/* * CDDL HEADER START * * The contents of this file are subject to the terms of the * Common Development and Distribution License (the "License"). * You may not use this file except in compliance with the License. * * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE * or http://www.opensolaris.org/os/licensing. * See the License for the specific language governing permissions * and limitations under the License. * * When distributing Covered Code, include this CDDL HEADER in each * file and include the License file at usr/src/OPENSOLARIS.LICENSE. * If applicable, add the following below this CDDL HEADER, with the * fields enclosed by brackets "[]" replaced with your own identifying * information: Portions Copyright [yyyy] [name of copyright owner] * * CDDL HEADER END */ /* * Copyright 2008 Sun Microsystems, Inc. All rights reserved. * Use is subject to license terms. */ /* Copyright (c) 1990 Mentat Inc. */ #pragma ident "%Z%%M% %I% %E% SMI" const char tcp_version[] = "%Z%%M% %I% %E% SMI"; #include #include #include #include #include #include #include #define _SUN_TPI_VERSION 2 #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include #include /* * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) * * (Read the detailed design doc in PSARC case directory) * * The entire tcp state is contained in tcp_t and conn_t structure * which are allocated in tandem using ipcl_conn_create() and passing * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect * the references on the tcp_t. The tcp_t structure is never compressed * and packets always land on the correct TCP perimeter from the time * eager is created till the time tcp_t dies (as such the old mentat * TCP global queue is not used for detached state and no IPSEC checking * is required). The global queue is still allocated to send out resets * for connection which have no listeners and IP directly calls * tcp_xmit_listeners_reset() which does any policy check. * * Protection and Synchronisation mechanism: * * The tcp data structure does not use any kind of lock for protecting * its state but instead uses 'squeues' for mutual exclusion from various * read and write side threads. To access a tcp member, the thread should * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or * squeue_fill). Since the squeues allow a direct function call, caller * can pass any tcp function having prototype of edesc_t as argument * (different from traditional STREAMs model where packets come in only * designated entry points). The list of functions that can be directly * called via squeue are listed before the usual function prototype. * * Referencing: * * TCP is MT-Hot and we use a reference based scheme to make sure that the * tcp structure doesn't disappear when its needed. When the application * creates an outgoing connection or accepts an incoming connection, we * start out with 2 references on 'conn_ref'. One for TCP and one for IP. * The IP reference is just a symbolic reference since ip_tcpclose() * looks at tcp structure after tcp_close_output() returns which could * have dropped the last TCP reference. So as long as the connection is * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the * conn_t. The classifier puts its own reference when the connection is * inserted in listen or connected hash. Anytime a thread needs to enter * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr * on write side or by doing a classify on read side and then puts a * reference on the conn before doing squeue_enter/tryenter/fill. For * read side, the classifier itself puts the reference under fanout lock * to make sure that tcp can't disappear before it gets processed. The * squeue will drop this reference automatically so the called function * doesn't have to do a DEC_REF. * * Opening a new connection: * * The outgoing connection open is pretty simple. tcp_open() does the * work in creating the conn/tcp structure and initializing it. The * squeue assignment is done based on the CPU the application * is running on. So for outbound connections, processing is always done * on application CPU which might be different from the incoming CPU * being interrupted by the NIC. An optimal way would be to figure out * the NIC <-> CPU binding at listen time, and assign the outgoing * connection to the squeue attached to the CPU that will be interrupted * for incoming packets (we know the NIC based on the bind IP address). * This might seem like a problem if more data is going out but the * fact is that in most cases the transmit is ACK driven transmit where * the outgoing data normally sits on TCP's xmit queue waiting to be * transmitted. * * Accepting a connection: * * This is a more interesting case because of various races involved in * establishing a eager in its own perimeter. Read the meta comment on * top of tcp_conn_request(). But briefly, the squeue is picked by * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU. * * Closing a connection: * * The close is fairly straight forward. tcp_close() calls tcp_close_output() * via squeue to do the close and mark the tcp as detached if the connection * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its * reference but tcp_close() drop IP's reference always. So if tcp was * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP * and 1 because it is in classifier's connected hash. This is the condition * we use to determine that its OK to clean up the tcp outside of squeue * when time wait expires (check the ref under fanout and conn_lock and * if it is 2, remove it from fanout hash and kill it). * * Although close just drops the necessary references and marks the * tcp_detached state, tcp_close needs to know the tcp_detached has been * set (under squeue) before letting the STREAM go away (because a * inbound packet might attempt to go up the STREAM while the close * has happened and tcp_detached is not set). So a special lock and * flag is used along with a condition variable (tcp_closelock, tcp_closed, * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked * tcp_detached. * * Special provisions and fast paths: * * We make special provision for (AF_INET, SOCK_STREAM) sockets which * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY * check to send packets directly to tcp_rput_data via squeue. Everyone * else comes through tcp_input() on the read side. * * We also make special provisions for sockfs by marking tcp_issocket * whenever we have only sockfs on top of TCP. This allows us to skip * putting the tcp in acceptor hash since a sockfs listener can never * become acceptor and also avoid allocating a tcp_t for acceptor STREAM * since eager has already been allocated and the accept now happens * on acceptor STREAM. There is a big blob of comment on top of * tcp_conn_request explaining the new accept. When socket is POP'd, * sockfs sends us an ioctl to mark the fact and we go back to old * behaviour. Once tcp_issocket is unset, its never set for the * life of that connection. * * In support of on-board asynchronous DMA hardware (e.g. Intel I/OAT) * two consoldiation private KAPIs are used to enqueue M_DATA mblk_t's * directly to the socket (sodirect) and start an asynchronous copyout * to a user-land receive-side buffer (uioa) when a blocking socket read * (e.g. read, recv, ...) is pending. * * This is accomplished when tcp_issocket is set and tcp_sodirect is not * NULL so points to an sodirect_t and if marked enabled then we enqueue * all mblk_t's directly to the socket. * * Further, if the sodirect_t sod_uioa and if marked enabled (due to a * blocking socket read, e.g. user-land read, recv, ...) then an asynchronous * copyout will be started directly to the user-land uio buffer. Also, as we * have a pending read, TCP's push logic can take into account the number of * bytes to be received and only awake the blocked read()er when the uioa_t * byte count has been satisfied. * * IPsec notes : * * Since a packet is always executed on the correct TCP perimeter * all IPsec processing is defered to IP including checking new * connections and setting IPSEC policies for new connection. The * only exception is tcp_xmit_listeners_reset() which is called * directly from IP and needs to policy check to see if TH_RST * can be sent out. * * PFHooks notes : * * For mdt case, one meta buffer contains multiple packets. Mblks for every * packet are assembled and passed to the hooks. When packets are blocked, * or boundary of any packet is changed, the mdt processing is stopped, and * packets of the meta buffer are send to the IP path one by one. */ /* * Values for squeue switch: * 1: squeue_enter_nodrain * 2: squeue_enter * 3: squeue_fill */ int tcp_squeue_close = 2; /* Setable in /etc/system */ int tcp_squeue_wput = 2; squeue_func_t tcp_squeue_close_proc; squeue_func_t tcp_squeue_wput_proc; /* * Macros for sodirect: * * SOD_PTR_ENTER(tcp, sodp) - for the tcp_t pointer "tcp" set the * sodirect_t pointer "sodp" to the socket/tcp shared sodirect_t * if it exists and is enabled, else to NULL. Note, in the current * sodirect implementation the sod_lock must not be held across any * STREAMS call (e.g. putnext) else a "recursive mutex_enter" PANIC * will result as sod_lock is the streamhead stdata.sd_lock. * * SOD_NOT_ENABLED(tcp) - return true if not a sodirect tcp_t or the * sodirect_t isn't enabled, usefull for ASSERT()ing that a recieve * side tcp code path dealing with a tcp_rcv_list or putnext() isn't * being used when sodirect code paths should be. */ #define SOD_PTR_ENTER(tcp, sodp) \ (sodp) = (tcp)->tcp_sodirect; \ \ if ((sodp) != NULL) { \ mutex_enter((sodp)->sod_lock); \ if (!((sodp)->sod_state & SOD_ENABLED)) { \ mutex_exit((sodp)->sod_lock); \ (sodp) = NULL; \ } \ } #define SOD_NOT_ENABLED(tcp) \ ((tcp)->tcp_sodirect == NULL || \ !((tcp)->tcp_sodirect->sod_state & SOD_ENABLED)) /* * This controls how tiny a write must be before we try to copy it * into the the mblk on the tail of the transmit queue. Not much * speedup is observed for values larger than sixteen. Zero will * disable the optimisation. */ int tcp_tx_pull_len = 16; /* * TCP Statistics. * * How TCP statistics work. * * There are two types of statistics invoked by two macros. * * TCP_STAT(name) does non-atomic increment of a named stat counter. It is * supposed to be used in non MT-hot paths of the code. * * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is * supposed to be used for DEBUG purposes and may be used on a hot path. * * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat * (use "kstat tcp" to get them). * * There is also additional debugging facility that marks tcp_clean_death() * instances and saves them in tcp_t structure. It is triggered by * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for * tcp_clean_death() calls that counts the number of times each tag was hit. It * is triggered by TCP_CLD_COUNTERS define. * * How to add new counters. * * 1) Add a field in the tcp_stat structure describing your counter. * 2) Add a line in the template in tcp_kstat2_init() with the name * of the counter. * * IMPORTANT!! - make sure that both are in sync !! * 3) Use either TCP_STAT or TCP_DBGSTAT with the name. * * Please avoid using private counters which are not kstat-exported. * * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances * in tcp_t structure. * * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags. */ #ifndef TCP_DEBUG_COUNTER #ifdef DEBUG #define TCP_DEBUG_COUNTER 1 #else #define TCP_DEBUG_COUNTER 0 #endif #endif #define TCP_CLD_COUNTERS 0 #define TCP_TAG_CLEAN_DEATH 1 #define TCP_MAX_CLEAN_DEATH_TAG 32 #ifdef lint static int _lint_dummy_; #endif #if TCP_CLD_COUNTERS static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG]; #define TCP_CLD_STAT(x) tcp_clean_death_stat[x]++ #elif defined(lint) #define TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0); #else #define TCP_CLD_STAT(x) #endif #if TCP_DEBUG_COUNTER #define TCP_DBGSTAT(tcps, x) \ atomic_add_64(&((tcps)->tcps_statistics.x.value.ui64), 1) #define TCP_G_DBGSTAT(x) \ atomic_add_64(&(tcp_g_statistics.x.value.ui64), 1) #elif defined(lint) #define TCP_DBGSTAT(tcps, x) ASSERT(_lint_dummy_ == 0); #define TCP_G_DBGSTAT(x) ASSERT(_lint_dummy_ == 0); #else #define TCP_DBGSTAT(tcps, x) #define TCP_G_DBGSTAT(x) #endif #define TCP_G_STAT(x) (tcp_g_statistics.x.value.ui64++) tcp_g_stat_t tcp_g_statistics; kstat_t *tcp_g_kstat; /* * Call either ip_output or ip_output_v6. This replaces putnext() calls on the * tcp write side. */ #define CALL_IP_WPUT(connp, q, mp) { \ tcp_stack_t *tcps; \ \ tcps = connp->conn_netstack->netstack_tcp; \ ASSERT(((q)->q_flag & QREADR) == 0); \ TCP_DBGSTAT(tcps, tcp_ip_output); \ connp->conn_send(connp, (mp), (q), IP_WPUT); \ } /* Macros for timestamp comparisons */ #define TSTMP_GEQ(a, b) ((int32_t)((a)-(b)) >= 0) #define TSTMP_LT(a, b) ((int32_t)((a)-(b)) < 0) /* * Parameters for TCP Initial Send Sequence number (ISS) generation. When * tcp_strong_iss is set to 1, which is the default, the ISS is calculated * by adding three components: a time component which grows by 1 every 4096 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27); * a per-connection component which grows by 125000 for every new connection; * and an "extra" component that grows by a random amount centered * approximately on 64000. This causes the the ISS generator to cycle every * 4.89 hours if no TCP connections are made, and faster if connections are * made. * * When tcp_strong_iss is set to 0, ISS is calculated by adding two * components: a time component which grows by 250000 every second; and * a per-connection component which grows by 125000 for every new connections. * * A third method, when tcp_strong_iss is set to 2, for generating ISS is * prescribed by Steve Bellovin. This involves adding time, the 125000 per * connection, and a one-way hash (MD5) of the connection ID , a "truly" random (per RFC 1750) number, and a console-entered * password. */ #define ISS_INCR 250000 #define ISS_NSEC_SHT 12 static sin_t sin_null; /* Zero address for quick clears */ static sin6_t sin6_null; /* Zero address for quick clears */ /* * This implementation follows the 4.3BSD interpretation of the urgent * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause * incompatible changes in protocols like telnet and rlogin. */ #define TCP_OLD_URP_INTERPRETATION 1 #define TCP_IS_DETACHED_NONEAGER(tcp) \ (TCP_IS_DETACHED(tcp) && \ (!(tcp)->tcp_hard_binding)) /* * TCP reassembly macros. We hide starting and ending sequence numbers in * b_next and b_prev of messages on the reassembly queue. The messages are * chained using b_cont. These macros are used in tcp_reass() so we don't * have to see the ugly casts and assignments. */ #define TCP_REASS_SEQ(mp) ((uint32_t)(uintptr_t)((mp)->b_next)) #define TCP_REASS_SET_SEQ(mp, u) ((mp)->b_next = \ (mblk_t *)(uintptr_t)(u)) #define TCP_REASS_END(mp) ((uint32_t)(uintptr_t)((mp)->b_prev)) #define TCP_REASS_SET_END(mp, u) ((mp)->b_prev = \ (mblk_t *)(uintptr_t)(u)) /* * Implementation of TCP Timers. * ============================= * * INTERFACE: * * There are two basic functions dealing with tcp timers: * * timeout_id_t tcp_timeout(connp, func, time) * clock_t tcp_timeout_cancel(connp, timeout_id) * TCP_TIMER_RESTART(tcp, intvl) * * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func' * after 'time' ticks passed. The function called by timeout() must adhere to * the same restrictions as a driver soft interrupt handler - it must not sleep * or call other functions that might sleep. The value returned is the opaque * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to * cancel the request. The call to tcp_timeout() may fail in which case it * returns zero. This is different from the timeout(9F) function which never * fails. * * The call-back function 'func' always receives 'connp' as its single * argument. It is always executed in the squeue corresponding to the tcp * structure. The tcp structure is guaranteed to be present at the time the * call-back is called. * * NOTE: The call-back function 'func' is never called if tcp is in * the TCPS_CLOSED state. * * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout() * request. locks acquired by the call-back routine should not be held across * the call to tcp_timeout_cancel() or a deadlock may result. * * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request. * Otherwise, it returns an integer value greater than or equal to 0. In * particular, if the call-back function is already placed on the squeue, it can * not be canceled. * * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called * within squeue context corresponding to the tcp instance. Since the * call-back is also called via the same squeue, there are no race * conditions described in untimeout(9F) manual page since all calls are * strictly serialized. * * TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout * stored in tcp_timer_tid and starts a new one using * MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back * and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid * field. * * NOTE: since the timeout cancellation is not guaranteed, the cancelled * call-back may still be called, so it is possible tcp_timer() will be * called several times. This should not be a problem since tcp_timer() * should always check the tcp instance state. * * * IMPLEMENTATION: * * TCP timers are implemented using three-stage process. The call to * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function * when the timer expires. The tcp_timer_callback() arranges the call of the * tcp_timer_handler() function via squeue corresponding to the tcp * instance. The tcp_timer_handler() calls actual requested timeout call-back * and passes tcp instance as an argument to it. Information is passed between * stages using the tcp_timer_t structure which contains the connp pointer, the * tcp call-back to call and the timeout id returned by the timeout(9F). * * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t - * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout() * returns the pointer to this mblk. * * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It * looks like a normal mblk without actual dblk attached to it. * * To optimize performance each tcp instance holds a small cache of timer * mblocks. In the current implementation it caches up to two timer mblocks per * tcp instance. The cache is preserved over tcp frees and is only freed when * the whole tcp structure is destroyed by its kmem destructor. Since all tcp * timer processing happens on a corresponding squeue, the cache manipulation * does not require any locks. Experiments show that majority of timer mblocks * allocations are satisfied from the tcp cache and do not involve kmem calls. * * The tcp_timeout() places a refhold on the connp instance which guarantees * that it will be present at the time the call-back function fires. The * tcp_timer_handler() drops the reference after calling the call-back, so the * call-back function does not need to manipulate the references explicitly. */ typedef struct tcp_timer_s { conn_t *connp; void (*tcpt_proc)(void *); timeout_id_t tcpt_tid; } tcp_timer_t; static kmem_cache_t *tcp_timercache; kmem_cache_t *tcp_sack_info_cache; kmem_cache_t *tcp_iphc_cache; /* * For scalability, we must not run a timer for every TCP connection * in TIME_WAIT state. To see why, consider (for time wait interval of * 4 minutes): * 1000 connections/sec * 240 seconds/time wait = 240,000 active conn's * * This list is ordered by time, so you need only delete from the head * until you get to entries which aren't old enough to delete yet. * The list consists of only the detached TIME_WAIT connections. * * Note that the timer (tcp_time_wait_expire) is started when the tcp_t * becomes detached TIME_WAIT (either by changing the state and already * being detached or the other way around). This means that the TIME_WAIT * state can be extended (up to doubled) if the connection doesn't become * detached for a long time. * * The list manipulations (including tcp_time_wait_next/prev) * are protected by the tcp_time_wait_lock. The content of the * detached TIME_WAIT connections is protected by the normal perimeters. * * This list is per squeue and squeues are shared across the tcp_stack_t's. * Things on tcp_time_wait_head remain associated with the tcp_stack_t * and conn_netstack. * The tcp_t's that are added to tcp_free_list are disassociated and * have NULL tcp_tcps and conn_netstack pointers. */ typedef struct tcp_squeue_priv_s { kmutex_t tcp_time_wait_lock; timeout_id_t tcp_time_wait_tid; tcp_t *tcp_time_wait_head; tcp_t *tcp_time_wait_tail; tcp_t *tcp_free_list; uint_t tcp_free_list_cnt; } tcp_squeue_priv_t; /* * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs. * Running it every 5 seconds seems to give the best results. */ #define TCP_TIME_WAIT_DELAY drv_usectohz(5000000) /* * To prevent memory hog, limit the number of entries in tcp_free_list * to 1% of available memory / number of cpus */ uint_t tcp_free_list_max_cnt = 0; #define TCP_XMIT_LOWATER 4096 #define TCP_XMIT_HIWATER 49152 #define TCP_RECV_LOWATER 2048 #define TCP_RECV_HIWATER 49152 /* * PAWS needs a timer for 24 days. This is the number of ticks in 24 days */ #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) #define TIDUSZ 4096 /* transport interface data unit size */ /* * Bind hash list size and has function. It has to be a power of 2 for * hashing. */ #define TCP_BIND_FANOUT_SIZE 512 #define TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1)) /* * Size of listen and acceptor hash list. It has to be a power of 2 for * hashing. */ #define TCP_FANOUT_SIZE 256 #ifdef _ILP32 #define TCP_ACCEPTOR_HASH(accid) \ (((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1)) #else #define TCP_ACCEPTOR_HASH(accid) \ ((uint_t)(accid) & (TCP_FANOUT_SIZE - 1)) #endif /* _ILP32 */ #define IP_ADDR_CACHE_SIZE 2048 #define IP_ADDR_CACHE_HASH(faddr) \ (ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1)) /* Hash for HSPs uses all 32 bits, since both networks and hosts are in table */ #define TCP_HSP_HASH_SIZE 256 #define TCP_HSP_HASH(addr) \ (((addr>>24) ^ (addr >>16) ^ \ (addr>>8) ^ (addr)) % TCP_HSP_HASH_SIZE) /* * TCP options struct returned from tcp_parse_options. */ typedef struct tcp_opt_s { uint32_t tcp_opt_mss; uint32_t tcp_opt_wscale; uint32_t tcp_opt_ts_val; uint32_t tcp_opt_ts_ecr; tcp_t *tcp; } tcp_opt_t; /* * RFC1323-recommended phrasing of TSTAMP option, for easier parsing */ #ifdef _BIG_ENDIAN #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ (TCPOPT_TSTAMP << 8) | 10) #else #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ (TCPOPT_NOP << 8) | TCPOPT_NOP) #endif /* * Flags returned from tcp_parse_options. */ #define TCP_OPT_MSS_PRESENT 1 #define TCP_OPT_WSCALE_PRESENT 2 #define TCP_OPT_TSTAMP_PRESENT 4 #define TCP_OPT_SACK_OK_PRESENT 8 #define TCP_OPT_SACK_PRESENT 16 /* TCP option length */ #define TCPOPT_NOP_LEN 1 #define TCPOPT_MAXSEG_LEN 4 #define TCPOPT_WS_LEN 3 #define TCPOPT_REAL_WS_LEN (TCPOPT_WS_LEN+1) #define TCPOPT_TSTAMP_LEN 10 #define TCPOPT_REAL_TS_LEN (TCPOPT_TSTAMP_LEN+2) #define TCPOPT_SACK_OK_LEN 2 #define TCPOPT_REAL_SACK_OK_LEN (TCPOPT_SACK_OK_LEN+2) #define TCPOPT_REAL_SACK_LEN 4 #define TCPOPT_MAX_SACK_LEN 36 #define TCPOPT_HEADER_LEN 2 /* TCP cwnd burst factor. */ #define TCP_CWND_INFINITE 65535 #define TCP_CWND_SS 3 #define TCP_CWND_NORMAL 5 /* Maximum TCP initial cwin (start/restart). */ #define TCP_MAX_INIT_CWND 8 /* * Initialize cwnd according to RFC 3390. def_max_init_cwnd is * either tcp_slow_start_initial or tcp_slow_start_after idle * depending on the caller. If the upper layer has not used the * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd. * If the upper layer has changed set the tcp_init_cwnd, just use * it to calculate the tcp_cwnd. */ #define SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd) \ { \ if ((tcp)->tcp_init_cwnd == 0) { \ (tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss), \ MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \ } else { \ (tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss); \ } \ tcp->tcp_cwnd_cnt = 0; \ } /* TCP Timer control structure */ typedef struct tcpt_s { pfv_t tcpt_pfv; /* The routine we are to call */ tcp_t *tcpt_tcp; /* The parameter we are to pass in */ } tcpt_t; /* Host Specific Parameter structure */ typedef struct tcp_hsp { struct tcp_hsp *tcp_hsp_next; in6_addr_t tcp_hsp_addr_v6; in6_addr_t tcp_hsp_subnet_v6; uint_t tcp_hsp_vers; /* IPV4_VERSION | IPV6_VERSION */ int32_t tcp_hsp_sendspace; int32_t tcp_hsp_recvspace; int32_t tcp_hsp_tstamp; } tcp_hsp_t; #define tcp_hsp_addr V4_PART_OF_V6(tcp_hsp_addr_v6) #define tcp_hsp_subnet V4_PART_OF_V6(tcp_hsp_subnet_v6) /* * Functions called directly via squeue having a prototype of edesc_t. */ void tcp_conn_request(void *arg, mblk_t *mp, void *arg2); static void tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2); void tcp_accept_finish(void *arg, mblk_t *mp, void *arg2); static void tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2); static void tcp_wput_proto(void *arg, mblk_t *mp, void *arg2); void tcp_input(void *arg, mblk_t *mp, void *arg2); void tcp_rput_data(void *arg, mblk_t *mp, void *arg2); static void tcp_close_output(void *arg, mblk_t *mp, void *arg2); void tcp_output(void *arg, mblk_t *mp, void *arg2); static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2); static void tcp_timer_handler(void *arg, mblk_t *mp, void *arg2); static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2); /* Prototype for TCP functions */ static void tcp_random_init(void); int tcp_random(void); static void tcp_accept(tcp_t *tcp, mblk_t *mp); static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager); static int tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp); static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, int reuseaddr, boolean_t quick_connect, boolean_t bind_to_req_port_only, boolean_t user_specified); static void tcp_closei_local(tcp_t *tcp); static void tcp_close_detached(tcp_t *tcp); static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp, mblk_t **defermp); static void tcp_connect(tcp_t *tcp, mblk_t *mp); static void tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport, uint_t srcid); static void tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id); static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag); static void tcp_def_q_set(tcp_t *tcp, mblk_t *mp); static void tcp_disconnect(tcp_t *tcp, mblk_t *mp); static char *tcp_display(tcp_t *tcp, char *, char); static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum); static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only); static void tcp_eager_unlink(tcp_t *tcp); static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr, int unixerr); static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, int tlierr, int unixerr); static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static int tcp_tpistate(tcp_t *tcp); static void tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp, int caller_holds_lock); static void tcp_bind_hash_remove(tcp_t *tcp); static tcp_t *tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *); void tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp); static void tcp_acceptor_hash_remove(tcp_t *tcp); static void tcp_capability_req(tcp_t *tcp, mblk_t *mp); static void tcp_info_req(tcp_t *tcp, mblk_t *mp); static void tcp_addr_req(tcp_t *tcp, mblk_t *mp); static void tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *mp); void tcp_g_q_setup(tcp_stack_t *); void tcp_g_q_create(tcp_stack_t *); void tcp_g_q_destroy(tcp_stack_t *); static int tcp_header_init_ipv4(tcp_t *tcp); static int tcp_header_init_ipv6(tcp_t *tcp); int tcp_init(tcp_t *tcp, queue_t *q); static int tcp_init_values(tcp_t *tcp); static mblk_t *tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic); static mblk_t *tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length); static void tcp_ip_ire_mark_advice(tcp_t *tcp); static void tcp_ip_notify(tcp_t *tcp); static mblk_t *tcp_ire_mp(mblk_t *mp); static void tcp_iss_init(tcp_t *tcp); static void tcp_keepalive_killer(void *arg); static int tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt); static void tcp_mss_set(tcp_t *tcp, uint32_t size, boolean_t do_ss); static int tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp, int *t_errorp, int *sys_errorp); static boolean_t tcp_allow_connopt_set(int level, int name); int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr); int tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr); int tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, mblk_t *mblk); static void tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha); static int tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len); static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static boolean_t tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, tcp_stack_t *); static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static void tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *); static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static void tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt); static mblk_t *tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start); static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp); static void tcp_reinit(tcp_t *tcp); static void tcp_reinit_values(tcp_t *tcp); static void tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream, cred_t *cr); static uint_t tcp_rcv_drain(queue_t *q, tcp_t *tcp); static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags); static boolean_t tcp_send_rst_chk(tcp_stack_t *); static void tcp_ss_rexmit(tcp_t *tcp); static mblk_t *tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp); static void tcp_process_options(tcp_t *, tcph_t *); static void tcp_rput_common(tcp_t *tcp, mblk_t *mp); static void tcp_rsrv(queue_t *q); static int tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd); static int tcp_snmp_state(tcp_t *tcp); static int tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static int tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static int tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr); static int tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); static void tcp_timer(void *arg); static void tcp_timer_callback(void *); static in_port_t tcp_update_next_port(in_port_t port, const tcp_t *tcp, boolean_t random); static in_port_t tcp_get_next_priv_port(const tcp_t *); static void tcp_wput_sock(queue_t *q, mblk_t *mp); void tcp_wput_accept(queue_t *q, mblk_t *mp); static void tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent); static void tcp_wput_flush(tcp_t *tcp, mblk_t *mp); static void tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp); static int tcp_send(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, const int mdt_thres); static int tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, const int mdt_thres); static void tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk); static void tcp_wsrv(queue_t *q); static int tcp_xmit_end(tcp_t *tcp); static void tcp_ack_timer(void *arg); static mblk_t *tcp_ack_mp(tcp_t *tcp); static void tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq, uint32_t ack, int ctl, uint_t ip_hdr_len, zoneid_t zoneid, tcp_stack_t *, conn_t *connp); static void tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl); static tcp_hsp_t *tcp_hsp_lookup(ipaddr_t addr, tcp_stack_t *); static tcp_hsp_t *tcp_hsp_lookup_ipv6(in6_addr_t *addr, tcp_stack_t *); static int setmaxps(queue_t *q, int maxpsz); static void tcp_set_rto(tcp_t *, time_t); static boolean_t tcp_check_policy(tcp_t *, mblk_t *, ipha_t *, ip6_t *, boolean_t, boolean_t); static void tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl); static mblk_t *tcp_setsockopt_mp(int level, int cmd, char *opt, int optlen); static int tcp_build_hdrs(queue_t *, tcp_t *); static void tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq, uint32_t seg_ack, int seg_len, tcph_t *tcph); boolean_t tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp); boolean_t tcp_reserved_port_add(int, in_port_t *, in_port_t *); boolean_t tcp_reserved_port_del(in_port_t, in_port_t); boolean_t tcp_reserved_port_check(in_port_t, tcp_stack_t *); static tcp_t *tcp_alloc_temp_tcp(in_port_t, tcp_stack_t *); static int tcp_reserved_port_list(queue_t *, mblk_t *, caddr_t, cred_t *); static mblk_t *tcp_mdt_info_mp(mblk_t *); static void tcp_mdt_update(tcp_t *, ill_mdt_capab_t *, boolean_t); static int tcp_mdt_add_attrs(multidata_t *, const mblk_t *, const boolean_t, const uint32_t, const uint32_t, const uint32_t, const uint32_t, tcp_stack_t *); static void tcp_multisend_data(tcp_t *, ire_t *, const ill_t *, mblk_t *, const uint_t, const uint_t, boolean_t *); static mblk_t *tcp_lso_info_mp(mblk_t *); static void tcp_lso_update(tcp_t *, ill_lso_capab_t *); static void tcp_send_data(tcp_t *, queue_t *, mblk_t *); extern mblk_t *tcp_timermp_alloc(int); extern void tcp_timermp_free(tcp_t *); static void tcp_timer_free(tcp_t *tcp, mblk_t *mp); static void tcp_stop_lingering(tcp_t *tcp); static void tcp_close_linger_timeout(void *arg); static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); static void tcp_stack_shutdown(netstackid_t stackid, void *arg); static void tcp_stack_fini(netstackid_t stackid, void *arg); static void *tcp_g_kstat_init(tcp_g_stat_t *); static void tcp_g_kstat_fini(kstat_t *); static void *tcp_kstat_init(netstackid_t, tcp_stack_t *); static void tcp_kstat_fini(netstackid_t, kstat_t *); static void *tcp_kstat2_init(netstackid_t, tcp_stat_t *); static void tcp_kstat2_fini(netstackid_t, kstat_t *); static int tcp_kstat_update(kstat_t *kp, int rw); void tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp); static int tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, tcph_t *tcph, uint_t ipvers, mblk_t *idmp); static int tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, tcph_t *tcph, mblk_t *idmp); static squeue_func_t tcp_squeue_switch(int); static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); static int tcp_close(queue_t *, int); static int tcpclose_accept(queue_t *); static void tcp_squeue_add(squeue_t *); static boolean_t tcp_zcopy_check(tcp_t *); static void tcp_zcopy_notify(tcp_t *); static mblk_t *tcp_zcopy_disable(tcp_t *, mblk_t *); static mblk_t *tcp_zcopy_backoff(tcp_t *, mblk_t *, int); static void tcp_ire_ill_check(tcp_t *, ire_t *, ill_t *, boolean_t); extern void tcp_kssl_input(tcp_t *, mblk_t *); void tcp_eager_kill(void *arg, mblk_t *mp, void *arg2); void tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2); /* * Routines related to the TCP_IOC_ABORT_CONN ioctl command. * * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure * (defined in tcp.h) needs to be filled in and passed into the kernel * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t * structure contains the four-tuple of a TCP connection and a range of TCP * states (specified by ac_start and ac_end). The use of wildcard addresses * and ports is allowed. Connections with a matching four tuple and a state * within the specified range will be aborted. The valid states for the * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT, * inclusive. * * An application which has its connection aborted by this ioctl will receive * an error that is dependent on the connection state at the time of the abort. * If the connection state is < TCPS_TIME_WAIT, an application should behave as * though a RST packet has been received. If the connection state is equal to * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel * and all resources associated with the connection will be freed. */ static mblk_t *tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *); static void tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *); static void tcp_ioctl_abort_handler(tcp_t *, mblk_t *); static int tcp_ioctl_abort(tcp_ioc_abort_conn_t *, tcp_stack_t *tcps); static void tcp_ioctl_abort_conn(queue_t *, mblk_t *); static int tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *, boolean_t, tcp_stack_t *); static struct module_info tcp_rinfo = { TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER }; static struct module_info tcp_winfo = { TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 }; /* * Entry points for TCP as a device. The normal case which supports * the TCP functionality. * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. */ struct qinit tcp_rinitv4 = { NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_close, NULL, &tcp_rinfo }; struct qinit tcp_rinitv6 = { NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_close, NULL, &tcp_rinfo }; struct qinit tcp_winit = { (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo }; /* Initial entry point for TCP in socket mode. */ struct qinit tcp_sock_winit = { (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo }; /* * Entry points for TCP as a acceptor STREAM opened by sockfs when doing * an accept. Avoid allocating data structures since eager has already * been created. */ struct qinit tcp_acceptor_rinit = { NULL, (pfi_t)tcp_rsrv, NULL, tcpclose_accept, NULL, &tcp_winfo }; struct qinit tcp_acceptor_winit = { (pfi_t)tcp_wput_accept, NULL, NULL, NULL, NULL, &tcp_winfo }; /* * Entry points for TCP loopback (read side only) * The open routine is only used for reopens, thus no need to * have a separate one for tcp_openv6. */ struct qinit tcp_loopback_rinit = { (pfi_t)0, (pfi_t)tcp_rsrv, tcp_openv4, tcp_close, (pfi_t)0, &tcp_rinfo, NULL, tcp_fuse_rrw, tcp_fuse_rinfop, STRUIOT_STANDARD }; /* For AF_INET aka /dev/tcp */ struct streamtab tcpinfov4 = { &tcp_rinitv4, &tcp_winit }; /* For AF_INET6 aka /dev/tcp6 */ struct streamtab tcpinfov6 = { &tcp_rinitv6, &tcp_winit }; /* * Have to ensure that tcp_g_q_close is not done by an * interrupt thread. */ static taskq_t *tcp_taskq; /* * TCP has a private interface for other kernel modules to reserve a * port range for them to use. Once reserved, TCP will not use any ports * in the range. This interface relies on the TCP_EXCLBIND feature. If * the semantics of TCP_EXCLBIND is changed, implementation of this interface * has to be verified. * * There can be TCP_RESERVED_PORTS_ARRAY_MAX_SIZE port ranges. Each port * range can cover at most TCP_RESERVED_PORTS_RANGE_MAX ports. A port * range is [port a, port b] inclusive. And each port range is between * TCP_LOWESET_RESERVED_PORT and TCP_LARGEST_RESERVED_PORT inclusive. * * Note that the default anonymous port range starts from 32768. There is * no port "collision" between that and the reserved port range. If there * is port collision (because the default smallest anonymous port is lowered * or some apps specifically bind to ports in the reserved port range), the * system may not be able to reserve a port range even there are enough * unbound ports as a reserved port range contains consecutive ports . */ #define TCP_RESERVED_PORTS_ARRAY_MAX_SIZE 5 #define TCP_RESERVED_PORTS_RANGE_MAX 1000 #define TCP_SMALLEST_RESERVED_PORT 10240 #define TCP_LARGEST_RESERVED_PORT 20480 /* Structure to represent those reserved port ranges. */ typedef struct tcp_rport_s { in_port_t lo_port; in_port_t hi_port; tcp_t **temp_tcp_array; } tcp_rport_t; /* Setable only in /etc/system. Move to ndd? */ boolean_t tcp_icmp_source_quench = B_FALSE; /* * Following assumes TPI alignment requirements stay along 32 bit * boundaries */ #define ROUNDUP32(x) \ (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) /* Template for response to info request. */ static struct T_info_ack tcp_g_t_info_ack = { T_INFO_ACK, /* PRIM_type */ 0, /* TSDU_size */ T_INFINITE, /* ETSDU_size */ T_INVALID, /* CDATA_size */ T_INVALID, /* DDATA_size */ sizeof (sin_t), /* ADDR_size */ 0, /* OPT_size - not initialized here */ TIDUSZ, /* TIDU_size */ T_COTS_ORD, /* SERV_type */ TCPS_IDLE, /* CURRENT_state */ (XPG4_1|EXPINLINE) /* PROVIDER_flag */ }; static struct T_info_ack tcp_g_t_info_ack_v6 = { T_INFO_ACK, /* PRIM_type */ 0, /* TSDU_size */ T_INFINITE, /* ETSDU_size */ T_INVALID, /* CDATA_size */ T_INVALID, /* DDATA_size */ sizeof (sin6_t), /* ADDR_size */ 0, /* OPT_size - not initialized here */ TIDUSZ, /* TIDU_size */ T_COTS_ORD, /* SERV_type */ TCPS_IDLE, /* CURRENT_state */ (XPG4_1|EXPINLINE) /* PROVIDER_flag */ }; #define MS 1L #define SECONDS (1000 * MS) #define MINUTES (60 * SECONDS) #define HOURS (60 * MINUTES) #define DAYS (24 * HOURS) #define PARAM_MAX (~(uint32_t)0) /* Max size IP datagram is 64k - 1 */ #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcph_t))) #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcph_t))) /* Max of the above */ #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 /* Largest TCP port number */ #define TCP_MAX_PORT (64 * 1024 - 1) /* * tcp_wroff_xtra is the extra space in front of TCP/IP header for link * layer header. It has to be a multiple of 4. */ static tcpparam_t lcl_tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; #define tcps_wroff_xtra tcps_wroff_xtra_param->tcp_param_val /* * All of these are alterable, within the min/max values given, at run time. * Note that the default value of "tcp_time_wait_interval" is four minutes, * per the TCP spec. */ /* BEGIN CSTYLED */ static tcpparam_t lcl_tcp_param_arr[] = { /*min max value name */ { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, { 1, 1024, 1, "tcp_conn_req_min" }, { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, { 128, (1<<30), 1024*1024, "tcp_cwnd_max" }, { 0, 10, 0, "tcp_debug" }, { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, { 500*MS, PARAM_MAX, 8*MINUTES, "tcp_ip_abort_interval"}, { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, { 1, 255, 64, "tcp_ipv4_ttl"}, { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, { 0, 100, 10, "tcp_maxpsz_multiplier" }, { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, { 1*MS, 20*SECONDS, 3*SECONDS, "tcp_rexmit_interval_initial"}, { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, { 0, 16, 0, "tcp_snd_lowat_fraction" }, { 0, 128000, 0, "tcp_sth_rcv_hiwat" }, { 0, 128000, 0, "tcp_sth_rcv_lowat" }, { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, { 0, 1, 0, "tcp_ignore_path_mtu" }, { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, { 0, TCP_MSS_MAX, 64, "tcp_co_min"}, { 8192, (1<<30), 1024*1024, "tcp_max_buf"}, /* * Question: What default value should I set for tcp_strong_iss? */ { 0, 2, 1, "tcp_strong_iss"}, { 0, 65536, 20, "tcp_rtt_updates"}, { 0, 1, 1, "tcp_wscale_always"}, { 0, 1, 0, "tcp_tstamp_always"}, { 0, 1, 1, "tcp_tstamp_if_wscale"}, { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, { 0, 16, 2, "tcp_deferred_acks_max"}, { 1, 16384, 4, "tcp_slow_start_after_idle"}, { 1, 4, 4, "tcp_slow_start_initial"}, { 10*MS, 50*MS, 20*MS, "tcp_co_timer_interval"}, { 0, 2, 2, "tcp_sack_permitted"}, { 0, 1, 0, "tcp_trace"}, { 0, 1, 1, "tcp_compression_enabled"}, { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, { 0, 1, 0, "tcp_rev_src_routes"}, { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, { 100*MS, 60*SECONDS, 1*SECONDS, "tcp_ndd_get_info_interval"}, { 0, 16, 8, "tcp_local_dacks_max"}, { 0, 2, 1, "tcp_ecn_permitted"}, { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, }; /* END CSTYLED */ /* * tcp_mdt_hdr_{head,tail}_min are the leading and trailing spaces of * each header fragment in the header buffer. Each parameter value has * to be a multiple of 4 (32-bit aligned). */ static tcpparam_t lcl_tcp_mdt_head_param = { 32, 256, 32, "tcp_mdt_hdr_head_min" }; static tcpparam_t lcl_tcp_mdt_tail_param = { 0, 256, 32, "tcp_mdt_hdr_tail_min" }; #define tcps_mdt_hdr_head_min tcps_mdt_head_param->tcp_param_val #define tcps_mdt_hdr_tail_min tcps_mdt_tail_param->tcp_param_val /* * tcp_mdt_max_pbufs is the upper limit value that tcp uses to figure out * the maximum number of payload buffers associated per Multidata. */ static tcpparam_t lcl_tcp_mdt_max_pbufs_param = { 1, MULTIDATA_MAX_PBUFS, MULTIDATA_MAX_PBUFS, "tcp_mdt_max_pbufs" }; #define tcps_mdt_max_pbufs tcps_mdt_max_pbufs_param->tcp_param_val /* Round up the value to the nearest mss. */ #define MSS_ROUNDUP(value, mss) ((((value) - 1) / (mss) + 1) * (mss)) /* * Set ECN capable transport (ECT) code point in IP header. * * Note that there are 2 ECT code points '01' and '10', which are called * ECT(1) and ECT(0) respectively. Here we follow the original ECT code * point ECT(0) for TCP as described in RFC 2481. */ #define SET_ECT(tcp, iph) \ if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ /* We need to clear the code point first. */ \ ((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \ ((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \ } else { \ ((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \ ((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \ } /* * The format argument to pass to tcp_display(). * DISP_PORT_ONLY means that the returned string has only port info. * DISP_ADDR_AND_PORT means that the returned string also contains the * remote and local IP address. */ #define DISP_PORT_ONLY 1 #define DISP_ADDR_AND_PORT 2 #define NDD_TOO_QUICK_MSG \ "ndd get info rate too high for non-privileged users, try again " \ "later.\n" #define NDD_OUT_OF_BUF_MSG "<< Out of buffer >>\n" #define IS_VMLOANED_MBLK(mp) \ (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) /* Enable or disable b_cont M_MULTIDATA chaining for MDT. */ boolean_t tcp_mdt_chain = B_TRUE; /* * MDT threshold in the form of effective send MSS multiplier; we take * the MDT path if the amount of unsent data exceeds the threshold value * (default threshold is 1*SMSS). */ uint_t tcp_mdt_smss_threshold = 1; uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ /* * Forces all connections to obey the value of the tcps_maxpsz_multiplier * tunable settable via NDD. Otherwise, the per-connection behavior is * determined dynamically during tcp_adapt_ire(), which is the default. */ boolean_t tcp_static_maxpsz = B_FALSE; /* Setable in /etc/system */ /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */ uint32_t tcp_random_anon_port = 1; /* * To reach to an eager in Q0 which can be dropped due to an incoming * new SYN request when Q0 is full, a new doubly linked list is * introduced. This list allows to select an eager from Q0 in O(1) time. * This is needed to avoid spending too much time walking through the * long list of eagers in Q0 when tcp_drop_q0() is called. Each member of * this new list has to be a member of Q0. * This list is headed by listener's tcp_t. When the list is empty, * both the pointers - tcp_eager_next_drop_q0 and tcp_eager_prev_drop_q0, * of listener's tcp_t point to listener's tcp_t itself. * * Given an eager in Q0 and a listener, MAKE_DROPPABLE() puts the eager * in the list. MAKE_UNDROPPABLE() takes the eager out of the list. * These macros do not affect the eager's membership to Q0. */ #define MAKE_DROPPABLE(listener, eager) \ if ((eager)->tcp_eager_next_drop_q0 == NULL) { \ (listener)->tcp_eager_next_drop_q0->tcp_eager_prev_drop_q0\ = (eager); \ (eager)->tcp_eager_prev_drop_q0 = (listener); \ (eager)->tcp_eager_next_drop_q0 = \ (listener)->tcp_eager_next_drop_q0; \ (listener)->tcp_eager_next_drop_q0 = (eager); \ } #define MAKE_UNDROPPABLE(eager) \ if ((eager)->tcp_eager_next_drop_q0 != NULL) { \ (eager)->tcp_eager_next_drop_q0->tcp_eager_prev_drop_q0 \ = (eager)->tcp_eager_prev_drop_q0; \ (eager)->tcp_eager_prev_drop_q0->tcp_eager_next_drop_q0 \ = (eager)->tcp_eager_next_drop_q0; \ (eager)->tcp_eager_prev_drop_q0 = NULL; \ (eager)->tcp_eager_next_drop_q0 = NULL; \ } /* * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent * data, TCP will not respond with an ACK. RFC 793 requires that * TCP responds with an ACK for such a bogus ACK. By not following * the RFC, we prevent TCP from getting into an ACK storm if somehow * an attacker successfully spoofs an acceptable segment to our * peer; or when our peer is "confused." */ uint32_t tcp_drop_ack_unsent_cnt = 10; /* * Hook functions to enable cluster networking * On non-clustered systems these vectors must always be NULL. */ void (*cl_inet_listen)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp, in_port_t lport) = NULL; void (*cl_inet_unlisten)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp, in_port_t lport) = NULL; void (*cl_inet_connect)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp, in_port_t lport, uint8_t *faddrp, in_port_t fport) = NULL; void (*cl_inet_disconnect)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp, in_port_t lport, uint8_t *faddrp, in_port_t fport) = NULL; /* * The following are defined in ip.c */ extern int (*cl_inet_isclusterwide)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp); extern uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family, uint8_t *laddrp, uint8_t *faddrp); #define CL_INET_CONNECT(tcp) { \ if (cl_inet_connect != NULL) { \ /* \ * Running in cluster mode - register active connection \ * information \ */ \ if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ if ((tcp)->tcp_ipha->ipha_src != 0) { \ (*cl_inet_connect)(IPPROTO_TCP, AF_INET,\ (uint8_t *)(&((tcp)->tcp_ipha->ipha_src)),\ (in_port_t)(tcp)->tcp_lport, \ (uint8_t *)(&((tcp)->tcp_ipha->ipha_dst)),\ (in_port_t)(tcp)->tcp_fport); \ } \ } else { \ if (!IN6_IS_ADDR_UNSPECIFIED( \ &(tcp)->tcp_ip6h->ip6_src)) {\ (*cl_inet_connect)(IPPROTO_TCP, AF_INET6,\ (uint8_t *)(&((tcp)->tcp_ip6h->ip6_src)),\ (in_port_t)(tcp)->tcp_lport, \ (uint8_t *)(&((tcp)->tcp_ip6h->ip6_dst)),\ (in_port_t)(tcp)->tcp_fport); \ } \ } \ } \ } #define CL_INET_DISCONNECT(tcp) { \ if (cl_inet_disconnect != NULL) { \ /* \ * Running in cluster mode - deregister active \ * connection information \ */ \ if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ if ((tcp)->tcp_ip_src != 0) { \ (*cl_inet_disconnect)(IPPROTO_TCP, \ AF_INET, \ (uint8_t *)(&((tcp)->tcp_ip_src)),\ (in_port_t)(tcp)->tcp_lport, \ (uint8_t *) \ (&((tcp)->tcp_ipha->ipha_dst)),\ (in_port_t)(tcp)->tcp_fport); \ } \ } else { \ if (!IN6_IS_ADDR_UNSPECIFIED( \ &(tcp)->tcp_ip_src_v6)) { \ (*cl_inet_disconnect)(IPPROTO_TCP, AF_INET6,\ (uint8_t *)(&((tcp)->tcp_ip_src_v6)),\ (in_port_t)(tcp)->tcp_lport, \ (uint8_t *) \ (&((tcp)->tcp_ip6h->ip6_dst)),\ (in_port_t)(tcp)->tcp_fport); \ } \ } \ } \ } /* * Cluster networking hook for traversing current connection list. * This routine is used to extract the current list of live connections * which must continue to to be dispatched to this node. */ int cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg); static int cl_tcp_walk_list_stack(int (*callback)(cl_tcp_info_t *, void *), void *arg, tcp_stack_t *tcps); #define DTRACE_IP_FASTPATH(mp, iph, ill, ipha, ip6h) \ DTRACE_IP7(send, mblk_t *, mp, conn_t *, NULL, void_ip_t *, \ iph, __dtrace_ipsr_ill_t *, ill, ipha_t *, ipha, \ ip6_t *, ip6h, int, 0); /* * Figure out the value of window scale opton. Note that the rwnd is * ASSUMED to be rounded up to the nearest MSS before the calculation. * We cannot find the scale value and then do a round up of tcp_rwnd * because the scale value may not be correct after that. * * Set the compiler flag to make this function inline. */ static void tcp_set_ws_value(tcp_t *tcp) { int i; uint32_t rwnd = tcp->tcp_rwnd; for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; i++, rwnd >>= 1) ; tcp->tcp_rcv_ws = i; } /* * Remove a connection from the list of detached TIME_WAIT connections. * It returns B_FALSE if it can't remove the connection from the list * as the connection has already been removed from the list due to an * earlier call to tcp_time_wait_remove(); otherwise it returns B_TRUE. */ static boolean_t tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait) { boolean_t locked = B_FALSE; if (tcp_time_wait == NULL) { tcp_time_wait = *((tcp_squeue_priv_t **) squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); mutex_enter(&tcp_time_wait->tcp_time_wait_lock); locked = B_TRUE; } else { ASSERT(MUTEX_HELD(&tcp_time_wait->tcp_time_wait_lock)); } if (tcp->tcp_time_wait_expire == 0) { ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); if (locked) mutex_exit(&tcp_time_wait->tcp_time_wait_lock); return (B_FALSE); } ASSERT(TCP_IS_DETACHED(tcp)); ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); if (tcp == tcp_time_wait->tcp_time_wait_head) { ASSERT(tcp->tcp_time_wait_prev == NULL); tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next; if (tcp_time_wait->tcp_time_wait_head != NULL) { tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev = NULL; } else { tcp_time_wait->tcp_time_wait_tail = NULL; } } else if (tcp == tcp_time_wait->tcp_time_wait_tail) { ASSERT(tcp != tcp_time_wait->tcp_time_wait_head); ASSERT(tcp->tcp_time_wait_next == NULL); tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev; ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL; } else { ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp); ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp); tcp->tcp_time_wait_prev->tcp_time_wait_next = tcp->tcp_time_wait_next; tcp->tcp_time_wait_next->tcp_time_wait_prev = tcp->tcp_time_wait_prev; } tcp->tcp_time_wait_next = NULL; tcp->tcp_time_wait_prev = NULL; tcp->tcp_time_wait_expire = 0; if (locked) mutex_exit(&tcp_time_wait->tcp_time_wait_lock); return (B_TRUE); } /* * Add a connection to the list of detached TIME_WAIT connections * and set its time to expire. */ static void tcp_time_wait_append(tcp_t *tcp) { tcp_stack_t *tcps = tcp->tcp_tcps; tcp_squeue_priv_t *tcp_time_wait = *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); tcp_timers_stop(tcp); /* Freed above */ ASSERT(tcp->tcp_timer_tid == 0); ASSERT(tcp->tcp_ack_tid == 0); /* must have happened at the time of detaching the tcp */ ASSERT(tcp->tcp_ptpahn == NULL); ASSERT(tcp->tcp_flow_stopped == 0); ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); ASSERT(tcp->tcp_time_wait_expire == NULL); ASSERT(tcp->tcp_listener == NULL); tcp->tcp_time_wait_expire = ddi_get_lbolt(); /* * The value computed below in tcp->tcp_time_wait_expire may * appear negative or wrap around. That is ok since our * interest is only in the difference between the current lbolt * value and tcp->tcp_time_wait_expire. But the value should not * be zero, since it means the tcp is not in the TIME_WAIT list. * The corresponding comparison in tcp_time_wait_collector() uses * modular arithmetic. */ tcp->tcp_time_wait_expire += drv_usectohz(tcps->tcps_time_wait_interval * 1000); if (tcp->tcp_time_wait_expire == 0) tcp->tcp_time_wait_expire = 1; ASSERT(TCP_IS_DETACHED(tcp)); ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); TCP_DBGSTAT(tcps, tcp_time_wait); mutex_enter(&tcp_time_wait->tcp_time_wait_lock); if (tcp_time_wait->tcp_time_wait_head == NULL) { ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL); tcp_time_wait->tcp_time_wait_head = tcp; } else { ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state == TCPS_TIME_WAIT); tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp; tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail; } tcp_time_wait->tcp_time_wait_tail = tcp; mutex_exit(&tcp_time_wait->tcp_time_wait_lock); } /* ARGSUSED */ void tcp_timewait_output(void *arg, mblk_t *mp, void *arg2) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT(tcp != NULL); if (tcp->tcp_state == TCPS_CLOSED) { return; } ASSERT((tcp->tcp_family == AF_INET && tcp->tcp_ipversion == IPV4_VERSION) || (tcp->tcp_family == AF_INET6 && (tcp->tcp_ipversion == IPV4_VERSION || tcp->tcp_ipversion == IPV6_VERSION))); ASSERT(!tcp->tcp_listener); TCP_STAT(tcps, tcp_time_wait_reap); ASSERT(TCP_IS_DETACHED(tcp)); /* * Because they have no upstream client to rebind or tcp_close() * them later, we axe the connection here and now. */ tcp_close_detached(tcp); } /* * Remove cached/latched IPsec references. */ void tcp_ipsec_cleanup(tcp_t *tcp) { conn_t *connp = tcp->tcp_connp; ASSERT(connp->conn_flags & IPCL_TCPCONN); if (connp->conn_latch != NULL) { IPLATCH_REFRELE(connp->conn_latch, connp->conn_netstack); connp->conn_latch = NULL; } if (connp->conn_policy != NULL) { IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); connp->conn_policy = NULL; } } /* * Cleaup before placing on free list. * Disassociate from the netstack/tcp_stack_t since the freelist * is per squeue and not per netstack. */ void tcp_cleanup(tcp_t *tcp) { mblk_t *mp; char *tcp_iphc; int tcp_iphc_len; int tcp_hdr_grown; tcp_sack_info_t *tcp_sack_info; conn_t *connp = tcp->tcp_connp; tcp_stack_t *tcps = tcp->tcp_tcps; netstack_t *ns = tcps->tcps_netstack; tcp_bind_hash_remove(tcp); /* Cleanup that which needs the netstack first */ tcp_ipsec_cleanup(tcp); tcp_free(tcp); /* Release any SSL context */ if (tcp->tcp_kssl_ent != NULL) { kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); tcp->tcp_kssl_ent = NULL; } if (tcp->tcp_kssl_ctx != NULL) { kssl_release_ctx(tcp->tcp_kssl_ctx); tcp->tcp_kssl_ctx = NULL; } tcp->tcp_kssl_pending = B_FALSE; conn_delete_ire(connp, NULL); /* * Since we will bzero the entire structure, we need to * remove it and reinsert it in global hash list. We * know the walkers can't get to this conn because we * had set CONDEMNED flag earlier and checked reference * under conn_lock so walker won't pick it and when we * go the ipcl_globalhash_remove() below, no walker * can get to it. */ ipcl_globalhash_remove(connp); /* * Now it is safe to decrement the reference counts. * This might be the last reference on the netstack and TCPS * in which case it will cause the tcp_g_q_close and * the freeing of the IP Instance. */ connp->conn_netstack = NULL; netstack_rele(ns); ASSERT(tcps != NULL); tcp->tcp_tcps = NULL; TCPS_REFRELE(tcps); /* Save some state */ mp = tcp->tcp_timercache; tcp_sack_info = tcp->tcp_sack_info; tcp_iphc = tcp->tcp_iphc; tcp_iphc_len = tcp->tcp_iphc_len; tcp_hdr_grown = tcp->tcp_hdr_grown; if (connp->conn_cred != NULL) { crfree(connp->conn_cred); connp->conn_cred = NULL; } if (connp->conn_peercred != NULL) { crfree(connp->conn_peercred); connp->conn_peercred = NULL; } ipcl_conn_cleanup(connp); connp->conn_flags = IPCL_TCPCONN; bzero(tcp, sizeof (tcp_t)); /* restore the state */ tcp->tcp_timercache = mp; tcp->tcp_sack_info = tcp_sack_info; tcp->tcp_iphc = tcp_iphc; tcp->tcp_iphc_len = tcp_iphc_len; tcp->tcp_hdr_grown = tcp_hdr_grown; tcp->tcp_connp = connp; ASSERT(connp->conn_tcp == tcp); ASSERT(connp->conn_flags & IPCL_TCPCONN); connp->conn_state_flags = CONN_INCIPIENT; ASSERT(connp->conn_ulp == IPPROTO_TCP); ASSERT(connp->conn_ref == 1); } /* * Blows away all tcps whose TIME_WAIT has expired. List traversal * is done forwards from the head. * This walks all stack instances since * tcp_time_wait remains global across all stacks. */ /* ARGSUSED */ void tcp_time_wait_collector(void *arg) { tcp_t *tcp; clock_t now; mblk_t *mp; conn_t *connp; kmutex_t *lock; boolean_t removed; squeue_t *sqp = (squeue_t *)arg; tcp_squeue_priv_t *tcp_time_wait = *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); mutex_enter(&tcp_time_wait->tcp_time_wait_lock); tcp_time_wait->tcp_time_wait_tid = 0; if (tcp_time_wait->tcp_free_list != NULL && tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) { TCP_G_STAT(tcp_freelist_cleanup); while ((tcp = tcp_time_wait->tcp_free_list) != NULL) { tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; tcp->tcp_time_wait_next = NULL; tcp_time_wait->tcp_free_list_cnt--; ASSERT(tcp->tcp_tcps == NULL); CONN_DEC_REF(tcp->tcp_connp); } ASSERT(tcp_time_wait->tcp_free_list_cnt == 0); } /* * In order to reap time waits reliably, we should use a * source of time that is not adjustable by the user -- hence * the call to ddi_get_lbolt(). */ now = ddi_get_lbolt(); while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) { /* * Compare times using modular arithmetic, since * lbolt can wrapover. */ if ((now - tcp->tcp_time_wait_expire) < 0) { break; } removed = tcp_time_wait_remove(tcp, tcp_time_wait); ASSERT(removed); connp = tcp->tcp_connp; ASSERT(connp->conn_fanout != NULL); lock = &connp->conn_fanout->connf_lock; /* * This is essentially a TW reclaim fast path optimization for * performance where the timewait collector checks under the * fanout lock (so that no one else can get access to the * conn_t) that the refcnt is 2 i.e. one for TCP and one for * the classifier hash list. If ref count is indeed 2, we can * just remove the conn under the fanout lock and avoid * cleaning up the conn under the squeue, provided that * clustering callbacks are not enabled. If clustering is * enabled, we need to make the clustering callback before * setting the CONDEMNED flag and after dropping all locks and * so we forego this optimization and fall back to the slow * path. Also please see the comments in tcp_closei_local * regarding the refcnt logic. * * Since we are holding the tcp_time_wait_lock, its better * not to block on the fanout_lock because other connections * can't add themselves to time_wait list. So we do a * tryenter instead of mutex_enter. */ if (mutex_tryenter(lock)) { mutex_enter(&connp->conn_lock); if ((connp->conn_ref == 2) && (cl_inet_disconnect == NULL)) { ipcl_hash_remove_locked(connp, connp->conn_fanout); /* * Set the CONDEMNED flag now itself so that * the refcnt cannot increase due to any * walker. But we have still not cleaned up * conn_ire_cache. This is still ok since * we are going to clean it up in tcp_cleanup * immediately and any interface unplumb * thread will wait till the ire is blown away */ connp->conn_state_flags |= CONN_CONDEMNED; mutex_exit(lock); mutex_exit(&connp->conn_lock); if (tcp_time_wait->tcp_free_list_cnt < tcp_free_list_max_cnt) { /* Add to head of tcp_free_list */ mutex_exit( &tcp_time_wait->tcp_time_wait_lock); tcp_cleanup(tcp); ASSERT(connp->conn_latch == NULL); ASSERT(connp->conn_policy == NULL); ASSERT(tcp->tcp_tcps == NULL); ASSERT(connp->conn_netstack == NULL); mutex_enter( &tcp_time_wait->tcp_time_wait_lock); tcp->tcp_time_wait_next = tcp_time_wait->tcp_free_list; tcp_time_wait->tcp_free_list = tcp; tcp_time_wait->tcp_free_list_cnt++; continue; } else { /* Do not add to tcp_free_list */ mutex_exit( &tcp_time_wait->tcp_time_wait_lock); tcp_bind_hash_remove(tcp); conn_delete_ire(tcp->tcp_connp, NULL); tcp_ipsec_cleanup(tcp); CONN_DEC_REF(tcp->tcp_connp); } } else { CONN_INC_REF_LOCKED(connp); mutex_exit(lock); mutex_exit(&tcp_time_wait->tcp_time_wait_lock); mutex_exit(&connp->conn_lock); /* * We can reuse the closemp here since conn has * detached (otherwise we wouldn't even be in * time_wait list). tcp_closemp_used can safely * be changed without taking a lock as no other * thread can concurrently access it at this * point in the connection lifecycle. */ if (tcp->tcp_closemp.b_prev == NULL) tcp->tcp_closemp_used = B_TRUE; else cmn_err(CE_PANIC, "tcp_timewait_collector: " "concurrent use of tcp_closemp: " "connp %p tcp %p\n", (void *)connp, (void *)tcp); TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); mp = &tcp->tcp_closemp; squeue_fill(connp->conn_sqp, mp, tcp_timewait_output, connp, SQTAG_TCP_TIMEWAIT); } } else { mutex_enter(&connp->conn_lock); CONN_INC_REF_LOCKED(connp); mutex_exit(&tcp_time_wait->tcp_time_wait_lock); mutex_exit(&connp->conn_lock); /* * We can reuse the closemp here since conn has * detached (otherwise we wouldn't even be in * time_wait list). tcp_closemp_used can safely * be changed without taking a lock as no other * thread can concurrently access it at this * point in the connection lifecycle. */ if (tcp->tcp_closemp.b_prev == NULL) tcp->tcp_closemp_used = B_TRUE; else cmn_err(CE_PANIC, "tcp_timewait_collector: " "concurrent use of tcp_closemp: " "connp %p tcp %p\n", (void *)connp, (void *)tcp); TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); mp = &tcp->tcp_closemp; squeue_fill(connp->conn_sqp, mp, tcp_timewait_output, connp, 0); } mutex_enter(&tcp_time_wait->tcp_time_wait_lock); } if (tcp_time_wait->tcp_free_list != NULL) tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE; tcp_time_wait->tcp_time_wait_tid = timeout(tcp_time_wait_collector, sqp, TCP_TIME_WAIT_DELAY); mutex_exit(&tcp_time_wait->tcp_time_wait_lock); } /* * Reply to a clients T_CONN_RES TPI message. This function * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES * on the acceptor STREAM and processed in tcp_wput_accept(). * Read the block comment on top of tcp_conn_request(). */ static void tcp_accept(tcp_t *listener, mblk_t *mp) { tcp_t *acceptor; tcp_t *eager; tcp_t *tcp; struct T_conn_res *tcr; t_uscalar_t acceptor_id; t_scalar_t seqnum; mblk_t *opt_mp = NULL; /* T_OPTMGMT_REQ messages */ mblk_t *ok_mp; mblk_t *mp1; tcp_stack_t *tcps = listener->tcp_tcps; if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { tcp_err_ack(listener, mp, TPROTO, 0); return; } tcr = (struct T_conn_res *)mp->b_rptr; /* * Under ILP32 the stream head points tcr->ACCEPTOR_id at the * read side queue of the streams device underneath us i.e. the * read side queue of 'ip'. Since we can't deference QUEUE_ptr we * look it up in the queue_hash. Under LP64 it sends down the * minor_t of the accepting endpoint. * * Once the acceptor/eager are modified (in tcp_accept_swap) the * fanout hash lock is held. * This prevents any thread from entering the acceptor queue from * below (since it has not been hard bound yet i.e. any inbound * packets will arrive on the listener or default tcp queue and * go through tcp_lookup). * The CONN_INC_REF will prevent the acceptor from closing. * * XXX It is still possible for a tli application to send down data * on the accepting stream while another thread calls t_accept. * This should not be a problem for well-behaved applications since * the T_OK_ACK is sent after the queue swapping is completed. * * If the accepting fd is the same as the listening fd, avoid * queue hash lookup since that will return an eager listener in a * already established state. */ acceptor_id = tcr->ACCEPTOR_id; mutex_enter(&listener->tcp_eager_lock); if (listener->tcp_acceptor_id == acceptor_id) { eager = listener->tcp_eager_next_q; /* only count how many T_CONN_INDs so don't count q0 */ if ((listener->tcp_conn_req_cnt_q != 1) || (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) { mutex_exit(&listener->tcp_eager_lock); tcp_err_ack(listener, mp, TBADF, 0); return; } if (listener->tcp_conn_req_cnt_q0 != 0) { /* Throw away all the eagers on q0. */ tcp_eager_cleanup(listener, 1); } if (listener->tcp_syn_defense) { listener->tcp_syn_defense = B_FALSE; if (listener->tcp_ip_addr_cache != NULL) { kmem_free(listener->tcp_ip_addr_cache, IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); listener->tcp_ip_addr_cache = NULL; } } /* * Transfer tcp_conn_req_max to the eager so that when * a disconnect occurs we can revert the endpoint to the * listen state. */ eager->tcp_conn_req_max = listener->tcp_conn_req_max; ASSERT(listener->tcp_conn_req_cnt_q0 == 0); /* * Get a reference on the acceptor just like the * tcp_acceptor_hash_lookup below. */ acceptor = listener; CONN_INC_REF(acceptor->tcp_connp); } else { acceptor = tcp_acceptor_hash_lookup(acceptor_id, tcps); if (acceptor == NULL) { if (listener->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_accept: did not find acceptor 0x%x\n", acceptor_id); } mutex_exit(&listener->tcp_eager_lock); tcp_err_ack(listener, mp, TPROVMISMATCH, 0); return; } /* * Verify acceptor state. The acceptable states for an acceptor * include TCPS_IDLE and TCPS_BOUND. */ switch (acceptor->tcp_state) { case TCPS_IDLE: /* FALLTHRU */ case TCPS_BOUND: break; default: CONN_DEC_REF(acceptor->tcp_connp); mutex_exit(&listener->tcp_eager_lock); tcp_err_ack(listener, mp, TOUTSTATE, 0); return; } } /* The listener must be in TCPS_LISTEN */ if (listener->tcp_state != TCPS_LISTEN) { CONN_DEC_REF(acceptor->tcp_connp); mutex_exit(&listener->tcp_eager_lock); tcp_err_ack(listener, mp, TOUTSTATE, 0); return; } /* * Rendezvous with an eager connection request packet hanging off * 'tcp' that has the 'seqnum' tag. We tagged the detached open * tcp structure when the connection packet arrived in * tcp_conn_request(). */ seqnum = tcr->SEQ_number; eager = listener; do { eager = eager->tcp_eager_next_q; if (eager == NULL) { CONN_DEC_REF(acceptor->tcp_connp); mutex_exit(&listener->tcp_eager_lock); tcp_err_ack(listener, mp, TBADSEQ, 0); return; } } while (eager->tcp_conn_req_seqnum != seqnum); mutex_exit(&listener->tcp_eager_lock); /* * At this point, both acceptor and listener have 2 ref * that they begin with. Acceptor has one additional ref * we placed in lookup while listener has 3 additional * ref for being behind the squeue (tcp_accept() is * done on listener's squeue); being in classifier hash; * and eager's ref on listener. */ ASSERT(listener->tcp_connp->conn_ref >= 5); ASSERT(acceptor->tcp_connp->conn_ref >= 3); /* * The eager at this point is set in its own squeue and * could easily have been killed (tcp_accept_finish will * deal with that) because of a TH_RST so we can only * ASSERT for a single ref. */ ASSERT(eager->tcp_connp->conn_ref >= 1); /* Pre allocate the stroptions mblk also */ opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); if (opt_mp == NULL) { CONN_DEC_REF(acceptor->tcp_connp); CONN_DEC_REF(eager->tcp_connp); tcp_err_ack(listener, mp, TSYSERR, ENOMEM); return; } DB_TYPE(opt_mp) = M_SETOPTS; opt_mp->b_wptr += sizeof (struct stroptions); /* * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO * from listener to acceptor. The message is chained on opt_mp * which will be sent onto eager's squeue. */ if (listener->tcp_bound_if != 0) { /* allocate optmgmt req */ mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, sizeof (int)); if (mp1 != NULL) linkb(opt_mp, mp1); } if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { uint_t on = 1; /* allocate optmgmt req */ mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); if (mp1 != NULL) linkb(opt_mp, mp1); } /* Re-use mp1 to hold a copy of mp, in case reallocb fails */ if ((mp1 = copymsg(mp)) == NULL) { CONN_DEC_REF(acceptor->tcp_connp); CONN_DEC_REF(eager->tcp_connp); freemsg(opt_mp); tcp_err_ack(listener, mp, TSYSERR, ENOMEM); return; } tcr = (struct T_conn_res *)mp1->b_rptr; /* * This is an expanded version of mi_tpi_ok_ack_alloc() * which allocates a larger mblk and appends the new * local address to the ok_ack. The address is copied by * soaccept() for getsockname(). */ { int extra; extra = (eager->tcp_family == AF_INET) ? sizeof (sin_t) : sizeof (sin6_t); /* * Try to re-use mp, if possible. Otherwise, allocate * an mblk and return it as ok_mp. In any case, mp * is no longer usable upon return. */ if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) { CONN_DEC_REF(acceptor->tcp_connp); CONN_DEC_REF(eager->tcp_connp); freemsg(opt_mp); /* Original mp has been freed by now, so use mp1 */ tcp_err_ack(listener, mp1, TSYSERR, ENOMEM); return; } mp = NULL; /* We should never use mp after this point */ switch (extra) { case sizeof (sin_t): { sin_t *sin = (sin_t *)ok_mp->b_wptr; ok_mp->b_wptr += extra; sin->sin_family = AF_INET; sin->sin_port = eager->tcp_lport; sin->sin_addr.s_addr = eager->tcp_ipha->ipha_src; break; } case sizeof (sin6_t): { sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr; ok_mp->b_wptr += extra; sin6->sin6_family = AF_INET6; sin6->sin6_port = eager->tcp_lport; if (eager->tcp_ipversion == IPV4_VERSION) { sin6->sin6_flowinfo = 0; IN6_IPADDR_TO_V4MAPPED( eager->tcp_ipha->ipha_src, &sin6->sin6_addr); } else { ASSERT(eager->tcp_ip6h != NULL); sin6->sin6_flowinfo = eager->tcp_ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; sin6->sin6_addr = eager->tcp_ip6h->ip6_src; } sin6->sin6_scope_id = 0; sin6->__sin6_src_id = 0; break; } default: break; } ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim); } /* * If there are no options we know that the T_CONN_RES will * succeed. However, we can't send the T_OK_ACK upstream until * the tcp_accept_swap is done since it would be dangerous to * let the application start using the new fd prior to the swap. */ tcp_accept_swap(listener, acceptor, eager); /* * tcp_accept_swap unlinks eager from listener but does not drop * the eager's reference on the listener. */ ASSERT(eager->tcp_listener == NULL); ASSERT(listener->tcp_connp->conn_ref >= 5); /* * The eager is now associated with its own queue. Insert in * the hash so that the connection can be reused for a future * T_CONN_RES. */ tcp_acceptor_hash_insert(acceptor_id, eager); /* * We now do the processing of options with T_CONN_RES. * We delay till now since we wanted to have queue to pass to * option processing routines that points back to the right * instance structure which does not happen until after * tcp_accept_swap(). * * Note: * The sanity of the logic here assumes that whatever options * are appropriate to inherit from listner=>eager are done * before this point, and whatever were to be overridden (or not) * in transfer logic from eager=>acceptor in tcp_accept_swap(). * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it * before its ACCEPTOR_id comes down in T_CONN_RES ] * This may not be true at this point in time but can be fixed * independently. This option processing code starts with * the instantiated acceptor instance and the final queue at * this point. */ if (tcr->OPT_length != 0) { /* Options to process */ int t_error = 0; int sys_error = 0; int do_disconnect = 0; if (tcp_conprim_opt_process(eager, mp1, &do_disconnect, &t_error, &sys_error) < 0) { eager->tcp_accept_error = 1; if (do_disconnect) { /* * An option failed which does not allow * connection to be accepted. * * We allow T_CONN_RES to succeed and * put a T_DISCON_IND on the eager queue. */ ASSERT(t_error == 0 && sys_error == 0); eager->tcp_send_discon_ind = 1; } else { ASSERT(t_error != 0); freemsg(ok_mp); /* * Original mp was either freed or set * to ok_mp above, so use mp1 instead. */ tcp_err_ack(listener, mp1, t_error, sys_error); goto finish; } } /* * Most likely success in setting options (except if * eager->tcp_send_discon_ind set). * mp1 option buffer represented by OPT_length/offset * potentially modified and contains results of setting * options at this point */ } /* We no longer need mp1, since all options processing has passed */ freemsg(mp1); putnext(listener->tcp_rq, ok_mp); mutex_enter(&listener->tcp_eager_lock); if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { tcp_t *tail; mblk_t *conn_ind; /* * This path should not be executed if listener and * acceptor streams are the same. */ ASSERT(listener != acceptor); tcp = listener->tcp_eager_prev_q0; /* * listener->tcp_eager_prev_q0 points to the TAIL of the * deferred T_conn_ind queue. We need to get to the head of * the queue in order to send up T_conn_ind the same order as * how the 3WHS is completed. */ while (tcp != listener) { if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) break; else tcp = tcp->tcp_eager_prev_q0; } ASSERT(tcp != listener); conn_ind = tcp->tcp_conn.tcp_eager_conn_ind; ASSERT(conn_ind != NULL); tcp->tcp_conn.tcp_eager_conn_ind = NULL; /* Move from q0 to q */ ASSERT(listener->tcp_conn_req_cnt_q0 > 0); listener->tcp_conn_req_cnt_q0--; listener->tcp_conn_req_cnt_q++; tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = tcp->tcp_eager_prev_q0; tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; tcp->tcp_eager_prev_q0 = NULL; tcp->tcp_eager_next_q0 = NULL; tcp->tcp_conn_def_q0 = B_FALSE; /* Make sure the tcp isn't in the list of droppables */ ASSERT(tcp->tcp_eager_next_drop_q0 == NULL && tcp->tcp_eager_prev_drop_q0 == NULL); /* * Insert at end of the queue because sockfs sends * down T_CONN_RES in chronological order. Leaving * the older conn indications at front of the queue * helps reducing search time. */ tail = listener->tcp_eager_last_q; if (tail != NULL) tail->tcp_eager_next_q = tcp; else listener->tcp_eager_next_q = tcp; listener->tcp_eager_last_q = tcp; tcp->tcp_eager_next_q = NULL; mutex_exit(&listener->tcp_eager_lock); putnext(tcp->tcp_rq, conn_ind); } else { mutex_exit(&listener->tcp_eager_lock); } /* * Done with the acceptor - free it * * Note: from this point on, no access to listener should be made * as listener can be equal to acceptor. */ finish: ASSERT(acceptor->tcp_detached); ASSERT(tcps->tcps_g_q != NULL); acceptor->tcp_rq = tcps->tcps_g_q; acceptor->tcp_wq = WR(tcps->tcps_g_q); (void) tcp_clean_death(acceptor, 0, 2); CONN_DEC_REF(acceptor->tcp_connp); /* * In case we already received a FIN we have to make tcp_rput send * the ordrel_ind. This will also send up a window update if the window * has opened up. * * In the normal case of a successful connection acceptance * we give the O_T_BIND_REQ to the read side put procedure as an * indication that this was just accepted. This tells tcp_rput to * pass up any data queued in tcp_rcv_list. * * In the fringe case where options sent with T_CONN_RES failed and * we required, we would be indicating a T_DISCON_IND to blow * away this connection. */ /* * XXX: we currently have a problem if XTI application closes the * acceptor stream in between. This problem exists in on10-gate also * and is well know but nothing can be done short of major rewrite * to fix it. Now it is possible to take care of it by assigning TLI/XTI * eager same squeue as listener (we can distinguish non socket * listeners at the time of handling a SYN in tcp_conn_request) * and do most of the work that tcp_accept_finish does here itself * and then get behind the acceptor squeue to access the acceptor * queue. */ /* * We already have a ref on tcp so no need to do one before squeue_fill */ squeue_fill(eager->tcp_connp->conn_sqp, opt_mp, tcp_accept_finish, eager->tcp_connp, SQTAG_TCP_ACCEPT_FINISH); } /* * Swap information between the eager and acceptor for a TLI/XTI client. * The sockfs accept is done on the acceptor stream and control goes * through tcp_wput_accept() and tcp_accept()/tcp_accept_swap() is not * called. In either case, both the eager and listener are in their own * perimeter (squeue) and the code has to deal with potential race. * * See the block comment on top of tcp_accept() and tcp_wput_accept(). */ static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager) { conn_t *econnp, *aconnp; ASSERT(eager->tcp_rq == listener->tcp_rq); ASSERT(eager->tcp_detached && !acceptor->tcp_detached); ASSERT(!eager->tcp_hard_bound); ASSERT(!TCP_IS_SOCKET(acceptor)); ASSERT(!TCP_IS_SOCKET(eager)); ASSERT(!TCP_IS_SOCKET(listener)); acceptor->tcp_detached = B_TRUE; /* * To permit stream re-use by TLI/XTI, the eager needs a copy of * the acceptor id. */ eager->tcp_acceptor_id = acceptor->tcp_acceptor_id; /* remove eager from listen list... */ mutex_enter(&listener->tcp_eager_lock); tcp_eager_unlink(eager); ASSERT(eager->tcp_eager_next_q == NULL && eager->tcp_eager_last_q == NULL); ASSERT(eager->tcp_eager_next_q0 == NULL && eager->tcp_eager_prev_q0 == NULL); mutex_exit(&listener->tcp_eager_lock); eager->tcp_rq = acceptor->tcp_rq; eager->tcp_wq = acceptor->tcp_wq; econnp = eager->tcp_connp; aconnp = acceptor->tcp_connp; eager->tcp_rq->q_ptr = econnp; eager->tcp_wq->q_ptr = econnp; /* * In the TLI/XTI loopback case, we are inside the listener's squeue, * which might be a different squeue from our peer TCP instance. * For TCP Fusion, the peer expects that whenever tcp_detached is * clear, our TCP queues point to the acceptor's queues. Thus, use * membar_producer() to ensure that the assignments of tcp_rq/tcp_wq * above reach global visibility prior to the clearing of tcp_detached. */ membar_producer(); eager->tcp_detached = B_FALSE; ASSERT(eager->tcp_ack_tid == 0); econnp->conn_dev = aconnp->conn_dev; econnp->conn_minor_arena = aconnp->conn_minor_arena; ASSERT(econnp->conn_minor_arena != NULL); if (eager->tcp_cred != NULL) crfree(eager->tcp_cred); eager->tcp_cred = econnp->conn_cred = aconnp->conn_cred; ASSERT(econnp->conn_netstack == aconnp->conn_netstack); ASSERT(eager->tcp_tcps == acceptor->tcp_tcps); aconnp->conn_cred = NULL; econnp->conn_zoneid = aconnp->conn_zoneid; econnp->conn_allzones = aconnp->conn_allzones; econnp->conn_mac_exempt = aconnp->conn_mac_exempt; aconnp->conn_mac_exempt = B_FALSE; ASSERT(aconnp->conn_peercred == NULL); /* Do the IPC initialization */ CONN_INC_REF(econnp); econnp->conn_multicast_loop = aconnp->conn_multicast_loop; econnp->conn_af_isv6 = aconnp->conn_af_isv6; econnp->conn_pkt_isv6 = aconnp->conn_pkt_isv6; /* Done with old IPC. Drop its ref on its connp */ CONN_DEC_REF(aconnp); } /* * Adapt to the information, such as rtt and rtt_sd, provided from the * ire cached in conn_cache_ire. If no ire cached, do a ire lookup. * * Checks for multicast and broadcast destination address. * Returns zero on failure; non-zero if ok. * * Note that the MSS calculation here is based on the info given in * the IRE. We do not do any calculation based on TCP options. They * will be handled in tcp_rput_other() and tcp_rput_data() when TCP * knows which options to use. * * Note on how TCP gets its parameters for a connection. * * When a tcp_t structure is allocated, it gets all the default parameters. * In tcp_adapt_ire(), it gets those metric parameters, like rtt, rtt_sd, * spipe, rpipe, ... from the route metrics. Route metric overrides the * default. But if there is an associated tcp_host_param, it will override * the metrics. * * An incoming SYN with a multicast or broadcast destination address, is dropped * in 1 of 2 places. * * 1. If the packet was received over the wire it is dropped in * ip_rput_process_broadcast() * * 2. If the packet was received through internal IP loopback, i.e. the packet * was generated and received on the same machine, it is dropped in * ip_wput_local() * * An incoming SYN with a multicast or broadcast source address is always * dropped in tcp_adapt_ire. The same logic in tcp_adapt_ire also serves to * reject an attempt to connect to a broadcast or multicast (destination) * address. */ static int tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp) { tcp_hsp_t *hsp; ire_t *ire; ire_t *sire = NULL; iulp_t *ire_uinfo = NULL; uint32_t mss_max; uint32_t mss; boolean_t tcp_detached = TCP_IS_DETACHED(tcp); conn_t *connp = tcp->tcp_connp; boolean_t ire_cacheable = B_FALSE; zoneid_t zoneid = connp->conn_zoneid; int match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT | MATCH_IRE_SECATTR; ts_label_t *tsl = crgetlabel(CONN_CRED(connp)); ill_t *ill = NULL; boolean_t incoming = (ire_mp == NULL); tcp_stack_t *tcps = tcp->tcp_tcps; ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; ASSERT(connp->conn_ire_cache == NULL); if (tcp->tcp_ipversion == IPV4_VERSION) { if (CLASSD(tcp->tcp_connp->conn_rem)) { BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); return (0); } /* * If IP_NEXTHOP is set, then look for an IRE_CACHE * for the destination with the nexthop as gateway. * ire_ctable_lookup() is used because this particular * ire, if it exists, will be marked private. * If that is not available, use the interface ire * for the nexthop. * * TSol: tcp_update_label will detect label mismatches based * only on the destination's label, but that would not * detect label mismatches based on the security attributes * of routes or next hop gateway. Hence we need to pass the * label to ire_ftable_lookup below in order to locate the * right prefix (and/or) ire cache. Similarly we also need * pass the label to the ire_cache_lookup below to locate * the right ire that also matches on the label. */ if (tcp->tcp_connp->conn_nexthop_set) { ire = ire_ctable_lookup(tcp->tcp_connp->conn_rem, tcp->tcp_connp->conn_nexthop_v4, 0, NULL, zoneid, tsl, MATCH_IRE_MARK_PRIVATE_ADDR | MATCH_IRE_GW, ipst); if (ire == NULL) { ire = ire_ftable_lookup( tcp->tcp_connp->conn_nexthop_v4, 0, 0, IRE_INTERFACE, NULL, NULL, zoneid, 0, tsl, match_flags, ipst); if (ire == NULL) return (0); } else { ire_uinfo = &ire->ire_uinfo; } } else { ire = ire_cache_lookup(tcp->tcp_connp->conn_rem, zoneid, tsl, ipst); if (ire != NULL) { ire_cacheable = B_TRUE; ire_uinfo = (ire_mp != NULL) ? &((ire_t *)ire_mp->b_rptr)->ire_uinfo: &ire->ire_uinfo; } else { if (ire_mp == NULL) { ire = ire_ftable_lookup( tcp->tcp_connp->conn_rem, 0, 0, 0, NULL, &sire, zoneid, 0, tsl, (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT), ipst); if (ire == NULL) return (0); ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : &ire->ire_uinfo; } else { ire = (ire_t *)ire_mp->b_rptr; ire_uinfo = &((ire_t *) ire_mp->b_rptr)->ire_uinfo; } } } ASSERT(ire != NULL); if ((ire->ire_src_addr == INADDR_ANY) || (ire->ire_type & IRE_BROADCAST)) { /* * ire->ire_mp is non null when ire_mp passed in is used * ire->ire_mp is set in ip_bind_insert_ire[_v6](). */ if (ire->ire_mp == NULL) ire_refrele(ire); if (sire != NULL) ire_refrele(sire); return (0); } if (tcp->tcp_ipha->ipha_src == INADDR_ANY) { ipaddr_t src_addr; /* * ip_bind_connected() has stored the correct source * address in conn_src. */ src_addr = tcp->tcp_connp->conn_src; tcp->tcp_ipha->ipha_src = src_addr; /* * Copy of the src addr. in tcp_t is needed * for the lookup funcs. */ IN6_IPADDR_TO_V4MAPPED(src_addr, &tcp->tcp_ip_src_v6); } /* * Set the fragment bit so that IP will tell us if the MTU * should change. IP tells us the latest setting of * ip_path_mtu_discovery through ire_frag_flag. */ if (ipst->ips_ip_path_mtu_discovery) { tcp->tcp_ipha->ipha_fragment_offset_and_flags = htons(IPH_DF); } /* * If ire_uinfo is NULL, this is the IRE_INTERFACE case * for IP_NEXTHOP. No cache ire has been found for the * destination and we are working with the nexthop's * interface ire. Since we need to forward all packets * to the nexthop first, we "blindly" set tcp_localnet * to false, eventhough the destination may also be * onlink. */ if (ire_uinfo == NULL) tcp->tcp_localnet = 0; else tcp->tcp_localnet = (ire->ire_gateway_addr == 0); } else { /* * For incoming connection ire_mp = NULL * For outgoing connection ire_mp != NULL * Technically we should check conn_incoming_ill * when ire_mp is NULL and conn_outgoing_ill when * ire_mp is non-NULL. But this is performance * critical path and for IPV*_BOUND_IF, outgoing * and incoming ill are always set to the same value. */ ill_t *dst_ill = NULL; ipif_t *dst_ipif = NULL; ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill); if (connp->conn_outgoing_ill != NULL) { /* Outgoing or incoming path */ int err; dst_ill = conn_get_held_ill(connp, &connp->conn_outgoing_ill, &err); if (err == ILL_LOOKUP_FAILED || dst_ill == NULL) { ip1dbg(("tcp_adapt_ire: ill_lookup failed\n")); return (0); } match_flags |= MATCH_IRE_ILL; dst_ipif = dst_ill->ill_ipif; } ire = ire_ctable_lookup_v6(&tcp->tcp_connp->conn_remv6, 0, 0, dst_ipif, zoneid, tsl, match_flags, ipst); if (ire != NULL) { ire_cacheable = B_TRUE; ire_uinfo = (ire_mp != NULL) ? &((ire_t *)ire_mp->b_rptr)->ire_uinfo: &ire->ire_uinfo; } else { if (ire_mp == NULL) { ire = ire_ftable_lookup_v6( &tcp->tcp_connp->conn_remv6, 0, 0, 0, dst_ipif, &sire, zoneid, 0, tsl, match_flags, ipst); if (ire == NULL) { if (dst_ill != NULL) ill_refrele(dst_ill); return (0); } ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : &ire->ire_uinfo; } else { ire = (ire_t *)ire_mp->b_rptr; ire_uinfo = &((ire_t *)ire_mp->b_rptr)->ire_uinfo; } } if (dst_ill != NULL) ill_refrele(dst_ill); ASSERT(ire != NULL); ASSERT(ire_uinfo != NULL); if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) || IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) { /* * ire->ire_mp is non null when ire_mp passed in is used * ire->ire_mp is set in ip_bind_insert_ire[_v6](). */ if (ire->ire_mp == NULL) ire_refrele(ire); if (sire != NULL) ire_refrele(sire); return (0); } if (IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { in6_addr_t src_addr; /* * ip_bind_connected_v6() has stored the correct source * address per IPv6 addr. selection policy in * conn_src_v6. */ src_addr = tcp->tcp_connp->conn_srcv6; tcp->tcp_ip6h->ip6_src = src_addr; /* * Copy of the src addr. in tcp_t is needed * for the lookup funcs. */ tcp->tcp_ip_src_v6 = src_addr; ASSERT(IN6_ARE_ADDR_EQUAL(&tcp->tcp_ip6h->ip6_src, &connp->conn_srcv6)); } tcp->tcp_localnet = IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6); } /* * This allows applications to fail quickly when connections are made * to dead hosts. Hosts can be labeled dead by adding a reject route * with both the RTF_REJECT and RTF_PRIVATE flags set. */ if ((ire->ire_flags & RTF_REJECT) && (ire->ire_flags & RTF_PRIVATE)) goto error; /* * Make use of the cached rtt and rtt_sd values to calculate the * initial RTO. Note that they are already initialized in * tcp_init_values(). * If ire_uinfo is NULL, i.e., we do not have a cache ire for * IP_NEXTHOP, but instead are using the interface ire for the * nexthop, then we do not use the ire_uinfo from that ire to * do any initializations. */ if (ire_uinfo != NULL) { if (ire_uinfo->iulp_rtt != 0) { clock_t rto; tcp->tcp_rtt_sa = ire_uinfo->iulp_rtt; tcp->tcp_rtt_sd = ire_uinfo->iulp_rtt_sd; rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5); if (rto > tcps->tcps_rexmit_interval_max) { tcp->tcp_rto = tcps->tcps_rexmit_interval_max; } else if (rto < tcps->tcps_rexmit_interval_min) { tcp->tcp_rto = tcps->tcps_rexmit_interval_min; } else { tcp->tcp_rto = rto; } } if (ire_uinfo->iulp_ssthresh != 0) tcp->tcp_cwnd_ssthresh = ire_uinfo->iulp_ssthresh; else tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; if (ire_uinfo->iulp_spipe > 0) { tcp->tcp_xmit_hiwater = MIN(ire_uinfo->iulp_spipe, tcps->tcps_max_buf); if (tcps->tcps_snd_lowat_fraction != 0) tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / tcps->tcps_snd_lowat_fraction; (void) tcp_maxpsz_set(tcp, B_TRUE); } /* * Note that up till now, acceptor always inherits receive * window from the listener. But if there is a metrics * associated with a host, we should use that instead of * inheriting it from listener. Thus we need to pass this * info back to the caller. */ if (ire_uinfo->iulp_rpipe > 0) { tcp->tcp_rwnd = MIN(ire_uinfo->iulp_rpipe, tcps->tcps_max_buf); } if (ire_uinfo->iulp_rtomax > 0) { tcp->tcp_second_timer_threshold = ire_uinfo->iulp_rtomax; } /* * Use the metric option settings, iulp_tstamp_ok and * iulp_wscale_ok, only for active open. What this means * is that if the other side uses timestamp or window * scale option, TCP will also use those options. That * is for passive open. If the application sets a * large window, window scale is enabled regardless of * the value in iulp_wscale_ok. This is the behavior * since 2.6. So we keep it. * The only case left in passive open processing is the * check for SACK. * For ECN, it should probably be like SACK. But the * current value is binary, so we treat it like the other * cases. The metric only controls active open.For passive * open, the ndd param, tcp_ecn_permitted, controls the * behavior. */ if (!tcp_detached) { /* * The if check means that the following can only * be turned on by the metrics only IRE, but not off. */ if (ire_uinfo->iulp_tstamp_ok) tcp->tcp_snd_ts_ok = B_TRUE; if (ire_uinfo->iulp_wscale_ok) tcp->tcp_snd_ws_ok = B_TRUE; if (ire_uinfo->iulp_sack == 2) tcp->tcp_snd_sack_ok = B_TRUE; if (ire_uinfo->iulp_ecn_ok) tcp->tcp_ecn_ok = B_TRUE; } else { /* * Passive open. * * As above, the if check means that SACK can only be * turned on by the metric only IRE. */ if (ire_uinfo->iulp_sack > 0) { tcp->tcp_snd_sack_ok = B_TRUE; } } } /* * XXX: Note that currently, ire_max_frag can be as small as 68 * because of PMTUd. So tcp_mss may go to negative if combined * length of all those options exceeds 28 bytes. But because * of the tcp_mss_min check below, we may not have a problem if * tcp_mss_min is of a reasonable value. The default is 1 so * the negative problem still exists. And the check defeats PMTUd. * In fact, if PMTUd finds that the MSS should be smaller than * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min * value. * * We do not deal with that now. All those problems related to * PMTUd will be fixed later. */ ASSERT(ire->ire_max_frag != 0); mss = tcp->tcp_if_mtu = ire->ire_max_frag; if (tcp->tcp_ipp_fields & IPPF_USE_MIN_MTU) { if (tcp->tcp_ipp_use_min_mtu == IPV6_USE_MIN_MTU_NEVER) { mss = MIN(mss, IPV6_MIN_MTU); } } /* Sanity check for MSS value. */ if (tcp->tcp_ipversion == IPV4_VERSION) mss_max = tcps->tcps_mss_max_ipv4; else mss_max = tcps->tcps_mss_max_ipv6; if (tcp->tcp_ipversion == IPV6_VERSION && (ire->ire_frag_flag & IPH_FRAG_HDR)) { /* * After receiving an ICMPv6 "packet too big" message with a * MTU < 1280, and for multirouted IPv6 packets, the IP layer * will insert a 8-byte fragment header in every packet; we * reduce the MSS by that amount here. */ mss -= sizeof (ip6_frag_t); } if (tcp->tcp_ipsec_overhead == 0) tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); mss -= tcp->tcp_ipsec_overhead; if (mss < tcps->tcps_mss_min) mss = tcps->tcps_mss_min; if (mss > mss_max) mss = mss_max; /* Note that this is the maximum MSS, excluding all options. */ tcp->tcp_mss = mss; /* * Initialize the ISS here now that we have the full connection ID. * The RFC 1948 method of initial sequence number generation requires * knowledge of the full connection ID before setting the ISS. */ tcp_iss_init(tcp); if (ire->ire_type & (IRE_LOOPBACK | IRE_LOCAL)) tcp->tcp_loopback = B_TRUE; if (tcp->tcp_ipversion == IPV4_VERSION) { hsp = tcp_hsp_lookup(tcp->tcp_remote, tcps); } else { hsp = tcp_hsp_lookup_ipv6(&tcp->tcp_remote_v6, tcps); } if (hsp != NULL) { /* Only modify if we're going to make them bigger */ if (hsp->tcp_hsp_sendspace > tcp->tcp_xmit_hiwater) { tcp->tcp_xmit_hiwater = hsp->tcp_hsp_sendspace; if (tcps->tcps_snd_lowat_fraction != 0) tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / tcps->tcps_snd_lowat_fraction; } if (hsp->tcp_hsp_recvspace > tcp->tcp_rwnd) { tcp->tcp_rwnd = hsp->tcp_hsp_recvspace; } /* Copy timestamp flag only for active open */ if (!tcp_detached) tcp->tcp_snd_ts_ok = hsp->tcp_hsp_tstamp; } if (sire != NULL) IRE_REFRELE(sire); /* * If we got an IRE_CACHE and an ILL, go through their properties; * otherwise, this is deferred until later when we have an IRE_CACHE. */ if (tcp->tcp_loopback || (ire_cacheable && (ill = ire_to_ill(ire)) != NULL)) { /* * For incoming, see if this tcp may be MDT-capable. For * outgoing, this process has been taken care of through * tcp_rput_other. */ tcp_ire_ill_check(tcp, ire, ill, incoming); tcp->tcp_ire_ill_check_done = B_TRUE; } mutex_enter(&connp->conn_lock); /* * Make sure that conn is not marked incipient * for incoming connections. A blind * removal of incipient flag is cheaper than * check and removal. */ connp->conn_state_flags &= ~CONN_INCIPIENT; /* * Must not cache forwarding table routes * or recache an IRE after the conn_t has * had conn_ire_cache cleared and is flagged * unusable, (see the CONN_CACHE_IRE() macro). */ if (ire_cacheable && CONN_CACHE_IRE(connp)) { rw_enter(&ire->ire_bucket->irb_lock, RW_READER); if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { connp->conn_ire_cache = ire; IRE_UNTRACE_REF(ire); rw_exit(&ire->ire_bucket->irb_lock); mutex_exit(&connp->conn_lock); return (1); } rw_exit(&ire->ire_bucket->irb_lock); } mutex_exit(&connp->conn_lock); if (ire->ire_mp == NULL) ire_refrele(ire); return (1); error: if (ire->ire_mp == NULL) ire_refrele(ire); if (sire != NULL) ire_refrele(sire); return (0); } /* * tcp_bind is called (holding the writer lock) by tcp_wput_proto to process a * O_T_BIND_REQ/T_BIND_REQ message. */ static void tcp_bind(tcp_t *tcp, mblk_t *mp) { sin_t *sin; sin6_t *sin6; mblk_t *mp1; in_port_t requested_port; in_port_t allocated_port; struct T_bind_req *tbr; boolean_t bind_to_req_port_only; boolean_t backlog_update = B_FALSE; boolean_t user_specified; in6_addr_t v6addr; ipaddr_t v4addr; uint_t origipversion; int err; queue_t *q = tcp->tcp_wq; conn_t *connp = tcp->tcp_connp; mlp_type_t addrtype, mlptype; zone_t *zone; cred_t *cr; in_port_t mlp_port; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: bad req, len %u", (uint_t)(mp->b_wptr - mp->b_rptr)); } tcp_err_ack(tcp, mp, TPROTO, 0); return; } /* Make sure the largest address fits */ mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1); if (mp1 == NULL) { tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } mp = mp1; tbr = (struct T_bind_req *)mp->b_rptr; if (tcp->tcp_state >= TCPS_BOUND) { if ((tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN) && tcp->tcp_conn_req_max != tbr->CONIND_number && tbr->CONIND_number > 0) { /* * Handle listen() increasing CONIND_number. * This is more "liberal" then what the TPI spec * requires but is needed to avoid a t_unbind * when handling listen() since the port number * might be "stolen" between the unbind and bind. */ backlog_update = B_TRUE; goto do_bind; } if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: bad state, %d", tcp->tcp_state); } tcp_err_ack(tcp, mp, TOUTSTATE, 0); return; } origipversion = tcp->tcp_ipversion; switch (tbr->ADDR_length) { case 0: /* request for a generic port */ tbr->ADDR_offset = sizeof (struct T_bind_req); if (tcp->tcp_family == AF_INET) { tbr->ADDR_length = sizeof (sin_t); sin = (sin_t *)&tbr[1]; *sin = sin_null; sin->sin_family = AF_INET; mp->b_wptr = (uchar_t *)&sin[1]; tcp->tcp_ipversion = IPV4_VERSION; IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &v6addr); } else { ASSERT(tcp->tcp_family == AF_INET6); tbr->ADDR_length = sizeof (sin6_t); sin6 = (sin6_t *)&tbr[1]; *sin6 = sin6_null; sin6->sin6_family = AF_INET6; mp->b_wptr = (uchar_t *)&sin6[1]; tcp->tcp_ipversion = IPV6_VERSION; V6_SET_ZERO(v6addr); } requested_port = 0; break; case sizeof (sin_t): /* Complete IPv4 address */ sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset, sizeof (sin_t)); if (sin == NULL || !OK_32PTR((char *)sin)) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: bad address parameter, " "offset %d, len %d", tbr->ADDR_offset, tbr->ADDR_length); } tcp_err_ack(tcp, mp, TPROTO, 0); return; } /* * With sockets sockfs will accept bogus sin_family in * bind() and replace it with the family used in the socket * call. */ if (sin->sin_family != AF_INET || tcp->tcp_family != AF_INET) { tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); return; } requested_port = ntohs(sin->sin_port); tcp->tcp_ipversion = IPV4_VERSION; v4addr = sin->sin_addr.s_addr; IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr); break; case sizeof (sin6_t): /* Complete IPv6 address */ sin6 = (sin6_t *)mi_offset_param(mp, tbr->ADDR_offset, sizeof (sin6_t)); if (sin6 == NULL || !OK_32PTR((char *)sin6)) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: bad IPv6 address parameter, " "offset %d, len %d", tbr->ADDR_offset, tbr->ADDR_length); } tcp_err_ack(tcp, mp, TSYSERR, EINVAL); return; } if (sin6->sin6_family != AF_INET6 || tcp->tcp_family != AF_INET6) { tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); return; } requested_port = ntohs(sin6->sin6_port); tcp->tcp_ipversion = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? IPV4_VERSION : IPV6_VERSION; v6addr = sin6->sin6_addr; break; default: if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: bad address length, %d", tbr->ADDR_length); } tcp_err_ack(tcp, mp, TBADADDR, 0); return; } tcp->tcp_bound_source_v6 = v6addr; /* Check for change in ipversion */ if (origipversion != tcp->tcp_ipversion) { ASSERT(tcp->tcp_family == AF_INET6); err = tcp->tcp_ipversion == IPV6_VERSION ? tcp_header_init_ipv6(tcp) : tcp_header_init_ipv4(tcp); if (err) { tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } } /* * Initialize family specific fields. Copy of the src addr. * in tcp_t is needed for the lookup funcs. */ if (tcp->tcp_ipversion == IPV6_VERSION) { tcp->tcp_ip6h->ip6_src = v6addr; } else { IN6_V4MAPPED_TO_IPADDR(&v6addr, tcp->tcp_ipha->ipha_src); } tcp->tcp_ip_src_v6 = v6addr; /* * For O_T_BIND_REQ: * Verify that the target port/addr is available, or choose * another. * For T_BIND_REQ: * Verify that the target port/addr is available or fail. * In both cases when it succeeds the tcp is inserted in the * bind hash table. This ensures that the operation is atomic * under the lock on the hash bucket. */ bind_to_req_port_only = requested_port != 0 && tbr->PRIM_type != O_T_BIND_REQ; /* * Get a valid port (within the anonymous range and should not * be a privileged one) to use if the user has not given a port. * If multiple threads are here, they may all start with * with the same initial port. But, it should be fine as long as * tcp_bindi will ensure that no two threads will be assigned * the same port. * * NOTE: XXX If a privileged process asks for an anonymous port, we * still check for ports only in the range > tcp_smallest_non_priv_port, * unless TCP_ANONPRIVBIND option is set. */ mlptype = mlptSingle; mlp_port = requested_port; if (requested_port == 0) { requested_port = tcp->tcp_anon_priv_bind ? tcp_get_next_priv_port(tcp) : tcp_update_next_port(tcps->tcps_next_port_to_try, tcp, B_TRUE); if (requested_port == 0) { tcp_err_ack(tcp, mp, TNOADDR, 0); return; } user_specified = B_FALSE; /* * If the user went through one of the RPC interfaces to create * this socket and RPC is MLP in this zone, then give him an * anonymous MLP. */ cr = DB_CREDDEF(mp, tcp->tcp_cred); if (connp->conn_anon_mlp && is_system_labeled()) { zone = crgetzone(cr); addrtype = tsol_mlp_addr_type(zone->zone_id, IPV6_VERSION, &v6addr, tcps->tcps_netstack->netstack_ip); if (addrtype == mlptSingle) { tcp_err_ack(tcp, mp, TNOADDR, 0); return; } mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, PMAPPORT, addrtype); mlp_port = PMAPPORT; } } else { int i; boolean_t priv = B_FALSE; /* * If the requested_port is in the well-known privileged range, * verify that the stream was opened by a privileged user. * Note: No locks are held when inspecting tcp_g_*epriv_ports * but instead the code relies on: * - the fact that the address of the array and its size never * changes * - the atomic assignment of the elements of the array */ cr = DB_CREDDEF(mp, tcp->tcp_cred); if (requested_port < tcps->tcps_smallest_nonpriv_port) { priv = B_TRUE; } else { for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { if (requested_port == tcps->tcps_g_epriv_ports[i]) { priv = B_TRUE; break; } } } if (priv) { if (secpolicy_net_privaddr(cr, requested_port, IPPROTO_TCP) != 0) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: no priv for port %d", requested_port); } tcp_err_ack(tcp, mp, TACCES, 0); return; } } user_specified = B_TRUE; if (is_system_labeled()) { zone = crgetzone(cr); addrtype = tsol_mlp_addr_type(zone->zone_id, IPV6_VERSION, &v6addr, tcps->tcps_netstack->netstack_ip); if (addrtype == mlptSingle) { tcp_err_ack(tcp, mp, TNOADDR, 0); return; } mlptype = tsol_mlp_port_type(zone, IPPROTO_TCP, requested_port, addrtype); } } if (mlptype != mlptSingle) { if (secpolicy_net_bindmlp(cr) != 0) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: no priv for multilevel port %d", requested_port); } tcp_err_ack(tcp, mp, TACCES, 0); return; } /* * If we're specifically binding a shared IP address and the * port is MLP on shared addresses, then check to see if this * zone actually owns the MLP. Reject if not. */ if (mlptype == mlptShared && addrtype == mlptShared) { /* * No need to handle exclusive-stack zones since * ALL_ZONES only applies to the shared stack. */ zoneid_t mlpzone; mlpzone = tsol_mlp_findzone(IPPROTO_TCP, htons(mlp_port)); if (connp->conn_zoneid != mlpzone) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: attempt to bind port " "%d on shared addr in zone %d " "(should be %d)", mlp_port, connp->conn_zoneid, mlpzone); } tcp_err_ack(tcp, mp, TACCES, 0); return; } } if (!user_specified) { err = tsol_mlp_anon(zone, mlptype, connp->conn_ulp, requested_port, B_TRUE); if (err != 0) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: cannot establish anon " "MLP for port %d", requested_port); } tcp_err_ack(tcp, mp, TSYSERR, err); return; } connp->conn_anon_port = B_TRUE; } connp->conn_mlp_type = mlptype; } allocated_port = tcp_bindi(tcp, requested_port, &v6addr, tcp->tcp_reuseaddr, B_FALSE, bind_to_req_port_only, user_specified); if (allocated_port == 0) { connp->conn_mlp_type = mlptSingle; if (connp->conn_anon_port) { connp->conn_anon_port = B_FALSE; (void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp, requested_port, B_FALSE); } if (bind_to_req_port_only) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: requested addr busy"); } tcp_err_ack(tcp, mp, TADDRBUSY, 0); } else { /* If we are out of ports, fail the bind. */ if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_bind: out of ports?"); } tcp_err_ack(tcp, mp, TNOADDR, 0); } return; } ASSERT(tcp->tcp_state == TCPS_BOUND); do_bind: if (!backlog_update) { if (tcp->tcp_family == AF_INET) sin->sin_port = htons(allocated_port); else sin6->sin6_port = htons(allocated_port); } if (tcp->tcp_family == AF_INET) { if (tbr->CONIND_number != 0) { mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, sizeof (sin_t)); } else { /* Just verify the local IP address */ mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IP_ADDR_LEN); } } else { if (tbr->CONIND_number != 0) { mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, sizeof (sin6_t)); } else { /* Just verify the local IP address */ mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IPV6_ADDR_LEN); } } if (mp1 == NULL) { if (connp->conn_anon_port) { connp->conn_anon_port = B_FALSE; (void) tsol_mlp_anon(zone, mlptype, connp->conn_ulp, requested_port, B_FALSE); } connp->conn_mlp_type = mlptSingle; tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } tbr->PRIM_type = T_BIND_ACK; mp->b_datap->db_type = M_PCPROTO; /* Chain in the reply mp for tcp_rput() */ mp1->b_cont = mp; mp = mp1; tcp->tcp_conn_req_max = tbr->CONIND_number; if (tcp->tcp_conn_req_max) { if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; /* * If this is a listener, do not reset the eager list * and other stuffs. Note that we don't check if the * existing eager list meets the new tcp_conn_req_max * requirement. */ if (tcp->tcp_state != TCPS_LISTEN) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_LISTEN); tcp->tcp_state = TCPS_LISTEN; /* Initialize the chain. Don't need the eager_lock */ tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; tcp->tcp_eager_next_drop_q0 = tcp; tcp->tcp_eager_prev_drop_q0 = tcp; tcp->tcp_second_ctimer_threshold = tcps->tcps_ip_abort_linterval; } } /* * We can call ip_bind directly which returns a T_BIND_ACK mp. The * processing continues in tcp_rput_other(). * * We need to make sure that the conn_recv is set to a non-null * value before we insert the conn into the classifier table. * This is to avoid a race with an incoming packet which does an * ipcl_classify(). */ connp->conn_recv = tcp_conn_request; if (tcp->tcp_family == AF_INET6) { ASSERT(tcp->tcp_connp->conn_af_isv6); mp = ip_bind_v6(q, mp, tcp->tcp_connp, &tcp->tcp_sticky_ipp); } else { ASSERT(!tcp->tcp_connp->conn_af_isv6); mp = ip_bind_v4(q, mp, tcp->tcp_connp); } /* * If the bind cannot complete immediately * IP will arrange to call tcp_rput_other * when the bind completes. */ if (mp != NULL) { tcp_rput_other(tcp, mp); } else { /* * Bind will be resumed later. Need to ensure * that conn doesn't disappear when that happens. * This will be decremented in ip_resume_tcp_bind(). */ CONN_INC_REF(tcp->tcp_connp); } } /* * If the "bind_to_req_port_only" parameter is set, if the requested port * number is available, return it, If not return 0 * * If "bind_to_req_port_only" parameter is not set and * If the requested port number is available, return it. If not, return * the first anonymous port we happen across. If no anonymous ports are * available, return 0. addr is the requested local address, if any. * * In either case, when succeeding update the tcp_t to record the port number * and insert it in the bind hash table. * * Note that TCP over IPv4 and IPv6 sockets can use the same port number * without setting SO_REUSEADDR. This is needed so that they * can be viewed as two independent transport protocols. */ static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, int reuseaddr, boolean_t quick_connect, boolean_t bind_to_req_port_only, boolean_t user_specified) { /* number of times we have run around the loop */ int count = 0; /* maximum number of times to run around the loop */ int loopmax; conn_t *connp = tcp->tcp_connp; zoneid_t zoneid = connp->conn_zoneid; tcp_stack_t *tcps = tcp->tcp_tcps; /* * Lookup for free addresses is done in a loop and "loopmax" * influences how long we spin in the loop */ if (bind_to_req_port_only) { /* * If the requested port is busy, don't bother to look * for a new one. Setting loop maximum count to 1 has * that effect. */ loopmax = 1; } else { /* * If the requested port is busy, look for a free one * in the anonymous port range. * Set loopmax appropriately so that one does not look * forever in the case all of the anonymous ports are in use. */ if (tcp->tcp_anon_priv_bind) { /* * loopmax = * (IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1 */ loopmax = IPPORT_RESERVED - tcps->tcps_min_anonpriv_port; } else { loopmax = (tcps->tcps_largest_anon_port - tcps->tcps_smallest_anon_port + 1); } } do { uint16_t lport; tf_t *tbf; tcp_t *ltcp; conn_t *lconnp; lport = htons(port); /* * Ensure that the tcp_t is not currently in the bind hash. * Hold the lock on the hash bucket to ensure that * the duplicate check plus the insertion is an atomic * operation. * * This function does an inline lookup on the bind hash list * Make sure that we access only members of tcp_t * and that we don't look at tcp_tcp, since we are not * doing a CONN_INC_REF. */ tcp_bind_hash_remove(tcp); tbf = &tcps->tcps_bind_fanout[TCP_BIND_HASH(lport)]; mutex_enter(&tbf->tf_lock); for (ltcp = tbf->tf_tcp; ltcp != NULL; ltcp = ltcp->tcp_bind_hash) { boolean_t not_socket; boolean_t exclbind; if (lport != ltcp->tcp_lport) continue; lconnp = ltcp->tcp_connp; /* * On a labeled system, we must treat bindings to ports * on shared IP addresses by sockets with MAC exemption * privilege as being in all zones, as there's * otherwise no way to identify the right receiver. */ if (!(IPCL_ZONE_MATCH(ltcp->tcp_connp, zoneid) || IPCL_ZONE_MATCH(connp, ltcp->tcp_connp->conn_zoneid)) && !lconnp->conn_mac_exempt && !connp->conn_mac_exempt) continue; /* * If TCP_EXCLBIND is set for either the bound or * binding endpoint, the semantics of bind * is changed according to the following. * * spec = specified address (v4 or v6) * unspec = unspecified address (v4 or v6) * A = specified addresses are different for endpoints * * bound bind to allowed * ------------------------------------- * unspec unspec no * unspec spec no * spec unspec no * spec spec yes if A * * For labeled systems, SO_MAC_EXEMPT behaves the same * as TCP_EXCLBIND, except that zoneid is ignored. * * Note: * * 1. Because of TLI semantics, an endpoint can go * back from, say TCP_ESTABLISHED to TCPS_LISTEN or * TCPS_BOUND, depending on whether it is originally * a listener or not. That is why we need to check * for states greater than or equal to TCPS_BOUND * here. * * 2. Ideally, we should only check for state equals * to TCPS_LISTEN. And the following check should be * added. * * if (ltcp->tcp_state == TCPS_LISTEN || * !reuseaddr || !ltcp->tcp_reuseaddr) { * ... * } * * The semantics will be changed to this. If the * endpoint on the list is in state not equal to * TCPS_LISTEN and both endpoints have SO_REUSEADDR * set, let the bind succeed. * * Because of (1), we cannot do that for TLI * endpoints. But we can do that for socket endpoints. * If in future, we can change this going back * semantics, we can use the above check for TLI also. */ not_socket = !