1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #pragma ident "%Z%%M% %I% %E% SMI" 29 30 const char tcp_version[] = "%Z%%M% %I% %E% SMI"; 31 32 #include <sys/types.h> 33 #include <sys/stream.h> 34 #include <sys/strsun.h> 35 #include <sys/strsubr.h> 36 #include <sys/stropts.h> 37 #include <sys/strlog.h> 38 #include <sys/strsun.h> 39 #define _SUN_TPI_VERSION 2 40 #include <sys/tihdr.h> 41 #include <sys/timod.h> 42 #include <sys/ddi.h> 43 #include <sys/sunddi.h> 44 #include <sys/suntpi.h> 45 #include <sys/xti_inet.h> 46 #include <sys/cmn_err.h> 47 #include <sys/debug.h> 48 #include <sys/vtrace.h> 49 #include <sys/kmem.h> 50 #include <sys/ethernet.h> 51 #include <sys/cpuvar.h> 52 #include <sys/dlpi.h> 53 #include <sys/multidata.h> 54 #include <sys/multidata_impl.h> 55 #include <sys/pattr.h> 56 #include <sys/policy.h> 57 #include <sys/zone.h> 58 59 #include <sys/errno.h> 60 #include <sys/signal.h> 61 #include <sys/socket.h> 62 #include <sys/sockio.h> 63 #include <sys/isa_defs.h> 64 #include <sys/md5.h> 65 #include <sys/random.h> 66 #include <netinet/in.h> 67 #include <netinet/tcp.h> 68 #include <netinet/ip6.h> 69 #include <netinet/icmp6.h> 70 #include <net/if.h> 71 #include <net/route.h> 72 #include <inet/ipsec_impl.h> 73 74 #include <inet/common.h> 75 #include <inet/ip.h> 76 #include <inet/ip6.h> 77 #include <inet/ip_ndp.h> 78 #include <inet/mi.h> 79 #include <inet/mib2.h> 80 #include <inet/nd.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <net/pfkeyv2.h> 86 #include <inet/ipsec_info.h> 87 #include <inet/ipdrop.h> 88 #include <inet/tcp_trace.h> 89 90 #include <inet/ipclassifier.h> 91 #include <inet/ip_ire.h> 92 #include <inet/ip_if.h> 93 #include <inet/ipp_common.h> 94 #include <sys/squeue.h> 95 96 /* 97 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 98 * 99 * (Read the detailed design doc in PSARC case directory) 100 * 101 * The entire tcp state is contained in tcp_t and conn_t structure 102 * which are allocated in tandem using ipcl_conn_create() and passing 103 * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect 104 * the references on the tcp_t. The tcp_t structure is never compressed 105 * and packets always land on the correct TCP perimeter from the time 106 * eager is created till the time tcp_t dies (as such the old mentat 107 * TCP global queue is not used for detached state and no IPSEC checking 108 * is required). The global queue is still allocated to send out resets 109 * for connection which have no listeners and IP directly calls 110 * tcp_xmit_listeners_reset() which does any policy check. 111 * 112 * Protection and Synchronisation mechanism: 113 * 114 * The tcp data structure does not use any kind of lock for protecting 115 * its state but instead uses 'squeues' for mutual exclusion from various 116 * read and write side threads. To access a tcp member, the thread should 117 * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or 118 * squeue_fill). Since the squeues allow a direct function call, caller 119 * can pass any tcp function having prototype of edesc_t as argument 120 * (different from traditional STREAMs model where packets come in only 121 * designated entry points). The list of functions that can be directly 122 * called via squeue are listed before the usual function prototype. 123 * 124 * Referencing: 125 * 126 * TCP is MT-Hot and we use a reference based scheme to make sure that the 127 * tcp structure doesn't disappear when its needed. When the application 128 * creates an outgoing connection or accepts an incoming connection, we 129 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 130 * The IP reference is just a symbolic reference since ip_tcpclose() 131 * looks at tcp structure after tcp_close_output() returns which could 132 * have dropped the last TCP reference. So as long as the connection is 133 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 134 * conn_t. The classifier puts its own reference when the connection is 135 * inserted in listen or connected hash. Anytime a thread needs to enter 136 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 137 * on write side or by doing a classify on read side and then puts a 138 * reference on the conn before doing squeue_enter/tryenter/fill. For 139 * read side, the classifier itself puts the reference under fanout lock 140 * to make sure that tcp can't disappear before it gets processed. The 141 * squeue will drop this reference automatically so the called function 142 * doesn't have to do a DEC_REF. 143 * 144 * Opening a new connection: 145 * 146 * The outgoing connection open is pretty simple. ip_tcpopen() does the 147 * work in creating the conn/tcp structure and initializing it. The 148 * squeue assignment is done based on the CPU the application 149 * is running on. So for outbound connections, processing is always done 150 * on application CPU which might be different from the incoming CPU 151 * being interrupted by the NIC. An optimal way would be to figure out 152 * the NIC <-> CPU binding at listen time, and assign the outgoing 153 * connection to the squeue attached to the CPU that will be interrupted 154 * for incoming packets (we know the NIC based on the bind IP address). 155 * This might seem like a problem if more data is going out but the 156 * fact is that in most cases the transmit is ACK driven transmit where 157 * the outgoing data normally sits on TCP's xmit queue waiting to be 158 * transmitted. 159 * 160 * Accepting a connection: 161 * 162 * This is a more interesting case because of various races involved in 163 * establishing a eager in its own perimeter. Read the meta comment on 164 * top of tcp_conn_request(). But briefly, the squeue is picked by 165 * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU. 166 * 167 * Closing a connection: 168 * 169 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 170 * via squeue to do the close and mark the tcp as detached if the connection 171 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 172 * reference but tcp_close() drop IP's reference always. So if tcp was 173 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 174 * and 1 because it is in classifier's connected hash. This is the condition 175 * we use to determine that its OK to clean up the tcp outside of squeue 176 * when time wait expires (check the ref under fanout and conn_lock and 177 * if it is 2, remove it from fanout hash and kill it). 178 * 179 * Although close just drops the necessary references and marks the 180 * tcp_detached state, tcp_close needs to know the tcp_detached has been 181 * set (under squeue) before letting the STREAM go away (because a 182 * inbound packet might attempt to go up the STREAM while the close 183 * has happened and tcp_detached is not set). So a special lock and 184 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 185 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 186 * tcp_detached. 187 * 188 * Special provisions and fast paths: 189 * 190 * We make special provision for (AF_INET, SOCK_STREAM) sockets which 191 * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP 192 * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles 193 * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY 194 * check to send packets directly to tcp_rput_data via squeue. Everyone 195 * else comes through tcp_input() on the read side. 196 * 197 * We also make special provisions for sockfs by marking tcp_issocket 198 * whenever we have only sockfs on top of TCP. This allows us to skip 199 * putting the tcp in acceptor hash since a sockfs listener can never 200 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 201 * since eager has already been allocated and the accept now happens 202 * on acceptor STREAM. There is a big blob of comment on top of 203 * tcp_conn_request explaining the new accept. When socket is POP'd, 204 * sockfs sends us an ioctl to mark the fact and we go back to old 205 * behaviour. Once tcp_issocket is unset, its never set for the 206 * life of that connection. 207 * 208 * IPsec notes : 209 * 210 * Since a packet is always executed on the correct TCP perimeter 211 * all IPsec processing is defered to IP including checking new 212 * connections and setting IPSEC policies for new connection. The 213 * only exception is tcp_xmit_listeners_reset() which is called 214 * directly from IP and needs to policy check to see if TH_RST 215 * can be sent out. 216 */ 217 218 219 extern major_t TCP6_MAJ; 220 221 /* 222 * Values for squeue switch: 223 * 1: squeue_enter_nodrain 224 * 2: squeue_enter 225 * 3: squeue_fill 226 */ 227 int tcp_squeue_close = 2; 228 int tcp_squeue_wput = 2; 229 230 squeue_func_t tcp_squeue_close_proc; 231 squeue_func_t tcp_squeue_wput_proc; 232 233 extern vmem_t *ip_minor_arena; 234 235 /* 236 * This controls how tiny a write must be before we try to copy it 237 * into the the mblk on the tail of the transmit queue. Not much 238 * speedup is observed for values larger than sixteen. Zero will 239 * disable the optimisation. 240 */ 241 int tcp_tx_pull_len = 16; 242 243 /* 244 * TCP Statistics. 245 * 246 * How TCP statistics work. 247 * 248 * There are two types of statistics invoked by two macros. 249 * 250 * TCP_STAT(name) does non-atomic increment of a named stat counter. It is 251 * supposed to be used in non MT-hot paths of the code. 252 * 253 * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is 254 * supposed to be used for DEBUG purposes and may be used on a hot path. 255 * 256 * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat 257 * (use "kstat tcp" to get them). 258 * 259 * There is also additional debugging facility that marks tcp_clean_death() 260 * instances and saves them in tcp_t structure. It is triggered by 261 * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for 262 * tcp_clean_death() calls that counts the number of times each tag was hit. It 263 * is triggered by TCP_CLD_COUNTERS define. 264 * 265 * How to add new counters. 266 * 267 * 1) Add a field in the tcp_stat structure describing your counter. 268 * 2) Add a line in tcp_statistics with the name of the counter. 269 * 270 * IMPORTANT!! - make sure that both are in sync !! 271 * 3) Use either TCP_STAT or TCP_DBGSTAT with the name. 272 * 273 * Please avoid using private counters which are not kstat-exported. 274 * 275 * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances 276 * in tcp_t structure. 277 * 278 * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags. 279 */ 280 281 #define TCP_COUNTERS 1 282 #define TCP_CLD_COUNTERS 0 283 284 #ifndef TCP_DEBUG_COUNTER 285 #ifdef DEBUG 286 #define TCP_DEBUG_COUNTER 1 287 #else 288 #define TCP_DEBUG_COUNTER 0 289 #endif 290 #endif 291 292 293 #define TCP_TAG_CLEAN_DEATH 1 294 #define TCP_MAX_CLEAN_DEATH_TAG 32 295 296 #ifdef lint 297 static int _lint_dummy_; 298 #endif 299 300 #if TCP_COUNTERS 301 #define TCP_STAT(x) (tcp_statistics.x.value.ui64++) 302 #define TCP_STAT_UPDATE(x, n) (tcp_statistics.x.value.ui64 += (n)) 303 #define TCP_STAT_SET(x, n) (tcp_statistics.x.value.ui64 = (n)) 304 #elif defined(lint) 305 #define TCP_STAT(x) ASSERT(_lint_dummy_ == 0); 306 #define TCP_STAT_UPDATE(x, n) ASSERT(_lint_dummy_ == 0); 307 #define TCP_STAT_SET(x, n) ASSERT(_lint_dummy_ == 0); 308 #else 309 #define TCP_STAT(x) 310 #define TCP_STAT_UPDATE(x, n) 311 #define TCP_STAT_SET(x, n) 312 #endif 313 314 #if TCP_CLD_COUNTERS 315 static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG]; 316 #define TCP_CLD_STAT(x) tcp_clean_death_stat[x]++ 317 #elif defined(lint) 318 #define TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0); 319 #else 320 #define TCP_CLD_STAT(x) 321 #endif 322 323 #if TCP_DEBUG_COUNTER 324 #define TCP_DBGSTAT(x) atomic_add_64(&(tcp_statistics.x.value.ui64), 1) 325 #elif defined(lint) 326 #define TCP_DBGSTAT(x) ASSERT(_lint_dummy_ == 0); 327 #else 328 #define TCP_DBGSTAT(x) 329 #endif 330 331 typedef struct tcp_stat { 332 kstat_named_t tcp_time_wait; 333 kstat_named_t tcp_time_wait_syn; 334 kstat_named_t tcp_time_wait_syn_success; 335 kstat_named_t tcp_time_wait_syn_fail; 336 kstat_named_t tcp_reinput_syn; 337 kstat_named_t tcp_ip_output; 338 kstat_named_t tcp_detach_non_time_wait; 339 kstat_named_t tcp_detach_time_wait; 340 kstat_named_t tcp_time_wait_reap; 341 kstat_named_t tcp_clean_death_nondetached; 342 kstat_named_t tcp_reinit_calls; 343 kstat_named_t tcp_eager_err1; 344 kstat_named_t tcp_eager_err2; 345 kstat_named_t tcp_eager_blowoff_calls; 346 kstat_named_t tcp_eager_blowoff_q; 347 kstat_named_t tcp_eager_blowoff_q0; 348 kstat_named_t tcp_not_hard_bound; 349 kstat_named_t tcp_no_listener; 350 kstat_named_t tcp_found_eager; 351 kstat_named_t tcp_wrong_queue; 352 kstat_named_t tcp_found_eager_binding1; 353 kstat_named_t tcp_found_eager_bound1; 354 kstat_named_t tcp_eager_has_listener1; 355 kstat_named_t tcp_open_alloc; 356 kstat_named_t tcp_open_detached_alloc; 357 kstat_named_t tcp_rput_time_wait; 358 kstat_named_t tcp_listendrop; 359 kstat_named_t tcp_listendropq0; 360 kstat_named_t tcp_wrong_rq; 361 kstat_named_t tcp_rsrv_calls; 362 kstat_named_t tcp_eagerfree2; 363 kstat_named_t tcp_eagerfree3; 364 kstat_named_t tcp_eagerfree4; 365 kstat_named_t tcp_eagerfree5; 366 kstat_named_t tcp_timewait_syn_fail; 367 kstat_named_t tcp_listen_badflags; 368 kstat_named_t tcp_timeout_calls; 369 kstat_named_t tcp_timeout_cached_alloc; 370 kstat_named_t tcp_timeout_cancel_reqs; 371 kstat_named_t tcp_timeout_canceled; 372 kstat_named_t tcp_timermp_alloced; 373 kstat_named_t tcp_timermp_freed; 374 kstat_named_t tcp_timermp_allocfail; 375 kstat_named_t tcp_timermp_allocdblfail; 376 kstat_named_t tcp_push_timer_cnt; 377 kstat_named_t tcp_ack_timer_cnt; 378 kstat_named_t tcp_ire_null1; 379 kstat_named_t tcp_ire_null; 380 kstat_named_t tcp_ip_send; 381 kstat_named_t tcp_ip_ire_send; 382 kstat_named_t tcp_wsrv_called; 383 kstat_named_t tcp_flwctl_on; 384 kstat_named_t tcp_timer_fire_early; 385 kstat_named_t tcp_timer_fire_miss; 386 kstat_named_t tcp_freelist_cleanup; 387 kstat_named_t tcp_rput_v6_error; 388 kstat_named_t tcp_out_sw_cksum; 389 kstat_named_t tcp_zcopy_on; 390 kstat_named_t tcp_zcopy_off; 391 kstat_named_t tcp_zcopy_backoff; 392 kstat_named_t tcp_zcopy_disable; 393 kstat_named_t tcp_mdt_pkt_out; 394 kstat_named_t tcp_mdt_pkt_out_v4; 395 kstat_named_t tcp_mdt_pkt_out_v6; 396 kstat_named_t tcp_mdt_discarded; 397 kstat_named_t tcp_mdt_conn_halted1; 398 kstat_named_t tcp_mdt_conn_halted2; 399 kstat_named_t tcp_mdt_conn_halted3; 400 kstat_named_t tcp_mdt_conn_resumed1; 401 kstat_named_t tcp_mdt_conn_resumed2; 402 kstat_named_t tcp_mdt_legacy_small; 403 kstat_named_t tcp_mdt_legacy_all; 404 kstat_named_t tcp_mdt_legacy_ret; 405 kstat_named_t tcp_mdt_allocfail; 406 kstat_named_t tcp_mdt_addpdescfail; 407 kstat_named_t tcp_mdt_allocd; 408 kstat_named_t tcp_mdt_linked; 409 kstat_named_t tcp_fusion_flowctl; 410 kstat_named_t tcp_fusion_backenabled; 411 kstat_named_t tcp_fusion_urg; 412 kstat_named_t tcp_fusion_putnext; 413 kstat_named_t tcp_fusion_unfusable; 414 kstat_named_t tcp_fusion_aborted; 415 kstat_named_t tcp_fusion_unqualified; 416 kstat_named_t tcp_in_ack_unsent_drop; 417 } tcp_stat_t; 418 419 #if (TCP_COUNTERS || TCP_DEBUG_COUNTER) 420 static tcp_stat_t tcp_statistics = { 421 { "tcp_time_wait", KSTAT_DATA_UINT64 }, 422 { "tcp_time_wait_syn", KSTAT_DATA_UINT64 }, 423 { "tcp_time_wait_success", KSTAT_DATA_UINT64 }, 424 { "tcp_time_wait_fail", KSTAT_DATA_UINT64 }, 425 { "tcp_reinput_syn", KSTAT_DATA_UINT64 }, 426 { "tcp_ip_output", KSTAT_DATA_UINT64 }, 427 { "tcp_detach_non_time_wait", KSTAT_DATA_UINT64 }, 428 { "tcp_detach_time_wait", KSTAT_DATA_UINT64 }, 429 { "tcp_time_wait_reap", KSTAT_DATA_UINT64 }, 430 { "tcp_clean_death_nondetached", KSTAT_DATA_UINT64 }, 431 { "tcp_reinit_calls", KSTAT_DATA_UINT64 }, 432 { "tcp_eager_err1", KSTAT_DATA_UINT64 }, 433 { "tcp_eager_err2", KSTAT_DATA_UINT64 }, 434 { "tcp_eager_blowoff_calls", KSTAT_DATA_UINT64 }, 435 { "tcp_eager_blowoff_q", KSTAT_DATA_UINT64 }, 436 { "tcp_eager_blowoff_q0", KSTAT_DATA_UINT64 }, 437 { "tcp_not_hard_bound", KSTAT_DATA_UINT64 }, 438 { "tcp_no_listener", KSTAT_DATA_UINT64 }, 439 { "tcp_found_eager", KSTAT_DATA_UINT64 }, 440 { "tcp_wrong_queue", KSTAT_DATA_UINT64 }, 441 { "tcp_found_eager_binding1", KSTAT_DATA_UINT64 }, 442 { "tcp_found_eager_bound1", KSTAT_DATA_UINT64 }, 443 { "tcp_eager_has_listener1", KSTAT_DATA_UINT64 }, 444 { "tcp_open_alloc", KSTAT_DATA_UINT64 }, 445 { "tcp_open_detached_alloc", KSTAT_DATA_UINT64 }, 446 { "tcp_rput_time_wait", KSTAT_DATA_UINT64 }, 447 { "tcp_listendrop", KSTAT_DATA_UINT64 }, 448 { "tcp_listendropq0", KSTAT_DATA_UINT64 }, 449 { "tcp_wrong_rq", KSTAT_DATA_UINT64 }, 450 { "tcp_rsrv_calls", KSTAT_DATA_UINT64 }, 451 { "tcp_eagerfree2", KSTAT_DATA_UINT64 }, 452 { "tcp_eagerfree3", KSTAT_DATA_UINT64 }, 453 { "tcp_eagerfree4", KSTAT_DATA_UINT64 }, 454 { "tcp_eagerfree5", KSTAT_DATA_UINT64 }, 455 { "tcp_timewait_syn_fail", KSTAT_DATA_UINT64 }, 456 { "tcp_listen_badflags", KSTAT_DATA_UINT64 }, 457 { "tcp_timeout_calls", KSTAT_DATA_UINT64 }, 458 { "tcp_timeout_cached_alloc", KSTAT_DATA_UINT64 }, 459 { "tcp_timeout_cancel_reqs", KSTAT_DATA_UINT64 }, 460 { "tcp_timeout_canceled", KSTAT_DATA_UINT64 }, 461 { "tcp_timermp_alloced", KSTAT_DATA_UINT64 }, 462 { "tcp_timermp_freed", KSTAT_DATA_UINT64 }, 463 { "tcp_timermp_allocfail", KSTAT_DATA_UINT64 }, 464 { "tcp_timermp_allocdblfail", KSTAT_DATA_UINT64 }, 465 { "tcp_push_timer_cnt", KSTAT_DATA_UINT64 }, 466 { "tcp_ack_timer_cnt", KSTAT_DATA_UINT64 }, 467 { "tcp_ire_null1", KSTAT_DATA_UINT64 }, 468 { "tcp_ire_null", KSTAT_DATA_UINT64 }, 469 { "tcp_ip_send", KSTAT_DATA_UINT64 }, 470 { "tcp_ip_ire_send", KSTAT_DATA_UINT64 }, 471 { "tcp_wsrv_called", KSTAT_DATA_UINT64 }, 472 { "tcp_flwctl_on", KSTAT_DATA_UINT64 }, 473 { "tcp_timer_fire_early", KSTAT_DATA_UINT64 }, 474 { "tcp_timer_fire_miss", KSTAT_DATA_UINT64 }, 475 { "tcp_freelist_cleanup", KSTAT_DATA_UINT64 }, 476 { "tcp_rput_v6_error", KSTAT_DATA_UINT64 }, 477 { "tcp_out_sw_cksum", KSTAT_DATA_UINT64 }, 478 { "tcp_zcopy_on", KSTAT_DATA_UINT64 }, 479 { "tcp_zcopy_off", KSTAT_DATA_UINT64 }, 480 { "tcp_zcopy_backoff", KSTAT_DATA_UINT64 }, 481 { "tcp_zcopy_disable", KSTAT_DATA_UINT64 }, 482 { "tcp_mdt_pkt_out", KSTAT_DATA_UINT64 }, 483 { "tcp_mdt_pkt_out_v4", KSTAT_DATA_UINT64 }, 484 { "tcp_mdt_pkt_out_v6", KSTAT_DATA_UINT64 }, 485 { "tcp_mdt_discarded", KSTAT_DATA_UINT64 }, 486 { "tcp_mdt_conn_halted1", KSTAT_DATA_UINT64 }, 487 { "tcp_mdt_conn_halted2", KSTAT_DATA_UINT64 }, 488 { "tcp_mdt_conn_halted3", KSTAT_DATA_UINT64 }, 489 { "tcp_mdt_conn_resumed1", KSTAT_DATA_UINT64 }, 490 { "tcp_mdt_conn_resumed2", KSTAT_DATA_UINT64 }, 491 { "tcp_mdt_legacy_small", KSTAT_DATA_UINT64 }, 492 { "tcp_mdt_legacy_all", KSTAT_DATA_UINT64 }, 493 { "tcp_mdt_legacy_ret", KSTAT_DATA_UINT64 }, 494 { "tcp_mdt_allocfail", KSTAT_DATA_UINT64 }, 495 { "tcp_mdt_addpdescfail", KSTAT_DATA_UINT64 }, 496 { "tcp_mdt_allocd", KSTAT_DATA_UINT64 }, 497 { "tcp_mdt_linked", KSTAT_DATA_UINT64 }, 498 { "tcp_fusion_flowctl", KSTAT_DATA_UINT64 }, 499 { "tcp_fusion_backenabled", KSTAT_DATA_UINT64 }, 500 { "tcp_fusion_urg", KSTAT_DATA_UINT64 }, 501 { "tcp_fusion_putnext", KSTAT_DATA_UINT64 }, 502 { "tcp_fusion_unfusable", KSTAT_DATA_UINT64 }, 503 { "tcp_fusion_aborted", KSTAT_DATA_UINT64 }, 504 { "tcp_fusion_unqualified", KSTAT_DATA_UINT64 }, 505 { "tcp_in_ack_unsent_drop", KSTAT_DATA_UINT64 }, 506 }; 507 508 static kstat_t *tcp_kstat; 509 510 #endif 511 512 /* 513 * Call either ip_output or ip_output_v6. This replaces putnext() calls on the 514 * tcp write side. 515 */ 516 #define CALL_IP_WPUT(connp, q, mp) { \ 517 ASSERT(((q)->q_flag & QREADR) == 0); \ 518 TCP_DBGSTAT(tcp_ip_output); \ 519 connp->conn_send(connp, (mp), (q), IP_WPUT); \ 520 } 521 522 /* 523 * Was this tcp created via socket() interface? 524 */ 525 #define TCP_IS_SOCKET(tcp) ((tcp)->tcp_issocket) 526 527 528 /* Macros for timestamp comparisons */ 529 #define TSTMP_GEQ(a, b) ((int32_t)((a)-(b)) >= 0) 530 #define TSTMP_LT(a, b) ((int32_t)((a)-(b)) < 0) 531 532 /* 533 * Parameters for TCP Initial Send Sequence number (ISS) generation. When 534 * tcp_strong_iss is set to 1, which is the default, the ISS is calculated 535 * by adding three components: a time component which grows by 1 every 4096 536 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27); 537 * a per-connection component which grows by 125000 for every new connection; 538 * and an "extra" component that grows by a random amount centered 539 * approximately on 64000. This causes the the ISS generator to cycle every 540 * 4.89 hours if no TCP connections are made, and faster if connections are 541 * made. 542 * 543 * When tcp_strong_iss is set to 0, ISS is calculated by adding two 544 * components: a time component which grows by 250000 every second; and 545 * a per-connection component which grows by 125000 for every new connections. 546 * 547 * A third method, when tcp_strong_iss is set to 2, for generating ISS is 548 * prescribed by Steve Bellovin. This involves adding time, the 125000 per 549 * connection, and a one-way hash (MD5) of the connection ID <sport, dport, 550 * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered 551 * password. 552 */ 553 #define ISS_INCR 250000 554 #define ISS_NSEC_SHT 12 555 556 static uint32_t tcp_iss_incr_extra; /* Incremented for each connection */ 557 static kmutex_t tcp_iss_key_lock; 558 static MD5_CTX tcp_iss_key; 559 static sin_t sin_null; /* Zero address for quick clears */ 560 static sin6_t sin6_null; /* Zero address for quick clears */ 561 562 /* Packet dropper for TCP IPsec policy drops. */ 563 static ipdropper_t tcp_dropper; 564 565 /* 566 * This implementation follows the 4.3BSD interpretation of the urgent 567 * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause 568 * incompatible changes in protocols like telnet and rlogin. 569 */ 570 #define TCP_OLD_URP_INTERPRETATION 1 571 572 #define TCP_IS_DETACHED(tcp) ((tcp)->tcp_detached) 573 574 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 575 (TCP_IS_DETACHED(tcp) && \ 576 (!(tcp)->tcp_hard_binding)) 577 578 /* 579 * TCP reassembly macros. We hide starting and ending sequence numbers in 580 * b_next and b_prev of messages on the reassembly queue. The messages are 581 * chained using b_cont. These macros are used in tcp_reass() so we don't 582 * have to see the ugly casts and assignments. 583 */ 584 #define TCP_REASS_SEQ(mp) ((uint32_t)(uintptr_t)((mp)->b_next)) 585 #define TCP_REASS_SET_SEQ(mp, u) ((mp)->b_next = \ 586 (mblk_t *)(uintptr_t)(u)) 587 #define TCP_REASS_END(mp) ((uint32_t)(uintptr_t)((mp)->b_prev)) 588 #define TCP_REASS_SET_END(mp, u) ((mp)->b_prev = \ 589 (mblk_t *)(uintptr_t)(u)) 590 591 /* 592 * Implementation of TCP Timers. 593 * ============================= 594 * 595 * INTERFACE: 596 * 597 * There are two basic functions dealing with tcp timers: 598 * 599 * timeout_id_t tcp_timeout(connp, func, time) 600 * clock_t tcp_timeout_cancel(connp, timeout_id) 601 * TCP_TIMER_RESTART(tcp, intvl) 602 * 603 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func' 604 * after 'time' ticks passed. The function called by timeout() must adhere to 605 * the same restrictions as a driver soft interrupt handler - it must not sleep 606 * or call other functions that might sleep. The value returned is the opaque 607 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to 608 * cancel the request. The call to tcp_timeout() may fail in which case it 609 * returns zero. This is different from the timeout(9F) function which never 610 * fails. 611 * 612 * The call-back function 'func' always receives 'connp' as its single 613 * argument. It is always executed in the squeue corresponding to the tcp 614 * structure. The tcp structure is guaranteed to be present at the time the 615 * call-back is called. 616 * 617 * NOTE: The call-back function 'func' is never called if tcp is in 618 * the TCPS_CLOSED state. 619 * 620 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout() 621 * request. locks acquired by the call-back routine should not be held across 622 * the call to tcp_timeout_cancel() or a deadlock may result. 623 * 624 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request. 625 * Otherwise, it returns an integer value greater than or equal to 0. In 626 * particular, if the call-back function is already placed on the squeue, it can 627 * not be canceled. 628 * 629 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called 630 * within squeue context corresponding to the tcp instance. Since the 631 * call-back is also called via the same squeue, there are no race 632 * conditions described in untimeout(9F) manual page since all calls are 633 * strictly serialized. 634 * 635 * TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout 636 * stored in tcp_timer_tid and starts a new one using 637 * MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back 638 * and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid 639 * field. 640 * 641 * NOTE: since the timeout cancellation is not guaranteed, the cancelled 642 * call-back may still be called, so it is possible tcp_timer() will be 643 * called several times. This should not be a problem since tcp_timer() 644 * should always check the tcp instance state. 645 * 646 * 647 * IMPLEMENTATION: 648 * 649 * TCP timers are implemented using three-stage process. The call to 650 * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function 651 * when the timer expires. The tcp_timer_callback() arranges the call of the 652 * tcp_timer_handler() function via squeue corresponding to the tcp 653 * instance. The tcp_timer_handler() calls actual requested timeout call-back 654 * and passes tcp instance as an argument to it. Information is passed between 655 * stages using the tcp_timer_t structure which contains the connp pointer, the 656 * tcp call-back to call and the timeout id returned by the timeout(9F). 657 * 658 * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t - 659 * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo 660 * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout() 661 * returns the pointer to this mblk. 662 * 663 * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It 664 * looks like a normal mblk without actual dblk attached to it. 665 * 666 * To optimize performance each tcp instance holds a small cache of timer 667 * mblocks. In the current implementation it caches up to two timer mblocks per 668 * tcp instance. The cache is preserved over tcp frees and is only freed when 669 * the whole tcp structure is destroyed by its kmem destructor. Since all tcp 670 * timer processing happens on a corresponding squeue, the cache manipulation 671 * does not require any locks. Experiments show that majority of timer mblocks 672 * allocations are satisfied from the tcp cache and do not involve kmem calls. 673 * 674 * The tcp_timeout() places a refhold on the connp instance which guarantees 675 * that it will be present at the time the call-back function fires. The 676 * tcp_timer_handler() drops the reference after calling the call-back, so the 677 * call-back function does not need to manipulate the references explicitly. 678 */ 679 680 typedef struct tcp_timer_s { 681 conn_t *connp; 682 void (*tcpt_proc)(void *); 683 timeout_id_t tcpt_tid; 684 } tcp_timer_t; 685 686 static kmem_cache_t *tcp_timercache; 687 kmem_cache_t *tcp_sack_info_cache; 688 kmem_cache_t *tcp_iphc_cache; 689 690 #define TCP_TIMER(tcp, f, tim) tcp_timeout(tcp->tcp_connp, f, tim) 691 #define TCP_TIMER_CANCEL(tcp, id) tcp_timeout_cancel(tcp->tcp_connp, id) 692 693 /* 694 * To restart the TCP retransmission timer. 695 */ 696 #define TCP_TIMER_RESTART(tcp, intvl) \ 697 { \ 698 if ((tcp)->tcp_timer_tid != 0) { \ 699 (void) TCP_TIMER_CANCEL((tcp), \ 700 (tcp)->tcp_timer_tid); \ 701 } \ 702 (tcp)->tcp_timer_tid = TCP_TIMER((tcp), tcp_timer, \ 703 MSEC_TO_TICK(intvl)); \ 704 } 705 706 /* 707 * For scalability, we must not run a timer for every TCP connection 708 * in TIME_WAIT state. To see why, consider (for time wait interval of 709 * 4 minutes): 710 * 1000 connections/sec * 240 seconds/time wait = 240,000 active conn's 711 * 712 * This list is ordered by time, so you need only delete from the head 713 * until you get to entries which aren't old enough to delete yet. 714 * The list consists of only the detached TIME_WAIT connections. 715 * 716 * Note that the timer (tcp_time_wait_expire) is started when the tcp_t 717 * becomes detached TIME_WAIT (either by changing the state and already 718 * being detached or the other way around). This means that the TIME_WAIT 719 * state can be extended (up to doubled) if the connection doesn't become 720 * detached for a long time. 721 * 722 * The list manipulations (including tcp_time_wait_next/prev) 723 * are protected by the tcp_time_wait_lock. The content of the 724 * detached TIME_WAIT connections is protected by the normal perimeters. 725 */ 726 727 typedef struct tcp_squeue_priv_s { 728 kmutex_t tcp_time_wait_lock; 729 /* Protects the next 3 globals */ 730 timeout_id_t tcp_time_wait_tid; 731 tcp_t *tcp_time_wait_head; 732 tcp_t *tcp_time_wait_tail; 733 tcp_t *tcp_free_list; 734 } tcp_squeue_priv_t; 735 736 /* 737 * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs. 738 * Running it every 5 seconds seems to give the best results. 739 */ 740 #define TCP_TIME_WAIT_DELAY drv_usectohz(5000000) 741 742 743 #define TCP_XMIT_LOWATER 4096 744 #define TCP_XMIT_HIWATER 49152 745 #define TCP_RECV_LOWATER 2048 746 #define TCP_RECV_HIWATER 49152 747 748 /* 749 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 750 */ 751 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 752 753 #define TIDUSZ 4096 /* transport interface data unit size */ 754 755 /* 756 * Bind hash list size and has function. It has to be a power of 2 for 757 * hashing. 758 */ 759 #define TCP_BIND_FANOUT_SIZE 512 760 #define TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1)) 761 /* 762 * Size of listen and acceptor hash list. It has to be a power of 2 for 763 * hashing. 764 */ 765 #define TCP_FANOUT_SIZE 256 766 767 #ifdef _ILP32 768 #define TCP_ACCEPTOR_HASH(accid) \ 769 (((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1)) 770 #else 771 #define TCP_ACCEPTOR_HASH(accid) \ 772 ((uint_t)(accid) & (TCP_FANOUT_SIZE - 1)) 773 #endif /* _ILP32 */ 774 775 #define IP_ADDR_CACHE_SIZE 2048 776 #define IP_ADDR_CACHE_HASH(faddr) \ 777 (ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1)) 778 779 /* Hash for HSPs uses all 32 bits, since both networks and hosts are in table */ 780 #define TCP_HSP_HASH_SIZE 256 781 782 #define TCP_HSP_HASH(addr) \ 783 (((addr>>24) ^ (addr >>16) ^ \ 784 (addr>>8) ^ (addr)) % TCP_HSP_HASH_SIZE) 785 786 /* 787 * TCP options struct returned from tcp_parse_options. 788 */ 789 typedef struct tcp_opt_s { 790 uint32_t tcp_opt_mss; 791 uint32_t tcp_opt_wscale; 792 uint32_t tcp_opt_ts_val; 793 uint32_t tcp_opt_ts_ecr; 794 tcp_t *tcp; 795 } tcp_opt_t; 796 797 /* 798 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing 799 */ 800 801 #ifdef _BIG_ENDIAN 802 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 803 (TCPOPT_TSTAMP << 8) | 10) 804 #else 805 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 806 (TCPOPT_NOP << 8) | TCPOPT_NOP) 807 #endif 808 809 /* 810 * Flags returned from tcp_parse_options. 811 */ 812 #define TCP_OPT_MSS_PRESENT 1 813 #define TCP_OPT_WSCALE_PRESENT 2 814 #define TCP_OPT_TSTAMP_PRESENT 4 815 #define TCP_OPT_SACK_OK_PRESENT 8 816 #define TCP_OPT_SACK_PRESENT 16 817 818 /* TCP option length */ 819 #define TCPOPT_NOP_LEN 1 820 #define TCPOPT_MAXSEG_LEN 4 821 #define TCPOPT_WS_LEN 3 822 #define TCPOPT_REAL_WS_LEN (TCPOPT_WS_LEN+1) 823 #define TCPOPT_TSTAMP_LEN 10 824 #define TCPOPT_REAL_TS_LEN (TCPOPT_TSTAMP_LEN+2) 825 #define TCPOPT_SACK_OK_LEN 2 826 #define TCPOPT_REAL_SACK_OK_LEN (TCPOPT_SACK_OK_LEN+2) 827 #define TCPOPT_REAL_SACK_LEN 4 828 #define TCPOPT_MAX_SACK_LEN 36 829 #define TCPOPT_HEADER_LEN 2 830 831 /* TCP cwnd burst factor. */ 832 #define TCP_CWND_INFINITE 65535 833 #define TCP_CWND_SS 3 834 #define TCP_CWND_NORMAL 5 835 836 /* Maximum TCP initial cwin (start/restart). */ 837 #define TCP_MAX_INIT_CWND 8 838 839 /* 840 * Initialize cwnd according to RFC 3390. def_max_init_cwnd is 841 * either tcp_slow_start_initial or tcp_slow_start_after idle 842 * depending on the caller. If the upper layer has not used the 843 * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd 844 * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd. 845 * If the upper layer has changed set the tcp_init_cwnd, just use 846 * it to calculate the tcp_cwnd. 847 */ 848 #define SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd) \ 849 { \ 850 if ((tcp)->tcp_init_cwnd == 0) { \ 851 (tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss), \ 852 MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \ 853 } else { \ 854 (tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss); \ 855 } \ 856 tcp->tcp_cwnd_cnt = 0; \ 857 } 858 859 /* TCP Timer control structure */ 860 typedef struct tcpt_s { 861 pfv_t tcpt_pfv; /* The routine we are to call */ 862 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 863 } tcpt_t; 864 865 /* Host Specific Parameter structure */ 866 typedef struct tcp_hsp { 867 struct tcp_hsp *tcp_hsp_next; 868 in6_addr_t tcp_hsp_addr_v6; 869 in6_addr_t tcp_hsp_subnet_v6; 870 uint_t tcp_hsp_vers; /* IPV4_VERSION | IPV6_VERSION */ 871 int32_t tcp_hsp_sendspace; 872 int32_t tcp_hsp_recvspace; 873 int32_t tcp_hsp_tstamp; 874 } tcp_hsp_t; 875 #define tcp_hsp_addr V4_PART_OF_V6(tcp_hsp_addr_v6) 876 #define tcp_hsp_subnet V4_PART_OF_V6(tcp_hsp_subnet_v6) 877 878 /* 879 * Functions called directly via squeue having a prototype of edesc_t. 880 */ 881 void tcp_conn_request(void *arg, mblk_t *mp, void *arg2); 882 static void tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2); 883 void tcp_accept_finish(void *arg, mblk_t *mp, void *arg2); 884 static void tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2); 885 static void tcp_wput_proto(void *arg, mblk_t *mp, void *arg2); 886 void tcp_input(void *arg, mblk_t *mp, void *arg2); 887 void tcp_rput_data(void *arg, mblk_t *mp, void *arg2); 888 static void tcp_close_output(void *arg, mblk_t *mp, void *arg2); 889 static void tcp_output(void *arg, mblk_t *mp, void *arg2); 890 static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2); 891 static void tcp_timer_handler(void *arg, mblk_t *mp, void *arg2); 892 893 894 /* Prototype for TCP functions */ 895 static void tcp_random_init(void); 896 int tcp_random(void); 897 static void tcp_accept(tcp_t *tcp, mblk_t *mp); 898 static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, 899 tcp_t *eager); 900 static int tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp); 901 static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 902 int reuseaddr, boolean_t bind_to_req_port_only, 903 boolean_t user_specified); 904 static void tcp_closei_local(tcp_t *tcp); 905 static void tcp_close_detached(tcp_t *tcp); 906 static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, 907 mblk_t *idmp, mblk_t **defermp); 908 static void tcp_connect(tcp_t *tcp, mblk_t *mp); 909 static void tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, 910 in_port_t dstport, uint_t srcid); 911 static void tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 912 in_port_t dstport, uint32_t flowinfo, uint_t srcid, 913 uint32_t scope_id); 914 static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag); 915 static void tcp_def_q_set(tcp_t *tcp, mblk_t *mp); 916 static void tcp_disconnect(tcp_t *tcp, mblk_t *mp); 917 static char *tcp_display(tcp_t *tcp, char *, char); 918 static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum); 919 static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only); 920 static void tcp_eager_unlink(tcp_t *tcp); 921 static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr, 922 int unixerr); 923 static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 924 int tlierr, int unixerr); 925 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 926 cred_t *cr); 927 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 928 char *value, caddr_t cp, cred_t *cr); 929 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 930 char *value, caddr_t cp, cred_t *cr); 931 static int tcp_tpistate(tcp_t *tcp); 932 static void tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp, 933 int caller_holds_lock); 934 static void tcp_bind_hash_remove(tcp_t *tcp); 935 static tcp_t *tcp_acceptor_hash_lookup(t_uscalar_t id); 936 void tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp); 937 static void tcp_acceptor_hash_remove(tcp_t *tcp); 938 static void tcp_capability_req(tcp_t *tcp, mblk_t *mp); 939 static void tcp_info_req(tcp_t *tcp, mblk_t *mp); 940 static void tcp_addr_req(tcp_t *tcp, mblk_t *mp); 941 static void tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *mp); 942 static int tcp_header_init_ipv4(tcp_t *tcp); 943 static int tcp_header_init_ipv6(tcp_t *tcp); 944 int tcp_init(tcp_t *tcp, queue_t *q); 945 static int tcp_init_values(tcp_t *tcp); 946 static mblk_t *tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic); 947 static mblk_t *tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, 948 t_scalar_t addr_length); 949 static void tcp_ip_ire_mark_advice(tcp_t *tcp); 950 static void tcp_ip_notify(tcp_t *tcp); 951 static mblk_t *tcp_ire_mp(mblk_t *mp); 952 static void tcp_iss_init(tcp_t *tcp); 953 static void tcp_keepalive_killer(void *arg); 954 static int tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk); 955 static int tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt); 956 static void tcp_mss_set(tcp_t *tcp, uint32_t size); 957 static int tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, 958 int *do_disconnectp, int *t_errorp, int *sys_errorp); 959 static boolean_t tcp_allow_connopt_set(int level, int name); 960 int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr); 961 int tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr); 962 static int tcp_opt_get_user(ipha_t *ipha, uchar_t *ptr); 963 int tcp_opt_set(queue_t *q, uint_t optset_context, int level, 964 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp, 965 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, 966 mblk_t *mblk); 967 static void tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha); 968 static int tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, 969 uchar_t *ptr, uint_t len); 970 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 971 static boolean_t tcp_param_register(tcpparam_t *tcppa, int cnt); 972 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 973 caddr_t cp, cred_t *cr); 974 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 975 caddr_t cp, cred_t *cr); 976 static void tcp_iss_key_init(uint8_t *phrase, int len); 977 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 978 caddr_t cp, cred_t *cr); 979 static void tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt); 980 static mblk_t *tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start); 981 static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp); 982 static void tcp_reinit(tcp_t *tcp); 983 static void tcp_reinit_values(tcp_t *tcp); 984 static void tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, 985 tcp_t *thisstream, cred_t *cr); 986 987 static uint_t tcp_rcv_drain(queue_t *q, tcp_t *tcp); 988 static void tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len); 989 static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags); 990 static boolean_t tcp_send_rst_chk(void); 991 static void tcp_ss_rexmit(tcp_t *tcp); 992 static mblk_t *tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp); 993 static void tcp_process_options(tcp_t *, tcph_t *); 994 static void tcp_rput_common(tcp_t *tcp, mblk_t *mp); 995 static void tcp_rsrv(queue_t *q); 996 static int tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd); 997 static int tcp_snmp_get(queue_t *q, mblk_t *mpctl); 998 static int tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, 999 int len); 1000 static int tcp_snmp_state(tcp_t *tcp); 1001 static int tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, 1002 cred_t *cr); 1003 static int tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1004 cred_t *cr); 1005 static int tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1006 cred_t *cr); 1007 static int tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1008 cred_t *cr); 1009 static int tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1010 cred_t *cr); 1011 static int tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, 1012 caddr_t cp, cred_t *cr); 1013 static int tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, 1014 caddr_t cp, cred_t *cr); 1015 static int tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, 1016 cred_t *cr); 1017 static void tcp_timer(void *arg); 1018 static void tcp_timer_callback(void *); 1019 static in_port_t tcp_update_next_port(in_port_t port, boolean_t random); 1020 static in_port_t tcp_get_next_priv_port(void); 1021 static void tcp_wput(queue_t *q, mblk_t *mp); 1022 static void tcp_wput_sock(queue_t *q, mblk_t *mp); 1023 void tcp_wput_accept(queue_t *q, mblk_t *mp); 1024 static void tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent); 1025 static void tcp_wput_flush(tcp_t *tcp, mblk_t *mp); 1026 static void tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp); 1027 static int tcp_send(queue_t *q, tcp_t *tcp, const int mss, 1028 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 1029 const int num_sack_blk, int *usable, uint_t *snxt, 1030 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 1031 const int mdt_thres); 1032 static int tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, 1033 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 1034 const int num_sack_blk, int *usable, uint_t *snxt, 1035 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 1036 const int mdt_thres); 1037 static void tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, 1038 int num_sack_blk); 1039 static void tcp_wsrv(queue_t *q); 1040 static int tcp_xmit_end(tcp_t *tcp); 1041 void tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len); 1042 static mblk_t *tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, 1043 int32_t *offset, mblk_t **end_mp, uint32_t seq, 1044 boolean_t sendall, uint32_t *seg_len, boolean_t rexmit); 1045 static void tcp_ack_timer(void *arg); 1046 static mblk_t *tcp_ack_mp(tcp_t *tcp); 1047 static void tcp_push_timer(void *arg); 1048 static void tcp_xmit_early_reset(char *str, mblk_t *mp, 1049 uint32_t seq, uint32_t ack, int ctl, uint_t ip_hdr_len); 1050 static void tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, 1051 uint32_t ack, int ctl); 1052 static tcp_hsp_t *tcp_hsp_lookup(ipaddr_t addr); 1053 static tcp_hsp_t *tcp_hsp_lookup_ipv6(in6_addr_t *addr); 1054 static int setmaxps(queue_t *q, int maxpsz); 1055 static void tcp_set_rto(tcp_t *, time_t); 1056 static boolean_t tcp_check_policy(tcp_t *, mblk_t *, ipha_t *, ip6_t *, 1057 boolean_t, boolean_t); 1058 static void tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, 1059 boolean_t ipsec_mctl); 1060 static boolean_t tcp_cmpbuf(void *a, uint_t alen, 1061 boolean_t b_valid, void *b, uint_t blen); 1062 static boolean_t tcp_allocbuf(void **dstp, uint_t *dstlenp, 1063 boolean_t src_valid, void *src, uint_t srclen); 1064 static void tcp_savebuf(void **dstp, uint_t *dstlenp, 1065 boolean_t src_valid, void *src, uint_t srclen); 1066 static mblk_t *tcp_setsockopt_mp(int level, int cmd, 1067 char *opt, int optlen); 1068 static int tcp_pkt_set(uchar_t *, uint_t, uchar_t **, uint_t *); 1069 static int tcp_build_hdrs(queue_t *, tcp_t *); 1070 static void tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, 1071 uint32_t seg_seq, uint32_t seg_ack, int seg_len, 1072 tcph_t *tcph); 1073 boolean_t tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp); 1074 boolean_t tcp_reserved_port_add(int, in_port_t *, in_port_t *); 1075 boolean_t tcp_reserved_port_del(in_port_t, in_port_t); 1076 boolean_t tcp_reserved_port_check(in_port_t); 1077 static tcp_t *tcp_alloc_temp_tcp(in_port_t); 1078 static int tcp_reserved_port_list(queue_t *, mblk_t *, caddr_t, cred_t *); 1079 static void tcp_timers_stop(tcp_t *); 1080 static timeout_id_t tcp_timeout(conn_t *, void (*)(void *), clock_t); 1081 static clock_t tcp_timeout_cancel(conn_t *, timeout_id_t); 1082 static mblk_t *tcp_mdt_info_mp(mblk_t *); 1083 static void tcp_mdt_update(tcp_t *, ill_mdt_capab_t *, boolean_t); 1084 static int tcp_mdt_add_attrs(multidata_t *, const mblk_t *, 1085 const boolean_t, const uint32_t, const uint32_t, 1086 const uint32_t, const uint32_t); 1087 static void tcp_multisend_data(tcp_t *, ire_t *, const ill_t *, mblk_t *, 1088 const uint_t, const uint_t, boolean_t *); 1089 static void tcp_send_data(tcp_t *, queue_t *, mblk_t *); 1090 extern mblk_t *tcp_timermp_alloc(int); 1091 extern void tcp_timermp_free(tcp_t *); 1092 static void tcp_timer_free(tcp_t *tcp, mblk_t *mp); 1093 static void tcp_stop_lingering(tcp_t *tcp); 1094 static void tcp_close_linger_timeout(void *arg); 1095 void tcp_ddi_init(void); 1096 void tcp_ddi_destroy(void); 1097 static void tcp_kstat_init(void); 1098 static void tcp_kstat_fini(void); 1099 static int tcp_kstat_update(kstat_t *kp, int rw); 1100 void tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp); 1101 conn_t *tcp_get_next_conn(connf_t *, conn_t *); 1102 static int tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 1103 tcph_t *tcph, uint_t ipvers, mblk_t *idmp); 1104 static int tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 1105 tcph_t *tcph, mblk_t *idmp); 1106 static squeue_func_t tcp_squeue_switch(int); 1107 1108 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *); 1109 static int tcp_close(queue_t *, int); 1110 static int tcpclose_accept(queue_t *); 1111 static int tcp_modclose(queue_t *); 1112 static void tcp_wput_mod(queue_t *, mblk_t *); 1113 1114 static void tcp_squeue_add(squeue_t *); 1115 static boolean_t tcp_zcopy_check(tcp_t *); 1116 static void tcp_zcopy_notify(tcp_t *); 1117 static mblk_t *tcp_zcopy_disable(tcp_t *, mblk_t *); 1118 static mblk_t *tcp_zcopy_backoff(tcp_t *, mblk_t *, int); 1119 static void tcp_ire_ill_check(tcp_t *, ire_t *, ill_t *, boolean_t); 1120 1121 static void tcp_fuse(tcp_t *, uchar_t *, tcph_t *); 1122 static void tcp_unfuse(tcp_t *); 1123 static boolean_t tcp_fuse_output(tcp_t *, mblk_t *); 1124 static void tcp_fuse_output_urg(tcp_t *, mblk_t *); 1125 static boolean_t tcp_fuse_rcv_drain(queue_t *, tcp_t *, mblk_t **); 1126 1127 extern mblk_t *allocb_tryhard(size_t); 1128 1129 /* 1130 * Routines related to the TCP_IOC_ABORT_CONN ioctl command. 1131 * 1132 * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting 1133 * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure 1134 * (defined in tcp.h) needs to be filled in and passed into the kernel 1135 * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t 1136 * structure contains the four-tuple of a TCP connection and a range of TCP 1137 * states (specified by ac_start and ac_end). The use of wildcard addresses 1138 * and ports is allowed. Connections with a matching four tuple and a state 1139 * within the specified range will be aborted. The valid states for the 1140 * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT, 1141 * inclusive. 1142 * 1143 * An application which has its connection aborted by this ioctl will receive 1144 * an error that is dependent on the connection state at the time of the abort. 1145 * If the connection state is < TCPS_TIME_WAIT, an application should behave as 1146 * though a RST packet has been received. If the connection state is equal to 1147 * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel 1148 * and all resources associated with the connection will be freed. 1149 */ 1150 static mblk_t *tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *); 1151 static void tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *); 1152 static void tcp_ioctl_abort_handler(tcp_t *, mblk_t *); 1153 static int tcp_ioctl_abort(tcp_ioc_abort_conn_t *); 1154 static void tcp_ioctl_abort_conn(queue_t *, mblk_t *); 1155 static int tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *, 1156 boolean_t); 1157 1158 1159 static void tcp_clrqfull(tcp_t *); 1160 static void tcp_setqfull(tcp_t *); 1161 1162 static struct module_info tcp_rinfo = { 1163 #define TCP_MODULE_ID 5105 1164 TCP_MODULE_ID, "tcp", 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 1165 }; 1166 1167 static struct module_info tcp_winfo = { 1168 TCP_MODULE_ID, "tcp", 0, INFPSZ, 127, 16 1169 }; 1170 1171 /* 1172 * Entry points for TCP as a module. It only allows SNMP requests 1173 * to pass through. 1174 */ 1175 struct qinit tcp_mod_rinit = { 1176 (pfi_t)putnext, NULL, tcp_open, tcp_modclose, NULL, &tcp_rinfo 1177 }; 1178 1179 struct qinit tcp_mod_winit = { 1180 (pfi_t)tcp_wput_mod, NULL, tcp_open, tcp_modclose, NULL, &tcp_rinfo 1181 }; 1182 1183 /* 1184 * Entry points for TCP as a device. The normal case which supports 1185 * the TCP functionality. 1186 */ 1187 struct qinit tcp_rinit = { 1188 NULL, (pfi_t)tcp_rsrv, tcp_open, tcp_close, NULL, &tcp_rinfo 1189 }; 1190 1191 struct qinit tcp_winit = { 1192 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1193 }; 1194 1195 /* Initial entry point for TCP in socket mode. */ 1196 struct qinit tcp_sock_winit = { 1197 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1198 }; 1199 1200 /* 1201 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 1202 * an accept. Avoid allocating data structures since eager has already 1203 * been created. 1204 */ 1205 struct qinit tcp_acceptor_rinit = { 1206 NULL, (pfi_t)tcp_rsrv, NULL, tcpclose_accept, NULL, &tcp_winfo 1207 }; 1208 1209 struct qinit tcp_acceptor_winit = { 1210 (pfi_t)tcp_wput_accept, NULL, NULL, NULL, NULL, &tcp_winfo 1211 }; 1212 1213 struct streamtab tcpinfo = { 1214 &tcp_rinit, &tcp_winit 1215 }; 1216 1217 1218 extern squeue_func_t tcp_squeue_wput_proc; 1219 extern squeue_func_t tcp_squeue_timer_proc; 1220 1221 /* Protected by tcp_g_q_lock */ 1222 static queue_t *tcp_g_q; /* Default queue used during detached closes */ 1223 kmutex_t tcp_g_q_lock; 1224 1225 /* Protected by tcp_hsp_lock */ 1226 /* 1227 * XXX The host param mechanism should go away and instead we should use 1228 * the metrics associated with the routes to determine the default sndspace 1229 * and rcvspace. 1230 */ 1231 static tcp_hsp_t **tcp_hsp_hash; /* Hash table for HSPs */ 1232 krwlock_t tcp_hsp_lock; 1233 1234 /* 1235 * Extra privileged ports. In host byte order. 1236 * Protected by tcp_epriv_port_lock. 1237 */ 1238 #define TCP_NUM_EPRIV_PORTS 64 1239 static int tcp_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 1240 static uint16_t tcp_g_epriv_ports[TCP_NUM_EPRIV_PORTS] = { 2049, 4045 }; 1241 kmutex_t tcp_epriv_port_lock; 1242 1243 /* 1244 * The smallest anonymous port in the priviledged port range which TCP 1245 * looks for free port. Use in the option TCP_ANONPRIVBIND. 1246 */ 1247 static in_port_t tcp_min_anonpriv_port = 512; 1248 1249 /* Only modified during _init and _fini thus no locking is needed. */ 1250 static caddr_t tcp_g_nd; /* Head of 'named dispatch' variable list */ 1251 1252 /* Hint not protected by any lock */ 1253 static uint_t tcp_next_port_to_try; 1254 1255 1256 /* TCP bind hash list - all tcp_t with state >= BOUND. */ 1257 static tf_t tcp_bind_fanout[TCP_BIND_FANOUT_SIZE]; 1258 1259 /* TCP queue hash list - all tcp_t in case they will be an acceptor. */ 1260 static tf_t tcp_acceptor_fanout[TCP_FANOUT_SIZE]; 1261 1262 /* 1263 * TCP has a private interface for other kernel modules to reserve a 1264 * port range for them to use. Once reserved, TCP will not use any ports 1265 * in the range. This interface relies on the TCP_EXCLBIND feature. If 1266 * the semantics of TCP_EXCLBIND is changed, implementation of this interface 1267 * has to be verified. 1268 * 1269 * There can be TCP_RESERVED_PORTS_ARRAY_MAX_SIZE port ranges. Each port 1270 * range can cover at most TCP_RESERVED_PORTS_RANGE_MAX ports. A port 1271 * range is [port a, port b] inclusive. And each port range is between 1272 * TCP_LOWESET_RESERVED_PORT and TCP_LARGEST_RESERVED_PORT inclusive. 1273 * 1274 * Note that the default anonymous port range starts from 32768. There is 1275 * no port "collision" between that and the reserved port range. If there 1276 * is port collision (because the default smallest anonymous port is lowered 1277 * or some apps specifically bind to ports in the reserved port range), the 1278 * system may not be able to reserve a port range even there are enough 1279 * unbound ports as a reserved port range contains consecutive ports . 1280 */ 1281 #define TCP_RESERVED_PORTS_ARRAY_MAX_SIZE 5 1282 #define TCP_RESERVED_PORTS_RANGE_MAX 1000 1283 #define TCP_SMALLEST_RESERVED_PORT 10240 1284 #define TCP_LARGEST_RESERVED_PORT 20480 1285 1286 /* Structure to represent those reserved port ranges. */ 1287 typedef struct tcp_rport_s { 1288 in_port_t lo_port; 1289 in_port_t hi_port; 1290 tcp_t **temp_tcp_array; 1291 } tcp_rport_t; 1292 1293 /* The reserved port array. */ 1294 static tcp_rport_t tcp_reserved_port[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 1295 1296 /* Locks to protect the tcp_reserved_ports array. */ 1297 static krwlock_t tcp_reserved_port_lock; 1298 1299 /* The number of ranges in the array. */ 1300 uint32_t tcp_reserved_port_array_size = 0; 1301 1302 /* 1303 * MIB-2 stuff for SNMP 1304 * Note: tcpInErrs {tcp 15} is accumulated in ip.c 1305 */ 1306 mib2_tcp_t tcp_mib; /* SNMP fixed size info */ 1307 kstat_t *tcp_mibkp; /* kstat exporting tcp_mib data */ 1308 1309 /* 1310 * Object to represent database of options to search passed to 1311 * {sock,tpi}optcom_req() interface routine to take care of option 1312 * management and associated methods. 1313 * XXX These and other externs should ideally move to a TCP header 1314 */ 1315 extern optdb_obj_t tcp_opt_obj; 1316 extern uint_t tcp_max_optsize; 1317 1318 boolean_t tcp_icmp_source_quench = B_FALSE; 1319 /* 1320 * Following assumes TPI alignment requirements stay along 32 bit 1321 * boundaries 1322 */ 1323 #define ROUNDUP32(x) \ 1324 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 1325 1326 /* Template for response to info request. */ 1327 static struct T_info_ack tcp_g_t_info_ack = { 1328 T_INFO_ACK, /* PRIM_type */ 1329 0, /* TSDU_size */ 1330 T_INFINITE, /* ETSDU_size */ 1331 T_INVALID, /* CDATA_size */ 1332 T_INVALID, /* DDATA_size */ 1333 sizeof (sin_t), /* ADDR_size */ 1334 0, /* OPT_size - not initialized here */ 1335 TIDUSZ, /* TIDU_size */ 1336 T_COTS_ORD, /* SERV_type */ 1337 TCPS_IDLE, /* CURRENT_state */ 1338 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1339 }; 1340 1341 static struct T_info_ack tcp_g_t_info_ack_v6 = { 1342 T_INFO_ACK, /* PRIM_type */ 1343 0, /* TSDU_size */ 1344 T_INFINITE, /* ETSDU_size */ 1345 T_INVALID, /* CDATA_size */ 1346 T_INVALID, /* DDATA_size */ 1347 sizeof (sin6_t), /* ADDR_size */ 1348 0, /* OPT_size - not initialized here */ 1349 TIDUSZ, /* TIDU_size */ 1350 T_COTS_ORD, /* SERV_type */ 1351 TCPS_IDLE, /* CURRENT_state */ 1352 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1353 }; 1354 1355 #define MS 1L 1356 #define SECONDS (1000 * MS) 1357 #define MINUTES (60 * SECONDS) 1358 #define HOURS (60 * MINUTES) 1359 #define DAYS (24 * HOURS) 1360 1361 #define PARAM_MAX (~(uint32_t)0) 1362 1363 /* Max size IP datagram is 64k - 1 */ 1364 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcph_t))) 1365 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcph_t))) 1366 /* Max of the above */ 1367 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 1368 1369 /* Largest TCP port number */ 1370 #define TCP_MAX_PORT (64 * 1024 - 1) 1371 1372 /* 1373 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 1374 * layer header. It has to be a multiple of 4. 1375 */ 1376 static tcpparam_t tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 1377 #define tcp_wroff_xtra tcp_wroff_xtra_param.tcp_param_val 1378 1379 /* 1380 * All of these are alterable, within the min/max values given, at run time. 1381 * Note that the default value of "tcp_time_wait_interval" is four minutes, 1382 * per the TCP spec. 1383 */ 1384 /* BEGIN CSTYLED */ 1385 tcpparam_t tcp_param_arr[] = { 1386 /*min max value name */ 1387 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 1388 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 1389 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 1390 { 1, 1024, 1, "tcp_conn_req_min" }, 1391 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 1392 { 128, (1<<30), 1024*1024, "tcp_cwnd_max" }, 1393 { 0, 10, 0, "tcp_debug" }, 1394 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 1395 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 1396 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 1397 { 500*MS, PARAM_MAX, 8*MINUTES, "tcp_ip_abort_interval"}, 1398 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 1399 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 1400 { 1, 255, 64, "tcp_ipv4_ttl"}, 1401 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 1402 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 1403 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 1404 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 1405 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 1406 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 1407 { 1*MS, 20*SECONDS, 3*SECONDS, "tcp_rexmit_interval_initial"}, 1408 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 1409 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 1410 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 1411 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 1412 { 0, 128000, 0, "tcp_sth_rcv_hiwat" }, 1413 { 0, 128000, 0, "tcp_sth_rcv_lowat" }, 1414 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 1415 { 0, 1, 0, "tcp_ignore_path_mtu" }, 1416 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 1417 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 1418 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 1419 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 1420 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 1421 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 1422 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 1423 { 0, TCP_MSS_MAX, 64, "tcp_co_min"}, 1424 { 8192, (1<<30), 1024*1024, "tcp_max_buf"}, 1425 /* 1426 * Question: What default value should I set for tcp_strong_iss? 1427 */ 1428 { 0, 2, 1, "tcp_strong_iss"}, 1429 { 0, 65536, 20, "tcp_rtt_updates"}, 1430 { 0, 1, 1, "tcp_wscale_always"}, 1431 { 0, 1, 0, "tcp_tstamp_always"}, 1432 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 1433 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 1434 { 0, 16, 2, "tcp_deferred_acks_max"}, 1435 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 1436 { 1, 4, 4, "tcp_slow_start_initial"}, 1437 { 10*MS, 50*MS, 20*MS, "tcp_co_timer_interval"}, 1438 { 0, 2, 2, "tcp_sack_permitted"}, 1439 { 0, 1, 0, "tcp_trace"}, 1440 { 0, 1, 1, "tcp_compression_enabled"}, 1441 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 1442 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 1443 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 1444 { 0, 1, 0, "tcp_rev_src_routes"}, 1445 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 1446 { 100*MS, 60*SECONDS, 1*SECONDS, "tcp_ndd_get_info_interval"}, 1447 { 0, 16, 8, "tcp_local_dacks_max"}, 1448 { 0, 2, 1, "tcp_ecn_permitted"}, 1449 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 1450 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 1451 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 1452 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 1453 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 1454 }; 1455 /* END CSTYLED */ 1456 1457 1458 #define tcp_time_wait_interval tcp_param_arr[0].tcp_param_val 1459 #define tcp_conn_req_max_q tcp_param_arr[1].tcp_param_val 1460 #define tcp_conn_req_max_q0 tcp_param_arr[2].tcp_param_val 1461 #define tcp_conn_req_min tcp_param_arr[3].tcp_param_val 1462 #define tcp_conn_grace_period tcp_param_arr[4].tcp_param_val 1463 #define tcp_cwnd_max_ tcp_param_arr[5].tcp_param_val 1464 #define tcp_dbg tcp_param_arr[6].tcp_param_val 1465 #define tcp_smallest_nonpriv_port tcp_param_arr[7].tcp_param_val 1466 #define tcp_ip_abort_cinterval tcp_param_arr[8].tcp_param_val 1467 #define tcp_ip_abort_linterval tcp_param_arr[9].tcp_param_val 1468 #define tcp_ip_abort_interval tcp_param_arr[10].tcp_param_val 1469 #define tcp_ip_notify_cinterval tcp_param_arr[11].tcp_param_val 1470 #define tcp_ip_notify_interval tcp_param_arr[12].tcp_param_val 1471 #define tcp_ipv4_ttl tcp_param_arr[13].tcp_param_val 1472 #define tcp_keepalive_interval_high tcp_param_arr[14].tcp_param_max 1473 #define tcp_keepalive_interval tcp_param_arr[14].tcp_param_val 1474 #define tcp_keepalive_interval_low tcp_param_arr[14].tcp_param_min 1475 #define tcp_maxpsz_multiplier tcp_param_arr[15].tcp_param_val 1476 #define tcp_mss_def_ipv4 tcp_param_arr[16].tcp_param_val 1477 #define tcp_mss_max_ipv4 tcp_param_arr[17].tcp_param_val 1478 #define tcp_mss_min tcp_param_arr[18].tcp_param_val 1479 #define tcp_naglim_def tcp_param_arr[19].tcp_param_val 1480 #define tcp_rexmit_interval_initial tcp_param_arr[20].tcp_param_val 1481 #define tcp_rexmit_interval_max tcp_param_arr[21].tcp_param_val 1482 #define tcp_rexmit_interval_min tcp_param_arr[22].tcp_param_val 1483 #define tcp_deferred_ack_interval tcp_param_arr[23].tcp_param_val 1484 #define tcp_snd_lowat_fraction tcp_param_arr[24].tcp_param_val 1485 #define tcp_sth_rcv_hiwat tcp_param_arr[25].tcp_param_val 1486 #define tcp_sth_rcv_lowat tcp_param_arr[26].tcp_param_val 1487 #define tcp_dupack_fast_retransmit tcp_param_arr[27].tcp_param_val 1488 #define tcp_ignore_path_mtu tcp_param_arr[28].tcp_param_val 1489 #define tcp_smallest_anon_port tcp_param_arr[29].tcp_param_val 1490 #define tcp_largest_anon_port tcp_param_arr[30].tcp_param_val 1491 #define tcp_xmit_hiwat tcp_param_arr[31].tcp_param_val 1492 #define tcp_xmit_lowat tcp_param_arr[32].tcp_param_val 1493 #define tcp_recv_hiwat tcp_param_arr[33].tcp_param_val 1494 #define tcp_recv_hiwat_minmss tcp_param_arr[34].tcp_param_val 1495 #define tcp_fin_wait_2_flush_interval tcp_param_arr[35].tcp_param_val 1496 #define tcp_co_min tcp_param_arr[36].tcp_param_val 1497 #define tcp_max_buf tcp_param_arr[37].tcp_param_val 1498 #define tcp_strong_iss tcp_param_arr[38].tcp_param_val 1499 #define tcp_rtt_updates tcp_param_arr[39].tcp_param_val 1500 #define tcp_wscale_always tcp_param_arr[40].tcp_param_val 1501 #define tcp_tstamp_always tcp_param_arr[41].tcp_param_val 1502 #define tcp_tstamp_if_wscale tcp_param_arr[42].tcp_param_val 1503 #define tcp_rexmit_interval_extra tcp_param_arr[43].tcp_param_val 1504 #define tcp_deferred_acks_max tcp_param_arr[44].tcp_param_val 1505 #define tcp_slow_start_after_idle tcp_param_arr[45].tcp_param_val 1506 #define tcp_slow_start_initial tcp_param_arr[46].tcp_param_val 1507 #define tcp_co_timer_interval tcp_param_arr[47].tcp_param_val 1508 #define tcp_sack_permitted tcp_param_arr[48].tcp_param_val 1509 #define tcp_trace tcp_param_arr[49].tcp_param_val 1510 #define tcp_compression_enabled tcp_param_arr[50].tcp_param_val 1511 #define tcp_ipv6_hoplimit tcp_param_arr[51].tcp_param_val 1512 #define tcp_mss_def_ipv6 tcp_param_arr[52].tcp_param_val 1513 #define tcp_mss_max_ipv6 tcp_param_arr[53].tcp_param_val 1514 #define tcp_rev_src_routes tcp_param_arr[54].tcp_param_val 1515 #define tcp_local_dack_interval tcp_param_arr[55].tcp_param_val 1516 #define tcp_ndd_get_info_interval tcp_param_arr[56].tcp_param_val 1517 #define tcp_local_dacks_max tcp_param_arr[57].tcp_param_val 1518 #define tcp_ecn_permitted tcp_param_arr[58].tcp_param_val 1519 #define tcp_rst_sent_rate_enabled tcp_param_arr[59].tcp_param_val 1520 #define tcp_rst_sent_rate tcp_param_arr[60].tcp_param_val 1521 #define tcp_push_timer_interval tcp_param_arr[61].tcp_param_val 1522 #define tcp_use_smss_as_mss_opt tcp_param_arr[62].tcp_param_val 1523 #define tcp_keepalive_abort_interval_high tcp_param_arr[63].tcp_param_max 1524 #define tcp_keepalive_abort_interval tcp_param_arr[63].tcp_param_val 1525 #define tcp_keepalive_abort_interval_low tcp_param_arr[63].tcp_param_min 1526 1527 /* 1528 * tcp_mdt_hdr_{head,tail}_min are the leading and trailing spaces of 1529 * each header fragment in the header buffer. Each parameter value has 1530 * to be a multiple of 4 (32-bit aligned). 1531 */ 1532 static tcpparam_t tcp_mdt_head_param = { 32, 256, 32, "tcp_mdt_hdr_head_min" }; 1533 static tcpparam_t tcp_mdt_tail_param = { 0, 256, 32, "tcp_mdt_hdr_tail_min" }; 1534 #define tcp_mdt_hdr_head_min tcp_mdt_head_param.tcp_param_val 1535 #define tcp_mdt_hdr_tail_min tcp_mdt_tail_param.tcp_param_val 1536 1537 /* 1538 * tcp_mdt_max_pbufs is the upper limit value that tcp uses to figure out 1539 * the maximum number of payload buffers associated per Multidata. 1540 */ 1541 static tcpparam_t tcp_mdt_max_pbufs_param = 1542 { 1, MULTIDATA_MAX_PBUFS, MULTIDATA_MAX_PBUFS, "tcp_mdt_max_pbufs" }; 1543 #define tcp_mdt_max_pbufs tcp_mdt_max_pbufs_param.tcp_param_val 1544 1545 /* Round up the value to the nearest mss. */ 1546 #define MSS_ROUNDUP(value, mss) ((((value) - 1) / (mss) + 1) * (mss)) 1547 1548 /* 1549 * Set ECN capable transport (ECT) code point in IP header. 1550 * 1551 * Note that there are 2 ECT code points '01' and '10', which are called 1552 * ECT(1) and ECT(0) respectively. Here we follow the original ECT code 1553 * point ECT(0) for TCP as described in RFC 2481. 1554 */ 1555 #define SET_ECT(tcp, iph) \ 1556 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1557 /* We need to clear the code point first. */ \ 1558 ((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \ 1559 ((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \ 1560 } else { \ 1561 ((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \ 1562 ((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \ 1563 } 1564 1565 /* 1566 * The format argument to pass to tcp_display(). 1567 * DISP_PORT_ONLY means that the returned string has only port info. 1568 * DISP_ADDR_AND_PORT means that the returned string also contains the 1569 * remote and local IP address. 1570 */ 1571 #define DISP_PORT_ONLY 1 1572 #define DISP_ADDR_AND_PORT 2 1573 1574 /* 1575 * This controls the rate some ndd info report functions can be used 1576 * by non-priviledged users. It stores the last time such info is 1577 * requested. When those report functions are called again, this 1578 * is checked with the current time and compare with the ndd param 1579 * tcp_ndd_get_info_interval. 1580 */ 1581 static clock_t tcp_last_ndd_get_info_time = 0; 1582 #define NDD_TOO_QUICK_MSG \ 1583 "ndd get info rate too high for non-priviledged users, try again " \ 1584 "later.\n" 1585 #define NDD_OUT_OF_BUF_MSG "<< Out of buffer >>\n" 1586 1587 #define IS_VMLOANED_MBLK(mp) \ 1588 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 1589 1590 /* 1591 * These two variables control the rate for TCP to generate RSTs in 1592 * response to segments not belonging to any connections. We limit 1593 * TCP to sent out tcp_rst_sent_rate (ndd param) number of RSTs in 1594 * each 1 second interval. This is to protect TCP against DoS attack. 1595 */ 1596 static clock_t tcp_last_rst_intrvl; 1597 static uint32_t tcp_rst_cnt; 1598 1599 /* The number of RST not sent because of the rate limit. */ 1600 static uint32_t tcp_rst_unsent; 1601 1602 /* Enable or disable b_cont M_MULTIDATA chaining for MDT. */ 1603 boolean_t tcp_mdt_chain = B_TRUE; 1604 1605 /* 1606 * MDT threshold in the form of effective send MSS multiplier; we take 1607 * the MDT path if the amount of unsent data exceeds the threshold value 1608 * (default threshold is 1*SMSS). 1609 */ 1610 uint_t tcp_mdt_smss_threshold = 1; 1611 1612 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 1613 1614 /* 1615 * Forces all connections to obey the value of the tcp_maxpsz_multiplier 1616 * tunable settable via NDD. Otherwise, the per-connection behavior is 1617 * determined dynamically during tcp_adapt_ire(), which is the default. 1618 */ 1619 boolean_t tcp_static_maxpsz = B_FALSE; 1620 1621 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */ 1622 uint32_t tcp_random_anon_port = 1; 1623 1624 /* 1625 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 1626 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 1627 * data, TCP will not respond with an ACK. RFC 793 requires that 1628 * TCP responds with an ACK for such a bogus ACK. By not following 1629 * the RFC, we prevent TCP from getting into an ACK storm if somehow 1630 * an attacker successfully spoofs an acceptable segment to our 1631 * peer; or when our peer is "confused." 1632 */ 1633 uint32_t tcp_drop_ack_unsent_cnt = 10; 1634 1635 /* 1636 * Hook functions to enable cluster networking 1637 * On non-clustered systems these vectors must always be NULL. 1638 */ 1639 1640 void (*cl_inet_listen)(uint8_t protocol, sa_family_t addr_family, 1641 uint8_t *laddrp, in_port_t lport) = NULL; 1642 void (*cl_inet_unlisten)(uint8_t protocol, sa_family_t addr_family, 1643 uint8_t *laddrp, in_port_t lport) = NULL; 1644 void (*cl_inet_connect)(uint8_t protocol, sa_family_t addr_family, 1645 uint8_t *laddrp, in_port_t lport, 1646 uint8_t *faddrp, in_port_t fport) = NULL; 1647 void (*cl_inet_disconnect)(uint8_t protocol, sa_family_t addr_family, 1648 uint8_t *laddrp, in_port_t lport, 1649 uint8_t *faddrp, in_port_t fport) = NULL; 1650 1651 /* 1652 * The following are defined in ip.c 1653 */ 1654 extern int (*cl_inet_isclusterwide)(uint8_t protocol, sa_family_t addr_family, 1655 uint8_t *laddrp); 1656 extern uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family, 1657 uint8_t *laddrp, uint8_t *faddrp); 1658 1659 #define CL_INET_CONNECT(tcp) { \ 1660 if (cl_inet_connect != NULL) { \ 1661 /* \ 1662 * Running in cluster mode - register active connection \ 1663 * information \ 1664 */ \ 1665 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1666 if ((tcp)->tcp_ipha->ipha_src != 0) { \ 1667 (*cl_inet_connect)(IPPROTO_TCP, AF_INET,\ 1668 (uint8_t *)(&((tcp)->tcp_ipha->ipha_src)),\ 1669 (in_port_t)(tcp)->tcp_lport, \ 1670 (uint8_t *)(&((tcp)->tcp_ipha->ipha_dst)),\ 1671 (in_port_t)(tcp)->tcp_fport); \ 1672 } \ 1673 } else { \ 1674 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1675 &(tcp)->tcp_ip6h->ip6_src)) {\ 1676 (*cl_inet_connect)(IPPROTO_TCP, AF_INET6,\ 1677 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_src)),\ 1678 (in_port_t)(tcp)->tcp_lport, \ 1679 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_dst)),\ 1680 (in_port_t)(tcp)->tcp_fport); \ 1681 } \ 1682 } \ 1683 } \ 1684 } 1685 1686 #define CL_INET_DISCONNECT(tcp) { \ 1687 if (cl_inet_disconnect != NULL) { \ 1688 /* \ 1689 * Running in cluster mode - deregister active \ 1690 * connection information \ 1691 */ \ 1692 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1693 if ((tcp)->tcp_ip_src != 0) { \ 1694 (*cl_inet_disconnect)(IPPROTO_TCP, \ 1695 AF_INET, \ 1696 (uint8_t *)(&((tcp)->tcp_ip_src)),\ 1697 (in_port_t)(tcp)->tcp_lport, \ 1698 (uint8_t *) \ 1699 (&((tcp)->tcp_ipha->ipha_dst)),\ 1700 (in_port_t)(tcp)->tcp_fport); \ 1701 } \ 1702 } else { \ 1703 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1704 &(tcp)->tcp_ip_src_v6)) { \ 1705 (*cl_inet_disconnect)(IPPROTO_TCP, AF_INET6,\ 1706 (uint8_t *)(&((tcp)->tcp_ip_src_v6)),\ 1707 (in_port_t)(tcp)->tcp_lport, \ 1708 (uint8_t *) \ 1709 (&((tcp)->tcp_ip6h->ip6_dst)),\ 1710 (in_port_t)(tcp)->tcp_fport); \ 1711 } \ 1712 } \ 1713 } \ 1714 } 1715 1716 /* 1717 * Cluster networking hook for traversing current connection list. 1718 * This routine is used to extract the current list of live connections 1719 * which must continue to to be dispatched to this node. 1720 */ 1721 int cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg); 1722 1723 #define IPH_TCPH_CHECKSUMP(ipha, hlen) \ 1724 ((uint16_t *)(((uchar_t *)(ipha)) + ((hlen) + 16))) 1725 1726 #ifdef _BIG_ENDIAN 1727 #define IP_TCP_CSUM_COMP IPPROTO_TCP 1728 #else 1729 #define IP_TCP_CSUM_COMP (IPPROTO_TCP << 8) 1730 #endif 1731 1732 #define IP_HDR_CKSUM(ipha, sum, v_hlen_tos_len, ttl_protocol) { \ 1733 (sum) += (ttl_protocol) + (ipha)->ipha_ident + \ 1734 ((v_hlen_tos_len) >> 16) + \ 1735 ((v_hlen_tos_len) & 0xFFFF) + \ 1736 (ipha)->ipha_fragment_offset_and_flags; \ 1737 (sum) = (((sum) & 0xFFFF) + ((sum) >> 16)); \ 1738 (sum) = ~((sum) + ((sum) >> 16)); \ 1739 (ipha)->ipha_hdr_checksum = (uint16_t)(sum); \ 1740 } 1741 1742 /* 1743 * Macros that determine whether or not IP processing is needed for TCP. 1744 */ 1745 #define TCP_IPOPT_POLICY_V4(tcp) \ 1746 ((tcp)->tcp_ipversion == IPV4_VERSION && \ 1747 ((tcp)->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH || \ 1748 CONN_OUTBOUND_POLICY_PRESENT((tcp)->tcp_connp) || \ 1749 CONN_INBOUND_POLICY_PRESENT((tcp)->tcp_connp))) 1750 1751 #define TCP_IPOPT_POLICY_V6(tcp) \ 1752 ((tcp)->tcp_ipversion == IPV6_VERSION && \ 1753 ((tcp)->tcp_ip_hdr_len != IPV6_HDR_LEN || \ 1754 CONN_OUTBOUND_POLICY_PRESENT_V6((tcp)->tcp_connp) || \ 1755 CONN_INBOUND_POLICY_PRESENT_V6((tcp)->tcp_connp))) 1756 1757 #define TCP_LOOPBACK_IP(tcp) \ 1758 (TCP_IPOPT_POLICY_V4(tcp) || TCP_IPOPT_POLICY_V6(tcp) || \ 1759 !CONN_IS_MD_FASTPATH((tcp)->tcp_connp)) 1760 1761 boolean_t do_tcp_fusion = B_TRUE; 1762 1763 /* 1764 * This routine gets called by the eager tcp upon changing state from 1765 * SYN_RCVD to ESTABLISHED. It fuses a direct path between itself 1766 * and the active connect tcp such that the regular tcp processings 1767 * may be bypassed under allowable circumstances. Because the fusion 1768 * requires both endpoints to be in the same squeue, it does not work 1769 * for simultaneous active connects because there is no easy way to 1770 * switch from one squeue to another once the connection is created. 1771 * This is different from the eager tcp case where we assign it the 1772 * same squeue as the one given to the active connect tcp during open. 1773 */ 1774 static void 1775 tcp_fuse(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph) 1776 { 1777 conn_t *peer_connp, *connp = tcp->tcp_connp; 1778 tcp_t *peer_tcp; 1779 1780 ASSERT(!tcp->tcp_fused); 1781 ASSERT(tcp->tcp_loopback); 1782 ASSERT(tcp->tcp_loopback_peer == NULL); 1783 /* 1784 * We need to check the listener tcp to make sure it's a socket 1785 * endpoint, but we can't really use tcp_listener since we get 1786 * here after sending up T_CONN_IND and tcp_wput_accept() may be 1787 * called independently, at which point tcp_listener is cleared; 1788 * this is why we use tcp_saved_listener. The listener itself 1789 * is guaranteed to be around until tcp_accept_finish() is called 1790 * on this eager -- this won't happen until we're done since 1791 * we're inside the eager's perimeter now. 1792 */ 1793 ASSERT(tcp->tcp_saved_listener != NULL); 1794 1795 /* 1796 * Lookup peer endpoint; search for the remote endpoint having 1797 * the reversed address-port quadruplet in ESTABLISHED state, 1798 * which is guaranteed to be unique in the system. Zone check 1799 * is applied accordingly for loopback address, but not for 1800 * local address since we want fusion to happen across Zones. 1801 */ 1802 if (tcp->tcp_ipversion == IPV4_VERSION) { 1803 peer_connp = ipcl_conn_tcp_lookup_reversed_ipv4(connp, 1804 (ipha_t *)iphdr, tcph); 1805 } else { 1806 peer_connp = ipcl_conn_tcp_lookup_reversed_ipv6(connp, 1807 (ip6_t *)iphdr, tcph); 1808 } 1809 1810 /* 1811 * We can only proceed if peer exists, resides in the same squeue 1812 * as our conn and is not raw-socket. The squeue assignment of 1813 * this eager tcp was done earlier at the time of SYN processing 1814 * in ip_fanout_tcp{_v6}. Note that similar squeues by itself 1815 * doesn't guarantee a safe condition to fuse, hence we perform 1816 * additional tests below. 1817 */ 1818 ASSERT(peer_connp == NULL || peer_connp != connp); 1819 if (peer_connp == NULL || peer_connp->conn_sqp != connp->conn_sqp || 1820 !IPCL_IS_TCP(peer_connp)) { 1821 if (peer_connp != NULL) { 1822 TCP_STAT(tcp_fusion_unqualified); 1823 CONN_DEC_REF(peer_connp); 1824 } 1825 return; 1826 } 1827 peer_tcp = peer_connp->conn_tcp; /* active connect tcp */ 1828 1829 ASSERT(peer_tcp != NULL && peer_tcp != tcp && !peer_tcp->tcp_fused); 1830 ASSERT(peer_tcp->tcp_loopback && peer_tcp->tcp_loopback_peer == NULL); 1831 ASSERT(peer_connp->conn_sqp == connp->conn_sqp); 1832 1833 /* 1834 * Fuse the endpoints; we perform further checks against both 1835 * tcp endpoints to ensure that a fusion is allowed to happen. 1836 * In particular we bail out for TPI, non-simple TCP/IP or if 1837 * IPsec/IPQoS policy exists. We could actually do it for the 1838 * XTI/TLI/TPI case but this requires more testing, so for now 1839 * we handle only the socket case. 1840 */ 1841 if (!tcp->tcp_unfusable && !peer_tcp->tcp_unfusable && 1842 TCP_IS_SOCKET(tcp->tcp_saved_listener) && TCP_IS_SOCKET(peer_tcp) && 1843 !TCP_LOOPBACK_IP(tcp) && !TCP_LOOPBACK_IP(peer_tcp) && 1844 !IPP_ENABLED(IPP_LOCAL_OUT|IPP_LOCAL_IN)) { 1845 mblk_t *mp; 1846 struct stroptions *stropt; 1847 queue_t *peer_rq = peer_tcp->tcp_rq; 1848 size_t sth_hiwat; 1849 1850 ASSERT(!TCP_IS_DETACHED(peer_tcp) && peer_rq != NULL); 1851 1852 /* 1853 * We need to drain data on both endpoints during unfuse. 1854 * If we need to send up SIGURG at the time of draining, 1855 * we want to be sure that an mblk is readily available. 1856 * This is why we pre-allocate the M_PCSIG mblks for both 1857 * endpoints which will only be used during/after unfuse. 1858 */ 1859 if ((mp = allocb(1, BPRI_HI)) == NULL) { 1860 CONN_DEC_REF(peer_connp); 1861 return; 1862 } 1863 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 1864 tcp->tcp_fused_sigurg_mp = mp; 1865 1866 if ((mp = allocb(1, BPRI_HI)) == NULL) { 1867 freeb(tcp->tcp_fused_sigurg_mp); 1868 tcp->tcp_fused_sigurg_mp = NULL; 1869 CONN_DEC_REF(peer_connp); 1870 return; 1871 } 1872 ASSERT(peer_tcp->tcp_fused_sigurg_mp == NULL); 1873 peer_tcp->tcp_fused_sigurg_mp = mp; 1874 1875 /* Allocate M_SETOPTS mblk */ 1876 mp = allocb(sizeof (*stropt), BPRI_HI); 1877 if (mp == NULL) { 1878 freeb(tcp->tcp_fused_sigurg_mp); 1879 tcp->tcp_fused_sigurg_mp = NULL; 1880 freeb(peer_tcp->tcp_fused_sigurg_mp); 1881 peer_tcp->tcp_fused_sigurg_mp = NULL; 1882 CONN_DEC_REF(peer_connp); 1883 return; 1884 } 1885 1886 /* Fuse both endpoints */ 1887 peer_tcp->tcp_loopback_peer = tcp; 1888 tcp->tcp_loopback_peer = peer_tcp; 1889 peer_tcp->tcp_fused = tcp->tcp_fused = B_TRUE; 1890 1891 /* 1892 * We never use regular tcp paths in fusion and should 1893 * therefore clear tcp_unsent on both endpoints. Having 1894 * them set to non-zero values means asking for trouble 1895 * especially after unfuse, where we may end up sending 1896 * through regular tcp paths which expect xmit_list and 1897 * friends to be correctly setup. 1898 */ 1899 peer_tcp->tcp_unsent = tcp->tcp_unsent = 0; 1900 1901 tcp_timers_stop(tcp); 1902 tcp_timers_stop(peer_tcp); 1903 1904 /* 1905 * Set the stream head's write offset value to zero, since we 1906 * won't be needing any room for TCP/IP headers, and tell it 1907 * to not break up the writes. This would reduce the amount 1908 * of work done by kmem. In addition, we set the receive 1909 * buffer to twice that of q_hiwat in order to simulate the 1910 * non-fusion case. Note that we can only do this for the 1911 * active connect tcp since our eager is still detached; 1912 * it will be dealt with later in tcp_accept_finish(). 1913 */ 1914 DB_TYPE(mp) = M_SETOPTS; 1915 mp->b_wptr += sizeof (*stropt); 1916 1917 sth_hiwat = peer_rq->q_hiwat << 1; 1918 if (sth_hiwat > tcp_max_buf) 1919 sth_hiwat = tcp_max_buf; 1920 1921 stropt = (struct stroptions *)mp->b_rptr; 1922 stropt->so_flags = SO_MAXBLK | SO_WROFF | SO_HIWAT; 1923 stropt->so_maxblk = tcp_maxpsz_set(peer_tcp, B_FALSE); 1924 stropt->so_wroff = 0; 1925 stropt->so_hiwat = MAX(sth_hiwat, tcp_sth_rcv_hiwat); 1926 1927 /* Send the options up */ 1928 putnext(peer_rq, mp); 1929 } else { 1930 TCP_STAT(tcp_fusion_unqualified); 1931 } 1932 CONN_DEC_REF(peer_connp); 1933 } 1934 1935 /* 1936 * Unfuse a previously-fused pair of tcp loopback endpoints. 1937 */ 1938 static void 1939 tcp_unfuse(tcp_t *tcp) 1940 { 1941 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 1942 1943 ASSERT(tcp->tcp_fused && peer_tcp != NULL); 1944 ASSERT(peer_tcp->tcp_fused && peer_tcp->tcp_loopback_peer == tcp); 1945 ASSERT(tcp->tcp_connp->conn_sqp == peer_tcp->tcp_connp->conn_sqp); 1946 ASSERT(tcp->tcp_unsent == 0 && peer_tcp->tcp_unsent == 0); 1947 ASSERT(tcp->tcp_fused_sigurg_mp != NULL); 1948 ASSERT(peer_tcp->tcp_fused_sigurg_mp != NULL); 1949 1950 /* 1951 * Drain any pending data; the detached check is needed because 1952 * we may be called from tcp_fuse_output(). Note that in case of 1953 * a detached tcp, the draining will happen later after the tcp 1954 * is unfused. For non-urgent data, this can be handled by the 1955 * regular tcp_rcv_drain(). If we have urgent data sitting in 1956 * the receive list, we will need to send up a SIGURG signal first 1957 * before draining the data. All of these will be handled by the 1958 * code in tcp_fuse_rcv_drain() when called from tcp_rcv_drain(). 1959 */ 1960 if (!TCP_IS_DETACHED(tcp)) { 1961 (void) tcp_fuse_rcv_drain(tcp->tcp_rq, tcp, 1962 &tcp->tcp_fused_sigurg_mp); 1963 } 1964 if (!TCP_IS_DETACHED(peer_tcp)) { 1965 (void) tcp_fuse_rcv_drain(peer_tcp->tcp_rq, peer_tcp, 1966 &peer_tcp->tcp_fused_sigurg_mp); 1967 } 1968 /* Lift up any flow-control conditions */ 1969 if (tcp->tcp_flow_stopped) { 1970 tcp_clrqfull(tcp); 1971 tcp->tcp_flow_stopped = B_FALSE; 1972 TCP_STAT(tcp_fusion_backenabled); 1973 } 1974 if (peer_tcp->tcp_flow_stopped) { 1975 tcp_clrqfull(peer_tcp); 1976 peer_tcp->tcp_flow_stopped = B_FALSE; 1977 TCP_STAT(tcp_fusion_backenabled); 1978 } 1979 1980 /* Free up M_PCSIG mblk(s) if not needed */ 1981 if (!tcp->tcp_fused_sigurg && tcp->tcp_fused_sigurg_mp != NULL) { 1982 freeb(tcp->tcp_fused_sigurg_mp); 1983 tcp->tcp_fused_sigurg_mp = NULL; 1984 } 1985 if (!peer_tcp->tcp_fused_sigurg && 1986 peer_tcp->tcp_fused_sigurg_mp != NULL) { 1987 freeb(peer_tcp->tcp_fused_sigurg_mp); 1988 peer_tcp->tcp_fused_sigurg_mp = NULL; 1989 } 1990 1991 /* 1992 * Update th_seq and th_ack in the header template 1993 */ 1994 U32_TO_ABE32(tcp->tcp_snxt, tcp->tcp_tcph->th_seq); 1995 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 1996 U32_TO_ABE32(peer_tcp->tcp_snxt, peer_tcp->tcp_tcph->th_seq); 1997 U32_TO_ABE32(peer_tcp->tcp_rnxt, peer_tcp->tcp_tcph->th_ack); 1998 1999 /* Unfuse the endpoints */ 2000 peer_tcp->tcp_fused = tcp->tcp_fused = B_FALSE; 2001 peer_tcp->tcp_loopback_peer = tcp->tcp_loopback_peer = NULL; 2002 } 2003 2004 /* 2005 * Fusion output routine for urgent data. This routine is called by 2006 * tcp_fuse_output() for handling non-M_DATA mblks. 2007 */ 2008 static void 2009 tcp_fuse_output_urg(tcp_t *tcp, mblk_t *mp) 2010 { 2011 mblk_t *mp1; 2012 struct T_exdata_ind *tei; 2013 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2014 mblk_t *head, *prev_head = NULL; 2015 2016 ASSERT(tcp->tcp_fused); 2017 ASSERT(peer_tcp != NULL && peer_tcp->tcp_loopback_peer == tcp); 2018 ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO); 2019 ASSERT(mp->b_cont != NULL && DB_TYPE(mp->b_cont) == M_DATA); 2020 ASSERT(MBLKL(mp) >= sizeof (*tei) && MBLKL(mp->b_cont) > 0); 2021 2022 /* 2023 * Urgent data arrives in the form of T_EXDATA_REQ from above. 2024 * Each occurence denotes a new urgent pointer. For each new 2025 * urgent pointer we signal (SIGURG) the receiving app to indicate 2026 * that it needs to go into urgent mode. This is similar to the 2027 * urgent data handling in the regular tcp. We don't need to keep 2028 * track of where the urgent pointer is, because each T_EXDATA_REQ 2029 * "advances" the urgent pointer for us. 2030 * 2031 * The actual urgent data carried by T_EXDATA_REQ is then prepended 2032 * by a T_EXDATA_IND before being enqueued behind any existing data 2033 * destined for the receiving app. There is only a single urgent 2034 * pointer (out-of-band mark) for a given tcp. If the new urgent 2035 * data arrives before the receiving app reads some existing urgent 2036 * data, the previous marker is lost. This behavior is emulated 2037 * accordingly below, by removing any existing T_EXDATA_IND messages 2038 * and essentially converting old urgent data into non-urgent. 2039 */ 2040 ASSERT(tcp->tcp_valid_bits & TCP_URG_VALID); 2041 /* Let sender get out of urgent mode */ 2042 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 2043 2044 /* 2045 * Send up SIGURG to the receiving peer; if the peer is detached 2046 * or if we can't allocate the M_PCSIG, indicate that we need to 2047 * signal upon draining to the peer by marking tcp_fused_sigurg. 2048 * This flag will only get cleared once SIGURG is delivered and 2049 * is not affected by the tcp_fused flag -- delivery will still 2050 * happen even after an endpoint is unfused, to handle the case 2051 * where the sending endpoint immediately closes/unfuses after 2052 * sending urgent data and the accept is not yet finished. 2053 */ 2054 if (!TCP_IS_DETACHED(peer_tcp) && 2055 ((mp1 = allocb(1, BPRI_HI)) != NULL || 2056 (mp1 = allocb_tryhard(1)) != NULL)) { 2057 peer_tcp->tcp_fused_sigurg = B_FALSE; 2058 /* Send up the signal */ 2059 DB_TYPE(mp1) = M_PCSIG; 2060 *mp1->b_wptr++ = (uchar_t)SIGURG; 2061 putnext(peer_tcp->tcp_rq, mp1); 2062 } else { 2063 peer_tcp->tcp_fused_sigurg = B_TRUE; 2064 } 2065 2066 /* Reuse T_EXDATA_REQ mblk for T_EXDATA_IND */ 2067 DB_TYPE(mp) = M_PROTO; 2068 tei = (struct T_exdata_ind *)mp->b_rptr; 2069 tei->PRIM_type = T_EXDATA_IND; 2070 tei->MORE_flag = 0; 2071 mp->b_wptr = (uchar_t *)&tei[1]; 2072 2073 TCP_STAT(tcp_fusion_urg); 2074 BUMP_MIB(&tcp_mib, tcpOutUrg); 2075 2076 head = peer_tcp->tcp_rcv_list; 2077 while (head != NULL) { 2078 /* 2079 * Remove existing T_EXDATA_IND, keep the data which follows 2080 * it and relink our list. Note that we don't modify the 2081 * tcp_rcv_last_tail since it never points to T_EXDATA_IND. 2082 */ 2083 if (DB_TYPE(head) != M_DATA) { 2084 mp1 = head; 2085 2086 ASSERT(DB_TYPE(mp1->b_cont) == M_DATA); 2087 head = mp1->b_cont; 2088 mp1->b_cont = NULL; 2089 head->b_next = mp1->b_next; 2090 mp1->b_next = NULL; 2091 if (prev_head != NULL) 2092 prev_head->b_next = head; 2093 if (peer_tcp->tcp_rcv_list == mp1) 2094 peer_tcp->tcp_rcv_list = head; 2095 if (peer_tcp->tcp_rcv_last_head == mp1) 2096 peer_tcp->tcp_rcv_last_head = head; 2097 freeb(mp1); 2098 } 2099 prev_head = head; 2100 head = head->b_next; 2101 } 2102 } 2103 2104 /* 2105 * Fusion output routine, called by tcp_output() and tcp_wput_proto(). 2106 */ 2107 static boolean_t 2108 tcp_fuse_output(tcp_t *tcp, mblk_t *mp) 2109 { 2110 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2111 queue_t *peer_rq; 2112 mblk_t *mp_tail = mp; 2113 uint32_t send_size = 0; 2114 2115 ASSERT(tcp->tcp_fused); 2116 ASSERT(peer_tcp != NULL && peer_tcp->tcp_loopback_peer == tcp); 2117 ASSERT(tcp->tcp_connp->conn_sqp == peer_tcp->tcp_connp->conn_sqp); 2118 ASSERT(DB_TYPE(mp) == M_DATA || DB_TYPE(mp) == M_PROTO || 2119 DB_TYPE(mp) == M_PCPROTO); 2120 2121 peer_rq = peer_tcp->tcp_rq; 2122 2123 /* If this connection requires IP, unfuse and use regular path */ 2124 if (TCP_LOOPBACK_IP(tcp) || TCP_LOOPBACK_IP(peer_tcp) || 2125 IPP_ENABLED(IPP_LOCAL_OUT|IPP_LOCAL_IN)) { 2126 TCP_STAT(tcp_fusion_aborted); 2127 tcp_unfuse(tcp); 2128 return (B_FALSE); 2129 } 2130 2131 for (;;) { 2132 if (DB_TYPE(mp_tail) == M_DATA) 2133 send_size += MBLKL(mp_tail); 2134 if (mp_tail->b_cont == NULL) 2135 break; 2136 mp_tail = mp_tail->b_cont; 2137 } 2138 2139 if (send_size == 0) { 2140 freemsg(mp); 2141 return (B_TRUE); 2142 } 2143 2144 /* 2145 * Handle urgent data; we either send up SIGURG to the peer now 2146 * or do it later when we drain, in case the peer is detached 2147 * or if we're short of memory for M_PCSIG mblk. 2148 */ 2149 if (DB_TYPE(mp) != M_DATA) 2150 tcp_fuse_output_urg(tcp, mp); 2151 2152 /* 2153 * Enqueue data into the peer's receive list; we may or may not 2154 * drain the contents depending on the conditions below. 2155 */ 2156 tcp_rcv_enqueue(peer_tcp, mp, send_size); 2157 2158 /* In case it wrapped around and also to keep it constant */ 2159 peer_tcp->tcp_rwnd += send_size; 2160 2161 /* 2162 * If peer is detached, exercise flow-control when needed; we will 2163 * get back-enabled either in tcp_accept_finish() or tcp_unfuse(). 2164 */ 2165 if (TCP_IS_DETACHED(peer_tcp) && 2166 peer_tcp->tcp_rcv_cnt > peer_rq->q_hiwat) { 2167 tcp_setqfull(tcp); 2168 tcp->tcp_flow_stopped = B_TRUE; 2169 TCP_STAT(tcp_fusion_flowctl); 2170 } 2171 2172 loopback_packets++; 2173 tcp->tcp_last_sent_len = send_size; 2174 2175 /* Need to adjust the following SNMP MIB-related variables */ 2176 tcp->tcp_snxt += send_size; 2177 tcp->tcp_suna = tcp->tcp_snxt; 2178 peer_tcp->tcp_rnxt += send_size; 2179 peer_tcp->tcp_rack = peer_tcp->tcp_rnxt; 2180 2181 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 2182 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, send_size); 2183 2184 BUMP_MIB(&tcp_mib, tcpInSegs); 2185 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 2186 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, send_size); 2187 2188 BUMP_LOCAL(tcp->tcp_obsegs); 2189 BUMP_LOCAL(peer_tcp->tcp_ibsegs); 2190 2191 if (!TCP_IS_DETACHED(peer_tcp)) { 2192 /* 2193 * If we can't send SIGURG above due to lack of memory, 2194 * schedule push timer and try again. Otherwise drain 2195 * the data if we're not flow-controlled. 2196 */ 2197 if (peer_tcp->tcp_fused_sigurg) { 2198 if (peer_tcp->tcp_push_tid == 0) { 2199 peer_tcp->tcp_push_tid = 2200 TCP_TIMER(peer_tcp, tcp_push_timer, 2201 MSEC_TO_TICK(tcp_push_timer_interval)); 2202 } 2203 } else if (!tcp->tcp_flow_stopped) { 2204 if (!canputnext(peer_rq)) { 2205 tcp_setqfull(tcp); 2206 tcp->tcp_flow_stopped = B_TRUE; 2207 TCP_STAT(tcp_fusion_flowctl); 2208 } else { 2209 ASSERT(peer_tcp->tcp_rcv_list != NULL); 2210 (void) tcp_fuse_rcv_drain(peer_rq, 2211 peer_tcp, NULL); 2212 TCP_STAT(tcp_fusion_putnext); 2213 } 2214 } 2215 } 2216 return (B_TRUE); 2217 } 2218 2219 /* 2220 * This routine gets called to deliver data upstream on a fused or 2221 * previously fused tcp loopback endpoint; the latter happens only 2222 * when there is a pending SIGURG signal plus urgent data that can't 2223 * be sent upstream in the past. 2224 */ 2225 static boolean_t 2226 tcp_fuse_rcv_drain(queue_t *q, tcp_t *tcp, mblk_t **sigurg_mpp) 2227 { 2228 mblk_t *mp; 2229 #ifdef DEBUG 2230 uint_t cnt = 0; 2231 #endif 2232 2233 ASSERT(tcp->tcp_loopback); 2234 ASSERT(tcp->tcp_fused || tcp->tcp_fused_sigurg); 2235 ASSERT(!tcp->tcp_fused || tcp->tcp_loopback_peer != NULL); 2236 ASSERT(sigurg_mpp != NULL || tcp->tcp_fused); 2237 2238 /* No need for the push timer now, in case it was scheduled */ 2239 if (tcp->tcp_push_tid != 0) { 2240 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 2241 tcp->tcp_push_tid = 0; 2242 } 2243 /* 2244 * If there's urgent data sitting in receive list and we didn't 2245 * get a chance to send up a SIGURG signal, make sure we send 2246 * it first before draining in order to ensure that SIOCATMARK 2247 * works properly. 2248 */ 2249 if (tcp->tcp_fused_sigurg) { 2250 /* 2251 * sigurg_mpp is normally NULL, i.e. when we're still 2252 * fused and didn't get here because of tcp_unfuse(). 2253 * In this case try hard to allocate the M_PCSIG mblk. 2254 */ 2255 if (sigurg_mpp == NULL && 2256 (mp = allocb(1, BPRI_HI)) == NULL && 2257 (mp = allocb_tryhard(1)) == NULL) { 2258 /* Alloc failed; try again next time */ 2259 tcp->tcp_push_tid = TCP_TIMER(tcp, tcp_push_timer, 2260 MSEC_TO_TICK(tcp_push_timer_interval)); 2261 return (B_TRUE); 2262 } else if (sigurg_mpp != NULL) { 2263 /* 2264 * Use the supplied M_PCSIG mblk; it means we're 2265 * either unfused or in the process of unfusing, 2266 * and the drain must happen now. 2267 */ 2268 mp = *sigurg_mpp; 2269 *sigurg_mpp = NULL; 2270 } 2271 ASSERT(mp != NULL); 2272 2273 tcp->tcp_fused_sigurg = B_FALSE; 2274 /* Send up the signal */ 2275 DB_TYPE(mp) = M_PCSIG; 2276 *mp->b_wptr++ = (uchar_t)SIGURG; 2277 putnext(q, mp); 2278 /* 2279 * Let the regular tcp_rcv_drain() path handle 2280 * draining the data if we're no longer fused. 2281 */ 2282 if (!tcp->tcp_fused) 2283 return (B_FALSE); 2284 } 2285 2286 /* Drain the data */ 2287 while ((mp = tcp->tcp_rcv_list) != NULL) { 2288 tcp->tcp_rcv_list = mp->b_next; 2289 mp->b_next = NULL; 2290 #ifdef DEBUG 2291 cnt += msgdsize(mp); 2292 #endif 2293 putnext(q, mp); 2294 } 2295 2296 ASSERT(cnt == tcp->tcp_rcv_cnt); 2297 tcp->tcp_rcv_last_head = NULL; 2298 tcp->tcp_rcv_last_tail = NULL; 2299 tcp->tcp_rcv_cnt = 0; 2300 tcp->tcp_rwnd = q->q_hiwat; 2301 2302 return (B_TRUE); 2303 } 2304 2305 /* 2306 * This is the walker function, which is TCP specific. 2307 * It walks through the conn_hash bucket searching for the 2308 * next valid connp/tcp in the list, selecting connp/tcp 2309 * which haven't closed or condemned. It also REFHOLDS the 2310 * reference for the tcp, ensuring that the tcp exists 2311 * when the caller uses the tcp. 2312 * 2313 * tcp_get_next_conn 2314 * get the next entry in the conn global list 2315 * and put a reference on the next_conn. 2316 * decrement the reference on the current conn. 2317 */ 2318 conn_t * 2319 tcp_get_next_conn(connf_t *connfp, conn_t *connp) 2320 { 2321 conn_t *next_connp; 2322 2323 if (connfp == NULL) 2324 return (NULL); 2325 2326 mutex_enter(&connfp->connf_lock); 2327 2328 next_connp = (connp == NULL) ? 2329 connfp->connf_head : connp->conn_g_next; 2330 2331 while (next_connp != NULL) { 2332 mutex_enter(&next_connp->conn_lock); 2333 if ((next_connp->conn_state_flags & 2334 (CONN_CONDEMNED | CONN_INCIPIENT)) || 2335 !IPCL_IS_TCP(next_connp)) { 2336 /* 2337 * This conn has been condemned or 2338 * is closing. 2339 */ 2340 mutex_exit(&next_connp->conn_lock); 2341 next_connp = next_connp->conn_g_next; 2342 continue; 2343 } 2344 ASSERT(next_connp->conn_tcp != NULL); 2345 CONN_INC_REF_LOCKED(next_connp); 2346 mutex_exit(&next_connp->conn_lock); 2347 break; 2348 } 2349 2350 mutex_exit(&connfp->connf_lock); 2351 2352 if (connp != NULL) { 2353 CONN_DEC_REF(connp); 2354 } 2355 2356 return (next_connp); 2357 } 2358 2359 /* 2360 * Figure out the value of window scale opton. Note that the rwnd is 2361 * ASSUMED to be rounded up to the nearest MSS before the calculation. 2362 * We cannot find the scale value and then do a round up of tcp_rwnd 2363 * because the scale value may not be correct after that. 2364 * 2365 * Set the compiler flag to make this function inline. 2366 */ 2367 static void 2368 tcp_set_ws_value(tcp_t *tcp) 2369 { 2370 int i; 2371 uint32_t rwnd = tcp->tcp_rwnd; 2372 2373 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 2374 i++, rwnd >>= 1) 2375 ; 2376 tcp->tcp_rcv_ws = i; 2377 } 2378 2379 /* 2380 * Remove a connection from the list of detached TIME_WAIT connections. 2381 */ 2382 static void 2383 tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait) 2384 { 2385 boolean_t locked = B_FALSE; 2386 2387 if (tcp_time_wait == NULL) { 2388 tcp_time_wait = *((tcp_squeue_priv_t **) 2389 squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); 2390 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2391 locked = B_TRUE; 2392 } 2393 2394 if (tcp->tcp_time_wait_expire == 0) { 2395 ASSERT(tcp->tcp_time_wait_next == NULL); 2396 ASSERT(tcp->tcp_time_wait_prev == NULL); 2397 if (locked) 2398 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2399 return; 2400 } 2401 ASSERT(TCP_IS_DETACHED(tcp)); 2402 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 2403 2404 if (tcp == tcp_time_wait->tcp_time_wait_head) { 2405 ASSERT(tcp->tcp_time_wait_prev == NULL); 2406 tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next; 2407 if (tcp_time_wait->tcp_time_wait_head != NULL) { 2408 tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev = 2409 NULL; 2410 } else { 2411 tcp_time_wait->tcp_time_wait_tail = NULL; 2412 } 2413 } else if (tcp == tcp_time_wait->tcp_time_wait_tail) { 2414 ASSERT(tcp != tcp_time_wait->tcp_time_wait_head); 2415 ASSERT(tcp->tcp_time_wait_next == NULL); 2416 tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev; 2417 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 2418 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL; 2419 } else { 2420 ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp); 2421 ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp); 2422 tcp->tcp_time_wait_prev->tcp_time_wait_next = 2423 tcp->tcp_time_wait_next; 2424 tcp->tcp_time_wait_next->tcp_time_wait_prev = 2425 tcp->tcp_time_wait_prev; 2426 } 2427 tcp->tcp_time_wait_next = NULL; 2428 tcp->tcp_time_wait_prev = NULL; 2429 tcp->tcp_time_wait_expire = 0; 2430 2431 if (locked) 2432 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2433 } 2434 2435 /* 2436 * Add a connection to the list of detached TIME_WAIT connections 2437 * and set its time to expire. 2438 */ 2439 static void 2440 tcp_time_wait_append(tcp_t *tcp) 2441 { 2442 tcp_squeue_priv_t *tcp_time_wait = 2443 *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp, 2444 SQPRIVATE_TCP)); 2445 2446 tcp_timers_stop(tcp); 2447 2448 /* Freed above */ 2449 ASSERT(tcp->tcp_timer_tid == 0); 2450 ASSERT(tcp->tcp_ack_tid == 0); 2451 2452 /* must have happened at the time of detaching the tcp */ 2453 ASSERT(tcp->tcp_ptpahn == NULL); 2454 ASSERT(tcp->tcp_flow_stopped == 0); 2455 ASSERT(tcp->tcp_time_wait_next == NULL); 2456 ASSERT(tcp->tcp_time_wait_prev == NULL); 2457 ASSERT(tcp->tcp_time_wait_expire == NULL); 2458 ASSERT(tcp->tcp_listener == NULL); 2459 2460 tcp->tcp_time_wait_expire = ddi_get_lbolt(); 2461 /* 2462 * The value computed below in tcp->tcp_time_wait_expire may 2463 * appear negative or wrap around. That is ok since our 2464 * interest is only in the difference between the current lbolt 2465 * value and tcp->tcp_time_wait_expire. But the value should not 2466 * be zero, since it means the tcp is not in the TIME_WAIT list. 2467 * The corresponding comparison in tcp_time_wait_collector() uses 2468 * modular arithmetic. 2469 */ 2470 tcp->tcp_time_wait_expire += 2471 drv_usectohz(tcp_time_wait_interval * 1000); 2472 if (tcp->tcp_time_wait_expire == 0) 2473 tcp->tcp_time_wait_expire = 1; 2474 2475 ASSERT(TCP_IS_DETACHED(tcp)); 2476 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 2477 ASSERT(tcp->tcp_time_wait_next == NULL); 2478 ASSERT(tcp->tcp_time_wait_prev == NULL); 2479 TCP_DBGSTAT(tcp_time_wait); 2480 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2481 if (tcp_time_wait->tcp_time_wait_head == NULL) { 2482 ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL); 2483 tcp_time_wait->tcp_time_wait_head = tcp; 2484 } else { 2485 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 2486 ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state == 2487 TCPS_TIME_WAIT); 2488 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp; 2489 tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail; 2490 } 2491 tcp_time_wait->tcp_time_wait_tail = tcp; 2492 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2493 } 2494 2495 /* ARGSUSED */ 2496 void 2497 tcp_timewait_output(void *arg, mblk_t *mp, void *arg2) 2498 { 2499 conn_t *connp = (conn_t *)arg; 2500 tcp_t *tcp = connp->conn_tcp; 2501 2502 ASSERT(tcp != NULL); 2503 if (tcp->tcp_state == TCPS_CLOSED) { 2504 return; 2505 } 2506 2507 ASSERT((tcp->tcp_family == AF_INET && 2508 tcp->tcp_ipversion == IPV4_VERSION) || 2509 (tcp->tcp_family == AF_INET6 && 2510 (tcp->tcp_ipversion == IPV4_VERSION || 2511 tcp->tcp_ipversion == IPV6_VERSION))); 2512 ASSERT(!tcp->tcp_listener); 2513 2514 TCP_STAT(tcp_time_wait_reap); 2515 ASSERT(TCP_IS_DETACHED(tcp)); 2516 2517 /* 2518 * Because they have no upstream client to rebind or tcp_close() 2519 * them later, we axe the connection here and now. 2520 */ 2521 tcp_close_detached(tcp); 2522 } 2523 2524 void 2525 tcp_cleanup(tcp_t *tcp) 2526 { 2527 mblk_t *mp; 2528 char *tcp_iphc; 2529 int tcp_iphc_len; 2530 int tcp_hdr_grown; 2531 tcp_sack_info_t *tcp_sack_info; 2532 conn_t *connp = tcp->tcp_connp; 2533 2534 tcp_bind_hash_remove(tcp); 2535 tcp_free(tcp); 2536 2537 conn_delete_ire(connp, NULL); 2538 if (connp->conn_flags & IPCL_TCPCONN) { 2539 if (connp->conn_latch != NULL) 2540 IPLATCH_REFRELE(connp->conn_latch); 2541 if (connp->conn_policy != NULL) 2542 IPPH_REFRELE(connp->conn_policy); 2543 } 2544 2545 /* 2546 * Since we will bzero the entire structure, we need to 2547 * remove it and reinsert it in global hash list. We 2548 * know the walkers can't get to this conn because we 2549 * had set CONDEMNED flag earlier and checked reference 2550 * under conn_lock so walker won't pick it and when we 2551 * go the ipcl_globalhash_remove() below, no walker 2552 * can get to it. 2553 */ 2554 ipcl_globalhash_remove(connp); 2555 2556 /* Save some state */ 2557 mp = tcp->tcp_timercache; 2558 2559 tcp_sack_info = tcp->tcp_sack_info; 2560 tcp_iphc = tcp->tcp_iphc; 2561 tcp_iphc_len = tcp->tcp_iphc_len; 2562 tcp_hdr_grown = tcp->tcp_hdr_grown; 2563 2564 bzero(connp, sizeof (conn_t)); 2565 bzero(tcp, sizeof (tcp_t)); 2566 2567 /* restore the state */ 2568 tcp->tcp_timercache = mp; 2569 2570 tcp->tcp_sack_info = tcp_sack_info; 2571 tcp->tcp_iphc = tcp_iphc; 2572 tcp->tcp_iphc_len = tcp_iphc_len; 2573 tcp->tcp_hdr_grown = tcp_hdr_grown; 2574 2575 2576 tcp->tcp_connp = connp; 2577 2578 connp->conn_tcp = tcp; 2579 connp->conn_flags = IPCL_TCPCONN; 2580 connp->conn_state_flags = CONN_INCIPIENT; 2581 connp->conn_ulp = IPPROTO_TCP; 2582 connp->conn_ref = 1; 2583 2584 ipcl_globalhash_insert(connp); 2585 } 2586 2587 /* 2588 * Blows away all tcps whose TIME_WAIT has expired. List traversal 2589 * is done forwards from the head. 2590 */ 2591 /* ARGSUSED */ 2592 void 2593 tcp_time_wait_collector(void *arg) 2594 { 2595 tcp_t *tcp; 2596 clock_t now; 2597 mblk_t *mp; 2598 conn_t *connp; 2599 kmutex_t *lock; 2600 2601 squeue_t *sqp = (squeue_t *)arg; 2602 tcp_squeue_priv_t *tcp_time_wait = 2603 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 2604 2605 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2606 tcp_time_wait->tcp_time_wait_tid = 0; 2607 2608 if (tcp_time_wait->tcp_free_list != NULL && 2609 tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) { 2610 TCP_STAT(tcp_freelist_cleanup); 2611 while ((tcp = tcp_time_wait->tcp_free_list) != NULL) { 2612 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 2613 CONN_DEC_REF(tcp->tcp_connp); 2614 } 2615 } 2616 2617 /* 2618 * In order to reap time waits reliably, we should use a 2619 * source of time that is not adjustable by the user -- hence 2620 * the call to ddi_get_lbolt(). 