper_handle != NULL); 20865 20866 if (msg->msg_controllen != 0) { 20867 freemsg(mp); 20868 return (EOPNOTSUPP); 20869 } 20870 20871 switch (DB_TYPE(mp)) { 20872 case M_DATA: 20873 tcp = connp->conn_tcp; 20874 ASSERT(tcp != NULL); 20875 20876 tcpstate = tcp->tcp_state; 20877 if (tcpstate < TCPS_ESTABLISHED) { 20878 freemsg(mp); 20879 /* 20880 * We return ENOTCONN if the endpoint is trying to 20881 * connect or has never been connected, and EPIPE if it 20882 * has been disconnected. The connection id helps us 20883 * distinguish between the last two cases. 20884 */ 20885 return ((tcpstate == TCPS_SYN_SENT) ? ENOTCONN : 20886 ((tcp->tcp_connid > 0) ? EPIPE : ENOTCONN)); 20887 } else if (tcpstate > TCPS_CLOSE_WAIT) { 20888 freemsg(mp); 20889 return (EPIPE); 20890 } 20891 20892 msize = msgdsize(mp); 20893 20894 mutex_enter(&tcp->tcp_non_sq_lock); 20895 tcp->tcp_squeue_bytes += msize; 20896 /* 20897 * Squeue Flow Control 20898 */ 20899 if (TCP_UNSENT_BYTES(tcp) > connp->conn_sndbuf) { 20900 tcp_setqfull(tcp); 20901 } 20902 mutex_exit(&tcp->tcp_non_sq_lock); 20903 20904 /* 20905 * The application may pass in an address in the msghdr, but 20906 * we ignore the address on connection-oriented sockets. 20907 * Just like BSD this code does not generate an error for 20908 * TCP (a CONNREQUIRED socket) when sending to an address 20909 * passed in with sendto/sendmsg. Instead the data is 20910 * delivered on the connection as if no address had been 20911 * supplied. 20912 */ 20913 CONN_INC_REF(connp); 20914 20915 if (msg->msg_flags & MSG_OOB) { 20916 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_output_urgent, 20917 connp, NULL, tcp_squeue_flag, SQTAG_TCP_OUTPUT); 20918 } else { 20919 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_output, 20920 connp, NULL, tcp_squeue_flag, SQTAG_TCP_OUTPUT); 20921 } 20922 20923 return (0); 20924 20925 default: 20926 ASSERT(0); 20927 } 20928 20929 freemsg(mp); 20930 return (0); 20931 } 20932 20933 /* ARGSUSED2 */ 20934 void 20935 tcp_output_urgent(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 20936 { 20937 int len; 20938 uint32_t msize; 20939 conn_t *connp = (conn_t *)arg; 20940 tcp_t *tcp = connp->conn_tcp; 20941 20942 msize = msgdsize(mp); 20943 20944 len = msize - 1; 20945 if (len < 0) { 20946 freemsg(mp); 20947 return; 20948 } 20949 20950 /* 20951 * Try to force urgent data out on the wire. Even if we have unsent 20952 * data this will at least send the urgent flag. 20953 * XXX does not handle more flag correctly. 20954 */ 20955 len += tcp->tcp_unsent; 20956 len += tcp->tcp_snxt; 20957 tcp->tcp_urg = len; 20958 tcp->tcp_valid_bits |= TCP_URG_VALID; 20959 20960 /* Bypass tcp protocol for fused tcp loopback */ 20961 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize)) 20962 return; 20963 20964 /* Strip off the T_EXDATA_REQ if the data is from TPI */ 20965 if (DB_TYPE(mp) != M_DATA) { 20966 mblk_t *mp1 = mp; 20967 ASSERT(!IPCL_IS_NONSTR(connp)); 20968 mp = mp->b_cont; 20969 freeb(mp1); 20970 } 20971 tcp_wput_data(tcp, mp, B_TRUE); 20972 } 20973 20974 /* ARGSUSED3 */ 20975 int 20976 tcp_getpeername(sock_lower_handle_t proto_handle, struct sockaddr *addr, 20977 socklen_t *addrlenp, cred_t *cr) 20978 { 20979 conn_t *connp = (conn_t *)proto_handle; 20980 tcp_t *tcp = connp->conn_tcp; 20981 20982 ASSERT(connp->conn_upper_handle != NULL); 20983 /* All Solaris components should pass a cred for this operation. */ 20984 ASSERT(cr != NULL); 20985 20986 ASSERT(tcp != NULL); 20987 if (tcp->tcp_state < TCPS_SYN_RCVD) 