1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 25 * Copyright (c) 2011 Joyent, Inc. All rights reserved. 26 * Copyright (c) 2014 by Delphix. All rights reserved. 27 */ 28 29 /* This file contains all TCP input processing functions. */ 30 31 #include <sys/types.h> 32 #include <sys/stream.h> 33 #include <sys/strsun.h> 34 #include <sys/strsubr.h> 35 #include <sys/stropts.h> 36 #include <sys/strlog.h> 37 #define _SUN_TPI_VERSION 2 38 #include <sys/tihdr.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/squeue_impl.h> 42 #include <sys/squeue.h> 43 #include <sys/tsol/tnet.h> 44 45 #include <inet/common.h> 46 #include <inet/ip.h> 47 #include <inet/tcp.h> 48 #include <inet/tcp_impl.h> 49 #include <inet/tcp_cluster.h> 50 #include <inet/proto_set.h> 51 #include <inet/ipsec_impl.h> 52 53 /* 54 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing 55 */ 56 57 #ifdef _BIG_ENDIAN 58 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 59 (TCPOPT_TSTAMP << 8) | 10) 60 #else 61 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 62 (TCPOPT_NOP << 8) | TCPOPT_NOP) 63 #endif 64 65 /* 66 * Flags returned from tcp_parse_options. 67 */ 68 #define TCP_OPT_MSS_PRESENT 1 69 #define TCP_OPT_WSCALE_PRESENT 2 70 #define TCP_OPT_TSTAMP_PRESENT 4 71 #define TCP_OPT_SACK_OK_PRESENT 8 72 #define TCP_OPT_SACK_PRESENT 16 73 74 /* 75 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 76 */ 77 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 78 79 /* 80 * Since tcp_listener is not cleared atomically with tcp_detached 81 * being cleared we need this extra bit to tell a detached connection 82 * apart from one that is in the process of being accepted. 83 */ 84 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 85 (TCP_IS_DETACHED(tcp) && \ 86 (!(tcp)->tcp_hard_binding)) 87 88 /* 89 * Steps to do when a tcp_t moves to TIME-WAIT state. 90 * 91 * This connection is done, we don't need to account for it. Decrement 92 * the listener connection counter if needed. 93 * 94 * Decrement the connection counter of the stack. Note that this counter 95 * is per CPU. So the total number of connections in a stack is the sum of all 96 * of them. Since there is no lock for handling all of them exclusively, the 97 * resulting sum is only an approximation. 98 * 99 * Unconditionally clear the exclusive binding bit so this TIME-WAIT 100 * connection won't interfere with new ones. 101 * 102 * Start the TIME-WAIT timer. If upper layer has not closed the connection, 103 * the timer is handled within the context of this tcp_t. When the timer 104 * fires, tcp_clean_death() is called. If upper layer closes the connection 105 * during this period, tcp_time_wait_append() will be called to add this 106 * tcp_t to the global TIME-WAIT list. Note that this means that the 107 * actual wait time in TIME-WAIT state will be longer than the 108 * tcps_time_wait_interval since the period before upper layer closes the 109 * connection is not accounted for when tcp_time_wait_append() is called. 110 * 111 * If uppser layer has closed the connection, call tcp_time_wait_append() 112 * directly. 113 * 114 */ 115 #define SET_TIME_WAIT(tcps, tcp, connp) \ 116 { \ 117 (tcp)->tcp_state = TCPS_TIME_WAIT; \ 118 if ((tcp)->tcp_listen_cnt != NULL) \ 119 TCP_DECR_LISTEN_CNT(tcp); \ 120 atomic_dec_64( \ 121 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \ 122 (connp)->conn_exclbind = 0; \ 123 if (!TCP_IS_DETACHED(tcp)) { \ 124 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \ 125 } else { \ 126 tcp_time_wait_append(tcp); \ 127 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \ 128 } \ 129 } 130 131 /* 132 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 133 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 134 * data, TCP will not respond with an ACK. RFC 793 requires that 135 * TCP responds with an ACK for such a bogus ACK. By not following 136 * the RFC, we prevent TCP from getting into an ACK storm if somehow 137 * an attacker successfully spoofs an acceptable segment to our 138 * peer; or when our peer is "confused." 139 */ 140 static uint32_t tcp_drop_ack_unsent_cnt = 10; 141 142 /* 143 * To protect TCP against attacker using a small window and requesting 144 * large amount of data (DoS attack by conuming memory), TCP checks the 145 * window advertised in the last ACK of the 3-way handshake. TCP uses 146 * the tcp_mss (the size of one packet) value for comparion. The window 147 * should be larger than tcp_mss. But while a sane TCP should advertise 148 * a receive window larger than or equal to 4*MSS to avoid stop and go 149 * tarrfic, not all TCP stacks do that. This is especially true when 150 * tcp_mss is a big value. 151 * 152 * To work around this issue, an additional fixed value for comparison 153 * is also used. If the advertised window is smaller than both tcp_mss 154 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large 155 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but 156 * smaller than 8K is considered to be OK. 157 */ 158 static uint32_t tcp_init_wnd_chk = 4096; 159 160 /* Process ICMP source quench message or not. */ 161 static boolean_t tcp_icmp_source_quench = B_FALSE; 162 163 static boolean_t tcp_outbound_squeue_switch = B_FALSE; 164 165 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *, 166 ip_recv_attr_t *); 167 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *, 168 ip_recv_attr_t *); 169 static boolean_t tcp_drop_q0(tcp_t *); 170 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *); 171 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *, 172 ip_recv_attr_t *); 173 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *); 174 static int tcp_parse_options(tcpha_t *, tcp_opt_t *); 175 static void tcp_process_options(tcp_t *, tcpha_t *); 176 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t); 177 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *); 178 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *); 179 static void tcp_set_rto(tcp_t *, time_t); 180 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *); 181 182 /* 183 * Set the MSS associated with a particular tcp based on its current value, 184 * and a new one passed in. Observe minimums and maximums, and reset other 185 * state variables that we want to view as multiples of MSS. 186 * 187 * The value of MSS could be either increased or descreased. 188 */ 189 void 190 tcp_mss_set(tcp_t *tcp, uint32_t mss) 191 { 192 uint32_t mss_max; 193 tcp_stack_t *tcps = tcp->tcp_tcps; 194 conn_t *connp = tcp->tcp_connp; 195 196 if (connp->conn_ipversion == IPV4_VERSION) 197 mss_max = tcps->tcps_mss_max_ipv4; 198 else 199 mss_max = tcps->tcps_mss_max_ipv6; 200 201 if (mss < tcps->tcps_mss_min) 202 mss = tcps->tcps_mss_min; 203 if (mss > mss_max) 204 mss = mss_max; 205 /* 206 * Unless naglim has been set by our client to 207 * a non-mss value, force naglim to track mss. 208 * This can help to aggregate small writes. 209 */ 210 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 211 tcp->tcp_naglim = mss; 212 /* 213 * TCP should be able to buffer at least 4 MSS data for obvious 214 * performance reason. 215 */ 216 if ((mss << 2) > connp->conn_sndbuf) 217 connp->conn_sndbuf = mss << 2; 218 219 /* 220 * Set the send lowater to at least twice of MSS. 221 */ 222 if ((mss << 1) > connp->conn_sndlowat) 223 connp->conn_sndlowat = mss << 1; 224 225 /* 226 * Update tcp_cwnd according to the new value of MSS. Keep the 227 * previous ratio to preserve the transmit rate. 228 */ 229 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss; 230 tcp->tcp_cwnd_cnt = 0; 231 232 tcp->tcp_mss = mss; 233 (void) tcp_maxpsz_set(tcp, B_TRUE); 234 } 235 236 /* 237 * Extract option values from a tcp header. We put any found values into the 238 * tcpopt struct and return a bitmask saying which options were found. 239 */ 240 static int 241 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt) 242 { 243 uchar_t *endp; 244 int len; 245 uint32_t mss; 246 uchar_t *up = (uchar_t *)tcpha; 247 int found = 0; 248 int32_t sack_len; 249 tcp_seq sack_begin, sack_end; 250 tcp_t *tcp; 251 252 endp = up + TCP_HDR_LENGTH(tcpha); 253 up += TCP_MIN_HEADER_LENGTH; 254 while (up < endp) { 255 len = endp - up; 256 switch (*up) { 257 case TCPOPT_EOL: 258 break; 259 260 case TCPOPT_NOP: 261 up++; 262 continue; 263 264 case TCPOPT_MAXSEG: 265 if (len < TCPOPT_MAXSEG_LEN || 266 up[1] != TCPOPT_MAXSEG_LEN) 267 break; 268 269 mss = BE16_TO_U16(up+2); 270 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 271 tcpopt->tcp_opt_mss = mss; 272 found |= TCP_OPT_MSS_PRESENT; 273 274 up += TCPOPT_MAXSEG_LEN; 275 continue; 276 277 case TCPOPT_WSCALE: 278 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 279 break; 280 281 if (up[2] > TCP_MAX_WINSHIFT) 282 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 283 else 284 tcpopt->tcp_opt_wscale = up[2]; 285 found |= TCP_OPT_WSCALE_PRESENT; 286 287 up += TCPOPT_WS_LEN; 288 continue; 289 290 case TCPOPT_SACK_PERMITTED: 291 if (len < TCPOPT_SACK_OK_LEN || 292 up[1] != TCPOPT_SACK_OK_LEN) 293 break; 294 found |= TCP_OPT_SACK_OK_PRESENT; 295 up += TCPOPT_SACK_OK_LEN; 296 continue; 297 298 case TCPOPT_SACK: 299 if (len <= 2 || up[1] <= 2 || len < up[1]) 300 break; 301 302 /* If TCP is not interested in SACK blks... */ 303 if ((tcp = tcpopt->tcp) == NULL) { 304 up += up[1]; 305 continue; 306 } 307 sack_len = up[1] - TCPOPT_HEADER_LEN; 308 up += TCPOPT_HEADER_LEN; 309 310 /* 311 * If the list is empty, allocate one and assume 312 * nothing is sack'ed. 313 */ 314 if (tcp->tcp_notsack_list == NULL) { 315 tcp_notsack_update(&(tcp->tcp_notsack_list), 316 tcp->tcp_suna, tcp->tcp_snxt, 317 &(tcp->tcp_num_notsack_blk), 318 &(tcp->tcp_cnt_notsack_list)); 319 320 /* 321 * Make sure tcp_notsack_list is not NULL. 322 * This happens when kmem_alloc(KM_NOSLEEP) 323 * returns NULL. 324 */ 325 if (tcp->tcp_notsack_list == NULL) { 326 up += sack_len; 327 continue; 328 } 329 tcp->tcp_fack = tcp->tcp_suna; 330 } 331 332 while (sack_len > 0) { 333 if (up + 8 > endp) { 334 up = endp; 335 break; 336 } 337 sack_begin = BE32_TO_U32(up); 338 up += 4; 339 sack_end = BE32_TO_U32(up); 340 up += 4; 341 sack_len -= 8; 342 /* 343 * Bounds checking. Make sure the SACK 344 * info is within tcp_suna and tcp_snxt. 345 * If this SACK blk is out of bound, ignore 346 * it but continue to parse the following 347 * blks. 348 */ 349 if (SEQ_LEQ(sack_end, sack_begin) || 350 SEQ_LT(sack_begin, tcp->tcp_suna) || 351 SEQ_GT(sack_end, tcp->tcp_snxt)) { 352 continue; 353 } 354 tcp_notsack_insert(&(tcp->tcp_notsack_list), 355 sack_begin, sack_end, 356 &(tcp->tcp_num_notsack_blk), 357 &(tcp->tcp_cnt_notsack_list)); 358 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 359 tcp->tcp_fack = sack_end; 360 } 361 } 362 found |= TCP_OPT_SACK_PRESENT; 363 continue; 364 365 case TCPOPT_TSTAMP: 366 if (len < TCPOPT_TSTAMP_LEN || 367 up[1] != TCPOPT_TSTAMP_LEN) 368 break; 369 370 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 371 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 372 373 found |= TCP_OPT_TSTAMP_PRESENT; 374 375 up += TCPOPT_TSTAMP_LEN; 376 continue; 377 378 default: 379 if (len <= 1 || len < (int)up[1] || up[1] == 0) 380 break; 381 up += up[1]; 382 continue; 383 } 384 break; 385 } 386 return (found); 387 } 388 389 /* 390 * Process all TCP option in SYN segment. Note that this function should 391 * be called after tcp_set_destination() is called so that the necessary info 392 * from IRE is already set in the tcp structure. 393 * 394 * This function sets up the correct tcp_mss value according to the 395 * MSS option value and our header size. It also sets up the window scale 396 * and timestamp values, and initialize SACK info blocks. But it does not 397 * change receive window size after setting the tcp_mss value. The caller 398 * should do the appropriate change. 399 */ 400 static void 401 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha) 402 { 403 int options; 404 tcp_opt_t tcpopt; 405 uint32_t mss_max; 406 char *tmp_tcph; 407 tcp_stack_t *tcps = tcp->tcp_tcps; 408 conn_t *connp = tcp->tcp_connp; 409 410 tcpopt.tcp = NULL; 411 options = tcp_parse_options(tcpha, &tcpopt); 412 413 /* 414 * Process MSS option. Note that MSS option value does not account 415 * for IP or TCP options. This means that it is equal to MTU - minimum 416 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 417 * IPv6. 418 */ 419 if (!(options & TCP_OPT_MSS_PRESENT)) { 420 if (connp->conn_ipversion == IPV4_VERSION) 421 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4; 422 else 423 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6; 424 } else { 425 if (connp->conn_ipversion == IPV4_VERSION) 426 mss_max = tcps->tcps_mss_max_ipv4; 427 else 428 mss_max = tcps->tcps_mss_max_ipv6; 429 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min) 430 tcpopt.tcp_opt_mss = tcps->tcps_mss_min; 431 else if (tcpopt.tcp_opt_mss > mss_max) 432 tcpopt.tcp_opt_mss = mss_max; 433 } 434 435 /* Process Window Scale option. */ 436 if (options & TCP_OPT_WSCALE_PRESENT) { 437 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 438 tcp->tcp_snd_ws_ok = B_TRUE; 439 } else { 440 tcp->tcp_snd_ws = B_FALSE; 441 tcp->tcp_snd_ws_ok = B_FALSE; 442 tcp->tcp_rcv_ws = B_FALSE; 443 } 444 445 /* Process Timestamp option. */ 446 if ((options & TCP_OPT_TSTAMP_PRESENT) && 447 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 448 tmp_tcph = (char *)tcp->tcp_tcpha; 449 450 tcp->tcp_snd_ts_ok = B_TRUE; 451 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 452 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 453 ASSERT(OK_32PTR(tmp_tcph)); 454 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH); 455 456 /* Fill in our template header with basic timestamp option. */ 457 tmp_tcph += connp->conn_ht_ulp_len; 458 tmp_tcph[0] = TCPOPT_NOP; 459 tmp_tcph[1] = TCPOPT_NOP; 460 tmp_tcph[2] = TCPOPT_TSTAMP; 461 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 462 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN; 463 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN; 464 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4); 465 } else { 466 tcp->tcp_snd_ts_ok = B_FALSE; 467 } 468 469 /* 470 * Process SACK options. If SACK is enabled for this connection, 471 * then allocate the SACK info structure. Note the following ways 472 * when tcp_snd_sack_ok is set to true. 473 * 474 * For active connection: in tcp_set_destination() called in 475 * tcp_connect(). 476 * 477 * For passive connection: in tcp_set_destination() called in 478 * tcp_input_listener(). 479 * 480 * That's the reason why the extra TCP_IS_DETACHED() check is there. 481 * That check makes sure that if we did not send a SACK OK option, 482 * we will not enable SACK for this connection even though the other 483 * side sends us SACK OK option. For active connection, the SACK 484 * info structure has already been allocated. So we need to free 485 * it if SACK is disabled. 486 */ 487 if ((options & TCP_OPT_SACK_OK_PRESENT) && 488 (tcp->tcp_snd_sack_ok || 489 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 490 ASSERT(tcp->tcp_num_sack_blk == 0); 491 ASSERT(tcp->tcp_notsack_list == NULL); 492 493 tcp->tcp_snd_sack_ok = B_TRUE; 494 if (tcp->tcp_snd_ts_ok) { 495 tcp->tcp_max_sack_blk = 3; 496 } else { 497 tcp->tcp_max_sack_blk = 4; 498 } 499 } else if (tcp->tcp_snd_sack_ok) { 500 /* 501 * Resetting tcp_snd_sack_ok to B_FALSE so that 502 * no SACK info will be used for this 503 * connection. This assumes that SACK usage 504 * permission is negotiated. This may need 505 * to be changed once this is clarified. 506 */ 507 ASSERT(tcp->tcp_num_sack_blk == 0); 508 ASSERT(tcp->tcp_notsack_list == NULL); 509 tcp->tcp_snd_sack_ok = B_FALSE; 510 } 511 512 /* 513 * Now we know the exact TCP/IP header length, subtract 514 * that from tcp_mss to get our side's MSS. 515 */ 516 tcp->tcp_mss -= connp->conn_ht_iphc_len; 517 518 /* 519 * Here we assume that the other side's header size will be equal to 520 * our header size. We calculate the real MSS accordingly. Need to 521 * take into additional stuffs IPsec puts in. 522 * 523 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 524 */ 525 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len + 526 tcp->tcp_ipsec_overhead - 527 ((connp->conn_ipversion == IPV4_VERSION ? 528 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 529 530 /* 531 * Set MSS to the smaller one of both ends of the connection. 532 * We should not have called tcp_mss_set() before, but our 533 * side of the MSS should have been set to a proper value 534 * by tcp_set_destination(). tcp_mss_set() will also set up the 535 * STREAM head parameters properly. 536 * 537 * If we have a larger-than-16-bit window but the other side 538 * didn't want to do window scale, tcp_rwnd_set() will take 539 * care of that. 540 */ 541 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 542 543 /* 544 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been 545 * updated properly. 546 */ 547 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial); 548 } 549 550 /* 551 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 552 * is filled, return as much as we can. The message passed in may be 553 * multi-part, chained using b_cont. "start" is the starting sequence 554 * number for this piece. 555 */ 556 static mblk_t * 557 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 558 { 559 uint32_t end; 560 mblk_t *mp1; 561 mblk_t *mp2; 562 mblk_t *next_mp; 563 uint32_t u1; 564 tcp_stack_t *tcps = tcp->tcp_tcps; 565 566 567 /* Walk through all the new pieces. */ 568 do { 569 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 570 (uintptr_t)INT_MAX); 571 end = start + (int)(mp->b_wptr - mp->b_rptr); 572 next_mp = mp->b_cont; 573 if (start == end) { 574 /* Empty. Blast it. */ 575 freeb(mp); 576 continue; 577 } 578 mp->b_cont = NULL; 579 TCP_REASS_SET_SEQ(mp, start); 580 TCP_REASS_SET_END(mp, end); 581 mp1 = tcp->tcp_reass_tail; 582 if (!mp1) { 583 tcp->tcp_reass_tail = mp; 584 tcp->tcp_reass_head = mp; 585 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs); 586 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, 587 end - start); 588 continue; 589 } 590 /* New stuff completely beyond tail? */ 591 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { 592 /* Link it on end. */ 593 mp1->b_cont = mp; 594 tcp->tcp_reass_tail = mp; 595 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs); 596 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, 597 end - start); 598 continue; 599 } 600 mp1 = tcp->tcp_reass_head; 601 u1 = TCP_REASS_SEQ(mp1); 602 /* New stuff at the front? */ 603 if (SEQ_LT(start, u1)) { 604 /* Yes... Check for overlap. */ 605 mp->b_cont = mp1; 606 tcp->tcp_reass_head = mp; 607 tcp_reass_elim_overlap(tcp, mp); 608 continue; 609 } 610 /* 611 * The new piece fits somewhere between the head and tail. 612 * We find our slot, where mp1 precedes us and mp2 trails. 613 */ 614 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 615 u1 = TCP_REASS_SEQ(mp2); 616 if (SEQ_LEQ(start, u1)) 617 break; 618 } 619 /* Link ourselves in */ 620 mp->b_cont = mp2; 621 mp1->b_cont = mp; 622 623 /* Trim overlap with following mblk(s) first */ 624 tcp_reass_elim_overlap(tcp, mp); 625 626 /* Trim overlap with preceding mblk */ 627 tcp_reass_elim_overlap(tcp, mp1); 628 629 } while (start = end, mp = next_mp); 630 mp1 = tcp->tcp_reass_head; 631 /* Anything ready to go? */ 632 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 633 return (NULL); 634 /* Eat what we can off the queue */ 635 for (;;) { 636 mp = mp1->b_cont; 637 end = TCP_REASS_END(mp1); 638 TCP_REASS_SET_SEQ(mp1, 0); 639 TCP_REASS_SET_END(mp1, 0); 640 if (!mp) { 641 tcp->tcp_reass_tail = NULL; 642 break; 643 } 644 if (end != TCP_REASS_SEQ(mp)) { 645 mp1->b_cont = NULL; 646 break; 647 } 648 mp1 = mp; 649 } 650 mp1 = tcp->tcp_reass_head; 651 tcp->tcp_reass_head = mp; 652 return (mp1); 653 } 654 655 /* Eliminate any overlap that mp may have over later mblks */ 656 static void 657 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 658 { 659 uint32_t end; 660 mblk_t *mp1; 661 uint32_t u1; 662 tcp_stack_t *tcps = tcp->tcp_tcps; 663 664 end = TCP_REASS_END(mp); 665 while ((mp1 = mp->b_cont) != NULL) { 666 u1 = TCP_REASS_SEQ(mp1); 667 if (!SEQ_GT(end, u1)) 668 break; 669 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 670 mp->b_wptr -= end - u1; 671 TCP_REASS_SET_END(mp, u1); 672 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs); 673 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes, 674 end - u1); 675 break; 676 } 677 mp->b_cont = mp1->b_cont; 678 TCP_REASS_SET_SEQ(mp1, 0); 679 TCP_REASS_SET_END(mp1, 0); 680 freeb(mp1); 681 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs); 682 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1); 683 } 684 if (!mp1) 685 tcp->tcp_reass_tail = mp; 686 } 687 688 /* 689 * This function does PAWS protection check. Returns B_TRUE if the 690 * segment passes the PAWS test, else returns B_FALSE. 691 */ 692 boolean_t 693 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp) 694 { 695 uint8_t flags; 696 int options; 697 uint8_t *up; 698 conn_t *connp = tcp->tcp_connp; 699 700 flags = (unsigned int)tcpha->tha_flags & 0xFF; 701 /* 702 * If timestamp option is aligned nicely, get values inline, 703 * otherwise call general routine to parse. Only do that 704 * if timestamp is the only option. 705 */ 706 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH + 707 TCPOPT_REAL_TS_LEN && 708 OK_32PTR((up = ((uint8_t *)tcpha) + 709 TCP_MIN_HEADER_LENGTH)) && 710 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 711 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 712 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 713 714 options = TCP_OPT_TSTAMP_PRESENT; 715 } else { 716 if (tcp->tcp_snd_sack_ok) { 717 tcpoptp->tcp = tcp; 718 } else { 719 tcpoptp->tcp = NULL; 720 } 721 options = tcp_parse_options(tcpha, tcpoptp); 722 } 723 724 if (options & TCP_OPT_TSTAMP_PRESENT) { 725 /* 726 * Do PAWS per RFC 1323 section 4.2. Accept RST 727 * regardless of the timestamp, page 18 RFC 1323.bis. 728 */ 729 if ((flags & TH_RST) == 0 && 730 TSTMP_LT(tcpoptp->tcp_opt_ts_val, 731 tcp->tcp_ts_recent)) { 732 if (LBOLT_FASTPATH64 < 733 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) { 734 /* This segment is not acceptable. */ 735 return (B_FALSE); 736 } else { 737 /* 738 * Connection has been idle for 739 * too long. Reset the timestamp 740 * and assume the segment is valid. 741 */ 742 tcp->tcp_ts_recent = 743 tcpoptp->tcp_opt_ts_val; 744 } 745 } 746 } else { 747 /* 748 * If we don't get a timestamp on every packet, we 749 * figure we can't really trust 'em, so we stop sending 750 * and parsing them. 751 */ 752 tcp->tcp_snd_ts_ok = B_FALSE; 753 754 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN; 755 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN; 756 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4); 757 /* 758 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid 759 * doing a slow start here so as to not to lose on the 760 * transfer rate built up so far. 761 */ 762 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN); 763 if (tcp->tcp_snd_sack_ok) 764 tcp->tcp_max_sack_blk = 4; 765 } 766 return (B_TRUE); 767 } 768 769 /* 770 * Defense for the SYN attack - 771 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest 772 * one from the list of droppable eagers. This list is a subset of q0. 