2621 */ 2622 now = ddi_get_lbolt(); 2623 while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) { 2624 /* 2625 * Compare times using modular arithmetic, since 2626 * lbolt can wrapover. 2627 */ 2628 if ((now - tcp->tcp_time_wait_expire) < 0) { 2629 break; 2630 } 2631 2632 tcp_time_wait_remove(tcp, tcp_time_wait); 2633 2634 connp = tcp->tcp_connp; 2635 ASSERT(connp->conn_fanout != NULL); 2636 lock = &connp->conn_fanout->connf_lock; 2637 /* 2638 * This is essentially a TW reclaim fast path optimization for 2639 * performance where the timewait collector checks under the 2640 * fanout lock (so that no one else can get access to the 2641 * conn_t) that the refcnt is 2 i.e. one for TCP and one for 2642 * the classifier hash list. If ref count is indeed 2, we can 2643 * just remove the conn under the fanout lock and avoid 2644 * cleaning up the conn under the squeue, provided that 2645 * clustering callbacks are not enabled. If clustering is 2646 * enabled, we need to make the clustering callback before 2647 * setting the CONDEMNED flag and after dropping all locks and 2648 * so we forego this optimization and fall back to the slow 2649 * path. Also please see the comments in tcp_closei_local 2650 * regarding the refcnt logic. 2651 * 2652 * Since we are holding the tcp_time_wait_lock, its better 2653 * not to block on the fanout_lock because other connections 2654 * can't add themselves to time_wait list. So we do a 2655 * tryenter instead of mutex_enter. 2656 */ 2657 if (mutex_tryenter(lock)) { 2658 mutex_enter(&connp->conn_lock); 2659 if ((connp->conn_ref == 2) && 2660 (cl_inet_disconnect == NULL)) { 2661 ipcl_hash_remove_locked(connp, 2662 connp->conn_fanout); 2663 /* 2664 * Set the CONDEMNED flag now itself so that 2665 * the refcnt cannot increase due to any 2666 * walker. But we have still not cleaned up 2667 * conn_ire_cache. This is still ok since 2668 * we are going to clean it up in tcp_cleanup 2669 * immediately and any interface unplumb 2670 * thread will wait till the ire is blown away 2671 */ 2672 connp->conn_state_flags |= CONN_CONDEMNED; 2673 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2674 mutex_exit(lock); 2675 mutex_exit(&connp->conn_lock); 2676 tcp_cleanup(tcp); 2677 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2678 tcp->tcp_time_wait_next = 2679 tcp_time_wait->tcp_free_list; 2680 tcp_time_wait->tcp_free_list = tcp; 2681 continue; 2682 } else { 2683 CONN_INC_REF_LOCKED(connp); 2684 mutex_exit(lock); 2685 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2686 mutex_exit(&connp->conn_lock); 2687 /* 2688 * We can reuse the closemp here since conn has 2689 * detached (otherwise we wouldn't even be in 2690 * time_wait list). 2691 */ 2692 mp = &tcp->tcp_closemp; 2693 squeue_fill(connp->conn_sqp, mp, 2694 tcp_timewait_output, connp, 2695 SQTAG_TCP_TIMEWAIT); 2696 } 2697 } else { 2698 mutex_enter(&connp->conn_lock); 2699 CONN_INC_REF_LOCKED(connp); 2700 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2701 mutex_exit(&connp->conn_lock); 2702 /* 2703 * We can reuse the closemp here since conn has 2704 * detached (otherwise we wouldn't even be in 2705 * time_wait list). 2706 */ 2707 mp = &tcp->tcp_closemp; 2708 squeue_fill(connp->conn_sqp, mp, 2709 tcp_timewait_output, connp, 0); 2710 } 2711 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2712 } 2713 2714 if (tcp_time_wait->tcp_free_list != NULL) 2715 tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE; 2716 2717 tcp_time_wait->tcp_time_wait_tid = 2718 timeout(tcp_time_wait_collector, sqp, TCP_TIME_WAIT_DELAY); 2719 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2720 } 2721 2722 /* 2723 * Reply to a clients T_CONN_RES TPI message. This function 2724 * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES 2725 * on the acceptor STREAM and processed in tcp_wput_accept(). 2726 * Read the block comment on top of tcp_conn_request(). 2727 */ 2728 static void 2729 tcp_accept(tcp_t *listener, mblk_t *mp) 2730 { 2731 tcp_t *acceptor; 2732 tcp_t *eager; 2733 tcp_t *tcp; 2734 struct T_conn_res *tcr; 2735 t_uscalar_t acceptor_id; 2736 t_scalar_t seqnum; 2737 mblk_t *opt_mp = NULL; /* T_OPTMGMT_REQ messages */ 2738 mblk_t *ok_mp; 2739 mblk_t *mp1; 2740 2741 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 2742 tcp_err_ack(listener, mp, TPROTO, 0); 2743 return; 2744 } 2745 tcr = (struct T_conn_res *)mp->b_rptr; 2746 2747 /* 2748 * Under ILP32 the stream head points tcr->ACCEPTOR_id at the 2749 * read side queue of the streams device underneath us i.e. the 2750 * read side queue of 'ip'. Since we can't deference QUEUE_ptr we 2751 * look it up in the queue_hash. Under LP64 it sends down the 2752 * minor_t of the accepting endpoint. 2753 * 2754 * Once the acceptor/eager are modified (in tcp_accept_swap) the 2755 * fanout hash lock is held. 2756 * This prevents any thread from entering the acceptor queue from 2757 * below (since it has not been hard bound yet i.e. any inbound 2758 * packets will arrive on the listener or default tcp queue and 2759 * go through tcp_lookup). 2760 * The CONN_INC_REF will prevent the acceptor from closing. 2761 * 2762 * XXX It is still possible for a tli application to send down data 2763 * on the accepting stream while another thread calls t_accept. 2764 * This should not be a problem for well-behaved applications since 2765 * the T_OK_ACK is sent after the queue swapping is completed. 2766 * 2767 * If the accepting fd is the same as the listening fd, avoid 2768 * queue hash lookup since that will return an eager listener in a 2769 * already established state. 2770 */ 2771 acceptor_id = tcr->ACCEPTOR_id; 2772 mutex_enter(&listener->tcp_eager_lock); 2773 if (listener->tcp_acceptor_id == acceptor_id) { 2774 eager = listener->tcp_eager_next_q; 2775 /* only count how many T_CONN_INDs so don't count q0 */ 2776 if ((listener->tcp_conn_req_cnt_q != 1) || 2777 (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) { 2778 mutex_exit(&listener->tcp_eager_lock); 2779 tcp_err_ack(listener, mp, TBADF, 0); 2780 return; 2781 } 2782 if (listener->tcp_conn_req_cnt_q0 != 0) { 2783 /* Throw away all the eagers on q0. */ 2784 tcp_eager_cleanup(listener, 1); 2785 } 2786 if (listener->tcp_syn_defense) { 2787 listener->tcp_syn_defense = B_FALSE; 2788 if (listener->tcp_ip_addr_cache != NULL) { 2789 kmem_free(listener->tcp_ip_addr_cache, 2790 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 2791 listener->tcp_ip_addr_cache = NULL; 2792 } 2793 } 2794 /* 2795 * Transfer tcp_conn_req_max to the eager so that when 2796 * a disconnect occurs we can revert the endpoint to the 2797 * listen state. 2798 */ 2799 eager->tcp_conn_req_max = listener->tcp_conn_req_max; 2800 ASSERT(listener->tcp_conn_req_cnt_q0 == 0); 2801 /* 2802 * Get a reference on the acceptor just like the 2803 * tcp_acceptor_hash_lookup below. 2804 */ 2805 acceptor = listener; 2806 CONN_INC_REF(acceptor->tcp_connp); 2807 } else { 2808 acceptor = tcp_acceptor_hash_lookup(acceptor_id); 2809 if (acceptor == NULL) { 2810 if (listener->tcp_debug) { 2811 (void) strlog(TCP_MODULE_ID, 0, 1, 2812 SL_ERROR|SL_TRACE, 2813 "tcp_accept: did not find acceptor 0x%x\n", 2814 acceptor_id); 2815 } 2816 mutex_exit(&listener->tcp_eager_lock); 2817 tcp_err_ack(listener, mp, TPROVMISMATCH, 0); 2818 return; 2819 } 2820 /* 2821 * Verify acceptor state. The acceptable states for an acceptor 2822 * include TCPS_IDLE and TCPS_BOUND. 2823 */ 2824 switch (acceptor->tcp_state) { 2825 case TCPS_IDLE: 2826 /* FALLTHRU */ 2827 case TCPS_BOUND: 2828 break; 2829 default: 2830 CONN_DEC_REF(acceptor->tcp_connp); 2831 mutex_exit(&listener->tcp_eager_lock); 2832 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2833 return; 2834 } 2835 } 2836 2837 /* The listener must be in TCPS_LISTEN */ 2838 if (listener->tcp_state != TCPS_LISTEN) { 2839 CONN_DEC_REF(acceptor->tcp_connp); 2840 mutex_exit(&listener->tcp_eager_lock); 2841 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2842 return; 2843 } 2844 2845 /* 2846 * Rendezvous with an eager connection request packet hanging off 2847 * 'tcp' that has the 'seqnum' tag. We tagged the detached open 2848 * tcp structure when the connection packet arrived in 2849 * tcp_conn_request(). 2850 */ 2851 seqnum = tcr->SEQ_number; 2852 eager = listener; 2853 do { 2854 eager = eager->tcp_eager_next_q; 2855 if (eager == NULL) { 2856 CONN_DEC_REF(acceptor->tcp_connp); 2857 mutex_exit(&listener->tcp_eager_lock); 2858 tcp_err_ack(listener, mp, TBADSEQ, 0); 2859 return; 2860 } 2861 } while (eager->tcp_conn_req_seqnum != seqnum); 2862 mutex_exit(&listener->tcp_eager_lock); 2863 2864 /* 2865 * At this point, both acceptor and listener have 2 ref 2866 * that they begin with. Acceptor has one additional ref 2867 * we placed in lookup while listener has 3 additional 2868 * ref for being behind the squeue (tcp_accept() is 2869 * done on listener's squeue); being in classifier hash; 2870 * and eager's ref on listener. 2871 */ 2872 ASSERT(listener->tcp_connp->conn_ref >= 5); 2873 ASSERT(acceptor->tcp_connp->conn_ref >= 3); 2874 2875 /* 2876 * The eager at this point is set in its own squeue and 2877 * could easily have been killed (tcp_accept_finish will 2878 * deal with that) because of a TH_RST so we can only 2879 * ASSERT for a single ref. 2880 */ 2881 ASSERT(eager->tcp_connp->conn_ref >= 1); 2882 2883 /* Pre allocate the stroptions mblk also */ 2884 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 2885 if (opt_mp == NULL) { 2886 CONN_DEC_REF(acceptor->tcp_connp); 2887 CONN_DEC_REF(eager->tcp_connp); 2888 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2889 return; 2890 } 2891 DB_TYPE(opt_mp) = M_SETOPTS; 2892 opt_mp->b_wptr += sizeof (struct stroptions); 2893 2894 /* 2895 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 2896 * from listener to acceptor. The message is chained on opt_mp 2897 * which will be sent onto eager's squeue. 2898 */ 2899 if (listener->tcp_bound_if != 0) { 2900 /* allocate optmgmt req */ 2901 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2902 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 2903 sizeof (int)); 2904 if (mp1 != NULL) 2905 linkb(opt_mp, mp1); 2906 } 2907 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 2908 uint_t on = 1; 2909 2910 /* allocate optmgmt req */ 2911 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2912 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 2913 if (mp1 != NULL) 2914 linkb(opt_mp, mp1); 2915 } 2916 2917 /* Re-use mp1 to hold a copy of mp, in case reallocb fails */ 2918 if ((mp1 = copymsg(mp)) == NULL) { 2919 CONN_DEC_REF(acceptor->tcp_connp); 2920 CONN_DEC_REF(eager->tcp_connp); 2921 freemsg(opt_mp); 2922 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2923 return; 2924 } 2925 2926 tcr = (struct T_conn_res *)mp1->b_rptr; 2927 2928 /* 2929 * This is an expanded version of mi_tpi_ok_ack_alloc() 2930 * which allocates a larger mblk and appends the new 2931 * local address to the ok_ack. The address is copied by 2932 * soaccept() for getsockname(). 2933 */ 2934 { 2935 int extra; 2936 2937 extra = (eager->tcp_family == AF_INET) ? 2938 sizeof (sin_t) : sizeof (sin6_t); 2939 2940 /* 2941 * Try to re-use mp, if possible. Otherwise, allocate 2942 * an mblk and return it as ok_mp. In any case, mp 2943 * is no longer usable upon return. 2944 */ 2945 if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) { 2946 CONN_DEC_REF(acceptor->tcp_connp); 2947 CONN_DEC_REF(eager->tcp_connp); 2948 freemsg(opt_mp); 2949 /* Original mp has been freed by now, so use mp1 */ 2950 tcp_err_ack(listener, mp1, TSYSERR, ENOMEM); 2951 return; 2952 } 2953 2954 mp = NULL; /* We should never use mp after this point */ 2955 2956 switch (extra) { 2957 case sizeof (sin_t): { 2958 sin_t *sin = (sin_t *)ok_mp->b_wptr; 2959 2960 ok_mp->b_wptr += extra; 2961 sin->sin_family = AF_INET; 2962 sin->sin_port = eager->tcp_lport; 2963 sin->sin_addr.s_addr = 2964 eager->tcp_ipha->ipha_src; 2965 break; 2966 } 2967 case sizeof (sin6_t): { 2968 sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr; 2969 2970 ok_mp->b_wptr += extra; 2971 sin6->sin6_family = AF_INET6; 2972 sin6->sin6_port = eager->tcp_lport; 2973 if (eager->tcp_ipversion == IPV4_VERSION) { 2974 sin6->sin6_flowinfo = 0; 2975 IN6_IPADDR_TO_V4MAPPED( 2976 eager->tcp_ipha->ipha_src, 2977 &sin6->sin6_addr); 2978 } else { 2979 ASSERT(eager->tcp_ip6h != NULL); 2980 sin6->sin6_flowinfo = 2981 eager->tcp_ip6h->ip6_vcf & 2982 ~IPV6_VERS_AND_FLOW_MASK; 2983 sin6->sin6_addr = 2984 eager->tcp_ip6h->ip6_src; 2985 } 2986 break; 2987 } 2988 default: 2989 break; 2990 } 2991 ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim); 2992 } 2993 2994 /* 2995 * If there are no options we know that the T_CONN_RES will 2996 * succeed. However, we can't send the T_OK_ACK upstream until 2997 * the tcp_accept_swap is done since it would be dangerous to 2998 * let the application start using the new fd prior to the swap. 2999 */ 3000 tcp_accept_swap(listener, acceptor, eager); 3001 3002 /* 3003 * tcp_accept_swap unlinks eager from listener but does not drop 3004 * the eager's reference on the listener. 3005 */ 3006 ASSERT(eager->tcp_listener == NULL); 3007 ASSERT(listener->tcp_connp->conn_ref >= 5); 3008 3009 /* 3010 * The eager is now associated with its own queue. Insert in 3011 * the hash so that the connection can be reused for a future 3012 * T_CONN_RES. 3013 */ 3014 tcp_acceptor_hash_insert(acceptor_id, eager); 3015 3016 /* 3017 * We now do the processing of options with T_CONN_RES. 3018 * We delay till now since we wanted to have queue to pass to 3019 * option processing routines that points back to the right 3020 * instance structure which does not happen until after 3021 * tcp_accept_swap(). 3022 * 3023 * Note: 3024 * The sanity of the logic here assumes that whatever options 3025 * are appropriate to inherit from listner=>eager are done 3026 * before this point, and whatever were to be overridden (or not) 3027 * in transfer logic from eager=>acceptor in tcp_accept_swap(). 3028 * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it 3029 * before its ACCEPTOR_id comes down in T_CONN_RES ] 3030 * This may not be true at this point in time but can be fixed 3031 * independently. This option processing code starts with 3032 * the instantiated acceptor instance and the final queue at 3033 * this point. 3034 */ 3035 3036 if (tcr->OPT_length != 0) { 3037 /* Options to process */ 3038 int t_error = 0; 3039 int sys_error = 0; 3040 int do_disconnect = 0; 3041 3042 if (tcp_conprim_opt_process(eager, mp1, 3043 &do_disconnect, &t_error, &sys_error) < 0) { 3044 eager->tcp_accept_error = 1; 3045 if (do_disconnect) { 3046 /* 3047 * An option failed which does not allow 3048 * connection to be accepted. 3049 * 3050 * We allow T_CONN_RES to succeed and 3051 * put a T_DISCON_IND on the eager queue. 3052 */ 3053 ASSERT(t_error == 0 && sys_error == 0); 3054 eager->tcp_send_discon_ind = 1; 3055 } else { 3056 ASSERT(t_error != 0); 3057 freemsg(ok_mp); 3058 /* 3059 * Original mp was either freed or set 3060 * to ok_mp above, so use mp1 instead. 3061 */ 3062 tcp_err_ack(listener, mp1, t_error, sys_error); 3063 goto finish; 3064 } 3065 } 3066 /* 3067 * Most likely success in setting options (except if 3068 * eager->tcp_send_discon_ind set). 3069 * mp1 option buffer represented by OPT_length/offset 3070 * potentially modified and contains results of setting 3071 * options at this point 3072 */ 3073 } 3074 3075 /* We no longer need mp1, since all options processing has passed */ 3076 freemsg(mp1); 3077 3078 putnext(listener->tcp_rq, ok_mp); 3079 3080 mutex_enter(&listener->tcp_eager_lock); 3081 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 3082 tcp_t *tail; 3083 mblk_t *conn_ind; 3084 3085 /* 3086 * This path should not be executed if listener and 3087 * acceptor streams are the same. 3088 */ 3089 ASSERT(listener != acceptor); 3090 3091 tcp = listener->tcp_eager_prev_q0; 3092 /* 3093 * listener->tcp_eager_prev_q0 points to the TAIL of the 3094 * deferred T_conn_ind queue. We need to get to the head of 3095 * the queue in order to send up T_conn_ind the same order as 3096 * how the 3WHS is completed. 3097 */ 3098 while (tcp != listener) { 3099 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 3100 break; 3101 else 3102 tcp = tcp->tcp_eager_prev_q0; 3103 } 3104 ASSERT(tcp != listener); 3105 conn_ind = tcp->tcp_conn.tcp_eager_conn_ind; 3106 ASSERT(conn_ind != NULL); 3107 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3108 3109 /* Move from q0 to q */ 3110 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 3111 listener->tcp_conn_req_cnt_q0--; 3112 listener->tcp_conn_req_cnt_q++; 3113 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 3114 tcp->tcp_eager_prev_q0; 3115 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 3116 tcp->tcp_eager_next_q0; 3117 tcp->tcp_eager_prev_q0 = NULL; 3118 tcp->tcp_eager_next_q0 = NULL; 3119 tcp->tcp_conn_def_q0 = B_FALSE; 3120 3121 /* 3122 * Insert at end of the queue because sockfs sends 3123 * down T_CONN_RES in chronological order. Leaving 3124 * the older conn indications at front of the queue 3125 * helps reducing search time. 3126 */ 3127 tail = listener->tcp_eager_last_q; 3128 if (tail != NULL) 3129 tail->tcp_eager_next_q = tcp; 3130 else 3131 listener->tcp_eager_next_q = tcp; 3132 listener->tcp_eager_last_q = tcp; 3133 tcp->tcp_eager_next_q = NULL; 3134 mutex_exit(&listener->tcp_eager_lock); 3135 putnext(tcp->tcp_rq, conn_ind); 3136 } else { 3137 mutex_exit(&listener->tcp_eager_lock); 3138 } 3139 3140 /* 3141 * Done with the acceptor - free it 3142 * 3143 * Note: from this point on, no access to listener should be made 3144 * as listener can be equal to acceptor. 3145 */ 3146 finish: 3147 ASSERT(acceptor->tcp_detached); 3148 acceptor->tcp_rq = tcp_g_q; 3149 acceptor->tcp_wq = WR(tcp_g_q); 3150 (void) tcp_clean_death(acceptor, 0, 2); 3151 CONN_DEC_REF(acceptor->tcp_connp); 3152 3153 /* 3154 * In case we already received a FIN we have to make tcp_rput send 3155 * the ordrel_ind. This will also send up a window update if the window 3156 * has opened up. 3157 * 3158 * In the normal case of a successful connection acceptance 3159 * we give the O_T_BIND_REQ to the read side put procedure as an 3160 * indication that this was just accepted. This tells tcp_rput to 3161 * pass up any data queued in tcp_rcv_list. 3162 * 3163 * In the fringe case where options sent with T_CONN_RES failed and 3164 * we required, we would be indicating a T_DISCON_IND to blow 3165 * away this connection. 3166 */ 3167 3168 /* 3169 * XXX: we currently have a problem if XTI application closes the 3170 * acceptor stream in between. This problem exists in on10-gate also 3171 * and is well know but nothing can be done short of major rewrite 3172 * to fix it. Now it is possible to take care of it by assigning TLI/XTI 3173 * eager same squeue as listener (we can distinguish non socket 3174 * listeners at the time of handling a SYN in tcp_conn_request) 3175 * and do most of the work that tcp_accept_finish does here itself 3176 * and then get behind the acceptor squeue to access the acceptor 3177 * queue. 3178 */ 3179 /* 3180 * We already have a ref on tcp so no need to do one before squeue_fill 3181 */ 3182 squeue_fill(eager->tcp_connp->conn_sqp, opt_mp, 3183 tcp_accept_finish, eager->tcp_connp, SQTAG_TCP_ACCEPT_FINISH); 3184 } 3185 3186 /* 3187 * Swap information between the eager and acceptor for a TLI/XTI client. 3188 * The sockfs accept is done on the acceptor stream and control goes 3189 * through tcp_wput_accept() and tcp_accept()/tcp_accept_swap() is not 3190 * called. In either case, both the eager and listener are in their own 3191 * perimeter (squeue) and the code has to deal with potential race. 3192 * 3193 * See the block comment on top of tcp_accept() and tcp_wput_accept(). 3194 */ 3195 static void 3196 tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager) 3197 { 3198 conn_t *econnp, *aconnp; 3199 3200 ASSERT(eager->tcp_rq == listener->tcp_rq); 3201 ASSERT(eager->tcp_detached && !acceptor->tcp_detached); 3202 ASSERT(!eager->tcp_hard_bound); 3203 ASSERT(!TCP_IS_SOCKET(acceptor)); 3204 ASSERT(!TCP_IS_SOCKET(eager)); 3205 ASSERT(!TCP_IS_SOCKET(listener)); 3206 3207 acceptor->tcp_detached = B_TRUE; 3208 /* 3209 * To permit stream re-use by TLI/XTI, the eager needs a copy of 3210 * the acceptor id. 3211 */ 3212 eager->tcp_acceptor_id = acceptor->tcp_acceptor_id; 3213 3214 /* remove eager from listen list... */ 3215 mutex_enter(&listener->tcp_eager_lock); 3216 tcp_eager_unlink(eager); 3217 ASSERT(eager->tcp_eager_next_q == NULL && 3218 eager->tcp_eager_last_q == NULL); 3219 ASSERT(eager->tcp_eager_next_q0 == NULL && 3220 eager->tcp_eager_prev_q0 == NULL); 3221 mutex_exit(&listener->tcp_eager_lock); 3222 eager->tcp_rq = acceptor->tcp_rq; 3223 eager->tcp_wq = acceptor->tcp_wq; 3224 3225 econnp = eager->tcp_connp; 3226 aconnp = acceptor->tcp_connp; 3227 3228 eager->tcp_rq->q_ptr = econnp; 3229 eager->tcp_wq->q_ptr = econnp; 3230 eager->tcp_detached = B_FALSE; 3231 3232 ASSERT(eager->tcp_ack_tid == 0); 3233 3234 econnp->conn_dev = aconnp->conn_dev; 3235 eager->tcp_cred = econnp->conn_cred = aconnp->conn_cred; 3236 econnp->conn_zoneid = aconnp->conn_zoneid; 3237 aconnp->conn_cred = NULL; 3238 3239 /* Do the IPC initialization */ 3240 CONN_INC_REF(econnp); 3241 3242 econnp->conn_multicast_loop = aconnp->conn_multicast_loop; 3243 econnp->conn_af_isv6 = aconnp->conn_af_isv6; 3244 econnp->conn_pkt_isv6 = aconnp->conn_pkt_isv6; 3245 econnp->conn_ulp = aconnp->conn_ulp; 3246 3247 /* Done with old IPC. Drop its ref on its connp */ 3248 CONN_DEC_REF(aconnp); 3249 } 3250 3251 3252 /* 3253 * Adapt to the information, such as rtt and rtt_sd, provided from the 3254 * ire cached in conn_cache_ire. If no ire cached, do a ire lookup. 3255 * 3256 * Checks for multicast and broadcast destination address. 3257 * Returns zero on failure; non-zero if ok. 3258 * 3259 * Note that the MSS calculation here is based on the info given in 3260 * the IRE. We do not do any calculation based on TCP options. They 3261 * will be handled in tcp_rput_other() and tcp_rput_data() when TCP 3262 * knows which options to use. 3263 * 3264 * Note on how TCP gets its parameters for a connection. 3265 * 3266 * When a tcp_t structure is allocated, it gets all the default parameters. 3267 * In tcp_adapt_ire(), it gets those metric parameters, like rtt, rtt_sd, 3268 * spipe, rpipe, ... from the route metrics. Route metric overrides the 3269 * default. But if there is an associated tcp_host_param, it will override 3270 * the metrics. 3271 * 3272 * An incoming SYN with a multicast or broadcast destination address, is dropped 3273 * in 1 of 2 places. 3274 * 3275 * 1. If the packet was received over the wire it is dropped in 3276 * ip_rput_process_broadcast() 3277 * 3278 * 2. If the packet was received through internal IP loopback, i.e. the packet 3279 * was generated and received on the same machine, it is dropped in 3280 * ip_wput_local() 3281 * 3282 * An incoming SYN with a multicast or broadcast source address is always 3283 * dropped in tcp_adapt_ire. The same logic in tcp_adapt_ire also serves to 3284 * reject an attempt to connect to a broadcast or multicast (destination) 3285 * address. 3286 */ 3287 static int 3288 tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp) 3289 { 3290 tcp_hsp_t *hsp; 3291 ire_t *ire; 3292 ire_t *sire = NULL; 3293 iulp_t *ire_uinfo; 3294 uint32_t mss_max; 3295 uint32_t mss; 3296 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 3297 conn_t *connp = tcp->tcp_connp; 3298 boolean_t ire_cacheable = B_FALSE; 3299 zoneid_t zoneid = connp->conn_zoneid; 3300 ill_t *ill = NULL; 3301 boolean_t incoming = (ire_mp == NULL); 3302 3303 ASSERT(connp->conn_ire_cache == NULL); 3304 3305 if (tcp->tcp_ipversion == IPV4_VERSION) { 3306 3307 if (CLASSD(tcp->tcp_connp->conn_rem)) { 3308 BUMP_MIB(&ip_mib, ipInDiscards); 3309 return (0); 3310 } 3311 3312 ire = ire_cache_lookup(tcp->tcp_connp->conn_rem, zoneid); 3313 if (ire != NULL) { 3314 ire_cacheable = B_TRUE; 3315 ire_uinfo = (ire_mp != NULL) ? 3316 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 3317 &ire->ire_uinfo; 3318 3319 } else { 3320 if (ire_mp == NULL) { 3321 ire = ire_ftable_lookup( 3322 tcp->tcp_connp->conn_rem, 3323 0, 0, 0, NULL, &sire, zoneid, 0, 3324 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT)); 3325 if (ire == NULL) 3326 return (0); 3327 ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : 3328 &ire->ire_uinfo; 3329 } else { 3330 ire = (ire_t *)ire_mp->b_rptr; 3331 ire_uinfo = 3332 &((ire_t *)ire_mp->b_rptr)->ire_uinfo; 3333 } 3334 } 3335 ASSERT(ire != NULL); 3336 ASSERT(ire_uinfo != NULL); 3337 3338 if ((ire->ire_src_addr == INADDR_ANY) || 3339 (ire->ire_type & IRE_BROADCAST)) { 3340 /* 3341 * ire->ire_mp is non null when ire_mp passed in is used 3342 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 3343 */ 3344 if (ire->ire_mp == NULL) 3345 ire_refrele(ire); 3346 if (sire != NULL) 3347 ire_refrele(sire); 3348 return (0); 3349 } 3350 3351 if (tcp->tcp_ipha->ipha_src == INADDR_ANY) { 3352 ipaddr_t src_addr; 3353 3354 /* 3355 * ip_bind_connected() has stored the correct source 3356 * address in conn_src. 3357 */ 3358 src_addr = tcp->tcp_connp->conn_src; 3359 tcp->tcp_ipha->ipha_src = src_addr; 3360 /* 3361 * Copy of the src addr. in tcp_t is needed 3362 * for the lookup funcs. 3363 */ 3364 IN6_IPADDR_TO_V4MAPPED(src_addr, &tcp->tcp_ip_src_v6); 3365 } 3366 /* 3367 * Set the fragment bit so that IP will tell us if the MTU 3368 * should change. IP tells us the latest setting of 3369 * ip_path_mtu_discovery through ire_frag_flag. 3370 */ 3371 if (ip_path_mtu_discovery) { 3372 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 3373 htons(IPH_DF); 3374 } 3375 tcp->tcp_localnet = (ire->ire_gateway_addr == 0); 3376 } else { 3377 /* 3378 * For incoming connection ire_mp = NULL 3379 * For outgoing connection ire_mp != NULL 3380 * Technically we should check conn_incoming_ill 3381 * when ire_mp is NULL and conn_outgoing_ill when 3382 * ire_mp is non-NULL. But this is performance 3383 * critical path and for IPV*_BOUND_IF, outgoing 3384 * and incoming ill are always set to the same value. 3385 */ 3386 ill_t *dst_ill = NULL; 3387 ipif_t *dst_ipif = NULL; 3388 int match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT; 3389 3390 ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill); 3391 3392 if (connp->conn_outgoing_ill != NULL) { 3393 /* Outgoing or incoming path */ 3394 int err; 3395 3396 dst_ill = conn_get_held_ill(connp, 3397 &connp->conn_outgoing_ill, &err); 3398 if (err == ILL_LOOKUP_FAILED || dst_ill == NULL) { 3399 ip1dbg(("tcp_adapt_ire: ill_lookup failed\n")); 3400 return (0); 3401 } 3402 match_flags |= MATCH_IRE_ILL; 3403 dst_ipif = dst_ill->ill_ipif; 3404 } 3405 ire = ire_ctable_lookup_v6(&tcp->tcp_connp->conn_remv6, 3406 0, 0, dst_ipif, zoneid, match_flags); 3407 3408 if (ire != NULL) { 3409 ire_cacheable = B_TRUE; 3410 ire_uinfo = (ire_mp != NULL) ? 3411 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 3412 &ire->ire_uinfo; 3413 } else { 3414 if (ire_mp == NULL) { 3415 ire = ire_ftable_lookup_v6( 3416 &tcp->tcp_connp->conn_remv6, 3417 0, 0, 0, dst_ipif, &sire, zoneid, 3418 0, match_flags); 3419 if (ire == NULL) { 3420 if (dst_ill != NULL) 3421 ill_refrele(dst_ill); 3422 return (0); 3423 } 3424 ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : 3425 &ire->ire_uinfo; 3426 } else { 3427 ire = (ire_t *)ire_mp->b_rptr; 3428 ire_uinfo = 3429 &((ire_t *)ire_mp->b_rptr)->ire_uinfo; 3430 } 3431 } 3432 if (dst_ill != NULL) 3433 ill_refrele(dst_ill); 3434 3435 ASSERT(ire != NULL); 3436 ASSERT(ire_uinfo != NULL); 3437 3438 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) || 3439 IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) { 3440 /* 3441 * ire->ire_mp is non null when ire_mp passed in is used 3442 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 3443 */ 3444 if (ire->ire_mp == NULL) 3445 ire_refrele(ire); 3446 if (sire != NULL) 3447 ire_refrele(sire); 3448 return (0); 3449 } 3450 3451 if (IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 3452 in6_addr_t src_addr; 3453 3454 /* 3455 * ip_bind_connected_v6() has stored the correct source 3456 * address per IPv6 addr. selection policy in 3457 * conn_src_v6. 3458 */ 3459 src_addr = tcp->tcp_connp->conn_srcv6; 3460 3461 tcp->tcp_ip6h->ip6_src = src_addr; 3462 /* 3463 * Copy of the src addr. in tcp_t is needed 3464 * for the lookup funcs. 3465 */ 3466 tcp->tcp_ip_src_v6 = src_addr; 3467 ASSERT(IN6_ARE_ADDR_EQUAL(&tcp->tcp_ip6h->ip6_src, 3468 &connp->conn_srcv6)); 3469 } 3470 tcp->tcp_localnet = 3471 IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6); 3472 } 3473 3474 /* 3475 * This allows applications to fail quickly when connections are made 3476 * to dead hosts. Hosts can be labeled dead by adding a reject route 3477 * with both the RTF_REJECT and RTF_PRIVATE flags set. 3478 */ 3479 if ((ire->ire_flags & RTF_REJECT) && 3480 (ire->ire_flags & RTF_PRIVATE)) 3481 goto error; 3482 3483 /* 3484 * Make use of the cached rtt and rtt_sd values to calculate the 3485 * initial RTO. Note that they are already initialized in 3486 * tcp_init_values(). 3487 */ 3488 if (ire_uinfo->iulp_rtt != 0) { 3489 clock_t rto; 3490 3491 tcp->tcp_rtt_sa = ire_uinfo->iulp_rtt; 3492 tcp->tcp_rtt_sd = ire_uinfo->iulp_rtt_sd; 3493 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 3494 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5); 3495 3496 if (rto > tcp_rexmit_interval_max) { 3497 tcp->tcp_rto = tcp_rexmit_interval_max; 3498 } else if (rto < tcp_rexmit_interval_min) { 3499 tcp->tcp_rto = tcp_rexmit_interval_min; 3500 } else { 3501 tcp->tcp_rto = rto; 3502 } 3503 } 3504 if (ire_uinfo->iulp_ssthresh != 0) 3505 tcp->tcp_cwnd_ssthresh = ire_uinfo->iulp_ssthresh; 3506 else 3507 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 3508 if (ire_uinfo->iulp_spipe > 0) { 3509 tcp->tcp_xmit_hiwater = MIN(ire_uinfo->iulp_spipe, 3510 tcp_max_buf); 3511 if (tcp_snd_lowat_fraction != 0) 3512 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 3513 tcp_snd_lowat_fraction; 3514 (void) tcp_maxpsz_set(tcp, B_TRUE); 3515 } 3516 /* 3517 * Note that up till now, acceptor always inherits receive 3518 * window from the listener. But if there is a metrics associated 3519 * with a host, we should use that instead of inheriting it from 3520 * listener. Thus we need to pass this info back to the caller. 3521 */ 3522 if (ire_uinfo->iulp_rpipe > 0) { 3523 tcp->tcp_rwnd = MIN(ire_uinfo->iulp_rpipe, tcp_max_buf); 3524 } else { 3525 /* 3526 * For passive open, set tcp_rwnd to 0 so that the caller 3527 * knows that there is no rpipe metric for this connection. 3528 */ 3529 if (tcp_detached) 3530 tcp->tcp_rwnd = 0; 3531 } 3532 if (ire_uinfo->iulp_rtomax > 0) { 3533 tcp->tcp_second_timer_threshold = ire_uinfo->iulp_rtomax; 3534 } 3535 3536 /* 3537 * Use the metric option settings, iulp_tstamp_ok and iulp_wscale_ok, 3538 * only for active open. What this means is that if the other side 3539 * uses timestamp or window scale option, TCP will also use those 3540 * options. That is for passive open. If the application sets a 3541 * large window, window scale is enabled regardless of the value in 3542 * iulp_wscale_ok. This is the behavior since 2.6. So we keep it. 3543 * The only case left in passive open processing is the check for SACK. 3544 * 3545 * For ECN, it should probably be like SACK. But the current 3546 * value is binary, so we treat it like the other cases. The 3547 * metric only controls active open. For passive open, the ndd 3548 * param, tcp_ecn_permitted, controls the behavior. 3549 */ 3550 if (!tcp_detached) { 3551 /* 3552 * The if check means that the following can only be turned 3553 * on by the metrics only IRE, but not off. 3554 */ 3555 if (ire_uinfo->iulp_tstamp_ok) 3556 tcp->tcp_snd_ts_ok = B_TRUE; 3557 if (ire_uinfo->iulp_wscale_ok) 3558 tcp->tcp_snd_ws_ok = B_TRUE; 3559 if (ire_uinfo->iulp_sack == 2) 3560 tcp->tcp_snd_sack_ok = B_TRUE; 3561 if (ire_uinfo->iulp_ecn_ok) 3562 tcp->tcp_ecn_ok = B_TRUE; 3563 } else { 3564 /* 3565 * Passive open. 3566 * 3567 * As above, the if check means that SACK can only be 3568 * turned on by the metric only IRE. 3569 */ 3570 if (ire_uinfo->iulp_sack > 0) { 3571 tcp->tcp_snd_sack_ok = B_TRUE; 3572 } 3573 } 3574 3575 /* 3576 * XXX: Note that currently, ire_max_frag can be as small as 68 3577 * because of PMTUd. So tcp_mss may go to negative if combined 3578 * length of all those options exceeds 28 bytes. But because 3579 * of the tcp_mss_min check below, we may not have a problem if 3580 * tcp_mss_min is of a reasonable value. The default is 1 so 3581 * the negative problem still exists. And the check defeats PMTUd. 3582 * In fact, if PMTUd finds that the MSS should be smaller than 3583 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 3584 * value. 3585 * 3586 * We do not deal with that now. All those problems related to 3587 * PMTUd will be fixed later. 3588 */ 3589 ASSERT(ire->ire_max_frag != 0); 3590 mss = tcp->tcp_if_mtu = ire->ire_max_frag; 3591 if (tcp->tcp_ipp_fields & IPPF_USE_MIN_MTU) { 3592 if (tcp->tcp_ipp_use_min_mtu == IPV6_USE_MIN_MTU_NEVER) { 3593 mss = MIN(mss, IPV6_MIN_MTU); 3594 } 3595 } 3596 3597 /* Sanity check for MSS value. */ 3598 if (tcp->tcp_ipversion == IPV4_VERSION) 3599 mss_max = tcp_mss_max_ipv4; 3600 else 3601 mss_max = tcp_mss_max_ipv6; 3602 3603 if (tcp->tcp_ipversion == IPV6_VERSION && 3604 (ire->ire_frag_flag & IPH_FRAG_HDR)) { 3605 /* 3606 * After receiving an ICMPv6 "packet too big" message with a 3607 * MTU < 1280, and for multirouted IPv6 packets, the IP layer 3608 * will insert a 8-byte fragment header in every packet; we 3609 * reduce the MSS by that amount here. 3610 */ 3611 mss -= sizeof (ip6_frag_t); 3612 } 3613 3614 if (tcp->tcp_ipsec_overhead == 0) 3615 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 3616 3617 mss -= tcp->tcp_ipsec_overhead; 3618 3619 if (mss < tcp_mss_min) 3620 mss = tcp_mss_min; 3621 if (mss > mss_max) 3622 mss = mss_max; 3623 3624 /* Note that this is the maximum MSS, excluding all options. */ 3625 tcp->tcp_mss = mss; 3626 3627 /* 3628 * Initialize the ISS here now that we have the full connection ID. 3629 * The RFC 1948 method of initial sequence number generation requires 3630 * knowledge of the full connection ID before setting the ISS. 3631 */ 3632 3633 tcp_iss_init(tcp); 3634 3635 if (ire->ire_type & (IRE_LOOPBACK | IRE_LOCAL)) 3636 tcp->tcp_loopback = B_TRUE; 3637 3638 if (tcp->tcp_ipversion == IPV4_VERSION) { 3639 hsp = tcp_hsp_lookup(tcp->tcp_remote); 3640 } else { 3641 hsp = tcp_hsp_lookup_ipv6(&tcp->tcp_remote_v6); 3642 } 3643 3644 if (hsp != NULL) { 3645 /* Only modify if we're going to make them bigger */ 3646 if (hsp->tcp_hsp_sendspace > tcp->tcp_xmit_hiwater) { 3647 tcp->tcp_xmit_hiwater = hsp->tcp_hsp_sendspace; 3648 if (tcp_snd_lowat_fraction != 0) 3649 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 3650 tcp_snd_lowat_fraction; 3651 } 3652 3653 if (hsp->tcp_hsp_recvspace > tcp->tcp_rwnd) { 3654 tcp->tcp_rwnd = hsp->tcp_hsp_recvspace; 3655 } 3656 3657 /* Copy timestamp flag only for active open */ 3658 if (!tcp_detached) 3659 tcp->tcp_snd_ts_ok = hsp->tcp_hsp_tstamp; 3660 } 3661 3662 if (sire != NULL) 3663 IRE_REFRELE(sire); 3664 3665 /* 3666 * If we got an IRE_CACHE and an ILL, go through their properties; 3667 * otherwise, this is deferred until later when we have an IRE_CACHE. 3668 */ 3669 if (tcp->tcp_loopback || 3670 (ire_cacheable && (ill = ire_to_ill(ire)) != NULL)) { 3671 /* 3672 * For incoming, see if this tcp may be MDT-capable. For 3673 * outgoing, this process has been taken care of through 3674 * tcp_rput_other. 3675 */ 3676 tcp_ire_ill_check(tcp, ire, ill, incoming); 3677 tcp->tcp_ire_ill_check_done = B_TRUE; 3678 } 3679 3680 mutex_enter(&connp->conn_lock); 3681 /* 3682 * Make sure that conn is not marked incipient 3683 * for incoming connections. A blind 3684 * removal of incipient flag is cheaper than 3685 * check and removal. 3686 */ 3687 connp->conn_state_flags &= ~CONN_INCIPIENT; 3688 3689 /* Must not cache forwarding table routes. */ 3690 if (ire_cacheable) { 3691 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 3692 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 3693 connp->conn_ire_cache = ire; 3694 IRE_UNTRACE_REF(ire); 3695 rw_exit(&ire->ire_bucket->irb_lock); 3696 mutex_exit(&connp->conn_lock); 3697 return (1); 3698 } 3699 rw_exit(&ire->ire_bucket->irb_lock); 3700 } 3701 mutex_exit(&connp->conn_lock); 3702 3703 if (ire->ire_mp == NULL) 3704 ire_refrele(ire); 3705 return (1); 3706 3707 error: 3708 if (ire->ire_mp == NULL) 3709 ire_refrele(ire); 3710 if (sire != NULL) 3711 ire_refrele(sire); 3712 return (0); 3713 } 3714 3715 /* 3716 * tcp_bind is called (holding the writer lock) by tcp_wput_proto to process a 3717 * O_T_BIND_REQ/T_BIND_REQ message. 3718 */ 3719 static void 3720 tcp_bind(tcp_t *tcp, mblk_t *mp) 3721 { 3722 sin_t *sin; 3723 sin6_t *sin6; 3724 mblk_t *mp1; 3725 in_port_t requested_port; 3726 in_port_t allocated_port; 3727 struct T_bind_req *tbr; 3728 boolean_t bind_to_req_port_only; 3729 boolean_t backlog_update = B_FALSE; 3730 boolean_t user_specified; 3731 in6_addr_t v6addr; 3732 ipaddr_t v4addr; 3733 uint_t origipversion; 3734 int err; 3735 queue_t *q = tcp->tcp_wq; 3736 3737 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 3738 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 3739 if (tcp->tcp_debug) { 3740 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3741 "tcp_bind: bad req, len %u", 3742 (uint_t)(mp->b_wptr - mp->b_rptr)); 3743 } 3744 tcp_err_ack(tcp, mp, TPROTO, 0); 3745 return; 3746 } 3747 /* Make sure the largest address fits */ 3748 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1); 3749 if (mp1 == NULL) { 3750 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3751 return; 3752 } 3753 mp = mp1; 3754 tbr = (struct T_bind_req *)mp->b_rptr; 3755 if (tcp->tcp_state >= TCPS_BOUND) { 3756 if ((tcp->tcp_state == TCPS_BOUND || 3757 tcp->tcp_state == TCPS_LISTEN) && 3758 tcp->tcp_conn_req_max != tbr->CONIND_number && 3759 tbr->CONIND_number > 0) { 3760 /* 3761 * Handle listen() increasing CONIND_number. 3762 * This is more "liberal" then what the TPI spec 3763 * requires but is needed to avoid a t_unbind 3764 * when handling listen() since the port number 3765 * might be "stolen" between the unbind and bind. 3766 */ 3767 backlog_update = B_TRUE; 3768 goto do_bind; 3769 } 3770 if (tcp->tcp_debug) { 3771 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3772 "tcp_bind: bad state, %d", tcp->tcp_state); 3773 } 3774 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 3775 return; 3776 } 3777 origipversion = tcp->tcp_ipversion; 3778 3779 switch (tbr->ADDR_length) { 3780 case 0: /* request for a generic port */ 3781 tbr->ADDR_offset = sizeof (struct T_bind_req); 3782 if (tcp->tcp_family == AF_INET) { 3783 tbr->ADDR_length = sizeof (sin_t); 3784 sin = (sin_t *)&tbr[1]; 3785 *sin = sin_null; 3786 sin->sin_family = AF_INET; 3787 mp->b_wptr = (uchar_t *)&sin[1]; 3788 tcp->tcp_ipversion = IPV4_VERSION; 3789 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &v6addr); 3790 } else { 3791 ASSERT(tcp->tcp_family == AF_INET6); 3792 tbr->ADDR_length = sizeof (sin6_t); 3793 sin6 = (sin6_t *)&tbr[1]; 3794 *sin6 = sin6_null; 3795 sin6->sin6_family = AF_INET6; 3796 mp->b_wptr = (uchar_t *)&sin6[1]; 3797 tcp->tcp_ipversion = IPV6_VERSION; 3798 V6_SET_ZERO(v6addr); 3799 } 3800 requested_port = 0; 3801 break; 3802 3803 case sizeof (sin_t): /* Complete IPv4 address */ 3804 sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset, 3805 sizeof (sin_t)); 3806 if (sin == NULL || !OK_32PTR((char *)sin)) { 3807 if (tcp->tcp_debug) { 3808 (void) strlog(TCP_MODULE_ID, 0, 1, 3809 SL_ERROR|SL_TRACE, 3810 "tcp_bind: bad address parameter, " 3811 "offset %d, len %d", 3812 tbr->ADDR_offset, tbr->ADDR_length); 3813 } 3814 tcp_err_ack(tcp, mp, TPROTO, 0); 3815 return; 3816 } 3817 /* 3818 * With sockets sockfs will accept bogus sin_family in 3819 * bind() and replace it with the family used in the socket 3820 * call. 3821 */ 3822 if (sin->sin_family != AF_INET || 3823 tcp->tcp_family != AF_INET) { 3824 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3825 return; 3826 } 3827 requested_port = ntohs(sin->sin_port); 3828 tcp->tcp_ipversion = IPV4_VERSION; 3829 v4addr = sin->sin_addr.s_addr; 3830 IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr); 3831 break; 3832 3833 case sizeof (sin6_t): /* Complete IPv6 address */ 3834 sin6 = (sin6_t *)mi_offset_param(mp, 3835 tbr->ADDR_offset, sizeof (sin6_t)); 3836 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 3837 if (tcp->tcp_debug) { 3838 (void) strlog(TCP_MODULE_ID, 0, 1, 3839 SL_ERROR|SL_TRACE, 3840 "tcp_bind: bad IPv6 address parameter, " 3841 "offset %d, len %d", tbr->ADDR_offset, 3842 tbr->ADDR_length); 3843 } 3844 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 3845 return; 3846 } 3847 if (sin6->sin6_family != AF_INET6 || 3848 tcp->tcp_family != AF_INET6) { 3849 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3850 return; 3851 } 3852 requested_port = ntohs(sin6->sin6_port); 3853 tcp->tcp_ipversion = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? 3854 IPV4_VERSION : IPV6_VERSION; 3855 v6addr = sin6->sin6_addr; 3856 break; 3857 3858 default: 3859 if (tcp->tcp_debug) { 3860 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3861 "tcp_bind: bad address length, %d", 3862 tbr->ADDR_length); 3863 } 3864 tcp_err_ack(tcp, mp, TBADADDR, 0); 3865 return; 3866 } 3867 tcp->tcp_bound_source_v6 = v6addr; 3868 3869 /* Check for change in ipversion */ 3870 if (origipversion != tcp->tcp_ipversion) { 3871 ASSERT(tcp->tcp_family == AF_INET6); 3872 err = tcp->tcp_ipversion == IPV6_VERSION ? 3873 tcp_header_init_ipv6(tcp) : tcp_header_init_ipv4(tcp); 3874 if (err) { 3875 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3876 return; 3877 } 3878 } 3879 3880 /* 3881 * Initialize family specific fields. Copy of the src addr. 3882 * in tcp_t is needed for the lookup funcs. 3883 */ 3884 if (tcp->tcp_ipversion == IPV6_VERSION) { 3885 tcp->tcp_ip6h->ip6_src = v6addr; 3886 } else { 3887 IN6_V4MAPPED_TO_IPADDR(&v6addr, tcp->tcp_ipha->ipha_src); 3888 } 3889 tcp->tcp_ip_src_v6 = v6addr; 3890 3891 /* 3892 * For O_T_BIND_REQ: 3893 * Verify that the target port/addr is available, or choose 3894 * another. 3895 * For T_BIND_REQ: 3896 * Verify that the target port/addr is available or fail. 3897 * In both cases when it succeeds the tcp is inserted in the 3898 * bind hash table. This ensures that the operation is atomic 3899 * under the lock on the hash bucket. 3900 */ 3901 bind_to_req_port_only = requested_port != 0 && 3902 tbr->PRIM_type != O_T_BIND_REQ; 3903 /* 3904 * Get a valid port (within the anonymous range and should not 3905 * be a privileged one) to use if the user has not given a port. 3906 * If multiple threads are here, they may all start with 3907 * with the same initial port. But, it should be fine as long as 3908 * tcp_bindi will ensure that no two threads will be assigned 3909 * the same port. 3910 * 3911 * NOTE: XXX If a privileged process asks for an anonymous port, we 3912 * still check for ports only in the range > tcp_smallest_non_priv_port, 3913 * unless TCP_ANONPRIVBIND option is set. 3914 */ 3915 if (requested_port == 0) { 3916 requested_port = tcp->tcp_anon_priv_bind ? 3917 tcp_get_next_priv_port() : 3918 tcp_update_next_port(tcp_next_port_to_try, B_TRUE); 3919 user_specified = B_FALSE; 3920 } else { 3921 int i; 3922 boolean_t priv = B_FALSE; 3923 /* 3924 * If the requested_port is in the well-known privileged range, 3925 * verify that the stream was opened by a privileged user. 3926 * Note: No locks are held when inspecting tcp_g_*epriv_ports 3927 * but instead the code relies on: 3928 * - the fact that the address of the array and its size never 3929 * changes 3930 * - the atomic assignment of the elements of the array 3931 */ 3932 if (requested_port < tcp_smallest_nonpriv_port) { 3933 priv = B_TRUE; 3934 } else { 3935 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 3936 if (requested_port == 3937 tcp_g_epriv_ports[i]) { 3938 priv = B_TRUE; 3939 break; 3940 } 3941 } 3942 } 3943 if (priv) { 3944 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 3945 3946 if (secpolicy_net_privaddr(cr, requested_port) != 0) { 3947 if (tcp->tcp_debug) { 3948 (void) strlog(TCP_MODULE_ID, 0, 1, 3949 SL_ERROR|SL_TRACE, 3950 "tcp_bind: no priv for port %d", 3951 requested_port); 3952 } 3953 tcp_err_ack(tcp, mp, TACCES, 0); 3954 return; 3955 } 3956 } 3957 user_specified = B_TRUE; 3958 } 3959 3960 allocated_port = tcp_bindi(tcp, requested_port, &v6addr, 3961 tcp->tcp_reuseaddr, bind_to_req_port_only, user_specified); 3962 3963 if (allocated_port == 0) { 3964 if (bind_to_req_port_only) { 3965 if (tcp->tcp_debug) { 3966 (void) strlog(TCP_MODULE_ID, 0, 1, 3967 SL_ERROR|SL_TRACE, 3968 "tcp_bind: requested addr busy"); 3969 } 3970 tcp_err_ack(tcp, mp, TADDRBUSY, 0); 3971 } else { 3972 /* If we are out of ports, fail the bind. */ 3973 if (tcp->tcp_debug) { 3974 (void) strlog(TCP_MODULE_ID, 0, 1, 3975 SL_ERROR|SL_TRACE, 3976 "tcp_bind: out of ports?"); 3977 } 3978 tcp_err_ack(tcp, mp, TNOADDR, 0); 3979 } 3980 return; 3981 } 3982 ASSERT(tcp->tcp_state == TCPS_BOUND); 3983 do_bind: 3984 if (!backlog_update) { 3985 if (tcp->tcp_family == AF_INET) 3986 sin->sin_port = htons(allocated_port); 3987 else 3988 sin6->sin6_port = htons(allocated_port); 3989 } 3990 if (tcp->tcp_family == AF_INET) { 3991 if (tbr->CONIND_number != 0) { 3992 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3993 sizeof (sin_t)); 3994 } else { 3995 /* Just verify the local IP address */ 3996 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IP_ADDR_LEN); 3997 } 3998 } else { 3999 if (tbr->CONIND_number != 0) { 4000 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 4001 sizeof (sin6_t)); 4002 } else { 4003 /* Just verify the local IP address */ 4004 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 4005 IPV6_ADDR_LEN); 4006 } 4007 } 4008 if (!mp1) { 4009 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 4010 return; 4011 } 4012 4013 tbr->PRIM_type = T_BIND_ACK; 4014 mp->b_datap->db_type = M_PCPROTO; 4015 4016 /* Chain in the reply mp for tcp_rput() */ 4017 mp1->b_cont = mp; 4018 mp = mp1; 4019 4020 tcp->tcp_conn_req_max = tbr->CONIND_number; 4021 if (tcp->tcp_conn_req_max) { 4022 if (tcp->tcp_conn_req_max < tcp_conn_req_min) 4023 tcp->tcp_conn_req_max = tcp_conn_req_min; 4024 if (tcp->tcp_conn_req_max > tcp_conn_req_max_q) 4025 tcp->tcp_conn_req_max = tcp_conn_req_max_q; 4026 /* 4027 * If this is a listener, do not reset the eager list 4028 * and other stuffs. Note that we don't check if the 4029 * existing eager list meets the new tcp_conn_req_max 4030 * requirement. 4031 */ 4032 if (tcp->tcp_state != TCPS_LISTEN) { 4033 tcp->tcp_state = TCPS_LISTEN; 4034 /* Initialize the chain. Don't need the eager_lock */ 4035 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 4036 tcp->tcp_second_ctimer_threshold = 4037 tcp_ip_abort_linterval; 4038 } 4039 } 4040 4041 /* 4042 * We can call ip_bind directly which returns a T_BIND_ACK mp. The 4043 * processing continues in tcp_rput_other(). 4044 */ 4045 if (tcp->tcp_family == AF_INET6) { 4046 ASSERT(tcp->tcp_connp->conn_af_isv6); 4047 mp = ip_bind_v6(q, mp, tcp->tcp_connp, &tcp->tcp_sticky_ipp); 4048 } else { 4049 ASSERT(!tcp->tcp_connp->conn_af_isv6); 4050 mp = ip_bind_v4(q, mp, tcp->tcp_connp); 4051 } 4052 /* 4053 * If the bind cannot complete immediately 4054 * IP will arrange to call tcp_rput_other 4055 * when the bind completes. 4056 */ 4057 if (mp != NULL) { 4058 tcp_rput_other(tcp, mp); 4059 } else { 4060 /* 4061 * Bind will be resumed later. Need to ensure 4062 * that conn doesn't disappear when that happens. 4063 * This will be decremented in ip_resume_tcp_bind(). 4064 */ 4065 CONN_INC_REF(tcp->tcp_connp); 4066 } 4067 } 4068 4069 4070 /* 4071 * If the "bind_to_req_port_only" parameter is set, if the requested port 4072 * number is available, return it, If not return 0 4073 * 4074 * If "bind_to_req_port_only" parameter is not set and 4075 * If the requested port number is available, return it. If not, return 4076 * the first anonymous port we happen across. If no anonymous ports are 4077 * available, return 0. addr is the requested local address, if any. 4078 * 4079 * In either case, when succeeding update the tcp_t to record the port number 4080 * and insert it in the bind hash table. 4081 * 4082 * Note that TCP over IPv4 and IPv6 sockets can use the same port number 4083 * without setting SO_REUSEADDR. This is needed so that they 4084 * can be viewed as two independent transport protocols. 4085 */ 4086 static in_port_t 4087 tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, int reuseaddr, 4088 boolean_t bind_to_req_port_only, boolean_t user_specified) 4089 { 4090 /* number of times we have run around the loop */ 4091 int count = 0; 4092 /* maximum number of times to run around the loop */ 4093 int loopmax; 4094 zoneid_t zoneid = tcp->tcp_connp->conn_zoneid; 4095 4096 /* 4097 * Lookup for free addresses is done in a loop and "loopmax" 4098 * influences how long we spin in the loop 4099 */ 4100 if (bind_to_req_port_only) { 4101 /* 4102 * If the requested port is busy, don't bother to look 4103 * for a new one. Setting loop maximum count to 1 has 4104 * that effect. 4105 */ 4106 loopmax = 1; 4107 } else { 4108 /* 4109 * If the requested port is busy, look for a free one 4110 * in the anonymous port range. 4111 * Set loopmax appropriately so that one does not look 4112 * forever in the case all of the anonymous ports are in use. 4113 */ 4114 if (tcp->tcp_anon_priv_bind) { 4115 /* 4116 * loopmax = 4117 * (IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1 4118 */ 4119 loopmax = IPPORT_RESERVED - tcp_min_anonpriv_port; 4120 } else { 4121 loopmax = (tcp_largest_anon_port - 4122 tcp_smallest_anon_port + 1); 4123 } 4124 } 4125 do { 4126 uint16_t lport; 4127 tf_t *tbf; 4128 tcp_t *ltcp; 4129 4130 lport = htons(port); 4131 4132 /* 4133 * Ensure that the tcp_t is not currently in the bind hash. 4134 * Hold the lock on the hash bucket to ensure that 4135 * the duplicate check plus the insertion is an atomic 4136 * operation. 4137 * 4138 * This function does an inline lookup on the bind hash list 4139 * Make sure that we access only members of tcp_t 4140 * and that we don't look at tcp_tcp, since we are not 4141 * doing a CONN_INC_REF. 4142 */ 4143 tcp_bind_hash_remove(tcp); 4144 tbf = &tcp_bind_fanout[TCP_BIND_HASH(lport)]; 4145 mutex_enter(&tbf->tf_lock); 4146 for (ltcp = tbf->tf_tcp; ltcp != NULL; 4147 ltcp = ltcp->tcp_bind_hash) { 4148 if (lport != ltcp->tcp_lport || 4149 ltcp->tcp_connp->conn_zoneid != zoneid) { 4150 continue; 4151 } 4152 4153 /* 4154 * If TCP_EXCLBIND is set for either the bound or 4155 * binding endpoint, the semantics of bind 4156 * is changed according to the following. 4157 * 4158 * spec = specified address (v4 or v6) 4159 * unspec = unspecified address (v4 or v6) 4160 * A = specified addresses are different for endpoints 4161 * 4162 * bound bind to allowed 4163 * ------------------------------------- 4164 * unspec unspec no 4165 * unspec spec no 4166 * spec unspec no 4167 * spec spec yes if A 4168 * 4169 * Note: 4170 * 4171 * 1. Because of TLI semantics, an endpoint can go 4172 * back from, say TCP_ESTABLISHED to TCPS_LISTEN or 4173 * TCPS_BOUND, depending on whether it is originally 4174 * a listener or not. That is why we need to check 4175 * for states greater than or equal to TCPS_BOUND 4176 * here. 4177 * 4178 * 2. Ideally, we should only check for state equals 4179 * to TCPS_LISTEN. And the following check should be 4180 * added. 4181 * 4182 * if (ltcp->tcp_state == TCPS_LISTEN || 4183 * !reuseaddr || !ltcp->tcp_reuseaddr) { 4184 * ... 4185 * } 4186 * 4187 * The semantics will be changed to this. If the 4188 * endpoint on the list is in state not equal to 4189 * TCPS_LISTEN and both endpoints have SO_REUSEADDR 4190 * set, let the bind succeed. 4191 * 4192 * But because of (1), we cannot do that now. If 4193 * in future, we can change this going back semantics, 4194 * we can add the above check. 4195 */ 4196 if (ltcp->tcp_exclbind || tcp->tcp_exclbind) { 4197 if (V6_OR_V4_INADDR_ANY( 4198 ltcp->tcp_bound_source_v6) || 4199 V6_OR_V4_INADDR_ANY(*laddr) || 4200 IN6_ARE_ADDR_EQUAL(laddr, 4201 <cp->tcp_bound_source_v6)) { 4202 break; 4203 } 4204 continue; 4205 } 4206 4207 /* 4208 * Check ipversion to allow IPv4 and IPv6 sockets to 4209 * have disjoint port number spaces, if *_EXCLBIND 4210 * is not set and only if the application binds to a 4211 * specific port. We use the same autoassigned port 4212 * number space for IPv4 and IPv6 sockets. 4213 */ 4214 if (tcp->tcp_ipversion != ltcp->tcp_ipversion && 4215 bind_to_req_port_only) 4216 continue; 4217 4218 if (!reuseaddr) { 4219 /* 4220 * No socket option SO_REUSEADDR. 4221 * 4222 * If existing port is bound to 4223 * a non-wildcard IP address 4224 * and the requesting stream is 4225 * bound to a distinct 4226 * different IP addresses 4227 * (non-wildcard, also), keep 4228 * going. 4229 */ 4230 if (!V6_OR_V4_INADDR_ANY(*laddr) && 4231 !V6_OR_V4_INADDR_ANY( 4232 ltcp->tcp_bound_source_v6) && 4233 !IN6_ARE_ADDR_EQUAL(laddr, 4234 <cp->tcp_bound_source_v6)) 4235 continue; 4236 if (ltcp->tcp_state >= TCPS_BOUND) { 4237 /* 4238 * This port is being used and 4239 * its state is >= TCPS_BOUND, 4240 * so we can't bind to it. 4241 */ 4242 break; 4243 } 4244 } else { 4245 /* 4246 * socket option SO_REUSEADDR is set on the 4247 * binding tcp_t. 4248 * 4249 * If two streams are bound to 4250 * same IP address or both addr 4251 * and bound source are wildcards 4252 * (INADDR_ANY), we want to stop 4253 * searching. 4254 * We have found a match of IP source 4255 * address and source port, which is 4256 * refused regardless of the 4257 * SO_REUSEADDR setting, so we break. 4258 */ 4259 if (IN6_ARE_ADDR_EQUAL(laddr, 4260 <cp->tcp_bound_source_v6) && 4261 (ltcp->tcp_state == TCPS_LISTEN || 4262 ltcp->tcp_state == TCPS_BOUND)) 4263 break; 4264 } 4265 } 4266 if (ltcp != NULL) { 4267 /* The port number is busy */ 4268 mutex_exit(&tbf->tf_lock); 4269 } else { 4270 /* 4271 * This port is ours. Insert in fanout and mark as 4272 * bound to prevent others from getting the port 4273 * number. 4274 */ 4275 tcp->tcp_state = TCPS_BOUND; 4276 tcp->tcp_lport = htons(port); 4277 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 4278 4279 ASSERT(&tcp_bind_fanout[TCP_BIND_HASH( 4280 tcp->tcp_lport)] == tbf); 4281 tcp_bind_hash_insert(tbf, tcp, 1); 4282 4283 mutex_exit(&tbf->tf_lock); 4284 4285 /* 4286 * We don't want tcp_next_port_to_try to "inherit" 4287 * a port number supplied by the user in a bind. 4288 */ 4289 if (user_specified) 4290 return (port); 4291 4292 /* 4293 * This is the only place where tcp_next_port_to_try 4294 * is updated. After the update, it may or may not 4295 * be in the valid range. 4296 */ 4297 if (!tcp->tcp_anon_priv_bind) 4298 tcp_next_port_to_try = port + 1; 4299 return (port); 4300 } 4301 4302 if (tcp->tcp_anon_priv_bind) { 4303 port = tcp_get_next_priv_port(); 4304 } else { 4305 if (count == 0 && user_specified) { 4306 /* 4307 * We may have to return an anonymous port. So 4308 * get one to start with. 4309 */ 4310 port = 4311 tcp_update_next_port(tcp_next_port_to_try, 4312 B_TRUE); 4313 user_specified = B_FALSE; 4314 } else { 4315 port = tcp_update_next_port(port + 1, B_FALSE); 4316 } 4317 } 4318 4319 /* 4320 * Don't let this loop run forever in the case where 4321 * all of the anonymous ports are in use. 4322 */ 4323 } while (++count < loopmax); 4324 return (0); 4325 } 4326 4327 /* 4328 * We are dying for some reason. Try to do it gracefully. (May be called 4329 * as writer.) 4330 * 4331 * Return -1 if the structure was not cleaned up (if the cleanup had to be 4332 * done by a service procedure). 4333 * TBD - Should the return value distinguish between the tcp_t being 4334 * freed and it being reinitialized? 4335 */ 4336 static int 4337 tcp_clean_death(tcp_t *tcp, int err, uint8_t tag) 4338 { 4339 mblk_t *mp; 4340 queue_t *q; 4341 4342 TCP_CLD_STAT(tag); 4343 4344 #if TCP_TAG_CLEAN_DEATH 4345 tcp->tcp_cleandeathtag = tag; 4346 #endif 4347 4348 if (tcp->tcp_linger_tid != 0 && 4349 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 4350 tcp_stop_lingering(tcp); 4351 } 4352 4353 ASSERT(tcp != NULL); 4354 ASSERT((tcp->tcp_family == AF_INET && 4355 tcp->tcp_ipversion == IPV4_VERSION) || 4356 (tcp->tcp_family == AF_INET6 && 4357 (tcp->tcp_ipversion == IPV4_VERSION || 4358 tcp->tcp_ipversion == IPV6_VERSION))); 4359 4360 if (TCP_IS_DETACHED(tcp)) { 4361 if (tcp->tcp_hard_binding) { 4362 /* 4363 * Its an eager that we are dealing with. We close the 4364 * eager but in case a conn_ind has already gone to the 4365 * listener, let tcp_accept_finish() send a discon_ind 4366 * to the listener and drop the last reference. If the 4367 * listener doesn't even know about the eager i.e. the 4368 * conn_ind hasn't gone up, blow away the eager and drop 4369 * the last reference as well. If the conn_ind has gone 4370 * up, state should be BOUND. tcp_accept_finish 4371 * will figure out that the connection has received a 4372 * RST and will send a DISCON_IND to the application. 4373 */ 4374 tcp_closei_local(tcp); 4375 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 4376 CONN_DEC_REF(tcp->tcp_connp); 4377 } else { 4378 tcp->tcp_state = TCPS_BOUND; 4379 } 4380 } else { 4381 tcp_close_detached(tcp); 4382 } 4383 return (0); 4384 } 4385 4386 TCP_STAT(tcp_clean_death_nondetached); 4387 4388 /* 4389 * If T_ORDREL_IND has not been sent yet (done when service routine 4390 * is run) postpone cleaning up the endpoint until service routine 4391 * has sent up the T_ORDREL_IND. Avoid clearing out an existing 4392 * client_errno since tcp_close uses the client_errno field. 4393 */ 4394 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 4395 if (err != 0) 4396 tcp->tcp_client_errno = err; 4397 4398 tcp->tcp_deferred_clean_death = B_TRUE; 4399 return (-1); 4400 } 4401 4402 q = tcp->tcp_rq; 4403 4404 /* Trash all inbound data */ 4405 flushq(q, FLUSHALL); 4406 4407 /* 4408 * If we are at least part way open and there is error 4409 * (err==0 implies no error) 4410 * notify our client by a T_DISCON_IND. 4411 */ 4412 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 4413 if (tcp->tcp_state >= TCPS_ESTABLISHED && 4414 !TCP_IS_SOCKET(tcp)) { 4415 /* 4416 * Send M_FLUSH according to TPI. Because sockets will 4417 * (and must) ignore FLUSHR we do that only for TPI 4418 * endpoints and sockets in STREAMS mode. 4419 */ 4420 (void) putnextctl1(q, M_FLUSH, FLUSHR); 4421 } 4422 if (tcp->tcp_debug) { 4423 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 4424 "tcp_clean_death: discon err %d", err); 4425 } 4426 mp = mi_tpi_discon_ind(NULL, err, 0); 4427 if (mp != NULL) { 4428 putnext(q, mp); 4429 } else { 4430 if (tcp->tcp_debug) { 4431 (void) strlog(TCP_MODULE_ID, 0, 1, 4432 SL_ERROR|SL_TRACE, 4433 "tcp_clean_death, sending M_ERROR"); 4434 } 4435 (void) putnextctl1(q, M_ERROR, EPROTO); 4436 } 4437 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 4438 /* SYN_SENT or SYN_RCVD */ 4439 BUMP_MIB(&tcp_mib, tcpAttemptFails); 4440 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 4441 /* ESTABLISHED or CLOSE_WAIT */ 4442 BUMP_MIB(&tcp_mib, tcpEstabResets); 4443 } 4444 } 4445 4446 tcp_reinit(tcp); 4447 return (-1); 4448 } 4449 4450 /* 4451 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 4452 * to expire, stop the wait and finish the close. 4453 */ 4454 static void 4455 tcp_stop_lingering(tcp_t *tcp) 4456 { 4457 clock_t delta = 0; 4458 4459 tcp->tcp_linger_tid = 0; 4460 if (tcp->tcp_state > TCPS_LISTEN) { 4461 tcp_acceptor_hash_remove(tcp); 4462 if (tcp->tcp_flow_stopped) { 4463 tcp->tcp_flow_stopped = B_FALSE; 4464 tcp_clrqfull(tcp); 4465 } 4466 4467 if (tcp->tcp_timer_tid != 0) { 4468 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4469 tcp->tcp_timer_tid = 0; 4470 } 4471 /* 4472 * Need to cancel those timers which will not be used when 4473 * TCP is detached. This has to be done before the tcp_wq 4474 * is set to the global queue. 4475 */ 4476 tcp_timers_stop(tcp); 4477 4478 4479 tcp->tcp_detached = B_TRUE; 4480 tcp->tcp_rq = tcp_g_q; 4481 tcp->tcp_wq = WR(tcp_g_q); 4482 4483 if (tcp->tcp_state == TCPS_TIME_WAIT) { 4484 tcp_time_wait_append(tcp); 4485 TCP_DBGSTAT(tcp_detach_time_wait); 4486 goto finish; 4487 } 4488 4489 /* 4490 * If delta is zero the timer event wasn't executed and was 4491 * successfully canceled. In this case we need to restart it 4492 * with the minimal delta possible. 4493 */ 4494 if (delta >= 0) { 4495 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 4496 delta ? delta : 1); 4497 } 4498 } else { 4499 tcp_closei_local(tcp); 4500 CONN_DEC_REF(tcp->tcp_connp); 4501 } 4502 finish: 4503 /* Signal closing thread that it can complete close */ 4504 mutex_enter(&tcp->tcp_closelock); 4505 tcp->tcp_detached = B_TRUE; 4506 tcp->tcp_rq = tcp_g_q; 4507 tcp->tcp_wq = WR(tcp_g_q); 4508 tcp->tcp_closed = 1; 4509 cv_signal(&tcp->tcp_closecv); 4510 mutex_exit(&tcp->tcp_closelock); 4511 } 4512 4513 /* 4514 * Handle lingering timeouts. This function is called when the SO_LINGER timeout 4515 * expires. 4516 */ 4517 static void 4518 tcp_close_linger_timeout(void *arg) 4519 { 4520 conn_t *connp = (conn_t *)arg; 4521 tcp_t *tcp = connp->conn_tcp; 4522 4523 tcp->tcp_client_errno = ETIMEDOUT; 4524 tcp_stop_lingering(tcp); 4525 } 4526 4527 static int 4528 tcp_close(queue_t *q, int flags) 4529 { 4530 conn_t *connp = Q_TO_CONN(q); 4531 tcp_t *tcp = connp->conn_tcp; 4532 mblk_t *mp = &tcp->tcp_closemp; 4533 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 4534 4535 ASSERT(WR(q)->q_next == NULL); 4536 ASSERT(connp->conn_ref >= 2); 4537 ASSERT((connp->conn_flags & IPCL_TCPMOD) == 0); 4538 4539 /* 4540 * We are being closed as /dev/tcp or /dev/tcp6. 4541 * 4542 * Mark the conn as closing. ill_pending_mp_add will not 4543 * add any mp to the pending mp list, after this conn has 4544 * started closing. Same for sq_pending_mp_add 4545 */ 4546 mutex_enter(&connp->conn_lock); 4547 connp->conn_state_flags |= CONN_CLOSING; 4548 if (connp->conn_oper_pending_ill != NULL) 4549 conn_ioctl_cleanup_reqd = B_TRUE; 4550 CONN_INC_REF_LOCKED(connp); 4551 mutex_exit(&connp->conn_lock); 4552 tcp->tcp_closeflags = (uint8_t)flags; 4553 ASSERT(connp->conn_ref >= 3); 4554 4555 (*tcp_squeue_close_proc)(connp->conn_sqp, mp, 4556 tcp_close_output, connp, SQTAG_IP_TCP_CLOSE); 4557 4558 mutex_enter(&tcp->tcp_closelock); 4559 while (!tcp->tcp_closed) 4560 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 4561 mutex_exit(&tcp->tcp_closelock); 4562 /* 4563 * In the case of listener streams that have eagers in the q or q0 4564 * we wait for the eagers to drop their reference to us. tcp_rq and 4565 * tcp_wq of the eagers point to our queues. By waiting for the 4566 * refcnt to drop to 1, we are sure that the eagers have cleaned 4567 * up their queue pointers and also dropped their references to us. 4568 */ 4569 if (tcp->tcp_wait_for_eagers) { 4570 mutex_enter(&connp->conn_lock); 4571 while (connp->conn_ref != 1) { 4572 cv_wait(&connp->conn_cv, &connp->conn_lock); 4573 } 4574 mutex_exit(&connp->conn_lock); 4575 } 4576 /* 4577 * ioctl cleanup. The mp is queued in the 4578 * ill_pending_mp or in the sq_pending_mp. 4579 */ 4580 if (conn_ioctl_cleanup_reqd) 4581 conn_ioctl_cleanup(connp); 4582 4583 qprocsoff(q); 4584 inet_minor_free(ip_minor_arena, connp->conn_dev); 4585 4586 ASSERT(connp->conn_cred != NULL); 4587 crfree(connp->conn_cred); 4588 tcp->tcp_cred = connp->conn_cred = NULL; 4589 tcp->tcp_cpid = -1; 4590 4591 /* 4592 * Drop IP's reference on the conn. This is the last reference 4593 * on the connp if the state was less than established. If the 4594 * connection has gone into timewait state, then we will have 4595 * one ref for the TCP and one more ref (total of two) for the 4596 * classifier connected hash list (a timewait connections stays 4597 * in connected hash till closed). 4598 * 4599 * We can't assert the references because there might be other 4600 * transient reference places because of some walkers or queued 4601 * packets in squeue for the timewait state. 4602 */ 4603 CONN_DEC_REF(connp); 4604 q->q_ptr = WR(q)->q_ptr = NULL; 4605 return (0); 4606 } 4607 4608 int 4609 tcp_modclose(queue_t *q) 4610 { 4611 conn_t *connp = Q_TO_CONN(q); 4612 ASSERT((connp->conn_flags & IPCL_TCPMOD) != 0); 4613 4614 qprocsoff(q); 4615 4616 if (connp->conn_cred != NULL) { 4617 crfree(connp->conn_cred); 4618 connp->conn_cred = NULL; 4619 } 4620 CONN_DEC_REF(connp); 4621 q->q_ptr = WR(q)->q_ptr = NULL; 4622 return (0); 4623 } 4624 4625 static int 4626 tcpclose_accept(queue_t *q) 4627 { 4628 ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit); 4629 4630 /* 4631 * We had opened an acceptor STREAM for sockfs which is 4632 * now being closed due to some error. 4633 */ 4634 qprocsoff(q); 4635 inet_minor_free(ip_minor_arena, (dev_t)q->q_ptr); 4636 q->q_ptr = WR(q)->q_ptr = NULL; 4637 return (0); 4638 } 4639 4640 4641 /* 4642 * Called by streams close routine via squeues when our client blows off her 4643 * descriptor, we take this to mean: "close the stream state NOW, close the tcp 4644 * connection politely" When SO_LINGER is set (with a non-zero linger time and 4645 * it is not a nonblocking socket) then this routine sleeps until the FIN is 4646 * acked. 4647 * 4648 * NOTE: tcp_close potentially returns error when lingering. 4649 * However, the stream head currently does not pass these errors 4650 * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK 4651 * errors to the application (from tsleep()) and not errors 4652 * like ECONNRESET caused by receiving a reset packet. 4653 */ 4654 4655 /* ARGSUSED */ 4656 static void 4657 tcp_close_output(void *arg, mblk_t *mp, void *arg2) 4658 { 4659 char *msg; 4660 conn_t *connp = (conn_t *)arg; 4661 tcp_t *tcp = connp->conn_tcp; 4662 clock_t delta = 0; 4663 4664 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 4665 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 4666 4667 /* Cancel any pending timeout */ 4668 if (tcp->tcp_ordrelid != 0) { 4669 if (tcp->tcp_timeout) { 4670 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ordrelid); 4671 } 4672 tcp->tcp_ordrelid = 0; 4673 tcp->tcp_timeout = B_FALSE; 4674 } 4675 4676 mutex_enter(&tcp->tcp_eager_lock); 4677 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 4678 /* Cleanup for listener */ 4679 tcp_eager_cleanup(tcp, 0); 4680 tcp->tcp_wait_for_eagers = 1; 4681 } 4682 mutex_exit(&tcp->tcp_eager_lock); 4683 4684 connp->conn_mdt_ok = B_FALSE; 4685 tcp->tcp_mdt = B_FALSE; 4686 4687 msg = NULL; 4688 switch (tcp->tcp_state) { 4689 case TCPS_CLOSED: 4690 case TCPS_IDLE: 4691 case TCPS_BOUND: 4692 case TCPS_LISTEN: 4693 break; 4694 case TCPS_SYN_SENT: 4695 msg = "tcp_close, during connect"; 4696 break; 4697 case TCPS_SYN_RCVD: 4698 /* 4699 * Close during the connect 3-way handshake 4700 * but here there may or may not be pending data 4701 * already on queue. Process almost same as in 4702 * the ESTABLISHED state. 4703 */ 4704 /* FALLTHRU */ 4705 default: 4706 if (tcp->tcp_fused) 4707 tcp_unfuse(tcp); 4708 4709 /* 4710 * If SO_LINGER has set a zero linger time, abort the 4711 * connection with a reset. 4712 */ 4713 if (tcp->tcp_linger && tcp->tcp_lingertime == 0) { 4714 msg = "tcp_close, zero lingertime"; 4715 break; 4716 } 4717 4718 ASSERT(tcp->tcp_hard_bound || tcp->tcp_hard_binding); 4719 /* 4720 * Abort connection if there is unread data queued. 4721 */ 4722 if (tcp->tcp_rcv_list || tcp->tcp_reass_head) { 4723 msg = "tcp_close, unread data"; 4724 break; 4725 } 4726 /* 4727 * tcp_hard_bound is now cleared thus all packets go through 4728 * tcp_lookup. This fact is used by tcp_detach below. 4729 * 4730 * We have done a qwait() above which could have possibly 4731 * drained more messages in turn causing transition to a 4732 * different state. Check whether we have to do the rest 4733 * of the processing or not. 4734 */ 4735 if (tcp->tcp_state <= TCPS_LISTEN) 4736 break; 4737 4738 /* 4739 * Transmit the FIN before detaching the tcp_t. 4740 * After tcp_detach returns this queue/perimeter 4741 * no longer owns the tcp_t thus others can modify it. 4742 */ 4743 (void) tcp_xmit_end(tcp); 4744 4745 /* 4746 * If lingering on close then wait until the fin is acked, 4747 * the SO_LINGER time passes, or a reset is sent/received. 4748 */ 4749 if (tcp->tcp_linger && tcp->tcp_lingertime > 0 && 4750 !(tcp->tcp_fin_acked) && 4751 tcp->tcp_state >= TCPS_ESTABLISHED) { 4752 if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) { 4753 tcp->tcp_client_errno = EWOULDBLOCK; 4754 } else if (tcp->tcp_client_errno == 0) { 4755 4756 ASSERT(tcp->tcp_linger_tid == 0); 4757 4758 tcp->tcp_linger_tid = TCP_TIMER(tcp, 4759 tcp_close_linger_timeout, 4760 tcp->tcp_lingertime * hz); 4761 4762 /* tcp_close_linger_timeout will finish close */ 4763 if (tcp->tcp_linger_tid == 0) 4764 tcp->tcp_client_errno = ENOSR; 4765 else 4766 return; 4767 } 4768 4769 /* 4770 * Check if we need to detach or just close 4771 * the instance. 4772 */ 4773 if (tcp->tcp_state <= TCPS_LISTEN) 4774 break; 4775 } 4776 4777 /* 4778 * Make sure that no other thread will access the tcp_rq of 4779 * this instance (through lookups etc.) as tcp_rq will go 4780 * away shortly. 4781 */ 4782 tcp_acceptor_hash_remove(tcp); 4783 4784 if (tcp->tcp_flow_stopped) { 4785 tcp->tcp_flow_stopped = B_FALSE; 4786 tcp_clrqfull(tcp); 4787 } 4788 4789 if (tcp->tcp_timer_tid != 0) { 4790 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4791 tcp->tcp_timer_tid = 0; 4792 } 4793 /* 4794 * Need to cancel those timers which will not be used when 4795 * TCP is detached. This has to be done before the tcp_wq 4796 * is set to the global queue. 4797 */ 4798 tcp_timers_stop(tcp); 4799 4800 tcp->tcp_detached = B_TRUE; 4801 if (tcp->tcp_state == TCPS_TIME_WAIT) { 4802 tcp_time_wait_append(tcp); 4803 TCP_DBGSTAT(tcp_detach_time_wait); 4804 ASSERT(connp->conn_ref >= 3); 4805 goto finish; 4806 } 4807 4808 /* 4809 * If delta is zero the timer event wasn't executed and was 4810 * successfully canceled. In this case we need to restart it 4811 * with the minimal delta possible. 4812 */ 4813 if (delta >= 0) 4814 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 4815 delta ? delta : 1); 4816 4817 ASSERT(connp->conn_ref >= 3); 4818 goto finish; 4819 } 4820 4821 /* Detach did not complete. Still need to remove q from stream. */ 4822 if (msg) { 4823 if (tcp->tcp_state == TCPS_ESTABLISHED || 4824 tcp->tcp_state == TCPS_CLOSE_WAIT) 4825 BUMP_MIB(&tcp_mib, tcpEstabResets); 4826 if (tcp->tcp_state == TCPS_SYN_SENT || 4827 tcp->tcp_state == TCPS_SYN_RCVD) 4828 BUMP_MIB(&tcp_mib, tcpAttemptFails); 4829 tcp_xmit_ctl(msg, tcp, tcp->tcp_snxt, 0, TH_RST); 4830 } 4831 4832 tcp_closei_local(tcp); 4833 CONN_DEC_REF(connp); 4834 ASSERT(connp->conn_ref >= 2); 4835 4836 finish: 4837 /* 4838 * Although packets are always processed on the correct 4839 * tcp's perimeter and access is serialized via squeue's, 4840 * IP still needs a queue when sending packets in time_wait 4841 * state so use WR(tcp_g_q) till ip_output() can be 4842 * changed to deal with just connp. For read side, we 4843 * could have set tcp_rq to NULL but there are some cases 4844 * in tcp_rput_data() from early days of this code which 4845 * do a putnext without checking if tcp is closed. Those 4846 * need to be identified before both tcp_rq and tcp_wq 4847 * can be set to NULL and tcp_q_q can disappear forever. 4848 */ 4849 mutex_enter(&tcp->tcp_closelock); 4850 /* 4851 * Don't change the queues in the case of a listener that has 4852 * eagers in its q or q0. It could surprise the eagers. 4853 * Instead wait for the eagers outside the squeue. 4854 */ 4855 if (!tcp->tcp_wait_for_eagers) { 4856 tcp->tcp_detached = B_TRUE; 4857 tcp->tcp_rq = tcp_g_q; 4858 tcp->tcp_wq = WR(tcp_g_q); 4859 } 4860 /* Signal tcp_close() to finish closing. */ 4861 tcp->tcp_closed = 1; 4862 cv_signal(&tcp->tcp_closecv); 4863 mutex_exit(&tcp->tcp_closelock); 4864 } 4865 4866 4867 /* 4868 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 4869 * Some stream heads get upset if they see these later on as anything but NULL. 4870 */ 4871 static void 4872 tcp_close_mpp(mblk_t **mpp) 4873 { 4874 mblk_t *mp; 4875 4876 if ((mp = *mpp) != NULL) { 4877 do { 4878 mp->b_next = NULL; 4879 mp->b_prev = NULL; 4880 } while ((mp = mp->b_cont) != NULL); 4881 4882 mp = *mpp; 4883 *mpp = NULL; 4884 freemsg(mp); 4885 } 4886 } 4887 4888 /* Do detached close. */ 4889 static void 4890 tcp_close_detached(tcp_t *tcp) 4891 { 4892 if (tcp->tcp_fused) 4893 tcp_unfuse(tcp); 4894 4895 /* 4896 * Clustering code serializes TCP disconnect callbacks and 4897 * cluster tcp list walks by blocking a TCP disconnect callback 4898 * if a cluster tcp list walk is in progress. This ensures 4899 * accurate accounting of TCPs in the cluster code even though 4900 * the TCP list walk itself is not atomic. 4901 */ 4902 tcp_closei_local(tcp); 4903 CONN_DEC_REF(tcp->tcp_connp); 4904 } 4905 4906 /* 4907 * Stop all TCP timers, and free the timer mblks if requested. 4908 */ 4909 static void 4910 tcp_timers_stop(tcp_t *tcp) 4911 { 4912 if (tcp->tcp_timer_tid != 0) { 4913 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4914 tcp->tcp_timer_tid = 0; 4915 } 4916 if (tcp->tcp_ka_tid != 0) { 4917 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); 4918 tcp->tcp_ka_tid = 0; 4919 } 4920 if (tcp->tcp_ack_tid != 0) { 4921 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 4922 tcp->tcp_ack_tid = 0; 4923 } 4924 if (tcp->tcp_push_tid != 0) { 4925 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 4926 tcp->tcp_push_tid = 0; 4927 } 4928 } 4929 4930 /* 4931 * The tcp_t is going away. Remove it from all lists and set it 4932 * to TCPS_CLOSED. The freeing up of memory is deferred until 4933 * tcp_inactive. This is needed since a thread in tcp_rput might have 4934 * done a CONN_INC_REF on this structure before it was removed from the 4935 * hashes. 4936 */ 4937 static void 4938 tcp_closei_local(tcp_t *tcp) 4939 { 4940 ire_t *ire; 4941 conn_t *connp = tcp->tcp_connp; 4942 4943 if (!TCP_IS_SOCKET(tcp)) 4944 tcp_acceptor_hash_remove(tcp); 4945 4946 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 4947 tcp->tcp_ibsegs = 0; 4948 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 4949 tcp->tcp_obsegs = 0; 4950 /* 4951 * If we are an eager connection hanging off a listener that 4952 * hasn't formally accepted the connection yet, get off his 4953 * list and blow off any data that we have accumulated. 4954 */ 4955 if (tcp->tcp_listener != NULL) { 4956 tcp_t *listener = tcp->tcp_listener; 4957 mutex_enter(&listener->tcp_eager_lock); 4958 /* 4959 * tcp_eager_conn_ind == NULL means that the 4960 * conn_ind has already gone to listener. At 4961 * this point, eager will be closed but we 4962 * leave it in listeners eager list so that 4963 * if listener decides to close without doing 4964 * accept, we can clean this up. In tcp_wput_accept 4965 * we take case of the case of accept on closed 4966 * eager. 4967 */ 4968 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 4969 tcp_eager_unlink(tcp); 4970 mutex_exit(&listener->tcp_eager_lock); 4971 /* 4972 * We don't want to have any pointers to the 4973 * listener queue, after we have released our 4974 * reference on the listener 4975 */ 4976 tcp->tcp_rq = tcp_g_q; 4977 tcp->tcp_wq = WR(tcp_g_q); 4978 CONN_DEC_REF(listener->tcp_connp); 4979 } else { 4980 mutex_exit(&listener->tcp_eager_lock); 4981 } 4982 } 4983 4984 /* Stop all the timers */ 4985 tcp_timers_stop(tcp); 4986 4987 if (tcp->tcp_state == TCPS_LISTEN) { 4988 if (tcp->tcp_ip_addr_cache) { 4989 kmem_free((void *)tcp->tcp_ip_addr_cache, 4990 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 4991 tcp->tcp_ip_addr_cache = NULL; 4992 } 4993 } 4994 if (tcp->tcp_flow_stopped) 4995 tcp_clrqfull(tcp); 4996 4997 tcp_bind_hash_remove(tcp); 4998 /* 4999 * If the tcp_time_wait_collector (which runs outside the squeue) 5000 * is trying to remove this tcp from the time wait list, we will 5001 * block in tcp_time_wait_remove while trying to acquire the 5002 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 5003 * requires the ipcl_hash_remove to be ordered after the 5004 * tcp_time_wait_remove for the refcnt checks to work correctly. 5005 */ 5006 if (tcp->tcp_state == TCPS_TIME_WAIT) 5007 tcp_time_wait_remove(tcp, NULL); 5008 CL_INET_DISCONNECT(tcp); 5009 ipcl_hash_remove(connp); 5010 5011 /* 5012 * Delete the cached ire in conn_ire_cache and also mark 5013 * the conn as CONDEMNED 5014 */ 5015 mutex_enter(&connp->conn_lock); 5016 connp->conn_state_flags |= CONN_CONDEMNED; 5017 ire = connp->conn_ire_cache; 5018 connp->conn_ire_cache = NULL; 5019 mutex_exit(&connp->conn_lock); 5020 if (ire != NULL) 5021 IRE_REFRELE_NOTR(ire); 5022 5023 /* Need to cleanup any pending ioctls */ 5024 ASSERT(tcp->tcp_time_wait_next == NULL); 5025 ASSERT(tcp->tcp_time_wait_prev == NULL); 5026 ASSERT(tcp->tcp_time_wait_expire == 0); 5027 tcp->tcp_state = TCPS_CLOSED; 5028 } 5029 5030 /* 5031 * tcp is dying (called from ipcl_conn_destroy and error cases). 5032 * Free the tcp_t in either case. 5033 */ 5034 void 5035 tcp_free(tcp_t *tcp) 5036 { 5037 mblk_t *mp; 5038 ip6_pkt_t *ipp; 5039 5040 ASSERT(tcp != NULL); 5041 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 5042 5043 tcp->tcp_rq = NULL; 5044 tcp->tcp_wq = NULL; 5045 5046 tcp_close_mpp(&tcp->tcp_xmit_head); 5047 tcp_close_mpp(&tcp->tcp_reass_head); 5048 if (tcp->tcp_rcv_list != NULL) { 5049 /* Free b_next chain */ 5050 tcp_close_mpp(&tcp->tcp_rcv_list); 5051 } 5052 if ((mp = tcp->tcp_urp_mp) != NULL) { 5053 freemsg(mp); 5054 } 5055 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 5056 freemsg(mp); 5057 } 5058 5059 if (tcp->tcp_fused_sigurg_mp != NULL) { 5060 freeb(tcp->tcp_fused_sigurg_mp); 5061 tcp->tcp_fused_sigurg_mp = NULL; 5062 } 5063 5064 if (tcp->tcp_sack_info != NULL) { 5065 if (tcp->tcp_notsack_list != NULL) { 5066 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 5067 } 5068 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 5069 } 5070 5071 if (tcp->tcp_hopopts != NULL) { 5072 mi_free(tcp->tcp_hopopts); 5073 tcp->tcp_hopopts = NULL; 5074 tcp->tcp_hopoptslen = 0; 5075 } 5076 ASSERT(tcp->tcp_hopoptslen == 0); 5077 if (tcp->tcp_dstopts != NULL) { 5078 mi_free(tcp->tcp_dstopts); 5079 tcp->tcp_dstopts = NULL; 5080 tcp->tcp_dstoptslen = 0; 5081 } 5082 ASSERT(tcp->tcp_dstoptslen == 0); 5083 if (tcp->tcp_rtdstopts != NULL) { 5084 mi_free(tcp->tcp_rtdstopts); 5085 tcp->tcp_rtdstopts = NULL; 5086 tcp->tcp_rtdstoptslen = 0; 5087 } 5088 ASSERT(tcp->tcp_rtdstoptslen == 0); 5089 if (tcp->tcp_rthdr != NULL) { 5090 mi_free(tcp->tcp_rthdr); 5091 tcp->tcp_rthdr = NULL; 5092 tcp->tcp_rthdrlen = 0; 5093 } 5094 ASSERT(tcp->tcp_rthdrlen == 0); 5095 5096 ipp = &tcp->tcp_sticky_ipp; 5097 if ((ipp->ipp_fields & (IPPF_HOPOPTS | IPPF_RTDSTOPTS | 5098 IPPF_DSTOPTS | IPPF_RTHDR)) != 0) { 5099 if ((ipp->ipp_fields & IPPF_HOPOPTS) != 0) { 5100 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen); 5101 ipp->ipp_hopopts = NULL; 5102 ipp->ipp_hopoptslen = 0; 5103 } 5104 if ((ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) { 5105 kmem_free(ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 5106 ipp->ipp_rtdstopts = NULL; 5107 ipp->ipp_rtdstoptslen = 0; 5108 } 5109 if ((ipp->ipp_fields & IPPF_DSTOPTS) != 0) { 5110 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen); 5111 ipp->ipp_dstopts = NULL; 5112 ipp->ipp_dstoptslen = 0; 5113 } 5114 if ((ipp->ipp_fields & IPPF_RTHDR) != 0) { 5115 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen); 5116 ipp->ipp_rthdr = NULL; 5117 ipp->ipp_rthdrlen = 0; 5118 } 5119 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTDSTOPTS | 5120 IPPF_DSTOPTS | IPPF_RTHDR); 5121 } 5122 5123 /* 5124 * Free memory associated with the tcp/ip header template. 5125 */ 5126 5127 if (tcp->tcp_iphc != NULL) 5128 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 5129 5130 /* 5131 * Following is really a blowing away a union. 5132 * It happens to have exactly two members of identical size 5133 * the following code is enough. 5134 */ 5135 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 5136 5137 if (tcp->tcp_tracebuf != NULL) { 5138 kmem_free(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 5139 tcp->tcp_tracebuf = NULL; 5140 } 5141 } 5142 5143 5144 /* 5145 * Put a connection confirmation message upstream built from the 5146 * address information within 'iph' and 'tcph'. Report our success or failure. 5147 */ 5148 static boolean_t 5149 tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp, 5150 mblk_t **defermp) 5151 { 5152 sin_t sin; 5153 sin6_t sin6; 5154 mblk_t *mp; 5155 char *optp = NULL; 5156 int optlen = 0; 5157 cred_t *cr; 5158 5159 if (defermp != NULL) 5160 *defermp = NULL; 5161 5162 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) { 5163 /* 5164 * Return in T_CONN_CON results of option negotiation through 5165 * the T_CONN_REQ. Note: If there is an real end-to-end option 5166 * negotiation, then what is received from remote end needs 5167 * to be taken into account but there is no such thing (yet?) 5168 * in our TCP/IP. 5169 * Note: We do not use mi_offset_param() here as 5170 * tcp_opts_conn_req contents do not directly come from 5171 * an application and are either generated in kernel or 5172 * from user input that was already verified. 5173 */ 5174 mp = tcp->tcp_conn.tcp_opts_conn_req; 5175 optp = (char *)(mp->b_rptr + 5176 ((struct T_conn_req *)mp->b_rptr)->OPT_offset); 5177 optlen = (int) 5178 ((struct T_conn_req *)mp->b_rptr)->OPT_length; 5179 } 5180 5181 if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) { 5182 ipha_t *ipha = (ipha_t *)iphdr; 5183 5184 /* packet is IPv4 */ 5185 if (tcp->tcp_family == AF_INET) { 5186 sin = sin_null; 5187 sin.sin_addr.s_addr = ipha->ipha_src; 5188 sin.sin_port = *(uint16_t *)tcph->th_lport; 5189 sin.sin_family = AF_INET; 5190 mp = mi_tpi_conn_con(NULL, (char *)&sin, 5191 (int)sizeof (sin_t), optp, optlen); 5192 } else { 5193 sin6 = sin6_null; 5194 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 5195 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5196 sin6.sin6_family = AF_INET6; 5197 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 5198 (int)sizeof (sin6_t), optp, optlen); 5199 5200 } 5201 } else { 5202 ip6_t *ip6h = (ip6_t *)iphdr; 5203 5204 ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION); 5205 ASSERT(tcp->tcp_family == AF_INET6); 5206 sin6 = sin6_null; 5207 sin6.sin6_addr = ip6h->ip6_src; 5208 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5209 sin6.sin6_family = AF_INET6; 5210 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 5211 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 5212 (int)sizeof (sin6_t), optp, optlen); 5213 } 5214 5215 if (!mp) 5216 return (B_FALSE); 5217 5218 if ((cr = DB_CRED(idmp)) != NULL) { 5219 mblk_setcred(mp, cr); 5220 DB_CPID(mp) = DB_CPID(idmp); 5221 } 5222 5223 if (defermp == NULL) 5224 putnext(tcp->tcp_rq, mp); 5225 else 5226 *defermp = mp; 5227 5228 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 5229 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 5230 return (B_TRUE); 5231 } 5232 5233 /* 5234 * Defense for the SYN attack - 5235 * 1. When q0 is full, drop from the tail (tcp_eager_prev_q0) the oldest 5236 * one that doesn't have the dontdrop bit set. 5237 * 2. Don't drop a SYN request before its first timeout. This gives every 5238 * request at least til the first timeout to complete its 3-way handshake. 5239 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 5240 * requests currently on the queue that has timed out. This will be used 5241 * as an indicator of whether an attack is under way, so that appropriate 5242 * actions can be taken. (It's incremented in tcp_timer() and decremented 5243 * either when eager goes into ESTABLISHED, or gets freed up.) 5244 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 5245 * # of timeout drops back to <= q0len/32 => SYN alert off 5246 */ 5247 static boolean_t 5248 tcp_drop_q0(tcp_t *tcp) 5249 { 5250 tcp_t *eager; 5251 5252 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 5253 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 5254 /* 5255 * New one is added after next_q0 so prev_q0 points to the oldest 5256 * Also do not drop any established connections that are deferred on 5257 * q0 due to q being full 5258 */ 5259 5260 eager = tcp->tcp_eager_prev_q0; 5261 while (eager->tcp_dontdrop || eager->tcp_conn_def_q0) { 5262 eager = eager->tcp_eager_prev_q0; 5263 if (eager == tcp) { 5264 eager = tcp->tcp_eager_prev_q0; 5265 break; 5266 } 5267 } 5268 if (eager->tcp_syn_rcvd_timeout == 0) 5269 return (B_FALSE); 5270 5271 if (tcp->tcp_debug) { 5272 (void) strlog(TCP_MODULE_ID, 0, 3, SL_TRACE, 5273 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 5274 " (%d pending) on %s, drop one", tcp_conn_req_max_q0, 5275 tcp->tcp_conn_req_cnt_q0, 5276 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 5277 } 5278 5279 BUMP_MIB(&tcp_mib, tcpHalfOpenDrop); 5280 5281 /* 5282 * need to do refhold here because the selected eager could 5283 * be removed by someone else if we release the eager lock. 5284 */ 5285 CONN_INC_REF(eager->tcp_connp); 5286 mutex_exit(&tcp->tcp_eager_lock); 5287 5288 /* Mark the IRE created for this SYN request temporary */ 5289 tcp_ip_ire_mark_advice(eager); 5290 (void) tcp_clean_death(eager, ETIMEDOUT, 5); 5291 CONN_DEC_REF(eager->tcp_connp); 5292 5293 mutex_enter(&tcp->tcp_eager_lock); 5294 return (B_TRUE); 5295 } 5296 5297 int 5298 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 5299 tcph_t *tcph, uint_t ipvers, mblk_t *idmp) 5300 { 5301 tcp_t *ltcp = lconnp->conn_tcp; 5302 tcp_t *tcp = connp->conn_tcp; 5303 mblk_t *tpi_mp; 5304 ipha_t *ipha; 5305 ip6_t *ip6h; 5306 sin6_t sin6; 5307 in6_addr_t v6dst; 5308 int err; 5309 int ifindex = 0; 5310 cred_t *cr; 5311 5312 if (ipvers == IPV4_VERSION) { 5313 ipha = (ipha_t *)mp->b_rptr; 5314 5315 connp->conn_send = ip_output; 5316 connp->conn_recv = tcp_input; 5317 5318 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 5319 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 5320 5321 sin6 = sin6_null; 5322 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 5323 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 5324 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5325 sin6.sin6_family = AF_INET6; 5326 sin6.__sin6_src_id = ip_srcid_find_addr(&v6dst, 5327 lconnp->conn_zoneid); 5328 if (tcp->tcp_recvdstaddr) { 5329 sin6_t sin6d; 5330 5331 sin6d = sin6_null; 5332 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, 5333 &sin6d.sin6_addr); 5334 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 5335 sin6d.sin6_family = AF_INET; 5336 tpi_mp = mi_tpi_extconn_ind(NULL, 5337 (char *)&sin6d, sizeof (sin6_t), 5338 (char *)&tcp, 5339 (t_scalar_t)sizeof (intptr_t), 5340 (char *)&sin6d, sizeof (sin6_t), 5341 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5342 } else { 5343 tpi_mp = mi_tpi_conn_ind(NULL, 5344 (char *)&sin6, sizeof (sin6_t), 5345 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5346 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5347 } 5348 } else { 5349 ip6h = (ip6_t *)mp->b_rptr; 5350 5351 connp->conn_send = ip_output_v6; 5352 connp->conn_recv = tcp_input; 5353 5354 connp->conn_srcv6 = ip6h->ip6_dst; 5355 connp->conn_remv6 = ip6h->ip6_src; 5356 5357 /* db_cksumstuff is set at ip_fanout_tcp_v6 */ 5358 ifindex = (int)mp->b_datap->db_cksumstuff; 5359 mp->b_datap->db_cksumstuff = 0; 5360 5361 sin6 = sin6_null; 5362 sin6.sin6_addr = ip6h->ip6_src; 5363 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5364 sin6.sin6_family = AF_INET6; 5365 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 5366 sin6.__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 5367 lconnp->conn_zoneid); 5368 5369 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 5370 /* Pass up the scope_id of remote addr */ 5371 sin6.sin6_scope_id = ifindex; 5372 } else { 5373 sin6.sin6_scope_id = 0; 5374 } 5375 if (tcp->tcp_recvdstaddr) { 5376 sin6_t sin6d; 5377 5378 sin6d = sin6_null; 5379 sin6.sin6_addr = ip6h->ip6_dst; 5380 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 5381 sin6d.sin6_family = AF_INET; 5382 tpi_mp = mi_tpi_extconn_ind(NULL, 5383 (char *)&sin6d, sizeof (sin6_t), 5384 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5385 (char *)&sin6d, sizeof (sin6_t), 5386 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5387 } else { 5388 tpi_mp = mi_tpi_conn_ind(NULL, 5389 (char *)&sin6, sizeof (sin6_t), 5390 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5391 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5392 } 5393 } 5394 5395 if (tpi_mp == NULL) 5396 return (ENOMEM); 5397 5398 connp->conn_fport = *(uint16_t *)tcph->th_lport; 5399 connp->conn_lport = *(uint16_t *)tcph->th_fport; 5400 connp->conn_flags |= (IPCL_TCP6|IPCL_EAGER); 5401 connp->conn_fully_bound = B_FALSE; 5402 5403 if (tcp_trace) 5404 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 5405 5406 /* Inherit information from the "parent" */ 5407 tcp->tcp_ipversion = ltcp->tcp_ipversion; 5408 tcp->tcp_family = ltcp->tcp_family; 5409 tcp->tcp_wq = ltcp->tcp_wq; 5410 tcp->tcp_rq = ltcp->tcp_rq; 5411 tcp->tcp_mss = tcp_mss_def_ipv6; 5412 tcp->tcp_detached = B_TRUE; 5413 if ((err = tcp_init_values(tcp)) != 0) { 5414 freemsg(tpi_mp); 5415 return (err); 5416 } 5417 5418 if (ipvers == IPV4_VERSION) { 5419 if ((err = tcp_header_init_ipv4(tcp)) != 0) { 5420 freemsg(tpi_mp); 5421 return (err); 5422 } 5423 ASSERT(tcp->tcp_ipha != NULL); 5424 } else { 5425 /* ifindex must be already set */ 5426 ASSERT(ifindex != 0); 5427 5428 if (ltcp->tcp_bound_if != 0) { 5429 /* 5430 * Set newtcp's bound_if equal to 5431 * listener's value. If ifindex is 5432 * not the same as ltcp->tcp_bound_if, 5433 * it must be a packet for the ipmp group 5434 * of interfaces 5435 */ 5436 tcp->tcp_bound_if = ltcp->tcp_bound_if; 5437 } else if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 5438 tcp->tcp_bound_if = ifindex; 5439 } 5440 5441 tcp->tcp_ipv6_recvancillary = ltcp->tcp_ipv6_recvancillary; 5442 tcp->tcp_recvifindex = 0; 5443 tcp->tcp_recvhops = 0xffffffffU; 5444 ASSERT(tcp->tcp_ip6h != NULL); 5445 } 5446 5447 tcp->tcp_lport = ltcp->tcp_lport; 5448 5449 if (ltcp->tcp_ipversion == tcp->tcp_ipversion) { 5450 if (tcp->tcp_iphc_len != ltcp->tcp_iphc_len) { 5451 /* 5452 * Listener had options of some sort; eager inherits. 5453 * Free up the eager template and allocate one 5454 * of the right size. 5455 */ 5456 if (tcp->tcp_hdr_grown) { 5457 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 5458 } else { 5459 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 5460 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 5461 } 5462 tcp->tcp_iphc = kmem_zalloc(ltcp->tcp_iphc_len, 5463 KM_NOSLEEP); 5464 if (tcp->tcp_iphc == NULL) { 5465 tcp->tcp_iphc_len = 0; 5466 freemsg(tpi_mp); 5467 return (ENOMEM); 5468 } 5469 tcp->tcp_iphc_len = ltcp->tcp_iphc_len; 5470 tcp->tcp_hdr_grown = B_TRUE; 5471 } 5472 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 5473 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 5474 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5475 tcp->tcp_ip6_hops = ltcp->tcp_ip6_hops; 5476 tcp->tcp_ip6_vcf = ltcp->tcp_ip6_vcf; 5477 5478 /* 5479 * Copy the IP+TCP header template from listener to eager 5480 */ 5481 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 5482 if (tcp->tcp_ipversion == IPV6_VERSION) { 5483 if (((ip6i_t *)(tcp->tcp_iphc))->ip6i_nxt == 5484 IPPROTO_RAW) { 5485 tcp->tcp_ip6h = 5486 (ip6_t *)(tcp->tcp_iphc + 5487 sizeof (ip6i_t)); 5488 } else { 5489 tcp->tcp_ip6h = 5490 (ip6_t *)(tcp->tcp_iphc); 5491 } 5492 tcp->tcp_ipha = NULL; 5493 } else { 5494 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 5495 tcp->tcp_ip6h = NULL; 5496 } 5497 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 5498 tcp->tcp_ip_hdr_len); 5499 } else { 5500 /* 5501 * only valid case when ipversion of listener and 5502 * eager differ is when listener is IPv6 and 5503 * eager is IPv4. 5504 * Eager header template has been initialized to the 5505 * maximum v4 header sizes, which includes space for 5506 * TCP and IP options. 5507 */ 5508 ASSERT((ltcp->tcp_ipversion == IPV6_VERSION) && 5509 (tcp->tcp_ipversion == IPV4_VERSION)); 5510 ASSERT(tcp->tcp_iphc_len >= 5511 TCP_MAX_COMBINED_HEADER_LENGTH); 5512 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5513 /* copy IP header fields individually */ 5514 tcp->tcp_ipha->ipha_ttl = 5515 ltcp->tcp_ip6h->ip6_hops; 5516 bcopy(ltcp->tcp_tcph->th_lport, 5517 tcp->tcp_tcph->th_lport, sizeof (ushort_t)); 5518 } 5519 5520 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 5521 bcopy(tcp->tcp_tcph->th_fport, &tcp->tcp_fport, 5522 sizeof (in_port_t)); 5523 5524 if (ltcp->tcp_lport == 0) { 5525 tcp->tcp_lport = *(in_port_t *)tcph->th_fport; 5526 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, 5527 sizeof (in_port_t)); 5528 } 5529 5530 if (tcp->tcp_ipversion == IPV4_VERSION) { 5531 ASSERT(ipha != NULL); 5532 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 5533 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 5534 5535 /* Source routing option copyover (reverse it) */ 5536 if (tcp_rev_src_routes) 5537 tcp_opt_reverse(tcp, ipha); 5538 } else { 5539 ASSERT(ip6h != NULL); 5540 tcp->tcp_ip6h->ip6_dst = ip6h->ip6_src; 5541 tcp->tcp_ip6h->ip6_src = ip6h->ip6_dst; 5542 } 5543 5544 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 5545 /* 5546 * If the SYN contains a credential, it's a loopback packet; attach 5547 * the credential to the TPI message. 5548 */ 5549 if ((cr = DB_CRED(idmp)) != NULL) { 5550 mblk_setcred(tpi_mp, cr); 5551 DB_CPID(tpi_mp) = DB_CPID(idmp); 5552 } 5553 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 5554 5555 return (0); 5556 } 5557 5558 5559 int 5560 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 5561 tcph_t *tcph, mblk_t *idmp) 5562 { 5563 tcp_t *ltcp = lconnp->conn_tcp; 5564 tcp_t *tcp = connp->conn_tcp; 5565 sin_t sin; 5566 mblk_t *tpi_mp = NULL; 5567 int err; 5568 cred_t *cr; 5569 5570 sin = sin_null; 5571 sin.sin_addr.s_addr = ipha->ipha_src; 5572 sin.sin_port = *(uint16_t *)tcph->th_lport; 5573 sin.sin_family = AF_INET; 5574 if (ltcp->tcp_recvdstaddr) { 5575 sin_t sind; 5576 5577 sind = sin_null; 5578 sind.sin_addr.s_addr = ipha->ipha_dst; 5579 sind.sin_port = *(uint16_t *)tcph->th_fport; 5580 sind.sin_family = AF_INET; 5581 tpi_mp = mi_tpi_extconn_ind(NULL, 5582 (char *)&sind, sizeof (sin_t), (char *)&tcp, 5583 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 5584 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5585 } else { 5586 tpi_mp = mi_tpi_conn_ind(NULL, 5587 (char *)&sin, sizeof (sin_t), 5588 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5589 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5590 } 5591 5592 if (tpi_mp == NULL) { 5593 return (ENOMEM); 5594 } 5595 5596 connp->conn_flags |= (IPCL_TCP4|IPCL_EAGER); 5597 connp->conn_send = ip_output; 5598 connp->conn_recv = tcp_input; 5599 connp->conn_fully_bound = B_FALSE; 5600 5601 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 5602 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 5603 connp->conn_fport = *(uint16_t *)tcph->th_lport; 5604 connp->conn_lport = *(uint16_t *)tcph->th_fport; 5605 5606 if (tcp_trace) { 5607 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 5608 } 5609 5610 /* Inherit information from the "parent" */ 5611 tcp->tcp_ipversion = ltcp->tcp_ipversion; 5612 tcp->tcp_family = ltcp->tcp_family; 5613 tcp->tcp_wq = ltcp->tcp_wq; 5614 tcp->tcp_rq = ltcp->tcp_rq; 5615 tcp->tcp_mss = tcp_mss_def_ipv4; 5616 tcp->tcp_detached = B_TRUE; 5617 if ((err = tcp_init_values(tcp)) != 0) { 5618 freemsg(tpi_mp); 5619 return (err); 5620 } 5621 5622 /* 5623 * Let's make sure that eager tcp template has enough space to 5624 * copy IPv4 listener's tcp template. Since the conn_t structure is 5625 * preserved and tcp_iphc_len is also preserved, an eager conn_t may 5626 * have a tcp_template of total len TCP_MAX_COMBINED_HEADER_LENGTH or 5627 * more (in case of re-allocation of conn_t with tcp-IPv6 template with 5628 * extension headers or with ip6i_t struct). Note that bcopy() below 5629 * copies listener tcp's hdr_len which cannot be greater than TCP_MAX_ 5630 * COMBINED_HEADER_LENGTH as this listener must be a IPv4 listener. 5631 */ 5632 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 5633 ASSERT(ltcp->tcp_hdr_len <= TCP_MAX_COMBINED_HEADER_LENGTH); 5634 5635 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 5636 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 5637 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5638 tcp->tcp_ttl = ltcp->tcp_ttl; 5639 tcp->tcp_tos = ltcp->tcp_tos; 5640 5641 /* Copy the IP+TCP header template from listener to eager */ 5642 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 5643 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 5644 tcp->tcp_ip6h = NULL; 5645 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 5646 tcp->tcp_ip_hdr_len); 5647 5648 /* Initialize the IP addresses and Ports */ 5649 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 5650 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 5651 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 5652 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t)); 5653 5654 /* Source routing option copyover (reverse it) */ 5655 if (tcp_rev_src_routes) 5656 tcp_opt_reverse(tcp, ipha); 5657 5658 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 5659 5660 /* 5661 * If the SYN contains a credential, it's a loopback packet; attach 5662 * the credential to the TPI message. 5663 */ 5664 if ((cr = DB_CRED(idmp)) != NULL) { 5665 mblk_setcred(tpi_mp, cr); 5666 DB_CPID(tpi_mp) = DB_CPID(idmp); 5667 } 5668 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 5669 5670 return (0); 5671 } 5672 5673 /* 5674 * sets up conn for ipsec. 5675 * if the first mblk is M_CTL it is consumed and mpp is updated. 5676 * in case of error mpp is freed. 5677 */ 5678 conn_t * 5679 tcp_get_ipsec_conn(tcp_t *tcp, squeue_t *sqp, mblk_t **mpp) 5680 { 5681 conn_t *connp = tcp->tcp_connp; 5682 conn_t *econnp; 5683 squeue_t *new_sqp; 5684 mblk_t *first_mp = *mpp; 5685 mblk_t *mp = *mpp; 5686 boolean_t mctl_present = B_FALSE; 5687 uint_t ipvers; 5688 5689 econnp = tcp_get_conn(sqp); 5690 if (econnp == NULL) { 5691 freemsg(first_mp); 5692 return (NULL); 5693 } 5694 if (DB_TYPE(mp) == M_CTL) { 5695 if (mp->b_cont == NULL || 5696 mp->b_cont->b_datap->db_type != M_DATA) { 5697 freemsg(first_mp); 5698 return (NULL); 5699 } 5700 mp = mp->b_cont; 5701 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) == 0) { 5702 freemsg(first_mp); 5703 return (NULL); 5704 } 5705 5706 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 5707 first_mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5708 mctl_present = B_TRUE; 5709 } else { 5710 ASSERT(mp->b_datap->db_struioflag & STRUIO_POLICY); 5711 mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5712 } 5713 5714 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 5715 mp->b_datap->db_cksumstart = 0; 5716 5717 ASSERT(OK_32PTR(mp->b_rptr)); 5718 ipvers = IPH_HDR_VERSION(mp->b_rptr); 5719 if (ipvers == IPV4_VERSION) { 5720 uint16_t *up; 5721 uint32_t ports; 5722 ipha_t *ipha; 5723 5724 ipha = (ipha_t *)mp->b_rptr; 5725 up = (uint16_t *)((uchar_t *)ipha + 5726 IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET); 5727 ports = *(uint32_t *)up; 5728 IPCL_TCP_EAGER_INIT(econnp, IPPROTO_TCP, 5729 ipha->ipha_dst, ipha->ipha_src, ports); 5730 } else { 5731 uint16_t *up; 5732 uint32_t ports; 5733 uint16_t ip_hdr_len; 5734 uint8_t *nexthdrp; 5735 ip6_t *ip6h; 5736 tcph_t *tcph; 5737 5738 ip6h = (ip6_t *)mp->b_rptr; 5739 if (ip6h->ip6_nxt == IPPROTO_TCP) { 5740 ip_hdr_len = IPV6_HDR_LEN; 5741 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip_hdr_len, 5742 &nexthdrp) || *nexthdrp != IPPROTO_TCP) { 5743 CONN_DEC_REF(econnp); 5744 freemsg(first_mp); 5745 return (NULL); 5746 } 5747 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 5748 up = (uint16_t *)tcph->th_lport; 5749 ports = *(uint32_t *)up; 5750 IPCL_TCP_EAGER_INIT_V6(econnp, IPPROTO_TCP, 5751 ip6h->ip6_dst, ip6h->ip6_src, ports); 5752 } 5753 5754 /* 5755 * The caller already ensured that there is a sqp present. 5756 */ 5757 econnp->conn_sqp = new_sqp; 5758 5759 if (connp->conn_policy != NULL) { 5760 ipsec_in_t *ii; 5761 ii = (ipsec_in_t *)(first_mp->b_rptr); 5762 ASSERT(ii->ipsec_in_policy == NULL); 5763 IPPH_REFHOLD(connp->conn_policy); 5764 ii->ipsec_in_policy = connp->conn_policy; 5765 5766 first_mp->b_datap->db_type = IPSEC_POLICY_SET; 5767 if (!ip_bind_ipsec_policy_set(econnp, first_mp)) { 5768 CONN_DEC_REF(econnp); 5769 freemsg(first_mp); 5770 return (NULL); 5771 } 5772 } 5773 5774 if (ipsec_conn_cache_policy(econnp, ipvers == IPV4_VERSION) != 0) { 5775 CONN_DEC_REF(econnp); 5776 freemsg(first_mp); 5777 return (NULL); 5778 } 5779 5780 /* 5781 * If we know we have some policy, pass the "IPSEC" 5782 * options size TCP uses this adjust the MSS. 5783 */ 5784 econnp->conn_tcp->tcp_ipsec_overhead = conn_ipsec_length(econnp); 5785 if (mctl_present) { 5786 freeb(first_mp); 5787 *mpp = mp; 5788 } 5789 5790 return (econnp); 5791 } 5792 5793 /* 5794 * tcp_get_conn/tcp_free_conn 5795 * 5796 * tcp_get_conn is used to get a clean tcp connection structure. 5797 * It tries to reuse the connections put on the freelist by the 5798 * time_wait_collector failing which it goes to kmem_cache. This 5799 * way has two benefits compared to just allocating from and 5800 * freeing to kmem_cache. 5801 * 1) The time_wait_collector can free (which includes the cleanup) 5802 * outside the squeue. So when the interrupt comes, we have a clean 5803 * connection sitting in the freelist. Obviously, this buys us 5804 * performance. 5805 * 5806 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_conn_request 5807 * has multiple disadvantages - tying up the squeue during alloc, and the 5808 * fact that IPSec policy initialization has to happen here which 5809 * requires us sending a M_CTL and checking for it i.e. real ugliness. 