1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright 2006 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #pragma ident "%Z%%M% %I% %E% SMI" 29 const char tcp_version[] = "%Z%%M% %I% %E% SMI"; 30 31 32 #include <sys/types.h> 33 #include <sys/stream.h> 34 #include <sys/strsun.h> 35 #include <sys/strsubr.h> 36 #include <sys/stropts.h> 37 #include <sys/strlog.h> 38 #include <sys/strsun.h> 39 #define _SUN_TPI_VERSION 2 40 #include <sys/tihdr.h> 41 #include <sys/timod.h> 42 #include <sys/ddi.h> 43 #include <sys/sunddi.h> 44 #include <sys/suntpi.h> 45 #include <sys/xti_inet.h> 46 #include <sys/cmn_err.h> 47 #include <sys/debug.h> 48 #include <sys/vtrace.h> 49 #include <sys/kmem.h> 50 #include <sys/ethernet.h> 51 #include <sys/cpuvar.h> 52 #include <sys/dlpi.h> 53 #include <sys/multidata.h> 54 #include <sys/multidata_impl.h> 55 #include <sys/pattr.h> 56 #include <sys/policy.h> 57 #include <sys/priv.h> 58 #include <sys/zone.h> 59 60 #include <sys/errno.h> 61 #include <sys/signal.h> 62 #include <sys/socket.h> 63 #include <sys/sockio.h> 64 #include <sys/isa_defs.h> 65 #include <sys/md5.h> 66 #include <sys/random.h> 67 #include <netinet/in.h> 68 #include <netinet/tcp.h> 69 #include <netinet/ip6.h> 70 #include <netinet/icmp6.h> 71 #include <net/if.h> 72 #include <net/route.h> 73 #include <inet/ipsec_impl.h> 74 75 #include <inet/common.h> 76 #include <inet/ip.h> 77 #include <inet/ip_impl.h> 78 #include <inet/ip6.h> 79 #include <inet/ip_ndp.h> 80 #include <inet/mi.h> 81 #include <inet/mib2.h> 82 #include <inet/nd.h> 83 #include <inet/optcom.h> 84 #include <inet/snmpcom.h> 85 #include <inet/kstatcom.h> 86 #include <inet/tcp.h> 87 #include <inet/tcp_impl.h> 88 #include <net/pfkeyv2.h> 89 #include <inet/ipsec_info.h> 90 #include <inet/ipdrop.h> 91 #include <inet/tcp_trace.h> 92 93 #include <inet/ipclassifier.h> 94 #include <inet/ip_ire.h> 95 #include <inet/ip_ftable.h> 96 #include <inet/ip_if.h> 97 #include <inet/ipp_common.h> 98 #include <sys/squeue.h> 99 #include <inet/kssl/ksslapi.h> 100 #include <sys/tsol/label.h> 101 #include <sys/tsol/tnet.h> 102 #include <sys/sdt.h> 103 #include <rpc/pmap_prot.h> 104 105 /* 106 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 107 * 108 * (Read the detailed design doc in PSARC case directory) 109 * 110 * The entire tcp state is contained in tcp_t and conn_t structure 111 * which are allocated in tandem using ipcl_conn_create() and passing 112 * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect 113 * the references on the tcp_t. The tcp_t structure is never compressed 114 * and packets always land on the correct TCP perimeter from the time 115 * eager is created till the time tcp_t dies (as such the old mentat 116 * TCP global queue is not used for detached state and no IPSEC checking 117 * is required). The global queue is still allocated to send out resets 118 * for connection which have no listeners and IP directly calls 119 * tcp_xmit_listeners_reset() which does any policy check. 120 * 121 * Protection and Synchronisation mechanism: 122 * 123 * The tcp data structure does not use any kind of lock for protecting 124 * its state but instead uses 'squeues' for mutual exclusion from various 125 * read and write side threads. To access a tcp member, the thread should 126 * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or 127 * squeue_fill). Since the squeues allow a direct function call, caller 128 * can pass any tcp function having prototype of edesc_t as argument 129 * (different from traditional STREAMs model where packets come in only 130 * designated entry points). The list of functions that can be directly 131 * called via squeue are listed before the usual function prototype. 132 * 133 * Referencing: 134 * 135 * TCP is MT-Hot and we use a reference based scheme to make sure that the 136 * tcp structure doesn't disappear when its needed. When the application 137 * creates an outgoing connection or accepts an incoming connection, we 138 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 139 * The IP reference is just a symbolic reference since ip_tcpclose() 140 * looks at tcp structure after tcp_close_output() returns which could 141 * have dropped the last TCP reference. So as long as the connection is 142 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 143 * conn_t. The classifier puts its own reference when the connection is 144 * inserted in listen or connected hash. Anytime a thread needs to enter 145 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 146 * on write side or by doing a classify on read side and then puts a 147 * reference on the conn before doing squeue_enter/tryenter/fill. For 148 * read side, the classifier itself puts the reference under fanout lock 149 * to make sure that tcp can't disappear before it gets processed. The 150 * squeue will drop this reference automatically so the called function 151 * doesn't have to do a DEC_REF. 152 * 153 * Opening a new connection: 154 * 155 * The outgoing connection open is pretty simple. ip_tcpopen() does the 156 * work in creating the conn/tcp structure and initializing it. The 157 * squeue assignment is done based on the CPU the application 158 * is running on. So for outbound connections, processing is always done 159 * on application CPU which might be different from the incoming CPU 160 * being interrupted by the NIC. An optimal way would be to figure out 161 * the NIC <-> CPU binding at listen time, and assign the outgoing 162 * connection to the squeue attached to the CPU that will be interrupted 163 * for incoming packets (we know the NIC based on the bind IP address). 164 * This might seem like a problem if more data is going out but the 165 * fact is that in most cases the transmit is ACK driven transmit where 166 * the outgoing data normally sits on TCP's xmit queue waiting to be 167 * transmitted. 168 * 169 * Accepting a connection: 170 * 171 * This is a more interesting case because of various races involved in 172 * establishing a eager in its own perimeter. Read the meta comment on 173 * top of tcp_conn_request(). But briefly, the squeue is picked by 174 * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU. 175 * 176 * Closing a connection: 177 * 178 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 179 * via squeue to do the close and mark the tcp as detached if the connection 180 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 181 * reference but tcp_close() drop IP's reference always. So if tcp was 182 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 183 * and 1 because it is in classifier's connected hash. This is the condition 184 * we use to determine that its OK to clean up the tcp outside of squeue 185 * when time wait expires (check the ref under fanout and conn_lock and 186 * if it is 2, remove it from fanout hash and kill it). 187 * 188 * Although close just drops the necessary references and marks the 189 * tcp_detached state, tcp_close needs to know the tcp_detached has been 190 * set (under squeue) before letting the STREAM go away (because a 191 * inbound packet might attempt to go up the STREAM while the close 192 * has happened and tcp_detached is not set). So a special lock and 193 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 194 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 195 * tcp_detached. 196 * 197 * Special provisions and fast paths: 198 * 199 * We make special provision for (AF_INET, SOCK_STREAM) sockets which 200 * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP 201 * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles 202 * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY 203 * check to send packets directly to tcp_rput_data via squeue. Everyone 204 * else comes through tcp_input() on the read side. 205 * 206 * We also make special provisions for sockfs by marking tcp_issocket 207 * whenever we have only sockfs on top of TCP. This allows us to skip 208 * putting the tcp in acceptor hash since a sockfs listener can never 209 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 210 * since eager has already been allocated and the accept now happens 211 * on acceptor STREAM. There is a big blob of comment on top of 212 * tcp_conn_request explaining the new accept. When socket is POP'd, 213 * sockfs sends us an ioctl to mark the fact and we go back to old 214 * behaviour. Once tcp_issocket is unset, its never set for the 215 * life of that connection. 216 * 217 * IPsec notes : 218 * 219 * Since a packet is always executed on the correct TCP perimeter 220 * all IPsec processing is defered to IP including checking new 221 * connections and setting IPSEC policies for new connection. The 222 * only exception is tcp_xmit_listeners_reset() which is called 223 * directly from IP and needs to policy check to see if TH_RST 224 * can be sent out. 225 */ 226 227 extern major_t TCP6_MAJ; 228 229 /* 230 * Values for squeue switch: 231 * 1: squeue_enter_nodrain 232 * 2: squeue_enter 233 * 3: squeue_fill 234 */ 235 int tcp_squeue_close = 2; 236 int tcp_squeue_wput = 2; 237 238 squeue_func_t tcp_squeue_close_proc; 239 squeue_func_t tcp_squeue_wput_proc; 240 241 /* 242 * This controls how tiny a write must be before we try to copy it 243 * into the the mblk on the tail of the transmit queue. Not much 244 * speedup is observed for values larger than sixteen. Zero will 245 * disable the optimisation. 246 */ 247 int tcp_tx_pull_len = 16; 248 249 /* 250 * TCP Statistics. 251 * 252 * How TCP statistics work. 253 * 254 * There are two types of statistics invoked by two macros. 255 * 256 * TCP_STAT(name) does non-atomic increment of a named stat counter. It is 257 * supposed to be used in non MT-hot paths of the code. 258 * 259 * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is 260 * supposed to be used for DEBUG purposes and may be used on a hot path. 261 * 262 * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat 263 * (use "kstat tcp" to get them). 264 * 265 * There is also additional debugging facility that marks tcp_clean_death() 266 * instances and saves them in tcp_t structure. It is triggered by 267 * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for 268 * tcp_clean_death() calls that counts the number of times each tag was hit. It 269 * is triggered by TCP_CLD_COUNTERS define. 270 * 271 * How to add new counters. 272 * 273 * 1) Add a field in the tcp_stat structure describing your counter. 274 * 2) Add a line in tcp_statistics with the name of the counter. 275 * 276 * IMPORTANT!! - make sure that both are in sync !! 277 * 3) Use either TCP_STAT or TCP_DBGSTAT with the name. 278 * 279 * Please avoid using private counters which are not kstat-exported. 280 * 281 * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances 282 * in tcp_t structure. 283 * 284 * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags. 285 */ 286 287 #ifndef TCP_DEBUG_COUNTER 288 #ifdef DEBUG 289 #define TCP_DEBUG_COUNTER 1 290 #else 291 #define TCP_DEBUG_COUNTER 0 292 #endif 293 #endif 294 295 #define TCP_CLD_COUNTERS 0 296 297 #define TCP_TAG_CLEAN_DEATH 1 298 #define TCP_MAX_CLEAN_DEATH_TAG 32 299 300 #ifdef lint 301 static int _lint_dummy_; 302 #endif 303 304 #if TCP_CLD_COUNTERS 305 static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG]; 306 #define TCP_CLD_STAT(x) tcp_clean_death_stat[x]++ 307 #elif defined(lint) 308 #define TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0); 309 #else 310 #define TCP_CLD_STAT(x) 311 #endif 312 313 #if TCP_DEBUG_COUNTER 314 #define TCP_DBGSTAT(x) atomic_add_64(&(tcp_statistics.x.value.ui64), 1) 315 #elif defined(lint) 316 #define TCP_DBGSTAT(x) ASSERT(_lint_dummy_ == 0); 317 #else 318 #define TCP_DBGSTAT(x) 319 #endif 320 321 tcp_stat_t tcp_statistics = { 322 { "tcp_time_wait", KSTAT_DATA_UINT64 }, 323 { "tcp_time_wait_syn", KSTAT_DATA_UINT64 }, 324 { "tcp_time_wait_success", KSTAT_DATA_UINT64 }, 325 { "tcp_time_wait_fail", KSTAT_DATA_UINT64 }, 326 { "tcp_reinput_syn", KSTAT_DATA_UINT64 }, 327 { "tcp_ip_output", KSTAT_DATA_UINT64 }, 328 { "tcp_detach_non_time_wait", KSTAT_DATA_UINT64 }, 329 { "tcp_detach_time_wait", KSTAT_DATA_UINT64 }, 330 { "tcp_time_wait_reap", KSTAT_DATA_UINT64 }, 331 { "tcp_clean_death_nondetached", KSTAT_DATA_UINT64 }, 332 { "tcp_reinit_calls", KSTAT_DATA_UINT64 }, 333 { "tcp_eager_err1", KSTAT_DATA_UINT64 }, 334 { "tcp_eager_err2", KSTAT_DATA_UINT64 }, 335 { "tcp_eager_blowoff_calls", KSTAT_DATA_UINT64 }, 336 { "tcp_eager_blowoff_q", KSTAT_DATA_UINT64 }, 337 { "tcp_eager_blowoff_q0", KSTAT_DATA_UINT64 }, 338 { "tcp_not_hard_bound", KSTAT_DATA_UINT64 }, 339 { "tcp_no_listener", KSTAT_DATA_UINT64 }, 340 { "tcp_found_eager", KSTAT_DATA_UINT64 }, 341 { "tcp_wrong_queue", KSTAT_DATA_UINT64 }, 342 { "tcp_found_eager_binding1", KSTAT_DATA_UINT64 }, 343 { "tcp_found_eager_bound1", KSTAT_DATA_UINT64 }, 344 { "tcp_eager_has_listener1", KSTAT_DATA_UINT64 }, 345 { "tcp_open_alloc", KSTAT_DATA_UINT64 }, 346 { "tcp_open_detached_alloc", KSTAT_DATA_UINT64 }, 347 { "tcp_rput_time_wait", KSTAT_DATA_UINT64 }, 348 { "tcp_listendrop", KSTAT_DATA_UINT64 }, 349 { "tcp_listendropq0", KSTAT_DATA_UINT64 }, 350 { "tcp_wrong_rq", KSTAT_DATA_UINT64 }, 351 { "tcp_rsrv_calls", KSTAT_DATA_UINT64 }, 352 { "tcp_eagerfree2", KSTAT_DATA_UINT64 }, 353 { "tcp_eagerfree3", KSTAT_DATA_UINT64 }, 354 { "tcp_eagerfree4", KSTAT_DATA_UINT64 }, 355 { "tcp_eagerfree5", KSTAT_DATA_UINT64 }, 356 { "tcp_timewait_syn_fail", KSTAT_DATA_UINT64 }, 357 { "tcp_listen_badflags", KSTAT_DATA_UINT64 }, 358 { "tcp_timeout_calls", KSTAT_DATA_UINT64 }, 359 { "tcp_timeout_cached_alloc", KSTAT_DATA_UINT64 }, 360 { "tcp_timeout_cancel_reqs", KSTAT_DATA_UINT64 }, 361 { "tcp_timeout_canceled", KSTAT_DATA_UINT64 }, 362 { "tcp_timermp_alloced", KSTAT_DATA_UINT64 }, 363 { "tcp_timermp_freed", KSTAT_DATA_UINT64 }, 364 { "tcp_timermp_allocfail", KSTAT_DATA_UINT64 }, 365 { "tcp_timermp_allocdblfail", KSTAT_DATA_UINT64 }, 366 { "tcp_push_timer_cnt", KSTAT_DATA_UINT64 }, 367 { "tcp_ack_timer_cnt", KSTAT_DATA_UINT64 }, 368 { "tcp_ire_null1", KSTAT_DATA_UINT64 }, 369 { "tcp_ire_null", KSTAT_DATA_UINT64 }, 370 { "tcp_ip_send", KSTAT_DATA_UINT64 }, 371 { "tcp_ip_ire_send", KSTAT_DATA_UINT64 }, 372 { "tcp_wsrv_called", KSTAT_DATA_UINT64 }, 373 { "tcp_flwctl_on", KSTAT_DATA_UINT64 }, 374 { "tcp_timer_fire_early", KSTAT_DATA_UINT64 }, 375 { "tcp_timer_fire_miss", KSTAT_DATA_UINT64 }, 376 { "tcp_freelist_cleanup", KSTAT_DATA_UINT64 }, 377 { "tcp_rput_v6_error", KSTAT_DATA_UINT64 }, 378 { "tcp_out_sw_cksum", KSTAT_DATA_UINT64 }, 379 { "tcp_out_sw_cksum_bytes", KSTAT_DATA_UINT64 }, 380 { "tcp_zcopy_on", KSTAT_DATA_UINT64 }, 381 { "tcp_zcopy_off", KSTAT_DATA_UINT64 }, 382 { "tcp_zcopy_backoff", KSTAT_DATA_UINT64 }, 383 { "tcp_zcopy_disable", KSTAT_DATA_UINT64 }, 384 { "tcp_mdt_pkt_out", KSTAT_DATA_UINT64 }, 385 { "tcp_mdt_pkt_out_v4", KSTAT_DATA_UINT64 }, 386 { "tcp_mdt_pkt_out_v6", KSTAT_DATA_UINT64 }, 387 { "tcp_mdt_discarded", KSTAT_DATA_UINT64 }, 388 { "tcp_mdt_conn_halted1", KSTAT_DATA_UINT64 }, 389 { "tcp_mdt_conn_halted2", KSTAT_DATA_UINT64 }, 390 { "tcp_mdt_conn_halted3", KSTAT_DATA_UINT64 }, 391 { "tcp_mdt_conn_resumed1", KSTAT_DATA_UINT64 }, 392 { "tcp_mdt_conn_resumed2", KSTAT_DATA_UINT64 }, 393 { "tcp_mdt_legacy_small", KSTAT_DATA_UINT64 }, 394 { "tcp_mdt_legacy_all", KSTAT_DATA_UINT64 }, 395 { "tcp_mdt_legacy_ret", KSTAT_DATA_UINT64 }, 396 { "tcp_mdt_allocfail", KSTAT_DATA_UINT64 }, 397 { "tcp_mdt_addpdescfail", KSTAT_DATA_UINT64 }, 398 { "tcp_mdt_allocd", KSTAT_DATA_UINT64 }, 399 { "tcp_mdt_linked", KSTAT_DATA_UINT64 }, 400 { "tcp_fusion_flowctl", KSTAT_DATA_UINT64 }, 401 { "tcp_fusion_backenabled", KSTAT_DATA_UINT64 }, 402 { "tcp_fusion_urg", KSTAT_DATA_UINT64 }, 403 { "tcp_fusion_putnext", KSTAT_DATA_UINT64 }, 404 { "tcp_fusion_unfusable", KSTAT_DATA_UINT64 }, 405 { "tcp_fusion_aborted", KSTAT_DATA_UINT64 }, 406 { "tcp_fusion_unqualified", KSTAT_DATA_UINT64 }, 407 { "tcp_fusion_rrw_busy", KSTAT_DATA_UINT64 }, 408 { "tcp_fusion_rrw_msgcnt", KSTAT_DATA_UINT64 }, 409 { "tcp_fusion_rrw_plugged", KSTAT_DATA_UINT64 }, 410 { "tcp_in_ack_unsent_drop", KSTAT_DATA_UINT64 }, 411 { "tcp_sock_fallback", KSTAT_DATA_UINT64 }, 412 }; 413 414 static kstat_t *tcp_kstat; 415 416 /* 417 * Call either ip_output or ip_output_v6. This replaces putnext() calls on the 418 * tcp write side. 419 */ 420 #define CALL_IP_WPUT(connp, q, mp) { \ 421 ASSERT(((q)->q_flag & QREADR) == 0); \ 422 TCP_DBGSTAT(tcp_ip_output); \ 423 connp->conn_send(connp, (mp), (q), IP_WPUT); \ 424 } 425 426 /* Macros for timestamp comparisons */ 427 #define TSTMP_GEQ(a, b) ((int32_t)((a)-(b)) >= 0) 428 #define TSTMP_LT(a, b) ((int32_t)((a)-(b)) < 0) 429 430 /* 431 * Parameters for TCP Initial Send Sequence number (ISS) generation. When 432 * tcp_strong_iss is set to 1, which is the default, the ISS is calculated 433 * by adding three components: a time component which grows by 1 every 4096 434 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27); 435 * a per-connection component which grows by 125000 for every new connection; 436 * and an "extra" component that grows by a random amount centered 437 * approximately on 64000. This causes the the ISS generator to cycle every 438 * 4.89 hours if no TCP connections are made, and faster if connections are 439 * made. 440 * 441 * When tcp_strong_iss is set to 0, ISS is calculated by adding two 442 * components: a time component which grows by 250000 every second; and 443 * a per-connection component which grows by 125000 for every new connections. 444 * 445 * A third method, when tcp_strong_iss is set to 2, for generating ISS is 446 * prescribed by Steve Bellovin. This involves adding time, the 125000 per 447 * connection, and a one-way hash (MD5) of the connection ID <sport, dport, 448 * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered 449 * password. 450 */ 451 #define ISS_INCR 250000 452 #define ISS_NSEC_SHT 12 453 454 static uint32_t tcp_iss_incr_extra; /* Incremented for each connection */ 455 static kmutex_t tcp_iss_key_lock; 456 static MD5_CTX tcp_iss_key; 457 static sin_t sin_null; /* Zero address for quick clears */ 458 static sin6_t sin6_null; /* Zero address for quick clears */ 459 460 /* Packet dropper for TCP IPsec policy drops. */ 461 static ipdropper_t tcp_dropper; 462 463 /* 464 * This implementation follows the 4.3BSD interpretation of the urgent 465 * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause 466 * incompatible changes in protocols like telnet and rlogin. 467 */ 468 #define TCP_OLD_URP_INTERPRETATION 1 469 470 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 471 (TCP_IS_DETACHED(tcp) && \ 472 (!(tcp)->tcp_hard_binding)) 473 474 /* 475 * TCP reassembly macros. We hide starting and ending sequence numbers in 476 * b_next and b_prev of messages on the reassembly queue. The messages are 477 * chained using b_cont. These macros are used in tcp_reass() so we don't 478 * have to see the ugly casts and assignments. 479 */ 480 #define TCP_REASS_SEQ(mp) ((uint32_t)(uintptr_t)((mp)->b_next)) 481 #define TCP_REASS_SET_SEQ(mp, u) ((mp)->b_next = \ 482 (mblk_t *)(uintptr_t)(u)) 483 #define TCP_REASS_END(mp) ((uint32_t)(uintptr_t)((mp)->b_prev)) 484 #define TCP_REASS_SET_END(mp, u) ((mp)->b_prev = \ 485 (mblk_t *)(uintptr_t)(u)) 486 487 /* 488 * Implementation of TCP Timers. 489 * ============================= 490 * 491 * INTERFACE: 492 * 493 * There are two basic functions dealing with tcp timers: 494 * 495 * timeout_id_t tcp_timeout(connp, func, time) 496 * clock_t tcp_timeout_cancel(connp, timeout_id) 497 * TCP_TIMER_RESTART(tcp, intvl) 498 * 499 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func' 500 * after 'time' ticks passed. The function called by timeout() must adhere to 501 * the same restrictions as a driver soft interrupt handler - it must not sleep 502 * or call other functions that might sleep. The value returned is the opaque 503 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to 504 * cancel the request. The call to tcp_timeout() may fail in which case it 505 * returns zero. This is different from the timeout(9F) function which never 506 * fails. 507 * 508 * The call-back function 'func' always receives 'connp' as its single 509 * argument. It is always executed in the squeue corresponding to the tcp 510 * structure. The tcp structure is guaranteed to be present at the time the 511 * call-back is called. 512 * 513 * NOTE: The call-back function 'func' is never called if tcp is in 514 * the TCPS_CLOSED state. 515 * 516 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout() 517 * request. locks acquired by the call-back routine should not be held across 518 * the call to tcp_timeout_cancel() or a deadlock may result. 519 * 520 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request. 521 * Otherwise, it returns an integer value greater than or equal to 0. In 522 * particular, if the call-back function is already placed on the squeue, it can 523 * not be canceled. 524 * 525 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called 526 * within squeue context corresponding to the tcp instance. Since the 527 * call-back is also called via the same squeue, there are no race 528 * conditions described in untimeout(9F) manual page since all calls are 529 * strictly serialized. 530 * 531 * TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout 532 * stored in tcp_timer_tid and starts a new one using 533 * MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back 534 * and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid 535 * field. 536 * 537 * NOTE: since the timeout cancellation is not guaranteed, the cancelled 538 * call-back may still be called, so it is possible tcp_timer() will be 539 * called several times. This should not be a problem since tcp_timer() 540 * should always check the tcp instance state. 541 * 542 * 543 * IMPLEMENTATION: 544 * 545 * TCP timers are implemented using three-stage process. The call to 546 * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function 547 * when the timer expires. The tcp_timer_callback() arranges the call of the 548 * tcp_timer_handler() function via squeue corresponding to the tcp 549 * instance. The tcp_timer_handler() calls actual requested timeout call-back 550 * and passes tcp instance as an argument to it. Information is passed between 551 * stages using the tcp_timer_t structure which contains the connp pointer, the 552 * tcp call-back to call and the timeout id returned by the timeout(9F). 553 * 554 * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t - 555 * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo 556 * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout() 557 * returns the pointer to this mblk. 558 * 559 * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It 560 * looks like a normal mblk without actual dblk attached to it. 561 * 562 * To optimize performance each tcp instance holds a small cache of timer 563 * mblocks. In the current implementation it caches up to two timer mblocks per 564 * tcp instance. The cache is preserved over tcp frees and is only freed when 565 * the whole tcp structure is destroyed by its kmem destructor. Since all tcp 566 * timer processing happens on a corresponding squeue, the cache manipulation 567 * does not require any locks. Experiments show that majority of timer mblocks 568 * allocations are satisfied from the tcp cache and do not involve kmem calls. 569 * 570 * The tcp_timeout() places a refhold on the connp instance which guarantees 571 * that it will be present at the time the call-back function fires. The 572 * tcp_timer_handler() drops the reference after calling the call-back, so the 573 * call-back function does not need to manipulate the references explicitly. 574 */ 575 576 typedef struct tcp_timer_s { 577 conn_t *connp; 578 void (*tcpt_proc)(void *); 579 timeout_id_t tcpt_tid; 580 } tcp_timer_t; 581 582 static kmem_cache_t *tcp_timercache; 583 kmem_cache_t *tcp_sack_info_cache; 584 kmem_cache_t *tcp_iphc_cache; 585 586 /* 587 * For scalability, we must not run a timer for every TCP connection 588 * in TIME_WAIT state. To see why, consider (for time wait interval of 589 * 4 minutes): 590 * 1000 connections/sec * 240 seconds/time wait = 240,000 active conn's 591 * 592 * This list is ordered by time, so you need only delete from the head 593 * until you get to entries which aren't old enough to delete yet. 594 * The list consists of only the detached TIME_WAIT connections. 595 * 596 * Note that the timer (tcp_time_wait_expire) is started when the tcp_t 597 * becomes detached TIME_WAIT (either by changing the state and already 598 * being detached or the other way around). This means that the TIME_WAIT 599 * state can be extended (up to doubled) if the connection doesn't become 600 * detached for a long time. 601 * 602 * The list manipulations (including tcp_time_wait_next/prev) 603 * are protected by the tcp_time_wait_lock. The content of the 604 * detached TIME_WAIT connections is protected by the normal perimeters. 605 */ 606 607 typedef struct tcp_squeue_priv_s { 608 kmutex_t tcp_time_wait_lock; 609 /* Protects the next 3 globals */ 610 timeout_id_t tcp_time_wait_tid; 611 tcp_t *tcp_time_wait_head; 612 tcp_t *tcp_time_wait_tail; 613 tcp_t *tcp_free_list; 614 uint_t tcp_free_list_cnt; 615 } tcp_squeue_priv_t; 616 617 /* 618 * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs. 619 * Running it every 5 seconds seems to give the best results. 620 */ 621 #define TCP_TIME_WAIT_DELAY drv_usectohz(5000000) 622 623 /* 624 * To prevent memory hog, limit the number of entries in tcp_free_list 625 * to 1% of available memory / number of cpus 626 */ 627 uint_t tcp_free_list_max_cnt = 0; 628 629 #define TCP_XMIT_LOWATER 4096 630 #define TCP_XMIT_HIWATER 49152 631 #define TCP_RECV_LOWATER 2048 632 #define TCP_RECV_HIWATER 49152 633 634 /* 635 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 636 */ 637 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 638 639 #define TIDUSZ 4096 /* transport interface data unit size */ 640 641 /* 642 * Bind hash list size and has function. It has to be a power of 2 for 643 * hashing. 644 */ 645 #define TCP_BIND_FANOUT_SIZE 512 646 #define TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1)) 647 /* 648 * Size of listen and acceptor hash list. It has to be a power of 2 for 649 * hashing. 650 */ 651 #define TCP_FANOUT_SIZE 256 652 653 #ifdef _ILP32 654 #define TCP_ACCEPTOR_HASH(accid) \ 655 (((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1)) 656 #else 657 #define TCP_ACCEPTOR_HASH(accid) \ 658 ((uint_t)(accid) & (TCP_FANOUT_SIZE - 1)) 659 #endif /* _ILP32 */ 660 661 #define IP_ADDR_CACHE_SIZE 2048 662 #define IP_ADDR_CACHE_HASH(faddr) \ 663 (ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1)) 664 665 /* Hash for HSPs uses all 32 bits, since both networks and hosts are in table */ 666 #define TCP_HSP_HASH_SIZE 256 667 668 #define TCP_HSP_HASH(addr) \ 669 (((addr>>24) ^ (addr >>16) ^ \ 670 (addr>>8) ^ (addr)) % TCP_HSP_HASH_SIZE) 671 672 /* 673 * TCP options struct returned from tcp_parse_options. 674 */ 675 typedef struct tcp_opt_s { 676 uint32_t tcp_opt_mss; 677 uint32_t tcp_opt_wscale; 678 uint32_t tcp_opt_ts_val; 679 uint32_t tcp_opt_ts_ecr; 680 tcp_t *tcp; 681 } tcp_opt_t; 682 683 /* 684 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing 685 */ 686 687 #ifdef _BIG_ENDIAN 688 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 689 (TCPOPT_TSTAMP << 8) | 10) 690 #else 691 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 692 (TCPOPT_NOP << 8) | TCPOPT_NOP) 693 #endif 694 695 /* 696 * Flags returned from tcp_parse_options. 697 */ 698 #define TCP_OPT_MSS_PRESENT 1 699 #define TCP_OPT_WSCALE_PRESENT 2 700 #define TCP_OPT_TSTAMP_PRESENT 4 701 #define TCP_OPT_SACK_OK_PRESENT 8 702 #define TCP_OPT_SACK_PRESENT 16 703 704 /* TCP option length */ 705 #define TCPOPT_NOP_LEN 1 706 #define TCPOPT_MAXSEG_LEN 4 707 #define TCPOPT_WS_LEN 3 708 #define TCPOPT_REAL_WS_LEN (TCPOPT_WS_LEN+1) 709 #define TCPOPT_TSTAMP_LEN 10 710 #define TCPOPT_REAL_TS_LEN (TCPOPT_TSTAMP_LEN+2) 711 #define TCPOPT_SACK_OK_LEN 2 712 #define TCPOPT_REAL_SACK_OK_LEN (TCPOPT_SACK_OK_LEN+2) 713 #define TCPOPT_REAL_SACK_LEN 4 714 #define TCPOPT_MAX_SACK_LEN 36 715 #define TCPOPT_HEADER_LEN 2 716 717 /* TCP cwnd burst factor. */ 718 #define TCP_CWND_INFINITE 65535 719 #define TCP_CWND_SS 3 720 #define TCP_CWND_NORMAL 5 721 722 /* Maximum TCP initial cwin (start/restart). */ 723 #define TCP_MAX_INIT_CWND 8 724 725 /* 726 * Initialize cwnd according to RFC 3390. def_max_init_cwnd is 727 * either tcp_slow_start_initial or tcp_slow_start_after idle 728 * depending on the caller. If the upper layer has not used the 729 * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd 730 * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd. 731 * If the upper layer has changed set the tcp_init_cwnd, just use 732 * it to calculate the tcp_cwnd. 733 */ 734 #define SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd) \ 735 { \ 736 if ((tcp)->tcp_init_cwnd == 0) { \ 737 (tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss), \ 738 MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \ 739 } else { \ 740 (tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss); \ 741 } \ 742 tcp->tcp_cwnd_cnt = 0; \ 743 } 744 745 /* TCP Timer control structure */ 746 typedef struct tcpt_s { 747 pfv_t tcpt_pfv; /* The routine we are to call */ 748 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 749 } tcpt_t; 750 751 /* Host Specific Parameter structure */ 752 typedef struct tcp_hsp { 753 struct tcp_hsp *tcp_hsp_next; 754 in6_addr_t tcp_hsp_addr_v6; 755 in6_addr_t tcp_hsp_subnet_v6; 756 uint_t tcp_hsp_vers; /* IPV4_VERSION | IPV6_VERSION */ 757 int32_t tcp_hsp_sendspace; 758 int32_t tcp_hsp_recvspace; 759 int32_t tcp_hsp_tstamp; 760 } tcp_hsp_t; 761 #define tcp_hsp_addr V4_PART_OF_V6(tcp_hsp_addr_v6) 762 #define tcp_hsp_subnet V4_PART_OF_V6(tcp_hsp_subnet_v6) 763 764 /* 765 * Functions called directly via squeue having a prototype of edesc_t. 766 */ 767 void tcp_conn_request(void *arg, mblk_t *mp, void *arg2); 768 static void tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2); 769 void tcp_accept_finish(void *arg, mblk_t *mp, void *arg2); 770 static void tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2); 771 static void tcp_wput_proto(void *arg, mblk_t *mp, void *arg2); 772 void tcp_input(void *arg, mblk_t *mp, void *arg2); 773 void tcp_rput_data(void *arg, mblk_t *mp, void *arg2); 774 static void tcp_close_output(void *arg, mblk_t *mp, void *arg2); 775 void tcp_output(void *arg, mblk_t *mp, void *arg2); 776 static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2); 777 static void tcp_timer_handler(void *arg, mblk_t *mp, void *arg2); 778 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2); 779 780 781 /* Prototype for TCP functions */ 782 static void tcp_random_init(void); 783 int tcp_random(void); 784 static void tcp_accept(tcp_t *tcp, mblk_t *mp); 785 static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, 786 tcp_t *eager); 787 static int tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp); 788 static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 789 int reuseaddr, boolean_t quick_connect, boolean_t bind_to_req_port_only, 790 boolean_t user_specified); 791 static void tcp_closei_local(tcp_t *tcp); 792 static void tcp_close_detached(tcp_t *tcp); 793 static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, 794 mblk_t *idmp, mblk_t **defermp); 795 static void tcp_connect(tcp_t *tcp, mblk_t *mp); 796 static void tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, 797 in_port_t dstport, uint_t srcid); 798 static void tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 799 in_port_t dstport, uint32_t flowinfo, uint_t srcid, 800 uint32_t scope_id); 801 static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag); 802 static void tcp_def_q_set(tcp_t *tcp, mblk_t *mp); 803 static void tcp_disconnect(tcp_t *tcp, mblk_t *mp); 804 static char *tcp_display(tcp_t *tcp, char *, char); 805 static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum); 806 static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only); 807 static void tcp_eager_unlink(tcp_t *tcp); 808 static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr, 809 int unixerr); 810 static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 811 int tlierr, int unixerr); 812 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 813 cred_t *cr); 814 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 815 char *value, caddr_t cp, cred_t *cr); 816 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 817 char *value, caddr_t cp, cred_t *cr); 818 static int tcp_tpistate(tcp_t *tcp); 819 static void tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp, 820 int caller_holds_lock); 821 static void tcp_bind_hash_remove(tcp_t *tcp); 822 static tcp_t *tcp_acceptor_hash_lookup(t_uscalar_t id); 823 void tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp); 824 static void tcp_acceptor_hash_remove(tcp_t *tcp); 825 static void tcp_capability_req(tcp_t *tcp, mblk_t *mp); 826 static void tcp_info_req(tcp_t *tcp, mblk_t *mp); 827 static void tcp_addr_req(tcp_t *tcp, mblk_t *mp); 828 static void tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *mp); 829 static int tcp_header_init_ipv4(tcp_t *tcp); 830 static int tcp_header_init_ipv6(tcp_t *tcp); 831 int tcp_init(tcp_t *tcp, queue_t *q); 832 static int tcp_init_values(tcp_t *tcp); 833 static mblk_t *tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic); 834 static mblk_t *tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, 835 t_scalar_t addr_length); 836 static void tcp_ip_ire_mark_advice(tcp_t *tcp); 837 static void tcp_ip_notify(tcp_t *tcp); 838 static mblk_t *tcp_ire_mp(mblk_t *mp); 839 static void tcp_iss_init(tcp_t *tcp); 840 static void tcp_keepalive_killer(void *arg); 841 static int tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt); 842 static void tcp_mss_set(tcp_t *tcp, uint32_t size); 843 static int tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, 844 int *do_disconnectp, int *t_errorp, int *sys_errorp); 845 static boolean_t tcp_allow_connopt_set(int level, int name); 846 int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr); 847 int tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr); 848 int tcp_opt_set(queue_t *q, uint_t optset_context, int level, 849 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp, 850 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, 851 mblk_t *mblk); 852 static void tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha); 853 static int tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, 854 uchar_t *ptr, uint_t len); 855 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 856 static boolean_t tcp_param_register(tcpparam_t *tcppa, int cnt); 857 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 858 caddr_t cp, cred_t *cr); 859 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 860 caddr_t cp, cred_t *cr); 861 static void tcp_iss_key_init(uint8_t *phrase, int len); 862 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 863 caddr_t cp, cred_t *cr); 864 static void tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt); 865 static mblk_t *tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start); 866 static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp); 867 static void tcp_reinit(tcp_t *tcp); 868 static void tcp_reinit_values(tcp_t *tcp); 869 static void tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, 870 tcp_t *thisstream, cred_t *cr); 871 872 static uint_t tcp_rcv_drain(queue_t *q, tcp_t *tcp); 873 static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags); 874 static boolean_t tcp_send_rst_chk(void); 875 static void tcp_ss_rexmit(tcp_t *tcp); 876 static mblk_t *tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp); 877 static void tcp_process_options(tcp_t *, tcph_t *); 878 static void tcp_rput_common(tcp_t *tcp, mblk_t *mp); 879 static void tcp_rsrv(queue_t *q); 880 static int tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd); 881 static int tcp_snmp_state(tcp_t *tcp); 882 static int tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, 883 cred_t *cr); 884 static int tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 885 cred_t *cr); 886 static int tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 887 cred_t *cr); 888 static int tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 889 cred_t *cr); 890 static int tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 891 cred_t *cr); 892 static int tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, 893 caddr_t cp, cred_t *cr); 894 static int tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, 895 caddr_t cp, cred_t *cr); 896 static int tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, 897 cred_t *cr); 898 static void tcp_timer(void *arg); 899 static void tcp_timer_callback(void *); 900 static in_port_t tcp_update_next_port(in_port_t port, const tcp_t *tcp, 901 boolean_t random); 902 static in_port_t tcp_get_next_priv_port(const tcp_t *); 903 static void tcp_wput_sock(queue_t *q, mblk_t *mp); 904 void tcp_wput_accept(queue_t *q, mblk_t *mp); 905 static void tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent); 906 static void tcp_wput_flush(tcp_t *tcp, mblk_t *mp); 907 static void tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp); 908 static int tcp_send(queue_t *q, tcp_t *tcp, const int mss, 909 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 910 const int num_sack_blk, int *usable, uint_t *snxt, 911 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 912 const int mdt_thres); 913 static int tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, 914 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 915 const int num_sack_blk, int *usable, uint_t *snxt, 916 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 917 const int mdt_thres); 918 static void tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, 919 int num_sack_blk); 920 static void tcp_wsrv(queue_t *q); 921 static int tcp_xmit_end(tcp_t *tcp); 922 static mblk_t *tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, 923 int32_t *offset, mblk_t **end_mp, uint32_t seq, 924 boolean_t sendall, uint32_t *seg_len, boolean_t rexmit); 925 static void tcp_ack_timer(void *arg); 926 static mblk_t *tcp_ack_mp(tcp_t *tcp); 927 static void tcp_xmit_early_reset(char *str, mblk_t *mp, 928 uint32_t seq, uint32_t ack, int ctl, uint_t ip_hdr_len, 929 zoneid_t zoneid); 930 static void tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, 931 uint32_t ack, int ctl); 932 static tcp_hsp_t *tcp_hsp_lookup(ipaddr_t addr); 933 static tcp_hsp_t *tcp_hsp_lookup_ipv6(in6_addr_t *addr); 934 static int setmaxps(queue_t *q, int maxpsz); 935 static void tcp_set_rto(tcp_t *, time_t); 936 static boolean_t tcp_check_policy(tcp_t *, mblk_t *, ipha_t *, ip6_t *, 937 boolean_t, boolean_t); 938 static void tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, 939 boolean_t ipsec_mctl); 940 static mblk_t *tcp_setsockopt_mp(int level, int cmd, 941 char *opt, int optlen); 942 static int tcp_build_hdrs(queue_t *, tcp_t *); 943 static void tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, 944 uint32_t seg_seq, uint32_t seg_ack, int seg_len, 945 tcph_t *tcph); 946 boolean_t tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp); 947 boolean_t tcp_reserved_port_add(int, in_port_t *, in_port_t *); 948 boolean_t tcp_reserved_port_del(in_port_t, in_port_t); 949 boolean_t tcp_reserved_port_check(in_port_t); 950 static tcp_t *tcp_alloc_temp_tcp(in_port_t); 951 static int tcp_reserved_port_list(queue_t *, mblk_t *, caddr_t, cred_t *); 952 static mblk_t *tcp_mdt_info_mp(mblk_t *); 953 static void tcp_mdt_update(tcp_t *, ill_mdt_capab_t *, boolean_t); 954 static int tcp_mdt_add_attrs(multidata_t *, const mblk_t *, 955 const boolean_t, const uint32_t, const uint32_t, 956 const uint32_t, const uint32_t); 957 static void tcp_multisend_data(tcp_t *, ire_t *, const ill_t *, mblk_t *, 958 const uint_t, const uint_t, boolean_t *); 959 static void tcp_send_data(tcp_t *, queue_t *, mblk_t *); 960 extern mblk_t *tcp_timermp_alloc(int); 961 extern void tcp_timermp_free(tcp_t *); 962 static void tcp_timer_free(tcp_t *tcp, mblk_t *mp); 963 static void tcp_stop_lingering(tcp_t *tcp); 964 static void tcp_close_linger_timeout(void *arg); 965 void tcp_ddi_init(void); 966 void tcp_ddi_destroy(void); 967 static void tcp_kstat_init(void); 968 static void tcp_kstat_fini(void); 969 static int tcp_kstat_update(kstat_t *kp, int rw); 970 void tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp); 971 static int tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 972 tcph_t *tcph, uint_t ipvers, mblk_t *idmp); 973 static int tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 974 tcph_t *tcph, mblk_t *idmp); 975 static squeue_func_t tcp_squeue_switch(int); 976 977 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *); 978 static int tcp_close(queue_t *, int); 979 static int tcpclose_accept(queue_t *); 980 static int tcp_modclose(queue_t *); 981 static void tcp_wput_mod(queue_t *, mblk_t *); 982 983 static void tcp_squeue_add(squeue_t *); 984 static boolean_t tcp_zcopy_check(tcp_t *); 985 static void tcp_zcopy_notify(tcp_t *); 986 static mblk_t *tcp_zcopy_disable(tcp_t *, mblk_t *); 987 static mblk_t *tcp_zcopy_backoff(tcp_t *, mblk_t *, int); 988 static void tcp_ire_ill_check(tcp_t *, ire_t *, ill_t *, boolean_t); 989 990 extern void tcp_kssl_input(tcp_t *, mblk_t *); 991 992 /* 993 * Routines related to the TCP_IOC_ABORT_CONN ioctl command. 994 * 995 * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting 996 * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure 997 * (defined in tcp.h) needs to be filled in and passed into the kernel 998 * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t 999 * structure contains the four-tuple of a TCP connection and a range of TCP 1000 * states (specified by ac_start and ac_end). The use of wildcard addresses 1001 * and ports is allowed. Connections with a matching four tuple and a state 1002 * within the specified range will be aborted. The valid states for the 1003 * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT, 1004 * inclusive. 1005 * 1006 * An application which has its connection aborted by this ioctl will receive 1007 * an error that is dependent on the connection state at the time of the abort. 1008 * If the connection state is < TCPS_TIME_WAIT, an application should behave as 1009 * though a RST packet has been received. If the connection state is equal to 1010 * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel 1011 * and all resources associated with the connection will be freed. 1012 */ 1013 static mblk_t *tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *); 1014 static void tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *); 1015 static void tcp_ioctl_abort_handler(tcp_t *, mblk_t *); 1016 static int tcp_ioctl_abort(tcp_ioc_abort_conn_t *); 1017 static void tcp_ioctl_abort_conn(queue_t *, mblk_t *); 1018 static int tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *, 1019 boolean_t); 1020 1021 static struct module_info tcp_rinfo = { 1022 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 1023 }; 1024 1025 static struct module_info tcp_winfo = { 1026 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 1027 }; 1028 1029 /* 1030 * Entry points for TCP as a module. It only allows SNMP requests 1031 * to pass through. 1032 */ 1033 struct qinit tcp_mod_rinit = { 1034 (pfi_t)putnext, NULL, tcp_open, ip_snmpmod_close, NULL, &tcp_rinfo, 1035 }; 1036 1037 struct qinit tcp_mod_winit = { 1038 (pfi_t)ip_snmpmod_wput, NULL, tcp_open, ip_snmpmod_close, NULL, 1039 &tcp_rinfo 1040 }; 1041 1042 /* 1043 * Entry points for TCP as a device. The normal case which supports 1044 * the TCP functionality. 1045 */ 1046 struct qinit tcp_rinit = { 1047 NULL, (pfi_t)tcp_rsrv, tcp_open, tcp_close, NULL, &tcp_rinfo 1048 }; 1049 1050 struct qinit tcp_winit = { 1051 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1052 }; 1053 1054 /* Initial entry point for TCP in socket mode. */ 1055 struct qinit tcp_sock_winit = { 1056 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1057 }; 1058 1059 /* 1060 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 1061 * an accept. Avoid allocating data structures since eager has already 1062 * been created. 1063 */ 1064 struct qinit tcp_acceptor_rinit = { 1065 NULL, (pfi_t)tcp_rsrv, NULL, tcpclose_accept, NULL, &tcp_winfo 1066 }; 1067 1068 struct qinit tcp_acceptor_winit = { 1069 (pfi_t)tcp_wput_accept, NULL, NULL, NULL, NULL, &tcp_winfo 1070 }; 1071 1072 /* 1073 * Entry points for TCP loopback (read side only) 1074 */ 1075 struct qinit tcp_loopback_rinit = { 1076 (pfi_t)0, (pfi_t)tcp_rsrv, tcp_open, tcp_close, (pfi_t)0, 1077 &tcp_rinfo, NULL, tcp_fuse_rrw, tcp_fuse_rinfop, STRUIOT_STANDARD 1078 }; 1079 1080 struct streamtab tcpinfo = { 1081 &tcp_rinit, &tcp_winit 1082 }; 1083 1084 extern squeue_func_t tcp_squeue_wput_proc; 1085 extern squeue_func_t tcp_squeue_timer_proc; 1086 1087 /* Protected by tcp_g_q_lock */ 1088 static queue_t *tcp_g_q; /* Default queue used during detached closes */ 1089 kmutex_t tcp_g_q_lock; 1090 1091 /* Protected by tcp_hsp_lock */ 1092 /* 1093 * XXX The host param mechanism should go away and instead we should use 1094 * the metrics associated with the routes to determine the default sndspace 1095 * and rcvspace. 1096 */ 1097 static tcp_hsp_t **tcp_hsp_hash; /* Hash table for HSPs */ 1098 krwlock_t tcp_hsp_lock; 1099 1100 /* 1101 * Extra privileged ports. In host byte order. 1102 * Protected by tcp_epriv_port_lock. 1103 */ 1104 #define TCP_NUM_EPRIV_PORTS 64 1105 static int tcp_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 1106 static uint16_t tcp_g_epriv_ports[TCP_NUM_EPRIV_PORTS] = { 2049, 4045 }; 1107 kmutex_t tcp_epriv_port_lock; 1108 1109 /* 1110 * The smallest anonymous port in the privileged port range which TCP 1111 * looks for free port. Use in the option TCP_ANONPRIVBIND. 1112 */ 1113 static in_port_t tcp_min_anonpriv_port = 512; 1114 1115 /* Only modified during _init and _fini thus no locking is needed. */ 1116 static caddr_t tcp_g_nd; /* Head of 'named dispatch' variable list */ 1117 1118 /* Hint not protected by any lock */ 1119 static uint_t tcp_next_port_to_try; 1120 1121 1122 /* TCP bind hash list - all tcp_t with state >= BOUND. */ 1123 tf_t tcp_bind_fanout[TCP_BIND_FANOUT_SIZE]; 1124 1125 /* TCP queue hash list - all tcp_t in case they will be an acceptor. */ 1126 static tf_t tcp_acceptor_fanout[TCP_FANOUT_SIZE]; 1127 1128 /* 1129 * TCP has a private interface for other kernel modules to reserve a 1130 * port range for them to use. Once reserved, TCP will not use any ports 1131 * in the range. This interface relies on the TCP_EXCLBIND feature. If 1132 * the semantics of TCP_EXCLBIND is changed, implementation of this interface 1133 * has to be verified. 1134 * 1135 * There can be TCP_RESERVED_PORTS_ARRAY_MAX_SIZE port ranges. Each port 1136 * range can cover at most TCP_RESERVED_PORTS_RANGE_MAX ports. A port 1137 * range is [port a, port b] inclusive. And each port range is between 1138 * TCP_LOWESET_RESERVED_PORT and TCP_LARGEST_RESERVED_PORT inclusive. 1139 * 1140 * Note that the default anonymous port range starts from 32768. There is 1141 * no port "collision" between that and the reserved port range. If there 1142 * is port collision (because the default smallest anonymous port is lowered 1143 * or some apps specifically bind to ports in the reserved port range), the 1144 * system may not be able to reserve a port range even there are enough 1145 * unbound ports as a reserved port range contains consecutive ports . 1146 */ 1147 #define TCP_RESERVED_PORTS_ARRAY_MAX_SIZE 5 1148 #define TCP_RESERVED_PORTS_RANGE_MAX 1000 1149 #define TCP_SMALLEST_RESERVED_PORT 10240 1150 #define TCP_LARGEST_RESERVED_PORT 20480 1151 1152 /* Structure to represent those reserved port ranges. */ 1153 typedef struct tcp_rport_s { 1154 in_port_t lo_port; 1155 in_port_t hi_port; 1156 tcp_t **temp_tcp_array; 1157 } tcp_rport_t; 1158 1159 /* The reserved port array. */ 1160 static tcp_rport_t tcp_reserved_port[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 1161 1162 /* Locks to protect the tcp_reserved_ports array. */ 1163 static krwlock_t tcp_reserved_port_lock; 1164 1165 /* The number of ranges in the array. */ 1166 uint32_t tcp_reserved_port_array_size = 0; 1167 1168 /* 1169 * MIB-2 stuff for SNMP 1170 * Note: tcpInErrs {tcp 15} is accumulated in ip.c 1171 */ 1172 mib2_tcp_t tcp_mib; /* SNMP fixed size info */ 1173 kstat_t *tcp_mibkp; /* kstat exporting tcp_mib data */ 1174 1175 boolean_t tcp_icmp_source_quench = B_FALSE; 1176 /* 1177 * Following assumes TPI alignment requirements stay along 32 bit 1178 * boundaries 1179 */ 1180 #define ROUNDUP32(x) \ 1181 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 1182 1183 /* Template for response to info request. */ 1184 static struct T_info_ack tcp_g_t_info_ack = { 1185 T_INFO_ACK, /* PRIM_type */ 1186 0, /* TSDU_size */ 1187 T_INFINITE, /* ETSDU_size */ 1188 T_INVALID, /* CDATA_size */ 1189 T_INVALID, /* DDATA_size */ 1190 sizeof (sin_t), /* ADDR_size */ 1191 0, /* OPT_size - not initialized here */ 1192 TIDUSZ, /* TIDU_size */ 1193 T_COTS_ORD, /* SERV_type */ 1194 TCPS_IDLE, /* CURRENT_state */ 1195 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1196 }; 1197 1198 static struct T_info_ack tcp_g_t_info_ack_v6 = { 1199 T_INFO_ACK, /* PRIM_type */ 1200 0, /* TSDU_size */ 1201 T_INFINITE, /* ETSDU_size */ 1202 T_INVALID, /* CDATA_size */ 1203 T_INVALID, /* DDATA_size */ 1204 sizeof (sin6_t), /* ADDR_size */ 1205 0, /* OPT_size - not initialized here */ 1206 TIDUSZ, /* TIDU_size */ 1207 T_COTS_ORD, /* SERV_type */ 1208 TCPS_IDLE, /* CURRENT_state */ 1209 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1210 }; 1211 1212 #define MS 1L 1213 #define SECONDS (1000 * MS) 1214 #define MINUTES (60 * SECONDS) 1215 #define HOURS (60 * MINUTES) 1216 #define DAYS (24 * HOURS) 1217 1218 #define PARAM_MAX (~(uint32_t)0) 1219 1220 /* Max size IP datagram is 64k - 1 */ 1221 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcph_t))) 1222 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcph_t))) 1223 /* Max of the above */ 1224 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 1225 1226 /* Largest TCP port number */ 1227 #define TCP_MAX_PORT (64 * 1024 - 1) 1228 1229 /* 1230 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 1231 * layer header. It has to be a multiple of 4. 1232 */ 1233 static tcpparam_t tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 1234 #define tcp_wroff_xtra tcp_wroff_xtra_param.tcp_param_val 1235 1236 /* 1237 * All of these are alterable, within the min/max values given, at run time. 1238 * Note that the default value of "tcp_time_wait_interval" is four minutes, 1239 * per the TCP spec. 1240 */ 1241 /* BEGIN CSTYLED */ 1242 tcpparam_t tcp_param_arr[] = { 1243 /*min max value name */ 1244 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 1245 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 1246 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 1247 { 1, 1024, 1, "tcp_conn_req_min" }, 1248 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 1249 { 128, (1<<30), 1024*1024, "tcp_cwnd_max" }, 1250 { 0, 10, 0, "tcp_debug" }, 1251 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 1252 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 1253 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 1254 { 500*MS, PARAM_MAX, 8*MINUTES, "tcp_ip_abort_interval"}, 1255 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 1256 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 1257 { 1, 255, 64, "tcp_ipv4_ttl"}, 1258 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 1259 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 1260 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 1261 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 1262 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 1263 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 1264 { 1*MS, 20*SECONDS, 3*SECONDS, "tcp_rexmit_interval_initial"}, 1265 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 1266 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 1267 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 1268 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 1269 { 0, 128000, 0, "tcp_sth_rcv_hiwat" }, 1270 { 0, 128000, 0, "tcp_sth_rcv_lowat" }, 1271 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 1272 { 0, 1, 0, "tcp_ignore_path_mtu" }, 1273 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 1274 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 1275 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 1276 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 1277 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 1278 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 1279 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 1280 { 0, TCP_MSS_MAX, 64, "tcp_co_min"}, 1281 { 8192, (1<<30), 1024*1024, "tcp_max_buf"}, 1282 /* 1283 * Question: What default value should I set for tcp_strong_iss? 1284 */ 1285 { 0, 2, 1, "tcp_strong_iss"}, 1286 { 0, 65536, 20, "tcp_rtt_updates"}, 1287 { 0, 1, 1, "tcp_wscale_always"}, 1288 { 0, 1, 0, "tcp_tstamp_always"}, 1289 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 1290 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 1291 { 0, 16, 2, "tcp_deferred_acks_max"}, 1292 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 1293 { 1, 4, 4, "tcp_slow_start_initial"}, 1294 { 10*MS, 50*MS, 20*MS, "tcp_co_timer_interval"}, 1295 { 0, 2, 2, "tcp_sack_permitted"}, 1296 { 0, 1, 0, "tcp_trace"}, 1297 { 0, 1, 1, "tcp_compression_enabled"}, 1298 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 1299 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 1300 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 1301 { 0, 1, 0, "tcp_rev_src_routes"}, 1302 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 1303 { 100*MS, 60*SECONDS, 1*SECONDS, "tcp_ndd_get_info_interval"}, 1304 { 0, 16, 8, "tcp_local_dacks_max"}, 1305 { 0, 2, 1, "tcp_ecn_permitted"}, 1306 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 1307 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 1308 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 1309 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 1310 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 1311 }; 1312 /* END CSTYLED */ 1313 1314 /* 1315 * tcp_mdt_hdr_{head,tail}_min are the leading and trailing spaces of 1316 * each header fragment in the header buffer. Each parameter value has 1317 * to be a multiple of 4 (32-bit aligned). 1318 */ 1319 static tcpparam_t tcp_mdt_head_param = { 32, 256, 32, "tcp_mdt_hdr_head_min" }; 1320 static tcpparam_t tcp_mdt_tail_param = { 0, 256, 32, "tcp_mdt_hdr_tail_min" }; 1321 #define tcp_mdt_hdr_head_min tcp_mdt_head_param.tcp_param_val 1322 #define tcp_mdt_hdr_tail_min tcp_mdt_tail_param.tcp_param_val 1323 1324 /* 1325 * tcp_mdt_max_pbufs is the upper limit value that tcp uses to figure out 1326 * the maximum number of payload buffers associated per Multidata. 1327 */ 1328 static tcpparam_t tcp_mdt_max_pbufs_param = 1329 { 1, MULTIDATA_MAX_PBUFS, MULTIDATA_MAX_PBUFS, "tcp_mdt_max_pbufs" }; 1330 #define tcp_mdt_max_pbufs tcp_mdt_max_pbufs_param.tcp_param_val 1331 1332 /* Round up the value to the nearest mss. */ 1333 #define MSS_ROUNDUP(value, mss) ((((value) - 1) / (mss) + 1) * (mss)) 1334 1335 /* 1336 * Set ECN capable transport (ECT) code point in IP header. 1337 * 1338 * Note that there are 2 ECT code points '01' and '10', which are called 1339 * ECT(1) and ECT(0) respectively. Here we follow the original ECT code 1340 * point ECT(0) for TCP as described in RFC 2481. 1341 */ 1342 #define SET_ECT(tcp, iph) \ 1343 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1344 /* We need to clear the code point first. */ \ 1345 ((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \ 1346 ((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \ 1347 } else { \ 1348 ((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \ 1349 ((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \ 1350 } 1351 1352 /* 1353 * The format argument to pass to tcp_display(). 1354 * DISP_PORT_ONLY means that the returned string has only port info. 1355 * DISP_ADDR_AND_PORT means that the returned string also contains the 1356 * remote and local IP address. 1357 */ 1358 #define DISP_PORT_ONLY 1 1359 #define DISP_ADDR_AND_PORT 2 1360 1361 /* 1362 * This controls the rate some ndd info report functions can be used 1363 * by non-privileged users. It stores the last time such info is 1364 * requested. When those report functions are called again, this 1365 * is checked with the current time and compare with the ndd param 1366 * tcp_ndd_get_info_interval. 1367 */ 1368 static clock_t tcp_last_ndd_get_info_time = 0; 1369 #define NDD_TOO_QUICK_MSG \ 1370 "ndd get info rate too high for non-privileged users, try again " \ 1371 "later.\n" 1372 #define NDD_OUT_OF_BUF_MSG "<< Out of buffer >>\n" 1373 1374 #define IS_VMLOANED_MBLK(mp) \ 1375 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 1376 1377 /* 1378 * These two variables control the rate for TCP to generate RSTs in 1379 * response to segments not belonging to any connections. We limit 1380 * TCP to sent out tcp_rst_sent_rate (ndd param) number of RSTs in 1381 * each 1 second interval. This is to protect TCP against DoS attack. 1382 */ 1383 static clock_t tcp_last_rst_intrvl; 1384 static uint32_t tcp_rst_cnt; 1385 1386 /* The number of RST not sent because of the rate limit. */ 1387 static uint32_t tcp_rst_unsent; 1388 1389 /* Enable or disable b_cont M_MULTIDATA chaining for MDT. */ 1390 boolean_t tcp_mdt_chain = B_TRUE; 1391 1392 /* 1393 * MDT threshold in the form of effective send MSS multiplier; we take 1394 * the MDT path if the amount of unsent data exceeds the threshold value 1395 * (default threshold is 1*SMSS). 1396 */ 1397 uint_t tcp_mdt_smss_threshold = 1; 1398 1399 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 1400 1401 /* 1402 * Forces all connections to obey the value of the tcp_maxpsz_multiplier 1403 * tunable settable via NDD. Otherwise, the per-connection behavior is 1404 * determined dynamically during tcp_adapt_ire(), which is the default. 1405 */ 1406 boolean_t tcp_static_maxpsz = B_FALSE; 1407 1408 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */ 1409 uint32_t tcp_random_anon_port = 1; 1410 1411 /* 1412 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 1413 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 1414 * data, TCP will not respond with an ACK. RFC 793 requires that 1415 * TCP responds with an ACK for such a bogus ACK. By not following 1416 * the RFC, we prevent TCP from getting into an ACK storm if somehow 1417 * an attacker successfully spoofs an acceptable segment to our 1418 * peer; or when our peer is "confused." 1419 */ 1420 uint32_t tcp_drop_ack_unsent_cnt = 10; 1421 1422 /* 1423 * Hook functions to enable cluster networking 1424 * On non-clustered systems these vectors must always be NULL. 1425 */ 1426 1427 void (*cl_inet_listen)(uint8_t protocol, sa_family_t addr_family, 1428 uint8_t *laddrp, in_port_t lport) = NULL; 1429 void (*cl_inet_unlisten)(uint8_t protocol, sa_family_t addr_family, 1430 uint8_t *laddrp, in_port_t lport) = NULL; 1431 void (*cl_inet_connect)(uint8_t protocol, sa_family_t addr_family, 1432 uint8_t *laddrp, in_port_t lport, 1433 uint8_t *faddrp, in_port_t fport) = NULL; 1434 void (*cl_inet_disconnect)(uint8_t protocol, sa_family_t addr_family, 1435 uint8_t *laddrp, in_port_t lport, 1436 uint8_t *faddrp, in_port_t fport) = NULL; 1437 1438 /* 1439 * The following are defined in ip.c 1440 */ 1441 extern int (*cl_inet_isclusterwide)(uint8_t protocol, sa_family_t addr_family, 1442 uint8_t *laddrp); 1443 extern uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family, 1444 uint8_t *laddrp, uint8_t *faddrp); 1445 1446 #define CL_INET_CONNECT(tcp) { \ 1447 if (cl_inet_connect != NULL) { \ 1448 /* \ 1449 * Running in cluster mode - register active connection \ 1450 * information \ 1451 */ \ 1452 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1453 if ((tcp)->tcp_ipha->ipha_src != 0) { \ 1454 (*cl_inet_connect)(IPPROTO_TCP, AF_INET,\ 1455 (uint8_t *)(&((tcp)->tcp_ipha->ipha_src)),\ 1456 (in_port_t)(tcp)->tcp_lport, \ 1457 (uint8_t *)(&((tcp)->tcp_ipha->ipha_dst)),\ 1458 (in_port_t)(tcp)->tcp_fport); \ 1459 } \ 1460 } else { \ 1461 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1462 &(tcp)->tcp_ip6h->ip6_src)) {\ 1463 (*cl_inet_connect)(IPPROTO_TCP, AF_INET6,\ 1464 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_src)),\ 1465 (in_port_t)(tcp)->tcp_lport, \ 1466 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_dst)),\ 1467 (in_port_t)(tcp)->tcp_fport); \ 1468 } \ 1469 } \ 1470 } \ 1471 } 1472 1473 #define CL_INET_DISCONNECT(tcp) { \ 1474 if (cl_inet_disconnect != NULL) { \ 1475 /* \ 1476 * Running in cluster mode - deregister active \ 1477 * connection information \ 1478 */ \ 1479 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1480 if ((tcp)->tcp_ip_src != 0) { \ 1481 (*cl_inet_disconnect)(IPPROTO_TCP, \ 1482 AF_INET, \ 1483 (uint8_t *)(&((tcp)->tcp_ip_src)),\ 1484 (in_port_t)(tcp)->tcp_lport, \ 1485 (uint8_t *) \ 1486 (&((tcp)->tcp_ipha->ipha_dst)),\ 1487 (in_port_t)(tcp)->tcp_fport); \ 1488 } \ 1489 } else { \ 1490 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1491 &(tcp)->tcp_ip_src_v6)) { \ 1492 (*cl_inet_disconnect)(IPPROTO_TCP, AF_INET6,\ 1493 (uint8_t *)(&((tcp)->tcp_ip_src_v6)),\ 1494 (in_port_t)(tcp)->tcp_lport, \ 1495 (uint8_t *) \ 1496 (&((tcp)->tcp_ip6h->ip6_dst)),\ 1497 (in_port_t)(tcp)->tcp_fport); \ 1498 } \ 1499 } \ 1500 } \ 1501 } 1502 1503 /* 1504 * Cluster networking hook for traversing current connection list. 1505 * This routine is used to extract the current list of live connections 1506 * which must continue to to be dispatched to this node. 1507 */ 1508 int cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg); 1509 1510 /* 1511 * Figure out the value of window scale opton. Note that the rwnd is 1512 * ASSUMED to be rounded up to the nearest MSS before the calculation. 1513 * We cannot find the scale value and then do a round up of tcp_rwnd 1514 * because the scale value may not be correct after that. 1515 * 1516 * Set the compiler flag to make this function inline. 1517 */ 1518 static void 1519 tcp_set_ws_value(tcp_t *tcp) 1520 { 1521 int i; 1522 uint32_t rwnd = tcp->tcp_rwnd; 1523 1524 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 1525 i++, rwnd >>= 1) 1526 ; 1527 tcp->tcp_rcv_ws = i; 1528 } 1529 1530 /* 1531 * Remove a connection from the list of detached TIME_WAIT connections. 1532 */ 1533 static void 1534 tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait) 1535 { 1536 boolean_t locked = B_FALSE; 1537 1538 if (tcp_time_wait == NULL) { 1539 tcp_time_wait = *((tcp_squeue_priv_t **) 1540 squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); 1541 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1542 locked = B_TRUE; 1543 } 1544 1545 if (tcp->tcp_time_wait_expire == 0) { 1546 ASSERT(tcp->tcp_time_wait_next == NULL); 1547 ASSERT(tcp->tcp_time_wait_prev == NULL); 1548 if (locked) 1549 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1550 return; 1551 } 1552 ASSERT(TCP_IS_DETACHED(tcp)); 1553 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 1554 1555 if (tcp == tcp_time_wait->tcp_time_wait_head) { 1556 ASSERT(tcp->tcp_time_wait_prev == NULL); 1557 tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next; 1558 if (tcp_time_wait->tcp_time_wait_head != NULL) { 1559 tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev = 1560 NULL; 1561 } else { 1562 tcp_time_wait->tcp_time_wait_tail = NULL; 1563 } 1564 } else if (tcp == tcp_time_wait->tcp_time_wait_tail) { 1565 ASSERT(tcp != tcp_time_wait->tcp_time_wait_head); 1566 ASSERT(tcp->tcp_time_wait_next == NULL); 1567 tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev; 1568 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 1569 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL; 1570 } else { 1571 ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp); 1572 ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp); 1573 tcp->tcp_time_wait_prev->tcp_time_wait_next = 1574 tcp->tcp_time_wait_next; 1575 tcp->tcp_time_wait_next->tcp_time_wait_prev = 1576 tcp->tcp_time_wait_prev; 1577 } 1578 tcp->tcp_time_wait_next = NULL; 1579 tcp->tcp_time_wait_prev = NULL; 1580 tcp->tcp_time_wait_expire = 0; 1581 1582 if (locked) 1583 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1584 } 1585 1586 /* 1587 * Add a connection to the list of detached TIME_WAIT connections 1588 * and set its time to expire. 1589 */ 1590 static void 1591 tcp_time_wait_append(tcp_t *tcp) 1592 { 1593 tcp_squeue_priv_t *tcp_time_wait = 1594 *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp, 1595 SQPRIVATE_TCP)); 1596 1597 tcp_timers_stop(tcp); 1598 1599 /* Freed above */ 1600 ASSERT(tcp->tcp_timer_tid == 0); 1601 ASSERT(tcp->tcp_ack_tid == 0); 1602 1603 /* must have happened at the time of detaching the tcp */ 1604 ASSERT(tcp->tcp_ptpahn == NULL); 1605 ASSERT(tcp->tcp_flow_stopped == 0); 1606 ASSERT(tcp->tcp_time_wait_next == NULL); 1607 ASSERT(tcp->tcp_time_wait_prev == NULL); 1608 ASSERT(tcp->tcp_time_wait_expire == NULL); 1609 ASSERT(tcp->tcp_listener == NULL); 1610 1611 tcp->tcp_time_wait_expire = ddi_get_lbolt(); 1612 /* 1613 * The value computed below in tcp->tcp_time_wait_expire may 1614 * appear negative or wrap around. That is ok since our 1615 * interest is only in the difference between the current lbolt 1616 * value and tcp->tcp_time_wait_expire. But the value should not 1617 * be zero, since it means the tcp is not in the TIME_WAIT list. 1618 * The corresponding comparison in tcp_time_wait_collector() uses 1619 * modular arithmetic. 1620 */ 1621 tcp->tcp_time_wait_expire += 1622 drv_usectohz(tcp_time_wait_interval * 1000); 1623 if (tcp->tcp_time_wait_expire == 0) 1624 tcp->tcp_time_wait_expire = 1; 1625 1626 ASSERT(TCP_IS_DETACHED(tcp)); 1627 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 1628 ASSERT(tcp->tcp_time_wait_next == NULL); 1629 ASSERT(tcp->tcp_time_wait_prev == NULL); 1630 TCP_DBGSTAT(tcp_time_wait); 1631 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1632 if (tcp_time_wait->tcp_time_wait_head == NULL) { 1633 ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL); 1634 tcp_time_wait->tcp_time_wait_head = tcp; 1635 } else { 1636 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 1637 ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state == 1638 TCPS_TIME_WAIT); 1639 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp; 1640 tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail; 1641 } 1642 tcp_time_wait->tcp_time_wait_tail = tcp; 1643 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1644 } 1645 1646 /* ARGSUSED */ 1647 void 1648 tcp_timewait_output(void *arg, mblk_t *mp, void *arg2) 1649 { 1650 conn_t *connp = (conn_t *)arg; 1651 tcp_t *tcp = connp->conn_tcp; 1652 1653 ASSERT(tcp != NULL); 1654 if (tcp->tcp_state == TCPS_CLOSED) { 1655 return; 1656 } 1657 1658 ASSERT((tcp->tcp_family == AF_INET && 1659 tcp->tcp_ipversion == IPV4_VERSION) || 1660 (tcp->tcp_family == AF_INET6 && 1661 (tcp->tcp_ipversion == IPV4_VERSION || 1662 tcp->tcp_ipversion == IPV6_VERSION))); 1663 ASSERT(!tcp->tcp_listener); 1664 1665 TCP_STAT(tcp_time_wait_reap); 1666 ASSERT(TCP_IS_DETACHED(tcp)); 1667 1668 /* 1669 * Because they have no upstream client to rebind or tcp_close() 1670 * them later, we axe the connection here and now. 1671 */ 1672 tcp_close_detached(tcp); 1673 } 1674 1675 void 1676 tcp_cleanup(tcp_t *tcp) 1677 { 1678 mblk_t *mp; 1679 char *tcp_iphc; 1680 int tcp_iphc_len; 1681 int tcp_hdr_grown; 1682 tcp_sack_info_t *tcp_sack_info; 1683 conn_t *connp = tcp->tcp_connp; 1684 1685 tcp_bind_hash_remove(tcp); 1686 tcp_free(tcp); 1687 1688 /* Release any SSL context */ 1689 if (tcp->tcp_kssl_ent != NULL) { 1690 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 1691 tcp->tcp_kssl_ent = NULL; 1692 } 1693 1694 if (tcp->tcp_kssl_ctx != NULL) { 1695 kssl_release_ctx(tcp->tcp_kssl_ctx); 1696 tcp->tcp_kssl_ctx = NULL; 1697 } 1698 tcp->tcp_kssl_pending = B_FALSE; 1699 1700 conn_delete_ire(connp, NULL); 1701 if (connp->conn_flags & IPCL_TCPCONN) { 1702 if (connp->conn_latch != NULL) 1703 IPLATCH_REFRELE(connp->conn_latch); 1704 if (connp->conn_policy != NULL) 1705 IPPH_REFRELE(connp->conn_policy); 1706 } 1707 1708 /* 1709 * Since we will bzero the entire structure, we need to 1710 * remove it and reinsert it in global hash list. We 1711 * know the walkers can't get to this conn because we 1712 * had set CONDEMNED flag earlier and checked reference 1713 * under conn_lock so walker won't pick it and when we 1714 * go the ipcl_globalhash_remove() below, no walker 1715 * can get to it. 1716 */ 1717 ipcl_globalhash_remove(connp); 1718 1719 /* Save some state */ 1720 mp = tcp->tcp_timercache; 1721 1722 tcp_sack_info = tcp->tcp_sack_info; 1723 tcp_iphc = tcp->tcp_iphc; 1724 tcp_iphc_len = tcp->tcp_iphc_len; 1725 tcp_hdr_grown = tcp->tcp_hdr_grown; 1726 1727 if (connp->conn_cred != NULL) 1728 crfree(connp->conn_cred); 1729 if (connp->conn_peercred != NULL) 1730 crfree(connp->conn_peercred); 1731 bzero(connp, sizeof (conn_t)); 1732 bzero(tcp, sizeof (tcp_t)); 1733 1734 /* restore the state */ 1735 tcp->tcp_timercache = mp; 1736 1737 tcp->tcp_sack_info = tcp_sack_info; 1738 tcp->tcp_iphc = tcp_iphc; 1739 tcp->tcp_iphc_len = tcp_iphc_len; 1740 tcp->tcp_hdr_grown = tcp_hdr_grown; 1741 1742 1743 tcp->tcp_connp = connp; 1744 1745 connp->conn_tcp = tcp; 1746 connp->conn_flags = IPCL_TCPCONN; 1747 connp->conn_state_flags = CONN_INCIPIENT; 1748 connp->conn_ulp = IPPROTO_TCP; 1749 connp->conn_ref = 1; 1750 1751 ipcl_globalhash_insert(connp); 1752 } 1753 1754 /* 1755 * Blows away all tcps whose TIME_WAIT has expired. List traversal 1756 * is done forwards from the head. 1757 */ 1758 /* ARGSUSED */ 1759 void 1760 tcp_time_wait_collector(void *arg) 1761 { 1762 tcp_t *tcp; 1763 clock_t now; 1764 mblk_t *mp; 1765 conn_t *connp; 1766 kmutex_t *lock; 1767 1768 squeue_t *sqp = (squeue_t *)arg; 1769 tcp_squeue_priv_t *tcp_time_wait = 1770 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1771 1772 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1773 tcp_time_wait->tcp_time_wait_tid = 0; 1774 1775 if (tcp_time_wait->tcp_free_list != NULL && 1776 tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) { 1777 TCP_STAT(tcp_freelist_cleanup); 1778 while ((tcp = tcp_time_wait->tcp_free_list) != NULL) { 1779 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1780 CONN_DEC_REF(tcp->tcp_connp); 1781 } 1782 tcp_time_wait->tcp_free_list_cnt = 0; 1783 } 1784 1785 /* 1786 * In order to reap time waits reliably, we should use a 1787 * source of time that is not adjustable by the user -- hence 1788 * the call to ddi_get_lbolt(). 1789 */ 1790 now = ddi_get_lbolt(); 1791 while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) { 1792 /* 1793 * Compare times using modular arithmetic, since 1794 * lbolt can wrapover. 1795 */ 1796 if ((now - tcp->tcp_time_wait_expire) < 0) { 1797 break; 1798 } 1799 1800 tcp_time_wait_remove(tcp, tcp_time_wait); 1801 1802 connp = tcp->tcp_connp; 1803 ASSERT(connp->conn_fanout != NULL); 1804 lock = &connp->conn_fanout->connf_lock; 1805 /* 1806 * This is essentially a TW reclaim fast path optimization for 1807 * performance where the timewait collector checks under the 1808 * fanout lock (so that no one else can get access to the 1809 * conn_t) that the refcnt is 2 i.e. one for TCP and one for 1810 * the classifier hash list. If ref count is indeed 2, we can 1811 * just remove the conn under the fanout lock and avoid 1812 * cleaning up the conn under the squeue, provided that 1813 * clustering callbacks are not enabled. If clustering is 1814 * enabled, we need to make the clustering callback before 1815 * setting the CONDEMNED flag and after dropping all locks and 1816 * so we forego this optimization and fall back to the slow 1817 * path. Also please see the comments in tcp_closei_local 1818 * regarding the refcnt logic. 1819 * 1820 * Since we are holding the tcp_time_wait_lock, its better 1821 * not to block on the fanout_lock because other connections 1822 * can't add themselves to time_wait list. So we do a 1823 * tryenter instead of mutex_enter. 1824 */ 1825 if (mutex_tryenter(lock)) { 1826 mutex_enter(&connp->conn_lock); 1827 if ((connp->conn_ref == 2) && 1828 (cl_inet_disconnect == NULL)) { 1829 ipcl_hash_remove_locked(connp, 1830 connp->conn_fanout); 1831 /* 1832 * Set the CONDEMNED flag now itself so that 1833 * the refcnt cannot increase due to any 1834 * walker. But we have still not cleaned up 1835 * conn_ire_cache. This is still ok since 1836 * we are going to clean it up in tcp_cleanup 1837 * immediately and any interface unplumb 1838 * thread will wait till the ire is blown away 1839 */ 1840 connp->conn_state_flags |= CONN_CONDEMNED; 1841 mutex_exit(lock); 1842 mutex_exit(&connp->conn_lock); 1843 if (tcp_time_wait->tcp_free_list_cnt < 1844 tcp_free_list_max_cnt) { 1845 /* Add to head of tcp_free_list */ 1846 mutex_exit( 1847 &tcp_time_wait->tcp_time_wait_lock); 1848 tcp_cleanup(tcp); 1849 mutex_enter( 1850 &tcp_time_wait->tcp_time_wait_lock); 1851 tcp->tcp_time_wait_next = 1852 tcp_time_wait->tcp_free_list; 1853 tcp_time_wait->tcp_free_list = tcp; 1854 tcp_time_wait->tcp_free_list_cnt++; 1855 continue; 1856 } else { 1857 /* Do not add to tcp_free_list */ 1858 mutex_exit( 1859 &tcp_time_wait->tcp_time_wait_lock); 1860 tcp_bind_hash_remove(tcp); 1861 conn_delete_ire(tcp->tcp_connp, NULL); 1862 CONN_DEC_REF(tcp->tcp_connp); 1863 } 1864 } else { 1865 CONN_INC_REF_LOCKED(connp); 1866 mutex_exit(lock); 1867 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1868 mutex_exit(&connp->conn_lock); 1869 /* 1870 * We can reuse the closemp here since conn has 1871 * detached (otherwise we wouldn't even be in 1872 * time_wait list). 1873 */ 1874 mp = &tcp->tcp_closemp; 1875 squeue_fill(connp->conn_sqp, mp, 1876 tcp_timewait_output, connp, 1877 SQTAG_TCP_TIMEWAIT); 1878 } 1879 } else { 1880 mutex_enter(&connp->conn_lock); 1881 CONN_INC_REF_LOCKED(connp); 1882 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1883 mutex_exit(&connp->conn_lock); 1884 /* 1885 * We can reuse the closemp here since conn has 1886 * detached (otherwise we wouldn't even be in 1887 * time_wait list). 1888 */ 1889 mp = &tcp->tcp_closemp; 1890 squeue_fill(connp->conn_sqp, mp, 1891 tcp_timewait_output, connp, 0); 1892 } 1893 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1894 } 1895 1896 if (tcp_time_wait->tcp_free_list != NULL) 1897 tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE; 1898 1899 tcp_time_wait->tcp_time_wait_tid = 1900 timeout(tcp_time_wait_collector, sqp, TCP_TIME_WAIT_DELAY); 1901 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1902 } 1903 1904 /* 1905 * Reply to a clients T_CONN_RES TPI message. This function 1906 * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES 1907 * on the acceptor STREAM and processed in tcp_wput_accept(). 1908 * Read the block comment on top of tcp_conn_request(). 1909 */ 1910 static void 1911 tcp_accept(tcp_t *listener, mblk_t *mp) 1912 { 1913 tcp_t *acceptor; 1914 tcp_t *eager; 1915 tcp_t *tcp; 1916 struct T_conn_res *tcr; 1917 t_uscalar_t acceptor_id; 1918 t_scalar_t seqnum; 1919 mblk_t *opt_mp = NULL; /* T_OPTMGMT_REQ messages */ 1920 mblk_t *ok_mp; 1921 mblk_t *mp1; 1922 1923 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 1924 tcp_err_ack(listener, mp, TPROTO, 0); 1925 return; 1926 } 1927 tcr = (struct T_conn_res *)mp->b_rptr; 1928 1929 /* 1930 * Under ILP32 the stream head points tcr->ACCEPTOR_id at the 1931 * read side queue of the streams device underneath us i.e. the 1932 * read side queue of 'ip'. Since we can't deference QUEUE_ptr we 1933 * look it up in the queue_hash. Under LP64 it sends down the 1934 * minor_t of the accepting endpoint. 1935 * 1936 * Once the acceptor/eager are modified (in tcp_accept_swap) the 1937 * fanout hash lock is held. 1938 * This prevents any thread from entering the acceptor queue from 1939 * below (since it has not been hard bound yet i.e. any inbound 1940 * packets will arrive on the listener or default tcp queue and 1941 * go through tcp_lookup). 1942 * The CONN_INC_REF will prevent the acceptor from closing. 1943 * 1944 * XXX It is still possible for a tli application to send down data 1945 * on the accepting stream while another thread calls t_accept. 1946 * This should not be a problem for well-behaved applications since 1947 * the T_OK_ACK is sent after the queue swapping is completed. 1948 * 1949 * If the accepting fd is the same as the listening fd, avoid 1950 * queue hash lookup since that will return an eager listener in a 1951 * already established state. 1952 */ 1953 acceptor_id = tcr->ACCEPTOR_id; 1954 mutex_enter(&listener->tcp_eager_lock); 1955 if (listener->tcp_acceptor_id == acceptor_id) { 1956 eager = listener->tcp_eager_next_q; 1957 /* only count how many T_CONN_INDs so don't count q0 */ 1958 if ((listener->tcp_conn_req_cnt_q != 1) || 1959 (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) { 1960 mutex_exit(&listener->tcp_eager_lock); 1961 tcp_err_ack(listener, mp, TBADF, 0); 1962 return; 1963 } 1964 if (listener->tcp_conn_req_cnt_q0 != 0) { 1965 /* Throw away all the eagers on q0. */ 1966 tcp_eager_cleanup(listener, 1); 1967 } 1968 if (listener->tcp_syn_defense) { 1969 listener->tcp_syn_defense = B_FALSE; 1970 if (listener->tcp_ip_addr_cache != NULL) { 1971 kmem_free(listener->tcp_ip_addr_cache, 1972 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1973 listener->tcp_ip_addr_cache = NULL; 1974 } 1975 } 1976 /* 1977 * Transfer tcp_conn_req_max to the eager so that when 1978 * a disconnect occurs we can revert the endpoint to the 1979 * listen state. 1980 */ 1981 eager->tcp_conn_req_max = listener->tcp_conn_req_max; 1982 ASSERT(listener->tcp_conn_req_cnt_q0 == 0); 1983 /* 1984 * Get a reference on the acceptor just like the 1985 * tcp_acceptor_hash_lookup below. 1986 */ 1987 acceptor = listener; 1988 CONN_INC_REF(acceptor->tcp_connp); 1989 } else { 1990 acceptor = tcp_acceptor_hash_lookup(acceptor_id); 1991 if (acceptor == NULL) { 1992 if (listener->tcp_debug) { 1993 (void) strlog(TCP_MOD_ID, 0, 1, 1994 SL_ERROR|SL_TRACE, 1995 "tcp_accept: did not find acceptor 0x%x\n", 1996 acceptor_id); 1997 } 1998 mutex_exit(&listener->tcp_eager_lock); 1999 tcp_err_ack(listener, mp, TPROVMISMATCH, 0); 2000 return; 2001 } 2002 /* 2003 * Verify acceptor state. The acceptable states for an acceptor 2004 * include TCPS_IDLE and TCPS_BOUND. 2005 */ 2006 switch (acceptor->tcp_state) { 2007 case TCPS_IDLE: 2008 /* FALLTHRU */ 2009 case TCPS_BOUND: 2010 break; 2011 default: 2012 CONN_DEC_REF(acceptor->tcp_connp); 2013 mutex_exit(&listener->tcp_eager_lock); 2014 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2015 return; 2016 } 2017 } 2018 2019 /* The listener must be in TCPS_LISTEN */ 2020 if (listener->tcp_state != TCPS_LISTEN) { 2021 CONN_DEC_REF(acceptor->tcp_connp); 2022 mutex_exit(&listener->tcp_eager_lock); 2023 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2024 return; 2025 } 2026 2027 /* 2028 * Rendezvous with an eager connection request packet hanging off 2029 * 'tcp' that has the 'seqnum' tag. We tagged the detached open 2030 * tcp structure when the connection packet arrived in 2031 * tcp_conn_request(). 2032 */ 2033 seqnum = tcr->SEQ_number; 2034 eager = listener; 2035 do { 2036 eager = eager->tcp_eager_next_q; 2037 if (eager == NULL) { 2038 CONN_DEC_REF(acceptor->tcp_connp); 2039 mutex_exit(&listener->tcp_eager_lock); 2040 tcp_err_ack(listener, mp, TBADSEQ, 0); 2041 return; 2042 } 2043 } while (eager->tcp_conn_req_seqnum != seqnum); 2044 mutex_exit(&listener->tcp_eager_lock); 2045 2046 /* 2047 * At this point, both acceptor and listener have 2 ref 2048 * that they begin with. Acceptor has one additional ref 2049 * we placed in lookup while listener has 3 additional 2050 * ref for being behind the squeue (tcp_accept() is 2051 * done on listener's squeue); being in classifier hash; 2052 * and eager's ref on listener. 2053 */ 2054 ASSERT(listener->tcp_connp->conn_ref >= 5); 2055 ASSERT(acceptor->tcp_connp->conn_ref >= 3); 2056 2057 /* 2058 * The eager at this point is set in its own squeue and 2059 * could easily have been killed (tcp_accept_finish will 2060 * deal with that) because of a TH_RST so we can only 2061 * ASSERT for a single ref. 2062 */ 2063 ASSERT(eager->tcp_connp->conn_ref >= 1); 2064 2065 /* Pre allocate the stroptions mblk also */ 2066 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 2067 if (opt_mp == NULL) { 2068 CONN_DEC_REF(acceptor->tcp_connp); 2069 CONN_DEC_REF(eager->tcp_connp); 2070 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2071 return; 2072 } 2073 DB_TYPE(opt_mp) = M_SETOPTS; 2074 opt_mp->b_wptr += sizeof (struct stroptions); 2075 2076 /* 2077 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 2078 * from listener to acceptor. The message is chained on opt_mp 2079 * which will be sent onto eager's squeue. 2080 */ 2081 if (listener->tcp_bound_if != 0) { 2082 /* allocate optmgmt req */ 2083 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2084 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 2085 sizeof (int)); 2086 if (mp1 != NULL) 2087 linkb(opt_mp, mp1); 2088 } 2089 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 2090 uint_t on = 1; 2091 2092 /* allocate optmgmt req */ 2093 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2094 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 2095 if (mp1 != NULL) 2096 linkb(opt_mp, mp1); 2097 } 2098 2099 /* Re-use mp1 to hold a copy of mp, in case reallocb fails */ 2100 if ((mp1 = copymsg(mp)) == NULL) { 2101 CONN_DEC_REF(acceptor->tcp_connp); 2102 CONN_DEC_REF(eager->tcp_connp); 2103 freemsg(opt_mp); 2104 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2105 return; 2106 } 2107 2108 tcr = (struct T_conn_res *)mp1->b_rptr; 2109 2110 /* 2111 * This is an expanded version of mi_tpi_ok_ack_alloc() 2112 * which allocates a larger mblk and appends the new 2113 * local address to the ok_ack. The address is copied by 2114 * soaccept() for getsockname(). 2115 */ 2116 { 2117 int extra; 2118 2119 extra = (eager->tcp_family == AF_INET) ? 2120 sizeof (sin_t) : sizeof (sin6_t); 2121 2122 /* 2123 * Try to re-use mp, if possible. Otherwise, allocate 2124 * an mblk and return it as ok_mp. In any case, mp 2125 * is no longer usable upon return. 2126 */ 2127 if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) { 2128 CONN_DEC_REF(acceptor->tcp_connp); 2129 CONN_DEC_REF(eager->tcp_connp); 2130 freemsg(opt_mp); 2131 /* Original mp has been freed by now, so use mp1 */ 2132 tcp_err_ack(listener, mp1, TSYSERR, ENOMEM); 2133 return; 2134 } 2135 2136 mp = NULL; /* We should never use mp after this point */ 2137 2138 switch (extra) { 2139 case sizeof (sin_t): { 2140 sin_t *sin = (sin_t *)ok_mp->b_wptr; 2141 2142 ok_mp->b_wptr += extra; 2143 sin->sin_family = AF_INET; 2144 sin->sin_port = eager->tcp_lport; 2145 sin->sin_addr.s_addr = 2146 eager->tcp_ipha->ipha_src; 2147 break; 2148 } 2149 case sizeof (sin6_t): { 2150 sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr; 2151 2152 ok_mp->b_wptr += extra; 2153 sin6->sin6_family = AF_INET6; 2154 sin6->sin6_port = eager->tcp_lport; 2155 if (eager->tcp_ipversion == IPV4_VERSION) { 2156 sin6->sin6_flowinfo = 0; 2157 IN6_IPADDR_TO_V4MAPPED( 2158 eager->tcp_ipha->ipha_src, 2159 &sin6->sin6_addr); 2160 } else { 2161 ASSERT(eager->tcp_ip6h != NULL); 2162 sin6->sin6_flowinfo = 2163 eager->tcp_ip6h->ip6_vcf & 2164 ~IPV6_VERS_AND_FLOW_MASK; 2165 sin6->sin6_addr = 2166 eager->tcp_ip6h->ip6_src; 2167 } 2168 break; 2169 } 2170 default: 2171 break; 2172 } 2173 ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim); 2174 } 2175 2176 /* 2177 * If there are no options we know that the T_CONN_RES will 2178 * succeed. However, we can't send the T_OK_ACK upstream until 2179 * the tcp_accept_swap is done since it would be dangerous to 2180 * let the application start using the new fd prior to the swap. 2181 */ 2182 tcp_accept_swap(listener, acceptor, eager); 2183 2184 /* 2185 * tcp_accept_swap unlinks eager from listener but does not drop 2186 * the eager's reference on the listener. 2187 */ 2188 ASSERT(eager->tcp_listener == NULL); 2189 ASSERT(listener->tcp_connp->conn_ref >= 5); 2190 2191 /* 2192 * The eager is now associated with its own queue. Insert in 2193 * the hash so that the connection can be reused for a future 2194 * T_CONN_RES. 2195 */ 2196 tcp_acceptor_hash_insert(acceptor_id, eager); 2197 2198 /* 2199 * We now do the processing of options with T_CONN_RES. 2200 * We delay till now since we wanted to have queue to pass to 2201 * option processing routines that points back to the right 2202 * instance structure which does not happen until after 2203 * tcp_accept_swap(). 2204 * 2205 * Note: 2206 * The sanity of the logic here assumes that whatever options 2207 * are appropriate to inherit from listner=>eager are done 2208 * before this point, and whatever were to be overridden (or not) 2209 * in transfer logic from eager=>acceptor in tcp_accept_swap(). 2210 * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it 2211 * before its ACCEPTOR_id comes down in T_CONN_RES ] 2212 * This may not be true at this point in time but can be fixed 2213 * independently. This option processing code starts with 2214 * the instantiated acceptor instance and the final queue at 2215 * this point. 2216 */ 2217 2218 if (tcr->OPT_length != 0) { 2219 /* Options to process */ 2220 int t_error = 0; 2221 int sys_error = 0; 2222 int do_disconnect = 0; 2223 2224 if (tcp_conprim_opt_process(eager, mp1, 2225 &do_disconnect, &t_error, &sys_error) < 0) { 2226 eager->tcp_accept_error = 1; 2227 if (do_disconnect) { 2228 /* 2229 * An option failed which does not allow 2230 * connection to be accepted. 2231 * 2232 * We allow T_CONN_RES to succeed and 2233 * put a T_DISCON_IND on the eager queue. 2234 */ 2235 ASSERT(t_error == 0 && sys_error == 0); 2236 eager->tcp_send_discon_ind = 1; 2237 } else { 2238 ASSERT(t_error != 0); 2239 freemsg(ok_mp); 2240 /* 2241 * Original mp was either freed or set 2242 * to ok_mp above, so use mp1 instead. 2243 */ 2244 tcp_err_ack(listener, mp1, t_error, sys_error); 2245 goto finish; 2246 } 2247 } 2248 /* 2249 * Most likely success in setting options (except if 2250 * eager->tcp_send_discon_ind set). 2251 * mp1 option buffer represented by OPT_length/offset 2252 * potentially modified and contains results of setting 2253 * options at this point 2254 */ 2255 } 2256 2257 /* We no longer need mp1, since all options processing has passed */ 2258 freemsg(mp1); 2259 2260 putnext(listener->tcp_rq, ok_mp); 2261 2262 mutex_enter(&listener->tcp_eager_lock); 2263 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 2264 tcp_t *tail; 2265 mblk_t *conn_ind; 2266 2267 /* 2268 * This path should not be executed if listener and 2269 * acceptor streams are the same. 2270 */ 2271 ASSERT(listener != acceptor); 2272 2273 tcp = listener->tcp_eager_prev_q0; 2274 /* 2275 * listener->tcp_eager_prev_q0 points to the TAIL of the 2276 * deferred T_conn_ind queue. We need to get to the head of 2277 * the queue in order to send up T_conn_ind the same order as 2278 * how the 3WHS is completed. 2279 */ 2280 while (tcp != listener) { 2281 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 2282 break; 2283 else 2284 tcp = tcp->tcp_eager_prev_q0; 2285 } 2286 ASSERT(tcp != listener); 2287 conn_ind = tcp->tcp_conn.tcp_eager_conn_ind; 2288 ASSERT(conn_ind != NULL); 2289 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 2290 2291 /* Move from q0 to q */ 2292 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 2293 listener->tcp_conn_req_cnt_q0--; 2294 listener->tcp_conn_req_cnt_q++; 2295 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 2296 tcp->tcp_eager_prev_q0; 2297 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 2298 tcp->tcp_eager_next_q0; 2299 tcp->tcp_eager_prev_q0 = NULL; 2300 tcp->tcp_eager_next_q0 = NULL; 2301 tcp->tcp_conn_def_q0 = B_FALSE; 2302 2303 /* 2304 * Insert at end of the queue because sockfs sends 2305 * down T_CONN_RES in chronological order. Leaving 2306 * the older conn indications at front of the queue 2307 * helps reducing search time. 2308 */ 2309 tail = listener->tcp_eager_last_q; 2310 if (tail != NULL) 2311 tail->tcp_eager_next_q = tcp; 2312 else 2313 listener->tcp_eager_next_q = tcp; 2314 listener->tcp_eager_last_q = tcp; 2315 tcp->tcp_eager_next_q = NULL; 2316 mutex_exit(&listener->tcp_eager_lock); 2317 putnext(tcp->tcp_rq, conn_ind); 2318 } else { 2319 mutex_exit(&listener->tcp_eager_lock); 2320 } 2321 2322 /* 2323 * Done with the acceptor - free it 2324 * 2325 * Note: from this point on, no access to listener should be made 2326 * as listener can be equal to acceptor. 2327 */ 2328 finish: 2329 ASSERT(acceptor->tcp_detached); 2330 acceptor->tcp_rq = tcp_g_q; 2331 acceptor->tcp_wq = WR(tcp_g_q); 2332 (void) tcp_clean_death(acceptor, 0, 2); 2333 CONN_DEC_REF(acceptor->tcp_connp); 2334 2335 /* 2336 * In case we already received a FIN we have to make tcp_rput send 2337 * the ordrel_ind. This will also send up a window update if the window 2338 * has opened up. 2339 * 2340 * In the normal case of a successful connection acceptance 2341 * we give the O_T_BIND_REQ to the read side put procedure as an 2342 * indication that this was just accepted. This tells tcp_rput to 2343 * pass up any data queued in tcp_rcv_list. 2344 * 2345 * In the fringe case where options sent with T_CONN_RES failed and 2346 * we required, we would be indicating a T_DISCON_IND to blow 2347 * away this connection. 2348 */ 2349 2350 /* 2351 * XXX: we currently have a problem if XTI application closes the 2352 * acceptor stream in between. This problem exists in on10-gate also 2353 * and is well know but nothing can be done short of major rewrite 2354 * to fix it. Now it is possible to take care of it by assigning TLI/XTI 2355 * eager same squeue as listener (we can distinguish non socket 2356 * listeners at the time of handling a SYN in tcp_conn_request) 2357 * and do most of the work that tcp_accept_finish does here itself 2358 * and then get behind the acceptor squeue to access the acceptor 2359 * queue. 2360 */ 2361 /* 2362 * We already have a ref on tcp so no need to do one before squeue_fill 2363 */ 2364 squeue_fill(eager->tcp_connp->conn_sqp, opt_mp, 2365 tcp_accept_finish, eager->tcp_connp, SQTAG_TCP_ACCEPT_FINISH); 2366 } 2367 2368 /* 2369 * Swap information between the eager and acceptor for a TLI/XTI client. 2370 * The sockfs accept is done on the acceptor stream and control goes 2371 * through tcp_wput_accept() and tcp_accept()/tcp_accept_swap() is not 2372 * called. In either case, both the eager and listener are in their own 2373 * perimeter (squeue) and the code has to deal with potential race. 2374 * 2375 * See the block comment on top of tcp_accept() and tcp_wput_accept(). 2376 */ 2377 static void 2378 tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager) 2379 { 2380 conn_t *econnp, *aconnp; 2381 2382 ASSERT(eager->tcp_rq == listener->tcp_rq); 2383 ASSERT(eager->tcp_detached && !acceptor->tcp_detached); 2384 ASSERT(!eager->tcp_hard_bound); 2385 ASSERT(!TCP_IS_SOCKET(acceptor)); 2386 ASSERT(!TCP_IS_SOCKET(eager)); 2387 ASSERT(!TCP_IS_SOCKET(listener)); 2388 2389 acceptor->tcp_detached = B_TRUE; 2390 /* 2391 * To permit stream re-use by TLI/XTI, the eager needs a copy of 2392 * the acceptor id. 2393 */ 2394 eager->tcp_acceptor_id = acceptor->tcp_acceptor_id; 2395 2396 /* remove eager from listen list... */ 2397 mutex_enter(&listener->tcp_eager_lock); 2398 tcp_eager_unlink(eager); 2399 ASSERT(eager->tcp_eager_next_q == NULL && 2400 eager->tcp_eager_last_q == NULL); 2401 ASSERT(eager->tcp_eager_next_q0 == NULL && 2402 eager->tcp_eager_prev_q0 == NULL); 2403 mutex_exit(&listener->tcp_eager_lock); 2404 eager->tcp_rq = acceptor->tcp_rq; 2405 eager->tcp_wq = acceptor->tcp_wq; 2406 2407 econnp = eager->tcp_connp; 2408 aconnp = acceptor->tcp_connp; 2409 2410 eager->tcp_rq->q_ptr = econnp; 2411 eager->tcp_wq->q_ptr = econnp; 2412 2413 /* 2414 * In the TLI/XTI loopback case, we are inside the listener's squeue, 2415 * which might be a different squeue from our peer TCP instance. 2416 * For TCP Fusion, the peer expects that whenever tcp_detached is 2417 * clear, our TCP queues point to the acceptor's queues. Thus, use 2418 * membar_producer() to ensure that the assignments of tcp_rq/tcp_wq 2419 * above reach global visibility prior to the clearing of tcp_detached. 2420 */ 2421 membar_producer(); 2422 eager->tcp_detached = B_FALSE; 2423 2424 ASSERT(eager->tcp_ack_tid == 0); 2425 2426 econnp->conn_dev = aconnp->conn_dev; 2427 if (eager->tcp_cred != NULL) 2428 crfree(eager->tcp_cred); 2429 eager->tcp_cred = econnp->conn_cred = aconnp->conn_cred; 2430 aconnp->conn_cred = NULL; 2431 2432 econnp->conn_zoneid = aconnp->conn_zoneid; 2433 econnp->conn_allzones = aconnp->conn_allzones; 2434 2435 econnp->conn_mac_exempt = aconnp->conn_mac_exempt; 2436 aconnp->conn_mac_exempt = B_FALSE; 2437 2438 ASSERT(aconnp->conn_peercred == NULL); 2439 2440 /* Do the IPC initialization */ 2441 CONN_INC_REF(econnp); 2442 2443 econnp->conn_multicast_loop = aconnp->conn_multicast_loop; 2444 econnp->conn_af_isv6 = aconnp->conn_af_isv6; 2445 econnp->conn_pkt_isv6 = aconnp->conn_pkt_isv6; 2446 econnp->conn_ulp = aconnp->conn_ulp; 2447 2448 /* Done with old IPC. Drop its ref on its connp */ 2449 CONN_DEC_REF(aconnp); 2450 } 2451 2452 2453 /* 2454 * Adapt to the information, such as rtt and rtt_sd, provided from the 2455 * ire cached in conn_cache_ire. If no ire cached, do a ire lookup. 2456 * 2457 * Checks for multicast and broadcast destination address. 2458 * Returns zero on failure; non-zero if ok. 2459 * 2460 * Note that the MSS calculation here is based on the info given in 2461 * the IRE. We do not do any calculation based on TCP options. They 2462 * will be handled in tcp_rput_other() and tcp_rput_data() when TCP 2463 * knows which options to use. 2464 * 2465 * Note on how TCP gets its parameters for a connection. 2466 * 2467 * When a tcp_t structure is allocated, it gets all the default parameters. 2468 * In tcp_adapt_ire(), it gets those metric parameters, like rtt, rtt_sd, 2469 * spipe, rpipe, ... from the route metrics. Route metric overrides the 2470 * default. But if there is an associated tcp_host_param, it will override 2471 * the metrics. 2472 * 2473 * An incoming SYN with a multicast or broadcast destination address, is dropped 2474 * in 1 of 2 places. 2475 * 2476 * 1. If the packet was received over the wire it is dropped in 2477 * ip_rput_process_broadcast() 2478 * 2479 * 2. If the packet was received through internal IP loopback, i.e. the packet 2480 * was generated and received on the same machine, it is dropped in 2481 * ip_wput_local() 2482 * 2483 * An incoming SYN with a multicast or broadcast source address is always 2484 * dropped in tcp_adapt_ire. The same logic in tcp_adapt_ire also serves to 2485 * reject an attempt to connect to a broadcast or multicast (destination) 2486 * address. 2487 */ 2488 static int 2489 tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp) 2490 { 2491 tcp_hsp_t *hsp; 2492 ire_t *ire; 2493 ire_t *sire = NULL; 2494 iulp_t *ire_uinfo = NULL; 2495 uint32_t mss_max; 2496 uint32_t mss; 2497 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 2498 conn_t *connp = tcp->tcp_connp; 2499 boolean_t ire_cacheable = B_FALSE; 2500 zoneid_t zoneid = connp->conn_zoneid; 2501 int match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | 2502 MATCH_IRE_SECATTR; 2503 ts_label_t *tsl = crgetlabel(CONN_CRED(connp)); 2504 ill_t *ill = NULL; 2505 boolean_t incoming = (ire_mp == NULL); 2506 2507 ASSERT(connp->conn_ire_cache == NULL); 2508 2509 if (tcp->tcp_ipversion == IPV4_VERSION) { 2510 2511 if (CLASSD(tcp->tcp_connp->conn_rem)) { 2512 BUMP_MIB(&ip_mib, ipInDiscards); 2513 return (0); 2514 } 2515 /* 2516 * If IP_NEXTHOP is set, then look for an IRE_CACHE 2517 * for the destination with the nexthop as gateway. 2518 * ire_ctable_lookup() is used because this particular 2519 * ire, if it exists, will be marked private. 2520 * If that is not available, use the interface ire 2521 * for the nexthop. 2522 * 2523 * TSol: tcp_update_label will detect label mismatches based 2524 * only on the destination's label, but that would not 2525 * detect label mismatches based on the security attributes 2526 * of routes or next hop gateway. Hence we need to pass the 2527 * label to ire_ftable_lookup below in order to locate the 2528 * right prefix (and/or) ire cache. Similarly we also need 2529 * pass the label to the ire_cache_lookup below to locate 2530 * the right ire that also matches on the label. 2531 */ 2532 if (tcp->tcp_connp->conn_nexthop_set) { 2533 ire = ire_ctable_lookup(tcp->tcp_connp->conn_rem, 2534 tcp->tcp_connp->conn_nexthop_v4, 0, NULL, zoneid, 2535 tsl, MATCH_IRE_MARK_PRIVATE_ADDR | MATCH_IRE_GW); 2536 if (ire == NULL) { 2537 ire = ire_ftable_lookup( 2538 tcp->tcp_connp->conn_nexthop_v4, 2539 0, 0, IRE_INTERFACE, NULL, NULL, zoneid, 0, 2540 tsl, match_flags); 2541 if (ire == NULL) 2542 return (0); 2543 } else { 2544 ire_uinfo = &ire->ire_uinfo; 2545 } 2546 } else { 2547 ire = ire_cache_lookup(tcp->tcp_connp->conn_rem, 2548 zoneid, tsl); 2549 if (ire != NULL) { 2550 ire_cacheable = B_TRUE; 2551 ire_uinfo = (ire_mp != NULL) ? 2552 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 2553 &ire->ire_uinfo; 2554 2555 } else { 2556 if (ire_mp == NULL) { 2557 ire = ire_ftable_lookup( 2558 tcp->tcp_connp->conn_rem, 2559 0, 0, 0, NULL, &sire, zoneid, 0, 2560 tsl, (MATCH_IRE_RECURSIVE | 2561 MATCH_IRE_DEFAULT)); 2562 if (ire == NULL) 2563 return (0); 2564 ire_uinfo = (sire != NULL) ? 2565 &sire->ire_uinfo : 2566 &ire->ire_uinfo; 2567 } else { 2568 ire = (ire_t *)ire_mp->b_rptr; 2569 ire_uinfo = 2570 &((ire_t *) 2571 ire_mp->b_rptr)->ire_uinfo; 2572 } 2573 } 2574 } 2575 ASSERT(ire != NULL); 2576 2577 if ((ire->ire_src_addr == INADDR_ANY) || 2578 (ire->ire_type & IRE_BROADCAST)) { 2579 /* 2580 * ire->ire_mp is non null when ire_mp passed in is used 2581 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 2582 */ 2583 if (ire->ire_mp == NULL) 2584 ire_refrele(ire); 2585 if (sire != NULL) 2586 ire_refrele(sire); 2587 return (0); 2588 } 2589 2590 if (tcp->tcp_ipha->ipha_src == INADDR_ANY) { 2591 ipaddr_t src_addr; 2592 2593 /* 2594 * ip_bind_connected() has stored the correct source 2595 * address in conn_src. 2596 */ 2597 src_addr = tcp->tcp_connp->conn_src; 2598 tcp->tcp_ipha->ipha_src = src_addr; 2599 /* 2600 * Copy of the src addr. in tcp_t is needed 2601 * for the lookup funcs. 2602 */ 2603 IN6_IPADDR_TO_V4MAPPED(src_addr, &tcp->tcp_ip_src_v6); 2604 } 2605 /* 2606 * Set the fragment bit so that IP will tell us if the MTU 2607 * should change. IP tells us the latest setting of 2608 * ip_path_mtu_discovery through ire_frag_flag. 2609 */ 2610 if (ip_path_mtu_discovery) { 2611 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 2612 htons(IPH_DF); 2613 } 2614 /* 2615 * If ire_uinfo is NULL, this is the IRE_INTERFACE case 2616 * for IP_NEXTHOP. No cache ire has been found for the 2617 * destination and we are working with the nexthop's 2618 * interface ire. Since we need to forward all packets 2619 * to the nexthop first, we "blindly" set tcp_localnet 2620 * to false, eventhough the destination may also be 2621 * onlink. 2622 */ 2623 if (ire_uinfo == NULL) 2624 tcp->tcp_localnet = 0; 2625 else 2626 tcp->tcp_localnet = (ire->ire_gateway_addr == 0); 2627 } else { 2628 /* 2629 * For incoming connection ire_mp = NULL 2630 * For outgoing connection ire_mp != NULL 2631 * Technically we should check conn_incoming_ill 2632 * when ire_mp is NULL and conn_outgoing_ill when 2633 * ire_mp is non-NULL. But this is performance 2634 * critical path and for IPV*_BOUND_IF, outgoing 2635 * and incoming ill are always set to the same value. 2636 */ 2637 ill_t *dst_ill = NULL; 2638 ipif_t *dst_ipif = NULL; 2639 2640 ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill); 2641 2642 if (connp->conn_outgoing_ill != NULL) { 2643 /* Outgoing or incoming path */ 2644 int err; 2645 2646 dst_ill = conn_get_held_ill(connp, 2647 &connp->conn_outgoing_ill, &err); 2648 if (err == ILL_LOOKUP_FAILED || dst_ill == NULL) { 2649 ip1dbg(("tcp_adapt_ire: ill_lookup failed\n")); 2650 return (0); 2651 } 2652 match_flags |= MATCH_IRE_ILL; 2653 dst_ipif = dst_ill->ill_ipif; 2654 } 2655 ire = ire_ctable_lookup_v6(&tcp->tcp_connp->conn_remv6, 2656 0, 0, dst_ipif, zoneid, tsl, match_flags); 2657 2658 if (ire != NULL) { 2659 ire_cacheable = B_TRUE; 2660 ire_uinfo = (ire_mp != NULL) ? 