773 * see comments before the definition of MAKE_DROPPABLE(). 774 * 2. Don't drop a SYN request before its first timeout. This gives every 775 * request at least til the first timeout to complete its 3-way handshake. 776 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 777 * requests currently on the queue that has timed out. This will be used 778 * as an indicator of whether an attack is under way, so that appropriate 779 * actions can be taken. (It's incremented in tcp_timer() and decremented 780 * either when eager goes into ESTABLISHED, or gets freed up.) 781 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 782 * # of timeout drops back to <= q0len/32 => SYN alert off 783 */ 784 static boolean_t 785 tcp_drop_q0(tcp_t *tcp) 786 { 787 tcp_t *eager; 788 mblk_t *mp; 789 tcp_stack_t *tcps = tcp->tcp_tcps; 790 791 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 792 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 793 794 /* Pick oldest eager from the list of droppable eagers */ 795 eager = tcp->tcp_eager_prev_drop_q0; 796 797 /* If list is empty. return B_FALSE */ 798 if (eager == tcp) { 799 return (B_FALSE); 800 } 801 802 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */ 803 if ((mp = allocb(0, BPRI_HI)) == NULL) 804 return (B_FALSE); 805 806 /* 807 * Take this eager out from the list of droppable eagers since we are 808 * going to drop it. 809 */ 810 MAKE_UNDROPPABLE(eager); 811 812 if (tcp->tcp_connp->conn_debug) { 813 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 814 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 815 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0, 816 tcp->tcp_conn_req_cnt_q0, 817 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 818 } 819 820 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop); 821 822 /* Put a reference on the conn as we are enqueueing it in the sqeue */ 823 CONN_INC_REF(eager->tcp_connp); 824 825 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 826 tcp_clean_death_wrapper, eager->tcp_connp, NULL, 827 SQ_FILL, SQTAG_TCP_DROP_Q0); 828 829 return (B_TRUE); 830 } 831 832 /* 833 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6 834 */ 835 static mblk_t * 836 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 837 ip_recv_attr_t *ira) 838 { 839 tcp_t *ltcp = lconnp->conn_tcp; 840 tcp_t *tcp = connp->conn_tcp; 841 mblk_t *tpi_mp; 842 ipha_t *ipha; 843 ip6_t *ip6h; 844 sin6_t sin6; 845 uint_t ifindex = ira->ira_ruifindex; 846 tcp_stack_t *tcps = tcp->tcp_tcps; 847 848 if (ira->ira_flags & IRAF_IS_IPV4) { 849 ipha = (ipha_t *)mp->b_rptr; 850 851 connp->conn_ipversion = IPV4_VERSION; 852 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 853 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 854 connp->conn_saddr_v6 = connp->conn_laddr_v6; 855 856 sin6 = sin6_null; 857 sin6.sin6_addr = connp->conn_faddr_v6; 858 sin6.sin6_port = connp->conn_fport; 859 sin6.sin6_family = AF_INET6; 860 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 861 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 862 863 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 864 sin6_t sin6d; 865 866 sin6d = sin6_null; 867 sin6d.sin6_addr = connp->conn_laddr_v6; 868 sin6d.sin6_port = connp->conn_lport; 869 sin6d.sin6_family = AF_INET; 870 tpi_mp = mi_tpi_extconn_ind(NULL, 871 (char *)&sin6d, sizeof (sin6_t), 872 (char *)&tcp, 873 (t_scalar_t)sizeof (intptr_t), 874 (char *)&sin6d, sizeof (sin6_t), 875 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 876 } else { 877 tpi_mp = mi_tpi_conn_ind(NULL, 878 (char *)&sin6, sizeof (sin6_t), 879 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 880 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 881 } 882 } else { 883 ip6h = (ip6_t *)mp->b_rptr; 884 885 connp->conn_ipversion = IPV6_VERSION; 886 connp->conn_laddr_v6 = ip6h->ip6_dst; 887 connp->conn_faddr_v6 = ip6h->ip6_src; 888 connp->conn_saddr_v6 = connp->conn_laddr_v6; 889 890 sin6 = sin6_null; 891 sin6.sin6_addr = connp->conn_faddr_v6; 892 sin6.sin6_port = connp->conn_fport; 893 sin6.sin6_family = AF_INET6; 894 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 895 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 896 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 897 898 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 899 /* Pass up the scope_id of remote addr */ 900 sin6.sin6_scope_id = ifindex; 901 } else { 902 sin6.sin6_scope_id = 0; 903 } 904 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 905 sin6_t sin6d; 906 907 sin6d = sin6_null; 908 sin6.sin6_addr = connp->conn_laddr_v6; 909 sin6d.sin6_port = connp->conn_lport; 910 sin6d.sin6_family = AF_INET6; 911 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6)) 912 sin6d.sin6_scope_id = ifindex; 913 914 tpi_mp = mi_tpi_extconn_ind(NULL, 915 (char *)&sin6d, sizeof (sin6_t), 916 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 917 (char *)&sin6d, sizeof (sin6_t), 918 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 919 } else { 920 tpi_mp = mi_tpi_conn_ind(NULL, 921 (char *)&sin6, sizeof (sin6_t), 922 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 923 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 924 } 925 } 926 927 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 928 return (tpi_mp); 929 } 930 931 /* Handle a SYN on an AF_INET socket */ 932 static mblk_t * 933 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp, 934 ip_recv_attr_t *ira) 935 { 936 tcp_t *ltcp = lconnp->conn_tcp; 937 tcp_t *tcp = connp->conn_tcp; 938 sin_t sin; 939 mblk_t *tpi_mp = NULL; 940 tcp_stack_t *tcps = tcp->tcp_tcps; 941 ipha_t *ipha; 942 943 ASSERT(ira->ira_flags & IRAF_IS_IPV4); 944 ipha = (ipha_t *)mp->b_rptr; 945 946 connp->conn_ipversion = IPV4_VERSION; 947 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 948 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 949 connp->conn_saddr_v6 = connp->conn_laddr_v6; 950 951 sin = sin_null; 952 sin.sin_addr.s_addr = connp->conn_faddr_v4; 953 sin.sin_port = connp->conn_fport; 954 sin.sin_family = AF_INET; 955 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) { 956 sin_t sind; 957 958 sind = sin_null; 959 sind.sin_addr.s_addr = connp->conn_laddr_v4; 960 sind.sin_port = connp->conn_lport; 961 sind.sin_family = AF_INET; 962 tpi_mp = mi_tpi_extconn_ind(NULL, 963 (char *)&sind, sizeof (sin_t), (char *)&tcp, 964 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 965 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 966 } else { 967 tpi_mp = mi_tpi_conn_ind(NULL, 968 (char *)&sin, sizeof (sin_t), 969 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 970 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 971 } 972 973 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 974 return (tpi_mp); 975 } 976 977 /* 978 * Called via squeue to get on to eager's perimeter. It sends a 979 * TH_RST if eager is in the fanout table. The listener wants the 980 * eager to disappear either by means of tcp_eager_blowoff() or 981 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be 982 * called (via squeue) if the eager cannot be inserted in the 983 * fanout table in tcp_input_listener(). 984 */ 985 /* ARGSUSED */ 986 void 987 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 988 { 989 conn_t *econnp = (conn_t *)arg; 990 tcp_t *eager = econnp->conn_tcp; 991 tcp_t *listener = eager->tcp_listener; 992 993 /* 994 * We could be called because listener is closing. Since 995 * the eager was using listener's queue's, we avoid 996 * using the listeners queues from now on. 997 */ 998 ASSERT(eager->tcp_detached); 999 econnp->conn_rq = NULL; 1000 econnp->conn_wq = NULL; 1001 1002 /* 1003 * An eager's conn_fanout will be NULL if it's a duplicate 1004 * for an existing 4-tuples in the conn fanout table. 1005 * We don't want to send an RST out in such case. 1006 */ 1007 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) { 1008 tcp_xmit_ctl("tcp_eager_kill, can't wait", 1009 eager, eager->tcp_snxt, 0, TH_RST); 1010 } 1011 1012 /* We are here because listener wants this eager gone */ 1013 if (listener != NULL) { 1014 mutex_enter(&listener->tcp_eager_lock); 1015 tcp_eager_unlink(eager); 1016 if (eager->tcp_tconnind_started) { 1017 /* 1018 * The eager has sent a conn_ind up to the 1019 * listener but listener decides to close 1020 * instead. We need to drop the extra ref 1021 * placed on eager in tcp_input_data() before 1022 * sending the conn_ind to listener. 1023 */ 1024 CONN_DEC_REF(econnp); 1025 } 1026 mutex_exit(&listener->tcp_eager_lock); 1027 CONN_DEC_REF(listener->tcp_connp); 1028 } 1029 1030 if (eager->tcp_state != TCPS_CLOSED) 1031 tcp_close_detached(eager); 1032 } 1033 1034 /* 1035 * Reset any eager connection hanging off this listener marked 1036 * with 'seqnum' and then reclaim it's resources. 1037 */ 1038 boolean_t 1039 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 1040 { 1041 tcp_t *eager; 1042 mblk_t *mp; 1043 1044 eager = listener; 1045 mutex_enter(&listener->tcp_eager_lock); 1046 do { 1047 eager = eager->tcp_eager_next_q; 1048 if (eager == NULL) { 1049 mutex_exit(&listener->tcp_eager_lock); 1050 return (B_FALSE); 1051 } 1052 } while (eager->tcp_conn_req_seqnum != seqnum); 1053 1054 if (eager->tcp_closemp_used) { 1055 mutex_exit(&listener->tcp_eager_lock); 1056 return (B_TRUE); 1057 } 1058 eager->tcp_closemp_used = B_TRUE; 1059 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1060 CONN_INC_REF(eager->tcp_connp); 1061 mutex_exit(&listener->tcp_eager_lock); 1062 mp = &eager->tcp_closemp; 1063 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 1064 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF); 1065 return (B_TRUE); 1066 } 1067 1068 /* 1069 * Reset any eager connection hanging off this listener 1070 * and then reclaim it's resources. 1071 */ 1072 void 1073 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 1074 { 1075 tcp_t *eager; 1076 mblk_t *mp; 1077 tcp_stack_t *tcps = listener->tcp_tcps; 1078 1079 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 1080 1081 if (!q0_only) { 1082 /* First cleanup q */ 1083 TCP_STAT(tcps, tcp_eager_blowoff_q); 1084 eager = listener->tcp_eager_next_q; 1085 while (eager != NULL) { 1086 if (!eager->tcp_closemp_used) { 1087 eager->tcp_closemp_used = B_TRUE; 1088 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1089 CONN_INC_REF(eager->tcp_connp); 1090 mp = &eager->tcp_closemp; 1091 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 1092 tcp_eager_kill, eager->tcp_connp, NULL, 1093 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP); 1094 } 1095 eager = eager->tcp_eager_next_q; 1096 } 1097 } 1098 /* Then cleanup q0 */ 1099 TCP_STAT(tcps, tcp_eager_blowoff_q0); 1100 eager = listener->tcp_eager_next_q0; 1101 while (eager != listener) { 1102 if (!eager->tcp_closemp_used) { 1103 eager->tcp_closemp_used = B_TRUE; 1104 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1105 CONN_INC_REF(eager->tcp_connp); 1106 mp = &eager->tcp_closemp; 1107 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 1108 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL, 1109 SQTAG_TCP_EAGER_CLEANUP_Q0); 1110 } 1111 eager = eager->tcp_eager_next_q0; 1112 } 1113 } 1114 1115 /* 1116 * If we are an eager connection hanging off a listener that hasn't 1117 * formally accepted the connection yet, get off his list and blow off 1118 * any data that we have accumulated. 1119 */ 1120 void 1121 tcp_eager_unlink(tcp_t *tcp) 1122 { 1123 tcp_t *listener = tcp->tcp_listener; 1124 1125 ASSERT(listener != NULL); 1126 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 1127 if (tcp->tcp_eager_next_q0 != NULL) { 1128 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 1129 1130 /* Remove the eager tcp from q0 */ 1131 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 1132 tcp->tcp_eager_prev_q0; 1133 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 1134 tcp->tcp_eager_next_q0; 1135 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 1136 listener->tcp_conn_req_cnt_q0--; 1137 1138 tcp->tcp_eager_next_q0 = NULL; 1139 tcp->tcp_eager_prev_q0 = NULL; 1140 1141 /* 1142 * Take the eager out, if it is in the list of droppable 1143 * eagers. 1144 */ 1145 MAKE_UNDROPPABLE(tcp); 1146 1147 if (tcp->tcp_syn_rcvd_timeout != 0) { 1148 /* we have timed out before */ 1149 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 1150 listener->tcp_syn_rcvd_timeout--; 1151 } 1152 } else { 1153 tcp_t **tcpp = &listener->tcp_eager_next_q; 1154 tcp_t *prev = NULL; 1155 1156 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 1157 if (tcpp[0] == tcp) { 1158 if (listener->tcp_eager_last_q == tcp) { 1159 /* 1160 * If we are unlinking the last 1161 * element on the list, adjust 1162 * tail pointer. Set tail pointer 1163 * to nil when list is empty. 1164 */ 1165 ASSERT(tcp->tcp_eager_next_q == NULL); 1166 if (listener->tcp_eager_last_q == 1167 listener->tcp_eager_next_q) { 1168 listener->tcp_eager_last_q = 1169 NULL; 1170 } else { 1171 /* 1172 * We won't get here if there 1173 * is only one eager in the 1174 * list. 1175 */ 1176 ASSERT(prev != NULL); 1177 listener->tcp_eager_last_q = 1178 prev; 1179 } 1180 } 1181 tcpp[0] = tcp->tcp_eager_next_q; 1182 tcp->tcp_eager_next_q = NULL; 1183 tcp->tcp_eager_last_q = NULL; 1184 ASSERT(listener->tcp_conn_req_cnt_q > 0); 1185 listener->tcp_conn_req_cnt_q--; 1186 break; 1187 } 1188 prev = tcpp[0]; 1189 } 1190 } 1191 tcp->tcp_listener = NULL; 1192 } 1193 1194 /* BEGIN CSTYLED */ 1195 /* 1196 * 1197 * The sockfs ACCEPT path: 1198 * ======================= 1199 * 1200 * The eager is now established in its own perimeter as soon as SYN is 1201 * received in tcp_input_listener(). When sockfs receives conn_ind, it 1202 * completes the accept processing on the acceptor STREAM. The sending 1203 * of conn_ind part is common for both sockfs listener and a TLI/XTI 1204 * listener but a TLI/XTI listener completes the accept processing 1205 * on the listener perimeter. 1206 * 1207 * Common control flow for 3 way handshake: 1208 * ---------------------------------------- 1209 * 1210 * incoming SYN (listener perimeter) -> tcp_input_listener() 1211 * 1212 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data() 1213 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 1214 * 1215 * Sockfs ACCEPT Path: 1216 * ------------------- 1217 * 1218 * open acceptor stream (tcp_open allocates tcp_tli_accept() 1219 * as STREAM entry point) 1220 * 1221 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept() 1222 * 1223 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager 1224 * association (we are not behind eager's squeue but sockfs is protecting us 1225 * and no one knows about this stream yet. The STREAMS entry point q->q_info 1226 * is changed to point at tcp_wput(). 1227 * 1228 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to 1229 * listener (done on listener's perimeter). 1230 * 1231 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish 1232 * accept. 1233 * 1234 * TLI/XTI client ACCEPT path: 1235 * --------------------------- 1236 * 1237 * soaccept() sends T_CONN_RES on the listener STREAM. 1238 * 1239 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send 1240 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()). 1241 * 1242 * Locks: 1243 * ====== 1244 * 1245 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 1246 * and listeners->tcp_eager_next_q. 1247 * 1248 * Referencing: 1249 * ============ 1250 * 1251 * 1) We start out in tcp_input_listener by eager placing a ref on 1252 * listener and listener adding eager to listeners->tcp_eager_next_q0. 1253 * 1254 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 1255 * doing so we place a ref on the eager. This ref is finally dropped at the 1256 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 1257 * reference is dropped by the squeue framework. 1258 * 1259 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 1260 * 1261 * The reference must be released by the same entity that added the reference 1262 * In the above scheme, the eager is the entity that adds and releases the 1263 * references. Note that tcp_accept_finish executes in the squeue of the eager 1264 * (albeit after it is attached to the acceptor stream). Though 1. executes 1265 * in the listener's squeue, the eager is nascent at this point and the 1266 * reference can be considered to have been added on behalf of the eager. 1267 * 1268 * Eager getting a Reset or listener closing: 1269 * ========================================== 1270 * 1271 * Once the listener and eager are linked, the listener never does the unlink. 1272 * If the listener needs to close, tcp_eager_cleanup() is called which queues 1273 * a message on all eager perimeter. The eager then does the unlink, clears 1274 * any pointers to the listener's queue and drops the reference to the 1275 * listener. The listener waits in tcp_close outside the squeue until its 1276 * refcount has dropped to 1. This ensures that the listener has waited for 1277 * all eagers to clear their association with the listener. 1278 * 1279 * Similarly, if eager decides to go away, it can unlink itself and close. 1280 * When the T_CONN_RES comes down, we check if eager has closed. Note that 1281 * the reference to eager is still valid because of the extra ref we put 1282 * in tcp_send_conn_ind. 1283 * 1284 * Listener can always locate the eager under the protection 1285 * of the listener->tcp_eager_lock, and then do a refhold 1286 * on the eager during the accept processing. 1287 * 1288 * The acceptor stream accesses the eager in the accept processing 1289 * based on the ref placed on eager before sending T_conn_ind. 1290 * The only entity that can negate this refhold is a listener close 1291 * which is mutually exclusive with an active acceptor stream. 1292 * 1293 * Eager's reference on the listener 1294 * =================================== 1295 * 1296 * If the accept happens (even on a closed eager) the eager drops its 1297 * reference on the listener at the start of tcp_accept_finish. If the 1298 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 1299 * the reference is dropped in tcp_closei_local. If the listener closes, 1300 * the reference is dropped in tcp_eager_kill. In all cases the reference 1301 * is dropped while executing in the eager's context (squeue). 1302 */ 1303 /* END CSTYLED */ 1304 1305 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 1306 1307 /* 1308 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 1309 * tcp_input_data will not see any packets for listeners since the listener 1310 * has conn_recv set to tcp_input_listener. 1311 */ 1312 /* ARGSUSED */ 1313 static void 1314 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1315 { 1316 tcpha_t *tcpha; 1317 uint32_t seg_seq; 1318 tcp_t *eager; 1319 int err; 1320 conn_t *econnp = NULL; 1321 squeue_t *new_sqp; 1322 mblk_t *mp1; 1323 uint_t ip_hdr_len; 1324 conn_t *lconnp = (conn_t *)arg; 1325 tcp_t *listener = lconnp->conn_tcp; 1326 tcp_stack_t *tcps = listener->tcp_tcps; 1327 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1328 uint_t flags; 1329 mblk_t *tpi_mp; 1330 uint_t ifindex = ira->ira_ruifindex; 1331 boolean_t tlc_set = B_FALSE; 1332 1333 ip_hdr_len = ira->ira_ip_hdr_length; 1334 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len]; 1335 flags = (unsigned int)tcpha->tha_flags & 0xFF; 1336 1337 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa, 1338 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener, 1339 __dtrace_tcp_tcph_t *, tcpha); 1340 1341 if (!(flags & TH_SYN)) { 1342 if ((flags & TH_RST) || (flags & TH_URG)) { 1343 freemsg(mp); 1344 return; 1345 } 1346 if (flags & TH_ACK) { 1347 /* Note this executes in listener's squeue */ 1348 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp); 1349 return; 1350 } 1351 1352 freemsg(mp); 1353 return; 1354 } 1355 1356 if (listener->tcp_state != TCPS_LISTEN) 1357 goto error2; 1358 1359 ASSERT(IPCL_IS_BOUND(lconnp)); 1360 1361 mutex_enter(&listener->tcp_eager_lock); 1362 1363 /* 1364 * The system is under memory pressure, so we need to do our part 1365 * to relieve the pressure. So we only accept new request if there 1366 * is nothing waiting to be accepted or waiting to complete the 3-way 1367 * handshake. This means that busy listener will not get too many 1368 * new requests which they cannot handle in time while non-busy 1369 * listener is still functioning properly. 1370 */ 1371 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 || 1372 listener->tcp_conn_req_cnt_q0 > 0)) { 1373 mutex_exit(&listener->tcp_eager_lock); 1374 TCP_STAT(tcps, tcp_listen_mem_drop); 1375 goto error2; 1376 } 1377 1378 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) { 1379 mutex_exit(&listener->tcp_eager_lock); 1380 TCP_STAT(tcps, tcp_listendrop); 1381 TCPS_BUMP_MIB(tcps, tcpListenDrop); 1382 if (lconnp->conn_debug) { 1383 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 1384 "tcp_input_listener: listen backlog (max=%d) " 1385 "overflow (%d pending) on %s", 1386 listener->tcp_conn_req_max, 1387 listener->tcp_conn_req_cnt_q, 1388 tcp_display(listener, NULL, DISP_PORT_ONLY)); 1389 } 1390 goto error2; 1391 } 1392 1393 if (listener->tcp_conn_req_cnt_q0 >= 1394 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) { 1395 /* 1396 * Q0 is full. Drop a pending half-open req from the queue 1397 * to make room for the new SYN req. Also mark the time we 1398 * drop a SYN. 1399 * 1400 * A more aggressive defense against SYN attack will 1401 * be to set the "tcp_syn_defense" flag now. 1402 */ 1403 TCP_STAT(tcps, tcp_listendropq0); 1404 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 1405 if (!tcp_drop_q0(listener)) { 1406 mutex_exit(&listener->tcp_eager_lock); 1407 TCPS_BUMP_MIB(tcps, tcpListenDropQ0); 1408 if (lconnp->conn_debug) { 1409 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 1410 "tcp_input_listener: listen half-open " 1411 "queue (max=%d) full (%d pending) on %s", 1412 tcps->tcps_conn_req_max_q0, 1413 listener->tcp_conn_req_cnt_q0, 1414 tcp_display(listener, NULL, 1415 DISP_PORT_ONLY)); 1416 } 1417 goto error2; 1418 } 1419 } 1420 1421 /* 1422 * Enforce the limit set on the number of connections per listener. 1423 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max 1424 * for comparison. 1425 */ 1426 if (listener->tcp_listen_cnt != NULL) { 1427 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt; 1428 int64_t now; 1429 1430 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) { 1431 mutex_exit(&listener->tcp_eager_lock); 1432 now = ddi_get_lbolt64(); 1433 atomic_dec_32(&tlc->tlc_cnt); 1434 TCP_STAT(tcps, tcp_listen_cnt_drop); 1435 tlc->tlc_drop++; 1436 if (now - tlc->tlc_report_time > 1437 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) { 1438 zcmn_err(lconnp->conn_zoneid, CE_WARN, 1439 "Listener (port %d) connection max (%u) " 1440 "reached: %u attempts dropped total\n", 1441 ntohs(listener->tcp_connp->conn_lport), 1442 tlc->tlc_max, tlc->tlc_drop); 1443 tlc->tlc_report_time = now; 1444 } 1445 goto error2; 1446 } 1447 tlc_set = B_TRUE; 1448 } 1449 1450 mutex_exit(&listener->tcp_eager_lock); 1451 1452 /* 1453 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 1454 * or based on the ring (for packets from GLD). Otherwise it is 1455 * set based on lbolt i.e., a somewhat random number. 