5810 * But allocating the conn/tcp in IP land is also not the best since 5811 * we can't check the 'q' and 'q0' which are protected by squeue and 5812 * blindly allocate memory which might have to be freed here if we are 5813 * not allowed to accept the connection. By using the freelist and 5814 * putting the conn/tcp back in freelist, we don't pay a penalty for 5815 * allocating memory without checking 'q/q0' and freeing it if we can't 5816 * accept the connection. 5817 * 5818 * Care should be taken to put the conn back in the same squeue's freelist 5819 * from which it was allocated. Best results are obtained if conn is 5820 * allocated from listener's squeue and freed to the same. Time wait 5821 * collector will free up the freelist is the connection ends up sitting 5822 * there for too long. 5823 */ 5824 void * 5825 tcp_get_conn(void *arg) 5826 { 5827 tcp_t *tcp = NULL; 5828 conn_t *connp = NULL; 5829 squeue_t *sqp = (squeue_t *)arg; 5830 tcp_squeue_priv_t *tcp_time_wait; 5831 5832 tcp_time_wait = 5833 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 5834 5835 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 5836 tcp = tcp_time_wait->tcp_free_list; 5837 if (tcp != NULL) { 5838 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 5839 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5840 tcp->tcp_time_wait_next = NULL; 5841 connp = tcp->tcp_connp; 5842 connp->conn_flags |= IPCL_REUSED; 5843 return ((void *)connp); 5844 } 5845 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5846 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL) 5847 return (NULL); 5848 return ((void *)connp); 5849 } 5850 5851 /* BEGIN CSTYLED */ 5852 /* 5853 * 5854 * The sockfs ACCEPT path: 5855 * ======================= 5856 * 5857 * The eager is now established in its own perimeter as soon as SYN is 5858 * received in tcp_conn_request(). When sockfs receives conn_ind, it 5859 * completes the accept processing on the acceptor STREAM. The sending 5860 * of conn_ind part is common for both sockfs listener and a TLI/XTI 5861 * listener but a TLI/XTI listener completes the accept processing 5862 * on the listener perimeter. 5863 * 5864 * Common control flow for 3 way handshake: 5865 * ---------------------------------------- 5866 * 5867 * incoming SYN (listener perimeter) -> tcp_rput_data() 5868 * -> tcp_conn_request() 5869 * 5870 * incoming SYN-ACK-ACK (eager perim) -> tcp_rput_data() 5871 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 5872 * 5873 * Sockfs ACCEPT Path: 5874 * ------------------- 5875 * 5876 * open acceptor stream (ip_tcpopen allocates tcp_wput_accept() 5877 * as STREAM entry point) 5878 * 5879 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_wput_accept() 5880 * 5881 * tcp_wput_accept() extracts the eager and makes the q->q_ptr <-> eager 5882 * association (we are not behind eager's squeue but sockfs is protecting us 5883 * and no one knows about this stream yet. The STREAMS entry point q->q_info 5884 * is changed to point at tcp_wput(). 5885 * 5886 * tcp_wput_accept() sends any deferred eagers via tcp_send_pending() to 5887 * listener (done on listener's perimeter). 5888 * 5889 * tcp_wput_accept() calls tcp_accept_finish() on eagers perimeter to finish 5890 * accept. 5891 * 5892 * TLI/XTI client ACCEPT path: 5893 * --------------------------- 5894 * 5895 * soaccept() sends T_CONN_RES on the listener STREAM. 5896 * 5897 * tcp_accept() -> tcp_accept_swap() complete the processing and send 5898 * the bind_mp to eager perimeter to finish accept (tcp_rput_other()). 5899 * 5900 * Locks: 5901 * ====== 5902 * 5903 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 5904 * and listeners->tcp_eager_next_q. 5905 * 5906 * Referencing: 5907 * ============ 5908 * 5909 * 1) We start out in tcp_conn_request by eager placing a ref on 5910 * listener and listener adding eager to listeners->tcp_eager_next_q0. 5911 * 5912 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 5913 * doing so we place a ref on the eager. This ref is finally dropped at the 5914 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 5915 * reference is dropped by the squeue framework. 5916 * 5917 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 5918 * 5919 * The reference must be released by the same entity that added the reference 5920 * In the above scheme, the eager is the entity that adds and releases the 5921 * references. Note that tcp_accept_finish executes in the squeue of the eager 5922 * (albeit after it is attached to the acceptor stream). Though 1. executes 5923 * in the listener's squeue, the eager is nascent at this point and the 5924 * reference can be considered to have been added on behalf of the eager. 5925 * 5926 * Eager getting a Reset or listener closing: 5927 * ========================================== 5928 * 5929 * Once the listener and eager are linked, the listener never does the unlink. 5930 * If the listener needs to close, tcp_eager_cleanup() is called which queues 5931 * a message on all eager perimeter. The eager then does the unlink, clears 5932 * any pointers to the listener's queue and drops the reference to the 5933 * listener. The listener waits in tcp_close outside the squeue until its 5934 * refcount has dropped to 1. This ensures that the listener has waited for 5935 * all eagers to clear their association with the listener. 5936 * 5937 * Similarly, if eager decides to go away, it can unlink itself and close. 5938 * When the T_CONN_RES comes down, we check if eager has closed. Note that 5939 * the reference to eager is still valid because of the extra ref we put 5940 * in tcp_send_conn_ind. 5941 * 5942 * Listener can always locate the eager under the protection 5943 * of the listener->tcp_eager_lock, and then do a refhold 5944 * on the eager during the accept processing. 5945 * 5946 * The acceptor stream accesses the eager in the accept processing 5947 * based on the ref placed on eager before sending T_conn_ind. 5948 * The only entity that can negate this refhold is a listener close 5949 * which is mutually exclusive with an active acceptor stream. 5950 * 5951 * Eager's reference on the listener 5952 * =================================== 5953 * 5954 * If the accept happens (even on a closed eager) the eager drops its 5955 * reference on the listener at the start of tcp_accept_finish. If the 5956 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 5957 * the reference is dropped in tcp_closei_local. If the listener closes, 5958 * the reference is dropped in tcp_eager_kill. In all cases the reference 5959 * is dropped while executing in the eager's context (squeue). 5960 */ 5961 /* END CSTYLED */ 5962 5963 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 5964 5965 /* 5966 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 5967 * tcp_rput_data will not see any SYN packets. 5968 */ 5969 /* ARGSUSED */ 5970 void 5971 tcp_conn_request(void *arg, mblk_t *mp, void *arg2) 5972 { 5973 tcph_t *tcph; 5974 uint32_t seg_seq; 5975 tcp_t *eager; 5976 uint_t ipvers; 5977 ipha_t *ipha; 5978 ip6_t *ip6h; 5979 int err; 5980 conn_t *econnp = NULL; 5981 squeue_t *new_sqp; 5982 mblk_t *mp1; 5983 uint_t ip_hdr_len; 5984 conn_t *connp = (conn_t *)arg; 5985 tcp_t *tcp = connp->conn_tcp; 5986 ire_t *ire; 5987 5988 if (tcp->tcp_state != TCPS_LISTEN) 5989 goto error2; 5990 5991 ASSERT((tcp->tcp_connp->conn_flags & IPCL_BOUND) != 0); 5992 5993 mutex_enter(&tcp->tcp_eager_lock); 5994 if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) { 5995 mutex_exit(&tcp->tcp_eager_lock); 5996 TCP_STAT(tcp_listendrop); 5997 BUMP_MIB(&tcp_mib, tcpListenDrop); 5998 if (tcp->tcp_debug) { 5999 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 6000 "tcp_conn_request: listen backlog (max=%d) " 6001 "overflow (%d pending) on %s", 6002 tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q, 6003 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 6004 } 6005 goto error2; 6006 } 6007 6008 if (tcp->tcp_conn_req_cnt_q0 >= 6009 tcp->tcp_conn_req_max + tcp_conn_req_max_q0) { 6010 /* 6011 * Q0 is full. Drop a pending half-open req from the queue 6012 * to make room for the new SYN req. Also mark the time we 6013 * drop a SYN. 6014 * 6015 * A more aggressive defense against SYN attack will 6016 * be to set the "tcp_syn_defense" flag now. 6017 */ 6018 TCP_STAT(tcp_listendropq0); 6019 tcp->tcp_last_rcv_lbolt = lbolt64; 6020 if (!tcp_drop_q0(tcp)) { 6021 mutex_exit(&tcp->tcp_eager_lock); 6022 BUMP_MIB(&tcp_mib, tcpListenDropQ0); 6023 if (tcp->tcp_debug) { 6024 (void) strlog(TCP_MODULE_ID, 0, 3, SL_TRACE, 6025 "tcp_conn_request: listen half-open queue " 6026 "(max=%d) full (%d pending) on %s", 6027 tcp_conn_req_max_q0, 6028 tcp->tcp_conn_req_cnt_q0, 6029 tcp_display(tcp, NULL, 6030 DISP_PORT_ONLY)); 6031 } 6032 goto error2; 6033 } 6034 } 6035 mutex_exit(&tcp->tcp_eager_lock); 6036 6037 /* 6038 * IP adds STRUIO_EAGER and ensures that the received packet is 6039 * M_DATA even if conn_ipv6_recvpktinfo is enabled or for ip6 6040 * link local address. If IPSec is enabled, db_struioflag has 6041 * STRUIO_POLICY set (mutually exclusive from STRUIO_EAGER); 6042 * otherwise an error case if neither of them is set. 6043 */ 6044 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 6045 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 6046 mp->b_datap->db_cksumstart = 0; 6047 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 6048 econnp = (conn_t *)tcp_get_conn(arg2); 6049 if (econnp == NULL) 6050 goto error2; 6051 econnp->conn_sqp = new_sqp; 6052 } else if ((mp->b_datap->db_struioflag & STRUIO_POLICY) != 0) { 6053 /* 6054 * mp is updated in tcp_get_ipsec_conn(). 6055 */ 6056 econnp = tcp_get_ipsec_conn(tcp, arg2, &mp); 6057 if (econnp == NULL) { 6058 /* 6059 * mp freed by tcp_get_ipsec_conn. 6060 */ 6061 return; 6062 } 6063 } else { 6064 goto error2; 6065 } 6066 6067 ASSERT(DB_TYPE(mp) == M_DATA); 6068 6069 ipvers = IPH_HDR_VERSION(mp->b_rptr); 6070 ASSERT(ipvers == IPV6_VERSION || ipvers == IPV4_VERSION); 6071 ASSERT(OK_32PTR(mp->b_rptr)); 6072 if (ipvers == IPV4_VERSION) { 6073 ipha = (ipha_t *)mp->b_rptr; 6074 ip_hdr_len = IPH_HDR_LENGTH(ipha); 6075 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 6076 } else { 6077 ip6h = (ip6_t *)mp->b_rptr; 6078 ip_hdr_len = ip_hdr_length_v6(mp, ip6h); 6079 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 6080 } 6081 6082 if (tcp->tcp_family == AF_INET) { 6083 ASSERT(ipvers == IPV4_VERSION); 6084 err = tcp_conn_create_v4(connp, econnp, ipha, tcph, mp); 6085 } else { 6086 err = tcp_conn_create_v6(connp, econnp, mp, tcph, ipvers, mp); 6087 } 6088 6089 if (err) 6090 goto error3; 6091 6092 eager = econnp->conn_tcp; 6093 6094 /* Inherit various TCP parameters from the listener */ 6095 eager->tcp_naglim = tcp->tcp_naglim; 6096 eager->tcp_first_timer_threshold = 6097 tcp->tcp_first_timer_threshold; 6098 eager->tcp_second_timer_threshold = 6099 tcp->tcp_second_timer_threshold; 6100 6101 eager->tcp_first_ctimer_threshold = 6102 tcp->tcp_first_ctimer_threshold; 6103 eager->tcp_second_ctimer_threshold = 6104 tcp->tcp_second_ctimer_threshold; 6105 6106 /* 6107 * Zones: tcp_adapt_ire() and tcp_send_data() both need the 6108 * zone id before the accept is completed in tcp_wput_accept(). 6109 */ 6110 econnp->conn_zoneid = connp->conn_zoneid; 6111 6112 eager->tcp_hard_binding = B_TRUE; 6113 6114 tcp_bind_hash_insert(&tcp_bind_fanout[ 6115 TCP_BIND_HASH(eager->tcp_lport)], eager, 0); 6116 6117 CL_INET_CONNECT(eager); 6118 6119 /* 6120 * No need to check for multicast destination since ip will only pass 6121 * up multicasts to those that have expressed interest 6122 * TODO: what about rejecting broadcasts? 6123 * Also check that source is not a multicast or broadcast address. 6124 */ 6125 eager->tcp_state = TCPS_SYN_RCVD; 6126 6127 6128 /* 6129 * There should be no ire in the mp as we are being called after 6130 * receiving the SYN. 6131 */ 6132 ASSERT(tcp_ire_mp(mp) == NULL); 6133 6134 /* 6135 * Adapt our mss, ttl, ... according to information provided in IRE. 6136 */ 6137 6138 if (tcp_adapt_ire(eager, NULL) == 0) { 6139 /* Undo the bind_hash_insert */ 6140 tcp_bind_hash_remove(eager); 6141 goto error3; 6142 } 6143 6144 /* Process all TCP options. */ 6145 tcp_process_options(eager, tcph); 6146 6147 /* Is the other end ECN capable? */ 6148 if (tcp_ecn_permitted >= 1 && 6149 (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 6150 eager->tcp_ecn_ok = B_TRUE; 6151 } 6152 6153 /* 6154 * listener->tcp_rq->q_hiwat should be the default window size or a 6155 * window size changed via SO_RCVBUF option. First round up the 6156 * eager's tcp_rwnd to the nearest MSS. Then find out the window 6157 * scale option value if needed. Call tcp_rwnd_set() to finish the 6158 * setting. 6159 * 6160 * Note if there is a rpipe metric associated with the remote host, 6161 * we should not inherit receive window size from listener. 6162 */ 6163 eager->tcp_rwnd = MSS_ROUNDUP( 6164 (eager->tcp_rwnd == 0 ? tcp->tcp_rq->q_hiwat : 6165 eager->tcp_rwnd), eager->tcp_mss); 6166 if (eager->tcp_snd_ws_ok) 6167 tcp_set_ws_value(eager); 6168 /* 6169 * Note that this is the only place tcp_rwnd_set() is called for 6170 * accepting a connection. We need to call it here instead of 6171 * after the 3-way handshake because we need to tell the other 6172 * side our rwnd in the SYN-ACK segment. 6173 */ 6174 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 6175 6176 /* 6177 * We eliminate the need for sockfs to send down a T_SVR4_OPTMGMT_REQ 6178 * via soaccept()->soinheritoptions() which essentially applies 6179 * all the listener options to the new STREAM. The options that we 6180 * need to take care of are: 6181 * SO_DEBUG, SO_REUSEADDR, SO_KEEPALIVE, SO_DONTROUTE, SO_BROADCAST, 6182 * SO_USELOOPBACK, SO_OOBINLINE, SO_DGRAM_ERRIND, SO_LINGER, 6183 * SO_SNDBUF, SO_RCVBUF. 6184 * 6185 * SO_RCVBUF: tcp_rwnd_set() above takes care of it. 6186 * SO_SNDBUF: Set the tcp_xmit_hiwater for the eager. When 6187 * tcp_maxpsz_set() gets called later from 6188 * tcp_accept_finish(), the option takes effect. 6189 * 6190 */ 6191 /* Set the TCP options */ 6192 eager->tcp_xmit_hiwater = tcp->tcp_xmit_hiwater; 6193 eager->tcp_dgram_errind = tcp->tcp_dgram_errind; 6194 eager->tcp_oobinline = tcp->tcp_oobinline; 6195 eager->tcp_reuseaddr = tcp->tcp_reuseaddr; 6196 eager->tcp_broadcast = tcp->tcp_broadcast; 6197 eager->tcp_useloopback = tcp->tcp_useloopback; 6198 eager->tcp_dontroute = tcp->tcp_dontroute; 6199 eager->tcp_linger = tcp->tcp_linger; 6200 eager->tcp_lingertime = tcp->tcp_lingertime; 6201 if (tcp->tcp_ka_enabled) 6202 eager->tcp_ka_enabled = 1; 6203 6204 /* Set the IP options */ 6205 econnp->conn_broadcast = connp->conn_broadcast; 6206 econnp->conn_loopback = connp->conn_loopback; 6207 econnp->conn_dontroute = connp->conn_dontroute; 6208 econnp->conn_reuseaddr = connp->conn_reuseaddr; 6209 6210 /* Put a ref on the listener for the eager. */ 6211 CONN_INC_REF(connp); 6212 mutex_enter(&tcp->tcp_eager_lock); 6213 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 6214 eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; 6215 tcp->tcp_eager_next_q0 = eager; 6216 eager->tcp_eager_prev_q0 = tcp; 6217 6218 /* Set tcp_listener before adding it to tcp_conn_fanout */ 6219 eager->tcp_listener = tcp; 6220 eager->tcp_saved_listener = tcp; 6221 6222 /* 6223 * Tag this detached tcp vector for later retrieval 6224 * by our listener client in tcp_accept(). 6225 */ 6226 eager->tcp_conn_req_seqnum = tcp->tcp_conn_req_seqnum; 6227 tcp->tcp_conn_req_cnt_q0++; 6228 if (++tcp->tcp_conn_req_seqnum == -1) { 6229 /* 6230 * -1 is "special" and defined in TPI as something 6231 * that should never be used in T_CONN_IND 6232 */ 6233 ++tcp->tcp_conn_req_seqnum; 6234 } 6235 mutex_exit(&tcp->tcp_eager_lock); 6236 6237 if (tcp->tcp_syn_defense) { 6238 /* Don't drop the SYN that comes from a good IP source */ 6239 ipaddr_t *addr_cache = (ipaddr_t *)(tcp->tcp_ip_addr_cache); 6240 if (addr_cache != NULL && eager->tcp_remote == 6241 addr_cache[IP_ADDR_CACHE_HASH(eager->tcp_remote)]) { 6242 eager->tcp_dontdrop = B_TRUE; 6243 } 6244 } 6245 6246 /* 6247 * We need to insert the eager in its own perimeter but as soon 6248 * as we do that, we expose the eager to the classifier and 6249 * should not touch any field outside the eager's perimeter. 6250 * So do all the work necessary before inserting the eager 6251 * in its own perimeter. Be optimistic that ipcl_conn_insert() 6252 * will succeed but undo everything if it fails. 6253 */ 6254 seg_seq = ABE32_TO_U32(tcph->th_seq); 6255 eager->tcp_irs = seg_seq; 6256 eager->tcp_rack = seg_seq; 6257 eager->tcp_rnxt = seg_seq + 1; 6258 U32_TO_ABE32(eager->tcp_rnxt, eager->tcp_tcph->th_ack); 6259 BUMP_MIB(&tcp_mib, tcpPassiveOpens); 6260 eager->tcp_state = TCPS_SYN_RCVD; 6261 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 6262 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 6263 if (mp1 == NULL) 6264 goto error1; 6265 mblk_setcred(mp1, tcp->tcp_cred); 6266 DB_CPID(mp1) = tcp->tcp_cpid; 6267 6268 /* 6269 * We need to start the rto timer. In normal case, we start 6270 * the timer after sending the packet on the wire (or at 6271 * least believing that packet was sent by waiting for 6272 * CALL_IP_WPUT() to return). Since this is the first packet 6273 * being sent on the wire for the eager, our initial tcp_rto 6274 * is at least tcp_rexmit_interval_min which is a fairly 6275 * large value to allow the algorithm to adjust slowly to large 6276 * fluctuations of RTT during first few transmissions. 6277 * 6278 * Starting the timer first and then sending the packet in this 6279 * case shouldn't make much difference since tcp_rexmit_interval_min 6280 * is of the order of several 100ms and starting the timer 6281 * first and then sending the packet will result in difference 6282 * of few micro seconds. 6283 * 6284 * Without this optimization, we are forced to hold the fanout 6285 * lock across the ipcl_bind_insert() and sending the packet 6286 * so that we don't race against an incoming packet (maybe RST) 6287 * for this eager. 6288 */ 6289 6290 TCP_RECORD_TRACE(eager, mp1, TCP_TRACE_SEND_PKT); 6291 TCP_TIMER_RESTART(eager, eager->tcp_rto); 6292 6293 6294 /* 6295 * Insert the eager in its own perimeter now. We are ready to deal 6296 * with any packets on eager. 6297 */ 6298 if (eager->tcp_ipversion == IPV4_VERSION) { 6299 if (ipcl_conn_insert(econnp, IPPROTO_TCP, 0, 0, 0) != 0) { 6300 goto error; 6301 } 6302 } else { 6303 if (ipcl_conn_insert_v6(econnp, IPPROTO_TCP, 0, 0, 0, 0) != 0) { 6304 goto error; 6305 } 6306 } 6307 6308 /* mark conn as fully-bound */ 6309 econnp->conn_fully_bound = B_TRUE; 6310 6311 /* Send the SYN-ACK */ 6312 tcp_send_data(eager, eager->tcp_wq, mp1); 6313 freemsg(mp); 6314 6315 return; 6316 error: 6317 (void) TCP_TIMER_CANCEL(eager, eager->tcp_timer_tid); 6318 freemsg(mp1); 6319 error1: 6320 /* Undo what we did above */ 6321 mutex_enter(&tcp->tcp_eager_lock); 6322 tcp_eager_unlink(eager); 6323 mutex_exit(&tcp->tcp_eager_lock); 6324 /* Drop eager's reference on the listener */ 6325 CONN_DEC_REF(connp); 6326 6327 /* 6328 * Delete the cached ire in conn_ire_cache and also mark 6329 * the conn as CONDEMNED 6330 */ 6331 mutex_enter(&econnp->conn_lock); 6332 econnp->conn_state_flags |= CONN_CONDEMNED; 6333 ire = econnp->conn_ire_cache; 6334 econnp->conn_ire_cache = NULL; 6335 mutex_exit(&econnp->conn_lock); 6336 if (ire != NULL) 6337 IRE_REFRELE_NOTR(ire); 6338 6339 /* 6340 * tcp_accept_comm inserts the eager to the bind_hash 6341 * we need to remove it from the hash if ipcl_conn_insert 6342 * fails. 6343 */ 6344 tcp_bind_hash_remove(eager); 6345 /* Drop the eager ref placed in tcp_open_detached */ 6346 CONN_DEC_REF(econnp); 6347 6348 /* 6349 * If a connection already exists, send the mp to that connections so 6350 * that it can be appropriately dealt with. 6351 */ 6352 if ((econnp = ipcl_classify(mp, connp->conn_zoneid)) != NULL) { 6353 if (!IPCL_IS_CONNECTED(econnp)) { 6354 /* 6355 * Something bad happened. ipcl_conn_insert() 6356 * failed because a connection already existed 6357 * in connected hash but we can't find it 6358 * anymore (someone blew it away). Just 6359 * free this message and hopefully remote 6360 * will retransmit at which time the SYN can be 6361 * treated as a new connection or dealth with 6362 * a TH_RST if a connection already exists. 6363 */ 6364 freemsg(mp); 6365 } else { 6366 squeue_fill(econnp->conn_sqp, mp, tcp_input, 6367 econnp, SQTAG_TCP_CONN_REQ); 6368 } 6369 } else { 6370 /* Nobody wants this packet */ 6371 freemsg(mp); 6372 } 6373 return; 6374 error2: 6375 freemsg(mp); 6376 return; 6377 error3: 6378 CONN_DEC_REF(econnp); 6379 freemsg(mp); 6380 } 6381 6382 /* 6383 * In an ideal case of vertical partition in NUMA architecture, its 6384 * beneficial to have the listener and all the incoming connections 6385 * tied to the same squeue. The other constraint is that incoming 6386 * connections should be tied to the squeue attached to interrupted 6387 * CPU for obvious locality reason so this leaves the listener to 6388 * be tied to the same squeue. Our only problem is that when listener 6389 * is binding, the CPU that will get interrupted by the NIC whose 6390 * IP address the listener is binding to is not even known. So 6391 * the code below allows us to change that binding at the time the 6392 * CPU is interrupted by virtue of incoming connection's squeue. 6393 * 6394 * This is usefull only in case of a listener bound to a specific IP 6395 * address. For other kind of listeners, they get bound the 6396 * very first time and there is no attempt to rebind them. 6397 */ 6398 void 6399 tcp_conn_request_unbound(void *arg, mblk_t *mp, void *arg2) 6400 { 6401 conn_t *connp = (conn_t *)arg; 6402 squeue_t *sqp = (squeue_t *)arg2; 6403 squeue_t *new_sqp; 6404 uint32_t conn_flags; 6405 6406 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 6407 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 6408 } else { 6409 goto done; 6410 } 6411 6412 if (connp->conn_fanout == NULL) 6413 goto done; 6414 6415 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 6416 mutex_enter(&connp->conn_fanout->connf_lock); 6417 mutex_enter(&connp->conn_lock); 6418 /* 6419 * No one from read or write side can access us now 6420 * except for already queued packets on this squeue. 6421 * But since we haven't changed the squeue yet, they 6422 * can't execute. If they are processed after we have 6423 * changed the squeue, they are sent back to the 6424 * correct squeue down below. 6425 */ 6426 if (connp->conn_sqp != new_sqp) { 6427 while (connp->conn_sqp != new_sqp) 6428 (void) casptr(&connp->conn_sqp, sqp, new_sqp); 6429 } 6430 6431 do { 6432 conn_flags = connp->conn_flags; 6433 conn_flags |= IPCL_FULLY_BOUND; 6434 (void) cas32(&connp->conn_flags, connp->conn_flags, 6435 conn_flags); 6436 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 6437 6438 mutex_exit(&connp->conn_fanout->connf_lock); 6439 mutex_exit(&connp->conn_lock); 6440 } 6441 6442 done: 6443 if (connp->conn_sqp != sqp) { 6444 CONN_INC_REF(connp); 6445 squeue_fill(connp->conn_sqp, mp, 6446 connp->conn_recv, connp, SQTAG_TCP_CONN_REQ_UNBOUND); 6447 } else { 6448 tcp_conn_request(connp, mp, sqp); 6449 } 6450 } 6451 6452 /* 6453 * Successful connect request processing begins when our client passes 6454 * a T_CONN_REQ message into tcp_wput() and ends when tcp_rput() passes 6455 * our T_OK_ACK reply message upstream. The control flow looks like this: 6456 * upstream -> tcp_wput() -> tcp_wput_proto() -> tcp_connect() -> IP 6457 * upstream <- tcp_rput() <- IP 6458 * After various error checks are completed, tcp_connect() lays 6459 * the target address and port into the composite header template, 6460 * preallocates the T_OK_ACK reply message, construct a full 12 byte bind 6461 * request followed by an IRE request, and passes the three mblk message 6462 * down to IP looking like this: 6463 * O_T_BIND_REQ for IP --> IRE req --> T_OK_ACK for our client 6464 * Processing continues in tcp_rput() when we receive the following message: 6465 * T_BIND_ACK from IP --> IRE ack --> T_OK_ACK for our client 6466 * After consuming the first two mblks, tcp_rput() calls tcp_timer(), 6467 * to fire off the connection request, and then passes the T_OK_ACK mblk 6468 * upstream that we filled in below. There are, of course, numerous 6469 * error conditions along the way which truncate the processing described 6470 * above. 6471 */ 6472 static void 6473 tcp_connect(tcp_t *tcp, mblk_t *mp) 6474 { 6475 sin_t *sin; 6476 sin6_t *sin6; 6477 in_port_t lport; 6478 queue_t *q = tcp->tcp_wq; 6479 struct T_conn_req *tcr; 6480 ipaddr_t *dstaddrp; 6481 in_port_t dstport; 6482 uint_t srcid; 6483 6484 tcr = (struct T_conn_req *)mp->b_rptr; 6485 6486 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 6487 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 6488 tcp_err_ack(tcp, mp, TPROTO, 0); 6489 return; 6490 } 6491 6492 /* 6493 * Determine packet type based on type of address passed in 6494 * the request should contain an IPv4 or IPv6 address. 6495 * Make sure that address family matches the type of 6496 * family of the the address passed down 6497 */ 6498 switch (tcr->DEST_length) { 6499 default: 6500 tcp_err_ack(tcp, mp, TBADADDR, 0); 6501 return; 6502 6503 case (sizeof (sin_t) - sizeof (sin->sin_zero)): { 6504 /* 6505 * XXX: The check for valid DEST_length was not there 6506 * in earlier releases and some buggy 6507 * TLI apps (e.g Sybase) got away with not feeding 6508 * in sin_zero part of address. 6509 * We allow that bug to keep those buggy apps humming. 6510 * Test suites require the check on DEST_length. 6511 * We construct a new mblk with valid DEST_length 6512 * free the original so the rest of the code does 6513 * not have to keep track of this special shorter 6514 * length address case. 6515 */ 6516 mblk_t *nmp; 6517 struct T_conn_req *ntcr; 6518 sin_t *nsin; 6519 6520 nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) + 6521 tcr->OPT_length, BPRI_HI); 6522 if (nmp == NULL) { 6523 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 6524 return; 6525 } 6526 ntcr = (struct T_conn_req *)nmp->b_rptr; 6527 bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */ 6528 ntcr->PRIM_type = T_CONN_REQ; 6529 ntcr->DEST_length = sizeof (sin_t); 6530 ntcr->DEST_offset = sizeof (struct T_conn_req); 6531 6532 nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset); 6533 *nsin = sin_null; 6534 /* Get pointer to shorter address to copy from original mp */ 6535 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6536 tcr->DEST_length); /* extract DEST_length worth of sin_t */ 6537 if (sin == NULL || !OK_32PTR((char *)sin)) { 6538 freemsg(nmp); 6539 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6540 return; 6541 } 6542 nsin->sin_family = sin->sin_family; 6543 nsin->sin_port = sin->sin_port; 6544 nsin->sin_addr = sin->sin_addr; 6545 /* Note:nsin->sin_zero zero-fill with sin_null assign above */ 6546 nmp->b_wptr = (uchar_t *)&nsin[1]; 6547 if (tcr->OPT_length != 0) { 6548 ntcr->OPT_length = tcr->OPT_length; 6549 ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr; 6550 bcopy((uchar_t *)tcr + tcr->OPT_offset, 6551 (uchar_t *)ntcr + ntcr->OPT_offset, 6552 tcr->OPT_length); 6553 nmp->b_wptr += tcr->OPT_length; 6554 } 6555 freemsg(mp); /* original mp freed */ 6556 mp = nmp; /* re-initialize original variables */ 6557 tcr = ntcr; 6558 } 6559 /* FALLTHRU */ 6560 6561 case sizeof (sin_t): 6562 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6563 sizeof (sin_t)); 6564 if (sin == NULL || !OK_32PTR((char *)sin)) { 6565 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6566 return; 6567 } 6568 if (tcp->tcp_family != AF_INET || 6569 sin->sin_family != AF_INET) { 6570 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6571 return; 6572 } 6573 if (sin->sin_port == 0) { 6574 tcp_err_ack(tcp, mp, TBADADDR, 0); 6575 return; 6576 } 6577 if (tcp->tcp_connp && tcp->tcp_connp->conn_ipv6_v6only) { 6578 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6579 return; 6580 } 6581 6582 break; 6583 6584 case sizeof (sin6_t): 6585 sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset, 6586 sizeof (sin6_t)); 6587 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 6588 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6589 return; 6590 } 6591 if (tcp->tcp_family != AF_INET6 || 6592 sin6->sin6_family != AF_INET6) { 6593 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6594 return; 6595 } 6596 if (sin6->sin6_port == 0) { 6597 tcp_err_ack(tcp, mp, TBADADDR, 0); 6598 return; 6599 } 6600 break; 6601 } 6602 /* 6603 * TODO: If someone in TCPS_TIME_WAIT has this dst/port we 6604 * should key on their sequence number and cut them loose. 6605 */ 6606 6607 /* 6608 * If options passed in, feed it for verification and handling 6609 */ 6610 if (tcr->OPT_length != 0) { 6611 mblk_t *ok_mp; 6612 mblk_t *discon_mp; 6613 mblk_t *conn_opts_mp; 6614 int t_error, sys_error, do_disconnect; 6615 6616 conn_opts_mp = NULL; 6617 6618 if (tcp_conprim_opt_process(tcp, mp, 6619 &do_disconnect, &t_error, &sys_error) < 0) { 6620 if (do_disconnect) { 6621 ASSERT(t_error == 0 && sys_error == 0); 6622 discon_mp = mi_tpi_discon_ind(NULL, 6623 ECONNREFUSED, 0); 6624 if (!discon_mp) { 6625 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6626 TSYSERR, ENOMEM); 6627 return; 6628 } 6629 ok_mp = mi_tpi_ok_ack_alloc(mp); 6630 if (!ok_mp) { 6631 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6632 TSYSERR, ENOMEM); 6633 return; 6634 } 6635 qreply(q, ok_mp); 6636 qreply(q, discon_mp); /* no flush! */ 6637 } else { 6638 ASSERT(t_error != 0); 6639 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error, 6640 sys_error); 6641 } 6642 return; 6643 } 6644 /* 6645 * Success in setting options, the mp option buffer represented 6646 * by OPT_length/offset has been potentially modified and 6647 * contains results of option processing. We copy it in 6648 * another mp to save it for potentially influencing returning 6649 * it in T_CONN_CONN. 6650 */ 6651 if (tcr->OPT_length != 0) { /* there are resulting options */ 6652 conn_opts_mp = copyb(mp); 6653 if (!conn_opts_mp) { 6654 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6655 TSYSERR, ENOMEM); 6656 return; 6657 } 6658 ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL); 6659 tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp; 6660 /* 6661 * Note: 6662 * These resulting option negotiation can include any 6663 * end-to-end negotiation options but there no such 6664 * thing (yet?) in our TCP/IP. 6665 */ 6666 } 6667 } 6668 6669 /* 6670 * If we're connecting to an IPv4-mapped IPv6 address, we need to 6671 * make sure that the template IP header in the tcp structure is an 6672 * IPv4 header, and that the tcp_ipversion is IPV4_VERSION. We 6673 * need to this before we call tcp_bindi() so that the port lookup 6674 * code will look for ports in the correct port space (IPv4 and 6675 * IPv6 have separate port spaces). 6676 */ 6677 if (tcp->tcp_family == AF_INET6 && tcp->tcp_ipversion == IPV6_VERSION && 6678 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6679 int err = 0; 6680 6681 err = tcp_header_init_ipv4(tcp); 6682 if (err != 0) { 6683 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6684 goto connect_failed; 6685 } 6686 if (tcp->tcp_lport != 0) 6687 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 6688 } 6689 6690 switch (tcp->tcp_state) { 6691 case TCPS_IDLE: 6692 /* 6693 * We support a quick connect capability here, allowing 6694 * clients to transition directly from IDLE to SYN_SENT 6695 * tcp_bindi will pick an unused port, insert the connection 6696 * in the bind hash and transition to BOUND state. 6697 */ 6698 lport = tcp_update_next_port(tcp_next_port_to_try, B_TRUE); 6699 lport = tcp_bindi(tcp, lport, &ipv6_all_zeros, 0, 0, 0); 6700 if (lport == 0) { 6701 mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); 6702 break; 6703 } 6704 /* FALLTHRU */ 6705 6706 case TCPS_BOUND: 6707 case TCPS_LISTEN: 6708 if (tcp->tcp_family == AF_INET6) { 6709 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6710 tcp_connect_ipv6(tcp, mp, 6711 &sin6->sin6_addr, 6712 sin6->sin6_port, sin6->sin6_flowinfo, 6713 sin6->__sin6_src_id, sin6->sin6_scope_id); 6714 return; 6715 } 6716 /* 6717 * Destination adress is mapped IPv6 address. 6718 * Source bound address should be unspecified or 6719 * IPv6 mapped address as well. 6720 */ 6721 if (!IN6_IS_ADDR_UNSPECIFIED( 6722 &tcp->tcp_bound_source_v6) && 6723 !IN6_IS_ADDR_V4MAPPED(&tcp->tcp_bound_source_v6)) { 6724 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, 6725 EADDRNOTAVAIL); 6726 break; 6727 } 6728 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 6729 dstport = sin6->sin6_port; 6730 srcid = sin6->__sin6_src_id; 6731 } else { 6732 dstaddrp = &sin->sin_addr.s_addr; 6733 dstport = sin->sin_port; 6734 srcid = 0; 6735 } 6736 6737 tcp_connect_ipv4(tcp, mp, dstaddrp, dstport, srcid); 6738 return; 6739 default: 6740 mp = mi_tpi_err_ack_alloc(mp, TOUTSTATE, 0); 6741 break; 6742 } 6743 /* 6744 * Note: Code below is the "failure" case 6745 */ 6746 /* return error ack and blow away saved option results if any */ 6747 connect_failed: 6748 if (mp != NULL) 6749 putnext(tcp->tcp_rq, mp); 6750 else { 6751 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6752 TSYSERR, ENOMEM); 6753 } 6754 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6755 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6756 } 6757 6758 /* 6759 * Handle connect to IPv4 destinations, including connections for AF_INET6 6760 * sockets connecting to IPv4 mapped IPv6 destinations. 6761 */ 6762 static void 6763 tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport, 6764 uint_t srcid) 6765 { 6766 tcph_t *tcph; 6767 mblk_t *mp1; 6768 ipaddr_t dstaddr = *dstaddrp; 6769 int32_t oldstate; 6770 6771 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 6772 6773 /* Check for attempt to connect to INADDR_ANY */ 6774 if (dstaddr == INADDR_ANY) { 6775 /* 6776 * SunOS 4.x and 4.3 BSD allow an application 6777 * to connect a TCP socket to INADDR_ANY. 6778 * When they do this, the kernel picks the 6779 * address of one interface and uses it 6780 * instead. The kernel usually ends up 6781 * picking the address of the loopback 6782 * interface. This is an undocumented feature. 6783 * However, we provide the same thing here 6784 * in order to have source and binary 6785 * compatibility with SunOS 4.x. 6786 * Update the T_CONN_REQ (sin/sin6) since it is used to 6787 * generate the T_CONN_CON. 6788 */ 6789 dstaddr = htonl(INADDR_LOOPBACK); 6790 *dstaddrp = dstaddr; 6791 } 6792 6793 /* Handle __sin6_src_id if socket not bound to an IP address */ 6794 if (srcid != 0 && tcp->tcp_ipha->ipha_src == INADDR_ANY) { 6795 ip_srcid_find_id(srcid, &tcp->tcp_ip_src_v6, 6796 tcp->tcp_connp->conn_zoneid); 6797 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_ip_src_v6, 6798 tcp->tcp_ipha->ipha_src); 6799 } 6800 6801 /* 6802 * Don't let an endpoint connect to itself. Note that 6803 * the test here does not catch the case where the 6804 * source IP addr was left unspecified by the user. In 6805 * this case, the source addr is set in tcp_adapt_ire() 6806 * using the reply to the T_BIND message that we send 6807 * down to IP here and the check is repeated in tcp_rput_other. 6808 */ 6809 if (dstaddr == tcp->tcp_ipha->ipha_src && 6810 dstport == tcp->tcp_lport) { 6811 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6812 goto failed; 6813 } 6814 6815 tcp->tcp_ipha->ipha_dst = dstaddr; 6816 IN6_IPADDR_TO_V4MAPPED(dstaddr, &tcp->tcp_remote_v6); 6817 6818 /* 6819 * Massage a source route if any putting the first hop 6820 * in iph_dst. Compute a starting value for the checksum which 6821 * takes into account that the original iph_dst should be 6822 * included in the checksum but that ip will include the 6823 * first hop in the source route in the tcp checksum. 6824 */ 6825 tcp->tcp_sum = ip_massage_options(tcp->tcp_ipha); 6826 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6827 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 6828 (tcp->tcp_ipha->ipha_dst & 0xffff)); 6829 if ((int)tcp->tcp_sum < 0) 6830 tcp->tcp_sum--; 6831 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6832 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 6833 (tcp->tcp_sum >> 16)); 6834 tcph = tcp->tcp_tcph; 6835 *(uint16_t *)tcph->th_fport = dstport; 6836 tcp->tcp_fport = dstport; 6837 6838 oldstate = tcp->tcp_state; 6839 tcp->tcp_state = TCPS_SYN_SENT; 6840 6841 /* 6842 * TODO: allow data with connect requests 6843 * by unlinking M_DATA trailers here and 6844 * linking them in behind the T_OK_ACK mblk. 6845 * The tcp_rput() bind ack handler would then 6846 * feed them to tcp_wput_data() rather than call 6847 * tcp_timer(). 6848 */ 6849 mp = mi_tpi_ok_ack_alloc(mp); 6850 if (!mp) { 6851 tcp->tcp_state = oldstate; 6852 goto failed; 6853 } 6854 if (tcp->tcp_family == AF_INET) { 6855 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6856 sizeof (ipa_conn_t)); 6857 } else { 6858 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6859 sizeof (ipa6_conn_t)); 6860 } 6861 if (mp1) { 6862 /* Hang onto the T_OK_ACK for later. */ 6863 linkb(mp1, mp); 6864 if (tcp->tcp_family == AF_INET) 6865 mp1 = ip_bind_v4(tcp->tcp_wq, mp1, tcp->tcp_connp); 6866 else { 6867 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 6868 &tcp->tcp_sticky_ipp); 6869 } 6870 BUMP_MIB(&tcp_mib, tcpActiveOpens); 6871 tcp->tcp_active_open = 1; 6872 /* 6873 * If the bind cannot complete immediately 6874 * IP will arrange to call tcp_rput_other 6875 * when the bind completes. 6876 */ 6877 if (mp1 != NULL) 6878 tcp_rput_other(tcp, mp1); 6879 return; 6880 } 6881 /* Error case */ 6882 tcp->tcp_state = oldstate; 6883 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6884 6885 failed: 6886 /* return error ack and blow away saved option results if any */ 6887 if (mp != NULL) 6888 putnext(tcp->tcp_rq, mp); 6889 else { 6890 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6891 TSYSERR, ENOMEM); 6892 } 6893 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6894 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6895 6896 } 6897 6898 /* 6899 * Handle connect to IPv6 destinations. 6900 */ 6901 static void 6902 tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 6903 in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 6904 { 6905 tcph_t *tcph; 6906 mblk_t *mp1; 6907 ip6_rthdr_t *rth; 6908 int32_t oldstate; 6909 6910 ASSERT(tcp->tcp_family == AF_INET6); 6911 6912 /* 6913 * If we're here, it means that the destination address is a native 6914 * IPv6 address. Return an error if tcp_ipversion is not IPv6. A 6915 * reason why it might not be IPv6 is if the socket was bound to an 6916 * IPv4-mapped IPv6 address. 6917 */ 6918 if (tcp->tcp_ipversion != IPV6_VERSION) { 6919 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6920 goto failed; 6921 } 6922 6923 /* 6924 * Interpret a zero destination to mean loopback. 6925 * Update the T_CONN_REQ (sin/sin6) since it is used to 6926 * generate the T_CONN_CON. 6927 */ 6928 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) { 6929 *dstaddrp = ipv6_loopback; 6930 } 6931 6932 /* Handle __sin6_src_id if socket not bound to an IP address */ 6933 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 6934 ip_srcid_find_id(srcid, &tcp->tcp_ip6h->ip6_src, 6935 tcp->tcp_connp->conn_zoneid); 6936 tcp->tcp_ip_src_v6 = tcp->tcp_ip6h->ip6_src; 6937 } 6938 6939 /* 6940 * Take care of the scope_id now and add ip6i_t 6941 * if ip6i_t is not already allocated through TCP 6942 * sticky options. At this point tcp_ip6h does not 6943 * have dst info, thus use dstaddrp. 6944 */ 6945 if (scope_id != 0 && 6946 IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 6947 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 6948 ip6i_t *ip6i; 6949 6950 ipp->ipp_ifindex = scope_id; 6951 ip6i = (ip6i_t *)tcp->tcp_iphc; 6952 6953 if ((ipp->ipp_fields & IPPF_HAS_IP6I) && 6954 ip6i != NULL && (ip6i->ip6i_nxt == IPPROTO_RAW)) { 6955 /* Already allocated */ 6956 ip6i->ip6i_flags |= IP6I_IFINDEX; 6957 ip6i->ip6i_ifindex = ipp->ipp_ifindex; 6958 ipp->ipp_fields |= IPPF_SCOPE_ID; 6959 } else { 6960 int reterr; 6961 6962 ipp->ipp_fields |= IPPF_SCOPE_ID; 6963 if (ipp->ipp_fields & IPPF_HAS_IP6I) 6964 ip2dbg(("tcp_connect_v6: SCOPE_ID set\n")); 6965 reterr = tcp_build_hdrs(tcp->tcp_rq, tcp); 6966 if (reterr != 0) 6967 goto failed; 6968 ip1dbg(("tcp_connect_ipv6: tcp_bld_hdrs returned\n")); 6969 } 6970 } 6971 6972 /* 6973 * Don't let an endpoint connect to itself. Note that 6974 * the test here does not catch the case where the 6975 * source IP addr was left unspecified by the user. In 6976 * this case, the source addr is set in tcp_adapt_ire() 6977 * using the reply to the T_BIND message that we send 6978 * down to IP here and the check is repeated in tcp_rput_other. 6979 */ 6980 if (IN6_ARE_ADDR_EQUAL(dstaddrp, &tcp->tcp_ip6h->ip6_src) && 6981 (dstport == tcp->tcp_lport)) { 6982 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6983 goto failed; 6984 } 6985 6986 tcp->tcp_ip6h->ip6_dst = *dstaddrp; 6987 tcp->tcp_remote_v6 = *dstaddrp; 6988 tcp->tcp_ip6h->ip6_vcf = 6989 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 6990 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 6991 6992 6993 /* 6994 * Massage a routing header (if present) putting the first hop 6995 * in ip6_dst. Compute a starting value for the checksum which 6996 * takes into account that the original ip6_dst should be 6997 * included in the checksum but that ip will include the 6998 * first hop in the source route in the tcp checksum. 6999 */ 7000 rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph); 7001 if (rth != NULL) { 7002 7003 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth); 7004 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 7005 (tcp->tcp_sum >> 16)); 7006 } else { 7007 tcp->tcp_sum = 0; 7008 } 7009 7010 tcph = tcp->tcp_tcph; 7011 *(uint16_t *)tcph->th_fport = dstport; 7012 tcp->tcp_fport = dstport; 7013 7014 oldstate = tcp->tcp_state; 7015 tcp->tcp_state = TCPS_SYN_SENT; 7016 7017 /* 7018 * TODO: allow data with connect requests 7019 * by unlinking M_DATA trailers here and 7020 * linking them in behind the T_OK_ACK mblk. 7021 * The tcp_rput() bind ack handler would then 7022 * feed them to tcp_wput_data() rather than call 7023 * tcp_timer(). 7024 */ 7025 mp = mi_tpi_ok_ack_alloc(mp); 7026 if (!mp) { 7027 tcp->tcp_state = oldstate; 7028 goto failed; 7029 } 7030 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t)); 7031 if (mp1) { 7032 /* Hang onto the T_OK_ACK for later. */ 7033 linkb(mp1, mp); 7034 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 7035 &tcp->tcp_sticky_ipp); 7036 BUMP_MIB(&tcp_mib, tcpActiveOpens); 7037 tcp->tcp_active_open = 1; 7038 /* ip_bind_v6() may return ACK or ERROR */ 7039 if (mp1 != NULL) 7040 tcp_rput_other(tcp, mp1); 7041 return; 7042 } 7043 /* Error case */ 7044 tcp->tcp_state = oldstate; 7045 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 7046 7047 failed: 7048 /* return error ack and blow away saved option results if any */ 7049 if (mp != NULL) 7050 putnext(tcp->tcp_rq, mp); 7051 else { 7052 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 7053 TSYSERR, ENOMEM); 7054 } 7055 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 7056 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 7057 } 7058 7059 /* 7060 * We need a stream q for detached closing tcp connections 7061 * to use. Our client hereby indicates that this q is the 7062 * one to use. 7063 */ 7064 static void 7065 tcp_def_q_set(tcp_t *tcp, mblk_t *mp) 7066 { 7067 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 7068 queue_t *q = tcp->tcp_wq; 7069 7070 mp->b_datap->db_type = M_IOCACK; 7071 iocp->ioc_count = 0; 7072 mutex_enter(&tcp_g_q_lock); 7073 if (tcp_g_q != NULL) { 7074 mutex_exit(&tcp_g_q_lock); 7075 iocp->ioc_error = EALREADY; 7076 } else { 7077 mblk_t *mp1; 7078 7079 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 0); 7080 if (mp1 == NULL) { 7081 mutex_exit(&tcp_g_q_lock); 7082 iocp->ioc_error = ENOMEM; 7083 } else { 7084 tcp_g_q = tcp->tcp_rq; 7085 mutex_exit(&tcp_g_q_lock); 7086 iocp->ioc_error = 0; 7087 iocp->ioc_rval = 0; 7088 /* 7089 * We are passing tcp_sticky_ipp as NULL 7090 * as it is not useful for tcp_default queue 7091 */ 7092 mp1 = ip_bind_v6(q, mp1, tcp->tcp_connp, NULL); 7093 if (mp1 != NULL) 7094 tcp_rput_other(tcp, mp1); 7095 } 7096 } 7097 qreply(q, mp); 7098 } 7099 7100 /* 7101 * Our client hereby directs us to reject the connection request 7102 * that tcp_conn_request() marked with 'seqnum'. Rejection consists 7103 * of sending the appropriate RST, not an ICMP error. 7104 */ 7105 static void 7106 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 7107 { 7108 tcp_t *ltcp = NULL; 7109 t_scalar_t seqnum; 7110 conn_t *connp; 7111 7112 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 7113 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 7114 tcp_err_ack(tcp, mp, TPROTO, 0); 7115 return; 7116 } 7117 7118 /* 7119 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 7120 * when the stream is in BOUND state. Do not send a reset, 7121 * since the destination IP address is not valid, and it can 7122 * be the initialized value of all zeros (broadcast address). 7123 * 7124 * If TCP has sent down a bind request to IP and has not 7125 * received the reply, reject the request. Otherwise, TCP 7126 * will be confused. 7127 */ 7128 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) { 7129 if (tcp->tcp_debug) { 7130 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 7131 "tcp_disconnect: bad state, %d", tcp->tcp_state); 7132 } 7133 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 7134 return; 7135 } 7136 7137 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 7138 7139 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 7140 7141 /* 7142 * According to TPI, for non-listeners, ignore seqnum 7143 * and disconnect. 7144 * Following interpretation of -1 seqnum is historical 7145 * and implied TPI ? (TPI only states that for T_CONN_IND, 7146 * a valid seqnum should not be -1). 7147 * 7148 * -1 means disconnect everything 7149 * regardless even on a listener. 7150 */ 7151 7152 int old_state = tcp->tcp_state; 7153 7154 /* 7155 * The connection can't be on the tcp_time_wait_head list 7156 * since it is not detached. 7157 */ 7158 ASSERT(tcp->tcp_time_wait_next == NULL); 7159 ASSERT(tcp->tcp_time_wait_prev == NULL); 7160 ASSERT(tcp->tcp_time_wait_expire == 0); 7161 ltcp = NULL; 7162 /* 7163 * If it used to be a listener, check to make sure no one else 7164 * has taken the port before switching back to LISTEN state. 7165 */ 7166 if (tcp->tcp_ipversion == IPV4_VERSION) { 7167 connp = ipcl_lookup_listener_v4(tcp->tcp_lport, 7168 tcp->tcp_ipha->ipha_src, 7169 tcp->tcp_connp->conn_zoneid); 7170 if (connp != NULL) 7171 ltcp = connp->conn_tcp; 7172 } else { 7173 /* Allow tcp_bound_if listeners? */ 7174 connp = ipcl_lookup_listener_v6(tcp->tcp_lport, 7175 &tcp->tcp_ip6h->ip6_src, 0, 7176 tcp->tcp_connp->conn_zoneid); 7177 if (connp != NULL) 7178 ltcp = connp->conn_tcp; 7179 } 7180 if (tcp->tcp_conn_req_max && ltcp == NULL) { 7181 tcp->tcp_state = TCPS_LISTEN; 7182 } else if (old_state > TCPS_BOUND) { 7183 tcp->tcp_conn_req_max = 0; 7184 tcp->tcp_state = TCPS_BOUND; 7185 } 7186 if (ltcp != NULL) 7187 CONN_DEC_REF(ltcp->tcp_connp); 7188 if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) { 7189 BUMP_MIB(&tcp_mib, tcpAttemptFails); 7190 } else if (old_state == TCPS_ESTABLISHED || 7191 old_state == TCPS_CLOSE_WAIT) { 7192 BUMP_MIB(&tcp_mib, tcpEstabResets); 7193 } 7194 7195 if (tcp->tcp_fused) 7196 tcp_unfuse(tcp); 7197 7198 mutex_enter(&tcp->tcp_eager_lock); 7199 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 7200 (tcp->tcp_conn_req_cnt_q != 0)) { 7201 tcp_eager_cleanup(tcp, 0); 7202 } 7203 mutex_exit(&tcp->tcp_eager_lock); 7204 7205 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 7206 tcp->tcp_rnxt, TH_RST | TH_ACK); 7207 7208 tcp_reinit(tcp); 7209 7210 if (old_state >= TCPS_ESTABLISHED) { 7211 /* Send M_FLUSH according to TPI */ 7212 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 7213 } 7214 mp = mi_tpi_ok_ack_alloc(mp); 7215 if (mp) 7216 putnext(tcp->tcp_rq, mp); 7217 return; 7218 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 7219 tcp_err_ack(tcp, mp, TBADSEQ, 0); 7220 return; 7221 } 7222 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 7223 /* Send M_FLUSH according to TPI */ 7224 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 7225 } 7226 mp = mi_tpi_ok_ack_alloc(mp); 7227 if (mp) 7228 putnext(tcp->tcp_rq, mp); 7229 } 7230 7231 /* 7232 * Diagnostic routine used to return a string associated with the tcp state. 7233 * Note that if the caller does not supply a buffer, it will use an internal 7234 * static string. This means that if multiple threads call this function at 7235 * the same time, output can be corrupted... Note also that this function 7236 * does not check the size of the supplied buffer. The caller has to make 7237 * sure that it is big enough. 7238 */ 7239 static char * 7240 tcp_display(tcp_t *tcp, char *sup_buf, char format) 7241 { 7242 char buf1[30]; 7243 static char priv_buf[INET6_ADDRSTRLEN * 2 + 80]; 7244 char *buf; 7245 char *cp; 7246 in6_addr_t local, remote; 7247 char local_addrbuf[INET6_ADDRSTRLEN]; 7248 char remote_addrbuf[INET6_ADDRSTRLEN]; 7249 7250 if (sup_buf != NULL) 7251 buf = sup_buf; 7252 else 7253 buf = priv_buf; 7254 7255 if (tcp == NULL) 7256 return ("NULL_TCP"); 7257 switch (tcp->tcp_state) { 7258 case TCPS_CLOSED: 7259 cp = "TCP_CLOSED"; 7260 break; 7261 case TCPS_IDLE: 7262 cp = "TCP_IDLE"; 7263 break; 7264 case TCPS_BOUND: 7265 cp = "TCP_BOUND"; 7266 break; 7267 case TCPS_LISTEN: 7268 cp = "TCP_LISTEN"; 7269 break; 7270 case TCPS_SYN_SENT: 7271 cp = "TCP_SYN_SENT"; 7272 break; 7273 case TCPS_SYN_RCVD: 7274 cp = "TCP_SYN_RCVD"; 7275 break; 7276 case TCPS_ESTABLISHED: 7277 cp = "TCP_ESTABLISHED"; 7278 break; 7279 case TCPS_CLOSE_WAIT: 7280 cp = "TCP_CLOSE_WAIT"; 7281 break; 7282 case TCPS_FIN_WAIT_1: 7283 cp = "TCP_FIN_WAIT_1"; 7284 break; 7285 case TCPS_CLOSING: 7286 cp = "TCP_CLOSING"; 7287 break; 7288 case TCPS_LAST_ACK: 7289 cp = "TCP_LAST_ACK"; 7290 break; 7291 case TCPS_FIN_WAIT_2: 7292 cp = "TCP_FIN_WAIT_2"; 7293 break; 7294 case TCPS_TIME_WAIT: 7295 cp = "TCP_TIME_WAIT"; 7296 break; 7297 default: 7298 (void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state); 7299 cp = buf1; 7300 break; 7301 } 7302 switch (format) { 7303 case DISP_ADDR_AND_PORT: 7304 if (tcp->tcp_ipversion == IPV4_VERSION) { 7305 /* 7306 * Note that we use the remote address in the tcp_b 7307 * structure. This means that it will print out 7308 * the real destination address, not the next hop's 7309 * address if source routing is used. 7310 */ 7311 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ip_src, &local); 7312 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &remote); 7313 7314 } else { 7315 local = tcp->tcp_ip_src_v6; 7316 remote = tcp->tcp_remote_v6; 7317 } 7318 (void) inet_ntop(AF_INET6, &local, local_addrbuf, 7319 sizeof (local_addrbuf)); 7320 (void) inet_ntop(AF_INET6, &remote, remote_addrbuf, 7321 sizeof (remote_addrbuf)); 7322 (void) mi_sprintf(buf, "[%s.%u, %s.%u] %s", 7323 local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf, 7324 ntohs(tcp->tcp_fport), cp); 7325 break; 7326 case DISP_PORT_ONLY: 7327 default: 7328 (void) mi_sprintf(buf, "[%u, %u] %s", 7329 ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp); 7330 break; 7331 } 7332 7333 return (buf); 7334 } 7335 7336 /* 7337 * Called via squeue to get on to eager's perimeter to send a 7338 * TH_RST. The listener wants the eager to disappear either 7339 * by means of tcp_eager_blowoff() or tcp_eager_cleanup() 7340 * being called. 7341 */ 7342 /* ARGSUSED */ 7343 void 7344 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2) 7345 { 7346 conn_t *econnp = (conn_t *)arg; 7347 tcp_t *eager = econnp->conn_tcp; 7348 tcp_t *listener = eager->tcp_listener; 7349 7350 /* 7351 * We could be called because listener is closing. Since 7352 * the eager is using listener's queue's, its not safe. 7353 * Better use the default queue just to send the TH_RST 7354 * out. 7355 */ 7356 eager->tcp_rq = tcp_g_q; 7357 eager->tcp_wq = WR(tcp_g_q); 7358 7359 if (eager->tcp_state > TCPS_LISTEN) { 7360 tcp_xmit_ctl("tcp_eager_kill, can't wait", 7361 eager, eager->tcp_snxt, 0, TH_RST); 7362 } 7363 7364 /* We are here because listener wants this eager gone */ 7365 if (listener != NULL) { 7366 mutex_enter(&listener->tcp_eager_lock); 7367 tcp_eager_unlink(eager); 7368 if (eager->tcp_conn.tcp_eager_conn_ind == NULL) { 7369 /* 7370 * The eager has sent a conn_ind up to the 7371 * listener but listener decides to close 7372 * instead. We need to drop the extra ref 7373 * placed on eager in tcp_rput_data() before 7374 * sending the conn_ind to listener. 7375 */ 7376 CONN_DEC_REF(econnp); 7377 } 7378 mutex_exit(&listener->tcp_eager_lock); 7379 CONN_DEC_REF(listener->tcp_connp); 7380 } 7381 7382 if (eager->tcp_state > TCPS_BOUND) 7383 tcp_close_detached(eager); 7384 } 7385 7386 /* 7387 * Reset any eager connection hanging off this listener marked 7388 * with 'seqnum' and then reclaim it's resources. 7389 */ 7390 static boolean_t 7391 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 7392 { 7393 tcp_t *eager; 7394 mblk_t *mp; 7395 7396 TCP_STAT(tcp_eager_blowoff_calls); 7397 eager = listener; 7398 mutex_enter(&listener->tcp_eager_lock); 7399 do { 7400 eager = eager->tcp_eager_next_q; 7401 if (eager == NULL) { 7402 mutex_exit(&listener->tcp_eager_lock); 7403 return (B_FALSE); 7404 } 7405 } while (eager->tcp_conn_req_seqnum != seqnum); 7406 CONN_INC_REF(eager->tcp_connp); 7407 mutex_exit(&listener->tcp_eager_lock); 7408 mp = &eager->tcp_closemp; 7409 squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 7410 eager->tcp_connp, SQTAG_TCP_EAGER_BLOWOFF); 7411 return (B_TRUE); 7412 } 7413 7414 /* 7415 * Reset any eager connection hanging off this listener 7416 * and then reclaim it's resources. 7417 */ 7418 static void 7419 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 7420 { 7421 tcp_t *eager; 7422 mblk_t *mp; 7423 7424 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7425 7426 if (!q0_only) { 7427 /* First cleanup q */ 7428 TCP_STAT(tcp_eager_blowoff_q); 7429 eager = listener->tcp_eager_next_q; 7430 while (eager != NULL) { 7431 CONN_INC_REF(eager->tcp_connp); 7432 mp = &eager->tcp_closemp; 7433 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7434 tcp_eager_kill, eager->tcp_connp, 7435 SQTAG_TCP_EAGER_CLEANUP); 7436 eager = eager->tcp_eager_next_q; 7437 } 7438 } 7439 /* Then cleanup q0 */ 7440 TCP_STAT(tcp_eager_blowoff_q0); 7441 eager = listener->tcp_eager_next_q0; 7442 while (eager != listener) { 7443 CONN_INC_REF(eager->tcp_connp); 7444 mp = &eager->tcp_closemp; 7445 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7446 tcp_eager_kill, eager->tcp_connp, 7447 SQTAG_TCP_EAGER_CLEANUP_Q0); 7448 eager = eager->tcp_eager_next_q0; 7449 } 7450 } 7451 7452 /* 7453 * If we are an eager connection hanging off a listener that hasn't 7454 * formally accepted the connection yet, get off his list and blow off 7455 * any data that we have accumulated. 7456 */ 7457 static void 7458 tcp_eager_unlink(tcp_t *tcp) 7459 { 7460 tcp_t *listener = tcp->tcp_listener; 7461 7462 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7463 ASSERT(listener != NULL); 7464 if (tcp->tcp_eager_next_q0 != NULL) { 7465 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 7466 7467 /* Remove the eager tcp from q0 */ 7468 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 7469 tcp->tcp_eager_prev_q0; 7470 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 7471 tcp->tcp_eager_next_q0; 7472 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 7473 listener->tcp_conn_req_cnt_q0--; 7474 7475 tcp->tcp_eager_next_q0 = NULL; 7476 tcp->tcp_eager_prev_q0 = NULL; 7477 7478 if (tcp->tcp_syn_rcvd_timeout != 0) { 7479 /* we have timed out before */ 7480 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 7481 listener->tcp_syn_rcvd_timeout--; 7482 } 7483 } else { 7484 tcp_t **tcpp = &listener->tcp_eager_next_q; 7485 tcp_t *prev = NULL; 7486 7487 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 7488 if (tcpp[0] == tcp) { 7489 if (listener->tcp_eager_last_q == tcp) { 7490 /* 7491 * If we are unlinking the last 7492 * element on the list, adjust 7493 * tail pointer. Set tail pointer 7494 * to nil when list is empty. 7495 */ 7496 ASSERT(tcp->tcp_eager_next_q == NULL); 7497 if (listener->tcp_eager_last_q == 7498 listener->tcp_eager_next_q) { 7499 listener->tcp_eager_last_q = 7500 NULL; 7501 } else { 7502 /* 7503 * We won't get here if there 7504 * is only one eager in the 7505 * list. 7506 */ 7507 ASSERT(prev != NULL); 7508 listener->tcp_eager_last_q = 7509 prev; 7510 } 7511 } 7512 tcpp[0] = tcp->tcp_eager_next_q; 7513 tcp->tcp_eager_next_q = NULL; 7514 tcp->tcp_eager_last_q = NULL; 7515 ASSERT(listener->tcp_conn_req_cnt_q > 0); 7516 listener->tcp_conn_req_cnt_q--; 7517 break; 7518 } 7519 prev = tcpp[0]; 7520 } 7521 } 7522 tcp->tcp_listener = NULL; 7523 } 7524 7525 /* Shorthand to generate and send TPI error acks to our client */ 7526 static void 7527 tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error) 7528 { 7529 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 7530 putnext(tcp->tcp_rq, mp); 7531 } 7532 7533 /* Shorthand to generate and send TPI error acks to our client */ 7534 static void 7535 tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 7536 int t_error, int sys_error) 7537 { 7538 struct T_error_ack *teackp; 7539 7540 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 7541 M_PCPROTO, T_ERROR_ACK)) != NULL) { 7542 teackp = (struct T_error_ack *)mp->b_rptr; 7543 teackp->ERROR_prim = primitive; 7544 teackp->TLI_error = t_error; 7545 teackp->UNIX_error = sys_error; 7546 putnext(tcp->tcp_rq, mp); 7547 } 7548 } 7549 7550 /* 7551 * Note: No locks are held when inspecting tcp_g_*epriv_ports 7552 * but instead the code relies on: 7553 * - the fact that the address of the array and its size never changes 7554 * - the atomic assignment of the elements of the array 7555 */ 7556 /* ARGSUSED */ 7557 static int 7558 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 7559 { 7560 int i; 7561 7562 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7563 if (tcp_g_epriv_ports[i] != 0) 7564 (void) mi_mpprintf(mp, "%d ", tcp_g_epriv_ports[i]); 7565 } 7566 return (0); 7567 } 7568 7569 /* 7570 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7571 * threads from changing it at the same time. 7572 */ 7573 /* ARGSUSED */ 7574 static int 7575 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7576 cred_t *cr) 7577 { 7578 long new_value; 7579 int i; 7580 7581 /* 7582 * Fail the request if the new value does not lie within the 7583 * port number limits. 7584 */ 7585 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 7586 new_value <= 0 || new_value >= 65536) { 7587 return (EINVAL); 7588 } 7589 7590 mutex_enter(&tcp_epriv_port_lock); 7591 /* Check if the value is already in the list */ 7592 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7593 if (new_value == tcp_g_epriv_ports[i]) { 7594 mutex_exit(&tcp_epriv_port_lock); 7595 return (EEXIST); 7596 } 7597 } 7598 /* Find an empty slot */ 7599 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7600 if (tcp_g_epriv_ports[i] == 0) 7601 break; 7602 } 7603 if (i == tcp_g_num_epriv_ports) { 7604 mutex_exit(&tcp_epriv_port_lock); 7605 return (EOVERFLOW); 7606 } 7607 /* Set the new value */ 7608 tcp_g_epriv_ports[i] = (uint16_t)new_value; 7609 mutex_exit(&tcp_epriv_port_lock); 7610 return (0); 7611 } 7612 7613 /* 7614 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7615 * threads from changing it at the same time. 7616 */ 7617 /* ARGSUSED */ 7618 static int 7619 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7620 cred_t *cr) 7621 { 7622 long new_value; 7623 int i; 7624 7625 /* 7626 * Fail the request if the new value does not lie within the 7627 * port number limits. 7628 */ 7629 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 7630 new_value >= 65536) { 7631 return (EINVAL); 7632 } 7633 7634 mutex_enter(&tcp_epriv_port_lock); 7635 /* Check that the value is already in the list */ 7636 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7637 if (tcp_g_epriv_ports[i] == new_value) 7638 break; 7639 } 7640 if (i == tcp_g_num_epriv_ports) { 7641 mutex_exit(&tcp_epriv_port_lock); 7642 return (ESRCH); 7643 } 7644 /* Clear the value */ 7645 tcp_g_epriv_ports[i] = 0; 7646 mutex_exit(&tcp_epriv_port_lock); 7647 return (0); 7648 } 7649 7650 /* Return the TPI/TLI equivalent of our current tcp_state */ 7651 static int 7652 tcp_tpistate(tcp_t *tcp) 7653 { 7654 switch (tcp->tcp_state) { 7655 case TCPS_IDLE: 7656 return (TS_UNBND); 7657 case TCPS_LISTEN: 7658 /* 7659 * Return whether there are outstanding T_CONN_IND waiting 7660 * for the matching T_CONN_RES. Therefore don't count q0. 7661 */ 7662 if (tcp->tcp_conn_req_cnt_q > 0) 7663 return (TS_WRES_CIND); 7664 else 7665 return (TS_IDLE); 7666 case TCPS_BOUND: 7667 return (TS_IDLE); 7668 case TCPS_SYN_SENT: 7669 return (TS_WCON_CREQ); 7670 case TCPS_SYN_RCVD: 7671 /* 7672 * Note: assumption: this has to the active open SYN_RCVD. 7673 * The passive instance is detached in SYN_RCVD stage of 7674 * incoming connection processing so we cannot get request 7675 * for T_info_ack on it. 7676 */ 7677 return (TS_WACK_CRES); 7678 case TCPS_ESTABLISHED: 7679 return (TS_DATA_XFER); 7680 case TCPS_CLOSE_WAIT: 7681 return (TS_WREQ_ORDREL); 7682 case TCPS_FIN_WAIT_1: 7683 return (TS_WIND_ORDREL); 7684 case TCPS_FIN_WAIT_2: 7685 return (TS_WIND_ORDREL); 7686 7687 case TCPS_CLOSING: 7688 case TCPS_LAST_ACK: 7689 case TCPS_TIME_WAIT: 7690 case TCPS_CLOSED: 7691 /* 7692 * Following TS_WACK_DREQ7 is a rendition of "not 7693 * yet TS_IDLE" TPI state. There is no best match to any 7694 * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we 7695 * choose a value chosen that will map to TLI/XTI level 7696 * state of TSTATECHNG (state is process of changing) which 7697 * captures what this dummy state represents. 7698 */ 7699 return (TS_WACK_DREQ7); 7700 default: 7701 cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s", 7702 tcp->tcp_state, tcp_display(tcp, NULL, 7703 DISP_PORT_ONLY)); 7704 return (TS_UNBND); 7705 } 7706 } 7707 7708 static void 7709 tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp) 7710 { 7711 if (tcp->tcp_family == AF_INET6) 7712 *tia = tcp_g_t_info_ack_v6; 7713 else 7714 *tia = tcp_g_t_info_ack; 7715 tia->CURRENT_state = tcp_tpistate(tcp); 7716 tia->OPT_size = tcp_max_optsize; 7717 if (tcp->tcp_mss == 0) { 7718 /* Not yet set - tcp_open does not set mss */ 7719 if (tcp->tcp_ipversion == IPV4_VERSION) 7720 tia->TIDU_size = tcp_mss_def_ipv4; 7721 else 7722 tia->TIDU_size = tcp_mss_def_ipv6; 7723 } else { 7724 tia->TIDU_size = tcp->tcp_mss; 7725 } 7726 /* TODO: Default ETSDU is 1. Is that correct for tcp? */ 7727 } 7728 7729 /* 7730 * This routine responds to T_CAPABILITY_REQ messages. It is called by 7731 * tcp_wput. Much of the T_CAPABILITY_ACK information is copied from 7732 * tcp_g_t_info_ack. The current state of the stream is copied from 7733 * tcp_state. 7734 */ 7735 static void 7736 tcp_capability_req(tcp_t *tcp, mblk_t *mp) 7737 { 7738 t_uscalar_t cap_bits1; 7739 struct T_capability_ack *tcap; 7740 7741 if (MBLKL(mp) < sizeof (struct T_capability_req)) { 7742 freemsg(mp); 7743 return; 7744 } 7745 7746 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 7747 7748 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 7749 mp->b_datap->db_type, T_CAPABILITY_ACK); 7750 if (mp == NULL) 7751 return; 7752 7753 tcap = (struct T_capability_ack *)mp->b_rptr; 7754 tcap->CAP_bits1 = 0; 7755 7756 if (cap_bits1 & TC1_INFO) { 7757 tcp_copy_info(&tcap->INFO_ack, tcp); 7758 tcap->CAP_bits1 |= TC1_INFO; 7759 } 7760 7761 if (cap_bits1 & TC1_ACCEPTOR_ID) { 7762 tcap->ACCEPTOR_id = tcp->tcp_acceptor_id; 7763 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID; 7764 } 7765 7766 putnext(tcp->tcp_rq, mp); 7767 } 7768 7769 /* 7770 * This routine responds to T_INFO_REQ messages. It is called by tcp_wput. 7771 * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack. 7772 * The current state of the stream is copied from tcp_state. 7773 */ 7774 static void 7775 tcp_info_req(tcp_t *tcp, mblk_t *mp) 7776 { 7777 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 7778 T_INFO_ACK); 7779 if (!mp) { 7780 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7781 return; 7782 } 7783 tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp); 7784 putnext(tcp->tcp_rq, mp); 7785 } 7786 7787 /* Respond to the TPI addr request */ 7788 static void 7789 tcp_addr_req(tcp_t *tcp, mblk_t *mp) 7790 { 7791 sin_t *sin; 7792 mblk_t *ackmp; 7793 struct T_addr_ack *taa; 7794 7795 /* Make it large enough for worst case */ 7796 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 7797 2 * sizeof (sin6_t), 1); 7798 if (ackmp == NULL) { 7799 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7800 return; 7801 } 7802 7803 if (tcp->tcp_ipversion == IPV6_VERSION) { 7804 tcp_addr_req_ipv6(tcp, ackmp); 7805 return; 7806 } 7807 taa = (struct T_addr_ack *)ackmp->b_rptr; 7808 7809 bzero(taa, sizeof (struct T_addr_ack)); 7810 ackmp->b_wptr = (uchar_t *)&taa[1]; 7811 7812 taa->PRIM_type = T_ADDR_ACK; 7813 ackmp->b_datap->db_type = M_PCPROTO; 7814 7815 /* 7816 * Note: Following code assumes 32 bit alignment of basic 7817 * data structures like sin_t and struct T_addr_ack. 7818 */ 7819 if (tcp->tcp_state >= TCPS_BOUND) { 7820 /* 7821 * Fill in local address 7822 */ 7823 taa->LOCADDR_length = sizeof (sin_t); 7824 taa->LOCADDR_offset = sizeof (*taa); 7825 7826 sin = (sin_t *)&taa[1]; 7827 7828 /* Fill zeroes and then intialize non-zero fields */ 7829 *sin = sin_null; 7830 7831 sin->sin_family = AF_INET; 7832 7833 sin->sin_addr.s_addr = tcp->tcp_ipha->ipha_src; 7834 sin->sin_port = *(uint16_t *)tcp->tcp_tcph->th_lport; 7835 7836 ackmp->b_wptr = (uchar_t *)&sin[1]; 7837 7838 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7839 /* 7840 * Fill in Remote address 7841 */ 7842 taa->REMADDR_length = sizeof (sin_t); 7843 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7844 taa->LOCADDR_length); 7845 7846 sin = (sin_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7847 *sin = sin_null; 7848 sin->sin_family = AF_INET; 7849 sin->sin_addr.s_addr = tcp->tcp_remote; 7850 sin->sin_port = tcp->tcp_fport; 7851 7852 ackmp->b_wptr = (uchar_t *)&sin[1]; 7853 } 7854 } 7855 putnext(tcp->tcp_rq, ackmp); 7856 } 7857 7858 /* Assumes that tcp_addr_req gets enough space and alignment */ 7859 static void 7860 tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *ackmp) 7861 { 7862 sin6_t *sin6; 7863 struct T_addr_ack *taa; 7864 7865 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 7866 ASSERT(OK_32PTR(ackmp->b_rptr)); 7867 ASSERT(ackmp->b_wptr - ackmp->b_rptr >= sizeof (struct T_addr_ack) + 7868 2 * sizeof (sin6_t)); 7869 7870 taa = (struct T_addr_ack *)ackmp->b_rptr; 7871 7872 bzero(taa, sizeof (struct T_addr_ack)); 7873 ackmp->b_wptr = (uchar_t *)&taa[1]; 7874 7875 taa->PRIM_type = T_ADDR_ACK; 7876 ackmp->b_datap->db_type = M_PCPROTO; 7877 7878 /* 7879 * Note: Following code assumes 32 bit alignment of basic 7880 * data structures like sin6_t and struct T_addr_ack. 7881 */ 7882 if (tcp->tcp_state >= TCPS_BOUND) { 7883 /* 7884 * Fill in local address 7885 */ 7886 taa->LOCADDR_length = sizeof (sin6_t); 7887 taa->LOCADDR_offset = sizeof (*taa); 7888 7889 sin6 = (sin6_t *)&taa[1]; 7890 *sin6 = sin6_null; 7891 7892 sin6->sin6_family = AF_INET6; 7893 sin6->sin6_addr = tcp->tcp_ip6h->ip6_src; 7894 sin6->sin6_port = tcp->tcp_lport; 7895 7896 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7897 7898 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7899 /* 7900 * Fill in Remote address 7901 */ 7902 taa->REMADDR_length = sizeof (sin6_t); 7903 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7904 taa->LOCADDR_length); 7905 7906 sin6 = (sin6_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7907 *sin6 = sin6_null; 7908 sin6->sin6_family = AF_INET6; 7909 sin6->sin6_flowinfo = 7910 tcp->tcp_ip6h->ip6_vcf & 7911 ~IPV6_VERS_AND_FLOW_MASK; 7912 sin6->sin6_addr = tcp->tcp_remote_v6; 7913 sin6->sin6_port = tcp->tcp_fport; 7914 7915 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7916 } 7917 } 7918 putnext(tcp->tcp_rq, ackmp); 7919 } 7920 7921 /* 7922 * Handle reinitialization of a tcp structure. 7923 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 7924 */ 7925 static void 7926 tcp_reinit(tcp_t *tcp) 7927 { 7928 mblk_t *mp; 7929 int err; 7930 7931 TCP_STAT(tcp_reinit_calls); 7932 7933 /* tcp_reinit should never be called for detached tcp_t's */ 7934 ASSERT(tcp->tcp_listener == NULL); 7935 ASSERT((tcp->tcp_family == AF_INET && 7936 tcp->tcp_ipversion == IPV4_VERSION) || 7937 (tcp->tcp_family == AF_INET6 && 7938 (tcp->tcp_ipversion == IPV4_VERSION || 7939 tcp->tcp_ipversion == IPV6_VERSION))); 7940 7941 /* Cancel outstanding timers */ 7942 tcp_timers_stop(tcp); 7943 7944 if (tcp->tcp_flow_stopped) { 7945 tcp->tcp_flow_stopped = B_FALSE; 7946 tcp_clrqfull(tcp); 7947 } 7948 /* 7949 * Reset everything in the state vector, after updating global 7950 * MIB data from instance counters. 7951 */ 7952 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 7953 tcp->tcp_ibsegs = 0; 7954 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 7955 tcp->tcp_obsegs = 0; 7956 7957 tcp_close_mpp(&tcp->tcp_xmit_head); 7958 if (tcp->tcp_snd_zcopy_aware) 7959 tcp_zcopy_notify(tcp); 7960 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 7961 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 7962 tcp_close_mpp(&tcp->tcp_reass_head); 7963 tcp->tcp_reass_tail = NULL; 7964 if (tcp->tcp_rcv_list != NULL) { 7965 /* Free b_next chain */ 7966 tcp_close_mpp(&tcp->tcp_rcv_list); 7967 tcp->tcp_rcv_last_head = NULL; 7968 tcp->tcp_rcv_last_tail = NULL; 7969 tcp->tcp_rcv_cnt = 0; 7970 } 7971 tcp->tcp_rcv_last_tail = NULL; 7972 7973 if ((mp = tcp->tcp_urp_mp) != NULL) { 7974 freemsg(mp); 7975 tcp->tcp_urp_mp = NULL; 7976 } 7977 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 7978 freemsg(mp); 7979 tcp->tcp_urp_mark_mp = NULL; 7980 } 7981 if (tcp->tcp_fused_sigurg_mp != NULL) { 7982 freeb(tcp->tcp_fused_sigurg_mp); 7983 tcp->tcp_fused_sigurg_mp = NULL; 7984 } 7985 7986 /* 7987 * Following is a union with two members which are 7988 * identical types and size so the following cleanup 7989 * is enough. 7990 */ 7991 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 7992 7993 CL_INET_DISCONNECT(tcp); 7994 7995 /* 7996 * The connection can't be on the tcp_time_wait_head list 7997 * since it is not detached. 7998 */ 7999 ASSERT(tcp->tcp_time_wait_next == NULL); 8000 ASSERT(tcp->tcp_time_wait_prev == NULL); 8001 ASSERT(tcp->tcp_time_wait_expire == 0); 8002 8003 /* 8004 * Reset/preserve other values 8005 */ 8006 tcp_reinit_values(tcp); 8007 ipcl_hash_remove(tcp->tcp_connp); 8008 conn_delete_ire(tcp->tcp_connp, NULL); 8009 8010 if (tcp->tcp_conn_req_max != 0) { 8011 /* 8012 * This is the case when a TLI program uses the same 8013 * transport end point to accept a connection. This 8014 * makes the TCP both a listener and acceptor. When 8015 * this connection is closed, we need to set the state 8016 * back to TCPS_LISTEN. Make sure that the eager list 8017 * is reinitialized. 8018 * 8019 * Note that this stream is still bound to the four 8020 * tuples of the previous connection in IP. If a new 8021 * SYN with different foreign address comes in, IP will 8022 * not find it and will send it to the global queue. In 8023 * the global queue, TCP will do a tcp_lookup_listener() 8024 * to find this stream. This works because this stream 8025 * is only removed from connected hash. 8026 * 8027 */ 8028 tcp->tcp_state = TCPS_LISTEN; 8029 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 8030 tcp->tcp_connp->conn_recv = tcp_conn_request; 8031 if (tcp->tcp_family == AF_INET6) { 8032 ASSERT(tcp->tcp_connp->conn_af_isv6); 8033 (void) ipcl_bind_insert_v6(tcp->tcp_connp, IPPROTO_TCP, 8034 &tcp->tcp_ip6h->ip6_src, tcp->tcp_lport); 8035 } else { 8036 ASSERT(!tcp->tcp_connp->conn_af_isv6); 8037 (void) ipcl_bind_insert(tcp->tcp_connp, IPPROTO_TCP, 8038 tcp->tcp_ipha->ipha_src, tcp->tcp_lport); 8039 } 8040 } else { 8041 tcp->tcp_state = TCPS_BOUND; 8042 } 8043 8044 /* 8045 * Initialize to default values 8046 * Can't fail since enough header template space already allocated 8047 * at open(). 8048 */ 8049 err = tcp_init_values(tcp); 8050 ASSERT(err == 0); 8051 /* Restore state in tcp_tcph */ 8052 bcopy(&tcp->tcp_lport, tcp->tcp_tcph->th_lport, TCP_PORT_LEN); 8053 if (tcp->tcp_ipversion == IPV4_VERSION) 8054 tcp->tcp_ipha->ipha_src = tcp->tcp_bound_source; 8055 else 8056 tcp->tcp_ip6h->ip6_src = tcp->tcp_bound_source_v6; 8057 /* 8058 * Copy of the src addr. in tcp_t is needed in tcp_t 8059 * since the lookup funcs can only lookup on tcp_t 8060 */ 8061 tcp->tcp_ip_src_v6 = tcp->tcp_bound_source_v6; 8062 8063 ASSERT(tcp->tcp_ptpbhn != NULL); 8064 tcp->tcp_rq->q_hiwat = tcp_recv_hiwat; 8065 tcp->tcp_rwnd = tcp_recv_hiwat; 8066 tcp->tcp_mss = tcp->tcp_ipversion != IPV4_VERSION ? 8067 tcp_mss_def_ipv6 : tcp_mss_def_ipv4; 8068 } 8069 8070 /* 8071 * Force values to zero that need be zero. 8072 * Do not touch values asociated with the BOUND or LISTEN state 8073 * since the connection will end up in that state after the reinit. 8074 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 8075 * structure! 8076 */ 8077 static void 8078 tcp_reinit_values(tcp) 8079 tcp_t *tcp; 8080 { 8081 #ifndef lint 8082 #define DONTCARE(x) 8083 #define PRESERVE(x) 8084 #else 8085 #define DONTCARE(x) ((x) = (x)) 8086 #define PRESERVE(x) ((x) = (x)) 8087 #endif /* lint */ 8088 8089 PRESERVE(tcp->tcp_bind_hash); 8090 PRESERVE(tcp->tcp_ptpbhn); 8091 PRESERVE(tcp->tcp_acceptor_hash); 8092 PRESERVE(tcp->tcp_ptpahn); 8093 8094 /* Should be ASSERT NULL on these with new code! */ 8095 ASSERT(tcp->tcp_time_wait_next == NULL); 8096 ASSERT(tcp->tcp_time_wait_prev == NULL); 8097 ASSERT(tcp->tcp_time_wait_expire == 0); 8098 PRESERVE(tcp->tcp_state); 8099 PRESERVE(tcp->tcp_rq); 8100 PRESERVE(tcp->tcp_wq); 8101 8102 ASSERT(tcp->tcp_xmit_head == NULL); 8103 ASSERT(tcp->tcp_xmit_last == NULL); 8104 ASSERT(tcp->tcp_unsent == 0); 8105 ASSERT(tcp->tcp_xmit_tail == NULL); 8106 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 8107 8108 tcp->tcp_snxt = 0; /* Displayed in mib */ 8109 tcp->tcp_suna = 0; /* Displayed in mib */ 8110 tcp->tcp_swnd = 0; 8111 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_mss_set */ 8112 8113 ASSERT(tcp->tcp_ibsegs == 0); 8114 ASSERT(tcp->tcp_obsegs == 0); 8115 8116 if (tcp->tcp_iphc != NULL) { 8117 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8118 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 8119 } 8120 8121 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 8122 DONTCARE(tcp->tcp_hdr_len); /* Init in tcp_init_values */ 8123 DONTCARE(tcp->tcp_ipha); 8124 DONTCARE(tcp->tcp_ip6h); 8125 DONTCARE(tcp->tcp_ip_hdr_len); 8126 DONTCARE(tcp->tcp_tcph); 8127 DONTCARE(tcp->tcp_tcp_hdr_len); /* Init in tcp_init_values */ 8128 tcp->tcp_valid_bits = 0; 8129 8130 DONTCARE(tcp->tcp_xmit_hiwater); /* Init in tcp_init_values */ 8131 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 8132 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 8133 tcp->tcp_last_rcv_lbolt = 0; 8134 8135 tcp->tcp_init_cwnd = 0; 8136 8137 tcp->tcp_urp_last_valid = 0; 8138 tcp->tcp_hard_binding = 0; 8139 tcp->tcp_hard_bound = 0; 8140 PRESERVE(tcp->tcp_cred); 8141 PRESERVE(tcp->tcp_cpid); 8142 PRESERVE(tcp->tcp_exclbind); 8143 8144 tcp->tcp_fin_acked = 0; 8145 tcp->tcp_fin_rcvd = 0; 8146 tcp->tcp_fin_sent = 0; 8147 tcp->tcp_ordrel_done = 0; 8148 8149 ASSERT(tcp->tcp_flow_stopped == 0); 8150 tcp->tcp_debug = 0; 8151 tcp->tcp_dontroute = 0; 8152 tcp->tcp_broadcast = 0; 8153 8154 tcp->tcp_useloopback = 0; 8155 tcp->tcp_reuseaddr = 0; 8156 tcp->tcp_oobinline = 0; 8157 tcp->tcp_dgram_errind = 0; 8158 8159 tcp->tcp_detached = 0; 8160 tcp->tcp_bind_pending = 0; 8161 tcp->tcp_unbind_pending = 0; 8162 tcp->tcp_deferred_clean_death = 0; 8163 8164 tcp->tcp_snd_ws_ok = B_FALSE; 8165 tcp->tcp_snd_ts_ok = B_FALSE; 8166 tcp->tcp_linger = 0; 8167 tcp->tcp_ka_enabled = 0; 8168 tcp->tcp_zero_win_probe = 0; 8169 8170 tcp->tcp_loopback = 0; 8171 tcp->tcp_localnet = 0; 8172 tcp->tcp_syn_defense = 0; 8173 tcp->tcp_set_timer = 0; 8174 8175 tcp->tcp_active_open = 0; 8176 ASSERT(tcp->tcp_timeout == B_FALSE); 8177 tcp->tcp_rexmit = B_FALSE; 8178 tcp->tcp_xmit_zc_clean = B_FALSE; 8179 8180 tcp->tcp_snd_sack_ok = B_FALSE; 8181 PRESERVE(tcp->tcp_recvdstaddr); 8182 tcp->tcp_hwcksum = B_FALSE; 8183 8184 tcp->tcp_ire_ill_check_done = B_FALSE; 8185 DONTCARE(tcp->tcp_maxpsz); /* Init in tcp_init_values */ 8186 8187 tcp->tcp_mdt = B_FALSE; 8188 tcp->tcp_mdt_hdr_head = 0; 8189 tcp->tcp_mdt_hdr_tail = 0; 8190 8191 tcp->tcp_conn_def_q0 = 0; 8192 tcp->tcp_ip_forward_progress = B_FALSE; 8193 tcp->tcp_anon_priv_bind = 0; 8194 tcp->tcp_ecn_ok = B_FALSE; 8195 8196 tcp->tcp_cwr = B_FALSE; 8197 tcp->tcp_ecn_echo_on = B_FALSE; 8198 8199 if (tcp->tcp_sack_info != NULL) { 8200 if (tcp->tcp_notsack_list != NULL) { 8201 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 8202 } 8203 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 8204 tcp->tcp_sack_info = NULL; 8205 } 8206 8207 tcp->tcp_rcv_ws = 0; 8208 tcp->tcp_snd_ws = 0; 8209 tcp->tcp_ts_recent = 0; 8210 tcp->tcp_rnxt = 0; /* Displayed in mib */ 8211 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 8212 tcp->tcp_if_mtu = 0; 8213 8214 ASSERT(tcp->tcp_reass_head == NULL); 8215 ASSERT(tcp->tcp_reass_tail == NULL); 8216 8217 tcp->tcp_cwnd_cnt = 0; 8218 8219 ASSERT(tcp->tcp_rcv_list == NULL); 8220 ASSERT(tcp->tcp_rcv_last_head == NULL); 8221 ASSERT(tcp->tcp_rcv_last_tail == NULL); 8222 ASSERT(tcp->tcp_rcv_cnt == 0); 8223 8224 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_adapt_ire */ 8225 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 8226 tcp->tcp_csuna = 0; 8227 8228 tcp->tcp_rto = 0; /* Displayed in MIB */ 8229 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 8230 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 8231 tcp->tcp_rtt_update = 0; 8232 8233 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 8234 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 8235 8236 tcp->tcp_rack = 0; /* Displayed in mib */ 8237 tcp->tcp_rack_cnt = 0; 8238 tcp->tcp_rack_cur_max = 0; 8239 tcp->tcp_rack_abs_max = 0; 8240 8241 tcp->tcp_max_swnd = 0; 8242 8243 ASSERT(tcp->tcp_listener == NULL); 8244 8245 DONTCARE(tcp->tcp_xmit_lowater); /* Init in tcp_init_values */ 8246 8247 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 8248 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 8249 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 8250 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 8251 8252 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 8253 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 8254 PRESERVE(tcp->tcp_conn_req_max); 8255 PRESERVE(tcp->tcp_conn_req_seqnum); 8256 8257 DONTCARE(tcp->tcp_ip_hdr_len); /* Init in tcp_init_values */ 8258 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 8259 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 8260 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 8261 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 8262 8263 tcp->tcp_lingertime = 0; 8264 8265 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 8266 ASSERT(tcp->tcp_urp_mp == NULL); 8267 ASSERT(tcp->tcp_urp_mark_mp == NULL); 8268 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 8269 8270 ASSERT(tcp->tcp_eager_next_q == NULL); 8271 ASSERT(tcp->tcp_eager_last_q == NULL); 8272 ASSERT((tcp->tcp_eager_next_q0 == NULL && 8273 tcp->tcp_eager_prev_q0 == NULL) || 8274 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 8275 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 8276 8277 tcp->tcp_client_errno = 0; 8278 8279 DONTCARE(tcp->tcp_sum); /* Init in tcp_init_values */ 8280 8281 tcp->tcp_remote_v6 = ipv6_all_zeros; /* Displayed in MIB */ 8282 8283 PRESERVE(tcp->tcp_bound_source_v6); 8284 tcp->tcp_last_sent_len = 0; 8285 tcp->tcp_dupack_cnt = 0; 8286 8287 tcp->tcp_fport = 0; /* Displayed in MIB */ 8288 PRESERVE(tcp->tcp_lport); 8289 8290 PRESERVE(tcp->tcp_acceptor_lockp); 8291 8292 ASSERT(tcp->tcp_ordrelid == 0); 8293 PRESERVE(tcp->tcp_acceptor_id); 8294 DONTCARE(tcp->tcp_ipsec_overhead); 8295 8296 /* 8297 * If tcp_tracing flag is ON (i.e. We have a trace buffer 8298 * in tcp structure and now tracing), Re-initialize all 8299 * members of tcp_traceinfo. 8300 */ 8301 if (tcp->tcp_tracebuf != NULL) { 8302 bzero(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 8303 } 8304 8305 PRESERVE(tcp->tcp_family); 8306 if (tcp->tcp_family == AF_INET6) { 8307 tcp->tcp_ipversion = IPV6_VERSION; 8308 tcp->tcp_mss = tcp_mss_def_ipv6; 8309 } else { 8310 tcp->tcp_ipversion = IPV4_VERSION; 8311 tcp->tcp_mss = tcp_mss_def_ipv4; 8312 } 8313 8314 tcp->tcp_bound_if = 0; 8315 tcp->tcp_ipv6_recvancillary = 0; 8316 tcp->tcp_recvifindex = 0; 8317 tcp->tcp_recvhops = 0; 8318 tcp->tcp_closed = 0; 8319 tcp->tcp_cleandeathtag = 0; 8320 if (tcp->tcp_hopopts != NULL) { 8321 mi_free(tcp->tcp_hopopts); 8322 tcp->tcp_hopopts = NULL; 8323 tcp->tcp_hopoptslen = 0; 8324 } 8325 ASSERT(tcp->tcp_hopoptslen == 0); 8326 if (tcp->tcp_dstopts != NULL) { 8327 mi_free(tcp->tcp_dstopts); 8328 tcp->tcp_dstopts = NULL; 8329 tcp->tcp_dstoptslen = 0; 8330 } 8331 ASSERT(tcp->tcp_dstoptslen == 0); 8332 if (tcp->tcp_rtdstopts != NULL) { 8333 mi_free(tcp->tcp_rtdstopts); 8334 tcp->tcp_rtdstopts = NULL; 8335 tcp->tcp_rtdstoptslen = 0; 8336 } 8337 ASSERT(tcp->tcp_rtdstoptslen == 0); 8338 if (tcp->tcp_rthdr != NULL) { 8339 mi_free(tcp->tcp_rthdr); 8340 tcp->tcp_rthdr = NULL; 8341 tcp->tcp_rthdrlen = 0; 8342 } 8343 ASSERT(tcp->tcp_rthdrlen == 0); 8344 PRESERVE(tcp->tcp_drop_opt_ack_cnt); 8345 8346 tcp->tcp_fused = B_FALSE; 8347 tcp->tcp_unfusable = B_FALSE; 8348 tcp->tcp_fused_sigurg = B_FALSE; 8349 tcp->tcp_loopback_peer = NULL; 8350 8351 tcp->tcp_in_ack_unsent = 0; 8352 tcp->tcp_cork = B_FALSE; 8353 8354 #undef DONTCARE 8355 #undef PRESERVE 8356 } 8357 8358 /* 8359 * Allocate necessary resources and initialize state vector. 8360 * Guaranteed not to fail so that when an error is returned, 8361 * the caller doesn't need to do any additional cleanup. 8362 */ 8363 int 8364 tcp_init(tcp_t *tcp, queue_t *q) 8365 { 8366 int err; 8367 8368 tcp->tcp_rq = q; 8369 tcp->tcp_wq = WR(q); 8370 tcp->tcp_state = TCPS_IDLE; 8371 if ((err = tcp_init_values(tcp)) != 0) 8372 tcp_timers_stop(tcp); 8373 return (err); 8374 } 8375 8376 static int 8377 tcp_init_values(tcp_t *tcp) 8378 { 8379 int err; 8380 8381 ASSERT((tcp->tcp_family == AF_INET && 8382 tcp->tcp_ipversion == IPV4_VERSION) || 8383 (tcp->tcp_family == AF_INET6 && 8384 (tcp->tcp_ipversion == IPV4_VERSION || 8385 tcp->tcp_ipversion == IPV6_VERSION))); 8386 8387 /* 8388 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 8389 * will be close to tcp_rexmit_interval_initial. By doing this, we 8390 * allow the algorithm to adjust slowly to large fluctuations of RTT 8391 * during first few transmissions of a connection as seen in slow 8392 * links. 8393 */ 8394 tcp->tcp_rtt_sa = tcp_rexmit_interval_initial << 2; 8395 tcp->tcp_rtt_sd = tcp_rexmit_interval_initial >> 1; 8396 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 8397 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 8398 tcp_conn_grace_period; 8399 if (tcp->tcp_rto < tcp_rexmit_interval_min) 8400 tcp->tcp_rto = tcp_rexmit_interval_min; 8401 tcp->tcp_timer_backoff = 0; 8402 tcp->tcp_ms_we_have_waited = 0; 8403 tcp->tcp_last_recv_time = lbolt; 8404 tcp->tcp_cwnd_max = tcp_cwnd_max_; 8405 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 8406 8407 tcp->tcp_maxpsz = tcp_maxpsz_multiplier; 8408 8409 tcp->tcp_first_timer_threshold = tcp_ip_notify_interval; 8410 tcp->tcp_first_ctimer_threshold = tcp_ip_notify_cinterval; 8411 tcp->tcp_second_timer_threshold = tcp_ip_abort_interval; 8412 /* 8413 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 8414 * passive open. 8415 */ 8416 tcp->tcp_second_ctimer_threshold = tcp_ip_abort_cinterval; 8417 8418 tcp->tcp_naglim = tcp_naglim_def; 8419 8420 /* NOTE: ISS is now set in tcp_adapt_ire(). */ 8421 8422 tcp->tcp_mdt_hdr_head = 0; 8423 tcp->tcp_mdt_hdr_tail = 0; 8424 8425 tcp->tcp_fused = B_FALSE; 8426 tcp->tcp_unfusable = B_FALSE; 8427 tcp->tcp_fused_sigurg = B_FALSE; 8428 tcp->tcp_loopback_peer = NULL; 8429 8430 /* Initialize the header template */ 8431 if (tcp->tcp_ipversion == IPV4_VERSION) { 8432 err = tcp_header_init_ipv4(tcp); 8433 } else { 8434 err = tcp_header_init_ipv6(tcp); 8435 } 8436 if (err) 8437 return (err); 8438 8439 /* 8440 * Init the window scale to the max so tcp_rwnd_set() won't pare 8441 * down tcp_rwnd. tcp_adapt_ire() will set the right value later. 8442 */ 8443 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 8444 tcp->tcp_xmit_lowater = tcp_xmit_lowat; 8445 tcp->tcp_xmit_hiwater = tcp_xmit_hiwat; 8446 8447 tcp->tcp_cork = B_FALSE; 8448 /* 8449 * Init the tcp_debug option. This value determines whether TCP 8450 * calls strlog() to print out debug messages. Doing this 8451 * initialization here means that this value is not inherited thru 8452 * tcp_reinit(). 8453 */ 8454 tcp->tcp_debug = tcp_dbg; 8455 8456 tcp->tcp_ka_interval = tcp_keepalive_interval; 8457 tcp->tcp_ka_abort_thres = tcp_keepalive_abort_interval; 8458 8459 return (0); 8460 } 8461 8462 /* 8463 * Initialize the IPv4 header. Loses any record of any IP options. 8464 */ 8465 static int 8466 tcp_header_init_ipv4(tcp_t *tcp) 8467 { 8468 tcph_t *tcph; 8469 uint32_t sum; 8470 8471 /* 8472 * This is a simple initialization. If there's 8473 * already a template, it should never be too small, 8474 * so reuse it. Otherwise, allocate space for the new one. 8475 */ 8476 if (tcp->tcp_iphc == NULL) { 8477 ASSERT(tcp->tcp_iphc_len == 0); 8478 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8479 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8480 if (tcp->tcp_iphc == NULL) { 8481 tcp->tcp_iphc_len = 0; 8482 return (ENOMEM); 8483 } 8484 } 8485 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8486 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 8487 tcp->tcp_ip6h = NULL; 8488 tcp->tcp_ipversion = IPV4_VERSION; 8489 tcp->tcp_hdr_len = sizeof (ipha_t) + sizeof (tcph_t); 8490 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8491 tcp->tcp_ip_hdr_len = sizeof (ipha_t); 8492 tcp->tcp_ipha->ipha_length = htons(sizeof (ipha_t) + sizeof (tcph_t)); 8493 tcp->tcp_ipha->ipha_version_and_hdr_length 8494 = (IP_VERSION << 4) | IP_SIMPLE_HDR_LENGTH_IN_WORDS; 8495 tcp->tcp_ipha->ipha_ident = 0; 8496 8497 tcp->tcp_ttl = (uchar_t)tcp_ipv4_ttl; 8498 tcp->tcp_tos = 0; 8499 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 8500 tcp->tcp_ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 8501 tcp->tcp_ipha->ipha_protocol = IPPROTO_TCP; 8502 8503 tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (ipha_t)); 8504 tcp->tcp_tcph = tcph; 8505 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8506 /* 8507 * IP wants our header length in the checksum field to 8508 * allow it to perform a single pseudo-header+checksum 8509 * calculation on behalf of TCP. 8510 * Include the adjustment for a source route once IP_OPTIONS is set. 8511 */ 8512 sum = sizeof (tcph_t) + tcp->tcp_sum; 8513 sum = (sum >> 16) + (sum & 0xFFFF); 8514 U16_TO_ABE16(sum, tcph->th_sum); 8515 return (0); 8516 } 8517 8518 /* 8519 * Initialize the IPv6 header. Loses any record of any IPv6 extension headers. 8520 */ 8521 static int 8522 tcp_header_init_ipv6(tcp_t *tcp) 8523 { 8524 tcph_t *tcph; 8525 uint32_t sum; 8526 8527 /* 8528 * This is a simple initialization. If there's 8529 * already a template, it should never be too small, 8530 * so reuse it. Otherwise, allocate space for the new one. 8531 * Ensure that there is enough space to "downgrade" the tcp_t 8532 * to an IPv4 tcp_t. This requires having space for a full load 8533 * of IPv4 options, as well as a full load of TCP options 8534 * (TCP_MAX_COMBINED_HEADER_LENGTH, 120 bytes); this is more space 8535 * than a v6 header and a TCP header with a full load of TCP options 8536 * (IPV6_HDR_LEN is 40 bytes; TCP_MAX_HDR_LENGTH is 60 bytes). 8537 * We want to avoid reallocation in the "downgraded" case when 8538 * processing outbound IPv4 options. 8539 */ 8540 if (tcp->tcp_iphc == NULL) { 8541 ASSERT(tcp->tcp_iphc_len == 0); 8542 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8543 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8544 if (tcp->tcp_iphc == NULL) { 8545 tcp->tcp_iphc_len = 0; 8546 return (ENOMEM); 8547 } 8548 } 8549 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8550 tcp->tcp_ipversion = IPV6_VERSION; 8551 tcp->tcp_hdr_len = IPV6_HDR_LEN + sizeof (tcph_t); 8552 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8553 tcp->tcp_ip_hdr_len = IPV6_HDR_LEN; 8554 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 8555 tcp->tcp_ipha = NULL; 8556 8557 /* Initialize the header template */ 8558 8559 tcp->tcp_ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW; 8560 tcp->tcp_ip6h->ip6_plen = ntohs(sizeof (tcph_t)); 8561 tcp->tcp_ip6h->ip6_nxt = IPPROTO_TCP; 8562 tcp->tcp_ip6h->ip6_hops = (uint8_t)tcp_ipv6_hoplimit; 8563 8564 tcph = (tcph_t *)(tcp->tcp_iphc + IPV6_HDR_LEN); 8565 tcp->tcp_tcph = tcph; 8566 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8567 /* 8568 * IP wants our header length in the checksum field to 8569 * allow it to perform a single psuedo-header+checksum 8570 * calculation on behalf of TCP. 8571 * Include the adjustment for a source route when IPV6_RTHDR is set. 8572 */ 8573 sum = sizeof (tcph_t) + tcp->tcp_sum; 8574 sum = (sum >> 16) + (sum & 0xFFFF); 8575 U16_TO_ABE16(sum, tcph->th_sum); 8576 return (0); 8577 } 8578 8579 /* At minimum we need 4 bytes in the TCP header for the lookup */ 8580 #define ICMP_MIN_TCP_HDR 4 8581 8582 /* 8583 * tcp_icmp_error is called by tcp_rput_other to process ICMP error messages 8584 * passed up by IP. The message is always received on the correct tcp_t. 8585 * Assumes that IP has pulled up everything up to and including the ICMP header. 8586 */ 8587 void 8588 tcp_icmp_error(tcp_t *tcp, mblk_t *mp) 8589 { 8590 icmph_t *icmph; 8591 ipha_t *ipha; 8592 int iph_hdr_length; 8593 tcph_t *tcph; 8594 boolean_t ipsec_mctl = B_FALSE; 8595 boolean_t secure; 8596 mblk_t *first_mp = mp; 8597 uint32_t new_mss; 8598 uint32_t ratio; 8599 size_t mp_size = MBLKL(mp); 8600 uint32_t seg_ack; 8601 uint32_t seg_seq; 8602 8603 /* Assume IP provides aligned packets - otherwise toss */ 8604 if (!OK_32PTR(mp->b_rptr)) { 8605 freemsg(mp); 8606 return; 8607 } 8608 8609 /* 8610 * Since ICMP errors are normal data marked with M_CTL when sent 8611 * to TCP or UDP, we have to look for a IPSEC_IN value to identify 8612 * packets starting with an ipsec_info_t, see ipsec_info.h. 8613 */ 8614 if ((mp_size == sizeof (ipsec_info_t)) && 8615 (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == IPSEC_IN)) { 8616 ASSERT(mp->b_cont != NULL); 8617 mp = mp->b_cont; 8618 /* IP should have done this */ 8619 ASSERT(OK_32PTR(mp->b_rptr)); 8620 mp_size = MBLKL(mp); 8621 ipsec_mctl = B_TRUE; 8622 } 8623 8624 /* 8625 * Verify that we have a complete outer IP header. If not, drop it. 8626 */ 8627 if (mp_size < sizeof (ipha_t)) { 8628 noticmpv4: 8629 freemsg(first_mp); 8630 return; 8631 } 8632 8633 ipha = (ipha_t *)mp->b_rptr; 8634 /* 8635 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 8636 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 8637 */ 8638 switch (IPH_HDR_VERSION(ipha)) { 8639 case IPV6_VERSION: 8640 tcp_icmp_error_ipv6(tcp, first_mp, ipsec_mctl); 8641 return; 8642 case IPV4_VERSION: 8643 break; 8644 default: 8645 goto noticmpv4; 8646 } 8647 8648 /* Skip past the outer IP and ICMP headers */ 8649 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8650 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 8651 /* 8652 * If we don't have the correct outer IP header length or if the ULP 8653 * is not IPPROTO_ICMP or if we don't have a complete inner IP header 8654 * send it upstream. 8655 */ 8656 if (iph_hdr_length < sizeof (ipha_t) || 8657 ipha->ipha_protocol != IPPROTO_ICMP || 8658 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 8659 goto noticmpv4; 8660 } 8661 ipha = (ipha_t *)&icmph[1]; 8662 8663 /* Skip past the inner IP and find the ULP header */ 8664 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8665 tcph = (tcph_t *)((char *)ipha + iph_hdr_length); 8666 /* 8667 * If we don't have the correct inner IP header length or if the ULP 8668 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 8669 * bytes of TCP header, drop it. 8670 */ 8671 if (iph_hdr_length < sizeof (ipha_t) || 8672 ipha->ipha_protocol != IPPROTO_TCP || 8673 (uchar_t *)tcph + ICMP_MIN_TCP_HDR > mp->b_wptr) { 8674 goto noticmpv4; 8675 } 8676 8677 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 8678 if (ipsec_mctl) { 8679 secure = ipsec_in_is_secure(first_mp); 8680 } else { 8681 secure = B_FALSE; 8682 } 8683 if (secure) { 8684 /* 8685 * If we are willing to accept this in clear 8686 * we don't have to verify policy. 8687 */ 8688 if (!ipsec_inbound_accept_clear(mp, ipha, NULL)) { 8689 if (!tcp_check_policy(tcp, first_mp, 8690 ipha, NULL, secure, ipsec_mctl)) { 8691 /* 8692 * tcp_check_policy called 8693 * ip_drop_packet() on failure. 8694 */ 8695 return; 8696 } 8697 } 8698 } 8699 } else if (ipsec_mctl) { 8700 /* 8701 * This is a hard_bound connection. IP has already 8702 * verified policy. We don't have to do it again. 8703 */ 8704 freeb(first_mp); 8705 first_mp = mp; 8706 ipsec_mctl = B_FALSE; 8707 } 8708 8709 seg_ack = ABE32_TO_U32(tcph->th_ack); 8710 seg_seq = ABE32_TO_U32(tcph->th_seq); 8711 /* 8712 * TCP SHOULD check that the TCP sequence number contained in 8713 * payload of the ICMP error message is within the range 8714 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8715 */ 8716 if (SEQ_LT(seg_seq, tcp->tcp_suna) || 8717 SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8718 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8719 /* 8720 * If the ICMP message is bogus, should we kill the 8721 * connection, or should we just drop the bogus ICMP 8722 * message? It would probably make more sense to just 8723 * drop the message so that if this one managed to get 8724 * in, the real connection should not suffer. 8725 */ 8726 goto noticmpv4; 8727 } 8728 8729 switch (icmph->icmph_type) { 8730 case ICMP_DEST_UNREACHABLE: 8731 switch (icmph->icmph_code) { 8732 case ICMP_FRAGMENTATION_NEEDED: 8733 /* 8734 * Reduce the MSS based on the new MTU. This will 8735 * eliminate any fragmentation locally. 8736 * N.B. There may well be some funny side-effects on 8737 * the local send policy and the remote receive policy. 8738 * Pending further research, we provide 8739 * tcp_ignore_path_mtu just in case this proves 8740 * disastrous somewhere. 8741 * 8742 * After updating the MSS, retransmit part of the 8743 * dropped segment using the new mss by calling 8744 * tcp_wput_data(). Need to adjust all those 8745 * params to make sure tcp_wput_data() work properly. 8746 */ 8747 if (tcp_ignore_path_mtu) 8748 break; 8749 8750 /* 8751 * Decrease the MSS by time stamp options 8752 * IP options and IPSEC options. tcp_hdr_len 8753 * includes time stamp option and IP option 8754 * length. 8755 */ 8756 8757 new_mss = ntohs(icmph->icmph_du_mtu) - 8758 tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead; 8759 8760 /* 8761 * Only update the MSS if the new one is 8762 * smaller than the previous one. This is 8763 * to avoid problems when getting multiple 8764 * ICMP errors for the same MTU. 8765 */ 8766 if (new_mss >= tcp->tcp_mss) 8767 break; 8768 8769 /* 8770 * Stop doing PMTU if new_mss is less than 68 8771 * or less than tcp_mss_min. 8772 * The value 68 comes from rfc 1191. 8773 */ 8774 if (new_mss < MAX(68, tcp_mss_min)) 8775 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 8776 0; 8777 8778 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 8779 ASSERT(ratio >= 1); 8780 tcp_mss_set(tcp, new_mss); 8781 8782 /* 8783 * Make sure we have something to 8784 * send. 8785 */ 8786 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 8787 (tcp->tcp_xmit_head != NULL)) { 8788 /* 8789 * Shrink tcp_cwnd in 8790 * proportion to the old MSS/new MSS. 8791 */ 8792 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 8793 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 8794 (tcp->tcp_unsent == 0)) { 8795 tcp->tcp_rexmit_max = tcp->tcp_fss; 8796 } else { 8797 tcp->tcp_rexmit_max = tcp->tcp_snxt; 8798 } 8799 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 8800 tcp->tcp_rexmit = B_TRUE; 8801 tcp->tcp_dupack_cnt = 0; 8802 tcp->tcp_snd_burst = TCP_CWND_SS; 8803 tcp_ss_rexmit(tcp); 8804 } 8805 break; 8806 case ICMP_PORT_UNREACHABLE: 8807 case ICMP_PROTOCOL_UNREACHABLE: 8808 switch (tcp->tcp_state) { 8809 case TCPS_SYN_SENT: 8810 case TCPS_SYN_RCVD: 8811 /* 8812 * ICMP can snipe away incipient 8813 * TCP connections as long as 8814 * seq number is same as initial 8815 * send seq number. 8816 */ 8817 if (seg_seq == tcp->tcp_iss) { 8818 (void) tcp_clean_death(tcp, 8819 ECONNREFUSED, 6); 8820 } 8821 break; 8822 } 8823 break; 8824 case ICMP_HOST_UNREACHABLE: 8825 case ICMP_NET_UNREACHABLE: 8826 /* Record the error in case we finally time out. */ 8827 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 8828 tcp->tcp_client_errno = EHOSTUNREACH; 8829 else 8830 tcp->tcp_client_errno = ENETUNREACH; 8831 if (tcp->tcp_state == TCPS_SYN_RCVD) { 8832 if (tcp->tcp_listener != NULL && 8833 tcp->tcp_listener->tcp_syn_defense) { 8834 /* 8835 * Ditch the half-open connection if we 8836 * suspect a SYN attack is under way. 8837 */ 8838 tcp_ip_ire_mark_advice(tcp); 8839 (void) tcp_clean_death(tcp, 8840 tcp->tcp_client_errno, 7); 8841 } 8842 } 8843 break; 8844 default: 8845 break; 8846 } 8847 break; 8848 case ICMP_SOURCE_QUENCH: { 8849 /* 8850 * use a global boolean to control 8851 * whether TCP should respond to ICMP_SOURCE_QUENCH. 8852 * The default is false. 8853 */ 8854 if (tcp_icmp_source_quench) { 8855 /* 8856 * Reduce the sending rate as if we got a 8857 * retransmit timeout 8858 */ 8859 uint32_t npkt; 8860 8861 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 8862 tcp->tcp_mss; 8863 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 8864 tcp->tcp_cwnd = tcp->tcp_mss; 8865 tcp->tcp_cwnd_cnt = 0; 8866 } 8867 break; 8868 } 8869 } 8870 freemsg(first_mp); 8871 } 8872 8873 /* 8874 * tcp_icmp_error_ipv6 is called by tcp_rput_other to process ICMPv6 8875 * error messages passed up by IP. 8876 * Assumes that IP has pulled up all the extension headers as well 8877 * as the ICMPv6 header. 8878 */ 8879 static void 8880 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl) 8881 { 8882 icmp6_t *icmp6; 8883 ip6_t *ip6h; 8884 uint16_t iph_hdr_length; 8885 tcpha_t *tcpha; 8886 uint8_t *nexthdrp; 8887 uint32_t new_mss; 8888 uint32_t ratio; 8889 boolean_t secure; 8890 mblk_t *first_mp = mp; 8891 size_t mp_size; 8892 uint32_t seg_ack; 8893 uint32_t seg_seq; 8894 8895 /* 8896 * The caller has determined if this is an IPSEC_IN packet and 8897 * set ipsec_mctl appropriately (see tcp_icmp_error). 8898 */ 8899 if (ipsec_mctl) 8900 mp = mp->b_cont; 8901 8902 mp_size = MBLKL(mp); 8903 8904 /* 8905 * Verify that we have a complete IP header. If not, send it upstream. 8906 */ 8907 if (mp_size < sizeof (ip6_t)) { 8908 noticmpv6: 8909 freemsg(first_mp); 8910 return; 8911 } 8912 8913 /* 8914 * Verify this is an ICMPV6 packet, else send it upstream. 8915 */ 8916 ip6h = (ip6_t *)mp->b_rptr; 8917 if (ip6h->ip6_nxt == IPPROTO_ICMPV6) { 8918 iph_hdr_length = IPV6_HDR_LEN; 8919 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, 8920 &nexthdrp) || 8921 *nexthdrp != IPPROTO_ICMPV6) { 8922 goto noticmpv6; 8923 } 8924 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 8925 ip6h = (ip6_t *)&icmp6[1]; 8926 /* 8927 * Verify if we have a complete ICMP and inner IP header. 8928 */ 8929 if ((uchar_t *)&ip6h[1] > mp->b_wptr) 8930 goto noticmpv6; 8931 8932 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 8933 goto noticmpv6; 8934 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 8935 /* 8936 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 8937 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 8938 * packet. 8939 */ 8940 if ((*nexthdrp != IPPROTO_TCP) || 8941 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 8942 goto noticmpv6; 8943 } 8944 8945 /* 8946 * ICMP errors come on the right queue or come on 8947 * listener/global queue for detached connections and 8948 * get switched to the right queue. If it comes on the 8949 * right queue, policy check has already been done by IP 8950 * and thus free the first_mp without verifying the policy. 8951 * If it has come for a non-hard bound connection, we need 8952 * to verify policy as IP may not have done it. 8953 */ 8954 if (!tcp->tcp_hard_bound) { 8955 if (ipsec_mctl) { 8956 secure = ipsec_in_is_secure(first_mp); 8957 } else { 8958 secure = B_FALSE; 8959 } 8960 if (secure) { 8961 /* 8962 * If we are willing to accept this in clear 8963 * we don't have to verify policy. 8964 */ 8965 if (!ipsec_inbound_accept_clear(mp, NULL, ip6h)) { 8966 if (!tcp_check_policy(tcp, first_mp, 8967 NULL, ip6h, secure, ipsec_mctl)) { 8968 /* 8969 * tcp_check_policy called 8970 * ip_drop_packet() on failure. 8971 */ 8972 return; 8973 } 8974 } 8975 } 8976 } else if (ipsec_mctl) { 8977 /* 8978 * This is a hard_bound connection. IP has already 8979 * verified policy. We don't have to do it again. 8980 */ 8981 freeb(first_mp); 8982 first_mp = mp; 8983 ipsec_mctl = B_FALSE; 8984 } 8985 8986 seg_ack = ntohl(tcpha->tha_ack); 8987 seg_seq = ntohl(tcpha->tha_seq); 8988 /* 8989 * TCP SHOULD check that the TCP sequence number contained in 8990 * payload of the ICMP error message is within the range 8991 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8992 */ 8993 if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8994 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8995 /* 8996 * If the ICMP message is bogus, should we kill the 8997 * connection, or should we just drop the bogus ICMP 8998 * message? It would probably make more sense to just 8999 * drop the message so that if this one managed to get 9000 * in, the real connection should not suffer. 9001 */ 9002 goto noticmpv6; 9003 } 9004 9005 switch (icmp6->icmp6_type) { 9006 case ICMP6_PACKET_TOO_BIG: 9007 /* 9008 * Reduce the MSS based on the new MTU. This will 9009 * eliminate any fragmentation locally. 