1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #include <sys/types.h> 29 #include <sys/stream.h> 30 #include <sys/strsun.h> 31 #include <sys/strsubr.h> 32 #include <sys/stropts.h> 33 #include <sys/strlog.h> 34 #define _SUN_TPI_VERSION 2 35 #include <sys/tihdr.h> 36 #include <sys/timod.h> 37 #include <sys/ddi.h> 38 #include <sys/sunddi.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/cmn_err.h> 42 #include <sys/debug.h> 43 #include <sys/sdt.h> 44 #include <sys/vtrace.h> 45 #include <sys/kmem.h> 46 #include <sys/ethernet.h> 47 #include <sys/cpuvar.h> 48 #include <sys/dlpi.h> 49 #include <sys/pattr.h> 50 #include <sys/policy.h> 51 #include <sys/priv.h> 52 #include <sys/zone.h> 53 #include <sys/sunldi.h> 54 55 #include <sys/errno.h> 56 #include <sys/signal.h> 57 #include <sys/socket.h> 58 #include <sys/socketvar.h> 59 #include <sys/sockio.h> 60 #include <sys/isa_defs.h> 61 #include <sys/md5.h> 62 #include <sys/random.h> 63 #include <sys/uio.h> 64 #include <sys/systm.h> 65 #include <netinet/in.h> 66 #include <netinet/tcp.h> 67 #include <netinet/ip6.h> 68 #include <netinet/icmp6.h> 69 #include <net/if.h> 70 #include <net/route.h> 71 #include <inet/ipsec_impl.h> 72 73 #include <inet/common.h> 74 #include <inet/ip.h> 75 #include <inet/ip_impl.h> 76 #include <inet/ip6.h> 77 #include <inet/ip_ndp.h> 78 #include <inet/proto_set.h> 79 #include <inet/mib2.h> 80 #include <inet/nd.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <inet/tcp_impl.h> 86 #include <inet/tcp_cluster.h> 87 #include <inet/udp_impl.h> 88 #include <net/pfkeyv2.h> 89 #include <inet/ipdrop.h> 90 91 #include <inet/ipclassifier.h> 92 #include <inet/ip_ire.h> 93 #include <inet/ip_ftable.h> 94 #include <inet/ip_if.h> 95 #include <inet/ipp_common.h> 96 #include <inet/ip_rts.h> 97 #include <inet/ip_netinfo.h> 98 #include <sys/squeue_impl.h> 99 #include <sys/squeue.h> 100 #include <inet/kssl/ksslapi.h> 101 #include <sys/tsol/label.h> 102 #include <sys/tsol/tnet.h> 103 #include <rpc/pmap_prot.h> 104 #include <sys/callo.h> 105 106 /* 107 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 108 * 109 * (Read the detailed design doc in PSARC case directory) 110 * 111 * The entire tcp state is contained in tcp_t and conn_t structure 112 * which are allocated in tandem using ipcl_conn_create() and passing 113 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect 114 * the references on the tcp_t. The tcp_t structure is never compressed 115 * and packets always land on the correct TCP perimeter from the time 116 * eager is created till the time tcp_t dies (as such the old mentat 117 * TCP global queue is not used for detached state and no IPSEC checking 118 * is required). The global queue is still allocated to send out resets 119 * for connection which have no listeners and IP directly calls 120 * tcp_xmit_listeners_reset() which does any policy check. 121 * 122 * Protection and Synchronisation mechanism: 123 * 124 * The tcp data structure does not use any kind of lock for protecting 125 * its state but instead uses 'squeues' for mutual exclusion from various 126 * read and write side threads. To access a tcp member, the thread should 127 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS, 128 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller 129 * can pass any tcp function having prototype of edesc_t as argument 130 * (different from traditional STREAMs model where packets come in only 131 * designated entry points). The list of functions that can be directly 132 * called via squeue are listed before the usual function prototype. 133 * 134 * Referencing: 135 * 136 * TCP is MT-Hot and we use a reference based scheme to make sure that the 137 * tcp structure doesn't disappear when its needed. When the application 138 * creates an outgoing connection or accepts an incoming connection, we 139 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 140 * The IP reference is just a symbolic reference since ip_tcpclose() 141 * looks at tcp structure after tcp_close_output() returns which could 142 * have dropped the last TCP reference. So as long as the connection is 143 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 144 * conn_t. The classifier puts its own reference when the connection is 145 * inserted in listen or connected hash. Anytime a thread needs to enter 146 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 147 * on write side or by doing a classify on read side and then puts a 148 * reference on the conn before doing squeue_enter/tryenter/fill. For 149 * read side, the classifier itself puts the reference under fanout lock 150 * to make sure that tcp can't disappear before it gets processed. The 151 * squeue will drop this reference automatically so the called function 152 * doesn't have to do a DEC_REF. 153 * 154 * Opening a new connection: 155 * 156 * The outgoing connection open is pretty simple. tcp_open() does the 157 * work in creating the conn/tcp structure and initializing it. The 158 * squeue assignment is done based on the CPU the application 159 * is running on. So for outbound connections, processing is always done 160 * on application CPU which might be different from the incoming CPU 161 * being interrupted by the NIC. An optimal way would be to figure out 162 * the NIC <-> CPU binding at listen time, and assign the outgoing 163 * connection to the squeue attached to the CPU that will be interrupted 164 * for incoming packets (we know the NIC based on the bind IP address). 165 * This might seem like a problem if more data is going out but the 166 * fact is that in most cases the transmit is ACK driven transmit where 167 * the outgoing data normally sits on TCP's xmit queue waiting to be 168 * transmitted. 169 * 170 * Accepting a connection: 171 * 172 * This is a more interesting case because of various races involved in 173 * establishing a eager in its own perimeter. Read the meta comment on 174 * top of tcp_input_listener(). But briefly, the squeue is picked by 175 * ip_fanout based on the ring or the sender (if loopback). 176 * 177 * Closing a connection: 178 * 179 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 180 * via squeue to do the close and mark the tcp as detached if the connection 181 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 182 * reference but tcp_close() drop IP's reference always. So if tcp was 183 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 184 * and 1 because it is in classifier's connected hash. This is the condition 185 * we use to determine that its OK to clean up the tcp outside of squeue 186 * when time wait expires (check the ref under fanout and conn_lock and 187 * if it is 2, remove it from fanout hash and kill it). 188 * 189 * Although close just drops the necessary references and marks the 190 * tcp_detached state, tcp_close needs to know the tcp_detached has been 191 * set (under squeue) before letting the STREAM go away (because a 192 * inbound packet might attempt to go up the STREAM while the close 193 * has happened and tcp_detached is not set). So a special lock and 194 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 195 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 196 * tcp_detached. 197 * 198 * Special provisions and fast paths: 199 * 200 * We make special provisions for sockfs by marking tcp_issocket 201 * whenever we have only sockfs on top of TCP. This allows us to skip 202 * putting the tcp in acceptor hash since a sockfs listener can never 203 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 204 * since eager has already been allocated and the accept now happens 205 * on acceptor STREAM. There is a big blob of comment on top of 206 * tcp_input_listener explaining the new accept. When socket is POP'd, 207 * sockfs sends us an ioctl to mark the fact and we go back to old 208 * behaviour. Once tcp_issocket is unset, its never set for the 209 * life of that connection. 210 * 211 * IPsec notes : 212 * 213 * Since a packet is always executed on the correct TCP perimeter 214 * all IPsec processing is defered to IP including checking new 215 * connections and setting IPSEC policies for new connection. The 216 * only exception is tcp_xmit_listeners_reset() which is called 217 * directly from IP and needs to policy check to see if TH_RST 218 * can be sent out. 219 */ 220 221 /* 222 * Values for squeue switch: 223 * 1: SQ_NODRAIN 224 * 2: SQ_PROCESS 225 * 3: SQ_FILL 226 */ 227 int tcp_squeue_wput = 2; /* /etc/systems */ 228 int tcp_squeue_flag; 229 230 kmem_cache_t *tcp_sack_info_cache; 231 232 /* 233 * To prevent memory hog, limit the number of entries in tcp_free_list 234 * to 1% of available memory / number of cpus 235 */ 236 uint_t tcp_free_list_max_cnt = 0; 237 238 #define TCP_XMIT_LOWATER 4096 239 #define TCP_XMIT_HIWATER 49152 240 #define TCP_RECV_LOWATER 2048 241 #define TCP_RECV_HIWATER 128000 242 243 #define TIDUSZ 4096 /* transport interface data unit size */ 244 245 /* 246 * Size of acceptor hash list. It has to be a power of 2 for hashing. 247 */ 248 #define TCP_ACCEPTOR_FANOUT_SIZE 256 249 250 #ifdef _ILP32 251 #define TCP_ACCEPTOR_HASH(accid) \ 252 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 253 #else 254 #define TCP_ACCEPTOR_HASH(accid) \ 255 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 256 #endif /* _ILP32 */ 257 258 /* Minimum number of connections per listener. */ 259 static uint32_t tcp_min_conn_listener = 2; 260 261 uint32_t tcp_early_abort = 30; 262 263 /* TCP Timer control structure */ 264 typedef struct tcpt_s { 265 pfv_t tcpt_pfv; /* The routine we are to call */ 266 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 267 } tcpt_t; 268 269 /* 270 * Functions called directly via squeue having a prototype of edesc_t. 271 */ 272 void tcp_input_listener(void *arg, mblk_t *mp, void *arg2, 273 ip_recv_attr_t *ira); 274 void tcp_input_data(void *arg, mblk_t *mp, void *arg2, 275 ip_recv_attr_t *ira); 276 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, 277 ip_recv_attr_t *dummy); 278 279 280 /* Prototype for TCP functions */ 281 static void tcp_random_init(void); 282 int tcp_random(void); 283 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, 284 in_port_t dstport, uint_t srcid); 285 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, 286 in_port_t dstport, uint32_t flowinfo, 287 uint_t srcid, uint32_t scope_id); 288 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 289 cred_t *cr); 290 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 291 char *value, caddr_t cp, cred_t *cr); 292 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 293 char *value, caddr_t cp, cred_t *cr); 294 static void tcp_iss_init(tcp_t *tcp); 295 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 296 static boolean_t tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, 297 tcp_stack_t *); 298 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 299 caddr_t cp, cred_t *cr); 300 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 301 caddr_t cp, cred_t *cr); 302 static void tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *); 303 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 304 caddr_t cp, cred_t *cr); 305 static void tcp_reinit(tcp_t *tcp); 306 static void tcp_reinit_values(tcp_t *tcp); 307 308 static void tcp_wsrv(queue_t *q); 309 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa); 310 static void tcp_update_zcopy(tcp_t *tcp); 311 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 312 ixa_notify_arg_t); 313 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); 314 static void tcp_stack_fini(netstackid_t stackid, void *arg); 315 316 static int tcp_squeue_switch(int); 317 318 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); 319 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); 320 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); 321 322 static void tcp_squeue_add(squeue_t *); 323 324 struct module_info tcp_rinfo = { 325 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 326 }; 327 328 static struct module_info tcp_winfo = { 329 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 330 }; 331 332 /* 333 * Entry points for TCP as a device. The normal case which supports 334 * the TCP functionality. 335 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. 336 */ 337 struct qinit tcp_rinitv4 = { 338 NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo 339 }; 340 341 struct qinit tcp_rinitv6 = { 342 NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo 343 }; 344 345 struct qinit tcp_winit = { 346 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 347 }; 348 349 /* Initial entry point for TCP in socket mode. */ 350 struct qinit tcp_sock_winit = { 351 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 352 }; 353 354 /* TCP entry point during fallback */ 355 struct qinit tcp_fallback_sock_winit = { 356 (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo 357 }; 358 359 /* 360 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 361 * an accept. Avoid allocating data structures since eager has already 362 * been created. 363 */ 364 struct qinit tcp_acceptor_rinit = { 365 NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo 366 }; 367 368 struct qinit tcp_acceptor_winit = { 369 (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo 370 }; 371 372 /* For AF_INET aka /dev/tcp */ 373 struct streamtab tcpinfov4 = { 374 &tcp_rinitv4, &tcp_winit 375 }; 376 377 /* For AF_INET6 aka /dev/tcp6 */ 378 struct streamtab tcpinfov6 = { 379 &tcp_rinitv6, &tcp_winit 380 }; 381 382 /* 383 * Following assumes TPI alignment requirements stay along 32 bit 384 * boundaries 385 */ 386 #define ROUNDUP32(x) \ 387 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 388 389 /* Template for response to info request. */ 390 struct T_info_ack tcp_g_t_info_ack = { 391 T_INFO_ACK, /* PRIM_type */ 392 0, /* TSDU_size */ 393 T_INFINITE, /* ETSDU_size */ 394 T_INVALID, /* CDATA_size */ 395 T_INVALID, /* DDATA_size */ 396 sizeof (sin_t), /* ADDR_size */ 397 0, /* OPT_size - not initialized here */ 398 TIDUSZ, /* TIDU_size */ 399 T_COTS_ORD, /* SERV_type */ 400 TCPS_IDLE, /* CURRENT_state */ 401 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 402 }; 403 404 struct T_info_ack tcp_g_t_info_ack_v6 = { 405 T_INFO_ACK, /* PRIM_type */ 406 0, /* TSDU_size */ 407 T_INFINITE, /* ETSDU_size */ 408 T_INVALID, /* CDATA_size */ 409 T_INVALID, /* DDATA_size */ 410 sizeof (sin6_t), /* ADDR_size */ 411 0, /* OPT_size - not initialized here */ 412 TIDUSZ, /* TIDU_size */ 413 T_COTS_ORD, /* SERV_type */ 414 TCPS_IDLE, /* CURRENT_state */ 415 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 416 }; 417 418 #define PARAM_MAX (~(uint32_t)0) 419 420 /* Max size IP datagram is 64k - 1 */ 421 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcpha_t))) 422 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcpha_t))) 423 /* Max of the above */ 424 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 425 426 /* Largest TCP port number */ 427 #define TCP_MAX_PORT (64 * 1024 - 1) 428 429 /* 430 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 431 * layer header. It has to be a multiple of 4. 432 */ 433 static tcpparam_t lcl_tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 434 435 #define MB (1024 * 1024) 436 437 /* 438 * All of these are alterable, within the min/max values given, at run time. 439 * Note that the default value of "tcp_time_wait_interval" is four minutes, 440 * per the TCP spec. 441 */ 442 /* BEGIN CSTYLED */ 443 static tcpparam_t lcl_tcp_param_arr[] = { 444 /*min max value name */ 445 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 446 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 447 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 448 { 1, 1024, 1, "tcp_conn_req_min" }, 449 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 450 { 128, (1<<30), 1*MB, "tcp_cwnd_max" }, 451 { 0, 10, 0, "tcp_debug" }, 452 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 453 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 454 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 455 { 500*MS, PARAM_MAX, 5*MINUTES, "tcp_ip_abort_interval"}, 456 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 457 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 458 { 1, 255, 64, "tcp_ipv4_ttl"}, 459 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 460 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 461 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 462 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 463 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 464 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 465 { 1*MS, 20*SECONDS, 1*SECONDS, "tcp_rexmit_interval_initial"}, 466 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 467 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 468 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 469 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 470 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 471 { 0, 1, 0, "tcp_ignore_path_mtu" }, 472 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 473 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 474 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 475 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 476 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 477 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 478 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 479 { 8192, (1<<30), 1*MB, "tcp_max_buf"}, 480 /* 481 * Question: What default value should I set for tcp_strong_iss? 482 */ 483 { 0, 2, 1, "tcp_strong_iss"}, 484 { 0, 65536, 20, "tcp_rtt_updates"}, 485 { 0, 1, 1, "tcp_wscale_always"}, 486 { 0, 1, 0, "tcp_tstamp_always"}, 487 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 488 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 489 { 0, 16, 2, "tcp_deferred_acks_max"}, 490 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 491 { 1, 4, 4, "tcp_slow_start_initial"}, 492 { 0, 2, 2, "tcp_sack_permitted"}, 493 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 494 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 495 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 496 { 0, 1, 0, "tcp_rev_src_routes"}, 497 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 498 { 0, 16, 8, "tcp_local_dacks_max"}, 499 { 0, 2, 1, "tcp_ecn_permitted"}, 500 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 501 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 502 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 503 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 504 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 505 { 0, 1, 0, "tcp_dev_flow_ctl"}, 506 { 0, PARAM_MAX, 100*SECONDS, "tcp_reass_timeout"} 507 }; 508 /* END CSTYLED */ 509 510 #define IS_VMLOANED_MBLK(mp) \ 511 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 512 513 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 514 515 /* 516 * Forces all connections to obey the value of the tcps_maxpsz_multiplier 517 * tunable settable via NDD. Otherwise, the per-connection behavior is 518 * determined dynamically during tcp_set_destination(), which is the default. 519 */ 520 boolean_t tcp_static_maxpsz = B_FALSE; 521 522 /* 523 * If the receive buffer size is changed, this function is called to update 524 * the upper socket layer on the new delayed receive wake up threshold. 525 */ 526 static void 527 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh) 528 { 529 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3; 530 531 if (IPCL_IS_NONSTR(tcp->tcp_connp)) { 532 conn_t *connp = tcp->tcp_connp; 533 struct sock_proto_props sopp; 534 535 /* 536 * only increase rcvthresh upto default_threshold 537 */ 538 if (new_rcvthresh > default_threshold) 539 new_rcvthresh = default_threshold; 540 541 sopp.sopp_flags = SOCKOPT_RCVTHRESH; 542 sopp.sopp_rcvthresh = new_rcvthresh; 543 544 (*connp->conn_upcalls->su_set_proto_props) 545 (connp->conn_upper_handle, &sopp); 546 } 547 } 548 549 /* 550 * Figure out the value of window scale opton. Note that the rwnd is 551 * ASSUMED to be rounded up to the nearest MSS before the calculation. 552 * We cannot find the scale value and then do a round up of tcp_rwnd 553 * because the scale value may not be correct after that. 554 * 555 * Set the compiler flag to make this function inline. 