2661 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 2662 &ire->ire_uinfo; 2663 } else { 2664 if (ire_mp == NULL) { 2665 ire = ire_ftable_lookup_v6( 2666 &tcp->tcp_connp->conn_remv6, 2667 0, 0, 0, dst_ipif, &sire, zoneid, 2668 0, tsl, match_flags); 2669 if (ire == NULL) { 2670 if (dst_ill != NULL) 2671 ill_refrele(dst_ill); 2672 return (0); 2673 } 2674 ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : 2675 &ire->ire_uinfo; 2676 } else { 2677 ire = (ire_t *)ire_mp->b_rptr; 2678 ire_uinfo = 2679 &((ire_t *)ire_mp->b_rptr)->ire_uinfo; 2680 } 2681 } 2682 if (dst_ill != NULL) 2683 ill_refrele(dst_ill); 2684 2685 ASSERT(ire != NULL); 2686 ASSERT(ire_uinfo != NULL); 2687 2688 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) || 2689 IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) { 2690 /* 2691 * ire->ire_mp is non null when ire_mp passed in is used 2692 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 2693 */ 2694 if (ire->ire_mp == NULL) 2695 ire_refrele(ire); 2696 if (sire != NULL) 2697 ire_refrele(sire); 2698 return (0); 2699 } 2700 2701 if (IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 2702 in6_addr_t src_addr; 2703 2704 /* 2705 * ip_bind_connected_v6() has stored the correct source 2706 * address per IPv6 addr. selection policy in 2707 * conn_src_v6. 2708 */ 2709 src_addr = tcp->tcp_connp->conn_srcv6; 2710 2711 tcp->tcp_ip6h->ip6_src = src_addr; 2712 /* 2713 * Copy of the src addr. in tcp_t is needed 2714 * for the lookup funcs. 2715 */ 2716 tcp->tcp_ip_src_v6 = src_addr; 2717 ASSERT(IN6_ARE_ADDR_EQUAL(&tcp->tcp_ip6h->ip6_src, 2718 &connp->conn_srcv6)); 2719 } 2720 tcp->tcp_localnet = 2721 IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6); 2722 } 2723 2724 /* 2725 * This allows applications to fail quickly when connections are made 2726 * to dead hosts. Hosts can be labeled dead by adding a reject route 2727 * with both the RTF_REJECT and RTF_PRIVATE flags set. 2728 */ 2729 if ((ire->ire_flags & RTF_REJECT) && 2730 (ire->ire_flags & RTF_PRIVATE)) 2731 goto error; 2732 2733 /* 2734 * Make use of the cached rtt and rtt_sd values to calculate the 2735 * initial RTO. Note that they are already initialized in 2736 * tcp_init_values(). 2737 * If ire_uinfo is NULL, i.e., we do not have a cache ire for 2738 * IP_NEXTHOP, but instead are using the interface ire for the 2739 * nexthop, then we do not use the ire_uinfo from that ire to 2740 * do any initializations. 2741 */ 2742 if (ire_uinfo != NULL) { 2743 if (ire_uinfo->iulp_rtt != 0) { 2744 clock_t rto; 2745 2746 tcp->tcp_rtt_sa = ire_uinfo->iulp_rtt; 2747 tcp->tcp_rtt_sd = ire_uinfo->iulp_rtt_sd; 2748 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 2749 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5); 2750 2751 if (rto > tcp_rexmit_interval_max) { 2752 tcp->tcp_rto = tcp_rexmit_interval_max; 2753 } else if (rto < tcp_rexmit_interval_min) { 2754 tcp->tcp_rto = tcp_rexmit_interval_min; 2755 } else { 2756 tcp->tcp_rto = rto; 2757 } 2758 } 2759 if (ire_uinfo->iulp_ssthresh != 0) 2760 tcp->tcp_cwnd_ssthresh = ire_uinfo->iulp_ssthresh; 2761 else 2762 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2763 if (ire_uinfo->iulp_spipe > 0) { 2764 tcp->tcp_xmit_hiwater = MIN(ire_uinfo->iulp_spipe, 2765 tcp_max_buf); 2766 if (tcp_snd_lowat_fraction != 0) 2767 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 2768 tcp_snd_lowat_fraction; 2769 (void) tcp_maxpsz_set(tcp, B_TRUE); 2770 } 2771 /* 2772 * Note that up till now, acceptor always inherits receive 2773 * window from the listener. But if there is a metrics 2774 * associated with a host, we should use that instead of 2775 * inheriting it from listener. Thus we need to pass this 2776 * info back to the caller. 2777 */ 2778 if (ire_uinfo->iulp_rpipe > 0) { 2779 tcp->tcp_rwnd = MIN(ire_uinfo->iulp_rpipe, tcp_max_buf); 2780 } 2781 2782 if (ire_uinfo->iulp_rtomax > 0) { 2783 tcp->tcp_second_timer_threshold = 2784 ire_uinfo->iulp_rtomax; 2785 } 2786 2787 /* 2788 * Use the metric option settings, iulp_tstamp_ok and 2789 * iulp_wscale_ok, only for active open. What this means 2790 * is that if the other side uses timestamp or window 2791 * scale option, TCP will also use those options. That 2792 * is for passive open. If the application sets a 2793 * large window, window scale is enabled regardless of 2794 * the value in iulp_wscale_ok. This is the behavior 2795 * since 2.6. So we keep it. 2796 * The only case left in passive open processing is the 2797 * check for SACK. 2798 * For ECN, it should probably be like SACK. But the 2799 * current value is binary, so we treat it like the other 2800 * cases. The metric only controls active open.For passive 2801 * open, the ndd param, tcp_ecn_permitted, controls the 2802 * behavior. 2803 */ 2804 if (!tcp_detached) { 2805 /* 2806 * The if check means that the following can only 2807 * be turned on by the metrics only IRE, but not off. 2808 */ 2809 if (ire_uinfo->iulp_tstamp_ok) 2810 tcp->tcp_snd_ts_ok = B_TRUE; 2811 if (ire_uinfo->iulp_wscale_ok) 2812 tcp->tcp_snd_ws_ok = B_TRUE; 2813 if (ire_uinfo->iulp_sack == 2) 2814 tcp->tcp_snd_sack_ok = B_TRUE; 2815 if (ire_uinfo->iulp_ecn_ok) 2816 tcp->tcp_ecn_ok = B_TRUE; 2817 } else { 2818 /* 2819 * Passive open. 2820 * 2821 * As above, the if check means that SACK can only be 2822 * turned on by the metric only IRE. 2823 */ 2824 if (ire_uinfo->iulp_sack > 0) { 2825 tcp->tcp_snd_sack_ok = B_TRUE; 2826 } 2827 } 2828 } 2829 2830 2831 /* 2832 * XXX: Note that currently, ire_max_frag can be as small as 68 2833 * because of PMTUd. So tcp_mss may go to negative if combined 2834 * length of all those options exceeds 28 bytes. But because 2835 * of the tcp_mss_min check below, we may not have a problem if 2836 * tcp_mss_min is of a reasonable value. The default is 1 so 2837 * the negative problem still exists. And the check defeats PMTUd. 2838 * In fact, if PMTUd finds that the MSS should be smaller than 2839 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 2840 * value. 2841 * 2842 * We do not deal with that now. All those problems related to 2843 * PMTUd will be fixed later. 2844 */ 2845 ASSERT(ire->ire_max_frag != 0); 2846 mss = tcp->tcp_if_mtu = ire->ire_max_frag; 2847 if (tcp->tcp_ipp_fields & IPPF_USE_MIN_MTU) { 2848 if (tcp->tcp_ipp_use_min_mtu == IPV6_USE_MIN_MTU_NEVER) { 2849 mss = MIN(mss, IPV6_MIN_MTU); 2850 } 2851 } 2852 2853 /* Sanity check for MSS value. */ 2854 if (tcp->tcp_ipversion == IPV4_VERSION) 2855 mss_max = tcp_mss_max_ipv4; 2856 else 2857 mss_max = tcp_mss_max_ipv6; 2858 2859 if (tcp->tcp_ipversion == IPV6_VERSION && 2860 (ire->ire_frag_flag & IPH_FRAG_HDR)) { 2861 /* 2862 * After receiving an ICMPv6 "packet too big" message with a 2863 * MTU < 1280, and for multirouted IPv6 packets, the IP layer 2864 * will insert a 8-byte fragment header in every packet; we 2865 * reduce the MSS by that amount here. 2866 */ 2867 mss -= sizeof (ip6_frag_t); 2868 } 2869 2870 if (tcp->tcp_ipsec_overhead == 0) 2871 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 2872 2873 mss -= tcp->tcp_ipsec_overhead; 2874 2875 if (mss < tcp_mss_min) 2876 mss = tcp_mss_min; 2877 if (mss > mss_max) 2878 mss = mss_max; 2879 2880 /* Note that this is the maximum MSS, excluding all options. */ 2881 tcp->tcp_mss = mss; 2882 2883 /* 2884 * Initialize the ISS here now that we have the full connection ID. 2885 * The RFC 1948 method of initial sequence number generation requires 2886 * knowledge of the full connection ID before setting the ISS. 2887 */ 2888 2889 tcp_iss_init(tcp); 2890 2891 if (ire->ire_type & (IRE_LOOPBACK | IRE_LOCAL)) 2892 tcp->tcp_loopback = B_TRUE; 2893 2894 if (tcp->tcp_ipversion == IPV4_VERSION) { 2895 hsp = tcp_hsp_lookup(tcp->tcp_remote); 2896 } else { 2897 hsp = tcp_hsp_lookup_ipv6(&tcp->tcp_remote_v6); 2898 } 2899 2900 if (hsp != NULL) { 2901 /* Only modify if we're going to make them bigger */ 2902 if (hsp->tcp_hsp_sendspace > tcp->tcp_xmit_hiwater) { 2903 tcp->tcp_xmit_hiwater = hsp->tcp_hsp_sendspace; 2904 if (tcp_snd_lowat_fraction != 0) 2905 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 2906 tcp_snd_lowat_fraction; 2907 } 2908 2909 if (hsp->tcp_hsp_recvspace > tcp->tcp_rwnd) { 2910 tcp->tcp_rwnd = hsp->tcp_hsp_recvspace; 2911 } 2912 2913 /* Copy timestamp flag only for active open */ 2914 if (!tcp_detached) 2915 tcp->tcp_snd_ts_ok = hsp->tcp_hsp_tstamp; 2916 } 2917 2918 if (sire != NULL) 2919 IRE_REFRELE(sire); 2920 2921 /* 2922 * If we got an IRE_CACHE and an ILL, go through their properties; 2923 * otherwise, this is deferred until later when we have an IRE_CACHE. 2924 */ 2925 if (tcp->tcp_loopback || 2926 (ire_cacheable && (ill = ire_to_ill(ire)) != NULL)) { 2927 /* 2928 * For incoming, see if this tcp may be MDT-capable. For 2929 * outgoing, this process has been taken care of through 2930 * tcp_rput_other. 2931 */ 2932 tcp_ire_ill_check(tcp, ire, ill, incoming); 2933 tcp->tcp_ire_ill_check_done = B_TRUE; 2934 } 2935 2936 mutex_enter(&connp->conn_lock); 2937 /* 2938 * Make sure that conn is not marked incipient 2939 * for incoming connections. A blind 2940 * removal of incipient flag is cheaper than 2941 * check and removal. 2942 */ 2943 connp->conn_state_flags &= ~CONN_INCIPIENT; 2944 2945 /* Must not cache forwarding table routes. */ 2946 if (ire_cacheable) { 2947 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 2948 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 2949 connp->conn_ire_cache = ire; 2950 IRE_UNTRACE_REF(ire); 2951 rw_exit(&ire->ire_bucket->irb_lock); 2952 mutex_exit(&connp->conn_lock); 2953 return (1); 2954 } 2955 rw_exit(&ire->ire_bucket->irb_lock); 2956 } 2957 mutex_exit(&connp->conn_lock); 2958 2959 if (ire->ire_mp == NULL) 2960 ire_refrele(ire); 2961 return (1); 2962 2963 error: 2964 if (ire->ire_mp == NULL) 2965 ire_refrele(ire); 2966 if (sire != NULL) 2967 ire_refrele(sire); 2968 return (0); 2969 } 2970 2971 /* 2972 * tcp_bind is called (holding the writer lock) by tcp_wput_proto to process a 2973 * O_T_BIND_REQ/T_BIND_REQ message. 2974 */ 2975 static void 2976 tcp_bind(tcp_t *tcp, mblk_t *mp) 2977 { 2978 sin_t *sin; 2979 sin6_t *sin6; 2980 mblk_t *mp1; 2981 in_port_t requested_port; 2982 in_port_t allocated_port; 2983 struct T_bind_req *tbr; 2984 boolean_t bind_to_req_port_only; 2985 boolean_t backlog_update = B_FALSE; 2986 boolean_t user_specified; 2987 in6_addr_t v6addr; 2988 ipaddr_t v4addr; 2989 uint_t origipversion; 2990 int err; 2991 queue_t *q = tcp->tcp_wq; 2992 conn_t *connp; 2993 mlp_type_t addrtype, mlptype; 2994 zone_t *zone; 2995 cred_t *cr; 2996 in_port_t mlp_port; 2997 2998 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 2999 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 3000 if (tcp->tcp_debug) { 3001 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 3002 "tcp_bind: bad req, len %u", 3003 (uint_t)(mp->b_wptr - mp->b_rptr)); 3004 } 3005 tcp_err_ack(tcp, mp, TPROTO, 0); 3006 return; 3007 } 3008 /* Make sure the largest address fits */ 3009 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1); 3010 if (mp1 == NULL) { 3011 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3012 return; 3013 } 3014 mp = mp1; 3015 tbr = (struct T_bind_req *)mp->b_rptr; 3016 if (tcp->tcp_state >= TCPS_BOUND) { 3017 if ((tcp->tcp_state == TCPS_BOUND || 3018 tcp->tcp_state == TCPS_LISTEN) && 3019 tcp->tcp_conn_req_max != tbr->CONIND_number && 3020 tbr->CONIND_number > 0) { 3021 /* 3022 * Handle listen() increasing CONIND_number. 3023 * This is more "liberal" then what the TPI spec 3024 * requires but is needed to avoid a t_unbind 3025 * when handling listen() since the port number 3026 * might be "stolen" between the unbind and bind. 3027 */ 3028 backlog_update = B_TRUE; 3029 goto do_bind; 3030 } 3031 if (tcp->tcp_debug) { 3032 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 3033 "tcp_bind: bad state, %d", tcp->tcp_state); 3034 } 3035 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 3036 return; 3037 } 3038 origipversion = tcp->tcp_ipversion; 3039 3040 switch (tbr->ADDR_length) { 3041 case 0: /* request for a generic port */ 3042 tbr->ADDR_offset = sizeof (struct T_bind_req); 3043 if (tcp->tcp_family == AF_INET) { 3044 tbr->ADDR_length = sizeof (sin_t); 3045 sin = (sin_t *)&tbr[1]; 3046 *sin = sin_null; 3047 sin->sin_family = AF_INET; 3048 mp->b_wptr = (uchar_t *)&sin[1]; 3049 tcp->tcp_ipversion = IPV4_VERSION; 3050 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &v6addr); 3051 } else { 3052 ASSERT(tcp->tcp_family == AF_INET6); 3053 tbr->ADDR_length = sizeof (sin6_t); 3054 sin6 = (sin6_t *)&tbr[1]; 3055 *sin6 = sin6_null; 3056 sin6->sin6_family = AF_INET6; 3057 mp->b_wptr = (uchar_t *)&sin6[1]; 3058 tcp->tcp_ipversion = IPV6_VERSION; 3059 V6_SET_ZERO(v6addr); 3060 } 3061 requested_port = 0; 3062 break; 3063 3064 case sizeof (sin_t): /* Complete IPv4 address */ 3065 sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset, 3066 sizeof (sin_t)); 3067 if (sin == NULL || !OK_32PTR((char *)sin)) { 3068 if (tcp->tcp_debug) { 3069 (void) strlog(TCP_MOD_ID, 0, 1, 3070 SL_ERROR|SL_TRACE, 3071 "tcp_bind: bad address parameter, " 3072 "offset %d, len %d", 3073 tbr->ADDR_offset, tbr->ADDR_length); 3074 } 3075 tcp_err_ack(tcp, mp, TPROTO, 0); 3076 return; 3077 } 3078 /* 3079 * With sockets sockfs will accept bogus sin_family in 3080 * bind() and replace it with the family used in the socket 3081 * call. 3082 */ 3083 if (sin->sin_family != AF_INET || 3084 tcp->tcp_family != AF_INET) { 3085 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3086 return; 3087 } 3088 requested_port = ntohs(sin->sin_port); 3089 tcp->tcp_ipversion = IPV4_VERSION; 3090 v4addr = sin->sin_addr.s_addr; 3091 IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr); 3092 break; 3093 3094 case sizeof (sin6_t): /* Complete IPv6 address */ 3095 sin6 = (sin6_t *)mi_offset_param(mp, 3096 tbr->ADDR_offset, sizeof (sin6_t)); 3097 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 3098 if (tcp->tcp_debug) { 3099 (void) strlog(TCP_MOD_ID, 0, 1, 3100 SL_ERROR|SL_TRACE, 3101 "tcp_bind: bad IPv6 address parameter, " 3102 "offset %d, len %d", tbr->ADDR_offset, 3103 tbr->ADDR_length); 3104 } 3105 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 3106 return; 3107 } 3108 if (sin6->sin6_family != AF_INET6 || 3109 tcp->tcp_family != AF_INET6) { 3110 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3111 return; 3112 } 3113 requested_port = ntohs(sin6->sin6_port); 3114 tcp->tcp_ipversion = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? 3115 IPV4_VERSION : IPV6_VERSION; 3116 v6addr = sin6->sin6_addr; 3117 break; 3118 3119 default: 3120 if (tcp->tcp_debug) { 3121 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 3122 "tcp_bind: bad address length, %d", 3123 tbr->ADDR_length); 3124 } 3125 tcp_err_ack(tcp, mp, TBADADDR, 0); 3126 return; 3127 } 3128 tcp->tcp_bound_source_v6 = v6addr; 3129 3130 /* Check for change in ipversion */ 3131 if (origipversion != tcp->tcp_ipversion) { 3132 ASSERT(tcp->tcp_family == AF_INET6); 3133 err = tcp->tcp_ipversion == IPV6_VERSION ? 3134 tcp_header_init_ipv6(tcp) : tcp_header_init_ipv4(tcp); 3135 if (err) { 3136 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3137 return; 3138 } 3139 } 3140 3141 /* 3142 * Initialize family specific fields. Copy of the src addr. 3143 * in tcp_t is needed for the lookup funcs. 3144 */ 3145 if (tcp->tcp_ipversion == IPV6_VERSION) { 3146 tcp->tcp_ip6h->ip6_src = v6addr; 3147 } else { 3148 IN6_V4MAPPED_TO_IPADDR(&v6addr, tcp->tcp_ipha->ipha_src); 3149 } 3150 tcp->tcp_ip_src_v6 = v6addr; 3151 3152 /* 3153 * For O_T_BIND_REQ: 3154 * Verify that the target port/addr is available, or choose 3155 * another. 3156 * For T_BIND_REQ: 3157 * Verify that the target port/addr is available or fail. 3158 * In both cases when it succeeds the tcp is inserted in the 3159 * bind hash table. This ensures that the operation is atomic 3160 * under the lock on the hash bucket. 3161 */ 3162 bind_to_req_port_only = requested_port != 0 && 3163 tbr->PRIM_type != O_T_BIND_REQ; 3164 /* 3165 * Get a valid port (within the anonymous range and should not 3166 * be a privileged one) to use if the user has not given a port. 3167 * If multiple threads are here, they may all start with 3168 * with the same initial port. But, it should be fine as long as 3169 * tcp_bindi will ensure that no two threads will be assigned 3170 * the same port. 3171 * 3172 * NOTE: XXX If a privileged process asks for an anonymous port, we 3173 * still check for ports only in the range > tcp_smallest_non_priv_port, 3174 * unless TCP_ANONPRIVBIND option is set. 3175 */ 3176 mlptype = mlptSingle; 3177 mlp_port = requested_port; 3178 if (requested_port == 0) { 3179 requested_port = tcp->tcp_anon_priv_bind ? 3180 tcp_get_next_priv_port(tcp) : 3181 tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE); 3182 if (requested_port == 0) { 3183 tcp_err_ack(tcp, mp, TNOADDR, 0); 3184 return; 3185 } 3186 user_specified = B_FALSE; 3187 3188 /* 3189 * If the user went through one of the RPC interfaces to create 3190 * this socket and RPC is MLP in this zone, then give him an 3191 * anonymous MLP. 3192 */ 3193 cr = DB_CREDDEF(mp, tcp->tcp_cred); 3194 connp = tcp->tcp_connp; 3195 if (connp->conn_anon_mlp && is_system_labeled()) { 3196 zone = crgetzone(cr); 3197 addrtype = tsol_mlp_addr_type(zone->zone_id, 3198 IPV6_VERSION, &v6addr); 3199 if (addrtype == mlptSingle) { 3200 tcp_err_ack(tcp, mp, TNOADDR, 0); 3201 return; 3202 } 3203 mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, 3204 PMAPPORT, addrtype); 3205 mlp_port = PMAPPORT; 3206 } 3207 } else { 3208 int i; 3209 boolean_t priv = B_FALSE; 3210 3211 /* 3212 * If the requested_port is in the well-known privileged range, 3213 * verify that the stream was opened by a privileged user. 3214 * Note: No locks are held when inspecting tcp_g_*epriv_ports 3215 * but instead the code relies on: 3216 * - the fact that the address of the array and its size never 3217 * changes 3218 * - the atomic assignment of the elements of the array 3219 */ 3220 cr = DB_CREDDEF(mp, tcp->tcp_cred); 3221 if (requested_port < tcp_smallest_nonpriv_port) { 3222 priv = B_TRUE; 3223 } else { 3224 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 3225 if (requested_port == 3226 tcp_g_epriv_ports[i]) { 3227 priv = B_TRUE; 3228 break; 3229 } 3230 } 3231 } 3232 if (priv) { 3233 if (secpolicy_net_privaddr(cr, requested_port) != 0) { 3234 if (tcp->tcp_debug) { 3235 (void) strlog(TCP_MOD_ID, 0, 1, 3236 SL_ERROR|SL_TRACE, 3237 "tcp_bind: no priv for port %d", 3238 requested_port); 3239 } 3240 tcp_err_ack(tcp, mp, TACCES, 0); 3241 return; 3242 } 3243 } 3244 user_specified = B_TRUE; 3245 3246 connp = tcp->tcp_connp; 3247 if (is_system_labeled()) { 3248 zone = crgetzone(cr); 3249 addrtype = tsol_mlp_addr_type(zone->zone_id, 3250 IPV6_VERSION, &v6addr); 3251 if (addrtype == mlptSingle) { 3252 tcp_err_ack(tcp, mp, TNOADDR, 0); 3253 return; 3254 } 3255 mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, 3256 requested_port, addrtype); 3257 } 3258 } 3259 3260 if (mlptype != mlptSingle) { 3261 if (secpolicy_net_bindmlp(cr) != 0) { 3262 if (tcp->tcp_debug) { 3263 (void) strlog(TCP_MOD_ID, 0, 1, 3264 SL_ERROR|SL_TRACE, 3265 "tcp_bind: no priv for multilevel port %d", 3266 requested_port); 3267 } 3268 tcp_err_ack(tcp, mp, TACCES, 0); 3269 return; 3270 } 3271 3272 /* 3273 * If we're specifically binding a shared IP address and the 3274 * port is MLP on shared addresses, then check to see if this 3275 * zone actually owns the MLP. Reject if not. 3276 */ 3277 if (mlptype == mlptShared && addrtype == mlptShared) { 3278 zoneid_t mlpzone; 3279 3280 mlpzone = tsol_mlp_findzone(IPPROTO_TCP, 3281 htons(mlp_port)); 3282 if (connp->conn_zoneid != mlpzone) { 3283 if (tcp->tcp_debug) { 3284 (void) strlog(TCP_MOD_ID, 0, 1, 3285 SL_ERROR|SL_TRACE, 3286 "tcp_bind: attempt to bind port " 3287 "%d on shared addr in zone %d " 3288 "(should be %d)", 3289 mlp_port, connp->conn_zoneid, 3290 mlpzone); 3291 } 3292 tcp_err_ack(tcp, mp, TACCES, 0); 3293 return; 3294 } 3295 } 3296 3297 if (!user_specified) { 3298 err = tsol_mlp_anon(zone, mlptype, connp->conn_ulp, 3299 requested_port, B_TRUE); 3300 if (err != 0) { 3301 if (tcp->tcp_debug) { 3302 (void) strlog(TCP_MOD_ID, 0, 1, 3303 SL_ERROR|SL_TRACE, 3304 "tcp_bind: cannot establish anon " 3305 "MLP for port %d", 3306 requested_port); 3307 } 3308 tcp_err_ack(tcp, mp, TSYSERR, err); 3309 return; 3310 } 3311 connp->conn_anon_port = B_TRUE; 3312 } 3313 connp->conn_mlp_type = mlptype; 3314 } 3315 3316 allocated_port = tcp_bindi(tcp, requested_port, &v6addr, 3317 tcp->tcp_reuseaddr, B_FALSE, bind_to_req_port_only, user_specified); 3318 3319 if (allocated_port == 0) { 3320 connp->conn_mlp_type = mlptSingle; 3321 if (connp->conn_anon_port) { 3322 connp->conn_anon_port = B_FALSE; 3323 (void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp, 3324 requested_port, B_FALSE); 3325 } 3326 if (bind_to_req_port_only) { 3327 if (tcp->tcp_debug) { 3328 (void) strlog(TCP_MOD_ID, 0, 1, 3329 SL_ERROR|SL_TRACE, 3330 "tcp_bind: requested addr busy"); 3331 } 3332 tcp_err_ack(tcp, mp, TADDRBUSY, 0); 3333 } else { 3334 /* If we are out of ports, fail the bind. */ 3335 if (tcp->tcp_debug) { 3336 (void) strlog(TCP_MOD_ID, 0, 1, 3337 SL_ERROR|SL_TRACE, 3338 "tcp_bind: out of ports?"); 3339 } 3340 tcp_err_ack(tcp, mp, TNOADDR, 0); 3341 } 3342 return; 3343 } 3344 ASSERT(tcp->tcp_state == TCPS_BOUND); 3345 do_bind: 3346 if (!backlog_update) { 3347 if (tcp->tcp_family == AF_INET) 3348 sin->sin_port = htons(allocated_port); 3349 else 3350 sin6->sin6_port = htons(allocated_port); 3351 } 3352 if (tcp->tcp_family == AF_INET) { 3353 if (tbr->CONIND_number != 0) { 3354 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3355 sizeof (sin_t)); 3356 } else { 3357 /* Just verify the local IP address */ 3358 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IP_ADDR_LEN); 3359 } 3360 } else { 3361 if (tbr->CONIND_number != 0) { 3362 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3363 sizeof (sin6_t)); 3364 } else { 3365 /* Just verify the local IP address */ 3366 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3367 IPV6_ADDR_LEN); 3368 } 3369 } 3370 if (mp1 == NULL) { 3371 if (connp->conn_anon_port) { 3372 connp->conn_anon_port = B_FALSE; 3373 (void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp, 3374 requested_port, B_FALSE); 3375 } 3376 connp->conn_mlp_type = mlptSingle; 3377 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3378 return; 3379 } 3380 3381 tbr->PRIM_type = T_BIND_ACK; 3382 mp->b_datap->db_type = M_PCPROTO; 3383 3384 /* Chain in the reply mp for tcp_rput() */ 3385 mp1->b_cont = mp; 3386 mp = mp1; 3387 3388 tcp->tcp_conn_req_max = tbr->CONIND_number; 3389 if (tcp->tcp_conn_req_max) { 3390 if (tcp->tcp_conn_req_max < tcp_conn_req_min) 3391 tcp->tcp_conn_req_max = tcp_conn_req_min; 3392 if (tcp->tcp_conn_req_max > tcp_conn_req_max_q) 3393 tcp->tcp_conn_req_max = tcp_conn_req_max_q; 3394 /* 3395 * If this is a listener, do not reset the eager list 3396 * and other stuffs. Note that we don't check if the 3397 * existing eager list meets the new tcp_conn_req_max 3398 * requirement. 3399 */ 3400 if (tcp->tcp_state != TCPS_LISTEN) { 3401 tcp->tcp_state = TCPS_LISTEN; 3402 /* Initialize the chain. Don't need the eager_lock */ 3403 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 3404 tcp->tcp_second_ctimer_threshold = 3405 tcp_ip_abort_linterval; 3406 } 3407 } 3408 3409 /* 3410 * We can call ip_bind directly which returns a T_BIND_ACK mp. The 3411 * processing continues in tcp_rput_other(). 3412 */ 3413 if (tcp->tcp_family == AF_INET6) { 3414 ASSERT(tcp->tcp_connp->conn_af_isv6); 3415 mp = ip_bind_v6(q, mp, tcp->tcp_connp, &tcp->tcp_sticky_ipp); 3416 } else { 3417 ASSERT(!tcp->tcp_connp->conn_af_isv6); 3418 mp = ip_bind_v4(q, mp, tcp->tcp_connp); 3419 } 3420 /* 3421 * If the bind cannot complete immediately 3422 * IP will arrange to call tcp_rput_other 3423 * when the bind completes. 3424 */ 3425 if (mp != NULL) { 3426 tcp_rput_other(tcp, mp); 3427 } else { 3428 /* 3429 * Bind will be resumed later. Need to ensure 3430 * that conn doesn't disappear when that happens. 3431 * This will be decremented in ip_resume_tcp_bind(). 3432 */ 3433 CONN_INC_REF(tcp->tcp_connp); 3434 } 3435 } 3436 3437 3438 /* 3439 * If the "bind_to_req_port_only" parameter is set, if the requested port 3440 * number is available, return it, If not return 0 3441 * 3442 * If "bind_to_req_port_only" parameter is not set and 3443 * If the requested port number is available, return it. If not, return 3444 * the first anonymous port we happen across. If no anonymous ports are 3445 * available, return 0. addr is the requested local address, if any. 3446 * 3447 * In either case, when succeeding update the tcp_t to record the port number 3448 * and insert it in the bind hash table. 3449 * 3450 * Note that TCP over IPv4 and IPv6 sockets can use the same port number 3451 * without setting SO_REUSEADDR. This is needed so that they 3452 * can be viewed as two independent transport protocols. 3453 */ 3454 static in_port_t 3455 tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 3456 int reuseaddr, boolean_t quick_connect, 3457 boolean_t bind_to_req_port_only, boolean_t user_specified) 3458 { 3459 /* number of times we have run around the loop */ 3460 int count = 0; 3461 /* maximum number of times to run around the loop */ 3462 int loopmax; 3463 conn_t *connp = tcp->tcp_connp; 3464 zoneid_t zoneid = connp->conn_zoneid; 3465 3466 /* 3467 * Lookup for free addresses is done in a loop and "loopmax" 3468 * influences how long we spin in the loop 3469 */ 3470 if (bind_to_req_port_only) { 3471 /* 3472 * If the requested port is busy, don't bother to look 3473 * for a new one. Setting loop maximum count to 1 has 3474 * that effect. 3475 */ 3476 loopmax = 1; 3477 } else { 3478 /* 3479 * If the requested port is busy, look for a free one 3480 * in the anonymous port range. 3481 * Set loopmax appropriately so that one does not look 3482 * forever in the case all of the anonymous ports are in use. 3483 */ 3484 if (tcp->tcp_anon_priv_bind) { 3485 /* 3486 * loopmax = 3487 * (IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1 3488 */ 3489 loopmax = IPPORT_RESERVED - tcp_min_anonpriv_port; 3490 } else { 3491 loopmax = (tcp_largest_anon_port - 3492 tcp_smallest_anon_port + 1); 3493 } 3494 } 3495 do { 3496 uint16_t lport; 3497 tf_t *tbf; 3498 tcp_t *ltcp; 3499 conn_t *lconnp; 3500 3501 lport = htons(port); 3502 3503 /* 3504 * Ensure that the tcp_t is not currently in the bind hash. 3505 * Hold the lock on the hash bucket to ensure that 3506 * the duplicate check plus the insertion is an atomic 3507 * operation. 3508 * 3509 * This function does an inline lookup on the bind hash list 3510 * Make sure that we access only members of tcp_t 3511 * and that we don't look at tcp_tcp, since we are not 3512 * doing a CONN_INC_REF. 3513 */ 3514 tcp_bind_hash_remove(tcp); 3515 tbf = &tcp_bind_fanout[TCP_BIND_HASH(lport)]; 3516 mutex_enter(&tbf->tf_lock); 3517 for (ltcp = tbf->tf_tcp; ltcp != NULL; 3518 ltcp = ltcp->tcp_bind_hash) { 3519 boolean_t not_socket; 3520 boolean_t exclbind; 3521 3522 if (lport != ltcp->tcp_lport) 3523 continue; 3524 3525 lconnp = ltcp->tcp_connp; 3526 3527 /* 3528 * On a labeled system, we must treat bindings to ports 3529 * on shared IP addresses by sockets with MAC exemption 3530 * privilege as being in all zones, as there's 3531 * otherwise no way to identify the right receiver. 3532 */ 3533 if (!IPCL_ZONE_MATCH(ltcp->tcp_connp, zoneid) && 3534 !lconnp->conn_mac_exempt && 3535 !connp->conn_mac_exempt) 3536 continue; 3537 3538 /* 3539 * If TCP_EXCLBIND is set for either the bound or 3540 * binding endpoint, the semantics of bind 3541 * is changed according to the following. 3542 * 3543 * spec = specified address (v4 or v6) 3544 * unspec = unspecified address (v4 or v6) 3545 * A = specified addresses are different for endpoints 3546 * 3547 * bound bind to allowed 3548 * ------------------------------------- 3549 * unspec unspec no 3550 * unspec spec no 3551 * spec unspec no 3552 * spec spec yes if A 3553 * 3554 * For labeled systems, SO_MAC_EXEMPT behaves the same 3555 * as TCP_EXCLBIND, except that zoneid is ignored. 3556 * 3557 * Note: 3558 * 3559 * 1. Because of TLI semantics, an endpoint can go 3560 * back from, say TCP_ESTABLISHED to TCPS_LISTEN or 3561 * TCPS_BOUND, depending on whether it is originally 3562 * a listener or not. That is why we need to check 3563 * for states greater than or equal to TCPS_BOUND 3564 * here. 3565 * 3566 * 2. Ideally, we should only check for state equals 3567 * to TCPS_LISTEN. And the following check should be 3568 * added. 3569 * 3570 * if (ltcp->tcp_state == TCPS_LISTEN || 3571 * !reuseaddr || !ltcp->tcp_reuseaddr) { 3572 * ... 3573 * } 3574 * 3575 * The semantics will be changed to this. If the 3576 * endpoint on the list is in state not equal to 3577 * TCPS_LISTEN and both endpoints have SO_REUSEADDR 3578 * set, let the bind succeed. 3579 * 3580 * Because of (1), we cannot do that for TLI 3581 * endpoints. But we can do that for socket endpoints. 3582 * If in future, we can change this going back 3583 * semantics, we can use the above check for TLI also. 3584 */ 3585 not_socket = !(TCP_IS_SOCKET(ltcp) && 3586 TCP_IS_SOCKET(tcp)); 3587 exclbind = ltcp->tcp_exclbind || tcp->tcp_exclbind; 3588 3589 if (lconnp->conn_mac_exempt || connp->conn_mac_exempt || 3590 (exclbind && (not_socket || 3591 ltcp->tcp_state <= TCPS_ESTABLISHED))) { 3592 if (V6_OR_V4_INADDR_ANY( 3593 ltcp->tcp_bound_source_v6) || 3594 V6_OR_V4_INADDR_ANY(*laddr) || 3595 IN6_ARE_ADDR_EQUAL(laddr, 3596 <cp->tcp_bound_source_v6)) { 3597 break; 3598 } 3599 continue; 3600 } 3601 3602 /* 3603 * Check ipversion to allow IPv4 and IPv6 sockets to 3604 * have disjoint port number spaces, if *_EXCLBIND 3605 * is not set and only if the application binds to a 3606 * specific port. We use the same autoassigned port 3607 * number space for IPv4 and IPv6 sockets. 3608 */ 3609 if (tcp->tcp_ipversion != ltcp->tcp_ipversion && 3610 bind_to_req_port_only) 3611 continue; 3612 3613 /* 3614 * Ideally, we should make sure that the source 3615 * address, remote address, and remote port in the 3616 * four tuple for this tcp-connection is unique. 3617 * However, trying to find out the local source 3618 * address would require too much code duplication 3619 * with IP, since IP needs needs to have that code 3620 * to support userland TCP implementations. 3621 */ 3622 if (quick_connect && 3623 (ltcp->tcp_state > TCPS_LISTEN) && 3624 ((tcp->tcp_fport != ltcp->tcp_fport) || 3625 !IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6, 3626 <cp->tcp_remote_v6))) 3627 continue; 3628 3629 if (!reuseaddr) { 3630 /* 3631 * No socket option SO_REUSEADDR. 3632 * If existing port is bound to 3633 * a non-wildcard IP address 3634 * and the requesting stream is 3635 * bound to a distinct 3636 * different IP addresses 3637 * (non-wildcard, also), keep 3638 * going. 3639 */ 3640 if (!V6_OR_V4_INADDR_ANY(*laddr) && 3641 !V6_OR_V4_INADDR_ANY( 3642 ltcp->tcp_bound_source_v6) && 3643 !IN6_ARE_ADDR_EQUAL(laddr, 3644 <cp->tcp_bound_source_v6)) 3645 continue; 3646 if (ltcp->tcp_state >= TCPS_BOUND) { 3647 /* 3648 * This port is being used and 3649 * its state is >= TCPS_BOUND, 3650 * so we can't bind to it. 3651 */ 3652 break; 3653 } 3654 } else { 3655 /* 3656 * socket option SO_REUSEADDR is set on the 3657 * binding tcp_t. 3658 * 3659 * If two streams are bound to 3660 * same IP address or both addr 3661 * and bound source are wildcards 3662 * (INADDR_ANY), we want to stop 3663 * searching. 3664 * We have found a match of IP source 3665 * address and source port, which is 3666 * refused regardless of the 3667 * SO_REUSEADDR setting, so we break. 3668 */ 3669 if (IN6_ARE_ADDR_EQUAL(laddr, 3670 <cp->tcp_bound_source_v6) && 3671 (ltcp->tcp_state == TCPS_LISTEN || 3672 ltcp->tcp_state == TCPS_BOUND)) 3673 break; 3674 } 3675 } 3676 if (ltcp != NULL) { 3677 /* The port number is busy */ 3678 mutex_exit(&tbf->tf_lock); 3679 } else { 3680 /* 3681 * This port is ours. Insert in fanout and mark as 3682 * bound to prevent others from getting the port 3683 * number. 3684 */ 3685 tcp->tcp_state = TCPS_BOUND; 3686 tcp->tcp_lport = htons(port); 3687 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 3688 3689 ASSERT(&tcp_bind_fanout[TCP_BIND_HASH( 3690 tcp->tcp_lport)] == tbf); 3691 tcp_bind_hash_insert(tbf, tcp, 1); 3692 3693 mutex_exit(&tbf->tf_lock); 3694 3695 /* 3696 * We don't want tcp_next_port_to_try to "inherit" 3697 * a port number supplied by the user in a bind. 3698 */ 3699 if (user_specified) 3700 return (port); 3701 3702 /* 3703 * This is the only place where tcp_next_port_to_try 3704 * is updated. After the update, it may or may not 3705 * be in the valid range. 3706 */ 3707 if (!tcp->tcp_anon_priv_bind) 3708 tcp_next_port_to_try = port + 1; 3709 return (port); 3710 } 3711 3712 if (tcp->tcp_anon_priv_bind) { 3713 port = tcp_get_next_priv_port(tcp); 3714 } else { 3715 if (count == 0 && user_specified) { 3716 /* 3717 * We may have to return an anonymous port. So 3718 * get one to start with. 3719 */ 3720 port = 3721 tcp_update_next_port(tcp_next_port_to_try, 3722 tcp, B_TRUE); 3723 user_specified = B_FALSE; 3724 } else { 3725 port = tcp_update_next_port(port + 1, tcp, 3726 B_FALSE); 3727 } 3728 } 3729 if (port == 0) 3730 break; 3731 3732 /* 3733 * Don't let this loop run forever in the case where 3734 * all of the anonymous ports are in use. 3735 */ 3736 } while (++count < loopmax); 3737 return (0); 3738 } 3739 3740 /* 3741 * We are dying for some reason. Try to do it gracefully. (May be called 3742 * as writer.) 3743 * 3744 * Return -1 if the structure was not cleaned up (if the cleanup had to be 3745 * done by a service procedure). 3746 * TBD - Should the return value distinguish between the tcp_t being 3747 * freed and it being reinitialized? 3748 */ 3749 static int 3750 tcp_clean_death(tcp_t *tcp, int err, uint8_t tag) 3751 { 3752 mblk_t *mp; 3753 queue_t *q; 3754 3755 TCP_CLD_STAT(tag); 3756 3757 #if TCP_TAG_CLEAN_DEATH 3758 tcp->tcp_cleandeathtag = tag; 3759 #endif 3760 3761 if (tcp->tcp_fused) 3762 tcp_unfuse(tcp); 3763 3764 if (tcp->tcp_linger_tid != 0 && 3765 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 3766 tcp_stop_lingering(tcp); 3767 } 3768 3769 ASSERT(tcp != NULL); 3770 ASSERT((tcp->tcp_family == AF_INET && 3771 tcp->tcp_ipversion == IPV4_VERSION) || 3772 (tcp->tcp_family == AF_INET6 && 3773 (tcp->tcp_ipversion == IPV4_VERSION || 3774 tcp->tcp_ipversion == IPV6_VERSION))); 3775 3776 if (TCP_IS_DETACHED(tcp)) { 3777 if (tcp->tcp_hard_binding) { 3778 /* 3779 * Its an eager that we are dealing with. We close the 3780 * eager but in case a conn_ind has already gone to the 3781 * listener, let tcp_accept_finish() send a discon_ind 3782 * to the listener and drop the last reference. If the 3783 * listener doesn't even know about the eager i.e. the 3784 * conn_ind hasn't gone up, blow away the eager and drop 3785 * the last reference as well. If the conn_ind has gone 3786 * up, state should be BOUND. tcp_accept_finish 3787 * will figure out that the connection has received a 3788 * RST and will send a DISCON_IND to the application. 3789 */ 3790 tcp_closei_local(tcp); 3791 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 3792 CONN_DEC_REF(tcp->tcp_connp); 3793 } else { 3794 tcp->tcp_state = TCPS_BOUND; 3795 } 3796 } else { 3797 tcp_close_detached(tcp); 3798 } 3799 return (0); 3800 } 3801 3802 TCP_STAT(tcp_clean_death_nondetached); 3803 3804 /* 3805 * If T_ORDREL_IND has not been sent yet (done when service routine 3806 * is run) postpone cleaning up the endpoint until service routine 3807 * has sent up the T_ORDREL_IND. Avoid clearing out an existing 3808 * client_errno since tcp_close uses the client_errno field. 3809 */ 3810 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 3811 if (err != 0) 3812 tcp->tcp_client_errno = err; 3813 3814 tcp->tcp_deferred_clean_death = B_TRUE; 3815 return (-1); 3816 } 3817 3818 q = tcp->tcp_rq; 3819 3820 /* Trash all inbound data */ 3821 flushq(q, FLUSHALL); 3822 3823 /* 3824 * If we are at least part way open and there is error 3825 * (err==0 implies no error) 3826 * notify our client by a T_DISCON_IND. 3827 */ 3828 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 3829 if (tcp->tcp_state >= TCPS_ESTABLISHED && 3830 !TCP_IS_SOCKET(tcp)) { 3831 /* 3832 * Send M_FLUSH according to TPI. Because sockets will 3833 * (and must) ignore FLUSHR we do that only for TPI 3834 * endpoints and sockets in STREAMS mode. 3835 */ 3836 (void) putnextctl1(q, M_FLUSH, FLUSHR); 3837 } 3838 if (tcp->tcp_debug) { 3839 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 3840 "tcp_clean_death: discon err %d", err); 3841 } 3842 mp = mi_tpi_discon_ind(NULL, err, 0); 3843 if (mp != NULL) { 3844 putnext(q, mp); 3845 } else { 3846 if (tcp->tcp_debug) { 3847 (void) strlog(TCP_MOD_ID, 0, 1, 3848 SL_ERROR|SL_TRACE, 3849 "tcp_clean_death, sending M_ERROR"); 3850 } 3851 (void) putnextctl1(q, M_ERROR, EPROTO); 3852 } 3853 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 3854 /* SYN_SENT or SYN_RCVD */ 3855 BUMP_MIB(&tcp_mib, tcpAttemptFails); 3856 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 3857 /* ESTABLISHED or CLOSE_WAIT */ 3858 BUMP_MIB(&tcp_mib, tcpEstabResets); 3859 } 3860 } 3861 3862 tcp_reinit(tcp); 3863 return (-1); 3864 } 3865 3866 /* 3867 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 3868 * to expire, stop the wait and finish the close. 3869 */ 3870 static void 3871 tcp_stop_lingering(tcp_t *tcp) 3872 { 3873 clock_t delta = 0; 3874 3875 tcp->tcp_linger_tid = 0; 3876 if (tcp->tcp_state > TCPS_LISTEN) { 3877 tcp_acceptor_hash_remove(tcp); 3878 if (tcp->tcp_flow_stopped) { 3879 tcp_clrqfull(tcp); 3880 } 3881 3882 if (tcp->tcp_timer_tid != 0) { 3883 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 3884 tcp->tcp_timer_tid = 0; 3885 } 3886 /* 3887 * Need to cancel those timers which will not be used when 3888 * TCP is detached. This has to be done before the tcp_wq 3889 * is set to the global queue. 3890 */ 3891 tcp_timers_stop(tcp); 3892 3893 3894 tcp->tcp_detached = B_TRUE; 3895 tcp->tcp_rq = tcp_g_q; 3896 tcp->tcp_wq = WR(tcp_g_q); 3897 3898 if (tcp->tcp_state == TCPS_TIME_WAIT) { 3899 tcp_time_wait_append(tcp); 3900 TCP_DBGSTAT(tcp_detach_time_wait); 3901 goto finish; 3902 } 3903 3904 /* 3905 * If delta is zero the timer event wasn't executed and was 3906 * successfully canceled. In this case we need to restart it 3907 * with the minimal delta possible. 3908 */ 3909 if (delta >= 0) { 3910 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 3911 delta ? delta : 1); 3912 } 3913 } else { 3914 tcp_closei_local(tcp); 3915 CONN_DEC_REF(tcp->tcp_connp); 3916 } 3917 finish: 3918 /* Signal closing thread that it can complete close */ 3919 mutex_enter(&tcp->tcp_closelock); 3920 tcp->tcp_detached = B_TRUE; 3921 tcp->tcp_rq = tcp_g_q; 3922 tcp->tcp_wq = WR(tcp_g_q); 3923 tcp->tcp_closed = 1; 3924 cv_signal(&tcp->tcp_closecv); 3925 mutex_exit(&tcp->tcp_closelock); 3926 } 3927 3928 /* 3929 * Handle lingering timeouts. This function is called when the SO_LINGER timeout 3930 * expires. 3931 */ 3932 static void 3933 tcp_close_linger_timeout(void *arg) 3934 { 3935 conn_t *connp = (conn_t *)arg; 3936 tcp_t *tcp = connp->conn_tcp; 3937 3938 tcp->tcp_client_errno = ETIMEDOUT; 3939 tcp_stop_lingering(tcp); 3940 } 3941 3942 static int 3943 tcp_close(queue_t *q, int flags) 3944 { 3945 conn_t *connp = Q_TO_CONN(q); 3946 tcp_t *tcp = connp->conn_tcp; 3947 mblk_t *mp = &tcp->tcp_closemp; 3948 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 3949 boolean_t linger_interrupted = B_FALSE; 3950 mblk_t *bp; 3951 3952 ASSERT(WR(q)->q_next == NULL); 3953 ASSERT(connp->conn_ref >= 2); 3954 ASSERT((connp->conn_flags & IPCL_TCPMOD) == 0); 3955 3956 /* 3957 * We are being closed as /dev/tcp or /dev/tcp6. 3958 * 3959 * Mark the conn as closing. ill_pending_mp_add will not 3960 * add any mp to the pending mp list, after this conn has 3961 * started closing. Same for sq_pending_mp_add 3962 */ 3963 mutex_enter(&connp->conn_lock); 3964 connp->conn_state_flags |= CONN_CLOSING; 3965 if (connp->conn_oper_pending_ill != NULL) 3966 conn_ioctl_cleanup_reqd = B_TRUE; 3967 CONN_INC_REF_LOCKED(connp); 3968 mutex_exit(&connp->conn_lock); 3969 tcp->tcp_closeflags = (uint8_t)flags; 3970 ASSERT(connp->conn_ref >= 3); 3971 3972 (*tcp_squeue_close_proc)(connp->conn_sqp, mp, 3973 tcp_close_output, connp, SQTAG_IP_TCP_CLOSE); 3974 3975 mutex_enter(&tcp->tcp_closelock); 3976 while (!tcp->tcp_closed) { 3977 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 3978 /* 3979 * We got interrupted. Check if we are lingering, 3980 * if yes, post a message to stop and wait until 3981 * tcp_closed is set. If we aren't lingering, 3982 * just go back around. 3983 */ 3984 if (tcp->tcp_linger && 3985 tcp->tcp_lingertime > 0 && 3986 !linger_interrupted) { 3987 mutex_exit(&tcp->tcp_closelock); 3988 /* Entering squeue, bump ref count. */ 3989 CONN_INC_REF(connp); 3990 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 3991 squeue_enter(connp->conn_sqp, bp, 3992 tcp_linger_interrupted, connp, 3993 SQTAG_IP_TCP_CLOSE); 3994 linger_interrupted = B_TRUE; 3995 mutex_enter(&tcp->tcp_closelock); 3996 } 3997 } 3998 } 3999 mutex_exit(&tcp->tcp_closelock); 4000 4001 /* 4002 * In the case of listener streams that have eagers in the q or q0 4003 * we wait for the eagers to drop their reference to us. tcp_rq and 4004 * tcp_wq of the eagers point to our queues. By waiting for the 4005 * refcnt to drop to 1, we are sure that the eagers have cleaned 4006 * up their queue pointers and also dropped their references to us. 4007 */ 4008 if (tcp->tcp_wait_for_eagers) { 4009 mutex_enter(&connp->conn_lock); 4010 while (connp->conn_ref != 1) { 4011 cv_wait(&connp->conn_cv, &connp->conn_lock); 4012 } 4013 mutex_exit(&connp->conn_lock); 4014 } 4015 /* 4016 * ioctl cleanup. The mp is queued in the 4017 * ill_pending_mp or in the sq_pending_mp. 4018 */ 4019 if (conn_ioctl_cleanup_reqd) 4020 conn_ioctl_cleanup(connp); 4021 4022 qprocsoff(q); 4023 inet_minor_free(ip_minor_arena, connp->conn_dev); 4024 4025 tcp->tcp_cpid = -1; 4026 4027 /* 4028 * Drop IP's reference on the conn. This is the last reference 4029 * on the connp if the state was less than established. If the 4030 * connection has gone into timewait state, then we will have 4031 * one ref for the TCP and one more ref (total of two) for the 4032 * classifier connected hash list (a timewait connections stays 4033 * in connected hash till closed). 4034 * 4035 * We can't assert the references because there might be other 4036 * transient reference places because of some walkers or queued 4037 * packets in squeue for the timewait state. 4038 */ 4039 CONN_DEC_REF(connp); 4040 q->q_ptr = WR(q)->q_ptr = NULL; 4041 return (0); 4042 } 4043 4044 static int 4045 tcpclose_accept(queue_t *q) 4046 { 4047 ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit); 4048 4049 /* 4050 * We had opened an acceptor STREAM for sockfs which is 4051 * now being closed due to some error. 4052 */ 4053 qprocsoff(q); 4054 inet_minor_free(ip_minor_arena, (dev_t)q->q_ptr); 4055 q->q_ptr = WR(q)->q_ptr = NULL; 4056 return (0); 4057 } 4058 4059 /* 4060 * Called by tcp_close() routine via squeue when lingering is 4061 * interrupted by a signal. 4062 */ 4063 4064 /* ARGSUSED */ 4065 static void 4066 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2) 4067 { 4068 conn_t *connp = (conn_t *)arg; 4069 tcp_t *tcp = connp->conn_tcp; 4070 4071 freeb(mp); 4072 if (tcp->tcp_linger_tid != 0 && 4073 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 4074 tcp_stop_lingering(tcp); 4075 tcp->tcp_client_errno = EINTR; 4076 } 4077 } 4078 4079 /* 4080 * Called by streams close routine via squeues when our client blows off her 4081 * descriptor, we take this to mean: "close the stream state NOW, close the tcp 4082 * connection politely" When SO_LINGER is set (with a non-zero linger time and 4083 * it is not a nonblocking socket) then this routine sleeps until the FIN is 4084 * acked. 4085 * 4086 * NOTE: tcp_close potentially returns error when lingering. 4087 * However, the stream head currently does not pass these errors 4088 * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK 4089 * errors to the application (from tsleep()) and not errors 4090 * like ECONNRESET caused by receiving a reset packet. 4091 */ 4092 4093 /* ARGSUSED */ 4094 static void 4095 tcp_close_output(void *arg, mblk_t *mp, void *arg2) 4096 { 4097 char *msg; 4098 conn_t *connp = (conn_t *)arg; 4099 tcp_t *tcp = connp->conn_tcp; 4100 clock_t delta = 0; 4101 4102 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 4103 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 4104 4105 /* Cancel any pending timeout */ 4106 if (tcp->tcp_ordrelid != 0) { 4107 if (tcp->tcp_timeout) { 4108 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ordrelid); 4109 } 4110 tcp->tcp_ordrelid = 0; 4111 tcp->tcp_timeout = B_FALSE; 4112 } 4113 4114 mutex_enter(&tcp->tcp_eager_lock); 4115 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 4116 /* Cleanup for listener */ 4117 tcp_eager_cleanup(tcp, 0); 4118 tcp->tcp_wait_for_eagers = 1; 4119 } 4120 mutex_exit(&tcp->tcp_eager_lock); 4121 4122 connp->conn_mdt_ok = B_FALSE; 4123 tcp->tcp_mdt = B_FALSE; 4124 4125 msg = NULL; 4126 switch (tcp->tcp_state) { 4127 case TCPS_CLOSED: 4128 case TCPS_IDLE: 4129 case TCPS_BOUND: 4130 case TCPS_LISTEN: 4131 break; 4132 case TCPS_SYN_SENT: 4133 msg = "tcp_close, during connect"; 4134 break; 4135 case TCPS_SYN_RCVD: 4136 /* 4137 * Close during the connect 3-way handshake 4138 * but here there may or may not be pending data 4139 * already on queue. Process almost same as in 4140 * the ESTABLISHED state. 4141 */ 4142 /* FALLTHRU */ 4143 default: 4144 if (tcp->tcp_fused) 4145 tcp_unfuse(tcp); 4146 4147 /* 4148 * If SO_LINGER has set a zero linger time, abort the 4149 * connection with a reset. 4150 */ 4151 if (tcp->tcp_linger && tcp->tcp_lingertime == 0) { 4152 msg = "tcp_close, zero lingertime"; 4153 break; 4154 } 4155 4156 ASSERT(tcp->tcp_hard_bound || tcp->tcp_hard_binding); 4157 /* 4158 * Abort connection if there is unread data queued. 4159 */ 4160 if (tcp->tcp_rcv_list || tcp->tcp_reass_head) { 4161 msg = "tcp_close, unread data"; 4162 break; 4163 } 4164 /* 4165 * tcp_hard_bound is now cleared thus all packets go through 4166 * tcp_lookup. This fact is used by tcp_detach below. 4167 * 4168 * We have done a qwait() above which could have possibly 4169 * drained more messages in turn causing transition to a 4170 * different state. Check whether we have to do the rest 4171 * of the processing or not. 4172 */ 4173 if (tcp->tcp_state <= TCPS_LISTEN) 4174 break; 4175 4176 /* 4177 * Transmit the FIN before detaching the tcp_t. 4178 * After tcp_detach returns this queue/perimeter 4179 * no longer owns the tcp_t thus others can modify it. 4180 */ 4181 (void) tcp_xmit_end(tcp); 4182 4183 /* 4184 * If lingering on close then wait until the fin is acked, 4185 * the SO_LINGER time passes, or a reset is sent/received. 4186 */ 4187 if (tcp->tcp_linger && tcp->tcp_lingertime > 0 && 4188 !(tcp->tcp_fin_acked) && 4189 tcp->tcp_state >= TCPS_ESTABLISHED) { 4190 if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) { 4191 tcp->tcp_client_errno = EWOULDBLOCK; 4192 } else if (tcp->tcp_client_errno == 0) { 4193 4194 ASSERT(tcp->tcp_linger_tid == 0); 4195 4196 tcp->tcp_linger_tid = TCP_TIMER(tcp, 4197 tcp_close_linger_timeout, 4198 tcp->tcp_lingertime * hz); 4199 4200 /* tcp_close_linger_timeout will finish close */ 4201 if (tcp->tcp_linger_tid == 0) 4202 tcp->tcp_client_errno = ENOSR; 4203 else 4204 return; 4205 } 4206 4207 /* 4208 * Check if we need to detach or just close 4209 * the instance. 4210 */ 4211 if (tcp->tcp_state <= TCPS_LISTEN) 4212 break; 4213 } 4214 4215 /* 4216 * Make sure that no other thread will access the tcp_rq of 4217 * this instance (through lookups etc.) as tcp_rq will go 4218 * away shortly. 4219 */ 4220 tcp_acceptor_hash_remove(tcp); 4221 4222 if (tcp->tcp_flow_stopped) { 4223 tcp_clrqfull(tcp); 4224 } 4225 4226 if (tcp->tcp_timer_tid != 0) { 4227 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4228 tcp->tcp_timer_tid = 0; 4229 } 4230 /* 4231 * Need to cancel those timers which will not be used when 4232 * TCP is detached. This has to be done before the tcp_wq 4233 * is set to the global queue. 4234 */ 4235 tcp_timers_stop(tcp); 4236 4237 tcp->tcp_detached = B_TRUE; 4238 if (tcp->tcp_state == TCPS_TIME_WAIT) { 4239 tcp_time_wait_append(tcp); 4240 TCP_DBGSTAT(tcp_detach_time_wait); 4241 ASSERT(connp->conn_ref >= 3); 4242 goto finish; 4243 } 4244 4245 /* 4246 * If delta is zero the timer event wasn't executed and was 4247 * successfully canceled. In this case we need to restart it 4248 * with the minimal delta possible. 4249 */ 4250 if (delta >= 0) 4251 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 4252 delta ? delta : 1); 4253 4254 ASSERT(connp->conn_ref >= 3); 4255 goto finish; 4256 } 4257 4258 /* Detach did not complete. Still need to remove q from stream. */ 4259 if (msg) { 4260 if (tcp->tcp_state == TCPS_ESTABLISHED || 4261 tcp->tcp_state == TCPS_CLOSE_WAIT) 4262 BUMP_MIB(&tcp_mib, tcpEstabResets); 4263 if (tcp->tcp_state == TCPS_SYN_SENT || 4264 tcp->tcp_state == TCPS_SYN_RCVD) 4265 BUMP_MIB(&tcp_mib, tcpAttemptFails); 4266 tcp_xmit_ctl(msg, tcp, tcp->tcp_snxt, 0, TH_RST); 4267 } 4268 4269 tcp_closei_local(tcp); 4270 CONN_DEC_REF(connp); 4271 ASSERT(connp->conn_ref >= 2); 4272 4273 finish: 4274 /* 4275 * Although packets are always processed on the correct 4276 * tcp's perimeter and access is serialized via squeue's, 4277 * IP still needs a queue when sending packets in time_wait 4278 * state so use WR(tcp_g_q) till ip_output() can be 4279 * changed to deal with just connp. For read side, we 4280 * could have set tcp_rq to NULL but there are some cases 4281 * in tcp_rput_data() from early days of this code which 4282 * do a putnext without checking if tcp is closed. Those 4283 * need to be identified before both tcp_rq and tcp_wq 4284 * can be set to NULL and tcp_q_q can disappear forever. 4285 */ 4286 mutex_enter(&tcp->tcp_closelock); 4287 /* 4288 * Don't change the queues in the case of a listener that has 4289 * eagers in its q or q0. It could surprise the eagers. 4290 * Instead wait for the eagers outside the squeue. 4291 */ 4292 if (!tcp->tcp_wait_for_eagers) { 4293 tcp->tcp_detached = B_TRUE; 4294 tcp->tcp_rq = tcp_g_q; 4295 tcp->tcp_wq = WR(tcp_g_q); 4296 } 4297 4298 /* Signal tcp_close() to finish closing. */ 4299 tcp->tcp_closed = 1; 4300 cv_signal(&tcp->tcp_closecv); 4301 mutex_exit(&tcp->tcp_closelock); 4302 } 4303 4304 4305 /* 4306 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 4307 * Some stream heads get upset if they see these later on as anything but NULL. 4308 */ 4309 static void 4310 tcp_close_mpp(mblk_t **mpp) 4311 { 4312 mblk_t *mp; 4313 4314 if ((mp = *mpp) != NULL) { 4315 do { 4316 mp->b_next = NULL; 4317 mp->b_prev = NULL; 4318 } while ((mp = mp->b_cont) != NULL); 4319 4320 mp = *mpp; 4321 *mpp = NULL; 4322 freemsg(mp); 4323 } 4324 } 4325 4326 /* Do detached close. */ 4327 static void 4328 tcp_close_detached(tcp_t *tcp) 4329 { 4330 if (tcp->tcp_fused) 4331 tcp_unfuse(tcp); 4332 4333 /* 4334 * Clustering code serializes TCP disconnect callbacks and 4335 * cluster tcp list walks by blocking a TCP disconnect callback 4336 * if a cluster tcp list walk is in progress. This ensures 4337 * accurate accounting of TCPs in the cluster code even though 4338 * the TCP list walk itself is not atomic. 4339 */ 4340 tcp_closei_local(tcp); 4341 CONN_DEC_REF(tcp->tcp_connp); 4342 } 4343 4344 /* 4345 * Stop all TCP timers, and free the timer mblks if requested. 4346 */ 4347 void 4348 tcp_timers_stop(tcp_t *tcp) 4349 { 4350 if (tcp->tcp_timer_tid != 0) { 4351 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4352 tcp->tcp_timer_tid = 0; 4353 } 4354 if (tcp->tcp_ka_tid != 0) { 4355 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); 4356 tcp->tcp_ka_tid = 0; 4357 } 4358 if (tcp->tcp_ack_tid != 0) { 4359 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 4360 tcp->tcp_ack_tid = 0; 4361 } 4362 if (tcp->tcp_push_tid != 0) { 4363 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 4364 tcp->tcp_push_tid = 0; 4365 } 4366 } 4367 4368 /* 4369 * The tcp_t is going away. Remove it from all lists and set it 4370 * to TCPS_CLOSED. The freeing up of memory is deferred until 4371 * tcp_inactive. This is needed since a thread in tcp_rput might have 4372 * done a CONN_INC_REF on this structure before it was removed from the 4373 * hashes. 4374 */ 4375 static void 4376 tcp_closei_local(tcp_t *tcp) 4377 { 4378 ire_t *ire; 4379 conn_t *connp = tcp->tcp_connp; 4380 4381 if (!TCP_IS_SOCKET(tcp)) 4382 tcp_acceptor_hash_remove(tcp); 4383 4384 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 4385 tcp->tcp_ibsegs = 0; 4386 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 4387 tcp->tcp_obsegs = 0; 4388 4389 /* 4390 * If we are an eager connection hanging off a listener that 4391 * hasn't formally accepted the connection yet, get off his 4392 * list and blow off any data that we have accumulated. 4393 */ 4394 if (tcp->tcp_listener != NULL) { 4395 tcp_t *listener = tcp->tcp_listener; 4396 mutex_enter(&listener->tcp_eager_lock); 4397 /* 4398 * tcp_eager_conn_ind == NULL means that the 4399 * conn_ind has already gone to listener. At 4400 * this point, eager will be closed but we 4401 * leave it in listeners eager list so that 4402 * if listener decides to close without doing 4403 * accept, we can clean this up. In tcp_wput_accept 4404 * we take case of the case of accept on closed 4405 * eager. 4406 */ 4407 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 4408 tcp_eager_unlink(tcp); 4409 mutex_exit(&listener->tcp_eager_lock); 4410 /* 4411 * We don't want to have any pointers to the 4412 * listener queue, after we have released our 4413 * reference on the listener 4414 */ 4415 tcp->tcp_rq = tcp_g_q; 4416 tcp->tcp_wq = WR(tcp_g_q); 4417 CONN_DEC_REF(listener->tcp_connp); 4418 } else { 4419 mutex_exit(&listener->tcp_eager_lock); 4420 } 4421 } 4422 4423 /* Stop all the timers */ 4424 tcp_timers_stop(tcp); 4425 4426 if (tcp->tcp_state == TCPS_LISTEN) { 4427 if (tcp->tcp_ip_addr_cache) { 4428 kmem_free((void *)tcp->tcp_ip_addr_cache, 4429 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 4430 tcp->tcp_ip_addr_cache = NULL; 4431 } 4432 } 4433 if (tcp->tcp_flow_stopped) 4434 tcp_clrqfull(tcp); 4435 4436 tcp_bind_hash_remove(tcp); 4437 /* 4438 * If the tcp_time_wait_collector (which runs outside the squeue) 4439 * is trying to remove this tcp from the time wait list, we will 4440 * block in tcp_time_wait_remove while trying to acquire the 4441 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 4442 * requires the ipcl_hash_remove to be ordered after the 4443 * tcp_time_wait_remove for the refcnt checks to work correctly. 4444 */ 4445 if (tcp->tcp_state == TCPS_TIME_WAIT) 4446 tcp_time_wait_remove(tcp, NULL); 4447 CL_INET_DISCONNECT(tcp); 4448 ipcl_hash_remove(connp); 4449 4450 /* 4451 * Delete the cached ire in conn_ire_cache and also mark 4452 * the conn as CONDEMNED 4453 */ 4454 mutex_enter(&connp->conn_lock); 4455 connp->conn_state_flags |= CONN_CONDEMNED; 4456 ire = connp->conn_ire_cache; 4457 connp->conn_ire_cache = NULL; 4458 mutex_exit(&connp->conn_lock); 4459 if (ire != NULL) 4460 IRE_REFRELE_NOTR(ire); 4461 4462 /* Need to cleanup any pending ioctls */ 4463 ASSERT(tcp->tcp_time_wait_next == NULL); 4464 ASSERT(tcp->tcp_time_wait_prev == NULL); 4465 ASSERT(tcp->tcp_time_wait_expire == 0); 4466 tcp->tcp_state = TCPS_CLOSED; 4467 4468 /* Release any SSL context */ 4469 if (tcp->tcp_kssl_ent != NULL) { 4470 kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); 4471 tcp->tcp_kssl_ent = NULL; 4472 } 4473 if (tcp->tcp_kssl_ctx != NULL) { 4474 kssl_release_ctx(tcp->tcp_kssl_ctx); 4475 tcp->tcp_kssl_ctx = NULL; 4476 } 4477 tcp->tcp_kssl_pending = B_FALSE; 4478 } 4479 4480 /* 4481 * tcp is dying (called from ipcl_conn_destroy and error cases). 4482 * Free the tcp_t in either case. 4483 */ 4484 void 4485 tcp_free(tcp_t *tcp) 4486 { 4487 mblk_t *mp; 4488 ip6_pkt_t *ipp; 4489 4490 ASSERT(tcp != NULL); 4491 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 4492 4493 tcp->tcp_rq = NULL; 4494 tcp->tcp_wq = NULL; 4495 4496 tcp_close_mpp(&tcp->tcp_xmit_head); 4497 tcp_close_mpp(&tcp->tcp_reass_head); 4498 if (tcp->tcp_rcv_list != NULL) { 4499 /* Free b_next chain */ 4500 tcp_close_mpp(&tcp->tcp_rcv_list); 4501 } 4502 if ((mp = tcp->tcp_urp_mp) != NULL) { 4503 freemsg(mp); 4504 } 4505 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 4506 freemsg(mp); 4507 } 4508 4509 if (tcp->tcp_fused_sigurg_mp != NULL) { 4510 freeb(tcp->tcp_fused_sigurg_mp); 4511 tcp->tcp_fused_sigurg_mp = NULL; 4512 } 4513 4514 if (tcp->tcp_sack_info != NULL) { 4515 if (tcp->tcp_notsack_list != NULL) { 4516 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 4517 } 4518 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 4519 } 4520 4521 if (tcp->tcp_hopopts != NULL) { 4522 mi_free(tcp->tcp_hopopts); 4523 tcp->tcp_hopopts = NULL; 4524 tcp->tcp_hopoptslen = 0; 4525 } 4526 ASSERT(tcp->tcp_hopoptslen == 0); 4527 if (tcp->tcp_dstopts != NULL) { 4528 mi_free(tcp->tcp_dstopts); 4529 tcp->tcp_dstopts = NULL; 4530 tcp->tcp_dstoptslen = 0; 4531 } 4532 ASSERT(tcp->tcp_dstoptslen == 0); 4533 if (tcp->tcp_rtdstopts != NULL) { 4534 mi_free(tcp->tcp_rtdstopts); 4535 tcp->tcp_rtdstopts = NULL; 4536 tcp->tcp_rtdstoptslen = 0; 4537 } 4538 ASSERT(tcp->tcp_rtdstoptslen == 0); 4539 if (tcp->tcp_rthdr != NULL) { 4540 mi_free(tcp->tcp_rthdr); 4541 tcp->tcp_rthdr = NULL; 4542 tcp->tcp_rthdrlen = 0; 4543 } 4544 ASSERT(tcp->tcp_rthdrlen == 0); 4545 4546 ipp = &tcp->tcp_sticky_ipp; 4547 if (ipp->ipp_fields & (IPPF_HOPOPTS | IPPF_RTDSTOPTS | IPPF_DSTOPTS | 4548 IPPF_RTHDR)) 4549 ip6_pkt_free(ipp); 4550 4551 /* 4552 * Free memory associated with the tcp/ip header template. 4553 */ 4554 4555 if (tcp->tcp_iphc != NULL) 4556 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 4557 4558 /* 4559 * Following is really a blowing away a union. 4560 * It happens to have exactly two members of identical size 4561 * the following code is enough. 4562 */ 4563 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 4564 4565 if (tcp->tcp_tracebuf != NULL) { 4566 kmem_free(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 4567 tcp->tcp_tracebuf = NULL; 4568 } 4569 } 4570 4571 4572 /* 4573 * Put a connection confirmation message upstream built from the 4574 * address information within 'iph' and 'tcph'. Report our success or failure. 4575 */ 4576 static boolean_t 4577 tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp, 4578 mblk_t **defermp) 4579 { 4580 sin_t sin; 4581 sin6_t sin6; 4582 mblk_t *mp; 4583 char *optp = NULL; 4584 int optlen = 0; 4585 cred_t *cr; 4586 4587 if (defermp != NULL) 4588 *defermp = NULL; 4589 4590 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) { 4591 /* 4592 * Return in T_CONN_CON results of option negotiation through 4593 * the T_CONN_REQ. Note: If there is an real end-to-end option 4594 * negotiation, then what is received from remote end needs 4595 * to be taken into account but there is no such thing (yet?) 4596 * in our TCP/IP. 4597 * Note: We do not use mi_offset_param() here as 4598 * tcp_opts_conn_req contents do not directly come from 4599 * an application and are either generated in kernel or 4600 * from user input that was already verified. 4601 */ 4602 mp = tcp->tcp_conn.tcp_opts_conn_req; 4603 optp = (char *)(mp->b_rptr + 4604 ((struct T_conn_req *)mp->b_rptr)->OPT_offset); 4605 optlen = (int) 4606 ((struct T_conn_req *)mp->b_rptr)->OPT_length; 4607 } 4608 4609 if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) { 4610 ipha_t *ipha = (ipha_t *)iphdr; 4611 4612 /* packet is IPv4 */ 4613 if (tcp->tcp_family == AF_INET) { 4614 sin = sin_null; 4615 sin.sin_addr.s_addr = ipha->ipha_src; 4616 sin.sin_port = *(uint16_t *)tcph->th_lport; 4617 sin.sin_family = AF_INET; 4618 mp = mi_tpi_conn_con(NULL, (char *)&sin, 4619 (int)sizeof (sin_t), optp, optlen); 4620 } else { 4621 sin6 = sin6_null; 4622 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 4623 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 4624 sin6.sin6_family = AF_INET6; 4625 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 4626 (int)sizeof (sin6_t), optp, optlen); 4627 4628 } 4629 } else { 4630 ip6_t *ip6h = (ip6_t *)iphdr; 4631 4632 ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION); 4633 ASSERT(tcp->tcp_family == AF_INET6); 4634 sin6 = sin6_null; 4635 sin6.sin6_addr = ip6h->ip6_src; 4636 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 4637 sin6.sin6_family = AF_INET6; 4638 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 4639 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 4640 (int)sizeof (sin6_t), optp, optlen); 4641 } 4642 4643 if (!mp) 4644 return (B_FALSE); 4645 4646 if ((cr = DB_CRED(idmp)) != NULL) { 4647 mblk_setcred(mp, cr); 4648 DB_CPID(mp) = DB_CPID(idmp); 4649 } 4650 4651 if (defermp == NULL) 4652 putnext(tcp->tcp_rq, mp); 4653 else 4654 *defermp = mp; 4655 4656 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4657 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4658 return (B_TRUE); 4659 } 4660 4661 /* 4662 * Defense for the SYN attack - 4663 * 1. When q0 is full, drop from the tail (tcp_eager_prev_q0) the oldest 4664 * one that doesn't have the dontdrop bit set. 4665 * 2. Don't drop a SYN request before its first timeout. This gives every 4666 * request at least til the first timeout to complete its 3-way handshake. 4667 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 4668 * requests currently on the queue that has timed out. This will be used 4669 * as an indicator of whether an attack is under way, so that appropriate 4670 * actions can be taken. (It's incremented in tcp_timer() and decremented 4671 * either when eager goes into ESTABLISHED, or gets freed up.) 4672 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 4673 * # of timeout drops back to <= q0len/32 => SYN alert off 4674 */ 4675 static boolean_t 4676 tcp_drop_q0(tcp_t *tcp) 4677 { 4678 tcp_t *eager; 4679 4680 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 4681 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 4682 /* 4683 * New one is added after next_q0 so prev_q0 points to the oldest 4684 * Also do not drop any established connections that are deferred on 4685 * q0 due to q being full 4686 */ 4687 4688 eager = tcp->tcp_eager_prev_q0; 4689 while (eager->tcp_dontdrop || eager->tcp_conn_def_q0) { 4690 eager = eager->tcp_eager_prev_q0; 4691 if (eager == tcp) { 4692 eager = tcp->tcp_eager_prev_q0; 4693 break; 4694 } 4695 } 4696 if (eager->tcp_syn_rcvd_timeout == 0) 4697 return (B_FALSE); 4698 4699 if (tcp->tcp_debug) { 4700 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 4701 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 4702 " (%d pending) on %s, drop one", tcp_conn_req_max_q0, 4703 tcp->tcp_conn_req_cnt_q0, 4704 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 4705 } 4706 4707 BUMP_MIB(&tcp_mib, tcpHalfOpenDrop); 4708 4709 /* 4710 * need to do refhold here because the selected eager could 4711 * be removed by someone else if we release the eager lock. 4712 */ 4713 CONN_INC_REF(eager->tcp_connp); 4714 mutex_exit(&tcp->tcp_eager_lock); 4715 4716 /* Mark the IRE created for this SYN request temporary */ 4717 tcp_ip_ire_mark_advice(eager); 4718 (void) tcp_clean_death(eager, ETIMEDOUT, 5); 4719 CONN_DEC_REF(eager->tcp_connp); 4720 4721 mutex_enter(&tcp->tcp_eager_lock); 4722 return (B_TRUE); 4723 } 4724 4725 int 4726 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 4727 tcph_t *tcph, uint_t ipvers, mblk_t *idmp) 4728 { 4729 tcp_t *ltcp = lconnp->conn_tcp; 4730 tcp_t *tcp = connp->conn_tcp; 4731 mblk_t *tpi_mp; 4732 ipha_t *ipha; 4733 ip6_t *ip6h; 4734 sin6_t sin6; 4735 in6_addr_t v6dst; 4736 int err; 4737 int ifindex = 0; 4738 cred_t *cr; 4739 4740 if (ipvers == IPV4_VERSION) { 4741 ipha = (ipha_t *)mp->b_rptr; 4742 4743 connp->conn_send = ip_output; 4744 connp->conn_recv = tcp_input; 4745 4746 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 4747 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 4748 4749 sin6 = sin6_null; 4750 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 4751 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 4752 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 4753 sin6.sin6_family = AF_INET6; 4754 sin6.__sin6_src_id = ip_srcid_find_addr(&v6dst, 4755 lconnp->conn_zoneid); 4756 if (tcp->tcp_recvdstaddr) { 4757 sin6_t sin6d; 4758 4759 sin6d = sin6_null; 4760 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, 4761 &sin6d.sin6_addr); 4762 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 4763 sin6d.sin6_family = AF_INET; 4764 tpi_mp = mi_tpi_extconn_ind(NULL, 4765 (char *)&sin6d, sizeof (sin6_t), 4766 (char *)&tcp, 4767 (t_scalar_t)sizeof (intptr_t), 4768 (char *)&sin6d, sizeof (sin6_t), 4769 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4770 } else { 4771 tpi_mp = mi_tpi_conn_ind(NULL, 4772 (char *)&sin6, sizeof (sin6_t), 4773 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4774 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4775 } 4776 } else { 4777 ip6h = (ip6_t *)mp->b_rptr; 4778 4779 connp->conn_send = ip_output_v6; 4780 connp->conn_recv = tcp_input; 4781 4782 connp->conn_srcv6 = ip6h->ip6_dst; 4783 connp->conn_remv6 = ip6h->ip6_src; 4784 4785 /* db_cksumstuff is set at ip_fanout_tcp_v6 */ 4786 ifindex = (int)DB_CKSUMSTUFF(mp); 4787 DB_CKSUMSTUFF(mp) = 0; 4788 4789 sin6 = sin6_null; 4790 sin6.sin6_addr = ip6h->ip6_src; 4791 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 4792 sin6.sin6_family = AF_INET6; 4793 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 4794 sin6.__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 4795 lconnp->conn_zoneid); 4796 4797 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 4798 /* Pass up the scope_id of remote addr */ 4799 sin6.sin6_scope_id = ifindex; 4800 } else { 4801 sin6.sin6_scope_id = 0; 4802 } 4803 if (tcp->tcp_recvdstaddr) { 4804 sin6_t sin6d; 4805 4806 sin6d = sin6_null; 4807 sin6.sin6_addr = ip6h->ip6_dst; 4808 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 4809 sin6d.sin6_family = AF_INET; 4810 tpi_mp = mi_tpi_extconn_ind(NULL, 4811 (char *)&sin6d, sizeof (sin6_t), 4812 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4813 (char *)&sin6d, sizeof (sin6_t), 4814 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4815 } else { 4816 tpi_mp = mi_tpi_conn_ind(NULL, 4817 (char *)&sin6, sizeof (sin6_t), 4818 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 4819 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 4820 } 4821 } 4822 4823 if (tpi_mp == NULL) 4824 return (ENOMEM); 4825 4826 connp->conn_fport = *(uint16_t *)tcph->th_lport; 4827 connp->conn_lport = *(uint16_t *)tcph->th_fport; 4828 connp->conn_flags |= (IPCL_TCP6|IPCL_EAGER); 4829 connp->conn_fully_bound = B_FALSE; 4830 4831 if (tcp_trace) 4832 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 4833 4834 /* Inherit information from the "parent" */ 4835 tcp->tcp_ipversion = ltcp->tcp_ipversion; 4836 tcp->tcp_family = ltcp->tcp_family; 4837 tcp->tcp_wq = ltcp->tcp_wq; 4838 tcp->tcp_rq = ltcp->tcp_rq; 4839 tcp->tcp_mss = tcp_mss_def_ipv6; 4840 tcp->tcp_detached = B_TRUE; 4841 if ((err = tcp_init_values(tcp)) != 0) { 4842 freemsg(tpi_mp); 4843 return (err); 4844 } 4845 4846 if (ipvers == IPV4_VERSION) { 4847 if ((err = tcp_header_init_ipv4(tcp)) != 0) { 4848 freemsg(tpi_mp); 4849 return (err); 4850 } 4851 ASSERT(tcp->tcp_ipha != NULL); 4852 } else { 4853 /* ifindex must be already set */ 4854 ASSERT(ifindex != 0); 4855 4856 if (ltcp->tcp_bound_if != 0) { 4857 /* 4858 * Set newtcp's bound_if equal to 4859 * listener's value. If ifindex is 4860 * not the same as ltcp->tcp_bound_if, 4861 * it must be a packet for the ipmp group 4862 * of interfaces 4863 */ 4864 tcp->tcp_bound_if = ltcp->tcp_bound_if; 4865 } else if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 4866 tcp->tcp_bound_if = ifindex; 4867 } 4868 4869 tcp->tcp_ipv6_recvancillary = ltcp->tcp_ipv6_recvancillary; 4870 tcp->tcp_recvifindex = 0; 4871 tcp->tcp_recvhops = 0xffffffffU; 4872 ASSERT(tcp->tcp_ip6h != NULL); 4873 } 4874 4875 tcp->tcp_lport = ltcp->tcp_lport; 4876 4877 if (ltcp->tcp_ipversion == tcp->tcp_ipversion) { 4878 if (tcp->tcp_iphc_len != ltcp->tcp_iphc_len) { 4879 /* 4880 * Listener had options of some sort; eager inherits. 4881 * Free up the eager template and allocate one 4882 * of the right size. 4883 */ 4884 if (tcp->tcp_hdr_grown) { 4885 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 4886 } else { 4887 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 4888 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 4889 } 4890 tcp->tcp_iphc = kmem_zalloc(ltcp->tcp_iphc_len, 4891 KM_NOSLEEP); 4892 if (tcp->tcp_iphc == NULL) { 4893 tcp->tcp_iphc_len = 0; 4894 freemsg(tpi_mp); 4895 return (ENOMEM); 4896 } 4897 tcp->tcp_iphc_len = ltcp->tcp_iphc_len; 4898 tcp->tcp_hdr_grown = B_TRUE; 4899 } 4900 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 4901 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 4902 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 4903 tcp->tcp_ip6_hops = ltcp->tcp_ip6_hops; 4904 tcp->tcp_ip6_vcf = ltcp->tcp_ip6_vcf; 4905 4906 /* 4907 * Copy the IP+TCP header template from listener to eager 4908 */ 4909 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 4910 if (tcp->tcp_ipversion == IPV6_VERSION) { 4911 if (((ip6i_t *)(tcp->tcp_iphc))->ip6i_nxt == 4912 IPPROTO_RAW) { 4913 tcp->tcp_ip6h = 4914 (ip6_t *)(tcp->tcp_iphc + 4915 sizeof (ip6i_t)); 4916 } else { 4917 tcp->tcp_ip6h = 4918 (ip6_t *)(tcp->tcp_iphc); 4919 } 4920 tcp->tcp_ipha = NULL; 4921 } else { 4922 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 4923 tcp->tcp_ip6h = NULL; 4924 } 4925 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 4926 tcp->tcp_ip_hdr_len); 4927 } else { 4928 /* 4929 * only valid case when ipversion of listener and 4930 * eager differ is when listener is IPv6 and 4931 * eager is IPv4. 4932 * Eager header template has been initialized to the 4933 * maximum v4 header sizes, which includes space for 4934 * TCP and IP options. 4935 */ 4936 ASSERT((ltcp->tcp_ipversion == IPV6_VERSION) && 4937 (tcp->tcp_ipversion == IPV4_VERSION)); 4938 ASSERT(tcp->tcp_iphc_len >= 4939 TCP_MAX_COMBINED_HEADER_LENGTH); 4940 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 4941 /* copy IP header fields individually */ 4942 tcp->tcp_ipha->ipha_ttl = 4943 ltcp->tcp_ip6h->ip6_hops; 4944 bcopy(ltcp->tcp_tcph->th_lport, 4945 tcp->tcp_tcph->th_lport, sizeof (ushort_t)); 4946 } 4947 4948 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 4949 bcopy(tcp->tcp_tcph->th_fport, &tcp->tcp_fport, 4950 sizeof (in_port_t)); 4951 4952 if (ltcp->tcp_lport == 0) { 4953 tcp->tcp_lport = *(in_port_t *)tcph->th_fport; 4954 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, 4955 sizeof (in_port_t)); 4956 } 4957 4958 if (tcp->tcp_ipversion == IPV4_VERSION) { 4959 ASSERT(ipha != NULL); 4960 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 4961 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 4962 4963 /* Source routing option copyover (reverse it) */ 4964 if (tcp_rev_src_routes) 4965 tcp_opt_reverse(tcp, ipha); 4966 } else { 4967 ASSERT(ip6h != NULL); 4968 tcp->tcp_ip6h->ip6_dst = ip6h->ip6_src; 4969 tcp->tcp_ip6h->ip6_src = ip6h->ip6_dst; 4970 } 4971 4972 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 4973 /* 4974 * If the SYN contains a credential, it's a loopback packet; attach 4975 * the credential to the TPI message. 4976 */ 4977 if ((cr = DB_CRED(idmp)) != NULL) { 4978 mblk_setcred(tpi_mp, cr); 4979 DB_CPID(tpi_mp) = DB_CPID(idmp); 4980 } 4981 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 4982 4983 /* Inherit the listener's SSL protection state */ 4984 4985 if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) { 4986 kssl_hold_ent(tcp->tcp_kssl_ent); 4987 tcp->tcp_kssl_pending = B_TRUE; 4988 } 4989 4990 return (0); 4991 } 4992 4993 4994 int 4995 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 4996 tcph_t *tcph, mblk_t *idmp) 4997 { 4998 tcp_t *ltcp = lconnp->conn_tcp; 4999 tcp_t *tcp = connp->conn_tcp; 5000 sin_t sin; 5001 mblk_t *tpi_mp = NULL; 5002 int err; 5003 cred_t *cr; 5004 5005 sin = sin_null; 5006 sin.sin_addr.s_addr = ipha->ipha_src; 5007 sin.sin_port = *(uint16_t *)tcph->th_lport; 5008 sin.sin_family = AF_INET; 5009 if (ltcp->tcp_recvdstaddr) { 5010 sin_t sind; 5011 5012 sind = sin_null; 5013 sind.sin_addr.s_addr = ipha->ipha_dst; 5014 sind.sin_port = *(uint16_t *)tcph->th_fport; 5015 sind.sin_family = AF_INET; 5016 tpi_mp = mi_tpi_extconn_ind(NULL, 5017 (char *)&sind, sizeof (sin_t), (char *)&tcp, 5018 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 5019 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5020 } else { 5021 tpi_mp = mi_tpi_conn_ind(NULL, 5022 (char *)&sin, sizeof (sin_t), 5023 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5024 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5025 } 5026 5027 if (tpi_mp == NULL) { 5028 return (ENOMEM); 5029 } 5030 5031 connp->conn_flags |= (IPCL_TCP4|IPCL_EAGER); 5032 connp->conn_send = ip_output; 5033 connp->conn_recv = tcp_input; 5034 connp->conn_fully_bound = B_FALSE; 5035 5036 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 5037 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 5038 connp->conn_fport = *(uint16_t *)tcph->th_lport; 5039 connp->conn_lport = *(uint16_t *)tcph->th_fport; 5040 5041 if (tcp_trace) { 5042 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 5043 } 5044 5045 /* Inherit information from the "parent" */ 5046 tcp->tcp_ipversion = ltcp->tcp_ipversion; 5047 tcp->tcp_family = ltcp->tcp_family; 5048 tcp->tcp_wq = ltcp->tcp_wq; 5049 tcp->tcp_rq = ltcp->tcp_rq; 5050 tcp->tcp_mss = tcp_mss_def_ipv4; 5051 tcp->tcp_detached = B_TRUE; 5052 if ((err = tcp_init_values(tcp)) != 0) { 5053 freemsg(tpi_mp); 5054 return (err); 5055 } 5056 5057 /* 5058 * Let's make sure that eager tcp template has enough space to 5059 * copy IPv4 listener's tcp template. Since the conn_t structure is 5060 * preserved and tcp_iphc_len is also preserved, an eager conn_t may 5061 * have a tcp_template of total len TCP_MAX_COMBINED_HEADER_LENGTH or 5062 * more (in case of re-allocation of conn_t with tcp-IPv6 template with 5063 * extension headers or with ip6i_t struct). Note that bcopy() below 5064 * copies listener tcp's hdr_len which cannot be greater than TCP_MAX_ 5065 * COMBINED_HEADER_LENGTH as this listener must be a IPv4 listener. 5066 */ 5067 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 5068 ASSERT(ltcp->tcp_hdr_len <= TCP_MAX_COMBINED_HEADER_LENGTH); 5069 5070 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 5071 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 5072 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5073 tcp->tcp_ttl = ltcp->tcp_ttl; 5074 tcp->tcp_tos = ltcp->tcp_tos; 5075 5076 /* Copy the IP+TCP header template from listener to eager */ 5077 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 5078 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 5079 tcp->tcp_ip6h = NULL; 5080 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 5081 tcp->tcp_ip_hdr_len); 5082 5083 /* Initialize the IP addresses and Ports */ 5084 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 5085 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 5086 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 5087 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t)); 5088 5089 /* Source routing option copyover (reverse it) */ 5090 if (tcp_rev_src_routes) 5091 tcp_opt_reverse(tcp, ipha); 5092 5093 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 5094 5095 /* 5096 * If the SYN contains a credential, it's a loopback packet; attach 5097 * the credential to the TPI message. 5098 */ 5099 if ((cr = DB_CRED(idmp)) != NULL) { 5100 mblk_setcred(tpi_mp, cr); 5101 DB_CPID(tpi_mp) = DB_CPID(idmp); 5102 } 5103 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 5104 5105 /* Inherit the listener's SSL protection state */ 5106 if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) { 5107 kssl_hold_ent(tcp->tcp_kssl_ent); 5108 tcp->tcp_kssl_pending = B_TRUE; 5109 } 5110 5111 return (0); 5112 } 5113 5114 /* 5115 * sets up conn for ipsec. 5116 * if the first mblk is M_CTL it is consumed and mpp is updated. 5117 * in case of error mpp is freed. 5118 */ 5119 conn_t * 5120 tcp_get_ipsec_conn(tcp_t *tcp, squeue_t *sqp, mblk_t **mpp) 5121 { 5122 conn_t *connp = tcp->tcp_connp; 5123 conn_t *econnp; 5124 squeue_t *new_sqp; 5125 mblk_t *first_mp = *mpp; 5126 mblk_t *mp = *mpp; 5127 boolean_t mctl_present = B_FALSE; 5128 uint_t ipvers; 5129 5130 econnp = tcp_get_conn(sqp); 5131 if (econnp == NULL) { 5132 freemsg(first_mp); 5133 return (NULL); 5134 } 5135 if (DB_TYPE(mp) == M_CTL) { 5136 if (mp->b_cont == NULL || 5137 mp->b_cont->b_datap->db_type != M_DATA) { 5138 freemsg(first_mp); 5139 return (NULL); 5140 } 5141 mp = mp->b_cont; 5142 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) == 0) { 5143 freemsg(first_mp); 5144 return (NULL); 5145 } 5146 5147 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 5148 first_mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5149 mctl_present = B_TRUE; 5150 } else { 5151 ASSERT(mp->b_datap->db_struioflag & STRUIO_POLICY); 5152 mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5153 } 5154 5155 new_sqp = (squeue_t *)DB_CKSUMSTART(mp); 5156 DB_CKSUMSTART(mp) = 0; 5157 5158 ASSERT(OK_32PTR(mp->b_rptr)); 5159 ipvers = IPH_HDR_VERSION(mp->b_rptr); 5160 if (ipvers == IPV4_VERSION) { 5161 uint16_t *up; 5162 uint32_t ports; 5163 ipha_t *ipha; 5164 5165 ipha = (ipha_t *)mp->b_rptr; 5166 up = (uint16_t *)((uchar_t *)ipha + 5167 IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET); 5168 ports = *(uint32_t *)up; 5169 IPCL_TCP_EAGER_INIT(econnp, IPPROTO_TCP, 5170 ipha->ipha_dst, ipha->ipha_src, ports); 5171 } else { 5172 uint16_t *up; 5173 uint32_t ports; 5174 uint16_t ip_hdr_len; 5175 uint8_t *nexthdrp; 5176 ip6_t *ip6h; 5177 tcph_t *tcph; 5178 5179 ip6h = (ip6_t *)mp->b_rptr; 5180 if (ip6h->ip6_nxt == IPPROTO_TCP) { 5181 ip_hdr_len = IPV6_HDR_LEN; 5182 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip_hdr_len, 5183 &nexthdrp) || *nexthdrp != IPPROTO_TCP) { 5184 CONN_DEC_REF(econnp); 5185 freemsg(first_mp); 5186 return (NULL); 5187 } 5188 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 5189 up = (uint16_t *)tcph->th_lport; 5190 ports = *(uint32_t *)up; 5191 IPCL_TCP_EAGER_INIT_V6(econnp, IPPROTO_TCP, 5192 ip6h->ip6_dst, ip6h->ip6_src, ports); 5193 } 5194 5195 /* 5196 * The caller already ensured that there is a sqp present. 5197 */ 5198 econnp->conn_sqp = new_sqp; 5199 5200 if (connp->conn_policy != NULL) { 5201 ipsec_in_t *ii; 5202 ii = (ipsec_in_t *)(first_mp->b_rptr); 5203 ASSERT(ii->ipsec_in_policy == NULL); 5204 IPPH_REFHOLD(connp->conn_policy); 5205 ii->ipsec_in_policy = connp->conn_policy; 5206 5207 first_mp->b_datap->db_type = IPSEC_POLICY_SET; 5208 if (!ip_bind_ipsec_policy_set(econnp, first_mp)) { 5209 CONN_DEC_REF(econnp); 5210 freemsg(first_mp); 5211 return (NULL); 5212 } 5213 } 5214 5215 if (ipsec_conn_cache_policy(econnp, ipvers == IPV4_VERSION) != 0) { 5216 CONN_DEC_REF(econnp); 5217 freemsg(first_mp); 5218 return (NULL); 5219 } 5220 5221 /* 5222 * If we know we have some policy, pass the "IPSEC" 5223 * options size TCP uses this adjust the MSS. 5224 */ 5225 econnp->conn_tcp->tcp_ipsec_overhead = conn_ipsec_length(econnp); 5226 if (mctl_present) { 5227 freeb(first_mp); 5228 *mpp = mp; 5229 } 5230 5231 return (econnp); 5232 } 5233 5234 /* 5235 * tcp_get_conn/tcp_free_conn 5236 * 5237 * tcp_get_conn is used to get a clean tcp connection structure. 5238 * It tries to reuse the connections put on the freelist by the 5239 * time_wait_collector failing which it goes to kmem_cache. This 5240 * way has two benefits compared to just allocating from and 5241 * freeing to kmem_cache. 5242 * 1) The time_wait_collector can free (which includes the cleanup) 5243 * outside the squeue. So when the interrupt comes, we have a clean 5244 * connection sitting in the freelist. Obviously, this buys us 5245 * performance. 5246 * 5247 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_conn_request 5248 * has multiple disadvantages - tying up the squeue during alloc, and the 5249 * fact that IPSec policy initialization has to happen here which 5250 * requires us sending a M_CTL and checking for it i.e. real ugliness. 5251 * But allocating the conn/tcp in IP land is also not the best since 5252 * we can't check the 'q' and 'q0' which are protected by squeue and 5253 * blindly allocate memory which might have to be freed here if we are 5254 * not allowed to accept the connection. By using the freelist and 5255 * putting the conn/tcp back in freelist, we don't pay a penalty for 5256 * allocating memory without checking 'q/q0' and freeing it if we can't 5257 * accept the connection. 5258 * 5259 * Care should be taken to put the conn back in the same squeue's freelist 5260 * from which it was allocated. Best results are obtained if conn is 5261 * allocated from listener's squeue and freed to the same. Time wait 5262 * collector will free up the freelist is the connection ends up sitting 5263 * there for too long. 5264 */ 5265 void * 5266 tcp_get_conn(void *arg) 5267 { 5268 tcp_t *tcp = NULL; 5269 conn_t *connp = NULL; 5270 squeue_t *sqp = (squeue_t *)arg; 5271 tcp_squeue_priv_t *tcp_time_wait; 5272 5273 tcp_time_wait = 5274 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 5275 5276 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 5277 tcp = tcp_time_wait->tcp_free_list; 5278 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 5279 if (tcp != NULL) { 5280 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 5281 tcp_time_wait->tcp_free_list_cnt--; 5282 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5283 tcp->tcp_time_wait_next = NULL; 5284 connp = tcp->tcp_connp; 5285 connp->conn_flags |= IPCL_REUSED; 5286 return ((void *)connp); 5287 } 5288 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5289 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL) 5290 return (NULL); 5291 return ((void *)connp); 5292 } 5293 5294 /* 5295 * Update the cached label for the given tcp_t. This should be called once per 5296 * connection, and before any packets are sent or tcp_process_options is 5297 * invoked. Returns B_FALSE if the correct label could not be constructed. 5298 */ 5299 static boolean_t 5300 tcp_update_label(tcp_t *tcp, const cred_t *cr) 5301 { 5302 conn_t *connp = tcp->tcp_connp; 5303 5304 if (tcp->tcp_ipversion == IPV4_VERSION) { 5305 uchar_t optbuf[IP_MAX_OPT_LENGTH]; 5306 int added; 5307 5308 if (tsol_compute_label(cr, tcp->tcp_remote, optbuf, 5309 connp->conn_mac_exempt) != 0) 5310 return (B_FALSE); 5311 5312 added = tsol_remove_secopt(tcp->tcp_ipha, tcp->tcp_hdr_len); 5313 if (added == -1) 5314 return (B_FALSE); 5315 tcp->tcp_hdr_len += added; 5316 tcp->tcp_tcph = (tcph_t *)((uchar_t *)tcp->tcp_tcph + added); 5317 tcp->tcp_ip_hdr_len += added; 5318 if ((tcp->tcp_label_len = optbuf[IPOPT_OLEN]) != 0) { 5319 tcp->tcp_label_len = (tcp->tcp_label_len + 3) & ~3; 5320 added = tsol_prepend_option(optbuf, tcp->tcp_ipha, 5321 tcp->tcp_hdr_len); 5322 if (added == -1) 5323 return (B_FALSE); 5324 tcp->tcp_hdr_len += added; 5325 tcp->tcp_tcph = (tcph_t *) 5326 ((uchar_t *)tcp->tcp_tcph + added); 5327 tcp->tcp_ip_hdr_len += added; 5328 } 5329 } else { 5330 uchar_t optbuf[TSOL_MAX_IPV6_OPTION]; 5331 5332 if (tsol_compute_label_v6(cr, &tcp->tcp_remote_v6, optbuf, 5333 connp->conn_mac_exempt) != 0) 5334 return (B_FALSE); 5335 if (tsol_update_sticky(&tcp->tcp_sticky_ipp, 5336 &tcp->tcp_label_len, optbuf) != 0) 5337 return (B_FALSE); 5338 if (tcp_build_hdrs(tcp->tcp_rq, tcp) != 0) 5339 return (B_FALSE); 5340 } 5341 5342 connp->conn_ulp_labeled = 1; 5343 5344 return (B_TRUE); 5345 } 5346 5347 /* BEGIN CSTYLED */ 5348 /* 5349 * 5350 * The sockfs ACCEPT path: 5351 * ======================= 5352 * 5353 * The eager is now established in its own perimeter as soon as SYN is 5354 * received in tcp_conn_request(). When sockfs receives conn_ind, it 5355 * completes the accept processing on the acceptor STREAM. The sending 5356 * of conn_ind part is common for both sockfs listener and a TLI/XTI 5357 * listener but a TLI/XTI listener completes the accept processing 5358 * on the listener perimeter. 5359 * 5360 * Common control flow for 3 way handshake: 5361 * ---------------------------------------- 5362 * 5363 * incoming SYN (listener perimeter) -> tcp_rput_data() 5364 * -> tcp_conn_request() 5365 * 5366 * incoming SYN-ACK-ACK (eager perim) -> tcp_rput_data() 5367 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 5368 * 5369 * Sockfs ACCEPT Path: 5370 * ------------------- 5371 * 5372 * open acceptor stream (ip_tcpopen allocates tcp_wput_accept() 5373 * as STREAM entry point) 5374 * 5375 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_wput_accept() 5376 * 5377 * tcp_wput_accept() extracts the eager and makes the q->q_ptr <-> eager 5378 * association (we are not behind eager's squeue but sockfs is protecting us 5379 * and no one knows about this stream yet. The STREAMS entry point q->q_info 5380 * is changed to point at tcp_wput(). 5381 * 5382 * tcp_wput_accept() sends any deferred eagers via tcp_send_pending() to 5383 * listener (done on listener's perimeter). 5384 * 5385 * tcp_wput_accept() calls tcp_accept_finish() on eagers perimeter to finish 5386 * accept. 5387 * 5388 * TLI/XTI client ACCEPT path: 5389 * --------------------------- 5390 * 5391 * soaccept() sends T_CONN_RES on the listener STREAM. 5392 * 5393 * tcp_accept() -> tcp_accept_swap() complete the processing and send 5394 * the bind_mp to eager perimeter to finish accept (tcp_rput_other()). 5395 * 5396 * Locks: 5397 * ====== 5398 * 5399 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 5400 * and listeners->tcp_eager_next_q. 5401 * 5402 * Referencing: 5403 * ============ 5404 * 5405 * 1) We start out in tcp_conn_request by eager placing a ref on 5406 * listener and listener adding eager to listeners->tcp_eager_next_q0. 5407 * 5408 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 5409 * doing so we place a ref on the eager. This ref is finally dropped at the 5410 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 5411 * reference is dropped by the squeue framework. 5412 * 5413 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 5414 * 5415 * The reference must be released by the same entity that added the reference 5416 * In the above scheme, the eager is the entity that adds and releases the 5417 * references. Note that tcp_accept_finish executes in the squeue of the eager 5418 * (albeit after it is attached to the acceptor stream). Though 1. executes 5419 * in the listener's squeue, the eager is nascent at this point and the 5420 * reference can be considered to have been added on behalf of the eager. 5421 * 5422 * Eager getting a Reset or listener closing: 5423 * ========================================== 5424 * 5425 * Once the listener and eager are linked, the listener never does the unlink. 5426 * If the listener needs to close, tcp_eager_cleanup() is called which queues 5427 * a message on all eager perimeter. The eager then does the unlink, clears 5428 * any pointers to the listener's queue and drops the reference to the 5429 * listener. The listener waits in tcp_close outside the squeue until its 5430 * refcount has dropped to 1. This ensures that the listener has waited for 5431 * all eagers to clear their association with the listener. 5432 * 5433 * Similarly, if eager decides to go away, it can unlink itself and close. 5434 * When the T_CONN_RES comes down, we check if eager has closed. Note that 5435 * the reference to eager is still valid because of the extra ref we put 5436 * in tcp_send_conn_ind. 5437 * 5438 * Listener can always locate the eager under the protection 5439 * of the listener->tcp_eager_lock, and then do a refhold 5440 * on the eager during the accept processing. 5441 * 5442 * The acceptor stream accesses the eager in the accept processing 5443 * based on the ref placed on eager before sending T_conn_ind. 5444 * The only entity that can negate this refhold is a listener close 5445 * which is mutually exclusive with an active acceptor stream. 5446 * 5447 * Eager's reference on the listener 5448 * =================================== 5449 * 5450 * If the accept happens (even on a closed eager) the eager drops its 5451 * reference on the listener at the start of tcp_accept_finish. If the 5452 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 5453 * the reference is dropped in tcp_closei_local. If the listener closes, 5454 * the reference is dropped in tcp_eager_kill. In all cases the reference 5455 * is dropped while executing in the eager's context (squeue). 5456 */ 5457 /* END CSTYLED */ 5458 5459 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 5460 5461 /* 5462 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 5463 * tcp_rput_data will not see any SYN packets. 5464 */ 5465 /* ARGSUSED */ 5466 void 5467 tcp_conn_request(void *arg, mblk_t *mp, void *arg2) 5468 { 5469 tcph_t *tcph; 5470 uint32_t seg_seq; 5471 tcp_t *eager; 5472 uint_t ipvers; 5473 ipha_t *ipha; 5474 ip6_t *ip6h; 5475 int err; 5476 conn_t *econnp = NULL; 5477 squeue_t *new_sqp; 5478 mblk_t *mp1; 5479 uint_t ip_hdr_len; 5480 conn_t *connp = (conn_t *)arg; 5481 tcp_t *tcp = connp->conn_tcp; 5482 ire_t *ire; 5483 cred_t *credp; 5484 5485 if (tcp->tcp_state != TCPS_LISTEN) 5486 goto error2; 5487 5488 ASSERT((tcp->tcp_connp->conn_flags & IPCL_BOUND) != 0); 5489 5490 mutex_enter(&tcp->tcp_eager_lock); 5491 if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) { 5492 mutex_exit(&tcp->tcp_eager_lock); 5493 TCP_STAT(tcp_listendrop); 5494 BUMP_MIB(&tcp_mib, tcpListenDrop); 5495 if (tcp->tcp_debug) { 5496 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 5497 "tcp_conn_request: listen backlog (max=%d) " 5498 "overflow (%d pending) on %s", 5499 tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q, 5500 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 5501 } 5502 goto error2; 5503 } 5504 5505 if (tcp->tcp_conn_req_cnt_q0 >= 5506 tcp->tcp_conn_req_max + tcp_conn_req_max_q0) { 5507 /* 5508 * Q0 is full. Drop a pending half-open req from the queue 5509 * to make room for the new SYN req. Also mark the time we 5510 * drop a SYN. 5511 * 5512 * A more aggressive defense against SYN attack will 5513 * be to set the "tcp_syn_defense" flag now. 5514 */ 5515 TCP_STAT(tcp_listendropq0); 5516 tcp->tcp_last_rcv_lbolt = lbolt64; 5517 if (!tcp_drop_q0(tcp)) { 5518 mutex_exit(&tcp->tcp_eager_lock); 5519 BUMP_MIB(&tcp_mib, tcpListenDropQ0); 5520 if (tcp->tcp_debug) { 5521 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 5522 "tcp_conn_request: listen half-open queue " 5523 "(max=%d) full (%d pending) on %s", 5524 tcp_conn_req_max_q0, 5525 tcp->tcp_conn_req_cnt_q0, 5526 tcp_display(tcp, NULL, 5527 DISP_PORT_ONLY)); 5528 } 5529 goto error2; 5530 } 5531 } 5532 mutex_exit(&tcp->tcp_eager_lock); 5533 5534 /* 5535 * IP adds STRUIO_EAGER and ensures that the received packet is 5536 * M_DATA even if conn_ipv6_recvpktinfo is enabled or for ip6 5537 * link local address. If IPSec is enabled, db_struioflag has 5538 * STRUIO_POLICY set (mutually exclusive from STRUIO_EAGER); 5539 * otherwise an error case if neither of them is set. 5540 */ 5541 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 5542 new_sqp = (squeue_t *)DB_CKSUMSTART(mp); 5543 DB_CKSUMSTART(mp) = 0; 5544 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 5545 econnp = (conn_t *)tcp_get_conn(arg2); 5546 if (econnp == NULL) 5547 goto error2; 5548 econnp->conn_sqp = new_sqp; 5549 } else if ((mp->b_datap->db_struioflag & STRUIO_POLICY) != 0) { 5550 /* 5551 * mp is updated in tcp_get_ipsec_conn(). 5552 */ 5553 econnp = tcp_get_ipsec_conn(tcp, arg2, &mp); 5554 if (econnp == NULL) { 5555 /* 5556 * mp freed by tcp_get_ipsec_conn. 5557 */ 5558 return; 5559 } 5560 } else { 5561 goto error2; 5562 } 5563 5564 ASSERT(DB_TYPE(mp) == M_DATA); 5565 5566 ipvers = IPH_HDR_VERSION(mp->b_rptr); 5567 ASSERT(ipvers == IPV6_VERSION || ipvers == IPV4_VERSION); 5568 ASSERT(OK_32PTR(mp->b_rptr)); 5569 if (ipvers == IPV4_VERSION) { 5570 ipha = (ipha_t *)mp->b_rptr; 5571 ip_hdr_len = IPH_HDR_LENGTH(ipha); 5572 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 5573 } else { 5574 ip6h = (ip6_t *)mp->b_rptr; 5575 ip_hdr_len = ip_hdr_length_v6(mp, ip6h); 5576 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 5577 } 5578 5579 if (tcp->tcp_family == AF_INET) { 5580 ASSERT(ipvers == IPV4_VERSION); 5581 err = tcp_conn_create_v4(connp, econnp, ipha, tcph, mp); 5582 } else { 5583 err = tcp_conn_create_v6(connp, econnp, mp, tcph, ipvers, mp); 5584 } 5585 5586 if (err) 5587 goto error3; 5588 5589 eager = econnp->conn_tcp; 5590 5591 /* Inherit various TCP parameters from the listener */ 5592 eager->tcp_naglim = tcp->tcp_naglim; 5593 eager->tcp_first_timer_threshold = 5594 tcp->tcp_first_timer_threshold; 5595 eager->tcp_second_timer_threshold = 5596 tcp->tcp_second_timer_threshold; 5597 5598 eager->tcp_first_ctimer_threshold = 5599 tcp->tcp_first_ctimer_threshold; 5600 eager->tcp_second_ctimer_threshold = 5601 tcp->tcp_second_ctimer_threshold; 5602 5603 /* 5604 * tcp_adapt_ire() may change tcp_rwnd according to the ire metrics. 5605 * If it does not, the eager's receive window will be set to the 5606 * listener's receive window later in this function. 5607 */ 5608 eager->tcp_rwnd = 0; 5609 5610 /* 5611 * Inherit listener's tcp_init_cwnd. Need to do this before 5612 * calling tcp_process_options() where tcp_mss_set() is called 5613 * to set the initial cwnd. 5614 */ 5615 eager->tcp_init_cwnd = tcp->tcp_init_cwnd; 5616 5617 /* 5618 * Zones: tcp_adapt_ire() and tcp_send_data() both need the 5619 * zone id before the accept is completed in tcp_wput_accept(). 5620 */ 5621 econnp->conn_zoneid = connp->conn_zoneid; 5622 econnp->conn_allzones = connp->conn_allzones; 5623 5624 /* Copy nexthop information from listener to eager */ 5625 if (connp->conn_nexthop_set) { 5626 econnp->conn_nexthop_set = connp->conn_nexthop_set; 5627 econnp->conn_nexthop_v4 = connp->conn_nexthop_v4; 5628 } 5629 5630 /* 5631 * TSOL: tsol_input_proc() needs the eager's cred before the 5632 * eager is accepted 5633 */ 5634 econnp->conn_cred = eager->tcp_cred = credp = connp->conn_cred; 5635 crhold(credp); 5636 5637 /* 5638 * If the caller has the process-wide flag set, then default to MAC 5639 * exempt mode. This allows read-down to unlabeled hosts. 5640 */ 5641 if (getpflags(NET_MAC_AWARE, credp) != 0) 5642 econnp->conn_mac_exempt = B_TRUE; 5643 5644 if (is_system_labeled()) { 5645 cred_t *cr; 5646 5647 if (connp->conn_mlp_type != mlptSingle) { 5648 cr = econnp->conn_peercred = DB_CRED(mp); 5649 if (cr != NULL) 5650 crhold(cr); 5651 else 5652 cr = econnp->conn_cred; 5653 DTRACE_PROBE2(mlp_syn_accept, conn_t *, 5654 econnp, cred_t *, cr) 5655 } else { 5656 cr = econnp->conn_cred; 5657 DTRACE_PROBE2(syn_accept, conn_t *, 5658 econnp, cred_t *, cr) 5659 } 5660 5661 if (!tcp_update_label(eager, cr)) { 5662 DTRACE_PROBE3( 5663 tx__ip__log__error__connrequest__tcp, 5664 char *, "eager connp(1) label on SYN mp(2) failed", 5665 conn_t *, econnp, mblk_t *, mp); 5666 goto error3; 5667 } 5668 } 5669 5670 eager->tcp_hard_binding = B_TRUE; 5671 5672 tcp_bind_hash_insert(&tcp_bind_fanout[ 5673 TCP_BIND_HASH(eager->tcp_lport)], eager, 0); 5674 5675 CL_INET_CONNECT(eager); 5676 5677 /* 5678 * No need to check for multicast destination since ip will only pass 5679 * up multicasts to those that have expressed interest 5680 * TODO: what about rejecting broadcasts? 5681 * Also check that source is not a multicast or broadcast address. 5682 */ 5683 eager->tcp_state = TCPS_SYN_RCVD; 5684 5685 5686 /* 5687 * There should be no ire in the mp as we are being called after 5688 * receiving the SYN. 5689 */ 5690 ASSERT(tcp_ire_mp(mp) == NULL); 5691 5692 /* 5693 * Adapt our mss, ttl, ... according to information provided in IRE. 5694 */ 5695 5696 if (tcp_adapt_ire(eager, NULL) == 0) { 5697 /* Undo the bind_hash_insert */ 5698 tcp_bind_hash_remove(eager); 5699 goto error3; 5700 } 5701 5702 /* Process all TCP options. */ 5703 tcp_process_options(eager, tcph); 5704 5705 /* Is the other end ECN capable? */ 5706 if (tcp_ecn_permitted >= 1 && 5707 (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 5708 eager->tcp_ecn_ok = B_TRUE; 5709 } 5710 5711 /* 5712 * listener->tcp_rq->q_hiwat should be the default window size or a 5713 * window size changed via SO_RCVBUF option. First round up the 5714 * eager's tcp_rwnd to the nearest MSS. Then find out the window 5715 * scale option value if needed. Call tcp_rwnd_set() to finish the 5716 * setting. 5717 * 5718 * Note if there is a rpipe metric associated with the remote host, 5719 * we should not inherit receive window size from listener. 5720 */ 5721 eager->tcp_rwnd = MSS_ROUNDUP( 5722 (eager->tcp_rwnd == 0 ? tcp->tcp_rq->q_hiwat : 5723 eager->tcp_rwnd), eager->tcp_mss); 5724 if (eager->tcp_snd_ws_ok) 5725 tcp_set_ws_value(eager); 5726 /* 5727 * Note that this is the only place tcp_rwnd_set() is called for 5728 * accepting a connection. We need to call it here instead of 5729 * after the 3-way handshake because we need to tell the other 5730 * side our rwnd in the SYN-ACK segment. 5731 */ 5732 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 5733 5734 /* 5735 * We eliminate the need for sockfs to send down a T_SVR4_OPTMGMT_REQ 5736 * via soaccept()->soinheritoptions() which essentially applies 5737 * all the listener options to the new STREAM. The options that we 5738 * need to take care of are: 5739 * SO_DEBUG, SO_REUSEADDR, SO_KEEPALIVE, SO_DONTROUTE, SO_BROADCAST, 5740 * SO_USELOOPBACK, SO_OOBINLINE, SO_DGRAM_ERRIND, SO_LINGER, 5741 * SO_SNDBUF, SO_RCVBUF. 5742 * 5743 * SO_RCVBUF: tcp_rwnd_set() above takes care of it. 5744 * SO_SNDBUF: Set the tcp_xmit_hiwater for the eager. When 5745 * tcp_maxpsz_set() gets called later from 5746 * tcp_accept_finish(), the option takes effect. 5747 * 5748 */ 5749 /* Set the TCP options */ 5750 eager->tcp_xmit_hiwater = tcp->tcp_xmit_hiwater; 5751 eager->tcp_dgram_errind = tcp->tcp_dgram_errind; 5752 eager->tcp_oobinline = tcp->tcp_oobinline; 5753 eager->tcp_reuseaddr = tcp->tcp_reuseaddr; 5754 eager->tcp_broadcast = tcp->tcp_broadcast; 5755 eager->tcp_useloopback = tcp->tcp_useloopback; 5756 eager->tcp_dontroute = tcp->tcp_dontroute; 5757 eager->tcp_linger = tcp->tcp_linger; 5758 eager->tcp_lingertime = tcp->tcp_lingertime; 5759 if (tcp->tcp_ka_enabled) 5760 eager->tcp_ka_enabled = 1; 5761 5762 /* Set the IP options */ 5763 econnp->conn_broadcast = connp->conn_broadcast; 5764 econnp->conn_loopback = connp->conn_loopback; 5765 econnp->conn_dontroute = connp->conn_dontroute; 5766 econnp->conn_reuseaddr = connp->conn_reuseaddr; 5767 5768 /* Put a ref on the listener for the eager. */ 5769 CONN_INC_REF(connp); 5770 mutex_enter(&tcp->tcp_eager_lock); 5771 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 5772 eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; 5773 tcp->tcp_eager_next_q0 = eager; 5774 eager->tcp_eager_prev_q0 = tcp; 5775 5776 /* Set tcp_listener before adding it to tcp_conn_fanout */ 5777 eager->tcp_listener = tcp; 5778 eager->tcp_saved_listener = tcp; 5779 5780 /* 5781 * Tag this detached tcp vector for later retrieval 5782 * by our listener client in tcp_accept(). 5783 */ 5784 eager->tcp_conn_req_seqnum = tcp->tcp_conn_req_seqnum; 5785 tcp->tcp_conn_req_cnt_q0++; 5786 if (++tcp->tcp_conn_req_seqnum == -1) { 5787 /* 5788 * -1 is "special" and defined in TPI as something 5789 * that should never be used in T_CONN_IND 5790 */ 5791 ++tcp->tcp_conn_req_seqnum; 5792 } 5793 mutex_exit(&tcp->tcp_eager_lock); 5794 5795 if (tcp->tcp_syn_defense) { 5796 /* Don't drop the SYN that comes from a good IP source */ 5797 ipaddr_t *addr_cache = (ipaddr_t *)(tcp->tcp_ip_addr_cache); 5798 if (addr_cache != NULL && eager->tcp_remote == 5799 addr_cache[IP_ADDR_CACHE_HASH(eager->tcp_remote)]) { 5800 eager->tcp_dontdrop = B_TRUE; 5801 } 5802 } 5803 5804 /* 5805 * We need to insert the eager in its own perimeter but as soon 5806 * as we do that, we expose the eager to the classifier and 5807 * should not touch any field outside the eager's perimeter. 5808 * So do all the work necessary before inserting the eager 5809 * in its own perimeter. Be optimistic that ipcl_conn_insert() 5810 * will succeed but undo everything if it fails. 5811 */ 5812 seg_seq = ABE32_TO_U32(tcph->th_seq); 5813 eager->tcp_irs = seg_seq; 5814 eager->tcp_rack = seg_seq; 5815 eager->tcp_rnxt = seg_seq + 1; 5816 U32_TO_ABE32(eager->tcp_rnxt, eager->tcp_tcph->th_ack); 5817 BUMP_MIB(&tcp_mib, tcpPassiveOpens); 5818 eager->tcp_state = TCPS_SYN_RCVD; 5819 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 5820 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 5821 if (mp1 == NULL) 5822 goto error1; 5823 DB_CPID(mp1) = tcp->tcp_cpid; 5824 5825 /* 5826 * We need to start the rto timer. In normal case, we start 5827 * the timer after sending the packet on the wire (or at 5828 * least believing that packet was sent by waiting for 5829 * CALL_IP_WPUT() to return). Since this is the first packet 5830 * being sent on the wire for the eager, our initial tcp_rto 5831 * is at least tcp_rexmit_interval_min which is a fairly 5832 * large value to allow the algorithm to adjust slowly to large 5833 * fluctuations of RTT during first few transmissions. 