20988 return (ENOTCONN); 20989 20990 return (conn_getpeername(connp, addr, addrlenp)); 20991 } 20992 20993 /* ARGSUSED3 */ 20994 int 20995 tcp_getsockname(sock_lower_handle_t proto_handle, struct sockaddr *addr, 20996 socklen_t *addrlenp, cred_t *cr) 20997 { 20998 conn_t *connp = (conn_t *)proto_handle; 20999 21000 /* All Solaris components should pass a cred for this operation. */ 21001 ASSERT(cr != NULL); 21002 21003 ASSERT(connp->conn_upper_handle != NULL); 21004 return (conn_getsockname(connp, addr, addrlenp)); 21005 } 21006 21007 /* 21008 * tcp_fallback 21009 * 21010 * A direct socket is falling back to using STREAMS. The queue 21011 * that is being passed down was created using tcp_open() with 21012 * the SO_FALLBACK flag set. As a result, the queue is not 21013 * associated with a conn, and the q_ptrs instead contain the 21014 * dev and minor area that should be used. 21015 * 21016 * The 'issocket' flag indicates whether the FireEngine 21017 * optimizations should be used. The common case would be that 21018 * optimizations are enabled, and they might be subsequently 21019 * disabled using the _SIOCSOCKFALLBACK ioctl. 21020 */ 21021 21022 /* 21023 * An active connection is falling back to TPI. Gather all the information 21024 * required by the STREAM head and TPI sonode and send it up. 21025 */ 21026 void 21027 tcp_fallback_noneager(tcp_t *tcp, mblk_t *stropt_mp, queue_t *q, 21028 boolean_t issocket, so_proto_quiesced_cb_t quiesced_cb) 21029 { 21030 conn_t *connp = tcp->tcp_connp; 21031 struct stroptions *stropt; 21032 struct T_capability_ack tca; 21033 struct sockaddr_in6 laddr, faddr; 21034 socklen_t laddrlen, faddrlen; 21035 short opts; 21036 int error; 21037 mblk_t *mp; 21038 21039 connp->conn_dev = (dev_t)RD(q)->q_ptr; 21040 connp->conn_minor_arena = WR(q)->q_ptr; 21041 21042 RD(q)->q_ptr = WR(q)->q_ptr = connp; 21043 21044 connp->conn_rq = RD(q); 21045 connp->conn_wq = WR(q); 21046 21047 WR(q)->q_qinfo = &tcp_sock_winit; 21048 21049 if (!issocket) 21050 tcp_use_pure_tpi(tcp); 21051 21052 /* 21053 * free the helper stream 21054 */ 21055 ip_free_helper_stream(connp); 21056 21057 /* 21058 * Notify the STREAM head about options 21059 */ 21060 DB_TYPE(stropt_mp) = M_SETOPTS; 21061 stropt = (struct stroptions *)stropt_mp->b_rptr; 21062 stropt_mp->b_wptr += sizeof (struct stroptions); 21063 stropt->so_flags = SO_HIWAT | SO_WROFF | SO_MAXBLK; 21064 21065 stropt->so_wroff = connp->conn_ht_iphc_len + (tcp->tcp_loopback ? 0 : 21066 tcp->tcp_tcps->tcps_wroff_xtra); 21067 if (tcp->tcp_snd_sack_ok) 21068 stropt->so_wroff += TCPOPT_MAX_SACK_LEN; 21069 stropt->so_hiwat = connp->conn_rcvbuf; 21070 stropt->so_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 21071 21072 putnext(RD(q), stropt_mp); 21073 21074 /* 21075 * Collect the information needed to sync with the sonode 21076 */ 21077 tcp_do_capability_ack(tcp, &tca, TC1_INFO|TC1_ACCEPTOR_ID); 21078 21079 laddrlen = faddrlen = sizeof (sin6_t); 21080 (void) tcp_getsockname((sock_lower_handle_t)connp, 21081 (struct sockaddr *)&laddr, &laddrlen, CRED()); 21082 error = tcp_getpeername((sock_lower_handle_t)connp, 21083 (struct sockaddr *)&faddr, &faddrlen, CRED()); 21084 if (error != 0) 21085 faddrlen = 0; 21086 21087 opts = 0; 21088 if (connp->conn_oobinline) 21089 opts |= SO_OOBINLINE; 21090 if (connp->conn_ixa->ixa_flags & IXAF_DONTROUTE) 21091 opts |= SO_DONTROUTE; 21092 21093 /* 21094 * Notify the socket that the protocol is now quiescent, 21095 * and it's therefore safe move data from