556 */ 557 void 558 tcp_set_ws_value(tcp_t *tcp) 559 { 560 int i; 561 uint32_t rwnd = tcp->tcp_rwnd; 562 563 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 564 i++, rwnd >>= 1) 565 ; 566 tcp->tcp_rcv_ws = i; 567 } 568 569 /* 570 * Remove cached/latched IPsec references. 571 */ 572 void 573 tcp_ipsec_cleanup(tcp_t *tcp) 574 { 575 conn_t *connp = tcp->tcp_connp; 576 577 ASSERT(connp->conn_flags & IPCL_TCPCONN); 578 579 if (connp->conn_latch != NULL) { 580 IPLATCH_REFRELE(connp->conn_latch); 581 connp->conn_latch = NULL; 582 } 583 if (connp->conn_latch_in_policy != NULL) { 584 IPPOL_REFRELE(connp->conn_latch_in_policy); 585 connp->conn_latch_in_policy = NULL; 586 } 587 if (connp->conn_latch_in_action != NULL) { 588 IPACT_REFRELE(connp->conn_latch_in_action); 589 connp->conn_latch_in_action = NULL; 590 } 591 if (connp->conn_policy != NULL) { 592 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 593 connp->conn_policy = NULL; 594 } 595 } 596 597 /* 598 * Cleaup before placing on free list. 599 * Disassociate from the netstack/tcp_stack_t since the freelist 600 * is per squeue and not per netstack. 601 */ 602 void 603 tcp_cleanup(tcp_t *tcp) 604 { 605 mblk_t *mp; 606 tcp_sack_info_t *tcp_sack_info; 607 conn_t *connp = tcp->tcp_connp; 608 tcp_stack_t *tcps = tcp->tcp_tcps; 609 netstack_t *ns = tcps->tcps_netstack; 610 mblk_t *tcp_rsrv_mp; 611 612 tcp_bind_hash_remove(tcp); 613 614 /* Cleanup that which needs the netstack first */ 615 tcp_ipsec_cleanup(tcp); 616 ixa_cleanup(connp->conn_ixa); 617 618 if (connp->conn_ht_iphc != NULL) { 619 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 620 connp->conn_ht_iphc = NULL; 621 connp->conn_ht_iphc_allocated = 0; 622 connp->conn_ht_iphc_len = 0; 623 connp->conn_ht_ulp = NULL; 624 connp->conn_ht_ulp_len = 0; 625 tcp->tcp_ipha = NULL; 626 tcp->tcp_ip6h = NULL; 627 tcp->tcp_tcpha = NULL; 628 } 629 630 /* We clear any IP_OPTIONS and extension headers */ 631 ip_pkt_free(&connp->conn_xmit_ipp); 632 633 tcp_free(tcp); 634 635 /* Release any SSL context */ 636 if (tcp->tcp_kssl_ent != NULL) { 637 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 638 tcp->tcp_kssl_ent = NULL; 639 } 640 641 if (tcp->tcp_kssl_ctx != NULL) { 642 kssl_release_ctx(tcp->tcp_kssl_ctx); 643 tcp->tcp_kssl_ctx = NULL; 644 } 645 tcp->tcp_kssl_pending = B_FALSE; 646 647 /* 648 * Since we will bzero the entire structure, we need to 649 * remove it and reinsert it in global hash list. We 650 * know the walkers can't get to this conn because we 651 * had set CONDEMNED flag earlier and checked reference 652 * under conn_lock so walker won't pick it and when we 653 * go the ipcl_globalhash_remove() below, no walker 654 * can get to it. 655 */ 656 ipcl_globalhash_remove(connp); 657 658 /* Save some state */ 659 mp = tcp->tcp_timercache; 660 661 tcp_sack_info = tcp->tcp_sack_info; 662 tcp_rsrv_mp = tcp->tcp_rsrv_mp; 663 664 if (connp->conn_cred != NULL) { 665 crfree(connp->conn_cred); 666 connp->conn_cred = NULL; 667 } 668 ipcl_conn_cleanup(connp); 669 connp->conn_flags = IPCL_TCPCONN; 670 671 /* 672 * Now it is safe to decrement the reference counts. 673 * This might be the last reference on the netstack 674 * in which case it will cause the freeing of the IP Instance. 675 */ 676 connp->conn_netstack = NULL; 677 connp->conn_ixa->ixa_ipst = NULL; 678 netstack_rele(ns); 679 ASSERT(tcps != NULL); 680 tcp->tcp_tcps = NULL; 681 682 bzero(tcp, sizeof (tcp_t)); 683 684 /* restore the state */ 685 tcp->tcp_timercache = mp; 686 687 tcp->tcp_sack_info = tcp_sack_info; 688 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 689 690 tcp->tcp_connp = connp; 691 692 ASSERT(connp->conn_tcp == tcp); 693 ASSERT(connp->conn_flags & IPCL_TCPCONN); 694 connp->conn_state_flags = CONN_INCIPIENT; 695 ASSERT(connp->conn_proto == IPPROTO_TCP); 696 ASSERT(connp->conn_ref == 1); 697 } 698 699 /* 700 * Adapt to the information, such as rtt and rtt_sd, provided from the 701 * DCE and IRE maintained by IP. 702 * 703 * Checks for multicast and broadcast destination address. 704 * Returns zero if ok; an errno on failure. 705 * 706 * Note that the MSS calculation here is based on the info given in 707 * the DCE and IRE. We do not do any calculation based on TCP options. They 708 * will be handled in tcp_input_data() when TCP knows which options to use. 709 * 710 * Note on how TCP gets its parameters for a connection. 711 * 712 * When a tcp_t structure is allocated, it gets all the default parameters. 713 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd, 714 * spipe, rpipe, ... from the route metrics. Route metric overrides the 715 * default. 716 * 717 * An incoming SYN with a multicast or broadcast destination address is dropped 718 * in ip_fanout_v4/v6. 719 * 720 * An incoming SYN with a multicast or broadcast source address is always 721 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in 722 * conn_connect. 723 * The same logic in tcp_set_destination also serves to 724 * reject an attempt to connect to a broadcast or multicast (destination) 725 * address. 726 */ 727 int 728 tcp_set_destination(tcp_t *tcp) 729 { 730 uint32_t mss_max; 731 uint32_t mss; 732 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 733 conn_t *connp = tcp->tcp_connp; 734 tcp_stack_t *tcps = tcp->tcp_tcps; 735 iulp_t uinfo; 736 int error; 737 uint32_t flags; 738 739 flags = IPDF_LSO | IPDF_ZCOPY; 740 /* 741 * Make sure we have a dce for the destination to avoid dce_ident 742 * contention for connected sockets. 743 */ 744 flags |= IPDF_UNIQUE_DCE; 745 746 if (!tcps->tcps_ignore_path_mtu) 747 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 748 749 /* Use conn_lock to satify ASSERT; tcp is already serialized */ 750 mutex_enter(&connp->conn_lock); 751 error = conn_connect(connp, &uinfo, flags); 752 mutex_exit(&connp->conn_lock); 753 if (error != 0) 754 return (error); 755 756 error = tcp_build_hdrs(tcp); 757 if (error != 0) 758 return (error); 759 760 tcp->tcp_localnet = uinfo.iulp_localnet; 761 762 if (uinfo.iulp_rtt != 0) { 763 clock_t rto; 764 765 tcp->tcp_rtt_sa = uinfo.iulp_rtt; 766 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd; 767 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 768 tcps->tcps_rexmit_interval_extra + 769 (tcp->tcp_rtt_sa >> 5); 770 771 if (rto > tcps->tcps_rexmit_interval_max) { 772 tcp->tcp_rto = tcps->tcps_rexmit_interval_max; 773 } else if (rto < tcps->tcps_rexmit_interval_min) { 774 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 775 } else { 776 tcp->tcp_rto = rto; 777 } 778 } 779 if (uinfo.iulp_ssthresh != 0) 780 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh; 781 else 782 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 783 if (uinfo.iulp_spipe > 0) { 784 connp->conn_sndbuf = MIN(uinfo.iulp_spipe, 785 tcps->tcps_max_buf); 786 if (tcps->tcps_snd_lowat_fraction != 0) { 787 connp->conn_sndlowat = connp->conn_sndbuf / 788 tcps->tcps_snd_lowat_fraction; 789 } 790 (void) tcp_maxpsz_set(tcp, B_TRUE); 791 } 792 /* 793 * Note that up till now, acceptor always inherits receive 794 * window from the listener. But if there is a metrics 795 * associated with a host, we should use that instead of 796 * inheriting it from listener. Thus we need to pass this 797 * info back to the caller. 798 */ 799 if (uinfo.iulp_rpipe > 0) { 800 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe, 801 tcps->tcps_max_buf); 802 } 803 804 if (uinfo.iulp_rtomax > 0) { 805 tcp->tcp_second_timer_threshold = 806 uinfo.iulp_rtomax; 807 } 808 809 /* 810 * Use the metric option settings, iulp_tstamp_ok and 811 * iulp_wscale_ok, only for active open. What this means 812 * is that if the other side uses timestamp or window 813 * scale option, TCP will also use those options. That 814 * is for passive open. If the application sets a 815 * large window, window scale is enabled regardless of 816 * the value in iulp_wscale_ok. This is the behavior 817 * since 2.6. So we keep it. 818 * The only case left in passive open processing is the 819 * check for SACK. 820 * For ECN, it should probably be like SACK. But the 821 * current value is binary, so we treat it like the other 822 * cases. The metric only controls active open.For passive 823 * open, the ndd param, tcp_ecn_permitted, controls the 824 * behavior. 825 */ 826 if (!tcp_detached) { 827 /* 828 * The if check means that the following can only 829 * be turned on by the metrics only IRE, but not off. 830 */ 831 if (uinfo.iulp_tstamp_ok) 832 tcp->tcp_snd_ts_ok = B_TRUE; 833 if (uinfo.iulp_wscale_ok) 834 tcp->tcp_snd_ws_ok = B_TRUE; 835 if (uinfo.iulp_sack == 2) 836 tcp->tcp_snd_sack_ok = B_TRUE; 837 if (uinfo.iulp_ecn_ok) 838 tcp->tcp_ecn_ok = B_TRUE; 839 } else { 840 /* 841 * Passive open. 842 * 843 * As above, the if check means that SACK can only be 844 * turned on by the metric only IRE. 845 */ 846 if (uinfo.iulp_sack > 0) { 847 tcp->tcp_snd_sack_ok = B_TRUE; 848 } 849 } 850 851 /* 852 * XXX Note that currently, iulp_mtu can be as small as 68 853 * because of PMTUd. So tcp_mss may go to negative if combined 854 * length of all those options exceeds 28 bytes. But because 855 * of the tcp_mss_min check below, we may not have a problem if 856 * tcp_mss_min is of a reasonable value. The default is 1 so 857 * the negative problem still exists. And the check defeats PMTUd. 858 * In fact, if PMTUd finds that the MSS should be smaller than 859 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 860 * value. 861 * 862 * We do not deal with that now. All those problems related to 863 * PMTUd will be fixed later. 864 */ 865 ASSERT(uinfo.iulp_mtu != 0); 866 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu; 867 868 /* Sanity check for MSS value. */ 869 if (connp->conn_ipversion == IPV4_VERSION) 870 mss_max = tcps->tcps_mss_max_ipv4; 871 else 872 mss_max = tcps->tcps_mss_max_ipv6; 873 874 if (tcp->tcp_ipsec_overhead == 0) 875 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 876 877 mss -= tcp->tcp_ipsec_overhead; 878 879 if (mss < tcps->tcps_mss_min) 880 mss = tcps->tcps_mss_min; 881 if (mss > mss_max) 882 mss = mss_max; 883 884 /* Note that this is the maximum MSS, excluding all options. */ 885 tcp->tcp_mss = mss; 886 887 /* 888 * Update the tcp connection with LSO capability. 889 */ 890 tcp_update_lso(tcp, connp->conn_ixa); 891 892 /* 893 * Initialize the ISS here now that we have the full connection ID. 894 * The RFC 1948 method of initial sequence number generation requires 895 * knowledge of the full connection ID before setting the ISS. 896 */ 897 tcp_iss_init(tcp); 898 899 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local); 900 901 /* 902 * Make sure that conn is not marked incipient 903 * for incoming connections. A blind 904 * removal of incipient flag is cheaper than 905 * check and removal. 906 */ 907 mutex_enter(&connp->conn_lock); 908 connp->conn_state_flags &= ~CONN_INCIPIENT; 909 mutex_exit(&connp->conn_lock); 910 return (0); 911 } 912 913 /* 914 * tcp_clean_death / tcp_close_detached must not be called more than once 915 * on a tcp. Thus every function that potentially calls tcp_clean_death 916 * must check for the tcp state before calling tcp_clean_death. 917 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper, 918 * tcp_timer_handler, all check for the tcp state. 919 */ 920 /* ARGSUSED */ 921 void 922 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 923 ip_recv_attr_t *dummy) 924 { 925 tcp_t *tcp = ((conn_t *)arg)->conn_tcp; 926 927 freemsg(mp); 928 if (tcp->tcp_state > TCPS_BOUND) 929 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT); 930 } 931 932 /* 933 * We are dying for some reason. Try to do it gracefully. (May be called 934 * as writer.) 935 * 936 * Return -1 if the structure was not cleaned up (if the cleanup had to be 937 * done by a service procedure). 938 * TBD - Should the return value distinguish between the tcp_t being 939 * freed and it being reinitialized? 940 */ 941 int 942 tcp_clean_death(tcp_t *tcp, int err) 943 { 944 mblk_t *mp; 945 queue_t *q; 946 conn_t *connp = tcp->tcp_connp; 947 tcp_stack_t *tcps = tcp->tcp_tcps; 948 949 if (tcp->tcp_fused) 950 tcp_unfuse(tcp); 951 952 if (tcp->tcp_linger_tid != 0 && 953 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 954 tcp_stop_lingering(tcp); 955 } 956 957 ASSERT(tcp != NULL); 958 ASSERT((connp->conn_family == AF_INET && 959 connp->conn_ipversion == IPV4_VERSION) || 960 (connp->conn_family == AF_INET6 && 961 (connp->conn_ipversion == IPV4_VERSION || 962 connp->conn_ipversion == IPV6_VERSION))); 963 964 if (TCP_IS_DETACHED(tcp)) { 965 if (tcp->tcp_hard_binding) { 966 /* 967 * Its an eager that we are dealing with. We close the 968 * eager but in case a conn_ind has already gone to the 969 * listener, let tcp_accept_finish() send a discon_ind 970 * to the listener and drop the last reference. If the 971 * listener doesn't even know about the eager i.e. the 972 * conn_ind hasn't gone up, blow away the eager and drop 973 * the last reference as well. If the conn_ind has gone 974 * up, state should be BOUND. tcp_accept_finish 975 * will figure out that the connection has received a 976 * RST and will send a DISCON_IND to the application. 977 */ 978 tcp_closei_local(tcp); 979 if (!tcp->tcp_tconnind_started) { 980 CONN_DEC_REF(connp); 981 } else { 982 tcp->tcp_state = TCPS_BOUND; 983 } 984 } else { 985 tcp_close_detached(tcp); 986 } 987 return (0); 988 } 989 990 TCP_STAT(tcps, tcp_clean_death_nondetached); 991 992 /* 993 * The connection is dead. Decrement listener connection counter if 994 * necessary. 995 */ 996 if (tcp->tcp_listen_cnt != NULL) 997 TCP_DECR_LISTEN_CNT(tcp); 998 999 /* 1000 * When a connection is moved to TIME_WAIT state, the connection 1001 * counter is already decremented. So no need to decrement here 1002 * again. See SET_TIME_WAIT() macro. 1003 */ 1004 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1005 tcp->tcp_state < TCPS_TIME_WAIT) { 1006 TCPS_CONN_DEC(tcps); 1007 } 1008 1009 q = connp->conn_rq; 1010 1011 /* Trash all inbound data */ 1012 if (!IPCL_IS_NONSTR(connp)) { 1013 ASSERT(q != NULL); 1014 flushq(q, FLUSHALL); 1015 } 1016 1017 /* 1018 * If we are at least part way open and there is error 1019 * (err==0 implies no error) 1020 * notify our client by a T_DISCON_IND. 1021 */ 1022 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 1023 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1024 !TCP_IS_SOCKET(tcp)) { 1025 /* 1026 * Send M_FLUSH according to TPI. Because sockets will 1027 * (and must) ignore FLUSHR we do that only for TPI 1028 * endpoints and sockets in STREAMS mode. 1029 */ 1030 (void) putnextctl1(q, M_FLUSH, FLUSHR); 1031 } 1032 if (connp->conn_debug) { 1033 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 1034 "tcp_clean_death: discon err %d", err); 1035 } 1036 if (IPCL_IS_NONSTR(connp)) { 1037 /* Direct socket, use upcall */ 1038 (*connp->conn_upcalls->su_disconnected)( 1039 connp->conn_upper_handle, tcp->tcp_connid, err); 1040 } else { 1041 mp = mi_tpi_discon_ind(NULL, err, 0); 1042 if (mp != NULL) { 1043 putnext(q, mp); 1044 } else { 1045 if (connp->conn_debug) { 1046 (void) strlog(TCP_MOD_ID, 0, 1, 1047 SL_ERROR|SL_TRACE, 1048 "tcp_clean_death, sending M_ERROR"); 1049 } 1050 (void) putnextctl1(q, M_ERROR, EPROTO); 1051 } 1052 } 1053 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 1054 /* SYN_SENT or SYN_RCVD */ 1055 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1056 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 1057 /* ESTABLISHED or CLOSE_WAIT */ 1058 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1059 } 1060 } 1061 1062 tcp_reinit(tcp); 1063 if (IPCL_IS_NONSTR(connp)) 1064 (void) tcp_do_unbind(connp); 1065 1066 return (-1); 1067 } 1068 1069 /* 1070 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 1071 * to expire, stop the wait and finish the close. 1072 */ 1073 void 1074 tcp_stop_lingering(tcp_t *tcp) 1075 { 1076 clock_t delta = 0; 1077 tcp_stack_t *tcps = tcp->tcp_tcps; 1078 conn_t *connp = tcp->tcp_connp; 1079 1080 tcp->tcp_linger_tid = 0; 1081 if (tcp->tcp_state > TCPS_LISTEN) { 1082 tcp_acceptor_hash_remove(tcp); 1083 mutex_enter(&tcp->tcp_non_sq_lock); 1084 if (tcp->tcp_flow_stopped) { 1085 tcp_clrqfull(tcp); 1086 } 1087 mutex_exit(&tcp->tcp_non_sq_lock); 1088 1089 if (tcp->tcp_timer_tid != 0) { 1090 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 1091 tcp->tcp_timer_tid = 0; 1092 } 1093 /* 1094 * Need to cancel those timers which will not be used when 1095 * TCP is detached. This has to be done before the conn_wq 1096 * is cleared. 1097 */ 1098 tcp_timers_stop(tcp); 1099 1100 tcp->tcp_detached = B_TRUE; 1101 connp->conn_rq = NULL; 1102 connp->conn_wq = NULL; 1103 1104 if (tcp->tcp_state == TCPS_TIME_WAIT) { 1105 tcp_time_wait_append(tcp); 1106 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 1107 goto finish; 1108 } 1109 1110 /* 1111 * If delta is zero the timer event wasn't executed and was 1112 * successfully canceled. In this case we need to restart it 1113 * with the minimal delta possible. 1114 */ 1115 if (delta >= 0) { 1116 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 1117 delta ? delta : 1); 1118 } 1119 } else { 1120 tcp_closei_local(tcp); 1121 CONN_DEC_REF(connp); 1122 } 1123 finish: 1124 /* Signal closing thread that it can complete close */ 1125 mutex_enter(&tcp->tcp_closelock); 1126 tcp->tcp_detached = B_TRUE; 1127 connp->conn_rq = NULL; 1128 connp->conn_wq = NULL; 1129 1130 tcp->tcp_closed = 1; 1131 cv_signal(&tcp->tcp_closecv); 1132 mutex_exit(&tcp->tcp_closelock); 1133 } 1134 1135 void 1136 tcp_close_common(conn_t *connp, int flags) 1137 { 1138 tcp_t *tcp = connp->conn_tcp; 1139 mblk_t *mp = &tcp->tcp_closemp; 1140 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 1141 mblk_t *bp; 1142 1143 ASSERT(connp->conn_ref >= 2); 1144 1145 /* 1146 * Mark the conn as closing. ipsq_pending_mp_add will not 1147 * add any mp to the pending mp list, after this conn has 1148 * started closing. 1149 */ 1150 mutex_enter(&connp->conn_lock); 1151 connp->conn_state_flags |= CONN_CLOSING; 1152 if (connp->conn_oper_pending_ill != NULL) 1153 conn_ioctl_cleanup_reqd = B_TRUE; 1154 CONN_INC_REF_LOCKED(connp); 1155 mutex_exit(&connp->conn_lock); 1156 tcp->tcp_closeflags = (uint8_t)flags; 1157 ASSERT(connp->conn_ref >= 3); 1158 1159 /* 1160 * tcp_closemp_used is used below without any protection of a lock 1161 * as we don't expect any one else to use it concurrently at this 1162 * point otherwise it would be a major defect. 1163 */ 1164 1165 if (mp->b_prev == NULL) 1166 tcp->tcp_closemp_used = B_TRUE; 1167 else 1168 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " 1169 "connp %p tcp %p\n", (void *)connp, (void *)tcp); 1170 1171 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1172 1173 /* 1174 * Cleanup any queued ioctls here. This must be done before the wq/rq 1175 * are re-written by tcp_close_output(). 1176 */ 1177 if (conn_ioctl_cleanup_reqd) 1178 conn_ioctl_cleanup(connp); 1179 1180 /* 1181 * As CONN_CLOSING is set, no further ioctls should be passed down to 1182 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and 1183 * tcp_wput_iocdata). If the ioctl was queued on an ipsq, 1184 * conn_ioctl_cleanup should have found it and removed it. If the ioctl 1185 * was still in flight at the time, we wait for it here. See comments 1186 * for CONN_INC_IOCTLREF in ip.h for details. 1187 */ 1188 mutex_enter(&connp->conn_lock); 1189 while (connp->conn_ioctlref > 0) 1190 cv_wait(&connp->conn_cv, &connp->conn_lock); 1191 ASSERT(connp->conn_ioctlref == 0); 1192 ASSERT(connp->conn_oper_pending_ill == NULL); 1193 mutex_exit(&connp->conn_lock); 1194 1195 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp, 1196 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1197 1198 mutex_enter(&tcp->tcp_closelock); 1199 while (!tcp->tcp_closed) { 1200 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 1201 /* 1202 * The cv_wait_sig() was interrupted. We now do the 1203 * following: 1204 * 1205 * 1) If the endpoint was lingering, we allow this 1206 * to be interrupted by cancelling the linger timeout 1207 * and closing normally. 