9010 * N.B. There may well be some funny side-effects on 9011 * the local send policy and the remote receive policy. 9012 * Pending further research, we provide 9013 * tcp_ignore_path_mtu just in case this proves 9014 * disastrous somewhere. 9015 * 9016 * After updating the MSS, retransmit part of the 9017 * dropped segment using the new mss by calling 9018 * tcp_wput_data(). Need to adjust all those 9019 * params to make sure tcp_wput_data() work properly. 9020 */ 9021 if (tcp_ignore_path_mtu) 9022 break; 9023 9024 /* 9025 * Decrease the MSS by time stamp options 9026 * IP options and IPSEC options. tcp_hdr_len 9027 * includes time stamp option and IP option 9028 * length. 9029 */ 9030 new_mss = ntohs(icmp6->icmp6_mtu) - tcp->tcp_hdr_len - 9031 tcp->tcp_ipsec_overhead; 9032 9033 /* 9034 * Only update the MSS if the new one is 9035 * smaller than the previous one. This is 9036 * to avoid problems when getting multiple 9037 * ICMP errors for the same MTU. 9038 */ 9039 if (new_mss >= tcp->tcp_mss) 9040 break; 9041 9042 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 9043 ASSERT(ratio >= 1); 9044 tcp_mss_set(tcp, new_mss); 9045 9046 /* 9047 * Make sure we have something to 9048 * send. 9049 */ 9050 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 9051 (tcp->tcp_xmit_head != NULL)) { 9052 /* 9053 * Shrink tcp_cwnd in 9054 * proportion to the old MSS/new MSS. 9055 */ 9056 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 9057 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 9058 (tcp->tcp_unsent == 0)) { 9059 tcp->tcp_rexmit_max = tcp->tcp_fss; 9060 } else { 9061 tcp->tcp_rexmit_max = tcp->tcp_snxt; 9062 } 9063 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 9064 tcp->tcp_rexmit = B_TRUE; 9065 tcp->tcp_dupack_cnt = 0; 9066 tcp->tcp_snd_burst = TCP_CWND_SS; 9067 tcp_ss_rexmit(tcp); 9068 } 9069 break; 9070 9071 case ICMP6_DST_UNREACH: 9072 switch (icmp6->icmp6_code) { 9073 case ICMP6_DST_UNREACH_NOPORT: 9074 if (((tcp->tcp_state == TCPS_SYN_SENT) || 9075 (tcp->tcp_state == TCPS_SYN_RCVD)) && 9076 (tcpha->tha_seq == tcp->tcp_iss)) { 9077 (void) tcp_clean_death(tcp, 9078 ECONNREFUSED, 8); 9079 } 9080 break; 9081 9082 case ICMP6_DST_UNREACH_ADMIN: 9083 case ICMP6_DST_UNREACH_NOROUTE: 9084 case ICMP6_DST_UNREACH_BEYONDSCOPE: 9085 case ICMP6_DST_UNREACH_ADDR: 9086 /* Record the error in case we finally time out. */ 9087 tcp->tcp_client_errno = EHOSTUNREACH; 9088 if (((tcp->tcp_state == TCPS_SYN_SENT) || 9089 (tcp->tcp_state == TCPS_SYN_RCVD)) && 9090 (tcpha->tha_seq == tcp->tcp_iss)) { 9091 if (tcp->tcp_listener != NULL && 9092 tcp->tcp_listener->tcp_syn_defense) { 9093 /* 9094 * Ditch the half-open connection if we 9095 * suspect a SYN attack is under way. 9096 */ 9097 tcp_ip_ire_mark_advice(tcp); 9098 (void) tcp_clean_death(tcp, 9099 tcp->tcp_client_errno, 9); 9100 } 9101 } 9102 9103 9104 break; 9105 default: 9106 break; 9107 } 9108 break; 9109 9110 case ICMP6_PARAM_PROB: 9111 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 9112 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 9113 (uchar_t *)ip6h + icmp6->icmp6_pptr == 9114 (uchar_t *)nexthdrp) { 9115 if (tcp->tcp_state == TCPS_SYN_SENT || 9116 tcp->tcp_state == TCPS_SYN_RCVD) { 9117 (void) tcp_clean_death(tcp, 9118 ECONNREFUSED, 10); 9119 } 9120 break; 9121 } 9122 break; 9123 9124 case ICMP6_TIME_EXCEEDED: 9125 default: 9126 break; 9127 } 9128 freemsg(first_mp); 9129 } 9130 9131 /* 9132 * IP recognizes seven kinds of bind requests: 9133 * 9134 * - A zero-length address binds only to the protocol number. 9135 * 9136 * - A 4-byte address is treated as a request to 9137 * validate that the address is a valid local IPv4 9138 * address, appropriate for an application to bind to. 9139 * IP does the verification, but does not make any note 9140 * of the address at this time. 9141 * 9142 * - A 16-byte address contains is treated as a request 9143 * to validate a local IPv6 address, as the 4-byte 9144 * address case above. 9145 * 9146 * - A 16-byte sockaddr_in to validate the local IPv4 address and also 9147 * use it for the inbound fanout of packets. 9148 * 9149 * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also 9150 * use it for the inbound fanout of packets. 9151 * 9152 * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout 9153 * information consisting of local and remote addresses 9154 * and ports. In this case, the addresses are both 9155 * validated as appropriate for this operation, and, if 9156 * so, the information is retained for use in the 9157 * inbound fanout. 9158 * 9159 * - A 36-byte address address (ipa6_conn_t) containing complete IPv6 9160 * fanout information, like the 12-byte case above. 9161 * 9162 * IP will also fill in the IRE request mblk with information 9163 * regarding our peer. In all cases, we notify IP of our protocol 9164 * type by appending a single protocol byte to the bind request. 9165 */ 9166 static mblk_t * 9167 tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length) 9168 { 9169 char *cp; 9170 mblk_t *mp; 9171 struct T_bind_req *tbr; 9172 ipa_conn_t *ac; 9173 ipa6_conn_t *ac6; 9174 sin_t *sin; 9175 sin6_t *sin6; 9176 9177 ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ); 9178 ASSERT((tcp->tcp_family == AF_INET && 9179 tcp->tcp_ipversion == IPV4_VERSION) || 9180 (tcp->tcp_family == AF_INET6 && 9181 (tcp->tcp_ipversion == IPV4_VERSION || 9182 tcp->tcp_ipversion == IPV6_VERSION))); 9183 9184 mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI); 9185 if (!mp) 9186 return (mp); 9187 mp->b_datap->db_type = M_PROTO; 9188 tbr = (struct T_bind_req *)mp->b_rptr; 9189 tbr->PRIM_type = bind_prim; 9190 tbr->ADDR_offset = sizeof (*tbr); 9191 tbr->CONIND_number = 0; 9192 tbr->ADDR_length = addr_length; 9193 cp = (char *)&tbr[1]; 9194 switch (addr_length) { 9195 case sizeof (ipa_conn_t): 9196 ASSERT(tcp->tcp_family == AF_INET); 9197 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 9198 9199 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 9200 if (mp->b_cont == NULL) { 9201 freemsg(mp); 9202 return (NULL); 9203 } 9204 mp->b_cont->b_wptr += sizeof (ire_t); 9205 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 9206 9207 /* cp known to be 32 bit aligned */ 9208 ac = (ipa_conn_t *)cp; 9209 ac->ac_laddr = tcp->tcp_ipha->ipha_src; 9210 ac->ac_faddr = tcp->tcp_remote; 9211 ac->ac_fport = tcp->tcp_fport; 9212 ac->ac_lport = tcp->tcp_lport; 9213 tcp->tcp_hard_binding = 1; 9214 break; 9215 9216 case sizeof (ipa6_conn_t): 9217 ASSERT(tcp->tcp_family == AF_INET6); 9218 9219 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 9220 if (mp->b_cont == NULL) { 9221 freemsg(mp); 9222 return (NULL); 9223 } 9224 mp->b_cont->b_wptr += sizeof (ire_t); 9225 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 9226 9227 /* cp known to be 32 bit aligned */ 9228 ac6 = (ipa6_conn_t *)cp; 9229 if (tcp->tcp_ipversion == IPV4_VERSION) { 9230 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 9231 &ac6->ac6_laddr); 9232 } else { 9233 ac6->ac6_laddr = tcp->tcp_ip6h->ip6_src; 9234 } 9235 ac6->ac6_faddr = tcp->tcp_remote_v6; 9236 ac6->ac6_fport = tcp->tcp_fport; 9237 ac6->ac6_lport = tcp->tcp_lport; 9238 tcp->tcp_hard_binding = 1; 9239 break; 9240 9241 case sizeof (sin_t): 9242 /* 9243 * NOTE: IPV6_ADDR_LEN also has same size. 9244 * Use family to discriminate. 9245 */ 9246 if (tcp->tcp_family == AF_INET) { 9247 sin = (sin_t *)cp; 9248 9249 *sin = sin_null; 9250 sin->sin_family = AF_INET; 9251 sin->sin_addr.s_addr = tcp->tcp_bound_source; 9252 sin->sin_port = tcp->tcp_lport; 9253 break; 9254 } else { 9255 *(in6_addr_t *)cp = tcp->tcp_bound_source_v6; 9256 } 9257 break; 9258 9259 case sizeof (sin6_t): 9260 ASSERT(tcp->tcp_family == AF_INET6); 9261 sin6 = (sin6_t *)cp; 9262 9263 *sin6 = sin6_null; 9264 sin6->sin6_family = AF_INET6; 9265 sin6->sin6_addr = tcp->tcp_bound_source_v6; 9266 sin6->sin6_port = tcp->tcp_lport; 9267 break; 9268 9269 case IP_ADDR_LEN: 9270 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 9271 *(uint32_t *)cp = tcp->tcp_ipha->ipha_src; 9272 break; 9273 9274 } 9275 /* Add protocol number to end */ 9276 cp[addr_length] = (char)IPPROTO_TCP; 9277 mp->b_wptr = (uchar_t *)&cp[addr_length + 1]; 9278 return (mp); 9279 } 9280 9281 /* 9282 * Notify IP that we are having trouble with this connection. IP should 9283 * blow the IRE away and start over. 9284 */ 9285 static void 9286 tcp_ip_notify(tcp_t *tcp) 9287 { 9288 struct iocblk *iocp; 9289 ipid_t *ipid; 9290 mblk_t *mp; 9291 9292 /* IPv6 has NUD thus notification to delete the IRE is not needed */ 9293 if (tcp->tcp_ipversion == IPV6_VERSION) 9294 return; 9295 9296 mp = mkiocb(IP_IOCTL); 9297 if (mp == NULL) 9298 return; 9299 9300 iocp = (struct iocblk *)mp->b_rptr; 9301 iocp->ioc_count = sizeof (ipid_t) + sizeof (tcp->tcp_ipha->ipha_dst); 9302 9303 mp->b_cont = allocb(iocp->ioc_count, BPRI_HI); 9304 if (!mp->b_cont) { 9305 freeb(mp); 9306 return; 9307 } 9308 9309 ipid = (ipid_t *)mp->b_cont->b_rptr; 9310 mp->b_cont->b_wptr += iocp->ioc_count; 9311 bzero(ipid, sizeof (*ipid)); 9312 ipid->ipid_cmd = IP_IOC_IRE_DELETE_NO_REPLY; 9313 ipid->ipid_ire_type = IRE_CACHE; 9314 ipid->ipid_addr_offset = sizeof (ipid_t); 9315 ipid->ipid_addr_length = sizeof (tcp->tcp_ipha->ipha_dst); 9316 /* 9317 * Note: in the case of source routing we want to blow away the 9318 * route to the first source route hop. 9319 */ 9320 bcopy(&tcp->tcp_ipha->ipha_dst, &ipid[1], 9321 sizeof (tcp->tcp_ipha->ipha_dst)); 9322 9323 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 9324 } 9325 9326 /* Unlink and return any mblk that looks like it contains an ire */ 9327 static mblk_t * 9328 tcp_ire_mp(mblk_t *mp) 9329 { 9330 mblk_t *prev_mp; 9331 9332 for (;;) { 9333 prev_mp = mp; 9334 mp = mp->b_cont; 9335 if (mp == NULL) 9336 break; 9337 switch (DB_TYPE(mp)) { 9338 case IRE_DB_TYPE: 9339 case IRE_DB_REQ_TYPE: 9340 if (prev_mp != NULL) 9341 prev_mp->b_cont = mp->b_cont; 9342 mp->b_cont = NULL; 9343 return (mp); 9344 default: 9345 break; 9346 } 9347 } 9348 return (mp); 9349 } 9350 9351 /* 9352 * Timer callback routine for keepalive probe. We do a fake resend of 9353 * last ACKed byte. Then set a timer using RTO. When the timer expires, 9354 * check to see if we have heard anything from the other end for the last 9355 * RTO period. If we have, set the timer to expire for another 9356 * tcp_keepalive_intrvl and check again. If we have not, set a timer using 9357 * RTO << 1 and check again when it expires. Keep exponentially increasing 9358 * the timeout if we have not heard from the other side. If for more than 9359 * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything, 9360 * kill the connection unless the keepalive abort threshold is 0. In 9361 * that case, we will probe "forever." 9362 */ 9363 static void 9364 tcp_keepalive_killer(void *arg) 9365 { 9366 mblk_t *mp; 9367 conn_t *connp = (conn_t *)arg; 9368 tcp_t *tcp = connp->conn_tcp; 9369 int32_t firetime; 9370 int32_t idletime; 9371 int32_t ka_intrvl; 9372 9373 tcp->tcp_ka_tid = 0; 9374 9375 if (tcp->tcp_fused) 9376 return; 9377 9378 BUMP_MIB(&tcp_mib, tcpTimKeepalive); 9379 ka_intrvl = tcp->tcp_ka_interval; 9380 9381 /* 9382 * Keepalive probe should only be sent if the application has not 9383 * done a close on the connection. 9384 */ 9385 if (tcp->tcp_state > TCPS_CLOSE_WAIT) { 9386 return; 9387 } 9388 /* Timer fired too early, restart it. */ 9389 if (tcp->tcp_state < TCPS_ESTABLISHED) { 9390 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9391 MSEC_TO_TICK(ka_intrvl)); 9392 return; 9393 } 9394 9395 idletime = TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time); 9396 /* 9397 * If we have not heard from the other side for a long 9398 * time, kill the connection unless the keepalive abort 9399 * threshold is 0. In that case, we will probe "forever." 9400 */ 9401 if (tcp->tcp_ka_abort_thres != 0 && 9402 idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) { 9403 BUMP_MIB(&tcp_mib, tcpTimKeepaliveDrop); 9404 (void) tcp_clean_death(tcp, tcp->tcp_client_errno ? 9405 tcp->tcp_client_errno : ETIMEDOUT, 11); 9406 return; 9407 } 9408 9409 if (tcp->tcp_snxt == tcp->tcp_suna && 9410 idletime >= ka_intrvl) { 9411 /* Fake resend of last ACKed byte. */ 9412 mblk_t *mp1 = allocb(1, BPRI_LO); 9413 9414 if (mp1 != NULL) { 9415 *mp1->b_wptr++ = '\0'; 9416 mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL, 9417 tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE); 9418 freeb(mp1); 9419 /* 9420 * if allocation failed, fall through to start the 9421 * timer back. 9422 */ 9423 if (mp != NULL) { 9424 TCP_RECORD_TRACE(tcp, mp, 9425 TCP_TRACE_SEND_PKT); 9426 tcp_send_data(tcp, tcp->tcp_wq, mp); 9427 BUMP_MIB(&tcp_mib, tcpTimKeepaliveProbe); 9428 if (tcp->tcp_ka_last_intrvl != 0) { 9429 /* 9430 * We should probe again at least 9431 * in ka_intrvl, but not more than 9432 * tcp_rexmit_interval_max. 9433 */ 9434 firetime = MIN(ka_intrvl - 1, 9435 tcp->tcp_ka_last_intrvl << 1); 9436 if (firetime > tcp_rexmit_interval_max) 9437 firetime = 9438 tcp_rexmit_interval_max; 9439 } else { 9440 firetime = tcp->tcp_rto; 9441 } 9442 tcp->tcp_ka_tid = TCP_TIMER(tcp, 9443 tcp_keepalive_killer, 9444 MSEC_TO_TICK(firetime)); 9445 tcp->tcp_ka_last_intrvl = firetime; 9446 return; 9447 } 9448 } 9449 } else { 9450 tcp->tcp_ka_last_intrvl = 0; 9451 } 9452 9453 /* firetime can be negative if (mp1 == NULL || mp == NULL) */ 9454 if ((firetime = ka_intrvl - idletime) < 0) { 9455 firetime = ka_intrvl; 9456 } 9457 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9458 MSEC_TO_TICK(firetime)); 9459 } 9460 9461 static int 9462 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 9463 { 9464 queue_t *q = tcp->tcp_rq; 9465 int32_t mss = tcp->tcp_mss; 9466 int maxpsz; 9467 9468 if (TCP_IS_DETACHED(tcp)) 9469 return (mss); 9470 9471 if (tcp->tcp_mdt || tcp->tcp_maxpsz == 0) { 9472 /* 9473 * Set the sd_qn_maxpsz according to the socket send buffer 9474 * size, and sd_maxblk to INFPSZ (-1). This will essentially 9475 * instruct the stream head to copyin user data into contiguous 9476 * kernel-allocated buffers without breaking it up into smaller 9477 * chunks. We round up the buffer size to the nearest SMSS. 9478 */ 9479 maxpsz = MSS_ROUNDUP(tcp->tcp_xmit_hiwater, mss); 9480 mss = INFPSZ; 9481 } else { 9482 /* 9483 * Set sd_qn_maxpsz to approx half the (receivers) buffer 9484 * (and a multiple of the mss). This instructs the stream 9485 * head to break down larger than SMSS writes into SMSS- 9486 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 9487 */ 9488 maxpsz = tcp->tcp_maxpsz * mss; 9489 if (maxpsz > tcp->tcp_xmit_hiwater/2) { 9490 maxpsz = tcp->tcp_xmit_hiwater/2; 9491 /* Round up to nearest mss */ 9492 maxpsz = MSS_ROUNDUP(maxpsz, mss); 9493 } 9494 } 9495 (void) setmaxps(q, maxpsz); 9496 tcp->tcp_wq->q_maxpsz = maxpsz; 9497 9498 if (set_maxblk) 9499 (void) mi_set_sth_maxblk(q, mss); 9500 9501 if (tcp->tcp_loopback) 9502 (void) mi_set_sth_copyopt(tcp->tcp_rq, COPYCACHED); 9503 9504 return (mss); 9505 } 9506 9507 /* 9508 * Extract option values from a tcp header. We put any found values into the 9509 * tcpopt struct and return a bitmask saying which options were found. 9510 */ 9511 static int 9512 tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt) 9513 { 9514 uchar_t *endp; 9515 int len; 9516 uint32_t mss; 9517 uchar_t *up = (uchar_t *)tcph; 9518 int found = 0; 9519 int32_t sack_len; 9520 tcp_seq sack_begin, sack_end; 9521 tcp_t *tcp; 9522 9523 endp = up + TCP_HDR_LENGTH(tcph); 9524 up += TCP_MIN_HEADER_LENGTH; 9525 while (up < endp) { 9526 len = endp - up; 9527 switch (*up) { 9528 case TCPOPT_EOL: 9529 break; 9530 9531 case TCPOPT_NOP: 9532 up++; 9533 continue; 9534 9535 case TCPOPT_MAXSEG: 9536 if (len < TCPOPT_MAXSEG_LEN || 9537 up[1] != TCPOPT_MAXSEG_LEN) 9538 break; 9539 9540 mss = BE16_TO_U16(up+2); 9541 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 9542 tcpopt->tcp_opt_mss = mss; 9543 found |= TCP_OPT_MSS_PRESENT; 9544 9545 up += TCPOPT_MAXSEG_LEN; 9546 continue; 9547 9548 case TCPOPT_WSCALE: 9549 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 9550 break; 9551 9552 if (up[2] > TCP_MAX_WINSHIFT) 9553 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 9554 else 9555 tcpopt->tcp_opt_wscale = up[2]; 9556 found |= TCP_OPT_WSCALE_PRESENT; 9557 9558 up += TCPOPT_WS_LEN; 9559 continue; 9560 9561 case TCPOPT_SACK_PERMITTED: 9562 if (len < TCPOPT_SACK_OK_LEN || 9563 up[1] != TCPOPT_SACK_OK_LEN) 9564 break; 9565 found |= TCP_OPT_SACK_OK_PRESENT; 9566 up += TCPOPT_SACK_OK_LEN; 9567 continue; 9568 9569 case TCPOPT_SACK: 9570 if (len <= 2 || up[1] <= 2 || len < up[1]) 9571 break; 9572 9573 /* If TCP is not interested in SACK blks... */ 9574 if ((tcp = tcpopt->tcp) == NULL) { 9575 up += up[1]; 9576 continue; 9577 } 9578 sack_len = up[1] - TCPOPT_HEADER_LEN; 9579 up += TCPOPT_HEADER_LEN; 9580 9581 /* 9582 * If the list is empty, allocate one and assume 9583 * nothing is sack'ed. 9584 */ 9585 ASSERT(tcp->tcp_sack_info != NULL); 9586 if (tcp->tcp_notsack_list == NULL) { 9587 tcp_notsack_update(&(tcp->tcp_notsack_list), 9588 tcp->tcp_suna, tcp->tcp_snxt, 9589 &(tcp->tcp_num_notsack_blk), 9590 &(tcp->tcp_cnt_notsack_list)); 9591 9592 /* 9593 * Make sure tcp_notsack_list is not NULL. 9594 * This happens when kmem_alloc(KM_NOSLEEP) 9595 * returns NULL. 9596 */ 9597 if (tcp->tcp_notsack_list == NULL) { 9598 up += sack_len; 9599 continue; 9600 } 9601 tcp->tcp_fack = tcp->tcp_suna; 9602 } 9603 9604 while (sack_len > 0) { 9605 if (up + 8 > endp) { 9606 up = endp; 9607 break; 9608 } 9609 sack_begin = BE32_TO_U32(up); 9610 up += 4; 9611 sack_end = BE32_TO_U32(up); 9612 up += 4; 9613 sack_len -= 8; 9614 /* 9615 * Bounds checking. Make sure the SACK 9616 * info is within tcp_suna and tcp_snxt. 9617 * If this SACK blk is out of bound, ignore 9618 * it but continue to parse the following 9619 * blks. 9620 */ 9621 if (SEQ_LEQ(sack_end, sack_begin) || 9622 SEQ_LT(sack_begin, tcp->tcp_suna) || 9623 SEQ_GT(sack_end, tcp->tcp_snxt)) { 9624 continue; 9625 } 9626 tcp_notsack_insert(&(tcp->tcp_notsack_list), 9627 sack_begin, sack_end, 9628 &(tcp->tcp_num_notsack_blk), 9629 &(tcp->tcp_cnt_notsack_list)); 9630 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 9631 tcp->tcp_fack = sack_end; 9632 } 9633 } 9634 found |= TCP_OPT_SACK_PRESENT; 9635 continue; 9636 9637 case TCPOPT_TSTAMP: 9638 if (len < TCPOPT_TSTAMP_LEN || 9639 up[1] != TCPOPT_TSTAMP_LEN) 9640 break; 9641 9642 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 9643 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 9644 9645 found |= TCP_OPT_TSTAMP_PRESENT; 9646 9647 up += TCPOPT_TSTAMP_LEN; 9648 continue; 9649 9650 default: 9651 if (len <= 1 || len < (int)up[1] || up[1] == 0) 9652 break; 9653 up += up[1]; 9654 continue; 9655 } 9656 break; 9657 } 9658 return (found); 9659 } 9660 9661 /* 9662 * Set the mss associated with a particular tcp based on its current value, 9663 * and a new one passed in. Observe minimums and maximums, and reset 9664 * other state variables that we want to view as multiples of mss. 9665 * 9666 * This function is called in various places mainly because 9667 * 1) Various stuffs, tcp_mss, tcp_cwnd, ... need to be adjusted when the 9668 * other side's SYN/SYN-ACK packet arrives. 9669 * 2) PMTUd may get us a new MSS. 9670 * 3) If the other side stops sending us timestamp option, we need to 9671 * increase the MSS size to use the extra bytes available. 9672 */ 9673 static void 9674 tcp_mss_set(tcp_t *tcp, uint32_t mss) 9675 { 9676 uint32_t mss_max; 9677 9678 if (tcp->tcp_ipversion == IPV4_VERSION) 9679 mss_max = tcp_mss_max_ipv4; 9680 else 9681 mss_max = tcp_mss_max_ipv6; 9682 9683 if (mss < tcp_mss_min) 9684 mss = tcp_mss_min; 9685 if (mss > mss_max) 9686 mss = mss_max; 9687 /* 9688 * Unless naglim has been set by our client to 9689 * a non-mss value, force naglim to track mss. 9690 * This can help to aggregate small writes. 9691 */ 9692 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 9693 tcp->tcp_naglim = mss; 9694 /* 9695 * TCP should be able to buffer at least 4 MSS data for obvious 9696 * performance reason. 9697 */ 9698 if ((mss << 2) > tcp->tcp_xmit_hiwater) 9699 tcp->tcp_xmit_hiwater = mss << 2; 9700 9701 /* 9702 * Check if we need to apply the tcp_init_cwnd here. If 9703 * it is set and the MSS gets bigger (should not happen 9704 * normally), we need to adjust the resulting tcp_cwnd properly. 9705 * The new tcp_cwnd should not get bigger. 9706 */ 9707 if (tcp->tcp_init_cwnd == 0) { 9708 tcp->tcp_cwnd = MIN(tcp_slow_start_initial * mss, 9709 MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss))); 9710 } else { 9711 if (tcp->tcp_mss < mss) { 9712 tcp->tcp_cwnd = MAX(1, 9713 (tcp->tcp_init_cwnd * tcp->tcp_mss / mss)) * mss; 9714 } else { 9715 tcp->tcp_cwnd = tcp->tcp_init_cwnd * mss; 9716 } 9717 } 9718 tcp->tcp_mss = mss; 9719 tcp->tcp_cwnd_cnt = 0; 9720 (void) tcp_maxpsz_set(tcp, B_TRUE); 9721 } 9722 9723 static int 9724 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 9725 { 9726 tcp_t *tcp = NULL; 9727 conn_t *connp; 9728 int err; 9729 dev_t conn_dev; 9730 zoneid_t zoneid = getzoneid(); 9731 9732 if (q->q_ptr != NULL) 9733 return (0); 9734 9735 if (sflag == MODOPEN) { 9736 /* 9737 * This is a special case. The purpose of a modopen 9738 * is to allow just the T_SVR4_OPTMGMT_REQ to pass 9739 * through for MIB browsers. Everything else is failed. 9740 */ 9741 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9742 9743 if (connp == NULL) 9744 return (ENOMEM); 9745 9746 connp->conn_flags |= IPCL_TCPMOD; 9747 connp->conn_cred = credp; 9748 connp->conn_zoneid = zoneid; 9749 q->q_ptr = WR(q)->q_ptr = connp; 9750 crhold(credp); 9751 q->q_qinfo = &tcp_mod_rinit; 9752 WR(q)->q_qinfo = &tcp_mod_winit; 9753 qprocson(q); 9754 return (0); 9755 } 9756 9757 if ((conn_dev = inet_minor_alloc(ip_minor_arena)) == 0) 9758 return (EBUSY); 9759 9760 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 9761 9762 if (flag & SO_ACCEPTOR) { 9763 q->q_qinfo = &tcp_acceptor_rinit; 9764 q->q_ptr = (void *)conn_dev; 9765 WR(q)->q_qinfo = &tcp_acceptor_winit; 9766 WR(q)->q_ptr = (void *)conn_dev; 9767 qprocson(q); 9768 return (0); 9769 } 9770 9771 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9772 if (connp == NULL) { 9773 inet_minor_free(ip_minor_arena, conn_dev); 9774 q->q_ptr = NULL; 9775 return (ENOSR); 9776 } 9777 connp->conn_sqp = IP_SQUEUE_GET(lbolt); 9778 tcp = connp->conn_tcp; 9779 9780 q->q_ptr = WR(q)->q_ptr = connp; 9781 if (getmajor(*devp) == TCP6_MAJ) { 9782 connp->conn_flags |= (IPCL_TCP6|IPCL_ISV6); 9783 connp->conn_send = ip_output_v6; 9784 connp->conn_af_isv6 = B_TRUE; 9785 connp->conn_pkt_isv6 = B_TRUE; 9786 connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT; 9787 tcp->tcp_ipversion = IPV6_VERSION; 9788 tcp->tcp_family = AF_INET6; 9789 tcp->tcp_mss = tcp_mss_def_ipv6; 9790 } else { 9791 connp->conn_flags |= IPCL_TCP4; 9792 connp->conn_send = ip_output; 9793 connp->conn_af_isv6 = B_FALSE; 9794 connp->conn_pkt_isv6 = B_FALSE; 9795 tcp->tcp_ipversion = IPV4_VERSION; 9796 tcp->tcp_family = AF_INET; 9797 tcp->tcp_mss = tcp_mss_def_ipv4; 9798 } 9799 9800 /* 9801 * TCP keeps a copy of cred for cache locality reasons but 9802 * we put a reference only once. If connp->conn_cred 9803 * becomes invalid, tcp_cred should also be set to NULL. 9804 */ 9805 tcp->tcp_cred = connp->conn_cred = credp; 9806 crhold(connp->conn_cred); 9807 tcp->tcp_cpid = curproc->p_pid; 9808 connp->conn_zoneid = zoneid; 9809 9810 connp->conn_dev = conn_dev; 9811 9812 ASSERT(q->q_qinfo == &tcp_rinit); 9813 ASSERT(WR(q)->q_qinfo == &tcp_winit); 9814 9815 if (flag & SO_SOCKSTR) { 9816 /* 9817 * No need to insert a socket in tcp acceptor hash. 9818 * If it was a socket acceptor stream, we dealt with 9819 * it above. A socket listener can never accept a 9820 * connection and doesn't need acceptor_id. 9821 */ 9822 connp->conn_flags |= IPCL_SOCKET; 9823 tcp->tcp_issocket = 1; 9824 9825 WR(q)->q_qinfo = &tcp_sock_winit; 9826 } else { 9827 #ifdef _ILP32 9828 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 9829 #else 9830 tcp->tcp_acceptor_id = conn_dev; 9831 #endif /* _ILP32 */ 9832 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 9833 } 9834 9835 if (tcp_trace) 9836 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_SLEEP); 9837 9838 err = tcp_init(tcp, q); 9839 if (err != 0) { 9840 inet_minor_free(ip_minor_arena, connp->conn_dev); 9841 tcp_acceptor_hash_remove(tcp); 9842 CONN_DEC_REF(connp); 9843 q->q_ptr = WR(q)->q_ptr = NULL; 9844 return (err); 9845 } 9846 9847 RD(q)->q_hiwat = tcp_recv_hiwat; 9848 tcp->tcp_rwnd = tcp_recv_hiwat; 9849 9850 /* Non-zero default values */ 9851 connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 9852 /* 9853 * Put the ref for TCP. Ref for IP was already put 9854 * by ipcl_conn_create. Also Make the conn_t globally 9855 * visible to walkers 9856 */ 9857 mutex_enter(&connp->conn_lock); 9858 CONN_INC_REF_LOCKED(connp); 9859 ASSERT(connp->conn_ref == 2); 9860 connp->conn_state_flags &= ~CONN_INCIPIENT; 9861 mutex_exit(&connp->conn_lock); 9862 9863 qprocson(q); 9864 return (0); 9865 } 9866 9867 /* 9868 * Some TCP options can be "set" by requesting them in the option 9869 * buffer. This is needed for XTI feature test though we do not 9870 * allow it in general. We interpret that this mechanism is more 9871 * applicable to OSI protocols and need not be allowed in general. 9872 * This routine filters out options for which it is not allowed (most) 9873 * and lets through those (few) for which it is. [ The XTI interface 9874 * test suite specifics will imply that any XTI_GENERIC level XTI_* if 9875 * ever implemented will have to be allowed here ]. 9876 */ 9877 static boolean_t 9878 tcp_allow_connopt_set(int level, int name) 9879 { 9880 9881 switch (level) { 9882 case IPPROTO_TCP: 9883 switch (name) { 9884 case TCP_NODELAY: 9885 return (B_TRUE); 9886 default: 9887 return (B_FALSE); 9888 } 9889 /*NOTREACHED*/ 9890 default: 9891 return (B_FALSE); 9892 } 9893 /*NOTREACHED*/ 9894 } 9895 9896 /* 9897 * This routine gets default values of certain options whose default 9898 * values are maintained by protocol specific code 9899 */ 9900 /* ARGSUSED */ 9901 int 9902 tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr) 9903 { 9904 int32_t *i1 = (int32_t *)ptr; 9905 9906 switch (level) { 9907 case IPPROTO_TCP: 9908 switch (name) { 9909 case TCP_NOTIFY_THRESHOLD: 9910 *i1 = tcp_ip_notify_interval; 9911 break; 9912 case TCP_ABORT_THRESHOLD: 9913 *i1 = tcp_ip_abort_interval; 9914 break; 9915 case TCP_CONN_NOTIFY_THRESHOLD: 9916 *i1 = tcp_ip_notify_cinterval; 9917 break; 9918 case TCP_CONN_ABORT_THRESHOLD: 9919 *i1 = tcp_ip_abort_cinterval; 9920 break; 9921 default: 9922 return (-1); 9923 } 9924 break; 9925 case IPPROTO_IP: 9926 switch (name) { 9927 case IP_TTL: 9928 *i1 = tcp_ipv4_ttl; 9929 break; 9930 default: 9931 return (-1); 9932 } 9933 break; 9934 case IPPROTO_IPV6: 9935 switch (name) { 9936 case IPV6_UNICAST_HOPS: 9937 *i1 = tcp_ipv6_hoplimit; 9938 break; 9939 default: 9940 return (-1); 9941 } 9942 break; 9943 default: 9944 return (-1); 9945 } 9946 return (sizeof (int)); 9947 } 9948 9949 9950 /* 9951 * TCP routine to get the values of options. 9952 */ 9953 int 9954 tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 9955 { 9956 int *i1 = (int *)ptr; 9957 conn_t *connp = Q_TO_CONN(q); 9958 tcp_t *tcp = connp->conn_tcp; 9959 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 9960 9961 switch (level) { 9962 case SOL_SOCKET: 9963 switch (name) { 9964 case SO_LINGER: { 9965 struct linger *lgr = (struct linger *)ptr; 9966 9967 lgr->l_onoff = tcp->tcp_linger ? SO_LINGER : 0; 9968 lgr->l_linger = tcp->tcp_lingertime; 9969 } 9970 return (sizeof (struct linger)); 9971 case SO_DEBUG: 9972 *i1 = tcp->tcp_debug ? SO_DEBUG : 0; 9973 break; 9974 case SO_KEEPALIVE: 9975 *i1 = tcp->tcp_ka_enabled ? SO_KEEPALIVE : 0; 9976 break; 9977 case SO_DONTROUTE: 9978 *i1 = tcp->tcp_dontroute ? SO_DONTROUTE : 0; 9979 break; 9980 case SO_USELOOPBACK: 9981 *i1 = tcp->tcp_useloopback ? SO_USELOOPBACK : 0; 9982 break; 9983 case SO_BROADCAST: 9984 *i1 = tcp->tcp_broadcast ? SO_BROADCAST : 0; 9985 break; 9986 case SO_REUSEADDR: 9987 *i1 = tcp->tcp_reuseaddr ? SO_REUSEADDR : 0; 9988 break; 9989 case SO_OOBINLINE: 9990 *i1 = tcp->tcp_oobinline ? SO_OOBINLINE : 0; 9991 break; 9992 case SO_DGRAM_ERRIND: 9993 *i1 = tcp->tcp_dgram_errind ? SO_DGRAM_ERRIND : 0; 9994 break; 9995 case SO_TYPE: 9996 *i1 = SOCK_STREAM; 9997 break; 9998 case SO_SNDBUF: 9999 *i1 = tcp->tcp_xmit_hiwater; 10000 break; 10001 case SO_RCVBUF: 10002 *i1 = RD(q)->q_hiwat; 10003 break; 10004 case SO_SND_COPYAVOID: 10005 *i1 = tcp->tcp_snd_zcopy_on ? 10006 SO_SND_COPYAVOID : 0; 10007 break; 10008 default: 10009 return (-1); 10010 } 10011 break; 10012 case IPPROTO_TCP: 10013 switch (name) { 10014 case TCP_NODELAY: 10015 *i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0; 10016 break; 10017 case TCP_MAXSEG: 10018 *i1 = tcp->tcp_mss; 10019 break; 10020 case TCP_NOTIFY_THRESHOLD: 10021 *i1 = (int)tcp->tcp_first_timer_threshold; 10022 break; 10023 case TCP_ABORT_THRESHOLD: 10024 *i1 = tcp->tcp_second_timer_threshold; 10025 break; 10026 case TCP_CONN_NOTIFY_THRESHOLD: 10027 *i1 = tcp->tcp_first_ctimer_threshold; 10028 break; 10029 case TCP_CONN_ABORT_THRESHOLD: 10030 *i1 = tcp->tcp_second_ctimer_threshold; 10031 break; 10032 case TCP_RECVDSTADDR: 10033 *i1 = tcp->tcp_recvdstaddr; 10034 break; 10035 case TCP_ANONPRIVBIND: 10036 *i1 = tcp->tcp_anon_priv_bind; 10037 break; 10038 case TCP_EXCLBIND: 10039 *i1 = tcp->tcp_exclbind ? TCP_EXCLBIND : 0; 10040 break; 10041 case TCP_INIT_CWND: 10042 *i1 = tcp->tcp_init_cwnd; 10043 break; 10044 case TCP_KEEPALIVE_THRESHOLD: 10045 *i1 = tcp->tcp_ka_interval; 10046 break; 10047 case TCP_KEEPALIVE_ABORT_THRESHOLD: 10048 *i1 = tcp->tcp_ka_abort_thres; 10049 break; 10050 case TCP_CORK: 10051 *i1 = tcp->tcp_cork; 10052 break; 10053 default: 10054 return (-1); 10055 } 10056 break; 10057 case IPPROTO_IP: 10058 if (tcp->tcp_family != AF_INET) 10059 return (-1); 10060 switch (name) { 10061 case IP_OPTIONS: 10062 case T_IP_OPTIONS: { 10063 /* 10064 * This is compatible with BSD in that in only return 10065 * the reverse source route with the final destination 10066 * as the last entry. The first 4 bytes of the option 10067 * will contain the final destination. 10068 */ 10069 char *opt_ptr; 10070 int opt_len; 10071 opt_ptr = (char *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; 10072 opt_len = (char *)tcp->tcp_tcph - opt_ptr; 10073 /* Caller ensures enough space */ 10074 if (opt_len > 0) { 10075 /* 10076 * TODO: Do we have to handle getsockopt on an 10077 * initiator as well? 10078 */ 10079 return (tcp_opt_get_user(tcp->tcp_ipha, ptr)); 10080 } 10081 return (0); 10082 } 10083 case IP_TOS: 10084 case T_IP_TOS: 10085 *i1 = (int)tcp->tcp_ipha->ipha_type_of_service; 10086 break; 10087 case IP_TTL: 10088 *i1 = (int)tcp->tcp_ipha->ipha_ttl; 10089 break; 10090 default: 10091 return (-1); 10092 } 10093 break; 10094 case IPPROTO_IPV6: 10095 /* 10096 * IPPROTO_IPV6 options are only supported for sockets 10097 * that are using IPv6 on the wire. 10098 */ 10099 if (tcp->tcp_ipversion != IPV6_VERSION) { 10100 return (-1); 10101 } 10102 switch (name) { 10103 case IPV6_UNICAST_HOPS: 10104 *i1 = (unsigned int) tcp->tcp_ip6h->ip6_hops; 10105 break; /* goto sizeof (int) option return */ 10106 case IPV6_BOUND_IF: 10107 /* Zero if not set */ 10108 *i1 = tcp->tcp_bound_if; 10109 break; /* goto sizeof (int) option return */ 10110 case IPV6_RECVPKTINFO: 10111 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) 10112 *i1 = 1; 10113 else 10114 *i1 = 0; 10115 break; /* goto sizeof (int) option return */ 10116 case IPV6_RECVTCLASS: 10117 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS) 10118 *i1 = 1; 10119 else 10120 *i1 = 0; 10121 break; /* goto sizeof (int) option return */ 10122 case IPV6_RECVHOPLIMIT: 10123 if (tcp->tcp_ipv6_recvancillary & 10124 TCP_IPV6_RECVHOPLIMIT) 10125 *i1 = 1; 10126 else 10127 *i1 = 0; 10128 break; /* goto sizeof (int) option return */ 10129 case IPV6_RECVHOPOPTS: 10130 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) 10131 *i1 = 1; 10132 else 10133 *i1 = 0; 10134 break; /* goto sizeof (int) option return */ 10135 case IPV6_RECVDSTOPTS: 10136 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVDSTOPTS) 10137 *i1 = 1; 10138 else 10139 *i1 = 0; 10140 break; /* goto sizeof (int) option return */ 10141 case _OLD_IPV6_RECVDSTOPTS: 10142 if (tcp->tcp_ipv6_recvancillary & 10143 TCP_OLD_IPV6_RECVDSTOPTS) 10144 *i1 = 1; 10145 else 10146 *i1 = 0; 10147 break; /* goto sizeof (int) option return */ 10148 case IPV6_RECVRTHDR: 10149 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) 10150 *i1 = 1; 10151 else 10152 *i1 = 0; 10153 break; /* goto sizeof (int) option return */ 10154 case IPV6_RECVRTHDRDSTOPTS: 10155 if (tcp->tcp_ipv6_recvancillary & 10156 TCP_IPV6_RECVRTDSTOPTS) 10157 *i1 = 1; 10158 else 10159 *i1 = 0; 10160 break; /* goto sizeof (int) option return */ 10161 case IPV6_PKTINFO: { 10162 /* XXX assumes that caller has room for max size! */ 10163 struct in6_pktinfo *pkti; 10164 10165 pkti = (struct in6_pktinfo *)ptr; 10166 if (ipp->ipp_fields & IPPF_IFINDEX) 10167 pkti->ipi6_ifindex = ipp->ipp_ifindex; 10168 else 10169 pkti->ipi6_ifindex = 0; 10170 if (ipp->ipp_fields & IPPF_ADDR) 10171 pkti->ipi6_addr = ipp->ipp_addr; 10172 else 10173 pkti->ipi6_addr = ipv6_all_zeros; 10174 return (sizeof (struct in6_pktinfo)); 10175 } 10176 case IPV6_HOPLIMIT: 10177 if (ipp->ipp_fields & IPPF_HOPLIMIT) 10178 *i1 = ipp->ipp_hoplimit; 10179 else 10180 *i1 = -1; /* Not set */ 10181 break; /* goto sizeof (int) option return */ 10182 case IPV6_TCLASS: 10183 if (ipp->ipp_fields & IPPF_TCLASS) 10184 *i1 = ipp->ipp_tclass; 10185 else 10186 *i1 = IPV6_FLOW_TCLASS( 10187 IPV6_DEFAULT_VERS_AND_FLOW); 10188 break; /* goto sizeof (int) option return */ 10189 case IPV6_NEXTHOP: { 10190 sin6_t *sin6 = (sin6_t *)ptr; 10191 10192 if (!(ipp->ipp_fields & IPPF_NEXTHOP)) 10193 return (0); 10194 *sin6 = sin6_null; 10195 sin6->sin6_family = AF_INET6; 10196 sin6->sin6_addr = ipp->ipp_nexthop; 10197 return (sizeof (sin6_t)); 10198 } 10199 case IPV6_HOPOPTS: 10200 if (!(ipp->ipp_fields & IPPF_HOPOPTS)) 10201 return (0); 10202 bcopy(ipp->ipp_hopopts, ptr, ipp->ipp_hopoptslen); 10203 return (ipp->ipp_hopoptslen); 10204 case IPV6_RTHDRDSTOPTS: 10205 if (!(ipp->ipp_fields & IPPF_RTDSTOPTS)) 10206 return (0); 10207 bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen); 10208 return (ipp->ipp_rtdstoptslen); 10209 case IPV6_RTHDR: 10210 if (!(ipp->ipp_fields & IPPF_RTHDR)) 10211 return (0); 10212 bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen); 10213 return (ipp->ipp_rthdrlen); 10214 case IPV6_DSTOPTS: 10215 if (!(ipp->ipp_fields & IPPF_DSTOPTS)) 10216 return (0); 10217 bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen); 10218 return (ipp->ipp_dstoptslen); 10219 case IPV6_SRC_PREFERENCES: 10220 return (ip6_get_src_preferences(connp, 10221 (uint32_t *)ptr)); 10222 case IPV6_PATHMTU: { 10223 struct ip6_mtuinfo *mtuinfo = (struct ip6_mtuinfo *)ptr; 10224 10225 if (tcp->tcp_state < TCPS_ESTABLISHED) 10226 return (-1); 10227 10228 return (ip_fill_mtuinfo(&connp->conn_remv6, 10229 connp->conn_fport, mtuinfo)); 10230 } 10231 default: 10232 return (-1); 10233 } 10234 break; 10235 default: 10236 return (-1); 10237 } 10238 return (sizeof (int)); 10239 } 10240 10241 /* 10242 * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements. 10243 * Parameters are assumed to be verified by the caller. 10244 */ 10245 /* ARGSUSED */ 10246 int 10247 tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name, 10248 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 10249 void *thisdg_attrs, cred_t *cr, mblk_t *mblk) 10250 { 10251 tcp_t *tcp = Q_TO_TCP(q); 10252 int *i1 = (int *)invalp; 10253 boolean_t onoff = (*i1 == 0) ? 0 : 1; 10254 boolean_t checkonly; 10255 int reterr; 10256 10257 switch (optset_context) { 10258 case SETFN_OPTCOM_CHECKONLY: 10259 checkonly = B_TRUE; 10260 /* 10261 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 10262 * inlen != 0 implies value supplied and 10263 * we have to "pretend" to set it. 10264 * inlen == 0 implies that there is no 10265 * value part in T_CHECK request and just validation 10266 * done elsewhere should be enough, we just return here. 10267 */ 10268 if (inlen == 0) { 10269 *outlenp = 0; 10270 return (0); 10271 } 10272 break; 10273 case SETFN_OPTCOM_NEGOTIATE: 10274 checkonly = B_FALSE; 10275 break; 10276 case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */ 10277 case SETFN_CONN_NEGOTIATE: 10278 checkonly = B_FALSE; 10279 /* 10280 * Negotiating local and "association-related" options 10281 * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ) 10282 * primitives is allowed by XTI, but we choose 10283 * to not implement this style negotiation for Internet 10284 * protocols (We interpret it is a must for OSI world but 10285 * optional for Internet protocols) for all options. 10286 * [ Will do only for the few options that enable test 10287 * suites that our XTI implementation of this feature 10288 * works for transports that do allow it ] 10289 */ 10290 if (!tcp_allow_connopt_set(level, name)) { 10291 *outlenp = 0; 10292 return (EINVAL); 10293 } 10294 break; 10295 default: 10296 /* 10297 * We should never get here 10298 */ 10299 *outlenp = 0; 10300 return (EINVAL); 10301 } 10302 10303 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 10304 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 10305 10306 /* 10307 * For TCP, we should have no ancillary data sent down 10308 * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs 10309 * has to be zero. 10310 */ 10311 ASSERT(thisdg_attrs == NULL); 10312 10313 /* 10314 * For fixed length options, no sanity check 10315 * of passed in length is done. It is assumed *_optcom_req() 10316 * routines do the right thing. 10317 */ 10318 10319 switch (level) { 10320 case SOL_SOCKET: 10321 switch (name) { 10322 case SO_LINGER: { 10323 struct linger *lgr = (struct linger *)invalp; 10324 10325 if (!checkonly) { 10326 if (lgr->l_onoff) { 10327 tcp->tcp_linger = 1; 10328 tcp->tcp_lingertime = lgr->l_linger; 10329 } else { 10330 tcp->tcp_linger = 0; 10331 tcp->tcp_lingertime = 0; 10332 } 10333 /* struct copy */ 10334 *(struct linger *)outvalp = *lgr; 10335 } else { 10336 if (!lgr->l_onoff) { 10337 ((struct linger *)outvalp)->l_onoff = 0; 10338 ((struct linger *)outvalp)->l_linger = 0; 10339 } else { 10340 /* struct copy */ 10341 *(struct linger *)outvalp = *lgr; 10342 } 10343 } 10344 *outlenp = sizeof (struct linger); 10345 return (0); 10346 } 10347 case SO_DEBUG: 10348 if (!checkonly) 10349 tcp->tcp_debug = onoff; 10350 break; 10351 case SO_KEEPALIVE: 10352 if (checkonly) { 10353 /* T_CHECK case */ 10354 break; 10355 } 10356 10357 if (!onoff) { 10358 if (tcp->tcp_ka_enabled) { 10359 if (tcp->tcp_ka_tid != 0) { 10360 (void) TCP_TIMER_CANCEL(tcp, 10361 tcp->tcp_ka_tid); 10362 tcp->tcp_ka_tid = 0; 10363 } 10364 tcp->tcp_ka_enabled = 0; 10365 } 10366 break; 10367 } 10368 if (!tcp->tcp_ka_enabled) { 10369 /* Crank up the keepalive timer */ 10370 tcp->tcp_ka_last_intrvl = 0; 10371 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10372 tcp_keepalive_killer, 10373 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10374 tcp->tcp_ka_enabled = 1; 10375 } 10376 break; 10377 case SO_DONTROUTE: 10378 /* 10379 * SO_DONTROUTE, SO_USELOOPBACK and SO_BROADCAST are 10380 * only of interest to IP. We track them here only so 10381 * that we can report their current value. 10382 */ 10383 if (!checkonly) { 10384 tcp->tcp_dontroute = onoff; 10385 tcp->tcp_connp->conn_dontroute = onoff; 10386 } 10387 break; 10388 case SO_USELOOPBACK: 10389 if (!checkonly) { 10390 tcp->tcp_useloopback = onoff; 10391 tcp->tcp_connp->conn_loopback = onoff; 10392 } 10393 break; 10394 case SO_BROADCAST: 10395 if (!checkonly) { 10396 tcp->tcp_broadcast = onoff; 10397 tcp->tcp_connp->conn_broadcast = onoff; 10398 } 10399 break; 10400 case SO_REUSEADDR: 10401 if (!checkonly) { 10402 tcp->tcp_reuseaddr = onoff; 10403 tcp->tcp_connp->conn_reuseaddr = onoff; 10404 } 10405 break; 10406 case SO_OOBINLINE: 10407 if (!checkonly) 10408 tcp->tcp_oobinline = onoff; 10409 break; 10410 case SO_DGRAM_ERRIND: 10411 if (!checkonly) 10412 tcp->tcp_dgram_errind = onoff; 10413 break; 10414 case SO_SNDBUF: 10415 if (*i1 > tcp_max_buf) { 10416 *outlenp = 0; 10417 return (ENOBUFS); 10418 } 10419 if (!checkonly) { 10420 tcp->tcp_xmit_hiwater = *i1; 10421 if (tcp_snd_lowat_fraction != 0) 10422 tcp->tcp_xmit_lowater = 10423 tcp->tcp_xmit_hiwater / 10424 tcp_snd_lowat_fraction; 10425 (void) tcp_maxpsz_set(tcp, B_TRUE); 10426 /* 10427 * If we are flow-controlled, recheck the 10428 * condition. There are apps that increase 10429 * SO_SNDBUF size when flow-controlled 10430 * (EWOULDBLOCK), and expect the flow control 10431 * condition to be lifted right away. 10432 */ 10433 if (tcp->tcp_flow_stopped && 10434 tcp->tcp_unsent < tcp->tcp_xmit_hiwater) { 10435 tcp->tcp_flow_stopped = B_FALSE; 10436 tcp_clrqfull(tcp); 10437 } 10438 } 10439 break; 10440 case SO_RCVBUF: 10441 if (*i1 > tcp_max_buf) { 10442 *outlenp = 0; 10443 return (ENOBUFS); 10444 } 10445 /* Silently ignore zero */ 10446 if (!checkonly && *i1 != 0) { 10447 *i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss); 10448 (void) tcp_rwnd_set(tcp, *i1); 10449 } 10450 /* 10451 * XXX should we return the rwnd here 10452 * and tcp_opt_get ? 10453 */ 10454 break; 10455 case SO_SND_COPYAVOID: 10456 if (!checkonly) { 10457 /* we only allow enable at most once for now */ 10458 if (tcp->tcp_loopback || 10459 (!tcp->tcp_snd_zcopy_aware && 10460 (onoff != 1 || !tcp_zcopy_check(tcp)))) { 10461 *outlenp = 0; 10462 return (EOPNOTSUPP); 10463 } 10464 tcp->tcp_snd_zcopy_aware = 1; 10465 } 10466 break; 10467 default: 10468 *outlenp = 0; 10469 return (EINVAL); 10470 } 10471 break; 10472 case IPPROTO_TCP: 10473 switch (name) { 10474 case TCP_NODELAY: 10475 if (!checkonly) 10476 tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss; 10477 break; 10478 case TCP_NOTIFY_THRESHOLD: 10479 if (!checkonly) 10480 tcp->tcp_first_timer_threshold = *i1; 10481 break; 10482 case TCP_ABORT_THRESHOLD: 10483 if (!checkonly) 10484 tcp->tcp_second_timer_threshold = *i1; 10485 break; 10486 case TCP_CONN_NOTIFY_THRESHOLD: 10487 if (!checkonly) 10488 tcp->tcp_first_ctimer_threshold = *i1; 10489 break; 10490 case TCP_CONN_ABORT_THRESHOLD: 10491 if (!checkonly) 10492 tcp->tcp_second_ctimer_threshold = *i1; 10493 break; 10494 case TCP_RECVDSTADDR: 10495 if (tcp->tcp_state > TCPS_LISTEN) 10496 return (EOPNOTSUPP); 10497 if (!checkonly) 10498 tcp->tcp_recvdstaddr = onoff; 10499 break; 10500 case TCP_ANONPRIVBIND: 10501 if ((reterr = secpolicy_net_privaddr(cr, 0)) != 0) { 10502 *outlenp = 0; 10503 return (reterr); 10504 } 10505 if (!checkonly) { 10506 tcp->tcp_anon_priv_bind = onoff; 10507 } 10508 break; 10509 case TCP_EXCLBIND: 10510 if (!checkonly) 10511 tcp->tcp_exclbind = onoff; 10512 break; /* goto sizeof (int) option return */ 10513 case TCP_INIT_CWND: { 10514 uint32_t init_cwnd = *((uint32_t *)invalp); 10515 10516 if (checkonly) 10517 break; 10518 10519 /* 10520 * Only allow socket with network configuration 10521 * privilege to set the initial cwnd to be larger 10522 * than allowed by RFC 3390. 10523 */ 10524 if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) { 10525 tcp->tcp_init_cwnd = init_cwnd; 10526 break; 10527 } 10528 if ((reterr = secpolicy_net_config(cr, B_TRUE)) != 0) { 10529 *outlenp = 0; 10530 return (reterr); 10531 } 10532 if (init_cwnd > TCP_MAX_INIT_CWND) { 10533 *outlenp = 0; 10534 return (EINVAL); 10535 } 10536 tcp->tcp_init_cwnd = init_cwnd; 10537 break; 10538 } 10539 case TCP_KEEPALIVE_THRESHOLD: 10540 if (checkonly) 10541 break; 10542 10543 if (*i1 < tcp_keepalive_interval_low || 10544 *i1 > tcp_keepalive_interval_high) { 10545 *outlenp = 0; 10546 return (EINVAL); 10547 } 10548 if (*i1 != tcp->tcp_ka_interval) { 10549 tcp->tcp_ka_interval = *i1; 10550 /* 10551 * Check if we need to restart the 10552 * keepalive timer. 10553 */ 10554 if (tcp->tcp_ka_tid != 0) { 10555 ASSERT(tcp->tcp_ka_enabled); 10556 (void) TCP_TIMER_CANCEL(tcp, 10557 tcp->tcp_ka_tid); 10558 tcp->tcp_ka_last_intrvl = 0; 10559 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10560 tcp_keepalive_killer, 10561 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10562 } 10563 } 10564 break; 10565 case TCP_KEEPALIVE_ABORT_THRESHOLD: 10566 if (!checkonly) { 10567 if (*i1 < tcp_keepalive_abort_interval_low || 10568 *i1 > tcp_keepalive_abort_interval_high) { 10569 *outlenp = 0; 10570 return (EINVAL); 10571 } 10572 tcp->tcp_ka_abort_thres = *i1; 10573 } 10574 break; 10575 case TCP_CORK: 10576 if (!checkonly) { 10577 /* 10578 * if tcp->tcp_cork was set and is now 10579 * being unset, we have to make sure that 10580 * the remaining data gets sent out. Also 10581 * unset tcp->tcp_cork so that tcp_wput_data() 10582 * can send data even if it is less than mss 10583 */ 10584 if (tcp->tcp_cork && onoff == 0 && 10585 tcp->tcp_unsent > 0) { 10586 tcp->tcp_cork = B_FALSE; 10587 tcp_wput_data(tcp, NULL, B_FALSE); 10588 } 10589 tcp->tcp_cork = onoff; 10590 } 10591 break; 10592 default: 10593 *outlenp = 0; 10594 return (EINVAL); 10595 } 10596 break; 10597 case IPPROTO_IP: 10598 if (tcp->tcp_family != AF_INET) { 10599 *outlenp = 0; 10600 return (ENOPROTOOPT); 10601 } 10602 switch (name) { 10603 case IP_OPTIONS: 10604 case T_IP_OPTIONS: 10605 reterr = tcp_opt_set_header(tcp, checkonly, 10606 invalp, inlen); 10607 if (reterr) { 10608 *outlenp = 0; 10609 return (reterr); 10610 } 10611 /* OK return - copy input buffer into output buffer */ 10612 if (invalp != outvalp) { 10613 /* don't trust bcopy for identical src/dst */ 10614 bcopy(invalp, outvalp, inlen); 10615 } 10616 *outlenp = inlen; 10617 return (0); 10618 case IP_TOS: 10619 case T_IP_TOS: 10620 if (!checkonly) { 10621 tcp->tcp_ipha->ipha_type_of_service = 10622 (uchar_t)*i1; 10623 tcp->tcp_tos = (uchar_t)*i1; 10624 } 10625 break; 10626 case IP_TTL: 10627 if (!checkonly) { 10628 tcp->tcp_ipha->ipha_ttl = (uchar_t)*i1; 10629 tcp->tcp_ttl = (uchar_t)*i1; 10630 } 10631 break; 10632 case IP_BOUND_IF: 10633 /* Handled at the IP level */ 10634 return (-EINVAL); 10635 case IP_SEC_OPT: 10636 /* 10637 * We should not allow policy setting after 10638 * we start listening for connections. 10639 */ 10640 if (tcp->tcp_state == TCPS_LISTEN) { 10641 return (EINVAL); 10642 } else { 10643 /* Handled at the IP level */ 10644 return (-EINVAL); 10645 } 10646 default: 10647 *outlenp = 0; 10648 return (EINVAL); 10649 } 10650 break; 10651 case IPPROTO_IPV6: { 10652 ip6_pkt_t *ipp; 10653 10654 /* 10655 * IPPROTO_IPV6 options are only supported for sockets 10656 * that are using IPv6 on the wire. 10657 */ 10658 if (tcp->tcp_ipversion != IPV6_VERSION) { 10659 *outlenp = 0; 10660 return (ENOPROTOOPT); 10661 } 10662 /* 10663 * Only sticky options; no ancillary data 10664 */ 10665 ASSERT(thisdg_attrs == NULL); 10666 ipp = &tcp->tcp_sticky_ipp; 10667 10668 switch (name) { 10669 case IPV6_UNICAST_HOPS: 10670 /* -1 means use default */ 10671 if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) { 10672 *outlenp = 0; 10673 return (EINVAL); 10674 } 10675 if (!checkonly) { 10676 if (*i1 == -1) { 10677 tcp->tcp_ip6h->ip6_hops = 10678 ipp->ipp_hoplimit = 10679 (uint8_t)tcp_ipv6_hoplimit; 10680 ipp->ipp_fields &= ~IPPF_HOPLIMIT; 10681 /* Pass modified value to IP. */ 10682 *i1 = tcp->tcp_ip6h->ip6_hops; 10683 } else { 10684 tcp->tcp_ip6h->ip6_hops = 10685 ipp->ipp_hoplimit = (uint8_t)*i1; 10686 ipp->ipp_fields |= IPPF_HOPLIMIT; 10687 } 10688 } 10689 break; 10690 case IPV6_BOUND_IF: 10691 if (!checkonly) { 10692 int error = 0; 10693 10694 tcp->tcp_bound_if = *i1; 10695 error = ip_opt_set_ill(tcp->tcp_connp, *i1, 10696 B_TRUE, checkonly, level, name, mblk); 10697 if (error != 0) { 10698 *outlenp = 0; 10699 return (error); 10700 } 10701 } 10702 break; 10703 /* 10704 * Set boolean switches for ancillary data delivery 10705 */ 10706 case IPV6_RECVPKTINFO: 10707 if (!checkonly) { 10708 if (onoff) 10709 tcp->tcp_ipv6_recvancillary |= 10710 TCP_IPV6_RECVPKTINFO; 10711 else 10712 tcp->tcp_ipv6_recvancillary &= 10713 ~TCP_IPV6_RECVPKTINFO; 10714 /* Force it to be sent up with the next msg */ 10715 tcp->tcp_recvifindex = 0; 10716 } 10717 break; 10718 case IPV6_RECVTCLASS: 10719 if (!checkonly) { 10720 if (onoff) 10721 tcp->tcp_ipv6_recvancillary |= 10722 TCP_IPV6_RECVTCLASS; 10723 else 10724 tcp->tcp_ipv6_recvancillary &= 10725 ~TCP_IPV6_RECVTCLASS; 10726 } 10727 break; 10728 case IPV6_RECVHOPLIMIT: 10729 if (!checkonly) { 10730 if (onoff) 10731 tcp->tcp_ipv6_recvancillary |= 10732 TCP_IPV6_RECVHOPLIMIT; 10733 else 10734 tcp->tcp_ipv6_recvancillary &= 10735 ~TCP_IPV6_RECVHOPLIMIT; 10736 /* Force it to be sent up with the next msg */ 10737 tcp->tcp_recvhops = 0xffffffffU; 10738 } 10739 break; 10740 case IPV6_RECVHOPOPTS: 10741 if (!checkonly) { 10742 if (onoff) 10743 tcp->tcp_ipv6_recvancillary |= 10744 TCP_IPV6_RECVHOPOPTS; 10745 else 10746 tcp->tcp_ipv6_recvancillary &= 10747 ~TCP_IPV6_RECVHOPOPTS; 10748 } 10749 break; 10750 case IPV6_RECVDSTOPTS: 10751 if (!checkonly) { 10752 if (onoff) 10753 tcp->tcp_ipv6_recvancillary |= 10754 TCP_IPV6_RECVDSTOPTS; 10755 else 10756 tcp->tcp_ipv6_recvancillary &= 10757 ~TCP_IPV6_RECVDSTOPTS; 10758 } 10759 break; 10760 case _OLD_IPV6_RECVDSTOPTS: 10761 if (!checkonly) { 10762 if (onoff) 10763 tcp->tcp_ipv6_recvancillary |= 10764 TCP_OLD_IPV6_RECVDSTOPTS; 10765 else 10766 tcp->tcp_ipv6_recvancillary &= 10767 ~TCP_OLD_IPV6_RECVDSTOPTS; 10768 } 10769 break; 10770 case IPV6_RECVRTHDR: 10771 if (!checkonly) { 10772 if (onoff) 10773 tcp->tcp_ipv6_recvancillary |= 10774 TCP_IPV6_RECVRTHDR; 10775 else 10776 tcp->tcp_ipv6_recvancillary &= 10777 ~TCP_IPV6_RECVRTHDR; 10778 } 10779 break; 10780 case IPV6_RECVRTHDRDSTOPTS: 10781 if (!checkonly) { 10782 if (onoff) 10783 tcp->tcp_ipv6_recvancillary |= 10784 TCP_IPV6_RECVRTDSTOPTS; 10785 else 10786 tcp->tcp_ipv6_recvancillary &= 10787 ~TCP_IPV6_RECVRTDSTOPTS; 10788 } 10789 break; 10790 case IPV6_PKTINFO: 10791 if (inlen != 0 && inlen != sizeof (struct in6_pktinfo)) 10792 return (EINVAL); 10793 if (checkonly) 10794 break; 10795 10796 if (inlen == 0) { 10797 ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR); 10798 } else { 10799 struct in6_pktinfo *pkti; 10800 10801 pkti = (struct in6_pktinfo *)invalp; 10802 /* 10803 * RFC 3542 states that ipi6_addr must be 10804 * the unspecified address when setting the 10805 * IPV6_PKTINFO sticky socket option on a 10806 * TCP socket. 10807 */ 10808 if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr)) 10809 return (EINVAL); 10810 /* 10811 * ip6_set_pktinfo() validates the source 10812 * address and interface index. 10813 */ 10814 reterr = ip6_set_pktinfo(cr, tcp->tcp_connp, 10815 pkti, mblk); 10816 if (reterr != 0) 10817 return (reterr); 10818 ipp->ipp_ifindex = pkti->ipi6_ifindex; 10819 ipp->ipp_addr = pkti->ipi6_addr; 10820 if (ipp->ipp_ifindex != 0) 10821 ipp->ipp_fields |= IPPF_IFINDEX; 10822 else 10823 ipp->ipp_fields &= ~IPPF_IFINDEX; 10824 if (!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)) 10825 ipp->ipp_fields |= IPPF_ADDR; 10826 else 10827 ipp->ipp_fields &= ~IPPF_ADDR; 10828 } 10829 reterr = tcp_build_hdrs(q, tcp); 10830 if (reterr != 0) 10831 return (reterr); 10832 break; 10833 case IPV6_HOPLIMIT: 10834 if (inlen != 0 && inlen != sizeof (int)) 10835 return (EINVAL); 10836 if (checkonly) 10837 break; 10838 10839 if (inlen == 0) { 10840 ipp->ipp_fields &= ~IPPF_HOPLIMIT; 10841 tcp->tcp_ip6_hops = 10842 (uint8_t)tcp_ipv6_hoplimit; 10843 } else { 10844 if (*i1 > 255 || *i1 < -1) 10845 return (EINVAL); 10846 if (*i1 == -1) { 10847 ipp->ipp_hoplimit = tcp_ipv6_hoplimit; 10848 *i1 = tcp_ipv6_hoplimit; 10849 } else { 10850 ipp->ipp_hoplimit = *i1; 10851 } 10852 ipp->ipp_fields |= IPPF_HOPLIMIT; 10853 tcp->tcp_ip6_hops = 10854 ipp->ipp_hoplimit; 10855 } 10856 reterr = tcp_build_hdrs(q, tcp); 10857 if (reterr != 0) 10858 return (reterr); 10859 break; 10860 case IPV6_TCLASS: 10861 if (inlen != 0 && inlen != sizeof (int)) 10862 return (EINVAL); 10863 if (checkonly) 10864 break; 10865 10866 if (inlen == 0) { 10867 ipp->ipp_fields &= ~IPPF_TCLASS; 10868 } else { 10869 if (*i1 > 255 || *i1 < -1) 10870 return (EINVAL); 10871 if (*i1 == -1) { 10872 ipp->ipp_tclass = 0; 10873 *i1 = 0; 10874 } else { 10875 ipp->ipp_tclass = *i1; 10876 } 10877 ipp->ipp_fields |= IPPF_TCLASS; 10878 } 10879 reterr = tcp_build_hdrs(q, tcp); 10880 if (reterr != 0) 10881 return (reterr); 10882 break; 10883 case IPV6_NEXTHOP: 10884 /* 10885 * IP will verify that the nexthop is reachable 10886 * and fail for sticky options. 10887 */ 10888 if (inlen != 0 && inlen != sizeof (sin6_t)) 10889 return (EINVAL); 10890 if (checkonly) 10891 break; 10892 10893 if (inlen == 0) { 10894 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10895 } else { 10896 sin6_t *sin6 = (sin6_t *)invalp; 10897 10898 if (sin6->sin6_family != AF_INET6) 10899 return (EAFNOSUPPORT); 10900 if (IN6_IS_ADDR_V4MAPPED( 10901 &sin6->sin6_addr)) 10902 return (EADDRNOTAVAIL); 10903 ipp->ipp_nexthop = sin6->sin6_addr; 10904 if (!IN6_IS_ADDR_UNSPECIFIED( 10905 &ipp->ipp_nexthop)) 10906 ipp->ipp_fields |= IPPF_NEXTHOP; 10907 else 10908 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10909 } 10910 reterr = tcp_build_hdrs(q, tcp); 10911 if (reterr != 0) 10912 return (reterr); 10913 break; 10914 case IPV6_HOPOPTS: { 10915 ip6_hbh_t *hopts = (ip6_hbh_t *)invalp; 10916 /* 10917 * Sanity checks - minimum size, size a multiple of 10918 * eight bytes, and matching size passed in. 10919 */ 10920 if (inlen != 0 && 10921 inlen != (8 * (hopts->ip6h_len + 1))) 10922 return (EINVAL); 10923 10924 if (checkonly) 10925 break; 10926 10927 if (inlen == 0) { 10928 if ((ipp->ipp_fields & IPPF_HOPOPTS) != 0) { 10929 kmem_free(ipp->ipp_hopopts, 10930 ipp->ipp_hopoptslen); 10931 ipp->ipp_hopopts = NULL; 10932 ipp->ipp_hopoptslen = 0; 10933 } 10934 ipp->ipp_fields &= ~IPPF_HOPOPTS; 10935 } else { 10936 reterr = tcp_pkt_set(invalp, inlen, 10937 (uchar_t **)&ipp->ipp_hopopts, 10938 &ipp->ipp_hopoptslen); 10939 if (reterr != 0) 10940 return (reterr); 10941 ipp->ipp_fields |= IPPF_HOPOPTS; 10942 } 10943 reterr = tcp_build_hdrs(q, tcp); 10944 if (reterr != 0) 10945 return (reterr); 10946 break; 10947 } 10948 case IPV6_RTHDRDSTOPTS: { 10949 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10950 10951 /* 10952 * Sanity checks - minimum size, size a multiple of 10953 * eight bytes, and matching size passed in. 10954 */ 10955 if (inlen != 0 && 10956 inlen != (8 * (dopts->ip6d_len + 1))) 10957 return (EINVAL); 10958 10959 if (checkonly) 10960 break; 10961 10962 if (inlen == 0) { 10963 if ((ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) { 10964 kmem_free(ipp->ipp_rtdstopts, 10965 ipp->ipp_rtdstoptslen); 10966 ipp->ipp_rtdstopts = NULL; 10967 ipp->ipp_rtdstoptslen = 0; 10968 } 10969 ipp->ipp_fields &= ~IPPF_RTDSTOPTS; 10970 } else { 10971 reterr = tcp_pkt_set(invalp, inlen, 10972 (uchar_t **)&ipp->ipp_rtdstopts, 10973 &ipp->ipp_rtdstoptslen); 10974 if (reterr != 0) 10975 return (reterr); 10976 ipp->ipp_fields |= IPPF_RTDSTOPTS; 10977 } 10978 reterr = tcp_build_hdrs(q, tcp); 10979 if (reterr != 0) 10980 return (reterr); 10981 break; 10982 } 10983 case IPV6_DSTOPTS: { 10984 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10985 10986 /* 10987 * Sanity checks - minimum size, size a multiple of 10988 * eight bytes, and matching size passed in. 10989 */ 10990 if (inlen != 0 && 10991 inlen != (8 * (dopts->ip6d_len + 1))) 10992 return (EINVAL); 10993 10994 if (checkonly) 10995 break; 10996 10997 if (inlen == 0) { 10998 if ((ipp->ipp_fields & IPPF_DSTOPTS) != 0) { 10999 kmem_free(ipp->ipp_dstopts, 11000 ipp->ipp_dstoptslen); 11001 ipp->ipp_dstopts = NULL; 11002 ipp->ipp_dstoptslen = 0; 11003 } 11004 ipp->ipp_fields &= ~IPPF_DSTOPTS; 11005 } else { 11006 reterr = tcp_pkt_set(invalp, inlen, 11007 (uchar_t **)&ipp->ipp_dstopts, 11008 &ipp->ipp_dstoptslen); 11009 if (reterr != 0) 11010 return (reterr); 11011 ipp->ipp_fields |= IPPF_DSTOPTS; 11012 } 11013 reterr = tcp_build_hdrs(q, tcp); 11014 if (reterr != 0) 11015 return (reterr); 11016 break; 11017 } 11018 case IPV6_RTHDR: { 11019 ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp; 11020 11021 /* 11022 * Sanity checks - minimum size, size a multiple of 11023 * eight bytes, and matching size passed in. 11024 */ 11025 if (inlen != 0 && 11026 inlen != (8 * (rt->ip6r_len + 1))) 11027 return (EINVAL); 11028 11029 if (checkonly) 11030 break; 11031 11032 if (inlen == 0) { 11033 if ((ipp->ipp_fields & IPPF_RTHDR) != 0) { 11034 kmem_free(ipp->ipp_rthdr, 11035 ipp->ipp_rthdrlen); 11036 ipp->ipp_rthdr = NULL; 11037 ipp->ipp_rthdrlen = 0; 11038 } 11039 ipp->ipp_fields &= ~IPPF_RTHDR; 11040 } else { 11041 reterr = tcp_pkt_set(invalp, inlen, 11042 (uchar_t **)&ipp->ipp_rthdr, 11043 &ipp->ipp_rthdrlen); 11044 if (reterr != 0) 11045 return (reterr); 11046 ipp->ipp_fields |= IPPF_RTHDR; 11047 } 11048 reterr = tcp_build_hdrs(q, tcp); 11049 if (reterr != 0) 11050 return (reterr); 11051 break; 11052 } 11053 case IPV6_V6ONLY: 11054 if (!checkonly) 11055 tcp->tcp_connp->conn_ipv6_v6only = onoff; 11056 break; 11057 case IPV6_USE_MIN_MTU: 11058 if (inlen != sizeof (int)) 11059 return (EINVAL); 11060 11061 if (*i1 < -1 || *i1 > 1) 11062 return (EINVAL); 11063 11064 if (checkonly) 11065 break; 11066 11067 ipp->ipp_fields |= IPPF_USE_MIN_MTU; 11068 ipp->ipp_use_min_mtu = *i1; 11069 break; 11070 case IPV6_BOUND_PIF: 11071 /* Handled at the IP level */ 11072 return (-EINVAL); 11073 case IPV6_SEC_OPT: 11074 /* 11075 * We should not allow policy setting after 11076 * we start listening for connections. 11077 */ 11078 if (tcp->tcp_state == TCPS_LISTEN) { 11079 return (EINVAL); 11080 } else { 11081 /* Handled at the IP level */ 11082 return (-EINVAL); 11083 } 11084 case IPV6_SRC_PREFERENCES: 11085 if (inlen != sizeof (uint32_t)) 11086 return (EINVAL); 11087 reterr = ip6_set_src_preferences(tcp->tcp_connp, 11088 *(uint32_t *)invalp); 11089 if (reterr != 0) { 11090 *outlenp = 0; 11091 return (reterr); 11092 } 11093 break; 11094 default: 11095 *outlenp = 0; 11096 return (EINVAL); 11097 } 11098 break; 11099 } /* end IPPROTO_IPV6 */ 11100 default: 11101 *outlenp = 0; 11102 return (EINVAL); 11103 } 11104 /* 11105 * Common case of OK return with outval same as inval 11106 */ 11107 if (invalp != outvalp) { 11108 /* don't trust bcopy for identical src/dst */ 11109 (void) bcopy(invalp, outvalp, inlen); 11110 } 11111 *outlenp = inlen; 11112 return (0); 11113 } 11114 11115 /* 11116 * Update tcp_sticky_hdrs based on tcp_sticky_ipp. 11117 * The headers include ip6i_t (if needed), ip6_t, any sticky extension 11118 * headers, and the maximum size tcp header (to avoid reallocation 11119 * on the fly for additional tcp options). 11120 * Returns failure if can't allocate memory. 11121 */ 11122 static int 11123 tcp_build_hdrs(queue_t *q, tcp_t *tcp) 11124 { 11125 char *hdrs; 11126 uint_t hdrs_len; 11127 ip6i_t *ip6i; 11128 char buf[TCP_MAX_HDR_LENGTH]; 11129 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 11130 in6_addr_t src, dst; 11131 uint8_t hops; 11132 11133 /* 11134 * save the existing tcp header and source/dest IP addresses 11135 */ 11136 bcopy(tcp->tcp_tcph, buf, tcp->tcp_tcp_hdr_len); 11137 src = tcp->tcp_ip6h->ip6_src; 11138 dst = tcp->tcp_ip6h->ip6_dst; 11139 hops = tcp->tcp_ip6h->ip6_hops; 11140 hdrs_len = ip_total_hdrs_len_v6(ipp) + TCP_MAX_HDR_LENGTH; 11141 ASSERT(hdrs_len != 0); 11142 if (hdrs_len > tcp->tcp_iphc_len) { 11143 /* Need to reallocate */ 11144 hdrs = kmem_zalloc(hdrs_len, KM_NOSLEEP); 11145 if (hdrs == NULL) 11146 return (ENOMEM); 11147 if (tcp->tcp_iphc != NULL) { 11148 if (tcp->tcp_hdr_grown) { 11149 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 11150 } else { 11151 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 11152 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 11153 } 11154 tcp->tcp_iphc_len = 0; 11155 } 11156 ASSERT(tcp->tcp_iphc_len == 0); 11157 tcp->tcp_iphc = hdrs; 11158 tcp->tcp_iphc_len = hdrs_len; 11159 tcp->tcp_hdr_grown = B_TRUE; 11160 } 11161 ip_build_hdrs_v6((uchar_t *)tcp->tcp_iphc, 11162 hdrs_len - TCP_MAX_HDR_LENGTH, ipp, IPPROTO_TCP); 11163 11164 /* Set header fields not in ipp */ 11165 if (ipp->ipp_fields & IPPF_HAS_IP6I) { 11166 ip6i = (ip6i_t *)tcp->tcp_iphc; 11167 tcp->tcp_ip6h = (ip6_t *)&ip6i[1]; 11168 } else { 11169 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 11170 } 11171 /* 11172 * tcp->tcp_ip_hdr_len will include ip6i_t if there is one. 11173 * 11174 * tcp->tcp_tcp_hdr_len doesn't change here. 11175 */ 11176 tcp->tcp_ip_hdr_len = hdrs_len - TCP_MAX_HDR_LENGTH; 11177 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); 11178 tcp->tcp_hdr_len = tcp->tcp_ip_hdr_len + tcp->tcp_tcp_hdr_len; 11179 11180 bcopy(buf, tcp->tcp_tcph, tcp->tcp_tcp_hdr_len); 11181 11182 tcp->tcp_ip6h->ip6_src = src; 11183 tcp->tcp_ip6h->ip6_dst = dst; 11184 11185 /* 11186 * If the hop limit was not set by ip_build_hdrs_v6(), restore 11187 * the saved value. 11188 */ 11189 if (!(ipp->ipp_fields & IPPF_HOPLIMIT)) 11190 tcp->tcp_ip6h->ip6_hops = hops; 11191 11192 /* 11193 * Set the IPv6 header payload length. 11194 * If there's an ip6i_t included, don't count it in the length. 11195 */ 11196 tcp->tcp_ip6h->ip6_plen = tcp->tcp_hdr_len - IPV6_HDR_LEN; 11197 if (ipp->ipp_fields & IPPF_HAS_IP6I) 11198 tcp->tcp_ip6h->ip6_plen -= sizeof (ip6i_t); 11199 /* 11200 * If we're setting extension headers after a connection 11201 * has been established, and if we have a routing header 11202 * among the extension headers, call ip_massage_options_v6 to 11203 * manipulate the routing header/ip6_dst set the checksum 11204 * difference in the tcp header template. 11205 * (This happens in tcp_connect_ipv6 if the routing header 11206 * is set prior to the connect.) 11207 * Set the tcp_sum to zero first in case we've cleared a 11208 * routing header or don't have one at all. 11209 */ 11210 tcp->tcp_sum = 0; 11211 if ((tcp->tcp_state >= TCPS_SYN_SENT) && 11212 (tcp->tcp_ipp_fields & IPPF_RTHDR)) { 11213 ip6_rthdr_t *rth = ip_find_rthdr_v6(tcp->tcp_ip6h, 11214 (uint8_t *)tcp->tcp_tcph); 11215 if (rth != NULL) { 11216 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, 11217 rth); 11218 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 11219 (tcp->tcp_sum >> 16)); 11220 } 11221 } 11222 11223 /* Try to get everything in a single mblk */ 11224 (void) mi_set_sth_wroff(RD(q), hdrs_len + tcp_wroff_xtra); 11225 return (0); 11226 } 11227 11228 /* 11229 * Set optbuf and optlen for the option. 11230 * Allocate memory (if not already present). 11231 * Otherwise just point optbuf and optlen at invalp and inlen. 11232 * Returns failure if memory can not be allocated. 11233 */ 11234 static int 11235 tcp_pkt_set(uchar_t *invalp, uint_t inlen, uchar_t **optbufp, uint_t *optlenp) 11236 { 11237 uchar_t *optbuf; 11238 11239 if (inlen == *optlenp) { 11240 /* Unchanged length - no need to realocate */ 11241 bcopy(invalp, *optbufp, inlen); 11242 return (0); 11243 } 11244 if (inlen != 0) { 11245 /* Allocate new buffer before free */ 11246 optbuf = kmem_alloc(inlen, KM_NOSLEEP); 11247 if (optbuf == NULL) 11248 return (ENOMEM); 11249 } else { 11250 optbuf = NULL; 11251 } 11252 /* Free old buffer */ 11253 if (*optlenp != 0) 11254 kmem_free(*optbufp, *optlenp); 11255 11256 bcopy(invalp, optbuf, inlen); 11257 *optbufp = optbuf; 11258 *optlenp = inlen; 11259 return (0); 11260 } 11261 11262 11263 /* 11264 * Use the outgoing IP header to create an IP_OPTIONS option the way 11265 * it was passed down from the application. 11266 */ 11267 static int 11268 tcp_opt_get_user(ipha_t *ipha, uchar_t *buf) 11269 { 11270 ipoptp_t opts; 11271 uchar_t *opt; 11272 uint8_t optval; 11273 uint8_t optlen; 11274 uint32_t len = 0; 11275 uchar_t *buf1 = buf; 11276 11277 buf += IP_ADDR_LEN; /* Leave room for final destination */ 11278 len += IP_ADDR_LEN; 11279 bzero(buf1, IP_ADDR_LEN); 11280 11281 for (optval = ipoptp_first(&opts, ipha); 11282 optval != IPOPT_EOL; 11283 optval = ipoptp_next(&opts)) { 11284 opt = opts.ipoptp_cur; 11285 optlen = opts.ipoptp_len; 11286 switch (optval) { 11287 int off; 11288 case IPOPT_SSRR: 11289 case IPOPT_LSRR: 11290 11291 /* 11292 * Insert ipha_dst as the first entry in the source 11293 * route and move down the entries on step. 11294 * The last entry gets placed at buf1. 11295 */ 11296 buf[IPOPT_OPTVAL] = optval; 11297 buf[IPOPT_OLEN] = optlen; 11298 buf[IPOPT_OFFSET] = optlen; 11299 11300 off = optlen - IP_ADDR_LEN; 11301 if (off < 0) { 11302 /* No entries in source route */ 11303 break; 11304 } 11305 /* Last entry in source route */ 11306 bcopy(opt + off, buf1, IP_ADDR_LEN); 11307 off -= IP_ADDR_LEN; 11308 11309 while (off > 0) { 11310 bcopy(opt + off, 11311 buf + off + IP_ADDR_LEN, 11312 IP_ADDR_LEN); 11313 off -= IP_ADDR_LEN; 11314 } 11315 /* ipha_dst into first slot */ 11316 bcopy(&ipha->ipha_dst, 11317 buf + off + IP_ADDR_LEN, 11318 IP_ADDR_LEN); 11319 buf += optlen; 11320 len += optlen; 11321 break; 11322 default: 11323 bcopy(opt, buf, optlen); 11324 buf += optlen; 11325 len += optlen; 11326 break; 11327 } 11328 } 11329 done: 11330 /* Pad the resulting options */ 11331 while (len & 0x3) { 11332 *buf++ = IPOPT_EOL; 11333 len++; 11334 } 11335 return (len); 11336 } 11337 11338 /* 11339 * Transfer any source route option from ipha to buf/dst in reversed form. 11340 */ 11341 static int 11342 tcp_opt_rev_src_route(ipha_t *ipha, char *buf, uchar_t *dst) 11343 { 11344 ipoptp_t opts; 11345 uchar_t *opt; 11346 uint8_t optval; 11347 uint8_t optlen; 11348 uint32_t len = 0; 11349 11350 for (optval = ipoptp_first(&opts, ipha); 11351 optval != IPOPT_EOL; 11352 optval = ipoptp_next(&opts)) { 11353 opt = opts.ipoptp_cur; 11354 optlen = opts.ipoptp_len; 11355 switch (optval) { 11356 int off1, off2; 11357 case IPOPT_SSRR: 11358 case IPOPT_LSRR: 11359 11360 /* Reverse source route */ 11361 /* 11362 * First entry should be the next to last one in the 11363 * current source route (the last entry is our 11364 * address.) 11365 * The last entry should be the final destination. 11366 */ 11367 buf[IPOPT_OPTVAL] = (uint8_t)optval; 11368 buf[IPOPT_OLEN] = (uint8_t)optlen; 11369 off1 = IPOPT_MINOFF_SR - 1; 11370 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 11371 if (off2 < 0) { 11372 /* No entries in source route */ 11373 break; 11374 } 11375 bcopy(opt + off2, dst, IP_ADDR_LEN); 11376 /* 11377 * Note: use src since ipha has not had its src 11378 * and dst reversed (it is in the state it was 11379 * received. 11380 */ 11381 bcopy(&ipha->ipha_src, buf + off2, 11382 IP_ADDR_LEN); 11383 off2 -= IP_ADDR_LEN; 11384 11385 while (off2 > 0) { 11386 bcopy(opt + off2, buf + off1, 11387 IP_ADDR_LEN); 11388 off1 += IP_ADDR_LEN; 11389 off2 -= IP_ADDR_LEN; 11390 } 11391 buf[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 11392 buf += optlen; 11393 len += optlen; 11394 break; 11395 } 11396 } 11397 done: 11398 /* Pad the resulting options */ 11399 while (len & 0x3) { 11400 *buf++ = IPOPT_EOL; 11401 len++; 11402 } 11403 return (len); 11404 } 11405 11406 11407 /* 11408 * Extract and revert a source route from ipha (if any) 11409 * and then update the relevant fields in both tcp_t and the standard header. 11410 */ 11411 static void 11412 tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha) 11413 { 11414 char buf[TCP_MAX_HDR_LENGTH]; 11415 uint_t tcph_len; 11416 int len; 11417 11418 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 11419 len = IPH_HDR_LENGTH(ipha); 11420 if (len == IP_SIMPLE_HDR_LENGTH) 11421 /* Nothing to do */ 11422 return; 11423 if (len > IP_SIMPLE_HDR_LENGTH + TCP_MAX_IP_OPTIONS_LENGTH || 11424 (len & 0x3)) 11425 return; 11426 11427 tcph_len = tcp->tcp_tcp_hdr_len; 11428 bcopy(tcp->tcp_tcph, buf, tcph_len); 11429 tcp->tcp_sum = (tcp->tcp_ipha->ipha_dst >> 16) + 11430 (tcp->tcp_ipha->ipha_dst & 0xffff); 11431 len = tcp_opt_rev_src_route(ipha, (char *)tcp->tcp_ipha + 11432 IP_SIMPLE_HDR_LENGTH, (uchar_t *)&tcp->tcp_ipha->ipha_dst); 11433 len += IP_SIMPLE_HDR_LENGTH; 11434 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 11435 (tcp->tcp_ipha->ipha_dst & 0xffff)); 11436 if ((int)tcp->tcp_sum < 0) 11437 tcp->tcp_sum--; 11438 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 11439 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); 11440 tcp->tcp_tcph = (tcph_t *)((char *)tcp->tcp_ipha + len); 11441 bcopy(buf, tcp->tcp_tcph, tcph_len); 11442 tcp->tcp_ip_hdr_len = len; 11443 tcp->tcp_ipha->ipha_version_and_hdr_length = 11444 (IP_VERSION << 4) | (len >> 2); 11445 len += tcph_len; 11446 tcp->tcp_hdr_len = len; 11447 } 11448 11449 /* 11450 * Copy the standard header into its new location, 11451 * lay in the new options and then update the relevant 11452 * fields in both tcp_t and the standard header. 11453 */ 11454 static int 11455 tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len) 11456 { 11457 uint_t tcph_len; 11458 char *ip_optp; 11459 tcph_t *new_tcph; 11460 11461 if (checkonly) { 11462 /* 11463 * do not really set, just pretend to - T_CHECK 11464 */ 11465 if (len != 0) { 11466 /* 11467 * there is value supplied, validate it as if 11468 * for a real set operation. 11469 */ 11470 if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) 11471 return (EINVAL); 11472 } 11473 return (0); 11474 } 11475 11476 if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) 11477 return (EINVAL); 11478 11479 ip_optp = (char *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; 11480 tcph_len = tcp->tcp_tcp_hdr_len; 11481 new_tcph = (tcph_t *)(ip_optp + len); 11482 ovbcopy((char *)tcp->tcp_tcph, (char *)new_tcph, tcph_len); 11483 tcp->tcp_tcph = new_tcph; 11484 bcopy(ptr, ip_optp, len); 11485 11486 len += IP_SIMPLE_HDR_LENGTH; 11487 11488 tcp->tcp_ip_hdr_len = len; 11489 tcp->tcp_ipha->ipha_version_and_hdr_length = 11490 (IP_VERSION << 4) | (len >> 2); 11491 len += tcph_len; 11492 tcp->tcp_hdr_len = len; 11493 if (!TCP_IS_DETACHED(tcp)) { 11494 /* Always allocate room for all options. */ 11495 (void) mi_set_sth_wroff(tcp->tcp_rq, 11496 TCP_MAX_COMBINED_HEADER_LENGTH + tcp_wroff_xtra); 11497 } 11498 return (0); 11499 } 11500 11501 /* Get callback routine passed to nd_load by tcp_param_register */ 11502 /* ARGSUSED */ 11503 static int 11504 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 11505 { 11506 tcpparam_t *tcppa = (tcpparam_t *)cp; 11507 11508 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 11509 return (0); 11510 } 11511 11512 /* 11513 * Walk through the param array specified registering each element with the 11514 * named dispatch handler. 11515 */ 11516 static boolean_t 11517 tcp_param_register(tcpparam_t *tcppa, int cnt) 11518 { 11519 for (; cnt-- > 0; tcppa++) { 11520 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 11521 if (!nd_load(&tcp_g_nd, tcppa->tcp_param_name, 11522 tcp_param_get, tcp_param_set, 11523 (caddr_t)tcppa)) { 11524 nd_free(&tcp_g_nd); 11525 return (B_FALSE); 11526 } 11527 } 11528 } 11529 if (!nd_load(&tcp_g_nd, tcp_wroff_xtra_param.tcp_param_name, 11530 tcp_param_get, tcp_param_set_aligned, 11531 (caddr_t)&tcp_wroff_xtra_param)) { 11532 nd_free(&tcp_g_nd); 11533 return (B_FALSE); 11534 } 11535 if (!nd_load(&tcp_g_nd, tcp_mdt_head_param.tcp_param_name, 11536 tcp_param_get, tcp_param_set_aligned, 11537 (caddr_t)&tcp_mdt_head_param)) { 11538 nd_free(&tcp_g_nd); 11539 return (B_FALSE); 11540 } 11541 if (!nd_load(&tcp_g_nd, tcp_mdt_tail_param.tcp_param_name, 11542 tcp_param_get, tcp_param_set_aligned, 11543 (caddr_t)&tcp_mdt_tail_param)) { 11544 nd_free(&tcp_g_nd); 11545 return (B_FALSE); 11546 } 11547 if (!nd_load(&tcp_g_nd, tcp_mdt_max_pbufs_param.tcp_param_name, 11548 tcp_param_get, tcp_param_set, 11549 (caddr_t)&tcp_mdt_max_pbufs_param)) { 11550 nd_free(&tcp_g_nd); 11551 return (B_FALSE); 11552 } 11553 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports", 11554 tcp_extra_priv_ports_get, NULL, NULL)) { 11555 nd_free(&tcp_g_nd); 11556 return (B_FALSE); 11557 } 11558 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_add", 11559 NULL, tcp_extra_priv_ports_add, NULL)) { 11560 nd_free(&tcp_g_nd); 11561 return (B_FALSE); 11562 } 11563 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_del", 11564 NULL, tcp_extra_priv_ports_del, NULL)) { 11565 nd_free(&tcp_g_nd); 11566 return (B_FALSE); 11567 } 11568 if (!nd_load(&tcp_g_nd, "tcp_status", tcp_status_report, NULL, 11569 NULL)) { 11570 nd_free(&tcp_g_nd); 11571 return (B_FALSE); 11572 } 11573 if (!nd_load(&tcp_g_nd, "tcp_bind_hash", tcp_bind_hash_report, 11574 NULL, NULL)) { 11575 nd_free(&tcp_g_nd); 11576 return (B_FALSE); 11577 } 11578 if (!nd_load(&tcp_g_nd, "tcp_listen_hash", tcp_listen_hash_report, 11579 NULL, NULL)) { 11580 nd_free(&tcp_g_nd); 11581 return (B_FALSE); 11582 } 11583 if (!nd_load(&tcp_g_nd, "tcp_conn_hash", tcp_conn_hash_report, 11584 NULL, NULL)) { 11585 nd_free(&tcp_g_nd); 11586 return (B_FALSE); 11587 } 11588 if (!nd_load(&tcp_g_nd, "tcp_acceptor_hash", tcp_acceptor_hash_report, 11589 NULL, NULL)) { 11590 nd_free(&tcp_g_nd); 11591 return (B_FALSE); 11592 } 11593 if (!nd_load(&tcp_g_nd, "tcp_host_param", tcp_host_param_report, 11594 tcp_host_param_set, NULL)) { 11595 nd_free(&tcp_g_nd); 11596 return (B_FALSE); 11597 } 11598 if (!nd_load(&tcp_g_nd, "tcp_host_param_ipv6", tcp_host_param_report, 11599 tcp_host_param_set_ipv6, NULL)) { 11600 nd_free(&tcp_g_nd); 11601 return (B_FALSE); 11602 } 11603 if (!nd_load(&tcp_g_nd, "tcp_1948_phrase", NULL, tcp_1948_phrase_set, 11604 NULL)) { 11605 nd_free(&tcp_g_nd); 11606 return (B_FALSE); 11607 } 11608 if (!nd_load(&tcp_g_nd, "tcp_reserved_port_list", 11609 tcp_reserved_port_list, NULL, NULL)) { 11610 nd_free(&tcp_g_nd); 11611 return (B_FALSE); 11612 } 11613 /* 11614 * Dummy ndd variables - only to convey obsolescence information 11615 * through printing of their name (no get or set routines) 11616 * XXX Remove in future releases ? 11617 */ 11618 if (!nd_load(&tcp_g_nd, 11619 "tcp_close_wait_interval(obsoleted - " 11620 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 11621 nd_free(&tcp_g_nd); 11622 return (B_FALSE); 11623 } 11624 return (B_TRUE); 11625 } 11626 11627 /* ndd set routine for tcp_wroff_xtra, tcp_mdt_hdr_{head,tail}_min. */ 11628 /* ARGSUSED */ 11629 static int 11630 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 11631 cred_t *cr) 11632 { 11633 long new_value; 11634 tcpparam_t *tcppa = (tcpparam_t *)cp; 11635 11636 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11637 new_value < tcppa->tcp_param_min || 11638 new_value > tcppa->tcp_param_max) { 11639 return (EINVAL); 11640 } 11641 /* 11642 * Need to make sure new_value is a multiple of 4. If it is not, 11643 * round it up. For future 64 bit requirement, we actually make it 11644 * a multiple of 8. 11645 */ 11646 if (new_value & 0x7) { 11647 new_value = (new_value & ~0x7) + 0x8; 11648 } 11649 tcppa->tcp_param_val = new_value; 11650 return (0); 11651 } 11652 11653 /* Set callback routine passed to nd_load by tcp_param_register */ 11654 /* ARGSUSED */ 11655 static int 11656 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 11657 { 11658 long new_value; 11659 tcpparam_t *tcppa = (tcpparam_t *)cp; 11660 11661 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11662 new_value < tcppa->tcp_param_min || 11663 new_value > tcppa->tcp_param_max) { 11664 return (EINVAL); 11665 } 11666 tcppa->tcp_param_val = new_value; 11667 return (0); 11668 } 11669 11670 /* 11671 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 11672 * is filled, return as much as we can. The message passed in may be 11673 * multi-part, chained using b_cont. "start" is the starting sequence 11674 * number for this piece. 11675 */ 11676 static mblk_t * 11677 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 11678 { 11679 uint32_t end; 11680 mblk_t *mp1; 11681 mblk_t *mp2; 11682 mblk_t *next_mp; 11683 uint32_t u1; 11684 11685 /* Walk through all the new pieces. */ 11686 do { 11687 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 11688 (uintptr_t)INT_MAX); 11689 end = start + (int)(mp->b_wptr - mp->b_rptr); 11690 next_mp = mp->b_cont; 11691 if (start == end) { 11692 /* Empty. Blast it. */ 11693 freeb(mp); 11694 continue; 11695 } 11696 mp->b_cont = NULL; 11697 TCP_REASS_SET_SEQ(mp, start); 11698 TCP_REASS_SET_END(mp, end); 11699 mp1 = tcp->tcp_reass_tail; 11700 if (!mp1) { 11701 tcp->tcp_reass_tail = mp; 11702 tcp->tcp_reass_head = mp; 11703 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11704 UPDATE_MIB(&tcp_mib, 11705 tcpInDataUnorderBytes, end - start); 11706 continue; 11707 } 11708 /* New stuff completely beyond tail? */ 11709 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { 11710 /* Link it on end. */ 11711 mp1->b_cont = mp; 11712 tcp->tcp_reass_tail = mp; 11713 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11714 UPDATE_MIB(&tcp_mib, 11715 tcpInDataUnorderBytes, end - start); 11716 continue; 11717 } 11718 mp1 = tcp->tcp_reass_head; 11719 u1 = TCP_REASS_SEQ(mp1); 11720 /* New stuff at the front? */ 11721 if (SEQ_LT(start, u1)) { 11722 /* Yes... Check for overlap. */ 11723 mp->b_cont = mp1; 11724 tcp->tcp_reass_head = mp; 11725 tcp_reass_elim_overlap(tcp, mp); 11726 continue; 11727 } 11728 /* 11729 * The new piece fits somewhere between the head and tail. 11730 * We find our slot, where mp1 precedes us and mp2 trails. 11731 */ 11732 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 11733 u1 = TCP_REASS_SEQ(mp2); 11734 if (SEQ_LEQ(start, u1)) 11735 break; 11736 } 11737 /* Link ourselves in */ 11738 mp->b_cont = mp2; 11739 mp1->b_cont = mp; 11740 11741 /* Trim overlap with following mblk(s) first */ 11742 tcp_reass_elim_overlap(tcp, mp); 11743 11744 /* Trim overlap with preceding mblk */ 11745 tcp_reass_elim_overlap(tcp, mp1); 11746 11747 } while (start = end, mp = next_mp); 11748 mp1 = tcp->tcp_reass_head; 11749 /* Anything ready to go? */ 11750 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 11751 return (NULL); 11752 /* Eat what we can off the queue */ 11753 for (;;) { 11754 mp = mp1->b_cont; 11755 end = TCP_REASS_END(mp1); 11756 TCP_REASS_SET_SEQ(mp1, 0); 11757 TCP_REASS_SET_END(mp1, 0); 11758 if (!mp) { 11759 tcp->tcp_reass_tail = NULL; 11760 break; 11761 } 11762 if (end != TCP_REASS_SEQ(mp)) { 11763 mp1->b_cont = NULL; 11764 break; 11765 } 11766 mp1 = mp; 11767 } 11768 mp1 = tcp->tcp_reass_head; 11769 tcp->tcp_reass_head = mp; 11770 return (mp1); 11771 } 11772 11773 /* Eliminate any overlap that mp may have over later mblks */ 11774 static void 11775 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 11776 { 11777 uint32_t end; 11778 mblk_t *mp1; 11779 uint32_t u1; 11780 11781 end = TCP_REASS_END(mp); 11782 while ((mp1 = mp->b_cont) != NULL) { 11783 u1 = TCP_REASS_SEQ(mp1); 11784 if (!SEQ_GT(end, u1)) 11785 break; 11786 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 11787 mp->b_wptr -= end - u1; 11788 TCP_REASS_SET_END(mp, u1); 11789 BUMP_MIB(&tcp_mib, tcpInDataPartDupSegs); 11790 UPDATE_MIB(&tcp_mib, tcpInDataPartDupBytes, end - u1); 11791 break; 11792 } 11793 mp->b_cont = mp1->b_cont; 11794 TCP_REASS_SET_SEQ(mp1, 0); 11795 TCP_REASS_SET_END(mp1, 0); 11796 freeb(mp1); 11797 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 11798 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, end - u1); 11799 } 11800 if (!mp1) 11801 tcp->tcp_reass_tail = mp; 11802 } 11803 11804 /* 11805 * Send up all messages queued on tcp_rcv_list. 11806 */ 11807 static uint_t 11808 tcp_rcv_drain(queue_t *q, tcp_t *tcp) 11809 { 11810 mblk_t *mp; 11811 uint_t ret = 0; 11812 uint_t thwin; 11813 #ifdef DEBUG 11814 uint_t cnt = 0; 11815 #endif 11816 /* Can't drain on an eager connection */ 11817 if (tcp->tcp_listener != NULL) 11818 return (ret); 11819 11820 /* 11821 * Handle two cases here: we are currently fused or we were 11822 * previously fused and have some urgent data to be delivered 11823 * upstream. The latter happens because we either ran out of 11824 * memory or were detached and therefore sending the SIGURG was 11825 * deferred until this point. In either case we pass control 11826 * over to tcp_fuse_rcv_drain() since it may need to complete 11827 * some work. 11828 */ 11829 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 11830 ASSERT(tcp->tcp_fused_sigurg_mp != NULL); 11831 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 11832 &tcp->tcp_fused_sigurg_mp)) 11833 return (ret); 11834 } 11835 11836 while ((mp = tcp->tcp_rcv_list) != NULL) { 11837 tcp->tcp_rcv_list = mp->b_next; 11838 mp->b_next = NULL; 11839 #ifdef DEBUG 11840 cnt += msgdsize(mp); 11841 #endif 11842 putnext(q, mp); 11843 } 11844 ASSERT(cnt == tcp->tcp_rcv_cnt); 11845 tcp->tcp_rcv_last_head = NULL; 11846 tcp->tcp_rcv_last_tail = NULL; 11847 tcp->tcp_rcv_cnt = 0; 11848 11849 /* Learn the latest rwnd information that we sent to the other side. */ 11850 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 11851 << tcp->tcp_rcv_ws; 11852 /* This is peer's calculated send window (our receive window). */ 11853 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 11854 /* 11855 * Increase the receive window to max. But we need to do receiver 11856 * SWS avoidance. This means that we need to check the increase of 11857 * of receive window is at least 1 MSS. 11858 */ 11859 if (canputnext(q) && (q->q_hiwat - thwin >= tcp->tcp_mss)) { 11860 /* 11861 * If the window that the other side knows is less than max 11862 * deferred acks segments, send an update immediately. 11863 */ 11864 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 11865 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 11866 ret = TH_ACK_NEEDED; 11867 } 11868 tcp->tcp_rwnd = q->q_hiwat; 11869 } 11870 /* No need for the push timer now. */ 11871 if (tcp->tcp_push_tid != 0) { 11872 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 11873 tcp->tcp_push_tid = 0; 11874 } 11875 return (ret); 11876 } 11877 11878 /* 11879 * Queue data on tcp_rcv_list which is a b_next chain. 11880 * tcp_rcv_last_head/tail is the last element of this chain. 11881 * Each element of the chain is a b_cont chain. 11882 * 11883 * M_DATA messages are added to the current element. 11884 * Other messages are added as new (b_next) elements. 11885 */ 11886 static void 11887 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len) 11888 { 11889 ASSERT(seg_len == msgdsize(mp)); 11890 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 11891 11892 if (tcp->tcp_rcv_list == NULL) { 11893 ASSERT(tcp->tcp_rcv_last_head == NULL); 11894 tcp->tcp_rcv_list = mp; 11895 tcp->tcp_rcv_last_head = mp; 11896 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 11897 tcp->tcp_rcv_last_tail->b_cont = mp; 11898 } else { 11899 tcp->tcp_rcv_last_head->b_next = mp; 11900 tcp->tcp_rcv_last_head = mp; 11901 } 11902 11903 while (mp->b_cont) 11904 mp = mp->b_cont; 11905 11906 tcp->tcp_rcv_last_tail = mp; 11907 tcp->tcp_rcv_cnt += seg_len; 11908 tcp->tcp_rwnd -= seg_len; 11909 } 11910 11911 /* 11912 * DEFAULT TCP ENTRY POINT via squeue on READ side. 11913 * 11914 * This is the default entry function into TCP on the read side. TCP is 11915 * always entered via squeue i.e. using squeue's for mutual exclusion. 11916 * When classifier does a lookup to find the tcp, it also puts a reference 11917 * on the conn structure associated so the tcp is guaranteed to exist 11918 * when we come here. We still need to check the state because it might 11919 * as well has been closed. The squeue processing function i.e. squeue_enter, 11920 * squeue_enter_nodrain, or squeue_drain is responsible for doing the 11921 * CONN_DEC_REF. 11922 * 11923 * Apart from the default entry point, IP also sends packets directly to 11924 * tcp_rput_data for AF_INET fast path and tcp_conn_request for incoming 11925 * connections. 11926 */ 11927 void 11928 tcp_input(void *arg, mblk_t *mp, void *arg2) 11929 { 11930 conn_t *connp = (conn_t *)arg; 11931 tcp_t *tcp = (tcp_t *)connp->conn_tcp; 11932 11933 /* arg2 is the sqp */ 11934 ASSERT(arg2 != NULL); 11935 ASSERT(mp != NULL); 11936 11937 /* 11938 * Don't accept any input on a closed tcp as this TCP logically does 11939 * not exist on the system. Don't proceed further with this TCP. 11940 * For eg. this packet could trigger another close of this tcp 11941 * which would be disastrous for tcp_refcnt. tcp_close_detached / 11942 * tcp_clean_death / tcp_closei_local must be called at most once 11943 * on a TCP. In this case we need to refeed the packet into the 11944 * classifier and figure out where the packet should go. Need to 11945 * preserve the recv_ill somehow. Until we figure that out, for 11946 * now just drop the packet if we can't classify the packet. 11947 */ 11948 if (tcp->tcp_state == TCPS_CLOSED || 11949 tcp->tcp_state == TCPS_BOUND) { 11950 conn_t *new_connp; 11951 11952 new_connp = ipcl_classify(mp, connp->conn_zoneid); 11953 if (new_connp != NULL) { 11954 tcp_reinput(new_connp, mp, arg2); 11955 return; 11956 } 11957 /* We failed to classify. For now just drop the packet */ 11958 freemsg(mp); 11959 return; 11960 } 11961 11962 if (DB_TYPE(mp) == M_DATA) 11963 tcp_rput_data(connp, mp, arg2); 11964 else 11965 tcp_rput_common(tcp, mp); 11966 } 11967 11968 /* 11969 * The read side put procedure. 11970 * The packets passed up by ip are assume to be aligned according to 11971 * OK_32PTR and the IP+TCP headers fitting in the first mblk. 11972 */ 11973 static void 11974 tcp_rput_common(tcp_t *tcp, mblk_t *mp) 11975 { 11976 /* 11977 * tcp_rput_data() does not expect M_CTL except for the case 11978 * where tcp_ipv6_recvancillary is set and we get a IN_PKTINFO 11979 * type. Need to make sure that any other M_CTLs don't make 11980 * it to tcp_rput_data since it is not expecting any and doesn't 11981 * check for it. 11982 */ 11983 if (DB_TYPE(mp) == M_CTL) { 11984 switch (*(uint32_t *)(mp->b_rptr)) { 11985 case TCP_IOC_ABORT_CONN: 11986 /* 11987 * Handle connection abort request. 11988 */ 11989 tcp_ioctl_abort_handler(tcp, mp); 11990 return; 11991 case IPSEC_IN: 11992 /* 11993 * Only secure icmp arrive in TCP and they 11994 * don't go through data path. 11995 */ 11996 tcp_icmp_error(tcp, mp); 11997 return; 11998 case IN_PKTINFO: 11999 /* 12000 * Handle IPV6_RECVPKTINFO socket option on AF_INET6 12001 * sockets that are receiving IPv4 traffic. tcp 12002 */ 12003 ASSERT(tcp->tcp_family == AF_INET6); 12004 ASSERT(tcp->tcp_ipv6_recvancillary & 12005 TCP_IPV6_RECVPKTINFO); 12006 tcp_rput_data(tcp->tcp_connp, mp, 12007 tcp->tcp_connp->conn_sqp); 12008 return; 12009 case MDT_IOC_INFO_UPDATE: 12010 /* 12011 * Handle Multidata information update; the 12012 * following routine will free the message. 12013 */ 12014 if (tcp->tcp_connp->conn_mdt_ok) { 12015 tcp_mdt_update(tcp, 12016 &((ip_mdt_info_t *)mp->b_rptr)->mdt_capab, 12017 B_FALSE); 12018 } 12019 freemsg(mp); 12020 return; 12021 default: 12022 break; 12023 } 12024 } 12025 12026 /* No point processing the message if tcp is already closed */ 12027 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 12028 freemsg(mp); 12029 return; 12030 } 12031 12032 tcp_rput_other(tcp, mp); 12033 } 12034 12035 12036 /* The minimum of smoothed mean deviation in RTO calculation. */ 12037 #define TCP_SD_MIN 400 12038 12039 /* 12040 * Set RTO for this connection. The formula is from Jacobson and Karels' 12041 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names 12042 * are the same as those in Appendix A.2 of that paper. 12043 * 12044 * m = new measurement 12045 * sa = smoothed RTT average (8 * average estimates). 12046 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 12047 */ 12048 static void 12049 tcp_set_rto(tcp_t *tcp, clock_t rtt) 12050 { 12051 long m = TICK_TO_MSEC(rtt); 12052 clock_t sa = tcp->tcp_rtt_sa; 12053 clock_t sv = tcp->tcp_rtt_sd; 12054 clock_t rto; 12055 12056 BUMP_MIB(&tcp_mib, tcpRttUpdate); 12057 tcp->tcp_rtt_update++; 12058 12059 /* tcp_rtt_sa is not 0 means this is a new sample. */ 12060 if (sa != 0) { 12061 /* 12062 * Update average estimator: 12063 * new rtt = 7/8 old rtt + 1/8 Error 12064 */ 12065 12066 /* m is now Error in estimate. */ 12067 m -= sa >> 3; 12068 if ((sa += m) <= 0) { 12069 /* 12070 * Don't allow the smoothed average to be negative. 12071 * We use 0 to denote reinitialization of the 12072 * variables. 12073 */ 12074 sa = 1; 12075 } 12076 12077 /* 12078 * Update deviation estimator: 12079 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) 12080 */ 12081 if (m < 0) 12082 m = -m; 12083 m -= sv >> 2; 12084 sv += m; 12085 } else { 12086 /* 12087 * This follows BSD's implementation. So the reinitialized 12088 * RTO is 3 * m. We cannot go less than 2 because if the 12089 * link is bandwidth dominated, doubling the window size 12090 * during slow start means doubling the RTT. We want to be 12091 * more conservative when we reinitialize our estimates. 3 12092 * is just a convenient number. 12093 */ 12094 sa = m << 3; 12095 sv = m << 1; 12096 } 12097 if (sv < TCP_SD_MIN) { 12098 /* 12099 * We do not know that if sa captures the delay ACK 12100 * effect as in a long train of segments, a receiver 12101 * does not delay its ACKs. So set the minimum of sv 12102 * to be TCP_SD_MIN, which is default to 400 ms, twice 12103 * of BSD DATO. That means the minimum of mean 12104 * deviation is 100 ms. 12105 * 12106 */ 12107 sv = TCP_SD_MIN; 12108 } 12109 tcp->tcp_rtt_sa = sa; 12110 tcp->tcp_rtt_sd = sv; 12111 /* 12112 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) 12113 * 12114 * Add tcp_rexmit_interval extra in case of extreme environment 12115 * where the algorithm fails to work. The default value of 12116 * tcp_rexmit_interval_extra should be 0. 12117 * 12118 * As we use a finer grained clock than BSD and update 12119 * RTO for every ACKs, add in another .25 of RTT to the 12120 * deviation of RTO to accomodate burstiness of 1/4 of 12121 * window size. 12122 */ 12123 rto = (sa >> 3) + sv + tcp_rexmit_interval_extra + (sa >> 5); 12124 12125 if (rto > tcp_rexmit_interval_max) { 12126 tcp->tcp_rto = tcp_rexmit_interval_max; 12127 } else if (rto < tcp_rexmit_interval_min) { 12128 tcp->tcp_rto = tcp_rexmit_interval_min; 12129 } else { 12130 tcp->tcp_rto = rto; 12131 } 12132 12133 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 12134 tcp->tcp_timer_backoff = 0; 12135 } 12136 12137 /* 12138 * tcp_get_seg_mp() is called to get the pointer to a segment in the 12139 * send queue which starts at the given seq. no. 12140 * 12141 * Parameters: 12142 * tcp_t *tcp: the tcp instance pointer. 12143 * uint32_t seq: the starting seq. no of the requested segment. 12144 * int32_t *off: after the execution, *off will be the offset to 12145 * the returned mblk which points to the requested seq no. 12146 * It is the caller's responsibility to send in a non-null off. 12147 * 12148 * Return: 12149 * A mblk_t pointer pointing to the requested segment in send queue. 12150 */ 12151 static mblk_t * 12152 tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off) 12153 { 12154 int32_t cnt; 12155 mblk_t *mp; 12156 12157 /* Defensive coding. Make sure we don't send incorrect data. */ 12158 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 12159 return (NULL); 12160 12161 cnt = seq - tcp->tcp_suna; 12162 mp = tcp->tcp_xmit_head; 12163 while (cnt > 0 && mp != NULL) { 12164 cnt -= mp->b_wptr - mp->b_rptr; 12165 if (cnt < 0) { 12166 cnt += mp->b_wptr - mp->b_rptr; 12167 break; 12168 } 12169 mp = mp->b_cont; 12170 } 12171 ASSERT(mp != NULL); 12172 *off = cnt; 12173 return (mp); 12174 } 12175 12176 /* 12177 * This function handles all retransmissions if SACK is enabled for this 12178 * connection. First it calculates how many segments can be retransmitted 12179 * based on tcp_pipe. Then it goes thru the notsack list to find eligible 12180 * segments. A segment is eligible if sack_cnt for that segment is greater 12181 * than or equal tcp_dupack_fast_retransmit. After it has retransmitted 12182 * all eligible segments, it checks to see if TCP can send some new segments 12183 * (fast recovery). If it can, set the appropriate flag for tcp_rput_data(). 12184 * 12185 * Parameters: 12186 * tcp_t *tcp: the tcp structure of the connection. 12187 * uint_t *flags: in return, appropriate value will be set for 12188 * tcp_rput_data(). 12189 */ 12190 static void 12191 tcp_sack_rxmit(tcp_t *tcp, uint_t *flags) 12192 { 12193 notsack_blk_t *notsack_blk; 12194 int32_t usable_swnd; 12195 int32_t mss; 12196 uint32_t seg_len; 12197 mblk_t *xmit_mp; 12198 12199 ASSERT(tcp->tcp_sack_info != NULL); 12200 ASSERT(tcp->tcp_notsack_list != NULL); 12201 ASSERT(tcp->tcp_rexmit == B_FALSE); 12202 12203 /* Defensive coding in case there is a bug... */ 12204 if (tcp->tcp_notsack_list == NULL) { 12205 return; 12206 } 12207 notsack_blk = tcp->tcp_notsack_list; 12208 mss = tcp->tcp_mss; 12209 12210 /* 12211 * Limit the num of outstanding data in the network to be 12212 * tcp_cwnd_ssthresh, which is half of the original congestion wnd. 12213 */ 12214 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 12215 12216 /* At least retransmit 1 MSS of data. */ 12217 if (usable_swnd <= 0) { 12218 usable_swnd = mss; 12219 } 12220 12221 /* Make sure no new RTT samples will be taken. */ 12222 tcp->tcp_csuna = tcp->tcp_snxt; 12223 12224 notsack_blk = tcp->tcp_notsack_list; 12225 while (usable_swnd > 0) { 12226 mblk_t *snxt_mp, *tmp_mp; 12227 tcp_seq begin = tcp->tcp_sack_snxt; 12228 tcp_seq end; 12229 int32_t off; 12230 12231 for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) { 12232 if (SEQ_GT(notsack_blk->end, begin) && 12233 (notsack_blk->sack_cnt >= 12234 tcp_dupack_fast_retransmit)) { 12235 end = notsack_blk->end; 12236 if (SEQ_LT(begin, notsack_blk->begin)) { 12237 begin = notsack_blk->begin; 12238 } 12239 break; 12240 } 12241 } 12242 /* 12243 * All holes are filled. Manipulate tcp_cwnd to send more 12244 * if we can. Note that after the SACK recovery, tcp_cwnd is 12245 * set to tcp_cwnd_ssthresh. 12246 */ 12247 if (notsack_blk == NULL) { 12248 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 12249 if (usable_swnd <= 0 || tcp->tcp_unsent == 0) { 12250 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna; 12251 ASSERT(tcp->tcp_cwnd > 0); 12252 return; 12253 } else { 12254 usable_swnd = usable_swnd / mss; 12255 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna + 12256 MAX(usable_swnd * mss, mss); 12257 *flags |= TH_XMIT_NEEDED; 12258 return; 12259 } 12260 } 12261 12262 /* 12263 * Note that we may send more than usable_swnd allows here 12264 * because of round off, but no more than 1 MSS of data. 12265 */ 12266 seg_len = end - begin; 12267 if (seg_len > mss) 12268 seg_len = mss; 12269 snxt_mp = tcp_get_seg_mp(tcp, begin, &off); 12270 ASSERT(snxt_mp != NULL); 12271 /* This should not happen. Defensive coding again... */ 12272 if (snxt_mp == NULL) { 12273 return; 12274 } 12275 12276 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off, 12277 &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE); 12278 if (xmit_mp == NULL) 12279 return; 12280 12281 usable_swnd -= seg_len; 12282 tcp->tcp_pipe += seg_len; 12283 tcp->tcp_sack_snxt = begin + seg_len; 12284 TCP_RECORD_TRACE(tcp, xmit_mp, TCP_TRACE_SEND_PKT); 12285 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 12286 12287 /* 12288 * Update the send timestamp to avoid false retransmission. 12289 */ 12290 snxt_mp->b_prev = (mblk_t *)lbolt; 12291 12292 BUMP_MIB(&tcp_mib, tcpRetransSegs); 12293 UPDATE_MIB(&tcp_mib, tcpRetransBytes, seg_len); 12294 BUMP_MIB(&tcp_mib, tcpOutSackRetransSegs); 12295 /* 12296 * Update tcp_rexmit_max to extend this SACK recovery phase. 12297 * This happens when new data sent during fast recovery is 12298 * also lost. If TCP retransmits those new data, it needs 12299 * to extend SACK recover phase to avoid starting another 12300 * fast retransmit/recovery unnecessarily. 12301 */ 12302 if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) { 12303 tcp->tcp_rexmit_max = tcp->tcp_sack_snxt; 12304 } 12305 } 12306 } 12307 12308 /* 12309 * This function handles policy checking at TCP level for non-hard_bound/ 12310 * detached connections. 12311 */ 12312 static boolean_t 12313 tcp_check_policy(tcp_t *tcp, mblk_t *first_mp, ipha_t *ipha, ip6_t *ip6h, 12314 boolean_t secure, boolean_t mctl_present) 12315 { 12316 ipsec_latch_t *ipl = NULL; 12317 ipsec_action_t *act = NULL; 12318 mblk_t *data_mp; 12319 ipsec_in_t *ii; 12320 const char *reason; 12321 kstat_named_t *counter; 12322 12323 ASSERT(mctl_present || !secure); 12324 12325 ASSERT((ipha == NULL && ip6h != NULL) || 12326 (ip6h == NULL && ipha != NULL)); 12327 12328 /* 12329 * We don't necessarily have an ipsec_in_act action to verify 12330 * policy because of assymetrical policy where we have only 12331 * outbound policy and no inbound policy (possible with global 12332 * policy). 12333 */ 12334 if (!secure) { 12335 if (act == NULL || act->ipa_act.ipa_type == IPSEC_ACT_BYPASS || 12336 act->ipa_act.ipa_type == IPSEC_ACT_CLEAR) 12337 return (B_TRUE); 12338 ipsec_log_policy_failure(tcp->tcp_wq, IPSEC_POLICY_MISMATCH, 12339 "tcp_check_policy", ipha, ip6h, secure); 12340 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 12341 &ipdrops_tcp_clear, &tcp_dropper); 12342 return (B_FALSE); 12343 } 12344 12345 /* 12346 * We have a secure packet. 12347 */ 12348 if (act == NULL) { 12349 ipsec_log_policy_failure(tcp->tcp_wq, 12350 IPSEC_POLICY_NOT_NEEDED, "tcp_check_policy", ipha, ip6h, 12351 secure); 12352 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 12353 &ipdrops_tcp_secure, &tcp_dropper); 12354 return (B_FALSE); 12355 } 12356 12357 /* 12358 * XXX This whole routine is currently incorrect. ipl should 12359 * be set to the latch pointer, but is currently not set, so 12360 * we initialize it to NULL to avoid picking up random garbage. 12361 */ 12362 if (ipl == NULL) 12363 return (B_TRUE); 12364 12365 data_mp = first_mp->b_cont; 12366 12367 ii = (ipsec_in_t *)first_mp->b_rptr; 12368 12369 if (ipsec_check_ipsecin_latch(ii, data_mp, ipl, ipha, ip6h, &reason, 12370 &counter)) { 12371 BUMP_MIB(&ip_mib, ipsecInSucceeded); 12372 return (B_TRUE); 12373 } 12374 (void) strlog(TCP_MODULE_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE, 12375 "tcp inbound policy mismatch: %s, packet dropped\n", 12376 reason); 12377 BUMP_MIB(&ip_mib, ipsecInFailed); 12378 12379 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter, &tcp_dropper); 12380 return (B_FALSE); 12381 } 12382 12383 /* 12384 * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start 12385 * retransmission after a timeout. 12386 * 12387 * To limit the number of duplicate segments, we limit the number of segment 12388 * to be sent in one time to tcp_snd_burst, the burst variable. 12389 */ 12390 static void 12391 tcp_ss_rexmit(tcp_t *tcp) 12392 { 12393 uint32_t snxt; 12394 uint32_t smax; 12395 int32_t win; 12396 int32_t mss; 12397 int32_t off; 12398 int32_t burst = tcp->tcp_snd_burst; 12399 mblk_t *snxt_mp; 12400 12401 /* 12402 * Note that tcp_rexmit can be set even though TCP has retransmitted 12403 * all unack'ed segments. 12404 */ 12405 if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) { 12406 smax = tcp->tcp_rexmit_max; 12407 snxt = tcp->tcp_rexmit_nxt; 12408 if (SEQ_LT(snxt, tcp->tcp_suna)) { 12409 snxt = tcp->tcp_suna; 12410 } 12411 win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd); 12412 win -= snxt - tcp->tcp_suna; 12413 mss = tcp->tcp_mss; 12414 snxt_mp = tcp_get_seg_mp(tcp, snxt, &off); 12415 12416 while (SEQ_LT(snxt, smax) && (win > 0) && 12417 (burst > 0) && (snxt_mp != NULL)) { 12418 mblk_t *xmit_mp; 12419 mblk_t *old_snxt_mp = snxt_mp; 12420 uint32_t cnt = mss; 12421 12422 if (win < cnt) { 12423 cnt = win; 12424 } 12425 if (SEQ_GT(snxt + cnt, smax)) { 12426 cnt = smax - snxt; 12427 } 12428 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off, 12429 &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE); 12430 if (xmit_mp == NULL) 12431 return; 12432 12433 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 12434 12435 snxt += cnt; 12436 win -= cnt; 12437 /* 12438 * Update the send timestamp to avoid false 12439 * retransmission. 12440 */ 12441 old_snxt_mp->b_prev = (mblk_t *)lbolt; 12442 BUMP_MIB(&tcp_mib, tcpRetransSegs); 12443 UPDATE_MIB(&tcp_mib, tcpRetransBytes, cnt); 12444 12445 tcp->tcp_rexmit_nxt = snxt; 12446 burst--; 12447 } 12448 /* 12449 * If we have transmitted all we have at the time 12450 * we started the retranmission, we can leave 12451 * the rest of the job to tcp_wput_data(). But we 12452 * need to check the send window first. If the 12453 * win is not 0, go on with tcp_wput_data(). 12454 */ 12455 if (SEQ_LT(snxt, smax) || win == 0) { 12456 return; 12457 } 12458 } 12459 /* Only call tcp_wput_data() if there is data to be sent. */ 12460 if (tcp->tcp_unsent) { 12461 tcp_wput_data(tcp, NULL, B_FALSE); 12462 } 12463 } 12464 12465 /* 12466 * Process all TCP option in SYN segment. Note that this function should 12467 * be called after tcp_adapt_ire() is called so that the necessary info 12468 * from IRE is already set in the tcp structure. 12469 * 12470 * This function sets up the correct tcp_mss value according to the 12471 * MSS option value and our header size. It also sets up the window scale 12472 * and timestamp values, and initialize SACK info blocks. But it does not 12473 * change receive window size after setting the tcp_mss value. The caller 12474 * should do the appropriate change. 12475 */ 12476 void 12477 tcp_process_options(tcp_t *tcp, tcph_t *tcph) 12478 { 12479 int options; 12480 tcp_opt_t tcpopt; 12481 uint32_t mss_max; 12482 char *tmp_tcph; 12483 12484 tcpopt.tcp = NULL; 12485 options = tcp_parse_options(tcph, &tcpopt); 12486 12487 /* 12488 * Process MSS option. Note that MSS option value does not account 12489 * for IP or TCP options. This means that it is equal to MTU - minimum 12490 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 12491 * IPv6. 12492 */ 12493 if (!