the socket 21096 * to the stream head. 21097 */ 21098 (*quiesced_cb)(connp->conn_upper_handle, q, &tca, 21099 (struct sockaddr *)&laddr, laddrlen, 21100 (struct sockaddr *)&faddr, faddrlen, opts); 21101 21102 while ((mp = tcp->tcp_rcv_list) != NULL) { 21103 tcp->tcp_rcv_list = mp->b_next; 21104 mp->b_next = NULL; 21105 /* We never do fallback for kernel RPC */ 21106 putnext(q, mp); 21107 } 21108 tcp->tcp_rcv_last_head = NULL; 21109 tcp->tcp_rcv_last_tail = NULL; 21110 tcp->tcp_rcv_cnt = 0; 21111 } 21112 21113 /* 21114 * An eager is falling back to TPI. All we have to do is send 21115 * up a T_CONN_IND. 21116 */ 21117 void 21118 tcp_fallback_eager(tcp_t *eager, boolean_t direct_sockfs) 21119 { 21120 tcp_t *listener = eager->tcp_listener; 21121 mblk_t *mp = eager->tcp_conn.tcp_eager_conn_ind; 21122 21123 ASSERT(listener != NULL); 21124 ASSERT(mp != NULL); 21125 21126 eager->tcp_conn.tcp_eager_conn_ind = NULL; 21127 21128 /* 21129 * TLI/XTI applications will get confused by 21130 * sending eager as an option since it violates 21131 * the option semantics. So remove the eager as 21132 * option since TLI/XTI app doesn't need it anyway. 21133 */ 21134 if (!direct_sockfs) { 21135 struct T_conn_ind *conn_ind; 21136 21137 conn_ind = (struct T_conn_ind *)mp->b_rptr; 21138 conn_ind->OPT_length = 0; 21139 conn_ind->OPT_offset = 0; 21140 } 21141 21142 /* 21143 * Sockfs guarantees that the listener will not be closed 21144 * during fallback. So we can safely use the listener's queue. 21145 */ 21146 putnext(listener->tcp_connp->conn_rq, mp); 21147 } 21148 21149 int 21150 tcp_fallback(sock_lower_handle_t proto_handle, queue_t *q, 21151 boolean_t direct_sockfs, so_proto_quiesced_cb_t quiesced_cb) 21152 { 21153 tcp_t *tcp; 21154 conn_t *connp = (conn_t *)proto_handle; 21155 int error; 21156 mblk_t *stropt_mp; 21157 mblk_t *ordrel_mp; 21158 21159 tcp = connp->conn_tcp; 21160 21161 stropt_mp = allocb_wait(sizeof (struct stroptions), BPRI_HI, STR_NOSIG, 21162 NULL); 21163 21164 /* Pre-allocate the T_ordrel_ind mblk. */ 21165 ASSERT(tcp->tcp_ordrel_mp == NULL); 21166 ordrel_mp = allocb_wait(sizeof (struct T_ordrel_ind), BPRI_HI, 21167 STR_NOSIG, NULL); 21168 ordrel_mp->b_datap->db_type = M_PROTO; 21169 ((struct T_ordrel_ind *)ordrel_mp->b_rptr)->PRIM_type = T_ORDREL_IND; 21170 ordrel_mp->b_wptr += sizeof (struct T_ordrel_ind); 21171 21172 /* 21173 * Enter the squeue so that no new packets can come in 21174 */ 21175 error = squeue_synch_enter(connp->conn_sqp, connp, NULL); 21176 if (error != 0) { 21177 /* failed to enter, free all the pre-allocated messages. */ 21178 freeb(stropt_mp); 21179 freeb(ordrel_mp); 21180 /* 21181 * We cannot process the eager, so at least send out a 21182 * RST so the peer can reconnect. 21183 */ 21184 if (tcp->tcp_listener != NULL) { 21185 (void) tcp_eager_blowoff(tcp->tcp_listener, 21186 tcp->tcp_conn_req_seqnum); 21187 } 21188 return (ENOMEM); 21189 } 21190 21191 /* 21192 * Both endpoints must be of the same type (either STREAMS or 21193 * non-STREAMS) for fusion to be enabled. So if we are fused, 21194 * we have to unfuse. 