5834 * 5835 * Starting the timer first and then sending the packet in this 5836 * case shouldn't make much difference since tcp_rexmit_interval_min 5837 * is of the order of several 100ms and starting the timer 5838 * first and then sending the packet will result in difference 5839 * of few micro seconds. 5840 * 5841 * Without this optimization, we are forced to hold the fanout 5842 * lock across the ipcl_bind_insert() and sending the packet 5843 * so that we don't race against an incoming packet (maybe RST) 5844 * for this eager. 5845 */ 5846 5847 TCP_RECORD_TRACE(eager, mp1, TCP_TRACE_SEND_PKT); 5848 TCP_TIMER_RESTART(eager, eager->tcp_rto); 5849 5850 5851 /* 5852 * Insert the eager in its own perimeter now. We are ready to deal 5853 * with any packets on eager. 5854 */ 5855 if (eager->tcp_ipversion == IPV4_VERSION) { 5856 if (ipcl_conn_insert(econnp, IPPROTO_TCP, 0, 0, 0) != 0) { 5857 goto error; 5858 } 5859 } else { 5860 if (ipcl_conn_insert_v6(econnp, IPPROTO_TCP, 0, 0, 0, 0) != 0) { 5861 goto error; 5862 } 5863 } 5864 5865 /* mark conn as fully-bound */ 5866 econnp->conn_fully_bound = B_TRUE; 5867 5868 /* Send the SYN-ACK */ 5869 tcp_send_data(eager, eager->tcp_wq, mp1); 5870 freemsg(mp); 5871 5872 return; 5873 error: 5874 (void) TCP_TIMER_CANCEL(eager, eager->tcp_timer_tid); 5875 freemsg(mp1); 5876 error1: 5877 /* Undo what we did above */ 5878 mutex_enter(&tcp->tcp_eager_lock); 5879 tcp_eager_unlink(eager); 5880 mutex_exit(&tcp->tcp_eager_lock); 5881 /* Drop eager's reference on the listener */ 5882 CONN_DEC_REF(connp); 5883 5884 /* 5885 * Delete the cached ire in conn_ire_cache and also mark 5886 * the conn as CONDEMNED 5887 */ 5888 mutex_enter(&econnp->conn_lock); 5889 econnp->conn_state_flags |= CONN_CONDEMNED; 5890 ire = econnp->conn_ire_cache; 5891 econnp->conn_ire_cache = NULL; 5892 mutex_exit(&econnp->conn_lock); 5893 if (ire != NULL) 5894 IRE_REFRELE_NOTR(ire); 5895 5896 /* 5897 * tcp_accept_comm inserts the eager to the bind_hash 5898 * we need to remove it from the hash if ipcl_conn_insert 5899 * fails. 5900 */ 5901 tcp_bind_hash_remove(eager); 5902 /* Drop the eager ref placed in tcp_open_detached */ 5903 CONN_DEC_REF(econnp); 5904 5905 /* 5906 * If a connection already exists, send the mp to that connections so 5907 * that it can be appropriately dealt with. 5908 */ 5909 if ((econnp = ipcl_classify(mp, connp->conn_zoneid)) != NULL) { 5910 if (!IPCL_IS_CONNECTED(econnp)) { 5911 /* 5912 * Something bad happened. ipcl_conn_insert() 5913 * failed because a connection already existed 5914 * in connected hash but we can't find it 5915 * anymore (someone blew it away). Just 5916 * free this message and hopefully remote 5917 * will retransmit at which time the SYN can be 5918 * treated as a new connection or dealth with 5919 * a TH_RST if a connection already exists. 5920 */ 5921 freemsg(mp); 5922 } else { 5923 squeue_fill(econnp->conn_sqp, mp, tcp_input, 5924 econnp, SQTAG_TCP_CONN_REQ); 5925 } 5926 } else { 5927 /* Nobody wants this packet */ 5928 freemsg(mp); 5929 } 5930 return; 5931 error2: 5932 freemsg(mp); 5933 return; 5934 error3: 5935 CONN_DEC_REF(econnp); 5936 freemsg(mp); 5937 } 5938 5939 /* 5940 * In an ideal case of vertical partition in NUMA architecture, its 5941 * beneficial to have the listener and all the incoming connections 5942 * tied to the same squeue. The other constraint is that incoming 5943 * connections should be tied to the squeue attached to interrupted 5944 * CPU for obvious locality reason so this leaves the listener to 5945 * be tied to the same squeue. Our only problem is that when listener 5946 * is binding, the CPU that will get interrupted by the NIC whose 5947 * IP address the listener is binding to is not even known. So 5948 * the code below allows us to change that binding at the time the 5949 * CPU is interrupted by virtue of incoming connection's squeue. 5950 * 5951 * This is usefull only in case of a listener bound to a specific IP 5952 * address. For other kind of listeners, they get bound the 5953 * very first time and there is no attempt to rebind them. 5954 */ 5955 void 5956 tcp_conn_request_unbound(void *arg, mblk_t *mp, void *arg2) 5957 { 5958 conn_t *connp = (conn_t *)arg; 5959 squeue_t *sqp = (squeue_t *)arg2; 5960 squeue_t *new_sqp; 5961 uint32_t conn_flags; 5962 5963 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 5964 new_sqp = (squeue_t *)DB_CKSUMSTART(mp); 5965 } else { 5966 goto done; 5967 } 5968 5969 if (connp->conn_fanout == NULL) 5970 goto done; 5971 5972 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 5973 mutex_enter(&connp->conn_fanout->connf_lock); 5974 mutex_enter(&connp->conn_lock); 5975 /* 5976 * No one from read or write side can access us now 5977 * except for already queued packets on this squeue. 5978 * But since we haven't changed the squeue yet, they 5979 * can't execute. If they are processed after we have 5980 * changed the squeue, they are sent back to the 5981 * correct squeue down below. 5982 */ 5983 if (connp->conn_sqp != new_sqp) { 5984 while (connp->conn_sqp != new_sqp) 5985 (void) casptr(&connp->conn_sqp, sqp, new_sqp); 5986 } 5987 5988 do { 5989 conn_flags = connp->conn_flags; 5990 conn_flags |= IPCL_FULLY_BOUND; 5991 (void) cas32(&connp->conn_flags, connp->conn_flags, 5992 conn_flags); 5993 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 5994 5995 mutex_exit(&connp->conn_fanout->connf_lock); 5996 mutex_exit(&connp->conn_lock); 5997 } 5998 5999 done: 6000 if (connp->conn_sqp != sqp) { 6001 CONN_INC_REF(connp); 6002 squeue_fill(connp->conn_sqp, mp, 6003 connp->conn_recv, connp, SQTAG_TCP_CONN_REQ_UNBOUND); 6004 } else { 6005 tcp_conn_request(connp, mp, sqp); 6006 } 6007 } 6008 6009 /* 6010 * Successful connect request processing begins when our client passes 6011 * a T_CONN_REQ message into tcp_wput() and ends when tcp_rput() passes 6012 * our T_OK_ACK reply message upstream. The control flow looks like this: 6013 * upstream -> tcp_wput() -> tcp_wput_proto() -> tcp_connect() -> IP 6014 * upstream <- tcp_rput() <- IP 6015 * After various error checks are completed, tcp_connect() lays 6016 * the target address and port into the composite header template, 6017 * preallocates the T_OK_ACK reply message, construct a full 12 byte bind 6018 * request followed by an IRE request, and passes the three mblk message 6019 * down to IP looking like this: 6020 * O_T_BIND_REQ for IP --> IRE req --> T_OK_ACK for our client 6021 * Processing continues in tcp_rput() when we receive the following message: 6022 * T_BIND_ACK from IP --> IRE ack --> T_OK_ACK for our client 6023 * After consuming the first two mblks, tcp_rput() calls tcp_timer(), 6024 * to fire off the connection request, and then passes the T_OK_ACK mblk 6025 * upstream that we filled in below. There are, of course, numerous 6026 * error conditions along the way which truncate the processing described 6027 * above. 6028 */ 6029 static void 6030 tcp_connect(tcp_t *tcp, mblk_t *mp) 6031 { 6032 sin_t *sin; 6033 sin6_t *sin6; 6034 queue_t *q = tcp->tcp_wq; 6035 struct T_conn_req *tcr; 6036 ipaddr_t *dstaddrp; 6037 in_port_t dstport; 6038 uint_t srcid; 6039 6040 tcr = (struct T_conn_req *)mp->b_rptr; 6041 6042 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 6043 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 6044 tcp_err_ack(tcp, mp, TPROTO, 0); 6045 return; 6046 } 6047 6048 /* 6049 * Determine packet type based on type of address passed in 6050 * the request should contain an IPv4 or IPv6 address. 6051 * Make sure that address family matches the type of 6052 * family of the the address passed down 6053 */ 6054 switch (tcr->DEST_length) { 6055 default: 6056 tcp_err_ack(tcp, mp, TBADADDR, 0); 6057 return; 6058 6059 case (sizeof (sin_t) - sizeof (sin->sin_zero)): { 6060 /* 6061 * XXX: The check for valid DEST_length was not there 6062 * in earlier releases and some buggy 6063 * TLI apps (e.g Sybase) got away with not feeding 6064 * in sin_zero part of address. 6065 * We allow that bug to keep those buggy apps humming. 6066 * Test suites require the check on DEST_length. 6067 * We construct a new mblk with valid DEST_length 6068 * free the original so the rest of the code does 6069 * not have to keep track of this special shorter 6070 * length address case. 6071 */ 6072 mblk_t *nmp; 6073 struct T_conn_req *ntcr; 6074 sin_t *nsin; 6075 6076 nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) + 6077 tcr->OPT_length, BPRI_HI); 6078 if (nmp == NULL) { 6079 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 6080 return; 6081 } 6082 ntcr = (struct T_conn_req *)nmp->b_rptr; 6083 bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */ 6084 ntcr->PRIM_type = T_CONN_REQ; 6085 ntcr->DEST_length = sizeof (sin_t); 6086 ntcr->DEST_offset = sizeof (struct T_conn_req); 6087 6088 nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset); 6089 *nsin = sin_null; 6090 /* Get pointer to shorter address to copy from original mp */ 6091 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6092 tcr->DEST_length); /* extract DEST_length worth of sin_t */ 6093 if (sin == NULL || !OK_32PTR((char *)sin)) { 6094 freemsg(nmp); 6095 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6096 return; 6097 } 6098 nsin->sin_family = sin->sin_family; 6099 nsin->sin_port = sin->sin_port; 6100 nsin->sin_addr = sin->sin_addr; 6101 /* Note:nsin->sin_zero zero-fill with sin_null assign above */ 6102 nmp->b_wptr = (uchar_t *)&nsin[1]; 6103 if (tcr->OPT_length != 0) { 6104 ntcr->OPT_length = tcr->OPT_length; 6105 ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr; 6106 bcopy((uchar_t *)tcr + tcr->OPT_offset, 6107 (uchar_t *)ntcr + ntcr->OPT_offset, 6108 tcr->OPT_length); 6109 nmp->b_wptr += tcr->OPT_length; 6110 } 6111 freemsg(mp); /* original mp freed */ 6112 mp = nmp; /* re-initialize original variables */ 6113 tcr = ntcr; 6114 } 6115 /* FALLTHRU */ 6116 6117 case sizeof (sin_t): 6118 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6119 sizeof (sin_t)); 6120 if (sin == NULL || !OK_32PTR((char *)sin)) { 6121 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6122 return; 6123 } 6124 if (tcp->tcp_family != AF_INET || 6125 sin->sin_family != AF_INET) { 6126 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6127 return; 6128 } 6129 if (sin->sin_port == 0) { 6130 tcp_err_ack(tcp, mp, TBADADDR, 0); 6131 return; 6132 } 6133 if (tcp->tcp_connp && tcp->tcp_connp->conn_ipv6_v6only) { 6134 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6135 return; 6136 } 6137 6138 break; 6139 6140 case sizeof (sin6_t): 6141 sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset, 6142 sizeof (sin6_t)); 6143 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 6144 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6145 return; 6146 } 6147 if (tcp->tcp_family != AF_INET6 || 6148 sin6->sin6_family != AF_INET6) { 6149 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6150 return; 6151 } 6152 if (sin6->sin6_port == 0) { 6153 tcp_err_ack(tcp, mp, TBADADDR, 0); 6154 return; 6155 } 6156 break; 6157 } 6158 /* 6159 * TODO: If someone in TCPS_TIME_WAIT has this dst/port we 6160 * should key on their sequence number and cut them loose. 6161 */ 6162 6163 /* 6164 * If options passed in, feed it for verification and handling 6165 */ 6166 if (tcr->OPT_length != 0) { 6167 mblk_t *ok_mp; 6168 mblk_t *discon_mp; 6169 mblk_t *conn_opts_mp; 6170 int t_error, sys_error, do_disconnect; 6171 6172 conn_opts_mp = NULL; 6173 6174 if (tcp_conprim_opt_process(tcp, mp, 6175 &do_disconnect, &t_error, &sys_error) < 0) { 6176 if (do_disconnect) { 6177 ASSERT(t_error == 0 && sys_error == 0); 6178 discon_mp = mi_tpi_discon_ind(NULL, 6179 ECONNREFUSED, 0); 6180 if (!discon_mp) { 6181 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6182 TSYSERR, ENOMEM); 6183 return; 6184 } 6185 ok_mp = mi_tpi_ok_ack_alloc(mp); 6186 if (!ok_mp) { 6187 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6188 TSYSERR, ENOMEM); 6189 return; 6190 } 6191 qreply(q, ok_mp); 6192 qreply(q, discon_mp); /* no flush! */ 6193 } else { 6194 ASSERT(t_error != 0); 6195 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error, 6196 sys_error); 6197 } 6198 return; 6199 } 6200 /* 6201 * Success in setting options, the mp option buffer represented 6202 * by OPT_length/offset has been potentially modified and 6203 * contains results of option processing. We copy it in 6204 * another mp to save it for potentially influencing returning 6205 * it in T_CONN_CONN. 6206 */ 6207 if (tcr->OPT_length != 0) { /* there are resulting options */ 6208 conn_opts_mp = copyb(mp); 6209 if (!conn_opts_mp) { 6210 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6211 TSYSERR, ENOMEM); 6212 return; 6213 } 6214 ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL); 6215 tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp; 6216 /* 6217 * Note: 6218 * These resulting option negotiation can include any 6219 * end-to-end negotiation options but there no such 6220 * thing (yet?) in our TCP/IP. 6221 */ 6222 } 6223 } 6224 6225 /* 6226 * If we're connecting to an IPv4-mapped IPv6 address, we need to 6227 * make sure that the template IP header in the tcp structure is an 6228 * IPv4 header, and that the tcp_ipversion is IPV4_VERSION. We 6229 * need to this before we call tcp_bindi() so that the port lookup 6230 * code will look for ports in the correct port space (IPv4 and 6231 * IPv6 have separate port spaces). 6232 */ 6233 if (tcp->tcp_family == AF_INET6 && tcp->tcp_ipversion == IPV6_VERSION && 6234 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6235 int err = 0; 6236 6237 err = tcp_header_init_ipv4(tcp); 6238 if (err != 0) { 6239 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6240 goto connect_failed; 6241 } 6242 if (tcp->tcp_lport != 0) 6243 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 6244 } 6245 6246 switch (tcp->tcp_state) { 6247 case TCPS_IDLE: 6248 /* 6249 * We support quick connect, refer to comments in 6250 * tcp_connect_*() 6251 */ 6252 /* FALLTHRU */ 6253 case TCPS_BOUND: 6254 case TCPS_LISTEN: 6255 if (tcp->tcp_family == AF_INET6) { 6256 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6257 tcp_connect_ipv6(tcp, mp, 6258 &sin6->sin6_addr, 6259 sin6->sin6_port, sin6->sin6_flowinfo, 6260 sin6->__sin6_src_id, sin6->sin6_scope_id); 6261 return; 6262 } 6263 /* 6264 * Destination adress is mapped IPv6 address. 6265 * Source bound address should be unspecified or 6266 * IPv6 mapped address as well. 6267 */ 6268 if (!IN6_IS_ADDR_UNSPECIFIED( 6269 &tcp->tcp_bound_source_v6) && 6270 !IN6_IS_ADDR_V4MAPPED(&tcp->tcp_bound_source_v6)) { 6271 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, 6272 EADDRNOTAVAIL); 6273 break; 6274 } 6275 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 6276 dstport = sin6->sin6_port; 6277 srcid = sin6->__sin6_src_id; 6278 } else { 6279 dstaddrp = &sin->sin_addr.s_addr; 6280 dstport = sin->sin_port; 6281 srcid = 0; 6282 } 6283 6284 tcp_connect_ipv4(tcp, mp, dstaddrp, dstport, srcid); 6285 return; 6286 default: 6287 mp = mi_tpi_err_ack_alloc(mp, TOUTSTATE, 0); 6288 break; 6289 } 6290 /* 6291 * Note: Code below is the "failure" case 6292 */ 6293 /* return error ack and blow away saved option results if any */ 6294 connect_failed: 6295 if (mp != NULL) 6296 putnext(tcp->tcp_rq, mp); 6297 else { 6298 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6299 TSYSERR, ENOMEM); 6300 } 6301 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6302 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6303 } 6304 6305 /* 6306 * Handle connect to IPv4 destinations, including connections for AF_INET6 6307 * sockets connecting to IPv4 mapped IPv6 destinations. 6308 */ 6309 static void 6310 tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport, 6311 uint_t srcid) 6312 { 6313 tcph_t *tcph; 6314 mblk_t *mp1; 6315 ipaddr_t dstaddr = *dstaddrp; 6316 int32_t oldstate; 6317 uint16_t lport; 6318 6319 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 6320 6321 /* Check for attempt to connect to INADDR_ANY */ 6322 if (dstaddr == INADDR_ANY) { 6323 /* 6324 * SunOS 4.x and 4.3 BSD allow an application 6325 * to connect a TCP socket to INADDR_ANY. 6326 * When they do this, the kernel picks the 6327 * address of one interface and uses it 6328 * instead. The kernel usually ends up 6329 * picking the address of the loopback 6330 * interface. This is an undocumented feature. 6331 * However, we provide the same thing here 6332 * in order to have source and binary 6333 * compatibility with SunOS 4.x. 6334 * Update the T_CONN_REQ (sin/sin6) since it is used to 6335 * generate the T_CONN_CON. 6336 */ 6337 dstaddr = htonl(INADDR_LOOPBACK); 6338 *dstaddrp = dstaddr; 6339 } 6340 6341 /* Handle __sin6_src_id if socket not bound to an IP address */ 6342 if (srcid != 0 && tcp->tcp_ipha->ipha_src == INADDR_ANY) { 6343 ip_srcid_find_id(srcid, &tcp->tcp_ip_src_v6, 6344 tcp->tcp_connp->conn_zoneid); 6345 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_ip_src_v6, 6346 tcp->tcp_ipha->ipha_src); 6347 } 6348 6349 /* 6350 * Don't let an endpoint connect to itself. Note that 6351 * the test here does not catch the case where the 6352 * source IP addr was left unspecified by the user. In 6353 * this case, the source addr is set in tcp_adapt_ire() 6354 * using the reply to the T_BIND message that we send 6355 * down to IP here and the check is repeated in tcp_rput_other. 6356 */ 6357 if (dstaddr == tcp->tcp_ipha->ipha_src && 6358 dstport == tcp->tcp_lport) { 6359 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6360 goto failed; 6361 } 6362 6363 tcp->tcp_ipha->ipha_dst = dstaddr; 6364 IN6_IPADDR_TO_V4MAPPED(dstaddr, &tcp->tcp_remote_v6); 6365 6366 /* 6367 * Massage a source route if any putting the first hop 6368 * in iph_dst. Compute a starting value for the checksum which 6369 * takes into account that the original iph_dst should be 6370 * included in the checksum but that ip will include the 6371 * first hop in the source route in the tcp checksum. 6372 */ 6373 tcp->tcp_sum = ip_massage_options(tcp->tcp_ipha); 6374 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6375 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 6376 (tcp->tcp_ipha->ipha_dst & 0xffff)); 6377 if ((int)tcp->tcp_sum < 0) 6378 tcp->tcp_sum--; 6379 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6380 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 6381 (tcp->tcp_sum >> 16)); 6382 tcph = tcp->tcp_tcph; 6383 *(uint16_t *)tcph->th_fport = dstport; 6384 tcp->tcp_fport = dstport; 6385 6386 oldstate = tcp->tcp_state; 6387 /* 6388 * At this point the remote destination address and remote port fields 6389 * in the tcp-four-tuple have been filled in the tcp structure. Now we 6390 * have to see which state tcp was in so we can take apropriate action. 6391 */ 6392 if (oldstate == TCPS_IDLE) { 6393 /* 6394 * We support a quick connect capability here, allowing 6395 * clients to transition directly from IDLE to SYN_SENT 6396 * tcp_bindi will pick an unused port, insert the connection 6397 * in the bind hash and transition to BOUND state. 6398 */ 6399 lport = tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE); 6400 lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE, 6401 B_FALSE, B_FALSE); 6402 if (lport == 0) { 6403 mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); 6404 goto failed; 6405 } 6406 } 6407 tcp->tcp_state = TCPS_SYN_SENT; 6408 6409 /* 6410 * TODO: allow data with connect requests 6411 * by unlinking M_DATA trailers here and 6412 * linking them in behind the T_OK_ACK mblk. 6413 * The tcp_rput() bind ack handler would then 6414 * feed them to tcp_wput_data() rather than call 6415 * tcp_timer(). 6416 */ 6417 mp = mi_tpi_ok_ack_alloc(mp); 6418 if (!mp) { 6419 tcp->tcp_state = oldstate; 6420 goto failed; 6421 } 6422 if (tcp->tcp_family == AF_INET) { 6423 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6424 sizeof (ipa_conn_t)); 6425 } else { 6426 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6427 sizeof (ipa6_conn_t)); 6428 } 6429 if (mp1) { 6430 /* Hang onto the T_OK_ACK for later. */ 6431 linkb(mp1, mp); 6432 mblk_setcred(mp1, tcp->tcp_cred); 6433 if (tcp->tcp_family == AF_INET) 6434 mp1 = ip_bind_v4(tcp->tcp_wq, mp1, tcp->tcp_connp); 6435 else { 6436 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 6437 &tcp->tcp_sticky_ipp); 6438 } 6439 BUMP_MIB(&tcp_mib, tcpActiveOpens); 6440 tcp->tcp_active_open = 1; 6441 /* 6442 * If the bind cannot complete immediately 6443 * IP will arrange to call tcp_rput_other 6444 * when the bind completes. 6445 */ 6446 if (mp1 != NULL) 6447 tcp_rput_other(tcp, mp1); 6448 return; 6449 } 6450 /* Error case */ 6451 tcp->tcp_state = oldstate; 6452 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6453 6454 failed: 6455 /* return error ack and blow away saved option results if any */ 6456 if (mp != NULL) 6457 putnext(tcp->tcp_rq, mp); 6458 else { 6459 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6460 TSYSERR, ENOMEM); 6461 } 6462 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6463 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6464 6465 } 6466 6467 /* 6468 * Handle connect to IPv6 destinations. 6469 */ 6470 static void 6471 tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 6472 in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 6473 { 6474 tcph_t *tcph; 6475 mblk_t *mp1; 6476 ip6_rthdr_t *rth; 6477 int32_t oldstate; 6478 uint16_t lport; 6479 6480 ASSERT(tcp->tcp_family == AF_INET6); 6481 6482 /* 6483 * If we're here, it means that the destination address is a native 6484 * IPv6 address. Return an error if tcp_ipversion is not IPv6. A 6485 * reason why it might not be IPv6 is if the socket was bound to an 6486 * IPv4-mapped IPv6 address. 6487 */ 6488 if (tcp->tcp_ipversion != IPV6_VERSION) { 6489 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6490 goto failed; 6491 } 6492 6493 /* 6494 * Interpret a zero destination to mean loopback. 6495 * Update the T_CONN_REQ (sin/sin6) since it is used to 6496 * generate the T_CONN_CON. 6497 */ 6498 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) { 6499 *dstaddrp = ipv6_loopback; 6500 } 6501 6502 /* Handle __sin6_src_id if socket not bound to an IP address */ 6503 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 6504 ip_srcid_find_id(srcid, &tcp->tcp_ip6h->ip6_src, 6505 tcp->tcp_connp->conn_zoneid); 6506 tcp->tcp_ip_src_v6 = tcp->tcp_ip6h->ip6_src; 6507 } 6508 6509 /* 6510 * Take care of the scope_id now and add ip6i_t 6511 * if ip6i_t is not already allocated through TCP 6512 * sticky options. At this point tcp_ip6h does not 6513 * have dst info, thus use dstaddrp. 6514 */ 6515 if (scope_id != 0 && 6516 IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 6517 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 6518 ip6i_t *ip6i; 6519 6520 ipp->ipp_ifindex = scope_id; 6521 ip6i = (ip6i_t *)tcp->tcp_iphc; 6522 6523 if ((ipp->ipp_fields & IPPF_HAS_IP6I) && 6524 ip6i != NULL && (ip6i->ip6i_nxt == IPPROTO_RAW)) { 6525 /* Already allocated */ 6526 ip6i->ip6i_flags |= IP6I_IFINDEX; 6527 ip6i->ip6i_ifindex = ipp->ipp_ifindex; 6528 ipp->ipp_fields |= IPPF_SCOPE_ID; 6529 } else { 6530 int reterr; 6531 6532 ipp->ipp_fields |= IPPF_SCOPE_ID; 6533 if (ipp->ipp_fields & IPPF_HAS_IP6I) 6534 ip2dbg(("tcp_connect_v6: SCOPE_ID set\n")); 6535 reterr = tcp_build_hdrs(tcp->tcp_rq, tcp); 6536 if (reterr != 0) 6537 goto failed; 6538 ip1dbg(("tcp_connect_ipv6: tcp_bld_hdrs returned\n")); 6539 } 6540 } 6541 6542 /* 6543 * Don't let an endpoint connect to itself. Note that 6544 * the test here does not catch the case where the 6545 * source IP addr was left unspecified by the user. In 6546 * this case, the source addr is set in tcp_adapt_ire() 6547 * using the reply to the T_BIND message that we send 6548 * down to IP here and the check is repeated in tcp_rput_other. 6549 */ 6550 if (IN6_ARE_ADDR_EQUAL(dstaddrp, &tcp->tcp_ip6h->ip6_src) && 6551 (dstport == tcp->tcp_lport)) { 6552 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6553 goto failed; 6554 } 6555 6556 tcp->tcp_ip6h->ip6_dst = *dstaddrp; 6557 tcp->tcp_remote_v6 = *dstaddrp; 6558 tcp->tcp_ip6h->ip6_vcf = 6559 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 6560 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 6561 6562 6563 /* 6564 * Massage a routing header (if present) putting the first hop 6565 * in ip6_dst. Compute a starting value for the checksum which 6566 * takes into account that the original ip6_dst should be 6567 * included in the checksum but that ip will include the 6568 * first hop in the source route in the tcp checksum. 6569 */ 6570 rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph); 6571 if (rth != NULL) { 6572 6573 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth); 6574 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 6575 (tcp->tcp_sum >> 16)); 6576 } else { 6577 tcp->tcp_sum = 0; 6578 } 6579 6580 tcph = tcp->tcp_tcph; 6581 *(uint16_t *)tcph->th_fport = dstport; 6582 tcp->tcp_fport = dstport; 6583 6584 oldstate = tcp->tcp_state; 6585 /* 6586 * At this point the remote destination address and remote port fields 6587 * in the tcp-four-tuple have been filled in the tcp structure. Now we 6588 * have to see which state tcp was in so we can take apropriate action. 6589 */ 6590 if (oldstate == TCPS_IDLE) { 6591 /* 6592 * We support a quick connect capability here, allowing 6593 * clients to transition directly from IDLE to SYN_SENT 6594 * tcp_bindi will pick an unused port, insert the connection 6595 * in the bind hash and transition to BOUND state. 6596 */ 6597 lport = tcp_update_next_port(tcp_next_port_to_try, tcp, B_TRUE); 6598 lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE, 6599 B_FALSE, B_FALSE); 6600 if (lport == 0) { 6601 mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); 6602 goto failed; 6603 } 6604 } 6605 tcp->tcp_state = TCPS_SYN_SENT; 6606 /* 6607 * TODO: allow data with connect requests 6608 * by unlinking M_DATA trailers here and 6609 * linking them in behind the T_OK_ACK mblk. 6610 * The tcp_rput() bind ack handler would then 6611 * feed them to tcp_wput_data() rather than call 6612 * tcp_timer(). 6613 */ 6614 mp = mi_tpi_ok_ack_alloc(mp); 6615 if (!mp) { 6616 tcp->tcp_state = oldstate; 6617 goto failed; 6618 } 6619 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t)); 6620 if (mp1) { 6621 /* Hang onto the T_OK_ACK for later. */ 6622 linkb(mp1, mp); 6623 mblk_setcred(mp1, tcp->tcp_cred); 6624 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 6625 &tcp->tcp_sticky_ipp); 6626 BUMP_MIB(&tcp_mib, tcpActiveOpens); 6627 tcp->tcp_active_open = 1; 6628 /* ip_bind_v6() may return ACK or ERROR */ 6629 if (mp1 != NULL) 6630 tcp_rput_other(tcp, mp1); 6631 return; 6632 } 6633 /* Error case */ 6634 tcp->tcp_state = oldstate; 6635 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6636 6637 failed: 6638 /* return error ack and blow away saved option results if any */ 6639 if (mp != NULL) 6640 putnext(tcp->tcp_rq, mp); 6641 else { 6642 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6643 TSYSERR, ENOMEM); 6644 } 6645 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6646 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6647 } 6648 6649 /* 6650 * We need a stream q for detached closing tcp connections 6651 * to use. Our client hereby indicates that this q is the 6652 * one to use. 6653 */ 6654 static void 6655 tcp_def_q_set(tcp_t *tcp, mblk_t *mp) 6656 { 6657 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 6658 queue_t *q = tcp->tcp_wq; 6659 6660 mp->b_datap->db_type = M_IOCACK; 6661 iocp->ioc_count = 0; 6662 mutex_enter(&tcp_g_q_lock); 6663 if (tcp_g_q != NULL) { 6664 mutex_exit(&tcp_g_q_lock); 6665 iocp->ioc_error = EALREADY; 6666 } else { 6667 mblk_t *mp1; 6668 6669 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 0); 6670 if (mp1 == NULL) { 6671 mutex_exit(&tcp_g_q_lock); 6672 iocp->ioc_error = ENOMEM; 6673 } else { 6674 tcp_g_q = tcp->tcp_rq; 6675 mutex_exit(&tcp_g_q_lock); 6676 iocp->ioc_error = 0; 6677 iocp->ioc_rval = 0; 6678 /* 6679 * We are passing tcp_sticky_ipp as NULL 6680 * as it is not useful for tcp_default queue 6681 */ 6682 mp1 = ip_bind_v6(q, mp1, tcp->tcp_connp, NULL); 6683 if (mp1 != NULL) 6684 tcp_rput_other(tcp, mp1); 6685 } 6686 } 6687 qreply(q, mp); 6688 } 6689 6690 /* 6691 * Our client hereby directs us to reject the connection request 6692 * that tcp_conn_request() marked with 'seqnum'. Rejection consists 6693 * of sending the appropriate RST, not an ICMP error. 6694 */ 6695 static void 6696 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 6697 { 6698 tcp_t *ltcp = NULL; 6699 t_scalar_t seqnum; 6700 conn_t *connp; 6701 6702 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 6703 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 6704 tcp_err_ack(tcp, mp, TPROTO, 0); 6705 return; 6706 } 6707 6708 /* 6709 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 6710 * when the stream is in BOUND state. Do not send a reset, 6711 * since the destination IP address is not valid, and it can 6712 * be the initialized value of all zeros (broadcast address). 6713 * 6714 * If TCP has sent down a bind request to IP and has not 6715 * received the reply, reject the request. Otherwise, TCP 6716 * will be confused. 6717 */ 6718 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) { 6719 if (tcp->tcp_debug) { 6720 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 6721 "tcp_disconnect: bad state, %d", tcp->tcp_state); 6722 } 6723 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 6724 return; 6725 } 6726 6727 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 6728 6729 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 6730 6731 /* 6732 * According to TPI, for non-listeners, ignore seqnum 6733 * and disconnect. 6734 * Following interpretation of -1 seqnum is historical 6735 * and implied TPI ? (TPI only states that for T_CONN_IND, 6736 * a valid seqnum should not be -1). 6737 * 6738 * -1 means disconnect everything 6739 * regardless even on a listener. 6740 */ 6741 6742 int old_state = tcp->tcp_state; 6743 6744 /* 6745 * The connection can't be on the tcp_time_wait_head list 6746 * since it is not detached. 6747 */ 6748 ASSERT(tcp->tcp_time_wait_next == NULL); 6749 ASSERT(tcp->tcp_time_wait_prev == NULL); 6750 ASSERT(tcp->tcp_time_wait_expire == 0); 6751 ltcp = NULL; 6752 /* 6753 * If it used to be a listener, check to make sure no one else 6754 * has taken the port before switching back to LISTEN state. 6755 */ 6756 if (tcp->tcp_ipversion == IPV4_VERSION) { 6757 connp = ipcl_lookup_listener_v4(tcp->tcp_lport, 6758 tcp->tcp_ipha->ipha_src, 6759 tcp->tcp_connp->conn_zoneid); 6760 if (connp != NULL) 6761 ltcp = connp->conn_tcp; 6762 } else { 6763 /* Allow tcp_bound_if listeners? */ 6764 connp = ipcl_lookup_listener_v6(tcp->tcp_lport, 6765 &tcp->tcp_ip6h->ip6_src, 0, 6766 tcp->tcp_connp->conn_zoneid); 6767 if (connp != NULL) 6768 ltcp = connp->conn_tcp; 6769 } 6770 if (tcp->tcp_conn_req_max && ltcp == NULL) { 6771 tcp->tcp_state = TCPS_LISTEN; 6772 } else if (old_state > TCPS_BOUND) { 6773 tcp->tcp_conn_req_max = 0; 6774 tcp->tcp_state = TCPS_BOUND; 6775 } 6776 if (ltcp != NULL) 6777 CONN_DEC_REF(ltcp->tcp_connp); 6778 if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) { 6779 BUMP_MIB(&tcp_mib, tcpAttemptFails); 6780 } else if (old_state == TCPS_ESTABLISHED || 6781 old_state == TCPS_CLOSE_WAIT) { 6782 BUMP_MIB(&tcp_mib, tcpEstabResets); 6783 } 6784 6785 if (tcp->tcp_fused) 6786 tcp_unfuse(tcp); 6787 6788 mutex_enter(&tcp->tcp_eager_lock); 6789 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 6790 (tcp->tcp_conn_req_cnt_q != 0)) { 6791 tcp_eager_cleanup(tcp, 0); 6792 } 6793 mutex_exit(&tcp->tcp_eager_lock); 6794 6795 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 6796 tcp->tcp_rnxt, TH_RST | TH_ACK); 6797 6798 tcp_reinit(tcp); 6799 6800 if (old_state >= TCPS_ESTABLISHED) { 6801 /* Send M_FLUSH according to TPI */ 6802 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 6803 } 6804 mp = mi_tpi_ok_ack_alloc(mp); 6805 if (mp) 6806 putnext(tcp->tcp_rq, mp); 6807 return; 6808 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 6809 tcp_err_ack(tcp, mp, TBADSEQ, 0); 6810 return; 6811 } 6812 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 6813 /* Send M_FLUSH according to TPI */ 6814 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 6815 } 6816 mp = mi_tpi_ok_ack_alloc(mp); 6817 if (mp) 6818 putnext(tcp->tcp_rq, mp); 6819 } 6820 6821 /* 6822 * Diagnostic routine used to return a string associated with the tcp state. 6823 * Note that if the caller does not supply a buffer, it will use an internal 6824 * static string. This means that if multiple threads call this function at 6825 * the same time, output can be corrupted... Note also that this function 6826 * does not check the size of the supplied buffer. The caller has to make 6827 * sure that it is big enough. 6828 */ 6829 static char * 6830 tcp_display(tcp_t *tcp, char *sup_buf, char format) 6831 { 6832 char buf1[30]; 6833 static char priv_buf[INET6_ADDRSTRLEN * 2 + 80]; 6834 char *buf; 6835 char *cp; 6836 in6_addr_t local, remote; 6837 char local_addrbuf[INET6_ADDRSTRLEN]; 6838 char remote_addrbuf[INET6_ADDRSTRLEN]; 6839 6840 if (sup_buf != NULL) 6841 buf = sup_buf; 6842 else 6843 buf = priv_buf; 6844 6845 if (tcp == NULL) 6846 return ("NULL_TCP"); 6847 switch (tcp->tcp_state) { 6848 case TCPS_CLOSED: 6849 cp = "TCP_CLOSED"; 6850 break; 6851 case TCPS_IDLE: 6852 cp = "TCP_IDLE"; 6853 break; 6854 case TCPS_BOUND: 6855 cp = "TCP_BOUND"; 6856 break; 6857 case TCPS_LISTEN: 6858 cp = "TCP_LISTEN"; 6859 break; 6860 case TCPS_SYN_SENT: 6861 cp = "TCP_SYN_SENT"; 6862 break; 6863 case TCPS_SYN_RCVD: 6864 cp = "TCP_SYN_RCVD"; 6865 break; 6866 case TCPS_ESTABLISHED: 6867 cp = "TCP_ESTABLISHED"; 6868 break; 6869 case TCPS_CLOSE_WAIT: 6870 cp = "TCP_CLOSE_WAIT"; 6871 break; 6872 case TCPS_FIN_WAIT_1: 6873 cp = "TCP_FIN_WAIT_1"; 6874 break; 6875 case TCPS_CLOSING: 6876 cp = "TCP_CLOSING"; 6877 break; 6878 case TCPS_LAST_ACK: 6879 cp = "TCP_LAST_ACK"; 6880 break; 6881 case TCPS_FIN_WAIT_2: 6882 cp = "TCP_FIN_WAIT_2"; 6883 break; 6884 case TCPS_TIME_WAIT: 6885 cp = "TCP_TIME_WAIT"; 6886 break; 6887 default: 6888 (void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state); 6889 cp = buf1; 6890 break; 6891 } 6892 switch (format) { 6893 case DISP_ADDR_AND_PORT: 6894 if (tcp->tcp_ipversion == IPV4_VERSION) { 6895 /* 6896 * Note that we use the remote address in the tcp_b 6897 * structure. This means that it will print out 6898 * the real destination address, not the next hop's 6899 * address if source routing is used. 6900 */ 6901 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ip_src, &local); 6902 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &remote); 6903 6904 } else { 6905 local = tcp->tcp_ip_src_v6; 6906 remote = tcp->tcp_remote_v6; 6907 } 6908 (void) inet_ntop(AF_INET6, &local, local_addrbuf, 6909 sizeof (local_addrbuf)); 6910 (void) inet_ntop(AF_INET6, &remote, remote_addrbuf, 6911 sizeof (remote_addrbuf)); 6912 (void) mi_sprintf(buf, "[%s.%u, %s.%u] %s", 6913 local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf, 6914 ntohs(tcp->tcp_fport), cp); 6915 break; 6916 case DISP_PORT_ONLY: 6917 default: 6918 (void) mi_sprintf(buf, "[%u, %u] %s", 6919 ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp); 6920 break; 6921 } 6922 6923 return (buf); 6924 } 6925 6926 /* 6927 * Called via squeue to get on to eager's perimeter to send a 6928 * TH_RST. The listener wants the eager to disappear either 6929 * by means of tcp_eager_blowoff() or tcp_eager_cleanup() 6930 * being called. 6931 */ 6932 /* ARGSUSED */ 6933 void 6934 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2) 6935 { 6936 conn_t *econnp = (conn_t *)arg; 6937 tcp_t *eager = econnp->conn_tcp; 6938 tcp_t *listener = eager->tcp_listener; 6939 6940 /* 6941 * We could be called because listener is closing. Since 6942 * the eager is using listener's queue's, its not safe. 6943 * Better use the default queue just to send the TH_RST 6944 * out. 6945 */ 6946 eager->tcp_rq = tcp_g_q; 6947 eager->tcp_wq = WR(tcp_g_q); 6948 6949 if (eager->tcp_state > TCPS_LISTEN) { 6950 tcp_xmit_ctl("tcp_eager_kill, can't wait", 6951 eager, eager->tcp_snxt, 0, TH_RST); 6952 } 6953 6954 /* We are here because listener wants this eager gone */ 6955 if (listener != NULL) { 6956 mutex_enter(&listener->tcp_eager_lock); 6957 tcp_eager_unlink(eager); 6958 if (eager->tcp_conn.tcp_eager_conn_ind == NULL) { 6959 /* 6960 * The eager has sent a conn_ind up to the 6961 * listener but listener decides to close 6962 * instead. We need to drop the extra ref 6963 * placed on eager in tcp_rput_data() before 6964 * sending the conn_ind to listener. 6965 */ 6966 CONN_DEC_REF(econnp); 6967 } 6968 mutex_exit(&listener->tcp_eager_lock); 6969 CONN_DEC_REF(listener->tcp_connp); 6970 } 6971 6972 if (eager->tcp_state > TCPS_BOUND) 6973 tcp_close_detached(eager); 6974 } 6975 6976 /* 6977 * Reset any eager connection hanging off this listener marked 6978 * with 'seqnum' and then reclaim it's resources. 6979 */ 6980 static boolean_t 6981 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 6982 { 6983 tcp_t *eager; 6984 mblk_t *mp; 6985 6986 TCP_STAT(tcp_eager_blowoff_calls); 6987 eager = listener; 6988 mutex_enter(&listener->tcp_eager_lock); 6989 do { 6990 eager = eager->tcp_eager_next_q; 6991 if (eager == NULL) { 6992 mutex_exit(&listener->tcp_eager_lock); 6993 return (B_FALSE); 6994 } 6995 } while (eager->tcp_conn_req_seqnum != seqnum); 6996 CONN_INC_REF(eager->tcp_connp); 6997 mutex_exit(&listener->tcp_eager_lock); 6998 mp = &eager->tcp_closemp; 6999 squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 7000 eager->tcp_connp, SQTAG_TCP_EAGER_BLOWOFF); 7001 return (B_TRUE); 7002 } 7003 7004 /* 7005 * Reset any eager connection hanging off this listener 7006 * and then reclaim it's resources. 7007 */ 7008 static void 7009 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 7010 { 7011 tcp_t *eager; 7012 mblk_t *mp; 7013 7014 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7015 7016 if (!q0_only) { 7017 /* First cleanup q */ 7018 TCP_STAT(tcp_eager_blowoff_q); 7019 eager = listener->tcp_eager_next_q; 7020 while (eager != NULL) { 7021 CONN_INC_REF(eager->tcp_connp); 7022 mp = &eager->tcp_closemp; 7023 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7024 tcp_eager_kill, eager->tcp_connp, 7025 SQTAG_TCP_EAGER_CLEANUP); 7026 eager = eager->tcp_eager_next_q; 7027 } 7028 } 7029 /* Then cleanup q0 */ 7030 TCP_STAT(tcp_eager_blowoff_q0); 7031 eager = listener->tcp_eager_next_q0; 7032 while (eager != listener) { 7033 CONN_INC_REF(eager->tcp_connp); 7034 mp = &eager->tcp_closemp; 7035 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7036 tcp_eager_kill, eager->tcp_connp, 7037 SQTAG_TCP_EAGER_CLEANUP_Q0); 7038 eager = eager->tcp_eager_next_q0; 7039 } 7040 } 7041 7042 /* 7043 * If we are an eager connection hanging off a listener that hasn't 7044 * formally accepted the connection yet, get off his list and blow off 7045 * any data that we have accumulated. 7046 */ 7047 static void 7048 tcp_eager_unlink(tcp_t *tcp) 7049 { 7050 tcp_t *listener = tcp->tcp_listener; 7051 7052 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7053 ASSERT(listener != NULL); 7054 if (tcp->tcp_eager_next_q0 != NULL) { 7055 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 7056 7057 /* Remove the eager tcp from q0 */ 7058 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 7059 tcp->tcp_eager_prev_q0; 7060 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 7061 tcp->tcp_eager_next_q0; 7062 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 7063 listener->tcp_conn_req_cnt_q0--; 7064 7065 tcp->tcp_eager_next_q0 = NULL; 7066 tcp->tcp_eager_prev_q0 = NULL; 7067 7068 if (tcp->tcp_syn_rcvd_timeout != 0) { 7069 /* we have timed out before */ 7070 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 7071 listener->tcp_syn_rcvd_timeout--; 7072 } 7073 } else { 7074 tcp_t **tcpp = &listener->tcp_eager_next_q; 7075 tcp_t *prev = NULL; 7076 7077 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 7078 if (tcpp[0] == tcp) { 7079 if (listener->tcp_eager_last_q == tcp) { 7080 /* 7081 * If we are unlinking the last 7082 * element on the list, adjust 7083 * tail pointer. Set tail pointer 7084 * to nil when list is empty. 7085 */ 7086 ASSERT(tcp->tcp_eager_next_q == NULL); 7087 if (listener->tcp_eager_last_q == 7088 listener->tcp_eager_next_q) { 7089 listener->tcp_eager_last_q = 7090 NULL; 7091 } else { 7092 /* 7093 * We won't get here if there 7094 * is only one eager in the 7095 * list. 7096 */ 7097 ASSERT(prev != NULL); 7098 listener->tcp_eager_last_q = 7099 prev; 7100 } 7101 } 7102 tcpp[0] = tcp->tcp_eager_next_q; 7103 tcp->tcp_eager_next_q = NULL; 7104 tcp->tcp_eager_last_q = NULL; 7105 ASSERT(listener->tcp_conn_req_cnt_q > 0); 7106 listener->tcp_conn_req_cnt_q--; 7107 break; 7108 } 7109 prev = tcpp[0]; 7110 } 7111 } 7112 tcp->tcp_listener = NULL; 7113 } 7114 7115 /* Shorthand to generate and send TPI error acks to our client */ 7116 static void 7117 tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error) 7118 { 7119 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 7120 putnext(tcp->tcp_rq, mp); 7121 } 7122 7123 /* Shorthand to generate and send TPI error acks to our client */ 7124 static void 7125 tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 7126 int t_error, int sys_error) 7127 { 7128 struct T_error_ack *teackp; 7129 7130 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 7131 M_PCPROTO, T_ERROR_ACK)) != NULL) { 7132 teackp = (struct T_error_ack *)mp->b_rptr; 7133 teackp->ERROR_prim = primitive; 7134 teackp->TLI_error = t_error; 7135 teackp->UNIX_error = sys_error; 7136 putnext(tcp->tcp_rq, mp); 7137 } 7138 } 7139 7140 /* 7141 * Note: No locks are held when inspecting tcp_g_*epriv_ports 7142 * but instead the code relies on: 7143 * - the fact that the address of the array and its size never changes 7144 * - the atomic assignment of the elements of the array 7145 */ 7146 /* ARGSUSED */ 7147 static int 7148 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 7149 { 7150 int i; 7151 7152 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7153 if (tcp_g_epriv_ports[i] != 0) 7154 (void) mi_mpprintf(mp, "%d ", tcp_g_epriv_ports[i]); 7155 } 7156 return (0); 7157 } 7158 7159 /* 7160 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7161 * threads from changing it at the same time. 7162 */ 7163 /* ARGSUSED */ 7164 static int 7165 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7166 cred_t *cr) 7167 { 7168 long new_value; 7169 int i; 7170 7171 /* 7172 * Fail the request if the new value does not lie within the 7173 * port number limits. 7174 */ 7175 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 7176 new_value <= 0 || new_value >= 65536) { 7177 return (EINVAL); 7178 } 7179 7180 mutex_enter(&tcp_epriv_port_lock); 7181 /* Check if the value is already in the list */ 7182 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7183 if (new_value == tcp_g_epriv_ports[i]) { 7184 mutex_exit(&tcp_epriv_port_lock); 7185 return (EEXIST); 7186 } 7187 } 7188 /* Find an empty slot */ 7189 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7190 if (tcp_g_epriv_ports[i] == 0) 7191 break; 7192 } 7193 if (i == tcp_g_num_epriv_ports) { 7194 mutex_exit(&tcp_epriv_port_lock); 7195 return (EOVERFLOW); 7196 } 7197 /* Set the new value */ 7198 tcp_g_epriv_ports[i] = (uint16_t)new_value; 7199 mutex_exit(&tcp_epriv_port_lock); 7200 return (0); 7201 } 7202 7203 /* 7204 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7205 * threads from changing it at the same time. 7206 */ 7207 /* ARGSUSED */ 7208 static int 7209 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7210 cred_t *cr) 7211 { 7212 long new_value; 7213 int i; 7214 7215 /* 7216 * Fail the request if the new value does not lie within the 7217 * port number limits. 7218 */ 7219 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 7220 new_value >= 65536) { 7221 return (EINVAL); 7222 } 7223 7224 mutex_enter(&tcp_epriv_port_lock); 7225 /* Check that the value is already in the list */ 7226 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7227 if (tcp_g_epriv_ports[i] == new_value) 7228 break; 7229 } 7230 if (i == tcp_g_num_epriv_ports) { 7231 mutex_exit(&tcp_epriv_port_lock); 7232 return (ESRCH); 7233 } 7234 /* Clear the value */ 7235 tcp_g_epriv_ports[i] = 0; 7236 mutex_exit(&tcp_epriv_port_lock); 7237 return (0); 7238 } 7239 7240 /* Return the TPI/TLI equivalent of our current tcp_state */ 7241 static int 7242 tcp_tpistate(tcp_t *tcp) 7243 { 7244 switch (tcp->tcp_state) { 7245 case TCPS_IDLE: 7246 return (TS_UNBND); 7247 case TCPS_LISTEN: 7248 /* 7249 * Return whether there are outstanding T_CONN_IND waiting 7250 * for the matching T_CONN_RES. Therefore don't count q0. 7251 */ 7252 if (tcp->tcp_conn_req_cnt_q > 0) 7253 return (TS_WRES_CIND); 7254 else 7255 return (TS_IDLE); 7256 case TCPS_BOUND: 7257 return (TS_IDLE); 7258 case TCPS_SYN_SENT: 7259 return (TS_WCON_CREQ); 7260 case TCPS_SYN_RCVD: 7261 /* 7262 * Note: assumption: this has to the active open SYN_RCVD. 7263 * The passive instance is detached in SYN_RCVD stage of 7264 * incoming connection processing so we cannot get request 7265 * for T_info_ack on it. 7266 */ 7267 return (TS_WACK_CRES); 7268 case TCPS_ESTABLISHED: 7269 return (TS_DATA_XFER); 7270 case TCPS_CLOSE_WAIT: 7271 return (TS_WREQ_ORDREL); 7272 case TCPS_FIN_WAIT_1: 7273 return (TS_WIND_ORDREL); 7274 case TCPS_FIN_WAIT_2: 7275 return (TS_WIND_ORDREL); 7276 7277 case TCPS_CLOSING: 7278 case TCPS_LAST_ACK: 7279 case TCPS_TIME_WAIT: 7280 case TCPS_CLOSED: 7281 /* 7282 * Following TS_WACK_DREQ7 is a rendition of "not 7283 * yet TS_IDLE" TPI state. There is no best match to any 7284 * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we 7285 * choose a value chosen that will map to TLI/XTI level 7286 * state of TSTATECHNG (state is process of changing) which 7287 * captures what this dummy state represents. 7288 */ 7289 return (TS_WACK_DREQ7); 7290 default: 7291 cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s", 7292 tcp->tcp_state, tcp_display(tcp, NULL, 7293 DISP_PORT_ONLY)); 7294 return (TS_UNBND); 7295 } 7296 } 7297 7298 static void 7299 tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp) 7300 { 7301 if (tcp->tcp_family == AF_INET6) 7302 *tia = tcp_g_t_info_ack_v6; 7303 else 7304 *tia = tcp_g_t_info_ack; 7305 tia->CURRENT_state = tcp_tpistate(tcp); 7306 tia->OPT_size = tcp_max_optsize; 7307 if (tcp->tcp_mss == 0) { 7308 /* Not yet set - tcp_open does not set mss */ 7309 if (tcp->tcp_ipversion == IPV4_VERSION) 7310 tia->TIDU_size = tcp_mss_def_ipv4; 7311 else 7312 tia->TIDU_size = tcp_mss_def_ipv6; 7313 } else { 7314 tia->TIDU_size = tcp->tcp_mss; 7315 } 7316 /* TODO: Default ETSDU is 1. Is that correct for tcp? */ 7317 } 7318 7319 /* 7320 * This routine responds to T_CAPABILITY_REQ messages. It is called by 7321 * tcp_wput. Much of the T_CAPABILITY_ACK information is copied from 7322 * tcp_g_t_info_ack. The current state of the stream is copied from 7323 * tcp_state. 7324 */ 7325 static void 7326 tcp_capability_req(tcp_t *tcp, mblk_t *mp) 7327 { 7328 t_uscalar_t cap_bits1; 7329 struct T_capability_ack *tcap; 7330 7331 if (MBLKL(mp) < sizeof (struct T_capability_req)) { 7332 freemsg(mp); 7333 return; 7334 } 7335 7336 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 7337 7338 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 7339 mp->b_datap->db_type, T_CAPABILITY_ACK); 7340 if (mp == NULL) 7341 return; 7342 7343 tcap = (struct T_capability_ack *)mp->b_rptr; 7344 tcap->CAP_bits1 = 0; 7345 7346 if (cap_bits1 & TC1_INFO) { 7347 tcp_copy_info(&tcap->INFO_ack, tcp); 7348 tcap->CAP_bits1 |= TC1_INFO; 7349 } 7350 7351 if (cap_bits1 & TC1_ACCEPTOR_ID) { 7352 tcap->ACCEPTOR_id = tcp->tcp_acceptor_id; 7353 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID; 7354 } 7355 7356 putnext(tcp->tcp_rq, mp); 7357 } 7358 7359 /* 7360 * This routine responds to T_INFO_REQ messages. It is called by tcp_wput. 7361 * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack. 7362 * The current state of the stream is copied from tcp_state. 7363 */ 7364 static void 7365 tcp_info_req(tcp_t *tcp, mblk_t *mp) 7366 { 7367 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 7368 T_INFO_ACK); 7369 if (!mp) { 7370 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7371 return; 7372 } 7373 tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp); 7374 putnext(tcp->tcp_rq, mp); 7375 } 7376 7377 /* Respond to the TPI addr request */ 7378 static void 7379 tcp_addr_req(tcp_t *tcp, mblk_t *mp) 7380 { 7381 sin_t *sin; 7382 mblk_t *ackmp; 7383 struct T_addr_ack *taa; 7384 7385 /* Make it large enough for worst case */ 7386 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 7387 2 * sizeof (sin6_t), 1); 7388 if (ackmp == NULL) { 7389 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7390 return; 7391 } 7392 7393 if (tcp->tcp_ipversion == IPV6_VERSION) { 7394 tcp_addr_req_ipv6(tcp, ackmp); 7395 return; 7396 } 7397 taa = (struct T_addr_ack *)ackmp->b_rptr; 7398 7399 bzero(taa, sizeof (struct T_addr_ack)); 7400 ackmp->b_wptr = (uchar_t *)&taa[1]; 7401 7402 taa->PRIM_type = T_ADDR_ACK; 7403 ackmp->b_datap->db_type = M_PCPROTO; 7404 7405 /* 7406 * Note: Following code assumes 32 bit alignment of basic 7407 * data structures like sin_t and struct T_addr_ack. 7408 */ 7409 if (tcp->tcp_state >= TCPS_BOUND) { 7410 /* 7411 * Fill in local address 7412 */ 7413 taa->LOCADDR_length = sizeof (sin_t); 7414 taa->LOCADDR_offset = sizeof (*taa); 7415 7416 sin = (sin_t *)&taa[1]; 7417 7418 /* Fill zeroes and then intialize non-zero fields */ 7419 *sin = sin_null; 7420 7421 sin->sin_family = AF_INET; 7422 7423 sin->sin_addr.s_addr = tcp->tcp_ipha->ipha_src; 7424 sin->sin_port = *(uint16_t *)tcp->tcp_tcph->th_lport; 7425 7426 ackmp->b_wptr = (uchar_t *)&sin[1]; 7427 7428 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7429 /* 7430 * Fill in Remote address 7431 */ 7432 taa->REMADDR_length = sizeof (sin_t); 7433 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7434 taa->LOCADDR_length); 7435 7436 sin = (sin_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7437 *sin = sin_null; 7438 sin->sin_family = AF_INET; 7439 sin->sin_addr.s_addr = tcp->tcp_remote; 7440 sin->sin_port = tcp->tcp_fport; 7441 7442 ackmp->b_wptr = (uchar_t *)&sin[1]; 7443 } 7444 } 7445 putnext(tcp->tcp_rq, ackmp); 7446 } 7447 7448 /* Assumes that tcp_addr_req gets enough space and alignment */ 7449 static void 7450 tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *ackmp) 7451 { 7452 sin6_t *sin6; 7453 struct T_addr_ack *taa; 7454 7455 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 7456 ASSERT(OK_32PTR(ackmp->b_rptr)); 7457 ASSERT(ackmp->b_wptr - ackmp->b_rptr >= sizeof (struct T_addr_ack) + 7458 2 * sizeof (sin6_t)); 7459 7460 taa = (struct T_addr_ack *)ackmp->b_rptr; 7461 7462 bzero(taa, sizeof (struct T_addr_ack)); 7463 ackmp->b_wptr = (uchar_t *)&taa[1]; 7464 7465 taa->PRIM_type = T_ADDR_ACK; 7466 ackmp->b_datap->db_type = M_PCPROTO; 7467 7468 /* 7469 * Note: Following code assumes 32 bit alignment of basic 7470 * data structures like sin6_t and struct T_addr_ack. 7471 */ 7472 if (tcp->tcp_state >= TCPS_BOUND) { 7473 /* 7474 * Fill in local address 7475 */ 7476 taa->LOCADDR_length = sizeof (sin6_t); 7477 taa->LOCADDR_offset = sizeof (*taa); 7478 7479 sin6 = (sin6_t *)&taa[1]; 7480 *sin6 = sin6_null; 7481 7482 sin6->sin6_family = AF_INET6; 7483 sin6->sin6_addr = tcp->tcp_ip6h->ip6_src; 7484 sin6->sin6_port = tcp->tcp_lport; 7485 7486 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7487 7488 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7489 /* 7490 * Fill in Remote address 7491 */ 7492 taa->REMADDR_length = sizeof (sin6_t); 7493 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7494 taa->LOCADDR_length); 7495 7496 sin6 = (sin6_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7497 *sin6 = sin6_null; 7498 sin6->sin6_family = AF_INET6; 7499 sin6->sin6_flowinfo = 7500 tcp->tcp_ip6h->ip6_vcf & 7501 ~IPV6_VERS_AND_FLOW_MASK; 7502 sin6->sin6_addr = tcp->tcp_remote_v6; 7503 sin6->sin6_port = tcp->tcp_fport; 7504 7505 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7506 } 7507 } 7508 putnext(tcp->tcp_rq, ackmp); 7509 } 7510 7511 /* 7512 * Handle reinitialization of a tcp structure. 7513 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 7514 */ 7515 static void 7516 tcp_reinit(tcp_t *tcp) 7517 { 7518 mblk_t *mp; 7519 int err; 7520 7521 TCP_STAT(tcp_reinit_calls); 7522 7523 /* tcp_reinit should never be called for detached tcp_t's */ 7524 ASSERT(tcp->tcp_listener == NULL); 7525 ASSERT((tcp->tcp_family == AF_INET && 7526 tcp->tcp_ipversion == IPV4_VERSION) || 7527 (tcp->tcp_family == AF_INET6 && 7528 (tcp->tcp_ipversion == IPV4_VERSION || 7529 tcp->tcp_ipversion == IPV6_VERSION))); 7530 7531 /* Cancel outstanding timers */ 7532 tcp_timers_stop(tcp); 7533 7534 /* 7535 * Reset everything in the state vector, after updating global 7536 * MIB data from instance counters. 7537 */ 7538 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 7539 tcp->tcp_ibsegs = 0; 7540 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 7541 tcp->tcp_obsegs = 0; 7542 7543 tcp_close_mpp(&tcp->tcp_xmit_head); 7544 if (tcp->tcp_snd_zcopy_aware) 7545 tcp_zcopy_notify(tcp); 7546 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 7547 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 7548 if (tcp->tcp_flow_stopped && 7549 TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) { 7550 tcp_clrqfull(tcp); 7551 } 7552 tcp_close_mpp(&tcp->tcp_reass_head); 7553 tcp->tcp_reass_tail = NULL; 7554 if (tcp->tcp_rcv_list != NULL) { 7555 /* Free b_next chain */ 7556 tcp_close_mpp(&tcp->tcp_rcv_list); 7557 tcp->tcp_rcv_last_head = NULL; 7558 tcp->tcp_rcv_last_tail = NULL; 7559 tcp->tcp_rcv_cnt = 0; 7560 } 7561 tcp->tcp_rcv_last_tail = NULL; 7562 7563 if ((mp = tcp->tcp_urp_mp) != NULL) { 7564 freemsg(mp); 7565 tcp->tcp_urp_mp = NULL; 7566 } 7567 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 7568 freemsg(mp); 7569 tcp->tcp_urp_mark_mp = NULL; 7570 } 7571 if (tcp->tcp_fused_sigurg_mp != NULL) { 7572 freeb(tcp->tcp_fused_sigurg_mp); 7573 tcp->tcp_fused_sigurg_mp = NULL; 7574 } 7575 7576 /* 7577 * Following is a union with two members which are 7578 * identical types and size so the following cleanup 7579 * is enough. 7580 */ 7581 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 7582 7583 CL_INET_DISCONNECT(tcp); 7584 7585 /* 7586 * The connection can't be on the tcp_time_wait_head list 7587 * since it is not detached. 7588 */ 7589 ASSERT(tcp->tcp_time_wait_next == NULL); 7590 ASSERT(tcp->tcp_time_wait_prev == NULL); 7591 ASSERT(tcp->tcp_time_wait_expire == 0); 7592 7593 if (tcp->tcp_kssl_pending) { 7594 tcp->tcp_kssl_pending = B_FALSE; 7595 7596 /* Don't reset if the initialized by bind. */ 7597 if (tcp->tcp_kssl_ent != NULL) { 7598 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 7599 KSSL_NO_PROXY); 7600 } 7601 } 7602 if (tcp->tcp_kssl_ctx != NULL) { 7603 kssl_release_ctx(tcp->tcp_kssl_ctx); 7604 tcp->tcp_kssl_ctx = NULL; 7605 } 7606 7607 /* 7608 * Reset/preserve other values 7609 */ 7610 tcp_reinit_values(tcp); 7611 ipcl_hash_remove(tcp->tcp_connp); 7612 conn_delete_ire(tcp->tcp_connp, NULL); 7613 7614 if (tcp->tcp_conn_req_max != 0) { 7615 /* 7616 * This is the case when a TLI program uses the same 7617 * transport end point to accept a connection. This 7618 * makes the TCP both a listener and acceptor. When 7619 * this connection is closed, we need to set the state 7620 * back to TCPS_LISTEN. Make sure that the eager list 7621 * is reinitialized. 7622 * 7623 * Note that this stream is still bound to the four 7624 * tuples of the previous connection in IP. If a new 7625 * SYN with different foreign address comes in, IP will 7626 * not find it and will send it to the global queue. In 7627 * the global queue, TCP will do a tcp_lookup_listener() 7628 * to find this stream. This works because this stream 7629 * is only removed from connected hash. 7630 * 7631 */ 7632 tcp->tcp_state = TCPS_LISTEN; 7633 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 7634 tcp->tcp_connp->conn_recv = tcp_conn_request; 7635 if (tcp->tcp_family == AF_INET6) { 7636 ASSERT(tcp->tcp_connp->conn_af_isv6); 7637 (void) ipcl_bind_insert_v6(tcp->tcp_connp, IPPROTO_TCP, 7638 &tcp->tcp_ip6h->ip6_src, tcp->tcp_lport); 7639 } else { 7640 ASSERT(!tcp->tcp_connp->conn_af_isv6); 7641 (void) ipcl_bind_insert(tcp->tcp_connp, IPPROTO_TCP, 7642 tcp->tcp_ipha->ipha_src, tcp->tcp_lport); 7643 } 7644 } else { 7645 tcp->tcp_state = TCPS_BOUND; 7646 } 7647 7648 /* 7649 * Initialize to default values 7650 * Can't fail since enough header template space already allocated 7651 * at open(). 7652 */ 7653 err = tcp_init_values(tcp); 7654 ASSERT(err == 0); 7655 /* Restore state in tcp_tcph */ 7656 bcopy(&tcp->tcp_lport, tcp->tcp_tcph->th_lport, TCP_PORT_LEN); 7657 if (tcp->tcp_ipversion == IPV4_VERSION) 7658 tcp->tcp_ipha->ipha_src = tcp->tcp_bound_source; 7659 else 7660 tcp->tcp_ip6h->ip6_src = tcp->tcp_bound_source_v6; 7661 /* 7662 * Copy of the src addr. in tcp_t is needed in tcp_t 7663 * since the lookup funcs can only lookup on tcp_t 7664 */ 7665 tcp->tcp_ip_src_v6 = tcp->tcp_bound_source_v6; 7666 7667 ASSERT(tcp->tcp_ptpbhn != NULL); 7668 tcp->tcp_rq->q_hiwat = tcp_recv_hiwat; 7669 tcp->tcp_rwnd = tcp_recv_hiwat; 7670 tcp->tcp_mss = tcp->tcp_ipversion != IPV4_VERSION ? 7671 tcp_mss_def_ipv6 : tcp_mss_def_ipv4; 7672 } 7673 7674 /* 7675 * Force values to zero that need be zero. 7676 * Do not touch values asociated with the BOUND or LISTEN state 7677 * since the connection will end up in that state after the reinit. 7678 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 7679 * structure! 7680 */ 7681 static void 7682 tcp_reinit_values(tcp) 7683 tcp_t *tcp; 7684 { 7685 #ifndef lint 7686 #define DONTCARE(x) 7687 #define PRESERVE(x) 7688 #else 7689 #define DONTCARE(x) ((x) = (x)) 7690 #define PRESERVE(x) ((x) = (x)) 7691 #endif /* lint */ 7692 7693 PRESERVE(tcp->tcp_bind_hash); 7694 PRESERVE(tcp->tcp_ptpbhn); 7695 PRESERVE(tcp->tcp_acceptor_hash); 7696 PRESERVE(tcp->tcp_ptpahn); 7697 7698 /* Should be ASSERT NULL on these with new code! */ 7699 ASSERT(tcp->tcp_time_wait_next == NULL); 7700 ASSERT(tcp->tcp_time_wait_prev == NULL); 7701 ASSERT(tcp->tcp_time_wait_expire == 0); 7702 PRESERVE(tcp->tcp_state); 7703 PRESERVE(tcp->tcp_rq); 7704 PRESERVE(tcp->tcp_wq); 7705 7706 ASSERT(tcp->tcp_xmit_head == NULL); 7707 ASSERT(tcp->tcp_xmit_last == NULL); 7708 ASSERT(tcp->tcp_unsent == 0); 7709 ASSERT(tcp->tcp_xmit_tail == NULL); 7710 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 7711 7712 tcp->tcp_snxt = 0; /* Displayed in mib */ 7713 tcp->tcp_suna = 0; /* Displayed in mib */ 7714 tcp->tcp_swnd = 0; 7715 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_mss_set */ 7716 7717 ASSERT(tcp->tcp_ibsegs == 0); 7718 ASSERT(tcp->tcp_obsegs == 0); 7719 7720 if (tcp->tcp_iphc != NULL) { 7721 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 7722 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 7723 } 7724 7725 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 7726 DONTCARE(tcp->tcp_hdr_len); /* Init in tcp_init_values */ 7727 DONTCARE(tcp->tcp_ipha); 7728 DONTCARE(tcp->tcp_ip6h); 7729 DONTCARE(tcp->tcp_ip_hdr_len); 7730 DONTCARE(tcp->tcp_tcph); 7731 DONTCARE(tcp->tcp_tcp_hdr_len); /* Init in tcp_init_values */ 7732 tcp->tcp_valid_bits = 0; 7733 7734 DONTCARE(tcp->tcp_xmit_hiwater); /* Init in tcp_init_values */ 7735 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 7736 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 7737 tcp->tcp_last_rcv_lbolt = 0; 7738 7739 tcp->tcp_init_cwnd = 0; 7740 7741 tcp->tcp_urp_last_valid = 0; 7742 tcp->tcp_hard_binding = 0; 7743 tcp->tcp_hard_bound = 0; 7744 PRESERVE(tcp->tcp_cred); 7745 PRESERVE(tcp->tcp_cpid); 7746 PRESERVE(tcp->tcp_exclbind); 7747 7748 tcp->tcp_fin_acked = 0; 7749 tcp->tcp_fin_rcvd = 0; 7750 tcp->tcp_fin_sent = 0; 7751 tcp->tcp_ordrel_done = 0; 7752 7753 tcp->tcp_debug = 0; 7754 tcp->tcp_dontroute = 0; 7755 tcp->tcp_broadcast = 0; 7756 7757 tcp->tcp_useloopback = 0; 7758 tcp->tcp_reuseaddr = 0; 7759 tcp->tcp_oobinline = 0; 7760 tcp->tcp_dgram_errind = 0; 7761 7762 tcp->tcp_detached = 0; 7763 tcp->tcp_bind_pending = 0; 7764 tcp->tcp_unbind_pending = 0; 7765 tcp->tcp_deferred_clean_death = 0; 7766 7767 tcp->tcp_snd_ws_ok = B_FALSE; 7768 tcp->tcp_snd_ts_ok = B_FALSE; 7769 tcp->tcp_linger = 0; 7770 tcp->tcp_ka_enabled = 0; 7771 tcp->tcp_zero_win_probe = 0; 7772 7773 tcp->tcp_loopback = 0; 7774 tcp->tcp_localnet = 0; 7775 tcp->tcp_syn_defense = 0; 7776 tcp->tcp_set_timer = 0; 7777 7778 tcp->tcp_active_open = 0; 7779 ASSERT(tcp->tcp_timeout == B_FALSE); 7780 tcp->tcp_rexmit = B_FALSE; 7781 tcp->tcp_xmit_zc_clean = B_FALSE; 7782 7783 tcp->tcp_snd_sack_ok = B_FALSE; 7784 PRESERVE(tcp->tcp_recvdstaddr); 7785 tcp->tcp_hwcksum = B_FALSE; 7786 7787 tcp->tcp_ire_ill_check_done = B_FALSE; 7788 DONTCARE(tcp->tcp_maxpsz); /* Init in tcp_init_values */ 7789 7790 tcp->tcp_mdt = B_FALSE; 7791 tcp->tcp_mdt_hdr_head = 0; 7792 tcp->tcp_mdt_hdr_tail = 0; 7793 7794 tcp->tcp_conn_def_q0 = 0; 7795 tcp->tcp_ip_forward_progress = B_FALSE; 7796 tcp->tcp_anon_priv_bind = 0; 7797 tcp->tcp_ecn_ok = B_FALSE; 7798 7799 tcp->tcp_cwr = B_FALSE; 7800 tcp->tcp_ecn_echo_on = B_FALSE; 7801 7802 if (tcp->tcp_sack_info != NULL) { 7803 if (tcp->tcp_notsack_list != NULL) { 7804 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 7805 } 7806 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 7807 tcp->tcp_sack_info = NULL; 7808 } 7809 7810 tcp->tcp_rcv_ws = 0; 7811 tcp->tcp_snd_ws = 0; 7812 tcp->tcp_ts_recent = 0; 7813 tcp->tcp_rnxt = 0; /* Displayed in mib */ 7814 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 7815 tcp->tcp_if_mtu = 0; 7816 7817 ASSERT(tcp->tcp_reass_head == NULL); 7818 ASSERT(tcp->tcp_reass_tail == NULL); 7819 7820 tcp->tcp_cwnd_cnt = 0; 7821 7822 ASSERT(tcp->tcp_rcv_list == NULL); 7823 ASSERT(tcp->tcp_rcv_last_head == NULL); 7824 ASSERT(tcp->tcp_rcv_last_tail == NULL); 7825 ASSERT(tcp->tcp_rcv_cnt == 0); 7826 7827 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_adapt_ire */ 7828 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 7829 tcp->tcp_csuna = 0; 7830 7831 tcp->tcp_rto = 0; /* Displayed in MIB */ 7832 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 7833 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 7834 tcp->tcp_rtt_update = 0; 7835 7836 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 7837 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 7838 7839 tcp->tcp_rack = 0; /* Displayed in mib */ 7840 tcp->tcp_rack_cnt = 0; 7841 tcp->tcp_rack_cur_max = 0; 7842 tcp->tcp_rack_abs_max = 0; 7843 7844 tcp->tcp_max_swnd = 0; 7845 7846 ASSERT(tcp->tcp_listener == NULL); 7847 7848 DONTCARE(tcp->tcp_xmit_lowater); /* Init in tcp_init_values */ 7849 7850 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 7851 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 7852 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 7853 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 7854 7855 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 7856 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 7857 PRESERVE(tcp->tcp_conn_req_max); 7858 PRESERVE(tcp->tcp_conn_req_seqnum); 7859 7860 DONTCARE(tcp->tcp_ip_hdr_len); /* Init in tcp_init_values */ 7861 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 7862 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 7863 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 7864 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 7865 7866 tcp->tcp_lingertime = 0; 7867 7868 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 7869 ASSERT(tcp->tcp_urp_mp == NULL); 7870 ASSERT(tcp->tcp_urp_mark_mp == NULL); 7871 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 7872 7873 ASSERT(tcp->tcp_eager_next_q == NULL); 7874 ASSERT(tcp->tcp_eager_last_q == NULL); 7875 ASSERT((tcp->tcp_eager_next_q0 == NULL && 7876 tcp->tcp_eager_prev_q0 == NULL) || 7877 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 7878 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 7879 7880 tcp->tcp_client_errno = 0; 7881 7882 DONTCARE(tcp->tcp_sum); /* Init in tcp_init_values */ 7883 7884 tcp->tcp_remote_v6 = ipv6_all_zeros; /* Displayed in MIB */ 7885 7886 PRESERVE(tcp->tcp_bound_source_v6); 7887 tcp->tcp_last_sent_len = 0; 7888 tcp->tcp_dupack_cnt = 0; 7889 7890 tcp->tcp_fport = 0; /* Displayed in MIB */ 7891 PRESERVE(tcp->tcp_lport); 7892 7893 PRESERVE(tcp->tcp_acceptor_lockp); 7894 7895 ASSERT(tcp->tcp_ordrelid == 0); 7896 PRESERVE(tcp->tcp_acceptor_id); 7897 DONTCARE(tcp->tcp_ipsec_overhead); 7898 7899 /* 7900 * If tcp_tracing flag is ON (i.e. We have a trace buffer 7901 * in tcp structure and now tracing), Re-initialize all 7902 * members of tcp_traceinfo. 7903 */ 7904 if (tcp->tcp_tracebuf != NULL) { 7905 bzero(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 7906 } 7907 7908 PRESERVE(tcp->tcp_family); 7909 if (tcp->tcp_family == AF_INET6) { 7910 tcp->tcp_ipversion = IPV6_VERSION; 7911 tcp->tcp_mss = tcp_mss_def_ipv6; 7912 } else { 7913 tcp->tcp_ipversion = IPV4_VERSION; 7914 tcp->tcp_mss = tcp_mss_def_ipv4; 7915 } 7916 7917 tcp->tcp_bound_if = 0; 7918 tcp->tcp_ipv6_recvancillary = 0; 7919 tcp->tcp_recvifindex = 0; 7920 tcp->tcp_recvhops = 0; 7921 tcp->tcp_closed = 0; 7922 tcp->tcp_cleandeathtag = 0; 7923 if (tcp->tcp_hopopts != NULL) { 7924 mi_free(tcp->tcp_hopopts); 7925 tcp->tcp_hopopts = NULL; 7926 tcp->tcp_hopoptslen = 0; 7927 } 7928 ASSERT(tcp->tcp_hopoptslen == 0); 7929 if (tcp->tcp_dstopts != NULL) { 7930 mi_free(tcp->tcp_dstopts); 7931 tcp->tcp_dstopts = NULL; 7932 tcp->tcp_dstoptslen = 0; 7933 } 7934 ASSERT(tcp->tcp_dstoptslen == 0); 7935 if (tcp->tcp_rtdstopts != NULL) { 7936 mi_free(tcp->tcp_rtdstopts); 7937 tcp->tcp_rtdstopts = NULL; 7938 tcp->tcp_rtdstoptslen = 0; 7939 } 7940 ASSERT(tcp->tcp_rtdstoptslen == 0); 7941 if (tcp->tcp_rthdr != NULL) { 7942 mi_free(tcp->tcp_rthdr); 7943 tcp->tcp_rthdr = NULL; 7944 tcp->tcp_rthdrlen = 0; 7945 } 7946 ASSERT(tcp->tcp_rthdrlen == 0); 7947 PRESERVE(tcp->tcp_drop_opt_ack_cnt); 7948 7949 /* Reset fusion-related fields */ 7950 tcp->tcp_fused = B_FALSE; 7951 tcp->tcp_unfusable = B_FALSE; 7952 tcp->tcp_fused_sigurg = B_FALSE; 7953 tcp->tcp_direct_sockfs = B_FALSE; 7954 tcp->tcp_fuse_syncstr_stopped = B_FALSE; 7955 tcp->tcp_fuse_syncstr_plugged = B_FALSE; 7956 tcp->tcp_loopback_peer = NULL; 7957 tcp->tcp_fuse_rcv_hiwater = 0; 7958 tcp->tcp_fuse_rcv_unread_hiwater = 0; 7959 tcp->tcp_fuse_rcv_unread_cnt = 0; 7960 7961 tcp->tcp_in_ack_unsent = 0; 7962 tcp->tcp_cork = B_FALSE; 7963 7964 PRESERVE(tcp->tcp_squeue_bytes); 7965 7966 ASSERT(tcp->tcp_kssl_ctx == NULL); 7967 ASSERT(!tcp->tcp_kssl_pending); 7968 PRESERVE(tcp->tcp_kssl_ent); 7969 7970 #undef DONTCARE 7971 #undef PRESERVE 7972 } 7973 7974 /* 7975 * Allocate necessary resources and initialize state vector. 7976 * Guaranteed not to fail so that when an error is returned, 7977 * the caller doesn't need to do any additional cleanup. 7978 */ 7979 int 7980 tcp_init(tcp_t *tcp, queue_t *q) 7981 { 7982 int err; 7983 7984 tcp->tcp_rq = q; 7985 tcp->tcp_wq = WR(q); 7986 tcp->tcp_state = TCPS_IDLE; 7987 if ((err = tcp_init_values(tcp)) != 0) 7988 tcp_timers_stop(tcp); 7989 return (err); 7990 } 7991 7992 static int 7993 tcp_init_values(tcp_t *tcp) 7994 { 7995 int err; 7996 7997 ASSERT((tcp->tcp_family == AF_INET && 7998 tcp->tcp_ipversion == IPV4_VERSION) || 7999 (tcp->tcp_family == AF_INET6 && 8000 (tcp->tcp_ipversion == IPV4_VERSION || 8001 tcp->tcp_ipversion == IPV6_VERSION))); 8002 8003 /* 8004 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 8005 * will be close to tcp_rexmit_interval_initial. By doing this, we 8006 * allow the algorithm to adjust slowly to large fluctuations of RTT 8007 * during first few transmissions of a connection as seen in slow 8008 * links. 8009 */ 8010 tcp->tcp_rtt_sa = tcp_rexmit_interval_initial << 2; 8011 tcp->tcp_rtt_sd = tcp_rexmit_interval_initial >> 1; 8012 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 8013 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 8014 tcp_conn_grace_period; 8015 if (tcp->tcp_rto < tcp_rexmit_interval_min) 8016 tcp->tcp_rto = tcp_rexmit_interval_min; 8017 tcp->tcp_timer_backoff = 0; 8018 tcp->tcp_ms_we_have_waited = 0; 8019 tcp->tcp_last_recv_time = lbolt; 8020 tcp->tcp_cwnd_max = tcp_cwnd_max_; 8021 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 8022 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 8023 8024 tcp->tcp_maxpsz = tcp_maxpsz_multiplier; 8025 8026 tcp->tcp_first_timer_threshold = tcp_ip_notify_interval; 8027 tcp->tcp_first_ctimer_threshold = tcp_ip_notify_cinterval; 8028 tcp->tcp_second_timer_threshold = tcp_ip_abort_interval; 8029 /* 8030 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 8031 * passive open. 8032 */ 8033 tcp->tcp_second_ctimer_threshold = tcp_ip_abort_cinterval; 8034 8035 tcp->tcp_naglim = tcp_naglim_def; 8036 8037 /* NOTE: ISS is now set in tcp_adapt_ire(). */ 8038 8039 tcp->tcp_mdt_hdr_head = 0; 8040 tcp->tcp_mdt_hdr_tail = 0; 8041 8042 /* Reset fusion-related fields */ 8043 tcp->tcp_fused = B_FALSE; 8044 tcp->tcp_unfusable = B_FALSE; 8045 tcp->tcp_fused_sigurg = B_FALSE; 8046 tcp->tcp_direct_sockfs = B_FALSE; 8047 tcp->tcp_fuse_syncstr_stopped = B_FALSE; 8048 tcp->tcp_fuse_syncstr_plugged = B_FALSE; 8049 tcp->tcp_loopback_peer = NULL; 8050 tcp->tcp_fuse_rcv_hiwater = 0; 8051 tcp->tcp_fuse_rcv_unread_hiwater = 0; 8052 tcp->tcp_fuse_rcv_unread_cnt = 0; 8053 8054 /* Initialize the header template */ 8055 if (tcp->tcp_ipversion == IPV4_VERSION) { 8056 err = tcp_header_init_ipv4(tcp); 8057 } else { 8058 err = tcp_header_init_ipv6(tcp); 8059 } 8060 if (err) 8061 return (err); 8062 8063 /* 8064 * Init the window scale to the max so tcp_rwnd_set() won't pare 8065 * down tcp_rwnd. tcp_adapt_ire() will set the right value later. 8066 */ 8067 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 8068 tcp->tcp_xmit_lowater = tcp_xmit_lowat; 8069 tcp->tcp_xmit_hiwater = tcp_xmit_hiwat; 8070 8071 tcp->tcp_cork = B_FALSE; 8072 /* 8073 * Init the tcp_debug option. This value determines whether TCP 8074 * calls strlog() to print out debug messages. Doing this 8075 * initialization here means that this value is not inherited thru 8076 * tcp_reinit(). 8077 */ 8078 tcp->tcp_debug = tcp_dbg; 8079 8080 tcp->tcp_ka_interval = tcp_keepalive_interval; 8081 tcp->tcp_ka_abort_thres = tcp_keepalive_abort_interval; 8082 8083 return (0); 8084 } 8085 8086 /* 8087 * Initialize the IPv4 header. Loses any record of any IP options. 8088 */ 8089 static int 8090 tcp_header_init_ipv4(tcp_t *tcp) 8091 { 8092 tcph_t *tcph; 8093 uint32_t sum; 8094 conn_t *connp; 8095 8096 /* 8097 * This is a simple initialization. If there's 8098 * already a template, it should never be too small, 8099 * so reuse it. Otherwise, allocate space for the new one. 8100 */ 8101 if (tcp->tcp_iphc == NULL) { 8102 ASSERT(tcp->tcp_iphc_len == 0); 8103 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8104 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8105 if (tcp->tcp_iphc == NULL) { 8106 tcp->tcp_iphc_len = 0; 8107 return (ENOMEM); 8108 } 8109 } 8110 8111 /* options are gone; may need a new label */ 8112 connp = tcp->tcp_connp; 8113 connp->conn_mlp_type = mlptSingle; 8114 connp->conn_ulp_labeled = !is_system_labeled(); 8115 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8116 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 8117 tcp->tcp_ip6h = NULL; 8118 tcp->tcp_ipversion = IPV4_VERSION; 8119 tcp->tcp_hdr_len = sizeof (ipha_t) + sizeof (tcph_t); 8120 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8121 tcp->tcp_ip_hdr_len = sizeof (ipha_t); 8122 tcp->tcp_ipha->ipha_length = htons(sizeof (ipha_t) + sizeof (tcph_t)); 8123 tcp->tcp_ipha->ipha_version_and_hdr_length 8124 = (IP_VERSION << 4) | IP_SIMPLE_HDR_LENGTH_IN_WORDS; 8125 tcp->tcp_ipha->ipha_ident = 0; 8126 8127 tcp->tcp_ttl = (uchar_t)tcp_ipv4_ttl; 8128 tcp->tcp_tos = 0; 8129 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 8130 tcp->tcp_ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 8131 tcp->tcp_ipha->ipha_protocol = IPPROTO_TCP; 8132 8133 tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (ipha_t)); 8134 tcp->tcp_tcph = tcph; 8135 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8136 /* 8137 * IP wants our header length in the checksum field to 8138 * allow it to perform a single pseudo-header+checksum 8139 * calculation on behalf of TCP. 8140 * Include the adjustment for a source route once IP_OPTIONS is set. 8141 */ 8142 sum = sizeof (tcph_t) + tcp->tcp_sum; 8143 sum = (sum >> 16) + (sum & 0xFFFF); 8144 U16_TO_ABE16(sum, tcph->th_sum); 8145 return (0); 8146 } 8147 8148 /* 8149 * Initialize the IPv6 header. Loses any record of any IPv6 extension headers. 8150 */ 8151 static int 8152 tcp_header_init_ipv6(tcp_t *tcp) 8153 { 8154 tcph_t *tcph; 8155 uint32_t sum; 8156 conn_t *connp; 8157 8158 /* 8159 * This is a simple initialization. If there's 8160 * already a template, it should never be too small, 8161 * so reuse it. Otherwise, allocate space for the new one. 8162 * Ensure that there is enough space to "downgrade" the tcp_t 8163 * to an IPv4 tcp_t. This requires having space for a full load 8164 * of IPv4 options, as well as a full load of TCP options 8165 * (TCP_MAX_COMBINED_HEADER_LENGTH, 120 bytes); this is more space 8166 * than a v6 header and a TCP header with a full load of TCP options 8167 * (IPV6_HDR_LEN is 40 bytes; TCP_MAX_HDR_LENGTH is 60 bytes). 8168 * We want to avoid reallocation in the "downgraded" case when 8169 * processing outbound IPv4 options. 8170 */ 8171 if (tcp->tcp_iphc == NULL) { 8172 ASSERT(tcp->tcp_iphc_len == 0); 8173 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8174 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8175 if (tcp->tcp_iphc == NULL) { 8176 tcp->tcp_iphc_len = 0; 8177 return (ENOMEM); 8178 } 8179 } 8180 8181 /* options are gone; may need a new label */ 8182 connp = tcp->tcp_connp; 8183 connp->conn_mlp_type = mlptSingle; 8184 connp->conn_ulp_labeled = !is_system_labeled(); 8185 8186 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8187 tcp->tcp_ipversion = IPV6_VERSION; 8188 tcp->tcp_hdr_len = IPV6_HDR_LEN + sizeof (tcph_t); 8189 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8190 tcp->tcp_ip_hdr_len = IPV6_HDR_LEN; 8191 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 8192 tcp->tcp_ipha = NULL; 8193 8194 /* Initialize the header template */ 8195 8196 tcp->tcp_ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW; 8197 tcp->tcp_ip6h->ip6_plen = ntohs(sizeof (tcph_t)); 8198 tcp->tcp_ip6h->ip6_nxt = IPPROTO_TCP; 8199 tcp->tcp_ip6h->ip6_hops = (uint8_t)tcp_ipv6_hoplimit; 8200 8201 tcph = (tcph_t *)(tcp->tcp_iphc + IPV6_HDR_LEN); 8202 tcp->tcp_tcph = tcph; 8203 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8204 /* 8205 * IP wants our header length in the checksum field to 8206 * allow it to perform a single psuedo-header+checksum 8207 * calculation on behalf of TCP. 8208 * Include the adjustment for a source route when IPV6_RTHDR is set. 8209 */ 8210 sum = sizeof (tcph_t) + tcp->tcp_sum; 8211 sum = (sum >> 16) + (sum & 0xFFFF); 8212 U16_TO_ABE16(sum, tcph->th_sum); 8213 return (0); 8214 } 8215 8216 /* At minimum we need 4 bytes in the TCP header for the lookup */ 8217 #define ICMP_MIN_TCP_HDR 12 8218 8219 /* 8220 * tcp_icmp_error is called by tcp_rput_other to process ICMP error messages 8221 * passed up by IP. The message is always received on the correct tcp_t. 8222 * Assumes that IP has pulled up everything up to and including the ICMP header. 8223 */ 8224 void 8225 tcp_icmp_error(tcp_t *tcp, mblk_t *mp) 8226 { 8227 icmph_t *icmph; 8228 ipha_t *ipha; 8229 int iph_hdr_length; 8230 tcph_t *tcph; 8231 boolean_t ipsec_mctl = B_FALSE; 8232 boolean_t secure; 8233 mblk_t *first_mp = mp; 8234 uint32_t new_mss; 8235 uint32_t ratio; 8236 size_t mp_size = MBLKL(mp); 8237 uint32_t seg_ack; 8238 uint32_t seg_seq; 8239 8240 /* Assume IP provides aligned packets - otherwise toss */ 8241 if (!OK_32PTR(mp->b_rptr)) { 8242 freemsg(mp); 8243 return; 8244 } 8245 8246 /* 8247 * Since ICMP errors are normal data marked with M_CTL when sent 8248 * to TCP or UDP, we have to look for a IPSEC_IN value to identify 8249 * packets starting with an ipsec_info_t, see ipsec_info.h. 8250 */ 8251 if ((mp_size == sizeof (ipsec_info_t)) && 8252 (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == IPSEC_IN)) { 8253 ASSERT(mp->b_cont != NULL); 8254 mp = mp->b_cont; 8255 /* IP should have done this */ 8256 ASSERT(OK_32PTR(mp->b_rptr)); 8257 mp_size = MBLKL(mp); 8258 ipsec_mctl = B_TRUE; 8259 } 8260 8261 /* 8262 * Verify that we have a complete outer IP header. If not, drop it. 8263 */ 8264 if (mp_size < sizeof (ipha_t)) { 8265 noticmpv4: 8266 freemsg(first_mp); 8267 return; 8268 } 8269 8270 ipha = (ipha_t *)mp->b_rptr; 8271 /* 8272 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 8273 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 8274 */ 8275 switch (IPH_HDR_VERSION(ipha)) { 8276 case IPV6_VERSION: 8277 tcp_icmp_error_ipv6(tcp, first_mp, ipsec_mctl); 8278 return; 8279 case IPV4_VERSION: 8280 break; 8281 default: 8282 goto noticmpv4; 8283 } 8284 8285 /* Skip past the outer IP and ICMP headers */ 8286 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8287 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 8288 /* 8289 * If we don't have the correct outer IP header length or if the ULP 8290 * is not IPPROTO_ICMP or if we don't have a complete inner IP header 8291 * send it upstream. 8292 */ 8293 if (iph_hdr_length < sizeof (ipha_t) || 8294 ipha->ipha_protocol != IPPROTO_ICMP || 8295 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 8296 goto noticmpv4; 8297 } 8298 ipha = (ipha_t *)&icmph[1]; 8299 8300 /* Skip past the inner IP and find the ULP header */ 8301 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8302 tcph = (tcph_t *)((char *)ipha + iph_hdr_length); 8303 /* 8304 * If we don't have the correct inner IP header length or if the ULP 8305 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 8306 * bytes of TCP header, drop it. 8307 */ 8308 if (iph_hdr_length < sizeof (ipha_t) || 8309 ipha->ipha_protocol != IPPROTO_TCP || 8310 (uchar_t *)tcph + ICMP_MIN_TCP_HDR > mp->b_wptr) { 8311 goto noticmpv4; 8312 } 8313 8314 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 8315 if (ipsec_mctl) { 8316 secure = ipsec_in_is_secure(first_mp); 8317 } else { 8318 secure = B_FALSE; 8319 } 8320 if (secure) { 8321 /* 8322 * If we are willing to accept this in clear 8323 * we don't have to verify policy. 8324 */ 8325 if (!ipsec_inbound_accept_clear(mp, ipha, NULL)) { 8326 if (!tcp_check_policy(tcp, first_mp, 8327 ipha, NULL, secure, ipsec_mctl)) { 8328 /* 8329 * tcp_check_policy called 8330 * ip_drop_packet() on failure. 8331 */ 8332 return; 8333 } 8334 } 8335 } 8336 } else if (ipsec_mctl) { 8337 /* 8338 * This is a hard_bound connection. IP has already 8339 * verified policy. We don't have to do it again. 8340 */ 8341 freeb(first_mp); 8342 first_mp = mp; 8343 ipsec_mctl = B_FALSE; 8344 } 8345 8346 seg_ack = ABE32_TO_U32(tcph->th_ack); 8347 seg_seq = ABE32_TO_U32(tcph->th_seq); 8348 /* 8349 * TCP SHOULD check that the TCP sequence number contained in 8350 * payload of the ICMP error message is within the range 8351 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8352 */ 8353 if (SEQ_LT(seg_seq, tcp->tcp_suna) || 8354 SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8355 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8356 /* 8357 * If the ICMP message is bogus, should we kill the 8358 * connection, or should we just drop the bogus ICMP 8359 * message? It would probably make more sense to just 8360 * drop the message so that if this one managed to get 8361 * in, the real connection should not suffer. 8362 */ 8363 goto noticmpv4; 8364 } 8365 8366 switch (icmph->icmph_type) { 8367 case ICMP_DEST_UNREACHABLE: 8368 switch (icmph->icmph_code) { 8369 case ICMP_FRAGMENTATION_NEEDED: 8370 /* 8371 * Reduce the MSS based on the new MTU. This will 8372 * eliminate any fragmentation locally. 8373 * N.B. There may well be some funny side-effects on 8374 * the local send policy and the remote receive policy. 8375 * Pending further research, we provide 8376 * tcp_ignore_path_mtu just in case this proves 8377 * disastrous somewhere. 8378 * 8379 * After updating the MSS, retransmit part of the 8380 * dropped segment using the new mss by calling 8381 * tcp_wput_data(). Need to adjust all those 8382 * params to make sure tcp_wput_data() work properly. 8383 */ 8384 if (tcp_ignore_path_mtu) 8385 break; 8386 8387 /* 8388 * Decrease the MSS by time stamp options 8389 * IP options and IPSEC options. tcp_hdr_len 8390 * includes time stamp option and IP option 8391 * length. 8392 */ 8393 8394 new_mss = ntohs(icmph->icmph_du_mtu) - 8395 tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead; 8396 8397 /* 8398 * Only update the MSS if the new one is 8399 * smaller than the previous one. This is 8400 * to avoid problems when getting multiple 8401 * ICMP errors for the same MTU. 8402 */ 8403 if (new_mss >= tcp->tcp_mss) 8404 break; 8405 8406 /* 8407 * Stop doing PMTU if new_mss is less than 68 8408 * or less than tcp_mss_min. 8409 * The value 68 comes from rfc 1191. 8410 */ 8411 if (new_mss < MAX(68, tcp_mss_min)) 8412 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 8413 0; 8414 8415 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 8416 ASSERT(ratio >= 1); 8417 tcp_mss_set(tcp, new_mss); 8418 8419 /* 8420 * Make sure we have something to 8421 * send. 8422 */ 8423 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 8424 (tcp->tcp_xmit_head != NULL)) { 8425 /* 8426 * Shrink tcp_cwnd in 8427 * proportion to the old MSS/new MSS. 8428 */ 8429 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 8430 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 8431 (tcp->tcp_unsent == 0)) { 8432 tcp->tcp_rexmit_max = tcp->tcp_fss; 8433 } else { 8434 tcp->tcp_rexmit_max = tcp->tcp_snxt; 8435 } 8436 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 8437 tcp->tcp_rexmit = B_TRUE; 8438 tcp->tcp_dupack_cnt = 0; 8439 tcp->tcp_snd_burst = TCP_CWND_SS; 8440 tcp_ss_rexmit(tcp); 8441 } 8442 break; 8443 case ICMP_PORT_UNREACHABLE: 8444 case ICMP_PROTOCOL_UNREACHABLE: 8445 switch (tcp->tcp_state) { 8446 case TCPS_SYN_SENT: 8447 case TCPS_SYN_RCVD: 8448 /* 8449 * ICMP can snipe away incipient 8450 * TCP connections as long as 8451 * seq number is same as initial 8452 * send seq number. 8453 */ 8454 if (seg_seq == tcp->tcp_iss) { 8455 (void) tcp_clean_death(tcp, 8456 ECONNREFUSED, 6); 8457 } 8458 break; 8459 } 8460 break; 8461 case ICMP_HOST_UNREACHABLE: 8462 case ICMP_NET_UNREACHABLE: 8463 /* Record the error in case we finally time out. */ 8464 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 8465 tcp->tcp_client_errno = EHOSTUNREACH; 8466 else 8467 tcp->tcp_client_errno = ENETUNREACH; 8468 if (tcp->tcp_state == TCPS_SYN_RCVD) { 8469 if (tcp->tcp_listener != NULL && 8470 tcp->tcp_listener->tcp_syn_defense) { 8471 /* 8472 * Ditch the half-open connection if we 8473 * suspect a SYN attack is under way. 8474 */ 8475 tcp_ip_ire_mark_advice(tcp); 8476 (void) tcp_clean_death(tcp, 8477 tcp->tcp_client_errno, 7); 8478 } 8479 } 8480 break; 8481 default: 8482 break; 8483 } 8484 break; 8485 case ICMP_SOURCE_QUENCH: { 8486 /* 8487 * use a global boolean to control 8488 * whether TCP should respond to ICMP_SOURCE_QUENCH. 8489 * The default is false. 8490 */ 8491 if (tcp_icmp_source_quench) { 8492 /* 8493 * Reduce the sending rate as if we got a 8494 * retransmit timeout 8495 */ 8496 uint32_t npkt; 8497 8498 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 8499 tcp->tcp_mss; 8500 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 8501 tcp->tcp_cwnd = tcp->tcp_mss; 8502 tcp->tcp_cwnd_cnt = 0; 8503 } 8504 break; 8505 } 8506 } 8507 freemsg(first_mp); 8508 } 8509 8510 /* 8511 * tcp_icmp_error_ipv6 is called by tcp_rput_other to process ICMPv6 8512 * error messages passed up by IP. 8513 * Assumes that IP has pulled up all the extension headers as well 8514 * as the ICMPv6 header. 8515 */ 8516 static void 8517 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl) 8518 { 8519 icmp6_t *icmp6; 8520 ip6_t *ip6h; 8521 uint16_t iph_hdr_length; 8522 tcpha_t *tcpha; 8523 uint8_t *nexthdrp; 8524 uint32_t new_mss; 8525 uint32_t ratio; 8526 boolean_t secure; 8527 mblk_t *first_mp = mp; 8528 size_t mp_size; 8529 uint32_t seg_ack; 8530 uint32_t seg_seq; 8531 8532 /* 8533 * The caller has determined if this is an IPSEC_IN packet and 8534 * set ipsec_mctl appropriately (see tcp_icmp_error). 8535 */ 8536 if (ipsec_mctl) 8537 mp = mp->b_cont; 8538 8539 mp_size = MBLKL(mp); 8540 8541 /* 8542 * Verify that we have a complete IP header. If not, send it upstream. 8543 */ 8544 if (mp_size < sizeof (ip6_t)) { 8545 noticmpv6: 8546 freemsg(first_mp); 8547 return; 8548 } 8549 8550 /* 8551 * Verify this is an ICMPV6 packet, else send it upstream. 8552 */ 8553 ip6h = (ip6_t *)mp->b_rptr; 8554 if (ip6h->ip6_nxt == IPPROTO_ICMPV6) { 8555 iph_hdr_length = IPV6_HDR_LEN; 8556 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, 8557 &nexthdrp) || 8558 *nexthdrp != IPPROTO_ICMPV6) { 8559 goto noticmpv6; 8560 } 8561 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 8562 ip6h = (ip6_t *)&icmp6[1]; 8563 /* 8564 * Verify if we have a complete ICMP and inner IP header. 8565 */ 8566 if ((uchar_t *)&ip6h[1] > mp->b_wptr) 8567 goto noticmpv6; 8568 8569 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 8570 goto noticmpv6; 8571 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 8572 /* 8573 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 8574 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 8575 * packet. 8576 */ 8577 if ((*nexthdrp != IPPROTO_TCP) || 8578 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 8579 goto noticmpv6; 8580 } 8581 8582 /* 8583 * ICMP errors come on the right queue or come on 8584 * listener/global queue for detached connections and 8585 * get switched to the right queue. If it comes on the 8586 * right queue, policy check has already been done by IP 8587 * and thus free the first_mp without verifying the policy. 8588 * If it has come for a non-hard bound connection, we need 8589 * to verify policy as IP may not have done it. 8590 */ 8591 if (!tcp->tcp_hard_bound) { 8592 if (ipsec_mctl) { 8593 secure = ipsec_in_is_secure(first_mp); 8594 } else { 8595 secure = B_FALSE; 8596 } 8597 if (secure) { 8598 /* 8599 * If we are willing to accept this in clear 8600 * we don't have to verify policy. 8601 */ 8602 if (!ipsec_inbound_accept_clear(mp, NULL, ip6h)) { 8603 if (!tcp_check_policy(tcp, first_mp, 8604 NULL, ip6h, secure, ipsec_mctl)) { 8605 /* 8606 * tcp_check_policy called 8607 * ip_drop_packet() on failure. 8608 */ 8609 return; 8610 } 8611 } 8612 } 8613 } else if (ipsec_mctl) { 8614 /* 8615 * This is a hard_bound connection. IP has already 8616 * verified policy. We don't have to do it again. 8617 */ 8618 freeb(first_mp); 8619 first_mp = mp; 8620 ipsec_mctl = B_FALSE; 8621 } 8622 8623 seg_ack = ntohl(tcpha->tha_ack); 8624 seg_seq = ntohl(tcpha->tha_seq); 8625 /* 8626 * TCP SHOULD check that the TCP sequence number contained in 8627 * payload of the ICMP error message is within the range 8628 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8629 */ 8630 if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8631 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8632 /* 8633 * If the ICMP message is bogus, should we kill the 8634 * connection, or should we just drop the bogus ICMP 8635 * message? It would probably make more sense to just 8636 * drop the message so that if this one managed to get 8637 * in, the real connection should not suffer. 8638 */ 8639 goto noticmpv6; 8640 } 8641 8642 switch (icmp6->icmp6_type) { 8643 case ICMP6_PACKET_TOO_BIG: 8644 /* 8645 * Reduce the MSS based on the new MTU. This will 8646 * eliminate any fragmentation locally. 8647 * N.B. There may well be some funny side-effects on 8648 * the local send policy and the remote receive policy. 8649 * Pending further research, we provide 8650 * tcp_ignore_path_mtu just in case this proves 8651 * disastrous somewhere. 8652 * 8653 * After updating the MSS, retransmit part of the 8654 * dropped segment using the new mss by calling 8655 * tcp_wput_data(). Need to adjust all those 8656 * params to make sure tcp_wput_data() work properly. 8657 */ 8658 if (tcp_ignore_path_mtu) 8659 break; 8660 8661 /* 8662 * Decrease the MSS by time stamp options 8663 * IP options and IPSEC options. tcp_hdr_len 8664 * includes time stamp option and IP option 8665 * length. 8666 */ 8667 new_mss = ntohs(icmp6->icmp6_mtu) - tcp->tcp_hdr_len - 8668 tcp->tcp_ipsec_overhead; 8669 8670 /* 8671 * Only update the MSS if the new one is 8672 * smaller than the previous one. This is 8673 * to avoid problems when getting multiple 8674 * ICMP errors for the same MTU. 8675 */ 8676 if (new_mss >= tcp->tcp_mss) 8677 break; 8678 8679 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 8680 ASSERT(ratio >= 1); 8681 tcp_mss_set(tcp, new_mss); 8682 8683 /* 8684 * Make sure we have something to 8685 * send. 8686 */ 8687 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 8688 (tcp->tcp_xmit_head != NULL)) { 8689 /* 8690 * Shrink tcp_cwnd in 8691 * proportion to the old MSS/new MSS. 8692 */ 8693 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 8694 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 8695 (tcp->tcp_unsent == 0)) { 8696 tcp->tcp_rexmit_max = tcp->tcp_fss; 8697 } else { 8698 tcp->tcp_rexmit_max = tcp->tcp_snxt; 8699 } 8700 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 8701 tcp->tcp_rexmit = B_TRUE; 8702 tcp->tcp_dupack_cnt = 0; 8703 tcp->tcp_snd_burst = TCP_CWND_SS; 8704 tcp_ss_rexmit(tcp); 8705 } 8706 break; 8707 8708 case ICMP6_DST_UNREACH: 8709 switch (icmp6->icmp6_code) { 8710 case ICMP6_DST_UNREACH_NOPORT: 8711 if (((tcp->tcp_state == TCPS_SYN_SENT) || 8712 (tcp->tcp_state == TCPS_SYN_RCVD)) && 8713 (seg_seq == tcp->tcp_iss)) { 8714 (void) tcp_clean_death(tcp, 8715 ECONNREFUSED, 8); 8716 } 8717 break; 8718 8719 case ICMP6_DST_UNREACH_ADMIN: 8720 case ICMP6_DST_UNREACH_NOROUTE: 8721 case ICMP6_DST_UNREACH_BEYONDSCOPE: 8722 case ICMP6_DST_UNREACH_ADDR: 8723 /* Record the error in case we finally time out. */ 8724 tcp->tcp_client_errno = EHOSTUNREACH; 8725 if (((tcp->tcp_state == TCPS_SYN_SENT) || 8726 (tcp->tcp_state == TCPS_SYN_RCVD)) && 8727 (seg_seq == tcp->tcp_iss)) { 8728 if (tcp->tcp_listener != NULL && 8729 tcp->tcp_listener->tcp_syn_defense) { 8730 /* 8731 * Ditch the half-open connection if we 8732 * suspect a SYN attack is under way. 8733 */ 8734 tcp_ip_ire_mark_advice(tcp); 8735 (void) tcp_clean_death(tcp, 8736 tcp->tcp_client_errno, 9); 8737 } 8738 } 8739 8740 8741 break; 8742 default: 8743 break; 8744 } 8745 break; 8746 8747 case ICMP6_PARAM_PROB: 8748 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 8749 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 8750 (uchar_t *)ip6h + icmp6->icmp6_pptr == 8751 (uchar_t *)nexthdrp) { 8752 if (tcp->tcp_state == TCPS_SYN_SENT || 8753 tcp->tcp_state == TCPS_SYN_RCVD) { 8754 (void) tcp_clean_death(tcp, 8755 ECONNREFUSED, 10); 8756 } 8757 break; 8758 } 8759 break; 8760 8761 case ICMP6_TIME_EXCEEDED: 8762 default: 8763 break; 8764 } 8765 freemsg(first_mp); 8766 } 8767 8768 /* 8769 * IP recognizes seven kinds of bind requests: 8770 * 8771 * - A zero-length address binds only to the protocol number. 8772 * 8773 * - A 4-byte address is treated as a request to 8774 * validate that the address is a valid local IPv4 8775 * address, appropriate for an application to bind to. 8776 * IP does the verification, but does not make any note 8777 * of the address at this time. 8778 * 8779 * - A 16-byte address contains is treated as a request 8780 * to validate a local IPv6 address, as the 4-byte 8781 * address case above. 8782 * 8783 * - A 16-byte sockaddr_in to validate the local IPv4 address and also 8784 * use it for the inbound fanout of packets. 8785 * 8786 * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also 8787 * use it for the inbound fanout of packets. 8788 * 8789 * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout 8790 * information consisting of local and remote addresses 8791 * and ports. In this case, the addresses are both 8792 * validated as appropriate for this operation, and, if 8793 * so, the information is retained for use in the 8794 * inbound fanout. 8795 * 8796 * - A 36-byte address address (ipa6_conn_t) containing complete IPv6 8797 * fanout information, like the 12-byte case above. 8798 * 8799 * IP will also fill in the IRE request mblk with information 8800 * regarding our peer. In all cases, we notify IP of our protocol 8801 * type by appending a single protocol byte to the bind request. 8802 */ 8803 static mblk_t * 8804 tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length) 8805 { 8806 char *cp; 8807 mblk_t *mp; 8808 struct T_bind_req *tbr; 8809 ipa_conn_t *ac; 8810 ipa6_conn_t *ac6; 8811 sin_t *sin; 8812 sin6_t *sin6; 8813 8814 ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ); 8815 ASSERT((tcp->tcp_family == AF_INET && 8816 tcp->tcp_ipversion == IPV4_VERSION) || 8817 (tcp->tcp_family == AF_INET6 && 8818 (tcp->tcp_ipversion == IPV4_VERSION || 8819 tcp->tcp_ipversion == IPV6_VERSION))); 8820 8821 mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI); 8822 if (!mp) 8823 return (mp); 8824 mp->b_datap->db_type = M_PROTO; 8825 tbr = (struct T_bind_req *)mp->b_rptr; 8826 tbr->PRIM_type = bind_prim; 8827 tbr->ADDR_offset = sizeof (*tbr); 8828 tbr->CONIND_number = 0; 8829 tbr->ADDR_length = addr_length; 8830 cp = (char *)&tbr[1]; 8831 switch (addr_length) { 8832 case sizeof (ipa_conn_t): 8833 ASSERT(tcp->tcp_family == AF_INET); 8834 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 8835 8836 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 8837 if (mp->b_cont == NULL) { 8838 freemsg(mp); 8839 return (NULL); 8840 } 8841 mp->b_cont->b_wptr += sizeof (ire_t); 8842 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 8843 8844 /* cp known to be 32 bit aligned */ 8845 ac = (ipa_conn_t *)cp; 8846 ac->ac_laddr = tcp->tcp_ipha->ipha_src; 8847 ac->ac_faddr = tcp->tcp_remote; 8848 ac->ac_fport = tcp->tcp_fport; 8849 ac->ac_lport = tcp->tcp_lport; 8850 tcp->tcp_hard_binding = 1; 8851 break; 8852 8853 case sizeof (ipa6_conn_t): 8854 ASSERT(tcp->tcp_family == AF_INET6); 8855 8856 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 8857 if (mp->b_cont == NULL) { 8858 freemsg(mp); 8859 return (NULL); 8860 } 8861 mp->b_cont->b_wptr += sizeof (ire_t); 8862 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 8863 8864 /* cp known to be 32 bit aligned */ 8865 ac6 = (ipa6_conn_t *)cp; 8866 if (tcp->tcp_ipversion == IPV4_VERSION) { 8867 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 8868 &ac6->ac6_laddr); 8869 } else { 8870 ac6->ac6_laddr = tcp->tcp_ip6h->ip6_src; 8871 } 8872 ac6->ac6_faddr = tcp->tcp_remote_v6; 8873 ac6->ac6_fport = tcp->tcp_fport; 8874 ac6->ac6_lport = tcp->tcp_lport; 8875 tcp->tcp_hard_binding = 1; 8876 break; 8877 8878 case sizeof (sin_t): 8879 /* 8880 * NOTE: IPV6_ADDR_LEN also has same size. 8881 * Use family to discriminate. 8882 */ 8883 if (tcp->tcp_family == AF_INET) { 8884 sin = (sin_t *)cp; 8885 8886 *sin = sin_null; 8887 sin->sin_family = AF_INET; 8888 sin->sin_addr.s_addr = tcp->tcp_bound_source; 8889 sin->sin_port = tcp->tcp_lport; 8890 break; 8891 } else { 8892 *(in6_addr_t *)cp = tcp->tcp_bound_source_v6; 8893 } 8894 break; 8895 8896 case sizeof (sin6_t): 8897 ASSERT(tcp->tcp_family == AF_INET6); 8898 sin6 = (sin6_t *)cp; 8899 8900 *sin6 = sin6_null; 8901 sin6->sin6_family = AF_INET6; 8902 sin6->sin6_addr = tcp->tcp_bound_source_v6; 8903 sin6->sin6_port = tcp->tcp_lport; 8904 break; 8905 8906 case IP_ADDR_LEN: 8907 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 8908 *(uint32_t *)cp = tcp->tcp_ipha->ipha_src; 8909 break; 8910 8911 } 8912 /* Add protocol number to end */ 8913 cp[addr_length] = (char)IPPROTO_TCP; 8914 mp->b_wptr = (uchar_t *)&cp[addr_length + 1]; 8915 return (mp); 8916 } 8917 8918 /* 8919 * Notify IP that we are having trouble with this connection. IP should 8920 * blow the IRE away and start over. 8921 */ 8922 static void 8923 tcp_ip_notify(tcp_t *tcp) 8924 { 8925 struct iocblk *iocp; 8926 ipid_t *ipid; 8927 mblk_t *mp; 8928 8929 /* IPv6 has NUD thus notification to delete the IRE is not needed */ 8930 if (tcp->tcp_ipversion == IPV6_VERSION) 8931 return; 8932 8933 mp = mkiocb(IP_IOCTL); 8934 if (mp == NULL) 8935 return; 8936 8937 iocp = (struct iocblk *)mp->b_rptr; 8938 iocp->ioc_count = sizeof (ipid_t) + sizeof (tcp->tcp_ipha->ipha_dst); 8939 8940 mp->b_cont = allocb(iocp->ioc_count, BPRI_HI); 8941 if (!mp->b_cont) { 8942 freeb(mp); 8943 return; 8944 } 8945 8946 ipid = (ipid_t *)mp->b_cont->b_rptr; 8947 mp->b_cont->b_wptr += iocp->ioc_count; 8948 bzero(ipid, sizeof (*ipid)); 8949 ipid->ipid_cmd = IP_IOC_IRE_DELETE_NO_REPLY; 8950 ipid->ipid_ire_type = IRE_CACHE; 8951 ipid->ipid_addr_offset = sizeof (ipid_t); 8952 ipid->ipid_addr_length = sizeof (tcp->tcp_ipha->ipha_dst); 8953 /* 8954 * Note: in the case of source routing we want to blow away the 8955 * route to the first source route hop. 8956 */ 8957 bcopy(&tcp->tcp_ipha->ipha_dst, &ipid[1], 8958 sizeof (tcp->tcp_ipha->ipha_dst)); 8959 8960 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 8961 } 8962 8963 /* Unlink and return any mblk that looks like it contains an ire */ 8964 static mblk_t * 8965 tcp_ire_mp(mblk_t *mp) 8966 { 8967 mblk_t *prev_mp; 8968 8969 for (;;) { 8970 prev_mp = mp; 8971 mp = mp->b_cont; 8972 if (mp == NULL) 8973 break; 8974 switch (DB_TYPE(mp)) { 8975 case IRE_DB_TYPE: 8976 case IRE_DB_REQ_TYPE: 8977 if (prev_mp != NULL) 8978 prev_mp->b_cont = mp->b_cont; 8979 mp->b_cont = NULL; 8980 return (mp); 8981 default: 8982 break; 8983 } 8984 } 8985 return (mp); 8986 } 8987 8988 /* 8989 * Timer callback routine for keepalive probe. We do a fake resend of 8990 * last ACKed byte. Then set a timer using RTO. When the timer expires, 8991 * check to see if we have heard anything from the other end for the last 8992 * RTO period. If we have, set the timer to expire for another 8993 * tcp_keepalive_intrvl and check again. If we have not, set a timer using 8994 * RTO << 1 and check again when it expires. Keep exponentially increasing 8995 * the timeout if we have not heard from the other side. If for more than 8996 * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything, 8997 * kill the connection unless the keepalive abort threshold is 0. In 8998 * that case, we will probe "forever." 8999 */ 9000 static void 9001 tcp_keepalive_killer(void *arg) 9002 { 9003 mblk_t *mp; 9004 conn_t *connp = (conn_t *)arg; 9005 tcp_t *tcp = connp->conn_tcp; 9006 int32_t firetime; 9007 int32_t idletime; 9008 int32_t ka_intrvl; 9009 9010 tcp->tcp_ka_tid = 0; 9011 9012 if (tcp->tcp_fused) 9013 return; 9014 9015 BUMP_MIB(&tcp_mib, tcpTimKeepalive); 9016 ka_intrvl = tcp->tcp_ka_interval; 9017 9018 /* 9019 * Keepalive probe should only be sent if the application has not 9020 * done a close on the connection. 9021 */ 9022 if (tcp->tcp_state > TCPS_CLOSE_WAIT) { 9023 return; 9024 } 9025 /* Timer fired too early, restart it. */ 9026 if (tcp->tcp_state < TCPS_ESTABLISHED) { 9027 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9028 MSEC_TO_TICK(ka_intrvl)); 9029 return; 9030 } 9031 9032 idletime = TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time); 9033 /* 9034 * If we have not heard from the other side for a long 9035 * time, kill the connection unless the keepalive abort 9036 * threshold is 0. In that case, we will probe "forever." 9037 */ 9038 if (tcp->tcp_ka_abort_thres != 0 && 9039 idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) { 9040 BUMP_MIB(&tcp_mib, tcpTimKeepaliveDrop); 9041 (void) tcp_clean_death(tcp, tcp->tcp_client_errno ? 