(TCP_IS_SOCKET(ltcp) && TCP_IS_SOCKET(tcp)); exclbind = ltcp->tcp_exclbind || tcp->tcp_exclbind; if (lconnp->conn_mac_exempt || connp->conn_mac_exempt || (exclbind && (not_socket || ltcp->tcp_state <= TCPS_ESTABLISHED))) { if (V6_OR_V4_INADDR_ANY( ltcp->tcp_bound_source_v6) || V6_OR_V4_INADDR_ANY(*laddr) || IN6_ARE_ADDR_EQUAL(laddr, <cp->tcp_bound_source_v6)) { break; } continue; } /* * Check ipversion to allow IPv4 and IPv6 sockets to * have disjoint port number spaces, if *_EXCLBIND * is not set and only if the application binds to a * specific port. We use the same autoassigned port * number space for IPv4 and IPv6 sockets. */ if (tcp->tcp_ipversion != ltcp->tcp_ipversion && bind_to_req_port_only) continue; /* * Ideally, we should make sure that the source * address, remote address, and remote port in the * four tuple for this tcp-connection is unique. * However, trying to find out the local source * address would require too much code duplication * with IP, since IP needs needs to have that code * to support userland TCP implementations. */ if (quick_connect && (ltcp->tcp_state > TCPS_LISTEN) && ((tcp->tcp_fport != ltcp->tcp_fport) || !IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6, <cp->tcp_remote_v6))) continue; if (!reuseaddr) { /* * No socket option SO_REUSEADDR. * If existing port is bound to * a non-wildcard IP address * and the requesting stream is * bound to a distinct * different IP addresses * (non-wildcard, also), keep * going. */ if (!V6_OR_V4_INADDR_ANY(*laddr) && !V6_OR_V4_INADDR_ANY( ltcp->tcp_bound_source_v6) && !IN6_ARE_ADDR_EQUAL(laddr, <cp->tcp_bound_source_v6)) continue; if (ltcp->tcp_state >= TCPS_BOUND) { /* * This port is being used and * its state is >= TCPS_BOUND, * so we can't bind to it. */ break; } } else { /* * socket option SO_REUSEADDR is set on the * binding tcp_t. * * If two streams are bound to * same IP address or both addr * and bound source are wildcards * (INADDR_ANY), we want to stop * searching. * We have found a match of IP source * address and source port, which is * refused regardless of the * SO_REUSEADDR setting, so we break. */ if (IN6_ARE_ADDR_EQUAL(laddr, <cp->tcp_bound_source_v6) && (ltcp->tcp_state == TCPS_LISTEN || ltcp->tcp_state == TCPS_BOUND)) break; } } if (ltcp != NULL) { /* The port number is busy */ mutex_exit(&tbf->tf_lock); } else { /* * This port is ours. Insert in fanout and mark as * bound to prevent others from getting the port * number. */ DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_BOUND); tcp->tcp_state = TCPS_BOUND; tcp->tcp_lport = htons(port); *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; ASSERT(&tcps->tcps_bind_fanout[TCP_BIND_HASH( tcp->tcp_lport)] == tbf); tcp_bind_hash_insert(tbf, tcp, 1); mutex_exit(&tbf->tf_lock); /* * We don't want tcp_next_port_to_try to "inherit" * a port number supplied by the user in a bind. */ if (user_specified) return (port); /* * This is the only place where tcp_next_port_to_try * is updated. After the update, it may or may not * be in the valid range. */ if (!tcp->tcp_anon_priv_bind) tcps->tcps_next_port_to_try = port + 1; return (port); } if (tcp->tcp_anon_priv_bind) { port = tcp_get_next_priv_port(tcp); } else { if (count == 0 && user_specified) { /* * We may have to return an anonymous port. So * get one to start with. */ port = tcp_update_next_port( tcps->tcps_next_port_to_try, tcp, B_TRUE); user_specified = B_FALSE; } else { port = tcp_update_next_port(port + 1, tcp, B_FALSE); } } if (port == 0) break; /* * Don't let this loop run forever in the case where * all of the anonymous ports are in use. */ } while (++count < loopmax); return (0); } /* * tcp_clean_death / tcp_close_detached must not be called more than once * on a tcp. Thus every function that potentially calls tcp_clean_death * must check for the tcp state before calling tcp_clean_death. * Eg. tcp_input, tcp_rput_data, tcp_eager_kill, tcp_clean_death_wrapper, * tcp_timer_handler, all check for the tcp state. */ /* ARGSUSED */ void tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2) { tcp_t *tcp = ((conn_t *)arg)->conn_tcp; freemsg(mp); if (tcp->tcp_state > TCPS_BOUND) (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT, 5); } /* * We are dying for some reason. Try to do it gracefully. (May be called * as writer.) * * Return -1 if the structure was not cleaned up (if the cleanup had to be * done by a service procedure). * TBD - Should the return value distinguish between the tcp_t being * freed and it being reinitialized? */ static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag) { mblk_t *mp; queue_t *q; tcp_stack_t *tcps = tcp->tcp_tcps; sodirect_t *sodp; TCP_CLD_STAT(tag); #if TCP_TAG_CLEAN_DEATH tcp->tcp_cleandeathtag = tag; #endif if (tcp->tcp_fused) tcp_unfuse(tcp); if (tcp->tcp_linger_tid != 0 && TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { tcp_stop_lingering(tcp); } ASSERT(tcp != NULL); ASSERT((tcp->tcp_family == AF_INET && tcp->tcp_ipversion == IPV4_VERSION) || (tcp->tcp_family == AF_INET6 && (tcp->tcp_ipversion == IPV4_VERSION || tcp->tcp_ipversion == IPV6_VERSION))); if (TCP_IS_DETACHED(tcp)) { if (tcp->tcp_hard_binding) { /* * Its an eager that we are dealing with. We close the * eager but in case a conn_ind has already gone to the * listener, let tcp_accept_finish() send a discon_ind * to the listener and drop the last reference. If the * listener doesn't even know about the eager i.e. the * conn_ind hasn't gone up, blow away the eager and drop * the last reference as well. If the conn_ind has gone * up, state should be BOUND. tcp_accept_finish * will figure out that the connection has received a * RST and will send a DISCON_IND to the application. */ tcp_closei_local(tcp); if (!tcp->tcp_tconnind_started) { CONN_DEC_REF(tcp->tcp_connp); } else { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_BOUND); tcp->tcp_state = TCPS_BOUND; } } else { tcp_close_detached(tcp); } return (0); } TCP_STAT(tcps, tcp_clean_death_nondetached); /* * If T_ORDREL_IND has not been sent yet (done when service routine * is run) postpone cleaning up the endpoint until service routine * has sent up the T_ORDREL_IND. Avoid clearing out an existing * client_errno since tcp_close uses the client_errno field. */ if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { if (err != 0) tcp->tcp_client_errno = err; tcp->tcp_deferred_clean_death = B_TRUE; return (-1); } /* If sodirect, not anymore */ SOD_PTR_ENTER(tcp, sodp); if (sodp != NULL) { tcp->tcp_sodirect = NULL; mutex_exit(sodp->sod_lock); } q = tcp->tcp_rq; /* Trash all inbound data */ flushq(q, FLUSHALL); /* * If we are at least part way open and there is error * (err==0 implies no error) * notify our client by a T_DISCON_IND. */ if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { if (tcp->tcp_state >= TCPS_ESTABLISHED && !TCP_IS_SOCKET(tcp)) { /* * Send M_FLUSH according to TPI. Because sockets will * (and must) ignore FLUSHR we do that only for TPI * endpoints and sockets in STREAMS mode. */ (void) putnextctl1(q, M_FLUSH, FLUSHR); } if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, "tcp_clean_death: discon err %d", err); } mp = mi_tpi_discon_ind(NULL, err, 0); if (mp != NULL) { putnext(q, mp); } else { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_clean_death, sending M_ERROR"); } (void) putnextctl1(q, M_ERROR, EPROTO); } if (tcp->tcp_state <= TCPS_SYN_RCVD) { /* SYN_SENT or SYN_RCVD */ BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { /* ESTABLISHED or CLOSE_WAIT */ BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); } } tcp_reinit(tcp); return (-1); } /* * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout * to expire, stop the wait and finish the close. */ static void tcp_stop_lingering(tcp_t *tcp) { clock_t delta = 0; tcp_stack_t *tcps = tcp->tcp_tcps; tcp->tcp_linger_tid = 0; if (tcp->tcp_state > TCPS_LISTEN) { tcp_acceptor_hash_remove(tcp); mutex_enter(&tcp->tcp_non_sq_lock); if (tcp->tcp_flow_stopped) { tcp_clrqfull(tcp); } mutex_exit(&tcp->tcp_non_sq_lock); if (tcp->tcp_timer_tid != 0) { delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); tcp->tcp_timer_tid = 0; } /* * Need to cancel those timers which will not be used when * TCP is detached. This has to be done before the tcp_wq * is set to the global queue. */ tcp_timers_stop(tcp); tcp->tcp_detached = B_TRUE; ASSERT(tcps->tcps_g_q != NULL); tcp->tcp_rq = tcps->tcps_g_q; tcp->tcp_wq = WR(tcps->tcps_g_q); if (tcp->tcp_state == TCPS_TIME_WAIT) { tcp_time_wait_append(tcp); TCP_DBGSTAT(tcps, tcp_detach_time_wait); goto finish; } /* * If delta is zero the timer event wasn't executed and was * successfully canceled. In this case we need to restart it * with the minimal delta possible. */ if (delta >= 0) { tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, delta ? delta : 1); } } else { tcp_closei_local(tcp); CONN_DEC_REF(tcp->tcp_connp); } finish: /* Signal closing thread that it can complete close */ mutex_enter(&tcp->tcp_closelock); tcp->tcp_detached = B_TRUE; ASSERT(tcps->tcps_g_q != NULL); tcp->tcp_rq = tcps->tcps_g_q; tcp->tcp_wq = WR(tcps->tcps_g_q); tcp->tcp_closed = 1; cv_signal(&tcp->tcp_closecv); mutex_exit(&tcp->tcp_closelock); } /* * Handle lingering timeouts. This function is called when the SO_LINGER timeout * expires. */ static void tcp_close_linger_timeout(void *arg) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; tcp->tcp_client_errno = ETIMEDOUT; tcp_stop_lingering(tcp); } static int tcp_close(queue_t *q, int flags) { conn_t *connp = Q_TO_CONN(q); tcp_t *tcp = connp->conn_tcp; mblk_t *mp = &tcp->tcp_closemp; boolean_t conn_ioctl_cleanup_reqd = B_FALSE; mblk_t *bp; ASSERT(WR(q)->q_next == NULL); ASSERT(connp->conn_ref >= 2); /* * We are being closed as /dev/tcp or /dev/tcp6. * * Mark the conn as closing. ill_pending_mp_add will not * add any mp to the pending mp list, after this conn has * started closing. Same for sq_pending_mp_add */ mutex_enter(&connp->conn_lock); connp->conn_state_flags |= CONN_CLOSING; if (connp->conn_oper_pending_ill != NULL) conn_ioctl_cleanup_reqd = B_TRUE; CONN_INC_REF_LOCKED(connp); mutex_exit(&connp->conn_lock); tcp->tcp_closeflags = (uint8_t)flags; ASSERT(connp->conn_ref >= 3); /* * tcp_closemp_used is used below without any protection of a lock * as we don't expect any one else to use it concurrently at this * point otherwise it would be a major defect. */ if (mp->b_prev == NULL) tcp->tcp_closemp_used = B_TRUE; else cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " "connp %p tcp %p\n", (void *)connp, (void *)tcp); TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); (*tcp_squeue_close_proc)(connp->conn_sqp, mp, tcp_close_output, connp, SQTAG_IP_TCP_CLOSE); mutex_enter(&tcp->tcp_closelock); while (!tcp->tcp_closed) { if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { /* * The cv_wait_sig() was interrupted. We now do the * following: * * 1) If the endpoint was lingering, we allow this * to be interrupted by cancelling the linger timeout * and closing normally. * * 2) Revert to calling cv_wait() * * We revert to using cv_wait() to avoid an * infinite loop which can occur if the calling * thread is higher priority than the squeue worker * thread and is bound to the same cpu. */ if (tcp->tcp_linger && tcp->tcp_lingertime > 0) { mutex_exit(&tcp->tcp_closelock); /* Entering squeue, bump ref count. */ CONN_INC_REF(connp); bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); squeue_enter(connp->conn_sqp, bp, tcp_linger_interrupted, connp, SQTAG_IP_TCP_CLOSE); mutex_enter(&tcp->tcp_closelock); } break; } } while (!tcp->tcp_closed) cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); mutex_exit(&tcp->tcp_closelock); /* * In the case of listener streams that have eagers in the q or q0 * we wait for the eagers to drop their reference to us. tcp_rq and * tcp_wq of the eagers point to our queues. By waiting for the * refcnt to drop to 1, we are sure that the eagers have cleaned * up their queue pointers and also dropped their references to us. */ if (tcp->tcp_wait_for_eagers) { mutex_enter(&connp->conn_lock); while (connp->conn_ref != 1) { cv_wait(&connp->conn_cv, &connp->conn_lock); } mutex_exit(&connp->conn_lock); } /* * ioctl cleanup. The mp is queued in the * ill_pending_mp or in the sq_pending_mp. */ if (conn_ioctl_cleanup_reqd) conn_ioctl_cleanup(connp); qprocsoff(q); inet_minor_free(connp->conn_minor_arena, connp->conn_dev); tcp->tcp_cpid = -1; /* * Drop IP's reference on the conn. This is the last reference * on the connp if the state was less than established. If the * connection has gone into timewait state, then we will have * one ref for the TCP and one more ref (total of two) for the * classifier connected hash list (a timewait connections stays * in connected hash till closed). * * We can't assert the references because there might be other * transient reference places because of some walkers or queued * packets in squeue for the timewait state. */ CONN_DEC_REF(connp); q->q_ptr = WR(q)->q_ptr = NULL; return (0); } static int tcpclose_accept(queue_t *q) { vmem_t *minor_arena; dev_t conn_dev; ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit); /* * We had opened an acceptor STREAM for sockfs which is * now being closed due to some error. */ qprocsoff(q); minor_arena = (vmem_t *)WR(q)->q_ptr; conn_dev = (dev_t)RD(q)->q_ptr; ASSERT(minor_arena != NULL); ASSERT(conn_dev != 0); inet_minor_free(minor_arena, conn_dev); q->q_ptr = WR(q)->q_ptr = NULL; return (0); } /* * Called by tcp_close() routine via squeue when lingering is * interrupted by a signal. */ /* ARGSUSED */ static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; freeb(mp); if (tcp->tcp_linger_tid != 0 && TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { tcp_stop_lingering(tcp); tcp->tcp_client_errno = EINTR; } } /* * Called by streams close routine via squeues when our client blows off her * descriptor, we take this to mean: "close the stream state NOW, close the tcp * connection politely" When SO_LINGER is set (with a non-zero linger time and * it is not a nonblocking socket) then this routine sleeps until the FIN is * acked. * * NOTE: tcp_close potentially returns error when lingering. * However, the stream head currently does not pass these errors * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK * errors to the application (from tsleep()) and not errors * like ECONNRESET caused by receiving a reset packet. */ /* ARGSUSED */ static void tcp_close_output(void *arg, mblk_t *mp, void *arg2) { char *msg; conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; clock_t delta = 0; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || (connp->conn_fanout == NULL && connp->conn_ref >= 3)); /* Cancel any pending timeout */ if (tcp->tcp_ordrelid != 0) { if (tcp->tcp_timeout) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ordrelid); } tcp->tcp_ordrelid = 0; tcp->tcp_timeout = B_FALSE; } mutex_enter(&tcp->tcp_eager_lock); if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { /* Cleanup for listener */ tcp_eager_cleanup(tcp, 0); tcp->tcp_wait_for_eagers = 1; } mutex_exit(&tcp->tcp_eager_lock); connp->conn_mdt_ok = B_FALSE; tcp->tcp_mdt = B_FALSE; connp->conn_lso_ok = B_FALSE; tcp->tcp_lso = B_FALSE; msg = NULL; switch (tcp->tcp_state) { case TCPS_CLOSED: case TCPS_IDLE: case TCPS_BOUND: case TCPS_LISTEN: break; case TCPS_SYN_SENT: msg = "tcp_close, during connect"; break; case TCPS_SYN_RCVD: /* * Close during the connect 3-way handshake * but here there may or may not be pending data * already on queue. Process almost same as in * the ESTABLISHED state. */ /* FALLTHRU */ default: if (tcp->tcp_sodirect != NULL) { /* Ok, no more sodirect */ tcp->tcp_sodirect = NULL; } if (tcp->tcp_fused) tcp_unfuse(tcp); /* * If SO_LINGER has set a zero linger time, abort the * connection with a reset. */ if (tcp->tcp_linger && tcp->tcp_lingertime == 0) { msg = "tcp_close, zero lingertime"; break; } ASSERT(tcp->tcp_hard_bound || tcp->tcp_hard_binding); /* * Abort connection if there is unread data queued. */ if (tcp->tcp_rcv_list || tcp->tcp_reass_head) { msg = "tcp_close, unread data"; break; } /* * tcp_hard_bound is now cleared thus all packets go through * tcp_lookup. This fact is used by tcp_detach below. * * We have done a qwait() above which could have possibly * drained more messages in turn causing transition to a * different state. Check whether we have to do the rest * of the processing or not. */ if (tcp->tcp_state <= TCPS_LISTEN) break; /* * Transmit the FIN before detaching the tcp_t. * After tcp_detach returns this queue/perimeter * no longer owns the tcp_t thus others can modify it. */ (void) tcp_xmit_end(tcp); /* * If lingering on close then wait until the fin is acked, * the SO_LINGER time passes, or a reset is sent/received. */ if (tcp->tcp_linger && tcp->tcp_lingertime > 0 && !(tcp->tcp_fin_acked) && tcp->tcp_state >= TCPS_ESTABLISHED) { if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) { tcp->tcp_client_errno = EWOULDBLOCK; } else if (tcp->tcp_client_errno == 0) { ASSERT(tcp->tcp_linger_tid == 0); tcp->tcp_linger_tid = TCP_TIMER(tcp, tcp_close_linger_timeout, tcp->tcp_lingertime * hz); /* tcp_close_linger_timeout will finish close */ if (tcp->tcp_linger_tid == 0) tcp->tcp_client_errno = ENOSR; else return; } /* * Check if we need to detach or just close * the instance. */ if (tcp->tcp_state <= TCPS_LISTEN) break; } /* * Make sure that no other thread will access the tcp_rq of * this instance (through lookups etc.) as tcp_rq will go * away shortly. */ tcp_acceptor_hash_remove(tcp); mutex_enter(&tcp->tcp_non_sq_lock); if (tcp->tcp_flow_stopped) { tcp_clrqfull(tcp); } mutex_exit(&tcp->tcp_non_sq_lock); if (tcp->tcp_timer_tid != 0) { delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); tcp->tcp_timer_tid = 0; } /* * Need to cancel those timers which will not be used when * TCP is detached. This has to be done before the tcp_wq * is set to the global queue. */ tcp_timers_stop(tcp); tcp->tcp_detached = B_TRUE; if (tcp->tcp_state == TCPS_TIME_WAIT) { tcp_time_wait_append(tcp); TCP_DBGSTAT(tcps, tcp_detach_time_wait); ASSERT(connp->conn_ref >= 3); goto finish; } /* * If delta is zero the timer event wasn't executed and was * successfully canceled. In this case we need to restart it * with the minimal delta possible. */ if (delta >= 0) tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, delta ? delta : 1); ASSERT(connp->conn_ref >= 3); goto finish; } /* Detach did not complete. Still need to remove q from stream. */ if (msg) { if (tcp->tcp_state == TCPS_ESTABLISHED || tcp->tcp_state == TCPS_CLOSE_WAIT) BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); if (tcp->tcp_state == TCPS_SYN_SENT || tcp->tcp_state == TCPS_SYN_RCVD) BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); tcp_xmit_ctl(msg, tcp, tcp->tcp_snxt, 0, TH_RST); } tcp_closei_local(tcp); CONN_DEC_REF(connp); ASSERT(connp->conn_ref >= 2); finish: /* * Although packets are always processed on the correct * tcp's perimeter and access is serialized via squeue's, * IP still needs a queue when sending packets in time_wait * state so use WR(tcps_g_q) till ip_output() can be * changed to deal with just connp. For read side, we * could have set tcp_rq to NULL but there are some cases * in tcp_rput_data() from early days of this code which * do a putnext without checking if tcp is closed. Those * need to be identified before both tcp_rq and tcp_wq * can be set to NULL and tcps_g_q can disappear forever. */ mutex_enter(&tcp->tcp_closelock); /* * Don't change the queues in the case of a listener that has * eagers in its q or q0. It could surprise the eagers. * Instead wait for the eagers outside the squeue. */ if (!tcp->tcp_wait_for_eagers) { tcp->tcp_detached = B_TRUE; /* * When default queue is closing we set tcps_g_q to NULL * after the close is done. */ ASSERT(tcps->tcps_g_q != NULL); tcp->tcp_rq = tcps->tcps_g_q; tcp->tcp_wq = WR(tcps->tcps_g_q); } /* Signal tcp_close() to finish closing. */ tcp->tcp_closed = 1; cv_signal(&tcp->tcp_closecv); mutex_exit(&tcp->tcp_closelock); } /* * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. * Some stream heads get upset if they see these later on as anything but NULL. */ static void tcp_close_mpp(mblk_t **mpp) { mblk_t *mp; if ((mp = *mpp) != NULL) { do { mp->b_next = NULL; mp->b_prev = NULL; } while ((mp = mp->b_cont) != NULL); mp = *mpp; *mpp = NULL; freemsg(mp); } } /* Do detached close. */ static void tcp_close_detached(tcp_t *tcp) { if (tcp->tcp_fused) tcp_unfuse(tcp); /* * Clustering code serializes TCP disconnect callbacks and * cluster tcp list walks by blocking a TCP disconnect callback * if a cluster tcp list walk is in progress. This ensures * accurate accounting of TCPs in the cluster code even though * the TCP list walk itself is not atomic. */ tcp_closei_local(tcp); CONN_DEC_REF(tcp->tcp_connp); } /* * Stop all TCP timers, and free the timer mblks if requested. */ void tcp_timers_stop(tcp_t *tcp) { if (tcp->tcp_timer_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); tcp->tcp_timer_tid = 0; } if (tcp->tcp_ka_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); tcp->tcp_ka_tid = 0; } if (tcp->tcp_ack_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); tcp->tcp_ack_tid = 0; } if (tcp->tcp_push_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); tcp->tcp_push_tid = 0; } } /* * The tcp_t is going away. Remove it from all lists and set it * to TCPS_CLOSED. The freeing up of memory is deferred until * tcp_inactive. This is needed since a thread in tcp_rput might have * done a CONN_INC_REF on this structure before it was removed from the * hashes. */ static void tcp_closei_local(tcp_t *tcp) { ire_t *ire; conn_t *connp = tcp->tcp_connp; tcp_stack_t *tcps = tcp->tcp_tcps; if (!TCP_IS_SOCKET(tcp)) tcp_acceptor_hash_remove(tcp); UPDATE_MIB(&tcps->tcps_mib, tcpHCInSegs, tcp->tcp_ibsegs); tcp->tcp_ibsegs = 0; UPDATE_MIB(&tcps->tcps_mib, tcpHCOutSegs, tcp->tcp_obsegs); tcp->tcp_obsegs = 0; /* * If we are an eager connection hanging off a listener that * hasn't formally accepted the connection yet, get off his * list and blow off any data that we have accumulated. */ if (tcp->tcp_listener != NULL) { tcp_t *listener = tcp->tcp_listener; mutex_enter(&listener->tcp_eager_lock); /* * tcp_tconnind_started == B_TRUE means that the * conn_ind has already gone to listener. At * this point, eager will be closed but we * leave it in listeners eager list so that * if listener decides to close without doing * accept, we can clean this up. In tcp_wput_accept * we take care of the case of accept on closed * eager. */ if (!tcp->tcp_tconnind_started) { tcp_eager_unlink(tcp); mutex_exit(&listener->tcp_eager_lock); /* * We don't want to have any pointers to the * listener queue, after we have released our * reference on the listener */ ASSERT(tcps->tcps_g_q != NULL); tcp->tcp_rq = tcps->tcps_g_q; tcp->tcp_wq = WR(tcps->tcps_g_q); CONN_DEC_REF(listener->tcp_connp); } else { mutex_exit(&listener->tcp_eager_lock); } } /* Stop all the timers */ tcp_timers_stop(tcp); if (tcp->tcp_state == TCPS_LISTEN) { if (tcp->tcp_ip_addr_cache) { kmem_free((void *)tcp->tcp_ip_addr_cache, IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); tcp->tcp_ip_addr_cache = NULL; } } mutex_enter(&tcp->tcp_non_sq_lock); if (tcp->tcp_flow_stopped) tcp_clrqfull(tcp); mutex_exit(&tcp->tcp_non_sq_lock); tcp_bind_hash_remove(tcp); /* * If the tcp_time_wait_collector (which runs outside the squeue) * is trying to remove this tcp from the time wait list, we will * block in tcp_time_wait_remove while trying to acquire the * tcp_time_wait_lock. The logic in tcp_time_wait_collector also * requires the ipcl_hash_remove to be ordered after the * tcp_time_wait_remove for the refcnt checks to work correctly. */ if (tcp->tcp_state == TCPS_TIME_WAIT) (void) tcp_time_wait_remove(tcp, NULL); CL_INET_DISCONNECT(tcp); ipcl_hash_remove(connp); /* * Delete the cached ire in conn_ire_cache and also mark * the conn as CONDEMNED */ mutex_enter(&connp->conn_lock); connp->conn_state_flags |= CONN_CONDEMNED; ire = connp->conn_ire_cache; connp->conn_ire_cache = NULL; mutex_exit(&connp->conn_lock); if (ire != NULL) IRE_REFRELE_NOTR(ire); /* Need to cleanup any pending ioctls */ ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); ASSERT(tcp->tcp_time_wait_expire == 0); if (connp->conn_fully_bound) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_CLOSED); } tcp->tcp_state = TCPS_CLOSED; /* Release any SSL context */ if (tcp->tcp_kssl_ent != NULL) { kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); tcp->tcp_kssl_ent = NULL; } if (tcp->tcp_kssl_ctx != NULL) { kssl_release_ctx(tcp->tcp_kssl_ctx); tcp->tcp_kssl_ctx = NULL; } tcp->tcp_kssl_pending = B_FALSE; tcp_ipsec_cleanup(tcp); } /* * tcp is dying (called from ipcl_conn_destroy and error cases). * Free the tcp_t in either case. */ void tcp_free(tcp_t *tcp) { mblk_t *mp; ip6_pkt_t *ipp; ASSERT(tcp != NULL); ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); tcp->tcp_rq = NULL; tcp->tcp_wq = NULL; tcp_close_mpp(&tcp->tcp_xmit_head); tcp_close_mpp(&tcp->tcp_reass_head); if (tcp->tcp_rcv_list != NULL) { /* Free b_next chain */ tcp_close_mpp(&tcp->tcp_rcv_list); } if ((mp = tcp->tcp_urp_mp) != NULL) { freemsg(mp); } if ((mp = tcp->tcp_urp_mark_mp) != NULL) { freemsg(mp); } if (tcp->tcp_fused_sigurg_mp != NULL) { freeb(tcp->tcp_fused_sigurg_mp); tcp->tcp_fused_sigurg_mp = NULL; } if (tcp->tcp_sack_info != NULL) { if (tcp->tcp_notsack_list != NULL) { TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); } bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); } if (tcp->tcp_hopopts != NULL) { mi_free(tcp->tcp_hopopts); tcp->tcp_hopopts = NULL; tcp->tcp_hopoptslen = 0; } ASSERT(tcp->tcp_hopoptslen == 0); if (tcp->tcp_dstopts != NULL) { mi_free(tcp->tcp_dstopts); tcp->tcp_dstopts = NULL; tcp->tcp_dstoptslen = 0; } ASSERT(tcp->tcp_dstoptslen == 0); if (tcp->tcp_rtdstopts != NULL) { mi_free(tcp->tcp_rtdstopts); tcp->tcp_rtdstopts = NULL; tcp->tcp_rtdstoptslen = 0; } ASSERT(tcp->tcp_rtdstoptslen == 0); if (tcp->tcp_rthdr != NULL) { mi_free(tcp->tcp_rthdr); tcp->tcp_rthdr = NULL; tcp->tcp_rthdrlen = 0; } ASSERT(tcp->tcp_rthdrlen == 0); ipp = &tcp->tcp_sticky_ipp; if (ipp->ipp_fields & (IPPF_HOPOPTS | IPPF_RTDSTOPTS | IPPF_DSTOPTS | IPPF_RTHDR)) ip6_pkt_free(ipp); /* * Free memory associated with the tcp/ip header template. */ if (tcp->tcp_iphc != NULL) bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); /* * Following is really a blowing away a union. * It happens to have exactly two members of identical size * the following code is enough. */ tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); if (tcp->tcp_tracebuf != NULL) { kmem_free(tcp->tcp_tracebuf, sizeof (tcptrch_t)); tcp->tcp_tracebuf = NULL; } } /* * Put a connection confirmation message upstream built from the * address information within 'iph' and 'tcph'. Report our success or failure. */ static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp, mblk_t **defermp) { sin_t sin; sin6_t sin6; mblk_t *mp; char *optp = NULL; int optlen = 0; cred_t *cr; if (defermp != NULL) *defermp = NULL; if (tcp->tcp_conn.tcp_opts_conn_req != NULL) { /* * Return in T_CONN_CON results of option negotiation through * the T_CONN_REQ. Note: If there is an real end-to-end option * negotiation, then what is received from remote end needs * to be taken into account but there is no such thing (yet?) * in our TCP/IP. * Note: We do not use mi_offset_param() here as * tcp_opts_conn_req contents do not directly come from * an application and are either generated in kernel or * from user input that was already verified. */ mp = tcp->tcp_conn.tcp_opts_conn_req; optp = (char *)(mp->b_rptr + ((struct T_conn_req *)mp->b_rptr)->OPT_offset); optlen = (int) ((struct T_conn_req *)mp->b_rptr)->OPT_length; } if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) { ipha_t *ipha = (ipha_t *)iphdr; /* packet is IPv4 */ if (tcp->tcp_family == AF_INET) { sin = sin_null; sin.sin_addr.s_addr = ipha->ipha_src; sin.sin_port = *(uint16_t *)tcph->th_lport; sin.sin_family = AF_INET; mp = mi_tpi_conn_con(NULL, (char *)&sin, (int)sizeof (sin_t), optp, optlen); } else { sin6 = sin6_null; IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); sin6.sin6_port = *(uint16_t *)tcph->th_lport; sin6.sin6_family = AF_INET6; mp = mi_tpi_conn_con(NULL, (char *)&sin6, (int)sizeof (sin6_t), optp, optlen); } } else { ip6_t *ip6h = (ip6_t *)iphdr; ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION); ASSERT(tcp->tcp_family == AF_INET6); sin6 = sin6_null; sin6.sin6_addr = ip6h->ip6_src; sin6.sin6_port = *(uint16_t *)tcph->th_lport; sin6.sin6_family = AF_INET6; sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; mp = mi_tpi_conn_con(NULL, (char *)&sin6, (int)sizeof (sin6_t), optp, optlen); } if (!mp) return (B_FALSE); if ((cr = DB_CRED(idmp)) != NULL) { mblk_setcred(mp, cr); DB_CPID(mp) = DB_CPID(idmp); } if (defermp == NULL) putnext(tcp->tcp_rq, mp); else *defermp = mp; if (tcp->tcp_conn.tcp_opts_conn_req != NULL) tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); return (B_TRUE); } /* * Defense for the SYN attack - * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest * one from the list of droppable eagers. This list is a subset of q0. * see comments before the definition of MAKE_DROPPABLE(). * 2. Don't drop a SYN request before its first timeout. This gives every * request at least til the first timeout to complete its 3-way handshake. * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many * requests currently on the queue that has timed out. This will be used * as an indicator of whether an attack is under way, so that appropriate * actions can be taken. (It's incremented in tcp_timer() and decremented * either when eager goes into ESTABLISHED, or gets freed up.) * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on * # of timeout drops back to <= q0len/32 => SYN alert off */ static boolean_t tcp_drop_q0(tcp_t *tcp) { tcp_t *eager; mblk_t *mp; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); /* Pick oldest eager from the list of droppable eagers */ eager = tcp->tcp_eager_prev_drop_q0; /* If list is empty. return B_FALSE */ if (eager == tcp) { return (B_FALSE); } /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */ if ((mp = allocb(0, BPRI_HI)) == NULL) return (B_FALSE); /* * Take this eager out from the list of droppable eagers since we are * going to drop it. */ MAKE_UNDROPPABLE(eager); if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, "tcp_drop_q0: listen half-open queue (max=%d) overflow" " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0, tcp->tcp_conn_req_cnt_q0, tcp_display(tcp, NULL, DISP_PORT_ONLY)); } BUMP_MIB(&tcps->tcps_mib, tcpHalfOpenDrop); /* Put a reference on the conn as we are enqueueing it in the sqeue */ CONN_INC_REF(eager->tcp_connp); /* Mark the IRE created for this SYN request temporary */ tcp_ip_ire_mark_advice(eager); squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_clean_death_wrapper, eager->tcp_connp, SQTAG_TCP_DROP_Q0); return (B_TRUE); } int tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, tcph_t *tcph, uint_t ipvers, mblk_t *idmp) { tcp_t *ltcp = lconnp->conn_tcp; tcp_t *tcp = connp->conn_tcp; mblk_t *tpi_mp; ipha_t *ipha; ip6_t *ip6h; sin6_t sin6; in6_addr_t v6dst; int err; int ifindex = 0; cred_t *cr; tcp_stack_t *tcps = tcp->tcp_tcps; if (ipvers == IPV4_VERSION) { ipha = (ipha_t *)mp->b_rptr; connp->conn_send = ip_output; connp->conn_recv = tcp_input; IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); sin6 = sin6_null; IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); sin6.sin6_port = *(uint16_t *)tcph->th_lport; sin6.sin6_family = AF_INET6; sin6.__sin6_src_id = ip_srcid_find_addr(&v6dst, lconnp->conn_zoneid, tcps->tcps_netstack); if (tcp->tcp_recvdstaddr) { sin6_t sin6d; sin6d = sin6_null; IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &sin6d.sin6_addr); sin6d.sin6_port = *(uint16_t *)tcph->th_fport; sin6d.sin6_family = AF_INET; tpi_mp = mi_tpi_extconn_ind(NULL, (char *)&sin6d, sizeof (sin6_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (char *)&sin6d, sizeof (sin6_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } else { tpi_mp = mi_tpi_conn_ind(NULL, (char *)&sin6, sizeof (sin6_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } } else { ip6h = (ip6_t *)mp->b_rptr; connp->conn_send = ip_output_v6; connp->conn_recv = tcp_input; connp->conn_srcv6 = ip6h->ip6_dst; connp->conn_remv6 = ip6h->ip6_src; /* db_cksumstuff is set at ip_fanout_tcp_v6 */ ifindex = (int)DB_CKSUMSTUFF(mp); DB_CKSUMSTUFF(mp) = 0; sin6 = sin6_null; sin6.sin6_addr = ip6h->ip6_src; sin6.sin6_port = *(uint16_t *)tcph->th_lport; sin6.sin6_family = AF_INET6; sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; sin6.__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, lconnp->conn_zoneid, tcps->tcps_netstack); if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { /* Pass up the scope_id of remote addr */ sin6.sin6_scope_id = ifindex; } else { sin6.sin6_scope_id = 0; } if (tcp->tcp_recvdstaddr) { sin6_t sin6d; sin6d = sin6_null; sin6.sin6_addr = ip6h->ip6_dst; sin6d.sin6_port = *(uint16_t *)tcph->th_fport; sin6d.sin6_family = AF_INET; tpi_mp = mi_tpi_extconn_ind(NULL, (char *)&sin6d, sizeof (sin6_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (char *)&sin6d, sizeof (sin6_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } else { tpi_mp = mi_tpi_conn_ind(NULL, (char *)&sin6, sizeof (sin6_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } } if (tpi_mp == NULL) return (ENOMEM); connp->conn_fport = *(uint16_t *)tcph->th_lport; connp->conn_lport = *(uint16_t *)tcph->th_fport; connp->conn_flags |= (IPCL_TCP6|IPCL_EAGER); connp->conn_fully_bound = B_FALSE; if (tcps->tcps_trace) tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); /* Inherit information from the "parent" */ tcp->tcp_ipversion = ltcp->tcp_ipversion; tcp->tcp_family = ltcp->tcp_family; tcp->tcp_wq = ltcp->tcp_wq; tcp->tcp_rq = ltcp->tcp_rq; tcp->tcp_mss = tcps->tcps_mss_def_ipv6; tcp->tcp_detached = B_TRUE; if ((err = tcp_init_values(tcp)) != 0) { freemsg(tpi_mp); return (err); } if (ipvers == IPV4_VERSION) { if ((err = tcp_header_init_ipv4(tcp)) != 0) { freemsg(tpi_mp); return (err); } ASSERT(tcp->tcp_ipha != NULL); } else { /* ifindex must be already set */ ASSERT(ifindex != 0); if (ltcp->tcp_bound_if != 0) { /* * Set newtcp's bound_if equal to * listener's value. If ifindex is * not the same as ltcp->tcp_bound_if, * it must be a packet for the ipmp group * of interfaces */ tcp->tcp_bound_if = ltcp->tcp_bound_if; } else if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { tcp->tcp_bound_if = ifindex; } tcp->tcp_ipv6_recvancillary = ltcp->tcp_ipv6_recvancillary; tcp->tcp_recvifindex = 0; tcp->tcp_recvhops = 0xffffffffU; ASSERT(tcp->tcp_ip6h != NULL); } tcp->tcp_lport = ltcp->tcp_lport; if (ltcp->tcp_ipversion == tcp->tcp_ipversion) { if (tcp->tcp_iphc_len != ltcp->tcp_iphc_len) { /* * Listener had options of some sort; eager inherits. * Free up the eager template and allocate one * of the right size. */ if (tcp->tcp_hdr_grown) { kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); } else { bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); } tcp->tcp_iphc = kmem_zalloc(ltcp->tcp_iphc_len, KM_NOSLEEP); if (tcp->tcp_iphc == NULL) { tcp->tcp_iphc_len = 0; freemsg(tpi_mp); return (ENOMEM); } tcp->tcp_iphc_len = ltcp->tcp_iphc_len; tcp->tcp_hdr_grown = B_TRUE; } tcp->tcp_hdr_len = ltcp->tcp_hdr_len; tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; tcp->tcp_ip6_hops = ltcp->tcp_ip6_hops; tcp->tcp_ip6_vcf = ltcp->tcp_ip6_vcf; /* * Copy the IP+TCP header template from listener to eager */ bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); if (tcp->tcp_ipversion == IPV6_VERSION) { if (((ip6i_t *)(tcp->tcp_iphc))->ip6i_nxt == IPPROTO_RAW) { tcp->tcp_ip6h = (ip6_t *)(tcp->tcp_iphc + sizeof (ip6i_t)); } else { tcp->tcp_ip6h = (ip6_t *)(tcp->tcp_iphc); } tcp->tcp_ipha = NULL; } else { tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; tcp->tcp_ip6h = NULL; } tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); } else { /* * only valid case when ipversion of listener and * eager differ is when listener is IPv6 and * eager is IPv4. * Eager header template has been initialized to the * maximum v4 header sizes, which includes space for * TCP and IP options. */ ASSERT((ltcp->tcp_ipversion == IPV6_VERSION) && (tcp->tcp_ipversion == IPV4_VERSION)); ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; /* copy IP header fields individually */ tcp->tcp_ipha->ipha_ttl = ltcp->tcp_ip6h->ip6_hops; bcopy(ltcp->tcp_tcph->th_lport, tcp->tcp_tcph->th_lport, sizeof (ushort_t)); } bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); bcopy(tcp->tcp_tcph->th_fport, &tcp->tcp_fport, sizeof (in_port_t)); if (ltcp->tcp_lport == 0) { tcp->tcp_lport = *(in_port_t *)tcph->th_fport; bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t)); } if (tcp->tcp_ipversion == IPV4_VERSION) { ASSERT(ipha != NULL); tcp->tcp_ipha->ipha_dst = ipha->ipha_src; tcp->tcp_ipha->ipha_src = ipha->ipha_dst; /* Source routing option copyover (reverse it) */ if (tcps->tcps_rev_src_routes) tcp_opt_reverse(tcp, ipha); } else { ASSERT(ip6h != NULL); tcp->tcp_ip6h->ip6_dst = ip6h->ip6_src; tcp->tcp_ip6h->ip6_src = ip6h->ip6_dst; } ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); ASSERT(!tcp->tcp_tconnind_started); /* * If the SYN contains a credential, it's a loopback packet; attach * the credential to the TPI message. */ if ((cr = DB_CRED(idmp)) != NULL) { mblk_setcred(tpi_mp, cr); DB_CPID(tpi_mp) = DB_CPID(idmp); } tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; /* Inherit the listener's SSL protection state */ if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) { kssl_hold_ent(tcp->tcp_kssl_ent); tcp->tcp_kssl_pending = B_TRUE; } return (0); } int tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, tcph_t *tcph, mblk_t *idmp) { tcp_t *ltcp = lconnp->conn_tcp; tcp_t *tcp = connp->conn_tcp; sin_t sin; mblk_t *tpi_mp = NULL; int err; cred_t *cr; tcp_stack_t *tcps = tcp->tcp_tcps; sin = sin_null; sin.sin_addr.s_addr = ipha->ipha_src; sin.sin_port = *(uint16_t *)tcph->th_lport; sin.sin_family = AF_INET; if (ltcp->tcp_recvdstaddr) { sin_t sind; sind = sin_null; sind.sin_addr.s_addr = ipha->ipha_dst; sind.sin_port = *(uint16_t *)tcph->th_fport; sind.sin_family = AF_INET; tpi_mp = mi_tpi_extconn_ind(NULL, (char *)&sind, sizeof (sin_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (char *)&sind, sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } else { tpi_mp = mi_tpi_conn_ind(NULL, (char *)&sin, sizeof (sin_t), (char *)&tcp, (t_scalar_t)sizeof (intptr_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); } if (tpi_mp == NULL) { return (ENOMEM); } connp->conn_flags |= (IPCL_TCP4|IPCL_EAGER); connp->conn_send = ip_output; connp->conn_recv = tcp_input; connp->conn_fully_bound = B_FALSE; IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); connp->conn_fport = *(uint16_t *)tcph->th_lport; connp->conn_lport = *(uint16_t *)tcph->th_fport; if (tcps->tcps_trace) { tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); } /* Inherit information from the "parent" */ tcp->tcp_ipversion = ltcp->tcp_ipversion; tcp->tcp_family = ltcp->tcp_family; tcp->tcp_wq = ltcp->tcp_wq; tcp->tcp_rq = ltcp->tcp_rq; tcp->tcp_mss = tcps->tcps_mss_def_ipv4; tcp->tcp_detached = B_TRUE; if ((err = tcp_init_values(tcp)) != 0) { freemsg(tpi_mp); return (err); } /* * Let's make sure that eager tcp template has enough space to * copy IPv4 listener's tcp template. Since the conn_t structure is * preserved and tcp_iphc_len is also preserved, an eager conn_t may * have a tcp_template of total len TCP_MAX_COMBINED_HEADER_LENGTH or * more (in case of re-allocation of conn_t with tcp-IPv6 template with * extension headers or with ip6i_t struct). Note that bcopy() below * copies listener tcp's hdr_len which cannot be greater than TCP_MAX_ * COMBINED_HEADER_LENGTH as this listener must be a IPv4 listener. */ ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); ASSERT(ltcp->tcp_hdr_len <= TCP_MAX_COMBINED_HEADER_LENGTH); tcp->tcp_hdr_len = ltcp->tcp_hdr_len; tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; tcp->tcp_ttl = ltcp->tcp_ttl; tcp->tcp_tos = ltcp->tcp_tos; /* Copy the IP+TCP header template from listener to eager */ bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; tcp->tcp_ip6h = NULL; tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); /* Initialize the IP addresses and Ports */ tcp->tcp_ipha->ipha_dst = ipha->ipha_src; tcp->tcp_ipha->ipha_src = ipha->ipha_dst; bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t)); /* Source routing option copyover (reverse it) */ if (tcps->tcps_rev_src_routes) tcp_opt_reverse(tcp, ipha); ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); ASSERT(!tcp->tcp_tconnind_started); /* * If the SYN contains a credential, it's a loopback packet; attach * the credential to the TPI message. */ if ((cr = DB_CRED(idmp)) != NULL) { mblk_setcred(tpi_mp, cr); DB_CPID(tpi_mp) = DB_CPID(idmp); } tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; /* Inherit the listener's SSL protection state */ if ((tcp->tcp_kssl_ent = ltcp->tcp_kssl_ent) != NULL) { kssl_hold_ent(tcp->tcp_kssl_ent); tcp->tcp_kssl_pending = B_TRUE; } return (0); } /* * sets up conn for ipsec. * if the first mblk is M_CTL it is consumed and mpp is updated. * in case of error mpp is freed. */ conn_t * tcp_get_ipsec_conn(tcp_t *tcp, squeue_t *sqp, mblk_t **mpp) { conn_t *connp = tcp->tcp_connp; conn_t *econnp; squeue_t *new_sqp; mblk_t *first_mp = *mpp; mblk_t *mp = *mpp; boolean_t mctl_present = B_FALSE; uint_t ipvers; econnp = tcp_get_conn(sqp, tcp->tcp_tcps); if (econnp == NULL) { freemsg(first_mp); return (NULL); } if (DB_TYPE(mp) == M_CTL) { if (mp->b_cont == NULL || mp->b_cont->b_datap->db_type != M_DATA) { freemsg(first_mp); return (NULL); } mp = mp->b_cont; if ((mp->b_datap->db_struioflag & STRUIO_EAGER) == 0) { freemsg(first_mp); return (NULL); } mp->b_datap->db_struioflag &= ~STRUIO_EAGER; first_mp->b_datap->db_struioflag &= ~STRUIO_POLICY; mctl_present = B_TRUE; } else { ASSERT(mp->b_datap->db_struioflag & STRUIO_POLICY); mp->b_datap->db_struioflag &= ~STRUIO_POLICY; } new_sqp = (squeue_t *)DB_CKSUMSTART(mp); DB_CKSUMSTART(mp) = 0; ASSERT(OK_32PTR(mp->b_rptr)); ipvers = IPH_HDR_VERSION(mp->b_rptr); if (ipvers == IPV4_VERSION) { uint16_t *up; uint32_t ports; ipha_t *ipha; ipha = (ipha_t *)mp->b_rptr; up = (uint16_t *)((uchar_t *)ipha + IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET); ports = *(uint32_t *)up; IPCL_TCP_EAGER_INIT(econnp, IPPROTO_TCP, ipha->ipha_dst, ipha->ipha_src, ports); } else { uint16_t *up; uint32_t ports; uint16_t ip_hdr_len; uint8_t *nexthdrp; ip6_t *ip6h; tcph_t *tcph; ip6h = (ip6_t *)mp->b_rptr; if (ip6h->ip6_nxt == IPPROTO_TCP) { ip_hdr_len = IPV6_HDR_LEN; } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip_hdr_len, &nexthdrp) || *nexthdrp != IPPROTO_TCP) { CONN_DEC_REF(econnp); freemsg(first_mp); return (NULL); } tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; up = (uint16_t *)tcph->th_lport; ports = *(uint32_t *)up; IPCL_TCP_EAGER_INIT_V6(econnp, IPPROTO_TCP, ip6h->ip6_dst, ip6h->ip6_src, ports); } /* * The caller already ensured that there is a sqp present. */ econnp->conn_sqp = new_sqp; if (connp->conn_policy != NULL) { ipsec_in_t *ii; ii = (ipsec_in_t *)(first_mp->b_rptr); ASSERT(ii->ipsec_in_policy == NULL); IPPH_REFHOLD(connp->conn_policy); ii->ipsec_in_policy = connp->conn_policy; first_mp->b_datap->db_type = IPSEC_POLICY_SET; if (!ip_bind_ipsec_policy_set(econnp, first_mp)) { CONN_DEC_REF(econnp); freemsg(first_mp); return (NULL); } } if (ipsec_conn_cache_policy(econnp, ipvers == IPV4_VERSION) != 0) { CONN_DEC_REF(econnp); freemsg(first_mp); return (NULL); } /* * If we know we have some policy, pass the "IPSEC" * options size TCP uses this adjust the MSS. */ econnp->conn_tcp->tcp_ipsec_overhead = conn_ipsec_length(econnp); if (mctl_present) { freeb(first_mp); *mpp = mp; } return (econnp); } /* * tcp_get_conn/tcp_free_conn * * tcp_get_conn is used to get a clean tcp connection structure. * It tries to reuse the connections put on the freelist by the * time_wait_collector failing which it goes to kmem_cache. This * way has two benefits compared to just allocating from and * freeing to kmem_cache. * 1) The time_wait_collector can free (which includes the cleanup) * outside the squeue. So when the interrupt comes, we have a clean * connection sitting in the freelist. Obviously, this buys us * performance. * * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_conn_request * has multiple disadvantages - tying up the squeue during alloc, and the * fact that IPSec policy initialization has to happen here which * requires us sending a M_CTL and checking for it i.e. real ugliness. * But allocating the conn/tcp in IP land is also not the best since * we can't check the 'q' and 'q0' which are protected by squeue and * blindly allocate memory which might have to be freed here if we are * not allowed to accept the connection. By using the freelist and * putting the conn/tcp back in freelist, we don't pay a penalty for * allocating memory without checking 'q/q0' and freeing it if we can't * accept the connection. * * Care should be taken to put the conn back in the same squeue's freelist * from which it was allocated. Best results are obtained if conn is * allocated from listener's squeue and freed to the same. Time wait * collector will free up the freelist is the connection ends up sitting * there for too long. */ void * tcp_get_conn(void *arg, tcp_stack_t *tcps) { tcp_t *tcp = NULL; conn_t *connp = NULL; squeue_t *sqp = (squeue_t *)arg; tcp_squeue_priv_t *tcp_time_wait; netstack_t *ns; tcp_time_wait = *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); mutex_enter(&tcp_time_wait->tcp_time_wait_lock); tcp = tcp_time_wait->tcp_free_list; ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); if (tcp != NULL) { tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; tcp_time_wait->tcp_free_list_cnt--; mutex_exit(&tcp_time_wait->tcp_time_wait_lock); tcp->tcp_time_wait_next = NULL; connp = tcp->tcp_connp; connp->conn_flags |= IPCL_REUSED; ASSERT(tcp->tcp_tcps == NULL); ASSERT(connp->conn_netstack == NULL); ns = tcps->tcps_netstack; netstack_hold(ns); connp->conn_netstack = ns; tcp->tcp_tcps = tcps; TCPS_REFHOLD(tcps); ipcl_globalhash_insert(connp); return ((void *)connp); } mutex_exit(&tcp_time_wait->tcp_time_wait_lock); if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, tcps->tcps_netstack)) == NULL) return (NULL); tcp = connp->conn_tcp; tcp->tcp_tcps = tcps; TCPS_REFHOLD(tcps); return ((void *)connp); } /* * Update the cached label for the given tcp_t. This should be called once per * connection, and before any packets are sent or tcp_process_options is * invoked. Returns B_FALSE if the correct label could not be constructed. */ static boolean_t tcp_update_label(tcp_t *tcp, const cred_t *cr) { conn_t *connp = tcp->tcp_connp; if (tcp->tcp_ipversion == IPV4_VERSION) { uchar_t optbuf[IP_MAX_OPT_LENGTH]; int added; if (tsol_compute_label(cr, tcp->tcp_remote, optbuf, connp->conn_mac_exempt, tcp->tcp_tcps->tcps_netstack->netstack_ip) != 0) return (B_FALSE); added = tsol_remove_secopt(tcp->tcp_ipha, tcp->tcp_hdr_len); if (added == -1) return (B_FALSE); tcp->tcp_hdr_len += added; tcp->tcp_tcph = (tcph_t *)((uchar_t *)tcp->tcp_tcph + added); tcp->tcp_ip_hdr_len += added; if ((tcp->tcp_label_len = optbuf[IPOPT_OLEN]) != 0) { tcp->tcp_label_len = (tcp->tcp_label_len + 3) & ~3; added = tsol_prepend_option(optbuf, tcp->tcp_ipha, tcp->tcp_hdr_len); if (added == -1) return (B_FALSE); tcp->tcp_hdr_len += added; tcp->tcp_tcph = (tcph_t *) ((uchar_t *)tcp->tcp_tcph + added); tcp->tcp_ip_hdr_len += added; } } else { uchar_t optbuf[TSOL_MAX_IPV6_OPTION]; if (tsol_compute_label_v6(cr, &tcp->tcp_remote_v6, optbuf, connp->conn_mac_exempt, tcp->tcp_tcps->tcps_netstack->netstack_ip) != 0) return (B_FALSE); if (tsol_update_sticky(&tcp->tcp_sticky_ipp, &tcp->tcp_label_len, optbuf) != 0) return (B_FALSE); if (tcp_build_hdrs(tcp->tcp_rq, tcp) != 0) return (B_FALSE); } connp->conn_ulp_labeled = 1; return (B_TRUE); } /* BEGIN CSTYLED */ /* * * The sockfs ACCEPT path: * ======================= * * The eager is now established in its own perimeter as soon as SYN is * received in tcp_conn_request(). When sockfs receives conn_ind, it * completes the accept processing on the acceptor STREAM. The sending * of conn_ind part is common for both sockfs listener and a TLI/XTI * listener but a TLI/XTI listener completes the accept processing * on the listener perimeter. * * Common control flow for 3 way handshake: * ---------------------------------------- * * incoming SYN (listener perimeter) -> tcp_rput_data() * -> tcp_conn_request() * * incoming SYN-ACK-ACK (eager perim) -> tcp_rput_data() * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() * * Sockfs ACCEPT Path: * ------------------- * * open acceptor stream (tcp_open allocates tcp_wput_accept() * as STREAM entry point) * * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_wput_accept() * * tcp_wput_accept() extracts the eager and makes the q->q_ptr <-> eager * association (we are not behind eager's squeue but sockfs is protecting us * and no one knows about this stream yet. The STREAMS entry point q->q_info * is changed to point at tcp_wput(). * * tcp_wput_accept() sends any deferred eagers via tcp_send_pending() to * listener (done on listener's perimeter). * * tcp_wput_accept() calls tcp_accept_finish() on eagers perimeter to finish * accept. * * TLI/XTI client ACCEPT path: * --------------------------- * * soaccept() sends T_CONN_RES on the listener STREAM. * * tcp_accept() -> tcp_accept_swap() complete the processing and send * the bind_mp to eager perimeter to finish accept (tcp_rput_other()). * * Locks: * ====== * * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and * and listeners->tcp_eager_next_q. * * Referencing: * ============ * * 1) We start out in tcp_conn_request by eager placing a ref on * listener and listener adding eager to listeners->tcp_eager_next_q0. * * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before * doing so we place a ref on the eager. This ref is finally dropped at the * end of tcp_accept_finish() while unwinding from the squeue, i.e. the * reference is dropped by the squeue framework. * * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish * * The reference must be released by the same entity that added the reference * In the above scheme, the eager is the entity that adds and releases the * references. Note that tcp_accept_finish executes in the squeue of the eager * (albeit after it is attached to the acceptor stream). Though 1. executes * in the listener's squeue, the eager is nascent at this point and the * reference can be considered to have been added on behalf of the eager. * * Eager getting a Reset or listener closing: * ========================================== * * Once the listener and eager are linked, the listener never does the unlink. * If the listener needs to close, tcp_eager_cleanup() is called which queues * a message on all eager perimeter. The eager then does the unlink, clears * any pointers to the listener's queue and drops the reference to the * listener. The listener waits in tcp_close outside the squeue until its * refcount has dropped to 1. This ensures that the listener has waited for * all eagers to clear their association with the listener. * * Similarly, if eager decides to go away, it can unlink itself and close. * When the T_CONN_RES comes down, we check if eager has closed. Note that * the reference to eager is still valid because of the extra ref we put * in tcp_send_conn_ind. * * Listener can always locate the eager under the protection * of the listener->tcp_eager_lock, and then do a refhold * on the eager during the accept processing. * * The acceptor stream accesses the eager in the accept processing * based on the ref placed on eager before sending T_conn_ind. * The only entity that can negate this refhold is a listener close * which is mutually exclusive with an active acceptor stream. * * Eager's reference on the listener * =================================== * * If the accept happens (even on a closed eager) the eager drops its * reference on the listener at the start of tcp_accept_finish. If the * eager is killed due to an incoming RST before the T_conn_ind is sent up, * the reference is dropped in tcp_closei_local. If the listener closes, * the reference is dropped in tcp_eager_kill. In all cases the reference * is dropped while executing in the eager's context (squeue). */ /* END CSTYLED */ /* Process the SYN packet, mp, directed at the listener 'tcp' */ /* * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. * tcp_rput_data will not see any SYN packets. */ /* ARGSUSED */ void tcp_conn_request(void *arg, mblk_t *mp, void *arg2) { tcph_t *tcph; uint32_t seg_seq; tcp_t *eager; uint_t ipvers; ipha_t *ipha; ip6_t *ip6h; int err; conn_t *econnp = NULL; squeue_t *new_sqp; mblk_t *mp1; uint_t ip_hdr_len; conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; cred_t *credp; tcp_stack_t *tcps = tcp->tcp_tcps; ip_stack_t *ipst; if (tcp->tcp_state != TCPS_LISTEN) goto error2; ASSERT((tcp->tcp_connp->conn_flags & IPCL_BOUND) != 0); mutex_enter(&tcp->tcp_eager_lock); if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) { mutex_exit(&tcp->tcp_eager_lock); TCP_STAT(tcps, tcp_listendrop); BUMP_MIB(&tcps->tcps_mib, tcpListenDrop); if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, "tcp_conn_request: listen backlog (max=%d) " "overflow (%d pending) on %s", tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q, tcp_display(tcp, NULL, DISP_PORT_ONLY)); } goto error2; } if (tcp->tcp_conn_req_cnt_q0 >= tcp->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) { /* * Q0 is full. Drop a pending half-open req from the queue * to make room for the new SYN req. Also mark the time we * drop a SYN. * * A more aggressive defense against SYN attack will * be to set the "tcp_syn_defense" flag now. */ TCP_STAT(tcps, tcp_listendropq0); tcp->tcp_last_rcv_lbolt = lbolt64; if (!tcp_drop_q0(tcp)) { mutex_exit(&tcp->tcp_eager_lock); BUMP_MIB(&tcps->tcps_mib, tcpListenDropQ0); if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, "tcp_conn_request: listen half-open queue " "(max=%d) full (%d pending) on %s", tcps->tcps_conn_req_max_q0, tcp->tcp_conn_req_cnt_q0, tcp_display(tcp, NULL, DISP_PORT_ONLY)); } goto error2; } } mutex_exit(&tcp->tcp_eager_lock); /* * IP adds STRUIO_EAGER and ensures that the received packet is * M_DATA even if conn_ipv6_recvpktinfo is enabled or for ip6 * link local address. If IPSec is enabled, db_struioflag has * STRUIO_POLICY set (mutually exclusive from STRUIO_EAGER); * otherwise an error case if neither of them is set. */ if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { new_sqp = (squeue_t *)DB_CKSUMSTART(mp); DB_CKSUMSTART(mp) = 0; mp->b_datap->db_struioflag &= ~STRUIO_EAGER; econnp = (conn_t *)tcp_get_conn(arg2, tcps); if (econnp == NULL) goto error2; ASSERT(econnp->conn_netstack == connp->conn_netstack); econnp->conn_sqp = new_sqp; } else if ((mp->b_datap->db_struioflag & STRUIO_POLICY) != 0) { /* * mp is updated in tcp_get_ipsec_conn(). */ econnp = tcp_get_ipsec_conn(tcp, arg2, &mp); if (econnp == NULL) { /* * mp freed by tcp_get_ipsec_conn. */ return; } ASSERT(econnp->conn_netstack == connp->conn_netstack); } else { goto error2; } ASSERT(DB_TYPE(mp) == M_DATA); ipvers = IPH_HDR_VERSION(mp->b_rptr); ASSERT(ipvers == IPV6_VERSION || ipvers == IPV4_VERSION); ASSERT(OK_32PTR(mp->b_rptr)); if (ipvers == IPV4_VERSION) { ipha = (ipha_t *)mp->b_rptr; ip_hdr_len = IPH_HDR_LENGTH(ipha); tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; } else { ip6h = (ip6_t *)mp->b_rptr; ip_hdr_len = ip_hdr_length_v6(mp, ip6h); tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; } if (tcp->tcp_family == AF_INET) { ASSERT(ipvers == IPV4_VERSION); err = tcp_conn_create_v4(connp, econnp, ipha, tcph, mp); } else { err = tcp_conn_create_v6(connp, econnp, mp, tcph, ipvers, mp); } if (err) goto error3; eager = econnp->conn_tcp; /* Inherit various TCP parameters from the listener */ eager->tcp_naglim = tcp->tcp_naglim; eager->tcp_first_timer_threshold = tcp->tcp_first_timer_threshold; eager->tcp_second_timer_threshold = tcp->tcp_second_timer_threshold; eager->tcp_first_ctimer_threshold = tcp->tcp_first_ctimer_threshold; eager->tcp_second_ctimer_threshold = tcp->tcp_second_ctimer_threshold; /* * tcp_adapt_ire() may change tcp_rwnd according to the ire metrics. * If it does not, the eager's receive window will be set to the * listener's receive window later in this function. */ eager->tcp_rwnd = 0; /* * Inherit listener's tcp_init_cwnd. Need to do this before * calling tcp_process_options() where tcp_mss_set() is called * to set the initial cwnd. */ eager->tcp_init_cwnd = tcp->tcp_init_cwnd; /* * Zones: tcp_adapt_ire() and tcp_send_data() both need the * zone id before the accept is completed in tcp_wput_accept(). */ econnp->conn_zoneid = connp->conn_zoneid; econnp->conn_allzones = connp->conn_allzones; /* Copy nexthop information from listener to eager */ if (connp->conn_nexthop_set) { econnp->conn_nexthop_set = connp->conn_nexthop_set; econnp->conn_nexthop_v4 = connp->conn_nexthop_v4; } /* * TSOL: tsol_input_proc() needs the eager's cred before the * eager is accepted */ econnp->conn_cred = eager->tcp_cred = credp = connp->conn_cred; crhold(credp); /* * If the caller has the process-wide flag set, then default to MAC * exempt mode. This allows read-down to unlabeled hosts. */ if (getpflags(NET_MAC_AWARE, credp) != 0) econnp->conn_mac_exempt = B_TRUE; if (is_system_labeled()) { cred_t *cr; if (connp->conn_mlp_type != mlptSingle) { cr = econnp->conn_peercred = DB_CRED(mp); if (cr != NULL) crhold(cr); else cr = econnp->conn_cred; DTRACE_PROBE2(mlp_syn_accept, conn_t *, econnp, cred_t *, cr) } else { cr = econnp->conn_cred; DTRACE_PROBE2(syn_accept, conn_t *, econnp, cred_t *, cr) } if (!tcp_update_label(eager, cr)) { DTRACE_PROBE3( tx__ip__log__error__connrequest__tcp, char *, "eager connp(1) label on SYN mp(2) failed", conn_t *, econnp, mblk_t *, mp); goto error3; } } eager->tcp_hard_binding = B_TRUE; tcp_bind_hash_insert(&tcps->tcps_bind_fanout[ TCP_BIND_HASH(eager->tcp_lport)], eager, 0); CL_INET_CONNECT(eager); /* * No need to check for multicast destination since ip will only pass * up multicasts to those that have expressed interest * TODO: what about rejecting broadcasts? * Also check that source is not a multicast or broadcast address. * * DTrace tcp:::state-change is probed a little further down, * where it is set for the second time. */ eager->tcp_state = TCPS_SYN_RCVD; /* * There should be no ire in the mp as we are being called after * receiving the SYN. */ ASSERT(tcp_ire_mp(mp) == NULL); /* * Adapt our mss, ttl, ... according to information provided in IRE. */ if (tcp_adapt_ire(eager, NULL) == 0) { /* Undo the bind_hash_insert */ tcp_bind_hash_remove(eager); goto error3; } /* * DTrace the first SYN as a tcp:::receive. This is placed after * tcp_adapt_ire() so that tcp->tcp_loopback has been set. */ DTRACE_TCP5(receive, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, mp->b_rptr, tcp_t *, tcp, tcph_t *, tcph); /* Process all TCP options. */ tcp_process_options(eager, tcph); /* Is the other end ECN capable? */ if (tcps->tcps_ecn_permitted >= 1 && (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { eager->tcp_ecn_ok = B_TRUE; } /* * listener->tcp_rq->q_hiwat should be the default window size or a * window size changed via SO_RCVBUF option. First round up the * eager's tcp_rwnd to the nearest MSS. Then find out the window * scale option value if needed. Call tcp_rwnd_set() to finish the * setting. * * Note if there is a rpipe metric associated with the remote host, * we should not inherit receive window size from listener. */ eager->tcp_rwnd = MSS_ROUNDUP( (eager->tcp_rwnd == 0 ? tcp->tcp_rq->q_hiwat : eager->tcp_rwnd), eager->tcp_mss); if (eager->tcp_snd_ws_ok) tcp_set_ws_value(eager); /* * Note that this is the only place tcp_rwnd_set() is called for * accepting a connection. We need to call it here instead of * after the 3-way handshake because we need to tell the other * side our rwnd in the SYN-ACK segment. */ (void) tcp_rwnd_set(eager, eager->tcp_rwnd); /* * We eliminate the need for sockfs to send down a T_SVR4_OPTMGMT_REQ * via soaccept()->soinheritoptions() which essentially applies * all the listener options to the new STREAM. The options that we * need to take care of are: * SO_DEBUG, SO_REUSEADDR, SO_KEEPALIVE, SO_DONTROUTE, SO_BROADCAST, * SO_USELOOPBACK, SO_OOBINLINE, SO_DGRAM_ERRIND, SO_LINGER, * SO_SNDBUF, SO_RCVBUF. * * SO_RCVBUF: tcp_rwnd_set() above takes care of it. * SO_SNDBUF: Set the tcp_xmit_hiwater for the eager. When * tcp_maxpsz_set() gets called later from * tcp_accept_finish(), the option takes effect. * */ /* Set the TCP options */ eager->tcp_xmit_hiwater = tcp->tcp_xmit_hiwater; eager->tcp_dgram_errind = tcp->tcp_dgram_errind; eager->tcp_oobinline = tcp->tcp_oobinline; eager->tcp_reuseaddr = tcp->tcp_reuseaddr; eager->tcp_broadcast = tcp->tcp_broadcast; eager->tcp_useloopback = tcp->tcp_useloopback; eager->tcp_dontroute = tcp->tcp_dontroute; eager->tcp_linger = tcp->tcp_linger; eager->tcp_lingertime = tcp->tcp_lingertime; if (tcp->tcp_ka_enabled) eager->tcp_ka_enabled = 1; /* Set the IP options */ econnp->conn_broadcast = connp->conn_broadcast; econnp->conn_loopback = connp->conn_loopback; econnp->conn_dontroute = connp->conn_dontroute; econnp->conn_reuseaddr = connp->conn_reuseaddr; /* Put a ref on the listener for the eager. */ CONN_INC_REF(connp); mutex_enter(&tcp->tcp_eager_lock); tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; tcp->tcp_eager_next_q0 = eager; eager->tcp_eager_prev_q0 = tcp; /* Set tcp_listener before adding it to tcp_conn_fanout */ eager->tcp_listener = tcp; eager->tcp_saved_listener = tcp; /* * Tag this detached tcp vector for later retrieval * by our listener client in tcp_accept(). */ eager->tcp_conn_req_seqnum = tcp->tcp_conn_req_seqnum; tcp->tcp_conn_req_cnt_q0++; if (++tcp->tcp_conn_req_seqnum == -1) { /* * -1 is "special" and defined in TPI as something * that should never be used in T_CONN_IND */ ++tcp->tcp_conn_req_seqnum; } mutex_exit(&tcp->tcp_eager_lock); if (tcp->tcp_syn_defense) { /* Don't drop the SYN that comes from a good IP source */ ipaddr_t *addr_cache = (ipaddr_t *)(tcp->tcp_ip_addr_cache); if (addr_cache != NULL && eager->tcp_remote == addr_cache[IP_ADDR_CACHE_HASH(eager->tcp_remote)]) { eager->tcp_dontdrop = B_TRUE; } } /* * We need to insert the eager in its own perimeter but as soon * as we do that, we expose the eager to the classifier and * should not touch any field outside the eager's perimeter. * So do all the work necessary before inserting the eager * in its own perimeter. Be optimistic that ipcl_conn_insert() * will succeed but undo everything if it fails. */ seg_seq = ABE32_TO_U32(tcph->th_seq); eager->tcp_irs = seg_seq; eager->tcp_rack = seg_seq; eager->tcp_rnxt = seg_seq + 1; U32_TO_ABE32(eager->tcp_rnxt, eager->tcp_tcph->th_ack); BUMP_MIB(&tcps->tcps_mib, tcpPassiveOpens); DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, eager, int32_t, TCPS_SYN_RCVD); eager->tcp_state = TCPS_SYN_RCVD; mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); if (mp1 == NULL) { /* * Increment the ref count as we are going to * enqueueing an mp in squeue */ CONN_INC_REF(econnp); goto error; } DB_CPID(mp1) = tcp->tcp_cpid; eager->tcp_cpid = tcp->tcp_cpid; eager->tcp_open_time = lbolt64; /* * We need to start the rto timer. In normal case, we start * the timer after sending the packet on the wire (or at * least believing that packet was sent by waiting for * CALL_IP_WPUT() to return). Since this is the first packet * being sent on the wire for the eager, our initial tcp_rto * is at least tcp_rexmit_interval_min which is a fairly * large value to allow the algorithm to adjust slowly to large * fluctuations of RTT during first few transmissions. * * Starting the timer first and then sending the packet in this * case shouldn't make much difference since tcp_rexmit_interval_min * is of the order of several 100ms and starting the timer * first and then sending the packet will result in difference * of few micro seconds. * * Without this optimization, we are forced to hold the fanout * lock across the ipcl_bind_insert() and sending the packet * so that we don't race against an incoming packet (maybe RST) * for this eager. * * It is necessary to