1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License, Version 1.0 only 6 * (the "License"). You may not use this file except in compliance 7 * with the License. 8 * 9 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10 * or http://www.opensolaris.org/os/licensing. 11 * See the License for the specific language governing permissions 12 * and limitations under the License. 13 * 14 * When distributing Covered Code, include this CDDL HEADER in each 15 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16 * If applicable, add the following below this CDDL HEADER, with the 17 * fields enclosed by brackets "[]" replaced with your own identifying 18 * information: Portions Copyright [yyyy] [name of copyright owner] 19 * 20 * CDDL HEADER END 21 */ 22 /* 23 * Copyright 2005 Sun Microsystems, Inc. All rights reserved. 24 * Use is subject to license terms. 25 */ 26 /* Copyright (c) 1990 Mentat Inc. */ 27 28 #pragma ident "%Z%%M% %I% %E% SMI" 29 30 const char tcp_version[] = "%Z%%M% %I% %E% SMI"; 31 32 #include <sys/types.h> 33 #include <sys/stream.h> 34 #include <sys/strsun.h> 35 #include <sys/strsubr.h> 36 #include <sys/stropts.h> 37 #include <sys/strlog.h> 38 #include <sys/strsun.h> 39 #define _SUN_TPI_VERSION 2 40 #include <sys/tihdr.h> 41 #include <sys/timod.h> 42 #include <sys/ddi.h> 43 #include <sys/sunddi.h> 44 #include <sys/suntpi.h> 45 #include <sys/xti_inet.h> 46 #include <sys/cmn_err.h> 47 #include <sys/debug.h> 48 #include <sys/vtrace.h> 49 #include <sys/kmem.h> 50 #include <sys/ethernet.h> 51 #include <sys/cpuvar.h> 52 #include <sys/dlpi.h> 53 #include <sys/multidata.h> 54 #include <sys/multidata_impl.h> 55 #include <sys/pattr.h> 56 #include <sys/policy.h> 57 #include <sys/zone.h> 58 59 #include <sys/errno.h> 60 #include <sys/signal.h> 61 #include <sys/socket.h> 62 #include <sys/sockio.h> 63 #include <sys/isa_defs.h> 64 #include <sys/md5.h> 65 #include <sys/random.h> 66 #include <netinet/in.h> 67 #include <netinet/tcp.h> 68 #include <netinet/ip6.h> 69 #include <netinet/icmp6.h> 70 #include <net/if.h> 71 #include <net/route.h> 72 #include <inet/ipsec_impl.h> 73 74 #include <inet/common.h> 75 #include <inet/ip.h> 76 #include <inet/ip6.h> 77 #include <inet/ip_ndp.h> 78 #include <inet/mi.h> 79 #include <inet/mib2.h> 80 #include <inet/nd.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <net/pfkeyv2.h> 86 #include <inet/ipsec_info.h> 87 #include <inet/ipdrop.h> 88 #include <inet/tcp_trace.h> 89 90 #include <inet/ipclassifier.h> 91 #include <inet/ip_ire.h> 92 #include <inet/ip_if.h> 93 #include <inet/ipp_common.h> 94 #include <sys/squeue.h> 95 96 /* 97 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 98 * 99 * (Read the detailed design doc in PSARC case directory) 100 * 101 * The entire tcp state is contained in tcp_t and conn_t structure 102 * which are allocated in tandem using ipcl_conn_create() and passing 103 * IPCL_CONNTCP as a flag. We use 'conn_ref' and 'conn_lock' to protect 104 * the references on the tcp_t. The tcp_t structure is never compressed 105 * and packets always land on the correct TCP perimeter from the time 106 * eager is created till the time tcp_t dies (as such the old mentat 107 * TCP global queue is not used for detached state and no IPSEC checking 108 * is required). The global queue is still allocated to send out resets 109 * for connection which have no listeners and IP directly calls 110 * tcp_xmit_listeners_reset() which does any policy check. 111 * 112 * Protection and Synchronisation mechanism: 113 * 114 * The tcp data structure does not use any kind of lock for protecting 115 * its state but instead uses 'squeues' for mutual exclusion from various 116 * read and write side threads. To access a tcp member, the thread should 117 * always be behind squeue (via squeue_enter, squeue_enter_nodrain, or 118 * squeue_fill). Since the squeues allow a direct function call, caller 119 * can pass any tcp function having prototype of edesc_t as argument 120 * (different from traditional STREAMs model where packets come in only 121 * designated entry points). The list of functions that can be directly 122 * called via squeue are listed before the usual function prototype. 123 * 124 * Referencing: 125 * 126 * TCP is MT-Hot and we use a reference based scheme to make sure that the 127 * tcp structure doesn't disappear when its needed. When the application 128 * creates an outgoing connection or accepts an incoming connection, we 129 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 130 * The IP reference is just a symbolic reference since ip_tcpclose() 131 * looks at tcp structure after tcp_close_output() returns which could 132 * have dropped the last TCP reference. So as long as the connection is 133 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 134 * conn_t. The classifier puts its own reference when the connection is 135 * inserted in listen or connected hash. Anytime a thread needs to enter 136 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 137 * on write side or by doing a classify on read side and then puts a 138 * reference on the conn before doing squeue_enter/tryenter/fill. For 139 * read side, the classifier itself puts the reference under fanout lock 140 * to make sure that tcp can't disappear before it gets processed. The 141 * squeue will drop this reference automatically so the called function 142 * doesn't have to do a DEC_REF. 143 * 144 * Opening a new connection: 145 * 146 * The outgoing connection open is pretty simple. ip_tcpopen() does the 147 * work in creating the conn/tcp structure and initializing it. The 148 * squeue assignment is done based on the CPU the application 149 * is running on. So for outbound connections, processing is always done 150 * on application CPU which might be different from the incoming CPU 151 * being interrupted by the NIC. An optimal way would be to figure out 152 * the NIC <-> CPU binding at listen time, and assign the outgoing 153 * connection to the squeue attached to the CPU that will be interrupted 154 * for incoming packets (we know the NIC based on the bind IP address). 155 * This might seem like a problem if more data is going out but the 156 * fact is that in most cases the transmit is ACK driven transmit where 157 * the outgoing data normally sits on TCP's xmit queue waiting to be 158 * transmitted. 159 * 160 * Accepting a connection: 161 * 162 * This is a more interesting case because of various races involved in 163 * establishing a eager in its own perimeter. Read the meta comment on 164 * top of tcp_conn_request(). But briefly, the squeue is picked by 165 * ip_tcp_input()/ip_fanout_tcp_v6() based on the interrupted CPU. 166 * 167 * Closing a connection: 168 * 169 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 170 * via squeue to do the close and mark the tcp as detached if the connection 171 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 172 * reference but tcp_close() drop IP's reference always. So if tcp was 173 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 174 * and 1 because it is in classifier's connected hash. This is the condition 175 * we use to determine that its OK to clean up the tcp outside of squeue 176 * when time wait expires (check the ref under fanout and conn_lock and 177 * if it is 2, remove it from fanout hash and kill it). 178 * 179 * Although close just drops the necessary references and marks the 180 * tcp_detached state, tcp_close needs to know the tcp_detached has been 181 * set (under squeue) before letting the STREAM go away (because a 182 * inbound packet might attempt to go up the STREAM while the close 183 * has happened and tcp_detached is not set). So a special lock and 184 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 185 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 186 * tcp_detached. 187 * 188 * Special provisions and fast paths: 189 * 190 * We make special provision for (AF_INET, SOCK_STREAM) sockets which 191 * can't have 'ipv6_recvpktinfo' set and for these type of sockets, IP 192 * will never send a M_CTL to TCP. As such, ip_tcp_input() which handles 193 * all TCP packets from the wire makes a IPCL_IS_TCP4_CONNECTED_NO_POLICY 194 * check to send packets directly to tcp_rput_data via squeue. Everyone 195 * else comes through tcp_input() on the read side. 196 * 197 * We also make special provisions for sockfs by marking tcp_issocket 198 * whenever we have only sockfs on top of TCP. This allows us to skip 199 * putting the tcp in acceptor hash since a sockfs listener can never 200 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 201 * since eager has already been allocated and the accept now happens 202 * on acceptor STREAM. There is a big blob of comment on top of 203 * tcp_conn_request explaining the new accept. When socket is POP'd, 204 * sockfs sends us an ioctl to mark the fact and we go back to old 205 * behaviour. Once tcp_issocket is unset, its never set for the 206 * life of that connection. 207 * 208 * IPsec notes : 209 * 210 * Since a packet is always executed on the correct TCP perimeter 211 * all IPsec processing is defered to IP including checking new 212 * connections and setting IPSEC policies for new connection. The 213 * only exception is tcp_xmit_listeners_reset() which is called 214 * directly from IP and needs to policy check to see if TH_RST 215 * can be sent out. 216 */ 217 218 219 extern major_t TCP6_MAJ; 220 221 /* 222 * Values for squeue switch: 223 * 1: squeue_enter_nodrain 224 * 2: squeue_enter 225 * 3: squeue_fill 226 */ 227 int tcp_squeue_close = 2; 228 int tcp_squeue_wput = 2; 229 230 squeue_func_t tcp_squeue_close_proc; 231 squeue_func_t tcp_squeue_wput_proc; 232 233 extern vmem_t *ip_minor_arena; 234 235 /* 236 * This controls how tiny a write must be before we try to copy it 237 * into the the mblk on the tail of the transmit queue. Not much 238 * speedup is observed for values larger than sixteen. Zero will 239 * disable the optimisation. 240 */ 241 int tcp_tx_pull_len = 16; 242 243 /* 244 * TCP Statistics. 245 * 246 * How TCP statistics work. 247 * 248 * There are two types of statistics invoked by two macros. 249 * 250 * TCP_STAT(name) does non-atomic increment of a named stat counter. It is 251 * supposed to be used in non MT-hot paths of the code. 252 * 253 * TCP_DBGSTAT(name) does atomic increment of a named stat counter. It is 254 * supposed to be used for DEBUG purposes and may be used on a hot path. 255 * 256 * Both TCP_STAT and TCP_DBGSTAT counters are available using kstat 257 * (use "kstat tcp" to get them). 258 * 259 * There is also additional debugging facility that marks tcp_clean_death() 260 * instances and saves them in tcp_t structure. It is triggered by 261 * TCP_TAG_CLEAN_DEATH define. Also, there is a global array of counters for 262 * tcp_clean_death() calls that counts the number of times each tag was hit. It 263 * is triggered by TCP_CLD_COUNTERS define. 