(options & TCP_OPT_MSS_PRESENT)) { 12494 if (tcp->tcp_ipversion == IPV4_VERSION) 12495 tcpopt.tcp_opt_mss = tcp_mss_def_ipv4; 12496 else 12497 tcpopt.tcp_opt_mss = tcp_mss_def_ipv6; 12498 } else { 12499 if (tcp->tcp_ipversion == IPV4_VERSION) 12500 mss_max = tcp_mss_max_ipv4; 12501 else 12502 mss_max = tcp_mss_max_ipv6; 12503 if (tcpopt.tcp_opt_mss < tcp_mss_min) 12504 tcpopt.tcp_opt_mss = tcp_mss_min; 12505 else if (tcpopt.tcp_opt_mss > mss_max) 12506 tcpopt.tcp_opt_mss = mss_max; 12507 } 12508 12509 /* Process Window Scale option. */ 12510 if (options & TCP_OPT_WSCALE_PRESENT) { 12511 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 12512 tcp->tcp_snd_ws_ok = B_TRUE; 12513 } else { 12514 tcp->tcp_snd_ws = B_FALSE; 12515 tcp->tcp_snd_ws_ok = B_FALSE; 12516 tcp->tcp_rcv_ws = B_FALSE; 12517 } 12518 12519 /* Process Timestamp option. */ 12520 if ((options & TCP_OPT_TSTAMP_PRESENT) && 12521 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 12522 tmp_tcph = (char *)tcp->tcp_tcph; 12523 12524 tcp->tcp_snd_ts_ok = B_TRUE; 12525 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 12526 tcp->tcp_last_rcv_lbolt = lbolt64; 12527 ASSERT(OK_32PTR(tmp_tcph)); 12528 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 12529 12530 /* Fill in our template header with basic timestamp option. */ 12531 tmp_tcph += tcp->tcp_tcp_hdr_len; 12532 tmp_tcph[0] = TCPOPT_NOP; 12533 tmp_tcph[1] = TCPOPT_NOP; 12534 tmp_tcph[2] = TCPOPT_TSTAMP; 12535 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 12536 tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12537 tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12538 tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4); 12539 } else { 12540 tcp->tcp_snd_ts_ok = B_FALSE; 12541 } 12542 12543 /* 12544 * Process SACK options. If SACK is enabled for this connection, 12545 * then allocate the SACK info structure. Note the following ways 12546 * when tcp_snd_sack_ok is set to true. 12547 * 12548 * For active connection: in tcp_adapt_ire() called in 12549 * tcp_rput_other(), or in tcp_rput_other() when tcp_sack_permitted 12550 * is checked. 12551 * 12552 * For passive connection: in tcp_adapt_ire() called in 12553 * tcp_accept_comm(). 12554 * 12555 * That's the reason why the extra TCP_IS_DETACHED() check is there. 12556 * That check makes sure that if we did not send a SACK OK option, 12557 * we will not enable SACK for this connection even though the other 12558 * side sends us SACK OK option. For active connection, the SACK 12559 * info structure has already been allocated. So we need to free 12560 * it if SACK is disabled. 12561 */ 12562 if ((options & TCP_OPT_SACK_OK_PRESENT) && 12563 (tcp->tcp_snd_sack_ok || 12564 (tcp_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 12565 /* This should be true only in the passive case. */ 12566 if (tcp->tcp_sack_info == NULL) { 12567 ASSERT(TCP_IS_DETACHED(tcp)); 12568 tcp->tcp_sack_info = 12569 kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP); 12570 } 12571 if (tcp->tcp_sack_info == NULL) { 12572 tcp->tcp_snd_sack_ok = B_FALSE; 12573 } else { 12574 tcp->tcp_snd_sack_ok = B_TRUE; 12575 if (tcp->tcp_snd_ts_ok) { 12576 tcp->tcp_max_sack_blk = 3; 12577 } else { 12578 tcp->tcp_max_sack_blk = 4; 12579 } 12580 } 12581 } else { 12582 /* 12583 * Resetting tcp_snd_sack_ok to B_FALSE so that 12584 * no SACK info will be used for this 12585 * connection. This assumes that SACK usage 12586 * permission is negotiated. This may need 12587 * to be changed once this is clarified. 12588 */ 12589 if (tcp->tcp_sack_info != NULL) { 12590 kmem_cache_free(tcp_sack_info_cache, 12591 tcp->tcp_sack_info); 12592 tcp->tcp_sack_info = NULL; 12593 } 12594 tcp->tcp_snd_sack_ok = B_FALSE; 12595 } 12596 12597 /* 12598 * Now we know the exact TCP/IP header length, subtract 12599 * that from tcp_mss to get our side's MSS. 12600 */ 12601 tcp->tcp_mss -= tcp->tcp_hdr_len; 12602 /* 12603 * Here we assume that the other side's header size will be equal to 12604 * our header size. We calculate the real MSS accordingly. Need to 12605 * take into additional stuffs IPsec puts in. 12606 * 12607 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 12608 */ 12609 tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len + tcp->tcp_ipsec_overhead - 12610 ((tcp->tcp_ipversion == IPV4_VERSION ? 12611 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 12612 12613 /* 12614 * Set MSS to the smaller one of both ends of the connection. 12615 * We should not have called tcp_mss_set() before, but our 12616 * side of the MSS should have been set to a proper value 12617 * by tcp_adapt_ire(). tcp_mss_set() will also set up the 12618 * STREAM head parameters properly. 12619 * 12620 * If we have a larger-than-16-bit window but the other side 12621 * didn't want to do window scale, tcp_rwnd_set() will take 12622 * care of that. 12623 */ 12624 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 12625 } 12626 12627 /* 12628 * Sends the T_CONN_IND to the listener. The caller calls this 12629 * functions via squeue to get inside the listener's perimeter 12630 * once the 3 way hand shake is done a T_CONN_IND needs to be 12631 * sent. As an optimization, the caller can call this directly 12632 * if listener's perimeter is same as eager's. 12633 */ 12634 /* ARGSUSED */ 12635 void 12636 tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2) 12637 { 12638 conn_t *lconnp = (conn_t *)arg; 12639 tcp_t *listener = lconnp->conn_tcp; 12640 tcp_t *tcp; 12641 struct T_conn_ind *conn_ind; 12642 ipaddr_t *addr_cache; 12643 boolean_t need_send_conn_ind = B_FALSE; 12644 12645 /* retrieve the eager */ 12646 conn_ind = (struct T_conn_ind *)mp->b_rptr; 12647 ASSERT(conn_ind->OPT_offset != 0 && 12648 conn_ind->OPT_length == sizeof (intptr_t)); 12649 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 12650 conn_ind->OPT_length); 12651 12652 /* 12653 * TLI/XTI applications will get confused by 12654 * sending eager as an option since it violates 12655 * the option semantics. So remove the eager as 12656 * option since TLI/XTI app doesn't need it anyway. 12657 */ 12658 if (!TCP_IS_SOCKET(listener)) { 12659 conn_ind->OPT_length = 0; 12660 conn_ind->OPT_offset = 0; 12661 } 12662 if (listener->tcp_state == TCPS_CLOSED || 12663 TCP_IS_DETACHED(listener)) { 12664 /* 12665 * If listener has closed, it would have caused a 12666 * a cleanup/blowoff to happen for the eager. We 12667 * just need to return. 12668 */ 12669 freemsg(mp); 12670 return; 12671 } 12672 12673 12674 /* 12675 * if the conn_req_q is full defer passing up the 12676 * T_CONN_IND until space is availabe after t_accept() 12677 * processing 12678 */ 12679 mutex_enter(&listener->tcp_eager_lock); 12680 if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) { 12681 tcp_t *tail; 12682 12683 /* 12684 * The eager already has an extra ref put in tcp_rput_data 12685 * so that it stays till accept comes back even though it 12686 * might get into TCPS_CLOSED as a result of a TH_RST etc. 12687 */ 12688 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 12689 listener->tcp_conn_req_cnt_q0--; 12690 listener->tcp_conn_req_cnt_q++; 12691 12692 /* Move from SYN_RCVD to ESTABLISHED list */ 12693 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12694 tcp->tcp_eager_prev_q0; 12695 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12696 tcp->tcp_eager_next_q0; 12697 tcp->tcp_eager_prev_q0 = NULL; 12698 tcp->tcp_eager_next_q0 = NULL; 12699 12700 /* 12701 * Insert at end of the queue because sockfs 12702 * sends down T_CONN_RES in chronological 12703 * order. Leaving the older conn indications 12704 * at front of the queue helps reducing search 12705 * time. 12706 */ 12707 tail = listener->tcp_eager_last_q; 12708 if (tail != NULL) 12709 tail->tcp_eager_next_q = tcp; 12710 else 12711 listener->tcp_eager_next_q = tcp; 12712 listener->tcp_eager_last_q = tcp; 12713 tcp->tcp_eager_next_q = NULL; 12714 /* 12715 * Delay sending up the T_conn_ind until we are 12716 * done with the eager. Once we have have sent up 12717 * the T_conn_ind, the accept can potentially complete 12718 * any time and release the refhold we have on the eager. 12719 */ 12720 need_send_conn_ind = B_TRUE; 12721 } else { 12722 /* 12723 * Defer connection on q0 and set deferred 12724 * connection bit true 12725 */ 12726 tcp->tcp_conn_def_q0 = B_TRUE; 12727 12728 /* take tcp out of q0 ... */ 12729 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12730 tcp->tcp_eager_next_q0; 12731 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12732 tcp->tcp_eager_prev_q0; 12733 12734 /* ... and place it at the end of q0 */ 12735 tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0; 12736 tcp->tcp_eager_next_q0 = listener; 12737 listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp; 12738 listener->tcp_eager_prev_q0 = tcp; 12739 tcp->tcp_conn.tcp_eager_conn_ind = mp; 12740 } 12741 12742 /* we have timed out before */ 12743 if (tcp->tcp_syn_rcvd_timeout != 0) { 12744 tcp->tcp_syn_rcvd_timeout = 0; 12745 listener->tcp_syn_rcvd_timeout--; 12746 if (listener->tcp_syn_defense && 12747 listener->tcp_syn_rcvd_timeout <= 12748 (tcp_conn_req_max_q0 >> 5) && 12749 10*MINUTES < TICK_TO_MSEC(lbolt64 - 12750 listener->tcp_last_rcv_lbolt)) { 12751 /* 12752 * Turn off the defense mode if we 12753 * believe the SYN attack is over. 12754 */ 12755 listener->tcp_syn_defense = B_FALSE; 12756 if (listener->tcp_ip_addr_cache) { 12757 kmem_free((void *)listener->tcp_ip_addr_cache, 12758 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 12759 listener->tcp_ip_addr_cache = NULL; 12760 } 12761 } 12762 } 12763 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 12764 if (addr_cache != NULL) { 12765 /* 12766 * We have finished a 3-way handshake with this 12767 * remote host. This proves the IP addr is good. 12768 * Cache it! 12769 */ 12770 addr_cache[IP_ADDR_CACHE_HASH( 12771 tcp->tcp_remote)] = tcp->tcp_remote; 12772 } 12773 mutex_exit(&listener->tcp_eager_lock); 12774 if (need_send_conn_ind) 12775 putnext(listener->tcp_rq, mp); 12776 } 12777 12778 mblk_t * 12779 tcp_find_pktinfo(tcp_t *tcp, mblk_t *mp, uint_t *ipversp, uint_t *ip_hdr_lenp, 12780 uint_t *ifindexp, ip6_pkt_t *ippp) 12781 { 12782 in_pktinfo_t *pinfo; 12783 ip6_t *ip6h; 12784 uchar_t *rptr; 12785 mblk_t *first_mp = mp; 12786 boolean_t mctl_present = B_FALSE; 12787 uint_t ifindex = 0; 12788 ip6_pkt_t ipp; 12789 uint_t ipvers; 12790 uint_t ip_hdr_len; 12791 12792 rptr = mp->b_rptr; 12793 ASSERT(OK_32PTR(rptr)); 12794 ASSERT(tcp != NULL); 12795 ipp.ipp_fields = 0; 12796 12797 switch DB_TYPE(mp) { 12798 case M_CTL: 12799 mp = mp->b_cont; 12800 if (mp == NULL) { 12801 freemsg(first_mp); 12802 return (NULL); 12803 } 12804 if (DB_TYPE(mp) != M_DATA) { 12805 freemsg(first_mp); 12806 return (NULL); 12807 } 12808 mctl_present = B_TRUE; 12809 break; 12810 case M_DATA: 12811 break; 12812 default: 12813 cmn_err(CE_NOTE, "tcp_find_pktinfo: unknown db_type"); 12814 freemsg(mp); 12815 return (NULL); 12816 } 12817 ipvers = IPH_HDR_VERSION(rptr); 12818 if (ipvers == IPV4_VERSION) { 12819 if (tcp == NULL) { 12820 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12821 goto done; 12822 } 12823 12824 ipp.ipp_fields |= IPPF_HOPLIMIT; 12825 ipp.ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl; 12826 12827 /* 12828 * If we have IN_PKTINFO in an M_CTL and tcp_ipv6_recvancillary 12829 * has TCP_IPV6_RECVPKTINFO set, pass I/F index along in ipp. 12830 */ 12831 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) && 12832 mctl_present) { 12833 pinfo = (in_pktinfo_t *)first_mp->b_rptr; 12834 if ((MBLKL(first_mp) == sizeof (in_pktinfo_t)) && 12835 (pinfo->in_pkt_ulp_type == IN_PKTINFO) && 12836 (pinfo->in_pkt_flags & IPF_RECVIF)) { 12837 ipp.ipp_fields |= IPPF_IFINDEX; 12838 ipp.ipp_ifindex = pinfo->in_pkt_ifindex; 12839 ifindex = pinfo->in_pkt_ifindex; 12840 } 12841 freeb(first_mp); 12842 mctl_present = B_FALSE; 12843 } 12844 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12845 } else { 12846 ip6h = (ip6_t *)rptr; 12847 12848 ASSERT(ipvers == IPV6_VERSION); 12849 ipp.ipp_fields = IPPF_HOPLIMIT | IPPF_TCLASS; 12850 ipp.ipp_tclass = (ip6h->ip6_flow & 0x0FF00000) >> 20; 12851 ipp.ipp_hoplimit = ip6h->ip6_hops; 12852 12853 if (ip6h->ip6_nxt != IPPROTO_TCP) { 12854 uint8_t nexthdrp; 12855 12856 /* Look for ifindex information */ 12857 if (ip6h->ip6_nxt == IPPROTO_RAW) { 12858 ip6i_t *ip6i = (ip6i_t *)ip6h; 12859 if ((uchar_t *)&ip6i[1] > mp->b_wptr) { 12860 BUMP_MIB(&ip_mib, tcpInErrs); 12861 freemsg(first_mp); 12862 return (NULL); 12863 } 12864 12865 if (ip6i->ip6i_flags & IP6I_IFINDEX) { 12866 ASSERT(ip6i->ip6i_ifindex != 0); 12867 ipp.ipp_fields |= IPPF_IFINDEX; 12868 ipp.ipp_ifindex = ip6i->ip6i_ifindex; 12869 ifindex = ip6i->ip6i_ifindex; 12870 } 12871 rptr = (uchar_t *)&ip6i[1]; 12872 mp->b_rptr = rptr; 12873 if (rptr == mp->b_wptr) { 12874 mblk_t *mp1; 12875 mp1 = mp->b_cont; 12876 freeb(mp); 12877 mp = mp1; 12878 rptr = mp->b_rptr; 12879 } 12880 if (MBLKL(mp) < IPV6_HDR_LEN + 12881 sizeof (tcph_t)) { 12882 BUMP_MIB(&ip_mib, tcpInErrs); 12883 freemsg(first_mp); 12884 return (NULL); 12885 } 12886 ip6h = (ip6_t *)rptr; 12887 } 12888 12889 /* 12890 * Find any potentially interesting extension headers 12891 * as well as the length of the IPv6 + extension 12892 * headers. 12893 */ 12894 ip_hdr_len = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp); 12895 /* Verify if this is a TCP packet */ 12896 if (nexthdrp != IPPROTO_TCP) { 12897 BUMP_MIB(&ip_mib, tcpInErrs); 12898 freemsg(first_mp); 12899 return (NULL); 12900 } 12901 } else { 12902 ip_hdr_len = IPV6_HDR_LEN; 12903 } 12904 } 12905 12906 done: 12907 if (ipversp != NULL) 12908 *ipversp = ipvers; 12909 if (ip_hdr_lenp != NULL) 12910 *ip_hdr_lenp = ip_hdr_len; 12911 if (ippp != NULL) 12912 *ippp = ipp; 12913 if (ifindexp != NULL) 12914 *ifindexp = ifindex; 12915 if (mctl_present) { 12916 freeb(first_mp); 12917 } 12918 return (mp); 12919 } 12920 12921 /* 12922 * Handle M_DATA messages from IP. Its called directly from IP via 12923 * squeue for AF_INET type sockets fast path. No M_CTL are expected 12924 * in this path. 12925 * 12926 * For everything else (including AF_INET6 sockets with 'tcp_ipversion' 12927 * v4 and v6), we are called through tcp_input() and a M_CTL can 12928 * be present for options but tcp_find_pktinfo() deals with it. We 12929 * only expect M_DATA packets after tcp_find_pktinfo() is done. 12930 * 12931 * The first argument is always the connp/tcp to which the mp belongs. 12932 * There are no exceptions to this rule. The caller has already put 12933 * a reference on this connp/tcp and once tcp_rput_data() returns, 12934 * the squeue will do the refrele. 12935 * 12936 * The TH_SYN for the listener directly go to tcp_conn_request via 12937 * squeue. 12938 * 12939 * sqp: NULL = recursive, sqp != NULL means called from squeue 12940 */ 12941 void 12942 tcp_rput_data(void *arg, mblk_t *mp, void *arg2) 12943 { 12944 int32_t bytes_acked; 12945 int32_t gap; 12946 mblk_t *mp1; 12947 uint_t flags; 12948 uint32_t new_swnd = 0; 12949 uchar_t *iphdr; 12950 uchar_t *rptr; 12951 int32_t rgap; 12952 uint32_t seg_ack; 12953 int seg_len; 12954 uint_t ip_hdr_len; 12955 uint32_t seg_seq; 12956 tcph_t *tcph; 12957 int urp; 12958 tcp_opt_t tcpopt; 12959 uint_t ipvers; 12960 ip6_pkt_t ipp; 12961 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 12962 uint32_t cwnd; 12963 uint32_t add; 12964 int npkt; 12965 int mss; 12966 conn_t *connp = (conn_t *)arg; 12967 squeue_t *sqp = (squeue_t *)arg2; 12968 tcp_t *tcp = connp->conn_tcp; 12969 12970 /* 12971 * RST from fused tcp loopback peer should trigger an unfuse. 12972 */ 12973 if (tcp->tcp_fused) { 12974 TCP_STAT(tcp_fusion_aborted); 12975 tcp_unfuse(tcp); 12976 } 12977 12978 iphdr = mp->b_rptr; 12979 rptr = mp->b_rptr; 12980 ASSERT(OK_32PTR(rptr)); 12981 12982 /* 12983 * An AF_INET socket is not capable of receiving any pktinfo. Do inline 12984 * processing here. For rest call tcp_find_pktinfo to fill up the 12985 * necessary information. 12986 */ 12987 if (IPCL_IS_TCP4(connp)) { 12988 ipvers = IPV4_VERSION; 12989 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12990 } else { 12991 mp = tcp_find_pktinfo(tcp, mp, &ipvers, &ip_hdr_len, 12992 NULL, &ipp); 12993 if (mp == NULL) { 12994 TCP_STAT(tcp_rput_v6_error); 12995 return; 12996 } 12997 iphdr = mp->b_rptr; 12998 rptr = mp->b_rptr; 12999 } 13000 ASSERT(DB_TYPE(mp) == M_DATA); 13001 13002 tcph = (tcph_t *)&rptr[ip_hdr_len]; 13003 seg_seq = ABE32_TO_U32(tcph->th_seq); 13004 seg_ack = ABE32_TO_U32(tcph->th_ack); 13005 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 13006 seg_len = (int)(mp->b_wptr - rptr) - 13007 (ip_hdr_len + TCP_HDR_LENGTH(tcph)); 13008 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 13009 do { 13010 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 13011 (uintptr_t)INT_MAX); 13012 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 13013 } while ((mp1 = mp1->b_cont) != NULL && 13014 mp1->b_datap->db_type == M_DATA); 13015 } 13016 13017 if (tcp->tcp_state == TCPS_TIME_WAIT) { 13018 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 13019 seg_len, tcph); 13020 return; 13021 } 13022 13023 if (sqp != NULL) { 13024 /* 13025 * This is the correct place to update tcp_last_recv_time. Note 13026 * that it is also updated for tcp structure that belongs to 13027 * global and listener queues which do not really need updating. 13028 * But that should not cause any harm. And it is updated for 13029 * all kinds of incoming segments, not only for data segments. 13030 */ 13031 tcp->tcp_last_recv_time = lbolt; 13032 } 13033 13034 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 13035 13036 BUMP_LOCAL(tcp->tcp_ibsegs); 13037 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 13038 13039 if ((flags & TH_URG) && sqp != NULL) { 13040 /* 13041 * TCP can't handle urgent pointers that arrive before 13042 * the connection has been accept()ed since it can't 13043 * buffer OOB data. Discard segment if this happens. 13044 * 13045 * Nor can it reassemble urgent pointers, so discard 13046 * if it's not the next segment expected. 13047 * 13048 * Otherwise, collapse chain into one mblk (discard if 13049 * that fails). This makes sure the headers, retransmitted 13050 * data, and new data all are in the same mblk. 13051 */ 13052 ASSERT(mp != NULL); 13053 if (tcp->tcp_listener || !pullupmsg(mp, -1)) { 13054 freemsg(mp); 13055 return; 13056 } 13057 /* Update pointers into message */ 13058 iphdr = rptr = mp->b_rptr; 13059 tcph = (tcph_t *)&rptr[ip_hdr_len]; 13060 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 13061 /* 13062 * Since we can't handle any data with this urgent 13063 * pointer that is out of sequence, we expunge 13064 * the data. This allows us to still register 13065 * the urgent mark and generate the M_PCSIG, 13066 * which we can do. 13067 */ 13068 mp->b_wptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 13069 seg_len = 0; 13070 } 13071 } 13072 13073 switch (tcp->tcp_state) { 13074 case TCPS_SYN_SENT: 13075 if (flags & TH_ACK) { 13076 /* 13077 * Note that our stack cannot send data before a 13078 * connection is established, therefore the 13079 * following check is valid. Otherwise, it has 13080 * to be changed. 13081 */ 13082 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 13083 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 13084 freemsg(mp); 13085 if (flags & TH_RST) 13086 return; 13087 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 13088 tcp, seg_ack, 0, TH_RST); 13089 return; 13090 } 13091 ASSERT(tcp->tcp_suna + 1 == seg_ack); 13092 } 13093 if (flags & TH_RST) { 13094 freemsg(mp); 13095 if (flags & TH_ACK) 13096 (void) tcp_clean_death(tcp, 13097 ECONNREFUSED, 13); 13098 return; 13099 } 13100 if (!(flags & TH_SYN)) { 13101 freemsg(mp); 13102 return; 13103 } 13104 13105 /* Process all TCP options. */ 13106 tcp_process_options(tcp, tcph); 13107 /* 13108 * The following changes our rwnd to be a multiple of the 13109 * MIN(peer MSS, our MSS) for performance reason. 13110 */ 13111 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rq->q_hiwat, 13112 tcp->tcp_mss)); 13113 13114 /* Is the other end ECN capable? */ 13115 if (tcp->tcp_ecn_ok) { 13116 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 13117 tcp->tcp_ecn_ok = B_FALSE; 13118 } 13119 } 13120 /* 13121 * Clear ECN flags because it may interfere with later 13122 * processing. 13123 */ 13124 flags &= ~(TH_ECE|TH_CWR); 13125 13126 tcp->tcp_irs = seg_seq; 13127 tcp->tcp_rack = seg_seq; 13128 tcp->tcp_rnxt = seg_seq + 1; 13129 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 13130 if (!TCP_IS_DETACHED(tcp)) { 13131 /* Allocate room for SACK options if needed. */ 13132 if (tcp->tcp_snd_sack_ok) { 13133 (void) mi_set_sth_wroff(tcp->tcp_rq, 13134 tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 13135 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 13136 } else { 13137 (void) mi_set_sth_wroff(tcp->tcp_rq, 13138 tcp->tcp_hdr_len + 13139 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 13140 } 13141 } 13142 if (flags & TH_ACK) { 13143 /* 13144 * If we can't get the confirmation upstream, pretend 13145 * we didn't even see this one. 13146 * 13147 * XXX: how can we pretend we didn't see it if we 13148 * have updated rnxt et. al. 13149 * 13150 * For loopback we defer sending up the T_CONN_CON 13151 * until after some checks below. 13152 */ 13153 mp1 = NULL; 13154 if (!tcp_conn_con(tcp, iphdr, tcph, mp, 13155 tcp->tcp_loopback ? &mp1 : NULL)) { 13156 freemsg(mp); 13157 return; 13158 } 13159 /* SYN was acked - making progress */ 13160 if (tcp->tcp_ipversion == IPV6_VERSION) 13161 tcp->tcp_ip_forward_progress = B_TRUE; 13162 13163 /* One for the SYN */ 13164 tcp->tcp_suna = tcp->tcp_iss + 1; 13165 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 13166 tcp->tcp_state = TCPS_ESTABLISHED; 13167 13168 /* 13169 * If SYN was retransmitted, need to reset all 13170 * retransmission info. This is because this 13171 * segment will be treated as a dup ACK. 13172 */ 13173 if (tcp->tcp_rexmit) { 13174 tcp->tcp_rexmit = B_FALSE; 13175 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 13176 tcp->tcp_rexmit_max = tcp->tcp_snxt; 13177 tcp->tcp_snd_burst = tcp->tcp_localnet ? 13178 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 13179 tcp->tcp_ms_we_have_waited = 0; 13180 13181 /* 13182 * Set tcp_cwnd back to 1 MSS, per 13183 * recommendation from 13184 * draft-floyd-incr-init-win-01.txt, 13185 * Increasing TCP's Initial Window. 13186 */ 13187 tcp->tcp_cwnd = tcp->tcp_mss; 13188 } 13189 13190 tcp->tcp_swl1 = seg_seq; 13191 tcp->tcp_swl2 = seg_ack; 13192 13193 new_swnd = BE16_TO_U16(tcph->th_win); 13194 tcp->tcp_swnd = new_swnd; 13195 if (new_swnd > tcp->tcp_max_swnd) 13196 tcp->tcp_max_swnd = new_swnd; 13197 13198 /* 13199 * Always send the three-way handshake ack immediately 13200 * in order to make the connection complete as soon as 13201 * possible on the accepting host. 13202 */ 13203 flags |= TH_ACK_NEEDED; 13204 13205 /* 13206 * Special case for loopback. At this point we have 13207 * received SYN-ACK from the remote endpoint. In 13208 * order to ensure that both endpoints reach the 13209 * fused state prior to any data exchange, the final 13210 * ACK needs to be sent before we indicate T_CONN_CON 13211 * to the module upstream. 13212 */ 13213 if (tcp->tcp_loopback) { 13214 mblk_t *ack_mp; 13215 13216 ASSERT(!tcp->tcp_unfusable); 13217 ASSERT(mp1 != NULL); 13218 /* 13219 * For loopback, we always get a pure SYN-ACK 13220 * and only need to send back the final ACK 13221 * with no data (this is because the other 13222 * tcp is ours and we don't do T/TCP). This 13223 * final ACK triggers the passive side to 13224 * perform fusion in ESTABLISHED state. 13225 */ 13226 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 13227 if (tcp->tcp_ack_tid != 0) { 13228 (void) TCP_TIMER_CANCEL(tcp, 13229 tcp->tcp_ack_tid); 13230 tcp->tcp_ack_tid = 0; 13231 } 13232 TCP_RECORD_TRACE(tcp, ack_mp, 13233 TCP_TRACE_SEND_PKT); 13234 tcp_send_data(tcp, tcp->tcp_wq, ack_mp); 13235 BUMP_LOCAL(tcp->tcp_obsegs); 13236 BUMP_MIB(&tcp_mib, tcpOutAck); 13237 13238 /* Send up T_CONN_CON */ 13239 putnext(tcp->tcp_rq, mp1); 13240 13241 freemsg(mp); 13242 return; 13243 } 13244 /* 13245 * Forget fusion; we need to handle more 13246 * complex cases below. Send the deferred 13247 * T_CONN_CON message upstream and proceed 13248 * as usual. Mark this tcp as not capable 13249 * of fusion. 13250 */ 13251 TCP_STAT(tcp_fusion_unfusable); 13252 tcp->tcp_unfusable = B_TRUE; 13253 putnext(tcp->tcp_rq, mp1); 13254 } 13255 13256 /* 13257 * Check to see if there is data to be sent. If 13258 * yes, set the transmit flag. Then check to see 13259 * if received data processing needs to be done. 13260 * If not, go straight to xmit_check. This short 13261 * cut is OK as we don't support T/TCP. 13262 */ 13263 if (tcp->tcp_unsent) 13264 flags |= TH_XMIT_NEEDED; 13265 13266 if (seg_len == 0 && !(flags & TH_URG)) { 13267 freemsg(mp); 13268 goto xmit_check; 13269 } 13270 13271 flags &= ~TH_SYN; 13272 seg_seq++; 13273 break; 13274 } 13275 tcp->tcp_state = TCPS_SYN_RCVD; 13276 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 13277 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 13278 if (mp1) { 13279 mblk_setcred(mp1, tcp->tcp_cred); 13280 DB_CPID(mp1) = tcp->tcp_cpid; 13281 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 13282 tcp_send_data(tcp, tcp->tcp_wq, mp1); 13283 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 13284 } 13285 freemsg(mp); 13286 return; 13287 case TCPS_SYN_RCVD: 13288 if (flags & TH_ACK) { 13289 /* 13290 * In this state, a SYN|ACK packet is either bogus 13291 * because the other side must be ACKing our SYN which 13292 * indicates it has seen the ACK for their SYN and 13293 * shouldn't retransmit it or we're crossing SYNs 13294 * on active open. 13295 */ 13296 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 13297 freemsg(mp); 13298 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 13299 tcp, seg_ack, 0, TH_RST); 13300 return; 13301 } 13302 /* 13303 * NOTE: RFC 793 pg. 72 says this should be 13304 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 13305 * but that would mean we have an ack that ignored 13306 * our SYN. 13307 */ 13308 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 13309 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 13310 freemsg(mp); 13311 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 13312 tcp, seg_ack, 0, TH_RST); 13313 return; 13314 } 13315 } 13316 break; 13317 case TCPS_LISTEN: 13318 /* 13319 * Only a TLI listener can come through this path when a 13320 * acceptor is going back to be a listener and a packet 13321 * for the acceptor hits the classifier. For a socket 13322 * listener, this can never happen because a listener 13323 * can never accept connection on itself and hence a 13324 * socket acceptor can not go back to being a listener. 13325 */ 13326 ASSERT(!TCP_IS_SOCKET(tcp)); 13327 /*FALLTHRU*/ 13328 case TCPS_CLOSED: 13329 case TCPS_BOUND: { 13330 conn_t *new_connp; 13331 13332 new_connp = ipcl_classify(mp, connp->conn_zoneid); 13333 if (new_connp != NULL) { 13334 tcp_reinput(new_connp, mp, connp->conn_sqp); 13335 return; 13336 } 13337 /* We failed to classify. For now just drop the packet */ 13338 freemsg(mp); 13339 return; 13340 } 13341 case TCPS_IDLE: 13342 /* 13343 * Handle the case where the tcp_clean_death() has happened 13344 * on a connection (application hasn't closed yet) but a packet 13345 * was already queued on squeue before tcp_clean_death() 13346 * was processed. Calling tcp_clean_death() twice on same 13347 * connection can result in weird behaviour. 13348 */ 13349 freemsg(mp); 13350 return; 13351 default: 13352 break; 13353 } 13354 13355 /* 13356 * Already on the correct queue/perimeter. 13357 * If this is a detached connection and not an eager 13358 * connection hanging off a listener then new data 13359 * (past the FIN) will cause a reset. 13360 * We do a special check here where it 13361 * is out of the main line, rather than check 13362 * if we are detached every time we see new 13363 * data down below. 13364 */ 13365 if (TCP_IS_DETACHED_NONEAGER(tcp) && 13366 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 13367 BUMP_MIB(&tcp_mib, tcpInClosed); 13368 TCP_RECORD_TRACE(tcp, 13369 mp, TCP_TRACE_RECV_PKT); 13370 freemsg(mp); 13371 tcp_xmit_ctl("new data when detached", tcp, 13372 tcp->tcp_snxt, 0, TH_RST); 13373 (void) tcp_clean_death(tcp, EPROTO, 12); 13374 return; 13375 } 13376 13377 mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 13378 urp = BE16_TO_U16(tcph->th_urp) - TCP_OLD_URP_INTERPRETATION; 13379 new_swnd = BE16_TO_U16(tcph->th_win) << 13380 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 13381 mss = tcp->tcp_mss; 13382 13383 if (tcp->tcp_snd_ts_ok) { 13384 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 13385 /* 13386 * This segment is not acceptable. 13387 * Drop it and send back an ACK. 13388 */ 13389 freemsg(mp); 13390 flags |= TH_ACK_NEEDED; 13391 goto ack_check; 13392 } 13393 } else if (tcp->tcp_snd_sack_ok) { 13394 ASSERT(tcp->tcp_sack_info != NULL); 13395 tcpopt.tcp = tcp; 13396 /* 13397 * SACK info in already updated in tcp_parse_options. Ignore 13398 * all other TCP options... 13399 */ 13400 (void) tcp_parse_options(tcph, &tcpopt); 13401 } 13402 try_again:; 13403 gap = seg_seq - tcp->tcp_rnxt; 13404 rgap = tcp->tcp_rwnd - (gap + seg_len); 13405 /* 13406 * gap is the amount of sequence space between what we expect to see 13407 * and what we got for seg_seq. A positive value for gap means 13408 * something got lost. A negative value means we got some old stuff. 13409 */ 13410 if (gap < 0) { 13411 /* Old stuff present. Is the SYN in there? */ 13412 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 13413 (seg_len != 0)) { 13414 flags &= ~TH_SYN; 13415 seg_seq++; 13416 urp--; 13417 /* Recompute the gaps after noting the SYN. */ 13418 goto try_again; 13419 } 13420 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 13421 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 13422 (seg_len > -gap ? -gap : seg_len)); 13423 /* Remove the old stuff from seg_len. */ 13424 seg_len += gap; 13425 /* 13426 * Anything left? 13427 * Make sure to check for unack'd FIN when rest of data 13428 * has been previously ack'd. 13429 */ 13430 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 13431 /* 13432 * Resets are only valid if they lie within our offered 13433 * window. If the RST bit is set, we just ignore this 13434 * segment. 13435 */ 13436 if (flags & TH_RST) { 13437 freemsg(mp); 13438 return; 13439 } 13440 13441 /* 13442 * The arriving of dup data packets indicate that we 13443 * may have postponed an ack for too long, or the other 13444 * side's RTT estimate is out of shape. Start acking 13445 * more often. 13446 */ 13447 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 13448 tcp->tcp_rack_cnt >= 1 && 13449 tcp->tcp_rack_abs_max > 2) { 13450 tcp->tcp_rack_abs_max--; 13451 } 13452 tcp->tcp_rack_cur_max = 1; 13453 13454 /* 13455 * This segment is "unacceptable". None of its 13456 * sequence space lies within our advertized window. 13457 * 13458 * Adjust seg_len to the original value for tracing. 13459 */ 13460 seg_len -= gap; 13461 if (tcp->tcp_debug) { 13462 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 13463 "tcp_rput: unacceptable, gap %d, rgap %d, " 13464 "flags 0x%x, seg_seq %u, seg_ack %u, " 13465 "seg_len %d, rnxt %u, snxt %u, %s", 13466 gap, rgap, flags, seg_seq, seg_ack, 13467 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 13468 tcp_display(tcp, NULL, 13469 DISP_ADDR_AND_PORT)); 13470 } 13471 13472 /* 13473 * Arrange to send an ACK in response to the 13474 * unacceptable segment per RFC 793 page 69. There 13475 * is only one small difference between ours and the 13476 * acceptability test in the RFC - we accept ACK-only 13477 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 13478 * will be generated. 13479 * 13480 * Note that we have to ACK an ACK-only packet at least 13481 * for stacks that send 0-length keep-alives with 13482 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 13483 * section 4.2.3.6. As long as we don't ever generate 13484 * an unacceptable packet in response to an incoming 13485 * packet that is unacceptable, it should not cause 13486 * "ACK wars". 13487 */ 13488 flags |= TH_ACK_NEEDED; 13489 13490 /* 13491 * Continue processing this segment in order to use the 13492 * ACK information it contains, but skip all other 13493 * sequence-number processing. Processing the ACK 13494 * information is necessary in order to 13495 * re-synchronize connections that may have lost 13496 * synchronization. 13497 * 13498 * We clear seg_len and flag fields related to 13499 * sequence number processing as they are not 13500 * to be trusted for an unacceptable segment. 13501 */ 13502 seg_len = 0; 13503 flags &= ~(TH_SYN | TH_FIN | TH_URG); 13504 goto process_ack; 13505 } 13506 13507 /* Fix seg_seq, and chew the gap off the front. */ 13508 seg_seq = tcp->tcp_rnxt; 13509 urp += gap; 13510 do { 13511 mblk_t *mp2; 13512 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13513 (uintptr_t)UINT_MAX); 13514 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 13515 if (gap > 0) { 13516 mp->b_rptr = mp->b_wptr - gap; 13517 break; 13518 } 13519 mp2 = mp; 13520 mp = mp->b_cont; 13521 freeb(mp2); 13522 } while (gap < 0); 13523 /* 13524 * If the urgent data has already been acknowledged, we 13525 * should ignore TH_URG below 13526 */ 13527 if (urp < 0) 13528 flags &= ~TH_URG; 13529 } 13530 /* 13531 * rgap is the amount of stuff received out of window. A negative 13532 * value is the amount out of window. 13533 */ 13534 if (rgap < 0) { 13535 mblk_t *mp2; 13536 13537 if (tcp->tcp_rwnd == 0) { 13538 BUMP_MIB(&tcp_mib, tcpInWinProbe); 13539 } else { 13540 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 13541 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 13542 } 13543 13544 /* 13545 * seg_len does not include the FIN, so if more than 13546 * just the FIN is out of window, we act like we don't 13547 * see it. (If just the FIN is out of window, rgap 13548 * will be zero and we will go ahead and acknowledge 13549 * the FIN.) 13550 */ 13551 flags &= ~TH_FIN; 13552 13553 /* Fix seg_len and make sure there is something left. */ 13554 seg_len += rgap; 13555 if (seg_len <= 0) { 13556 /* 13557 * Resets are only valid if they lie within our offered 13558 * window. If the RST bit is set, we just ignore this 13559 * segment. 13560 */ 13561 if (flags & TH_RST) { 13562 freemsg(mp); 13563 return; 13564 } 13565 13566 /* Per RFC 793, we need to send back an ACK. */ 13567 flags |= TH_ACK_NEEDED; 13568 13569 /* 13570 * Send SIGURG as soon as possible i.e. even 13571 * if the TH_URG was delivered in a window probe 13572 * packet (which will be unacceptable). 13573 * 13574 * We generate a signal if none has been generated 13575 * for this connection or if this is a new urgent 13576 * byte. Also send a zero-length "unmarked" message 13577 * to inform SIOCATMARK that this is not the mark. 13578 * 13579 * tcp_urp_last_valid is cleared when the T_exdata_ind 13580 * is sent up. This plus the check for old data 13581 * (gap >= 0) handles the wraparound of the sequence 13582 * number space without having to always track the 13583 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 13584 * this max in its rcv_up variable). 13585 * 13586 * This prevents duplicate SIGURGS due to a "late" 13587 * zero-window probe when the T_EXDATA_IND has already 13588 * been sent up. 13589 */ 13590 if ((flags & TH_URG) && 13591 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 13592 tcp->tcp_urp_last))) { 13593 mp1 = allocb(0, BPRI_MED); 13594 if (mp1 == NULL) { 13595 freemsg(mp); 13596 return; 13597 } 13598 if (!TCP_IS_DETACHED(tcp) && 13599 !putnextctl1(tcp->tcp_rq, M_PCSIG, 13600 SIGURG)) { 13601 /* Try again on the rexmit. */ 13602 freemsg(mp1); 13603 freemsg(mp); 13604 return; 13605 } 13606 /* 13607 * If the next byte would be the mark 13608 * then mark with MARKNEXT else mark 13609 * with NOTMARKNEXT. 13610 */ 13611 if (gap == 0 && urp == 0) 13612 mp1->b_flag |= MSGMARKNEXT; 13613 else 13614 mp1->b_flag |= MSGNOTMARKNEXT; 13615 freemsg(tcp->tcp_urp_mark_mp); 13616 tcp->tcp_urp_mark_mp = mp1; 13617 flags |= TH_SEND_URP_MARK; 13618 tcp->tcp_urp_last_valid = B_TRUE; 13619 tcp->tcp_urp_last = urp + seg_seq; 13620 } 13621 /* 13622 * If this is a zero window probe, continue to 13623 * process the ACK part. But we need to set seg_len 13624 * to 0 to avoid data processing. Otherwise just 13625 * drop the segment and send back an ACK. 13626 */ 13627 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 13628 flags &= ~(TH_SYN | TH_URG); 13629 seg_len = 0; 13630 goto process_ack; 13631 } else { 13632 freemsg(mp); 13633 goto ack_check; 13634 } 13635 } 13636 /* Pitch out of window stuff off the end. */ 13637 rgap = seg_len; 13638 mp2 = mp; 13639 do { 13640 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 13641 (uintptr_t)INT_MAX); 13642 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 13643 if (rgap < 0) { 13644 mp2->b_wptr += rgap; 13645 if ((mp1 = mp2->b_cont) != NULL) { 13646 mp2->b_cont = NULL; 13647 freemsg(mp1); 13648 } 13649 break; 13650 } 13651 } while ((mp2 = mp2->b_cont) != NULL); 13652 } 13653 ok:; 13654 /* 13655 * TCP should check ECN info for segments inside the window only. 13656 * Therefore the check should be done here. 13657 */ 13658 if (tcp->tcp_ecn_ok) { 13659 if (flags & TH_CWR) { 13660 tcp->tcp_ecn_echo_on = B_FALSE; 13661 } 13662 /* 13663 * Note that both ECN_CE and CWR can be set in the 13664 * same segment. In this case, we once again turn 13665 * on ECN_ECHO. 13666 */ 13667 if (tcp->tcp_ipversion == IPV4_VERSION) { 13668 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 13669 13670 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 13671 tcp->tcp_ecn_echo_on = B_TRUE; 13672 } 13673 } else { 13674 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 13675 13676 if ((vcf & htonl(IPH_ECN_CE << 20)) == 13677 htonl(IPH_ECN_CE << 20)) { 13678 tcp->tcp_ecn_echo_on = B_TRUE; 13679 } 13680 } 13681 } 13682 13683 /* 13684 * Check whether we can update tcp_ts_recent. This test is 13685 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 13686 * Extensions for High Performance: An Update", Internet Draft. 13687 */ 13688 if (tcp->tcp_snd_ts_ok && 13689 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 13690 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 13691 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 13692 tcp->tcp_last_rcv_lbolt = lbolt64; 13693 } 13694 13695 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 13696 /* 13697 * FIN in an out of order segment. We record this in 13698 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 13699 * Clear the FIN so that any check on FIN flag will fail. 13700 * Remember that FIN also counts in the sequence number 13701 * space. So we need to ack out of order FIN only segments. 13702 */ 13703 if (flags & TH_FIN) { 13704 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 13705 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 13706 flags &= ~TH_FIN; 13707 flags |= TH_ACK_NEEDED; 13708 } 13709 if (seg_len > 0) { 13710 /* Fill in the SACK blk list. */ 13711 if (tcp->tcp_snd_sack_ok) { 13712 ASSERT(tcp->tcp_sack_info != NULL); 13713 tcp_sack_insert(tcp->tcp_sack_list, 13714 seg_seq, seg_seq + seg_len, 13715 &(tcp->tcp_num_sack_blk)); 13716 } 13717 13718 /* 13719 * Attempt reassembly and see if we have something 13720 * ready to go. 13721 */ 13722 mp = tcp_reass(tcp, mp, seg_seq); 13723 /* Always ack out of order packets */ 13724 flags |= TH_ACK_NEEDED | TH_PUSH; 13725 if (mp) { 13726 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13727 (uintptr_t)INT_MAX); 13728 seg_len = mp->b_cont ? msgdsize(mp) : 13729 (int)(mp->b_wptr - mp->b_rptr); 13730 seg_seq = tcp->tcp_rnxt; 13731 /* 13732 * A gap is filled and the seq num and len 13733 * of the gap match that of a previously 13734 * received FIN, put the FIN flag back in. 13735 */ 13736 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13737 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13738 flags |= TH_FIN; 13739 tcp->tcp_valid_bits &= 13740 ~TCP_OFO_FIN_VALID; 13741 } 13742 } else { 13743 /* 13744 * Keep going even with NULL mp. 13745 * There may be a useful ACK or something else 13746 * we don't want to miss. 13747 * 13748 * But TCP should not perform fast retransmit 13749 * because of the ack number. TCP uses 13750 * seg_len == 0 to determine if it is a pure 13751 * ACK. And this is not a pure ACK. 13752 */ 13753 seg_len = 0; 13754 ofo_seg = B_TRUE; 13755 } 13756 } 13757 } else if (seg_len > 0) { 13758 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 13759 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 13760 /* 13761 * If an out of order FIN was received before, and the seq 13762 * num and len of the new segment match that of the FIN, 13763 * put the FIN flag back in. 13764 */ 13765 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13766 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13767 flags |= TH_FIN; 13768 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 13769 } 13770 } 13771 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 13772 if (flags & TH_RST) { 13773 freemsg(mp); 13774 switch (tcp->tcp_state) { 13775 case TCPS_SYN_RCVD: 13776 (void) tcp_clean_death(tcp, ECONNREFUSED, 14); 13777 break; 13778 case TCPS_ESTABLISHED: 13779 case TCPS_FIN_WAIT_1: 13780 case TCPS_FIN_WAIT_2: 13781 case TCPS_CLOSE_WAIT: 13782 (void) tcp_clean_death(tcp, ECONNRESET, 15); 13783 break; 13784 case TCPS_CLOSING: 13785 case TCPS_LAST_ACK: 13786 (void) tcp_clean_death(tcp, 0, 16); 13787 break; 13788 default: 13789 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13790 (void) tcp_clean_death(tcp, ENXIO, 17); 13791 break; 13792 } 13793 return; 13794 } 13795 if (flags & TH_SYN) { 13796 /* 13797 * See RFC 793, Page 71 13798 * 13799 * The seq number must be in the window as it should 13800 * be "fixed" above. If it is outside window, it should 13801 * be already rejected. Note that we allow seg_seq to be 13802 * rnxt + rwnd because we want to accept 0 window probe. 13803 */ 13804 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 13805 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 13806 freemsg(mp); 13807 /* 13808 * If the ACK flag is not set, just use our snxt as the 13809 * seq number of the RST segment. 13810 */ 13811 if (!(flags & TH_ACK)) { 13812 seg_ack = tcp->tcp_snxt; 13813 } 13814 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 13815 TH_RST|TH_ACK); 13816 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13817 (void) tcp_clean_death(tcp, ECONNRESET, 18); 13818 return; 13819 } 13820 /* 13821 * urp could be -1 when the urp field in the packet is 0 13822 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 13823 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 13824 */ 13825 if (flags & TH_URG && urp >= 0) { 13826 if (!tcp->tcp_urp_last_valid || 13827 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 13828 /* 13829 * If we haven't generated the signal yet for this 13830 * urgent pointer value, do it now. Also, send up a 13831 * zero-length M_DATA indicating whether or not this is 13832 * the mark. The latter is not needed when a 13833 * T_EXDATA_IND is sent up. However, if there are 13834 * allocation failures this code relies on the sender 13835 * retransmitting and the socket code for determining 13836 * the mark should not block waiting for the peer to 13837 * transmit. Thus, for simplicity we always send up the 13838 * mark indication. 13839 */ 13840 mp1 = allocb(0, BPRI_MED); 13841 if (mp1 == NULL) { 13842 freemsg(mp); 13843 return; 13844 } 13845 if (!TCP_IS_DETACHED(tcp) && 13846 !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) { 13847 /* Try again on the rexmit. */ 13848 freemsg(mp1); 13849 freemsg(mp); 13850 return; 13851 } 13852 /* 13853 * Mark with NOTMARKNEXT for now. 13854 * The code below will change this to MARKNEXT 13855 * if we are at the mark. 13856 * 13857 * If there are allocation failures (e.g. in dupmsg 13858 * below) the next time tcp_rput_data sees the urgent 13859 * segment it will send up the MSG*MARKNEXT message. 13860 */ 13861 mp1->b_flag |= MSGNOTMARKNEXT; 13862 freemsg(tcp->tcp_urp_mark_mp); 13863 tcp->tcp_urp_mark_mp = mp1; 13864 flags |= TH_SEND_URP_MARK; 13865 #ifdef DEBUG 13866 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 13867 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 13868 "last %x, %s", 13869 seg_seq, urp, tcp->tcp_urp_last, 13870 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 13871 #endif /* DEBUG */ 13872 tcp->tcp_urp_last_valid = B_TRUE; 13873 tcp->tcp_urp_last = urp + seg_seq; 13874 } else if (tcp->tcp_urp_mark_mp != NULL) { 13875 /* 13876 * An allocation failure prevented the previous 13877 * tcp_rput_data from sending up the allocated 13878 * MSG*MARKNEXT message - send it up this time 13879 * around. 13880 */ 13881 flags |= TH_SEND_URP_MARK; 13882 } 13883 13884 /* 13885 * If the urgent byte is in this segment, make sure that it is 13886 * all by itself. This makes it much easier to deal with the 13887 * possibility of an allocation failure on the T_exdata_ind. 13888 * Note that seg_len is the number of bytes in the segment, and 13889 * urp is the offset into the segment of the urgent byte. 13890 * urp < seg_len means that the urgent byte is in this segment. 13891 */ 13892 if (urp < seg_len) { 13893 if (seg_len != 1) { 13894 uint32_t tmp_rnxt; 13895 /* 13896 * Break it up and feed it back in. 13897 * Re-attach the IP header. 13898 */ 13899 mp->b_rptr = iphdr; 13900 if (urp > 0) { 13901 /* 13902 * There is stuff before the urgent 13903 * byte. 13904 */ 13905 mp1 = dupmsg(mp); 13906 if (!mp1) { 13907 /* 13908 * Trim from urgent byte on. 13909 * The rest will come back. 13910 */ 13911 (void) adjmsg(mp, 13912 urp - seg_len); 13913 tcp_rput_data(connp, 13914 mp, NULL); 13915 return; 13916 } 13917 (void) adjmsg(mp1, urp - seg_len); 13918 /* Feed this piece back in. */ 13919 tmp_rnxt = tcp->tcp_rnxt; 13920 tcp_rput_data(connp, mp1, NULL); 13921 /* 13922 * If the data passed back in was not 13923 * processed (ie: bad ACK) sending 13924 * the remainder back in will cause a 13925 * loop. In this case, drop the 13926 * packet and let the sender try 13927 * sending a good packet. 13928 */ 13929 if (tmp_rnxt == tcp->tcp_rnxt) { 13930 freemsg(mp); 13931 return; 13932 } 13933 } 13934 if (urp != seg_len - 1) { 13935 uint32_t tmp_rnxt; 13936 /* 13937 * There is stuff after the urgent 13938 * byte. 13939 */ 13940 mp1 = dupmsg(mp); 13941 if (!mp1) { 13942 /* 13943 * Trim everything beyond the 13944 * urgent byte. The rest will 13945 * come back. 13946 */ 13947 (void) adjmsg(mp, 13948 urp + 1 - seg_len); 13949 tcp_rput_data(connp, 13950 mp, NULL); 13951 return; 13952 } 13953 (void) adjmsg(mp1, urp + 1 - seg_len); 13954 tmp_rnxt = tcp->tcp_rnxt; 13955 tcp_rput_data(connp, mp1, NULL); 13956 /* 13957 * If the data passed back in was not 13958 * processed (ie: bad ACK) sending 13959 * the remainder back in will cause a 13960 * loop. In this case, drop the 13961 * packet and let the sender try 13962 * sending a good packet. 13963 */ 13964 if (tmp_rnxt == tcp->tcp_rnxt) { 13965 freemsg(mp); 13966 return; 13967 } 13968 } 13969 tcp_rput_data(connp, mp, NULL); 13970 return; 13971 } 13972 /* 13973 * This segment contains only the urgent byte. We 13974 * have to allocate the T_exdata_ind, if we can. 13975 */ 13976 if (!tcp->tcp_urp_mp) { 13977 struct T_exdata_ind *tei; 13978 mp1 = allocb(sizeof (struct T_exdata_ind), 13979 BPRI_MED); 13980 if (!mp1) { 13981 /* 13982 * Sigh... It'll be back. 13983 * Generate any MSG*MARK message now. 13984 */ 13985 freemsg(mp); 13986 seg_len = 0; 13987 if (flags & TH_SEND_URP_MARK) { 13988 13989 13990 ASSERT(tcp->tcp_urp_mark_mp); 13991 tcp->tcp_urp_mark_mp->b_flag &= 13992 ~MSGNOTMARKNEXT; 13993 tcp->tcp_urp_mark_mp->b_flag |= 13994 MSGMARKNEXT; 13995 } 13996 goto ack_check; 13997 } 13998 mp1->b_datap->db_type = M_PROTO; 13999 tei = (struct T_exdata_ind *)mp1->b_rptr; 14000 tei->PRIM_type = T_EXDATA_IND; 14001 tei->MORE_flag = 0; 14002 mp1->b_wptr = (uchar_t *)&tei[1]; 14003 tcp->tcp_urp_mp = mp1; 14004 #ifdef DEBUG 14005 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14006 "tcp_rput: allocated exdata_ind %s", 14007 tcp_display(tcp, NULL, 14008 DISP_PORT_ONLY)); 14009 #endif /* DEBUG */ 14010 /* 14011 * There is no need to send a separate MSG*MARK 14012 * message since the T_EXDATA_IND will be sent 14013 * now. 14014 */ 14015 flags &= ~TH_SEND_URP_MARK; 14016 freemsg(tcp->tcp_urp_mark_mp); 14017 tcp->tcp_urp_mark_mp = NULL; 14018 } 14019 /* 14020 * Now we are all set. On the next putnext upstream, 14021 * tcp_urp_mp will be non-NULL and will get prepended 14022 * to what has to be this piece containing the urgent 14023 * byte. If for any reason we abort this segment below, 14024 * if it comes back, we will have this ready, or it 14025 * will get blown off in close. 14026 */ 14027 } else if (urp == seg_len) { 14028 /* 14029 * The urgent byte is the next byte after this sequence 14030 * number. If there is data it is marked with 14031 * MSGMARKNEXT and any tcp_urp_mark_mp is discarded 14032 * since it is not needed. Otherwise, if the code 14033 * above just allocated a zero-length tcp_urp_mark_mp 14034 * message, that message is tagged with MSGMARKNEXT. 14035 * Sending up these MSGMARKNEXT messages makes 14036 * SIOCATMARK work correctly even though 14037 * the T_EXDATA_IND will not be sent up until the 14038 * urgent byte arrives. 14039 */ 14040 if (seg_len != 0) { 14041 flags |= TH_MARKNEXT_NEEDED; 14042 freemsg(tcp->tcp_urp_mark_mp); 14043 tcp->tcp_urp_mark_mp = NULL; 14044 flags &= ~TH_SEND_URP_MARK; 14045 } else if (tcp->tcp_urp_mark_mp != NULL) { 14046 flags |= TH_SEND_URP_MARK; 14047 tcp->tcp_urp_mark_mp->b_flag &= 14048 ~MSGNOTMARKNEXT; 14049 tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT; 14050 } 14051 #ifdef DEBUG 14052 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14053 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 14054 seg_len, flags, 14055 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14056 #endif /* DEBUG */ 14057 } else { 14058 /* Data left until we hit mark */ 14059 #ifdef DEBUG 14060 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14061 "tcp_rput: URP %d bytes left, %s", 14062 urp - seg_len, tcp_display(tcp, NULL, 14063 DISP_PORT_ONLY)); 14064 #endif /* DEBUG */ 14065 } 14066 } 14067 14068 process_ack: 14069 if (!(flags & TH_ACK)) { 14070 freemsg(mp); 14071 goto xmit_check; 14072 } 14073 } 14074 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 14075 14076 if (tcp->tcp_ipversion == IPV6_VERSION && bytes_acked > 0) 14077 tcp->tcp_ip_forward_progress = B_TRUE; 14078 if (tcp->tcp_state == TCPS_SYN_RCVD) { 14079 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 14080 /* 3-way handshake complete - pass up the T_CONN_IND */ 14081 tcp_t *listener = tcp->tcp_listener; 14082 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 14083 14084 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 14085 /* 14086 * We are here means eager is fine but it can 14087 * get a TH_RST at any point between now and till 14088 * accept completes and disappear. We need to 14089 * ensure that reference to eager is valid after 14090 * we get out of eager's perimeter. So we do 14091 * an extra refhold. 14092 */ 14093 CONN_INC_REF(connp); 14094 14095 /* 14096 * The listener also exists because of the refhold 14097 * done in tcp_conn_request. Its possible that it 14098 * might have closed. We will check that once we 14099 * get inside listeners context. 14100 */ 14101 CONN_INC_REF(listener->tcp_connp); 14102 if (listener->tcp_connp->conn_sqp == 14103 connp->conn_sqp) { 14104 tcp_send_conn_ind(listener->tcp_connp, mp, 14105 listener->tcp_connp->conn_sqp); 14106 CONN_DEC_REF(listener->tcp_connp); 14107 } else if (!tcp->tcp_loopback) { 14108 squeue_fill(listener->tcp_connp->conn_sqp, mp, 14109 tcp_send_conn_ind, 14110 listener->tcp_connp, SQTAG_TCP_CONN_IND); 14111 } else { 14112 squeue_enter(listener->tcp_connp->conn_sqp, mp, 14113 tcp_send_conn_ind, listener->tcp_connp, 14114 SQTAG_TCP_CONN_IND); 14115 } 14116 } 14117 14118 if (tcp->tcp_active_open) { 14119 /* 14120 * We are seeing the final ack in the three way 14121 * hand shake of a active open'ed connection 14122 * so we must send up a T_CONN_CON 14123 */ 14124 if (!tcp_conn_con(tcp, iphdr, tcph, mp, NULL)) { 14125 freemsg(mp); 14126 return; 14127 } 14128 /* 14129 * Don't fuse the loopback endpoints for 14130 * simultaneous active opens. 14131 */ 14132 if (tcp->tcp_loopback) { 14133 TCP_STAT(tcp_fusion_unfusable); 14134 tcp->tcp_unfusable = B_TRUE; 14135 } 14136 } 14137 14138 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 14139 bytes_acked--; 14140 /* SYN was acked - making progress */ 14141 if (tcp->tcp_ipversion == IPV6_VERSION) 14142 tcp->tcp_ip_forward_progress = B_TRUE; 14143 14144 /* 14145 * If SYN was retransmitted, need to reset all 14146 * retransmission info as this segment will be 14147 * treated as a dup ACK. 14148 */ 14149 if (tcp->tcp_rexmit) { 14150 tcp->tcp_rexmit = B_FALSE; 14151 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 14152 tcp->tcp_rexmit_max = tcp->tcp_snxt; 14153 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14154 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14155 tcp->tcp_ms_we_have_waited = 0; 14156 tcp->tcp_cwnd = mss; 14157 } 14158 14159 /* 14160 * We set the send window to zero here. 14161 * This is needed if there is data to be 14162 * processed already on the queue. 14163 * Later (at swnd_update label), the 14164 * "new_swnd > tcp_swnd" condition is satisfied 14165 * the XMIT_NEEDED flag is set in the current 14166 * (SYN_RCVD) state. This ensures tcp_wput_data() is 14167 * called if there is already data on queue in 14168 * this state. 14169 */ 14170 tcp->tcp_swnd = 0; 14171 14172 if (new_swnd > tcp->tcp_max_swnd) 14173 tcp->tcp_max_swnd = new_swnd; 14174 tcp->tcp_swl1 = seg_seq; 14175 tcp->tcp_swl2 = seg_ack; 14176 tcp->tcp_state = TCPS_ESTABLISHED; 14177 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 14178 14179 /* Fuse when both sides are in ESTABLISHED state */ 14180 if (tcp->tcp_loopback && do_tcp_fusion) 14181 tcp_fuse(tcp, iphdr, tcph); 14182 14183 } 14184 /* This code follows 4.4BSD-Lite2 mostly. */ 14185 if (bytes_acked < 0) 14186 goto est; 14187 14188 /* 14189 * If TCP is ECN capable and the congestion experience bit is 14190 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 14191 * done once per window (or more loosely, per RTT). 14192 */ 14193 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 14194 tcp->tcp_cwr = B_FALSE; 14195 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 14196 if (!tcp->tcp_cwr) { 14197 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 14198 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 14199 tcp->tcp_cwnd = npkt * mss; 14200 /* 14201 * If the cwnd is 0, use the timer to clock out 14202 * new segments. This is required by the ECN spec. 14203 */ 14204 if (npkt == 0) { 14205 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14206 /* 14207 * This makes sure that when the ACK comes 14208 * back, we will increase tcp_cwnd by 1 MSS. 14209 */ 14210 tcp->tcp_cwnd_cnt = 0; 14211 } 14212 tcp->tcp_cwr = B_TRUE; 14213 /* 14214 * This marks the end of the current window of in 14215 * flight data. That is why we don't use 14216 * tcp_suna + tcp_swnd. Only data in flight can 14217 * provide ECN info. 14218 */ 14219 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 14220 tcp->tcp_ecn_cwr_sent = B_FALSE; 14221 } 14222 } 14223 14224 mp1 = tcp->tcp_xmit_head; 14225 if (bytes_acked == 0) { 14226 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 14227 int dupack_cnt; 14228 14229 BUMP_MIB(&tcp_mib, tcpInDupAck); 14230 /* 14231 * Fast retransmit. When we have seen exactly three 14232 * identical ACKs while we have unacked data 14233 * outstanding we take it as a hint that our peer 14234 * dropped something. 14235 * 14236 * If TCP is retransmitting, don't do fast retransmit. 14237 */ 14238 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 14239 ! tcp->tcp_rexmit) { 14240 /* Do Limited Transmit */ 14241 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 14242 tcp_dupack_fast_retransmit) { 14243 /* 14244 * RFC 3042 14245 * 14246 * What we need to do is temporarily 14247 * increase tcp_cwnd so that new 14248 * data can be sent if it is allowed 14249 * by the receive window (tcp_rwnd). 14250 * tcp_wput_data() will take care of 14251 * the rest. 14252 * 14253 * If the connection is SACK capable, 14254 * only do limited xmit when there 14255 * is SACK info. 14256 * 14257 * Note how tcp_cwnd is incremented. 14258 * The first dup ACK will increase 14259 * it by 1 MSS. The second dup ACK 14260 * will increase it by 2 MSS. This 14261 * means that only 1 new segment will 14262 * be sent for each dup ACK. 14263 */ 14264 if (tcp->tcp_unsent > 0 && 14265 (!tcp->tcp_snd_sack_ok || 14266 (tcp->tcp_snd_sack_ok && 14267 tcp->tcp_notsack_list != NULL))) { 14268 tcp->tcp_cwnd += mss << 14269 (tcp->tcp_dupack_cnt - 1); 14270 flags |= TH_LIMIT_XMIT; 14271 } 14272 } else if (dupack_cnt == 14273 tcp_dupack_fast_retransmit) { 14274 14275 /* 14276 * If we have reduced tcp_ssthresh 14277 * because of ECN, do not reduce it again 14278 * unless it is already one window of data 14279 * away. After one window of data, tcp_cwr 14280 * should then be cleared. Note that 14281 * for non ECN capable connection, tcp_cwr 14282 * should always be false. 14283 * 14284 * Adjust cwnd since the duplicate 14285 * ack indicates that a packet was 14286 * dropped (due to congestion.) 14287 */ 14288 if (!tcp->tcp_cwr) { 14289 npkt = ((tcp->tcp_snxt - 14290 tcp->tcp_suna) >> 1) / mss; 14291 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 14292 mss; 14293 tcp->tcp_cwnd = (npkt + 14294 tcp->tcp_dupack_cnt) * mss; 14295 } 14296 if (tcp->tcp_ecn_ok) { 14297 tcp->tcp_cwr = B_TRUE; 14298 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 14299 tcp->tcp_ecn_cwr_sent = B_FALSE; 14300 } 14301 14302 /* 14303 * We do Hoe's algorithm. Refer to her 14304 * paper "Improving the Start-up Behavior 14305 * of a Congestion Control Scheme for TCP," 14306 * appeared in SIGCOMM'96. 14307 * 14308 * Save highest seq no we have sent so far. 14309 * Be careful about the invisible FIN byte. 14310 */ 14311 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 14312 (tcp->tcp_unsent == 0)) { 14313 tcp->tcp_rexmit_max = tcp->tcp_fss; 14314 } else { 14315 tcp->tcp_rexmit_max = tcp->tcp_snxt; 14316 } 14317 14318 /* 14319 * Do not allow bursty traffic during. 14320 * fast recovery. Refer to Fall and Floyd's 14321 * paper "Simulation-based Comparisons of 14322 * Tahoe, Reno and SACK TCP" (in CCR?) 14323 * This is a best current practise. 14324 */ 14325 tcp->tcp_snd_burst = TCP_CWND_SS; 14326 14327 /* 14328 * For SACK: 14329 * Calculate tcp_pipe, which is the 14330 * estimated number of bytes in 14331 * network. 14332 * 14333 * tcp_fack is the highest sack'ed seq num 14334 * TCP has received. 14335 * 14336 * tcp_pipe is explained in the above quoted 14337 * Fall and Floyd's paper. tcp_fack is 14338 * explained in Mathis and Mahdavi's 14339 * "Forward Acknowledgment: Refining TCP 14340 * Congestion Control" in SIGCOMM '96. 14341 */ 14342 if (tcp->tcp_snd_sack_ok) { 14343 ASSERT(tcp->tcp_sack_info != NULL); 14344 if (tcp->tcp_notsack_list != NULL) { 14345 tcp->tcp_pipe = tcp->tcp_snxt - 14346 tcp->tcp_fack; 14347 tcp->tcp_sack_snxt = seg_ack; 14348 flags |= TH_NEED_SACK_REXMIT; 14349 } else { 14350 /* 14351 * Always initialize tcp_pipe 14352 * even though we don't have 14353 * any SACK info. If later 14354 * we get SACK info and 14355 * tcp_pipe is not initialized, 14356 * funny things will happen. 14357 */ 14358 tcp->tcp_pipe = 14359 tcp->tcp_cwnd_ssthresh; 14360 } 14361 } else { 14362 flags |= TH_REXMIT_NEEDED; 14363 } /* tcp_snd_sack_ok */ 14364 14365 } else { 14366 /* 14367 * Here we perform congestion 14368 * avoidance, but NOT slow start. 14369 * This is known as the Fast 14370 * Recovery Algorithm. 14371 */ 14372 if (tcp->tcp_snd_sack_ok && 14373 tcp->tcp_notsack_list != NULL) { 14374 flags |= TH_NEED_SACK_REXMIT; 14375 tcp->tcp_pipe -= mss; 14376 if (tcp->tcp_pipe < 0) 14377 tcp->tcp_pipe = 0; 14378 } else { 14379 /* 14380 * We know that one more packet has 14381 * left the pipe thus we can update 14382 * cwnd. 14383 */ 14384 cwnd = tcp->tcp_cwnd + mss; 14385 if (cwnd > tcp->tcp_cwnd_max) 14386 cwnd = tcp->tcp_cwnd_max; 14387 tcp->tcp_cwnd = cwnd; 14388 if (tcp->tcp_unsent > 0) 14389 flags |= TH_XMIT_NEEDED; 14390 } 14391 } 14392 } 14393 } else if (tcp->tcp_zero_win_probe) { 14394 /* 14395 * If the window has opened, need to arrange 14396 * to send additional data. 14397 */ 14398 if (new_swnd != 0) { 14399 /* tcp_suna != tcp_snxt */ 14400 /* Packet contains a window update */ 14401 BUMP_MIB(&tcp_mib, tcpInWinUpdate); 14402 tcp->tcp_zero_win_probe = 0; 14403 tcp->tcp_timer_backoff = 0; 14404 tcp->tcp_ms_we_have_waited = 0; 14405 14406 /* 14407 * Transmit starting with tcp_suna since 14408 * the one byte probe is not ack'ed. 14409 * If TCP has sent more than one identical 14410 * probe, tcp_rexmit will be set. That means 14411 * tcp_ss_rexmit() will send out the one 14412 * byte along with new data. Otherwise, 14413 * fake the retransmission. 14414 */ 14415 flags |= TH_XMIT_NEEDED; 14416 if (!tcp->tcp_rexmit) { 14417 tcp->tcp_rexmit = B_TRUE; 14418 tcp->tcp_dupack_cnt = 0; 14419 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 14420 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 14421 } 14422 } 14423 } 14424 goto swnd_update; 14425 } 14426 14427 /* 14428 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 14429 * If the ACK value acks something that we have not yet sent, it might 14430 * be an old duplicate segment. Send an ACK to re-synchronize the 14431 * other side. 14432 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 14433 * state is handled above, so we can always just drop the segment and 14434 * send an ACK here. 14435 * 14436 * Should we send ACKs in response to ACK only segments? 14437 */ 14438 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 14439 BUMP_MIB(&tcp_mib, tcpInAckUnsent); 14440 /* drop the received segment */ 14441 freemsg(mp); 14442 14443 /* 14444 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 14445 * greater than 0, check if the number of such 14446 * bogus ACks is greater than that count. If yes, 14447 * don't send back any ACK. This prevents TCP from 14448 * getting into an ACK storm if somehow an attacker 14449 * successfully spoofs an acceptable segment to our 14450 * peer. 14451 */ 14452 if (tcp_drop_ack_unsent_cnt > 0 && 14453 ++tcp->tcp_in_ack_unsent > tcp_drop_ack_unsent_cnt) { 14454 TCP_STAT(tcp_in_ack_unsent_drop); 14455 return; 14456 } 14457 mp = tcp_ack_mp(tcp); 14458 if (mp != NULL) { 14459 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 14460 BUMP_LOCAL(tcp->tcp_obsegs); 14461 BUMP_MIB(&tcp_mib, tcpOutAck); 14462 tcp_send_data(tcp, tcp->tcp_wq, mp); 14463 } 14464 return; 14465 } 14466 14467 /* 14468 * TCP gets a new ACK, update the notsack'ed list to delete those 14469 * blocks that are covered by this ACK. 14470 */ 14471 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 14472 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 14473 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 14474 } 14475 14476 /* 14477 * If we got an ACK after fast retransmit, check to see 14478 * if it is a partial ACK. If it is not and the congestion 14479 * window was inflated to account for the other side's 14480 * cached packets, retract it. If it is, do Hoe's algorithm. 14481 */ 14482 if (tcp->tcp_dupack_cnt >= tcp_dupack_fast_retransmit) { 14483 ASSERT(tcp->tcp_rexmit == B_FALSE); 14484 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 14485 tcp->tcp_dupack_cnt = 0; 14486 /* 14487 * Restore the orig tcp_cwnd_ssthresh after 14488 * fast retransmit phase. 14489 */ 14490 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 14491 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 14492 } 14493 tcp->tcp_rexmit_max = seg_ack; 14494 tcp->tcp_cwnd_cnt = 0; 14495 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14496 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14497 14498 /* 14499 * Remove all notsack info to avoid confusion with 14500 * the next fast retrasnmit/recovery phase. 14501 */ 14502 if (tcp->tcp_snd_sack_ok && 14503 tcp->tcp_notsack_list != NULL) { 14504 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 14505 } 14506 } else { 14507 if (tcp->tcp_snd_sack_ok && 14508 tcp->tcp_notsack_list != NULL) { 14509 flags |= TH_NEED_SACK_REXMIT; 14510 tcp->tcp_pipe -= mss; 14511 if (tcp->tcp_pipe < 0) 14512 tcp->tcp_pipe = 0; 14513 } else { 14514 /* 14515 * Hoe's algorithm: 14516 * 14517 * Retransmit the unack'ed segment and 14518 * restart fast recovery. Note that we 14519 * need to scale back tcp_cwnd to the 14520 * original value when we started fast 14521 * recovery. This is to prevent overly 14522 * aggressive behaviour in sending new 14523 * segments. 14524 */ 14525 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 14526 tcp_dupack_fast_retransmit * mss; 14527 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 14528 flags |= TH_REXMIT_NEEDED; 14529 } 14530 } 14531 } else { 14532 tcp->tcp_dupack_cnt = 0; 14533 if (tcp->tcp_rexmit) { 14534 /* 14535 * TCP is retranmitting. If the ACK ack's all 14536 * outstanding data, update tcp_rexmit_max and 14537 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 14538 * to the correct value. 14539 * 14540 * Note that SEQ_LEQ() is used. This is to avoid 14541 * unnecessary fast retransmit caused by dup ACKs 14542 * received when TCP does slow start retransmission 14543 * after a time out. During this phase, TCP may 14544 * send out segments which are already received. 14545 * This causes dup ACKs to be sent back. 14546 */ 14547 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 14548 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 14549 tcp->tcp_rexmit_nxt = seg_ack; 14550 } 14551 if (seg_ack != tcp->tcp_rexmit_max) { 14552 flags |= TH_XMIT_NEEDED; 14553 } 14554 } else { 14555 tcp->tcp_rexmit = B_FALSE; 14556 tcp->tcp_xmit_zc_clean = B_FALSE; 14557 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 14558 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14559 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14560 } 14561 tcp->tcp_ms_we_have_waited = 0; 14562 } 14563 } 14564 14565 BUMP_MIB(&tcp_mib, tcpInAckSegs); 14566 UPDATE_MIB(&tcp_mib, tcpInAckBytes, bytes_acked); 14567 tcp->tcp_suna = seg_ack; 14568 if (tcp->tcp_zero_win_probe != 0) { 14569 tcp->tcp_zero_win_probe = 0; 14570 tcp->tcp_timer_backoff = 0; 14571 } 14572 14573 /* 14574 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 14575 * Note that it cannot be the SYN being ack'ed. The code flow 14576 * will not reach here. 14577 */ 14578 if (mp1 == NULL) { 14579 goto fin_acked; 14580 } 14581 14582 /* 14583 * Update the congestion window. 14584 * 14585 * If TCP is not ECN capable or TCP is ECN capable but the 14586 * congestion experience bit is not set, increase the tcp_cwnd as 14587 * usual. 14588 */ 14589 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 14590 cwnd = tcp->tcp_cwnd; 14591 add = mss; 14592 14593 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 14594 /* 14595 * This is to prevent an increase of less than 1 MSS of 14596 * tcp_cwnd. With partial increase, tcp_wput_data() 14597 * may send out tinygrams in order to preserve mblk 14598 * boundaries. 14599 * 14600 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 14601 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 14602 * increased by 1 MSS for every RTTs. 14603 */ 14604 if (tcp->tcp_cwnd_cnt <= 0) { 14605 tcp->tcp_cwnd_cnt = cwnd + add; 14606 } else { 14607 tcp->tcp_cwnd_cnt -= add; 14608 add = 0; 14609 } 14610 } 14611 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 14612 } 14613 14614 /* See if the latest urgent data has been acknowledged */ 14615 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 14616 SEQ_GT(seg_ack, tcp->tcp_urg)) 14617 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 14618 14619 /* Can we update the RTT estimates? */ 14620 if (tcp->tcp_snd_ts_ok) { 14621 /* Ignore zero timestamp echo-reply. */ 14622 if (tcpopt.tcp_opt_ts_ecr != 0) { 14623 tcp_set_rto(tcp, (int32_t)lbolt - 14624 (int32_t)tcpopt.tcp_opt_ts_ecr); 14625 } 14626 14627 /* If needed, restart the timer. */ 14628 if (tcp->tcp_set_timer == 1) { 14629 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14630 tcp->tcp_set_timer = 0; 14631 } 14632 /* 14633 * Update tcp_csuna in case the other side stops sending 14634 * us timestamps. 14635 */ 14636 tcp->tcp_csuna = tcp->tcp_snxt; 14637 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 14638 /* 14639 * An ACK sequence we haven't seen before, so get the RTT 14640 * and update the RTO. But first check if the timestamp is 14641 * valid to use. 14642 */ 14643 if ((mp1->b_next != NULL) && 14644 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) 14645 tcp_set_rto(tcp, (int32_t)lbolt - 14646 (int32_t)(intptr_t)mp1->b_prev); 14647 else 14648 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14649 14650 /* Remeber the last sequence to be ACKed */ 14651 tcp->tcp_csuna = seg_ack; 14652 if (tcp->tcp_set_timer == 1) { 14653 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14654 tcp->tcp_set_timer = 0; 14655 } 14656 } else { 14657 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14658 } 14659 14660 /* Eat acknowledged bytes off the xmit queue. */ 14661 for (;;) { 14662 mblk_t *mp2; 14663 uchar_t *wptr; 14664 14665 wptr = mp1->b_wptr; 14666 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 14667 bytes_acked -= (int)(wptr - mp1->b_rptr); 14668 if (bytes_acked < 0) { 14669 mp1->b_rptr = wptr + bytes_acked; 14670 /* 14671 * Set a new timestamp if all the bytes timed by the 14672 * old timestamp have been ack'ed. 14673 */ 14674 if (SEQ_GT(seg_ack, 14675 (uint32_t)(uintptr_t)(mp1->b_next))) { 14676 mp1->b_prev = (mblk_t *)(uintptr_t)lbolt; 14677 mp1->b_next = NULL; 14678 } 14679 break; 14680 } 14681 mp1->b_next = NULL; 14682 mp1->b_prev = NULL; 14683 mp2 = mp1; 14684 mp1 = mp1->b_cont; 14685 14686 /* 14687 * This notification is required for some zero-copy 14688 * clients to maintain a copy semantic. After the data 14689 * is ack'ed, client is safe to modify or reuse the buffer. 14690 */ 14691 if (tcp->tcp_snd_zcopy_aware && 14692 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 14693 tcp_zcopy_notify(tcp); 14694 freeb(mp2); 14695 if (bytes_acked == 0) { 14696 if (mp1 == NULL) { 14697 /* Everything is ack'ed, clear the tail. */ 14698 tcp->tcp_xmit_tail = NULL; 14699 /* 14700 * Cancel the timer unless we are still 14701 * waiting for an ACK for the FIN packet. 14702 */ 14703 if (tcp->tcp_timer_tid != 0 && 14704 tcp->tcp_snxt == tcp->tcp_suna) { 14705 (void) TCP_TIMER_CANCEL(tcp, 14706 tcp->tcp_timer_tid); 14707 tcp->tcp_timer_tid = 0; 14708 } 14709 goto pre_swnd_update; 14710 } 14711 if (mp2 != tcp->tcp_xmit_tail) 14712 break; 14713 tcp->tcp_xmit_tail = mp1; 14714 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 14715 (uintptr_t)INT_MAX); 14716 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 14717 mp1->b_rptr); 14718 break; 14719 } 14720 if (mp1 == NULL) { 14721 /* 14722 * More was acked but there is nothing more 14723 * outstanding. This means that the FIN was 14724 * just acked or that we're talking to a clown. 14725 */ 14726 fin_acked: 14727 ASSERT(tcp->tcp_fin_sent); 14728 tcp->tcp_xmit_tail = NULL; 14729 if (tcp->tcp_fin_sent) { 14730 /* FIN was acked - making progress */ 14731 if (tcp->tcp_ipversion == IPV6_VERSION && 14732 !tcp->tcp_fin_acked) 14733 tcp->tcp_ip_forward_progress = B_TRUE; 14734 tcp->tcp_fin_acked = B_TRUE; 14735 if (tcp->tcp_linger_tid != 0 && 14736 TCP_TIMER_CANCEL(tcp, 14737 tcp->tcp_linger_tid) >= 0) { 14738 tcp_stop_lingering(tcp); 14739 } 14740 } else { 14741 /* 14742 * We should never get here because 14743 * we have already checked that the 14744 * number of bytes ack'ed should be 14745 * smaller than or equal to what we 14746 * have sent so far (it is the 14747 * acceptability check of the ACK). 14748 * We can only get here if the send 14749 * queue is corrupted. 14750 * 14751 * Terminate the connection and 14752 * panic the system. It is better 14753 * for us to panic instead of 14754 * continuing to avoid other disaster. 14755 */ 14756 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 14757 tcp->tcp_rnxt, TH_RST|TH_ACK); 14758 panic("Memory corruption " 14759 "detected for connection %s.", 14760 tcp_display(tcp, NULL, 14761 DISP_ADDR_AND_PORT)); 14762 /*NOTREACHED*/ 14763 } 14764 goto pre_swnd_update; 14765 } 14766 ASSERT(mp2 != tcp->tcp_xmit_tail); 14767 } 14768 if (tcp->tcp_unsent) { 14769 flags |= TH_XMIT_NEEDED; 14770 } 14771 pre_swnd_update: 14772 tcp->tcp_xmit_head = mp1; 14773 swnd_update: 14774 /* 14775 * The following check is different from most other implementations. 14776 * For bi-directional transfer, when segments are dropped, the 14777 * "normal" check will not accept a window update in those 14778 * retransmitted segemnts. Failing to do that, TCP may send out 14779 * segments which are outside receiver's window. As TCP accepts 14780 * the ack in those retransmitted segments, if the window update in 14781 * the same segment is not accepted, TCP will incorrectly calculates 14782 * that it can send more segments. This can create a deadlock 14783 * with the receiver if its window becomes zero. 14784 */ 14785 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 14786 SEQ_LT(tcp->tcp_swl1, seg_seq) || 14787 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 14788 /* 14789 * The criteria for update is: 14790 * 14791 * 1. the segment acknowledges some data. Or 14792 * 2. the segment is new, i.e. it has a higher seq num. Or 14793 * 3. the segment is not old and the advertised window is 14794 * larger than the previous advertised window. 14795 */ 14796 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 14797 flags |= TH_XMIT_NEEDED; 14798 tcp->tcp_swnd = new_swnd; 14799 if (new_swnd > tcp->tcp_max_swnd) 14800 tcp->tcp_max_swnd = new_swnd; 14801 tcp->tcp_swl1 = seg_seq; 14802 tcp->tcp_swl2 = seg_ack; 14803 } 14804 est: 14805 if (tcp->tcp_state > TCPS_ESTABLISHED) { 14806 switch (tcp->tcp_state) { 14807 case TCPS_FIN_WAIT_1: 14808 if (tcp->tcp_fin_acked) { 14809 tcp->tcp_state = TCPS_FIN_WAIT_2; 14810 /* 14811 * We implement the non-standard BSD/SunOS 14812 * FIN_WAIT_2 flushing algorithm. 14813 * If there is no user attached to this 14814 * TCP endpoint, then this TCP struct 14815 * could hang around forever in FIN_WAIT_2 14816 * state if the peer forgets to send us 14817 * a FIN. To prevent this, we wait only 14818 * 2*MSL (a convenient time value) for 14819 * the FIN to arrive. If it doesn't show up, 14820 * we flush the TCP endpoint. This algorithm, 14821 * though a violation of RFC-793, has worked 14822 * for over 10 years in BSD systems. 14823 * Note: SunOS 4.x waits 675 seconds before 14824 * flushing the FIN_WAIT_2 connection. 14825 */ 14826 TCP_TIMER_RESTART(tcp, 14827 tcp_fin_wait_2_flush_interval); 14828 } 14829 break; 14830 case TCPS_FIN_WAIT_2: 14831 break; /* Shutdown hook? */ 14832 case TCPS_LAST_ACK: 14833 freemsg(mp); 14834 if (tcp->tcp_fin_acked) { 14835 (void) tcp_clean_death(tcp, 0, 19); 14836 return; 14837 } 14838 goto xmit_check; 14839 case TCPS_CLOSING: 14840 if (tcp->tcp_fin_acked) { 14841 tcp->tcp_state = TCPS_TIME_WAIT; 14842 if (!TCP_IS_DETACHED(tcp)) { 14843 TCP_TIMER_RESTART(tcp, 14844 tcp_time_wait_interval); 14845 } else { 14846 tcp_time_wait_append(tcp); 14847 TCP_DBGSTAT(tcp_rput_time_wait); 14848 } 14849 } 14850 /*FALLTHRU*/ 14851 case TCPS_CLOSE_WAIT: 14852 freemsg(mp); 14853 goto xmit_check; 14854 default: 14855 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 14856 break; 14857 } 14858 } 14859 if (flags & TH_FIN) { 14860 /* Make sure we ack the fin */ 14861 flags |= TH_ACK_NEEDED; 14862 if (!tcp->tcp_fin_rcvd) { 14863 tcp->tcp_fin_rcvd = B_TRUE; 14864 tcp->tcp_rnxt++; 14865 tcph = tcp->tcp_tcph; 14866 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14867 14868 /* 14869 * Generate the ordrel_ind at the end unless we 14870 * are an eager guy. 14871 * In the eager case tcp_rsrv will do this when run 14872 * after tcp_accept is done. 14873 */ 14874 if (tcp->tcp_listener == NULL && 14875 !TCP_IS_DETACHED(tcp) && (!tcp->tcp_hard_binding)) 14876 flags |= TH_ORDREL_NEEDED; 14877 switch (tcp->tcp_state) { 14878 case TCPS_SYN_RCVD: 14879 case TCPS_ESTABLISHED: 14880 tcp->tcp_state = TCPS_CLOSE_WAIT; 14881 /* Keepalive? */ 14882 break; 14883 case TCPS_FIN_WAIT_1: 14884 if (!tcp->tcp_fin_acked) { 14885 tcp->tcp_state = TCPS_CLOSING; 14886 break; 14887 } 14888 /* FALLTHRU */ 14889 case TCPS_FIN_WAIT_2: 14890 tcp->tcp_state = TCPS_TIME_WAIT; 14891 if (!TCP_IS_DETACHED(tcp)) { 14892 TCP_TIMER_RESTART(tcp, 14893 tcp_time_wait_interval); 14894 } else { 14895 tcp_time_wait_append(tcp); 14896 TCP_DBGSTAT(tcp_rput_time_wait); 14897 } 14898 if (seg_len) { 14899 /* 14900 * implies data piggybacked on FIN. 14901 * break to handle data. 14902 */ 14903 break; 14904 } 14905 freemsg(mp); 14906 goto ack_check; 14907 } 14908 } 14909 } 14910 if (mp == NULL) 14911 goto xmit_check; 14912 if (seg_len == 0) { 14913 freemsg(mp); 14914 goto xmit_check; 14915 } 14916 if (mp->b_rptr == mp->b_wptr) { 14917 /* 14918 * The header has been consumed, so we remove the 14919 * zero-length mblk here. 14920 */ 14921 mp1 = mp; 14922 mp = mp->b_cont; 14923 freeb(mp1); 14924 } 14925 tcph = tcp->tcp_tcph; 14926 tcp->tcp_rack_cnt++; 14927 { 14928 uint32_t cur_max; 14929 14930 cur_max = tcp->tcp_rack_cur_max; 14931 if (tcp->tcp_rack_cnt >= cur_max) { 14932 /* 14933 * We have more unacked data than we should - send 14934 * an ACK now. 14935 */ 14936 flags |= TH_ACK_NEEDED; 14937 cur_max++; 14938 if (cur_max > tcp->tcp_rack_abs_max) 14939 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 14940 else 14941 tcp->tcp_rack_cur_max = cur_max; 14942 } else if (TCP_IS_DETACHED(tcp)) { 14943 /* We don't have an ACK timer for detached TCP. */ 14944 flags |= TH_ACK_NEEDED; 14945 } else if (seg_len < mss) { 14946 /* 14947 * If we get a segment that is less than an mss, and we 14948 * already have unacknowledged data, and the amount 14949 * unacknowledged is not a multiple of mss, then we 14950 * better generate an ACK now. Otherwise, this may be 14951 * the tail piece of a transaction, and we would rather 14952 * wait for the response. 14953 */ 14954 uint32_t udif; 14955 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 14956 (uintptr_t)INT_MAX); 14957 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 14958 if (udif && (udif % mss)) 14959 flags |= TH_ACK_NEEDED; 14960 else 14961 flags |= TH_ACK_TIMER_NEEDED; 14962 } else { 14963 /* Start delayed ack timer */ 14964 flags |= TH_ACK_TIMER_NEEDED; 14965 } 14966 } 14967 tcp->tcp_rnxt += seg_len; 14968 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14969 14970 /* Update SACK list */ 14971 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 14972 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 14973 &(tcp->tcp_num_sack_blk)); 14974 } 14975 14976 if (tcp->tcp_urp_mp) { 14977 tcp->tcp_urp_mp->b_cont = mp; 14978 mp = tcp->tcp_urp_mp; 14979 tcp->tcp_urp_mp = NULL; 14980 /* Ready for a new signal. */ 14981 tcp->tcp_urp_last_valid = B_FALSE; 14982 #ifdef DEBUG 14983 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14984 "tcp_rput: sending exdata_ind %s", 14985 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14986 #endif /* DEBUG */ 14987 } 14988 14989 /* 14990 * Check for ancillary data changes compared to last segment. 14991 */ 14992 if (tcp->tcp_ipv6_recvancillary != 0) { 14993 mp = tcp_rput_add_ancillary(tcp, mp, &ipp); 14994 if (mp == NULL) 14995 return; 14996 } 14997 14998 if (tcp->tcp_listener || tcp->tcp_hard_binding) { 14999 /* 15000 * Side queue inbound data until the accept happens. 15001 * tcp_accept/tcp_rput drains this when the accept happens. 15002 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 15003 * T_EXDATA_IND) it is queued on b_next. 15004 * XXX Make urgent data use this. Requires: 15005 * Removing tcp_listener check for TH_URG 15006 * Making M_PCPROTO and MARK messages skip the eager case 15007 */ 15008 tcp_rcv_enqueue(tcp, mp, seg_len); 15009 } else { 15010 if (mp->b_datap->db_type != M_DATA || 15011 (flags & TH_MARKNEXT_NEEDED)) { 15012 if (tcp->tcp_rcv_list != NULL) { 15013 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15014 } 15015 ASSERT(tcp->tcp_rcv_list == NULL || 15016 tcp->tcp_fused_sigurg); 15017 if (flags & TH_MARKNEXT_NEEDED) { 15018 #ifdef DEBUG 15019 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 15020 "tcp_rput: sending MSGMARKNEXT %s", 15021 tcp_display(tcp, NULL, 15022 DISP_PORT_ONLY)); 15023 #endif /* DEBUG */ 15024 mp->b_flag |= MSGMARKNEXT; 15025 flags &= ~TH_MARKNEXT_NEEDED; 15026 } 15027 putnext(tcp->tcp_rq, mp); 15028 if (!canputnext(tcp->tcp_rq)) 15029 tcp->tcp_rwnd -= seg_len; 15030 } else if (((flags & (TH_PUSH|TH_FIN)) || 15031 tcp->tcp_rcv_cnt + seg_len >= tcp->tcp_rq->q_hiwat >> 3) && 15032 (sqp != NULL)) { 15033 if (tcp->tcp_rcv_list != NULL) { 15034 /* 15035 * Enqueue the new segment first and then 15036 * call tcp_rcv_drain() to send all data 15037 * up. The other way to do this is to 15038 * send all queued data up and then call 15039 * putnext() to send the new segment up. 15040 * This way can remove the else part later 15041 * on. 15042 * 15043 * We don't this to avoid one more call to 15044 * canputnext() as tcp_rcv_drain() needs to 15045 * call canputnext(). 15046 */ 15047 tcp_rcv_enqueue(tcp, mp, seg_len); 15048 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15049 } else { 15050 putnext(tcp->tcp_rq, mp); 15051 if (!canputnext(tcp->tcp_rq)) 15052 tcp->tcp_rwnd -= seg_len; 15053 } 15054 } else { 15055 /* 15056 * Enqueue all packets when processing an mblk 15057 * from the co queue and also enqueue normal packets. 15058 */ 15059 tcp_rcv_enqueue(tcp, mp, seg_len); 15060 } 15061 /* 15062 * Make sure the timer is running if we have data waiting 15063 * for a push bit. This provides resiliency against 15064 * implementations that do not correctly generate push bits. 15065 */ 15066 if ((sqp != NULL) && tcp->tcp_rcv_list != NULL && 15067 tcp->tcp_push_tid == 0) { 15068 /* 15069 * The connection may be closed at this point, so don't 15070 * do anything for a detached tcp. 15071 */ 15072 if (!TCP_IS_DETACHED(tcp)) 15073 tcp->tcp_push_tid = TCP_TIMER(tcp, 15074 tcp_push_timer, 15075 MSEC_TO_TICK(tcp_push_timer_interval)); 15076 } 15077 } 15078 xmit_check: 15079 /* Is there anything left to do? */ 15080 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 15081 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 15082 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 15083 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 15084 goto done; 15085 15086 /* Any transmit work to do and a non-zero window? */ 15087 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 15088 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 15089 if (flags & TH_REXMIT_NEEDED) { 15090 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 15091 15092 BUMP_MIB(&tcp_mib, tcpOutFastRetrans); 15093 if (snd_size > mss) 15094 snd_size = mss; 15095 if (snd_size > tcp->tcp_swnd) 15096 snd_size = tcp->tcp_swnd; 15097 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 15098 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 15099 B_TRUE); 15100 15101 if (mp1 != NULL) { 15102 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 15103 tcp->tcp_csuna = tcp->tcp_snxt; 15104 BUMP_MIB(&tcp_mib, tcpRetransSegs); 15105 UPDATE_MIB(&tcp_mib, tcpRetransBytes, snd_size); 15106 TCP_RECORD_TRACE(tcp, mp1, 15107 TCP_TRACE_SEND_PKT); 15108 tcp_send_data(tcp, tcp->tcp_wq, mp1); 15109 } 15110 } 15111 if (flags & TH_NEED_SACK_REXMIT) { 15112 tcp_sack_rxmit(tcp, &flags); 15113 } 15114 /* 15115 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 15116 * out new segment. Note that tcp_rexmit should not be 15117 * set, otherwise TH_LIMIT_XMIT should not be set. 15118 */ 15119 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 15120 if (!tcp->tcp_rexmit) { 15121 tcp_wput_data(tcp, NULL, B_FALSE); 15122 } else { 15123 tcp_ss_rexmit(tcp); 15124 } 15125 } 15126 /* 15127 * Adjust tcp_cwnd back to normal value after sending 15128 * new data segments. 15129 */ 15130 if (flags & TH_LIMIT_XMIT) { 15131 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 15132 /* 15133 * This will restart the timer. Restarting the 15134 * timer is used to avoid a timeout before the 15135 * limited transmitted segment's ACK gets back. 15136 */ 15137 if (tcp->tcp_xmit_head != NULL) 15138 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 15139 } 15140 15141 /* Anything more to do? */ 15142 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 15143 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 15144 goto done; 15145 } 15146 ack_check: 15147 if (flags & TH_SEND_URP_MARK) { 15148 ASSERT(tcp->tcp_urp_mark_mp); 15149 /* 15150 * Send up any queued data and then send the mark message 15151 */ 15152 if (tcp->tcp_rcv_list != NULL) { 15153 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15154 } 15155 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 15156 15157 mp1 = tcp->tcp_urp_mark_mp; 15158 tcp->tcp_urp_mark_mp = NULL; 15159 #ifdef DEBUG 15160 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 15161 "tcp_rput: sending zero-length %s %s", 15162 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 15163 "MSGNOTMARKNEXT"), 15164 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 15165 #endif /* DEBUG */ 15166 putnext(tcp->tcp_rq, mp1); 15167 flags &= ~TH_SEND_URP_MARK; 15168 } 15169 if (flags & TH_ACK_NEEDED) { 15170 /* 15171 * Time to send an ack for some reason. 15172 */ 15173 mp1 = tcp_ack_mp(tcp); 15174 15175 if (mp1 != NULL) { 15176 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 15177 tcp_send_data(tcp, tcp->tcp_wq, mp1); 15178 BUMP_LOCAL(tcp->tcp_obsegs); 15179 BUMP_MIB(&tcp_mib, tcpOutAck); 15180 } 15181 if (tcp->tcp_ack_tid != 0) { 15182 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 15183 tcp->tcp_ack_tid = 0; 15184 } 15185 } 15186 if (flags & TH_ACK_TIMER_NEEDED) { 15187 /* 15188 * Arrange for deferred ACK or push wait timeout. 15189 * Start timer if it is not already running. 15190 */ 15191 if (tcp->tcp_ack_tid == 0) { 15192 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 15193 MSEC_TO_TICK(tcp->tcp_localnet ? 15194 (clock_t)tcp_local_dack_interval : 15195 (clock_t)tcp_deferred_ack_interval)); 15196 } 15197 } 15198 if (flags & TH_ORDREL_NEEDED) { 15199 /* 15200 * Send up the ordrel_ind unless we are an eager guy. 15201 * In the eager case tcp_rsrv will do this when run 15202 * after tcp_accept is done. 15203 */ 15204 ASSERT(tcp->tcp_listener == NULL); 15205 if (tcp->tcp_rcv_list != NULL) { 15206 /* 15207 * Push any mblk(s) enqueued from co processing. 15208 */ 15209 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15210 } 15211 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 15212 if ((mp1 = mi_tpi_ordrel_ind()) != NULL) { 15213 tcp->tcp_ordrel_done = B_TRUE; 15214 putnext(tcp->tcp_rq, mp1); 15215 if (tcp->tcp_deferred_clean_death) { 15216 /* 15217 * tcp_clean_death was deferred 15218 * for T_ORDREL_IND - do it now 15219 */ 15220 (void) tcp_clean_death(tcp, 15221 tcp->tcp_client_errno, 20); 15222 tcp->tcp_deferred_clean_death = B_FALSE; 15223 } 15224 } else { 15225 /* 15226 * Run the orderly release in the 15227 * service routine. 15228 */ 15229 qenable(tcp->tcp_rq); 15230 /* 15231 * Caveat(XXX): The machine may be so 15232 * overloaded that tcp_rsrv() is not scheduled 15233 * until after the endpoint has transitioned 15234 * to TCPS_TIME_WAIT 15235 * and tcp_time_wait_interval expires. Then 15236 * tcp_timer() will blow away state in tcp_t 15237 * and T_ORDREL_IND will never be delivered 15238 * upstream. Unlikely but potentially 15239 * a problem. 15240 */ 15241 } 15242 } 15243 done: 15244 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 15245 } 15246 15247 /* 15248 * This function does PAWS protection check. Returns B_TRUE if the 15249 * segment passes the PAWS test, else returns B_FALSE. 15250 */ 15251 boolean_t 15252 tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp) 15253 { 15254 uint8_t flags; 15255 int options; 15256 uint8_t *up; 15257 15258 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 15259 /* 15260 * If timestamp option is aligned nicely, get values inline, 15261 * otherwise call general routine to parse. Only do that 15262 * if timestamp is the only option. 15263 */ 15264 if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH + 15265 TCPOPT_REAL_TS_LEN && 15266 OK_32PTR((up = ((uint8_t *)tcph) + 15267 TCP_MIN_HEADER_LENGTH)) && 15268 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 15269 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 15270 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 15271 15272 options = TCP_OPT_TSTAMP_PRESENT; 15273 } else { 15274 if (tcp->tcp_snd_sack_ok) { 15275 tcpoptp->tcp = tcp; 15276 } else { 15277 tcpoptp->tcp = NULL; 15278 } 15279 options = tcp_parse_options(tcph, tcpoptp); 15280 } 15281 15282 if (options & TCP_OPT_TSTAMP_PRESENT) { 15283 /* 15284 * Do PAWS per RFC 1323 section 4.2. Accept RST 15285 * regardless of the timestamp, page 18 RFC 1323.bis. 15286 */ 15287 if ((flags & TH_RST) == 0 && 15288 TSTMP_LT(tcpoptp->tcp_opt_ts_val, 15289 tcp->tcp_ts_recent)) { 15290 if (TSTMP_LT(lbolt64, tcp->tcp_last_rcv_lbolt + 15291 PAWS_TIMEOUT)) { 15292 /* This segment is not acceptable. */ 15293 return (B_FALSE); 15294 } else { 15295 /* 15296 * Connection has been idle for 15297 * too long. Reset the timestamp 15298 * and assume the segment is valid. 15299 */ 15300 tcp->tcp_ts_recent = 15301 tcpoptp->tcp_opt_ts_val; 15302 } 15303 } 15304 } else { 15305 /* 15306 * If we don't get a timestamp on every packet, we 15307 * figure we can't really trust 'em, so we stop sending 15308 * and parsing them. 15309 */ 15310 tcp->tcp_snd_ts_ok = B_FALSE; 15311 15312 tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 15313 tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 15314 tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4); 15315 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN); 15316 if (tcp->tcp_snd_sack_ok) { 15317 ASSERT(tcp->tcp_sack_info != NULL); 15318 tcp->tcp_max_sack_blk = 4; 15319 } 15320 } 15321 return (B_TRUE); 15322 } 15323 15324 /* 15325 * Attach ancillary data to a received TCP segments for the 15326 * ancillary pieces requested by the application that are 15327 * different than they were in the previous data segment. 15328 * 15329 * Save the "current" values once memory allocation is ok so that 15330 * when memory allocation fails we can just wait for the next data segment. 15331 */ 15332 static mblk_t * 15333 tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp) 15334 { 15335 struct T_optdata_ind *todi; 15336 int optlen; 15337 uchar_t *optptr; 15338 struct T_opthdr *toh; 15339 uint_t addflag; /* Which pieces to add */ 15340 mblk_t *mp1; 15341 15342 optlen = 0; 15343 addflag = 0; 15344 /* If app asked for pktinfo and the index has changed ... */ 15345 if ((ipp->ipp_fields & IPPF_IFINDEX) && 15346 ipp->ipp_ifindex != tcp->tcp_recvifindex && 15347 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)) { 15348 optlen += sizeof (struct T_opthdr) + 15349 sizeof (struct in6_pktinfo); 15350 addflag |= TCP_IPV6_RECVPKTINFO; 15351 } 15352 /* If app asked for hoplimit and it has changed ... */ 15353 if ((ipp->ipp_fields & IPPF_HOPLIMIT) && 15354 ipp->ipp_hoplimit != tcp->tcp_recvhops && 15355 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT)) { 15356 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 15357 addflag |= TCP_IPV6_RECVHOPLIMIT; 15358 } 15359 /* If app asked for tclass and it has changed ... */ 15360 if ((ipp->ipp_fields & IPPF_TCLASS) && 15361 ipp->ipp_tclass != tcp->tcp_recvtclass && 15362 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)) { 15363 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 15364 addflag |= TCP_IPV6_RECVTCLASS; 15365 } 15366 /* If app asked for hopbyhop headers and it has changed ... */ 15367 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) && 15368 tcp_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 15369 (ipp->ipp_fields & IPPF_HOPOPTS), 15370 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 15371 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen; 15372 addflag |= TCP_IPV6_RECVHOPOPTS; 15373 if (!tcp_allocbuf((void **)&tcp->tcp_hopopts, 15374 &tcp->tcp_hopoptslen, 15375 (ipp->ipp_fields & IPPF_HOPOPTS), 15376 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 15377 return (mp); 15378 } 15379 /* If app asked for dst headers before routing headers ... */ 15380 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) && 15381 tcp_cmpbuf(tcp->tcp_rtdstopts, tcp->tcp_rtdstoptslen, 15382 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15383 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) { 15384 optlen += sizeof (struct T_opthdr) + 15385 ipp->ipp_rtdstoptslen; 15386 addflag |= TCP_IPV6_RECVRTDSTOPTS; 15387 if (!tcp_allocbuf((void **)&tcp->tcp_rtdstopts, 15388 &tcp->tcp_rtdstoptslen, 15389 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15390 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) 15391 return (mp); 15392 } 15393 /* If app asked for routing headers and it has changed ... */ 15394 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) && 15395 tcp_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 15396 (ipp->ipp_fields & IPPF_RTHDR), 15397 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 15398 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 15399 addflag |= TCP_IPV6_RECVRTHDR; 15400 if (!tcp_allocbuf((void **)&tcp->tcp_rthdr, 15401 &tcp->tcp_rthdrlen, 15402 (ipp->ipp_fields & IPPF_RTHDR), 15403 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 15404 return (mp); 15405 } 15406 /* If app asked for dest headers and it has changed ... */ 15407 if ((tcp->tcp_ipv6_recvancillary & 15408 (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) && 15409 tcp_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 15410 (ipp->ipp_fields & IPPF_DSTOPTS), 15411 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 15412 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 15413 addflag |= TCP_IPV6_RECVDSTOPTS; 15414 if (!tcp_allocbuf((void **)&tcp->tcp_dstopts, 15415 &tcp->tcp_dstoptslen, 15416 (ipp->ipp_fields & IPPF_DSTOPTS), 15417 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 15418 return (mp); 15419 } 15420 15421 if (optlen == 0) { 15422 /* Nothing to add */ 15423 return (mp); 15424 } 15425 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 15426 if (mp1 == NULL) { 15427 /* 15428 * Defer sending ancillary data until the next TCP segment 15429 * arrives. 15430 */ 15431 return (mp); 15432 } 15433 mp1->b_cont = mp; 15434 mp = mp1; 15435 mp->b_wptr += sizeof (*todi) + optlen; 15436 mp->b_datap->db_type = M_PROTO; 15437 todi = (struct T_optdata_ind *)mp->b_rptr; 15438 todi->PRIM_type = T_OPTDATA_IND; 15439 todi->DATA_flag = 1; /* MORE data */ 15440 todi->OPT_length = optlen; 15441 todi->OPT_offset = sizeof (*todi); 15442 optptr = (uchar_t *)&todi[1]; 15443 /* 15444 * If app asked for pktinfo and the index has changed ... 15445 * Note that the local address never changes for the connection. 15446 */ 15447 if (addflag & TCP_IPV6_RECVPKTINFO) { 15448 struct in6_pktinfo *pkti; 15449 15450 toh = (struct T_opthdr *)optptr; 15451 toh->level = IPPROTO_IPV6; 15452 toh->name = IPV6_PKTINFO; 15453 toh->len = sizeof (*toh) + sizeof (*pkti); 15454 toh->status = 0; 15455 optptr += sizeof (*toh); 15456 pkti = (struct in6_pktinfo *)optptr; 15457 if (tcp->tcp_ipversion == IPV6_VERSION) 15458 pkti->ipi6_addr = tcp->tcp_ip6h->ip6_src; 15459 else 15460 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 15461 &pkti->ipi6_addr); 15462 pkti->ipi6_ifindex = ipp->ipp_ifindex; 15463 optptr += sizeof (*pkti); 15464 ASSERT(OK_32PTR(optptr)); 15465 /* Save as "last" value */ 15466 tcp->tcp_recvifindex = ipp->ipp_ifindex; 15467 } 15468 /* If app asked for hoplimit and it has changed ... */ 15469 if (addflag & TCP_IPV6_RECVHOPLIMIT) { 15470 toh = (struct T_opthdr *)optptr; 15471 toh->level = IPPROTO_IPV6; 15472 toh->name = IPV6_HOPLIMIT; 15473 toh->len = sizeof (*toh) + sizeof (uint_t); 15474 toh->status = 0; 15475 optptr += sizeof (*toh); 15476 *(uint_t *)optptr = ipp->ipp_hoplimit; 15477 optptr += sizeof (uint_t); 15478 ASSERT(OK_32PTR(optptr)); 15479 /* Save as "last" value */ 15480 tcp->tcp_recvhops = ipp->ipp_hoplimit; 15481 } 15482 /* If app asked for tclass and it has changed ... */ 15483 if (addflag & TCP_IPV6_RECVTCLASS) { 15484 toh = (struct T_opthdr *)optptr; 15485 toh->level = IPPROTO_IPV6; 15486 toh->name = IPV6_TCLASS; 15487 toh->len = sizeof (*toh) + sizeof (uint_t); 15488 toh->status = 0; 15489 optptr += sizeof (*toh); 15490 *(uint_t *)optptr = ipp->ipp_tclass; 15491 optptr += sizeof (uint_t); 15492 ASSERT(OK_32PTR(optptr)); 15493 /* Save as "last" value */ 15494 tcp->tcp_recvtclass = ipp->ipp_tclass; 15495 } 15496 if (addflag & TCP_IPV6_RECVHOPOPTS) { 15497 toh = (struct T_opthdr *)optptr; 15498 toh->level = IPPROTO_IPV6; 15499 toh->name = IPV6_HOPOPTS; 15500 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen; 15501 toh->status = 0; 15502 optptr += sizeof (*toh); 15503 bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 15504 optptr += ipp->ipp_hopoptslen; 15505 ASSERT(OK_32PTR(optptr)); 15506 /* Save as last value */ 15507 tcp_savebuf((void **)&tcp->tcp_hopopts, 15508 &tcp->tcp_hopoptslen, 15509 (ipp->ipp_fields & IPPF_HOPOPTS), 15510 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 15511 } 15512 if (addflag & TCP_IPV6_RECVRTDSTOPTS) { 15513 toh = (struct T_opthdr *)optptr; 15514 toh->level = IPPROTO_IPV6; 15515 toh->name = IPV6_RTHDRDSTOPTS; 15516 toh->len = sizeof (*toh) + ipp->ipp_rtdstoptslen; 15517 toh->status = 0; 15518 optptr += sizeof (*toh); 15519 bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen); 15520 optptr += ipp->ipp_rtdstoptslen; 15521 ASSERT(OK_32PTR(optptr)); 15522 /* Save as last value */ 15523 tcp_savebuf((void **)&tcp->tcp_rtdstopts, 15524 &tcp->tcp_rtdstoptslen, 15525 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15526 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 15527 } 15528 if (addflag & TCP_IPV6_RECVRTHDR) { 15529 toh = (struct T_opthdr *)optptr; 15530 toh->level = IPPROTO_IPV6; 15531 toh->name = IPV6_RTHDR; 15532 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 15533 toh->status = 0; 15534 optptr += sizeof (*toh); 15535 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 15536 optptr += ipp->ipp_rthdrlen; 15537 ASSERT(OK_32PTR(optptr)); 15538 /* Save as last value */ 15539 tcp_savebuf((void **)&tcp->tcp_rthdr, 15540 &tcp->tcp_rthdrlen, 15541 (ipp->ipp_fields & IPPF_RTHDR), 15542 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 15543 } 15544 if (addflag & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) { 15545 toh = (struct T_opthdr *)optptr; 15546 toh->level = IPPROTO_IPV6; 15547 toh->name = IPV6_DSTOPTS; 15548 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 15549 toh->status = 0; 15550 optptr += sizeof (*toh); 15551 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 15552 optptr += ipp->ipp_dstoptslen; 15553 ASSERT(OK_32PTR(optptr)); 15554 /* Save as last value */ 15555 tcp_savebuf((void **)&tcp->tcp_dstopts, 15556 &tcp->tcp_dstoptslen, 15557 (ipp->ipp_fields & IPPF_DSTOPTS), 15558 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 15559 } 15560 ASSERT(optptr == mp->b_wptr); 15561 return (mp); 15562 } 15563 15564 15565 /* 15566 * Handle a *T_BIND_REQ that has failed either due to a T_ERROR_ACK 15567 * or a "bad" IRE detected by tcp_adapt_ire. 15568 * We can't tell if the failure was due to the laddr or the faddr 15569 * thus we clear out all addresses and ports. 15570 */ 15571 static void 15572 tcp_bind_failed(tcp_t *tcp, mblk_t *mp, int error) 15573 { 15574 queue_t *q = tcp->tcp_rq; 15575 tcph_t *tcph; 15576 struct T_error_ack *tea; 15577 conn_t *connp = tcp->tcp_connp; 15578 15579 15580 ASSERT(mp->b_datap->db_type == M_PCPROTO); 15581 15582 if (mp->b_cont) { 15583 freemsg(mp->b_cont); 15584 mp->b_cont = NULL; 15585 } 15586 tea = (struct T_error_ack *)mp->b_rptr; 15587 switch (tea->PRIM_type) { 15588 case T_BIND_ACK: 15589 /* 15590 * Need to unbind with classifier since we were just told that 15591 * our bind succeeded. 15592 */ 15593 tcp->tcp_hard_bound = B_FALSE; 15594 tcp->tcp_hard_binding = B_FALSE; 15595 15596 ipcl_hash_remove(connp); 15597 /* Reuse the mblk if possible */ 15598 ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >= 15599 sizeof (*tea)); 15600 mp->b_rptr = mp->b_datap->db_base; 15601 mp->b_wptr = mp->b_rptr + sizeof (*tea); 15602 tea = (struct T_error_ack *)mp->b_rptr; 15603 tea->PRIM_type = T_ERROR_ACK; 15604 tea->TLI_error = TSYSERR; 15605 tea->UNIX_error = error; 15606 if (tcp->tcp_state >= TCPS_SYN_SENT) { 15607 tea->ERROR_prim = T_CONN_REQ; 15608 } else { 15609 tea->ERROR_prim = O_T_BIND_REQ; 15610 } 15611 break; 15612 15613 case T_ERROR_ACK: 15614 if (tcp->tcp_state >= TCPS_SYN_SENT) 15615 tea->ERROR_prim = T_CONN_REQ; 15616 break; 15617 default: 15618 panic("tcp_bind_failed: unexpected TPI type"); 15619 /*NOTREACHED*/ 15620 } 15621 15622 tcp->tcp_state = TCPS_IDLE; 15623 if (tcp->tcp_ipversion == IPV4_VERSION) 15624 tcp->tcp_ipha->ipha_src = 0; 15625 else 15626 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 15627 /* 15628 * Copy of the src addr. in tcp_t is needed since 15629 * the lookup funcs. can only look at tcp_t 15630 */ 15631 V6_SET_ZERO(tcp->tcp_ip_src_v6); 15632 15633 tcph = tcp->tcp_tcph; 15634 tcph->th_lport[0] = 0; 15635 tcph->th_lport[1] = 0; 15636 tcp_bind_hash_remove(tcp); 15637 bzero(&connp->u_port, sizeof (connp->u_port)); 15638 /* blow away saved option results if any */ 15639 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 15640 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 15641 15642 conn_delete_ire(tcp->tcp_connp, NULL); 15643 putnext(q, mp); 15644 } 15645 15646 /* 15647 * tcp_rput_other is called by tcp_rput to handle everything other than M_DATA 15648 * messages. 15649 */ 15650 void 15651 tcp_rput_other(tcp_t *tcp, mblk_t *mp) 15652 { 15653 mblk_t *mp1; 15654 uchar_t *rptr = mp->b_rptr; 15655 queue_t *q = tcp->tcp_rq; 15656 struct T_error_ack *tea; 15657 uint32_t mss; 15658 mblk_t *syn_mp; 15659 mblk_t *mdti; 15660 int retval; 15661 mblk_t *ire_mp; 15662 15663 switch (mp->b_datap->db_type) { 15664 case M_PROTO: 15665 case M_PCPROTO: 15666 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 15667 if ((mp->b_wptr - rptr) < sizeof (t_scalar_t)) 15668 break; 15669 tea = (struct T_error_ack *)rptr; 15670 switch (tea->PRIM_type) { 15671 case T_BIND_ACK: 15672 /* 15673 * Adapt Multidata information, if any. The 15674 * following tcp_mdt_update routine will free 15675 * the message. 