1208 * 1209 * 2) Revert to calling cv_wait() 1210 * 1211 * We revert to using cv_wait() to avoid an 1212 * infinite loop which can occur if the calling 1213 * thread is higher priority than the squeue worker 1214 * thread and is bound to the same cpu. 1215 */ 1216 if (connp->conn_linger && connp->conn_lingertime > 0) { 1217 mutex_exit(&tcp->tcp_closelock); 1218 /* Entering squeue, bump ref count. */ 1219 CONN_INC_REF(connp); 1220 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 1221 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, 1222 tcp_linger_interrupted, connp, NULL, 1223 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1224 mutex_enter(&tcp->tcp_closelock); 1225 } 1226 break; 1227 } 1228 } 1229 while (!tcp->tcp_closed) 1230 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 1231 mutex_exit(&tcp->tcp_closelock); 1232 1233 /* 1234 * In the case of listener streams that have eagers in the q or q0 1235 * we wait for the eagers to drop their reference to us. conn_rq and 1236 * conn_wq of the eagers point to our queues. By waiting for the 1237 * refcnt to drop to 1, we are sure that the eagers have cleaned 1238 * up their queue pointers and also dropped their references to us. 1239 */ 1240 if (tcp->tcp_wait_for_eagers) { 1241 mutex_enter(&connp->conn_lock); 1242 while (connp->conn_ref != 1) { 1243 cv_wait(&connp->conn_cv, &connp->conn_lock); 1244 } 1245 mutex_exit(&connp->conn_lock); 1246 } 1247 1248 connp->conn_cpid = NOPID; 1249 } 1250 1251 /* 1252 * Called by tcp_close() routine via squeue when lingering is 1253 * interrupted by a signal. 1254 */ 1255 1256 /* ARGSUSED */ 1257 static void 1258 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 1259 { 1260 conn_t *connp = (conn_t *)arg; 1261 tcp_t *tcp = connp->conn_tcp; 1262 1263 freeb(mp); 1264 if (tcp->tcp_linger_tid != 0 && 1265 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 1266 tcp_stop_lingering(tcp); 1267 tcp->tcp_client_errno = EINTR; 1268 } 1269 } 1270 1271 /* 1272 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 1273 * Some stream heads get upset if they see these later on as anything but NULL. 1274 */ 1275 void 1276 tcp_close_mpp(mblk_t **mpp) 1277 { 1278 mblk_t *mp; 1279 1280 if ((mp = *mpp) != NULL) { 1281 do { 1282 mp->b_next = NULL; 1283 mp->b_prev = NULL; 1284 } while ((mp = mp->b_cont) != NULL); 1285 1286 mp = *mpp; 1287 *mpp = NULL; 1288 freemsg(mp); 1289 } 1290 } 1291 1292 /* Do detached close. */ 1293 void 1294 tcp_close_detached(tcp_t *tcp) 1295 { 1296 if (tcp->tcp_fused) 1297 tcp_unfuse(tcp); 1298 1299 /* 1300 * Clustering code serializes TCP disconnect callbacks and 1301 * cluster tcp list walks by blocking a TCP disconnect callback 1302 * if a cluster tcp list walk is in progress. This ensures 1303 * accurate accounting of TCPs in the cluster code even though 1304 * the TCP list walk itself is not atomic. 1305 */ 1306 tcp_closei_local(tcp); 1307 CONN_DEC_REF(tcp->tcp_connp); 1308 } 1309 1310 /* 1311 * The tcp_t is going away. Remove it from all lists and set it 1312 * to TCPS_CLOSED. The freeing up of memory is deferred until 1313 * tcp_inactive. This is needed since a thread in tcp_rput might have 1314 * done a CONN_INC_REF on this structure before it was removed from the 1315 * hashes. 1316 */ 1317 void 1318 tcp_closei_local(tcp_t *tcp) 1319 { 1320 conn_t *connp = tcp->tcp_connp; 1321 tcp_stack_t *tcps = tcp->tcp_tcps; 1322 1323 if (!TCP_IS_SOCKET(tcp)) 1324 tcp_acceptor_hash_remove(tcp); 1325 1326 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 1327 tcp->tcp_ibsegs = 0; 1328 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 1329 tcp->tcp_obsegs = 0; 1330 1331 /* 1332 * This can be called via tcp_time_wait_processing() if TCP gets a 1333 * SYN with sequence number outside the TIME-WAIT connection's 1334 * window. So we need to check for TIME-WAIT state here as the 1335 * connection counter is already decremented. See SET_TIME_WAIT() 1336 * macro 1337 */ 1338 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1339 tcp->tcp_state < TCPS_TIME_WAIT) { 1340 TCPS_CONN_DEC(tcps); 1341 } 1342 1343 /* 1344 * If we are an eager connection hanging off a listener that 1345 * hasn't formally accepted the connection yet, get off his 1346 * list and blow off any data that we have accumulated. 1347 */ 1348 if (tcp->tcp_listener != NULL) { 1349 tcp_t *listener = tcp->tcp_listener; 1350 mutex_enter(&listener->tcp_eager_lock); 1351 /* 1352 * tcp_tconnind_started == B_TRUE means that the 1353 * conn_ind has already gone to listener. At 1354 * this point, eager will be closed but we 1355 * leave it in listeners eager list so that 1356 * if listener decides to close without doing 1357 * accept, we can clean this up. In tcp_tli_accept 1358 * we take care of the case of accept on closed 1359 * eager. 1360 */ 1361 if (!tcp->tcp_tconnind_started) { 1362 tcp_eager_unlink(tcp); 1363 mutex_exit(&listener->tcp_eager_lock); 1364 /* 1365 * We don't want to have any pointers to the 1366 * listener queue, after we have released our 1367 * reference on the listener 1368 */ 1369 ASSERT(tcp->tcp_detached); 1370 connp->conn_rq = NULL; 1371 connp->conn_wq = NULL; 1372 CONN_DEC_REF(listener->tcp_connp); 1373 } else { 1374 mutex_exit(&listener->tcp_eager_lock); 1375 } 1376 } 1377 1378 /* Stop all the timers */ 1379 tcp_timers_stop(tcp); 1380 1381 if (tcp->tcp_state == TCPS_LISTEN) { 1382 if (tcp->tcp_ip_addr_cache) { 1383 kmem_free((void *)tcp->tcp_ip_addr_cache, 1384 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1385 tcp->tcp_ip_addr_cache = NULL; 1386 } 1387 } 1388 1389 /* Decrement listerner connection counter if necessary. */ 1390 if (tcp->tcp_listen_cnt != NULL) 1391 TCP_DECR_LISTEN_CNT(tcp); 1392 1393 mutex_enter(&tcp->tcp_non_sq_lock); 1394 if (tcp->tcp_flow_stopped) 1395 tcp_clrqfull(tcp); 1396 mutex_exit(&tcp->tcp_non_sq_lock); 1397 1398 tcp_bind_hash_remove(tcp); 1399 /* 1400 * If the tcp_time_wait_collector (which runs outside the squeue) 1401 * is trying to remove this tcp from the time wait list, we will 1402 * block in tcp_time_wait_remove while trying to acquire the 1403 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 1404 * requires the ipcl_hash_remove to be ordered after the 1405 * tcp_time_wait_remove for the refcnt checks to work correctly. 1406 */ 1407 if (tcp->tcp_state == TCPS_TIME_WAIT) 1408 (void) tcp_time_wait_remove(tcp, NULL); 1409 CL_INET_DISCONNECT(connp); 1410 ipcl_hash_remove(connp); 1411 ixa_cleanup(connp->conn_ixa); 1412 1413 /* 1414 * Mark the conn as CONDEMNED 1415 */ 1416 mutex_enter(&connp->conn_lock); 1417 connp->conn_state_flags |= CONN_CONDEMNED; 1418 mutex_exit(&connp->conn_lock); 1419 1420 ASSERT(tcp->tcp_time_wait_next == NULL); 1421 ASSERT(tcp->tcp_time_wait_prev == NULL); 1422 ASSERT(tcp->tcp_time_wait_expire == 0); 1423 tcp->tcp_state = TCPS_CLOSED; 1424 1425 /* Release any SSL context */ 1426 if (tcp->tcp_kssl_ent != NULL) { 1427 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 1428 tcp->tcp_kssl_ent = NULL; 1429 } 1430 if (tcp->tcp_kssl_ctx != NULL) { 1431 kssl_release_ctx(tcp->tcp_kssl_ctx); 1432 tcp->tcp_kssl_ctx = NULL; 1433 } 1434 tcp->tcp_kssl_pending = B_FALSE; 1435 1436 tcp_ipsec_cleanup(tcp); 1437 } 1438 1439 /* 1440 * tcp is dying (called from ipcl_conn_destroy and error cases). 1441 * Free the tcp_t in either case. 1442 */ 1443 void 1444 tcp_free(tcp_t *tcp) 1445 { 1446 mblk_t *mp; 1447 conn_t *connp = tcp->tcp_connp; 1448 1449 ASSERT(tcp != NULL); 1450 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 1451 1452 connp->conn_rq = NULL; 1453 connp->conn_wq = NULL; 1454 1455 tcp_close_mpp(&tcp->tcp_xmit_head); 1456 tcp_close_mpp(&tcp->tcp_reass_head); 1457 if (tcp->tcp_rcv_list != NULL) { 1458 /* Free b_next chain */ 1459 tcp_close_mpp(&tcp->tcp_rcv_list); 1460 } 1461 if ((mp = tcp->tcp_urp_mp) != NULL) { 1462 freemsg(mp); 1463 } 1464 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1465 freemsg(mp); 1466 } 1467 1468 if (tcp->tcp_fused_sigurg_mp != NULL) { 1469 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1470 freeb(tcp->tcp_fused_sigurg_mp); 1471 tcp->tcp_fused_sigurg_mp = NULL; 1472 } 1473 1474 if (tcp->tcp_ordrel_mp != NULL) { 1475 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1476 freeb(tcp->tcp_ordrel_mp); 1477 tcp->tcp_ordrel_mp = NULL; 1478 } 1479 1480 if (tcp->tcp_sack_info != NULL) { 1481 if (tcp->tcp_notsack_list != NULL) { 1482 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 1483 tcp); 1484 } 1485 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 1486 } 1487 1488 if (tcp->tcp_hopopts != NULL) { 1489 mi_free(tcp->tcp_hopopts); 1490 tcp->tcp_hopopts = NULL; 1491 tcp->tcp_hopoptslen = 0; 1492 } 1493 ASSERT(tcp->tcp_hopoptslen == 0); 1494 if (tcp->tcp_dstopts != NULL) { 1495 mi_free(tcp->tcp_dstopts); 1496 tcp->tcp_dstopts = NULL; 1497 tcp->tcp_dstoptslen = 0; 1498 } 1499 ASSERT(tcp->tcp_dstoptslen == 0); 1500 if (tcp->tcp_rthdrdstopts != NULL) { 1501 mi_free(tcp->tcp_rthdrdstopts); 1502 tcp->tcp_rthdrdstopts = NULL; 1503 tcp->tcp_rthdrdstoptslen = 0; 1504 } 1505 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 1506 if (tcp->tcp_rthdr != NULL) { 1507 mi_free(tcp->tcp_rthdr); 1508 tcp->tcp_rthdr = NULL; 1509 tcp->tcp_rthdrlen = 0; 1510 } 1511 ASSERT(tcp->tcp_rthdrlen == 0); 1512 1513 /* 1514 * Following is really a blowing away a union. 1515 * It happens to have exactly two members of identical size 1516 * the following code is enough. 1517 */ 1518 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1519 } 1520 1521 /* 1522 * tcp_get_conn/tcp_free_conn 1523 * 1524 * tcp_get_conn is used to get a clean tcp connection structure. 1525 * It tries to reuse the connections put on the freelist by the 1526 * time_wait_collector failing which it goes to kmem_cache. This 1527 * way has two benefits compared to just allocating from and 1528 * freeing to kmem_cache. 1529 * 1) The time_wait_collector can free (which includes the cleanup) 1530 * outside the squeue. So when the interrupt comes, we have a clean 1531 * connection sitting in the freelist. Obviously, this buys us 1532 * performance. 1533 * 1534 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener 1535 * has multiple disadvantages - tying up the squeue during alloc. 1536 * But allocating the conn/tcp in IP land is also not the best since 1537 * we can't check the 'q' and 'q0' which are protected by squeue and 1538 * blindly allocate memory which might have to be freed here if we are 1539 * not allowed to accept the connection. By using the freelist and 1540 * putting the conn/tcp back in freelist, we don't pay a penalty for 1541 * allocating memory without checking 'q/q0' and freeing it if we can't 1542 * accept the connection. 1543 * 1544 * Care should be taken to put the conn back in the same squeue's freelist 1545 * from which it was allocated. Best results are obtained if conn is 1546 * allocated from listener's squeue and freed to the same. Time wait 1547 * collector will free up the freelist is the connection ends up sitting 1548 * there for too long. 1549 */ 1550 void * 1551 tcp_get_conn(void *arg, tcp_stack_t *tcps) 1552 { 1553 tcp_t *tcp = NULL; 1554 conn_t *connp = NULL; 1555 squeue_t *sqp = (squeue_t *)arg; 1556 tcp_squeue_priv_t *tcp_time_wait; 1557 netstack_t *ns; 1558 mblk_t *tcp_rsrv_mp = NULL; 1559 1560 tcp_time_wait = 1561 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1562 1563 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1564 tcp = tcp_time_wait->tcp_free_list; 1565 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 1566 if (tcp != NULL) { 1567 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1568 tcp_time_wait->tcp_free_list_cnt--; 1569 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1570 tcp->tcp_time_wait_next = NULL; 1571 connp = tcp->tcp_connp; 1572 connp->conn_flags |= IPCL_REUSED; 1573 1574 ASSERT(tcp->tcp_tcps == NULL); 1575 ASSERT(connp->conn_netstack == NULL); 1576 ASSERT(tcp->tcp_rsrv_mp != NULL); 1577 ns = tcps->tcps_netstack; 1578 netstack_hold(ns); 1579 connp->conn_netstack = ns; 1580 connp->conn_ixa->ixa_ipst = ns->netstack_ip; 1581 tcp->tcp_tcps = tcps; 1582 ipcl_globalhash_insert(connp); 1583 1584 connp->conn_ixa->ixa_notify_cookie = tcp; 1585 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify); 1586 connp->conn_recv = tcp_input_data; 1587 ASSERT(connp->conn_recvicmp == tcp_icmp_input); 1588 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp); 1589 return ((void *)connp); 1590 } 1591 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1592 /* 1593 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until 1594 * this conn_t/tcp_t is freed at ipcl_conn_destroy(). 1595 */ 1596 tcp_rsrv_mp = allocb(0, BPRI_HI); 1597 if (tcp_rsrv_mp == NULL) 1598 return (NULL); 1599 1600 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, 1601 tcps->tcps_netstack)) == NULL) { 1602 freeb(tcp_rsrv_mp); 1603 return (NULL); 1604 } 1605 1606 tcp = connp->conn_tcp; 1607 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 1608 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL); 1609 1610 tcp->tcp_tcps = tcps; 1611 1612 connp->conn_recv = tcp_input_data; 1613 connp->conn_recvicmp = tcp_icmp_input; 1614 connp->conn_verifyicmp = tcp_verifyicmp; 1615 1616 /* 1617 * Register tcp_notify to listen to capability changes detected by IP. 1618 * This upcall is made in the context of the call to conn_ip_output 1619 * thus it is inside the squeue. 1620 */ 1621 connp->conn_ixa->ixa_notify = tcp_notify; 1622 connp->conn_ixa->ixa_notify_cookie = tcp; 1623 1624 return ((void *)connp); 1625 } 1626 1627 /* 1628 * Handle connect to IPv4 destinations, including connections for AF_INET6 1629 * sockets connecting to IPv4 mapped IPv6 destinations. 1630 * Returns zero if OK, a positive errno, or a negative TLI error. 1631 */ 1632 static int 1633 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport, 1634 uint_t srcid) 1635 { 1636 ipaddr_t dstaddr = *dstaddrp; 1637 uint16_t lport; 1638 conn_t *connp = tcp->tcp_connp; 1639 tcp_stack_t *tcps = tcp->tcp_tcps; 1640 int error; 1641 1642 ASSERT(connp->conn_ipversion == IPV4_VERSION); 1643 1644 /* Check for attempt to connect to INADDR_ANY */ 1645 if (dstaddr == INADDR_ANY) { 1646 /* 1647 * SunOS 4.x and 4.3 BSD allow an application 1648 * to connect a TCP socket to INADDR_ANY. 1649 * When they do this, the kernel picks the 1650 * address of one interface and uses it 1651 * instead. The kernel usually ends up 1652 * picking the address of the loopback 1653 * interface. This is an undocumented feature. 1654 * However, we provide the same thing here 1655 * in order to have source and binary 1656 * compatibility with SunOS 4.x. 1657 * Update the T_CONN_REQ (sin/sin6) since it is used to 1658 * generate the T_CONN_CON. 1659 */ 1660 dstaddr = htonl(INADDR_LOOPBACK); 1661 *dstaddrp = dstaddr; 1662 } 1663 1664 /* Handle __sin6_src_id if socket not bound to an IP address */ 1665 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) { 1666 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1667 IPCL_ZONEID(connp), tcps->tcps_netstack); 1668 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1669 } 1670 1671 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6); 1672 connp->conn_fport = dstport; 1673 1674 /* 1675 * At this point the remote destination address and remote port fields 1676 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1677 * have to see which state tcp was in so we can take appropriate action. 1678 */ 1679 if (tcp->tcp_state == TCPS_IDLE) { 1680 /* 1681 * We support a quick connect capability here, allowing 1682 * clients to transition directly from IDLE to SYN_SENT 1683 * tcp_bindi will pick an unused port, insert the connection 1684 * in the bind hash and transition to BOUND state. 1685 */ 1686 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1687 tcp, B_TRUE); 1688 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1689 B_FALSE, B_FALSE); 1690 if (lport == 0) 1691 return (-TNOADDR); 1692 } 1693 1694 /* 1695 * Lookup the route to determine a source address and the uinfo. 1696 * Setup TCP parameters based on the metrics/DCE. 1697 */ 1698 error = tcp_set_destination(tcp); 1699 if (error != 0) 1700 return (error); 1701 1702 /* 1703 * Don't let an endpoint connect to itself. 1704 */ 1705 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 && 1706 connp->conn_fport == connp->conn_lport) 1707 return (-TBADADDR); 1708 1709 tcp->tcp_state = TCPS_SYN_SENT; 1710 1711 return (ipcl_conn_insert_v4(connp)); 1712 } 1713 1714 /* 1715 * Handle connect to IPv6 destinations. 1716 * Returns zero if OK, a positive errno, or a negative TLI error. 1717 */ 1718 static int 1719 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport, 1720 uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 1721 { 1722 uint16_t lport; 1723 conn_t *connp = tcp->tcp_connp; 1724 tcp_stack_t *tcps = tcp->tcp_tcps; 1725 int error; 1726 1727 ASSERT(connp->conn_family == AF_INET6); 1728 1729 /* 1730 * If we're here, it means that the destination address is a native 1731 * IPv6 address. Return an error if conn_ipversion is not IPv6. A 1732 * reason why it might not be IPv6 is if the socket was bound to an 1733 * IPv4-mapped IPv6 address. 1734 */ 1735 if (connp->conn_ipversion != IPV6_VERSION) 1736 return (-TBADADDR); 1737 1738 /* 1739 * Interpret a zero destination to mean loopback. 1740 * Update the T_CONN_REQ (sin/sin6) since it is used to 1741 * generate the T_CONN_CON. 1742 */ 1743 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) 1744 *dstaddrp = ipv6_loopback; 1745 1746 /* Handle __sin6_src_id if socket not bound to an IP address */ 1747 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) { 1748 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1749 IPCL_ZONEID(connp), tcps->tcps_netstack); 1750 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1751 } 1752 1753 /* 1754 * Take care of the scope_id now. 1755 */ 1756 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 1757 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1758 connp->conn_ixa->ixa_scopeid = scope_id; 1759 } else { 1760 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 1761 } 1762 1763 connp->conn_flowinfo = flowinfo; 1764 connp->conn_faddr_v6 = *dstaddrp; 1765 connp->conn_fport = dstport; 1766 1767 /* 1768 * At this point the remote destination address and remote port fields 1769 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1770 * have to see which state tcp was in so we can take appropriate action. 1771 */ 1772 if (tcp->tcp_state == TCPS_IDLE) { 1773 /* 1774 * We support a quick connect capability here, allowing 1775 * clients to transition directly from IDLE to SYN_SENT 1776 * tcp_bindi will pick an unused port, insert the connection 1777 * in the bind hash and transition to BOUND state. 1778 */ 1779 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1780 tcp, B_TRUE); 1781 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1782 B_FALSE, B_FALSE); 1783 if (lport == 0) 1784 return (-TNOADDR); 1785 } 1786 1787 /* 1788 * Lookup the route to determine a source address and the uinfo. 1789 * Setup TCP parameters based on the metrics/DCE. 1790 */ 1791 error = tcp_set_destination(tcp); 1792 if (error != 0) 1793 return (error); 1794 1795 /* 1796 * Don't let an endpoint connect to itself. 1797 */ 1798 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) && 1799 connp->conn_fport == connp->conn_lport) 1800 return (-TBADADDR); 1801 1802 tcp->tcp_state = TCPS_SYN_SENT; 1803 1804 return (ipcl_conn_insert_v6(connp)); 1805 } 1806 1807 /* 1808 * Disconnect 1809 * Note that unlike other functions this returns a positive tli error 1810 * when it fails; it never returns an errno. 1811 */ 1812 static int 1813 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum) 1814 { 1815 conn_t *lconnp; 1816 tcp_stack_t *tcps = tcp->tcp_tcps; 1817 conn_t *connp = tcp->tcp_connp; 1818 1819 /* 1820 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 1821 * when the stream is in BOUND state. Do not send a reset, 1822 * since the destination IP address is not valid, and it can 1823 * be the initialized value of all zeros (broadcast address). 1824 */ 1825 if (tcp->tcp_state <= TCPS_BOUND) { 1826 if (connp->conn_debug) { 1827 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 1828 "tcp_disconnect: bad state, %d", tcp->tcp_state); 1829 } 1830 return (TOUTSTATE); 1831 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1832 TCPS_CONN_DEC(tcps); 1833 } 1834 1835 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 1836 1837 /* 1838 * According to TPI, for non-listeners, ignore seqnum 1839 * and disconnect. 1840 * Following interpretation of -1 seqnum is historical 1841 * and implied TPI ? (TPI only states that for T_CONN_IND, 1842 * a valid seqnum should not be -1). 1843 * 1844 * -1 means disconnect everything 1845 * regardless even on a listener. 1846 */ 1847 1848 int old_state = tcp->tcp_state; 1849 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1850 1851 /* 1852 * The connection can't be on the tcp_time_wait_head list 1853 * since it is not detached. 