1456 */ 1457 ASSERT(ira->ira_sqp != NULL); 1458 new_sqp = ira->ira_sqp; 1459 1460 econnp = (conn_t *)tcp_get_conn(arg2, tcps); 1461 if (econnp == NULL) 1462 goto error2; 1463 1464 ASSERT(econnp->conn_netstack == lconnp->conn_netstack); 1465 econnp->conn_sqp = new_sqp; 1466 econnp->conn_initial_sqp = new_sqp; 1467 econnp->conn_ixa->ixa_sqp = new_sqp; 1468 1469 econnp->conn_fport = tcpha->tha_lport; 1470 econnp->conn_lport = tcpha->tha_fport; 1471 1472 err = conn_inherit_parent(lconnp, econnp); 1473 if (err != 0) 1474 goto error3; 1475 1476 /* We already know the laddr of the new connection is ours */ 1477 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation; 1478 1479 ASSERT(OK_32PTR(mp->b_rptr)); 1480 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION || 1481 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION); 1482 1483 if (lconnp->conn_family == AF_INET) { 1484 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION); 1485 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira); 1486 } else { 1487 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira); 1488 } 1489 1490 if (tpi_mp == NULL) 1491 goto error3; 1492 1493 eager = econnp->conn_tcp; 1494 eager->tcp_detached = B_TRUE; 1495 SOCK_CONNID_INIT(eager->tcp_connid); 1496 1497 /* 1498 * Initialize the eager's tcp_t and inherit some parameters from 1499 * the listener. 1500 */ 1501 tcp_init_values(eager, listener); 1502 1503 ASSERT((econnp->conn_ixa->ixa_flags & 1504 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 1505 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) == 1506 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 1507 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)); 1508 1509 if (!tcps->tcps_dev_flow_ctl) 1510 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 1511 1512 /* Prepare for diffing against previous packets */ 1513 eager->tcp_recvifindex = 0; 1514 eager->tcp_recvhops = 0xffffffffU; 1515 1516 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) { 1517 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) || 1518 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) { 1519 econnp->conn_incoming_ifindex = ifindex; 1520 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1521 econnp->conn_ixa->ixa_scopeid = ifindex; 1522 } 1523 } 1524 1525 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) == 1526 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) && 1527 tcps->tcps_rev_src_routes) { 1528 ipha_t *ipha = (ipha_t *)mp->b_rptr; 1529 ip_pkt_t *ipp = &econnp->conn_xmit_ipp; 1530 1531 /* Source routing option copyover (reverse it) */ 1532 err = ip_find_hdr_v4(ipha, ipp, B_TRUE); 1533 if (err != 0) { 1534 freemsg(tpi_mp); 1535 goto error3; 1536 } 1537 ip_pkt_source_route_reverse_v4(ipp); 1538 } 1539 1540 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL); 1541 ASSERT(!eager->tcp_tconnind_started); 1542 /* 1543 * If the SYN came with a credential, it's a loopback packet or a 1544 * labeled packet; attach the credential to the TPI message. 1545 */ 1546 if (ira->ira_cred != NULL) 1547 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid); 1548 1549 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp; 1550 ASSERT(eager->tcp_ordrel_mp == NULL); 1551 1552 /* Inherit the listener's non-STREAMS flag */ 1553 if (IPCL_IS_NONSTR(lconnp)) { 1554 econnp->conn_flags |= IPCL_NONSTR; 1555 /* All non-STREAMS tcp_ts are sockets */ 1556 eager->tcp_issocket = B_TRUE; 1557 } else { 1558 /* 1559 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that 1560 * at close time, we will always have that to send up. 1561 * Otherwise, we need to do special handling in case the 1562 * allocation fails at that time. 1563 */ 1564 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL) 1565 goto error3; 1566 } 1567 /* 1568 * Now that the IP addresses and ports are setup in econnp we 1569 * can do the IPsec policy work. 1570 */ 1571 if (ira->ira_flags & IRAF_IPSEC_SECURE) { 1572 if (lconnp->conn_policy != NULL) { 1573 /* 1574 * Inherit the policy from the listener; use 1575 * actions from ira 1576 */ 1577 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) { 1578 CONN_DEC_REF(econnp); 1579 freemsg(mp); 1580 goto error3; 1581 } 1582 } 1583 } 1584 1585 /* 1586 * tcp_set_destination() may set tcp_rwnd according to the route 1587 * metrics. If it does not, the eager's receive window will be set 1588 * to the listener's receive window later in this function. 1589 */ 1590 eager->tcp_rwnd = 0; 1591 1592 if (is_system_labeled()) { 1593 ip_xmit_attr_t *ixa = econnp->conn_ixa; 1594 1595 ASSERT(ira->ira_tsl != NULL); 1596 /* Discard any old label */ 1597 if (ixa->ixa_free_flags & IXA_FREE_TSL) { 1598 ASSERT(ixa->ixa_tsl != NULL); 1599 label_rele(ixa->ixa_tsl); 1600 ixa->ixa_free_flags &= ~IXA_FREE_TSL; 1601 ixa->ixa_tsl = NULL; 1602 } 1603 if ((lconnp->conn_mlp_type != mlptSingle || 1604 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) && 1605 ira->ira_tsl != NULL) { 1606 /* 1607 * If this is an MLP connection or a MAC-Exempt 1608 * connection with an unlabeled node, packets are to be 1609 * exchanged using the security label of the received 1610 * SYN packet instead of the server application's label. 1611 * tsol_check_dest called from ip_set_destination 1612 * might later update TSF_UNLABELED by replacing 1613 * ixa_tsl with a new label. 1614 */ 1615 label_hold(ira->ira_tsl); 1616 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl); 1617 DTRACE_PROBE2(mlp_syn_accept, conn_t *, 1618 econnp, ts_label_t *, ixa->ixa_tsl) 1619 } else { 1620 ixa->ixa_tsl = crgetlabel(econnp->conn_cred); 1621 DTRACE_PROBE2(syn_accept, conn_t *, 1622 econnp, ts_label_t *, ixa->ixa_tsl) 1623 } 1624 /* 1625 * conn_connect() called from tcp_set_destination will verify 1626 * the destination is allowed to receive packets at the 1627 * security label of the SYN-ACK we are generating. As part of 1628 * that, tsol_check_dest() may create a new effective label for 1629 * this connection. 1630 * Finally conn_connect() will call conn_update_label. 1631 * All that remains for TCP to do is to call 1632 * conn_build_hdr_template which is done as part of 1633 * tcp_set_destination. 1634 */ 1635 } 1636 1637 /* 1638 * Since we will clear tcp_listener before we clear tcp_detached 1639 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress 1640 * so we can tell a TCP_IS_DETACHED_NONEAGER apart. 1641 */ 1642 eager->tcp_hard_binding = B_TRUE; 1643 1644 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[ 1645 TCP_BIND_HASH(econnp->conn_lport)], eager, 0); 1646 1647 CL_INET_CONNECT(econnp, B_FALSE, err); 1648 if (err != 0) { 1649 tcp_bind_hash_remove(eager); 1650 goto error3; 1651 } 1652 1653 SOCK_CONNID_BUMP(eager->tcp_connid); 1654 1655 /* 1656 * Adapt our mss, ttl, ... based on the remote address. 1657 */ 1658 1659 if (tcp_set_destination(eager) != 0) { 1660 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1661 /* Undo the bind_hash_insert */ 1662 tcp_bind_hash_remove(eager); 1663 goto error3; 1664 } 1665 1666 /* Process all TCP options. */ 1667 tcp_process_options(eager, tcpha); 1668 1669 /* Is the other end ECN capable? */ 1670 if (tcps->tcps_ecn_permitted >= 1 && 1671 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 1672 eager->tcp_ecn_ok = B_TRUE; 1673 } 1674 1675 /* 1676 * The listener's conn_rcvbuf should be the default window size or a 1677 * window size changed via SO_RCVBUF option. First round up the 1678 * eager's tcp_rwnd to the nearest MSS. Then find out the window 1679 * scale option value if needed. Call tcp_rwnd_set() to finish the 1680 * setting. 1681 * 1682 * Note if there is a rpipe metric associated with the remote host, 1683 * we should not inherit receive window size from listener. 1684 */ 1685 eager->tcp_rwnd = MSS_ROUNDUP( 1686 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf : 1687 eager->tcp_rwnd), eager->tcp_mss); 1688 if (eager->tcp_snd_ws_ok) 1689 tcp_set_ws_value(eager); 1690 /* 1691 * Note that this is the only place tcp_rwnd_set() is called for 1692 * accepting a connection. We need to call it here instead of 1693 * after the 3-way handshake because we need to tell the other 1694 * side our rwnd in the SYN-ACK segment. 1695 */ 1696 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 1697 1698 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 && 1699 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd); 1700 1701 ASSERT(econnp->conn_rcvbuf != 0 && 1702 econnp->conn_rcvbuf == eager->tcp_rwnd); 1703 1704 /* Put a ref on the listener for the eager. */ 1705 CONN_INC_REF(lconnp); 1706 mutex_enter(&listener->tcp_eager_lock); 1707 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 1708 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0; 1709 listener->tcp_eager_next_q0 = eager; 1710 eager->tcp_eager_prev_q0 = listener; 1711 1712 /* Set tcp_listener before adding it to tcp_conn_fanout */ 1713 eager->tcp_listener = listener; 1714 eager->tcp_saved_listener = listener; 1715 1716 /* 1717 * Set tcp_listen_cnt so that when the connection is done, the counter 1718 * is decremented. 1719 */ 1720 eager->tcp_listen_cnt = listener->tcp_listen_cnt; 1721 1722 /* 1723 * Tag this detached tcp vector for later retrieval 1724 * by our listener client in tcp_accept(). 1725 */ 1726 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum; 1727 listener->tcp_conn_req_cnt_q0++; 1728 if (++listener->tcp_conn_req_seqnum == -1) { 1729 /* 1730 * -1 is "special" and defined in TPI as something 1731 * that should never be used in T_CONN_IND 1732 */ 1733 ++listener->tcp_conn_req_seqnum; 1734 } 1735 mutex_exit(&listener->tcp_eager_lock); 1736 1737 if (listener->tcp_syn_defense) { 1738 /* Don't drop the SYN that comes from a good IP source */ 1739 ipaddr_t *addr_cache; 1740 1741 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 1742 if (addr_cache != NULL && econnp->conn_faddr_v4 == 1743 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) { 1744 eager->tcp_dontdrop = B_TRUE; 1745 } 1746 } 1747 1748 /* 1749 * We need to insert the eager in its own perimeter but as soon 1750 * as we do that, we expose the eager to the classifier and 1751 * should not touch any field outside the eager's perimeter. 1752 * So do all the work necessary before inserting the eager 1753 * in its own perimeter. Be optimistic that conn_connect() 1754 * will succeed but undo everything if it fails. 1755 */ 1756 seg_seq = ntohl(tcpha->tha_seq); 1757 eager->tcp_irs = seg_seq; 1758 eager->tcp_rack = seg_seq; 1759 eager->tcp_rnxt = seg_seq + 1; 1760 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt); 1761 TCPS_BUMP_MIB(tcps, tcpPassiveOpens); 1762 eager->tcp_state = TCPS_SYN_RCVD; 1763 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1764 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL, 1765 int32_t, TCPS_LISTEN); 1766 1767 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 1768 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 1769 if (mp1 == NULL) { 1770 /* 1771 * Increment the ref count as we are going to 1772 * enqueueing an mp in squeue 1773 */ 1774 CONN_INC_REF(econnp); 1775 goto error; 1776 } 1777 1778 /* 1779 * We need to start the rto timer. In normal case, we start 1780 * the timer after sending the packet on the wire (or at 1781 * least believing that packet was sent by waiting for 1782 * conn_ip_output() to return). Since this is the first packet 1783 * being sent on the wire for the eager, our initial tcp_rto 1784 * is at least tcp_rexmit_interval_min which is a fairly 1785 * large value to allow the algorithm to adjust slowly to large 1786 * fluctuations of RTT during first few transmissions. 1787 * 1788 * Starting the timer first and then sending the packet in this 1789 * case shouldn't make much difference since tcp_rexmit_interval_min 1790 * is of the order of several 100ms and starting the timer 1791 * first and then sending the packet will result in difference 1792 * of few micro seconds. 1793 * 1794 * Without this optimization, we are forced to hold the fanout 1795 * lock across the ipcl_bind_insert() and sending the packet 1796 * so that we don't race against an incoming packet (maybe RST) 1797 * for this eager. 1798 * 1799 * It is necessary to acquire an extra reference on the eager 1800 * at this point and hold it until after tcp_send_data() to 1801 * ensure against an eager close race. 1802 */ 1803 1804 CONN_INC_REF(econnp); 1805 1806 TCP_TIMER_RESTART(eager, eager->tcp_rto); 1807 1808 /* 1809 * Insert the eager in its own perimeter now. We are ready to deal 1810 * with any packets on eager. 1811 */ 1812 if (ipcl_conn_insert(econnp) != 0) 1813 goto error; 1814 1815 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp); 1816 freemsg(mp); 1817 /* 1818 * Send the SYN-ACK. Use the right squeue so that conn_ixa is 1819 * only used by one thread at a time. 1820 */ 1821 if (econnp->conn_sqp == lconnp->conn_sqp) { 1822 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *, 1823 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr, 1824 tcp_t *, eager, __dtrace_tcp_tcph_t *, 1825 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]); 1826 (void) conn_ip_output(mp1, econnp->conn_ixa); 1827 CONN_DEC_REF(econnp); 1828 } else { 1829 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack, 1830 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK); 1831 } 1832 return; 1833 error: 1834 freemsg(mp1); 1835 eager->tcp_closemp_used = B_TRUE; 1836 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1837 mp1 = &eager->tcp_closemp; 1838 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill, 1839 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2); 1840 1841 /* 1842 * If a connection already exists, send the mp to that connections so 1843 * that it can be appropriately dealt with. 1844 */ 1845 ipst = tcps->tcps_netstack->netstack_ip; 1846 1847 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) { 1848 if (!IPCL_IS_CONNECTED(econnp)) { 1849 /* 1850 * Something bad happened. ipcl_conn_insert() 1851 * failed because a connection already existed 1852 * in connected hash but we can't find it 1853 * anymore (someone blew it away). Just 1854 * free this message and hopefully remote 1855 * will retransmit at which time the SYN can be 1856 * treated as a new connection or dealth with 1857 * a TH_RST if a connection already exists. 1858 */ 1859 CONN_DEC_REF(econnp); 1860 freemsg(mp); 1861 } else { 1862 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data, 1863 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1); 1864 } 1865 } else { 1866 /* Nobody wants this packet */ 1867 freemsg(mp); 1868 } 1869 return; 1870 error3: 1871 CONN_DEC_REF(econnp); 1872 error2: 1873 freemsg(mp); 1874 if (tlc_set) 1875 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt); 1876 } 1877 1878 /* 1879 * In an ideal case of vertical partition in NUMA architecture, its 1880 * beneficial to have the listener and all the incoming connections 1881 * tied to the same squeue. The other constraint is that incoming 1882 * connections should be tied to the squeue attached to interrupted 1883 * CPU for obvious locality reason so this leaves the listener to 1884 * be tied to the same squeue. Our only problem is that when listener 1885 * is binding, the CPU that will get interrupted by the NIC whose 1886 * IP address the listener is binding to is not even known. So 1887 * the code below allows us to change that binding at the time the 1888 * CPU is interrupted by virtue of incoming connection's squeue. 1889 * 1890 * This is usefull only in case of a listener bound to a specific IP 1891 * address. For other kind of listeners, they get bound the 1892 * very first time and there is no attempt to rebind them. 1893 */ 1894 void 1895 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2, 1896 ip_recv_attr_t *ira) 1897 { 1898 conn_t *connp = (conn_t *)arg; 1899 squeue_t *sqp = (squeue_t *)arg2; 1900 squeue_t *new_sqp; 1901 uint32_t conn_flags; 1902 1903 /* 1904 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 1905 * or based on the ring (for packets from GLD). Otherwise it is 1906 * set based on lbolt i.e., a somewhat random number. 1907 */ 1908 ASSERT(ira->ira_sqp != NULL); 1909 new_sqp = ira->ira_sqp; 1910 1911 if (connp->conn_fanout == NULL) 1912 goto done; 1913 1914 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 1915 mutex_enter(&connp->conn_fanout->connf_lock); 1916 mutex_enter(&connp->conn_lock); 1917 /* 1918 * No one from read or write side can access us now 1919 * except for already queued packets on this squeue. 1920 * But since we haven't changed the squeue yet, they 1921 * can't execute. If they are processed after we have 1922 * changed the squeue, they are sent back to the 1923 * correct squeue down below. 1924 * But a listner close can race with processing of 1925 * incoming SYN. If incoming SYN processing changes 1926 * the squeue then the listener close which is waiting 1927 * to enter the squeue would operate on the wrong 1928 * squeue. Hence we don't change the squeue here unless 1929 * the refcount is exactly the minimum refcount. The 1930 * minimum refcount of 4 is counted as - 1 each for 1931 * TCP and IP, 1 for being in the classifier hash, and 1932 * 1 for the mblk being processed. 1933 */ 1934 1935 if (connp->conn_ref != 4 || 1936 connp->conn_tcp->tcp_state != TCPS_LISTEN) { 1937 mutex_exit(&connp->conn_lock); 1938 mutex_exit(&connp->conn_fanout->connf_lock); 1939 goto done; 1940 } 1941 if (connp->conn_sqp != new_sqp) { 1942 while (connp->conn_sqp != new_sqp) 1943 (void) atomic_cas_ptr(&connp->conn_sqp, sqp, 1944 new_sqp); 1945 /* No special MT issues for outbound ixa_sqp hint */ 1946 connp->conn_ixa->ixa_sqp = new_sqp; 1947 } 1948 1949 do { 1950 conn_flags = connp->conn_flags; 1951 conn_flags |= IPCL_FULLY_BOUND; 1952 (void) atomic_cas_32(&connp->conn_flags, 1953 connp->conn_flags, conn_flags); 1954 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 1955 1956 mutex_exit(&connp->conn_fanout->connf_lock); 1957 mutex_exit(&connp->conn_lock); 1958 1959 /* 1960 * Assume we have picked a good squeue for the listener. Make 1961 * subsequent SYNs not try to change the squeue. 1962 */ 1963 connp->conn_recv = tcp_input_listener; 1964 } 1965 1966 done: 1967 if (connp->conn_sqp != sqp) { 1968 CONN_INC_REF(connp); 1969 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp, 1970 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND); 1971 } else { 1972 tcp_input_listener(connp, mp, sqp, ira); 1973 } 1974 } 1975 1976 /* 1977 * Send up all messages queued on tcp_rcv_list. 1978 */ 1979 uint_t 1980 tcp_rcv_drain(tcp_t *tcp) 1981 { 1982 mblk_t *mp; 1983 uint_t ret = 0; 1984 #ifdef DEBUG 1985 uint_t cnt = 0; 1986 #endif 1987 queue_t *q = tcp->tcp_connp->conn_rq; 1988 1989 /* Can't drain on an eager connection */ 1990 if (tcp->tcp_listener != NULL) 1991 return (ret); 1992 1993 /* Can't be a non-STREAMS connection */ 1994 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1995 1996 /* No need for the push timer now. */ 1997 if (tcp->tcp_push_tid != 0) { 1998 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 1999 tcp->tcp_push_tid = 0; 2000 } 2001 2002 /* 2003 * Handle two cases here: we are currently fused or we were 2004 * previously fused and have some urgent data to be delivered 2005 * upstream. The latter happens because we either ran out of 2006 * memory or were detached and therefore sending the SIGURG was 2007 * deferred until this point. In either case we pass control 2008 * over to tcp_fuse_rcv_drain() since it may need to complete 2009 * some work. 2010 */ 2011 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 2012 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 2013 &tcp->tcp_fused_sigurg_mp)) 2014 return (ret); 2015 } 2016 2017 while ((mp = tcp->tcp_rcv_list) != NULL) { 2018 tcp->tcp_rcv_list = mp->b_next; 2019 mp->b_next = NULL; 2020 #ifdef DEBUG 2021 cnt += msgdsize(mp); 2022 #endif 2023 putnext(q, mp); 2024 } 2025 #ifdef DEBUG 2026 ASSERT(cnt == tcp->tcp_rcv_cnt); 2027 #endif 2028 tcp->tcp_rcv_last_head = NULL; 2029 tcp->tcp_rcv_last_tail = NULL; 2030 tcp->tcp_rcv_cnt = 0; 2031 2032 if (canputnext(q)) 2033 return (tcp_rwnd_reopen(tcp)); 2034 2035 return (ret); 2036 } 2037 2038 /* 2039 * Queue data on tcp_rcv_list which is a b_next chain. 2040 * tcp_rcv_last_head/tail is the last element of this chain. 2041 * Each element of the chain is a b_cont chain. 2042 * 2043 * M_DATA messages are added to the current element. 2044 * Other messages are added as new (b_next) elements. 2045 */ 2046 void 2047 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr) 2048 { 2049 ASSERT(seg_len == msgdsize(mp)); 2050 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 2051 2052 if (is_system_labeled()) { 2053 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL); 2054 /* 2055 * Provide for protocols above TCP such as RPC. NOPID leaves 2056 * db_cpid unchanged. 2057 * The cred could have already been set. 2058 */ 2059 if (cr != NULL) 2060 mblk_setcred(mp, cr, NOPID); 2061 } 2062 2063 if (tcp->tcp_rcv_list == NULL) { 2064 ASSERT(tcp->tcp_rcv_last_head == NULL); 2065 tcp->tcp_rcv_list = mp; 2066 tcp->tcp_rcv_last_head = mp; 2067 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 2068 tcp->tcp_rcv_last_tail->b_cont = mp; 2069 } else { 2070 tcp->tcp_rcv_last_head->b_next = mp; 2071 tcp->tcp_rcv_last_head = mp; 2072 } 2073 2074 while (mp->b_cont) 2075 mp = mp->b_cont; 2076 2077 tcp->tcp_rcv_last_tail = mp; 2078 tcp->tcp_rcv_cnt += seg_len; 2079 tcp->tcp_rwnd -= seg_len; 2080 } 2081 2082 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 2083 mblk_t * 2084 tcp_ack_mp(tcp_t *tcp) 2085 { 2086 uint32_t seq_no; 2087 tcp_stack_t *tcps = tcp->tcp_tcps; 2088 conn_t *connp = tcp->tcp_connp; 2089 2090 /* 2091 * There are a few cases to be considered while setting the sequence no. 2092 * Essentially, we can come here while processing an unacceptable pkt 2093 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 2094 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 2095 * If we are here for a zero window probe, stick with suna. In all 2096 * other cases, we check if suna + swnd encompasses snxt and set 2097 * the sequence number to snxt, if so. If snxt falls outside the 2098 * window (the receiver probably shrunk its window), we will go with 2099 * suna + swnd, otherwise the sequence no will be unacceptable to the 2100 * receiver. 2101 */ 2102 if (tcp->tcp_zero_win_probe) { 2103 seq_no = tcp->tcp_suna; 2104 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 2105 ASSERT(tcp->tcp_swnd == 0); 2106 seq_no = tcp->tcp_snxt; 2107 } else { 2108 seq_no = SEQ_GT(tcp->tcp_snxt, 2109 (tcp->tcp_suna + tcp->tcp_swnd)) ? 