264 * 265 * How to add new counters. 266 * 267 * 1) Add a field in the tcp_stat structure describing your counter. 268 * 2) Add a line in tcp_statistics with the name of the counter. 269 * 270 * IMPORTANT!! - make sure that both are in sync !! 271 * 3) Use either TCP_STAT or TCP_DBGSTAT with the name. 272 * 273 * Please avoid using private counters which are not kstat-exported. 274 * 275 * TCP_TAG_CLEAN_DEATH set to 1 enables tagging of tcp_clean_death() instances 276 * in tcp_t structure. 277 * 278 * TCP_MAX_CLEAN_DEATH_TAG is the maximum number of possible clean death tags. 279 */ 280 281 #define TCP_COUNTERS 1 282 #define TCP_CLD_COUNTERS 0 283 284 #ifndef TCP_DEBUG_COUNTER 285 #ifdef DEBUG 286 #define TCP_DEBUG_COUNTER 1 287 #else 288 #define TCP_DEBUG_COUNTER 0 289 #endif 290 #endif 291 292 293 #define TCP_TAG_CLEAN_DEATH 1 294 #define TCP_MAX_CLEAN_DEATH_TAG 32 295 296 #ifdef lint 297 static int _lint_dummy_; 298 #endif 299 300 #if TCP_COUNTERS 301 #define TCP_STAT(x) (tcp_statistics.x.value.ui64++) 302 #define TCP_STAT_UPDATE(x, n) (tcp_statistics.x.value.ui64 += (n)) 303 #define TCP_STAT_SET(x, n) (tcp_statistics.x.value.ui64 = (n)) 304 #elif defined(lint) 305 #define TCP_STAT(x) ASSERT(_lint_dummy_ == 0); 306 #define TCP_STAT_UPDATE(x, n) ASSERT(_lint_dummy_ == 0); 307 #define TCP_STAT_SET(x, n) ASSERT(_lint_dummy_ == 0); 308 #else 309 #define TCP_STAT(x) 310 #define TCP_STAT_UPDATE(x, n) 311 #define TCP_STAT_SET(x, n) 312 #endif 313 314 #if TCP_CLD_COUNTERS 315 static uint_t tcp_clean_death_stat[TCP_MAX_CLEAN_DEATH_TAG]; 316 #define TCP_CLD_STAT(x) tcp_clean_death_stat[x]++ 317 #elif defined(lint) 318 #define TCP_CLD_STAT(x) ASSERT(_lint_dummy_ == 0); 319 #else 320 #define TCP_CLD_STAT(x) 321 #endif 322 323 #if TCP_DEBUG_COUNTER 324 #define TCP_DBGSTAT(x) atomic_add_64(&(tcp_statistics.x.value.ui64), 1) 325 #elif defined(lint) 326 #define TCP_DBGSTAT(x) ASSERT(_lint_dummy_ == 0); 327 #else 328 #define TCP_DBGSTAT(x) 329 #endif 330 331 typedef struct tcp_stat { 332 kstat_named_t tcp_time_wait; 333 kstat_named_t tcp_time_wait_syn; 334 kstat_named_t tcp_time_wait_syn_success; 335 kstat_named_t tcp_time_wait_syn_fail; 336 kstat_named_t tcp_reinput_syn; 337 kstat_named_t tcp_ip_output; 338 kstat_named_t tcp_detach_non_time_wait; 339 kstat_named_t tcp_detach_time_wait; 340 kstat_named_t tcp_time_wait_reap; 341 kstat_named_t tcp_clean_death_nondetached; 342 kstat_named_t tcp_reinit_calls; 343 kstat_named_t tcp_eager_err1; 344 kstat_named_t tcp_eager_err2; 345 kstat_named_t tcp_eager_blowoff_calls; 346 kstat_named_t tcp_eager_blowoff_q; 347 kstat_named_t tcp_eager_blowoff_q0; 348 kstat_named_t tcp_not_hard_bound; 349 kstat_named_t tcp_no_listener; 350 kstat_named_t tcp_found_eager; 351 kstat_named_t tcp_wrong_queue; 352 kstat_named_t tcp_found_eager_binding1; 353 kstat_named_t tcp_found_eager_bound1; 354 kstat_named_t tcp_eager_has_listener1; 355 kstat_named_t tcp_open_alloc; 356 kstat_named_t tcp_open_detached_alloc; 357 kstat_named_t tcp_rput_time_wait; 358 kstat_named_t tcp_listendrop; 359 kstat_named_t tcp_listendropq0; 360 kstat_named_t tcp_wrong_rq; 361 kstat_named_t tcp_rsrv_calls; 362 kstat_named_t tcp_eagerfree2; 363 kstat_named_t tcp_eagerfree3; 364 kstat_named_t tcp_eagerfree4; 365 kstat_named_t tcp_eagerfree5; 366 kstat_named_t tcp_timewait_syn_fail; 367 kstat_named_t tcp_listen_badflags; 368 kstat_named_t tcp_timeout_calls; 369 kstat_named_t tcp_timeout_cached_alloc; 370 kstat_named_t tcp_timeout_cancel_reqs; 371 kstat_named_t tcp_timeout_canceled; 372 kstat_named_t tcp_timermp_alloced; 373 kstat_named_t tcp_timermp_freed; 374 kstat_named_t tcp_timermp_allocfail; 375 kstat_named_t tcp_timermp_allocdblfail; 376 kstat_named_t tcp_push_timer_cnt; 377 kstat_named_t tcp_ack_timer_cnt; 378 kstat_named_t tcp_ire_null1; 379 kstat_named_t tcp_ire_null; 380 kstat_named_t tcp_ip_send; 381 kstat_named_t tcp_ip_ire_send; 382 kstat_named_t tcp_wsrv_called; 383 kstat_named_t tcp_flwctl_on; 384 kstat_named_t tcp_timer_fire_early; 385 kstat_named_t tcp_timer_fire_miss; 386 kstat_named_t tcp_freelist_cleanup; 387 kstat_named_t tcp_rput_v6_error; 388 kstat_named_t tcp_out_sw_cksum; 389 kstat_named_t tcp_zcopy_on; 390 kstat_named_t tcp_zcopy_off; 391 kstat_named_t tcp_zcopy_backoff; 392 kstat_named_t tcp_zcopy_disable; 393 kstat_named_t tcp_mdt_pkt_out; 394 kstat_named_t tcp_mdt_pkt_out_v4; 395 kstat_named_t tcp_mdt_pkt_out_v6; 396 kstat_named_t tcp_mdt_discarded; 397 kstat_named_t tcp_mdt_conn_halted1; 398 kstat_named_t tcp_mdt_conn_halted2; 399 kstat_named_t tcp_mdt_conn_halted3; 400 kstat_named_t tcp_mdt_conn_resumed1; 401 kstat_named_t tcp_mdt_conn_resumed2; 402 kstat_named_t tcp_mdt_legacy_small; 403 kstat_named_t tcp_mdt_legacy_all; 404 kstat_named_t tcp_mdt_legacy_ret; 405 kstat_named_t tcp_mdt_allocfail; 406 kstat_named_t tcp_mdt_addpdescfail; 407 kstat_named_t tcp_mdt_allocd; 408 kstat_named_t tcp_mdt_linked; 409 kstat_named_t tcp_fusion_flowctl; 410 kstat_named_t tcp_fusion_backenabled; 411 kstat_named_t tcp_fusion_urg; 412 kstat_named_t tcp_fusion_putnext; 413 kstat_named_t tcp_fusion_unfusable; 414 kstat_named_t tcp_fusion_aborted; 415 kstat_named_t tcp_fusion_unqualified; 416 kstat_named_t tcp_in_ack_unsent_drop; 417 } tcp_stat_t; 418 419 #if (TCP_COUNTERS || TCP_DEBUG_COUNTER) 420 static tcp_stat_t tcp_statistics = { 421 { "tcp_time_wait", KSTAT_DATA_UINT64 }, 422 { "tcp_time_wait_syn", KSTAT_DATA_UINT64 }, 423 { "tcp_time_wait_success", KSTAT_DATA_UINT64 }, 424 { "tcp_time_wait_fail", KSTAT_DATA_UINT64 }, 425 { "tcp_reinput_syn", KSTAT_DATA_UINT64 }, 426 { "tcp_ip_output", KSTAT_DATA_UINT64 }, 427 { "tcp_detach_non_time_wait", KSTAT_DATA_UINT64 }, 428 { "tcp_detach_time_wait", KSTAT_DATA_UINT64 }, 429 { "tcp_time_wait_reap", KSTAT_DATA_UINT64 }, 430 { "tcp_clean_death_nondetached", KSTAT_DATA_UINT64 }, 431 { "tcp_reinit_calls", KSTAT_DATA_UINT64 }, 432 { "tcp_eager_err1", KSTAT_DATA_UINT64 }, 433 { "tcp_eager_err2", KSTAT_DATA_UINT64 }, 434 { "tcp_eager_blowoff_calls", KSTAT_DATA_UINT64 }, 435 { "tcp_eager_blowoff_q", KSTAT_DATA_UINT64 }, 436 { "tcp_eager_blowoff_q0", KSTAT_DATA_UINT64 }, 437 { "tcp_not_hard_bound", KSTAT_DATA_UINT64 }, 438 { "tcp_no_listener", KSTAT_DATA_UINT64 }, 439 { "tcp_found_eager", KSTAT_DATA_UINT64 }, 440 { "tcp_wrong_queue", KSTAT_DATA_UINT64 }, 441 { "tcp_found_eager_binding1", KSTAT_DATA_UINT64 }, 442 { "tcp_found_eager_bound1", KSTAT_DATA_UINT64 }, 443 { "tcp_eager_has_listener1", KSTAT_DATA_UINT64 }, 444 { "tcp_open_alloc", KSTAT_DATA_UINT64 }, 445 { "tcp_open_detached_alloc", KSTAT_DATA_UINT64 }, 446 { "tcp_rput_time_wait", KSTAT_DATA_UINT64 }, 447 { "tcp_listendrop", KSTAT_DATA_UINT64 }, 448 { "tcp_listendropq0", KSTAT_DATA_UINT64 }, 449 { "tcp_wrong_rq", KSTAT_DATA_UINT64 }, 450 { "tcp_rsrv_calls", KSTAT_DATA_UINT64 }, 451 { "tcp_eagerfree2", KSTAT_DATA_UINT64 }, 452 { "tcp_eagerfree3", KSTAT_DATA_UINT64 }, 453 { "tcp_eagerfree4", KSTAT_DATA_UINT64 }, 454 { "tcp_eagerfree5", KSTAT_DATA_UINT64 }, 455 { "tcp_timewait_syn_fail", KSTAT_DATA_UINT64 }, 456 { "tcp_listen_badflags", KSTAT_DATA_UINT64 }, 457 { "tcp_timeout_calls", KSTAT_DATA_UINT64 }, 458 { "tcp_timeout_cached_alloc", KSTAT_DATA_UINT64 }, 459 { "tcp_timeout_cancel_reqs", KSTAT_DATA_UINT64 }, 460 { "tcp_timeout_canceled", KSTAT_DATA_UINT64 }, 461 { "tcp_timermp_alloced", KSTAT_DATA_UINT64 }, 462 { "tcp_timermp_freed", KSTAT_DATA_UINT64 }, 463 { "tcp_timermp_allocfail", KSTAT_DATA_UINT64 }, 464 { "tcp_timermp_allocdblfail", KSTAT_DATA_UINT64 }, 465 { "tcp_push_timer_cnt", KSTAT_DATA_UINT64 }, 466 { "tcp_ack_timer_cnt", KSTAT_DATA_UINT64 }, 467 { "tcp_ire_null1", KSTAT_DATA_UINT64 }, 468 { "tcp_ire_null", KSTAT_DATA_UINT64 }, 469 { "tcp_ip_send", KSTAT_DATA_UINT64 }, 470 { "tcp_ip_ire_send", KSTAT_DATA_UINT64 }, 471 { "tcp_wsrv_called", KSTAT_DATA_UINT64 }, 472 { "tcp_flwctl_on", KSTAT_DATA_UINT64 }, 473 { "tcp_timer_fire_early", KSTAT_DATA_UINT64 }, 474 { "tcp_timer_fire_miss", KSTAT_DATA_UINT64 }, 475 { "tcp_freelist_cleanup", KSTAT_DATA_UINT64 }, 476 { "tcp_rput_v6_error", KSTAT_DATA_UINT64 }, 477 { "tcp_out_sw_cksum", KSTAT_DATA_UINT64 }, 478 { "tcp_zcopy_on", KSTAT_DATA_UINT64 }, 479 { "tcp_zcopy_off", KSTAT_DATA_UINT64 }, 480 { "tcp_zcopy_backoff", KSTAT_DATA_UINT64 }, 481 { "tcp_zcopy_disable", KSTAT_DATA_UINT64 }, 482 { "tcp_mdt_pkt_out", KSTAT_DATA_UINT64 }, 483 { "tcp_mdt_pkt_out_v4", KSTAT_DATA_UINT64 }, 484 { "tcp_mdt_pkt_out_v6", KSTAT_DATA_UINT64 }, 485 { "tcp_mdt_discarded", KSTAT_DATA_UINT64 }, 486 { "tcp_mdt_conn_halted1", KSTAT_DATA_UINT64 }, 487 { "tcp_mdt_conn_halted2", KSTAT_DATA_UINT64 }, 488 { "tcp_mdt_conn_halted3", KSTAT_DATA_UINT64 }, 489 { "tcp_mdt_conn_resumed1", KSTAT_DATA_UINT64 }, 490 { "tcp_mdt_conn_resumed2", KSTAT_DATA_UINT64 }, 491 { "tcp_mdt_legacy_small", KSTAT_DATA_UINT64 }, 492 { "tcp_mdt_legacy_all", KSTAT_DATA_UINT64 }, 493 { "tcp_mdt_legacy_ret", KSTAT_DATA_UINT64 }, 494 { "tcp_mdt_allocfail", KSTAT_DATA_UINT64 }, 495 { "tcp_mdt_addpdescfail", KSTAT_DATA_UINT64 }, 496 { "tcp_mdt_allocd", KSTAT_DATA_UINT64 }, 497 { "tcp_mdt_linked", KSTAT_DATA_UINT64 }, 498 { "tcp_fusion_flowctl", KSTAT_DATA_UINT64 }, 499 { "tcp_fusion_backenabled", KSTAT_DATA_UINT64 }, 500 { "tcp_fusion_urg", KSTAT_DATA_UINT64 }, 501 { "tcp_fusion_putnext", KSTAT_DATA_UINT64 }, 502 { "tcp_fusion_unfusable", KSTAT_DATA_UINT64 }, 503 { "tcp_fusion_aborted", KSTAT_DATA_UINT64 }, 504 { "tcp_fusion_unqualified", KSTAT_DATA_UINT64 }, 505 { "tcp_in_ack_unsent_drop", KSTAT_DATA_UINT64 }, 506 }; 507 508 static kstat_t *tcp_kstat; 509 510 #endif 511 512 /* 513 * Call either ip_output or ip_output_v6. This replaces putnext() calls on the 514 * tcp write side. 515 */ 516 #define CALL_IP_WPUT(connp, q, mp) { \ 517 ASSERT(((q)->q_flag & QREADR) == 0); \ 518 TCP_DBGSTAT(tcp_ip_output); \ 519 connp->conn_send(connp, (mp), (q), IP_WPUT); \ 520 } 521 522 /* 523 * Was this tcp created via socket() interface? 524 */ 525 #define TCP_IS_SOCKET(tcp) ((tcp)->tcp_issocket) 526 527 528 /* Macros for timestamp comparisons */ 529 #define TSTMP_GEQ(a, b) ((int32_t)((a)-(b)) >= 0) 530 #define TSTMP_LT(a, b) ((int32_t)((a)-(b)) < 0) 531 532 /* 533 * Parameters for TCP Initial Send Sequence number (ISS) generation. When 534 * tcp_strong_iss is set to 1, which is the default, the ISS is calculated 535 * by adding three components: a time component which grows by 1 every 4096 536 * nanoseconds (versus every 4 microseconds suggested by RFC 793, page 27); 537 * a per-connection component which grows by 125000 for every new connection; 538 * and an "extra" component that grows by a random amount centered 539 * approximately on 64000. This causes the the ISS generator to cycle every 540 * 4.89 hours if no TCP connections are made, and faster if connections are 541 * made. 542 * 543 * When tcp_strong_iss is set to 0, ISS is calculated by adding two 544 * components: a time component which grows by 250000 every second; and 545 * a per-connection component which grows by 125000 for every new connections. 