15676 */ 15677 if ((mdti = tcp_mdt_info_mp(mp)) != NULL) { 15678 tcp_mdt_update(tcp, &((ip_mdt_info_t *)mdti-> 15679 b_rptr)->mdt_capab, B_TRUE); 15680 freemsg(mdti); 15681 } 15682 15683 /* Get the IRE, if we had requested for it */ 15684 ire_mp = tcp_ire_mp(mp); 15685 15686 if (tcp->tcp_hard_binding) { 15687 tcp->tcp_hard_binding = B_FALSE; 15688 tcp->tcp_hard_bound = B_TRUE; 15689 CL_INET_CONNECT(tcp); 15690 } else { 15691 if (ire_mp != NULL) 15692 freeb(ire_mp); 15693 goto after_syn_sent; 15694 } 15695 15696 retval = tcp_adapt_ire(tcp, ire_mp); 15697 if (ire_mp != NULL) 15698 freeb(ire_mp); 15699 if (retval == 0) { 15700 tcp_bind_failed(tcp, mp, 15701 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15702 ENETUNREACH : EADDRNOTAVAIL)); 15703 return; 15704 } 15705 /* 15706 * Don't let an endpoint connect to itself. 15707 * Also checked in tcp_connect() but that 15708 * check can't handle the case when the 15709 * local IP address is INADDR_ANY. 15710 */ 15711 if (tcp->tcp_ipversion == IPV4_VERSION) { 15712 if ((tcp->tcp_ipha->ipha_dst == 15713 tcp->tcp_ipha->ipha_src) && 15714 (BE16_EQL(tcp->tcp_tcph->th_lport, 15715 tcp->tcp_tcph->th_fport))) { 15716 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15717 return; 15718 } 15719 } else { 15720 if (IN6_ARE_ADDR_EQUAL( 15721 &tcp->tcp_ip6h->ip6_dst, 15722 &tcp->tcp_ip6h->ip6_src) && 15723 (BE16_EQL(tcp->tcp_tcph->th_lport, 15724 tcp->tcp_tcph->th_fport))) { 15725 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15726 return; 15727 } 15728 } 15729 ASSERT(tcp->tcp_state == TCPS_SYN_SENT); 15730 /* 15731 * This should not be possible! Just for 15732 * defensive coding... 15733 */ 15734 if (tcp->tcp_state != TCPS_SYN_SENT) 15735 goto after_syn_sent; 15736 15737 ASSERT(q == tcp->tcp_rq); 15738 /* 15739 * tcp_adapt_ire() does not adjust 15740 * for TCP/IP header length. 15741 */ 15742 mss = tcp->tcp_mss - tcp->tcp_hdr_len; 15743 15744 /* 15745 * Just make sure our rwnd is at 15746 * least tcp_recv_hiwat_mss * MSS 15747 * large, and round up to the nearest 15748 * MSS. 15749 * 15750 * We do the round up here because 15751 * we need to get the interface 15752 * MTU first before we can do the 15753 * round up. 15754 */ 15755 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 15756 tcp_recv_hiwat_minmss * mss); 15757 q->q_hiwat = tcp->tcp_rwnd; 15758 tcp_set_ws_value(tcp); 15759 U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws), 15760 tcp->tcp_tcph->th_win); 15761 if (tcp->tcp_rcv_ws > 0 || tcp_wscale_always) 15762 tcp->tcp_snd_ws_ok = B_TRUE; 15763 15764 /* 15765 * Set tcp_snd_ts_ok to true 15766 * so that tcp_xmit_mp will 15767 * include the timestamp 15768 * option in the SYN segment. 15769 */ 15770 if (tcp_tstamp_always || 15771 (tcp->tcp_rcv_ws && tcp_tstamp_if_wscale)) { 15772 tcp->tcp_snd_ts_ok = B_TRUE; 15773 } 15774 15775 /* 15776 * tcp_snd_sack_ok can be set in 15777 * tcp_adapt_ire() if the sack metric 15778 * is set. So check it here also. 15779 */ 15780 if (tcp_sack_permitted == 2 || 15781 tcp->tcp_snd_sack_ok) { 15782 if (tcp->tcp_sack_info == NULL) { 15783 tcp->tcp_sack_info = 15784 kmem_cache_alloc(tcp_sack_info_cache, 15785 KM_SLEEP); 15786 } 15787 tcp->tcp_snd_sack_ok = B_TRUE; 15788 } 15789 15790 /* 15791 * Should we use ECN? Note that the current 15792 * default value (SunOS 5.9) of tcp_ecn_permitted 15793 * is 1. The reason for doing this is that there 15794 * are equipments out there that will drop ECN 15795 * enabled IP packets. Setting it to 1 avoids 15796 * compatibility problems. 15797 */ 15798 if (tcp_ecn_permitted == 2) 15799 tcp->tcp_ecn_ok = B_TRUE; 15800 15801 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15802 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 15803 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 15804 if (syn_mp) { 15805 cred_t *cr; 15806 pid_t pid; 15807 15808 /* 15809 * Obtain the credential from the 15810 * thread calling connect(); the credential 15811 * lives on in the second mblk which 15812 * originated from T_CONN_REQ and is echoed 15813 * with the T_BIND_ACK from ip. If none 15814 * can be found, default to the creator 15815 * of the socket. 15816 */ 15817 if (mp->b_cont == NULL || 15818 (cr = DB_CRED(mp->b_cont)) == NULL) { 15819 cr = tcp->tcp_cred; 15820 pid = tcp->tcp_cpid; 15821 } else { 15822 pid = DB_CPID(mp->b_cont); 15823 } 15824 15825 TCP_RECORD_TRACE(tcp, syn_mp, 15826 TCP_TRACE_SEND_PKT); 15827 mblk_setcred(syn_mp, cr); 15828 DB_CPID(syn_mp) = pid; 15829 tcp_send_data(tcp, tcp->tcp_wq, syn_mp); 15830 } 15831 after_syn_sent: 15832 /* 15833 * A trailer mblk indicates a waiting client upstream. 15834 * We complete here the processing begun in 15835 * either tcp_bind() or tcp_connect() by passing 15836 * upstream the reply message they supplied. 15837 */ 15838 mp1 = mp; 15839 mp = mp->b_cont; 15840 freeb(mp1); 15841 if (mp) 15842 break; 15843 return; 15844 case T_ERROR_ACK: 15845 if (tcp->tcp_debug) { 15846 (void) strlog(TCP_MODULE_ID, 0, 1, 15847 SL_TRACE|SL_ERROR, 15848 "tcp_rput_other: case T_ERROR_ACK, " 15849 "ERROR_prim == %d", 15850 tea->ERROR_prim); 15851 } 15852 switch (tea->ERROR_prim) { 15853 case O_T_BIND_REQ: 15854 case T_BIND_REQ: 15855 tcp_bind_failed(tcp, mp, 15856 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15857 ENETUNREACH : EADDRNOTAVAIL)); 15858 return; 15859 case T_UNBIND_REQ: 15860 tcp->tcp_hard_binding = B_FALSE; 15861 tcp->tcp_hard_bound = B_FALSE; 15862 if (mp->b_cont) { 15863 freemsg(mp->b_cont); 15864 mp->b_cont = NULL; 15865 } 15866 if (tcp->tcp_unbind_pending) 15867 tcp->tcp_unbind_pending = 0; 15868 else { 15869 /* From tcp_ip_unbind() - free */ 15870 freemsg(mp); 15871 return; 15872 } 15873 break; 15874 case T_SVR4_OPTMGMT_REQ: 15875 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15876 /* T_OPTMGMT_REQ generated by TCP */ 15877 printf("T_SVR4_OPTMGMT_REQ failed " 15878 "%d/%d - dropped (cnt %d)\n", 15879 tea->TLI_error, tea->UNIX_error, 15880 tcp->tcp_drop_opt_ack_cnt); 15881 freemsg(mp); 15882 tcp->tcp_drop_opt_ack_cnt--; 15883 return; 15884 } 15885 break; 15886 } 15887 if (tea->ERROR_prim == T_SVR4_OPTMGMT_REQ && 15888 tcp->tcp_drop_opt_ack_cnt > 0) { 15889 printf("T_SVR4_OPTMGMT_REQ failed %d/%d " 15890 "- dropped (cnt %d)\n", 15891 tea->TLI_error, tea->UNIX_error, 15892 tcp->tcp_drop_opt_ack_cnt); 15893 freemsg(mp); 15894 tcp->tcp_drop_opt_ack_cnt--; 15895 return; 15896 } 15897 break; 15898 case T_OPTMGMT_ACK: 15899 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15900 /* T_OPTMGMT_REQ generated by TCP */ 15901 freemsg(mp); 15902 tcp->tcp_drop_opt_ack_cnt--; 15903 return; 15904 } 15905 break; 15906 default: 15907 break; 15908 } 15909 break; 15910 case M_CTL: 15911 /* 15912 * ICMP messages. 15913 */ 15914 tcp_icmp_error(tcp, mp); 15915 return; 15916 case M_FLUSH: 15917 if (*rptr & FLUSHR) 15918 flushq(q, FLUSHDATA); 15919 break; 15920 default: 15921 break; 15922 } 15923 /* 15924 * Make sure we set this bit before sending the ACK for 15925 * bind. Otherwise accept could possibly run and free 15926 * this tcp struct. 15927 */ 15928 putnext(q, mp); 15929 } 15930 15931 /* 15932 * Called as the result of a qbufcall or a qtimeout to remedy a failure 15933 * to allocate a T_ordrel_ind in tcp_rsrv(). qenable(q) will make 15934 * tcp_rsrv() try again. 15935 */ 15936 static void 15937 tcp_ordrel_kick(void *arg) 15938 { 15939 conn_t *connp = (conn_t *)arg; 15940 tcp_t *tcp = connp->conn_tcp; 15941 15942 tcp->tcp_ordrelid = 0; 15943 tcp->tcp_timeout = B_FALSE; 15944 if (!TCP_IS_DETACHED(tcp) && tcp->tcp_rq != NULL && 15945 tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 15946 qenable(tcp->tcp_rq); 15947 } 15948 } 15949 15950 /* ARGSUSED */ 15951 static void 15952 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2) 15953 { 15954 conn_t *connp = (conn_t *)arg; 15955 tcp_t *tcp = connp->conn_tcp; 15956 queue_t *q = tcp->tcp_rq; 15957 uint_t thwin; 15958 15959 freeb(mp); 15960 15961 TCP_STAT(tcp_rsrv_calls); 15962 15963 if (TCP_IS_DETACHED(tcp) || q == NULL) { 15964 return; 15965 } 15966 15967 if (tcp->tcp_fused) { 15968 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 15969 15970 ASSERT(tcp->tcp_fused); 15971 ASSERT(peer_tcp != NULL && peer_tcp->tcp_fused); 15972 ASSERT(peer_tcp->tcp_loopback_peer == tcp); 15973 ASSERT(!TCP_IS_DETACHED(tcp)); 15974 ASSERT(tcp->tcp_connp->conn_sqp == 15975 peer_tcp->tcp_connp->conn_sqp); 15976 15977 if (tcp->tcp_rcv_list != NULL) 15978 (void) tcp_rcv_drain(tcp->tcp_rq, tcp); 15979 15980 tcp_clrqfull(peer_tcp); 15981 peer_tcp->tcp_flow_stopped = B_FALSE; 15982 TCP_STAT(tcp_fusion_backenabled); 15983 return; 15984 } 15985 15986 if (canputnext(q)) { 15987 tcp->tcp_rwnd = q->q_hiwat; 15988 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 15989 << tcp->tcp_rcv_ws; 15990 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 15991 /* 15992 * Send back a window update immediately if TCP is above 15993 * ESTABLISHED state and the increase of the rcv window 15994 * that the other side knows is at least 1 MSS after flow 15995 * control is lifted. 15996 */ 15997 if (tcp->tcp_state >= TCPS_ESTABLISHED && 15998 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 15999 tcp_xmit_ctl(NULL, tcp, 16000 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 16001 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 16002 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 16003 } 16004 } 16005 /* Handle a failure to allocate a T_ORDREL_IND here */ 16006 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 16007 ASSERT(tcp->tcp_listener == NULL); 16008 if (tcp->tcp_rcv_list != NULL) { 16009 (void) tcp_rcv_drain(q, tcp); 16010 } 16011 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 16012 mp = mi_tpi_ordrel_ind(); 16013 if (mp) { 16014 tcp->tcp_ordrel_done = B_TRUE; 16015 putnext(q, mp); 16016 if (tcp->tcp_deferred_clean_death) { 16017 /* 16018 * tcp_clean_death was deferred for 16019 * T_ORDREL_IND - do it now 16020 */ 16021 tcp->tcp_deferred_clean_death = B_FALSE; 16022 (void) tcp_clean_death(tcp, 16023 tcp->tcp_client_errno, 22); 16024 } 16025 } else if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 16026 /* 16027 * If there isn't already a timer running 16028 * start one. Use a 4 second 16029 * timer as a fallback since it can't fail. 16030 */ 16031 tcp->tcp_timeout = B_TRUE; 16032 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 16033 MSEC_TO_TICK(4000)); 16034 } 16035 } 16036 } 16037 16038 /* 16039 * The read side service routine is called mostly when we get back-enabled as a 16040 * result of flow control relief. Since we don't actually queue anything in 16041 * TCP, we have no data to send out of here. What we do is clear the receive 16042 * window, and send out a window update. 16043 * This routine is also called to drive an orderly release message upstream 16044 * if the attempt in tcp_rput failed. 16045 */ 16046 static void 16047 tcp_rsrv(queue_t *q) 16048 { 16049 conn_t *connp = Q_TO_CONN(q); 16050 tcp_t *tcp = connp->conn_tcp; 16051 mblk_t *mp; 16052 16053 /* No code does a putq on the read side */ 16054 ASSERT(q->q_first == NULL); 16055 16056 /* Nothing to do for the default queue */ 16057 if (q == tcp_g_q) { 16058 return; 16059 } 16060 16061 mp = allocb(0, BPRI_HI); 16062 if (mp == NULL) { 16063 /* 16064 * We are under memory pressure. Return for now and we 16065 * we will be called again later. 16066 */ 16067 if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 16068 /* 16069 * If there isn't already a timer running 16070 * start one. Use a 4 second 16071 * timer as a fallback since it can't fail. 16072 */ 16073 tcp->tcp_timeout = B_TRUE; 16074 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 16075 MSEC_TO_TICK(4000)); 16076 } 16077 return; 16078 } 16079 CONN_INC_REF(connp); 16080 squeue_enter(connp->conn_sqp, mp, tcp_rsrv_input, connp, 16081 SQTAG_TCP_RSRV); 16082 } 16083 16084 /* 16085 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 16086 * We do not allow the receive window to shrink. After setting rwnd, 16087 * set the flow control hiwat of the stream. 16088 * 16089 * This function is called in 2 cases: 16090 * 16091 * 1) Before data transfer begins, in tcp_accept_comm() for accepting a 16092 * connection (passive open) and in tcp_rput_data() for active connect. 16093 * This is called after tcp_mss_set() when the desired MSS value is known. 16094 * This makes sure that our window size is a mutiple of the other side's 16095 * MSS. 16096 * 2) Handling SO_RCVBUF option. 16097 * 16098 * It is ASSUMED that the requested size is a multiple of the current MSS. 16099 * 16100 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 16101 * user requests so. 16102 */ 16103 static int 16104 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 16105 { 16106 uint32_t mss = tcp->tcp_mss; 16107 uint32_t old_max_rwnd; 16108 uint32_t max_transmittable_rwnd; 16109 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 16110 16111 if (tcp_detached) 16112 old_max_rwnd = tcp->tcp_rwnd; 16113 else 16114 old_max_rwnd = tcp->tcp_rq->q_hiwat; 16115 16116 /* 16117 * Insist on a receive window that is at least 16118 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 16119 * funny TCP interactions of Nagle algorithm, SWS avoidance 16120 * and delayed acknowledgement. 16121 */ 16122 rwnd = MAX(rwnd, tcp_recv_hiwat_minmss * mss); 16123 16124 /* 16125 * If window size info has already been exchanged, TCP should not 16126 * shrink the window. Shrinking window is doable if done carefully. 16127 * We may add that support later. But so far there is not a real 16128 * need to do that. 16129 */ 16130 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 16131 /* MSS may have changed, do a round up again. */ 16132 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 16133 } 16134 16135 /* 16136 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 16137 * can be applied even before the window scale option is decided. 16138 */ 16139 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 16140 if (rwnd > max_transmittable_rwnd) { 16141 rwnd = max_transmittable_rwnd - 16142 (max_transmittable_rwnd % mss); 16143 if (rwnd < mss) 16144 rwnd = max_transmittable_rwnd; 16145 /* 16146 * If we're over the limit we may have to back down tcp_rwnd. 16147 * The increment below won't work for us. So we set all three 16148 * here and the increment below will have no effect. 16149 */ 16150 tcp->tcp_rwnd = old_max_rwnd = rwnd; 16151 } 16152 if (tcp->tcp_localnet) { 16153 tcp->tcp_rack_abs_max = 16154 MIN(tcp_local_dacks_max, rwnd / mss / 2); 16155 } else { 16156 /* 16157 * For a remote host on a different subnet (through a router), 16158 * we ack every other packet to be conforming to RFC1122. 16159 * tcp_deferred_acks_max is default to 2. 16160 */ 16161 tcp->tcp_rack_abs_max = 16162 MIN(tcp_deferred_acks_max, rwnd / mss / 2); 16163 } 16164 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 16165 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 16166 else 16167 tcp->tcp_rack_cur_max = 0; 16168 /* 16169 * Increment the current rwnd by the amount the maximum grew (we 16170 * can not overwrite it since we might be in the middle of a 16171 * connection.) 16172 */ 16173 tcp->tcp_rwnd += rwnd - old_max_rwnd; 16174 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win); 16175 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 16176 tcp->tcp_cwnd_max = rwnd; 16177 16178 if (tcp_detached) 16179 return (rwnd); 16180 /* 16181 * We set the maximum receive window into rq->q_hiwat. 16182 * This is not actually used for flow control. 16183 */ 16184 tcp->tcp_rq->q_hiwat = rwnd; 16185 /* 16186 * Set the Stream head high water mark. This doesn't have to be 16187 * here, since we are simply using default values, but we would 16188 * prefer to choose these values algorithmically, with a likely 16189 * relationship to rwnd. For fused loopback tcp, we double the 16190 * amount of buffer in order to simulate the normal tcp case. 16191 */ 16192 if (tcp->tcp_fused) { 16193 (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd << 1, 16194 tcp_sth_rcv_hiwat)); 16195 } else { 16196 (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd, 16197 tcp_sth_rcv_hiwat)); 16198 } 16199 return (rwnd); 16200 } 16201 16202 /* 16203 * Return SNMP stuff in buffer in mpdata. 16204 */ 16205 static int 16206 tcp_snmp_get(queue_t *q, mblk_t *mpctl) 16207 { 16208 mblk_t *mpdata; 16209 mblk_t *mp_conn_ctl = NULL; 16210 mblk_t *mp_conn_data; 16211 mblk_t *mp6_conn_ctl = NULL; 16212 mblk_t *mp6_conn_data; 16213 mblk_t *mp_conn_tail = NULL; 16214 mblk_t *mp6_conn_tail = NULL; 16215 struct opthdr *optp; 16216 mib2_tcpConnEntry_t tce; 16217 mib2_tcp6ConnEntry_t tce6; 16218 connf_t *connfp; 16219 conn_t *connp; 16220 int i; 16221 boolean_t ispriv; 16222 zoneid_t zoneid; 16223 16224 if (mpctl == NULL || 16225 (mpdata = mpctl->b_cont) == NULL || 16226 (mp_conn_ctl = copymsg(mpctl)) == NULL || 16227 (mp6_conn_ctl = copymsg(mpctl)) == NULL) { 16228 if (mp_conn_ctl != NULL) 16229 freemsg(mp_conn_ctl); 16230 if (mp6_conn_ctl != NULL) 16231 freemsg(mp6_conn_ctl); 16232 return (0); 16233 } 16234 16235 /* build table of connections -- need count in fixed part */ 16236 mp_conn_data = mp_conn_ctl->b_cont; 16237 mp6_conn_data = mp6_conn_ctl->b_cont; 16238 SET_MIB(tcp_mib.tcpRtoAlgorithm, 4); /* vanj */ 16239 SET_MIB(tcp_mib.tcpRtoMin, tcp_rexmit_interval_min); 16240 SET_MIB(tcp_mib.tcpRtoMax, tcp_rexmit_interval_max); 16241 SET_MIB(tcp_mib.tcpMaxConn, -1); 16242 SET_MIB(tcp_mib.tcpCurrEstab, 0); 16243 16244 ispriv = 16245 secpolicy_net_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0; 16246 zoneid = Q_TO_CONN(q)->conn_zoneid; 16247 16248 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 16249 16250 connfp = &ipcl_globalhash_fanout[i]; 16251 16252 connp = NULL; 16253 16254 while ((connp = tcp_get_next_conn(connfp, connp))) { 16255 tcp_t *tcp; 16256 16257 if (connp->conn_zoneid != zoneid) 16258 continue; /* not in this zone */ 16259 16260 tcp = connp->conn_tcp; 16261 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 16262 tcp->tcp_ibsegs = 0; 16263 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 16264 tcp->tcp_obsegs = 0; 16265 16266 tce6.tcp6ConnState = tce.tcpConnState = 16267 tcp_snmp_state(tcp); 16268 if (tce.tcpConnState == MIB2_TCP_established || 16269 tce.tcpConnState == MIB2_TCP_closeWait) 16270 BUMP_MIB(&tcp_mib, tcpCurrEstab); 16271 16272 /* Create a message to report on IPv6 entries */ 16273 if (tcp->tcp_ipversion == IPV6_VERSION) { 16274 tce6.tcp6ConnLocalAddress = tcp->tcp_ip_src_v6; 16275 tce6.tcp6ConnRemAddress = tcp->tcp_remote_v6; 16276 tce6.tcp6ConnLocalPort = ntohs(tcp->tcp_lport); 16277 tce6.tcp6ConnRemPort = ntohs(tcp->tcp_fport); 16278 tce6.tcp6ConnIfIndex = tcp->tcp_bound_if; 16279 /* Don't want just anybody seeing these... */ 16280 if (ispriv) { 16281 tce6.tcp6ConnEntryInfo.ce_snxt = 16282 tcp->tcp_snxt; 16283 tce6.tcp6ConnEntryInfo.ce_suna = 16284 tcp->tcp_suna; 16285 tce6.tcp6ConnEntryInfo.ce_rnxt = 16286 tcp->tcp_rnxt; 16287 tce6.tcp6ConnEntryInfo.ce_rack = 16288 tcp->tcp_rack; 16289 } else { 16290 /* 16291 * Netstat, unfortunately, uses this to 16292 * get send/receive queue sizes. How to fix? 16293 * Why not compute the difference only? 16294 */ 16295 tce6.tcp6ConnEntryInfo.ce_snxt = 16296 tcp->tcp_snxt - tcp->tcp_suna; 16297 tce6.tcp6ConnEntryInfo.ce_suna = 0; 16298 tce6.tcp6ConnEntryInfo.ce_rnxt = 16299 tcp->tcp_rnxt - tcp->tcp_rack; 16300 tce6.tcp6ConnEntryInfo.ce_rack = 0; 16301 } 16302 16303 tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd; 16304 tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 16305 tce6.tcp6ConnEntryInfo.ce_rto = tcp->tcp_rto; 16306 tce6.tcp6ConnEntryInfo.ce_mss = tcp->tcp_mss; 16307 tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state; 16308 (void) snmp_append_data2(mp6_conn_data, &mp6_conn_tail, 16309 (char *)&tce6, sizeof (tce6)); 16310 } 16311 /* 16312 * Create an IPv4 table entry for IPv4 entries and also 16313 * for IPv6 entries which are bound to in6addr_any 16314 * but don't have IPV6_V6ONLY set. 16315 * (i.e. anything an IPv4 peer could connect to) 16316 */ 16317 if (tcp->tcp_ipversion == IPV4_VERSION || 16318 (tcp->tcp_state <= TCPS_LISTEN && 16319 !tcp->tcp_connp->conn_ipv6_v6only && 16320 IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip_src_v6))) { 16321 if (tcp->tcp_ipversion == IPV6_VERSION) { 16322 tce.tcpConnRemAddress = INADDR_ANY; 16323 tce.tcpConnLocalAddress = INADDR_ANY; 16324 } else { 16325 tce.tcpConnRemAddress = 16326 tcp->tcp_remote; 16327 tce.tcpConnLocalAddress = 16328 tcp->tcp_ip_src; 16329 } 16330 tce.tcpConnLocalPort = ntohs(tcp->tcp_lport); 16331 tce.tcpConnRemPort = ntohs(tcp->tcp_fport); 16332 /* Don't want just anybody seeing these... */ 16333 if (ispriv) { 16334 tce.tcpConnEntryInfo.ce_snxt = 16335 tcp->tcp_snxt; 16336 tce.tcpConnEntryInfo.ce_suna = 16337 tcp->tcp_suna; 16338 tce.tcpConnEntryInfo.ce_rnxt = 16339 tcp->tcp_rnxt; 16340 tce.tcpConnEntryInfo.ce_rack = 16341 tcp->tcp_rack; 16342 } else { 16343 /* 16344 * Netstat, unfortunately, uses this to 16345 * get send/receive queue sizes. How 16346 * to fix? 16347 * Why not compute the difference only? 16348 */ 16349 tce.tcpConnEntryInfo.ce_snxt = 16350 tcp->tcp_snxt - tcp->tcp_suna; 16351 tce.tcpConnEntryInfo.ce_suna = 0; 16352 tce.tcpConnEntryInfo.ce_rnxt = 16353 tcp->tcp_rnxt - tcp->tcp_rack; 16354 tce.tcpConnEntryInfo.ce_rack = 0; 16355 } 16356 16357 tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd; 16358 tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 16359 tce.tcpConnEntryInfo.ce_rto = tcp->tcp_rto; 16360 tce.tcpConnEntryInfo.ce_mss = tcp->tcp_mss; 16361 tce.tcpConnEntryInfo.ce_state = 16362 tcp->tcp_state; 16363 (void) snmp_append_data2(mp_conn_data, 16364 &mp_conn_tail, (char *)&tce, sizeof (tce)); 16365 } 16366 } 16367 } 16368 16369 /* fixed length structure for IPv4 and IPv6 counters */ 16370 SET_MIB(tcp_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t)); 16371 SET_MIB(tcp_mib.tcp6ConnTableSize, sizeof (mib2_tcp6ConnEntry_t)); 16372 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 16373 optp->level = MIB2_TCP; 16374 optp->name = 0; 16375 (void) snmp_append_data(mpdata, (char *)&tcp_mib, sizeof (tcp_mib)); 16376 optp->len = msgdsize(mpdata); 16377 qreply(q, mpctl); 16378 16379 /* table of connections... */ 16380 optp = (struct opthdr *)&mp_conn_ctl->b_rptr[ 16381 sizeof (struct T_optmgmt_ack)]; 16382 optp->level = MIB2_TCP; 16383 optp->name = MIB2_TCP_CONN; 16384 optp->len = msgdsize(mp_conn_data); 16385 qreply(q, mp_conn_ctl); 16386 16387 /* table of IPv6 connections... */ 16388 optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[ 16389 sizeof (struct T_optmgmt_ack)]; 16390 optp->level = MIB2_TCP6; 16391 optp->name = MIB2_TCP6_CONN; 16392 optp->len = msgdsize(mp6_conn_data); 16393 qreply(q, mp6_conn_ctl); 16394 return (1); 16395 } 16396 16397 /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests */ 16398 /* ARGSUSED */ 16399 static int 16400 tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 16401 { 16402 mib2_tcpConnEntry_t *tce = (mib2_tcpConnEntry_t *)ptr; 16403 16404 switch (level) { 16405 case MIB2_TCP: 16406 switch (name) { 16407 case 13: 16408 if (tce->tcpConnState != MIB2_TCP_deleteTCB) 16409 return (0); 16410 /* TODO: delete entry defined by tce */ 16411 return (1); 16412 default: 16413 return (0); 16414 } 16415 default: 16416 return (1); 16417 } 16418 } 16419 16420 /* Translate TCP state to MIB2 TCP state. */ 16421 static int 16422 tcp_snmp_state(tcp_t *tcp) 16423 { 16424 if (tcp == NULL) 16425 return (0); 16426 16427 switch (tcp->tcp_state) { 16428 case TCPS_CLOSED: 16429 case TCPS_IDLE: /* RFC1213 doesn't have analogue for IDLE & BOUND */ 16430 case TCPS_BOUND: 16431 return (MIB2_TCP_closed); 16432 case TCPS_LISTEN: 16433 return (MIB2_TCP_listen); 16434 case TCPS_SYN_SENT: 16435 return (MIB2_TCP_synSent); 16436 case TCPS_SYN_RCVD: 16437 return (MIB2_TCP_synReceived); 16438 case TCPS_ESTABLISHED: 16439 return (MIB2_TCP_established); 16440 case TCPS_CLOSE_WAIT: 16441 return (MIB2_TCP_closeWait); 16442 case TCPS_FIN_WAIT_1: 16443 return (MIB2_TCP_finWait1); 16444 case TCPS_CLOSING: 16445 return (MIB2_TCP_closing); 16446 case TCPS_LAST_ACK: 16447 return (MIB2_TCP_lastAck); 16448 case TCPS_FIN_WAIT_2: 16449 return (MIB2_TCP_finWait2); 16450 case TCPS_TIME_WAIT: 16451 return (MIB2_TCP_timeWait); 16452 default: 16453 return (0); 16454 } 16455 } 16456 16457 static char tcp_report_header[] = 16458 "TCP " MI_COL_HDRPAD_STR 16459 "zone dest snxt suna " 16460 "swnd rnxt rack rwnd rto mss w sw rw t " 16461 "recent [lport,fport] state"; 16462 16463 /* 16464 * TCP status report triggered via the Named Dispatch mechanism. 16465 */ 16466 /* ARGSUSED */ 16467 static void 16468 tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream, 16469 cred_t *cr) 16470 { 16471 char hash[10], addrbuf[INET6_ADDRSTRLEN]; 16472 boolean_t ispriv = secpolicy_net_config(cr, B_TRUE) == 0; 16473 char cflag; 16474 in6_addr_t v6dst; 16475 char buf[80]; 16476 uint_t print_len, buf_len; 16477 16478 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16479 if (buf_len <= 0) 16480 return; 16481 16482 if (hashval >= 0) 16483 (void) sprintf(hash, "%03d ", hashval); 16484 else 16485 hash[0] = '\0'; 16486 16487 /* 16488 * Note that we use the remote address in the tcp_b structure. 16489 * This means that it will print out the real destination address, 16490 * not the next hop's address if source routing is used. This 16491 * avoid the confusion on the output because user may not 16492 * know that source routing is used for a connection. 16493 */ 16494 if (tcp->tcp_ipversion == IPV4_VERSION) { 16495 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &v6dst); 16496 } else { 16497 v6dst = tcp->tcp_remote_v6; 16498 } 16499 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16500 /* 16501 * the ispriv checks are so that normal users cannot determine 16502 * sequence number information using NDD. 16503 */ 16504 16505 if (TCP_IS_DETACHED(tcp)) 16506 cflag = '*'; 16507 else 16508 cflag = ' '; 16509 print_len = snprintf((char *)mp->b_wptr, buf_len, 16510 "%s " MI_COL_PTRFMT_STR "%d %s %08x %08x %010d %08x %08x " 16511 "%010d %05ld %05d %1d %02d %02d %1d %08x %s%c\n", 16512 hash, 16513 (void *)tcp, 16514 tcp->tcp_connp->conn_zoneid, 16515 addrbuf, 16516 (ispriv) ? tcp->tcp_snxt : 0, 16517 (ispriv) ? tcp->tcp_suna : 0, 16518 tcp->tcp_swnd, 16519 (ispriv) ? tcp->tcp_rnxt : 0, 16520 (ispriv) ? tcp->tcp_rack : 0, 16521 tcp->tcp_rwnd, 16522 tcp->tcp_rto, 16523 tcp->tcp_mss, 16524 tcp->tcp_snd_ws_ok, 16525 tcp->tcp_snd_ws, 16526 tcp->tcp_rcv_ws, 16527 tcp->tcp_snd_ts_ok, 16528 tcp->tcp_ts_recent, 16529 tcp_display(tcp, buf, DISP_PORT_ONLY), cflag); 16530 if (print_len < buf_len) { 16531 ((mblk_t *)mp)->b_wptr += print_len; 16532 } else { 16533 ((mblk_t *)mp)->b_wptr += buf_len; 16534 } 16535 } 16536 16537 /* 16538 * TCP status report (for listeners only) triggered via the Named Dispatch 16539 * mechanism. 16540 */ 16541 /* ARGSUSED */ 16542 static void 16543 tcp_report_listener(mblk_t *mp, tcp_t *tcp, int hashval) 16544 { 16545 char addrbuf[INET6_ADDRSTRLEN]; 16546 in6_addr_t v6dst; 16547 uint_t print_len, buf_len; 16548 16549 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16550 if (buf_len <= 0) 16551 return; 16552 16553 if (tcp->tcp_ipversion == IPV4_VERSION) { 16554 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &v6dst); 16555 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16556 } else { 16557 (void) inet_ntop(AF_INET6, &tcp->tcp_ip6h->ip6_src, 16558 addrbuf, sizeof (addrbuf)); 16559 } 16560 print_len = snprintf((char *)mp->b_wptr, buf_len, 16561 "%03d " 16562 MI_COL_PTRFMT_STR 16563 "%d %s %05u %08u %d/%d/%d%c\n", 16564 hashval, (void *)tcp, 16565 tcp->tcp_connp->conn_zoneid, 16566 addrbuf, 16567 (uint_t)BE16_TO_U16(tcp->tcp_tcph->th_lport), 16568 tcp->tcp_conn_req_seqnum, 16569 tcp->tcp_conn_req_cnt_q0, tcp->tcp_conn_req_cnt_q, 16570 tcp->tcp_conn_req_max, 16571 tcp->tcp_syn_defense ? '*' : ' '); 16572 if (print_len < buf_len) { 16573 ((mblk_t *)mp)->b_wptr += print_len; 16574 } else { 16575 ((mblk_t *)mp)->b_wptr += buf_len; 16576 } 16577 } 16578 16579 /* TCP status report triggered via the Named Dispatch mechanism. */ 16580 /* ARGSUSED */ 16581 static int 16582 tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16583 { 16584 tcp_t *tcp; 16585 int i; 16586 conn_t *connp; 16587 connf_t *connfp; 16588 zoneid_t zoneid; 16589 16590 /* 16591 * Because of the ndd constraint, at most we can have 64K buffer 16592 * to put in all TCP info. So to be more efficient, just 16593 * allocate a 64K buffer here, assuming we need that large buffer. 16594 * This may be a problem as any user can read tcp_status. Therefore 16595 * we limit the rate of doing this using tcp_ndd_get_info_interval. 16596 * This should be OK as normal users should not do this too often. 16597 */ 16598 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16599 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16600 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16601 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16602 return (0); 16603 } 16604 } 16605 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16606 /* The following may work even if we cannot get a large buf. */ 16607 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16608 return (0); 16609 } 16610 16611 (void) mi_mpprintf(mp, "%s", tcp_report_header); 16612 16613 zoneid = Q_TO_CONN(q)->conn_zoneid; 16614 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 16615 16616 connfp = &ipcl_globalhash_fanout[i]; 16617 16618 connp = NULL; 16619 16620 while ((connp = tcp_get_next_conn(connfp, connp))) { 16621 tcp = connp->conn_tcp; 16622 if (zoneid != GLOBAL_ZONEID && 16623 zoneid != connp->conn_zoneid) 16624 continue; 16625 tcp_report_item(mp->b_cont, tcp, -1, tcp, 16626 cr); 16627 } 16628 16629 } 16630 16631 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16632 return (0); 16633 } 16634 16635 /* TCP status report triggered via the Named Dispatch mechanism. */ 16636 /* ARGSUSED */ 16637 static int 16638 tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16639 { 16640 tf_t *tbf; 16641 tcp_t *tcp; 16642 int i; 16643 zoneid_t zoneid; 16644 16645 /* Refer to comments in tcp_status_report(). */ 16646 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16647 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16648 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16649 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16650 return (0); 16651 } 16652 } 16653 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16654 /* The following may work even if we cannot get a large buf. */ 16655 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16656 return (0); 16657 } 16658 16659 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16660 16661 zoneid = Q_TO_CONN(q)->conn_zoneid; 16662 16663 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 16664 tbf = &tcp_bind_fanout[i]; 16665 mutex_enter(&tbf->tf_lock); 16666 for (tcp = tbf->tf_tcp; tcp != NULL; 16667 tcp = tcp->tcp_bind_hash) { 16668 if (zoneid != GLOBAL_ZONEID && 16669 zoneid != tcp->tcp_connp->conn_zoneid) 16670 continue; 16671 CONN_INC_REF(tcp->tcp_connp); 16672 tcp_report_item(mp->b_cont, tcp, i, 16673 Q_TO_TCP(q), cr); 16674 CONN_DEC_REF(tcp->tcp_connp); 16675 } 16676 mutex_exit(&tbf->tf_lock); 16677 } 16678 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16679 return (0); 16680 } 16681 16682 /* TCP status report triggered via the Named Dispatch mechanism. */ 16683 /* ARGSUSED */ 16684 static int 16685 tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16686 { 16687 connf_t *connfp; 16688 conn_t *connp; 16689 tcp_t *tcp; 16690 int i; 16691 zoneid_t zoneid; 16692 16693 /* Refer to comments in tcp_status_report(). */ 16694 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16695 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16696 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16697 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16698 return (0); 16699 } 16700 } 16701 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16702 /* The following may work even if we cannot get a large buf. */ 16703 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16704 return (0); 16705 } 16706 16707 (void) mi_mpprintf(mp, 16708 " TCP " MI_COL_HDRPAD_STR 16709 "zone IP addr port seqnum backlog (q0/q/max)"); 16710 16711 zoneid = Q_TO_CONN(q)->conn_zoneid; 16712 16713 for (i = 0; i < ipcl_bind_fanout_size; i++) { 16714 connfp = &ipcl_bind_fanout[i]; 16715 connp = NULL; 16716 while ((connp = tcp_get_next_conn(connfp, connp))) { 16717 tcp = connp->conn_tcp; 16718 if (zoneid != GLOBAL_ZONEID && 16719 zoneid != connp->conn_zoneid) 16720 continue; 16721 tcp_report_listener(mp->b_cont, tcp, i); 16722 } 16723 } 16724 16725 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16726 return (0); 16727 } 16728 16729 /* TCP status report triggered via the Named Dispatch mechanism. */ 16730 /* ARGSUSED */ 16731 static int 16732 tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16733 { 16734 connf_t *connfp; 16735 conn_t *connp; 16736 tcp_t *tcp; 16737 int i; 16738 zoneid_t zoneid; 16739 16740 /* Refer to comments in tcp_status_report(). */ 16741 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16742 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16743 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16744 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16745 return (0); 16746 } 16747 } 16748 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16749 /* The following may work even if we cannot get a large buf. */ 16750 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16751 return (0); 16752 } 16753 16754 (void) mi_mpprintf(mp, "tcp_conn_hash_size = %d", 16755 ipcl_conn_fanout_size); 16756 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16757 16758 zoneid = Q_TO_CONN(q)->conn_zoneid; 16759 16760 for (i = 0; i < ipcl_conn_fanout_size; i++) { 16761 connfp = &ipcl_conn_fanout[i]; 16762 connp = NULL; 16763 while ((connp = tcp_get_next_conn(connfp, connp))) { 16764 tcp = connp->conn_tcp; 16765 if (zoneid != GLOBAL_ZONEID && 16766 zoneid != connp->conn_zoneid) 16767 continue; 16768 tcp_report_item(mp->b_cont, tcp, i, 16769 Q_TO_TCP(q), cr); 16770 } 16771 } 16772 16773 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16774 return (0); 16775 } 16776 16777 /* TCP status report triggered via the Named Dispatch mechanism. */ 16778 /* ARGSUSED */ 16779 static int 16780 tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16781 { 16782 tf_t *tf; 16783 tcp_t *tcp; 16784 int i; 16785 zoneid_t zoneid; 16786 16787 /* Refer to comments in tcp_status_report(). */ 16788 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16789 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16790 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16791 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16792 return (0); 16793 } 16794 } 16795 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16796 /* The following may work even if we cannot get a large buf. */ 16797 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16798 return (0); 16799 } 16800 16801 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16802 16803 zoneid = Q_TO_CONN(q)->conn_zoneid; 16804 16805 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 16806 tf = &tcp_acceptor_fanout[i]; 16807 mutex_enter(&tf->tf_lock); 16808 for (tcp = tf->tf_tcp; tcp != NULL; 16809 tcp = tcp->tcp_acceptor_hash) { 16810 if (zoneid != GLOBAL_ZONEID && 16811 zoneid != tcp->tcp_connp->conn_zoneid) 16812 continue; 16813 tcp_report_item(mp->b_cont, tcp, i, 16814 Q_TO_TCP(q), cr); 16815 } 16816 mutex_exit(&tf->tf_lock); 16817 } 16818 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16819 return (0); 16820 } 16821 16822 /* 16823 * tcp_timer is the timer service routine. It handles the retransmission, 16824 * FIN_WAIT_2 flush, and zero window probe timeout events. It figures out 16825 * from the state of the tcp instance what kind of action needs to be done 16826 * at the time it is called. 16827 */ 16828 static void 16829 tcp_timer(void *arg) 16830 { 16831 mblk_t *mp; 16832 clock_t first_threshold; 16833 clock_t second_threshold; 16834 clock_t ms; 16835 uint32_t mss; 16836 conn_t *connp = (conn_t *)arg; 16837 tcp_t *tcp = connp->conn_tcp; 16838 16839 tcp->tcp_timer_tid = 0; 16840 16841 if (tcp->tcp_fused) 16842 return; 16843 16844 first_threshold = tcp->tcp_first_timer_threshold; 16845 second_threshold = tcp->tcp_second_timer_threshold; 16846 switch (tcp->tcp_state) { 16847 case TCPS_IDLE: 16848 case TCPS_BOUND: 16849 case TCPS_LISTEN: 16850 return; 16851 case TCPS_SYN_RCVD: { 16852 tcp_t *listener = tcp->tcp_listener; 16853 16854 if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) { 16855 ASSERT(tcp->tcp_rq == listener->tcp_rq); 16856 /* it's our first timeout */ 16857 tcp->tcp_syn_rcvd_timeout = 1; 16858 mutex_enter(&listener->tcp_eager_lock); 16859 listener->tcp_syn_rcvd_timeout++; 16860 if (!listener->tcp_syn_defense && 16861 (listener->tcp_syn_rcvd_timeout > 16862 (tcp_conn_req_max_q0 >> 2)) && 16863 (tcp_conn_req_max_q0 > 200)) { 16864 /* We may be under attack. Put on a defense. */ 16865 listener->tcp_syn_defense = B_TRUE; 16866 cmn_err(CE_WARN, "High TCP connect timeout " 16867 "rate! System (port %d) may be under a " 16868 "SYN flood attack!", 16869 BE16_TO_U16(listener->tcp_tcph->th_lport)); 16870 16871 listener->tcp_ip_addr_cache = kmem_zalloc( 16872 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t), 16873 KM_NOSLEEP); 16874 } 16875 mutex_exit(&listener->tcp_eager_lock); 16876 } 16877 } 16878 /* FALLTHRU */ 16879 case TCPS_SYN_SENT: 16880 first_threshold = tcp->tcp_first_ctimer_threshold; 16881 second_threshold = tcp->tcp_second_ctimer_threshold; 16882 break; 16883 case TCPS_ESTABLISHED: 16884 case TCPS_FIN_WAIT_1: 16885 case TCPS_CLOSING: 16886 case TCPS_CLOSE_WAIT: 16887 case TCPS_LAST_ACK: 16888 /* If we have data to rexmit */ 16889 if (tcp->tcp_suna != tcp->tcp_snxt) { 16890 clock_t time_to_wait; 16891 16892 BUMP_MIB(&tcp_mib, tcpTimRetrans); 16893 if (!tcp->tcp_xmit_head) 16894 break; 16895 time_to_wait = lbolt - 16896 (clock_t)tcp->tcp_xmit_head->b_prev; 16897 time_to_wait = tcp->tcp_rto - 16898 TICK_TO_MSEC(time_to_wait); 16899 /* 16900 * If the timer fires too early, 1 clock tick earlier, 16901 * restart the timer. 16902 */ 16903 if (time_to_wait > msec_per_tick) { 16904 TCP_STAT(tcp_timer_fire_early); 16905 TCP_TIMER_RESTART(tcp, time_to_wait); 16906 return; 16907 } 16908 /* 16909 * When we probe zero windows, we force the swnd open. 16910 * If our peer acks with a closed window swnd will be 16911 * set to zero by tcp_rput(). As long as we are 16912 * receiving acks tcp_rput will 16913 * reset 'tcp_ms_we_have_waited' so as not to trip the 16914 * first and second interval actions. NOTE: the timer 16915 * interval is allowed to continue its exponential 16916 * backoff. 16917 */ 16918 if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) { 16919 if (tcp->tcp_debug) { 16920 (void) strlog(TCP_MODULE_ID, 0, 1, 16921 SL_TRACE, "tcp_timer: zero win"); 16922 } 16923 } else { 16924 /* 16925 * After retransmission, we need to do 16926 * slow start. Set the ssthresh to one 16927 * half of current effective window and 16928 * cwnd to one MSS. Also reset 16929 * tcp_cwnd_cnt. 16930 * 16931 * Note that if tcp_ssthresh is reduced because 16932 * of ECN, do not reduce it again unless it is 16933 * already one window of data away (tcp_cwr 16934 * should then be cleared) or this is a 16935 * timeout for a retransmitted segment. 16936 */ 16937 uint32_t npkt; 16938 16939 if (!tcp->tcp_cwr || tcp->tcp_rexmit) { 16940 npkt = ((tcp->tcp_timer_backoff ? 16941 tcp->tcp_cwnd_ssthresh : 16942 tcp->tcp_snxt - 16943 tcp->tcp_suna) >> 1) / tcp->tcp_mss; 16944 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 16945 tcp->tcp_mss; 16946 } 16947 tcp->tcp_cwnd = tcp->tcp_mss; 16948 tcp->tcp_cwnd_cnt = 0; 16949 if (tcp->tcp_ecn_ok) { 16950 tcp->tcp_cwr = B_TRUE; 16951 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 16952 tcp->tcp_ecn_cwr_sent = B_FALSE; 16953 } 16954 } 16955 break; 16956 } 16957 /* 16958 * We have something to send yet we cannot send. The 16959 * reason can be: 16960 * 16961 * 1. Zero send window: we need to do zero window probe. 16962 * 2. Zero cwnd: because of ECN, we need to "clock out 16963 * segments. 16964 * 3. SWS avoidance: receiver may have shrunk window, 16965 * reset our knowledge. 16966 * 16967 * Note that condition 2 can happen with either 1 or 16968 * 3. But 1 and 3 are exclusive. 16969 */ 16970 if (tcp->tcp_unsent != 0) { 16971 if (tcp->tcp_cwnd == 0) { 16972 /* 16973 * Set tcp_cwnd to 1 MSS so that a 16974 * new segment can be sent out. We 16975 * are "clocking out" new data when 16976 * the network is really congested. 16977 */ 16978 ASSERT(tcp->tcp_ecn_ok); 16979 tcp->tcp_cwnd = tcp->tcp_mss; 16980 } 16981 if (tcp->tcp_swnd == 0) { 16982 /* Extend window for zero window probe */ 16983 tcp->tcp_swnd++; 16984 tcp->tcp_zero_win_probe = B_TRUE; 16985 BUMP_MIB(&tcp_mib, tcpOutWinProbe); 16986 } else { 16987 /* 16988 * Handle timeout from sender SWS avoidance. 16989 * Reset our knowledge of the max send window 16990 * since the receiver might have reduced its 16991 * receive buffer. Avoid setting tcp_max_swnd 16992 * to one since that will essentially disable 16993 * the SWS checks. 16994 * 16995 * Note that since we don't have a SWS 16996 * state variable, if the timeout is set 16997 * for ECN but not for SWS, this 16998 * code will also be executed. This is 16999 * fine as tcp_max_swnd is updated 17000 * constantly and it will not affect 17001 * anything. 17002 */ 17003 tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2); 17004 } 17005 tcp_wput_data(tcp, NULL, B_FALSE); 17006 return; 17007 } 17008 /* Is there a FIN that needs to be to re retransmitted? */ 17009 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 17010 !tcp->tcp_fin_acked) 17011 break; 17012 /* Nothing to do, return without restarting timer. */ 17013 TCP_STAT(tcp_timer_fire_miss); 17014 return; 17015 case TCPS_FIN_WAIT_2: 17016 /* 17017 * User closed the TCP endpoint and peer ACK'ed our FIN. 17018 * We waited some time for for peer's FIN, but it hasn't 17019 * arrived. We flush the connection now to avoid 17020 * case where the peer has rebooted. 17021 */ 17022 if (TCP_IS_DETACHED(tcp)) { 17023 (void) tcp_clean_death(tcp, 0, 23); 17024 } else { 17025 TCP_TIMER_RESTART(tcp, tcp_fin_wait_2_flush_interval); 17026 } 17027 return; 17028 case TCPS_TIME_WAIT: 17029 (void) tcp_clean_death(tcp, 0, 24); 17030 return; 17031 default: 17032 if (tcp->tcp_debug) { 17033 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 17034 "tcp_timer: strange state (%d) %s", 17035 tcp->tcp_state, tcp_display(tcp, NULL, 17036 DISP_PORT_ONLY)); 17037 } 17038 return; 17039 } 17040 if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) { 17041 /* 17042 * For zero window probe, we need to send indefinitely, 17043 * unless we have not heard from the other side for some 17044 * time... 17045 */ 17046 if ((tcp->tcp_zero_win_probe == 0) || 17047 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) > 17048 second_threshold)) { 17049 BUMP_MIB(&tcp_mib, tcpTimRetransDrop); 17050 /* 17051 * If TCP is in SYN_RCVD state, send back a 17052 * RST|ACK as BSD does. Note that tcp_zero_win_probe 17053 * should be zero in TCPS_SYN_RCVD state. 17054 */ 17055 if (tcp->tcp_state == TCPS_SYN_RCVD) { 17056 tcp_xmit_ctl("tcp_timer: RST sent on timeout " 17057 "in SYN_RCVD", 17058 tcp, tcp->tcp_snxt, 17059 tcp->tcp_rnxt, TH_RST | TH_ACK); 17060 } 17061 (void) tcp_clean_death(tcp, 17062 tcp->tcp_client_errno ? 17063 tcp->tcp_client_errno : ETIMEDOUT, 25); 17064 return; 17065 } else { 17066 /* 17067 * Set tcp_ms_we_have_waited to second_threshold 17068 * so that in next timeout, we will do the above 17069 * check (lbolt - tcp_last_recv_time). This is 17070 * also to avoid overflow. 17071 * 17072 * We don't need to decrement tcp_timer_backoff 17073 * to avoid overflow because it will be decremented 17074 * later if new timeout value is greater than 17075 * tcp_rexmit_interval_max. In the case when 17076 * tcp_rexmit_interval_max is greater than 17077 * second_threshold, it means that we will wait 17078 * longer than second_threshold to send the next 17079 * window probe. 17080 */ 17081 tcp->tcp_ms_we_have_waited = second_threshold; 17082 } 17083 } else if (ms > first_threshold) { 17084 if (tcp->tcp_snd_zcopy_aware && (!tcp->tcp_xmit_zc_clean) && 17085 tcp->tcp_xmit_head != NULL) { 17086 tcp->tcp_xmit_head = 17087 tcp_zcopy_backoff(tcp, tcp->tcp_xmit_head, 1); 17088 } 17089 /* 17090 * We have been retransmitting for too long... The RTT 17091 * we calculated is probably incorrect. Reinitialize it. 17092 * Need to compensate for 0 tcp_rtt_sa. Reset 17093 * tcp_rtt_update so that we won't accidentally cache a 17094 * bad value. But only do this if this is not a zero 17095 * window probe. 17096 */ 17097 if (tcp->tcp_rtt_sa != 0 && tcp->tcp_zero_win_probe == 0) { 17098 tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) + 17099 (tcp->tcp_rtt_sa >> 5); 17100 tcp->tcp_rtt_sa = 0; 17101 tcp_ip_notify(tcp); 17102 tcp->tcp_rtt_update = 0; 17103 } 17104 } 17105 tcp->tcp_timer_backoff++; 17106 if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 17107 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) < 17108 tcp_rexmit_interval_min) { 17109 /* 17110 * This means the original RTO is tcp_rexmit_interval_min. 17111 * So we will use tcp_rexmit_interval_min as the RTO value 17112 * and do the backoff. 17113 */ 17114 ms = tcp_rexmit_interval_min << tcp->tcp_timer_backoff; 17115 } else { 17116 ms <<= tcp->tcp_timer_backoff; 17117 } 17118 if (ms > tcp_rexmit_interval_max) { 17119 ms = tcp_rexmit_interval_max; 17120 /* 17121 * ms is at max, decrement tcp_timer_backoff to avoid 17122 * overflow. 17123 */ 17124 tcp->tcp_timer_backoff--; 17125 } 17126 tcp->tcp_ms_we_have_waited += ms; 17127 if (tcp->tcp_zero_win_probe == 0) { 17128 tcp->tcp_rto = ms; 17129 } 17130 TCP_TIMER_RESTART(tcp, ms); 17131 /* 17132 * This is after a timeout and tcp_rto is backed off. Set 17133 * tcp_set_timer to 1 so that next time RTO is updated, we will 17134 * restart the timer with a correct value. 17135 */ 17136 tcp->tcp_set_timer = 1; 17137 mss = tcp->tcp_snxt - tcp->tcp_suna; 17138 if (mss > tcp->tcp_mss) 17139 mss = tcp->tcp_mss; 17140 if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0) 17141 mss = tcp->tcp_swnd; 17142 17143 if ((mp = tcp->tcp_xmit_head) != NULL) 17144 mp->b_prev = (mblk_t *)lbolt; 17145 mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss, 17146 B_TRUE); 17147 17148 /* 17149 * When slow start after retransmission begins, start with 17150 * this seq no. tcp_rexmit_max marks the end of special slow 17151 * start phase. tcp_snd_burst controls how many segments 17152 * can be sent because of an ack. 17153 */ 17154 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 17155 tcp->tcp_snd_burst = TCP_CWND_SS; 17156 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 17157 (tcp->tcp_unsent == 0)) { 17158 tcp->tcp_rexmit_max = tcp->tcp_fss; 17159 } else { 17160 tcp->tcp_rexmit_max = tcp->tcp_snxt; 17161 } 17162 tcp->tcp_rexmit = B_TRUE; 17163 tcp->tcp_dupack_cnt = 0; 17164 17165 /* 17166 * Remove all rexmit SACK blk to start from fresh. 17167 */ 17168 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 17169 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 17170 tcp->tcp_num_notsack_blk = 0; 17171 tcp->tcp_cnt_notsack_list = 0; 17172 } 17173 if (mp == NULL) { 17174 return; 17175 } 17176 /* Attach credentials to retransmitted initial SYNs. */ 17177 if (tcp->tcp_state == TCPS_SYN_SENT) { 17178 mblk_setcred(mp, tcp->tcp_cred); 17179 DB_CPID(mp) = tcp->tcp_cpid; 17180 } 17181 17182 tcp->tcp_csuna = tcp->tcp_snxt; 17183 BUMP_MIB(&tcp_mib, tcpRetransSegs); 17184 UPDATE_MIB(&tcp_mib, tcpRetransBytes, mss); 17185 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 17186 tcp_send_data(tcp, tcp->tcp_wq, mp); 17187 17188 } 17189 17190 /* tcp_unbind is called by tcp_wput_proto to handle T_UNBIND_REQ messages. */ 17191 static void 17192 tcp_unbind(tcp_t *tcp, mblk_t *mp) 17193 { 17194 conn_t *connp; 17195 17196 switch (tcp->tcp_state) { 17197 case TCPS_BOUND: 17198 case TCPS_LISTEN: 17199 break; 17200 default: 17201 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 17202 return; 17203 } 17204 17205 /* 17206 * Need to clean up all the eagers since after the unbind, segments 17207 * will no longer be delivered to this listener stream. 17208 */ 17209 mutex_enter(&tcp->tcp_eager_lock); 17210 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 17211 tcp_eager_cleanup(tcp, 0); 17212 } 17213 mutex_exit(&tcp->tcp_eager_lock); 17214 17215 if (tcp->tcp_ipversion == IPV4_VERSION) { 17216 tcp->tcp_ipha->ipha_src = 0; 17217 } else { 17218 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 17219 } 17220 V6_SET_ZERO(tcp->tcp_ip_src_v6); 17221 bzero(tcp->tcp_tcph->th_lport, sizeof (tcp->tcp_tcph->th_lport)); 17222 tcp_bind_hash_remove(tcp); 17223 tcp->tcp_state = TCPS_IDLE; 17224 tcp->tcp_mdt = B_FALSE; 17225 /* Send M_FLUSH according to TPI */ 17226 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 17227 connp = tcp->tcp_connp; 17228 connp->conn_mdt_ok = B_FALSE; 17229 ipcl_hash_remove(connp); 17230 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 17231 mp = mi_tpi_ok_ack_alloc(mp); 17232 putnext(tcp->tcp_rq, mp); 17233 } 17234 17235 /* 17236 * Don't let port fall into the privileged range. 17237 * Since the extra privileged ports can be arbitrary we also 17238 * ensure that we exclude those from consideration. 17239 * tcp_g_epriv_ports is not sorted thus we loop over it until 17240 * there are no changes. 17241 * 17242 * Note: No locks are held when inspecting tcp_g_*epriv_ports 17243 * but instead the code relies on: 17244 * - the fact that the address of the array and its size never changes 17245 * - the atomic assignment of the elements of the array 17246 */ 17247 static in_port_t 17248 tcp_update_next_port(in_port_t port, boolean_t random) 17249 { 17250 int i; 17251 17252 if (random && tcp_random_anon_port != 0) { 17253 (void) random_get_pseudo_bytes((uint8_t *)&port, 17254 sizeof (in_port_t)); 17255 /* 17256 * Unless changed by a sys admin, the smallest anon port 17257 * is 32768 and the largest anon port is 65535. It is 17258 * very likely (50%) for the random port to be smaller 17259 * than the smallest anon port. When that happens, 17260 * add port % (anon port range) to the smallest anon 17261 * port to get the random port. It should fall into the 17262 * valid anon port range. 17263 */ 17264 if (port < tcp_smallest_anon_port) { 17265 port = tcp_smallest_anon_port + 17266 port % (tcp_largest_anon_port - 17267 tcp_smallest_anon_port); 17268 } 17269 } 17270 17271 retry: 17272 if (port < tcp_smallest_anon_port || port > tcp_largest_anon_port) 17273 port = (in_port_t)tcp_smallest_anon_port; 17274 17275 if (port < tcp_smallest_nonpriv_port) 17276 port = (in_port_t)tcp_smallest_nonpriv_port; 17277 17278 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 17279 if (port == tcp_g_epriv_ports[i]) { 17280 port++; 17281 /* 17282 * Make sure whether the port is in the 17283 * valid range. 17284 * 17285 * XXX Note that if tcp_g_epriv_ports contains 17286 * all the anonymous ports this will be an 17287 * infinite loop. 17288 */ 17289 goto retry; 17290 } 17291 } 17292 return (port); 17293 } 17294 17295 /* 17296 * Return the next anonymous port in the priviledged port range for 17297 * bind checking. It starts at IPPORT_RESERVED - 1 and goes 17298 * downwards. This is the same behavior as documented in the userland 17299 * library call rresvport(3N). 17300 */ 17301 static in_port_t 17302 tcp_get_next_priv_port(void) 17303 { 17304 static in_port_t next_priv_port = IPPORT_RESERVED - 1; 17305 17306 if (next_priv_port < tcp_min_anonpriv_port) { 17307 next_priv_port = IPPORT_RESERVED - 1; 17308 } 17309 return (next_priv_port--); 17310 } 17311 17312 /* The write side r/w procedure. */ 17313 17314 #if CCS_STATS 17315 struct { 17316 struct { 17317 int64_t count, bytes; 17318 } tot, hit; 17319 } wrw_stats; 17320 #endif 17321 17322 /* 17323 * Call by tcp_wput() to handle all non data, except M_PROTO and M_PCPROTO, 17324 * messages. 17325 */ 17326 /* ARGSUSED */ 17327 static void 17328 tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2) 17329 { 17330 conn_t *connp = (conn_t *)arg; 17331 tcp_t *tcp = connp->conn_tcp; 17332 queue_t *q = tcp->tcp_wq; 17333 17334 ASSERT(DB_TYPE(mp) != M_IOCTL); 17335 /* 17336 * TCP is D_MP and qprocsoff() is done towards the end of the tcp_close. 17337 * Once the close starts, streamhead and sockfs will not let any data 17338 * packets come down (close ensures that there are no threads using the 17339 * queue and no new threads will come down) but since qprocsoff() 17340 * hasn't happened yet, a M_FLUSH or some non data message might 17341 * get reflected back (in response to our own FLUSHRW) and get 17342 * processed after tcp_close() is done. The conn would still be valid 17343 * because a ref would have added but we need to check the state 17344 * before actually processing the packet. 17345 */ 17346 if (TCP_IS_DETACHED(tcp) || (tcp->tcp_state == TCPS_CLOSED)) { 17347 freemsg(mp); 17348 return; 17349 } 17350 17351 switch (DB_TYPE(mp)) { 17352 case M_IOCDATA: 17353 tcp_wput_iocdata(tcp, mp); 17354 break; 17355 case M_FLUSH: 17356 tcp_wput_flush(tcp, mp); 17357 break; 17358 default: 17359 CALL_IP_WPUT(connp, q, mp); 17360 break; 17361 } 17362 } 17363 17364 /* 17365 * Write side put procedure for TCP module instance. 17366 * TCP as a module is only used for MIB browsers that push TCP over IP or 17367 * ARP. The only supported primitives are T_SVR4_OPTMGMT_REQ and 17368 * T_OPTMGMT_REQ. M_FLUSH messages are only passed downstream; we don't flush 17369 * our queues as we never enqueue messages there. All ioctls are NAKed and 17370 * everything else is freed. 17371 */ 17372 static void 17373 tcp_wput_mod(queue_t *q, mblk_t *mp) 17374 { 17375 switch (DB_TYPE(mp)) { 17376 case M_PROTO: 17377 case M_PCPROTO: 17378 if ((MBLKL(mp) >= sizeof (t_scalar_t)) && 17379 ((((union T_primitives *)mp->b_rptr)->type == 17380 T_SVR4_OPTMGMT_REQ) || 17381 (((union T_primitives *)mp->b_rptr)->type == 17382 T_OPTMGMT_REQ))) { 17383 /* 17384 * This is the only TPI primitive supported. Its 17385 * handling does not require tcp_t, but it does require 17386 * conn_t to check permissions. 17387 */ 17388 cred_t *cr = DB_CREDDEF(mp, Q_TO_CONN(q)->conn_cred); 17389 if (!snmpcom_req(q, mp, tcp_snmp_set, 17390 tcp_snmp_get, cr)) { 17391 freemsg(mp); 17392 return; 17393 } 17394 } else if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, ENOTSUP)) 17395 != NULL) 17396 qreply(q, mp); 17397 break; 17398 case M_FLUSH: 17399 putnext(q, mp); 17400 break; 17401 case M_IOCTL: 17402 miocnak(q, mp, 0, ENOTSUP); 17403 break; 17404 default: 17405 freemsg(mp); 17406 break; 17407 } 17408 } 17409 17410 /* 17411 * The TCP fast path write put procedure. 17412 * NOTE: the logic of the fast path is duplicated from tcp_wput_data() 17413 */ 17414 /* ARGSUSED */ 17415 static void 17416 tcp_output(void *arg, mblk_t *mp, void *arg2) 17417 { 17418 int len; 17419 int hdrlen; 17420 int plen; 17421 mblk_t *mp1; 17422 uchar_t *rptr; 17423 uint32_t snxt; 17424 tcph_t *tcph; 17425 struct datab *db; 17426 uint32_t suna; 17427 uint32_t mss; 17428 ipaddr_t *dst; 17429 ipaddr_t *src; 17430 uint32_t sum; 17431 int usable; 17432 conn_t *connp = (conn_t *)arg; 17433 tcp_t *tcp = connp->conn_tcp; 17434 17435 /* 17436 * Try and ASSERT the minimum possible references on the 17437 * conn early enough. Since we are executing on write side, 17438 * the connection is obviously not detached and that means 17439 * there is a ref each for TCP and IP. Since we are behind 17440 * the squeue, the minimum references needed are 3. If the 17441 * conn is in classifier hash list, there should be an 17442 * extra ref for that (we check both the possibilities). 17443 */ 17444 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17445 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17446 17447 /* Bypass tcp protocol for fused tcp loopback */ 17448 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp)) 17449 return; 17450 17451 mss = tcp->tcp_mss; 17452 if (tcp->tcp_xmit_zc_clean) 17453 mp = tcp_zcopy_backoff(tcp, mp, 0); 17454 17455 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 17456 len = (int)(mp->b_wptr - mp->b_rptr); 17457 17458 /* 17459 * Criteria for fast path: 17460 * 17461 * 1. no unsent data 17462 * 2. single mblk in request 17463 * 3. connection established 17464 * 4. data in mblk 17465 * 5. len <= mss 17466 * 6. no tcp_valid bits 17467 */ 17468 if ((tcp->tcp_unsent != 0) || 17469 (tcp->tcp_cork) || 17470 (mp->b_cont != NULL) || 17471 (tcp->tcp_state != TCPS_ESTABLISHED) || 17472 (len == 0) || 17473 (len > mss) || 17474 (tcp->tcp_valid_bits != 0)) { 17475 tcp_wput_data(tcp, mp, B_FALSE); 17476 return; 17477 } 17478 17479 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 17480 ASSERT(tcp->tcp_fin_sent == 0); 17481 17482 /* queue new packet onto retransmission queue */ 17483 if (tcp->tcp_xmit_head == NULL) { 17484 tcp->tcp_xmit_head = mp; 17485 } else { 17486 tcp->tcp_xmit_last->b_cont = mp; 17487 } 17488 tcp->tcp_xmit_last = mp; 17489 tcp->tcp_xmit_tail = mp; 17490 17491 /* find out how much we can send */ 17492 /* BEGIN CSTYLED */ 17493 /* 17494 * un-acked usable 17495 * |--------------|-----------------| 17496 * tcp_suna tcp_snxt tcp_suna+tcp_swnd 17497 */ 17498 /* END CSTYLED */ 17499 17500 /* start sending from tcp_snxt */ 17501 snxt = tcp->tcp_snxt; 17502 17503 /* 17504 * Check to see if this connection has been idled for some 17505 * time and no ACK is expected. If it is, we need to slow 17506 * start again to get back the connection's "self-clock" as 17507 * described in VJ's paper. 17508 * 17509 * Refer to the comment in tcp_mss_set() for the calculation 17510 * of tcp_cwnd after idle. 17511 */ 17512 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 17513 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 17514 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 17515 } 17516 17517 usable = tcp->tcp_swnd; /* tcp window size */ 17518 if (usable > tcp->tcp_cwnd) 17519 usable = tcp->tcp_cwnd; /* congestion window smaller */ 17520 usable -= snxt; /* subtract stuff already sent */ 17521 suna = tcp->tcp_suna; 17522 usable += suna; 17523 /* usable can be < 0 if the congestion window is smaller */ 17524 if (len > usable) { 17525 /* Can't send complete M_DATA in one shot */ 17526 goto slow; 17527 } 17528 17529 /* 17530 * determine if anything to send (Nagle). 17531 * 17532 * 1. len < tcp_mss (i.e. small) 17533 * 2. unacknowledged data present 17534 * 3. len < nagle limit 17535 * 4. last packet sent < nagle limit (previous packet sent) 17536 */ 17537 if ((len < mss) && (snxt != suna) && 17538 (len < (int)tcp->tcp_naglim) && 17539 (tcp->tcp_last_sent_len < tcp->tcp_naglim)) { 17540 /* 17541 * This was the first unsent packet and normally 17542 * mss < xmit_hiwater so there is no need to worry 17543 * about flow control. The next packet will go 17544 * through the flow control check in tcp_wput_data(). 17545 */ 17546 /* leftover work from above */ 17547 tcp->tcp_unsent = len; 17548 tcp->tcp_xmit_tail_unsent = len; 17549 17550 return; 17551 } 17552 17553 /* len <= tcp->tcp_mss && len == unsent so no silly window */ 17554 17555 if (snxt == suna) { 17556 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 17557 } 17558 17559 /* we have always sent something */ 17560 tcp->tcp_rack_cnt = 0; 17561 17562 tcp->tcp_snxt = snxt + len; 17563 tcp->tcp_rack = tcp->tcp_rnxt; 17564 17565 if ((mp1 = dupb(mp)) == 0) 17566 goto no_memory; 17567 mp->b_prev = (mblk_t *)(uintptr_t)lbolt; 17568 mp->b_next = (mblk_t *)(uintptr_t)snxt; 17569 17570 /* adjust tcp header information */ 17571 tcph = tcp->tcp_tcph; 17572 tcph->th_flags[0] = (TH_ACK|TH_PUSH); 17573 17574 sum = len + tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 17575 sum = (sum >> 16) + (sum & 0xFFFF); 17576 U16_TO_ABE16(sum, tcph->th_sum); 17577 17578 U32_TO_ABE32(snxt, tcph->th_seq); 17579 17580 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 17581 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 17582 BUMP_LOCAL(tcp->tcp_obsegs); 17583 17584 /* Update the latest receive window size in TCP header. */ 17585 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 17586 tcph->th_win); 17587 17588 tcp->tcp_last_sent_len = (ushort_t)len; 17589 17590 plen = len + tcp->tcp_hdr_len; 17591 17592 if (tcp->tcp_ipversion == IPV4_VERSION) { 17593 tcp->tcp_ipha->ipha_length = htons(plen); 17594 } else { 17595 tcp->tcp_ip6h->ip6_plen = htons(plen - 17596 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 17597 } 17598 17599 /* see if we need to allocate a mblk for the headers */ 17600 hdrlen = tcp->tcp_hdr_len; 17601 rptr = mp1->b_rptr - hdrlen; 17602 db = mp1->b_datap; 17603 if ((db->db_ref != 2) || rptr < db->db_base || 17604 (!OK_32PTR(rptr))) { 17605 /* NOTE: we assume allocb returns an OK_32PTR */ 17606 mp = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 17607 tcp_wroff_xtra, BPRI_MED); 17608 if (!mp) { 17609 freemsg(mp1); 17610 goto no_memory; 17611 } 17612 mp->b_cont = mp1; 17613 mp1 = mp; 17614 /* Leave room for Link Level header */ 17615 /* hdrlen = tcp->tcp_hdr_len; */ 17616 rptr = &mp1->b_rptr[tcp_wroff_xtra]; 17617 mp1->b_wptr = &rptr[hdrlen]; 17618 } 17619 mp1->b_rptr = rptr; 17620 17621 /* Fill in the timestamp option. */ 17622 if (tcp->tcp_snd_ts_ok) { 17623 U32_TO_BE32((uint32_t)lbolt, 17624 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 17625 U32_TO_BE32(tcp->tcp_ts_recent, 17626 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 17627 } else { 17628 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 17629 } 17630 17631 /* copy header into outgoing packet */ 17632 dst = (ipaddr_t *)rptr; 17633 src = (ipaddr_t *)tcp->tcp_iphc; 17634 dst[0] = src[0]; 17635 dst[1] = src[1]; 17636 dst[2] = src[2]; 17637 dst[3] = src[3]; 17638 dst[4] = src[4]; 17639 dst[5] = src[5]; 17640 dst[6] = src[6]; 17641 dst[7] = src[7]; 17642 dst[8] = src[8]; 17643 dst[9] = src[9]; 17644 if (hdrlen -= 40) { 17645 hdrlen >>= 2; 17646 dst += 10; 17647 src += 10; 17648 do { 17649 *dst++ = *src++; 17650 } while (--hdrlen); 17651 } 17652 17653 /* 17654 * Set the ECN info in the TCP header. Note that this 17655 * is not the template header. 17656 */ 17657 if (tcp->tcp_ecn_ok) { 17658 SET_ECT(tcp, rptr); 17659 17660 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 17661 if (tcp->tcp_ecn_echo_on) 17662 tcph->th_flags[0] |= TH_ECE; 17663 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 17664 tcph->th_flags[0] |= TH_CWR; 17665 tcp->tcp_ecn_cwr_sent = B_TRUE; 17666 } 17667 } 17668 17669 if (tcp->tcp_ip_forward_progress) { 17670 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 17671 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 17672 tcp->tcp_ip_forward_progress = B_FALSE; 17673 } 17674 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 17675 tcp_send_data(tcp, tcp->tcp_wq, mp1); 17676 return; 17677 17678 /* 17679 * If we ran out of memory, we pretend to have sent the packet 17680 * and that it was lost on the wire. 17681 */ 17682 no_memory: 17683 return; 17684 17685 slow: 17686 /* leftover work from above */ 17687 tcp->tcp_unsent = len; 17688 tcp->tcp_xmit_tail_unsent = len; 17689 tcp_wput_data(tcp, NULL, B_FALSE); 17690 } 17691 17692 /* 17693 * The function called through squeue to get behind eager's perimeter to 17694 * finish the accept processing. 17695 */ 17696 /* ARGSUSED */ 17697 void 17698 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2) 17699 { 17700 conn_t *connp = (conn_t *)arg; 17701 tcp_t *tcp = connp->conn_tcp; 17702 queue_t *q = tcp->tcp_rq; 17703 mblk_t *mp1; 17704 mblk_t *stropt_mp = mp; 17705 struct stroptions *stropt; 17706 uint_t thwin; 17707 17708 /* 17709 * Drop the eager's ref on the listener, that was placed when 17710 * this eager began life in tcp_conn_request. 17711 */ 17712 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 17713 17714 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 17715 /* 17716 * Someone blewoff the eager before we could finish 17717 * the accept. 17718 * 17719 * The only reason eager exists it because we put in 17720 * a ref on it when conn ind went up. We need to send 17721 * a disconnect indication up while the last reference 17722 * on the eager will be dropped by the squeue when we 17723 * return. 17724 */ 17725 ASSERT(tcp->tcp_listener == NULL); 17726 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 17727 struct T_discon_ind *tdi; 17728 17729 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 17730 /* 17731 * Let us reuse the incoming mblk to avoid memory 17732 * allocation failure problems. We know that the 17733 * size of the incoming mblk i.e. stroptions is greater 17734 * than sizeof T_discon_ind. So the reallocb below 17735 * can't fail. 17736 */ 17737 freemsg(mp->b_cont); 17738 mp->b_cont = NULL; 17739 ASSERT(DB_REF(mp) == 1); 17740 mp = reallocb(mp, sizeof (struct T_discon_ind), 17741 B_FALSE); 17742 ASSERT(mp != NULL); 17743 DB_TYPE(mp) = M_PROTO; 17744 ((union T_primitives *)mp->b_rptr)->type = T_DISCON_IND; 17745 tdi = (struct T_discon_ind *)mp->b_rptr; 17746 if (tcp->tcp_issocket) { 17747 tdi->DISCON_reason = ECONNREFUSED; 17748 tdi->SEQ_number = 0; 17749 } else { 17750 tdi->DISCON_reason = ENOPROTOOPT; 17751 tdi->SEQ_number = 17752 tcp->tcp_conn_req_seqnum; 17753 } 17754 mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind); 17755 putnext(q, mp); 17756 } else { 17757 freemsg(mp); 17758 } 17759 if (tcp->tcp_hard_binding) { 17760 tcp->tcp_hard_binding = B_FALSE; 17761 tcp->tcp_hard_bound = B_TRUE; 17762 } 17763 tcp->tcp_detached = B_FALSE; 17764 return; 17765 } 17766 17767 mp1 = stropt_mp->b_cont; 17768 stropt_mp->b_cont = NULL; 17769 ASSERT(DB_TYPE(stropt_mp) == M_SETOPTS); 17770 stropt = (struct stroptions *)stropt_mp->b_rptr; 17771 17772 while (mp1 != NULL) { 17773 mp = mp1; 17774 mp1 = mp1->b_cont; 17775 mp->b_cont = NULL; 17776 tcp->tcp_drop_opt_ack_cnt++; 17777 CALL_IP_WPUT(connp, tcp->tcp_wq, mp); 17778 } 17779 mp = NULL; 17780 17781 /* 17782 * Set the max window size (tcp_rq->q_hiwat) of the acceptor 17783 * properly. This is the first time we know of the acceptor' 17784 * queue. So we do it here. 17785 */ 17786 if (tcp->tcp_rcv_list == NULL) { 17787 /* 17788 * Recv queue is empty, tcp_rwnd should not have changed. 17789 * That means it should be equal to the listener's tcp_rwnd. 17790 */ 17791 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd; 17792 } else { 17793 #ifdef DEBUG 17794 uint_t cnt = 0; 17795 17796 mp1 = tcp->tcp_rcv_list; 17797 while ((mp = mp1) != NULL) { 17798 mp1 = mp->b_next; 17799 cnt += msgdsize(mp); 17800 } 17801 ASSERT(cnt != 0 && tcp->tcp_rcv_cnt == cnt); 17802 #endif 17803 /* There is some data, add them back to get the max. */ 17804 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd + tcp->tcp_rcv_cnt; 17805 } 17806 17807 stropt->so_flags = SO_HIWAT; 17808 stropt->so_hiwat = MAX(q->q_hiwat, tcp_sth_rcv_hiwat); 17809 17810 stropt->so_flags |= SO_MAXBLK; 17811 stropt->so_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 17812 17813 /* 17814 * This is the first time we run on the correct 17815 * queue after tcp_accept. So fix all the q parameters 17816 * here. 17817 */ 17818 /* Allocate room for SACK options if needed. */ 17819 stropt->so_flags |= SO_WROFF; 17820 if (tcp->tcp_fused) { 17821 size_t sth_hiwat; 17822 17823 ASSERT(tcp->tcp_loopback); 17824 /* 17825 * For fused tcp loopback, set the stream head's write 17826 * offset value to zero since we won't be needing any room 17827 * for TCP/IP headers. This would also improve performance 17828 * since it would reduce the amount of work done by kmem. 17829 * Non-fused tcp loopback case is handled separately below. 17830 */ 17831 stropt->so_wroff = 0; 17832 17833 /* 17834 * Override q_hiwat and set it to be twice that of the 17835 * previous value; this is to simulate non-fusion case. 17836 */ 17837 sth_hiwat = q->q_hiwat << 1; 17838 if (sth_hiwat > tcp_max_buf) 17839 sth_hiwat = tcp_max_buf; 17840 17841 stropt->so_hiwat = MAX(sth_hiwat, tcp_sth_rcv_hiwat); 17842 } else if (tcp->tcp_snd_sack_ok) { 17843 stropt->so_wroff = tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 17844 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra); 17845 } else { 17846 stropt->so_wroff = tcp->tcp_hdr_len + (tcp->tcp_loopback ? 0 : 17847 tcp_wroff_xtra); 17848 } 17849 17850 /* 17851 * If loopback, set COPYCACHED option to make sure NOT to use 17852 * non-temporal access. 17853 */ 17854 if (tcp->tcp_loopback) { 17855 stropt->so_flags |= SO_COPYOPT; 17856 stropt->so_copyopt = COPYCACHED; 17857 } 17858 17859 /* Send the options up */ 17860 putnext(q, stropt_mp); 17861 17862 /* 17863 * Pass up any data and/or a fin that has been received. 17864 * 17865 * Adjust receive window in case it had decreased 17866 * (because there is data <=> tcp_rcv_list != NULL) 17867 * while the connection was detached. Note that 17868 * in case the eager was flow-controlled, w/o this 17869 * code, the rwnd may never open up again! 17870 */ 17871 if (tcp->tcp_rcv_list != NULL) { 17872 /* We drain directly in case of fused tcp loopback */ 17873 if (!tcp->tcp_fused && canputnext(q)) { 17874 tcp->tcp_rwnd = q->q_hiwat; 17875 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 17876 << tcp->tcp_rcv_ws; 17877 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 17878 if (tcp->tcp_state >= TCPS_ESTABLISHED && 17879 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 17880 tcp_xmit_ctl(NULL, 17881 tcp, (tcp->tcp_swnd == 0) ? 17882 tcp->tcp_suna : tcp->tcp_snxt, 17883 tcp->tcp_rnxt, TH_ACK); 17884 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 17885 } 17886 17887 } 17888 (void) tcp_rcv_drain(q, tcp); 17889 17890 /* 17891 * For fused tcp loopback, back-enable peer endpoint 17892 * if it's currently flow-controlled. 17893 */ 17894 if (tcp->tcp_fused && 17895 tcp->tcp_loopback_peer->tcp_flow_stopped) { 17896 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 17897 17898 ASSERT(peer_tcp != NULL); 17899 ASSERT(peer_tcp->tcp_fused); 17900 17901 tcp_clrqfull(peer_tcp); 17902 peer_tcp->tcp_flow_stopped = B_FALSE; 17903 TCP_STAT(tcp_fusion_backenabled); 17904 } 17905 } 17906 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 17907 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 17908 mp = mi_tpi_ordrel_ind(); 17909 if (mp) { 17910 tcp->tcp_ordrel_done = B_TRUE; 17911 putnext(q, mp); 17912 if (tcp->tcp_deferred_clean_death) { 17913 /* 17914 * tcp_clean_death was deferred 17915 * for T_ORDREL_IND - do it now 17916 */ 17917 (void) tcp_clean_death( 17918 tcp, 17919 tcp->tcp_client_errno, 21); 17920 tcp->tcp_deferred_clean_death = 17921 B_FALSE; 17922 } 17923 } else { 17924 /* 17925 * Run the orderly release in the 17926 * service routine. 17927 */ 17928 qenable(q); 17929 } 17930 } 17931 if (tcp->tcp_hard_binding) { 17932 tcp->tcp_hard_binding = B_FALSE; 17933 tcp->tcp_hard_bound = B_TRUE; 17934 } 17935 tcp->tcp_detached = B_FALSE; 17936 17937 if (tcp->tcp_ka_enabled) { 17938 tcp->tcp_ka_last_intrvl = 0; 17939 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 17940 MSEC_TO_TICK(tcp->tcp_ka_interval)); 17941 } 17942 17943 /* 17944 * At this point, eager is fully established and will 17945 * have the following references - 17946 * 17947 * 2 references for connection to exist (1 for TCP and 1 for IP). 17948 * 1 reference for the squeue which will be dropped by the squeue as 17949 * soon as this function returns. 17950 * There will be 1 additonal reference for being in classifier 17951 * hash list provided something bad hasn't happened. 17952 */ 17953 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17954 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17955 } 17956 17957 /* 17958 * The function called through squeue to get behind listener's perimeter to 17959 * send a deffered conn_ind. 17960 */ 17961 /* ARGSUSED */ 17962 void 17963 tcp_send_pending(void *arg, mblk_t *mp, void *arg2) 17964 { 17965 conn_t *connp = (conn_t *)arg; 17966 tcp_t *listener = connp->conn_tcp; 17967 17968 if (listener->tcp_state == TCPS_CLOSED || 17969 TCP_IS_DETACHED(listener)) { 17970 /* 17971 * If listener has closed, it would have caused a 17972 * a cleanup/blowoff to happen for the eager. 17973 */ 17974 tcp_t *tcp; 17975 struct T_conn_ind *conn_ind; 17976 17977 conn_ind = (struct T_conn_ind *)mp->b_rptr; 17978 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 17979 conn_ind->OPT_length); 17980 /* 17981 * We need to drop the ref on eager that was put 17982 * tcp_rput_data() before trying to send the conn_ind 17983 * to listener. The conn_ind was deferred in tcp_send_conn_ind 17984 * and tcp_wput_accept() is sending this deferred conn_ind but 17985 * listener is closed so we drop the ref. 17986 */ 17987 CONN_DEC_REF(tcp->tcp_connp); 17988 freemsg(mp); 17989 return; 17990 } 17991 putnext(listener->tcp_rq, mp); 17992 } 17993 17994 17995 /* 17996 * This is the STREAMS entry point for T_CONN_RES coming down on 17997 * Acceptor STREAM when sockfs listener does accept processing. 17998 * Read the block comment on top pf tcp_conn_request(). 17999 */ 18000 void 18001 tcp_wput_accept(queue_t *q, mblk_t *mp) 18002 { 18003 queue_t *rq = RD(q); 18004 struct T_conn_res *conn_res; 18005 tcp_t *eager; 18006 tcp_t *listener; 18007 struct T_ok_ack *ok; 18008 t_scalar_t PRIM_type; 18009 mblk_t *opt_mp; 18010 conn_t *econnp; 18011 18012 ASSERT(DB_TYPE(mp) == M_PROTO); 18013 18014 conn_res = (struct T_conn_res *)mp->b_rptr; 18015 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 18016 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_res)) { 18017 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 18018 if (mp != NULL) 18019 putnext(rq, mp); 18020 return; 18021 } 18022 switch (conn_res->PRIM_type) { 18023 case O_T_CONN_RES: 18024 case T_CONN_RES: 18025 /* 18026 * We pass up an err ack if allocb fails. This will 18027 * cause sockfs to issue a T_DISCON_REQ which will cause 18028 * tcp_eager_blowoff to be called. sockfs will then call 18029 * rq->q_qinfo->qi_qclose to cleanup the acceptor stream. 18030 * we need to do the allocb up here because we have to 18031 * make sure rq->q_qinfo->qi_qclose still points to the 18032 * correct function (tcpclose_accept) in case allocb 18033 * fails. 18034 */ 18035 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 18036 if (opt_mp == NULL) { 18037 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 18038 if (mp != NULL) 18039 putnext(rq, mp); 18040 return; 18041 } 18042 18043 bcopy(mp->b_rptr + conn_res->OPT_offset, 18044 &eager, conn_res->OPT_length); 18045 PRIM_type = conn_res->PRIM_type; 18046 mp->b_datap->db_type = M_PCPROTO; 18047 mp->b_wptr = mp->b_rptr + sizeof (struct T_ok_ack); 18048 ok = (struct T_ok_ack *)mp->b_rptr; 18049 ok->PRIM_type = T_OK_ACK; 18050 ok->CORRECT_prim = PRIM_type; 18051 econnp = eager->tcp_connp; 18052 econnp->conn_dev = (dev_t)q->q_ptr; 18053 eager->tcp_rq = rq; 18054 eager->tcp_wq = q; 18055 rq->q_ptr = econnp; 18056 rq->q_qinfo = &tcp_rinit; 18057 q->q_ptr = econnp; 18058 q->q_qinfo = &tcp_winit; 18059 listener = eager->tcp_listener; 18060 eager->tcp_issocket = B_TRUE; 18061 eager->tcp_cred = econnp->conn_cred = 18062 listener->tcp_connp->conn_cred; 18063 crhold(econnp->conn_cred); 18064 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 18065 18066 /* Put the ref for IP */ 18067 CONN_INC_REF(econnp); 18068 18069 /* 18070 * We should have minimum of 3 references on the conn 18071 * at this point. One each for TCP and IP and one for 18072 * the T_conn_ind that was sent up when the 3-way handshake 18073 * completed. In the normal case we would also have another 18074 * reference (making a total of 4) for the conn being in the 18075 * classifier hash list. However the eager could have received 18076 * an RST subsequently and tcp_closei_local could have removed 18077 * the eager from the classifier hash list, hence we can't 18078 * assert that reference. 18079 */ 18080 ASSERT(econnp->conn_ref >= 3); 18081 18082 /* 18083 * Send the new local address also up to sockfs. There 18084 * should already be enough space in the mp that came 18085 * down from soaccept(). 18086 */ 18087 if (eager->tcp_family == AF_INET) { 18088 sin_t *sin; 18089 18090 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 18091 (sizeof (struct T_ok_ack) + sizeof (sin_t))); 18092 sin = (sin_t *)mp->b_wptr; 18093 mp->b_wptr += sizeof (sin_t); 18094 sin->sin_family = AF_INET; 18095 sin->sin_port = eager->tcp_lport; 18096 sin->sin_addr.s_addr = eager->tcp_ipha->ipha_src; 18097 } else { 18098 sin6_t *sin6; 18099 18100 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 18101 sizeof (struct T_ok_ack) + sizeof (sin6_t)); 18102 sin6 = (sin6_t *)mp->b_wptr; 18103 mp->b_wptr += sizeof (sin6_t); 18104 sin6->sin6_family = AF_INET6; 18105 sin6->sin6_port = eager->tcp_lport; 18106 if (eager->tcp_ipversion == IPV4_VERSION) { 18107 sin6->sin6_flowinfo = 0; 18108 IN6_IPADDR_TO_V4MAPPED( 18109 eager->tcp_ipha->ipha_src, 18110 &sin6->sin6_addr); 18111 } else { 18112 ASSERT(eager->tcp_ip6h != NULL); 18113 sin6->sin6_flowinfo = 18114 eager->tcp_ip6h->ip6_vcf & 18115 ~IPV6_VERS_AND_FLOW_MASK; 18116 sin6->sin6_addr = eager->tcp_ip6h->ip6_src; 18117 } 18118 sin6->sin6_scope_id = 0; 18119 sin6->__sin6_src_id = 0; 18120 } 18121 18122 putnext(rq, mp); 18123 18124 opt_mp->b_datap->db_type = M_SETOPTS; 18125 opt_mp->b_wptr += sizeof (struct stroptions); 18126 18127 /* 18128 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 18129 * from listener to acceptor. The message is chained on the 18130 * bind_mp which tcp_rput_other will send down to IP. 18131 */ 18132 if (listener->tcp_bound_if != 0) { 18133 /* allocate optmgmt req */ 18134 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 18135 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 18136 sizeof (int)); 18137 if (mp != NULL) 18138 linkb(opt_mp, mp); 18139 } 18140 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 18141 uint_t on = 1; 18142 18143 /* allocate optmgmt req */ 18144 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 18145 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 18146 if (mp != NULL) 18147 linkb(opt_mp, mp); 18148 } 18149 18150 18151 mutex_enter(&listener->tcp_eager_lock); 18152 18153 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 18154 18155 tcp_t *tail; 18156 tcp_t *tcp; 18157 mblk_t *mp1; 18158 18159 tcp = listener->tcp_eager_prev_q0; 18160 /* 18161 * listener->tcp_eager_prev_q0 points to the TAIL of the 18162 * deferred T_conn_ind queue. We need to get to the head 18163 * of the queue in order to send up T_conn_ind the same 18164 * order as how the 3WHS is completed. 18165 */ 18166 while (tcp != listener) { 18167 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 18168 break; 18169 else 18170 tcp = tcp->tcp_eager_prev_q0; 18171 } 18172 ASSERT(tcp != listener); 18173 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 18174 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 18175 /* Move from q0 to q */ 18176 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 18177 listener->tcp_conn_req_cnt_q0--; 18178 listener->tcp_conn_req_cnt_q++; 18179 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 18180 tcp->tcp_eager_prev_q0; 18181 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 18182 tcp->tcp_eager_next_q0; 18183 tcp->tcp_eager_prev_q0 = NULL; 18184 tcp->tcp_eager_next_q0 = NULL; 18185 tcp->tcp_conn_def_q0 = B_FALSE; 18186 18187 /* 18188 * Insert at end of the queue because sockfs sends 18189 * down T_CONN_RES in chronological order. Leaving 18190 * the older conn indications at front of the queue 18191 * helps reducing search time. 18192 */ 18193 tail = listener->tcp_eager_last_q; 18194 if (tail != NULL) { 18195 tail->tcp_eager_next_q = tcp; 18196 } else { 18197 listener->tcp_eager_next_q = tcp; 18198 } 18199 listener->tcp_eager_last_q = tcp; 18200 tcp->tcp_eager_next_q = NULL; 18201 18202 /* Need to get inside the listener perimeter */ 18203 CONN_INC_REF(listener->tcp_connp); 18204 squeue_fill(listener->tcp_connp->conn_sqp, mp1, 18205 tcp_send_pending, listener->tcp_connp, 18206 SQTAG_TCP_SEND_PENDING); 18207 } 18208 tcp_eager_unlink(eager); 18209 mutex_exit(&listener->tcp_eager_lock); 18210 18211 /* 18212 * At this point, the eager is detached from the listener 18213 * but we still have an extra refs on eager (apart from the 18214 * usual tcp references). The ref was placed in tcp_rput_data 18215 * before sending the conn_ind in tcp_send_conn_ind. 18216 * The ref will be dropped in tcp_accept_finish(). 18217 */ 18218 squeue_enter_nodrain(econnp->conn_sqp, opt_mp, 18219 tcp_accept_finish, econnp, SQTAG_TCP_ACCEPT_FINISH_Q0); 18220 return; 18221 default: 18222 mp = mi_tpi_err_ack_alloc(mp, TNOTSUPPORT, 0); 18223 if (mp != NULL) 18224 putnext(rq, mp); 18225 return; 18226 } 18227 } 18228 18229 static void 18230 tcp_wput(queue_t *q, mblk_t *mp) 18231 { 18232 conn_t *connp = Q_TO_CONN(q); 18233 tcp_t *tcp; 18234 void (*output_proc)(); 18235 t_scalar_t type; 18236 uchar_t *rptr; 18237 struct iocblk *iocp; 18238 18239 ASSERT(connp->conn_ref >= 2); 18240 18241 switch (DB_TYPE(mp)) { 18242 case M_DATA: 18243 CONN_INC_REF(connp); 18244 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 18245 tcp_output, connp, SQTAG_TCP_OUTPUT); 18246 return; 18247 case M_PROTO: 18248 case M_PCPROTO: 18249 /* 18250 * if it is a snmp message, don't get behind the squeue 18251 */ 18252 tcp = connp->conn_tcp; 18253 rptr = mp->b_rptr; 18254 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 18255 type = ((union T_primitives *)rptr)->type; 18256 } else { 18257 if (tcp->tcp_debug) { 18258 (void) strlog(TCP_MODULE_ID, 0, 1, 18259 SL_ERROR|SL_TRACE, 18260 "tcp_wput_proto, dropping one..."); 18261 } 18262 freemsg(mp); 18263 return; 18264 } 18265 if (type == T_SVR4_OPTMGMT_REQ) { 18266 cred_t *cr = DB_CREDDEF(mp, 18267 tcp->tcp_cred); 18268 if (snmpcom_req(q, mp, tcp_snmp_set, tcp_snmp_get, 18269 cr)) { 18270 /* 18271 * This was a SNMP request 18272 */ 18273 return; 18274 } else { 18275 output_proc = tcp_wput_proto; 18276 } 18277 } else { 18278 output_proc = tcp_wput_proto; 18279 } 18280 break; 18281 case M_IOCTL: 18282 /* 18283 * Most ioctls can be processed right away without going via 18284 * squeues - process them right here. Those that do require 18285 * squeue (currently TCP_IOC_DEFAULT_Q and SIOCPOPSOCKFS) 18286 * are processed by tcp_wput_ioctl(). 18287 */ 18288 iocp = (struct iocblk *)mp->b_rptr; 18289 tcp = connp->conn_tcp; 18290 18291 switch (iocp->ioc_cmd) { 18292 case TCP_IOC_ABORT_CONN: 18293 tcp_ioctl_abort_conn(q, mp); 18294 return; 18295 case TI_GETPEERNAME: 18296 if (tcp->tcp_state < TCPS_SYN_RCVD) { 18297 iocp->ioc_error = ENOTCONN; 18298 iocp->ioc_count = 0; 18299 mp->b_datap->db_type = M_IOCACK; 18300 qreply(q, mp); 18301 return; 18302 } 18303 /* FALLTHRU */ 18304 case TI_GETMYNAME: 18305 mi_copyin(q, mp, NULL, 18306 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 18307 return; 18308 case ND_SET: 18309 /* nd_getset does the necessary checks */ 18310 case ND_GET: 18311 if (!nd_getset(q, tcp_g_nd, mp)) { 18312 CALL_IP_WPUT(connp, q, mp); 18313 return; 18314 } 18315 qreply(q, mp); 18316 return; 18317 case TCP_IOC_DEFAULT_Q: 18318 /* 18319 * Wants to be the default wq. Check the credentials 18320 * first, the rest is executed via squeue. 18321 */ 18322 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 18323 iocp->ioc_error = EPERM; 18324 iocp->ioc_count = 0; 18325 mp->b_datap->db_type = M_IOCACK; 18326 qreply(q, mp); 18327 return; 18328 } 18329 output_proc = tcp_wput_ioctl; 18330 break; 18331 default: 18332 output_proc = tcp_wput_ioctl; 18333 break; 18334 } 18335 break; 18336 default: 18337 output_proc = tcp_wput_nondata; 18338 break; 18339 } 18340 18341 CONN_INC_REF(connp); 18342 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 18343 output_proc, connp, SQTAG_TCP_WPUT_OTHER); 18344 } 18345 18346 /* 18347 * Initial STREAMS write side put() procedure for sockets. It tries to 18348 * handle the T_CAPABILITY_REQ which sockfs sends down while setting 18349 * up the socket without using the squeue. Non T_CAPABILITY_REQ messages 18350 * are handled by tcp_wput() as usual. 18351 * 18352 * All further messages will also be handled by tcp_wput() because we cannot 18353 * be sure that the above short cut is safe later. 18354 */ 18355 static void 18356 tcp_wput_sock(queue_t *wq, mblk_t *mp) 18357 { 18358 conn_t *connp = Q_TO_CONN(wq); 18359 tcp_t *tcp = connp->conn_tcp; 18360 struct T_capability_req *car = (struct T_capability_req *)mp->b_rptr; 18361 18362 ASSERT(wq->q_qinfo == &tcp_sock_winit); 18363 wq->q_qinfo = &tcp_winit; 18364 18365 ASSERT(IS_TCP_CONN(connp)); 18366 ASSERT(TCP_IS_SOCKET(tcp)); 18367 18368 if (DB_TYPE(mp) == M_PCPROTO && 18369 MBLKL(mp) == sizeof (struct T_capability_req) && 18370 car->PRIM_type == T_CAPABILITY_REQ) { 18371 tcp_capability_req(tcp, mp); 18372 return; 18373 } 18374 18375 tcp_wput(wq, mp); 18376 } 18377 18378 static boolean_t 18379 tcp_zcopy_check(tcp_t *tcp) 18380 { 18381 conn_t *connp = tcp->tcp_connp; 18382 ire_t *ire; 18383 boolean_t zc_enabled = B_FALSE; 18384 18385 if (do_tcpzcopy == 2) 18386 zc_enabled = B_TRUE; 18387 else if (tcp->tcp_ipversion == IPV4_VERSION && 18388 IPCL_IS_CONNECTED(connp) && 18389 (connp->conn_flags & IPCL_CHECK_POLICY) == 0 && 18390 connp->conn_dontroute == 0 && 18391 connp->conn_xmit_if_ill == NULL && 18392 connp->conn_nofailover_ill == NULL && 18393 do_tcpzcopy == 1) { 18394 /* 18395 * the checks above closely resemble the fast path checks 18396 * in tcp_send_data(). 18397 */ 18398 mutex_enter(&connp->conn_lock); 18399 ire = connp->conn_ire_cache; 18400 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18401 if (ire != NULL && !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18402 IRE_REFHOLD(ire); 18403 if (ire->ire_stq != NULL) { 18404 ill_t *ill = (ill_t *)ire->ire_stq->q_ptr; 18405 18406 zc_enabled = ill && (ill->ill_capabilities & 18407 ILL_CAPAB_ZEROCOPY) && 18408 (ill->ill_zerocopy_capab-> 18409 ill_zerocopy_flags != 0); 18410 } 18411 IRE_REFRELE(ire); 18412 } 18413 mutex_exit(&connp->conn_lock); 18414 } 18415 tcp->tcp_snd_zcopy_on = zc_enabled; 18416 if (!TCP_IS_DETACHED(tcp)) { 18417 if (zc_enabled) { 18418 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMSAFE); 18419 TCP_STAT(tcp_zcopy_on); 18420 } else { 18421 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18422 TCP_STAT(tcp_zcopy_off); 18423 } 18424 } 18425 return (zc_enabled); 18426 } 18427 18428 static mblk_t * 18429 tcp_zcopy_disable(tcp_t *tcp, mblk_t *bp) 18430 { 18431 if (do_tcpzcopy == 2) 18432 return (bp); 18433 else if (tcp->tcp_snd_zcopy_on) { 18434 tcp->tcp_snd_zcopy_on = B_FALSE; 18435 if (!TCP_IS_DETACHED(tcp)) { 18436 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18437 TCP_STAT(tcp_zcopy_disable); 18438 } 18439 } 18440 return (tcp_zcopy_backoff(tcp, bp, 0)); 18441 } 18442 18443 /* 18444 * Backoff from a zero-copy mblk by copying data to a new mblk and freeing 18445 * the original desballoca'ed segmapped mblk. 18446 */ 18447 static mblk_t * 18448 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, int fix_xmitlist) 18449 { 18450 mblk_t *head, *tail, *nbp; 18451 if (IS_VMLOANED_MBLK(bp)) { 18452 TCP_STAT(tcp_zcopy_backoff); 18453 if ((head = copyb(bp)) == NULL) { 18454 /* fail to backoff; leave it for the next backoff */ 18455 tcp->tcp_xmit_zc_clean = B_FALSE; 18456 return (bp); 18457 } 18458 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18459 if (fix_xmitlist) 18460 tcp_zcopy_notify(tcp); 18461 else 18462 head->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18463 } 18464 nbp = bp->b_cont; 18465 if (fix_xmitlist) { 18466 head->b_prev = bp->b_prev; 18467 head->b_next = bp->b_next; 18468 if (tcp->tcp_xmit_tail == bp) 18469 tcp->tcp_xmit_tail = head; 18470 } 18471 bp->b_next = NULL; 18472 bp->b_prev = NULL; 18473 freeb(bp); 18474 } else { 18475 head = bp; 18476 nbp = bp->b_cont; 18477 } 18478 tail = head; 18479 while (nbp) { 18480 if (IS_VMLOANED_MBLK(nbp)) { 18481 TCP_STAT(tcp_zcopy_backoff); 18482 if ((tail->b_cont = copyb(nbp)) == NULL) { 18483 tcp->tcp_xmit_zc_clean = B_FALSE; 18484 tail->b_cont = nbp; 18485 return (head); 18486 } 18487 tail = tail->b_cont; 18488 if (nbp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18489 if (fix_xmitlist) 18490 tcp_zcopy_notify(tcp); 18491 else 18492 tail->b_datap->db_struioflag |= 18493 STRUIO_ZCNOTIFY; 18494 } 18495 bp = nbp; 18496 nbp = nbp->b_cont; 18497 if (fix_xmitlist) { 18498 tail->b_prev = bp->b_prev; 18499 tail->b_next = bp->b_next; 18500 if (tcp->tcp_xmit_tail == bp) 18501 tcp->tcp_xmit_tail = tail; 18502 } 18503 bp->b_next = NULL; 18504 bp->b_prev = NULL; 18505 freeb(bp); 18506 } else { 18507 tail->b_cont = nbp; 18508 tail = nbp; 18509 nbp = nbp->b_cont; 18510 } 18511 } 18512 if (fix_xmitlist) { 18513 tcp->tcp_xmit_last = tail; 18514 tcp->tcp_xmit_zc_clean = B_TRUE; 18515 } 18516 return (head); 18517 } 18518 18519 static void 18520 tcp_zcopy_notify(tcp_t *tcp) 18521 { 18522 struct stdata *stp; 18523 18524 if (tcp->tcp_detached) 18525 return; 18526 stp = STREAM(tcp->tcp_rq); 18527 mutex_enter(&stp->sd_lock); 18528 stp->sd_flag |= STZCNOTIFY; 18529 cv_broadcast(&stp->sd_zcopy_wait); 18530 mutex_exit(&stp->sd_lock); 18531 } 18532 18533 18534 static void 18535 tcp_send_data(tcp_t *tcp, queue_t *q, mblk_t *mp) 18536 { 18537 ipha_t *ipha; 18538 ipaddr_t src; 18539 ipaddr_t dst; 18540 uint32_t cksum; 18541 ire_t *ire; 18542 uint16_t *up; 18543 ill_t *ill; 18544 conn_t *connp = tcp->tcp_connp; 18545 uint32_t hcksum_txflags = 0; 18546 mblk_t *ire_fp_mp; 18547 uint_t ire_fp_mp_len; 18548 ill_poll_capab_t *ill_poll; 18549 18550 ASSERT(DB_TYPE(mp) == M_DATA); 18551 18552 ipha = (ipha_t *)mp->b_rptr; 18553 src = ipha->ipha_src; 18554 dst = ipha->ipha_dst; 18555 18556 /* 18557 * Drop off slow path for IPv6 and also if options are present. 18558 */ 18559 if (tcp->tcp_ipversion != IPV4_VERSION || 18560 !IPCL_IS_CONNECTED(connp) || 18561 (connp->conn_flags & IPCL_CHECK_POLICY) != 0 || 18562 connp->conn_dontroute || 18563 connp->conn_xmit_if_ill != NULL || 18564 connp->conn_nofailover_ill != NULL || 18565 ipha->ipha_ident == IP_HDR_INCLUDED || 18566 ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION || 18567 IPP_ENABLED(IPP_LOCAL_OUT)) { 18568 if (tcp->tcp_snd_zcopy_aware) 18569 mp = tcp_zcopy_disable(tcp, mp); 18570 TCP_STAT(tcp_ip_send); 18571 CALL_IP_WPUT(connp, q, mp); 18572 return; 18573 } 18574 18575 mutex_enter(&connp->conn_lock); 18576 ire = connp->conn_ire_cache; 18577 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18578 if (ire != NULL && ire->ire_addr == dst && 18579 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18580 IRE_REFHOLD(ire); 18581 mutex_exit(&connp->conn_lock); 18582 } else { 18583 boolean_t cached = B_FALSE; 18584 18585 /* force a recheck later on */ 18586 tcp->tcp_ire_ill_check_done = B_FALSE; 18587 18588 TCP_DBGSTAT(tcp_ire_null1); 18589 connp->conn_ire_cache = NULL; 18590 mutex_exit(&connp->conn_lock); 18591 if (ire != NULL) 18592 IRE_REFRELE_NOTR(ire); 18593 ire = ire_cache_lookup(dst, connp->conn_zoneid); 18594 if (ire == NULL) { 18595 if (tcp->tcp_snd_zcopy_aware) 18596 mp = tcp_zcopy_backoff(tcp, mp, 0); 18597 TCP_STAT(tcp_ire_null); 18598 CALL_IP_WPUT(connp, q, mp); 18599 return; 18600 } 18601 IRE_REFHOLD_NOTR(ire); 18602 /* 18603 * Since we are inside the squeue, there cannot be another 18604 * thread in TCP trying to set the conn_ire_cache now. The 18605 * check for IRE_MARK_CONDEMNED ensures that an interface 18606 * unplumb thread has not yet started cleaning up the conns. 18607 * Hence we don't need to grab the conn lock. 18608 */ 18609 if (!(connp->conn_state_flags & CONN_CLOSING)) { 18610 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 18611 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18612 connp->conn_ire_cache = ire; 18613 cached = B_TRUE; 18614 } 18615 rw_exit(&ire->ire_bucket->irb_lock); 18616 } 18617 18618 /* 18619 * We can continue to use the ire but since it was 18620 * not cached, we should drop the extra reference. 18621 */ 18622 if (!cached) 18623 IRE_REFRELE_NOTR(ire); 18624 } 18625 18626 if (ire->ire_flags & RTF_MULTIRT || 18627 ire->ire_stq == NULL || 18628 ire->ire_max_frag < ntohs(ipha->ipha_length) || 18629 (ire_fp_mp = ire->ire_fp_mp) == NULL || 18630 (ire_fp_mp_len = MBLKL(ire_fp_mp)) > MBLKHEAD(mp)) { 18631 if (tcp->tcp_snd_zcopy_aware) 18632 mp = tcp_zcopy_disable(tcp, mp); 18633 TCP_STAT(tcp_ip_ire_send); 18634 IRE_REFRELE(ire); 18635 CALL_IP_WPUT(connp, q, mp); 18636 return; 18637 } 18638 18639 ill = ire_to_ill(ire); 18640 if (connp->conn_outgoing_ill != NULL) { 18641 ill_t *conn_outgoing_ill = NULL; 18642 /* 18643 * Choose a good ill in the group to send the packets on. 18644 */ 18645 ire = conn_set_outgoing_ill(connp, ire, &conn_outgoing_ill); 18646 ill = ire_to_ill(ire); 18647 } 18648 ASSERT(ill != NULL); 18649 18650 if (!tcp->tcp_ire_ill_check_done) { 18651 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 18652 tcp->tcp_ire_ill_check_done = B_TRUE; 18653 } 18654 18655 ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED); 18656 ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1); 18657 #ifndef _BIG_ENDIAN 18658 ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8); 18659 #endif 18660 18661 /* 18662 * Check to see if we need to re-enable MDT for this connection 18663 * because it was previously disabled due to changes in the ill; 18664 * note that by doing it here, this re-enabling only applies when 18665 * the packet is not dispatched through CALL_IP_WPUT(). 18666 * 18667 * That means for IPv4, it is worth re-enabling MDT for the fastpath 18668 * case, since that's how we ended up here. For IPv6, we do the 18669 * re-enabling work in ip_xmit_v6(), albeit indirectly via squeue. 18670 */ 18671 if (connp->conn_mdt_ok && !tcp->tcp_mdt && ILL_MDT_USABLE(ill)) { 18672 /* 18673 * Restore MDT for this connection, so that next time around 18674 * it is eligible to go through tcp_multisend() path again. 18675 */ 18676 TCP_STAT(tcp_mdt_conn_resumed1); 18677 tcp->tcp_mdt = B_TRUE; 18678 ip1dbg(("tcp_send_data: reenabling MDT for connp %p on " 18679 "interface %s\n", (void *)connp, ill->ill_name)); 18680 } 18681 18682 if (tcp->tcp_snd_zcopy_aware) { 18683 if ((ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) == 0 || 18684 (ill->ill_zerocopy_capab->ill_zerocopy_flags == 0)) 18685 mp = tcp_zcopy_disable(tcp, mp); 18686 /* 18687 * we shouldn't need to reset ipha as the mp containing 18688 * ipha should never be a zero-copy mp. 18689 */ 18690 } 18691 18692 if ((ill->ill_capabilities & ILL_CAPAB_HCKSUM) && dohwcksum) { 18693 ASSERT(ill->ill_hcksum_capab != NULL); 18694 hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags; 18695 } 18696 18697 /* pseudo-header checksum (do it in parts for IP header checksum) */ 18698 cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF); 18699 18700 ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION); 18701 up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); 18702 18703 /* 18704 * Underlying interface supports hardware checksum offload for 18705 * the tcp payload, along with M_DATA fast path; leave the payload 18706 * checksum for the hardware to calculate. 18707 * 18708 * N.B: We only need to set up checksum info on the first mblk. 18709 */ 18710 if (hcksum_txflags & HCKSUM_INET_FULL_V4) { 18711 /* 18712 * Hardware calculates pseudo-header, header and payload 18713 * checksums, so clear checksum field in TCP header. 18714 */ 18715 *up = 0; 18716 mp->b_datap->db_struioun.cksum.flags |= HCK_FULLCKSUM; 18717 } else if (hcksum_txflags & HCKSUM_INET_PARTIAL) { 18718 uint32_t sum; 18719 /* 18720 * Partial checksum offload has been enabled. Fill the 18721 * checksum field in the TCP header with the pseudo-header 18722 * checksum value. 18723 */ 18724 sum = *up + cksum + IP_TCP_CSUM_COMP; 18725 sum = (sum & 0xFFFF) + (sum >> 16); 18726 *up = (sum & 0xFFFF) + (sum >> 16); 18727 mp->b_datap->db_cksumstart = IP_SIMPLE_HDR_LENGTH; 18728 mp->b_datap->db_cksumstuff = IP_SIMPLE_HDR_LENGTH + 16; 18729 mp->b_datap->db_cksumend = ntohs(ipha->ipha_length); 18730 mp->b_datap->db_struioun.cksum.flags |= HCK_PARTIALCKSUM; 18731 } else { 18732 /* software checksumming */ 18733 TCP_STAT(tcp_out_sw_cksum); 18734 *up = IP_CSUM(mp, IP_SIMPLE_HDR_LENGTH, 18735 cksum + IP_TCP_CSUM_COMP); 18736 mp->b_datap->db_struioun.cksum.flags = 0; 18737 } 18738 18739 ipha->ipha_fragment_offset_and_flags |= 18740 (uint32_t)htons(ire->ire_frag_flag); 18741 18742 /* 18743 * Hardware supports IP header checksum offload; clear contents 18744 * of IP header checksum field. Otherwise we calculate it. 18745 */ 18746 if (hcksum_txflags & HCKSUM_IPHDRCKSUM) { 18747 ipha->ipha_hdr_checksum = 0; 18748 mp->b_datap->db_struioun.cksum.flags |= HCK_IPV4_HDRCKSUM; 18749 } else { 18750 IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0], 18751 ((uint16_t *)ipha)[4]); 18752 } 18753 18754 ASSERT(DB_TYPE(ire_fp_mp) == M_DATA); 18755 mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len; 18756 bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len); 18757 18758 UPDATE_OB_PKT_COUNT(ire); 18759 ire->ire_last_used_time = lbolt; 18760 BUMP_MIB(&ip_mib, ipOutRequests); 18761 18762 if (ill->ill_capabilities & ILL_CAPAB_POLL) { 18763 ill_poll = ill->ill_poll_capab; 18764 ASSERT(ill_poll != NULL); 18765 ASSERT(ill_poll->ill_tx != NULL); 18766 ASSERT(ill_poll->ill_tx_handle != NULL); 18767 18768 ill_poll->ill_tx(ill_poll->ill_tx_handle, mp); 18769 } else { 18770 putnext(ire->ire_stq, mp); 18771 } 18772 IRE_REFRELE(ire); 18773 } 18774 18775 /* 18776 * This handles the case when the receiver has shrunk its win. Per RFC 1122 18777 * if the receiver shrinks the window, i.e. moves the right window to the 18778 * left, the we should not send new data, but should retransmit normally the 18779 * old unacked data between suna and suna + swnd. We might has sent data 18780 * that is now outside the new window, pretend that we didn't send it. 18781 */ 18782 static void 18783 tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_count) 18784 { 18785 uint32_t snxt = tcp->tcp_snxt; 18786 mblk_t *xmit_tail; 18787 int32_t offset; 18788 18789 ASSERT(shrunk_count > 0); 18790 18791 /* Pretend we didn't send the data outside the window */ 18792 snxt -= shrunk_count; 18793 18794 /* Get the mblk and the offset in it per the shrunk window */ 18795 xmit_tail = tcp_get_seg_mp(tcp, snxt, &offset); 18796 18797 ASSERT(xmit_tail != NULL); 18798 18799 /* Reset all the values per the now shrunk window */ 18800 tcp->tcp_snxt = snxt; 18801 tcp->tcp_xmit_tail = xmit_tail; 18802 tcp->tcp_xmit_tail_unsent = xmit_tail->b_wptr - xmit_tail->b_rptr - 18803 offset; 18804 tcp->tcp_unsent += shrunk_count; 18805 18806 if (tcp->tcp_suna == tcp->tcp_snxt && tcp->tcp_swnd == 0) 18807 /* 18808 * Make sure the timer is running so that we will probe a zero 18809 * window. 18810 */ 18811 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 18812 } 18813 18814 18815 /* 18816 * The TCP normal data output path. 18817 * NOTE: the logic of the fast path is duplicated from this function. 18818 */ 18819 static void 18820 tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent) 18821 { 18822 int len; 18823 mblk_t *local_time; 18824 mblk_t *mp1; 18825 uint32_t snxt; 18826 int tail_unsent; 18827 int tcpstate; 18828 int usable = 0; 18829 mblk_t *xmit_tail; 18830 queue_t *q = tcp->tcp_wq; 18831 int32_t mss; 18832 int32_t num_sack_blk = 0; 18833 int32_t tcp_hdr_len; 18834 int32_t tcp_tcp_hdr_len; 18835 int mdt_thres; 18836 int rc; 18837 18838 tcpstate = tcp->tcp_state; 18839 if (mp == NULL) { 18840 /* 18841 * tcp_wput_data() with NULL mp should only be called when 18842 * there is unsent data. 18843 */ 18844 ASSERT(tcp->tcp_unsent > 0); 18845 /* Really tacky... but we need this for detached closes. */ 18846 len = tcp->tcp_unsent; 18847 goto data_null; 18848 } 18849 18850 #if CCS_STATS 18851 wrw_stats.tot.count++; 18852 wrw_stats.tot.bytes += msgdsize(mp); 18853 #endif 18854 ASSERT(mp->b_datap->db_type == M_DATA); 18855 /* 18856 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ, 18857 * or before a connection attempt has begun. 18858 */ 18859 if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT || 18860 (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18861 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18862 #ifdef DEBUG 18863 cmn_err(CE_WARN, 18864 "tcp_wput_data: data after ordrel, %s", 18865 tcp_display(tcp, NULL, 18866 DISP_ADDR_AND_PORT)); 18867 #else 18868 if (tcp->tcp_debug) { 18869 (void) strlog(TCP_MODULE_ID, 0, 1, 18870 SL_TRACE|SL_ERROR, 18871 "tcp_wput_data: data after ordrel, %s\n", 18872 tcp_display(tcp, NULL, 18873 DISP_ADDR_AND_PORT)); 18874 } 18875 #endif /* DEBUG */ 18876 } 18877 if (tcp->tcp_snd_zcopy_aware && 18878 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) != 0) 18879 tcp_zcopy_notify(tcp); 18880 freemsg(mp); 18881 return; 18882 } 18883 18884 /* Strip empties */ 18885 for (;;) { 18886 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 18887 (uintptr_t)INT_MAX); 18888 len = (int)(mp->b_wptr - mp->b_rptr); 18889 if (len > 0) 18890 break; 18891 mp1 = mp; 18892 mp = mp->b_cont; 18893 freeb(mp1); 18894 if (!mp) { 18895 return; 18896 } 18897 } 18898 18899 /* If we are the first on the list ... */ 18900 if (tcp->tcp_xmit_head == NULL) { 18901 tcp->tcp_xmit_head = mp; 18902 tcp->tcp_xmit_tail = mp; 18903 tcp->tcp_xmit_tail_unsent = len; 18904 } else { 18905 /* If tiny tx and room in txq tail, pullup to save mblks. */ 18906 struct datab *dp; 18907 18908 mp1 = tcp->tcp_xmit_last; 18909 if (len < tcp_tx_pull_len && 18910 (dp = mp1->b_datap)->db_ref == 1 && 18911 dp->db_lim - mp1->b_wptr >= len) { 18912 ASSERT(len > 0); 18913 ASSERT(!mp1->b_cont); 18914 if (len == 1) { 18915 *mp1->b_wptr++ = *mp->b_rptr; 18916 } else { 18917 bcopy(mp->b_rptr, mp1->b_wptr, len); 18918 mp1->b_wptr += len; 18919 } 18920 if (mp1 == tcp->tcp_xmit_tail) 18921 tcp->tcp_xmit_tail_unsent += len; 18922 mp1->b_cont = mp->b_cont; 18923 if (tcp->tcp_snd_zcopy_aware && 18924 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 18925 mp1->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18926 freeb(mp); 18927 mp = mp1; 18928 } else { 18929 tcp->tcp_xmit_last->b_cont = mp; 18930 } 18931 len += tcp->tcp_unsent; 18932 } 18933 18934 /* Tack on however many more positive length mblks we have */ 18935 if ((mp1 = mp->b_cont) != NULL) { 18936 do { 18937 int tlen; 18938 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 18939 (uintptr_t)INT_MAX); 18940 tlen = (int)(mp1->b_wptr - mp1->b_rptr); 18941 if (tlen <= 0) { 18942 mp->b_cont = mp1->b_cont; 18943 freeb(mp1); 18944 } else { 18945 len += tlen; 18946 mp = mp1; 18947 } 18948 } while ((mp1 = mp->b_cont) != NULL); 18949 } 18950 tcp->tcp_xmit_last = mp; 18951 tcp->tcp_unsent = len; 18952 18953 if (urgent) 18954 usable = 1; 18955 18956 data_null: 18957 snxt = tcp->tcp_snxt; 18958 xmit_tail = tcp->tcp_xmit_tail; 18959 tail_unsent = tcp->tcp_xmit_tail_unsent; 18960 18961 /* 18962 * Note that tcp_mss has been adjusted to take into account the 18963 * timestamp option if applicable. Because SACK options do not 18964 * appear in every TCP segments and they are of variable lengths, 18965 * they cannot be included in tcp_mss. Thus we need to calculate 18966 * the actual segment length when we need to send a segment which 18967 * includes SACK options. 