2110 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 2111 } 2112 2113 if (tcp->tcp_valid_bits) { 2114 /* 2115 * For the complex case where we have to send some 2116 * controls (FIN or SYN), let tcp_xmit_mp do it. 2117 */ 2118 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 2119 NULL, B_FALSE)); 2120 } else { 2121 /* Generate a simple ACK */ 2122 int data_length; 2123 uchar_t *rptr; 2124 tcpha_t *tcpha; 2125 mblk_t *mp1; 2126 int32_t total_hdr_len; 2127 int32_t tcp_hdr_len; 2128 int32_t num_sack_blk = 0; 2129 int32_t sack_opt_len; 2130 ip_xmit_attr_t *ixa = connp->conn_ixa; 2131 2132 /* 2133 * Allocate space for TCP + IP headers 2134 * and link-level header 2135 */ 2136 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 2137 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 2138 tcp->tcp_num_sack_blk); 2139 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 2140 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 2141 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len; 2142 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len; 2143 } else { 2144 total_hdr_len = connp->conn_ht_iphc_len; 2145 tcp_hdr_len = connp->conn_ht_ulp_len; 2146 } 2147 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED); 2148 if (!mp1) 2149 return (NULL); 2150 2151 /* Update the latest receive window size in TCP header. */ 2152 tcp->tcp_tcpha->tha_win = 2153 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 2154 /* copy in prototype TCP + IP header */ 2155 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra; 2156 mp1->b_rptr = rptr; 2157 mp1->b_wptr = rptr + total_hdr_len; 2158 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len); 2159 2160 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length]; 2161 2162 /* Set the TCP sequence number. */ 2163 tcpha->tha_seq = htonl(seq_no); 2164 2165 /* Set up the TCP flag field. */ 2166 tcpha->tha_flags = (uchar_t)TH_ACK; 2167 if (tcp->tcp_ecn_echo_on) 2168 tcpha->tha_flags |= TH_ECE; 2169 2170 tcp->tcp_rack = tcp->tcp_rnxt; 2171 tcp->tcp_rack_cnt = 0; 2172 2173 /* fill in timestamp option if in use */ 2174 if (tcp->tcp_snd_ts_ok) { 2175 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH; 2176 2177 U32_TO_BE32(llbolt, 2178 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 2179 U32_TO_BE32(tcp->tcp_ts_recent, 2180 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 2181 } 2182 2183 /* Fill in SACK options */ 2184 if (num_sack_blk > 0) { 2185 uchar_t *wptr = (uchar_t *)tcpha + 2186 connp->conn_ht_ulp_len; 2187 sack_blk_t *tmp; 2188 int32_t i; 2189 2190 wptr[0] = TCPOPT_NOP; 2191 wptr[1] = TCPOPT_NOP; 2192 wptr[2] = TCPOPT_SACK; 2193 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 2194 sizeof (sack_blk_t); 2195 wptr += TCPOPT_REAL_SACK_LEN; 2196 2197 tmp = tcp->tcp_sack_list; 2198 for (i = 0; i < num_sack_blk; i++) { 2199 U32_TO_BE32(tmp[i].begin, wptr); 2200 wptr += sizeof (tcp_seq); 2201 U32_TO_BE32(tmp[i].end, wptr); 2202 wptr += sizeof (tcp_seq); 2203 } 2204 tcpha->tha_offset_and_reserved += 2205 ((num_sack_blk * 2 + 1) << 4); 2206 } 2207 2208 ixa->ixa_pktlen = total_hdr_len; 2209 2210 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2211 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len); 2212 } else { 2213 ip6_t *ip6 = (ip6_t *)rptr; 2214 2215 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN); 2216 } 2217 2218 /* 2219 * Prime pump for checksum calculation in IP. Include the 2220 * adjustment for a source route if any. 2221 */ 2222 data_length = tcp_hdr_len + connp->conn_sum; 2223 data_length = (data_length >> 16) + (data_length & 0xFFFF); 2224 tcpha->tha_sum = htons(data_length); 2225 2226 if (tcp->tcp_ip_forward_progress) { 2227 tcp->tcp_ip_forward_progress = B_FALSE; 2228 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF; 2229 } else { 2230 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF; 2231 } 2232 return (mp1); 2233 } 2234 } 2235 2236 /* 2237 * Dummy socket upcalls for if/when the conn_t gets detached from a 2238 * direct-callback sonode via a user-driven close(). Easy to catch with 2239 * DTrace FBT, and should be mostly harmless. 2240 */ 2241 2242 /* ARGSUSED */ 2243 static sock_upper_handle_t 2244 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y, 2245 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored) 2246 { 2247 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2248 return (NULL); 2249 } 2250 2251 /* ARGSUSED */ 2252 static void 2253 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr, 2254 pid_t pid) 2255 { 2256 ASSERT(x == NULL); 2257 /* Normally we'd crhold(cr) and attach it to socket state. */ 2258 /* LINTED */ 2259 } 2260 2261 /* ARGSUSED */ 2262 static int 2263 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah) 2264 { 2265 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2266 return (-1); 2267 } 2268 2269 /* ARGSUSED */ 2270 static void 2271 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah) 2272 { 2273 ASSERT(x == NULL); 2274 /* We really want this one to be a harmless NOP for now. */ 2275 /* LINTED */ 2276 } 2277 2278 /* ARGSUSED */ 2279 static ssize_t 2280 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags, 2281 int *error, boolean_t *push) 2282 { 2283 ASSERT(x == NULL); 2284 2285 /* 2286 * Consume the message, set ESHUTDOWN, and return an error. 2287 * Nobody's home! 2288 */ 2289 freemsg(mp); 2290 *error = ESHUTDOWN; 2291 return (-1); 2292 } 2293 2294 /* ARGSUSED */ 2295 static void 2296 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y) 2297 { 2298 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2299 } 2300 2301 /* ARGSUSED */ 2302 static void 2303 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y) 2304 { 2305 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2306 } 2307 2308 /* ARGSUSED */ 2309 static void 2310 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len) 2311 { 2312 ASSERT(x == NULL); 2313 /* Otherwise, this would signal socket state about OOB data. */ 2314 } 2315 2316 /* ARGSUSED */ 2317 static void 2318 tcp_dummy_set_error(sock_upper_handle_t x, int err) 2319 { 2320 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2321 } 2322 2323 /* ARGSUSED */ 2324 static void 2325 tcp_dummy_onearg(sock_upper_handle_t x) 2326 { 2327 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2328 } 2329 2330 static sock_upcalls_t tcp_dummy_upcalls = { 2331 tcp_dummy_newconn, 2332 tcp_dummy_connected, 2333 tcp_dummy_disconnected, 2334 tcp_dummy_opctl, 2335 tcp_dummy_recv, 2336 tcp_dummy_set_proto_props, 2337 tcp_dummy_txq_full, 2338 tcp_dummy_signal_oob, 2339 tcp_dummy_onearg, 2340 tcp_dummy_set_error, 2341 tcp_dummy_onearg 2342 }; 2343 2344 /* 2345 * Handle M_DATA messages from IP. Its called directly from IP via 2346 * squeue for received IP packets. 2347 * 2348 * The first argument is always the connp/tcp to which the mp belongs. 2349 * There are no exceptions to this rule. The caller has already put 2350 * a reference on this connp/tcp and once tcp_input_data() returns, 2351 * the squeue will do the refrele. 2352 * 2353 * The TH_SYN for the listener directly go to tcp_input_listener via 2354 * squeue. ICMP errors go directly to tcp_icmp_input(). 2355 * 2356 * sqp: NULL = recursive, sqp != NULL means called from squeue 2357 */ 2358 void 2359 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2360 { 2361 int32_t bytes_acked; 2362 int32_t gap; 2363 mblk_t *mp1; 2364 uint_t flags; 2365 uint32_t new_swnd = 0; 2366 uchar_t *iphdr; 2367 uchar_t *rptr; 2368 int32_t rgap; 2369 uint32_t seg_ack; 2370 int seg_len; 2371 uint_t ip_hdr_len; 2372 uint32_t seg_seq; 2373 tcpha_t *tcpha; 2374 int urp; 2375 tcp_opt_t tcpopt; 2376 ip_pkt_t ipp; 2377 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 2378 uint32_t cwnd; 2379 uint32_t add; 2380 int npkt; 2381 int mss; 2382 conn_t *connp = (conn_t *)arg; 2383 squeue_t *sqp = (squeue_t *)arg2; 2384 tcp_t *tcp = connp->conn_tcp; 2385 tcp_stack_t *tcps = tcp->tcp_tcps; 2386 sock_upcalls_t *sockupcalls; 2387 2388 /* 2389 * RST from fused tcp loopback peer should trigger an unfuse. 2390 */ 2391 if (tcp->tcp_fused) { 2392 TCP_STAT(tcps, tcp_fusion_aborted); 2393 tcp_unfuse(tcp); 2394 } 2395 2396 iphdr = mp->b_rptr; 2397 rptr = mp->b_rptr; 2398 ASSERT(OK_32PTR(rptr)); 2399 2400 ip_hdr_len = ira->ira_ip_hdr_length; 2401 if (connp->conn_recv_ancillary.crb_all != 0) { 2402 /* 2403 * Record packet information in the ip_pkt_t 2404 */ 2405 ipp.ipp_fields = 0; 2406 if (ira->ira_flags & IRAF_IS_IPV4) { 2407 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp, 2408 B_FALSE); 2409 } else { 2410 uint8_t nexthdrp; 2411 2412 /* 2413 * IPv6 packets can only be received by applications 2414 * that are prepared to receive IPv6 addresses. 2415 * The IP fanout must ensure this. 2416 */ 2417 ASSERT(connp->conn_family == AF_INET6); 2418 2419 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp, 2420 &nexthdrp); 2421 ASSERT(nexthdrp == IPPROTO_TCP); 2422 2423 /* Could have caused a pullup? */ 2424 iphdr = mp->b_rptr; 2425 rptr = mp->b_rptr; 2426 } 2427 } 2428 ASSERT(DB_TYPE(mp) == M_DATA); 2429 ASSERT(mp->b_next == NULL); 2430 2431 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 2432 seg_seq = ntohl(tcpha->tha_seq); 2433 seg_ack = ntohl(tcpha->tha_ack); 2434 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 2435 seg_len = (int)(mp->b_wptr - rptr) - 2436 (ip_hdr_len + TCP_HDR_LENGTH(tcpha)); 2437 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 2438 do { 2439 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 2440 (uintptr_t)INT_MAX); 2441 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 2442 } while ((mp1 = mp1->b_cont) != NULL && 2443 mp1->b_datap->db_type == M_DATA); 2444 } 2445 2446 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa, 2447 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp, 2448 __dtrace_tcp_tcph_t *, tcpha); 2449 2450 if (tcp->tcp_state == TCPS_TIME_WAIT) { 2451 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 2452 seg_len, tcpha, ira); 2453 return; 2454 } 2455 2456 if (sqp != NULL) { 2457 /* 2458 * This is the correct place to update tcp_last_recv_time. Note 2459 * that it is also updated for tcp structure that belongs to 2460 * global and listener queues which do not really need updating. 2461 * But that should not cause any harm. And it is updated for 2462 * all kinds of incoming segments, not only for data segments. 2463 */ 2464 tcp->tcp_last_recv_time = LBOLT_FASTPATH; 2465 } 2466 2467 flags = (unsigned int)tcpha->tha_flags & 0xFF; 2468 2469 BUMP_LOCAL(tcp->tcp_ibsegs); 2470 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 2471 2472 if ((flags & TH_URG) && sqp != NULL) { 2473 /* 2474 * TCP can't handle urgent pointers that arrive before 2475 * the connection has been accept()ed since it can't 2476 * buffer OOB data. Discard segment if this happens. 2477 * 2478 * We can't just rely on a non-null tcp_listener to indicate 2479 * that the accept() has completed since unlinking of the 2480 * eager and completion of the accept are not atomic. 2481 * tcp_detached, when it is not set (B_FALSE) indicates 2482 * that the accept() has completed. 2483 * 2484 * Nor can it reassemble urgent pointers, so discard 2485 * if it's not the next segment expected. 2486 * 2487 * Otherwise, collapse chain into one mblk (discard if 2488 * that fails). This makes sure the headers, retransmitted 2489 * data, and new data all are in the same mblk. 2490 */ 2491 ASSERT(mp != NULL); 2492 if (tcp->tcp_detached || !pullupmsg(mp, -1)) { 2493 freemsg(mp); 2494 return; 2495 } 2496 /* Update pointers into message */ 2497 iphdr = rptr = mp->b_rptr; 2498 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 2499 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 2500 /* 2501 * Since we can't handle any data with this urgent 2502 * pointer that is out of sequence, we expunge 2503 * the data. This allows us to still register 2504 * the urgent mark and generate the M_PCSIG, 2505 * which we can do. 2506 */ 2507 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 2508 seg_len = 0; 2509 } 2510 } 2511 2512 sockupcalls = connp->conn_upcalls; 2513 /* A conn_t may have belonged to a now-closed socket. Be careful. */ 2514 if (sockupcalls == NULL) 2515 sockupcalls = &tcp_dummy_upcalls; 2516 2517 switch (tcp->tcp_state) { 2518 case TCPS_SYN_SENT: 2519 if (connp->conn_final_sqp == NULL && 2520 tcp_outbound_squeue_switch && sqp != NULL) { 2521 ASSERT(connp->conn_initial_sqp == connp->conn_sqp); 2522 connp->conn_final_sqp = sqp; 2523 if (connp->conn_final_sqp != connp->conn_sqp) { 2524 DTRACE_PROBE1(conn__final__sqp__switch, 2525 conn_t *, connp); 2526 CONN_INC_REF(connp); 2527 SQUEUE_SWITCH(connp, connp->conn_final_sqp); 2528 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 2529 tcp_input_data, connp, ira, ip_squeue_flag, 2530 SQTAG_CONNECT_FINISH); 2531 return; 2532 } 2533 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp); 2534 } 2535 if (flags & TH_ACK) { 2536 /* 2537 * Note that our stack cannot send data before a 2538 * connection is established, therefore the 2539 * following check is valid. Otherwise, it has 2540 * to be changed. 2541 */ 2542 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 2543 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 2544 freemsg(mp); 2545 if (flags & TH_RST) 2546 return; 2547 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 2548 tcp, seg_ack, 0, TH_RST); 2549 return; 2550 } 2551 ASSERT(tcp->tcp_suna + 1 == seg_ack); 2552 } 2553 if (flags & TH_RST) { 2554 if (flags & TH_ACK) { 2555 DTRACE_TCP5(connect__refused, mblk_t *, NULL, 2556 ip_xmit_attr_t *, connp->conn_ixa, 2557 void_ip_t *, iphdr, tcp_t *, tcp, 2558 tcph_t *, tcpha); 2559 (void) tcp_clean_death(tcp, ECONNREFUSED); 2560 } 2561 freemsg(mp); 2562 return; 2563 } 2564 if (!(flags & TH_SYN)) { 2565 freemsg(mp); 2566 return; 2567 } 2568 2569 /* Process all TCP options. */ 2570 tcp_process_options(tcp, tcpha); 2571 /* 2572 * The following changes our rwnd to be a multiple of the 2573 * MIN(peer MSS, our MSS) for performance reason. 2574 */ 2575 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf, 2576 tcp->tcp_mss)); 2577 2578 /* Is the other end ECN capable? */ 2579 if (tcp->tcp_ecn_ok) { 2580 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 2581 tcp->tcp_ecn_ok = B_FALSE; 2582 } 2583 } 2584 /* 2585 * Clear ECN flags because it may interfere with later 2586 * processing. 2587 */ 2588 flags &= ~(TH_ECE|TH_CWR); 2589 2590 tcp->tcp_irs = seg_seq; 2591 tcp->tcp_rack = seg_seq; 2592 tcp->tcp_rnxt = seg_seq + 1; 2593 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt); 2594 if (!TCP_IS_DETACHED(tcp)) { 2595 /* Allocate room for SACK options if needed. */ 2596 connp->conn_wroff = connp->conn_ht_iphc_len; 2597 if (tcp->tcp_snd_sack_ok) 2598 connp->conn_wroff += TCPOPT_MAX_SACK_LEN; 2599 if (!tcp->tcp_loopback) 2600 connp->conn_wroff += tcps->tcps_wroff_xtra; 2601 2602 (void) proto_set_tx_wroff(connp->conn_rq, connp, 2603 connp->conn_wroff); 2604 } 2605 if (flags & TH_ACK) { 2606 /* 2607 * If we can't get the confirmation upstream, pretend 2608 * we didn't even see this one. 2609 * 2610 * XXX: how can we pretend we didn't see it if we 2611 * have updated rnxt et. al. 2612 * 2613 * For loopback we defer sending up the T_CONN_CON 2614 * until after some checks below. 2615 */ 2616 mp1 = NULL; 2617 /* 2618 * tcp_sendmsg() checks tcp_state without entering 2619 * the squeue so tcp_state should be updated before 2620 * sending up connection confirmation. Probe the 2621 * state change below when we are sure the connection 2622 * confirmation has been sent. 2623 */ 2624 tcp->tcp_state = TCPS_ESTABLISHED; 2625 if (!tcp_conn_con(tcp, iphdr, mp, 2626 tcp->tcp_loopback ? &mp1 : NULL, ira)) { 2627 tcp->tcp_state = TCPS_SYN_SENT; 2628 freemsg(mp); 2629 return; 2630 } 2631 TCPS_CONN_INC(tcps); 2632 /* SYN was acked - making progress */ 2633 tcp->tcp_ip_forward_progress = B_TRUE; 2634 2635 /* One for the SYN */ 2636 tcp->tcp_suna = tcp->tcp_iss + 1; 2637 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 2638 2639 /* 2640 * If SYN was retransmitted, need to reset all 2641 * retransmission info. This is because this 2642 * segment will be treated as a dup ACK. 2643 */ 2644 if (tcp->tcp_rexmit) { 2645 tcp->tcp_rexmit = B_FALSE; 2646 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 2647 tcp->tcp_rexmit_max = tcp->tcp_snxt; 2648 tcp->tcp_ms_we_have_waited = 0; 2649 2650 /* 2651 * Set tcp_cwnd back to 1 MSS, per 2652 * recommendation from 2653 * draft-floyd-incr-init-win-01.txt, 2654 * Increasing TCP's Initial Window. 2655 */ 2656 tcp->tcp_cwnd = tcp->tcp_mss; 2657 } 2658 2659 tcp->tcp_swl1 = seg_seq; 2660 tcp->tcp_swl2 = seg_ack; 2661 2662 new_swnd = ntohs(tcpha->tha_win); 2663 tcp->tcp_swnd = new_swnd; 2664 if (new_swnd > tcp->tcp_max_swnd) 2665 tcp->tcp_max_swnd = new_swnd; 2666 2667 /* 2668 * Always send the three-way handshake ack immediately 2669 * in order to make the connection complete as soon as 2670 * possible on the accepting host. 2671 */ 2672 flags |= TH_ACK_NEEDED; 2673 2674 /* 2675 * Trace connect-established here. 2676 */ 2677 DTRACE_TCP5(connect__established, mblk_t *, NULL, 2678 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa, 2679 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha); 2680 2681 /* Trace change from SYN_SENT -> ESTABLISHED here */ 2682 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2683 connp->conn_ixa, void, NULL, tcp_t *, tcp, 2684 void, NULL, int32_t, TCPS_SYN_SENT); 2685 2686 /* 2687 * Special case for loopback. At this point we have 2688 * received SYN-ACK from the remote endpoint. In 2689 * order to ensure that both endpoints reach the 2690 * fused state prior to any data exchange, the final 2691 * ACK needs to be sent before we indicate T_CONN_CON 2692 * to the module upstream. 2693 */ 2694 if (tcp->tcp_loopback) { 2695 mblk_t *ack_mp; 2696 2697 ASSERT(!tcp->tcp_unfusable); 2698 ASSERT(mp1 != NULL); 2699 /* 2700 * For loopback, we always get a pure SYN-ACK 2701 * and only need to send back the final ACK 2702 * with no data (this is because the other 2703 * tcp is ours and we don't do T/TCP). This 2704 * final ACK triggers the passive side to 2705 * perform fusion in ESTABLISHED state. 2706 */ 2707 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 2708 if (tcp->tcp_ack_tid != 0) { 2709 (void) TCP_TIMER_CANCEL(tcp, 2710 tcp->tcp_ack_tid); 2711 tcp->tcp_ack_tid = 0; 2712 } 2713 tcp_send_data(tcp, ack_mp); 2714 BUMP_LOCAL(tcp->tcp_obsegs); 2715 TCPS_BUMP_MIB(tcps, tcpOutAck); 2716 2717 if (!IPCL_IS_NONSTR(connp)) { 2718 /* Send up T_CONN_CON */ 2719 if (ira->ira_cred != NULL) { 2720 mblk_setcred(mp1, 2721 ira->ira_cred, 2722 ira->ira_cpid); 2723 } 2724 putnext(connp->conn_rq, mp1); 2725 } else { 2726 (*sockupcalls->su_connected) 2727 (connp->conn_upper_handle, 2728 tcp->tcp_connid, 2729 ira->ira_cred, 2730 ira->ira_cpid); 2731 freemsg(mp1); 2732 } 2733 2734 freemsg(mp); 2735 return; 2736 } 2737 /* 2738 * Forget fusion; we need to handle more 2739 * complex cases below. Send the deferred 2740 * T_CONN_CON message upstream and proceed 2741 * as usual. Mark this tcp as not capable 2742 * of fusion. 2743 */ 2744 TCP_STAT(tcps, tcp_fusion_unfusable); 2745 tcp->tcp_unfusable = B_TRUE; 2746 if (!IPCL_IS_NONSTR(connp)) { 2747 if (ira->ira_cred != NULL) { 2748 mblk_setcred(mp1, ira->ira_cred, 2749 ira->ira_cpid); 2750 } 2751 putnext(connp->conn_rq, mp1); 2752 } else { 2753 (*sockupcalls->su_connected) 2754 (connp->conn_upper_handle, 2755 tcp->tcp_connid, ira->ira_cred, 2756 ira->ira_cpid); 2757 freemsg(mp1); 2758 } 2759 } 2760 2761 /* 2762 * Check to see if there is data to be sent. If 2763 * yes, set the transmit flag. Then check to see 2764 * if received data processing needs to be done. 2765 * If not, go straight to xmit_check. This short 2766 * cut is OK as we don't support T/TCP. 2767 */ 2768 if (tcp->tcp_unsent) 2769 flags |= TH_XMIT_NEEDED; 2770 2771 if (seg_len == 0 && !(flags & TH_URG)) { 2772 freemsg(mp); 2773 goto xmit_check; 2774 } 2775 2776 flags &= ~TH_SYN; 2777 seg_seq++; 2778 break; 2779 } 2780 tcp->tcp_state = TCPS_SYN_RCVD; 2781 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2782 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp, 2783 tcph_t *, NULL, int32_t, TCPS_SYN_SENT); 2784 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 2785 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 2786 if (mp1 != NULL) { 2787 tcp_send_data(tcp, mp1); 2788 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 2789 } 2790 freemsg(mp); 2791 return; 2792 case TCPS_SYN_RCVD: 2793 if (flags & TH_ACK) { 2794 uint32_t pinit_wnd; 2795 2796 /* 2797 * In this state, a SYN|ACK packet is either bogus 2798 * because the other side must be ACKing our SYN which 2799 * indicates it has seen the ACK for their SYN and 2800 * shouldn't retransmit it or we're crossing SYNs 2801 * on active open. 2802 */ 2803 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 2804 freemsg(mp); 2805 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 2806 tcp, seg_ack, 0, TH_RST); 2807 return; 2808 } 2809 /* 2810 * NOTE: RFC 793 pg. 72 says this should be 2811 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 2812 * but that would mean we have an ack that ignored 2813 * our SYN. 2814 */ 2815 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 2816 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 2817 freemsg(mp); 2818 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 2819 tcp, seg_ack, 0, TH_RST); 2820 return; 2821 } 2822 /* 2823 * No sane TCP stack will send such a small window 2824 * without receiving any data. Just drop this invalid 2825 * ACK. We also shorten the abort timeout in case 2826 * this is an attack. 2827 */ 2828 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws; 2829 if (pinit_wnd < tcp->tcp_mss && 2830 pinit_wnd < tcp_init_wnd_chk) { 2831 freemsg(mp); 2832 TCP_STAT(tcps, tcp_zwin_ack_syn); 2833 tcp->tcp_second_ctimer_threshold = 2834 tcp_early_abort * SECONDS; 2835 return; 2836 } 2837 } 2838 break; 2839 case TCPS_LISTEN: 2840 /* 2841 * Only a TLI listener can come through this path when a 2842 * acceptor is going back to be a listener and a packet 2843 * for the acceptor hits the classifier. For a socket 2844 * listener, this can never happen because a listener 2845 * can never accept connection on itself and hence a 2846 * socket acceptor can not go back to being a listener. 2847 */ 2848 ASSERT(!TCP_IS_SOCKET(tcp)); 2849 /*FALLTHRU*/ 2850 case TCPS_CLOSED: 2851 case TCPS_BOUND: { 2852 conn_t *new_connp; 2853 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 2854 2855 /* 2856 * Don't accept any input on a closed tcp as this TCP logically 2857 * does not exist on the system. Don't proceed further with 2858 * this TCP. For instance, this packet could trigger another 2859 * close of this tcp which would be disastrous for tcp_refcnt. 