1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2010 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #include <sys/types.h> 29 #include <sys/stream.h> 30 #include <sys/strsun.h> 31 #include <sys/strsubr.h> 32 #include <sys/stropts.h> 33 #include <sys/strlog.h> 34 #define _SUN_TPI_VERSION 2 35 #include <sys/tihdr.h> 36 #include <sys/timod.h> 37 #include <sys/ddi.h> 38 #include <sys/sunddi.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/cmn_err.h> 42 #include <sys/debug.h> 43 #include <sys/sdt.h> 44 #include <sys/vtrace.h> 45 #include <sys/kmem.h> 46 #include <sys/ethernet.h> 47 #include <sys/cpuvar.h> 48 #include <sys/dlpi.h> 49 #include <sys/pattr.h> 50 #include <sys/policy.h> 51 #include <sys/priv.h> 52 #include <sys/zone.h> 53 #include <sys/sunldi.h> 54 55 #include <sys/errno.h> 56 #include <sys/signal.h> 57 #include <sys/socket.h> 58 #include <sys/socketvar.h> 59 #include <sys/sockio.h> 60 #include <sys/isa_defs.h> 61 #include <sys/md5.h> 62 #include <sys/random.h> 63 #include <sys/uio.h> 64 #include <sys/systm.h> 65 #include <netinet/in.h> 66 #include <netinet/tcp.h> 67 #include <netinet/ip6.h> 68 #include <netinet/icmp6.h> 69 #include <net/if.h> 70 #include <net/route.h> 71 #include <inet/ipsec_impl.h> 72 73 #include <inet/common.h> 74 #include <inet/ip.h> 75 #include <inet/ip_impl.h> 76 #include <inet/ip6.h> 77 #include <inet/ip_ndp.h> 78 #include <inet/proto_set.h> 79 #include <inet/mib2.h> 80 #include <inet/nd.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <inet/tcp_impl.h> 86 #include <inet/tcp_cluster.h> 87 #include <inet/udp_impl.h> 88 #include <net/pfkeyv2.h> 89 #include <inet/ipdrop.h> 90 91 #include <inet/ipclassifier.h> 92 #include <inet/ip_ire.h> 93 #include <inet/ip_ftable.h> 94 #include <inet/ip_if.h> 95 #include <inet/ipp_common.h> 96 #include <inet/ip_rts.h> 97 #include <inet/ip_netinfo.h> 98 #include <sys/squeue_impl.h> 99 #include <sys/squeue.h> 100 #include <inet/kssl/ksslapi.h> 101 #include <sys/tsol/label.h> 102 #include <sys/tsol/tnet.h> 103 #include <rpc/pmap_prot.h> 104 #include <sys/callo.h> 105 106 /* 107 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 108 * 109 * (Read the detailed design doc in PSARC case directory) 110 * 111 * The entire tcp state is contained in tcp_t and conn_t structure 112 * which are allocated in tandem using ipcl_conn_create() and passing 113 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect 114 * the references on the tcp_t. The tcp_t structure is never compressed 115 * and packets always land on the correct TCP perimeter from the time 116 * eager is created till the time tcp_t dies (as such the old mentat 117 * TCP global queue is not used for detached state and no IPSEC checking 118 * is required). The global queue is still allocated to send out resets 119 * for connection which have no listeners and IP directly calls 120 * tcp_xmit_listeners_reset() which does any policy check. 121 * 122 * Protection and Synchronisation mechanism: 123 * 124 * The tcp data structure does not use any kind of lock for protecting 125 * its state but instead uses 'squeues' for mutual exclusion from various 126 * read and write side threads. To access a tcp member, the thread should 127 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS, 128 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller 129 * can pass any tcp function having prototype of edesc_t as argument 130 * (different from traditional STREAMs model where packets come in only 131 * designated entry points). The list of functions that can be directly 132 * called via squeue are listed before the usual function prototype. 133 * 134 * Referencing: 135 * 136 * TCP is MT-Hot and we use a reference based scheme to make sure that the 137 * tcp structure doesn't disappear when its needed. When the application 138 * creates an outgoing connection or accepts an incoming connection, we 139 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 140 * The IP reference is just a symbolic reference since ip_tcpclose() 141 * looks at tcp structure after tcp_close_output() returns which could 142 * have dropped the last TCP reference. So as long as the connection is 143 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 144 * conn_t. The classifier puts its own reference when the connection is 145 * inserted in listen or connected hash. Anytime a thread needs to enter 146 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 147 * on write side or by doing a classify on read side and then puts a 148 * reference on the conn before doing squeue_enter/tryenter/fill. For 149 * read side, the classifier itself puts the reference under fanout lock 150 * to make sure that tcp can't disappear before it gets processed. The 151 * squeue will drop this reference automatically so the called function 152 * doesn't have to do a DEC_REF. 153 * 154 * Opening a new connection: 155 * 156 * The outgoing connection open is pretty simple. tcp_open() does the 157 * work in creating the conn/tcp structure and initializing it. The 158 * squeue assignment is done based on the CPU the application 159 * is running on. So for outbound connections, processing is always done 160 * on application CPU which might be different from the incoming CPU 161 * being interrupted by the NIC. An optimal way would be to figure out 162 * the NIC <-> CPU binding at listen time, and assign the outgoing 163 * connection to the squeue attached to the CPU that will be interrupted 164 * for incoming packets (we know the NIC based on the bind IP address). 165 * This might seem like a problem if more data is going out but the 166 * fact is that in most cases the transmit is ACK driven transmit where 167 * the outgoing data normally sits on TCP's xmit queue waiting to be 168 * transmitted. 169 * 170 * Accepting a connection: 171 * 172 * This is a more interesting case because of various races involved in 173 * establishing a eager in its own perimeter. Read the meta comment on 174 * top of tcp_input_listener(). But briefly, the squeue is picked by 175 * ip_fanout based on the ring or the sender (if loopback). 176 * 177 * Closing a connection: 178 * 179 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 180 * via squeue to do the close and mark the tcp as detached if the connection 181 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 182 * reference but tcp_close() drop IP's reference always. So if tcp was 183 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 184 * and 1 because it is in classifier's connected hash. This is the condition 185 * we use to determine that its OK to clean up the tcp outside of squeue 186 * when time wait expires (check the ref under fanout and conn_lock and 187 * if it is 2, remove it from fanout hash and kill it). 188 * 189 * Although close just drops the necessary references and marks the 190 * tcp_detached state, tcp_close needs to know the tcp_detached has been 191 * set (under squeue) before letting the STREAM go away (because a 192 * inbound packet might attempt to go up the STREAM while the close 193 * has happened and tcp_detached is not set). So a special lock and 194 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 195 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 196 * tcp_detached. 197 * 198 * Special provisions and fast paths: 199 * 200 * We make special provisions for sockfs by marking tcp_issocket 201 * whenever we have only sockfs on top of TCP. This allows us to skip 202 * putting the tcp in acceptor hash since a sockfs listener can never 203 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 204 * since eager has already been allocated and the accept now happens 205 * on acceptor STREAM. There is a big blob of comment on top of 206 * tcp_input_listener explaining the new accept. When socket is POP'd, 207 * sockfs sends us an ioctl to mark the fact and we go back to old 208 * behaviour. Once tcp_issocket is unset, its never set for the 209 * life of that connection. 210 * 211 * IPsec notes : 212 * 213 * Since a packet is always executed on the correct TCP perimeter 214 * all IPsec processing is defered to IP including checking new 215 * connections and setting IPSEC policies for new connection. The 216 * only exception is tcp_xmit_listeners_reset() which is called 217 * directly from IP and needs to policy check to see if TH_RST 218 * can be sent out. 219 */ 220 221 /* 222 * Values for squeue switch: 223 * 1: SQ_NODRAIN 224 * 2: SQ_PROCESS 225 * 3: SQ_FILL 226 */ 227 int tcp_squeue_wput = 2; /* /etc/systems */ 228 int tcp_squeue_flag; 229 230 kmem_cache_t *tcp_sack_info_cache; 231 232 /* 233 * To prevent memory hog, limit the number of entries in tcp_free_list 234 * to 1% of available memory / number of cpus 235 */ 236 uint_t tcp_free_list_max_cnt = 0; 237 238 #define TCP_XMIT_LOWATER 4096 239 #define TCP_XMIT_HIWATER 49152 240 #define TCP_RECV_LOWATER 2048 241 #define TCP_RECV_HIWATER 128000 242 243 #define TIDUSZ 4096 /* transport interface data unit size */ 244 245 /* 246 * Size of acceptor hash list. It has to be a power of 2 for hashing. 247 */ 248 #define TCP_ACCEPTOR_FANOUT_SIZE 256 249 250 #ifdef _ILP32 251 #define TCP_ACCEPTOR_HASH(accid) \ 252 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 253 #else 254 #define TCP_ACCEPTOR_HASH(accid) \ 255 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 256 #endif /* _ILP32 */ 257 258 /* Minimum number of connections per listener. */ 259 static uint32_t tcp_min_conn_listener = 2; 260 261 uint32_t tcp_early_abort = 30; 262 263 /* TCP Timer control structure */ 264 typedef struct tcpt_s { 265 pfv_t tcpt_pfv; /* The routine we are to call */ 266 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 267 } tcpt_t; 268 269 /* 270 * Functions called directly via squeue having a prototype of edesc_t. 271 */ 272 void tcp_input_listener(void *arg, mblk_t *mp, void *arg2, 273 ip_recv_attr_t *ira); 274 void tcp_input_data(void *arg, mblk_t *mp, void *arg2, 275 ip_recv_attr_t *ira); 276 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, 277 ip_recv_attr_t *dummy); 278 279 280 /* Prototype for TCP functions */ 281 static void tcp_random_init(void); 282 int tcp_random(void); 283 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, 284 in_port_t dstport, uint_t srcid); 285 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, 286 in_port_t dstport, uint32_t flowinfo, 287 uint_t srcid, uint32_t scope_id); 288 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 289 cred_t *cr); 290 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 291 char *value, caddr_t cp, cred_t *cr); 292 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 293 char *value, caddr_t cp, cred_t *cr); 294 static void tcp_iss_init(tcp_t *tcp); 295 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 296 static boolean_t tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, 297 tcp_stack_t *); 298 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 299 caddr_t cp, cred_t *cr); 300 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 301 caddr_t cp, cred_t *cr); 302 static void tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *); 303 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 304 caddr_t cp, cred_t *cr); 305 static void tcp_reinit(tcp_t *tcp); 306 static void tcp_reinit_values(tcp_t *tcp); 307 308 static void tcp_wsrv(queue_t *q); 309 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa); 310 static void tcp_update_zcopy(tcp_t *tcp); 311 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 312 ixa_notify_arg_t); 313 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); 314 static void tcp_stack_fini(netstackid_t stackid, void *arg); 315 316 static int tcp_squeue_switch(int); 317 318 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); 319 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); 320 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); 321 322 static void tcp_squeue_add(squeue_t *); 323 324 struct module_info tcp_rinfo = { 325 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 326 }; 327 328 static struct module_info tcp_winfo = { 329 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 330 }; 331 332 /* 333 * Entry points for TCP as a device. The normal case which supports 334 * the TCP functionality. 335 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. 336 */ 337 struct qinit tcp_rinitv4 = { 338 NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo 339 }; 340 341 struct qinit tcp_rinitv6 = { 342 NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo 343 }; 344 345 struct qinit tcp_winit = { 346 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 347 }; 348 349 /* Initial entry point for TCP in socket mode. */ 350 struct qinit tcp_sock_winit = { 351 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 352 }; 353 354 /* TCP entry point during fallback */ 355 struct qinit tcp_fallback_sock_winit = { 356 (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo 357 }; 358 359 /* 360 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 361 * an accept. Avoid allocating data structures since eager has already 362 * been created. 363 */ 364 struct qinit tcp_acceptor_rinit = { 365 NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo 366 }; 367 368 struct qinit tcp_acceptor_winit = { 369 (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo 370 }; 371 372 /* For AF_INET aka /dev/tcp */ 373 struct streamtab tcpinfov4 = { 374 &tcp_rinitv4, &tcp_winit 375 }; 376 377 /* For AF_INET6 aka /dev/tcp6 */ 378 struct streamtab tcpinfov6 = { 379 &tcp_rinitv6, &tcp_winit 380 }; 381 382 /* 383 * Following assumes TPI alignment requirements stay along 32 bit 384 * boundaries 385 */ 386 #define ROUNDUP32(x) \ 387 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 388 389 /* Template for response to info request. */ 390 struct T_info_ack tcp_g_t_info_ack = { 391 T_INFO_ACK, /* PRIM_type */ 392 0, /* TSDU_size */ 393 T_INFINITE, /* ETSDU_size */ 394 T_INVALID, /* CDATA_size */ 395 T_INVALID, /* DDATA_size */ 396 sizeof (sin_t), /* ADDR_size */ 397 0, /* OPT_size - not initialized here */ 398 TIDUSZ, /* TIDU_size */ 399 T_COTS_ORD, /* SERV_type */ 400 TCPS_IDLE, /* CURRENT_state */ 401 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 402 }; 403 404 struct T_info_ack tcp_g_t_info_ack_v6 = { 405 T_INFO_ACK, /* PRIM_type */ 406 0, /* TSDU_size */ 407 T_INFINITE, /* ETSDU_size */ 408 T_INVALID, /* CDATA_size */ 409 T_INVALID, /* DDATA_size */ 410 sizeof (sin6_t), /* ADDR_size */ 411 0, /* OPT_size - not initialized here */ 412 TIDUSZ, /* TIDU_size */ 413 T_COTS_ORD, /* SERV_type */ 414 TCPS_IDLE, /* CURRENT_state */ 415 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 416 }; 417 418 #define PARAM_MAX (~(uint32_t)0) 419 420 /* Max size IP datagram is 64k - 1 */ 421 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcpha_t))) 422 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcpha_t))) 423 /* Max of the above */ 424 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 425 426 /* Largest TCP port number */ 427 #define TCP_MAX_PORT (64 * 1024 - 1) 428 429 /* 430 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 431 * layer header. It has to be a multiple of 4. 432 */ 433 static tcpparam_t lcl_tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 434 435 #define MB (1024 * 1024) 436 437 /* 438 * All of these are alterable, within the min/max values given, at run time. 439 * Note that the default value of "tcp_time_wait_interval" is four minutes, 440 * per the TCP spec. 441 */ 442 /* BEGIN CSTYLED */ 443 static tcpparam_t lcl_tcp_param_arr[] = { 444 /*min max value name */ 445 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 446 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 447 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 448 { 1, 1024, 1, "tcp_conn_req_min" }, 449 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 450 { 128, (1<<30), 1*MB, "tcp_cwnd_max" }, 451 { 0, 10, 0, "tcp_debug" }, 452 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 453 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 454 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 455 { 500*MS, PARAM_MAX, 5*MINUTES, "tcp_ip_abort_interval"}, 456 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 457 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 458 { 1, 255, 64, "tcp_ipv4_ttl"}, 459 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 460 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 461 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 462 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 463 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 464 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 465 { 1*MS, 20*SECONDS, 1*SECONDS, "tcp_rexmit_interval_initial"}, 466 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 467 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 468 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 469 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 470 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 471 { 0, 1, 0, "tcp_ignore_path_mtu" }, 472 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 473 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 474 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 475 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 476 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 477 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 478 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 479 { 8192, (1<<30), 1*MB, "tcp_max_buf"}, 480 /* 481 * Question: What default value should I set for tcp_strong_iss? 482 */ 483 { 0, 2, 1, "tcp_strong_iss"}, 484 { 0, 65536, 20, "tcp_rtt_updates"}, 485 { 0, 1, 1, "tcp_wscale_always"}, 486 { 0, 1, 0, "tcp_tstamp_always"}, 487 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 488 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 489 { 0, 16, 2, "tcp_deferred_acks_max"}, 490 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 491 { 1, 4, 4, "tcp_slow_start_initial"}, 492 { 0, 2, 2, "tcp_sack_permitted"}, 493 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 494 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 495 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 496 { 0, 1, 0, "tcp_rev_src_routes"}, 497 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 498 { 0, 16, 8, "tcp_local_dacks_max"}, 499 { 0, 2, 1, "tcp_ecn_permitted"}, 500 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 501 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 502 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 503 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 504 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 505 { 0, 1, 0, "tcp_dev_flow_ctl"}, 506 { 0, PARAM_MAX, 100*SECONDS, "tcp_reass_timeout"} 507 }; 508 /* END CSTYLED */ 509 510 #define IS_VMLOANED_MBLK(mp) \ 511 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 512 513 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 514 515 /* 516 * Forces all connections to obey the value of the tcps_maxpsz_multiplier 517 * tunable settable via NDD. Otherwise, the per-connection behavior is 518 * determined dynamically during tcp_set_destination(), which is the default. 519 */ 520 boolean_t tcp_static_maxpsz = B_FALSE; 521 522 /* 523 * If the receive buffer size is changed, this function is called to update 524 * the upper socket layer on the new delayed receive wake up threshold. 525 */ 526 static void 527 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh) 528 { 529 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3; 530 531 if (IPCL_IS_NONSTR(tcp->tcp_connp)) { 532 conn_t *connp = tcp->tcp_connp; 533 struct sock_proto_props sopp; 534 535 /* 536 * only increase rcvthresh upto default_threshold 537 */ 538 if (new_rcvthresh > default_threshold) 539 new_rcvthresh = default_threshold; 540 541 sopp.sopp_flags = SOCKOPT_RCVTHRESH; 542 sopp.sopp_rcvthresh = new_rcvthresh; 543 544 (*connp->conn_upcalls->su_set_proto_props) 545 (connp->conn_upper_handle, &sopp); 546 } 547 } 548 549 /* 550 * Figure out the value of window scale opton. Note that the rwnd is 551 * ASSUMED to be rounded up to the nearest MSS before the calculation. 552 * We cannot find the scale value and then do a round up of tcp_rwnd 553 * because the scale value may not be correct after that. 554 * 555 * Set the compiler flag to make this function inline. 