21195 */ 21196 if (tcp->tcp_fused) 21197 tcp_unfuse(tcp); 21198 21199 /* 21200 * No longer a direct socket 21201 */ 21202 connp->conn_flags &= ~IPCL_NONSTR; 21203 tcp->tcp_ordrel_mp = ordrel_mp; 21204 21205 if (tcp->tcp_listener != NULL) { 21206 /* The eager will deal with opts when accept() is called */ 21207 freeb(stropt_mp); 21208 tcp_fallback_eager(tcp, direct_sockfs); 21209 } else { 21210 tcp_fallback_noneager(tcp, stropt_mp, q, direct_sockfs, 21211 quiesced_cb); 21212 } 21213 21214 /* 21215 * There should be atleast two ref's (IP + TCP) 21216 */ 21217 ASSERT(connp->conn_ref >= 2); 21218 squeue_synch_exit(connp->conn_sqp, connp); 21219 21220 return (0); 21221 } 21222 21223 /* ARGSUSED */ 21224 static void 21225 tcp_shutdown_output(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 21226 { 21227 conn_t *connp = (conn_t *)arg; 21228 tcp_t *tcp = connp->conn_tcp; 21229 21230 freemsg(mp); 21231 21232 if (tcp->tcp_fused) 21233 tcp_unfuse(tcp); 21234 21235 if (tcp_xmit_end(tcp) != 0) { 21236 /* 21237 * We were crossing FINs and got a reset from 21238 * the other side. Just ignore it. 21239 */ 21240 if (connp->conn_debug) { 21241 (void) strlog(TCP_MOD_ID, 0, 1, 21242 SL_ERROR|SL_TRACE, 21243 "tcp_shutdown_output() out of state %s", 21244 tcp_display(tcp, NULL, DISP_ADDR_AND_PORT)); 21245 } 21246 } 21247 } 21248 21249 /* ARGSUSED */ 21250 int 21251 tcp_shutdown(sock_lower_handle_t proto_handle, int how, cred_t *cr) 21252 { 21253 conn_t *connp = (conn_t *)proto_handle; 21254 tcp_t *tcp = connp->conn_tcp; 21255 21256 ASSERT(connp->conn_upper_handle != NULL); 21257 21258 /* All Solaris components should pass a cred for this operation. */ 21259 ASSERT(cr != NULL); 21260 21261 /* 21262 * X/Open requires that we check the connected state. 21263 */ 21264 if (tcp->tcp_state < TCPS_SYN_SENT) 21265 return (ENOTCONN); 21266 21267 /* shutdown the send side */ 21268 if (how != SHUT_RD) { 21269 mblk_t *bp; 21270 21271 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 21272 CONN_INC_REF(connp); 21273 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, tcp_shutdown_output, 21274 connp, NULL, SQ_NODRAIN, SQTAG_TCP_SHUTDOWN_OUTPUT); 21275 21276 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 21277 SOCK_OPCTL_SHUT_SEND, 0); 21278 } 21279 21280 /* shutdown the recv side */ 21281 if (how != SHUT_WR) 21282 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 21283 SOCK_OPCTL_SHUT_RECV, 0); 21284 21285 return (0); 21286 } 21287 21288 /* 21289 * SOP_LISTEN() calls into tcp_listen(). 21290 */ 21291 /* ARGSUSED */ 21292 int 21293 tcp_listen(sock_lower_handle_t proto_handle, int backlog, cred_t *cr) 21294 { 21295 conn_t *connp = (conn_t *)proto_handle; 21296 int error; 21297 squeue_t *sqp = connp->conn_sqp; 21298 21299 ASSERT(connp->conn_upper_handle != NULL); 21300 21301 /* All Solaris components should pass a cred for this operation. */ 21302 ASSERT(cr != NULL); 21303 21304 error = squeue_synch_enter(sqp, connp, NULL); 21305 if (error != 0) { 21306 /* failed to enter */ 21307 return (ENOBUFS); 21308 } 21309 21310 error = tcp_do_listen(connp, NULL, 0, backlog, cr, FALSE); 21311 if (error == 0) { 21312 (*connp->conn_upcalls->su_opctl)(connp->conn_upper_handle, 21313 SOCK_OPCTL_ENAB_ACCEPT, (uintptr_t)backlog); 21314 } else if (error < 0) { 21315 if (error == -TOUTSTATE) 21316 error = EINVAL; 21317 else 21318 error = proto_tlitosyserr(-error); 21319 } 21320 squeue_synch_exit(sqp, connp); 21321 return (error); 21322 } 21323 21324 static int 21325 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len, 21326 int backlog, cred_t *cr, boolean_t bind_to_req_port_only) 21327 { 21328 tcp_t *tcp = connp->conn_tcp; 21329 int error = 0; 21330 tcp_stack_t *tcps = tcp->tcp_tcps; 21331 21332 /* All Solaris components should pass a cred for this operation. */ 21333 ASSERT(cr != NULL); 21334 21335 if (tcp->tcp_state >= TCPS_BOUND) { 21336 if ((tcp->tcp_state == TCPS_BOUND || 21337 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) { 21338 /* 21339 * Handle listen() increasing backlog. 