2860 * tcp_close_detached / tcp_clean_death / tcp_closei_local must 2861 * be called at most once on a TCP. In this case we need to 2862 * refeed the packet into the classifier and figure out where 2863 * the packet should go. 2864 */ 2865 new_connp = ipcl_classify(mp, ira, ipst); 2866 if (new_connp != NULL) { 2867 /* Drops ref on new_connp */ 2868 tcp_reinput(new_connp, mp, ira, ipst); 2869 return; 2870 } 2871 /* We failed to classify. For now just drop the packet */ 2872 freemsg(mp); 2873 return; 2874 } 2875 case TCPS_IDLE: 2876 /* 2877 * Handle the case where the tcp_clean_death() has happened 2878 * on a connection (application hasn't closed yet) but a packet 2879 * was already queued on squeue before tcp_clean_death() 2880 * was processed. Calling tcp_clean_death() twice on same 2881 * connection can result in weird behaviour. 2882 */ 2883 freemsg(mp); 2884 return; 2885 default: 2886 break; 2887 } 2888 2889 /* 2890 * Already on the correct queue/perimeter. 2891 * If this is a detached connection and not an eager 2892 * connection hanging off a listener then new data 2893 * (past the FIN) will cause a reset. 2894 * We do a special check here where it 2895 * is out of the main line, rather than check 2896 * if we are detached every time we see new 2897 * data down below. 2898 */ 2899 if (TCP_IS_DETACHED_NONEAGER(tcp) && 2900 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 2901 TCPS_BUMP_MIB(tcps, tcpInClosed); 2902 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 2903 freemsg(mp); 2904 tcp_xmit_ctl("new data when detached", tcp, 2905 tcp->tcp_snxt, 0, TH_RST); 2906 (void) tcp_clean_death(tcp, EPROTO); 2907 return; 2908 } 2909 2910 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 2911 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION; 2912 new_swnd = ntohs(tcpha->tha_win) << 2913 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws); 2914 2915 if (tcp->tcp_snd_ts_ok) { 2916 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) { 2917 /* 2918 * This segment is not acceptable. 2919 * Drop it and send back an ACK. 2920 */ 2921 freemsg(mp); 2922 flags |= TH_ACK_NEEDED; 2923 goto ack_check; 2924 } 2925 } else if (tcp->tcp_snd_sack_ok) { 2926 tcpopt.tcp = tcp; 2927 /* 2928 * SACK info in already updated in tcp_parse_options. Ignore 2929 * all other TCP options... 2930 */ 2931 (void) tcp_parse_options(tcpha, &tcpopt); 2932 } 2933 try_again:; 2934 mss = tcp->tcp_mss; 2935 gap = seg_seq - tcp->tcp_rnxt; 2936 rgap = tcp->tcp_rwnd - (gap + seg_len); 2937 /* 2938 * gap is the amount of sequence space between what we expect to see 2939 * and what we got for seg_seq. A positive value for gap means 2940 * something got lost. A negative value means we got some old stuff. 2941 */ 2942 if (gap < 0) { 2943 /* Old stuff present. Is the SYN in there? */ 2944 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 2945 (seg_len != 0)) { 2946 flags &= ~TH_SYN; 2947 seg_seq++; 2948 urp--; 2949 /* Recompute the gaps after noting the SYN. */ 2950 goto try_again; 2951 } 2952 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs); 2953 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, 2954 (seg_len > -gap ? -gap : seg_len)); 2955 /* Remove the old stuff from seg_len. */ 2956 seg_len += gap; 2957 /* 2958 * Anything left? 2959 * Make sure to check for unack'd FIN when rest of data 2960 * has been previously ack'd. 2961 */ 2962 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 2963 /* 2964 * Resets are only valid if they lie within our offered 2965 * window. If the RST bit is set, we just ignore this 2966 * segment. 2967 */ 2968 if (flags & TH_RST) { 2969 freemsg(mp); 2970 return; 2971 } 2972 2973 /* 2974 * The arriving of dup data packets indicate that we 2975 * may have postponed an ack for too long, or the other 2976 * side's RTT estimate is out of shape. Start acking 2977 * more often. 2978 */ 2979 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 2980 tcp->tcp_rack_cnt >= 1 && 2981 tcp->tcp_rack_abs_max > 2) { 2982 tcp->tcp_rack_abs_max--; 2983 } 2984 tcp->tcp_rack_cur_max = 1; 2985 2986 /* 2987 * This segment is "unacceptable". None of its 2988 * sequence space lies within our advertized window. 2989 * 2990 * Adjust seg_len to the original value for tracing. 2991 */ 2992 seg_len -= gap; 2993 if (connp->conn_debug) { 2994 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 2995 "tcp_rput: unacceptable, gap %d, rgap %d, " 2996 "flags 0x%x, seg_seq %u, seg_ack %u, " 2997 "seg_len %d, rnxt %u, snxt %u, %s", 2998 gap, rgap, flags, seg_seq, seg_ack, 2999 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 3000 tcp_display(tcp, NULL, 3001 DISP_ADDR_AND_PORT)); 3002 } 3003 3004 /* 3005 * Arrange to send an ACK in response to the 3006 * unacceptable segment per RFC 793 page 69. There 3007 * is only one small difference between ours and the 3008 * acceptability test in the RFC - we accept ACK-only 3009 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 3010 * will be generated. 3011 * 3012 * Note that we have to ACK an ACK-only packet at least 3013 * for stacks that send 0-length keep-alives with 3014 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 3015 * section 4.2.3.6. As long as we don't ever generate 3016 * an unacceptable packet in response to an incoming 3017 * packet that is unacceptable, it should not cause 3018 * "ACK wars". 3019 */ 3020 flags |= TH_ACK_NEEDED; 3021 3022 /* 3023 * Continue processing this segment in order to use the 3024 * ACK information it contains, but skip all other 3025 * sequence-number processing. Processing the ACK 3026 * information is necessary in order to 3027 * re-synchronize connections that may have lost 3028 * synchronization. 3029 * 3030 * We clear seg_len and flag fields related to 3031 * sequence number processing as they are not 3032 * to be trusted for an unacceptable segment. 3033 */ 3034 seg_len = 0; 3035 flags &= ~(TH_SYN | TH_FIN | TH_URG); 3036 goto process_ack; 3037 } 3038 3039 /* Fix seg_seq, and chew the gap off the front. */ 3040 seg_seq = tcp->tcp_rnxt; 3041 urp += gap; 3042 do { 3043 mblk_t *mp2; 3044 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 3045 (uintptr_t)UINT_MAX); 3046 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 3047 if (gap > 0) { 3048 mp->b_rptr = mp->b_wptr - gap; 3049 break; 3050 } 3051 mp2 = mp; 3052 mp = mp->b_cont; 3053 freeb(mp2); 3054 } while (gap < 0); 3055 /* 3056 * If the urgent data has already been acknowledged, we 3057 * should ignore TH_URG below 3058 */ 3059 if (urp < 0) 3060 flags &= ~TH_URG; 3061 } 3062 /* 3063 * rgap is the amount of stuff received out of window. A negative 3064 * value is the amount out of window. 3065 */ 3066 if (rgap < 0) { 3067 mblk_t *mp2; 3068 3069 if (tcp->tcp_rwnd == 0) { 3070 TCPS_BUMP_MIB(tcps, tcpInWinProbe); 3071 } else { 3072 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs); 3073 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap); 3074 } 3075 3076 /* 3077 * seg_len does not include the FIN, so if more than 3078 * just the FIN is out of window, we act like we don't 3079 * see it. (If just the FIN is out of window, rgap 3080 * will be zero and we will go ahead and acknowledge 3081 * the FIN.) 3082 */ 3083 flags &= ~TH_FIN; 3084 3085 /* Fix seg_len and make sure there is something left. */ 3086 seg_len += rgap; 3087 if (seg_len <= 0) { 3088 /* 3089 * Resets are only valid if they lie within our offered 3090 * window. If the RST bit is set, we just ignore this 3091 * segment. 3092 */ 3093 if (flags & TH_RST) { 3094 freemsg(mp); 3095 return; 3096 } 3097 3098 /* Per RFC 793, we need to send back an ACK. */ 3099 flags |= TH_ACK_NEEDED; 3100 3101 /* 3102 * Send SIGURG as soon as possible i.e. even 3103 * if the TH_URG was delivered in a window probe 3104 * packet (which will be unacceptable). 3105 * 3106 * We generate a signal if none has been generated 3107 * for this connection or if this is a new urgent 3108 * byte. Also send a zero-length "unmarked" message 3109 * to inform SIOCATMARK that this is not the mark. 3110 * 3111 * tcp_urp_last_valid is cleared when the T_exdata_ind 3112 * is sent up. This plus the check for old data 3113 * (gap >= 0) handles the wraparound of the sequence 3114 * number space without having to always track the 3115 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 3116 * this max in its rcv_up variable). 3117 * 3118 * This prevents duplicate SIGURGS due to a "late" 3119 * zero-window probe when the T_EXDATA_IND has already 3120 * been sent up. 3121 */ 3122 if ((flags & TH_URG) && 3123 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 3124 tcp->tcp_urp_last))) { 3125 if (IPCL_IS_NONSTR(connp)) { 3126 if (!TCP_IS_DETACHED(tcp)) { 3127 (*sockupcalls->su_signal_oob) 3128 (connp->conn_upper_handle, 3129 urp); 3130 } 3131 } else { 3132 mp1 = allocb(0, BPRI_MED); 3133 if (mp1 == NULL) { 3134 freemsg(mp); 3135 return; 3136 } 3137 if (!TCP_IS_DETACHED(tcp) && 3138 !putnextctl1(connp->conn_rq, 3139 M_PCSIG, SIGURG)) { 3140 /* Try again on the rexmit. */ 3141 freemsg(mp1); 3142 freemsg(mp); 3143 return; 3144 } 3145 /* 3146 * If the next byte would be the mark 3147 * then mark with MARKNEXT else mark 3148 * with NOTMARKNEXT. 3149 */ 3150 if (gap == 0 && urp == 0) 3151 mp1->b_flag |= MSGMARKNEXT; 3152 else 3153 mp1->b_flag |= MSGNOTMARKNEXT; 3154 freemsg(tcp->tcp_urp_mark_mp); 3155 tcp->tcp_urp_mark_mp = mp1; 3156 flags |= TH_SEND_URP_MARK; 3157 } 3158 tcp->tcp_urp_last_valid = B_TRUE; 3159 tcp->tcp_urp_last = urp + seg_seq; 3160 } 3161 /* 3162 * If this is a zero window probe, continue to 3163 * process the ACK part. But we need to set seg_len 3164 * to 0 to avoid data processing. Otherwise just 3165 * drop the segment and send back an ACK. 3166 */ 3167 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 3168 flags &= ~(TH_SYN | TH_URG); 3169 seg_len = 0; 3170 goto process_ack; 3171 } else { 3172 freemsg(mp); 3173 goto ack_check; 3174 } 3175 } 3176 /* Pitch out of window stuff off the end. */ 3177 rgap = seg_len; 3178 mp2 = mp; 3179 do { 3180 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 3181 (uintptr_t)INT_MAX); 3182 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 3183 if (rgap < 0) { 3184 mp2->b_wptr += rgap; 3185 if ((mp1 = mp2->b_cont) != NULL) { 3186 mp2->b_cont = NULL; 3187 freemsg(mp1); 3188 } 3189 break; 3190 } 3191 } while ((mp2 = mp2->b_cont) != NULL); 3192 } 3193 ok:; 3194 /* 3195 * TCP should check ECN info for segments inside the window only. 3196 * Therefore the check should be done here. 3197 */ 3198 if (tcp->tcp_ecn_ok) { 3199 if (flags & TH_CWR) { 3200 tcp->tcp_ecn_echo_on = B_FALSE; 3201 } 3202 /* 3203 * Note that both ECN_CE and CWR can be set in the 3204 * same segment. In this case, we once again turn 3205 * on ECN_ECHO. 3206 */ 3207 if (connp->conn_ipversion == IPV4_VERSION) { 3208 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 3209 3210 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 3211 tcp->tcp_ecn_echo_on = B_TRUE; 3212 } 3213 } else { 3214 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 3215 3216 if ((vcf & htonl(IPH_ECN_CE << 20)) == 3217 htonl(IPH_ECN_CE << 20)) { 3218 tcp->tcp_ecn_echo_on = B_TRUE; 3219 } 3220 } 3221 } 3222 3223 /* 3224 * Check whether we can update tcp_ts_recent. This test is 3225 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 3226 * Extensions for High Performance: An Update", Internet Draft. 3227 */ 3228 if (tcp->tcp_snd_ts_ok && 3229 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 3230 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 3231 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 3232 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64; 3233 } 3234 3235 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 3236 /* 3237 * FIN in an out of order segment. We record this in 3238 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 3239 * Clear the FIN so that any check on FIN flag will fail. 3240 * Remember that FIN also counts in the sequence number 3241 * space. So we need to ack out of order FIN only segments. 3242 */ 3243 if (flags & TH_FIN) { 3244 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 3245 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 3246 flags &= ~TH_FIN; 3247 flags |= TH_ACK_NEEDED; 3248 } 3249 if (seg_len > 0) { 3250 /* Fill in the SACK blk list. */ 3251 if (tcp->tcp_snd_sack_ok) { 3252 tcp_sack_insert(tcp->tcp_sack_list, 3253 seg_seq, seg_seq + seg_len, 3254 &(tcp->tcp_num_sack_blk)); 3255 } 3256 3257 /* 3258 * Attempt reassembly and see if we have something 3259 * ready to go. 3260 */ 3261 mp = tcp_reass(tcp, mp, seg_seq); 3262 /* Always ack out of order packets */ 3263 flags |= TH_ACK_NEEDED | TH_PUSH; 3264 if (mp) { 3265 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 3266 (uintptr_t)INT_MAX); 3267 seg_len = mp->b_cont ? msgdsize(mp) : 3268 (int)(mp->b_wptr - mp->b_rptr); 3269 seg_seq = tcp->tcp_rnxt; 3270 /* 3271 * A gap is filled and the seq num and len 3272 * of the gap match that of a previously 3273 * received FIN, put the FIN flag back in. 3274 */ 3275 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 3276 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 3277 flags |= TH_FIN; 3278 tcp->tcp_valid_bits &= 3279 ~TCP_OFO_FIN_VALID; 3280 } 3281 if (tcp->tcp_reass_tid != 0) { 3282 (void) TCP_TIMER_CANCEL(tcp, 3283 tcp->tcp_reass_tid); 3284 /* 3285 * Restart the timer if there is still 3286 * data in the reassembly queue. 3287 */ 3288 if (tcp->tcp_reass_head != NULL) { 3289 tcp->tcp_reass_tid = TCP_TIMER( 3290 tcp, tcp_reass_timer, 3291 tcps->tcps_reass_timeout); 3292 } else { 3293 tcp->tcp_reass_tid = 0; 3294 } 3295 } 3296 } else { 3297 /* 3298 * Keep going even with NULL mp. 3299 * There may be a useful ACK or something else 3300 * we don't want to miss. 3301 * 3302 * But TCP should not perform fast retransmit 3303 * because of the ack number. TCP uses 3304 * seg_len == 0 to determine if it is a pure 3305 * ACK. And this is not a pure ACK. 3306 */ 3307 seg_len = 0; 3308 ofo_seg = B_TRUE; 3309 3310 if (tcps->tcps_reass_timeout != 0 && 3311 tcp->tcp_reass_tid == 0) { 3312 tcp->tcp_reass_tid = TCP_TIMER(tcp, 3313 tcp_reass_timer, 3314 tcps->tcps_reass_timeout); 3315 } 3316 } 3317 } 3318 } else if (seg_len > 0) { 3319 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs); 3320 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len); 3321 /* 3322 * If an out of order FIN was received before, and the seq 3323 * num and len of the new segment match that of the FIN, 3324 * put the FIN flag back in. 3325 */ 3326 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 3327 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 3328 flags |= TH_FIN; 3329 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 3330 } 3331 } 3332 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 3333 if (flags & TH_RST) { 3334 freemsg(mp); 3335 switch (tcp->tcp_state) { 3336 case TCPS_SYN_RCVD: 3337 (void) tcp_clean_death(tcp, ECONNREFUSED); 3338 break; 3339 case TCPS_ESTABLISHED: 3340 case TCPS_FIN_WAIT_1: 3341 case TCPS_FIN_WAIT_2: 3342 case TCPS_CLOSE_WAIT: 3343 (void) tcp_clean_death(tcp, ECONNRESET); 3344 break; 3345 case TCPS_CLOSING: 3346 case TCPS_LAST_ACK: 3347 (void) tcp_clean_death(tcp, 0); 3348 break; 3349 default: 3350 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 3351 (void) tcp_clean_death(tcp, ENXIO); 3352 break; 3353 } 3354 return; 3355 } 3356 if (flags & TH_SYN) { 3357 /* 3358 * See RFC 793, Page 71 3359 * 3360 * The seq number must be in the window as it should 3361 * be "fixed" above. If it is outside window, it should 3362 * be already rejected. Note that we allow seg_seq to be 3363 * rnxt + rwnd because we want to accept 0 window probe. 3364 */ 3365 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 3366 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 3367 freemsg(mp); 3368 /* 3369 * If the ACK flag is not set, just use our snxt as the 3370 * seq number of the RST segment. 3371 */ 3372 if (!(flags & TH_ACK)) { 3373 seg_ack = tcp->tcp_snxt; 3374 } 3375 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 3376 TH_RST|TH_ACK); 3377 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 3378 (void) tcp_clean_death(tcp, ECONNRESET); 3379 return; 3380 } 3381 /* 3382 * urp could be -1 when the urp field in the packet is 0 3383 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 3384 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 3385 */ 3386 if (flags & TH_URG && urp >= 0) { 3387 if (!tcp->tcp_urp_last_valid || 3388 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 3389 /* 3390 * Non-STREAMS sockets handle the urgent data a litte 3391 * differently from STREAMS based sockets. There is no 3392 * need to mark any mblks with the MSG{NOT,}MARKNEXT 3393 * flags to keep SIOCATMARK happy. Instead a 3394 * su_signal_oob upcall is made to update the mark. 3395 * Neither is a T_EXDATA_IND mblk needed to be 3396 * prepended to the urgent data. The urgent data is 3397 * delivered using the su_recv upcall, where we set 3398 * the MSG_OOB flag to indicate that it is urg data. 3399 * 3400 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED 3401 * are used by non-STREAMS sockets. 3402 */ 3403 if (IPCL_IS_NONSTR(connp)) { 3404 if (!TCP_IS_DETACHED(tcp)) { 3405 (*sockupcalls->su_signal_oob) 3406 (connp->conn_upper_handle, urp); 3407 } 3408 } else { 3409 /* 3410 * If we haven't generated the signal yet for 3411 * this urgent pointer value, do it now. Also, 3412 * send up a zero-length M_DATA indicating 3413 * whether or not this is the mark. The latter 3414 * is not needed when a T_EXDATA_IND is sent up. 3415 * However, if there are allocation failures 3416 * this code relies on the sender retransmitting 3417 * and the socket code for determining the mark 3418 * should not block waiting for the peer to 3419 * transmit. Thus, for simplicity we always 3420 * send up the mark indication. 3421 */ 3422 mp1 = allocb(0, BPRI_MED); 3423 if (mp1 == NULL) { 3424 freemsg(mp); 3425 return; 3426 } 3427 if (!TCP_IS_DETACHED(tcp) && 3428 !putnextctl1(connp->conn_rq, M_PCSIG, 3429 SIGURG)) { 3430 /* Try again on the rexmit. */ 3431 freemsg(mp1); 3432 freemsg(mp); 3433 return; 3434 } 3435 /* 3436 * Mark with NOTMARKNEXT for now. 3437 * The code below will change this to MARKNEXT 3438 * if we are at the mark. 3439 * 3440 * If there are allocation failures (e.g. in 3441 * dupmsg below) the next time tcp_input_data 3442 * sees the urgent segment it will send up the 3443 * MSGMARKNEXT message. 3444 */ 3445 mp1->b_flag |= MSGNOTMARKNEXT; 3446 freemsg(tcp->tcp_urp_mark_mp); 3447 tcp->tcp_urp_mark_mp = mp1; 3448 flags |= TH_SEND_URP_MARK; 3449 #ifdef DEBUG 3450 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3451 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 3452 "last %x, %s", 3453 seg_seq, urp, tcp->tcp_urp_last, 3454 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 3455 #endif /* DEBUG */ 3456 } 3457 tcp->tcp_urp_last_valid = B_TRUE; 3458 tcp->tcp_urp_last = urp + seg_seq; 3459 } else if (tcp->tcp_urp_mark_mp != NULL) { 3460 /* 3461 * An allocation failure prevented the previous 3462 * tcp_input_data from sending up the allocated 3463 * MSG*MARKNEXT message - send it up this time 3464 * around. 3465 */ 3466 flags |= TH_SEND_URP_MARK; 3467 } 3468 3469 /* 3470 * If the urgent byte is in this segment, make sure that it is 3471 * all by itself. This makes it much easier to deal with the 3472 * possibility of an allocation failure on the T_exdata_ind. 3473 * Note that seg_len is the number of bytes in the segment, and 3474 * urp is the offset into the segment of the urgent byte. 3475 * urp < seg_len means that the urgent byte is in this segment. 3476 */ 3477 if (urp < seg_len) { 3478 if (seg_len != 1) { 3479 uint32_t tmp_rnxt; 3480 /* 3481 * Break it up and feed it back in. 3482 * Re-attach the IP header. 3483 */ 3484 mp->b_rptr = iphdr; 3485 if (urp > 0) { 3486 /* 3487 * There is stuff before the urgent 3488 * byte. 3489 */ 3490 mp1 = dupmsg(mp); 3491 if (!mp1) { 3492 /* 3493 * Trim from urgent byte on. 3494 * The rest will come back. 3495 */ 3496 (void) adjmsg(mp, 3497 urp - seg_len); 3498 tcp_input_data(connp, 3499 mp, NULL, ira); 3500 return; 3501 } 3502 (void) adjmsg(mp1, urp - seg_len); 3503 /* Feed this piece back in. */ 3504 tmp_rnxt = tcp->tcp_rnxt; 3505 tcp_input_data(connp, mp1, NULL, ira); 3506 /* 3507 * If the data passed back in was not 3508 * processed (ie: bad ACK) sending 3509 * the remainder back in will cause a 3510 * loop. In this case, drop the 3511 * packet and let the sender try 3512 * sending a good packet. 3513 */ 3514 if (tmp_rnxt == tcp->tcp_rnxt) { 3515 freemsg(mp); 3516 return; 3517 } 3518 } 3519 if (urp != seg_len - 1) { 3520 uint32_t tmp_rnxt; 3521 /* 3522 * There is stuff after the urgent 3523 * byte. 3524 */ 3525 mp1 = dupmsg(mp); 3526 if (!mp1) { 3527 /* 3528 * Trim everything beyond the 3529 * urgent byte. The rest will 3530 * come back. 3531 */ 3532 (void) adjmsg(mp, 3533 urp + 1 - seg_len); 3534 tcp_input_data(connp, 3535 mp, NULL, ira); 3536 return; 3537 } 3538 (void) adjmsg(mp1, urp + 1 - seg_len); 3539 tmp_rnxt = tcp->tcp_rnxt; 3540 tcp_input_data(connp, mp1, NULL, ira); 3541 /* 3542 * If the data passed back in was not 3543 * processed (ie: bad ACK) sending 3544 * the remainder back in will cause a 3545 * loop. In this case, drop the 3546 * packet and let the sender try 3547 * sending a good packet. 3548 */ 3549 if (tmp_rnxt == tcp->tcp_rnxt) { 3550 freemsg(mp); 3551 return; 3552 } 3553 } 3554 tcp_input_data(connp, mp, NULL, ira); 3555 return; 3556 } 3557 /* 3558 * This segment contains only the urgent byte. We 3559 * have to allocate the T_exdata_ind, if we can. 3560 */ 3561 if (IPCL_IS_NONSTR(connp)) { 3562 int error; 3563 3564 (*sockupcalls->su_recv) 3565 (connp->conn_upper_handle, mp, seg_len, 3566 MSG_OOB, &error, NULL); 3567 /* 3568 * We should never be in middle of a 3569 * fallback, the squeue guarantees that. 3570 */ 3571 ASSERT(error != EOPNOTSUPP); 3572 mp = NULL; 3573 goto update_ack; 3574 } else if (!tcp->tcp_urp_mp) { 3575 struct T_exdata_ind *tei; 3576 mp1 = allocb(sizeof (struct T_exdata_ind), 3577 BPRI_MED); 3578 if (!mp1) { 3579 /* 3580 * Sigh... It'll be back. 3581 * Generate any MSG*MARK message now. 3582 */ 3583 freemsg(mp); 3584 seg_len = 0; 3585 if (flags & TH_SEND_URP_MARK) { 3586 3587 3588 ASSERT(tcp->tcp_urp_mark_mp); 3589 tcp->tcp_urp_mark_mp->b_flag &= 3590 ~MSGNOTMARKNEXT; 3591 tcp->tcp_urp_mark_mp->b_flag |= 3592 MSGMARKNEXT; 3593 } 3594 goto ack_check; 3595 } 3596 mp1->b_datap->db_type = M_PROTO; 3597 tei = (struct T_exdata_ind *)mp1->b_rptr; 3598 tei->PRIM_type = T_EXDATA_IND; 3599 tei->MORE_flag = 0; 3600 mp1->b_wptr = (uchar_t *)&tei[1]; 3601 tcp->tcp_urp_mp = mp1; 3602 #ifdef DEBUG 3603 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3604 "tcp_rput: allocated exdata_ind %s", 3605 tcp_display(tcp, NULL, 3606 DISP_PORT_ONLY)); 3607 #endif /* DEBUG */ 3608 /* 3609 * There is no need to send a separate MSG*MARK 3610 * message since the T_EXDATA_IND will be sent 3611 * now. 3612 */ 3613 flags &= ~TH_SEND_URP_MARK; 3614 freemsg(tcp->tcp_urp_mark_mp); 3615 tcp->tcp_urp_mark_mp = NULL; 3616 } 3617 /* 3618 * Now we are all set. On the next putnext upstream, 3619 * tcp_urp_mp will be non-NULL and will get prepended 3620 * to what has to be this piece containing the urgent 3621 * byte. If for any reason we abort this segment below, 3622 * if it comes back, we will have this ready, or it 3623 * will get blown off in close. 