556 */ 557 void 558 tcp_set_ws_value(tcp_t *tcp) 559 { 560 int i; 561 uint32_t rwnd = tcp->tcp_rwnd; 562 563 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 564 i++, rwnd >>= 1) 565 ; 566 tcp->tcp_rcv_ws = i; 567 } 568 569 /* 570 * Remove cached/latched IPsec references. 571 */ 572 void 573 tcp_ipsec_cleanup(tcp_t *tcp) 574 { 575 conn_t *connp = tcp->tcp_connp; 576 577 ASSERT(connp->conn_flags & IPCL_TCPCONN); 578 579 if (connp->conn_latch != NULL) { 580 IPLATCH_REFRELE(connp->conn_latch); 581 connp->conn_latch = NULL; 582 } 583 if (connp->conn_latch_in_policy != NULL) { 584 IPPOL_REFRELE(connp->conn_latch_in_policy); 585 connp->conn_latch_in_policy = NULL; 586 } 587 if (connp->conn_latch_in_action != NULL) { 588 IPACT_REFRELE(connp->conn_latch_in_action); 589 connp->conn_latch_in_action = NULL; 590 } 591 if (connp->conn_policy != NULL) { 592 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 593 connp->conn_policy = NULL; 594 } 595 } 596 597 /* 598 * Cleaup before placing on free list. 599 * Disassociate from the netstack/tcp_stack_t since the freelist 600 * is per squeue and not per netstack. 601 */ 602 void 603 tcp_cleanup(tcp_t *tcp) 604 { 605 mblk_t *mp; 606 tcp_sack_info_t *tcp_sack_info; 607 conn_t *connp = tcp->tcp_connp; 608 tcp_stack_t *tcps = tcp->tcp_tcps; 609 netstack_t *ns = tcps->tcps_netstack; 610 mblk_t *tcp_rsrv_mp; 611 612 tcp_bind_hash_remove(tcp); 613 614 /* Cleanup that which needs the netstack first */ 615 tcp_ipsec_cleanup(tcp); 616 ixa_cleanup(connp->conn_ixa); 617 618 if (connp->conn_ht_iphc != NULL) { 619 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 620 connp->conn_ht_iphc = NULL; 621 connp->conn_ht_iphc_allocated = 0; 622 connp->conn_ht_iphc_len = 0; 623 connp->conn_ht_ulp = NULL; 624 connp->conn_ht_ulp_len = 0; 625 tcp->tcp_ipha = NULL; 626 tcp->tcp_ip6h = NULL; 627 tcp->tcp_tcpha = NULL; 628 } 629 630 /* We clear any IP_OPTIONS and extension headers */ 631 ip_pkt_free(&connp->conn_xmit_ipp); 632 633 tcp_free(tcp); 634 635 /* Release any SSL context */ 636 if (tcp->tcp_kssl_ent != NULL) { 637 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 638 tcp->tcp_kssl_ent = NULL; 639 } 640 641 if (tcp->tcp_kssl_ctx != NULL) { 642 kssl_release_ctx(tcp->tcp_kssl_ctx); 643 tcp->tcp_kssl_ctx = NULL; 644 } 645 tcp->tcp_kssl_pending = B_FALSE; 646 647 /* 648 * Since we will bzero the entire structure, we need to 649 * remove it and reinsert it in global hash list. We 650 * know the walkers can't get to this conn because we 651 * had set CONDEMNED flag earlier and checked reference 652 * under conn_lock so walker won't pick it and when we 653 * go the ipcl_globalhash_remove() below, no walker 654 * can get to it. 655 */ 656 ipcl_globalhash_remove(connp); 657 658 /* Save some state */ 659 mp = tcp->tcp_timercache; 660 661 tcp_sack_info = tcp->tcp_sack_info; 662 tcp_rsrv_mp = tcp->tcp_rsrv_mp; 663 664 if (connp->conn_cred != NULL) { 665 crfree(connp->conn_cred); 666 connp->conn_cred = NULL; 667 } 668 ipcl_conn_cleanup(connp); 669 connp->conn_flags = IPCL_TCPCONN; 670 671 /* 672 * Now it is safe to decrement the reference counts. 673 * This might be the last reference on the netstack 674 * in which case it will cause the freeing of the IP Instance. 675 */ 676 connp->conn_netstack = NULL; 677 connp->conn_ixa->ixa_ipst = NULL; 678 netstack_rele(ns); 679 ASSERT(tcps != NULL); 680 tcp->tcp_tcps = NULL; 681 682 bzero(tcp, sizeof (tcp_t)); 683 684 /* restore the state */ 685 tcp->tcp_timercache = mp; 686 687 tcp->tcp_sack_info = tcp_sack_info; 688 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 689 690 tcp->tcp_connp = connp; 691 692 ASSERT(connp->conn_tcp == tcp); 693 ASSERT(connp->conn_flags & IPCL_TCPCONN); 694 connp->conn_state_flags = CONN_INCIPIENT; 695 ASSERT(connp->conn_proto == IPPROTO_TCP); 696 ASSERT(connp->conn_ref == 1); 697 } 698 699 /* 700 * Adapt to the information, such as rtt and rtt_sd, provided from the 701 * DCE and IRE maintained by IP. 702 * 703 * Checks for multicast and broadcast destination address. 704 * Returns zero if ok; an errno on failure. 705 * 706 * Note that the MSS calculation here is based on the info given in 707 * the DCE and IRE. We do not do any calculation based on TCP options. They 708 * will be handled in tcp_input_data() when TCP knows which options to use. 709 * 710 * Note on how TCP gets its parameters for a connection. 711 * 712 * When a tcp_t structure is allocated, it gets all the default parameters. 713 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd, 714 * spipe, rpipe, ... from the route metrics. Route metric overrides the 715 * default. 716 * 717 * An incoming SYN with a multicast or broadcast destination address is dropped 718 * in ip_fanout_v4/v6. 719 * 720 * An incoming SYN with a multicast or broadcast source address is always 721 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in 722 * conn_connect. 723 * The same logic in tcp_set_destination also serves to 724 * reject an attempt to connect to a broadcast or multicast (destination) 725 * address. 726 */ 727 int 728 tcp_set_destination(tcp_t *tcp) 729 { 730 uint32_t mss_max; 731 uint32_t mss; 732 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 733 conn_t *connp = tcp->tcp_connp; 734 tcp_stack_t *tcps = tcp->tcp_tcps; 735 iulp_t uinfo; 736 int error; 737 uint32_t flags; 738 739 flags = IPDF_LSO | IPDF_ZCOPY; 740 /* 741 * Make sure we have a dce for the destination to avoid dce_ident 742 * contention for connected sockets. 743 */ 744 flags |= IPDF_UNIQUE_DCE; 745 746 if (!tcps->tcps_ignore_path_mtu) 747 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 748 749 /* Use conn_lock to satify ASSERT; tcp is already serialized */ 750 mutex_enter(&connp->conn_lock); 751 error = conn_connect(connp, &uinfo, flags); 752 mutex_exit(&connp->conn_lock); 753 if (error != 0) 754 return (error); 755 756 error = tcp_build_hdrs(tcp); 757 if (error != 0) 758 return (error); 759 760 tcp->tcp_localnet = uinfo.iulp_localnet; 761 762 if (uinfo.iulp_rtt != 0) { 763 clock_t rto; 764 765 tcp->tcp_rtt_sa = uinfo.iulp_rtt; 766 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd; 767 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 768 tcps->tcps_rexmit_interval_extra + 769 (tcp->tcp_rtt_sa >> 5); 770 771 if (rto > tcps->tcps_rexmit_interval_max) { 772 tcp->tcp_rto = tcps->tcps_rexmit_interval_max; 773 } else if (rto < tcps->tcps_rexmit_interval_min) { 774 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 775 } else { 776 tcp->tcp_rto = rto; 777 } 778 } 779 if (uinfo.iulp_ssthresh != 0) 780 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh; 781 else 782 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 783 if (uinfo.iulp_spipe > 0) { 784 connp->conn_sndbuf = MIN(uinfo.iulp_spipe, 785 tcps->tcps_max_buf); 786 if (tcps->tcps_snd_lowat_fraction != 0) { 787 connp->conn_sndlowat = connp->conn_sndbuf / 788 tcps->tcps_snd_lowat_fraction; 789 } 790 (void) tcp_maxpsz_set(tcp, B_TRUE); 791 } 792 /* 793 * Note that up till now, acceptor always inherits receive 794 * window from the listener. But if there is a metrics 795 * associated with a host, we should use that instead of 796 * inheriting it from listener. Thus we need to pass this 797 * info back to the caller. 798 */ 799 if (uinfo.iulp_rpipe > 0) { 800 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe, 801 tcps->tcps_max_buf); 802 } 803 804 if (uinfo.iulp_rtomax > 0) { 805 tcp->tcp_second_timer_threshold = 806 uinfo.iulp_rtomax; 807 } 808 809 /* 810 * Use the metric option settings, iulp_tstamp_ok and 811 * iulp_wscale_ok, only for active open. What this means 812 * is that if the other side uses timestamp or window 813 * scale option, TCP will also use those options. That 814 * is for passive open. If the application sets a 815 * large window, window scale is enabled regardless of 816 * the value in iulp_wscale_ok. This is the behavior 817 * since 2.6. So we keep it. 818 * The only case left in passive open processing is the 819 * check for SACK. 820 * For ECN, it should probably be like SACK. But the 821 * current value is binary, so we treat it like the other 822 * cases. The metric only controls active open.For passive 823 * open, the ndd param, tcp_ecn_permitted, controls the 824 * behavior. 825 */ 826 if (!tcp_detached) { 827 /* 828 * The if check means that the following can only 829 * be turned on by the metrics only IRE, but not off. 830 */ 831 if (uinfo.iulp_tstamp_ok) 832 tcp->tcp_snd_ts_ok = B_TRUE; 833 if (uinfo.iulp_wscale_ok) 834 tcp->tcp_snd_ws_ok = B_TRUE; 835 if (uinfo.iulp_sack == 2) 836 tcp->tcp_snd_sack_ok = B_TRUE; 837 if (uinfo.iulp_ecn_ok) 838 tcp->tcp_ecn_ok = B_TRUE; 839 } else { 840 /* 841 * Passive open. 842 * 843 * As above, the if check means that SACK can only be 844 * turned on by the metric only IRE. 845 */ 846 if (uinfo.iulp_sack > 0) { 847 tcp->tcp_snd_sack_ok = B_TRUE; 848 } 849 } 850 851 /* 852 * XXX Note that currently, iulp_mtu can be as small as 68 853 * because of PMTUd. So tcp_mss may go to negative if combined 854 * length of all those options exceeds 28 bytes. But because 855 * of the tcp_mss_min check below, we may not have a problem if 856 * tcp_mss_min is of a reasonable value. The default is 1 so 857 * the negative problem still exists. And the check defeats PMTUd. 858 * In fact, if PMTUd finds that the MSS should be smaller than 859 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 860 * value. 861 * 862 * We do not deal with that now. All those problems related to 863 * PMTUd will be fixed later. 864 */ 865 ASSERT(uinfo.iulp_mtu != 0); 866 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu; 867 868 /* Sanity check for MSS value. */ 869 if (connp->conn_ipversion == IPV4_VERSION) 870 mss_max = tcps->tcps_mss_max_ipv4; 871 else 872 mss_max = tcps->tcps_mss_max_ipv6; 873 874 if (tcp->tcp_ipsec_overhead == 0) 875 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 876 877 mss -= tcp->tcp_ipsec_overhead; 878 879 if (mss < tcps->tcps_mss_min) 880 mss = tcps->tcps_mss_min; 881 if (mss > mss_max) 882 mss = mss_max; 883 884 /* Note that this is the maximum MSS, excluding all options. */ 885 tcp->tcp_mss = mss; 886 887 /* 888 * Update the tcp connection with LSO capability. 889 */ 890 tcp_update_lso(tcp, connp->conn_ixa); 891 892 /* 893 * Initialize the ISS here now that we have the full connection ID. 894 * The RFC 1948 method of initial sequence number generation requires 895 * knowledge of the full connection ID before setting the ISS. 896 */ 897 tcp_iss_init(tcp); 898 899 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local); 900 901 /* 902 * Make sure that conn is not marked incipient 903 * for incoming connections. A blind 904 * removal of incipient flag is cheaper than 905 * check and removal. 906 */ 907 mutex_enter(&connp->conn_lock); 908 connp->conn_state_flags &= ~CONN_INCIPIENT; 909 mutex_exit(&connp->conn_lock); 910 return (0); 911 } 912 913 /* 914 * tcp_clean_death / tcp_close_detached must not be called more than once 915 * on a tcp. Thus every function that potentially calls tcp_clean_death 916 * must check for the tcp state before calling tcp_clean_death. 917 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper, 918 * tcp_timer_handler, all check for the tcp state. 919 */ 920 /* ARGSUSED */ 921 void 922 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 923 ip_recv_attr_t *dummy) 924 { 925 tcp_t *tcp = ((conn_t *)arg)->conn_tcp; 926 927 freemsg(mp); 928 if (tcp->tcp_state > TCPS_BOUND) 929 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT); 930 } 931 932 /* 933 * We are dying for some reason. Try to do it gracefully. (May be called 934 * as writer.) 935 * 936 * Return -1 if the structure was not cleaned up (if the cleanup had to be 937 * done by a service procedure). 938 * TBD - Should the return value distinguish between the tcp_t being 939 * freed and it being reinitialized? 940 */ 941 int 942 tcp_clean_death(tcp_t *tcp, int err) 943 { 944 mblk_t *mp; 945 queue_t *q; 946 conn_t *connp = tcp->tcp_connp; 947 tcp_stack_t *tcps = tcp->tcp_tcps; 948 949 if (tcp->tcp_fused) 950 tcp_unfuse(tcp); 951 952 if (tcp->tcp_linger_tid != 0 && 953 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 954 tcp_stop_lingering(tcp); 955 } 956 957 ASSERT(tcp != NULL); 958 ASSERT((connp->conn_family == AF_INET && 959 connp->conn_ipversion == IPV4_VERSION) || 960 (connp->conn_family == AF_INET6 && 961 (connp->conn_ipversion == IPV4_VERSION || 962 connp->conn_ipversion == IPV6_VERSION))); 963 964 if (TCP_IS_DETACHED(tcp)) { 965 if (tcp->tcp_hard_binding) { 966 /* 967 * Its an eager that we are dealing with. We close the 968 * eager but in case a conn_ind has already gone to the 969 * listener, let tcp_accept_finish() send a discon_ind 970 * to the listener and drop the last reference. If the 971 * listener doesn't even know about the eager i.e. the 972 * conn_ind hasn't gone up, blow away the eager and drop 973 * the last reference as well. If the conn_ind has gone 974 * up, state should be BOUND. tcp_accept_finish 975 * will figure out that the connection has received a 976 * RST and will send a DISCON_IND to the application. 977 */ 978 tcp_closei_local(tcp); 979 if (!tcp->tcp_tconnind_started) { 980 CONN_DEC_REF(connp); 981 } else { 982 tcp->tcp_state = TCPS_BOUND; 983 } 984 } else { 985 tcp_close_detached(tcp); 986 } 987 return (0); 988 } 989 990 TCP_STAT(tcps, tcp_clean_death_nondetached); 991 992 /* 993 * The connection is dead. Decrement listener connection counter if 994 * necessary. 995 */ 996 if (tcp->tcp_listen_cnt != NULL) 997 TCP_DECR_LISTEN_CNT(tcp); 998 999 /* 1000 * When a connection is moved to TIME_WAIT state, the connection 1001 * counter is already decremented. So no need to decrement here 1002 * again. See SET_TIME_WAIT() macro. 1003 */ 1004 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1005 tcp->tcp_state < TCPS_TIME_WAIT) { 1006 TCPS_CONN_DEC(tcps); 1007 } 1008 1009 q = connp->conn_rq; 1010 1011 /* Trash all inbound data */ 1012 if (!IPCL_IS_NONSTR(connp)) { 1013 ASSERT(q != NULL); 1014 flushq(q, FLUSHALL); 1015 } 1016 1017 /* 1018 * If we are at least part way open and there is error 1019 * (err==0 implies no error) 1020 * notify our client by a T_DISCON_IND. 1021 */ 1022 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 1023 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1024 !TCP_IS_SOCKET(tcp)) { 1025 /* 1026 * Send M_FLUSH according to TPI. Because sockets will 1027 * (and must) ignore FLUSHR we do that only for TPI 1028 * endpoints and sockets in STREAMS mode. 1029 */ 1030 (void) putnextctl1(q, M_FLUSH, FLUSHR); 1031 } 1032 if (connp->conn_debug) { 1033 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 1034 "tcp_clean_death: discon err %d", err); 1035 } 1036 if (IPCL_IS_NONSTR(connp)) { 1037 /* Direct socket, use upcall */ 1038 (*connp->conn_upcalls->su_disconnected)( 1039 connp->conn_upper_handle, tcp->tcp_connid, err); 1040 } else { 1041 mp = mi_tpi_discon_ind(NULL, err, 0); 1042 if (mp != NULL) { 1043 putnext(q, mp); 1044 } else { 1045 if (connp->conn_debug) { 1046 (void) strlog(TCP_MOD_ID, 0, 1, 1047 SL_ERROR|SL_TRACE, 1048 "tcp_clean_death, sending M_ERROR"); 1049 } 1050 (void) putnextctl1(q, M_ERROR, EPROTO); 1051 } 1052 } 1053 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 1054 /* SYN_SENT or SYN_RCVD */ 1055 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1056 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 1057 /* ESTABLISHED or CLOSE_WAIT */ 1058 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1059 } 1060 } 1061 1062 tcp_reinit(tcp); 1063 if (IPCL_IS_NONSTR(connp)) 1064 (void) tcp_do_unbind(connp); 1065 1066 return (-1); 1067 } 1068 1069 /* 1070 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 1071 * to expire, stop the wait and finish the close. 1072 */ 1073 void 1074 tcp_stop_lingering(tcp_t *tcp) 1075 { 1076 clock_t delta = 0; 1077 tcp_stack_t *tcps = tcp->tcp_tcps; 1078 conn_t *connp = tcp->tcp_connp; 1079 1080 tcp->tcp_linger_tid = 0; 1081 if (tcp->tcp_state > TCPS_LISTEN) { 1082 tcp_acceptor_hash_remove(tcp); 1083 mutex_enter(&tcp->tcp_non_sq_lock); 1084 if (tcp->tcp_flow_stopped) { 1085 tcp_clrqfull(tcp); 1086 } 1087 mutex_exit(&tcp->tcp_non_sq_lock); 1088 1089 if (tcp->tcp_timer_tid != 0) { 1090 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 1091 tcp->tcp_timer_tid = 0; 1092 } 1093 /* 1094 * Need to cancel those timers which will not be used when 1095 * TCP is detached. This has to be done before the conn_wq 1096 * is cleared. 1097 */ 1098 tcp_timers_stop(tcp); 1099 1100 tcp->tcp_detached = B_TRUE; 1101 connp->conn_rq = NULL; 1102 connp->conn_wq = NULL; 1103 1104 if (tcp->tcp_state == TCPS_TIME_WAIT) { 1105 tcp_time_wait_append(tcp); 1106 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 1107 goto finish; 1108 } 1109 1110 /* 1111 * If delta is zero the timer event wasn't executed and was 1112 * successfully canceled. In this case we need to restart it 1113 * with the minimal delta possible. 1114 */ 1115 if (delta >= 0) { 1116 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 1117 delta ? delta : 1); 1118 } 1119 } else { 1120 tcp_closei_local(tcp); 1121 CONN_DEC_REF(connp); 1122 } 1123 finish: 1124 /* Signal closing thread that it can complete close */ 1125 mutex_enter(&tcp->tcp_closelock); 1126 tcp->tcp_detached = B_TRUE; 1127 connp->conn_rq = NULL; 1128 connp->conn_wq = NULL; 1129 1130 tcp->tcp_closed = 1; 1131 cv_signal(&tcp->tcp_closecv); 1132 mutex_exit(&tcp->tcp_closelock); 1133 } 1134 1135 void 1136 tcp_close_common(conn_t *connp, int flags) 1137 { 1138 tcp_t *tcp = connp->conn_tcp; 1139 mblk_t *mp = &tcp->tcp_closemp; 1140 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 1141 mblk_t *bp; 1142 1143 ASSERT(connp->conn_ref >= 2); 1144 1145 /* 1146 * Mark the conn as closing. ipsq_pending_mp_add will not 1147 * add any mp to the pending mp list, after this conn has 1148 * started closing. 1149 */ 1150 mutex_enter(&connp->conn_lock); 1151 connp->conn_state_flags |= CONN_CLOSING; 1152 if (connp->conn_oper_pending_ill != NULL) 1153 conn_ioctl_cleanup_reqd = B_TRUE; 1154 CONN_INC_REF_LOCKED(connp); 1155 mutex_exit(&connp->conn_lock); 1156 tcp->tcp_closeflags = (uint8_t)flags; 1157 ASSERT(connp->conn_ref >= 3); 1158 1159 /* 1160 * tcp_closemp_used is used below without any protection of a lock 1161 * as we don't expect any one else to use it concurrently at this 1162 * point otherwise it would be a major defect. 1163 */ 1164 1165 if (mp->b_prev == NULL) 1166 tcp->tcp_closemp_used = B_TRUE; 1167 else 1168 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " 1169 "connp %p tcp %p\n", (void *)connp, (void *)tcp); 1170 1171 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1172 1173 /* 1174 * Cleanup any queued ioctls here. This must be done before the wq/rq 1175 * are re-written by tcp_close_output(). 1176 */ 1177 if (conn_ioctl_cleanup_reqd) 1178 conn_ioctl_cleanup(connp); 1179 1180 /* 1181 * As CONN_CLOSING is set, no further ioctls should be passed down to 1182 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and 1183 * tcp_wput_iocdata). If the ioctl was queued on an ipsq, 1184 * conn_ioctl_cleanup should have found it and removed it. If the ioctl 1185 * was still in flight at the time, we wait for it here. See comments 1186 * for CONN_INC_IOCTLREF in ip.h for details. 1187 */ 1188 mutex_enter(&connp->conn_lock); 1189 while (connp->conn_ioctlref > 0) 1190 cv_wait(&connp->conn_cv, &connp->conn_lock); 1191 ASSERT(connp->conn_ioctlref == 0); 1192 ASSERT(connp->conn_oper_pending_ill == NULL); 1193 mutex_exit(&connp->conn_lock); 1194 1195 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp, 1196 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1197 1198 mutex_enter(&tcp->tcp_closelock); 1199 while (!tcp->tcp_closed) { 1200 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 1201 /* 1202 * The cv_wait_sig() was interrupted. We now do the 1203 * following: 1204 * 1205 * 1) If the endpoint was lingering, we allow this 1206 * to be interrupted by cancelling the linger timeout 1207 * and closing normally. 