546 * 547 * A third method, when tcp_strong_iss is set to 2, for generating ISS is 548 * prescribed by Steve Bellovin. This involves adding time, the 125000 per 549 * connection, and a one-way hash (MD5) of the connection ID <sport, dport, 550 * src, dst>, a "truly" random (per RFC 1750) number, and a console-entered 551 * password. 552 */ 553 #define ISS_INCR 250000 554 #define ISS_NSEC_SHT 12 555 556 static uint32_t tcp_iss_incr_extra; /* Incremented for each connection */ 557 static kmutex_t tcp_iss_key_lock; 558 static MD5_CTX tcp_iss_key; 559 static sin_t sin_null; /* Zero address for quick clears */ 560 static sin6_t sin6_null; /* Zero address for quick clears */ 561 562 /* Packet dropper for TCP IPsec policy drops. */ 563 static ipdropper_t tcp_dropper; 564 565 /* 566 * This implementation follows the 4.3BSD interpretation of the urgent 567 * pointer and not RFC 1122. Switching to RFC 1122 behavior would cause 568 * incompatible changes in protocols like telnet and rlogin. 569 */ 570 #define TCP_OLD_URP_INTERPRETATION 1 571 572 #define TCP_IS_DETACHED(tcp) ((tcp)->tcp_detached) 573 574 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 575 (TCP_IS_DETACHED(tcp) && \ 576 (!(tcp)->tcp_hard_binding)) 577 578 /* 579 * TCP reassembly macros. We hide starting and ending sequence numbers in 580 * b_next and b_prev of messages on the reassembly queue. The messages are 581 * chained using b_cont. These macros are used in tcp_reass() so we don't 582 * have to see the ugly casts and assignments. 583 */ 584 #define TCP_REASS_SEQ(mp) ((uint32_t)(uintptr_t)((mp)->b_next)) 585 #define TCP_REASS_SET_SEQ(mp, u) ((mp)->b_next = \ 586 (mblk_t *)(uintptr_t)(u)) 587 #define TCP_REASS_END(mp) ((uint32_t)(uintptr_t)((mp)->b_prev)) 588 #define TCP_REASS_SET_END(mp, u) ((mp)->b_prev = \ 589 (mblk_t *)(uintptr_t)(u)) 590 591 /* 592 * Implementation of TCP Timers. 593 * ============================= 594 * 595 * INTERFACE: 596 * 597 * There are two basic functions dealing with tcp timers: 598 * 599 * timeout_id_t tcp_timeout(connp, func, time) 600 * clock_t tcp_timeout_cancel(connp, timeout_id) 601 * TCP_TIMER_RESTART(tcp, intvl) 602 * 603 * tcp_timeout() starts a timer for the 'tcp' instance arranging to call 'func' 604 * after 'time' ticks passed. The function called by timeout() must adhere to 605 * the same restrictions as a driver soft interrupt handler - it must not sleep 606 * or call other functions that might sleep. The value returned is the opaque 607 * non-zero timeout identifier that can be passed to tcp_timeout_cancel() to 608 * cancel the request. The call to tcp_timeout() may fail in which case it 609 * returns zero. This is different from the timeout(9F) function which never 610 * fails. 611 * 612 * The call-back function 'func' always receives 'connp' as its single 613 * argument. It is always executed in the squeue corresponding to the tcp 614 * structure. The tcp structure is guaranteed to be present at the time the 615 * call-back is called. 616 * 617 * NOTE: The call-back function 'func' is never called if tcp is in 618 * the TCPS_CLOSED state. 619 * 620 * tcp_timeout_cancel() attempts to cancel a pending tcp_timeout() 621 * request. locks acquired by the call-back routine should not be held across 622 * the call to tcp_timeout_cancel() or a deadlock may result. 623 * 624 * tcp_timeout_cancel() returns -1 if it can not cancel the timeout request. 625 * Otherwise, it returns an integer value greater than or equal to 0. In 626 * particular, if the call-back function is already placed on the squeue, it can 627 * not be canceled. 628 * 629 * NOTE: both tcp_timeout() and tcp_timeout_cancel() should always be called 630 * within squeue context corresponding to the tcp instance. Since the 631 * call-back is also called via the same squeue, there are no race 632 * conditions described in untimeout(9F) manual page since all calls are 633 * strictly serialized. 634 * 635 * TCP_TIMER_RESTART() is a macro that attempts to cancel a pending timeout 636 * stored in tcp_timer_tid and starts a new one using 637 * MSEC_TO_TICK(intvl). It always uses tcp_timer() function as a call-back 638 * and stores the return value of tcp_timeout() in the tcp->tcp_timer_tid 639 * field. 640 * 641 * NOTE: since the timeout cancellation is not guaranteed, the cancelled 642 * call-back may still be called, so it is possible tcp_timer() will be 643 * called several times. This should not be a problem since tcp_timer() 644 * should always check the tcp instance state. 645 * 646 * 647 * IMPLEMENTATION: 648 * 649 * TCP timers are implemented using three-stage process. The call to 650 * tcp_timeout() uses timeout(9F) function to call tcp_timer_callback() function 651 * when the timer expires. The tcp_timer_callback() arranges the call of the 652 * tcp_timer_handler() function via squeue corresponding to the tcp 653 * instance. The tcp_timer_handler() calls actual requested timeout call-back 654 * and passes tcp instance as an argument to it. Information is passed between 655 * stages using the tcp_timer_t structure which contains the connp pointer, the 656 * tcp call-back to call and the timeout id returned by the timeout(9F). 657 * 658 * The tcp_timer_t structure is not used directly, it is embedded in an mblk_t - 659 * like structure that is used to enter an squeue. The mp->b_rptr of this pseudo 660 * mblk points to the beginning of tcp_timer_t structure. The tcp_timeout() 661 * returns the pointer to this mblk. 662 * 663 * The pseudo mblk is allocated from a special tcp_timer_cache kmem cache. It 664 * looks like a normal mblk without actual dblk attached to it. 665 * 666 * To optimize performance each tcp instance holds a small cache of timer 667 * mblocks. In the current implementation it caches up to two timer mblocks per 668 * tcp instance. The cache is preserved over tcp frees and is only freed when 669 * the whole tcp structure is destroyed by its kmem destructor. Since all tcp 670 * timer processing happens on a corresponding squeue, the cache manipulation 671 * does not require any locks. Experiments show that majority of timer mblocks 672 * allocations are satisfied from the tcp cache and do not involve kmem calls. 673 * 674 * The tcp_timeout() places a refhold on the connp instance which guarantees 675 * that it will be present at the time the call-back function fires. The 676 * tcp_timer_handler() drops the reference after calling the call-back, so the 677 * call-back function does not need to manipulate the references explicitly. 678 */ 679 680 typedef struct tcp_timer_s { 681 conn_t *connp; 682 void (*tcpt_proc)(void *); 683 timeout_id_t tcpt_tid; 684 } tcp_timer_t; 685 686 static kmem_cache_t *tcp_timercache; 687 kmem_cache_t *tcp_sack_info_cache; 688 kmem_cache_t *tcp_iphc_cache; 689 690 #define TCP_TIMER(tcp, f, tim) tcp_timeout(tcp->tcp_connp, f, tim) 691 #define TCP_TIMER_CANCEL(tcp, id) tcp_timeout_cancel(tcp->tcp_connp, id) 692 693 /* 694 * To restart the TCP retransmission timer. 695 */ 696 #define TCP_TIMER_RESTART(tcp, intvl) \ 697 { \ 698 if ((tcp)->tcp_timer_tid != 0) { \ 699 (void) TCP_TIMER_CANCEL((tcp), \ 700 (tcp)->tcp_timer_tid); \ 701 } \ 702 (tcp)->tcp_timer_tid = TCP_TIMER((tcp), tcp_timer, \ 703 MSEC_TO_TICK(intvl)); \ 704 } 705 706 /* 707 * For scalability, we must not run a timer for every TCP connection 708 * in TIME_WAIT state. To see why, consider (for time wait interval of 709 * 4 minutes): 710 * 1000 connections/sec * 240 seconds/time wait = 240,000 active conn's 711 * 712 * This list is ordered by time, so you need only delete from the head 713 * until you get to entries which aren't old enough to delete yet. 714 * The list consists of only the detached TIME_WAIT connections. 715 * 716 * Note that the timer (tcp_time_wait_expire) is started when the tcp_t 717 * becomes detached TIME_WAIT (either by changing the state and already 718 * being detached or the other way around). This means that the TIME_WAIT 719 * state can be extended (up to doubled) if the connection doesn't become 720 * detached for a long time. 721 * 722 * The list manipulations (including tcp_time_wait_next/prev) 723 * are protected by the tcp_time_wait_lock. The content of the 724 * detached TIME_WAIT connections is protected by the normal perimeters. 725 */ 726 727 typedef struct tcp_squeue_priv_s { 728 kmutex_t tcp_time_wait_lock; 729 /* Protects the next 3 globals */ 730 timeout_id_t tcp_time_wait_tid; 731 tcp_t *tcp_time_wait_head; 732 tcp_t *tcp_time_wait_tail; 733 tcp_t *tcp_free_list; 734 } tcp_squeue_priv_t; 735 736 /* 737 * TCP_TIME_WAIT_DELAY governs how often the time_wait_collector runs. 738 * Running it every 5 seconds seems to give the best results. 739 */ 740 #define TCP_TIME_WAIT_DELAY drv_usectohz(5000000) 741 742 743 #define TCP_XMIT_LOWATER 4096 744 #define TCP_XMIT_HIWATER 49152 745 #define TCP_RECV_LOWATER 2048 746 #define TCP_RECV_HIWATER 49152 747 748 /* 749 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 750 */ 751 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 752 753 #define TIDUSZ 4096 /* transport interface data unit size */ 754 755 /* 756 * Bind hash list size and has function. It has to be a power of 2 for 757 * hashing. 758 */ 759 #define TCP_BIND_FANOUT_SIZE 512 760 #define TCP_BIND_HASH(lport) (ntohs(lport) & (TCP_BIND_FANOUT_SIZE - 1)) 761 /* 762 * Size of listen and acceptor hash list. It has to be a power of 2 for 763 * hashing. 764 */ 765 #define TCP_FANOUT_SIZE 256 766 767 #ifdef _ILP32 768 #define TCP_ACCEPTOR_HASH(accid) \ 769 (((uint_t)(accid) >> 8) & (TCP_FANOUT_SIZE - 1)) 770 #else 771 #define TCP_ACCEPTOR_HASH(accid) \ 772 ((uint_t)(accid) & (TCP_FANOUT_SIZE - 1)) 773 #endif /* _ILP32 */ 774 775 #define IP_ADDR_CACHE_SIZE 2048 776 #define IP_ADDR_CACHE_HASH(faddr) \ 777 (ntohl(faddr) & (IP_ADDR_CACHE_SIZE -1)) 778 779 /* Hash for HSPs uses all 32 bits, since both networks and hosts are in table */ 780 #define TCP_HSP_HASH_SIZE 256 781 782 #define TCP_HSP_HASH(addr) \ 783 (((addr>>24) ^ (addr >>16) ^ \ 784 (addr>>8) ^ (addr)) % TCP_HSP_HASH_SIZE) 785 786 /* 787 * TCP options struct returned from tcp_parse_options. 788 */ 789 typedef struct tcp_opt_s { 790 uint32_t tcp_opt_mss; 791 uint32_t tcp_opt_wscale; 792 uint32_t tcp_opt_ts_val; 793 uint32_t tcp_opt_ts_ecr; 794 tcp_t *tcp; 795 } tcp_opt_t; 796 797 /* 798 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing 799 */ 800 801 #ifdef _BIG_ENDIAN 802 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 803 (TCPOPT_TSTAMP << 8) | 10) 804 #else 805 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 806 (TCPOPT_NOP << 8) | TCPOPT_NOP) 807 #endif 808 809 /* 810 * Flags returned from tcp_parse_options. 