3624 */ 3625 } else if (urp == seg_len) { 3626 /* 3627 * The urgent byte is the next byte after this sequence 3628 * number. If this endpoint is non-STREAMS, then there 3629 * is nothing to do here since the socket has already 3630 * been notified about the urg pointer by the 3631 * su_signal_oob call above. 3632 * 3633 * In case of STREAMS, some more work might be needed. 3634 * If there is data it is marked with MSGMARKNEXT and 3635 * and any tcp_urp_mark_mp is discarded since it is not 3636 * needed. Otherwise, if the code above just allocated 3637 * a zero-length tcp_urp_mark_mp message, that message 3638 * is tagged with MSGMARKNEXT. Sending up these 3639 * MSGMARKNEXT messages makes SIOCATMARK work correctly 3640 * even though the T_EXDATA_IND will not be sent up 3641 * until the urgent byte arrives. 3642 */ 3643 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) { 3644 if (seg_len != 0) { 3645 flags |= TH_MARKNEXT_NEEDED; 3646 freemsg(tcp->tcp_urp_mark_mp); 3647 tcp->tcp_urp_mark_mp = NULL; 3648 flags &= ~TH_SEND_URP_MARK; 3649 } else if (tcp->tcp_urp_mark_mp != NULL) { 3650 flags |= TH_SEND_URP_MARK; 3651 tcp->tcp_urp_mark_mp->b_flag &= 3652 ~MSGNOTMARKNEXT; 3653 tcp->tcp_urp_mark_mp->b_flag |= 3654 MSGMARKNEXT; 3655 } 3656 } 3657 #ifdef DEBUG 3658 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3659 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 3660 seg_len, flags, 3661 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 3662 #endif /* DEBUG */ 3663 } 3664 #ifdef DEBUG 3665 else { 3666 /* Data left until we hit mark */ 3667 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3668 "tcp_rput: URP %d bytes left, %s", 3669 urp - seg_len, tcp_display(tcp, NULL, 3670 DISP_PORT_ONLY)); 3671 } 3672 #endif /* DEBUG */ 3673 } 3674 3675 process_ack: 3676 if (!(flags & TH_ACK)) { 3677 freemsg(mp); 3678 goto xmit_check; 3679 } 3680 } 3681 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 3682 3683 if (bytes_acked > 0) 3684 tcp->tcp_ip_forward_progress = B_TRUE; 3685 if (tcp->tcp_state == TCPS_SYN_RCVD) { 3686 /* 3687 * tcp_sendmsg() checks tcp_state without entering 3688 * the squeue so tcp_state should be updated before 3689 * sending up a connection confirmation or a new 3690 * connection indication. 3691 */ 3692 tcp->tcp_state = TCPS_ESTABLISHED; 3693 3694 /* 3695 * We are seeing the final ack in the three way 3696 * hand shake of a active open'ed connection 3697 * so we must send up a T_CONN_CON 3698 */ 3699 if (tcp->tcp_active_open) { 3700 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) { 3701 freemsg(mp); 3702 tcp->tcp_state = TCPS_SYN_RCVD; 3703 return; 3704 } 3705 /* 3706 * Don't fuse the loopback endpoints for 3707 * simultaneous active opens. 3708 */ 3709 if (tcp->tcp_loopback) { 3710 TCP_STAT(tcps, tcp_fusion_unfusable); 3711 tcp->tcp_unfusable = B_TRUE; 3712 } 3713 /* 3714 * For simultaneous active open, trace receipt of final 3715 * ACK as tcp:::connect-established. 3716 */ 3717 DTRACE_TCP5(connect__established, mblk_t *, NULL, 3718 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3719 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3720 } else if (IPCL_IS_NONSTR(connp)) { 3721 /* 3722 * 3-way handshake has completed, so notify socket 3723 * of the new connection. 3724 * 3725 * We are here means eager is fine but it can 3726 * get a TH_RST at any point between now and till 3727 * accept completes and disappear. We need to 3728 * ensure that reference to eager is valid after 3729 * we get out of eager's perimeter. So we do 3730 * an extra refhold. 3731 */ 3732 CONN_INC_REF(connp); 3733 3734 if (!tcp_newconn_notify(tcp, ira)) { 3735 /* 3736 * The state-change probe for SYN_RCVD -> 3737 * ESTABLISHED has not fired yet. We reset 3738 * the state to SYN_RCVD so that future 3739 * state-change probes report correct state 3740 * transistions. 3741 */ 3742 tcp->tcp_state = TCPS_SYN_RCVD; 3743 freemsg(mp); 3744 /* notification did not go up, so drop ref */ 3745 CONN_DEC_REF(connp); 3746 /* ... and close the eager */ 3747 ASSERT(TCP_IS_DETACHED(tcp)); 3748 (void) tcp_close_detached(tcp); 3749 return; 3750 } 3751 /* 3752 * tcp_newconn_notify() changes conn_upcalls and 3753 * connp->conn_upper_handle. Fix things now, in case 3754 * there's data attached to this ack. 3755 */ 3756 if (connp->conn_upcalls != NULL) 3757 sockupcalls = connp->conn_upcalls; 3758 /* 3759 * For passive open, trace receipt of final ACK as 3760 * tcp:::accept-established. 3761 */ 3762 DTRACE_TCP5(accept__established, mlbk_t *, NULL, 3763 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3764 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3765 } else { 3766 /* 3767 * 3-way handshake complete - this is a STREAMS based 3768 * socket, so pass up the T_CONN_IND. 3769 */ 3770 tcp_t *listener = tcp->tcp_listener; 3771 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 3772 3773 tcp->tcp_tconnind_started = B_TRUE; 3774 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3775 ASSERT(mp != NULL); 3776 /* 3777 * We are here means eager is fine but it can 3778 * get a TH_RST at any point between now and till 3779 * accept completes and disappear. We need to 3780 * ensure that reference to eager is valid after 3781 * we get out of eager's perimeter. So we do 3782 * an extra refhold. 3783 */ 3784 CONN_INC_REF(connp); 3785 3786 /* 3787 * The listener also exists because of the refhold 3788 * done in tcp_input_listener. Its possible that it 3789 * might have closed. We will check that once we 3790 * get inside listeners context. 3791 */ 3792 CONN_INC_REF(listener->tcp_connp); 3793 if (listener->tcp_connp->conn_sqp == 3794 connp->conn_sqp) { 3795 /* 3796 * We optimize by not calling an SQUEUE_ENTER 3797 * on the listener since we know that the 3798 * listener and eager squeues are the same. 3799 * We are able to make this check safely only 3800 * because neither the eager nor the listener 3801 * can change its squeue. Only an active connect 3802 * can change its squeue 3803 */ 3804 tcp_send_conn_ind(listener->tcp_connp, mp, 3805 listener->tcp_connp->conn_sqp); 3806 CONN_DEC_REF(listener->tcp_connp); 3807 } else if (!tcp->tcp_loopback) { 3808 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 3809 mp, tcp_send_conn_ind, 3810 listener->tcp_connp, NULL, SQ_FILL, 3811 SQTAG_TCP_CONN_IND); 3812 } else { 3813 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 3814 mp, tcp_send_conn_ind, 3815 listener->tcp_connp, NULL, SQ_NODRAIN, 3816 SQTAG_TCP_CONN_IND); 3817 } 3818 /* 3819 * For passive open, trace receipt of final ACK as 3820 * tcp:::accept-established. 3821 */ 3822 DTRACE_TCP5(accept__established, mlbk_t *, NULL, 3823 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3824 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3825 } 3826 TCPS_CONN_INC(tcps); 3827 3828 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 3829 bytes_acked--; 3830 /* SYN was acked - making progress */ 3831 tcp->tcp_ip_forward_progress = B_TRUE; 3832 3833 /* 3834 * If SYN was retransmitted, need to reset all 3835 * retransmission info as this segment will be 3836 * treated as a dup ACK. 3837 */ 3838 if (tcp->tcp_rexmit) { 3839 tcp->tcp_rexmit = B_FALSE; 3840 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 3841 tcp->tcp_rexmit_max = tcp->tcp_snxt; 3842 tcp->tcp_ms_we_have_waited = 0; 3843 tcp->tcp_cwnd = mss; 3844 } 3845 3846 /* 3847 * We set the send window to zero here. 3848 * This is needed if there is data to be 3849 * processed already on the queue. 3850 * Later (at swnd_update label), the 3851 * "new_swnd > tcp_swnd" condition is satisfied 3852 * the XMIT_NEEDED flag is set in the current 3853 * (SYN_RCVD) state. This ensures tcp_wput_data() is 3854 * called if there is already data on queue in 3855 * this state. 3856 */ 3857 tcp->tcp_swnd = 0; 3858 3859 if (new_swnd > tcp->tcp_max_swnd) 3860 tcp->tcp_max_swnd = new_swnd; 3861 tcp->tcp_swl1 = seg_seq; 3862 tcp->tcp_swl2 = seg_ack; 3863 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 3864 3865 /* Trace change from SYN_RCVD -> ESTABLISHED here */ 3866 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 3867 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 3868 int32_t, TCPS_SYN_RCVD); 3869 3870 /* Fuse when both sides are in ESTABLISHED state */ 3871 if (tcp->tcp_loopback && do_tcp_fusion) 3872 tcp_fuse(tcp, iphdr, tcpha); 3873 3874 } 3875 /* This code follows 4.4BSD-Lite2 mostly. */ 3876 if (bytes_acked < 0) 3877 goto est; 3878 3879 /* 3880 * If TCP is ECN capable and the congestion experience bit is 3881 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 3882 * done once per window (or more loosely, per RTT). 3883 */ 3884 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 3885 tcp->tcp_cwr = B_FALSE; 3886 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 3887 if (!tcp->tcp_cwr) { 3888 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 3889 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 3890 tcp->tcp_cwnd = npkt * mss; 3891 /* 3892 * If the cwnd is 0, use the timer to clock out 3893 * new segments. This is required by the ECN spec. 3894 */ 3895 if (npkt == 0) { 3896 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 3897 /* 3898 * This makes sure that when the ACK comes 3899 * back, we will increase tcp_cwnd by 1 MSS. 3900 */ 3901 tcp->tcp_cwnd_cnt = 0; 3902 } 3903 tcp->tcp_cwr = B_TRUE; 3904 /* 3905 * This marks the end of the current window of in 3906 * flight data. That is why we don't use 3907 * tcp_suna + tcp_swnd. Only data in flight can 3908 * provide ECN info. 3909 */ 3910 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 3911 tcp->tcp_ecn_cwr_sent = B_FALSE; 3912 } 3913 } 3914 3915 mp1 = tcp->tcp_xmit_head; 3916 if (bytes_acked == 0) { 3917 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 3918 int dupack_cnt; 3919 3920 TCPS_BUMP_MIB(tcps, tcpInDupAck); 3921 /* 3922 * Fast retransmit. When we have seen exactly three 3923 * identical ACKs while we have unacked data 3924 * outstanding we take it as a hint that our peer 3925 * dropped something. 3926 * 3927 * If TCP is retransmitting, don't do fast retransmit. 3928 */ 3929 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 3930 ! tcp->tcp_rexmit) { 3931 /* Do Limited Transmit */ 3932 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 3933 tcps->tcps_dupack_fast_retransmit) { 3934 /* 3935 * RFC 3042 3936 * 3937 * What we need to do is temporarily 3938 * increase tcp_cwnd so that new 3939 * data can be sent if it is allowed 3940 * by the receive window (tcp_rwnd). 3941 * tcp_wput_data() will take care of 3942 * the rest. 3943 * 3944 * If the connection is SACK capable, 3945 * only do limited xmit when there 3946 * is SACK info. 3947 * 3948 * Note how tcp_cwnd is incremented. 3949 * The first dup ACK will increase 3950 * it by 1 MSS. The second dup ACK 3951 * will increase it by 2 MSS. This 3952 * means that only 1 new segment will 3953 * be sent for each dup ACK. 3954 */ 3955 if (tcp->tcp_unsent > 0 && 3956 (!tcp->tcp_snd_sack_ok || 3957 (tcp->tcp_snd_sack_ok && 3958 tcp->tcp_notsack_list != NULL))) { 3959 tcp->tcp_cwnd += mss << 3960 (tcp->tcp_dupack_cnt - 1); 3961 flags |= TH_LIMIT_XMIT; 3962 } 3963 } else if (dupack_cnt == 3964 tcps->tcps_dupack_fast_retransmit) { 3965 3966 /* 3967 * If we have reduced tcp_ssthresh 3968 * because of ECN, do not reduce it again 3969 * unless it is already one window of data 3970 * away. After one window of data, tcp_cwr 3971 * should then be cleared. Note that 3972 * for non ECN capable connection, tcp_cwr 3973 * should always be false. 3974 * 3975 * Adjust cwnd since the duplicate 3976 * ack indicates that a packet was 3977 * dropped (due to congestion.) 3978 */ 3979 if (!tcp->tcp_cwr) { 3980 npkt = ((tcp->tcp_snxt - 3981 tcp->tcp_suna) >> 1) / mss; 3982 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 3983 mss; 3984 tcp->tcp_cwnd = (npkt + 3985 tcp->tcp_dupack_cnt) * mss; 3986 } 3987 if (tcp->tcp_ecn_ok) { 3988 tcp->tcp_cwr = B_TRUE; 3989 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 3990 tcp->tcp_ecn_cwr_sent = B_FALSE; 3991 } 3992 3993 /* 3994 * We do Hoe's algorithm. Refer to her 3995 * paper "Improving the Start-up Behavior 3996 * of a Congestion Control Scheme for TCP," 3997 * appeared in SIGCOMM'96. 3998 * 3999 * Save highest seq no we have sent so far. 4000 * Be careful about the invisible FIN byte. 4001 */ 4002 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 4003 (tcp->tcp_unsent == 0)) { 4004 tcp->tcp_rexmit_max = tcp->tcp_fss; 4005 } else { 4006 tcp->tcp_rexmit_max = tcp->tcp_snxt; 4007 } 4008 4009 /* 4010 * For SACK: 4011 * Calculate tcp_pipe, which is the 4012 * estimated number of bytes in 4013 * network. 4014 * 4015 * tcp_fack is the highest sack'ed seq num 4016 * TCP has received. 4017 * 4018 * tcp_pipe is explained in the above quoted 4019 * Fall and Floyd's paper. tcp_fack is 4020 * explained in Mathis and Mahdavi's 4021 * "Forward Acknowledgment: Refining TCP 4022 * Congestion Control" in SIGCOMM '96. 4023 */ 4024 if (tcp->tcp_snd_sack_ok) { 4025 if (tcp->tcp_notsack_list != NULL) { 4026 tcp->tcp_pipe = tcp->tcp_snxt - 4027 tcp->tcp_fack; 4028 tcp->tcp_sack_snxt = seg_ack; 4029 flags |= TH_NEED_SACK_REXMIT; 4030 } else { 4031 /* 4032 * Always initialize tcp_pipe 4033 * even though we don't have 4034 * any SACK info. If later 4035 * we get SACK info and 4036 * tcp_pipe is not initialized, 4037 * funny things will happen. 4038 */ 4039 tcp->tcp_pipe = 4040 tcp->tcp_cwnd_ssthresh; 4041 } 4042 } else { 4043 flags |= TH_REXMIT_NEEDED; 4044 } /* tcp_snd_sack_ok */ 4045 4046 } else { 4047 /* 4048 * Here we perform congestion 4049 * avoidance, but NOT slow start. 4050 * This is known as the Fast 4051 * Recovery Algorithm. 4052 */ 4053 if (tcp->tcp_snd_sack_ok && 4054 tcp->tcp_notsack_list != NULL) { 4055 flags |= TH_NEED_SACK_REXMIT; 4056 tcp->tcp_pipe -= mss; 4057 if (tcp->tcp_pipe < 0) 4058 tcp->tcp_pipe = 0; 4059 } else { 4060 /* 4061 * We know that one more packet has 4062 * left the pipe thus we can update 4063 * cwnd. 4064 */ 4065 cwnd = tcp->tcp_cwnd + mss; 4066 if (cwnd > tcp->tcp_cwnd_max) 4067 cwnd = tcp->tcp_cwnd_max; 4068 tcp->tcp_cwnd = cwnd; 4069 if (tcp->tcp_unsent > 0) 4070 flags |= TH_XMIT_NEEDED; 4071 } 4072 } 4073 } 4074 } else if (tcp->tcp_zero_win_probe) { 4075 /* 4076 * If the window has opened, need to arrange 4077 * to send additional data. 4078 */ 4079 if (new_swnd != 0) { 4080 /* tcp_suna != tcp_snxt */ 4081 /* Packet contains a window update */ 4082 TCPS_BUMP_MIB(tcps, tcpInWinUpdate); 4083 tcp->tcp_zero_win_probe = 0; 4084 tcp->tcp_timer_backoff = 0; 4085 tcp->tcp_ms_we_have_waited = 0; 4086 4087 /* 4088 * Transmit starting with tcp_suna since 4089 * the one byte probe is not ack'ed. 4090 * If TCP has sent more than one identical 4091 * probe, tcp_rexmit will be set. That means 4092 * tcp_ss_rexmit() will send out the one 4093 * byte along with new data. Otherwise, 4094 * fake the retransmission. 4095 */ 4096 flags |= TH_XMIT_NEEDED; 4097 if (!tcp->tcp_rexmit) { 4098 tcp->tcp_rexmit = B_TRUE; 4099 tcp->tcp_dupack_cnt = 0; 4100 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 4101 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 4102 } 4103 } 4104 } 4105 goto swnd_update; 4106 } 4107 4108 /* 4109 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 4110 * If the ACK value acks something that we have not yet sent, it might 4111 * be an old duplicate segment. Send an ACK to re-synchronize the 4112 * other side. 4113 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 4114 * state is handled above, so we can always just drop the segment and 4115 * send an ACK here. 4116 * 4117 * In the case where the peer shrinks the window, we see the new window 4118 * update, but all the data sent previously is queued up by the peer. 4119 * To account for this, in tcp_process_shrunk_swnd(), the sequence 4120 * number, which was already sent, and within window, is recorded. 4121 * tcp_snxt is then updated. 4122 * 4123 * If the window has previously shrunk, and an ACK for data not yet 4124 * sent, according to tcp_snxt is recieved, it may still be valid. If 4125 * the ACK is for data within the window at the time the window was 4126 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to 4127 * the sequence number ACK'ed. 4128 * 4129 * If the ACK covers all the data sent at the time the window was 4130 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE. 4131 * 4132 * Should we send ACKs in response to ACK only segments? 4133 */ 4134 4135 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 4136 if ((tcp->tcp_is_wnd_shrnk) && 4137 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) { 4138 uint32_t data_acked_ahead_snxt; 4139 4140 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt; 4141 tcp_update_xmit_tail(tcp, seg_ack); 4142 tcp->tcp_unsent -= data_acked_ahead_snxt; 4143 } else { 4144 TCPS_BUMP_MIB(tcps, tcpInAckUnsent); 4145 /* drop the received segment */ 4146 freemsg(mp); 4147 4148 /* 4149 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 4150 * greater than 0, check if the number of such 4151 * bogus ACks is greater than that count. If yes, 4152 * don't send back any ACK. This prevents TCP from 4153 * getting into an ACK storm if somehow an attacker 4154 * successfully spoofs an acceptable segment to our 4155 * peer. If this continues (count > 2 X threshold), 4156 * we should abort this connection. 4157 */ 4158 if (tcp_drop_ack_unsent_cnt > 0 && 4159 ++tcp->tcp_in_ack_unsent > 4160 tcp_drop_ack_unsent_cnt) { 4161 TCP_STAT(tcps, tcp_in_ack_unsent_drop); 4162 if (tcp->tcp_in_ack_unsent > 2 * 4163 tcp_drop_ack_unsent_cnt) { 4164 (void) tcp_clean_death(tcp, EPROTO); 4165 } 4166 return; 4167 } 4168 mp = tcp_ack_mp(tcp); 4169 if (mp != NULL) { 4170 BUMP_LOCAL(tcp->tcp_obsegs); 4171 TCPS_BUMP_MIB(tcps, tcpOutAck); 4172 tcp_send_data(tcp, mp); 4173 } 4174 return; 4175 } 4176 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack, 4177 tcp->tcp_snxt_shrunk)) { 4178 tcp->tcp_is_wnd_shrnk = B_FALSE; 4179 } 4180 4181 /* 4182 * TCP gets a new ACK, update the notsack'ed list to delete those 4183 * blocks that are covered by this ACK. 4184 */ 4185 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 4186 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 4187 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 4188 } 4189 4190 /* 4191 * If we got an ACK after fast retransmit, check to see 4192 * if it is a partial ACK. If it is not and the congestion 4193 * window was inflated to account for the other side's 4194 * cached packets, retract it. If it is, do Hoe's algorithm. 4195 */ 4196 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) { 4197 ASSERT(tcp->tcp_rexmit == B_FALSE); 4198 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 4199 tcp->tcp_dupack_cnt = 0; 4200 /* 4201 * Restore the orig tcp_cwnd_ssthresh after 4202 * fast retransmit phase. 4203 */ 4204 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 4205 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 4206 } 4207 tcp->tcp_rexmit_max = seg_ack; 4208 tcp->tcp_cwnd_cnt = 0; 4209 4210 /* 4211 * Remove all notsack info to avoid confusion with 4212 * the next fast retrasnmit/recovery phase. 4213 */ 4214 if (tcp->tcp_snd_sack_ok) { 4215 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 4216 tcp); 4217 } 4218 } else { 4219 if (tcp->tcp_snd_sack_ok && 4220 tcp->tcp_notsack_list != NULL) { 4221 flags |= TH_NEED_SACK_REXMIT; 4222 tcp->tcp_pipe -= mss; 4223 if (tcp->tcp_pipe < 0) 4224 tcp->tcp_pipe = 0; 4225 } else { 4226 /* 4227 * Hoe's algorithm: 4228 * 4229 * Retransmit the unack'ed segment and 4230 * restart fast recovery. Note that we 4231 * need to scale back tcp_cwnd to the 4232 * original value when we started fast 4233 * recovery. This is to prevent overly 4234 * aggressive behaviour in sending new 4235 * segments. 4236 */ 4237 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 4238 tcps->tcps_dupack_fast_retransmit * mss; 4239 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 4240 flags |= TH_REXMIT_NEEDED; 4241 } 4242 } 4243 } else { 4244 tcp->tcp_dupack_cnt = 0; 4245 if (tcp->tcp_rexmit) { 4246 /* 4247 * TCP is retranmitting. If the ACK ack's all 4248 * outstanding data, update tcp_rexmit_max and 4249 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 4250 * to the correct value. 4251 * 4252 * Note that SEQ_LEQ() is used. This is to avoid 4253 * unnecessary fast retransmit caused by dup ACKs 4254 * received when TCP does slow start retransmission 4255 * after a time out. During this phase, TCP may 4256 * send out segments which are already received. 4257 * This causes dup ACKs to be sent back. 4258 */ 4259 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 4260 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 4261 tcp->tcp_rexmit_nxt = seg_ack; 4262 } 4263 if (seg_ack != tcp->tcp_rexmit_max) { 4264 flags |= TH_XMIT_NEEDED; 4265 } 4266 } else { 4267 tcp->tcp_rexmit = B_FALSE; 4268 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 4269 } 4270 tcp->tcp_ms_we_have_waited = 0; 4271 } 4272 } 4273 4274 TCPS_BUMP_MIB(tcps, tcpInAckSegs); 4275 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked); 4276 tcp->tcp_suna = seg_ack; 4277 if (tcp->tcp_zero_win_probe != 0) { 4278 tcp->tcp_zero_win_probe = 0; 4279 tcp->tcp_timer_backoff = 0; 4280 } 4281 4282 /* 4283 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 4284 * Note that it cannot be the SYN being ack'ed. The code flow 4285 * will not reach here. 4286 */ 4287 if (mp1 == NULL) { 4288 goto fin_acked; 4289 } 4290 4291 /* 4292 * Update the congestion window. 4293 * 4294 * If TCP is not ECN capable or TCP is ECN capable but the 4295 * congestion experience bit is not set, increase the tcp_cwnd as 4296 * usual. 4297 */ 4298 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 4299 cwnd = tcp->tcp_cwnd; 4300 add = mss; 4301 4302 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 4303 /* 4304 * This is to prevent an increase of less than 1 MSS of 4305 * tcp_cwnd. With partial increase, tcp_wput_data() 4306 * may send out tinygrams in order to preserve mblk 4307 * boundaries. 4308 * 4309 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 4310 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 4311 * increased by 1 MSS for every RTTs. 4312 */ 4313 if (tcp->tcp_cwnd_cnt <= 0) { 4314 tcp->tcp_cwnd_cnt = cwnd + add; 4315 } else { 4316 tcp->tcp_cwnd_cnt -= add; 4317 add = 0; 4318 } 4319 } 4320 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 4321 } 4322 4323 /* See if the latest urgent data has been acknowledged */ 4324 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 4325 SEQ_GT(seg_ack, tcp->tcp_urg)) 4326 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 4327 4328 /* Can we update the RTT estimates? */ 4329 if (tcp->tcp_snd_ts_ok) { 4330 /* Ignore zero timestamp echo-reply. */ 4331 if (tcpopt.tcp_opt_ts_ecr != 0) { 4332 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH - 4333 (int32_t)tcpopt.tcp_opt_ts_ecr); 4334 } 4335 4336 /* If needed, restart the timer. */ 4337 if (tcp->tcp_set_timer == 1) { 4338 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4339 tcp->tcp_set_timer = 0; 4340 } 4341 /* 4342 * Update tcp_csuna in case the other side stops sending 4343 * us timestamps. 