1208 * 1209 * 2) Revert to calling cv_wait() 1210 * 1211 * We revert to using cv_wait() to avoid an 1212 * infinite loop which can occur if the calling 1213 * thread is higher priority than the squeue worker 1214 * thread and is bound to the same cpu. 1215 */ 1216 if (connp->conn_linger && connp->conn_lingertime > 0) { 1217 mutex_exit(&tcp->tcp_closelock); 1218 /* Entering squeue, bump ref count. */ 1219 CONN_INC_REF(connp); 1220 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 1221 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, 1222 tcp_linger_interrupted, connp, NULL, 1223 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1224 mutex_enter(&tcp->tcp_closelock); 1225 } 1226 break; 1227 } 1228 } 1229 while (!tcp->tcp_closed) 1230 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 1231 mutex_exit(&tcp->tcp_closelock); 1232 1233 /* 1234 * In the case of listener streams that have eagers in the q or q0 1235 * we wait for the eagers to drop their reference to us. conn_rq and 1236 * conn_wq of the eagers point to our queues. By waiting for the 1237 * refcnt to drop to 1, we are sure that the eagers have cleaned 1238 * up their queue pointers and also dropped their references to us. 1239 */ 1240 if (tcp->tcp_wait_for_eagers) { 1241 mutex_enter(&connp->conn_lock); 1242 while (connp->conn_ref != 1) { 1243 cv_wait(&connp->conn_cv, &connp->conn_lock); 1244 } 1245 mutex_exit(&connp->conn_lock); 1246 } 1247 1248 connp->conn_cpid = NOPID; 1249 } 1250 1251 /* 1252 * Called by tcp_close() routine via squeue when lingering is 1253 * interrupted by a signal. 1254 */ 1255 1256 /* ARGSUSED */ 1257 static void 1258 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 1259 { 1260 conn_t *connp = (conn_t *)arg; 1261 tcp_t *tcp = connp->conn_tcp; 1262 1263 freeb(mp); 1264 if (tcp->tcp_linger_tid != 0 && 1265 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 1266 tcp_stop_lingering(tcp); 1267 tcp->tcp_client_errno = EINTR; 1268 } 1269 } 1270 1271 /* 1272 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 1273 * Some stream heads get upset if they see these later on as anything but NULL. 1274 */ 1275 void 1276 tcp_close_mpp(mblk_t **mpp) 1277 { 1278 mblk_t *mp; 1279 1280 if ((mp = *mpp) != NULL) { 1281 do { 1282 mp->b_next = NULL; 1283 mp->b_prev = NULL; 1284 } while ((mp = mp->b_cont) != NULL); 1285 1286 mp = *mpp; 1287 *mpp = NULL; 1288 freemsg(mp); 1289 } 1290 } 1291 1292 /* Do detached close. */ 1293 void 1294 tcp_close_detached(tcp_t *tcp) 1295 { 1296 if (tcp->tcp_fused) 1297 tcp_unfuse(tcp); 1298 1299 /* 1300 * Clustering code serializes TCP disconnect callbacks and 1301 * cluster tcp list walks by blocking a TCP disconnect callback 1302 * if a cluster tcp list walk is in progress. This ensures 1303 * accurate accounting of TCPs in the cluster code even though 1304 * the TCP list walk itself is not atomic. 1305 */ 1306 tcp_closei_local(tcp); 1307 CONN_DEC_REF(tcp->tcp_connp); 1308 } 1309 1310 /* 1311 * The tcp_t is going away. Remove it from all lists and set it 1312 * to TCPS_CLOSED. The freeing up of memory is deferred until 1313 * tcp_inactive. This is needed since a thread in tcp_rput might have 1314 * done a CONN_INC_REF on this structure before it was removed from the 1315 * hashes. 1316 */ 1317 void 1318 tcp_closei_local(tcp_t *tcp) 1319 { 1320 conn_t *connp = tcp->tcp_connp; 1321 tcp_stack_t *tcps = tcp->tcp_tcps; 1322 1323 if (!TCP_IS_SOCKET(tcp)) 1324 tcp_acceptor_hash_remove(tcp); 1325 1326 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 1327 tcp->tcp_ibsegs = 0; 1328 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 1329 tcp->tcp_obsegs = 0; 1330 1331 /* 1332 * This can be called via tcp_time_wait_processing() if TCP gets a 1333 * SYN with sequence number outside the TIME-WAIT connection's 1334 * window. So we need to check for TIME-WAIT state here as the 1335 * connection counter is already decremented. See SET_TIME_WAIT() 1336 * macro 1337 */ 1338 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1339 tcp->tcp_state < TCPS_TIME_WAIT) { 1340 TCPS_CONN_DEC(tcps); 1341 } 1342 1343 /* 1344 * If we are an eager connection hanging off a listener that 1345 * hasn't formally accepted the connection yet, get off his 1346 * list and blow off any data that we have accumulated. 1347 */ 1348 if (tcp->tcp_listener != NULL) { 1349 tcp_t *listener = tcp->tcp_listener; 1350 mutex_enter(&listener->tcp_eager_lock); 1351 /* 1352 * tcp_tconnind_started == B_TRUE means that the 1353 * conn_ind has already gone to listener. At 1354 * this point, eager will be closed but we 1355 * leave it in listeners eager list so that 1356 * if listener decides to close without doing 1357 * accept, we can clean this up. In tcp_tli_accept 1358 * we take care of the case of accept on closed 1359 * eager. 1360 */ 1361 if (!tcp->tcp_tconnind_started) { 1362 tcp_eager_unlink(tcp); 1363 mutex_exit(&listener->tcp_eager_lock); 1364 /* 1365 * We don't want to have any pointers to the 1366 * listener queue, after we have released our 1367 * reference on the listener 1368 */ 1369 ASSERT(tcp->tcp_detached); 1370 connp->conn_rq = NULL; 1371 connp->conn_wq = NULL; 1372 CONN_DEC_REF(listener->tcp_connp); 1373 } else { 1374 mutex_exit(&listener->tcp_eager_lock); 1375 } 1376 } 1377 1378 /* Stop all the timers */ 1379 tcp_timers_stop(tcp); 1380 1381 if (tcp->tcp_state == TCPS_LISTEN) { 1382 if (tcp->tcp_ip_addr_cache) { 1383 kmem_free((void *)tcp->tcp_ip_addr_cache, 1384 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1385 tcp->tcp_ip_addr_cache = NULL; 1386 } 1387 } 1388 1389 /* Decrement listerner connection counter if necessary. */ 1390 if (tcp->tcp_listen_cnt != NULL) 1391 TCP_DECR_LISTEN_CNT(tcp); 1392 1393 mutex_enter(&tcp->tcp_non_sq_lock); 1394 if (tcp->tcp_flow_stopped) 1395 tcp_clrqfull(tcp); 1396 mutex_exit(&tcp->tcp_non_sq_lock); 1397 1398 tcp_bind_hash_remove(tcp); 1399 /* 1400 * If the tcp_time_wait_collector (which runs outside the squeue) 1401 * is trying to remove this tcp from the time wait list, we will 1402 * block in tcp_time_wait_remove while trying to acquire the 1403 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 1404 * requires the ipcl_hash_remove to be ordered after the 1405 * tcp_time_wait_remove for the refcnt checks to work correctly. 1406 */ 1407 if (tcp->tcp_state == TCPS_TIME_WAIT) 1408 (void) tcp_time_wait_remove(tcp, NULL); 1409 CL_INET_DISCONNECT(connp); 1410 ipcl_hash_remove(connp); 1411 ixa_cleanup(connp->conn_ixa); 1412 1413 /* 1414 * Mark the conn as CONDEMNED 1415 */ 1416 mutex_enter(&connp->conn_lock); 1417 connp->conn_state_flags |= CONN_CONDEMNED; 1418 mutex_exit(&connp->conn_lock); 1419 1420 ASSERT(tcp->tcp_time_wait_next == NULL); 1421 ASSERT(tcp->tcp_time_wait_prev == NULL); 1422 ASSERT(tcp->tcp_time_wait_expire == 0); 1423 tcp->tcp_state = TCPS_CLOSED; 1424 1425 /* Release any SSL context */ 1426 if (tcp->tcp_kssl_ent != NULL) { 1427 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 1428 tcp->tcp_kssl_ent = NULL; 1429 } 1430 if (tcp->tcp_kssl_ctx != NULL) { 1431 kssl_release_ctx(tcp->tcp_kssl_ctx); 1432 tcp->tcp_kssl_ctx = NULL; 1433 } 1434 tcp->tcp_kssl_pending = B_FALSE; 1435 1436 tcp_ipsec_cleanup(tcp); 1437 } 1438 1439 /* 1440 * tcp is dying (called from ipcl_conn_destroy and error cases). 1441 * Free the tcp_t in either case. 1442 */ 1443 void 1444 tcp_free(tcp_t *tcp) 1445 { 1446 mblk_t *mp; 1447 conn_t *connp = tcp->tcp_connp; 1448 1449 ASSERT(tcp != NULL); 1450 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 1451 1452 connp->conn_rq = NULL; 1453 connp->conn_wq = NULL; 1454 1455 tcp_close_mpp(&tcp->tcp_xmit_head); 1456 tcp_close_mpp(&tcp->tcp_reass_head); 1457 if (tcp->tcp_rcv_list != NULL) { 1458 /* Free b_next chain */ 1459 tcp_close_mpp(&tcp->tcp_rcv_list); 1460 } 1461 if ((mp = tcp->tcp_urp_mp) != NULL) { 1462 freemsg(mp); 1463 } 1464 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1465 freemsg(mp); 1466 } 1467 1468 if (tcp->tcp_fused_sigurg_mp != NULL) { 1469 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1470 freeb(tcp->tcp_fused_sigurg_mp); 1471 tcp->tcp_fused_sigurg_mp = NULL; 1472 } 1473 1474 if (tcp->tcp_ordrel_mp != NULL) { 1475 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1476 freeb(tcp->tcp_ordrel_mp); 1477 tcp->tcp_ordrel_mp = NULL; 1478 } 1479 1480 if (tcp->tcp_sack_info != NULL) { 1481 if (tcp->tcp_notsack_list != NULL) { 1482 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 1483 tcp); 1484 } 1485 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 1486 } 1487 1488 if (tcp->tcp_hopopts != NULL) { 1489 mi_free(tcp->tcp_hopopts); 1490 tcp->tcp_hopopts = NULL; 1491 tcp->tcp_hopoptslen = 0; 1492 } 1493 ASSERT(tcp->tcp_hopoptslen == 0); 1494 if (tcp->tcp_dstopts != NULL) { 1495 mi_free(tcp->tcp_dstopts); 1496 tcp->tcp_dstopts = NULL; 1497 tcp->tcp_dstoptslen = 0; 1498 } 1499 ASSERT(tcp->tcp_dstoptslen == 0); 1500 if (tcp->tcp_rthdrdstopts != NULL) { 1501 mi_free(tcp->tcp_rthdrdstopts); 1502 tcp->tcp_rthdrdstopts = NULL; 1503 tcp->tcp_rthdrdstoptslen = 0; 1504 } 1505 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 1506 if (tcp->tcp_rthdr != NULL) { 1507 mi_free(tcp->tcp_rthdr); 1508 tcp->tcp_rthdr = NULL; 1509 tcp->tcp_rthdrlen = 0; 1510 } 1511 ASSERT(tcp->tcp_rthdrlen == 0); 1512 1513 /* 1514 * Following is really a blowing away a union. 1515 * It happens to have exactly two members of identical size 1516 * the following code is enough. 1517 */ 1518 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1519 } 1520 1521 /* 1522 * tcp_get_conn/tcp_free_conn 1523 * 1524 * tcp_get_conn is used to get a clean tcp connection structure. 1525 * It tries to reuse the connections put on the freelist by the 1526 * time_wait_collector failing which it goes to kmem_cache. This 1527 * way has two benefits compared to just allocating from and 1528 * freeing to kmem_cache. 1529 * 1) The time_wait_collector can free (which includes the cleanup) 1530 * outside the squeue. So when the interrupt comes, we have a clean 1531 * connection sitting in the freelist. Obviously, this buys us 1532 * performance. 1533 * 1534 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener 1535 * has multiple disadvantages - tying up the squeue during alloc. 1536 * But allocating the conn/tcp in IP land is also not the best since 1537 * we can't check the 'q' and 'q0' which are protected by squeue and 1538 * blindly allocate memory which might have to be freed here if we are 1539 * not allowed to accept the connection. By using the freelist and 1540 * putting the conn/tcp back in freelist, we don't pay a penalty for 1541 * allocating memory without checking 'q/q0' and freeing it if we can't 1542 * accept the connection. 1543 * 1544 * Care should be taken to put the conn back in the same squeue's freelist 1545 * from which it was allocated. Best results are obtained if conn is 1546 * allocated from listener's squeue and freed to the same. Time wait 1547 * collector will free up the freelist is the connection ends up sitting 1548 * there for too long. 1549 */ 1550 void * 1551 tcp_get_conn(void *arg, tcp_stack_t *tcps) 1552 { 1553 tcp_t *tcp = NULL; 1554 conn_t *connp = NULL; 1555 squeue_t *sqp = (squeue_t *)arg; 1556 tcp_squeue_priv_t *tcp_time_wait; 1557 netstack_t *ns; 1558 mblk_t *tcp_rsrv_mp = NULL; 1559 1560 tcp_time_wait = 1561 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1562 1563 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1564 tcp = tcp_time_wait->tcp_free_list; 1565 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 1566 if (tcp != NULL) { 1567 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1568 tcp_time_wait->tcp_free_list_cnt--; 1569 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1570 tcp->tcp_time_wait_next = NULL; 1571 connp = tcp->tcp_connp; 1572 connp->conn_flags |= IPCL_REUSED; 1573 1574 ASSERT(tcp->tcp_tcps == NULL); 1575 ASSERT(connp->conn_netstack == NULL); 1576 ASSERT(tcp->tcp_rsrv_mp != NULL); 1577 ns = tcps->tcps_netstack; 1578 netstack_hold(ns); 1579 connp->conn_netstack = ns; 1580 connp->conn_ixa->ixa_ipst = ns->netstack_ip; 1581 tcp->tcp_tcps = tcps; 1582 ipcl_globalhash_insert(connp); 1583 1584 connp->conn_ixa->ixa_notify_cookie = tcp; 1585 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify); 1586 connp->conn_recv = tcp_input_data; 1587 ASSERT(connp->conn_recvicmp == tcp_icmp_input); 1588 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp); 1589 return ((void *)connp); 1590 } 1591 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1592 /* 1593 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until 1594 * this conn_t/tcp_t is freed at ipcl_conn_destroy(). 1595 */ 1596 tcp_rsrv_mp = allocb(0, BPRI_HI); 1597 if (tcp_rsrv_mp == NULL) 1598 return (NULL); 1599 1600 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, 1601 tcps->tcps_netstack)) == NULL) { 1602 freeb(tcp_rsrv_mp); 1603 return (NULL); 1604 } 1605 1606 tcp = connp->conn_tcp; 1607 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 1608 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL); 1609 1610 tcp->tcp_tcps = tcps; 1611 1612 connp->conn_recv = tcp_input_data; 1613 connp->conn_recvicmp = tcp_icmp_input; 1614 connp->conn_verifyicmp = tcp_verifyicmp; 1615 1616 /* 1617 * Register tcp_notify to listen to capability changes detected by IP. 1618 * This upcall is made in the context of the call to conn_ip_output 1619 * thus it is inside the squeue. 1620 */ 1621 connp->conn_ixa->ixa_notify = tcp_notify; 1622 connp->conn_ixa->ixa_notify_cookie = tcp; 1623 1624 return ((void *)connp); 1625 } 1626 1627 /* 1628 * Handle connect to IPv4 destinations, including connections for AF_INET6 1629 * sockets connecting to IPv4 mapped IPv6 destinations. 1630 * Returns zero if OK, a positive errno, or a negative TLI error. 1631 */ 1632 static int 1633 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport, 1634 uint_t srcid) 1635 { 1636 ipaddr_t dstaddr = *dstaddrp; 1637 uint16_t lport; 1638 conn_t *connp = tcp->tcp_connp; 1639 tcp_stack_t *tcps = tcp->tcp_tcps; 1640 int error; 1641 1642 ASSERT(connp->conn_ipversion == IPV4_VERSION); 1643 1644 /* Check for attempt to connect to INADDR_ANY */ 1645 if (dstaddr == INADDR_ANY) { 1646 /* 1647 * SunOS 4.x and 4.3 BSD allow an application 1648 * to connect a TCP socket to INADDR_ANY. 1649 * When they do this, the kernel picks the 1650 * address of one interface and uses it 1651 * instead. The kernel usually ends up 1652 * picking the address of the loopback 1653 * interface. This is an undocumented feature. 1654 * However, we provide the same thing here 1655 * in order to have source and binary 1656 * compatibility with SunOS 4.x. 1657 * Update the T_CONN_REQ (sin/sin6) since it is used to 1658 * generate the T_CONN_CON. 1659 */ 1660 dstaddr = htonl(INADDR_LOOPBACK); 1661 *dstaddrp = dstaddr; 1662 } 1663 1664 /* Handle __sin6_src_id if socket not bound to an IP address */ 1665 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) { 1666 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1667 IPCL_ZONEID(connp), tcps->tcps_netstack); 1668 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1669 } 1670 1671 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6); 1672 connp->conn_fport = dstport; 1673 1674 /* 1675 * At this point the remote destination address and remote port fields 1676 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1677 * have to see which state tcp was in so we can take appropriate action. 1678 */ 1679 if (tcp->tcp_state == TCPS_IDLE) { 1680 /* 1681 * We support a quick connect capability here, allowing 1682 * clients to transition directly from IDLE to SYN_SENT 1683 * tcp_bindi will pick an unused port, insert the connection 1684 * in the bind hash and transition to BOUND state. 1685 */ 1686 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1687 tcp, B_TRUE); 1688 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1689 B_FALSE, B_FALSE); 1690 if (lport == 0) 1691 return (-TNOADDR); 1692 } 1693 1694 /* 1695 * Lookup the route to determine a source address and the uinfo. 1696 * Setup TCP parameters based on the metrics/DCE. 1697 */ 1698 error = tcp_set_destination(tcp); 1699 if (error != 0) 1700 return (error); 1701 1702 /* 1703 * Don't let an endpoint connect to itself. 1704 */ 1705 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 && 1706 connp->conn_fport == connp->conn_lport) 1707 return (-TBADADDR); 1708 1709 tcp->tcp_state = TCPS_SYN_SENT; 1710 1711 return (ipcl_conn_insert_v4(connp)); 1712 } 1713 1714 /* 1715 * Handle connect to IPv6 destinations. 1716 * Returns zero if OK, a positive errno, or a negative TLI error. 1717 */ 1718 static int 1719 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport, 1720 uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 1721 { 1722 uint16_t lport; 1723 conn_t *connp = tcp->tcp_connp; 1724 tcp_stack_t *tcps = tcp->tcp_tcps; 1725 int error; 1726 1727 ASSERT(connp->conn_family == AF_INET6); 1728 1729 /* 1730 * If we're here, it means that the destination address is a native 1731 * IPv6 address. Return an error if conn_ipversion is not IPv6. A 1732 * reason why it might not be IPv6 is if the socket was bound to an 1733 * IPv4-mapped IPv6 address. 1734 */ 1735 if (connp->conn_ipversion != IPV6_VERSION) 1736 return (-TBADADDR); 1737 1738 /* 1739 * Interpret a zero destination to mean loopback. 1740 * Update the T_CONN_REQ (sin/sin6) since it is used to 1741 * generate the T_CONN_CON. 1742 */ 1743 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) 1744 *dstaddrp = ipv6_loopback; 1745 1746 /* Handle __sin6_src_id if socket not bound to an IP address */ 1747 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) { 1748 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1749 IPCL_ZONEID(connp), tcps->tcps_netstack); 1750 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1751 } 1752 1753 /* 1754 * Take care of the scope_id now. 1755 */ 1756 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 1757 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1758 connp->conn_ixa->ixa_scopeid = scope_id; 1759 } else { 1760 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 1761 } 1762 1763 connp->conn_flowinfo = flowinfo; 1764 connp->conn_faddr_v6 = *dstaddrp; 1765 connp->conn_fport = dstport; 1766 1767 /* 1768 * At this point the remote destination address and remote port fields 1769 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1770 * have to see which state tcp was in so we can take appropriate action. 1771 */ 1772 if (tcp->tcp_state == TCPS_IDLE) { 1773 /* 1774 * We support a quick connect capability here, allowing 1775 * clients to transition directly from IDLE to SYN_SENT 1776 * tcp_bindi will pick an unused port, insert the connection 1777 * in the bind hash and transition to BOUND state. 1778 */ 1779 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1780 tcp, B_TRUE); 1781 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1782 B_FALSE, B_FALSE); 1783 if (lport == 0) 1784 return (-TNOADDR); 1785 } 1786 1787 /* 1788 * Lookup the route to determine a source address and the uinfo. 1789 * Setup TCP parameters based on the metrics/DCE. 1790 */ 1791 error = tcp_set_destination(tcp); 1792 if (error != 0) 1793 return (error); 1794 1795 /* 1796 * Don't let an endpoint connect to itself. 1797 */ 1798 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) && 1799 connp->conn_fport == connp->conn_lport) 1800 return (-TBADADDR); 1801 1802 tcp->tcp_state = TCPS_SYN_SENT; 1803 1804 return (ipcl_conn_insert_v6(connp)); 1805 } 1806 1807 /* 1808 * Disconnect 1809 * Note that unlike other functions this returns a positive tli error 1810 * when it fails; it never returns an errno. 1811 */ 1812 static int 1813 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum) 1814 { 1815 conn_t *lconnp; 1816 tcp_stack_t *tcps = tcp->tcp_tcps; 1817 conn_t *connp = tcp->tcp_connp; 1818 1819 /* 1820 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 1821 * when the stream is in BOUND state. Do not send a reset, 1822 * since the destination IP address is not valid, and it can 1823 * be the initialized value of all zeros (broadcast address). 1824 */ 1825 if (tcp->tcp_state <= TCPS_BOUND) { 1826 if (connp->conn_debug) { 1827 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 1828 "tcp_disconnect: bad state, %d", tcp->tcp_state); 1829 } 1830 return (TOUTSTATE); 1831 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1832 TCPS_CONN_DEC(tcps); 1833 } 1834 1835 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 1836 1837 /* 1838 * According to TPI, for non-listeners, ignore seqnum 1839 * and disconnect. 1840 * Following interpretation of -1 seqnum is historical 1841 * and implied TPI ? (TPI only states that for T_CONN_IND, 1842 * a valid seqnum should not be -1). 1843 * 1844 * -1 means disconnect everything 1845 * regardless even on a listener. 