9042 tcp->tcp_client_errno : ETIMEDOUT, 11); 9043 return; 9044 } 9045 9046 if (tcp->tcp_snxt == tcp->tcp_suna && 9047 idletime >= ka_intrvl) { 9048 /* Fake resend of last ACKed byte. */ 9049 mblk_t *mp1 = allocb(1, BPRI_LO); 9050 9051 if (mp1 != NULL) { 9052 *mp1->b_wptr++ = '\0'; 9053 mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL, 9054 tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE); 9055 freeb(mp1); 9056 /* 9057 * if allocation failed, fall through to start the 9058 * timer back. 9059 */ 9060 if (mp != NULL) { 9061 TCP_RECORD_TRACE(tcp, mp, 9062 TCP_TRACE_SEND_PKT); 9063 tcp_send_data(tcp, tcp->tcp_wq, mp); 9064 BUMP_MIB(&tcp_mib, tcpTimKeepaliveProbe); 9065 if (tcp->tcp_ka_last_intrvl != 0) { 9066 /* 9067 * We should probe again at least 9068 * in ka_intrvl, but not more than 9069 * tcp_rexmit_interval_max. 9070 */ 9071 firetime = MIN(ka_intrvl - 1, 9072 tcp->tcp_ka_last_intrvl << 1); 9073 if (firetime > tcp_rexmit_interval_max) 9074 firetime = 9075 tcp_rexmit_interval_max; 9076 } else { 9077 firetime = tcp->tcp_rto; 9078 } 9079 tcp->tcp_ka_tid = TCP_TIMER(tcp, 9080 tcp_keepalive_killer, 9081 MSEC_TO_TICK(firetime)); 9082 tcp->tcp_ka_last_intrvl = firetime; 9083 return; 9084 } 9085 } 9086 } else { 9087 tcp->tcp_ka_last_intrvl = 0; 9088 } 9089 9090 /* firetime can be negative if (mp1 == NULL || mp == NULL) */ 9091 if ((firetime = ka_intrvl - idletime) < 0) { 9092 firetime = ka_intrvl; 9093 } 9094 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9095 MSEC_TO_TICK(firetime)); 9096 } 9097 9098 int 9099 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 9100 { 9101 queue_t *q = tcp->tcp_rq; 9102 int32_t mss = tcp->tcp_mss; 9103 int maxpsz; 9104 9105 if (TCP_IS_DETACHED(tcp)) 9106 return (mss); 9107 9108 if (tcp->tcp_fused) { 9109 maxpsz = tcp_fuse_maxpsz_set(tcp); 9110 mss = INFPSZ; 9111 } else if (tcp->tcp_mdt || tcp->tcp_maxpsz == 0) { 9112 /* 9113 * Set the sd_qn_maxpsz according to the socket send buffer 9114 * size, and sd_maxblk to INFPSZ (-1). This will essentially 9115 * instruct the stream head to copyin user data into contiguous 9116 * kernel-allocated buffers without breaking it up into smaller 9117 * chunks. We round up the buffer size to the nearest SMSS. 9118 */ 9119 maxpsz = MSS_ROUNDUP(tcp->tcp_xmit_hiwater, mss); 9120 if (tcp->tcp_kssl_ctx == NULL) 9121 mss = INFPSZ; 9122 else 9123 mss = SSL3_MAX_RECORD_LEN; 9124 } else { 9125 /* 9126 * Set sd_qn_maxpsz to approx half the (receivers) buffer 9127 * (and a multiple of the mss). This instructs the stream 9128 * head to break down larger than SMSS writes into SMSS- 9129 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 9130 */ 9131 maxpsz = tcp->tcp_maxpsz * mss; 9132 if (maxpsz > tcp->tcp_xmit_hiwater/2) { 9133 maxpsz = tcp->tcp_xmit_hiwater/2; 9134 /* Round up to nearest mss */ 9135 maxpsz = MSS_ROUNDUP(maxpsz, mss); 9136 } 9137 } 9138 (void) setmaxps(q, maxpsz); 9139 tcp->tcp_wq->q_maxpsz = maxpsz; 9140 9141 if (set_maxblk) 9142 (void) mi_set_sth_maxblk(q, mss); 9143 9144 return (mss); 9145 } 9146 9147 /* 9148 * Extract option values from a tcp header. We put any found values into the 9149 * tcpopt struct and return a bitmask saying which options were found. 9150 */ 9151 static int 9152 tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt) 9153 { 9154 uchar_t *endp; 9155 int len; 9156 uint32_t mss; 9157 uchar_t *up = (uchar_t *)tcph; 9158 int found = 0; 9159 int32_t sack_len; 9160 tcp_seq sack_begin, sack_end; 9161 tcp_t *tcp; 9162 9163 endp = up + TCP_HDR_LENGTH(tcph); 9164 up += TCP_MIN_HEADER_LENGTH; 9165 while (up < endp) { 9166 len = endp - up; 9167 switch (*up) { 9168 case TCPOPT_EOL: 9169 break; 9170 9171 case TCPOPT_NOP: 9172 up++; 9173 continue; 9174 9175 case TCPOPT_MAXSEG: 9176 if (len < TCPOPT_MAXSEG_LEN || 9177 up[1] != TCPOPT_MAXSEG_LEN) 9178 break; 9179 9180 mss = BE16_TO_U16(up+2); 9181 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 9182 tcpopt->tcp_opt_mss = mss; 9183 found |= TCP_OPT_MSS_PRESENT; 9184 9185 up += TCPOPT_MAXSEG_LEN; 9186 continue; 9187 9188 case TCPOPT_WSCALE: 9189 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 9190 break; 9191 9192 if (up[2] > TCP_MAX_WINSHIFT) 9193 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 9194 else 9195 tcpopt->tcp_opt_wscale = up[2]; 9196 found |= TCP_OPT_WSCALE_PRESENT; 9197 9198 up += TCPOPT_WS_LEN; 9199 continue; 9200 9201 case TCPOPT_SACK_PERMITTED: 9202 if (len < TCPOPT_SACK_OK_LEN || 9203 up[1] != TCPOPT_SACK_OK_LEN) 9204 break; 9205 found |= TCP_OPT_SACK_OK_PRESENT; 9206 up += TCPOPT_SACK_OK_LEN; 9207 continue; 9208 9209 case TCPOPT_SACK: 9210 if (len <= 2 || up[1] <= 2 || len < up[1]) 9211 break; 9212 9213 /* If TCP is not interested in SACK blks... */ 9214 if ((tcp = tcpopt->tcp) == NULL) { 9215 up += up[1]; 9216 continue; 9217 } 9218 sack_len = up[1] - TCPOPT_HEADER_LEN; 9219 up += TCPOPT_HEADER_LEN; 9220 9221 /* 9222 * If the list is empty, allocate one and assume 9223 * nothing is sack'ed. 9224 */ 9225 ASSERT(tcp->tcp_sack_info != NULL); 9226 if (tcp->tcp_notsack_list == NULL) { 9227 tcp_notsack_update(&(tcp->tcp_notsack_list), 9228 tcp->tcp_suna, tcp->tcp_snxt, 9229 &(tcp->tcp_num_notsack_blk), 9230 &(tcp->tcp_cnt_notsack_list)); 9231 9232 /* 9233 * Make sure tcp_notsack_list is not NULL. 9234 * This happens when kmem_alloc(KM_NOSLEEP) 9235 * returns NULL. 9236 */ 9237 if (tcp->tcp_notsack_list == NULL) { 9238 up += sack_len; 9239 continue; 9240 } 9241 tcp->tcp_fack = tcp->tcp_suna; 9242 } 9243 9244 while (sack_len > 0) { 9245 if (up + 8 > endp) { 9246 up = endp; 9247 break; 9248 } 9249 sack_begin = BE32_TO_U32(up); 9250 up += 4; 9251 sack_end = BE32_TO_U32(up); 9252 up += 4; 9253 sack_len -= 8; 9254 /* 9255 * Bounds checking. Make sure the SACK 9256 * info is within tcp_suna and tcp_snxt. 9257 * If this SACK blk is out of bound, ignore 9258 * it but continue to parse the following 9259 * blks. 9260 */ 9261 if (SEQ_LEQ(sack_end, sack_begin) || 9262 SEQ_LT(sack_begin, tcp->tcp_suna) || 9263 SEQ_GT(sack_end, tcp->tcp_snxt)) { 9264 continue; 9265 } 9266 tcp_notsack_insert(&(tcp->tcp_notsack_list), 9267 sack_begin, sack_end, 9268 &(tcp->tcp_num_notsack_blk), 9269 &(tcp->tcp_cnt_notsack_list)); 9270 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 9271 tcp->tcp_fack = sack_end; 9272 } 9273 } 9274 found |= TCP_OPT_SACK_PRESENT; 9275 continue; 9276 9277 case TCPOPT_TSTAMP: 9278 if (len < TCPOPT_TSTAMP_LEN || 9279 up[1] != TCPOPT_TSTAMP_LEN) 9280 break; 9281 9282 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 9283 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 9284 9285 found |= TCP_OPT_TSTAMP_PRESENT; 9286 9287 up += TCPOPT_TSTAMP_LEN; 9288 continue; 9289 9290 default: 9291 if (len <= 1 || len < (int)up[1] || up[1] == 0) 9292 break; 9293 up += up[1]; 9294 continue; 9295 } 9296 break; 9297 } 9298 return (found); 9299 } 9300 9301 /* 9302 * Set the mss associated with a particular tcp based on its current value, 9303 * and a new one passed in. Observe minimums and maximums, and reset 9304 * other state variables that we want to view as multiples of mss. 9305 * 9306 * This function is called in various places mainly because 9307 * 1) Various stuffs, tcp_mss, tcp_cwnd, ... need to be adjusted when the 9308 * other side's SYN/SYN-ACK packet arrives. 9309 * 2) PMTUd may get us a new MSS. 9310 * 3) If the other side stops sending us timestamp option, we need to 9311 * increase the MSS size to use the extra bytes available. 9312 */ 9313 static void 9314 tcp_mss_set(tcp_t *tcp, uint32_t mss) 9315 { 9316 uint32_t mss_max; 9317 9318 if (tcp->tcp_ipversion == IPV4_VERSION) 9319 mss_max = tcp_mss_max_ipv4; 9320 else 9321 mss_max = tcp_mss_max_ipv6; 9322 9323 if (mss < tcp_mss_min) 9324 mss = tcp_mss_min; 9325 if (mss > mss_max) 9326 mss = mss_max; 9327 /* 9328 * Unless naglim has been set by our client to 9329 * a non-mss value, force naglim to track mss. 9330 * This can help to aggregate small writes. 9331 */ 9332 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 9333 tcp->tcp_naglim = mss; 9334 /* 9335 * TCP should be able to buffer at least 4 MSS data for obvious 9336 * performance reason. 9337 */ 9338 if ((mss << 2) > tcp->tcp_xmit_hiwater) 9339 tcp->tcp_xmit_hiwater = mss << 2; 9340 9341 /* 9342 * Check if we need to apply the tcp_init_cwnd here. If 9343 * it is set and the MSS gets bigger (should not happen 9344 * normally), we need to adjust the resulting tcp_cwnd properly. 9345 * The new tcp_cwnd should not get bigger. 9346 */ 9347 if (tcp->tcp_init_cwnd == 0) { 9348 tcp->tcp_cwnd = MIN(tcp_slow_start_initial * mss, 9349 MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss))); 9350 } else { 9351 if (tcp->tcp_mss < mss) { 9352 tcp->tcp_cwnd = MAX(1, 9353 (tcp->tcp_init_cwnd * tcp->tcp_mss / mss)) * mss; 9354 } else { 9355 tcp->tcp_cwnd = tcp->tcp_init_cwnd * mss; 9356 } 9357 } 9358 tcp->tcp_mss = mss; 9359 tcp->tcp_cwnd_cnt = 0; 9360 (void) tcp_maxpsz_set(tcp, B_TRUE); 9361 } 9362 9363 static int 9364 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 9365 { 9366 tcp_t *tcp = NULL; 9367 conn_t *connp; 9368 int err; 9369 dev_t conn_dev; 9370 zoneid_t zoneid = getzoneid(); 9371 9372 /* 9373 * Special case for install: miniroot needs to be able to access files 9374 * via NFS as though it were always in the global zone. 9375 */ 9376 if (credp == kcred && nfs_global_client_only != 0) 9377 zoneid = GLOBAL_ZONEID; 9378 9379 if (q->q_ptr != NULL) 9380 return (0); 9381 9382 if (sflag == MODOPEN) { 9383 /* 9384 * This is a special case. The purpose of a modopen 9385 * is to allow just the T_SVR4_OPTMGMT_REQ to pass 9386 * through for MIB browsers. Everything else is failed. 9387 */ 9388 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9389 9390 if (connp == NULL) 9391 return (ENOMEM); 9392 9393 connp->conn_flags |= IPCL_TCPMOD; 9394 connp->conn_cred = credp; 9395 connp->conn_zoneid = zoneid; 9396 q->q_ptr = WR(q)->q_ptr = connp; 9397 crhold(credp); 9398 q->q_qinfo = &tcp_mod_rinit; 9399 WR(q)->q_qinfo = &tcp_mod_winit; 9400 qprocson(q); 9401 return (0); 9402 } 9403 9404 if ((conn_dev = inet_minor_alloc(ip_minor_arena)) == 0) 9405 return (EBUSY); 9406 9407 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 9408 9409 if (flag & SO_ACCEPTOR) { 9410 q->q_qinfo = &tcp_acceptor_rinit; 9411 q->q_ptr = (void *)conn_dev; 9412 WR(q)->q_qinfo = &tcp_acceptor_winit; 9413 WR(q)->q_ptr = (void *)conn_dev; 9414 qprocson(q); 9415 return (0); 9416 } 9417 9418 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9419 if (connp == NULL) { 9420 inet_minor_free(ip_minor_arena, conn_dev); 9421 q->q_ptr = NULL; 9422 return (ENOSR); 9423 } 9424 connp->conn_sqp = IP_SQUEUE_GET(lbolt); 9425 tcp = connp->conn_tcp; 9426 9427 q->q_ptr = WR(q)->q_ptr = connp; 9428 if (getmajor(*devp) == TCP6_MAJ) { 9429 connp->conn_flags |= (IPCL_TCP6|IPCL_ISV6); 9430 connp->conn_send = ip_output_v6; 9431 connp->conn_af_isv6 = B_TRUE; 9432 connp->conn_pkt_isv6 = B_TRUE; 9433 connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT; 9434 tcp->tcp_ipversion = IPV6_VERSION; 9435 tcp->tcp_family = AF_INET6; 9436 tcp->tcp_mss = tcp_mss_def_ipv6; 9437 } else { 9438 connp->conn_flags |= IPCL_TCP4; 9439 connp->conn_send = ip_output; 9440 connp->conn_af_isv6 = B_FALSE; 9441 connp->conn_pkt_isv6 = B_FALSE; 9442 tcp->tcp_ipversion = IPV4_VERSION; 9443 tcp->tcp_family = AF_INET; 9444 tcp->tcp_mss = tcp_mss_def_ipv4; 9445 } 9446 9447 /* 9448 * TCP keeps a copy of cred for cache locality reasons but 9449 * we put a reference only once. If connp->conn_cred 9450 * becomes invalid, tcp_cred should also be set to NULL. 9451 */ 9452 tcp->tcp_cred = connp->conn_cred = credp; 9453 crhold(connp->conn_cred); 9454 tcp->tcp_cpid = curproc->p_pid; 9455 connp->conn_zoneid = zoneid; 9456 connp->conn_mlp_type = mlptSingle; 9457 connp->conn_ulp_labeled = !is_system_labeled(); 9458 9459 /* 9460 * If the caller has the process-wide flag set, then default to MAC 9461 * exempt mode. This allows read-down to unlabeled hosts. 9462 */ 9463 if (getpflags(NET_MAC_AWARE, credp) != 0) 9464 connp->conn_mac_exempt = B_TRUE; 9465 9466 connp->conn_dev = conn_dev; 9467 9468 ASSERT(q->q_qinfo == &tcp_rinit); 9469 ASSERT(WR(q)->q_qinfo == &tcp_winit); 9470 9471 if (flag & SO_SOCKSTR) { 9472 /* 9473 * No need to insert a socket in tcp acceptor hash. 9474 * If it was a socket acceptor stream, we dealt with 9475 * it above. A socket listener can never accept a 9476 * connection and doesn't need acceptor_id. 9477 */ 9478 connp->conn_flags |= IPCL_SOCKET; 9479 tcp->tcp_issocket = 1; 9480 WR(q)->q_qinfo = &tcp_sock_winit; 9481 } else { 9482 #ifdef _ILP32 9483 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 9484 #else 9485 tcp->tcp_acceptor_id = conn_dev; 9486 #endif /* _ILP32 */ 9487 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 9488 } 9489 9490 if (tcp_trace) 9491 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_SLEEP); 9492 9493 err = tcp_init(tcp, q); 9494 if (err != 0) { 9495 inet_minor_free(ip_minor_arena, connp->conn_dev); 9496 tcp_acceptor_hash_remove(tcp); 9497 CONN_DEC_REF(connp); 9498 q->q_ptr = WR(q)->q_ptr = NULL; 9499 return (err); 9500 } 9501 9502 RD(q)->q_hiwat = tcp_recv_hiwat; 9503 tcp->tcp_rwnd = tcp_recv_hiwat; 9504 9505 /* Non-zero default values */ 9506 connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 9507 /* 9508 * Put the ref for TCP. Ref for IP was already put 9509 * by ipcl_conn_create. Also Make the conn_t globally 9510 * visible to walkers 9511 */ 9512 mutex_enter(&connp->conn_lock); 9513 CONN_INC_REF_LOCKED(connp); 9514 ASSERT(connp->conn_ref == 2); 9515 connp->conn_state_flags &= ~CONN_INCIPIENT; 9516 mutex_exit(&connp->conn_lock); 9517 9518 qprocson(q); 9519 return (0); 9520 } 9521 9522 /* 9523 * Some TCP options can be "set" by requesting them in the option 9524 * buffer. This is needed for XTI feature test though we do not 9525 * allow it in general. We interpret that this mechanism is more 9526 * applicable to OSI protocols and need not be allowed in general. 9527 * This routine filters out options for which it is not allowed (most) 9528 * and lets through those (few) for which it is. [ The XTI interface 9529 * test suite specifics will imply that any XTI_GENERIC level XTI_* if 9530 * ever implemented will have to be allowed here ]. 9531 */ 9532 static boolean_t 9533 tcp_allow_connopt_set(int level, int name) 9534 { 9535 9536 switch (level) { 9537 case IPPROTO_TCP: 9538 switch (name) { 9539 case TCP_NODELAY: 9540 return (B_TRUE); 9541 default: 9542 return (B_FALSE); 9543 } 9544 /*NOTREACHED*/ 9545 default: 9546 return (B_FALSE); 9547 } 9548 /*NOTREACHED*/ 9549 } 9550 9551 /* 9552 * This routine gets default values of certain options whose default 9553 * values are maintained by protocol specific code 9554 */ 9555 /* ARGSUSED */ 9556 int 9557 tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr) 9558 { 9559 int32_t *i1 = (int32_t *)ptr; 9560 9561 switch (level) { 9562 case IPPROTO_TCP: 9563 switch (name) { 9564 case TCP_NOTIFY_THRESHOLD: 9565 *i1 = tcp_ip_notify_interval; 9566 break; 9567 case TCP_ABORT_THRESHOLD: 9568 *i1 = tcp_ip_abort_interval; 9569 break; 9570 case TCP_CONN_NOTIFY_THRESHOLD: 9571 *i1 = tcp_ip_notify_cinterval; 9572 break; 9573 case TCP_CONN_ABORT_THRESHOLD: 9574 *i1 = tcp_ip_abort_cinterval; 9575 break; 9576 default: 9577 return (-1); 9578 } 9579 break; 9580 case IPPROTO_IP: 9581 switch (name) { 9582 case IP_TTL: 9583 *i1 = tcp_ipv4_ttl; 9584 break; 9585 default: 9586 return (-1); 9587 } 9588 break; 9589 case IPPROTO_IPV6: 9590 switch (name) { 9591 case IPV6_UNICAST_HOPS: 9592 *i1 = tcp_ipv6_hoplimit; 9593 break; 9594 default: 9595 return (-1); 9596 } 9597 break; 9598 default: 9599 return (-1); 9600 } 9601 return (sizeof (int)); 9602 } 9603 9604 9605 /* 9606 * TCP routine to get the values of options. 9607 */ 9608 int 9609 tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 9610 { 9611 int *i1 = (int *)ptr; 9612 conn_t *connp = Q_TO_CONN(q); 9613 tcp_t *tcp = connp->conn_tcp; 9614 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 9615 9616 switch (level) { 9617 case SOL_SOCKET: 9618 switch (name) { 9619 case SO_LINGER: { 9620 struct linger *lgr = (struct linger *)ptr; 9621 9622 lgr->l_onoff = tcp->tcp_linger ? SO_LINGER : 0; 9623 lgr->l_linger = tcp->tcp_lingertime; 9624 } 9625 return (sizeof (struct linger)); 9626 case SO_DEBUG: 9627 *i1 = tcp->tcp_debug ? SO_DEBUG : 0; 9628 break; 9629 case SO_KEEPALIVE: 9630 *i1 = tcp->tcp_ka_enabled ? SO_KEEPALIVE : 0; 9631 break; 9632 case SO_DONTROUTE: 9633 *i1 = tcp->tcp_dontroute ? SO_DONTROUTE : 0; 9634 break; 9635 case SO_USELOOPBACK: 9636 *i1 = tcp->tcp_useloopback ? SO_USELOOPBACK : 0; 9637 break; 9638 case SO_BROADCAST: 9639 *i1 = tcp->tcp_broadcast ? SO_BROADCAST : 0; 9640 break; 9641 case SO_REUSEADDR: 9642 *i1 = tcp->tcp_reuseaddr ? SO_REUSEADDR : 0; 9643 break; 9644 case SO_OOBINLINE: 9645 *i1 = tcp->tcp_oobinline ? SO_OOBINLINE : 0; 9646 break; 9647 case SO_DGRAM_ERRIND: 9648 *i1 = tcp->tcp_dgram_errind ? SO_DGRAM_ERRIND : 0; 9649 break; 9650 case SO_TYPE: 9651 *i1 = SOCK_STREAM; 9652 break; 9653 case SO_SNDBUF: 9654 *i1 = tcp->tcp_xmit_hiwater; 9655 break; 9656 case SO_RCVBUF: 9657 *i1 = RD(q)->q_hiwat; 9658 break; 9659 case SO_SND_COPYAVOID: 9660 *i1 = tcp->tcp_snd_zcopy_on ? 9661 SO_SND_COPYAVOID : 0; 9662 break; 9663 case SO_ALLZONES: 9664 *i1 = connp->conn_allzones ? 1 : 0; 9665 break; 9666 case SO_ANON_MLP: 9667 *i1 = connp->conn_anon_mlp; 9668 break; 9669 case SO_MAC_EXEMPT: 9670 *i1 = connp->conn_mac_exempt; 9671 break; 9672 case SO_EXCLBIND: 9673 *i1 = tcp->tcp_exclbind ? SO_EXCLBIND : 0; 9674 break; 9675 default: 9676 return (-1); 9677 } 9678 break; 9679 case IPPROTO_TCP: 9680 switch (name) { 9681 case TCP_NODELAY: 9682 *i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0; 9683 break; 9684 case TCP_MAXSEG: 9685 *i1 = tcp->tcp_mss; 9686 break; 9687 case TCP_NOTIFY_THRESHOLD: 9688 *i1 = (int)tcp->tcp_first_timer_threshold; 9689 break; 9690 case TCP_ABORT_THRESHOLD: 9691 *i1 = tcp->tcp_second_timer_threshold; 9692 break; 9693 case TCP_CONN_NOTIFY_THRESHOLD: 9694 *i1 = tcp->tcp_first_ctimer_threshold; 9695 break; 9696 case TCP_CONN_ABORT_THRESHOLD: 9697 *i1 = tcp->tcp_second_ctimer_threshold; 9698 break; 9699 case TCP_RECVDSTADDR: 9700 *i1 = tcp->tcp_recvdstaddr; 9701 break; 9702 case TCP_ANONPRIVBIND: 9703 *i1 = tcp->tcp_anon_priv_bind; 9704 break; 9705 case TCP_EXCLBIND: 9706 *i1 = tcp->tcp_exclbind ? TCP_EXCLBIND : 0; 9707 break; 9708 case TCP_INIT_CWND: 9709 *i1 = tcp->tcp_init_cwnd; 9710 break; 9711 case TCP_KEEPALIVE_THRESHOLD: 9712 *i1 = tcp->tcp_ka_interval; 9713 break; 9714 case TCP_KEEPALIVE_ABORT_THRESHOLD: 9715 *i1 = tcp->tcp_ka_abort_thres; 9716 break; 9717 case TCP_CORK: 9718 *i1 = tcp->tcp_cork; 9719 break; 9720 default: 9721 return (-1); 9722 } 9723 break; 9724 case IPPROTO_IP: 9725 if (tcp->tcp_family != AF_INET) 9726 return (-1); 9727 switch (name) { 9728 case IP_OPTIONS: 9729 case T_IP_OPTIONS: { 9730 /* 9731 * This is compatible with BSD in that in only return 9732 * the reverse source route with the final destination 9733 * as the last entry. The first 4 bytes of the option 9734 * will contain the final destination. 9735 */ 9736 int opt_len; 9737 9738 opt_len = (char *)tcp->tcp_tcph - (char *)tcp->tcp_ipha; 9739 opt_len -= tcp->tcp_label_len + IP_SIMPLE_HDR_LENGTH; 9740 ASSERT(opt_len >= 0); 9741 /* Caller ensures enough space */ 9742 if (opt_len > 0) { 9743 /* 9744 * TODO: Do we have to handle getsockopt on an 9745 * initiator as well? 9746 */ 9747 return (ip_opt_get_user(tcp->tcp_ipha, ptr)); 9748 } 9749 return (0); 9750 } 9751 case IP_TOS: 9752 case T_IP_TOS: 9753 *i1 = (int)tcp->tcp_ipha->ipha_type_of_service; 9754 break; 9755 case IP_TTL: 9756 *i1 = (int)tcp->tcp_ipha->ipha_ttl; 9757 break; 9758 case IP_NEXTHOP: 9759 /* Handled at IP level */ 9760 return (-EINVAL); 9761 default: 9762 return (-1); 9763 } 9764 break; 9765 case IPPROTO_IPV6: 9766 /* 9767 * IPPROTO_IPV6 options are only supported for sockets 9768 * that are using IPv6 on the wire. 9769 */ 9770 if (tcp->tcp_ipversion != IPV6_VERSION) { 9771 return (-1); 9772 } 9773 switch (name) { 9774 case IPV6_UNICAST_HOPS: 9775 *i1 = (unsigned int) tcp->tcp_ip6h->ip6_hops; 9776 break; /* goto sizeof (int) option return */ 9777 case IPV6_BOUND_IF: 9778 /* Zero if not set */ 9779 *i1 = tcp->tcp_bound_if; 9780 break; /* goto sizeof (int) option return */ 9781 case IPV6_RECVPKTINFO: 9782 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) 9783 *i1 = 1; 9784 else 9785 *i1 = 0; 9786 break; /* goto sizeof (int) option return */ 9787 case IPV6_RECVTCLASS: 9788 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS) 9789 *i1 = 1; 9790 else 9791 *i1 = 0; 9792 break; /* goto sizeof (int) option return */ 9793 case IPV6_RECVHOPLIMIT: 9794 if (tcp->tcp_ipv6_recvancillary & 9795 TCP_IPV6_RECVHOPLIMIT) 9796 *i1 = 1; 9797 else 9798 *i1 = 0; 9799 break; /* goto sizeof (int) option return */ 9800 case IPV6_RECVHOPOPTS: 9801 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) 9802 *i1 = 1; 9803 else 9804 *i1 = 0; 9805 break; /* goto sizeof (int) option return */ 9806 case IPV6_RECVDSTOPTS: 9807 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVDSTOPTS) 9808 *i1 = 1; 9809 else 9810 *i1 = 0; 9811 break; /* goto sizeof (int) option return */ 9812 case _OLD_IPV6_RECVDSTOPTS: 9813 if (tcp->tcp_ipv6_recvancillary & 9814 TCP_OLD_IPV6_RECVDSTOPTS) 9815 *i1 = 1; 9816 else 9817 *i1 = 0; 9818 break; /* goto sizeof (int) option return */ 9819 case IPV6_RECVRTHDR: 9820 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) 9821 *i1 = 1; 9822 else 9823 *i1 = 0; 9824 break; /* goto sizeof (int) option return */ 9825 case IPV6_RECVRTHDRDSTOPTS: 9826 if (tcp->tcp_ipv6_recvancillary & 9827 TCP_IPV6_RECVRTDSTOPTS) 9828 *i1 = 1; 9829 else 9830 *i1 = 0; 9831 break; /* goto sizeof (int) option return */ 9832 case IPV6_PKTINFO: { 9833 /* XXX assumes that caller has room for max size! */ 9834 struct in6_pktinfo *pkti; 9835 9836 pkti = (struct in6_pktinfo *)ptr; 9837 if (ipp->ipp_fields & IPPF_IFINDEX) 9838 pkti->ipi6_ifindex = ipp->ipp_ifindex; 9839 else 9840 pkti->ipi6_ifindex = 0; 9841 if (ipp->ipp_fields & IPPF_ADDR) 9842 pkti->ipi6_addr = ipp->ipp_addr; 9843 else 9844 pkti->ipi6_addr = ipv6_all_zeros; 9845 return (sizeof (struct in6_pktinfo)); 9846 } 9847 case IPV6_TCLASS: 9848 if (ipp->ipp_fields & IPPF_TCLASS) 9849 *i1 = ipp->ipp_tclass; 9850 else 9851 *i1 = IPV6_FLOW_TCLASS( 9852 IPV6_DEFAULT_VERS_AND_FLOW); 9853 break; /* goto sizeof (int) option return */ 9854 case IPV6_NEXTHOP: { 9855 sin6_t *sin6 = (sin6_t *)ptr; 9856 9857 if (!(ipp->ipp_fields & IPPF_NEXTHOP)) 9858 return (0); 9859 *sin6 = sin6_null; 9860 sin6->sin6_family = AF_INET6; 9861 sin6->sin6_addr = ipp->ipp_nexthop; 9862 return (sizeof (sin6_t)); 9863 } 9864 case IPV6_HOPOPTS: 9865 if (!(ipp->ipp_fields & IPPF_HOPOPTS)) 9866 return (0); 9867 if (ipp->ipp_hopoptslen <= tcp->tcp_label_len) 9868 return (0); 9869 bcopy((char *)ipp->ipp_hopopts + tcp->tcp_label_len, 9870 ptr, ipp->ipp_hopoptslen - tcp->tcp_label_len); 9871 if (tcp->tcp_label_len > 0) { 9872 ptr[0] = ((char *)ipp->ipp_hopopts)[0]; 9873 ptr[1] = (ipp->ipp_hopoptslen - 9874 tcp->tcp_label_len + 7) / 8 - 1; 9875 } 9876 return (ipp->ipp_hopoptslen - tcp->tcp_label_len); 9877 case IPV6_RTHDRDSTOPTS: 9878 if (!(ipp->ipp_fields & IPPF_RTDSTOPTS)) 9879 return (0); 9880 bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen); 9881 return (ipp->ipp_rtdstoptslen); 9882 case IPV6_RTHDR: 9883 if (!(ipp->ipp_fields & IPPF_RTHDR)) 9884 return (0); 9885 bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen); 9886 return (ipp->ipp_rthdrlen); 9887 case IPV6_DSTOPTS: 9888 if (!(ipp->ipp_fields & IPPF_DSTOPTS)) 9889 return (0); 9890 bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen); 9891 return (ipp->ipp_dstoptslen); 9892 case IPV6_SRC_PREFERENCES: 9893 return (ip6_get_src_preferences(connp, 9894 (uint32_t *)ptr)); 9895 case IPV6_PATHMTU: { 9896 struct ip6_mtuinfo *mtuinfo = (struct ip6_mtuinfo *)ptr; 9897 9898 if (tcp->tcp_state < TCPS_ESTABLISHED) 9899 return (-1); 9900 9901 return (ip_fill_mtuinfo(&connp->conn_remv6, 9902 connp->conn_fport, mtuinfo)); 9903 } 9904 default: 9905 return (-1); 9906 } 9907 break; 9908 default: 9909 return (-1); 9910 } 9911 return (sizeof (int)); 9912 } 9913 9914 /* 9915 * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements. 9916 * Parameters are assumed to be verified by the caller. 9917 */ 9918 /* ARGSUSED */ 9919 int 9920 tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name, 9921 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 9922 void *thisdg_attrs, cred_t *cr, mblk_t *mblk) 9923 { 9924 conn_t *connp = Q_TO_CONN(q); 9925 tcp_t *tcp = connp->conn_tcp; 9926 int *i1 = (int *)invalp; 9927 boolean_t onoff = (*i1 == 0) ? 0 : 1; 9928 boolean_t checkonly; 9929 int reterr; 9930 9931 switch (optset_context) { 9932 case SETFN_OPTCOM_CHECKONLY: 9933 checkonly = B_TRUE; 9934 /* 9935 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 9936 * inlen != 0 implies value supplied and 9937 * we have to "pretend" to set it. 9938 * inlen == 0 implies that there is no 9939 * value part in T_CHECK request and just validation 9940 * done elsewhere should be enough, we just return here. 9941 */ 9942 if (inlen == 0) { 9943 *outlenp = 0; 9944 return (0); 9945 } 9946 break; 9947 case SETFN_OPTCOM_NEGOTIATE: 9948 checkonly = B_FALSE; 9949 break; 9950 case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */ 9951 case SETFN_CONN_NEGOTIATE: 9952 checkonly = B_FALSE; 9953 /* 9954 * Negotiating local and "association-related" options 9955 * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ) 9956 * primitives is allowed by XTI, but we choose 9957 * to not implement this style negotiation for Internet 9958 * protocols (We interpret it is a must for OSI world but 9959 * optional for Internet protocols) for all options. 9960 * [ Will do only for the few options that enable test 9961 * suites that our XTI implementation of this feature 9962 * works for transports that do allow it ] 9963 */ 9964 if (!tcp_allow_connopt_set(level, name)) { 9965 *outlenp = 0; 9966 return (EINVAL); 9967 } 9968 break; 9969 default: 9970 /* 9971 * We should never get here 9972 */ 9973 *outlenp = 0; 9974 return (EINVAL); 9975 } 9976 9977 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 9978 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 9979 9980 /* 9981 * For TCP, we should have no ancillary data sent down 9982 * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs 9983 * has to be zero. 9984 */ 9985 ASSERT(thisdg_attrs == NULL); 9986 9987 /* 9988 * For fixed length options, no sanity check 9989 * of passed in length is done. It is assumed *_optcom_req() 9990 * routines do the right thing. 9991 */ 9992 9993 switch (level) { 9994 case SOL_SOCKET: 9995 switch (name) { 9996 case SO_LINGER: { 9997 struct linger *lgr = (struct linger *)invalp; 9998 9999 if (!checkonly) { 10000 if (lgr->l_onoff) { 10001 tcp->tcp_linger = 1; 10002 tcp->tcp_lingertime = lgr->l_linger; 10003 } else { 10004 tcp->tcp_linger = 0; 10005 tcp->tcp_lingertime = 0; 10006 } 10007 /* struct copy */ 10008 *(struct linger *)outvalp = *lgr; 10009 } else { 10010 if (!lgr->l_onoff) { 10011 ((struct linger *)outvalp)->l_onoff = 0; 10012 ((struct linger *)outvalp)->l_linger = 0; 10013 } else { 10014 /* struct copy */ 10015 *(struct linger *)outvalp = *lgr; 10016 } 10017 } 10018 *outlenp = sizeof (struct linger); 10019 return (0); 10020 } 10021 case SO_DEBUG: 10022 if (!checkonly) 10023 tcp->tcp_debug = onoff; 10024 break; 10025 case SO_KEEPALIVE: 10026 if (checkonly) { 10027 /* T_CHECK case */ 10028 break; 10029 } 10030 10031 if (!onoff) { 10032 if (tcp->tcp_ka_enabled) { 10033 if (tcp->tcp_ka_tid != 0) { 10034 (void) TCP_TIMER_CANCEL(tcp, 10035 tcp->tcp_ka_tid); 10036 tcp->tcp_ka_tid = 0; 10037 } 10038 tcp->tcp_ka_enabled = 0; 10039 } 10040 break; 10041 } 10042 if (!tcp->tcp_ka_enabled) { 10043 /* Crank up the keepalive timer */ 10044 tcp->tcp_ka_last_intrvl = 0; 10045 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10046 tcp_keepalive_killer, 10047 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10048 tcp->tcp_ka_enabled = 1; 10049 } 10050 break; 10051 case SO_DONTROUTE: 10052 /* 10053 * SO_DONTROUTE, SO_USELOOPBACK, and SO_BROADCAST are 10054 * only of interest to IP. We track them here only so 10055 * that we can report their current value. 10056 */ 10057 if (!checkonly) { 10058 tcp->tcp_dontroute = onoff; 10059 tcp->tcp_connp->conn_dontroute = onoff; 10060 } 10061 break; 10062 case SO_USELOOPBACK: 10063 if (!checkonly) { 10064 tcp->tcp_useloopback = onoff; 10065 tcp->tcp_connp->conn_loopback = onoff; 10066 } 10067 break; 10068 case SO_BROADCAST: 10069 if (!checkonly) { 10070 tcp->tcp_broadcast = onoff; 10071 tcp->tcp_connp->conn_broadcast = onoff; 10072 } 10073 break; 10074 case SO_REUSEADDR: 10075 if (!checkonly) { 10076 tcp->tcp_reuseaddr = onoff; 10077 tcp->tcp_connp->conn_reuseaddr = onoff; 10078 } 10079 break; 10080 case SO_OOBINLINE: 10081 if (!checkonly) 10082 tcp->tcp_oobinline = onoff; 10083 break; 10084 case SO_DGRAM_ERRIND: 10085 if (!checkonly) 10086 tcp->tcp_dgram_errind = onoff; 10087 break; 10088 case SO_SNDBUF: { 10089 tcp_t *peer_tcp; 10090 10091 if (*i1 > tcp_max_buf) { 10092 *outlenp = 0; 10093 return (ENOBUFS); 10094 } 10095 if (checkonly) 10096 break; 10097 10098 tcp->tcp_xmit_hiwater = *i1; 10099 if (tcp_snd_lowat_fraction != 0) 10100 tcp->tcp_xmit_lowater = 10101 tcp->tcp_xmit_hiwater / 10102 tcp_snd_lowat_fraction; 10103 (void) tcp_maxpsz_set(tcp, B_TRUE); 10104 /* 10105 * If we are flow-controlled, recheck the condition. 10106 * There are apps that increase SO_SNDBUF size when 10107 * flow-controlled (EWOULDBLOCK), and expect the flow 10108 * control condition to be lifted right away. 10109 * 10110 * For the fused tcp loopback case, in order to avoid 10111 * a race with the peer's tcp_fuse_rrw() we need to 10112 * hold its fuse_lock while accessing tcp_flow_stopped. 10113 */ 10114 peer_tcp = tcp->tcp_loopback_peer; 10115 ASSERT(!tcp->tcp_fused || peer_tcp != NULL); 10116 if (tcp->tcp_fused) 10117 mutex_enter(&peer_tcp->tcp_fuse_lock); 10118 10119 if (tcp->tcp_flow_stopped && 10120 TCP_UNSENT_BYTES(tcp) < tcp->tcp_xmit_hiwater) { 10121 tcp_clrqfull(tcp); 10122 } 10123 if (tcp->tcp_fused) 10124 mutex_exit(&peer_tcp->tcp_fuse_lock); 10125 break; 10126 } 10127 case SO_RCVBUF: 10128 if (*i1 > tcp_max_buf) { 10129 *outlenp = 0; 10130 return (ENOBUFS); 10131 } 10132 /* Silently ignore zero */ 10133 if (!checkonly && *i1 != 0) { 10134 *i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss); 10135 (void) tcp_rwnd_set(tcp, *i1); 10136 } 10137 /* 10138 * XXX should we return the rwnd here 10139 * and tcp_opt_get ? 10140 */ 10141 break; 10142 case SO_SND_COPYAVOID: 10143 if (!checkonly) { 10144 /* we only allow enable at most once for now */ 10145 if (tcp->tcp_loopback || 10146 (!tcp->tcp_snd_zcopy_aware && 10147 (onoff != 1 || !tcp_zcopy_check(tcp)))) { 10148 *outlenp = 0; 10149 return (EOPNOTSUPP); 10150 } 10151 tcp->tcp_snd_zcopy_aware = 1; 10152 } 10153 break; 10154 case SO_ALLZONES: 10155 /* Handled at the IP level */ 10156 return (-EINVAL); 10157 case SO_ANON_MLP: 10158 if (!checkonly) { 10159 mutex_enter(&connp->conn_lock); 10160 connp->conn_anon_mlp = onoff; 10161 mutex_exit(&connp->conn_lock); 10162 } 10163 break; 10164 case SO_MAC_EXEMPT: 10165 if (secpolicy_net_mac_aware(cr) != 0 || 10166 IPCL_IS_BOUND(connp)) 10167 return (EACCES); 10168 if (!checkonly) { 10169 mutex_enter(&connp->conn_lock); 10170 connp->conn_mac_exempt = onoff; 10171 mutex_exit(&connp->conn_lock); 10172 } 10173 break; 10174 case SO_EXCLBIND: 10175 if (!checkonly) 10176 tcp->tcp_exclbind = onoff; 10177 break; 10178 default: 10179 *outlenp = 0; 10180 return (EINVAL); 10181 } 10182 break; 10183 case IPPROTO_TCP: 10184 switch (name) { 10185 case TCP_NODELAY: 10186 if (!checkonly) 10187 tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss; 10188 break; 10189 case TCP_NOTIFY_THRESHOLD: 10190 if (!checkonly) 10191 tcp->tcp_first_timer_threshold = *i1; 10192 break; 10193 case TCP_ABORT_THRESHOLD: 10194 if (!checkonly) 10195 tcp->tcp_second_timer_threshold = *i1; 10196 break; 10197 case TCP_CONN_NOTIFY_THRESHOLD: 10198 if (!checkonly) 10199 tcp->tcp_first_ctimer_threshold = *i1; 10200 break; 10201 case TCP_CONN_ABORT_THRESHOLD: 10202 if (!checkonly) 10203 tcp->tcp_second_ctimer_threshold = *i1; 10204 break; 10205 case TCP_RECVDSTADDR: 10206 if (tcp->tcp_state > TCPS_LISTEN) 10207 return (EOPNOTSUPP); 10208 if (!checkonly) 10209 tcp->tcp_recvdstaddr = onoff; 10210 break; 10211 case TCP_ANONPRIVBIND: 10212 if ((reterr = secpolicy_net_privaddr(cr, 0)) != 0) { 10213 *outlenp = 0; 10214 return (reterr); 10215 } 10216 if (!checkonly) { 10217 tcp->tcp_anon_priv_bind = onoff; 10218 } 10219 break; 10220 case TCP_EXCLBIND: 10221 if (!checkonly) 10222 tcp->tcp_exclbind = onoff; 10223 break; /* goto sizeof (int) option return */ 10224 case TCP_INIT_CWND: { 10225 uint32_t init_cwnd = *((uint32_t *)invalp); 10226 10227 if (checkonly) 10228 break; 10229 10230 /* 10231 * Only allow socket with network configuration 10232 * privilege to set the initial cwnd to be larger 10233 * than allowed by RFC 3390. 10234 */ 10235 if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) { 10236 tcp->tcp_init_cwnd = init_cwnd; 10237 break; 10238 } 10239 if ((reterr = secpolicy_net_config(cr, B_TRUE)) != 0) { 10240 *outlenp = 0; 10241 return (reterr); 10242 } 10243 if (init_cwnd > TCP_MAX_INIT_CWND) { 10244 *outlenp = 0; 10245 return (EINVAL); 10246 } 10247 tcp->tcp_init_cwnd = init_cwnd; 10248 break; 10249 } 10250 case TCP_KEEPALIVE_THRESHOLD: 10251 if (checkonly) 10252 break; 10253 10254 if (*i1 < tcp_keepalive_interval_low || 10255 *i1 > tcp_keepalive_interval_high) { 10256 *outlenp = 0; 10257 return (EINVAL); 10258 } 10259 if (*i1 != tcp->tcp_ka_interval) { 10260 tcp->tcp_ka_interval = *i1; 10261 /* 10262 * Check if we need to restart the 10263 * keepalive timer. 10264 */ 10265 if (tcp->tcp_ka_tid != 0) { 10266 ASSERT(tcp->tcp_ka_enabled); 10267 (void) TCP_TIMER_CANCEL(tcp, 10268 tcp->tcp_ka_tid); 10269 tcp->tcp_ka_last_intrvl = 0; 10270 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10271 tcp_keepalive_killer, 10272 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10273 } 10274 } 10275 break; 10276 case TCP_KEEPALIVE_ABORT_THRESHOLD: 10277 if (!checkonly) { 10278 if (*i1 < tcp_keepalive_abort_interval_low || 10279 *i1 > tcp_keepalive_abort_interval_high) { 10280 *outlenp = 0; 10281 return (EINVAL); 10282 } 10283 tcp->tcp_ka_abort_thres = *i1; 10284 } 10285 break; 10286 case TCP_CORK: 10287 if (!checkonly) { 10288 /* 10289 * if tcp->tcp_cork was set and is now 10290 * being unset, we have to make sure that 10291 * the remaining data gets sent out. Also 10292 * unset tcp->tcp_cork so that tcp_wput_data() 10293 * can send data even if it is less than mss 10294 */ 10295 if (tcp->tcp_cork && onoff == 0 && 10296 tcp->tcp_unsent > 0) { 10297 tcp->tcp_cork = B_FALSE; 10298 tcp_wput_data(tcp, NULL, B_FALSE); 10299 } 10300 tcp->tcp_cork = onoff; 10301 } 10302 break; 10303 default: 10304 *outlenp = 0; 10305 return (EINVAL); 10306 } 10307 break; 10308 case IPPROTO_IP: 10309 if (tcp->tcp_family != AF_INET) { 10310 *outlenp = 0; 10311 return (ENOPROTOOPT); 10312 } 10313 switch (name) { 10314 case IP_OPTIONS: 10315 case T_IP_OPTIONS: 10316 reterr = tcp_opt_set_header(tcp, checkonly, 10317 invalp, inlen); 10318 if (reterr) { 10319 *outlenp = 0; 10320 return (reterr); 10321 } 10322 /* OK return - copy input buffer into output buffer */ 10323 if (invalp != outvalp) { 10324 /* don't trust bcopy for identical src/dst */ 10325 bcopy(invalp, outvalp, inlen); 10326 } 10327 *outlenp = inlen; 10328 return (0); 10329 case IP_TOS: 10330 case T_IP_TOS: 10331 if (!checkonly) { 10332 tcp->tcp_ipha->ipha_type_of_service = 10333 (uchar_t)*i1; 10334 tcp->tcp_tos = (uchar_t)*i1; 10335 } 10336 break; 10337 case IP_TTL: 10338 if (!checkonly) { 10339 tcp->tcp_ipha->ipha_ttl = (uchar_t)*i1; 10340 tcp->tcp_ttl = (uchar_t)*i1; 10341 } 10342 break; 10343 case IP_BOUND_IF: 10344 case IP_NEXTHOP: 10345 /* Handled at the IP level */ 10346 return (-EINVAL); 10347 case IP_SEC_OPT: 10348 /* 10349 * We should not allow policy setting after 10350 * we start listening for connections. 10351 */ 10352 if (tcp->tcp_state == TCPS_LISTEN) { 10353 return (EINVAL); 10354 } else { 10355 /* Handled at the IP level */ 10356 return (-EINVAL); 10357 } 10358 default: 10359 *outlenp = 0; 10360 return (EINVAL); 10361 } 10362 break; 10363 case IPPROTO_IPV6: { 10364 ip6_pkt_t *ipp; 10365 10366 /* 10367 * IPPROTO_IPV6 options are only supported for sockets 10368 * that are using IPv6 on the wire. 10369 */ 10370 if (tcp->tcp_ipversion != IPV6_VERSION) { 10371 *outlenp = 0; 10372 return (ENOPROTOOPT); 10373 } 10374 /* 10375 * Only sticky options; no ancillary data 10376 */ 10377 ASSERT(thisdg_attrs == NULL); 10378 ipp = &tcp->tcp_sticky_ipp; 10379 10380 switch (name) { 10381 case IPV6_UNICAST_HOPS: 10382 /* -1 means use default */ 10383 if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) { 10384 *outlenp = 0; 10385 return (EINVAL); 10386 } 10387 if (!checkonly) { 10388 if (*i1 == -1) { 10389 tcp->tcp_ip6h->ip6_hops = 10390 ipp->ipp_unicast_hops = 10391 (uint8_t)tcp_ipv6_hoplimit; 10392 ipp->ipp_fields &= ~IPPF_UNICAST_HOPS; 10393 /* Pass modified value to IP. */ 10394 *i1 = tcp->tcp_ip6h->ip6_hops; 10395 } else { 10396 tcp->tcp_ip6h->ip6_hops = 10397 ipp->ipp_unicast_hops = 10398 (uint8_t)*i1; 10399 ipp->ipp_fields |= IPPF_UNICAST_HOPS; 10400 } 10401 reterr = tcp_build_hdrs(q, tcp); 10402 if (reterr != 0) 10403 return (reterr); 10404 } 10405 break; 10406 case IPV6_BOUND_IF: 10407 if (!checkonly) { 10408 int error = 0; 10409 10410 tcp->tcp_bound_if = *i1; 10411 error = ip_opt_set_ill(tcp->tcp_connp, *i1, 10412 B_TRUE, checkonly, level, name, mblk); 10413 if (error != 0) { 10414 *outlenp = 0; 10415 return (error); 10416 } 10417 } 10418 break; 10419 /* 10420 * Set boolean switches for ancillary data delivery 10421 */ 10422 case IPV6_RECVPKTINFO: 10423 if (!checkonly) { 10424 if (onoff) 10425 tcp->tcp_ipv6_recvancillary |= 10426 TCP_IPV6_RECVPKTINFO; 10427 else 10428 tcp->tcp_ipv6_recvancillary &= 10429 ~TCP_IPV6_RECVPKTINFO; 10430 /* Force it to be sent up with the next msg */ 10431 tcp->tcp_recvifindex = 0; 10432 } 10433 break; 10434 case IPV6_RECVTCLASS: 10435 if (!checkonly) { 10436 if (onoff) 10437 tcp->tcp_ipv6_recvancillary |= 10438 TCP_IPV6_RECVTCLASS; 10439 else 10440 tcp->tcp_ipv6_recvancillary &= 10441 ~TCP_IPV6_RECVTCLASS; 10442 } 10443 break; 10444 case IPV6_RECVHOPLIMIT: 10445 if (!checkonly) { 10446 if (onoff) 10447 tcp->tcp_ipv6_recvancillary |= 10448 TCP_IPV6_RECVHOPLIMIT; 10449 else 10450 tcp->tcp_ipv6_recvancillary &= 10451 ~TCP_IPV6_RECVHOPLIMIT; 10452 /* Force it to be sent up with the next msg */ 10453 tcp->tcp_recvhops = 0xffffffffU; 10454 } 10455 break; 10456 case IPV6_RECVHOPOPTS: 10457 if (!checkonly) { 10458 if (onoff) 10459 tcp->tcp_ipv6_recvancillary |= 10460 TCP_IPV6_RECVHOPOPTS; 10461 else 10462 tcp->tcp_ipv6_recvancillary &= 10463 ~TCP_IPV6_RECVHOPOPTS; 10464 } 10465 break; 10466 case IPV6_RECVDSTOPTS: 10467 if (!checkonly) { 10468 if (onoff) 10469 tcp->tcp_ipv6_recvancillary |= 10470 TCP_IPV6_RECVDSTOPTS; 10471 else 10472 tcp->tcp_ipv6_recvancillary &= 10473 ~TCP_IPV6_RECVDSTOPTS; 10474 } 10475 break; 10476 case _OLD_IPV6_RECVDSTOPTS: 10477 if (!checkonly) { 10478 if (onoff) 10479 tcp->tcp_ipv6_recvancillary |= 10480 TCP_OLD_IPV6_RECVDSTOPTS; 10481 else 10482 tcp->tcp_ipv6_recvancillary &= 10483 ~TCP_OLD_IPV6_RECVDSTOPTS; 10484 } 10485 break; 10486 case IPV6_RECVRTHDR: 10487 if (!checkonly) { 10488 if (onoff) 10489 tcp->tcp_ipv6_recvancillary |= 10490 TCP_IPV6_RECVRTHDR; 10491 else 10492 tcp->tcp_ipv6_recvancillary &= 10493 ~TCP_IPV6_RECVRTHDR; 10494 } 10495 break; 10496 case IPV6_RECVRTHDRDSTOPTS: 10497 if (!checkonly) { 10498 if (onoff) 10499 tcp->tcp_ipv6_recvancillary |= 10500 TCP_IPV6_RECVRTDSTOPTS; 10501 else 10502 tcp->tcp_ipv6_recvancillary &= 10503 ~TCP_IPV6_RECVRTDSTOPTS; 10504 } 10505 break; 10506 case IPV6_PKTINFO: 10507 if (inlen != 0 && inlen != sizeof (struct in6_pktinfo)) 10508 return (EINVAL); 10509 if (checkonly) 10510 break; 10511 10512 if (inlen == 0) { 10513 ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR); 10514 } else { 10515 struct in6_pktinfo *pkti; 10516 10517 pkti = (struct in6_pktinfo *)invalp; 10518 /* 10519 * RFC 3542 states that ipi6_addr must be 10520 * the unspecified address when setting the 10521 * IPV6_PKTINFO sticky socket option on a 10522 * TCP socket. 10523 */ 10524 if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr)) 10525 return (EINVAL); 10526 /* 10527 * ip6_set_pktinfo() validates the source 10528 * address and interface index. 10529 */ 10530 reterr = ip6_set_pktinfo(cr, tcp->tcp_connp, 10531 pkti, mblk); 10532 if (reterr != 0) 10533 return (reterr); 10534 ipp->ipp_ifindex = pkti->ipi6_ifindex; 10535 ipp->ipp_addr = pkti->ipi6_addr; 10536 if (ipp->ipp_ifindex != 0) 10537 ipp->ipp_fields |= IPPF_IFINDEX; 10538 else 10539 ipp->ipp_fields &= ~IPPF_IFINDEX; 10540 if (!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)) 10541 ipp->ipp_fields |= IPPF_ADDR; 10542 else 10543 ipp->ipp_fields &= ~IPPF_ADDR; 10544 } 10545 reterr = tcp_build_hdrs(q, tcp); 10546 if (reterr != 0) 10547 return (reterr); 10548 break; 10549 case IPV6_TCLASS: 10550 if (inlen != 0 && inlen != sizeof (int)) 10551 return (EINVAL); 10552 if (checkonly) 10553 break; 10554 10555 if (inlen == 0) { 10556 ipp->ipp_fields &= ~IPPF_TCLASS; 10557 } else { 10558 if (*i1 > 255 || *i1 < -1) 10559 return (EINVAL); 10560 if (*i1 == -1) { 10561 ipp->ipp_tclass = 0; 10562 *i1 = 0; 10563 } else { 10564 ipp->ipp_tclass = *i1; 10565 } 10566 ipp->ipp_fields |= IPPF_TCLASS; 10567 } 10568 reterr = tcp_build_hdrs(q, tcp); 10569 if (reterr != 0) 10570 return (reterr); 10571 break; 10572 case IPV6_NEXTHOP: 10573 /* 10574 * IP will verify that the nexthop is reachable 10575 * and fail for sticky options. 10576 */ 10577 if (inlen != 0 && inlen != sizeof (sin6_t)) 10578 return (EINVAL); 10579 if (checkonly) 10580 break; 10581 10582 if (inlen == 0) { 10583 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10584 } else { 10585 sin6_t *sin6 = (sin6_t *)invalp; 10586 10587 if (sin6->sin6_family != AF_INET6) 10588 return (EAFNOSUPPORT); 10589 if (IN6_IS_ADDR_V4MAPPED( 10590 &sin6->sin6_addr)) 10591 return (EADDRNOTAVAIL); 10592 ipp->ipp_nexthop = sin6->sin6_addr; 10593 if (!IN6_IS_ADDR_UNSPECIFIED( 10594 &ipp->ipp_nexthop)) 10595 ipp->ipp_fields |= IPPF_NEXTHOP; 10596 else 10597 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10598 } 10599 reterr = tcp_build_hdrs(q, tcp); 10600 if (reterr != 0) 10601 return (reterr); 10602 break; 10603 case IPV6_HOPOPTS: { 10604 ip6_hbh_t *hopts = (ip6_hbh_t *)invalp; 10605 10606 /* 10607 * Sanity checks - minimum size, size a multiple of 10608 * eight bytes, and matching size passed in. 10609 */ 10610 if (inlen != 0 && 10611 inlen != (8 * (hopts->ip6h_len + 1))) 10612 return (EINVAL); 10613 10614 if (checkonly) 10615 break; 10616 10617 reterr = optcom_pkt_set(invalp, inlen, B_TRUE, 10618 (uchar_t **)&ipp->ipp_hopopts, 10619 &ipp->ipp_hopoptslen, tcp->tcp_label_len); 10620 if (reterr != 0) 10621 return (reterr); 10622 if (ipp->ipp_hopoptslen == 0) 10623 ipp->ipp_fields &= ~IPPF_HOPOPTS; 10624 else 10625 ipp->ipp_fields |= IPPF_HOPOPTS; 10626 reterr = tcp_build_hdrs(q, tcp); 10627 if (reterr != 0) 10628 return (reterr); 10629 break; 10630 } 10631 case IPV6_RTHDRDSTOPTS: { 10632 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10633 10634 /* 10635 * Sanity checks - minimum size, size a multiple of 10636 * eight bytes, and matching size passed in. 10637 */ 10638 if (inlen != 0 && 10639 inlen != (8 * (dopts->ip6d_len + 1))) 10640 return (EINVAL); 10641 10642 if (checkonly) 10643 break; 10644 10645 reterr = optcom_pkt_set(invalp, inlen, B_TRUE, 10646 (uchar_t **)&ipp->ipp_rtdstopts, 10647 &ipp->ipp_rtdstoptslen, 0); 10648 if (reterr != 0) 10649 return (reterr); 10650 if (ipp->ipp_rtdstoptslen == 0) 10651 ipp->ipp_fields &= ~IPPF_RTDSTOPTS; 10652 else 10653 ipp->ipp_fields |= IPPF_RTDSTOPTS; 10654 reterr = tcp_build_hdrs(q, tcp); 10655 if (reterr != 0) 10656 return (reterr); 10657 break; 10658 } 10659 case IPV6_DSTOPTS: { 10660 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10661 10662 /* 10663 * Sanity checks - minimum size, size a multiple of 10664 * eight bytes, and matching size passed in. 10665 */ 10666 if (inlen != 0 && 10667 inlen != (8 * (dopts->ip6d_len + 1))) 10668 return (EINVAL); 10669 10670 if (checkonly) 10671 break; 10672 10673 reterr = optcom_pkt_set(invalp, inlen, B_TRUE, 10674 (uchar_t **)&ipp->ipp_dstopts, 10675 &ipp->ipp_dstoptslen, 0); 10676 if (reterr != 0) 10677 return (reterr); 10678 if (ipp->ipp_dstoptslen == 0) 10679 ipp->ipp_fields &= ~IPPF_DSTOPTS; 10680 else 10681 ipp->ipp_fields |= IPPF_DSTOPTS; 10682 reterr = tcp_build_hdrs(q, tcp); 10683 if (reterr != 0) 10684 return (reterr); 10685 break; 10686 } 10687 case IPV6_RTHDR: { 10688 ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp; 10689 10690 /* 10691 * Sanity checks - minimum size, size a multiple of 10692 * eight bytes, and matching size passed in. 10693 */ 10694 if (inlen != 0 && 10695 inlen != (8 * (rt->ip6r_len + 1))) 10696 return (EINVAL); 10697 10698 if (checkonly) 10699 break; 10700 10701 reterr = optcom_pkt_set(invalp, inlen, B_TRUE, 10702 (uchar_t **)&ipp->ipp_rthdr, 10703 &ipp->ipp_rthdrlen, 0); 10704 if (reterr != 0) 10705 return (reterr); 10706 if (ipp->ipp_rthdrlen == 0) 10707 ipp->ipp_fields &= ~IPPF_RTHDR; 10708 else 10709 ipp->ipp_fields |= IPPF_RTHDR; 10710 reterr = tcp_build_hdrs(q, tcp); 10711 if (reterr != 0) 10712 return (reterr); 10713 break; 10714 } 10715 case IPV6_V6ONLY: 10716 if (!checkonly) 10717 tcp->tcp_connp->conn_ipv6_v6only = onoff; 10718 break; 10719 case IPV6_USE_MIN_MTU: 10720 if (inlen != sizeof (int)) 10721 return (EINVAL); 10722 10723 if (*i1 < -1 || *i1 > 1) 10724 return (EINVAL); 10725 10726 if (checkonly) 10727 break; 10728 10729 ipp->ipp_fields |= IPPF_USE_MIN_MTU; 10730 ipp->ipp_use_min_mtu = *i1; 10731 break; 10732 case IPV6_BOUND_PIF: 10733 /* Handled at the IP level */ 10734 return (-EINVAL); 10735 case IPV6_SEC_OPT: 10736 /* 10737 * We should not allow policy setting after 10738 * we start listening for connections. 10739 */ 10740 if (tcp->tcp_state == TCPS_LISTEN) { 10741 return (EINVAL); 10742 } else { 10743 /* Handled at the IP level */ 10744 return (-EINVAL); 10745 } 10746 case IPV6_SRC_PREFERENCES: 10747 if (inlen != sizeof (uint32_t)) 10748 return (EINVAL); 10749 reterr = ip6_set_src_preferences(tcp->tcp_connp, 10750 *(uint32_t *)invalp); 10751 if (reterr != 0) { 10752 *outlenp = 0; 10753 return (reterr); 10754 } 10755 break; 10756 default: 10757 *outlenp = 0; 10758 return (EINVAL); 10759 } 10760 break; 10761 } /* end IPPROTO_IPV6 */ 10762 default: 10763 *outlenp = 0; 10764 return (EINVAL); 10765 } 10766 /* 10767 * Common case of OK return with outval same as inval 10768 */ 10769 if (invalp != outvalp) { 10770 /* don't trust bcopy for identical src/dst */ 10771 (void) bcopy(invalp, outvalp, inlen); 10772 } 10773 *outlenp = inlen; 10774 return (0); 10775 } 10776 10777 /* 10778 * Update tcp_sticky_hdrs based on tcp_sticky_ipp. 10779 * The headers include ip6i_t (if needed), ip6_t, any sticky extension 10780 * headers, and the maximum size tcp header (to avoid reallocation 10781 * on the fly for additional tcp options). 10782 * Returns failure if can't allocate memory. 10783 */ 10784 static int 10785 tcp_build_hdrs(queue_t *q, tcp_t *tcp) 10786 { 10787 char *hdrs; 10788 uint_t hdrs_len; 10789 ip6i_t *ip6i; 10790 char buf[TCP_MAX_HDR_LENGTH]; 10791 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 10792 in6_addr_t src, dst; 10793 10794 /* 10795 * save the existing tcp header and source/dest IP addresses 10796 */ 10797 bcopy(tcp->tcp_tcph, buf, tcp->tcp_tcp_hdr_len); 10798 src = tcp->tcp_ip6h->ip6_src; 10799 dst = tcp->tcp_ip6h->ip6_dst; 10800 hdrs_len = ip_total_hdrs_len_v6(ipp) + TCP_MAX_HDR_LENGTH; 10801 ASSERT(hdrs_len != 0); 10802 if (hdrs_len > tcp->tcp_iphc_len) { 10803 /* Need to reallocate */ 10804 hdrs = kmem_zalloc(hdrs_len, KM_NOSLEEP); 10805 if (hdrs == NULL) 10806 return (ENOMEM); 10807 if (tcp->tcp_iphc != NULL) { 10808 if (tcp->tcp_hdr_grown) { 10809 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 10810 } else { 10811 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 10812 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 10813 } 10814 tcp->tcp_iphc_len = 0; 10815 } 10816 ASSERT(tcp->tcp_iphc_len == 0); 10817 tcp->tcp_iphc = hdrs; 10818 tcp->tcp_iphc_len = hdrs_len; 10819 tcp->tcp_hdr_grown = B_TRUE; 10820 } 10821 ip_build_hdrs_v6((uchar_t *)tcp->tcp_iphc, 10822 hdrs_len - TCP_MAX_HDR_LENGTH, ipp, IPPROTO_TCP); 10823 10824 /* Set header fields not in ipp */ 10825 if (ipp->ipp_fields & IPPF_HAS_IP6I) { 10826 ip6i = (ip6i_t *)tcp->tcp_iphc; 10827 tcp->tcp_ip6h = (ip6_t *)&ip6i[1]; 10828 } else { 10829 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 10830 } 10831 /* 10832 * tcp->tcp_ip_hdr_len will include ip6i_t if there is one. 10833 * 10834 * tcp->tcp_tcp_hdr_len doesn't change here. 10835 */ 10836 tcp->tcp_ip_hdr_len = hdrs_len - TCP_MAX_HDR_LENGTH; 10837 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); 10838 tcp->tcp_hdr_len = tcp->tcp_ip_hdr_len + tcp->tcp_tcp_hdr_len; 10839 10840 bcopy(buf, tcp->tcp_tcph, tcp->tcp_tcp_hdr_len); 10841 10842 tcp->tcp_ip6h->ip6_src = src; 10843 tcp->tcp_ip6h->ip6_dst = dst; 10844 10845 /* 10846 * If the hop limit was not set by ip_build_hdrs_v6(), set it to 10847 * the default value for TCP. 10848 */ 10849 if (!(ipp->ipp_fields & IPPF_UNICAST_HOPS)) 10850 tcp->tcp_ip6h->ip6_hops = tcp_ipv6_hoplimit; 10851 10852 /* 10853 * If we're setting extension headers after a connection 10854 * has been established, and if we have a routing header 10855 * among the extension headers, call ip_massage_options_v6 to 10856 * manipulate the routing header/ip6_dst set the checksum 10857 * difference in the tcp header template. 10858 * (This happens in tcp_connect_ipv6 if the routing header 10859 * is set prior to the connect.) 10860 * Set the tcp_sum to zero first in case we've cleared a 10861 * routing header or don't have one at all. 10862 */ 10863 tcp->tcp_sum = 0; 10864 if ((tcp->tcp_state >= TCPS_SYN_SENT) && 10865 (tcp->tcp_ipp_fields & IPPF_RTHDR)) { 10866 ip6_rthdr_t *rth = ip_find_rthdr_v6(tcp->tcp_ip6h, 10867 (uint8_t *)tcp->tcp_tcph); 10868 if (rth != NULL) { 10869 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, 10870 rth); 10871 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 10872 (tcp->tcp_sum >> 16)); 10873 } 10874 } 10875 10876 /* Try to get everything in a single mblk */ 10877 (void) mi_set_sth_wroff(RD(q), hdrs_len + tcp_wroff_xtra); 10878 return (0); 10879 } 10880 10881 /* 10882 * Transfer any source route option from ipha to buf/dst in reversed form. 10883 */ 10884 static int 10885 tcp_opt_rev_src_route(ipha_t *ipha, char *buf, uchar_t *dst) 10886 { 10887 ipoptp_t opts; 10888 uchar_t *opt; 10889 uint8_t optval; 10890 uint8_t optlen; 10891 uint32_t len = 0; 10892 10893 for (optval = ipoptp_first(&opts, ipha); 10894 optval != IPOPT_EOL; 10895 optval = ipoptp_next(&opts)) { 10896 opt = opts.ipoptp_cur; 10897 optlen = opts.ipoptp_len; 10898 switch (optval) { 10899 int off1, off2; 10900 case IPOPT_SSRR: 10901 case IPOPT_LSRR: 10902 10903 /* Reverse source route */ 10904 /* 10905 * First entry should be the next to last one in the 10906 * current source route (the last entry is our 10907 * address.) 10908 * The last entry should be the final destination. 10909 */ 10910 buf[IPOPT_OPTVAL] = (uint8_t)optval; 10911 buf[IPOPT_OLEN] = (uint8_t)optlen; 10912 off1 = IPOPT_MINOFF_SR - 1; 10913 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 10914 if (off2 < 0) { 10915 /* No entries in source route */ 10916 break; 10917 } 10918 bcopy(opt + off2, dst, IP_ADDR_LEN); 10919 /* 10920 * Note: use src since ipha has not had its src 10921 * and dst reversed (it is in the state it was 10922 * received. 10923 */ 10924 bcopy(&ipha->ipha_src, buf + off2, 10925 IP_ADDR_LEN); 10926 off2 -= IP_ADDR_LEN; 10927 10928 while (off2 > 0) { 10929 bcopy(opt + off2, buf + off1, 10930 IP_ADDR_LEN); 10931 off1 += IP_ADDR_LEN; 10932 off2 -= IP_ADDR_LEN; 10933 } 10934 buf[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 10935 buf += optlen; 10936 len += optlen; 10937 break; 10938 } 10939 } 10940 done: 10941 /* Pad the resulting options */ 10942 while (len & 0x3) { 10943 *buf++ = IPOPT_EOL; 10944 len++; 10945 } 10946 return (len); 10947 } 10948 10949 10950 /* 10951 * Extract and revert a source route from ipha (if any) 10952 * and then update the relevant fields in both tcp_t and the standard header. 10953 */ 10954 static void 10955 tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha) 10956 { 10957 char buf[TCP_MAX_HDR_LENGTH]; 10958 uint_t tcph_len; 10959 int len; 10960 10961 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 10962 len = IPH_HDR_LENGTH(ipha); 10963 if (len == IP_SIMPLE_HDR_LENGTH) 10964 /* Nothing to do */ 10965 return; 10966 if (len > IP_SIMPLE_HDR_LENGTH + TCP_MAX_IP_OPTIONS_LENGTH || 10967 (len & 0x3)) 10968 return; 10969 10970 tcph_len = tcp->tcp_tcp_hdr_len; 10971 bcopy(tcp->tcp_tcph, buf, tcph_len); 10972 tcp->tcp_sum = (tcp->tcp_ipha->ipha_dst >> 16) + 10973 (tcp->tcp_ipha->ipha_dst & 0xffff); 10974 len = tcp_opt_rev_src_route(ipha, (char *)tcp->tcp_ipha + 10975 IP_SIMPLE_HDR_LENGTH, (uchar_t *)&tcp->tcp_ipha->ipha_dst); 10976 len += IP_SIMPLE_HDR_LENGTH; 10977 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 10978 (tcp->tcp_ipha->ipha_dst & 0xffff)); 10979 if ((int)tcp->tcp_sum < 0) 10980 tcp->tcp_sum--; 10981 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 10982 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); 10983 tcp->tcp_tcph = (tcph_t *)((char *)tcp->tcp_ipha + len); 10984 bcopy(buf, tcp->tcp_tcph, tcph_len); 10985 tcp->tcp_ip_hdr_len = len; 10986 tcp->tcp_ipha->ipha_version_and_hdr_length = 10987 (IP_VERSION << 4) | (len >> 2); 10988 len += tcph_len; 10989 tcp->tcp_hdr_len = len; 10990 } 10991 10992 /* 10993 * Copy the standard header into its new location, 10994 * lay in the new options and then update the relevant 10995 * fields in both tcp_t and the standard header. 10996 */ 10997 static int 10998 tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len) 10999 { 11000 uint_t tcph_len; 11001 uint8_t *ip_optp; 11002 tcph_t *new_tcph; 11003 11004 if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) 11005 return (EINVAL); 11006 11007 if (len > IP_MAX_OPT_LENGTH - tcp->tcp_label_len) 11008 return (EINVAL); 11009 11010 if (checkonly) { 11011 /* 11012 * do not really set, just pretend to - T_CHECK 11013 */ 11014 return (0); 11015 } 11016 11017 ip_optp = (uint8_t *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; 11018 if (tcp->tcp_label_len > 0) { 11019 int padlen; 11020 uint8_t opt; 11021 11022 /* convert list termination to no-ops */ 11023 padlen = tcp->tcp_label_len - ip_optp[IPOPT_OLEN]; 11024 ip_optp += ip_optp[IPOPT_OLEN]; 11025 opt = len > 0 ? IPOPT_NOP : IPOPT_EOL; 11026 while (--padlen >= 0) 11027 *ip_optp++ = opt; 11028 } 11029 tcph_len = tcp->tcp_tcp_hdr_len; 11030 new_tcph = (tcph_t *)(ip_optp + len); 11031 ovbcopy(tcp->tcp_tcph, new_tcph, tcph_len); 11032 tcp->tcp_tcph = new_tcph; 11033 bcopy(ptr, ip_optp, len); 11034 11035 len += IP_SIMPLE_HDR_LENGTH + tcp->tcp_label_len; 11036 11037 tcp->tcp_ip_hdr_len = len; 11038 tcp->tcp_ipha->ipha_version_and_hdr_length = 11039 (IP_VERSION << 4) | (len >> 2); 11040 tcp->tcp_hdr_len = len + tcph_len; 11041 if (!TCP_IS_DETACHED(tcp)) { 11042 /* Always allocate room for all options. */ 11043 (void) mi_set_sth_wroff(tcp->tcp_rq, 11044 TCP_MAX_COMBINED_HEADER_LENGTH + tcp_wroff_xtra); 11045 } 11046 return (0); 11047 } 11048 11049 /* Get callback routine passed to nd_load by tcp_param_register */ 11050 /* ARGSUSED */ 11051 static int 11052 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 11053 { 11054 tcpparam_t *tcppa = (tcpparam_t *)cp; 11055 11056 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 11057 return (0); 11058 } 11059 11060 /* 11061 * Walk through the param array specified registering each element with the 11062 * named dispatch handler. 11063 */ 11064 static boolean_t 11065 tcp_param_register(tcpparam_t *tcppa, int cnt) 11066 { 11067 for (; cnt-- > 0; tcppa++) { 11068 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 11069 if (!nd_load(&tcp_g_nd, tcppa->tcp_param_name, 11070 tcp_param_get, tcp_param_set, 11071 (caddr_t)tcppa)) { 11072 nd_free(&tcp_g_nd); 11073 return (B_FALSE); 11074 } 11075 } 11076 } 11077 if (!nd_load(&tcp_g_nd, tcp_wroff_xtra_param.tcp_param_name, 11078 tcp_param_get, tcp_param_set_aligned, 11079 (caddr_t)&tcp_wroff_xtra_param)) { 11080 nd_free(&tcp_g_nd); 11081 return (B_FALSE); 11082 } 11083 if (!nd_load(&tcp_g_nd, tcp_mdt_head_param.tcp_param_name, 11084 tcp_param_get, tcp_param_set_aligned, 11085 (caddr_t)&tcp_mdt_head_param)) { 11086 nd_free(&tcp_g_nd); 11087 return (B_FALSE); 11088 } 11089 if (!nd_load(&tcp_g_nd, tcp_mdt_tail_param.tcp_param_name, 11090 tcp_param_get, tcp_param_set_aligned, 11091 (caddr_t)&tcp_mdt_tail_param)) { 11092 nd_free(&tcp_g_nd); 11093 return (B_FALSE); 11094 } 11095 if (!nd_load(&tcp_g_nd, tcp_mdt_max_pbufs_param.tcp_param_name, 11096 tcp_param_get, tcp_param_set, 11097 (caddr_t)&tcp_mdt_max_pbufs_param)) { 11098 nd_free(&tcp_g_nd); 11099 return (B_FALSE); 11100 } 11101 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports", 11102 tcp_extra_priv_ports_get, NULL, NULL)) { 11103 nd_free(&tcp_g_nd); 11104 return (B_FALSE); 11105 } 11106 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_add", 11107 NULL, tcp_extra_priv_ports_add, NULL)) { 11108 nd_free(&tcp_g_nd); 11109 return (B_FALSE); 11110 } 11111 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_del", 11112 NULL, tcp_extra_priv_ports_del, NULL)) { 11113 nd_free(&tcp_g_nd); 11114 return (B_FALSE); 11115 } 11116 if (!nd_load(&tcp_g_nd, "tcp_status", tcp_status_report, NULL, 11117 NULL)) { 11118 nd_free(&tcp_g_nd); 11119 return (B_FALSE); 11120 } 11121 if (!nd_load(&tcp_g_nd, "tcp_bind_hash", tcp_bind_hash_report, 11122 NULL, NULL)) { 11123 nd_free(&tcp_g_nd); 11124 return (B_FALSE); 11125 } 11126 if (!nd_load(&tcp_g_nd, "tcp_listen_hash", tcp_listen_hash_report, 11127 NULL, NULL)) { 11128 nd_free(&tcp_g_nd); 11129 return (B_FALSE); 11130 } 11131 if (!nd_load(&tcp_g_nd, "tcp_conn_hash", tcp_conn_hash_report, 11132 NULL, NULL)) { 11133 nd_free(&tcp_g_nd); 11134 return (B_FALSE); 11135 } 11136 if (!nd_load(&tcp_g_nd, "tcp_acceptor_hash", tcp_acceptor_hash_report, 11137 NULL, NULL)) { 11138 nd_free(&tcp_g_nd); 11139 return (B_FALSE); 11140 } 11141 if (!nd_load(&tcp_g_nd, "tcp_host_param", tcp_host_param_report, 11142 tcp_host_param_set, NULL)) { 11143 nd_free(&tcp_g_nd); 11144 return (B_FALSE); 11145 } 11146 if (!nd_load(&tcp_g_nd, "tcp_host_param_ipv6", tcp_host_param_report, 11147 tcp_host_param_set_ipv6, NULL)) { 11148 nd_free(&tcp_g_nd); 11149 return (B_FALSE); 11150 } 11151 if (!nd_load(&tcp_g_nd, "tcp_1948_phrase", NULL, tcp_1948_phrase_set, 11152 NULL)) { 11153 nd_free(&tcp_g_nd); 11154 return (B_FALSE); 11155 } 11156 if (!nd_load(&tcp_g_nd, "tcp_reserved_port_list", 11157 tcp_reserved_port_list, NULL, NULL)) { 11158 nd_free(&tcp_g_nd); 11159 return (B_FALSE); 11160 } 11161 /* 11162 * Dummy ndd variables - only to convey obsolescence information 11163 * through printing of their name (no get or set routines) 11164 * XXX Remove in future releases ? 11165 */ 11166 if (!nd_load(&tcp_g_nd, 11167 "tcp_close_wait_interval(obsoleted - " 11168 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 11169 nd_free(&tcp_g_nd); 11170 return (B_FALSE); 11171 } 11172 return (B_TRUE); 11173 } 11174 11175 /* ndd set routine for tcp_wroff_xtra, tcp_mdt_hdr_{head,tail}_min. */ 11176 /* ARGSUSED */ 11177 static int 11178 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 11179 cred_t *cr) 11180 { 11181 long new_value; 11182 tcpparam_t *tcppa = (tcpparam_t *)cp; 11183 11184 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11185 new_value < tcppa->tcp_param_min || 11186 new_value > tcppa->tcp_param_max) { 11187 return (EINVAL); 11188 } 11189 /* 11190 * Need to make sure new_value is a multiple of 4. If it is not, 11191 * round it up. For future 64 bit requirement, we actually make it 11192 * a multiple of 8. 11193 */ 11194 if (new_value & 0x7) { 11195 new_value = (new_value & ~0x7) + 0x8; 11196 } 11197 tcppa->tcp_param_val = new_value; 11198 return (0); 11199 } 11200 11201 /* Set callback routine passed to nd_load by tcp_param_register */ 11202 /* ARGSUSED */ 11203 static int 11204 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 11205 { 11206 long new_value; 11207 tcpparam_t *tcppa = (tcpparam_t *)cp; 11208 11209 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11210 new_value < tcppa->tcp_param_min || 11211 new_value > tcppa->tcp_param_max) { 11212 return (EINVAL); 11213 } 11214 tcppa->tcp_param_val = new_value; 11215 return (0); 11216 } 11217 11218 /* 11219 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 11220 * is filled, return as much as we can. The message passed in may be 11221 * multi-part, chained using b_cont. "start" is the starting sequence 11222 * number for this piece. 11223 */ 11224 static mblk_t * 11225 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 11226 { 11227 uint32_t end; 11228 mblk_t *mp1; 11229 mblk_t *mp2; 11230 mblk_t *next_mp; 11231 uint32_t u1; 11232 11233 /* Walk through all the new pieces. */ 11234 do { 11235 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 11236 (uintptr_t)INT_MAX); 11237 end = start + (int)(mp->b_wptr - mp->b_rptr); 11238 next_mp = mp->b_cont; 11239 if (start == end) { 11240 /* Empty. Blast it. */ 11241 freeb(mp); 11242 continue; 11243 } 11244 mp->b_cont = NULL; 11245 TCP_REASS_SET_SEQ(mp, start); 11246 TCP_REASS_SET_END(mp, end); 11247 mp1 = tcp->tcp_reass_tail; 11248 if (!mp1) { 11249 tcp->tcp_reass_tail = mp; 11250 tcp->tcp_reass_head = mp; 11251 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11252 UPDATE_MIB(&tcp_mib, 11253 tcpInDataUnorderBytes, end - start); 11254 continue; 11255 } 11256 /* New stuff completely beyond tail? */ 11257 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { 11258 /* Link it on end. */ 11259 mp1->b_cont = mp; 11260 tcp->tcp_reass_tail = mp; 11261 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11262 UPDATE_MIB(&tcp_mib, 11263 tcpInDataUnorderBytes, end - start); 11264 continue; 11265 } 11266 mp1 = tcp->tcp_reass_head; 11267 u1 = TCP_REASS_SEQ(mp1); 11268 /* New stuff at the front? */ 11269 if (SEQ_LT(start, u1)) { 11270 /* Yes... Check for overlap. */ 11271 mp->b_cont = mp1; 11272 tcp->tcp_reass_head = mp; 11273 tcp_reass_elim_overlap(tcp, mp); 11274 continue; 11275 } 11276 /* 11277 * The new piece fits somewhere between the head and tail. 11278 * We find our slot, where mp1 precedes us and mp2 trails. 11279 */ 11280 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 11281 u1 = TCP_REASS_SEQ(mp2); 11282 if (SEQ_LEQ(start, u1)) 11283 break; 11284 } 11285 /* Link ourselves in */ 11286 mp->b_cont = mp2; 11287 mp1->b_cont = mp; 11288 11289 /* Trim overlap with following mblk(s) first */ 11290 tcp_reass_elim_overlap(tcp, mp); 11291 11292 /* Trim overlap with preceding mblk */ 11293 tcp_reass_elim_overlap(tcp, mp1); 11294 11295 } while (start = end, mp = next_mp); 11296 mp1 = tcp->tcp_reass_head; 11297 /* Anything ready to go? */ 11298 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 11299 return (NULL); 11300 /* Eat what we can off the queue */ 11301 for (;;) { 11302 mp = mp1->b_cont; 11303 end = TCP_REASS_END(mp1); 11304 TCP_REASS_SET_SEQ(mp1, 0); 11305 TCP_REASS_SET_END(mp1, 0); 11306 if (!mp) { 11307 tcp->tcp_reass_tail = NULL; 11308 break; 11309 } 11310 if (end != TCP_REASS_SEQ(mp)) { 11311 mp1->b_cont = NULL; 11312 break; 11313 } 11314 mp1 = mp; 11315 } 11316 mp1 = tcp->tcp_reass_head; 11317 tcp->tcp_reass_head = mp; 11318 return (mp1); 11319 } 11320 11321 /* Eliminate any overlap that mp may have over later mblks */ 11322 static void 11323 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 11324 { 11325 uint32_t end; 11326 mblk_t *mp1; 11327 uint32_t u1; 11328 11329 end = TCP_REASS_END(mp); 11330 while ((mp1 = mp->b_cont) != NULL) { 11331 u1 = TCP_REASS_SEQ(mp1); 11332 if (!SEQ_GT(end, u1)) 11333 break; 11334 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 11335 mp->b_wptr -= end - u1; 11336 TCP_REASS_SET_END(mp, u1); 11337 BUMP_MIB(&tcp_mib, tcpInDataPartDupSegs); 11338 UPDATE_MIB(&tcp_mib, tcpInDataPartDupBytes, end - u1); 11339 break; 11340 } 11341 mp->b_cont = mp1->b_cont; 11342 TCP_REASS_SET_SEQ(mp1, 0); 11343 TCP_REASS_SET_END(mp1, 0); 11344 freeb(mp1); 11345 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 11346 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, end - u1); 11347 } 11348 if (!mp1) 11349 tcp->tcp_reass_tail = mp; 11350 } 11351 11352 /* 11353 * Send up all messages queued on tcp_rcv_list. 11354 */ 11355 static uint_t 11356 tcp_rcv_drain(queue_t *q, tcp_t *tcp) 11357 { 11358 mblk_t *mp; 11359 uint_t ret = 0; 11360 uint_t thwin; 11361 #ifdef DEBUG 11362 uint_t cnt = 0; 11363 #endif 11364 /* Can't drain on an eager connection */ 11365 if (tcp->tcp_listener != NULL) 11366 return (ret); 11367 11368 /* 11369 * Handle two cases here: we are currently fused or we were 11370 * previously fused and have some urgent data to be delivered 11371 * upstream. The latter happens because we either ran out of 11372 * memory or were detached and therefore sending the SIGURG was 11373 * deferred until this point. In either case we pass control 11374 * over to tcp_fuse_rcv_drain() since it may need to complete 11375 * some work. 11376 */ 11377 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 11378 ASSERT(tcp->tcp_fused_sigurg_mp != NULL); 11379 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 11380 &tcp->tcp_fused_sigurg_mp)) 11381 return (ret); 11382 } 11383 11384 while ((mp = tcp->tcp_rcv_list) != NULL) { 11385 tcp->tcp_rcv_list = mp->b_next; 11386 mp->b_next = NULL; 11387 #ifdef DEBUG 11388 cnt += msgdsize(mp); 11389 #endif 11390 /* Does this need SSL processing first? */ 11391 if ((tcp->tcp_kssl_ctx != NULL) && (DB_TYPE(mp) == M_DATA)) { 11392 tcp_kssl_input(tcp, mp); 11393 continue; 11394 } 11395 putnext(q, mp); 11396 } 11397 ASSERT(cnt == tcp->tcp_rcv_cnt); 11398 tcp->tcp_rcv_last_head = NULL; 11399 tcp->tcp_rcv_last_tail = NULL; 11400 tcp->tcp_rcv_cnt = 0; 11401 11402 /* Learn the latest rwnd information that we sent to the other side. */ 11403 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 11404 << tcp->tcp_rcv_ws; 11405 /* This is peer's calculated send window (our receive window). */ 11406 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 11407 /* 11408 * Increase the receive window to max. But we need to do receiver 11409 * SWS avoidance. This means that we need to check the increase of 11410 * of receive window is at least 1 MSS. 11411 */ 11412 if (canputnext(q) && (q->q_hiwat - thwin >= tcp->tcp_mss)) { 11413 /* 11414 * If the window that the other side knows is less than max 11415 * deferred acks segments, send an update immediately. 11416 */ 11417 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 11418 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 11419 ret = TH_ACK_NEEDED; 11420 } 11421 tcp->tcp_rwnd = q->q_hiwat; 11422 } 11423 /* No need for the push timer now. */ 11424 if (tcp->tcp_push_tid != 0) { 11425 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 11426 tcp->tcp_push_tid = 0; 11427 } 11428 return (ret); 11429 } 11430 11431 /* 11432 * Queue data on tcp_rcv_list which is a b_next chain. 11433 * tcp_rcv_last_head/tail is the last element of this chain. 11434 * Each element of the chain is a b_cont chain. 11435 * 11436 * M_DATA messages are added to the current element. 11437 * Other messages are added as new (b_next) elements. 11438 */ 11439 void 11440 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len) 11441 { 11442 ASSERT(seg_len == msgdsize(mp)); 11443 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 11444 11445 if (tcp->tcp_rcv_list == NULL) { 11446 ASSERT(tcp->tcp_rcv_last_head == NULL); 11447 tcp->tcp_rcv_list = mp; 11448 tcp->tcp_rcv_last_head = mp; 11449 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 11450 tcp->tcp_rcv_last_tail->b_cont = mp; 11451 } else { 11452 tcp->tcp_rcv_last_head->b_next = mp; 11453 tcp->tcp_rcv_last_head = mp; 11454 } 11455 11456 while (mp->b_cont) 11457 mp = mp->b_cont; 11458 11459 tcp->tcp_rcv_last_tail = mp; 11460 tcp->tcp_rcv_cnt += seg_len; 11461 tcp->tcp_rwnd -= seg_len; 11462 } 11463 11464 /* 11465 * DEFAULT TCP ENTRY POINT via squeue on READ side. 11466 * 11467 * This is the default entry function into TCP on the read side. TCP is 11468 * always entered via squeue i.e. using squeue's for mutual exclusion. 11469 * When classifier does a lookup to find the tcp, it also puts a reference 11470 * on the conn structure associated so the tcp is guaranteed to exist 11471 * when we come here. We still need to check the state because it might 11472 * as well has been closed. The squeue processing function i.e. squeue_enter, 11473 * squeue_enter_nodrain, or squeue_drain is responsible for doing the 11474 * CONN_DEC_REF. 11475 * 11476 * Apart from the default entry point, IP also sends packets directly to 11477 * tcp_rput_data for AF_INET fast path and tcp_conn_request for incoming 11478 * connections. 11479 */ 11480 void 11481 tcp_input(void *arg, mblk_t *mp, void *arg2) 11482 { 11483 conn_t *connp = (conn_t *)arg; 11484 tcp_t *tcp = (tcp_t *)connp->conn_tcp; 11485 11486 /* arg2 is the sqp */ 11487 ASSERT(arg2 != NULL); 11488 ASSERT(mp != NULL); 11489 11490 /* 11491 * Don't accept any input on a closed tcp as this TCP logically does 11492 * not exist on the system. Don't proceed further with this TCP. 11493 * For eg. this packet could trigger another close of this tcp 11494 * which would be disastrous for tcp_refcnt. tcp_close_detached / 11495 * tcp_clean_death / tcp_closei_local must be called at most once 11496 * on a TCP. In this case we need to refeed the packet into the 11497 * classifier and figure out where the packet should go. Need to 11498 * preserve the recv_ill somehow. Until we figure that out, for 11499 * now just drop the packet if we can't classify the packet. 11500 */ 11501 if (tcp->tcp_state == TCPS_CLOSED || 11502 tcp->tcp_state == TCPS_BOUND) { 11503 conn_t *new_connp; 11504 11505 new_connp = ipcl_classify(mp, connp->conn_zoneid); 11506 if (new_connp != NULL) { 11507 tcp_reinput(new_connp, mp, arg2); 11508 return; 11509 } 11510 /* We failed to classify. For now just drop the packet */ 11511 freemsg(mp); 11512 return; 11513 } 11514 11515 if (DB_TYPE(mp) == M_DATA) 11516 tcp_rput_data(connp, mp, arg2); 11517 else 11518 tcp_rput_common(tcp, mp); 11519 } 11520 11521 /* 11522 * The read side put procedure. 11523 * The packets passed up by ip are assume to be aligned according to 11524 * OK_32PTR and the IP+TCP headers fitting in the first mblk. 11525 */ 11526 static void 11527 tcp_rput_common(tcp_t *tcp, mblk_t *mp) 11528 { 11529 /* 11530 * tcp_rput_data() does not expect M_CTL except for the case 11531 * where tcp_ipv6_recvancillary is set and we get a IN_PKTINFO 11532 * type. Need to make sure that any other M_CTLs don't make 11533 * it to tcp_rput_data since it is not expecting any and doesn't 11534 * check for it. 11535 */ 11536 if (DB_TYPE(mp) == M_CTL) { 11537 switch (*(uint32_t *)(mp->b_rptr)) { 11538 case TCP_IOC_ABORT_CONN: 11539 /* 11540 * Handle connection abort request. 11541 */ 11542 tcp_ioctl_abort_handler(tcp, mp); 11543 return; 11544 case IPSEC_IN: 11545 /* 11546 * Only secure icmp arrive in TCP and they 11547 * don't go through data path. 11548 */ 11549 tcp_icmp_error(tcp, mp); 11550 return; 11551 case IN_PKTINFO: 11552 /* 11553 * Handle IPV6_RECVPKTINFO socket option on AF_INET6 11554 * sockets that are receiving IPv4 traffic. tcp 11555 */ 11556 ASSERT(tcp->tcp_family == AF_INET6); 11557 ASSERT(tcp->tcp_ipv6_recvancillary & 11558 TCP_IPV6_RECVPKTINFO); 11559 tcp_rput_data(tcp->tcp_connp, mp, 11560 tcp->tcp_connp->conn_sqp); 11561 return; 11562 case MDT_IOC_INFO_UPDATE: 11563 /* 11564 * Handle Multidata information update; the 11565 * following routine will free the message. 11566 */ 11567 if (tcp->tcp_connp->conn_mdt_ok) { 11568 tcp_mdt_update(tcp, 11569 &((ip_mdt_info_t *)mp->b_rptr)->mdt_capab, 11570 B_FALSE); 11571 } 11572 freemsg(mp); 11573 return; 11574 default: 11575 break; 11576 } 11577 } 11578 11579 /* No point processing the message if tcp is already closed */ 11580 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 11581 freemsg(mp); 11582 return; 11583 } 11584 11585 tcp_rput_other(tcp, mp); 11586 } 11587 11588 11589 /* The minimum of smoothed mean deviation in RTO calculation. */ 11590 #define TCP_SD_MIN 400 11591 11592 /* 11593 * Set RTO for this connection. The formula is from Jacobson and Karels' 11594 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names 11595 * are the same as those in Appendix A.2 of that paper. 11596 * 11597 * m = new measurement 11598 * sa = smoothed RTT average (8 * average estimates). 11599 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 11600 */ 11601 static void 11602 tcp_set_rto(tcp_t *tcp, clock_t rtt) 11603 { 11604 long m = TICK_TO_MSEC(rtt); 11605 clock_t sa = tcp->tcp_rtt_sa; 11606 clock_t sv = tcp->tcp_rtt_sd; 11607 clock_t rto; 11608 11609 BUMP_MIB(&tcp_mib, tcpRttUpdate); 11610 tcp->tcp_rtt_update++; 11611 11612 /* tcp_rtt_sa is not 0 means this is a new sample. */ 11613 if (sa != 0) { 11614 /* 11615 * Update average estimator: 11616 * new rtt = 7/8 old rtt + 1/8 Error 11617 */ 11618 11619 /* m is now Error in estimate. */ 11620 m -= sa >> 3; 11621 if ((sa += m) <= 0) { 11622 /* 11623 * Don't allow the smoothed average to be negative. 11624 * We use 0 to denote reinitialization of the 11625 * variables. 11626 */ 11627 sa = 1; 11628 } 11629 11630 /* 11631 * Update deviation estimator: 11632 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) 11633 */ 11634 if (m < 0) 11635 m = -m; 11636 m -= sv >> 2; 11637 sv += m; 11638 } else { 11639 /* 11640 * This follows BSD's implementation. So the reinitialized 11641 * RTO is 3 * m. We cannot go less than 2 because if the 11642 * link is bandwidth dominated, doubling the window size 11643 * during slow start means doubling the RTT. We want to be 11644 * more conservative when we reinitialize our estimates. 3 11645 * is just a convenient number. 11646 */ 11647 sa = m << 3; 11648 sv = m << 1; 11649 } 11650 if (sv < TCP_SD_MIN) { 11651 /* 11652 * We do not know that if sa captures the delay ACK 11653 * effect as in a long train of segments, a receiver 11654 * does not delay its ACKs. So set the minimum of sv 11655 * to be TCP_SD_MIN, which is default to 400 ms, twice 11656 * of BSD DATO. That means the minimum of mean 11657 * deviation is 100 ms. 11658 * 11659 */ 11660 sv = TCP_SD_MIN; 11661 } 11662 tcp->tcp_rtt_sa = sa; 11663 tcp->tcp_rtt_sd = sv; 11664 /* 11665 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) 11666 * 11667 * Add tcp_rexmit_interval extra in case of extreme environment 11668 * where the algorithm fails to work. The default value of 11669 * tcp_rexmit_interval_extra should be 0. 11670 * 11671 * As we use a finer grained clock than BSD and update 11672 * RTO for every ACKs, add in another .25 of RTT to the 11673 * deviation of RTO to accomodate burstiness of 1/4 of 11674 * window size. 11675 */ 11676 rto = (sa >> 3) + sv + tcp_rexmit_interval_extra + (sa >> 5); 11677 11678 if (rto > tcp_rexmit_interval_max) { 11679 tcp->tcp_rto = tcp_rexmit_interval_max; 11680 } else if (rto < tcp_rexmit_interval_min) { 11681 tcp->tcp_rto = tcp_rexmit_interval_min; 11682 } else { 11683 tcp->tcp_rto = rto; 11684 } 11685 11686 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 11687 tcp->tcp_timer_backoff = 0; 11688 } 11689 11690 /* 11691 * tcp_get_seg_mp() is called to get the pointer to a segment in the 11692 * send queue which starts at the given seq. no. 11693 * 11694 * Parameters: 11695 * tcp_t *tcp: the tcp instance pointer. 11696 * uint32_t seq: the starting seq. no of the requested segment. 11697 * int32_t *off: after the execution, *off will be the offset to 11698 * the returned mblk which points to the requested seq no. 11699 * It is the caller's responsibility to send in a non-null off. 11700 * 11701 * Return: 11702 * A mblk_t pointer pointing to the requested segment in send queue. 11703 */ 11704 static mblk_t * 11705 tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off) 11706 { 11707 int32_t cnt; 11708 mblk_t *mp; 11709 11710 /* Defensive coding. Make sure we don't send incorrect data. */ 11711 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 11712 return (NULL); 11713 11714 cnt = seq - tcp->tcp_suna; 11715 mp = tcp->tcp_xmit_head; 11716 while (cnt > 0 && mp != NULL) { 11717 cnt -= mp->b_wptr - mp->b_rptr; 11718 if (cnt < 0) { 11719 cnt += mp->b_wptr - mp->b_rptr; 11720 break; 11721 } 11722 mp = mp->b_cont; 11723 } 11724 ASSERT(mp != NULL); 11725 *off = cnt; 11726 return (mp); 11727 } 11728 11729 /* 11730 * This function handles all retransmissions if SACK is enabled for this 11731 * connection. First it calculates how many segments can be retransmitted 11732 * based on tcp_pipe. Then it goes thru the notsack list to find eligible 11733 * segments. A segment is eligible if sack_cnt for that segment is greater 11734 * than or equal tcp_dupack_fast_retransmit. After it has retransmitted 11735 * all eligible segments, it checks to see if TCP can send some new segments 11736 * (fast recovery). If it can, set the appropriate flag for tcp_rput_data(). 11737 * 11738 * Parameters: 11739 * tcp_t *tcp: the tcp structure of the connection. 11740 * uint_t *flags: in return, appropriate value will be set for 11741 * tcp_rput_data(). 11742 */ 11743 static void 11744 tcp_sack_rxmit(tcp_t *tcp, uint_t *flags) 11745 { 11746 notsack_blk_t *notsack_blk; 11747 int32_t usable_swnd; 11748 int32_t mss; 11749 uint32_t seg_len; 11750 mblk_t *xmit_mp; 11751 11752 ASSERT(tcp->tcp_sack_info != NULL); 11753 ASSERT(tcp->tcp_notsack_list != NULL); 11754 ASSERT(tcp->tcp_rexmit == B_FALSE); 11755 11756 /* Defensive coding in case there is a bug... */ 11757 if (tcp->tcp_notsack_list == NULL) { 11758 return; 11759 } 11760 notsack_blk = tcp->tcp_notsack_list; 11761 mss = tcp->tcp_mss; 11762 11763 /* 11764 * Limit the num of outstanding data in the network to be 11765 * tcp_cwnd_ssthresh, which is half of the original congestion wnd. 11766 */ 11767 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 11768 11769 /* At least retransmit 1 MSS of data. */ 11770 if (usable_swnd <= 0) { 11771 usable_swnd = mss; 11772 } 11773 11774 /* Make sure no new RTT samples will be taken. */ 11775 tcp->tcp_csuna = tcp->tcp_snxt; 11776 11777 notsack_blk = tcp->tcp_notsack_list; 11778 while (usable_swnd > 0) { 11779 mblk_t *snxt_mp, *tmp_mp; 11780 tcp_seq begin = tcp->tcp_sack_snxt; 11781 tcp_seq end; 11782 int32_t off; 11783 11784 for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) { 11785 if (SEQ_GT(notsack_blk->end, begin) && 11786 (notsack_blk->sack_cnt >= 11787 tcp_dupack_fast_retransmit)) { 11788 end = notsack_blk->end; 11789 if (SEQ_LT(begin, notsack_blk->begin)) { 11790 begin = notsack_blk->begin; 11791 } 11792 break; 11793 } 11794 } 11795 /* 11796 * All holes are filled. Manipulate tcp_cwnd to send more 11797 * if we can. Note that after the SACK recovery, tcp_cwnd is 11798 * set to tcp_cwnd_ssthresh. 11799 */ 11800 if (notsack_blk == NULL) { 11801 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 11802 if (usable_swnd <= 0 || tcp->tcp_unsent == 0) { 11803 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna; 11804 ASSERT(tcp->tcp_cwnd > 0); 11805 return; 11806 } else { 11807 usable_swnd = usable_swnd / mss; 11808 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna + 11809 MAX(usable_swnd * mss, mss); 11810 *flags |= TH_XMIT_NEEDED; 11811 return; 11812 } 11813 } 11814 11815 /* 11816 * Note that we may send more than usable_swnd allows here 11817 * because of round off, but no more than 1 MSS of data. 11818 */ 11819 seg_len = end - begin; 11820 if (seg_len > mss) 11821 seg_len = mss; 11822 snxt_mp = tcp_get_seg_mp(tcp, begin, &off); 11823 ASSERT(snxt_mp != NULL); 11824 /* This should not happen. Defensive coding again... */ 11825 if (snxt_mp == NULL) { 11826 return; 11827 } 11828 11829 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off, 11830 &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE); 11831 if (xmit_mp == NULL) 11832 return; 11833 11834 usable_swnd -= seg_len; 11835 tcp->tcp_pipe += seg_len; 11836 tcp->tcp_sack_snxt = begin + seg_len; 11837 TCP_RECORD_TRACE(tcp, xmit_mp, TCP_TRACE_SEND_PKT); 11838 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 11839 11840 /* 11841 * Update the send timestamp to avoid false retransmission. 11842 */ 11843 snxt_mp->b_prev = (mblk_t *)lbolt; 11844 11845 BUMP_MIB(&tcp_mib, tcpRetransSegs); 11846 UPDATE_MIB(&tcp_mib, tcpRetransBytes, seg_len); 11847 BUMP_MIB(&tcp_mib, tcpOutSackRetransSegs); 11848 /* 11849 * Update tcp_rexmit_max to extend this SACK recovery phase. 11850 * This happens when new data sent during fast recovery is 11851 * also lost. If TCP retransmits those new data, it needs 11852 * to extend SACK recover phase to avoid starting another 11853 * fast retransmit/recovery unnecessarily. 11854 */ 11855 if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) { 11856 tcp->tcp_rexmit_max = tcp->tcp_sack_snxt; 11857 } 11858 } 11859 } 11860 11861 /* 11862 * This function handles policy checking at TCP level for non-hard_bound/ 11863 * detached connections. 11864 */ 11865 static boolean_t 11866 tcp_check_policy(tcp_t *tcp, mblk_t *first_mp, ipha_t *ipha, ip6_t *ip6h, 11867 boolean_t secure, boolean_t mctl_present) 11868 { 11869 ipsec_latch_t *ipl = NULL; 11870 ipsec_action_t *act = NULL; 11871 mblk_t *data_mp; 11872 ipsec_in_t *ii; 11873 const char *reason; 11874 kstat_named_t *counter; 11875 11876 ASSERT(mctl_present || !secure); 11877 11878 ASSERT((ipha == NULL && ip6h != NULL) || 11879 (ip6h == NULL && ipha != NULL)); 11880 11881 /* 11882 * We don't necessarily have an ipsec_in_act action to verify 11883 * policy because of assymetrical policy where we have only 11884 * outbound policy and no inbound policy (possible with global 11885 * policy). 11886 */ 11887 if (!secure) { 11888 if (act == NULL || act->ipa_act.ipa_type == IPSEC_ACT_BYPASS || 11889 act->ipa_act.ipa_type == IPSEC_ACT_CLEAR) 11890 return (B_TRUE); 11891 ipsec_log_policy_failure(tcp->tcp_wq, IPSEC_POLICY_MISMATCH, 11892 "tcp_check_policy", ipha, ip6h, secure); 11893 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 11894 &ipdrops_tcp_clear, &tcp_dropper); 11895 return (B_FALSE); 11896 } 11897 11898 /* 11899 * We have a secure packet. 11900 */ 11901 if (act == NULL) { 11902 ipsec_log_policy_failure(tcp->tcp_wq, 11903 IPSEC_POLICY_NOT_NEEDED, "tcp_check_policy", ipha, ip6h, 11904 secure); 11905 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 11906 &ipdrops_tcp_secure, &tcp_dropper); 11907 return (B_FALSE); 11908 } 11909 11910 /* 11911 * XXX This whole routine is currently incorrect. ipl should 11912 * be set to the latch pointer, but is currently not set, so 11913 * we initialize it to NULL to avoid picking up random garbage. 11914 */ 11915 if (ipl == NULL) 11916 return (B_TRUE); 11917 11918 data_mp = first_mp->b_cont; 11919 11920 ii = (ipsec_in_t *)first_mp->b_rptr; 11921 11922 if (ipsec_check_ipsecin_latch(ii, data_mp, ipl, ipha, ip6h, &reason, 11923 &counter)) { 11924 BUMP_MIB(&ip_mib, ipsecInSucceeded); 11925 return (B_TRUE); 11926 } 11927 (void) strlog(TCP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE, 11928 "tcp inbound policy mismatch: %s, packet dropped\n", 11929 reason); 11930 BUMP_MIB(&ip_mib, ipsecInFailed); 11931 11932 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter, &tcp_dropper); 11933 return (B_FALSE); 11934 } 11935 11936 /* 11937 * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start 11938 * retransmission after a timeout. 11939 * 11940 * To limit the number of duplicate segments, we limit the number of segment 11941 * to be sent in one time to tcp_snd_burst, the burst variable. 11942 */ 11943 static void 11944 tcp_ss_rexmit(tcp_t *tcp) 11945 { 11946 uint32_t snxt; 11947 uint32_t smax; 11948 int32_t win; 11949 int32_t mss; 11950 int32_t off; 11951 int32_t burst = tcp->tcp_snd_burst; 11952 mblk_t *snxt_mp; 11953 11954 /* 11955 * Note that tcp_rexmit can be set even though TCP has retransmitted 11956 * all unack'ed segments. 11957 */ 11958 if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) { 11959 smax = tcp->tcp_rexmit_max; 11960 snxt = tcp->tcp_rexmit_nxt; 11961 if (SEQ_LT(snxt, tcp->tcp_suna)) { 11962 snxt = tcp->tcp_suna; 11963 } 11964 win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd); 11965 win -= snxt - tcp->tcp_suna; 11966 mss = tcp->tcp_mss; 11967 snxt_mp = tcp_get_seg_mp(tcp, snxt, &off); 11968 11969 while (SEQ_LT(snxt, smax) && (win > 0) && 11970 (burst > 0) && (snxt_mp != NULL)) { 11971 mblk_t *xmit_mp; 11972 mblk_t *old_snxt_mp = snxt_mp; 11973 uint32_t cnt = mss; 11974 11975 if (win < cnt) { 11976 cnt = win; 11977 } 11978 if (SEQ_GT(snxt + cnt, smax)) { 11979 cnt = smax - snxt; 11980 } 11981 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off, 11982 &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE); 11983 if (xmit_mp == NULL) 11984 return; 11985 11986 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 11987 11988 snxt += cnt; 11989 win -= cnt; 11990 /* 11991 * Update the send timestamp to avoid false 11992 * retransmission. 11993 */ 11994 old_snxt_mp->b_prev = (mblk_t *)lbolt; 11995 BUMP_MIB(&tcp_mib, tcpRetransSegs); 11996 UPDATE_MIB(&tcp_mib, tcpRetransBytes, cnt); 11997 11998 tcp->tcp_rexmit_nxt = snxt; 11999 burst--; 12000 } 12001 /* 12002 * If we have transmitted all we have at the time 12003 * we started the retranmission, we can leave 12004 * the rest of the job to tcp_wput_data(). But we 12005 * need to check the send window first. If the 12006 * win is not 0, go on with tcp_wput_data(). 12007 */ 12008 if (SEQ_LT(snxt, smax) || win == 0) { 12009 return; 12010 } 12011 } 12012 /* Only call tcp_wput_data() if there is data to be sent. */ 12013 if (tcp->tcp_unsent) { 12014 tcp_wput_data(tcp, NULL, B_FALSE); 12015 } 12016 } 12017 12018 /* 12019 * Process all TCP option in SYN segment. Note that this function should 12020 * be called after tcp_adapt_ire() is called so that the necessary info 12021 * from IRE is already set in the tcp structure. 12022 * 12023 * This function sets up the correct tcp_mss value according to the 12024 * MSS option value and our header size. It also sets up the window scale 12025 * and timestamp values, and initialize SACK info blocks. But it does not 12026 * change receive window size after setting the tcp_mss value. The caller 12027 * should do the appropriate change. 12028 */ 12029 void 12030 tcp_process_options(tcp_t *tcp, tcph_t *tcph) 12031 { 12032 int options; 12033 tcp_opt_t tcpopt; 12034 uint32_t mss_max; 12035 char *tmp_tcph; 12036 12037 tcpopt.tcp = NULL; 12038 options = tcp_parse_options(tcph, &tcpopt); 12039 12040 /* 12041 * Process MSS option. Note that MSS option value does not account 12042 * for IP or TCP options. This means that it is equal to MTU - minimum 12043 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 12044 * IPv6. 12045 */ 12046 if (!(options & TCP_OPT_MSS_PRESENT)) { 12047 if (tcp->tcp_ipversion == IPV4_VERSION) 12048 tcpopt.tcp_opt_mss = tcp_mss_def_ipv4; 12049 else 12050 tcpopt.tcp_opt_mss = tcp_mss_def_ipv6; 12051 } else { 12052 if (tcp->tcp_ipversion == IPV4_VERSION) 12053 mss_max = tcp_mss_max_ipv4; 12054 else 12055 mss_max = tcp_mss_max_ipv6; 12056 if (tcpopt.tcp_opt_mss < tcp_mss_min) 12057 tcpopt.tcp_opt_mss = tcp_mss_min; 12058 else if (tcpopt.tcp_opt_mss > mss_max) 12059 tcpopt.tcp_opt_mss = mss_max; 12060 } 12061 12062 /* Process Window Scale option. */ 12063 if (options & TCP_OPT_WSCALE_PRESENT) { 12064 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 12065 tcp->tcp_snd_ws_ok = B_TRUE; 12066 } else { 12067 tcp->tcp_snd_ws = B_FALSE; 12068 tcp->tcp_snd_ws_ok = B_FALSE; 12069 tcp->tcp_rcv_ws = B_FALSE; 12070 } 12071 12072 /* Process Timestamp option. */ 12073 if ((options & TCP_OPT_TSTAMP_PRESENT) && 12074 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 12075 tmp_tcph = (char *)tcp->tcp_tcph; 12076 12077 tcp->tcp_snd_ts_ok = B_TRUE; 12078 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 12079 tcp->tcp_last_rcv_lbolt = lbolt64; 12080 ASSERT(OK_32PTR(tmp_tcph)); 12081 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 12082 12083 /* Fill in our template header with basic timestamp option. */ 12084 tmp_tcph += tcp->tcp_tcp_hdr_len; 12085 tmp_tcph[0] = TCPOPT_NOP; 12086 tmp_tcph[1] = TCPOPT_NOP; 12087 tmp_tcph[2] = TCPOPT_TSTAMP; 12088 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 12089 tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12090 tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12091 tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4); 12092 } else { 12093 tcp->tcp_snd_ts_ok = B_FALSE; 12094 } 12095 12096 /* 12097 * Process SACK options. If SACK is enabled for this connection, 12098 * then allocate the SACK info structure. Note the following ways 12099 * when tcp_snd_sack_ok is set to true. 12100 * 12101 * For active connection: in tcp_adapt_ire() called in 12102 * tcp_rput_other(), or in tcp_rput_other() when tcp_sack_permitted 12103 * is checked. 12104 * 12105 * For passive connection: in tcp_adapt_ire() called in 12106 * tcp_accept_comm(). 12107 * 12108 * That's the reason why the extra TCP_IS_DETACHED() check is there. 12109 * That check makes sure that if we did not send a SACK OK option, 12110 * we will not enable SACK for this connection even though the other 12111 * side sends us SACK OK option. For active connection, the SACK 12112 * info structure has already been allocated. So we need to free 12113 * it if SACK is disabled. 12114 */ 12115 if ((options & TCP_OPT_SACK_OK_PRESENT) && 12116 (tcp->tcp_snd_sack_ok || 12117 (tcp_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 12118 /* This should be true only in the passive case. */ 12119 if (tcp->tcp_sack_info == NULL) { 12120 ASSERT(TCP_IS_DETACHED(tcp)); 12121 tcp->tcp_sack_info = 12122 kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP); 12123 } 12124 if (tcp->tcp_sack_info == NULL) { 12125 tcp->tcp_snd_sack_ok = B_FALSE; 12126 } else { 12127 tcp->tcp_snd_sack_ok = B_TRUE; 12128 if (tcp->tcp_snd_ts_ok) { 12129 tcp->tcp_max_sack_blk = 3; 12130 } else { 12131 tcp->tcp_max_sack_blk = 4; 12132 } 12133 } 12134 } else { 12135 /* 12136 * Resetting tcp_snd_sack_ok to B_FALSE so that 12137 * no SACK info will be used for this 12138 * connection. This assumes that SACK usage 12139 * permission is negotiated. This may need 12140 * to be changed once this is clarified. 12141 */ 12142 if (tcp->tcp_sack_info != NULL) { 12143 ASSERT(tcp->tcp_notsack_list == NULL); 12144 kmem_cache_free(tcp_sack_info_cache, 12145 tcp->tcp_sack_info); 12146 tcp->tcp_sack_info = NULL; 12147 } 12148 tcp->tcp_snd_sack_ok = B_FALSE; 12149 } 12150 12151 /* 12152 * Now we know the exact TCP/IP header length, subtract 12153 * that from tcp_mss to get our side's MSS. 12154 */ 12155 tcp->tcp_mss -= tcp->tcp_hdr_len; 12156 /* 12157 * Here we assume that the other side's header size will be equal to 12158 * our header size. We calculate the real MSS accordingly. Need to 12159 * take into additional stuffs IPsec puts in. 12160 * 12161 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 12162 */ 12163 tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len + tcp->tcp_ipsec_overhead - 12164 ((tcp->tcp_ipversion == IPV4_VERSION ? 12165 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 12166 12167 /* 12168 * Set MSS to the smaller one of both ends of the connection. 12169 * We should not have called tcp_mss_set() before, but our 12170 * side of the MSS should have been set to a proper value 12171 * by tcp_adapt_ire(). tcp_mss_set() will also set up the 12172 * STREAM head parameters properly. 12173 * 12174 * If we have a larger-than-16-bit window but the other side 12175 * didn't want to do window scale, tcp_rwnd_set() will take 12176 * care of that. 12177 */ 12178 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 12179 } 12180 12181 /* 12182 * Sends the T_CONN_IND to the listener. The caller calls this 12183 * functions via squeue to get inside the listener's perimeter 12184 * once the 3 way hand shake is done a T_CONN_IND needs to be 12185 * sent. As an optimization, the caller can call this directly 12186 * if listener's perimeter is same as eager's. 12187 */ 12188 /* ARGSUSED */ 12189 void 12190 tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2) 12191 { 12192 conn_t *lconnp = (conn_t *)arg; 12193 tcp_t *listener = lconnp->conn_tcp; 12194 tcp_t *tcp; 12195 struct T_conn_ind *conn_ind; 12196 ipaddr_t *addr_cache; 12197 boolean_t need_send_conn_ind = B_FALSE; 12198 12199 /* retrieve the eager */ 12200 conn_ind = (struct T_conn_ind *)mp->b_rptr; 12201 ASSERT(conn_ind->OPT_offset != 0 && 12202 conn_ind->OPT_length == sizeof (intptr_t)); 12203 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 12204 conn_ind->OPT_length); 12205 12206 /* 12207 * TLI/XTI applications will get confused by 12208 * sending eager as an option since it violates 12209 * the option semantics. So remove the eager as 12210 * option since TLI/XTI app doesn't need it anyway. 12211 */ 12212 if (!TCP_IS_SOCKET(listener)) { 12213 conn_ind->OPT_length = 0; 12214 conn_ind->OPT_offset = 0; 12215 } 12216 if (listener->tcp_state == TCPS_CLOSED || 12217 TCP_IS_DETACHED(listener)) { 12218 /* 12219 * If listener has closed, it would have caused a 12220 * a cleanup/blowoff to happen for the eager. We 12221 * just need to return. 12222 */ 12223 freemsg(mp); 12224 return; 12225 } 12226 12227 12228 /* 12229 * if the conn_req_q is full defer passing up the 12230 * T_CONN_IND until space is availabe after t_accept() 12231 * processing 12232 */ 12233 mutex_enter(&listener->tcp_eager_lock); 12234 if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) { 12235 tcp_t *tail; 12236 12237 /* 12238 * The eager already has an extra ref put in tcp_rput_data 12239 * so that it stays till accept comes back even though it 12240 * might get into TCPS_CLOSED as a result of a TH_RST etc. 12241 */ 12242 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 12243 listener->tcp_conn_req_cnt_q0--; 12244 listener->tcp_conn_req_cnt_q++; 12245 12246 /* Move from SYN_RCVD to ESTABLISHED list */ 12247 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12248 tcp->tcp_eager_prev_q0; 12249 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12250 tcp->tcp_eager_next_q0; 12251 tcp->tcp_eager_prev_q0 = NULL; 12252 tcp->tcp_eager_next_q0 = NULL; 12253 12254 /* 12255 * Insert at end of the queue because sockfs 12256 * sends down T_CONN_RES in chronological 12257 * order. Leaving the older conn indications 12258 * at front of the queue helps reducing search 12259 * time. 12260 */ 12261 tail = listener->tcp_eager_last_q; 12262 if (tail != NULL) 12263 tail->tcp_eager_next_q = tcp; 12264 else 12265 listener->tcp_eager_next_q = tcp; 12266 listener->tcp_eager_last_q = tcp; 12267 tcp->tcp_eager_next_q = NULL; 12268 /* 12269 * Delay sending up the T_conn_ind until we are 12270 * done with the eager. Once we have have sent up 12271 * the T_conn_ind, the accept can potentially complete 12272 * any time and release the refhold we have on the eager. 12273 */ 12274 need_send_conn_ind = B_TRUE; 12275 } else { 12276 /* 12277 * Defer connection on q0 and set deferred 12278 * connection bit true 12279 */ 12280 tcp->tcp_conn_def_q0 = B_TRUE; 12281 12282 /* take tcp out of q0 ... */ 12283 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12284 tcp->tcp_eager_next_q0; 12285 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12286 tcp->tcp_eager_prev_q0; 12287 12288 /* ... and place it at the end of q0 */ 12289 tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0; 12290 tcp->tcp_eager_next_q0 = listener; 12291 listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp; 12292 listener->tcp_eager_prev_q0 = tcp; 12293 tcp->tcp_conn.tcp_eager_conn_ind = mp; 12294 } 12295 12296 /* we have timed out before */ 12297 if (tcp->tcp_syn_rcvd_timeout != 0) { 12298 tcp->tcp_syn_rcvd_timeout = 0; 12299 listener->tcp_syn_rcvd_timeout--; 12300 if (listener->tcp_syn_defense && 12301 listener->tcp_syn_rcvd_timeout <= 12302 (tcp_conn_req_max_q0 >> 5) && 12303 10*MINUTES < TICK_TO_MSEC(lbolt64 - 12304 listener->tcp_last_rcv_lbolt)) { 12305 /* 12306 * Turn off the defense mode if we 12307 * believe the SYN attack is over. 12308 */ 12309 listener->tcp_syn_defense = B_FALSE; 12310 if (listener->tcp_ip_addr_cache) { 12311 kmem_free((void *)listener->tcp_ip_addr_cache, 12312 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 12313 listener->tcp_ip_addr_cache = NULL; 12314 } 12315 } 12316 } 12317 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 12318 if (addr_cache != NULL) { 12319 /* 12320 * We have finished a 3-way handshake with this 12321 * remote host. This proves the IP addr is good. 12322 * Cache it! 12323 */ 12324 addr_cache[IP_ADDR_CACHE_HASH( 12325 tcp->tcp_remote)] = tcp->tcp_remote; 12326 } 12327 mutex_exit(&listener->tcp_eager_lock); 12328 if (need_send_conn_ind) 12329 putnext(listener->tcp_rq, mp); 12330 } 12331 12332 mblk_t * 12333 tcp_find_pktinfo(tcp_t *tcp, mblk_t *mp, uint_t *ipversp, uint_t *ip_hdr_lenp, 12334 uint_t *ifindexp, ip6_pkt_t *ippp) 12335 { 12336 in_pktinfo_t *pinfo; 12337 ip6_t *ip6h; 12338 uchar_t *rptr; 12339 mblk_t *first_mp = mp; 12340 boolean_t mctl_present = B_FALSE; 12341 uint_t ifindex = 0; 12342 ip6_pkt_t ipp; 12343 uint_t ipvers; 12344 uint_t ip_hdr_len; 12345 12346 rptr = mp->b_rptr; 12347 ASSERT(OK_32PTR(rptr)); 12348 ASSERT(tcp != NULL); 12349 ipp.ipp_fields = 0; 12350 12351 switch DB_TYPE(mp) { 12352 case M_CTL: 12353 mp = mp->b_cont; 12354 if (mp == NULL) { 12355 freemsg(first_mp); 12356 return (NULL); 12357 } 12358 if (DB_TYPE(mp) != M_DATA) { 12359 freemsg(first_mp); 12360 return (NULL); 12361 } 12362 mctl_present = B_TRUE; 12363 break; 12364 case M_DATA: 12365 break; 12366 default: 12367 cmn_err(CE_NOTE, "tcp_find_pktinfo: unknown db_type"); 12368 freemsg(mp); 12369 return (NULL); 12370 } 12371 ipvers = IPH_HDR_VERSION(rptr); 12372 if (ipvers == IPV4_VERSION) { 12373 if (tcp == NULL) { 12374 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12375 goto done; 12376 } 12377 12378 ipp.ipp_fields |= IPPF_HOPLIMIT; 12379 ipp.ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl; 12380 12381 /* 12382 * If we have IN_PKTINFO in an M_CTL and tcp_ipv6_recvancillary 12383 * has TCP_IPV6_RECVPKTINFO set, pass I/F index along in ipp. 12384 */ 12385 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) && 12386 mctl_present) { 12387 pinfo = (in_pktinfo_t *)first_mp->b_rptr; 12388 if ((MBLKL(first_mp) == sizeof (in_pktinfo_t)) && 12389 (pinfo->in_pkt_ulp_type == IN_PKTINFO) && 12390 (pinfo->in_pkt_flags & IPF_RECVIF)) { 12391 ipp.ipp_fields |= IPPF_IFINDEX; 12392 ipp.ipp_ifindex = pinfo->in_pkt_ifindex; 12393 ifindex = pinfo->in_pkt_ifindex; 12394 } 12395 freeb(first_mp); 12396 mctl_present = B_FALSE; 12397 } 12398 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12399 } else { 12400 ip6h = (ip6_t *)rptr; 12401 12402 ASSERT(ipvers == IPV6_VERSION); 12403 ipp.ipp_fields = IPPF_HOPLIMIT | IPPF_TCLASS; 12404 ipp.ipp_tclass = (ip6h->ip6_flow & 0x0FF00000) >> 20; 12405 ipp.ipp_hoplimit = ip6h->ip6_hops; 12406 12407 if (ip6h->ip6_nxt != IPPROTO_TCP) { 12408 uint8_t nexthdrp; 12409 12410 /* Look for ifindex information */ 12411 if (ip6h->ip6_nxt == IPPROTO_RAW) { 12412 ip6i_t *ip6i = (ip6i_t *)ip6h; 12413 if ((uchar_t *)&ip6i[1] > mp->b_wptr) { 12414 BUMP_MIB(&ip_mib, tcpInErrs); 12415 freemsg(first_mp); 12416 return (NULL); 12417 } 12418 12419 if (ip6i->ip6i_flags & IP6I_IFINDEX) { 12420 ASSERT(ip6i->ip6i_ifindex != 0); 12421 ipp.ipp_fields |= IPPF_IFINDEX; 12422 ipp.ipp_ifindex = ip6i->ip6i_ifindex; 12423 ifindex = ip6i->ip6i_ifindex; 12424 } 12425 rptr = (uchar_t *)&ip6i[1]; 12426 mp->b_rptr = rptr; 12427 if (rptr == mp->b_wptr) { 12428 mblk_t *mp1; 12429 mp1 = mp->b_cont; 12430 freeb(mp); 12431 mp = mp1; 12432 rptr = mp->b_rptr; 12433 } 12434 if (MBLKL(mp) < IPV6_HDR_LEN + 12435 sizeof (tcph_t)) { 12436 BUMP_MIB(&ip_mib, tcpInErrs); 12437 freemsg(first_mp); 12438 return (NULL); 12439 } 12440 ip6h = (ip6_t *)rptr; 12441 } 12442 12443 /* 12444 * Find any potentially interesting extension headers 12445 * as well as the length of the IPv6 + extension 12446 * headers. 12447 */ 12448 ip_hdr_len = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp); 12449 /* Verify if this is a TCP packet */ 12450 if (nexthdrp != IPPROTO_TCP) { 12451 BUMP_MIB(&ip_mib, tcpInErrs); 12452 freemsg(first_mp); 12453 return (NULL); 12454 } 12455 } else { 12456 ip_hdr_len = IPV6_HDR_LEN; 12457 } 12458 } 12459 12460 done: 12461 if (ipversp != NULL) 12462 *ipversp = ipvers; 12463 if (ip_hdr_lenp != NULL) 12464 *ip_hdr_lenp = ip_hdr_len; 12465 if (ippp != NULL) 12466 *ippp = ipp; 12467 if (ifindexp != NULL) 12468 *ifindexp = ifindex; 12469 if (mctl_present) { 12470 freeb(first_mp); 12471 } 12472 return (mp); 12473 } 12474 12475 /* 12476 * Handle M_DATA messages from IP. Its called directly from IP via 12477 * squeue for AF_INET type sockets fast path. No M_CTL are expected 12478 * in this path. 12479 * 12480 * For everything else (including AF_INET6 sockets with 'tcp_ipversion' 12481 * v4 and v6), we are called through tcp_input() and a M_CTL can 12482 * be present for options but tcp_find_pktinfo() deals with it. We 12483 * only expect M_DATA packets after tcp_find_pktinfo() is done. 12484 * 12485 * The first argument is always the connp/tcp to which the mp belongs. 