21340 * This is more "liberal" then what the TPI spec 21341 * requires but is needed to avoid a t_unbind 21342 * when handling listen() since the port number 21343 * might be "stolen" between the unbind and bind. 21344 */ 21345 goto do_listen; 21346 } 21347 if (connp->conn_debug) { 21348 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 21349 "tcp_listen: bad state, %d", tcp->tcp_state); 21350 } 21351 return (-TOUTSTATE); 21352 } else { 21353 if (sa == NULL) { 21354 sin6_t addr; 21355 sin_t *sin; 21356 sin6_t *sin6; 21357 21358 ASSERT(IPCL_IS_NONSTR(connp)); 21359 /* Do an implicit bind: Request for a generic port. */ 21360 if (connp->conn_family == AF_INET) { 21361 len = sizeof (sin_t); 21362 sin = (sin_t *)&addr; 21363 *sin = sin_null; 21364 sin->sin_family = AF_INET; 21365 } else { 21366 ASSERT(connp->conn_family == AF_INET6); 21367 len = sizeof (sin6_t); 21368 sin6 = (sin6_t *)&addr; 21369 *sin6 = sin6_null; 21370 sin6->sin6_family = AF_INET6; 21371 } 21372 sa = (struct sockaddr *)&addr; 21373 } 21374 21375 error = tcp_bind_check(connp, sa, len, cr, 21376 bind_to_req_port_only); 21377 if (error) 21378 return (error); 21379 /* Fall through and do the fanout insertion */ 21380 } 21381 21382 do_listen: 21383 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN); 21384 tcp->tcp_conn_req_max = backlog; 21385 if (tcp->tcp_conn_req_max) { 21386 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) 21387 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; 21388 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) 21389 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; 21390 /* 21391 * If this is a listener, do not reset the eager list 21392 * and other stuffs. Note that we don't check if the 21393 * existing eager list meets the new tcp_conn_req_max 21394 * requirement. 21395 */ 21396 if (tcp->tcp_state != TCPS_LISTEN) { 21397 tcp->tcp_state = TCPS_LISTEN; 21398 /* Initialize the chain. Don't need the eager_lock */ 21399 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 21400 tcp->tcp_eager_next_drop_q0 = tcp; 21401 tcp->tcp_eager_prev_drop_q0 = tcp; 21402 tcp->tcp_second_ctimer_threshold = 21403 tcps->tcps_ip_abort_linterval; 21404 } 21405 } 21406 21407 /* 21408 * We need to make sure that the conn_recv is set to a non-null 21409 * value before we insert the conn into the classifier table. 21410 * This is to avoid a race with an incoming packet which does an 21411 * ipcl_classify(). 21412 * We initially set it to tcp_input_listener_unbound to try to 21413 * pick a good squeue for the listener when the first SYN arrives. 21414 * tcp_input_listener_unbound sets it to tcp_input_listener on that 21415 * first SYN. 21416 */ 21417 connp->conn_recv = tcp_input_listener_unbound; 21418 21419 /* Insert the listener in the classifier table */ 21420 error = ip_laddr_fanout_insert(connp); 21421 if (error != 0) { 21422 /* Undo the bind - release the port number */ 21423 tcp->tcp_state = TCPS_IDLE; 21424 connp->conn_bound_addr_v6 = ipv6_all_zeros; 21425 21426 connp->conn_laddr_v6 = ipv6_all_zeros; 21427 connp->conn_saddr_v6 = ipv6_all_zeros; 21428 connp->conn_ports = 0; 21429 21430 if (connp->conn_anon_port) { 21431 zone_t *zone; 21432 21433 zone = crgetzone(cr); 21434 connp->conn_anon_port = B_FALSE; 21435 (void) tsol_mlp_anon(zone, connp->conn_mlp_type, 21436 connp->conn_proto, connp->conn_lport, B_FALSE); 21437 } 21438 connp->conn_mlp_type = mlptSingle; 21439 21440 tcp_bind_hash_remove(tcp); 21441 return (error); 21442 } 21443 return (error); 21444 } 21445 21446 void 21447 tcp_clr_flowctrl(sock_lower_handle_t proto_handle) 21448 { 21449 conn_t *connp = (conn_t *)proto_handle; 21450 tcp_t *tcp = connp->conn_tcp; 21451 mblk_t *mp; 21452 int error; 21453 21454 ASSERT(connp->conn_upper_handle != NULL); 21455 21456 /* 21457 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_clr_flowctrl() 21458 * is currently running. 