1846 */ 1847 1848 int old_state = tcp->tcp_state; 1849 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1850 1851 /* 1852 * The connection can't be on the tcp_time_wait_head list 1853 * since it is not detached. 1854 */ 1855 ASSERT(tcp->tcp_time_wait_next == NULL); 1856 ASSERT(tcp->tcp_time_wait_prev == NULL); 1857 ASSERT(tcp->tcp_time_wait_expire == 0); 1858 /* 1859 * If it used to be a listener, check to make sure no one else 1860 * has taken the port before switching back to LISTEN state. 1861 */ 1862 if (connp->conn_ipversion == IPV4_VERSION) { 1863 lconnp = ipcl_lookup_listener_v4(connp->conn_lport, 1864 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst); 1865 } else { 1866 uint_t ifindex = 0; 1867 1868 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) 1869 ifindex = connp->conn_ixa->ixa_scopeid; 1870 1871 /* Allow conn_bound_if listeners? */ 1872 lconnp = ipcl_lookup_listener_v6(connp->conn_lport, 1873 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp), 1874 ipst); 1875 } 1876 if (tcp->tcp_conn_req_max && lconnp == NULL) { 1877 tcp->tcp_state = TCPS_LISTEN; 1878 } else if (old_state > TCPS_BOUND) { 1879 tcp->tcp_conn_req_max = 0; 1880 tcp->tcp_state = TCPS_BOUND; 1881 1882 /* 1883 * If this end point is not going to become a listener, 1884 * decrement the listener connection count if 1885 * necessary. Note that we do not do this if it is 1886 * going to be a listner (the above if case) since 1887 * then it may remove the counter struct. 1888 */ 1889 if (tcp->tcp_listen_cnt != NULL) 1890 TCP_DECR_LISTEN_CNT(tcp); 1891 } 1892 if (lconnp != NULL) 1893 CONN_DEC_REF(lconnp); 1894 switch (old_state) { 1895 case TCPS_SYN_SENT: 1896 case TCPS_SYN_RCVD: 1897 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1898 break; 1899 case TCPS_ESTABLISHED: 1900 case TCPS_CLOSE_WAIT: 1901 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1902 break; 1903 } 1904 1905 if (tcp->tcp_fused) 1906 tcp_unfuse(tcp); 1907 1908 mutex_enter(&tcp->tcp_eager_lock); 1909 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 1910 (tcp->tcp_conn_req_cnt_q != 0)) { 1911 tcp_eager_cleanup(tcp, 0); 1912 } 1913 mutex_exit(&tcp->tcp_eager_lock); 1914 1915 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 1916 tcp->tcp_rnxt, TH_RST | TH_ACK); 1917 1918 tcp_reinit(tcp); 1919 1920 return (0); 1921 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 1922 return (TBADSEQ); 1923 } 1924 return (0); 1925 } 1926 1927 /* 1928 * Our client hereby directs us to reject the connection request 1929 * that tcp_input_listener() marked with 'seqnum'. Rejection consists 1930 * of sending the appropriate RST, not an ICMP error. 1931 */ 1932 void 1933 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 1934 { 1935 t_scalar_t seqnum; 1936 int error; 1937 conn_t *connp = tcp->tcp_connp; 1938 1939 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 1940 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 1941 tcp_err_ack(tcp, mp, TPROTO, 0); 1942 return; 1943 } 1944 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 1945 error = tcp_disconnect_common(tcp, seqnum); 1946 if (error != 0) 1947 tcp_err_ack(tcp, mp, error, 0); 1948 else { 1949 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1950 /* Send M_FLUSH according to TPI */ 1951 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 1952 } 1953 mp = mi_tpi_ok_ack_alloc(mp); 1954 if (mp != NULL) 1955 putnext(connp->conn_rq, mp); 1956 } 1957 } 1958 1959 /* 1960 * Note: No locks are held when inspecting tcp_g_*epriv_ports 1961 * but instead the code relies on: 1962 * - the fact that the address of the array and its size never changes 1963 * - the atomic assignment of the elements of the array 1964 */ 1965 /* ARGSUSED */ 1966 static int 1967 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 1968 { 1969 int i; 1970 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 1971 1972 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 1973 if (tcps->tcps_g_epriv_ports[i] != 0) 1974 (void) mi_mpprintf(mp, "%d ", 1975 tcps->tcps_g_epriv_ports[i]); 1976 } 1977 return (0); 1978 } 1979 1980 /* 1981 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 1982 * threads from changing it at the same time. 1983 */ 1984 /* ARGSUSED */ 1985 static int 1986 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 1987 cred_t *cr) 1988 { 1989 long new_value; 1990 int i; 1991 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 1992 1993 /* 1994 * Fail the request if the new value does not lie within the 1995 * port number limits. 1996 */ 1997 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 1998 new_value <= 0 || new_value >= 65536) { 1999 return (EINVAL); 2000 } 2001 2002 mutex_enter(&tcps->tcps_epriv_port_lock); 2003 /* Check if the value is already in the list */ 2004 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2005 if (new_value == tcps->tcps_g_epriv_ports[i]) { 2006 mutex_exit(&tcps->tcps_epriv_port_lock); 2007 return (EEXIST); 2008 } 2009 } 2010 /* Find an empty slot */ 2011 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2012 if (tcps->tcps_g_epriv_ports[i] == 0) 2013 break; 2014 } 2015 if (i == tcps->tcps_g_num_epriv_ports) { 2016 mutex_exit(&tcps->tcps_epriv_port_lock); 2017 return (EOVERFLOW); 2018 } 2019 /* Set the new value */ 2020 tcps->tcps_g_epriv_ports[i] = (uint16_t)new_value; 2021 mutex_exit(&tcps->tcps_epriv_port_lock); 2022 return (0); 2023 } 2024 2025 /* 2026 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 2027 * threads from changing it at the same time. 2028 */ 2029 /* ARGSUSED */ 2030 static int 2031 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 2032 cred_t *cr) 2033 { 2034 long new_value; 2035 int i; 2036 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 2037 2038 /* 2039 * Fail the request if the new value does not lie within the 2040 * port number limits. 2041 */ 2042 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 2043 new_value >= 65536) { 2044 return (EINVAL); 2045 } 2046 2047 mutex_enter(&tcps->tcps_epriv_port_lock); 2048 /* Check that the value is already in the list */ 2049 for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { 2050 if (tcps->tcps_g_epriv_ports[i] == new_value) 2051 break; 2052 } 2053 if (i == tcps->tcps_g_num_epriv_ports) { 2054 mutex_exit(&tcps->tcps_epriv_port_lock); 2055 return (ESRCH); 2056 } 2057 /* Clear the value */ 2058 tcps->tcps_g_epriv_ports[i] = 0; 2059 mutex_exit(&tcps->tcps_epriv_port_lock); 2060 return (0); 2061 } 2062 2063 /* 2064 * Handle reinitialization of a tcp structure. 2065 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 2066 */ 2067 static void 2068 tcp_reinit(tcp_t *tcp) 2069 { 2070 mblk_t *mp; 2071 tcp_stack_t *tcps = tcp->tcp_tcps; 2072 conn_t *connp = tcp->tcp_connp; 2073 2074 /* tcp_reinit should never be called for detached tcp_t's */ 2075 ASSERT(tcp->tcp_listener == NULL); 2076 ASSERT((connp->conn_family == AF_INET && 2077 connp->conn_ipversion == IPV4_VERSION) || 2078 (connp->conn_family == AF_INET6 && 2079 (connp->conn_ipversion == IPV4_VERSION || 2080 connp->conn_ipversion == IPV6_VERSION))); 2081 2082 /* Cancel outstanding timers */ 2083 tcp_timers_stop(tcp); 2084 2085 /* 2086 * Reset everything in the state vector, after updating global 2087 * MIB data from instance counters. 2088 */ 2089 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 2090 tcp->tcp_ibsegs = 0; 2091 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 2092 tcp->tcp_obsegs = 0; 2093 2094 tcp_close_mpp(&tcp->tcp_xmit_head); 2095 if (tcp->tcp_snd_zcopy_aware) 2096 tcp_zcopy_notify(tcp); 2097 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 2098 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 2099 mutex_enter(&tcp->tcp_non_sq_lock); 2100 if (tcp->tcp_flow_stopped && 2101 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 2102 tcp_clrqfull(tcp); 2103 } 2104 mutex_exit(&tcp->tcp_non_sq_lock); 2105 tcp_close_mpp(&tcp->tcp_reass_head); 2106 tcp->tcp_reass_tail = NULL; 2107 if (tcp->tcp_rcv_list != NULL) { 2108 /* Free b_next chain */ 2109 tcp_close_mpp(&tcp->tcp_rcv_list); 2110 tcp->tcp_rcv_last_head = NULL; 2111 tcp->tcp_rcv_last_tail = NULL; 2112 tcp->tcp_rcv_cnt = 0; 2113 } 2114 tcp->tcp_rcv_last_tail = NULL; 2115 2116 if ((mp = tcp->tcp_urp_mp) != NULL) { 2117 freemsg(mp); 2118 tcp->tcp_urp_mp = NULL; 2119 } 2120 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 2121 freemsg(mp); 2122 tcp->tcp_urp_mark_mp = NULL; 2123 } 2124 if (tcp->tcp_fused_sigurg_mp != NULL) { 2125 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 2126 freeb(tcp->tcp_fused_sigurg_mp); 2127 tcp->tcp_fused_sigurg_mp = NULL; 2128 } 2129 if (tcp->tcp_ordrel_mp != NULL) { 2130 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 2131 freeb(tcp->tcp_ordrel_mp); 2132 tcp->tcp_ordrel_mp = NULL; 2133 } 2134 2135 /* 2136 * Following is a union with two members which are 2137 * identical types and size so the following cleanup 2138 * is enough. 2139 */ 2140 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 2141 2142 CL_INET_DISCONNECT(connp); 2143 2144 /* 2145 * The connection can't be on the tcp_time_wait_head list 2146 * since it is not detached. 2147 */ 2148 ASSERT(tcp->tcp_time_wait_next == NULL); 2149 ASSERT(tcp->tcp_time_wait_prev == NULL); 2150 ASSERT(tcp->tcp_time_wait_expire == 0); 2151 2152 if (tcp->tcp_kssl_pending) { 2153 tcp->tcp_kssl_pending = B_FALSE; 2154 2155 /* Don't reset if the initialized by bind. */ 2156 if (tcp->tcp_kssl_ent != NULL) { 2157 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 2158 KSSL_NO_PROXY); 2159 } 2160 } 2161 if (tcp->tcp_kssl_ctx != NULL) { 2162 kssl_release_ctx(tcp->tcp_kssl_ctx); 2163 tcp->tcp_kssl_ctx = NULL; 2164 } 2165 2166 /* 2167 * Reset/preserve other values 2168 */ 2169 tcp_reinit_values(tcp); 2170 ipcl_hash_remove(connp); 2171 /* Note that ixa_cred gets cleared in ixa_cleanup */ 2172 ixa_cleanup(connp->conn_ixa); 2173 tcp_ipsec_cleanup(tcp); 2174 2175 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 2176 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 2177 2178 if (tcp->tcp_conn_req_max != 0) { 2179 /* 2180 * This is the case when a TLI program uses the same 2181 * transport end point to accept a connection. This 2182 * makes the TCP both a listener and acceptor. When 2183 * this connection is closed, we need to set the state 2184 * back to TCPS_LISTEN. Make sure that the eager list 2185 * is reinitialized. 2186 * 2187 * Note that this stream is still bound to the four 2188 * tuples of the previous connection in IP. If a new 2189 * SYN with different foreign address comes in, IP will 2190 * not find it and will send it to the global queue. In 2191 * the global queue, TCP will do a tcp_lookup_listener() 2192 * to find this stream. This works because this stream 2193 * is only removed from connected hash. 2194 * 2195 */ 2196 tcp->tcp_state = TCPS_LISTEN; 2197 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 2198 tcp->tcp_eager_next_drop_q0 = tcp; 2199 tcp->tcp_eager_prev_drop_q0 = tcp; 2200 /* 2201 * Initially set conn_recv to tcp_input_listener_unbound to try 2202 * to pick a good squeue for the listener when the first SYN 2203 * arrives. tcp_input_listener_unbound sets it to 2204 * tcp_input_listener on that first SYN. 2205 */ 2206 connp->conn_recv = tcp_input_listener_unbound; 2207 2208 connp->conn_proto = IPPROTO_TCP; 2209 connp->conn_faddr_v6 = ipv6_all_zeros; 2210 connp->conn_fport = 0; 2211 2212 (void) ipcl_bind_insert(connp); 2213 } else { 2214 tcp->tcp_state = TCPS_BOUND; 2215 } 2216 2217 /* 2218 * Initialize to default values 2219 */ 2220 tcp_init_values(tcp); 2221 2222 ASSERT(tcp->tcp_ptpbhn != NULL); 2223 tcp->tcp_rwnd = connp->conn_rcvbuf; 2224 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ? 2225 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; 2226 } 2227 2228 /* 2229 * Force values to zero that need be zero. 2230 * Do not touch values asociated with the BOUND or LISTEN state 2231 * since the connection will end up in that state after the reinit. 2232 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 2233 * structure! 2234 */ 2235 static void 2236 tcp_reinit_values(tcp) 2237 tcp_t *tcp; 2238 { 2239 tcp_stack_t *tcps = tcp->tcp_tcps; 2240 conn_t *connp = tcp->tcp_connp; 2241 2242 #ifndef lint 2243 #define DONTCARE(x) 2244 #define PRESERVE(x) 2245 #else 2246 #define DONTCARE(x) ((x) = (x)) 2247 #define PRESERVE(x) ((x) = (x)) 2248 #endif /* lint */ 2249 2250 PRESERVE(tcp->tcp_bind_hash_port); 2251 PRESERVE(tcp->tcp_bind_hash); 2252 PRESERVE(tcp->tcp_ptpbhn); 2253 PRESERVE(tcp->tcp_acceptor_hash); 2254 PRESERVE(tcp->tcp_ptpahn); 2255 2256 /* Should be ASSERT NULL on these with new code! */ 2257 ASSERT(tcp->tcp_time_wait_next == NULL); 2258 ASSERT(tcp->tcp_time_wait_prev == NULL); 2259 ASSERT(tcp->tcp_time_wait_expire == 0); 2260 PRESERVE(tcp->tcp_state); 2261 PRESERVE(connp->conn_rq); 2262 PRESERVE(connp->conn_wq); 2263 2264 ASSERT(tcp->tcp_xmit_head == NULL); 2265 ASSERT(tcp->tcp_xmit_last == NULL); 2266 ASSERT(tcp->tcp_unsent == 0); 2267 ASSERT(tcp->tcp_xmit_tail == NULL); 2268 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 2269 2270 tcp->tcp_snxt = 0; /* Displayed in mib */ 2271 tcp->tcp_suna = 0; /* Displayed in mib */ 2272 tcp->tcp_swnd = 0; 2273 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */ 2274 2275 ASSERT(tcp->tcp_ibsegs == 0); 2276 ASSERT(tcp->tcp_obsegs == 0); 2277 2278 if (connp->conn_ht_iphc != NULL) { 2279 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 2280 connp->conn_ht_iphc = NULL; 2281 connp->conn_ht_iphc_allocated = 0; 2282 connp->conn_ht_iphc_len = 0; 2283 connp->conn_ht_ulp = NULL; 2284 connp->conn_ht_ulp_len = 0; 2285 tcp->tcp_ipha = NULL; 2286 tcp->tcp_ip6h = NULL; 2287 tcp->tcp_tcpha = NULL; 2288 } 2289 2290 /* We clear any IP_OPTIONS and extension headers */ 2291 ip_pkt_free(&connp->conn_xmit_ipp); 2292 2293 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 2294 DONTCARE(tcp->tcp_ipha); 2295 DONTCARE(tcp->tcp_ip6h); 2296 DONTCARE(tcp->tcp_tcpha); 2297 tcp->tcp_valid_bits = 0; 2298 2299 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 2300 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 2301 tcp->tcp_last_rcv_lbolt = 0; 2302 2303 tcp->tcp_init_cwnd = 0; 2304 2305 tcp->tcp_urp_last_valid = 0; 2306 tcp->tcp_hard_binding = 0; 2307 2308 tcp->tcp_fin_acked = 0; 2309 tcp->tcp_fin_rcvd = 0; 2310 tcp->tcp_fin_sent = 0; 2311 tcp->tcp_ordrel_done = 0; 2312 2313 tcp->tcp_detached = 0; 2314 2315 tcp->tcp_snd_ws_ok = B_FALSE; 2316 tcp->tcp_snd_ts_ok = B_FALSE; 2317 tcp->tcp_zero_win_probe = 0; 2318 2319 tcp->tcp_loopback = 0; 2320 tcp->tcp_localnet = 0; 2321 tcp->tcp_syn_defense = 0; 2322 tcp->tcp_set_timer = 0; 2323 2324 tcp->tcp_active_open = 0; 2325 tcp->tcp_rexmit = B_FALSE; 2326 tcp->tcp_xmit_zc_clean = B_FALSE; 2327 2328 tcp->tcp_snd_sack_ok = B_FALSE; 2329 tcp->tcp_hwcksum = B_FALSE; 2330 2331 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */ 2332 2333 tcp->tcp_conn_def_q0 = 0; 2334 tcp->tcp_ip_forward_progress = B_FALSE; 2335 tcp->tcp_ecn_ok = B_FALSE; 2336 2337 tcp->tcp_cwr = B_FALSE; 2338 tcp->tcp_ecn_echo_on = B_FALSE; 2339 tcp->tcp_is_wnd_shrnk = B_FALSE; 2340 2341 if (tcp->tcp_sack_info != NULL) { 2342 if (tcp->tcp_notsack_list != NULL) { 2343 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 2344 tcp); 2345 } 2346 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 2347 tcp->tcp_sack_info = NULL; 2348 } 2349 2350 tcp->tcp_rcv_ws = 0; 2351 tcp->tcp_snd_ws = 0; 2352 tcp->tcp_ts_recent = 0; 2353 tcp->tcp_rnxt = 0; /* Displayed in mib */ 2354 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 2355 tcp->tcp_initial_pmtu = 0; 2356 2357 ASSERT(tcp->tcp_reass_head == NULL); 2358 ASSERT(tcp->tcp_reass_tail == NULL); 2359 2360 tcp->tcp_cwnd_cnt = 0; 2361 2362 ASSERT(tcp->tcp_rcv_list == NULL); 2363 ASSERT(tcp->tcp_rcv_last_head == NULL); 2364 ASSERT(tcp->tcp_rcv_last_tail == NULL); 2365 ASSERT(tcp->tcp_rcv_cnt == 0); 2366 2367 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */ 2368 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 2369 tcp->tcp_csuna = 0; 2370 2371 tcp->tcp_rto = 0; /* Displayed in MIB */ 2372 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 2373 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 2374 tcp->tcp_rtt_update = 0; 2375 2376 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2377 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2378 2379 tcp->tcp_rack = 0; /* Displayed in mib */ 2380 tcp->tcp_rack_cnt = 0; 2381 tcp->tcp_rack_cur_max = 0; 2382 tcp->tcp_rack_abs_max = 0; 2383 2384 tcp->tcp_max_swnd = 0; 2385 2386 ASSERT(tcp->tcp_listener == NULL); 2387 2388 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 2389 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 2390 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 2391 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 2392 2393 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 2394 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 2395 PRESERVE(tcp->tcp_conn_req_max); 2396 PRESERVE(tcp->tcp_conn_req_seqnum); 2397 2398 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 2399 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 2400 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 2401 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 2402 2403 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 2404 ASSERT(tcp->tcp_urp_mp == NULL); 2405 ASSERT(tcp->tcp_urp_mark_mp == NULL); 2406 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 2407 2408 ASSERT(tcp->tcp_eager_next_q == NULL); 2409 ASSERT(tcp->tcp_eager_last_q == NULL); 2410 ASSERT((tcp->tcp_eager_next_q0 == NULL && 2411 tcp->tcp_eager_prev_q0 == NULL) || 2412 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 2413 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 2414 2415 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && 2416 tcp->tcp_eager_prev_drop_q0 == NULL) || 2417 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); 2418 2419 tcp->tcp_client_errno = 0; 2420 2421 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */ 2422 2423 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */ 2424 2425 PRESERVE(connp->conn_bound_addr_v6); 2426 tcp->tcp_last_sent_len = 0; 2427 tcp->tcp_dupack_cnt = 0; 2428 2429 connp->conn_fport = 0; /* Displayed in MIB */ 2430 PRESERVE(connp->conn_lport); 2431 2432 PRESERVE(tcp->tcp_acceptor_lockp); 2433 2434 ASSERT(tcp->tcp_ordrel_mp == NULL); 2435 PRESERVE(tcp->tcp_acceptor_id); 2436 DONTCARE(tcp->tcp_ipsec_overhead); 2437 2438 PRESERVE(connp->conn_family); 2439 /* Remove any remnants of mapped address binding */ 2440 if (connp->conn_family == AF_INET6) { 2441 connp->conn_ipversion = IPV6_VERSION; 2442 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2443 } else { 2444 connp->conn_ipversion = IPV4_VERSION; 2445 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2446 } 2447 2448 connp->conn_bound_if = 0; 2449 connp->conn_recv_ancillary.crb_all = 0; 2450 tcp->tcp_recvifindex = 0; 2451 tcp->tcp_recvhops = 0; 2452 tcp->tcp_closed = 0; 2453 if (tcp->tcp_hopopts != NULL) { 2454 mi_free(tcp->tcp_hopopts); 2455 tcp->tcp_hopopts = NULL; 2456 tcp->tcp_hopoptslen = 0; 2457 } 2458 ASSERT(tcp->tcp_hopoptslen == 0); 2459 if (tcp->tcp_dstopts != NULL) { 2460 mi_free(tcp->tcp_dstopts); 2461 tcp->tcp_dstopts = NULL; 2462 tcp->tcp_dstoptslen = 0; 2463 } 2464 ASSERT(tcp->tcp_dstoptslen == 0); 2465 if (tcp->tcp_rthdrdstopts != NULL) { 2466 mi_free(tcp->tcp_rthdrdstopts); 2467 tcp->tcp_rthdrdstopts = NULL; 2468 tcp->tcp_rthdrdstoptslen = 0; 2469 } 2470 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 2471 if (tcp->tcp_rthdr != NULL) { 2472 mi_free(tcp->tcp_rthdr); 2473 tcp->tcp_rthdr = NULL; 2474 tcp->tcp_rthdrlen = 0; 2475 } 2476 ASSERT(tcp->tcp_rthdrlen == 0); 2477 2478 /* Reset fusion-related fields */ 2479 tcp->tcp_fused = B_FALSE; 2480 tcp->tcp_unfusable = B_FALSE; 2481 tcp->tcp_fused_sigurg = B_FALSE; 2482 tcp->tcp_loopback_peer = NULL; 2483 2484 tcp->tcp_lso = B_FALSE; 2485 2486 tcp->tcp_in_ack_unsent = 0; 2487 tcp->tcp_cork = B_FALSE; 2488 tcp->tcp_tconnind_started = B_FALSE; 2489 2490 PRESERVE(tcp->tcp_squeue_bytes); 2491 2492 ASSERT(tcp->tcp_kssl_ctx == NULL); 2493 ASSERT(!tcp->tcp_kssl_pending); 2494 PRESERVE(tcp->tcp_kssl_ent); 2495 2496 tcp->tcp_closemp_used = B_FALSE; 2497 2498 PRESERVE(tcp->tcp_rsrv_mp); 2499 PRESERVE(tcp->tcp_rsrv_mp_lock); 2500 2501 #ifdef DEBUG 2502 DONTCARE(tcp->tcmp_stk[0]); 2503 #endif 2504 2505 PRESERVE(tcp->tcp_connid); 2506 2507 ASSERT(tcp->tcp_listen_cnt == NULL); 2508 ASSERT(tcp->tcp_reass_tid == 0); 2509 2510 #undef DONTCARE 2511 #undef PRESERVE 2512 } 2513 2514 void 2515 tcp_init_values(tcp_t *tcp) 2516 { 2517 tcp_stack_t *tcps = tcp->tcp_tcps; 2518 conn_t *connp = tcp->tcp_connp; 2519 2520 ASSERT((connp->conn_family == AF_INET && 2521 connp->conn_ipversion == IPV4_VERSION) || 2522 (connp->conn_family == AF_INET6 && 2523 (connp->conn_ipversion == IPV4_VERSION || 2524 connp->conn_ipversion == IPV6_VERSION))); 2525 2526 /* 2527 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 2528 * will be close to tcp_rexmit_interval_initial. By doing this, we 2529 * allow the algorithm to adjust slowly to large fluctuations of RTT 2530 * during first few transmissions of a connection as seen in slow 2531 * links. 