12486 * There are no exceptions to this rule. The caller has already put 12487 * a reference on this connp/tcp and once tcp_rput_data() returns, 12488 * the squeue will do the refrele. 12489 * 12490 * The TH_SYN for the listener directly go to tcp_conn_request via 12491 * squeue. 12492 * 12493 * sqp: NULL = recursive, sqp != NULL means called from squeue 12494 */ 12495 void 12496 tcp_rput_data(void *arg, mblk_t *mp, void *arg2) 12497 { 12498 int32_t bytes_acked; 12499 int32_t gap; 12500 mblk_t *mp1; 12501 uint_t flags; 12502 uint32_t new_swnd = 0; 12503 uchar_t *iphdr; 12504 uchar_t *rptr; 12505 int32_t rgap; 12506 uint32_t seg_ack; 12507 int seg_len; 12508 uint_t ip_hdr_len; 12509 uint32_t seg_seq; 12510 tcph_t *tcph; 12511 int urp; 12512 tcp_opt_t tcpopt; 12513 uint_t ipvers; 12514 ip6_pkt_t ipp; 12515 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 12516 uint32_t cwnd; 12517 uint32_t add; 12518 int npkt; 12519 int mss; 12520 conn_t *connp = (conn_t *)arg; 12521 squeue_t *sqp = (squeue_t *)arg2; 12522 tcp_t *tcp = connp->conn_tcp; 12523 12524 /* 12525 * RST from fused tcp loopback peer should trigger an unfuse. 12526 */ 12527 if (tcp->tcp_fused) { 12528 TCP_STAT(tcp_fusion_aborted); 12529 tcp_unfuse(tcp); 12530 } 12531 12532 iphdr = mp->b_rptr; 12533 rptr = mp->b_rptr; 12534 ASSERT(OK_32PTR(rptr)); 12535 12536 /* 12537 * An AF_INET socket is not capable of receiving any pktinfo. Do inline 12538 * processing here. For rest call tcp_find_pktinfo to fill up the 12539 * necessary information. 12540 */ 12541 if (IPCL_IS_TCP4(connp)) { 12542 ipvers = IPV4_VERSION; 12543 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12544 } else { 12545 mp = tcp_find_pktinfo(tcp, mp, &ipvers, &ip_hdr_len, 12546 NULL, &ipp); 12547 if (mp == NULL) { 12548 TCP_STAT(tcp_rput_v6_error); 12549 return; 12550 } 12551 iphdr = mp->b_rptr; 12552 rptr = mp->b_rptr; 12553 } 12554 ASSERT(DB_TYPE(mp) == M_DATA); 12555 12556 tcph = (tcph_t *)&rptr[ip_hdr_len]; 12557 seg_seq = ABE32_TO_U32(tcph->th_seq); 12558 seg_ack = ABE32_TO_U32(tcph->th_ack); 12559 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 12560 seg_len = (int)(mp->b_wptr - rptr) - 12561 (ip_hdr_len + TCP_HDR_LENGTH(tcph)); 12562 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 12563 do { 12564 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 12565 (uintptr_t)INT_MAX); 12566 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 12567 } while ((mp1 = mp1->b_cont) != NULL && 12568 mp1->b_datap->db_type == M_DATA); 12569 } 12570 12571 if (tcp->tcp_state == TCPS_TIME_WAIT) { 12572 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 12573 seg_len, tcph); 12574 return; 12575 } 12576 12577 if (sqp != NULL) { 12578 /* 12579 * This is the correct place to update tcp_last_recv_time. Note 12580 * that it is also updated for tcp structure that belongs to 12581 * global and listener queues which do not really need updating. 12582 * But that should not cause any harm. And it is updated for 12583 * all kinds of incoming segments, not only for data segments. 12584 */ 12585 tcp->tcp_last_recv_time = lbolt; 12586 } 12587 12588 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 12589 12590 BUMP_LOCAL(tcp->tcp_ibsegs); 12591 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 12592 12593 if ((flags & TH_URG) && sqp != NULL) { 12594 /* 12595 * TCP can't handle urgent pointers that arrive before 12596 * the connection has been accept()ed since it can't 12597 * buffer OOB data. Discard segment if this happens. 12598 * 12599 * Nor can it reassemble urgent pointers, so discard 12600 * if it's not the next segment expected. 12601 * 12602 * Otherwise, collapse chain into one mblk (discard if 12603 * that fails). This makes sure the headers, retransmitted 12604 * data, and new data all are in the same mblk. 12605 */ 12606 ASSERT(mp != NULL); 12607 if (tcp->tcp_listener || !pullupmsg(mp, -1)) { 12608 freemsg(mp); 12609 return; 12610 } 12611 /* Update pointers into message */ 12612 iphdr = rptr = mp->b_rptr; 12613 tcph = (tcph_t *)&rptr[ip_hdr_len]; 12614 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 12615 /* 12616 * Since we can't handle any data with this urgent 12617 * pointer that is out of sequence, we expunge 12618 * the data. This allows us to still register 12619 * the urgent mark and generate the M_PCSIG, 12620 * which we can do. 12621 */ 12622 mp->b_wptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 12623 seg_len = 0; 12624 } 12625 } 12626 12627 switch (tcp->tcp_state) { 12628 case TCPS_SYN_SENT: 12629 if (flags & TH_ACK) { 12630 /* 12631 * Note that our stack cannot send data before a 12632 * connection is established, therefore the 12633 * following check is valid. Otherwise, it has 12634 * to be changed. 12635 */ 12636 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 12637 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 12638 freemsg(mp); 12639 if (flags & TH_RST) 12640 return; 12641 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 12642 tcp, seg_ack, 0, TH_RST); 12643 return; 12644 } 12645 ASSERT(tcp->tcp_suna + 1 == seg_ack); 12646 } 12647 if (flags & TH_RST) { 12648 freemsg(mp); 12649 if (flags & TH_ACK) 12650 (void) tcp_clean_death(tcp, 12651 ECONNREFUSED, 13); 12652 return; 12653 } 12654 if (!(flags & TH_SYN)) { 12655 freemsg(mp); 12656 return; 12657 } 12658 12659 /* Process all TCP options. */ 12660 tcp_process_options(tcp, tcph); 12661 /* 12662 * The following changes our rwnd to be a multiple of the 12663 * MIN(peer MSS, our MSS) for performance reason. 12664 */ 12665 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rq->q_hiwat, 12666 tcp->tcp_mss)); 12667 12668 /* Is the other end ECN capable? */ 12669 if (tcp->tcp_ecn_ok) { 12670 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 12671 tcp->tcp_ecn_ok = B_FALSE; 12672 } 12673 } 12674 /* 12675 * Clear ECN flags because it may interfere with later 12676 * processing. 12677 */ 12678 flags &= ~(TH_ECE|TH_CWR); 12679 12680 tcp->tcp_irs = seg_seq; 12681 tcp->tcp_rack = seg_seq; 12682 tcp->tcp_rnxt = seg_seq + 1; 12683 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 12684 if (!TCP_IS_DETACHED(tcp)) { 12685 /* Allocate room for SACK options if needed. */ 12686 if (tcp->tcp_snd_sack_ok) { 12687 (void) mi_set_sth_wroff(tcp->tcp_rq, 12688 tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 12689 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 12690 } else { 12691 (void) mi_set_sth_wroff(tcp->tcp_rq, 12692 tcp->tcp_hdr_len + 12693 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 12694 } 12695 } 12696 if (flags & TH_ACK) { 12697 /* 12698 * If we can't get the confirmation upstream, pretend 12699 * we didn't even see this one. 12700 * 12701 * XXX: how can we pretend we didn't see it if we 12702 * have updated rnxt et. al. 12703 * 12704 * For loopback we defer sending up the T_CONN_CON 12705 * until after some checks below. 12706 */ 12707 mp1 = NULL; 12708 if (!tcp_conn_con(tcp, iphdr, tcph, mp, 12709 tcp->tcp_loopback ? &mp1 : NULL)) { 12710 freemsg(mp); 12711 return; 12712 } 12713 /* SYN was acked - making progress */ 12714 if (tcp->tcp_ipversion == IPV6_VERSION) 12715 tcp->tcp_ip_forward_progress = B_TRUE; 12716 12717 /* One for the SYN */ 12718 tcp->tcp_suna = tcp->tcp_iss + 1; 12719 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 12720 tcp->tcp_state = TCPS_ESTABLISHED; 12721 12722 /* 12723 * If SYN was retransmitted, need to reset all 12724 * retransmission info. This is because this 12725 * segment will be treated as a dup ACK. 12726 */ 12727 if (tcp->tcp_rexmit) { 12728 tcp->tcp_rexmit = B_FALSE; 12729 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 12730 tcp->tcp_rexmit_max = tcp->tcp_snxt; 12731 tcp->tcp_snd_burst = tcp->tcp_localnet ? 12732 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 12733 tcp->tcp_ms_we_have_waited = 0; 12734 12735 /* 12736 * Set tcp_cwnd back to 1 MSS, per 12737 * recommendation from 12738 * draft-floyd-incr-init-win-01.txt, 12739 * Increasing TCP's Initial Window. 12740 */ 12741 tcp->tcp_cwnd = tcp->tcp_mss; 12742 } 12743 12744 tcp->tcp_swl1 = seg_seq; 12745 tcp->tcp_swl2 = seg_ack; 12746 12747 new_swnd = BE16_TO_U16(tcph->th_win); 12748 tcp->tcp_swnd = new_swnd; 12749 if (new_swnd > tcp->tcp_max_swnd) 12750 tcp->tcp_max_swnd = new_swnd; 12751 12752 /* 12753 * Always send the three-way handshake ack immediately 12754 * in order to make the connection complete as soon as 12755 * possible on the accepting host. 12756 */ 12757 flags |= TH_ACK_NEEDED; 12758 12759 /* 12760 * Special case for loopback. At this point we have 12761 * received SYN-ACK from the remote endpoint. In 12762 * order to ensure that both endpoints reach the 12763 * fused state prior to any data exchange, the final 12764 * ACK needs to be sent before we indicate T_CONN_CON 12765 * to the module upstream. 12766 */ 12767 if (tcp->tcp_loopback) { 12768 mblk_t *ack_mp; 12769 12770 ASSERT(!tcp->tcp_unfusable); 12771 ASSERT(mp1 != NULL); 12772 /* 12773 * For loopback, we always get a pure SYN-ACK 12774 * and only need to send back the final ACK 12775 * with no data (this is because the other 12776 * tcp is ours and we don't do T/TCP). This 12777 * final ACK triggers the passive side to 12778 * perform fusion in ESTABLISHED state. 12779 */ 12780 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 12781 if (tcp->tcp_ack_tid != 0) { 12782 (void) TCP_TIMER_CANCEL(tcp, 12783 tcp->tcp_ack_tid); 12784 tcp->tcp_ack_tid = 0; 12785 } 12786 TCP_RECORD_TRACE(tcp, ack_mp, 12787 TCP_TRACE_SEND_PKT); 12788 tcp_send_data(tcp, tcp->tcp_wq, ack_mp); 12789 BUMP_LOCAL(tcp->tcp_obsegs); 12790 BUMP_MIB(&tcp_mib, tcpOutAck); 12791 12792 /* Send up T_CONN_CON */ 12793 putnext(tcp->tcp_rq, mp1); 12794 12795 freemsg(mp); 12796 return; 12797 } 12798 /* 12799 * Forget fusion; we need to handle more 12800 * complex cases below. Send the deferred 12801 * T_CONN_CON message upstream and proceed 12802 * as usual. Mark this tcp as not capable 12803 * of fusion. 12804 */ 12805 TCP_STAT(tcp_fusion_unfusable); 12806 tcp->tcp_unfusable = B_TRUE; 12807 putnext(tcp->tcp_rq, mp1); 12808 } 12809 12810 /* 12811 * Check to see if there is data to be sent. If 12812 * yes, set the transmit flag. Then check to see 12813 * if received data processing needs to be done. 12814 * If not, go straight to xmit_check. This short 12815 * cut is OK as we don't support T/TCP. 12816 */ 12817 if (tcp->tcp_unsent) 12818 flags |= TH_XMIT_NEEDED; 12819 12820 if (seg_len == 0 && !(flags & TH_URG)) { 12821 freemsg(mp); 12822 goto xmit_check; 12823 } 12824 12825 flags &= ~TH_SYN; 12826 seg_seq++; 12827 break; 12828 } 12829 tcp->tcp_state = TCPS_SYN_RCVD; 12830 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 12831 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 12832 if (mp1) { 12833 DB_CPID(mp1) = tcp->tcp_cpid; 12834 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 12835 tcp_send_data(tcp, tcp->tcp_wq, mp1); 12836 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 12837 } 12838 freemsg(mp); 12839 return; 12840 case TCPS_SYN_RCVD: 12841 if (flags & TH_ACK) { 12842 /* 12843 * In this state, a SYN|ACK packet is either bogus 12844 * because the other side must be ACKing our SYN which 12845 * indicates it has seen the ACK for their SYN and 12846 * shouldn't retransmit it or we're crossing SYNs 12847 * on active open. 12848 */ 12849 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 12850 freemsg(mp); 12851 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 12852 tcp, seg_ack, 0, TH_RST); 12853 return; 12854 } 12855 /* 12856 * NOTE: RFC 793 pg. 72 says this should be 12857 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 12858 * but that would mean we have an ack that ignored 12859 * our SYN. 12860 */ 12861 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 12862 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 12863 freemsg(mp); 12864 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 12865 tcp, seg_ack, 0, TH_RST); 12866 return; 12867 } 12868 } 12869 break; 12870 case TCPS_LISTEN: 12871 /* 12872 * Only a TLI listener can come through this path when a 12873 * acceptor is going back to be a listener and a packet 12874 * for the acceptor hits the classifier. For a socket 12875 * listener, this can never happen because a listener 12876 * can never accept connection on itself and hence a 12877 * socket acceptor can not go back to being a listener. 12878 */ 12879 ASSERT(!TCP_IS_SOCKET(tcp)); 12880 /*FALLTHRU*/ 12881 case TCPS_CLOSED: 12882 case TCPS_BOUND: { 12883 conn_t *new_connp; 12884 12885 new_connp = ipcl_classify(mp, connp->conn_zoneid); 12886 if (new_connp != NULL) { 12887 tcp_reinput(new_connp, mp, connp->conn_sqp); 12888 return; 12889 } 12890 /* We failed to classify. For now just drop the packet */ 12891 freemsg(mp); 12892 return; 12893 } 12894 case TCPS_IDLE: 12895 /* 12896 * Handle the case where the tcp_clean_death() has happened 12897 * on a connection (application hasn't closed yet) but a packet 12898 * was already queued on squeue before tcp_clean_death() 12899 * was processed. Calling tcp_clean_death() twice on same 12900 * connection can result in weird behaviour. 12901 */ 12902 freemsg(mp); 12903 return; 12904 default: 12905 break; 12906 } 12907 12908 /* 12909 * Already on the correct queue/perimeter. 12910 * If this is a detached connection and not an eager 12911 * connection hanging off a listener then new data 12912 * (past the FIN) will cause a reset. 12913 * We do a special check here where it 12914 * is out of the main line, rather than check 12915 * if we are detached every time we see new 12916 * data down below. 12917 */ 12918 if (TCP_IS_DETACHED_NONEAGER(tcp) && 12919 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 12920 BUMP_MIB(&tcp_mib, tcpInClosed); 12921 TCP_RECORD_TRACE(tcp, 12922 mp, TCP_TRACE_RECV_PKT); 12923 12924 freemsg(mp); 12925 /* 12926 * This could be an SSL closure alert. We're detached so just 12927 * acknowledge it this last time. 12928 */ 12929 if (tcp->tcp_kssl_ctx != NULL) { 12930 kssl_release_ctx(tcp->tcp_kssl_ctx); 12931 tcp->tcp_kssl_ctx = NULL; 12932 12933 tcp->tcp_rnxt += seg_len; 12934 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 12935 flags |= TH_ACK_NEEDED; 12936 goto ack_check; 12937 } 12938 12939 tcp_xmit_ctl("new data when detached", tcp, 12940 tcp->tcp_snxt, 0, TH_RST); 12941 (void) tcp_clean_death(tcp, EPROTO, 12); 12942 return; 12943 } 12944 12945 mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 12946 urp = BE16_TO_U16(tcph->th_urp) - TCP_OLD_URP_INTERPRETATION; 12947 new_swnd = BE16_TO_U16(tcph->th_win) << 12948 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 12949 mss = tcp->tcp_mss; 12950 12951 if (tcp->tcp_snd_ts_ok) { 12952 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 12953 /* 12954 * This segment is not acceptable. 12955 * Drop it and send back an ACK. 12956 */ 12957 freemsg(mp); 12958 flags |= TH_ACK_NEEDED; 12959 goto ack_check; 12960 } 12961 } else if (tcp->tcp_snd_sack_ok) { 12962 ASSERT(tcp->tcp_sack_info != NULL); 12963 tcpopt.tcp = tcp; 12964 /* 12965 * SACK info in already updated in tcp_parse_options. Ignore 12966 * all other TCP options... 12967 */ 12968 (void) tcp_parse_options(tcph, &tcpopt); 12969 } 12970 try_again:; 12971 gap = seg_seq - tcp->tcp_rnxt; 12972 rgap = tcp->tcp_rwnd - (gap + seg_len); 12973 /* 12974 * gap is the amount of sequence space between what we expect to see 12975 * and what we got for seg_seq. A positive value for gap means 12976 * something got lost. A negative value means we got some old stuff. 12977 */ 12978 if (gap < 0) { 12979 /* Old stuff present. Is the SYN in there? */ 12980 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 12981 (seg_len != 0)) { 12982 flags &= ~TH_SYN; 12983 seg_seq++; 12984 urp--; 12985 /* Recompute the gaps after noting the SYN. */ 12986 goto try_again; 12987 } 12988 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 12989 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 12990 (seg_len > -gap ? -gap : seg_len)); 12991 /* Remove the old stuff from seg_len. */ 12992 seg_len += gap; 12993 /* 12994 * Anything left? 12995 * Make sure to check for unack'd FIN when rest of data 12996 * has been previously ack'd. 12997 */ 12998 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 12999 /* 13000 * Resets are only valid if they lie within our offered 13001 * window. If the RST bit is set, we just ignore this 13002 * segment. 13003 */ 13004 if (flags & TH_RST) { 13005 freemsg(mp); 13006 return; 13007 } 13008 13009 /* 13010 * The arriving of dup data packets indicate that we 13011 * may have postponed an ack for too long, or the other 13012 * side's RTT estimate is out of shape. Start acking 13013 * more often. 13014 */ 13015 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 13016 tcp->tcp_rack_cnt >= 1 && 13017 tcp->tcp_rack_abs_max > 2) { 13018 tcp->tcp_rack_abs_max--; 13019 } 13020 tcp->tcp_rack_cur_max = 1; 13021 13022 /* 13023 * This segment is "unacceptable". None of its 13024 * sequence space lies within our advertized window. 13025 * 13026 * Adjust seg_len to the original value for tracing. 13027 */ 13028 seg_len -= gap; 13029 if (tcp->tcp_debug) { 13030 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 13031 "tcp_rput: unacceptable, gap %d, rgap %d, " 13032 "flags 0x%x, seg_seq %u, seg_ack %u, " 13033 "seg_len %d, rnxt %u, snxt %u, %s", 13034 gap, rgap, flags, seg_seq, seg_ack, 13035 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 13036 tcp_display(tcp, NULL, 13037 DISP_ADDR_AND_PORT)); 13038 } 13039 13040 /* 13041 * Arrange to send an ACK in response to the 13042 * unacceptable segment per RFC 793 page 69. There 13043 * is only one small difference between ours and the 13044 * acceptability test in the RFC - we accept ACK-only 13045 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 13046 * will be generated. 13047 * 13048 * Note that we have to ACK an ACK-only packet at least 13049 * for stacks that send 0-length keep-alives with 13050 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 13051 * section 4.2.3.6. As long as we don't ever generate 13052 * an unacceptable packet in response to an incoming 13053 * packet that is unacceptable, it should not cause 13054 * "ACK wars". 13055 */ 13056 flags |= TH_ACK_NEEDED; 13057 13058 /* 13059 * Continue processing this segment in order to use the 13060 * ACK information it contains, but skip all other 13061 * sequence-number processing. Processing the ACK 13062 * information is necessary in order to 13063 * re-synchronize connections that may have lost 13064 * synchronization. 13065 * 13066 * We clear seg_len and flag fields related to 13067 * sequence number processing as they are not 13068 * to be trusted for an unacceptable segment. 13069 */ 13070 seg_len = 0; 13071 flags &= ~(TH_SYN | TH_FIN | TH_URG); 13072 goto process_ack; 13073 } 13074 13075 /* Fix seg_seq, and chew the gap off the front. */ 13076 seg_seq = tcp->tcp_rnxt; 13077 urp += gap; 13078 do { 13079 mblk_t *mp2; 13080 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13081 (uintptr_t)UINT_MAX); 13082 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 13083 if (gap > 0) { 13084 mp->b_rptr = mp->b_wptr - gap; 13085 break; 13086 } 13087 mp2 = mp; 13088 mp = mp->b_cont; 13089 freeb(mp2); 13090 } while (gap < 0); 13091 /* 13092 * If the urgent data has already been acknowledged, we 13093 * should ignore TH_URG below 13094 */ 13095 if (urp < 0) 13096 flags &= ~TH_URG; 13097 } 13098 /* 13099 * rgap is the amount of stuff received out of window. A negative 13100 * value is the amount out of window. 13101 */ 13102 if (rgap < 0) { 13103 mblk_t *mp2; 13104 13105 if (tcp->tcp_rwnd == 0) { 13106 BUMP_MIB(&tcp_mib, tcpInWinProbe); 13107 } else { 13108 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 13109 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 13110 } 13111 13112 /* 13113 * seg_len does not include the FIN, so if more than 13114 * just the FIN is out of window, we act like we don't 13115 * see it. (If just the FIN is out of window, rgap 13116 * will be zero and we will go ahead and acknowledge 13117 * the FIN.) 13118 */ 13119 flags &= ~TH_FIN; 13120 13121 /* Fix seg_len and make sure there is something left. */ 13122 seg_len += rgap; 13123 if (seg_len <= 0) { 13124 /* 13125 * Resets are only valid if they lie within our offered 13126 * window. If the RST bit is set, we just ignore this 13127 * segment. 13128 */ 13129 if (flags & TH_RST) { 13130 freemsg(mp); 13131 return; 13132 } 13133 13134 /* Per RFC 793, we need to send back an ACK. */ 13135 flags |= TH_ACK_NEEDED; 13136 13137 /* 13138 * Send SIGURG as soon as possible i.e. even 13139 * if the TH_URG was delivered in a window probe 13140 * packet (which will be unacceptable). 13141 * 13142 * We generate a signal if none has been generated 13143 * for this connection or if this is a new urgent 13144 * byte. Also send a zero-length "unmarked" message 13145 * to inform SIOCATMARK that this is not the mark. 13146 * 13147 * tcp_urp_last_valid is cleared when the T_exdata_ind 13148 * is sent up. This plus the check for old data 13149 * (gap >= 0) handles the wraparound of the sequence 13150 * number space without having to always track the 13151 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 13152 * this max in its rcv_up variable). 13153 * 13154 * This prevents duplicate SIGURGS due to a "late" 13155 * zero-window probe when the T_EXDATA_IND has already 13156 * been sent up. 13157 */ 13158 if ((flags & TH_URG) && 13159 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 13160 tcp->tcp_urp_last))) { 13161 mp1 = allocb(0, BPRI_MED); 13162 if (mp1 == NULL) { 13163 freemsg(mp); 13164 return; 13165 } 13166 if (!TCP_IS_DETACHED(tcp) && 13167 !putnextctl1(tcp->tcp_rq, M_PCSIG, 13168 SIGURG)) { 13169 /* Try again on the rexmit. */ 13170 freemsg(mp1); 13171 freemsg(mp); 13172 return; 13173 } 13174 /* 13175 * If the next byte would be the mark 13176 * then mark with MARKNEXT else mark 13177 * with NOTMARKNEXT. 13178 */ 13179 if (gap == 0 && urp == 0) 13180 mp1->b_flag |= MSGMARKNEXT; 13181 else 13182 mp1->b_flag |= MSGNOTMARKNEXT; 13183 freemsg(tcp->tcp_urp_mark_mp); 13184 tcp->tcp_urp_mark_mp = mp1; 13185 flags |= TH_SEND_URP_MARK; 13186 tcp->tcp_urp_last_valid = B_TRUE; 13187 tcp->tcp_urp_last = urp + seg_seq; 13188 } 13189 /* 13190 * If this is a zero window probe, continue to 13191 * process the ACK part. But we need to set seg_len 13192 * to 0 to avoid data processing. Otherwise just 13193 * drop the segment and send back an ACK. 13194 */ 13195 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 13196 flags &= ~(TH_SYN | TH_URG); 13197 seg_len = 0; 13198 goto process_ack; 13199 } else { 13200 freemsg(mp); 13201 goto ack_check; 13202 } 13203 } 13204 /* Pitch out of window stuff off the end. */ 13205 rgap = seg_len; 13206 mp2 = mp; 13207 do { 13208 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 13209 (uintptr_t)INT_MAX); 13210 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 13211 if (rgap < 0) { 13212 mp2->b_wptr += rgap; 13213 if ((mp1 = mp2->b_cont) != NULL) { 13214 mp2->b_cont = NULL; 13215 freemsg(mp1); 13216 } 13217 break; 13218 } 13219 } while ((mp2 = mp2->b_cont) != NULL); 13220 } 13221 ok:; 13222 /* 13223 * TCP should check ECN info for segments inside the window only. 13224 * Therefore the check should be done here. 13225 */ 13226 if (tcp->tcp_ecn_ok) { 13227 if (flags & TH_CWR) { 13228 tcp->tcp_ecn_echo_on = B_FALSE; 13229 } 13230 /* 13231 * Note that both ECN_CE and CWR can be set in the 13232 * same segment. In this case, we once again turn 13233 * on ECN_ECHO. 13234 */ 13235 if (tcp->tcp_ipversion == IPV4_VERSION) { 13236 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 13237 13238 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 13239 tcp->tcp_ecn_echo_on = B_TRUE; 13240 } 13241 } else { 13242 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 13243 13244 if ((vcf & htonl(IPH_ECN_CE << 20)) == 13245 htonl(IPH_ECN_CE << 20)) { 13246 tcp->tcp_ecn_echo_on = B_TRUE; 13247 } 13248 } 13249 } 13250 13251 /* 13252 * Check whether we can update tcp_ts_recent. This test is 13253 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 13254 * Extensions for High Performance: An Update", Internet Draft. 13255 */ 13256 if (tcp->tcp_snd_ts_ok && 13257 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 13258 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 13259 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 13260 tcp->tcp_last_rcv_lbolt = lbolt64; 13261 } 13262 13263 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 13264 /* 13265 * FIN in an out of order segment. We record this in 13266 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 13267 * Clear the FIN so that any check on FIN flag will fail. 13268 * Remember that FIN also counts in the sequence number 13269 * space. So we need to ack out of order FIN only segments. 13270 */ 13271 if (flags & TH_FIN) { 13272 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 13273 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 13274 flags &= ~TH_FIN; 13275 flags |= TH_ACK_NEEDED; 13276 } 13277 if (seg_len > 0) { 13278 /* Fill in the SACK blk list. */ 13279 if (tcp->tcp_snd_sack_ok) { 13280 ASSERT(tcp->tcp_sack_info != NULL); 13281 tcp_sack_insert(tcp->tcp_sack_list, 13282 seg_seq, seg_seq + seg_len, 13283 &(tcp->tcp_num_sack_blk)); 13284 } 13285 13286 /* 13287 * Attempt reassembly and see if we have something 13288 * ready to go. 13289 */ 13290 mp = tcp_reass(tcp, mp, seg_seq); 13291 /* Always ack out of order packets */ 13292 flags |= TH_ACK_NEEDED | TH_PUSH; 13293 if (mp) { 13294 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13295 (uintptr_t)INT_MAX); 13296 seg_len = mp->b_cont ? msgdsize(mp) : 13297 (int)(mp->b_wptr - mp->b_rptr); 13298 seg_seq = tcp->tcp_rnxt; 13299 /* 13300 * A gap is filled and the seq num and len 13301 * of the gap match that of a previously 13302 * received FIN, put the FIN flag back in. 13303 */ 13304 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13305 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13306 flags |= TH_FIN; 13307 tcp->tcp_valid_bits &= 13308 ~TCP_OFO_FIN_VALID; 13309 } 13310 } else { 13311 /* 13312 * Keep going even with NULL mp. 13313 * There may be a useful ACK or something else 13314 * we don't want to miss. 13315 * 13316 * But TCP should not perform fast retransmit 13317 * because of the ack number. TCP uses 13318 * seg_len == 0 to determine if it is a pure 13319 * ACK. And this is not a pure ACK. 13320 */ 13321 seg_len = 0; 13322 ofo_seg = B_TRUE; 13323 } 13324 } 13325 } else if (seg_len > 0) { 13326 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 13327 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 13328 /* 13329 * If an out of order FIN was received before, and the seq 13330 * num and len of the new segment match that of the FIN, 13331 * put the FIN flag back in. 13332 */ 13333 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13334 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13335 flags |= TH_FIN; 13336 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 13337 } 13338 } 13339 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 13340 if (flags & TH_RST) { 13341 freemsg(mp); 13342 switch (tcp->tcp_state) { 13343 case TCPS_SYN_RCVD: 13344 (void) tcp_clean_death(tcp, ECONNREFUSED, 14); 13345 break; 13346 case TCPS_ESTABLISHED: 13347 case TCPS_FIN_WAIT_1: 13348 case TCPS_FIN_WAIT_2: 13349 case TCPS_CLOSE_WAIT: 13350 (void) tcp_clean_death(tcp, ECONNRESET, 15); 13351 break; 13352 case TCPS_CLOSING: 13353 case TCPS_LAST_ACK: 13354 (void) tcp_clean_death(tcp, 0, 16); 13355 break; 13356 default: 13357 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13358 (void) tcp_clean_death(tcp, ENXIO, 17); 13359 break; 13360 } 13361 return; 13362 } 13363 if (flags & TH_SYN) { 13364 /* 13365 * See RFC 793, Page 71 13366 * 13367 * The seq number must be in the window as it should 13368 * be "fixed" above. If it is outside window, it should 13369 * be already rejected. Note that we allow seg_seq to be 13370 * rnxt + rwnd because we want to accept 0 window probe. 13371 */ 13372 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 13373 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 13374 freemsg(mp); 13375 /* 13376 * If the ACK flag is not set, just use our snxt as the 13377 * seq number of the RST segment. 13378 */ 13379 if (!(flags & TH_ACK)) { 13380 seg_ack = tcp->tcp_snxt; 13381 } 13382 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 13383 TH_RST|TH_ACK); 13384 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13385 (void) tcp_clean_death(tcp, ECONNRESET, 18); 13386 return; 13387 } 13388 /* 13389 * urp could be -1 when the urp field in the packet is 0 13390 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 13391 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 13392 */ 13393 if (flags & TH_URG && urp >= 0) { 13394 if (!tcp->tcp_urp_last_valid || 13395 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 13396 /* 13397 * If we haven't generated the signal yet for this 13398 * urgent pointer value, do it now. Also, send up a 13399 * zero-length M_DATA indicating whether or not this is 13400 * the mark. The latter is not needed when a 13401 * T_EXDATA_IND is sent up. However, if there are 13402 * allocation failures this code relies on the sender 13403 * retransmitting and the socket code for determining 13404 * the mark should not block waiting for the peer to 13405 * transmit. Thus, for simplicity we always send up the 13406 * mark indication. 13407 */ 13408 mp1 = allocb(0, BPRI_MED); 13409 if (mp1 == NULL) { 13410 freemsg(mp); 13411 return; 13412 } 13413 if (!TCP_IS_DETACHED(tcp) && 13414 !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) { 13415 /* Try again on the rexmit. */ 13416 freemsg(mp1); 13417 freemsg(mp); 13418 return; 13419 } 13420 /* 13421 * Mark with NOTMARKNEXT for now. 13422 * The code below will change this to MARKNEXT 13423 * if we are at the mark. 13424 * 13425 * If there are allocation failures (e.g. in dupmsg 13426 * below) the next time tcp_rput_data sees the urgent 13427 * segment it will send up the MSG*MARKNEXT message. 13428 */ 13429 mp1->b_flag |= MSGNOTMARKNEXT; 13430 freemsg(tcp->tcp_urp_mark_mp); 13431 tcp->tcp_urp_mark_mp = mp1; 13432 flags |= TH_SEND_URP_MARK; 13433 #ifdef DEBUG 13434 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 13435 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 13436 "last %x, %s", 13437 seg_seq, urp, tcp->tcp_urp_last, 13438 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 13439 #endif /* DEBUG */ 13440 tcp->tcp_urp_last_valid = B_TRUE; 13441 tcp->tcp_urp_last = urp + seg_seq; 13442 } else if (tcp->tcp_urp_mark_mp != NULL) { 13443 /* 13444 * An allocation failure prevented the previous 13445 * tcp_rput_data from sending up the allocated 13446 * MSG*MARKNEXT message - send it up this time 13447 * around. 13448 */ 13449 flags |= TH_SEND_URP_MARK; 13450 } 13451 13452 /* 13453 * If the urgent byte is in this segment, make sure that it is 13454 * all by itself. This makes it much easier to deal with the 13455 * possibility of an allocation failure on the T_exdata_ind. 13456 * Note that seg_len is the number of bytes in the segment, and 13457 * urp is the offset into the segment of the urgent byte. 13458 * urp < seg_len means that the urgent byte is in this segment. 13459 */ 13460 if (urp < seg_len) { 13461 if (seg_len != 1) { 13462 uint32_t tmp_rnxt; 13463 /* 13464 * Break it up and feed it back in. 13465 * Re-attach the IP header. 13466 */ 13467 mp->b_rptr = iphdr; 13468 if (urp > 0) { 13469 /* 13470 * There is stuff before the urgent 13471 * byte. 13472 */ 13473 mp1 = dupmsg(mp); 13474 if (!mp1) { 13475 /* 13476 * Trim from urgent byte on. 13477 * The rest will come back. 13478 */ 13479 (void) adjmsg(mp, 13480 urp - seg_len); 13481 tcp_rput_data(connp, 13482 mp, NULL); 13483 return; 13484 } 13485 (void) adjmsg(mp1, urp - seg_len); 13486 /* Feed this piece back in. */ 13487 tmp_rnxt = tcp->tcp_rnxt; 13488 tcp_rput_data(connp, mp1, NULL); 13489 /* 13490 * If the data passed back in was not 13491 * processed (ie: bad ACK) sending 13492 * the remainder back in will cause a 13493 * loop. In this case, drop the 13494 * packet and let the sender try 13495 * sending a good packet. 13496 */ 13497 if (tmp_rnxt == tcp->tcp_rnxt) { 13498 freemsg(mp); 13499 return; 13500 } 13501 } 13502 if (urp != seg_len - 1) { 13503 uint32_t tmp_rnxt; 13504 /* 13505 * There is stuff after the urgent 13506 * byte. 13507 */ 13508 mp1 = dupmsg(mp); 13509 if (!mp1) { 13510 /* 13511 * Trim everything beyond the 13512 * urgent byte. The rest will 13513 * come back. 13514 */ 13515 (void) adjmsg(mp, 13516 urp + 1 - seg_len); 13517 tcp_rput_data(connp, 13518 mp, NULL); 13519 return; 13520 } 13521 (void) adjmsg(mp1, urp + 1 - seg_len); 13522 tmp_rnxt = tcp->tcp_rnxt; 13523 tcp_rput_data(connp, mp1, NULL); 13524 /* 13525 * If the data passed back in was not 13526 * processed (ie: bad ACK) sending 13527 * the remainder back in will cause a 13528 * loop. In this case, drop the 13529 * packet and let the sender try 13530 * sending a good packet. 13531 */ 13532 if (tmp_rnxt == tcp->tcp_rnxt) { 13533 freemsg(mp); 13534 return; 13535 } 13536 } 13537 tcp_rput_data(connp, mp, NULL); 13538 return; 13539 } 13540 /* 13541 * This segment contains only the urgent byte. We 13542 * have to allocate the T_exdata_ind, if we can. 13543 */ 13544 if (!tcp->tcp_urp_mp) { 13545 struct T_exdata_ind *tei; 13546 mp1 = allocb(sizeof (struct T_exdata_ind), 13547 BPRI_MED); 13548 if (!mp1) { 13549 /* 13550 * Sigh... It'll be back. 13551 * Generate any MSG*MARK message now. 13552 */ 13553 freemsg(mp); 13554 seg_len = 0; 13555 if (flags & TH_SEND_URP_MARK) { 13556 13557 13558 ASSERT(tcp->tcp_urp_mark_mp); 13559 tcp->tcp_urp_mark_mp->b_flag &= 13560 ~MSGNOTMARKNEXT; 13561 tcp->tcp_urp_mark_mp->b_flag |= 13562 MSGMARKNEXT; 13563 } 13564 goto ack_check; 13565 } 13566 mp1->b_datap->db_type = M_PROTO; 13567 tei = (struct T_exdata_ind *)mp1->b_rptr; 13568 tei->PRIM_type = T_EXDATA_IND; 13569 tei->MORE_flag = 0; 13570 mp1->b_wptr = (uchar_t *)&tei[1]; 13571 tcp->tcp_urp_mp = mp1; 13572 #ifdef DEBUG 13573 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 13574 "tcp_rput: allocated exdata_ind %s", 13575 tcp_display(tcp, NULL, 13576 DISP_PORT_ONLY)); 13577 #endif /* DEBUG */ 13578 /* 13579 * There is no need to send a separate MSG*MARK 13580 * message since the T_EXDATA_IND will be sent 13581 * now. 13582 */ 13583 flags &= ~TH_SEND_URP_MARK; 13584 freemsg(tcp->tcp_urp_mark_mp); 13585 tcp->tcp_urp_mark_mp = NULL; 13586 } 13587 /* 13588 * Now we are all set. On the next putnext upstream, 13589 * tcp_urp_mp will be non-NULL and will get prepended 13590 * to what has to be this piece containing the urgent 13591 * byte. If for any reason we abort this segment below, 13592 * if it comes back, we will have this ready, or it 13593 * will get blown off in close. 13594 */ 13595 } else if (urp == seg_len) { 13596 /* 13597 * The urgent byte is the next byte after this sequence 13598 * number. If there is data it is marked with 13599 * MSGMARKNEXT and any tcp_urp_mark_mp is discarded 13600 * since it is not needed. Otherwise, if the code 13601 * above just allocated a zero-length tcp_urp_mark_mp 13602 * message, that message is tagged with MSGMARKNEXT. 13603 * Sending up these MSGMARKNEXT messages makes 13604 * SIOCATMARK work correctly even though 13605 * the T_EXDATA_IND will not be sent up until the 13606 * urgent byte arrives. 13607 */ 13608 if (seg_len != 0) { 13609 flags |= TH_MARKNEXT_NEEDED; 13610 freemsg(tcp->tcp_urp_mark_mp); 13611 tcp->tcp_urp_mark_mp = NULL; 13612 flags &= ~TH_SEND_URP_MARK; 13613 } else if (tcp->tcp_urp_mark_mp != NULL) { 13614 flags |= TH_SEND_URP_MARK; 13615 tcp->tcp_urp_mark_mp->b_flag &= 13616 ~MSGNOTMARKNEXT; 13617 tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT; 13618 } 13619 #ifdef DEBUG 13620 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 13621 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 13622 seg_len, flags, 13623 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 13624 #endif /* DEBUG */ 13625 } else { 13626 /* Data left until we hit mark */ 13627 #ifdef DEBUG 13628 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 13629 "tcp_rput: URP %d bytes left, %s", 13630 urp - seg_len, tcp_display(tcp, NULL, 13631 DISP_PORT_ONLY)); 13632 #endif /* DEBUG */ 13633 } 13634 } 13635 13636 process_ack: 13637 if (!(flags & TH_ACK)) { 13638 freemsg(mp); 13639 goto xmit_check; 13640 } 13641 } 13642 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 13643 13644 if (tcp->tcp_ipversion == IPV6_VERSION && bytes_acked > 0) 13645 tcp->tcp_ip_forward_progress = B_TRUE; 13646 if (tcp->tcp_state == TCPS_SYN_RCVD) { 13647 if ((tcp->tcp_conn.tcp_eager_conn_ind != NULL) && 13648 ((tcp->tcp_kssl_ent == NULL) || !tcp->tcp_kssl_pending)) { 13649 /* 3-way handshake complete - pass up the T_CONN_IND */ 13650 tcp_t *listener = tcp->tcp_listener; 13651 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 13652 13653 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 13654 /* 13655 * We are here means eager is fine but it can 13656 * get a TH_RST at any point between now and till 13657 * accept completes and disappear. We need to 13658 * ensure that reference to eager is valid after 13659 * we get out of eager's perimeter. So we do 13660 * an extra refhold. 13661 */ 13662 CONN_INC_REF(connp); 13663 13664 /* 13665 * The listener also exists because of the refhold 13666 * done in tcp_conn_request. Its possible that it 13667 * might have closed. We will check that once we 13668 * get inside listeners context. 13669 */ 13670 CONN_INC_REF(listener->tcp_connp); 13671 if (listener->tcp_connp->conn_sqp == 13672 connp->conn_sqp) { 13673 tcp_send_conn_ind(listener->tcp_connp, mp, 13674 listener->tcp_connp->conn_sqp); 13675 CONN_DEC_REF(listener->tcp_connp); 13676 } else if (!tcp->tcp_loopback) { 13677 squeue_fill(listener->tcp_connp->conn_sqp, mp, 13678 tcp_send_conn_ind, 13679 listener->tcp_connp, SQTAG_TCP_CONN_IND); 13680 } else { 13681 squeue_enter(listener->tcp_connp->conn_sqp, mp, 13682 tcp_send_conn_ind, listener->tcp_connp, 13683 SQTAG_TCP_CONN_IND); 13684 } 13685 } 13686 13687 if (tcp->tcp_active_open) { 13688 /* 13689 * We are seeing the final ack in the three way 13690 * hand shake of a active open'ed connection 13691 * so we must send up a T_CONN_CON 13692 */ 13693 if (!tcp_conn_con(tcp, iphdr, tcph, mp, NULL)) { 13694 freemsg(mp); 13695 return; 13696 } 13697 /* 13698 * Don't fuse the loopback endpoints for 13699 * simultaneous active opens. 13700 */ 13701 if (tcp->tcp_loopback) { 13702 TCP_STAT(tcp_fusion_unfusable); 13703 tcp->tcp_unfusable = B_TRUE; 13704 } 13705 } 13706 13707 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 13708 bytes_acked--; 13709 /* SYN was acked - making progress */ 13710 if (tcp->tcp_ipversion == IPV6_VERSION) 13711 tcp->tcp_ip_forward_progress = B_TRUE; 13712 13713 /* 13714 * If SYN was retransmitted, need to reset all 13715 * retransmission info as this segment will be 13716 * treated as a dup ACK. 13717 */ 13718 if (tcp->tcp_rexmit) { 13719 tcp->tcp_rexmit = B_FALSE; 13720 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 13721 tcp->tcp_rexmit_max = tcp->tcp_snxt; 13722 tcp->tcp_snd_burst = tcp->tcp_localnet ? 13723 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 13724 tcp->tcp_ms_we_have_waited = 0; 13725 tcp->tcp_cwnd = mss; 13726 } 13727 13728 /* 13729 * We set the send window to zero here. 13730 * This is needed if there is data to be 13731 * processed already on the queue. 13732 * Later (at swnd_update label), the 13733 * "new_swnd > tcp_swnd" condition is satisfied 13734 * the XMIT_NEEDED flag is set in the current 13735 * (SYN_RCVD) state. This ensures tcp_wput_data() is 13736 * called if there is already data on queue in 13737 * this state. 13738 */ 13739 tcp->tcp_swnd = 0; 13740 13741 if (new_swnd > tcp->tcp_max_swnd) 13742 tcp->tcp_max_swnd = new_swnd; 13743 tcp->tcp_swl1 = seg_seq; 13744 tcp->tcp_swl2 = seg_ack; 13745 tcp->tcp_state = TCPS_ESTABLISHED; 13746 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 13747 13748 /* Fuse when both sides are in ESTABLISHED state */ 13749 if (tcp->tcp_loopback && do_tcp_fusion) 13750 tcp_fuse(tcp, iphdr, tcph); 13751 13752 } 13753 /* This code follows 4.4BSD-Lite2 mostly. */ 13754 if (bytes_acked < 0) 13755 goto est; 13756 13757 /* 13758 * If TCP is ECN capable and the congestion experience bit is 13759 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 13760 * done once per window (or more loosely, per RTT). 13761 */ 13762 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 13763 tcp->tcp_cwr = B_FALSE; 13764 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 13765 if (!tcp->tcp_cwr) { 13766 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 13767 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 13768 tcp->tcp_cwnd = npkt * mss; 13769 /* 13770 * If the cwnd is 0, use the timer to clock out 13771 * new segments. This is required by the ECN spec. 13772 */ 13773 if (npkt == 0) { 13774 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 13775 /* 13776 * This makes sure that when the ACK comes 13777 * back, we will increase tcp_cwnd by 1 MSS. 13778 */ 13779 tcp->tcp_cwnd_cnt = 0; 13780 } 13781 tcp->tcp_cwr = B_TRUE; 13782 /* 13783 * This marks the end of the current window of in 13784 * flight data. That is why we don't use 13785 * tcp_suna + tcp_swnd. Only data in flight can 13786 * provide ECN info. 13787 */ 13788 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 13789 tcp->tcp_ecn_cwr_sent = B_FALSE; 13790 } 13791 } 13792 13793 mp1 = tcp->tcp_xmit_head; 13794 if (bytes_acked == 0) { 13795 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 13796 int dupack_cnt; 13797 13798 BUMP_MIB(&tcp_mib, tcpInDupAck); 13799 /* 13800 * Fast retransmit. When we have seen exactly three 13801 * identical ACKs while we have unacked data 13802 * outstanding we take it as a hint that our peer 13803 * dropped something. 13804 * 13805 * If TCP is retransmitting, don't do fast retransmit. 13806 */ 13807 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 13808 ! tcp->tcp_rexmit) { 13809 /* Do Limited Transmit */ 13810 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 13811 tcp_dupack_fast_retransmit) { 13812 /* 13813 * RFC 3042 13814 * 13815 * What we need to do is temporarily 13816 * increase tcp_cwnd so that new 13817 * data can be sent if it is allowed 13818 * by the receive window (tcp_rwnd). 13819 * tcp_wput_data() will take care of 13820 * the rest. 13821 * 13822 * If the connection is SACK capable, 13823 * only do limited xmit when there 13824 * is SACK info. 13825 * 13826 * Note how tcp_cwnd is incremented. 13827 * The first dup ACK will increase 13828 * it by 1 MSS. The second dup ACK 13829 * will increase it by 2 MSS. This 13830 * means that only 1 new segment will 13831 * be sent for each dup ACK. 13832 */ 13833 if (tcp->tcp_unsent > 0 && 13834 (!tcp->tcp_snd_sack_ok || 13835 (tcp->tcp_snd_sack_ok && 13836 tcp->tcp_notsack_list != NULL))) { 13837 tcp->tcp_cwnd += mss << 13838 (tcp->tcp_dupack_cnt - 1); 13839 flags |= TH_LIMIT_XMIT; 13840 } 13841 } else if (dupack_cnt == 13842 tcp_dupack_fast_retransmit) { 13843 13844 /* 13845 * If we have reduced tcp_ssthresh 13846 * because of ECN, do not reduce it again 13847 * unless it is already one window of data 13848 * away. After one window of data, tcp_cwr 13849 * should then be cleared. Note that 13850 * for non ECN capable connection, tcp_cwr 13851 * should always be false. 13852 * 13853 * Adjust cwnd since the duplicate 13854 * ack indicates that a packet was 13855 * dropped (due to congestion.) 13856 */ 13857 if (!tcp->tcp_cwr) { 13858 npkt = ((tcp->tcp_snxt - 13859 tcp->tcp_suna) >> 1) / mss; 13860 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 13861 mss; 13862 tcp->tcp_cwnd = (npkt + 13863 tcp->tcp_dupack_cnt) * mss; 13864 } 13865 if (tcp->tcp_ecn_ok) { 13866 tcp->tcp_cwr = B_TRUE; 13867 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 13868 tcp->tcp_ecn_cwr_sent = B_FALSE; 13869 } 13870 13871 /* 13872 * We do Hoe's algorithm. Refer to her 13873 * paper "Improving the Start-up Behavior 13874 * of a Congestion Control Scheme for TCP," 13875 * appeared in SIGCOMM'96. 13876 * 13877 * Save highest seq no we have sent so far. 13878 * Be careful about the invisible FIN byte. 13879 */ 13880 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 13881 (tcp->tcp_unsent == 0)) { 13882 tcp->tcp_rexmit_max = tcp->tcp_fss; 13883 } else { 13884 tcp->tcp_rexmit_max = tcp->tcp_snxt; 13885 } 13886 13887 /* 13888 * Do not allow bursty traffic during. 13889 * fast recovery. Refer to Fall and Floyd's 13890 * paper "Simulation-based Comparisons of 13891 * Tahoe, Reno and SACK TCP" (in CCR?) 13892 * This is a best current practise. 13893 */ 13894 tcp->tcp_snd_burst = TCP_CWND_SS; 13895 13896 /* 13897 * For SACK: 13898 * Calculate tcp_pipe, which is the 13899 * estimated number of bytes in 13900 * network. 13901 * 13902 * tcp_fack is the highest sack'ed seq num 13903 * TCP has received. 13904 * 13905 * tcp_pipe is explained in the above quoted 13906 * Fall and Floyd's paper. tcp_fack is 13907 * explained in Mathis and Mahdavi's 13908 * "Forward Acknowledgment: Refining TCP 13909 * Congestion Control" in SIGCOMM '96. 13910 */ 13911 if (tcp->tcp_snd_sack_ok) { 13912 ASSERT(tcp->tcp_sack_info != NULL); 13913 if (tcp->tcp_notsack_list != NULL) { 13914 tcp->tcp_pipe = tcp->tcp_snxt - 13915 tcp->tcp_fack; 13916 tcp->tcp_sack_snxt = seg_ack; 13917 flags |= TH_NEED_SACK_REXMIT; 13918 } else { 13919 /* 13920 * Always initialize tcp_pipe 13921 * even though we don't have 13922 * any SACK info. If later 13923 * we get SACK info and 13924 * tcp_pipe is not initialized, 13925 * funny things will happen. 13926 */ 13927 tcp->tcp_pipe = 13928 tcp->tcp_cwnd_ssthresh; 13929 } 13930 } else { 13931 flags |= TH_REXMIT_NEEDED; 13932 } /* tcp_snd_sack_ok */ 13933 13934 } else { 13935 /* 13936 * Here we perform congestion 13937 * avoidance, but NOT slow start. 13938 * This is known as the Fast 13939 * Recovery Algorithm. 13940 */ 13941 if (tcp->tcp_snd_sack_ok && 13942 tcp->tcp_notsack_list != NULL) { 13943 flags |= TH_NEED_SACK_REXMIT; 13944 tcp->tcp_pipe -= mss; 13945 if (tcp->tcp_pipe < 0) 13946 tcp->tcp_pipe = 0; 13947 } else { 13948 /* 13949 * We know that one more packet has 13950 * left the pipe thus we can update 13951 * cwnd. 13952 */ 13953 cwnd = tcp->tcp_cwnd + mss; 13954 if (cwnd > tcp->tcp_cwnd_max) 13955 cwnd = tcp->tcp_cwnd_max; 13956 tcp->tcp_cwnd = cwnd; 13957 if (tcp->tcp_unsent > 0) 13958 flags |= TH_XMIT_NEEDED; 13959 } 13960 } 13961 } 13962 } else if (tcp->tcp_zero_win_probe) { 13963 /* 13964 * If the window has opened, need to arrange 13965 * to send additional data. 13966 */ 13967 if (new_swnd != 0) { 13968 /* tcp_suna != tcp_snxt */ 13969 /* Packet contains a window update */ 13970 BUMP_MIB(&tcp_mib, tcpInWinUpdate); 13971 tcp->tcp_zero_win_probe = 0; 13972 tcp->tcp_timer_backoff = 0; 13973 tcp->tcp_ms_we_have_waited = 0; 13974 13975 /* 13976 * Transmit starting with tcp_suna since 13977 * the one byte probe is not ack'ed. 13978 * If TCP has sent more than one identical 13979 * probe, tcp_rexmit will be set. That means 13980 * tcp_ss_rexmit() will send out the one 13981 * byte along with new data. Otherwise, 13982 * fake the retransmission. 13983 */ 13984 flags |= TH_XMIT_NEEDED; 13985 if (!tcp->tcp_rexmit) { 13986 tcp->tcp_rexmit = B_TRUE; 13987 tcp->tcp_dupack_cnt = 0; 13988 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 13989 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 13990 } 13991 } 13992 } 13993 goto swnd_update; 13994 } 13995 13996 /* 13997 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 13998 * If the ACK value acks something that we have not yet sent, it might 13999 * be an old duplicate segment. Send an ACK to re-synchronize the 14000 * other side. 14001 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 14002 * state is handled above, so we can always just drop the segment and 14003 * send an ACK here. 14004 * 14005 * Should we send ACKs in response to ACK only segments? 14006 */ 14007 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 14008 BUMP_MIB(&tcp_mib, tcpInAckUnsent); 14009 /* drop the received segment */ 14010 freemsg(mp); 14011 14012 /* 14013 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 14014 * greater than 0, check if the number of such 14015 * bogus ACks is greater than that count. If yes, 14016 * don't send back any ACK. This prevents TCP from 14017 * getting into an ACK storm if somehow an attacker 14018 * successfully spoofs an acceptable segment to our 14019 * peer. 14020 */ 14021 if (tcp_drop_ack_unsent_cnt > 0 && 14022 ++tcp->tcp_in_ack_unsent > tcp_drop_ack_unsent_cnt) { 14023 TCP_STAT(tcp_in_ack_unsent_drop); 14024 return; 14025 } 14026 mp = tcp_ack_mp(tcp); 14027 if (mp != NULL) { 14028 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 14029 BUMP_LOCAL(tcp->tcp_obsegs); 14030 BUMP_MIB(&tcp_mib, tcpOutAck); 14031 tcp_send_data(tcp, tcp->tcp_wq, mp); 14032 } 14033 return; 14034 } 14035 14036 /* 14037 * TCP gets a new ACK, update the notsack'ed list to delete those 14038 * blocks that are covered by this ACK. 14039 */ 14040 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 14041 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 14042 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 14043 } 14044 14045 /* 14046 * If we got an ACK after fast retransmit, check to see 14047 * if it is a partial ACK. If it is not and the congestion 14048 * window was inflated to account for the other side's 14049 * cached packets, retract it. If it is, do Hoe's algorithm. 14050 */ 14051 if (tcp->tcp_dupack_cnt >= tcp_dupack_fast_retransmit) { 14052 ASSERT(tcp->tcp_rexmit == B_FALSE); 14053 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 14054 tcp->tcp_dupack_cnt = 0; 14055 /* 14056 * Restore the orig tcp_cwnd_ssthresh after 14057 * fast retransmit phase. 14058 */ 14059 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 14060 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 14061 } 14062 tcp->tcp_rexmit_max = seg_ack; 14063 tcp->tcp_cwnd_cnt = 0; 14064 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14065 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14066 14067 /* 14068 * Remove all notsack info to avoid confusion with 14069 * the next fast retrasnmit/recovery phase. 14070 */ 14071 if (tcp->tcp_snd_sack_ok && 14072 tcp->tcp_notsack_list != NULL) { 14073 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 14074 } 14075 } else { 14076 if (tcp->tcp_snd_sack_ok && 14077 tcp->tcp_notsack_list != NULL) { 14078 flags |= TH_NEED_SACK_REXMIT; 14079 tcp->tcp_pipe -= mss; 14080 if (tcp->tcp_pipe < 0) 14081 tcp->tcp_pipe = 0; 14082 } else { 14083 /* 14084 * Hoe's algorithm: 14085 * 14086 * Retransmit the unack'ed segment and 14087 * restart fast recovery. Note that we 14088 * need to scale back tcp_cwnd to the 14089 * original value when we started fast 14090 * recovery. This is to prevent overly 14091 * aggressive behaviour in sending new 14092 * segments. 14093 */ 14094 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 14095 tcp_dupack_fast_retransmit * mss; 14096 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 14097 flags |= TH_REXMIT_NEEDED; 14098 } 14099 } 14100 } else { 14101 tcp->tcp_dupack_cnt = 0; 14102 if (tcp->tcp_rexmit) { 14103 /* 14104 * TCP is retranmitting. If the ACK ack's all 14105 * outstanding data, update tcp_rexmit_max and 14106 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 14107 * to the correct value. 14108 * 14109 * Note that SEQ_LEQ() is used. This is to avoid 14110 * unnecessary fast retransmit caused by dup ACKs 14111 * received when TCP does slow start retransmission 14112 * after a time out. During this phase, TCP may 14113 * send out segments which are already received. 14114 * This causes dup ACKs to be sent back. 14115 */ 14116 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 14117 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 14118 tcp->tcp_rexmit_nxt = seg_ack; 14119 } 14120 if (seg_ack != tcp->tcp_rexmit_max) { 14121 flags |= TH_XMIT_NEEDED; 14122 } 14123 } else { 14124 tcp->tcp_rexmit = B_FALSE; 14125 tcp->tcp_xmit_zc_clean = B_FALSE; 14126 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 14127 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14128 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14129 } 14130 tcp->tcp_ms_we_have_waited = 0; 14131 } 14132 } 14133 14134 BUMP_MIB(&tcp_mib, tcpInAckSegs); 14135 UPDATE_MIB(&tcp_mib, tcpInAckBytes, bytes_acked); 14136 tcp->tcp_suna = seg_ack; 14137 if (tcp->tcp_zero_win_probe != 0) { 14138 tcp->tcp_zero_win_probe = 0; 14139 tcp->tcp_timer_backoff = 0; 14140 } 14141 14142 /* 14143 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 14144 * Note that it cannot be the SYN being ack'ed. The code flow 14145 * will not reach here. 14146 */ 14147 if (mp1 == NULL) { 14148 goto fin_acked; 14149 } 14150 14151 /* 14152 * Update the congestion window. 14153 * 14154 * If TCP is not ECN capable or TCP is ECN capable but the 14155 * congestion experience bit is not set, increase the tcp_cwnd as 14156 * usual. 14157 */ 14158 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 14159 cwnd = tcp->tcp_cwnd; 14160 add = mss; 14161 14162 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 14163 /* 14164 * This is to prevent an increase of less than 1 MSS of 14165 * tcp_cwnd. With partial increase, tcp_wput_data() 14166 * may send out tinygrams in order to preserve mblk 14167 * boundaries. 14168 * 14169 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 14170 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 14171 * increased by 1 MSS for every RTTs. 14172 */ 14173 if (tcp->tcp_cwnd_cnt <= 0) { 14174 tcp->tcp_cwnd_cnt = cwnd + add; 14175 } else { 14176 tcp->tcp_cwnd_cnt -= add; 14177 add = 0; 14178 } 14179 } 14180 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 14181 } 14182 14183 /* See if the latest urgent data has been acknowledged */ 14184 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 14185 SEQ_GT(seg_ack, tcp->tcp_urg)) 14186 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 14187 14188 /* Can we update the RTT estimates? */ 14189 if (tcp->tcp_snd_ts_ok) { 14190 /* Ignore zero timestamp echo-reply. */ 14191 if (tcpopt.tcp_opt_ts_ecr != 0) { 14192 tcp_set_rto(tcp, (int32_t)lbolt - 14193 (int32_t)tcpopt.tcp_opt_ts_ecr); 14194 } 14195 14196 /* If needed, restart the timer. */ 14197 if (tcp->tcp_set_timer == 1) { 14198 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14199 tcp->tcp_set_timer = 0; 14200 } 14201 /* 14202 * Update tcp_csuna in case the other side stops sending 14203 * us timestamps. 14204 */ 14205 tcp->tcp_csuna = tcp->tcp_snxt; 14206 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 14207 /* 14208 * An ACK sequence we haven't seen before, so get the RTT 14209 * and update the RTO. But first check if the timestamp is 14210 * valid to use. 14211 */ 14212 if ((mp1->b_next != NULL) && 14213 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) 14214 tcp_set_rto(tcp, (int32_t)lbolt - 14215 (int32_t)(intptr_t)mp1->b_prev); 14216 else 14217 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14218 14219 /* Remeber the last sequence to be ACKed */ 14220 tcp->tcp_csuna = seg_ack; 14221 if (tcp->tcp_set_timer == 1) { 14222 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14223 tcp->tcp_set_timer = 0; 14224 } 14225 } else { 14226 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14227 } 14228 14229 /* Eat acknowledged bytes off the xmit queue. */ 14230 for (;;) { 14231 mblk_t *mp2; 14232 uchar_t *wptr; 14233 14234 wptr = mp1->b_wptr; 14235 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 14236 bytes_acked -= (int)(wptr - mp1->b_rptr); 14237 if (bytes_acked < 0) { 14238 mp1->b_rptr = wptr + bytes_acked; 14239 /* 14240 * Set a new timestamp if all the bytes timed by the 14241 * old timestamp have been ack'ed. 14242 */ 14243 if (SEQ_GT(seg_ack, 14244 (uint32_t)(uintptr_t)(mp1->b_next))) { 14245 mp1->b_prev = (mblk_t *)(uintptr_t)lbolt; 14246 mp1->b_next = NULL; 14247 } 14248 break; 14249 } 14250 mp1->b_next = NULL; 14251 mp1->b_prev = NULL; 14252 mp2 = mp1; 14253 mp1 = mp1->b_cont; 14254 14255 /* 14256 * This notification is required for some zero-copy 14257 * clients to maintain a copy semantic. After the data 14258 * is ack'ed, client is safe to modify or reuse the buffer. 14259 */ 14260 if (tcp->tcp_snd_zcopy_aware && 14261 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 14262 tcp_zcopy_notify(tcp); 14263 freeb(mp2); 14264 if (bytes_acked == 0) { 14265 if (mp1 == NULL) { 14266 /* Everything is ack'ed, clear the tail. */ 14267 tcp->tcp_xmit_tail = NULL; 14268 /* 14269 * Cancel the timer unless we are still 14270 * waiting for an ACK for the FIN packet. 14271 */ 14272 if (tcp->tcp_timer_tid != 0 && 14273 tcp->tcp_snxt == tcp->tcp_suna) { 14274 (void) TCP_TIMER_CANCEL(tcp, 14275 tcp->tcp_timer_tid); 14276 tcp->tcp_timer_tid = 0; 14277 } 14278 goto pre_swnd_update; 14279 } 14280 if (mp2 != tcp->tcp_xmit_tail) 14281 break; 14282 tcp->tcp_xmit_tail = mp1; 14283 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 14284 (uintptr_t)INT_MAX); 14285 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 14286 mp1->b_rptr); 14287 break; 14288 } 14289 if (mp1 == NULL) { 14290 /* 14291 * More was acked but there is nothing more 14292 * outstanding. This means that the FIN was 14293 * just acked or that we're talking to a clown. 14294 */ 14295 fin_acked: 14296 ASSERT(tcp->tcp_fin_sent); 14297 tcp->tcp_xmit_tail = NULL; 14298 if (tcp->tcp_fin_sent) { 14299 /* FIN was acked - making progress */ 14300 if (tcp->tcp_ipversion == IPV6_VERSION && 14301 !tcp->tcp_fin_acked) 14302 tcp->tcp_ip_forward_progress = B_TRUE; 14303 tcp->tcp_fin_acked = B_TRUE; 14304 if (tcp->tcp_linger_tid != 0 && 14305 TCP_TIMER_CANCEL(tcp, 14306 tcp->tcp_linger_tid) >= 0) { 14307 tcp_stop_lingering(tcp); 14308 } 14309 } else { 14310 /* 14311 * We should never get here because 14312 * we have already checked that the 14313 * number of bytes ack'ed should be 14314 * smaller than or equal to what we 14315 * have sent so far (it is the 14316 * acceptability check of the ACK). 14317 * We can only get here if the send 14318 * queue is corrupted. 14319 * 14320 * Terminate the connection and 14321 * panic the system. It is better 14322 * for us to panic instead of 14323 * continuing to avoid other disaster. 14324 */ 14325 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 14326 tcp->tcp_rnxt, TH_RST|TH_ACK); 14327 panic("Memory corruption " 14328 "detected for connection %s.", 14329 tcp_display(tcp, NULL, 14330 DISP_ADDR_AND_PORT)); 14331 /*NOTREACHED*/ 14332 } 14333 goto pre_swnd_update; 14334 } 14335 ASSERT(mp2 != tcp->tcp_xmit_tail); 14336 } 14337 if (tcp->tcp_unsent) { 14338 flags |= TH_XMIT_NEEDED; 14339 } 14340 pre_swnd_update: 14341 tcp->tcp_xmit_head = mp1; 14342 swnd_update: 14343 /* 14344 * The following check is different from most other implementations. 14345 * For bi-directional transfer, when segments are dropped, the 14346 * "normal" check will not accept a window update in those 14347 * retransmitted segemnts. Failing to do that, TCP may send out 14348 * segments which are outside receiver's window. As TCP accepts 14349 * the ack in those retransmitted segments, if the window update in 14350 * the same segment is not accepted, TCP will incorrectly calculates 14351 * that it can send more segments. This can create a deadlock 14352 * with the receiver if its window becomes zero. 14353 */ 14354 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 14355 SEQ_LT(tcp->tcp_swl1, seg_seq) || 14356 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 14357 /* 14358 * The criteria for update is: 14359 * 14360 * 1. the segment acknowledges some data. Or 14361 * 2. the segment is new, i.e. it has a higher seq num. Or 14362 * 3. the segment is not old and the advertised window is 14363 * larger than the previous advertised window. 14364 */ 14365 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 14366 flags |= TH_XMIT_NEEDED; 14367 tcp->tcp_swnd = new_swnd; 14368 if (new_swnd > tcp->tcp_max_swnd) 14369 tcp->tcp_max_swnd = new_swnd; 14370 tcp->tcp_swl1 = seg_seq; 14371 tcp->tcp_swl2 = seg_ack; 14372 } 14373 est: 14374 if (tcp->tcp_state > TCPS_ESTABLISHED) { 14375 14376 switch (tcp->tcp_state) { 14377 case TCPS_FIN_WAIT_1: 14378 if (tcp->tcp_fin_acked) { 14379 tcp->tcp_state = TCPS_FIN_WAIT_2; 14380 /* 14381 * We implement the non-standard BSD/SunOS 14382 * FIN_WAIT_2 flushing algorithm. 14383 * If there is no user attached to this 14384 * TCP endpoint, then this TCP struct 14385 * could hang around forever in FIN_WAIT_2 14386 * state if the peer forgets to send us 14387 * a FIN. To prevent this, we wait only 14388 * 2*MSL (a convenient time value) for 14389 * the FIN to arrive. If it doesn't show up, 14390 * we flush the TCP endpoint. This algorithm, 14391 * though a violation of RFC-793, has worked 14392 * for over 10 years in BSD systems. 14393 * Note: SunOS 4.x waits 675 seconds before 14394 * flushing the FIN_WAIT_2 connection. 14395 */ 14396 TCP_TIMER_RESTART(tcp, 14397 tcp_fin_wait_2_flush_interval); 14398 } 14399 break; 14400 case TCPS_FIN_WAIT_2: 14401 break; /* Shutdown hook? */ 14402 case TCPS_LAST_ACK: 14403 freemsg(mp); 14404 if (tcp->tcp_fin_acked) { 14405 (void) tcp_clean_death(tcp, 0, 19); 14406 return; 14407 } 14408 goto xmit_check; 14409 case TCPS_CLOSING: 14410 if (tcp->tcp_fin_acked) { 14411 tcp->tcp_state = TCPS_TIME_WAIT; 14412 /* 14413 * Unconditionally clear the exclusive binding 14414 * bit so this TIME-WAIT connection won't 14415 * interfere with new ones. 14416 */ 14417 tcp->tcp_exclbind = 0; 14418 if (!TCP_IS_DETACHED(tcp)) { 14419 TCP_TIMER_RESTART(tcp, 14420 tcp_time_wait_interval); 14421 } else { 14422 tcp_time_wait_append(tcp); 14423 TCP_DBGSTAT(tcp_rput_time_wait); 14424 } 14425 } 14426 /*FALLTHRU*/ 14427 case TCPS_CLOSE_WAIT: 14428 freemsg(mp); 14429 goto xmit_check; 14430 default: 14431 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 14432 break; 14433 } 14434 } 14435 if (flags & TH_FIN) { 14436 /* Make sure we ack the fin */ 14437 flags |= TH_ACK_NEEDED; 14438 if (!tcp->tcp_fin_rcvd) { 14439 tcp->tcp_fin_rcvd = B_TRUE; 14440 tcp->tcp_rnxt++; 14441 tcph = tcp->tcp_tcph; 14442 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14443 14444 /* 14445 * Generate the ordrel_ind at the end unless we 14446 * are an eager guy. 14447 * In the eager case tcp_rsrv will do this when run 14448 * after tcp_accept is done. 14449 */ 14450 if (tcp->tcp_listener == NULL && 14451 !TCP_IS_DETACHED(tcp) && (!tcp->tcp_hard_binding)) 14452 flags |= TH_ORDREL_NEEDED; 14453 switch (tcp->tcp_state) { 14454 case TCPS_SYN_RCVD: 14455 case TCPS_ESTABLISHED: 14456 tcp->tcp_state = TCPS_CLOSE_WAIT; 14457 /* Keepalive? */ 14458 break; 14459 case TCPS_FIN_WAIT_1: 14460 if (!tcp->tcp_fin_acked) { 14461 tcp->tcp_state = TCPS_CLOSING; 14462 break; 14463 } 14464 /* FALLTHRU */ 14465 case TCPS_FIN_WAIT_2: 14466 tcp->tcp_state = TCPS_TIME_WAIT; 14467 /* 14468 * Unconditionally clear the exclusive binding 14469 * bit so this TIME-WAIT connection won't 14470 * interfere with new ones. 14471 */ 14472 tcp->tcp_exclbind = 0; 14473 if (!TCP_IS_DETACHED(tcp)) { 14474 TCP_TIMER_RESTART(tcp, 14475 tcp_time_wait_interval); 14476 } else { 14477 tcp_time_wait_append(tcp); 14478 TCP_DBGSTAT(tcp_rput_time_wait); 14479 } 14480 if (seg_len) { 14481 /* 14482 * implies data piggybacked on FIN. 14483 * break to handle data. 14484 */ 14485 break; 14486 } 14487 freemsg(mp); 14488 goto ack_check; 14489 } 14490 } 14491 } 14492 if (mp == NULL) 14493 goto xmit_check; 14494 if (seg_len == 0) { 14495 freemsg(mp); 14496 goto xmit_check; 14497 } 14498 if (mp->b_rptr == mp->b_wptr) { 14499 /* 14500 * The header has been consumed, so we remove the 14501 * zero-length mblk here. 14502 */ 14503 mp1 = mp; 14504 mp = mp->b_cont; 14505 freeb(mp1); 14506 } 14507 tcph = tcp->tcp_tcph; 14508 tcp->tcp_rack_cnt++; 14509 { 14510 uint32_t cur_max; 14511 14512 cur_max = tcp->tcp_rack_cur_max; 14513 if (tcp->tcp_rack_cnt >= cur_max) { 14514 /* 14515 * We have more unacked data than we should - send 14516 * an ACK now. 14517 */ 14518 flags |= TH_ACK_NEEDED; 14519 cur_max++; 14520 if (cur_max > tcp->tcp_rack_abs_max) 14521 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 14522 else 14523 tcp->tcp_rack_cur_max = cur_max; 14524 } else if (TCP_IS_DETACHED(tcp)) { 14525 /* We don't have an ACK timer for detached TCP. */ 14526 flags |= TH_ACK_NEEDED; 14527 } else if (seg_len < mss) { 14528 /* 14529 * If we get a segment that is less than an mss, and we 14530 * already have unacknowledged data, and the amount 14531 * unacknowledged is not a multiple of mss, then we 14532 * better generate an ACK now. Otherwise, this may be 14533 * the tail piece of a transaction, and we would rather 14534 * wait for the response. 14535 */ 14536 uint32_t udif; 14537 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 14538 (uintptr_t)INT_MAX); 14539 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 14540 if (udif && (udif % mss)) 14541 flags |= TH_ACK_NEEDED; 14542 else 14543 flags |= TH_ACK_TIMER_NEEDED; 14544 } else { 14545 /* Start delayed ack timer */ 14546 flags |= TH_ACK_TIMER_NEEDED; 14547 } 14548 } 14549 tcp->tcp_rnxt += seg_len; 14550 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14551 14552 /* Update SACK list */ 14553 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 14554 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 14555 &(tcp->tcp_num_sack_blk)); 14556 } 14557 14558 if (tcp->tcp_urp_mp) { 14559 tcp->tcp_urp_mp->b_cont = mp; 14560 mp = tcp->tcp_urp_mp; 14561 tcp->tcp_urp_mp = NULL; 14562 /* Ready for a new signal. */ 14563 tcp->tcp_urp_last_valid = B_FALSE; 14564 #ifdef DEBUG 14565 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 14566 "tcp_rput: sending exdata_ind %s", 14567 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14568 #endif /* DEBUG */ 14569 } 14570 14571 /* 14572 * Check for ancillary data changes compared to last segment. 14573 */ 14574 if (tcp->tcp_ipv6_recvancillary != 0) { 14575 mp = tcp_rput_add_ancillary(tcp, mp, &ipp); 14576 if (mp == NULL) 14577 return; 14578 } 14579 14580 if (tcp->tcp_listener || tcp->tcp_hard_binding) { 14581 /* 14582 * Side queue inbound data until the accept happens. 14583 * tcp_accept/tcp_rput drains this when the accept happens. 14584 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 14585 * T_EXDATA_IND) it is queued on b_next. 14586 * XXX Make urgent data use this. Requires: 14587 * Removing tcp_listener check for TH_URG 14588 * Making M_PCPROTO and MARK messages skip the eager case 14589 */ 14590 14591 if (tcp->tcp_kssl_pending) { 14592 tcp_kssl_input(tcp, mp); 14593 } else { 14594 tcp_rcv_enqueue(tcp, mp, seg_len); 14595 } 14596 } else { 14597 if (mp->b_datap->db_type != M_DATA || 14598 (flags & TH_MARKNEXT_NEEDED)) { 14599 if (tcp->tcp_rcv_list != NULL) { 14600 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 14601 } 14602 ASSERT(tcp->tcp_rcv_list == NULL || 14603 tcp->tcp_fused_sigurg); 14604 if (flags & TH_MARKNEXT_NEEDED) { 14605 #ifdef DEBUG 14606 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 14607 "tcp_rput: sending MSGMARKNEXT %s", 14608 tcp_display(tcp, NULL, 14609 DISP_PORT_ONLY)); 14610 #endif /* DEBUG */ 14611 mp->b_flag |= MSGMARKNEXT; 14612 flags &= ~TH_MARKNEXT_NEEDED; 14613 } 14614 14615 /* Does this need SSL processing first? */ 14616 if ((tcp->tcp_kssl_ctx != NULL) && 14617 (DB_TYPE(mp) == M_DATA)) { 14618 tcp_kssl_input(tcp, mp); 14619 } else { 14620 putnext(tcp->tcp_rq, mp); 14621 if (!canputnext(tcp->tcp_rq)) 14622 tcp->tcp_rwnd -= seg_len; 14623 } 14624 } else if ((flags & (TH_PUSH|TH_FIN)) || 14625 tcp->tcp_rcv_cnt + seg_len >= tcp->tcp_rq->q_hiwat >> 3) { 14626 if (tcp->tcp_rcv_list != NULL) { 14627 /* 14628 * Enqueue the new segment first and then 14629 * call tcp_rcv_drain() to send all data 14630 * up. The other way to do this is to 14631 * send all queued data up and then call 14632 * putnext() to send the new segment up. 14633 * This way can remove the else part later 14634 * on. 14635 * 14636 * We don't this to avoid one more call to 14637 * canputnext() as tcp_rcv_drain() needs to 14638 * call canputnext(). 14639 */ 14640 tcp_rcv_enqueue(tcp, mp, seg_len); 14641 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 14642 } else { 14643 /* Does this need SSL processing first? */ 14644 if ((tcp->tcp_kssl_ctx != NULL) && 14645 (DB_TYPE(mp) == M_DATA)) { 14646 tcp_kssl_input(tcp, mp); 14647 } else { 14648 putnext(tcp->tcp_rq, mp); 14649 if (!canputnext(tcp->tcp_rq)) 14650 tcp->tcp_rwnd -= seg_len; 14651 } 14652 } 14653 } else { 14654 /* 14655 * Enqueue all packets when processing an mblk 14656 * from the co queue and also enqueue normal packets. 14657 */ 14658 tcp_rcv_enqueue(tcp, mp, seg_len); 14659 } 14660 /* 14661 * Make sure the timer is running if we have data waiting 14662 * for a push bit. This provides resiliency against 14663 * implementations that do not correctly generate push bits. 14664 */ 14665 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) { 14666 /* 14667 * The connection may be closed at this point, so don't 14668 * do anything for a detached tcp. 14669 */ 14670 if (!TCP_IS_DETACHED(tcp)) 14671 tcp->tcp_push_tid = TCP_TIMER(tcp, 14672 tcp_push_timer, 14673 MSEC_TO_TICK(tcp_push_timer_interval)); 14674 } 14675 } 14676 xmit_check: 14677 /* Is there anything left to do? */ 14678 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 14679 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 14680 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 14681 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 14682 goto done; 14683 14684 /* Any transmit work to do and a non-zero window? */ 14685 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 14686 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 14687 if (flags & TH_REXMIT_NEEDED) { 14688 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 14689 14690 BUMP_MIB(&tcp_mib, tcpOutFastRetrans); 14691 if (snd_size > mss) 14692 snd_size = mss; 14693 if (snd_size > tcp->tcp_swnd) 14694 snd_size = tcp->tcp_swnd; 14695 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 14696 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 14697 B_TRUE); 14698 14699 if (mp1 != NULL) { 14700 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 14701 tcp->tcp_csuna = tcp->tcp_snxt; 14702 BUMP_MIB(&tcp_mib, tcpRetransSegs); 14703 UPDATE_MIB(&tcp_mib, tcpRetransBytes, snd_size); 14704 TCP_RECORD_TRACE(tcp, mp1, 14705 TCP_TRACE_SEND_PKT); 14706 tcp_send_data(tcp, tcp->tcp_wq, mp1); 14707 } 14708 } 14709 if (flags & TH_NEED_SACK_REXMIT) { 14710 tcp_sack_rxmit(tcp, &flags); 14711 } 14712 /* 14713 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 14714 * out new segment. Note that tcp_rexmit should not be 14715 * set, otherwise TH_LIMIT_XMIT should not be set. 14716 */ 14717 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 14718 if (!tcp->tcp_rexmit) { 14719 tcp_wput_data(tcp, NULL, B_FALSE); 14720 } else { 14721 tcp_ss_rexmit(tcp); 14722 } 14723 } 14724 /* 14725 * Adjust tcp_cwnd back to normal value after sending 14726 * new data segments. 14727 */ 14728 if (flags & TH_LIMIT_XMIT) { 14729 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 14730 /* 14731 * This will restart the timer. Restarting the 14732 * timer is used to avoid a timeout before the 14733 * limited transmitted segment's ACK gets back. 14734 */ 14735 if (tcp->tcp_xmit_head != NULL) 14736 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 14737 } 14738 14739 /* Anything more to do? */ 14740 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 14741 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 14742 goto done; 14743 } 14744 ack_check: 14745 if (flags & TH_SEND_URP_MARK) { 14746 ASSERT(tcp->tcp_urp_mark_mp); 14747 /* 14748 * Send up any queued data and then send the mark message 14749 */ 14750 if (tcp->tcp_rcv_list != NULL) { 14751 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 14752 } 14753 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 14754 14755 mp1 = tcp->tcp_urp_mark_mp; 14756 tcp->tcp_urp_mark_mp = NULL; 14757 #ifdef DEBUG 14758 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 14759 "tcp_rput: sending zero-length %s %s", 14760 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 14761 "MSGNOTMARKNEXT"), 14762 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14763 #endif /* DEBUG */ 14764 putnext(tcp->tcp_rq, mp1); 14765 flags &= ~TH_SEND_URP_MARK; 14766 } 14767 if (flags & TH_ACK_NEEDED) { 14768 /* 14769 * Time to send an ack for some reason. 14770 */ 14771 mp1 = tcp_ack_mp(tcp); 14772 14773 if (mp1 != NULL) { 14774 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 14775 tcp_send_data(tcp, tcp->tcp_wq, mp1); 14776 BUMP_LOCAL(tcp->tcp_obsegs); 14777 BUMP_MIB(&tcp_mib, tcpOutAck); 14778 } 14779 if (tcp->tcp_ack_tid != 0) { 14780 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 14781 tcp->tcp_ack_tid = 0; 14782 } 14783 } 14784 if (flags & TH_ACK_TIMER_NEEDED) { 14785 /* 14786 * Arrange for deferred ACK or push wait timeout. 14787 * Start timer if it is not already running. 14788 */ 14789 if (tcp->tcp_ack_tid == 0) { 14790 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 14791 MSEC_TO_TICK(tcp->tcp_localnet ? 14792 (clock_t)tcp_local_dack_interval : 14793 (clock_t)tcp_deferred_ack_interval)); 14794 } 14795 } 14796 if (flags & TH_ORDREL_NEEDED) { 14797 /* 14798 * Send up the ordrel_ind unless we are an eager guy. 14799 * In the eager case tcp_rsrv will do this when run 14800 * after tcp_accept is done. 14801 */ 14802 ASSERT(tcp->tcp_listener == NULL); 14803 if (tcp->tcp_rcv_list != NULL) { 14804 /* 14805 * Push any mblk(s) enqueued from co processing. 14806 */ 14807 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 14808 } 14809 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 14810 if ((mp1 = mi_tpi_ordrel_ind()) != NULL) { 14811 tcp->tcp_ordrel_done = B_TRUE; 14812 putnext(tcp->tcp_rq, mp1); 14813 if (tcp->tcp_deferred_clean_death) { 14814 /* 14815 * tcp_clean_death was deferred 14816 * for T_ORDREL_IND - do it now 14817 */ 14818 (void) tcp_clean_death(tcp, 14819 tcp->tcp_client_errno, 20); 14820 tcp->tcp_deferred_clean_death = B_FALSE; 14821 } 14822 } else { 14823 /* 14824 * Run the orderly release in the 14825 * service routine. 14826 */ 14827 qenable(tcp->tcp_rq); 14828 /* 14829 * Caveat(XXX): The machine may be so 14830 * overloaded that tcp_rsrv() is not scheduled 14831 * until after the endpoint has transitioned 14832 * to TCPS_TIME_WAIT 14833 * and tcp_time_wait_interval expires. Then 14834 * tcp_timer() will blow away state in tcp_t 14835 * and T_ORDREL_IND will never be delivered 14836 * upstream. Unlikely but potentially 14837 * a problem. 14838 */ 14839 } 14840 } 14841 done: 14842 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 14843 } 14844 14845 /* 14846 * This function does PAWS protection check. Returns B_TRUE if the 14847 * segment passes the PAWS test, else returns B_FALSE. 14848 */ 14849 boolean_t 14850 tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp) 14851 { 14852 uint8_t flags; 14853 int options; 14854 uint8_t *up; 14855 14856 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 14857 /* 14858 * If timestamp option is aligned nicely, get values inline, 14859 * otherwise call general routine to parse. Only do that 14860 * if timestamp is the only option. 14861 */ 14862 if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH + 14863 TCPOPT_REAL_TS_LEN && 14864 OK_32PTR((up = ((uint8_t *)tcph) + 14865 TCP_MIN_HEADER_LENGTH)) && 14866 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 14867 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 14868 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 14869 14870 options = TCP_OPT_TSTAMP_PRESENT; 14871 } else { 14872 if (tcp->tcp_snd_sack_ok) { 14873 tcpoptp->tcp = tcp; 14874 } else { 14875 tcpoptp->tcp = NULL; 14876 } 14877 options = tcp_parse_options(tcph, tcpoptp); 14878 } 14879 14880 if (options & TCP_OPT_TSTAMP_PRESENT) { 14881 /* 14882 * Do PAWS per RFC 1323 section 4.2. Accept RST 14883 * regardless of the timestamp, page 18 RFC 1323.bis. 14884 */ 14885 if ((flags & TH_RST) == 0 && 14886 TSTMP_LT(tcpoptp->tcp_opt_ts_val, 14887 tcp->tcp_ts_recent)) { 14888 if (TSTMP_LT(lbolt64, tcp->tcp_last_rcv_lbolt + 14889 PAWS_TIMEOUT)) { 14890 /* This segment is not acceptable. */ 14891 return (B_FALSE); 14892 } else { 14893 /* 14894 * Connection has been idle for 14895 * too long. Reset the timestamp 14896 * and assume the segment is valid. 14897 */ 14898 tcp->tcp_ts_recent = 14899 tcpoptp->tcp_opt_ts_val; 14900 } 14901 } 14902 } else { 14903 /* 14904 * If we don't get a timestamp on every packet, we 14905 * figure we can't really trust 'em, so we stop sending 14906 * and parsing them. 14907 */ 14908 tcp->tcp_snd_ts_ok = B_FALSE; 14909 14910 tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 14911 tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 14912 tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4); 14913 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN); 14914 if (tcp->tcp_snd_sack_ok) { 14915 ASSERT(tcp->tcp_sack_info != NULL); 14916 tcp->tcp_max_sack_blk = 4; 14917 } 14918 } 14919 return (B_TRUE); 14920 } 14921 14922 /* 14923 * Attach ancillary data to a received TCP segments for the 14924 * ancillary pieces requested by the application that are 14925 * different than they were in the previous data segment. 14926 * 14927 * Save the "current" values once memory allocation is ok so that 14928 * when memory allocation fails we can just wait for the next data segment. 14929 */ 14930 static mblk_t * 14931 tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp) 14932 { 14933 struct T_optdata_ind *todi; 14934 int optlen; 14935 uchar_t *optptr; 14936 struct T_opthdr *toh; 14937 uint_t addflag; /* Which pieces to add */ 14938 mblk_t *mp1; 14939 14940 optlen = 0; 14941 addflag = 0; 14942 /* If app asked for pktinfo and the index has changed ... */ 14943 if ((ipp->ipp_fields & IPPF_IFINDEX) && 14944 ipp->ipp_ifindex != tcp->tcp_recvifindex && 14945 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)) { 14946 optlen += sizeof (struct T_opthdr) + 14947 sizeof (struct in6_pktinfo); 14948 addflag |= TCP_IPV6_RECVPKTINFO; 14949 } 14950 /* If app asked for hoplimit and it has changed ... */ 14951 if ((ipp->ipp_fields & IPPF_HOPLIMIT) && 14952 ipp->ipp_hoplimit != tcp->tcp_recvhops && 14953 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT)) { 14954 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 14955 addflag |= TCP_IPV6_RECVHOPLIMIT; 14956 } 14957 /* If app asked for tclass and it has changed ... */ 14958 if ((ipp->ipp_fields & IPPF_TCLASS) && 14959 ipp->ipp_tclass != tcp->tcp_recvtclass && 14960 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)) { 14961 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 14962 addflag |= TCP_IPV6_RECVTCLASS; 14963 } 14964 /* 14965 * If app asked for hopbyhop headers and it has changed ... 14966 * For security labels, note that (1) security labels can't change on 14967 * a connected socket at all, (2) we're connected to at most one peer, 14968 * (3) if anything changes, then it must be some other extra option. 14969 */ 14970 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) && 14971 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 14972 (ipp->ipp_fields & IPPF_HOPOPTS), 14973 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 14974 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen - 14975 tcp->tcp_label_len; 14976 addflag |= TCP_IPV6_RECVHOPOPTS; 14977 if (!ip_allocbuf((void **)&tcp->tcp_hopopts, 14978 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), 14979 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 14980 return (mp); 14981 } 14982 /* If app asked for dst headers before routing headers ... */ 14983 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) && 14984 ip_cmpbuf(tcp->tcp_rtdstopts, tcp->tcp_rtdstoptslen, 14985 (ipp->ipp_fields & IPPF_RTDSTOPTS), 14986 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) { 14987 optlen += sizeof (struct T_opthdr) + 14988 ipp->ipp_rtdstoptslen; 14989 addflag |= TCP_IPV6_RECVRTDSTOPTS; 14990 if (!ip_allocbuf((void **)&tcp->tcp_rtdstopts, 14991 &tcp->tcp_rtdstoptslen, (ipp->ipp_fields & IPPF_RTDSTOPTS), 14992 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) 14993 return (mp); 14994 } 14995 /* If app asked for routing headers and it has changed ... */ 14996 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) && 14997 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 14998 (ipp->ipp_fields & IPPF_RTHDR), 14999 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 15000 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 15001 addflag |= TCP_IPV6_RECVRTHDR; 15002 if (!ip_allocbuf((void **)&tcp->tcp_rthdr, 15003 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), 15004 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 15005 return (mp); 15006 } 15007 /* If app asked for dest headers and it has changed ... */ 15008 if ((tcp->tcp_ipv6_recvancillary & 15009 (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) && 15010 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 15011 (ipp->ipp_fields & IPPF_DSTOPTS), 15012 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 15013 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 15014 addflag |= TCP_IPV6_RECVDSTOPTS; 15015 if (!ip_allocbuf((void **)&tcp->tcp_dstopts, 15016 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), 15017 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 15018 return (mp); 15019 } 15020 15021 if (optlen == 0) { 15022 /* Nothing to add */ 15023 return (mp); 15024 } 15025 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 15026 if (mp1 == NULL) { 15027 /* 15028 * Defer sending ancillary data until the next TCP segment 15029 * arrives. 15030 */ 15031 return (mp); 15032 } 15033 mp1->b_cont = mp; 15034 mp = mp1; 15035 mp->b_wptr += sizeof (*todi) + optlen; 15036 mp->b_datap->db_type = M_PROTO; 15037 todi = (struct T_optdata_ind *)mp->b_rptr; 15038 todi->PRIM_type = T_OPTDATA_IND; 15039 todi->DATA_flag = 1; /* MORE data */ 15040 todi->OPT_length = optlen; 15041 todi->OPT_offset = sizeof (*todi); 15042 optptr = (uchar_t *)&todi[1]; 15043 /* 15044 * If app asked for pktinfo and the index has changed ... 15045 * Note that the local address never changes for the connection. 15046 */ 15047 if (addflag & TCP_IPV6_RECVPKTINFO) { 15048 struct in6_pktinfo *pkti; 15049 15050 toh = (struct T_opthdr *)optptr; 15051 toh->level = IPPROTO_IPV6; 15052 toh->name = IPV6_PKTINFO; 15053 toh->len = sizeof (*toh) + sizeof (*pkti); 15054 toh->status = 0; 15055 optptr += sizeof (*toh); 15056 pkti = (struct in6_pktinfo *)optptr; 15057 if (tcp->tcp_ipversion == IPV6_VERSION) 15058 pkti->ipi6_addr = tcp->tcp_ip6h->ip6_src; 15059 else 15060 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 15061 &pkti->ipi6_addr); 15062 pkti->ipi6_ifindex = ipp->ipp_ifindex; 15063 optptr += sizeof (*pkti); 15064 ASSERT(OK_32PTR(optptr)); 15065 /* Save as "last" value */ 15066 tcp->tcp_recvifindex = ipp->ipp_ifindex; 15067 } 15068 /* If app asked for hoplimit and it has changed ... */ 15069 if (addflag & TCP_IPV6_RECVHOPLIMIT) { 15070 toh = (struct T_opthdr *)optptr; 15071 toh->level = IPPROTO_IPV6; 15072 toh->name = IPV6_HOPLIMIT; 15073 toh->len = sizeof (*toh) + sizeof (uint_t); 15074 toh->status = 0; 15075 optptr += sizeof (*toh); 15076 *(uint_t *)optptr = ipp->ipp_hoplimit; 15077 optptr += sizeof (uint_t); 15078 ASSERT(OK_32PTR(optptr)); 15079 /* Save as "last" value */ 15080 tcp->tcp_recvhops = ipp->ipp_hoplimit; 15081 } 15082 /* If app asked for tclass and it has changed ... */ 15083 if (addflag & TCP_IPV6_RECVTCLASS) { 15084 toh = (struct T_opthdr *)optptr; 15085 toh->level = IPPROTO_IPV6; 15086 toh->name = IPV6_TCLASS; 15087 toh->len = sizeof (*toh) + sizeof (uint_t); 15088 toh->status = 0; 15089 optptr += sizeof (*toh); 15090 *(uint_t *)optptr = ipp->ipp_tclass; 15091 optptr += sizeof (uint_t); 15092 ASSERT(OK_32PTR(optptr)); 15093 /* Save as "last" value */ 15094 tcp->tcp_recvtclass = ipp->ipp_tclass; 15095 } 15096 if (addflag & TCP_IPV6_RECVHOPOPTS) { 15097 toh = (struct T_opthdr *)optptr; 15098 toh->level = IPPROTO_IPV6; 15099 toh->name = IPV6_HOPOPTS; 15100 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen - 15101 tcp->tcp_label_len; 15102 toh->status = 0; 15103 optptr += sizeof (*toh); 15104 bcopy((uchar_t *)ipp->ipp_hopopts + tcp->tcp_label_len, optptr, 15105 ipp->ipp_hopoptslen - tcp->tcp_label_len); 15106 optptr += ipp->ipp_hopoptslen - tcp->tcp_label_len; 15107 ASSERT(OK_32PTR(optptr)); 15108 /* Save as last value */ 15109 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, 15110 (ipp->ipp_fields & IPPF_HOPOPTS), 15111 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 15112 } 15113 if (addflag & TCP_IPV6_RECVRTDSTOPTS) { 15114 toh = (struct T_opthdr *)optptr; 15115 toh->level = IPPROTO_IPV6; 15116 toh->name = IPV6_RTHDRDSTOPTS; 15117 toh->len = sizeof (*toh) + ipp->ipp_rtdstoptslen; 15118 toh->status = 0; 15119 optptr += sizeof (*toh); 15120 bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen); 15121 optptr += ipp->ipp_rtdstoptslen; 15122 ASSERT(OK_32PTR(optptr)); 15123 /* Save as last value */ 15124 ip_savebuf((void **)&tcp->tcp_rtdstopts, 15125 &tcp->tcp_rtdstoptslen, 15126 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15127 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 15128 } 15129 if (addflag & TCP_IPV6_RECVRTHDR) { 15130 toh = (struct T_opthdr *)optptr; 15131 toh->level = IPPROTO_IPV6; 15132 toh->name = IPV6_RTHDR; 15133 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 15134 toh->status = 0; 15135 optptr += sizeof (*toh); 15136 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 15137 optptr += ipp->ipp_rthdrlen; 15138 ASSERT(OK_32PTR(optptr)); 15139 /* Save as last value */ 15140 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, 15141 (ipp->ipp_fields & IPPF_RTHDR), 15142 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 15143 } 15144 if (addflag & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) { 15145 toh = (struct T_opthdr *)optptr; 15146 toh->level = IPPROTO_IPV6; 15147 toh->name = IPV6_DSTOPTS; 15148 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 15149 toh->status = 0; 15150 optptr += sizeof (*toh); 15151 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 15152 optptr += ipp->ipp_dstoptslen; 15153 ASSERT(OK_32PTR(optptr)); 15154 /* Save as last value */ 15155 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, 15156 (ipp->ipp_fields & IPPF_DSTOPTS), 15157 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 15158 } 15159 ASSERT(optptr == mp->b_wptr); 15160 return (mp); 15161 } 15162 15163 15164 /* 15165 * Handle a *T_BIND_REQ that has failed either due to a T_ERROR_ACK 15166 * or a "bad" IRE detected by tcp_adapt_ire. 15167 * We can't tell if the failure was due to the laddr or the faddr 15168 * thus we clear out all addresses and ports. 15169 */ 15170 static void 15171 tcp_bind_failed(tcp_t *tcp, mblk_t *mp, int error) 15172 { 15173 queue_t *q = tcp->tcp_rq; 15174 tcph_t *tcph; 15175 struct T_error_ack *tea; 15176 conn_t *connp = tcp->tcp_connp; 15177 15178 15179 ASSERT(mp->b_datap->db_type == M_PCPROTO); 15180 15181 if (mp->b_cont) { 15182 freemsg(mp->b_cont); 15183 mp->b_cont = NULL; 15184 } 15185 tea = (struct T_error_ack *)mp->b_rptr; 15186 switch (tea->PRIM_type) { 15187 case T_BIND_ACK: 15188 /* 15189 * Need to unbind with classifier since we were just told that 15190 * our bind succeeded. 15191 */ 15192 tcp->tcp_hard_bound = B_FALSE; 15193 tcp->tcp_hard_binding = B_FALSE; 15194 15195 ipcl_hash_remove(connp); 15196 /* Reuse the mblk if possible */ 15197 ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >= 15198 sizeof (*tea)); 15199 mp->b_rptr = mp->b_datap->db_base; 15200 mp->b_wptr = mp->b_rptr + sizeof (*tea); 15201 tea = (struct T_error_ack *)mp->b_rptr; 15202 tea->PRIM_type = T_ERROR_ACK; 15203 tea->TLI_error = TSYSERR; 15204 tea->UNIX_error = error; 15205 if (tcp->tcp_state >= TCPS_SYN_SENT) { 15206 tea->ERROR_prim = T_CONN_REQ; 15207 } else { 15208 tea->ERROR_prim = O_T_BIND_REQ; 15209 } 15210 break; 15211 15212 case T_ERROR_ACK: 15213 if (tcp->tcp_state >= TCPS_SYN_SENT) 15214 tea->ERROR_prim = T_CONN_REQ; 15215 break; 15216 default: 15217 panic("tcp_bind_failed: unexpected TPI type"); 15218 /*NOTREACHED*/ 15219 } 15220 15221 tcp->tcp_state = TCPS_IDLE; 15222 if (tcp->tcp_ipversion == IPV4_VERSION) 15223 tcp->tcp_ipha->ipha_src = 0; 15224 else 15225 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 15226 /* 15227 * Copy of the src addr. in tcp_t is needed since 15228 * the lookup funcs. can only look at tcp_t 15229 */ 15230 V6_SET_ZERO(tcp->tcp_ip_src_v6); 15231 15232 tcph = tcp->tcp_tcph; 15233 tcph->th_lport[0] = 0; 15234 tcph->th_lport[1] = 0; 15235 tcp_bind_hash_remove(tcp); 15236 bzero(&connp->u_port, sizeof (connp->u_port)); 15237 /* blow away saved option results if any */ 15238 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 15239 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 15240 15241 conn_delete_ire(tcp->tcp_connp, NULL); 15242 putnext(q, mp); 15243 } 15244 15245 /* 15246 * tcp_rput_other is called by tcp_rput to handle everything other than M_DATA 15247 * messages. 15248 */ 15249 void 15250 tcp_rput_other(tcp_t *tcp, mblk_t *mp) 15251 { 15252 mblk_t *mp1; 15253 uchar_t *rptr = mp->b_rptr; 15254 queue_t *q = tcp->tcp_rq; 15255 struct T_error_ack *tea; 15256 uint32_t mss; 15257 mblk_t *syn_mp; 15258 mblk_t *mdti; 15259 int retval; 15260 mblk_t *ire_mp; 15261 15262 switch (mp->b_datap->db_type) { 15263 case M_PROTO: 15264 case M_PCPROTO: 15265 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 15266 if ((mp->b_wptr - rptr) < sizeof (t_scalar_t)) 15267 break; 15268 tea = (struct T_error_ack *)rptr; 15269 switch (tea->PRIM_type) { 15270 case T_BIND_ACK: 15271 /* 15272 * Adapt Multidata information, if any. The 15273 * following tcp_mdt_update routine will free 15274 * the message. 15275 */ 15276 if ((mdti = tcp_mdt_info_mp(mp)) != NULL) { 15277 tcp_mdt_update(tcp, &((ip_mdt_info_t *)mdti-> 15278 b_rptr)->mdt_capab, B_TRUE); 15279 freemsg(mdti); 15280 } 15281 15282 /* Get the IRE, if we had requested for it */ 15283 ire_mp = tcp_ire_mp(mp); 15284 15285 if (tcp->tcp_hard_binding) { 15286 tcp->tcp_hard_binding = B_FALSE; 15287 tcp->tcp_hard_bound = B_TRUE; 15288 CL_INET_CONNECT(tcp); 15289 } else { 15290 if (ire_mp != NULL) 15291 freeb(ire_mp); 15292 goto after_syn_sent; 15293 } 15294 15295 retval = tcp_adapt_ire(tcp, ire_mp); 15296 if (ire_mp != NULL) 15297 freeb(ire_mp); 15298 if (retval == 0) { 15299 tcp_bind_failed(tcp, mp, 15300 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15301 ENETUNREACH : EADDRNOTAVAIL)); 15302 return; 15303 } 15304 /* 15305 * Don't let an endpoint connect to itself. 15306 * Also checked in tcp_connect() but that 15307 * check can't handle the case when the 15308 * local IP address is INADDR_ANY. 15309 */ 15310 if (tcp->tcp_ipversion == IPV4_VERSION) { 15311 if ((tcp->tcp_ipha->ipha_dst == 15312 tcp->tcp_ipha->ipha_src) && 15313 (BE16_EQL(tcp->tcp_tcph->th_lport, 15314 tcp->tcp_tcph->th_fport))) { 15315 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15316 return; 15317 } 15318 } else { 15319 if (IN6_ARE_ADDR_EQUAL( 15320 &tcp->tcp_ip6h->ip6_dst, 15321 &tcp->tcp_ip6h->ip6_src) && 15322 (BE16_EQL(tcp->tcp_tcph->th_lport, 15323 tcp->tcp_tcph->th_fport))) { 15324 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15325 return; 15326 } 15327 } 15328 ASSERT(tcp->tcp_state == TCPS_SYN_SENT); 15329 /* 15330 * This should not be possible! Just for 15331 * defensive coding... 15332 */ 15333 if (tcp->tcp_state != TCPS_SYN_SENT) 15334 goto after_syn_sent; 15335 15336 if (is_system_labeled() && 15337 !tcp_update_label(tcp, CONN_CRED(tcp->tcp_connp))) { 15338 tcp_bind_failed(tcp, mp, EHOSTUNREACH); 15339 return; 15340 } 15341 15342 ASSERT(q == tcp->tcp_rq); 15343 /* 15344 * tcp_adapt_ire() does not adjust 15345 * for TCP/IP header length. 15346 */ 15347 mss = tcp->tcp_mss - tcp->tcp_hdr_len; 15348 15349 /* 15350 * Just make sure our rwnd is at 15351 * least tcp_recv_hiwat_mss * MSS 15352 * large, and round up to the nearest 15353 * MSS. 15354 * 15355 * We do the round up here because 15356 * we need to get the interface 15357 * MTU first before we can do the 15358 * round up. 15359 */ 15360 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 15361 tcp_recv_hiwat_minmss * mss); 15362 q->q_hiwat = tcp->tcp_rwnd; 15363 tcp_set_ws_value(tcp); 15364 U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws), 15365 tcp->tcp_tcph->th_win); 15366 if (tcp->tcp_rcv_ws > 0 || tcp_wscale_always) 15367 tcp->tcp_snd_ws_ok = B_TRUE; 15368 15369 /* 15370 * Set tcp_snd_ts_ok to true 15371 * so that tcp_xmit_mp will 15372 * include the timestamp 15373 * option in the SYN segment. 15374 */ 15375 if (tcp_tstamp_always || 15376 (tcp->tcp_rcv_ws && tcp_tstamp_if_wscale)) { 15377 tcp->tcp_snd_ts_ok = B_TRUE; 15378 } 15379 15380 /* 15381 * tcp_snd_sack_ok can be set in 15382 * tcp_adapt_ire() if the sack metric 15383 * is set. So check it here also. 15384 */ 15385 if (tcp_sack_permitted == 2 || 15386 tcp->tcp_snd_sack_ok) { 15387 if (tcp->tcp_sack_info == NULL) { 15388 tcp->tcp_sack_info = 15389 kmem_cache_alloc(tcp_sack_info_cache, 15390 KM_SLEEP); 15391 } 15392 tcp->tcp_snd_sack_ok = B_TRUE; 15393 } 15394 15395 /* 15396 * Should we use ECN? Note that the current 15397 * default value (SunOS 5.9) of tcp_ecn_permitted 15398 * is 1. The reason for doing this is that there 15399 * are equipments out there that will drop ECN 15400 * enabled IP packets. Setting it to 1 avoids 15401 * compatibility problems. 15402 */ 15403 if (tcp_ecn_permitted == 2) 15404 tcp->tcp_ecn_ok = B_TRUE; 15405 15406 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15407 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 15408 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 15409 if (syn_mp) { 15410 cred_t *cr; 15411 pid_t pid; 15412 15413 /* 15414 * Obtain the credential from the 15415 * thread calling connect(); the credential 15416 * lives on in the second mblk which 15417 * originated from T_CONN_REQ and is echoed 15418 * with the T_BIND_ACK from ip. If none 15419 * can be found, default to the creator 15420 * of the socket. 15421 */ 15422 if (mp->b_cont == NULL || 15423 (cr = DB_CRED(mp->b_cont)) == NULL) { 15424 cr = tcp->tcp_cred; 15425 pid = tcp->tcp_cpid; 15426 } else { 15427 pid = DB_CPID(mp->b_cont); 15428 } 15429 15430 TCP_RECORD_TRACE(tcp, syn_mp, 15431 TCP_TRACE_SEND_PKT); 15432 mblk_setcred(syn_mp, cr); 15433 DB_CPID(syn_mp) = pid; 15434 tcp_send_data(tcp, tcp->tcp_wq, syn_mp); 15435 } 15436 after_syn_sent: 15437 /* 15438 * A trailer mblk indicates a waiting client upstream. 15439 * We complete here the processing begun in 15440 * either tcp_bind() or tcp_connect() by passing 15441 * upstream the reply message they supplied. 15442 */ 15443 mp1 = mp; 15444 mp = mp->b_cont; 15445 freeb(mp1); 15446 if (mp) 15447 break; 15448 return; 15449 case T_ERROR_ACK: 15450 if (tcp->tcp_debug) { 15451 (void) strlog(TCP_MOD_ID, 0, 1, 15452 SL_TRACE|SL_ERROR, 15453 "tcp_rput_other: case T_ERROR_ACK, " 15454 "ERROR_prim == %d", 15455 tea->ERROR_prim); 15456 } 15457 switch (tea->ERROR_prim) { 15458 case O_T_BIND_REQ: 15459 case T_BIND_REQ: 15460 tcp_bind_failed(tcp, mp, 15461 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15462 ENETUNREACH : EADDRNOTAVAIL)); 15463 return; 15464 case T_UNBIND_REQ: 15465 tcp->tcp_hard_binding = B_FALSE; 15466 tcp->tcp_hard_bound = B_FALSE; 15467 if (mp->b_cont) { 15468 freemsg(mp->b_cont); 15469 mp->b_cont = NULL; 15470 } 15471 if (tcp->tcp_unbind_pending) 15472 tcp->tcp_unbind_pending = 0; 15473 else { 15474 /* From tcp_ip_unbind() - free */ 15475 freemsg(mp); 15476 return; 15477 } 15478 break; 15479 case T_SVR4_OPTMGMT_REQ: 15480 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15481 /* T_OPTMGMT_REQ generated by TCP */ 15482 printf("T_SVR4_OPTMGMT_REQ failed " 15483 "%d/%d - dropped (cnt %d)\n", 15484 tea->TLI_error, tea->UNIX_error, 15485 tcp->tcp_drop_opt_ack_cnt); 15486 freemsg(mp); 15487 tcp->tcp_drop_opt_ack_cnt--; 15488 return; 15489 } 15490 break; 15491 } 15492 if (tea->ERROR_prim == T_SVR4_OPTMGMT_REQ && 15493 tcp->tcp_drop_opt_ack_cnt > 0) { 15494 printf("T_SVR4_OPTMGMT_REQ failed %d/%d " 15495 "- dropped (cnt %d)\n", 15496 tea->TLI_error, tea->UNIX_error, 15497 tcp->tcp_drop_opt_ack_cnt); 15498 freemsg(mp); 15499 tcp->tcp_drop_opt_ack_cnt--; 15500 return; 15501 } 15502 break; 15503 case T_OPTMGMT_ACK: 15504 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15505 /* T_OPTMGMT_REQ generated by TCP */ 15506 freemsg(mp); 15507 tcp->tcp_drop_opt_ack_cnt--; 15508 return; 15509 } 15510 break; 15511 default: 15512 break; 15513 } 15514 break; 15515 case M_CTL: 15516 /* 15517 * ICMP messages. 15518 */ 15519 tcp_icmp_error(tcp, mp); 15520 return; 15521 case M_FLUSH: 15522 if (*rptr & FLUSHR) 15523 flushq(q, FLUSHDATA); 15524 break; 15525 default: 15526 break; 15527 } 15528 /* 15529 * Make sure we set this bit before sending the ACK for 15530 * bind. Otherwise accept could possibly run and free 15531 * this tcp struct. 15532 */ 15533 putnext(q, mp); 15534 } 15535 15536 /* 15537 * Called as the result of a qbufcall or a qtimeout to remedy a failure 15538 * to allocate a T_ordrel_ind in tcp_rsrv(). qenable(q) will make 15539 * tcp_rsrv() try again. 15540 */ 15541 static void 15542 tcp_ordrel_kick(void *arg) 15543 { 15544 conn_t *connp = (conn_t *)arg; 15545 tcp_t *tcp = connp->conn_tcp; 15546 15547 tcp->tcp_ordrelid = 0; 15548 tcp->tcp_timeout = B_FALSE; 15549 if (!TCP_IS_DETACHED(tcp) && tcp->tcp_rq != NULL && 15550 tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 15551 qenable(tcp->tcp_rq); 15552 } 15553 } 15554 15555 /* ARGSUSED */ 15556 static void 15557 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2) 15558 { 15559 conn_t *connp = (conn_t *)arg; 15560 tcp_t *tcp = connp->conn_tcp; 15561 queue_t *q = tcp->tcp_rq; 15562 uint_t thwin; 15563 15564 freeb(mp); 15565 15566 TCP_STAT(tcp_rsrv_calls); 15567 15568 if (TCP_IS_DETACHED(tcp) || q == NULL) { 15569 return; 15570 } 15571 15572 if (tcp->tcp_fused) { 15573 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 15574 15575 ASSERT(tcp->tcp_fused); 15576 ASSERT(peer_tcp != NULL && peer_tcp->tcp_fused); 15577 ASSERT(peer_tcp->tcp_loopback_peer == tcp); 15578 ASSERT(!TCP_IS_DETACHED(tcp)); 15579 ASSERT(tcp->tcp_connp->conn_sqp == 15580 peer_tcp->tcp_connp->conn_sqp); 15581 15582 /* 15583 * Normally we would not get backenabled in synchronous 15584 * streams mode, but in case this happens, we need to plug 15585 * synchronous streams during our drain to prevent a race 15586 * with tcp_fuse_rrw() or tcp_fuse_rinfop(). 15587 */ 15588 TCP_FUSE_SYNCSTR_PLUG_DRAIN(tcp); 15589 if (tcp->tcp_rcv_list != NULL) 15590 (void) tcp_rcv_drain(tcp->tcp_rq, tcp); 15591 15592 tcp_clrqfull(peer_tcp); 15593 TCP_FUSE_SYNCSTR_UNPLUG_DRAIN(tcp); 15594 TCP_STAT(tcp_fusion_backenabled); 15595 return; 15596 } 15597 15598 if (canputnext(q)) { 15599 tcp->tcp_rwnd = q->q_hiwat; 15600 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 15601 << tcp->tcp_rcv_ws; 15602 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 15603 /* 15604 * Send back a window update immediately if TCP is above 15605 * ESTABLISHED state and the increase of the rcv window 15606 * that the other side knows is at least 1 MSS after flow 15607 * control is lifted. 15608 */ 15609 if (tcp->tcp_state >= TCPS_ESTABLISHED && 15610 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 15611 tcp_xmit_ctl(NULL, tcp, 15612 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 15613 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 15614 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 15615 } 15616 } 15617 /* Handle a failure to allocate a T_ORDREL_IND here */ 15618 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 15619 ASSERT(tcp->tcp_listener == NULL); 15620 if (tcp->tcp_rcv_list != NULL) { 15621 (void) tcp_rcv_drain(q, tcp); 15622 } 15623 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 15624 mp = mi_tpi_ordrel_ind(); 15625 if (mp) { 15626 tcp->tcp_ordrel_done = B_TRUE; 15627 putnext(q, mp); 15628 if (tcp->tcp_deferred_clean_death) { 15629 /* 15630 * tcp_clean_death was deferred for 15631 * T_ORDREL_IND - do it now 15632 */ 15633 tcp->tcp_deferred_clean_death = B_FALSE; 15634 (void) tcp_clean_death(tcp, 15635 tcp->tcp_client_errno, 22); 15636 } 15637 } else if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 15638 /* 15639 * If there isn't already a timer running 15640 * start one. Use a 4 second 15641 * timer as a fallback since it can't fail. 15642 */ 15643 tcp->tcp_timeout = B_TRUE; 15644 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 15645 MSEC_TO_TICK(4000)); 15646 } 15647 } 15648 } 15649 15650 /* 15651 * The read side service routine is called mostly when we get back-enabled as a 15652 * result of flow control relief. Since we don't actually queue anything in 15653 * TCP, we have no data to send out of here. What we do is clear the receive 15654 * window, and send out a window update. 