18968 */ 18969 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 18970 int32_t opt_len; 18971 18972 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 18973 tcp->tcp_num_sack_blk); 18974 opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN * 18975 2 + TCPOPT_HEADER_LEN; 18976 mss = tcp->tcp_mss - opt_len; 18977 tcp_hdr_len = tcp->tcp_hdr_len + opt_len; 18978 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + opt_len; 18979 } else { 18980 mss = tcp->tcp_mss; 18981 tcp_hdr_len = tcp->tcp_hdr_len; 18982 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 18983 } 18984 18985 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 18986 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 18987 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 18988 } 18989 if (tcpstate == TCPS_SYN_RCVD) { 18990 /* 18991 * The three-way connection establishment handshake is not 18992 * complete yet. We want to queue the data for transmission 18993 * after entering ESTABLISHED state (RFC793). A jump to 18994 * "done" label effectively leaves data on the queue. 18995 */ 18996 goto done; 18997 } else { 18998 int usable_r = tcp->tcp_swnd; 18999 19000 /* 19001 * In the special case when cwnd is zero, which can only 19002 * happen if the connection is ECN capable, return now. 19003 * New segments is sent using tcp_timer(). The timer 19004 * is set in tcp_rput_data(). 19005 */ 19006 if (tcp->tcp_cwnd == 0) { 19007 /* 19008 * Note that tcp_cwnd is 0 before 3-way handshake is 19009 * finished. 19010 */ 19011 ASSERT(tcp->tcp_ecn_ok || 19012 tcp->tcp_state < TCPS_ESTABLISHED); 19013 return; 19014 } 19015 19016 /* NOTE: trouble if xmitting while SYN not acked? */ 19017 usable_r -= snxt; 19018 usable_r += tcp->tcp_suna; 19019 19020 /* 19021 * Check if the receiver has shrunk the window. If 19022 * tcp_wput_data() with NULL mp is called, tcp_fin_sent 19023 * cannot be set as there is unsent data, so FIN cannot 19024 * be sent out. Otherwise, we need to take into account 19025 * of FIN as it consumes an "invisible" sequence number. 19026 */ 19027 ASSERT(tcp->tcp_fin_sent == 0); 19028 if (usable_r < 0) { 19029 /* 19030 * The receiver has shrunk the window and we have sent 19031 * -usable_r date beyond the window, re-adjust. 19032 * 19033 * If TCP window scaling is enabled, there can be 19034 * round down error as the advertised receive window 19035 * is actually right shifted n bits. This means that 19036 * the lower n bits info is wiped out. It will look 19037 * like the window is shrunk. Do a check here to 19038 * see if the shrunk amount is actually within the 19039 * error in window calculation. If it is, just 19040 * return. Note that this check is inside the 19041 * shrunk window check. This makes sure that even 19042 * though tcp_process_shrunk_swnd() is not called, 19043 * we will stop further processing. 19044 */ 19045 if ((-usable_r >> tcp->tcp_snd_ws) > 0) { 19046 tcp_process_shrunk_swnd(tcp, -usable_r); 19047 } 19048 return; 19049 } 19050 19051 /* usable = MIN(swnd, cwnd) - unacked_bytes */ 19052 if (tcp->tcp_swnd > tcp->tcp_cwnd) 19053 usable_r -= tcp->tcp_swnd - tcp->tcp_cwnd; 19054 19055 /* usable = MIN(usable, unsent) */ 19056 if (usable_r > len) 19057 usable_r = len; 19058 19059 /* usable = MAX(usable, {1 for urgent, 0 for data}) */ 19060 if (usable_r > 0) { 19061 usable = usable_r; 19062 } else { 19063 /* Bypass all other unnecessary processing. */ 19064 goto done; 19065 } 19066 } 19067 19068 local_time = (mblk_t *)lbolt; 19069 19070 /* 19071 * "Our" Nagle Algorithm. This is not the same as in the old 19072 * BSD. This is more in line with the true intent of Nagle. 19073 * 19074 * The conditions are: 19075 * 1. The amount of unsent data (or amount of data which can be 19076 * sent, whichever is smaller) is less than Nagle limit. 19077 * 2. The last sent size is also less than Nagle limit. 19078 * 3. There is unack'ed data. 19079 * 4. Urgent pointer is not set. Send urgent data ignoring the 19080 * Nagle algorithm. This reduces the probability that urgent 19081 * bytes get "merged" together. 19082 * 5. The app has not closed the connection. This eliminates the 19083 * wait time of the receiving side waiting for the last piece of 19084 * (small) data. 19085 * 19086 * If all are satisified, exit without sending anything. Note 19087 * that Nagle limit can be smaller than 1 MSS. Nagle limit is 19088 * the smaller of 1 MSS and global tcp_naglim_def (default to be 19089 * 4095). 19090 */ 19091 if (usable < (int)tcp->tcp_naglim && 19092 tcp->tcp_naglim > tcp->tcp_last_sent_len && 19093 snxt != tcp->tcp_suna && 19094 !(tcp->tcp_valid_bits & TCP_URG_VALID) && 19095 !(tcp->tcp_valid_bits & TCP_FSS_VALID)) { 19096 goto done; 19097 } 19098 19099 if (tcp->tcp_cork) { 19100 /* 19101 * if the tcp->tcp_cork option is set, then we have to force 19102 * TCP not to send partial segment (smaller than MSS bytes). 19103 * We are calculating the usable now based on full mss and 19104 * will save the rest of remaining data for later. 19105 */ 19106 if (usable < mss) 19107 goto done; 19108 usable = (usable / mss) * mss; 19109 } 19110 19111 /* Update the latest receive window size in TCP header. */ 19112 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 19113 tcp->tcp_tcph->th_win); 19114 19115 /* 19116 * Determine if it's worthwhile to attempt MDT, based on: 19117 * 19118 * 1. Simple TCP/IP{v4,v6} (no options). 19119 * 2. IPSEC/IPQoS processing is not needed for the TCP connection. 19120 * 3. If the TCP connection is in ESTABLISHED state. 19121 * 4. The TCP is not detached. 19122 * 19123 * If any of the above conditions have changed during the 19124 * connection, stop using MDT and restore the stream head 19125 * parameters accordingly. 19126 */ 19127 if (tcp->tcp_mdt && 19128 ((tcp->tcp_ipversion == IPV4_VERSION && 19129 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 19130 (tcp->tcp_ipversion == IPV6_VERSION && 19131 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN) || 19132 tcp->tcp_state != TCPS_ESTABLISHED || 19133 TCP_IS_DETACHED(tcp) || !CONN_IS_MD_FASTPATH(tcp->tcp_connp) || 19134 CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp) || 19135 IPP_ENABLED(IPP_LOCAL_OUT))) { 19136 tcp->tcp_connp->conn_mdt_ok = B_FALSE; 19137 tcp->tcp_mdt = B_FALSE; 19138 19139 /* Anything other than detached is considered pathological */ 19140 if (!TCP_IS_DETACHED(tcp)) { 19141 TCP_STAT(tcp_mdt_conn_halted1); 19142 (void) tcp_maxpsz_set(tcp, B_TRUE); 19143 } 19144 } 19145 19146 /* Use MDT if sendable amount is greater than the threshold */ 19147 if (tcp->tcp_mdt && 19148 (mdt_thres = mss << tcp_mdt_smss_threshold, usable > mdt_thres) && 19149 (tail_unsent > mdt_thres || (xmit_tail->b_cont != NULL && 19150 MBLKL(xmit_tail->b_cont) > mdt_thres)) && 19151 (tcp->tcp_valid_bits == 0 || 19152 tcp->tcp_valid_bits == TCP_FSS_VALID)) { 19153 ASSERT(tcp->tcp_connp->conn_mdt_ok); 19154 rc = tcp_multisend(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 19155 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 19156 local_time, mdt_thres); 19157 } else { 19158 rc = tcp_send(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 19159 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 19160 local_time, INT_MAX); 19161 } 19162 19163 /* Pretend that all we were trying to send really got sent */ 19164 if (rc < 0 && tail_unsent < 0) { 19165 do { 19166 xmit_tail = xmit_tail->b_cont; 19167 xmit_tail->b_prev = local_time; 19168 ASSERT((uintptr_t)(xmit_tail->b_wptr - 19169 xmit_tail->b_rptr) <= (uintptr_t)INT_MAX); 19170 tail_unsent += (int)(xmit_tail->b_wptr - 19171 xmit_tail->b_rptr); 19172 } while (tail_unsent < 0); 19173 } 19174 done:; 19175 tcp->tcp_xmit_tail = xmit_tail; 19176 tcp->tcp_xmit_tail_unsent = tail_unsent; 19177 len = tcp->tcp_snxt - snxt; 19178 if (len) { 19179 /* 19180 * If new data was sent, need to update the notsack 19181 * list, which is, afterall, data blocks that have 19182 * not been sack'ed by the receiver. New data is 19183 * not sack'ed. 19184 */ 19185 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 19186 /* len is a negative value. */ 19187 tcp->tcp_pipe -= len; 19188 tcp_notsack_update(&(tcp->tcp_notsack_list), 19189 tcp->tcp_snxt, snxt, 19190 &(tcp->tcp_num_notsack_blk), 19191 &(tcp->tcp_cnt_notsack_list)); 19192 } 19193 tcp->tcp_snxt = snxt + tcp->tcp_fin_sent; 19194 tcp->tcp_rack = tcp->tcp_rnxt; 19195 tcp->tcp_rack_cnt = 0; 19196 if ((snxt + len) == tcp->tcp_suna) { 19197 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 19198 } 19199 } else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) { 19200 /* 19201 * Didn't send anything. Make sure the timer is running 19202 * so that we will probe a zero window. 19203 */ 19204 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 19205 } 19206 /* Note that len is the amount we just sent but with a negative sign */ 19207 len += tcp->tcp_unsent; 19208 tcp->tcp_unsent = len; 19209 if (tcp->tcp_flow_stopped) { 19210 if (len <= tcp->tcp_xmit_lowater) { 19211 tcp->tcp_flow_stopped = B_FALSE; 19212 tcp_clrqfull(tcp); 19213 } 19214 } else if (len >= tcp->tcp_xmit_hiwater) { 19215 tcp->tcp_flow_stopped = B_TRUE; 19216 tcp_setqfull(tcp); 19217 } 19218 } 19219 19220 /* 19221 * tcp_fill_header is called by tcp_send() and tcp_multisend() to fill the 19222 * outgoing TCP header with the template header, as well as other 19223 * options such as time-stamp, ECN and/or SACK. 19224 */ 19225 static void 19226 tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk) 19227 { 19228 tcph_t *tcp_tmpl, *tcp_h; 19229 uint32_t *dst, *src; 19230 int hdrlen; 19231 19232 ASSERT(OK_32PTR(rptr)); 19233 19234 /* Template header */ 19235 tcp_tmpl = tcp->tcp_tcph; 19236 19237 /* Header of outgoing packet */ 19238 tcp_h = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 19239 19240 /* dst and src are opaque 32-bit fields, used for copying */ 19241 dst = (uint32_t *)rptr; 19242 src = (uint32_t *)tcp->tcp_iphc; 19243 hdrlen = tcp->tcp_hdr_len; 19244 19245 /* Fill time-stamp option if needed */ 19246 if (tcp->tcp_snd_ts_ok) { 19247 U32_TO_BE32((uint32_t)now, 19248 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 4); 19249 U32_TO_BE32(tcp->tcp_ts_recent, 19250 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 8); 19251 } else { 19252 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 19253 } 19254 19255 /* 19256 * Copy the template header; is this really more efficient than 19257 * calling bcopy()? For simple IPv4/TCP, it may be the case, 19258 * but perhaps not for other scenarios. 19259 */ 19260 dst[0] = src[0]; 19261 dst[1] = src[1]; 19262 dst[2] = src[2]; 19263 dst[3] = src[3]; 19264 dst[4] = src[4]; 19265 dst[5] = src[5]; 19266 dst[6] = src[6]; 19267 dst[7] = src[7]; 19268 dst[8] = src[8]; 19269 dst[9] = src[9]; 19270 if (hdrlen -= 40) { 19271 hdrlen >>= 2; 19272 dst += 10; 19273 src += 10; 19274 do { 19275 *dst++ = *src++; 19276 } while (--hdrlen); 19277 } 19278 19279 /* 19280 * Set the ECN info in the TCP header if it is not a zero 19281 * window probe. Zero window probe is only sent in 19282 * tcp_wput_data() and tcp_timer(). 19283 */ 19284 if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) { 19285 SET_ECT(tcp, rptr); 19286 19287 if (tcp->tcp_ecn_echo_on) 19288 tcp_h->th_flags[0] |= TH_ECE; 19289 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 19290 tcp_h->th_flags[0] |= TH_CWR; 19291 tcp->tcp_ecn_cwr_sent = B_TRUE; 19292 } 19293 } 19294 19295 /* Fill in SACK options */ 19296 if (num_sack_blk > 0) { 19297 uchar_t *wptr = rptr + tcp->tcp_hdr_len; 19298 sack_blk_t *tmp; 19299 int32_t i; 19300 19301 wptr[0] = TCPOPT_NOP; 19302 wptr[1] = TCPOPT_NOP; 19303 wptr[2] = TCPOPT_SACK; 19304 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 19305 sizeof (sack_blk_t); 19306 wptr += TCPOPT_REAL_SACK_LEN; 19307 19308 tmp = tcp->tcp_sack_list; 19309 for (i = 0; i < num_sack_blk; i++) { 19310 U32_TO_BE32(tmp[i].begin, wptr); 19311 wptr += sizeof (tcp_seq); 19312 U32_TO_BE32(tmp[i].end, wptr); 19313 wptr += sizeof (tcp_seq); 19314 } 19315 tcp_h->th_offset_and_rsrvd[0] += 19316 ((num_sack_blk * 2 + 1) << 4); 19317 } 19318 } 19319 19320 /* 19321 * tcp_mdt_add_attrs() is called by tcp_multisend() in order to attach 19322 * the destination address and SAP attribute, and if necessary, the 19323 * hardware checksum offload attribute to a Multidata message. 19324 */ 19325 static int 19326 tcp_mdt_add_attrs(multidata_t *mmd, const mblk_t *dlmp, const boolean_t hwcksum, 19327 const uint32_t start, const uint32_t stuff, const uint32_t end, 19328 const uint32_t flags) 19329 { 19330 /* Add global destination address & SAP attribute */ 19331 if (dlmp == NULL || !ip_md_addr_attr(mmd, NULL, dlmp)) { 19332 ip1dbg(("tcp_mdt_add_attrs: can't add global physical " 19333 "destination address+SAP\n")); 19334 19335 if (dlmp != NULL) 19336 TCP_STAT(tcp_mdt_allocfail); 19337 return (-1); 19338 } 19339 19340 /* Add global hwcksum attribute */ 19341 if (hwcksum && 19342 !ip_md_hcksum_attr(mmd, NULL, start, stuff, end, flags)) { 19343 ip1dbg(("tcp_mdt_add_attrs: can't add global hardware " 19344 "checksum attribute\n")); 19345 19346 TCP_STAT(tcp_mdt_allocfail); 19347 return (-1); 19348 } 19349 19350 return (0); 19351 } 19352 19353 /* 19354 * tcp_multisend() is called by tcp_wput_data() for Multidata Transmit 19355 * scheme, and returns one the following: 19356 * 19357 * -1 = failed allocation. 19358 * 0 = success; burst count reached, or usable send window is too small, 19359 * and that we'd rather wait until later before sending again. 19360 */ 19361 static int 19362 tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 19363 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 19364 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 19365 const int mdt_thres) 19366 { 19367 mblk_t *md_mp_head, *md_mp, *md_pbuf, *md_pbuf_nxt, *md_hbuf; 19368 multidata_t *mmd; 19369 uint_t obsegs, obbytes, hdr_frag_sz; 19370 uint_t cur_hdr_off, cur_pld_off, base_pld_off, first_snxt; 19371 int num_burst_seg, max_pld; 19372 pdesc_t *pkt; 19373 tcp_pdescinfo_t tcp_pkt_info; 19374 pdescinfo_t *pkt_info; 19375 int pbuf_idx, pbuf_idx_nxt; 19376 int seg_len, len, spill, af; 19377 boolean_t add_buffer, zcopy, clusterwide; 19378 boolean_t rconfirm = B_FALSE; 19379 boolean_t done = B_FALSE; 19380 uint32_t cksum; 19381 uint32_t hwcksum_flags; 19382 ire_t *ire; 19383 ill_t *ill; 19384 ipha_t *ipha; 19385 ip6_t *ip6h; 19386 ipaddr_t src, dst; 19387 ill_zerocopy_capab_t *zc_cap = NULL; 19388 uint16_t *up; 19389 int err; 19390 19391 #ifdef _BIG_ENDIAN 19392 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 28) & 0x7) 19393 #else 19394 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 4) & 0x7) 19395 #endif 19396 19397 #define TCP_CSUM_OFFSET 16 19398 #define TCP_CSUM_SIZE 2 19399 19400 #define PREP_NEW_MULTIDATA() { \ 19401 mmd = NULL; \ 19402 md_mp = md_hbuf = NULL; \ 19403 cur_hdr_off = 0; \ 19404 max_pld = tcp->tcp_mdt_max_pld; \ 19405 pbuf_idx = pbuf_idx_nxt = -1; \ 19406 add_buffer = B_TRUE; \ 19407 zcopy = B_FALSE; \ 19408 } 19409 19410 #define PREP_NEW_PBUF() { \ 19411 md_pbuf = md_pbuf_nxt = NULL; \ 19412 pbuf_idx = pbuf_idx_nxt = -1; \ 19413 cur_pld_off = 0; \ 19414 first_snxt = *snxt; \ 19415 ASSERT(*tail_unsent > 0); \ 19416 base_pld_off = MBLKL(*xmit_tail) - *tail_unsent; \ 19417 } 19418 19419 ASSERT(mdt_thres >= mss); 19420 ASSERT(*usable > 0 && *usable > mdt_thres); 19421 ASSERT(tcp->tcp_state == TCPS_ESTABLISHED); 19422 ASSERT(!TCP_IS_DETACHED(tcp)); 19423 ASSERT(tcp->tcp_valid_bits == 0 || 19424 tcp->tcp_valid_bits == TCP_FSS_VALID); 19425 ASSERT((tcp->tcp_ipversion == IPV4_VERSION && 19426 tcp->tcp_ip_hdr_len == IP_SIMPLE_HDR_LENGTH) || 19427 (tcp->tcp_ipversion == IPV6_VERSION && 19428 tcp->tcp_ip_hdr_len == IPV6_HDR_LEN)); 19429 ASSERT(tcp->tcp_connp != NULL); 19430 ASSERT(CONN_IS_MD_FASTPATH(tcp->tcp_connp)); 19431 ASSERT(!CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp)); 19432 19433 /* 19434 * Note that tcp will only declare at most 2 payload spans per 19435 * packet, which is much lower than the maximum allowable number 19436 * of packet spans per Multidata. For this reason, we use the 19437 * privately declared and smaller descriptor info structure, in 19438 * order to save some stack space. 19439 */ 19440 pkt_info = (pdescinfo_t *)&tcp_pkt_info; 19441 19442 af = (tcp->tcp_ipversion == IPV4_VERSION) ? AF_INET : AF_INET6; 19443 if (af == AF_INET) { 19444 dst = tcp->tcp_ipha->ipha_dst; 19445 src = tcp->tcp_ipha->ipha_src; 19446 ASSERT(!CLASSD(dst)); 19447 } 19448 ASSERT(af == AF_INET || 19449 !IN6_IS_ADDR_MULTICAST(&tcp->tcp_ip6h->ip6_dst)); 19450 19451 obsegs = obbytes = 0; 19452 num_burst_seg = tcp->tcp_snd_burst; 19453 md_mp_head = NULL; 19454 PREP_NEW_MULTIDATA(); 19455 19456 /* 19457 * Before we go on further, make sure there is an IRE that we can 19458 * use, and that the ILL supports MDT. Otherwise, there's no point 19459 * in proceeding any further, and we should just hand everything 19460 * off to the legacy path. 19461 */ 19462 mutex_enter(&tcp->tcp_connp->conn_lock); 19463 ire = tcp->tcp_connp->conn_ire_cache; 19464 ASSERT(!(tcp->tcp_connp->conn_state_flags & CONN_INCIPIENT)); 19465 if (ire != NULL && ((af == AF_INET && ire->ire_addr == dst) || 19466 (af == AF_INET6 && IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, 19467 &tcp->tcp_ip6h->ip6_dst))) && 19468 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19469 IRE_REFHOLD(ire); 19470 mutex_exit(&tcp->tcp_connp->conn_lock); 19471 } else { 19472 boolean_t cached = B_FALSE; 19473 19474 /* force a recheck later on */ 19475 tcp->tcp_ire_ill_check_done = B_FALSE; 19476 19477 TCP_DBGSTAT(tcp_ire_null1); 19478 tcp->tcp_connp->conn_ire_cache = NULL; 19479 mutex_exit(&tcp->tcp_connp->conn_lock); 19480 19481 /* Release the old ire */ 19482 if (ire != NULL) 19483 IRE_REFRELE_NOTR(ire); 19484 19485 ire = (af == AF_INET) ? 19486 ire_cache_lookup(dst, tcp->tcp_connp->conn_zoneid) : 19487 ire_cache_lookup_v6(&tcp->tcp_ip6h->ip6_dst, 19488 tcp->tcp_connp->conn_zoneid); 19489 19490 if (ire == NULL) { 19491 TCP_STAT(tcp_ire_null); 19492 goto legacy_send_no_md; 19493 } 19494 19495 IRE_REFHOLD_NOTR(ire); 19496 /* 19497 * Since we are inside the squeue, there cannot be another 19498 * thread in TCP trying to set the conn_ire_cache now. The 19499 * check for IRE_MARK_CONDEMNED ensures that an interface 19500 * unplumb thread has not yet started cleaning up the conns. 19501 * Hence we don't need to grab the conn lock. 19502 */ 19503 if (!(tcp->tcp_connp->conn_state_flags & CONN_CLOSING)) { 19504 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 19505 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19506 tcp->tcp_connp->conn_ire_cache = ire; 19507 cached = B_TRUE; 19508 } 19509 rw_exit(&ire->ire_bucket->irb_lock); 19510 } 19511 19512 /* 19513 * We can continue to use the ire but since it was not 19514 * cached, we should drop the extra reference. 19515 */ 19516 if (!cached) 19517 IRE_REFRELE_NOTR(ire); 19518 } 19519 19520 ASSERT(ire != NULL); 19521 ASSERT(af != AF_INET || ire->ire_ipversion == IPV4_VERSION); 19522 ASSERT(af == AF_INET || !IN6_IS_ADDR_V4MAPPED(&(ire->ire_addr_v6))); 19523 ASSERT(af == AF_INET || ire->ire_nce != NULL); 19524 ASSERT(!(ire->ire_type & IRE_BROADCAST)); 19525 /* 19526 * If we do support loopback for MDT (which requires modifications 19527 * to the receiving paths), the following assertions should go away, 19528 * and we would be sending the Multidata to loopback conn later on. 19529 */ 19530 ASSERT(!IRE_IS_LOCAL(ire)); 19531 ASSERT(ire->ire_stq != NULL); 19532 19533 ill = ire_to_ill(ire); 19534 ASSERT(ill != NULL); 19535 ASSERT((ill->ill_capabilities & ILL_CAPAB_MDT) == 0 || 19536 ill->ill_mdt_capab != NULL); 19537 19538 if (!tcp->tcp_ire_ill_check_done) { 19539 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 19540 tcp->tcp_ire_ill_check_done = B_TRUE; 19541 } 19542 19543 /* 19544 * If the underlying interface conditions have changed, or if the 19545 * new interface does not support MDT, go back to legacy path. 19546 */ 19547 if (!ILL_MDT_USABLE(ill) || (ire->ire_flags & RTF_MULTIRT) != 0) { 19548 /* don't go through this path anymore for this connection */ 19549 TCP_STAT(tcp_mdt_conn_halted2); 19550 tcp->tcp_mdt = B_FALSE; 19551 ip1dbg(("tcp_multisend: disabling MDT for connp %p on " 19552 "interface %s\n", (void *)tcp->tcp_connp, ill->ill_name)); 19553 /* IRE will be released prior to returning */ 19554 goto legacy_send_no_md; 19555 } 19556 19557 if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) 19558 zc_cap = ill->ill_zerocopy_capab; 19559 19560 /* go to legacy path if interface doesn't support zerocopy */ 19561 if (tcp->tcp_snd_zcopy_aware && do_tcpzcopy != 2 && 19562 (zc_cap == NULL || zc_cap->ill_zerocopy_flags == 0)) { 19563 /* IRE will be released prior to returning */ 19564 goto legacy_send_no_md; 19565 } 19566 19567 /* does the interface support hardware checksum offload? */ 19568 hwcksum_flags = 0; 19569 if ((ill->ill_capabilities & ILL_CAPAB_HCKSUM) && 19570 (ill->ill_hcksum_capab->ill_hcksum_txflags & 19571 (HCKSUM_INET_FULL_V4 | HCKSUM_INET_PARTIAL | HCKSUM_IPHDRCKSUM)) && 19572 dohwcksum) { 19573 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19574 HCKSUM_IPHDRCKSUM) 19575 hwcksum_flags = HCK_IPV4_HDRCKSUM; 19576 19577 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19578 HCKSUM_INET_FULL_V4) 19579 hwcksum_flags |= HCK_FULLCKSUM; 19580 else if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19581 HCKSUM_INET_PARTIAL) 19582 hwcksum_flags |= HCK_PARTIALCKSUM; 19583 } 19584 19585 /* 19586 * Each header fragment consists of the leading extra space, 19587 * followed by the TCP/IP header, and the trailing extra space. 19588 * We make sure that each header fragment begins on a 32-bit 19589 * aligned memory address (tcp_mdt_hdr_head is already 32-bit 19590 * aligned in tcp_mdt_update). 19591 */ 19592 hdr_frag_sz = roundup((tcp->tcp_mdt_hdr_head + tcp_hdr_len + 19593 tcp->tcp_mdt_hdr_tail), 4); 19594 19595 /* are we starting from the beginning of data block? */ 19596 if (*tail_unsent == 0) { 19597 *xmit_tail = (*xmit_tail)->b_cont; 19598 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= (uintptr_t)INT_MAX); 19599 *tail_unsent = (int)MBLKL(*xmit_tail); 19600 } 19601 19602 /* 19603 * Here we create one or more Multidata messages, each made up of 19604 * one header buffer and up to N payload buffers. This entire 19605 * operation is done within two loops: 19606 * 19607 * The outer loop mostly deals with creating the Multidata message, 19608 * as well as the header buffer that gets added to it. It also 19609 * links the Multidata messages together such that all of them can 19610 * be sent down to the lower layer in a single putnext call; this 19611 * linking behavior depends on the tcp_mdt_chain tunable. 19612 * 19613 * The inner loop takes an existing Multidata message, and adds 19614 * one or more (up to tcp_mdt_max_pld) payload buffers to it. It 19615 * packetizes those buffers by filling up the corresponding header 19616 * buffer fragments with the proper IP and TCP headers, and by 19617 * describing the layout of each packet in the packet descriptors 19618 * that get added to the Multidata. 19619 */ 19620 do { 19621 /* 19622 * If usable send window is too small, or data blocks in 19623 * transmit list are smaller than our threshold (i.e. app 19624 * performs large writes followed by small ones), we hand 19625 * off the control over to the legacy path. Note that we'll 19626 * get back the control once it encounters a large block. 19627 */ 19628 if (*usable < mss || (*tail_unsent <= mdt_thres && 19629 (*xmit_tail)->b_cont != NULL && 19630 MBLKL((*xmit_tail)->b_cont) <= mdt_thres)) { 19631 /* send down what we've got so far */ 19632 if (md_mp_head != NULL) { 19633 tcp_multisend_data(tcp, ire, ill, md_mp_head, 19634 obsegs, obbytes, &rconfirm); 19635 } 19636 /* 19637 * Pass control over to tcp_send(), but tell it to 19638 * return to us once a large-size transmission is 19639 * possible. 19640 */ 19641 TCP_STAT(tcp_mdt_legacy_small); 19642 if ((err = tcp_send(q, tcp, mss, tcp_hdr_len, 19643 tcp_tcp_hdr_len, num_sack_blk, usable, snxt, 19644 tail_unsent, xmit_tail, local_time, 19645 mdt_thres)) <= 0) { 19646 /* burst count reached, or alloc failed */ 19647 IRE_REFRELE(ire); 19648 return (err); 19649 } 19650 19651 /* tcp_send() may have sent everything, so check */ 19652 if (*usable <= 0) { 19653 IRE_REFRELE(ire); 19654 return (0); 19655 } 19656 19657 TCP_STAT(tcp_mdt_legacy_ret); 19658 /* 19659 * We may have delivered the Multidata, so make sure 19660 * to re-initialize before the next round. 19661 */ 19662 md_mp_head = NULL; 19663 obsegs = obbytes = 0; 19664 num_burst_seg = tcp->tcp_snd_burst; 19665 PREP_NEW_MULTIDATA(); 19666 19667 /* are we starting from the beginning of data block? */ 19668 if (*tail_unsent == 0) { 19669 *xmit_tail = (*xmit_tail)->b_cont; 19670 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 19671 (uintptr_t)INT_MAX); 19672 *tail_unsent = (int)MBLKL(*xmit_tail); 19673 } 19674 } 19675 19676 /* 19677 * max_pld limits the number of mblks in tcp's transmit 19678 * queue that can be added to a Multidata message. Once 19679 * this counter reaches zero, no more additional mblks 19680 * can be added to it. What happens afterwards depends 19681 * on whether or not we are set to chain the Multidata 19682 * messages. If we are to link them together, reset 19683 * max_pld to its original value (tcp_mdt_max_pld) and 19684 * prepare to create a new Multidata message which will 19685 * get linked to md_mp_head. Else, leave it alone and 19686 * let the inner loop break on its own. 19687 */ 19688 if (tcp_mdt_chain && max_pld == 0) 19689 PREP_NEW_MULTIDATA(); 19690 19691 /* adding a payload buffer; re-initialize values */ 19692 if (add_buffer) 19693 PREP_NEW_PBUF(); 19694 19695 /* 19696 * If we don't have a Multidata, either because we just 19697 * (re)entered this outer loop, or after we branched off 19698 * to tcp_send above, setup the Multidata and header 19699 * buffer to be used. 19700 */ 19701 if (md_mp == NULL) { 19702 int md_hbuflen; 19703 uint32_t start, stuff; 19704 19705 /* 19706 * Calculate Multidata header buffer size large enough 19707 * to hold all of the headers that can possibly be 19708 * sent at this moment. We'd rather over-estimate 19709 * the size than running out of space; this is okay 19710 * since this buffer is small anyway. 19711 */ 19712 md_hbuflen = (howmany(*usable, mss) + 1) * hdr_frag_sz; 19713 19714 /* 19715 * Start and stuff offset for partial hardware 19716 * checksum offload; these are currently for IPv4. 19717 * For full checksum offload, they are set to zero. 19718 */ 19719 if (af == AF_INET && 19720 (hwcksum_flags & HCK_PARTIALCKSUM)) { 19721 start = IP_SIMPLE_HDR_LENGTH; 19722 stuff = IP_SIMPLE_HDR_LENGTH + TCP_CSUM_OFFSET; 19723 } else { 19724 start = stuff = 0; 19725 } 19726 19727 /* 19728 * Create the header buffer, Multidata, as well as 19729 * any necessary attributes (destination address, 19730 * SAP and hardware checksum offload) that should 19731 * be associated with the Multidata message. 19732 */ 19733 ASSERT(cur_hdr_off == 0); 19734 if ((md_hbuf = allocb(md_hbuflen, BPRI_HI)) == NULL || 19735 ((md_hbuf->b_wptr += md_hbuflen), 19736 (mmd = mmd_alloc(md_hbuf, &md_mp, 19737 KM_NOSLEEP)) == NULL) || (tcp_mdt_add_attrs(mmd, 19738 /* fastpath mblk */ 19739 (af == AF_INET) ? ire->ire_dlureq_mp : 19740 ire->ire_nce->nce_res_mp, 19741 /* hardware checksum enabled (IPv4 only) */ 19742 (af == AF_INET && hwcksum_flags != 0), 19743 /* hardware checksum offsets */ 19744 start, stuff, 0, 19745 /* hardware checksum flag */ 19746 hwcksum_flags) != 0)) { 19747 legacy_send: 19748 if (md_mp != NULL) { 19749 /* Unlink message from the chain */ 19750 if (md_mp_head != NULL) { 19751 err = (intptr_t)rmvb(md_mp_head, 19752 md_mp); 19753 /* 19754 * We can't assert that rmvb 19755 * did not return -1, since we 19756 * may get here before linkb 19757 * happens. We do, however, 19758 * check if we just removed the 19759 * only element in the list. 19760 */ 19761 if (err == 0) 19762 md_mp_head = NULL; 19763 } 19764 /* md_hbuf gets freed automatically */ 19765 TCP_STAT(tcp_mdt_discarded); 19766 freeb(md_mp); 19767 } else { 19768 /* Either allocb or mmd_alloc failed */ 19769 TCP_STAT(tcp_mdt_allocfail); 19770 if (md_hbuf != NULL) 19771 freeb(md_hbuf); 19772 } 19773 19774 /* send down what we've got so far */ 19775 if (md_mp_head != NULL) { 19776 tcp_multisend_data(tcp, ire, ill, 19777 md_mp_head, obsegs, obbytes, 19778 &rconfirm); 19779 } 19780 legacy_send_no_md: 19781 if (ire != NULL) 19782 IRE_REFRELE(ire); 19783 /* 19784 * Too bad; let the legacy path handle this. 19785 * We specify INT_MAX for the threshold, since 19786 * we gave up with the Multidata processings 19787 * and let the old path have it all. 19788 */ 19789 TCP_STAT(tcp_mdt_legacy_all); 19790 return (tcp_send(q, tcp, mss, tcp_hdr_len, 19791 tcp_tcp_hdr_len, num_sack_blk, usable, 19792 snxt, tail_unsent, xmit_tail, local_time, 19793 INT_MAX)); 19794 } 19795 19796 /* link to any existing ones, if applicable */ 19797 TCP_STAT(tcp_mdt_allocd); 19798 if (md_mp_head == NULL) { 19799 md_mp_head = md_mp; 19800 } else if (tcp_mdt_chain) { 19801 TCP_STAT(tcp_mdt_linked); 19802 linkb(md_mp_head, md_mp); 19803 } 19804 } 19805 19806 ASSERT(md_mp_head != NULL); 19807 ASSERT(tcp_mdt_chain || md_mp_head->b_cont == NULL); 19808 ASSERT(md_mp != NULL && mmd != NULL); 19809 ASSERT(md_hbuf != NULL); 19810 19811 /* 19812 * Packetize the transmittable portion of the data block; 19813 * each data block is essentially added to the Multidata 19814 * as a payload buffer. We also deal with adding more 19815 * than one payload buffers, which happens when the remaining 19816 * packetized portion of the current payload buffer is less 19817 * than MSS, while the next data block in transmit queue 19818 * has enough data to make up for one. This "spillover" 19819 * case essentially creates a split-packet, where portions 19820 * of the packet's payload fragments may span across two 19821 * virtually discontiguous address blocks. 19822 */ 19823 seg_len = mss; 19824 do { 19825 len = seg_len; 19826 19827 ASSERT(len > 0); 19828 ASSERT(max_pld >= 0); 19829 ASSERT(!add_buffer || cur_pld_off == 0); 19830 19831 /* 19832 * First time around for this payload buffer; note 19833 * in the case of a spillover, the following has 19834 * been done prior to adding the split-packet 19835 * descriptor to Multidata, and we don't want to 19836 * repeat the process. 19837 */ 19838 if (add_buffer) { 19839 ASSERT(mmd != NULL); 19840 ASSERT(md_pbuf == NULL); 19841 ASSERT(md_pbuf_nxt == NULL); 19842 ASSERT(pbuf_idx == -1 && pbuf_idx_nxt == -1); 19843 19844 /* 19845 * Have we reached the limit? We'd get to 19846 * this case when we're not chaining the 19847 * Multidata messages together, and since 19848 * we're done, terminate this loop. 19849 */ 19850 if (max_pld == 0) 19851 break; /* done */ 19852 19853 if ((md_pbuf = dupb(*xmit_tail)) == NULL) { 19854 TCP_STAT(tcp_mdt_allocfail); 19855 goto legacy_send; /* out_of_mem */ 19856 } 19857 19858 if (IS_VMLOANED_MBLK(md_pbuf) && !zcopy && 19859 zc_cap != NULL) { 19860 if (!ip_md_zcopy_attr(mmd, NULL, 19861 zc_cap->ill_zerocopy_flags)) { 19862 freeb(md_pbuf); 19863 TCP_STAT(tcp_mdt_allocfail); 19864 /* out_of_mem */ 19865 goto legacy_send; 19866 } 19867 zcopy = B_TRUE; 19868 } 19869 19870 md_pbuf->b_rptr += base_pld_off; 19871 19872 /* 19873 * Add a payload buffer to the Multidata; this 19874 * operation must not fail, or otherwise our 19875 * logic in this routine is broken. There 19876 * is no memory allocation done by the 19877 * routine, so any returned failure simply 19878 * tells us that we've done something wrong. 19879 * 19880 * A failure tells us that either we're adding 19881 * the same payload buffer more than once, or 19882 * we're trying to add more buffers than 19883 * allowed (max_pld calculation is wrong). 19884 * None of the above cases should happen, and 19885 * we panic because either there's horrible 19886 * heap corruption, and/or programming mistake. 19887 */ 19888 pbuf_idx = mmd_addpldbuf(mmd, md_pbuf); 19889 if (pbuf_idx < 0) { 19890 cmn_err(CE_PANIC, "tcp_multisend: " 19891 "payload buffer logic error " 19892 "detected for tcp %p mmd %p " 19893 "pbuf %p (%d)\n", 19894 (void *)tcp, (void *)mmd, 19895 (void *)md_pbuf, pbuf_idx); 19896 } 19897 19898 ASSERT(max_pld > 0); 19899 --max_pld; 19900 add_buffer = B_FALSE; 19901 } 19902 19903 ASSERT(md_mp_head != NULL); 19904 ASSERT(md_pbuf != NULL); 19905 ASSERT(md_pbuf_nxt == NULL); 19906 ASSERT(pbuf_idx != -1); 19907 ASSERT(pbuf_idx_nxt == -1); 19908 ASSERT(*usable > 0); 19909 19910 /* 19911 * We spillover to the next payload buffer only 19912 * if all of the following is true: 19913 * 19914 * 1. There is not enough data on the current 19915 * payload buffer to make up `len', 19916 * 2. We are allowed to send `len', 19917 * 3. The next payload buffer length is large 19918 * enough to accomodate `spill'. 19919 */ 19920 if ((spill = len - *tail_unsent) > 0 && 19921 *usable >= len && 19922 MBLKL((*xmit_tail)->b_cont) >= spill && 19923 max_pld > 0) { 19924 md_pbuf_nxt = dupb((*xmit_tail)->b_cont); 19925 if (md_pbuf_nxt == NULL) { 19926 TCP_STAT(tcp_mdt_allocfail); 19927 goto legacy_send; /* out_of_mem */ 19928 } 19929 19930 if (IS_VMLOANED_MBLK(md_pbuf_nxt) && !zcopy && 19931 zc_cap != NULL) { 19932 if (!ip_md_zcopy_attr(mmd, NULL, 19933 zc_cap->ill_zerocopy_flags)) { 19934 freeb(md_pbuf_nxt); 19935 TCP_STAT(tcp_mdt_allocfail); 19936 /* out_of_mem */ 19937 goto legacy_send; 19938 } 19939 zcopy = B_TRUE; 19940 } 19941 19942 /* 19943 * See comments above on the first call to 19944 * mmd_addpldbuf for explanation on the panic. 19945 */ 19946 pbuf_idx_nxt = mmd_addpldbuf(mmd, md_pbuf_nxt); 19947 if (pbuf_idx_nxt < 0) { 19948 panic("tcp_multisend: " 19949 "next payload buffer logic error " 19950 "detected for tcp %p mmd %p " 19951 "pbuf %p (%d)\n", 19952 (void *)tcp, (void *)mmd, 19953 (void *)md_pbuf_nxt, pbuf_idx_nxt); 19954 } 19955 19956 ASSERT(max_pld > 0); 19957 --max_pld; 19958 } else if (spill > 0) { 19959 /* 19960 * If there's a spillover, but the following 19961 * xmit_tail couldn't give us enough octets 19962 * to reach "len", then stop the current 19963 * Multidata creation and let the legacy 19964 * tcp_send() path take over. We don't want 19965 * to send the tiny segment as part of this 19966 * Multidata for performance reasons; instead, 19967 * we let the legacy path deal with grouping 19968 * it with the subsequent small mblks. 19969 */ 19970 if (*usable >= len && 19971 MBLKL((*xmit_tail)->b_cont) < spill) { 19972 max_pld = 0; 19973 break; /* done */ 19974 } 19975 19976 /* 19977 * We can't spillover, and we are near 19978 * the end of the current payload buffer, 19979 * so send what's left. 19980 */ 19981 ASSERT(*tail_unsent > 0); 19982 len = *tail_unsent; 19983 } 19984 19985 /* tail_unsent is negated if there is a spillover */ 19986 *tail_unsent -= len; 19987 *usable -= len; 19988 ASSERT(*usable >= 0); 19989 19990 if (*usable < mss) 19991 seg_len = *usable; 19992 /* 19993 * Sender SWS avoidance; see comments in tcp_send(); 19994 * everything else is the same, except that we only 19995 * do this here if there is no more data to be sent 19996 * following the current xmit_tail. We don't check 19997 * for 1-byte urgent data because we shouldn't get 19998 * here if TCP_URG_VALID is set. 19999 */ 20000 if (*usable > 0 && *usable < mss && 20001 ((md_pbuf_nxt == NULL && 20002 (*xmit_tail)->b_cont == NULL) || 20003 (md_pbuf_nxt != NULL && 20004 (*xmit_tail)->b_cont->b_cont == NULL)) && 20005 seg_len < (tcp->tcp_max_swnd >> 1) && 20006 (tcp->tcp_unsent - 20007 ((*snxt + len) - tcp->tcp_snxt)) > seg_len && 20008 !tcp->tcp_zero_win_probe) { 20009 if ((*snxt + len) == tcp->tcp_snxt && 20010 (*snxt + len) == tcp->tcp_suna) { 20011 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20012 } 20013 done = B_TRUE; 20014 } 20015 20016 /* 20017 * Prime pump for IP's checksumming on our behalf; 20018 * include the adjustment for a source route if any. 20019 * Do this only for software/partial hardware checksum 20020 * offload, as this field gets zeroed out later for 20021 * the full hardware checksum offload case. 20022 */ 20023 if (!(hwcksum_flags & HCK_FULLCKSUM)) { 20024 cksum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 20025 cksum = (cksum >> 16) + (cksum & 0xFFFF); 20026 U16_TO_ABE16(cksum, tcp->tcp_tcph->th_sum); 20027 } 20028 20029 U32_TO_ABE32(*snxt, tcp->tcp_tcph->th_seq); 20030 *snxt += len; 20031 20032 tcp->tcp_tcph->th_flags[0] = TH_ACK; 20033 /* 20034 * We set the PUSH bit only if TCP has no more buffered 20035 * data to be transmitted (or if sender SWS avoidance 20036 * takes place), as opposed to setting it for every 20037 * last packet in the burst. 20038 */ 20039 if (done || 20040 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) == 0) 20041 tcp->tcp_tcph->th_flags[0] |= TH_PUSH; 20042 20043 /* 20044 * Set FIN bit if this is our last segment; snxt 20045 * already includes its length, and it will not 20046 * be adjusted after this point. 20047 */ 20048 if (tcp->tcp_valid_bits == TCP_FSS_VALID && 20049 *snxt == tcp->tcp_fss) { 20050 if (!tcp->tcp_fin_acked) { 20051 tcp->tcp_tcph->th_flags[0] |= TH_FIN; 20052 BUMP_MIB(&tcp_mib, tcpOutControl); 20053 } 20054 if (!tcp->tcp_fin_sent) { 20055 tcp->tcp_fin_sent = B_TRUE; 20056 /* 20057 * tcp state must be ESTABLISHED 20058 * in order for us to get here in 20059 * the first place. 20060 */ 20061 tcp->tcp_state = TCPS_FIN_WAIT_1; 20062 20063 /* 20064 * Upon returning from this routine, 20065 * tcp_wput_data() will set tcp_snxt 20066 * to be equal to snxt + tcp_fin_sent. 20067 * This is essentially the same as 20068 * setting it to tcp_fss + 1. 20069 */ 20070 } 20071 } 20072 20073 tcp->tcp_last_sent_len = (ushort_t)len; 20074 20075 len += tcp_hdr_len; 20076 if (tcp->tcp_ipversion == IPV4_VERSION) 20077 tcp->tcp_ipha->ipha_length = htons(len); 20078 else 20079 tcp->tcp_ip6h->ip6_plen = htons(len - 20080 ((char *)&tcp->tcp_ip6h[1] - 20081 tcp->tcp_iphc)); 20082 20083 pkt_info->flags = (PDESC_HBUF_REF | PDESC_PBUF_REF); 20084 20085 /* setup header fragment */ 20086 PDESC_HDR_ADD(pkt_info, 20087 md_hbuf->b_rptr + cur_hdr_off, /* base */ 20088 tcp->tcp_mdt_hdr_head, /* head room */ 20089 tcp_hdr_len, /* len */ 20090 tcp->tcp_mdt_hdr_tail); /* tail room */ 20091 20092 ASSERT(pkt_info->hdr_lim - pkt_info->hdr_base == 20093 hdr_frag_sz); 20094 ASSERT(MBLKIN(md_hbuf, 20095 (pkt_info->hdr_base - md_hbuf->b_rptr), 20096 PDESC_HDRSIZE(pkt_info))); 20097 20098 /* setup first payload fragment */ 20099 PDESC_PLD_INIT(pkt_info); 20100 PDESC_PLD_SPAN_ADD(pkt_info, 20101 pbuf_idx, /* index */ 20102 md_pbuf->b_rptr + cur_pld_off, /* start */ 20103 tcp->tcp_last_sent_len); /* len */ 20104 20105 /* create a split-packet in case of a spillover */ 20106 if (md_pbuf_nxt != NULL) { 20107 ASSERT(spill > 0); 20108 ASSERT(pbuf_idx_nxt > pbuf_idx); 20109 ASSERT(!add_buffer); 20110 20111 md_pbuf = md_pbuf_nxt; 20112 md_pbuf_nxt = NULL; 20113 pbuf_idx = pbuf_idx_nxt; 20114 pbuf_idx_nxt = -1; 20115 cur_pld_off = spill; 20116 20117 /* trim out first payload fragment */ 20118 PDESC_PLD_SPAN_TRIM(pkt_info, 0, spill); 20119 20120 /* setup second payload fragment */ 20121 PDESC_PLD_SPAN_ADD(pkt_info, 20122 pbuf_idx, /* index */ 20123 md_pbuf->b_rptr, /* start */ 20124 spill); /* len */ 20125 20126 if ((*xmit_tail)->b_next == NULL) { 20127 /* 20128 * Store the lbolt used for RTT 20129 * estimation. We can only record one 20130 * timestamp per mblk so we do it when 20131 * we reach the end of the payload 20132 * buffer. Also we only take a new 20133 * timestamp sample when the previous 20134 * timed data from the same mblk has 20135 * been ack'ed. 20136 */ 20137 (*xmit_tail)->b_prev = local_time; 20138 (*xmit_tail)->b_next = 20139 (mblk_t *)(uintptr_t)first_snxt; 20140 } 20141 20142 first_snxt = *snxt - spill; 20143 20144 /* 20145 * Advance xmit_tail; usable could be 0 by 20146 * the time we got here, but we made sure 20147 * above that we would only spillover to 20148 * the next data block if usable includes 20149 * the spilled-over amount prior to the 20150 * subtraction. Therefore, we are sure 20151 * that xmit_tail->b_cont can't be NULL. 20152 */ 20153 ASSERT((*xmit_tail)->b_cont != NULL); 20154 *xmit_tail = (*xmit_tail)->b_cont; 20155 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 20156 (uintptr_t)INT_MAX); 20157 *tail_unsent = (int)MBLKL(*xmit_tail) - spill; 20158 } else { 20159 cur_pld_off += tcp->tcp_last_sent_len; 20160 } 20161 20162 /* 20163 * Fill in the header using the template header, and 20164 * add options such as time-stamp, ECN and/or SACK, 20165 * as needed. 20166 */ 20167 tcp_fill_header(tcp, pkt_info->hdr_rptr, 20168 (clock_t)local_time, num_sack_blk); 20169 20170 /* take care of some IP header businesses */ 20171 if (af == AF_INET) { 20172 ipha = (ipha_t *)pkt_info->hdr_rptr; 20173 20174 ASSERT(OK_32PTR((uchar_t *)ipha)); 20175 ASSERT(PDESC_HDRL(pkt_info) >= 20176 IP_SIMPLE_HDR_LENGTH); 20177 ASSERT(ipha->ipha_version_and_hdr_length == 20178 IP_SIMPLE_HDR_VERSION); 20179 20180 /* 20181 * Assign ident value for current packet; see 20182 * related comments in ip_wput_ire() about the 20183 * contract private interface with clustering 20184 * group. 20185 */ 20186 clusterwide = B_FALSE; 20187 if (cl_inet_ipident != NULL) { 20188 ASSERT(cl_inet_isclusterwide != NULL); 20189 if ((*cl_inet_isclusterwide)(IPPROTO_IP, 20190 AF_INET, 20191 (uint8_t *)(uintptr_t)src)) { 20192 ipha->ipha_ident = 20193 (*cl_inet_ipident) 20194 (IPPROTO_IP, AF_INET, 20195 (uint8_t *)(uintptr_t)src, 20196 (uint8_t *)(uintptr_t)dst); 20197 clusterwide = B_TRUE; 20198 } 20199 } 20200 20201 if (!clusterwide) { 20202 ipha->ipha_ident = (uint16_t) 20203 atomic_add_32_nv( 20204 &ire->ire_ident, 1); 20205 } 20206 #ifndef _BIG_ENDIAN 20207 ipha->ipha_ident = (ipha->ipha_ident << 8) | 20208 (ipha->ipha_ident >> 8); 20209 #endif 20210 } else { 20211 ip6h = (ip6_t *)pkt_info->hdr_rptr; 20212 20213 ASSERT(OK_32PTR((uchar_t *)ip6h)); 20214 ASSERT(IPVER(ip6h) == IPV6_VERSION); 20215 ASSERT(ip6h->ip6_nxt == IPPROTO_TCP); 20216 ASSERT(PDESC_HDRL(pkt_info) >= 20217 (IPV6_HDR_LEN + TCP_CSUM_OFFSET + 20218 TCP_CSUM_SIZE)); 20219 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 20220 20221 if (tcp->tcp_ip_forward_progress) { 20222 rconfirm = B_TRUE; 20223 tcp->tcp_ip_forward_progress = B_FALSE; 20224 } 20225 } 20226 20227 /* at least one payload span, and at most two */ 20228 ASSERT(pkt_info->pld_cnt > 0 && pkt_info->pld_cnt < 3); 20229 20230 /* add the packet descriptor to Multidata */ 20231 if ((pkt = mmd_addpdesc(mmd, pkt_info, &err, 20232 KM_NOSLEEP)) == NULL) { 20233 /* 20234 * Any failure other than ENOMEM indicates 20235 * that we have passed in invalid pkt_info 20236 * or parameters to mmd_addpdesc, which must 20237 * not happen. 20238 * 20239 * EINVAL is a result of failure on boundary 20240 * checks against the pkt_info contents. It 20241 * should not happen, and we panic because 20242 * either there's horrible heap corruption, 20243 * and/or programming mistake. 20244 */ 20245 if (err != ENOMEM) { 20246 cmn_err(CE_PANIC, "tcp_multisend: " 20247 "pdesc logic error detected for " 20248 "tcp %p mmd %p pinfo %p (%d)\n", 20249 (void *)tcp, (void *)mmd, 20250 (void *)pkt_info, err); 20251 } 20252 TCP_STAT(tcp_mdt_addpdescfail); 20253 goto legacy_send; /* out_of_mem */ 20254 } 20255 ASSERT(pkt != NULL); 20256 20257 /* calculate IP header and TCP checksums */ 20258 if (af == AF_INET) { 20259 /* calculate pseudo-header checksum */ 20260 cksum = (dst >> 16) + (dst & 0xFFFF) + 20261 (src >> 16) + (src & 0xFFFF); 20262 20263 /* offset for TCP header checksum */ 20264 up = IPH_TCPH_CHECKSUMP(ipha, 20265 IP_SIMPLE_HDR_LENGTH); 20266 20267 if (hwcksum_flags & HCK_FULLCKSUM) { 20268 /* 20269 * Hardware calculates pseudo-header, 20270 * header and payload checksums, so 20271 * zero out this field. 20272 */ 20273 *up = 0; 20274 } else if (hwcksum_flags & HCK_PARTIALCKSUM) { 20275 uint32_t sum; 20276 20277 /* pseudo-header checksumming */ 20278 sum = *up + cksum + IP_TCP_CSUM_COMP; 20279 sum = (sum & 0xFFFF) + (sum >> 16); 20280 *up = (sum & 0xFFFF) + (sum >> 16); 20281 } else { 20282 /* software checksumming */ 20283 TCP_STAT(tcp_out_sw_cksum); 20284 *up = IP_MD_CSUM(pkt, 20285 IP_SIMPLE_HDR_LENGTH, 20286 cksum + IP_TCP_CSUM_COMP); 20287 } 20288 20289 ipha->ipha_fragment_offset_and_flags |= 20290 (uint32_t)htons(ire->ire_frag_flag); 20291 20292 if (hwcksum_flags & HCK_IPV4_HDRCKSUM) { 20293 ipha->ipha_hdr_checksum = 0; 20294 } else { 20295 IP_HDR_CKSUM(ipha, cksum, 20296 ((uint32_t *)ipha)[0], 20297 ((uint16_t *)ipha)[4]); 20298 } 20299 } else { 20300 up = (uint16_t *)(((uchar_t *)ip6h) + 20301 IPV6_HDR_LEN + TCP_CSUM_OFFSET); 20302 20303 /* 20304 * Software checksumming (hardware checksum 20305 * offload for IPv6 will hopefully be 20306 * implemented one day). 20307 */ 20308 TCP_STAT(tcp_out_sw_cksum); 20309 *up = IP_MD_CSUM(pkt, 20310 IPV6_HDR_LEN - 2 * sizeof (in6_addr_t), 20311 htons(IPPROTO_TCP)); 20312 } 20313 20314 /* advance header offset */ 20315 cur_hdr_off += hdr_frag_sz; 20316 20317 obbytes += tcp->tcp_last_sent_len; 20318 ++obsegs; 20319 } while (!done && *usable > 0 && --num_burst_seg > 0 && 20320 *tail_unsent > 0); 20321 20322 if ((*xmit_tail)->b_next == NULL) { 20323 /* 20324 * Store the lbolt used for RTT estimation. We can only 20325 * record one timestamp per mblk so we do it when we 20326 * reach the end of the payload buffer. Also we only 20327 * take a new timestamp sample when the previous timed 20328 * data from the same mblk has been ack'ed. 20329 */ 20330 (*xmit_tail)->b_prev = local_time; 20331 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)first_snxt; 20332 } 20333 20334 ASSERT(*tail_unsent >= 0); 20335 if (*tail_unsent > 0) { 20336 /* 20337 * We got here because we broke out of the above 20338 * loop due to of one of the following cases: 20339 * 20340 * 1. len < adjusted MSS (i.e. small), 20341 * 2. Sender SWS avoidance, 20342 * 3. max_pld is zero. 20343 * 20344 * We are done for this Multidata, so trim our 20345 * last payload buffer (if any) accordingly. 20346 */ 20347 if (md_pbuf != NULL) 20348 md_pbuf->b_wptr -= *tail_unsent; 20349 } else if (*usable > 0) { 20350 *xmit_tail = (*xmit_tail)->b_cont; 20351 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 20352 (uintptr_t)INT_MAX); 20353 *tail_unsent = (int)MBLKL(*xmit_tail); 20354 add_buffer = B_TRUE; 20355 } 20356 } while (!done && *usable > 0 && num_burst_seg > 0 && 20357 (tcp_mdt_chain || max_pld > 0)); 20358 20359 /* send everything down */ 20360 tcp_multisend_data(tcp, ire, ill, md_mp_head, obsegs, obbytes, 20361 &rconfirm); 20362 20363 #undef PREP_NEW_MULTIDATA 20364 #undef PREP_NEW_PBUF 20365 #undef IPVER 20366 #undef TCP_CSUM_OFFSET 20367 #undef TCP_CSUM_SIZE 20368 20369 IRE_REFRELE(ire); 20370 return (0); 20371 } 20372 20373 /* 20374 * A wrapper function for sending one or more Multidata messages down to 20375 * the module below ip; this routine does not release the reference of the 20376 * IRE (caller does that). This routine is analogous to tcp_send_data(). 20377 */ 20378 static void 20379 tcp_multisend_data(tcp_t *tcp, ire_t *ire, const ill_t *ill, mblk_t *md_mp_head, 20380 const uint_t obsegs, const uint_t obbytes, boolean_t *rconfirm) 20381 { 20382 uint64_t delta; 20383 nce_t *nce; 20384 20385 ASSERT(ire != NULL && ill != NULL); 20386 ASSERT(ire->ire_stq != NULL); 20387 ASSERT(md_mp_head != NULL); 20388 ASSERT(rconfirm != NULL); 20389 20390 /* adjust MIBs and IRE timestamp */ 20391 TCP_RECORD_TRACE(tcp, md_mp_head, TCP_TRACE_SEND_PKT); 20392 tcp->tcp_obsegs += obsegs; 20393 UPDATE_MIB(&tcp_mib, tcpOutDataSegs, obsegs); 20394 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, obbytes); 20395 TCP_STAT_UPDATE(tcp_mdt_pkt_out, obsegs); 20396 20397 if (tcp->tcp_ipversion == IPV4_VERSION) { 20398 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v4, obsegs); 20399 UPDATE_MIB(&ip_mib, ipOutRequests, obsegs); 20400 } else { 20401 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v6, obsegs); 20402 UPDATE_MIB(&ip6_mib, ipv6OutRequests, obsegs); 20403 } 20404 20405 ire->ire_ob_pkt_count += obsegs; 20406 if (ire->ire_ipif != NULL) 20407 atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, obsegs); 20408 ire->ire_last_used_time = lbolt; 20409 20410 /* send it down */ 20411 putnext(ire->ire_stq, md_mp_head); 20412 20413 /* we're done for TCP/IPv4 */ 20414 if (tcp->tcp_ipversion == IPV4_VERSION) 20415 return; 20416 20417 nce = ire->ire_nce; 20418 20419 ASSERT(nce != NULL); 20420 ASSERT(!(nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT))); 20421 ASSERT(nce->nce_state != ND_INCOMPLETE); 20422 20423 /* reachability confirmation? */ 20424 if (*rconfirm) { 20425 nce->nce_last = TICK_TO_MSEC(lbolt64); 20426 if (nce->nce_state != ND_REACHABLE) { 20427 mutex_enter(&nce->nce_lock); 20428 nce->nce_state = ND_REACHABLE; 20429 nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT; 20430 mutex_exit(&nce->nce_lock); 20431 (void) untimeout(nce->nce_timeout_id); 20432 if (ip_debug > 2) { 20433 /* ip1dbg */ 20434 pr_addr_dbg("tcp_multisend_data: state " 20435 "for %s changed to REACHABLE\n", 20436 AF_INET6, &ire->ire_addr_v6); 20437 } 20438 } 20439 /* reset transport reachability confirmation */ 20440 *rconfirm = B_FALSE; 20441 } 20442 20443 delta = TICK_TO_MSEC(lbolt64) - nce->nce_last; 20444 ip1dbg(("tcp_multisend_data: delta = %" PRId64 20445 " ill_reachable_time = %d \n", delta, ill->ill_reachable_time)); 20446 20447 if (delta > (uint64_t)ill->ill_reachable_time) { 20448 mutex_enter(&nce->nce_lock); 20449 switch (nce->nce_state) { 20450 case ND_REACHABLE: 20451 case ND_STALE: 20452 /* 20453 * ND_REACHABLE is identical to ND_STALE in this 20454 * specific case. If reachable time has expired for 20455 * this neighbor (delta is greater than reachable 20456 * time), conceptually, the neighbor cache is no 20457 * longer in REACHABLE state, but already in STALE 20458 * state. So the correct transition here is to 20459 * ND_DELAY. 20460 */ 20461 nce->nce_state = ND_DELAY; 20462 mutex_exit(&nce->nce_lock); 20463 NDP_RESTART_TIMER(nce, delay_first_probe_time); 20464 if (ip_debug > 3) { 20465 /* ip2dbg */ 20466 pr_addr_dbg("tcp_multisend_data: state " 20467 "for %s changed to DELAY\n", 20468 AF_INET6, &ire->ire_addr_v6); 20469 } 20470 break; 20471 case ND_DELAY: 20472 case ND_PROBE: 20473 mutex_exit(&nce->nce_lock); 20474 /* Timers have already started */ 20475 break; 20476 case ND_UNREACHABLE: 20477 /* 20478 * ndp timer has detected that this nce is 20479 * unreachable and initiated deleting this nce 20480 * and all its associated IREs. This is a race 20481 * where we found the ire before it was deleted 20482 * and have just sent out a packet using this 20483 * unreachable nce. 20484 */ 20485 mutex_exit(&nce->nce_lock); 20486 break; 20487 default: 20488 ASSERT(0); 20489 } 20490 } 20491 } 20492 20493 /* 20494 * tcp_send() is called by tcp_wput_data() for non-Multidata transmission 20495 * scheme, and returns one of the following: 20496 * 20497 * -1 = failed allocation. 20498 * 0 = success; burst count reached, or usable send window is too small, 20499 * and that we'd rather wait until later before sending again. 20500 * 1 = success; we are called from tcp_multisend(), and both usable send 20501 * window and tail_unsent are greater than the MDT threshold, and thus 20502 * Multidata Transmit should be used instead. 20503 */ 20504 static int 20505 tcp_send(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 20506 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 20507 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 20508 const int mdt_thres) 20509 { 20510 int num_burst_seg = tcp->tcp_snd_burst; 20511 20512 for (;;) { 20513 struct datab *db; 20514 tcph_t *tcph; 20515 uint32_t sum; 20516 mblk_t *mp, *mp1; 20517 uchar_t *rptr; 20518 int len; 20519 20520 /* 20521 * If we're called by tcp_multisend(), and the amount of 20522 * sendable data as well as the size of current xmit_tail 20523 * is beyond the MDT threshold, return to the caller and 20524 * let the large data transmit be done using MDT. 20525 */ 20526 if (*usable > 0 && *usable > mdt_thres && 20527 (*tail_unsent > mdt_thres || (*tail_unsent == 0 && 20528 MBLKL((*xmit_tail)->b_cont) > mdt_thres))) { 20529 ASSERT(tcp->tcp_mdt); 20530 return (1); /* success; do large send */ 20531 } 20532 20533 if (num_burst_seg-- == 0) 20534 break; /* success; burst count reached */ 20535 20536 len = mss; 20537 if (len > *usable) { 20538 len = *usable; 20539 if (len <= 0) { 20540 /* Terminate the loop */ 20541 break; /* success; too small */ 20542 } 20543 /* 20544 * Sender silly-window avoidance. 20545 * Ignore this if we are going to send a 20546 * zero window probe out. 20547 * 20548 * TODO: force data into microscopic window? 20549 * ==> (!pushed || (unsent > usable)) 20550 */ 20551 if (len < (tcp->tcp_max_swnd >> 1) && 20552 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) > len && 20553 !((tcp->tcp_valid_bits & TCP_URG_VALID) && 20554 len == 1) && (! tcp->tcp_zero_win_probe)) { 20555 /* 20556 * If the retransmit timer is not running 20557 * we start it so that we will retransmit 20558 * in the case when the the receiver has 20559 * decremented the window. 20560 */ 20561 if (*snxt == tcp->tcp_snxt && 20562 *snxt == tcp->tcp_suna) { 20563 /* 20564 * We are not supposed to send 20565 * anything. So let's wait a little 20566 * bit longer before breaking SWS 20567 * avoidance. 20568 * 20569 * What should the value be? 20570 * Suggestion: MAX(init rexmit time, 20571 * tcp->tcp_rto) 20572 */ 20573 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20574 } 20575 break; /* success; too small */ 20576 } 20577 } 20578 20579 tcph = tcp->tcp_tcph; 20580 20581 *usable -= len; /* Approximate - can be adjusted later */ 20582 if (*usable > 0) 20583 tcph->th_flags[0] = TH_ACK; 20584 else 20585 tcph->th_flags[0] = (TH_ACK | TH_PUSH); 20586 20587 /* 20588 * Prime pump for IP's checksumming on our behalf 20589 * Include the adjustment for a source route if any. 20590 */ 20591 sum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 20592 sum = (sum >> 16) + (sum & 0xFFFF); 20593 U16_TO_ABE16(sum, tcph->th_sum); 20594 20595 U32_TO_ABE32(*snxt, tcph->th_seq); 20596 20597 /* 20598 * Branch off to tcp_xmit_mp() if any of the VALID bits is 20599 * set. For the case when TCP_FSS_VALID is the only valid 20600 * bit (normal active close), branch off only when we think 20601 * that the FIN flag needs to be set. Note for this case, 20602 * that (snxt + len) may not reflect the actual seg_len, 20603 * as len may be further reduced in tcp_xmit_mp(). If len 20604 * gets modified, we will end up here again. 20605 */ 20606 if (tcp->tcp_valid_bits != 0 && 20607 (tcp->tcp_valid_bits != TCP_FSS_VALID || 20608 ((*snxt + len) == tcp->tcp_fss))) { 20609 uchar_t *prev_rptr; 20610 uint32_t prev_snxt = tcp->tcp_snxt; 20611 20612 if (*tail_unsent == 0) { 20613 ASSERT((*xmit_tail)->b_cont != NULL); 20614 *xmit_tail = (*xmit_tail)->b_cont; 20615 prev_rptr = (*xmit_tail)->b_rptr; 20616 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20617 (*xmit_tail)->b_rptr); 20618 } else { 20619 prev_rptr = (*xmit_tail)->b_rptr; 20620 (*xmit_tail)->b_rptr = (*xmit_tail)->b_wptr - 20621 *tail_unsent; 20622 } 20623 mp = tcp_xmit_mp(tcp, *xmit_tail, len, NULL, NULL, 20624 *snxt, B_FALSE, (uint32_t *)&len, B_FALSE); 20625 /* Restore tcp_snxt so we get amount sent right. */ 20626 tcp->tcp_snxt = prev_snxt; 20627 if (prev_rptr == (*xmit_tail)->b_rptr) { 20628 /* 20629 * If the previous timestamp is still in use, 20630 * don't stomp on it. 20631 */ 20632 if ((*xmit_tail)->b_next == NULL) { 20633 (*xmit_tail)->b_prev = local_time; 20634 (*xmit_tail)->b_next = 20635 (mblk_t *)(uintptr_t)(*snxt); 20636 } 20637 } else 20638 (*xmit_tail)->b_rptr = prev_rptr; 20639 20640 if (mp == NULL) 20641 return (-1); 20642 mp1 = mp->b_cont; 20643 20644 tcp->tcp_last_sent_len = (ushort_t)len; 20645 while (mp1->b_cont) { 20646 *xmit_tail = (*xmit_tail)->b_cont; 20647 (*xmit_tail)->b_prev = local_time; 20648 (*xmit_tail)->b_next = 20649 (mblk_t *)(uintptr_t)(*snxt); 20650 mp1 = mp1->b_cont; 20651 } 20652 *snxt += len; 20653 *tail_unsent = (*xmit_tail)->b_wptr - mp1->b_wptr; 20654 BUMP_LOCAL(tcp->tcp_obsegs); 20655 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20656 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20657 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20658 tcp_send_data(tcp, q, mp); 20659 continue; 20660 } 20661 20662 *snxt += len; /* Adjust later if we don't send all of len */ 20663 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20664 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20665 20666 if (*tail_unsent) { 20667 /* Are the bytes above us in flight? */ 20668 rptr = (*xmit_tail)->b_wptr - *tail_unsent; 20669 if (rptr != (*xmit_tail)->b_rptr) { 20670 *tail_unsent -= len; 20671 tcp->tcp_last_sent_len = (ushort_t)len; 20672 len += tcp_hdr_len; 20673 if (tcp->tcp_ipversion == IPV4_VERSION) 20674 tcp->tcp_ipha->ipha_length = htons(len); 20675 else 20676 tcp->tcp_ip6h->ip6_plen = 20677 htons(len - 20678 ((char *)&tcp->tcp_ip6h[1] - 20679 tcp->tcp_iphc)); 20680 mp = dupb(*xmit_tail); 20681 if (!mp) 20682 return (-1); /* out_of_mem */ 20683 mp->b_rptr = rptr; 20684 /* 20685 * If the old timestamp is no longer in use, 20686 * sample a new timestamp now. 20687 */ 20688 if ((*xmit_tail)->b_next == NULL) { 20689 (*xmit_tail)->b_prev = local_time; 20690 (*xmit_tail)->b_next = 20691 (mblk_t *)(uintptr_t)(*snxt-len); 20692 } 20693 goto must_alloc; 20694 } 20695 } else { 20696 *xmit_tail = (*xmit_tail)->b_cont; 20697 ASSERT((uintptr_t)((*xmit_tail)->b_wptr - 20698 (*xmit_tail)->b_rptr) <= (uintptr_t)INT_MAX); 20699 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20700 (*xmit_tail)->b_rptr); 20701 } 20702 20703 (*xmit_tail)->b_prev = local_time; 20704 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)(*snxt - len); 20705 20706 *tail_unsent -= len; 20707 tcp->tcp_last_sent_len = (ushort_t)len; 20708 20709 len += tcp_hdr_len; 20710 if (tcp->tcp_ipversion == IPV4_VERSION) 20711 tcp->tcp_ipha->ipha_length = htons(len); 20712 else 20713 tcp->tcp_ip6h->ip6_plen = htons(len - 20714 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 20715 20716 mp = dupb(*xmit_tail); 20717 if (!mp) 20718 return (-1); /* out_of_mem */ 20719 20720 len = tcp_hdr_len; 20721 /* 20722 * There are four reasons to allocate a new hdr mblk: 20723 * 1) The bytes above us are in use by another packet 20724 * 2) We don't have good alignment 20725 * 3) The mblk is being shared 20726 * 4) We don't have enough room for a header 20727 */ 20728 rptr = mp->b_rptr - len; 20729 if (!OK_32PTR(rptr) || 20730 ((db = mp->b_datap), db->db_ref != 2) || 20731 rptr < db->db_base) { 20732 /* NOTE: we assume allocb returns an OK_32PTR */ 20733 20734 must_alloc:; 20735 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 20736 tcp_wroff_xtra, BPRI_MED); 20737 if (!mp1) { 20738 freemsg(mp); 20739 return (-1); /* out_of_mem */ 20740 } 20741 mp1->b_cont = mp; 20742 mp = mp1; 20743 /* Leave room for Link Level header */ 20744 len = tcp_hdr_len; 20745 rptr = &mp->b_rptr[tcp_wroff_xtra]; 20746 mp->b_wptr = &rptr[len]; 20747 } 20748 20749 /* 20750 * Fill in the header using the template header, and add 20751 * options such as time-stamp, ECN and/or SACK, as needed. 20752 */ 20753 tcp_fill_header(tcp, rptr, (clock_t)local_time, num_sack_blk); 20754 20755 mp->b_rptr = rptr; 20756 20757 if (*tail_unsent) { 20758 int spill = *tail_unsent; 20759 20760 mp1 = mp->b_cont; 20761 if (!mp1) 20762 mp1 = mp; 20763 20764 /* 20765 * If we're a little short, tack on more mblks until 20766 * there is no more spillover. 20767 */ 20768 while (spill < 0) { 20769 mblk_t *nmp; 20770 int nmpsz; 20771 20772 nmp = (*xmit_tail)->b_cont; 20773 nmpsz = MBLKL(nmp); 20774 20775 /* 20776 * Excess data in mblk; can we split it? 20777 * If MDT is enabled for the connection, 20778 * keep on splitting as this is a transient 20779 * send path. 20780 */ 20781 if (!tcp->tcp_mdt && (spill + nmpsz > 0)) { 20782 /* 20783 * Don't split if stream head was 20784 * told to break up larger writes 20785 * into smaller ones. 20786 */ 20787 if (tcp->tcp_maxpsz > 0) 20788 break; 20789 20790 /* 20791 * Next mblk is less than SMSS/2 20792 * rounded up to nearest 64-byte; 20793 * let it get sent as part of the 20794 * next segment. 20795 */ 20796 if (tcp->tcp_localnet && 20797 !tcp->tcp_cork && 20798 (nmpsz < roundup((mss >> 1), 64))) 20799 break; 20800 } 20801 20802 *xmit_tail = nmp; 20803 ASSERT((uintptr_t)nmpsz <= (uintptr_t)INT_MAX); 20804 /* Stash for rtt use later */ 20805 (*xmit_tail)->b_prev = local_time; 20806 (*xmit_tail)->b_next = 20807 (mblk_t *)(uintptr_t)(*snxt - len); 20808 mp1->b_cont = dupb(*xmit_tail); 20809 mp1 = mp1->b_cont; 20810 20811 spill += nmpsz; 20812 if (mp1 == NULL) { 20813 *tail_unsent = spill; 20814 freemsg(mp); 20815 return (-1); /* out_of_mem */ 20816 } 20817 } 20818 20819 /* Trim back any surplus on the last mblk */ 20820 if (spill >= 0) { 20821 mp1->b_wptr -= spill; 20822 *tail_unsent = spill; 20823 } else { 20824 /* 20825 * We did not send everything we could in 20826 * order to remain within the b_cont limit. 20827 */ 20828 *usable -= spill; 20829 *snxt += spill; 20830 tcp->tcp_last_sent_len += spill; 20831 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, spill); 20832 /* 20833 * Adjust the checksum 20834 */ 20835 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 20836 sum += spill; 20837 sum = (sum >> 16) + (sum & 0xFFFF); 20838 U16_TO_ABE16(sum, tcph->th_sum); 20839 if (tcp->tcp_ipversion == IPV4_VERSION) { 20840 sum = ntohs( 20841 ((ipha_t *)rptr)->ipha_length) + 20842 spill; 20843 ((ipha_t *)rptr)->ipha_length = 20844 htons(sum); 20845 } else { 20846 sum = ntohs( 20847 ((ip6_t *)rptr)->ip6_plen) + 20848 spill; 20849 ((ip6_t *)rptr)->ip6_plen = 20850 htons(sum); 20851 } 20852 *tail_unsent = 0; 20853 } 20854 } 20855 if (tcp->tcp_ip_forward_progress) { 20856 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 20857 *(uint32_t *)mp->b_rptr |= IP_FORWARD_PROG; 20858 tcp->tcp_ip_forward_progress = B_FALSE; 20859 } 20860 20861 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20862 tcp_send_data(tcp, q, mp); 20863 BUMP_LOCAL(tcp->tcp_obsegs); 20864 } 20865 20866 return (0); 20867 } 20868 20869 /* Unlink and return any mblk that looks like it contains a MDT info */ 20870 static mblk_t * 20871 tcp_mdt_info_mp(mblk_t *mp) 20872 { 20873 mblk_t *prev_mp; 20874 20875 for (;;) { 20876 prev_mp = mp; 20877 /* no more to process? */ 20878 if ((mp = mp->b_cont) == NULL) 20879 break; 20880 20881 switch (DB_TYPE(mp)) { 20882 case M_CTL: 20883 if (*(uint32_t *)mp->b_rptr != MDT_IOC_INFO_UPDATE) 20884 continue; 20885 ASSERT(prev_mp != NULL); 20886 prev_mp->b_cont = mp->b_cont; 20887 mp->b_cont = NULL; 20888 return (mp); 20889 default: 20890 break; 20891 } 20892 } 20893 return (mp); 20894 } 20895 20896 /* MDT info update routine, called when IP notifies us about MDT */ 20897 static void 20898 tcp_mdt_update(tcp_t *tcp, ill_mdt_capab_t *mdt_capab, boolean_t first) 20899 { 20900 boolean_t prev_state; 20901 20902 /* 20903 * IP is telling us to abort MDT on this connection? We know 20904 * this because the capability is only turned off when IP 20905 * encounters some pathological cases, e.g. link-layer change 20906 * where the new driver doesn't support MDT, or in situation 20907 * where MDT usage on the link-layer has been switched off. 20908 * IP would not have sent us the initial MDT_IOC_INFO_UPDATE 20909 * if the link-layer doesn't support MDT, and if it does, it 20910 * will indicate that the feature is to be turned on. 20911 */ 20912 prev_state = tcp->tcp_mdt; 20913 tcp->tcp_mdt = (mdt_capab->ill_mdt_on != 0); 20914 if (!tcp->tcp_mdt && !first) { 20915 TCP_STAT(tcp_mdt_conn_halted3); 20916 ip1dbg(("tcp_mdt_update: disabling MDT for connp %p\n", 20917 (void *)tcp->tcp_connp)); 20918 } 20919 20920 /* 20921 * We currently only support MDT on simple TCP/{IPv4,IPv6}, 20922 * so disable MDT otherwise. The checks are done here 20923 * and in tcp_wput_data(). 20924 */ 20925 if (tcp->tcp_mdt && 20926 (tcp->tcp_ipversion == IPV4_VERSION && 20927 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 20928 (tcp->tcp_ipversion == IPV6_VERSION && 20929 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN)) 20930 tcp->tcp_mdt = B_FALSE; 20931 20932 if (tcp->tcp_mdt) { 20933 if (mdt_capab->ill_mdt_version != MDT_VERSION_2) { 20934 cmn_err(CE_NOTE, "tcp_mdt_update: unknown MDT " 20935 "version (%d), expected version is %d", 20936 mdt_capab->ill_mdt_version, MDT_VERSION_2); 20937 tcp->tcp_mdt = B_FALSE; 20938 return; 20939 } 20940 20941 /* 20942 * We need the driver to be able to handle at least three 20943 * spans per packet in order for tcp MDT to be utilized. 20944 * The first is for the header portion, while the rest are 20945 * needed to handle a packet that straddles across two 20946 * virtually non-contiguous buffers; a typical tcp packet 20947 * therefore consists of only two spans. Note that we take 20948 * a zero as "don't care". 20949 */ 20950 if (mdt_capab->ill_mdt_span_limit > 0 && 20951 mdt_capab->ill_mdt_span_limit < 3) { 20952 tcp->tcp_mdt = B_FALSE; 20953 return; 20954 } 20955 20956 /* a zero means driver wants default value */ 20957 tcp->tcp_mdt_max_pld = MIN(mdt_capab->ill_mdt_max_pld, 20958 tcp_mdt_max_pbufs); 20959 if (tcp->tcp_mdt_max_pld == 0) 20960 tcp->tcp_mdt_max_pld = tcp_mdt_max_pbufs; 20961 20962 /* ensure 32-bit alignment */ 20963 tcp->tcp_mdt_hdr_head = roundup(MAX(tcp_mdt_hdr_head_min, 20964 mdt_capab->ill_mdt_hdr_head), 4); 20965 tcp->tcp_mdt_hdr_tail = roundup(MAX(tcp_mdt_hdr_tail_min, 20966 mdt_capab->ill_mdt_hdr_tail), 4); 20967 20968 if (!first && !prev_state) { 20969 TCP_STAT(tcp_mdt_conn_resumed2); 20970 ip1dbg(("tcp_mdt_update: reenabling MDT for connp %p\n", 20971 (void *)tcp->tcp_connp)); 20972 } 20973 } 20974 } 20975 20976 static void 20977 tcp_ire_ill_check(tcp_t *tcp, ire_t *ire, ill_t *ill, boolean_t check_mdt) 20978 { 20979 conn_t *connp = tcp->tcp_connp; 20980 20981 ASSERT(ire != NULL); 20982 20983 /* 20984 * We may be in the fastpath here, and although we essentially do 20985 * similar checks as in ip_bind_connected{_v6}/ip_mdinfo_return, 20986 * we try to keep things as brief as possible. After all, these 20987 * are only best-effort checks, and we do more thorough ones prior 20988 * to calling tcp_multisend(). 20989 */ 20990 if (ip_multidata_outbound && check_mdt && 20991 !(ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) && 20992 ill != NULL && (ill->ill_capabilities & ILL_CAPAB_MDT) && 20993 !CONN_IPSEC_OUT_ENCAPSULATED(connp) && 20994 !(ire->ire_flags & RTF_MULTIRT) && 20995 !IPP_ENABLED(IPP_LOCAL_OUT) && 20996 CONN_IS_MD_FASTPATH(connp)) { 20997 /* Remember the result */ 20998 connp->conn_mdt_ok = B_TRUE; 20999 21000 ASSERT(ill->ill_mdt_capab != NULL); 21001 if (!ill->ill_mdt_capab->ill_mdt_on) { 21002 /* 21003 * If MDT has been previously turned off in the past, 21004 * and we currently can do MDT (due to IPQoS policy 21005 * removal, etc.) then enable it for this interface. 21006 */ 21007 ill->ill_mdt_capab->ill_mdt_on = 1; 21008 ip1dbg(("tcp_ire_ill_check: connp %p enables MDT for " 21009 "interface %s\n", (void *)connp, ill->ill_name)); 21010 } 21011 tcp_mdt_update(tcp, ill->ill_mdt_capab, B_TRUE); 21012 } 21013 21014 /* 21015 * The goal is to reduce the number of generated tcp segments by 21016 * setting the maxpsz multiplier to 0; this will have an affect on 21017 * tcp_maxpsz_set(). With this behavior, tcp will pack more data 21018 * into each packet, up to SMSS bytes. Doing this reduces the number 21019 * of outbound segments and incoming ACKs, thus allowing for better 21020 * network and system performance. In contrast the legacy behavior 21021 * may result in sending less than SMSS size, because the last mblk 21022 * for some packets may have more data than needed to make up SMSS, 21023 * and the legacy code refused to "split" it. 21024 * 21025 * We apply the new behavior on following situations: 21026 * 21027 * 1) Loopback connections, 21028 * 2) Connections in which the remote peer is not on local subnet, 21029 * 3) Local subnet connections over the bge interface (see below). 21030 * 21031 * Ideally, we would like this behavior to apply for interfaces other 21032 * than bge. However, doing so would negatively impact drivers which 21033 * perform dynamic mapping and unmapping of DMA resources, which are 21034 * increased by setting the maxpsz multiplier to 0 (more mblks per 21035 * packet will be generated by tcp). The bge driver does not suffer 21036 * from this, as it copies the mblks into pre-mapped buffers, and 21037 * therefore does not require more I/O resources than before. 21038 * 21039 * Otherwise, this behavior is present on all network interfaces when 21040 * the destination endpoint is non-local, since reducing the number 21041 * of packets in general is good for the network. 21042 * 21043 * TODO We need to remove this hard-coded conditional for bge once 21044 * a better "self-tuning" mechanism, or a way to comprehend 21045 * the driver transmit strategy is devised. Until the solution 21046 * is found and well understood, we live with this hack. 21047 */ 21048 if (!tcp_static_maxpsz && 21049 (tcp->tcp_loopback || !tcp->tcp_localnet || 21050 (ill->ill_name_length > 3 && bcmp(ill->ill_name, "bge", 3) == 0))) { 21051 /* override the default value */ 21052 tcp->tcp_maxpsz = 0; 21053 21054 ip3dbg(("tcp_ire_ill_check: connp %p tcp_maxpsz %d on " 21055 "interface %s\n", (void *)connp, tcp->tcp_maxpsz, 21056 ill != NULL ? ill->ill_name : ipif_loopback_name)); 21057 } 21058 21059 /* set the stream head parameters accordingly */ 21060 (void) tcp_maxpsz_set(tcp, B_TRUE); 21061 } 21062 21063 /* tcp_wput_flush is called by tcp_wput_nondata to handle M_FLUSH messages. */ 21064 static void 21065 tcp_wput_flush(tcp_t *tcp, mblk_t *mp) 21066 { 21067 uchar_t fval = *mp->b_rptr; 21068 mblk_t *tail; 21069 queue_t *q = tcp->tcp_wq; 21070 21071 /* TODO: How should flush interact with urgent data? */ 21072 if ((fval & FLUSHW) && tcp->tcp_xmit_head && 21073 !(tcp->tcp_valid_bits & TCP_URG_VALID)) { 21074 /* 21075 * Flush only data that has not yet been put on the wire. If 21076 * we flush data that we have already transmitted, life, as we 21077 * know it, may come to an end. 21078 */ 21079 tail = tcp->tcp_xmit_tail; 21080 tail->b_wptr -= tcp->tcp_xmit_tail_unsent; 21081 tcp->tcp_xmit_tail_unsent = 0; 21082 tcp->tcp_unsent = 0; 21083 if (tail->b_wptr != tail->b_rptr) 21084 tail = tail->b_cont; 21085 if (tail) { 21086 mblk_t **excess = &tcp->tcp_xmit_head; 21087 for (;;) { 21088 mblk_t *mp1 = *excess; 21089 if (mp1 == tail) 21090 break; 21091 tcp->tcp_xmit_tail = mp1; 21092 tcp->tcp_xmit_last = mp1; 21093 excess = &mp1->b_cont; 21094 } 21095 *excess = NULL; 21096 tcp_close_mpp(&tail); 21097 if (tcp->tcp_snd_zcopy_aware) 21098 tcp_zcopy_notify(tcp); 21099 } 21100 /* 21101 * We have no unsent data, so unsent must be less than 21102 * tcp_xmit_lowater, so re-enable flow. 21103 */ 21104 if (tcp->tcp_flow_stopped) { 21105 tcp->tcp_flow_stopped = B_FALSE; 21106 tcp_clrqfull(tcp); 21107 } 21108 } 21109 /* 21110 * TODO: you can't just flush these, you have to increase rwnd for one 21111 * thing. For another, how should urgent data interact? 21112 */ 21113 if (fval & FLUSHR) { 21114 *mp->b_rptr = fval & ~FLUSHW; 21115 /* XXX */ 21116 qreply(q, mp); 21117 return; 21118 } 21119 freemsg(mp); 21120 } 21121 21122 /* 21123 * tcp_wput_iocdata is called by tcp_wput_nondata to handle all M_IOCDATA 21124 * messages. 21125 */ 21126 static void 21127 tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp) 21128 { 21129 mblk_t *mp1; 21130 STRUCT_HANDLE(strbuf, sb); 21131 uint16_t port; 21132 queue_t *q = tcp->tcp_wq; 21133 in6_addr_t v6addr; 21134 ipaddr_t v4addr; 21135 uint32_t flowinfo = 0; 21136 int addrlen; 21137 21138 /* Make sure it is one of ours. */ 21139 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 21140 case TI_GETMYNAME: 21141 case TI_GETPEERNAME: 21142 break; 21143 default: 21144 CALL_IP_WPUT(tcp->tcp_connp, q, mp); 21145 return; 21146 } 21147 switch (mi_copy_state(q, mp, &mp1)) { 21148 case -1: 21149 return; 21150 case MI_COPY_CASE(MI_COPY_IN, 1): 21151 break; 21152 case MI_COPY_CASE(MI_COPY_OUT, 1): 21153 /* Copy out the strbuf. */ 21154 mi_copyout(q, mp); 21155 return; 21156 case MI_COPY_CASE(MI_COPY_OUT, 2): 21157 /* All done. */ 21158 mi_copy_done(q, mp, 0); 21159 return; 21160 default: 21161 mi_copy_done(q, mp, EPROTO); 21162 return; 21163 } 21164 /* Check alignment of the strbuf */ 21165 if (!OK_32PTR(mp1->b_rptr)) { 21166 mi_copy_done(q, mp, EINVAL); 21167 return; 21168 } 21169 21170 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 21171 (void *)mp1->b_rptr); 21172 addrlen = tcp->tcp_family == AF_INET ? sizeof (sin_t) : sizeof (sin6_t); 21173 21174 if (STRUCT_FGET(sb, maxlen) < addrlen) { 21175 mi_copy_done(q, mp, EINVAL); 21176 return; 21177 } 21178 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 21179 case TI_GETMYNAME: 21180 if (tcp->tcp_family == AF_INET) { 21181 if (tcp->tcp_ipversion == IPV4_VERSION) { 21182 v4addr = tcp->tcp_ipha->ipha_src; 21183 } else { 21184 /* can't return an address in this case */ 21185 v4addr = 0; 21186 } 21187 } else { 21188 /* tcp->tcp_family == AF_INET6 */ 21189 if (tcp->tcp_ipversion == IPV4_VERSION) { 21190 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 21191 &v6addr); 21192 } else { 21193 v6addr = tcp->tcp_ip6h->ip6_src; 21194 } 21195 } 21196 port = tcp->tcp_lport; 21197 break; 21198 case TI_GETPEERNAME: 21199 if (tcp->tcp_family == AF_INET) { 21200 if (tcp->tcp_ipversion == IPV4_VERSION) { 21201 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_remote_v6, 21202 v4addr); 21203 } else { 21204 /* can't return an address in this case */ 21205 v4addr = 0; 21206 } 21207 } else { 21208 /* tcp->tcp_family == AF_INET6) */ 21209 v6addr = tcp->tcp_remote_v6; 21210 if (tcp->tcp_ipversion == IPV6_VERSION) { 21211 /* 21212 * No flowinfo if tcp->tcp_ipversion is v4. 21213 * 21214 * flowinfo was already initialized to zero 21215 * where it was declared above, so only 21216 * set it if ipversion is v6. 21217 */ 21218 flowinfo = tcp->tcp_ip6h->ip6_vcf & 21219 ~IPV6_VERS_AND_FLOW_MASK; 21220 } 21221 } 21222 port = tcp->tcp_fport; 21223 break; 21224 default: 21225 mi_copy_done(q, mp, EPROTO); 21226 return; 21227 } 21228 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 21229 if (!mp1) 21230 return; 21231 21232 if (tcp->tcp_family == AF_INET) { 21233 sin_t *sin; 21234 21235 STRUCT_FSET(sb, len, (int)sizeof (sin_t)); 21236 sin = (sin_t *)mp1->b_rptr; 21237 mp1->b_wptr = (uchar_t *)&sin[1]; 21238 *sin = sin_null; 21239 sin->sin_family = AF_INET; 21240 sin->sin_addr.s_addr = v4addr; 21241 sin->sin_port = port; 21242 } else { 21243 /* tcp->tcp_family == AF_INET6 */ 21244 sin6_t *sin6; 21245 21246 STRUCT_FSET(sb, len, (int)sizeof (sin6_t)); 21247 sin6 = (sin6_t *)mp1->b_rptr; 21248 mp1->b_wptr = (uchar_t *)&sin6[1]; 21249 *sin6 = sin6_null; 21250 sin6->sin6_family = AF_INET6; 21251 sin6->sin6_flowinfo = flowinfo; 21252 sin6->sin6_addr = v6addr; 21253 sin6->sin6_port = port; 21254 } 21255 /* Copy out the address */ 21256 mi_copyout(q, mp); 21257 } 21258 21259 /* 21260 * tcp_wput_ioctl is called by tcp_wput_nondata() to handle all M_IOCTL 21261 * messages. 21262 */ 21263 /* ARGSUSED */ 21264 static void 21265 tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2) 21266 { 21267 conn_t *connp = (conn_t *)arg; 21268 tcp_t *tcp = connp->conn_tcp; 21269 queue_t *q = tcp->tcp_wq; 21270 struct iocblk *iocp; 21271 21272 ASSERT(DB_TYPE(mp) == M_IOCTL); 21273 /* 21274 * Try and ASSERT the minimum possible references on the 21275 * conn early enough. Since we are executing on write side, 21276 * the connection is obviously not detached and that means 21277 * there is a ref each for TCP and IP. Since we are behind 21278 * the squeue, the minimum references needed are 3. If the 21279 * conn is in classifier hash list, there should be an 21280 * extra ref for that (we check both the possibilities). 21281 */ 21282 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21283 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21284 21285 iocp = (struct iocblk *)mp->b_rptr; 21286 switch (iocp->ioc_cmd) { 21287 case TCP_IOC_DEFAULT_Q: 21288 /* Wants to be the default wq. */ 21289 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 21290 iocp->ioc_error = EPERM; 21291 iocp->ioc_count = 0; 21292 mp->b_datap->db_type = M_IOCACK; 21293 qreply(q, mp); 21294 return; 21295 } 21296 tcp_def_q_set(tcp, mp); 21297 return; 21298 case SIOCPOPSOCKFS: 21299 /* 21300 * sockfs is being I_POP'ed, reset the flag 21301 * indicating this 21302 */ 21303 tcp->tcp_issocket = B_FALSE; 21304 21305 /* 21306 * Insert this socket into the acceptor hash. 21307 * We might need it for T_CONN_RES message 21308 */ 21309 #ifdef _ILP32 21310 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 21311 #else 21312 tcp->tcp_acceptor_id = tcp->tcp_connp->conn_dev; 21313 #endif 21314 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 21315 mp->b_datap->db_type = M_IOCACK; 21316 iocp->ioc_count = 0; 21317 iocp->ioc_error = 0; 21318 iocp->ioc_rval = 0; 21319 qreply(q, mp); 21320 return; 21321 } 21322 CALL_IP_WPUT(connp, q, mp); 21323 } 21324 21325 /* 21326 * This routine is called by tcp_wput() to handle all TPI requests. 21327 */ 21328 /* ARGSUSED */ 21329 static void 21330 tcp_wput_proto(void *arg, mblk_t *mp, void *arg2) 21331 { 21332 conn_t *connp = (conn_t *)arg; 21333 tcp_t *tcp = connp->conn_tcp; 21334 union T_primitives *tprim = (union T_primitives *)mp->b_rptr; 21335 uchar_t *rptr; 21336 t_scalar_t type; 21337 int len; 21338 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 21339 21340 /* 21341 * Try and ASSERT the minimum possible references on the 21342 * conn early enough. Since we are executing on write side, 21343 * the connection is obviously not detached and that means 21344 * there is a ref each for TCP and IP. Since we are behind 21345 * the squeue, the minimum references needed are 3. If the 21346 * conn is in classifier hash list, there should be an 21347 * extra ref for that (we check both the possibilities). 21348 */ 21349 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21350 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21351 21352 rptr = mp->b_rptr; 21353 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 21354 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 21355 type = ((union T_primitives *)rptr)->type; 21356 if (type == T_EXDATA_REQ) { 21357 len = msgdsize(mp->b_cont) - 1; 21358 if (len < 0) { 21359 freemsg(mp); 21360 return; 21361 } 21362 /* 21363 * Try to force urgent data out on the wire. 21364 * Even if we have unsent data this will 21365 * at least send the urgent flag. 21366 * XXX does not handle more flag correctly. 21367 */ 21368 len += tcp->tcp_unsent; 21369 len += tcp->tcp_snxt; 21370 tcp->tcp_urg = len; 21371 tcp->tcp_valid_bits |= TCP_URG_VALID; 21372 21373 /* Bypass tcp protocol for fused tcp loopback */ 21374 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp)) 21375 return; 21376 } else if (type != T_DATA_REQ) { 21377 goto non_urgent_data; 21378 } 21379 /* TODO: options, flags, ... from user */ 21380 /* Set length to zero for reclamation below */ 21381 tcp_wput_data(tcp, mp->b_cont, B_TRUE); 21382 freeb(mp); 21383 return; 21384 } else { 21385 if (tcp->tcp_debug) { 21386 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 21387 "tcp_wput_proto, dropping one..."); 21388 } 21389 freemsg(mp); 21390 return; 21391 } 21392 21393 non_urgent_data: 21394 21395 switch ((int)tprim->type) { 21396 case O_T_BIND_REQ: /* bind request */ 21397 case T_BIND_REQ: /* new semantics bind request */ 21398 tcp_bind(tcp, mp); 21399 break; 21400 case T_UNBIND_REQ: /* unbind request */ 21401 tcp_unbind(tcp, mp); 21402 break; 21403 case O_T_CONN_RES: /* old connection response XXX */ 21404 case T_CONN_RES: /* connection response */ 21405 tcp_accept(tcp, mp); 21406 break; 21407 case T_CONN_REQ: /* connection request */ 21408 tcp_connect(tcp, mp); 21409 break; 21410 case T_DISCON_REQ: /* disconnect request */ 21411 tcp_disconnect(tcp, mp); 21412 break; 21413 case T_CAPABILITY_REQ: 21414 tcp_capability_req(tcp, mp); /* capability request */ 21415 break; 21416 case T_INFO_REQ: /* information request */ 21417 tcp_info_req(tcp, mp); 21418 break; 21419 case T_SVR4_OPTMGMT_REQ: /* manage options req */ 21420 /* Only IP is allowed to return meaningful value */ 21421 (void) svr4_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21422 break; 21423 case T_OPTMGMT_REQ: 21424 /* 21425 * Note: no support for snmpcom_req() through new 21426 * T_OPTMGMT_REQ. See comments in ip.c 21427 */ 21428 /* Only IP is allowed to return meaningful value */ 21429 (void) tpi_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21430 break; 21431 21432 case T_UNITDATA_REQ: /* unitdata request */ 21433 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21434 break; 21435 case T_ORDREL_REQ: /* orderly release req */ 21436 freemsg(mp); 21437 21438 if (tcp->tcp_fused) 21439 tcp_unfuse(tcp); 21440 21441 if (tcp_xmit_end(tcp) != 0) { 21442 /* 21443 * We were crossing FINs and got a reset from 21444 * the other side. Just ignore it. 21445 */ 21446 if (tcp->tcp_debug) { 21447 (void) strlog(TCP_MODULE_ID, 0, 1, 21448 SL_ERROR|SL_TRACE, 21449 "tcp_wput_proto, T_ORDREL_REQ out of " 21450 "state %s", 21451 tcp_display(tcp, NULL, 21452 DISP_ADDR_AND_PORT)); 21453 } 21454 } 21455 break; 21456 case T_ADDR_REQ: 21457 tcp_addr_req(tcp, mp); 21458 break; 21459 default: 21460 if (tcp->tcp_debug) { 21461 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 21462 "tcp_wput_proto, bogus TPI msg, type %d", 21463 tprim->type); 21464 } 21465 /* 21466 * We used to M_ERROR. Sending TNOTSUPPORT gives the user 21467 * to recover. 21468 */ 21469 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21470 break; 21471 } 21472 } 21473 21474 /* 21475 * The TCP write service routine should never be called... 21476 */ 21477 /* ARGSUSED */ 21478 static void 21479 tcp_wsrv(queue_t *q) 21480 { 21481 TCP_STAT(tcp_wsrv_called); 21482 } 21483 21484 /* Non overlapping byte exchanger */ 21485 static void 21486 tcp_xchg(uchar_t *a, uchar_t *b, int len) 21487 { 21488 uchar_t uch; 21489 21490 while (len-- > 0) { 21491 uch = a[len]; 21492 a[len] = b[len]; 21493 b[len] = uch; 21494 } 21495 } 21496 21497 /* 21498 * Send out a control packet on the tcp connection specified. This routine 21499 * is typically called where we need a simple ACK or RST generated. 21500 */ 21501 static void 21502 tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl) 21503 { 21504 uchar_t *rptr; 21505 tcph_t *tcph; 21506 ipha_t *ipha = NULL; 21507 ip6_t *ip6h = NULL; 21508 uint32_t sum; 21509 int tcp_hdr_len; 21510 int tcp_ip_hdr_len; 21511 mblk_t *mp; 21512 21513 /* 21514 * Save sum for use in source route later. 21515 */ 21516 ASSERT(tcp != NULL); 21517 sum = tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 21518 tcp_hdr_len = tcp->tcp_hdr_len; 21519 tcp_ip_hdr_len = tcp->tcp_ip_hdr_len; 21520 21521 /* If a text string is passed in with the request, pass it to strlog. */ 21522 if (str != NULL && tcp->tcp_debug) { 21523 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 21524 "tcp_xmit_ctl: '%s', seq 0x%x, ack 0x%x, ctl 0x%x", 21525 str, seq, ack, ctl); 21526 } 21527 mp = allocb(tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 21528 BPRI_MED); 21529 if (mp == NULL) { 21530 return; 21531 } 21532 rptr = &mp->b_rptr[tcp_wroff_xtra]; 21533 mp->b_rptr = rptr; 21534 mp->b_wptr = &rptr[tcp_hdr_len]; 21535 bcopy(tcp->tcp_iphc, rptr, tcp_hdr_len); 21536 21537 if (tcp->tcp_ipversion == IPV4_VERSION) { 21538 ipha = (ipha_t *)rptr; 21539 ipha->ipha_length = htons(tcp_hdr_len); 21540 } else { 21541 ip6h = (ip6_t *)rptr; 21542 ASSERT(tcp != NULL); 21543 ip6h->ip6_plen = htons(tcp->tcp_hdr_len - 21544 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 21545 } 21546 tcph = (tcph_t *)&rptr[tcp_ip_hdr_len]; 21547 tcph->th_flags[0] = (uint8_t)ctl; 21548 if (ctl & TH_RST) { 21549 BUMP_MIB(&tcp_mib, tcpOutRsts); 21550 BUMP_MIB(&tcp_mib, tcpOutControl); 21551 /* 21552 * Don't send TSopt w/ TH_RST packets per RFC 1323. 21553 */ 21554 if (tcp->tcp_snd_ts_ok && 21555 tcp->tcp_state > TCPS_SYN_SENT) { 21556 mp->b_wptr = &rptr[tcp_hdr_len - TCPOPT_REAL_TS_LEN]; 21557 *(mp->b_wptr) = TCPOPT_EOL; 21558 if (tcp->tcp_ipversion == IPV4_VERSION) { 21559 ipha->ipha_length = htons(tcp_hdr_len - 21560 TCPOPT_REAL_TS_LEN); 21561 } else { 21562 ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - 21563 TCPOPT_REAL_TS_LEN); 21564 } 21565 tcph->th_offset_and_rsrvd[0] -= (3 << 4); 21566 sum -= TCPOPT_REAL_TS_LEN; 21567 } 21568 } 21569 if (ctl & TH_ACK) { 21570 if (tcp->tcp_snd_ts_ok) { 21571 U32_TO_BE32(lbolt, 21572 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 21573 U32_TO_BE32(tcp->tcp_ts_recent, 21574 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 21575 } 21576 21577 /* Update the latest receive window size in TCP header. */ 21578 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 21579 tcph->th_win); 21580 tcp->tcp_rack = ack; 21581 tcp->tcp_rack_cnt = 0; 21582 BUMP_MIB(&tcp_mib, tcpOutAck); 21583 } 21584 BUMP_LOCAL(tcp->tcp_obsegs); 21585 U32_TO_BE32(seq, tcph->th_seq); 21586 U32_TO_BE32(ack, tcph->th_ack); 21587 /* 21588 * Include the adjustment for a source route if any. 21589 */ 21590 sum = (sum >> 16) + (sum & 0xFFFF); 21591 U16_TO_BE16(sum, tcph->th_sum); 21592 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21593 tcp_send_data(tcp, tcp->tcp_wq, mp); 21594 } 21595 21596 /* 21597 * If this routine returns B_TRUE, TCP can generate a RST in response 21598 * to a segment. If it returns B_FALSE, TCP should not respond. 21599 */ 21600 static boolean_t 21601 tcp_send_rst_chk(void) 21602 { 21603 clock_t now; 21604 21605 /* 21606 * TCP needs to protect itself from generating too many RSTs. 21607 * This can be a DoS attack by sending us random segments 21608 * soliciting RSTs. 21609 * 21610 * What we do here is to have a limit of tcp_rst_sent_rate RSTs 21611 * in each 1 second interval. In this way, TCP still generate 21612 * RSTs in normal cases but when under attack, the impact is 21613 * limited. 21614 */ 21615 if (tcp_rst_sent_rate_enabled != 0) { 21616 now = lbolt; 21617 /* lbolt can wrap around. */ 21618 if ((tcp_last_rst_intrvl > now) || 21619 (TICK_TO_MSEC(now - tcp_last_rst_intrvl) > 1*SECONDS)) { 21620 tcp_last_rst_intrvl = now; 21621 tcp_rst_cnt = 1; 21622 } else if (++tcp_rst_cnt > tcp_rst_sent_rate) { 21623 return (B_FALSE); 21624 } 21625 } 21626 return (B_TRUE); 21627 } 21628 21629 /* 21630 * Send down the advice IP ioctl to tell IP to mark an IRE temporary. 21631 */ 21632 static void 21633 tcp_ip_ire_mark_advice(tcp_t *tcp) 21634 { 21635 mblk_t *mp; 21636 ipic_t *ipic; 21637 21638 if (tcp->tcp_ipversion == IPV4_VERSION) { 21639 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21640 &ipic); 21641 } else { 21642 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21643 &ipic); 21644 } 21645 if (mp == NULL) 21646 return; 21647 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21648 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21649 } 21650 21651 /* 21652 * Return an IP advice ioctl mblk and set ipic to be the pointer 21653 * to the advice structure. 21654 */ 21655 static mblk_t * 21656 tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic) 21657 { 21658 struct iocblk *ioc; 21659 mblk_t *mp, *mp1; 21660 21661 mp = allocb(sizeof (ipic_t) + addr_len, BPRI_HI); 21662 if (mp == NULL) 21663 return (NULL); 21664 bzero(mp->b_rptr, sizeof (ipic_t) + addr_len); 21665 *ipic = (ipic_t *)mp->b_rptr; 21666 (*ipic)->ipic_cmd = IP_IOC_IRE_ADVISE_NO_REPLY; 21667 (*ipic)->ipic_addr_offset = sizeof (ipic_t); 21668 21669 bcopy(addr, *ipic + 1, addr_len); 21670 21671 (*ipic)->ipic_addr_length = addr_len; 21672 mp->b_wptr = &mp->b_rptr[sizeof (ipic_t) + addr_len]; 21673 21674 mp1 = mkiocb(IP_IOCTL); 21675 if (mp1 == NULL) { 21676 freemsg(mp); 21677 return (NULL); 21678 } 21679 mp1->b_cont = mp; 21680 ioc = (struct iocblk *)mp1->b_rptr; 21681 ioc->ioc_count = sizeof (ipic_t) + addr_len; 21682 21683 return (mp1); 21684 } 21685 21686 /* 21687 * Generate a reset based on an inbound packet for which there is no active 21688 * tcp state that we can find. 21689 * 21690 * IPSEC NOTE : Try to send the reply with the same protection as it came 21691 * in. We still have the ipsec_mp that the packet was attached to. Thus 21692 * the packet will go out at the same level of protection as it came in by 21693 * converting the IPSEC_IN to IPSEC_OUT. 21694 */ 21695 static void 21696 tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq, 21697 uint32_t ack, int ctl, uint_t ip_hdr_len) 21698 { 21699 ipha_t *ipha = NULL; 21700 ip6_t *ip6h = NULL; 21701 ushort_t len; 21702 tcph_t *tcph; 21703 int i; 21704 mblk_t *ipsec_mp; 21705 boolean_t mctl_present; 21706 ipic_t *ipic; 21707 ipaddr_t v4addr; 21708 in6_addr_t v6addr; 21709 int addr_len; 21710 void *addr; 21711 queue_t *q = tcp_g_q; 21712 tcp_t *tcp = Q_TO_TCP(q); 21713 21714 if (!tcp_send_rst_chk()) { 21715 tcp_rst_unsent++; 21716 freemsg(mp); 21717 return; 21718 } 21719 21720 if (mp->b_datap->db_type == M_CTL) { 21721 ipsec_mp = mp; 21722 mp = mp->b_cont; 21723 mctl_present = B_TRUE; 21724 } else { 21725 ipsec_mp = mp; 21726 mctl_present = B_FALSE; 21727 } 21728 21729 if (str && q && tcp_dbg) { 21730 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 21731 "tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, " 21732 "flags 0x%x", 21733 str, seq, ack, ctl); 21734 } 21735 if (mp->b_datap->db_ref != 1) { 21736 mblk_t *mp1 = copyb(mp); 21737 freemsg(mp); 21738 mp = mp1; 21739 if (!mp) { 21740 if (mctl_present) 21741 freeb(ipsec_mp); 21742 return; 21743 } else { 21744 if (mctl_present) { 21745 ipsec_mp->b_cont = mp; 21746 } else { 21747 ipsec_mp = mp; 21748 } 21749 } 21750 } else if (mp->b_cont) { 21751 freemsg(mp->b_cont); 21752 mp->b_cont = NULL; 21753 } 21754 /* 21755 * We skip reversing source route here. 21756 * (for now we replace all IP options with EOL) 21757 */ 21758 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21759 ipha = (ipha_t *)mp->b_rptr; 21760 for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++) 21761 mp->b_rptr[i] = IPOPT_EOL; 21762 /* 21763 * Make sure that src address isn't flagrantly invalid. 21764 * Not all broadcast address checking for the src address 21765 * is possible, since we don't know the netmask of the src 21766 * addr. No check for destination address is done, since 21767 * IP will not pass up a packet with a broadcast dest 21768 * address to TCP. Similar checks are done below for IPv6. 21769 */ 21770 if (ipha->ipha_src == 0 || ipha->ipha_src == INADDR_BROADCAST || 21771 CLASSD(ipha->ipha_src)) { 21772 freemsg(ipsec_mp); 21773 BUMP_MIB(&ip_mib, ipInDiscards); 21774 return; 21775 } 21776 } else { 21777 ip6h = (ip6_t *)mp->b_rptr; 21778 21779 if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) || 21780 IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src)) { 21781 freemsg(ipsec_mp); 21782 BUMP_MIB(&ip6_mib, ipv6InDiscards); 21783 return; 21784 } 21785 21786 /* Remove any extension headers assuming partial overlay */ 21787 if (ip_hdr_len > IPV6_HDR_LEN) { 21788 uint8_t *to; 21789 21790 to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN; 21791 ovbcopy(ip6h, to, IPV6_HDR_LEN); 21792 mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN; 21793 ip_hdr_len = IPV6_HDR_LEN; 21794 ip6h = (ip6_t *)mp->b_rptr; 21795 ip6h->ip6_nxt = IPPROTO_TCP; 21796 } 21797 } 21798 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 21799 if (tcph->th_flags[0] & TH_RST) { 21800 freemsg(ipsec_mp); 21801 return; 21802 } 21803 tcph->th_offset_and_rsrvd[0] = (5 << 4); 21804 len = ip_hdr_len + sizeof (tcph_t); 21805 mp->b_wptr = &mp->b_rptr[len]; 21806 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21807 ipha->ipha_length = htons(len); 21808 /* Swap addresses */ 21809 v4addr = ipha->ipha_src; 21810 ipha->ipha_src = ipha->ipha_dst; 21811 ipha->ipha_dst = v4addr; 21812 ipha->ipha_ident = 0; 21813 ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 21814 addr_len = IP_ADDR_LEN; 21815 addr = &v4addr; 21816 } else { 21817 /* No ip6i_t in this case */ 21818 ip6h->ip6_plen = htons(len - IPV6_HDR_LEN); 21819 /* Swap addresses */ 21820 v6addr = ip6h->ip6_src; 21821 ip6h->ip6_src = ip6h->ip6_dst; 21822 ip6h->ip6_dst = v6addr; 21823 ip6h->ip6_hops = (uchar_t)tcp_ipv6_hoplimit; 21824 addr_len = IPV6_ADDR_LEN; 21825 addr = &v6addr; 21826 } 21827 tcp_xchg(tcph->th_fport, tcph->th_lport, 2); 21828 U32_TO_BE32(ack, tcph->th_ack); 21829 U32_TO_BE32(seq, tcph->th_seq); 21830 U16_TO_BE16(0, tcph->th_win); 21831 U16_TO_BE16(sizeof (tcph_t), tcph->th_sum); 21832 tcph->th_flags[0] = (uint8_t)ctl; 21833 if (ctl & TH_RST) { 21834 BUMP_MIB(&tcp_mib, tcpOutRsts); 21835 BUMP_MIB(&tcp_mib, tcpOutControl); 21836 } 21837 if (mctl_present) { 21838 ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr; 21839 21840 ASSERT(ii->ipsec_in_type == IPSEC_IN); 21841 if (!ipsec_in_to_out(ipsec_mp, ipha, ip6h)) { 21842 return; 21843 } 21844 } 21845 /* 21846 * NOTE: one might consider tracing a TCP packet here, but 21847 * this function has no active TCP state nd no tcp structure 21848 * which has trace buffer. If we traced here, we would have 21849 * to keep a local trace buffer in tcp_record_trace(). 21850 */ 21851 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, ipsec_mp); 21852 21853 /* 21854 * Tell IP to mark the IRE used for this destination temporary. 21855 * This way, we can limit our exposure to DoS attack because IP 21856 * creates an IRE for each destination. If there are too many, 21857 * the time to do any routing lookup will be extremely long. And 21858 * the lookup can be in interrupt context. 21859 * 21860 * Note that in normal circumstances, this marking should not 21861 * affect anything. It would be nice if only 1 message is 21862 * needed to inform IP that the IRE created for this RST should 21863 * not be added to the cache table. But there is currently 21864 * not such communication mechanism between TCP and IP. So 21865 * the best we can do now is to send the advice ioctl to IP 21866 * to mark the IRE temporary. 21867 */ 21868 if ((mp = tcp_ip_advise_mblk(addr, addr_len, &ipic)) != NULL) { 21869 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21870 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21871 } 21872 } 21873 21874 /* 21875 * Initiate closedown sequence on an active connection. (May be called as 21876 * writer.) Return value zero for OK return, non-zero for error return. 21877 */ 21878 static int 21879 tcp_xmit_end(tcp_t *tcp) 21880 { 21881 ipic_t *ipic; 21882 mblk_t *mp; 21883 21884 if (tcp->tcp_state < TCPS_SYN_RCVD || 21885 tcp->tcp_state > TCPS_CLOSE_WAIT) { 21886 /* 21887 * Invalid state, only states TCPS_SYN_RCVD, 21888 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid 21889 */ 21890 return (-1); 21891 } 21892 21893 tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent; 21894 tcp->tcp_valid_bits |= TCP_FSS_VALID; 21895 /* 21896 * If there is nothing more unsent, send the FIN now. 21897 * Otherwise, it will go out with the last segment. 21898 */ 21899 if (tcp->tcp_unsent == 0) { 21900 mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 21901 tcp->tcp_fss, B_FALSE, NULL, B_FALSE); 21902 21903 if (mp) { 21904 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21905 tcp_send_data(tcp, tcp->tcp_wq, mp); 21906 } else { 21907 /* 21908 * Couldn't allocate msg. Pretend we got it out. 21909 * Wait for rexmit timeout. 21910 */ 21911 tcp->tcp_snxt = tcp->tcp_fss + 1; 21912 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 21913 } 21914 21915 /* 21916 * If needed, update tcp_rexmit_snxt as tcp_snxt is 21917 * changed. 21918 */ 21919 if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) { 21920 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 21921 } 21922 } else { 21923 /* 21924 * If tcp->tcp_cork is set, then the data will not get sent, 21925 * so we have to check that and unset it first. 21926 */ 21927 if (tcp->tcp_cork) 21928 tcp->tcp_cork = B_FALSE; 21929 tcp_wput_data(tcp, NULL, B_FALSE); 21930 } 21931 21932 /* 21933 * If TCP does not get enough samples of RTT or tcp_rtt_updates 21934 * is 0, don't update the cache. 21935 */ 21936 if (tcp_rtt_updates == 0 || tcp->tcp_rtt_update < tcp_rtt_updates) 21937 return (0); 21938 21939 /* 21940 * NOTE: should not update if source routes i.e. if tcp_remote if 21941 * different from the destination. 21942 */ 21943 if (tcp->tcp_ipversion == IPV4_VERSION) { 21944 if (tcp->tcp_remote != tcp->tcp_ipha->ipha_dst) { 21945 return (0); 21946 } 21947 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21948 &ipic); 21949 } else { 21950 if (!(IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6, 21951 &tcp->tcp_ip6h->ip6_dst))) { 21952 return (0); 21953 } 21954 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21955 &ipic); 21956 } 21957 21958 /* Record route attributes in the IRE for use by future connections. */ 21959 if (mp == NULL) 21960 return (0); 21961 21962 /* 21963 * We do not have a good algorithm to update ssthresh at this time. 21964 * So don't do any update. 21965 */ 21966 ipic->ipic_rtt = tcp->tcp_rtt_sa; 21967 ipic->ipic_rtt_sd = tcp->tcp_rtt_sd; 21968 21969 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21970 return (0); 21971 } 21972 21973 /* 21974 * Generate a "no listener here" RST in response to an "unknown" segment. 21975 * Note that we are reusing the incoming mp to construct the outgoing 21976 * RST. 21977 */ 21978 void 21979 tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len) 21980 { 21981 uchar_t *rptr; 21982 uint32_t seg_len; 21983 tcph_t *tcph; 21984 uint32_t seg_seq; 21985 uint32_t seg_ack; 21986 uint_t flags; 21987 mblk_t *ipsec_mp; 21988 ipha_t *ipha; 21989 ip6_t *ip6h; 21990 boolean_t mctl_present = B_FALSE; 21991 boolean_t check = B_TRUE; 21992 boolean_t policy_present; 21993 21994 TCP_STAT(tcp_no_listener); 21995 21996 ipsec_mp = mp; 21997 21998 if (mp->b_datap->db_type == M_CTL) { 21999 ipsec_in_t *ii; 22000 22001 mctl_present = B_TRUE; 22002 mp = mp->b_cont; 22003 22004 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 22005 ASSERT(ii->ipsec_in_type == IPSEC_IN); 22006 if (ii->ipsec_in_dont_check) { 22007 check = B_FALSE; 22008 if (!ii->ipsec_in_secure) { 22009 freeb(ipsec_mp); 22010 mctl_present = B_FALSE; 22011 ipsec_mp = mp; 22012 } 22013 } 22014 } 22015 22016 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 22017 policy_present = ipsec_inbound_v4_policy_present; 22018 ipha = (ipha_t *)mp->b_rptr; 22019 ip6h = NULL; 22020 } else { 22021 policy_present = ipsec_inbound_v6_policy_present; 22022 ipha = NULL; 22023 ip6h = (ip6_t *)mp->b_rptr; 22024 } 22025 22026 if (check && policy_present) { 22027 /* 22028 * The conn_t parameter is NULL because we already know 22029 * nobody's home. 22030 */ 22031 ipsec_mp = ipsec_check_global_policy( 22032 ipsec_mp, (conn_t *)NULL, ipha, ip6h, mctl_present); 22033 if (ipsec_mp == NULL) 22034 return; 22035 } 22036 22037 22038 rptr = mp->b_rptr; 22039 22040 tcph = (tcph_t *)&rptr[ip_hdr_len]; 22041 seg_seq = BE32_TO_U32(tcph->th_seq); 22042 seg_ack = BE32_TO_U32(tcph->th_ack); 22043 flags = tcph->th_flags[0]; 22044 22045 seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcph) + ip_hdr_len); 22046 if (flags & TH_RST) { 22047 freemsg(ipsec_mp); 22048 } else if (flags & TH_ACK) { 22049 tcp_xmit_early_reset("no tcp, reset", 22050 ipsec_mp, seg_ack, 0, TH_RST, ip_hdr_len); 22051 } else { 22052 if (flags & TH_SYN) { 22053 seg_len++; 22054 } else { 22055 /* 22056 * Here we violate the RFC. Note that a normal 22057 * TCP will never send a segment without the ACK 22058 * flag, except for RST or SYN segment. This 22059 * segment is neither. Just drop it on the 22060 * floor. 22061 */ 22062 freemsg(ipsec_mp); 22063 tcp_rst_unsent++; 22064 return; 22065 } 22066 22067 tcp_xmit_early_reset("no tcp, reset/ack", 22068 ipsec_mp, 0, seg_seq + seg_len, 22069 TH_RST | TH_ACK, ip_hdr_len); 22070 } 22071 } 22072 22073 /* 22074 * tcp_xmit_mp is called to return a pointer to an mblk chain complete with 22075 * ip and tcp header ready to pass down to IP. If the mp passed in is 22076 * non-NULL, then up to max_to_send bytes of data will be dup'ed off that 22077 * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary 22078 * otherwise it will dup partial mblks.) 