21459 */ 21460 mutex_enter(&tcp->tcp_rsrv_mp_lock); 21461 if ((mp = tcp->tcp_rsrv_mp) == NULL) { 21462 mutex_exit(&tcp->tcp_rsrv_mp_lock); 21463 return; 21464 } 21465 tcp->tcp_rsrv_mp = NULL; 21466 mutex_exit(&tcp->tcp_rsrv_mp_lock); 21467 21468 error = squeue_synch_enter(connp->conn_sqp, connp, mp); 21469 ASSERT(error == 0); 21470 21471 mutex_enter(&tcp->tcp_rsrv_mp_lock); 21472 tcp->tcp_rsrv_mp = mp; 21473 mutex_exit(&tcp->tcp_rsrv_mp_lock); 21474 21475 if (tcp->tcp_fused) { 21476 tcp_fuse_backenable(tcp); 21477 } else { 21478 tcp->tcp_rwnd = connp->conn_rcvbuf; 21479 /* 21480 * Send back a window update immediately if TCP is above 21481 * ESTABLISHED state and the increase of the rcv window 21482 * that the other side knows is at least 1 MSS after flow 21483 * control is lifted. 21484 */ 21485 if (tcp->tcp_state >= TCPS_ESTABLISHED && 21486 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 21487 tcp_xmit_ctl(NULL, tcp, 21488 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 21489 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 21490 } 21491 } 21492 21493 squeue_synch_exit(connp->conn_sqp, connp); 21494 } 21495 21496 /* ARGSUSED */ 21497 int 21498 tcp_ioctl(sock_lower_handle_t proto_handle, int cmd, intptr_t arg, 21499 int mode, int32_t *rvalp, cred_t *cr) 21500 { 21501 conn_t *connp = (conn_t *)proto_handle; 21502 int error; 21503 21504 ASSERT(connp->conn_upper_handle != NULL); 21505 21506 /* All Solaris components should pass a cred for this operation. */ 21507 ASSERT(cr != NULL); 21508 21509 /* 21510 * If we don't have a helper stream then create one. 21511 * ip_create_helper_stream takes care of locking the conn_t, 21512 * so this check for NULL is just a performance optimization. 21513 */ 21514 if (connp->conn_helper_info == NULL) { 21515 tcp_stack_t *tcps = connp->conn_tcp->tcp_tcps; 21516 21517 /* 21518 * Create a helper stream for non-STREAMS socket. 21519 */ 21520 error = ip_create_helper_stream(connp, tcps->tcps_ldi_ident); 21521 if (error != 0) { 21522 ip0dbg(("tcp_ioctl: create of IP helper stream " 21523 "failed %d\n", error)); 21524 return (error); 21525 } 21526 } 21527 21528 switch (cmd) { 21529 case ND_SET: 21530 case ND_GET: 21531 case _SIOCSOCKFALLBACK: 21532 case TCP_IOC_ABORT_CONN: 21533 case TI_GETPEERNAME: 21534 case TI_GETMYNAME: 21535 ip1dbg(("tcp_ioctl: cmd 0x%x on non sreams socket", 21536 cmd)); 21537 error = EINVAL; 21538 break; 21539 default: 21540 /* 21541 * Pass on to IP using helper stream 21542 */ 21543 error = ldi_ioctl(connp->conn_helper_info->iphs_handle, 21544 cmd, arg, mode, cr, rvalp); 21545 break; 21546 } 21547 return (error); 21548 } 21549 21550 sock_downcalls_t sock_tcp_downcalls = { 21551 tcp_activate, 21552 tcp_accept, 21553 tcp_bind, 21554 tcp_listen, 21555 tcp_connect, 21556 tcp_getpeername, 21557 tcp_getsockname, 21558 tcp_getsockopt, 21559 tcp_setsockopt, 21560 tcp_sendmsg, 21561 NULL, 21562 NULL, 21563 NULL, 21564 tcp_shutdown, 21565 tcp_clr_flowctrl, 21566 tcp_ioctl, 21567 tcp_close, 21568 }; 21569