1854 */ 1855 ASSERT(tcp->tcp_time_wait_next == NULL); 1856 ASSERT(tcp->tcp_time_wait_prev == NULL); 1857 ASSERT(tcp->tcp_time_wait_expire == 0); 1858 /* 1859 * If it used to be a listener, check to make sure no one else 1860 * has taken the port before switching back to LISTEN state. 1861 */ 1862 if (connp->conn_ipversion == IPV4_VERSION) { 1863 lconnp = ipcl_lookup_listener_v4(connp->conn_lport, 1864 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst); 1865 } else { 1866 uint_t ifindex = 0; 1867 1868 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) 1869 ifindex = connp->conn_ixa->ixa_scopeid; 1870 1871 /* Allow conn_bound_if listeners? */ 1872 lconnp = ipcl_lookup_listener_v6(connp->conn_lport, 1873 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp), 1874 ipst); 1875 } 1876 if (tcp->tcp_conn_req_max && lconnp == NULL) { 1877 tcp->tcp_state = TCPS_LISTEN; 1878 } else if (old_state > TCPS_BOUND) { 1879 tcp->tcp_conn_req_max = 0; 1880 tcp->tcp_state = TCPS_BOUND; 1881 1882 /* 1883 * If this end point is not going to become a listener, 1884 * decrement the listener connection count if 1885 * necessary. Note that we do not do this if it is 1886 * going to be a listner (the above if case) since 1887 * then it may remove the counter struct. 1888 */ 1889 if (tcp->tcp_listen_cnt != NULL) 1890 TCP_DECR_LISTEN_CNT(tcp); 1891 } 1892 if (lconnp != NULL) 1893 CONN_DEC_REF(lconnp); 1894 switch (old_state) { 1895 case TCPS_SYN_SENT: 1896 case TCPS_SYN_RCVD: 1897 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1898 break; 1899 case TCPS_ESTABLISHED: 1900 case TCPS_CLOSE_WAIT: 1901 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1902 break; 1903 } 1904 1905 if (tcp->tcp_fused) 1906 tcp_unfuse(tcp); 1907 1908 mutex_enter(&tcp->tcp_eager_lock); 1909 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 1910 (tcp->tcp_conn_req_cnt_q != 0)) { 1911 tcp_eager_cleanup(tcp, 0); 1912 } 1913 mutex_exit(&tcp->tcp_eager_lock); 1914 1915 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 1916 tcp->tcp_rnxt, TH_RST | TH_ACK); 1917 1918 tcp_reinit(tcp); 1919 1920 return (0); 1921 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 1922 return (TBADSEQ); 1923 } 1924 return (0); 1925 } 1926 1927 /* 1928 * Our client hereby directs us to reject the connection request 1929 * that tcp_input_listener() marked with 'seqnum'. Rejection consists 1930 * of sending the appropriate RST, not an ICMP error. 1931 */ 1932 void 1933 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 1934 { 1935 t_scalar_t seqnum; 1936 int error; 1937 conn_t *connp = tcp->tcp_connp; 1938 1939 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 1940 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 1941 tcp_err_ack(tcp, mp, TPROTO, 0); 1942 return; 1943 } 1944 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 1945 error = tcp_disconnect_common(tcp, seqnum); 1946 if (error != 0) 1947 tcp_err_ack(tcp, mp, error, 0); 1948 else { 1949 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1950 /* Send M_FLUSH according to TPI */ 1951 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 1952 } 1953 mp = mi_tpi_ok_ack_alloc(mp); 1954 if (mp != NULL) 1955 putnext(connp->conn_rq, mp); 1956 } 1957 } 1958 1959 /* 1960 * Note: No locks are held when inspecting tcp_g_*epriv_ports 1961 * but instead the code relies on: 1962 * - the fact that the address of the array and its size never changes 1963 * - the atomic assignment of the elements of the array 1964 */ 1965 /* ARGSUSED */ 1966 static int 1967 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 1968 { 1969 int i; 1970 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 1971 1972 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 1973 if (tcps->tcps_g_epriv_ports[i] != 0) 1974 (void) mi_mpprintf(mp, "%d ", 1975 tcps->tcps_g_epriv_ports[i]); 1976 } 1977 return (0); 1978 } 1979 1980 /* 1981 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 1982 * threads from changing it at the same time. 1983 */ 1984 /* ARGSUSED */ 1985 static int 1986 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 1987 cred_t *cr) 1988 { 1989 long new_value; 1990 int i; 1991 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 1992 1993 /* 1994 * Fail the request if the new value does not lie within the 1995 * port number limits. 1996 */ 1997 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 1998 new_value <= 0 || new_value >= 65536) { 1999 return (EINVAL); 2000 } 2001 2002 mutex_enter(&tcps->tcps_epriv_port_lock); 2003 /* Check if the value is already in the list */ 2004 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2005 if (new_value == tcps->tcps_g_epriv_ports[i]) { 2006 mutex_exit(&tcps->tcps_epriv_port_lock); 2007 return (EEXIST); 2008 } 2009 } 2010 /* Find an empty slot */ 2011 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2012 if (tcps->tcps_g_epriv_ports[i] == 0) 2013 break; 2014 } 2015 if (i == tcps->tcps_g_num_epriv_ports) { 2016 mutex_exit(&tcps->tcps_epriv_port_lock); 2017 return (EOVERFLOW); 2018 } 2019 /* Set the new value */ 2020 tcps->tcps_g_epriv_ports[i] = (uint16_t)new_value; 2021 mutex_exit(&tcps->tcps_epriv_port_lock); 2022 return (0); 2023 } 2024 2025 /* 2026 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 2027 * threads from changing it at the same time. 2028 */ 2029 /* ARGSUSED */ 2030 static int 2031 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 2032 cred_t *cr) 2033 { 2034 long new_value; 2035 int i; 2036 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 2037 2038 /* 2039 * Fail the request if the new value does not lie within the 2040 * port number limits. 2041 */ 2042 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 2043 new_value >= 65536) { 2044 return (EINVAL); 2045 } 2046 2047 mutex_enter(&tcps->tcps_epriv_port_lock); 2048 /* Check that the value is already in the list */ 2049 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2050 if (tcps->tcps_g_epriv_ports[i] == new_value) 2051 break; 2052 } 2053 if (i == tcps->tcps_g_num_epriv_ports) { 2054 mutex_exit(&tcps->tcps_epriv_port_lock); 2055 return (ESRCH); 2056 } 2057 /* Clear the value */ 2058 tcps->tcps_g_epriv_ports[i] = 0; 2059 mutex_exit(&tcps->tcps_epriv_port_lock); 2060 return (0); 2061 } 2062 2063 /* 2064 * Handle reinitialization of a tcp structure. 2065 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 2066 */ 2067 static void 2068 tcp_reinit(tcp_t *tcp) 2069 { 2070 mblk_t *mp; 2071 tcp_stack_t *tcps = tcp->tcp_tcps; 2072 conn_t *connp = tcp->tcp_connp; 2073 2074 /* tcp_reinit should never be called for detached tcp_t's */ 2075 ASSERT(tcp->tcp_listener == NULL); 2076 ASSERT((connp->conn_family == AF_INET && 2077 connp->conn_ipversion == IPV4_VERSION) || 2078 (connp->conn_family == AF_INET6 && 2079 (connp->conn_ipversion == IPV4_VERSION || 2080 connp->conn_ipversion == IPV6_VERSION))); 2081 2082 /* Cancel outstanding timers */ 2083 tcp_timers_stop(tcp); 2084 2085 /* 2086 * Reset everything in the state vector, after updating global 2087 * MIB data from instance counters. 2088 */ 2089 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 2090 tcp->tcp_ibsegs = 0; 2091 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 2092 tcp->tcp_obsegs = 0; 2093 2094 tcp_close_mpp(&tcp->tcp_xmit_head); 2095 if (tcp->tcp_snd_zcopy_aware) 2096 tcp_zcopy_notify(tcp); 2097 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 2098 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 2099 mutex_enter(&tcp->tcp_non_sq_lock); 2100 if (tcp->tcp_flow_stopped && 2101 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 2102 tcp_clrqfull(tcp); 2103 } 2104 mutex_exit(&tcp->tcp_non_sq_lock); 2105 tcp_close_mpp(&tcp->tcp_reass_head); 2106 tcp->tcp_reass_tail = NULL; 2107 if (tcp->tcp_rcv_list != NULL) { 2108 /* Free b_next chain */ 2109 tcp_close_mpp(&tcp->tcp_rcv_list); 2110 tcp->tcp_rcv_last_head = NULL; 2111 tcp->tcp_rcv_last_tail = NULL; 2112 tcp->tcp_rcv_cnt = 0; 2113 } 2114 tcp->tcp_rcv_last_tail = NULL; 2115 2116 if ((mp = tcp->tcp_urp_mp) != NULL) { 2117 freemsg(mp); 2118 tcp->tcp_urp_mp = NULL; 2119 } 2120 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 2121 freemsg(mp); 2122 tcp->tcp_urp_mark_mp = NULL; 2123 } 2124 if (tcp->tcp_fused_sigurg_mp != NULL) { 2125 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 2126 freeb(tcp->tcp_fused_sigurg_mp); 2127 tcp->tcp_fused_sigurg_mp = NULL; 2128 } 2129 if (tcp->tcp_ordrel_mp != NULL) { 2130 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 2131 freeb(tcp->tcp_ordrel_mp); 2132 tcp->tcp_ordrel_mp = NULL; 2133 } 2134 2135 /* 2136 * Following is a union with two members which are 2137 * identical types and size so the following cleanup 2138 * is enough. 2139 */ 2140 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 2141 2142 CL_INET_DISCONNECT(connp); 2143 2144 /* 2145 * The connection can't be on the tcp_time_wait_head list 2146 * since it is not detached. 2147 */ 2148 ASSERT(tcp->tcp_time_wait_next == NULL); 2149 ASSERT(tcp->tcp_time_wait_prev == NULL); 2150 ASSERT(tcp->tcp_time_wait_expire == 0); 2151 2152 if (tcp->tcp_kssl_pending) { 2153 tcp->tcp_kssl_pending = B_FALSE; 2154 2155 /* Don't reset if the initialized by bind. */ 2156 if (tcp->tcp_kssl_ent != NULL) { 2157 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 2158 KSSL_NO_PROXY); 2159 } 2160 } 2161 if (tcp->tcp_kssl_ctx != NULL) { 2162 kssl_release_ctx(tcp->tcp_kssl_ctx); 2163 tcp->tcp_kssl_ctx = NULL; 2164 } 2165 2166 /* 2167 * Reset/preserve other values 2168 */ 2169 tcp_reinit_values(tcp); 2170 ipcl_hash_remove(connp); 2171 /* Note that ixa_cred gets cleared in ixa_cleanup */ 2172 ixa_cleanup(connp->conn_ixa); 2173 tcp_ipsec_cleanup(tcp); 2174 2175 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 2176 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 2177 2178 if (tcp->tcp_conn_req_max != 0) { 2179 /* 2180 * This is the case when a TLI program uses the same 2181 * transport end point to accept a connection. This 2182 * makes the TCP both a listener and acceptor. When 2183 * this connection is closed, we need to set the state 2184 * back to TCPS_LISTEN. Make sure that the eager list 2185 * is reinitialized. 2186 * 2187 * Note that this stream is still bound to the four 2188 * tuples of the previous connection in IP. If a new 2189 * SYN with different foreign address comes in, IP will 2190 * not find it and will send it to the global queue. In 2191 * the global queue, TCP will do a tcp_lookup_listener() 2192 * to find this stream. This works because this stream 2193 * is only removed from connected hash. 2194 * 2195 */ 2196 tcp->tcp_state = TCPS_LISTEN; 2197 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 2198 tcp->tcp_eager_next_drop_q0 = tcp; 2199 tcp->tcp_eager_prev_drop_q0 = tcp; 2200 /* 2201 * Initially set conn_recv to tcp_input_listener_unbound to try 2202 * to pick a good squeue for the listener when the first SYN 2203 * arrives. tcp_input_listener_unbound sets it to 2204 * tcp_input_listener on that first SYN. 2205 */ 2206 connp->conn_recv = tcp_input_listener_unbound; 2207 2208 connp->conn_proto = IPPROTO_TCP; 2209 connp->conn_faddr_v6 = ipv6_all_zeros; 2210 connp->conn_fport = 0; 2211 2212 (void) ipcl_bind_insert(connp); 2213 } else { 2214 tcp->tcp_state = TCPS_BOUND; 2215 } 2216 2217 /* 2218 * Initialize to default values 2219 */ 2220 tcp_init_values(tcp); 2221 2222 ASSERT(tcp->tcp_ptpbhn != NULL); 2223 tcp->tcp_rwnd = connp->conn_rcvbuf; 2224 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ? 2225 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; 2226 } 2227 2228 /* 2229 * Force values to zero that need be zero. 2230 * Do not touch values asociated with the BOUND or LISTEN state 2231 * since the connection will end up in that state after the reinit. 2232 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 2233 * structure! 2234 */ 2235 static void 2236 tcp_reinit_values(tcp) 2237 tcp_t *tcp; 2238 { 2239 tcp_stack_t *tcps = tcp->tcp_tcps; 2240 conn_t *connp = tcp->tcp_connp; 2241 2242 #ifndef lint 2243 #define DONTCARE(x) 2244 #define PRESERVE(x) 2245 #else 2246 #define DONTCARE(x) ((x) = (x)) 2247 #define PRESERVE(x) ((x) = (x)) 2248 #endif /* lint */ 2249 2250 PRESERVE(tcp->tcp_bind_hash_port); 2251 PRESERVE(tcp->tcp_bind_hash); 2252 PRESERVE(tcp->tcp_ptpbhn); 2253 PRESERVE(tcp->tcp_acceptor_hash); 2254 PRESERVE(tcp->tcp_ptpahn); 2255 2256 /* Should be ASSERT NULL on these with new code! */ 2257 ASSERT(tcp->tcp_time_wait_next == NULL); 2258 ASSERT(tcp->tcp_time_wait_prev == NULL); 2259 ASSERT(tcp->tcp_time_wait_expire == 0); 2260 PRESERVE(tcp->tcp_state); 2261 PRESERVE(connp->conn_rq); 2262 PRESERVE(connp->conn_wq); 2263 2264 ASSERT(tcp->tcp_xmit_head == NULL); 2265 ASSERT(tcp->tcp_xmit_last == NULL); 2266 ASSERT(tcp->tcp_unsent == 0); 2267 ASSERT(tcp->tcp_xmit_tail == NULL); 2268 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 2269 2270 tcp->tcp_snxt = 0; /* Displayed in mib */ 2271 tcp->tcp_suna = 0; /* Displayed in mib */ 2272 tcp->tcp_swnd = 0; 2273 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */ 2274 2275 ASSERT(tcp->tcp_ibsegs == 0); 2276 ASSERT(tcp->tcp_obsegs == 0); 2277 2278 if (connp->conn_ht_iphc != NULL) { 2279 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 2280 connp->conn_ht_iphc = NULL; 2281 connp->conn_ht_iphc_allocated = 0; 2282 connp->conn_ht_iphc_len = 0; 2283 connp->conn_ht_ulp = NULL; 2284 connp->conn_ht_ulp_len = 0; 2285 tcp->tcp_ipha = NULL; 2286 tcp->tcp_ip6h = NULL; 2287 tcp->tcp_tcpha = NULL; 2288 } 2289 2290 /* We clear any IP_OPTIONS and extension headers */ 2291 ip_pkt_free(&connp->conn_xmit_ipp); 2292 2293 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 2294 DONTCARE(tcp->tcp_ipha); 2295 DONTCARE(tcp->tcp_ip6h); 2296 DONTCARE(tcp->tcp_tcpha); 2297 tcp->tcp_valid_bits = 0; 2298 2299 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 2300 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 2301 tcp->tcp_last_rcv_lbolt = 0; 2302 2303 tcp->tcp_init_cwnd = 0; 2304 2305 tcp->tcp_urp_last_valid = 0; 2306 tcp->tcp_hard_binding = 0; 2307 2308 tcp->tcp_fin_acked = 0; 2309 tcp->tcp_fin_rcvd = 0; 2310 tcp->tcp_fin_sent = 0; 2311 tcp->tcp_ordrel_done = 0; 2312 2313 tcp->tcp_detached = 0; 2314 2315 tcp->tcp_snd_ws_ok = B_FALSE; 2316 tcp->tcp_snd_ts_ok = B_FALSE; 2317 tcp->tcp_zero_win_probe = 0; 2318 2319 tcp->tcp_loopback = 0; 2320 tcp->tcp_localnet = 0; 2321 tcp->tcp_syn_defense = 0; 2322 tcp->tcp_set_timer = 0; 2323 2324 tcp->tcp_active_open = 0; 2325 tcp->tcp_rexmit = B_FALSE; 2326 tcp->tcp_xmit_zc_clean = B_FALSE; 2327 2328 tcp->tcp_snd_sack_ok = B_FALSE; 2329 tcp->tcp_hwcksum = B_FALSE; 2330 2331 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */ 2332 2333 tcp->tcp_conn_def_q0 = 0; 2334 tcp->tcp_ip_forward_progress = B_FALSE; 2335 tcp->tcp_ecn_ok = B_FALSE; 2336 2337 tcp->tcp_cwr = B_FALSE; 2338 tcp->tcp_ecn_echo_on = B_FALSE; 2339 tcp->tcp_is_wnd_shrnk = B_FALSE; 2340 2341 if (tcp->tcp_sack_info != NULL) { 2342 if (tcp->tcp_notsack_list != NULL) { 2343 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 2344 tcp); 2345 } 2346 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 2347 tcp->tcp_sack_info = NULL; 2348 } 2349 2350 tcp->tcp_rcv_ws = 0; 2351 tcp->tcp_snd_ws = 0; 2352 tcp->tcp_ts_recent = 0; 2353 tcp->tcp_rnxt = 0; /* Displayed in mib */ 2354 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 2355 tcp->tcp_initial_pmtu = 0; 2356 2357 ASSERT(tcp->tcp_reass_head == NULL); 2358 ASSERT(tcp->tcp_reass_tail == NULL); 2359 2360 tcp->tcp_cwnd_cnt = 0; 2361 2362 ASSERT(tcp->tcp_rcv_list == NULL); 2363 ASSERT(tcp->tcp_rcv_last_head == NULL); 2364 ASSERT(tcp->tcp_rcv_last_tail == NULL); 2365 ASSERT(tcp->tcp_rcv_cnt == 0); 2366 2367 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */ 2368 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 2369 tcp->tcp_csuna = 0; 2370 2371 tcp->tcp_rto = 0; /* Displayed in MIB */ 2372 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 2373 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 2374 tcp->tcp_rtt_update = 0; 2375 2376 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2377 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2378 2379 tcp->tcp_rack = 0; /* Displayed in mib */ 2380 tcp->tcp_rack_cnt = 0; 2381 tcp->tcp_rack_cur_max = 0; 2382 tcp->tcp_rack_abs_max = 0; 2383 2384 tcp->tcp_max_swnd = 0; 2385 2386 ASSERT(tcp->tcp_listener == NULL); 2387 2388 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 2389 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 2390 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 2391 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 2392 2393 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 2394 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 2395 PRESERVE(tcp->tcp_conn_req_max); 2396 PRESERVE(tcp->tcp_conn_req_seqnum); 2397 2398 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 2399 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 2400 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 2401 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 2402 2403 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 2404 ASSERT(tcp->tcp_urp_mp == NULL); 2405 ASSERT(tcp->tcp_urp_mark_mp == NULL); 2406 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 2407 2408 ASSERT(tcp->tcp_eager_next_q == NULL); 2409 ASSERT(tcp->tcp_eager_last_q == NULL); 2410 ASSERT((tcp->tcp_eager_next_q0 == NULL && 2411 tcp->tcp_eager_prev_q0 == NULL) || 2412 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 2413 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 2414 2415 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && 2416 tcp->tcp_eager_prev_drop_q0 == NULL) || 2417 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); 2418 2419 tcp->tcp_client_errno = 0; 2420 2421 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */ 2422 2423 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */ 2424 2425 PRESERVE(connp->conn_bound_addr_v6); 2426 tcp->tcp_last_sent_len = 0; 2427 tcp->tcp_dupack_cnt = 0; 2428 2429 connp->conn_fport = 0; /* Displayed in MIB */ 2430 PRESERVE(connp->conn_lport); 2431 2432 PRESERVE(tcp->tcp_acceptor_lockp); 2433 2434 ASSERT(tcp->tcp_ordrel_mp == NULL); 2435 PRESERVE(tcp->tcp_acceptor_id); 2436 DONTCARE(tcp->tcp_ipsec_overhead); 2437 2438 PRESERVE(connp->conn_family); 2439 /* Remove any remnants of mapped address binding */ 2440 if (connp->conn_family == AF_INET6) { 2441 connp->conn_ipversion = IPV6_VERSION; 2442 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2443 } else { 2444 connp->conn_ipversion = IPV4_VERSION; 2445 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2446 } 2447 2448 connp->conn_bound_if = 0; 2449 connp->conn_recv_ancillary.crb_all = 0; 2450 tcp->tcp_recvifindex = 0; 2451 tcp->tcp_recvhops = 0; 2452 tcp->tcp_closed = 0; 2453 if (tcp->tcp_hopopts != NULL) { 2454 mi_free(tcp->tcp_hopopts); 2455 tcp->tcp_hopopts = NULL; 2456 tcp->tcp_hopoptslen = 0; 2457 } 2458 ASSERT(tcp->tcp_hopoptslen == 0); 2459 if (tcp->tcp_dstopts != NULL) { 2460 mi_free(tcp->tcp_dstopts); 2461 tcp->tcp_dstopts = NULL; 2462 tcp->tcp_dstoptslen = 0; 2463 } 2464 ASSERT(tcp->tcp_dstoptslen == 0); 2465 if (tcp->tcp_rthdrdstopts != NULL) { 2466 mi_free(tcp->tcp_rthdrdstopts); 2467 tcp->tcp_rthdrdstopts = NULL; 2468 tcp->tcp_rthdrdstoptslen = 0; 2469 } 2470 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 2471 if (tcp->tcp_rthdr != NULL) { 2472 mi_free(tcp->tcp_rthdr); 2473 tcp->tcp_rthdr = NULL; 2474 tcp->tcp_rthdrlen = 0; 2475 } 2476 ASSERT(tcp->tcp_rthdrlen == 0); 2477 2478 /* Reset fusion-related fields */ 2479 tcp->tcp_fused = B_FALSE; 2480 tcp->tcp_unfusable = B_FALSE; 2481 tcp->tcp_fused_sigurg = B_FALSE; 2482 tcp->tcp_loopback_peer = NULL; 2483 2484 tcp->tcp_lso = B_FALSE; 2485 2486 tcp->tcp_in_ack_unsent = 0; 2487 tcp->tcp_cork = B_FALSE; 2488 tcp->tcp_tconnind_started = B_FALSE; 2489 2490 PRESERVE(tcp->tcp_squeue_bytes); 2491 2492 ASSERT(tcp->tcp_kssl_ctx == NULL); 2493 ASSERT(!tcp->tcp_kssl_pending); 2494 PRESERVE(tcp->tcp_kssl_ent); 2495 2496 tcp->tcp_closemp_used = B_FALSE; 2497 2498 PRESERVE(tcp->tcp_rsrv_mp); 2499 PRESERVE(tcp->tcp_rsrv_mp_lock); 2500 2501 #ifdef DEBUG 2502 DONTCARE(tcp->tcmp_stk[0]); 2503 #endif 2504 2505 PRESERVE(tcp->tcp_connid); 2506 2507 ASSERT(tcp->tcp_listen_cnt == NULL); 2508 ASSERT(tcp->tcp_reass_tid == 0); 2509 2510 #undef DONTCARE 2511 #undef PRESERVE 2512 } 2513 2514 void 2515 tcp_init_values(tcp_t *tcp) 2516 { 2517 tcp_stack_t *tcps = tcp->tcp_tcps; 2518 conn_t *connp = tcp->tcp_connp; 2519 2520 ASSERT((connp->conn_family == AF_INET && 2521 connp->conn_ipversion == IPV4_VERSION) || 2522 (connp->conn_family == AF_INET6 && 2523 (connp->conn_ipversion == IPV4_VERSION || 2524 connp->conn_ipversion == IPV6_VERSION))); 2525 2526 /* 2527 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 2528 * will be close to tcp_rexmit_interval_initial. By doing this, we 2529 * allow the algorithm to adjust slowly to large fluctuations of RTT 2530 * during first few transmissions of a connection as seen in slow 2531 * links. 