22079 * Otherwise, an appropriate ACK packet will be generated. This 22080 * routine is not usually called to send new data for the first time. It 22081 * is mostly called out of the timer for retransmits, and to generate ACKs. 22082 * 22083 * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will 22084 * be adjusted by *offset. And after dupb(), the offset and the ending mblk 22085 * of the original mblk chain will be returned in *offset and *end_mp. 22086 */ 22087 static mblk_t * 22088 tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset, 22089 mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len, 22090 boolean_t rexmit) 22091 { 22092 int data_length; 22093 int32_t off = 0; 22094 uint_t flags; 22095 mblk_t *mp1; 22096 mblk_t *mp2; 22097 uchar_t *rptr; 22098 tcph_t *tcph; 22099 int32_t num_sack_blk = 0; 22100 int32_t sack_opt_len = 0; 22101 22102 /* Allocate for our maximum TCP header + link-level */ 22103 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 22104 BPRI_MED); 22105 if (!mp1) 22106 return (NULL); 22107 data_length = 0; 22108 22109 /* 22110 * Note that tcp_mss has been adjusted to take into account the 22111 * timestamp option if applicable. Because SACK options do not 22112 * appear in every TCP segments and they are of variable lengths, 22113 * they cannot be included in tcp_mss. Thus we need to calculate 22114 * the actual segment length when we need to send a segment which 22115 * includes SACK options. 22116 */ 22117 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 22118 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 22119 tcp->tcp_num_sack_blk); 22120 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 22121 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 22122 if (max_to_send + sack_opt_len > tcp->tcp_mss) 22123 max_to_send -= sack_opt_len; 22124 } 22125 22126 if (offset != NULL) { 22127 off = *offset; 22128 /* We use offset as an indicator that end_mp is not NULL. */ 22129 *end_mp = NULL; 22130 } 22131 for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) { 22132 /* This could be faster with cooperation from downstream */ 22133 if (mp2 != mp1 && !sendall && 22134 data_length + (int)(mp->b_wptr - mp->b_rptr) > 22135 max_to_send) 22136 /* 22137 * Don't send the next mblk since the whole mblk 22138 * does not fit. 22139 */ 22140 break; 22141 mp2->b_cont = dupb(mp); 22142 mp2 = mp2->b_cont; 22143 if (!mp2) { 22144 freemsg(mp1); 22145 return (NULL); 22146 } 22147 mp2->b_rptr += off; 22148 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 22149 (uintptr_t)INT_MAX); 22150 22151 data_length += (int)(mp2->b_wptr - mp2->b_rptr); 22152 if (data_length > max_to_send) { 22153 mp2->b_wptr -= data_length - max_to_send; 22154 data_length = max_to_send; 22155 off = mp2->b_wptr - mp->b_rptr; 22156 break; 22157 } else { 22158 off = 0; 22159 } 22160 } 22161 if (offset != NULL) { 22162 *offset = off; 22163 *end_mp = mp; 22164 } 22165 if (seg_len != NULL) { 22166 *seg_len = data_length; 22167 } 22168 22169 /* Update the latest receive window size in TCP header. */ 22170 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22171 tcp->tcp_tcph->th_win); 22172 22173 rptr = mp1->b_rptr + tcp_wroff_xtra; 22174 mp1->b_rptr = rptr; 22175 mp1->b_wptr = rptr + tcp->tcp_hdr_len + sack_opt_len; 22176 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22177 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22178 U32_TO_ABE32(seq, tcph->th_seq); 22179 22180 /* 22181 * Use tcp_unsent to determine if the PUSH bit should be used assumes 22182 * that this function was called from tcp_wput_data. Thus, when called 22183 * to retransmit data the setting of the PUSH bit may appear some 22184 * what random in that it might get set when it should not. This 22185 * should not pose any performance issues. 22186 */ 22187 if (data_length != 0 && (tcp->tcp_unsent == 0 || 22188 tcp->tcp_unsent == data_length)) { 22189 flags = TH_ACK | TH_PUSH; 22190 } else { 22191 flags = TH_ACK; 22192 } 22193 22194 if (tcp->tcp_ecn_ok) { 22195 if (tcp->tcp_ecn_echo_on) 22196 flags |= TH_ECE; 22197 22198 /* 22199 * Only set ECT bit and ECN_CWR if a segment contains new data. 22200 * There is no TCP flow control for non-data segments, and 22201 * only data segment is transmitted reliably. 22202 */ 22203 if (data_length > 0 && !rexmit) { 22204 SET_ECT(tcp, rptr); 22205 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 22206 flags |= TH_CWR; 22207 tcp->tcp_ecn_cwr_sent = B_TRUE; 22208 } 22209 } 22210 } 22211 22212 if (tcp->tcp_valid_bits) { 22213 uint32_t u1; 22214 22215 if ((tcp->tcp_valid_bits & TCP_ISS_VALID) && 22216 seq == tcp->tcp_iss) { 22217 uchar_t *wptr; 22218 22219 /* 22220 * If TCP_ISS_VALID and the seq number is tcp_iss, 22221 * TCP can only be in SYN-SENT, SYN-RCVD or 22222 * FIN-WAIT-1 state. It can be FIN-WAIT-1 if 22223 * our SYN is not ack'ed but the app closes this 22224 * TCP connection. 22225 */ 22226 ASSERT(tcp->tcp_state == TCPS_SYN_SENT || 22227 tcp->tcp_state == TCPS_SYN_RCVD || 22228 tcp->tcp_state == TCPS_FIN_WAIT_1); 22229 22230 /* 22231 * Tack on the MSS option. It is always needed 22232 * for both active and passive open. 22233 * 22234 * MSS option value should be interface MTU - MIN 22235 * TCP/IP header according to RFC 793 as it means 22236 * the maximum segment size TCP can receive. But 22237 * to get around some broken middle boxes/end hosts 22238 * out there, we allow the option value to be the 22239 * same as the MSS option size on the peer side. 22240 * In this way, the other side will not send 22241 * anything larger than they can receive. 22242 * 22243 * Note that for SYN_SENT state, the ndd param 22244 * tcp_use_smss_as_mss_opt has no effect as we 22245 * don't know the peer's MSS option value. So 22246 * the only case we need to take care of is in 22247 * SYN_RCVD state, which is done later. 22248 */ 22249 wptr = mp1->b_wptr; 22250 wptr[0] = TCPOPT_MAXSEG; 22251 wptr[1] = TCPOPT_MAXSEG_LEN; 22252 wptr += 2; 22253 u1 = tcp->tcp_if_mtu - 22254 (tcp->tcp_ipversion == IPV4_VERSION ? 22255 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) - 22256 TCP_MIN_HEADER_LENGTH; 22257 U16_TO_BE16(u1, wptr); 22258 mp1->b_wptr = wptr + 2; 22259 /* Update the offset to cover the additional word */ 22260 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22261 22262 /* 22263 * Note that the following way of filling in 22264 * TCP options are not optimal. Some NOPs can 22265 * be saved. But there is no need at this time 22266 * to optimize it. When it is needed, we will 22267 * do it. 22268 */ 22269 switch (tcp->tcp_state) { 22270 case TCPS_SYN_SENT: 22271 flags = TH_SYN; 22272 22273 if (tcp->tcp_snd_ts_ok) { 22274 uint32_t llbolt = (uint32_t)lbolt; 22275 22276 wptr = mp1->b_wptr; 22277 wptr[0] = TCPOPT_NOP; 22278 wptr[1] = TCPOPT_NOP; 22279 wptr[2] = TCPOPT_TSTAMP; 22280 wptr[3] = TCPOPT_TSTAMP_LEN; 22281 wptr += 4; 22282 U32_TO_BE32(llbolt, wptr); 22283 wptr += 4; 22284 ASSERT(tcp->tcp_ts_recent == 0); 22285 U32_TO_BE32(0L, wptr); 22286 mp1->b_wptr += TCPOPT_REAL_TS_LEN; 22287 tcph->th_offset_and_rsrvd[0] += 22288 (3 << 4); 22289 } 22290 22291 /* 22292 * Set up all the bits to tell other side 22293 * we are ECN capable. 22294 */ 22295 if (tcp->tcp_ecn_ok) { 22296 flags |= (TH_ECE | TH_CWR); 22297 } 22298 break; 22299 case TCPS_SYN_RCVD: 22300 flags |= TH_SYN; 22301 22302 /* 22303 * Reset the MSS option value to be SMSS 22304 * We should probably add back the bytes 22305 * for timestamp option and IPsec. We 22306 * don't do that as this is a workaround 22307 * for broken middle boxes/end hosts, it 22308 * is better for us to be more cautious. 22309 * They may not take these things into 22310 * account in their SMSS calculation. Thus 22311 * the peer's calculated SMSS may be smaller 22312 * than what it can be. This should be OK. 22313 */ 22314 if (tcp_use_smss_as_mss_opt) { 22315 u1 = tcp->tcp_mss; 22316 U16_TO_BE16(u1, wptr); 22317 } 22318 22319 /* 22320 * If the other side is ECN capable, reply 22321 * that we are also ECN capable. 22322 */ 22323 if (tcp->tcp_ecn_ok) 22324 flags |= TH_ECE; 22325 break; 22326 default: 22327 /* 22328 * The above ASSERT() makes sure that this 22329 * must be FIN-WAIT-1 state. Our SYN has 22330 * not been ack'ed so retransmit it. 22331 */ 22332 flags |= TH_SYN; 22333 break; 22334 } 22335 22336 if (tcp->tcp_snd_ws_ok) { 22337 wptr = mp1->b_wptr; 22338 wptr[0] = TCPOPT_NOP; 22339 wptr[1] = TCPOPT_WSCALE; 22340 wptr[2] = TCPOPT_WS_LEN; 22341 wptr[3] = (uchar_t)tcp->tcp_rcv_ws; 22342 mp1->b_wptr += TCPOPT_REAL_WS_LEN; 22343 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22344 } 22345 22346 if (tcp->tcp_snd_sack_ok) { 22347 wptr = mp1->b_wptr; 22348 wptr[0] = TCPOPT_NOP; 22349 wptr[1] = TCPOPT_NOP; 22350 wptr[2] = TCPOPT_SACK_PERMITTED; 22351 wptr[3] = TCPOPT_SACK_OK_LEN; 22352 mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN; 22353 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22354 } 22355 22356 /* allocb() of adequate mblk assures space */ 22357 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 22358 (uintptr_t)INT_MAX); 22359 u1 = (int)(mp1->b_wptr - mp1->b_rptr); 22360 /* 22361 * Get IP set to checksum on our behalf 22362 * Include the adjustment for a source route if any. 22363 */ 22364 u1 += tcp->tcp_sum; 22365 u1 = (u1 >> 16) + (u1 & 0xFFFF); 22366 U16_TO_BE16(u1, tcph->th_sum); 22367 BUMP_MIB(&tcp_mib, tcpOutControl); 22368 } 22369 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 22370 (seq + data_length) == tcp->tcp_fss) { 22371 if (!tcp->tcp_fin_acked) { 22372 flags |= TH_FIN; 22373 BUMP_MIB(&tcp_mib, tcpOutControl); 22374 } 22375 if (!tcp->tcp_fin_sent) { 22376 tcp->tcp_fin_sent = B_TRUE; 22377 switch (tcp->tcp_state) { 22378 case TCPS_SYN_RCVD: 22379 case TCPS_ESTABLISHED: 22380 tcp->tcp_state = TCPS_FIN_WAIT_1; 22381 break; 22382 case TCPS_CLOSE_WAIT: 22383 tcp->tcp_state = TCPS_LAST_ACK; 22384 break; 22385 } 22386 if (tcp->tcp_suna == tcp->tcp_snxt) 22387 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 22388 tcp->tcp_snxt = tcp->tcp_fss + 1; 22389 } 22390 } 22391 /* 22392 * Note the trick here. u1 is unsigned. When tcp_urg 22393 * is smaller than seq, u1 will become a very huge value. 22394 * So the comparison will fail. Also note that tcp_urp 22395 * should be positive, see RFC 793 page 17. 22396 */ 22397 u1 = tcp->tcp_urg - seq + TCP_OLD_URP_INTERPRETATION; 22398 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && u1 != 0 && 22399 u1 < (uint32_t)(64 * 1024)) { 22400 flags |= TH_URG; 22401 BUMP_MIB(&tcp_mib, tcpOutUrg); 22402 U32_TO_ABE16(u1, tcph->th_urp); 22403 } 22404 } 22405 tcph->th_flags[0] = (uchar_t)flags; 22406 tcp->tcp_rack = tcp->tcp_rnxt; 22407 tcp->tcp_rack_cnt = 0; 22408 22409 if (tcp->tcp_snd_ts_ok) { 22410 if (tcp->tcp_state != TCPS_SYN_SENT) { 22411 uint32_t llbolt = (uint32_t)lbolt; 22412 22413 U32_TO_BE32(llbolt, 22414 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22415 U32_TO_BE32(tcp->tcp_ts_recent, 22416 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22417 } 22418 } 22419 22420 if (num_sack_blk > 0) { 22421 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22422 sack_blk_t *tmp; 22423 int32_t i; 22424 22425 wptr[0] = TCPOPT_NOP; 22426 wptr[1] = TCPOPT_NOP; 22427 wptr[2] = TCPOPT_SACK; 22428 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22429 sizeof (sack_blk_t); 22430 wptr += TCPOPT_REAL_SACK_LEN; 22431 22432 tmp = tcp->tcp_sack_list; 22433 for (i = 0; i < num_sack_blk; i++) { 22434 U32_TO_BE32(tmp[i].begin, wptr); 22435 wptr += sizeof (tcp_seq); 22436 U32_TO_BE32(tmp[i].end, wptr); 22437 wptr += sizeof (tcp_seq); 22438 } 22439 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) << 4); 22440 } 22441 ASSERT((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX); 22442 data_length += (int)(mp1->b_wptr - rptr); 22443 if (tcp->tcp_ipversion == IPV4_VERSION) { 22444 ((ipha_t *)rptr)->ipha_length = htons(data_length); 22445 } else { 22446 ip6_t *ip6 = (ip6_t *)(rptr + 22447 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22448 sizeof (ip6i_t) : 0)); 22449 22450 ip6->ip6_plen = htons(data_length - 22451 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22452 } 22453 22454 /* 22455 * Prime pump for IP 22456 * Include the adjustment for a source route if any. 22457 */ 22458 data_length -= tcp->tcp_ip_hdr_len; 22459 data_length += tcp->tcp_sum; 22460 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22461 U16_TO_ABE16(data_length, tcph->th_sum); 22462 if (tcp->tcp_ip_forward_progress) { 22463 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22464 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22465 tcp->tcp_ip_forward_progress = B_FALSE; 22466 } 22467 return (mp1); 22468 } 22469 22470 /* This function handles the push timeout. */ 22471 static void 22472 tcp_push_timer(void *arg) 22473 { 22474 conn_t *connp = (conn_t *)arg; 22475 tcp_t *tcp = connp->conn_tcp; 22476 22477 TCP_DBGSTAT(tcp_push_timer_cnt); 22478 22479 ASSERT(tcp->tcp_listener == NULL); 22480 22481 tcp->tcp_push_tid = 0; 22482 if ((tcp->tcp_rcv_list != NULL) && 22483 (tcp_rcv_drain(tcp->tcp_rq, tcp) == TH_ACK_NEEDED)) 22484 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 22485 } 22486 22487 /* 22488 * This function handles delayed ACK timeout. 22489 */ 22490 static void 22491 tcp_ack_timer(void *arg) 22492 { 22493 conn_t *connp = (conn_t *)arg; 22494 tcp_t *tcp = connp->conn_tcp; 22495 mblk_t *mp; 22496 22497 TCP_DBGSTAT(tcp_ack_timer_cnt); 22498 22499 tcp->tcp_ack_tid = 0; 22500 22501 if (tcp->tcp_fused) 22502 return; 22503 22504 /* 22505 * Do not send ACK if there is no outstanding unack'ed data. 22506 */ 22507 if (tcp->tcp_rnxt == tcp->tcp_rack) { 22508 return; 22509 } 22510 22511 if ((tcp->tcp_rnxt - tcp->tcp_rack) > tcp->tcp_mss) { 22512 /* 22513 * Make sure we don't allow deferred ACKs to result in 22514 * timer-based ACKing. If we have held off an ACK 22515 * when there was more than an mss here, and the timer 22516 * goes off, we have to worry about the possibility 22517 * that the sender isn't doing slow-start, or is out 22518 * of step with us for some other reason. We fall 22519 * permanently back in the direction of 22520 * ACK-every-other-packet as suggested in RFC 1122. 22521 */ 22522 if (tcp->tcp_rack_abs_max > 2) 22523 tcp->tcp_rack_abs_max--; 22524 tcp->tcp_rack_cur_max = 2; 22525 } 22526 mp = tcp_ack_mp(tcp); 22527 22528 if (mp != NULL) { 22529 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 22530 BUMP_LOCAL(tcp->tcp_obsegs); 22531 BUMP_MIB(&tcp_mib, tcpOutAck); 22532 BUMP_MIB(&tcp_mib, tcpOutAckDelayed); 22533 tcp_send_data(tcp, tcp->tcp_wq, mp); 22534 } 22535 } 22536 22537 22538 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 22539 static mblk_t * 22540 tcp_ack_mp(tcp_t *tcp) 22541 { 22542 uint32_t seq_no; 22543 22544 /* 22545 * There are a few cases to be considered while setting the sequence no. 22546 * Essentially, we can come here while processing an unacceptable pkt 22547 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 22548 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 22549 * If we are here for a zero window probe, stick with suna. In all 22550 * other cases, we check if suna + swnd encompasses snxt and set 22551 * the sequence number to snxt, if so. If snxt falls outside the 22552 * window (the receiver probably shrunk its window), we will go with 22553 * suna + swnd, otherwise the sequence no will be unacceptable to the 22554 * receiver. 22555 */ 22556 if (tcp->tcp_zero_win_probe) { 22557 seq_no = tcp->tcp_suna; 22558 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 22559 ASSERT(tcp->tcp_swnd == 0); 22560 seq_no = tcp->tcp_snxt; 22561 } else { 22562 seq_no = SEQ_GT(tcp->tcp_snxt, 22563 (tcp->tcp_suna + tcp->tcp_swnd)) ? 22564 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 22565 } 22566 22567 if (tcp->tcp_valid_bits) { 22568 /* 22569 * For the complex case where we have to send some 22570 * controls (FIN or SYN), let tcp_xmit_mp do it. 22571 */ 22572 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 22573 NULL, B_FALSE)); 22574 } else { 22575 /* Generate a simple ACK */ 22576 int data_length; 22577 uchar_t *rptr; 22578 tcph_t *tcph; 22579 mblk_t *mp1; 22580 int32_t tcp_hdr_len; 22581 int32_t tcp_tcp_hdr_len; 22582 int32_t num_sack_blk = 0; 22583 int32_t sack_opt_len; 22584 22585 /* 22586 * Allocate space for TCP + IP headers 22587 * and link-level header 22588 */ 22589 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 22590 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 22591 tcp->tcp_num_sack_blk); 22592 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 22593 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 22594 tcp_hdr_len = tcp->tcp_hdr_len + sack_opt_len; 22595 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + sack_opt_len; 22596 } else { 22597 tcp_hdr_len = tcp->tcp_hdr_len; 22598 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 22599 } 22600 mp1 = allocb(tcp_hdr_len + tcp_wroff_xtra, BPRI_MED); 22601 if (!mp1) 22602 return (NULL); 22603 22604 /* Update the latest receive window size in TCP header. */ 22605 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22606 tcp->tcp_tcph->th_win); 22607 /* copy in prototype TCP + IP header */ 22608 rptr = mp1->b_rptr + tcp_wroff_xtra; 22609 mp1->b_rptr = rptr; 22610 mp1->b_wptr = rptr + tcp_hdr_len; 22611 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22612 22613 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22614 22615 /* Set the TCP sequence number. */ 22616 U32_TO_ABE32(seq_no, tcph->th_seq); 22617 22618 /* Set up the TCP flag field. */ 22619 tcph->th_flags[0] = (uchar_t)TH_ACK; 22620 if (tcp->tcp_ecn_echo_on) 22621 tcph->th_flags[0] |= TH_ECE; 22622 22623 tcp->tcp_rack = tcp->tcp_rnxt; 22624 tcp->tcp_rack_cnt = 0; 22625 22626 /* fill in timestamp option if in use */ 22627 if (tcp->tcp_snd_ts_ok) { 22628 uint32_t llbolt = (uint32_t)lbolt; 22629 22630 U32_TO_BE32(llbolt, 22631 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22632 U32_TO_BE32(tcp->tcp_ts_recent, 22633 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22634 } 22635 22636 /* Fill in SACK options */ 22637 if (num_sack_blk > 0) { 22638 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22639 sack_blk_t *tmp; 22640 int32_t i; 22641 22642 wptr[0] = TCPOPT_NOP; 22643 wptr[1] = TCPOPT_NOP; 22644 wptr[2] = TCPOPT_SACK; 22645 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22646 sizeof (sack_blk_t); 22647 wptr += TCPOPT_REAL_SACK_LEN; 22648 22649 tmp = tcp->tcp_sack_list; 22650 for (i = 0; i < num_sack_blk; i++) { 22651 U32_TO_BE32(tmp[i].begin, wptr); 22652 wptr += sizeof (tcp_seq); 22653 U32_TO_BE32(tmp[i].end, wptr); 22654 wptr += sizeof (tcp_seq); 22655 } 22656 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) 22657 << 4); 22658 } 22659 22660 if (tcp->tcp_ipversion == IPV4_VERSION) { 22661 ((ipha_t *)rptr)->ipha_length = htons(tcp_hdr_len); 22662 } else { 22663 /* Check for ip6i_t header in sticky hdrs */ 22664 ip6_t *ip6 = (ip6_t *)(rptr + 22665 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22666 sizeof (ip6i_t) : 0)); 22667 22668 ip6->ip6_plen = htons(tcp_hdr_len - 22669 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22670 } 22671 22672 /* 22673 * Prime pump for checksum calculation in IP. Include the 22674 * adjustment for a source route if any. 22675 */ 22676 data_length = tcp_tcp_hdr_len + tcp->tcp_sum; 22677 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22678 U16_TO_ABE16(data_length, tcph->th_sum); 22679 22680 if (tcp->tcp_ip_forward_progress) { 22681 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22682 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22683 tcp->tcp_ip_forward_progress = B_FALSE; 22684 } 22685 return (mp1); 22686 } 22687 } 22688 22689 /* 22690 * To create a temporary tcp structure for inserting into bind hash list. 22691 * The parameter is assumed to be in network byte order, ready for use. 22692 */ 22693 /* ARGSUSED */ 22694 static tcp_t * 22695 tcp_alloc_temp_tcp(in_port_t port) 22696 { 22697 conn_t *connp; 22698 tcp_t *tcp; 22699 22700 connp = ipcl_conn_create(IPCL_TCPCONN, KM_SLEEP); 22701 if (connp == NULL) 22702 return (NULL); 22703 22704 tcp = connp->conn_tcp; 22705 22706 /* 22707 * Only initialize the necessary info in those structures. Note 22708 * that since INADDR_ANY is all 0, we do not need to set 22709 * tcp_bound_source to INADDR_ANY here. 22710 */ 22711 tcp->tcp_state = TCPS_BOUND; 22712 tcp->tcp_lport = port; 22713 tcp->tcp_exclbind = 1; 22714 tcp->tcp_reserved_port = 1; 22715 22716 /* Just for place holding... */ 22717 tcp->tcp_ipversion = IPV4_VERSION; 22718 22719 return (tcp); 22720 } 22721 22722 /* 22723 * To remove a port range specified by lo_port and hi_port from the 22724 * reserved port ranges. This is one of the three public functions of 22725 * the reserved port interface. Note that a port range has to be removed 22726 * as a whole. Ports in a range cannot be removed individually. 22727 * 22728 * Params: 22729 * in_port_t lo_port: the beginning port of the reserved port range to 22730 * be deleted. 22731 * in_port_t hi_port: the ending port of the reserved port range to 22732 * be deleted. 22733 * 22734 * Return: 22735 * B_TRUE if the deletion is successful, B_FALSE otherwise. 22736 */ 22737 boolean_t 22738 tcp_reserved_port_del(in_port_t lo_port, in_port_t hi_port) 22739 { 22740 int i, j; 22741 int size; 22742 tcp_t **temp_tcp_array; 22743 tcp_t *tcp; 22744 22745 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22746 22747 /* First make sure that the port ranage is indeed reserved. */ 22748 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22749 if (tcp_reserved_port[i].lo_port == lo_port) { 22750 hi_port = tcp_reserved_port[i].hi_port; 22751 temp_tcp_array = tcp_reserved_port[i].temp_tcp_array; 22752 break; 22753 } 22754 } 22755 if (i == tcp_reserved_port_array_size) { 22756 rw_exit(&tcp_reserved_port_lock); 22757 return (B_FALSE); 22758 } 22759 22760 /* 22761 * Remove the range from the array. This simple loop is possible 22762 * because port ranges are inserted in ascending order. 22763 */ 22764 for (j = i; j < tcp_reserved_port_array_size - 1; j++) { 22765 tcp_reserved_port[j].lo_port = tcp_reserved_port[j+1].lo_port; 22766 tcp_reserved_port[j].hi_port = tcp_reserved_port[j+1].hi_port; 22767 tcp_reserved_port[j].temp_tcp_array = 22768 tcp_reserved_port[j+1].temp_tcp_array; 22769 } 22770 22771 /* Remove all the temporary tcp structures. */ 22772 size = hi_port - lo_port + 1; 22773 while (size > 0) { 22774 tcp = temp_tcp_array[size - 1]; 22775 ASSERT(tcp != NULL); 22776 tcp_bind_hash_remove(tcp); 22777 CONN_DEC_REF(tcp->tcp_connp); 22778 size--; 22779 } 22780 kmem_free(temp_tcp_array, (hi_port - lo_port + 1) * sizeof (tcp_t *)); 22781 tcp_reserved_port_array_size--; 22782 rw_exit(&tcp_reserved_port_lock); 22783 return (B_TRUE); 22784 } 22785 22786 /* 22787 * Macro to remove temporary tcp structure from the bind hash list. The 22788 * first parameter is the list of tcp to be removed. The second parameter 22789 * is the number of tcps in the array. 22790 */ 22791 #define TCP_TMP_TCP_REMOVE(tcp_array, num) \ 22792 { \ 22793 while ((num) > 0) { \ 22794 tcp_t *tcp = (tcp_array)[(num) - 1]; \ 22795 tf_t *tbf; \ 22796 tcp_t *tcpnext; \ 22797 tbf = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)]; \ 22798 mutex_enter(&tbf->tf_lock); \ 22799 tcpnext = tcp->tcp_bind_hash; \ 22800 if (tcpnext) { \ 22801 tcpnext->tcp_ptpbhn = \ 22802 tcp->tcp_ptpbhn; \ 22803 } \ 22804 *tcp->tcp_ptpbhn = tcpnext; \ 22805 mutex_exit(&tbf->tf_lock); \ 22806 kmem_free(tcp, sizeof (tcp_t)); \ 22807 (tcp_array)[(num) - 1] = NULL; \ 22808 (num)--; \ 22809 } \ 22810 } 22811 22812 /* 22813 * The public interface for other modules to call to reserve a port range 22814 * in TCP. The caller passes in how large a port range it wants. TCP 22815 * will try to find a range and return it via lo_port and hi_port. This is 22816 * used by NCA's nca_conn_init. 22817 * NCA can only be used in the global zone so this only affects the global 22818 * zone's ports. 22819 * 22820 * Params: 22821 * int size: the size of the port range to be reserved. 22822 * in_port_t *lo_port (referenced): returns the beginning port of the 22823 * reserved port range added. 22824 * in_port_t *hi_port (referenced): returns the ending port of the 22825 * reserved port range added. 22826 * 22827 * Return: 22828 * B_TRUE if the port reservation is successful, B_FALSE otherwise. 22829 */ 22830 boolean_t 22831 tcp_reserved_port_add(int size, in_port_t *lo_port, in_port_t *hi_port) 22832 { 22833 tcp_t *tcp; 22834 tcp_t *tmp_tcp; 22835 tcp_t **temp_tcp_array; 22836 tf_t *tbf; 22837 in_port_t net_port; 22838 in_port_t port; 22839 int32_t cur_size; 22840 int i, j; 22841 boolean_t used; 22842 tcp_rport_t tmp_ports[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 22843 zoneid_t zoneid = GLOBAL_ZONEID; 22844 22845 /* Sanity check. */ 22846 if (size <= 0 || size > TCP_RESERVED_PORTS_RANGE_MAX) { 22847 return (B_FALSE); 22848 } 22849 22850 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22851 if (tcp_reserved_port_array_size == TCP_RESERVED_PORTS_ARRAY_MAX_SIZE) { 22852 rw_exit(&tcp_reserved_port_lock); 22853 return (B_FALSE); 22854 } 22855 22856 /* 22857 * Find the starting port to try. Since the port ranges are ordered 22858 * in the reserved port array, we can do a simple search here. 22859 */ 22860 *lo_port = TCP_SMALLEST_RESERVED_PORT; 22861 *hi_port = TCP_LARGEST_RESERVED_PORT; 22862 for (i = 0; i < tcp_reserved_port_array_size; 22863 *lo_port = tcp_reserved_port[i].hi_port + 1, i++) { 22864 if (tcp_reserved_port[i].lo_port - *lo_port >= size) { 22865 *hi_port = tcp_reserved_port[i].lo_port - 1; 22866 break; 22867 } 22868 } 22869 /* No available port range. */ 22870 if (i == tcp_reserved_port_array_size && *hi_port - *lo_port < size) { 22871 rw_exit(&tcp_reserved_port_lock); 22872 return (B_FALSE); 22873 } 22874 22875 temp_tcp_array = kmem_zalloc(size * sizeof (tcp_t *), KM_NOSLEEP); 22876 if (temp_tcp_array == NULL) { 22877 rw_exit(&tcp_reserved_port_lock); 22878 return (B_FALSE); 22879 } 22880 22881 /* Go thru the port range to see if some ports are already bound. */ 22882 for (port = *lo_port, cur_size = 0; 22883 cur_size < size && port <= *hi_port; 22884 cur_size++, port++) { 22885 used = B_FALSE; 22886 net_port = htons(port); 22887 tbf = &tcp_bind_fanout[TCP_BIND_HASH(net_port)]; 22888 mutex_enter(&tbf->tf_lock); 22889 for (tcp = tbf->tf_tcp; tcp != NULL; 22890 tcp = tcp->tcp_bind_hash) { 22891 if (zoneid == tcp->tcp_connp->conn_zoneid && 22892 net_port == tcp->tcp_lport) { 22893 /* 22894 * A port is already bound. Search again 22895 * starting from port + 1. Release all 22896 * temporary tcps. 22897 */ 22898 mutex_exit(&tbf->tf_lock); 22899 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22900 *lo_port = port + 1; 22901 cur_size = -1; 22902 used = B_TRUE; 22903 break; 22904 } 22905 } 22906 if (!used) { 22907 if ((tmp_tcp = tcp_alloc_temp_tcp(net_port)) == NULL) { 22908 /* 22909 * Allocation failure. Just fail the request. 22910 * Need to remove all those temporary tcp 22911 * structures. 22912 */ 22913 mutex_exit(&tbf->tf_lock); 22914 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22915 rw_exit(&tcp_reserved_port_lock); 22916 kmem_free(temp_tcp_array, 22917 (hi_port - lo_port + 1) * 22918 sizeof (tcp_t *)); 22919 return (B_FALSE); 22920 } 22921 temp_tcp_array[cur_size] = tmp_tcp; 22922 tcp_bind_hash_insert(tbf, tmp_tcp, B_TRUE); 22923 mutex_exit(&tbf->tf_lock); 22924 } 22925 } 22926 22927 /* 22928 * The current range is not large enough. We can actually do another 22929 * search if this search is done between 2 reserved port ranges. But 22930 * for first release, we just stop here and return saying that no port 22931 * range is available. 22932 */ 22933 if (cur_size < size) { 22934 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22935 rw_exit(&tcp_reserved_port_lock); 22936 kmem_free(temp_tcp_array, size * sizeof (tcp_t *)); 22937 return (B_FALSE); 22938 } 22939 *hi_port = port - 1; 22940 22941 /* 22942 * Insert range into array in ascending order. Since this function 22943 * must not be called often, we choose to use the simplest method. 22944 * The above array should not consume excessive stack space as 22945 * the size must be very small. If in future releases, we find 22946 * that we should provide more reserved port ranges, this function 22947 * has to be modified to be more efficient. 22948 */ 22949 if (tcp_reserved_port_array_size == 0) { 22950 tcp_reserved_port[0].lo_port = *lo_port; 22951 tcp_reserved_port[0].hi_port = *hi_port; 22952 tcp_reserved_port[0].temp_tcp_array = temp_tcp_array; 22953 } else { 22954 for (i = 0, j = 0; i < tcp_reserved_port_array_size; i++, j++) { 22955 if (*lo_port < tcp_reserved_port[i].lo_port && i == j) { 22956 tmp_ports[j].lo_port = *lo_port; 22957 tmp_ports[j].hi_port = *hi_port; 22958 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22959 j++; 22960 } 22961 tmp_ports[j].lo_port = tcp_reserved_port[i].lo_port; 22962 tmp_ports[j].hi_port = tcp_reserved_port[i].hi_port; 22963 tmp_ports[j].temp_tcp_array = 22964 tcp_reserved_port[i].temp_tcp_array; 22965 } 22966 if (j == i) { 22967 tmp_ports[j].lo_port = *lo_port; 22968 tmp_ports[j].hi_port = *hi_port; 22969 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22970 } 22971 bcopy(tmp_ports, tcp_reserved_port, sizeof (tmp_ports)); 22972 } 22973 tcp_reserved_port_array_size++; 22974 rw_exit(&tcp_reserved_port_lock); 22975 return (B_TRUE); 22976 } 22977 22978 /* 22979 * Check to see if a port is in any reserved port range. 22980 * 22981 * Params: 22982 * in_port_t port: the port to be verified. 22983 * 22984 * Return: 22985 * B_TRUE is the port is inside a reserved port range, B_FALSE otherwise. 22986 */ 22987 boolean_t 22988 tcp_reserved_port_check(in_port_t port) 22989 { 22990 int i; 22991 22992 rw_enter(&tcp_reserved_port_lock, RW_READER); 22993 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22994 if (port >= tcp_reserved_port[i].lo_port || 22995 port <= tcp_reserved_port[i].hi_port) { 22996 rw_exit(&tcp_reserved_port_lock); 22997 return (B_TRUE); 22998 } 22999 } 23000 rw_exit(&tcp_reserved_port_lock); 23001 return (B_FALSE); 23002 } 23003 23004 /* 23005 * To list all reserved port ranges. This is the function to handle 23006 * ndd tcp_reserved_port_list. 23007 */ 23008 /* ARGSUSED */ 23009 static int 23010 tcp_reserved_port_list(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 23011 { 23012 int i; 23013 23014 rw_enter(&tcp_reserved_port_lock, RW_READER); 23015 if (tcp_reserved_port_array_size > 0) 23016 (void) mi_mpprintf(mp, "The following ports are reserved:"); 23017 else 23018 (void) mi_mpprintf(mp, "No port is reserved."); 23019 for (i = 0; i < tcp_reserved_port_array_size; i++) { 23020 (void) mi_mpprintf(mp, "%d-%d", 23021 tcp_reserved_port[i].lo_port, tcp_reserved_port[i].hi_port); 23022 } 23023 rw_exit(&tcp_reserved_port_lock); 23024 return (0); 23025 } 23026 23027 /* 23028 * Hash list insertion routine for tcp_t structures. 23029 * Inserts entries with the ones bound to a specific IP address first 23030 * followed by those bound to INADDR_ANY. 23031 */ 23032 static void 23033 tcp_bind_hash_insert(tf_t *tbf, tcp_t *tcp, int caller_holds_lock) 23034 { 23035 tcp_t **tcpp; 23036 tcp_t *tcpnext; 23037 23038 if (tcp->tcp_ptpbhn != NULL) { 23039 ASSERT(!caller_holds_lock); 23040 tcp_bind_hash_remove(tcp); 23041 } 23042 tcpp = &tbf->tf_tcp; 23043 if (!caller_holds_lock) { 23044 mutex_enter(&tbf->tf_lock); 23045 } else { 23046 ASSERT(MUTEX_HELD(&tbf->tf_lock)); 23047 } 23048 tcpnext = tcpp[0]; 23049 if (tcpnext) { 23050 /* 23051 * If the new tcp bound to the INADDR_ANY address 23052 * and the first one in the list is not bound to 23053 * INADDR_ANY we skip all entries until we find the 23054 * first one bound to INADDR_ANY. 23055 * This makes sure that applications binding to a 23056 * specific address get preference over those binding to 23057 * INADDR_ANY. 23058 */ 23059 if (V6_OR_V4_INADDR_ANY(tcp->tcp_bound_source_v6) && 23060 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) { 23061 while ((tcpnext = tcpp[0]) != NULL && 23062 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) 23063 tcpp = &(tcpnext->tcp_bind_hash); 23064 if (tcpnext) 23065 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 23066 } else 23067 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 23068 } 23069 tcp->tcp_bind_hash = tcpnext; 23070 tcp->tcp_ptpbhn = tcpp; 23071 tcpp[0] = tcp; 23072 if (!caller_holds_lock) 23073 mutex_exit(&tbf->tf_lock); 23074 } 23075 23076 /* 23077 * Hash list removal routine for tcp_t structures. 23078 */ 23079 static void 23080 tcp_bind_hash_remove(tcp_t *tcp) 23081 { 23082 tcp_t *tcpnext; 23083 kmutex_t *lockp; 23084 23085 if (tcp->tcp_ptpbhn == NULL) 23086 return; 23087 23088 /* 23089 * Extract the lock pointer in case there are concurrent 23090 * hash_remove's for this instance. 23091 */ 23092 ASSERT(tcp->tcp_lport != 0); 23093 lockp = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)].tf_lock; 23094 23095 ASSERT(lockp != NULL); 23096 mutex_enter(lockp); 23097 if (tcp->tcp_ptpbhn) { 23098 tcpnext = tcp->tcp_bind_hash; 23099 if (tcpnext) { 23100 tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn; 23101 tcp->tcp_bind_hash = NULL; 23102 } 23103 *tcp->tcp_ptpbhn = tcpnext; 23104 tcp->tcp_ptpbhn = NULL; 23105 } 23106 mutex_exit(lockp); 23107 } 23108 23109 23110 /* 23111 * Hash list lookup routine for tcp_t structures. 23112 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 23113 */ 23114 static tcp_t * 23115 tcp_acceptor_hash_lookup(t_uscalar_t id) 23116 { 23117 tf_t *tf; 23118 tcp_t *tcp; 23119 23120 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 23121 mutex_enter(&tf->tf_lock); 23122 for (tcp = tf->tf_tcp; tcp != NULL; 23123 tcp = tcp->tcp_acceptor_hash) { 23124 if (tcp->tcp_acceptor_id == id) { 23125 CONN_INC_REF(tcp->tcp_connp); 23126 mutex_exit(&tf->tf_lock); 23127 return (tcp); 23128 } 23129 } 23130 mutex_exit(&tf->tf_lock); 23131 return (NULL); 23132 } 23133 23134 23135 /* 23136 * Hash list insertion routine for tcp_t structures. 23137 */ 23138 void 23139 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 23140 { 23141 tf_t *tf; 23142 tcp_t **tcpp; 23143 tcp_t *tcpnext; 23144 23145 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 23146 23147 if (tcp->tcp_ptpahn != NULL) 23148 tcp_acceptor_hash_remove(tcp); 23149 tcpp = &tf->tf_tcp; 23150 mutex_enter(&tf->tf_lock); 23151 tcpnext = tcpp[0]; 23152 if (tcpnext) 23153 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 23154 tcp->tcp_acceptor_hash = tcpnext; 23155 tcp->tcp_ptpahn = tcpp; 23156 tcpp[0] = tcp; 23157 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 23158 mutex_exit(&tf->tf_lock); 23159 } 23160 23161 /* 23162 * Hash list removal routine for tcp_t structures. 23163 */ 23164 static void 23165 tcp_acceptor_hash_remove(tcp_t *tcp) 23166 { 23167 tcp_t *tcpnext; 23168 kmutex_t *lockp; 23169 23170 /* 23171 * Extract the lock pointer in case there are concurrent 23172 * hash_remove's for this instance. 23173 */ 23174 lockp = tcp->tcp_acceptor_lockp; 23175 23176 if (tcp->tcp_ptpahn == NULL) 23177 return; 23178 23179 ASSERT(lockp != NULL); 23180 mutex_enter(lockp); 23181 if (tcp->tcp_ptpahn) { 23182 tcpnext = tcp->tcp_acceptor_hash; 23183 if (tcpnext) { 23184 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 23185 tcp->tcp_acceptor_hash = NULL; 23186 } 23187 *tcp->tcp_ptpahn = tcpnext; 23188 tcp->tcp_ptpahn = NULL; 23189 } 23190 mutex_exit(lockp); 23191 tcp->tcp_acceptor_lockp = NULL; 23192 } 23193 23194 /* ARGSUSED */ 23195 static int 23196 tcp_host_param_setvalue(queue_t *q, mblk_t *mp, char *value, caddr_t cp, int af) 23197 { 23198 int error = 0; 23199 int retval; 23200 char *end; 23201 23202 tcp_hsp_t *hsp; 23203 tcp_hsp_t *hspprev; 23204 23205 ipaddr_t addr = 0; /* Address we're looking for */ 23206 in6_addr_t v6addr; /* Address we're looking for */ 23207 uint32_t hash; /* Hash of that address */ 23208 23209 /* 23210 * If the following variables are still zero after parsing the input 23211 * string, the user didn't specify them and we don't change them in 23212 * the HSP. 23213 */ 23214 23215 ipaddr_t mask = 0; /* Subnet mask */ 23216 in6_addr_t v6mask; 23217 long sendspace = 0; /* Send buffer size */ 23218 long recvspace = 0; /* Receive buffer size */ 23219 long timestamp = 0; /* Originate TCP TSTAMP option, 1 = yes */ 23220 boolean_t delete = B_FALSE; /* User asked to delete this HSP */ 23221 23222 rw_enter(&tcp_hsp_lock, RW_WRITER); 23223 23224 /* Parse and validate address */ 23225 if (af == AF_INET) { 23226 retval = inet_pton(af, value, &addr); 23227 if (retval == 1) 23228 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr); 23229 } else if (af == AF_INET6) { 23230 retval = inet_pton(af, value, &v6addr); 23231 } else { 23232 error = EINVAL; 23233 goto done; 23234 } 23235 if (retval == 0) { 23236 error = EINVAL; 23237 goto done; 23238 } 23239 23240 while ((*value) && *value != ' ') 23241 value++; 23242 23243 /* Parse individual keywords, set variables if found */ 23244 while (*value) { 23245 /* Skip leading blanks */ 23246 23247 while (*value == ' ' || *value == '\t') 23248 value++; 23249 23250 /* If at end of string, we're done */ 23251 23252 if (!*value) 23253 break; 23254 23255 /* We have a word, figure out what it is */ 23256 23257 if (strncmp("mask", value, 4) == 0) { 23258 value += 4; 23259 while (*value == ' ' || *value == '\t') 23260 value++; 23261 /* Parse subnet mask */ 23262 if (af == AF_INET) { 23263 retval = inet_pton(af, value, &mask); 23264 if (retval == 1) { 23265 V4MASK_TO_V6(mask, v6mask); 23266 } 23267 } else if (af == AF_INET6) { 23268 retval = inet_pton(af, value, &v6mask); 23269 } 23270 if (retval != 1) { 23271 error = EINVAL; 23272 goto done; 23273 } 23274 while ((*value) && *value != ' ') 23275 value++; 23276 } else if (strncmp("sendspace", value, 9) == 0) { 23277 value += 9; 23278 23279 if (ddi_strtol(value, &end, 0, &sendspace) != 0 || 23280 sendspace < TCP_XMIT_HIWATER || 23281 sendspace >= (1L<<30)) { 23282 error = EINVAL; 23283 goto done; 23284 } 23285 value = end; 23286 } else if (strncmp("recvspace", value, 9) == 0) { 23287 value += 9; 23288 23289 if (ddi_strtol(value, &end, 0, &recvspace) != 0 || 23290 recvspace < TCP_RECV_HIWATER || 23291 recvspace >= (1L<<30)) { 23292 error = EINVAL; 23293 goto done; 23294 } 23295 value = end; 23296 } else if (strncmp("timestamp", value, 9) == 0) { 23297 value += 9; 23298 23299 if (ddi_strtol(value, &end, 0, ×tamp) != 0 || 23300 timestamp < 0 || timestamp > 1) { 23301 error = EINVAL; 23302 goto done; 23303 } 23304 23305 /* 23306 * We increment timestamp so we know it's been set; 23307 * this is undone when we put it in the HSP 23308 */ 23309 timestamp++; 23310 value = end; 23311 } else if (strncmp("delete", value, 6) == 0) { 23312 value += 6; 23313 delete = B_TRUE; 23314 } else { 23315 error = EINVAL; 23316 goto done; 23317 } 23318 } 23319 23320 /* Hash address for lookup */ 23321 23322 hash = TCP_HSP_HASH(addr); 23323 23324 if (delete) { 23325 /* 23326 * Note that deletes don't return an error if the thing 23327 * we're trying to delete isn't there. 23328 */ 23329 if (tcp_hsp_hash == NULL) 23330 goto done; 23331 hsp = tcp_hsp_hash[hash]; 23332 23333 if (hsp) { 23334 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23335 &v6addr)) { 23336 tcp_hsp_hash[hash] = hsp->tcp_hsp_next; 23337 mi_free((char *)hsp); 23338 } else { 23339 hspprev = hsp; 23340 while ((hsp = hsp->tcp_hsp_next) != NULL) { 23341 if (IN6_ARE_ADDR_EQUAL( 23342 &hsp->tcp_hsp_addr_v6, &v6addr)) { 23343 hspprev->tcp_hsp_next = 23344 hsp->tcp_hsp_next; 23345 mi_free((char *)hsp); 23346 break; 23347 } 23348 hspprev = hsp; 23349 } 23350 } 23351 } 23352 } else { 23353 /* 23354 * We're adding/modifying an HSP. If we haven't already done 23355 * so, allocate the hash table. 23356 */ 23357 23358 if (!tcp_hsp_hash) { 23359 tcp_hsp_hash = (tcp_hsp_t **) 23360 mi_zalloc(sizeof (tcp_hsp_t *) * TCP_HSP_HASH_SIZE); 23361 if (!tcp_hsp_hash) { 23362 error = EINVAL; 23363 goto done; 23364 } 23365 } 23366 23367 /* Get head of hash chain */ 23368 23369 hsp = tcp_hsp_hash[hash]; 23370 23371 /* Try to find pre-existing hsp on hash chain */ 23372 /* Doesn't handle CIDR prefixes. */ 23373 while (hsp) { 23374 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, &v6addr)) 23375 break; 23376 hsp = hsp->tcp_hsp_next; 23377 } 23378 23379 /* 23380 * If we didn't, create one with default values and put it 23381 * at head of hash chain 23382 */ 23383 23384 if (!hsp) { 23385 hsp = (tcp_hsp_t *)mi_zalloc(sizeof (tcp_hsp_t)); 23386 if (!hsp) { 23387 error = EINVAL; 23388 goto done; 23389 } 23390 hsp->tcp_hsp_next = tcp_hsp_hash[hash]; 23391 tcp_hsp_hash[hash] = hsp; 23392 } 23393 23394 /* Set values that the user asked us to change */ 23395 23396 hsp->tcp_hsp_addr_v6 = v6addr; 23397 if (IN6_IS_ADDR_V4MAPPED(&v6addr)) 23398 hsp->tcp_hsp_vers = IPV4_VERSION; 23399 else 23400 hsp->tcp_hsp_vers = IPV6_VERSION; 23401 hsp->tcp_hsp_subnet_v6 = v6mask; 23402 if (sendspace > 0) 23403 hsp->tcp_hsp_sendspace = sendspace; 23404 if (recvspace > 0) 23405 hsp->tcp_hsp_recvspace = recvspace; 23406 if (timestamp > 0) 23407 hsp->tcp_hsp_tstamp = timestamp - 1; 23408 } 23409 23410 done: 23411 rw_exit(&tcp_hsp_lock); 23412 return (error); 23413 } 23414 23415 /* Set callback routine passed to nd_load by tcp_param_register. */ 23416 /* ARGSUSED */ 23417 static int 23418 tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 23419 { 23420 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET)); 23421 } 23422 /* ARGSUSED */ 23423 static int 23424 tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23425 cred_t *cr) 23426 { 23427 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET6)); 23428 } 23429 23430 /* TCP host parameters report triggered via the Named Dispatch mechanism. */ 23431 /* ARGSUSED */ 23432 static int 23433 tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 23434 { 23435 tcp_hsp_t *hsp; 23436 int i; 23437 char addrbuf[INET6_ADDRSTRLEN], subnetbuf[INET6_ADDRSTRLEN]; 23438 23439 rw_enter(&tcp_hsp_lock, RW_READER); 23440 (void) mi_mpprintf(mp, 23441 "Hash HSP " MI_COL_HDRPAD_STR 23442 "Address Subnet Mask Send Receive TStamp"); 23443 if (tcp_hsp_hash) { 23444 for (i = 0; i < TCP_HSP_HASH_SIZE; i++) { 23445 hsp = tcp_hsp_hash[i]; 23446 while (hsp) { 23447 if (hsp->tcp_hsp_vers == IPV4_VERSION) { 23448 (void) inet_ntop(AF_INET, 23449 &hsp->tcp_hsp_addr, 23450 addrbuf, sizeof (addrbuf)); 23451 (void) inet_ntop(AF_INET, 23452 &hsp->tcp_hsp_subnet, 23453 subnetbuf, sizeof (subnetbuf)); 23454 } else { 23455 (void) inet_ntop(AF_INET6, 23456 &hsp->tcp_hsp_addr_v6, 23457 addrbuf, sizeof (addrbuf)); 23458 (void) inet_ntop(AF_INET6, 23459 &hsp->tcp_hsp_subnet_v6, 23460 subnetbuf, sizeof (subnetbuf)); 23461 } 23462 (void) mi_mpprintf(mp, 23463 " %03d " MI_COL_PTRFMT_STR 23464 "%s %s %010d %010d %d", 23465 i, 23466 (void *)hsp, 23467 addrbuf, 23468 subnetbuf, 23469 hsp->tcp_hsp_sendspace, 23470 hsp->tcp_hsp_recvspace, 23471 hsp->tcp_hsp_tstamp); 23472 23473 hsp = hsp->tcp_hsp_next; 23474 } 23475 } 23476 } 23477 rw_exit(&tcp_hsp_lock); 23478 return (0); 23479 } 23480 23481 23482 /* Data for fast netmask macro used by tcp_hsp_lookup */ 23483 23484 static ipaddr_t netmasks[] = { 23485 IN_CLASSA_NET, IN_CLASSA_NET, IN_CLASSB_NET, 23486 IN_CLASSC_NET | IN_CLASSD_NET /* Class C,D,E */ 23487 }; 23488 23489 #define netmask(addr) (netmasks[(ipaddr_t)(addr) >> 30]) 23490 23491 /* 23492 * XXX This routine should go away and instead we should use the metrics 23493 * associated with the routes to determine the default sndspace and rcvspace. 23494 */ 23495 static tcp_hsp_t * 23496 tcp_hsp_lookup(ipaddr_t addr) 23497 { 23498 tcp_hsp_t *hsp = NULL; 23499 23500 /* Quick check without acquiring the lock. */ 23501 if (tcp_hsp_hash == NULL) 23502 return (NULL); 23503 23504 rw_enter(&tcp_hsp_lock, RW_READER); 23505 23506 /* This routine finds the best-matching HSP for address addr. */ 23507 23508 if (tcp_hsp_hash) { 23509 int i; 23510 ipaddr_t srchaddr; 23511 tcp_hsp_t *hsp_net; 23512 23513 /* We do three passes: host, network, and subnet. */ 23514 23515 srchaddr = addr; 23516 23517 for (i = 1; i <= 3; i++) { 23518 /* Look for exact match on srchaddr */ 23519 23520 hsp = tcp_hsp_hash[TCP_HSP_HASH(srchaddr)]; 23521 while (hsp) { 23522 if (hsp->tcp_hsp_vers == IPV4_VERSION && 23523 hsp->tcp_hsp_addr == srchaddr) 23524 break; 23525 hsp = hsp->tcp_hsp_next; 23526 } 23527 ASSERT(hsp == NULL || 23528 hsp->tcp_hsp_vers == IPV4_VERSION); 23529 23530 /* 23531 * If this is the first pass: 23532 * If we found a match, great, return it. 23533 * If not, search for the network on the second pass. 23534 */ 23535 23536 if (i == 1) 23537 if (hsp) 23538 break; 23539 else 23540 { 23541 srchaddr = addr & netmask(addr); 23542 continue; 23543 } 23544 23545 /* 23546 * If this is the second pass: 23547 * If we found a match, but there's a subnet mask, 23548 * save the match but try again using the subnet 23549 * mask on the third pass. 23550 * Otherwise, return whatever we found. 23551 */ 23552 23553 if (i == 2) { 23554 if (hsp && hsp->tcp_hsp_subnet) { 23555 hsp_net = hsp; 23556 srchaddr = addr & hsp->tcp_hsp_subnet; 23557 continue; 23558 } else { 23559 break; 23560 } 23561 } 23562 23563 /* 23564 * This must be the third pass. If we didn't find 23565 * anything, return the saved network HSP instead. 23566 */ 23567 23568 if (!hsp) 23569 hsp = hsp_net; 23570 } 23571 } 23572 23573 rw_exit(&tcp_hsp_lock); 23574 return (hsp); 23575 } 23576 23577 /* 23578 * XXX Equally broken as the IPv4 routine. Doesn't handle longest 23579 * match lookup. 23580 */ 23581 static tcp_hsp_t * 23582 tcp_hsp_lookup_ipv6(in6_addr_t *v6addr) 23583 { 23584 tcp_hsp_t *hsp = NULL; 23585 23586 /* Quick check without acquiring the lock. */ 23587 if (tcp_hsp_hash == NULL) 23588 return (NULL); 23589 23590 rw_enter(&tcp_hsp_lock, RW_READER); 23591 23592 /* This routine finds the best-matching HSP for address addr. */ 23593 23594 if (tcp_hsp_hash) { 23595 int i; 23596 in6_addr_t v6srchaddr; 23597 tcp_hsp_t *hsp_net; 23598 23599 /* We do three passes: host, network, and subnet. */ 23600 23601 v6srchaddr = *v6addr; 23602 23603 for (i = 1; i <= 3; i++) { 23604 /* Look for exact match on srchaddr */ 23605 23606 hsp = tcp_hsp_hash[TCP_HSP_HASH( 23607 V4_PART_OF_V6(v6srchaddr))]; 23608 while (hsp) { 23609 if (hsp->tcp_hsp_vers == IPV6_VERSION && 23610 IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23611 &v6srchaddr)) 23612 break; 23613 hsp = hsp->tcp_hsp_next; 23614 } 23615 23616 /* 23617 * If this is the first pass: 23618 * If we found a match, great, return it. 23619 * If not, search for the network on the second pass. 23620 */ 23621 23622 if (i == 1) 23623 if (hsp) 23624 break; 23625 else { 23626 /* Assume a 64 bit mask */ 23627 v6srchaddr.s6_addr32[0] = 23628 v6addr->s6_addr32[0]; 23629 v6srchaddr.s6_addr32[1] = 23630 v6addr->s6_addr32[1]; 23631 v6srchaddr.s6_addr32[2] = 0; 23632 v6srchaddr.s6_addr32[3] = 0; 23633 continue; 23634 } 23635 23636 /* 23637 * If this is the second pass: 23638 * If we found a match, but there's a subnet mask, 23639 * save the match but try again using the subnet 23640 * mask on the third pass. 23641 * Otherwise, return whatever we found. 23642 */ 23643 23644 if (i == 2) { 23645 ASSERT(hsp == NULL || 23646 hsp->tcp_hsp_vers == IPV6_VERSION); 23647 if (hsp && 23648 !IN6_IS_ADDR_UNSPECIFIED( 23649 &hsp->tcp_hsp_subnet_v6)) { 23650 hsp_net = hsp; 23651 V6_MASK_COPY(*v6addr, 23652 hsp->tcp_hsp_subnet_v6, v6srchaddr); 23653 continue; 23654 } else { 23655 break; 23656 } 23657 } 23658 23659 /* 23660 * This must be the third pass. If we didn't find 23661 * anything, return the saved network HSP instead. 23662 */ 23663 23664 if (!hsp) 23665 hsp = hsp_net; 23666 } 23667 } 23668 23669 rw_exit(&tcp_hsp_lock); 23670 return (hsp); 23671 } 23672 23673 /* 23674 * Type three generator adapted from the random() function in 4.4 BSD: 23675 */ 23676 23677 /* 23678 * Copyright (c) 1983, 1993 23679 * The Regents of the University of California. All rights reserved. 23680 * 23681 * Redistribution and use in source and binary forms, with or without 23682 * modification, are permitted provided that the following conditions 23683 * are met: 23684 * 1. Redistributions of source code must retain the above copyright 23685 * notice, this list of conditions and the following disclaimer. 23686 * 2. Redistributions in binary form must reproduce the above copyright 23687 * notice, this list of conditions and the following disclaimer in the 23688 * documentation and/or other materials provided with the distribution. 23689 * 3. All advertising materials mentioning features or use of this software 23690 * must display the following acknowledgement: 23691 * This product includes software developed by the University of 23692 * California, Berkeley and its contributors. 23693 * 4. Neither the name of the University nor the names of its contributors 23694 * may be used to endorse or promote products derived from this software 23695 * without specific prior written permission. 23696 * 23697 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23698 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23699 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23700 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23701 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23702 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23703 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23704 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23705 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23706 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23707 * SUCH DAMAGE. 23708 */ 23709 23710 /* Type 3 -- x**31 + x**3 + 1 */ 23711 #define DEG_3 31 23712 #define SEP_3 3 23713 23714 23715 /* Protected by tcp_random_lock */ 23716 static int tcp_randtbl[DEG_3 + 1]; 23717 23718 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 23719 static int *tcp_random_rptr = &tcp_randtbl[1]; 23720 23721 static int *tcp_random_state = &tcp_randtbl[1]; 23722 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 23723 23724 kmutex_t tcp_random_lock; 23725 23726 void 23727 tcp_random_init(void) 23728 { 23729 int i; 23730 hrtime_t hrt; 23731 time_t wallclock; 23732 uint64_t result; 23733 23734 /* 23735 * Use high-res timer and current time for seed. Gethrtime() returns 23736 * a longlong, which may contain resolution down to nanoseconds. 23737 * The current time will either be a 32-bit or a 64-bit quantity. 23738 * XOR the two together in a 64-bit result variable. 23739 * Convert the result to a 32-bit value by multiplying the high-order 23740 * 32-bits by the low-order 32-bits. 23741 */ 23742 23743 hrt = gethrtime(); 23744 (void) drv_getparm(TIME, &wallclock); 23745 result = (uint64_t)wallclock ^ (uint64_t)hrt; 23746 mutex_enter(&tcp_random_lock); 23747 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 23748 (result & 0xffffffff); 23749 23750 for (i = 1; i < DEG_3; i++) 23751 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 23752 + 12345; 23753 tcp_random_fptr = &tcp_random_state[SEP_3]; 23754 tcp_random_rptr = &tcp_random_state[0]; 23755 mutex_exit(&tcp_random_lock); 23756 for (i = 0; i < 10 * DEG_3; i++) 23757 (void) tcp_random(); 23758 } 23759 23760 /* 23761 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 23762 * This range is selected to be approximately centered on TCP_ISS / 2, 23763 * and easy to compute. We get this value by generating a 32-bit random 23764 * number, selecting out the high-order 17 bits, and then adding one so 23765 * that we never return zero. 23766 */ 23767 int 23768 tcp_random(void) 23769 { 23770 int i; 23771 23772 mutex_enter(&tcp_random_lock); 23773 *tcp_random_fptr += *tcp_random_rptr; 23774 23775 /* 23776 * The high-order bits are more random than the low-order bits, 23777 * so we select out the high-order 17 bits and add one so that 23778 * we never return zero. 23779 */ 23780 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 23781 if (++tcp_random_fptr >= tcp_random_end_ptr) { 23782 tcp_random_fptr = tcp_random_state; 23783 ++tcp_random_rptr; 23784 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 23785 tcp_random_rptr = tcp_random_state; 23786 23787 mutex_exit(&tcp_random_lock); 23788 return (i); 23789 } 23790 23791 /* 23792 * XXX This will go away when TPI is extended to send 23793 * info reqs to sockfs/timod ..... 23794 * Given a queue, set the max packet size for the write 23795 * side of the queue below stream head. This value is 23796 * cached on the stream head. 23797 * Returns 1 on success, 0 otherwise. 23798 */ 23799 static int 23800 setmaxps(queue_t *q, int maxpsz) 23801 { 23802 struct stdata *stp; 23803 queue_t *wq; 23804 stp = STREAM(q); 23805 23806 /* 23807 * At this point change of a queue parameter is not allowed 23808 * when a multiplexor is sitting on top. 23809 */ 23810 if (stp->sd_flag & STPLEX) 23811 return (0); 23812 23813 claimstr(stp->sd_wrq); 23814 wq = stp->sd_wrq->q_next; 23815 ASSERT(wq != NULL); 23816 (void) strqset(wq, QMAXPSZ, 0, maxpsz); 23817 releasestr(stp->sd_wrq); 23818 return (1); 23819 } 23820 23821 static int 23822 tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp, 23823 int *t_errorp, int *sys_errorp) 23824 { 23825 int error; 23826 int is_absreq_failure; 23827 t_scalar_t *opt_lenp; 23828 t_scalar_t opt_offset; 23829 int prim_type; 23830 struct T_conn_req *tcreqp; 23831 struct T_conn_res *tcresp; 23832 cred_t *cr; 23833 23834 cr = DB_CREDDEF(mp, tcp->tcp_cred); 23835 23836 prim_type = ((union T_primitives *)mp->b_rptr)->type; 23837 ASSERT(prim_type == T_CONN_REQ || prim_type == O_T_CONN_RES || 23838 prim_type == T_CONN_RES); 23839 23840 switch (prim_type) { 23841 case T_CONN_REQ: 23842 tcreqp = (struct T_conn_req *)mp->b_rptr; 23843 opt_offset = tcreqp->OPT_offset; 23844 opt_lenp = (t_scalar_t *)&tcreqp->OPT_length; 23845 break; 23846 case O_T_CONN_RES: 23847 case T_CONN_RES: 23848 tcresp = (struct T_conn_res *)mp->b_rptr; 23849 opt_offset = tcresp->OPT_offset; 23850 opt_lenp = (t_scalar_t *)&tcresp->OPT_length; 23851 break; 23852 } 23853 23854 *t_errorp = 0; 23855 *sys_errorp = 0; 23856 *do_disconnectp = 0; 23857 23858 error = tpi_optcom_buf(tcp->tcp_wq, mp, opt_lenp, 23859 opt_offset, cr, &tcp_opt_obj, 23860 NULL, &is_absreq_failure); 23861 23862 switch (error) { 23863 case 0: /* no error */ 23864 ASSERT(is_absreq_failure == 0); 23865 return (0); 23866 case ENOPROTOOPT: 23867 *t_errorp = TBADOPT; 23868 break; 23869 case EACCES: 23870 *t_errorp = TACCES; 23871 break; 23872 default: 23873 *t_errorp = TSYSERR; *sys_errorp = error; 23874 break; 23875 } 23876 if (is_absreq_failure != 0) { 23877 /* 23878 * The connection request should get the local ack 23879 * T_OK_ACK and then a T_DISCON_IND. 23880 */ 23881 *do_disconnectp = 1; 23882 } 23883 return (-1); 23884 } 23885 23886 /* 23887 * Split this function out so that if the secret changes, I'm okay. 23888 * 23889 * Initialize the tcp_iss_cookie and tcp_iss_key. 23890 */ 23891 23892 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 23893 23894 static void 23895 tcp_iss_key_init(uint8_t *phrase, int len) 23896 { 23897 struct { 23898 int32_t current_time; 23899 uint32_t randnum; 23900 uint16_t pad; 23901 uint8_t ether[6]; 23902 uint8_t passwd[PASSWD_SIZE]; 23903 } tcp_iss_cookie; 23904 time_t t; 23905 23906 /* 23907 * Start with the current absolute time. 23908 */ 23909 (void) drv_getparm(TIME, &t); 23910 tcp_iss_cookie.current_time = t; 23911 23912 /* 23913 * XXX - Need a more random number per RFC 1750, not this crap. 23914 * OTOH, if what follows is pretty random, then I'm in better shape. 23915 */ 23916 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 23917 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 23918 23919 /* 23920 * The cpu_type_info is pretty non-random. Ugggh. It does serve 23921 * as a good template. 23922 */ 23923 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 23924 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 23925 23926 /* 23927 * The pass-phrase. Normally this is supplied by user-called NDD. 23928 */ 23929 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 23930 23931 /* 23932 * See 4010593 if this section becomes a problem again, 23933 * but the local ethernet address is useful here. 23934 */ 23935 (void) localetheraddr(NULL, 23936 (struct ether_addr *)&tcp_iss_cookie.ether); 23937 23938 /* 23939 * Hash 'em all together. The MD5Final is called per-connection. 23940 */ 23941 mutex_enter(&tcp_iss_key_lock); 23942 MD5Init(&tcp_iss_key); 23943 MD5Update(&tcp_iss_key, (uchar_t *)&tcp_iss_cookie, 23944 sizeof (tcp_iss_cookie)); 23945 mutex_exit(&tcp_iss_key_lock); 23946 } 23947 23948 /* 23949 * Set the RFC 1948 pass phrase 23950 */ 23951 /* ARGSUSED */ 23952 static int 23953 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23954 cred_t *cr) 23955 { 23956 /* 23957 * Basically, value contains a new pass phrase. Pass it along! 23958 */ 23959 tcp_iss_key_init((uint8_t *)value, strlen(value)); 23960 return (0); 23961 } 23962 23963 /* ARGSUSED */ 23964 static int 23965 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 23966 { 23967 bzero(buf, sizeof (tcp_sack_info_t)); 23968 return (0); 23969 } 23970 23971 /* ARGSUSED */ 23972 static int 23973 tcp_iphc_constructor(void *buf, void *cdrarg, int kmflags) 23974 { 23975 bzero(buf, TCP_MAX_COMBINED_HEADER_LENGTH); 23976 return (0); 23977 } 23978 23979 void 23980 tcp_ddi_init(void) 23981 { 23982 int i; 23983 23984 /* Initialize locks */ 23985 rw_init(&tcp_hsp_lock, NULL, RW_DEFAULT, NULL); 23986 mutex_init(&tcp_g_q_lock, NULL, MUTEX_DEFAULT, NULL); 23987 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 23988 mutex_init(&tcp_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 23989 mutex_init(&tcp_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 23990 rw_init(&tcp_reserved_port_lock, NULL, RW_DEFAULT, NULL); 23991 23992 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 23993 mutex_init(&tcp_bind_fanout[i].tf_lock, NULL, 23994 MUTEX_DEFAULT, NULL); 23995 } 23996 23997 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 23998 mutex_init(&tcp_acceptor_fanout[i].tf_lock, NULL, 23999 MUTEX_DEFAULT, NULL); 24000 } 24001 24002 /* TCP's IPsec code calls the packet dropper. */ 24003 ip_drop_register(&tcp_dropper, "TCP IPsec policy enforcement"); 24004 24005 if (!tcp_g_nd) { 24006 if (!tcp_param_register(tcp_param_arr, A_CNT(tcp_param_arr))) { 24007 nd_free(&tcp_g_nd); 24008 } 24009 } 24010 24011 /* 24012 * Note: To really walk the device tree you need the devinfo 24013 * pointer to your device which is only available after probe/attach. 24014 * The following is safe only because it uses ddi_root_node() 24015 */ 24016 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 24017 tcp_opt_obj.odb_opt_arr_cnt); 24018 24019 tcp_timercache = kmem_cache_create("tcp_timercache", 24020 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 24021 NULL, NULL, NULL, NULL, NULL, 0); 24022 24023 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 24024 sizeof (tcp_sack_info_t), 0, 24025 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 24026 24027 tcp_iphc_cache = kmem_cache_create("tcp_iphc_cache", 24028 TCP_MAX_COMBINED_HEADER_LENGTH, 0, 24029 tcp_iphc_constructor, NULL, NULL, NULL, NULL, 0); 24030 24031 tcp_squeue_wput_proc = tcp_squeue_switch(tcp_squeue_wput); 24032 tcp_squeue_close_proc = tcp_squeue_switch(tcp_squeue_close); 24033 24034 ip_squeue_init(tcp_squeue_add); 24035 24036 /* Initialize the random number generator */ 24037 tcp_random_init(); 24038 24039 /* 24040 * Initialize RFC 1948 secret values. This will probably be reset once 24041 * by the boot scripts. 24042 * 24043 * Use NULL name, as the name is caught by the new lockstats. 24044 * 24045 * Initialize with some random, non-guessable string, like the global 24046 * T_INFO_ACK. 24047 */ 24048 24049 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 24050 sizeof (tcp_g_t_info_ack)); 24051 24052 #if TCP_COUNTERS || TCP_DEBUG_COUNTER 24053 if ((tcp_kstat = kstat_create("tcp", 0, "tcpstat", 24054 "net", KSTAT_TYPE_NAMED, 24055 sizeof (tcp_statistics) / sizeof (kstat_named_t), 24056 KSTAT_FLAG_VIRTUAL)) != NULL) { 24057 tcp_kstat->ks_data = &tcp_statistics; 24058 kstat_install(tcp_kstat); 24059 } 24060 #endif 24061 tcp_kstat_init(); 24062 } 24063 24064 void 24065 tcp_ddi_destroy(void) 24066 { 24067 int i; 24068 24069 nd_free(&tcp_g_nd); 24070 24071 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 24072 mutex_destroy(&tcp_bind_fanout[i].tf_lock); 24073 } 24074 24075 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 24076 mutex_destroy(&tcp_acceptor_fanout[i].tf_lock); 24077 } 24078 24079 mutex_destroy(&tcp_iss_key_lock); 24080 rw_destroy(&tcp_hsp_lock); 24081 mutex_destroy(&tcp_g_q_lock); 24082 mutex_destroy(&tcp_random_lock); 24083 mutex_destroy(&tcp_epriv_port_lock); 24084 rw_destroy(&tcp_reserved_port_lock); 24085 24086 ip_drop_unregister(&tcp_dropper); 24087 24088 kmem_cache_destroy(tcp_timercache); 24089 kmem_cache_destroy(tcp_sack_info_cache); 24090 kmem_cache_destroy(tcp_iphc_cache); 24091 24092 tcp_kstat_fini(); 24093 } 24094 24095 /* 24096 * Generate ISS, taking into account NDD changes may happen halfway through. 24097 * (If the iss is not zero, set it.) 24098 */ 24099 24100 static void 24101 tcp_iss_init(tcp_t *tcp) 24102 { 24103 MD5_CTX context; 24104 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 24105 uint32_t answer[4]; 24106 24107 tcp_iss_incr_extra += (ISS_INCR >> 1); 24108 tcp->tcp_iss = tcp_iss_incr_extra; 24109 switch (tcp_strong_iss) { 24110 case 2: 24111 mutex_enter(&tcp_iss_key_lock); 24112 context = tcp_iss_key; 24113 mutex_exit(&tcp_iss_key_lock); 24114 arg.ports = tcp->tcp_ports; 24115 if (tcp->tcp_ipversion == IPV4_VERSION) { 24116 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 24117 &arg.src); 24118 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_dst, 24119 &arg.dst); 24120 } else { 24121 arg.src = tcp->tcp_ip6h->ip6_src; 24122 arg.dst = tcp->tcp_ip6h->ip6_dst; 24123 } 24124 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 24125 MD5Final((uchar_t *)answer, &context); 24126 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 24127 /* 24128 * Now that we've hashed into a unique per-connection sequence 24129 * space, add a random increment per strong_iss == 1. So I 24130 * guess we'll have to... 24131 */ 24132 /* FALLTHRU */ 24133 case 1: 24134 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 24135 break; 24136 default: 24137 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 24138 break; 24139 } 24140 tcp->tcp_valid_bits = TCP_ISS_VALID; 24141 tcp->tcp_fss = tcp->tcp_iss - 1; 24142 tcp->tcp_suna = tcp->tcp_iss; 24143 tcp->tcp_snxt = tcp->tcp_iss + 1; 24144 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 24145 tcp->tcp_csuna = tcp->tcp_snxt; 24146 } 24147 24148 /* 24149 * Exported routine for extracting active tcp connection status. 24150 * 24151 * This is used by the Solaris Cluster Networking software to 24152 * gather a list of connections that need to be forwarded to 24153 * specific nodes in the cluster when configuration changes occur. 24154 * 24155 * The callback is invoked for each tcp_t structure. Returning 24156 * non-zero from the callback routine terminates the search. 24157 */ 24158 int 24159 cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg) 24160 { 24161 tcp_t *tcp; 24162 cl_tcp_info_t cl_tcpi; 24163 connf_t *connfp; 24164 conn_t *connp; 24165 int i; 24166 24167 ASSERT(callback != NULL); 24168 24169 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 24170 24171 connfp = &ipcl_globalhash_fanout[i]; 24172 connp = NULL; 24173 24174 while ((connp = tcp_get_next_conn(connfp, connp))) { 24175 24176 tcp = connp->conn_tcp; 24177 cl_tcpi.cl_tcpi_version = CL_TCPI_V1; 24178 cl_tcpi.cl_tcpi_ipversion = tcp->tcp_ipversion; 24179 cl_tcpi.cl_tcpi_state = tcp->tcp_state; 24180 cl_tcpi.cl_tcpi_lport = tcp->tcp_lport; 24181 cl_tcpi.cl_tcpi_fport = tcp->tcp_fport; 24182 /* 24183 * The macros tcp_laddr and tcp_faddr give the IPv4 24184 * addresses. They are copied implicitly below as 24185 * mapped addresses. 24186 */ 24187 cl_tcpi.cl_tcpi_laddr_v6 = tcp->tcp_ip_src_v6; 24188 if (tcp->tcp_ipversion == IPV4_VERSION) { 24189 cl_tcpi.cl_tcpi_faddr = 24190 tcp->tcp_ipha->ipha_dst; 24191 } else { 24192 cl_tcpi.cl_tcpi_faddr_v6 = 24193 tcp->tcp_ip6h->ip6_dst; 24194 } 24195 24196 /* 24197 * If the callback returns non-zero 24198 * we terminate the traversal. 24199 */ 24200 if ((*callback)(&cl_tcpi, arg) != 0) { 24201 CONN_DEC_REF(tcp->tcp_connp); 24202 return (1); 24203 } 24204 } 24205 } 24206 24207 return (0); 24208 } 24209 24210 /* 24211 * Macros used for accessing the different types of sockaddr 24212 * structures inside a tcp_ioc_abort_conn_t. 24213 */ 24214 #define TCP_AC_V4LADDR(acp) ((sin_t *)&(acp)->ac_local) 24215 #define TCP_AC_V4RADDR(acp) ((sin_t *)&(acp)->ac_remote) 24216 #define TCP_AC_V4LOCAL(acp) (TCP_AC_V4LADDR(acp)->sin_addr.s_addr) 24217 #define TCP_AC_V4REMOTE(acp) (TCP_AC_V4RADDR(acp)->sin_addr.s_addr) 24218 #define TCP_AC_V4LPORT(acp) (TCP_AC_V4LADDR(acp)->sin_port) 24219 #define TCP_AC_V4RPORT(acp) (TCP_AC_V4RADDR(acp)->sin_port) 24220 #define TCP_AC_V6LADDR(acp) ((sin6_t *)&(acp)->ac_local) 24221 #define TCP_AC_V6RADDR(acp) ((sin6_t *)&(acp)->ac_remote) 24222 #define TCP_AC_V6LOCAL(acp) (TCP_AC_V6LADDR(acp)->sin6_addr) 24223 #define TCP_AC_V6REMOTE(acp) (TCP_AC_V6RADDR(acp)->sin6_addr) 24224 #define TCP_AC_V6LPORT(acp) (TCP_AC_V6LADDR(acp)->sin6_port) 24225 #define TCP_AC_V6RPORT(acp) (TCP_AC_V6RADDR(acp)->sin6_port) 24226 24227 /* 24228 * Return the correct error code to mimic the behavior 24229 * of a connection reset. 24230 */ 24231 #define TCP_AC_GET_ERRCODE(state, err) { \ 24232 switch ((state)) { \ 24233 case TCPS_SYN_SENT: \ 24234 case TCPS_SYN_RCVD: \ 24235 (err) = ECONNREFUSED; \ 24236 break; \ 24237 case TCPS_ESTABLISHED: \ 24238 case TCPS_FIN_WAIT_1: \ 24239 case TCPS_FIN_WAIT_2: \ 24240 case TCPS_CLOSE_WAIT: \ 24241 (err) = ECONNRESET; \ 24242 break; \ 24243 case TCPS_CLOSING: \ 24244 case TCPS_LAST_ACK: \ 24245 case TCPS_TIME_WAIT: \ 24246 (err) = 0; \ 24247 break; \ 24248 default: \ 24249 (err) = ENXIO; \ 24250 } \ 24251 } 24252 24253 /* 24254 * Check if a tcp structure matches the info in acp. 24255 */ 24256 #define TCP_AC_ADDR_MATCH(acp, tcp) \ 24257 (((acp)->ac_local.ss_family == AF_INET) ? \ 24258 ((TCP_AC_V4LOCAL((acp)) == INADDR_ANY || \ 24259 TCP_AC_V4LOCAL((acp)) == (tcp)->tcp_ip_src) && \ 24260 (TCP_AC_V4REMOTE((acp)) == INADDR_ANY || \ 24261 TCP_AC_V4REMOTE((acp)) == (tcp)->tcp_remote) && \ 24262 (TCP_AC_V4LPORT((acp)) == 0 || \ 24263 TCP_AC_V4LPORT((acp)) == (tcp)->tcp_lport) && \ 24264 (TCP_AC_V4RPORT((acp)) == 0 || \ 24265 TCP_AC_V4RPORT((acp)) == (tcp)->tcp_fport) && \ 24266 (acp)->ac_start <= (tcp)->tcp_state && \ 24267 (acp)->ac_end >= (tcp)->tcp_state) : \ 24268 ((IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL((acp))) || \ 24269 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6LOCAL((acp)), \ 24270 &(tcp)->tcp_ip_src_v6)) && \ 24271 (IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE((acp))) || \ 24272 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6REMOTE((acp)), \ 24273 &(tcp)->tcp_remote_v6)) && \ 24274 (TCP_AC_V6LPORT((acp)) == 0 || \ 24275 TCP_AC_V6LPORT((acp)) == (tcp)->tcp_lport) && \ 24276 (TCP_AC_V6RPORT((acp)) == 0 || \ 24277 TCP_AC_V6RPORT((acp)) == (tcp)->tcp_fport) && \ 24278 (acp)->ac_start <= (tcp)->tcp_state && \ 24279 (acp)->ac_end >= (tcp)->tcp_state)) 24280 24281 #define TCP_AC_MATCH(acp, tcp) \ 24282 (((acp)->ac_zoneid == ALL_ZONES || \ 24283 (acp)->ac_zoneid == tcp->tcp_connp->conn_zoneid) ? \ 24284 TCP_AC_ADDR_MATCH(acp, tcp) : 0) 24285 24286 /* 24287 * Build a message containing a tcp_ioc_abort_conn_t structure 24288 * which is filled in with information from acp and tp. 24289 */ 24290 static mblk_t * 24291 tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *acp, tcp_t *tp) 24292 { 24293 mblk_t *mp; 24294 tcp_ioc_abort_conn_t *tacp; 24295 24296 mp = allocb(sizeof (uint32_t) + sizeof (*acp), BPRI_LO); 24297 if (mp == NULL) 24298 return (NULL); 24299 24300 mp->b_datap->db_type = M_CTL; 24301 24302 *((uint32_t *)mp->b_rptr) = TCP_IOC_ABORT_CONN; 24303 tacp = (tcp_ioc_abort_conn_t *)((uchar_t *)mp->b_rptr + 24304 sizeof (uint32_t)); 24305 24306 tacp->ac_start = acp->ac_start; 24307 tacp->ac_end = acp->ac_end; 24308 tacp->ac_zoneid = acp->ac_zoneid; 24309 24310 if (acp->ac_local.ss_family == AF_INET) { 24311 tacp->ac_local.ss_family = AF_INET; 24312 tacp->ac_remote.ss_family = AF_INET; 24313 TCP_AC_V4LOCAL(tacp) = tp->tcp_ip_src; 24314 TCP_AC_V4REMOTE(tacp) = tp->tcp_remote; 24315 TCP_AC_V4LPORT(tacp) = tp->tcp_lport; 24316 TCP_AC_V4RPORT(tacp) = tp->tcp_fport; 24317 } else { 24318 tacp->ac_local.ss_family = AF_INET6; 24319 tacp->ac_remote.ss_family = AF_INET6; 24320 TCP_AC_V6LOCAL(tacp) = tp->tcp_ip_src_v6; 24321 TCP_AC_V6REMOTE(tacp) = tp->tcp_remote_v6; 24322 TCP_AC_V6LPORT(tacp) = tp->tcp_lport; 24323 TCP_AC_V6RPORT(tacp) = tp->tcp_fport; 24324 } 24325 mp->b_wptr = (uchar_t *)mp->b_rptr + sizeof (uint32_t) + sizeof (*acp); 24326 return (mp); 24327 } 24328 24329 /* 24330 * Print a tcp_ioc_abort_conn_t structure. 24331 */ 24332 static void 24333 tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *acp) 24334 { 24335 char lbuf[128]; 24336 char rbuf[128]; 24337 sa_family_t af; 24338 in_port_t lport, rport; 24339 ushort_t logflags; 24340 24341 af = acp->ac_local.ss_family; 24342 24343 if (af == AF_INET) { 24344 (void) inet_ntop(af, (const void *)&TCP_AC_V4LOCAL(acp), 24345 lbuf, 128); 24346 (void) inet_ntop(af, (const void *)&TCP_AC_V4REMOTE(acp), 24347 rbuf, 128); 24348 lport = ntohs(TCP_AC_V4LPORT(acp)); 24349 rport = ntohs(TCP_AC_V4RPORT(acp)); 24350 } else { 24351 (void) inet_ntop(af, (const void *)&TCP_AC_V6LOCAL(acp), 24352 lbuf, 128); 24353 (void) inet_ntop(af, (const void *)&TCP_AC_V6REMOTE(acp), 24354 rbuf, 128); 24355 lport = ntohs(TCP_AC_V6LPORT(acp)); 24356 rport = ntohs(TCP_AC_V6RPORT(acp)); 24357 } 24358 24359 logflags = SL_TRACE | SL_NOTE; 24360 /* 24361 * Don't print this message to the console if the operation was done 24362 * to a non-global zone. 24363 */ 24364 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24365 logflags |= SL_CONSOLE; 24366 (void) strlog(TCP_MODULE_ID, 0, 1, logflags, 24367 "TCP_IOC_ABORT_CONN: local = %s:%d, remote = %s:%d, " 24368 "start = %d, end = %d\n", lbuf, lport, rbuf, rport, 24369 acp->ac_start, acp->ac_end); 24370 } 24371 24372 /* 24373 * Called inside tcp_rput when a message built using 24374 * tcp_ioctl_abort_build_msg is put into a queue. 24375 * Note that when we get here there is no wildcard in acp any more. 24376 */ 24377 static void 24378 tcp_ioctl_abort_handler(tcp_t *tcp, mblk_t *mp) 24379 { 24380 tcp_ioc_abort_conn_t *acp; 24381 24382 acp = (tcp_ioc_abort_conn_t *)(mp->b_rptr + sizeof (uint32_t)); 24383 if (tcp->tcp_state <= acp->ac_end) { 24384 /* 24385 * If we get here, we are already on the correct 24386 * squeue. This ioctl follows the following path 24387 * tcp_wput -> tcp_wput_ioctl -> tcp_ioctl_abort_conn 24388 * ->tcp_ioctl_abort->squeue_fill (if on a 24389 * different squeue) 24390 */ 24391 int errcode; 24392 24393 TCP_AC_GET_ERRCODE(tcp->tcp_state, errcode); 24394 (void) tcp_clean_death(tcp, errcode, 26); 24395 } 24396 freemsg(mp); 24397 } 24398 24399 /* 24400 * Abort all matching connections on a hash chain. 24401 */ 24402 static int 24403 tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *acp, int index, int *count, 24404 boolean_t exact) 24405 { 24406 int nmatch, err = 0; 24407 tcp_t *tcp; 24408 MBLKP mp, last, listhead = NULL; 24409 conn_t *tconnp; 24410 connf_t *connfp = &ipcl_conn_fanout[index]; 24411 24412 startover: 24413 nmatch = 0; 24414 24415 mutex_enter(&connfp->connf_lock); 24416 for (tconnp = connfp->connf_head; tconnp != NULL; 24417 tconnp = tconnp->conn_next) { 24418 tcp = tconnp->conn_tcp; 24419 if (TCP_AC_MATCH(acp, tcp)) { 24420 CONN_INC_REF(tcp->tcp_connp); 24421 mp = tcp_ioctl_abort_build_msg(acp, tcp); 24422 if (mp == NULL) { 24423 err = ENOMEM; 24424 CONN_DEC_REF(tcp->tcp_connp); 24425 break; 24426 } 24427 mp->b_prev = (mblk_t *)tcp; 24428 24429 if (listhead == NULL) { 24430 listhead = mp; 24431 last = mp; 24432 } else { 24433 last->b_next = mp; 24434 last = mp; 24435 } 24436 nmatch++; 24437 if (exact) 24438 break; 24439 } 24440 24441 /* Avoid holding lock for too long. */ 24442 if (nmatch >= 500) 24443 break; 24444 } 24445 mutex_exit(&connfp->connf_lock); 24446 24447 /* Pass mp into the correct tcp */ 24448 while ((mp = listhead) != NULL) { 24449 listhead = listhead->b_next; 24450 tcp = (tcp_t *)mp->b_prev; 24451 mp->b_next = mp->b_prev = NULL; 24452 squeue_fill(tcp->tcp_connp->conn_sqp, mp, 24453 tcp_input, tcp->tcp_connp, SQTAG_TCP_ABORT_BUCKET); 24454 } 24455 24456 *count += nmatch; 24457 if (nmatch >= 500 && err == 0) 24458 goto startover; 24459 return (err); 24460 } 24461 24462 /* 24463 * Abort all connections that matches the attributes specified in acp. 24464 */ 24465 static int 24466 tcp_ioctl_abort(tcp_ioc_abort_conn_t *acp) 24467 { 24468 sa_family_t af; 24469 uint32_t ports; 24470 uint16_t *pports; 24471 int err = 0, count = 0; 24472 boolean_t exact = B_FALSE; /* set when there is no wildcard */ 24473 int index = -1; 24474 ushort_t logflags; 24475 24476 af = acp->ac_local.ss_family; 24477 24478 if (af == AF_INET) { 24479 if (TCP_AC_V4REMOTE(acp) != INADDR_ANY && 24480 TCP_AC_V4LPORT(acp) != 0 && TCP_AC_V4RPORT(acp) != 0) { 24481 pports = (uint16_t *)&ports; 24482 pports[1] = TCP_AC_V4LPORT(acp); 24483 pports[0] = TCP_AC_V4RPORT(acp); 24484 exact = (TCP_AC_V4LOCAL(acp) != INADDR_ANY); 24485 } 24486 } else { 24487 if (!IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE(acp)) && 24488 TCP_AC_V6LPORT(acp) != 0 && TCP_AC_V6RPORT(acp) != 0) { 24489 pports = (uint16_t *)&ports; 24490 pports[1] = TCP_AC_V6LPORT(acp); 24491 pports[0] = TCP_AC_V6RPORT(acp); 24492 exact = !IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL(acp)); 24493 } 24494 } 24495 24496 /* 24497 * For cases where remote addr, local port, and remote port are non- 24498 * wildcards, tcp_ioctl_abort_bucket will only be called once. 24499 */ 24500 if (index != -1) { 24501 err = tcp_ioctl_abort_bucket(acp, index, 24502 &count, exact); 24503 } else { 24504 /* 24505 * loop through all entries for wildcard case 24506 */ 24507 for (index = 0; index < ipcl_conn_fanout_size; index++) { 24508 err = tcp_ioctl_abort_bucket(acp, index, 24509 &count, exact); 24510 if (err != 0) 24511 break; 24512 } 24513 } 24514 24515 logflags = SL_TRACE | SL_NOTE; 24516 /* 24517 * Don't print this message to the console if the operation was done 24518 * to a non-global zone. 24519 */ 24520 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24521 logflags |= SL_CONSOLE; 24522 (void) strlog(TCP_MODULE_ID, 0, 1, logflags, "TCP_IOC_ABORT_CONN: " 24523 "aborted %d connection%c\n", count, ((count > 1) ? 's' : ' ')); 24524 if (err == 0 && count == 0) 24525 err = ENOENT; 24526 return (err); 24527 } 24528 24529 /* 24530 * Process the TCP_IOC_ABORT_CONN ioctl request. 24531 */ 24532 static void 24533 tcp_ioctl_abort_conn(queue_t *q, mblk_t *mp) 24534 { 24535 int err; 24536 IOCP iocp; 24537 MBLKP mp1; 24538 sa_family_t laf, raf; 24539 tcp_ioc_abort_conn_t *acp; 24540 zone_t *zptr; 24541 zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 24542 24543 iocp = (IOCP)mp->b_rptr; 24544 24545 if ((mp1 = mp->b_cont) == NULL || 24546 iocp->ioc_count != sizeof (tcp_ioc_abort_conn_t)) { 24547 err = EINVAL; 24548 goto out; 24549 } 24550 24551 /* check permissions */ 24552 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 24553 err = EPERM; 24554 goto out; 24555 } 24556 24557 if (mp1->b_cont != NULL) { 24558 freemsg(mp1->b_cont); 24559 mp1->b_cont = NULL; 24560 } 24561 24562 acp = (tcp_ioc_abort_conn_t *)mp1->b_rptr; 24563 laf = acp->ac_local.ss_family; 24564 raf = acp->ac_remote.ss_family; 24565 24566 /* check that a zone with the supplied zoneid exists */ 24567 if (acp->ac_zoneid != GLOBAL_ZONEID && acp->ac_zoneid != ALL_ZONES) { 24568 zptr = zone_find_by_id(zoneid); 24569 if (zptr != NULL) { 24570 zone_rele(zptr); 24571 } else { 24572 err = EINVAL; 24573 goto out; 24574 } 24575 } 24576 24577 if (acp->ac_start < TCPS_SYN_SENT || acp->ac_end > TCPS_TIME_WAIT || 24578 acp->ac_start > acp->ac_end || laf != raf || 24579 (laf != AF_INET && laf != AF_INET6)) { 24580 err = EINVAL; 24581 goto out; 24582 } 24583 24584 tcp_ioctl_abort_dump(acp); 24585 err = tcp_ioctl_abort(acp); 24586 24587 out: 24588 if (mp1 != NULL) { 24589 freemsg(mp1); 24590 mp->b_cont = NULL; 24591 } 24592 24593 if (err != 0) 24594 miocnak(q, mp, 0, err); 24595 else 24596 miocack(q, mp, 0, 0); 24597 } 24598 24599 /* 24600 * tcp_time_wait_processing() handles processing of incoming packets when 24601 * the tcp is in the TIME_WAIT state. 24602 * A TIME_WAIT tcp that has an associated open TCP stream is never put 24603 * on the time wait list. 24604 */ 24605 void 24606 tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq, 24607 uint32_t seg_ack, int seg_len, tcph_t *tcph) 24608 { 24609 int32_t bytes_acked; 24610 int32_t gap; 24611 int32_t rgap; 24612 tcp_opt_t tcpopt; 24613 uint_t flags; 24614 uint32_t new_swnd = 0; 24615 conn_t *connp; 24616 24617 BUMP_LOCAL(tcp->tcp_ibsegs); 24618 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 24619 24620 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 24621 new_swnd = BE16_TO_U16(tcph->th_win) << 24622 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 24623 if (tcp->tcp_snd_ts_ok) { 24624 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 24625 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24626 tcp->tcp_rnxt, TH_ACK); 24627 goto done; 24628 } 24629 } 24630 gap = seg_seq - tcp->tcp_rnxt; 24631 rgap = tcp->tcp_rwnd - (gap + seg_len); 24632 if (gap < 0) { 24633 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 24634 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 24635 (seg_len > -gap ? -gap : seg_len)); 24636 seg_len += gap; 24637 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 24638 if (flags & TH_RST) { 24639 goto done; 24640 } 24641 if ((flags & TH_FIN) && seg_len == -1) { 24642 /* 24643 * When TCP receives a duplicate FIN in 24644 * TIME_WAIT state, restart the 2 MSL timer. 24645 * See page 73 in RFC 793. Make sure this TCP 24646 * is already on the TIME_WAIT list. If not, 24647 * just restart the timer. 24648 */ 24649 if (TCP_IS_DETACHED(tcp)) { 24650 tcp_time_wait_remove(tcp, NULL); 24651 tcp_time_wait_append(tcp); 24652 TCP_DBGSTAT(tcp_rput_time_wait); 24653 } else { 24654 ASSERT(tcp != NULL); 24655 TCP_TIMER_RESTART(tcp, 24656 tcp_time_wait_interval); 24657 } 24658 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24659 tcp->tcp_rnxt, TH_ACK); 24660 goto done; 24661 } 24662 flags |= TH_ACK_NEEDED; 24663 seg_len = 0; 24664 goto process_ack; 24665 } 24666 24667 /* Fix seg_seq, and chew the gap off the front. */ 24668 seg_seq = tcp->tcp_rnxt; 24669 } 24670 24671 if ((flags & TH_SYN) && gap > 0 && rgap < 0) { 24672 /* 24673 * Make sure that when we accept the connection, pick 24674 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the 24675 * old connection. 24676 * 24677 * The next ISS generated is equal to tcp_iss_incr_extra 24678 * + ISS_INCR/2 + other components depending on the 24679 * value of tcp_strong_iss. We pre-calculate the new 24680 * ISS here and compare with tcp_snxt to determine if 24681 * we need to make adjustment to tcp_iss_incr_extra. 24682 * 24683 * The above calculation is ugly and is a 24684 * waste of CPU cycles... 24685 */ 24686 uint32_t new_iss = tcp_iss_incr_extra; 24687 int32_t adj; 24688 24689 switch (tcp_strong_iss) { 24690 case 2: { 24691 /* Add time and MD5 components. */ 24692 uint32_t answer[4]; 24693 struct { 24694 uint32_t ports; 24695 in6_addr_t src; 24696 in6_addr_t dst; 24697 } arg; 24698 MD5_CTX context; 24699 24700 mutex_enter(&tcp_iss_key_lock); 24701 context = tcp_iss_key; 24702 mutex_exit(&tcp_iss_key_lock); 24703 arg.ports = tcp->tcp_ports; 24704 /* We use MAPPED addresses in tcp_iss_init */ 24705 arg.src = tcp->tcp_ip_src_v6; 24706 if (tcp->tcp_ipversion == IPV4_VERSION) { 24707 IN6_IPADDR_TO_V4MAPPED( 24708 tcp->tcp_ipha->ipha_dst, 24709 &arg.dst); 24710 } else { 24711 arg.dst = 24712 tcp->tcp_ip6h->ip6_dst; 24713 } 24714 MD5Update(&context, (uchar_t *)&arg, 24715 sizeof (arg)); 24716 MD5Final((uchar_t *)answer, &context); 24717 answer[0] ^= answer[1] ^ answer[2] ^ answer[3]; 24718 new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0]; 24719 break; 24720 } 24721 case 1: 24722 /* Add time component and min random (i.e. 1). */ 24723 new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1; 24724 break; 24725 default: 24726 /* Add only time component. */ 24727 new_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 24728 break; 24729 } 24730 if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) { 24731 /* 24732 * New ISS not guaranteed to be ISS_INCR/2 24733 * ahead of the current tcp_snxt, so add the 24734 * difference to tcp_iss_incr_extra. 24735 */ 24736 tcp_iss_incr_extra += adj; 24737 } 24738 /* 24739 * If tcp_clean_death() can not perform the task now, 24740 * drop the SYN packet and let the other side re-xmit. 24741 * Otherwise pass the SYN packet back in, since the 24742 * old tcp state has been cleaned up or freed. 24743 */ 24744 if (tcp_clean_death(tcp, 0, 27) == -1) 24745 goto done; 24746 /* 24747 * We will come back to tcp_rput_data 24748 * on the global queue. Packets destined 24749 * for the global queue will be checked 24750 * with global policy. But the policy for 24751 * this packet has already been checked as 24752 * this was destined for the detached 24753 * connection. We need to bypass policy 24754 * check this time by attaching a dummy 24755 * ipsec_in with ipsec_in_dont_check set. 24756 */ 24757 if ((connp = ipcl_classify(mp, tcp->tcp_connp->conn_zoneid)) != 24758 NULL) { 24759 TCP_STAT(tcp_time_wait_syn_success); 24760 tcp_reinput(connp, mp, tcp->tcp_connp->conn_sqp); 24761 return; 24762 } 24763 goto done; 24764 } 24765 24766 /* 24767 * rgap is the amount of stuff received out of window. A negative 24768 * value is the amount out of window. 24769 */ 24770 if (rgap < 0) { 24771 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 24772 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 24773 /* Fix seg_len and make sure there is something left. */ 24774 seg_len += rgap; 24775 if (seg_len <= 0) { 24776 if (flags & TH_RST) { 24777 goto done; 24778 } 24779 flags |= TH_ACK_NEEDED; 24780 seg_len = 0; 24781 goto process_ack; 24782 } 24783 } 24784 /* 24785 * Check whether we can update tcp_ts_recent. This test is 24786 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 24787 * Extensions for High Performance: An Update", Internet Draft. 24788 */ 24789 if (tcp->tcp_snd_ts_ok && 24790 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 24791 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 24792 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 24793 tcp->tcp_last_rcv_lbolt = lbolt64; 24794 } 24795 24796 if (seg_seq != tcp->tcp_rnxt && seg_len > 0) { 24797 /* Always ack out of order packets */ 24798 flags |= TH_ACK_NEEDED; 24799 seg_len = 0; 24800 } else if (seg_len > 0) { 24801 BUMP_MIB(&tcp_mib, tcpInClosed); 24802 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 24803 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 24804 } 24805 if (flags & TH_RST) { 24806 (void) tcp_clean_death(tcp, 0, 28); 24807 goto done; 24808 } 24809 if (flags & TH_SYN) { 24810 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 24811 TH_RST|TH_ACK); 24812 /* 24813 * Do not delete the TCP structure if it is in 24814 * TIME_WAIT state. Refer to RFC 1122, 4.2.2.13. 24815 */ 24816 goto done; 24817 } 24818 process_ack: 24819 if (flags & TH_ACK) { 24820 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 24821 if (bytes_acked <= 0) { 24822 if (bytes_acked == 0 && seg_len == 0 && 24823 new_swnd == tcp->tcp_swnd) 24824 BUMP_MIB(&tcp_mib, tcpInDupAck); 24825 } else { 24826 /* Acks something not sent */ 24827 flags |= TH_ACK_NEEDED; 24828 } 24829 } 24830 if (flags & TH_ACK_NEEDED) { 24831 /* 24832 * Time to send an ack for some reason. 24833 */ 24834 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24835 tcp->tcp_rnxt, TH_ACK); 24836 } 24837 done: 24838 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 24839 mp->b_datap->db_cksumstart = 0; 24840 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 24841 TCP_STAT(tcp_time_wait_syn_fail); 24842 } 24843 freemsg(mp); 24844 } 24845 24846 /* 24847 * Return zero if the buffers are identical in length and content. 24848 * This is used for comparing extension header buffers. 24849 * Note that an extension header would be declared different 24850 * even if all that changed was the next header value in that header i.e. 24851 * what really changed is the next extension header. 24852 */ 24853 static boolean_t 24854 tcp_cmpbuf(void *a, uint_t alen, boolean_t b_valid, void *b, uint_t blen) 24855 { 24856 if (!b_valid) 24857 blen = 0; 24858 24859 if (alen != blen) 24860 return (B_TRUE); 24861 if (alen == 0) 24862 return (B_FALSE); /* Both zero length */ 24863 return (bcmp(a, b, alen)); 24864 } 24865 24866 /* 24867 * Preallocate memory for tcp_savebuf(). Returns B_TRUE if ok. 24868 * Return B_FALSE if memory allocation fails - don't change any state! 24869 */ 24870 static boolean_t 24871 tcp_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 24872 void *src, uint_t srclen) 24873 { 24874 void *dst; 24875 24876 if (!src_valid) 24877 srclen = 0; 24878 24879 ASSERT(*dstlenp == 0); 24880 if (src != NULL && srclen != 0) { 24881 dst = mi_alloc(srclen, BPRI_MED); 24882 if (dst == NULL) 24883 return (B_FALSE); 24884 } else { 24885 dst = NULL; 24886 } 24887 if (*dstp != NULL) { 24888 mi_free(*dstp); 24889 *dstp = NULL; 24890 *dstlenp = 0; 24891 } 24892 *dstp = dst; 24893 if (dst != NULL) 24894 *dstlenp = srclen; 24895 else 24896 *dstlenp = 0; 24897 return (B_TRUE); 24898 } 24899 24900 /* 24901 * Replace what is in *dst, *dstlen with the source. 24902 * Assumes tcp_allocbuf has already been called. 24903 */ 24904 static void 24905 tcp_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 24906 void *src, uint_t srclen) 24907 { 24908 if (!src_valid) 24909 srclen = 0; 24910 24911 ASSERT(*dstlenp == srclen); 24912 if (src != NULL && srclen != 0) { 24913 bcopy(src, *dstp, srclen); 24914 } 24915 } 24916 24917 /* 24918 * Allocate a T_SVR4_OPTMGMT_REQ. 24919 * The caller needs to increment tcp_drop_opt_ack_cnt when sending these so 24920 * that tcp_rput_other can drop the acks. 24921 */ 24922 static mblk_t * 24923 tcp_setsockopt_mp(int level, int cmd, char *opt, int optlen) 24924 { 24925 mblk_t *mp; 24926 struct T_optmgmt_req *tor; 24927 struct opthdr *oh; 24928 uint_t size; 24929 char *optptr; 24930 24931 size = sizeof (*tor) + sizeof (*oh) + optlen; 24932 mp = allocb(size, BPRI_MED); 24933 if (mp == NULL) 24934 return (NULL); 24935 24936 mp->b_wptr += size; 24937 mp->b_datap->db_type = M_PROTO; 24938 tor = (struct T_optmgmt_req *)mp->b_rptr; 24939 tor->PRIM_type = T_SVR4_OPTMGMT_REQ; 24940 tor->MGMT_flags = T_NEGOTIATE; 24941 tor->OPT_length = sizeof (*oh) + optlen; 24942 tor->OPT_offset = (t_scalar_t)sizeof (*tor); 24943 24944 oh = (struct opthdr *)&tor[1]; 24945 oh->level = level; 24946 oh->name = cmd; 24947 oh->len = optlen; 24948 if (optlen != 0) { 24949 optptr = (char *)&oh[1]; 24950 bcopy(opt, optptr, optlen); 24951 } 24952 return (mp); 24953 } 24954 24955 /* 24956 * TCP Timers Implementation. 24957 */ 24958 static timeout_id_t 24959 tcp_timeout(conn_t *connp, void (*f)(void *), clock_t tim) 24960 { 24961 mblk_t *mp; 24962 tcp_timer_t *tcpt; 24963 tcp_t *tcp = connp->conn_tcp; 24964 24965 ASSERT(connp->conn_sqp != NULL); 24966 24967 TCP_DBGSTAT(tcp_timeout_calls); 24968 24969 if (tcp->tcp_timercache == NULL) { 24970 mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC); 24971 } else { 24972 TCP_DBGSTAT(tcp_timeout_cached_alloc); 24973 mp = tcp->tcp_timercache; 24974 tcp->tcp_timercache = mp->b_next; 24975 mp->b_next = NULL; 24976 ASSERT(mp->b_wptr == NULL); 24977 } 24978 24979 CONN_INC_REF(connp); 24980 tcpt = (tcp_timer_t *)mp->b_rptr; 24981 tcpt->connp = connp; 24982 tcpt->tcpt_proc = f; 24983 tcpt->tcpt_tid = timeout(tcp_timer_callback, mp, tim); 24984 return ((timeout_id_t)mp); 24985 } 24986 24987 static void 24988 tcp_timer_callback(void *arg) 24989 { 24990 mblk_t *mp = (mblk_t *)arg; 24991 tcp_timer_t *tcpt; 24992 conn_t *connp; 24993 24994 tcpt = (tcp_timer_t *)mp->b_rptr; 24995 connp = tcpt->connp; 24996 squeue_fill(connp->conn_sqp, mp, 24997 tcp_timer_handler, connp, SQTAG_TCP_TIMER); 24998 } 24999 25000 static void 25001 tcp_timer_handler(void *arg, mblk_t *mp, void *arg2) 25002 { 25003 tcp_timer_t *tcpt; 25004 conn_t *connp = (conn_t *)arg; 25005 tcp_t *tcp = connp->conn_tcp; 25006 25007 tcpt = (tcp_timer_t *)mp->b_rptr; 25008 ASSERT(connp == tcpt->connp); 25009 ASSERT((squeue_t *)arg2 == connp->conn_sqp); 25010 25011 /* 25012 * If the TCP has reached the closed state, don't proceed any 25013 * further. This TCP logically does not exist on the system. 25014 * tcpt_proc could for example access queues, that have already 25015 * been qprocoff'ed off. Also see comments at the start of tcp_input 25016 */ 25017 if (tcp->tcp_state != TCPS_CLOSED) { 25018 (*tcpt->tcpt_proc)(connp); 25019 } else { 25020 tcp->tcp_timer_tid = 0; 25021 } 25022 tcp_timer_free(connp->conn_tcp, mp); 25023 } 25024 25025 /* 25026 * There is potential race with untimeout and the handler firing at the same 25027 * time. The mblock may be freed by the handler while we are trying to use 25028 * it. But since both should execute on the same squeue, this race should not 25029 * occur. 25030 */ 25031 static clock_t 25032 tcp_timeout_cancel(conn_t *connp, timeout_id_t id) 25033 { 25034 mblk_t *mp = (mblk_t *)id; 25035 tcp_timer_t *tcpt; 25036 clock_t delta; 25037 25038 TCP_DBGSTAT(tcp_timeout_cancel_reqs); 25039 25040 if (mp == NULL) 25041 return (-1); 25042 25043 tcpt = (tcp_timer_t *)mp->b_rptr; 25044 ASSERT(tcpt->connp == connp); 25045 25046 delta = untimeout(tcpt->tcpt_tid); 25047 25048 if (delta >= 0) { 25049 TCP_DBGSTAT(tcp_timeout_canceled); 25050 tcp_timer_free(connp->conn_tcp, mp); 25051 CONN_DEC_REF(connp); 25052 } 25053 25054 return (delta); 25055 } 25056 25057 /* 25058 * Allocate space for the timer event. The allocation looks like mblk, but it is 25059 * not a proper mblk. To avoid confusion we set b_wptr to NULL. 25060 * 25061 * Dealing with failures: If we can't allocate from the timer cache we try 25062 * allocating from dblock caches using allocb_tryhard(). In this case b_wptr 25063 * points to b_rptr. 25064 * If we can't allocate anything using allocb_tryhard(), we perform a last 25065 * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and 25066 * save the actual allocation size in b_datap. 25067 */ 25068 mblk_t * 25069 tcp_timermp_alloc(int kmflags) 25070 { 25071 mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache, 25072 kmflags & ~KM_PANIC); 25073 25074 if (mp != NULL) { 25075 mp->b_next = mp->b_prev = NULL; 25076 mp->b_rptr = (uchar_t *)(&mp[1]); 25077 mp->b_wptr = NULL; 25078 mp->b_datap = NULL; 25079 mp->b_queue = NULL; 25080 } else if (kmflags & KM_PANIC) { 25081 /* 25082 * Failed to allocate memory for the timer. Try allocating from 25083 * dblock caches. 25084 */ 25085 TCP_STAT(tcp_timermp_allocfail); 25086 mp = allocb_tryhard(sizeof (tcp_timer_t)); 25087 if (mp == NULL) { 25088 size_t size = 0; 25089 /* 25090 * Memory is really low. Try tryhard allocation. 25091 */ 25092 TCP_STAT(tcp_timermp_allocdblfail); 25093 mp = kmem_alloc_tryhard(sizeof (mblk_t) + 25094 sizeof (tcp_timer_t), &size, kmflags); 25095 mp->b_rptr = (uchar_t *)(&mp[1]); 25096 mp->b_next = mp->b_prev = NULL; 25097 mp->b_wptr = (uchar_t *)-1; 25098 mp->b_datap = (dblk_t *)size; 25099 mp->b_queue = NULL; 25100 } 25101 ASSERT(mp->b_wptr != NULL); 25102 } 25103 TCP_DBGSTAT(tcp_timermp_alloced); 25104 25105 return (mp); 25106 } 25107 25108 /* 25109 * Free per-tcp timer cache. 25110 * It can only contain entries from tcp_timercache. 25111 */ 25112 void 25113 tcp_timermp_free(tcp_t *tcp) 25114 { 25115 mblk_t *mp; 25116 25117 while ((mp = tcp->tcp_timercache) != NULL) { 25118 ASSERT(mp->b_wptr == NULL); 25119 tcp->tcp_timercache = tcp->tcp_timercache->b_next; 25120 kmem_cache_free(tcp_timercache, mp); 25121 } 25122 } 25123 25124 /* 25125 * Free timer event. Put it on the per-tcp timer cache if there is not too many 25126 * events there already (currently at most two events are cached). 25127 * If the event is not allocated from the timer cache, free it right away. 25128 */ 25129 static void 25130 tcp_timer_free(tcp_t *tcp, mblk_t *mp) 25131 { 25132 mblk_t *mp1 = tcp->tcp_timercache; 25133 25134 if (mp->b_wptr != NULL) { 25135 /* 25136 * This allocation is not from a timer cache, free it right 25137 * away. 25138 */ 25139 if (mp->b_wptr != (uchar_t *)-1) 25140 freeb(mp); 25141 else 25142 kmem_free(mp, (size_t)mp->b_datap); 25143 } else if (mp1 == NULL || mp1->b_next == NULL) { 25144 /* Cache this timer block for future allocations */ 25145 mp->b_rptr = (uchar_t *)(&mp[1]); 25146 mp->b_next = mp1; 25147 tcp->tcp_timercache = mp; 25148 } else { 25149 kmem_cache_free(tcp_timercache, mp); 25150 TCP_DBGSTAT(tcp_timermp_freed); 25151 } 25152 } 25153 25154 /* 25155 * End of TCP Timers implementation. 25156 */ 25157 25158 static void 25159 tcp_setqfull(tcp_t *tcp) 25160 { 25161 queue_t *q = tcp->tcp_wq; 25162 25163 if (!(q->q_flag & QFULL)) { 25164 TCP_STAT(tcp_flwctl_on); 25165 mutex_enter(QLOCK(q)); 25166 q->q_flag |= QFULL; 25167 mutex_exit(QLOCK(q)); 25168 } 25169 } 25170 25171 static void 25172 tcp_clrqfull(tcp_t *tcp) 25173 { 25174 queue_t *q = tcp->tcp_wq; 25175 25176 if (q->q_flag & QFULL) { 25177 mutex_enter(QLOCK(q)); 25178 q->q_flag &= ~QFULL; 25179 mutex_exit(QLOCK(q)); 25180 if (q->q_flag & QWANTW) 25181 qbackenable(q, 0); 25182 } 25183 } 25184 25185 /* 25186 * TCP Kstats implementation 25187 */ 25188 static void 25189 tcp_kstat_init(void) 25190 { 25191 tcp_named_kstat_t template = { 25192 { "rtoAlgorithm", KSTAT_DATA_INT32, 0 }, 25193 { "rtoMin", KSTAT_DATA_INT32, 0 }, 25194 { "rtoMax", KSTAT_DATA_INT32, 0 }, 25195 { "maxConn", KSTAT_DATA_INT32, 0 }, 25196 { "activeOpens", KSTAT_DATA_UINT32, 0 }, 25197 { "passiveOpens", KSTAT_DATA_UINT32, 0 }, 25198 { "attemptFails", KSTAT_DATA_UINT32, 0 }, 25199 { "estabResets", KSTAT_DATA_UINT32, 0 }, 25200 { "currEstab", KSTAT_DATA_UINT32, 0 }, 25201 { "inSegs", KSTAT_DATA_UINT32, 0 }, 25202 { "outSegs", KSTAT_DATA_UINT32, 0 }, 25203 { "retransSegs", KSTAT_DATA_UINT32, 0 }, 25204 { "connTableSize", KSTAT_DATA_INT32, 0 }, 25205 { "outRsts", KSTAT_DATA_UINT32, 0 }, 25206 { "outDataSegs", KSTAT_DATA_UINT32, 0 }, 25207 { "outDataBytes", KSTAT_DATA_UINT32, 0 }, 25208 { "retransBytes", KSTAT_DATA_UINT32, 0 }, 25209 { "outAck", KSTAT_DATA_UINT32, 0 }, 25210 { "outAckDelayed", KSTAT_DATA_UINT32, 0 }, 25211 { "outUrg", KSTAT_DATA_UINT32, 0 }, 25212 { "outWinUpdate", KSTAT_DATA_UINT32, 0 }, 25213 { "outWinProbe", KSTAT_DATA_UINT32, 0 }, 25214 { "outControl", KSTAT_DATA_UINT32, 0 }, 25215 { "outFastRetrans", KSTAT_DATA_UINT32, 0 }, 25216 { "inAckSegs", KSTAT_DATA_UINT32, 0 }, 25217 { "inAckBytes", KSTAT_DATA_UINT32, 0 }, 25218 { "inDupAck", KSTAT_DATA_UINT32, 0 }, 25219 { "inAckUnsent", KSTAT_DATA_UINT32, 0 }, 25220 { "inDataInorderSegs", KSTAT_DATA_UINT32, 0 }, 25221 { "inDataInorderBytes", KSTAT_DATA_UINT32, 0 }, 25222 { "inDataUnorderSegs", KSTAT_DATA_UINT32, 0 }, 25223 { "inDataUnorderBytes", KSTAT_DATA_UINT32, 0 }, 25224 { "inDataDupSegs", KSTAT_DATA_UINT32, 0 }, 25225 { "inDataDupBytes", KSTAT_DATA_UINT32, 0 }, 25226 { "inDataPartDupSegs", KSTAT_DATA_UINT32, 0 }, 25227 { "inDataPartDupBytes", KSTAT_DATA_UINT32, 0 }, 25228 { "inDataPastWinSegs", KSTAT_DATA_UINT32, 0 }, 25229 { "inDataPastWinBytes", KSTAT_DATA_UINT32, 0 }, 25230 { "inWinProbe", KSTAT_DATA_UINT32, 0 }, 25231 { "inWinUpdate", KSTAT_DATA_UINT32, 0 }, 25232 { "inClosed", KSTAT_DATA_UINT32, 0 }, 25233 { "rttUpdate", KSTAT_DATA_UINT32, 0 }, 25234 { "rttNoUpdate", KSTAT_DATA_UINT32, 0 }, 25235 { "timRetrans", KSTAT_DATA_UINT32, 0 }, 25236 { "timRetransDrop", KSTAT_DATA_UINT32, 0 }, 25237 { "timKeepalive", KSTAT_DATA_UINT32, 0 }, 25238 { "timKeepaliveProbe", KSTAT_DATA_UINT32, 0 }, 25239 { "timKeepaliveDrop", KSTAT_DATA_UINT32, 0 }, 25240 { "listenDrop", KSTAT_DATA_UINT32, 0 }, 25241 { "listenDropQ0", KSTAT_DATA_UINT32, 0 }, 25242 { "halfOpenDrop", KSTAT_DATA_UINT32, 0 }, 25243 { "outSackRetransSegs", KSTAT_DATA_UINT32, 0 }, 25244 { "connTableSize6", KSTAT_DATA_INT32, 0 } 25245 }; 25246 25247 tcp_mibkp = kstat_create("tcp", 0, "tcp", "mib2", KSTAT_TYPE_NAMED, 25248 NUM_OF_FIELDS(tcp_named_kstat_t), 0); 25249 25250 if (tcp_mibkp == NULL) 25251 return; 25252 25253 template.rtoAlgorithm.value.ui32 = 4; 25254 template.rtoMin.value.ui32 = tcp_rexmit_interval_min; 25255 template.rtoMax.value.ui32 = tcp_rexmit_interval_max; 25256 template.maxConn.value.i32 = -1; 25257 25258 bcopy(&template, tcp_mibkp->ks_data, sizeof (template)); 25259 25260 tcp_mibkp->ks_update = tcp_kstat_update; 25261 25262 kstat_install(tcp_mibkp); 25263 } 25264 25265 static void 25266 tcp_kstat_fini(void) 25267 { 25268 25269 if (tcp_mibkp != NULL) { 25270 kstat_delete(tcp_mibkp); 25271 tcp_mibkp = NULL; 25272 } 25273 } 25274 25275 static int 25276 tcp_kstat_update(kstat_t *kp, int rw) 25277 { 25278 tcp_named_kstat_t *tcpkp; 25279 tcp_t *tcp; 25280 connf_t *connfp; 25281 conn_t *connp; 25282 int i; 25283 25284 if (!kp || !kp->ks_data) 25285 return (EIO); 25286 25287 if (rw == KSTAT_WRITE) 25288 return (EACCES); 25289 25290 tcpkp = (tcp_named_kstat_t *)kp->ks_data; 25291 25292 tcpkp->currEstab.value.ui32 = 0; 25293 25294 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 25295 connfp = &ipcl_globalhash_fanout[i]; 25296 connp = NULL; 25297 while ((connp = tcp_get_next_conn(connfp, connp))) { 25298 tcp = connp->conn_tcp; 25299 switch (tcp_snmp_state(tcp)) { 25300 case MIB2_TCP_established: 25301 case MIB2_TCP_closeWait: 25302 tcpkp->currEstab.value.ui32++; 25303 break; 25304 } 25305 } 25306 } 25307 25308 tcpkp->activeOpens.value.ui32 = tcp_mib.tcpActiveOpens; 25309 tcpkp->passiveOpens.value.ui32 = tcp_mib.tcpPassiveOpens; 25310 tcpkp->attemptFails.value.ui32 = tcp_mib.tcpAttemptFails; 25311 tcpkp->estabResets.value.ui32 = tcp_mib.tcpEstabResets; 25312 tcpkp->inSegs.value.ui32 = tcp_mib.tcpInSegs; 25313 tcpkp->outSegs.value.ui32 = tcp_mib.tcpOutSegs; 25314 tcpkp->retransSegs.value.ui32 = tcp_mib.tcpRetransSegs; 25315 tcpkp->connTableSize.value.i32 = tcp_mib.tcpConnTableSize; 25316 tcpkp->outRsts.value.ui32 = tcp_mib.tcpOutRsts; 25317 tcpkp->outDataSegs.value.ui32 = tcp_mib.tcpOutDataSegs; 25318 tcpkp->outDataBytes.value.ui32 = tcp_mib.tcpOutDataBytes; 25319 tcpkp->retransBytes.value.ui32 = tcp_mib.tcpRetransBytes; 25320 tcpkp->outAck.value.ui32 = tcp_mib.tcpOutAck; 25321 tcpkp->outAckDelayed.value.ui32 = tcp_mib.tcpOutAckDelayed; 25322 tcpkp->outUrg.value.ui32 = tcp_mib.tcpOutUrg; 25323 tcpkp->outWinUpdate.value.ui32 = tcp_mib.tcpOutWinUpdate; 25324 tcpkp->outWinProbe.value.ui32 = tcp_mib.tcpOutWinProbe; 25325 tcpkp->outControl.value.ui32 = tcp_mib.tcpOutControl; 25326 tcpkp->outFastRetrans.value.ui32 = tcp_mib.tcpOutFastRetrans; 25327 tcpkp->inAckSegs.value.ui32 = tcp_mib.tcpInAckSegs; 25328 tcpkp->inAckBytes.value.ui32 = tcp_mib.tcpInAckBytes; 25329 tcpkp->inDupAck.value.ui32 = tcp_mib.tcpInDupAck; 25330 tcpkp->inAckUnsent.value.ui32 = tcp_mib.tcpInAckUnsent; 25331 tcpkp->inDataInorderSegs.value.ui32 = tcp_mib.tcpInDataInorderSegs; 25332 tcpkp->inDataInorderBytes.value.ui32 = tcp_mib.tcpInDataInorderBytes; 25333 tcpkp->inDataUnorderSegs.value.ui32 = tcp_mib.tcpInDataUnorderSegs; 25334 tcpkp->inDataUnorderBytes.value.ui32 = tcp_mib.tcpInDataUnorderBytes; 25335 tcpkp->inDataDupSegs.value.ui32 = tcp_mib.tcpInDataDupSegs; 25336 tcpkp->inDataDupBytes.value.ui32 = tcp_mib.tcpInDataDupBytes; 25337 tcpkp->inDataPartDupSegs.value.ui32 = tcp_mib.tcpInDataPartDupSegs; 25338 tcpkp->inDataPartDupBytes.value.ui32 = tcp_mib.tcpInDataPartDupBytes; 25339 tcpkp->inDataPastWinSegs.value.ui32 = tcp_mib.tcpInDataPastWinSegs; 25340 tcpkp->inDataPastWinBytes.value.ui32 = tcp_mib.tcpInDataPastWinBytes; 25341 tcpkp->inWinProbe.value.ui32 = tcp_mib.tcpInWinProbe; 25342 tcpkp->inWinUpdate.value.ui32 = tcp_mib.tcpInWinUpdate; 25343 tcpkp->inClosed.value.ui32 = tcp_mib.tcpInClosed; 25344 tcpkp->rttNoUpdate.value.ui32 = tcp_mib.tcpRttNoUpdate; 25345 tcpkp->rttUpdate.value.ui32 = tcp_mib.tcpRttUpdate; 25346 tcpkp->timRetrans.value.ui32 = tcp_mib.tcpTimRetrans; 25347 tcpkp->timRetransDrop.value.ui32 = tcp_mib.tcpTimRetransDrop; 25348 tcpkp->timKeepalive.value.ui32 = tcp_mib.tcpTimKeepalive; 25349 tcpkp->timKeepaliveProbe.value.ui32 = tcp_mib.tcpTimKeepaliveProbe; 25350 tcpkp->timKeepaliveDrop.value.ui32 = tcp_mib.tcpTimKeepaliveDrop; 25351 tcpkp->listenDrop.value.ui32 = tcp_mib.tcpListenDrop; 25352 tcpkp->listenDropQ0.value.ui32 = tcp_mib.tcpListenDropQ0; 25353 tcpkp->halfOpenDrop.value.ui32 = tcp_mib.tcpHalfOpenDrop; 25354 tcpkp->outSackRetransSegs.value.ui32 = tcp_mib.tcpOutSackRetransSegs; 25355 tcpkp->connTableSize6.value.i32 = tcp_mib.tcp6ConnTableSize; 25356 25357 return (0); 25358 } 25359 25360 void 25361 tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp) 25362 { 25363 uint16_t hdr_len; 25364 ipha_t *ipha; 25365 uint8_t *nexthdrp; 25366 tcph_t *tcph; 25367 25368 /* Already has an eager */ 25369 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 25370 TCP_STAT(tcp_reinput_syn); 25371 squeue_enter(connp->conn_sqp, mp, connp->conn_recv, 25372 connp, SQTAG_TCP_REINPUT_EAGER); 25373 return; 25374 } 25375 25376 switch (IPH_HDR_VERSION(mp->b_rptr)) { 25377 case IPV4_VERSION: 25378 ipha = (ipha_t *)mp->b_rptr; 25379 hdr_len = IPH_HDR_LENGTH(ipha); 25380 break; 25381 case IPV6_VERSION: 25382 if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, 25383 &hdr_len, &nexthdrp)) { 25384 CONN_DEC_REF(connp); 25385 freemsg(mp); 25386 return; 25387 } 25388 break; 25389 } 25390 25391 tcph = (tcph_t *)&mp->b_rptr[hdr_len]; 25392 if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) { 25393 mp->b_datap->db_struioflag |= STRUIO_EAGER; 25394 mp->b_datap->db_cksumstart = (intptr_t)sqp; 25395 } 25396 25397 squeue_fill(connp->conn_sqp, mp, connp->conn_recv, connp, 25398 SQTAG_TCP_REINPUT); 25399 } 25400 25401 static squeue_func_t 25402 tcp_squeue_switch(int val) 25403 { 25404 squeue_func_t rval = squeue_fill; 25405 25406 switch (val) { 25407 case 1: 25408 rval = squeue_enter_nodrain; 25409 break; 25410 case 2: 25411 rval = squeue_enter; 25412 break; 25413 default: 25414 break; 25415 } 25416 return (rval); 25417 } 25418 25419 static void 25420 tcp_squeue_add(squeue_t *sqp) 25421 { 25422 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 25423 sizeof (tcp_squeue_priv_t), KM_SLEEP); 25424 25425 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 25426 tcp_time_wait->tcp_time_wait_tid = timeout(tcp_time_wait_collector, 25427 sqp, TCP_TIME_WAIT_DELAY); 25428 } 25429