2532 */ 2533 tcp->tcp_rtt_sa = tcps->tcps_rexmit_interval_initial << 2; 2534 tcp->tcp_rtt_sd = tcps->tcps_rexmit_interval_initial >> 1; 2535 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 2536 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 2537 tcps->tcps_conn_grace_period; 2538 if (tcp->tcp_rto < tcps->tcps_rexmit_interval_min) 2539 tcp->tcp_rto = tcps->tcps_rexmit_interval_min; 2540 tcp->tcp_timer_backoff = 0; 2541 tcp->tcp_ms_we_have_waited = 0; 2542 tcp->tcp_last_recv_time = ddi_get_lbolt(); 2543 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; 2544 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2545 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 2546 2547 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier; 2548 2549 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; 2550 tcp->tcp_first_ctimer_threshold = tcps->tcps_ip_notify_cinterval; 2551 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; 2552 /* 2553 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 2554 * passive open. 2555 */ 2556 tcp->tcp_second_ctimer_threshold = tcps->tcps_ip_abort_cinterval; 2557 2558 tcp->tcp_naglim = tcps->tcps_naglim_def; 2559 2560 /* NOTE: ISS is now set in tcp_set_destination(). */ 2561 2562 /* Reset fusion-related fields */ 2563 tcp->tcp_fused = B_FALSE; 2564 tcp->tcp_unfusable = B_FALSE; 2565 tcp->tcp_fused_sigurg = B_FALSE; 2566 tcp->tcp_loopback_peer = NULL; 2567 2568 /* We rebuild the header template on the next connect/conn_request */ 2569 2570 connp->conn_mlp_type = mlptSingle; 2571 2572 /* 2573 * Init the window scale to the max so tcp_rwnd_set() won't pare 2574 * down tcp_rwnd. tcp_set_destination() will set the right value later. 2575 */ 2576 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 2577 tcp->tcp_rwnd = connp->conn_rcvbuf; 2578 2579 tcp->tcp_cork = B_FALSE; 2580 /* 2581 * Init the tcp_debug option if it wasn't already set. This value 2582 * determines whether TCP 2583 * calls strlog() to print out debug messages. Doing this 2584 * initialization here means that this value is not inherited thru 2585 * tcp_reinit(). 2586 */ 2587 if (!connp->conn_debug) 2588 connp->conn_debug = tcps->tcps_dbg; 2589 2590 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; 2591 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; 2592 } 2593 2594 /* 2595 * Update the TCP connection according to change of PMTU. 2596 * 2597 * Path MTU might have changed by either increase or decrease, so need to 2598 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny 2599 * or negative MSS, since tcp_mss_set() will do it. 2600 */ 2601 void 2602 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only) 2603 { 2604 uint32_t pmtu; 2605 int32_t mss; 2606 conn_t *connp = tcp->tcp_connp; 2607 ip_xmit_attr_t *ixa = connp->conn_ixa; 2608 iaflags_t ixaflags; 2609 2610 if (tcp->tcp_tcps->tcps_ignore_path_mtu) 2611 return; 2612 2613 if (tcp->tcp_state < TCPS_ESTABLISHED) 2614 return; 2615 2616 /* 2617 * Always call ip_get_pmtu() to make sure that IP has updated 2618 * ixa_flags properly. 2619 */ 2620 pmtu = ip_get_pmtu(ixa); 2621 ixaflags = ixa->ixa_flags; 2622 2623 /* 2624 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and 2625 * IPsec overhead if applied. Make sure to use the most recent 2626 * IPsec information. 2627 */ 2628 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp); 2629 2630 /* 2631 * Nothing to change, so just return. 2632 */ 2633 if (mss == tcp->tcp_mss) 2634 return; 2635 2636 /* 2637 * Currently, for ICMP errors, only PMTU decrease is handled. 2638 */ 2639 if (mss > tcp->tcp_mss && decrease_only) 2640 return; 2641 2642 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss); 2643 2644 /* 2645 * Update ixa_fragsize and ixa_pmtu. 2646 */ 2647 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 2648 2649 /* 2650 * Adjust MSS and all relevant variables. 2651 */ 2652 tcp_mss_set(tcp, mss); 2653 2654 /* 2655 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu 2656 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP 2657 * has a (potentially different) min size we do the same. Make sure to 2658 * clear IXAF_DONTFRAG, which is used by IP to decide whether to 2659 * fragment the packet. 2660 * 2661 * LSO over IPv6 can not be fragmented. So need to disable LSO 2662 * when IPv6 fragmentation is needed. 2663 */ 2664 if (mss < tcp->tcp_tcps->tcps_mss_min) 2665 ixaflags |= IXAF_PMTU_TOO_SMALL; 2666 2667 if (ixaflags & IXAF_PMTU_TOO_SMALL) 2668 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 2669 2670 if ((connp->conn_ipversion == IPV4_VERSION) && 2671 !(ixaflags & IXAF_PMTU_IPV4_DF)) { 2672 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 2673 } 2674 ixa->ixa_flags = ixaflags; 2675 } 2676 2677 int 2678 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 2679 { 2680 conn_t *connp = tcp->tcp_connp; 2681 queue_t *q = connp->conn_rq; 2682 int32_t mss = tcp->tcp_mss; 2683 int maxpsz; 2684 2685 if (TCP_IS_DETACHED(tcp)) 2686 return (mss); 2687 if (tcp->tcp_fused) { 2688 maxpsz = tcp_fuse_maxpsz(tcp); 2689 mss = INFPSZ; 2690 } else if (tcp->tcp_maxpsz_multiplier == 0) { 2691 /* 2692 * Set the sd_qn_maxpsz according to the socket send buffer 2693 * size, and sd_maxblk to INFPSZ (-1). This will essentially 2694 * instruct the stream head to copyin user data into contiguous 2695 * kernel-allocated buffers without breaking it up into smaller 2696 * chunks. We round up the buffer size to the nearest SMSS. 2697 */ 2698 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss); 2699 if (tcp->tcp_kssl_ctx == NULL) 2700 mss = INFPSZ; 2701 else 2702 mss = SSL3_MAX_RECORD_LEN; 2703 } else { 2704 /* 2705 * Set sd_qn_maxpsz to approx half the (receivers) buffer 2706 * (and a multiple of the mss). This instructs the stream 2707 * head to break down larger than SMSS writes into SMSS- 2708 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 2709 */ 2710 maxpsz = tcp->tcp_maxpsz_multiplier * mss; 2711 if (maxpsz > connp->conn_sndbuf / 2) { 2712 maxpsz = connp->conn_sndbuf / 2; 2713 /* Round up to nearest mss */ 2714 maxpsz = MSS_ROUNDUP(maxpsz, mss); 2715 } 2716 } 2717 2718 (void) proto_set_maxpsz(q, connp, maxpsz); 2719 if (!(IPCL_IS_NONSTR(connp))) 2720 connp->conn_wq->q_maxpsz = maxpsz; 2721 if (set_maxblk) 2722 (void) proto_set_tx_maxblk(q, connp, mss); 2723 return (mss); 2724 } 2725 2726 /* For /dev/tcp aka AF_INET open */ 2727 static int 2728 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2729 { 2730 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); 2731 } 2732 2733 /* For /dev/tcp6 aka AF_INET6 open */ 2734 static int 2735 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2736 { 2737 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); 2738 } 2739 2740 conn_t * 2741 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket, 2742 int *errorp) 2743 { 2744 tcp_t *tcp = NULL; 2745 conn_t *connp; 2746 zoneid_t zoneid; 2747 tcp_stack_t *tcps; 2748 squeue_t *sqp; 2749 2750 ASSERT(errorp != NULL); 2751 /* 2752 * Find the proper zoneid and netstack. 2753 */ 2754 /* 2755 * Special case for install: miniroot needs to be able to 2756 * access files via NFS as though it were always in the 2757 * global zone. 2758 */ 2759 if (credp == kcred && nfs_global_client_only != 0) { 2760 zoneid = GLOBAL_ZONEID; 2761 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> 2762 netstack_tcp; 2763 ASSERT(tcps != NULL); 2764 } else { 2765 netstack_t *ns; 2766 int err; 2767 2768 if ((err = secpolicy_basic_net_access(credp)) != 0) { 2769 *errorp = err; 2770 return (NULL); 2771 } 2772 2773 ns = netstack_find_by_cred(credp); 2774 ASSERT(ns != NULL); 2775 tcps = ns->netstack_tcp; 2776 ASSERT(tcps != NULL); 2777 2778 /* 2779 * For exclusive stacks we set the zoneid to zero 2780 * to make TCP operate as if in the global zone. 2781 */ 2782 if (tcps->tcps_netstack->netstack_stackid != 2783 GLOBAL_NETSTACKID) 2784 zoneid = GLOBAL_ZONEID; 2785 else 2786 zoneid = crgetzoneid(credp); 2787 } 2788 2789 sqp = IP_SQUEUE_GET((uint_t)gethrtime()); 2790 connp = (conn_t *)tcp_get_conn(sqp, tcps); 2791 /* 2792 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, 2793 * so we drop it by one. 2794 */ 2795 netstack_rele(tcps->tcps_netstack); 2796 if (connp == NULL) { 2797 *errorp = ENOSR; 2798 return (NULL); 2799 } 2800 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto); 2801 2802 connp->conn_sqp = sqp; 2803 connp->conn_initial_sqp = connp->conn_sqp; 2804 connp->conn_ixa->ixa_sqp = connp->conn_sqp; 2805 tcp = connp->conn_tcp; 2806 2807 /* 2808 * Besides asking IP to set the checksum for us, have conn_ip_output 2809 * to do the following checks when necessary: 2810 * 2811 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid 2812 * IXAF_VERIFY_PMTU: verify PMTU changes 2813 * IXAF_VERIFY_LSO: verify LSO capability changes 2814 */ 2815 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 2816 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO; 2817 2818 if (!tcps->tcps_dev_flow_ctl) 2819 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 2820 2821 if (isv6) { 2822 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 2823 connp->conn_ipversion = IPV6_VERSION; 2824 connp->conn_family = AF_INET6; 2825 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2826 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit; 2827 } else { 2828 connp->conn_ipversion = IPV4_VERSION; 2829 connp->conn_family = AF_INET; 2830 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2831 connp->conn_default_ttl = tcps->tcps_ipv4_ttl; 2832 } 2833 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 2834 2835 crhold(credp); 2836 connp->conn_cred = credp; 2837 connp->conn_cpid = curproc->p_pid; 2838 connp->conn_open_time = ddi_get_lbolt64(); 2839 2840 /* Cache things in the ixa without any refhold */ 2841 connp->conn_ixa->ixa_cred = credp; 2842 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 2843 2844 connp->conn_zoneid = zoneid; 2845 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 2846 connp->conn_ixa->ixa_zoneid = zoneid; 2847 connp->conn_mlp_type = mlptSingle; 2848 ASSERT(connp->conn_netstack == tcps->tcps_netstack); 2849 ASSERT(tcp->tcp_tcps == tcps); 2850 2851 /* 2852 * If the caller has the process-wide flag set, then default to MAC 2853 * exempt mode. This allows read-down to unlabeled hosts. 2854 */ 2855 if (getpflags(NET_MAC_AWARE, credp) != 0) 2856 connp->conn_mac_mode = CONN_MAC_AWARE; 2857 2858 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 2859 2860 if (issocket) { 2861 tcp->tcp_issocket = 1; 2862 } 2863 2864 connp->conn_rcvbuf = tcps->tcps_recv_hiwat; 2865 connp->conn_sndbuf = tcps->tcps_xmit_hiwat; 2866 connp->conn_sndlowat = tcps->tcps_xmit_lowat; 2867 connp->conn_so_type = SOCK_STREAM; 2868 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2869 tcps->tcps_wroff_xtra; 2870 2871 SOCK_CONNID_INIT(tcp->tcp_connid); 2872 tcp->tcp_state = TCPS_IDLE; 2873 tcp_init_values(tcp); 2874 return (connp); 2875 } 2876 2877 static int 2878 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 2879 boolean_t isv6) 2880 { 2881 tcp_t *tcp = NULL; 2882 conn_t *connp = NULL; 2883 int err; 2884 vmem_t *minor_arena = NULL; 2885 dev_t conn_dev; 2886 boolean_t issocket; 2887 2888 if (q->q_ptr != NULL) 2889 return (0); 2890 2891 if (sflag == MODOPEN) 2892 return (EINVAL); 2893 2894 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 2895 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 2896 minor_arena = ip_minor_arena_la; 2897 } else { 2898 /* 2899 * Either minor numbers in the large arena were exhausted 2900 * or a non socket application is doing the open. 2901 * Try to allocate from the small arena. 2902 */ 2903 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 2904 return (EBUSY); 2905 } 2906 minor_arena = ip_minor_arena_sa; 2907 } 2908 2909 ASSERT(minor_arena != NULL); 2910 2911 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev); 2912 2913 if (flag & SO_FALLBACK) { 2914 /* 2915 * Non streams socket needs a stream to fallback to 2916 */ 2917 RD(q)->q_ptr = (void *)conn_dev; 2918 WR(q)->q_qinfo = &tcp_fallback_sock_winit; 2919 WR(q)->q_ptr = (void *)minor_arena; 2920 qprocson(q); 2921 return (0); 2922 } else if (flag & SO_ACCEPTOR) { 2923 q->q_qinfo = &tcp_acceptor_rinit; 2924 /* 2925 * the conn_dev and minor_arena will be subsequently used by 2926 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out 2927 * the minor device number for this connection from the q_ptr. 2928 */ 2929 RD(q)->q_ptr = (void *)conn_dev; 2930 WR(q)->q_qinfo = &tcp_acceptor_winit; 2931 WR(q)->q_ptr = (void *)minor_arena; 2932 qprocson(q); 2933 return (0); 2934 } 2935 2936 issocket = flag & SO_SOCKSTR; 2937 connp = tcp_create_common(credp, isv6, issocket, &err); 2938 2939 if (connp == NULL) { 2940 inet_minor_free(minor_arena, conn_dev); 2941 q->q_ptr = WR(q)->q_ptr = NULL; 2942 return (err); 2943 } 2944 2945 connp->conn_rq = q; 2946 connp->conn_wq = WR(q); 2947 q->q_ptr = WR(q)->q_ptr = connp; 2948 2949 connp->conn_dev = conn_dev; 2950 connp->conn_minor_arena = minor_arena; 2951 2952 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); 2953 ASSERT(WR(q)->q_qinfo == &tcp_winit); 2954 2955 tcp = connp->conn_tcp; 2956 2957 if (issocket) { 2958 WR(q)->q_qinfo = &tcp_sock_winit; 2959 } else { 2960 #ifdef _ILP32 2961 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 2962 #else 2963 tcp->tcp_acceptor_id = conn_dev; 2964 #endif /* _ILP32 */ 2965 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 2966 } 2967 2968 /* 2969 * Put the ref for TCP. Ref for IP was already put 2970 * by ipcl_conn_create. Also Make the conn_t globally 2971 * visible to walkers 2972 */ 2973 mutex_enter(&connp->conn_lock); 2974 CONN_INC_REF_LOCKED(connp); 2975 ASSERT(connp->conn_ref == 2); 2976 connp->conn_state_flags &= ~CONN_INCIPIENT; 2977 mutex_exit(&connp->conn_lock); 2978 2979 qprocson(q); 2980 return (0); 2981 } 2982 2983 /* 2984 * Build/update the tcp header template (in conn_ht_iphc) based on 2985 * conn_xmit_ipp. The headers include ip6_t, any extension 2986 * headers, and the maximum size tcp header (to avoid reallocation 2987 * on the fly for additional tcp options). 2988 * 2989 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}. 2990 * Returns failure if can't allocate memory. 2991 */ 2992 int 2993 tcp_build_hdrs(tcp_t *tcp) 2994 { 2995 tcp_stack_t *tcps = tcp->tcp_tcps; 2996 conn_t *connp = tcp->tcp_connp; 2997 char buf[TCP_MAX_HDR_LENGTH]; 2998 uint_t buflen; 2999 uint_t ulplen = TCP_MIN_HEADER_LENGTH; 3000 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH; 3001 tcpha_t *tcpha; 3002 uint32_t cksum; 3003 int error; 3004 3005 /* 3006 * We might be called after the connection is set up, and we might 3007 * have TS options already in the TCP header. Thus we save any 3008 * existing tcp header. 3009 */ 3010 buflen = connp->conn_ht_ulp_len; 3011 if (buflen != 0) { 3012 bcopy(connp->conn_ht_ulp, buf, buflen); 3013 extralen -= buflen - ulplen; 3014 ulplen = buflen; 3015 } 3016 3017 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */ 3018 mutex_enter(&connp->conn_lock); 3019 error = conn_build_hdr_template(connp, ulplen, extralen, 3020 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo); 3021 mutex_exit(&connp->conn_lock); 3022 if (error != 0) 3023 return (error); 3024 3025 /* 3026 * Any routing header/option has been massaged. The checksum difference 3027 * is stored in conn_sum for later use. 3028 */ 3029 tcpha = (tcpha_t *)connp->conn_ht_ulp; 3030 tcp->tcp_tcpha = tcpha; 3031 3032 /* restore any old tcp header */ 3033 if (buflen != 0) { 3034 bcopy(buf, connp->conn_ht_ulp, buflen); 3035 } else { 3036 tcpha->tha_sum = 0; 3037 tcpha->tha_urp = 0; 3038 tcpha->tha_ack = 0; 3039 tcpha->tha_offset_and_reserved = (5 << 4); 3040 tcpha->tha_lport = connp->conn_lport; 3041 tcpha->tha_fport = connp->conn_fport; 3042 } 3043 3044 /* 3045 * IP wants our header length in the checksum field to 3046 * allow it to perform a single pseudo-header+checksum 3047 * calculation on behalf of TCP. 3048 * Include the adjustment for a source route once IP_OPTIONS is set. 3049 */ 3050 cksum = sizeof (tcpha_t) + connp->conn_sum; 3051 cksum = (cksum >> 16) + (cksum & 0xFFFF); 3052 ASSERT(cksum < 0x10000); 3053 tcpha->tha_sum = htons(cksum); 3054 3055 if (connp->conn_ipversion == IPV4_VERSION) 3056 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc; 3057 else 3058 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc; 3059 3060 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra > 3061 connp->conn_wroff) { 3062 connp->conn_wroff = connp->conn_ht_iphc_allocated + 3063 tcps->tcps_wroff_xtra; 3064 (void) proto_set_tx_wroff(connp->conn_rq, connp, 3065 connp->conn_wroff); 3066 } 3067 return (0); 3068 } 3069 3070 /* Get callback routine passed to nd_load by tcp_param_register */ 3071 /* ARGSUSED */ 3072 static int 3073 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 3074 { 3075 tcpparam_t *tcppa = (tcpparam_t *)cp; 3076 3077 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 3078 return (0); 3079 } 3080 3081 /* 3082 * Walk through the param array specified registering each element with the 3083 * named dispatch handler. 3084 */ 3085 static boolean_t 3086 tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, tcp_stack_t *tcps) 3087 { 3088 for (; cnt-- > 0; tcppa++) { 3089 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 3090 if (!nd_load(ndp, tcppa->tcp_param_name, 3091 tcp_param_get, tcp_param_set, 3092 (caddr_t)tcppa)) { 3093 nd_free(ndp); 3094 return (B_FALSE); 3095 } 3096 } 3097 } 3098 tcps->tcps_wroff_xtra_param = kmem_zalloc(sizeof (tcpparam_t), 3099 KM_SLEEP); 3100 bcopy(&lcl_tcp_wroff_xtra_param, tcps->tcps_wroff_xtra_param, 3101 sizeof (tcpparam_t)); 3102 if (!nd_load(ndp, tcps->tcps_wroff_xtra_param->tcp_param_name, 3103 tcp_param_get, tcp_param_set_aligned, 3104 (caddr_t)tcps->tcps_wroff_xtra_param)) { 3105 nd_free(ndp); 3106 return (B_FALSE); 3107 } 3108 if (!nd_load(ndp, "tcp_extra_priv_ports", 3109 tcp_extra_priv_ports_get, NULL, NULL)) { 3110 nd_free(ndp); 3111 return (B_FALSE); 3112 } 3113 if (!nd_load(ndp, "tcp_extra_priv_ports_add", 3114 NULL, tcp_extra_priv_ports_add, NULL)) { 3115 nd_free(ndp); 3116 return (B_FALSE); 3117 } 3118 if (!nd_load(ndp, "tcp_extra_priv_ports_del", 3119 NULL, tcp_extra_priv_ports_del, NULL)) { 3120 nd_free(ndp); 3121 return (B_FALSE); 3122 } 3123 if (!nd_load(ndp, "tcp_1948_phrase", NULL, 3124 tcp_1948_phrase_set, NULL)) { 3125 nd_free(ndp); 3126 return (B_FALSE); 3127 } 3128 3129 3130 if (!nd_load(ndp, "tcp_listener_limit_conf", 3131 tcp_listener_conf_get, NULL, NULL)) { 3132 nd_free(ndp); 3133 return (B_FALSE); 3134 } 3135 if (!nd_load(ndp, "tcp_listener_limit_conf_add", 3136 NULL, tcp_listener_conf_add, NULL)) { 3137 nd_free(ndp); 3138 return (B_FALSE); 3139 } 3140 if (!nd_load(ndp, "tcp_listener_limit_conf_del", 3141 NULL, tcp_listener_conf_del, NULL)) { 3142 nd_free(ndp); 3143 return (B_FALSE); 3144 } 3145 3146 /* 3147 * Dummy ndd variables - only to convey obsolescence information 3148 * through printing of their name (no get or set routines) 3149 * XXX Remove in future releases ? 3150 */ 3151 if (!nd_load(ndp, 3152 "tcp_close_wait_interval(obsoleted - " 3153 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 3154 nd_free(ndp); 3155 return (B_FALSE); 3156 } 3157 return (B_TRUE); 3158 } 3159 3160 /* ndd set routine for tcp_wroff_xtra. */ 3161 /* ARGSUSED */ 3162 static int 3163 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 3164 cred_t *cr) 3165 { 3166 long new_value; 3167 tcpparam_t *tcppa = (tcpparam_t *)cp; 3168 3169 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 3170 new_value < tcppa->tcp_param_min || 3171 new_value > tcppa->tcp_param_max) { 3172 return (EINVAL); 3173 } 3174 /* 3175 * Need to make sure new_value is a multiple of 4. If it is not, 3176 * round it up. For future 64 bit requirement, we actually make it 3177 * a multiple of 8. 