2532 */ 2533 tcp->tcp_rtt_sa = tcps->tcps_rexmit_interval_initial << 2; 2534 tcp->tcp_rtt_sd = tcps->tcps_rexmit_interval_initial >> 1; 2535 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 2536 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 2537 tcps->tcps_conn_grace_period; 2538 if (tcp->tcp_rto < tcps->tcps_rexmit_interval_min) 2539 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 2540 tcp->tcp_timer_backoff = 0; 2541 tcp->tcp_ms_we_have_waited = 0; 2542 tcp->tcp_last_recv_time = ddi_get_lbolt(); 2543 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; 2544 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2545 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 2546 2547 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier; 2548 2549 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; 2550 tcp->tcp_first_ctimer_threshold = tcps->tcps_ip_notify_cinterval; 2551 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; 2552 /* 2553 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 2554 * passive open. 2555 */ 2556 tcp->tcp_second_ctimer_threshold = tcps->tcps_ip_abort_cinterval; 2557 2558 tcp->tcp_naglim = tcps->tcps_naglim_def; 2559 2560 /* NOTE: ISS is now set in tcp_set_destination(). */ 2561 2562 /* Reset fusion-related fields */ 2563 tcp->tcp_fused = B_FALSE; 2564 tcp->tcp_unfusable = B_FALSE; 2565 tcp->tcp_fused_sigurg = B_FALSE; 2566 tcp->tcp_loopback_peer = NULL; 2567 2568 /* We rebuild the header template on the next connect/conn_request */ 2569 2570 connp->conn_mlp_type = mlptSingle; 2571 2572 /* 2573 * Init the window scale to the max so tcp_rwnd_set() won't pare 2574 * down tcp_rwnd. tcp_set_destination() will set the right value later. 2575 */ 2576 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 2577 tcp->tcp_rwnd = connp->conn_rcvbuf; 2578 2579 tcp->tcp_cork = B_FALSE; 2580 /* 2581 * Init the tcp_debug option if it wasn't already set. This value 2582 * determines whether TCP 2583 * calls strlog() to print out debug messages. Doing this 2584 * initialization here means that this value is not inherited thru 2585 * tcp_reinit(). 2586 */ 2587 if (!connp->conn_debug) 2588 connp->conn_debug = tcps->tcps_dbg; 2589 2590 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; 2591 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; 2592 } 2593 2594 /* 2595 * Update the TCP connection according to change of PMTU. 2596 * 2597 * Path MTU might have changed by either increase or decrease, so need to 2598 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny 2599 * or negative MSS, since tcp_mss_set() will do it. 2600 */ 2601 void 2602 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only) 2603 { 2604 uint32_t pmtu; 2605 int32_t mss; 2606 conn_t *connp = tcp->tcp_connp; 2607 ip_xmit_attr_t *ixa = connp->conn_ixa; 2608 iaflags_t ixaflags; 2609 2610 if (tcp->tcp_tcps->tcps_ignore_path_mtu) 2611 return; 2612 2613 if (tcp->tcp_state < TCPS_ESTABLISHED) 2614 return; 2615 2616 /* 2617 * Always call ip_get_pmtu() to make sure that IP has updated 2618 * ixa_flags properly. 2619 */ 2620 pmtu = ip_get_pmtu(ixa); 2621 ixaflags = ixa->ixa_flags; 2622 2623 /* 2624 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and 2625 * IPsec overhead if applied. Make sure to use the most recent 2626 * IPsec information. 2627 */ 2628 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp); 2629 2630 /* 2631 * Nothing to change, so just return. 2632 */ 2633 if (mss == tcp->tcp_mss) 2634 return; 2635 2636 /* 2637 * Currently, for ICMP errors, only PMTU decrease is handled. 2638 */ 2639 if (mss > tcp->tcp_mss && decrease_only) 2640 return; 2641 2642 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss); 2643 2644 /* 2645 * Update ixa_fragsize and ixa_pmtu. 2646 */ 2647 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 2648 2649 /* 2650 * Adjust MSS and all relevant variables. 2651 */ 2652 tcp_mss_set(tcp, mss); 2653 2654 /* 2655 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu 2656 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP 2657 * has a (potentially different) min size we do the same. Make sure to 2658 * clear IXAF_DONTFRAG, which is used by IP to decide whether to 2659 * fragment the packet. 2660 * 2661 * LSO over IPv6 can not be fragmented. So need to disable LSO 2662 * when IPv6 fragmentation is needed. 2663 */ 2664 if (mss < tcp->tcp_tcps->tcps_mss_min) 2665 ixaflags |= IXAF_PMTU_TOO_SMALL; 2666 2667 if (ixaflags & IXAF_PMTU_TOO_SMALL) 2668 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 2669 2670 if ((connp->conn_ipversion == IPV4_VERSION) && 2671 !(ixaflags & IXAF_PMTU_IPV4_DF)) { 2672 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 2673 } 2674 ixa->ixa_flags = ixaflags; 2675 } 2676 2677 int 2678 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 2679 { 2680 conn_t *connp = tcp->tcp_connp; 2681 queue_t *q = connp->conn_rq; 2682 int32_t mss = tcp->tcp_mss; 2683 int maxpsz; 2684 2685 if (TCP_IS_DETACHED(tcp)) 2686 return (mss); 2687 if (tcp->tcp_fused) { 2688 maxpsz = tcp_fuse_maxpsz(tcp); 2689 mss = INFPSZ; 2690 } else if (tcp->tcp_maxpsz_multiplier == 0) { 2691 /* 2692 * Set the sd_qn_maxpsz according to the socket send buffer 2693 * size, and sd_maxblk to INFPSZ (-1). This will essentially 2694 * instruct the stream head to copyin user data into contiguous 2695 * kernel-allocated buffers without breaking it up into smaller 2696 * chunks. We round up the buffer size to the nearest SMSS. 2697 */ 2698 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss); 2699 if (tcp->tcp_kssl_ctx == NULL) 2700 mss = INFPSZ; 2701 else 2702 mss = SSL3_MAX_RECORD_LEN; 2703 } else { 2704 /* 2705 * Set sd_qn_maxpsz to approx half the (receivers) buffer 2706 * (and a multiple of the mss). This instructs the stream 2707 * head to break down larger than SMSS writes into SMSS- 2708 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 2709 */ 2710 maxpsz = tcp->tcp_maxpsz_multiplier * mss; 2711 if (maxpsz > connp->conn_sndbuf / 2) { 2712 maxpsz = connp->conn_sndbuf / 2; 2713 /* Round up to nearest mss */ 2714 maxpsz = MSS_ROUNDUP(maxpsz, mss); 2715 } 2716 } 2717 2718 (void) proto_set_maxpsz(q, connp, maxpsz); 2719 if (!(IPCL_IS_NONSTR(connp))) 2720 connp->conn_wq->q_maxpsz = maxpsz; 2721 if (set_maxblk) 2722 (void) proto_set_tx_maxblk(q, connp, mss); 2723 return (mss); 2724 } 2725 2726 /* For /dev/tcp aka AF_INET open */ 2727 static int 2728 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2729 { 2730 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); 2731 } 2732 2733 /* For /dev/tcp6 aka AF_INET6 open */ 2734 static int 2735 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2736 { 2737 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); 2738 } 2739 2740 conn_t * 2741 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket, 2742 int *errorp) 2743 { 2744 tcp_t *tcp = NULL; 2745 conn_t *connp; 2746 zoneid_t zoneid; 2747 tcp_stack_t *tcps; 2748 squeue_t *sqp; 2749 2750 ASSERT(errorp != NULL); 2751 /* 2752 * Find the proper zoneid and netstack. 2753 */ 2754 /* 2755 * Special case for install: miniroot needs to be able to 2756 * access files via NFS as though it were always in the 2757 * global zone. 2758 */ 2759 if (credp == kcred && nfs_global_client_only != 0) { 2760 zoneid = GLOBAL_ZONEID; 2761 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> 2762 netstack_tcp; 2763 ASSERT(tcps != NULL); 2764 } else { 2765 netstack_t *ns; 2766 int err; 2767 2768 if ((err = secpolicy_basic_net_access(credp)) != 0) { 2769 *errorp = err; 2770 return (NULL); 2771 } 2772 2773 ns = netstack_find_by_cred(credp); 2774 ASSERT(ns != NULL); 2775 tcps = ns->netstack_tcp; 2776 ASSERT(tcps != NULL); 2777 2778 /* 2779 * For exclusive stacks we set the zoneid to zero 2780 * to make TCP operate as if in the global zone. 2781 */ 2782 if (tcps->tcps_netstack->netstack_stackid != 2783 GLOBAL_NETSTACKID) 2784 zoneid = GLOBAL_ZONEID; 2785 else 2786 zoneid = crgetzoneid(credp); 2787 } 2788 2789 sqp = IP_SQUEUE_GET((uint_t)gethrtime()); 2790 connp = (conn_t *)tcp_get_conn(sqp, tcps); 2791 /* 2792 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, 2793 * so we drop it by one. 2794 */ 2795 netstack_rele(tcps->tcps_netstack); 2796 if (connp == NULL) { 2797 *errorp = ENOSR; 2798 return (NULL); 2799 } 2800 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto); 2801 2802 connp->conn_sqp = sqp; 2803 connp->conn_initial_sqp = connp->conn_sqp; 2804 connp->conn_ixa->ixa_sqp = connp->conn_sqp; 2805 tcp = connp->conn_tcp; 2806 2807 /* 2808 * Besides asking IP to set the checksum for us, have conn_ip_output 2809 * to do the following checks when necessary: 2810 * 2811 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid 2812 * IXAF_VERIFY_PMTU: verify PMTU changes 2813 * IXAF_VERIFY_LSO: verify LSO capability changes 2814 */ 2815 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 2816 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO; 2817 2818 if (!tcps->tcps_dev_flow_ctl) 2819 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 2820 2821 if (isv6) { 2822 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 2823 connp->conn_ipversion = IPV6_VERSION; 2824 connp->conn_family = AF_INET6; 2825 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2826 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit; 2827 } else { 2828 connp->conn_ipversion = IPV4_VERSION; 2829 connp->conn_family = AF_INET; 2830 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2831 connp->conn_default_ttl = tcps->tcps_ipv4_ttl; 2832 } 2833 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 2834 2835 crhold(credp); 2836 connp->conn_cred = credp; 2837 connp->conn_cpid = curproc->p_pid; 2838 connp->conn_open_time = ddi_get_lbolt64(); 2839 2840 /* Cache things in the ixa without any refhold */ 2841 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 2842 connp->conn_ixa->ixa_cred = credp; 2843 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 2844 2845 connp->conn_zoneid = zoneid; 2846 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 2847 connp->conn_ixa->ixa_zoneid = zoneid; 2848 connp->conn_mlp_type = mlptSingle; 2849 ASSERT(connp->conn_netstack == tcps->tcps_netstack); 2850 ASSERT(tcp->tcp_tcps == tcps); 2851 2852 /* 2853 * If the caller has the process-wide flag set, then default to MAC 2854 * exempt mode. This allows read-down to unlabeled hosts. 2855 */ 2856 if (getpflags(NET_MAC_AWARE, credp) != 0) 2857 connp->conn_mac_mode = CONN_MAC_AWARE; 2858 2859 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 2860 2861 if (issocket) { 2862 tcp->tcp_issocket = 1; 2863 } 2864 2865 connp->conn_rcvbuf = tcps->tcps_recv_hiwat; 2866 connp->conn_sndbuf = tcps->tcps_xmit_hiwat; 2867 connp->conn_sndlowat = tcps->tcps_xmit_lowat; 2868 connp->conn_so_type = SOCK_STREAM; 2869 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2870 tcps->tcps_wroff_xtra; 2871 2872 SOCK_CONNID_INIT(tcp->tcp_connid); 2873 tcp->tcp_state = TCPS_IDLE; 2874 tcp_init_values(tcp); 2875 return (connp); 2876 } 2877 2878 static int 2879 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 2880 boolean_t isv6) 2881 { 2882 tcp_t *tcp = NULL; 2883 conn_t *connp = NULL; 2884 int err; 2885 vmem_t *minor_arena = NULL; 2886 dev_t conn_dev; 2887 boolean_t issocket; 2888 2889 if (q->q_ptr != NULL) 2890 return (0); 2891 2892 if (sflag == MODOPEN) 2893 return (EINVAL); 2894 2895 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 2896 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 2897 minor_arena = ip_minor_arena_la; 2898 } else { 2899 /* 2900 * Either minor numbers in the large arena were exhausted 2901 * or a non socket application is doing the open. 2902 * Try to allocate from the small arena. 2903 */ 2904 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 2905 return (EBUSY); 2906 } 2907 minor_arena = ip_minor_arena_sa; 2908 } 2909 2910 ASSERT(minor_arena != NULL); 2911 2912 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev); 2913 2914 if (flag & SO_FALLBACK) { 2915 /* 2916 * Non streams socket needs a stream to fallback to 2917 */ 2918 RD(q)->q_ptr = (void *)conn_dev; 2919 WR(q)->q_qinfo = &tcp_fallback_sock_winit; 2920 WR(q)->q_ptr = (void *)minor_arena; 2921 qprocson(q); 2922 return (0); 2923 } else if (flag & SO_ACCEPTOR) { 2924 q->q_qinfo = &tcp_acceptor_rinit; 2925 /* 2926 * the conn_dev and minor_arena will be subsequently used by 2927 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out 2928 * the minor device number for this connection from the q_ptr. 2929 */ 2930 RD(q)->q_ptr = (void *)conn_dev; 2931 WR(q)->q_qinfo = &tcp_acceptor_winit; 2932 WR(q)->q_ptr = (void *)minor_arena; 2933 qprocson(q); 2934 return (0); 2935 } 2936 2937 issocket = flag & SO_SOCKSTR; 2938 connp = tcp_create_common(credp, isv6, issocket, &err); 2939 2940 if (connp == NULL) { 2941 inet_minor_free(minor_arena, conn_dev); 2942 q->q_ptr = WR(q)->q_ptr = NULL; 2943 return (err); 2944 } 2945 2946 connp->conn_rq = q; 2947 connp->conn_wq = WR(q); 2948 q->q_ptr = WR(q)->q_ptr = connp; 2949 2950 connp->conn_dev = conn_dev; 2951 connp->conn_minor_arena = minor_arena; 2952 2953 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); 2954 ASSERT(WR(q)->q_qinfo == &tcp_winit); 2955 2956 tcp = connp->conn_tcp; 2957 2958 if (issocket) { 2959 WR(q)->q_qinfo = &tcp_sock_winit; 2960 } else { 2961 #ifdef _ILP32 2962 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 2963 #else 2964 tcp->tcp_acceptor_id = conn_dev; 2965 #endif /* _ILP32 */ 2966 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 2967 } 2968 2969 /* 2970 * Put the ref for TCP. Ref for IP was already put 2971 * by ipcl_conn_create. Also Make the conn_t globally 2972 * visible to walkers 2973 */ 2974 mutex_enter(&connp->conn_lock); 2975 CONN_INC_REF_LOCKED(connp); 2976 ASSERT(connp->conn_ref == 2); 2977 connp->conn_state_flags &= ~CONN_INCIPIENT; 2978 mutex_exit(&connp->conn_lock); 2979 2980 qprocson(q); 2981 return (0); 2982 } 2983 2984 /* 2985 * Build/update the tcp header template (in conn_ht_iphc) based on 2986 * conn_xmit_ipp. The headers include ip6_t, any extension 2987 * headers, and the maximum size tcp header (to avoid reallocation 2988 * on the fly for additional tcp options). 2989 * 2990 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}. 2991 * Returns failure if can't allocate memory. 2992 */ 2993 int 2994 tcp_build_hdrs(tcp_t *tcp) 2995 { 2996 tcp_stack_t *tcps = tcp->tcp_tcps; 2997 conn_t *connp = tcp->tcp_connp; 2998 char buf[TCP_MAX_HDR_LENGTH]; 2999 uint_t buflen; 3000 uint_t ulplen = TCP_MIN_HEADER_LENGTH; 3001 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH; 3002 tcpha_t *tcpha; 3003 uint32_t cksum; 3004 int error; 3005 3006 /* 3007 * We might be called after the connection is set up, and we might 3008 * have TS options already in the TCP header. Thus we save any 3009 * existing tcp header. 3010 */ 3011 buflen = connp->conn_ht_ulp_len; 3012 if (buflen != 0) { 3013 bcopy(connp->conn_ht_ulp, buf, buflen); 3014 extralen -= buflen - ulplen; 3015 ulplen = buflen; 3016 } 3017 3018 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */ 3019 mutex_enter(&connp->conn_lock); 3020 error = conn_build_hdr_template(connp, ulplen, extralen, 3021 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo); 3022 mutex_exit(&connp->conn_lock); 3023 if (error != 0) 3024 return (error); 3025 3026 /* 3027 * Any routing header/option has been massaged. The checksum difference 3028 * is stored in conn_sum for later use. 3029 */ 3030 tcpha = (tcpha_t *)connp->conn_ht_ulp; 3031 tcp->tcp_tcpha = tcpha; 3032 3033 /* restore any old tcp header */ 3034 if (buflen != 0) { 3035 bcopy(buf, connp->conn_ht_ulp, buflen); 3036 } else { 3037 tcpha->tha_sum = 0; 3038 tcpha->tha_urp = 0; 3039 tcpha->tha_ack = 0; 3040 tcpha->tha_offset_and_reserved = (5 << 4); 3041 tcpha->tha_lport = connp->conn_lport; 3042 tcpha->tha_fport = connp->conn_fport; 3043 } 3044 3045 /* 3046 * IP wants our header length in the checksum field to 3047 * allow it to perform a single pseudo-header+checksum 3048 * calculation on behalf of TCP. 3049 * Include the adjustment for a source route once IP_OPTIONS is set. 3050 */ 3051 cksum = sizeof (tcpha_t) + connp->conn_sum; 3052 cksum = (cksum >> 16) + (cksum & 0xFFFF); 3053 ASSERT(cksum < 0x10000); 3054 tcpha->tha_sum = htons(cksum); 3055 3056 if (connp->conn_ipversion == IPV4_VERSION) 3057 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc; 3058 else 3059 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc; 3060 3061 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra > 3062 connp->conn_wroff) { 3063 connp->conn_wroff = connp->conn_ht_iphc_allocated + 3064 tcps->tcps_wroff_xtra; 3065 (void) proto_set_tx_wroff(connp->conn_rq, connp, 3066 connp->conn_wroff); 3067 } 3068 return (0); 3069 } 3070 3071 /* Get callback routine passed to nd_load by tcp_param_register */ 3072 /* ARGSUSED */ 3073 static int 3074 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 3075 { 3076 tcpparam_t *tcppa = (tcpparam_t *)cp; 3077 3078 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 3079 return (0); 3080 } 3081 3082 /* 3083 * Walk through the param array specified registering each element with the 3084 * named dispatch handler. 3085 */ 3086 static boolean_t 3087 tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, tcp_stack_t *tcps) 3088 { 3089 for (; cnt-- > 0; tcppa++) { 3090 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 3091 if (!nd_load(ndp, tcppa->tcp_param_name, 3092 tcp_param_get, tcp_param_set, 3093 (caddr_t)tcppa)) { 3094 nd_free(ndp); 3095 return (B_FALSE); 3096 } 3097 } 3098 } 3099 tcps->tcps_wroff_xtra_param = kmem_zalloc(sizeof (tcpparam_t), 3100 KM_SLEEP); 3101 bcopy(&lcl_tcp_wroff_xtra_param, tcps->tcps_wroff_xtra_param, 3102 sizeof (tcpparam_t)); 3103 if (!nd_load(ndp, tcps->tcps_wroff_xtra_param->tcp_param_name, 3104 tcp_param_get, tcp_param_set_aligned, 3105 (caddr_t)tcps->tcps_wroff_xtra_param)) { 3106 nd_free(ndp); 3107 return (B_FALSE); 3108 } 3109 if (!nd_load(ndp, "tcp_extra_priv_ports", 3110 tcp_extra_priv_ports_get, NULL, NULL)) { 3111 nd_free(ndp); 3112 return (B_FALSE); 3113 } 3114 if (!nd_load(ndp, "tcp_extra_priv_ports_add", 3115 NULL, tcp_extra_priv_ports_add, NULL)) { 3116 nd_free(ndp); 3117 return (B_FALSE); 3118 } 3119 if (!nd_load(ndp, "tcp_extra_priv_ports_del", 3120 NULL, tcp_extra_priv_ports_del, NULL)) { 3121 nd_free(ndp); 3122 return (B_FALSE); 3123 } 3124 if (!nd_load(ndp, "tcp_1948_phrase", NULL, 3125 tcp_1948_phrase_set, NULL)) { 3126 nd_free(ndp); 3127 return (B_FALSE); 3128 } 3129 3130 3131 if (!nd_load(ndp, "tcp_listener_limit_conf", 3132 tcp_listener_conf_get, NULL, NULL)) { 3133 nd_free(ndp); 3134 return (B_FALSE); 3135 } 3136 if (!nd_load(ndp, "tcp_listener_limit_conf_add", 3137 NULL, tcp_listener_conf_add, NULL)) { 3138 nd_free(ndp); 3139 return (B_FALSE); 3140 } 3141 if (!nd_load(ndp, "tcp_listener_limit_conf_del", 3142 NULL, tcp_listener_conf_del, NULL)) { 3143 nd_free(ndp); 3144 return (B_FALSE); 3145 } 3146 3147 /* 3148 * Dummy ndd variables - only to convey obsolescence information 3149 * through printing of their name (no get or set routines) 3150 * XXX Remove in future releases ? 3151 */ 3152 if (!nd_load(ndp, 3153 "tcp_close_wait_interval(obsoleted - " 3154 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 3155 nd_free(ndp); 3156 return (B_FALSE); 3157 } 3158 return (B_TRUE); 3159 } 3160 3161 /* ndd set routine for tcp_wroff_xtra. */ 3162 /* ARGSUSED */ 3163 static int 3164 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 3165 cred_t *cr) 3166 { 3167 long new_value; 3168 tcpparam_t *tcppa = (tcpparam_t *)cp; 3169 3170 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 3171 new_value < tcppa->tcp_param_min || 3172 new_value > tcppa->tcp_param_max) { 3173 return (EINVAL); 3174 } 3175 /* 3176 * Need to make sure new_value is a multiple of 4. If it is not, 3177 * round it up. For future 64 bit requirement, we actually make it 3178 * a multiple of 8. 