acquire an extra reference on the eager * at this point and hold it until after tcp_send_data() to * ensure against an eager close race. */ CONN_INC_REF(eager->tcp_connp); TCP_RECORD_TRACE(eager, mp1, TCP_TRACE_SEND_PKT); TCP_TIMER_RESTART(eager, eager->tcp_rto); /* * Insert the eager in its own perimeter now. We are ready to deal * with any packets on eager. */ if (eager->tcp_ipversion == IPV4_VERSION) { if (ipcl_conn_insert(econnp, IPPROTO_TCP, 0, 0, 0) != 0) { goto error; } } else { if (ipcl_conn_insert_v6(econnp, IPPROTO_TCP, 0, 0, 0, 0) != 0) { goto error; } } /* mark conn as fully-bound */ econnp->conn_fully_bound = B_TRUE; /* Send the SYN-ACK */ tcp_send_data(eager, eager->tcp_wq, mp1); CONN_DEC_REF(eager->tcp_connp); freemsg(mp); return; error: freemsg(mp1); eager->tcp_closemp_used = B_TRUE; TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); squeue_fill(econnp->conn_sqp, &eager->tcp_closemp, tcp_eager_kill, econnp, SQTAG_TCP_CONN_REQ_2); /* * If a connection already exists, send the mp to that connections so * that it can be appropriately dealt with. */ ipst = tcps->tcps_netstack->netstack_ip; if ((econnp = ipcl_classify(mp, connp->conn_zoneid, ipst)) != NULL) { if (!IPCL_IS_CONNECTED(econnp)) { /* * Something bad happened. ipcl_conn_insert() * failed because a connection already existed * in connected hash but we can't find it * anymore (someone blew it away). Just * free this message and hopefully remote * will retransmit at which time the SYN can be * treated as a new connection or dealth with * a TH_RST if a connection already exists. */ CONN_DEC_REF(econnp); freemsg(mp); } else { squeue_fill(econnp->conn_sqp, mp, tcp_input, econnp, SQTAG_TCP_CONN_REQ_1); } } else { /* Nobody wants this packet */ freemsg(mp); } return; error3: CONN_DEC_REF(econnp); error2: /* * DTrace this tcp:::receive event, as we skipped the previous receive * probe. For DTrace only, we find the IP header length so that the * TCP header can be found. */ ipvers = IPH_HDR_VERSION(mp->b_rptr); if (OK_32PTR(mp->b_rptr) && (ipvers == IPV4_VERSION || ipvers == IPV6_VERSION)) { if (ipvers == IPV4_VERSION) ip_hdr_len = IPH_HDR_LENGTH((ipha_t *)mp->b_rptr); else ip_hdr_len = ip_hdr_length_v6(mp, (ip6_t *)mp->b_rptr); DTRACE_TCP5(receive, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, mp->b_rptr, tcp_t *, NULL, tcph_t *, &mp->b_rptr[ip_hdr_len]); } freemsg(mp); } /* * In an ideal case of vertical partition in NUMA architecture, its * beneficial to have the listener and all the incoming connections * tied to the same squeue. The other constraint is that incoming * connections should be tied to the squeue attached to interrupted * CPU for obvious locality reason so this leaves the listener to * be tied to the same squeue. Our only problem is that when listener * is binding, the CPU that will get interrupted by the NIC whose * IP address the listener is binding to is not even known. So * the code below allows us to change that binding at the time the * CPU is interrupted by virtue of incoming connection's squeue. * * This is usefull only in case of a listener bound to a specific IP * address. For other kind of listeners, they get bound the * very first time and there is no attempt to rebind them. */ void tcp_conn_request_unbound(void *arg, mblk_t *mp, void *arg2) { conn_t *connp = (conn_t *)arg; squeue_t *sqp = (squeue_t *)arg2; squeue_t *new_sqp; uint32_t conn_flags; if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { new_sqp = (squeue_t *)DB_CKSUMSTART(mp); } else { goto done; } if (connp->conn_fanout == NULL) goto done; if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { mutex_enter(&connp->conn_fanout->connf_lock); mutex_enter(&connp->conn_lock); /* * No one from read or write side can access us now * except for already queued packets on this squeue. * But since we haven't changed the squeue yet, they * can't execute. If they are processed after we have * changed the squeue, they are sent back to the * correct squeue down below. * But a listner close can race with processing of * incoming SYN. If incoming SYN processing changes * the squeue then the listener close which is waiting * to enter the squeue would operate on the wrong * squeue. Hence we don't change the squeue here unless * the refcount is exactly the minimum refcount. The * minimum refcount of 4 is counted as - 1 each for * TCP and IP, 1 for being in the classifier hash, and * 1 for the mblk being processed. */ if (connp->conn_ref != 4 || connp->conn_tcp->tcp_state != TCPS_LISTEN) { mutex_exit(&connp->conn_lock); mutex_exit(&connp->conn_fanout->connf_lock); goto done; } if (connp->conn_sqp != new_sqp) { while (connp->conn_sqp != new_sqp) (void) casptr(&connp->conn_sqp, sqp, new_sqp); } do { conn_flags = connp->conn_flags; conn_flags |= IPCL_FULLY_BOUND; (void) cas32(&connp->conn_flags, connp->conn_flags, conn_flags); } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); mutex_exit(&connp->conn_fanout->connf_lock); mutex_exit(&connp->conn_lock); } done: if (connp->conn_sqp != sqp) { CONN_INC_REF(connp); squeue_fill(connp->conn_sqp, mp, connp->conn_recv, connp, SQTAG_TCP_CONN_REQ_UNBOUND); } else { tcp_conn_request(connp, mp, sqp); } } /* * Successful connect request processing begins when our client passes * a T_CONN_REQ message into tcp_wput() and ends when tcp_rput() passes * our T_OK_ACK reply message upstream. The control flow looks like this: * upstream -> tcp_wput() -> tcp_wput_proto() -> tcp_connect() -> IP * upstream <- tcp_rput() <- IP * After various error checks are completed, tcp_connect() lays * the target address and port into the composite header template, * preallocates the T_OK_ACK reply message, construct a full 12 byte bind * request followed by an IRE request, and passes the three mblk message * down to IP looking like this: * O_T_BIND_REQ for IP --> IRE req --> T_OK_ACK for our client * Processing continues in tcp_rput() when we receive the following message: * T_BIND_ACK from IP --> IRE ack --> T_OK_ACK for our client * After consuming the first two mblks, tcp_rput() calls tcp_timer(), * to fire off the connection request, and then passes the T_OK_ACK mblk * upstream that we filled in below. There are, of course, numerous * error conditions along the way which truncate the processing described * above. */ static void tcp_connect(tcp_t *tcp, mblk_t *mp) { sin_t *sin; sin6_t *sin6; queue_t *q = tcp->tcp_wq; struct T_conn_req *tcr; ipaddr_t *dstaddrp; in_port_t dstport; uint_t srcid; tcr = (struct T_conn_req *)mp->b_rptr; ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { tcp_err_ack(tcp, mp, TPROTO, 0); return; } /* * Determine packet type based on type of address passed in * the request should contain an IPv4 or IPv6 address. * Make sure that address family matches the type of * family of the the address passed down */ switch (tcr->DEST_length) { default: tcp_err_ack(tcp, mp, TBADADDR, 0); return; case (sizeof (sin_t) - sizeof (sin->sin_zero)): { /* * XXX: The check for valid DEST_length was not there * in earlier releases and some buggy * TLI apps (e.g Sybase) got away with not feeding * in sin_zero part of address. * We allow that bug to keep those buggy apps humming. * Test suites require the check on DEST_length. * We construct a new mblk with valid DEST_length * free the original so the rest of the code does * not have to keep track of this special shorter * length address case. */ mblk_t *nmp; struct T_conn_req *ntcr; sin_t *nsin; nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) + tcr->OPT_length, BPRI_HI); if (nmp == NULL) { tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } ntcr = (struct T_conn_req *)nmp->b_rptr; bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */ ntcr->PRIM_type = T_CONN_REQ; ntcr->DEST_length = sizeof (sin_t); ntcr->DEST_offset = sizeof (struct T_conn_req); nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset); *nsin = sin_null; /* Get pointer to shorter address to copy from original mp */ sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, tcr->DEST_length); /* extract DEST_length worth of sin_t */ if (sin == NULL || !OK_32PTR((char *)sin)) { freemsg(nmp); tcp_err_ack(tcp, mp, TSYSERR, EINVAL); return; } nsin->sin_family = sin->sin_family; nsin->sin_port = sin->sin_port; nsin->sin_addr = sin->sin_addr; /* Note:nsin->sin_zero zero-fill with sin_null assign above */ nmp->b_wptr = (uchar_t *)&nsin[1]; if (tcr->OPT_length != 0) { ntcr->OPT_length = tcr->OPT_length; ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr; bcopy((uchar_t *)tcr + tcr->OPT_offset, (uchar_t *)ntcr + ntcr->OPT_offset, tcr->OPT_length); nmp->b_wptr += tcr->OPT_length; } freemsg(mp); /* original mp freed */ mp = nmp; /* re-initialize original variables */ tcr = ntcr; } /* FALLTHRU */ case sizeof (sin_t): sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, sizeof (sin_t)); if (sin == NULL || !OK_32PTR((char *)sin)) { tcp_err_ack(tcp, mp, TSYSERR, EINVAL); return; } if (tcp->tcp_family != AF_INET || sin->sin_family != AF_INET) { tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); return; } if (sin->sin_port == 0) { tcp_err_ack(tcp, mp, TBADADDR, 0); return; } if (tcp->tcp_connp && tcp->tcp_connp->conn_ipv6_v6only) { tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); return; } break; case sizeof (sin6_t): sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset, sizeof (sin6_t)); if (sin6 == NULL || !OK_32PTR((char *)sin6)) { tcp_err_ack(tcp, mp, TSYSERR, EINVAL); return; } if (tcp->tcp_family != AF_INET6 || sin6->sin6_family != AF_INET6) { tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); return; } if (sin6->sin6_port == 0) { tcp_err_ack(tcp, mp, TBADADDR, 0); return; } break; } /* * TODO: If someone in TCPS_TIME_WAIT has this dst/port we * should key on their sequence number and cut them loose. */ /* * If options passed in, feed it for verification and handling */ if (tcr->OPT_length != 0) { mblk_t *ok_mp; mblk_t *discon_mp; mblk_t *conn_opts_mp; int t_error, sys_error, do_disconnect; conn_opts_mp = NULL; if (tcp_conprim_opt_process(tcp, mp, &do_disconnect, &t_error, &sys_error) < 0) { if (do_disconnect) { ASSERT(t_error == 0 && sys_error == 0); discon_mp = mi_tpi_discon_ind(NULL, ECONNREFUSED, 0); if (!discon_mp) { tcp_err_ack_prim(tcp, mp, T_CONN_REQ, TSYSERR, ENOMEM); return; } ok_mp = mi_tpi_ok_ack_alloc(mp); if (!ok_mp) { tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, TSYSERR, ENOMEM); return; } qreply(q, ok_mp); qreply(q, discon_mp); /* no flush! */ } else { ASSERT(t_error != 0); tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error, sys_error); } return; } /* * Success in setting options, the mp option buffer represented * by OPT_length/offset has been potentially modified and * contains results of option processing. We copy it in * another mp to save it for potentially influencing returning * it in T_CONN_CONN. */ if (tcr->OPT_length != 0) { /* there are resulting options */ conn_opts_mp = copyb(mp); if (!conn_opts_mp) { tcp_err_ack_prim(tcp, mp, T_CONN_REQ, TSYSERR, ENOMEM); return; } ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL); tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp; /* * Note: * These resulting option negotiation can include any * end-to-end negotiation options but there no such * thing (yet?) in our TCP/IP. */ } } /* * If we're connecting to an IPv4-mapped IPv6 address, we need to * make sure that the template IP header in the tcp structure is an * IPv4 header, and that the tcp_ipversion is IPV4_VERSION. We * need to this before we call tcp_bindi() so that the port lookup * code will look for ports in the correct port space (IPv4 and * IPv6 have separate port spaces). */ if (tcp->tcp_family == AF_INET6 && tcp->tcp_ipversion == IPV6_VERSION && IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { int err = 0; err = tcp_header_init_ipv4(tcp); if (err != 0) { mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); goto connect_failed; } if (tcp->tcp_lport != 0) *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; } if (tcp->tcp_issocket) { /* * TCP is _D_SODIRECT and sockfs is directly above so save * the shared sonode sodirect_t pointer (if any) to enable * TCP sodirect. */ tcp->tcp_sodirect = SOD_QTOSODP(tcp->tcp_rq); } switch (tcp->tcp_state) { case TCPS_IDLE: /* * We support quick connect, refer to comments in * tcp_connect_*() */ /* FALLTHRU */ case TCPS_BOUND: case TCPS_LISTEN: if (tcp->tcp_family == AF_INET6) { if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { tcp_connect_ipv6(tcp, mp, &sin6->sin6_addr, sin6->sin6_port, sin6->sin6_flowinfo, sin6->__sin6_src_id, sin6->sin6_scope_id); return; } /* * Destination adress is mapped IPv6 address. * Source bound address should be unspecified or * IPv6 mapped address as well. */ if (!IN6_IS_ADDR_UNSPECIFIED( &tcp->tcp_bound_source_v6) && !IN6_IS_ADDR_V4MAPPED(&tcp->tcp_bound_source_v6)) { mp = mi_tpi_err_ack_alloc(mp, TSYSERR, EADDRNOTAVAIL); break; } dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); dstport = sin6->sin6_port; srcid = sin6->__sin6_src_id; } else { dstaddrp = &sin->sin_addr.s_addr; dstport = sin->sin_port; srcid = 0; } tcp_connect_ipv4(tcp, mp, dstaddrp, dstport, srcid); return; default: mp = mi_tpi_err_ack_alloc(mp, TOUTSTATE, 0); break; } /* * Note: Code below is the "failure" case */ /* return error ack and blow away saved option results if any */ connect_failed: if (mp != NULL) putnext(tcp->tcp_rq, mp); else { tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, TSYSERR, ENOMEM); } if (tcp->tcp_conn.tcp_opts_conn_req != NULL) tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); } /* * Handle connect to IPv4 destinations, including connections for AF_INET6 * sockets connecting to IPv4 mapped IPv6 destinations. */ static void tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport, uint_t srcid) { tcph_t *tcph; mblk_t *mp1; ipaddr_t dstaddr = *dstaddrp; int32_t oldstate; uint16_t lport; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT(tcp->tcp_ipversion == IPV4_VERSION); /* Check for attempt to connect to INADDR_ANY */ if (dstaddr == INADDR_ANY) { /* * SunOS 4.x and 4.3 BSD allow an application * to connect a TCP socket to INADDR_ANY. * When they do this, the kernel picks the * address of one interface and uses it * instead. The kernel usually ends up * picking the address of the loopback * interface. This is an undocumented feature. * However, we provide the same thing here * in order to have source and binary * compatibility with SunOS 4.x. * Update the T_CONN_REQ (sin/sin6) since it is used to * generate the T_CONN_CON. */ dstaddr = htonl(INADDR_LOOPBACK); *dstaddrp = dstaddr; } /* Handle __sin6_src_id if socket not bound to an IP address */ if (srcid != 0 && tcp->tcp_ipha->ipha_src == INADDR_ANY) { ip_srcid_find_id(srcid, &tcp->tcp_ip_src_v6, tcp->tcp_connp->conn_zoneid, tcps->tcps_netstack); IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_ip_src_v6, tcp->tcp_ipha->ipha_src); } /* * Don't let an endpoint connect to itself. Note that * the test here does not catch the case where the * source IP addr was left unspecified by the user. In * this case, the source addr is set in tcp_adapt_ire() * using the reply to the T_BIND message that we send * down to IP here and the check is repeated in tcp_rput_other. */ if (dstaddr == tcp->tcp_ipha->ipha_src && dstport == tcp->tcp_lport) { mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); goto failed; } tcp->tcp_ipha->ipha_dst = dstaddr; IN6_IPADDR_TO_V4MAPPED(dstaddr, &tcp->tcp_remote_v6); /* * Massage a source route if any putting the first hop * in iph_dst. Compute a starting value for the checksum which * takes into account that the original iph_dst should be * included in the checksum but that ip will include the * first hop in the source route in the tcp checksum. */ tcp->tcp_sum = ip_massage_options(tcp->tcp_ipha, tcps->tcps_netstack); tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + (tcp->tcp_ipha->ipha_dst & 0xffff)); if ((int)tcp->tcp_sum < 0) tcp->tcp_sum--; tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); tcph = tcp->tcp_tcph; *(uint16_t *)tcph->th_fport = dstport; tcp->tcp_fport = dstport; oldstate = tcp->tcp_state; /* * At this point the remote destination address and remote port fields * in the tcp-four-tuple have been filled in the tcp structure. Now we * have to see which state tcp was in so we can take apropriate action. */ if (oldstate == TCPS_IDLE) { /* * We support a quick connect capability here, allowing * clients to transition directly from IDLE to SYN_SENT * tcp_bindi will pick an unused port, insert the connection * in the bind hash and transition to BOUND state. */ lport = tcp_update_next_port(tcps->tcps_next_port_to_try, tcp, B_TRUE); lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE, B_FALSE, B_FALSE); if (lport == 0) { mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); goto failed; } } DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_SYN_SENT); tcp->tcp_state = TCPS_SYN_SENT; /* * TODO: allow data with connect requests * by unlinking M_DATA trailers here and * linking them in behind the T_OK_ACK mblk. * The tcp_rput() bind ack handler would then * feed them to tcp_wput_data() rather than call * tcp_timer(). */ mp = mi_tpi_ok_ack_alloc(mp); if (!mp) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, oldstate); tcp->tcp_state = oldstate; goto failed; } if (tcp->tcp_family == AF_INET) { mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa_conn_t)); } else { mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t)); } if (mp1) { /* * We need to make sure that the conn_recv is set to a non-null * value before we insert the conn_t into the classifier table. * This is to avoid a race with an incoming packet which does * an ipcl_classify(). */ tcp->tcp_connp->conn_recv = tcp_input; /* Hang onto the T_OK_ACK for later. */ linkb(mp1, mp); mblk_setcred(mp1, tcp->tcp_cred); if (tcp->tcp_family == AF_INET) mp1 = ip_bind_v4(tcp->tcp_wq, mp1, tcp->tcp_connp); else { mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, &tcp->tcp_sticky_ipp); } BUMP_MIB(&tcps->tcps_mib, tcpActiveOpens); tcp->tcp_active_open = 1; /* * If the bind cannot complete immediately * IP will arrange to call tcp_rput_other * when the bind completes. */ if (mp1 != NULL) tcp_rput_other(tcp, mp1); return; } /* Error case */ DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, oldstate); tcp->tcp_state = oldstate; mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); failed: /* return error ack and blow away saved option results if any */ if (mp != NULL) putnext(tcp->tcp_rq, mp); else { tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, TSYSERR, ENOMEM); } if (tcp->tcp_conn.tcp_opts_conn_req != NULL) tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); } /* * Handle connect to IPv6 destinations. */ static void tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id) { tcph_t *tcph; mblk_t *mp1; ip6_rthdr_t *rth; int32_t oldstate; uint16_t lport; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT(tcp->tcp_family == AF_INET6); /* * If we're here, it means that the destination address is a native * IPv6 address. Return an error if tcp_ipversion is not IPv6. A * reason why it might not be IPv6 is if the socket was bound to an * IPv4-mapped IPv6 address. */ if (tcp->tcp_ipversion != IPV6_VERSION) { mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); goto failed; } /* * Interpret a zero destination to mean loopback. * Update the T_CONN_REQ (sin/sin6) since it is used to * generate the T_CONN_CON. */ if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) { *dstaddrp = ipv6_loopback; } /* Handle __sin6_src_id if socket not bound to an IP address */ if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { ip_srcid_find_id(srcid, &tcp->tcp_ip6h->ip6_src, tcp->tcp_connp->conn_zoneid, tcps->tcps_netstack); tcp->tcp_ip_src_v6 = tcp->tcp_ip6h->ip6_src; } /* * Take care of the scope_id now and add ip6i_t * if ip6i_t is not already allocated through TCP * sticky options. At this point tcp_ip6h does not * have dst info, thus use dstaddrp. */ if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; ip6i_t *ip6i; ipp->ipp_ifindex = scope_id; ip6i = (ip6i_t *)tcp->tcp_iphc; if ((ipp->ipp_fields & IPPF_HAS_IP6I) && ip6i != NULL && (ip6i->ip6i_nxt == IPPROTO_RAW)) { /* Already allocated */ ip6i->ip6i_flags |= IP6I_IFINDEX; ip6i->ip6i_ifindex = ipp->ipp_ifindex; ipp->ipp_fields |= IPPF_SCOPE_ID; } else { int reterr; ipp->ipp_fields |= IPPF_SCOPE_ID; if (ipp->ipp_fields & IPPF_HAS_IP6I) ip2dbg(("tcp_connect_v6: SCOPE_ID set\n")); reterr = tcp_build_hdrs(tcp->tcp_rq, tcp); if (reterr != 0) goto failed; ip1dbg(("tcp_connect_ipv6: tcp_bld_hdrs returned\n")); } } /* * Don't let an endpoint connect to itself. Note that * the test here does not catch the case where the * source IP addr was left unspecified by the user. In * this case, the source addr is set in tcp_adapt_ire() * using the reply to the T_BIND message that we send * down to IP here and the check is repeated in tcp_rput_other. */ if (IN6_ARE_ADDR_EQUAL(dstaddrp, &tcp->tcp_ip6h->ip6_src) && (dstport == tcp->tcp_lport)) { mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); goto failed; } tcp->tcp_ip6h->ip6_dst = *dstaddrp; tcp->tcp_remote_v6 = *dstaddrp; tcp->tcp_ip6h->ip6_vcf = (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); /* * Massage a routing header (if present) putting the first hop * in ip6_dst. Compute a starting value for the checksum which * takes into account that the original ip6_dst should be * included in the checksum but that ip will include the * first hop in the source route in the tcp checksum. */ rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph); if (rth != NULL) { tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth, tcps->tcps_netstack); tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); } else { tcp->tcp_sum = 0; } tcph = tcp->tcp_tcph; *(uint16_t *)tcph->th_fport = dstport; tcp->tcp_fport = dstport; oldstate = tcp->tcp_state; /* * At this point the remote destination address and remote port fields * in the tcp-four-tuple have been filled in the tcp structure. Now we * have to see which state tcp was in so we can take apropriate action. */ if (oldstate == TCPS_IDLE) { /* * We support a quick connect capability here, allowing * clients to transition directly from IDLE to SYN_SENT * tcp_bindi will pick an unused port, insert the connection * in the bind hash and transition to BOUND state. */ lport = tcp_update_next_port(tcps->tcps_next_port_to_try, tcp, B_TRUE); lport = tcp_bindi(tcp, lport, &tcp->tcp_ip_src_v6, 0, B_TRUE, B_FALSE, B_FALSE); if (lport == 0) { mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); goto failed; } } DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_SYN_SENT); tcp->tcp_state = TCPS_SYN_SENT; /* * TODO: allow data with connect requests * by unlinking M_DATA trailers here and * linking them in behind the T_OK_ACK mblk. * The tcp_rput() bind ack handler would then * feed them to tcp_wput_data() rather than call * tcp_timer(). */ mp = mi_tpi_ok_ack_alloc(mp); if (!mp) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, oldstate); tcp->tcp_state = oldstate; goto failed; } mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t)); if (mp1) { /* * We need to make sure that the conn_recv is set to a non-null * value before we insert the conn_t into the classifier table. * This is to avoid a race with an incoming packet which does * an ipcl_classify(). */ tcp->tcp_connp->conn_recv = tcp_input; /* Hang onto the T_OK_ACK for later. */ linkb(mp1, mp); mblk_setcred(mp1, tcp->tcp_cred); mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, &tcp->tcp_sticky_ipp); BUMP_MIB(&tcps->tcps_mib, tcpActiveOpens); tcp->tcp_active_open = 1; /* ip_bind_v6() may return ACK or ERROR */ if (mp1 != NULL) tcp_rput_other(tcp, mp1); return; } /* Error case */ DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, oldstate); tcp->tcp_state = oldstate; mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); failed: /* return error ack and blow away saved option results if any */ if (mp != NULL) putnext(tcp->tcp_rq, mp); else { tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, TSYSERR, ENOMEM); } if (tcp->tcp_conn.tcp_opts_conn_req != NULL) tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); } /* * We need a stream q for detached closing tcp connections * to use. Our client hereby indicates that this q is the * one to use. */ static void tcp_def_q_set(tcp_t *tcp, mblk_t *mp) { struct iocblk *iocp = (struct iocblk *)mp->b_rptr; queue_t *q = tcp->tcp_wq; tcp_stack_t *tcps = tcp->tcp_tcps; #ifdef NS_DEBUG (void) printf("TCP_IOC_DEFAULT_Q for stack %d\n", tcps->tcps_netstack->netstack_stackid); #endif mp->b_datap->db_type = M_IOCACK; iocp->ioc_count = 0; mutex_enter(&tcps->tcps_g_q_lock); if (tcps->tcps_g_q != NULL) { mutex_exit(&tcps->tcps_g_q_lock); iocp->ioc_error = EALREADY; } else { mblk_t *mp1; mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 0); if (mp1 == NULL) { mutex_exit(&tcps->tcps_g_q_lock); iocp->ioc_error = ENOMEM; } else { tcps->tcps_g_q = tcp->tcp_rq; mutex_exit(&tcps->tcps_g_q_lock); iocp->ioc_error = 0; iocp->ioc_rval = 0; /* * We are passing tcp_sticky_ipp as NULL * as it is not useful for tcp_default queue * * Set conn_recv just in case. */ tcp->tcp_connp->conn_recv = tcp_conn_request; mp1 = ip_bind_v6(q, mp1, tcp->tcp_connp, NULL); if (mp1 != NULL) tcp_rput_other(tcp, mp1); } } qreply(q, mp); } /* * Our client hereby directs us to reject the connection request * that tcp_conn_request() marked with 'seqnum'. Rejection consists * of sending the appropriate RST, not an ICMP error. */ static void tcp_disconnect(tcp_t *tcp, mblk_t *mp) { tcp_t *ltcp = NULL; t_scalar_t seqnum; conn_t *connp; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { tcp_err_ack(tcp, mp, TPROTO, 0); return; } /* * Right now, upper modules pass down a T_DISCON_REQ to TCP, * when the stream is in BOUND state. Do not send a reset, * since the destination IP address is not valid, and it can * be the initialized value of all zeros (broadcast address). * * If TCP has sent down a bind request to IP and has not * received the reply, reject the request. Otherwise, TCP * will be confused. */ if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, "tcp_disconnect: bad state, %d", tcp->tcp_state); } tcp_err_ack(tcp, mp, TOUTSTATE, 0); return; } seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { /* * According to TPI, for non-listeners, ignore seqnum * and disconnect. * Following interpretation of -1 seqnum is historical * and implied TPI ? (TPI only states that for T_CONN_IND, * a valid seqnum should not be -1). * * -1 means disconnect everything * regardless even on a listener. */ int old_state = tcp->tcp_state; ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; /* * The connection can't be on the tcp_time_wait_head list * since it is not detached. */ ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); ASSERT(tcp->tcp_time_wait_expire == 0); ltcp = NULL; /* * If it used to be a listener, check to make sure no one else * has taken the port before switching back to LISTEN state. */ if (tcp->tcp_ipversion == IPV4_VERSION) { connp = ipcl_lookup_listener_v4(tcp->tcp_lport, tcp->tcp_ipha->ipha_src, tcp->tcp_connp->conn_zoneid, ipst); if (connp != NULL) ltcp = connp->conn_tcp; } else { /* Allow tcp_bound_if listeners? */ connp = ipcl_lookup_listener_v6(tcp->tcp_lport, &tcp->tcp_ip6h->ip6_src, 0, tcp->tcp_connp->conn_zoneid, ipst); if (connp != NULL) ltcp = connp->conn_tcp; } if (tcp->tcp_conn_req_max && ltcp == NULL) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_LISTEN); tcp->tcp_state = TCPS_LISTEN; } else if (old_state > TCPS_BOUND) { tcp->tcp_conn_req_max = 0; DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_BOUND); tcp->tcp_state = TCPS_BOUND; } if (ltcp != NULL) CONN_DEC_REF(ltcp->tcp_connp); if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) { BUMP_MIB(&tcps->tcps_mib, tcpAttemptFails); } else if (old_state == TCPS_ESTABLISHED || old_state == TCPS_CLOSE_WAIT) { BUMP_MIB(&tcps->tcps_mib, tcpEstabResets); } if (tcp->tcp_fused) tcp_unfuse(tcp); mutex_enter(&tcp->tcp_eager_lock); if ((tcp->tcp_conn_req_cnt_q0 != 0) || (tcp->tcp_conn_req_cnt_q != 0)) { tcp_eager_cleanup(tcp, 0); } mutex_exit(&tcp->tcp_eager_lock); tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_RST | TH_ACK); tcp_reinit(tcp); if (old_state >= TCPS_ESTABLISHED) { /* Send M_FLUSH according to TPI */ (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); } mp = mi_tpi_ok_ack_alloc(mp); if (mp) putnext(tcp->tcp_rq, mp); return; } else if (!tcp_eager_blowoff(tcp, seqnum)) { tcp_err_ack(tcp, mp, TBADSEQ, 0); return; } if (tcp->tcp_state >= TCPS_ESTABLISHED) { /* Send M_FLUSH according to TPI */ (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); } mp = mi_tpi_ok_ack_alloc(mp); if (mp) putnext(tcp->tcp_rq, mp); } /* * Diagnostic routine used to return a string associated with the tcp state. * Note that if the caller does not supply a buffer, it will use an internal * static string. This means that if multiple threads call this function at * the same time, output can be corrupted... Note also that this function * does not check the size of the supplied buffer. The caller has to make * sure that it is big enough. */ static char * tcp_display(tcp_t *tcp, char *sup_buf, char format) { char buf1[30]; static char priv_buf[INET6_ADDRSTRLEN * 2 + 80]; char *buf; char *cp; in6_addr_t local, remote; char local_addrbuf[INET6_ADDRSTRLEN]; char remote_addrbuf[INET6_ADDRSTRLEN]; if (sup_buf != NULL) buf = sup_buf; else buf = priv_buf; if (tcp == NULL) return ("NULL_TCP"); switch (tcp->tcp_state) { case TCPS_CLOSED: cp = "TCP_CLOSED"; break; case TCPS_IDLE: cp = "TCP_IDLE"; break; case TCPS_BOUND: cp = "TCP_BOUND"; break; case TCPS_LISTEN: cp = "TCP_LISTEN"; break; case TCPS_SYN_SENT: cp = "TCP_SYN_SENT"; break; case TCPS_SYN_RCVD: cp = "TCP_SYN_RCVD"; break; case TCPS_ESTABLISHED: cp = "TCP_ESTABLISHED"; break; case TCPS_CLOSE_WAIT: cp = "TCP_CLOSE_WAIT"; break; case TCPS_FIN_WAIT_1: cp = "TCP_FIN_WAIT_1"; break; case TCPS_CLOSING: cp = "TCP_CLOSING"; break; case TCPS_LAST_ACK: cp = "TCP_LAST_ACK"; break; case TCPS_FIN_WAIT_2: cp = "TCP_FIN_WAIT_2"; break; case TCPS_TIME_WAIT: cp = "TCP_TIME_WAIT"; break; default: (void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state); cp = buf1; break; } switch (format) { case DISP_ADDR_AND_PORT: if (tcp->tcp_ipversion == IPV4_VERSION) { /* * Note that we use the remote address in the tcp_b * structure. This means that it will print out * the real destination address, not the next hop's * address if source routing is used. */ IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ip_src, &local); IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &remote); } else { local = tcp->tcp_ip_src_v6; remote = tcp->tcp_remote_v6; } (void) inet_ntop(AF_INET6, &local, local_addrbuf, sizeof (local_addrbuf)); (void) inet_ntop(AF_INET6, &remote, remote_addrbuf, sizeof (remote_addrbuf)); (void) mi_sprintf(buf, "[%s.%u, %s.%u] %s", local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf, ntohs(tcp->tcp_fport), cp); break; case DISP_PORT_ONLY: default: (void) mi_sprintf(buf, "[%u, %u] %s", ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp); break; } return (buf); } /* * Called via squeue to get on to eager's perimeter. It sends a * TH_RST if eager is in the fanout table. The listener wants the * eager to disappear either by means of tcp_eager_blowoff() or * tcp_eager_cleanup() being called. tcp_eager_kill() can also be * called (via squeue) if the eager cannot be inserted in the * fanout table in tcp_conn_request(). */ /* ARGSUSED */ void tcp_eager_kill(void *arg, mblk_t *mp, void *arg2) { conn_t *econnp = (conn_t *)arg; tcp_t *eager = econnp->conn_tcp; tcp_t *listener = eager->tcp_listener; tcp_stack_t *tcps = eager->tcp_tcps; /* * We could be called because listener is closing. Since * the eager is using listener's queue's, its not safe. * Better use the default queue just to send the TH_RST * out. */ ASSERT(tcps->tcps_g_q != NULL); eager->tcp_rq = tcps->tcps_g_q; eager->tcp_wq = WR(tcps->tcps_g_q); /* * An eager's conn_fanout will be NULL if it's a duplicate * for an existing 4-tuples in the conn fanout table. * We don't want to send an RST out in such case. */ if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) { tcp_xmit_ctl("tcp_eager_kill, can't wait", eager, eager->tcp_snxt, 0, TH_RST); } /* We are here because listener wants this eager gone */ if (listener != NULL) { mutex_enter(&listener->tcp_eager_lock); tcp_eager_unlink(eager); if (eager->tcp_tconnind_started) { /* * The eager has sent a conn_ind up to the * listener but listener decides to close * instead. We need to drop the extra ref * placed on eager in tcp_rput_data() before * sending the conn_ind to listener. */ CONN_DEC_REF(econnp); } mutex_exit(&listener->tcp_eager_lock); CONN_DEC_REF(listener->tcp_connp); } if (eager->tcp_state > TCPS_BOUND) tcp_close_detached(eager); } /* * Reset any eager connection hanging off this listener marked * with 'seqnum' and then reclaim it's resources. */ static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) { tcp_t *eager; mblk_t *mp; tcp_stack_t *tcps = listener->tcp_tcps; TCP_STAT(tcps, tcp_eager_blowoff_calls); eager = listener; mutex_enter(&listener->tcp_eager_lock); do { eager = eager->tcp_eager_next_q; if (eager == NULL) { mutex_exit(&listener->tcp_eager_lock); return (B_FALSE); } } while (eager->tcp_conn_req_seqnum != seqnum); if (eager->tcp_closemp_used) { mutex_exit(&listener->tcp_eager_lock); return (B_TRUE); } eager->tcp_closemp_used = B_TRUE; TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); CONN_INC_REF(eager->tcp_connp); mutex_exit(&listener->tcp_eager_lock); mp = &eager->tcp_closemp; squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, eager->tcp_connp, SQTAG_TCP_EAGER_BLOWOFF); return (B_TRUE); } /* * Reset any eager connection hanging off this listener * and then reclaim it's resources. */ static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) { tcp_t *eager; mblk_t *mp; tcp_stack_t *tcps = listener->tcp_tcps; ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); if (!q0_only) { /* First cleanup q */ TCP_STAT(tcps, tcp_eager_blowoff_q); eager = listener->tcp_eager_next_q; while (eager != NULL) { if (!eager->tcp_closemp_used) { eager->tcp_closemp_used = B_TRUE; TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); CONN_INC_REF(eager->tcp_connp); mp = &eager->tcp_closemp; squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, eager->tcp_connp, SQTAG_TCP_EAGER_CLEANUP); } eager = eager->tcp_eager_next_q; } } /* Then cleanup q0 */ TCP_STAT(tcps, tcp_eager_blowoff_q0); eager = listener->tcp_eager_next_q0; while (eager != listener) { if (!eager->tcp_closemp_used) { eager->tcp_closemp_used = B_TRUE; TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); CONN_INC_REF(eager->tcp_connp); mp = &eager->tcp_closemp; squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, eager->tcp_connp, SQTAG_TCP_EAGER_CLEANUP_Q0); } eager = eager->tcp_eager_next_q0; } } /* * If we are an eager connection hanging off a listener that hasn't * formally accepted the connection yet, get off his list and blow off * any data that we have accumulated. */ static void tcp_eager_unlink(tcp_t *tcp) { tcp_t *listener = tcp->tcp_listener; ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); ASSERT(listener != NULL); if (tcp->tcp_eager_next_q0 != NULL) { ASSERT(tcp->tcp_eager_prev_q0 != NULL); /* Remove the eager tcp from q0 */ tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = tcp->tcp_eager_prev_q0; tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; ASSERT(listener->tcp_conn_req_cnt_q0 > 0); listener->tcp_conn_req_cnt_q0--; tcp->tcp_eager_next_q0 = NULL; tcp->tcp_eager_prev_q0 = NULL; /* * Take the eager out, if it is in the list of droppable * eagers. */ MAKE_UNDROPPABLE(tcp); if (tcp->tcp_syn_rcvd_timeout != 0) { /* we have timed out before */ ASSERT(listener->tcp_syn_rcvd_timeout > 0); listener->tcp_syn_rcvd_timeout--; } } else { tcp_t **tcpp = &listener->tcp_eager_next_q; tcp_t *prev = NULL; for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { if (tcpp[0] == tcp) { if (listener->tcp_eager_last_q == tcp) { /* * If we are unlinking the last * element on the list, adjust * tail pointer. Set tail pointer * to nil when list is empty. */ ASSERT(tcp->tcp_eager_next_q == NULL); if (listener->tcp_eager_last_q == listener->tcp_eager_next_q) { listener->tcp_eager_last_q = NULL; } else { /* * We won't get here if there * is only one eager in the * list. */ ASSERT(prev != NULL); listener->tcp_eager_last_q = prev; } } tcpp[0] = tcp->tcp_eager_next_q; tcp->tcp_eager_next_q = NULL; tcp->tcp_eager_last_q = NULL; ASSERT(listener->tcp_conn_req_cnt_q > 0); listener->tcp_conn_req_cnt_q--; break; } prev = tcpp[0]; } } tcp->tcp_listener = NULL; } /* Shorthand to generate and send TPI error acks to our client */ static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error) { if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) putnext(tcp->tcp_rq, mp); } /* Shorthand to generate and send TPI error acks to our client */ static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, int t_error, int sys_error) { struct T_error_ack *teackp; if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), M_PCPROTO, T_ERROR_ACK)) != NULL) { teackp = (struct T_error_ack *)mp->b_rptr; teackp->ERROR_prim = primitive; teackp->TLI_error = t_error; teackp->UNIX_error = sys_error; putnext(tcp->tcp_rq, mp); } } /* * Note: No locks are held when inspecting tcp_g_*epriv_ports * but instead the code relies on: * - the fact that the address of the array and its size never changes * - the atomic assignment of the elements of the array */ /* ARGSUSED */ static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { int i; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { if (tcps->tcps_g_epriv_ports[i] != 0) (void) mi_mpprintf(mp, "%d ", tcps->tcps_g_epriv_ports[i]); } return (0); } /* * Hold a lock while changing tcp_g_epriv_ports to prevent multiple * threads from changing it at the same time. */ /* ARGSUSED */ static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) { long new_value; int i; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; /* * Fail the request if the new value does not lie within the * port number limits. */ if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || new_value >= 65536) { return (EINVAL); } mutex_enter(&tcps->tcps_epriv_port_lock); /* Check if the value is already in the list */ for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { if (new_value == tcps->tcps_g_epriv_ports[i]) { mutex_exit(&tcps->tcps_epriv_port_lock); return (EEXIST); } } /* Find an empty slot */ for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { if (tcps->tcps_g_epriv_ports[i] == 0) break; } if (i == tcps->tcps_g_num_epriv_ports) { mutex_exit(&tcps->tcps_epriv_port_lock); return (EOVERFLOW); } /* Set the new value */ tcps->tcps_g_epriv_ports[i] = (uint16_t)new_value; mutex_exit(&tcps->tcps_epriv_port_lock); return (0); } /* * Hold a lock while changing tcp_g_epriv_ports to prevent multiple * threads from changing it at the same time. */ /* ARGSUSED */ static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) { long new_value; int i; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; /* * Fail the request if the new value does not lie within the * port number limits. */ if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || new_value >= 65536) { return (EINVAL); } mutex_enter(&tcps->tcps_epriv_port_lock); /* Check that the value is already in the list */ for (i = 0; i < tcps->tcps_g_num_epriv_ports; i++) { if (tcps->tcps_g_epriv_ports[i] == new_value) break; } if (i == tcps->tcps_g_num_epriv_ports) { mutex_exit(&tcps->tcps_epriv_port_lock); return (ESRCH); } /* Clear the value */ tcps->tcps_g_epriv_ports[i] = 0; mutex_exit(&tcps->tcps_epriv_port_lock); return (0); } /* Return the TPI/TLI equivalent of our current tcp_state */ static int tcp_tpistate(tcp_t *tcp) { switch (tcp->tcp_state) { case TCPS_IDLE: return (TS_UNBND); case TCPS_LISTEN: /* * Return whether there are outstanding T_CONN_IND waiting * for the matching T_CONN_RES. Therefore don't count q0. */ if (tcp->tcp_conn_req_cnt_q > 0) return (TS_WRES_CIND); else return (TS_IDLE); case TCPS_BOUND: return (TS_IDLE); case TCPS_SYN_SENT: return (TS_WCON_CREQ); case TCPS_SYN_RCVD: /* * Note: assumption: this has to the active open SYN_RCVD. * The passive instance is detached in SYN_RCVD stage of * incoming connection processing so we cannot get request * for T_info_ack on it. */ return (TS_WACK_CRES); case TCPS_ESTABLISHED: return (TS_DATA_XFER); case TCPS_CLOSE_WAIT: return (TS_WREQ_ORDREL); case TCPS_FIN_WAIT_1: return (TS_WIND_ORDREL); case TCPS_FIN_WAIT_2: return (TS_WIND_ORDREL); case TCPS_CLOSING: case TCPS_LAST_ACK: case TCPS_TIME_WAIT: case TCPS_CLOSED: /* * Following TS_WACK_DREQ7 is a rendition of "not * yet TS_IDLE" TPI state. There is no best match to any * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we * choose a value chosen that will map to TLI/XTI level * state of TSTATECHNG (state is process of changing) which * captures what this dummy state represents. */ return (TS_WACK_DREQ7); default: cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s", tcp->tcp_state, tcp_display(tcp, NULL, DISP_PORT_ONLY)); return (TS_UNBND); } } static void tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp) { tcp_stack_t *tcps = tcp->tcp_tcps; if (tcp->tcp_family == AF_INET6) *tia = tcp_g_t_info_ack_v6; else *tia = tcp_g_t_info_ack; tia->CURRENT_state = tcp_tpistate(tcp); tia->OPT_size = tcp_max_optsize; if (tcp->tcp_mss == 0) { /* Not yet set - tcp_open does not set mss */ if (tcp->tcp_ipversion == IPV4_VERSION) tia->TIDU_size = tcps->tcps_mss_def_ipv4; else tia->TIDU_size = tcps->tcps_mss_def_ipv6; } else { tia->TIDU_size = tcp->tcp_mss; } /* TODO: Default ETSDU is 1. Is that correct for tcp? */ } /* * This routine responds to T_CAPABILITY_REQ messages. It is called by * tcp_wput. Much of the T_CAPABILITY_ACK information is copied from * tcp_g_t_info_ack. The current state of the stream is copied from * tcp_state. */ static void tcp_capability_req(tcp_t *tcp, mblk_t *mp) { t_uscalar_t cap_bits1; struct T_capability_ack *tcap; if (MBLKL(mp) < sizeof (struct T_capability_req)) { freemsg(mp); return; } cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), mp->b_datap->db_type, T_CAPABILITY_ACK); if (mp == NULL) return; tcap = (struct T_capability_ack *)mp->b_rptr; tcap->CAP_bits1 = 0; if (cap_bits1 & TC1_INFO) { tcp_copy_info(&tcap->INFO_ack, tcp); tcap->CAP_bits1 |= TC1_INFO; } if (cap_bits1 & TC1_ACCEPTOR_ID) { tcap->ACCEPTOR_id = tcp->tcp_acceptor_id; tcap->CAP_bits1 |= TC1_ACCEPTOR_ID; } putnext(tcp->tcp_rq, mp); } /* * This routine responds to T_INFO_REQ messages. It is called by tcp_wput. * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack. * The current state of the stream is copied from tcp_state. */ static void tcp_info_req(tcp_t *tcp, mblk_t *mp) { mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, T_INFO_ACK); if (!mp) { tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp); putnext(tcp->tcp_rq, mp); } /* Respond to the TPI addr request */ static void tcp_addr_req(tcp_t *tcp, mblk_t *mp) { sin_t *sin; mblk_t *ackmp; struct T_addr_ack *taa; /* Make it large enough for worst case */ ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 2 * sizeof (sin6_t), 1); if (ackmp == NULL) { tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); return; } if (tcp->tcp_ipversion == IPV6_VERSION) { tcp_addr_req_ipv6(tcp, ackmp); return; } taa = (struct T_addr_ack *)ackmp->b_rptr; bzero(taa, sizeof (struct T_addr_ack)); ackmp->b_wptr = (uchar_t *)&taa[1]; taa->PRIM_type = T_ADDR_ACK; ackmp->b_datap->db_type = M_PCPROTO; /* * Note: Following code assumes 32 bit alignment of basic * data structures like sin_t and struct T_addr_ack. */ if (tcp->tcp_state >= TCPS_BOUND) { /* * Fill in local address */ taa->LOCADDR_length = sizeof (sin_t); taa->LOCADDR_offset = sizeof (*taa); sin = (sin_t *)&taa[1]; /* Fill zeroes and then intialize non-zero fields */ *sin = sin_null; sin->sin_family = AF_INET; sin->sin_addr.s_addr = tcp->tcp_ipha->ipha_src; sin->sin_port = *(uint16_t *)tcp->tcp_tcph->th_lport; ackmp->b_wptr = (uchar_t *)&sin[1]; if (tcp->tcp_state >= TCPS_SYN_RCVD) { /* * Fill in Remote address */ taa->REMADDR_length = sizeof (sin_t); taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + taa->LOCADDR_length); sin = (sin_t *)(ackmp->b_rptr + taa->REMADDR_offset); *sin = sin_null; sin->sin_family = AF_INET; sin->sin_addr.s_addr = tcp->tcp_remote; sin->sin_port = tcp->tcp_fport; ackmp->b_wptr = (uchar_t *)&sin[1]; } } putnext(tcp->tcp_rq, ackmp); } /* Assumes that tcp_addr_req gets enough space and alignment */ static void tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *ackmp) { sin6_t *sin6; struct T_addr_ack *taa; ASSERT(tcp->tcp_ipversion == IPV6_VERSION); ASSERT(OK_32PTR(ackmp->b_rptr)); ASSERT(ackmp->b_wptr - ackmp->b_rptr >= sizeof (struct T_addr_ack) + 2 * sizeof (sin6_t)); taa = (struct T_addr_ack *)ackmp->b_rptr; bzero(taa, sizeof (struct T_addr_ack)); ackmp->b_wptr = (uchar_t *)&taa[1]; taa->PRIM_type = T_ADDR_ACK; ackmp->b_datap->db_type = M_PCPROTO; /* * Note: Following code assumes 32 bit alignment of basic * data structures like sin6_t and struct T_addr_ack. */ if (tcp->tcp_state >= TCPS_BOUND) { /* * Fill in local address */ taa->LOCADDR_length = sizeof (sin6_t); taa->LOCADDR_offset = sizeof (*taa); sin6 = (sin6_t *)&taa[1]; *sin6 = sin6_null; sin6->sin6_family = AF_INET6; sin6->sin6_addr = tcp->tcp_ip6h->ip6_src; sin6->sin6_port = tcp->tcp_lport; ackmp->b_wptr = (uchar_t *)&sin6[1]; if (tcp->tcp_state >= TCPS_SYN_RCVD) { /* * Fill in Remote address */ taa->REMADDR_length = sizeof (sin6_t); taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + taa->LOCADDR_length); sin6 = (sin6_t *)(ackmp->b_rptr + taa->REMADDR_offset); *sin6 = sin6_null; sin6->sin6_family = AF_INET6; sin6->sin6_flowinfo = tcp->tcp_ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; sin6->sin6_addr = tcp->tcp_remote_v6; sin6->sin6_port = tcp->tcp_fport; ackmp->b_wptr = (uchar_t *)&sin6[1]; } } putnext(tcp->tcp_rq, ackmp); } /* * Handle reinitialization of a tcp structure. * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. */ static void tcp_reinit(tcp_t *tcp) { mblk_t *mp; int err; tcp_stack_t *tcps = tcp->tcp_tcps; TCP_STAT(tcps, tcp_reinit_calls); /* tcp_reinit should never be called for detached tcp_t's */ ASSERT(tcp->tcp_listener == NULL); ASSERT((tcp->tcp_family == AF_INET && tcp->tcp_ipversion == IPV4_VERSION) || (tcp->tcp_family == AF_INET6 && (tcp->tcp_ipversion == IPV4_VERSION || tcp->tcp_ipversion == IPV6_VERSION))); /* Cancel outstanding timers */ tcp_timers_stop(tcp); /* * Reset everything in the state vector, after updating global * MIB data from instance counters. */ UPDATE_MIB(&tcps->tcps_mib, tcpHCInSegs, tcp->tcp_ibsegs); tcp->tcp_ibsegs = 0; UPDATE_MIB(&tcps->tcps_mib, tcpHCOutSegs, tcp->tcp_obsegs); tcp->tcp_obsegs = 0; tcp_close_mpp(&tcp->tcp_xmit_head); if (tcp->tcp_snd_zcopy_aware) tcp_zcopy_notify(tcp); tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; mutex_enter(&tcp->tcp_non_sq_lock); if (tcp->tcp_flow_stopped && TCP_UNSENT_BYTES(tcp) <= tcp->tcp_xmit_lowater) { tcp_clrqfull(tcp); } mutex_exit(&tcp->tcp_non_sq_lock); tcp_close_mpp(&tcp->tcp_reass_head); tcp->tcp_reass_tail = NULL; if (tcp->tcp_rcv_list != NULL) { /* Free b_next chain */ tcp_close_mpp(&tcp->tcp_rcv_list); tcp->tcp_rcv_last_head = NULL; tcp->tcp_rcv_last_tail = NULL; tcp->tcp_rcv_cnt = 0; } tcp->tcp_rcv_last_tail = NULL; if ((mp = tcp->tcp_urp_mp) != NULL) { freemsg(mp); tcp->tcp_urp_mp = NULL; } if ((mp = tcp->tcp_urp_mark_mp) != NULL) { freemsg(mp); tcp->tcp_urp_mark_mp = NULL; } if (tcp->tcp_fused_sigurg_mp != NULL) { freeb(tcp->tcp_fused_sigurg_mp); tcp->tcp_fused_sigurg_mp = NULL; } /* * Following is a union with two members which are * identical types and size so the following cleanup * is enough. */ tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); CL_INET_DISCONNECT(tcp); /* * The connection can't be on the tcp_time_wait_head list * since it is not detached. */ ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); ASSERT(tcp->tcp_time_wait_expire == 0); if (tcp->tcp_kssl_pending) { tcp->tcp_kssl_pending = B_FALSE; /* Don't reset if the initialized by bind. */ if (tcp->tcp_kssl_ent != NULL) { kssl_release_ent(tcp->tcp_kssl_ent, NULL, KSSL_NO_PROXY); } } if (tcp->tcp_kssl_ctx != NULL) { kssl_release_ctx(tcp->tcp_kssl_ctx); tcp->tcp_kssl_ctx = NULL; } /* * Reset/preserve other values */ tcp_reinit_values(tcp); ipcl_hash_remove(tcp->tcp_connp); conn_delete_ire(tcp->tcp_connp, NULL); tcp_ipsec_cleanup(tcp); if (tcp->tcp_conn_req_max != 0) { /* * This is the case when a TLI program uses the same * transport end point to accept a connection. This * makes the TCP both a listener and acceptor. When * this connection is closed, we need to set the state * back to TCPS_LISTEN. Make sure that the eager list * is reinitialized. * * Note that this stream is still bound to the four * tuples of the previous connection in IP. If a new * SYN with different foreign address comes in, IP will * not find it and will send it to the global queue. In * the global queue, TCP will do a tcp_lookup_listener() * to find this stream. This works because this stream * is only removed from connected hash. * */ DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_LISTEN); tcp->tcp_state = TCPS_LISTEN; tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; tcp->tcp_eager_next_drop_q0 = tcp; tcp->tcp_eager_prev_drop_q0 = tcp; tcp->tcp_connp->conn_recv = tcp_conn_request; if (tcp->tcp_family == AF_INET6) { ASSERT(tcp->tcp_connp->conn_af_isv6); (void) ipcl_bind_insert_v6(tcp->tcp_connp, IPPROTO_TCP, &tcp->tcp_ip6h->ip6_src, tcp->tcp_lport); } else { ASSERT(!tcp->tcp_connp->conn_af_isv6); (void) ipcl_bind_insert(tcp->tcp_connp, IPPROTO_TCP, tcp->tcp_ipha->ipha_src, tcp->tcp_lport); } } else { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_BOUND); tcp->tcp_state = TCPS_BOUND; } /* * Initialize to default values * Can't fail since enough header template space already allocated * at open(). */ err = tcp_init_values(tcp); ASSERT(err == 0); /* Restore state in tcp_tcph */ bcopy(&tcp->tcp_lport, tcp->tcp_tcph->th_lport, TCP_PORT_LEN); if (tcp->tcp_ipversion == IPV4_VERSION) tcp->tcp_ipha->ipha_src = tcp->tcp_bound_source; else tcp->tcp_ip6h->ip6_src = tcp->tcp_bound_source_v6; /* * Copy of the src addr. in tcp_t is needed in tcp_t * since the lookup funcs can only lookup on tcp_t */ tcp->tcp_ip_src_v6 = tcp->tcp_bound_source_v6; ASSERT(tcp->tcp_ptpbhn != NULL); tcp->tcp_rq->q_hiwat = tcps->tcps_recv_hiwat; tcp->tcp_rwnd = tcps->tcps_recv_hiwat; tcp->tcp_mss = tcp->tcp_ipversion != IPV4_VERSION ? tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; } /* * Force values to zero that need be zero. * Do not touch values asociated with the BOUND or LISTEN state * since the connection will end up in that state after the reinit. * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t * structure! */ static void tcp_reinit_values(tcp) tcp_t *tcp; { tcp_stack_t *tcps = tcp->tcp_tcps; #ifndef lint #define DONTCARE(x) #define PRESERVE(x) #else #define DONTCARE(x) ((x) = (x)) #define PRESERVE(x) ((x) = (x)) #endif /* lint */ PRESERVE(tcp->tcp_bind_hash); PRESERVE(tcp->tcp_ptpbhn); PRESERVE(tcp->tcp_acceptor_hash); PRESERVE(tcp->tcp_ptpahn); /* Should be ASSERT NULL on these with new code! */ ASSERT(tcp->tcp_time_wait_next == NULL); ASSERT(tcp->tcp_time_wait_prev == NULL); ASSERT(tcp->tcp_time_wait_expire == 0); PRESERVE(tcp->tcp_state); PRESERVE(tcp->tcp_rq); PRESERVE(tcp->tcp_wq); ASSERT(tcp->tcp_xmit_head == NULL); ASSERT(tcp->tcp_xmit_last == NULL); ASSERT(tcp->tcp_unsent == 0); ASSERT(tcp->tcp_xmit_tail == NULL); ASSERT(tcp->tcp_xmit_tail_unsent == 0); tcp->tcp_snxt = 0; /* Displayed in mib */ tcp->tcp_suna = 0; /* Displayed in mib */ tcp->tcp_swnd = 0; DONTCARE(tcp->tcp_cwnd); /* Init in tcp_mss_set */ ASSERT(tcp->tcp_ibsegs == 0); ASSERT(tcp->tcp_obsegs == 0); if (tcp->tcp_iphc != NULL) { ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); } DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_hdr_len); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_ipha); DONTCARE(tcp->tcp_ip6h); DONTCARE(tcp->tcp_ip_hdr_len); DONTCARE(tcp->tcp_tcph); DONTCARE(tcp->tcp_tcp_hdr_len); /* Init in tcp_init_values */ tcp->tcp_valid_bits = 0; DONTCARE(tcp->tcp_xmit_hiwater); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ tcp->tcp_last_rcv_lbolt = 0; tcp->tcp_init_cwnd = 0; tcp->tcp_urp_last_valid = 0; tcp->tcp_hard_binding = 0; tcp->tcp_hard_bound = 0; PRESERVE(tcp->tcp_cred); PRESERVE(tcp->tcp_cpid); PRESERVE(tcp->tcp_open_time); PRESERVE(tcp->tcp_exclbind); tcp->tcp_fin_acked = 0; tcp->tcp_fin_rcvd = 0; tcp->tcp_fin_sent = 0; tcp->tcp_ordrel_done = 0; tcp->tcp_debug = 0; tcp->tcp_dontroute = 0; tcp->tcp_broadcast = 0; tcp->tcp_useloopback = 0; tcp->tcp_reuseaddr = 0; tcp->tcp_oobinline = 0; tcp->tcp_dgram_errind = 0; tcp->tcp_detached = 0; tcp->tcp_bind_pending = 0; tcp->tcp_unbind_pending = 0; tcp->tcp_deferred_clean_death = 0; tcp->tcp_snd_ws_ok = B_FALSE; tcp->tcp_snd_ts_ok = B_FALSE; tcp->tcp_linger = 0; tcp->tcp_ka_enabled = 0; tcp->tcp_zero_win_probe = 0; tcp->tcp_loopback = 0; tcp->tcp_localnet = 0; tcp->tcp_syn_defense = 0; tcp->tcp_set_timer = 0; tcp->tcp_active_open = 0; ASSERT(tcp->tcp_timeout == B_FALSE); tcp->tcp_rexmit = B_FALSE; tcp->tcp_xmit_zc_clean = B_FALSE; tcp->tcp_snd_sack_ok = B_FALSE; PRESERVE(tcp->tcp_recvdstaddr); tcp->tcp_hwcksum = B_FALSE; tcp->tcp_ire_ill_check_done = B_FALSE; DONTCARE(tcp->tcp_maxpsz); /* Init in tcp_init_values */ tcp->tcp_mdt = B_FALSE; tcp->tcp_mdt_hdr_head = 0; tcp->tcp_mdt_hdr_tail = 0; tcp->tcp_conn_def_q0 = 0; tcp->tcp_ip_forward_progress = B_FALSE; tcp->tcp_anon_priv_bind = 0; tcp->tcp_ecn_ok = B_FALSE; tcp->tcp_cwr = B_FALSE; tcp->tcp_ecn_echo_on = B_FALSE; if (tcp->tcp_sack_info != NULL) { if (tcp->tcp_notsack_list != NULL) { TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); } kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); tcp->tcp_sack_info = NULL; } tcp->tcp_rcv_ws = 0; tcp->tcp_snd_ws = 0; tcp->tcp_ts_recent = 0; tcp->tcp_rnxt = 0; /* Displayed in mib */ DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ tcp->tcp_if_mtu = 0; ASSERT(tcp->tcp_reass_head == NULL); ASSERT(tcp->tcp_reass_tail == NULL); tcp->tcp_cwnd_cnt = 0; ASSERT(tcp->tcp_rcv_list == NULL); ASSERT(tcp->tcp_rcv_last_head == NULL); ASSERT(tcp->tcp_rcv_last_tail == NULL); ASSERT(tcp->tcp_rcv_cnt == 0); DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_adapt_ire */ DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ tcp->tcp_csuna = 0; tcp->tcp_rto = 0; /* Displayed in MIB */ DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ tcp->tcp_rtt_update = 0; DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ tcp->tcp_rack = 0; /* Displayed in mib */ tcp->tcp_rack_cnt = 0; tcp->tcp_rack_cur_max = 0; tcp->tcp_rack_abs_max = 0; tcp->tcp_max_swnd = 0; ASSERT(tcp->tcp_listener == NULL); DONTCARE(tcp->tcp_xmit_lowater); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ ASSERT(tcp->tcp_conn_req_cnt_q == 0); ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); PRESERVE(tcp->tcp_conn_req_max); PRESERVE(tcp->tcp_conn_req_seqnum); DONTCARE(tcp->tcp_ip_hdr_len); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ tcp->tcp_lingertime = 0; DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ ASSERT(tcp->tcp_urp_mp == NULL); ASSERT(tcp->tcp_urp_mark_mp == NULL); ASSERT(tcp->tcp_fused_sigurg_mp == NULL); ASSERT(tcp->tcp_eager_next_q == NULL); ASSERT(tcp->tcp_eager_last_q == NULL); ASSERT((tcp->tcp_eager_next_q0 == NULL && tcp->tcp_eager_prev_q0 == NULL) || tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && tcp->tcp_eager_prev_drop_q0 == NULL) || tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); tcp->tcp_client_errno = 0; DONTCARE(tcp->tcp_sum); /* Init in tcp_init_values */ tcp->tcp_remote_v6 = ipv6_all_zeros; /* Displayed in MIB */ PRESERVE(tcp->tcp_bound_source_v6); tcp->tcp_last_sent_len = 0; tcp->tcp_dupack_cnt = 0; tcp->tcp_fport = 0; /* Displayed in MIB */ PRESERVE(tcp->tcp_lport); PRESERVE(tcp->tcp_acceptor_lockp); ASSERT(tcp->tcp_ordrelid == 0); PRESERVE(tcp->tcp_acceptor_id); DONTCARE(tcp->tcp_ipsec_overhead); /* * If tcp_tracing flag is ON (i.e. We have a trace buffer * in tcp structure and now tracing), Re-initialize all * members of tcp_traceinfo. */ if (tcp->tcp_tracebuf != NULL) { bzero(tcp->tcp_tracebuf, sizeof (tcptrch_t)); } PRESERVE(tcp->tcp_family); if (tcp->tcp_family == AF_INET6) { tcp->tcp_ipversion = IPV6_VERSION; tcp->tcp_mss = tcps->tcps_mss_def_ipv6; } else { tcp->tcp_ipversion = IPV4_VERSION; tcp->tcp_mss = tcps->tcps_mss_def_ipv4; } tcp->tcp_bound_if = 0; tcp->tcp_ipv6_recvancillary = 0; tcp->tcp_recvifindex = 0; tcp->tcp_recvhops = 0; tcp->tcp_closed = 0; tcp->tcp_cleandeathtag = 0; if (tcp->tcp_hopopts != NULL) { mi_free(tcp->tcp_hopopts); tcp->tcp_hopopts = NULL; tcp->tcp_hopoptslen = 0; } ASSERT(tcp->tcp_hopoptslen == 0); if (tcp->tcp_dstopts != NULL) { mi_free(tcp->tcp_dstopts); tcp->tcp_dstopts = NULL; tcp->tcp_dstoptslen = 0; } ASSERT(tcp->tcp_dstoptslen == 0); if (tcp->tcp_rtdstopts != NULL) { mi_free(tcp->tcp_rtdstopts); tcp->tcp_rtdstopts = NULL; tcp->tcp_rtdstoptslen = 0; } ASSERT(tcp->tcp_rtdstoptslen == 0); if (tcp->tcp_rthdr != NULL) { mi_free(tcp->tcp_rthdr); tcp->tcp_rthdr = NULL; tcp->tcp_rthdrlen = 0; } ASSERT(tcp->tcp_rthdrlen == 0); PRESERVE(tcp->tcp_drop_opt_ack_cnt); /* Reset fusion-related fields */ tcp->tcp_fused = B_FALSE; tcp->tcp_unfusable = B_FALSE; tcp->tcp_fused_sigurg = B_FALSE; tcp->tcp_direct_sockfs = B_FALSE; tcp->tcp_fuse_syncstr_stopped = B_FALSE; tcp->tcp_fuse_syncstr_plugged = B_FALSE; tcp->tcp_loopback_peer = NULL; tcp->tcp_fuse_rcv_hiwater = 0; tcp->tcp_fuse_rcv_unread_hiwater = 0; tcp->tcp_fuse_rcv_unread_cnt = 0; tcp->tcp_lso = B_FALSE; tcp->tcp_in_ack_unsent = 0; tcp->tcp_cork = B_FALSE; tcp->tcp_tconnind_started = B_FALSE; PRESERVE(tcp->tcp_squeue_bytes); ASSERT(tcp->tcp_kssl_ctx == NULL); ASSERT(!tcp->tcp_kssl_pending); PRESERVE(tcp->tcp_kssl_ent); /* Sodirect */ tcp->tcp_sodirect = NULL; tcp->tcp_closemp_used = B_FALSE; #ifdef DEBUG DONTCARE(tcp->tcmp_stk[0]); #endif #undef DONTCARE #undef PRESERVE } /* * Allocate necessary resources and initialize state vector. * Guaranteed not to fail so that when an error is returned, * the caller doesn't need to do any additional