15655 * This routine is also called to drive an orderly release message upstream 15656 * if the attempt in tcp_rput failed. 15657 */ 15658 static void 15659 tcp_rsrv(queue_t *q) 15660 { 15661 conn_t *connp = Q_TO_CONN(q); 15662 tcp_t *tcp = connp->conn_tcp; 15663 mblk_t *mp; 15664 15665 /* No code does a putq on the read side */ 15666 ASSERT(q->q_first == NULL); 15667 15668 /* Nothing to do for the default queue */ 15669 if (q == tcp_g_q) { 15670 return; 15671 } 15672 15673 mp = allocb(0, BPRI_HI); 15674 if (mp == NULL) { 15675 /* 15676 * We are under memory pressure. Return for now and we 15677 * we will be called again later. 15678 */ 15679 if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 15680 /* 15681 * If there isn't already a timer running 15682 * start one. Use a 4 second 15683 * timer as a fallback since it can't fail. 15684 */ 15685 tcp->tcp_timeout = B_TRUE; 15686 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 15687 MSEC_TO_TICK(4000)); 15688 } 15689 return; 15690 } 15691 CONN_INC_REF(connp); 15692 squeue_enter(connp->conn_sqp, mp, tcp_rsrv_input, connp, 15693 SQTAG_TCP_RSRV); 15694 } 15695 15696 /* 15697 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 15698 * We do not allow the receive window to shrink. After setting rwnd, 15699 * set the flow control hiwat of the stream. 15700 * 15701 * This function is called in 2 cases: 15702 * 15703 * 1) Before data transfer begins, in tcp_accept_comm() for accepting a 15704 * connection (passive open) and in tcp_rput_data() for active connect. 15705 * This is called after tcp_mss_set() when the desired MSS value is known. 15706 * This makes sure that our window size is a mutiple of the other side's 15707 * MSS. 15708 * 2) Handling SO_RCVBUF option. 15709 * 15710 * It is ASSUMED that the requested size is a multiple of the current MSS. 15711 * 15712 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 15713 * user requests so. 15714 */ 15715 static int 15716 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 15717 { 15718 uint32_t mss = tcp->tcp_mss; 15719 uint32_t old_max_rwnd; 15720 uint32_t max_transmittable_rwnd; 15721 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 15722 15723 if (tcp->tcp_fused) { 15724 size_t sth_hiwat; 15725 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 15726 15727 ASSERT(peer_tcp != NULL); 15728 /* 15729 * Record the stream head's high water mark for 15730 * this endpoint; this is used for flow-control 15731 * purposes in tcp_fuse_output(). 15732 */ 15733 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 15734 if (!tcp_detached) 15735 (void) mi_set_sth_hiwat(tcp->tcp_rq, sth_hiwat); 15736 15737 /* 15738 * In the fusion case, the maxpsz stream head value of 15739 * our peer is set according to its send buffer size 15740 * and our receive buffer size; since the latter may 15741 * have changed we need to update the peer's maxpsz. 15742 */ 15743 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 15744 return (rwnd); 15745 } 15746 15747 if (tcp_detached) 15748 old_max_rwnd = tcp->tcp_rwnd; 15749 else 15750 old_max_rwnd = tcp->tcp_rq->q_hiwat; 15751 15752 /* 15753 * Insist on a receive window that is at least 15754 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 15755 * funny TCP interactions of Nagle algorithm, SWS avoidance 15756 * and delayed acknowledgement. 15757 */ 15758 rwnd = MAX(rwnd, tcp_recv_hiwat_minmss * mss); 15759 15760 /* 15761 * If window size info has already been exchanged, TCP should not 15762 * shrink the window. Shrinking window is doable if done carefully. 15763 * We may add that support later. But so far there is not a real 15764 * need to do that. 15765 */ 15766 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 15767 /* MSS may have changed, do a round up again. */ 15768 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 15769 } 15770 15771 /* 15772 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 15773 * can be applied even before the window scale option is decided. 15774 */ 15775 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 15776 if (rwnd > max_transmittable_rwnd) { 15777 rwnd = max_transmittable_rwnd - 15778 (max_transmittable_rwnd % mss); 15779 if (rwnd < mss) 15780 rwnd = max_transmittable_rwnd; 15781 /* 15782 * If we're over the limit we may have to back down tcp_rwnd. 15783 * The increment below won't work for us. So we set all three 15784 * here and the increment below will have no effect. 15785 */ 15786 tcp->tcp_rwnd = old_max_rwnd = rwnd; 15787 } 15788 if (tcp->tcp_localnet) { 15789 tcp->tcp_rack_abs_max = 15790 MIN(tcp_local_dacks_max, rwnd / mss / 2); 15791 } else { 15792 /* 15793 * For a remote host on a different subnet (through a router), 15794 * we ack every other packet to be conforming to RFC1122. 15795 * tcp_deferred_acks_max is default to 2. 15796 */ 15797 tcp->tcp_rack_abs_max = 15798 MIN(tcp_deferred_acks_max, rwnd / mss / 2); 15799 } 15800 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 15801 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 15802 else 15803 tcp->tcp_rack_cur_max = 0; 15804 /* 15805 * Increment the current rwnd by the amount the maximum grew (we 15806 * can not overwrite it since we might be in the middle of a 15807 * connection.) 15808 */ 15809 tcp->tcp_rwnd += rwnd - old_max_rwnd; 15810 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win); 15811 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 15812 tcp->tcp_cwnd_max = rwnd; 15813 15814 if (tcp_detached) 15815 return (rwnd); 15816 /* 15817 * We set the maximum receive window into rq->q_hiwat. 15818 * This is not actually used for flow control. 15819 */ 15820 tcp->tcp_rq->q_hiwat = rwnd; 15821 /* 15822 * Set the Stream head high water mark. This doesn't have to be 15823 * here, since we are simply using default values, but we would 15824 * prefer to choose these values algorithmically, with a likely 15825 * relationship to rwnd. 15826 */ 15827 (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd, tcp_sth_rcv_hiwat)); 15828 return (rwnd); 15829 } 15830 15831 /* 15832 * Return SNMP stuff in buffer in mpdata. 15833 */ 15834 int 15835 tcp_snmp_get(queue_t *q, mblk_t *mpctl) 15836 { 15837 mblk_t *mpdata; 15838 mblk_t *mp_conn_ctl = NULL; 15839 mblk_t *mp_conn_tail; 15840 mblk_t *mp_attr_ctl = NULL; 15841 mblk_t *mp_attr_tail; 15842 mblk_t *mp6_conn_ctl = NULL; 15843 mblk_t *mp6_conn_tail; 15844 mblk_t *mp6_attr_ctl = NULL; 15845 mblk_t *mp6_attr_tail; 15846 struct opthdr *optp; 15847 mib2_tcpConnEntry_t tce; 15848 mib2_tcp6ConnEntry_t tce6; 15849 mib2_transportMLPEntry_t mlp; 15850 connf_t *connfp; 15851 conn_t *connp; 15852 int i; 15853 boolean_t ispriv; 15854 zoneid_t zoneid; 15855 int v4_conn_idx; 15856 int v6_conn_idx; 15857 15858 if (mpctl == NULL || 15859 (mpdata = mpctl->b_cont) == NULL || 15860 (mp_conn_ctl = copymsg(mpctl)) == NULL || 15861 (mp_attr_ctl = copymsg(mpctl)) == NULL || 15862 (mp6_conn_ctl = copymsg(mpctl)) == NULL || 15863 (mp6_attr_ctl = copymsg(mpctl)) == NULL) { 15864 freemsg(mp_conn_ctl); 15865 freemsg(mp_attr_ctl); 15866 freemsg(mp6_conn_ctl); 15867 freemsg(mp6_attr_ctl); 15868 return (0); 15869 } 15870 15871 /* build table of connections -- need count in fixed part */ 15872 SET_MIB(tcp_mib.tcpRtoAlgorithm, 4); /* vanj */ 15873 SET_MIB(tcp_mib.tcpRtoMin, tcp_rexmit_interval_min); 15874 SET_MIB(tcp_mib.tcpRtoMax, tcp_rexmit_interval_max); 15875 SET_MIB(tcp_mib.tcpMaxConn, -1); 15876 SET_MIB(tcp_mib.tcpCurrEstab, 0); 15877 15878 ispriv = 15879 secpolicy_net_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0; 15880 zoneid = Q_TO_CONN(q)->conn_zoneid; 15881 15882 v4_conn_idx = v6_conn_idx = 0; 15883 mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL; 15884 15885 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 15886 15887 connfp = &ipcl_globalhash_fanout[i]; 15888 15889 connp = NULL; 15890 15891 while ((connp = 15892 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 15893 tcp_t *tcp; 15894 boolean_t needattr; 15895 15896 if (connp->conn_zoneid != zoneid) 15897 continue; /* not in this zone */ 15898 15899 tcp = connp->conn_tcp; 15900 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 15901 tcp->tcp_ibsegs = 0; 15902 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 15903 tcp->tcp_obsegs = 0; 15904 15905 tce6.tcp6ConnState = tce.tcpConnState = 15906 tcp_snmp_state(tcp); 15907 if (tce.tcpConnState == MIB2_TCP_established || 15908 tce.tcpConnState == MIB2_TCP_closeWait) 15909 BUMP_MIB(&tcp_mib, tcpCurrEstab); 15910 15911 needattr = B_FALSE; 15912 bzero(&mlp, sizeof (mlp)); 15913 if (connp->conn_mlp_type != mlptSingle) { 15914 if (connp->conn_mlp_type == mlptShared || 15915 connp->conn_mlp_type == mlptBoth) 15916 mlp.tme_flags |= MIB2_TMEF_SHARED; 15917 if (connp->conn_mlp_type == mlptPrivate || 15918 connp->conn_mlp_type == mlptBoth) 15919 mlp.tme_flags |= MIB2_TMEF_PRIVATE; 15920 needattr = B_TRUE; 15921 } 15922 if (connp->conn_peercred != NULL) { 15923 ts_label_t *tsl; 15924 15925 tsl = crgetlabel(connp->conn_peercred); 15926 mlp.tme_doi = label2doi(tsl); 15927 mlp.tme_label = *label2bslabel(tsl); 15928 needattr = B_TRUE; 15929 } 15930 15931 /* Create a message to report on IPv6 entries */ 15932 if (tcp->tcp_ipversion == IPV6_VERSION) { 15933 tce6.tcp6ConnLocalAddress = tcp->tcp_ip_src_v6; 15934 tce6.tcp6ConnRemAddress = tcp->tcp_remote_v6; 15935 tce6.tcp6ConnLocalPort = ntohs(tcp->tcp_lport); 15936 tce6.tcp6ConnRemPort = ntohs(tcp->tcp_fport); 15937 tce6.tcp6ConnIfIndex = tcp->tcp_bound_if; 15938 /* Don't want just anybody seeing these... */ 15939 if (ispriv) { 15940 tce6.tcp6ConnEntryInfo.ce_snxt = 15941 tcp->tcp_snxt; 15942 tce6.tcp6ConnEntryInfo.ce_suna = 15943 tcp->tcp_suna; 15944 tce6.tcp6ConnEntryInfo.ce_rnxt = 15945 tcp->tcp_rnxt; 15946 tce6.tcp6ConnEntryInfo.ce_rack = 15947 tcp->tcp_rack; 15948 } else { 15949 /* 15950 * Netstat, unfortunately, uses this to 15951 * get send/receive queue sizes. How to fix? 15952 * Why not compute the difference only? 15953 */ 15954 tce6.tcp6ConnEntryInfo.ce_snxt = 15955 tcp->tcp_snxt - tcp->tcp_suna; 15956 tce6.tcp6ConnEntryInfo.ce_suna = 0; 15957 tce6.tcp6ConnEntryInfo.ce_rnxt = 15958 tcp->tcp_rnxt - tcp->tcp_rack; 15959 tce6.tcp6ConnEntryInfo.ce_rack = 0; 15960 } 15961 15962 tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd; 15963 tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 15964 tce6.tcp6ConnEntryInfo.ce_rto = tcp->tcp_rto; 15965 tce6.tcp6ConnEntryInfo.ce_mss = tcp->tcp_mss; 15966 tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state; 15967 15968 (void) snmp_append_data2(mp6_conn_ctl->b_cont, 15969 &mp6_conn_tail, (char *)&tce6, sizeof (tce6)); 15970 15971 mlp.tme_connidx = v6_conn_idx++; 15972 if (needattr) 15973 (void) snmp_append_data2(mp6_attr_ctl->b_cont, 15974 &mp6_attr_tail, (char *)&mlp, sizeof (mlp)); 15975 } 15976 /* 15977 * Create an IPv4 table entry for IPv4 entries and also 15978 * for IPv6 entries which are bound to in6addr_any 15979 * but don't have IPV6_V6ONLY set. 15980 * (i.e. anything an IPv4 peer could connect to) 15981 */ 15982 if (tcp->tcp_ipversion == IPV4_VERSION || 15983 (tcp->tcp_state <= TCPS_LISTEN && 15984 !tcp->tcp_connp->conn_ipv6_v6only && 15985 IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip_src_v6))) { 15986 if (tcp->tcp_ipversion == IPV6_VERSION) { 15987 tce.tcpConnRemAddress = INADDR_ANY; 15988 tce.tcpConnLocalAddress = INADDR_ANY; 15989 } else { 15990 tce.tcpConnRemAddress = 15991 tcp->tcp_remote; 15992 tce.tcpConnLocalAddress = 15993 tcp->tcp_ip_src; 15994 } 15995 tce.tcpConnLocalPort = ntohs(tcp->tcp_lport); 15996 tce.tcpConnRemPort = ntohs(tcp->tcp_fport); 15997 /* Don't want just anybody seeing these... */ 15998 if (ispriv) { 15999 tce.tcpConnEntryInfo.ce_snxt = 16000 tcp->tcp_snxt; 16001 tce.tcpConnEntryInfo.ce_suna = 16002 tcp->tcp_suna; 16003 tce.tcpConnEntryInfo.ce_rnxt = 16004 tcp->tcp_rnxt; 16005 tce.tcpConnEntryInfo.ce_rack = 16006 tcp->tcp_rack; 16007 } else { 16008 /* 16009 * Netstat, unfortunately, uses this to 16010 * get send/receive queue sizes. How 16011 * to fix? 16012 * Why not compute the difference only? 16013 */ 16014 tce.tcpConnEntryInfo.ce_snxt = 16015 tcp->tcp_snxt - tcp->tcp_suna; 16016 tce.tcpConnEntryInfo.ce_suna = 0; 16017 tce.tcpConnEntryInfo.ce_rnxt = 16018 tcp->tcp_rnxt - tcp->tcp_rack; 16019 tce.tcpConnEntryInfo.ce_rack = 0; 16020 } 16021 16022 tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd; 16023 tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 16024 tce.tcpConnEntryInfo.ce_rto = tcp->tcp_rto; 16025 tce.tcpConnEntryInfo.ce_mss = tcp->tcp_mss; 16026 tce.tcpConnEntryInfo.ce_state = 16027 tcp->tcp_state; 16028 16029 (void) snmp_append_data2(mp_conn_ctl->b_cont, 16030 &mp_conn_tail, (char *)&tce, sizeof (tce)); 16031 16032 mlp.tme_connidx = v4_conn_idx++; 16033 if (needattr) 16034 (void) snmp_append_data2( 16035 mp_attr_ctl->b_cont, 16036 &mp_attr_tail, (char *)&mlp, 16037 sizeof (mlp)); 16038 } 16039 } 16040 } 16041 16042 /* fixed length structure for IPv4 and IPv6 counters */ 16043 SET_MIB(tcp_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t)); 16044 SET_MIB(tcp_mib.tcp6ConnTableSize, sizeof (mib2_tcp6ConnEntry_t)); 16045 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 16046 optp->level = MIB2_TCP; 16047 optp->name = 0; 16048 (void) snmp_append_data(mpdata, (char *)&tcp_mib, sizeof (tcp_mib)); 16049 optp->len = msgdsize(mpdata); 16050 qreply(q, mpctl); 16051 16052 /* table of connections... */ 16053 optp = (struct opthdr *)&mp_conn_ctl->b_rptr[ 16054 sizeof (struct T_optmgmt_ack)]; 16055 optp->level = MIB2_TCP; 16056 optp->name = MIB2_TCP_CONN; 16057 optp->len = msgdsize(mp_conn_ctl->b_cont); 16058 qreply(q, mp_conn_ctl); 16059 16060 /* table of MLP attributes... */ 16061 optp = (struct opthdr *)&mp_attr_ctl->b_rptr[ 16062 sizeof (struct T_optmgmt_ack)]; 16063 optp->level = MIB2_TCP; 16064 optp->name = EXPER_XPORT_MLP; 16065 optp->len = msgdsize(mp_attr_ctl->b_cont); 16066 if (optp->len == 0) 16067 freemsg(mp_attr_ctl); 16068 else 16069 qreply(q, mp_attr_ctl); 16070 16071 /* table of IPv6 connections... */ 16072 optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[ 16073 sizeof (struct T_optmgmt_ack)]; 16074 optp->level = MIB2_TCP6; 16075 optp->name = MIB2_TCP6_CONN; 16076 optp->len = msgdsize(mp6_conn_ctl->b_cont); 16077 qreply(q, mp6_conn_ctl); 16078 16079 /* table of IPv6 MLP attributes... */ 16080 optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[ 16081 sizeof (struct T_optmgmt_ack)]; 16082 optp->level = MIB2_TCP6; 16083 optp->name = EXPER_XPORT_MLP; 16084 optp->len = msgdsize(mp6_attr_ctl->b_cont); 16085 if (optp->len == 0) 16086 freemsg(mp6_attr_ctl); 16087 else 16088 qreply(q, mp6_attr_ctl); 16089 return (1); 16090 } 16091 16092 /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests */ 16093 /* ARGSUSED */ 16094 int 16095 tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 16096 { 16097 mib2_tcpConnEntry_t *tce = (mib2_tcpConnEntry_t *)ptr; 16098 16099 switch (level) { 16100 case MIB2_TCP: 16101 switch (name) { 16102 case 13: 16103 if (tce->tcpConnState != MIB2_TCP_deleteTCB) 16104 return (0); 16105 /* TODO: delete entry defined by tce */ 16106 return (1); 16107 default: 16108 return (0); 16109 } 16110 default: 16111 return (1); 16112 } 16113 } 16114 16115 /* Translate TCP state to MIB2 TCP state. */ 16116 static int 16117 tcp_snmp_state(tcp_t *tcp) 16118 { 16119 if (tcp == NULL) 16120 return (0); 16121 16122 switch (tcp->tcp_state) { 16123 case TCPS_CLOSED: 16124 case TCPS_IDLE: /* RFC1213 doesn't have analogue for IDLE & BOUND */ 16125 case TCPS_BOUND: 16126 return (MIB2_TCP_closed); 16127 case TCPS_LISTEN: 16128 return (MIB2_TCP_listen); 16129 case TCPS_SYN_SENT: 16130 return (MIB2_TCP_synSent); 16131 case TCPS_SYN_RCVD: 16132 return (MIB2_TCP_synReceived); 16133 case TCPS_ESTABLISHED: 16134 return (MIB2_TCP_established); 16135 case TCPS_CLOSE_WAIT: 16136 return (MIB2_TCP_closeWait); 16137 case TCPS_FIN_WAIT_1: 16138 return (MIB2_TCP_finWait1); 16139 case TCPS_CLOSING: 16140 return (MIB2_TCP_closing); 16141 case TCPS_LAST_ACK: 16142 return (MIB2_TCP_lastAck); 16143 case TCPS_FIN_WAIT_2: 16144 return (MIB2_TCP_finWait2); 16145 case TCPS_TIME_WAIT: 16146 return (MIB2_TCP_timeWait); 16147 default: 16148 return (0); 16149 } 16150 } 16151 16152 static char tcp_report_header[] = 16153 "TCP " MI_COL_HDRPAD_STR 16154 "zone dest snxt suna " 16155 "swnd rnxt rack rwnd rto mss w sw rw t " 16156 "recent [lport,fport] state"; 16157 16158 /* 16159 * TCP status report triggered via the Named Dispatch mechanism. 16160 */ 16161 /* ARGSUSED */ 16162 static void 16163 tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream, 16164 cred_t *cr) 16165 { 16166 char hash[10], addrbuf[INET6_ADDRSTRLEN]; 16167 boolean_t ispriv = secpolicy_net_config(cr, B_TRUE) == 0; 16168 char cflag; 16169 in6_addr_t v6dst; 16170 char buf[80]; 16171 uint_t print_len, buf_len; 16172 16173 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16174 if (buf_len <= 0) 16175 return; 16176 16177 if (hashval >= 0) 16178 (void) sprintf(hash, "%03d ", hashval); 16179 else 16180 hash[0] = '\0'; 16181 16182 /* 16183 * Note that we use the remote address in the tcp_b structure. 16184 * This means that it will print out the real destination address, 16185 * not the next hop's address if source routing is used. This 16186 * avoid the confusion on the output because user may not 16187 * know that source routing is used for a connection. 16188 */ 16189 if (tcp->tcp_ipversion == IPV4_VERSION) { 16190 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &v6dst); 16191 } else { 16192 v6dst = tcp->tcp_remote_v6; 16193 } 16194 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16195 /* 16196 * the ispriv checks are so that normal users cannot determine 16197 * sequence number information using NDD. 16198 */ 16199 16200 if (TCP_IS_DETACHED(tcp)) 16201 cflag = '*'; 16202 else 16203 cflag = ' '; 16204 print_len = snprintf((char *)mp->b_wptr, buf_len, 16205 "%s " MI_COL_PTRFMT_STR "%d %s %08x %08x %010d %08x %08x " 16206 "%010d %05ld %05d %1d %02d %02d %1d %08x %s%c\n", 16207 hash, 16208 (void *)tcp, 16209 tcp->tcp_connp->conn_zoneid, 16210 addrbuf, 16211 (ispriv) ? tcp->tcp_snxt : 0, 16212 (ispriv) ? tcp->tcp_suna : 0, 16213 tcp->tcp_swnd, 16214 (ispriv) ? tcp->tcp_rnxt : 0, 16215 (ispriv) ? tcp->tcp_rack : 0, 16216 tcp->tcp_rwnd, 16217 tcp->tcp_rto, 16218 tcp->tcp_mss, 16219 tcp->tcp_snd_ws_ok, 16220 tcp->tcp_snd_ws, 16221 tcp->tcp_rcv_ws, 16222 tcp->tcp_snd_ts_ok, 16223 tcp->tcp_ts_recent, 16224 tcp_display(tcp, buf, DISP_PORT_ONLY), cflag); 16225 if (print_len < buf_len) { 16226 ((mblk_t *)mp)->b_wptr += print_len; 16227 } else { 16228 ((mblk_t *)mp)->b_wptr += buf_len; 16229 } 16230 } 16231 16232 /* 16233 * TCP status report (for listeners only) triggered via the Named Dispatch 16234 * mechanism. 16235 */ 16236 /* ARGSUSED */ 16237 static void 16238 tcp_report_listener(mblk_t *mp, tcp_t *tcp, int hashval) 16239 { 16240 char addrbuf[INET6_ADDRSTRLEN]; 16241 in6_addr_t v6dst; 16242 uint_t print_len, buf_len; 16243 16244 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16245 if (buf_len <= 0) 16246 return; 16247 16248 if (tcp->tcp_ipversion == IPV4_VERSION) { 16249 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &v6dst); 16250 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16251 } else { 16252 (void) inet_ntop(AF_INET6, &tcp->tcp_ip6h->ip6_src, 16253 addrbuf, sizeof (addrbuf)); 16254 } 16255 print_len = snprintf((char *)mp->b_wptr, buf_len, 16256 "%03d " 16257 MI_COL_PTRFMT_STR 16258 "%d %s %05u %08u %d/%d/%d%c\n", 16259 hashval, (void *)tcp, 16260 tcp->tcp_connp->conn_zoneid, 16261 addrbuf, 16262 (uint_t)BE16_TO_U16(tcp->tcp_tcph->th_lport), 16263 tcp->tcp_conn_req_seqnum, 16264 tcp->tcp_conn_req_cnt_q0, tcp->tcp_conn_req_cnt_q, 16265 tcp->tcp_conn_req_max, 16266 tcp->tcp_syn_defense ? '*' : ' '); 16267 if (print_len < buf_len) { 16268 ((mblk_t *)mp)->b_wptr += print_len; 16269 } else { 16270 ((mblk_t *)mp)->b_wptr += buf_len; 16271 } 16272 } 16273 16274 /* TCP status report triggered via the Named Dispatch mechanism. */ 16275 /* ARGSUSED */ 16276 static int 16277 tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16278 { 16279 tcp_t *tcp; 16280 int i; 16281 conn_t *connp; 16282 connf_t *connfp; 16283 zoneid_t zoneid; 16284 16285 /* 16286 * Because of the ndd constraint, at most we can have 64K buffer 16287 * to put in all TCP info. So to be more efficient, just 16288 * allocate a 64K buffer here, assuming we need that large buffer. 16289 * This may be a problem as any user can read tcp_status. Therefore 16290 * we limit the rate of doing this using tcp_ndd_get_info_interval. 16291 * This should be OK as normal users should not do this too often. 16292 */ 16293 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16294 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16295 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16296 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16297 return (0); 16298 } 16299 } 16300 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16301 /* The following may work even if we cannot get a large buf. */ 16302 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16303 return (0); 16304 } 16305 16306 (void) mi_mpprintf(mp, "%s", tcp_report_header); 16307 16308 zoneid = Q_TO_CONN(q)->conn_zoneid; 16309 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 16310 16311 connfp = &ipcl_globalhash_fanout[i]; 16312 16313 connp = NULL; 16314 16315 while ((connp = 16316 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 16317 tcp = connp->conn_tcp; 16318 if (zoneid != GLOBAL_ZONEID && 16319 zoneid != connp->conn_zoneid) 16320 continue; 16321 tcp_report_item(mp->b_cont, tcp, -1, tcp, 16322 cr); 16323 } 16324 16325 } 16326 16327 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16328 return (0); 16329 } 16330 16331 /* TCP status report triggered via the Named Dispatch mechanism. */ 16332 /* ARGSUSED */ 16333 static int 16334 tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16335 { 16336 tf_t *tbf; 16337 tcp_t *tcp; 16338 int i; 16339 zoneid_t zoneid; 16340 16341 /* Refer to comments in tcp_status_report(). */ 16342 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16343 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16344 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16345 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16346 return (0); 16347 } 16348 } 16349 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16350 /* The following may work even if we cannot get a large buf. */ 16351 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16352 return (0); 16353 } 16354 16355 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16356 16357 zoneid = Q_TO_CONN(q)->conn_zoneid; 16358 16359 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 16360 tbf = &tcp_bind_fanout[i]; 16361 mutex_enter(&tbf->tf_lock); 16362 for (tcp = tbf->tf_tcp; tcp != NULL; 16363 tcp = tcp->tcp_bind_hash) { 16364 if (zoneid != GLOBAL_ZONEID && 16365 zoneid != tcp->tcp_connp->conn_zoneid) 16366 continue; 16367 CONN_INC_REF(tcp->tcp_connp); 16368 tcp_report_item(mp->b_cont, tcp, i, 16369 Q_TO_TCP(q), cr); 16370 CONN_DEC_REF(tcp->tcp_connp); 16371 } 16372 mutex_exit(&tbf->tf_lock); 16373 } 16374 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16375 return (0); 16376 } 16377 16378 /* TCP status report triggered via the Named Dispatch mechanism. */ 16379 /* ARGSUSED */ 16380 static int 16381 tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16382 { 16383 connf_t *connfp; 16384 conn_t *connp; 16385 tcp_t *tcp; 16386 int i; 16387 zoneid_t zoneid; 16388 16389 /* Refer to comments in tcp_status_report(). */ 16390 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16391 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16392 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16393 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16394 return (0); 16395 } 16396 } 16397 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16398 /* The following may work even if we cannot get a large buf. */ 16399 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16400 return (0); 16401 } 16402 16403 (void) mi_mpprintf(mp, 16404 " TCP " MI_COL_HDRPAD_STR 16405 "zone IP addr port seqnum backlog (q0/q/max)"); 16406 16407 zoneid = Q_TO_CONN(q)->conn_zoneid; 16408 16409 for (i = 0; i < ipcl_bind_fanout_size; i++) { 16410 connfp = &ipcl_bind_fanout[i]; 16411 connp = NULL; 16412 while ((connp = 16413 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 16414 tcp = connp->conn_tcp; 16415 if (zoneid != GLOBAL_ZONEID && 16416 zoneid != connp->conn_zoneid) 16417 continue; 16418 tcp_report_listener(mp->b_cont, tcp, i); 16419 } 16420 } 16421 16422 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16423 return (0); 16424 } 16425 16426 /* TCP status report triggered via the Named Dispatch mechanism. */ 16427 /* ARGSUSED */ 16428 static int 16429 tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16430 { 16431 connf_t *connfp; 16432 conn_t *connp; 16433 tcp_t *tcp; 16434 int i; 16435 zoneid_t zoneid; 16436 16437 /* Refer to comments in tcp_status_report(). */ 16438 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16439 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16440 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16441 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16442 return (0); 16443 } 16444 } 16445 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16446 /* The following may work even if we cannot get a large buf. */ 16447 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16448 return (0); 16449 } 16450 16451 (void) mi_mpprintf(mp, "tcp_conn_hash_size = %d", 16452 ipcl_conn_fanout_size); 16453 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16454 16455 zoneid = Q_TO_CONN(q)->conn_zoneid; 16456 16457 for (i = 0; i < ipcl_conn_fanout_size; i++) { 16458 connfp = &ipcl_conn_fanout[i]; 16459 connp = NULL; 16460 while ((connp = 16461 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 16462 tcp = connp->conn_tcp; 16463 if (zoneid != GLOBAL_ZONEID && 16464 zoneid != connp->conn_zoneid) 16465 continue; 16466 tcp_report_item(mp->b_cont, tcp, i, 16467 Q_TO_TCP(q), cr); 16468 } 16469 } 16470 16471 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16472 return (0); 16473 } 16474 16475 /* TCP status report triggered via the Named Dispatch mechanism. */ 16476 /* ARGSUSED */ 16477 static int 16478 tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16479 { 16480 tf_t *tf; 16481 tcp_t *tcp; 16482 int i; 16483 zoneid_t zoneid; 16484 16485 /* Refer to comments in tcp_status_report(). */ 16486 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16487 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16488 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16489 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16490 return (0); 16491 } 16492 } 16493 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16494 /* The following may work even if we cannot get a large buf. */ 16495 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16496 return (0); 16497 } 16498 16499 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16500 16501 zoneid = Q_TO_CONN(q)->conn_zoneid; 16502 16503 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 16504 tf = &tcp_acceptor_fanout[i]; 16505 mutex_enter(&tf->tf_lock); 16506 for (tcp = tf->tf_tcp; tcp != NULL; 16507 tcp = tcp->tcp_acceptor_hash) { 16508 if (zoneid != GLOBAL_ZONEID && 16509 zoneid != tcp->tcp_connp->conn_zoneid) 16510 continue; 16511 tcp_report_item(mp->b_cont, tcp, i, 16512 Q_TO_TCP(q), cr); 16513 } 16514 mutex_exit(&tf->tf_lock); 16515 } 16516 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16517 return (0); 16518 } 16519 16520 /* 16521 * tcp_timer is the timer service routine. It handles the retransmission, 16522 * FIN_WAIT_2 flush, and zero window probe timeout events. It figures out 16523 * from the state of the tcp instance what kind of action needs to be done 16524 * at the time it is called. 16525 */ 16526 static void 16527 tcp_timer(void *arg) 16528 { 16529 mblk_t *mp; 16530 clock_t first_threshold; 16531 clock_t second_threshold; 16532 clock_t ms; 16533 uint32_t mss; 16534 conn_t *connp = (conn_t *)arg; 16535 tcp_t *tcp = connp->conn_tcp; 16536 16537 tcp->tcp_timer_tid = 0; 16538 16539 if (tcp->tcp_fused) 16540 return; 16541 16542 first_threshold = tcp->tcp_first_timer_threshold; 16543 second_threshold = tcp->tcp_second_timer_threshold; 16544 switch (tcp->tcp_state) { 16545 case TCPS_IDLE: 16546 case TCPS_BOUND: 16547 case TCPS_LISTEN: 16548 return; 16549 case TCPS_SYN_RCVD: { 16550 tcp_t *listener = tcp->tcp_listener; 16551 16552 if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) { 16553 ASSERT(tcp->tcp_rq == listener->tcp_rq); 16554 /* it's our first timeout */ 16555 tcp->tcp_syn_rcvd_timeout = 1; 16556 mutex_enter(&listener->tcp_eager_lock); 16557 listener->tcp_syn_rcvd_timeout++; 16558 if (!listener->tcp_syn_defense && 16559 (listener->tcp_syn_rcvd_timeout > 16560 (tcp_conn_req_max_q0 >> 2)) && 16561 (tcp_conn_req_max_q0 > 200)) { 16562 /* We may be under attack. Put on a defense. */ 16563 listener->tcp_syn_defense = B_TRUE; 16564 cmn_err(CE_WARN, "High TCP connect timeout " 16565 "rate! System (port %d) may be under a " 16566 "SYN flood attack!", 16567 BE16_TO_U16(listener->tcp_tcph->th_lport)); 16568 16569 listener->tcp_ip_addr_cache = kmem_zalloc( 16570 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t), 16571 KM_NOSLEEP); 16572 } 16573 mutex_exit(&listener->tcp_eager_lock); 16574 } 16575 } 16576 /* FALLTHRU */ 16577 case TCPS_SYN_SENT: 16578 first_threshold = tcp->tcp_first_ctimer_threshold; 16579 second_threshold = tcp->tcp_second_ctimer_threshold; 16580 break; 16581 case TCPS_ESTABLISHED: 16582 case TCPS_FIN_WAIT_1: 16583 case TCPS_CLOSING: 16584 case TCPS_CLOSE_WAIT: 16585 case TCPS_LAST_ACK: 16586 /* If we have data to rexmit */ 16587 if (tcp->tcp_suna != tcp->tcp_snxt) { 16588 clock_t time_to_wait; 16589 16590 BUMP_MIB(&tcp_mib, tcpTimRetrans); 16591 if (!tcp->tcp_xmit_head) 16592 break; 16593 time_to_wait = lbolt - 16594 (clock_t)tcp->tcp_xmit_head->b_prev; 16595 time_to_wait = tcp->tcp_rto - 16596 TICK_TO_MSEC(time_to_wait); 16597 /* 16598 * If the timer fires too early, 1 clock tick earlier, 16599 * restart the timer. 16600 */ 16601 if (time_to_wait > msec_per_tick) { 16602 TCP_STAT(tcp_timer_fire_early); 16603 TCP_TIMER_RESTART(tcp, time_to_wait); 16604 return; 16605 } 16606 /* 16607 * When we probe zero windows, we force the swnd open. 16608 * If our peer acks with a closed window swnd will be 16609 * set to zero by tcp_rput(). As long as we are 16610 * receiving acks tcp_rput will 16611 * reset 'tcp_ms_we_have_waited' so as not to trip the 16612 * first and second interval actions. NOTE: the timer 16613 * interval is allowed to continue its exponential 16614 * backoff. 16615 */ 16616 if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) { 16617 if (tcp->tcp_debug) { 16618 (void) strlog(TCP_MOD_ID, 0, 1, 16619 SL_TRACE, "tcp_timer: zero win"); 16620 } 16621 } else { 16622 /* 16623 * After retransmission, we need to do 16624 * slow start. Set the ssthresh to one 16625 * half of current effective window and 16626 * cwnd to one MSS. Also reset 16627 * tcp_cwnd_cnt. 16628 * 16629 * Note that if tcp_ssthresh is reduced because 16630 * of ECN, do not reduce it again unless it is 16631 * already one window of data away (tcp_cwr 16632 * should then be cleared) or this is a 16633 * timeout for a retransmitted segment. 16634 */ 16635 uint32_t npkt; 16636 16637 if (!tcp->tcp_cwr || tcp->tcp_rexmit) { 16638 npkt = ((tcp->tcp_timer_backoff ? 16639 tcp->tcp_cwnd_ssthresh : 16640 tcp->tcp_snxt - 16641 tcp->tcp_suna) >> 1) / tcp->tcp_mss; 16642 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 16643 tcp->tcp_mss; 16644 } 16645 tcp->tcp_cwnd = tcp->tcp_mss; 16646 tcp->tcp_cwnd_cnt = 0; 16647 if (tcp->tcp_ecn_ok) { 16648 tcp->tcp_cwr = B_TRUE; 16649 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 16650 tcp->tcp_ecn_cwr_sent = B_FALSE; 16651 } 16652 } 16653 break; 16654 } 16655 /* 16656 * We have something to send yet we cannot send. The 16657 * reason can be: 16658 * 16659 * 1. Zero send window: we need to do zero window probe. 16660 * 2. Zero cwnd: because of ECN, we need to "clock out 16661 * segments. 16662 * 3. SWS avoidance: receiver may have shrunk window, 16663 * reset our knowledge. 16664 * 16665 * Note that condition 2 can happen with either 1 or 16666 * 3. But 1 and 3 are exclusive. 16667 */ 16668 if (tcp->tcp_unsent != 0) { 16669 if (tcp->tcp_cwnd == 0) { 16670 /* 16671 * Set tcp_cwnd to 1 MSS so that a 16672 * new segment can be sent out. We 16673 * are "clocking out" new data when 16674 * the network is really congested. 16675 */ 16676 ASSERT(tcp->tcp_ecn_ok); 16677 tcp->tcp_cwnd = tcp->tcp_mss; 16678 } 16679 if (tcp->tcp_swnd == 0) { 16680 /* Extend window for zero window probe */ 16681 tcp->tcp_swnd++; 16682 tcp->tcp_zero_win_probe = B_TRUE; 16683 BUMP_MIB(&tcp_mib, tcpOutWinProbe); 16684 } else { 16685 /* 16686 * Handle timeout from sender SWS avoidance. 16687 * Reset our knowledge of the max send window 16688 * since the receiver might have reduced its 16689 * receive buffer. Avoid setting tcp_max_swnd 16690 * to one since that will essentially disable 16691 * the SWS checks. 16692 * 16693 * Note that since we don't have a SWS 16694 * state variable, if the timeout is set 16695 * for ECN but not for SWS, this 16696 * code will also be executed. This is 16697 * fine as tcp_max_swnd is updated 16698 * constantly and it will not affect 16699 * anything. 16700 */ 16701 tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2); 16702 } 16703 tcp_wput_data(tcp, NULL, B_FALSE); 16704 return; 16705 } 16706 /* Is there a FIN that needs to be to re retransmitted? */ 16707 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 16708 !tcp->tcp_fin_acked) 16709 break; 16710 /* Nothing to do, return without restarting timer. */ 16711 TCP_STAT(tcp_timer_fire_miss); 16712 return; 16713 case TCPS_FIN_WAIT_2: 16714 /* 16715 * User closed the TCP endpoint and peer ACK'ed our FIN. 16716 * We waited some time for for peer's FIN, but it hasn't 16717 * arrived. We flush the connection now to avoid 16718 * case where the peer has rebooted. 16719 */ 16720 if (TCP_IS_DETACHED(tcp)) { 16721 (void) tcp_clean_death(tcp, 0, 23); 16722 } else { 16723 TCP_TIMER_RESTART(tcp, tcp_fin_wait_2_flush_interval); 16724 } 16725 return; 16726 case TCPS_TIME_WAIT: 16727 (void) tcp_clean_death(tcp, 0, 24); 16728 return; 16729 default: 16730 if (tcp->tcp_debug) { 16731 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 16732 "tcp_timer: strange state (%d) %s", 16733 tcp->tcp_state, tcp_display(tcp, NULL, 16734 DISP_PORT_ONLY)); 16735 } 16736 return; 16737 } 16738 if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) { 16739 /* 16740 * For zero window probe, we need to send indefinitely, 16741 * unless we have not heard from the other side for some 16742 * time... 16743 */ 16744 if ((tcp->tcp_zero_win_probe == 0) || 16745 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) > 16746 second_threshold)) { 16747 BUMP_MIB(&tcp_mib, tcpTimRetransDrop); 16748 /* 16749 * If TCP is in SYN_RCVD state, send back a 16750 * RST|ACK as BSD does. Note that tcp_zero_win_probe 16751 * should be zero in TCPS_SYN_RCVD state. 16752 */ 16753 if (tcp->tcp_state == TCPS_SYN_RCVD) { 16754 tcp_xmit_ctl("tcp_timer: RST sent on timeout " 16755 "in SYN_RCVD", 16756 tcp, tcp->tcp_snxt, 16757 tcp->tcp_rnxt, TH_RST | TH_ACK); 16758 } 16759 (void) tcp_clean_death(tcp, 16760 tcp->tcp_client_errno ? 16761 tcp->tcp_client_errno : ETIMEDOUT, 25); 16762 return; 16763 } else { 16764 /* 16765 * Set tcp_ms_we_have_waited to second_threshold 16766 * so that in next timeout, we will do the above 16767 * check (lbolt - tcp_last_recv_time). This is 16768 * also to avoid overflow. 16769 * 16770 * We don't need to decrement tcp_timer_backoff 16771 * to avoid overflow because it will be decremented 16772 * later if new timeout value is greater than 16773 * tcp_rexmit_interval_max. In the case when 16774 * tcp_rexmit_interval_max is greater than 16775 * second_threshold, it means that we will wait 16776 * longer than second_threshold to send the next 16777 * window probe. 16778 */ 16779 tcp->tcp_ms_we_have_waited = second_threshold; 16780 } 16781 } else if (ms > first_threshold) { 16782 if (tcp->tcp_snd_zcopy_aware && (!tcp->tcp_xmit_zc_clean) && 16783 tcp->tcp_xmit_head != NULL) { 16784 tcp->tcp_xmit_head = 16785 tcp_zcopy_backoff(tcp, tcp->tcp_xmit_head, 1); 16786 } 16787 /* 16788 * We have been retransmitting for too long... The RTT 16789 * we calculated is probably incorrect. Reinitialize it. 16790 * Need to compensate for 0 tcp_rtt_sa. Reset 16791 * tcp_rtt_update so that we won't accidentally cache a 16792 * bad value. But only do this if this is not a zero 16793 * window probe. 16794 */ 16795 if (tcp->tcp_rtt_sa != 0 && tcp->tcp_zero_win_probe == 0) { 16796 tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) + 16797 (tcp->tcp_rtt_sa >> 5); 16798 tcp->tcp_rtt_sa = 0; 16799 tcp_ip_notify(tcp); 16800 tcp->tcp_rtt_update = 0; 16801 } 16802 } 16803 tcp->tcp_timer_backoff++; 16804 if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 16805 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) < 16806 tcp_rexmit_interval_min) { 16807 /* 16808 * This means the original RTO is tcp_rexmit_interval_min. 16809 * So we will use tcp_rexmit_interval_min as the RTO value 16810 * and do the backoff. 16811 */ 16812 ms = tcp_rexmit_interval_min << tcp->tcp_timer_backoff; 16813 } else { 16814 ms <<= tcp->tcp_timer_backoff; 16815 } 16816 if (ms > tcp_rexmit_interval_max) { 16817 ms = tcp_rexmit_interval_max; 16818 /* 16819 * ms is at max, decrement tcp_timer_backoff to avoid 16820 * overflow. 16821 */ 16822 tcp->tcp_timer_backoff--; 16823 } 16824 tcp->tcp_ms_we_have_waited += ms; 16825 if (tcp->tcp_zero_win_probe == 0) { 16826 tcp->tcp_rto = ms; 16827 } 16828 TCP_TIMER_RESTART(tcp, ms); 16829 /* 16830 * This is after a timeout and tcp_rto is backed off. Set 16831 * tcp_set_timer to 1 so that next time RTO is updated, we will 16832 * restart the timer with a correct value. 16833 */ 16834 tcp->tcp_set_timer = 1; 16835 mss = tcp->tcp_snxt - tcp->tcp_suna; 16836 if (mss > tcp->tcp_mss) 16837 mss = tcp->tcp_mss; 16838 if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0) 16839 mss = tcp->tcp_swnd; 16840 16841 if ((mp = tcp->tcp_xmit_head) != NULL) 16842 mp->b_prev = (mblk_t *)lbolt; 16843 mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss, 16844 B_TRUE); 16845 16846 /* 16847 * When slow start after retransmission begins, start with 16848 * this seq no. tcp_rexmit_max marks the end of special slow 16849 * start phase. tcp_snd_burst controls how many segments 16850 * can be sent because of an ack. 16851 */ 16852 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 16853 tcp->tcp_snd_burst = TCP_CWND_SS; 16854 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 16855 (tcp->tcp_unsent == 0)) { 16856 tcp->tcp_rexmit_max = tcp->tcp_fss; 16857 } else { 16858 tcp->tcp_rexmit_max = tcp->tcp_snxt; 16859 } 16860 tcp->tcp_rexmit = B_TRUE; 16861 tcp->tcp_dupack_cnt = 0; 16862 16863 /* 16864 * Remove all rexmit SACK blk to start from fresh. 16865 */ 16866 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 16867 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 16868 tcp->tcp_num_notsack_blk = 0; 16869 tcp->tcp_cnt_notsack_list = 0; 16870 } 16871 if (mp == NULL) { 16872 return; 16873 } 16874 /* Attach credentials to retransmitted initial SYNs. */ 16875 if (tcp->tcp_state == TCPS_SYN_SENT) { 16876 mblk_setcred(mp, tcp->tcp_cred); 16877 DB_CPID(mp) = tcp->tcp_cpid; 16878 } 16879 16880 tcp->tcp_csuna = tcp->tcp_snxt; 16881 BUMP_MIB(&tcp_mib, tcpRetransSegs); 16882 UPDATE_MIB(&tcp_mib, tcpRetransBytes, mss); 16883 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 16884 tcp_send_data(tcp, tcp->tcp_wq, mp); 16885 16886 } 16887 16888 /* tcp_unbind is called by tcp_wput_proto to handle T_UNBIND_REQ messages. */ 16889 static void 16890 tcp_unbind(tcp_t *tcp, mblk_t *mp) 16891 { 16892 conn_t *connp; 16893 16894 switch (tcp->tcp_state) { 16895 case TCPS_BOUND: 16896 case TCPS_LISTEN: 16897 break; 16898 default: 16899 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 16900 return; 16901 } 16902 16903 /* 16904 * Need to clean up all the eagers since after the unbind, segments 16905 * will no longer be delivered to this listener stream. 16906 */ 16907 mutex_enter(&tcp->tcp_eager_lock); 16908 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 16909 tcp_eager_cleanup(tcp, 0); 16910 } 16911 mutex_exit(&tcp->tcp_eager_lock); 16912 16913 if (tcp->tcp_ipversion == IPV4_VERSION) { 16914 tcp->tcp_ipha->ipha_src = 0; 16915 } else { 16916 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 16917 } 16918 V6_SET_ZERO(tcp->tcp_ip_src_v6); 16919 bzero(tcp->tcp_tcph->th_lport, sizeof (tcp->tcp_tcph->th_lport)); 16920 tcp_bind_hash_remove(tcp); 16921 tcp->tcp_state = TCPS_IDLE; 16922 tcp->tcp_mdt = B_FALSE; 16923 /* Send M_FLUSH according to TPI */ 16924 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 16925 connp = tcp->tcp_connp; 16926 connp->conn_mdt_ok = B_FALSE; 16927 ipcl_hash_remove(connp); 16928 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 16929 mp = mi_tpi_ok_ack_alloc(mp); 16930 putnext(tcp->tcp_rq, mp); 16931 } 16932 16933 /* 16934 * Don't let port fall into the privileged range. 16935 * Since the extra privileged ports can be arbitrary we also 16936 * ensure that we exclude those from consideration. 16937 * tcp_g_epriv_ports is not sorted thus we loop over it until 16938 * there are no changes. 16939 * 16940 * Note: No locks are held when inspecting tcp_g_*epriv_ports 16941 * but instead the code relies on: 16942 * - the fact that the address of the array and its size never changes 16943 * - the atomic assignment of the elements of the array 16944 * 16945 * Returns 0 if there are no more ports available. 16946 * 16947 * TS note: skip multilevel ports. 16948 */ 16949 static in_port_t 16950 tcp_update_next_port(in_port_t port, const tcp_t *tcp, boolean_t random) 16951 { 16952 int i; 16953 boolean_t restart = B_FALSE; 16954 16955 if (random && tcp_random_anon_port != 0) { 16956 (void) random_get_pseudo_bytes((uint8_t *)&port, 16957 sizeof (in_port_t)); 16958 /* 16959 * Unless changed by a sys admin, the smallest anon port 16960 * is 32768 and the largest anon port is 65535. It is 16961 * very likely (50%) for the random port to be smaller 16962 * than the smallest anon port. When that happens, 16963 * add port % (anon port range) to the smallest anon 16964 * port to get the random port. It should fall into the 16965 * valid anon port range. 16966 */ 16967 if (port < tcp_smallest_anon_port) { 16968 port = tcp_smallest_anon_port + 16969 port % (tcp_largest_anon_port - 16970 tcp_smallest_anon_port); 16971 } 16972 } 16973 16974 retry: 16975 if (port < tcp_smallest_anon_port) 16976 port = (in_port_t)tcp_smallest_anon_port; 16977 16978 if (port > tcp_largest_anon_port) { 16979 if (restart) 16980 return (0); 16981 restart = B_TRUE; 16982 port = (in_port_t)tcp_smallest_anon_port; 16983 } 16984 16985 if (port < tcp_smallest_nonpriv_port) 16986 port = (in_port_t)tcp_smallest_nonpriv_port; 16987 16988 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 16989 if (port == tcp_g_epriv_ports[i]) { 16990 port++; 16991 /* 16992 * Make sure whether the port is in the 16993 * valid range. 16994 */ 16995 goto retry; 16996 } 16997 } 16998 if (is_system_labeled() && 16999 (i = tsol_next_port(crgetzone(tcp->tcp_cred), port, 17000 IPPROTO_TCP, B_TRUE)) != 0) { 17001 port = i; 17002 goto retry; 17003 } 17004 return (port); 17005 } 17006 17007 /* 17008 * Return the next anonymous port in the privileged port range for 17009 * bind checking. It starts at IPPORT_RESERVED - 1 and goes 17010 * downwards. This is the same behavior as documented in the userland 17011 * library call rresvport(3N). 17012 * 17013 * TS note: skip multilevel ports. 17014 */ 17015 static in_port_t 17016 tcp_get_next_priv_port(const tcp_t *tcp) 17017 { 17018 static in_port_t next_priv_port = IPPORT_RESERVED - 1; 17019 in_port_t nextport; 17020 boolean_t restart = B_FALSE; 17021 17022 retry: 17023 if (next_priv_port < tcp_min_anonpriv_port || 17024 next_priv_port >= IPPORT_RESERVED) { 17025 next_priv_port = IPPORT_RESERVED - 1; 17026 if (restart) 17027 return (0); 17028 restart = B_TRUE; 17029 } 17030 if (is_system_labeled() && 17031 (nextport = tsol_next_port(crgetzone(tcp->tcp_cred), 17032 next_priv_port, IPPROTO_TCP, B_FALSE)) != 0) { 17033 next_priv_port = nextport; 17034 goto retry; 17035 } 17036 return (next_priv_port--); 17037 } 17038 17039 /* The write side r/w procedure. */ 17040 17041 #if CCS_STATS 17042 struct { 17043 struct { 17044 int64_t count, bytes; 17045 } tot, hit; 17046 } wrw_stats; 17047 #endif 17048 17049 /* 17050 * Call by tcp_wput() to handle all non data, except M_PROTO and M_PCPROTO, 17051 * messages. 17052 */ 17053 /* ARGSUSED */ 17054 static void 17055 tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2) 17056 { 17057 conn_t *connp = (conn_t *)arg; 17058 tcp_t *tcp = connp->conn_tcp; 17059 queue_t *q = tcp->tcp_wq; 17060 17061 ASSERT(DB_TYPE(mp) != M_IOCTL); 17062 /* 17063 * TCP is D_MP and qprocsoff() is done towards the end of the tcp_close. 17064 * Once the close starts, streamhead and sockfs will not let any data 17065 * packets come down (close ensures that there are no threads using the 17066 * queue and no new threads will come down) but since qprocsoff() 17067 * hasn't happened yet, a M_FLUSH or some non data message might 17068 * get reflected back (in response to our own FLUSHRW) and get 17069 * processed after tcp_close() is done. The conn would still be valid 17070 * because a ref would have added but we need to check the state 17071 * before actually processing the packet. 17072 */ 17073 if (TCP_IS_DETACHED(tcp) || (tcp->tcp_state == TCPS_CLOSED)) { 17074 freemsg(mp); 17075 return; 17076 } 17077 17078 switch (DB_TYPE(mp)) { 17079 case M_IOCDATA: 17080 tcp_wput_iocdata(tcp, mp); 17081 break; 17082 case M_FLUSH: 17083 tcp_wput_flush(tcp, mp); 17084 break; 17085 default: 17086 CALL_IP_WPUT(connp, q, mp); 17087 break; 17088 } 17089 } 17090 17091 /* 17092 * The TCP fast path write put procedure. 17093 * NOTE: the logic of the fast path is duplicated from tcp_wput_data() 17094 */ 17095 /* ARGSUSED */ 17096 void 17097 tcp_output(void *arg, mblk_t *mp, void *arg2) 17098 { 17099 int len; 17100 int hdrlen; 17101 int plen; 17102 mblk_t *mp1; 17103 uchar_t *rptr; 17104 uint32_t snxt; 17105 tcph_t *tcph; 17106 struct datab *db; 17107 uint32_t suna; 17108 uint32_t mss; 17109 ipaddr_t *dst; 17110 ipaddr_t *src; 17111 uint32_t sum; 17112 int usable; 17113 conn_t *connp = (conn_t *)arg; 17114 tcp_t *tcp = connp->conn_tcp; 17115 uint32_t msize; 17116 17117 /* 17118 * Try and ASSERT the minimum possible references on the 17119 * conn early enough. Since we are executing on write side, 17120 * the connection is obviously not detached and that means 17121 * there is a ref each for TCP and IP. Since we are behind 17122 * the squeue, the minimum references needed are 3. If the 17123 * conn is in classifier hash list, there should be an 17124 * extra ref for that (we check both the possibilities). 17125 */ 17126 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17127 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17128 17129 ASSERT(DB_TYPE(mp) == M_DATA); 17130 msize = (mp->b_cont == NULL) ? MBLKL(mp) : msgdsize(mp); 17131 17132 mutex_enter(&connp->conn_lock); 17133 tcp->tcp_squeue_bytes -= msize; 17134 mutex_exit(&connp->conn_lock); 17135 17136 /* Bypass tcp protocol for fused tcp loopback */ 17137 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize)) 17138 return; 17139 17140 mss = tcp->tcp_mss; 17141 if (tcp->tcp_xmit_zc_clean) 17142 mp = tcp_zcopy_backoff(tcp, mp, 0); 17143 17144 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 17145 len = (int)(mp->b_wptr - mp->b_rptr); 17146 17147 /* 17148 * Criteria for fast path: 17149 * 17150 * 1. no unsent data 17151 * 2. single mblk in request 17152 * 3. connection established 17153 * 4. data in mblk 17154 * 5. len <= mss 17155 * 6. no tcp_valid bits 17156 */ 17157 if ((tcp->tcp_unsent != 0) || 17158 (tcp->tcp_cork) || 17159 (mp->b_cont != NULL) || 17160 (tcp->tcp_state != TCPS_ESTABLISHED) || 17161 (len == 0) || 17162 (len > mss) || 17163 (tcp->tcp_valid_bits != 0)) { 17164 tcp_wput_data(tcp, mp, B_FALSE); 17165 return; 17166 } 17167 17168 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 17169 ASSERT(tcp->tcp_fin_sent == 0); 17170 17171 /* queue new packet onto retransmission queue */ 17172 if (tcp->tcp_xmit_head == NULL) { 17173 tcp->tcp_xmit_head = mp; 17174 } else { 17175 tcp->tcp_xmit_last->b_cont = mp; 17176 } 17177 tcp->tcp_xmit_last = mp; 17178 tcp->tcp_xmit_tail = mp; 17179 17180 /* find out how much we can send */ 17181 /* BEGIN CSTYLED */ 17182 /* 17183 * un-acked usable 17184 * |--------------|-----------------| 17185 * tcp_suna tcp_snxt tcp_suna+tcp_swnd 17186 */ 17187 /* END CSTYLED */ 17188 17189 /* start sending from tcp_snxt */ 17190 snxt = tcp->tcp_snxt; 17191 17192 /* 17193 * Check to see if this connection has been idled for some 17194 * time and no ACK is expected. If it is, we need to slow 17195 * start again to get back the connection's "self-clock" as 17196 * described in VJ's paper. 17197 * 17198 * Refer to the comment in tcp_mss_set() for the calculation 17199 * of tcp_cwnd after idle. 17200 */ 17201 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 17202 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 17203 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 17204 } 17205 17206 usable = tcp->tcp_swnd; /* tcp window size */ 17207 if (usable > tcp->tcp_cwnd) 17208 usable = tcp->tcp_cwnd; /* congestion window smaller */ 17209 usable -= snxt; /* subtract stuff already sent */ 17210 suna = tcp->tcp_suna; 17211 usable += suna; 17212 /* usable can be < 0 if the congestion window is smaller */ 17213 if (len > usable) { 17214 /* Can't send complete M_DATA in one shot */ 17215 goto slow; 17216 } 17217 17218 if (tcp->tcp_flow_stopped && 17219 TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) { 17220 tcp_clrqfull(tcp); 17221 } 17222 17223 /* 17224 * determine if anything to send (Nagle). 17225 * 17226 * 1. len < tcp_mss (i.e. small) 17227 * 2. unacknowledged data present 17228 * 3. len < nagle limit 17229 * 4. last packet sent < nagle limit (previous packet sent) 17230 */ 17231 if ((len < mss) && (snxt != suna) && 17232 (len < (int)tcp->tcp_naglim) && 17233 (tcp->tcp_last_sent_len < tcp->tcp_naglim)) { 17234 /* 17235 * This was the first unsent packet and normally 17236 * mss < xmit_hiwater so there is no need to worry 17237 * about flow control. The next packet will go 17238 * through the flow control check in tcp_wput_data(). 17239 */ 17240 /* leftover work from above */ 17241 tcp->tcp_unsent = len; 17242 tcp->tcp_xmit_tail_unsent = len; 17243 17244 return; 17245 } 17246 17247 /* len <= tcp->tcp_mss && len == unsent so no silly window */ 17248 17249 if (snxt == suna) { 17250 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 17251 } 17252 17253 /* we have always sent something */ 17254 tcp->tcp_rack_cnt = 0; 17255 17256 tcp->tcp_snxt = snxt + len; 17257 tcp->tcp_rack = tcp->tcp_rnxt; 17258 17259 if ((mp1 = dupb(mp)) == 0) 17260 goto no_memory; 17261 mp->b_prev = (mblk_t *)(uintptr_t)lbolt; 17262 mp->b_next = (mblk_t *)(uintptr_t)snxt; 17263 17264 /* adjust tcp header information */ 17265 tcph = tcp->tcp_tcph; 17266 tcph->th_flags[0] = (TH_ACK|TH_PUSH); 17267 17268 sum = len + tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 17269 sum = (sum >> 16) + (sum & 0xFFFF); 17270 U16_TO_ABE16(sum, tcph->th_sum); 17271 17272 U32_TO_ABE32(snxt, tcph->th_seq); 17273 17274 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 17275 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 17276 BUMP_LOCAL(tcp->tcp_obsegs); 17277 17278 /* Update the latest receive window size in TCP header. */ 17279 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 17280 tcph->th_win); 17281 17282 tcp->tcp_last_sent_len = (ushort_t)len; 17283 17284 plen = len + tcp->tcp_hdr_len; 17285 17286 if (tcp->tcp_ipversion == IPV4_VERSION) { 17287 tcp->tcp_ipha->ipha_length = htons(plen); 17288 } else { 17289 tcp->tcp_ip6h->ip6_plen = htons(plen - 17290 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 17291 } 17292 17293 /* see if we need to allocate a mblk for the headers */ 17294 hdrlen = tcp->tcp_hdr_len; 17295 rptr = mp1->b_rptr - hdrlen; 17296 db = mp1->b_datap; 17297 if ((db->db_ref != 2) || rptr < db->db_base || 17298 (!OK_32PTR(rptr))) { 17299 /* NOTE: we assume allocb returns an OK_32PTR */ 17300 mp = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 17301 tcp_wroff_xtra, BPRI_MED); 17302 if (!mp) { 17303 freemsg(mp1); 17304 goto no_memory; 17305 } 17306 mp->b_cont = mp1; 17307 mp1 = mp; 17308 /* Leave room for Link Level header */ 17309 /* hdrlen = tcp->tcp_hdr_len; */ 17310 rptr = &mp1->b_rptr[tcp_wroff_xtra]; 17311 mp1->b_wptr = &rptr[hdrlen]; 17312 } 17313 mp1->b_rptr = rptr; 17314 17315 /* Fill in the timestamp option. */ 17316 if (tcp->tcp_snd_ts_ok) { 17317 U32_TO_BE32((uint32_t)lbolt, 17318 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 17319 U32_TO_BE32(tcp->tcp_ts_recent, 17320 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 17321 } else { 17322 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 17323 } 17324 17325 /* copy header into outgoing packet */ 17326 dst = (ipaddr_t *)rptr; 17327 src = (ipaddr_t *)tcp->tcp_iphc; 17328 dst[0] = src[0]; 17329 dst[1] = src[1]; 17330 dst[2] = src[2]; 17331 dst[3] = src[3]; 17332 dst[4] = src[4]; 17333 dst[5] = src[5]; 17334 dst[6] = src[6]; 17335 dst[7] = src[7]; 17336 dst[8] = src[8]; 17337 dst[9] = src[9]; 17338 if (hdrlen -= 40) { 17339 hdrlen >>= 2; 17340 dst += 10; 17341 src += 10; 17342 do { 17343 *dst++ = *src++; 17344 } while (--hdrlen); 17345 } 17346 17347 /* 17348 * Set the ECN info in the TCP header. Note that this 17349 * is not the template header. 17350 */ 17351 if (tcp->tcp_ecn_ok) { 17352 SET_ECT(tcp, rptr); 17353 17354 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 17355 if (tcp->tcp_ecn_echo_on) 17356 tcph->th_flags[0] |= TH_ECE; 17357 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 17358 tcph->th_flags[0] |= TH_CWR; 17359 tcp->tcp_ecn_cwr_sent = B_TRUE; 17360 } 17361 } 17362 17363 if (tcp->tcp_ip_forward_progress) { 17364 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 17365 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 17366 tcp->tcp_ip_forward_progress = B_FALSE; 17367 } 17368 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 17369 tcp_send_data(tcp, tcp->tcp_wq, mp1); 17370 return; 17371 17372 /* 17373 * If we ran out of memory, we pretend to have sent the packet 17374 * and that it was lost on the wire. 17375 */ 17376 no_memory: 17377 return; 17378 17379 slow: 17380 /* leftover work from above */ 17381 tcp->tcp_unsent = len; 17382 tcp->tcp_xmit_tail_unsent = len; 17383 tcp_wput_data(tcp, NULL, B_FALSE); 17384 } 17385 17386 /* 17387 * The function called through squeue to get behind eager's perimeter to 17388 * finish the accept processing. 17389 */ 17390 /* ARGSUSED */ 17391 void 17392 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2) 17393 { 17394 conn_t *connp = (conn_t *)arg; 17395 tcp_t *tcp = connp->conn_tcp; 17396 queue_t *q = tcp->tcp_rq; 17397 mblk_t *mp1; 17398 mblk_t *stropt_mp = mp; 17399 struct stroptions *stropt; 17400 uint_t thwin; 17401 17402 /* 17403 * Drop the eager's ref on the listener, that was placed when 17404 * this eager began life in tcp_conn_request. 17405 */ 17406 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 17407 17408 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 17409 /* 17410 * Someone blewoff the eager before we could finish 17411 * the accept. 17412 * 17413 * The only reason eager exists it because we put in 17414 * a ref on it when conn ind went up. We need to send 17415 * a disconnect indication up while the last reference 17416 * on the eager will be dropped by the squeue when we 17417 * return. 17418 */ 17419 ASSERT(tcp->tcp_listener == NULL); 17420 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 17421 struct T_discon_ind *tdi; 17422 17423 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 17424 /* 17425 * Let us reuse the incoming mblk to avoid memory 17426 * allocation failure problems. We know that the 17427 * size of the incoming mblk i.e. stroptions is greater 17428 * than sizeof T_discon_ind. So the reallocb below 17429 * can't fail. 17430 */ 17431 freemsg(mp->b_cont); 17432 mp->b_cont = NULL; 17433 ASSERT(DB_REF(mp) == 1); 17434 mp = reallocb(mp, sizeof (struct T_discon_ind), 17435 B_FALSE); 17436 ASSERT(mp != NULL); 17437 DB_TYPE(mp) = M_PROTO; 17438 ((union T_primitives *)mp->b_rptr)->type = T_DISCON_IND; 17439 tdi = (struct T_discon_ind *)mp->b_rptr; 17440 if (tcp->tcp_issocket) { 17441 tdi->DISCON_reason = ECONNREFUSED; 17442 tdi->SEQ_number = 0; 17443 } else { 17444 tdi->DISCON_reason = ENOPROTOOPT; 17445 tdi->SEQ_number = 17446 tcp->tcp_conn_req_seqnum; 17447 } 17448 mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind); 17449 putnext(q, mp); 17450 } else { 17451 freemsg(mp); 17452 } 17453 if (tcp->tcp_hard_binding) { 17454 tcp->tcp_hard_binding = B_FALSE; 17455 tcp->tcp_hard_bound = B_TRUE; 17456 } 17457 tcp->tcp_detached = B_FALSE; 17458 return; 17459 } 17460 17461 mp1 = stropt_mp->b_cont; 17462 stropt_mp->b_cont = NULL; 17463 ASSERT(DB_TYPE(stropt_mp) == M_SETOPTS); 17464 stropt = (struct stroptions *)stropt_mp->b_rptr; 17465 17466 while (mp1 != NULL) { 17467 mp = mp1; 17468 mp1 = mp1->b_cont; 17469 mp->b_cont = NULL; 17470 tcp->tcp_drop_opt_ack_cnt++; 17471 CALL_IP_WPUT(connp, tcp->tcp_wq, mp); 17472 } 17473 mp = NULL; 17474 17475 /* 17476 * For a loopback connection with tcp_direct_sockfs on, note that 17477 * we don't have to protect tcp_rcv_list yet because synchronous 17478 * streams has not yet been enabled and tcp_fuse_rrw() cannot 17479 * possibly race with us. 17480 */ 17481 17482 /* 17483 * Set the max window size (tcp_rq->q_hiwat) of the acceptor 17484 * properly. This is the first time we know of the acceptor' 17485 * queue. So we do it here. 17486 */ 17487 if (tcp->tcp_rcv_list == NULL) { 17488 /* 17489 * Recv queue is empty, tcp_rwnd should not have changed. 17490 * That means it should be equal to the listener's tcp_rwnd. 17491 */ 17492 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd; 17493 } else { 17494 #ifdef DEBUG 17495 uint_t cnt = 0; 17496 17497 mp1 = tcp->tcp_rcv_list; 17498 while ((mp = mp1) != NULL) { 17499 mp1 = mp->b_next; 17500 cnt += msgdsize(mp); 17501 } 17502 ASSERT(cnt != 0 && tcp->tcp_rcv_cnt == cnt); 17503 #endif 17504 /* There is some data, add them back to get the max. */ 17505 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd + tcp->tcp_rcv_cnt; 17506 } 17507 17508 stropt->so_flags = SO_HIWAT; 17509 stropt->so_hiwat = MAX(q->q_hiwat, tcp_sth_rcv_hiwat); 17510 17511 stropt->so_flags |= SO_MAXBLK; 17512 stropt->so_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 17513 17514 /* 17515 * This is the first time we run on the correct 17516 * queue after tcp_accept. So fix all the q parameters 17517 * here. 17518 */ 17519 /* Allocate room for SACK options if needed. */ 17520 stropt->so_flags |= SO_WROFF; 17521 if (tcp->tcp_fused) { 17522 ASSERT(tcp->tcp_loopback); 17523 ASSERT(tcp->tcp_loopback_peer != NULL); 17524 /* 17525 * For fused tcp loopback, set the stream head's write 17526 * offset value to zero since we won't be needing any room 17527 * for TCP/IP headers. This would also improve performance 17528 * since it would reduce the amount of work done by kmem. 17529 * Non-fused tcp loopback case is handled separately below. 17530 */ 17531 stropt->so_wroff = 0; 17532 /* 17533 * Record the stream head's high water mark for this endpoint; 17534 * this is used for flow-control purposes in tcp_fuse_output(). 17535 */ 17536 stropt->so_hiwat = tcp_fuse_set_rcv_hiwat(tcp, q->q_hiwat); 17537 /* 17538 * Update the peer's transmit parameters according to 17539 * our recently calculated high water mark value. 17540 */ 17541 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 17542 } else if (tcp->tcp_snd_sack_ok) { 17543 stropt->so_wroff = tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 17544 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra); 17545 } else { 17546 stropt->so_wroff = tcp->tcp_hdr_len + (tcp->tcp_loopback ? 0 : 17547 tcp_wroff_xtra); 17548 } 17549 17550 /* 17551 * If this is endpoint is handling SSL, then reserve extra 17552 * offset and space at the end. 17553 * Also have the stream head allocate SSL3_MAX_RECORD_LEN packets, 17554 * overriding the previous setting. The extra cost of signing and 17555 * encrypting multiple MSS-size records (12 of them with Ethernet), 17556 * instead of a single contiguous one by the stream head 17557 * largely outweighs the statistical reduction of ACKs, when 17558 * applicable. The peer will also save on decyption and verification 17559 * costs. 17560 */ 17561 if (tcp->tcp_kssl_ctx != NULL) { 17562 stropt->so_wroff += SSL3_WROFFSET; 17563 17564 stropt->so_flags |= SO_TAIL; 17565 stropt->so_tail = SSL3_MAX_TAIL_LEN; 17566 17567 stropt->so_maxblk = SSL3_MAX_RECORD_LEN; 17568 } 17569 17570 /* Send the options up */ 17571 putnext(q, stropt_mp); 17572 17573 /* 17574 * Pass up any data and/or a fin that has been received. 17575 * 17576 * Adjust receive window in case it had decreased 17577 * (because there is data <=> tcp_rcv_list != NULL) 17578 * while the connection was detached. Note that 17579 * in case the eager was flow-controlled, w/o this 17580 * code, the rwnd may never open up again! 17581 */ 17582 if (tcp->tcp_rcv_list != NULL) { 17583 /* We drain directly in case of fused tcp loopback */ 17584 if (!tcp->tcp_fused && canputnext(q)) { 17585 tcp->tcp_rwnd = q->q_hiwat; 17586 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 17587 << tcp->tcp_rcv_ws; 17588 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 17589 if (tcp->tcp_state >= TCPS_ESTABLISHED && 17590 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 17591 tcp_xmit_ctl(NULL, 17592 tcp, (tcp->tcp_swnd == 0) ? 17593 tcp->tcp_suna : tcp->tcp_snxt, 17594 tcp->tcp_rnxt, TH_ACK); 17595 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 17596 } 17597 17598 } 17599 (void) tcp_rcv_drain(q, tcp); 17600 17601 /* 17602 * For fused tcp loopback, back-enable peer endpoint 17603 * if it's currently flow-controlled. 17604 */ 17605 if (tcp->tcp_fused && 17606 tcp->tcp_loopback_peer->tcp_flow_stopped) { 17607 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 17608 17609 ASSERT(peer_tcp != NULL); 17610 ASSERT(peer_tcp->tcp_fused); 17611 17612 tcp_clrqfull(peer_tcp); 17613 TCP_STAT(tcp_fusion_backenabled); 17614 } 17615 } 17616 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 17617 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 17618 mp = mi_tpi_ordrel_ind(); 17619 if (mp) { 17620 tcp->tcp_ordrel_done = B_TRUE; 17621 putnext(q, mp); 17622 if (tcp->tcp_deferred_clean_death) { 17623 /* 17624 * tcp_clean_death was deferred 17625 * for T_ORDREL_IND - do it now 17626 */ 17627 (void) tcp_clean_death(tcp, 17628 tcp->tcp_client_errno, 21); 17629 tcp->tcp_deferred_clean_death = B_FALSE; 17630 } 17631 } else { 17632 /* 17633 * Run the orderly release in the 17634 * service routine. 17635 */ 17636 qenable(q); 17637 } 17638 } 17639 if (tcp->tcp_hard_binding) { 17640 tcp->tcp_hard_binding = B_FALSE; 17641 tcp->tcp_hard_bound = B_TRUE; 17642 } 17643 17644 tcp->tcp_detached = B_FALSE; 17645 17646 /* We can enable synchronous streams now */ 17647 if (tcp->tcp_fused) { 17648 tcp_fuse_syncstr_enable_pair(tcp); 17649 } 17650 17651 if (tcp->tcp_ka_enabled) { 17652 tcp->tcp_ka_last_intrvl = 0; 17653 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 17654 MSEC_TO_TICK(tcp->tcp_ka_interval)); 17655 } 17656 17657 /* 17658 * At this point, eager is fully established and will 17659 * have the following references - 17660 * 17661 * 2 references for connection to exist (1 for TCP and 1 for IP). 17662 * 1 reference for the squeue which will be dropped by the squeue as 17663 * soon as this function returns. 17664 * There will be 1 additonal reference for being in classifier 17665 * hash list provided something bad hasn't happened. 17666 */ 17667 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17668 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17669 } 17670 17671 /* 17672 * The function called through squeue to get behind listener's perimeter to 17673 * send a deffered conn_ind. 17674 */ 17675 /* ARGSUSED */ 17676 void 17677 tcp_send_pending(void *arg, mblk_t *mp, void *arg2) 17678 { 17679 conn_t *connp = (conn_t *)arg; 17680 tcp_t *listener = connp->conn_tcp; 17681 17682 if (listener->tcp_state == TCPS_CLOSED || 17683 TCP_IS_DETACHED(listener)) { 17684 /* 17685 * If listener has closed, it would have caused a 17686 * a cleanup/blowoff to happen for the eager. 17687 */ 17688 tcp_t *tcp; 17689 struct T_conn_ind *conn_ind; 17690 17691 conn_ind = (struct T_conn_ind *)mp->b_rptr; 17692 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 17693 conn_ind->OPT_length); 17694 /* 17695 * We need to drop the ref on eager that was put 17696 * tcp_rput_data() before trying to send the conn_ind 17697 * to listener. The conn_ind was deferred in tcp_send_conn_ind 17698 * and tcp_wput_accept() is sending this deferred conn_ind but 17699 * listener is closed so we drop the ref. 17700 */ 17701 CONN_DEC_REF(tcp->tcp_connp); 17702 freemsg(mp); 17703 return; 17704 } 17705 putnext(listener->tcp_rq, mp); 17706 } 17707 17708 17709 /* 17710 * This is the STREAMS entry point for T_CONN_RES coming down on 17711 * Acceptor STREAM when sockfs listener does accept processing. 17712 * Read the block comment on top pf tcp_conn_request(). 17713 */ 17714 void 17715 tcp_wput_accept(queue_t *q, mblk_t *mp) 17716 { 17717 queue_t *rq = RD(q); 17718 struct T_conn_res *conn_res; 17719 tcp_t *eager; 17720 tcp_t *listener; 17721 struct T_ok_ack *ok; 17722 t_scalar_t PRIM_type; 17723 mblk_t *opt_mp; 17724 conn_t *econnp; 17725 17726 ASSERT(DB_TYPE(mp) == M_PROTO); 17727 17728 conn_res = (struct T_conn_res *)mp->b_rptr; 17729 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 17730 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_res)) { 17731 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 17732 if (mp != NULL) 17733 putnext(rq, mp); 17734 return; 17735 } 17736 switch (conn_res->PRIM_type) { 17737 case O_T_CONN_RES: 17738 case T_CONN_RES: 17739 /* 17740 * We pass up an err ack if allocb fails. This will 17741 * cause sockfs to issue a T_DISCON_REQ which will cause 17742 * tcp_eager_blowoff to be called. sockfs will then call 17743 * rq->q_qinfo->qi_qclose to cleanup the acceptor stream. 17744 * we need to do the allocb up here because we have to 17745 * make sure rq->q_qinfo->qi_qclose still points to the 17746 * correct function (tcpclose_accept) in case allocb 17747 * fails. 17748 */ 17749 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 17750 if (opt_mp == NULL) { 17751 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 17752 if (mp != NULL) 17753 putnext(rq, mp); 17754 return; 17755 } 17756 17757 bcopy(mp->b_rptr + conn_res->OPT_offset, 17758 &eager, conn_res->OPT_length); 17759 PRIM_type = conn_res->PRIM_type; 17760 mp->b_datap->db_type = M_PCPROTO; 17761 mp->b_wptr = mp->b_rptr + sizeof (struct T_ok_ack); 17762 ok = (struct T_ok_ack *)mp->b_rptr; 17763 ok->PRIM_type = T_OK_ACK; 17764 ok->CORRECT_prim = PRIM_type; 17765 econnp = eager->tcp_connp; 17766 econnp->conn_dev = (dev_t)q->q_ptr; 17767 eager->tcp_rq = rq; 17768 eager->tcp_wq = q; 17769 rq->q_ptr = econnp; 17770 rq->q_qinfo = &tcp_rinit; 17771 q->q_ptr = econnp; 17772 q->q_qinfo = &tcp_winit; 17773 listener = eager->tcp_listener; 17774 eager->tcp_issocket = B_TRUE; 17775 17776 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 17777 econnp->conn_allzones = listener->tcp_connp->conn_allzones; 17778 17779 /* Put the ref for IP */ 17780 CONN_INC_REF(econnp); 17781 17782 /* 17783 * We should have minimum of 3 references on the conn 17784 * at this point. One each for TCP and IP and one for 17785 * the T_conn_ind that was sent up when the 3-way handshake 17786 * completed. In the normal case we would also have another 17787 * reference (making a total of 4) for the conn being in the 17788 * classifier hash list. However the eager could have received 17789 * an RST subsequently and tcp_closei_local could have removed 17790 * the eager from the classifier hash list, hence we can't 17791 * assert that reference. 17792 */ 17793 ASSERT(econnp->conn_ref >= 3); 17794 17795 /* 17796 * Send the new local address also up to sockfs. There 17797 * should already be enough space in the mp that came 17798 * down from soaccept(). 17799 */ 17800 if (eager->tcp_family == AF_INET) { 17801 sin_t *sin; 17802 17803 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 17804 (sizeof (struct T_ok_ack) + sizeof (sin_t))); 17805 sin = (sin_t *)mp->b_wptr; 17806 mp->b_wptr += sizeof (sin_t); 17807 sin->sin_family = AF_INET; 17808 sin->sin_port = eager->tcp_lport; 17809 sin->sin_addr.s_addr = eager->tcp_ipha->ipha_src; 17810 } else { 17811 sin6_t *sin6; 17812 17813 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 17814 sizeof (struct T_ok_ack) + sizeof (sin6_t)); 17815 sin6 = (sin6_t *)mp->b_wptr; 17816 mp->b_wptr += sizeof (sin6_t); 17817 sin6->sin6_family = AF_INET6; 17818 sin6->sin6_port = eager->tcp_lport; 17819 if (eager->tcp_ipversion == IPV4_VERSION) { 17820 sin6->sin6_flowinfo = 0; 17821 IN6_IPADDR_TO_V4MAPPED( 17822 eager->tcp_ipha->ipha_src, 17823 &sin6->sin6_addr); 17824 } else { 17825 ASSERT(eager->tcp_ip6h != NULL); 17826 sin6->sin6_flowinfo = 17827 eager->tcp_ip6h->ip6_vcf & 17828 ~IPV6_VERS_AND_FLOW_MASK; 17829 sin6->sin6_addr = eager->tcp_ip6h->ip6_src; 17830 } 17831 sin6->sin6_scope_id = 0; 17832 sin6->__sin6_src_id = 0; 17833 } 17834 17835 putnext(rq, mp); 17836 17837 opt_mp->b_datap->db_type = M_SETOPTS; 17838 opt_mp->b_wptr += sizeof (struct stroptions); 17839 17840 /* 17841 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 17842 * from listener to acceptor. The message is chained on the 17843 * bind_mp which tcp_rput_other will send down to IP. 17844 */ 17845 if (listener->tcp_bound_if != 0) { 17846 /* allocate optmgmt req */ 17847 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 17848 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 17849 sizeof (int)); 17850 if (mp != NULL) 17851 linkb(opt_mp, mp); 17852 } 17853 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 17854 uint_t on = 1; 17855 17856 /* allocate optmgmt req */ 17857 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 17858 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 17859 if (mp != NULL) 17860 linkb(opt_mp, mp); 17861 } 17862 17863 17864 mutex_enter(&listener->tcp_eager_lock); 17865 17866 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 17867 17868 tcp_t *tail; 17869 tcp_t *tcp; 17870 mblk_t *mp1; 17871 17872 tcp = listener->tcp_eager_prev_q0; 17873 /* 17874 * listener->tcp_eager_prev_q0 points to the TAIL of the 17875 * deferred T_conn_ind queue. We need to get to the head 17876 * of the queue in order to send up T_conn_ind the same 17877 * order as how the 3WHS is completed. 17878 */ 17879 while (tcp != listener) { 17880 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0 && 17881 !tcp->tcp_kssl_pending) 17882 break; 17883 else 17884 tcp = tcp->tcp_eager_prev_q0; 17885 } 17886 /* None of the pending eagers can be sent up now */ 17887 if (tcp == listener) 17888 goto no_more_eagers; 17889 17890 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 17891 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 17892 /* Move from q0 to q */ 17893 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 17894 listener->tcp_conn_req_cnt_q0--; 17895 listener->tcp_conn_req_cnt_q++; 17896 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 17897 tcp->tcp_eager_prev_q0; 17898 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 17899 tcp->tcp_eager_next_q0; 17900 tcp->tcp_eager_prev_q0 = NULL; 17901 tcp->tcp_eager_next_q0 = NULL; 17902 tcp->tcp_conn_def_q0 = B_FALSE; 17903 17904 /* 17905 * Insert at end of the queue because sockfs sends 17906 * down T_CONN_RES in chronological order. Leaving 17907 * the older conn indications at front of the queue 17908 * helps reducing search time. 17909 */ 17910 tail = listener->tcp_eager_last_q; 17911 if (tail != NULL) { 17912 tail->tcp_eager_next_q = tcp; 17913 } else { 17914 listener->tcp_eager_next_q = tcp; 17915 } 17916 listener->tcp_eager_last_q = tcp; 17917 tcp->tcp_eager_next_q = NULL; 17918 17919 /* Need to get inside the listener perimeter */ 17920 CONN_INC_REF(listener->tcp_connp); 17921 squeue_fill(listener->tcp_connp->conn_sqp, mp1, 17922 tcp_send_pending, listener->tcp_connp, 17923 SQTAG_TCP_SEND_PENDING); 17924 } 17925 no_more_eagers: 17926 tcp_eager_unlink(eager); 17927 mutex_exit(&listener->tcp_eager_lock); 17928 17929 /* 17930 * At this point, the eager is detached from the listener 17931 * but we still have an extra refs on eager (apart from the 17932 * usual tcp references). The ref was placed in tcp_rput_data 17933 * before sending the conn_ind in tcp_send_conn_ind. 17934 * The ref will be dropped in tcp_accept_finish(). 17935 */ 17936 squeue_enter_nodrain(econnp->conn_sqp, opt_mp, 17937 tcp_accept_finish, econnp, SQTAG_TCP_ACCEPT_FINISH_Q0); 17938 return; 17939 default: 17940 mp = mi_tpi_err_ack_alloc(mp, TNOTSUPPORT, 0); 17941 if (mp != NULL) 17942 putnext(rq, mp); 17943 return; 17944 } 17945 } 17946 17947 void 17948 tcp_wput(queue_t *q, mblk_t *mp) 17949 { 17950 conn_t *connp = Q_TO_CONN(q); 17951 tcp_t *tcp; 17952 void (*output_proc)(); 17953 t_scalar_t type; 17954 uchar_t *rptr; 17955 struct iocblk *iocp; 17956 uint32_t msize; 17957 17958 ASSERT(connp->conn_ref >= 2); 17959 17960 switch (DB_TYPE(mp)) { 17961 case M_DATA: 17962 tcp = connp->conn_tcp; 17963 ASSERT(tcp != NULL); 17964 17965 msize = msgdsize(mp); 17966 17967 mutex_enter(&connp->conn_lock); 17968 CONN_INC_REF_LOCKED(connp); 17969 17970 tcp->tcp_squeue_bytes += msize; 17971 if (TCP_UNSENT_BYTES(tcp) > tcp->tcp_xmit_hiwater) { 17972 mutex_exit(&connp->conn_lock); 17973 tcp_setqfull(tcp); 17974 } else 17975 mutex_exit(&connp->conn_lock); 17976 17977 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 17978 tcp_output, connp, SQTAG_TCP_OUTPUT); 17979 return; 17980 case M_PROTO: 17981 case M_PCPROTO: 17982 /* 17983 * if it is a snmp message, don't get behind the squeue 17984 */ 17985 tcp = connp->conn_tcp; 17986 rptr = mp->b_rptr; 17987 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 17988 type = ((union T_primitives *)rptr)->type; 17989 } else { 17990 if (tcp->tcp_debug) { 17991 (void) strlog(TCP_MOD_ID, 0, 1, 17992 SL_ERROR|SL_TRACE, 17993 "tcp_wput_proto, dropping one..."); 17994 } 17995 freemsg(mp); 17996 return; 17997 } 17998 if (type == T_SVR4_OPTMGMT_REQ) { 17999 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 18000 if (snmpcom_req(q, mp, tcp_snmp_set, tcp_snmp_get, 18001 cr)) { 18002 /* 18003 * This was a SNMP request 18004 */ 18005 return; 18006 } else { 18007 output_proc = tcp_wput_proto; 18008 } 18009 } else { 18010 output_proc = tcp_wput_proto; 18011 } 18012 break; 18013 case M_IOCTL: 18014 /* 18015 * Most ioctls can be processed right away without going via 18016 * squeues - process them right here. Those that do require 18017 * squeue (currently TCP_IOC_DEFAULT_Q and _SIOCSOCKFALLBACK) 18018 * are processed by tcp_wput_ioctl(). 18019 */ 18020 iocp = (struct iocblk *)mp->b_rptr; 18021 tcp = connp->conn_tcp; 18022 18023 switch (iocp->ioc_cmd) { 18024 case TCP_IOC_ABORT_CONN: 18025 tcp_ioctl_abort_conn(q, mp); 18026 return; 18027 case TI_GETPEERNAME: 18028 if (tcp->tcp_state < TCPS_SYN_RCVD) { 18029 iocp->ioc_error = ENOTCONN; 18030 iocp->ioc_count = 0; 18031 mp->b_datap->db_type = M_IOCACK; 18032 qreply(q, mp); 18033 return; 18034 } 18035 /* FALLTHRU */ 18036 case TI_GETMYNAME: 18037 mi_copyin(q, mp, NULL, 18038 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 18039 return; 18040 case ND_SET: 18041 /* nd_getset does the necessary checks */ 18042 case ND_GET: 18043 if (!nd_getset(q, tcp_g_nd, mp)) { 18044 CALL_IP_WPUT(connp, q, mp); 18045 return; 18046 } 18047 qreply(q, mp); 18048 return; 18049 case TCP_IOC_DEFAULT_Q: 18050 /* 18051 * Wants to be the default wq. Check the credentials 18052 * first, the rest is executed via squeue. 18053 */ 18054 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 18055 iocp->ioc_error = EPERM; 18056 iocp->ioc_count = 0; 18057 mp->b_datap->db_type = M_IOCACK; 18058 qreply(q, mp); 18059 return; 18060 } 18061 output_proc = tcp_wput_ioctl; 18062 break; 18063 default: 18064 output_proc = tcp_wput_ioctl; 18065 break; 18066 } 18067 break; 18068 default: 18069 output_proc = tcp_wput_nondata; 18070 break; 18071 } 18072 18073 CONN_INC_REF(connp); 18074 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 18075 output_proc, connp, SQTAG_TCP_WPUT_OTHER); 18076 } 18077 18078 /* 18079 * Initial STREAMS write side put() procedure for sockets. It tries to 18080 * handle the T_CAPABILITY_REQ which sockfs sends down while setting 18081 * up the socket without using the squeue. Non T_CAPABILITY_REQ messages 18082 * are handled by tcp_wput() as usual. 18083 * 18084 * All further messages will also be handled by tcp_wput() because we cannot 18085 * be sure that the above short cut is safe later. 18086 */ 18087 static void 18088 tcp_wput_sock(queue_t *wq, mblk_t *mp) 18089 { 18090 conn_t *connp = Q_TO_CONN(wq); 18091 tcp_t *tcp = connp->conn_tcp; 18092 struct T_capability_req *car = (struct T_capability_req *)mp->b_rptr; 18093 18094 ASSERT(wq->q_qinfo == &tcp_sock_winit); 18095 wq->q_qinfo = &tcp_winit; 18096 18097 ASSERT(IPCL_IS_TCP(connp)); 18098 ASSERT(TCP_IS_SOCKET(tcp)); 18099 18100 if (DB_TYPE(mp) == M_PCPROTO && 18101 MBLKL(mp) == sizeof (struct T_capability_req) && 18102 car->PRIM_type == T_CAPABILITY_REQ) { 18103 tcp_capability_req(tcp, mp); 18104 return; 18105 } 18106 18107 tcp_wput(wq, mp); 18108 } 18109 18110 static boolean_t 18111 tcp_zcopy_check(tcp_t *tcp) 18112 { 18113 conn_t *connp = tcp->tcp_connp; 18114 ire_t *ire; 18115 boolean_t zc_enabled = B_FALSE; 18116 18117 if (do_tcpzcopy == 2) 18118 zc_enabled = B_TRUE; 18119 else if (tcp->tcp_ipversion == IPV4_VERSION && 18120 IPCL_IS_CONNECTED(connp) && 18121 (connp->conn_flags & IPCL_CHECK_POLICY) == 0 && 18122 connp->conn_dontroute == 0 && 18123 !connp->conn_nexthop_set && 18124 connp->conn_xmit_if_ill == NULL && 18125 connp->conn_nofailover_ill == NULL && 18126 do_tcpzcopy == 1) { 18127 /* 18128 * the checks above closely resemble the fast path checks 18129 * in tcp_send_data(). 18130 */ 18131 mutex_enter(&connp->conn_lock); 18132 ire = connp->conn_ire_cache; 18133 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18134 if (ire != NULL && !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18135 IRE_REFHOLD(ire); 18136 if (ire->ire_stq != NULL) { 18137 ill_t *ill = (ill_t *)ire->ire_stq->q_ptr; 18138 18139 zc_enabled = ill && (ill->ill_capabilities & 18140 ILL_CAPAB_ZEROCOPY) && 18141 (ill->ill_zerocopy_capab-> 18142 ill_zerocopy_flags != 0); 18143 } 18144 IRE_REFRELE(ire); 18145 } 18146 mutex_exit(&connp->conn_lock); 18147 } 18148 tcp->tcp_snd_zcopy_on = zc_enabled; 18149 if (!TCP_IS_DETACHED(tcp)) { 18150 if (zc_enabled) { 18151 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMSAFE); 18152 TCP_STAT(tcp_zcopy_on); 18153 } else { 18154 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18155 TCP_STAT(tcp_zcopy_off); 18156 } 18157 } 18158 return (zc_enabled); 18159 } 18160 18161 static mblk_t * 18162 tcp_zcopy_disable(tcp_t *tcp, mblk_t *bp) 18163 { 18164 if (do_tcpzcopy == 2) 18165 return (bp); 18166 else if (tcp->tcp_snd_zcopy_on) { 18167 tcp->tcp_snd_zcopy_on = B_FALSE; 18168 if (!TCP_IS_DETACHED(tcp)) { 18169 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18170 TCP_STAT(tcp_zcopy_disable); 18171 } 18172 } 18173 return (tcp_zcopy_backoff(tcp, bp, 0)); 18174 } 18175 18176 /* 18177 * Backoff from a zero-copy mblk by copying data to a new mblk and freeing 18178 * the original desballoca'ed segmapped mblk. 18179 */ 18180 static mblk_t * 18181 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, int fix_xmitlist) 18182 { 18183 mblk_t *head, *tail, *nbp; 18184 if (IS_VMLOANED_MBLK(bp)) { 18185 TCP_STAT(tcp_zcopy_backoff); 18186 if ((head = copyb(bp)) == NULL) { 18187 /* fail to backoff; leave it for the next backoff */ 18188 tcp->tcp_xmit_zc_clean = B_FALSE; 18189 return (bp); 18190 } 18191 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18192 if (fix_xmitlist) 18193 tcp_zcopy_notify(tcp); 18194 else 18195 head->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18196 } 18197 nbp = bp->b_cont; 18198 if (fix_xmitlist) { 18199 head->b_prev = bp->b_prev; 18200 head->b_next = bp->b_next; 18201 if (tcp->tcp_xmit_tail == bp) 18202 tcp->tcp_xmit_tail = head; 18203 } 18204 bp->b_next = NULL; 18205 bp->b_prev = NULL; 18206 freeb(bp); 18207 } else { 18208 head = bp; 18209 nbp = bp->b_cont; 18210 } 18211 tail = head; 18212 while (nbp) { 18213 if (IS_VMLOANED_MBLK(nbp)) { 18214 TCP_STAT(tcp_zcopy_backoff); 18215 if ((tail->b_cont = copyb(nbp)) == NULL) { 18216 tcp->tcp_xmit_zc_clean = B_FALSE; 18217 tail->b_cont = nbp; 18218 return (head); 18219 } 18220 tail = tail->b_cont; 18221 if (nbp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18222 if (fix_xmitlist) 18223 tcp_zcopy_notify(tcp); 18224 else 18225 tail->b_datap->db_struioflag |= 18226 STRUIO_ZCNOTIFY; 18227 } 18228 bp = nbp; 18229 nbp = nbp->b_cont; 18230 if (fix_xmitlist) { 18231 tail->b_prev = bp->b_prev; 18232 tail->b_next = bp->b_next; 18233 if (tcp->tcp_xmit_tail == bp) 18234 tcp->tcp_xmit_tail = tail; 18235 } 18236 bp->b_next = NULL; 18237 bp->b_prev = NULL; 18238 freeb(bp); 18239 } else { 18240 tail->b_cont = nbp; 18241 tail = nbp; 18242 nbp = nbp->b_cont; 18243 } 18244 } 18245 if (fix_xmitlist) { 18246 tcp->tcp_xmit_last = tail; 18247 tcp->tcp_xmit_zc_clean = B_TRUE; 18248 } 18249 return (head); 18250 } 18251 18252 static void 18253 tcp_zcopy_notify(tcp_t *tcp) 18254 { 18255 struct stdata *stp; 18256 18257 if (tcp->tcp_detached) 18258 return; 18259 stp = STREAM(tcp->tcp_rq); 18260 mutex_enter(&stp->sd_lock); 18261 stp->sd_flag |= STZCNOTIFY; 18262 cv_broadcast(&stp->sd_zcopy_wait); 18263 mutex_exit(&stp->sd_lock); 18264 } 18265 18266 static void 18267 tcp_send_data(tcp_t *tcp, queue_t *q, mblk_t *mp) 18268 { 18269 ipha_t *ipha; 18270 ipaddr_t src; 18271 ipaddr_t dst; 18272 uint32_t cksum; 18273 ire_t *ire; 18274 uint16_t *up; 18275 ill_t *ill; 18276 conn_t *connp = tcp->tcp_connp; 18277 uint32_t hcksum_txflags = 0; 18278 mblk_t *ire_fp_mp; 18279 uint_t ire_fp_mp_len; 18280 18281 ASSERT(DB_TYPE(mp) == M_DATA); 18282 18283 if (DB_CRED(mp) == NULL) 18284 mblk_setcred(mp, CONN_CRED(connp)); 18285 18286 ipha = (ipha_t *)mp->b_rptr; 18287 src = ipha->ipha_src; 18288 dst = ipha->ipha_dst; 18289 18290 /* 18291 * Drop off fast path for IPv6 and also if options are present or 18292 * we need to resolve a TS label. 18293 */ 18294 if (tcp->tcp_ipversion != IPV4_VERSION || 18295 !IPCL_IS_CONNECTED(connp) || 18296 (connp->conn_flags & IPCL_CHECK_POLICY) != 0 || 18297 connp->conn_dontroute || 18298 connp->conn_nexthop_set || 18299 connp->conn_xmit_if_ill != NULL || 18300 connp->conn_nofailover_ill != NULL || 18301 !connp->conn_ulp_labeled || 18302 ipha->ipha_ident == IP_HDR_INCLUDED || 18303 ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION || 18304 IPP_ENABLED(IPP_LOCAL_OUT)) { 18305 if (tcp->tcp_snd_zcopy_aware) 18306 mp = tcp_zcopy_disable(tcp, mp); 18307 TCP_STAT(tcp_ip_send); 18308 CALL_IP_WPUT(connp, q, mp); 18309 return; 18310 } 18311 18312 mutex_enter(&connp->conn_lock); 18313 ire = connp->conn_ire_cache; 18314 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18315 if (ire != NULL && ire->ire_addr == dst && 18316 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18317 IRE_REFHOLD(ire); 18318 mutex_exit(&connp->conn_lock); 18319 } else { 18320 boolean_t cached = B_FALSE; 18321 18322 /* force a recheck later on */ 18323 tcp->tcp_ire_ill_check_done = B_FALSE; 18324 18325 TCP_DBGSTAT(tcp_ire_null1); 18326 connp->conn_ire_cache = NULL; 18327 mutex_exit(&connp->conn_lock); 18328 if (ire != NULL) 18329 IRE_REFRELE_NOTR(ire); 18330 ire = ire_cache_lookup(dst, connp->conn_zoneid, 18331 MBLK_GETLABEL(mp)); 18332 if (ire == NULL) { 18333 if (tcp->tcp_snd_zcopy_aware) 18334 mp = tcp_zcopy_backoff(tcp, mp, 0); 18335 TCP_STAT(tcp_ire_null); 18336 CALL_IP_WPUT(connp, q, mp); 18337 return; 18338 } 18339 IRE_REFHOLD_NOTR(ire); 18340 /* 18341 * Since we are inside the squeue, there cannot be another 18342 * thread in TCP trying to set the conn_ire_cache now. The 18343 * check for IRE_MARK_CONDEMNED ensures that an interface 18344 * unplumb thread has not yet started cleaning up the conns. 18345 * Hence we don't need to grab the conn lock. 18346 */ 18347 if (!(connp->conn_state_flags & CONN_CLOSING)) { 18348 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 18349 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18350 connp->conn_ire_cache = ire; 18351 cached = B_TRUE; 18352 } 18353 rw_exit(&ire->ire_bucket->irb_lock); 18354 } 18355 18356 /* 18357 * We can continue to use the ire but since it was 18358 * not cached, we should drop the extra reference. 18359 */ 18360 if (!cached) 18361 IRE_REFRELE_NOTR(ire); 18362 18363 /* 18364 * Rampart note: no need to select a new label here, since 18365 * labels are not allowed to change during the life of a TCP 18366 * connection. 18367 */ 18368 } 18369 18370 /* 18371 * The following if case identifies whether or not 18372 * we are forced to take the slowpath. 18373 */ 18374 if (ire->ire_flags & RTF_MULTIRT || 18375 ire->ire_stq == NULL || 18376 ire->ire_max_frag < ntohs(ipha->ipha_length) || 18377 (ire->ire_nce != NULL && 18378 (ire_fp_mp = ire->ire_nce->nce_fp_mp) == NULL) || 18379 (ire_fp_mp_len = MBLKL(ire_fp_mp)) > MBLKHEAD(mp)) { 18380 if (tcp->tcp_snd_zcopy_aware) 18381 mp = tcp_zcopy_disable(tcp, mp); 18382 TCP_STAT(tcp_ip_ire_send); 18383 IRE_REFRELE(ire); 18384 CALL_IP_WPUT(connp, q, mp); 18385 return; 18386 } 18387 18388 ill = ire_to_ill(ire); 18389 if (connp->conn_outgoing_ill != NULL) { 18390 ill_t *conn_outgoing_ill = NULL; 18391 /* 18392 * Choose a good ill in the group to send the packets on. 18393 */ 18394 ire = conn_set_outgoing_ill(connp, ire, &conn_outgoing_ill); 18395 ill = ire_to_ill(ire); 18396 } 18397 ASSERT(ill != NULL); 18398 18399 if (!tcp->tcp_ire_ill_check_done) { 18400 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 18401 tcp->tcp_ire_ill_check_done = B_TRUE; 18402 } 18403 18404 ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED); 18405 ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1); 18406 #ifndef _BIG_ENDIAN 18407 ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8); 18408 #endif 18409 18410 /* 18411 * Check to see if we need to re-enable MDT for this connection 18412 * because it was previously disabled due to changes in the ill; 18413 * note that by doing it here, this re-enabling only applies when 18414 * the packet is not dispatched through CALL_IP_WPUT(). 18415 * 18416 * That means for IPv4, it is worth re-enabling MDT for the fastpath 18417 * case, since that's how we ended up here. For IPv6, we do the 18418 * re-enabling work in ip_xmit_v6(), albeit indirectly via squeue. 18419 */ 18420 if (connp->conn_mdt_ok && !tcp->tcp_mdt && ILL_MDT_USABLE(ill)) { 18421 /* 18422 * Restore MDT for this connection, so that next time around 18423 * it is eligible to go through tcp_multisend() path again. 18424 */ 18425 TCP_STAT(tcp_mdt_conn_resumed1); 18426 tcp->tcp_mdt = B_TRUE; 18427 ip1dbg(("tcp_send_data: reenabling MDT for connp %p on " 18428 "interface %s\n", (void *)connp, ill->ill_name)); 18429 } 18430 18431 if (tcp->tcp_snd_zcopy_aware) { 18432 if ((ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) == 0 || 18433 (ill->ill_zerocopy_capab->ill_zerocopy_flags == 0)) 18434 mp = tcp_zcopy_disable(tcp, mp); 18435 /* 18436 * we shouldn't need to reset ipha as the mp containing 18437 * ipha should never be a zero-copy mp. 18438 */ 18439 } 18440 18441 if (ILL_HCKSUM_CAPABLE(ill) && dohwcksum) { 18442 ASSERT(ill->ill_hcksum_capab != NULL); 18443 hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags; 18444 } 18445 18446 /* pseudo-header checksum (do it in parts for IP header checksum) */ 18447 cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF); 18448 18449 ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION); 18450 up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); 18451 18452 IP_CKSUM_XMIT_FAST(ire->ire_ipversion, hcksum_txflags, mp, ipha, up, 18453 IPPROTO_TCP, IP_SIMPLE_HDR_LENGTH, ntohs(ipha->ipha_length), cksum); 18454 18455 /* Software checksum? */ 18456 if (DB_CKSUMFLAGS(mp) == 0) { 18457 TCP_STAT(tcp_out_sw_cksum); 18458 TCP_STAT_UPDATE(tcp_out_sw_cksum_bytes, 18459 ntohs(ipha->ipha_length) - IP_SIMPLE_HDR_LENGTH); 18460 } 18461 18462 ipha->ipha_fragment_offset_and_flags |= 18463 (uint32_t)htons(ire->ire_frag_flag); 18464 18465 /* Calculate IP header checksum if hardware isn't capable */ 18466 if (!(DB_CKSUMFLAGS(mp) & HCK_IPV4_HDRCKSUM)) { 18467 IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0], 18468 ((uint16_t *)ipha)[4]); 18469 } 18470 18471 ASSERT(DB_TYPE(ire_fp_mp) == M_DATA); 18472 mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len; 18473 bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len); 18474 18475 UPDATE_OB_PKT_COUNT(ire); 18476 ire->ire_last_used_time = lbolt; 18477 BUMP_MIB(&ip_mib, ipOutRequests); 18478 18479 if (ILL_DLS_CAPABLE(ill)) { 18480 /* 18481 * Send the packet directly to DLD, where it may be queued 18482 * depending on the availability of transmit resources at 18483 * the media layer. 18484 */ 18485 IP_DLS_ILL_TX(ill, mp); 18486 } else { 18487 putnext(ire->ire_stq, mp); 18488 } 18489 IRE_REFRELE(ire); 18490 } 18491 18492 /* 18493 * This handles the case when the receiver has shrunk its win. Per RFC 1122 18494 * if the receiver shrinks the window, i.e. moves the right window to the 18495 * left, the we should not send new data, but should retransmit normally the 18496 * old unacked data between suna and suna + swnd. We might has sent data 18497 * that is now outside the new window, pretend that we didn't send it. 18498 */ 18499 static void 18500 tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_count) 18501 { 18502 uint32_t snxt = tcp->tcp_snxt; 18503 mblk_t *xmit_tail; 18504 int32_t offset; 18505 18506 ASSERT(shrunk_count > 0); 18507 18508 /* Pretend we didn't send the data outside the window */ 18509 snxt -= shrunk_count; 18510 18511 /* Get the mblk and the offset in it per the shrunk window */ 18512 xmit_tail = tcp_get_seg_mp(tcp, snxt, &offset); 18513 18514 ASSERT(xmit_tail != NULL); 18515 18516 /* Reset all the values per the now shrunk window */ 18517 tcp->tcp_snxt = snxt; 18518 tcp->tcp_xmit_tail = xmit_tail; 18519 tcp->tcp_xmit_tail_unsent = xmit_tail->b_wptr - xmit_tail->b_rptr - 18520 offset; 18521 tcp->tcp_unsent += shrunk_count; 18522 18523 if (tcp->tcp_suna == tcp->tcp_snxt && tcp->tcp_swnd == 0) 18524 /* 18525 * Make sure the timer is running so that we will probe a zero 18526 * window. 18527 */ 18528 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 18529 } 18530 18531 18532 /* 18533 * The TCP normal data output path. 18534 * NOTE: the logic of the fast path is duplicated from this function. 18535 */ 18536 static void 18537 tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent) 18538 { 18539 int len; 18540 mblk_t *local_time; 18541 mblk_t *mp1; 18542 uint32_t snxt; 18543 int tail_unsent; 18544 int tcpstate; 18545 int usable = 0; 18546 mblk_t *xmit_tail; 18547 queue_t *q = tcp->tcp_wq; 18548 int32_t mss; 18549 int32_t num_sack_blk = 0; 18550 int32_t tcp_hdr_len; 18551 int32_t tcp_tcp_hdr_len; 18552 int mdt_thres; 18553 int rc; 18554 18555 tcpstate = tcp->tcp_state; 18556 if (mp == NULL) { 18557 /* 18558 * tcp_wput_data() with NULL mp should only be called when 18559 * there is unsent data. 18560 */ 18561 ASSERT(tcp->tcp_unsent > 0); 18562 /* Really tacky... but we need this for detached closes. */ 18563 len = tcp->tcp_unsent; 18564 goto data_null; 18565 } 18566 18567 #if CCS_STATS 18568 wrw_stats.tot.count++; 18569 wrw_stats.tot.bytes += msgdsize(mp); 18570 #endif 18571 ASSERT(mp->b_datap->db_type == M_DATA); 18572 /* 18573 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ, 18574 * or before a connection attempt has begun. 18575 */ 18576 if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT || 18577 (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18578 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18579 #ifdef DEBUG 18580 cmn_err(CE_WARN, 18581 "tcp_wput_data: data after ordrel, %s", 18582 tcp_display(tcp, NULL, 18583 DISP_ADDR_AND_PORT)); 18584 #else 18585 if (tcp->tcp_debug) { 18586 (void) strlog(TCP_MOD_ID, 0, 1, 18587 SL_TRACE|SL_ERROR, 18588 "tcp_wput_data: data after ordrel, %s\n", 18589 tcp_display(tcp, NULL, 18590 DISP_ADDR_AND_PORT)); 18591 } 18592 #endif /* DEBUG */ 18593 } 18594 if (tcp->tcp_snd_zcopy_aware && 18595 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) != 0) 18596 tcp_zcopy_notify(tcp); 18597 freemsg(mp); 18598 if (tcp->tcp_flow_stopped && 18599 TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) { 18600 tcp_clrqfull(tcp); 18601 } 18602 return; 18603 } 18604 18605 /* Strip empties */ 18606 for (;;) { 18607 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 18608 (uintptr_t)INT_MAX); 18609 len = (int)(mp->b_wptr - mp->b_rptr); 18610 if (len > 0) 18611 break; 18612 mp1 = mp; 18613 mp = mp->b_cont; 18614 freeb(mp1); 18615 if (!mp) { 18616 return; 18617 } 18618 } 18619 18620 /* If we are the first on the list ... */ 18621 if (tcp->tcp_xmit_head == NULL) { 18622 tcp->tcp_xmit_head = mp; 18623 tcp->tcp_xmit_tail = mp; 18624 tcp->tcp_xmit_tail_unsent = len; 18625 } else { 18626 /* If tiny tx and room in txq tail, pullup to save mblks. */ 18627 struct datab *dp; 18628 18629 mp1 = tcp->tcp_xmit_last; 18630 if (len < tcp_tx_pull_len && 18631 (dp = mp1->b_datap)->db_ref == 1 && 18632 dp->db_lim - mp1->b_wptr >= len) { 18633 ASSERT(len > 0); 18634 ASSERT(!mp1->b_cont); 18635 if (len == 1) { 18636 *mp1->b_wptr++ = *mp->b_rptr; 18637 } else { 18638 bcopy(mp->b_rptr, mp1->b_wptr, len); 18639 mp1->b_wptr += len; 18640 } 18641 if (mp1 == tcp->tcp_xmit_tail) 18642 tcp->tcp_xmit_tail_unsent += len; 18643 mp1->b_cont = mp->b_cont; 18644 if (tcp->tcp_snd_zcopy_aware && 18645 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 18646 mp1->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18647 freeb(mp); 18648 mp = mp1; 18649 } else { 18650 tcp->tcp_xmit_last->b_cont = mp; 18651 } 18652 len += tcp->tcp_unsent; 18653 } 18654 18655 /* Tack on however many more positive length mblks we have */ 18656 if ((mp1 = mp->b_cont) != NULL) { 18657 do { 18658 int tlen; 18659 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 18660 (uintptr_t)INT_MAX); 18661 tlen = (int)(mp1->b_wptr - mp1->b_rptr); 18662 if (tlen <= 0) { 18663 mp->b_cont = mp1->b_cont; 18664 freeb(mp1); 18665 } else { 18666 len += tlen; 18667 mp = mp1; 18668 } 18669 } while ((mp1 = mp->b_cont) != NULL); 18670 } 18671 tcp->tcp_xmit_last = mp; 18672 tcp->tcp_unsent = len; 18673 18674 if (urgent) 18675 usable = 1; 18676 18677 data_null: 18678 snxt = tcp->tcp_snxt; 18679 xmit_tail = tcp->tcp_xmit_tail; 18680 tail_unsent = tcp->tcp_xmit_tail_unsent; 18681 18682 /* 18683 * Note that tcp_mss has been adjusted to take into account the 18684 * timestamp option if applicable. Because SACK options do not 18685 * appear in every TCP segments and they are of variable lengths, 18686 * they cannot be included in tcp_mss. Thus we need to calculate 18687 * the actual segment length when we need to send a segment which 18688 * includes SACK options. 18689 */ 18690 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 18691 int32_t opt_len; 18692 18693 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 18694 tcp->tcp_num_sack_blk); 18695 opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN * 18696 2 + TCPOPT_HEADER_LEN; 18697 mss = tcp->tcp_mss - opt_len; 18698 tcp_hdr_len = tcp->tcp_hdr_len + opt_len; 18699 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + opt_len; 18700 } else { 18701 mss = tcp->tcp_mss; 18702 tcp_hdr_len = tcp->tcp_hdr_len; 18703 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 18704 } 18705 18706 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 18707 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 18708 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 18709 } 18710 if (tcpstate == TCPS_SYN_RCVD) { 18711 /* 18712 * The three-way connection establishment handshake is not 18713 * complete yet. We want to queue the data for transmission 18714 * after entering ESTABLISHED state (RFC793). A jump to 18715 * "done" label effectively leaves data on the queue. 18716 */ 18717 goto done; 18718 } else { 18719 int usable_r; 18720 18721 /* 18722 * In the special case when cwnd is zero, which can only 18723 * happen if the connection is ECN capable, return now. 18724 * New segments is sent using tcp_timer(). The timer 18725 * is set in tcp_rput_data(). 18726 */ 18727 if (tcp->tcp_cwnd == 0) { 18728 /* 18729 * Note that tcp_cwnd is 0 before 3-way handshake is 18730 * finished. 18731 */ 18732 ASSERT(tcp->tcp_ecn_ok || 18733 tcp->tcp_state < TCPS_ESTABLISHED); 18734 return; 18735 } 18736 18737 /* NOTE: trouble if xmitting while SYN not acked? */ 18738 usable_r = snxt - tcp->tcp_suna; 18739 usable_r = tcp->tcp_swnd - usable_r; 18740 18741 /* 18742 * Check if the receiver has shrunk the window. If 18743 * tcp_wput_data() with NULL mp is called, tcp_fin_sent 18744 * cannot be set as there is unsent data, so FIN cannot 18745 * be sent out. Otherwise, we need to take into account 18746 * of FIN as it consumes an "invisible" sequence number. 18747 */ 18748 ASSERT(tcp->tcp_fin_sent == 0); 18749 if (usable_r < 0) { 18750 /* 18751 * The receiver has shrunk the window and we have sent 18752 * -usable_r date beyond the window, re-adjust. 18753 * 18754 * If TCP window scaling is enabled, there can be 18755 * round down error as the advertised receive window 18756 * is actually right shifted n bits. This means that 18757 * the lower n bits info is wiped out. It will look 18758 * like the window is shrunk. Do a check here to 18759 * see if the shrunk amount is actually within the 18760 * error in window calculation. If it is, just 18761 * return. Note that this check is inside the 18762 * shrunk window check. This makes sure that even 18763 * though tcp_process_shrunk_swnd() is not called, 18764 * we will stop further processing. 18765 */ 18766 if ((-usable_r >> tcp->tcp_snd_ws) > 0) { 18767 tcp_process_shrunk_swnd(tcp, -usable_r); 18768 } 18769 return; 18770 } 18771 18772 /* usable = MIN(swnd, cwnd) - unacked_bytes */ 18773 if (tcp->tcp_swnd > tcp->tcp_cwnd) 18774 usable_r -= tcp->tcp_swnd - tcp->tcp_cwnd; 18775 18776 /* usable = MIN(usable, unsent) */ 18777 if (usable_r > len) 18778 usable_r = len; 18779 18780 /* usable = MAX(usable, {1 for urgent, 0 for data}) */ 18781 if (usable_r > 0) { 18782 usable = usable_r; 18783 } else { 18784 /* Bypass all other unnecessary processing. */ 18785 goto done; 18786 } 18787 } 18788 18789 local_time = (mblk_t *)lbolt; 18790 18791 /* 18792 * "Our" Nagle Algorithm. This is not the same as in the old 18793 * BSD. This is more in line with the true intent of Nagle. 18794 * 18795 * The conditions are: 18796 * 1. The amount of unsent data (or amount of data which can be 18797 * sent, whichever is smaller) is less than Nagle limit. 18798 * 2. The last sent size is also less than Nagle limit. 18799 * 3. There is unack'ed data. 18800 * 4. Urgent pointer is not set. Send urgent data ignoring the 18801 * Nagle algorithm. This reduces the probability that urgent 18802 * bytes get "merged" together. 18803 * 5. The app has not closed the connection. This eliminates the 18804 * wait time of the receiving side waiting for the last piece of 18805 * (small) data. 18806 * 18807 * If all are satisified, exit without sending anything. Note 18808 * that Nagle limit can be smaller than 1 MSS. Nagle limit is 18809 * the smaller of 1 MSS and global tcp_naglim_def (default to be 18810 * 4095). 18811 */ 18812 if (usable < (int)tcp->tcp_naglim && 18813 tcp->tcp_naglim > tcp->tcp_last_sent_len && 18814 snxt != tcp->tcp_suna && 18815 !(tcp->tcp_valid_bits & TCP_URG_VALID) && 18816 !