3179 */ 3180 if (new_value & 0x7) { 3181 new_value = (new_value & ~0x7) + 0x8; 3182 } 3183 tcppa->tcp_param_val = new_value; 3184 return (0); 3185 } 3186 3187 /* Set callback routine passed to nd_load by tcp_param_register */ 3188 /* ARGSUSED */ 3189 static int 3190 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 3191 { 3192 long new_value; 3193 tcpparam_t *tcppa = (tcpparam_t *)cp; 3194 3195 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 3196 new_value < tcppa->tcp_param_min || 3197 new_value > tcppa->tcp_param_max) { 3198 return (EINVAL); 3199 } 3200 tcppa->tcp_param_val = new_value; 3201 return (0); 3202 } 3203 3204 /* 3205 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 3206 * We do not allow the receive window to shrink. After setting rwnd, 3207 * set the flow control hiwat of the stream. 3208 * 3209 * This function is called in 2 cases: 3210 * 3211 * 1) Before data transfer begins, in tcp_input_listener() for accepting a 3212 * connection (passive open) and in tcp_input_data() for active connect. 3213 * This is called after tcp_mss_set() when the desired MSS value is known. 3214 * This makes sure that our window size is a mutiple of the other side's 3215 * MSS. 3216 * 2) Handling SO_RCVBUF option. 3217 * 3218 * It is ASSUMED that the requested size is a multiple of the current MSS. 3219 * 3220 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 3221 * user requests so. 3222 */ 3223 int 3224 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 3225 { 3226 uint32_t mss = tcp->tcp_mss; 3227 uint32_t old_max_rwnd; 3228 uint32_t max_transmittable_rwnd; 3229 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 3230 tcp_stack_t *tcps = tcp->tcp_tcps; 3231 conn_t *connp = tcp->tcp_connp; 3232 3233 /* 3234 * Insist on a receive window that is at least 3235 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 3236 * funny TCP interactions of Nagle algorithm, SWS avoidance 3237 * and delayed acknowledgement. 3238 */ 3239 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); 3240 3241 if (tcp->tcp_fused) { 3242 size_t sth_hiwat; 3243 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 3244 3245 ASSERT(peer_tcp != NULL); 3246 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 3247 if (!tcp_detached) { 3248 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 3249 sth_hiwat); 3250 tcp_set_recv_threshold(tcp, sth_hiwat >> 3); 3251 } 3252 3253 /* Caller could have changed tcp_rwnd; update tha_win */ 3254 if (tcp->tcp_tcpha != NULL) { 3255 tcp->tcp_tcpha->tha_win = 3256 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3257 } 3258 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3259 tcp->tcp_cwnd_max = rwnd; 3260 3261 /* 3262 * In the fusion case, the maxpsz stream head value of 3263 * our peer is set according to its send buffer size 3264 * and our receive buffer size; since the latter may 3265 * have changed we need to update the peer's maxpsz. 3266 */ 3267 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 3268 return (sth_hiwat); 3269 } 3270 3271 if (tcp_detached) 3272 old_max_rwnd = tcp->tcp_rwnd; 3273 else 3274 old_max_rwnd = connp->conn_rcvbuf; 3275 3276 3277 /* 3278 * If window size info has already been exchanged, TCP should not 3279 * shrink the window. Shrinking window is doable if done carefully. 3280 * We may add that support later. But so far there is not a real 3281 * need to do that. 3282 */ 3283 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 3284 /* MSS may have changed, do a round up again. */ 3285 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 3286 } 3287 3288 /* 3289 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 3290 * can be applied even before the window scale option is decided. 3291 */ 3292 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 3293 if (rwnd > max_transmittable_rwnd) { 3294 rwnd = max_transmittable_rwnd - 3295 (max_transmittable_rwnd % mss); 3296 if (rwnd < mss) 3297 rwnd = max_transmittable_rwnd; 3298 /* 3299 * If we're over the limit we may have to back down tcp_rwnd. 3300 * The increment below won't work for us. So we set all three 3301 * here and the increment below will have no effect. 3302 */ 3303 tcp->tcp_rwnd = old_max_rwnd = rwnd; 3304 } 3305 if (tcp->tcp_localnet) { 3306 tcp->tcp_rack_abs_max = 3307 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); 3308 } else { 3309 /* 3310 * For a remote host on a different subnet (through a router), 3311 * we ack every other packet to be conforming to RFC1122. 3312 * tcp_deferred_acks_max is default to 2. 3313 */ 3314 tcp->tcp_rack_abs_max = 3315 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); 3316 } 3317 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 3318 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 3319 else 3320 tcp->tcp_rack_cur_max = 0; 3321 /* 3322 * Increment the current rwnd by the amount the maximum grew (we 3323 * can not overwrite it since we might be in the middle of a 3324 * connection.) 3325 */ 3326 tcp->tcp_rwnd += rwnd - old_max_rwnd; 3327 connp->conn_rcvbuf = rwnd; 3328 3329 /* Are we already connected? */ 3330 if (tcp->tcp_tcpha != NULL) { 3331 tcp->tcp_tcpha->tha_win = 3332 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3333 } 3334 3335 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3336 tcp->tcp_cwnd_max = rwnd; 3337 3338 if (tcp_detached) 3339 return (rwnd); 3340 3341 tcp_set_recv_threshold(tcp, rwnd >> 3); 3342 3343 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd); 3344 return (rwnd); 3345 } 3346 3347 int 3348 tcp_do_unbind(conn_t *connp) 3349 { 3350 tcp_t *tcp = connp->conn_tcp; 3351 3352 switch (tcp->tcp_state) { 3353 case TCPS_BOUND: 3354 case TCPS_LISTEN: 3355 break; 3356 default: 3357 return (-TOUTSTATE); 3358 } 3359 3360 /* 3361 * Need to clean up all the eagers since after the unbind, segments 3362 * will no longer be delivered to this listener stream. 3363 */ 3364 mutex_enter(&tcp->tcp_eager_lock); 3365 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 3366 tcp_eager_cleanup(tcp, 0); 3367 } 3368 mutex_exit(&tcp->tcp_eager_lock); 3369 3370 /* Clean up the listener connection counter if necessary. */ 3371 if (tcp->tcp_listen_cnt != NULL) 3372 TCP_DECR_LISTEN_CNT(tcp); 3373 connp->conn_laddr_v6 = ipv6_all_zeros; 3374 connp->conn_saddr_v6 = ipv6_all_zeros; 3375 tcp_bind_hash_remove(tcp); 3376 tcp->tcp_state = TCPS_IDLE; 3377 3378 ip_unbind(connp); 3379 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 3380 3381 return (0); 3382 } 3383 3384 /* 3385 * This runs at the tail end of accept processing on the squeue of the 3386 * new connection. 3387 */ 3388 /* ARGSUSED */ 3389 void 3390 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 3391 { 3392 conn_t *connp = (conn_t *)arg; 3393 tcp_t *tcp = connp->conn_tcp; 3394 queue_t *q = connp->conn_rq; 3395 tcp_stack_t *tcps = tcp->tcp_tcps; 3396 /* socket options */ 3397 struct sock_proto_props sopp; 3398 3399 /* We should just receive a single mblk that fits a T_discon_ind */ 3400 ASSERT(mp->b_cont == NULL); 3401 3402 /* 3403 * Drop the eager's ref on the listener, that was placed when 3404 * this eager began life in tcp_input_listener. 3405 */ 3406 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 3407 if (IPCL_IS_NONSTR(connp)) { 3408 /* Safe to free conn_ind message */ 3409 freemsg(tcp->tcp_conn.tcp_eager_conn_ind); 3410 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3411 } 3412 3413 tcp->tcp_detached = B_FALSE; 3414 3415 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 3416 /* 3417 * Someone blewoff the eager before we could finish 3418 * the accept. 3419 * 3420 * The only reason eager exists it because we put in 3421 * a ref on it when conn ind went up. We need to send 3422 * a disconnect indication up while the last reference 3423 * on the eager will be dropped by the squeue when we 3424 * return. 3425 */ 3426 ASSERT(tcp->tcp_listener == NULL); 3427 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 3428 if (IPCL_IS_NONSTR(connp)) { 3429 ASSERT(tcp->tcp_issocket); 3430 (*connp->conn_upcalls->su_disconnected)( 3431 connp->conn_upper_handle, tcp->tcp_connid, 3432 ECONNREFUSED); 3433 freemsg(mp); 3434 } else { 3435 struct T_discon_ind *tdi; 3436 3437 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 3438 /* 3439 * Let us reuse the incoming mblk to avoid 3440 * memory allocation failure problems. We know 3441 * that the size of the incoming mblk i.e. 3442 * stroptions is greater than sizeof 3443 * T_discon_ind. 3444 */ 3445 ASSERT(DB_REF(mp) == 1); 3446 ASSERT(MBLKSIZE(mp) >= 3447 sizeof (struct T_discon_ind)); 3448 3449 DB_TYPE(mp) = M_PROTO; 3450 ((union T_primitives *)mp->b_rptr)->type = 3451 T_DISCON_IND; 3452 tdi = (struct T_discon_ind *)mp->b_rptr; 3453 if (tcp->tcp_issocket) { 3454 tdi->DISCON_reason = ECONNREFUSED; 3455 tdi->SEQ_number = 0; 3456 } else { 3457 tdi->DISCON_reason = ENOPROTOOPT; 3458 tdi->SEQ_number = 3459 tcp->tcp_conn_req_seqnum; 3460 } 3461 mp->b_wptr = mp->b_rptr + 3462 sizeof (struct T_discon_ind); 3463 putnext(q, mp); 3464 } 3465 } 3466 tcp->tcp_hard_binding = B_FALSE; 3467 return; 3468 } 3469 3470 /* 3471 * This is the first time we run on the correct 3472 * queue after tcp_accept. So fix all the q parameters 3473 * here. 3474 */ 3475 sopp.sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF; 3476 sopp.sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 3477 3478 sopp.sopp_rxhiwat = tcp->tcp_fused ? 3479 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) : 3480 connp->conn_rcvbuf; 3481 3482 /* 3483 * Determine what write offset value to use depending on SACK and 3484 * whether the endpoint is fused or not. 3485 */ 3486 if (tcp->tcp_fused) { 3487 ASSERT(tcp->tcp_loopback); 3488 ASSERT(tcp->tcp_loopback_peer != NULL); 3489 /* 3490 * For fused tcp loopback, set the stream head's write 3491 * offset value to zero since we won't be needing any room 3492 * for TCP/IP headers. This would also improve performance 3493 * since it would reduce the amount of work done by kmem. 3494 * Non-fused tcp loopback case is handled separately below. 3495 */ 3496 sopp.sopp_wroff = 0; 3497 /* 3498 * Update the peer's transmit parameters according to 3499 * our recently calculated high water mark value. 3500 */ 3501 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 3502 } else if (tcp->tcp_snd_sack_ok) { 3503 sopp.sopp_wroff = connp->conn_ht_iphc_allocated + 3504 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 3505 } else { 3506 sopp.sopp_wroff = connp->conn_ht_iphc_len + 3507 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 3508 } 3509 3510 /* 3511 * If this is endpoint is handling SSL, then reserve extra 3512 * offset and space at the end. 3513 * Also have the stream head allocate SSL3_MAX_RECORD_LEN packets, 3514 * overriding the previous setting. The extra cost of signing and 3515 * encrypting multiple MSS-size records (12 of them with Ethernet), 3516 * instead of a single contiguous one by the stream head 3517 * largely outweighs the statistical reduction of ACKs, when 3518 * applicable. The peer will also save on decryption and verification 3519 * costs. 3520 */ 3521 if (tcp->tcp_kssl_ctx != NULL) { 3522 sopp.sopp_wroff += SSL3_WROFFSET; 3523 3524 sopp.sopp_flags |= SOCKOPT_TAIL; 3525 sopp.sopp_tail = SSL3_MAX_TAIL_LEN; 3526 3527 sopp.sopp_flags |= SOCKOPT_ZCOPY; 3528 sopp.sopp_zcopyflag = ZCVMUNSAFE; 3529 3530 sopp.sopp_maxblk = SSL3_MAX_RECORD_LEN; 3531 } 3532 3533 /* Send the options up */ 3534 if (IPCL_IS_NONSTR(connp)) { 3535 if (sopp.sopp_flags & SOCKOPT_TAIL) { 3536 ASSERT(tcp->tcp_kssl_ctx != NULL); 3537 ASSERT(sopp.sopp_flags & SOCKOPT_ZCOPY); 3538 } 3539 if (tcp->tcp_loopback) { 3540 sopp.sopp_flags |= SOCKOPT_LOOPBACK; 3541 sopp.sopp_loopback = B_TRUE; 3542 } 3543 (*connp->conn_upcalls->su_set_proto_props) 3544 (connp->conn_upper_handle, &sopp); 3545 freemsg(mp); 3546 } else { 3547 /* 3548 * Let us reuse the incoming mblk to avoid 3549 * memory allocation failure problems. We know 3550 * that the size of the incoming mblk is at least 3551 * stroptions 3552 */ 3553 struct stroptions *stropt; 3554 3555 ASSERT(DB_REF(mp) == 1); 3556 ASSERT(MBLKSIZE(mp) >= sizeof (struct stroptions)); 3557 3558 DB_TYPE(mp) = M_SETOPTS; 3559 stropt = (struct stroptions *)mp->b_rptr; 3560 mp->b_wptr = mp->b_rptr + sizeof (struct stroptions); 3561 stropt = (struct stroptions *)mp->b_rptr; 3562 stropt->so_flags = SO_HIWAT | SO_WROFF | SO_MAXBLK; 3563 stropt->so_hiwat = sopp.sopp_rxhiwat; 3564 stropt->so_wroff = sopp.sopp_wroff; 3565 stropt->so_maxblk = sopp.sopp_maxblk; 3566 3567 if (sopp.sopp_flags & SOCKOPT_TAIL) { 3568 ASSERT(tcp->tcp_kssl_ctx != NULL); 3569 3570 stropt->so_flags |= SO_TAIL | SO_COPYOPT; 3571 stropt->so_tail = sopp.sopp_tail; 3572 stropt->so_copyopt = sopp.sopp_zcopyflag; 3573 } 3574 3575 /* Send the options up */ 3576 putnext(q, mp); 3577 } 3578 3579 /* 3580 * Pass up any data and/or a fin that has been received. 3581 * 3582 * Adjust receive window in case it had decreased 3583 * (because there is data <=> tcp_rcv_list != NULL) 3584 * while the connection was detached. Note that 3585 * in case the eager was flow-controlled, w/o this 3586 * code, the rwnd may never open up again! 3587 */ 3588 if (tcp->tcp_rcv_list != NULL) { 3589 if (IPCL_IS_NONSTR(connp)) { 3590 mblk_t *mp; 3591 int space_left; 3592 int error; 3593 boolean_t push = B_TRUE; 3594 3595 if (!tcp->tcp_fused && (*connp->conn_upcalls->su_recv) 3596 (connp->conn_upper_handle, NULL, 0, 0, &error, 3597 &push) >= 0) { 3598 tcp->tcp_rwnd = connp->conn_rcvbuf; 3599 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3600 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 3601 tcp_xmit_ctl(NULL, 3602 tcp, (tcp->tcp_swnd == 0) ? 3603 tcp->tcp_suna : tcp->tcp_snxt, 3604 tcp->tcp_rnxt, TH_ACK); 3605 } 3606 } 3607 while ((mp = tcp->tcp_rcv_list) != NULL) { 3608 push = B_TRUE; 3609 tcp->tcp_rcv_list = mp->b_next; 3610 mp->b_next = NULL; 3611 space_left = (*connp->conn_upcalls->su_recv) 3612 (connp->conn_upper_handle, mp, msgdsize(mp), 3613 0, &error, &push); 3614 if (space_left < 0) { 3615 /* 3616 * We should never be in middle of a 3617 * fallback, the squeue guarantees that. 3618 */ 3619 ASSERT(error != EOPNOTSUPP); 3620 } 3621 } 3622 tcp->tcp_rcv_last_head = NULL; 3623 tcp->tcp_rcv_last_tail = NULL; 3624 tcp->tcp_rcv_cnt = 0; 3625 } else { 3626 /* We drain directly in case of fused tcp loopback */ 3627 3628 if (!tcp->tcp_fused && canputnext(q)) { 3629 tcp->tcp_rwnd = connp->conn_rcvbuf; 3630 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3631 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 3632 tcp_xmit_ctl(NULL, 3633 tcp, (tcp->tcp_swnd == 0) ? 3634 tcp->tcp_suna : tcp->tcp_snxt, 3635 tcp->tcp_rnxt, TH_ACK); 3636 } 3637 } 3638 3639 (void) tcp_rcv_drain(tcp); 3640 } 3641 3642 /* 3643 * For fused tcp loopback, back-enable peer endpoint 3644 * if it's currently flow-controlled. 3645 */ 3646 if (tcp->tcp_fused) { 3647 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 3648 3649 ASSERT(peer_tcp != NULL); 3650 ASSERT(peer_tcp->tcp_fused); 3651 3652 mutex_enter(&peer_tcp->tcp_non_sq_lock); 3653 if (peer_tcp->tcp_flow_stopped) { 3654 tcp_clrqfull(peer_tcp); 3655 TCP_STAT(tcps, tcp_fusion_backenabled); 3656 } 3657 mutex_exit(&peer_tcp->tcp_non_sq_lock); 3658 } 3659 } 3660 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 3661 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 3662 tcp->tcp_ordrel_done = B_TRUE; 3663 if (IPCL_IS_NONSTR(connp)) { 3664 ASSERT(tcp->tcp_ordrel_mp == NULL); 3665 (*connp->conn_upcalls->su_opctl)( 3666 connp->conn_upper_handle, 3667 SOCK_OPCTL_SHUT_RECV, 0); 3668 } else { 3669 mp = tcp->tcp_ordrel_mp; 3670 tcp->tcp_ordrel_mp = NULL; 3671 putnext(q, mp); 3672 } 3673 } 3674 tcp->tcp_hard_binding = B_FALSE; 3675 3676 if (connp->conn_keepalive) { 3677 tcp->tcp_ka_last_intrvl = 0; 3678 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_timer, 3679 MSEC_TO_TICK(tcp->tcp_ka_interval)); 3680 } 3681 3682 /* 3683 * At this point, eager is fully established and will 3684 * have the following references - 3685 * 3686 * 2 references for connection to exist (1 for TCP and 1 for IP). 3687 * 1 reference for the squeue which will be dropped by the squeue as 3688 * soon as this function returns. 3689 * There will be 1 additonal reference for being in classifier 3690 * hash list provided something bad hasn't happened. 3691 */ 3692 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 3693 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 3694 } 3695 3696 /* 3697 * Common to TPI and sockfs accept code. 3698 */ 3699 /* ARGSUSED2 */ 3700 int 3701 tcp_accept_common(conn_t *lconnp, conn_t *econnp, cred_t *cr) 3702 { 3703 tcp_t *listener, *eager; 3704 mblk_t *discon_mp; 3705 3706 listener = lconnp->conn_tcp; 3707 ASSERT(listener->tcp_state == TCPS_LISTEN); 3708 eager = econnp->conn_tcp; 3709 ASSERT(eager->tcp_listener != NULL); 3710 3711 /* 3712 * Pre allocate the discon_ind mblk also. tcp_accept_finish will 3713 * use it if something failed. 3714 */ 3715 discon_mp = allocb(MAX(sizeof (struct T_discon_ind), 3716 sizeof (struct stroptions)), BPRI_HI); 3717 3718 if (discon_mp == NULL) { 3719 return (-TPROTO); 3720 } 3721 eager->tcp_issocket = B_TRUE; 3722 3723 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 3724 econnp->conn_allzones = listener->tcp_connp->conn_allzones; 3725 ASSERT(econnp->conn_netstack == 3726 listener->tcp_connp->conn_netstack); 3727 ASSERT(eager->tcp_tcps == listener->tcp_tcps); 3728 3729 /* Put the ref for IP */ 3730 CONN_INC_REF(econnp); 3731 3732 /* 3733 * We should have minimum of 3 references on the conn 3734 * at this point. One each for TCP and IP and one for 3735 * the T_conn_ind that was sent up when the 3-way handshake 3736 * completed. In the normal case we would also have another 3737 * reference (making a total of 4) for the conn being in the 3738 * classifier hash list. However the eager could have received 3739 * an RST subsequently and tcp_closei_local could have removed 3740 * the eager from the classifier hash list, hence we can't 3741 * assert that reference. 3742 */ 3743 ASSERT(econnp->conn_ref >= 3); 3744 3745 mutex_enter(&listener->tcp_eager_lock); 3746 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 3747 3748 tcp_t *tail; 3749 tcp_t *tcp; 3750 mblk_t *mp1; 3751 3752 tcp = listener->tcp_eager_prev_q0; 3753 /* 3754 * listener->tcp_eager_prev_q0 points to the TAIL of the 3755 * deferred T_conn_ind queue. We need to get to the head 3756 * of the queue in order to send up T_conn_ind the same 3757 * order as how the 3WHS is completed. 3758 */ 3759 while (tcp != listener) { 3760 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0 && 3761 !tcp->tcp_kssl_pending) 3762 break; 3763 else 3764 tcp = tcp->tcp_eager_prev_q0; 3765 } 3766 /* None of the pending eagers can be sent up now */ 3767 if (tcp == listener) 3768 goto no_more_eagers; 3769 3770 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 3771 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3772 /* Move from q0 to q */ 3773 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 3774 listener->tcp_conn_req_cnt_q0--; 3775 listener->tcp_conn_req_cnt_q++; 3776 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 3777 tcp->tcp_eager_prev_q0; 3778 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 3779 tcp->tcp_eager_next_q0; 3780 tcp->tcp_eager_prev_q0 = NULL; 3781 tcp->tcp_eager_next_q0 = NULL; 3782 tcp->tcp_conn_def_q0 = B_FALSE; 3783 3784 /* Make sure the tcp isn't in the list of droppables */ 3785 ASSERT(tcp->tcp_eager_next_drop_q0 == NULL && 3786 tcp->tcp_eager_prev_drop_q0 == NULL); 3787 3788 /* 3789 * Insert at end of the queue because sockfs sends 3790 * down T_CONN_RES in chronological order. Leaving 3791 * the older conn indications at front of the queue 3792 * helps reducing search time. 3793 */ 3794 tail = listener->tcp_eager_last_q; 3795 if (tail != NULL) { 3796 tail->tcp_eager_next_q = tcp; 3797 } else { 3798 listener->tcp_eager_next_q = tcp; 3799 } 3800 listener->tcp_eager_last_q = tcp; 3801 tcp->tcp_eager_next_q = NULL; 3802 3803 /* Need to get inside the listener perimeter */ 3804 CONN_INC_REF(listener->tcp_connp); 3805 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, mp1, 3806 tcp_send_pending, listener->tcp_connp, NULL, SQ_FILL, 3807 SQTAG_TCP_SEND_PENDING); 3808 } 3809 no_more_eagers: 3810 tcp_eager_unlink(eager); 3811 mutex_exit(&listener->tcp_eager_lock); 3812 3813 /* 3814 * At this point, the eager is detached from the listener 3815 * but we still have an extra refs on eager (apart from the 3816 * usual tcp references). The ref was placed in tcp_input_data 3817 * before sending the conn_ind in tcp_send_conn_ind. 3818 * The ref will be dropped in tcp_accept_finish(). 