811 */ 812 #define TCP_OPT_MSS_PRESENT 1 813 #define TCP_OPT_WSCALE_PRESENT 2 814 #define TCP_OPT_TSTAMP_PRESENT 4 815 #define TCP_OPT_SACK_OK_PRESENT 8 816 #define TCP_OPT_SACK_PRESENT 16 817 818 /* TCP option length */ 819 #define TCPOPT_NOP_LEN 1 820 #define TCPOPT_MAXSEG_LEN 4 821 #define TCPOPT_WS_LEN 3 822 #define TCPOPT_REAL_WS_LEN (TCPOPT_WS_LEN+1) 823 #define TCPOPT_TSTAMP_LEN 10 824 #define TCPOPT_REAL_TS_LEN (TCPOPT_TSTAMP_LEN+2) 825 #define TCPOPT_SACK_OK_LEN 2 826 #define TCPOPT_REAL_SACK_OK_LEN (TCPOPT_SACK_OK_LEN+2) 827 #define TCPOPT_REAL_SACK_LEN 4 828 #define TCPOPT_MAX_SACK_LEN 36 829 #define TCPOPT_HEADER_LEN 2 830 831 /* TCP cwnd burst factor. */ 832 #define TCP_CWND_INFINITE 65535 833 #define TCP_CWND_SS 3 834 #define TCP_CWND_NORMAL 5 835 836 /* Maximum TCP initial cwin (start/restart). */ 837 #define TCP_MAX_INIT_CWND 8 838 839 /* 840 * Initialize cwnd according to RFC 3390. def_max_init_cwnd is 841 * either tcp_slow_start_initial or tcp_slow_start_after idle 842 * depending on the caller. If the upper layer has not used the 843 * TCP_INIT_CWND option to change the initial cwnd, tcp_init_cwnd 844 * should be 0 and we use the formula in RFC 3390 to set tcp_cwnd. 845 * If the upper layer has changed set the tcp_init_cwnd, just use 846 * it to calculate the tcp_cwnd. 847 */ 848 #define SET_TCP_INIT_CWND(tcp, mss, def_max_init_cwnd) \ 849 { \ 850 if ((tcp)->tcp_init_cwnd == 0) { \ 851 (tcp)->tcp_cwnd = MIN(def_max_init_cwnd * (mss), \ 852 MIN(4 * (mss), MAX(2 * (mss), 4380 / (mss) * (mss)))); \ 853 } else { \ 854 (tcp)->tcp_cwnd = (tcp)->tcp_init_cwnd * (mss); \ 855 } \ 856 tcp->tcp_cwnd_cnt = 0; \ 857 } 858 859 /* TCP Timer control structure */ 860 typedef struct tcpt_s { 861 pfv_t tcpt_pfv; /* The routine we are to call */ 862 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 863 } tcpt_t; 864 865 /* Host Specific Parameter structure */ 866 typedef struct tcp_hsp { 867 struct tcp_hsp *tcp_hsp_next; 868 in6_addr_t tcp_hsp_addr_v6; 869 in6_addr_t tcp_hsp_subnet_v6; 870 uint_t tcp_hsp_vers; /* IPV4_VERSION | IPV6_VERSION */ 871 int32_t tcp_hsp_sendspace; 872 int32_t tcp_hsp_recvspace; 873 int32_t tcp_hsp_tstamp; 874 } tcp_hsp_t; 875 #define tcp_hsp_addr V4_PART_OF_V6(tcp_hsp_addr_v6) 876 #define tcp_hsp_subnet V4_PART_OF_V6(tcp_hsp_subnet_v6) 877 878 /* 879 * Functions called directly via squeue having a prototype of edesc_t. 880 */ 881 void tcp_conn_request(void *arg, mblk_t *mp, void *arg2); 882 static void tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2); 883 void tcp_accept_finish(void *arg, mblk_t *mp, void *arg2); 884 static void tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2); 885 static void tcp_wput_proto(void *arg, mblk_t *mp, void *arg2); 886 void tcp_input(void *arg, mblk_t *mp, void *arg2); 887 void tcp_rput_data(void *arg, mblk_t *mp, void *arg2); 888 static void tcp_close_output(void *arg, mblk_t *mp, void *arg2); 889 static void tcp_output(void *arg, mblk_t *mp, void *arg2); 890 static void tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2); 891 static void tcp_timer_handler(void *arg, mblk_t *mp, void *arg2); 892 893 894 /* Prototype for TCP functions */ 895 static void tcp_random_init(void); 896 int tcp_random(void); 897 static void tcp_accept(tcp_t *tcp, mblk_t *mp); 898 static void tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, 899 tcp_t *eager); 900 static int tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp); 901 static in_port_t tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, 902 int reuseaddr, boolean_t bind_to_req_port_only, 903 boolean_t user_specified); 904 static void tcp_closei_local(tcp_t *tcp); 905 static void tcp_close_detached(tcp_t *tcp); 906 static boolean_t tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, 907 mblk_t *idmp, mblk_t **defermp); 908 static void tcp_connect(tcp_t *tcp, mblk_t *mp); 909 static void tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, 910 in_port_t dstport, uint_t srcid); 911 static void tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 912 in_port_t dstport, uint32_t flowinfo, uint_t srcid, 913 uint32_t scope_id); 914 static int tcp_clean_death(tcp_t *tcp, int err, uint8_t tag); 915 static void tcp_def_q_set(tcp_t *tcp, mblk_t *mp); 916 static void tcp_disconnect(tcp_t *tcp, mblk_t *mp); 917 static char *tcp_display(tcp_t *tcp, char *, char); 918 static boolean_t tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum); 919 static void tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only); 920 static void tcp_eager_unlink(tcp_t *tcp); 921 static void tcp_err_ack(tcp_t *tcp, mblk_t *mp, int tlierr, 922 int unixerr); 923 static void tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 924 int tlierr, int unixerr); 925 static int tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, 926 cred_t *cr); 927 static int tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, 928 char *value, caddr_t cp, cred_t *cr); 929 static int tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, 930 char *value, caddr_t cp, cred_t *cr); 931 static int tcp_tpistate(tcp_t *tcp); 932 static void tcp_bind_hash_insert(tf_t *tf, tcp_t *tcp, 933 int caller_holds_lock); 934 static void tcp_bind_hash_remove(tcp_t *tcp); 935 static tcp_t *tcp_acceptor_hash_lookup(t_uscalar_t id); 936 void tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp); 937 static void tcp_acceptor_hash_remove(tcp_t *tcp); 938 static void tcp_capability_req(tcp_t *tcp, mblk_t *mp); 939 static void tcp_info_req(tcp_t *tcp, mblk_t *mp); 940 static void tcp_addr_req(tcp_t *tcp, mblk_t *mp); 941 static void tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *mp); 942 static int tcp_header_init_ipv4(tcp_t *tcp); 943 static int tcp_header_init_ipv6(tcp_t *tcp); 944 int tcp_init(tcp_t *tcp, queue_t *q); 945 static int tcp_init_values(tcp_t *tcp); 946 static mblk_t *tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic); 947 static mblk_t *tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, 948 t_scalar_t addr_length); 949 static void tcp_ip_ire_mark_advice(tcp_t *tcp); 950 static void tcp_ip_notify(tcp_t *tcp); 951 static mblk_t *tcp_ire_mp(mblk_t *mp); 952 static void tcp_iss_init(tcp_t *tcp); 953 static void tcp_keepalive_killer(void *arg); 954 static int tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk); 955 static int tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt); 956 static void tcp_mss_set(tcp_t *tcp, uint32_t size); 957 static int tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, 958 int *do_disconnectp, int *t_errorp, int *sys_errorp); 959 static boolean_t tcp_allow_connopt_set(int level, int name); 960 int tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr); 961 int tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr); 962 static int tcp_opt_get_user(ipha_t *ipha, uchar_t *ptr); 963 int tcp_opt_set(queue_t *q, uint_t optset_context, int level, 964 int name, uint_t inlen, uchar_t *invalp, uint_t *outlenp, 965 uchar_t *outvalp, void *thisdg_attrs, cred_t *cr, 966 mblk_t *mblk); 967 static void tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha); 968 static int tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, 969 uchar_t *ptr, uint_t len); 970 static int tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr); 971 static boolean_t tcp_param_register(tcpparam_t *tcppa, int cnt); 972 static int tcp_param_set(queue_t *q, mblk_t *mp, char *value, 973 caddr_t cp, cred_t *cr); 974 static int tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, 975 caddr_t cp, cred_t *cr); 976 static void tcp_iss_key_init(uint8_t *phrase, int len); 977 static int tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, 978 caddr_t cp, cred_t *cr); 979 static void tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_cnt); 980 static mblk_t *tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start); 981 static void tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp); 982 static void tcp_reinit(tcp_t *tcp); 983 static void tcp_reinit_values(tcp_t *tcp); 984 static void tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, 985 tcp_t *thisstream, cred_t *cr); 986 987 static uint_t tcp_rcv_drain(queue_t *q, tcp_t *tcp); 988 static void tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len); 989 static void tcp_sack_rxmit(tcp_t *tcp, uint_t *flags); 990 static boolean_t tcp_send_rst_chk(void); 991 static void tcp_ss_rexmit(tcp_t *tcp); 992 static mblk_t *tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp); 993 static void tcp_process_options(tcp_t *, tcph_t *); 994 static void tcp_rput_common(tcp_t *tcp, mblk_t *mp); 995 static void tcp_rsrv(queue_t *q); 996 static int tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd); 997 static int tcp_snmp_get(queue_t *q, mblk_t *mpctl); 998 static int tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, 999 int len); 1000 static int tcp_snmp_state(tcp_t *tcp); 1001 static int tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, 1002 cred_t *cr); 1003 static int tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1004 cred_t *cr); 1005 static int tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1006 cred_t *cr); 1007 static int tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1008 cred_t *cr); 1009 static int tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, 1010 cred_t *cr); 1011 static int tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, 1012 caddr_t cp, cred_t *cr); 1013 static int tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, 1014 caddr_t cp, cred_t *cr); 1015 static int tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, 1016 cred_t *cr); 1017 static void tcp_timer(void *arg); 1018 static void tcp_timer_callback(void *); 1019 static in_port_t tcp_update_next_port(in_port_t port, boolean_t random); 1020 static in_port_t tcp_get_next_priv_port(void); 1021 static void tcp_wput(queue_t *q, mblk_t *mp); 1022 static void tcp_wput_sock(queue_t *q, mblk_t *mp); 1023 void tcp_wput_accept(queue_t *q, mblk_t *mp); 1024 static void tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent); 1025 static void tcp_wput_flush(tcp_t *tcp, mblk_t *mp); 1026 static void tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp); 1027 static int tcp_send(queue_t *q, tcp_t *tcp, const int mss, 1028 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 1029 const int num_sack_blk, int *usable, uint_t *snxt, 1030 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 1031 const int mdt_thres); 1032 static int tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, 1033 const int tcp_hdr_len, const int tcp_tcp_hdr_len, 1034 const int num_sack_blk, int *usable, uint_t *snxt, 1035 int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 1036 const int mdt_thres); 1037 static void tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, 1038 int num_sack_blk); 1039 static void tcp_wsrv(queue_t *q); 1040 static int tcp_xmit_end(tcp_t *tcp); 1041 void tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len); 1042 static mblk_t *tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, 1043 int32_t *offset, mblk_t **end_mp, uint32_t seq, 1044 boolean_t sendall, uint32_t *seg_len, boolean_t rexmit); 1045 static void tcp_ack_timer(void *arg); 1046 static mblk_t *tcp_ack_mp(tcp_t *tcp); 1047 static void tcp_push_timer(void *arg); 1048 static void tcp_xmit_early_reset(char *str, mblk_t *mp, 1049 uint32_t seq, uint32_t ack, int ctl, uint_t ip_hdr_len); 1050 static void tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, 1051 uint32_t ack, int ctl); 1052 static tcp_hsp_t *tcp_hsp_lookup(ipaddr_t addr); 1053 static tcp_hsp_t *tcp_hsp_lookup_ipv6(in6_addr_t *addr); 1054 static int setmaxps(queue_t *q, int maxpsz); 1055 static void tcp_set_rto(tcp_t *, time_t); 1056 static boolean_t tcp_check_policy(tcp_t *, mblk_t *, ipha_t *, ip6_t *, 1057 boolean_t, boolean_t); 1058 static void tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, 1059 boolean_t ipsec_mctl); 1060 static boolean_t tcp_cmpbuf(void *a, uint_t alen, 1061 boolean_t b_valid, void *b, uint_t blen); 1062 static boolean_t tcp_allocbuf(void **dstp, uint_t *dstlenp, 1063 boolean_t src_valid, void *src, uint_t srclen); 1064 static void tcp_savebuf(void **dstp, uint_t *dstlenp, 1065 boolean_t src_valid, void *src, uint_t srclen); 1066 static mblk_t *tcp_setsockopt_mp(int level, int cmd, 1067 char *opt, int optlen); 1068 static int tcp_pkt_set(uchar_t *, uint_t, uchar_t **, uint_t *); 1069 static int tcp_build_hdrs(queue_t *, tcp_t *); 1070 static void tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, 1071 uint32_t seg_seq, uint32_t seg_ack, int seg_len, 1072 tcph_t *tcph); 1073 boolean_t tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp); 1074 boolean_t tcp_reserved_port_add(int, in_port_t *, in_port_t *); 1075 boolean_t tcp_reserved_port_del(in_port_t, in_port_t); 1076 boolean_t tcp_reserved_port_check(in_port_t); 1077 static tcp_t *tcp_alloc_temp_tcp(in_port_t); 1078 static int tcp_reserved_port_list(queue_t *, mblk_t *, caddr_t, cred_t *); 1079 static void tcp_timers_stop(tcp_t *); 1080 static timeout_id_t tcp_timeout(conn_t *, void (*)(void *), clock_t); 1081 static clock_t tcp_timeout_cancel(conn_t *, timeout_id_t); 1082 static mblk_t *tcp_mdt_info_mp(mblk_t *); 1083 static void tcp_mdt_update(tcp_t *, ill_mdt_capab_t *, boolean_t); 1084 static int tcp_mdt_add_attrs(multidata_t *, const mblk_t *, 1085 const boolean_t, const uint32_t, const uint32_t, 1086 const uint32_t, const uint32_t); 1087 static void tcp_multisend_data(tcp_t *, ire_t *, const ill_t *, mblk_t *, 1088 const uint_t, const uint_t, boolean_t *); 1089 static void tcp_send_data(tcp_t *, queue_t *, mblk_t *); 1090 extern mblk_t *tcp_timermp_alloc(int); 1091 extern void tcp_timermp_free(tcp_t *); 1092 static void tcp_timer_free(tcp_t *tcp, mblk_t *mp); 1093 static void tcp_stop_lingering(tcp_t *tcp); 1094 static void tcp_close_linger_timeout(void *arg); 1095 void tcp_ddi_init(void); 1096 void tcp_ddi_destroy(void); 1097 static void tcp_kstat_init(void); 1098 static void tcp_kstat_fini(void); 1099 static int tcp_kstat_update(kstat_t *kp, int rw); 1100 void tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp); 1101 conn_t *tcp_get_next_conn(connf_t *, conn_t *); 1102 static int tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 1103 tcph_t *tcph, uint_t ipvers, mblk_t *idmp); 1104 static int tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 1105 tcph_t *tcph, mblk_t *idmp); 1106 static squeue_func_t tcp_squeue_switch(int); 1107 1108 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *); 1109 static int tcp_close(queue_t *, int); 1110 static int tcpclose_accept(queue_t *); 1111 static int tcp_modclose(queue_t *); 1112 static void tcp_wput_mod(queue_t *, mblk_t *); 1113 1114 static void tcp_squeue_add(squeue_t *); 1115 static boolean_t tcp_zcopy_check(tcp_t *); 1116 static void tcp_zcopy_notify(tcp_t *); 1117 static mblk_t *tcp_zcopy_disable(tcp_t *, mblk_t *); 1118 static mblk_t *tcp_zcopy_backoff(tcp_t *, mblk_t *, int); 1119 static void tcp_ire_ill_check(tcp_t *, ire_t *, ill_t *, boolean_t); 1120 1121 static void tcp_fuse(tcp_t *, uchar_t *, tcph_t *); 1122 static void tcp_unfuse(tcp_t *); 1123 static boolean_t tcp_fuse_output(tcp_t *, mblk_t *); 1124 static void tcp_fuse_output_urg(tcp_t *, mblk_t *); 1125 static boolean_t tcp_fuse_rcv_drain(queue_t *, tcp_t *, mblk_t **); 1126 1127 extern mblk_t *allocb_tryhard(size_t); 1128 1129 /* 1130 * Routines related to the TCP_IOC_ABORT_CONN ioctl command. 1131 * 1132 * TCP_IOC_ABORT_CONN is a non-transparent ioctl command used for aborting 1133 * TCP connections. To invoke this ioctl, a tcp_ioc_abort_conn_t structure 1134 * (defined in tcp.h) needs to be filled in and passed into the kernel 1135 * via an I_STR ioctl command (see streamio(7I)). The tcp_ioc_abort_conn_t 1136 * structure contains the four-tuple of a TCP connection and a range of TCP 1137 * states (specified by ac_start and ac_end). The use of wildcard addresses 1138 * and ports is allowed. Connections with a matching four tuple and a state 1139 * within the specified range will be aborted. The valid states for the 1140 * ac_start and ac_end fields are in the range TCPS_SYN_SENT to TCPS_TIME_WAIT, 1141 * inclusive. 1142 * 1143 * An application which has its connection aborted by this ioctl will receive 1144 * an error that is dependent on the connection state at the time of the abort. 1145 * If the connection state is < TCPS_TIME_WAIT, an application should behave as 1146 * though a RST packet has been received. If the connection state is equal to 1147 * TCPS_TIME_WAIT, the 2MSL timeout will immediately be canceled by the kernel 1148 * and all resources associated with the connection will be freed. 1149 */ 1150 static mblk_t *tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *, tcp_t *); 1151 static void tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *); 1152 static void tcp_ioctl_abort_handler(tcp_t *, mblk_t *); 1153 static int tcp_ioctl_abort(tcp_ioc_abort_conn_t *); 1154 static void tcp_ioctl_abort_conn(queue_t *, mblk_t *); 1155 static int tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *, int, int *, 1156 boolean_t); 1157 1158 1159 static void tcp_clrqfull(tcp_t *); 1160 static void tcp_setqfull(tcp_t *); 1161 1162 static struct module_info tcp_rinfo = { 1163 #define TCP_MODULE_ID 5105 1164 TCP_MODULE_ID, "tcp", 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 1165 }; 1166 1167 static struct module_info tcp_winfo = { 1168 TCP_MODULE_ID, "tcp", 0, INFPSZ, 127, 16 1169 }; 1170 1171 /* 1172 * Entry points for TCP as a module. It only allows SNMP requests 1173 * to pass through. 1174 */ 1175 struct qinit tcp_mod_rinit = { 1176 (pfi_t)putnext, NULL, tcp_open, tcp_modclose, NULL, &tcp_rinfo 1177 }; 1178 1179 struct qinit tcp_mod_winit = { 1180 (pfi_t)tcp_wput_mod, NULL, tcp_open, tcp_modclose, NULL, &tcp_rinfo 1181 }; 1182 1183 /* 1184 * Entry points for TCP as a device. The normal case which supports 1185 * the TCP functionality. 1186 */ 1187 struct qinit tcp_rinit = { 1188 NULL, (pfi_t)tcp_rsrv, tcp_open, tcp_close, NULL, &tcp_rinfo 1189 }; 1190 1191 struct qinit tcp_winit = { 1192 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1193 }; 1194 1195 /* Initial entry point for TCP in socket mode. */ 1196 struct qinit tcp_sock_winit = { 1197 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 1198 }; 1199 1200 /* 1201 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 1202 * an accept. Avoid allocating data structures since eager has already 1203 * been created. 1204 */ 1205 struct qinit tcp_acceptor_rinit = { 1206 NULL, (pfi_t)tcp_rsrv, NULL, tcpclose_accept, NULL, &tcp_winfo 1207 }; 1208 1209 struct qinit tcp_acceptor_winit = { 1210 (pfi_t)tcp_wput_accept, NULL, NULL, NULL, NULL, &tcp_winfo 1211 }; 1212 1213 struct streamtab tcpinfo = { 1214 &tcp_rinit, &tcp_winit 1215 }; 1216 1217 1218 extern squeue_func_t tcp_squeue_wput_proc; 1219 extern squeue_func_t tcp_squeue_timer_proc; 1220 1221 /* Protected by tcp_g_q_lock */ 1222 static queue_t *tcp_g_q; /* Default queue used during detached closes */ 1223 kmutex_t tcp_g_q_lock; 1224 1225 /* Protected by tcp_hsp_lock */ 1226 /* 1227 * XXX The host param mechanism should go away and instead we should use 1228 * the metrics associated with the routes to determine the default sndspace 1229 * and rcvspace. 1230 */ 1231 static tcp_hsp_t **tcp_hsp_hash; /* Hash table for HSPs */ 1232 krwlock_t tcp_hsp_lock; 1233 1234 /* 1235 * Extra privileged ports. In host byte order. 1236 * Protected by tcp_epriv_port_lock. 1237 */ 1238 #define TCP_NUM_EPRIV_PORTS 64 1239 static int tcp_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 1240 static uint16_t tcp_g_epriv_ports[TCP_NUM_EPRIV_PORTS] = { 2049, 4045 }; 1241 kmutex_t tcp_epriv_port_lock; 1242 1243 /* 1244 * The smallest anonymous port in the priviledged port range which TCP 1245 * looks for free port. Use in the option TCP_ANONPRIVBIND. 1246 */ 1247 static in_port_t tcp_min_anonpriv_port = 512; 1248 1249 /* Only modified during _init and _fini thus no locking is needed. */ 1250 static caddr_t tcp_g_nd; /* Head of 'named dispatch' variable list */ 1251 1252 /* Hint not protected by any lock */ 1253 static uint_t tcp_next_port_to_try; 1254 1255 1256 /* TCP bind hash list - all tcp_t with state >= BOUND. */ 1257 static tf_t tcp_bind_fanout[TCP_BIND_FANOUT_SIZE]; 1258 1259 /* TCP queue hash list - all tcp_t in case they will be an acceptor. */ 1260 static tf_t tcp_acceptor_fanout[TCP_FANOUT_SIZE]; 1261 1262 /* 1263 * TCP has a private interface for other kernel modules to reserve a 1264 * port range for them to use. Once reserved, TCP will not use any ports 1265 * in the range. This interface relies on the TCP_EXCLBIND feature. If 1266 * the semantics of TCP_EXCLBIND is changed, implementation of this interface 1267 * has to be verified. 1268 * 1269 * There can be TCP_RESERVED_PORTS_ARRAY_MAX_SIZE port ranges. Each port 1270 * range can cover at most TCP_RESERVED_PORTS_RANGE_MAX ports. A port 1271 * range is [port a, port b] inclusive. And each port range is between 1272 * TCP_LOWESET_RESERVED_PORT and TCP_LARGEST_RESERVED_PORT inclusive. 1273 * 1274 * Note that the default anonymous port range starts from 32768. There is 1275 * no port "collision" between that and the reserved port range. If there 1276 * is port collision (because the default smallest anonymous port is lowered 1277 * or some apps specifically bind to ports in the reserved port range), the 1278 * system may not be able to reserve a port range even there are enough 1279 * unbound ports as a reserved port range contains consecutive ports . 