(tcp->tcp_valid_bits & TCP_FSS_VALID)) { 18817 goto done; 18818 } 18819 18820 if (tcp->tcp_cork) { 18821 /* 18822 * if the tcp->tcp_cork option is set, then we have to force 18823 * TCP not to send partial segment (smaller than MSS bytes). 18824 * We are calculating the usable now based on full mss and 18825 * will save the rest of remaining data for later. 18826 */ 18827 if (usable < mss) 18828 goto done; 18829 usable = (usable / mss) * mss; 18830 } 18831 18832 /* Update the latest receive window size in TCP header. */ 18833 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 18834 tcp->tcp_tcph->th_win); 18835 18836 /* 18837 * Determine if it's worthwhile to attempt MDT, based on: 18838 * 18839 * 1. Simple TCP/IP{v4,v6} (no options). 18840 * 2. IPSEC/IPQoS processing is not needed for the TCP connection. 18841 * 3. If the TCP connection is in ESTABLISHED state. 18842 * 4. The TCP is not detached. 18843 * 18844 * If any of the above conditions have changed during the 18845 * connection, stop using MDT and restore the stream head 18846 * parameters accordingly. 18847 */ 18848 if (tcp->tcp_mdt && 18849 ((tcp->tcp_ipversion == IPV4_VERSION && 18850 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 18851 (tcp->tcp_ipversion == IPV6_VERSION && 18852 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN) || 18853 tcp->tcp_state != TCPS_ESTABLISHED || 18854 TCP_IS_DETACHED(tcp) || !CONN_IS_MD_FASTPATH(tcp->tcp_connp) || 18855 CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp) || 18856 IPP_ENABLED(IPP_LOCAL_OUT))) { 18857 tcp->tcp_connp->conn_mdt_ok = B_FALSE; 18858 tcp->tcp_mdt = B_FALSE; 18859 18860 /* Anything other than detached is considered pathological */ 18861 if (!TCP_IS_DETACHED(tcp)) { 18862 TCP_STAT(tcp_mdt_conn_halted1); 18863 (void) tcp_maxpsz_set(tcp, B_TRUE); 18864 } 18865 } 18866 18867 /* Use MDT if sendable amount is greater than the threshold */ 18868 if (tcp->tcp_mdt && 18869 (mdt_thres = mss << tcp_mdt_smss_threshold, usable > mdt_thres) && 18870 (tail_unsent > mdt_thres || (xmit_tail->b_cont != NULL && 18871 MBLKL(xmit_tail->b_cont) > mdt_thres)) && 18872 (tcp->tcp_valid_bits == 0 || 18873 tcp->tcp_valid_bits == TCP_FSS_VALID)) { 18874 ASSERT(tcp->tcp_connp->conn_mdt_ok); 18875 rc = tcp_multisend(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 18876 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 18877 local_time, mdt_thres); 18878 } else { 18879 rc = tcp_send(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 18880 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 18881 local_time, INT_MAX); 18882 } 18883 18884 /* Pretend that all we were trying to send really got sent */ 18885 if (rc < 0 && tail_unsent < 0) { 18886 do { 18887 xmit_tail = xmit_tail->b_cont; 18888 xmit_tail->b_prev = local_time; 18889 ASSERT((uintptr_t)(xmit_tail->b_wptr - 18890 xmit_tail->b_rptr) <= (uintptr_t)INT_MAX); 18891 tail_unsent += (int)(xmit_tail->b_wptr - 18892 xmit_tail->b_rptr); 18893 } while (tail_unsent < 0); 18894 } 18895 done:; 18896 tcp->tcp_xmit_tail = xmit_tail; 18897 tcp->tcp_xmit_tail_unsent = tail_unsent; 18898 len = tcp->tcp_snxt - snxt; 18899 if (len) { 18900 /* 18901 * If new data was sent, need to update the notsack 18902 * list, which is, afterall, data blocks that have 18903 * not been sack'ed by the receiver. New data is 18904 * not sack'ed. 18905 */ 18906 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 18907 /* len is a negative value. */ 18908 tcp->tcp_pipe -= len; 18909 tcp_notsack_update(&(tcp->tcp_notsack_list), 18910 tcp->tcp_snxt, snxt, 18911 &(tcp->tcp_num_notsack_blk), 18912 &(tcp->tcp_cnt_notsack_list)); 18913 } 18914 tcp->tcp_snxt = snxt + tcp->tcp_fin_sent; 18915 tcp->tcp_rack = tcp->tcp_rnxt; 18916 tcp->tcp_rack_cnt = 0; 18917 if ((snxt + len) == tcp->tcp_suna) { 18918 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 18919 } 18920 } else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) { 18921 /* 18922 * Didn't send anything. Make sure the timer is running 18923 * so that we will probe a zero window. 18924 */ 18925 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 18926 } 18927 /* Note that len is the amount we just sent but with a negative sign */ 18928 tcp->tcp_unsent += len; 18929 if (tcp->tcp_flow_stopped) { 18930 if (TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) { 18931 tcp_clrqfull(tcp); 18932 } 18933 } else if (TCP_UNSENT_BYTES(tcp) >= tcp->tcp_xmit_hiwater) { 18934 tcp_setqfull(tcp); 18935 } 18936 } 18937 18938 /* 18939 * tcp_fill_header is called by tcp_send() and tcp_multisend() to fill the 18940 * outgoing TCP header with the template header, as well as other 18941 * options such as time-stamp, ECN and/or SACK. 18942 */ 18943 static void 18944 tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk) 18945 { 18946 tcph_t *tcp_tmpl, *tcp_h; 18947 uint32_t *dst, *src; 18948 int hdrlen; 18949 18950 ASSERT(OK_32PTR(rptr)); 18951 18952 /* Template header */ 18953 tcp_tmpl = tcp->tcp_tcph; 18954 18955 /* Header of outgoing packet */ 18956 tcp_h = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 18957 18958 /* dst and src are opaque 32-bit fields, used for copying */ 18959 dst = (uint32_t *)rptr; 18960 src = (uint32_t *)tcp->tcp_iphc; 18961 hdrlen = tcp->tcp_hdr_len; 18962 18963 /* Fill time-stamp option if needed */ 18964 if (tcp->tcp_snd_ts_ok) { 18965 U32_TO_BE32((uint32_t)now, 18966 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 4); 18967 U32_TO_BE32(tcp->tcp_ts_recent, 18968 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 8); 18969 } else { 18970 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 18971 } 18972 18973 /* 18974 * Copy the template header; is this really more efficient than 18975 * calling bcopy()? For simple IPv4/TCP, it may be the case, 18976 * but perhaps not for other scenarios. 18977 */ 18978 dst[0] = src[0]; 18979 dst[1] = src[1]; 18980 dst[2] = src[2]; 18981 dst[3] = src[3]; 18982 dst[4] = src[4]; 18983 dst[5] = src[5]; 18984 dst[6] = src[6]; 18985 dst[7] = src[7]; 18986 dst[8] = src[8]; 18987 dst[9] = src[9]; 18988 if (hdrlen -= 40) { 18989 hdrlen >>= 2; 18990 dst += 10; 18991 src += 10; 18992 do { 18993 *dst++ = *src++; 18994 } while (--hdrlen); 18995 } 18996 18997 /* 18998 * Set the ECN info in the TCP header if it is not a zero 18999 * window probe. Zero window probe is only sent in 19000 * tcp_wput_data() and tcp_timer(). 19001 */ 19002 if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) { 19003 SET_ECT(tcp, rptr); 19004 19005 if (tcp->tcp_ecn_echo_on) 19006 tcp_h->th_flags[0] |= TH_ECE; 19007 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 19008 tcp_h->th_flags[0] |= TH_CWR; 19009 tcp->tcp_ecn_cwr_sent = B_TRUE; 19010 } 19011 } 19012 19013 /* Fill in SACK options */ 19014 if (num_sack_blk > 0) { 19015 uchar_t *wptr = rptr + tcp->tcp_hdr_len; 19016 sack_blk_t *tmp; 19017 int32_t i; 19018 19019 wptr[0] = TCPOPT_NOP; 19020 wptr[1] = TCPOPT_NOP; 19021 wptr[2] = TCPOPT_SACK; 19022 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 19023 sizeof (sack_blk_t); 19024 wptr += TCPOPT_REAL_SACK_LEN; 19025 19026 tmp = tcp->tcp_sack_list; 19027 for (i = 0; i < num_sack_blk; i++) { 19028 U32_TO_BE32(tmp[i].begin, wptr); 19029 wptr += sizeof (tcp_seq); 19030 U32_TO_BE32(tmp[i].end, wptr); 19031 wptr += sizeof (tcp_seq); 19032 } 19033 tcp_h->th_offset_and_rsrvd[0] += 19034 ((num_sack_blk * 2 + 1) << 4); 19035 } 19036 } 19037 19038 /* 19039 * tcp_mdt_add_attrs() is called by tcp_multisend() in order to attach 19040 * the destination address and SAP attribute, and if necessary, the 19041 * hardware checksum offload attribute to a Multidata message. 19042 */ 19043 static int 19044 tcp_mdt_add_attrs(multidata_t *mmd, const mblk_t *dlmp, const boolean_t hwcksum, 19045 const uint32_t start, const uint32_t stuff, const uint32_t end, 19046 const uint32_t flags) 19047 { 19048 /* Add global destination address & SAP attribute */ 19049 if (dlmp == NULL || !ip_md_addr_attr(mmd, NULL, dlmp)) { 19050 ip1dbg(("tcp_mdt_add_attrs: can't add global physical " 19051 "destination address+SAP\n")); 19052 19053 if (dlmp != NULL) 19054 TCP_STAT(tcp_mdt_allocfail); 19055 return (-1); 19056 } 19057 19058 /* Add global hwcksum attribute */ 19059 if (hwcksum && 19060 !ip_md_hcksum_attr(mmd, NULL, start, stuff, end, flags)) { 19061 ip1dbg(("tcp_mdt_add_attrs: can't add global hardware " 19062 "checksum attribute\n")); 19063 19064 TCP_STAT(tcp_mdt_allocfail); 19065 return (-1); 19066 } 19067 19068 return (0); 19069 } 19070 19071 /* 19072 * Smaller and private version of pdescinfo_t used specifically for TCP, 19073 * which allows for only two payload spans per packet. 19074 */ 19075 typedef struct tcp_pdescinfo_s PDESCINFO_STRUCT(2) tcp_pdescinfo_t; 19076 19077 /* 19078 * tcp_multisend() is called by tcp_wput_data() for Multidata Transmit 19079 * scheme, and returns one the following: 19080 * 19081 * -1 = failed allocation. 19082 * 0 = success; burst count reached, or usable send window is too small, 19083 * and that we'd rather wait until later before sending again. 19084 */ 19085 static int 19086 tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 19087 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 19088 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 19089 const int mdt_thres) 19090 { 19091 mblk_t *md_mp_head, *md_mp, *md_pbuf, *md_pbuf_nxt, *md_hbuf; 19092 multidata_t *mmd; 19093 uint_t obsegs, obbytes, hdr_frag_sz; 19094 uint_t cur_hdr_off, cur_pld_off, base_pld_off, first_snxt; 19095 int num_burst_seg, max_pld; 19096 pdesc_t *pkt; 19097 tcp_pdescinfo_t tcp_pkt_info; 19098 pdescinfo_t *pkt_info; 19099 int pbuf_idx, pbuf_idx_nxt; 19100 int seg_len, len, spill, af; 19101 boolean_t add_buffer, zcopy, clusterwide; 19102 boolean_t rconfirm = B_FALSE; 19103 boolean_t done = B_FALSE; 19104 uint32_t cksum; 19105 uint32_t hwcksum_flags; 19106 ire_t *ire; 19107 ill_t *ill; 19108 ipha_t *ipha; 19109 ip6_t *ip6h; 19110 ipaddr_t src, dst; 19111 ill_zerocopy_capab_t *zc_cap = NULL; 19112 uint16_t *up; 19113 int err; 19114 conn_t *connp; 19115 19116 #ifdef _BIG_ENDIAN 19117 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 28) & 0x7) 19118 #else 19119 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 4) & 0x7) 19120 #endif 19121 19122 #define PREP_NEW_MULTIDATA() { \ 19123 mmd = NULL; \ 19124 md_mp = md_hbuf = NULL; \ 19125 cur_hdr_off = 0; \ 19126 max_pld = tcp->tcp_mdt_max_pld; \ 19127 pbuf_idx = pbuf_idx_nxt = -1; \ 19128 add_buffer = B_TRUE; \ 19129 zcopy = B_FALSE; \ 19130 } 19131 19132 #define PREP_NEW_PBUF() { \ 19133 md_pbuf = md_pbuf_nxt = NULL; \ 19134 pbuf_idx = pbuf_idx_nxt = -1; \ 19135 cur_pld_off = 0; \ 19136 first_snxt = *snxt; \ 19137 ASSERT(*tail_unsent > 0); \ 19138 base_pld_off = MBLKL(*xmit_tail) - *tail_unsent; \ 19139 } 19140 19141 ASSERT(mdt_thres >= mss); 19142 ASSERT(*usable > 0 && *usable > mdt_thres); 19143 ASSERT(tcp->tcp_state == TCPS_ESTABLISHED); 19144 ASSERT(!TCP_IS_DETACHED(tcp)); 19145 ASSERT(tcp->tcp_valid_bits == 0 || 19146 tcp->tcp_valid_bits == TCP_FSS_VALID); 19147 ASSERT((tcp->tcp_ipversion == IPV4_VERSION && 19148 tcp->tcp_ip_hdr_len == IP_SIMPLE_HDR_LENGTH) || 19149 (tcp->tcp_ipversion == IPV6_VERSION && 19150 tcp->tcp_ip_hdr_len == IPV6_HDR_LEN)); 19151 19152 connp = tcp->tcp_connp; 19153 ASSERT(connp != NULL); 19154 ASSERT(CONN_IS_MD_FASTPATH(connp)); 19155 ASSERT(!CONN_IPSEC_OUT_ENCAPSULATED(connp)); 19156 19157 /* 19158 * Note that tcp will only declare at most 2 payload spans per 19159 * packet, which is much lower than the maximum allowable number 19160 * of packet spans per Multidata. For this reason, we use the 19161 * privately declared and smaller descriptor info structure, in 19162 * order to save some stack space. 19163 */ 19164 pkt_info = (pdescinfo_t *)&tcp_pkt_info; 19165 19166 af = (tcp->tcp_ipversion == IPV4_VERSION) ? AF_INET : AF_INET6; 19167 if (af == AF_INET) { 19168 dst = tcp->tcp_ipha->ipha_dst; 19169 src = tcp->tcp_ipha->ipha_src; 19170 ASSERT(!CLASSD(dst)); 19171 } 19172 ASSERT(af == AF_INET || 19173 !IN6_IS_ADDR_MULTICAST(&tcp->tcp_ip6h->ip6_dst)); 19174 19175 obsegs = obbytes = 0; 19176 num_burst_seg = tcp->tcp_snd_burst; 19177 md_mp_head = NULL; 19178 PREP_NEW_MULTIDATA(); 19179 19180 /* 19181 * Before we go on further, make sure there is an IRE that we can 19182 * use, and that the ILL supports MDT. Otherwise, there's no point 19183 * in proceeding any further, and we should just hand everything 19184 * off to the legacy path. 19185 */ 19186 mutex_enter(&connp->conn_lock); 19187 ire = connp->conn_ire_cache; 19188 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 19189 if (ire != NULL && ((af == AF_INET && ire->ire_addr == dst) || 19190 (af == AF_INET6 && IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, 19191 &tcp->tcp_ip6h->ip6_dst))) && 19192 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19193 IRE_REFHOLD(ire); 19194 mutex_exit(&connp->conn_lock); 19195 } else { 19196 boolean_t cached = B_FALSE; 19197 ts_label_t *tsl; 19198 19199 /* force a recheck later on */ 19200 tcp->tcp_ire_ill_check_done = B_FALSE; 19201 19202 TCP_DBGSTAT(tcp_ire_null1); 19203 connp->conn_ire_cache = NULL; 19204 mutex_exit(&connp->conn_lock); 19205 19206 /* Release the old ire */ 19207 if (ire != NULL) 19208 IRE_REFRELE_NOTR(ire); 19209 19210 tsl = crgetlabel(CONN_CRED(connp)); 19211 ire = (af == AF_INET) ? 19212 ire_cache_lookup(dst, connp->conn_zoneid, tsl) : 19213 ire_cache_lookup_v6(&tcp->tcp_ip6h->ip6_dst, 19214 connp->conn_zoneid, tsl); 19215 19216 if (ire == NULL) { 19217 TCP_STAT(tcp_ire_null); 19218 goto legacy_send_no_md; 19219 } 19220 19221 IRE_REFHOLD_NOTR(ire); 19222 /* 19223 * Since we are inside the squeue, there cannot be another 19224 * thread in TCP trying to set the conn_ire_cache now. The 19225 * check for IRE_MARK_CONDEMNED ensures that an interface 19226 * unplumb thread has not yet started cleaning up the conns. 19227 * Hence we don't need to grab the conn lock. 19228 */ 19229 if (!(connp->conn_state_flags & CONN_CLOSING)) { 19230 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 19231 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19232 connp->conn_ire_cache = ire; 19233 cached = B_TRUE; 19234 } 19235 rw_exit(&ire->ire_bucket->irb_lock); 19236 } 19237 19238 /* 19239 * We can continue to use the ire but since it was not 19240 * cached, we should drop the extra reference. 19241 */ 19242 if (!cached) 19243 IRE_REFRELE_NOTR(ire); 19244 } 19245 19246 ASSERT(ire != NULL); 19247 ASSERT(af != AF_INET || ire->ire_ipversion == IPV4_VERSION); 19248 ASSERT(af == AF_INET || !IN6_IS_ADDR_V4MAPPED(&(ire->ire_addr_v6))); 19249 ASSERT(af == AF_INET || ire->ire_nce != NULL); 19250 ASSERT(!(ire->ire_type & IRE_BROADCAST)); 19251 /* 19252 * If we do support loopback for MDT (which requires modifications 19253 * to the receiving paths), the following assertions should go away, 19254 * and we would be sending the Multidata to loopback conn later on. 19255 */ 19256 ASSERT(!IRE_IS_LOCAL(ire)); 19257 ASSERT(ire->ire_stq != NULL); 19258 19259 ill = ire_to_ill(ire); 19260 ASSERT(ill != NULL); 19261 ASSERT(!ILL_MDT_CAPABLE(ill) || ill->ill_mdt_capab != NULL); 19262 19263 if (!tcp->tcp_ire_ill_check_done) { 19264 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 19265 tcp->tcp_ire_ill_check_done = B_TRUE; 19266 } 19267 19268 /* 19269 * If the underlying interface conditions have changed, or if the 19270 * new interface does not support MDT, go back to legacy path. 19271 */ 19272 if (!ILL_MDT_USABLE(ill) || (ire->ire_flags & RTF_MULTIRT) != 0) { 19273 /* don't go through this path anymore for this connection */ 19274 TCP_STAT(tcp_mdt_conn_halted2); 19275 tcp->tcp_mdt = B_FALSE; 19276 ip1dbg(("tcp_multisend: disabling MDT for connp %p on " 19277 "interface %s\n", (void *)connp, ill->ill_name)); 19278 /* IRE will be released prior to returning */ 19279 goto legacy_send_no_md; 19280 } 19281 19282 if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) 19283 zc_cap = ill->ill_zerocopy_capab; 19284 19285 /* 19286 * Check if we can take tcp fast-path. Note that "incomplete" 19287 * ire's (where the link-layer for next hop is not resolved 19288 * or where the fast-path header in nce_fp_mp is not available 19289 * yet) are sent down the legacy (slow) path. 19290 * NOTE: We should fix ip_xmit_v4 to handle M_MULTIDATA 19291 */ 19292 if (ire->ire_nce && ire->ire_nce->nce_state != ND_REACHABLE) { 19293 /* IRE will be released prior to returning */ 19294 goto legacy_send_no_md; 19295 } 19296 19297 /* go to legacy path if interface doesn't support zerocopy */ 19298 if (tcp->tcp_snd_zcopy_aware && do_tcpzcopy != 2 && 19299 (zc_cap == NULL || zc_cap->ill_zerocopy_flags == 0)) { 19300 /* IRE will be released prior to returning */ 19301 goto legacy_send_no_md; 19302 } 19303 19304 /* does the interface support hardware checksum offload? */ 19305 hwcksum_flags = 0; 19306 if (ILL_HCKSUM_CAPABLE(ill) && 19307 (ill->ill_hcksum_capab->ill_hcksum_txflags & 19308 (HCKSUM_INET_FULL_V4 | HCKSUM_INET_FULL_V6 | HCKSUM_INET_PARTIAL | 19309 HCKSUM_IPHDRCKSUM)) && dohwcksum) { 19310 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19311 HCKSUM_IPHDRCKSUM) 19312 hwcksum_flags = HCK_IPV4_HDRCKSUM; 19313 19314 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19315 (HCKSUM_INET_FULL_V4 | HCKSUM_INET_FULL_V6)) 19316 hwcksum_flags |= HCK_FULLCKSUM; 19317 else if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19318 HCKSUM_INET_PARTIAL) 19319 hwcksum_flags |= HCK_PARTIALCKSUM; 19320 } 19321 19322 /* 19323 * Each header fragment consists of the leading extra space, 19324 * followed by the TCP/IP header, and the trailing extra space. 19325 * We make sure that each header fragment begins on a 32-bit 19326 * aligned memory address (tcp_mdt_hdr_head is already 32-bit 19327 * aligned in tcp_mdt_update). 19328 */ 19329 hdr_frag_sz = roundup((tcp->tcp_mdt_hdr_head + tcp_hdr_len + 19330 tcp->tcp_mdt_hdr_tail), 4); 19331 19332 /* are we starting from the beginning of data block? */ 19333 if (*tail_unsent == 0) { 19334 *xmit_tail = (*xmit_tail)->b_cont; 19335 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= (uintptr_t)INT_MAX); 19336 *tail_unsent = (int)MBLKL(*xmit_tail); 19337 } 19338 19339 /* 19340 * Here we create one or more Multidata messages, each made up of 19341 * one header buffer and up to N payload buffers. This entire 19342 * operation is done within two loops: 19343 * 19344 * The outer loop mostly deals with creating the Multidata message, 19345 * as well as the header buffer that gets added to it. It also 19346 * links the Multidata messages together such that all of them can 19347 * be sent down to the lower layer in a single putnext call; this 19348 * linking behavior depends on the tcp_mdt_chain tunable. 19349 * 19350 * The inner loop takes an existing Multidata message, and adds 19351 * one or more (up to tcp_mdt_max_pld) payload buffers to it. It 19352 * packetizes those buffers by filling up the corresponding header 19353 * buffer fragments with the proper IP and TCP headers, and by 19354 * describing the layout of each packet in the packet descriptors 19355 * that get added to the Multidata. 19356 */ 19357 do { 19358 /* 19359 * If usable send window is too small, or data blocks in 19360 * transmit list are smaller than our threshold (i.e. app 19361 * performs large writes followed by small ones), we hand 19362 * off the control over to the legacy path. Note that we'll 19363 * get back the control once it encounters a large block. 19364 */ 19365 if (*usable < mss || (*tail_unsent <= mdt_thres && 19366 (*xmit_tail)->b_cont != NULL && 19367 MBLKL((*xmit_tail)->b_cont) <= mdt_thres)) { 19368 /* send down what we've got so far */ 19369 if (md_mp_head != NULL) { 19370 tcp_multisend_data(tcp, ire, ill, md_mp_head, 19371 obsegs, obbytes, &rconfirm); 19372 } 19373 /* 19374 * Pass control over to tcp_send(), but tell it to 19375 * return to us once a large-size transmission is 19376 * possible. 19377 */ 19378 TCP_STAT(tcp_mdt_legacy_small); 19379 if ((err = tcp_send(q, tcp, mss, tcp_hdr_len, 19380 tcp_tcp_hdr_len, num_sack_blk, usable, snxt, 19381 tail_unsent, xmit_tail, local_time, 19382 mdt_thres)) <= 0) { 19383 /* burst count reached, or alloc failed */ 19384 IRE_REFRELE(ire); 19385 return (err); 19386 } 19387 19388 /* tcp_send() may have sent everything, so check */ 19389 if (*usable <= 0) { 19390 IRE_REFRELE(ire); 19391 return (0); 19392 } 19393 19394 TCP_STAT(tcp_mdt_legacy_ret); 19395 /* 19396 * We may have delivered the Multidata, so make sure 19397 * to re-initialize before the next round. 19398 */ 19399 md_mp_head = NULL; 19400 obsegs = obbytes = 0; 19401 num_burst_seg = tcp->tcp_snd_burst; 19402 PREP_NEW_MULTIDATA(); 19403 19404 /* are we starting from the beginning of data block? */ 19405 if (*tail_unsent == 0) { 19406 *xmit_tail = (*xmit_tail)->b_cont; 19407 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 19408 (uintptr_t)INT_MAX); 19409 *tail_unsent = (int)MBLKL(*xmit_tail); 19410 } 19411 } 19412 19413 /* 19414 * max_pld limits the number of mblks in tcp's transmit 19415 * queue that can be added to a Multidata message. Once 19416 * this counter reaches zero, no more additional mblks 19417 * can be added to it. What happens afterwards depends 19418 * on whether or not we are set to chain the Multidata 19419 * messages. If we are to link them together, reset 19420 * max_pld to its original value (tcp_mdt_max_pld) and 19421 * prepare to create a new Multidata message which will 19422 * get linked to md_mp_head. Else, leave it alone and 19423 * let the inner loop break on its own. 19424 */ 19425 if (tcp_mdt_chain && max_pld == 0) 19426 PREP_NEW_MULTIDATA(); 19427 19428 /* adding a payload buffer; re-initialize values */ 19429 if (add_buffer) 19430 PREP_NEW_PBUF(); 19431 19432 /* 19433 * If we don't have a Multidata, either because we just 19434 * (re)entered this outer loop, or after we branched off 19435 * to tcp_send above, setup the Multidata and header 19436 * buffer to be used. 19437 */ 19438 if (md_mp == NULL) { 19439 int md_hbuflen; 19440 uint32_t start, stuff; 19441 19442 /* 19443 * Calculate Multidata header buffer size large enough 19444 * to hold all of the headers that can possibly be 19445 * sent at this moment. We'd rather over-estimate 19446 * the size than running out of space; this is okay 19447 * since this buffer is small anyway. 19448 */ 19449 md_hbuflen = (howmany(*usable, mss) + 1) * hdr_frag_sz; 19450 19451 /* 19452 * Start and stuff offset for partial hardware 19453 * checksum offload; these are currently for IPv4. 19454 * For full checksum offload, they are set to zero. 19455 */ 19456 if ((hwcksum_flags & HCK_PARTIALCKSUM)) { 19457 if (af == AF_INET) { 19458 start = IP_SIMPLE_HDR_LENGTH; 19459 stuff = IP_SIMPLE_HDR_LENGTH + 19460 TCP_CHECKSUM_OFFSET; 19461 } else { 19462 start = IPV6_HDR_LEN; 19463 stuff = IPV6_HDR_LEN + 19464 TCP_CHECKSUM_OFFSET; 19465 } 19466 } else { 19467 start = stuff = 0; 19468 } 19469 19470 /* 19471 * Create the header buffer, Multidata, as well as 19472 * any necessary attributes (destination address, 19473 * SAP and hardware checksum offload) that should 19474 * be associated with the Multidata message. 19475 */ 19476 ASSERT(cur_hdr_off == 0); 19477 if ((md_hbuf = allocb(md_hbuflen, BPRI_HI)) == NULL || 19478 ((md_hbuf->b_wptr += md_hbuflen), 19479 (mmd = mmd_alloc(md_hbuf, &md_mp, 19480 KM_NOSLEEP)) == NULL) || (tcp_mdt_add_attrs(mmd, 19481 /* fastpath mblk */ 19482 ire->ire_nce->nce_res_mp, 19483 /* hardware checksum enabled */ 19484 (hwcksum_flags & (HCK_FULLCKSUM|HCK_PARTIALCKSUM)), 19485 /* hardware checksum offsets */ 19486 start, stuff, 0, 19487 /* hardware checksum flag */ 19488 hwcksum_flags) != 0)) { 19489 legacy_send: 19490 if (md_mp != NULL) { 19491 /* Unlink message from the chain */ 19492 if (md_mp_head != NULL) { 19493 err = (intptr_t)rmvb(md_mp_head, 19494 md_mp); 19495 /* 19496 * We can't assert that rmvb 19497 * did not return -1, since we 19498 * may get here before linkb 19499 * happens. We do, however, 19500 * check if we just removed the 19501 * only element in the list. 19502 */ 19503 if (err == 0) 19504 md_mp_head = NULL; 19505 } 19506 /* md_hbuf gets freed automatically */ 19507 TCP_STAT(tcp_mdt_discarded); 19508 freeb(md_mp); 19509 } else { 19510 /* Either allocb or mmd_alloc failed */ 19511 TCP_STAT(tcp_mdt_allocfail); 19512 if (md_hbuf != NULL) 19513 freeb(md_hbuf); 19514 } 19515 19516 /* send down what we've got so far */ 19517 if (md_mp_head != NULL) { 19518 tcp_multisend_data(tcp, ire, ill, 19519 md_mp_head, obsegs, obbytes, 19520 &rconfirm); 19521 } 19522 legacy_send_no_md: 19523 if (ire != NULL) 19524 IRE_REFRELE(ire); 19525 /* 19526 * Too bad; let the legacy path handle this. 19527 * We specify INT_MAX for the threshold, since 19528 * we gave up with the Multidata processings 19529 * and let the old path have it all. 19530 */ 19531 TCP_STAT(tcp_mdt_legacy_all); 19532 return (tcp_send(q, tcp, mss, tcp_hdr_len, 19533 tcp_tcp_hdr_len, num_sack_blk, usable, 19534 snxt, tail_unsent, xmit_tail, local_time, 19535 INT_MAX)); 19536 } 19537 19538 /* link to any existing ones, if applicable */ 19539 TCP_STAT(tcp_mdt_allocd); 19540 if (md_mp_head == NULL) { 19541 md_mp_head = md_mp; 19542 } else if (tcp_mdt_chain) { 19543 TCP_STAT(tcp_mdt_linked); 19544 linkb(md_mp_head, md_mp); 19545 } 19546 } 19547 19548 ASSERT(md_mp_head != NULL); 19549 ASSERT(tcp_mdt_chain || md_mp_head->b_cont == NULL); 19550 ASSERT(md_mp != NULL && mmd != NULL); 19551 ASSERT(md_hbuf != NULL); 19552 19553 /* 19554 * Packetize the transmittable portion of the data block; 19555 * each data block is essentially added to the Multidata 19556 * as a payload buffer. We also deal with adding more 19557 * than one payload buffers, which happens when the remaining 19558 * packetized portion of the current payload buffer is less 19559 * than MSS, while the next data block in transmit queue 19560 * has enough data to make up for one. This "spillover" 19561 * case essentially creates a split-packet, where portions 19562 * of the packet's payload fragments may span across two 19563 * virtually discontiguous address blocks. 19564 */ 19565 seg_len = mss; 19566 do { 19567 len = seg_len; 19568 19569 ASSERT(len > 0); 19570 ASSERT(max_pld >= 0); 19571 ASSERT(!add_buffer || cur_pld_off == 0); 19572 19573 /* 19574 * First time around for this payload buffer; note 19575 * in the case of a spillover, the following has 19576 * been done prior to adding the split-packet 19577 * descriptor to Multidata, and we don't want to 19578 * repeat the process. 19579 */ 19580 if (add_buffer) { 19581 ASSERT(mmd != NULL); 19582 ASSERT(md_pbuf == NULL); 19583 ASSERT(md_pbuf_nxt == NULL); 19584 ASSERT(pbuf_idx == -1 && pbuf_idx_nxt == -1); 19585 19586 /* 19587 * Have we reached the limit? We'd get to 19588 * this case when we're not chaining the 19589 * Multidata messages together, and since 19590 * we're done, terminate this loop. 19591 */ 19592 if (max_pld == 0) 19593 break; /* done */ 19594 19595 if ((md_pbuf = dupb(*xmit_tail)) == NULL) { 19596 TCP_STAT(tcp_mdt_allocfail); 19597 goto legacy_send; /* out_of_mem */ 19598 } 19599 19600 if (IS_VMLOANED_MBLK(md_pbuf) && !zcopy && 19601 zc_cap != NULL) { 19602 if (!ip_md_zcopy_attr(mmd, NULL, 19603 zc_cap->ill_zerocopy_flags)) { 19604 freeb(md_pbuf); 19605 TCP_STAT(tcp_mdt_allocfail); 19606 /* out_of_mem */ 19607 goto legacy_send; 19608 } 19609 zcopy = B_TRUE; 19610 } 19611 19612 md_pbuf->b_rptr += base_pld_off; 19613 19614 /* 19615 * Add a payload buffer to the Multidata; this 19616 * operation must not fail, or otherwise our 19617 * logic in this routine is broken. There 19618 * is no memory allocation done by the 19619 * routine, so any returned failure simply 19620 * tells us that we've done something wrong. 19621 * 19622 * A failure tells us that either we're adding 19623 * the same payload buffer more than once, or 19624 * we're trying to add more buffers than 19625 * allowed (max_pld calculation is wrong). 19626 * None of the above cases should happen, and 19627 * we panic because either there's horrible 19628 * heap corruption, and/or programming mistake. 19629 */ 19630 pbuf_idx = mmd_addpldbuf(mmd, md_pbuf); 19631 if (pbuf_idx < 0) { 19632 cmn_err(CE_PANIC, "tcp_multisend: " 19633 "payload buffer logic error " 19634 "detected for tcp %p mmd %p " 19635 "pbuf %p (%d)\n", 19636 (void *)tcp, (void *)mmd, 19637 (void *)md_pbuf, pbuf_idx); 19638 } 19639 19640 ASSERT(max_pld > 0); 19641 --max_pld; 19642 add_buffer = B_FALSE; 19643 } 19644 19645 ASSERT(md_mp_head != NULL); 19646 ASSERT(md_pbuf != NULL); 19647 ASSERT(md_pbuf_nxt == NULL); 19648 ASSERT(pbuf_idx != -1); 19649 ASSERT(pbuf_idx_nxt == -1); 19650 ASSERT(*usable > 0); 19651 19652 /* 19653 * We spillover to the next payload buffer only 19654 * if all of the following is true: 19655 * 19656 * 1. There is not enough data on the current 19657 * payload buffer to make up `len', 19658 * 2. We are allowed to send `len', 19659 * 3. The next payload buffer length is large 19660 * enough to accomodate `spill'. 19661 */ 19662 if ((spill = len - *tail_unsent) > 0 && 19663 *usable >= len && 19664 MBLKL((*xmit_tail)->b_cont) >= spill && 19665 max_pld > 0) { 19666 md_pbuf_nxt = dupb((*xmit_tail)->b_cont); 19667 if (md_pbuf_nxt == NULL) { 19668 TCP_STAT(tcp_mdt_allocfail); 19669 goto legacy_send; /* out_of_mem */ 19670 } 19671 19672 if (IS_VMLOANED_MBLK(md_pbuf_nxt) && !zcopy && 19673 zc_cap != NULL) { 19674 if (!ip_md_zcopy_attr(mmd, NULL, 19675 zc_cap->ill_zerocopy_flags)) { 19676 freeb(md_pbuf_nxt); 19677 TCP_STAT(tcp_mdt_allocfail); 19678 /* out_of_mem */ 19679 goto legacy_send; 19680 } 19681 zcopy = B_TRUE; 19682 } 19683 19684 /* 19685 * See comments above on the first call to 19686 * mmd_addpldbuf for explanation on the panic. 19687 */ 19688 pbuf_idx_nxt = mmd_addpldbuf(mmd, md_pbuf_nxt); 19689 if (pbuf_idx_nxt < 0) { 19690 panic("tcp_multisend: " 19691 "next payload buffer logic error " 19692 "detected for tcp %p mmd %p " 19693 "pbuf %p (%d)\n", 19694 (void *)tcp, (void *)mmd, 19695 (void *)md_pbuf_nxt, pbuf_idx_nxt); 19696 } 19697 19698 ASSERT(max_pld > 0); 19699 --max_pld; 19700 } else if (spill > 0) { 19701 /* 19702 * If there's a spillover, but the following 19703 * xmit_tail couldn't give us enough octets 19704 * to reach "len", then stop the current 19705 * Multidata creation and let the legacy 19706 * tcp_send() path take over. We don't want 19707 * to send the tiny segment as part of this 19708 * Multidata for performance reasons; instead, 19709 * we let the legacy path deal with grouping 19710 * it with the subsequent small mblks. 19711 */ 19712 if (*usable >= len && 19713 MBLKL((*xmit_tail)->b_cont) < spill) { 19714 max_pld = 0; 19715 break; /* done */ 19716 } 19717 19718 /* 19719 * We can't spillover, and we are near 19720 * the end of the current payload buffer, 19721 * so send what's left. 19722 */ 19723 ASSERT(*tail_unsent > 0); 19724 len = *tail_unsent; 19725 } 19726 19727 /* tail_unsent is negated if there is a spillover */ 19728 *tail_unsent -= len; 19729 *usable -= len; 19730 ASSERT(*usable >= 0); 19731 19732 if (*usable < mss) 19733 seg_len = *usable; 19734 /* 19735 * Sender SWS avoidance; see comments in tcp_send(); 19736 * everything else is the same, except that we only 19737 * do this here if there is no more data to be sent 19738 * following the current xmit_tail. We don't check 19739 * for 1-byte urgent data because we shouldn't get 19740 * here if TCP_URG_VALID is set. 19741 */ 19742 if (*usable > 0 && *usable < mss && 19743 ((md_pbuf_nxt == NULL && 19744 (*xmit_tail)->b_cont == NULL) || 19745 (md_pbuf_nxt != NULL && 19746 (*xmit_tail)->b_cont->b_cont == NULL)) && 19747 seg_len < (tcp->tcp_max_swnd >> 1) && 19748 (tcp->tcp_unsent - 19749 ((*snxt + len) - tcp->tcp_snxt)) > seg_len && 19750 !tcp->tcp_zero_win_probe) { 19751 if ((*snxt + len) == tcp->tcp_snxt && 19752 (*snxt + len) == tcp->tcp_suna) { 19753 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 19754 } 19755 done = B_TRUE; 19756 } 19757 19758 /* 19759 * Prime pump for IP's checksumming on our behalf; 19760 * include the adjustment for a source route if any. 19761 * Do this only for software/partial hardware checksum 19762 * offload, as this field gets zeroed out later for 19763 * the full hardware checksum offload case. 19764 */ 19765 if (!(hwcksum_flags & HCK_FULLCKSUM)) { 19766 cksum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 19767 cksum = (cksum >> 16) + (cksum & 0xFFFF); 19768 U16_TO_ABE16(cksum, tcp->tcp_tcph->th_sum); 19769 } 19770 19771 U32_TO_ABE32(*snxt, tcp->tcp_tcph->th_seq); 19772 *snxt += len; 19773 19774 tcp->tcp_tcph->th_flags[0] = TH_ACK; 19775 /* 19776 * We set the PUSH bit only if TCP has no more buffered 19777 * data to be transmitted (or if sender SWS avoidance 19778 * takes place), as opposed to setting it for every 19779 * last packet in the burst. 19780 */ 19781 if (done || 19782 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) == 0) 19783 tcp->tcp_tcph->th_flags[0] |= TH_PUSH; 19784 19785 /* 19786 * Set FIN bit if this is our last segment; snxt 19787 * already includes its length, and it will not 19788 * be adjusted after this point. 19789 */ 19790 if (tcp->tcp_valid_bits == TCP_FSS_VALID && 19791 *snxt == tcp->tcp_fss) { 19792 if (!tcp->tcp_fin_acked) { 19793 tcp->tcp_tcph->th_flags[0] |= TH_FIN; 19794 BUMP_MIB(&tcp_mib, tcpOutControl); 19795 } 19796 if (!tcp->tcp_fin_sent) { 19797 tcp->tcp_fin_sent = B_TRUE; 19798 /* 19799 * tcp state must be ESTABLISHED 19800 * in order for us to get here in 19801 * the first place. 19802 */ 19803 tcp->tcp_state = TCPS_FIN_WAIT_1; 19804 19805 /* 19806 * Upon returning from this routine, 19807 * tcp_wput_data() will set tcp_snxt 19808 * to be equal to snxt + tcp_fin_sent. 19809 * This is essentially the same as 19810 * setting it to tcp_fss + 1. 19811 */ 19812 } 19813 } 19814 19815 tcp->tcp_last_sent_len = (ushort_t)len; 19816 19817 len += tcp_hdr_len; 19818 if (tcp->tcp_ipversion == IPV4_VERSION) 19819 tcp->tcp_ipha->ipha_length = htons(len); 19820 else 19821 tcp->tcp_ip6h->ip6_plen = htons(len - 19822 ((char *)&tcp->tcp_ip6h[1] - 19823 tcp->tcp_iphc)); 19824 19825 pkt_info->flags = (PDESC_HBUF_REF | PDESC_PBUF_REF); 19826 19827 /* setup header fragment */ 19828 PDESC_HDR_ADD(pkt_info, 19829 md_hbuf->b_rptr + cur_hdr_off, /* base */ 19830 tcp->tcp_mdt_hdr_head, /* head room */ 19831 tcp_hdr_len, /* len */ 19832 tcp->tcp_mdt_hdr_tail); /* tail room */ 19833 19834 ASSERT(pkt_info->hdr_lim - pkt_info->hdr_base == 19835 hdr_frag_sz); 19836 ASSERT(MBLKIN(md_hbuf, 19837 (pkt_info->hdr_base - md_hbuf->b_rptr), 19838 PDESC_HDRSIZE(pkt_info))); 19839 19840 /* setup first payload fragment */ 19841 PDESC_PLD_INIT(pkt_info); 19842 PDESC_PLD_SPAN_ADD(pkt_info, 19843 pbuf_idx, /* index */ 19844 md_pbuf->b_rptr + cur_pld_off, /* start */ 19845 tcp->tcp_last_sent_len); /* len */ 19846 19847 /* create a split-packet in case of a spillover */ 19848 if (md_pbuf_nxt != NULL) { 19849 ASSERT(spill > 0); 19850 ASSERT(pbuf_idx_nxt > pbuf_idx); 19851 ASSERT(!add_buffer); 19852 19853 md_pbuf = md_pbuf_nxt; 19854 md_pbuf_nxt = NULL; 19855 pbuf_idx = pbuf_idx_nxt; 19856 pbuf_idx_nxt = -1; 19857 cur_pld_off = spill; 19858 19859 /* trim out first payload fragment */ 19860 PDESC_PLD_SPAN_TRIM(pkt_info, 0, spill); 19861 19862 /* setup second payload fragment */ 19863 PDESC_PLD_SPAN_ADD(pkt_info, 19864 pbuf_idx, /* index */ 19865 md_pbuf->b_rptr, /* start */ 19866 spill); /* len */ 19867 19868 if ((*xmit_tail)->b_next == NULL) { 19869 /* 19870 * Store the lbolt used for RTT 19871 * estimation. We can only record one 19872 * timestamp per mblk so we do it when 19873 * we reach the end of the payload 19874 * buffer. Also we only take a new 19875 * timestamp sample when the previous 19876 * timed data from the same mblk has 19877 * been ack'ed. 19878 */ 19879 (*xmit_tail)->b_prev = local_time; 19880 (*xmit_tail)->b_next = 19881 (mblk_t *)(uintptr_t)first_snxt; 19882 } 19883 19884 first_snxt = *snxt - spill; 19885 19886 /* 19887 * Advance xmit_tail; usable could be 0 by 19888 * the time we got here, but we made sure 19889 * above that we would only spillover to 19890 * the next data block if usable includes 19891 * the spilled-over amount prior to the 19892 * subtraction. Therefore, we are sure 19893 * that xmit_tail->b_cont can't be NULL. 19894 */ 19895 ASSERT((*xmit_tail)->b_cont != NULL); 19896 *xmit_tail = (*xmit_tail)->b_cont; 19897 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 19898 (uintptr_t)INT_MAX); 19899 *tail_unsent = (int)MBLKL(*xmit_tail) - spill; 19900 } else { 19901 cur_pld_off += tcp->tcp_last_sent_len; 19902 } 19903 19904 /* 19905 * Fill in the header using the template header, and 19906 * add options such as time-stamp, ECN and/or SACK, 19907 * as needed. 19908 */ 19909 tcp_fill_header(tcp, pkt_info->hdr_rptr, 19910 (clock_t)local_time, num_sack_blk); 19911 19912 /* take care of some IP header businesses */ 19913 if (af == AF_INET) { 19914 ipha = (ipha_t *)pkt_info->hdr_rptr; 19915 19916 ASSERT(OK_32PTR((uchar_t *)ipha)); 19917 ASSERT(PDESC_HDRL(pkt_info) >= 19918 IP_SIMPLE_HDR_LENGTH); 19919 ASSERT(ipha->ipha_version_and_hdr_length == 19920 IP_SIMPLE_HDR_VERSION); 19921 19922 /* 19923 * Assign ident value for current packet; see 19924 * related comments in ip_wput_ire() about the 19925 * contract private interface with clustering 19926 * group. 19927 */ 19928 clusterwide = B_FALSE; 19929 if (cl_inet_ipident != NULL) { 19930 ASSERT(cl_inet_isclusterwide != NULL); 19931 if ((*cl_inet_isclusterwide)(IPPROTO_IP, 19932 AF_INET, 19933 (uint8_t *)(uintptr_t)src)) { 19934 ipha->ipha_ident = 19935 (*cl_inet_ipident) 19936 (IPPROTO_IP, AF_INET, 19937 (uint8_t *)(uintptr_t)src, 19938 (uint8_t *)(uintptr_t)dst); 19939 clusterwide = B_TRUE; 19940 } 19941 } 19942 19943 if (!clusterwide) { 19944 ipha->ipha_ident = (uint16_t) 19945 atomic_add_32_nv( 19946 &ire->ire_ident, 1); 19947 } 19948 #ifndef _BIG_ENDIAN 19949 ipha->ipha_ident = (ipha->ipha_ident << 8) | 19950 (ipha->ipha_ident >> 8); 19951 #endif 19952 } else { 19953 ip6h = (ip6_t *)pkt_info->hdr_rptr; 19954 19955 ASSERT(OK_32PTR((uchar_t *)ip6h)); 19956 ASSERT(IPVER(ip6h) == IPV6_VERSION); 19957 ASSERT(ip6h->ip6_nxt == IPPROTO_TCP); 19958 ASSERT(PDESC_HDRL(pkt_info) >= 19959 (IPV6_HDR_LEN + TCP_CHECKSUM_OFFSET + 19960 TCP_CHECKSUM_SIZE)); 19961 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 19962 19963 if (tcp->tcp_ip_forward_progress) { 19964 rconfirm = B_TRUE; 19965 tcp->tcp_ip_forward_progress = B_FALSE; 19966 } 19967 } 19968 19969 /* at least one payload span, and at most two */ 19970 ASSERT(pkt_info->pld_cnt > 0 && pkt_info->pld_cnt < 3); 19971 19972 /* add the packet descriptor to Multidata */ 19973 if ((pkt = mmd_addpdesc(mmd, pkt_info, &err, 19974 KM_NOSLEEP)) == NULL) { 19975 /* 19976 * Any failure other than ENOMEM indicates 19977 * that we have passed in invalid pkt_info 19978 * or parameters to mmd_addpdesc, which must 19979 * not happen. 19980 * 19981 * EINVAL is a result of failure on boundary 19982 * checks against the pkt_info contents. It 19983 * should not happen, and we panic because 19984 * either there's horrible heap corruption, 19985 * and/or programming mistake. 19986 */ 19987 if (err != ENOMEM) { 19988 cmn_err(CE_PANIC, "tcp_multisend: " 19989 "pdesc logic error detected for " 19990 "tcp %p mmd %p pinfo %p (%d)\n", 19991 (void *)tcp, (void *)mmd, 19992 (void *)pkt_info, err); 19993 } 19994 TCP_STAT(tcp_mdt_addpdescfail); 19995 goto legacy_send; /* out_of_mem */ 19996 } 19997 ASSERT(pkt != NULL); 19998 19999 /* calculate IP header and TCP checksums */ 20000 if (af == AF_INET) { 20001 /* calculate pseudo-header checksum */ 20002 cksum = (dst >> 16) + (dst & 0xFFFF) + 20003 (src >> 16) + (src & 0xFFFF); 20004 20005 /* offset for TCP header checksum */ 20006 up = IPH_TCPH_CHECKSUMP(ipha, 20007 IP_SIMPLE_HDR_LENGTH); 20008 } else { 20009 up = (uint16_t *)&ip6h->ip6_src; 20010 20011 /* calculate pseudo-header checksum */ 20012 cksum = up[0] + up[1] + up[2] + up[3] + 20013 up[4] + up[5] + up[6] + up[7] + 20014 up[8] + up[9] + up[10] + up[11] + 20015 up[12] + up[13] + up[14] + up[15]; 20016 20017 /* Fold the initial sum */ 20018 cksum = (cksum & 0xffff) + (cksum >> 16); 20019 20020 up = (uint16_t *)(((uchar_t *)ip6h) + 20021 IPV6_HDR_LEN + TCP_CHECKSUM_OFFSET); 20022 } 20023 20024 if (hwcksum_flags & HCK_FULLCKSUM) { 20025 /* clear checksum field for hardware */ 20026 *up = 0; 20027 } else if (hwcksum_flags & HCK_PARTIALCKSUM) { 20028 uint32_t sum; 20029 20030 /* pseudo-header checksumming */ 20031 sum = *up + cksum + IP_TCP_CSUM_COMP; 20032 sum = (sum & 0xFFFF) + (sum >> 16); 20033 *up = (sum & 0xFFFF) + (sum >> 16); 20034 } else { 20035 /* software checksumming */ 20036 TCP_STAT(tcp_out_sw_cksum); 20037 TCP_STAT_UPDATE(tcp_out_sw_cksum_bytes, 20038 tcp->tcp_hdr_len + tcp->tcp_last_sent_len); 20039 *up = IP_MD_CSUM(pkt, tcp->tcp_ip_hdr_len, 20040 cksum + IP_TCP_CSUM_COMP); 20041 if (*up == 0) 20042 *up = 0xFFFF; 20043 } 20044 20045 /* IPv4 header checksum */ 20046 if (af == AF_INET) { 20047 ipha->ipha_fragment_offset_and_flags |= 20048 (uint32_t)htons(ire->ire_frag_flag); 20049 20050 if (hwcksum_flags & HCK_IPV4_HDRCKSUM) { 20051 ipha->ipha_hdr_checksum = 0; 20052 } else { 20053 IP_HDR_CKSUM(ipha, cksum, 20054 ((uint32_t *)ipha)[0], 20055 ((uint16_t *)ipha)[4]); 20056 } 20057 } 20058 20059 /* advance header offset */ 20060 cur_hdr_off += hdr_frag_sz; 20061 20062 obbytes += tcp->tcp_last_sent_len; 20063 ++obsegs; 20064 } while (!done && *usable > 0 && --num_burst_seg > 0 && 20065 *tail_unsent > 0); 20066 20067 if ((*xmit_tail)->b_next == NULL) { 20068 /* 20069 * Store the lbolt used for RTT estimation. We can only 20070 * record one timestamp per mblk so we do it when we 20071 * reach the end of the payload buffer. Also we only 20072 * take a new timestamp sample when the previous timed 20073 * data from the same mblk has been ack'ed. 20074 */ 20075 (*xmit_tail)->b_prev = local_time; 20076 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)first_snxt; 20077 } 20078 20079 ASSERT(*tail_unsent >= 0); 20080 if (*tail_unsent > 0) { 20081 /* 20082 * We got here because we broke out of the above 20083 * loop due to of one of the following cases: 20084 * 20085 * 1. len < adjusted MSS (i.e. small), 20086 * 2. Sender SWS avoidance, 20087 * 3. max_pld is zero. 20088 * 20089 * We are done for this Multidata, so trim our 20090 * last payload buffer (if any) accordingly. 20091 */ 20092 if (md_pbuf != NULL) 20093 md_pbuf->b_wptr -= *tail_unsent; 20094 } else if (*usable > 0) { 20095 *xmit_tail = (*xmit_tail)->b_cont; 20096 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 20097 (uintptr_t)INT_MAX); 20098 *tail_unsent = (int)MBLKL(*xmit_tail); 20099 add_buffer = B_TRUE; 20100 } 20101 } while (!done && *usable > 0 && num_burst_seg > 0 && 20102 (tcp_mdt_chain || max_pld > 0)); 20103 20104 /* send everything down */ 20105 tcp_multisend_data(tcp, ire, ill, md_mp_head, obsegs, obbytes, 20106 &rconfirm); 20107 20108 #undef PREP_NEW_MULTIDATA 20109 #undef PREP_NEW_PBUF 20110 #undef IPVER 20111 20112 IRE_REFRELE(ire); 20113 return (0); 20114 } 20115 20116 /* 20117 * A wrapper function for sending one or more Multidata messages down to 20118 * the module below ip; this routine does not release the reference of the 20119 * IRE (caller does that). This routine is analogous to tcp_send_data(). 20120 */ 20121 static void 20122 tcp_multisend_data(tcp_t *tcp, ire_t *ire, const ill_t *ill, mblk_t *md_mp_head, 20123 const uint_t obsegs, const uint_t obbytes, boolean_t *rconfirm) 20124 { 20125 uint64_t delta; 20126 nce_t *nce; 20127 20128 ASSERT(ire != NULL && ill != NULL); 20129 ASSERT(ire->ire_stq != NULL); 20130 ASSERT(md_mp_head != NULL); 20131 ASSERT(rconfirm != NULL); 20132 20133 /* adjust MIBs and IRE timestamp */ 20134 TCP_RECORD_TRACE(tcp, md_mp_head, TCP_TRACE_SEND_PKT); 20135 tcp->tcp_obsegs += obsegs; 20136 UPDATE_MIB(&tcp_mib, tcpOutDataSegs, obsegs); 20137 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, obbytes); 20138 TCP_STAT_UPDATE(tcp_mdt_pkt_out, obsegs); 20139 20140 if (tcp->tcp_ipversion == IPV4_VERSION) { 20141 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v4, obsegs); 20142 UPDATE_MIB(&ip_mib, ipOutRequests, obsegs); 20143 } else { 20144 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v6, obsegs); 20145 UPDATE_MIB(&ip6_mib, ipv6OutRequests, obsegs); 20146 } 20147 20148 ire->ire_ob_pkt_count += obsegs; 20149 if (ire->ire_ipif != NULL) 20150 atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, obsegs); 20151 ire->ire_last_used_time = lbolt; 20152 20153 /* send it down */ 20154 putnext(ire->ire_stq, md_mp_head); 20155 20156 /* we're done for TCP/IPv4 */ 20157 if (tcp->tcp_ipversion == IPV4_VERSION) 20158 return; 20159 20160 nce = ire->ire_nce; 20161 20162 ASSERT(nce != NULL); 20163 ASSERT(!(nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT))); 20164 ASSERT(nce->nce_state != ND_INCOMPLETE); 20165 20166 /* reachability confirmation? */ 20167 if (*rconfirm) { 20168 nce->nce_last = TICK_TO_MSEC(lbolt64); 20169 if (nce->nce_state != ND_REACHABLE) { 20170 mutex_enter(&nce->nce_lock); 20171 nce->nce_state = ND_REACHABLE; 20172 nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT; 20173 mutex_exit(&nce->nce_lock); 20174 (void) untimeout(nce->nce_timeout_id); 20175 if (ip_debug > 2) { 20176 /* ip1dbg */ 20177 pr_addr_dbg("tcp_multisend_data: state " 20178 "for %s changed to REACHABLE\n", 20179 AF_INET6, &ire->ire_addr_v6); 20180 } 20181 } 20182 /* reset transport reachability confirmation */ 20183 *rconfirm = B_FALSE; 20184 } 20185 20186 delta = TICK_TO_MSEC(lbolt64) - nce->nce_last; 20187 ip1dbg(("tcp_multisend_data: delta = %" PRId64 20188 " ill_reachable_time = %d \n", delta, ill->ill_reachable_time)); 20189 20190 if (delta > (uint64_t)ill->ill_reachable_time) { 20191 mutex_enter(&nce->nce_lock); 20192 switch (nce->nce_state) { 20193 case ND_REACHABLE: 20194 case ND_STALE: 20195 /* 20196 * ND_REACHABLE is identical to ND_STALE in this 20197 * specific case. If reachable time has expired for 20198 * this neighbor (delta is greater than reachable 20199 * time), conceptually, the neighbor cache is no 20200 * longer in REACHABLE state, but already in STALE 20201 * state. So the correct transition here is to 20202 * ND_DELAY. 20203 */ 20204 nce->nce_state = ND_DELAY; 20205 mutex_exit(&nce->nce_lock); 20206 NDP_RESTART_TIMER(nce, delay_first_probe_time); 20207 if (ip_debug > 3) { 20208 /* ip2dbg */ 20209 pr_addr_dbg("tcp_multisend_data: state " 20210 "for %s changed to DELAY\n", 20211 AF_INET6, &ire->ire_addr_v6); 20212 } 20213 break; 20214 case ND_DELAY: 20215 case ND_PROBE: 20216 mutex_exit(&nce->nce_lock); 20217 /* Timers have already started */ 20218 break; 20219 case ND_UNREACHABLE: 20220 /* 20221 * ndp timer has detected that this nce is 20222 * unreachable and initiated deleting this nce 20223 * and all its associated IREs. This is a race 20224 * where we found the ire before it was deleted 20225 * and have just sent out a packet using this 20226 * unreachable nce. 20227 */ 20228 mutex_exit(&nce->nce_lock); 20229 break; 20230 default: 20231 ASSERT(0); 20232 } 20233 } 20234 } 20235 20236 /* 20237 * tcp_send() is called by tcp_wput_data() for non-Multidata transmission 20238 * scheme, and returns one of the following: 20239 * 20240 * -1 = failed allocation. 20241 * 0 = success; burst count reached, or usable send window is too small, 20242 * and that we'd rather wait until later before sending again. 20243 * 1 = success; we are called from tcp_multisend(), and both usable send 20244 * window and tail_unsent are greater than the MDT threshold, and thus 20245 * Multidata Transmit should be used instead. 20246 */ 20247 static int 20248 tcp_send(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 20249 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 20250 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 20251 const int mdt_thres) 20252 { 20253 int num_burst_seg = tcp->tcp_snd_burst; 20254 20255 for (;;) { 20256 struct datab *db; 20257 tcph_t *tcph; 20258 uint32_t sum; 20259 mblk_t *mp, *mp1; 20260 uchar_t *rptr; 20261 int len; 20262 20263 /* 20264 * If we're called by tcp_multisend(), and the amount of 20265 * sendable data as well as the size of current xmit_tail 20266 * is beyond the MDT threshold, return to the caller and 20267 * let the large data transmit be done using MDT. 20268 */ 20269 if (*usable > 0 && *usable > mdt_thres && 20270 (*tail_unsent > mdt_thres || (*tail_unsent == 0 && 20271 MBLKL((*xmit_tail)->b_cont) > mdt_thres))) { 20272 ASSERT(tcp->tcp_mdt); 20273 return (1); /* success; do large send */ 20274 } 20275 20276 if (num_burst_seg-- == 0) 20277 break; /* success; burst count reached */ 20278 20279 len = mss; 20280 if (len > *usable) { 20281 len = *usable; 20282 if (len <= 0) { 20283 /* Terminate the loop */ 20284 break; /* success; too small */ 20285 } 20286 /* 20287 * Sender silly-window avoidance. 20288 * Ignore this if we are going to send a 20289 * zero window probe out. 20290 * 20291 * TODO: force data into microscopic window? 20292 * ==> (!pushed || (unsent > usable)) 20293 */ 20294 if (len < (tcp->tcp_max_swnd >> 1) && 20295 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) > len && 20296 !((tcp->tcp_valid_bits & TCP_URG_VALID) && 20297 len == 1) && (! tcp->tcp_zero_win_probe)) { 20298 /* 20299 * If the retransmit timer is not running 20300 * we start it so that we will retransmit 20301 * in the case when the the receiver has 20302 * decremented the window. 20303 */ 20304 if (*snxt == tcp->tcp_snxt && 20305 *snxt == tcp->tcp_suna) { 20306 /* 20307 * We are not supposed to send 20308 * anything. So let's wait a little 20309 * bit longer before breaking SWS 20310 * avoidance. 20311 * 20312 * What should the value be? 20313 * Suggestion: MAX(init rexmit time, 20314 * tcp->tcp_rto) 20315 */ 20316 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20317 } 20318 break; /* success; too small */ 20319 } 20320 } 20321 20322 tcph = tcp->tcp_tcph; 20323 20324 *usable -= len; /* Approximate - can be adjusted later */ 20325 if (*usable > 0) 20326 tcph->th_flags[0] = TH_ACK; 20327 else 20328 tcph->th_flags[0] = (TH_ACK | TH_PUSH); 20329 20330 /* 20331 * Prime pump for IP's checksumming on our behalf 20332 * Include the adjustment for a source route if any. 20333 */ 20334 sum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 20335 sum = (sum >> 16) + (sum & 0xFFFF); 20336 U16_TO_ABE16(sum, tcph->th_sum); 20337 20338 U32_TO_ABE32(*snxt, tcph->th_seq); 20339 20340 /* 20341 * Branch off to tcp_xmit_mp() if any of the VALID bits is 20342 * set. For the case when TCP_FSS_VALID is the only valid 20343 * bit (normal active close), branch off only when we think 20344 * that the FIN flag needs to be set. Note for this case, 20345 * that (snxt + len) may not reflect the actual seg_len, 20346 * as len may be further reduced in tcp_xmit_mp(). If len 20347 * gets modified, we will end up here again. 20348 */ 20349 if (tcp->tcp_valid_bits != 0 && 20350 (tcp->tcp_valid_bits != TCP_FSS_VALID || 20351 ((*snxt + len) == tcp->tcp_fss))) { 20352 uchar_t *prev_rptr; 20353 uint32_t prev_snxt = tcp->tcp_snxt; 20354 20355 if (*tail_unsent == 0) { 20356 ASSERT((*xmit_tail)->b_cont != NULL); 20357 *xmit_tail = (*xmit_tail)->b_cont; 20358 prev_rptr = (*xmit_tail)->b_rptr; 20359 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20360 (*xmit_tail)->b_rptr); 20361 } else { 20362 prev_rptr = (*xmit_tail)->b_rptr; 20363 (*xmit_tail)->b_rptr = (*xmit_tail)->b_wptr - 20364 *tail_unsent; 20365 } 20366 mp = tcp_xmit_mp(tcp, *xmit_tail, len, NULL, NULL, 20367 *snxt, B_FALSE, (uint32_t *)&len, B_FALSE); 20368 /* Restore tcp_snxt so we get amount sent right. */ 20369 tcp->tcp_snxt = prev_snxt; 20370 if (prev_rptr == (*xmit_tail)->b_rptr) { 20371 /* 20372 * If the previous timestamp is still in use, 20373 * don't stomp on it. 20374 */ 20375 if ((*xmit_tail)->b_next == NULL) { 20376 (*xmit_tail)->b_prev = local_time; 20377 (*xmit_tail)->b_next = 20378 (mblk_t *)(uintptr_t)(*snxt); 20379 } 20380 } else 20381 (*xmit_tail)->b_rptr = prev_rptr; 20382 20383 if (mp == NULL) 20384 return (-1); 20385 mp1 = mp->b_cont; 20386 20387 tcp->tcp_last_sent_len = (ushort_t)len; 20388 while (mp1->b_cont) { 20389 *xmit_tail = (*xmit_tail)->b_cont; 20390 (*xmit_tail)->b_prev = local_time; 20391 (*xmit_tail)->b_next = 20392 (mblk_t *)(uintptr_t)(*snxt); 20393 mp1 = mp1->b_cont; 20394 } 20395 *snxt += len; 20396 *tail_unsent = (*xmit_tail)->b_wptr - mp1->b_wptr; 20397 BUMP_LOCAL(tcp->tcp_obsegs); 20398 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20399 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20400 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20401 tcp_send_data(tcp, q, mp); 20402 continue; 20403 } 20404 20405 *snxt += len; /* Adjust later if we don't send all of len */ 20406 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20407 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20408 20409 if (*tail_unsent) { 20410 /* Are the bytes above us in flight? */ 20411 rptr = (*xmit_tail)->b_wptr - *tail_unsent; 20412 if (rptr != (*xmit_tail)->b_rptr) { 20413 *tail_unsent -= len; 20414 tcp->tcp_last_sent_len = (ushort_t)len; 20415 len += tcp_hdr_len; 20416 if (tcp->tcp_ipversion == IPV4_VERSION) 20417 tcp->tcp_ipha->ipha_length = htons(len); 20418 else 20419 tcp->tcp_ip6h->ip6_plen = 20420 htons(len - 20421 ((char *)&tcp->tcp_ip6h[1] - 20422 tcp->tcp_iphc)); 20423 mp = dupb(*xmit_tail); 20424 if (!mp) 20425 return (-1); /* out_of_mem */ 20426 mp->b_rptr = rptr; 20427 /* 20428 * If the old timestamp is no longer in use, 20429 * sample a new timestamp now. 20430 */ 20431 if ((*xmit_tail)->b_next == NULL) { 20432 (*xmit_tail)->b_prev = local_time; 20433 (*xmit_tail)->b_next = 20434 (mblk_t *)(uintptr_t)(*snxt-len); 20435 } 20436 goto must_alloc; 20437 } 20438 } else { 20439 *xmit_tail = (*xmit_tail)->b_cont; 20440 ASSERT((uintptr_t)((*xmit_tail)->b_wptr - 20441 (*xmit_tail)->b_rptr) <= (uintptr_t)INT_MAX); 20442 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20443 (*xmit_tail)->b_rptr); 20444 } 20445 20446 (*xmit_tail)->b_prev = local_time; 20447 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)(*snxt - len); 20448 20449 *tail_unsent -= len; 20450 tcp->tcp_last_sent_len = (ushort_t)len; 20451 20452 len += tcp_hdr_len; 20453 if (tcp->tcp_ipversion == IPV4_VERSION) 20454 tcp->tcp_ipha->ipha_length = htons(len); 20455 else 20456 tcp->tcp_ip6h->ip6_plen = htons(len - 20457 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 20458 20459 mp = dupb(*xmit_tail); 20460 if (!mp) 20461 return (-1); /* out_of_mem */ 20462 20463 len = tcp_hdr_len; 20464 /* 20465 * There are four reasons to allocate a new hdr mblk: 20466 * 1) The bytes above us are in use by another packet 20467 * 2) We don't have good alignment 20468 * 3) The mblk is being shared 20469 * 4) We don't have enough room for a header 20470 */ 20471 rptr = mp->b_rptr - len; 20472 if (!OK_32PTR(rptr) || 20473 ((db = mp->b_datap), db->db_ref != 2) || 20474 rptr < db->db_base) { 20475 /* NOTE: we assume allocb returns an OK_32PTR */ 20476 20477 must_alloc:; 20478 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 20479 tcp_wroff_xtra, BPRI_MED); 20480 if (!mp1) { 20481 freemsg(mp); 20482 return (-1); /* out_of_mem */ 20483 } 20484 mp1->b_cont = mp; 20485 mp = mp1; 20486 /* Leave room for Link Level header */ 20487 len = tcp_hdr_len; 20488 rptr = &mp->b_rptr[tcp_wroff_xtra]; 20489 mp->b_wptr = &rptr[len]; 20490 } 20491 20492 /* 20493 * Fill in the header using the template header, and add 20494 * options such as time-stamp, ECN and/or SACK, as needed. 20495 */ 20496 tcp_fill_header(tcp, rptr, (clock_t)local_time, num_sack_blk); 20497 20498 mp->b_rptr = rptr; 20499 20500 if (*tail_unsent) { 20501 int spill = *tail_unsent; 20502 20503 mp1 = mp->b_cont; 20504 if (!mp1) 20505 mp1 = mp; 20506 20507 /* 20508 * If we're a little short, tack on more mblks until 20509 * there is no more spillover. 20510 */ 20511 while (spill < 0) { 20512 mblk_t *nmp; 20513 int nmpsz; 20514 20515 nmp = (*xmit_tail)->b_cont; 20516 nmpsz = MBLKL(nmp); 20517 20518 /* 20519 * Excess data in mblk; can we split it? 20520 * If MDT is enabled for the connection, 20521 * keep on splitting as this is a transient 20522 * send path. 20523 */ 20524 if (!tcp->tcp_mdt && (spill + nmpsz > 0)) { 20525 /* 20526 * Don't split if stream head was 20527 * told to break up larger writes 20528 * into smaller ones. 20529 */ 20530 if (tcp->tcp_maxpsz > 0) 20531 break; 20532 20533 /* 20534 * Next mblk is less than SMSS/2 20535 * rounded up to nearest 64-byte; 20536 * let it get sent as part of the 20537 * next segment. 20538 */ 20539 if (tcp->tcp_localnet && 20540 !tcp->tcp_cork && 20541 (nmpsz < roundup((mss >> 1), 64))) 20542 break; 20543 } 20544 20545 *xmit_tail = nmp; 20546 ASSERT((uintptr_t)nmpsz <= (uintptr_t)INT_MAX); 20547 /* Stash for rtt use later */ 20548 (*xmit_tail)->b_prev = local_time; 20549 (*xmit_tail)->b_next = 20550 (mblk_t *)(uintptr_t)(*snxt - len); 20551 mp1->b_cont = dupb(*xmit_tail); 20552 mp1 = mp1->b_cont; 20553 20554 spill += nmpsz; 20555 if (mp1 == NULL) { 20556 *tail_unsent = spill; 20557 freemsg(mp); 20558 return (-1); /* out_of_mem */ 20559 } 20560 } 20561 20562 /* Trim back any surplus on the last mblk */ 20563 if (spill >= 0) { 20564 mp1->b_wptr -= spill; 20565 *tail_unsent = spill; 20566 } else { 20567 /* 20568 * We did not send everything we could in 20569 * order to remain within the b_cont limit. 20570 */ 20571 *usable -= spill; 20572 *snxt += spill; 20573 tcp->tcp_last_sent_len += spill; 20574 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, spill); 20575 /* 20576 * Adjust the checksum 20577 */ 20578 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 20579 sum += spill; 20580 sum = (sum >> 16) + (sum & 0xFFFF); 20581 U16_TO_ABE16(sum, tcph->th_sum); 20582 if (tcp->tcp_ipversion == IPV4_VERSION) { 20583 sum = ntohs( 20584 ((ipha_t *)rptr)->ipha_length) + 20585 spill; 20586 ((ipha_t *)rptr)->ipha_length = 20587 htons(sum); 20588 } else { 20589 sum = ntohs( 20590 ((ip6_t *)rptr)->ip6_plen) + 20591 spill; 20592 ((ip6_t *)rptr)->ip6_plen = 20593 htons(sum); 20594 } 20595 *tail_unsent = 0; 20596 } 20597 } 20598 if (tcp->tcp_ip_forward_progress) { 20599 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 20600 *(uint32_t *)mp->b_rptr |= IP_FORWARD_PROG; 20601 tcp->tcp_ip_forward_progress = B_FALSE; 20602 } 20603 20604 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20605 tcp_send_data(tcp, q, mp); 20606 BUMP_LOCAL(tcp->tcp_obsegs); 20607 } 20608 20609 return (0); 20610 } 20611 20612 /* Unlink and return any mblk that looks like it contains a MDT info */ 20613 static mblk_t * 20614 tcp_mdt_info_mp(mblk_t *mp) 20615 { 20616 mblk_t *prev_mp; 20617 20618 for (;;) { 20619 prev_mp = mp; 20620 /* no more to process? */ 20621 if ((mp = mp->b_cont) == NULL) 20622 break; 20623 20624 switch (DB_TYPE(mp)) { 20625 case M_CTL: 20626 if (*(uint32_t *)mp->b_rptr != MDT_IOC_INFO_UPDATE) 20627 continue; 20628 ASSERT(prev_mp != NULL); 20629 prev_mp->b_cont = mp->b_cont; 20630 mp->b_cont = NULL; 20631 return (mp); 20632 default: 20633 break; 20634 } 20635 } 20636 return (mp); 20637 } 20638 20639 /* MDT info update routine, called when IP notifies us about MDT */ 20640 static void 20641 tcp_mdt_update(tcp_t *tcp, ill_mdt_capab_t *mdt_capab, boolean_t first) 20642 { 20643 boolean_t prev_state; 20644 20645 /* 20646 * IP is telling us to abort MDT on this connection? We know 20647 * this because the capability is only turned off when IP 20648 * encounters some pathological cases, e.g. link-layer change 20649 * where the new driver doesn't support MDT, or in situation 20650 * where MDT usage on the link-layer has been switched off. 20651 * IP would not have sent us the initial MDT_IOC_INFO_UPDATE 20652 * if the link-layer doesn't support MDT, and if it does, it 20653 * will indicate that the feature is to be turned on. 20654 */ 20655 prev_state = tcp->tcp_mdt; 20656 tcp->tcp_mdt = (mdt_capab->ill_mdt_on != 0); 20657 if (!tcp->tcp_mdt && !first) { 20658 TCP_STAT(tcp_mdt_conn_halted3); 20659 ip1dbg(("tcp_mdt_update: disabling MDT for connp %p\n", 20660 (void *)tcp->tcp_connp)); 20661 } 20662 20663 /* 20664 * We currently only support MDT on simple TCP/{IPv4,IPv6}, 20665 * so disable MDT otherwise. The checks are done here 20666 * and in tcp_wput_data(). 20667 */ 20668 if (tcp->tcp_mdt && 20669 (tcp->tcp_ipversion == IPV4_VERSION && 20670 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 20671 (tcp->tcp_ipversion == IPV6_VERSION && 20672 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN)) 20673 tcp->tcp_mdt = B_FALSE; 20674 20675 if (tcp->tcp_mdt) { 20676 if (mdt_capab->ill_mdt_version != MDT_VERSION_2) { 20677 cmn_err(CE_NOTE, "tcp_mdt_update: unknown MDT " 20678 "version (%d), expected version is %d", 20679 mdt_capab->ill_mdt_version, MDT_VERSION_2); 20680 tcp->tcp_mdt = B_FALSE; 20681 return; 20682 } 20683 20684 /* 20685 * We need the driver to be able to handle at least three 20686 * spans per packet in order for tcp MDT to be utilized. 20687 * The first is for the header portion, while the rest are 20688 * needed to handle a packet that straddles across two 20689 * virtually non-contiguous buffers; a typical tcp packet 20690 * therefore consists of only two spans. Note that we take 20691 * a zero as "don't care". 20692 */ 20693 if (mdt_capab->ill_mdt_span_limit > 0 && 20694 mdt_capab->ill_mdt_span_limit < 3) { 20695 tcp->tcp_mdt = B_FALSE; 20696 return; 20697 } 20698 20699 /* a zero means driver wants default value */ 20700 tcp->tcp_mdt_max_pld = MIN(mdt_capab->ill_mdt_max_pld, 20701 tcp_mdt_max_pbufs); 20702 if (tcp->tcp_mdt_max_pld == 0) 20703 tcp->tcp_mdt_max_pld = tcp_mdt_max_pbufs; 20704 20705 /* ensure 32-bit alignment */ 20706 tcp->tcp_mdt_hdr_head = roundup(MAX(tcp_mdt_hdr_head_min, 20707 mdt_capab->ill_mdt_hdr_head), 4); 20708 tcp->tcp_mdt_hdr_tail = roundup(MAX(tcp_mdt_hdr_tail_min, 20709 mdt_capab->ill_mdt_hdr_tail), 4); 20710 20711 if (!first && !prev_state) { 20712 TCP_STAT(tcp_mdt_conn_resumed2); 20713 ip1dbg(("tcp_mdt_update: reenabling MDT for connp %p\n", 20714 (void *)tcp->tcp_connp)); 20715 } 20716 } 20717 } 20718 20719 static void 20720 tcp_ire_ill_check(tcp_t *tcp, ire_t *ire, ill_t *ill, boolean_t check_mdt) 20721 { 20722 conn_t *connp = tcp->tcp_connp; 20723 20724 ASSERT(ire != NULL); 20725 20726 /* 20727 * We may be in the fastpath here, and although we essentially do 20728 * similar checks as in ip_bind_connected{_v6}/ip_mdinfo_return, 20729 * we try to keep things as brief as possible. After all, these 20730 * are only best-effort checks, and we do more thorough ones prior 20731 * to calling tcp_multisend(). 20732 */ 20733 if (ip_multidata_outbound && check_mdt && 20734 !(ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) && 20735 ill != NULL && ILL_MDT_CAPABLE(ill) && 20736 !CONN_IPSEC_OUT_ENCAPSULATED(connp) && 20737 !(ire->ire_flags & RTF_MULTIRT) && 20738 !IPP_ENABLED(IPP_LOCAL_OUT) && 20739 CONN_IS_MD_FASTPATH(connp)) { 20740 /* Remember the result */ 20741 connp->conn_mdt_ok = B_TRUE; 20742 20743 ASSERT(ill->ill_mdt_capab != NULL); 20744 if (!ill->ill_mdt_capab->ill_mdt_on) { 20745 /* 20746 * If MDT has been previously turned off in the past, 20747 * and we currently can do MDT (due to IPQoS policy 20748 * removal, etc.) then enable it for this interface. 20749 */ 20750 ill->ill_mdt_capab->ill_mdt_on = 1; 20751 ip1dbg(("tcp_ire_ill_check: connp %p enables MDT for " 20752 "interface %s\n", (void *)connp, ill->ill_name)); 20753 } 20754 tcp_mdt_update(tcp, ill->ill_mdt_capab, B_TRUE); 20755 } 20756 20757 /* 20758 * The goal is to reduce the number of generated tcp segments by 20759 * setting the maxpsz multiplier to 0; this will have an affect on 20760 * tcp_maxpsz_set(). With this behavior, tcp will pack more data 20761 * into each packet, up to SMSS bytes. Doing this reduces the number 20762 * of outbound segments and incoming ACKs, thus allowing for better 20763 * network and system performance. In contrast the legacy behavior 20764 * may result in sending less than SMSS size, because the last mblk 20765 * for some packets may have more data than needed to make up SMSS, 20766 * and the legacy code refused to "split" it. 20767 * 20768 * We apply the new behavior on following situations: 20769 * 20770 * 1) Loopback connections, 20771 * 2) Connections in which the remote peer is not on local subnet, 20772 * 3) Local subnet connections over the bge interface (see below). 20773 * 20774 * Ideally, we would like this behavior to apply for interfaces other 20775 * than bge. However, doing so would negatively impact drivers which 20776 * perform dynamic mapping and unmapping of DMA resources, which are 20777 * increased by setting the maxpsz multiplier to 0 (more mblks per 20778 * packet will be generated by tcp). The bge driver does not suffer 20779 * from this, as it copies the mblks into pre-mapped buffers, and 20780 * therefore does not require more I/O resources than before. 20781 * 20782 * Otherwise, this behavior is present on all network interfaces when 20783 * the destination endpoint is non-local, since reducing the number 20784 * of packets in general is good for the network. 20785 * 20786 * TODO We need to remove this hard-coded conditional for bge once 20787 * a better "self-tuning" mechanism, or a way to comprehend 20788 * the driver transmit strategy is devised. Until the solution 20789 * is found and well understood, we live with this hack. 20790 */ 20791 if (!tcp_static_maxpsz && 20792 (tcp->tcp_loopback || !tcp->tcp_localnet || 20793 (ill->ill_name_length > 3 && bcmp(ill->ill_name, "bge", 3) == 0))) { 20794 /* override the default value */ 20795 tcp->tcp_maxpsz = 0; 20796 20797 ip3dbg(("tcp_ire_ill_check: connp %p tcp_maxpsz %d on " 20798 "interface %s\n", (void *)connp, tcp->tcp_maxpsz, 20799 ill != NULL ? ill->ill_name : ipif_loopback_name)); 20800 } 20801 20802 /* set the stream head parameters accordingly */ 20803 (void) tcp_maxpsz_set(tcp, B_TRUE); 20804 } 20805 20806 /* tcp_wput_flush is called by tcp_wput_nondata to handle M_FLUSH messages. */ 20807 static void 20808 tcp_wput_flush(tcp_t *tcp, mblk_t *mp) 20809 { 20810 uchar_t fval = *mp->b_rptr; 20811 mblk_t *tail; 20812 queue_t *q = tcp->tcp_wq; 20813 20814 /* TODO: How should flush interact with urgent data? */ 20815 if ((fval & FLUSHW) && tcp->tcp_xmit_head && 20816 !(tcp->tcp_valid_bits & TCP_URG_VALID)) { 20817 /* 20818 * Flush only data that has not yet been put on the wire. If 20819 * we flush data that we have already transmitted, life, as we 20820 * know it, may come to an end. 20821 */ 20822 tail = tcp->tcp_xmit_tail; 20823 tail->b_wptr -= tcp->tcp_xmit_tail_unsent; 20824 tcp->tcp_xmit_tail_unsent = 0; 20825 tcp->tcp_unsent = 0; 20826 if (tail->b_wptr != tail->b_rptr) 20827 tail = tail->b_cont; 20828 if (tail) { 20829 mblk_t **excess = &tcp->tcp_xmit_head; 20830 for (;;) { 20831 mblk_t *mp1 = *excess; 20832 if (mp1 == tail) 20833 break; 20834 tcp->tcp_xmit_tail = mp1; 20835 tcp->tcp_xmit_last = mp1; 20836 excess = &mp1->b_cont; 20837 } 20838 *excess = NULL; 20839 tcp_close_mpp(&tail); 20840 if (tcp->tcp_snd_zcopy_aware) 20841 tcp_zcopy_notify(tcp); 20842 } 20843 /* 20844 * We have no unsent data, so unsent must be less than 20845 * tcp_xmit_lowater, so re-enable flow. 20846 */ 20847 if (tcp->tcp_flow_stopped) { 20848 tcp_clrqfull(tcp); 20849 } 20850 } 20851 /* 20852 * TODO: you can't just flush these, you have to increase rwnd for one 20853 * thing. For another, how should urgent data interact? 20854 */ 20855 if (fval & FLUSHR) { 20856 *mp->b_rptr = fval & ~FLUSHW; 20857 /* XXX */ 20858 qreply(q, mp); 20859 return; 20860 } 20861 freemsg(mp); 20862 } 20863 20864 /* 20865 * tcp_wput_iocdata is called by tcp_wput_nondata to handle all M_IOCDATA 20866 * messages. 20867 */ 20868 static void 20869 tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp) 20870 { 20871 mblk_t *mp1; 20872 STRUCT_HANDLE(strbuf, sb); 20873 uint16_t port; 20874 queue_t *q = tcp->tcp_wq; 20875 in6_addr_t v6addr; 20876 ipaddr_t v4addr; 20877 uint32_t flowinfo = 0; 20878 int addrlen; 20879 20880 /* Make sure it is one of ours. */ 20881 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 20882 case TI_GETMYNAME: 20883 case TI_GETPEERNAME: 20884 break; 20885 default: 20886 CALL_IP_WPUT(tcp->tcp_connp, q, mp); 20887 return; 20888 } 20889 switch (mi_copy_state(q, mp, &mp1)) { 20890 case -1: 20891 return; 20892 case MI_COPY_CASE(MI_COPY_IN, 1): 20893 break; 20894 case MI_COPY_CASE(MI_COPY_OUT, 1): 20895 /* Copy out the strbuf. */ 20896 mi_copyout(q, mp); 20897 return; 20898 case MI_COPY_CASE(MI_COPY_OUT, 2): 20899 /* All done. */ 20900 mi_copy_done(q, mp, 0); 20901 return; 20902 default: 20903 mi_copy_done(q, mp, EPROTO); 20904 return; 20905 } 20906 /* Check alignment of the strbuf */ 20907 if (!OK_32PTR(mp1->b_rptr)) { 20908 mi_copy_done(q, mp, EINVAL); 20909 return; 20910 } 20911 20912 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 20913 (void *)mp1->b_rptr); 20914 addrlen = tcp->tcp_family == AF_INET ? sizeof (sin_t) : sizeof (sin6_t); 20915 20916 if (STRUCT_FGET(sb, maxlen) < addrlen) { 20917 mi_copy_done(q, mp, EINVAL); 20918 return; 20919 } 20920 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 20921 case TI_GETMYNAME: 20922 if (tcp->tcp_family == AF_INET) { 20923 if (tcp->tcp_ipversion == IPV4_VERSION) { 20924 v4addr = tcp->tcp_ipha->ipha_src; 20925 } else { 20926 /* can't return an address in this case */ 20927 v4addr = 0; 20928 } 20929 } else { 20930 /* tcp->tcp_family == AF_INET6 */ 20931 if (tcp->tcp_ipversion == IPV4_VERSION) { 20932 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 20933 &v6addr); 20934 } else { 20935 v6addr = tcp->tcp_ip6h->ip6_src; 20936 } 20937 } 20938 port = tcp->tcp_lport; 20939 break; 20940 case TI_GETPEERNAME: 20941 if (tcp->tcp_family == AF_INET) { 20942 if (tcp->tcp_ipversion == IPV4_VERSION) { 20943 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_remote_v6, 20944 v4addr); 20945 } else { 20946 /* can't return an address in this case */ 20947 v4addr = 0; 20948 } 20949 } else { 20950 /* tcp->tcp_family == AF_INET6) */ 20951 v6addr = tcp->tcp_remote_v6; 20952 if (tcp->tcp_ipversion == IPV6_VERSION) { 20953 /* 20954 * No flowinfo if tcp->tcp_ipversion is v4. 20955 * 20956 * flowinfo was already initialized to zero 20957 * where it was declared above, so only 20958 * set it if ipversion is v6. 20959 */ 20960 flowinfo = tcp->tcp_ip6h->ip6_vcf & 20961 ~IPV6_VERS_AND_FLOW_MASK; 20962 } 20963 } 20964 port = tcp->tcp_fport; 20965 break; 20966 default: 20967 mi_copy_done(q, mp, EPROTO); 20968 return; 20969 } 20970 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 20971 if (!mp1) 20972 return; 20973 20974 if (tcp->tcp_family == AF_INET) { 20975 sin_t *sin; 20976 20977 STRUCT_FSET(sb, len, (int)sizeof (sin_t)); 20978 sin = (sin_t *)mp1->b_rptr; 20979 mp1->b_wptr = (uchar_t *)&sin[1]; 20980 *sin = sin_null; 20981 sin->sin_family = AF_INET; 20982 sin->sin_addr.s_addr = v4addr; 20983 sin->sin_port = port; 20984 } else { 20985 /* tcp->tcp_family == AF_INET6 */ 20986 sin6_t *sin6; 20987 20988 STRUCT_FSET(sb, len, (int)sizeof (sin6_t)); 20989 sin6 = (sin6_t *)mp1->b_rptr; 20990 mp1->b_wptr = (uchar_t *)&sin6[1]; 20991 *sin6 = sin6_null; 20992 sin6->sin6_family = AF_INET6; 20993 sin6->sin6_flowinfo = flowinfo; 20994 sin6->sin6_addr = v6addr; 20995 sin6->sin6_port = port; 20996 } 20997 /* Copy out the address */ 20998 mi_copyout(q, mp); 20999 } 21000 21001 /* 21002 * tcp_wput_ioctl is called by tcp_wput_nondata() to handle all M_IOCTL 21003 * messages. 21004 */ 21005 /* ARGSUSED */ 21006 static void 21007 tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2) 21008 { 21009 conn_t *connp = (conn_t *)arg; 21010 tcp_t *tcp = connp->conn_tcp; 21011 queue_t *q = tcp->tcp_wq; 21012 struct iocblk *iocp; 21013 21014 ASSERT(DB_TYPE(mp) == M_IOCTL); 21015 /* 21016 * Try and ASSERT the minimum possible references on the 21017 * conn early enough. Since we are executing on write side, 21018 * the connection is obviously not detached and that means 21019 * there is a ref each for TCP and IP. Since we are behind 21020 * the squeue, the minimum references needed are 3. If the 21021 * conn is in classifier hash list, there should be an 21022 * extra ref for that (we check both the possibilities). 21023 */ 21024 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21025 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21026 21027 iocp = (struct iocblk *)mp->b_rptr; 21028 switch (iocp->ioc_cmd) { 21029 case TCP_IOC_DEFAULT_Q: 21030 /* Wants to be the default wq. */ 21031 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 21032 iocp->ioc_error = EPERM; 21033 iocp->ioc_count = 0; 21034 mp->b_datap->db_type = M_IOCACK; 21035 qreply(q, mp); 21036 return; 21037 } 21038 tcp_def_q_set(tcp, mp); 21039 return; 21040 case _SIOCSOCKFALLBACK: 21041 /* 21042 * Either sockmod is about to be popped and the socket 21043 * would now be treated as a plain stream, or a module 21044 * is about to be pushed so we could no longer use read- 21045 * side synchronous streams for fused loopback tcp. 21046 * Drain any queued data and disable direct sockfs 21047 * interface from now on. 21048 */ 21049 if (!tcp->tcp_issocket) { 21050 DB_TYPE(mp) = M_IOCNAK; 21051 iocp->ioc_error = EINVAL; 21052 } else { 21053 #ifdef _ILP32 21054 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 21055 #else 21056 tcp->tcp_acceptor_id = tcp->tcp_connp->conn_dev; 21057 #endif 21058 /* 21059 * Insert this socket into the acceptor hash. 21060 * We might need it for T_CONN_RES message 21061 */ 21062 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 21063 21064 if (tcp->tcp_fused) { 21065 /* 21066 * This is a fused loopback tcp; disable 21067 * read-side synchronous streams interface 21068 * and drain any queued data. It is okay 21069 * to do this for non-synchronous streams 21070 * fused tcp as well. 21071 */ 21072 tcp_fuse_disable_pair(tcp, B_FALSE); 21073 } 21074 tcp->tcp_issocket = B_FALSE; 21075 TCP_STAT(tcp_sock_fallback); 21076 21077 DB_TYPE(mp) = M_IOCACK; 21078 iocp->ioc_error = 0; 21079 } 21080 iocp->ioc_count = 0; 21081 iocp->ioc_rval = 0; 21082 qreply(q, mp); 21083 return; 21084 } 21085 CALL_IP_WPUT(connp, q, mp); 21086 } 21087 21088 /* 21089 * This routine is called by tcp_wput() to handle all TPI requests. 21090 */ 21091 /* ARGSUSED */ 21092 static void 21093 tcp_wput_proto(void *arg, mblk_t *mp, void *arg2) 21094 { 21095 conn_t *connp = (conn_t *)arg; 21096 tcp_t *tcp = connp->conn_tcp; 21097 union T_primitives *tprim = (union T_primitives *)mp->b_rptr; 21098 uchar_t *rptr; 21099 t_scalar_t type; 21100 int len; 21101 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 21102 21103 /* 21104 * Try and ASSERT the minimum possible references on the 21105 * conn early enough. Since we are executing on write side, 21106 * the connection is obviously not detached and that means 21107 * there is a ref each for TCP and IP. Since we are behind 21108 * the squeue, the minimum references needed are 3. If the 21109 * conn is in classifier hash list, there should be an 21110 * extra ref for that (we check both the possibilities). 21111 */ 21112 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21113 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21114 21115 rptr = mp->b_rptr; 21116 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 21117 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 21118 type = ((union T_primitives *)rptr)->type; 21119 if (type == T_EXDATA_REQ) { 21120 uint32_t msize = msgdsize(mp->b_cont); 21121 21122 len = msize - 1; 21123 if (len < 0) { 21124 freemsg(mp); 21125 return; 21126 } 21127 /* 21128 * Try to force urgent data out on the wire. 21129 * Even if we have unsent data this will 21130 * at least send the urgent flag. 21131 * XXX does not handle more flag correctly. 21132 */ 21133 len += tcp->tcp_unsent; 21134 len += tcp->tcp_snxt; 21135 tcp->tcp_urg = len; 21136 tcp->tcp_valid_bits |= TCP_URG_VALID; 21137 21138 /* Bypass tcp protocol for fused tcp loopback */ 21139 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp, msize)) 21140 return; 21141 } else if (type != T_DATA_REQ) { 21142 goto non_urgent_data; 21143 } 21144 /* TODO: options, flags, ... from user */ 21145 /* Set length to zero for reclamation below */ 21146 tcp_wput_data(tcp, mp->b_cont, B_TRUE); 21147 freeb(mp); 21148 return; 21149 } else { 21150 if (tcp->tcp_debug) { 21151 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 21152 "tcp_wput_proto, dropping one..."); 21153 } 21154 freemsg(mp); 21155 return; 21156 } 21157 21158 non_urgent_data: 21159 21160 switch ((int)tprim->type) { 21161 case T_SSL_PROXY_BIND_REQ: /* an SSL proxy endpoint bind request */ 21162 /* 21163 * save the kssl_ent_t from the next block, and convert this 21164 * back to a normal bind_req. 21165 */ 21166 if (mp->b_cont != NULL) { 21167 ASSERT(MBLKL(mp->b_cont) >= sizeof (kssl_ent_t)); 21168 21169 if (tcp->tcp_kssl_ent != NULL) { 21170 kssl_release_ent(tcp->tcp_kssl_ent, NULL, 21171 KSSL_NO_PROXY); 21172 tcp->tcp_kssl_ent = NULL; 21173 } 21174 bcopy(mp->b_cont->b_rptr, &tcp->tcp_kssl_ent, 21175 sizeof (kssl_ent_t)); 21176 kssl_hold_ent(tcp->tcp_kssl_ent); 21177 freemsg(mp->b_cont); 21178 mp->b_cont = NULL; 21179 } 21180 tprim->type = T_BIND_REQ; 21181 21182 /* FALLTHROUGH */ 21183 case O_T_BIND_REQ: /* bind request */ 21184 case T_BIND_REQ: /* new semantics bind request */ 21185 tcp_bind(tcp, mp); 21186 break; 21187 case T_UNBIND_REQ: /* unbind request */ 21188 tcp_unbind(tcp, mp); 21189 break; 21190 case O_T_CONN_RES: /* old connection response XXX */ 21191 case T_CONN_RES: /* connection response */ 21192 tcp_accept(tcp, mp); 21193 break; 21194 case T_CONN_REQ: /* connection request */ 21195 tcp_connect(tcp, mp); 21196 break; 21197 case T_DISCON_REQ: /* disconnect request */ 21198 tcp_disconnect(tcp, mp); 21199 break; 21200 case T_CAPABILITY_REQ: 21201 tcp_capability_req(tcp, mp); /* capability request */ 21202 break; 21203 case T_INFO_REQ: /* information request */ 21204 tcp_info_req(tcp, mp); 21205 break; 21206 case T_SVR4_OPTMGMT_REQ: /* manage options req */ 21207 /* Only IP is allowed to return meaningful value */ 21208 (void) svr4_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21209 break; 21210 case T_OPTMGMT_REQ: 21211 /* 21212 * Note: no support for snmpcom_req() through new 21213 * T_OPTMGMT_REQ. See comments in ip.c 21214 */ 21215 /* Only IP is allowed to return meaningful value */ 21216 (void) tpi_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21217 break; 21218 21219 case T_UNITDATA_REQ: /* unitdata request */ 21220 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21221 break; 21222 case T_ORDREL_REQ: /* orderly release req */ 21223 freemsg(mp); 21224 21225 if (tcp->tcp_fused) 21226 tcp_unfuse(tcp); 21227 21228 if (tcp_xmit_end(tcp) != 0) { 21229 /* 21230 * We were crossing FINs and got a reset from 21231 * the other side. Just ignore it. 21232 */ 21233 if (tcp->tcp_debug) { 21234 (void) strlog(TCP_MOD_ID, 0, 1, 21235 SL_ERROR|SL_TRACE, 21236 "tcp_wput_proto, T_ORDREL_REQ out of " 21237 "state %s", 21238 tcp_display(tcp, NULL, 21239 DISP_ADDR_AND_PORT)); 21240 } 21241 } 21242 break; 21243 case T_ADDR_REQ: 21244 tcp_addr_req(tcp, mp); 21245 break; 21246 default: 21247 if (tcp->tcp_debug) { 21248 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 21249 "tcp_wput_proto, bogus TPI msg, type %d", 21250 tprim->type); 21251 } 21252 /* 21253 * We used to M_ERROR. Sending TNOTSUPPORT gives the user 21254 * to recover. 21255 */ 21256 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21257 break; 21258 } 21259 } 21260 21261 /* 21262 * The TCP write service routine should never be called... 21263 */ 21264 /* ARGSUSED */ 21265 static void 21266 tcp_wsrv(queue_t *q) 21267 { 21268 TCP_STAT(tcp_wsrv_called); 21269 } 21270 21271 /* Non overlapping byte exchanger */ 21272 static void 21273 tcp_xchg(uchar_t *a, uchar_t *b, int len) 21274 { 21275 uchar_t uch; 21276 21277 while (len-- > 0) { 21278 uch = a[len]; 21279 a[len] = b[len]; 21280 b[len] = uch; 21281 } 21282 } 21283 21284 /* 21285 * Send out a control packet on the tcp connection specified. This routine 21286 * is typically called where we need a simple ACK or RST generated. 21287 */ 21288 static void 21289 tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl) 21290 { 21291 uchar_t *rptr; 21292 tcph_t *tcph; 21293 ipha_t *ipha = NULL; 21294 ip6_t *ip6h = NULL; 21295 uint32_t sum; 21296 int tcp_hdr_len; 21297 int tcp_ip_hdr_len; 21298 mblk_t *mp; 21299 21300 /* 21301 * Save sum for use in source route later. 21302 */ 21303 ASSERT(tcp != NULL); 21304 sum = tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 21305 tcp_hdr_len = tcp->tcp_hdr_len; 21306 tcp_ip_hdr_len = tcp->tcp_ip_hdr_len; 21307 21308 /* If a text string is passed in with the request, pass it to strlog. */ 21309 if (str != NULL && tcp->tcp_debug) { 21310 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 21311 "tcp_xmit_ctl: '%s', seq 0x%x, ack 0x%x, ctl 0x%x", 21312 str, seq, ack, ctl); 21313 } 21314 mp = allocb(tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 21315 BPRI_MED); 21316 if (mp == NULL) { 21317 return; 21318 } 21319 rptr = &mp->b_rptr[tcp_wroff_xtra]; 21320 mp->b_rptr = rptr; 21321 mp->b_wptr = &rptr[tcp_hdr_len]; 21322 bcopy(tcp->tcp_iphc, rptr, tcp_hdr_len); 21323 21324 if (tcp->tcp_ipversion == IPV4_VERSION) { 21325 ipha = (ipha_t *)rptr; 21326 ipha->ipha_length = htons(tcp_hdr_len); 21327 } else { 21328 ip6h = (ip6_t *)rptr; 21329 ASSERT(tcp != NULL); 21330 ip6h->ip6_plen = htons(tcp->tcp_hdr_len - 21331 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 21332 } 21333 tcph = (tcph_t *)&rptr[tcp_ip_hdr_len]; 21334 tcph->th_flags[0] = (uint8_t)ctl; 21335 if (ctl & TH_RST) { 21336 BUMP_MIB(&tcp_mib, tcpOutRsts); 21337 BUMP_MIB(&tcp_mib, tcpOutControl); 21338 /* 21339 * Don't send TSopt w/ TH_RST packets per RFC 1323. 21340 */ 21341 if (tcp->tcp_snd_ts_ok && 21342 tcp->tcp_state > TCPS_SYN_SENT) { 21343 mp->b_wptr = &rptr[tcp_hdr_len - TCPOPT_REAL_TS_LEN]; 21344 *(mp->b_wptr) = TCPOPT_EOL; 21345 if (tcp->tcp_ipversion == IPV4_VERSION) { 21346 ipha->ipha_length = htons(tcp_hdr_len - 21347 TCPOPT_REAL_TS_LEN); 21348 } else { 21349 ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - 21350 TCPOPT_REAL_TS_LEN); 21351 } 21352 tcph->th_offset_and_rsrvd[0] -= (3 << 4); 21353 sum -= TCPOPT_REAL_TS_LEN; 21354 } 21355 } 21356 if (ctl & TH_ACK) { 21357 if (tcp->tcp_snd_ts_ok) { 21358 U32_TO_BE32(lbolt, 21359 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 21360 U32_TO_BE32(tcp->tcp_ts_recent, 21361 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 21362 } 21363 21364 /* Update the latest receive window size in TCP header. */ 21365 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 21366 tcph->th_win); 21367 tcp->tcp_rack = ack; 21368 tcp->tcp_rack_cnt = 0; 21369 BUMP_MIB(&tcp_mib, tcpOutAck); 21370 } 21371 BUMP_LOCAL(tcp->tcp_obsegs); 21372 U32_TO_BE32(seq, tcph->th_seq); 21373 U32_TO_BE32(ack, tcph->th_ack); 21374 /* 21375 * Include the adjustment for a source route if any. 21376 */ 21377 sum = (sum >> 16) + (sum & 0xFFFF); 21378 U16_TO_BE16(sum, tcph->th_sum); 21379 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21380 tcp_send_data(tcp, tcp->tcp_wq, mp); 21381 } 21382 21383 /* 21384 * If this routine returns B_TRUE, TCP can generate a RST in response 21385 * to a segment. If it returns B_FALSE, TCP should not respond. 21386 */ 21387 static boolean_t 21388 tcp_send_rst_chk(void) 21389 { 21390 clock_t now; 21391 21392 /* 21393 * TCP needs to protect itself from generating too many RSTs. 21394 * This can be a DoS attack by sending us random segments 21395 * soliciting RSTs. 21396 * 21397 * What we do here is to have a limit of tcp_rst_sent_rate RSTs 21398 * in each 1 second interval. In this way, TCP still generate 21399 * RSTs in normal cases but when under attack, the impact is 21400 * limited. 21401 */ 21402 if (tcp_rst_sent_rate_enabled != 0) { 21403 now = lbolt; 21404 /* lbolt can wrap around. */ 21405 if ((tcp_last_rst_intrvl > now) || 21406 (TICK_TO_MSEC(now - tcp_last_rst_intrvl) > 1*SECONDS)) { 21407 tcp_last_rst_intrvl = now; 21408 tcp_rst_cnt = 1; 21409 } else if (++tcp_rst_cnt > tcp_rst_sent_rate) { 21410 return (B_FALSE); 21411 } 21412 } 21413 return (B_TRUE); 21414 } 21415 21416 /* 21417 * Send down the advice IP ioctl to tell IP to mark an IRE temporary. 21418 */ 21419 static void 21420 tcp_ip_ire_mark_advice(tcp_t *tcp) 21421 { 21422 mblk_t *mp; 21423 ipic_t *ipic; 21424 21425 if (tcp->tcp_ipversion == IPV4_VERSION) { 21426 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21427 &ipic); 21428 } else { 21429 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21430 &ipic); 21431 } 21432 if (mp == NULL) 21433 return; 21434 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21435 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21436 } 21437 21438 /* 21439 * Return an IP advice ioctl mblk and set ipic to be the pointer 21440 * to the advice structure. 21441 */ 21442 static mblk_t * 21443 tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic) 21444 { 21445 struct iocblk *ioc; 21446 mblk_t *mp, *mp1; 21447 21448 mp = allocb(sizeof (ipic_t) + addr_len, BPRI_HI); 21449 if (mp == NULL) 21450 return (NULL); 21451 bzero(mp->b_rptr, sizeof (ipic_t) + addr_len); 21452 *ipic = (ipic_t *)mp->b_rptr; 21453 (*ipic)->ipic_cmd = IP_IOC_IRE_ADVISE_NO_REPLY; 21454 (*ipic)->ipic_addr_offset = sizeof (ipic_t); 21455 21456 bcopy(addr, *ipic + 1, addr_len); 21457 21458 (*ipic)->ipic_addr_length = addr_len; 21459 mp->b_wptr = &mp->b_rptr[sizeof (ipic_t) + addr_len]; 21460 21461 mp1 = mkiocb(IP_IOCTL); 21462 if (mp1 == NULL) { 21463 freemsg(mp); 21464 return (NULL); 21465 } 21466 mp1->b_cont = mp; 21467 ioc = (struct iocblk *)mp1->b_rptr; 21468 ioc->ioc_count = sizeof (ipic_t) + addr_len; 21469 21470 return (mp1); 21471 } 21472 21473 /* 21474 * Generate a reset based on an inbound packet for which there is no active 21475 * tcp state that we can find. 21476 * 21477 * IPSEC NOTE : Try to send the reply with the same protection as it came 21478 * in. We still have the ipsec_mp that the packet was attached to. Thus 21479 * the packet will go out at the same level of protection as it came in by 21480 * converting the IPSEC_IN to IPSEC_OUT. 21481 */ 21482 static void 21483 tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq, 21484 uint32_t ack, int ctl, uint_t ip_hdr_len, zoneid_t zoneid) 21485 { 21486 ipha_t *ipha = NULL; 21487 ip6_t *ip6h = NULL; 21488 ushort_t len; 21489 tcph_t *tcph; 21490 int i; 21491 mblk_t *ipsec_mp; 21492 boolean_t mctl_present; 21493 ipic_t *ipic; 21494 ipaddr_t v4addr; 21495 in6_addr_t v6addr; 21496 int addr_len; 21497 void *addr; 21498 queue_t *q = tcp_g_q; 21499 tcp_t *tcp = Q_TO_TCP(q); 21500 cred_t *cr; 21501 mblk_t *nmp; 21502 21503 if (!tcp_send_rst_chk()) { 21504 tcp_rst_unsent++; 21505 freemsg(mp); 21506 return; 21507 } 21508 21509 if (mp->b_datap->db_type == M_CTL) { 21510 ipsec_mp = mp; 21511 mp = mp->b_cont; 21512 mctl_present = B_TRUE; 21513 } else { 21514 ipsec_mp = mp; 21515 mctl_present = B_FALSE; 21516 } 21517 21518 if (str && q && tcp_dbg) { 21519 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 21520 "tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, " 21521 "flags 0x%x", 21522 str, seq, ack, ctl); 21523 } 21524 if (mp->b_datap->db_ref != 1) { 21525 mblk_t *mp1 = copyb(mp); 21526 freemsg(mp); 21527 mp = mp1; 21528 if (!mp) { 21529 if (mctl_present) 21530 freeb(ipsec_mp); 21531 return; 21532 } else { 21533 if (mctl_present) { 21534 ipsec_mp->b_cont = mp; 21535 } else { 21536 ipsec_mp = mp; 21537 } 21538 } 21539 } else if (mp->b_cont) { 21540 freemsg(mp->b_cont); 21541 mp->b_cont = NULL; 21542 } 21543 /* 21544 * We skip reversing source route here. 21545 * (for now we replace all IP options with EOL) 21546 */ 21547 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21548 ipha = (ipha_t *)mp->b_rptr; 21549 for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++) 21550 mp->b_rptr[i] = IPOPT_EOL; 21551 /* 21552 * Make sure that src address isn't flagrantly invalid. 21553 * Not all broadcast address checking for the src address 21554 * is possible, since we don't know the netmask of the src 21555 * addr. No check for destination address is done, since 21556 * IP will not pass up a packet with a broadcast dest 21557 * address to TCP. Similar checks are done below for IPv6. 21558 */ 21559 if (ipha->ipha_src == 0 || ipha->ipha_src == INADDR_BROADCAST || 21560 CLASSD(ipha->ipha_src)) { 21561 freemsg(ipsec_mp); 21562 BUMP_MIB(&ip_mib, ipInDiscards); 21563 return; 21564 } 21565 } else { 21566 ip6h = (ip6_t *)mp->b_rptr; 21567 21568 if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) || 21569 IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src)) { 21570 freemsg(ipsec_mp); 21571 BUMP_MIB(&ip6_mib, ipv6InDiscards); 21572 return; 21573 } 21574 21575 /* Remove any extension headers assuming partial overlay */ 21576 if (ip_hdr_len > IPV6_HDR_LEN) { 21577 uint8_t *to; 21578 21579 to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN; 21580 ovbcopy(ip6h, to, IPV6_HDR_LEN); 21581 mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN; 21582 ip_hdr_len = IPV6_HDR_LEN; 21583 ip6h = (ip6_t *)mp->b_rptr; 21584 ip6h->ip6_nxt = IPPROTO_TCP; 21585 } 21586 } 21587 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 21588 if (tcph->th_flags[0] & TH_RST) { 21589 freemsg(ipsec_mp); 21590 return; 21591 } 21592 tcph->th_offset_and_rsrvd[0] = (5 << 4); 21593 len = ip_hdr_len + sizeof (tcph_t); 21594 mp->b_wptr = &mp->b_rptr[len]; 21595 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21596 ipha->ipha_length = htons(len); 21597 /* Swap addresses */ 21598 v4addr = ipha->ipha_src; 21599 ipha->ipha_src = ipha->ipha_dst; 21600 ipha->ipha_dst = v4addr; 21601 ipha->ipha_ident = 0; 21602 ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 21603 addr_len = IP_ADDR_LEN; 21604 addr = &v4addr; 21605 } else { 21606 /* No ip6i_t in this case */ 21607 ip6h->ip6_plen = htons(len - IPV6_HDR_LEN); 21608 /* Swap addresses */ 21609 v6addr = ip6h->ip6_src; 21610 ip6h->ip6_src = ip6h->ip6_dst; 21611 ip6h->ip6_dst = v6addr; 21612 ip6h->ip6_hops = (uchar_t)tcp_ipv6_hoplimit; 21613 addr_len = IPV6_ADDR_LEN; 21614 addr = &v6addr; 21615 } 21616 tcp_xchg(tcph->th_fport, tcph->th_lport, 2); 21617 U32_TO_BE32(ack, tcph->th_ack); 21618 U32_TO_BE32(seq, tcph->th_seq); 21619 U16_TO_BE16(0, tcph->th_win); 21620 U16_TO_BE16(sizeof (tcph_t), tcph->th_sum); 21621 tcph->th_flags[0] = (uint8_t)ctl; 21622 if (ctl & TH_RST) { 21623 BUMP_MIB(&tcp_mib, tcpOutRsts); 21624 BUMP_MIB(&tcp_mib, tcpOutControl); 21625 } 21626 21627 /* IP trusts us to set up labels when required. */ 21628 if (is_system_labeled() && (cr = DB_CRED(mp)) != NULL && 21629 crgetlabel(cr) != NULL) { 21630 int err, adjust; 21631 21632 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) 21633 err = tsol_check_label(cr, &mp, &adjust, 21634 tcp->tcp_connp->conn_mac_exempt); 21635 else 21636 err = tsol_check_label_v6(cr, &mp, &adjust, 21637 tcp->tcp_connp->conn_mac_exempt); 21638 if (mctl_present) 21639 ipsec_mp->b_cont = mp; 21640 else 21641 ipsec_mp = mp; 21642 if (err != 0) { 21643 freemsg(ipsec_mp); 21644 return; 21645 } 21646 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21647 ipha = (ipha_t *)mp->b_rptr; 21648 adjust += ntohs(ipha->ipha_length); 21649 ipha->ipha_length = htons(adjust); 21650 } else { 21651 ip6h = (ip6_t *)mp->b_rptr; 21652 } 21653 } 21654 21655 if (mctl_present) { 21656 ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr; 21657 21658 ASSERT(ii->ipsec_in_type == IPSEC_IN); 21659 if (!ipsec_in_to_out(ipsec_mp, ipha, ip6h)) { 21660 return; 21661 } 21662 } 21663 if (zoneid == ALL_ZONES) 21664 zoneid = GLOBAL_ZONEID; 21665 21666 /* Add the zoneid so ip_output routes it properly */ 21667 if ((nmp = ip_prepend_zoneid(ipsec_mp, zoneid)) == NULL) { 21668 freemsg(ipsec_mp); 21669 return; 21670 } 21671 ipsec_mp = nmp; 21672 21673 /* 21674 * NOTE: one might consider tracing a TCP packet here, but 21675 * this function has no active TCP state and no tcp structure 21676 * that has a trace buffer. If we traced here, we would have 21677 * to keep a local trace buffer in tcp_record_trace(). 21678 * 21679 * TSol note: The mblk that contains the incoming packet was 21680 * reused by tcp_xmit_listener_reset, so it already contains 21681 * the right credentials and we don't need to call mblk_setcred. 21682 * Also the conn's cred is not right since it is associated 21683 * with tcp_g_q. 21684 */ 21685 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, ipsec_mp); 21686 21687 /* 21688 * Tell IP to mark the IRE used for this destination temporary. 21689 * This way, we can limit our exposure to DoS attack because IP 21690 * creates an IRE for each destination. If there are too many, 21691 * the time to do any routing lookup will be extremely long. And 21692 * the lookup can be in interrupt context. 21693 * 21694 * Note that in normal circumstances, this marking should not 21695 * affect anything. It would be nice if only 1 message is 21696 * needed to inform IP that the IRE created for this RST should 21697 * not be added to the cache table. But there is currently 21698 * not such communication mechanism between TCP and IP. So 21699 * the best we can do now is to send the advice ioctl to IP 21700 * to mark the IRE temporary. 21701 */ 21702 if ((mp = tcp_ip_advise_mblk(addr, addr_len, &ipic)) != NULL) { 21703 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21704 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21705 } 21706 } 21707 21708 /* 21709 * Initiate closedown sequence on an active connection. (May be called as 21710 * writer.) Return value zero for OK return, non-zero for error return. 21711 */ 21712 static int 21713 tcp_xmit_end(tcp_t *tcp) 21714 { 21715 ipic_t *ipic; 21716 mblk_t *mp; 21717 21718 if (tcp->tcp_state < TCPS_SYN_RCVD || 21719 tcp->tcp_state > TCPS_CLOSE_WAIT) { 21720 /* 21721 * Invalid state, only states TCPS_SYN_RCVD, 21722 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid 21723 */ 21724 return (-1); 21725 } 21726 21727 tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent; 21728 tcp->tcp_valid_bits |= TCP_FSS_VALID; 21729 /* 21730 * If there is nothing more unsent, send the FIN now. 21731 * Otherwise, it will go out with the last segment. 21732 */ 21733 if (tcp->tcp_unsent == 0) { 21734 mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 21735 tcp->tcp_fss, B_FALSE, NULL, B_FALSE); 21736 21737 if (mp) { 21738 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21739 tcp_send_data(tcp, tcp->tcp_wq, mp); 21740 } else { 21741 /* 21742 * Couldn't allocate msg. Pretend we got it out. 21743 * Wait for rexmit timeout. 21744 */ 21745 tcp->tcp_snxt = tcp->tcp_fss + 1; 21746 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 21747 } 21748 21749 /* 21750 * If needed, update tcp_rexmit_snxt as tcp_snxt is 21751 * changed. 21752 */ 21753 if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) { 21754 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 21755 } 21756 } else { 21757 /* 21758 * If tcp->tcp_cork is set, then the data will not get sent, 21759 * so we have to check that and unset it first. 21760 */ 21761 if (tcp->tcp_cork) 21762 tcp->tcp_cork = B_FALSE; 21763 tcp_wput_data(tcp, NULL, B_FALSE); 21764 } 21765 21766 /* 21767 * If TCP does not get enough samples of RTT or tcp_rtt_updates 21768 * is 0, don't update the cache. 21769 */ 21770 if (tcp_rtt_updates == 0 || tcp->tcp_rtt_update < tcp_rtt_updates) 21771 return (0); 21772 21773 /* 21774 * NOTE: should not update if source routes i.e. if tcp_remote if 21775 * different from the destination. 21776 */ 21777 if (tcp->tcp_ipversion == IPV4_VERSION) { 21778 if (tcp->tcp_remote != tcp->tcp_ipha->ipha_dst) { 21779 return (0); 21780 } 21781 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21782 &ipic); 21783 } else { 21784 if (!(IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6, 21785 &tcp->tcp_ip6h->ip6_dst))) { 21786 return (0); 21787 } 21788 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21789 &ipic); 21790 } 21791 21792 /* Record route attributes in the IRE for use by future connections. */ 21793 if (mp == NULL) 21794 return (0); 21795 21796 /* 21797 * We do not have a good algorithm to update ssthresh at this time. 21798 * So don't do any update. 21799 */ 21800 ipic->ipic_rtt = tcp->tcp_rtt_sa; 21801 ipic->ipic_rtt_sd = tcp->tcp_rtt_sd; 21802 21803 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21804 return (0); 21805 } 21806 21807 /* 21808 * Generate a "no listener here" RST in response to an "unknown" segment. 21809 * Note that we are reusing the incoming mp to construct the outgoing 21810 * RST. 21811 */ 21812 void 21813 tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len, zoneid_t zoneid) 21814 { 21815 uchar_t *rptr; 21816 uint32_t seg_len; 21817 tcph_t *tcph; 21818 uint32_t seg_seq; 21819 uint32_t seg_ack; 21820 uint_t flags; 21821 mblk_t *ipsec_mp; 21822 ipha_t *ipha; 21823 ip6_t *ip6h; 21824 boolean_t mctl_present = B_FALSE; 21825 boolean_t check = B_TRUE; 21826 boolean_t policy_present; 21827 21828 TCP_STAT(tcp_no_listener); 21829 21830 ipsec_mp = mp; 21831 21832 if (mp->b_datap->db_type == M_CTL) { 21833 ipsec_in_t *ii; 21834 21835 mctl_present = B_TRUE; 21836 mp = mp->b_cont; 21837 21838 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 21839 ASSERT(ii->ipsec_in_type == IPSEC_IN); 21840 if (ii->ipsec_in_dont_check) { 21841 check = B_FALSE; 21842 if (!ii->ipsec_in_secure) { 21843 freeb(ipsec_mp); 21844 mctl_present = B_FALSE; 21845 ipsec_mp = mp; 21846 } 21847 } 21848 } 21849 21850 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21851 policy_present = ipsec_inbound_v4_policy_present; 21852 ipha = (ipha_t *)mp->b_rptr; 21853 ip6h = NULL; 21854 } else { 21855 policy_present = ipsec_inbound_v6_policy_present; 21856 ipha = NULL; 21857 ip6h = (ip6_t *)mp->b_rptr; 21858 } 21859 21860 if (check && policy_present) { 21861 /* 21862 * The conn_t parameter is NULL because we already know 21863 * nobody's home. 21864 */ 21865 ipsec_mp = ipsec_check_global_policy( 21866 ipsec_mp, (conn_t *)NULL, ipha, ip6h, mctl_present); 21867 if (ipsec_mp == NULL) 21868 return; 21869 } 21870 if (is_system_labeled() && !tsol_can_reply_error(mp)) { 21871 DTRACE_PROBE2( 21872 tx__ip__log__error__nolistener__tcp, 21873 char *, "Could not reply with RST to mp(1)", 21874 mblk_t *, mp); 21875 ip2dbg(("tcp_xmit_listeners_reset: not permitted to reply\n")); 21876 freemsg(ipsec_mp); 21877 return; 21878 } 21879 21880 rptr = mp->b_rptr; 21881 21882 tcph = (tcph_t *)&rptr[ip_hdr_len]; 21883 seg_seq = BE32_TO_U32(tcph->th_seq); 21884 seg_ack = BE32_TO_U32(tcph->th_ack); 21885 flags = tcph->th_flags[0]; 21886 21887 seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcph) + ip_hdr_len); 21888 if (flags & TH_RST) { 21889 freemsg(ipsec_mp); 21890 } else if (flags & TH_ACK) { 21891 tcp_xmit_early_reset("no tcp, reset", 21892 ipsec_mp, seg_ack, 0, TH_RST, ip_hdr_len, zoneid); 21893 } else { 21894 if (flags & TH_SYN) { 21895 seg_len++; 21896 } else { 21897 /* 21898 * Here we violate the RFC. Note that a normal 21899 * TCP will never send a segment without the ACK 21900 * flag, except for RST or SYN segment. This 21901 * segment is neither. Just drop it on the 21902 * floor. 21903 */ 21904 freemsg(ipsec_mp); 21905 tcp_rst_unsent++; 21906 return; 21907 } 21908 21909 tcp_xmit_early_reset("no tcp, reset/ack", 21910 ipsec_mp, 0, seg_seq + seg_len, 21911 TH_RST | TH_ACK, ip_hdr_len, zoneid); 21912 } 21913 } 21914 21915 /* 21916 * tcp_xmit_mp is called to return a pointer to an mblk chain complete with 21917 * ip and tcp header ready to pass down to IP. If the mp passed in is 21918 * non-NULL, then up to max_to_send bytes of data will be dup'ed off that 21919 * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary 21920 * otherwise it will dup partial mblks.) 21921 * Otherwise, an appropriate ACK packet will be generated. This 21922 * routine is not usually called to send new data for the first time. It 21923 * is mostly called out of the timer for retransmits, and to generate ACKs. 21924 * 21925 * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will 21926 * be adjusted by *offset. And after dupb(), the offset and the ending mblk 21927 * of the original mblk chain will be returned in *offset and *end_mp. 21928 */ 21929 static mblk_t * 21930 tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset, 21931 mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len, 21932 boolean_t rexmit) 21933 { 21934 int data_length; 21935 int32_t off = 0; 21936 uint_t flags; 21937 mblk_t *mp1; 21938 mblk_t *mp2; 21939 uchar_t *rptr; 21940 tcph_t *tcph; 21941 int32_t num_sack_blk = 0; 21942 int32_t sack_opt_len = 0; 21943 21944 /* Allocate for our maximum TCP header + link-level */ 21945 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 21946 BPRI_MED); 21947 if (!mp1) 21948 return (NULL); 21949 data_length = 0; 21950 21951 /* 21952 * Note that tcp_mss has been adjusted to take into account the 21953 * timestamp option if applicable. Because SACK options do not 21954 * appear in every TCP segments and they are of variable lengths, 21955 * they cannot be included in tcp_mss. Thus we need to calculate 21956 * the actual segment length when we need to send a segment which 21957 * includes SACK options. 