3819 */ 3820 SQUEUE_ENTER_ONE(econnp->conn_sqp, discon_mp, tcp_accept_finish, 3821 econnp, NULL, SQ_NODRAIN, SQTAG_TCP_ACCEPT_FINISH_Q0); 3822 return (0); 3823 } 3824 3825 /* 3826 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP. 3827 */ 3828 boolean_t 3829 tcp_zcopy_check(tcp_t *tcp) 3830 { 3831 conn_t *connp = tcp->tcp_connp; 3832 ip_xmit_attr_t *ixa = connp->conn_ixa; 3833 boolean_t zc_enabled = B_FALSE; 3834 tcp_stack_t *tcps = tcp->tcp_tcps; 3835 3836 if (do_tcpzcopy == 2) 3837 zc_enabled = B_TRUE; 3838 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB)) 3839 zc_enabled = B_TRUE; 3840 3841 tcp->tcp_snd_zcopy_on = zc_enabled; 3842 if (!TCP_IS_DETACHED(tcp)) { 3843 if (zc_enabled) { 3844 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY; 3845 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3846 ZCVMSAFE); 3847 TCP_STAT(tcps, tcp_zcopy_on); 3848 } else { 3849 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY; 3850 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3851 ZCVMUNSAFE); 3852 TCP_STAT(tcps, tcp_zcopy_off); 3853 } 3854 } 3855 return (zc_enabled); 3856 } 3857 3858 /* 3859 * Backoff from a zero-copy message by copying data to a new allocated 3860 * message and freeing the original desballoca'ed segmapped message. 3861 * 3862 * This function is called by following two callers: 3863 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free 3864 * the origial desballoca'ed message and notify sockfs. This is in re- 3865 * transmit state. 3866 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need 3867 * to be copied to new message. 3868 */ 3869 mblk_t * 3870 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist) 3871 { 3872 mblk_t *nbp; 3873 mblk_t *head = NULL; 3874 mblk_t *tail = NULL; 3875 tcp_stack_t *tcps = tcp->tcp_tcps; 3876 3877 ASSERT(bp != NULL); 3878 while (bp != NULL) { 3879 if (IS_VMLOANED_MBLK(bp)) { 3880 TCP_STAT(tcps, tcp_zcopy_backoff); 3881 if ((nbp = copyb(bp)) == NULL) { 3882 tcp->tcp_xmit_zc_clean = B_FALSE; 3883 if (tail != NULL) 3884 tail->b_cont = bp; 3885 return ((head == NULL) ? bp : head); 3886 } 3887 3888 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 3889 if (fix_xmitlist) 3890 tcp_zcopy_notify(tcp); 3891 else 3892 nbp->b_datap->db_struioflag |= 3893 STRUIO_ZCNOTIFY; 3894 } 3895 nbp->b_cont = bp->b_cont; 3896 3897 /* 3898 * Copy saved information and adjust tcp_xmit_tail 3899 * if needed. 3900 */ 3901 if (fix_xmitlist) { 3902 nbp->b_prev = bp->b_prev; 3903 nbp->b_next = bp->b_next; 3904 3905 if (tcp->tcp_xmit_tail == bp) 3906 tcp->tcp_xmit_tail = nbp; 3907 } 3908 3909 /* Free the original message. */ 3910 bp->b_prev = NULL; 3911 bp->b_next = NULL; 3912 freeb(bp); 3913 3914 bp = nbp; 3915 } 3916 3917 if (head == NULL) { 3918 head = bp; 3919 } 3920 if (tail == NULL) { 3921 tail = bp; 3922 } else { 3923 tail->b_cont = bp; 3924 tail = bp; 3925 } 3926 3927 /* Move forward. */ 3928 bp = bp->b_cont; 3929 } 3930 3931 if (fix_xmitlist) { 3932 tcp->tcp_xmit_last = tail; 3933 tcp->tcp_xmit_zc_clean = B_TRUE; 3934 } 3935 3936 return (head); 3937 } 3938 3939 void 3940 tcp_zcopy_notify(tcp_t *tcp) 3941 { 3942 struct stdata *stp; 3943 conn_t *connp; 3944 3945 if (tcp->tcp_detached) 3946 return; 3947 connp = tcp->tcp_connp; 3948 if (IPCL_IS_NONSTR(connp)) { 3949 (*connp->conn_upcalls->su_zcopy_notify) 3950 (connp->conn_upper_handle); 3951 return; 3952 } 3953 stp = STREAM(connp->conn_rq); 3954 mutex_enter(&stp->sd_lock); 3955 stp->sd_flag |= STZCNOTIFY; 3956 cv_broadcast(&stp->sd_zcopy_wait); 3957 mutex_exit(&stp->sd_lock); 3958 } 3959 3960 /* 3961 * Update the TCP connection according to change of LSO capability. 3962 */ 3963 static void 3964 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa) 3965 { 3966 /* 3967 * We check against IPv4 header length to preserve the old behavior 3968 * of only enabling LSO when there are no IP options. 3969 * But this restriction might not be necessary at all. Before removing 3970 * it, need to verify how LSO is handled for source routing case, with 3971 * which IP does software checksum. 3972 * 3973 * For IPv6, whenever any extension header is needed, LSO is supressed. 3974 */ 3975 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ? 3976 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN)) 3977 return; 3978 3979 /* 3980 * Either the LSO capability newly became usable, or it has changed. 3981 */ 3982 if (ixa->ixa_flags & IXAF_LSO_CAPAB) { 3983 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab; 3984 3985 ASSERT(lsoc->ill_lso_max > 0); 3986 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max); 3987 3988 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3989 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max); 3990 3991 /* 3992 * If LSO to be enabled, notify the STREAM header with larger 3993 * data block. 3994 */ 3995 if (!tcp->tcp_lso) 3996 tcp->tcp_maxpsz_multiplier = 0; 3997 3998 tcp->tcp_lso = B_TRUE; 3999 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled); 4000 } else { /* LSO capability is not usable any more. */ 4001 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 4002 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max); 4003 4004 /* 4005 * If LSO to be disabled, notify the STREAM header with smaller 4006 * data block. And need to restore fragsize to PMTU. 4007 */ 4008 if (tcp->tcp_lso) { 4009 tcp->tcp_maxpsz_multiplier = 4010 tcp->tcp_tcps->tcps_maxpsz_multiplier; 4011 ixa->ixa_fragsize = ixa->ixa_pmtu; 4012 tcp->tcp_lso = B_FALSE; 4013 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled); 4014 } 4015 } 4016 4017 (void) tcp_maxpsz_set(tcp, B_TRUE); 4018 } 4019 4020 /* 4021 * Update the TCP connection according to change of ZEROCOPY capability. 4022 */ 4023 static void 4024 tcp_update_zcopy(tcp_t *tcp) 4025 { 4026 conn_t *connp = tcp->tcp_connp; 4027 tcp_stack_t *tcps = tcp->tcp_tcps; 4028 4029 if (tcp->tcp_snd_zcopy_on) { 4030 tcp->tcp_snd_zcopy_on = B_FALSE; 4031 if (!TCP_IS_DETACHED(tcp)) { 4032 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 4033 ZCVMUNSAFE); 4034 TCP_STAT(tcps, tcp_zcopy_off); 4035 } 4036 } else { 4037 tcp->tcp_snd_zcopy_on = B_TRUE; 4038 if (!TCP_IS_DETACHED(tcp)) { 4039 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 4040 ZCVMSAFE); 4041 TCP_STAT(tcps, tcp_zcopy_on); 4042 } 4043 } 4044 } 4045 4046 /* 4047 * Notify function registered with ip_xmit_attr_t. It's called in the squeue 4048 * so it's safe to update the TCP connection. 4049 */ 4050 /* ARGSUSED1 */ 4051 static void 4052 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 4053 ixa_notify_arg_t narg) 4054 { 4055 tcp_t *tcp = (tcp_t *)arg; 4056 conn_t *connp = tcp->tcp_connp; 4057 4058 switch (ntype) { 4059 case IXAN_LSO: 4060 tcp_update_lso(tcp, connp->conn_ixa); 4061 break; 4062 case IXAN_PMTU: 4063 tcp_update_pmtu(tcp, B_FALSE); 4064 break; 4065 case IXAN_ZCOPY: 4066 tcp_update_zcopy(tcp); 4067 break; 4068 default: 4069 break; 4070 } 4071 } 4072 4073 /* 4074 * The TCP write service routine should never be called... 4075 */ 4076 /* ARGSUSED */ 4077 static void 4078 tcp_wsrv(queue_t *q) 4079 { 4080 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 4081 4082 TCP_STAT(tcps, tcp_wsrv_called); 4083 } 4084 4085 /* 4086 * Hash list lookup routine for tcp_t structures. 4087 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 4088 */ 4089 tcp_t * 4090 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps) 4091 { 4092 tf_t *tf; 4093 tcp_t *tcp; 4094 4095 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 4096 mutex_enter(&tf->tf_lock); 4097 for (tcp = tf->tf_tcp; tcp != NULL; 4098 tcp = tcp->tcp_acceptor_hash) { 4099 if (tcp->tcp_acceptor_id == id) { 4100 CONN_INC_REF(tcp->tcp_connp); 4101 mutex_exit(&tf->tf_lock); 4102 return (tcp); 4103 } 4104 } 4105 mutex_exit(&tf->tf_lock); 4106 return (NULL); 4107 } 4108 4109 /* 4110 * Hash list insertion routine for tcp_t structures. 4111 */ 4112 void 4113 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 4114 { 4115 tf_t *tf; 4116 tcp_t **tcpp; 4117 tcp_t *tcpnext; 4118 tcp_stack_t *tcps = tcp->tcp_tcps; 4119 4120 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 4121 4122 if (tcp->tcp_ptpahn != NULL) 4123 tcp_acceptor_hash_remove(tcp); 4124 tcpp = &tf->tf_tcp; 4125 mutex_enter(&tf->tf_lock); 4126 tcpnext = tcpp[0]; 4127 if (tcpnext) 4128 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 4129 tcp->tcp_acceptor_hash = tcpnext; 4130 tcp->tcp_ptpahn = tcpp; 4131 tcpp[0] = tcp; 4132 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 4133 mutex_exit(&tf->tf_lock); 4134 } 4135 4136 /* 4137 * Hash list removal routine for tcp_t structures. 4138 */ 4139 void 4140 tcp_acceptor_hash_remove(tcp_t *tcp) 4141 { 4142 tcp_t *tcpnext; 4143 kmutex_t *lockp; 4144 4145 /* 4146 * Extract the lock pointer in case there are concurrent 4147 * hash_remove's for this instance. 4148 */ 4149 lockp = tcp->tcp_acceptor_lockp; 4150 4151 if (tcp->tcp_ptpahn == NULL) 4152 return; 4153 4154 ASSERT(lockp != NULL); 4155 mutex_enter(lockp); 4156 if (tcp->tcp_ptpahn) { 4157 tcpnext = tcp->tcp_acceptor_hash; 4158 if (tcpnext) { 4159 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 4160 tcp->tcp_acceptor_hash = NULL; 4161 } 4162 *tcp->tcp_ptpahn = tcpnext; 4163 tcp->tcp_ptpahn = NULL; 4164 } 4165 mutex_exit(lockp); 4166 tcp->tcp_acceptor_lockp = NULL; 4167 } 4168 4169 /* 4170 * Type three generator adapted from the random() function in 4.4 BSD: 4171 */ 4172 4173 /* 4174 * Copyright (c) 1983, 1993 4175 * The Regents of the University of California. All rights reserved. 4176 * 4177 * Redistribution and use in source and binary forms, with or without 4178 * modification, are permitted provided that the following conditions 4179 * are met: 4180 * 1. Redistributions of source code must retain the above copyright 4181 * notice, this list of conditions and the following disclaimer. 4182 * 2. Redistributions in binary form must reproduce the above copyright 4183 * notice, this list of conditions and the following disclaimer in the 4184 * documentation and/or other materials provided with the distribution. 4185 * 3. All advertising materials mentioning features or use of this software 4186 * must display the following acknowledgement: 4187 * This product includes software developed by the University of 4188 * California, Berkeley and its contributors. 4189 * 4. Neither the name of the University nor the names of its contributors 4190 * may be used to endorse or promote products derived from this software 4191 * without specific prior written permission. 4192 * 4193 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 4194 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4195 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4196 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 4197 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4198 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4199 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4200 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4201 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 4202 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 4203 * SUCH DAMAGE. 4204 */ 4205 4206 /* Type 3 -- x**31 + x**3 + 1 */ 4207 #define DEG_3 31 4208 #define SEP_3 3 4209 4210 4211 /* Protected by tcp_random_lock */ 4212 static int tcp_randtbl[DEG_3 + 1]; 4213 4214 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 4215 static int *tcp_random_rptr = &tcp_randtbl[1]; 4216 4217 static int *tcp_random_state = &tcp_randtbl[1]; 4218 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 4219 4220 kmutex_t tcp_random_lock; 4221 4222 void 4223 tcp_random_init(void) 4224 { 4225 int i; 4226 hrtime_t hrt; 4227 time_t wallclock; 4228 uint64_t result; 4229 4230 /* 4231 * Use high-res timer and current time for seed. Gethrtime() returns 4232 * a longlong, which may contain resolution down to nanoseconds. 4233 * The current time will either be a 32-bit or a 64-bit quantity. 4234 * XOR the two together in a 64-bit result variable. 4235 * Convert the result to a 32-bit value by multiplying the high-order 4236 * 32-bits by the low-order 32-bits. 4237 */ 4238 4239 hrt = gethrtime(); 4240 (void) drv_getparm(TIME, &wallclock); 4241 result = (uint64_t)wallclock ^ (uint64_t)hrt; 4242 mutex_enter(&tcp_random_lock); 4243 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 4244 (result & 0xffffffff); 4245 4246 for (i = 1; i < DEG_3; i++) 4247 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 4248 + 12345; 4249 tcp_random_fptr = &tcp_random_state[SEP_3]; 4250 tcp_random_rptr = &tcp_random_state[0]; 4251 mutex_exit(&tcp_random_lock); 4252 for (i = 0; i < 10 * DEG_3; i++) 4253 (void) tcp_random(); 4254 } 4255 4256 /* 4257 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 4258 * This range is selected to be approximately centered on TCP_ISS / 2, 4259 * and easy to compute. We get this value by generating a 32-bit random 4260 * number, selecting out the high-order 17 bits, and then adding one so 4261 * that we never return zero. 4262 */ 4263 int 4264 tcp_random(void) 4265 { 4266 int i; 4267 4268 mutex_enter(&tcp_random_lock); 4269 *tcp_random_fptr += *tcp_random_rptr; 4270 4271 /* 4272 * The high-order bits are more random than the low-order bits, 4273 * so we select out the high-order 17 bits and add one so that 4274 * we never return zero. 4275 */ 4276 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 4277 if (++tcp_random_fptr >= tcp_random_end_ptr) { 4278 tcp_random_fptr = tcp_random_state; 4279 ++tcp_random_rptr; 4280 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 4281 tcp_random_rptr = tcp_random_state; 4282 4283 mutex_exit(&tcp_random_lock); 4284 return (i); 4285 } 4286 4287 /* 4288 * Split this function out so that if the secret changes, I'm okay. 4289 * 4290 * Initialize the tcp_iss_cookie and tcp_iss_key. 4291 */ 4292 4293 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 4294 4295 static void 4296 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps) 4297 { 4298 struct { 4299 int32_t current_time; 4300 uint32_t randnum; 4301 uint16_t pad; 4302 uint8_t ether[6]; 4303 uint8_t passwd[PASSWD_SIZE]; 4304 } tcp_iss_cookie; 4305 time_t t; 4306 4307 /* 4308 * Start with the current absolute time. 4309 */ 4310 (void) drv_getparm(TIME, &t); 4311 tcp_iss_cookie.current_time = t; 4312 4313 /* 4314 * XXX - Need a more random number per RFC 1750, not this crap. 4315 * OTOH, if what follows is pretty random, then I'm in better shape. 4316 */ 4317 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 4318 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 4319 4320 /* 4321 * The cpu_type_info is pretty non-random. Ugggh. It does serve 4322 * as a good template. 4323 */ 4324 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 4325 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 4326 4327 /* 4328 * The pass-phrase. Normally this is supplied by user-called NDD. 4329 */ 4330 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 4331 4332 /* 4333 * See 4010593 if this section becomes a problem again, 4334 * but the local ethernet address is useful here. 4335 */ 4336 (void) localetheraddr(NULL, 4337 (struct ether_addr *)&tcp_iss_cookie.ether); 4338 4339 /* 4340 * Hash 'em all together. The MD5Final is called per-connection. 4341 */ 4342 mutex_enter(&tcps->tcps_iss_key_lock); 4343 MD5Init(&tcps->tcps_iss_key); 4344 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie, 4345 sizeof (tcp_iss_cookie)); 4346 mutex_exit(&tcps->tcps_iss_key_lock); 4347 } 4348 4349 /* 4350 * Set the RFC 1948 pass phrase 4351 */ 4352 /* ARGSUSED */ 4353 static int 4354 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 4355 cred_t *cr) 4356 { 4357 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 4358 4359 /* 4360 * Basically, value contains a new pass phrase. Pass it along! 4361 */ 4362 tcp_iss_key_init((uint8_t *)value, strlen(value), tcps); 4363 return (0); 4364 } 4365 4366 /* ARGSUSED */ 4367 static int 4368 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 4369 { 4370 bzero(buf, sizeof (tcp_sack_info_t)); 4371 return (0); 4372 } 4373 4374 /* 4375 * Called by IP when IP is loaded into the kernel 4376 */ 4377 void 4378 tcp_ddi_g_init(void) 4379 { 4380 tcp_timercache = kmem_cache_create("tcp_timercache", 4381 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 4382 NULL, NULL, NULL, NULL, NULL, 0); 4383 4384 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 4385 sizeof (tcp_sack_info_t), 0, 4386 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 4387 4388 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 4389 4390 /* Initialize the random number generator */ 4391 tcp_random_init(); 4392 4393 /* A single callback independently of how many netstacks we have */ 4394 ip_squeue_init(tcp_squeue_add); 4395 4396 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics); 4397 4398 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput); 4399 4400 /* 4401 * We want to be informed each time a stack is created or 4402 * destroyed in the kernel, so we can maintain the 4403 * set of tcp_stack_t's. 4404 */ 4405 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini); 4406 4407 mutex_enter(&cpu_lock); 4408 register_cpu_setup_func(tcp_cpu_update, NULL); 4409 mutex_exit(&cpu_lock); 4410 } 4411 4412 4413 #define INET_NAME "ip" 4414 4415 /* 4416 * Initialize the TCP stack instance. 4417 */ 4418 static void * 4419 tcp_stack_init(netstackid_t stackid, netstack_t *ns) 4420 { 4421 tcp_stack_t *tcps; 4422 tcpparam_t *pa; 4423 int i; 4424 int error = 0; 4425 major_t major; 4426 4427 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP); 4428 tcps->tcps_netstack = ns; 4429 4430 /* Initialize locks */ 4431 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 4432 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 4433 4434 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 4435 tcps->tcps_g_epriv_ports[0] = 2049; 4436 tcps->tcps_g_epriv_ports[1] = 4045; 4437 tcps->tcps_min_anonpriv_port = 512; 4438 4439 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) * 4440 TCP_BIND_FANOUT_SIZE, KM_SLEEP); 4441 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) * 4442 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP); 4443 4444 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 4445 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL, 4446 MUTEX_DEFAULT, NULL); 4447 } 4448 4449 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 4450 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL, 4451 MUTEX_DEFAULT, NULL); 4452 } 4453 4454 /* TCP's IPsec code calls the packet dropper. */ 4455 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement"); 4456 4457 pa = (tcpparam_t *)kmem_alloc(sizeof (lcl_tcp_param_arr), KM_SLEEP); 4458 tcps->tcps_params = pa; 4459 bcopy(lcl_tcp_param_arr, tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 4460 4461 (void) tcp_param_register(&tcps->tcps_g_nd, tcps->tcps_params, 4462 A_CNT(lcl_tcp_param_arr), tcps); 4463 4464 /* 4465 * Note: To really walk the device tree you need the devinfo 4466 * pointer to your device which is only available after probe/attach. 4467 * The following is safe only because it uses ddi_root_node() 4468 */ 4469 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 4470 tcp_opt_obj.odb_opt_arr_cnt); 4471 4472 /* 4473 * Initialize RFC 1948 secret values. This will probably be reset once 4474 * by the boot scripts. 4475 * 4476 * Use NULL name, as the name is caught by the new lockstats. 