1280 */ 1281 #define TCP_RESERVED_PORTS_ARRAY_MAX_SIZE 5 1282 #define TCP_RESERVED_PORTS_RANGE_MAX 1000 1283 #define TCP_SMALLEST_RESERVED_PORT 10240 1284 #define TCP_LARGEST_RESERVED_PORT 20480 1285 1286 /* Structure to represent those reserved port ranges. */ 1287 typedef struct tcp_rport_s { 1288 in_port_t lo_port; 1289 in_port_t hi_port; 1290 tcp_t **temp_tcp_array; 1291 } tcp_rport_t; 1292 1293 /* The reserved port array. */ 1294 static tcp_rport_t tcp_reserved_port[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 1295 1296 /* Locks to protect the tcp_reserved_ports array. */ 1297 static krwlock_t tcp_reserved_port_lock; 1298 1299 /* The number of ranges in the array. */ 1300 uint32_t tcp_reserved_port_array_size = 0; 1301 1302 /* 1303 * MIB-2 stuff for SNMP 1304 * Note: tcpInErrs {tcp 15} is accumulated in ip.c 1305 */ 1306 mib2_tcp_t tcp_mib; /* SNMP fixed size info */ 1307 kstat_t *tcp_mibkp; /* kstat exporting tcp_mib data */ 1308 1309 /* 1310 * Object to represent database of options to search passed to 1311 * {sock,tpi}optcom_req() interface routine to take care of option 1312 * management and associated methods. 1313 * XXX These and other externs should ideally move to a TCP header 1314 */ 1315 extern optdb_obj_t tcp_opt_obj; 1316 extern uint_t tcp_max_optsize; 1317 1318 boolean_t tcp_icmp_source_quench = B_FALSE; 1319 /* 1320 * Following assumes TPI alignment requirements stay along 32 bit 1321 * boundaries 1322 */ 1323 #define ROUNDUP32(x) \ 1324 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 1325 1326 /* Template for response to info request. */ 1327 static struct T_info_ack tcp_g_t_info_ack = { 1328 T_INFO_ACK, /* PRIM_type */ 1329 0, /* TSDU_size */ 1330 T_INFINITE, /* ETSDU_size */ 1331 T_INVALID, /* CDATA_size */ 1332 T_INVALID, /* DDATA_size */ 1333 sizeof (sin_t), /* ADDR_size */ 1334 0, /* OPT_size - not initialized here */ 1335 TIDUSZ, /* TIDU_size */ 1336 T_COTS_ORD, /* SERV_type */ 1337 TCPS_IDLE, /* CURRENT_state */ 1338 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1339 }; 1340 1341 static struct T_info_ack tcp_g_t_info_ack_v6 = { 1342 T_INFO_ACK, /* PRIM_type */ 1343 0, /* TSDU_size */ 1344 T_INFINITE, /* ETSDU_size */ 1345 T_INVALID, /* CDATA_size */ 1346 T_INVALID, /* DDATA_size */ 1347 sizeof (sin6_t), /* ADDR_size */ 1348 0, /* OPT_size - not initialized here */ 1349 TIDUSZ, /* TIDU_size */ 1350 T_COTS_ORD, /* SERV_type */ 1351 TCPS_IDLE, /* CURRENT_state */ 1352 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 1353 }; 1354 1355 #define MS 1L 1356 #define SECONDS (1000 * MS) 1357 #define MINUTES (60 * SECONDS) 1358 #define HOURS (60 * MINUTES) 1359 #define DAYS (24 * HOURS) 1360 1361 #define PARAM_MAX (~(uint32_t)0) 1362 1363 /* Max size IP datagram is 64k - 1 */ 1364 #define TCP_MSS_MAX_IPV4 (IP_MAXPACKET - (sizeof (ipha_t) + sizeof (tcph_t))) 1365 #define TCP_MSS_MAX_IPV6 (IP_MAXPACKET - (sizeof (ip6_t) + sizeof (tcph_t))) 1366 /* Max of the above */ 1367 #define TCP_MSS_MAX TCP_MSS_MAX_IPV4 1368 1369 /* Largest TCP port number */ 1370 #define TCP_MAX_PORT (64 * 1024 - 1) 1371 1372 /* 1373 * tcp_wroff_xtra is the extra space in front of TCP/IP header for link 1374 * layer header. It has to be a multiple of 4. 1375 */ 1376 static tcpparam_t tcp_wroff_xtra_param = { 0, 256, 32, "tcp_wroff_xtra" }; 1377 #define tcp_wroff_xtra tcp_wroff_xtra_param.tcp_param_val 1378 1379 /* 1380 * All of these are alterable, within the min/max values given, at run time. 1381 * Note that the default value of "tcp_time_wait_interval" is four minutes, 1382 * per the TCP spec. 1383 */ 1384 /* BEGIN CSTYLED */ 1385 tcpparam_t tcp_param_arr[] = { 1386 /*min max value name */ 1387 { 1*SECONDS, 10*MINUTES, 1*MINUTES, "tcp_time_wait_interval"}, 1388 { 1, PARAM_MAX, 128, "tcp_conn_req_max_q" }, 1389 { 0, PARAM_MAX, 1024, "tcp_conn_req_max_q0" }, 1390 { 1, 1024, 1, "tcp_conn_req_min" }, 1391 { 0*MS, 20*SECONDS, 0*MS, "tcp_conn_grace_period" }, 1392 { 128, (1<<30), 1024*1024, "tcp_cwnd_max" }, 1393 { 0, 10, 0, "tcp_debug" }, 1394 { 1024, (32*1024), 1024, "tcp_smallest_nonpriv_port"}, 1395 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_cinterval"}, 1396 { 1*SECONDS, PARAM_MAX, 3*MINUTES, "tcp_ip_abort_linterval"}, 1397 { 500*MS, PARAM_MAX, 8*MINUTES, "tcp_ip_abort_interval"}, 1398 { 1*SECONDS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_cinterval"}, 1399 { 500*MS, PARAM_MAX, 10*SECONDS, "tcp_ip_notify_interval"}, 1400 { 1, 255, 64, "tcp_ipv4_ttl"}, 1401 { 10*SECONDS, 10*DAYS, 2*HOURS, "tcp_keepalive_interval"}, 1402 { 0, 100, 10, "tcp_maxpsz_multiplier" }, 1403 { 1, TCP_MSS_MAX_IPV4, 536, "tcp_mss_def_ipv4"}, 1404 { 1, TCP_MSS_MAX_IPV4, TCP_MSS_MAX_IPV4, "tcp_mss_max_ipv4"}, 1405 { 1, TCP_MSS_MAX, 108, "tcp_mss_min"}, 1406 { 1, (64*1024)-1, (4*1024)-1, "tcp_naglim_def"}, 1407 { 1*MS, 20*SECONDS, 3*SECONDS, "tcp_rexmit_interval_initial"}, 1408 { 1*MS, 2*HOURS, 60*SECONDS, "tcp_rexmit_interval_max"}, 1409 { 1*MS, 2*HOURS, 400*MS, "tcp_rexmit_interval_min"}, 1410 { 1*MS, 1*MINUTES, 100*MS, "tcp_deferred_ack_interval" }, 1411 { 0, 16, 0, "tcp_snd_lowat_fraction" }, 1412 { 0, 128000, 0, "tcp_sth_rcv_hiwat" }, 1413 { 0, 128000, 0, "tcp_sth_rcv_lowat" }, 1414 { 1, 10000, 3, "tcp_dupack_fast_retransmit" }, 1415 { 0, 1, 0, "tcp_ignore_path_mtu" }, 1416 { 1024, TCP_MAX_PORT, 32*1024, "tcp_smallest_anon_port"}, 1417 { 1024, TCP_MAX_PORT, TCP_MAX_PORT, "tcp_largest_anon_port"}, 1418 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_HIWATER,"tcp_xmit_hiwat"}, 1419 { TCP_XMIT_LOWATER, (1<<30), TCP_XMIT_LOWATER,"tcp_xmit_lowat"}, 1420 { TCP_RECV_LOWATER, (1<<30), TCP_RECV_HIWATER,"tcp_recv_hiwat"}, 1421 { 1, 65536, 4, "tcp_recv_hiwat_minmss"}, 1422 { 1*SECONDS, PARAM_MAX, 675*SECONDS, "tcp_fin_wait_2_flush_interval"}, 1423 { 0, TCP_MSS_MAX, 64, "tcp_co_min"}, 1424 { 8192, (1<<30), 1024*1024, "tcp_max_buf"}, 1425 /* 1426 * Question: What default value should I set for tcp_strong_iss? 1427 */ 1428 { 0, 2, 1, "tcp_strong_iss"}, 1429 { 0, 65536, 20, "tcp_rtt_updates"}, 1430 { 0, 1, 1, "tcp_wscale_always"}, 1431 { 0, 1, 0, "tcp_tstamp_always"}, 1432 { 0, 1, 1, "tcp_tstamp_if_wscale"}, 1433 { 0*MS, 2*HOURS, 0*MS, "tcp_rexmit_interval_extra"}, 1434 { 0, 16, 2, "tcp_deferred_acks_max"}, 1435 { 1, 16384, 4, "tcp_slow_start_after_idle"}, 1436 { 1, 4, 4, "tcp_slow_start_initial"}, 1437 { 10*MS, 50*MS, 20*MS, "tcp_co_timer_interval"}, 1438 { 0, 2, 2, "tcp_sack_permitted"}, 1439 { 0, 1, 0, "tcp_trace"}, 1440 { 0, 1, 1, "tcp_compression_enabled"}, 1441 { 0, IPV6_MAX_HOPS, IPV6_DEFAULT_HOPS, "tcp_ipv6_hoplimit"}, 1442 { 1, TCP_MSS_MAX_IPV6, 1220, "tcp_mss_def_ipv6"}, 1443 { 1, TCP_MSS_MAX_IPV6, TCP_MSS_MAX_IPV6, "tcp_mss_max_ipv6"}, 1444 { 0, 1, 0, "tcp_rev_src_routes"}, 1445 { 10*MS, 500*MS, 50*MS, "tcp_local_dack_interval"}, 1446 { 100*MS, 60*SECONDS, 1*SECONDS, "tcp_ndd_get_info_interval"}, 1447 { 0, 16, 8, "tcp_local_dacks_max"}, 1448 { 0, 2, 1, "tcp_ecn_permitted"}, 1449 { 0, 1, 1, "tcp_rst_sent_rate_enabled"}, 1450 { 0, PARAM_MAX, 40, "tcp_rst_sent_rate"}, 1451 { 0, 100*MS, 50*MS, "tcp_push_timer_interval"}, 1452 { 0, 1, 0, "tcp_use_smss_as_mss_opt"}, 1453 { 0, PARAM_MAX, 8*MINUTES, "tcp_keepalive_abort_interval"}, 1454 }; 1455 /* END CSTYLED */ 1456 1457 1458 #define tcp_time_wait_interval tcp_param_arr[0].tcp_param_val 1459 #define tcp_conn_req_max_q tcp_param_arr[1].tcp_param_val 1460 #define tcp_conn_req_max_q0 tcp_param_arr[2].tcp_param_val 1461 #define tcp_conn_req_min tcp_param_arr[3].tcp_param_val 1462 #define tcp_conn_grace_period tcp_param_arr[4].tcp_param_val 1463 #define tcp_cwnd_max_ tcp_param_arr[5].tcp_param_val 1464 #define tcp_dbg tcp_param_arr[6].tcp_param_val 1465 #define tcp_smallest_nonpriv_port tcp_param_arr[7].tcp_param_val 1466 #define tcp_ip_abort_cinterval tcp_param_arr[8].tcp_param_val 1467 #define tcp_ip_abort_linterval tcp_param_arr[9].tcp_param_val 1468 #define tcp_ip_abort_interval tcp_param_arr[10].tcp_param_val 1469 #define tcp_ip_notify_cinterval tcp_param_arr[11].tcp_param_val 1470 #define tcp_ip_notify_interval tcp_param_arr[12].tcp_param_val 1471 #define tcp_ipv4_ttl tcp_param_arr[13].tcp_param_val 1472 #define tcp_keepalive_interval_high tcp_param_arr[14].tcp_param_max 1473 #define tcp_keepalive_interval tcp_param_arr[14].tcp_param_val 1474 #define tcp_keepalive_interval_low tcp_param_arr[14].tcp_param_min 1475 #define tcp_maxpsz_multiplier tcp_param_arr[15].tcp_param_val 1476 #define tcp_mss_def_ipv4 tcp_param_arr[16].tcp_param_val 1477 #define tcp_mss_max_ipv4 tcp_param_arr[17].tcp_param_val 1478 #define tcp_mss_min tcp_param_arr[18].tcp_param_val 1479 #define tcp_naglim_def tcp_param_arr[19].tcp_param_val 1480 #define tcp_rexmit_interval_initial tcp_param_arr[20].tcp_param_val 1481 #define tcp_rexmit_interval_max tcp_param_arr[21].tcp_param_val 1482 #define tcp_rexmit_interval_min tcp_param_arr[22].tcp_param_val 1483 #define tcp_deferred_ack_interval tcp_param_arr[23].tcp_param_val 1484 #define tcp_snd_lowat_fraction tcp_param_arr[24].tcp_param_val 1485 #define tcp_sth_rcv_hiwat tcp_param_arr[25].tcp_param_val 1486 #define tcp_sth_rcv_lowat tcp_param_arr[26].tcp_param_val 1487 #define tcp_dupack_fast_retransmit tcp_param_arr[27].tcp_param_val 1488 #define tcp_ignore_path_mtu tcp_param_arr[28].tcp_param_val 1489 #define tcp_smallest_anon_port tcp_param_arr[29].tcp_param_val 1490 #define tcp_largest_anon_port tcp_param_arr[30].tcp_param_val 1491 #define tcp_xmit_hiwat tcp_param_arr[31].tcp_param_val 1492 #define tcp_xmit_lowat tcp_param_arr[32].tcp_param_val 1493 #define tcp_recv_hiwat tcp_param_arr[33].tcp_param_val 1494 #define tcp_recv_hiwat_minmss tcp_param_arr[34].tcp_param_val 1495 #define tcp_fin_wait_2_flush_interval tcp_param_arr[35].tcp_param_val 1496 #define tcp_co_min tcp_param_arr[36].tcp_param_val 1497 #define tcp_max_buf tcp_param_arr[37].tcp_param_val 1498 #define tcp_strong_iss tcp_param_arr[38].tcp_param_val 1499 #define tcp_rtt_updates tcp_param_arr[39].tcp_param_val 1500 #define tcp_wscale_always tcp_param_arr[40].tcp_param_val 1501 #define tcp_tstamp_always tcp_param_arr[41].tcp_param_val 1502 #define tcp_tstamp_if_wscale tcp_param_arr[42].tcp_param_val 1503 #define tcp_rexmit_interval_extra tcp_param_arr[43].tcp_param_val 1504 #define tcp_deferred_acks_max tcp_param_arr[44].tcp_param_val 1505 #define tcp_slow_start_after_idle tcp_param_arr[45].tcp_param_val 1506 #define tcp_slow_start_initial tcp_param_arr[46].tcp_param_val 1507 #define tcp_co_timer_interval tcp_param_arr[47].tcp_param_val 1508 #define tcp_sack_permitted tcp_param_arr[48].tcp_param_val 1509 #define tcp_trace tcp_param_arr[49].tcp_param_val 1510 #define tcp_compression_enabled tcp_param_arr[50].tcp_param_val 1511 #define tcp_ipv6_hoplimit tcp_param_arr[51].tcp_param_val 1512 #define tcp_mss_def_ipv6 tcp_param_arr[52].tcp_param_val 1513 #define tcp_mss_max_ipv6 tcp_param_arr[53].tcp_param_val 1514 #define tcp_rev_src_routes tcp_param_arr[54].tcp_param_val 1515 #define tcp_local_dack_interval tcp_param_arr[55].tcp_param_val 1516 #define tcp_ndd_get_info_interval tcp_param_arr[56].tcp_param_val 1517 #define tcp_local_dacks_max tcp_param_arr[57].tcp_param_val 1518 #define tcp_ecn_permitted tcp_param_arr[58].tcp_param_val 1519 #define tcp_rst_sent_rate_enabled tcp_param_arr[59].tcp_param_val 1520 #define tcp_rst_sent_rate tcp_param_arr[60].tcp_param_val 1521 #define tcp_push_timer_interval tcp_param_arr[61].tcp_param_val 1522 #define tcp_use_smss_as_mss_opt tcp_param_arr[62].tcp_param_val 1523 #define tcp_keepalive_abort_interval_high tcp_param_arr[63].tcp_param_max 1524 #define tcp_keepalive_abort_interval tcp_param_arr[63].tcp_param_val 1525 #define tcp_keepalive_abort_interval_low tcp_param_arr[63].tcp_param_min 1526 1527 /* 1528 * tcp_mdt_hdr_{head,tail}_min are the leading and trailing spaces of 1529 * each header fragment in the header buffer. Each parameter value has 1530 * to be a multiple of 4 (32-bit aligned). 