4344 */ 4345 tcp->tcp_csuna = tcp->tcp_snxt; 4346 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 4347 /* 4348 * An ACK sequence we haven't seen before, so get the RTT 4349 * and update the RTO. But first check if the timestamp is 4350 * valid to use. 4351 */ 4352 if ((mp1->b_next != NULL) && 4353 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) 4354 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH - 4355 (int32_t)(intptr_t)mp1->b_prev); 4356 else 4357 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate); 4358 4359 /* Remeber the last sequence to be ACKed */ 4360 tcp->tcp_csuna = seg_ack; 4361 if (tcp->tcp_set_timer == 1) { 4362 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4363 tcp->tcp_set_timer = 0; 4364 } 4365 } else { 4366 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate); 4367 } 4368 4369 /* Eat acknowledged bytes off the xmit queue. */ 4370 for (;;) { 4371 mblk_t *mp2; 4372 uchar_t *wptr; 4373 4374 wptr = mp1->b_wptr; 4375 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 4376 bytes_acked -= (int)(wptr - mp1->b_rptr); 4377 if (bytes_acked < 0) { 4378 mp1->b_rptr = wptr + bytes_acked; 4379 /* 4380 * Set a new timestamp if all the bytes timed by the 4381 * old timestamp have been ack'ed. 4382 */ 4383 if (SEQ_GT(seg_ack, 4384 (uint32_t)(uintptr_t)(mp1->b_next))) { 4385 mp1->b_prev = 4386 (mblk_t *)(uintptr_t)LBOLT_FASTPATH; 4387 mp1->b_next = NULL; 4388 } 4389 break; 4390 } 4391 mp1->b_next = NULL; 4392 mp1->b_prev = NULL; 4393 mp2 = mp1; 4394 mp1 = mp1->b_cont; 4395 4396 /* 4397 * This notification is required for some zero-copy 4398 * clients to maintain a copy semantic. After the data 4399 * is ack'ed, client is safe to modify or reuse the buffer. 4400 */ 4401 if (tcp->tcp_snd_zcopy_aware && 4402 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 4403 tcp_zcopy_notify(tcp); 4404 freeb(mp2); 4405 if (bytes_acked == 0) { 4406 if (mp1 == NULL) { 4407 /* Everything is ack'ed, clear the tail. */ 4408 tcp->tcp_xmit_tail = NULL; 4409 /* 4410 * Cancel the timer unless we are still 4411 * waiting for an ACK for the FIN packet. 4412 */ 4413 if (tcp->tcp_timer_tid != 0 && 4414 tcp->tcp_snxt == tcp->tcp_suna) { 4415 (void) TCP_TIMER_CANCEL(tcp, 4416 tcp->tcp_timer_tid); 4417 tcp->tcp_timer_tid = 0; 4418 } 4419 goto pre_swnd_update; 4420 } 4421 if (mp2 != tcp->tcp_xmit_tail) 4422 break; 4423 tcp->tcp_xmit_tail = mp1; 4424 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 4425 (uintptr_t)INT_MAX); 4426 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 4427 mp1->b_rptr); 4428 break; 4429 } 4430 if (mp1 == NULL) { 4431 /* 4432 * More was acked but there is nothing more 4433 * outstanding. This means that the FIN was 4434 * just acked or that we're talking to a clown. 4435 */ 4436 fin_acked: 4437 ASSERT(tcp->tcp_fin_sent); 4438 tcp->tcp_xmit_tail = NULL; 4439 if (tcp->tcp_fin_sent) { 4440 /* FIN was acked - making progress */ 4441 if (!tcp->tcp_fin_acked) 4442 tcp->tcp_ip_forward_progress = B_TRUE; 4443 tcp->tcp_fin_acked = B_TRUE; 4444 if (tcp->tcp_linger_tid != 0 && 4445 TCP_TIMER_CANCEL(tcp, 4446 tcp->tcp_linger_tid) >= 0) { 4447 tcp_stop_lingering(tcp); 4448 freemsg(mp); 4449 mp = NULL; 4450 } 4451 } else { 4452 /* 4453 * We should never get here because 4454 * we have already checked that the 4455 * number of bytes ack'ed should be 4456 * smaller than or equal to what we 4457 * have sent so far (it is the 4458 * acceptability check of the ACK). 4459 * We can only get here if the send 4460 * queue is corrupted. 4461 * 4462 * Terminate the connection and 4463 * panic the system. It is better 4464 * for us to panic instead of 4465 * continuing to avoid other disaster. 4466 */ 4467 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 4468 tcp->tcp_rnxt, TH_RST|TH_ACK); 4469 panic("Memory corruption " 4470 "detected for connection %s.", 4471 tcp_display(tcp, NULL, 4472 DISP_ADDR_AND_PORT)); 4473 /*NOTREACHED*/ 4474 } 4475 goto pre_swnd_update; 4476 } 4477 ASSERT(mp2 != tcp->tcp_xmit_tail); 4478 } 4479 if (tcp->tcp_unsent) { 4480 flags |= TH_XMIT_NEEDED; 4481 } 4482 pre_swnd_update: 4483 tcp->tcp_xmit_head = mp1; 4484 swnd_update: 4485 /* 4486 * The following check is different from most other implementations. 4487 * For bi-directional transfer, when segments are dropped, the 4488 * "normal" check will not accept a window update in those 4489 * retransmitted segemnts. Failing to do that, TCP may send out 4490 * segments which are outside receiver's window. As TCP accepts 4491 * the ack in those retransmitted segments, if the window update in 4492 * the same segment is not accepted, TCP will incorrectly calculates 4493 * that it can send more segments. This can create a deadlock 4494 * with the receiver if its window becomes zero. 4495 */ 4496 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 4497 SEQ_LT(tcp->tcp_swl1, seg_seq) || 4498 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 4499 /* 4500 * The criteria for update is: 4501 * 4502 * 1. the segment acknowledges some data. Or 4503 * 2. the segment is new, i.e. it has a higher seq num. Or 4504 * 3. the segment is not old and the advertised window is 4505 * larger than the previous advertised window. 4506 */ 4507 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 4508 flags |= TH_XMIT_NEEDED; 4509 tcp->tcp_swnd = new_swnd; 4510 if (new_swnd > tcp->tcp_max_swnd) 4511 tcp->tcp_max_swnd = new_swnd; 4512 tcp->tcp_swl1 = seg_seq; 4513 tcp->tcp_swl2 = seg_ack; 4514 } 4515 est: 4516 if (tcp->tcp_state > TCPS_ESTABLISHED) { 4517 4518 switch (tcp->tcp_state) { 4519 case TCPS_FIN_WAIT_1: 4520 if (tcp->tcp_fin_acked) { 4521 tcp->tcp_state = TCPS_FIN_WAIT_2; 4522 DTRACE_TCP6(state__change, void, NULL, 4523 ip_xmit_attr_t *, connp->conn_ixa, 4524 void, NULL, tcp_t *, tcp, void, NULL, 4525 int32_t, TCPS_FIN_WAIT_1); 4526 /* 4527 * We implement the non-standard BSD/SunOS 4528 * FIN_WAIT_2 flushing algorithm. 4529 * If there is no user attached to this 4530 * TCP endpoint, then this TCP struct 4531 * could hang around forever in FIN_WAIT_2 4532 * state if the peer forgets to send us 4533 * a FIN. To prevent this, we wait only 4534 * 2*MSL (a convenient time value) for 4535 * the FIN to arrive. If it doesn't show up, 4536 * we flush the TCP endpoint. This algorithm, 4537 * though a violation of RFC-793, has worked 4538 * for over 10 years in BSD systems. 4539 * Note: SunOS 4.x waits 675 seconds before 4540 * flushing the FIN_WAIT_2 connection. 4541 */ 4542 TCP_TIMER_RESTART(tcp, 4543 tcp->tcp_fin_wait_2_flush_interval); 4544 } 4545 break; 4546 case TCPS_FIN_WAIT_2: 4547 break; /* Shutdown hook? */ 4548 case TCPS_LAST_ACK: 4549 freemsg(mp); 4550 if (tcp->tcp_fin_acked) { 4551 (void) tcp_clean_death(tcp, 0); 4552 return; 4553 } 4554 goto xmit_check; 4555 case TCPS_CLOSING: 4556 if (tcp->tcp_fin_acked) { 4557 SET_TIME_WAIT(tcps, tcp, connp); 4558 DTRACE_TCP6(state__change, void, NULL, 4559 ip_xmit_attr_t *, connp->conn_ixa, void, 4560 NULL, tcp_t *, tcp, void, NULL, int32_t, 4561 TCPS_CLOSING); 4562 } 4563 /*FALLTHRU*/ 4564 case TCPS_CLOSE_WAIT: 4565 freemsg(mp); 4566 goto xmit_check; 4567 default: 4568 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 4569 break; 4570 } 4571 } 4572 if (flags & TH_FIN) { 4573 /* Make sure we ack the fin */ 4574 flags |= TH_ACK_NEEDED; 4575 if (!tcp->tcp_fin_rcvd) { 4576 tcp->tcp_fin_rcvd = B_TRUE; 4577 tcp->tcp_rnxt++; 4578 tcpha = tcp->tcp_tcpha; 4579 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 4580 4581 /* 4582 * Generate the ordrel_ind at the end unless the 4583 * conn is detached or it is a STREAMS based eager. 4584 * In the eager case we defer the notification until 4585 * tcp_accept_finish has run. 4586 */ 4587 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) || 4588 (tcp->tcp_listener == NULL && 4589 !tcp->tcp_hard_binding))) 4590 flags |= TH_ORDREL_NEEDED; 4591 switch (tcp->tcp_state) { 4592 case TCPS_SYN_RCVD: 4593 tcp->tcp_state = TCPS_CLOSE_WAIT; 4594 DTRACE_TCP6(state__change, void, NULL, 4595 ip_xmit_attr_t *, connp->conn_ixa, 4596 void, NULL, tcp_t *, tcp, void, NULL, 4597 int32_t, TCPS_SYN_RCVD); 4598 /* Keepalive? */ 4599 break; 4600 case TCPS_ESTABLISHED: 4601 tcp->tcp_state = TCPS_CLOSE_WAIT; 4602 DTRACE_TCP6(state__change, void, NULL, 4603 ip_xmit_attr_t *, connp->conn_ixa, 4604 void, NULL, tcp_t *, tcp, void, NULL, 4605 int32_t, TCPS_ESTABLISHED); 4606 /* Keepalive? */ 4607 break; 4608 case TCPS_FIN_WAIT_1: 4609 if (!tcp->tcp_fin_acked) { 4610 tcp->tcp_state = TCPS_CLOSING; 4611 DTRACE_TCP6(state__change, void, NULL, 4612 ip_xmit_attr_t *, connp->conn_ixa, 4613 void, NULL, tcp_t *, tcp, void, 4614 NULL, int32_t, TCPS_FIN_WAIT_1); 4615 break; 4616 } 4617 /* FALLTHRU */ 4618 case TCPS_FIN_WAIT_2: 4619 SET_TIME_WAIT(tcps, tcp, connp); 4620 DTRACE_TCP6(state__change, void, NULL, 4621 ip_xmit_attr_t *, connp->conn_ixa, void, 4622 NULL, tcp_t *, tcp, void, NULL, int32_t, 4623 TCPS_FIN_WAIT_2); 4624 if (seg_len) { 4625 /* 4626 * implies data piggybacked on FIN. 4627 * break to handle data. 4628 */ 4629 break; 4630 } 4631 freemsg(mp); 4632 goto ack_check; 4633 } 4634 } 4635 } 4636 if (mp == NULL) 4637 goto xmit_check; 4638 if (seg_len == 0) { 4639 freemsg(mp); 4640 goto xmit_check; 4641 } 4642 if (mp->b_rptr == mp->b_wptr) { 4643 /* 4644 * The header has been consumed, so we remove the 4645 * zero-length mblk here. 4646 */ 4647 mp1 = mp; 4648 mp = mp->b_cont; 4649 freeb(mp1); 4650 } 4651 update_ack: 4652 tcpha = tcp->tcp_tcpha; 4653 tcp->tcp_rack_cnt++; 4654 { 4655 uint32_t cur_max; 4656 4657 cur_max = tcp->tcp_rack_cur_max; 4658 if (tcp->tcp_rack_cnt >= cur_max) { 4659 /* 4660 * We have more unacked data than we should - send 4661 * an ACK now. 4662 */ 4663 flags |= TH_ACK_NEEDED; 4664 cur_max++; 4665 if (cur_max > tcp->tcp_rack_abs_max) 4666 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 4667 else 4668 tcp->tcp_rack_cur_max = cur_max; 4669 } else if (TCP_IS_DETACHED(tcp)) { 4670 /* We don't have an ACK timer for detached TCP. */ 4671 flags |= TH_ACK_NEEDED; 4672 } else if (seg_len < mss) { 4673 /* 4674 * If we get a segment that is less than an mss, and we 4675 * already have unacknowledged data, and the amount 4676 * unacknowledged is not a multiple of mss, then we 4677 * better generate an ACK now. Otherwise, this may be 4678 * the tail piece of a transaction, and we would rather 4679 * wait for the response. 4680 */ 4681 uint32_t udif; 4682 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 4683 (uintptr_t)INT_MAX); 4684 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 4685 if (udif && (udif % mss)) 4686 flags |= TH_ACK_NEEDED; 4687 else 4688 flags |= TH_ACK_TIMER_NEEDED; 4689 } else { 4690 /* Start delayed ack timer */ 4691 flags |= TH_ACK_TIMER_NEEDED; 4692 } 4693 } 4694 tcp->tcp_rnxt += seg_len; 4695 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 4696 4697 if (mp == NULL) 4698 goto xmit_check; 4699 4700 /* Update SACK list */ 4701 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 4702 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 4703 &(tcp->tcp_num_sack_blk)); 4704 } 4705 4706 if (tcp->tcp_urp_mp) { 4707 tcp->tcp_urp_mp->b_cont = mp; 4708 mp = tcp->tcp_urp_mp; 4709 tcp->tcp_urp_mp = NULL; 4710 /* Ready for a new signal. */ 4711 tcp->tcp_urp_last_valid = B_FALSE; 4712 #ifdef DEBUG 4713 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4714 "tcp_rput: sending exdata_ind %s", 4715 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 4716 #endif /* DEBUG */ 4717 } 4718 4719 /* 4720 * Check for ancillary data changes compared to last segment. 4721 */ 4722 if (connp->conn_recv_ancillary.crb_all != 0) { 4723 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira); 4724 if (mp == NULL) 4725 return; 4726 } 4727 4728 if (IPCL_IS_NONSTR(connp)) { 4729 /* 4730 * Non-STREAMS socket 4731 */ 4732 boolean_t push = flags & (TH_PUSH|TH_FIN); 4733 int error; 4734 4735 if ((*sockupcalls->su_recv)(connp->conn_upper_handle, 4736 mp, seg_len, 0, &error, &push) <= 0) { 4737 /* 4738 * We should never be in middle of a 4739 * fallback, the squeue guarantees that. 4740 */ 4741 ASSERT(error != EOPNOTSUPP); 4742 if (error == ENOSPC) 4743 tcp->tcp_rwnd -= seg_len; 4744 } else if (push) { 4745 /* PUSH bit set and sockfs is not flow controlled */ 4746 flags |= tcp_rwnd_reopen(tcp); 4747 } 4748 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) { 4749 /* 4750 * Side queue inbound data until the accept happens. 4751 * tcp_accept/tcp_rput drains this when the accept happens. 4752 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 4753 * T_EXDATA_IND) it is queued on b_next. 4754 * XXX Make urgent data use this. Requires: 4755 * Removing tcp_listener check for TH_URG 4756 * Making M_PCPROTO and MARK messages skip the eager case 4757 */ 4758 4759 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 4760 } else { 4761 /* Active STREAMS socket */ 4762 if (mp->b_datap->db_type != M_DATA || 4763 (flags & TH_MARKNEXT_NEEDED)) { 4764 if (tcp->tcp_rcv_list != NULL) { 4765 flags |= tcp_rcv_drain(tcp); 4766 } 4767 ASSERT(tcp->tcp_rcv_list == NULL || 4768 tcp->tcp_fused_sigurg); 4769 4770 if (flags & TH_MARKNEXT_NEEDED) { 4771 #ifdef DEBUG 4772 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4773 "tcp_rput: sending MSGMARKNEXT %s", 4774 tcp_display(tcp, NULL, 4775 DISP_PORT_ONLY)); 4776 #endif /* DEBUG */ 4777 mp->b_flag |= MSGMARKNEXT; 4778 flags &= ~TH_MARKNEXT_NEEDED; 4779 } 4780 4781 if (is_system_labeled()) 4782 tcp_setcred_data(mp, ira); 4783 4784 putnext(connp->conn_rq, mp); 4785 if (!canputnext(connp->conn_rq)) 4786 tcp->tcp_rwnd -= seg_len; 4787 } else if ((flags & (TH_PUSH|TH_FIN)) || 4788 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) { 4789 if (tcp->tcp_rcv_list != NULL) { 4790 /* 4791 * Enqueue the new segment first and then 4792 * call tcp_rcv_drain() to send all data 4793 * up. The other way to do this is to 4794 * send all queued data up and then call 4795 * putnext() to send the new segment up. 4796 * This way can remove the else part later 4797 * on. 4798 * 4799 * We don't do this to avoid one more call to 4800 * canputnext() as tcp_rcv_drain() needs to 4801 * call canputnext(). 4802 */ 4803 tcp_rcv_enqueue(tcp, mp, seg_len, 4804 ira->ira_cred); 4805 flags |= tcp_rcv_drain(tcp); 4806 } else { 4807 if (is_system_labeled()) 4808 tcp_setcred_data(mp, ira); 4809 4810 putnext(connp->conn_rq, mp); 4811 if (!canputnext(connp->conn_rq)) 4812 tcp->tcp_rwnd -= seg_len; 4813 } 4814 } else { 4815 /* 4816 * Enqueue all packets when processing an mblk 4817 * from the co queue and also enqueue normal packets. 4818 */ 4819 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 4820 } 4821 /* 4822 * Make sure the timer is running if we have data waiting 4823 * for a push bit. This provides resiliency against 4824 * implementations that do not correctly generate push bits. 4825 */ 4826 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) { 4827 /* 4828 * The connection may be closed at this point, so don't 4829 * do anything for a detached tcp. 4830 */ 4831 if (!TCP_IS_DETACHED(tcp)) 4832 tcp->tcp_push_tid = TCP_TIMER(tcp, 4833 tcp_push_timer, 4834 tcps->tcps_push_timer_interval); 4835 } 4836 } 4837 4838 xmit_check: 4839 /* Is there anything left to do? */ 4840 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 4841 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 4842 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 4843 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 4844 goto done; 4845 4846 /* Any transmit work to do and a non-zero window? */ 4847 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 4848 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 4849 if (flags & TH_REXMIT_NEEDED) { 4850 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 4851 4852 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans); 4853 if (snd_size > mss) 4854 snd_size = mss; 4855 if (snd_size > tcp->tcp_swnd) 4856 snd_size = tcp->tcp_swnd; 4857 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 4858 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 4859 B_TRUE); 4860 4861 if (mp1 != NULL) { 4862 tcp->tcp_xmit_head->b_prev = 4863 (mblk_t *)LBOLT_FASTPATH; 4864 tcp->tcp_csuna = tcp->tcp_snxt; 4865 TCPS_BUMP_MIB(tcps, tcpRetransSegs); 4866 TCPS_UPDATE_MIB(tcps, tcpRetransBytes, 4867 snd_size); 4868 tcp_send_data(tcp, mp1); 4869 } 4870 } 4871 if (flags & TH_NEED_SACK_REXMIT) { 4872 tcp_sack_rexmit(tcp, &flags); 4873 } 4874 /* 4875 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 4876 * out new segment. Note that tcp_rexmit should not be 4877 * set, otherwise TH_LIMIT_XMIT should not be set. 4878 */ 4879 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 4880 if (!tcp->tcp_rexmit) { 4881 tcp_wput_data(tcp, NULL, B_FALSE); 4882 } else { 4883 tcp_ss_rexmit(tcp); 4884 } 4885 } 4886 /* 4887 * Adjust tcp_cwnd back to normal value after sending 4888 * new data segments. 4889 */ 4890 if (flags & TH_LIMIT_XMIT) { 4891 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 4892 /* 4893 * This will restart the timer. Restarting the 4894 * timer is used to avoid a timeout before the 4895 * limited transmitted segment's ACK gets back. 4896 */ 4897 if (tcp->tcp_xmit_head != NULL) 4898 tcp->tcp_xmit_head->b_prev = 4899 (mblk_t *)LBOLT_FASTPATH; 4900 } 4901 4902 /* Anything more to do? */ 4903 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 4904 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 4905 goto done; 4906 } 4907 ack_check: 4908 if (flags & TH_SEND_URP_MARK) { 4909 ASSERT(tcp->tcp_urp_mark_mp); 4910 ASSERT(!IPCL_IS_NONSTR(connp)); 4911 /* 4912 * Send up any queued data and then send the mark message 4913 */ 4914 if (tcp->tcp_rcv_list != NULL) { 4915 flags |= tcp_rcv_drain(tcp); 4916 4917 } 4918 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 4919 mp1 = tcp->tcp_urp_mark_mp; 4920 tcp->tcp_urp_mark_mp = NULL; 4921 if (is_system_labeled()) 4922 tcp_setcred_data(mp1, ira); 4923 4924 putnext(connp->conn_rq, mp1); 4925 #ifdef DEBUG 4926 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4927 "tcp_rput: sending zero-length %s %s", 4928 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 4929 "MSGNOTMARKNEXT"), 4930 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 4931 #endif /* DEBUG */ 4932 flags &= ~TH_SEND_URP_MARK; 4933 } 4934 if (flags & TH_ACK_NEEDED) { 4935 /* 4936 * Time to send an ack for some reason. 4937 */ 4938 mp1 = tcp_ack_mp(tcp); 4939 4940 if (mp1 != NULL) { 4941 tcp_send_data(tcp, mp1); 4942 BUMP_LOCAL(tcp->tcp_obsegs); 4943 TCPS_BUMP_MIB(tcps, tcpOutAck); 4944 } 4945 if (tcp->tcp_ack_tid != 0) { 4946 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 4947 tcp->tcp_ack_tid = 0; 4948 } 4949 } 4950 if (flags & TH_ACK_TIMER_NEEDED) { 4951 /* 4952 * Arrange for deferred ACK or push wait timeout. 4953 * Start timer if it is not already running. 4954 */ 4955 if (tcp->tcp_ack_tid == 0) { 4956 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 4957 tcp->tcp_localnet ? 4958 tcps->tcps_local_dack_interval : 4959 tcps->tcps_deferred_ack_interval); 4960 } 4961 } 4962 if (flags & TH_ORDREL_NEEDED) { 4963 /* 4964 * Notify upper layer about an orderly release. If this is 4965 * a non-STREAMS socket, then just make an upcall. For STREAMS 4966 * we send up an ordrel_ind, unless this is an eager, in which 4967 * case the ordrel will be sent when tcp_accept_finish runs. 4968 * Note that for non-STREAMS we make an upcall even if it is an 4969 * eager, because we have an upper handle to send it to. 4970 */ 4971 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL); 4972 ASSERT(!tcp->tcp_detached); 4973 4974 if (IPCL_IS_NONSTR(connp)) { 4975 ASSERT(tcp->tcp_ordrel_mp == NULL); 4976 tcp->tcp_ordrel_done = B_TRUE; 4977 (*sockupcalls->su_opctl)(connp->conn_upper_handle, 4978 SOCK_OPCTL_SHUT_RECV, 0); 4979 goto done; 4980 } 4981 4982 if (tcp->tcp_rcv_list != NULL) { 4983 /* 4984 * Push any mblk(s) enqueued from co processing. 4985 */ 4986 flags |= tcp_rcv_drain(tcp); 4987 } 4988 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 4989 4990 mp1 = tcp->tcp_ordrel_mp; 4991 tcp->tcp_ordrel_mp = NULL; 4992 tcp->tcp_ordrel_done = B_TRUE; 4993 putnext(connp->conn_rq, mp1); 4994 } 4995 done: 4996 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 4997 } 4998 4999 /* 5000 * Attach ancillary data to a received TCP segments for the 5001 * ancillary pieces requested by the application that are 5002 * different than they were in the previous data segment. 5003 * 5004 * Save the "current" values once memory allocation is ok so that 5005 * when memory allocation fails we can just wait for the next data segment. 5006 */ 5007 static mblk_t * 5008 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp, 5009 ip_recv_attr_t *ira) 5010 { 5011 struct T_optdata_ind *todi; 5012 int optlen; 5013 uchar_t *optptr; 5014 struct T_opthdr *toh; 5015 crb_t addflag; /* Which pieces to add */ 5016 mblk_t *mp1; 5017 conn_t *connp = tcp->tcp_connp; 5018 5019 optlen = 0; 5020 addflag.crb_all = 0; 5021 /* If app asked for pktinfo and the index has changed ... */ 5022 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo && 5023 ira->ira_ruifindex != tcp->tcp_recvifindex) { 5024 optlen += sizeof (struct T_opthdr) + 5025 sizeof (struct in6_pktinfo); 5026 addflag.crb_ip_recvpktinfo = 1; 5027 } 5028 /* If app asked for hoplimit and it has changed ... */ 5029 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit && 5030 ipp->ipp_hoplimit != tcp->tcp_recvhops) { 5031 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 5032 addflag.crb_ipv6_recvhoplimit = 1; 5033 } 5034 /* If app asked for tclass and it has changed ... */ 5035 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass && 5036 ipp->ipp_tclass != tcp->tcp_recvtclass) { 5037 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 5038 addflag.crb_ipv6_recvtclass = 1; 5039 } 5040 /* 5041 * If app asked for hopbyhop headers and it has changed ... 5042 * For security labels, note that (1) security labels can't change on 5043 * a connected socket at all, (2) we're connected to at most one peer, 5044 * (3) if anything changes, then it must be some other extra option. 