4477 * 4478 * Initialize with some random, non-guessable string, like the global 4479 * T_INFO_ACK. 4480 */ 4481 4482 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 4483 sizeof (tcp_g_t_info_ack), tcps); 4484 4485 tcps->tcps_kstat = tcp_kstat2_init(stackid); 4486 tcps->tcps_mibkp = tcp_kstat_init(stackid); 4487 4488 major = mod_name_to_major(INET_NAME); 4489 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident); 4490 ASSERT(error == 0); 4491 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL); 4492 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL); 4493 cv_init(&tcps->tcps_ixa_cleanup_cv, NULL, CV_DEFAULT, NULL); 4494 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL); 4495 4496 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL); 4497 tcps->tcps_reclaim = B_FALSE; 4498 tcps->tcps_reclaim_tid = 0; 4499 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max; 4500 4501 /* 4502 * ncpus is the current number of CPUs, which can be bigger than 4503 * boot_ncpus. But we don't want to use ncpus to allocate all the 4504 * tcp_stats_cpu_t at system boot up time since it will be 1. While 4505 * we handle adding CPU in tcp_cpu_update(), it will be slow if 4506 * there are many CPUs as we will be adding them 1 by 1. 4507 * 4508 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers 4509 * are not freed until the stack is going away. So there is no need 4510 * to grab a lock to access the per CPU tcps_sc[x] pointer. 4511 */ 4512 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus); 4513 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *), 4514 KM_SLEEP); 4515 for (i = 0; i < tcps->tcps_sc_cnt; i++) { 4516 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t), 4517 KM_SLEEP); 4518 } 4519 4520 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL); 4521 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t), 4522 offsetof(tcp_listener_t, tl_link)); 4523 4524 return (tcps); 4525 } 4526 4527 /* 4528 * Called when the IP module is about to be unloaded. 4529 */ 4530 void 4531 tcp_ddi_g_destroy(void) 4532 { 4533 mutex_enter(&cpu_lock); 4534 unregister_cpu_setup_func(tcp_cpu_update, NULL); 4535 mutex_exit(&cpu_lock); 4536 4537 tcp_g_kstat_fini(tcp_g_kstat); 4538 tcp_g_kstat = NULL; 4539 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics)); 4540 4541 mutex_destroy(&tcp_random_lock); 4542 4543 kmem_cache_destroy(tcp_timercache); 4544 kmem_cache_destroy(tcp_sack_info_cache); 4545 4546 netstack_unregister(NS_TCP); 4547 } 4548 4549 /* 4550 * Free the TCP stack instance. 4551 */ 4552 static void 4553 tcp_stack_fini(netstackid_t stackid, void *arg) 4554 { 4555 tcp_stack_t *tcps = (tcp_stack_t *)arg; 4556 int i; 4557 4558 freeb(tcps->tcps_ixa_cleanup_mp); 4559 tcps->tcps_ixa_cleanup_mp = NULL; 4560 cv_destroy(&tcps->tcps_ixa_cleanup_cv); 4561 mutex_destroy(&tcps->tcps_ixa_cleanup_lock); 4562 4563 /* 4564 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart 4565 * the timer. 4566 */ 4567 mutex_enter(&tcps->tcps_reclaim_lock); 4568 tcps->tcps_reclaim = B_FALSE; 4569 mutex_exit(&tcps->tcps_reclaim_lock); 4570 if (tcps->tcps_reclaim_tid != 0) 4571 (void) untimeout(tcps->tcps_reclaim_tid); 4572 mutex_destroy(&tcps->tcps_reclaim_lock); 4573 4574 tcp_listener_conf_cleanup(tcps); 4575 4576 for (i = 0; i < tcps->tcps_sc_cnt; i++) 4577 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t)); 4578 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *)); 4579 4580 nd_free(&tcps->tcps_g_nd); 4581 kmem_free(tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 4582 tcps->tcps_params = NULL; 4583 kmem_free(tcps->tcps_wroff_xtra_param, sizeof (tcpparam_t)); 4584 tcps->tcps_wroff_xtra_param = NULL; 4585 4586 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 4587 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL); 4588 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock); 4589 } 4590 4591 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 4592 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL); 4593 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock); 4594 } 4595 4596 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE); 4597 tcps->tcps_bind_fanout = NULL; 4598 4599 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) * 4600 TCP_ACCEPTOR_FANOUT_SIZE); 4601 tcps->tcps_acceptor_fanout = NULL; 4602 4603 mutex_destroy(&tcps->tcps_iss_key_lock); 4604 mutex_destroy(&tcps->tcps_epriv_port_lock); 4605 4606 ip_drop_unregister(&tcps->tcps_dropper); 4607 4608 tcp_kstat2_fini(stackid, tcps->tcps_kstat); 4609 tcps->tcps_kstat = NULL; 4610 4611 tcp_kstat_fini(stackid, tcps->tcps_mibkp); 4612 tcps->tcps_mibkp = NULL; 4613 4614 ldi_ident_release(tcps->tcps_ldi_ident); 4615 kmem_free(tcps, sizeof (*tcps)); 4616 } 4617 4618 /* 4619 * Generate ISS, taking into account NDD changes may happen halfway through. 4620 * (If the iss is not zero, set it.) 4621 */ 4622 4623 static void 4624 tcp_iss_init(tcp_t *tcp) 4625 { 4626 MD5_CTX context; 4627 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 4628 uint32_t answer[4]; 4629 tcp_stack_t *tcps = tcp->tcp_tcps; 4630 conn_t *connp = tcp->tcp_connp; 4631 4632 tcps->tcps_iss_incr_extra += (ISS_INCR >> 1); 4633 tcp->tcp_iss = tcps->tcps_iss_incr_extra; 4634 switch (tcps->tcps_strong_iss) { 4635 case 2: 4636 mutex_enter(&tcps->tcps_iss_key_lock); 4637 context = tcps->tcps_iss_key; 4638 mutex_exit(&tcps->tcps_iss_key_lock); 4639 arg.ports = connp->conn_ports; 4640 arg.src = connp->conn_laddr_v6; 4641 arg.dst = connp->conn_faddr_v6; 4642 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 4643 MD5Final((uchar_t *)answer, &context); 4644 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 4645 /* 4646 * Now that we've hashed into a unique per-connection sequence 4647 * space, add a random increment per strong_iss == 1. So I 4648 * guess we'll have to... 4649 */ 4650 /* FALLTHRU */ 4651 case 1: 4652 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 4653 break; 4654 default: 4655 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 4656 break; 4657 } 4658 tcp->tcp_valid_bits = TCP_ISS_VALID; 4659 tcp->tcp_fss = tcp->tcp_iss - 1; 4660 tcp->tcp_suna = tcp->tcp_iss; 4661 tcp->tcp_snxt = tcp->tcp_iss + 1; 4662 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 4663 tcp->tcp_csuna = tcp->tcp_snxt; 4664 } 4665 4666 /* 4667 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 4668 * on the specified backing STREAMS q. Note, the caller may make the 4669 * decision to call based on the tcp_t.tcp_flow_stopped value which 4670 * when check outside the q's lock is only an advisory check ... 4671 */ 4672 void 4673 tcp_setqfull(tcp_t *tcp) 4674 { 4675 tcp_stack_t *tcps = tcp->tcp_tcps; 4676 conn_t *connp = tcp->tcp_connp; 4677 4678 if (tcp->tcp_closed) 4679 return; 4680 4681 conn_setqfull(connp, &tcp->tcp_flow_stopped); 4682 if (tcp->tcp_flow_stopped) 4683 TCP_STAT(tcps, tcp_flwctl_on); 4684 } 4685 4686 void 4687 tcp_clrqfull(tcp_t *tcp) 4688 { 4689 conn_t *connp = tcp->tcp_connp; 4690 4691 if (tcp->tcp_closed) 4692 return; 4693 conn_clrqfull(connp, &tcp->tcp_flow_stopped); 4694 } 4695 4696 static int 4697 tcp_squeue_switch(int val) 4698 { 4699 int rval = SQ_FILL; 4700 4701 switch (val) { 4702 case 1: 4703 rval = SQ_NODRAIN; 4704 break; 4705 case 2: 4706 rval = SQ_PROCESS; 4707 break; 4708 default: 4709 break; 4710 } 4711 return (rval); 4712 } 4713 4714 /* 4715 * This is called once for each squeue - globally for all stack 4716 * instances. 4717 */ 4718 static void 4719 tcp_squeue_add(squeue_t *sqp) 4720 { 4721 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 4722 sizeof (tcp_squeue_priv_t), KM_SLEEP); 4723 4724 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 4725 /* Kick start the periodic TIME WAIT collector. */ 4726 tcp_time_wait->tcp_time_wait_tid = 4727 timeout_generic(CALLOUT_NORMAL, tcp_time_wait_collector, sqp, 4728 (hrtime_t)10 * NANOSEC, CALLOUT_TCP_RESOLUTION, 4729 CALLOUT_FLAG_ROUNDUP); 4730 if (tcp_free_list_max_cnt == 0) { 4731 int tcp_ncpus = ((boot_max_ncpus == -1) ? 4732 max_ncpus : boot_max_ncpus); 4733 4734 /* 4735 * Limit number of entries to 1% of availble memory / tcp_ncpus 4736 */ 4737 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 4738 (tcp_ncpus * sizeof (tcp_t) * 100); 4739 } 4740 tcp_time_wait->tcp_free_list_cnt = 0; 4741 } 4742 /* 4743 * Return unix error is tli error is TSYSERR, otherwise return a negative 4744 * tli error. 4745 */ 4746 int 4747 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 4748 boolean_t bind_to_req_port_only) 4749 { 4750 int error; 4751 tcp_t *tcp = connp->conn_tcp; 4752 4753 if (tcp->tcp_state >= TCPS_BOUND) { 4754 if (connp->conn_debug) { 4755 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4756 "tcp_bind: bad state, %d", tcp->tcp_state); 4757 } 4758 return (-TOUTSTATE); 4759 } 4760 4761 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only); 4762 if (error != 0) 4763 return (error); 4764 4765 ASSERT(tcp->tcp_state == TCPS_BOUND); 4766 tcp->tcp_conn_req_max = 0; 4767 return (0); 4768 } 4769 4770 /* 4771 * If the return value from this function is positive, it's a UNIX error. 4772 * Otherwise, if it's negative, then the absolute value is a TLI error. 4773 * the TPI routine tcp_tpi_connect() is a wrapper function for this. 4774 */ 4775 int 4776 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 4777 cred_t *cr, pid_t pid) 4778 { 4779 tcp_t *tcp = connp->conn_tcp; 4780 sin_t *sin = (sin_t *)sa; 4781 sin6_t *sin6 = (sin6_t *)sa; 4782 ipaddr_t *dstaddrp; 4783 in_port_t dstport; 4784 uint_t srcid; 4785 int error; 4786 uint32_t mss; 4787 mblk_t *syn_mp; 4788 tcp_stack_t *tcps = tcp->tcp_tcps; 4789 int32_t oldstate; 4790 ip_xmit_attr_t *ixa = connp->conn_ixa; 4791 4792 oldstate = tcp->tcp_state; 4793 4794 switch (len) { 4795 default: 4796 /* 4797 * Should never happen 4798 */ 4799 return (EINVAL); 4800 4801 case sizeof (sin_t): 4802 sin = (sin_t *)sa; 4803 if (sin->sin_port == 0) { 4804 return (-TBADADDR); 4805 } 4806 if (connp->conn_ipv6_v6only) { 4807 return (EAFNOSUPPORT); 4808 } 4809 break; 4810 4811 case sizeof (sin6_t): 4812 sin6 = (sin6_t *)sa; 4813 if (sin6->sin6_port == 0) { 4814 return (-TBADADDR); 4815 } 4816 break; 4817 } 4818 /* 4819 * If we're connecting to an IPv4-mapped IPv6 address, we need to 4820 * make sure that the conn_ipversion is IPV4_VERSION. We 4821 * need to this before we call tcp_bindi() so that the port lookup 4822 * code will look for ports in the correct port space (IPv4 and 4823 * IPv6 have separate port spaces). 4824 */ 4825 if (connp->conn_family == AF_INET6 && 4826 connp->conn_ipversion == IPV6_VERSION && 4827 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4828 if (connp->conn_ipv6_v6only) 4829 return (EADDRNOTAVAIL); 4830 4831 connp->conn_ipversion = IPV4_VERSION; 4832 } 4833 4834 switch (tcp->tcp_state) { 4835 case TCPS_LISTEN: 4836 /* 4837 * Listening sockets are not allowed to issue connect(). 4838 */ 4839 if (IPCL_IS_NONSTR(connp)) 4840 return (EOPNOTSUPP); 4841 /* FALLTHRU */ 4842 case TCPS_IDLE: 4843 /* 4844 * We support quick connect, refer to comments in 4845 * tcp_connect_*() 4846 */ 4847 /* FALLTHRU */ 4848 case TCPS_BOUND: 4849 break; 4850 default: 4851 return (-TOUTSTATE); 4852 } 4853 4854 /* 4855 * We update our cred/cpid based on the caller of connect 4856 */ 4857 if (connp->conn_cred != cr) { 4858 crhold(cr); 4859 crfree(connp->conn_cred); 4860 connp->conn_cred = cr; 4861 } 4862 connp->conn_cpid = pid; 4863 4864 /* Cache things in the ixa without any refhold */ 4865 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4866 ixa->ixa_cred = cr; 4867 ixa->ixa_cpid = pid; 4868 if (is_system_labeled()) { 4869 /* We need to restart with a label based on the cred */ 4870 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4871 } 4872 4873 if (connp->conn_family == AF_INET6) { 4874 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4875 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr, 4876 sin6->sin6_port, sin6->sin6_flowinfo, 4877 sin6->__sin6_src_id, sin6->sin6_scope_id); 4878 } else { 4879 /* 4880 * Destination adress is mapped IPv6 address. 4881 * Source bound address should be unspecified or 4882 * IPv6 mapped address as well. 4883 */ 4884 if (!IN6_IS_ADDR_UNSPECIFIED( 4885 &connp->conn_bound_addr_v6) && 4886 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) { 4887 return (EADDRNOTAVAIL); 4888 } 4889 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 4890 dstport = sin6->sin6_port; 4891 srcid = sin6->__sin6_src_id; 4892 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, 4893 srcid); 4894 } 4895 } else { 4896 dstaddrp = &sin->sin_addr.s_addr; 4897 dstport = sin->sin_port; 4898 srcid = 0; 4899 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid); 4900 } 4901 4902 if (error != 0) 4903 goto connect_failed; 4904 4905 CL_INET_CONNECT(connp, B_TRUE, error); 4906 if (error != 0) 4907 goto connect_failed; 4908 4909 /* connect succeeded */ 4910 TCPS_BUMP_MIB(tcps, tcpActiveOpens); 4911 tcp->tcp_active_open = 1; 4912 4913 /* 4914 * tcp_set_destination() does not adjust for TCP/IP header length. 4915 */ 4916 mss = tcp->tcp_mss - connp->conn_ht_iphc_len; 4917 4918 /* 4919 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up 4920 * to the nearest MSS. 4921 * 4922 * We do the round up here because we need to get the interface MTU 4923 * first before we can do the round up. 4924 */ 4925 tcp->tcp_rwnd = connp->conn_rcvbuf; 4926 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 4927 tcps->tcps_recv_hiwat_minmss * mss); 4928 connp->conn_rcvbuf = tcp->tcp_rwnd; 4929 tcp_set_ws_value(tcp); 4930 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 4931 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) 4932 tcp->tcp_snd_ws_ok = B_TRUE; 4933 4934 /* 4935 * Set tcp_snd_ts_ok to true 4936 * so that tcp_xmit_mp will 4937 * include the timestamp 4938 * option in the SYN segment. 4939 */ 4940 if (tcps->tcps_tstamp_always || 4941 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { 4942 tcp->tcp_snd_ts_ok = B_TRUE; 4943 } 4944 4945 /* 4946 * tcp_snd_sack_ok can be set in 4947 * tcp_set_destination() if the sack metric 4948 * is set. So check it here also. 4949 */ 4950 if (tcps->tcps_sack_permitted == 2 || 4951 tcp->tcp_snd_sack_ok) { 4952 if (tcp->tcp_sack_info == NULL) { 4953 tcp->tcp_sack_info = kmem_cache_alloc( 4954 tcp_sack_info_cache, KM_SLEEP); 4955 } 4956 tcp->tcp_snd_sack_ok = B_TRUE; 4957 } 4958 4959 /* 4960 * Should we use ECN? Note that the current 4961 * default value (SunOS 5.9) of tcp_ecn_permitted 4962 * is 1. The reason for doing this is that there 4963 * are equipments out there that will drop ECN 4964 * enabled IP packets. Setting it to 1 avoids 4965 * compatibility problems. 4966 */ 4967 if (tcps->tcps_ecn_permitted == 2) 4968 tcp->tcp_ecn_ok = B_TRUE; 4969 4970 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4971 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 4972 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 4973 if (syn_mp != NULL) { 4974 /* 4975 * We must bump the generation before sending the syn 4976 * to ensure that we use the right generation in case 4977 * this thread issues a "connected" up call. 4978 */ 4979 SOCK_CONNID_BUMP(tcp->tcp_connid); 4980 tcp_send_data(tcp, syn_mp); 4981 } 4982 4983 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4984 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4985 return (0); 4986 4987 connect_failed: 4988 connp->conn_faddr_v6 = ipv6_all_zeros; 4989 connp->conn_fport = 0; 4990 tcp->tcp_state = oldstate; 4991 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4992 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4993 return (error); 4994 } 4995 4996 int 4997 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len, 4998 int backlog, cred_t *cr, boolean_t bind_to_req_port_only) 4999 { 5000 tcp_t *tcp = connp->conn_tcp; 5001 int error = 0; 5002 tcp_stack_t *tcps = tcp->tcp_tcps; 5003 5004 /* All Solaris components should pass a cred for this operation. */ 5005 ASSERT(cr != NULL); 5006 5007 if (tcp->tcp_state >= TCPS_BOUND) { 5008 if ((tcp->tcp_state == TCPS_BOUND || 5009 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) { 5010 /* 5011 * Handle listen() increasing backlog. 5012 * This is more "liberal" then what the TPI spec 5013 * requires but is needed to avoid a t_unbind 5014 * when handling listen() since the port number 5015 * might be "stolen" between the unbind and bind. 5016 */ 5017 goto do_listen; 5018 } 5019 if (connp->conn_debug) { 5020 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 5021 "tcp_listen: bad state, %d", tcp->tcp_state); 5022 } 5023 return (-TOUTSTATE); 5024 } else { 5025 if (sa == NULL) { 5026 sin6_t addr; 5027 sin_t *sin; 5028 sin6_t *sin6; 5029 5030 ASSERT(IPCL_IS_NONSTR(connp)); 5031 /* Do an implicit bind: Request for a generic port. */ 5032 if (connp->conn_family == AF_INET) { 5033 len = sizeof (sin_t); 5034 sin = (sin_t *)&addr; 5035 *sin = sin_null; 5036 sin->sin_family = AF_INET; 5037 } else { 5038 ASSERT(connp->conn_family == AF_INET6); 5039 len = sizeof (sin6_t); 5040 sin6 = (sin6_t *)&addr; 5041 *sin6 = sin6_null; 5042 sin6->sin6_family = AF_INET6; 5043 } 5044 sa = (struct sockaddr *)&addr; 5045 } 5046 5047 error = tcp_bind_check(connp, sa, len, cr, 5048 bind_to_req_port_only); 5049 if (error) 5050 return (error); 5051 /* Fall through and do the fanout insertion */ 5052 } 5053 5054 do_listen: 5055 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN); 5056 tcp->tcp_conn_req_max = backlog; 5057 if (tcp->tcp_conn_req_max) { 5058 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) 5059 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; 5060 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) 5061 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; 5062 /* 5063 * If this is a listener, do not reset the eager list 5064 * and other stuffs. Note that we don't check if the 5065 * existing eager list meets the new tcp_conn_req_max 5066 * requirement. 5067 */ 5068 if (tcp->tcp_state != TCPS_LISTEN) { 5069 tcp->tcp_state = TCPS_LISTEN; 5070 /* Initialize the chain. Don't need the eager_lock */ 5071 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 5072 tcp->tcp_eager_next_drop_q0 = tcp; 5073 tcp->tcp_eager_prev_drop_q0 = tcp; 5074 tcp->tcp_second_ctimer_threshold = 5075 tcps->tcps_ip_abort_linterval; 5076 } 5077 } 5078 5079 /* 5080 * We need to make sure that the conn_recv is set to a non-null 5081 * value before we insert the conn into the classifier table. 5082 * This is to avoid a race with an incoming packet which does an 5083 * ipcl_classify(). 5084 * We initially set it to tcp_input_listener_unbound to try to 5085 * pick a good squeue for the listener when the first SYN arrives. 5086 * tcp_input_listener_unbound sets it to tcp_input_listener on that 5087 * first SYN. 5088 */ 5089 connp->conn_recv = tcp_input_listener_unbound; 5090 5091 /* Insert the listener in the classifier table */ 5092 error = ip_laddr_fanout_insert(connp); 5093 if (error != 0) { 5094 /* Undo the bind - release the port number */ 5095 tcp->tcp_state = TCPS_IDLE; 5096 connp->conn_bound_addr_v6 = ipv6_all_zeros; 5097 5098 connp->conn_laddr_v6 = ipv6_all_zeros; 5099 connp->conn_saddr_v6 = ipv6_all_zeros; 5100 connp->conn_ports = 0; 5101 5102 if (connp->conn_anon_port) { 5103 zone_t *zone; 5104 5105 zone = crgetzone(cr); 5106 connp->conn_anon_port = B_FALSE; 5107 (void) tsol_mlp_anon(zone, connp->conn_mlp_type, 5108 connp->conn_proto, connp->conn_lport, B_FALSE); 5109 } 5110 connp->conn_mlp_type = mlptSingle; 5111 5112 tcp_bind_hash_remove(tcp); 5113 return (error); 5114 } else { 5115 /* 5116 * If there is a connection limit, allocate and initialize 5117 * the counter struct. Note that since listen can be called 5118 * multiple times, the struct may have been allready allocated. 5119 */ 5120 if (!list_is_empty(&tcps->tcps_listener_conf) && 5121 tcp->tcp_listen_cnt == NULL) { 5122 tcp_listen_cnt_t *tlc; 5123 uint32_t ratio; 5124 5125 ratio = tcp_find_listener_conf(tcps, 5126 ntohs(connp->conn_lport)); 5127 if (ratio != 0) { 5128 uint32_t mem_ratio, tot_buf; 5129 5130 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t), 5131 KM_SLEEP); 5132 /* 5133 * Calculate the connection limit based on 5134 * the configured ratio and maxusers. Maxusers 5135 * are calculated based on memory size, 5136 * ~ 1 user per MB. Note that the conn_rcvbuf 5137 * and conn_sndbuf may change after a 5138 * connection is accepted. So what we have 5139 * is only an approximation. 5140 */ 5141 if ((tot_buf = connp->conn_rcvbuf + 5142 connp->conn_sndbuf) < MB) { 5143 mem_ratio = MB / tot_buf; 5144 tlc->tlc_max = maxusers / ratio * 5145 mem_ratio; 5146 } else { 5147 mem_ratio = tot_buf / MB; 5148 tlc->tlc_max = maxusers / ratio / 5149 mem_ratio; 5150 } 5151 /* At least we should allow two connections! */ 5152 if (tlc->tlc_max <= tcp_min_conn_listener) 5153 tlc->tlc_max = tcp_min_conn_listener; 5154 tlc->tlc_cnt = 1; 5155 tlc->tlc_drop = 0; 5156 tcp->tcp_listen_cnt = tlc; 5157 } 5158 } 5159 } 5160 return (error); 5161 } 5162