1531 */ 1532 static tcpparam_t tcp_mdt_head_param = { 32, 256, 32, "tcp_mdt_hdr_head_min" }; 1533 static tcpparam_t tcp_mdt_tail_param = { 0, 256, 32, "tcp_mdt_hdr_tail_min" }; 1534 #define tcp_mdt_hdr_head_min tcp_mdt_head_param.tcp_param_val 1535 #define tcp_mdt_hdr_tail_min tcp_mdt_tail_param.tcp_param_val 1536 1537 /* 1538 * tcp_mdt_max_pbufs is the upper limit value that tcp uses to figure out 1539 * the maximum number of payload buffers associated per Multidata. 1540 */ 1541 static tcpparam_t tcp_mdt_max_pbufs_param = 1542 { 1, MULTIDATA_MAX_PBUFS, MULTIDATA_MAX_PBUFS, "tcp_mdt_max_pbufs" }; 1543 #define tcp_mdt_max_pbufs tcp_mdt_max_pbufs_param.tcp_param_val 1544 1545 /* Round up the value to the nearest mss. */ 1546 #define MSS_ROUNDUP(value, mss) ((((value) - 1) / (mss) + 1) * (mss)) 1547 1548 /* 1549 * Set ECN capable transport (ECT) code point in IP header. 1550 * 1551 * Note that there are 2 ECT code points '01' and '10', which are called 1552 * ECT(1) and ECT(0) respectively. Here we follow the original ECT code 1553 * point ECT(0) for TCP as described in RFC 2481. 1554 */ 1555 #define SET_ECT(tcp, iph) \ 1556 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1557 /* We need to clear the code point first. */ \ 1558 ((ipha_t *)(iph))->ipha_type_of_service &= 0xFC; \ 1559 ((ipha_t *)(iph))->ipha_type_of_service |= IPH_ECN_ECT0; \ 1560 } else { \ 1561 ((ip6_t *)(iph))->ip6_vcf &= htonl(0xFFCFFFFF); \ 1562 ((ip6_t *)(iph))->ip6_vcf |= htonl(IPH_ECN_ECT0 << 20); \ 1563 } 1564 1565 /* 1566 * The format argument to pass to tcp_display(). 1567 * DISP_PORT_ONLY means that the returned string has only port info. 1568 * DISP_ADDR_AND_PORT means that the returned string also contains the 1569 * remote and local IP address. 1570 */ 1571 #define DISP_PORT_ONLY 1 1572 #define DISP_ADDR_AND_PORT 2 1573 1574 /* 1575 * This controls the rate some ndd info report functions can be used 1576 * by non-priviledged users. It stores the last time such info is 1577 * requested. When those report functions are called again, this 1578 * is checked with the current time and compare with the ndd param 1579 * tcp_ndd_get_info_interval. 1580 */ 1581 static clock_t tcp_last_ndd_get_info_time = 0; 1582 #define NDD_TOO_QUICK_MSG \ 1583 "ndd get info rate too high for non-priviledged users, try again " \ 1584 "later.\n" 1585 #define NDD_OUT_OF_BUF_MSG "<< Out of buffer >>\n" 1586 1587 #define IS_VMLOANED_MBLK(mp) \ 1588 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 1589 1590 /* 1591 * These two variables control the rate for TCP to generate RSTs in 1592 * response to segments not belonging to any connections. We limit 1593 * TCP to sent out tcp_rst_sent_rate (ndd param) number of RSTs in 1594 * each 1 second interval. This is to protect TCP against DoS attack. 1595 */ 1596 static clock_t tcp_last_rst_intrvl; 1597 static uint32_t tcp_rst_cnt; 1598 1599 /* The number of RST not sent because of the rate limit. */ 1600 static uint32_t tcp_rst_unsent; 1601 1602 /* Enable or disable b_cont M_MULTIDATA chaining for MDT. */ 1603 boolean_t tcp_mdt_chain = B_TRUE; 1604 1605 /* 1606 * MDT threshold in the form of effective send MSS multiplier; we take 1607 * the MDT path if the amount of unsent data exceeds the threshold value 1608 * (default threshold is 1*SMSS). 1609 */ 1610 uint_t tcp_mdt_smss_threshold = 1; 1611 1612 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 1613 1614 /* 1615 * Forces all connections to obey the value of the tcp_maxpsz_multiplier 1616 * tunable settable via NDD. Otherwise, the per-connection behavior is 1617 * determined dynamically during tcp_adapt_ire(), which is the default. 1618 */ 1619 boolean_t tcp_static_maxpsz = B_FALSE; 1620 1621 /* If set to 0, pick ephemeral port sequentially; otherwise randomly. */ 1622 uint32_t tcp_random_anon_port = 1; 1623 1624 /* 1625 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 1626 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 1627 * data, TCP will not respond with an ACK. RFC 793 requires that 1628 * TCP responds with an ACK for such a bogus ACK. By not following 1629 * the RFC, we prevent TCP from getting into an ACK storm if somehow 1630 * an attacker successfully spoofs an acceptable segment to our 1631 * peer; or when our peer is "confused." 1632 */ 1633 uint32_t tcp_drop_ack_unsent_cnt = 10; 1634 1635 /* 1636 * Hook functions to enable cluster networking 1637 * On non-clustered systems these vectors must always be NULL. 1638 */ 1639 1640 void (*cl_inet_listen)(uint8_t protocol, sa_family_t addr_family, 1641 uint8_t *laddrp, in_port_t lport) = NULL; 1642 void (*cl_inet_unlisten)(uint8_t protocol, sa_family_t addr_family, 1643 uint8_t *laddrp, in_port_t lport) = NULL; 1644 void (*cl_inet_connect)(uint8_t protocol, sa_family_t addr_family, 1645 uint8_t *laddrp, in_port_t lport, 1646 uint8_t *faddrp, in_port_t fport) = NULL; 1647 void (*cl_inet_disconnect)(uint8_t protocol, sa_family_t addr_family, 1648 uint8_t *laddrp, in_port_t lport, 1649 uint8_t *faddrp, in_port_t fport) = NULL; 1650 1651 /* 1652 * The following are defined in ip.c 1653 */ 1654 extern int (*cl_inet_isclusterwide)(uint8_t protocol, sa_family_t addr_family, 1655 uint8_t *laddrp); 1656 extern uint32_t (*cl_inet_ipident)(uint8_t protocol, sa_family_t addr_family, 1657 uint8_t *laddrp, uint8_t *faddrp); 1658 1659 #define CL_INET_CONNECT(tcp) { \ 1660 if (cl_inet_connect != NULL) { \ 1661 /* \ 1662 * Running in cluster mode - register active connection \ 1663 * information \ 1664 */ \ 1665 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1666 if ((tcp)->tcp_ipha->ipha_src != 0) { \ 1667 (*cl_inet_connect)(IPPROTO_TCP, AF_INET,\ 1668 (uint8_t *)(&((tcp)->tcp_ipha->ipha_src)),\ 1669 (in_port_t)(tcp)->tcp_lport, \ 1670 (uint8_t *)(&((tcp)->tcp_ipha->ipha_dst)),\ 1671 (in_port_t)(tcp)->tcp_fport); \ 1672 } \ 1673 } else { \ 1674 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1675 &(tcp)->tcp_ip6h->ip6_src)) {\ 1676 (*cl_inet_connect)(IPPROTO_TCP, AF_INET6,\ 1677 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_src)),\ 1678 (in_port_t)(tcp)->tcp_lport, \ 1679 (uint8_t *)(&((tcp)->tcp_ip6h->ip6_dst)),\ 1680 (in_port_t)(tcp)->tcp_fport); \ 1681 } \ 1682 } \ 1683 } \ 1684 } 1685 1686 #define CL_INET_DISCONNECT(tcp) { \ 1687 if (cl_inet_disconnect != NULL) { \ 1688 /* \ 1689 * Running in cluster mode - deregister active \ 1690 * connection information \ 1691 */ \ 1692 if ((tcp)->tcp_ipversion == IPV4_VERSION) { \ 1693 if ((tcp)->tcp_ip_src != 0) { \ 1694 (*cl_inet_disconnect)(IPPROTO_TCP, \ 1695 AF_INET, \ 1696 (uint8_t *)(&((tcp)->tcp_ip_src)),\ 1697 (in_port_t)(tcp)->tcp_lport, \ 1698 (uint8_t *) \ 1699 (&((tcp)->tcp_ipha->ipha_dst)),\ 1700 (in_port_t)(tcp)->tcp_fport); \ 1701 } \ 1702 } else { \ 1703 if (!IN6_IS_ADDR_UNSPECIFIED( \ 1704 &(tcp)->tcp_ip_src_v6)) { \ 1705 (*cl_inet_disconnect)(IPPROTO_TCP, AF_INET6,\ 1706 (uint8_t *)(&((tcp)->tcp_ip_src_v6)),\ 1707 (in_port_t)(tcp)->tcp_lport, \ 1708 (uint8_t *) \ 1709 (&((tcp)->tcp_ip6h->ip6_dst)),\ 1710 (in_port_t)(tcp)->tcp_fport); \ 1711 } \ 1712 } \ 1713 } \ 1714 } 1715 1716 /* 1717 * Cluster networking hook for traversing current connection list. 1718 * This routine is used to extract the current list of live connections 1719 * which must continue to to be dispatched to this node. 1720 */ 1721 int cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg); 1722 1723 #define IPH_TCPH_CHECKSUMP(ipha, hlen) \ 1724 ((uint16_t *)(((uchar_t *)(ipha)) + ((hlen) + 16))) 1725 1726 #ifdef _BIG_ENDIAN 1727 #define IP_TCP_CSUM_COMP IPPROTO_TCP 1728 #else 1729 #define IP_TCP_CSUM_COMP (IPPROTO_TCP << 8) 1730 #endif 1731 1732 #define IP_HDR_CKSUM(ipha, sum, v_hlen_tos_len, ttl_protocol) { \ 1733 (sum) += (ttl_protocol) + (ipha)->ipha_ident + \ 1734 ((v_hlen_tos_len) >> 16) + \ 1735 ((v_hlen_tos_len) & 0xFFFF) + \ 1736 (ipha)->ipha_fragment_offset_and_flags; \ 1737 (sum) = (((sum) & 0xFFFF) + ((sum) >> 16)); \ 1738 (sum) = ~((sum) + ((sum) >> 16)); \ 1739 (ipha)->ipha_hdr_checksum = (uint16_t)(sum); \ 1740 } 1741 1742 /* 1743 * Macros that determine whether or not IP processing is needed for TCP. 1744 */ 1745 #define TCP_IPOPT_POLICY_V4(tcp) \ 1746 ((tcp)->tcp_ipversion == IPV4_VERSION && \ 1747 ((tcp)->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH || \ 1748 CONN_OUTBOUND_POLICY_PRESENT((tcp)->tcp_connp) || \ 1749 CONN_INBOUND_POLICY_PRESENT((tcp)->tcp_connp))) 1750 1751 #define TCP_IPOPT_POLICY_V6(tcp) \ 1752 ((tcp)->tcp_ipversion == IPV6_VERSION && \ 1753 ((tcp)->tcp_ip_hdr_len != IPV6_HDR_LEN || \ 1754 CONN_OUTBOUND_POLICY_PRESENT_V6((tcp)->tcp_connp) || \ 1755 CONN_INBOUND_POLICY_PRESENT_V6((tcp)->tcp_connp))) 1756 1757 #define TCP_LOOPBACK_IP(tcp) \ 1758 (TCP_IPOPT_POLICY_V4(tcp) || TCP_IPOPT_POLICY_V6(tcp) || \ 1759 !CONN_IS_MD_FASTPATH((tcp)->tcp_connp)) 1760 1761 boolean_t do_tcp_fusion = B_TRUE; 1762 1763 /* 1764 * This routine gets called by the eager tcp upon changing state from 1765 * SYN_RCVD to ESTABLISHED. It fuses a direct path between itself 1766 * and the active connect tcp such that the regular tcp processings 1767 * may be bypassed under allowable circumstances. Because the fusion 1768 * requires both endpoints to be in the same squeue, it does not work 1769 * for simultaneous active connects because there is no easy way to 1770 * switch from one squeue to another once the connection is created. 