21958 */ 21959 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 21960 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 21961 tcp->tcp_num_sack_blk); 21962 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 21963 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 21964 if (max_to_send + sack_opt_len > tcp->tcp_mss) 21965 max_to_send -= sack_opt_len; 21966 } 21967 21968 if (offset != NULL) { 21969 off = *offset; 21970 /* We use offset as an indicator that end_mp is not NULL. */ 21971 *end_mp = NULL; 21972 } 21973 for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) { 21974 /* This could be faster with cooperation from downstream */ 21975 if (mp2 != mp1 && !sendall && 21976 data_length + (int)(mp->b_wptr - mp->b_rptr) > 21977 max_to_send) 21978 /* 21979 * Don't send the next mblk since the whole mblk 21980 * does not fit. 21981 */ 21982 break; 21983 mp2->b_cont = dupb(mp); 21984 mp2 = mp2->b_cont; 21985 if (!mp2) { 21986 freemsg(mp1); 21987 return (NULL); 21988 } 21989 mp2->b_rptr += off; 21990 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 21991 (uintptr_t)INT_MAX); 21992 21993 data_length += (int)(mp2->b_wptr - mp2->b_rptr); 21994 if (data_length > max_to_send) { 21995 mp2->b_wptr -= data_length - max_to_send; 21996 data_length = max_to_send; 21997 off = mp2->b_wptr - mp->b_rptr; 21998 break; 21999 } else { 22000 off = 0; 22001 } 22002 } 22003 if (offset != NULL) { 22004 *offset = off; 22005 *end_mp = mp; 22006 } 22007 if (seg_len != NULL) { 22008 *seg_len = data_length; 22009 } 22010 22011 /* Update the latest receive window size in TCP header. */ 22012 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22013 tcp->tcp_tcph->th_win); 22014 22015 rptr = mp1->b_rptr + tcp_wroff_xtra; 22016 mp1->b_rptr = rptr; 22017 mp1->b_wptr = rptr + tcp->tcp_hdr_len + sack_opt_len; 22018 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22019 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22020 U32_TO_ABE32(seq, tcph->th_seq); 22021 22022 /* 22023 * Use tcp_unsent to determine if the PUSH bit should be used assumes 22024 * that this function was called from tcp_wput_data. Thus, when called 22025 * to retransmit data the setting of the PUSH bit may appear some 22026 * what random in that it might get set when it should not. This 22027 * should not pose any performance issues. 22028 */ 22029 if (data_length != 0 && (tcp->tcp_unsent == 0 || 22030 tcp->tcp_unsent == data_length)) { 22031 flags = TH_ACK | TH_PUSH; 22032 } else { 22033 flags = TH_ACK; 22034 } 22035 22036 if (tcp->tcp_ecn_ok) { 22037 if (tcp->tcp_ecn_echo_on) 22038 flags |= TH_ECE; 22039 22040 /* 22041 * Only set ECT bit and ECN_CWR if a segment contains new data. 22042 * There is no TCP flow control for non-data segments, and 22043 * only data segment is transmitted reliably. 22044 */ 22045 if (data_length > 0 && !rexmit) { 22046 SET_ECT(tcp, rptr); 22047 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 22048 flags |= TH_CWR; 22049 tcp->tcp_ecn_cwr_sent = B_TRUE; 22050 } 22051 } 22052 } 22053 22054 if (tcp->tcp_valid_bits) { 22055 uint32_t u1; 22056 22057 if ((tcp->tcp_valid_bits & TCP_ISS_VALID) && 22058 seq == tcp->tcp_iss) { 22059 uchar_t *wptr; 22060 22061 /* 22062 * If TCP_ISS_VALID and the seq number is tcp_iss, 22063 * TCP can only be in SYN-SENT, SYN-RCVD or 22064 * FIN-WAIT-1 state. It can be FIN-WAIT-1 if 22065 * our SYN is not ack'ed but the app closes this 22066 * TCP connection. 22067 */ 22068 ASSERT(tcp->tcp_state == TCPS_SYN_SENT || 22069 tcp->tcp_state == TCPS_SYN_RCVD || 22070 tcp->tcp_state == TCPS_FIN_WAIT_1); 22071 22072 /* 22073 * Tack on the MSS option. It is always needed 22074 * for both active and passive open. 22075 * 22076 * MSS option value should be interface MTU - MIN 22077 * TCP/IP header according to RFC 793 as it means 22078 * the maximum segment size TCP can receive. But 22079 * to get around some broken middle boxes/end hosts 22080 * out there, we allow the option value to be the 22081 * same as the MSS option size on the peer side. 22082 * In this way, the other side will not send 22083 * anything larger than they can receive. 22084 * 22085 * Note that for SYN_SENT state, the ndd param 22086 * tcp_use_smss_as_mss_opt has no effect as we 22087 * don't know the peer's MSS option value. So 22088 * the only case we need to take care of is in 22089 * SYN_RCVD state, which is done later. 22090 */ 22091 wptr = mp1->b_wptr; 22092 wptr[0] = TCPOPT_MAXSEG; 22093 wptr[1] = TCPOPT_MAXSEG_LEN; 22094 wptr += 2; 22095 u1 = tcp->tcp_if_mtu - 22096 (tcp->tcp_ipversion == IPV4_VERSION ? 22097 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) - 22098 TCP_MIN_HEADER_LENGTH; 22099 U16_TO_BE16(u1, wptr); 22100 mp1->b_wptr = wptr + 2; 22101 /* Update the offset to cover the additional word */ 22102 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22103 22104 /* 22105 * Note that the following way of filling in 22106 * TCP options are not optimal. Some NOPs can 22107 * be saved. But there is no need at this time 22108 * to optimize it. When it is needed, we will 22109 * do it. 22110 */ 22111 switch (tcp->tcp_state) { 22112 case TCPS_SYN_SENT: 22113 flags = TH_SYN; 22114 22115 if (tcp->tcp_snd_ts_ok) { 22116 uint32_t llbolt = (uint32_t)lbolt; 22117 22118 wptr = mp1->b_wptr; 22119 wptr[0] = TCPOPT_NOP; 22120 wptr[1] = TCPOPT_NOP; 22121 wptr[2] = TCPOPT_TSTAMP; 22122 wptr[3] = TCPOPT_TSTAMP_LEN; 22123 wptr += 4; 22124 U32_TO_BE32(llbolt, wptr); 22125 wptr += 4; 22126 ASSERT(tcp->tcp_ts_recent == 0); 22127 U32_TO_BE32(0L, wptr); 22128 mp1->b_wptr += TCPOPT_REAL_TS_LEN; 22129 tcph->th_offset_and_rsrvd[0] += 22130 (3 << 4); 22131 } 22132 22133 /* 22134 * Set up all the bits to tell other side 22135 * we are ECN capable. 22136 */ 22137 if (tcp->tcp_ecn_ok) { 22138 flags |= (TH_ECE | TH_CWR); 22139 } 22140 break; 22141 case TCPS_SYN_RCVD: 22142 flags |= TH_SYN; 22143 22144 /* 22145 * Reset the MSS option value to be SMSS 22146 * We should probably add back the bytes 22147 * for timestamp option and IPsec. We 22148 * don't do that as this is a workaround 22149 * for broken middle boxes/end hosts, it 22150 * is better for us to be more cautious. 22151 * They may not take these things into 22152 * account in their SMSS calculation. Thus 22153 * the peer's calculated SMSS may be smaller 22154 * than what it can be. This should be OK. 22155 */ 22156 if (tcp_use_smss_as_mss_opt) { 22157 u1 = tcp->tcp_mss; 22158 U16_TO_BE16(u1, wptr); 22159 } 22160 22161 /* 22162 * If the other side is ECN capable, reply 22163 * that we are also ECN capable. 22164 */ 22165 if (tcp->tcp_ecn_ok) 22166 flags |= TH_ECE; 22167 break; 22168 default: 22169 /* 22170 * The above ASSERT() makes sure that this 22171 * must be FIN-WAIT-1 state. Our SYN has 22172 * not been ack'ed so retransmit it. 22173 */ 22174 flags |= TH_SYN; 22175 break; 22176 } 22177 22178 if (tcp->tcp_snd_ws_ok) { 22179 wptr = mp1->b_wptr; 22180 wptr[0] = TCPOPT_NOP; 22181 wptr[1] = TCPOPT_WSCALE; 22182 wptr[2] = TCPOPT_WS_LEN; 22183 wptr[3] = (uchar_t)tcp->tcp_rcv_ws; 22184 mp1->b_wptr += TCPOPT_REAL_WS_LEN; 22185 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22186 } 22187 22188 if (tcp->tcp_snd_sack_ok) { 22189 wptr = mp1->b_wptr; 22190 wptr[0] = TCPOPT_NOP; 22191 wptr[1] = TCPOPT_NOP; 22192 wptr[2] = TCPOPT_SACK_PERMITTED; 22193 wptr[3] = TCPOPT_SACK_OK_LEN; 22194 mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN; 22195 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22196 } 22197 22198 /* allocb() of adequate mblk assures space */ 22199 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 22200 (uintptr_t)INT_MAX); 22201 u1 = (int)(mp1->b_wptr - mp1->b_rptr); 22202 /* 22203 * Get IP set to checksum on our behalf 22204 * Include the adjustment for a source route if any. 22205 */ 22206 u1 += tcp->tcp_sum; 22207 u1 = (u1 >> 16) + (u1 & 0xFFFF); 22208 U16_TO_BE16(u1, tcph->th_sum); 22209 BUMP_MIB(&tcp_mib, tcpOutControl); 22210 } 22211 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 22212 (seq + data_length) == tcp->tcp_fss) { 22213 if (!tcp->tcp_fin_acked) { 22214 flags |= TH_FIN; 22215 BUMP_MIB(&tcp_mib, tcpOutControl); 22216 } 22217 if (!tcp->tcp_fin_sent) { 22218 tcp->tcp_fin_sent = B_TRUE; 22219 switch (tcp->tcp_state) { 22220 case TCPS_SYN_RCVD: 22221 case TCPS_ESTABLISHED: 22222 tcp->tcp_state = TCPS_FIN_WAIT_1; 22223 break; 22224 case TCPS_CLOSE_WAIT: 22225 tcp->tcp_state = TCPS_LAST_ACK; 22226 break; 22227 } 22228 if (tcp->tcp_suna == tcp->tcp_snxt) 22229 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 22230 tcp->tcp_snxt = tcp->tcp_fss + 1; 22231 } 22232 } 22233 /* 22234 * Note the trick here. u1 is unsigned. When tcp_urg 22235 * is smaller than seq, u1 will become a very huge value. 22236 * So the comparison will fail. Also note that tcp_urp 22237 * should be positive, see RFC 793 page 17. 22238 */ 22239 u1 = tcp->tcp_urg - seq + TCP_OLD_URP_INTERPRETATION; 22240 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && u1 != 0 && 22241 u1 < (uint32_t)(64 * 1024)) { 22242 flags |= TH_URG; 22243 BUMP_MIB(&tcp_mib, tcpOutUrg); 22244 U32_TO_ABE16(u1, tcph->th_urp); 22245 } 22246 } 22247 tcph->th_flags[0] = (uchar_t)flags; 22248 tcp->tcp_rack = tcp->tcp_rnxt; 22249 tcp->tcp_rack_cnt = 0; 22250 22251 if (tcp->tcp_snd_ts_ok) { 22252 if (tcp->tcp_state != TCPS_SYN_SENT) { 22253 uint32_t llbolt = (uint32_t)lbolt; 22254 22255 U32_TO_BE32(llbolt, 22256 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22257 U32_TO_BE32(tcp->tcp_ts_recent, 22258 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22259 } 22260 } 22261 22262 if (num_sack_blk > 0) { 22263 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22264 sack_blk_t *tmp; 22265 int32_t i; 22266 22267 wptr[0] = TCPOPT_NOP; 22268 wptr[1] = TCPOPT_NOP; 22269 wptr[2] = TCPOPT_SACK; 22270 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22271 sizeof (sack_blk_t); 22272 wptr += TCPOPT_REAL_SACK_LEN; 22273 22274 tmp = tcp->tcp_sack_list; 22275 for (i = 0; i < num_sack_blk; i++) { 22276 U32_TO_BE32(tmp[i].begin, wptr); 22277 wptr += sizeof (tcp_seq); 22278 U32_TO_BE32(tmp[i].end, wptr); 22279 wptr += sizeof (tcp_seq); 22280 } 22281 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) << 4); 22282 } 22283 ASSERT((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX); 22284 data_length += (int)(mp1->b_wptr - rptr); 22285 if (tcp->tcp_ipversion == IPV4_VERSION) { 22286 ((ipha_t *)rptr)->ipha_length = htons(data_length); 22287 } else { 22288 ip6_t *ip6 = (ip6_t *)(rptr + 22289 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22290 sizeof (ip6i_t) : 0)); 22291 22292 ip6->ip6_plen = htons(data_length - 22293 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22294 } 22295 22296 /* 22297 * Prime pump for IP 22298 * Include the adjustment for a source route if any. 22299 */ 22300 data_length -= tcp->tcp_ip_hdr_len; 22301 data_length += tcp->tcp_sum; 22302 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22303 U16_TO_ABE16(data_length, tcph->th_sum); 22304 if (tcp->tcp_ip_forward_progress) { 22305 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22306 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22307 tcp->tcp_ip_forward_progress = B_FALSE; 22308 } 22309 return (mp1); 22310 } 22311 22312 /* This function handles the push timeout. */ 22313 void 22314 tcp_push_timer(void *arg) 22315 { 22316 conn_t *connp = (conn_t *)arg; 22317 tcp_t *tcp = connp->conn_tcp; 22318 22319 TCP_DBGSTAT(tcp_push_timer_cnt); 22320 22321 ASSERT(tcp->tcp_listener == NULL); 22322 22323 /* 22324 * We need to plug synchronous streams during our drain to prevent 22325 * a race with tcp_fuse_rrw() or tcp_fusion_rinfop(). 22326 */ 22327 TCP_FUSE_SYNCSTR_PLUG_DRAIN(tcp); 22328 tcp->tcp_push_tid = 0; 22329 if ((tcp->tcp_rcv_list != NULL) && 22330 (tcp_rcv_drain(tcp->tcp_rq, tcp) == TH_ACK_NEEDED)) 22331 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 22332 TCP_FUSE_SYNCSTR_UNPLUG_DRAIN(tcp); 22333 } 22334 22335 /* 22336 * This function handles delayed ACK timeout. 22337 */ 22338 static void 22339 tcp_ack_timer(void *arg) 22340 { 22341 conn_t *connp = (conn_t *)arg; 22342 tcp_t *tcp = connp->conn_tcp; 22343 mblk_t *mp; 22344 22345 TCP_DBGSTAT(tcp_ack_timer_cnt); 22346 22347 tcp->tcp_ack_tid = 0; 22348 22349 if (tcp->tcp_fused) 22350 return; 22351 22352 /* 22353 * Do not send ACK if there is no outstanding unack'ed data. 22354 */ 22355 if (tcp->tcp_rnxt == tcp->tcp_rack) { 22356 return; 22357 } 22358 22359 if ((tcp->tcp_rnxt - tcp->tcp_rack) > tcp->tcp_mss) { 22360 /* 22361 * Make sure we don't allow deferred ACKs to result in 22362 * timer-based ACKing. If we have held off an ACK 22363 * when there was more than an mss here, and the timer 22364 * goes off, we have to worry about the possibility 22365 * that the sender isn't doing slow-start, or is out 22366 * of step with us for some other reason. We fall 22367 * permanently back in the direction of 22368 * ACK-every-other-packet as suggested in RFC 1122. 22369 */ 22370 if (tcp->tcp_rack_abs_max > 2) 22371 tcp->tcp_rack_abs_max--; 22372 tcp->tcp_rack_cur_max = 2; 22373 } 22374 mp = tcp_ack_mp(tcp); 22375 22376 if (mp != NULL) { 22377 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 22378 BUMP_LOCAL(tcp->tcp_obsegs); 22379 BUMP_MIB(&tcp_mib, tcpOutAck); 22380 BUMP_MIB(&tcp_mib, tcpOutAckDelayed); 22381 tcp_send_data(tcp, tcp->tcp_wq, mp); 22382 } 22383 } 22384 22385 22386 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 22387 static mblk_t * 22388 tcp_ack_mp(tcp_t *tcp) 22389 { 22390 uint32_t seq_no; 22391 22392 /* 22393 * There are a few cases to be considered while setting the sequence no. 22394 * Essentially, we can come here while processing an unacceptable pkt 22395 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 22396 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 22397 * If we are here for a zero window probe, stick with suna. In all 22398 * other cases, we check if suna + swnd encompasses snxt and set 22399 * the sequence number to snxt, if so. If snxt falls outside the 22400 * window (the receiver probably shrunk its window), we will go with 22401 * suna + swnd, otherwise the sequence no will be unacceptable to the 22402 * receiver. 22403 */ 22404 if (tcp->tcp_zero_win_probe) { 22405 seq_no = tcp->tcp_suna; 22406 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 22407 ASSERT(tcp->tcp_swnd == 0); 22408 seq_no = tcp->tcp_snxt; 22409 } else { 22410 seq_no = SEQ_GT(tcp->tcp_snxt, 22411 (tcp->tcp_suna + tcp->tcp_swnd)) ? 22412 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 22413 } 22414 22415 if (tcp->tcp_valid_bits) { 22416 /* 22417 * For the complex case where we have to send some 22418 * controls (FIN or SYN), let tcp_xmit_mp do it. 22419 */ 22420 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 22421 NULL, B_FALSE)); 22422 } else { 22423 /* Generate a simple ACK */ 22424 int data_length; 22425 uchar_t *rptr; 22426 tcph_t *tcph; 22427 mblk_t *mp1; 22428 int32_t tcp_hdr_len; 22429 int32_t tcp_tcp_hdr_len; 22430 int32_t num_sack_blk = 0; 22431 int32_t sack_opt_len; 22432 22433 /* 22434 * Allocate space for TCP + IP headers 22435 * and link-level header 22436 */ 22437 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 22438 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 22439 tcp->tcp_num_sack_blk); 22440 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 22441 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 22442 tcp_hdr_len = tcp->tcp_hdr_len + sack_opt_len; 22443 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + sack_opt_len; 22444 } else { 22445 tcp_hdr_len = tcp->tcp_hdr_len; 22446 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 22447 } 22448 mp1 = allocb(tcp_hdr_len + tcp_wroff_xtra, BPRI_MED); 22449 if (!mp1) 22450 return (NULL); 22451 22452 /* Update the latest receive window size in TCP header. */ 22453 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22454 tcp->tcp_tcph->th_win); 22455 /* copy in prototype TCP + IP header */ 22456 rptr = mp1->b_rptr + tcp_wroff_xtra; 22457 mp1->b_rptr = rptr; 22458 mp1->b_wptr = rptr + tcp_hdr_len; 22459 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22460 22461 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22462 22463 /* Set the TCP sequence number. */ 22464 U32_TO_ABE32(seq_no, tcph->th_seq); 22465 22466 /* Set up the TCP flag field. */ 22467 tcph->th_flags[0] = (uchar_t)TH_ACK; 22468 if (tcp->tcp_ecn_echo_on) 22469 tcph->th_flags[0] |= TH_ECE; 22470 22471 tcp->tcp_rack = tcp->tcp_rnxt; 22472 tcp->tcp_rack_cnt = 0; 22473 22474 /* fill in timestamp option if in use */ 22475 if (tcp->tcp_snd_ts_ok) { 22476 uint32_t llbolt = (uint32_t)lbolt; 22477 22478 U32_TO_BE32(llbolt, 22479 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22480 U32_TO_BE32(tcp->tcp_ts_recent, 22481 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22482 } 22483 22484 /* Fill in SACK options */ 22485 if (num_sack_blk > 0) { 22486 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22487 sack_blk_t *tmp; 22488 int32_t i; 22489 22490 wptr[0] = TCPOPT_NOP; 22491 wptr[1] = TCPOPT_NOP; 22492 wptr[2] = TCPOPT_SACK; 22493 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22494 sizeof (sack_blk_t); 22495 wptr += TCPOPT_REAL_SACK_LEN; 22496 22497 tmp = tcp->tcp_sack_list; 22498 for (i = 0; i < num_sack_blk; i++) { 22499 U32_TO_BE32(tmp[i].begin, wptr); 22500 wptr += sizeof (tcp_seq); 22501 U32_TO_BE32(tmp[i].end, wptr); 22502 wptr += sizeof (tcp_seq); 22503 } 22504 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) 22505 << 4); 22506 } 22507 22508 if (tcp->tcp_ipversion == IPV4_VERSION) { 22509 ((ipha_t *)rptr)->ipha_length = htons(tcp_hdr_len); 22510 } else { 22511 /* Check for ip6i_t header in sticky hdrs */ 22512 ip6_t *ip6 = (ip6_t *)(rptr + 22513 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22514 sizeof (ip6i_t) : 0)); 22515 22516 ip6->ip6_plen = htons(tcp_hdr_len - 22517 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22518 } 22519 22520 /* 22521 * Prime pump for checksum calculation in IP. Include the 22522 * adjustment for a source route if any. 22523 */ 22524 data_length = tcp_tcp_hdr_len + tcp->tcp_sum; 22525 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22526 U16_TO_ABE16(data_length, tcph->th_sum); 22527 22528 if (tcp->tcp_ip_forward_progress) { 22529 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22530 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22531 tcp->tcp_ip_forward_progress = B_FALSE; 22532 } 22533 return (mp1); 22534 } 22535 } 22536 22537 /* 22538 * To create a temporary tcp structure for inserting into bind hash list. 22539 * The parameter is assumed to be in network byte order, ready for use. 22540 */ 22541 /* ARGSUSED */ 22542 static tcp_t * 22543 tcp_alloc_temp_tcp(in_port_t port) 22544 { 22545 conn_t *connp; 22546 tcp_t *tcp; 22547 22548 connp = ipcl_conn_create(IPCL_TCPCONN, KM_SLEEP); 22549 if (connp == NULL) 22550 return (NULL); 22551 22552 tcp = connp->conn_tcp; 22553 22554 /* 22555 * Only initialize the necessary info in those structures. Note 22556 * that since INADDR_ANY is all 0, we do not need to set 22557 * tcp_bound_source to INADDR_ANY here. 22558 */ 22559 tcp->tcp_state = TCPS_BOUND; 22560 tcp->tcp_lport = port; 22561 tcp->tcp_exclbind = 1; 22562 tcp->tcp_reserved_port = 1; 22563 22564 /* Just for place holding... */ 22565 tcp->tcp_ipversion = IPV4_VERSION; 22566 22567 return (tcp); 22568 } 22569 22570 /* 22571 * To remove a port range specified by lo_port and hi_port from the 22572 * reserved port ranges. This is one of the three public functions of 22573 * the reserved port interface. Note that a port range has to be removed 22574 * as a whole. Ports in a range cannot be removed individually. 22575 * 22576 * Params: 22577 * in_port_t lo_port: the beginning port of the reserved port range to 22578 * be deleted. 22579 * in_port_t hi_port: the ending port of the reserved port range to 22580 * be deleted. 22581 * 22582 * Return: 22583 * B_TRUE if the deletion is successful, B_FALSE otherwise. 22584 */ 22585 boolean_t 22586 tcp_reserved_port_del(in_port_t lo_port, in_port_t hi_port) 22587 { 22588 int i, j; 22589 int size; 22590 tcp_t **temp_tcp_array; 22591 tcp_t *tcp; 22592 22593 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22594 22595 /* First make sure that the port ranage is indeed reserved. */ 22596 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22597 if (tcp_reserved_port[i].lo_port == lo_port) { 22598 hi_port = tcp_reserved_port[i].hi_port; 22599 temp_tcp_array = tcp_reserved_port[i].temp_tcp_array; 22600 break; 22601 } 22602 } 22603 if (i == tcp_reserved_port_array_size) { 22604 rw_exit(&tcp_reserved_port_lock); 22605 return (B_FALSE); 22606 } 22607 22608 /* 22609 * Remove the range from the array. This simple loop is possible 22610 * because port ranges are inserted in ascending order. 22611 */ 22612 for (j = i; j < tcp_reserved_port_array_size - 1; j++) { 22613 tcp_reserved_port[j].lo_port = tcp_reserved_port[j+1].lo_port; 22614 tcp_reserved_port[j].hi_port = tcp_reserved_port[j+1].hi_port; 22615 tcp_reserved_port[j].temp_tcp_array = 22616 tcp_reserved_port[j+1].temp_tcp_array; 22617 } 22618 22619 /* Remove all the temporary tcp structures. */ 22620 size = hi_port - lo_port + 1; 22621 while (size > 0) { 22622 tcp = temp_tcp_array[size - 1]; 22623 ASSERT(tcp != NULL); 22624 tcp_bind_hash_remove(tcp); 22625 CONN_DEC_REF(tcp->tcp_connp); 22626 size--; 22627 } 22628 kmem_free(temp_tcp_array, (hi_port - lo_port + 1) * sizeof (tcp_t *)); 22629 tcp_reserved_port_array_size--; 22630 rw_exit(&tcp_reserved_port_lock); 22631 return (B_TRUE); 22632 } 22633 22634 /* 22635 * Macro to remove temporary tcp structure from the bind hash list. The 22636 * first parameter is the list of tcp to be removed. The second parameter 22637 * is the number of tcps in the array. 22638 */ 22639 #define TCP_TMP_TCP_REMOVE(tcp_array, num) \ 22640 { \ 22641 while ((num) > 0) { \ 22642 tcp_t *tcp = (tcp_array)[(num) - 1]; \ 22643 tf_t *tbf; \ 22644 tcp_t *tcpnext; \ 22645 tbf = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)]; \ 22646 mutex_enter(&tbf->tf_lock); \ 22647 tcpnext = tcp->tcp_bind_hash; \ 22648 if (tcpnext) { \ 22649 tcpnext->tcp_ptpbhn = \ 22650 tcp->tcp_ptpbhn; \ 22651 } \ 22652 *tcp->tcp_ptpbhn = tcpnext; \ 22653 mutex_exit(&tbf->tf_lock); \ 22654 kmem_free(tcp, sizeof (tcp_t)); \ 22655 (tcp_array)[(num) - 1] = NULL; \ 22656 (num)--; \ 22657 } \ 22658 } 22659 22660 /* 22661 * The public interface for other modules to call to reserve a port range 22662 * in TCP. The caller passes in how large a port range it wants. TCP 22663 * will try to find a range and return it via lo_port and hi_port. This is 22664 * used by NCA's nca_conn_init. 22665 * NCA can only be used in the global zone so this only affects the global 22666 * zone's ports. 22667 * 22668 * Params: 22669 * int size: the size of the port range to be reserved. 22670 * in_port_t *lo_port (referenced): returns the beginning port of the 22671 * reserved port range added. 22672 * in_port_t *hi_port (referenced): returns the ending port of the 22673 * reserved port range added. 22674 * 22675 * Return: 22676 * B_TRUE if the port reservation is successful, B_FALSE otherwise. 22677 */ 22678 boolean_t 22679 tcp_reserved_port_add(int size, in_port_t *lo_port, in_port_t *hi_port) 22680 { 22681 tcp_t *tcp; 22682 tcp_t *tmp_tcp; 22683 tcp_t **temp_tcp_array; 22684 tf_t *tbf; 22685 in_port_t net_port; 22686 in_port_t port; 22687 int32_t cur_size; 22688 int i, j; 22689 boolean_t used; 22690 tcp_rport_t tmp_ports[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 22691 zoneid_t zoneid = GLOBAL_ZONEID; 22692 22693 /* Sanity check. */ 22694 if (size <= 0 || size > TCP_RESERVED_PORTS_RANGE_MAX) { 22695 return (B_FALSE); 22696 } 22697 22698 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22699 if (tcp_reserved_port_array_size == TCP_RESERVED_PORTS_ARRAY_MAX_SIZE) { 22700 rw_exit(&tcp_reserved_port_lock); 22701 return (B_FALSE); 22702 } 22703 22704 /* 22705 * Find the starting port to try. Since the port ranges are ordered 22706 * in the reserved port array, we can do a simple search here. 22707 */ 22708 *lo_port = TCP_SMALLEST_RESERVED_PORT; 22709 *hi_port = TCP_LARGEST_RESERVED_PORT; 22710 for (i = 0; i < tcp_reserved_port_array_size; 22711 *lo_port = tcp_reserved_port[i].hi_port + 1, i++) { 22712 if (tcp_reserved_port[i].lo_port - *lo_port >= size) { 22713 *hi_port = tcp_reserved_port[i].lo_port - 1; 22714 break; 22715 } 22716 } 22717 /* No available port range. */ 22718 if (i == tcp_reserved_port_array_size && *hi_port - *lo_port < size) { 22719 rw_exit(&tcp_reserved_port_lock); 22720 return (B_FALSE); 22721 } 22722 22723 temp_tcp_array = kmem_zalloc(size * sizeof (tcp_t *), KM_NOSLEEP); 22724 if (temp_tcp_array == NULL) { 22725 rw_exit(&tcp_reserved_port_lock); 22726 return (B_FALSE); 22727 } 22728 22729 /* Go thru the port range to see if some ports are already bound. */ 22730 for (port = *lo_port, cur_size = 0; 22731 cur_size < size && port <= *hi_port; 22732 cur_size++, port++) { 22733 used = B_FALSE; 22734 net_port = htons(port); 22735 tbf = &tcp_bind_fanout[TCP_BIND_HASH(net_port)]; 22736 mutex_enter(&tbf->tf_lock); 22737 for (tcp = tbf->tf_tcp; tcp != NULL; 22738 tcp = tcp->tcp_bind_hash) { 22739 if (IPCL_ZONE_MATCH(tcp->tcp_connp, zoneid) && 22740 net_port == tcp->tcp_lport) { 22741 /* 22742 * A port is already bound. Search again 22743 * starting from port + 1. Release all 22744 * temporary tcps. 22745 */ 22746 mutex_exit(&tbf->tf_lock); 22747 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22748 *lo_port = port + 1; 22749 cur_size = -1; 22750 used = B_TRUE; 22751 break; 22752 } 22753 } 22754 if (!used) { 22755 if ((tmp_tcp = tcp_alloc_temp_tcp(net_port)) == NULL) { 22756 /* 22757 * Allocation failure. Just fail the request. 22758 * Need to remove all those temporary tcp 22759 * structures. 22760 */ 22761 mutex_exit(&tbf->tf_lock); 22762 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22763 rw_exit(&tcp_reserved_port_lock); 22764 kmem_free(temp_tcp_array, 22765 (hi_port - lo_port + 1) * 22766 sizeof (tcp_t *)); 22767 return (B_FALSE); 22768 } 22769 temp_tcp_array[cur_size] = tmp_tcp; 22770 tcp_bind_hash_insert(tbf, tmp_tcp, B_TRUE); 22771 mutex_exit(&tbf->tf_lock); 22772 } 22773 } 22774 22775 /* 22776 * The current range is not large enough. We can actually do another 22777 * search if this search is done between 2 reserved port ranges. But 22778 * for first release, we just stop here and return saying that no port 22779 * range is available. 22780 */ 22781 if (cur_size < size) { 22782 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22783 rw_exit(&tcp_reserved_port_lock); 22784 kmem_free(temp_tcp_array, size * sizeof (tcp_t *)); 22785 return (B_FALSE); 22786 } 22787 *hi_port = port - 1; 22788 22789 /* 22790 * Insert range into array in ascending order. Since this function 22791 * must not be called often, we choose to use the simplest method. 22792 * The above array should not consume excessive stack space as 22793 * the size must be very small. If in future releases, we find 22794 * that we should provide more reserved port ranges, this function 22795 * has to be modified to be more efficient. 22796 */ 22797 if (tcp_reserved_port_array_size == 0) { 22798 tcp_reserved_port[0].lo_port = *lo_port; 22799 tcp_reserved_port[0].hi_port = *hi_port; 22800 tcp_reserved_port[0].temp_tcp_array = temp_tcp_array; 22801 } else { 22802 for (i = 0, j = 0; i < tcp_reserved_port_array_size; i++, j++) { 22803 if (*lo_port < tcp_reserved_port[i].lo_port && i == j) { 22804 tmp_ports[j].lo_port = *lo_port; 22805 tmp_ports[j].hi_port = *hi_port; 22806 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22807 j++; 22808 } 22809 tmp_ports[j].lo_port = tcp_reserved_port[i].lo_port; 22810 tmp_ports[j].hi_port = tcp_reserved_port[i].hi_port; 22811 tmp_ports[j].temp_tcp_array = 22812 tcp_reserved_port[i].temp_tcp_array; 22813 } 22814 if (j == i) { 22815 tmp_ports[j].lo_port = *lo_port; 22816 tmp_ports[j].hi_port = *hi_port; 22817 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22818 } 22819 bcopy(tmp_ports, tcp_reserved_port, sizeof (tmp_ports)); 22820 } 22821 tcp_reserved_port_array_size++; 22822 rw_exit(&tcp_reserved_port_lock); 22823 return (B_TRUE); 22824 } 22825 22826 /* 22827 * Check to see if a port is in any reserved port range. 22828 * 22829 * Params: 22830 * in_port_t port: the port to be verified. 22831 * 22832 * Return: 22833 * B_TRUE is the port is inside a reserved port range, B_FALSE otherwise. 22834 */ 22835 boolean_t 22836 tcp_reserved_port_check(in_port_t port) 22837 { 22838 int i; 22839 22840 rw_enter(&tcp_reserved_port_lock, RW_READER); 22841 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22842 if (port >= tcp_reserved_port[i].lo_port || 22843 port <= tcp_reserved_port[i].hi_port) { 22844 rw_exit(&tcp_reserved_port_lock); 22845 return (B_TRUE); 22846 } 22847 } 22848 rw_exit(&tcp_reserved_port_lock); 22849 return (B_FALSE); 22850 } 22851 22852 /* 22853 * To list all reserved port ranges. This is the function to handle 22854 * ndd tcp_reserved_port_list. 22855 */ 22856 /* ARGSUSED */ 22857 static int 22858 tcp_reserved_port_list(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 22859 { 22860 int i; 22861 22862 rw_enter(&tcp_reserved_port_lock, RW_READER); 22863 if (tcp_reserved_port_array_size > 0) 22864 (void) mi_mpprintf(mp, "The following ports are reserved:"); 22865 else 22866 (void) mi_mpprintf(mp, "No port is reserved."); 22867 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22868 (void) mi_mpprintf(mp, "%d-%d", 22869 tcp_reserved_port[i].lo_port, tcp_reserved_port[i].hi_port); 22870 } 22871 rw_exit(&tcp_reserved_port_lock); 22872 return (0); 22873 } 22874 22875 /* 22876 * Hash list insertion routine for tcp_t structures. 22877 * Inserts entries with the ones bound to a specific IP address first 22878 * followed by those bound to INADDR_ANY. 22879 */ 22880 static void 22881 tcp_bind_hash_insert(tf_t *tbf, tcp_t *tcp, int caller_holds_lock) 22882 { 22883 tcp_t **tcpp; 22884 tcp_t *tcpnext; 22885 22886 if (tcp->tcp_ptpbhn != NULL) { 22887 ASSERT(!caller_holds_lock); 22888 tcp_bind_hash_remove(tcp); 22889 } 22890 tcpp = &tbf->tf_tcp; 22891 if (!caller_holds_lock) { 22892 mutex_enter(&tbf->tf_lock); 22893 } else { 22894 ASSERT(MUTEX_HELD(&tbf->tf_lock)); 22895 } 22896 tcpnext = tcpp[0]; 22897 if (tcpnext) { 22898 /* 22899 * If the new tcp bound to the INADDR_ANY address 22900 * and the first one in the list is not bound to 22901 * INADDR_ANY we skip all entries until we find the 22902 * first one bound to INADDR_ANY. 22903 * This makes sure that applications binding to a 22904 * specific address get preference over those binding to 22905 * INADDR_ANY. 22906 */ 22907 if (V6_OR_V4_INADDR_ANY(tcp->tcp_bound_source_v6) && 22908 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) { 22909 while ((tcpnext = tcpp[0]) != NULL && 22910 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) 22911 tcpp = &(tcpnext->tcp_bind_hash); 22912 if (tcpnext) 22913 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 22914 } else 22915 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 22916 } 22917 tcp->tcp_bind_hash = tcpnext; 22918 tcp->tcp_ptpbhn = tcpp; 22919 tcpp[0] = tcp; 22920 if (!caller_holds_lock) 22921 mutex_exit(&tbf->tf_lock); 22922 } 22923 22924 /* 22925 * Hash list removal routine for tcp_t structures. 22926 */ 22927 static void 22928 tcp_bind_hash_remove(tcp_t *tcp) 22929 { 22930 tcp_t *tcpnext; 22931 kmutex_t *lockp; 22932 22933 if (tcp->tcp_ptpbhn == NULL) 22934 return; 22935 22936 /* 22937 * Extract the lock pointer in case there are concurrent 22938 * hash_remove's for this instance. 22939 */ 22940 ASSERT(tcp->tcp_lport != 0); 22941 lockp = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)].tf_lock; 22942 22943 ASSERT(lockp != NULL); 22944 mutex_enter(lockp); 22945 if (tcp->tcp_ptpbhn) { 22946 tcpnext = tcp->tcp_bind_hash; 22947 if (tcpnext) { 22948 tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn; 22949 tcp->tcp_bind_hash = NULL; 22950 } 22951 *tcp->tcp_ptpbhn = tcpnext; 22952 tcp->tcp_ptpbhn = NULL; 22953 } 22954 mutex_exit(lockp); 22955 } 22956 22957 22958 /* 22959 * Hash list lookup routine for tcp_t structures. 22960 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 22961 */ 22962 static tcp_t * 22963 tcp_acceptor_hash_lookup(t_uscalar_t id) 22964 { 22965 tf_t *tf; 22966 tcp_t *tcp; 22967 22968 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 22969 mutex_enter(&tf->tf_lock); 22970 for (tcp = tf->tf_tcp; tcp != NULL; 22971 tcp = tcp->tcp_acceptor_hash) { 22972 if (tcp->tcp_acceptor_id == id) { 22973 CONN_INC_REF(tcp->tcp_connp); 22974 mutex_exit(&tf->tf_lock); 22975 return (tcp); 22976 } 22977 } 22978 mutex_exit(&tf->tf_lock); 22979 return (NULL); 22980 } 22981 22982 22983 /* 22984 * Hash list insertion routine for tcp_t structures. 22985 */ 22986 void 22987 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 22988 { 22989 tf_t *tf; 22990 tcp_t **tcpp; 22991 tcp_t *tcpnext; 22992 22993 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 22994 22995 if (tcp->tcp_ptpahn != NULL) 22996 tcp_acceptor_hash_remove(tcp); 22997 tcpp = &tf->tf_tcp; 22998 mutex_enter(&tf->tf_lock); 22999 tcpnext = tcpp[0]; 23000 if (tcpnext) 23001 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 23002 tcp->tcp_acceptor_hash = tcpnext; 23003 tcp->tcp_ptpahn = tcpp; 23004 tcpp[0] = tcp; 23005 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 23006 mutex_exit(&tf->tf_lock); 23007 } 23008 23009 /* 23010 * Hash list removal routine for tcp_t structures. 23011 */ 23012 static void 23013 tcp_acceptor_hash_remove(tcp_t *tcp) 23014 { 23015 tcp_t *tcpnext; 23016 kmutex_t *lockp; 23017 23018 /* 23019 * Extract the lock pointer in case there are concurrent 23020 * hash_remove's for this instance. 23021 */ 23022 lockp = tcp->tcp_acceptor_lockp; 23023 23024 if (tcp->tcp_ptpahn == NULL) 23025 return; 23026 23027 ASSERT(lockp != NULL); 23028 mutex_enter(lockp); 23029 if (tcp->tcp_ptpahn) { 23030 tcpnext = tcp->tcp_acceptor_hash; 23031 if (tcpnext) { 23032 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 23033 tcp->tcp_acceptor_hash = NULL; 23034 } 23035 *tcp->tcp_ptpahn = tcpnext; 23036 tcp->tcp_ptpahn = NULL; 23037 } 23038 mutex_exit(lockp); 23039 tcp->tcp_acceptor_lockp = NULL; 23040 } 23041 23042 /* ARGSUSED */ 23043 static int 23044 tcp_host_param_setvalue(queue_t *q, mblk_t *mp, char *value, caddr_t cp, int af) 23045 { 23046 int error = 0; 23047 int retval; 23048 char *end; 23049 23050 tcp_hsp_t *hsp; 23051 tcp_hsp_t *hspprev; 23052 23053 ipaddr_t addr = 0; /* Address we're looking for */ 23054 in6_addr_t v6addr; /* Address we're looking for */ 23055 uint32_t hash; /* Hash of that address */ 23056 23057 /* 23058 * If the following variables are still zero after parsing the input 23059 * string, the user didn't specify them and we don't change them in 23060 * the HSP. 23061 */ 23062 23063 ipaddr_t mask = 0; /* Subnet mask */ 23064 in6_addr_t v6mask; 23065 long sendspace = 0; /* Send buffer size */ 23066 long recvspace = 0; /* Receive buffer size */ 23067 long timestamp = 0; /* Originate TCP TSTAMP option, 1 = yes */ 23068 boolean_t delete = B_FALSE; /* User asked to delete this HSP */ 23069 23070 rw_enter(&tcp_hsp_lock, RW_WRITER); 23071 23072 /* Parse and validate address */ 23073 if (af == AF_INET) { 23074 retval = inet_pton(af, value, &addr); 23075 if (retval == 1) 23076 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr); 23077 } else if (af == AF_INET6) { 23078 retval = inet_pton(af, value, &v6addr); 23079 } else { 23080 error = EINVAL; 23081 goto done; 23082 } 23083 if (retval == 0) { 23084 error = EINVAL; 23085 goto done; 23086 } 23087 23088 while ((*value) && *value != ' ') 23089 value++; 23090 23091 /* Parse individual keywords, set variables if found */ 23092 while (*value) { 23093 /* Skip leading blanks */ 23094 23095 while (*value == ' ' || *value == '\t') 23096 value++; 23097 23098 /* If at end of string, we're done */ 23099 23100 if (!*value) 23101 break; 23102 23103 /* We have a word, figure out what it is */ 23104 23105 if (strncmp("mask", value, 4) == 0) { 23106 value += 4; 23107 while (*value == ' ' || *value == '\t') 23108 value++; 23109 /* Parse subnet mask */ 23110 if (af == AF_INET) { 23111 retval = inet_pton(af, value, &mask); 23112 if (retval == 1) { 23113 V4MASK_TO_V6(mask, v6mask); 23114 } 23115 } else if (af == AF_INET6) { 23116 retval = inet_pton(af, value, &v6mask); 23117 } 23118 if (retval != 1) { 23119 error = EINVAL; 23120 goto done; 23121 } 23122 while ((*value) && *value != ' ') 23123 value++; 23124 } else if (strncmp("sendspace", value, 9) == 0) { 23125 value += 9; 23126 23127 if (ddi_strtol(value, &end, 0, &sendspace) != 0 || 23128 sendspace < TCP_XMIT_HIWATER || 23129 sendspace >= (1L<<30)) { 23130 error = EINVAL; 23131 goto done; 23132 } 23133 value = end; 23134 } else if (strncmp("recvspace", value, 9) == 0) { 23135 value += 9; 23136 23137 if (ddi_strtol(value, &end, 0, &recvspace) != 0 || 23138 recvspace < TCP_RECV_HIWATER || 23139 recvspace >= (1L<<30)) { 23140 error = EINVAL; 23141 goto done; 23142 } 23143 value = end; 23144 } else if (strncmp("timestamp", value, 9) == 0) { 23145 value += 9; 23146 23147 if (ddi_strtol(value, &end, 0, ×tamp) != 0 || 23148 timestamp < 0 || timestamp > 1) { 23149 error = EINVAL; 23150 goto done; 23151 } 23152 23153 /* 23154 * We increment timestamp so we know it's been set; 23155 * this is undone when we put it in the HSP 23156 */ 23157 timestamp++; 23158 value = end; 23159 } else if (strncmp("delete", value, 6) == 0) { 23160 value += 6; 23161 delete = B_TRUE; 23162 } else { 23163 error = EINVAL; 23164 goto done; 23165 } 23166 } 23167 23168 /* Hash address for lookup */ 23169 23170 hash = TCP_HSP_HASH(addr); 23171 23172 if (delete) { 23173 /* 23174 * Note that deletes don't return an error if the thing 23175 * we're trying to delete isn't there. 23176 */ 23177 if (tcp_hsp_hash == NULL) 23178 goto done; 23179 hsp = tcp_hsp_hash[hash]; 23180 23181 if (hsp) { 23182 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23183 &v6addr)) { 23184 tcp_hsp_hash[hash] = hsp->tcp_hsp_next; 23185 mi_free((char *)hsp); 23186 } else { 23187 hspprev = hsp; 23188 while ((hsp = hsp->tcp_hsp_next) != NULL) { 23189 if (IN6_ARE_ADDR_EQUAL( 23190 &hsp->tcp_hsp_addr_v6, &v6addr)) { 23191 hspprev->tcp_hsp_next = 23192 hsp->tcp_hsp_next; 23193 mi_free((char *)hsp); 23194 break; 23195 } 23196 hspprev = hsp; 23197 } 23198 } 23199 } 23200 } else { 23201 /* 23202 * We're adding/modifying an HSP. If we haven't already done 23203 * so, allocate the hash table. 23204 */ 23205 23206 if (!tcp_hsp_hash) { 23207 tcp_hsp_hash = (tcp_hsp_t **) 23208 mi_zalloc(sizeof (tcp_hsp_t *) * TCP_HSP_HASH_SIZE); 23209 if (!tcp_hsp_hash) { 23210 error = EINVAL; 23211 goto done; 23212 } 23213 } 23214 23215 /* Get head of hash chain */ 23216 23217 hsp = tcp_hsp_hash[hash]; 23218 23219 /* Try to find pre-existing hsp on hash chain */ 23220 /* Doesn't handle CIDR prefixes. */ 23221 while (hsp) { 23222 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, &v6addr)) 23223 break; 23224 hsp = hsp->tcp_hsp_next; 23225 } 23226 23227 /* 23228 * If we didn't, create one with default values and put it 23229 * at head of hash chain 23230 */ 23231 23232 if (!hsp) { 23233 hsp = (tcp_hsp_t *)mi_zalloc(sizeof (tcp_hsp_t)); 23234 if (!hsp) { 23235 error = EINVAL; 23236 goto done; 23237 } 23238 hsp->tcp_hsp_next = tcp_hsp_hash[hash]; 23239 tcp_hsp_hash[hash] = hsp; 23240 } 23241 23242 /* Set values that the user asked us to change */ 23243 23244 hsp->tcp_hsp_addr_v6 = v6addr; 23245 if (IN6_IS_ADDR_V4MAPPED(&v6addr)) 23246 hsp->tcp_hsp_vers = IPV4_VERSION; 23247 else 23248 hsp->tcp_hsp_vers = IPV6_VERSION; 23249 hsp->tcp_hsp_subnet_v6 = v6mask; 23250 if (sendspace > 0) 23251 hsp->tcp_hsp_sendspace = sendspace; 23252 if (recvspace > 0) 23253 hsp->tcp_hsp_recvspace = recvspace; 23254 if (timestamp > 0) 23255 hsp->tcp_hsp_tstamp = timestamp - 1; 23256 } 23257 23258 done: 23259 rw_exit(&tcp_hsp_lock); 23260 return (error); 23261 } 23262 23263 /* Set callback routine passed to nd_load by tcp_param_register. */ 23264 /* ARGSUSED */ 23265 static int 23266 tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 23267 { 23268 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET)); 23269 } 23270 /* ARGSUSED */ 23271 static int 23272 tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23273 cred_t *cr) 23274 { 23275 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET6)); 23276 } 23277 23278 /* TCP host parameters report triggered via the Named Dispatch mechanism. */ 23279 /* ARGSUSED */ 23280 static int 23281 tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 23282 { 23283 tcp_hsp_t *hsp; 23284 int i; 23285 char addrbuf[INET6_ADDRSTRLEN], subnetbuf[INET6_ADDRSTRLEN]; 23286 23287 rw_enter(&tcp_hsp_lock, RW_READER); 23288 (void) mi_mpprintf(mp, 23289 "Hash HSP " MI_COL_HDRPAD_STR 23290 "Address Subnet Mask Send Receive TStamp"); 23291 if (tcp_hsp_hash) { 23292 for (i = 0; i < TCP_HSP_HASH_SIZE; i++) { 23293 hsp = tcp_hsp_hash[i]; 23294 while (hsp) { 23295 if (hsp->tcp_hsp_vers == IPV4_VERSION) { 23296 (void) inet_ntop(AF_INET, 23297 &hsp->tcp_hsp_addr, 23298 addrbuf, sizeof (addrbuf)); 23299 (void) inet_ntop(AF_INET, 23300 &hsp->tcp_hsp_subnet, 23301 subnetbuf, sizeof (subnetbuf)); 23302 } else { 23303 (void) inet_ntop(AF_INET6, 23304 &hsp->tcp_hsp_addr_v6, 23305 addrbuf, sizeof (addrbuf)); 23306 (void) inet_ntop(AF_INET6, 23307 &hsp->tcp_hsp_subnet_v6, 23308 subnetbuf, sizeof (subnetbuf)); 23309 } 23310 (void) mi_mpprintf(mp, 23311 " %03d " MI_COL_PTRFMT_STR 23312 "%s %s %010d %010d %d", 23313 i, 23314 (void *)hsp, 23315 addrbuf, 23316 subnetbuf, 23317 hsp->tcp_hsp_sendspace, 23318 hsp->tcp_hsp_recvspace, 23319 hsp->tcp_hsp_tstamp); 23320 23321 hsp = hsp->tcp_hsp_next; 23322 } 23323 } 23324 } 23325 rw_exit(&tcp_hsp_lock); 23326 return (0); 23327 } 23328 23329 23330 /* Data for fast netmask macro used by tcp_hsp_lookup */ 23331 23332 static ipaddr_t netmasks[] = { 23333 IN_CLASSA_NET, IN_CLASSA_NET, IN_CLASSB_NET, 23334 IN_CLASSC_NET | IN_CLASSD_NET /* Class C,D,E */ 23335 }; 23336 23337 #define netmask(addr) (netmasks[(ipaddr_t)(addr) >> 30]) 23338 23339 /* 23340 * XXX This routine should go away and instead we should use the metrics 23341 * associated with the routes to determine the default sndspace and rcvspace. 23342 */ 23343 static tcp_hsp_t * 23344 tcp_hsp_lookup(ipaddr_t addr) 23345 { 23346 tcp_hsp_t *hsp = NULL; 23347 23348 /* Quick check without acquiring the lock. */ 23349 if (tcp_hsp_hash == NULL) 23350 return (NULL); 23351 23352 rw_enter(&tcp_hsp_lock, RW_READER); 23353 23354 /* This routine finds the best-matching HSP for address addr. */ 23355 23356 if (tcp_hsp_hash) { 23357 int i; 23358 ipaddr_t srchaddr; 23359 tcp_hsp_t *hsp_net; 23360 23361 /* We do three passes: host, network, and subnet. */ 23362 23363 srchaddr = addr; 23364 23365 for (i = 1; i <= 3; i++) { 23366 /* Look for exact match on srchaddr */ 23367 23368 hsp = tcp_hsp_hash[TCP_HSP_HASH(srchaddr)]; 23369 while (hsp) { 23370 if (hsp->tcp_hsp_vers == IPV4_VERSION && 23371 hsp->tcp_hsp_addr == srchaddr) 23372 break; 23373 hsp = hsp->tcp_hsp_next; 23374 } 23375 ASSERT(hsp == NULL || 23376 hsp->tcp_hsp_vers == IPV4_VERSION); 23377 23378 /* 23379 * If this is the first pass: 23380 * If we found a match, great, return it. 23381 * If not, search for the network on the second pass. 23382 */ 23383 23384 if (i == 1) 23385 if (hsp) 23386 break; 23387 else 23388 { 23389 srchaddr = addr & netmask(addr); 23390 continue; 23391 } 23392 23393 /* 23394 * If this is the second pass: 23395 * If we found a match, but there's a subnet mask, 23396 * save the match but try again using the subnet 23397 * mask on the third pass. 23398 * Otherwise, return whatever we found. 23399 */ 23400 23401 if (i == 2) { 23402 if (hsp && hsp->tcp_hsp_subnet) { 23403 hsp_net = hsp; 23404 srchaddr = addr & hsp->tcp_hsp_subnet; 23405 continue; 23406 } else { 23407 break; 23408 } 23409 } 23410 23411 /* 23412 * This must be the third pass. If we didn't find 23413 * anything, return the saved network HSP instead. 23414 */ 23415 23416 if (!hsp) 23417 hsp = hsp_net; 23418 } 23419 } 23420 23421 rw_exit(&tcp_hsp_lock); 23422 return (hsp); 23423 } 23424 23425 /* 23426 * XXX Equally broken as the IPv4 routine. Doesn't handle longest 23427 * match lookup. 23428 */ 23429 static tcp_hsp_t * 23430 tcp_hsp_lookup_ipv6(in6_addr_t *v6addr) 23431 { 23432 tcp_hsp_t *hsp = NULL; 23433 23434 /* Quick check without acquiring the lock. */ 23435 if (tcp_hsp_hash == NULL) 23436 return (NULL); 23437 23438 rw_enter(&tcp_hsp_lock, RW_READER); 23439 23440 /* This routine finds the best-matching HSP for address addr. */ 23441 23442 if (tcp_hsp_hash) { 23443 int i; 23444 in6_addr_t v6srchaddr; 23445 tcp_hsp_t *hsp_net; 23446 23447 /* We do three passes: host, network, and subnet. */ 23448 23449 v6srchaddr = *v6addr; 23450 23451 for (i = 1; i <= 3; i++) { 23452 /* Look for exact match on srchaddr */ 23453 23454 hsp = tcp_hsp_hash[TCP_HSP_HASH( 23455 V4_PART_OF_V6(v6srchaddr))]; 23456 while (hsp) { 23457 if (hsp->tcp_hsp_vers == IPV6_VERSION && 23458 IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23459 &v6srchaddr)) 23460 break; 23461 hsp = hsp->tcp_hsp_next; 23462 } 23463 23464 /* 23465 * If this is the first pass: 23466 * If we found a match, great, return it. 23467 * If not, search for the network on the second pass. 23468 */ 23469 23470 if (i == 1) 23471 if (hsp) 23472 break; 23473 else { 23474 /* Assume a 64 bit mask */ 23475 v6srchaddr.s6_addr32[0] = 23476 v6addr->s6_addr32[0]; 23477 v6srchaddr.s6_addr32[1] = 23478 v6addr->s6_addr32[1]; 23479 v6srchaddr.s6_addr32[2] = 0; 23480 v6srchaddr.s6_addr32[3] = 0; 23481 continue; 23482 } 23483 23484 /* 23485 * If this is the second pass: 23486 * If we found a match, but there's a subnet mask, 23487 * save the match but try again using the subnet 23488 * mask on the third pass. 23489 * Otherwise, return whatever we found. 23490 */ 23491 23492 if (i == 2) { 23493 ASSERT(hsp == NULL || 23494 hsp->tcp_hsp_vers == IPV6_VERSION); 23495 if (hsp && 23496 !IN6_IS_ADDR_UNSPECIFIED( 23497 &hsp->tcp_hsp_subnet_v6)) { 23498 hsp_net = hsp; 23499 V6_MASK_COPY(*v6addr, 23500 hsp->tcp_hsp_subnet_v6, v6srchaddr); 23501 continue; 23502 } else { 23503 break; 23504 } 23505 } 23506 23507 /* 23508 * This must be the third pass. If we didn't find 23509 * anything, return the saved network HSP instead. 23510 */ 23511 23512 if (!hsp) 23513 hsp = hsp_net; 23514 } 23515 } 23516 23517 rw_exit(&tcp_hsp_lock); 23518 return (hsp); 23519 } 23520 23521 /* 23522 * Type three generator adapted from the random() function in 4.4 BSD: 23523 */ 23524 23525 /* 23526 * Copyright (c) 1983, 1993 23527 * The Regents of the University of California. All rights reserved. 23528 * 23529 * Redistribution and use in source and binary forms, with or without 23530 * modification, are permitted provided that the following conditions 23531 * are met: 23532 * 1. Redistributions of source code must retain the above copyright 23533 * notice, this list of conditions and the following disclaimer. 23534 * 2. Redistributions in binary form must reproduce the above copyright 23535 * notice, this list of conditions and the following disclaimer in the 23536 * documentation and/or other materials provided with the distribution. 23537 * 3. All advertising materials mentioning features or use of this software 23538 * must display the following acknowledgement: 23539 * This product includes software developed by the University of 23540 * California, Berkeley and its contributors. 23541 * 4. Neither the name of the University nor the names of its contributors 23542 * may be used to endorse or promote products derived from this software 23543 * without specific prior written permission. 23544 * 23545 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23546 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23547 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23548 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23549 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23550 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23551 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23552 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23553 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23554 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23555 * SUCH DAMAGE. 23556 */ 23557 23558 /* Type 3 -- x**31 + x**3 + 1 */ 23559 #define DEG_3 31 23560 #define SEP_3 3 23561 23562 23563 /* Protected by tcp_random_lock */ 23564 static int tcp_randtbl[DEG_3 + 1]; 23565 23566 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 23567 static int *tcp_random_rptr = &tcp_randtbl[1]; 23568 23569 static int *tcp_random_state = &tcp_randtbl[1]; 23570 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 23571 23572 kmutex_t tcp_random_lock; 23573 23574 void 23575 tcp_random_init(void) 23576 { 23577 int i; 23578 hrtime_t hrt; 23579 time_t wallclock; 23580 uint64_t result; 23581 23582 /* 23583 * Use high-res timer and current time for seed. Gethrtime() returns 23584 * a longlong, which may contain resolution down to nanoseconds. 23585 * The current time will either be a 32-bit or a 64-bit quantity. 23586 * XOR the two together in a 64-bit result variable. 23587 * Convert the result to a 32-bit value by multiplying the high-order 23588 * 32-bits by the low-order 32-bits. 23589 */ 23590 23591 hrt = gethrtime(); 23592 (void) drv_getparm(TIME, &wallclock); 23593 result = (uint64_t)wallclock ^ (uint64_t)hrt; 23594 mutex_enter(&tcp_random_lock); 23595 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 23596 (result & 0xffffffff); 23597 23598 for (i = 1; i < DEG_3; i++) 23599 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 23600 + 12345; 23601 tcp_random_fptr = &tcp_random_state[SEP_3]; 23602 tcp_random_rptr = &tcp_random_state[0]; 23603 mutex_exit(&tcp_random_lock); 23604 for (i = 0; i < 10 * DEG_3; i++) 23605 (void) tcp_random(); 23606 } 23607 23608 /* 23609 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 23610 * This range is selected to be approximately centered on TCP_ISS / 2, 23611 * and easy to compute. We get this value by generating a 32-bit random 23612 * number, selecting out the high-order 17 bits, and then adding one so 23613 * that we never return zero. 23614 */ 23615 int 23616 tcp_random(void) 23617 { 23618 int i; 23619 23620 mutex_enter(&tcp_random_lock); 23621 *tcp_random_fptr += *tcp_random_rptr; 23622 23623 /* 23624 * The high-order bits are more random than the low-order bits, 23625 * so we select out the high-order 17 bits and add one so that 23626 * we never return zero. 23627 */ 23628 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 23629 if (++tcp_random_fptr >= tcp_random_end_ptr) { 23630 tcp_random_fptr = tcp_random_state; 23631 ++tcp_random_rptr; 23632 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 23633 tcp_random_rptr = tcp_random_state; 23634 23635 mutex_exit(&tcp_random_lock); 23636 return (i); 23637 } 23638 23639 /* 23640 * XXX This will go away when TPI is extended to send 23641 * info reqs to sockfs/timod ..... 23642 * Given a queue, set the max packet size for the write 23643 * side of the queue below stream head. This value is 23644 * cached on the stream head. 23645 * Returns 1 on success, 0 otherwise. 23646 */ 23647 static int 23648 setmaxps(queue_t *q, int maxpsz) 23649 { 23650 struct stdata *stp; 23651 queue_t *wq; 23652 stp = STREAM(q); 23653 23654 /* 23655 * At this point change of a queue parameter is not allowed 23656 * when a multiplexor is sitting on top. 23657 */ 23658 if (stp->sd_flag & STPLEX) 23659 return (0); 23660 23661 claimstr(stp->sd_wrq); 23662 wq = stp->sd_wrq->q_next; 23663 ASSERT(wq != NULL); 23664 (void) strqset(wq, QMAXPSZ, 0, maxpsz); 23665 releasestr(stp->sd_wrq); 23666 return (1); 23667 } 23668 23669 static int 23670 tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp, 23671 int *t_errorp, int *sys_errorp) 23672 { 23673 int error; 23674 int is_absreq_failure; 23675 t_scalar_t *opt_lenp; 23676 t_scalar_t opt_offset; 23677 int prim_type; 23678 struct T_conn_req *tcreqp; 23679 struct T_conn_res *tcresp; 23680 cred_t *cr; 23681 23682 cr = DB_CREDDEF(mp, tcp->tcp_cred); 23683 23684 prim_type = ((union T_primitives *)mp->b_rptr)->type; 23685 ASSERT(prim_type == T_CONN_REQ || prim_type == O_T_CONN_RES || 23686 prim_type == T_CONN_RES); 23687 23688 switch (prim_type) { 23689 case T_CONN_REQ: 23690 tcreqp = (struct T_conn_req *)mp->b_rptr; 23691 opt_offset = tcreqp->OPT_offset; 23692 opt_lenp = (t_scalar_t *)&tcreqp->OPT_length; 23693 break; 23694 case O_T_CONN_RES: 23695 case T_CONN_RES: 23696 tcresp = (struct T_conn_res *)mp->b_rptr; 23697 opt_offset = tcresp->OPT_offset; 23698 opt_lenp = (t_scalar_t *)&tcresp->OPT_length; 23699 break; 23700 } 23701 23702 *t_errorp = 0; 23703 *sys_errorp = 0; 23704 *do_disconnectp = 0; 23705 23706 error = tpi_optcom_buf(tcp->tcp_wq, mp, opt_lenp, 23707 opt_offset, cr, &tcp_opt_obj, 23708 NULL, &is_absreq_failure); 23709 23710 switch (error) { 23711 case 0: /* no error */ 23712 ASSERT(is_absreq_failure == 0); 23713 return (0); 23714 case ENOPROTOOPT: 23715 *t_errorp = TBADOPT; 23716 break; 23717 case EACCES: 23718 *t_errorp = TACCES; 23719 break; 23720 default: 23721 *t_errorp = TSYSERR; *sys_errorp = error; 23722 break; 23723 } 23724 if (is_absreq_failure != 0) { 23725 /* 23726 * The connection request should get the local ack 23727 * T_OK_ACK and then a T_DISCON_IND. 23728 */ 23729 *do_disconnectp = 1; 23730 } 23731 return (-1); 23732 } 23733 23734 /* 23735 * Split this function out so that if the secret changes, I'm okay. 23736 * 23737 * Initialize the tcp_iss_cookie and tcp_iss_key. 23738 */ 23739 23740 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 23741 23742 static void 23743 tcp_iss_key_init(uint8_t *phrase, int len) 23744 { 23745 struct { 23746 int32_t current_time; 23747 uint32_t randnum; 23748 uint16_t pad; 23749 uint8_t ether[6]; 23750 uint8_t passwd[PASSWD_SIZE]; 23751 } tcp_iss_cookie; 23752 time_t t; 23753 23754 /* 23755 * Start with the current absolute time. 23756 */ 23757 (void) drv_getparm(TIME, &t); 23758 tcp_iss_cookie.current_time = t; 23759 23760 /* 23761 * XXX - Need a more random number per RFC 1750, not this crap. 23762 * OTOH, if what follows is pretty random, then I'm in better shape. 23763 */ 23764 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 23765 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 23766 23767 /* 23768 * The cpu_type_info is pretty non-random. Ugggh. It does serve 23769 * as a good template. 23770 */ 23771 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 23772 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 23773 23774 /* 23775 * The pass-phrase. Normally this is supplied by user-called NDD. 23776 */ 23777 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 23778 23779 /* 23780 * See 4010593 if this section becomes a problem again, 23781 * but the local ethernet address is useful here. 23782 */ 23783 (void) localetheraddr(NULL, 23784 (struct ether_addr *)&tcp_iss_cookie.ether); 23785 23786 /* 23787 * Hash 'em all together. The MD5Final is called per-connection. 23788 */ 23789 mutex_enter(&tcp_iss_key_lock); 23790 MD5Init(&tcp_iss_key); 23791 MD5Update(&tcp_iss_key, (uchar_t *)&tcp_iss_cookie, 23792 sizeof (tcp_iss_cookie)); 23793 mutex_exit(&tcp_iss_key_lock); 23794 } 23795 23796 /* 23797 * Set the RFC 1948 pass phrase 23798 */ 23799 /* ARGSUSED */ 23800 static int 23801 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23802 cred_t *cr) 23803 { 23804 /* 23805 * Basically, value contains a new pass phrase. Pass it along! 23806 */ 23807 tcp_iss_key_init((uint8_t *)value, strlen(value)); 23808 return (0); 23809 } 23810 23811 /* ARGSUSED */ 23812 static int 23813 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 23814 { 23815 bzero(buf, sizeof (tcp_sack_info_t)); 23816 return (0); 23817 } 23818 23819 /* ARGSUSED */ 23820 static int 23821 tcp_iphc_constructor(void *buf, void *cdrarg, int kmflags) 23822 { 23823 bzero(buf, TCP_MAX_COMBINED_HEADER_LENGTH); 23824 return (0); 23825 } 23826 23827 void 23828 tcp_ddi_init(void) 23829 { 23830 int i; 23831 23832 /* Initialize locks */ 23833 rw_init(&tcp_hsp_lock, NULL, RW_DEFAULT, NULL); 23834 mutex_init(&tcp_g_q_lock, NULL, MUTEX_DEFAULT, NULL); 23835 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 23836 mutex_init(&tcp_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 23837 mutex_init(&tcp_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 23838 rw_init(&tcp_reserved_port_lock, NULL, RW_DEFAULT, NULL); 23839 23840 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 23841 mutex_init(&tcp_bind_fanout[i].tf_lock, NULL, 23842 MUTEX_DEFAULT, NULL); 23843 } 23844 23845 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 23846 mutex_init(&tcp_acceptor_fanout[i].tf_lock, NULL, 23847 MUTEX_DEFAULT, NULL); 23848 } 23849 23850 /* TCP's IPsec code calls the packet dropper. */ 23851 ip_drop_register(&tcp_dropper, "TCP IPsec policy enforcement"); 23852 23853 if (!tcp_g_nd) { 23854 if (!tcp_param_register(tcp_param_arr, A_CNT(tcp_param_arr))) { 23855 nd_free(&tcp_g_nd); 23856 } 23857 } 23858 23859 /* 23860 * Note: To really walk the device tree you need the devinfo 23861 * pointer to your device which is only available after probe/attach. 23862 * The following is safe only because it uses ddi_root_node() 23863 */ 23864 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 23865 tcp_opt_obj.odb_opt_arr_cnt); 23866 23867 tcp_timercache = kmem_cache_create("tcp_timercache", 23868 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 23869 NULL, NULL, NULL, NULL, NULL, 0); 23870 23871 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 23872 sizeof (tcp_sack_info_t), 0, 23873 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 23874 23875 tcp_iphc_cache = kmem_cache_create("tcp_iphc_cache", 23876 TCP_MAX_COMBINED_HEADER_LENGTH, 0, 23877 tcp_iphc_constructor, NULL, NULL, NULL, NULL, 0); 23878 23879 tcp_squeue_wput_proc = tcp_squeue_switch(tcp_squeue_wput); 23880 tcp_squeue_close_proc = tcp_squeue_switch(tcp_squeue_close); 23881 23882 ip_squeue_init(tcp_squeue_add); 23883 23884 /* Initialize the random number generator */ 23885 tcp_random_init(); 23886 23887 /* 23888 * Initialize RFC 1948 secret values. This will probably be reset once 23889 * by the boot scripts. 23890 * 23891 * Use NULL name, as the name is caught by the new lockstats. 23892 * 23893 * Initialize with some random, non-guessable string, like the global 23894 * T_INFO_ACK. 23895 */ 23896 23897 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 23898 sizeof (tcp_g_t_info_ack)); 23899 23900 if ((tcp_kstat = kstat_create(TCP_MOD_NAME, 0, "tcpstat", 23901 "net", KSTAT_TYPE_NAMED, 23902 sizeof (tcp_statistics) / sizeof (kstat_named_t), 23903 KSTAT_FLAG_VIRTUAL)) != NULL) { 23904 tcp_kstat->ks_data = &tcp_statistics; 23905 kstat_install(tcp_kstat); 23906 } 23907 23908 tcp_kstat_init(); 23909 } 23910 23911 void 23912 tcp_ddi_destroy(void) 23913 { 23914 int i; 23915 23916 nd_free(&tcp_g_nd); 23917 23918 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 23919 mutex_destroy(&tcp_bind_fanout[i].tf_lock); 23920 } 23921 23922 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 23923 mutex_destroy(&tcp_acceptor_fanout[i].tf_lock); 23924 } 23925 23926 mutex_destroy(&tcp_iss_key_lock); 23927 rw_destroy(&tcp_hsp_lock); 23928 mutex_destroy(&tcp_g_q_lock); 23929 mutex_destroy(&tcp_random_lock); 23930 mutex_destroy(&tcp_epriv_port_lock); 23931 rw_destroy(&tcp_reserved_port_lock); 23932 23933 ip_drop_unregister(&tcp_dropper); 23934 23935 kmem_cache_destroy(tcp_timercache); 23936 kmem_cache_destroy(tcp_sack_info_cache); 23937 kmem_cache_destroy(tcp_iphc_cache); 23938 23939 tcp_kstat_fini(); 23940 } 23941 23942 /* 23943 * Generate ISS, taking into account NDD changes may happen halfway through. 23944 * (If the iss is not zero, set it.) 23945 */ 23946 23947 static void 23948 tcp_iss_init(tcp_t *tcp) 23949 { 23950 MD5_CTX context; 23951 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 23952 uint32_t answer[4]; 23953 23954 tcp_iss_incr_extra += (ISS_INCR >> 1); 23955 tcp->tcp_iss = tcp_iss_incr_extra; 23956 switch (tcp_strong_iss) { 23957 case 2: 23958 mutex_enter(&tcp_iss_key_lock); 23959 context = tcp_iss_key; 23960 mutex_exit(&tcp_iss_key_lock); 23961 arg.ports = tcp->tcp_ports; 23962 if (tcp->tcp_ipversion == IPV4_VERSION) { 23963 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 23964 &arg.src); 23965 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_dst, 23966 &arg.dst); 23967 } else { 23968 arg.src = tcp->tcp_ip6h->ip6_src; 23969 arg.dst = tcp->tcp_ip6h->ip6_dst; 23970 } 23971 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 23972 MD5Final((uchar_t *)answer, &context); 23973 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 23974 /* 23975 * Now that we've hashed into a unique per-connection sequence 23976 * space, add a random increment per strong_iss == 1. So I 23977 * guess we'll have to... 23978 */ 23979 /* FALLTHRU */ 23980 case 1: 23981 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 23982 break; 23983 default: 23984 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 23985 break; 23986 } 23987 tcp->tcp_valid_bits = TCP_ISS_VALID; 23988 tcp->tcp_fss = tcp->tcp_iss - 1; 23989 tcp->tcp_suna = tcp->tcp_iss; 23990 tcp->tcp_snxt = tcp->tcp_iss + 1; 23991 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 23992 tcp->tcp_csuna = tcp->tcp_snxt; 23993 } 23994 23995 /* 23996 * Exported routine for extracting active tcp connection status. 23997 * 23998 * This is used by the Solaris Cluster Networking software to 23999 * gather a list of connections that need to be forwarded to 24000 * specific nodes in the cluster when configuration changes occur. 24001 * 24002 * The callback is invoked for each tcp_t structure. Returning 24003 * non-zero from the callback routine terminates the search. 24004 */ 24005 int 24006 cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg) 24007 { 24008 tcp_t *tcp; 24009 cl_tcp_info_t cl_tcpi; 24010 connf_t *connfp; 24011 conn_t *connp; 24012 int i; 24013 24014 ASSERT(callback != NULL); 24015 24016 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 24017 24018 connfp = &ipcl_globalhash_fanout[i]; 24019 connp = NULL; 24020 24021 while ((connp = 24022 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 24023 24024 tcp = connp->conn_tcp; 24025 cl_tcpi.cl_tcpi_version = CL_TCPI_V1; 24026 cl_tcpi.cl_tcpi_ipversion = tcp->tcp_ipversion; 24027 cl_tcpi.cl_tcpi_state = tcp->tcp_state; 24028 cl_tcpi.cl_tcpi_lport = tcp->tcp_lport; 24029 cl_tcpi.cl_tcpi_fport = tcp->tcp_fport; 24030 /* 24031 * The macros tcp_laddr and tcp_faddr give the IPv4 24032 * addresses. They are copied implicitly below as 24033 * mapped addresses. 24034 */ 24035 cl_tcpi.cl_tcpi_laddr_v6 = tcp->tcp_ip_src_v6; 24036 if (tcp->tcp_ipversion == IPV4_VERSION) { 24037 cl_tcpi.cl_tcpi_faddr = 24038 tcp->tcp_ipha->ipha_dst; 24039 } else { 24040 cl_tcpi.cl_tcpi_faddr_v6 = 24041 tcp->tcp_ip6h->ip6_dst; 24042 } 24043 24044 /* 24045 * If the callback returns non-zero 24046 * we terminate the traversal. 24047 */ 24048 if ((*callback)(&cl_tcpi, arg) != 0) { 24049 CONN_DEC_REF(tcp->tcp_connp); 24050 return (1); 24051 } 24052 } 24053 } 24054 24055 return (0); 24056 } 24057 24058 /* 24059 * Macros used for accessing the different types of sockaddr 24060 * structures inside a tcp_ioc_abort_conn_t. 24061 */ 24062 #define TCP_AC_V4LADDR(acp) ((sin_t *)&(acp)->ac_local) 24063 #define TCP_AC_V4RADDR(acp) ((sin_t *)&(acp)->ac_remote) 24064 #define TCP_AC_V4LOCAL(acp) (TCP_AC_V4LADDR(acp)->sin_addr.s_addr) 24065 #define TCP_AC_V4REMOTE(acp) (TCP_AC_V4RADDR(acp)->sin_addr.s_addr) 24066 #define TCP_AC_V4LPORT(acp) (TCP_AC_V4LADDR(acp)->sin_port) 24067 #define TCP_AC_V4RPORT(acp) (TCP_AC_V4RADDR(acp)->sin_port) 24068 #define TCP_AC_V6LADDR(acp) ((sin6_t *)&(acp)->ac_local) 24069 #define TCP_AC_V6RADDR(acp) ((sin6_t *)&(acp)->ac_remote) 24070 #define TCP_AC_V6LOCAL(acp) (TCP_AC_V6LADDR(acp)->sin6_addr) 24071 #define TCP_AC_V6REMOTE(acp) (TCP_AC_V6RADDR(acp)->sin6_addr) 24072 #define TCP_AC_V6LPORT(acp) (TCP_AC_V6LADDR(acp)->sin6_port) 24073 #define TCP_AC_V6RPORT(acp) (TCP_AC_V6RADDR(acp)->sin6_port) 24074 24075 /* 24076 * Return the correct error code to mimic the behavior 24077 * of a connection reset. 24078 */ 24079 #define TCP_AC_GET_ERRCODE(state, err) { \ 24080 switch ((state)) { \ 24081 case TCPS_SYN_SENT: \ 24082 case TCPS_SYN_RCVD: \ 24083 (err) = ECONNREFUSED; \ 24084 break; \ 24085 case TCPS_ESTABLISHED: \ 24086 case TCPS_FIN_WAIT_1: \ 24087 case TCPS_FIN_WAIT_2: \ 24088 case TCPS_CLOSE_WAIT: \ 24089 (err) = ECONNRESET; \ 24090 break; \ 24091 case TCPS_CLOSING: \ 24092 case TCPS_LAST_ACK: \ 24093 case TCPS_TIME_WAIT: \ 24094 (err) = 0; \ 24095 break; \ 24096 default: \ 24097 (err) = ENXIO; \ 24098 } \ 24099 } 24100 24101 /* 24102 * Check if a tcp structure matches the info in acp. 24103 */ 24104 #define TCP_AC_ADDR_MATCH(acp, tcp) \ 24105 (((acp)->ac_local.ss_family == AF_INET) ? \ 24106 ((TCP_AC_V4LOCAL((acp)) == INADDR_ANY || \ 24107 TCP_AC_V4LOCAL((acp)) == (tcp)->tcp_ip_src) && \ 24108 (TCP_AC_V4REMOTE((acp)) == INADDR_ANY || \ 24109 TCP_AC_V4REMOTE((acp)) == (tcp)->tcp_remote) && \ 24110 (TCP_AC_V4LPORT((acp)) == 0 || \ 24111 TCP_AC_V4LPORT((acp)) == (tcp)->tcp_lport) && \ 24112 (TCP_AC_V4RPORT((acp)) == 0 || \ 24113 TCP_AC_V4RPORT((acp)) == (tcp)->tcp_fport) && \ 24114 (acp)->ac_start <= (tcp)->tcp_state && \ 24115 (acp)->ac_end >= (tcp)->tcp_state) : \ 24116 ((IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL((acp))) || \ 24117 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6LOCAL((acp)), \ 24118 &(tcp)->tcp_ip_src_v6)) && \ 24119 (IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE((acp))) || \ 24120 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6REMOTE((acp)), \ 24121 &(tcp)->tcp_remote_v6)) && \ 24122 (TCP_AC_V6LPORT((acp)) == 0 || \ 24123 TCP_AC_V6LPORT((acp)) == (tcp)->tcp_lport) && \ 24124 (TCP_AC_V6RPORT((acp)) == 0 || \ 24125 TCP_AC_V6RPORT((acp)) == (tcp)->tcp_fport) && \ 24126 (acp)->ac_start <= (tcp)->tcp_state && \ 24127 (acp)->ac_end >= (tcp)->tcp_state)) 24128 24129 #define TCP_AC_MATCH(acp, tcp) \ 24130 (((acp)->ac_zoneid == ALL_ZONES || \ 24131 (acp)->ac_zoneid == tcp->tcp_connp->conn_zoneid) ? \ 24132 TCP_AC_ADDR_MATCH(acp, tcp) : 0) 24133 24134 /* 24135 * Build a message containing a tcp_ioc_abort_conn_t structure 24136 * which is filled in with information from acp and tp. 24137 */ 24138 static mblk_t * 24139 tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *acp, tcp_t *tp) 24140 { 24141 mblk_t *mp; 24142 tcp_ioc_abort_conn_t *tacp; 24143 24144 mp = allocb(sizeof (uint32_t) + sizeof (*acp), BPRI_LO); 24145 if (mp == NULL) 24146 return (NULL); 24147 24148 mp->b_datap->db_type = M_CTL; 24149 24150 *((uint32_t *)mp->b_rptr) = TCP_IOC_ABORT_CONN; 24151 tacp = (tcp_ioc_abort_conn_t *)((uchar_t *)mp->b_rptr + 24152 sizeof (uint32_t)); 24153 24154 tacp->ac_start = acp->ac_start; 24155 tacp->ac_end = acp->ac_end; 24156 tacp->ac_zoneid = acp->ac_zoneid; 24157 24158 if (acp->ac_local.ss_family == AF_INET) { 24159 tacp->ac_local.ss_family = AF_INET; 24160 tacp->ac_remote.ss_family = AF_INET; 24161 TCP_AC_V4LOCAL(tacp) = tp->tcp_ip_src; 24162 TCP_AC_V4REMOTE(tacp) = tp->tcp_remote; 24163 TCP_AC_V4LPORT(tacp) = tp->tcp_lport; 24164 TCP_AC_V4RPORT(tacp) = tp->tcp_fport; 24165 } else { 24166 tacp->ac_local.ss_family = AF_INET6; 24167 tacp->ac_remote.ss_family = AF_INET6; 24168 TCP_AC_V6LOCAL(tacp) = tp->tcp_ip_src_v6; 24169 TCP_AC_V6REMOTE(tacp) = tp->tcp_remote_v6; 24170 TCP_AC_V6LPORT(tacp) = tp->tcp_lport; 24171 TCP_AC_V6RPORT(tacp) = tp->tcp_fport; 24172 } 24173 mp->b_wptr = (uchar_t *)mp->b_rptr + sizeof (uint32_t) + sizeof (*acp); 24174 return (mp); 24175 } 24176 24177 /* 24178 * Print a tcp_ioc_abort_conn_t structure. 24179 */ 24180 static void 24181 tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *acp) 24182 { 24183 char lbuf[128]; 24184 char rbuf[128]; 24185 sa_family_t af; 24186 in_port_t lport, rport; 24187 ushort_t logflags; 24188 24189 af = acp->ac_local.ss_family; 24190 24191 if (af == AF_INET) { 24192 (void) inet_ntop(af, (const void *)&TCP_AC_V4LOCAL(acp), 24193 lbuf, 128); 24194 (void) inet_ntop(af, (const void *)&TCP_AC_V4REMOTE(acp), 24195 rbuf, 128); 24196 lport = ntohs(TCP_AC_V4LPORT(acp)); 24197 rport = ntohs(TCP_AC_V4RPORT(acp)); 24198 } else { 24199 (void) inet_ntop(af, (const void *)&TCP_AC_V6LOCAL(acp), 24200 lbuf, 128); 24201 (void) inet_ntop(af, (const void *)&TCP_AC_V6REMOTE(acp), 24202 rbuf, 128); 24203 lport = ntohs(TCP_AC_V6LPORT(acp)); 24204 rport = ntohs(TCP_AC_V6RPORT(acp)); 24205 } 24206 24207 logflags = SL_TRACE | SL_NOTE; 24208 /* 24209 * Don't print this message to the console if the operation was done 24210 * to a non-global zone. 24211 */ 24212 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24213 logflags |= SL_CONSOLE; 24214 (void) strlog(TCP_MOD_ID, 0, 1, logflags, 24215 "TCP_IOC_ABORT_CONN: local = %s:%d, remote = %s:%d, " 24216 "start = %d, end = %d\n", lbuf, lport, rbuf, rport, 24217 acp->ac_start, acp->ac_end); 24218 } 24219 24220 /* 24221 * Called inside tcp_rput when a message built using 24222 * tcp_ioctl_abort_build_msg is put into a queue. 24223 * Note that when we get here there is no wildcard in acp any more. 24224 */ 24225 static void 24226 tcp_ioctl_abort_handler(tcp_t *tcp, mblk_t *mp) 24227 { 24228 tcp_ioc_abort_conn_t *acp; 24229 24230 acp = (tcp_ioc_abort_conn_t *)(mp->b_rptr + sizeof (uint32_t)); 24231 if (tcp->tcp_state <= acp->ac_end) { 24232 /* 24233 * If we get here, we are already on the correct 24234 * squeue. This ioctl follows the following path 24235 * tcp_wput -> tcp_wput_ioctl -> tcp_ioctl_abort_conn 24236 * ->tcp_ioctl_abort->squeue_fill (if on a 24237 * different squeue) 24238 */ 24239 int errcode; 24240 24241 TCP_AC_GET_ERRCODE(tcp->tcp_state, errcode); 24242 (void) tcp_clean_death(tcp, errcode, 26); 24243 } 24244 freemsg(mp); 24245 } 24246 24247 /* 24248 * Abort all matching connections on a hash chain. 24249 */ 24250 static int 24251 tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *acp, int index, int *count, 24252 boolean_t exact) 24253 { 24254 int nmatch, err = 0; 24255 tcp_t *tcp; 24256 MBLKP mp, last, listhead = NULL; 24257 conn_t *tconnp; 24258 connf_t *connfp = &ipcl_conn_fanout[index]; 24259 24260 startover: 24261 nmatch = 0; 24262 24263 mutex_enter(&connfp->connf_lock); 24264 for (tconnp = connfp->connf_head; tconnp != NULL; 24265 tconnp = tconnp->conn_next) { 24266 tcp = tconnp->conn_tcp; 24267 if (TCP_AC_MATCH(acp, tcp)) { 24268 CONN_INC_REF(tcp->tcp_connp); 24269 mp = tcp_ioctl_abort_build_msg(acp, tcp); 24270 if (mp == NULL) { 24271 err = ENOMEM; 24272 CONN_DEC_REF(tcp->tcp_connp); 24273 break; 24274 } 24275 mp->b_prev = (mblk_t *)tcp; 24276 24277 if (listhead == NULL) { 24278 listhead = mp; 24279 last = mp; 24280 } else { 24281 last->b_next = mp; 24282 last = mp; 24283 } 24284 nmatch++; 24285 if (exact) 24286 break; 24287 } 24288 24289 /* Avoid holding lock for too long. */ 24290 if (nmatch >= 500) 24291 break; 24292 } 24293 mutex_exit(&connfp->connf_lock); 24294 24295 /* Pass mp into the correct tcp */ 24296 while ((mp = listhead) != NULL) { 24297 listhead = listhead->b_next; 24298 tcp = (tcp_t *)mp->b_prev; 24299 mp->b_next = mp->b_prev = NULL; 24300 squeue_fill(tcp->tcp_connp->conn_sqp, mp, 24301 tcp_input, tcp->tcp_connp, SQTAG_TCP_ABORT_BUCKET); 24302 } 24303 24304 *count += nmatch; 24305 if (nmatch >= 500 && err == 0) 24306 goto startover; 24307 return (err); 24308 } 24309 24310 /* 24311 * Abort all connections that matches the attributes specified in acp. 24312 */ 24313 static int 24314 tcp_ioctl_abort(tcp_ioc_abort_conn_t *acp) 24315 { 24316 sa_family_t af; 24317 uint32_t ports; 24318 uint16_t *pports; 24319 int err = 0, count = 0; 24320 boolean_t exact = B_FALSE; /* set when there is no wildcard */ 24321 int index = -1; 24322 ushort_t logflags; 24323 24324 af = acp->ac_local.ss_family; 24325 24326 if (af == AF_INET) { 24327 if (TCP_AC_V4REMOTE(acp) != INADDR_ANY && 24328 TCP_AC_V4LPORT(acp) != 0 && TCP_AC_V4RPORT(acp) != 0) { 24329 pports = (uint16_t *)&ports; 24330 pports[1] = TCP_AC_V4LPORT(acp); 24331 pports[0] = TCP_AC_V4RPORT(acp); 24332 exact = (TCP_AC_V4LOCAL(acp) != INADDR_ANY); 24333 } 24334 } else { 24335 if (!IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE(acp)) && 24336 TCP_AC_V6LPORT(acp) != 0 && TCP_AC_V6RPORT(acp) != 0) { 24337 pports = (uint16_t *)&ports; 24338 pports[1] = TCP_AC_V6LPORT(acp); 24339 pports[0] = TCP_AC_V6RPORT(acp); 24340 exact = !IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL(acp)); 24341 } 24342 } 24343 24344 /* 24345 * For cases where remote addr, local port, and remote port are non- 24346 * wildcards, tcp_ioctl_abort_bucket will only be called once. 24347 */ 24348 if (index != -1) { 24349 err = tcp_ioctl_abort_bucket(acp, index, 24350 &count, exact); 24351 } else { 24352 /* 24353 * loop through all entries for wildcard case 24354 */ 24355 for (index = 0; index < ipcl_conn_fanout_size; index++) { 24356 err = tcp_ioctl_abort_bucket(acp, index, 24357 &count, exact); 24358 if (err != 0) 24359 break; 24360 } 24361 } 24362 24363 logflags = SL_TRACE | SL_NOTE; 24364 /* 24365 * Don't print this message to the console if the operation was done 24366 * to a non-global zone. 24367 */ 24368 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24369 logflags |= SL_CONSOLE; 24370 (void) strlog(TCP_MOD_ID, 0, 1, logflags, "TCP_IOC_ABORT_CONN: " 24371 "aborted %d connection%c\n", count, ((count > 1) ? 's' : ' ')); 24372 if (err == 0 && count == 0) 24373 err = ENOENT; 24374 return (err); 24375 } 24376 24377 /* 24378 * Process the TCP_IOC_ABORT_CONN ioctl request. 24379 */ 24380 static void 24381 tcp_ioctl_abort_conn(queue_t *q, mblk_t *mp) 24382 { 24383 int err; 24384 IOCP iocp; 24385 MBLKP mp1; 24386 sa_family_t laf, raf; 24387 tcp_ioc_abort_conn_t *acp; 24388 zone_t *zptr; 24389 zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 24390 24391 iocp = (IOCP)mp->b_rptr; 24392 24393 if ((mp1 = mp->b_cont) == NULL || 24394 iocp->ioc_count != sizeof (tcp_ioc_abort_conn_t)) { 24395 err = EINVAL; 24396 goto out; 24397 } 24398 24399 /* check permissions */ 24400 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 24401 err = EPERM; 24402 goto out; 24403 } 24404 24405 if (mp1->b_cont != NULL) { 24406 freemsg(mp1->b_cont); 24407 mp1->b_cont = NULL; 24408 } 24409 24410 acp = (tcp_ioc_abort_conn_t *)mp1->b_rptr; 24411 laf = acp->ac_local.ss_family; 24412 raf = acp->ac_remote.ss_family; 24413 24414 /* check that a zone with the supplied zoneid exists */ 24415 if (acp->ac_zoneid != GLOBAL_ZONEID && acp->ac_zoneid != ALL_ZONES) { 24416 zptr = zone_find_by_id(zoneid); 24417 if (zptr != NULL) { 24418 zone_rele(zptr); 24419 } else { 24420 err = EINVAL; 24421 goto out; 24422 } 24423 } 24424 24425 if (acp->ac_start < TCPS_SYN_SENT || acp->ac_end > TCPS_TIME_WAIT || 24426 acp->ac_start > acp->ac_end || laf != raf || 24427 (laf != AF_INET && laf != AF_INET6)) { 24428 err = EINVAL; 24429 goto out; 24430 } 24431 24432 tcp_ioctl_abort_dump(acp); 24433 err = tcp_ioctl_abort(acp); 24434 24435 out: 24436 if (mp1 != NULL) { 24437 freemsg(mp1); 24438 mp->b_cont = NULL; 24439 } 24440 24441 if (err != 0) 24442 miocnak(q, mp, 0, err); 24443 else 24444 miocack(q, mp, 0, 0); 24445 } 24446 24447 /* 24448 * tcp_time_wait_processing() handles processing of incoming packets when 24449 * the tcp is in the TIME_WAIT state. 24450 * A TIME_WAIT tcp that has an associated open TCP stream is never put 24451 * on the time wait list. 24452 */ 24453 void 24454 tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq, 24455 uint32_t seg_ack, int seg_len, tcph_t *tcph) 24456 { 24457 int32_t bytes_acked; 24458 int32_t gap; 24459 int32_t rgap; 24460 tcp_opt_t tcpopt; 24461 uint_t flags; 24462 uint32_t new_swnd = 0; 24463 conn_t *connp; 24464 24465 BUMP_LOCAL(tcp->tcp_ibsegs); 24466 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 24467 24468 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 24469 new_swnd = BE16_TO_U16(tcph->th_win) << 24470 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 24471 if (tcp->tcp_snd_ts_ok) { 24472 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 24473 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24474 tcp->tcp_rnxt, TH_ACK); 24475 goto done; 24476 } 24477 } 24478 gap = seg_seq - tcp->tcp_rnxt; 24479 rgap = tcp->tcp_rwnd - (gap + seg_len); 24480 if (gap < 0) { 24481 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 24482 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 24483 (seg_len > -gap ? -gap : seg_len)); 24484 seg_len += gap; 24485 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 24486 if (flags & TH_RST) { 24487 goto done; 24488 } 24489 if ((flags & TH_FIN) && seg_len == -1) { 24490 /* 24491 * When TCP receives a duplicate FIN in 24492 * TIME_WAIT state, restart the 2 MSL timer. 24493 * See page 73 in RFC 793. Make sure this TCP 24494 * is already on the TIME_WAIT list. If not, 24495 * just restart the timer. 24496 */ 24497 if (TCP_IS_DETACHED(tcp)) { 24498 tcp_time_wait_remove(tcp, NULL); 24499 tcp_time_wait_append(tcp); 24500 TCP_DBGSTAT(tcp_rput_time_wait); 24501 } else { 24502 ASSERT(tcp != NULL); 24503 TCP_TIMER_RESTART(tcp, 24504 tcp_time_wait_interval); 24505 } 24506 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24507 tcp->tcp_rnxt, TH_ACK); 24508 goto done; 24509 } 24510 flags |= TH_ACK_NEEDED; 24511 seg_len = 0; 24512 goto process_ack; 24513 } 24514 24515 /* Fix seg_seq, and chew the gap off the front. */ 24516 seg_seq = tcp->tcp_rnxt; 24517 } 24518 24519 if ((flags & TH_SYN) && gap > 0 && rgap < 0) { 24520 /* 24521 * Make sure that when we accept the connection, pick 24522 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the 24523 * old connection. 24524 * 24525 * The next ISS generated is equal to tcp_iss_incr_extra 24526 * + ISS_INCR/2 + other components depending on the 24527 * value of tcp_strong_iss. We pre-calculate the new 24528 * ISS here and compare with tcp_snxt to determine if 24529 * we need to make adjustment to tcp_iss_incr_extra. 24530 * 24531 * The above calculation is ugly and is a 24532 * waste of CPU cycles... 24533 */ 24534 uint32_t new_iss = tcp_iss_incr_extra; 24535 int32_t adj; 24536 24537 switch (tcp_strong_iss) { 24538 case 2: { 24539 /* Add time and MD5 components. */ 24540 uint32_t answer[4]; 24541 struct { 24542 uint32_t ports; 24543 in6_addr_t src; 24544 in6_addr_t dst; 24545 } arg; 24546 MD5_CTX context; 24547 24548 mutex_enter(&tcp_iss_key_lock); 24549 context = tcp_iss_key; 24550 mutex_exit(&tcp_iss_key_lock); 24551 arg.ports = tcp->tcp_ports; 24552 /* We use MAPPED addresses in tcp_iss_init */ 24553 arg.src = tcp->tcp_ip_src_v6; 24554 if (tcp->tcp_ipversion == IPV4_VERSION) { 24555 IN6_IPADDR_TO_V4MAPPED( 24556 tcp->tcp_ipha->ipha_dst, 24557 &arg.dst); 24558 } else { 24559 arg.dst = 24560 tcp->tcp_ip6h->ip6_dst; 24561 } 24562 MD5Update(&context, (uchar_t *)&arg, 24563 sizeof (arg)); 24564 MD5Final((uchar_t *)answer, &context); 24565 answer[0] ^= answer[1] ^ answer[2] ^ answer[3]; 24566 new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0]; 24567 break; 24568 } 24569 case 1: 24570 /* Add time component and min random (i.e. 1). */ 24571 new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1; 24572 break; 24573 default: 24574 /* Add only time component. */ 24575 new_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 24576 break; 24577 } 24578 if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) { 24579 /* 24580 * New ISS not guaranteed to be ISS_INCR/2 24581 * ahead of the current tcp_snxt, so add the 24582 * difference to tcp_iss_incr_extra. 24583 */ 24584 tcp_iss_incr_extra += adj; 24585 } 24586 /* 24587 * If tcp_clean_death() can not perform the task now, 24588 * drop the SYN packet and let the other side re-xmit. 24589 * Otherwise pass the SYN packet back in, since the 24590 * old tcp state has been cleaned up or freed. 24591 */ 24592 if (tcp_clean_death(tcp, 0, 27) == -1) 24593 goto done; 24594 /* 24595 * We will come back to tcp_rput_data 24596 * on the global queue. Packets destined 24597 * for the global queue will be checked 24598 * with global policy. But the policy for 24599 * this packet has already been checked as 24600 * this was destined for the detached 24601 * connection. We need to bypass policy 24602 * check this time by attaching a dummy 24603 * ipsec_in with ipsec_in_dont_check set. 24604 */ 24605 if ((connp = ipcl_classify(mp, tcp->tcp_connp->conn_zoneid)) != 24606 NULL) { 24607 TCP_STAT(tcp_time_wait_syn_success); 24608 tcp_reinput(connp, mp, tcp->tcp_connp->conn_sqp); 24609 return; 24610 } 24611 goto done; 24612 } 24613 24614 /* 24615 * rgap is the amount of stuff received out of window. A negative 24616 * value is the amount out of window. 24617 */ 24618 if (rgap < 0) { 24619 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 24620 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 24621 /* Fix seg_len and make sure there is something left. */ 24622 seg_len += rgap; 24623 if (seg_len <= 0) { 24624 if (flags & TH_RST) { 24625 goto done; 24626 } 24627 flags |= TH_ACK_NEEDED; 24628 seg_len = 0; 24629 goto process_ack; 24630 } 24631 } 24632 /* 24633 * Check whether we can update tcp_ts_recent. This test is 24634 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 24635 * Extensions for High Performance: An Update", Internet Draft. 24636 */ 24637 if (tcp->tcp_snd_ts_ok && 24638 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 24639 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 24640 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 24641 tcp->tcp_last_rcv_lbolt = lbolt64; 24642 } 24643 24644 if (seg_seq != tcp->tcp_rnxt && seg_len > 0) { 24645 /* Always ack out of order packets */ 24646 flags |= TH_ACK_NEEDED; 24647 seg_len = 0; 24648 } else if (seg_len > 0) { 24649 BUMP_MIB(&tcp_mib, tcpInClosed); 24650 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 24651 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 24652 } 24653 if (flags & TH_RST) { 24654 (void) tcp_clean_death(tcp, 0, 28); 24655 goto done; 24656 } 24657 if (flags & TH_SYN) { 24658 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 24659 TH_RST|TH_ACK); 24660 /* 24661 * Do not delete the TCP structure if it is in 24662 * TIME_WAIT state. Refer to RFC 1122, 4.2.2.13. 24663 */ 24664 goto done; 24665 } 24666 process_ack: 24667 if (flags & TH_ACK) { 24668 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 24669 if (bytes_acked <= 0) { 24670 if (bytes_acked == 0 && seg_len == 0 && 24671 new_swnd == tcp->tcp_swnd) 24672 BUMP_MIB(&tcp_mib, tcpInDupAck); 24673 } else { 24674 /* Acks something not sent */ 24675 flags |= TH_ACK_NEEDED; 24676 } 24677 } 24678 if (flags & TH_ACK_NEEDED) { 24679 /* 24680 * Time to send an ack for some reason. 24681 */ 24682 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24683 tcp->tcp_rnxt, TH_ACK); 24684 } 24685 done: 24686 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 24687 DB_CKSUMSTART(mp) = 0; 24688 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 24689 TCP_STAT(tcp_time_wait_syn_fail); 24690 } 24691 freemsg(mp); 24692 } 24693 24694 /* 24695 * Allocate a T_SVR4_OPTMGMT_REQ. 24696 * The caller needs to increment tcp_drop_opt_ack_cnt when sending these so 24697 * that tcp_rput_other can drop the acks. 24698 */ 24699 static mblk_t * 24700 tcp_setsockopt_mp(int level, int cmd, char *opt, int optlen) 24701 { 24702 mblk_t *mp; 24703 struct T_optmgmt_req *tor; 24704 struct opthdr *oh; 24705 uint_t size; 24706 char *optptr; 24707 24708 size = sizeof (*tor) + sizeof (*oh) + optlen; 24709 mp = allocb(size, BPRI_MED); 24710 if (mp == NULL) 24711 return (NULL); 24712 24713 mp->b_wptr += size; 24714 mp->b_datap->db_type = M_PROTO; 24715 tor = (struct T_optmgmt_req *)mp->b_rptr; 24716 tor->PRIM_type = T_SVR4_OPTMGMT_REQ; 24717 tor->MGMT_flags = T_NEGOTIATE; 24718 tor->OPT_length = sizeof (*oh) + optlen; 24719 tor->OPT_offset = (t_scalar_t)sizeof (*tor); 24720 24721 oh = (struct opthdr *)&tor[1]; 24722 oh->level = level; 24723 oh->name = cmd; 24724 oh->len = optlen; 24725 if (optlen != 0) { 24726 optptr = (char *)&oh[1]; 24727 bcopy(opt, optptr, optlen); 24728 } 24729 return (mp); 24730 } 24731 24732 /* 24733 * TCP Timers Implementation. 24734 */ 24735 timeout_id_t 24736 tcp_timeout(conn_t *connp, void (*f)(void *), clock_t tim) 24737 { 24738 mblk_t *mp; 24739 tcp_timer_t *tcpt; 24740 tcp_t *tcp = connp->conn_tcp; 24741 24742 ASSERT(connp->conn_sqp != NULL); 24743 24744 TCP_DBGSTAT(tcp_timeout_calls); 24745 24746 if (tcp->tcp_timercache == NULL) { 24747 mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC); 24748 } else { 24749 TCP_DBGSTAT(tcp_timeout_cached_alloc); 24750 mp = tcp->tcp_timercache; 24751 tcp->tcp_timercache = mp->b_next; 24752 mp->b_next = NULL; 24753 ASSERT(mp->b_wptr == NULL); 24754 } 24755 24756 CONN_INC_REF(connp); 24757 tcpt = (tcp_timer_t *)mp->b_rptr; 24758 tcpt->connp = connp; 24759 tcpt->tcpt_proc = f; 24760 tcpt->tcpt_tid = timeout(tcp_timer_callback, mp, tim); 24761 return ((timeout_id_t)mp); 24762 } 24763 24764 static void 24765 tcp_timer_callback(void *arg) 24766 { 24767 mblk_t *mp = (mblk_t *)arg; 24768 tcp_timer_t *tcpt; 24769 conn_t *connp; 24770 24771 tcpt = (tcp_timer_t *)mp->b_rptr; 24772 connp = tcpt->connp; 24773 squeue_fill(connp->conn_sqp, mp, 24774 tcp_timer_handler, connp, SQTAG_TCP_TIMER); 24775 } 24776 24777 static void 24778 tcp_timer_handler(void *arg, mblk_t *mp, void *arg2) 24779 { 24780 tcp_timer_t *tcpt; 24781 conn_t *connp = (conn_t *)arg; 24782 tcp_t *tcp = connp->conn_tcp; 24783 24784 tcpt = (tcp_timer_t *)mp->b_rptr; 24785 ASSERT(connp == tcpt->connp); 24786 ASSERT((squeue_t *)arg2 == connp->conn_sqp); 24787 24788 /* 24789 * If the TCP has reached the closed state, don't proceed any 24790 * further. This TCP logically does not exist on the system. 24791 * tcpt_proc could for example access queues, that have already 24792 * been qprocoff'ed off. Also see comments at the start of tcp_input 24793 */ 24794 if (tcp->tcp_state != TCPS_CLOSED) { 24795 (*tcpt->tcpt_proc)(connp); 24796 } else { 24797 tcp->tcp_timer_tid = 0; 24798 } 24799 tcp_timer_free(connp->conn_tcp, mp); 24800 } 24801 24802 /* 24803 * There is potential race with untimeout and the handler firing at the same 24804 * time. The mblock may be freed by the handler while we are trying to use 24805 * it. But since both should execute on the same squeue, this race should not 24806 * occur. 24807 */ 24808 clock_t 24809 tcp_timeout_cancel(conn_t *connp, timeout_id_t id) 24810 { 24811 mblk_t *mp = (mblk_t *)id; 24812 tcp_timer_t *tcpt; 24813 clock_t delta; 24814 24815 TCP_DBGSTAT(tcp_timeout_cancel_reqs); 24816 24817 if (mp == NULL) 24818 return (-1); 24819 24820 tcpt = (tcp_timer_t *)mp->b_rptr; 24821 ASSERT(tcpt->connp == connp); 24822 24823 delta = untimeout(tcpt->tcpt_tid); 24824 24825 if (delta >= 0) { 24826 TCP_DBGSTAT(tcp_timeout_canceled); 24827 tcp_timer_free(connp->conn_tcp, mp); 24828 CONN_DEC_REF(connp); 24829 } 24830 24831 return (delta); 24832 } 24833 24834 /* 24835 * Allocate space for the timer event. The allocation looks like mblk, but it is 24836 * not a proper mblk. To avoid confusion we set b_wptr to NULL. 24837 * 24838 * Dealing with failures: If we can't allocate from the timer cache we try 24839 * allocating from dblock caches using allocb_tryhard(). In this case b_wptr 24840 * points to b_rptr. 24841 * If we can't allocate anything using allocb_tryhard(), we perform a last 24842 * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and 24843 * save the actual allocation size in b_datap. 24844 */ 24845 mblk_t * 24846 tcp_timermp_alloc(int kmflags) 24847 { 24848 mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache, 24849 kmflags & ~KM_PANIC); 24850 24851 if (mp != NULL) { 24852 mp->b_next = mp->b_prev = NULL; 24853 mp->b_rptr = (uchar_t *)(&mp[1]); 24854 mp->b_wptr = NULL; 24855 mp->b_datap = NULL; 24856 mp->b_queue = NULL; 24857 } else if (kmflags & KM_PANIC) { 24858 /* 24859 * Failed to allocate memory for the timer. Try allocating from 24860 * dblock caches. 24861 */ 24862 TCP_STAT(tcp_timermp_allocfail); 24863 mp = allocb_tryhard(sizeof (tcp_timer_t)); 24864 if (mp == NULL) { 24865 size_t size = 0; 24866 /* 24867 * Memory is really low. Try tryhard allocation. 24868 */ 24869 TCP_STAT(tcp_timermp_allocdblfail); 24870 mp = kmem_alloc_tryhard(sizeof (mblk_t) + 24871 sizeof (tcp_timer_t), &size, kmflags); 24872 mp->b_rptr = (uchar_t *)(&mp[1]); 24873 mp->b_next = mp->b_prev = NULL; 24874 mp->b_wptr = (uchar_t *)-1; 24875 mp->b_datap = (dblk_t *)size; 24876 mp->b_queue = NULL; 24877 } 24878 ASSERT(mp->b_wptr != NULL); 24879 } 24880 TCP_DBGSTAT(tcp_timermp_alloced); 24881 24882 return (mp); 24883 } 24884 24885 /* 24886 * Free per-tcp timer cache. 24887 * It can only contain entries from tcp_timercache. 24888 */ 24889 void 24890 tcp_timermp_free(tcp_t *tcp) 24891 { 24892 mblk_t *mp; 24893 24894 while ((mp = tcp->tcp_timercache) != NULL) { 24895 ASSERT(mp->b_wptr == NULL); 24896 tcp->tcp_timercache = tcp->tcp_timercache->b_next; 24897 kmem_cache_free(tcp_timercache, mp); 24898 } 24899 } 24900 24901 /* 24902 * Free timer event. Put it on the per-tcp timer cache if there is not too many 24903 * events there already (currently at most two events are cached). 24904 * If the event is not allocated from the timer cache, free it right away. 24905 */ 24906 static void 24907 tcp_timer_free(tcp_t *tcp, mblk_t *mp) 24908 { 24909 mblk_t *mp1 = tcp->tcp_timercache; 24910 24911 if (mp->b_wptr != NULL) { 24912 /* 24913 * This allocation is not from a timer cache, free it right 24914 * away. 24915 */ 24916 if (mp->b_wptr != (uchar_t *)-1) 24917 freeb(mp); 24918 else 24919 kmem_free(mp, (size_t)mp->b_datap); 24920 } else if (mp1 == NULL || mp1->b_next == NULL) { 24921 /* Cache this timer block for future allocations */ 24922 mp->b_rptr = (uchar_t *)(&mp[1]); 24923 mp->b_next = mp1; 24924 tcp->tcp_timercache = mp; 24925 } else { 24926 kmem_cache_free(tcp_timercache, mp); 24927 TCP_DBGSTAT(tcp_timermp_freed); 24928 } 24929 } 24930 24931 /* 24932 * End of TCP Timers implementation. 24933 */ 24934 24935 /* 24936 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 24937 * on the specified backing STREAMS q. Note, the caller may make the 24938 * decision to call based on the tcp_t.tcp_flow_stopped value which 24939 * when check outside the q's lock is only an advisory check ... 24940 */ 24941 24942 void 24943 tcp_setqfull(tcp_t *tcp) 24944 { 24945 queue_t *q = tcp->tcp_wq; 24946 24947 if (!(q->q_flag & QFULL)) { 24948 mutex_enter(QLOCK(q)); 24949 if (!(q->q_flag & QFULL)) { 24950 /* still need to set QFULL */ 24951 q->q_flag |= QFULL; 24952 tcp->tcp_flow_stopped = B_TRUE; 24953 mutex_exit(QLOCK(q)); 24954 TCP_STAT(tcp_flwctl_on); 24955 } else { 24956 mutex_exit(QLOCK(q)); 24957 } 24958 } 24959 } 24960 24961 void 24962 tcp_clrqfull(tcp_t *tcp) 24963 { 24964 queue_t *q = tcp->tcp_wq; 24965 24966 if (q->q_flag & QFULL) { 24967 mutex_enter(QLOCK(q)); 24968 if (q->q_flag & QFULL) { 24969 q->q_flag &= ~QFULL; 24970 tcp->tcp_flow_stopped = B_FALSE; 24971 mutex_exit(QLOCK(q)); 24972 if (q->q_flag & QWANTW) 24973 qbackenable(q, 0); 24974 } else { 24975 mutex_exit(QLOCK(q)); 24976 } 24977 } 24978 } 24979 24980 /* 24981 * TCP Kstats implementation 24982 */ 24983 static void 24984 tcp_kstat_init(void) 24985 { 24986 tcp_named_kstat_t template = { 24987 { "rtoAlgorithm", KSTAT_DATA_INT32, 0 }, 24988 { "rtoMin", KSTAT_DATA_INT32, 0 }, 24989 { "rtoMax", KSTAT_DATA_INT32, 0 }, 24990 { "maxConn", KSTAT_DATA_INT32, 0 }, 24991 { "activeOpens", KSTAT_DATA_UINT32, 0 }, 24992 { "passiveOpens", KSTAT_DATA_UINT32, 0 }, 24993 { "attemptFails", KSTAT_DATA_UINT32, 0 }, 24994 { "estabResets", KSTAT_DATA_UINT32, 0 }, 24995 { "currEstab", KSTAT_DATA_UINT32, 0 }, 24996 { "inSegs", KSTAT_DATA_UINT32, 0 }, 24997 { "outSegs", KSTAT_DATA_UINT32, 0 }, 24998 { "retransSegs", KSTAT_DATA_UINT32, 0 }, 24999 { "connTableSize", KSTAT_DATA_INT32, 0 }, 25000 { "outRsts", KSTAT_DATA_UINT32, 0 }, 25001 { "outDataSegs", KSTAT_DATA_UINT32, 0 }, 25002 { "outDataBytes", KSTAT_DATA_UINT32, 0 }, 25003 { "retransBytes", KSTAT_DATA_UINT32, 0 }, 25004 { "outAck", KSTAT_DATA_UINT32, 0 }, 25005 { "outAckDelayed", KSTAT_DATA_UINT32, 0 }, 25006 { "outUrg", KSTAT_DATA_UINT32, 0 }, 25007 { "outWinUpdate", KSTAT_DATA_UINT32, 0 }, 25008 { "outWinProbe", KSTAT_DATA_UINT32, 0 }, 25009 { "outControl", KSTAT_DATA_UINT32, 0 }, 25010 { "outFastRetrans", KSTAT_DATA_UINT32, 0 }, 25011 { "inAckSegs", KSTAT_DATA_UINT32, 0 }, 25012 { "inAckBytes", KSTAT_DATA_UINT32, 0 }, 25013 { "inDupAck", KSTAT_DATA_UINT32, 0 }, 25014 { "inAckUnsent", KSTAT_DATA_UINT32, 0 }, 25015 { "inDataInorderSegs", KSTAT_DATA_UINT32, 0 }, 25016 { "inDataInorderBytes", KSTAT_DATA_UINT32, 0 }, 25017 { "inDataUnorderSegs", KSTAT_DATA_UINT32, 0 }, 25018 { "inDataUnorderBytes", KSTAT_DATA_UINT32, 0 }, 25019 { "inDataDupSegs", KSTAT_DATA_UINT32, 0 }, 25020 { "inDataDupBytes", KSTAT_DATA_UINT32, 0 }, 25021 { "inDataPartDupSegs", KSTAT_DATA_UINT32, 0 }, 25022 { "inDataPartDupBytes", KSTAT_DATA_UINT32, 0 }, 25023 { "inDataPastWinSegs", KSTAT_DATA_UINT32, 0 }, 25024 { "inDataPastWinBytes", KSTAT_DATA_UINT32, 0 }, 25025 { "inWinProbe", KSTAT_DATA_UINT32, 0 }, 25026 { "inWinUpdate", KSTAT_DATA_UINT32, 0 }, 25027 { "inClosed", KSTAT_DATA_UINT32, 0 }, 25028 { "rttUpdate", KSTAT_DATA_UINT32, 0 }, 25029 { "rttNoUpdate", KSTAT_DATA_UINT32, 0 }, 25030 { "timRetrans", KSTAT_DATA_UINT32, 0 }, 25031 { "timRetransDrop", KSTAT_DATA_UINT32, 0 }, 25032 { "timKeepalive", KSTAT_DATA_UINT32, 0 }, 25033 { "timKeepaliveProbe", KSTAT_DATA_UINT32, 0 }, 25034 { "timKeepaliveDrop", KSTAT_DATA_UINT32, 0 }, 25035 { "listenDrop", KSTAT_DATA_UINT32, 0 }, 25036 { "listenDropQ0", KSTAT_DATA_UINT32, 0 }, 25037 { "halfOpenDrop", KSTAT_DATA_UINT32, 0 }, 25038 { "outSackRetransSegs", KSTAT_DATA_UINT32, 0 }, 25039 { "connTableSize6", KSTAT_DATA_INT32, 0 } 25040 }; 25041 25042 tcp_mibkp = kstat_create(TCP_MOD_NAME, 0, TCP_MOD_NAME, 25043 "mib2", KSTAT_TYPE_NAMED, NUM_OF_FIELDS(tcp_named_kstat_t), 0); 25044 25045 if (tcp_mibkp == NULL) 25046 return; 25047 25048 template.rtoAlgorithm.value.ui32 = 4; 25049 template.rtoMin.value.ui32 = tcp_rexmit_interval_min; 25050 template.rtoMax.value.ui32 = tcp_rexmit_interval_max; 25051 template.maxConn.value.i32 = -1; 25052 25053 bcopy(&template, tcp_mibkp->ks_data, sizeof (template)); 25054 25055 tcp_mibkp->ks_update = tcp_kstat_update; 25056 25057 kstat_install(tcp_mibkp); 25058 } 25059 25060 static void 25061 tcp_kstat_fini(void) 25062 { 25063 25064 if (tcp_mibkp != NULL) { 25065 kstat_delete(tcp_mibkp); 25066 tcp_mibkp = NULL; 25067 } 25068 } 25069 25070 static int 25071 tcp_kstat_update(kstat_t *kp, int rw) 25072 { 25073 tcp_named_kstat_t *tcpkp; 25074 tcp_t *tcp; 25075 connf_t *connfp; 25076 conn_t *connp; 25077 int i; 25078 25079 if (!kp || !kp->ks_data) 25080 return (EIO); 25081 25082 if (rw == KSTAT_WRITE) 25083 return (EACCES); 25084 25085 tcpkp = (tcp_named_kstat_t *)kp->ks_data; 25086 25087 tcpkp->currEstab.value.ui32 = 0; 25088 25089 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 25090 connfp = &ipcl_globalhash_fanout[i]; 25091 connp = NULL; 25092 while ((connp = 25093 ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { 25094 tcp = connp->conn_tcp; 25095 switch (tcp_snmp_state(tcp)) { 25096 case MIB2_TCP_established: 25097 case MIB2_TCP_closeWait: 25098 tcpkp->currEstab.value.ui32++; 25099 break; 25100 } 25101 } 25102 } 25103 25104 tcpkp->activeOpens.value.ui32 = tcp_mib.tcpActiveOpens; 25105 tcpkp->passiveOpens.value.ui32 = tcp_mib.tcpPassiveOpens; 25106 tcpkp->attemptFails.value.ui32 = tcp_mib.tcpAttemptFails; 25107 tcpkp->estabResets.value.ui32 = tcp_mib.tcpEstabResets; 25108 tcpkp->inSegs.value.ui32 = tcp_mib.tcpInSegs; 25109 tcpkp->outSegs.value.ui32 = tcp_mib.tcpOutSegs; 25110 tcpkp->retransSegs.value.ui32 = tcp_mib.tcpRetransSegs; 25111 tcpkp->connTableSize.value.i32 = tcp_mib.tcpConnTableSize; 25112 tcpkp->outRsts.value.ui32 = tcp_mib.tcpOutRsts; 25113 tcpkp->outDataSegs.value.ui32 = tcp_mib.tcpOutDataSegs; 25114 tcpkp->outDataBytes.value.ui32 = tcp_mib.tcpOutDataBytes; 25115 tcpkp->retransBytes.value.ui32 = tcp_mib.tcpRetransBytes; 25116 tcpkp->outAck.value.ui32 = tcp_mib.tcpOutAck; 25117 tcpkp->outAckDelayed.value.ui32 = tcp_mib.tcpOutAckDelayed; 25118 tcpkp->outUrg.value.ui32 = tcp_mib.tcpOutUrg; 25119 tcpkp->outWinUpdate.value.ui32 = tcp_mib.tcpOutWinUpdate; 25120 tcpkp->outWinProbe.value.ui32 = tcp_mib.tcpOutWinProbe; 25121 tcpkp->outControl.value.ui32 = tcp_mib.tcpOutControl; 25122 tcpkp->outFastRetrans.value.ui32 = tcp_mib.tcpOutFastRetrans; 25123 tcpkp->inAckSegs.value.ui32 = tcp_mib.tcpInAckSegs; 25124 tcpkp->inAckBytes.value.ui32 = tcp_mib.tcpInAckBytes; 25125 tcpkp->inDupAck.value.ui32 = tcp_mib.tcpInDupAck; 25126 tcpkp->inAckUnsent.value.ui32 = tcp_mib.tcpInAckUnsent; 25127 tcpkp->inDataInorderSegs.value.ui32 = tcp_mib.tcpInDataInorderSegs; 25128 tcpkp->inDataInorderBytes.value.ui32 = tcp_mib.tcpInDataInorderBytes; 25129 tcpkp->inDataUnorderSegs.value.ui32 = tcp_mib.tcpInDataUnorderSegs; 25130 tcpkp->inDataUnorderBytes.value.ui32 = tcp_mib.tcpInDataUnorderBytes; 25131 tcpkp->inDataDupSegs.value.ui32 = tcp_mib.tcpInDataDupSegs; 25132 tcpkp->inDataDupBytes.value.ui32 = tcp_mib.tcpInDataDupBytes; 25133 tcpkp->inDataPartDupSegs.value.ui32 = tcp_mib.tcpInDataPartDupSegs; 25134 tcpkp->inDataPartDupBytes.value.ui32 = tcp_mib.tcpInDataPartDupBytes; 25135 tcpkp->inDataPastWinSegs.value.ui32 = tcp_mib.tcpInDataPastWinSegs; 25136 tcpkp->inDataPastWinBytes.value.ui32 = tcp_mib.tcpInDataPastWinBytes; 25137 tcpkp->inWinProbe.value.ui32 = tcp_mib.tcpInWinProbe; 25138 tcpkp->inWinUpdate.value.ui32 = tcp_mib.tcpInWinUpdate; 25139 tcpkp->inClosed.value.ui32 = tcp_mib.tcpInClosed; 25140 tcpkp->rttNoUpdate.value.ui32 = tcp_mib.tcpRttNoUpdate; 25141 tcpkp->rttUpdate.value.ui32 = tcp_mib.tcpRttUpdate; 25142 tcpkp->timRetrans.value.ui32 = tcp_mib.tcpTimRetrans; 25143 tcpkp->timRetransDrop.value.ui32 = tcp_mib.tcpTimRetransDrop; 25144 tcpkp->timKeepalive.value.ui32 = tcp_mib.tcpTimKeepalive; 25145 tcpkp->timKeepaliveProbe.value.ui32 = tcp_mib.tcpTimKeepaliveProbe; 25146 tcpkp->timKeepaliveDrop.value.ui32 = tcp_mib.tcpTimKeepaliveDrop; 25147 tcpkp->listenDrop.value.ui32 = tcp_mib.tcpListenDrop; 25148 tcpkp->listenDropQ0.value.ui32 = tcp_mib.tcpListenDropQ0; 25149 tcpkp->halfOpenDrop.value.ui32 = tcp_mib.tcpHalfOpenDrop; 25150 tcpkp->outSackRetransSegs.value.ui32 = tcp_mib.tcpOutSackRetransSegs; 25151 tcpkp->connTableSize6.value.i32 = tcp_mib.tcp6ConnTableSize; 25152 25153 return (0); 25154 } 25155 25156 void 25157 tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp) 25158 { 25159 uint16_t hdr_len; 25160 ipha_t *ipha; 25161 uint8_t *nexthdrp; 25162 tcph_t *tcph; 25163 25164 /* Already has an eager */ 25165 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 25166 TCP_STAT(tcp_reinput_syn); 25167 squeue_enter(connp->conn_sqp, mp, connp->conn_recv, 25168 connp, SQTAG_TCP_REINPUT_EAGER); 25169 return; 25170 } 25171 25172 switch (IPH_HDR_VERSION(mp->b_rptr)) { 25173 case IPV4_VERSION: 25174 ipha = (ipha_t *)mp->b_rptr; 25175 hdr_len = IPH_HDR_LENGTH(ipha); 25176 break; 25177 case IPV6_VERSION: 25178 if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, 25179 &hdr_len, &nexthdrp)) { 25180 CONN_DEC_REF(connp); 25181 freemsg(mp); 25182 return; 25183 } 25184 break; 25185 } 25186 25187 tcph = (tcph_t *)&mp->b_rptr[hdr_len]; 25188 if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) { 25189 mp->b_datap->db_struioflag |= STRUIO_EAGER; 25190 DB_CKSUMSTART(mp) = (intptr_t)sqp; 25191 } 25192 25193 squeue_fill(connp->conn_sqp, mp, connp->conn_recv, connp, 25194 SQTAG_TCP_REINPUT); 25195 } 25196 25197 static squeue_func_t 25198 tcp_squeue_switch(int val) 25199 { 25200 squeue_func_t rval = squeue_fill; 25201 25202 switch (val) { 25203 case 1: 25204 rval = squeue_enter_nodrain; 25205 break; 25206 case 2: 25207 rval = squeue_enter; 25208 break; 25209 default: 25210 break; 25211 } 25212 return (rval); 25213 } 25214 25215 static void 25216 tcp_squeue_add(squeue_t *sqp) 25217 { 25218 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 25219 sizeof (tcp_squeue_priv_t), KM_SLEEP); 25220 25221 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 25222 tcp_time_wait->tcp_time_wait_tid = timeout(tcp_time_wait_collector, 25223 sqp, TCP_TIME_WAIT_DELAY); 25224 if (tcp_free_list_max_cnt == 0) { 25225 int tcp_ncpus = ((boot_max_ncpus == -1) ? 25226 max_ncpus : boot_max_ncpus); 25227 25228 /* 25229 * Limit number of entries to 1% of availble memory / tcp_ncpus 25230 */ 25231 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 25232 (tcp_ncpus * sizeof (tcp_t) * 100); 25233 } 25234 tcp_time_wait->tcp_free_list_cnt = 0; 25235 } 25236