3178 */ 3179 if (new_value & 0x7) { 3180 new_value = (new_value & ~0x7) + 0x8; 3181 } 3182 tcppa->tcp_param_val = new_value; 3183 return (0); 3184 } 3185 3186 /* Set callback routine passed to nd_load by tcp_param_register */ 3187 /* ARGSUSED */ 3188 static int 3189 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 3190 { 3191 long new_value; 3192 tcpparam_t *tcppa = (tcpparam_t *)cp; 3193 3194 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 3195 new_value < tcppa->tcp_param_min || 3196 new_value > tcppa->tcp_param_max) { 3197 return (EINVAL); 3198 } 3199 tcppa->tcp_param_val = new_value; 3200 return (0); 3201 } 3202 3203 /* 3204 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 3205 * We do not allow the receive window to shrink. After setting rwnd, 3206 * set the flow control hiwat of the stream. 3207 * 3208 * This function is called in 2 cases: 3209 * 3210 * 1) Before data transfer begins, in tcp_input_listener() for accepting a 3211 * connection (passive open) and in tcp_input_data() for active connect. 3212 * This is called after tcp_mss_set() when the desired MSS value is known. 3213 * This makes sure that our window size is a mutiple of the other side's 3214 * MSS. 3215 * 2) Handling SO_RCVBUF option. 3216 * 3217 * It is ASSUMED that the requested size is a multiple of the current MSS. 3218 * 3219 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 3220 * user requests so. 3221 */ 3222 int 3223 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 3224 { 3225 uint32_t mss = tcp->tcp_mss; 3226 uint32_t old_max_rwnd; 3227 uint32_t max_transmittable_rwnd; 3228 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 3229 tcp_stack_t *tcps = tcp->tcp_tcps; 3230 conn_t *connp = tcp->tcp_connp; 3231 3232 /* 3233 * Insist on a receive window that is at least 3234 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 3235 * funny TCP interactions of Nagle algorithm, SWS avoidance 3236 * and delayed acknowledgement. 3237 */ 3238 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); 3239 3240 if (tcp->tcp_fused) { 3241 size_t sth_hiwat; 3242 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 3243 3244 ASSERT(peer_tcp != NULL); 3245 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 3246 if (!tcp_detached) { 3247 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 3248 sth_hiwat); 3249 tcp_set_recv_threshold(tcp, sth_hiwat >> 3); 3250 } 3251 3252 /* Caller could have changed tcp_rwnd; update tha_win */ 3253 if (tcp->tcp_tcpha != NULL) { 3254 tcp->tcp_tcpha->tha_win = 3255 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3256 } 3257 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3258 tcp->tcp_cwnd_max = rwnd; 3259 3260 /* 3261 * In the fusion case, the maxpsz stream head value of 3262 * our peer is set according to its send buffer size 3263 * and our receive buffer size; since the latter may 3264 * have changed we need to update the peer's maxpsz. 3265 */ 3266 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 3267 return (sth_hiwat); 3268 } 3269 3270 if (tcp_detached) 3271 old_max_rwnd = tcp->tcp_rwnd; 3272 else 3273 old_max_rwnd = connp->conn_rcvbuf; 3274 3275 3276 /* 3277 * If window size info has already been exchanged, TCP should not 3278 * shrink the window. Shrinking window is doable if done carefully. 3279 * We may add that support later. But so far there is not a real 3280 * need to do that. 3281 */ 3282 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 3283 /* MSS may have changed, do a round up again. */ 3284 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 3285 } 3286 3287 /* 3288 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 3289 * can be applied even before the window scale option is decided. 3290 */ 3291 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 3292 if (rwnd > max_transmittable_rwnd) { 3293 rwnd = max_transmittable_rwnd - 3294 (max_transmittable_rwnd % mss); 3295 if (rwnd < mss) 3296 rwnd = max_transmittable_rwnd; 3297 /* 3298 * If we're over the limit we may have to back down tcp_rwnd. 3299 * The increment below won't work for us. So we set all three 3300 * here and the increment below will have no effect. 3301 */ 3302 tcp->tcp_rwnd = old_max_rwnd = rwnd; 3303 } 3304 if (tcp->tcp_localnet) { 3305 tcp->tcp_rack_abs_max = 3306 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); 3307 } else { 3308 /* 3309 * For a remote host on a different subnet (through a router), 3310 * we ack every other packet to be conforming to RFC1122. 3311 * tcp_deferred_acks_max is default to 2. 3312 */ 3313 tcp->tcp_rack_abs_max = 3314 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); 3315 } 3316 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 3317 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 3318 else 3319 tcp->tcp_rack_cur_max = 0; 3320 /* 3321 * Increment the current rwnd by the amount the maximum grew (we 3322 * can not overwrite it since we might be in the middle of a 3323 * connection.) 3324 */ 3325 tcp->tcp_rwnd += rwnd - old_max_rwnd; 3326 connp->conn_rcvbuf = rwnd; 3327 3328 /* Are we already connected? */ 3329 if (tcp->tcp_tcpha != NULL) { 3330 tcp->tcp_tcpha->tha_win = 3331 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3332 } 3333 3334 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3335 tcp->tcp_cwnd_max = rwnd; 3336 3337 if (tcp_detached) 3338 return (rwnd); 3339 3340 tcp_set_recv_threshold(tcp, rwnd >> 3); 3341 3342 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd); 3343 return (rwnd); 3344 } 3345 3346 int 3347 tcp_do_unbind(conn_t *connp) 3348 { 3349 tcp_t *tcp = connp->conn_tcp; 3350 3351 switch (tcp->tcp_state) { 3352 case TCPS_BOUND: 3353 case TCPS_LISTEN: 3354 break; 3355 default: 3356 return (-TOUTSTATE); 3357 } 3358 3359 /* 3360 * Need to clean up all the eagers since after the unbind, segments 3361 * will no longer be delivered to this listener stream. 3362 */ 3363 mutex_enter(&tcp->tcp_eager_lock); 3364 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 3365 tcp_eager_cleanup(tcp, 0); 3366 } 3367 mutex_exit(&tcp->tcp_eager_lock); 3368 3369 /* Clean up the listener connection counter if necessary. */ 3370 if (tcp->tcp_listen_cnt != NULL) 3371 TCP_DECR_LISTEN_CNT(tcp); 3372 connp->conn_laddr_v6 = ipv6_all_zeros; 3373 connp->conn_saddr_v6 = ipv6_all_zeros; 3374 tcp_bind_hash_remove(tcp); 3375 tcp->tcp_state = TCPS_IDLE; 3376 3377 ip_unbind(connp); 3378 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 3379 3380 return (0); 3381 } 3382 3383 /* 3384 * This runs at the tail end of accept processing on the squeue of the 3385 * new connection. 3386 */ 3387 /* ARGSUSED */ 3388 void 3389 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 3390 { 3391 conn_t *connp = (conn_t *)arg; 3392 tcp_t *tcp = connp->conn_tcp; 3393 queue_t *q = connp->conn_rq; 3394 tcp_stack_t *tcps = tcp->tcp_tcps; 3395 /* socket options */ 3396 struct sock_proto_props sopp; 3397 3398 /* We should just receive a single mblk that fits a T_discon_ind */ 3399 ASSERT(mp->b_cont == NULL); 3400 3401 /* 3402 * Drop the eager's ref on the listener, that was placed when 3403 * this eager began life in tcp_input_listener. 3404 */ 3405 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 3406 if (IPCL_IS_NONSTR(connp)) { 3407 /* Safe to free conn_ind message */ 3408 freemsg(tcp->tcp_conn.tcp_eager_conn_ind); 3409 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3410 } 3411 3412 tcp->tcp_detached = B_FALSE; 3413 3414 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 3415 /* 3416 * Someone blewoff the eager before we could finish 3417 * the accept. 3418 * 3419 * The only reason eager exists it because we put in 3420 * a ref on it when conn ind went up. We need to send 3421 * a disconnect indication up while the last reference 3422 * on the eager will be dropped by the squeue when we 3423 * return. 3424 */ 3425 ASSERT(tcp->tcp_listener == NULL); 3426 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 3427 if (IPCL_IS_NONSTR(connp)) { 3428 ASSERT(tcp->tcp_issocket); 3429 (*connp->conn_upcalls->su_disconnected)( 3430 connp->conn_upper_handle, tcp->tcp_connid, 3431 ECONNREFUSED); 3432 freemsg(mp); 3433 } else { 3434 struct T_discon_ind *tdi; 3435 3436 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 3437 /* 3438 * Let us reuse the incoming mblk to avoid 3439 * memory allocation failure problems. We know 3440 * that the size of the incoming mblk i.e. 3441 * stroptions is greater than sizeof 3442 * T_discon_ind. 3443 */ 3444 ASSERT(DB_REF(mp) == 1); 3445 ASSERT(MBLKSIZE(mp) >= 3446 sizeof (struct T_discon_ind)); 3447 3448 DB_TYPE(mp) = M_PROTO; 3449 ((union T_primitives *)mp->b_rptr)->type = 3450 T_DISCON_IND; 3451 tdi = (struct T_discon_ind *)mp->b_rptr; 3452 if (tcp->tcp_issocket) { 3453 tdi->DISCON_reason = ECONNREFUSED; 3454 tdi->SEQ_number = 0; 3455 } else { 3456 tdi->DISCON_reason = ENOPROTOOPT; 3457 tdi->SEQ_number = 3458 tcp->tcp_conn_req_seqnum; 3459 } 3460 mp->b_wptr = mp->b_rptr + 3461 sizeof (struct T_discon_ind); 3462 putnext(q, mp); 3463 } 3464 } 3465 tcp->tcp_hard_binding = B_FALSE; 3466 return; 3467 } 3468 3469 /* 3470 * This is the first time we run on the correct 3471 * queue after tcp_accept. So fix all the q parameters 3472 * here. 3473 */ 3474 sopp.sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF; 3475 sopp.sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 3476 3477 sopp.sopp_rxhiwat = tcp->tcp_fused ? 3478 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) : 3479 connp->conn_rcvbuf; 3480 3481 /* 3482 * Determine what write offset value to use depending on SACK and 3483 * whether the endpoint is fused or not. 3484 */ 3485 if (tcp->tcp_fused) { 3486 ASSERT(tcp->tcp_loopback); 3487 ASSERT(tcp->tcp_loopback_peer != NULL); 3488 /* 3489 * For fused tcp loopback, set the stream head's write 3490 * offset value to zero since we won't be needing any room 3491 * for TCP/IP headers. This would also improve performance 3492 * since it would reduce the amount of work done by kmem. 3493 * Non-fused tcp loopback case is handled separately below. 3494 */ 3495 sopp.sopp_wroff = 0; 3496 /* 3497 * Update the peer's transmit parameters according to 3498 * our recently calculated high water mark value. 3499 */ 3500 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 3501 } else if (tcp->tcp_snd_sack_ok) { 3502 sopp.sopp_wroff = connp->conn_ht_iphc_allocated + 3503 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 3504 } else { 3505 sopp.sopp_wroff = connp->conn_ht_iphc_len + 3506 (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra); 3507 } 3508 3509 /* 3510 * If this is endpoint is handling SSL, then reserve extra 3511 * offset and space at the end. 3512 * Also have the stream head allocate SSL3_MAX_RECORD_LEN packets, 3513 * overriding the previous setting. The extra cost of signing and 3514 * encrypting multiple MSS-size records (12 of them with Ethernet), 3515 * instead of a single contiguous one by the stream head 3516 * largely outweighs the statistical reduction of ACKs, when 3517 * applicable. The peer will also save on decryption and verification 3518 * costs. 3519 */ 3520 if (tcp->tcp_kssl_ctx != NULL) { 3521 sopp.sopp_wroff += SSL3_WROFFSET; 3522 3523 sopp.sopp_flags |= SOCKOPT_TAIL; 3524 sopp.sopp_tail = SSL3_MAX_TAIL_LEN; 3525 3526 sopp.sopp_flags |= SOCKOPT_ZCOPY; 3527 sopp.sopp_zcopyflag = ZCVMUNSAFE; 3528 3529 sopp.sopp_maxblk = SSL3_MAX_RECORD_LEN; 3530 } 3531 3532 /* Send the options up */ 3533 if (IPCL_IS_NONSTR(connp)) { 3534 if (sopp.sopp_flags & SOCKOPT_TAIL) { 3535 ASSERT(tcp->tcp_kssl_ctx != NULL); 3536 ASSERT(sopp.sopp_flags & SOCKOPT_ZCOPY); 3537 } 3538 if (tcp->tcp_loopback) { 3539 sopp.sopp_flags |= SOCKOPT_LOOPBACK; 3540 sopp.sopp_loopback = B_TRUE; 3541 } 3542 (*connp->conn_upcalls->su_set_proto_props) 3543 (connp->conn_upper_handle, &sopp); 3544 freemsg(mp); 3545 } else { 3546 /* 3547 * Let us reuse the incoming mblk to avoid 3548 * memory allocation failure problems. We know 3549 * that the size of the incoming mblk is at least 3550 * stroptions 3551 */ 3552 struct stroptions *stropt; 3553 3554 ASSERT(DB_REF(mp) == 1); 3555 ASSERT(MBLKSIZE(mp) >= sizeof (struct stroptions)); 3556 3557 DB_TYPE(mp) = M_SETOPTS; 3558 stropt = (struct stroptions *)mp->b_rptr; 3559 mp->b_wptr = mp->b_rptr + sizeof (struct stroptions); 3560 stropt = (struct stroptions *)mp->b_rptr; 3561 stropt->so_flags = SO_HIWAT | SO_WROFF | SO_MAXBLK; 3562 stropt->so_hiwat = sopp.sopp_rxhiwat; 3563 stropt->so_wroff = sopp.sopp_wroff; 3564 stropt->so_maxblk = sopp.sopp_maxblk; 3565 3566 if (sopp.sopp_flags & SOCKOPT_TAIL) { 3567 ASSERT(tcp->tcp_kssl_ctx != NULL); 3568 3569 stropt->so_flags |= SO_TAIL | SO_COPYOPT; 3570 stropt->so_tail = sopp.sopp_tail; 3571 stropt->so_copyopt = sopp.sopp_zcopyflag; 3572 } 3573 3574 /* Send the options up */ 3575 putnext(q, mp); 3576 } 3577 3578 /* 3579 * Pass up any data and/or a fin that has been received. 3580 * 3581 * Adjust receive window in case it had decreased 3582 * (because there is data <=> tcp_rcv_list != NULL) 3583 * while the connection was detached. Note that 3584 * in case the eager was flow-controlled, w/o this 3585 * code, the rwnd may never open up again! 3586 */ 3587 if (tcp->tcp_rcv_list != NULL) { 3588 if (IPCL_IS_NONSTR(connp)) { 3589 mblk_t *mp; 3590 int space_left; 3591 int error; 3592 boolean_t push = B_TRUE; 3593 3594 if (!tcp->tcp_fused && (*connp->conn_upcalls->su_recv) 3595 (connp->conn_upper_handle, NULL, 0, 0, &error, 3596 &push) >= 0) { 3597 tcp->tcp_rwnd = connp->conn_rcvbuf; 3598 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3599 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 3600 tcp_xmit_ctl(NULL, 3601 tcp, (tcp->tcp_swnd == 0) ? 3602 tcp->tcp_suna : tcp->tcp_snxt, 3603 tcp->tcp_rnxt, TH_ACK); 3604 } 3605 } 3606 while ((mp = tcp->tcp_rcv_list) != NULL) { 3607 push = B_TRUE; 3608 tcp->tcp_rcv_list = mp->b_next; 3609 mp->b_next = NULL; 3610 space_left = (*connp->conn_upcalls->su_recv) 3611 (connp->conn_upper_handle, mp, msgdsize(mp), 3612 0, &error, &push); 3613 if (space_left < 0) { 3614 /* 3615 * We should never be in middle of a 3616 * fallback, the squeue guarantees that. 3617 */ 3618 ASSERT(error != EOPNOTSUPP); 3619 } 3620 } 3621 tcp->tcp_rcv_last_head = NULL; 3622 tcp->tcp_rcv_last_tail = NULL; 3623 tcp->tcp_rcv_cnt = 0; 3624 } else { 3625 /* We drain directly in case of fused tcp loopback */ 3626 3627 if (!tcp->tcp_fused && canputnext(q)) { 3628 tcp->tcp_rwnd = connp->conn_rcvbuf; 3629 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3630 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 3631 tcp_xmit_ctl(NULL, 3632 tcp, (tcp->tcp_swnd == 0) ? 3633 tcp->tcp_suna : tcp->tcp_snxt, 3634 tcp->tcp_rnxt, TH_ACK); 3635 } 3636 } 3637 3638 (void) tcp_rcv_drain(tcp); 3639 } 3640 3641 /* 3642 * For fused tcp loopback, back-enable peer endpoint 3643 * if it's currently flow-controlled. 3644 */ 3645 if (tcp->tcp_fused) { 3646 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 3647 3648 ASSERT(peer_tcp != NULL); 3649 ASSERT(peer_tcp->tcp_fused); 3650 3651 mutex_enter(&peer_tcp->tcp_non_sq_lock); 3652 if (peer_tcp->tcp_flow_stopped) { 3653 tcp_clrqfull(peer_tcp); 3654 TCP_STAT(tcps, tcp_fusion_backenabled); 3655 } 3656 mutex_exit(&peer_tcp->tcp_non_sq_lock); 3657 } 3658 } 3659 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 3660 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 3661 tcp->tcp_ordrel_done = B_TRUE; 3662 if (IPCL_IS_NONSTR(connp)) { 3663 ASSERT(tcp->tcp_ordrel_mp == NULL); 3664 (*connp->conn_upcalls->su_opctl)( 3665 connp->conn_upper_handle, 3666 SOCK_OPCTL_SHUT_RECV, 0); 3667 } else { 3668 mp = tcp->tcp_ordrel_mp; 3669 tcp->tcp_ordrel_mp = NULL; 3670 putnext(q, mp); 3671 } 3672 } 3673 tcp->tcp_hard_binding = B_FALSE; 3674 3675 if (connp->conn_keepalive) { 3676 tcp->tcp_ka_last_intrvl = 0; 3677 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_timer, 3678 MSEC_TO_TICK(tcp->tcp_ka_interval)); 3679 } 3680 3681 /* 3682 * At this point, eager is fully established and will 3683 * have the following references - 3684 * 3685 * 2 references for connection to exist (1 for TCP and 1 for IP). 3686 * 1 reference for the squeue which will be dropped by the squeue as 3687 * soon as this function returns. 3688 * There will be 1 additonal reference for being in classifier 3689 * hash list provided something bad hasn't happened. 3690 */ 3691 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 3692 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 3693 } 3694 3695 /* 3696 * Common to TPI and sockfs accept code. 3697 */ 3698 /* ARGSUSED2 */ 3699 int 3700 tcp_accept_common(conn_t *lconnp, conn_t *econnp, cred_t *cr) 3701 { 3702 tcp_t *listener, *eager; 3703 mblk_t *discon_mp; 3704 3705 listener = lconnp->conn_tcp; 3706 ASSERT(listener->tcp_state == TCPS_LISTEN); 3707 eager = econnp->conn_tcp; 3708 ASSERT(eager->tcp_listener != NULL); 3709 3710 /* 3711 * Pre allocate the discon_ind mblk also. tcp_accept_finish will 3712 * use it if something failed. 3713 */ 3714 discon_mp = allocb(MAX(sizeof (struct T_discon_ind), 3715 sizeof (struct stroptions)), BPRI_HI); 3716 3717 if (discon_mp == NULL) { 3718 return (-TPROTO); 3719 } 3720 eager->tcp_issocket = B_TRUE; 3721 3722 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 3723 econnp->conn_allzones = listener->tcp_connp->conn_allzones; 3724 ASSERT(econnp->conn_netstack == 3725 listener->tcp_connp->conn_netstack); 3726 ASSERT(eager->tcp_tcps == listener->tcp_tcps); 3727 3728 /* Put the ref for IP */ 3729 CONN_INC_REF(econnp); 3730 3731 /* 3732 * We should have minimum of 3 references on the conn 3733 * at this point. One each for TCP and IP and one for 3734 * the T_conn_ind that was sent up when the 3-way handshake 3735 * completed. In the normal case we would also have another 3736 * reference (making a total of 4) for the conn being in the 3737 * classifier hash list. However the eager could have received 3738 * an RST subsequently and tcp_closei_local could have removed 3739 * the eager from the classifier hash list, hence we can't 3740 * assert that reference. 3741 */ 3742 ASSERT(econnp->conn_ref >= 3); 3743 3744 mutex_enter(&listener->tcp_eager_lock); 3745 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 3746 3747 tcp_t *tail; 3748 tcp_t *tcp; 3749 mblk_t *mp1; 3750 3751 tcp = listener->tcp_eager_prev_q0; 3752 /* 3753 * listener->tcp_eager_prev_q0 points to the TAIL of the 3754 * deferred T_conn_ind queue. We need to get to the head 3755 * of the queue in order to send up T_conn_ind the same 3756 * order as how the 3WHS is completed. 3757 */ 3758 while (tcp != listener) { 3759 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0 && 3760 !tcp->tcp_kssl_pending) 3761 break; 3762 else 3763 tcp = tcp->tcp_eager_prev_q0; 3764 } 3765 /* None of the pending eagers can be sent up now */ 3766 if (tcp == listener) 3767 goto no_more_eagers; 3768 3769 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 3770 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3771 /* Move from q0 to q */ 3772 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 3773 listener->tcp_conn_req_cnt_q0--; 3774 listener->tcp_conn_req_cnt_q++; 3775 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 3776 tcp->tcp_eager_prev_q0; 3777 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 3778 tcp->tcp_eager_next_q0; 3779 tcp->tcp_eager_prev_q0 = NULL; 3780 tcp->tcp_eager_next_q0 = NULL; 3781 tcp->tcp_conn_def_q0 = B_FALSE; 3782 3783 /* Make sure the tcp isn't in the list of droppables */ 3784 ASSERT(tcp->tcp_eager_next_drop_q0 == NULL && 3785 tcp->tcp_eager_prev_drop_q0 == NULL); 3786 3787 /* 3788 * Insert at end of the queue because sockfs sends 3789 * down T_CONN_RES in chronological order. Leaving 3790 * the older conn indications at front of the queue 3791 * helps reducing search time. 3792 */ 3793 tail = listener->tcp_eager_last_q; 3794 if (tail != NULL) { 3795 tail->tcp_eager_next_q = tcp; 3796 } else { 3797 listener->tcp_eager_next_q = tcp; 3798 } 3799 listener->tcp_eager_last_q = tcp; 3800 tcp->tcp_eager_next_q = NULL; 3801 3802 /* Need to get inside the listener perimeter */ 3803 CONN_INC_REF(listener->tcp_connp); 3804 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, mp1, 3805 tcp_send_pending, listener->tcp_connp, NULL, SQ_FILL, 3806 SQTAG_TCP_SEND_PENDING); 3807 } 3808 no_more_eagers: 3809 tcp_eager_unlink(eager); 3810 mutex_exit(&listener->tcp_eager_lock); 3811 3812 /* 3813 * At this point, the eager is detached from the listener 3814 * but we still have an extra refs on eager (apart from the 3815 * usual tcp references). The ref was placed in tcp_input_data 3816 * before sending the conn_ind in tcp_send_conn_ind. 3817 * The ref will be dropped in tcp_accept_finish(). 