cleanup. */ int tcp_init(tcp_t *tcp, queue_t *q) { int err; tcp->tcp_rq = q; tcp->tcp_wq = WR(q); /* DTrace ignores this - it isn't a tcp:::state-change */ tcp->tcp_state = TCPS_IDLE; if ((err = tcp_init_values(tcp)) != 0) tcp_timers_stop(tcp); return (err); } static int tcp_init_values(tcp_t *tcp) { int err; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT((tcp->tcp_family == AF_INET && tcp->tcp_ipversion == IPV4_VERSION) || (tcp->tcp_family == AF_INET6 && (tcp->tcp_ipversion == IPV4_VERSION || tcp->tcp_ipversion == IPV6_VERSION))); /* * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO * will be close to tcp_rexmit_interval_initial. By doing this, we * allow the algorithm to adjust slowly to large fluctuations of RTT * during first few transmissions of a connection as seen in slow * links. */ tcp->tcp_rtt_sa = tcps->tcps_rexmit_interval_initial << 2; tcp->tcp_rtt_sd = tcps->tcps_rexmit_interval_initial >> 1; tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + tcps->tcps_conn_grace_period; if (tcp->tcp_rto < tcps->tcps_rexmit_interval_min) tcp->tcp_rto = tcps->tcps_rexmit_interval_min; tcp->tcp_timer_backoff = 0; tcp->tcp_ms_we_have_waited = 0; tcp->tcp_last_recv_time = lbolt; tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; tcp->tcp_snd_burst = TCP_CWND_INFINITE; tcp->tcp_maxpsz = tcps->tcps_maxpsz_multiplier; tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; tcp->tcp_first_ctimer_threshold = tcps->tcps_ip_notify_cinterval; tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; /* * Fix it to tcp_ip_abort_linterval later if it turns out to be a * passive open. */ tcp->tcp_second_ctimer_threshold = tcps->tcps_ip_abort_cinterval; tcp->tcp_naglim = tcps->tcps_naglim_def; /* NOTE: ISS is now set in tcp_adapt_ire(). */ tcp->tcp_mdt_hdr_head = 0; tcp->tcp_mdt_hdr_tail = 0; /* Reset fusion-related fields */ tcp->tcp_fused = B_FALSE; tcp->tcp_unfusable = B_FALSE; tcp->tcp_fused_sigurg = B_FALSE; tcp->tcp_direct_sockfs = B_FALSE; tcp->tcp_fuse_syncstr_stopped = B_FALSE; tcp->tcp_fuse_syncstr_plugged = B_FALSE; tcp->tcp_loopback_peer = NULL; tcp->tcp_fuse_rcv_hiwater = 0; tcp->tcp_fuse_rcv_unread_hiwater = 0; tcp->tcp_fuse_rcv_unread_cnt = 0; /* Sodirect */ tcp->tcp_sodirect = NULL; /* Initialize the header template */ if (tcp->tcp_ipversion == IPV4_VERSION) { err = tcp_header_init_ipv4(tcp); } else { err = tcp_header_init_ipv6(tcp); } if (err) return (err); /* * Init the window scale to the max so tcp_rwnd_set() won't pare * down tcp_rwnd. tcp_adapt_ire() will set the right value later. */ tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; tcp->tcp_xmit_lowater = tcps->tcps_xmit_lowat; tcp->tcp_xmit_hiwater = tcps->tcps_xmit_hiwat; tcp->tcp_cork = B_FALSE; /* * Init the tcp_debug option. This value determines whether TCP * calls strlog() to print out debug messages. Doing this * initialization here means that this value is not inherited thru * tcp_reinit(). */ tcp->tcp_debug = tcps->tcps_dbg; tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; return (0); } /* * Initialize the IPv4 header. Loses any record of any IP options. */ static int tcp_header_init_ipv4(tcp_t *tcp) { tcph_t *tcph; uint32_t sum; conn_t *connp; tcp_stack_t *tcps = tcp->tcp_tcps; /* * This is a simple initialization. If there's * already a template, it should never be too small, * so reuse it. Otherwise, allocate space for the new one. */ if (tcp->tcp_iphc == NULL) { ASSERT(tcp->tcp_iphc_len == 0); tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); if (tcp->tcp_iphc == NULL) { tcp->tcp_iphc_len = 0; return (ENOMEM); } } /* options are gone; may need a new label */ connp = tcp->tcp_connp; connp->conn_mlp_type = mlptSingle; connp->conn_ulp_labeled = !is_system_labeled(); ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; tcp->tcp_ip6h = NULL; tcp->tcp_ipversion = IPV4_VERSION; tcp->tcp_hdr_len = sizeof (ipha_t) + sizeof (tcph_t); tcp->tcp_tcp_hdr_len = sizeof (tcph_t); tcp->tcp_ip_hdr_len = sizeof (ipha_t); tcp->tcp_ipha->ipha_length = htons(sizeof (ipha_t) + sizeof (tcph_t)); tcp->tcp_ipha->ipha_version_and_hdr_length = (IP_VERSION << 4) | IP_SIMPLE_HDR_LENGTH_IN_WORDS; tcp->tcp_ipha->ipha_ident = 0; tcp->tcp_ttl = (uchar_t)tcps->tcps_ipv4_ttl; tcp->tcp_tos = 0; tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; tcp->tcp_ipha->ipha_ttl = (uchar_t)tcps->tcps_ipv4_ttl; tcp->tcp_ipha->ipha_protocol = IPPROTO_TCP; tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (ipha_t)); tcp->tcp_tcph = tcph; tcph->th_offset_and_rsrvd[0] = (5 << 4); /* * IP wants our header length in the checksum field to * allow it to perform a single pseudo-header+checksum * calculation on behalf of TCP. * Include the adjustment for a source route once IP_OPTIONS is set. */ sum = sizeof (tcph_t) + tcp->tcp_sum; sum = (sum >> 16) + (sum & 0xFFFF); U16_TO_ABE16(sum, tcph->th_sum); return (0); } /* * Initialize the IPv6 header. Loses any record of any IPv6 extension headers. */ static int tcp_header_init_ipv6(tcp_t *tcp) { tcph_t *tcph; uint32_t sum; conn_t *connp; tcp_stack_t *tcps = tcp->tcp_tcps; /* * This is a simple initialization. If there's * already a template, it should never be too small, * so reuse it. Otherwise, allocate space for the new one. * Ensure that there is enough space to "downgrade" the tcp_t * to an IPv4 tcp_t. This requires having space for a full load * of IPv4 options, as well as a full load of TCP options * (TCP_MAX_COMBINED_HEADER_LENGTH, 120 bytes); this is more space * than a v6 header and a TCP header with a full load of TCP options * (IPV6_HDR_LEN is 40 bytes; TCP_MAX_HDR_LENGTH is 60 bytes). * We want to avoid reallocation in the "downgraded" case when * processing outbound IPv4 options. */ if (tcp->tcp_iphc == NULL) { ASSERT(tcp->tcp_iphc_len == 0); tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); if (tcp->tcp_iphc == NULL) { tcp->tcp_iphc_len = 0; return (ENOMEM); } } /* options are gone; may need a new label */ connp = tcp->tcp_connp; connp->conn_mlp_type = mlptSingle; connp->conn_ulp_labeled = !is_system_labeled(); ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); tcp->tcp_ipversion = IPV6_VERSION; tcp->tcp_hdr_len = IPV6_HDR_LEN + sizeof (tcph_t); tcp->tcp_tcp_hdr_len = sizeof (tcph_t); tcp->tcp_ip_hdr_len = IPV6_HDR_LEN; tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; tcp->tcp_ipha = NULL; /* Initialize the header template */ tcp->tcp_ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW; tcp->tcp_ip6h->ip6_plen = ntohs(sizeof (tcph_t)); tcp->tcp_ip6h->ip6_nxt = IPPROTO_TCP; tcp->tcp_ip6h->ip6_hops = (uint8_t)tcps->tcps_ipv6_hoplimit; tcph = (tcph_t *)(tcp->tcp_iphc + IPV6_HDR_LEN); tcp->tcp_tcph = tcph; tcph->th_offset_and_rsrvd[0] = (5 << 4); /* * IP wants our header length in the checksum field to * allow it to perform a single psuedo-header+checksum * calculation on behalf of TCP. * Include the adjustment for a source route when IPV6_RTHDR is set. */ sum = sizeof (tcph_t) + tcp->tcp_sum; sum = (sum >> 16) + (sum & 0xFFFF); U16_TO_ABE16(sum, tcph->th_sum); return (0); } /* At minimum we need 8 bytes in the TCP header for the lookup */ #define ICMP_MIN_TCP_HDR 8 /* * tcp_icmp_error is called by tcp_rput_other to process ICMP error messages * passed up by IP. The message is always received on the correct tcp_t. * Assumes that IP has pulled up everything up to and including the ICMP header. */ void tcp_icmp_error(tcp_t *tcp, mblk_t *mp) { icmph_t *icmph; ipha_t *ipha; int iph_hdr_length; tcph_t *tcph; boolean_t ipsec_mctl = B_FALSE; boolean_t secure; mblk_t *first_mp = mp; uint32_t new_mss; uint32_t ratio; size_t mp_size = MBLKL(mp); uint32_t seg_seq; tcp_stack_t *tcps = tcp->tcp_tcps; /* Assume IP provides aligned packets - otherwise toss */ if (!OK_32PTR(mp->b_rptr)) { freemsg(mp); return; } /* * Since ICMP errors are normal data marked with M_CTL when sent * to TCP or UDP, we have to look for a IPSEC_IN value to identify * packets starting with an ipsec_info_t, see ipsec_info.h. */ if ((mp_size == sizeof (ipsec_info_t)) && (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == IPSEC_IN)) { ASSERT(mp->b_cont != NULL); mp = mp->b_cont; /* IP should have done this */ ASSERT(OK_32PTR(mp->b_rptr)); mp_size = MBLKL(mp); ipsec_mctl = B_TRUE; } /* * Verify that we have a complete outer IP header. If not, drop it. */ if (mp_size < sizeof (ipha_t)) { noticmpv4: freemsg(first_mp); return; } ipha = (ipha_t *)mp->b_rptr; /* * Verify IP version. Anything other than IPv4 or IPv6 packet is sent * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. */ switch (IPH_HDR_VERSION(ipha)) { case IPV6_VERSION: tcp_icmp_error_ipv6(tcp, first_mp, ipsec_mctl); return; case IPV4_VERSION: break; default: goto noticmpv4; } /* Skip past the outer IP and ICMP headers */ iph_hdr_length = IPH_HDR_LENGTH(ipha); icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; /* * If we don't have the correct outer IP header length or if the ULP * is not IPPROTO_ICMP or if we don't have a complete inner IP header * send it upstream. */ if (iph_hdr_length < sizeof (ipha_t) || ipha->ipha_protocol != IPPROTO_ICMP || (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { goto noticmpv4; } ipha = (ipha_t *)&icmph[1]; /* Skip past the inner IP and find the ULP header */ iph_hdr_length = IPH_HDR_LENGTH(ipha); tcph = (tcph_t *)((char *)ipha + iph_hdr_length); /* * If we don't have the correct inner IP header length or if the ULP * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR * bytes of TCP header, drop it. */ if (iph_hdr_length < sizeof (ipha_t) || ipha->ipha_protocol != IPPROTO_TCP || (uchar_t *)tcph + ICMP_MIN_TCP_HDR > mp->b_wptr) { goto noticmpv4; } if (TCP_IS_DETACHED_NONEAGER(tcp)) { if (ipsec_mctl) { secure = ipsec_in_is_secure(first_mp); } else { secure = B_FALSE; } if (secure) { /* * If we are willing to accept this in clear * we don't have to verify policy. */ if (!ipsec_inbound_accept_clear(mp, ipha, NULL)) { if (!tcp_check_policy(tcp, first_mp, ipha, NULL, secure, ipsec_mctl)) { /* * tcp_check_policy called * ip_drop_packet() on failure. */ return; } } } } else if (ipsec_mctl) { /* * This is a hard_bound connection. IP has already * verified policy. We don't have to do it again. */ freeb(first_mp); first_mp = mp; ipsec_mctl = B_FALSE; } seg_seq = ABE32_TO_U32(tcph->th_seq); /* * TCP SHOULD check that the TCP sequence number contained in * payload of the ICMP error message is within the range * SND.UNA <= SEG.SEQ < SND.NXT. */ if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt)) { /* * If the ICMP message is bogus, should we kill the * connection, or should we just drop the bogus ICMP * message? It would probably make more sense to just * drop the message so that if this one managed to get * in, the real connection should not suffer. */ goto noticmpv4; } switch (icmph->icmph_type) { case ICMP_DEST_UNREACHABLE: switch (icmph->icmph_code) { case ICMP_FRAGMENTATION_NEEDED: /* * Reduce the MSS based on the new MTU. This will * eliminate any fragmentation locally. * N.B. There may well be some funny side-effects on * the local send policy and the remote receive policy. * Pending further research, we provide * tcp_ignore_path_mtu just in case this proves * disastrous somewhere. * * After updating the MSS, retransmit part of the * dropped segment using the new mss by calling * tcp_wput_data(). Need to adjust all those * params to make sure tcp_wput_data() work properly. */ if (tcps->tcps_ignore_path_mtu) break; /* * Decrease the MSS by time stamp options * IP options and IPSEC options. tcp_hdr_len * includes time stamp option and IP option * length. */ new_mss = ntohs(icmph->icmph_du_mtu) - tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead; /* * Only update the MSS if the new one is * smaller than the previous one. This is * to avoid problems when getting multiple * ICMP errors for the same MTU. */ if (new_mss >= tcp->tcp_mss) break; /* * Stop doing PMTU if new_mss is less than 68 * or less than tcp_mss_min. * The value 68 comes from rfc 1191. */ if (new_mss < MAX(68, tcps->tcps_mss_min)) tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; ratio = tcp->tcp_cwnd / tcp->tcp_mss; ASSERT(ratio >= 1); tcp_mss_set(tcp, new_mss, B_TRUE); /* * Make sure we have something to * send. */ if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && (tcp->tcp_xmit_head != NULL)) { /* * Shrink tcp_cwnd in * proportion to the old MSS/new MSS. */ tcp->tcp_cwnd = ratio * tcp->tcp_mss; if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && (tcp->tcp_unsent == 0)) { tcp->tcp_rexmit_max = tcp->tcp_fss; } else { tcp->tcp_rexmit_max = tcp->tcp_snxt; } tcp->tcp_rexmit_nxt = tcp->tcp_suna; tcp->tcp_rexmit = B_TRUE; tcp->tcp_dupack_cnt = 0; tcp->tcp_snd_burst = TCP_CWND_SS; tcp_ss_rexmit(tcp); } break; case ICMP_PORT_UNREACHABLE: case ICMP_PROTOCOL_UNREACHABLE: switch (tcp->tcp_state) { case TCPS_SYN_SENT: case TCPS_SYN_RCVD: /* * ICMP can snipe away incipient * TCP connections as long as * seq number is same as initial * send seq number. */ if (seg_seq == tcp->tcp_iss) { (void) tcp_clean_death(tcp, ECONNREFUSED, 6); } break; } break; case ICMP_HOST_UNREACHABLE: case ICMP_NET_UNREACHABLE: /* Record the error in case we finally time out. */ if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) tcp->tcp_client_errno = EHOSTUNREACH; else tcp->tcp_client_errno = ENETUNREACH; if (tcp->tcp_state == TCPS_SYN_RCVD) { if (tcp->tcp_listener != NULL && tcp->tcp_listener->tcp_syn_defense) { /* * Ditch the half-open connection if we * suspect a SYN attack is under way. */ tcp_ip_ire_mark_advice(tcp); (void) tcp_clean_death(tcp, tcp->tcp_client_errno, 7); } } break; default: break; } break; case ICMP_SOURCE_QUENCH: { /* * use a global boolean to control * whether TCP should respond to ICMP_SOURCE_QUENCH. * The default is false. */ if (tcp_icmp_source_quench) { /* * Reduce the sending rate as if we got a * retransmit timeout */ uint32_t npkt; npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / tcp->tcp_mss; tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; tcp->tcp_cwnd = tcp->tcp_mss; tcp->tcp_cwnd_cnt = 0; } break; } } freemsg(first_mp); } /* * tcp_icmp_error_ipv6 is called by tcp_rput_other to process ICMPv6 * error messages passed up by IP. * Assumes that IP has pulled up all the extension headers as well * as the ICMPv6 header. */ static void tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl) { icmp6_t *icmp6; ip6_t *ip6h; uint16_t iph_hdr_length; tcpha_t *tcpha; uint8_t *nexthdrp; uint32_t new_mss; uint32_t ratio; boolean_t secure; mblk_t *first_mp = mp; size_t mp_size; uint32_t seg_seq; tcp_stack_t *tcps = tcp->tcp_tcps; /* * The caller has determined if this is an IPSEC_IN packet and * set ipsec_mctl appropriately (see tcp_icmp_error). */ if (ipsec_mctl) mp = mp->b_cont; mp_size = MBLKL(mp); /* * Verify that we have a complete IP header. If not, send it upstream. */ if (mp_size < sizeof (ip6_t)) { noticmpv6: freemsg(first_mp); return; } /* * Verify this is an ICMPV6 packet, else send it upstream. */ ip6h = (ip6_t *)mp->b_rptr; if (ip6h->ip6_nxt == IPPROTO_ICMPV6) { iph_hdr_length = IPV6_HDR_LEN; } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp) || *nexthdrp != IPPROTO_ICMPV6) { goto noticmpv6; } icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; ip6h = (ip6_t *)&icmp6[1]; /* * Verify if we have a complete ICMP and inner IP header. */ if ((uchar_t *)&ip6h[1] > mp->b_wptr) goto noticmpv6; if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) goto noticmpv6; tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); /* * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the * packet. */ if ((*nexthdrp != IPPROTO_TCP) || ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { goto noticmpv6; } /* * ICMP errors come on the right queue or come on * listener/global queue for detached connections and * get switched to the right queue. If it comes on the * right queue, policy check has already been done by IP * and thus free the first_mp without verifying the policy. * If it has come for a non-hard bound connection, we need * to verify policy as IP may not have done it. */ if (!tcp->tcp_hard_bound) { if (ipsec_mctl) { secure = ipsec_in_is_secure(first_mp); } else { secure = B_FALSE; } if (secure) { /* * If we are willing to accept this in clear * we don't have to verify policy. */ if (!ipsec_inbound_accept_clear(mp, NULL, ip6h)) { if (!tcp_check_policy(tcp, first_mp, NULL, ip6h, secure, ipsec_mctl)) { /* * tcp_check_policy called * ip_drop_packet() on failure. */ return; } } } } else if (ipsec_mctl) { /* * This is a hard_bound connection. IP has already * verified policy. We don't have to do it again. */ freeb(first_mp); first_mp = mp; ipsec_mctl = B_FALSE; } seg_seq = ntohl(tcpha->tha_seq); /* * TCP SHOULD check that the TCP sequence number contained in * payload of the ICMP error message is within the range * SND.UNA <= SEG.SEQ < SND.NXT. */ if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt)) { /* * If the ICMP message is bogus, should we kill the * connection, or should we just drop the bogus ICMP * message? It would probably make more sense to just * drop the message so that if this one managed to get * in, the real connection should not suffer. */ goto noticmpv6; } switch (icmp6->icmp6_type) { case ICMP6_PACKET_TOO_BIG: /* * Reduce the MSS based on the new MTU. This will * eliminate any fragmentation locally. * N.B. There may well be some funny side-effects on * the local send policy and the remote receive policy. * Pending further research, we provide * tcp_ignore_path_mtu just in case this proves * disastrous somewhere. * * After updating the MSS, retransmit part of the * dropped segment using the new mss by calling * tcp_wput_data(). Need to adjust all those * params to make sure tcp_wput_data() work properly. */ if (tcps->tcps_ignore_path_mtu) break; /* * Decrease the MSS by time stamp options * IP options and IPSEC options. tcp_hdr_len * includes time stamp option and IP option * length. */ new_mss = ntohs(icmp6->icmp6_mtu) - tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead; /* * Only update the MSS if the new one is * smaller than the previous one. This is * to avoid problems when getting multiple * ICMP errors for the same MTU. */ if (new_mss >= tcp->tcp_mss) break; ratio = tcp->tcp_cwnd / tcp->tcp_mss; ASSERT(ratio >= 1); tcp_mss_set(tcp, new_mss, B_TRUE); /* * Make sure we have something to * send. */ if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && (tcp->tcp_xmit_head != NULL)) { /* * Shrink tcp_cwnd in * proportion to the old MSS/new MSS. */ tcp->tcp_cwnd = ratio * tcp->tcp_mss; if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && (tcp->tcp_unsent == 0)) { tcp->tcp_rexmit_max = tcp->tcp_fss; } else { tcp->tcp_rexmit_max = tcp->tcp_snxt; } tcp->tcp_rexmit_nxt = tcp->tcp_suna; tcp->tcp_rexmit = B_TRUE; tcp->tcp_dupack_cnt = 0; tcp->tcp_snd_burst = TCP_CWND_SS; tcp_ss_rexmit(tcp); } break; case ICMP6_DST_UNREACH: switch (icmp6->icmp6_code) { case ICMP6_DST_UNREACH_NOPORT: if (((tcp->tcp_state == TCPS_SYN_SENT) || (tcp->tcp_state == TCPS_SYN_RCVD)) && (seg_seq == tcp->tcp_iss)) { (void) tcp_clean_death(tcp, ECONNREFUSED, 8); } break; case ICMP6_DST_UNREACH_ADMIN: case ICMP6_DST_UNREACH_NOROUTE: case ICMP6_DST_UNREACH_BEYONDSCOPE: case ICMP6_DST_UNREACH_ADDR: /* Record the error in case we finally time out. */ tcp->tcp_client_errno = EHOSTUNREACH; if (((tcp->tcp_state == TCPS_SYN_SENT) || (tcp->tcp_state == TCPS_SYN_RCVD)) && (seg_seq == tcp->tcp_iss)) { if (tcp->tcp_listener != NULL && tcp->tcp_listener->tcp_syn_defense) { /* * Ditch the half-open connection if we * suspect a SYN attack is under way. */ tcp_ip_ire_mark_advice(tcp); (void) tcp_clean_death(tcp, tcp->tcp_client_errno, 9); } } break; default: break; } break; case ICMP6_PARAM_PROB: /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && (uchar_t *)ip6h + icmp6->icmp6_pptr == (uchar_t *)nexthdrp) { if (tcp->tcp_state == TCPS_SYN_SENT || tcp->tcp_state == TCPS_SYN_RCVD) { (void) tcp_clean_death(tcp, ECONNREFUSED, 10); } break; } break; case ICMP6_TIME_EXCEEDED: default: break; } freemsg(first_mp); } /* * IP recognizes seven kinds of bind requests: * * - A zero-length address binds only to the protocol number. * * - A 4-byte address is treated as a request to * validate that the address is a valid local IPv4 * address, appropriate for an application to bind to. * IP does the verification, but does not make any note * of the address at this time. * * - A 16-byte address contains is treated as a request * to validate a local IPv6 address, as the 4-byte * address case above. * * - A 16-byte sockaddr_in to validate the local IPv4 address and also * use it for the inbound fanout of packets. * * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also * use it for the inbound fanout of packets. * * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout * information consisting of local and remote addresses * and ports. In this case, the addresses are both * validated as appropriate for this operation, and, if * so, the information is retained for use in the * inbound fanout. * * - A 36-byte address address (ipa6_conn_t) containing complete IPv6 * fanout information, like the 12-byte case above. * * IP will also fill in the IRE request mblk with information * regarding our peer. In all cases, we notify IP of our protocol * type by appending a single protocol byte to the bind request. */ static mblk_t * tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length) { char *cp; mblk_t *mp; struct T_bind_req *tbr; ipa_conn_t *ac; ipa6_conn_t *ac6; sin_t *sin; sin6_t *sin6; ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ); ASSERT((tcp->tcp_family == AF_INET && tcp->tcp_ipversion == IPV4_VERSION) || (tcp->tcp_family == AF_INET6 && (tcp->tcp_ipversion == IPV4_VERSION || tcp->tcp_ipversion == IPV6_VERSION))); mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI); if (!mp) return (mp); mp->b_datap->db_type = M_PROTO; tbr = (struct T_bind_req *)mp->b_rptr; tbr->PRIM_type = bind_prim; tbr->ADDR_offset = sizeof (*tbr); tbr->CONIND_number = 0; tbr->ADDR_length = addr_length; cp = (char *)&tbr[1]; switch (addr_length) { case sizeof (ipa_conn_t): ASSERT(tcp->tcp_family == AF_INET); ASSERT(tcp->tcp_ipversion == IPV4_VERSION); mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); if (mp->b_cont == NULL) { freemsg(mp); return (NULL); } mp->b_cont->b_wptr += sizeof (ire_t); mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; /* cp known to be 32 bit aligned */ ac = (ipa_conn_t *)cp; ac->ac_laddr = tcp->tcp_ipha->ipha_src; ac->ac_faddr = tcp->tcp_remote; ac->ac_fport = tcp->tcp_fport; ac->ac_lport = tcp->tcp_lport; tcp->tcp_hard_binding = 1; break; case sizeof (ipa6_conn_t): ASSERT(tcp->tcp_family == AF_INET6); mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); if (mp->b_cont == NULL) { freemsg(mp); return (NULL); } mp->b_cont->b_wptr += sizeof (ire_t); mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; /* cp known to be 32 bit aligned */ ac6 = (ipa6_conn_t *)cp; if (tcp->tcp_ipversion == IPV4_VERSION) { IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &ac6->ac6_laddr); } else { ac6->ac6_laddr = tcp->tcp_ip6h->ip6_src; } ac6->ac6_faddr = tcp->tcp_remote_v6; ac6->ac6_fport = tcp->tcp_fport; ac6->ac6_lport = tcp->tcp_lport; tcp->tcp_hard_binding = 1; break; case sizeof (sin_t): /* * NOTE: IPV6_ADDR_LEN also has same size. * Use family to discriminate. */ if (tcp->tcp_family == AF_INET) { sin = (sin_t *)cp; *sin = sin_null; sin->sin_family = AF_INET; sin->sin_addr.s_addr = tcp->tcp_bound_source; sin->sin_port = tcp->tcp_lport; break; } else { *(in6_addr_t *)cp = tcp->tcp_bound_source_v6; } break; case sizeof (sin6_t): ASSERT(tcp->tcp_family == AF_INET6); sin6 = (sin6_t *)cp; *sin6 = sin6_null; sin6->sin6_family = AF_INET6; sin6->sin6_addr = tcp->tcp_bound_source_v6; sin6->sin6_port = tcp->tcp_lport; break; case IP_ADDR_LEN: ASSERT(tcp->tcp_ipversion == IPV4_VERSION); *(uint32_t *)cp = tcp->tcp_ipha->ipha_src; break; } /* Add protocol number to end */ cp[addr_length] = (char)IPPROTO_TCP; mp->b_wptr = (uchar_t *)&cp[addr_length + 1]; return (mp); } /* * Notify IP that we are having trouble with this connection. IP should * blow the IRE away and start over. */ static void tcp_ip_notify(tcp_t *tcp) { struct iocblk *iocp; ipid_t *ipid; mblk_t *mp; /* IPv6 has NUD thus notification to delete the IRE is not needed */ if (tcp->tcp_ipversion == IPV6_VERSION) return; mp = mkiocb(IP_IOCTL); if (mp == NULL) return; iocp = (struct iocblk *)mp->b_rptr; iocp->ioc_count = sizeof (ipid_t) + sizeof (tcp->tcp_ipha->ipha_dst); mp->b_cont = allocb(iocp->ioc_count, BPRI_HI); if (!mp->b_cont) { freeb(mp); return; } ipid = (ipid_t *)mp->b_cont->b_rptr; mp->b_cont->b_wptr += iocp->ioc_count; bzero(ipid, sizeof (*ipid)); ipid->ipid_cmd = IP_IOC_IRE_DELETE_NO_REPLY; ipid->ipid_ire_type = IRE_CACHE; ipid->ipid_addr_offset = sizeof (ipid_t); ipid->ipid_addr_length = sizeof (tcp->tcp_ipha->ipha_dst); /* * Note: in the case of source routing we want to blow away the * route to the first source route hop. */ bcopy(&tcp->tcp_ipha->ipha_dst, &ipid[1], sizeof (tcp->tcp_ipha->ipha_dst)); CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); } /* Unlink and return any mblk that looks like it contains an ire */ static mblk_t * tcp_ire_mp(mblk_t *mp) { mblk_t *prev_mp; for (;;) { prev_mp = mp; mp = mp->b_cont; if (mp == NULL) break; switch (DB_TYPE(mp)) { case IRE_DB_TYPE: case IRE_DB_REQ_TYPE: if (prev_mp != NULL) prev_mp->b_cont = mp->b_cont; mp->b_cont = NULL; return (mp); default: break; } } return (mp); } /* * Timer callback routine for keepalive probe. We do a fake resend of * last ACKed byte. Then set a timer using RTO. When the timer expires, * check to see if we have heard anything from the other end for the last * RTO period. If we have, set the timer to expire for another * tcp_keepalive_intrvl and check again. If we have not, set a timer using * RTO << 1 and check again when it expires. Keep exponentially increasing * the timeout if we have not heard from the other side. If for more than * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything, * kill the connection unless the keepalive abort threshold is 0. In * that case, we will probe "forever." */ static void tcp_keepalive_killer(void *arg) { mblk_t *mp; conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; int32_t firetime; int32_t idletime; int32_t ka_intrvl; tcp_stack_t *tcps = tcp->tcp_tcps; tcp->tcp_ka_tid = 0; if (tcp->tcp_fused) return; BUMP_MIB(&tcps->tcps_mib, tcpTimKeepalive); ka_intrvl = tcp->tcp_ka_interval; /* * Keepalive probe should only be sent if the application has not * done a close on the connection. */ if (tcp->tcp_state > TCPS_CLOSE_WAIT) { return; } /* Timer fired too early, restart it. */ if (tcp->tcp_state < TCPS_ESTABLISHED) { tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, MSEC_TO_TICK(ka_intrvl)); return; } idletime = TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time); /* * If we have not heard from the other side for a long * time, kill the connection unless the keepalive abort * threshold is 0. In that case, we will probe "forever." */ if (tcp->tcp_ka_abort_thres != 0 && idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) { BUMP_MIB(&tcps->tcps_mib, tcpTimKeepaliveDrop); (void) tcp_clean_death(tcp, tcp->tcp_client_errno ? tcp->tcp_client_errno : ETIMEDOUT, 11); return; } if (tcp->tcp_snxt == tcp->tcp_suna && idletime >= ka_intrvl) { /* Fake resend of last ACKed byte. */ mblk_t *mp1 = allocb(1, BPRI_LO); if (mp1 != NULL) { *mp1->b_wptr++ = '\0'; mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL, tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE); freeb(mp1); /* * if allocation failed, fall through to start the * timer back. */ if (mp != NULL) { TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, mp); BUMP_MIB(&tcps->tcps_mib, tcpTimKeepaliveProbe); if (tcp->tcp_ka_last_intrvl != 0) { int max; /* * We should probe again at least * in ka_intrvl, but not more than * tcp_rexmit_interval_max. */ max = tcps->tcps_rexmit_interval_max; firetime = MIN(ka_intrvl - 1, tcp->tcp_ka_last_intrvl << 1); if (firetime > max) firetime = max; } else { firetime = tcp->tcp_rto; } tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, MSEC_TO_TICK(firetime)); tcp->tcp_ka_last_intrvl = firetime; return; } } } else { tcp->tcp_ka_last_intrvl = 0; } /* firetime can be negative if (mp1 == NULL || mp == NULL) */ if ((firetime = ka_intrvl - idletime) < 0) { firetime = ka_intrvl; } tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, MSEC_TO_TICK(firetime)); } int tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) { queue_t *q = tcp->tcp_rq; int32_t mss = tcp->tcp_mss; int maxpsz; if (TCP_IS_DETACHED(tcp)) return (mss); if (tcp->tcp_fused) { maxpsz = tcp_fuse_maxpsz_set(tcp); mss = INFPSZ; } else if (tcp->tcp_mdt || tcp->tcp_lso || tcp->tcp_maxpsz == 0) { /* * Set the sd_qn_maxpsz according to the socket send buffer * size, and sd_maxblk to INFPSZ (-1). This will essentially * instruct the stream head to copyin user data into contiguous * kernel-allocated buffers without breaking it up into smaller * chunks. We round up the buffer size to the nearest SMSS. */ maxpsz = MSS_ROUNDUP(tcp->tcp_xmit_hiwater, mss); if (tcp->tcp_kssl_ctx == NULL) mss = INFPSZ; else mss = SSL3_MAX_RECORD_LEN; } else { /* * Set sd_qn_maxpsz to approx half the (receivers) buffer * (and a multiple of the mss). This instructs the stream * head to break down larger than SMSS writes into SMSS- * size mblks, up to tcp_maxpsz_multiplier mblks at a time. */ maxpsz = tcp->tcp_maxpsz * mss; if (maxpsz > tcp->tcp_xmit_hiwater/2) { maxpsz = tcp->tcp_xmit_hiwater/2; /* Round up to nearest mss */ maxpsz = MSS_ROUNDUP(maxpsz, mss); } } (void) setmaxps(q, maxpsz); tcp->tcp_wq->q_maxpsz = maxpsz; if (set_maxblk) (void) mi_set_sth_maxblk(q, mss); return (mss); } /* * Extract option values from a tcp header. We put any found values into the * tcpopt struct and return a bitmask saying which options were found. */ static int tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt) { uchar_t *endp; int len; uint32_t mss; uchar_t *up = (uchar_t *)tcph; int found = 0; int32_t sack_len; tcp_seq sack_begin, sack_end; tcp_t *tcp; endp = up + TCP_HDR_LENGTH(tcph); up += TCP_MIN_HEADER_LENGTH; while (up < endp) { len = endp - up; switch (*up) { case TCPOPT_EOL: break; case TCPOPT_NOP: up++; continue; case TCPOPT_MAXSEG: if (len < TCPOPT_MAXSEG_LEN || up[1] != TCPOPT_MAXSEG_LEN) break; mss = BE16_TO_U16(up+2); /* Caller must handle tcp_mss_min and tcp_mss_max_* */ tcpopt->tcp_opt_mss = mss; found |= TCP_OPT_MSS_PRESENT; up += TCPOPT_MAXSEG_LEN; continue; case TCPOPT_WSCALE: if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) break; if (up[2] > TCP_MAX_WINSHIFT) tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; else tcpopt->tcp_opt_wscale = up[2]; found |= TCP_OPT_WSCALE_PRESENT; up += TCPOPT_WS_LEN; continue; case TCPOPT_SACK_PERMITTED: if (len < TCPOPT_SACK_OK_LEN || up[1] != TCPOPT_SACK_OK_LEN) break; found |= TCP_OPT_SACK_OK_PRESENT; up += TCPOPT_SACK_OK_LEN; continue; case TCPOPT_SACK: if (len <= 2 || up[1] <= 2 || len < up[1]) break; /* If TCP is not interested in SACK blks... */ if ((tcp = tcpopt->tcp) == NULL) { up += up[1]; continue; } sack_len = up[1] - TCPOPT_HEADER_LEN; up += TCPOPT_HEADER_LEN; /* * If the list is empty, allocate one and assume * nothing is sack'ed. */ ASSERT(tcp->tcp_sack_info != NULL); if (tcp->tcp_notsack_list == NULL) { tcp_notsack_update(&(tcp->tcp_notsack_list), tcp->tcp_suna, tcp->tcp_snxt, &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); /* * Make sure tcp_notsack_list is not NULL. * This happens when kmem_alloc(KM_NOSLEEP) * returns NULL. */ if (tcp->tcp_notsack_list == NULL) { up += sack_len; continue; } tcp->tcp_fack = tcp->tcp_suna; } while (sack_len > 0) { if (up + 8 > endp) { up = endp; break; } sack_begin = BE32_TO_U32(up); up += 4; sack_end = BE32_TO_U32(up); up += 4; sack_len -= 8; /* * Bounds checking. Make sure the SACK * info is within tcp_suna and tcp_snxt. * If this SACK blk is out of bound, ignore * it but continue to parse the following * blks. */ if (SEQ_LEQ(sack_end, sack_begin) || SEQ_LT(sack_begin, tcp->tcp_suna) || SEQ_GT(sack_end, tcp->tcp_snxt)) { continue; } tcp_notsack_insert(&(tcp->tcp_notsack_list), sack_begin, sack_end, &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); if (SEQ_GT(sack_end, tcp->tcp_fack)) { tcp->tcp_fack = sack_end; } } found |= TCP_OPT_SACK_PRESENT; continue; case TCPOPT_TSTAMP: if (len < TCPOPT_TSTAMP_LEN || up[1] != TCPOPT_TSTAMP_LEN) break; tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); found |= TCP_OPT_TSTAMP_PRESENT; up += TCPOPT_TSTAMP_LEN; continue; default: if (len <= 1 || len < (int)up[1] || up[1] == 0) break; up += up[1]; continue; } break; } return (found); } /* * Set the mss associated with a particular tcp based on its current value, * and a new one passed in. Observe minimums and maximums, and reset * other state variables that we want to view as multiples of mss. * * This function is called mainly because values like tcp_mss, tcp_cwnd, * highwater marks etc. need to be initialized or adjusted. * 1) From tcp_process_options() when the other side's SYN/SYN-ACK * packet arrives. * 2) We need to set a new MSS when ICMP_FRAGMENTATION_NEEDED or * ICMP6_PACKET_TOO_BIG arrives. * 3) From tcp_paws_check() if the other side stops sending the timestamp, * to increase the MSS to use the extra bytes available. * * Callers except tcp_paws_check() ensure that they only reduce mss. */ static void tcp_mss_set(tcp_t *tcp, uint32_t mss, boolean_t do_ss) { uint32_t mss_max; tcp_stack_t *tcps = tcp->tcp_tcps; if (tcp->tcp_ipversion == IPV4_VERSION) mss_max = tcps->tcps_mss_max_ipv4; else mss_max = tcps->tcps_mss_max_ipv6; if (mss < tcps->tcps_mss_min) mss = tcps->tcps_mss_min; if (mss > mss_max) mss = mss_max; /* * Unless naglim has been set by our client to * a non-mss value, force naglim to track mss. * This can help to aggregate small writes. */ if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) tcp->tcp_naglim = mss; /* * TCP should be able to buffer at least 4 MSS data for obvious * performance reason. */ if ((mss << 2) > tcp->tcp_xmit_hiwater) tcp->tcp_xmit_hiwater = mss << 2; if (do_ss) { /* * Either the tcp_cwnd is as yet uninitialized, or mss is * changing due to a reduction in MTU, presumably as a * result of a new path component, reset cwnd to its * "initial" value, as a multiple of the new mss. */ SET_TCP_INIT_CWND(tcp, mss, tcps->tcps_slow_start_initial); } else { /* * Called by tcp_paws_check(), the mss increased * marginally to allow use of space previously taken * by the timestamp option. It would be inappropriate * to apply slow start or tcp_init_cwnd values to * tcp_cwnd, simply adjust to a multiple of the new mss. */ tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss; tcp->tcp_cwnd_cnt = 0; } tcp->tcp_mss = mss; (void) tcp_maxpsz_set(tcp, B_TRUE); } /* For /dev/tcp aka AF_INET open */ static int tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) { return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); } /* For /dev/tcp6 aka AF_INET6 open */ static int tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) { return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); } static int tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, boolean_t isv6) { tcp_t *tcp = NULL; conn_t *connp; int err; vmem_t *minor_arena = NULL; dev_t conn_dev; zoneid_t zoneid; tcp_stack_t *tcps = NULL; if (q->q_ptr != NULL) return (0); if (sflag == MODOPEN) return (EINVAL); if (!(flag & SO_ACCEPTOR)) { /* * Special case for install: miniroot needs to be able to * access files via NFS as though it were always in the * global zone. */ if (credp == kcred && nfs_global_client_only != 0) { zoneid = GLOBAL_ZONEID; tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> netstack_tcp; ASSERT(tcps != NULL); } else { netstack_t *ns; ns = netstack_find_by_cred(credp); ASSERT(ns != NULL); tcps = ns->netstack_tcp; ASSERT(tcps != NULL); /* * For exclusive stacks we set the zoneid to zero * to make TCP operate as if in the global zone. */ if (tcps->tcps_netstack->netstack_stackid != GLOBAL_NETSTACKID) zoneid = GLOBAL_ZONEID; else zoneid = crgetzoneid(credp); } /* * For stackid zero this is done from strplumb.c, but * non-zero stackids are handled here. */ if (tcps->tcps_g_q == NULL && tcps->tcps_netstack->netstack_stackid != GLOBAL_NETSTACKID) { tcp_g_q_setup(tcps); } } if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { minor_arena = ip_minor_arena_la; } else { /* * Either minor numbers in the large arena were exhausted * or a non socket application is doing the open. * Try to allocate from the small arena. */ if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { if (tcps != NULL) netstack_rele(tcps->tcps_netstack); return (EBUSY); } minor_arena = ip_minor_arena_sa; } ASSERT(minor_arena != NULL); *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); if (flag & SO_ACCEPTOR) { /* No netstack_find_by_cred, hence no netstack_rele needed */ ASSERT(tcps == NULL); q->q_qinfo = &tcp_acceptor_rinit; /* * the conn_dev and minor_arena will be subsequently used by * tcp_wput_accept() and tcpclose_accept() to figure out the * minor device number for this connection from the q_ptr. */ RD(q)->q_ptr = (void *)conn_dev; WR(q)->q_qinfo = &tcp_acceptor_winit; WR(q)->q_ptr = (void *)minor_arena; qprocson(q); return (0); } connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt), tcps); /* * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, * so we drop it by one. */ netstack_rele(tcps->tcps_netstack); if (connp == NULL) { inet_minor_free(minor_arena, conn_dev); q->q_ptr = NULL; return (ENOSR); } connp->conn_sqp = IP_SQUEUE_GET(lbolt); tcp = connp->conn_tcp; q->q_ptr = WR(q)->q_ptr = connp; if (isv6) { connp->conn_flags |= (IPCL_TCP6|IPCL_ISV6); connp->conn_send = ip_output_v6; connp->conn_af_isv6 = B_TRUE; connp->conn_pkt_isv6 = B_TRUE; connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT; tcp->tcp_ipversion = IPV6_VERSION; tcp->tcp_family = AF_INET6; tcp->tcp_mss = tcps->tcps_mss_def_ipv6; } else { connp->conn_flags |= IPCL_TCP4; connp->conn_send = ip_output; connp->conn_af_isv6 = B_FALSE; connp->conn_pkt_isv6 = B_FALSE; tcp->tcp_ipversion = IPV4_VERSION; tcp->tcp_family = AF_INET; tcp->tcp_mss = tcps->tcps_mss_def_ipv4; } /* * TCP keeps a copy of cred for cache locality reasons but * we put a reference only once. If connp->conn_cred * becomes invalid, tcp_cred should also be set to NULL. */ tcp->tcp_cred = connp->conn_cred = credp; crhold(connp->conn_cred); tcp->tcp_cpid = curproc->p_pid; tcp->tcp_open_time = lbolt64; connp->conn_zoneid = zoneid; connp->conn_mlp_type = mlptSingle; connp->conn_ulp_labeled = !is_system_labeled(); ASSERT(connp->conn_netstack == tcps->tcps_netstack); ASSERT(tcp->tcp_tcps == tcps); /* * If the caller has the process-wide flag set, then default to MAC * exempt mode. This allows read-down to unlabeled hosts. */ if (getpflags(NET_MAC_AWARE, credp) != 0) connp->conn_mac_exempt = B_TRUE; connp->conn_dev = conn_dev; connp->conn_minor_arena = minor_arena; ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); ASSERT(WR(q)->q_qinfo == &tcp_winit); if (flag & SO_SOCKSTR) { /* * No need to insert a socket in tcp acceptor hash. * If it was a socket acceptor stream, we dealt with * it above. A socket listener can never accept a * connection and doesn't need acceptor_id. */ connp->conn_flags |= IPCL_SOCKET; tcp->tcp_issocket = 1; WR(q)->q_qinfo = &tcp_sock_winit; } else { #ifdef _ILP32 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); #else tcp->tcp_acceptor_id = conn_dev; #endif /* _ILP32 */ tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); } if (tcps->tcps_trace) tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_SLEEP); err = tcp_init(tcp, q); if (err != 0) { inet_minor_free(connp->conn_minor_arena, connp->conn_dev); tcp_acceptor_hash_remove(tcp); CONN_DEC_REF(connp); q->q_ptr = WR(q)->q_ptr = NULL; return (err); } RD(q)->q_hiwat = tcps->tcps_recv_hiwat; tcp->tcp_rwnd = tcps->tcps_recv_hiwat; /* Non-zero default values */ connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; /* * Put the ref for TCP. Ref for IP was already put * by ipcl_conn_create. Also Make the conn_t globally * visible to walkers */ mutex_enter(&connp->conn_lock); CONN_INC_REF_LOCKED(connp); ASSERT(connp->conn_ref == 2); connp->conn_state_flags &= ~CONN_INCIPIENT; mutex_exit(&connp->conn_lock); qprocson(q); return (0); } /* * Some TCP options can be "set" by requesting them in the option * buffer. This is needed for XTI feature test though we do not * allow it in general. We interpret that this mechanism is more * applicable to OSI protocols and need not be allowed in general. * This routine filters out options for which it is not allowed (most) * and lets through those (few) for which it is. [ The XTI interface * test suite specifics will imply that any XTI_GENERIC level XTI_* if * ever implemented will have to be allowed here ]. */ static boolean_t tcp_allow_connopt_set(int level, int name) { switch (level) { case IPPROTO_TCP: switch (name) { case TCP_NODELAY: return (B_TRUE); default: return (B_FALSE); } /*NOTREACHED*/ default: return (B_FALSE); } /*NOTREACHED*/ } /* * This routine gets default values of certain options whose default * values are maintained by protocol specific code */ /* ARGSUSED */ int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr) { int32_t *i1 = (int32_t *)ptr; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; switch (level) { case IPPROTO_TCP: switch (name) { case TCP_NOTIFY_THRESHOLD: *i1 = tcps->tcps_ip_notify_interval; break; case TCP_ABORT_THRESHOLD: *i1 = tcps->tcps_ip_abort_interval; break; case TCP_CONN_NOTIFY_THRESHOLD: *i1 = tcps->tcps_ip_notify_cinterval; break; case TCP_CONN_ABORT_THRESHOLD: *i1 = tcps->tcps_ip_abort_cinterval; break; default: return (-1); } break; case IPPROTO_IP: switch (name) { case IP_TTL: *i1 = tcps->tcps_ipv4_ttl; break; default: return (-1); } break; case IPPROTO_IPV6: switch (name) { case IPV6_UNICAST_HOPS: *i1 = tcps->tcps_ipv6_hoplimit; break; default: return (-1); } break; default: return (-1); } return (sizeof (int)); } /* * TCP routine to get the values of options. */ int tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr) { int *i1 = (int *)ptr; conn_t *connp = Q_TO_CONN(q); tcp_t *tcp = connp->conn_tcp; ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; switch (level) { case SOL_SOCKET: switch (name) { case SO_LINGER: { struct linger *lgr = (struct linger *)ptr; lgr->l_onoff = tcp->tcp_linger ? SO_LINGER : 0; lgr->l_linger = tcp->tcp_lingertime; } return (sizeof (struct linger)); case SO_DEBUG: *i1 = tcp->tcp_debug ? SO_DEBUG : 0; break; case SO_KEEPALIVE: *i1 = tcp->tcp_ka_enabled ? SO_KEEPALIVE : 0; break; case SO_DONTROUTE: *i1 = tcp->tcp_dontroute ? SO_DONTROUTE : 0; break; case SO_USELOOPBACK: *i1 = tcp->tcp_useloopback ? SO_USELOOPBACK : 0; break; case SO_BROADCAST: *i1 = tcp->tcp_broadcast ? SO_BROADCAST : 0; break; case SO_REUSEADDR: *i1 = tcp->tcp_reuseaddr ? SO_REUSEADDR : 0; break; case SO_OOBINLINE: *i1 = tcp->tcp_oobinline ? SO_OOBINLINE : 0; break; case SO_DGRAM_ERRIND: *i1 = tcp->tcp_dgram_errind ? SO_DGRAM_ERRIND : 0; break; case SO_TYPE: *i1 = SOCK_STREAM; break; case SO_SNDBUF: *i1 = tcp->tcp_xmit_hiwater; break; case SO_RCVBUF: *i1 = RD(q)->q_hiwat; break; case SO_SND_COPYAVOID: *i1 = tcp->tcp_snd_zcopy_on ? SO_SND_COPYAVOID : 0; break; case SO_ALLZONES: *i1 = connp->conn_allzones ? 1 : 0; break; case SO_ANON_MLP: *i1 = connp->conn_anon_mlp; break; case SO_MAC_EXEMPT: *i1 = connp->conn_mac_exempt; break; case SO_EXCLBIND: *i1 = tcp->tcp_exclbind ? SO_EXCLBIND : 0; break; case SO_PROTOTYPE: *i1 = IPPROTO_TCP; break; case SO_DOMAIN: *i1 = tcp->tcp_family; break; default: return (-1); } break; case IPPROTO_TCP: switch (name) { case TCP_NODELAY: *i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0; break; case TCP_MAXSEG: *i1 = tcp->tcp_mss; break; case TCP_NOTIFY_THRESHOLD: *i1 = (int)tcp->tcp_first_timer_threshold; break; case TCP_ABORT_THRESHOLD: *i1 = tcp->tcp_second_timer_threshold; break; case TCP_CONN_NOTIFY_THRESHOLD: *i1 = tcp->tcp_first_ctimer_threshold; break; case TCP_CONN_ABORT_THRESHOLD: *i1 = tcp->tcp_second_ctimer_threshold; break; case TCP_RECVDSTADDR: *i1 = tcp->tcp_recvdstaddr; break; case TCP_ANONPRIVBIND: *i1 = tcp->tcp_anon_priv_bind; break; case TCP_EXCLBIND: *i1 = tcp->tcp_exclbind ? TCP_EXCLBIND : 0; break; case TCP_INIT_CWND: *i1 = tcp->tcp_init_cwnd; break; case TCP_KEEPALIVE_THRESHOLD: *i1 = tcp->tcp_ka_interval; break; case TCP_KEEPALIVE_ABORT_THRESHOLD: *i1 = tcp->tcp_ka_abort_thres; break; case TCP_CORK: *i1 = tcp->tcp_cork; break; default: return (-1); } break; case IPPROTO_IP: if (tcp->tcp_family != AF_INET) return (-1); switch (name) { case IP_OPTIONS: case T_IP_OPTIONS: { /* * This is compatible with BSD in that in only return * the reverse source route with the final destination * as the last entry. The first 4 bytes of the option * will contain the final destination. */ int opt_len; opt_len = (char *)tcp->tcp_tcph - (char *)tcp->tcp_ipha; opt_len -= tcp->tcp_label_len + IP_SIMPLE_HDR_LENGTH; ASSERT(opt_len >= 0); /* Caller ensures enough space */ if (opt_len > 0) { /* * TODO: Do we have to handle getsockopt on an * initiator as well? */ return (ip_opt_get_user(tcp->tcp_ipha, ptr)); } return (0); } case IP_TOS: case T_IP_TOS: *i1 = (int)tcp->tcp_ipha->ipha_type_of_service; break; case IP_TTL: *i1 = (int)tcp->tcp_ipha->ipha_ttl; break; case IP_NEXTHOP: /* Handled at IP level */ return (-EINVAL); default: return (-1); } break; case IPPROTO_IPV6: /* * IPPROTO_IPV6 options are only supported for sockets * that are using IPv6 on the wire. */ if (tcp->tcp_ipversion != IPV6_VERSION) { return (-1); } switch (name) { case IPV6_UNICAST_HOPS: *i1 = (unsigned int) tcp->tcp_ip6h->ip6_hops; break; /* goto sizeof (int) option return */ case IPV6_BOUND_IF: /* Zero if not set */ *i1 = tcp->tcp_bound_if; break; /* goto sizeof (int) option return */ case IPV6_RECVPKTINFO: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVTCLASS: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVHOPLIMIT: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVHOPOPTS: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVDSTOPTS: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVDSTOPTS) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case _OLD_IPV6_RECVDSTOPTS: if (tcp->tcp_ipv6_recvancillary & TCP_OLD_IPV6_RECVDSTOPTS) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVRTHDR: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_RECVRTHDRDSTOPTS: if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) *i1 = 1; else *i1 = 0; break; /* goto sizeof (int) option return */ case IPV6_PKTINFO: { /* XXX assumes that caller has room for max size! */ struct in6_pktinfo *pkti; pkti = (struct in6_pktinfo *)ptr; if (ipp->ipp_fields & IPPF_IFINDEX) pkti->ipi6_ifindex = ipp->ipp_ifindex; else pkti->ipi6_ifindex = 0; if (ipp->ipp_fields & IPPF_ADDR) pkti->ipi6_addr = ipp->ipp_addr; else pkti->ipi6_addr = ipv6_all_zeros; return (sizeof (struct in6_pktinfo)); } case IPV6_TCLASS: if (ipp->ipp_fields & IPPF_TCLASS) *i1 = ipp->ipp_tclass; else *i1 = IPV6_FLOW_TCLASS( IPV6_DEFAULT_VERS_AND_FLOW); break; /* goto sizeof (int) option return */ case IPV6_NEXTHOP: { sin6_t *sin6 = (sin6_t *)ptr; if (!(ipp->ipp_fields & IPPF_NEXTHOP)) return (0); *sin6 = sin6_null; sin6->sin6_family = AF_INET6; sin6->sin6_addr = ipp->ipp_nexthop; return (sizeof (sin6_t)); } case IPV6_HOPOPTS: if (!(ipp->ipp_fields & IPPF_HOPOPTS)) return (0); if (ipp->ipp_hopoptslen <= tcp->tcp_label_len) return (0); bcopy((char *)ipp->ipp_hopopts + tcp->tcp_label_len, ptr, ipp->ipp_hopoptslen - tcp->tcp_label_len); if (tcp->tcp_label_len > 0) { ptr[0] = ((char *)ipp->ipp_hopopts)[0]; ptr[1] = (ipp->ipp_hopoptslen - tcp->tcp_label_len + 7) / 8 - 1; } return (ipp->ipp_hopoptslen - tcp->tcp_label_len); case IPV6_RTHDRDSTOPTS: if (!(ipp->ipp_fields & IPPF_RTDSTOPTS)) return (0); bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen); return (ipp->ipp_rtdstoptslen); case IPV6_RTHDR: if (!(ipp->ipp_fields & IPPF_RTHDR)) return (0); bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen); return (ipp->ipp_rthdrlen); case IPV6_DSTOPTS: if (!(ipp->ipp_fields & IPPF_DSTOPTS)) return (0); bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen); return (ipp->ipp_dstoptslen); case IPV6_SRC_PREFERENCES: return (ip6_get_src_preferences(connp, (uint32_t *)ptr)); case IPV6_PATHMTU: { struct ip6_mtuinfo *mtuinfo = (struct ip6_mtuinfo *)ptr; if (tcp->tcp_state < TCPS_ESTABLISHED) return (-1); return (ip_fill_mtuinfo(&connp->conn_remv6, connp->conn_fport, mtuinfo, connp->conn_netstack)); } default: return (-1); } break; default: return (-1); } return (sizeof (int)); } /* * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements. * Parameters are assumed to be verified by the caller. */ /* ARGSUSED */ int tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, mblk_t *mblk) { conn_t *connp = Q_TO_CONN(q); tcp_t *tcp = connp->conn_tcp; int *i1 = (int *)invalp; boolean_t onoff = (*i1 == 0) ? 0 : 1; boolean_t checkonly; int reterr; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; switch (optset_context) { case SETFN_OPTCOM_CHECKONLY: checkonly = B_TRUE; /* * Note: Implies T_CHECK semantics for T_OPTCOM_REQ * inlen != 0 implies value supplied and * we have to "pretend" to set it. * inlen == 0 implies that there is no * value part in T_CHECK request and just validation * done elsewhere should be enough, we just return here. */ if (inlen == 0) { *outlenp = 0; return (0); } break; case SETFN_OPTCOM_NEGOTIATE: checkonly = B_FALSE; break; case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */ case SETFN_CONN_NEGOTIATE: checkonly = B_FALSE; /* * Negotiating local and "association-related" options * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ) * primitives is allowed by XTI, but we choose * to not implement this style negotiation for Internet * protocols (We interpret it is a must for OSI world but * optional for Internet protocols) for all options. * [ Will do only for the few options that enable test * suites that our XTI implementation of this feature * works for transports that do allow it ] */ if (!tcp_allow_connopt_set(level, name)) { *outlenp = 0; return (EINVAL); } break; default: /* * We should never get here */ *outlenp = 0; return (EINVAL); } ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); /* * For TCP, we should have no ancillary data sent down * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs * has to be zero. */ ASSERT(thisdg_attrs == NULL); /* * For fixed length options, no sanity check * of passed in length is done. It is assumed *_optcom_req() * routines do the right thing. */ switch (level) { case SOL_SOCKET: switch (name) { case SO_LINGER: { struct linger *lgr = (struct linger *)invalp; if (!checkonly) { if (lgr->l_onoff) { tcp->tcp_linger = 1; tcp->tcp_lingertime = lgr->l_linger; } else { tcp->tcp_linger = 0; tcp->tcp_lingertime = 0; } /* struct copy */ *(struct linger *)outvalp = *lgr; } else { if (!lgr->l_onoff) { ((struct linger *) outvalp)->l_onoff = 0; ((struct linger *) outvalp)->l_linger = 0; } else { /* struct copy */ *(struct linger *)outvalp = *lgr; } } *outlenp = sizeof (struct linger); return (0); } case SO_DEBUG: if (!checkonly) tcp->tcp_debug = onoff; break; case SO_KEEPALIVE: if (checkonly) { /* T_CHECK case */ break; } if (!onoff) { if (tcp->tcp_ka_enabled) { if (tcp->tcp_ka_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); tcp->tcp_ka_tid = 0; } tcp->tcp_ka_enabled = 0; } break; } if (!tcp->tcp_ka_enabled) { /* Crank up the keepalive timer */ tcp->tcp_ka_last_intrvl = 0; tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, MSEC_TO_TICK(tcp->tcp_ka_interval)); tcp->tcp_ka_enabled = 1; } break; case SO_DONTROUTE: /* * SO_DONTROUTE, SO_USELOOPBACK, and SO_BROADCAST are * only of interest to IP. We track them here only so * that we can report their current value. */ if (!checkonly) { tcp->tcp_dontroute = onoff; tcp->tcp_connp->conn_dontroute = onoff; } break; case SO_USELOOPBACK: if (!checkonly) { tcp->tcp_useloopback = onoff; tcp->tcp_connp->conn_loopback = onoff; } break; case SO_BROADCAST: if (!checkonly) { tcp->tcp_broadcast = onoff; tcp->tcp_connp->conn_broadcast = onoff; } break; case SO_REUSEADDR: if (!checkonly) { tcp->tcp_reuseaddr = onoff; tcp->tcp_connp->conn_reuseaddr = onoff; } break; case SO_OOBINLINE: if (!checkonly) tcp->tcp_oobinline = onoff; break; case SO_DGRAM_ERRIND: if (!checkonly) tcp->tcp_dgram_errind = onoff; break; case SO_SNDBUF: { if (*i1 > tcps->tcps_max_buf) { *outlenp = 0; return (ENOBUFS); } if (checkonly) break; tcp->tcp_xmit_hiwater = *i1; if (tcps->tcps_snd_lowat_fraction != 0) tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / tcps->tcps_snd_lowat_fraction; (void) tcp_maxpsz_set(tcp, B_TRUE); /* * If we are flow-controlled, recheck the condition. * There are apps that increase SO_SNDBUF size when * flow-controlled (EWOULDBLOCK), and expect the flow * control condition to be lifted right away. */ mutex_enter(&tcp->tcp_non_sq_lock); if (tcp->tcp_flow_stopped && TCP_UNSENT_BYTES(tcp) < tcp->tcp_xmit_hiwater) { tcp_clrqfull(tcp); } mutex_exit(&tcp->tcp_non_sq_lock); break; } case SO_RCVBUF: if (*i1 > tcps->tcps_max_buf) { *outlenp = 0; return (ENOBUFS); } /* Silently ignore zero */ if (!checkonly && *i1 != 0) { *i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss); (void) tcp_rwnd_set(tcp, *i1); } /* * XXX should we return the rwnd here * and tcp_opt_get ? */ break; case SO_SND_COPYAVOID: if (!checkonly) { /* we only allow enable at most once for now */ if (tcp->tcp_loopback || (tcp->tcp_kssl_ctx != NULL) || (!tcp->tcp_snd_zcopy_aware && (onoff != 1 || !tcp_zcopy_check(tcp)))) { *outlenp = 0; return (EOPNOTSUPP); } tcp->tcp_snd_zcopy_aware = 1; } break; case SO_ALLZONES: /* Pass option along to IP level for handling */ return (-EINVAL); case SO_ANON_MLP: /* Pass option along to IP level for handling */ return (-EINVAL); case SO_MAC_EXEMPT: /* Pass option along to IP level for handling */ return (-EINVAL); case SO_EXCLBIND: if (!checkonly) tcp->tcp_exclbind = onoff; break; default: *outlenp = 0; return (EINVAL); } break; case IPPROTO_TCP: switch (name) { case TCP_NODELAY: if (!checkonly) tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss; break; case TCP_NOTIFY_THRESHOLD: if (!checkonly) tcp->tcp_first_timer_threshold = *i1; break; case TCP_ABORT_THRESHOLD: if (!checkonly) tcp->tcp_second_timer_threshold = *i1; break; case TCP_CONN_NOTIFY_THRESHOLD: if (!checkonly) tcp->tcp_first_ctimer_threshold = *i1; break; case TCP_CONN_ABORT_THRESHOLD: if (!checkonly) tcp->tcp_second_ctimer_threshold = *i1; break; case TCP_RECVDSTADDR: if (tcp->tcp_state > TCPS_LISTEN) return (EOPNOTSUPP); if (!checkonly) tcp->tcp_recvdstaddr = onoff; break; case TCP_ANONPRIVBIND: if ((reterr = secpolicy_net_privaddr(cr, 0, IPPROTO_TCP)) != 0) { *outlenp = 0; return (reterr); } if (!checkonly) { tcp->tcp_anon_priv_bind = onoff; } break; case TCP_EXCLBIND: if (!checkonly) tcp->tcp_exclbind = onoff; break; /* goto sizeof (int) option return */ case TCP_INIT_CWND: { uint32_t init_cwnd = *((uint32_t *)invalp); if (checkonly) break; /* * Only allow socket with network configuration * privilege to set the initial cwnd to be larger * than allowed by RFC 3390. */ if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) { tcp->tcp_init_cwnd = init_cwnd; break; } if ((reterr = secpolicy_ip_config(cr, B_TRUE)) != 0) { *outlenp = 0; return (reterr); } if (init_cwnd > TCP_MAX_INIT_CWND) { *outlenp = 0; return (EINVAL); } tcp->tcp_init_cwnd = init_cwnd; break; } case TCP_KEEPALIVE_THRESHOLD: if (checkonly) break; if (*i1 < tcps->tcps_keepalive_interval_low || *i1 > tcps->tcps_keepalive_interval_high) { *outlenp = 0; return (EINVAL); } if (*i1 != tcp->tcp_ka_interval) { tcp->tcp_ka_interval = *i1; /* * Check if we need to restart the * keepalive timer. */ if (tcp->tcp_ka_tid != 0) { ASSERT(tcp->tcp_ka_enabled); (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); tcp->tcp_ka_last_intrvl = 0; tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, MSEC_TO_TICK(tcp->tcp_ka_interval)); } } break; case TCP_KEEPALIVE_ABORT_THRESHOLD: if (!checkonly) { if (*i1 < tcps->tcps_keepalive_abort_interval_low || *i1 > tcps->tcps_keepalive_abort_interval_high) { *outlenp = 0; return (EINVAL); } tcp->tcp_ka_abort_thres = *i1; } break; case TCP_CORK: if (!checkonly) { /* * if tcp->tcp_cork was set and is now * being unset, we have to make sure that * the remaining data gets sent out. Also * unset tcp->tcp_cork so that tcp_wput_data() * can send data even if it is less than mss */ if (tcp->tcp_cork && onoff == 0 && tcp->tcp_unsent > 0) { tcp->tcp_cork = B_FALSE; tcp_wput_data(tcp, NULL, B_FALSE); } tcp->tcp_cork = onoff; } break; default: *outlenp = 0; return (EINVAL); } break; case IPPROTO_IP: if (tcp->tcp_family != AF_INET) { *outlenp = 0; return (ENOPROTOOPT); } switch (name) { case IP_OPTIONS: case T_IP_OPTIONS: reterr = tcp_opt_set_header(tcp, checkonly, invalp, inlen); if (reterr) { *outlenp = 0; return (reterr); } /* OK return - copy input buffer into output buffer */ if (invalp != outvalp) { /* don't trust bcopy for identical src/dst */ bcopy(invalp, outvalp, inlen); } *outlenp = inlen; return (0); case IP_TOS: case T_IP_TOS: if (!checkonly) { tcp->tcp_ipha->ipha_type_of_service = (uchar_t)*i1; tcp->tcp_tos = (uchar_t)*i1; } break; case IP_TTL: if (!checkonly) { tcp->tcp_ipha->ipha_ttl = (uchar_t)*i1; tcp->tcp_ttl = (uchar_t)*i1; } break; case IP_BOUND_IF: case IP_NEXTHOP: /* Handled at the IP level */ return (-EINVAL); case IP_SEC_OPT: /* * We should not allow policy setting after * we start listening for connections. */ if (tcp->tcp_state == TCPS_LISTEN) { return (EINVAL); } else { /* Handled at the IP level */ return (-EINVAL); } default: *outlenp = 0; return (EINVAL); } break; case IPPROTO_IPV6: { ip6_pkt_t *ipp; /* * IPPROTO_IPV6 options are only supported for sockets * that are using IPv6 on the wire. */ if (tcp->tcp_ipversion != IPV6_VERSION) { *outlenp = 0; return (ENOPROTOOPT); } /* * Only sticky options; no ancillary data */ ASSERT(thisdg_attrs == NULL); ipp = &tcp->tcp_sticky_ipp; switch (name) { case IPV6_UNICAST_HOPS: /* -1 means use default */ if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) { *outlenp = 0; return (EINVAL); } if (!checkonly) { if (*i1 == -1) { tcp->tcp_ip6h->ip6_hops = ipp->ipp_unicast_hops = (uint8_t)tcps->tcps_ipv6_hoplimit; ipp->ipp_fields &= ~IPPF_UNICAST_HOPS; /* Pass modified value to IP. */ *i1 = tcp->tcp_ip6h->ip6_hops; } else { tcp->tcp_ip6h->ip6_hops = ipp->ipp_unicast_hops = (uint8_t)*i1; ipp->ipp_fields |= IPPF_UNICAST_HOPS; } reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); } break; case IPV6_BOUND_IF: if (!checkonly) { int error = 0; tcp->tcp_bound_if = *i1; error = ip_opt_set_ill(tcp->tcp_connp, *i1, B_TRUE, checkonly, level, name, mblk); if (error != 0) { *outlenp = 0; return (error); } } break; /* * Set boolean switches for ancillary data delivery */ case IPV6_RECVPKTINFO: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVPKTINFO; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVPKTINFO; /* Force it to be sent up with the next msg */ tcp->tcp_recvifindex = 0; } break; case IPV6_RECVTCLASS: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVTCLASS; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVTCLASS; } break; case IPV6_RECVHOPLIMIT: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVHOPLIMIT; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVHOPLIMIT; /* Force it to be sent up with the next msg */ tcp->tcp_recvhops = 0xffffffffU; } break; case IPV6_RECVHOPOPTS: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVHOPOPTS; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVHOPOPTS; } break; case IPV6_RECVDSTOPTS: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVDSTOPTS; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVDSTOPTS; } break; case _OLD_IPV6_RECVDSTOPTS: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_OLD_IPV6_RECVDSTOPTS; else tcp->tcp_ipv6_recvancillary &= ~TCP_OLD_IPV6_RECVDSTOPTS; } break; case IPV6_RECVRTHDR: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVRTHDR; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVRTHDR; } break; case IPV6_RECVRTHDRDSTOPTS: if (!checkonly) { if (onoff) tcp->tcp_ipv6_recvancillary |= TCP_IPV6_RECVRTDSTOPTS; else tcp->tcp_ipv6_recvancillary &= ~TCP_IPV6_RECVRTDSTOPTS; } break; case IPV6_PKTINFO: if (inlen != 0 && inlen != sizeof (struct in6_pktinfo)) return (EINVAL); if (checkonly) break; if (inlen == 0) { ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR); } else { struct in6_pktinfo *pkti; pkti = (struct in6_pktinfo *)invalp; /* * RFC 3542 states that ipi6_addr must be * the unspecified address when setting the * IPV6_PKTINFO sticky socket option on a * TCP socket. */ if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr)) return (EINVAL); /* * ip6_set_pktinfo() validates the source * address and interface index. */ reterr = ip6_set_pktinfo(cr, tcp->tcp_connp, pkti, mblk); if (reterr != 0) return (reterr); ipp->ipp_ifindex = pkti->ipi6_ifindex; ipp->ipp_addr = pkti->ipi6_addr; if (ipp->ipp_ifindex != 0) ipp->ipp_fields |= IPPF_IFINDEX; else ipp->ipp_fields &= ~IPPF_IFINDEX; if (!