5045 */ 5046 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts && 5047 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 5048 (ipp->ipp_fields & IPPF_HOPOPTS), 5049 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 5050 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen; 5051 addflag.crb_ipv6_recvhopopts = 1; 5052 if (!ip_allocbuf((void **)&tcp->tcp_hopopts, 5053 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), 5054 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 5055 return (mp); 5056 } 5057 /* If app asked for dst headers before routing headers ... */ 5058 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts && 5059 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen, 5060 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5061 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) { 5062 optlen += sizeof (struct T_opthdr) + 5063 ipp->ipp_rthdrdstoptslen; 5064 addflag.crb_ipv6_recvrthdrdstopts = 1; 5065 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts, 5066 &tcp->tcp_rthdrdstoptslen, 5067 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5068 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) 5069 return (mp); 5070 } 5071 /* If app asked for routing headers and it has changed ... */ 5072 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr && 5073 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 5074 (ipp->ipp_fields & IPPF_RTHDR), 5075 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 5076 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 5077 addflag.crb_ipv6_recvrthdr = 1; 5078 if (!ip_allocbuf((void **)&tcp->tcp_rthdr, 5079 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), 5080 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 5081 return (mp); 5082 } 5083 /* If app asked for dest headers and it has changed ... */ 5084 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts || 5085 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) && 5086 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 5087 (ipp->ipp_fields & IPPF_DSTOPTS), 5088 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 5089 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 5090 addflag.crb_ipv6_recvdstopts = 1; 5091 if (!ip_allocbuf((void **)&tcp->tcp_dstopts, 5092 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), 5093 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 5094 return (mp); 5095 } 5096 5097 if (optlen == 0) { 5098 /* Nothing to add */ 5099 return (mp); 5100 } 5101 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 5102 if (mp1 == NULL) { 5103 /* 5104 * Defer sending ancillary data until the next TCP segment 5105 * arrives. 5106 */ 5107 return (mp); 5108 } 5109 mp1->b_cont = mp; 5110 mp = mp1; 5111 mp->b_wptr += sizeof (*todi) + optlen; 5112 mp->b_datap->db_type = M_PROTO; 5113 todi = (struct T_optdata_ind *)mp->b_rptr; 5114 todi->PRIM_type = T_OPTDATA_IND; 5115 todi->DATA_flag = 1; /* MORE data */ 5116 todi->OPT_length = optlen; 5117 todi->OPT_offset = sizeof (*todi); 5118 optptr = (uchar_t *)&todi[1]; 5119 /* 5120 * If app asked for pktinfo and the index has changed ... 5121 * Note that the local address never changes for the connection. 5122 */ 5123 if (addflag.crb_ip_recvpktinfo) { 5124 struct in6_pktinfo *pkti; 5125 uint_t ifindex; 5126 5127 ifindex = ira->ira_ruifindex; 5128 toh = (struct T_opthdr *)optptr; 5129 toh->level = IPPROTO_IPV6; 5130 toh->name = IPV6_PKTINFO; 5131 toh->len = sizeof (*toh) + sizeof (*pkti); 5132 toh->status = 0; 5133 optptr += sizeof (*toh); 5134 pkti = (struct in6_pktinfo *)optptr; 5135 pkti->ipi6_addr = connp->conn_laddr_v6; 5136 pkti->ipi6_ifindex = ifindex; 5137 optptr += sizeof (*pkti); 5138 ASSERT(OK_32PTR(optptr)); 5139 /* Save as "last" value */ 5140 tcp->tcp_recvifindex = ifindex; 5141 } 5142 /* If app asked for hoplimit and it has changed ... */ 5143 if (addflag.crb_ipv6_recvhoplimit) { 5144 toh = (struct T_opthdr *)optptr; 5145 toh->level = IPPROTO_IPV6; 5146 toh->name = IPV6_HOPLIMIT; 5147 toh->len = sizeof (*toh) + sizeof (uint_t); 5148 toh->status = 0; 5149 optptr += sizeof (*toh); 5150 *(uint_t *)optptr = ipp->ipp_hoplimit; 5151 optptr += sizeof (uint_t); 5152 ASSERT(OK_32PTR(optptr)); 5153 /* Save as "last" value */ 5154 tcp->tcp_recvhops = ipp->ipp_hoplimit; 5155 } 5156 /* If app asked for tclass and it has changed ... */ 5157 if (addflag.crb_ipv6_recvtclass) { 5158 toh = (struct T_opthdr *)optptr; 5159 toh->level = IPPROTO_IPV6; 5160 toh->name = IPV6_TCLASS; 5161 toh->len = sizeof (*toh) + sizeof (uint_t); 5162 toh->status = 0; 5163 optptr += sizeof (*toh); 5164 *(uint_t *)optptr = ipp->ipp_tclass; 5165 optptr += sizeof (uint_t); 5166 ASSERT(OK_32PTR(optptr)); 5167 /* Save as "last" value */ 5168 tcp->tcp_recvtclass = ipp->ipp_tclass; 5169 } 5170 if (addflag.crb_ipv6_recvhopopts) { 5171 toh = (struct T_opthdr *)optptr; 5172 toh->level = IPPROTO_IPV6; 5173 toh->name = IPV6_HOPOPTS; 5174 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen; 5175 toh->status = 0; 5176 optptr += sizeof (*toh); 5177 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 5178 optptr += ipp->ipp_hopoptslen; 5179 ASSERT(OK_32PTR(optptr)); 5180 /* Save as last value */ 5181 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, 5182 (ipp->ipp_fields & IPPF_HOPOPTS), 5183 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 5184 } 5185 if (addflag.crb_ipv6_recvrthdrdstopts) { 5186 toh = (struct T_opthdr *)optptr; 5187 toh->level = IPPROTO_IPV6; 5188 toh->name = IPV6_RTHDRDSTOPTS; 5189 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen; 5190 toh->status = 0; 5191 optptr += sizeof (*toh); 5192 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen); 5193 optptr += ipp->ipp_rthdrdstoptslen; 5194 ASSERT(OK_32PTR(optptr)); 5195 /* Save as last value */ 5196 ip_savebuf((void **)&tcp->tcp_rthdrdstopts, 5197 &tcp->tcp_rthdrdstoptslen, 5198 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5199 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen); 5200 } 5201 if (addflag.crb_ipv6_recvrthdr) { 5202 toh = (struct T_opthdr *)optptr; 5203 toh->level = IPPROTO_IPV6; 5204 toh->name = IPV6_RTHDR; 5205 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 5206 toh->status = 0; 5207 optptr += sizeof (*toh); 5208 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 5209 optptr += ipp->ipp_rthdrlen; 5210 ASSERT(OK_32PTR(optptr)); 5211 /* Save as last value */ 5212 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, 5213 (ipp->ipp_fields & IPPF_RTHDR), 5214 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 5215 } 5216 if (addflag.crb_ipv6_recvdstopts) { 5217 toh = (struct T_opthdr *)optptr; 5218 toh->level = IPPROTO_IPV6; 5219 toh->name = IPV6_DSTOPTS; 5220 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 5221 toh->status = 0; 5222 optptr += sizeof (*toh); 5223 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 5224 optptr += ipp->ipp_dstoptslen; 5225 ASSERT(OK_32PTR(optptr)); 5226 /* Save as last value */ 5227 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, 5228 (ipp->ipp_fields & IPPF_DSTOPTS), 5229 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 5230 } 5231 ASSERT(optptr == mp->b_wptr); 5232 return (mp); 5233 } 5234 5235 /* The minimum of smoothed mean deviation in RTO calculation. */ 5236 #define TCP_SD_MIN 400 5237 5238 /* 5239 * Set RTO for this connection. The formula is from Jacobson and Karels' 5240 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names 5241 * are the same as those in Appendix A.2 of that paper. 5242 * 5243 * m = new measurement 5244 * sa = smoothed RTT average (8 * average estimates). 5245 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 5246 */ 5247 static void 5248 tcp_set_rto(tcp_t *tcp, clock_t rtt) 5249 { 5250 long m = TICK_TO_MSEC(rtt); 5251 clock_t sa = tcp->tcp_rtt_sa; 5252 clock_t sv = tcp->tcp_rtt_sd; 5253 clock_t rto; 5254 tcp_stack_t *tcps = tcp->tcp_tcps; 5255 5256 TCPS_BUMP_MIB(tcps, tcpRttUpdate); 5257 tcp->tcp_rtt_update++; 5258 5259 /* tcp_rtt_sa is not 0 means this is a new sample. */ 5260 if (sa != 0) { 5261 /* 5262 * Update average estimator: 5263 * new rtt = 7/8 old rtt + 1/8 Error 5264 */ 5265 5266 /* m is now Error in estimate. */ 5267 m -= sa >> 3; 5268 if ((sa += m) <= 0) { 5269 /* 5270 * Don't allow the smoothed average to be negative. 5271 * We use 0 to denote reinitialization of the 5272 * variables. 5273 */ 5274 sa = 1; 5275 } 5276 5277 /* 5278 * Update deviation estimator: 5279 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) 5280 */ 5281 if (m < 0) 5282 m = -m; 5283 m -= sv >> 2; 5284 sv += m; 5285 } else { 5286 /* 5287 * This follows BSD's implementation. So the reinitialized 5288 * RTO is 3 * m. We cannot go less than 2 because if the 5289 * link is bandwidth dominated, doubling the window size 5290 * during slow start means doubling the RTT. We want to be 5291 * more conservative when we reinitialize our estimates. 3 5292 * is just a convenient number. 5293 */ 5294 sa = m << 3; 5295 sv = m << 1; 5296 } 5297 if (sv < TCP_SD_MIN) { 5298 /* 5299 * We do not know that if sa captures the delay ACK 5300 * effect as in a long train of segments, a receiver 5301 * does not delay its ACKs. So set the minimum of sv 5302 * to be TCP_SD_MIN, which is default to 400 ms, twice 5303 * of BSD DATO. That means the minimum of mean 5304 * deviation is 100 ms. 5305 * 5306 */ 5307 sv = TCP_SD_MIN; 5308 } 5309 tcp->tcp_rtt_sa = sa; 5310 tcp->tcp_rtt_sd = sv; 5311 /* 5312 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) 5313 * 5314 * Add tcp_rexmit_interval extra in case of extreme environment 5315 * where the algorithm fails to work. The default value of 5316 * tcp_rexmit_interval_extra should be 0. 5317 * 5318 * As we use a finer grained clock than BSD and update 5319 * RTO for every ACKs, add in another .25 of RTT to the 5320 * deviation of RTO to accomodate burstiness of 1/4 of 5321 * window size. 5322 */ 5323 rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5); 5324 5325 TCP_SET_RTO(tcp, rto); 5326 5327 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 5328 tcp->tcp_timer_backoff = 0; 5329 } 5330 5331 /* 5332 * On a labeled system we have some protocols above TCP, such as RPC, which 5333 * appear to assume that every mblk in a chain has a db_credp. 5334 */ 5335 static void 5336 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira) 5337 { 5338 ASSERT(is_system_labeled()); 5339 ASSERT(ira->ira_cred != NULL); 5340 5341 while (mp != NULL) { 5342 mblk_setcred(mp, ira->ira_cred, NOPID); 5343 mp = mp->b_cont; 5344 } 5345 } 5346 5347 uint_t 5348 tcp_rwnd_reopen(tcp_t *tcp) 5349 { 5350 uint_t ret = 0; 5351 uint_t thwin; 5352 conn_t *connp = tcp->tcp_connp; 5353 5354 /* Learn the latest rwnd information that we sent to the other side. */ 5355 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win)) 5356 << tcp->tcp_rcv_ws; 5357 /* This is peer's calculated send window (our receive window). */ 5358 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 5359 /* 5360 * Increase the receive window to max. But we need to do receiver 5361 * SWS avoidance. This means that we need to check the increase of 5362 * of receive window is at least 1 MSS. 5363 */ 5364 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) { 5365 /* 5366 * If the window that the other side knows is less than max 5367 * deferred acks segments, send an update immediately. 5368 */ 5369 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 5370 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate); 5371 ret = TH_ACK_NEEDED; 5372 } 5373 tcp->tcp_rwnd = connp->conn_rcvbuf; 5374 } 5375 return (ret); 5376 } 5377 5378 /* 5379 * Handle a packet that has been reclassified by TCP. 5380 * This function drops the ref on connp that the caller had. 5381 */ 5382 void 5383 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst) 5384 { 5385 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 5386 5387 if (connp->conn_incoming_ifindex != 0 && 5388 connp->conn_incoming_ifindex != ira->ira_ruifindex) { 5389 freemsg(mp); 5390 CONN_DEC_REF(connp); 5391 return; 5392 } 5393 5394 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || 5395 (ira->ira_flags & IRAF_IPSEC_SECURE)) { 5396 ip6_t *ip6h; 5397 ipha_t *ipha; 5398 5399 if (ira->ira_flags & IRAF_IS_IPV4) { 5400 ipha = (ipha_t *)mp->b_rptr; 5401 ip6h = NULL; 5402 } else { 5403 ipha = NULL; 5404 ip6h = (ip6_t *)mp->b_rptr; 5405 } 5406 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira); 5407 if (mp == NULL) { 5408 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); 5409 /* Note that mp is NULL */ 5410 ip_drop_input("ipIfStatsInDiscards", mp, NULL); 5411 CONN_DEC_REF(connp); 5412 return; 5413 } 5414 } 5415 5416 if (IPCL_IS_TCP(connp)) { 5417 /* 5418 * do not drain, certain use cases can blow 5419 * the stack 5420 */ 5421 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 5422 connp->conn_recv, connp, ira, 5423 SQ_NODRAIN, SQTAG_IP_TCP_INPUT); 5424 } else { 5425 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */ 5426 (connp->conn_recv)(connp, mp, NULL, 5427 ira); 5428 CONN_DEC_REF(connp); 5429 } 5430 5431 } 5432 5433 /* ARGSUSED */ 5434 static void 5435 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 5436 { 5437 conn_t *connp = (conn_t *)arg; 5438 tcp_t *tcp = connp->conn_tcp; 5439 queue_t *q = connp->conn_rq; 5440 5441 ASSERT(!IPCL_IS_NONSTR(connp)); 5442 mutex_enter(&tcp->tcp_rsrv_mp_lock); 5443 tcp->tcp_rsrv_mp = mp; 5444 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5445 5446 if (TCP_IS_DETACHED(tcp) || q == NULL) { 5447 return; 5448 } 5449 5450 if (tcp->tcp_fused) { 5451 tcp_fuse_backenable(tcp); 5452 return; 5453 } 5454 5455 if (canputnext(q)) { 5456 /* Not flow-controlled, open rwnd */ 5457 tcp->tcp_rwnd = connp->conn_rcvbuf; 5458 5459 /* 5460 * Send back a window update immediately if TCP is above 5461 * ESTABLISHED state and the increase of the rcv window 5462 * that the other side knows is at least 1 MSS after flow 5463 * control is lifted. 5464 */ 5465 if (tcp->tcp_state >= TCPS_ESTABLISHED && 5466 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 5467 tcp_xmit_ctl(NULL, tcp, 5468 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 5469 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 5470 } 5471 } 5472 } 5473 5474 /* 5475 * The read side service routine is called mostly when we get back-enabled as a 5476 * result of flow control relief. Since we don't actually queue anything in 5477 * TCP, we have no data to send out of here. What we do is clear the receive 5478 * window, and send out a window update. 5479 */ 5480 void 5481 tcp_rsrv(queue_t *q) 5482 { 5483 conn_t *connp = Q_TO_CONN(q); 5484 tcp_t *tcp = connp->conn_tcp; 5485 mblk_t *mp; 5486 5487 /* No code does a putq on the read side */ 5488 ASSERT(q->q_first == NULL); 5489 5490 /* 5491 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already 5492 * been run. So just return. 5493 */ 5494 mutex_enter(&tcp->tcp_rsrv_mp_lock); 5495 if ((mp = tcp->tcp_rsrv_mp) == NULL) { 5496 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5497 return; 5498 } 5499 tcp->tcp_rsrv_mp = NULL; 5500 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5501 5502 CONN_INC_REF(connp); 5503 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp, 5504 NULL, SQ_PROCESS, SQTAG_TCP_RSRV); 5505 } 5506 5507 /* At minimum we need 8 bytes in the TCP header for the lookup */ 5508 #define ICMP_MIN_TCP_HDR 8 5509 5510 /* 5511 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages 5512 * passed up by IP. The message is always received on the correct tcp_t. 5513 * Assumes that IP has pulled up everything up to and including the ICMP header. 5514 */ 5515 /* ARGSUSED2 */ 5516 void 5517 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 5518 { 5519 conn_t *connp = (conn_t *)arg1; 5520 icmph_t *icmph; 5521 ipha_t *ipha; 5522 int iph_hdr_length; 5523 tcpha_t *tcpha; 5524 uint32_t seg_seq; 5525 tcp_t *tcp = connp->conn_tcp; 5526 5527 /* Assume IP provides aligned packets */ 5528 ASSERT(OK_32PTR(mp->b_rptr)); 5529 ASSERT((MBLKL(mp) >= sizeof (ipha_t))); 5530 5531 /* 5532 * It's possible we have a closed, but not yet destroyed, TCP 5533 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid 5534 * in the closed state, so don't take any chances and drop the packet. 5535 */ 5536 if (tcp->tcp_state == TCPS_CLOSED) { 5537 freemsg(mp); 5538 return; 5539 } 5540 5541 /* 5542 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 5543 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 5544 */ 5545 if (!(ira->ira_flags & IRAF_IS_IPV4)) { 5546 tcp_icmp_error_ipv6(tcp, mp, ira); 5547 return; 5548 } 5549 5550 /* Skip past the outer IP and ICMP headers */ 5551 iph_hdr_length = ira->ira_ip_hdr_length; 5552 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 5553 /* 5554 * If we don't have the correct outer IP header length 5555 * or if we don't have a complete inner IP header 5556 * drop it. 5557 */ 5558 if (iph_hdr_length < sizeof (ipha_t) || 5559 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 5560 noticmpv4: 5561 freemsg(mp); 5562 return; 5563 } 5564 ipha = (ipha_t *)&icmph[1]; 5565 5566 /* Skip past the inner IP and find the ULP header */ 5567 iph_hdr_length = IPH_HDR_LENGTH(ipha); 5568 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length); 5569 /* 5570 * If we don't have the correct inner IP header length or if the ULP 5571 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 5572 * bytes of TCP header, drop it. 5573 */ 5574 if (iph_hdr_length < sizeof (ipha_t) || 5575 ipha->ipha_protocol != IPPROTO_TCP || 5576 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) { 5577 goto noticmpv4; 5578 } 5579 5580 seg_seq = ntohl(tcpha->tha_seq); 5581 switch (icmph->icmph_type) { 5582 case ICMP_DEST_UNREACHABLE: 5583 switch (icmph->icmph_code) { 5584 case ICMP_FRAGMENTATION_NEEDED: 5585 /* 5586 * Update Path MTU, then try to send something out. 5587 */ 5588 tcp_update_pmtu(tcp, B_TRUE); 5589 tcp_rexmit_after_error(tcp); 5590 break; 5591 case ICMP_PORT_UNREACHABLE: 5592 case ICMP_PROTOCOL_UNREACHABLE: 5593 switch (tcp->tcp_state) { 5594 case TCPS_SYN_SENT: 5595 case TCPS_SYN_RCVD: 5596 /* 5597 * ICMP can snipe away incipient 5598 * TCP connections as long as 5599 * seq number is same as initial 5600 * send seq number. 5601 */ 5602 if (seg_seq == tcp->tcp_iss) { 5603 (void) tcp_clean_death(tcp, 5604 ECONNREFUSED); 5605 } 5606 break; 5607 } 5608 break; 5609 case ICMP_HOST_UNREACHABLE: 5610 case ICMP_NET_UNREACHABLE: 5611 /* Record the error in case we finally time out. */ 5612 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 5613 tcp->tcp_client_errno = EHOSTUNREACH; 5614 else 5615 tcp->tcp_client_errno = ENETUNREACH; 5616 if (tcp->tcp_state == TCPS_SYN_RCVD) { 5617 if (tcp->tcp_listener != NULL && 5618 tcp->tcp_listener->tcp_syn_defense) { 5619 /* 5620 * Ditch the half-open connection if we 5621 * suspect a SYN attack is under way. 5622 */ 5623 (void) tcp_clean_death(tcp, 5624 tcp->tcp_client_errno); 5625 } 5626 } 5627 break; 5628 default: 5629 break; 5630 } 5631 break; 5632 case ICMP_SOURCE_QUENCH: { 5633 /* 5634 * use a global boolean to control 5635 * whether TCP should respond to ICMP_SOURCE_QUENCH. 5636 * The default is false. 5637 */ 5638 if (tcp_icmp_source_quench) { 5639 /* 5640 * Reduce the sending rate as if we got a 5641 * retransmit timeout 5642 */ 5643 uint32_t npkt; 5644 5645 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 5646 tcp->tcp_mss; 5647 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 5648 tcp->tcp_cwnd = tcp->tcp_mss; 5649 tcp->tcp_cwnd_cnt = 0; 5650 } 5651 break; 5652 } 5653 } 5654 freemsg(mp); 5655 } 5656 5657 /* 5658 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6 5659 * error messages passed up by IP. 5660 * Assumes that IP has pulled up all the extension headers as well 5661 * as the ICMPv6 header. 5662 */ 5663 static void 5664 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira) 5665 { 5666 icmp6_t *icmp6; 5667 ip6_t *ip6h; 5668 uint16_t iph_hdr_length = ira->ira_ip_hdr_length; 5669 tcpha_t *tcpha; 5670 uint8_t *nexthdrp; 5671 uint32_t seg_seq; 5672 5673 /* 5674 * Verify that we have a complete IP header. 5675 */ 5676 ASSERT((MBLKL(mp) >= sizeof (ip6_t))); 5677 5678 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 5679 ip6h = (ip6_t *)&icmp6[1]; 5680 /* 5681 * Verify if we have a complete ICMP and inner IP header. 5682 */ 5683 if ((uchar_t *)&ip6h[1] > mp->b_wptr) { 5684 noticmpv6: 5685 freemsg(mp); 5686 return; 5687 } 5688 5689 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 5690 goto noticmpv6; 5691 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 5692 /* 5693 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 5694 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 5695 * packet. 5696 */ 5697 if ((*nexthdrp != IPPROTO_TCP) || 5698 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 5699 goto noticmpv6; 5700 } 5701 5702 seg_seq = ntohl(tcpha->tha_seq); 5703 switch (icmp6->icmp6_type) { 5704 case ICMP6_PACKET_TOO_BIG: 5705 /* 5706 * Update Path MTU, then try to send something out. 5707 */ 5708 tcp_update_pmtu(tcp, B_TRUE); 5709 tcp_rexmit_after_error(tcp); 5710 break; 5711 case ICMP6_DST_UNREACH: 5712 switch (icmp6->icmp6_code) { 5713 case ICMP6_DST_UNREACH_NOPORT: 5714 if (((tcp->tcp_state == TCPS_SYN_SENT) || 5715 (tcp->tcp_state == TCPS_SYN_RCVD)) && 5716 (seg_seq == tcp->tcp_iss)) { 5717 (void) tcp_clean_death(tcp, ECONNREFUSED); 5718 } 5719 break; 5720 case ICMP6_DST_UNREACH_ADMIN: 5721 case ICMP6_DST_UNREACH_NOROUTE: 5722 case ICMP6_DST_UNREACH_BEYONDSCOPE: 5723 case ICMP6_DST_UNREACH_ADDR: 5724 /* Record the error in case we finally time out. */ 5725 tcp->tcp_client_errno = EHOSTUNREACH; 5726 if (((tcp->tcp_state == TCPS_SYN_SENT) || 5727 (tcp->tcp_state == TCPS_SYN_RCVD)) && 5728 (seg_seq == tcp->tcp_iss)) { 5729 if (tcp->tcp_listener != NULL && 5730 tcp->tcp_listener->tcp_syn_defense) { 5731 /* 5732 * Ditch the half-open connection if we 5733 * suspect a SYN attack is under way. 5734 */ 5735 (void) tcp_clean_death(tcp, 5736 tcp->tcp_client_errno); 5737 } 5738 } 5739 5740 5741 break; 5742 default: 5743 break; 5744 } 5745 break; 5746 case ICMP6_PARAM_PROB: 5747 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 5748 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 5749 (uchar_t *)ip6h + icmp6->icmp6_pptr == 5750 (uchar_t *)nexthdrp) { 5751 if (tcp->tcp_state == TCPS_SYN_SENT || 5752 tcp->tcp_state == TCPS_SYN_RCVD) { 5753 (void) tcp_clean_death(tcp, ECONNREFUSED); 5754 } 5755 break; 5756 } 5757 break; 5758 5759 case ICMP6_TIME_EXCEEDED: 5760 default: 5761 break; 5762 } 5763 freemsg(mp); 5764 } 5765 5766 /* 5767 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might 5768 * change. But it can refer to fields like tcp_suna and tcp_snxt. 5769 * 5770 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP 5771 * error messages received by IP. The message is always received on the correct 5772 * tcp_t. 5773 */ 5774 /* ARGSUSED */ 5775 boolean_t 5776 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6, 5777 ip_recv_attr_t *ira) 5778 { 5779 tcpha_t *tcpha = (tcpha_t *)arg2; 5780 uint32_t seq = ntohl(tcpha->tha_seq); 5781 tcp_t *tcp = connp->conn_tcp; 5782 5783 /* 5784 * TCP sequence number contained in payload of the ICMP error message 5785 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise, 5786 * the message is either a stale ICMP error, or an attack from the 5787 * network. Fail the verification. 5788 */ 5789 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 5790 return (B_FALSE); 5791 5792 /* For "too big" we also check the ignore flag */ 5793 if (ira->ira_flags & IRAF_IS_IPV4) { 5794 ASSERT(icmph != NULL); 5795 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE && 5796 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED && 5797 tcp->tcp_tcps->tcps_ignore_path_mtu) 5798 return (B_FALSE); 5799 } else { 5800 ASSERT(icmp6 != NULL); 5801 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG && 5802 tcp->tcp_tcps->tcps_ignore_path_mtu) 5803 return (B_FALSE); 5804 } 5805 return (B_TRUE); 5806 } 5807