3818 */ 3819 SQUEUE_ENTER_ONE(econnp->conn_sqp, discon_mp, tcp_accept_finish, 3820 econnp, NULL, SQ_NODRAIN, SQTAG_TCP_ACCEPT_FINISH_Q0); 3821 return (0); 3822 } 3823 3824 /* 3825 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP. 3826 */ 3827 boolean_t 3828 tcp_zcopy_check(tcp_t *tcp) 3829 { 3830 conn_t *connp = tcp->tcp_connp; 3831 ip_xmit_attr_t *ixa = connp->conn_ixa; 3832 boolean_t zc_enabled = B_FALSE; 3833 tcp_stack_t *tcps = tcp->tcp_tcps; 3834 3835 if (do_tcpzcopy == 2) 3836 zc_enabled = B_TRUE; 3837 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB)) 3838 zc_enabled = B_TRUE; 3839 3840 tcp->tcp_snd_zcopy_on = zc_enabled; 3841 if (!TCP_IS_DETACHED(tcp)) { 3842 if (zc_enabled) { 3843 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY; 3844 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3845 ZCVMSAFE); 3846 TCP_STAT(tcps, tcp_zcopy_on); 3847 } else { 3848 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY; 3849 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3850 ZCVMUNSAFE); 3851 TCP_STAT(tcps, tcp_zcopy_off); 3852 } 3853 } 3854 return (zc_enabled); 3855 } 3856 3857 /* 3858 * Backoff from a zero-copy message by copying data to a new allocated 3859 * message and freeing the original desballoca'ed segmapped message. 3860 * 3861 * This function is called by following two callers: 3862 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free 3863 * the origial desballoca'ed message and notify sockfs. This is in re- 3864 * transmit state. 3865 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need 3866 * to be copied to new message. 3867 */ 3868 mblk_t * 3869 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist) 3870 { 3871 mblk_t *nbp; 3872 mblk_t *head = NULL; 3873 mblk_t *tail = NULL; 3874 tcp_stack_t *tcps = tcp->tcp_tcps; 3875 3876 ASSERT(bp != NULL); 3877 while (bp != NULL) { 3878 if (IS_VMLOANED_MBLK(bp)) { 3879 TCP_STAT(tcps, tcp_zcopy_backoff); 3880 if ((nbp = copyb(bp)) == NULL) { 3881 tcp->tcp_xmit_zc_clean = B_FALSE; 3882 if (tail != NULL) 3883 tail->b_cont = bp; 3884 return ((head == NULL) ? bp : head); 3885 } 3886 3887 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 3888 if (fix_xmitlist) 3889 tcp_zcopy_notify(tcp); 3890 else 3891 nbp->b_datap->db_struioflag |= 3892 STRUIO_ZCNOTIFY; 3893 } 3894 nbp->b_cont = bp->b_cont; 3895 3896 /* 3897 * Copy saved information and adjust tcp_xmit_tail 3898 * if needed. 3899 */ 3900 if (fix_xmitlist) { 3901 nbp->b_prev = bp->b_prev; 3902 nbp->b_next = bp->b_next; 3903 3904 if (tcp->tcp_xmit_tail == bp) 3905 tcp->tcp_xmit_tail = nbp; 3906 } 3907 3908 /* Free the original message. */ 3909 bp->b_prev = NULL; 3910 bp->b_next = NULL; 3911 freeb(bp); 3912 3913 bp = nbp; 3914 } 3915 3916 if (head == NULL) { 3917 head = bp; 3918 } 3919 if (tail == NULL) { 3920 tail = bp; 3921 } else { 3922 tail->b_cont = bp; 3923 tail = bp; 3924 } 3925 3926 /* Move forward. */ 3927 bp = bp->b_cont; 3928 } 3929 3930 if (fix_xmitlist) { 3931 tcp->tcp_xmit_last = tail; 3932 tcp->tcp_xmit_zc_clean = B_TRUE; 3933 } 3934 3935 return (head); 3936 } 3937 3938 void 3939 tcp_zcopy_notify(tcp_t *tcp) 3940 { 3941 struct stdata *stp; 3942 conn_t *connp; 3943 3944 if (tcp->tcp_detached) 3945 return; 3946 connp = tcp->tcp_connp; 3947 if (IPCL_IS_NONSTR(connp)) { 3948 (*connp->conn_upcalls->su_zcopy_notify) 3949 (connp->conn_upper_handle); 3950 return; 3951 } 3952 stp = STREAM(connp->conn_rq); 3953 mutex_enter(&stp->sd_lock); 3954 stp->sd_flag |= STZCNOTIFY; 3955 cv_broadcast(&stp->sd_zcopy_wait); 3956 mutex_exit(&stp->sd_lock); 3957 } 3958 3959 /* 3960 * Update the TCP connection according to change of LSO capability. 3961 */ 3962 static void 3963 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa) 3964 { 3965 /* 3966 * We check against IPv4 header length to preserve the old behavior 3967 * of only enabling LSO when there are no IP options. 3968 * But this restriction might not be necessary at all. Before removing 3969 * it, need to verify how LSO is handled for source routing case, with 3970 * which IP does software checksum. 3971 * 3972 * For IPv6, whenever any extension header is needed, LSO is supressed. 3973 */ 3974 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ? 3975 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN)) 3976 return; 3977 3978 /* 3979 * Either the LSO capability newly became usable, or it has changed. 3980 */ 3981 if (ixa->ixa_flags & IXAF_LSO_CAPAB) { 3982 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab; 3983 3984 ASSERT(lsoc->ill_lso_max > 0); 3985 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max); 3986 3987 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3988 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max); 3989 3990 /* 3991 * If LSO to be enabled, notify the STREAM header with larger 3992 * data block. 3993 */ 3994 if (!tcp->tcp_lso) 3995 tcp->tcp_maxpsz_multiplier = 0; 3996 3997 tcp->tcp_lso = B_TRUE; 3998 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled); 3999 } else { /* LSO capability is not usable any more. */ 4000 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 4001 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max); 4002 4003 /* 4004 * If LSO to be disabled, notify the STREAM header with smaller 4005 * data block. And need to restore fragsize to PMTU. 4006 */ 4007 if (tcp->tcp_lso) { 4008 tcp->tcp_maxpsz_multiplier = 4009 tcp->tcp_tcps->tcps_maxpsz_multiplier; 4010 ixa->ixa_fragsize = ixa->ixa_pmtu; 4011 tcp->tcp_lso = B_FALSE; 4012 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled); 4013 } 4014 } 4015 4016 (void) tcp_maxpsz_set(tcp, B_TRUE); 4017 } 4018 4019 /* 4020 * Update the TCP connection according to change of ZEROCOPY capability. 4021 */ 4022 static void 4023 tcp_update_zcopy(tcp_t *tcp) 4024 { 4025 conn_t *connp = tcp->tcp_connp; 4026 tcp_stack_t *tcps = tcp->tcp_tcps; 4027 4028 if (tcp->tcp_snd_zcopy_on) { 4029 tcp->tcp_snd_zcopy_on = B_FALSE; 4030 if (!TCP_IS_DETACHED(tcp)) { 4031 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 4032 ZCVMUNSAFE); 4033 TCP_STAT(tcps, tcp_zcopy_off); 4034 } 4035 } else { 4036 tcp->tcp_snd_zcopy_on = B_TRUE; 4037 if (!TCP_IS_DETACHED(tcp)) { 4038 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 4039 ZCVMSAFE); 4040 TCP_STAT(tcps, tcp_zcopy_on); 4041 } 4042 } 4043 } 4044 4045 /* 4046 * Notify function registered with ip_xmit_attr_t. It's called in the squeue 4047 * so it's safe to update the TCP connection. 4048 */ 4049 /* ARGSUSED1 */ 4050 static void 4051 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 4052 ixa_notify_arg_t narg) 4053 { 4054 tcp_t *tcp = (tcp_t *)arg; 4055 conn_t *connp = tcp->tcp_connp; 4056 4057 switch (ntype) { 4058 case IXAN_LSO: 4059 tcp_update_lso(tcp, connp->conn_ixa); 4060 break; 4061 case IXAN_PMTU: 4062 tcp_update_pmtu(tcp, B_FALSE); 4063 break; 4064 case IXAN_ZCOPY: 4065 tcp_update_zcopy(tcp); 4066 break; 4067 default: 4068 break; 4069 } 4070 } 4071 4072 /* 4073 * The TCP write service routine should never be called... 4074 */ 4075 /* ARGSUSED */ 4076 static void 4077 tcp_wsrv(queue_t *q) 4078 { 4079 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 4080 4081 TCP_STAT(tcps, tcp_wsrv_called); 4082 } 4083 4084 /* 4085 * Hash list lookup routine for tcp_t structures. 4086 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 4087 */ 4088 tcp_t * 4089 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps) 4090 { 4091 tf_t *tf; 4092 tcp_t *tcp; 4093 4094 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 4095 mutex_enter(&tf->tf_lock); 4096 for (tcp = tf->tf_tcp; tcp != NULL; 4097 tcp = tcp->tcp_acceptor_hash) { 4098 if (tcp->tcp_acceptor_id == id) { 4099 CONN_INC_REF(tcp->tcp_connp); 4100 mutex_exit(&tf->tf_lock); 4101 return (tcp); 4102 } 4103 } 4104 mutex_exit(&tf->tf_lock); 4105 return (NULL); 4106 } 4107 4108 /* 4109 * Hash list insertion routine for tcp_t structures. 4110 */ 4111 void 4112 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 4113 { 4114 tf_t *tf; 4115 tcp_t **tcpp; 4116 tcp_t *tcpnext; 4117 tcp_stack_t *tcps = tcp->tcp_tcps; 4118 4119 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 4120 4121 if (tcp->tcp_ptpahn != NULL) 4122 tcp_acceptor_hash_remove(tcp); 4123 tcpp = &tf->tf_tcp; 4124 mutex_enter(&tf->tf_lock); 4125 tcpnext = tcpp[0]; 4126 if (tcpnext) 4127 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 4128 tcp->tcp_acceptor_hash = tcpnext; 4129 tcp->tcp_ptpahn = tcpp; 4130 tcpp[0] = tcp; 4131 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 4132 mutex_exit(&tf->tf_lock); 4133 } 4134 4135 /* 4136 * Hash list removal routine for tcp_t structures. 4137 */ 4138 void 4139 tcp_acceptor_hash_remove(tcp_t *tcp) 4140 { 4141 tcp_t *tcpnext; 4142 kmutex_t *lockp; 4143 4144 /* 4145 * Extract the lock pointer in case there are concurrent 4146 * hash_remove's for this instance. 4147 */ 4148 lockp = tcp->tcp_acceptor_lockp; 4149 4150 if (tcp->tcp_ptpahn == NULL) 4151 return; 4152 4153 ASSERT(lockp != NULL); 4154 mutex_enter(lockp); 4155 if (tcp->tcp_ptpahn) { 4156 tcpnext = tcp->tcp_acceptor_hash; 4157 if (tcpnext) { 4158 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 4159 tcp->tcp_acceptor_hash = NULL; 4160 } 4161 *tcp->tcp_ptpahn = tcpnext; 4162 tcp->tcp_ptpahn = NULL; 4163 } 4164 mutex_exit(lockp); 4165 tcp->tcp_acceptor_lockp = NULL; 4166 } 4167 4168 /* 4169 * Type three generator adapted from the random() function in 4.4 BSD: 4170 */ 4171 4172 /* 4173 * Copyright (c) 1983, 1993 4174 * The Regents of the University of California. All rights reserved. 4175 * 4176 * Redistribution and use in source and binary forms, with or without 4177 * modification, are permitted provided that the following conditions 4178 * are met: 4179 * 1. Redistributions of source code must retain the above copyright 4180 * notice, this list of conditions and the following disclaimer. 4181 * 2. Redistributions in binary form must reproduce the above copyright 4182 * notice, this list of conditions and the following disclaimer in the 4183 * documentation and/or other materials provided with the distribution. 4184 * 3. All advertising materials mentioning features or use of this software 4185 * must display the following acknowledgement: 4186 * This product includes software developed by the University of 4187 * California, Berkeley and its contributors. 4188 * 4. Neither the name of the University nor the names of its contributors 4189 * may be used to endorse or promote products derived from this software 4190 * without specific prior written permission. 4191 * 4192 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 4193 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 4194 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 4195 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 4196 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 4197 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 4198 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 4199 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 4200 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 4201 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 4202 * SUCH DAMAGE. 4203 */ 4204 4205 /* Type 3 -- x**31 + x**3 + 1 */ 4206 #define DEG_3 31 4207 #define SEP_3 3 4208 4209 4210 /* Protected by tcp_random_lock */ 4211 static int tcp_randtbl[DEG_3 + 1]; 4212 4213 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 4214 static int *tcp_random_rptr = &tcp_randtbl[1]; 4215 4216 static int *tcp_random_state = &tcp_randtbl[1]; 4217 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 4218 4219 kmutex_t tcp_random_lock; 4220 4221 void 4222 tcp_random_init(void) 4223 { 4224 int i; 4225 hrtime_t hrt; 4226 time_t wallclock; 4227 uint64_t result; 4228 4229 /* 4230 * Use high-res timer and current time for seed. Gethrtime() returns 4231 * a longlong, which may contain resolution down to nanoseconds. 4232 * The current time will either be a 32-bit or a 64-bit quantity. 4233 * XOR the two together in a 64-bit result variable. 4234 * Convert the result to a 32-bit value by multiplying the high-order 4235 * 32-bits by the low-order 32-bits. 4236 */ 4237 4238 hrt = gethrtime(); 4239 (void) drv_getparm(TIME, &wallclock); 4240 result = (uint64_t)wallclock ^ (uint64_t)hrt; 4241 mutex_enter(&tcp_random_lock); 4242 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 4243 (result & 0xffffffff); 4244 4245 for (i = 1; i < DEG_3; i++) 4246 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 4247 + 12345; 4248 tcp_random_fptr = &tcp_random_state[SEP_3]; 4249 tcp_random_rptr = &tcp_random_state[0]; 4250 mutex_exit(&tcp_random_lock); 4251 for (i = 0; i < 10 * DEG_3; i++) 4252 (void) tcp_random(); 4253 } 4254 4255 /* 4256 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 4257 * This range is selected to be approximately centered on TCP_ISS / 2, 4258 * and easy to compute. We get this value by generating a 32-bit random 4259 * number, selecting out the high-order 17 bits, and then adding one so 4260 * that we never return zero. 4261 */ 4262 int 4263 tcp_random(void) 4264 { 4265 int i; 4266 4267 mutex_enter(&tcp_random_lock); 4268 *tcp_random_fptr += *tcp_random_rptr; 4269 4270 /* 4271 * The high-order bits are more random than the low-order bits, 4272 * so we select out the high-order 17 bits and add one so that 4273 * we never return zero. 4274 */ 4275 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 4276 if (++tcp_random_fptr >= tcp_random_end_ptr) { 4277 tcp_random_fptr = tcp_random_state; 4278 ++tcp_random_rptr; 4279 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 4280 tcp_random_rptr = tcp_random_state; 4281 4282 mutex_exit(&tcp_random_lock); 4283 return (i); 4284 } 4285 4286 /* 4287 * Split this function out so that if the secret changes, I'm okay. 4288 * 4289 * Initialize the tcp_iss_cookie and tcp_iss_key. 4290 */ 4291 4292 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 4293 4294 static void 4295 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps) 4296 { 4297 struct { 4298 int32_t current_time; 4299 uint32_t randnum; 4300 uint16_t pad; 4301 uint8_t ether[6]; 4302 uint8_t passwd[PASSWD_SIZE]; 4303 } tcp_iss_cookie; 4304 time_t t; 4305 4306 /* 4307 * Start with the current absolute time. 4308 */ 4309 (void) drv_getparm(TIME, &t); 4310 tcp_iss_cookie.current_time = t; 4311 4312 /* 4313 * XXX - Need a more random number per RFC 1750, not this crap. 4314 * OTOH, if what follows is pretty random, then I'm in better shape. 4315 */ 4316 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 4317 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 4318 4319 /* 4320 * The cpu_type_info is pretty non-random. Ugggh. It does serve 4321 * as a good template. 4322 */ 4323 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 4324 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 4325 4326 /* 4327 * The pass-phrase. Normally this is supplied by user-called NDD. 4328 */ 4329 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 4330 4331 /* 4332 * See 4010593 if this section becomes a problem again, 4333 * but the local ethernet address is useful here. 4334 */ 4335 (void) localetheraddr(NULL, 4336 (struct ether_addr *)&tcp_iss_cookie.ether); 4337 4338 /* 4339 * Hash 'em all together. The MD5Final is called per-connection. 4340 */ 4341 mutex_enter(&tcps->tcps_iss_key_lock); 4342 MD5Init(&tcps->tcps_iss_key); 4343 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie, 4344 sizeof (tcp_iss_cookie)); 4345 mutex_exit(&tcps->tcps_iss_key_lock); 4346 } 4347 4348 /* 4349 * Set the RFC 1948 pass phrase 4350 */ 4351 /* ARGSUSED */ 4352 static int 4353 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 4354 cred_t *cr) 4355 { 4356 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 4357 4358 /* 4359 * Basically, value contains a new pass phrase. Pass it along! 4360 */ 4361 tcp_iss_key_init((uint8_t *)value, strlen(value), tcps); 4362 return (0); 4363 } 4364 4365 /* ARGSUSED */ 4366 static int 4367 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 4368 { 4369 bzero(buf, sizeof (tcp_sack_info_t)); 4370 return (0); 4371 } 4372 4373 /* 4374 * Called by IP when IP is loaded into the kernel 4375 */ 4376 void 4377 tcp_ddi_g_init(void) 4378 { 4379 tcp_timercache = kmem_cache_create("tcp_timercache", 4380 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 4381 NULL, NULL, NULL, NULL, NULL, 0); 4382 4383 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 4384 sizeof (tcp_sack_info_t), 0, 4385 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 4386 4387 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 4388 4389 /* Initialize the random number generator */ 4390 tcp_random_init(); 4391 4392 /* A single callback independently of how many netstacks we have */ 4393 ip_squeue_init(tcp_squeue_add); 4394 4395 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics); 4396 4397 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput); 4398 4399 /* 4400 * We want to be informed each time a stack is created or 4401 * destroyed in the kernel, so we can maintain the 4402 * set of tcp_stack_t's. 4403 */ 4404 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini); 4405 4406 mutex_enter(&cpu_lock); 4407 register_cpu_setup_func(tcp_cpu_update, NULL); 4408 mutex_exit(&cpu_lock); 4409 } 4410 4411 4412 #define INET_NAME "ip" 4413 4414 /* 4415 * Initialize the TCP stack instance. 4416 */ 4417 static void * 4418 tcp_stack_init(netstackid_t stackid, netstack_t *ns) 4419 { 4420 tcp_stack_t *tcps; 4421 tcpparam_t *pa; 4422 int i; 4423 int error = 0; 4424 major_t major; 4425 4426 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP); 4427 tcps->tcps_netstack = ns; 4428 4429 /* Initialize locks */ 4430 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 4431 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 4432 4433 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 4434 tcps->tcps_g_epriv_ports[0] = 2049; 4435 tcps->tcps_g_epriv_ports[1] = 4045; 4436 tcps->tcps_min_anonpriv_port = 512; 4437 4438 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) * 4439 TCP_BIND_FANOUT_SIZE, KM_SLEEP); 4440 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) * 4441 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP); 4442 4443 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 4444 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL, 4445 MUTEX_DEFAULT, NULL); 4446 } 4447 4448 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 4449 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL, 4450 MUTEX_DEFAULT, NULL); 4451 } 4452 4453 /* TCP's IPsec code calls the packet dropper. */ 4454 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement"); 4455 4456 pa = (tcpparam_t *)kmem_alloc(sizeof (lcl_tcp_param_arr), KM_SLEEP); 4457 tcps->tcps_params = pa; 4458 bcopy(lcl_tcp_param_arr, tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 4459 4460 (void) tcp_param_register(&tcps->tcps_g_nd, tcps->tcps_params, 4461 A_CNT(lcl_tcp_param_arr), tcps); 4462 4463 /* 4464 * Note: To really walk the device tree you need the devinfo 4465 * pointer to your device which is only available after probe/attach. 4466 * The following is safe only because it uses ddi_root_node() 4467 */ 4468 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 4469 tcp_opt_obj.odb_opt_arr_cnt); 4470 4471 /* 4472 * Initialize RFC 1948 secret values. This will probably be reset once 4473 * by the boot scripts. 4474 * 4475 * Use NULL name, as the name is caught by the new lockstats. 