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)) ipp->ipp_fields |= IPPF_ADDR; else ipp->ipp_fields &= ~IPPF_ADDR; } reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; case IPV6_TCLASS: if (inlen != 0 && inlen != sizeof (int)) return (EINVAL); if (checkonly) break; if (inlen == 0) { ipp->ipp_fields &= ~IPPF_TCLASS; } else { if (*i1 > 255 || *i1 < -1) return (EINVAL); if (*i1 == -1) { ipp->ipp_tclass = 0; *i1 = 0; } else { ipp->ipp_tclass = *i1; } ipp->ipp_fields |= IPPF_TCLASS; } reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; case IPV6_NEXTHOP: /* * IP will verify that the nexthop is reachable * and fail for sticky options. */ if (inlen != 0 && inlen != sizeof (sin6_t)) return (EINVAL); if (checkonly) break; if (inlen == 0) { ipp->ipp_fields &= ~IPPF_NEXTHOP; } else { sin6_t *sin6 = (sin6_t *)invalp; if (sin6->sin6_family != AF_INET6) return (EAFNOSUPPORT); if (IN6_IS_ADDR_V4MAPPED( &sin6->sin6_addr)) return (EADDRNOTAVAIL); ipp->ipp_nexthop = sin6->sin6_addr; if (!IN6_IS_ADDR_UNSPECIFIED( &ipp->ipp_nexthop)) ipp->ipp_fields |= IPPF_NEXTHOP; else ipp->ipp_fields &= ~IPPF_NEXTHOP; } reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; case IPV6_HOPOPTS: { ip6_hbh_t *hopts = (ip6_hbh_t *)invalp; /* * Sanity checks - minimum size, size a multiple of * eight bytes, and matching size passed in. */ if (inlen != 0 && inlen != (8 * (hopts->ip6h_len + 1))) return (EINVAL); if (checkonly) break; reterr = optcom_pkt_set(invalp, inlen, B_TRUE, (uchar_t **)&ipp->ipp_hopopts, &ipp->ipp_hopoptslen, tcp->tcp_label_len); if (reterr != 0) return (reterr); if (ipp->ipp_hopoptslen == 0) ipp->ipp_fields &= ~IPPF_HOPOPTS; else ipp->ipp_fields |= IPPF_HOPOPTS; reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; } case IPV6_RTHDRDSTOPTS: { ip6_dest_t *dopts = (ip6_dest_t *)invalp; /* * Sanity checks - minimum size, size a multiple of * eight bytes, and matching size passed in. */ if (inlen != 0 && inlen != (8 * (dopts->ip6d_len + 1))) return (EINVAL); if (checkonly) break; reterr = optcom_pkt_set(invalp, inlen, B_TRUE, (uchar_t **)&ipp->ipp_rtdstopts, &ipp->ipp_rtdstoptslen, 0); if (reterr != 0) return (reterr); if (ipp->ipp_rtdstoptslen == 0) ipp->ipp_fields &= ~IPPF_RTDSTOPTS; else ipp->ipp_fields |= IPPF_RTDSTOPTS; reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; } case IPV6_DSTOPTS: { ip6_dest_t *dopts = (ip6_dest_t *)invalp; /* * Sanity checks - minimum size, size a multiple of * eight bytes, and matching size passed in. */ if (inlen != 0 && inlen != (8 * (dopts->ip6d_len + 1))) return (EINVAL); if (checkonly) break; reterr = optcom_pkt_set(invalp, inlen, B_TRUE, (uchar_t **)&ipp->ipp_dstopts, &ipp->ipp_dstoptslen, 0); if (reterr != 0) return (reterr); if (ipp->ipp_dstoptslen == 0) ipp->ipp_fields &= ~IPPF_DSTOPTS; else ipp->ipp_fields |= IPPF_DSTOPTS; reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; } case IPV6_RTHDR: { ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp; /* * Sanity checks - minimum size, size a multiple of * eight bytes, and matching size passed in. */ if (inlen != 0 && inlen != (8 * (rt->ip6r_len + 1))) return (EINVAL); if (checkonly) break; reterr = optcom_pkt_set(invalp, inlen, B_TRUE, (uchar_t **)&ipp->ipp_rthdr, &ipp->ipp_rthdrlen, 0); if (reterr != 0) return (reterr); if (ipp->ipp_rthdrlen == 0) ipp->ipp_fields &= ~IPPF_RTHDR; else ipp->ipp_fields |= IPPF_RTHDR; reterr = tcp_build_hdrs(q, tcp); if (reterr != 0) return (reterr); break; } case IPV6_V6ONLY: if (!checkonly) tcp->tcp_connp->conn_ipv6_v6only = onoff; break; case IPV6_USE_MIN_MTU: if (inlen != sizeof (int)) return (EINVAL); if (*i1 < -1 || *i1 > 1) return (EINVAL); if (checkonly) break; ipp->ipp_fields |= IPPF_USE_MIN_MTU; ipp->ipp_use_min_mtu = *i1; break; case IPV6_BOUND_PIF: /* Handled at the IP level */ return (-EINVAL); case IPV6_SEC_OPT: /* * We should not allow policy setting after * we start listening for connections. */ if (tcp->tcp_state == TCPS_LISTEN) { return (EINVAL); } else { /* Handled at the IP level */ return (-EINVAL); } case IPV6_SRC_PREFERENCES: if (inlen != sizeof (uint32_t)) return (EINVAL); reterr = ip6_set_src_preferences(tcp->tcp_connp, *(uint32_t *)invalp); if (reterr != 0) { *outlenp = 0; return (reterr); } break; default: *outlenp = 0; return (EINVAL); } break; } /* end IPPROTO_IPV6 */ default: *outlenp = 0; return (EINVAL); } /* * Common case of OK return with outval same as inval */ if (invalp != outvalp) { /* don't trust bcopy for identical src/dst */ (void) bcopy(invalp, outvalp, inlen); } *outlenp = inlen; return (0); } /* * Update tcp_sticky_hdrs based on tcp_sticky_ipp. * The headers include ip6i_t (if needed), ip6_t, any sticky extension * headers, and the maximum size tcp header (to avoid reallocation * on the fly for additional tcp options). * Returns failure if can't allocate memory. */ static int tcp_build_hdrs(queue_t *q, tcp_t *tcp) { char *hdrs; uint_t hdrs_len; ip6i_t *ip6i; char buf[TCP_MAX_HDR_LENGTH]; ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; in6_addr_t src, dst; tcp_stack_t *tcps = tcp->tcp_tcps; /* * save the existing tcp header and source/dest IP addresses */ bcopy(tcp->tcp_tcph, buf, tcp->tcp_tcp_hdr_len); src = tcp->tcp_ip6h->ip6_src; dst = tcp->tcp_ip6h->ip6_dst; hdrs_len = ip_total_hdrs_len_v6(ipp) + TCP_MAX_HDR_LENGTH; ASSERT(hdrs_len != 0); if (hdrs_len > tcp->tcp_iphc_len) { /* Need to reallocate */ hdrs = kmem_zalloc(hdrs_len, KM_NOSLEEP); if (hdrs == NULL) return (ENOMEM); if (tcp->tcp_iphc != NULL) { if (tcp->tcp_hdr_grown) { kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); } else { bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); } tcp->tcp_iphc_len = 0; } ASSERT(tcp->tcp_iphc_len == 0); tcp->tcp_iphc = hdrs; tcp->tcp_iphc_len = hdrs_len; tcp->tcp_hdr_grown = B_TRUE; } ip_build_hdrs_v6((uchar_t *)tcp->tcp_iphc, hdrs_len - TCP_MAX_HDR_LENGTH, ipp, IPPROTO_TCP); /* Set header fields not in ipp */ if (ipp->ipp_fields & IPPF_HAS_IP6I) { ip6i = (ip6i_t *)tcp->tcp_iphc; tcp->tcp_ip6h = (ip6_t *)&ip6i[1]; } else { tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; } /* * tcp->tcp_ip_hdr_len will include ip6i_t if there is one. * * tcp->tcp_tcp_hdr_len doesn't change here. */ tcp->tcp_ip_hdr_len = hdrs_len - TCP_MAX_HDR_LENGTH; tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); tcp->tcp_hdr_len = tcp->tcp_ip_hdr_len + tcp->tcp_tcp_hdr_len; bcopy(buf, tcp->tcp_tcph, tcp->tcp_tcp_hdr_len); tcp->tcp_ip6h->ip6_src = src; tcp->tcp_ip6h->ip6_dst = dst; /* * If the hop limit was not set by ip_build_hdrs_v6(), set it to * the default value for TCP. */ if (!(ipp->ipp_fields & IPPF_UNICAST_HOPS)) tcp->tcp_ip6h->ip6_hops = tcps->tcps_ipv6_hoplimit; /* * If we're setting extension headers after a connection * has been established, and if we have a routing header * among the extension headers, call ip_massage_options_v6 to * manipulate the routing header/ip6_dst set the checksum * difference in the tcp header template. * (This happens in tcp_connect_ipv6 if the routing header * is set prior to the connect.) * Set the tcp_sum to zero first in case we've cleared a * routing header or don't have one at all. */ tcp->tcp_sum = 0; if ((tcp->tcp_state >= TCPS_SYN_SENT) && (tcp->tcp_ipp_fields & IPPF_RTHDR)) { ip6_rthdr_t *rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph); if (rth != NULL) { tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth, tcps->tcps_netstack); tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); } } /* Try to get everything in a single mblk */ (void) mi_set_sth_wroff(RD(q), hdrs_len + tcps->tcps_wroff_xtra); return (0); } /* * Transfer any source route option from ipha to buf/dst in reversed form. */ static int tcp_opt_rev_src_route(ipha_t *ipha, char *buf, uchar_t *dst) { ipoptp_t opts; uchar_t *opt; uint8_t optval; uint8_t optlen; uint32_t len = 0; for (optval = ipoptp_first(&opts, ipha); optval != IPOPT_EOL; optval = ipoptp_next(&opts)) { opt = opts.ipoptp_cur; optlen = opts.ipoptp_len; switch (optval) { int off1, off2; case IPOPT_SSRR: case IPOPT_LSRR: /* Reverse source route */ /* * First entry should be the next to last one in the * current source route (the last entry is our * address.) * The last entry should be the final destination. */ buf[IPOPT_OPTVAL] = (uint8_t)optval; buf[IPOPT_OLEN] = (uint8_t)optlen; off1 = IPOPT_MINOFF_SR - 1; off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; if (off2 < 0) { /* No entries in source route */ break; } bcopy(opt + off2, dst, IP_ADDR_LEN); /* * Note: use src since ipha has not had its src * and dst reversed (it is in the state it was * received. */ bcopy(&ipha->ipha_src, buf + off2, IP_ADDR_LEN); off2 -= IP_ADDR_LEN; while (off2 > 0) { bcopy(opt + off2, buf + off1, IP_ADDR_LEN); off1 += IP_ADDR_LEN; off2 -= IP_ADDR_LEN; } buf[IPOPT_OFFSET] = IPOPT_MINOFF_SR; buf += optlen; len += optlen; break; } } done: /* Pad the resulting options */ while (len & 0x3) { *buf++ = IPOPT_EOL; len++; } return (len); } /* * Extract and revert a source route from ipha (if any) * and then update the relevant fields in both tcp_t and the standard header. */ static void tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha) { char buf[TCP_MAX_HDR_LENGTH]; uint_t tcph_len; int len; ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); len = IPH_HDR_LENGTH(ipha); if (len == IP_SIMPLE_HDR_LENGTH) /* Nothing to do */ return; if (len > IP_SIMPLE_HDR_LENGTH + TCP_MAX_IP_OPTIONS_LENGTH || (len & 0x3)) return; tcph_len = tcp->tcp_tcp_hdr_len; bcopy(tcp->tcp_tcph, buf, tcph_len); tcp->tcp_sum = (tcp->tcp_ipha->ipha_dst >> 16) + (tcp->tcp_ipha->ipha_dst & 0xffff); len = tcp_opt_rev_src_route(ipha, (char *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH, (uchar_t *)&tcp->tcp_ipha->ipha_dst); len += IP_SIMPLE_HDR_LENGTH; tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + (tcp->tcp_ipha->ipha_dst & 0xffff)); if ((int)tcp->tcp_sum < 0) tcp->tcp_sum--; tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); tcp->tcp_tcph = (tcph_t *)((char *)tcp->tcp_ipha + len); bcopy(buf, tcp->tcp_tcph, tcph_len); tcp->tcp_ip_hdr_len = len; tcp->tcp_ipha->ipha_version_and_hdr_length = (IP_VERSION << 4) | (len >> 2); len += tcph_len; tcp->tcp_hdr_len = len; } /* * Copy the standard header into its new location, * lay in the new options and then update the relevant * fields in both tcp_t and the standard header. */ static int tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len) { uint_t tcph_len; uint8_t *ip_optp; tcph_t *new_tcph; tcp_stack_t *tcps = tcp->tcp_tcps; if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) return (EINVAL); if (len > IP_MAX_OPT_LENGTH - tcp->tcp_label_len) return (EINVAL); if (checkonly) { /* * do not really set, just pretend to - T_CHECK */ return (0); } ip_optp = (uint8_t *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; if (tcp->tcp_label_len > 0) { int padlen; uint8_t opt; /* convert list termination to no-ops */ padlen = tcp->tcp_label_len - ip_optp[IPOPT_OLEN]; ip_optp += ip_optp[IPOPT_OLEN]; opt = len > 0 ? IPOPT_NOP : IPOPT_EOL; while (--padlen >= 0) *ip_optp++ = opt; } tcph_len = tcp->tcp_tcp_hdr_len; new_tcph = (tcph_t *)(ip_optp + len); ovbcopy(tcp->tcp_tcph, new_tcph, tcph_len); tcp->tcp_tcph = new_tcph; bcopy(ptr, ip_optp, len); len += IP_SIMPLE_HDR_LENGTH + tcp->tcp_label_len; tcp->tcp_ip_hdr_len = len; tcp->tcp_ipha->ipha_version_and_hdr_length = (IP_VERSION << 4) | (len >> 2); tcp->tcp_hdr_len = len + tcph_len; if (!TCP_IS_DETACHED(tcp)) { /* Always allocate room for all options. */ (void) mi_set_sth_wroff(tcp->tcp_rq, TCP_MAX_COMBINED_HEADER_LENGTH + tcps->tcps_wroff_xtra); } return (0); } /* Get callback routine passed to nd_load by tcp_param_register */ /* ARGSUSED */ static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { tcpparam_t *tcppa = (tcpparam_t *)cp; (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); return (0); } /* * Walk through the param array specified registering each element with the * named dispatch handler. */ static boolean_t tcp_param_register(IDP *ndp, tcpparam_t *tcppa, int cnt, tcp_stack_t *tcps) { for (; cnt-- > 0; tcppa++) { if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { if (!nd_load(ndp, tcppa->tcp_param_name, tcp_param_get, tcp_param_set, (caddr_t)tcppa)) { nd_free(ndp); return (B_FALSE); } } } tcps->tcps_wroff_xtra_param = kmem_zalloc(sizeof (tcpparam_t), KM_SLEEP); bcopy(&lcl_tcp_wroff_xtra_param, tcps->tcps_wroff_xtra_param, sizeof (tcpparam_t)); if (!nd_load(ndp, tcps->tcps_wroff_xtra_param->tcp_param_name, tcp_param_get, tcp_param_set_aligned, (caddr_t)tcps->tcps_wroff_xtra_param)) { nd_free(ndp); return (B_FALSE); } tcps->tcps_mdt_head_param = kmem_zalloc(sizeof (tcpparam_t), KM_SLEEP); bcopy(&lcl_tcp_mdt_head_param, tcps->tcps_mdt_head_param, sizeof (tcpparam_t)); if (!nd_load(ndp, tcps->tcps_mdt_head_param->tcp_param_name, tcp_param_get, tcp_param_set_aligned, (caddr_t)tcps->tcps_mdt_head_param)) { nd_free(ndp); return (B_FALSE); } tcps->tcps_mdt_tail_param = kmem_zalloc(sizeof (tcpparam_t), KM_SLEEP); bcopy(&lcl_tcp_mdt_tail_param, tcps->tcps_mdt_tail_param, sizeof (tcpparam_t)); if (!nd_load(ndp, tcps->tcps_mdt_tail_param->tcp_param_name, tcp_param_get, tcp_param_set_aligned, (caddr_t)tcps->tcps_mdt_tail_param)) { nd_free(ndp); return (B_FALSE); } tcps->tcps_mdt_max_pbufs_param = kmem_zalloc(sizeof (tcpparam_t), KM_SLEEP); bcopy(&lcl_tcp_mdt_max_pbufs_param, tcps->tcps_mdt_max_pbufs_param, sizeof (tcpparam_t)); if (!nd_load(ndp, tcps->tcps_mdt_max_pbufs_param->tcp_param_name, tcp_param_get, tcp_param_set_aligned, (caddr_t)tcps->tcps_mdt_max_pbufs_param)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_extra_priv_ports", tcp_extra_priv_ports_get, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_extra_priv_ports_add", NULL, tcp_extra_priv_ports_add, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_extra_priv_ports_del", NULL, tcp_extra_priv_ports_del, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_status", tcp_status_report, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_bind_hash", tcp_bind_hash_report, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_listen_hash", tcp_listen_hash_report, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_conn_hash", tcp_conn_hash_report, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_acceptor_hash", tcp_acceptor_hash_report, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_host_param", tcp_host_param_report, tcp_host_param_set, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_host_param_ipv6", tcp_host_param_report, tcp_host_param_set_ipv6, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_1948_phrase", NULL, tcp_1948_phrase_set, NULL)) { nd_free(ndp); return (B_FALSE); } if (!nd_load(ndp, "tcp_reserved_port_list", tcp_reserved_port_list, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } /* * Dummy ndd variables - only to convey obsolescence information * through printing of their name (no get or set routines) * XXX Remove in future releases ? */ if (!nd_load(ndp, "tcp_close_wait_interval(obsoleted - " "use tcp_time_wait_interval)", NULL, NULL, NULL)) { nd_free(ndp); return (B_FALSE); } return (B_TRUE); } /* ndd set routine for tcp_wroff_xtra, tcp_mdt_hdr_{head,tail}_min. */ /* ARGSUSED */ static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) { long new_value; tcpparam_t *tcppa = (tcpparam_t *)cp; if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value < tcppa->tcp_param_min || new_value > tcppa->tcp_param_max) { return (EINVAL); } /* * Need to make sure new_value is a multiple of 4. If it is not, * round it up. For future 64 bit requirement, we actually make it * a multiple of 8. */ if (new_value & 0x7) { new_value = (new_value & ~0x7) + 0x8; } tcppa->tcp_param_val = new_value; return (0); } /* Set callback routine passed to nd_load by tcp_param_register */ /* ARGSUSED */ static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) { long new_value; tcpparam_t *tcppa = (tcpparam_t *)cp; if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value < tcppa->tcp_param_min || new_value > tcppa->tcp_param_max) { return (EINVAL); } tcppa->tcp_param_val = new_value; return (0); } /* * Add a new piece to the tcp reassembly queue. If the gap at the beginning * is filled, return as much as we can. The message passed in may be * multi-part, chained using b_cont. "start" is the starting sequence * number for this piece. */ static mblk_t * tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) { uint32_t end; mblk_t *mp1; mblk_t *mp2; mblk_t *next_mp; uint32_t u1; tcp_stack_t *tcps = tcp->tcp_tcps; /* Walk through all the new pieces. */ do { ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); end = start + (int)(mp->b_wptr - mp->b_rptr); next_mp = mp->b_cont; if (start == end) { /* Empty. Blast it. */ freeb(mp); continue; } mp->b_cont = NULL; TCP_REASS_SET_SEQ(mp, start); TCP_REASS_SET_END(mp, end); mp1 = tcp->tcp_reass_tail; if (!mp1) { tcp->tcp_reass_tail = mp; tcp->tcp_reass_head = mp; BUMP_MIB(&tcps->tcps_mib, tcpInDataUnorderSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataUnorderBytes, end - start); continue; } /* New stuff completely beyond tail? */ if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { /* Link it on end. */ mp1->b_cont = mp; tcp->tcp_reass_tail = mp; BUMP_MIB(&tcps->tcps_mib, tcpInDataUnorderSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataUnorderBytes, end - start); continue; } mp1 = tcp->tcp_reass_head; u1 = TCP_REASS_SEQ(mp1); /* New stuff at the front? */ if (SEQ_LT(start, u1)) { /* Yes... Check for overlap. */ mp->b_cont = mp1; tcp->tcp_reass_head = mp; tcp_reass_elim_overlap(tcp, mp); continue; } /* * The new piece fits somewhere between the head and tail. * We find our slot, where mp1 precedes us and mp2 trails. */ for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { u1 = TCP_REASS_SEQ(mp2); if (SEQ_LEQ(start, u1)) break; } /* Link ourselves in */ mp->b_cont = mp2; mp1->b_cont = mp; /* Trim overlap with following mblk(s) first */ tcp_reass_elim_overlap(tcp, mp); /* Trim overlap with preceding mblk */ tcp_reass_elim_overlap(tcp, mp1); } while (start = end, mp = next_mp); mp1 = tcp->tcp_reass_head; /* Anything ready to go? */ if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) return (NULL); /* Eat what we can off the queue */ for (;;) { mp = mp1->b_cont; end = TCP_REASS_END(mp1); TCP_REASS_SET_SEQ(mp1, 0); TCP_REASS_SET_END(mp1, 0); if (!mp) { tcp->tcp_reass_tail = NULL; break; } if (end != TCP_REASS_SEQ(mp)) { mp1->b_cont = NULL; break; } mp1 = mp; } mp1 = tcp->tcp_reass_head; tcp->tcp_reass_head = mp; return (mp1); } /* Eliminate any overlap that mp may have over later mblks */ static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) { uint32_t end; mblk_t *mp1; uint32_t u1; tcp_stack_t *tcps = tcp->tcp_tcps; end = TCP_REASS_END(mp); while ((mp1 = mp->b_cont) != NULL) { u1 = TCP_REASS_SEQ(mp1); if (!SEQ_GT(end, u1)) break; if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { mp->b_wptr -= end - u1; TCP_REASS_SET_END(mp, u1); BUMP_MIB(&tcps->tcps_mib, tcpInDataPartDupSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataPartDupBytes, end - u1); break; } mp->b_cont = mp1->b_cont; TCP_REASS_SET_SEQ(mp1, 0); TCP_REASS_SET_END(mp1, 0); freeb(mp1); BUMP_MIB(&tcps->tcps_mib, tcpInDataDupSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataDupBytes, end - u1); } if (!mp1) tcp->tcp_reass_tail = mp; } /* * Send up all messages queued on tcp_rcv_list. */ static uint_t tcp_rcv_drain(queue_t *q, tcp_t *tcp) { mblk_t *mp; uint_t ret = 0; uint_t thwin; #ifdef DEBUG uint_t cnt = 0; #endif tcp_stack_t *tcps = tcp->tcp_tcps; /* Can't drain on an eager connection */ if (tcp->tcp_listener != NULL) return (ret); /* Can't be sodirect enabled */ ASSERT(SOD_NOT_ENABLED(tcp)); /* No need for the push timer now. */ if (tcp->tcp_push_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); tcp->tcp_push_tid = 0; } /* * Handle two cases here: we are currently fused or we were * previously fused and have some urgent data to be delivered * upstream. The latter happens because we either ran out of * memory or were detached and therefore sending the SIGURG was * deferred until this point. In either case we pass control * over to tcp_fuse_rcv_drain() since it may need to complete * some work. */ if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { ASSERT(tcp->tcp_fused_sigurg_mp != NULL); if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : &tcp->tcp_fused_sigurg_mp)) return (ret); } while ((mp = tcp->tcp_rcv_list) != NULL) { tcp->tcp_rcv_list = mp->b_next; mp->b_next = NULL; #ifdef DEBUG cnt += msgdsize(mp); #endif /* Does this need SSL processing first? */ if ((tcp->tcp_kssl_ctx != NULL) && (DB_TYPE(mp) == M_DATA)) { DTRACE_PROBE1(kssl_mblk__ksslinput_rcvdrain, mblk_t *, mp); tcp_kssl_input(tcp, mp); continue; } putnext(q, mp); } ASSERT(cnt == tcp->tcp_rcv_cnt); tcp->tcp_rcv_last_head = NULL; tcp->tcp_rcv_last_tail = NULL; tcp->tcp_rcv_cnt = 0; /* Learn the latest rwnd information that we sent to the other side. */ thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) << tcp->tcp_rcv_ws; /* This is peer's calculated send window (our receive window). */ thwin -= tcp->tcp_rnxt - tcp->tcp_rack; /* * Increase the receive window to max. But we need to do receiver * SWS avoidance. This means that we need to check the increase of * of receive window is at least 1 MSS. */ if (canputnext(q) && (q->q_hiwat - thwin >= tcp->tcp_mss)) { /* * If the window that the other side knows is less than max * deferred acks segments, send an update immediately. */ if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { BUMP_MIB(&tcps->tcps_mib, tcpOutWinUpdate); ret = TH_ACK_NEEDED; } tcp->tcp_rwnd = q->q_hiwat; } return (ret); } /* * Queue data on tcp_rcv_list which is a b_next chain. * tcp_rcv_last_head/tail is the last element of this chain. * Each element of the chain is a b_cont chain. * * M_DATA messages are added to the current element. * Other messages are added as new (b_next) elements. */ void tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len) { ASSERT(seg_len == msgdsize(mp)); ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); if (tcp->tcp_rcv_list == NULL) { ASSERT(tcp->tcp_rcv_last_head == NULL); tcp->tcp_rcv_list = mp; tcp->tcp_rcv_last_head = mp; } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { tcp->tcp_rcv_last_tail->b_cont = mp; } else { tcp->tcp_rcv_last_head->b_next = mp; tcp->tcp_rcv_last_head = mp; } while (mp->b_cont) mp = mp->b_cont; tcp->tcp_rcv_last_tail = mp; tcp->tcp_rcv_cnt += seg_len; tcp->tcp_rwnd -= seg_len; } /* * The tcp_rcv_sod_XXX() functions enqueue data directly to the socket * above, in addition when uioa is enabled schedule an asynchronous uio * prior to enqueuing. They implement the combinhed semantics of the * tcp_rcv_XXX() functions, tcp_rcv_list push logic, and STREAMS putnext() * canputnext(), i.e. flow-control with backenable. * * tcp_sod_wakeup() is called where tcp_rcv_drain() would be called in the * non sodirect connection but as there are no tcp_tcv_list mblk_t's we deal * with the rcv_wnd and push timer and call the sodirect wakeup function. * * Must be called with sodp->sod_lock held and will return with the lock * released. */ static uint_t tcp_rcv_sod_wakeup(tcp_t *tcp, sodirect_t *sodp) { queue_t *q = tcp->tcp_rq; uint_t thwin; tcp_stack_t *tcps = tcp->tcp_tcps; uint_t ret = 0; /* Can't be an eager connection */ ASSERT(tcp->tcp_listener == NULL); /* Caller must have lock held */ ASSERT(MUTEX_HELD(sodp->sod_lock)); /* Sodirect mode so must not be a tcp_rcv_list */ ASSERT(tcp->tcp_rcv_list == NULL); if (SOD_QFULL(sodp)) { /* Q is full, mark Q for need backenable */ SOD_QSETBE(sodp); } /* Last advertised rwnd, i.e. rwnd last sent in a packet */ thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) << tcp->tcp_rcv_ws; /* This is peer's calculated send window (our available rwnd). */ thwin -= tcp->tcp_rnxt - tcp->tcp_rack; /* * Increase the receive window to max. But we need to do receiver * SWS avoidance. This means that we need to check the increase of * of receive window is at least 1 MSS. */ if (!SOD_QFULL(sodp) && (q->q_hiwat - thwin >= tcp->tcp_mss)) { /* * If the window that the other side knows is less than max * deferred acks segments, send an update immediately. */ if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { BUMP_MIB(&tcps->tcps_mib, tcpOutWinUpdate); ret = TH_ACK_NEEDED; } tcp->tcp_rwnd = q->q_hiwat; } if (!SOD_QEMPTY(sodp)) { /* Wakeup to socket */ sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_DONE; (sodp->sod_wakeup)(sodp); /* wakeup() does the mutex_ext() */ } else { /* Q is empty, no need to wake */ sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_NOT; mutex_exit(sodp->sod_lock); } /* No need for the push timer now. */ if (tcp->tcp_push_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); tcp->tcp_push_tid = 0; } return (ret); } /* * Called where tcp_rcv_enqueue()/putnext(RD(q)) would be. For M_DATA * mblk_t's if uioa enabled then start a uioa asynchronous copy directly * to the user-land buffer and flag the mblk_t as such. * * Also, handle tcp_rwnd. */ uint_t tcp_rcv_sod_enqueue(tcp_t *tcp, sodirect_t *sodp, mblk_t *mp, uint_t seg_len) { uioa_t *uioap = &sodp->sod_uioa; boolean_t qfull; uint_t thwin; /* Can't be an eager connection */ ASSERT(tcp->tcp_listener == NULL); /* Caller must have lock held */ ASSERT(MUTEX_HELD(sodp->sod_lock)); /* Sodirect mode so must not be a tcp_rcv_list */ ASSERT(tcp->tcp_rcv_list == NULL); /* Passed in segment length must be equal to mblk_t chain data size */ ASSERT(seg_len == msgdsize(mp)); if (DB_TYPE(mp) != M_DATA) { /* Only process M_DATA mblk_t's */ goto enq; } if (uioap->uioa_state & UIOA_ENABLED) { /* Uioa is enabled */ mblk_t *mp1 = mp; if (seg_len > uioap->uio_resid) { /* * There isn't enough uio space for the mblk_t chain * so disable uioa such that this and any additional * mblk_t data is handled by the socket and schedule * the socket for wakeup to finish this uioa. */ uioap->uioa_state &= UIOA_CLR; uioap->uioa_state |= UIOA_FINI; if (sodp->sod_state & SOD_WAKE_NOT) { sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_NEED; } goto enq; } do { uint32_t len = MBLKL(mp1); if (!uioamove(mp1->b_rptr, len, UIO_READ, uioap)) { /* Scheduled, mark dblk_t as such */ DB_FLAGS(mp1) |= DBLK_UIOA; } else { /* Error, turn off async processing */ uioap->uioa_state &= UIOA_CLR; uioap->uioa_state |= UIOA_FINI; break; } } while ((mp1 = mp1->b_cont) != NULL); if (mp1 != NULL || uioap->uio_resid == 0) { /* * Not all mblk_t(s) uioamoved (error) or all uio * space has been consumed so schedule the socket * for wakeup to finish this uio. */ sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_NEED; } } else if (uioap->uioa_state & UIOA_FINI) { /* * Post UIO_ENABLED waiting for socket to finish processing * so just enqueue and update tcp_rwnd. */ if (SOD_QFULL(sodp)) tcp->tcp_rwnd -= seg_len; } else if (sodp->sod_want > 0) { /* * Uioa isn't enabled but sodirect has a pending read(). */ if (SOD_QCNT(sodp) + seg_len >= sodp->sod_want) { if (sodp->sod_state & SOD_WAKE_NOT) { /* Schedule socket for wakeup */ sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_NEED; } tcp->tcp_rwnd -= seg_len; } } else if (SOD_QCNT(sodp) + seg_len >= tcp->tcp_rq->q_hiwat >> 3) { /* * No pending sodirect read() so used the default * TCP push logic to guess that a push is needed. */ if (sodp->sod_state & SOD_WAKE_NOT) { /* Schedule socket for wakeup */ sodp->sod_state &= SOD_WAKE_CLR; sodp->sod_state |= SOD_WAKE_NEED; } tcp->tcp_rwnd -= seg_len; } else { /* Just update tcp_rwnd */ tcp->tcp_rwnd -= seg_len; } enq: qfull = SOD_QFULL(sodp); (sodp->sod_enqueue)(sodp, mp); if (! qfull && SOD_QFULL(sodp)) { /* Wasn't QFULL, now QFULL, need back-enable */ SOD_QSETBE(sodp); } /* * Check to see if remote avail swnd < mss due to delayed ACK, * first get advertised rwnd. */ thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)); /* Minus delayed ACK count */ thwin -= tcp->tcp_rnxt - tcp->tcp_rack; if (thwin < tcp->tcp_mss) { /* Remote avail swnd < mss, need ACK now */ return (TH_ACK_NEEDED); } return (0); } /* * DEFAULT TCP ENTRY POINT via squeue on READ side. * * This is the default entry function into TCP on the read side. TCP is * always entered via squeue i.e. using squeue's for mutual exclusion. * When classifier does a lookup to find the tcp, it also puts a reference * on the conn structure associated so the tcp is guaranteed to exist * when we come here. We still need to check the state because it might * as well has been closed. The squeue processing function i.e. squeue_enter, * squeue_enter_nodrain, or squeue_drain is responsible for doing the * CONN_DEC_REF. * * Apart from the default entry point, IP also sends packets directly to * tcp_rput_data for AF_INET fast path and tcp_conn_request for incoming * connections. */ void tcp_input(void *arg, mblk_t *mp, void *arg2) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = (tcp_t *)connp->conn_tcp; /* arg2 is the sqp */ ASSERT(arg2 != NULL); ASSERT(mp != NULL); /* * Don't accept any input on a closed tcp as this TCP logically does * not exist on the system. Don't proceed further with this TCP. * For eg. this packet could trigger another close of this tcp * which would be disastrous for tcp_refcnt. tcp_close_detached / * tcp_clean_death / tcp_closei_local must be called at most once * on a TCP. In this case we need to refeed the packet into the * classifier and figure out where the packet should go. Need to * preserve the recv_ill somehow. Until we figure that out, for * now just drop the packet if we can't classify the packet. */ if (tcp->tcp_state == TCPS_CLOSED || tcp->tcp_state == TCPS_BOUND) { conn_t *new_connp; ip_stack_t *ipst = tcp->tcp_tcps->tcps_netstack->netstack_ip; new_connp = ipcl_classify(mp, connp->conn_zoneid, ipst); if (new_connp != NULL) { tcp_reinput(new_connp, mp, arg2); return; } /* We failed to classify. For now just drop the packet */ freemsg(mp); return; } if (DB_TYPE(mp) == M_DATA) tcp_rput_data(connp, mp, arg2); else tcp_rput_common(tcp, mp); } /* * The read side put procedure. * The packets passed up by ip are assume to be aligned according to * OK_32PTR and the IP+TCP headers fitting in the first mblk. */ static void tcp_rput_common(tcp_t *tcp, mblk_t *mp) { /* * tcp_rput_data() does not expect M_CTL except for the case * where tcp_ipv6_recvancillary is set and we get a IN_PKTINFO * type. Need to make sure that any other M_CTLs don't make * it to tcp_rput_data since it is not expecting any and doesn't * check for it. */ if (DB_TYPE(mp) == M_CTL) { switch (*(uint32_t *)(mp->b_rptr)) { case TCP_IOC_ABORT_CONN: /* * Handle connection abort request. */ tcp_ioctl_abort_handler(tcp, mp); return; case IPSEC_IN: /* * Only secure icmp arrive in TCP and they * don't go through data path. */ tcp_icmp_error(tcp, mp); return; case IN_PKTINFO: /* * Handle IPV6_RECVPKTINFO socket option on AF_INET6 * sockets that are receiving IPv4 traffic. tcp */ ASSERT(tcp->tcp_family == AF_INET6); ASSERT(tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO); tcp_rput_data(tcp->tcp_connp, mp, tcp->tcp_connp->conn_sqp); return; case MDT_IOC_INFO_UPDATE: /* * Handle Multidata information update; the * following routine will free the message. */ if (tcp->tcp_connp->conn_mdt_ok) { tcp_mdt_update(tcp, &((ip_mdt_info_t *)mp->b_rptr)->mdt_capab, B_FALSE); } freemsg(mp); return; case LSO_IOC_INFO_UPDATE: /* * Handle LSO information update; the following * routine will free the message. */ if (tcp->tcp_connp->conn_lso_ok) { tcp_lso_update(tcp, &((ip_lso_info_t *)mp->b_rptr)->lso_capab); } freemsg(mp); return; default: /* * tcp_icmp_err() will process the M_CTL packets. * Non-ICMP packets, if any, will be discarded in * tcp_icmp_err(). We will process the ICMP packet * even if we are TCP_IS_DETACHED_NONEAGER as the * incoming ICMP packet may result in changing * the tcp_mss, which we would need if we have * packets to retransmit. */ tcp_icmp_error(tcp, mp); return; } } /* No point processing the message if tcp is already closed */ if (TCP_IS_DETACHED_NONEAGER(tcp)) { freemsg(mp); return; } tcp_rput_other(tcp, mp); } /* The minimum of smoothed mean deviation in RTO calculation. */ #define TCP_SD_MIN 400 /* * Set RTO for this connection. The formula is from Jacobson and Karels' * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names * are the same as those in Appendix A.2 of that paper. * * m = new measurement * sa = smoothed RTT average (8 * average estimates). * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). */ static void tcp_set_rto(tcp_t *tcp, clock_t rtt) { long m = TICK_TO_MSEC(rtt); clock_t sa = tcp->tcp_rtt_sa; clock_t sv = tcp->tcp_rtt_sd; clock_t rto; tcp_stack_t *tcps = tcp->tcp_tcps; BUMP_MIB(&tcps->tcps_mib, tcpRttUpdate); tcp->tcp_rtt_update++; /* tcp_rtt_sa is not 0 means this is a new sample. */ if (sa != 0) { /* * Update average estimator: * new rtt = 7/8 old rtt + 1/8 Error */ /* m is now Error in estimate. */ m -= sa >> 3; if ((sa += m) <= 0) { /* * Don't allow the smoothed average to be negative. * We use 0 to denote reinitialization of the * variables. */ sa = 1; } /* * Update deviation estimator: * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) */ if (m < 0) m = -m; m -= sv >> 2; sv += m; } else { /* * This follows BSD's implementation. So the reinitialized * RTO is 3 * m. We cannot go less than 2 because if the * link is bandwidth dominated, doubling the window size * during slow start means doubling the RTT. We want to be * more conservative when we reinitialize our estimates. 3 * is just a convenient number. */ sa = m << 3; sv = m << 1; } if (sv < TCP_SD_MIN) { /* * We do not know that if sa captures the delay ACK * effect as in a long train of segments, a receiver * does not delay its ACKs. So set the minimum of sv * to be TCP_SD_MIN, which is default to 400 ms, twice * of BSD DATO. That means the minimum of mean * deviation is 100 ms. * */ sv = TCP_SD_MIN; } tcp->tcp_rtt_sa = sa; tcp->tcp_rtt_sd = sv; /* * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) * * Add tcp_rexmit_interval extra in case of extreme environment * where the algorithm fails to work. The default value of * tcp_rexmit_interval_extra should be 0. * * As we use a finer grained clock than BSD and update * RTO for every ACKs, add in another .25 of RTT to the * deviation of RTO to accomodate burstiness of 1/4 of * window size. */ rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5); if (rto > tcps->tcps_rexmit_interval_max) { tcp->tcp_rto = tcps->tcps_rexmit_interval_max; } else if (rto < tcps->tcps_rexmit_interval_min) { tcp->tcp_rto = tcps->tcps_rexmit_interval_min; } else { tcp->tcp_rto = rto; } /* Now, we can reset tcp_timer_backoff to use the new RTO... */ tcp->tcp_timer_backoff = 0; } /* * tcp_get_seg_mp() is called to get the pointer to a segment in the * send queue which starts at the given seq. no. * * Parameters: * tcp_t *tcp: the tcp instance pointer. * uint32_t seq: the starting seq. no of the requested segment. * int32_t *off: after the execution, *off will be the offset to * the returned mblk which points to the requested seq no. * It is the caller's responsibility to send in a non-null off. * * Return: * A mblk_t pointer pointing to the requested segment in send queue. */ static mblk_t * tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off) { int32_t cnt; mblk_t *mp; /* Defensive coding. Make sure we don't send incorrect data. */ if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) return (NULL); cnt = seq - tcp->tcp_suna; mp = tcp->tcp_xmit_head; while (cnt > 0 && mp != NULL) { cnt -= mp->b_wptr - mp->b_rptr; if (cnt < 0) { cnt += mp->b_wptr - mp->b_rptr; break; } mp = mp->b_cont; } ASSERT(mp != NULL); *off = cnt; return (mp); } /* * This function handles all retransmissions if SACK is enabled for this * connection. First it calculates how many segments can be retransmitted * based on tcp_pipe. Then it goes thru the notsack list to find eligible * segments. A segment is eligible if sack_cnt for that segment is greater * than or equal tcp_dupack_fast_retransmit. After it has retransmitted * all eligible segments, it checks to see if TCP can send some new segments * (fast recovery). If it can, set the appropriate flag for tcp_rput_data(). * * Parameters: * tcp_t *tcp: the tcp structure of the connection. * uint_t *flags: in return, appropriate value will be set for * tcp_rput_data(). */ static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags) { notsack_blk_t *notsack_blk; int32_t usable_swnd; int32_t mss; uint32_t seg_len; mblk_t *xmit_mp; tcp_stack_t *tcps = tcp->tcp_tcps; ASSERT(tcp->tcp_sack_info != NULL); ASSERT(tcp->tcp_notsack_list != NULL); ASSERT(tcp->tcp_rexmit == B_FALSE); /* Defensive coding in case there is a bug... */ if (tcp->tcp_notsack_list == NULL) { return; } notsack_blk = tcp->tcp_notsack_list; mss = tcp->tcp_mss; /* * Limit the num of outstanding data in the network to be * tcp_cwnd_ssthresh, which is half of the original congestion wnd. */ usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; /* At least retransmit 1 MSS of data. */ if (usable_swnd <= 0) { usable_swnd = mss; } /* Make sure no new RTT samples will be taken. */ tcp->tcp_csuna = tcp->tcp_snxt; notsack_blk = tcp->tcp_notsack_list; while (usable_swnd > 0) { mblk_t *snxt_mp, *tmp_mp; tcp_seq begin = tcp->tcp_sack_snxt; tcp_seq end; int32_t off; for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) { if (SEQ_GT(notsack_blk->end, begin) && (notsack_blk->sack_cnt >= tcps->tcps_dupack_fast_retransmit)) { end = notsack_blk->end; if (SEQ_LT(begin, notsack_blk->begin)) { begin = notsack_blk->begin; } break; } } /* * All holes are filled. Manipulate tcp_cwnd to send more * if we can. Note that after the SACK recovery, tcp_cwnd is * set to tcp_cwnd_ssthresh. */ if (notsack_blk == NULL) { usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; if (usable_swnd <= 0 || tcp->tcp_unsent == 0) { tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna; ASSERT(tcp->tcp_cwnd > 0); return; } else { usable_swnd = usable_swnd / mss; tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna + MAX(usable_swnd * mss, mss); *flags |= TH_XMIT_NEEDED; return; } } /* * Note that we may send more than usable_swnd allows here * because of round off, but no more than 1 MSS of data. */ seg_len = end - begin; if (seg_len > mss) seg_len = mss; snxt_mp = tcp_get_seg_mp(tcp, begin, &off); ASSERT(snxt_mp != NULL); /* This should not happen. Defensive coding again... */ if (snxt_mp == NULL) { return; } xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off, &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE); if (xmit_mp == NULL) return; usable_swnd -= seg_len; tcp->tcp_pipe += seg_len; tcp->tcp_sack_snxt = begin + seg_len; TCP_RECORD_TRACE(tcp, xmit_mp, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); /* * Update the send timestamp to avoid false retransmission. */ snxt_mp->b_prev = (mblk_t *)lbolt; BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, seg_len); BUMP_MIB(&tcps->tcps_mib, tcpOutSackRetransSegs); /* * Update tcp_rexmit_max to extend this SACK recovery phase. * This happens when new data sent during fast recovery is * also lost. If TCP retransmits those new data, it needs * to extend SACK recover phase to avoid starting another * fast retransmit/recovery unnecessarily. */ if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) { tcp->tcp_rexmit_max = tcp->tcp_sack_snxt; } } } /* * This function handles policy checking at TCP level for non-hard_bound/ * detached connections. */ static boolean_t tcp_check_policy(tcp_t *tcp, mblk_t *first_mp, ipha_t *ipha, ip6_t *ip6h, boolean_t secure, boolean_t mctl_present) { ipsec_latch_t *ipl = NULL; ipsec_action_t *act = NULL; mblk_t *data_mp; ipsec_in_t *ii; const char *reason; kstat_named_t *counter; tcp_stack_t *tcps = tcp->tcp_tcps; ipsec_stack_t *ipss; ip_stack_t *ipst; ASSERT(mctl_present || !secure); ASSERT((ipha == NULL && ip6h != NULL) || (ip6h == NULL && ipha != NULL)); /* * We don't necessarily have an ipsec_in_act action to verify * policy because of assymetrical policy where we have only * outbound policy and no inbound policy (possible with global * policy). */ if (!secure) { if (act == NULL || act->ipa_act.ipa_type == IPSEC_ACT_BYPASS || act->ipa_act.ipa_type == IPSEC_ACT_CLEAR) return (B_TRUE); ipsec_log_policy_failure(IPSEC_POLICY_MISMATCH, "tcp_check_policy", ipha, ip6h, secure, tcps->tcps_netstack); ipss = tcps->tcps_netstack->netstack_ipsec; ip_drop_packet(first_mp, B_TRUE, NULL, NULL, DROPPER(ipss, ipds_tcp_clear), &tcps->tcps_dropper); return (B_FALSE); } /* * We have a secure packet. */ if (act == NULL) { ipsec_log_policy_failure(IPSEC_POLICY_NOT_NEEDED, "tcp_check_policy", ipha, ip6h, secure, tcps->tcps_netstack); ipss = tcps->tcps_netstack->netstack_ipsec; ip_drop_packet(first_mp, B_TRUE, NULL, NULL, DROPPER(ipss, ipds_tcp_secure), &tcps->tcps_dropper); return (B_FALSE); } /* * XXX This whole routine is currently incorrect. ipl should * be set to the latch pointer, but is currently not set, so * we initialize it to NULL to avoid picking up random garbage. */ if (ipl == NULL) return (B_TRUE); data_mp = first_mp->b_cont; ii = (ipsec_in_t *)first_mp->b_rptr; ipst = tcps->tcps_netstack->netstack_ip; if (ipsec_check_ipsecin_latch(ii, data_mp, ipl, ipha, ip6h, &reason, &counter, tcp->tcp_connp)) { BUMP_MIB(&ipst->ips_ip_mib, ipsecInSucceeded); return (B_TRUE); } (void) strlog(TCP_MOD_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE, "tcp inbound policy mismatch: %s, packet dropped\n", reason); BUMP_MIB(&ipst->ips_ip_mib, ipsecInFailed); ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter, &tcps->tcps_dropper); return (B_FALSE); } /* * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start * retransmission after a timeout. * * To limit the number of duplicate segments, we limit the number of segment * to be sent in one time to tcp_snd_burst, the burst variable. */ static void tcp_ss_rexmit(tcp_t *tcp) { uint32_t snxt; uint32_t smax; int32_t win; int32_t mss; int32_t off; int32_t burst = tcp->tcp_snd_burst; mblk_t *snxt_mp; tcp_stack_t *tcps = tcp->tcp_tcps; /* * Note that tcp_rexmit can be set even though TCP has retransmitted * all unack'ed segments. */ if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) { smax = tcp->tcp_rexmit_max; snxt = tcp->tcp_rexmit_nxt; if (SEQ_LT(snxt, tcp->tcp_suna)) { snxt = tcp->tcp_suna; } win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd); win -= snxt - tcp->tcp_suna; mss = tcp->tcp_mss; snxt_mp = tcp_get_seg_mp(tcp, snxt, &off); while (SEQ_LT(snxt, smax) && (win > 0) && (burst > 0) && (snxt_mp != NULL)) { mblk_t *xmit_mp; mblk_t *old_snxt_mp = snxt_mp; uint32_t cnt = mss; if (win < cnt) { cnt = win; } if (SEQ_GT(snxt + cnt, smax)) { cnt = smax - snxt; } xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off, &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE); if (xmit_mp == NULL) return; tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); snxt += cnt; win -= cnt; /* * Update the send timestamp to avoid false * retransmission. */ old_snxt_mp->b_prev = (mblk_t *)lbolt; BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, cnt); tcp->tcp_rexmit_nxt = snxt; burst--; } /* * If we have transmitted all we have at the time * we started the retranmission, we can leave * the rest of the job to tcp_wput_data(). But we * need to check the send window first. If the * win is not 0, go on with tcp_wput_data(). */ if (SEQ_LT(snxt, smax) || win == 0) { return; } } /* Only call tcp_wput_data() if there is data to be sent. */ if (tcp->tcp_unsent) { tcp_wput_data(tcp, NULL, B_FALSE); } } /* * Process all TCP option in SYN segment. Note that this function should * be called after tcp_adapt_ire() is called so that the necessary info * from IRE is already set in the tcp structure. * * This function sets up the correct tcp_mss value according to the * MSS option value and our header size. It also sets up the window scale * and timestamp values, and initialize SACK info blocks. But it does not * change receive window size after setting the tcp_mss value. The caller * should do the appropriate change. */ void tcp_process_options(tcp_t *tcp, tcph_t *tcph) { int options; tcp_opt_t tcpopt; uint32_t mss_max; char *tmp_tcph; tcp_stack_t *tcps = tcp->tcp_tcps; tcpopt.tcp = NULL; options = tcp_parse_options(tcph, &tcpopt); /* * Process MSS option. Note that MSS option value does not account * for IP or TCP options. This means that it is equal to MTU - minimum * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for * IPv6. */ if (!(options & TCP_OPT_MSS_PRESENT)) { if (tcp->tcp_ipversion == IPV4_VERSION) tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4; else tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6; } else { if (tcp->tcp_ipversion == IPV4_VERSION) mss_max = tcps->tcps_mss_max_ipv4; else mss_max = tcps->tcps_mss_max_ipv6; if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min) tcpopt.tcp_opt_mss = tcps->tcps_mss_min; else if (tcpopt.tcp_opt_mss > mss_max) tcpopt.tcp_opt_mss = mss_max; } /* Process Window Scale option. */ if (options & TCP_OPT_WSCALE_PRESENT) { tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; tcp->tcp_snd_ws_ok = B_TRUE; } else { tcp->tcp_snd_ws = B_FALSE; tcp->tcp_snd_ws_ok = B_FALSE; tcp->tcp_rcv_ws = B_FALSE; } /* Process Timestamp option. */ if ((options & TCP_OPT_TSTAMP_PRESENT) && (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { tmp_tcph = (char *)tcp->tcp_tcph; tcp->tcp_snd_ts_ok = B_TRUE; tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; tcp->tcp_last_rcv_lbolt = lbolt64; ASSERT(OK_32PTR(tmp_tcph)); ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); /* Fill in our template header with basic timestamp option. */ tmp_tcph += tcp->tcp_tcp_hdr_len; tmp_tcph[0] = TCPOPT_NOP; tmp_tcph[1] = TCPOPT_NOP; tmp_tcph[2] = TCPOPT_TSTAMP; tmp_tcph[3] = TCPOPT_TSTAMP_LEN; tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN; tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN; tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4); } else { tcp->tcp_snd_ts_ok = B_FALSE; } /* * Process SACK options. If SACK is enabled for this connection, * then allocate the SACK info structure. Note the following ways * when tcp_snd_sack_ok is set to true. * * For active connection: in tcp_adapt_ire() called in * tcp_rput_other(), or in tcp_rput_other() when tcp_sack_permitted * is checked. * * For passive connection: in tcp_adapt_ire() called in * tcp_accept_comm(). * * That's the reason why the extra TCP_IS_DETACHED() check is there. * That check makes sure that if we did not send a SACK OK option, * we will not enable SACK for this connection even though the other * side sends us SACK OK option. For active connection, the SACK * info structure has already been allocated. So we need to free * it if SACK is disabled. */ if ((options & TCP_OPT_SACK_OK_PRESENT) && (tcp->tcp_snd_sack_ok || (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { /* This should be true only in the passive case. */ if (tcp->tcp_sack_info == NULL) { ASSERT(TCP_IS_DETACHED(tcp)); tcp->tcp_sack_info = kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP); } if (tcp->tcp_sack_info == NULL) { tcp->tcp_snd_sack_ok = B_FALSE; } else { tcp->tcp_snd_sack_ok = B_TRUE; if (tcp->tcp_snd_ts_ok) { tcp->tcp_max_sack_blk = 3; } else { tcp->tcp_max_sack_blk = 4; } } } else { /* * Resetting tcp_snd_sack_ok to B_FALSE so that * no SACK info will be used for this * connection. This assumes that SACK usage * permission is negotiated. This may need * to be changed once this is clarified. */ if (tcp->tcp_sack_info != NULL) { ASSERT(tcp->tcp_notsack_list == NULL); kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); tcp->tcp_sack_info = NULL; } tcp->tcp_snd_sack_ok = B_FALSE; } /* * Now we know the exact TCP/IP header length, subtract * that from tcp_mss to get our side's MSS. */ tcp->tcp_mss -= tcp->tcp_hdr_len; /* * Here we assume that the other side's header size will be equal to * our header size. We calculate the real MSS accordingly. Need to * take into additional stuffs IPsec puts in. * * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) */ tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len + tcp->tcp_ipsec_overhead - ((tcp->tcp_ipversion == IPV4_VERSION ? IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); /* * Set MSS to the smaller one of both ends of the connection. * We should not have called tcp_mss_set() before, but our * side of the MSS should have been set to a proper value * by tcp_adapt_ire(). tcp_mss_set() will also set up the * STREAM head parameters properly. * * If we have a larger-than-16-bit window but the other side * didn't want to do window scale, tcp_rwnd_set() will take * care of that. */ tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss), B_TRUE); } /* * Sends the T_CONN_IND to the listener. The caller calls this * functions via squeue to get inside the listener's perimeter * once the 3 way hand shake is done a T_CONN_IND needs to be * sent. As an optimization, the caller can call this directly * if listener's perimeter is same as eager's. */ /* ARGSUSED */ void tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2) { conn_t *lconnp = (conn_t *)arg; tcp_t *listener = lconnp->conn_tcp; tcp_t *tcp; struct T_conn_ind *conn_ind; ipaddr_t *addr_cache; boolean_t need_send_conn_ind = B_FALSE; tcp_stack_t *tcps = listener->tcp_tcps; /* retrieve the eager */ conn_ind = (struct T_conn_ind *)mp->b_rptr; ASSERT(conn_ind->OPT_offset != 0 && conn_ind->OPT_length == sizeof (intptr_t)); bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, conn_ind->OPT_length); /* * TLI/XTI applications will get confused by * sending eager as an option since it violates * the option semantics. So remove the eager as * option since TLI/XTI app doesn't need it anyway. */ if (!TCP_IS_SOCKET(listener)) { conn_ind->OPT_length = 0; conn_ind->OPT_offset = 0; } if (listener->tcp_state == TCPS_CLOSED || TCP_IS_DETACHED(listener)) { /* * If listener has closed, it would have caused a * a cleanup/blowoff to happen for the eager. We * just need to return. */ freemsg(mp); return; } /* * if the conn_req_q is full defer passing up the * T_CONN_IND until space is availabe after t_accept() * processing */ mutex_enter(&listener->tcp_eager_lock); /* * Take the eager out, if it is in the list of droppable eagers * as we are here because the 3W handshake is over. */ MAKE_UNDROPPABLE(tcp); if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) { tcp_t *tail; /* * The eager already has an extra ref put in tcp_rput_data * so that it stays till accept comes back even though it * might get into TCPS_CLOSED as a result of a TH_RST etc. */ ASSERT(listener->tcp_conn_req_cnt_q0 > 0); listener->tcp_conn_req_cnt_q0--; listener->tcp_conn_req_cnt_q++; /* Move from SYN_RCVD to ESTABLISHED list */ tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = tcp->tcp_eager_prev_q0; tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; tcp->tcp_eager_prev_q0 = NULL; tcp->tcp_eager_next_q0 = NULL; /* * Insert at end of the queue because sockfs * sends down T_CONN_RES in chronological * order. Leaving the older conn indications * at front of the queue helps reducing search * time. */ tail = listener->tcp_eager_last_q; if (tail != NULL) tail->tcp_eager_next_q = tcp; else listener->tcp_eager_next_q = tcp; listener->tcp_eager_last_q = tcp; tcp->tcp_eager_next_q = NULL; /* * Delay sending up the T_conn_ind until we are * done with the eager. Once we have have sent up * the T_conn_ind, the accept can potentially complete * any time and release the refhold we have on the eager. */ need_send_conn_ind = B_TRUE; } else { /* * Defer connection on q0 and set deferred * connection bit true */ tcp->tcp_conn_def_q0 = B_TRUE; /* take tcp out of q0 ... */ tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = tcp->tcp_eager_prev_q0; /* ... and place it at the end of q0 */ tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0; tcp->tcp_eager_next_q0 = listener; listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp; listener->tcp_eager_prev_q0 = tcp; tcp->tcp_conn.tcp_eager_conn_ind = mp; } /* we have timed out before */ if (tcp->tcp_syn_rcvd_timeout != 0) { tcp->tcp_syn_rcvd_timeout = 0; listener->tcp_syn_rcvd_timeout--; if (listener->tcp_syn_defense && listener->tcp_syn_rcvd_timeout <= (tcps->tcps_conn_req_max_q0 >> 5) && 10*MINUTES < TICK_TO_MSEC(lbolt64 - listener->tcp_last_rcv_lbolt)) { /* * Turn off the defense mode if we * believe the SYN attack is over. */ listener->tcp_syn_defense = B_FALSE; if (listener->tcp_ip_addr_cache) { kmem_free((void *)listener->tcp_ip_addr_cache, IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); listener->tcp_ip_addr_cache = NULL; } } } addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); if (addr_cache != NULL) { /* * We have finished a 3-way handshake with this * remote host. This proves the IP addr is good. * Cache it! */ addr_cache[IP_ADDR_CACHE_HASH( tcp->tcp_remote)] = tcp->tcp_remote; } mutex_exit(&listener->tcp_eager_lock); if (need_send_conn_ind) putnext(listener->tcp_rq, mp); } mblk_t * tcp_find_pktinfo(tcp_t *tcp, mblk_t *mp, uint_t *ipversp, uint_t *ip_hdr_lenp, uint_t *ifindexp, ip6_pkt_t *ippp) { ip_pktinfo_t *pinfo; ip6_t *ip6h; uchar_t *rptr; mblk_t *first_mp = mp; boolean_t mctl_present = B_FALSE; uint_t ifindex = 0; ip6_pkt_t ipp; uint_t ipvers; uint_t ip_hdr_len; tcp_stack_t *tcps = tcp->tcp_tcps; rptr = mp->b_rptr; ASSERT(OK_32PTR(rptr)); ASSERT(tcp != NULL); ipp.ipp_fields = 0; switch DB_TYPE(mp) { case M_CTL: mp = mp->b_cont; if (mp == NULL) { freemsg(first_mp); return (NULL); } if (DB_TYPE(mp) != M_DATA) { freemsg(first_mp); return (NULL); } mctl_present = B_TRUE; break; case M_DATA: break; default: cmn_err(CE_NOTE, "tcp_find_pktinfo: unknown db_type"); freemsg(mp); return (NULL); } ipvers = IPH_HDR_VERSION(rptr); if (ipvers == IPV4_VERSION) { if (tcp == NULL) { ip_hdr_len = IPH_HDR_LENGTH(rptr); goto done; } ipp.ipp_fields |= IPPF_HOPLIMIT; ipp.ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl; /* * If we have IN_PKTINFO in an M_CTL and tcp_ipv6_recvancillary * has TCP_IPV6_RECVPKTINFO set, pass I/F index along in ipp. */ if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) && mctl_present) { pinfo = (ip_pktinfo_t *)first_mp->b_rptr; if ((MBLKL(first_mp) == sizeof (ip_pktinfo_t)) && (pinfo->ip_pkt_ulp_type == IN_PKTINFO) && (pinfo->ip_pkt_flags & IPF_RECVIF)) { ipp.ipp_fields |= IPPF_IFINDEX; ipp.ipp_ifindex = pinfo->ip_pkt_ifindex; ifindex = pinfo->ip_pkt_ifindex; } freeb(first_mp); mctl_present = B_FALSE; } ip_hdr_len = IPH_HDR_LENGTH(rptr); } else { ip6h = (ip6_t *)rptr; ASSERT(ipvers == IPV6_VERSION); ipp.ipp_fields = IPPF_HOPLIMIT | IPPF_TCLASS; ipp.ipp_tclass = (ip6h->ip6_flow & 0x0FF00000) >> 20; ipp.ipp_hoplimit = ip6h->ip6_hops; if (ip6h->ip6_nxt != IPPROTO_TCP) { uint8_t nexthdrp; ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; /* Look for ifindex information */ if (ip6h->ip6_nxt == IPPROTO_RAW) { ip6i_t *ip6i = (ip6i_t *)ip6h; if ((uchar_t *)&ip6i[1] > mp->b_wptr) { BUMP_MIB(&ipst->ips_ip_mib, tcpInErrs); freemsg(first_mp); return (NULL); } if (ip6i->ip6i_flags & IP6I_IFINDEX) { ASSERT(ip6i->ip6i_ifindex != 0); ipp.ipp_fields |= IPPF_IFINDEX; ipp.ipp_ifindex = ip6i->ip6i_ifindex; ifindex = ip6i->ip6i_ifindex; } rptr = (uchar_t *)&ip6i[1]; mp->b_rptr = rptr; if (rptr == mp->b_wptr) { mblk_t *mp1; mp1 = mp->b_cont; freeb(mp); mp = mp1; rptr = mp->b_rptr; } if (MBLKL(mp) < IPV6_HDR_LEN + sizeof (tcph_t)) { BUMP_MIB(&ipst->ips_ip_mib, tcpInErrs); freemsg(first_mp); return (NULL); } ip6h = (ip6_t *)rptr; } /* * Find any potentially interesting extension headers * as well as the length of the IPv6 + extension * headers. */ ip_hdr_len = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp); /* Verify if this is a TCP packet */ if (nexthdrp != IPPROTO_TCP) { BUMP_MIB(&ipst->ips_ip_mib, tcpInErrs); freemsg(first_mp); return (NULL); } } else { ip_hdr_len = IPV6_HDR_LEN; } } done: if (ipversp != NULL) *ipversp = ipvers; if (ip_hdr_lenp != NULL) *ip_hdr_lenp = ip_hdr_len; if (ippp != NULL) *ippp = ipp; if (ifindexp != NULL) *ifindexp = ifindex; if (mctl_present) { freeb(first_mp); } return (mp); } /* * Handle M_DATA messages from IP. Its called directly from IP via * squeue for AF_INET type sockets fast path. No M_CTL are expected * in this path. * * For everything else (including AF_INET6 sockets with 'tcp_ipversion' * v4 and v6), we are called through tcp_input() and a M_CTL can * be present for options but tcp_find_pktinfo() deals with it. We * only expect M_DATA packets after tcp_find_pktinfo() is done. * * The first argument is always the connp/tcp to which the mp belongs. * There are no exceptions to this rule. The caller has already put * a reference on this connp/tcp and once tcp_rput_data() returns, * the squeue will do the refrele. * * The TH_SYN for the listener directly go to tcp_conn_request via * squeue. * * sqp: NULL = recursive, sqp != NULL means called from squeue */ void tcp_rput_data(void *arg, mblk_t *mp, void *arg2) { int32_t bytes_acked; int32_t gap; mblk_t *mp1; uint_t flags; uint32_t new_swnd = 0; uchar_t *iphdr; uchar_t *rptr; int32_t rgap; uint32_t seg_ack; int seg_len; uint_t ip_hdr_len; uint32_t seg_seq; tcph_t *tcph; int urp; tcp_opt_t tcpopt; uint_t ipvers; ip6_pkt_t ipp; boolean_t ofo_seg = B_FALSE; /* Out of order segment */ uint32_t cwnd; uint32_t add; int npkt; int mss; conn_t *connp = (conn_t *)arg; squeue_t *sqp = (squeue_t *)arg2; tcp_t *tcp = connp->conn_tcp; tcp_stack_t *tcps = tcp->tcp_tcps; /* * RST from fused tcp loopback peer should trigger an unfuse. */ if (tcp->tcp_fused) { TCP_STAT(tcps, tcp_fusion_aborted); tcp_unfuse(tcp); } iphdr = mp->b_rptr; rptr = mp->b_rptr; ASSERT(OK_32PTR(rptr)); /* * An AF_INET socket is not capable of receiving any pktinfo. Do inline * processing here. For rest call tcp_find_pktinfo to fill up the * necessary information. */ if (IPCL_IS_TCP4(connp)) { ipvers = IPV4_VERSION; ip_hdr_len = IPH_HDR_LENGTH(rptr); } else { mp = tcp_find_pktinfo(tcp, mp, &ipvers, &ip_hdr_len, NULL, &ipp); if (mp == NULL) { TCP_STAT(tcps, tcp_rput_v6_error); return; } iphdr = mp->b_rptr; rptr = mp->b_rptr; } ASSERT(DB_TYPE(mp) == M_DATA); tcph = (tcph_t *)&rptr[ip_hdr_len]; seg_seq = ABE32_TO_U32(tcph->th_seq); seg_ack = ABE32_TO_U32(tcph->th_ack); ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); seg_len = (int)(mp->b_wptr - rptr) - (ip_hdr_len + TCP_HDR_LENGTH(tcph)); if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { do { ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); seg_len += (int)(mp1->b_wptr - mp1->b_rptr); } while ((mp1 = mp1->b_cont) != NULL && mp1->b_datap->db_type == M_DATA); } if (tcp->tcp_state == TCPS_TIME_WAIT) { tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, seg_len, tcph); return; } if (sqp != NULL) { /* * This is the correct place to update tcp_last_recv_time. Note * that it is also updated for tcp structure that belongs to * global and listener queues which do not really need updating. * But that should not cause any harm. And it is updated for * all kinds of incoming segments, not only for data segments. */ tcp->tcp_last_recv_time = lbolt; } flags = (unsigned int)tcph->th_flags[0] & 0xFF; BUMP_LOCAL(tcp->tcp_ibsegs); TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); if ((flags & TH_URG) && sqp != NULL) { /* * TCP can't handle urgent pointers that arrive before * the connection has been accept()ed since it can't * buffer OOB data. Discard segment if this happens. * * We can't just rely on a non-null tcp_listener to indicate * that the accept() has completed since unlinking of the * eager and completion of the accept are not atomic. * tcp_detached, when it is not set (B_FALSE) indicates * that the accept() has completed. * * Nor can it reassemble urgent pointers, so discard * if it's not the next segment expected. * * Otherwise, collapse chain into one mblk (discard if * that fails). This makes sure the headers, retransmitted * data, and new data all are in the same mblk. */ ASSERT(mp != NULL); if (tcp->tcp_detached || !pullupmsg(mp, -1)) { freemsg(mp); return; } /* Update pointers into message */ iphdr = rptr = mp->b_rptr; tcph = (tcph_t *)&rptr[ip_hdr_len]; if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { /* * Since we can't handle any data with this urgent * pointer that is out of sequence, we expunge * the data. This allows us to still register * the urgent mark and generate the M_PCSIG, * which we can do. */ mp->b_wptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); seg_len = 0; } } DTRACE_TCP5(receive, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcph); if (tcp->tcp_state == TCPS_SYN_RCVD && (flags & TH_ACK)) { DTRACE_TCP5(accept__established, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcph); } switch (tcp->tcp_state) { case TCPS_SYN_SENT: if (flags & TH_ACK) { /* * Note that our stack cannot send data before a * connection is established, therefore the * following check is valid. Otherwise, it has * to be changed. */ if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || SEQ_GT(seg_ack, tcp->tcp_snxt)) { freemsg(mp); if (flags & TH_RST) return; tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", tcp, seg_ack, 0, TH_RST); return; } ASSERT(tcp->tcp_suna + 1 == seg_ack); } if (flags & TH_RST) { DTRACE_TCP5(connect__refused, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, iphdr, tcp_t *, NULL, tcph_t *, tcph); freemsg(mp); if (flags & TH_ACK) (void) tcp_clean_death(tcp, ECONNREFUSED, 13); return; } if (!(flags & TH_SYN)) { freemsg(mp); return; } /* Process all TCP options. */ tcp_process_options(tcp, tcph); /* * The following changes our rwnd to be a multiple of the * MIN(peer MSS, our MSS) for performance reason. */ (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rq->q_hiwat, tcp->tcp_mss)); /* Is the other end ECN capable? */ if (tcp->tcp_ecn_ok) { if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { tcp->tcp_ecn_ok = B_FALSE; } } /* * Clear ECN flags because it may interfere with later * processing. */ flags &= ~(TH_ECE|TH_CWR); tcp->tcp_irs = seg_seq; tcp->tcp_rack = seg_seq; tcp->tcp_rnxt = seg_seq + 1; U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); if (!TCP_IS_DETACHED(tcp)) { /* Allocate room for SACK options if needed. */ if (tcp->tcp_snd_sack_ok) { (void) mi_set_sth_wroff(tcp->tcp_rq, tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra)); } else { (void) mi_set_sth_wroff(tcp->tcp_rq, tcp->tcp_hdr_len + (tcp->tcp_loopback ? 0 : tcps->tcps_wroff_xtra)); } } if (flags & TH_ACK) { /* * If we can't get the confirmation upstream, pretend * we didn't even see this one. * * XXX: how can we pretend we didn't see it if we * have updated rnxt et. al. * * For loopback we defer sending up the T_CONN_CON * until after some checks below. */ mp1 = NULL; if (!tcp_conn_con(tcp, iphdr, tcph, mp, tcp->tcp_loopback ? &mp1 : NULL)) { freemsg(mp); return; } /* SYN was acked - making progress */ if (tcp->tcp_ipversion == IPV6_VERSION) tcp->tcp_ip_forward_progress = B_TRUE; /* One for the SYN */ tcp->tcp_suna = tcp->tcp_iss + 1; tcp->tcp_valid_bits &= ~TCP_ISS_VALID; DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_ESTABLISHED); tcp->tcp_state = TCPS_ESTABLISHED; /* * For DTrace observability, remember that we just * established a connection and are about to send * the final ACK. */ tcp->tcp_dtrace_connect_established = B_TRUE; /* * If SYN was retransmitted, need to reset all * retransmission info. This is because this * segment will be treated as a dup ACK. */ if (tcp->tcp_rexmit) { tcp->tcp_rexmit = B_FALSE; tcp->tcp_rexmit_nxt = tcp->tcp_snxt; tcp->tcp_rexmit_max = tcp->tcp_snxt; tcp->tcp_snd_burst = tcp->tcp_localnet ? TCP_CWND_INFINITE : TCP_CWND_NORMAL; tcp->tcp_ms_we_have_waited = 0; /* * Set tcp_cwnd back to 1 MSS, per * recommendation from * draft-floyd-incr-init-win-01.txt, * Increasing TCP's Initial Window. */ tcp->tcp_cwnd = tcp->tcp_mss; } tcp->tcp_swl1 = seg_seq; tcp->tcp_swl2 = seg_ack; new_swnd = BE16_TO_U16(tcph->th_win); tcp->tcp_swnd = new_swnd; if (new_swnd > tcp->tcp_max_swnd) tcp->tcp_max_swnd = new_swnd; /* * Always send the three-way handshake ack immediately * in order to make the connection complete as soon as * possible on the accepting host. */ flags |= TH_ACK_NEEDED; /* * Special case for loopback. At this point we have * received SYN-ACK from the remote endpoint. In * order to ensure that both endpoints reach the * fused state prior to any data exchange, the final * ACK needs to be sent before we indicate T_CONN_CON * to the module upstream. */ if (tcp->tcp_loopback) { mblk_t *ack_mp; ASSERT(!tcp->tcp_unfusable); ASSERT(mp1 != NULL); /* * For loopback, we always get a pure SYN-ACK * and only need to send back the final ACK * with no data (this is because the other * tcp is ours and we don't do T/TCP). This * final ACK triggers the passive side to * perform fusion in ESTABLISHED state. */ if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { if (tcp->tcp_ack_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); tcp->tcp_ack_tid = 0; } TCP_RECORD_TRACE(tcp, ack_mp, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, ack_mp); BUMP_LOCAL(tcp->tcp_obsegs); BUMP_MIB(&tcps->tcps_mib, tcpOutAck); /* Send up T_CONN_CON */ putnext(tcp->tcp_rq, mp1); freemsg(mp); return; } /* * Forget fusion; we need to handle more * complex cases below. Send the deferred * T_CONN_CON message upstream and proceed * as usual. Mark this tcp as not capable * of fusion. */ TCP_STAT(tcps, tcp_fusion_unfusable); tcp->tcp_unfusable = B_TRUE; putnext(tcp->tcp_rq, mp1); } /* * Check to see if there is data to be sent. If * yes, set the transmit flag. Then check to see * if received data processing needs to be done. * If not, go straight to xmit_check. This short * cut is OK as we don't support T/TCP. */ if (tcp->tcp_unsent) flags |= TH_XMIT_NEEDED; if (seg_len == 0 && !(flags & TH_URG)) { freemsg(mp); goto xmit_check; } flags &= ~TH_SYN; seg_seq++; break; } DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_SYN_RCVD); tcp->tcp_state = TCPS_SYN_RCVD; mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); if (mp1) { DB_CPID(mp1) = tcp->tcp_cpid; TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, mp1); TCP_TIMER_RESTART(tcp, tcp->tcp_rto); } freemsg(mp); return; case TCPS_SYN_RCVD: if (flags & TH_ACK) { /* * In this state, a SYN|ACK packet is either bogus * because the other side must be ACKing our SYN which * indicates it has seen the ACK for their SYN and * shouldn't retransmit it or we're crossing SYNs * on active open. */ if ((flags & TH_SYN) && !tcp->tcp_active_open) { freemsg(mp); tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", tcp, seg_ack, 0, TH_RST); return; } /* * NOTE: RFC 793 pg. 72 says this should be * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt * but that would mean we have an ack that ignored * our SYN. */ if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || SEQ_GT(seg_ack, tcp->tcp_snxt)) { freemsg(mp); tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", tcp, seg_ack, 0, TH_RST); return; } } break; case TCPS_LISTEN: /* * Only a TLI listener can come through this path when a * acceptor is going back to be a listener and a packet * for the acceptor hits the classifier. For a socket * listener, this can never happen because a listener * can never accept connection on itself and hence a * socket acceptor can not go back to being a listener. */ ASSERT(!TCP_IS_SOCKET(tcp)); /*FALLTHRU*/ case TCPS_CLOSED: case TCPS_BOUND: { conn_t *new_connp; ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; new_connp = ipcl_classify(mp, connp->conn_zoneid, ipst); if (new_connp != NULL) { tcp_reinput(new_connp, mp, connp->conn_sqp); return; } /* We failed to classify. For now just drop the packet */ freemsg(mp); return; } case TCPS_IDLE: /* * Handle the case where the tcp_clean_death() has happened * on a connection (application hasn't closed yet) but a packet * was already queued on squeue before tcp_clean_death() * was processed. Calling tcp_clean_death() twice on same * connection can result in weird behaviour. */ freemsg(mp); return; default: break; } /* * Already on the correct queue/perimeter. * If this is a detached connection and not an eager * connection hanging off a listener then new data * (past the FIN) will cause a reset. * We do a special check here where it * is out of the main line, rather than check * if we are detached every time we see new * data down below. */ if (TCP_IS_DETACHED_NONEAGER(tcp) && (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { BUMP_MIB(&tcps->tcps_mib, tcpInClosed); TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); freemsg(mp); /* * This could be an SSL closure alert. We're detached so just * acknowledge it this last time. */ if (tcp->tcp_kssl_ctx != NULL) { kssl_release_ctx(tcp->tcp_kssl_ctx); tcp->tcp_kssl_ctx = NULL; tcp->tcp_rnxt += seg_len; U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); flags |= TH_ACK_NEEDED; goto ack_check; } tcp_xmit_ctl("new data when detached", tcp, tcp->tcp_snxt, 0, TH_RST); (void) tcp_clean_death(tcp, EPROTO, 12); return; } mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); urp = BE16_TO_U16(tcph->th_urp) - TCP_OLD_URP_INTERPRETATION; new_swnd = BE16_TO_U16(tcph->th_win) << ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); if (tcp->tcp_snd_ts_ok) { if (!tcp_paws_check(tcp, tcph, &tcpopt)) { /* * This segment is not acceptable. * Drop it and send back an ACK. */ freemsg(mp); flags |= TH_ACK_NEEDED; goto ack_check; } } else if (tcp->tcp_snd_sack_ok) { ASSERT(tcp->tcp_sack_info != NULL); tcpopt.tcp = tcp; /* * SACK info in already updated in tcp_parse_options. Ignore * all other TCP options... */ (void) tcp_parse_options(tcph, &tcpopt); } try_again:; mss = tcp->tcp_mss; gap = seg_seq - tcp->tcp_rnxt; rgap = tcp->tcp_rwnd - (gap + seg_len); /* * gap is the amount of sequence space between what we expect to see * and what we got for seg_seq. A positive value for gap means * something got lost. A negative value means we got some old stuff. */ if (gap < 0) { /* Old stuff present. Is the SYN in there? */ if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && (seg_len != 0)) { flags &= ~TH_SYN; seg_seq++; urp--; /* Recompute the gaps after noting the SYN. */ goto try_again; } BUMP_MIB(&tcps->tcps_mib, tcpInDataDupSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataDupBytes, (seg_len > -gap ? -gap : seg_len)); /* Remove the old stuff from seg_len. */ seg_len += gap; /* * Anything left? * Make sure to check for unack'd FIN when rest of data * has been previously ack'd. */ if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { /* * Resets are only valid if they lie within our offered * window. If the RST bit is set, we just ignore this * segment. */ if (flags & TH_RST) { freemsg(mp); return; } /* * The arriving of dup data packets indicate that we * may have postponed an ack for too long, or the other * side's RTT estimate is out of shape. Start acking * more often. */ if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && tcp->tcp_rack_cnt >= 1 && tcp->tcp_rack_abs_max > 2) { tcp->tcp_rack_abs_max--; } tcp->tcp_rack_cur_max = 1; /* * This segment is "unacceptable". None of its * sequence space lies within our advertized window. * * Adjust seg_len to the original value for tracing. */ seg_len -= gap; if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: unacceptable, gap %d, rgap %d, " "flags 0x%x, seg_seq %u, seg_ack %u, " "seg_len %d, rnxt %u, snxt %u, %s", gap, rgap, flags, seg_seq, seg_ack, seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, tcp_display(tcp, NULL, DISP_ADDR_AND_PORT)); } /* * Arrange to send an ACK in response to the * unacceptable segment per RFC 793 page 69. There * is only one small difference between ours and the * acceptability test in the RFC - we accept ACK-only * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK * will be generated. * * Note that we have to ACK an ACK-only packet at least * for stacks that send 0-length keep-alives with * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, * section 4.2.3.6. As long as we don't ever generate * an unacceptable packet in response to an incoming * packet that is unacceptable, it should not cause * "ACK wars". */ flags |= TH_ACK_NEEDED; /* * Continue processing this segment in order to use the * ACK information it contains, but skip all other * sequence-number processing. Processing the ACK * information is necessary in order to * re-synchronize connections that may have lost * synchronization. * * We clear seg_len and flag fields related to * sequence number processing as they are not * to be trusted for an unacceptable segment. */ seg_len = 0; flags &= ~(TH_SYN | TH_FIN | TH_URG); goto process_ack; } /* Fix seg_seq, and chew the gap off the front. */ seg_seq = tcp->tcp_rnxt; urp += gap; do { mblk_t *mp2; ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)UINT_MAX); gap += (uint_t)(mp->b_wptr - mp->b_rptr); if (gap > 0) { mp->b_rptr = mp->b_wptr - gap; break; } mp2 = mp; mp = mp->b_cont; freeb(mp2); } while (gap < 0); /* * If the urgent data has already been acknowledged, we * should ignore TH_URG below */ if (urp < 0) flags &= ~TH_URG; } /* * rgap is the amount of stuff received out of window. A negative * value is the amount out of window. */ if (rgap < 0) { mblk_t *mp2; if (tcp->tcp_rwnd == 0) { BUMP_MIB(&tcps->tcps_mib, tcpInWinProbe); } else { BUMP_MIB(&tcps->tcps_mib, tcpInDataPastWinSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataPastWinBytes, -rgap); } /* * seg_len does not include the FIN, so if more than * just the FIN is out of window, we act like we don't * see it. (If just the FIN is out of window, rgap * will be zero and we will go ahead and acknowledge * the FIN.) */ flags &= ~TH_FIN; /* Fix seg_len and make sure there is something left. */ seg_len += rgap; if (seg_len <= 0) { /* * Resets are only valid if they lie within our offered * window. If the RST bit is set, we just ignore this * segment. */ if (flags & TH_RST) { freemsg(mp); return; } /* Per RFC 793, we need to send back an ACK. */ flags |= TH_ACK_NEEDED; /* * Send SIGURG as soon as possible i.e. even * if the TH_URG was delivered in a window probe * packet (which will be unacceptable). * * We generate a signal if none has been generated * for this connection or if this is a new urgent * byte. Also send a zero-length "unmarked" message * to inform SIOCATMARK that this is not the mark. * * tcp_urp_last_valid is cleared when the T_exdata_ind * is sent up. This plus the check for old data * (gap >= 0) handles the wraparound of the sequence * number space without having to always track the * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks * this max in its rcv_up variable). * * This prevents duplicate SIGURGS due to a "late" * zero-window probe when the T_EXDATA_IND has already * been sent up. */ if ((flags & TH_URG) && (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, tcp->tcp_urp_last))) { mp1 = allocb(0, BPRI_MED); if (mp1 == NULL) { freemsg(mp); return; } if (!TCP_IS_DETACHED(tcp) && !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) { /* Try again on the rexmit. */ freemsg(mp1); freemsg(mp); return; } /* * If the next byte would be the mark * then mark with MARKNEXT else mark * with NOTMARKNEXT. */ if (gap == 0 && urp == 0) mp1->b_flag |= MSGMARKNEXT; else mp1->b_flag |= MSGNOTMARKNEXT; freemsg(tcp->tcp_urp_mark_mp); tcp->tcp_urp_mark_mp = mp1; flags |= TH_SEND_URP_MARK; tcp->tcp_urp_last_valid = B_TRUE; tcp->tcp_urp_last = urp + seg_seq; } /* * If this is a zero window probe, continue to * process the ACK part. But we need to set seg_len * to 0 to avoid data processing. Otherwise just * drop the segment and send back an ACK. */ if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { flags &= ~(TH_SYN | TH_URG); seg_len = 0; goto process_ack; } else { freemsg(mp); goto ack_check; } } /* Pitch out of window stuff off the end. */ rgap = seg_len; mp2 = mp; do { ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= (uintptr_t)INT_MAX); rgap -= (int)(mp2->b_wptr - mp2->b_rptr); if (rgap < 0) { mp2->b_wptr += rgap; if ((mp1 = mp2->b_cont) != NULL) { mp2->b_cont = NULL; freemsg(mp1); } break; } } while ((mp2 = mp2->b_cont) != NULL); } ok:; /* * TCP should check ECN info for segments inside the window only. * Therefore the check should be done here. */ if (tcp->tcp_ecn_ok) { if (flags & TH_CWR) { tcp->tcp_ecn_echo_on = B_FALSE; } /* * Note that both ECN_CE and CWR can be set in the * same segment. In this case, we once again turn * on ECN_ECHO. */ if (tcp->tcp_ipversion == IPV4_VERSION) { uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { tcp->tcp_ecn_echo_on = B_TRUE; } } else { uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; if ((vcf & htonl(IPH_ECN_CE << 20)) == htonl(IPH_ECN_CE << 20)) { tcp->tcp_ecn_echo_on = B_TRUE; } } } /* * Check whether we can update tcp_ts_recent. This test is * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP * Extensions for High Performance: An Update", Internet Draft. */ if (tcp->tcp_snd_ts_ok && TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && SEQ_LEQ(seg_seq, tcp->tcp_rack)) { tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; tcp->tcp_last_rcv_lbolt = lbolt64; } if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { /* * FIN in an out of order segment. We record this in * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. * Clear the FIN so that any check on FIN flag will fail. * Remember that FIN also counts in the sequence number * space. So we need to ack out of order FIN only segments. */ if (flags & TH_FIN) { tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; tcp->tcp_ofo_fin_seq = seg_seq + seg_len; flags &= ~TH_FIN; flags |= TH_ACK_NEEDED; } if (seg_len > 0) { /* Fill in the SACK blk list. */ if (tcp->tcp_snd_sack_ok) { ASSERT(tcp->tcp_sack_info != NULL); tcp_sack_insert(tcp->tcp_sack_list, seg_seq, seg_seq + seg_len, &(tcp->tcp_num_sack_blk)); } /* * Attempt reassembly and see if we have something * ready to go. */ mp = tcp_reass(tcp, mp, seg_seq); /* Always ack out of order packets */ flags |= TH_ACK_NEEDED | TH_PUSH; if (mp) { ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); seg_len = mp->b_cont ? msgdsize(mp) : (int)(mp->b_wptr - mp->b_rptr); seg_seq = tcp->tcp_rnxt; /* * A gap is filled and the seq num and len * of the gap match that of a previously * received FIN, put the FIN flag back in. */ if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { flags |= TH_FIN; tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; } } else { /* * Keep going even with NULL mp. * There may be a useful ACK or something else * we don't want to miss. * * But TCP should not perform fast retransmit * because of the ack number. TCP uses * seg_len == 0 to determine if it is a pure * ACK. And this is not a pure ACK. */ seg_len = 0; ofo_seg = B_TRUE; } } } else if (seg_len > 0) { BUMP_MIB(&tcps->tcps_mib, tcpInDataInorderSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInDataInorderBytes, seg_len); /* * If an out of order FIN was received before, and the seq * num and len of the new segment match that of the FIN, * put the FIN flag back in. */ if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { flags |= TH_FIN; tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; } } if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { if (flags & TH_RST) { freemsg(mp); switch (tcp->tcp_state) { case TCPS_SYN_RCVD: (void) tcp_clean_death(tcp, ECONNREFUSED, 14); break; case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_FIN_WAIT_2: case TCPS_CLOSE_WAIT: (void) tcp_clean_death(tcp, ECONNRESET, 15); break; case TCPS_CLOSING: case TCPS_LAST_ACK: (void) tcp_clean_death(tcp, 0, 16); break; default: ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); (void) tcp_clean_death(tcp, ENXIO, 17); break; } return; } if (flags & TH_SYN) { /* * See RFC 793, Page 71 * * The seq number must be in the window as it should * be "fixed" above. If it is outside window, it should * be already rejected. Note that we allow seg_seq to be * rnxt + rwnd because we want to accept 0 window probe. */ ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); freemsg(mp); /* * If the ACK flag is not set, just use our snxt as the * seq number of the RST segment. */ if (!(flags & TH_ACK)) { seg_ack = tcp->tcp_snxt; } tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, TH_RST|TH_ACK); ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); (void) tcp_clean_death(tcp, ECONNRESET, 18); return; } /* * urp could be -1 when the urp field in the packet is 0 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent * byte was at seg_seq - 1, in which case we ignore the urgent flag. */ if (flags & TH_URG && urp >= 0) { if (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { /* * If we haven't generated the signal yet for this * urgent pointer value, do it now. Also, send up a * zero-length M_DATA indicating whether or not this is * the mark. The latter is not needed when a * T_EXDATA_IND is sent up. However, if there are * allocation failures this code relies on the sender * retransmitting and the socket code for determining * the mark should not block waiting for the peer to * transmit. Thus, for simplicity we always send up the * mark indication. */ mp1 = allocb(0, BPRI_MED); if (mp1 == NULL) { freemsg(mp); return; } if (!TCP_IS_DETACHED(tcp) && !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) { /* Try again on the rexmit. */ freemsg(mp1); freemsg(mp); return; } /* * Mark with NOTMARKNEXT for now. * The code below will change this to MARKNEXT * if we are at the mark. * * If there are allocation failures (e.g. in dupmsg * below) the next time tcp_rput_data sees the urgent * segment it will send up the MSG*MARKNEXT message. */ mp1->b_flag |= MSGNOTMARKNEXT; freemsg(tcp->tcp_urp_mark_mp); tcp->tcp_urp_mark_mp = mp1; flags |= TH_SEND_URP_MARK; #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: sent M_PCSIG 2 seq %x urp %x " "last %x, %s", seg_seq, urp, tcp->tcp_urp_last, tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ tcp->tcp_urp_last_valid = B_TRUE; tcp->tcp_urp_last = urp + seg_seq; } else if (tcp->tcp_urp_mark_mp != NULL) { /* * An allocation failure prevented the previous * tcp_rput_data from sending up the allocated * MSG*MARKNEXT message - send it up this time * around. */ flags |= TH_SEND_URP_MARK; } /* * If the urgent byte is in this segment, make sure that it is * all by itself. This makes it much easier to deal with the * possibility of an allocation failure on the T_exdata_ind. * Note that seg_len is the number of bytes in the segment, and * urp is the offset into the segment of the urgent byte. * urp < seg_len means that the urgent byte is in this segment. */ if (urp < seg_len) { if (seg_len != 1) { uint32_t tmp_rnxt; /* * Break it up and feed it back in. * Re-attach the IP header. */ mp->b_rptr = iphdr; if (urp > 0) { /* * There is stuff before the urgent * byte. */ mp1 = dupmsg(mp); if (!mp1) { /* * Trim from urgent byte on. * The rest will come back. */ (void) adjmsg(mp, urp - seg_len); tcp_rput_data(connp, mp, NULL); return; } (void) adjmsg(mp1, urp - seg_len); /* Feed this piece back in. */ tmp_rnxt = tcp->tcp_rnxt; tcp_rput_data(connp, mp1, NULL); /* * If the data passed back in was not * processed (ie: bad ACK) sending * the remainder back in will cause a * loop. In this case, drop the * packet and let the sender try * sending a good packet. */ if (tmp_rnxt == tcp->tcp_rnxt) { freemsg(mp); return; } } if (urp != seg_len - 1) { uint32_t tmp_rnxt; /* * There is stuff after the urgent * byte. */ mp1 = dupmsg(mp); if (!mp1) { /* * Trim everything beyond the * urgent byte. The rest will * come back. */ (void) adjmsg(mp, urp + 1 - seg_len); tcp_rput_data(connp, mp, NULL); return; } (void) adjmsg(mp1, urp + 1 - seg_len); tmp_rnxt = tcp->tcp_rnxt; tcp_rput_data(connp, mp1, NULL); /* * If the data passed back in was not * processed (ie: bad ACK) sending * the remainder back in will cause a * loop. In this case, drop the * packet and let the sender try * sending a good packet. */ if (tmp_rnxt == tcp->tcp_rnxt) { freemsg(mp); return; } } tcp_rput_data(connp, mp, NULL); return; } /* * This segment contains only the urgent byte. We * have to allocate the T_exdata_ind, if we can. */ if (!tcp->tcp_urp_mp) { struct T_exdata_ind *tei; mp1 = allocb(sizeof (struct T_exdata_ind), BPRI_MED); if (!mp1) { /* * Sigh... It'll be back. * Generate any MSG*MARK message now. */ freemsg(mp); seg_len = 0; if (flags & TH_SEND_URP_MARK) { ASSERT(tcp->tcp_urp_mark_mp); tcp->tcp_urp_mark_mp->b_flag &= ~MSGNOTMARKNEXT; tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT; } goto ack_check; } mp1->b_datap->db_type = M_PROTO; tei = (struct T_exdata_ind *)mp1->b_rptr; tei->PRIM_type = T_EXDATA_IND; tei->MORE_flag = 0; mp1->b_wptr = (uchar_t *)&tei[1]; tcp->tcp_urp_mp = mp1; #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: allocated exdata_ind %s", tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ /* * There is no need to send a separate MSG*MARK * message since the T_EXDATA_IND will be sent * now. */ flags &= ~TH_SEND_URP_MARK; freemsg(tcp->tcp_urp_mark_mp); tcp->tcp_urp_mark_mp = NULL; } /* * Now we are all set. On the next putnext upstream, * tcp_urp_mp will be non-NULL and will get prepended * to what has to be this piece containing the urgent * byte. If for any reason we abort this segment below, * if it comes back, we will have this ready, or it * will get blown off in close. */ } else if (urp == seg_len) { /* * The urgent byte is the next byte after this sequence * number. If there is data it is marked with * MSGMARKNEXT and any tcp_urp_mark_mp is discarded * since it is not needed. Otherwise, if the code * above just allocated a zero-length tcp_urp_mark_mp * message, that message is tagged with MSGMARKNEXT. * Sending up these MSGMARKNEXT messages makes * SIOCATMARK work correctly even though * the T_EXDATA_IND will not be sent up until the * urgent byte arrives. */ if (seg_len != 0) { flags |= TH_MARKNEXT_NEEDED; freemsg(tcp->tcp_urp_mark_mp); tcp->tcp_urp_mark_mp = NULL; flags &= ~TH_SEND_URP_MARK; } else if (tcp->tcp_urp_mark_mp != NULL) { flags |= TH_SEND_URP_MARK; tcp->tcp_urp_mark_mp->b_flag &= ~MSGNOTMARKNEXT; tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT; } #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: AT MARK, len %d, flags 0x%x, %s", seg_len, flags, tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ } else { /* Data left until we hit mark */ #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: URP %d bytes left, %s", urp - seg_len, tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ } } process_ack: if (!(flags & TH_ACK)) { freemsg(mp); goto xmit_check; } } bytes_acked = (int)(seg_ack - tcp->tcp_suna); if (tcp->tcp_ipversion == IPV6_VERSION && bytes_acked > 0) tcp->tcp_ip_forward_progress = B_TRUE; if (tcp->tcp_state == TCPS_SYN_RCVD) { if ((tcp->tcp_conn.tcp_eager_conn_ind != NULL) && ((tcp->tcp_kssl_ent == NULL) || !tcp->tcp_kssl_pending)) { /* 3-way handshake complete - pass up the T_CONN_IND */ tcp_t *listener = tcp->tcp_listener; mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; tcp->tcp_tconnind_started = B_TRUE; tcp->tcp_conn.tcp_eager_conn_ind = NULL; /* * We are here means eager is fine but it can * get a TH_RST at any point between now and till * accept completes and disappear. We need to * ensure that reference to eager is valid after * we get out of eager's perimeter. So we do * an extra refhold. */ CONN_INC_REF(connp); /* * The listener also exists because of the refhold * done in tcp_conn_request. Its possible that it * might have closed. We will check that once we * get inside listeners context. */ CONN_INC_REF(listener->tcp_connp); if (listener->tcp_connp->conn_sqp == connp->conn_sqp) { tcp_send_conn_ind(listener->tcp_connp, mp, listener->tcp_connp->conn_sqp); CONN_DEC_REF(listener->tcp_connp); } else if (!tcp->tcp_loopback) { squeue_fill(listener->tcp_connp->conn_sqp, mp, tcp_send_conn_ind, listener->tcp_connp, SQTAG_TCP_CONN_IND); } else { squeue_enter(listener->tcp_connp->conn_sqp, mp, tcp_send_conn_ind, listener->tcp_connp, SQTAG_TCP_CONN_IND); } } if (tcp->tcp_active_open) { /* * We are seeing the final ack in the three way * hand shake of a active open'ed connection * so we must send up a T_CONN_CON */ if (!tcp_conn_con(tcp, iphdr, tcph, mp, NULL)) { freemsg(mp); return; } /* * Don't fuse the loopback endpoints for * simultaneous active opens. */ if (tcp->tcp_loopback) { TCP_STAT(tcps, tcp_fusion_unfusable); tcp->tcp_unfusable = B_TRUE; } } tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ bytes_acked--; /* SYN was acked - making progress */ if (tcp->tcp_ipversion == IPV6_VERSION) tcp->tcp_ip_forward_progress = B_TRUE; /* * If SYN was retransmitted, need to reset all * retransmission info as this segment will be * treated as a dup ACK. */ if (tcp->tcp_rexmit) { tcp->tcp_rexmit = B_FALSE; tcp->tcp_rexmit_nxt = tcp->tcp_snxt; tcp->tcp_rexmit_max = tcp->tcp_snxt; tcp->tcp_snd_burst = tcp->tcp_localnet ? TCP_CWND_INFINITE : TCP_CWND_NORMAL; tcp->tcp_ms_we_have_waited = 0; tcp->tcp_cwnd = mss; } /* * We set the send window to zero here. * This is needed if there is data to be * processed already on the queue. * Later (at swnd_update label), the * "new_swnd > tcp_swnd" condition is satisfied * the XMIT_NEEDED flag is set in the current * (SYN_RCVD) state. This ensures tcp_wput_data() is * called if there is already data on queue in * this state. */ tcp->tcp_swnd = 0; if (new_swnd > tcp->tcp_max_swnd) tcp->tcp_max_swnd = new_swnd; tcp->tcp_swl1 = seg_seq; tcp->tcp_swl2 = seg_ack; DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_ESTABLISHED); tcp->tcp_state = TCPS_ESTABLISHED; tcp->tcp_valid_bits &= ~TCP_ISS_VALID; /* Fuse when both sides are in ESTABLISHED state */ if (tcp->tcp_loopback && do_tcp_fusion) tcp_fuse(tcp, iphdr, tcph); } /* This code follows 4.4BSD-Lite2 mostly. */ if (bytes_acked < 0) goto est; /* * If TCP is ECN capable and the congestion experience bit is * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be * done once per window (or more loosely, per RTT). */ if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) tcp->tcp_cwr = B_FALSE; if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { if (!tcp->tcp_cwr) { npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; tcp->tcp_cwnd = npkt * mss; /* * If the cwnd is 0, use the timer to clock out * new segments. This is required by the ECN spec. */ if (npkt == 0) { TCP_TIMER_RESTART(tcp, tcp->tcp_rto); /* * This makes sure that when the ACK comes * back, we will increase tcp_cwnd by 1 MSS. */ tcp->tcp_cwnd_cnt = 0; } tcp->tcp_cwr = B_TRUE; /* * This marks the end of the current window of in * flight data. That is why we don't use * tcp_suna + tcp_swnd. Only data in flight can * provide ECN info. */ tcp->tcp_cwr_snd_max = tcp->tcp_snxt; tcp->tcp_ecn_cwr_sent = B_FALSE; } } mp1 = tcp->tcp_xmit_head; if (bytes_acked == 0) { if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { int dupack_cnt; BUMP_MIB(&tcps->tcps_mib, tcpInDupAck); /* * Fast retransmit. When we have seen exactly three * identical ACKs while we have unacked data * outstanding we take it as a hint that our peer * dropped something. * * If TCP is retransmitting, don't do fast retransmit. */ if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && ! tcp->tcp_rexmit) { /* Do Limited Transmit */ if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < tcps->tcps_dupack_fast_retransmit) { /* * RFC 3042 * * What we need to do is temporarily * increase tcp_cwnd so that new * data can be sent if it is allowed * by the receive window (tcp_rwnd). * tcp_wput_data() will take care of * the rest. * * If the connection is SACK capable, * only do limited xmit when there * is SACK info. * * Note how tcp_cwnd is incremented. * The first dup ACK will increase * it by 1 MSS. The second dup ACK * will increase it by 2 MSS. This * means that only 1 new segment will * be sent for each dup ACK. */ if (tcp->tcp_unsent > 0 && (!tcp->tcp_snd_sack_ok || (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL))) { tcp->tcp_cwnd += mss << (tcp->tcp_dupack_cnt - 1); flags |= TH_LIMIT_XMIT; } } else if (dupack_cnt == tcps->tcps_dupack_fast_retransmit) { /* * If we have reduced tcp_ssthresh * because of ECN, do not reduce it again * unless it is already one window of data * away. After one window of data, tcp_cwr * should then be cleared. Note that * for non ECN capable connection, tcp_cwr * should always be false. * * Adjust cwnd since the duplicate * ack indicates that a packet was * dropped (due to congestion.) */ if (!tcp->tcp_cwr) { npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; tcp->tcp_cwnd = (npkt + tcp->tcp_dupack_cnt) * mss; } if (tcp->tcp_ecn_ok) { tcp->tcp_cwr = B_TRUE; tcp->tcp_cwr_snd_max = tcp->tcp_snxt; tcp->tcp_ecn_cwr_sent = B_FALSE; } /* * We do Hoe's algorithm. Refer to her * paper "Improving the Start-up Behavior * of a Congestion Control Scheme for TCP," * appeared in SIGCOMM'96. * * Save highest seq no we have sent so far. * Be careful about the invisible FIN byte. */ if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && (tcp->tcp_unsent == 0)) { tcp->tcp_rexmit_max = tcp->tcp_fss; } else { tcp->tcp_rexmit_max = tcp->tcp_snxt; } /* * Do not allow bursty traffic during. * fast recovery. Refer to Fall and Floyd's * paper "Simulation-based Comparisons of * Tahoe, Reno and SACK TCP" (in CCR?) * This is a best current practise. */ tcp->tcp_snd_burst = TCP_CWND_SS; /* * For SACK: * Calculate tcp_pipe, which is the * estimated number of bytes in * network. * * tcp_fack is the highest sack'ed seq num * TCP has received. * * tcp_pipe is explained in the above quoted * Fall and Floyd's paper. tcp_fack is * explained in Mathis and Mahdavi's * "Forward Acknowledgment: Refining TCP * Congestion Control" in SIGCOMM '96. */ if (tcp->tcp_snd_sack_ok) { ASSERT(tcp->tcp_sack_info != NULL); if (tcp->tcp_notsack_list != NULL) { tcp->tcp_pipe = tcp->tcp_snxt - tcp->tcp_fack; tcp->tcp_sack_snxt = seg_ack; flags |= TH_NEED_SACK_REXMIT; } else { /* * Always initialize tcp_pipe * even though we don't have * any SACK info. If later * we get SACK info and * tcp_pipe is not initialized, * funny things will happen. */ tcp->tcp_pipe = tcp->tcp_cwnd_ssthresh; } } else { flags |= TH_REXMIT_NEEDED; } /* tcp_snd_sack_ok */ } else { /* * Here we perform congestion * avoidance, but NOT slow start. * This is known as the Fast * Recovery Algorithm. */ if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { flags |= TH_NEED_SACK_REXMIT; tcp->tcp_pipe -= mss; if (tcp->tcp_pipe < 0) tcp->tcp_pipe = 0; } else { /* * We know that one more packet has * left the pipe thus we can update * cwnd. */ cwnd = tcp->tcp_cwnd + mss; if (cwnd > tcp->tcp_cwnd_max) cwnd = tcp->tcp_cwnd_max; tcp->tcp_cwnd = cwnd; if (tcp->tcp_unsent > 0) flags |= TH_XMIT_NEEDED; } } } } else if (tcp->tcp_zero_win_probe) { /* * If the window has opened, need to arrange * to send additional data. */ if (new_swnd != 0) { /* tcp_suna != tcp_snxt */ /* Packet contains a window update */ BUMP_MIB(&tcps->tcps_mib, tcpInWinUpdate); tcp->tcp_zero_win_probe = 0; tcp->tcp_timer_backoff = 0; tcp->tcp_ms_we_have_waited = 0; /* * Transmit starting with tcp_suna since * the one byte probe is not ack'ed. * If TCP has sent more than one identical * probe, tcp_rexmit will be set. That means * tcp_ss_rexmit() will send out the one * byte along with new data. Otherwise, * fake the retransmission. */ flags |= TH_XMIT_NEEDED; if (!tcp->tcp_rexmit) { tcp->tcp_rexmit = B_TRUE; tcp->tcp_dupack_cnt = 0; tcp->tcp_rexmit_nxt = tcp->tcp_suna; tcp->tcp_rexmit_max = tcp->tcp_suna + 1; } } } goto swnd_update; } /* * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. * If the ACK value acks something that we have not yet sent, it might * be an old duplicate segment. Send an ACK to re-synchronize the * other side. * Note: reset in response to unacceptable ACK in SYN_RECEIVE * state is handled above, so we can always just drop the segment and * send an ACK here. * * Should we send ACKs in response to ACK only segments? */ if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { BUMP_MIB(&tcps->tcps_mib, tcpInAckUnsent); /* drop the received segment */ freemsg(mp); /* * Send back an ACK. If tcp_drop_ack_unsent_cnt is * greater than 0, check if the number of such * bogus ACks is greater than that count. If yes, * don't send back any ACK. This prevents TCP from * getting into an ACK storm if somehow an attacker * successfully spoofs an acceptable segment to our * peer. */ if (tcp_drop_ack_unsent_cnt > 0 && ++tcp->tcp_in_ack_unsent > tcp_drop_ack_unsent_cnt) { TCP_STAT(tcps, tcp_in_ack_unsent_drop); return; } mp = tcp_ack_mp(tcp); if (mp != NULL) { TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); BUMP_LOCAL(tcp->tcp_obsegs); BUMP_MIB(&tcps->tcps_mib, tcpOutAck); tcp_send_data(tcp, tcp->tcp_wq, mp); } return; } /* * TCP gets a new ACK, update the notsack'ed list to delete those * blocks that are covered by this ACK. */ if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); } /* * If we got an ACK after fast retransmit, check to see * if it is a partial ACK. If it is not and the congestion * window was inflated to account for the other side's * cached packets, retract it. If it is, do Hoe's algorithm. */ if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) { ASSERT(tcp->tcp_rexmit == B_FALSE); if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { tcp->tcp_dupack_cnt = 0; /* * Restore the orig tcp_cwnd_ssthresh after * fast retransmit phase. */ if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; } tcp->tcp_rexmit_max = seg_ack; tcp->tcp_cwnd_cnt = 0; tcp->tcp_snd_burst = tcp->tcp_localnet ? TCP_CWND_INFINITE : TCP_CWND_NORMAL; /* * Remove all notsack info to avoid confusion with * the next fast retrasnmit/recovery phase. */ if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); } } else { if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { flags |= TH_NEED_SACK_REXMIT; tcp->tcp_pipe -= mss; if (tcp->tcp_pipe < 0) tcp->tcp_pipe = 0; } else { /* * Hoe's algorithm: * * Retransmit the unack'ed segment and * restart fast recovery. Note that we * need to scale back tcp_cwnd to the * original value when we started fast * recovery. This is to prevent overly * aggressive behaviour in sending new * segments. */ tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + tcps->tcps_dupack_fast_retransmit * mss; tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; flags |= TH_REXMIT_NEEDED; } } } else { tcp->tcp_dupack_cnt = 0; if (tcp->tcp_rexmit) { /* * TCP is retranmitting. If the ACK ack's all * outstanding data, update tcp_rexmit_max and * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt * to the correct value. * * Note that SEQ_LEQ() is used. This is to avoid * unnecessary fast retransmit caused by dup ACKs * received when TCP does slow start retransmission * after a time out. During this phase, TCP may * send out segments which are already received. * This causes dup ACKs to be sent back. */ if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { tcp->tcp_rexmit_nxt = seg_ack; } if (seg_ack != tcp->tcp_rexmit_max) { flags |= TH_XMIT_NEEDED; } } else { tcp->tcp_rexmit = B_FALSE; tcp->tcp_xmit_zc_clean = B_FALSE; tcp->tcp_rexmit_nxt = tcp->tcp_snxt; tcp->tcp_snd_burst = tcp->tcp_localnet ? TCP_CWND_INFINITE : TCP_CWND_NORMAL; } tcp->tcp_ms_we_have_waited = 0; } } BUMP_MIB(&tcps->tcps_mib, tcpInAckSegs); UPDATE_MIB(&tcps->tcps_mib, tcpInAckBytes, bytes_acked); tcp->tcp_suna = seg_ack; if (tcp->tcp_zero_win_probe != 0) { tcp->tcp_zero_win_probe = 0; tcp->tcp_timer_backoff = 0; } /* * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. * Note that it cannot be the SYN being ack'ed. The code flow * will not reach here. */ if (mp1 == NULL) { goto fin_acked; } /* * Update the congestion window. * * If TCP is not ECN capable or TCP is ECN capable but the * congestion experience bit is not set, increase the tcp_cwnd as * usual. */ if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { cwnd = tcp->tcp_cwnd; add = mss; if (cwnd >= tcp->tcp_cwnd_ssthresh) { /* * This is to prevent an increase of less than 1 MSS of * tcp_cwnd. With partial increase, tcp_wput_data() * may send out tinygrams in order to preserve mblk * boundaries. * * By initializing tcp_cwnd_cnt to new tcp_cwnd and * decrementing it by 1 MSS for every ACKs, tcp_cwnd is * increased by 1 MSS for every RTTs. */ if (tcp->tcp_cwnd_cnt <= 0) { tcp->tcp_cwnd_cnt = cwnd + add; } else { tcp->tcp_cwnd_cnt -= add; add = 0; } } tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); } /* See if the latest urgent data has been acknowledged */ if ((tcp->tcp_valid_bits & TCP_URG_VALID) && SEQ_GT(seg_ack, tcp->tcp_urg)) tcp->tcp_valid_bits &= ~TCP_URG_VALID; /* Can we update the RTT estimates? */ if (tcp->tcp_snd_ts_ok) { /* Ignore zero timestamp echo-reply. */ if (tcpopt.tcp_opt_ts_ecr != 0) { tcp_set_rto(tcp, (int32_t)lbolt - (int32_t)tcpopt.tcp_opt_ts_ecr); } /* If needed, restart the timer. */ if (tcp->tcp_set_timer == 1) { TCP_TIMER_RESTART(tcp, tcp->tcp_rto); tcp->tcp_set_timer = 0; } /* * Update tcp_csuna in case the other side stops sending * us timestamps. */ tcp->tcp_csuna = tcp->tcp_snxt; } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { /* * An ACK sequence we haven't seen before, so get the RTT * and update the RTO. But first check if the timestamp is * valid to use. */ if ((mp1->b_next != NULL) && SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) tcp_set_rto(tcp, (int32_t)lbolt - (int32_t)(intptr_t)mp1->b_prev); else BUMP_MIB(&tcps->tcps_mib, tcpRttNoUpdate); /* Remeber the last sequence to be ACKed */ tcp->tcp_csuna = seg_ack; if (tcp->tcp_set_timer == 1) { TCP_TIMER_RESTART(tcp, tcp->tcp_rto); tcp->tcp_set_timer = 0; } } else { BUMP_MIB(&tcps->tcps_mib, tcpRttNoUpdate); } /* Eat acknowledged bytes off the xmit queue. */ for (;;) { mblk_t *mp2; uchar_t *wptr; wptr = mp1->b_wptr; ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); bytes_acked -= (int)(wptr - mp1->b_rptr); if (bytes_acked < 0) { mp1->b_rptr = wptr + bytes_acked; /* * Set a new timestamp if all the bytes timed by the * old timestamp have been ack'ed. */ if (SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) { mp1->b_prev = (mblk_t *)(uintptr_t)lbolt; mp1->b_next = NULL; } break; } mp1->b_next = NULL; mp1->b_prev = NULL; mp2 = mp1; mp1 = mp1->b_cont; /* * This notification is required for some zero-copy * clients to maintain a copy semantic. After the data * is ack'ed, client is safe to modify or reuse the buffer. */ if (tcp->tcp_snd_zcopy_aware && (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) tcp_zcopy_notify(tcp); freeb(mp2); if (bytes_acked == 0) { if (mp1 == NULL) { /* Everything is ack'ed, clear the tail. */ tcp->tcp_xmit_tail = NULL; /* * Cancel the timer unless we are still * waiting for an ACK for the FIN packet. */ if (tcp->tcp_timer_tid != 0 && tcp->tcp_snxt == tcp->tcp_suna) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); tcp->tcp_timer_tid = 0; } goto pre_swnd_update; } if (mp2 != tcp->tcp_xmit_tail) break; tcp->tcp_xmit_tail = mp1; ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - mp1->b_rptr); break; } if (mp1 == NULL) { /* * More was acked but there is nothing more * outstanding. This means that the FIN was * just acked or that we're talking to a clown. */ fin_acked: ASSERT(tcp->tcp_fin_sent); tcp->tcp_xmit_tail = NULL; if (tcp->tcp_fin_sent) { /* FIN was acked - making progress */ if (tcp->tcp_ipversion == IPV6_VERSION && !tcp->tcp_fin_acked) tcp->tcp_ip_forward_progress = B_TRUE; tcp->tcp_fin_acked = B_TRUE; if (tcp->tcp_linger_tid != 0 && TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { tcp_stop_lingering(tcp); freemsg(mp); mp = NULL; } } else { /* * We should never get here because * we have already checked that the * number of bytes ack'ed should be * smaller than or equal to what we * have sent so far (it is the * acceptability check of the ACK). * We can only get here if the send * queue is corrupted. * * Terminate the connection and * panic the system. It is better * for us to panic instead of * continuing to avoid other disaster. */ tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_RST|TH_ACK); panic("Memory corruption " "detected for connection %s.", tcp_display(tcp, NULL, DISP_ADDR_AND_PORT)); /*NOTREACHED*/ } goto pre_swnd_update; } ASSERT(mp2 != tcp->tcp_xmit_tail); } if (tcp->tcp_unsent) { flags |= TH_XMIT_NEEDED; } pre_swnd_update: tcp->tcp_xmit_head = mp1; swnd_update: /* * The following check is different from most other implementations. * For bi-directional transfer, when segments are dropped, the * "normal" check will not accept a window update in those * retransmitted segemnts. Failing to do that, TCP may send out * segments which are outside receiver's window. As TCP accepts * the ack in those retransmitted segments, if the window update in * the same segment is not accepted, TCP will incorrectly calculates * that it can send more segments. This can create a deadlock * with the receiver if its window becomes zero. */ if (SEQ_LT(tcp->tcp_swl2, seg_ack) || SEQ_LT(tcp->tcp_swl1, seg_seq) || (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { /* * The criteria for update is: * * 1. the segment acknowledges some data. Or * 2. the segment is new, i.e. it has a higher seq num. Or * 3. the segment is not old and the advertised window is * larger than the previous advertised window. */ if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) flags |= TH_XMIT_NEEDED; tcp->tcp_swnd = new_swnd; if (new_swnd > tcp->tcp_max_swnd) tcp->tcp_max_swnd = new_swnd; tcp->tcp_swl1 = seg_seq; tcp->tcp_swl2 = seg_ack; } est: if (tcp->tcp_state > TCPS_ESTABLISHED) { switch (tcp->tcp_state) { case TCPS_FIN_WAIT_1: if (tcp->tcp_fin_acked) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_FIN_WAIT_2); tcp->tcp_state = TCPS_FIN_WAIT_2; /* * We implement the non-standard BSD/SunOS * FIN_WAIT_2 flushing algorithm. * If there is no user attached to this * TCP endpoint, then this TCP struct * could hang around forever in FIN_WAIT_2 * state if the peer forgets to send us * a FIN. To prevent this, we wait only * 2*MSL (a convenient time value) for * the FIN to arrive. If it doesn't show up, * we flush the TCP endpoint. This algorithm, * though a violation of RFC-793, has worked * for over 10 years in BSD systems. * Note: SunOS 4.x waits 675 seconds before * flushing the FIN_WAIT_2 connection. */ TCP_TIMER_RESTART(tcp, tcps->tcps_fin_wait_2_flush_interval); } break; case TCPS_FIN_WAIT_2: break; /* Shutdown hook? */ case TCPS_LAST_ACK: freemsg(mp); if (tcp->tcp_fin_acked) { (void) tcp_clean_death(tcp, 0, 19); return; } goto xmit_check; case TCPS_CLOSING: if (tcp->tcp_fin_acked) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_TIME_WAIT); tcp->tcp_state = TCPS_TIME_WAIT; /* * Unconditionally clear the exclusive binding * bit so this TIME-WAIT connection won't * interfere with new ones. */ tcp->tcp_exclbind = 0; if (!TCP_IS_DETACHED(tcp)) { TCP_TIMER_RESTART(tcp, tcps->tcps_time_wait_interval); } else { tcp_time_wait_append(tcp); TCP_DBGSTAT(tcps, tcp_rput_time_wait); } } /*FALLTHRU*/ case TCPS_CLOSE_WAIT: freemsg(mp); goto xmit_check; default: ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); break; } } if (flags & TH_FIN) { /* Make sure we ack the fin */ flags |= TH_ACK_NEEDED; if (!tcp->tcp_fin_rcvd) { tcp->tcp_fin_rcvd = B_TRUE; tcp->tcp_rnxt++; tcph = tcp->tcp_tcph; U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); /* * Generate the ordrel_ind at the end unless we * are an eager guy. * In the eager case tcp_rsrv will do this when run * after tcp_accept is done. */ if (tcp->tcp_listener == NULL && !TCP_IS_DETACHED(tcp) && (!tcp->tcp_hard_binding)) flags |= TH_ORDREL_NEEDED; switch (tcp->tcp_state) { case TCPS_SYN_RCVD: case TCPS_ESTABLISHED: DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_CLOSE_WAIT); tcp->tcp_state = TCPS_CLOSE_WAIT; /* Keepalive? */ break; case TCPS_FIN_WAIT_1: if (!tcp->tcp_fin_acked) { DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_CLOSING); tcp->tcp_state = TCPS_CLOSING; break; } /* FALLTHRU */ case TCPS_FIN_WAIT_2: DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_TIME_WAIT); tcp->tcp_state = TCPS_TIME_WAIT; /* * Unconditionally clear the exclusive binding * bit so this TIME-WAIT connection won't * interfere with new ones. */ tcp->tcp_exclbind = 0; if (!TCP_IS_DETACHED(tcp)) { TCP_TIMER_RESTART(tcp, tcps->tcps_time_wait_interval); } else { tcp_time_wait_append(tcp); TCP_DBGSTAT(tcps, tcp_rput_time_wait); } if (seg_len) { /* * implies data piggybacked on FIN. * break to handle data. */ break; } freemsg(mp); goto ack_check; } } } if (mp == NULL) goto xmit_check; if (seg_len == 0) { freemsg(mp); goto xmit_check; } if (mp->b_rptr == mp->b_wptr) { /* * The header has been consumed, so we remove the * zero-length mblk here. */ mp1 = mp; mp = mp->b_cont; freeb(mp1); } tcph = tcp->tcp_tcph; tcp->tcp_rack_cnt++; { uint32_t cur_max; cur_max = tcp->tcp_rack_cur_max; if (tcp->tcp_rack_cnt >= cur_max) { /* * We have more unacked data than we should - send * an ACK now. */ flags |= TH_ACK_NEEDED; cur_max++; if (cur_max > tcp->tcp_rack_abs_max) tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; else tcp->tcp_rack_cur_max = cur_max; } else if (TCP_IS_DETACHED(tcp)) { /* We don't have an ACK timer for detached TCP. */ flags |= TH_ACK_NEEDED; } else if (seg_len < mss) { /* * If we get a segment that is less than an mss, and we * already have unacknowledged data, and the amount * unacknowledged is not a multiple of mss, then we * better generate an ACK now. Otherwise, this may be * the tail piece of a transaction, and we would rather * wait for the response. */ uint32_t udif; ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= (uintptr_t)INT_MAX); udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); if (udif && (udif % mss)) flags |= TH_ACK_NEEDED; else flags |= TH_ACK_TIMER_NEEDED; } else { /* Start delayed ack timer */ flags |= TH_ACK_TIMER_NEEDED; } } tcp->tcp_rnxt += seg_len; U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); /* Update SACK list */ if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, &(tcp->tcp_num_sack_blk)); } if (tcp->tcp_urp_mp) { tcp->tcp_urp_mp->b_cont = mp; mp = tcp->tcp_urp_mp; tcp->tcp_urp_mp = NULL; /* Ready for a new signal. */ tcp->tcp_urp_last_valid = B_FALSE; #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: sending exdata_ind %s", tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ } /* * Check for ancillary data changes compared to last segment. */ if (tcp->tcp_ipv6_recvancillary != 0) { mp = tcp_rput_add_ancillary(tcp, mp, &ipp); if (mp == NULL) return; } if (tcp->tcp_listener || tcp->tcp_hard_binding) { /* * Side queue inbound data until the accept happens. * tcp_accept/tcp_rput drains this when the accept happens. * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or * T_EXDATA_IND) it is queued on b_next. * XXX Make urgent data use this. Requires: * Removing tcp_listener check for TH_URG * Making M_PCPROTO and MARK messages skip the eager case */ if (tcp->tcp_kssl_pending) { DTRACE_PROBE1(kssl_mblk__ksslinput_pending, mblk_t *, mp); tcp_kssl_input(tcp, mp); } else { tcp_rcv_enqueue(tcp, mp, seg_len); } } else { sodirect_t *sodp = tcp->tcp_sodirect; /* * If an sodirect connection and an enabled sodirect_t then * sodp will be set to point to the tcp_t/sonode_t shared * sodirect_t and the sodirect_t's lock will be held. */ if (sodp != NULL) { mutex_enter(sodp->sod_lock); if (!(sodp->sod_state & SOD_ENABLED)) { mutex_exit(sodp->sod_lock); sodp = NULL; } else if (tcp->tcp_kssl_ctx != NULL && DB_TYPE(mp) == M_DATA) { mutex_exit(sodp->sod_lock); sodp = NULL; } } if (mp->b_datap->db_type != M_DATA || (flags & TH_MARKNEXT_NEEDED)) { if (sodp != NULL) { if (!SOD_QEMPTY(sodp) && (sodp->sod_state & SOD_WAKE_NOT)) { flags |= tcp_rcv_sod_wakeup(tcp, sodp); /* sod_wakeup() did the mutex_exit() */ mutex_enter(sodp->sod_lock); } } else if (tcp->tcp_rcv_list != NULL) { flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); } ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); if (flags & TH_MARKNEXT_NEEDED) { #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: sending MSGMARKNEXT %s", tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ mp->b_flag |= MSGMARKNEXT; flags &= ~TH_MARKNEXT_NEEDED; } /* Does this need SSL processing first? */ if ((tcp->tcp_kssl_ctx != NULL) && (DB_TYPE(mp) == M_DATA)) { DTRACE_PROBE1(kssl_mblk__ksslinput_data1, mblk_t *, mp); tcp_kssl_input(tcp, mp); } else { if (sodp) { /* * Done with sodirect, use putnext * to push this non M_DATA headed * mblk_t chain. */ mutex_exit(sodp->sod_lock); } putnext(tcp->tcp_rq, mp); if (!canputnext(tcp->tcp_rq)) tcp->tcp_rwnd -= seg_len; } } else if ((tcp->tcp_kssl_ctx != NULL) && (DB_TYPE(mp) == M_DATA)) { /* Do SSL processing first */ DTRACE_PROBE1(kssl_mblk__ksslinput_data2, mblk_t *, mp); tcp_kssl_input(tcp, mp); } else if (sodp != NULL) { /* * Sodirect so all mblk_t's are queued on the * socket directly, check for wakeup of blocked * reader (if any), and last if flow-controled. */ flags |= tcp_rcv_sod_enqueue(tcp, sodp, mp, seg_len); if ((sodp->sod_state & SOD_WAKE_NEED) || (flags & (TH_PUSH|TH_FIN))) { flags |= tcp_rcv_sod_wakeup(tcp, sodp); /* sod_wakeup() did the mutex_exit() */ } else { if (SOD_QFULL(sodp)) { /* Q is full, need backenable */ SOD_QSETBE(sodp); } mutex_exit(sodp->sod_lock); } } else if ((flags & (TH_PUSH|TH_FIN)) || tcp->tcp_rcv_cnt + seg_len >= tcp->tcp_rq->q_hiwat >> 3) { if (tcp->tcp_rcv_list != NULL) { /* * Enqueue the new segment first and then * call tcp_rcv_drain() to send all data * up. The other way to do this is to * send all queued data up and then call * putnext() to send the new segment up. * This way can remove the else part later * on. * * We don't this to avoid one more call to * canputnext() as tcp_rcv_drain() needs to * call canputnext(). */ tcp_rcv_enqueue(tcp, mp, seg_len); flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); } else { putnext(tcp->tcp_rq, mp); if (!canputnext(tcp->tcp_rq)) tcp->tcp_rwnd -= seg_len; } } else { /* * Enqueue all packets when processing an mblk * from the co queue and also enqueue normal packets. */ tcp_rcv_enqueue(tcp, mp, seg_len); } /* * Make sure the timer is running if we have data waiting * for a push bit. This provides resiliency against * implementations that do not correctly generate push bits. * * Note, for sodirect if Q isn't empty and there's not a * pending wakeup then we need a timer. Also note that sodp * is assumed to be still valid after exit()ing the sod_lock * above and while the SOD state can change it can only change * such that the Q is empty now even though data was added * above. */ if (((sodp != NULL && !SOD_QEMPTY(sodp) && (sodp->sod_state & SOD_WAKE_NOT)) || (sodp == NULL && tcp->tcp_rcv_list != NULL)) && tcp->tcp_push_tid == 0) { /* * The connection may be closed at this point, so don't * do anything for a detached tcp. */ if (!TCP_IS_DETACHED(tcp)) tcp->tcp_push_tid = TCP_TIMER(tcp, tcp_push_timer, MSEC_TO_TICK( tcps->tcps_push_timer_interval)); } } xmit_check: /* Is there anything left to do? */ ASSERT(!