4476 * 4477 * Initialize with some random, non-guessable string, like the global 4478 * T_INFO_ACK. 4479 */ 4480 4481 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 4482 sizeof (tcp_g_t_info_ack), tcps); 4483 4484 tcps->tcps_kstat = tcp_kstat2_init(stackid); 4485 tcps->tcps_mibkp = tcp_kstat_init(stackid); 4486 4487 major = mod_name_to_major(INET_NAME); 4488 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident); 4489 ASSERT(error == 0); 4490 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL); 4491 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL); 4492 cv_init(&tcps->tcps_ixa_cleanup_cv, NULL, CV_DEFAULT, NULL); 4493 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL); 4494 4495 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL); 4496 tcps->tcps_reclaim = B_FALSE; 4497 tcps->tcps_reclaim_tid = 0; 4498 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max; 4499 4500 /* 4501 * ncpus is the current number of CPUs, which can be bigger than 4502 * boot_ncpus. But we don't want to use ncpus to allocate all the 4503 * tcp_stats_cpu_t at system boot up time since it will be 1. While 4504 * we handle adding CPU in tcp_cpu_update(), it will be slow if 4505 * there are many CPUs as we will be adding them 1 by 1. 4506 * 4507 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers 4508 * are not freed until the stack is going away. So there is no need 4509 * to grab a lock to access the per CPU tcps_sc[x] pointer. 4510 */ 4511 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus); 4512 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *), 4513 KM_SLEEP); 4514 for (i = 0; i < tcps->tcps_sc_cnt; i++) { 4515 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t), 4516 KM_SLEEP); 4517 } 4518 4519 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL); 4520 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t), 4521 offsetof(tcp_listener_t, tl_link)); 4522 4523 return (tcps); 4524 } 4525 4526 /* 4527 * Called when the IP module is about to be unloaded. 4528 */ 4529 void 4530 tcp_ddi_g_destroy(void) 4531 { 4532 mutex_enter(&cpu_lock); 4533 unregister_cpu_setup_func(tcp_cpu_update, NULL); 4534 mutex_exit(&cpu_lock); 4535 4536 tcp_g_kstat_fini(tcp_g_kstat); 4537 tcp_g_kstat = NULL; 4538 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics)); 4539 4540 mutex_destroy(&tcp_random_lock); 4541 4542 kmem_cache_destroy(tcp_timercache); 4543 kmem_cache_destroy(tcp_sack_info_cache); 4544 4545 netstack_unregister(NS_TCP); 4546 } 4547 4548 /* 4549 * Free the TCP stack instance. 4550 */ 4551 static void 4552 tcp_stack_fini(netstackid_t stackid, void *arg) 4553 { 4554 tcp_stack_t *tcps = (tcp_stack_t *)arg; 4555 int i; 4556 4557 freeb(tcps->tcps_ixa_cleanup_mp); 4558 tcps->tcps_ixa_cleanup_mp = NULL; 4559 cv_destroy(&tcps->tcps_ixa_cleanup_cv); 4560 mutex_destroy(&tcps->tcps_ixa_cleanup_lock); 4561 4562 /* 4563 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart 4564 * the timer. 4565 */ 4566 mutex_enter(&tcps->tcps_reclaim_lock); 4567 tcps->tcps_reclaim = B_FALSE; 4568 mutex_exit(&tcps->tcps_reclaim_lock); 4569 if (tcps->tcps_reclaim_tid != 0) 4570 (void) untimeout(tcps->tcps_reclaim_tid); 4571 mutex_destroy(&tcps->tcps_reclaim_lock); 4572 4573 tcp_listener_conf_cleanup(tcps); 4574 4575 for (i = 0; i < tcps->tcps_sc_cnt; i++) 4576 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t)); 4577 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *)); 4578 4579 nd_free(&tcps->tcps_g_nd); 4580 kmem_free(tcps->tcps_params, sizeof (lcl_tcp_param_arr)); 4581 tcps->tcps_params = NULL; 4582 kmem_free(tcps->tcps_wroff_xtra_param, sizeof (tcpparam_t)); 4583 tcps->tcps_wroff_xtra_param = NULL; 4584 4585 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 4586 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL); 4587 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock); 4588 } 4589 4590 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 4591 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL); 4592 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock); 4593 } 4594 4595 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE); 4596 tcps->tcps_bind_fanout = NULL; 4597 4598 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) * 4599 TCP_ACCEPTOR_FANOUT_SIZE); 4600 tcps->tcps_acceptor_fanout = NULL; 4601 4602 mutex_destroy(&tcps->tcps_iss_key_lock); 4603 mutex_destroy(&tcps->tcps_epriv_port_lock); 4604 4605 ip_drop_unregister(&tcps->tcps_dropper); 4606 4607 tcp_kstat2_fini(stackid, tcps->tcps_kstat); 4608 tcps->tcps_kstat = NULL; 4609 4610 tcp_kstat_fini(stackid, tcps->tcps_mibkp); 4611 tcps->tcps_mibkp = NULL; 4612 4613 ldi_ident_release(tcps->tcps_ldi_ident); 4614 kmem_free(tcps, sizeof (*tcps)); 4615 } 4616 4617 /* 4618 * Generate ISS, taking into account NDD changes may happen halfway through. 4619 * (If the iss is not zero, set it.) 4620 */ 4621 4622 static void 4623 tcp_iss_init(tcp_t *tcp) 4624 { 4625 MD5_CTX context; 4626 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 4627 uint32_t answer[4]; 4628 tcp_stack_t *tcps = tcp->tcp_tcps; 4629 conn_t *connp = tcp->tcp_connp; 4630 4631 tcps->tcps_iss_incr_extra += (ISS_INCR >> 1); 4632 tcp->tcp_iss = tcps->tcps_iss_incr_extra; 4633 switch (tcps->tcps_strong_iss) { 4634 case 2: 4635 mutex_enter(&tcps->tcps_iss_key_lock); 4636 context = tcps->tcps_iss_key; 4637 mutex_exit(&tcps->tcps_iss_key_lock); 4638 arg.ports = connp->conn_ports; 4639 arg.src = connp->conn_laddr_v6; 4640 arg.dst = connp->conn_faddr_v6; 4641 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 4642 MD5Final((uchar_t *)answer, &context); 4643 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 4644 /* 4645 * Now that we've hashed into a unique per-connection sequence 4646 * space, add a random increment per strong_iss == 1. So I 4647 * guess we'll have to... 4648 */ 4649 /* FALLTHRU */ 4650 case 1: 4651 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 4652 break; 4653 default: 4654 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 4655 break; 4656 } 4657 tcp->tcp_valid_bits = TCP_ISS_VALID; 4658 tcp->tcp_fss = tcp->tcp_iss - 1; 4659 tcp->tcp_suna = tcp->tcp_iss; 4660 tcp->tcp_snxt = tcp->tcp_iss + 1; 4661 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 4662 tcp->tcp_csuna = tcp->tcp_snxt; 4663 } 4664 4665 /* 4666 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 4667 * on the specified backing STREAMS q. Note, the caller may make the 4668 * decision to call based on the tcp_t.tcp_flow_stopped value which 4669 * when check outside the q's lock is only an advisory check ... 4670 */ 4671 void 4672 tcp_setqfull(tcp_t *tcp) 4673 { 4674 tcp_stack_t *tcps = tcp->tcp_tcps; 4675 conn_t *connp = tcp->tcp_connp; 4676 4677 if (tcp->tcp_closed) 4678 return; 4679 4680 conn_setqfull(connp, &tcp->tcp_flow_stopped); 4681 if (tcp->tcp_flow_stopped) 4682 TCP_STAT(tcps, tcp_flwctl_on); 4683 } 4684 4685 void 4686 tcp_clrqfull(tcp_t *tcp) 4687 { 4688 conn_t *connp = tcp->tcp_connp; 4689 4690 if (tcp->tcp_closed) 4691 return; 4692 conn_clrqfull(connp, &tcp->tcp_flow_stopped); 4693 } 4694 4695 static int 4696 tcp_squeue_switch(int val) 4697 { 4698 int rval = SQ_FILL; 4699 4700 switch (val) { 4701 case 1: 4702 rval = SQ_NODRAIN; 4703 break; 4704 case 2: 4705 rval = SQ_PROCESS; 4706 break; 4707 default: 4708 break; 4709 } 4710 return (rval); 4711 } 4712 4713 /* 4714 * This is called once for each squeue - globally for all stack 4715 * instances. 4716 */ 4717 static void 4718 tcp_squeue_add(squeue_t *sqp) 4719 { 4720 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 4721 sizeof (tcp_squeue_priv_t), KM_SLEEP); 4722 4723 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 4724 /* Kick start the periodic TIME WAIT collector. */ 4725 tcp_time_wait->tcp_time_wait_tid = 4726 timeout_generic(CALLOUT_NORMAL, tcp_time_wait_collector, sqp, 4727 (hrtime_t)10 * NANOSEC, CALLOUT_TCP_RESOLUTION, 4728 CALLOUT_FLAG_ROUNDUP); 4729 if (tcp_free_list_max_cnt == 0) { 4730 int tcp_ncpus = ((boot_max_ncpus == -1) ? 4731 max_ncpus : boot_max_ncpus); 4732 4733 /* 4734 * Limit number of entries to 1% of availble memory / tcp_ncpus 4735 */ 4736 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 4737 (tcp_ncpus * sizeof (tcp_t) * 100); 4738 } 4739 tcp_time_wait->tcp_free_list_cnt = 0; 4740 } 4741 /* 4742 * Return unix error is tli error is TSYSERR, otherwise return a negative 4743 * tli error. 4744 */ 4745 int 4746 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 4747 boolean_t bind_to_req_port_only) 4748 { 4749 int error; 4750 tcp_t *tcp = connp->conn_tcp; 4751 4752 if (tcp->tcp_state >= TCPS_BOUND) { 4753 if (connp->conn_debug) { 4754 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4755 "tcp_bind: bad state, %d", tcp->tcp_state); 4756 } 4757 return (-TOUTSTATE); 4758 } 4759 4760 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only); 4761 if (error != 0) 4762 return (error); 4763 4764 ASSERT(tcp->tcp_state == TCPS_BOUND); 4765 tcp->tcp_conn_req_max = 0; 4766 return (0); 4767 } 4768 4769 /* 4770 * If the return value from this function is positive, it's a UNIX error. 4771 * Otherwise, if it's negative, then the absolute value is a TLI error. 4772 * the TPI routine tcp_tpi_connect() is a wrapper function for this. 4773 */ 4774 int 4775 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 4776 cred_t *cr, pid_t pid) 4777 { 4778 tcp_t *tcp = connp->conn_tcp; 4779 sin_t *sin = (sin_t *)sa; 4780 sin6_t *sin6 = (sin6_t *)sa; 4781 ipaddr_t *dstaddrp; 4782 in_port_t dstport; 4783 uint_t srcid; 4784 int error; 4785 uint32_t mss; 4786 mblk_t *syn_mp; 4787 tcp_stack_t *tcps = tcp->tcp_tcps; 4788 int32_t oldstate; 4789 ip_xmit_attr_t *ixa = connp->conn_ixa; 4790 4791 oldstate = tcp->tcp_state; 4792 4793 switch (len) { 4794 default: 4795 /* 4796 * Should never happen 4797 */ 4798 return (EINVAL); 4799 4800 case sizeof (sin_t): 4801 sin = (sin_t *)sa; 4802 if (sin->sin_port == 0) { 4803 return (-TBADADDR); 4804 } 4805 if (connp->conn_ipv6_v6only) { 4806 return (EAFNOSUPPORT); 4807 } 4808 break; 4809 4810 case sizeof (sin6_t): 4811 sin6 = (sin6_t *)sa; 4812 if (sin6->sin6_port == 0) { 4813 return (-TBADADDR); 4814 } 4815 break; 4816 } 4817 /* 4818 * If we're connecting to an IPv4-mapped IPv6 address, we need to 4819 * make sure that the conn_ipversion is IPV4_VERSION. We 4820 * need to this before we call tcp_bindi() so that the port lookup 4821 * code will look for ports in the correct port space (IPv4 and 4822 * IPv6 have separate port spaces). 4823 */ 4824 if (connp->conn_family == AF_INET6 && 4825 connp->conn_ipversion == IPV6_VERSION && 4826 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4827 if (connp->conn_ipv6_v6only) 4828 return (EADDRNOTAVAIL); 4829 4830 connp->conn_ipversion = IPV4_VERSION; 4831 } 4832 4833 switch (tcp->tcp_state) { 4834 case TCPS_LISTEN: 4835 /* 4836 * Listening sockets are not allowed to issue connect(). 4837 */ 4838 if (IPCL_IS_NONSTR(connp)) 4839 return (EOPNOTSUPP); 4840 /* FALLTHRU */ 4841 case TCPS_IDLE: 4842 /* 4843 * We support quick connect, refer to comments in 4844 * tcp_connect_*() 4845 */ 4846 /* FALLTHRU */ 4847 case TCPS_BOUND: 4848 break; 4849 default: 4850 return (-TOUTSTATE); 4851 } 4852 4853 /* 4854 * We update our cred/cpid based on the caller of connect 4855 */ 4856 if (connp->conn_cred != cr) { 4857 crhold(cr); 4858 crfree(connp->conn_cred); 4859 connp->conn_cred = cr; 4860 } 4861 connp->conn_cpid = pid; 4862 4863 /* Cache things in the ixa without any refhold */ 4864 ixa->ixa_cred = cr; 4865 ixa->ixa_cpid = pid; 4866 if (is_system_labeled()) { 4867 /* We need to restart with a label based on the cred */ 4868 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4869 } 4870 4871 if (connp->conn_family == AF_INET6) { 4872 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4873 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr, 4874 sin6->sin6_port, sin6->sin6_flowinfo, 4875 sin6->__sin6_src_id, sin6->sin6_scope_id); 4876 } else { 4877 /* 4878 * Destination adress is mapped IPv6 address. 4879 * Source bound address should be unspecified or 4880 * IPv6 mapped address as well. 4881 */ 4882 if (!IN6_IS_ADDR_UNSPECIFIED( 4883 &connp->conn_bound_addr_v6) && 4884 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) { 4885 return (EADDRNOTAVAIL); 4886 } 4887 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 4888 dstport = sin6->sin6_port; 4889 srcid = sin6->__sin6_src_id; 4890 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, 4891 srcid); 4892 } 4893 } else { 4894 dstaddrp = &sin->sin_addr.s_addr; 4895 dstport = sin->sin_port; 4896 srcid = 0; 4897 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid); 4898 } 4899 4900 if (error != 0) 4901 goto connect_failed; 4902 4903 CL_INET_CONNECT(connp, B_TRUE, error); 4904 if (error != 0) 4905 goto connect_failed; 4906 4907 /* connect succeeded */ 4908 TCPS_BUMP_MIB(tcps, tcpActiveOpens); 4909 tcp->tcp_active_open = 1; 4910 4911 /* 4912 * tcp_set_destination() does not adjust for TCP/IP header length. 4913 */ 4914 mss = tcp->tcp_mss - connp->conn_ht_iphc_len; 4915 4916 /* 4917 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up 4918 * to the nearest MSS. 4919 * 4920 * We do the round up here because we need to get the interface MTU 4921 * first before we can do the round up. 4922 */ 4923 tcp->tcp_rwnd = connp->conn_rcvbuf; 4924 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 4925 tcps->tcps_recv_hiwat_minmss * mss); 4926 connp->conn_rcvbuf = tcp->tcp_rwnd; 4927 tcp_set_ws_value(tcp); 4928 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 4929 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) 4930 tcp->tcp_snd_ws_ok = B_TRUE; 4931 4932 /* 4933 * Set tcp_snd_ts_ok to true 4934 * so that tcp_xmit_mp will 4935 * include the timestamp 4936 * option in the SYN segment. 4937 */ 4938 if (tcps->tcps_tstamp_always || 4939 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { 4940 tcp->tcp_snd_ts_ok = B_TRUE; 4941 } 4942 4943 /* 4944 * tcp_snd_sack_ok can be set in 4945 * tcp_set_destination() if the sack metric 4946 * is set. So check it here also. 4947 */ 4948 if (tcps->tcps_sack_permitted == 2 || 4949 tcp->tcp_snd_sack_ok) { 4950 if (tcp->tcp_sack_info == NULL) { 4951 tcp->tcp_sack_info = kmem_cache_alloc( 4952 tcp_sack_info_cache, KM_SLEEP); 4953 } 4954 tcp->tcp_snd_sack_ok = B_TRUE; 4955 } 4956 4957 /* 4958 * Should we use ECN? Note that the current 4959 * default value (SunOS 5.9) of tcp_ecn_permitted 4960 * is 1. The reason for doing this is that there 4961 * are equipments out there that will drop ECN 4962 * enabled IP packets. Setting it to 1 avoids 4963 * compatibility problems. 4964 */ 4965 if (tcps->tcps_ecn_permitted == 2) 4966 tcp->tcp_ecn_ok = B_TRUE; 4967 4968 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4969 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 4970 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 4971 if (syn_mp != NULL) { 4972 /* 4973 * We must bump the generation before sending the syn 4974 * to ensure that we use the right generation in case 4975 * this thread issues a "connected" up call. 4976 */ 4977 SOCK_CONNID_BUMP(tcp->tcp_connid); 4978 tcp_send_data(tcp, syn_mp); 4979 } 4980 4981 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4982 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4983 return (0); 4984 4985 connect_failed: 4986 connp->conn_faddr_v6 = ipv6_all_zeros; 4987 connp->conn_fport = 0; 4988 tcp->tcp_state = oldstate; 4989 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4990 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4991 return (error); 4992 } 4993 4994 int 4995 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len, 4996 int backlog, cred_t *cr, boolean_t bind_to_req_port_only) 4997 { 4998 tcp_t *tcp = connp->conn_tcp; 4999 int error = 0; 5000 tcp_stack_t *tcps = tcp->tcp_tcps; 5001 5002 /* All Solaris components should pass a cred for this operation. */ 5003 ASSERT(cr != NULL); 5004 5005 if (tcp->tcp_state >= TCPS_BOUND) { 5006 if ((tcp->tcp_state == TCPS_BOUND || 5007 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) { 5008 /* 5009 * Handle listen() increasing backlog. 5010 * This is more "liberal" then what the TPI spec 5011 * requires but is needed to avoid a t_unbind 5012 * when handling listen() since the port number 5013 * might be "stolen" between the unbind and bind. 5014 */ 5015 goto do_listen; 5016 } 5017 if (connp->conn_debug) { 5018 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 5019 "tcp_listen: bad state, %d", tcp->tcp_state); 5020 } 5021 return (-TOUTSTATE); 5022 } else { 5023 if (sa == NULL) { 5024 sin6_t addr; 5025 sin_t *sin; 5026 sin6_t *sin6; 5027 5028 ASSERT(IPCL_IS_NONSTR(connp)); 5029 /* Do an implicit bind: Request for a generic port. */ 5030 if (connp->conn_family == AF_INET) { 5031 len = sizeof (sin_t); 5032 sin = (sin_t *)&addr; 5033 *sin = sin_null; 5034 sin->sin_family = AF_INET; 5035 } else { 5036 ASSERT(connp->conn_family == AF_INET6); 5037 len = sizeof (sin6_t); 5038 sin6 = (sin6_t *)&addr; 5039 *sin6 = sin6_null; 5040 sin6->sin6_family = AF_INET6; 5041 } 5042 sa = (struct sockaddr *)&addr; 5043 } 5044 5045 error = tcp_bind_check(connp, sa, len, cr, 5046 bind_to_req_port_only); 5047 if (error) 5048 return (error); 5049 /* Fall through and do the fanout insertion */ 5050 } 5051 5052 do_listen: 5053 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN); 5054 tcp->tcp_conn_req_max = backlog; 5055 if (tcp->tcp_conn_req_max) { 5056 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) 5057 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; 5058 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) 5059 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; 5060 /* 5061 * If this is a listener, do not reset the eager list 5062 * and other stuffs. Note that we don't check if the 5063 * existing eager list meets the new tcp_conn_req_max 5064 * requirement. 5065 */ 5066 if (tcp->tcp_state != TCPS_LISTEN) { 5067 tcp->tcp_state = TCPS_LISTEN; 5068 /* Initialize the chain. Don't need the eager_lock */ 5069 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 5070 tcp->tcp_eager_next_drop_q0 = tcp; 5071 tcp->tcp_eager_prev_drop_q0 = tcp; 5072 tcp->tcp_second_ctimer_threshold = 5073 tcps->tcps_ip_abort_linterval; 5074 } 5075 } 5076 5077 /* 5078 * We need to make sure that the conn_recv is set to a non-null 5079 * value before we insert the conn into the classifier table. 5080 * This is to avoid a race with an incoming packet which does an 5081 * ipcl_classify(). 5082 * We initially set it to tcp_input_listener_unbound to try to 5083 * pick a good squeue for the listener when the first SYN arrives. 5084 * tcp_input_listener_unbound sets it to tcp_input_listener on that 5085 * first SYN. 5086 */ 5087 connp->conn_recv = tcp_input_listener_unbound; 5088 5089 /* Insert the listener in the classifier table */ 5090 error = ip_laddr_fanout_insert(connp); 5091 if (error != 0) { 5092 /* Undo the bind - release the port number */ 5093 tcp->tcp_state = TCPS_IDLE; 5094 connp->conn_bound_addr_v6 = ipv6_all_zeros; 5095 5096 connp->conn_laddr_v6 = ipv6_all_zeros; 5097 connp->conn_saddr_v6 = ipv6_all_zeros; 5098 connp->conn_ports = 0; 5099 5100 if (connp->conn_anon_port) { 5101 zone_t *zone; 5102 5103 zone = crgetzone(cr); 5104 connp->conn_anon_port = B_FALSE; 5105 (void) tsol_mlp_anon(zone, connp->conn_mlp_type, 5106 connp->conn_proto, connp->conn_lport, B_FALSE); 5107 } 5108 connp->conn_mlp_type = mlptSingle; 5109 5110 tcp_bind_hash_remove(tcp); 5111 return (error); 5112 } else { 5113 /* 5114 * If there is a connection limit, allocate and initialize 5115 * the counter struct. Note that since listen can be called 5116 * multiple times, the struct may have been allready allocated. 5117 */ 5118 if (!list_is_empty(&tcps->tcps_listener_conf) && 5119 tcp->tcp_listen_cnt == NULL) { 5120 tcp_listen_cnt_t *tlc; 5121 uint32_t ratio; 5122 5123 ratio = tcp_find_listener_conf(tcps, 5124 ntohs(connp->conn_lport)); 5125 if (ratio != 0) { 5126 uint32_t mem_ratio, tot_buf; 5127 5128 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t), 5129 KM_SLEEP); 5130 /* 5131 * Calculate the connection limit based on 5132 * the configured ratio and maxusers. Maxusers 5133 * are calculated based on memory size, 5134 * ~ 1 user per MB. Note that the conn_rcvbuf 5135 * and conn_sndbuf may change after a 5136 * connection is accepted. So what we have 5137 * is only an approximation. 5138 */ 5139 if ((tot_buf = connp->conn_rcvbuf + 5140 connp->conn_sndbuf) < MB) { 5141 mem_ratio = MB / tot_buf; 5142 tlc->tlc_max = maxusers / ratio * 5143 mem_ratio; 5144 } else { 5145 mem_ratio = tot_buf / MB; 5146 tlc->tlc_max = maxusers / ratio / 5147 mem_ratio; 5148 } 5149 /* At least we should allow two connections! */ 5150 if (tlc->tlc_max <= tcp_min_conn_listener) 5151 tlc->tlc_max = tcp_min_conn_listener; 5152 tlc->tlc_cnt = 1; 5153 tlc->tlc_drop = 0; 5154 tcp->tcp_listen_cnt = tlc; 5155 } 5156 } 5157 } 5158 return (error); 5159 } 5160