(flags & TH_MARKNEXT_NEEDED)); if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) goto done; /* Any transmit work to do and a non-zero window? */ if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { if (flags & TH_REXMIT_NEEDED) { uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; BUMP_MIB(&tcps->tcps_mib, tcpOutFastRetrans); if (snd_size > mss) snd_size = mss; if (snd_size > tcp->tcp_swnd) snd_size = tcp->tcp_swnd; mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, B_TRUE); if (mp1 != NULL) { tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; tcp->tcp_csuna = tcp->tcp_snxt; BUMP_MIB(&tcps->tcps_mib, tcpRetransSegs); UPDATE_MIB(&tcps->tcps_mib, tcpRetransBytes, snd_size); TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, mp1); } } if (flags & TH_NEED_SACK_REXMIT) { tcp_sack_rxmit(tcp, &flags); } /* * For TH_LIMIT_XMIT, tcp_wput_data() is called to send * out new segment. Note that tcp_rexmit should not be * set, otherwise TH_LIMIT_XMIT should not be set. */ if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { if (!tcp->tcp_rexmit) { tcp_wput_data(tcp, NULL, B_FALSE); } else { tcp_ss_rexmit(tcp); } } /* * Adjust tcp_cwnd back to normal value after sending * new data segments. */ if (flags & TH_LIMIT_XMIT) { tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); /* * This will restart the timer. Restarting the * timer is used to avoid a timeout before the * limited transmitted segment's ACK gets back. */ if (tcp->tcp_xmit_head != NULL) tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; } /* Anything more to do? */ if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) goto done; } ack_check: if (flags & TH_SEND_URP_MARK) { ASSERT(tcp->tcp_urp_mark_mp); /* * Send up any queued data and then send the mark message */ sodirect_t *sodp; SOD_PTR_ENTER(tcp, sodp); mp1 = tcp->tcp_urp_mark_mp; tcp->tcp_urp_mark_mp = NULL; if (sodp != NULL) { ASSERT(tcp->tcp_rcv_list == NULL); flags |= tcp_rcv_sod_wakeup(tcp, sodp); /* sod_wakeup() does the mutex_exit() */ } else if (tcp->tcp_rcv_list != NULL) { flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); } putnext(tcp->tcp_rq, mp1); #ifdef DEBUG (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_rput: sending zero-length %s %s", ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : "MSGNOTMARKNEXT"), tcp_display(tcp, NULL, DISP_PORT_ONLY)); #endif /* DEBUG */ flags &= ~TH_SEND_URP_MARK; } if (flags & TH_ACK_NEEDED) { /* * Time to send an ack for some reason. */ mp1 = tcp_ack_mp(tcp); if (mp1 != NULL) { TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); tcp_send_data(tcp, tcp->tcp_wq, mp1); BUMP_LOCAL(tcp->tcp_obsegs); BUMP_MIB(&tcps->tcps_mib, tcpOutAck); } if (tcp->tcp_ack_tid != 0) { (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); tcp->tcp_ack_tid = 0; } } if (flags & TH_ACK_TIMER_NEEDED) { /* * Arrange for deferred ACK or push wait timeout. * Start timer if it is not already running. */ if (tcp->tcp_ack_tid == 0) { tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, MSEC_TO_TICK(tcp->tcp_localnet ? (clock_t)tcps->tcps_local_dack_interval : (clock_t)tcps->tcps_deferred_ack_interval)); } } if (flags & TH_ORDREL_NEEDED) { /* * Send up the ordrel_ind unless we are an eager guy. * In the eager case tcp_rsrv will do this when run * after tcp_accept is done. */ sodirect_t *sodp; ASSERT(tcp->tcp_listener == NULL); SOD_PTR_ENTER(tcp, sodp); if (sodp != NULL) { /* No more sodirect */ tcp->tcp_sodirect = NULL; if (!SOD_QEMPTY(sodp)) { /* Mblk(s) to process, notify */ flags |= tcp_rcv_sod_wakeup(tcp, sodp); /* sod_wakeup() does the mutex_exit() */ } else { /* Nothing to process */ mutex_exit(sodp->sod_lock); } } else if (tcp->tcp_rcv_list != NULL) { /* * Push any mblk(s) enqueued from co processing. */ flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); } if ((mp1 = mi_tpi_ordrel_ind()) != NULL) { tcp->tcp_ordrel_done = B_TRUE; putnext(tcp->tcp_rq, mp1); if (tcp->tcp_deferred_clean_death) { /* * tcp_clean_death was deferred * for T_ORDREL_IND - do it now */ (void) tcp_clean_death(tcp, tcp->tcp_client_errno, 20); tcp->tcp_deferred_clean_death = B_FALSE; } } else { /* * Run the orderly release in the * service routine. */ qenable(tcp->tcp_rq); /* * Caveat(XXX): The machine may be so * overloaded that tcp_rsrv() is not scheduled * until after the endpoint has transitioned * to TCPS_TIME_WAIT * and tcp_time_wait_interval expires. Then * tcp_timer() will blow away state in tcp_t * and T_ORDREL_IND will never be delivered * upstream. Unlikely but potentially * a problem. */ } } done: ASSERT(!(flags & TH_MARKNEXT_NEEDED)); } /* * This function does PAWS protection check. Returns B_TRUE if the * segment passes the PAWS test, else returns B_FALSE. */ boolean_t tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp) { uint8_t flags; int options; uint8_t *up; flags = (unsigned int)tcph->th_flags[0] & 0xFF; /* * If timestamp option is aligned nicely, get values inline, * otherwise call general routine to parse. Only do that * if timestamp is the only option. */ if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH + TCPOPT_REAL_TS_LEN && OK_32PTR((up = ((uint8_t *)tcph) + TCP_MIN_HEADER_LENGTH)) && *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); options = TCP_OPT_TSTAMP_PRESENT; } else { if (tcp->tcp_snd_sack_ok) { tcpoptp->tcp = tcp; } else { tcpoptp->tcp = NULL; } options = tcp_parse_options(tcph, tcpoptp); } if (options & TCP_OPT_TSTAMP_PRESENT) { /* * Do PAWS per RFC 1323 section 4.2. Accept RST * regardless of the timestamp, page 18 RFC 1323.bis. */ if ((flags & TH_RST) == 0 && TSTMP_LT(tcpoptp->tcp_opt_ts_val, tcp->tcp_ts_recent)) { if (TSTMP_LT(lbolt64, tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) { /* This segment is not acceptable. */ return (B_FALSE); } else { /* * Connection has been idle for * too long. Reset the timestamp * and assume the segment is valid. */ tcp->tcp_ts_recent = tcpoptp->tcp_opt_ts_val; } } } else { /* * If we don't get a timestamp on every packet, we * figure we can't really trust 'em, so we stop sending * and parsing them. */ tcp->tcp_snd_ts_ok = B_FALSE; tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN; tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN; tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4); /* * Adjust the tcp_mss accordingly. We also need to * adjust tcp_cwnd here in accordance with the new mss. * But we avoid doing a slow start here so as to not * to lose on the transfer rate built up so far. */ tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN, B_FALSE); if (tcp->tcp_snd_sack_ok) { ASSERT(tcp->tcp_sack_info != NULL); tcp->tcp_max_sack_blk = 4; } } return (B_TRUE); } /* * Attach ancillary data to a received TCP segments for the * ancillary pieces requested by the application that are * different than they were in the previous data segment. * * Save the "current" values once memory allocation is ok so that * when memory allocation fails we can just wait for the next data segment. */ static mblk_t * tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp) { struct T_optdata_ind *todi; int optlen; uchar_t *optptr; struct T_opthdr *toh; uint_t addflag; /* Which pieces to add */ mblk_t *mp1; optlen = 0; addflag = 0; /* If app asked for pktinfo and the index has changed ... */ if ((ipp->ipp_fields & IPPF_IFINDEX) && ipp->ipp_ifindex != tcp->tcp_recvifindex && (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)) { optlen += sizeof (struct T_opthdr) + sizeof (struct in6_pktinfo); addflag |= TCP_IPV6_RECVPKTINFO; } /* If app asked for hoplimit and it has changed ... */ if ((ipp->ipp_fields & IPPF_HOPLIMIT) && ipp->ipp_hoplimit != tcp->tcp_recvhops && (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT)) { optlen += sizeof (struct T_opthdr) + sizeof (uint_t); addflag |= TCP_IPV6_RECVHOPLIMIT; } /* If app asked for tclass and it has changed ... */ if ((ipp->ipp_fields & IPPF_TCLASS) && ipp->ipp_tclass != tcp->tcp_recvtclass && (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)) { optlen += sizeof (struct T_opthdr) + sizeof (uint_t); addflag |= TCP_IPV6_RECVTCLASS; } /* * If app asked for hopbyhop headers and it has changed ... * For security labels, note that (1) security labels can't change on * a connected socket at all, (2) we're connected to at most one peer, * (3) if anything changes, then it must be some other extra option. */ if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) && ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen - tcp->tcp_label_len; addflag |= TCP_IPV6_RECVHOPOPTS; if (!ip_allocbuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), ipp->ipp_hopopts, ipp->ipp_hopoptslen)) return (mp); } /* If app asked for dst headers before routing headers ... */ if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) && ip_cmpbuf(tcp->tcp_rtdstopts, tcp->tcp_rtdstoptslen, (ipp->ipp_fields & IPPF_RTDSTOPTS), ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) { optlen += sizeof (struct T_opthdr) + ipp->ipp_rtdstoptslen; addflag |= TCP_IPV6_RECVRTDSTOPTS; if (!ip_allocbuf((void **)&tcp->tcp_rtdstopts, &tcp->tcp_rtdstoptslen, (ipp->ipp_fields & IPPF_RTDSTOPTS), ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) return (mp); } /* If app asked for routing headers and it has changed ... */ if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) && ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; addflag |= TCP_IPV6_RECVRTHDR; if (!ip_allocbuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), ipp->ipp_rthdr, ipp->ipp_rthdrlen)) return (mp); } /* If app asked for dest headers and it has changed ... */ if ((tcp->tcp_ipv6_recvancillary & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) && ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; addflag |= TCP_IPV6_RECVDSTOPTS; if (!ip_allocbuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), ipp->ipp_dstopts, ipp->ipp_dstoptslen)) return (mp); } if (optlen == 0) { /* Nothing to add */ return (mp); } mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); if (mp1 == NULL) { /* * Defer sending ancillary data until the next TCP segment * arrives. */ return (mp); } mp1->b_cont = mp; mp = mp1; mp->b_wptr += sizeof (*todi) + optlen; mp->b_datap->db_type = M_PROTO; todi = (struct T_optdata_ind *)mp->b_rptr; todi->PRIM_type = T_OPTDATA_IND; todi->DATA_flag = 1; /* MORE data */ todi->OPT_length = optlen; todi->OPT_offset = sizeof (*todi); optptr = (uchar_t *)&todi[1]; /* * If app asked for pktinfo and the index has changed ... * Note that the local address never changes for the connection. */ if (addflag & TCP_IPV6_RECVPKTINFO) { struct in6_pktinfo *pkti; toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_PKTINFO; toh->len = sizeof (*toh) + sizeof (*pkti); toh->status = 0; optptr += sizeof (*toh); pkti = (struct in6_pktinfo *)optptr; if (tcp->tcp_ipversion == IPV6_VERSION) pkti->ipi6_addr = tcp->tcp_ip6h->ip6_src; else IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &pkti->ipi6_addr); pkti->ipi6_ifindex = ipp->ipp_ifindex; optptr += sizeof (*pkti); ASSERT(OK_32PTR(optptr)); /* Save as "last" value */ tcp->tcp_recvifindex = ipp->ipp_ifindex; } /* If app asked for hoplimit and it has changed ... */ if (addflag & TCP_IPV6_RECVHOPLIMIT) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_HOPLIMIT; toh->len = sizeof (*toh) + sizeof (uint_t); toh->status = 0; optptr += sizeof (*toh); *(uint_t *)optptr = ipp->ipp_hoplimit; optptr += sizeof (uint_t); ASSERT(OK_32PTR(optptr)); /* Save as "last" value */ tcp->tcp_recvhops = ipp->ipp_hoplimit; } /* If app asked for tclass and it has changed ... */ if (addflag & TCP_IPV6_RECVTCLASS) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_TCLASS; toh->len = sizeof (*toh) + sizeof (uint_t); toh->status = 0; optptr += sizeof (*toh); *(uint_t *)optptr = ipp->ipp_tclass; optptr += sizeof (uint_t); ASSERT(OK_32PTR(optptr)); /* Save as "last" value */ tcp->tcp_recvtclass = ipp->ipp_tclass; } if (addflag & TCP_IPV6_RECVHOPOPTS) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_HOPOPTS; toh->len = sizeof (*toh) + ipp->ipp_hopoptslen - tcp->tcp_label_len; toh->status = 0; optptr += sizeof (*toh); bcopy((uchar_t *)ipp->ipp_hopopts + tcp->tcp_label_len, optptr, ipp->ipp_hopoptslen - tcp->tcp_label_len); optptr += ipp->ipp_hopoptslen - tcp->tcp_label_len; ASSERT(OK_32PTR(optptr)); /* Save as last value */ ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), ipp->ipp_hopopts, ipp->ipp_hopoptslen); } if (addflag & TCP_IPV6_RECVRTDSTOPTS) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_RTHDRDSTOPTS; toh->len = sizeof (*toh) + ipp->ipp_rtdstoptslen; toh->status = 0; optptr += sizeof (*toh); bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen); optptr += ipp->ipp_rtdstoptslen; ASSERT(OK_32PTR(optptr)); /* Save as last value */ ip_savebuf((void **)&tcp->tcp_rtdstopts, &tcp->tcp_rtdstoptslen, (ipp->ipp_fields & IPPF_RTDSTOPTS), ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); } if (addflag & TCP_IPV6_RECVRTHDR) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_RTHDR; toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; toh->status = 0; optptr += sizeof (*toh); bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); optptr += ipp->ipp_rthdrlen; ASSERT(OK_32PTR(optptr)); /* Save as last value */ ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), ipp->ipp_rthdr, ipp->ipp_rthdrlen); } if (addflag & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) { toh = (struct T_opthdr *)optptr; toh->level = IPPROTO_IPV6; toh->name = IPV6_DSTOPTS; toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; toh->status = 0; optptr += sizeof (*toh); bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); optptr += ipp->ipp_dstoptslen; ASSERT(OK_32PTR(optptr)); /* Save as last value */ ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), ipp->ipp_dstopts, ipp->ipp_dstoptslen); } ASSERT(optptr == mp->b_wptr); return (mp); } /* * Handle a *T_BIND_REQ that has failed either due to a T_ERROR_ACK * or a "bad" IRE detected by tcp_adapt_ire. * We can't tell if the failure was due to the laddr or the faddr * thus we clear out all addresses and ports. */ static void tcp_bind_failed(tcp_t *tcp, mblk_t *mp, int error) { queue_t *q = tcp->tcp_rq; tcph_t *tcph; struct T_error_ack *tea; conn_t *connp = tcp->tcp_connp; ASSERT(mp->b_datap->db_type == M_PCPROTO); if (mp->b_cont) { freemsg(mp->b_cont); mp->b_cont = NULL; } tea = (struct T_error_ack *)mp->b_rptr; switch (tea->PRIM_type) { case T_BIND_ACK: /* * Need to unbind with classifier since we were just told that * our bind succeeded. */ tcp->tcp_hard_bound = B_FALSE; tcp->tcp_hard_binding = B_FALSE; ipcl_hash_remove(connp); /* Reuse the mblk if possible */ ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >= sizeof (*tea)); mp->b_rptr = mp->b_datap->db_base; mp->b_wptr = mp->b_rptr + sizeof (*tea); tea = (struct T_error_ack *)mp->b_rptr; tea->PRIM_type = T_ERROR_ACK; tea->TLI_error = TSYSERR; tea->UNIX_error = error; if (tcp->tcp_state >= TCPS_SYN_SENT) { tea->ERROR_prim = T_CONN_REQ; } else { tea->ERROR_prim = O_T_BIND_REQ; } break; case T_ERROR_ACK: if (tcp->tcp_state >= TCPS_SYN_SENT) tea->ERROR_prim = T_CONN_REQ; break; default: panic("tcp_bind_failed: unexpected TPI type"); /*NOTREACHED*/ } DTRACE_TCP4(state__change, void, NULL, conn_t *, NULL, tcp_t *, tcp, int32_t, TCPS_IDLE); tcp->tcp_state = TCPS_IDLE; if (tcp->tcp_ipversion == IPV4_VERSION) tcp->tcp_ipha->ipha_src = 0; else V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); /* * Copy of the src addr. in tcp_t is needed since * the lookup funcs. can only look at tcp_t */ V6_SET_ZERO(tcp->tcp_ip_src_v6); tcph = tcp->tcp_tcph; tcph->th_lport[0] = 0; tcph->th_lport[1] = 0; tcp_bind_hash_remove(tcp); bzero(&connp->u_port, sizeof (connp->u_port)); /* blow away saved option results if any */ if (tcp->tcp_conn.tcp_opts_conn_req != NULL) tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); conn_delete_ire(tcp->tcp_connp, NULL); putnext(q, mp); } /* * tcp_rput_other is called by tcp_rput to handle everything other than M_DATA * messages. */ void tcp_rput_other(tcp_t *tcp, mblk_t *mp) { mblk_t *mp1; uchar_t *rptr = mp->b_rptr; queue_t *q = tcp->tcp_rq; struct T_error_ack *tea; uint32_t mss; mblk_t *syn_mp; mblk_t *mdti; mblk_t *lsoi; int retval; mblk_t *ire_mp; tcp_stack_t *tcps = tcp->tcp_tcps; uint_t ip_hdr_len; switch (mp->b_datap->db_type) { case M_PROTO: case M_PCPROTO: ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); if ((mp->b_wptr - rptr) < sizeof (t_scalar_t)) break; tea = (struct T_error_ack *)rptr; switch (tea->PRIM_type) { case T_BIND_ACK: /* * Adapt Multidata information, if any. The * following tcp_mdt_update routine will free * the message. */ if ((mdti = tcp_mdt_info_mp(mp)) != NULL) { tcp_mdt_update(tcp, &((ip_mdt_info_t *)mdti-> b_rptr)->mdt_capab, B_TRUE); freemsg(mdti); } /* * Check to update LSO information with tcp, and * tcp_lso_update routine will free the message. */ if ((lsoi = tcp_lso_info_mp(mp)) != NULL) { tcp_lso_update(tcp, &((ip_lso_info_t *)lsoi-> b_rptr)->lso_capab); freemsg(lsoi); } /* Get the IRE, if we had requested for it */ ire_mp = tcp_ire_mp(mp); if (tcp->tcp_hard_binding) { tcp->tcp_hard_binding = B_FALSE; tcp->tcp_hard_bound = B_TRUE; CL_INET_CONNECT(tcp); } else { if (ire_mp != NULL) freeb(ire_mp); goto after_syn_sent; } retval = tcp_adapt_ire(tcp, ire_mp); if (ire_mp != NULL) freeb(ire_mp); if (retval == 0) { tcp_bind_failed(tcp, mp, (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? ENETUNREACH : EADDRNOTAVAIL)); return; } /* * Don't let an endpoint connect to itself. * Also checked in tcp_connect() but that * check can't handle the case when the * local IP address is INADDR_ANY. */ if (tcp->tcp_ipversion == IPV4_VERSION) { if ((tcp->tcp_ipha->ipha_dst == tcp->tcp_ipha->ipha_src) && (BE16_EQL(tcp->tcp_tcph->th_lport, tcp->tcp_tcph->th_fport))) { tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); return; } } else { if (IN6_ARE_ADDR_EQUAL( &tcp->tcp_ip6h->ip6_dst, &tcp->tcp_ip6h->ip6_src) && (BE16_EQL(tcp->tcp_tcph->th_lport, tcp->tcp_tcph->th_fport))) { tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); return; } } ASSERT(tcp->tcp_state == TCPS_SYN_SENT); /* * This should not be possible! Just for * defensive coding... */ if (tcp->tcp_state != TCPS_SYN_SENT) goto after_syn_sent; if (is_system_labeled() && !tcp_update_label(tcp, CONN_CRED(tcp->tcp_connp))) { tcp_bind_failed(tcp, mp, EHOSTUNREACH); return; } ASSERT(q == tcp->tcp_rq); /* * tcp_adapt_ire() does not adjust * for TCP/IP header length. */ mss = tcp->tcp_mss - tcp->tcp_hdr_len; /* * Just make sure our rwnd is at * least tcp_recv_hiwat_mss * MSS * large, and round up to the nearest * MSS. * * We do the round up here because * we need to get the interface * MTU first before we can do the * round up. */ tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), tcps->tcps_recv_hiwat_minmss * mss); q->q_hiwat = tcp->tcp_rwnd; tcp_set_ws_value(tcp); U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws), tcp->tcp_tcph->th_win); if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) tcp->tcp_snd_ws_ok = B_TRUE; /* * Set tcp_snd_ts_ok to true * so that tcp_xmit_mp will * include the timestamp * option in the SYN segment. */ if (tcps->tcps_tstamp_always || (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { tcp->tcp_snd_ts_ok = B_TRUE; } /* * tcp_snd_sack_ok can be set in * tcp_adapt_ire() if the sack metric * is set. So check it here also. */ if (tcps->tcps_sack_permitted == 2 || tcp->tcp_snd_sack_ok) { if (tcp->tcp_sack_info == NULL) { tcp->tcp_sack_info = kmem_cache_alloc( tcp_sack_info_cache, KM_SLEEP); } tcp->tcp_snd_sack_ok = B_TRUE; } /* * Should we use ECN? Note that the current * default value (SunOS 5.9) of tcp_ecn_permitted * is 1. The reason for doing this is that there * are equipments out there that will drop ECN * enabled IP packets. Setting it to 1 avoids * compatibility problems. */ if (tcps->tcps_ecn_permitted == 2) tcp->tcp_ecn_ok = B_TRUE; TCP_TIMER_RESTART(tcp, tcp->tcp_rto); syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); if (syn_mp) { cred_t *cr; pid_t pid; /* * Obtain the credential from the * thread calling connect(); the credential * lives on in the second mblk which * originated from T_CONN_REQ and is echoed * with the T_BIND_ACK from ip. If none * can be found, default to the creator * of the socket. */ if (mp->b_cont == NULL || (cr = DB_CRED(mp->b_cont)) == NULL) { cr = tcp->tcp_cred; pid = tcp->tcp_cpid; } else { pid = DB_CPID(mp->b_cont); } TCP_RECORD_TRACE(tcp, syn_mp, TCP_TRACE_SEND_PKT); mblk_setcred(syn_mp, cr); DB_CPID(syn_mp) = pid; /* * DTrace sending the first SYN as a * tcp:::connect-request event. For DTrace * only, the IP header length is found * so that the TCP header can be retrieved. */ if (tcp->tcp_ipversion == IPV4_VERSION) ip_hdr_len = IPH_HDR_LENGTH( (ipha_t *)syn_mp->b_rptr); else ip_hdr_len = ip_hdr_length_v6(mp, (ip6_t *)syn_mp->b_rptr); DTRACE_TCP5(connect__request, mblk_t *, NULL, conn_t *, NULL, void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp, tcph_t *, &syn_mp->b_rptr[ip_hdr_len]); tcp_send_data(tcp, tcp->tcp_wq, syn_mp); } after_syn_sent: /* * A trailer mblk indicates a waiting client upstream. * We complete here the processing begun in * either tcp_bind() or tcp_connect() by passing * upstream the reply message they supplied. */ mp1 = mp; mp = mp->b_cont; freeb(mp1); if (mp) break; return; case T_ERROR_ACK: if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, "tcp_rput_other: case T_ERROR_ACK, " "ERROR_prim == %d", tea->ERROR_prim); } switch (tea->ERROR_prim) { case O_T_BIND_REQ: case T_BIND_REQ: tcp_bind_failed(tcp, mp, (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? ENETUNREACH : EADDRNOTAVAIL)); return; case T_UNBIND_REQ: tcp->tcp_hard_binding = B_FALSE; tcp->tcp_hard_bound = B_FALSE; if (mp->b_cont) { freemsg(mp->b_cont); mp->b_cont = NULL; } if (tcp->tcp_unbind_pending) tcp->tcp_unbind_pending = 0; else { /* From tcp_ip_unbind() - free */ freemsg(mp); return; } break; case T_SVR4_OPTMGMT_REQ: if (tcp->tcp_drop_opt_ack_cnt > 0) { /* T_OPTMGMT_REQ generated by TCP */ printf("T_SVR4_OPTMGMT_REQ failed " "%d/%d - dropped (cnt %d)\n", tea->TLI_error, tea->UNIX_error, tcp->tcp_drop_opt_ack_cnt); freemsg(mp); tcp->tcp_drop_opt_ack_cnt--; return; } break; } if (tea->ERROR_prim == T_SVR4_OPTMGMT_REQ && tcp->tcp_drop_opt_ack_cnt > 0) { printf("T_SVR4_OPTMGMT_REQ failed %d/%d " "- dropped (cnt %d)\n", tea->TLI_error, tea->UNIX_error, tcp->tcp_drop_opt_ack_cnt); freemsg(mp); tcp->tcp_drop_opt_ack_cnt--; return; } break; case T_OPTMGMT_ACK: if (tcp->tcp_drop_opt_ack_cnt > 0) { /* T_OPTMGMT_REQ generated by TCP */ freemsg(mp); tcp->tcp_drop_opt_ack_cnt--; return; } break; default: break; } break; case M_FLUSH: if (*rptr & FLUSHR) flushq(q, FLUSHDATA); break; default: /* M_CTL will be directly sent to tcp_icmp_error() */ ASSERT(DB_TYPE(mp) != M_CTL); break; } /* * Make sure we set this bit before sending the ACK for * bind. Otherwise accept could possibly run and free * this tcp struct. */ putnext(q, mp); } /* * Called as the result of a qbufcall or a qtimeout to remedy a failure * to allocate a T_ordrel_ind in tcp_rsrv(). qenable(q) will make * tcp_rsrv() try again. */ static void tcp_ordrel_kick(void *arg) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; tcp->tcp_ordrelid = 0; tcp->tcp_timeout = B_FALSE; if (!TCP_IS_DETACHED(tcp) && tcp->tcp_rq != NULL && tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { qenable(tcp->tcp_rq); } } /* ARGSUSED */ static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2) { conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; queue_t *q = tcp->tcp_rq; uint_t thwin; tcp_stack_t *tcps = tcp->tcp_tcps; sodirect_t *sodp; boolean_t fc; freeb(mp); TCP_STAT(tcps, tcp_rsrv_calls); if (TCP_IS_DETACHED(tcp) || q == NULL) { return; } if (tcp->tcp_fused) { tcp_t *peer_tcp = tcp->tcp_loopback_peer; ASSERT(tcp->tcp_fused); ASSERT(peer_tcp != NULL && peer_tcp->tcp_fused); ASSERT(peer_tcp->tcp_loopback_peer == tcp); ASSERT(!TCP_IS_DETACHED(tcp)); ASSERT(tcp->tcp_connp->conn_sqp == peer_tcp->tcp_connp->conn_sqp); /* * Normally we would not get backenabled in synchronous * streams mode, but in case this happens, we need to plug * synchronous streams during our drain to prevent a race * with tcp_fuse_rrw() or tcp_fuse_rinfop(). */ TCP_FUSE_SYNCSTR_PLUG_DRAIN(tcp); if (tcp->tcp_rcv_list != NULL) (void) tcp_rcv_drain(tcp->tcp_rq, tcp); if (peer_tcp > tcp) { mutex_enter(&peer_tcp->tcp_non_sq_lock); mutex_enter(&tcp->tcp_non_sq_lock); } else { mutex_enter(&tcp->tcp_non_sq_lock); mutex_enter(&peer_tcp->tcp_non_sq_lock); } if (peer_tcp->tcp_flow_stopped && (TCP_UNSENT_BYTES(peer_tcp) <= peer_tcp->tcp_xmit_lowater)) { tcp_clrqfull(peer_tcp); } mutex_exit(&peer_tcp->tcp_non_sq_lock); mutex_exit(&tcp->tcp_non_sq_lock); TCP_FUSE_SYNCSTR_UNPLUG_DRAIN(tcp); TCP_STAT(tcps, tcp_fusion_backenabled); return; } SOD_PTR_ENTER(tcp, sodp); if (sodp != NULL) { /* An sodirect connection */ if (SOD_QFULL(sodp)) { /* Flow-controlled, need another back-enable */ fc = B_TRUE; SOD_QSETBE(sodp); } else { /* Not flow-controlled */ fc = B_FALSE; } mutex_exit(sodp->sod_lock); } else if (canputnext(q)) { /* STREAMS, not flow-controlled */ fc = B_FALSE; } else { /* STREAMS, flow-controlled */ fc = B_TRUE; } if (!fc) { /* Not flow-controlled, open rwnd */ tcp->tcp_rwnd = q->q_hiwat; thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) << tcp->tcp_rcv_ws; thwin -= tcp->tcp_rnxt - tcp->tcp_rack; /* * Send back a window update immediately if TCP is above * ESTABLISHED state and the increase of the rcv window * that the other side knows is at least 1 MSS after flow * control is lifted. */ if (tcp->tcp_state >= TCPS_ESTABLISHED && (q->q_hiwat - thwin >= tcp->tcp_mss)) { tcp_xmit_ctl(NULL, tcp, (tcp->tcp_swnd == 0) ? tcp->tcp_suna : tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); BUMP_MIB(&tcps->tcps_mib, tcpOutWinUpdate); } } /* Handle a failure to allocate a T_ORDREL_IND here */ if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { ASSERT(tcp->tcp_listener == NULL); SOD_PTR_ENTER(tcp, sodp); if (sodp != NULL) { /* No more sodirect */ tcp->tcp_sodirect = NULL; if (!SOD_QEMPTY(sodp)) { /* Notify mblk(s) to process */ (void) tcp_rcv_sod_wakeup(tcp, sodp); /* sod_wakeup() does the mutex_exit() */ } else { /* Nothing to process */ mutex_exit(sodp->sod_lock); } } else if (tcp->tcp_rcv_list != NULL) { /* * Push any mblk(s) enqueued from co processing. */ (void) tcp_rcv_drain(tcp->tcp_rq, tcp); ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); } mp = mi_tpi_ordrel_ind(); if (mp) { tcp->tcp_ordrel_done = B_TRUE; putnext(q, mp); if (tcp->tcp_deferred_clean_death) { /* * tcp_clean_death was deferred for * T_ORDREL_IND - do it now */ tcp->tcp_deferred_clean_death = B_FALSE; (void) tcp_clean_death(tcp, tcp->tcp_client_errno, 22); } } else if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { /* * If there isn't already a timer running * start one. Use a 4 second * timer as a fallback since it can't fail. */ tcp->tcp_timeout = B_TRUE; tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, MSEC_TO_TICK(4000)); } } } /* * The read side service routine is called mostly when we get back-enabled as a * result of flow control relief. Since we don't actually queue anything in * TCP, we have no data to send out of here. What we do is clear the receive * window, and send out a window update. * This routine is also called to drive an orderly release message upstream * if the attempt in tcp_rput failed. */ static void tcp_rsrv(queue_t *q) { conn_t *connp = Q_TO_CONN(q); tcp_t *tcp = connp->conn_tcp; mblk_t *mp; tcp_stack_t *tcps = tcp->tcp_tcps; /* No code does a putq on the read side */ ASSERT(q->q_first == NULL); /* Nothing to do for the default queue */ if (q == tcps->tcps_g_q) { return; } mp = allocb(0, BPRI_HI); if (mp == NULL) { /* * We are under memory pressure. Return for now and we * we will be called again later. */ if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { /* * If there isn't already a timer running * start one. Use a 4 second * timer as a fallback since it can't fail. */ tcp->tcp_timeout = B_TRUE; tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, MSEC_TO_TICK(4000)); } return; } CONN_INC_REF(connp); squeue_enter(connp->conn_sqp, mp, tcp_rsrv_input, connp, SQTAG_TCP_RSRV); } /* * tcp_rwnd_set() is called to adjust the receive window to a desired value. * We do not allow the receive window to shrink. After setting rwnd, * set the flow control hiwat of the stream. * * This function is called in 2 cases: * * 1) Before data transfer begins, in tcp_accept_comm() for accepting a * connection (passive open) and in tcp_rput_data() for active connect. * This is called after tcp_mss_set() when the desired MSS value is known. * This makes sure that our window size is a mutiple of the other side's * MSS. * 2) Handling SO_RCVBUF option. * * It is ASSUMED that the requested size is a multiple of the current MSS. * * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the * user requests so. */ static int tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) { uint32_t mss = tcp->tcp_mss; uint32_t old_max_rwnd; uint32_t max_transmittable_rwnd; boolean_t tcp_detached = TCP_IS_DETACHED(tcp); tcp_stack_t *tcps = tcp->tcp_tcps; if (tcp->tcp_fused) { size_t sth_hiwat; tcp_t *peer_tcp = tcp->tcp_loopback_peer; ASSERT(peer_tcp != NULL); /* * Record the stream head's high water mark for * this endpoint; this is used for flow-control * purposes in tcp_fuse_output(). */ sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); if (!tcp_detached) (void) mi_set_sth_hiwat(tcp->tcp_rq, sth_hiwat); /* * In the fusion case, the maxpsz stream head value of * our peer is set according to its send buffer size * and our receive buffer size; since the latter may * have changed we need to update the peer's maxpsz. */ (void) tcp_maxpsz_set(peer_tcp, B_TRUE); return (rwnd); } if (tcp_detached) old_max_rwnd = tcp->tcp_rwnd; else old_max_rwnd = tcp->tcp_rq->q_hiwat; /* * Insist on a receive window that is at least * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid * funny TCP interactions of Nagle algorithm, SWS avoidance * and delayed acknowledgement. */ rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); /* * If window size info has already been exchanged, TCP should not * shrink the window. Shrinking window is doable if done carefully. * We may add that support later. But so far there is not a real * need to do that. */ if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { /* MSS may have changed, do a round up again. */ rwnd = MSS_ROUNDUP(old_max_rwnd, mss); } /* * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check * can be applied even before the window scale option is decided. */ max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; if (rwnd > max_transmittable_rwnd) { rwnd = max_transmittable_rwnd - (max_transmittable_rwnd % mss); if (rwnd < mss) rwnd = max_transmittable_rwnd; /* * If we're over the limit we may have to back down tcp_rwnd. * The increment below won't work for us. So we set all three * here and the increment below will have no effect. */ tcp->tcp_rwnd = old_max_rwnd = rwnd; } if (tcp->tcp_localnet) { tcp->tcp_rack_abs_max = MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); } else { /* * For a remote host on a different subnet (through a router), * we ack every other packet to be conforming to RFC1122. * tcp_deferred_acks_max is default to 2. */ tcp->tcp_rack_abs_max = MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); } if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; else tcp->tcp_rack_cur_max = 0; /* * Increment the current rwnd by the amount the maximum grew (we * can not overwrite it since we might be in the middle of a * connection.) */ tcp->tcp_rwnd += rwnd - old_max_rwnd; U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win); if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) tcp->tcp_cwnd_max = rwnd; if (tcp_detached) return (rwnd); /* * We set the maximum receive window into rq->q_hiwat. * This is not actually used for flow control. */ tcp->tcp_rq->q_hiwat = rwnd; /* * Set the Stream head high water mark. This doesn't have to be * here, since we are simply using default values, but we would * prefer to choose these values algorithmically, with a likely * relationship to rwnd. */ (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd, tcps->tcps_sth_rcv_hiwat)); return (rwnd); } /* * Return SNMP stuff in buffer in mpdata. */ mblk_t * tcp_snmp_get(queue_t *q, mblk_t *mpctl) { mblk_t *mpdata; mblk_t *mp_conn_ctl = NULL; mblk_t *mp_conn_tail; mblk_t *mp_attr_ctl = NULL; mblk_t *mp_attr_tail; mblk_t *mp6_conn_ctl = NULL; mblk_t *mp6_conn_tail; mblk_t *mp6_attr_ctl = NULL; mblk_t *mp6_attr_tail; struct opthdr *optp; mib2_tcpConnEntry_t tce; mib2_tcp6ConnEntry_t tce6; mib2_transportMLPEntry_t mlp; connf_t *connfp; int i; boolean_t ispriv; zoneid_t zoneid; int v4_conn_idx; int v6_conn_idx; conn_t *connp = Q_TO_CONN(q); tcp_stack_t *tcps; ip_stack_t *ipst; mblk_t *mp2ctl; /* * make a copy of the original message */ mp2ctl = copymsg(mpctl); if (mpctl == NULL || (mpdata = mpctl->b_cont) == NULL || (mp_conn_ctl = copymsg(mpctl)) == NULL || (mp_attr_ctl = copymsg(mpctl)) == NULL || (mp6_conn_ctl = copymsg(mpctl)) == NULL || (mp6_attr_ctl = copymsg(mpctl)) == NULL) { freemsg(mp_conn_ctl); freemsg(mp_attr_ctl); freemsg(mp6_conn_ctl); freemsg(mp6_attr_ctl); freemsg(mpctl); freemsg(mp2ctl); return (NULL); } ipst = connp->conn_netstack->netstack_ip; tcps = connp->conn_netstack->netstack_tcp; /* build table of connections -- need count in fixed part */ SET_MIB(tcps->tcps_mib.tcpRtoAlgorithm, 4); /* vanj */ SET_MIB(tcps->tcps_mib.tcpRtoMin, tcps->tcps_rexmit_interval_min); SET_MIB(tcps->tcps_mib.tcpRtoMax, tcps->tcps_rexmit_interval_max); SET_MIB(tcps->tcps_mib.tcpMaxConn, -1); SET_MIB(tcps->tcps_mib.tcpCurrEstab, 0); ispriv = secpolicy_ip_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0; zoneid = Q_TO_CONN(q)->conn_zoneid; v4_conn_idx = v6_conn_idx = 0; mp_conn_tail = mp_attr_tail = mp6_conn_tail = mp6_attr_tail = NULL; for (i = 0; i < CONN_G_HASH_SIZE; i++) { ipst = tcps->tcps_netstack->netstack_ip; connfp = &ipst->ips_ipcl_globalhash_fanout[i]; connp = NULL; while ((connp = ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { tcp_t *tcp; boolean_t needattr; if (connp->conn_zoneid != zoneid) continue; /* not in this zone */ tcp = connp->conn_tcp; UPDATE_MIB(&tcps->tcps_mib, tcpHCInSegs, tcp->tcp_ibsegs); tcp->tcp_ibsegs = 0; UPDATE_MIB(&tcps->tcps_mib, tcpHCOutSegs, tcp->tcp_obsegs); tcp->tcp_obsegs = 0; tce6.tcp6ConnState = tce.tcpConnState = tcp_snmp_state(tcp); if (tce.tcpConnState == MIB2_TCP_established || tce.tcpConnState == MIB2_TCP_closeWait) BUMP_MIB(&tcps->tcps_mib, tcpCurrEstab); needattr = B_FALSE; bzero(&mlp, sizeof (mlp)); if (connp->conn_mlp_type != mlptSingle) { if (connp->conn_mlp_type == mlptShared || connp->conn_mlp_type == mlptBoth) mlp.tme_flags |= MIB2_TMEF_SHARED; if (connp->conn_mlp_type == mlptPrivate || connp->conn_mlp_type == mlptBoth) mlp.tme_flags |= MIB2_TMEF_PRIVATE; needattr = B_TRUE; } if (connp->conn_peercred != NULL) { ts_label_t *tsl; tsl = crgetlabel(connp->conn_peercred); mlp.tme_doi = label2doi(tsl); mlp.tme_label = *label2bslabel(tsl); needattr = B_TRUE; } /* Create a message to report on IPv6 entries */ if (tcp->tcp_ipversion == IPV6_VERSION) { tce6.tcp6ConnLocalAddress = tcp->tcp_ip_src_v6; tce6.tcp6ConnRemAddress = tcp->tcp_remote_v6; tce6.tcp6ConnLocalPort = ntohs(tcp->tcp_lport); tce6.tcp6ConnRemPort = ntohs(tcp->tcp_fport); tce6.tcp6ConnIfIndex = tcp->tcp_bound_if; /* Don't want just anybody seeing these... */ if (ispriv) { tce6.tcp6ConnEntryInfo.ce_snxt = tcp->tcp_snxt; tce6.tcp6ConnEntryInfo.ce_suna = tcp->tcp_suna; tce6.tcp6ConnEntryInfo.ce_rnxt = tcp->tcp_rnxt; tce6.tcp6ConnEntryInfo.ce_rack = tcp->tcp_rack; } else { /* * Netstat, unfortunately, uses this to * get send/receive queue sizes. How to fix? * Why not compute the difference only? */ tce6.tcp6ConnEntryInfo.ce_snxt = tcp->tcp_snxt - tcp->tcp_suna; tce6.tcp6ConnEntryInfo.ce_suna = 0; tce6.tcp6ConnEntryInfo.ce_rnxt = tcp->tcp_rnxt - tcp->tcp_rack; tce6.tcp6ConnEntryInfo.ce_rack = 0; } tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd; tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; tce6.tcp6ConnEntryInfo.ce_rto = tcp->tcp_rto; tce6.tcp6ConnEntryInfo.ce_mss = tcp->tcp_mss; tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state; tce6.tcp6ConnCreationProcess = (tcp->tcp_cpid < 0) ? MIB2_UNKNOWN_PROCESS : tcp->tcp_cpid; tce6.tcp6ConnCreationTime = tcp->tcp_open_time; (void) snmp_append_data2(mp6_conn_ctl->b_cont, &mp6_conn_tail, (char *)&tce6, sizeof (tce6)); mlp.tme_connidx = v6_conn_idx++; if (needattr) (void) snmp_append_data2(mp6_attr_ctl->b_cont, &mp6_attr_tail, (char *)&mlp, sizeof (mlp)); } /* * Create an IPv4 table entry for IPv4 entries and also * for IPv6 entries which are bound to in6addr_any * but don't have IPV6_V6ONLY set. * (i.e. anything an IPv4 peer could connect to) */ if (tcp->tcp_ipversion == IPV4_VERSION || (tcp->tcp_state <= TCPS_LISTEN && !tcp->tcp_connp->conn_ipv6_v6only && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip_src_v6))) { if (tcp->tcp_ipversion == IPV6_VERSION) { tce.tcpConnRemAddress = INADDR_ANY; tce.tcpConnLocalAddress = INADDR_ANY; } else { tce.tcpConnRemAddress = tcp->tcp_remote; tce.tcpConnLocalAddress = tcp->tcp_ip_src; } tce.tcpConnLocalPort = ntohs(tcp->tcp_lport); tce.tcpConnRemPort = ntohs(tcp->tcp_fport); /* Don't want just anybody seeing these... */ if (ispriv) { tce.tcpConnEntryInfo.ce_snxt = tcp->tcp_snxt; tce.tcpConnEntryInfo.ce_suna = tcp->tcp_suna; tce.tcpConnEntryInfo.ce_rnxt = tcp->tcp_rnxt; tce.tcpConnEntryInfo.ce_rack = tcp->tcp_rack; } else { /* * Netstat, unfortunately, uses this to * get send/receive queue sizes. How * to fix? * Why not compute the difference only? */ tce.tcpConnEntryInfo.ce_snxt = tcp->tcp_snxt - tcp->tcp_suna; tce.tcpConnEntryInfo.ce_suna = 0; tce.tcpConnEntryInfo.ce_rnxt = tcp->tcp_rnxt - tcp->tcp_rack; tce.tcpConnEntryInfo.ce_rack = 0; } tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd; tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; tce.tcpConnEntryInfo.ce_rto = tcp->tcp_rto; tce.tcpConnEntryInfo.ce_mss = tcp->tcp_mss; tce.tcpConnEntryInfo.ce_state = tcp->tcp_state; tce.tcpConnCreationProcess = (tcp->tcp_cpid < 0) ? MIB2_UNKNOWN_PROCESS : tcp->tcp_cpid; tce.tcpConnCreationTime = tcp->tcp_open_time; (void) snmp_append_data2(mp_conn_ctl->b_cont, &mp_conn_tail, (char *)&tce, sizeof (tce)); mlp.tme_connidx = v4_conn_idx++; if (needattr) (void) snmp_append_data2( mp_attr_ctl->b_cont, &mp_attr_tail, (char *)&mlp, sizeof (mlp)); } } } /* fixed length structure for IPv4 and IPv6 counters */ SET_MIB(tcps->tcps_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t)); SET_MIB(tcps->tcps_mib.tcp6ConnTableSize, sizeof (mib2_tcp6ConnEntry_t)); /* synchronize 32- and 64-bit counters */ SYNC32_MIB(&tcps->tcps_mib, tcpInSegs, tcpHCInSegs); SYNC32_MIB(&tcps->tcps_mib, tcpOutSegs, tcpHCOutSegs); optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; optp->level = MIB2_TCP; optp->name = 0; (void) snmp_append_data(mpdata, (char *)&tcps->tcps_mib, sizeof (tcps->tcps_mib)); optp->len = msgdsize(mpdata); qreply(q, mpctl); /* table of connections... */ optp = (struct opthdr *)&mp_conn_ctl->b_rptr[ sizeof (struct T_optmgmt_ack)]; optp->level = MIB2_TCP; optp->name = MIB2_TCP_CONN; optp->len = msgdsize(mp_conn_ctl->b_cont); qreply(q, mp_conn_ctl); /* table of MLP attributes... */ optp = (struct opthdr *)&mp_attr_ctl->b_rptr[ sizeof (struct T_optmgmt_ack)]; optp->level = MIB2_TCP; optp->name = EXPER_XPORT_MLP; optp->len = msgdsize(mp_attr_ctl->b_cont); if (optp->len == 0) freemsg(mp_attr_ctl); else qreply(q, mp_attr_ctl); /* table of IPv6 connections... */ optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[ sizeof (struct T_optmgmt_ack)]; optp->level = MIB2_TCP6; optp->name = MIB2_TCP6_CONN; optp->len = msgdsize(mp6_conn_ctl->b_cont); qreply(q, mp6_conn_ctl); /* table of IPv6 MLP attributes... */ optp = (struct opthdr *)&mp6_attr_ctl->b_rptr[ sizeof (struct T_optmgmt_ack)]; optp->level = MIB2_TCP6; optp->name = EXPER_XPORT_MLP; optp->len = msgdsize(mp6_attr_ctl->b_cont); if (optp->len == 0) freemsg(mp6_attr_ctl); else qreply(q, mp6_attr_ctl); return (mp2ctl); } /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests */ /* ARGSUSED */ int tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) { mib2_tcpConnEntry_t *tce = (mib2_tcpConnEntry_t *)ptr; switch (level) { case MIB2_TCP: switch (name) { case 13: if (tce->tcpConnState != MIB2_TCP_deleteTCB) return (0); /* TODO: delete entry defined by tce */ return (1); default: return (0); } default: return (1); } } /* Translate TCP state to MIB2 TCP state. */ static int tcp_snmp_state(tcp_t *tcp) { if (tcp == NULL) return (0); switch (tcp->tcp_state) { case TCPS_CLOSED: case TCPS_IDLE: /* RFC1213 doesn't have analogue for IDLE & BOUND */ case TCPS_BOUND: return (MIB2_TCP_closed); case TCPS_LISTEN: return (MIB2_TCP_listen); case TCPS_SYN_SENT: return (MIB2_TCP_synSent); case TCPS_SYN_RCVD: return (MIB2_TCP_synReceived); case TCPS_ESTABLISHED: return (MIB2_TCP_established); case TCPS_CLOSE_WAIT: return (MIB2_TCP_closeWait); case TCPS_FIN_WAIT_1: return (MIB2_TCP_finWait1); case TCPS_CLOSING: return (MIB2_TCP_closing); case TCPS_LAST_ACK: return (MIB2_TCP_lastAck); case TCPS_FIN_WAIT_2: return (MIB2_TCP_finWait2); case TCPS_TIME_WAIT: return (MIB2_TCP_timeWait); default: return (0); } } static char tcp_report_header[] = "TCP " MI_COL_HDRPAD_STR "zone dest snxt suna " "swnd rnxt rack rwnd rto mss w sw rw t " "recent [lport,fport] state"; /* * TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static void tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream, cred_t *cr) { char hash[10], addrbuf[INET6_ADDRSTRLEN]; boolean_t ispriv = secpolicy_ip_config(cr, B_TRUE) == 0; char cflag; in6_addr_t v6dst; char buf[80]; uint_t print_len, buf_len; buf_len = mp->b_datap->db_lim - mp->b_wptr; if (buf_len <= 0) return; if (hashval >= 0) (void) sprintf(hash, "%03d ", hashval); else hash[0] = '\0'; /* * Note that we use the remote address in the tcp_b structure. * This means that it will print out the real destination address, * not the next hop's address if source routing is used. This * avoid the confusion on the output because user may not * know that source routing is used for a connection. */ if (tcp->tcp_ipversion == IPV4_VERSION) { IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &v6dst); } else { v6dst = tcp->tcp_remote_v6; } (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); /* * the ispriv checks are so that normal users cannot determine * sequence number information using NDD. */ if (TCP_IS_DETACHED(tcp)) cflag = '*'; else cflag = ' '; print_len = snprintf((char *)mp->b_wptr, buf_len, "%s " MI_COL_PTRFMT_STR "%d %s %08x %08x %010d %08x %08x " "%010d %05ld %05d %1d %02d %02d %1d %08x %s%c\n", hash, (void *)tcp, tcp->tcp_connp->conn_zoneid, addrbuf, (ispriv) ? tcp->tcp_snxt : 0, (ispriv) ? tcp->tcp_suna : 0, tcp->tcp_swnd, (ispriv) ? tcp->tcp_rnxt : 0, (ispriv) ? tcp->tcp_rack : 0, tcp->tcp_rwnd, tcp->tcp_rto, tcp->tcp_mss, tcp->tcp_snd_ws_ok, tcp->tcp_snd_ws, tcp->tcp_rcv_ws, tcp->tcp_snd_ts_ok, tcp->tcp_ts_recent, tcp_display(tcp, buf, DISP_PORT_ONLY), cflag); if (print_len < buf_len) { ((mblk_t *)mp)->b_wptr += print_len; } else { ((mblk_t *)mp)->b_wptr += buf_len; } } /* * TCP status report (for listeners only) triggered via the Named Dispatch * mechanism. */ /* ARGSUSED */ static void tcp_report_listener(mblk_t *mp, tcp_t *tcp, int hashval) { char addrbuf[INET6_ADDRSTRLEN]; in6_addr_t v6dst; uint_t print_len, buf_len; buf_len = mp->b_datap->db_lim - mp->b_wptr; if (buf_len <= 0) return; if (tcp->tcp_ipversion == IPV4_VERSION) { IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &v6dst); (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); } else { (void) inet_ntop(AF_INET6, &tcp->tcp_ip6h->ip6_src, addrbuf, sizeof (addrbuf)); } print_len = snprintf((char *)mp->b_wptr, buf_len, "%03d " MI_COL_PTRFMT_STR "%d %s %05u %08u %d/%d/%d%c\n", hashval, (void *)tcp, tcp->tcp_connp->conn_zoneid, addrbuf, (uint_t)BE16_TO_U16(tcp->tcp_tcph->th_lport), tcp->tcp_conn_req_seqnum, tcp->tcp_conn_req_cnt_q0, tcp->tcp_conn_req_cnt_q, tcp->tcp_conn_req_max, tcp->tcp_syn_defense ? '*' : ' '); if (print_len < buf_len) { ((mblk_t *)mp)->b_wptr += print_len; } else { ((mblk_t *)mp)->b_wptr += buf_len; } } /* TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static int tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { tcp_t *tcp; int i; conn_t *connp; connf_t *connfp; zoneid_t zoneid; tcp_stack_t *tcps; ip_stack_t *ipst; zoneid = Q_TO_CONN(q)->conn_zoneid; tcps = Q_TO_TCP(q)->tcp_tcps; /* * Because of the ndd constraint, at most we can have 64K buffer * to put in all TCP info. So to be more efficient, just * allocate a 64K buffer here, assuming we need that large buffer. * This may be a problem as any user can read tcp_status. Therefore * we limit the rate of doing this using tcp_ndd_get_info_interval. * This should be OK as normal users should not do this too often. */ if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) { if (ddi_get_lbolt() - tcps->tcps_last_ndd_get_info_time < drv_usectohz(tcps->tcps_ndd_get_info_interval * 1000)) { (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); return (0); } } if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { /* The following may work even if we cannot get a large buf. */ (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); return (0); } (void) mi_mpprintf(mp, "%s", tcp_report_header); for (i = 0; i < CONN_G_HASH_SIZE; i++) { ipst = tcps->tcps_netstack->netstack_ip; connfp = &ipst->ips_ipcl_globalhash_fanout[i]; connp = NULL; while ((connp = ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { tcp = connp->conn_tcp; if (zoneid != GLOBAL_ZONEID && zoneid != connp->conn_zoneid) continue; tcp_report_item(mp->b_cont, tcp, -1, tcp, cr); } } tcps->tcps_last_ndd_get_info_time = ddi_get_lbolt(); return (0); } /* TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static int tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { tf_t *tbf; tcp_t *tcp; int i; zoneid_t zoneid; tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; zoneid = Q_TO_CONN(q)->conn_zoneid; /* Refer to comments in tcp_status_report(). */ if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) { if (ddi_get_lbolt() - tcps->tcps_last_ndd_get_info_time < drv_usectohz(tcps->tcps_ndd_get_info_interval * 1000)) { (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); return (0); } } if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { /* The following may work even if we cannot get a large buf. */ (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); return (0); } (void) mi_mpprintf(mp, " %s", tcp_report_header); for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { tbf = &tcps->tcps_bind_fanout[i]; mutex_enter(&tbf->tf_lock); for (tcp = tbf->tf_tcp; tcp != NULL; tcp = tcp->tcp_bind_hash) { if (zoneid != GLOBAL_ZONEID && zoneid != tcp->tcp_connp->conn_zoneid) continue; CONN_INC_REF(tcp->tcp_connp); tcp_report_item(mp->b_cont, tcp, i, Q_TO_TCP(q), cr); CONN_DEC_REF(tcp->tcp_connp); } mutex_exit(&tbf->tf_lock); } tcps->tcps_last_ndd_get_info_time = ddi_get_lbolt(); return (0); } /* TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static int tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { connf_t *connfp; conn_t *connp; tcp_t *tcp; int i; zoneid_t zoneid; tcp_stack_t *tcps; ip_stack_t *ipst; zoneid = Q_TO_CONN(q)->conn_zoneid; tcps = Q_TO_TCP(q)->tcp_tcps; /* Refer to comments in tcp_status_report(). */ if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) { if (ddi_get_lbolt() - tcps->tcps_last_ndd_get_info_time < drv_usectohz(tcps->tcps_ndd_get_info_interval * 1000)) { (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); return (0); } } if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { /* The following may work even if we cannot get a large buf. */ (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); return (0); } (void) mi_mpprintf(mp, " TCP " MI_COL_HDRPAD_STR "zone IP addr port seqnum backlog (q0/q/max)"); ipst = tcps->tcps_netstack->netstack_ip; for (i = 0; i < ipst->ips_ipcl_bind_fanout_size; i++) { connfp = &ipst->ips_ipcl_bind_fanout[i]; connp = NULL; while ((connp = ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { tcp = connp->conn_tcp; if (zoneid != GLOBAL_ZONEID && zoneid != connp->conn_zoneid) continue; tcp_report_listener(mp->b_cont, tcp, i); } } tcps->tcps_last_ndd_get_info_time = ddi_get_lbolt(); return (0); } /* TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static int tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { connf_t *connfp; conn_t *connp; tcp_t *tcp; int i; zoneid_t zoneid; tcp_stack_t *tcps; ip_stack_t *ipst; zoneid = Q_TO_CONN(q)->conn_zoneid; tcps = Q_TO_TCP(q)->tcp_tcps; ipst = tcps->tcps_netstack->netstack_ip; /* Refer to comments in tcp_status_report(). */ if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) { if (ddi_get_lbolt() - tcps->tcps_last_ndd_get_info_time < drv_usectohz(tcps->tcps_ndd_get_info_interval * 1000)) { (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); return (0); } } if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { /* The following may work even if we cannot get a large buf. */ (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); return (0); } (void) mi_mpprintf(mp, "tcp_conn_hash_size = %d", ipst->ips_ipcl_conn_fanout_size); (void) mi_mpprintf(mp, " %s", tcp_report_header); for (i = 0; i < ipst->ips_ipcl_conn_fanout_size; i++) { connfp = &ipst->ips_ipcl_conn_fanout[i]; connp = NULL; while ((connp = ipcl_get_next_conn(connfp, connp, IPCL_TCP)) != NULL) { tcp = connp->conn_tcp; if (zoneid != GLOBAL_ZONEID && zoneid != connp->conn_zoneid) continue; tcp_report_item(mp->b_cont, tcp, i, Q_TO_TCP(q), cr); } } tcps->tcps_last_ndd_get_info_time = ddi_get_lbolt(); return (0); } /* TCP status report triggered via the Named Dispatch mechanism. */ /* ARGSUSED */ static int tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) { tf_t *tf; tcp_t *tcp; int i; zoneid_t zoneid; tcp_stack_t *tcps; zoneid = Q_TO_CONN(q)->conn_zoneid; tcps = Q_TO_TCP(q)->tcp_tcps; /* Refer to comments in tcp_status_report(). */ if (cr == NULL || secpolicy_ip_config(cr, B_TRUE) != 0) { if (ddi_get_lbolt() - tcps->tcps_last_ndd_get_info_time < drv_usectohz(tcps->tcps_ndd_get_info_interval * 1000)) { (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); return (0); } } if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { /* The following may work even if we cannot get a large buf. */ (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); return (0); } (void) mi_mpprintf(mp, " %s", tcp_report_header); for (i = 0; i < TCP_FANOUT_SIZE; i++) { tf = &tcps->tcps_acceptor_fanout[i]; mutex_enter(&tf->tf_lock); for (tcp = tf->tf_tcp; tcp != NULL; tcp = tcp->tcp_acceptor_hash) { if (zoneid != GLOBAL_ZONEID && zoneid != tcp->tcp_connp->conn_zoneid) continue; tcp_report_item(mp->b_cont, tcp, i, Q_TO_TCP(q), cr); } mutex_exit(&tf->tf_lock); } tcps->tcps_last_ndd_get_info_time = ddi_get_lbolt(); return (0); } /* * tcp_timer is the timer service routine. It handles the retransmission, * FIN_WAIT_2 flush, and zero window probe timeout events. It figures out * from the state of the tcp instance what kind of action needs to be done * at the time it is called. */ static void tcp_timer(void *arg) { mblk_t *mp; clock_t first_threshold; clock_t second_threshold; clock_t ms; uint32_t mss; conn_t *connp = (conn_t *)arg; tcp_t *tcp = connp->conn_tcp; tcp_stack_t *tcps = tcp->tcp_tcps; tcp->tcp_timer_tid = 0; if (tcp->tcp_fused) return; first_threshold = tcp->tcp_first_timer_threshold; second_threshold = tcp->tcp_second_timer_threshold; switch (tcp->tcp_state) { case TCPS_IDLE: case TCPS_BOUND: case TCPS_LISTEN: return; case TCPS_SYN_RCVD: { tcp_t *listener = tcp->tcp_listener; if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) { ASSERT(tcp->tcp_rq == listener->tcp_rq); /* it's our first timeout */ tcp->tcp_syn_rcvd_timeout = 1; mutex_enter(&listener->tcp_eager_lock); listener->tcp_syn_rcvd_timeout++; if (!tcp->tcp_dontdrop && !tcp->tcp_closemp_used) { /* * Make this eager available for drop if we * need to drop one to accomodate a new * incoming SYN request. */ MAKE_DROPPABLE(listener, tcp); } if (!listener->tcp_syn_defense && (listener->tcp_syn_rcvd_timeout > (tcps->tcps_conn_req_max_q0 >> 2)) && (tcps->tcps_conn_req_max_q0 > 200)) { /* We may be under attack. Put on a defense. */ listener->tcp_syn_defense = B_TRUE; cmn_err(CE_WARN, "High TCP connect timeout " "rate! System (port %d) may be under a " "SYN flood attack!", BE16_TO_U16(listener->tcp_tcph->th_lport)); listener->tcp_ip_addr_cache = kmem_zalloc( IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t), KM_NOSLEEP); } mutex_exit(&listener->tcp_eager_lock); } else if (listener != NULL) { mutex_enter(&listener->tcp_eager_lock); tcp->tcp_syn_rcvd_timeout++; if (tcp->tcp_syn_rcvd_timeout > 1 && !tcp->tcp_closemp_used) { /* * This is our second timeout. Put the tcp in * the list of droppable eagers to allow it to * be dropped, if needed. We don't check * whether tcp_dontdrop is set or not to * protect ourselve from a SYN attack where a * remote host can spoof itself as one of the * good IP source and continue to hold * resources too long. */ MAKE_DROPPABLE(listener, tcp); } mutex_exit(&listener->tcp_eager_lock); } } /* FALLTHRU */ case TCPS_SYN_SENT: first_threshold = tcp->tcp_first_ctimer_threshold; second_threshold = tcp->tcp_second_ctimer_threshold; break; case TCPS_ESTABLISHED: case TCPS_FIN_WAIT_1: case TCPS_CLOSING: case TCPS_CLOSE_WAIT: case TCPS_LAST_ACK: /* If we have data to rexmit */ if (tcp->tcp_suna != tcp->tcp_snxt) { clock_t time_to_wait; BUMP_MIB(&tcps->tcps_mib, tcpTimRetrans); if (!tcp->tcp_xmit_head) break; time_to_wait = lbolt - (clock_t)tcp->tcp_xmit_head->b_prev; time_to_wait = tcp->tcp_rto - TICK_TO_MSEC(time_to_wait); /* * If the timer fires too early, 1 clock tick earlier, * restart the timer. */ if (time_to_wait > msec_per_tick) { TCP_STAT(tcps, tcp_timer_fire_early); TCP_TIMER_RESTART(tcp, time_to_wait); return; } /* * When we probe zero windows, we force the swnd open. * If our peer acks with a closed window swnd will be * set to zero by tcp_rput(). As long as we are * receiving acks tcp_rput will * reset 'tcp_ms_we_have_waited' so as not to trip the * first and second interval actions. NOTE: the timer * interval is allowed to continue its exponential * backoff. */ if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) { if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, "tcp_timer: zero win"); } } else { /* * After retransmission, we need to do * slow start. Set the ssthresh to one * half of current effective window and * cwnd to one MSS. Also reset * tcp_cwnd_cnt. * * Note that if tcp_ssthresh is reduced because * of ECN, do not reduce it again unless it is * already one window of data away (tcp_cwr * should then be cleared) or this is a * timeout for a retransmitted segment. */ uint32_t npkt; if (!tcp->tcp_cwr || tcp->tcp_rexmit) { npkt = ((tcp->tcp_timer_backoff ? tcp->tcp_cwnd_ssthresh : tcp->tcp_snxt - tcp->tcp_suna) >> 1) / tcp->tcp_mss; tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; } tcp->tcp_cwnd = tcp->tcp_mss; tcp->tcp_cwnd_cnt = 0; if (tcp->tcp_ecn_ok) { tcp->tcp_cwr = B_TRUE; tcp->tcp_cwr_snd_max = tcp->tcp_snxt; tcp->tcp_ecn_cwr_sent = B_FALSE; } } break; } /* * We have something to send yet we cannot send. The * reason can be: * * 1. Zero send window: we need to do zero window probe. * 2. Zero cwnd: because of ECN, we need to "clock out * segments. * 3. SWS avoidance: receiver may have shrunk window, * reset our knowledge. * * Note that condition 2 can happen with either 1 or * 3. But 1 and 3 are exclusive. */ if (tcp->tcp_unsent != 0) { if (tcp->tcp_cwnd == 0) { /* * Set tcp_cwnd to 1 MSS so that a * new segment can be sent out. We * are "clocking out" new data when * the network is really congested. */ ASSERT(tcp->tcp_ecn_ok); tcp->tcp_cwnd = tcp->tcp_mss; } if (tcp->tcp_swnd == 0) { /* Extend window for zero window probe */ tcp->tcp_swnd++; tcp->tcp_zero_win_probe = B_TRUE; BUMP_MIB(&tcps->tcps_mib, tcpOutWinProbe); } else { /* * Handle timeout from sender SWS avoidance. * Reset our knowledge of the max send window * since the receiver might have reduced its * receive buffer. Avoid setting tcp_max_swnd * to one since that will essentially disable * the SWS checks. * * Note that since we don't have a SWS * state variable, if the timeout is set * for ECN but not for SWS, this * code will also be executed. This is * fine as tcp_max_swnd is updated * constantly and it will not affect * anything. */ tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2); } tcp_wput_data(tcp, NULL, B_FALSE); return; } /* Is there a FIN that needs to be to re retransmitted? */ if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && !tcp->tcp_fin_acked) break; /* Nothing to do, return without restarting timer. */ TCP_STAT(tcps, tcp_timer_fire_miss); return; case TCPS_FIN_WAIT_2: /* * User closed the TCP endpoint and peer ACK'ed our FIN. * We waited some time for for peer's FIN, but it hasn't * arrived. We flush the connection now to avoid * case where the peer has rebooted. */ if (TCP_IS_DETACHED(tcp)) { (void) tcp_clean_death(tcp, 0, 23); } else { TCP_TIMER_RESTART(tcp, tcps->tcps_fin_wait_2_flush_interval); } return; case TCPS_TIME_WAIT: (void) tcp_clean_death(tcp, 0, 24); return; default: if (tcp->tcp_debug) { (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, "tcp_timer: strange state (%d) %s", tcp->tcp_state, tcp_display(tcp, NULL, DISP_PORT_ONLY)); } return; } if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) { /* * For zero window probe, we need to send indefinitely, * unless we have not heard from the other si