1771 * This is different from the eager tcp case where we assign it the 1772 * same squeue as the one given to the active connect tcp during open. 1773 */ 1774 static void 1775 tcp_fuse(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph) 1776 { 1777 conn_t *peer_connp, *connp = tcp->tcp_connp; 1778 tcp_t *peer_tcp; 1779 1780 ASSERT(!tcp->tcp_fused); 1781 ASSERT(tcp->tcp_loopback); 1782 ASSERT(tcp->tcp_loopback_peer == NULL); 1783 /* 1784 * We need to check the listener tcp to make sure it's a socket 1785 * endpoint, but we can't really use tcp_listener since we get 1786 * here after sending up T_CONN_IND and tcp_wput_accept() may be 1787 * called independently, at which point tcp_listener is cleared; 1788 * this is why we use tcp_saved_listener. The listener itself 1789 * is guaranteed to be around until tcp_accept_finish() is called 1790 * on this eager -- this won't happen until we're done since 1791 * we're inside the eager's perimeter now. 1792 */ 1793 ASSERT(tcp->tcp_saved_listener != NULL); 1794 1795 /* 1796 * Lookup peer endpoint; search for the remote endpoint having 1797 * the reversed address-port quadruplet in ESTABLISHED state, 1798 * which is guaranteed to be unique in the system. Zone check 1799 * is applied accordingly for loopback address, but not for 1800 * local address since we want fusion to happen across Zones. 1801 */ 1802 if (tcp->tcp_ipversion == IPV4_VERSION) { 1803 peer_connp = ipcl_conn_tcp_lookup_reversed_ipv4(connp, 1804 (ipha_t *)iphdr, tcph); 1805 } else { 1806 peer_connp = ipcl_conn_tcp_lookup_reversed_ipv6(connp, 1807 (ip6_t *)iphdr, tcph); 1808 } 1809 1810 /* 1811 * We can only proceed if peer exists, resides in the same squeue 1812 * as our conn and is not raw-socket. The squeue assignment of 1813 * this eager tcp was done earlier at the time of SYN processing 1814 * in ip_fanout_tcp{_v6}. Note that similar squeues by itself 1815 * doesn't guarantee a safe condition to fuse, hence we perform 1816 * additional tests below. 1817 */ 1818 ASSERT(peer_connp == NULL || peer_connp != connp); 1819 if (peer_connp == NULL || peer_connp->conn_sqp != connp->conn_sqp || 1820 !IPCL_IS_TCP(peer_connp)) { 1821 if (peer_connp != NULL) { 1822 TCP_STAT(tcp_fusion_unqualified); 1823 CONN_DEC_REF(peer_connp); 1824 } 1825 return; 1826 } 1827 peer_tcp = peer_connp->conn_tcp; /* active connect tcp */ 1828 1829 ASSERT(peer_tcp != NULL && peer_tcp != tcp && !peer_tcp->tcp_fused); 1830 ASSERT(peer_tcp->tcp_loopback && peer_tcp->tcp_loopback_peer == NULL); 1831 ASSERT(peer_connp->conn_sqp == connp->conn_sqp); 1832 1833 /* 1834 * Fuse the endpoints; we perform further checks against both 1835 * tcp endpoints to ensure that a fusion is allowed to happen. 1836 * In particular we bail out for TPI, non-simple TCP/IP or if 1837 * IPsec/IPQoS policy exists. We could actually do it for the 1838 * XTI/TLI/TPI case but this requires more testing, so for now 1839 * we handle only the socket case. 1840 */ 1841 if (!tcp->tcp_unfusable && !peer_tcp->tcp_unfusable && 1842 TCP_IS_SOCKET(tcp->tcp_saved_listener) && TCP_IS_SOCKET(peer_tcp) && 1843 !TCP_LOOPBACK_IP(tcp) && !TCP_LOOPBACK_IP(peer_tcp) && 1844 !IPP_ENABLED(IPP_LOCAL_OUT|IPP_LOCAL_IN)) { 1845 mblk_t *mp; 1846 struct stroptions *stropt; 1847 queue_t *peer_rq = peer_tcp->tcp_rq; 1848 size_t sth_hiwat; 1849 1850 ASSERT(!TCP_IS_DETACHED(peer_tcp) && peer_rq != NULL); 1851 1852 /* 1853 * We need to drain data on both endpoints during unfuse. 1854 * If we need to send up SIGURG at the time of draining, 1855 * we want to be sure that an mblk is readily available. 1856 * This is why we pre-allocate the M_PCSIG mblks for both 1857 * endpoints which will only be used during/after unfuse. 1858 */ 1859 if ((mp = allocb(1, BPRI_HI)) == NULL) { 1860 CONN_DEC_REF(peer_connp); 1861 return; 1862 } 1863 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 1864 tcp->tcp_fused_sigurg_mp = mp; 1865 1866 if ((mp = allocb(1, BPRI_HI)) == NULL) { 1867 freeb(tcp->tcp_fused_sigurg_mp); 1868 tcp->tcp_fused_sigurg_mp = NULL; 1869 CONN_DEC_REF(peer_connp); 1870 return; 1871 } 1872 ASSERT(peer_tcp->tcp_fused_sigurg_mp == NULL); 1873 peer_tcp->tcp_fused_sigurg_mp = mp; 1874 1875 /* Allocate M_SETOPTS mblk */ 1876 mp = allocb(sizeof (*stropt), BPRI_HI); 1877 if (mp == NULL) { 1878 freeb(tcp->tcp_fused_sigurg_mp); 1879 tcp->tcp_fused_sigurg_mp = NULL; 1880 freeb(peer_tcp->tcp_fused_sigurg_mp); 1881 peer_tcp->tcp_fused_sigurg_mp = NULL; 1882 CONN_DEC_REF(peer_connp); 1883 return; 1884 } 1885 1886 /* Fuse both endpoints */ 1887 peer_tcp->tcp_loopback_peer = tcp; 1888 tcp->tcp_loopback_peer = peer_tcp; 1889 peer_tcp->tcp_fused = tcp->tcp_fused = B_TRUE; 1890 1891 /* 1892 * We never use regular tcp paths in fusion and should 1893 * therefore clear tcp_unsent on both endpoints. Having 1894 * them set to non-zero values means asking for trouble 1895 * especially after unfuse, where we may end up sending 1896 * through regular tcp paths which expect xmit_list and 1897 * friends to be correctly setup. 1898 */ 1899 peer_tcp->tcp_unsent = tcp->tcp_unsent = 0; 1900 1901 tcp_timers_stop(tcp); 1902 tcp_timers_stop(peer_tcp); 1903 1904 /* 1905 * Set the stream head's write offset value to zero, since we 1906 * won't be needing any room for TCP/IP headers, and tell it 1907 * to not break up the writes. This would reduce the amount 1908 * of work done by kmem. In addition, we set the receive 1909 * buffer to twice that of q_hiwat in order to simulate the 1910 * non-fusion case. Note that we can only do this for the 1911 * active connect tcp since our eager is still detached; 1912 * it will be dealt with later in tcp_accept_finish(). 1913 */ 1914 DB_TYPE(mp) = M_SETOPTS; 1915 mp->b_wptr += sizeof (*stropt); 1916 1917 sth_hiwat = peer_rq->q_hiwat << 1; 1918 if (sth_hiwat > tcp_max_buf) 1919 sth_hiwat = tcp_max_buf; 1920 1921 stropt = (struct stroptions *)mp->b_rptr; 1922 stropt->so_flags = SO_MAXBLK | SO_WROFF | SO_HIWAT; 1923 stropt->so_maxblk = tcp_maxpsz_set(peer_tcp, B_FALSE); 1924 stropt->so_wroff = 0; 1925 stropt->so_hiwat = MAX(sth_hiwat, tcp_sth_rcv_hiwat); 1926 1927 /* Send the options up */ 1928 putnext(peer_rq, mp); 1929 } else { 1930 TCP_STAT(tcp_fusion_unqualified); 1931 } 1932 CONN_DEC_REF(peer_connp); 1933 } 1934 1935 /* 1936 * Unfuse a previously-fused pair of tcp loopback endpoints. 1937 */ 1938 static void 1939 tcp_unfuse(tcp_t *tcp) 1940 { 1941 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 1942 1943 ASSERT(tcp->tcp_fused && peer_tcp != NULL); 1944 ASSERT(peer_tcp->tcp_fused && peer_tcp->tcp_loopback_peer == tcp); 1945 ASSERT(tcp->tcp_connp->conn_sqp == peer_tcp->tcp_connp->conn_sqp); 1946 ASSERT(tcp->tcp_unsent == 0 && peer_tcp->tcp_unsent == 0); 1947 ASSERT(tcp->tcp_fused_sigurg_mp != NULL); 1948 ASSERT(peer_tcp->tcp_fused_sigurg_mp != NULL); 1949 1950 /* 1951 * Drain any pending data; the detached check is needed because 1952 * we may be called from tcp_fuse_output(). Note that in case of 1953 * a detached tcp, the draining will happen later after the tcp 1954 * is unfused. For non-urgent data, this can be handled by the 1955 * regular tcp_rcv_drain(). If we have urgent data sitting in 1956 * the receive list, we will need to send up a SIGURG signal first 1957 * before draining the data. All of these will be handled by the 1958 * code in tcp_fuse_rcv_drain() when called from tcp_rcv_drain(). 1959 */ 1960 if (!TCP_IS_DETACHED(tcp)) { 1961 (void) tcp_fuse_rcv_drain(tcp->tcp_rq, tcp, 1962 &tcp->tcp_fused_sigurg_mp); 1963 } 1964 if (!TCP_IS_DETACHED(peer_tcp)) { 1965 (void) tcp_fuse_rcv_drain(peer_tcp->tcp_rq, peer_tcp, 1966 &peer_tcp->tcp_fused_sigurg_mp); 1967 } 1968 /* Lift up any flow-control conditions */ 1969 if (tcp->tcp_flow_stopped) { 1970 tcp_clrqfull(tcp); 1971 tcp->tcp_flow_stopped = B_FALSE; 1972 TCP_STAT(tcp_fusion_backenabled); 1973 } 1974 if (peer_tcp->tcp_flow_stopped) { 1975 tcp_clrqfull(peer_tcp); 1976 peer_tcp->tcp_flow_stopped = B_FALSE; 1977 TCP_STAT(tcp_fusion_backenabled); 1978 } 1979 1980 /* Free up M_PCSIG mblk(s) if not needed */ 1981 if (!tcp->tcp_fused_sigurg && tcp->tcp_fused_sigurg_mp != NULL) { 1982 freeb(tcp->tcp_fused_sigurg_mp); 1983 tcp->tcp_fused_sigurg_mp = NULL; 1984 } 1985 if (!peer_tcp->tcp_fused_sigurg && 1986 peer_tcp->tcp_fused_sigurg_mp != NULL) { 1987 freeb(peer_tcp->tcp_fused_sigurg_mp); 1988 peer_tcp->tcp_fused_sigurg_mp = NULL; 1989 } 1990 1991 /* 1992 * Update th_seq and th_ack in the header template 1993 */ 1994 U32_TO_ABE32(tcp->tcp_snxt, tcp->tcp_tcph->th_seq); 1995 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 1996 U32_TO_ABE32(peer_tcp->tcp_snxt, peer_tcp->tcp_tcph->th_seq); 1997 U32_TO_ABE32(peer_tcp->tcp_rnxt, peer_tcp->tcp_tcph->th_ack); 1998 1999 /* Unfuse the endpoints */ 2000 peer_tcp->tcp_fused = tcp->tcp_fused = B_FALSE; 2001 peer_tcp->tcp_loopback_peer = tcp->tcp_loopback_peer = NULL; 2002 } 2003 2004 /* 2005 * Fusion output routine for urgent data. This routine is called by 2006 * tcp_fuse_output() for handling non-M_DATA mblks. 2007 */ 2008 static void 2009 tcp_fuse_output_urg(tcp_t *tcp, mblk_t *mp) 2010 { 2011 mblk_t *mp1; 2012 struct T_exdata_ind *tei; 2013 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2014 mblk_t *head, *prev_head = NULL; 2015 2016 ASSERT(tcp->tcp_fused); 2017 ASSERT(peer_tcp != NULL && peer_tcp->tcp_loopback_peer == tcp); 2018 ASSERT(DB_TYPE(mp) == M_PROTO || DB_TYPE(mp) == M_PCPROTO); 2019 ASSERT(mp->b_cont != NULL && DB_TYPE(mp->b_cont) == M_DATA); 2020 ASSERT(MBLKL(mp) >= sizeof (*tei) && MBLKL(mp->b_cont) > 0); 2021 2022 /* 2023 * Urgent data arrives in the form of T_EXDATA_REQ from above. 2024 * Each occurence denotes a new urgent pointer. For each new 2025 * urgent pointer we signal (SIGURG) the receiving app to indicate 2026 * that it needs to go into urgent mode. This is similar to the 2027 * urgent data handling in the regular tcp. We don't need to keep 2028 * track of where the urgent pointer is, because each T_EXDATA_REQ 2029 * "advances" the urgent pointer for us. 2030 * 2031 * The actual urgent data carried by T_EXDATA_REQ is then prepended 2032 * by a T_EXDATA_IND before being enqueued behind any existing data 2033 * destined for the receiving app. There is only a single urgent 2034 * pointer (out-of-band mark) for a given tcp. If the new urgent 2035 * data arrives before the receiving app reads some existing urgent 2036 * data, the previous marker is lost. This behavior is emulated 2037 * accordingly below, by removing any existing T_EXDATA_IND messages 2038 * and essentially converting old urgent data into non-urgent. 2039 */ 2040 ASSERT(tcp->tcp_valid_bits & TCP_URG_VALID); 2041 /* Let sender get out of urgent mode */ 2042 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 2043 2044 /* 2045 * Send up SIGURG to the receiving peer; if the peer is detached 2046 * or if we can't allocate the M_PCSIG, indicate that we need to 2047 * signal upon draining to the peer by marking tcp_fused_sigurg. 2048 * This flag will only get cleared once SIGURG is delivered and 2049 * is not affected by the tcp_fused flag -- delivery will still 2050 * happen even after an endpoint is unfused, to handle the case 2051 * where the sending endpoint immediately closes/unfuses after 2052 * sending urgent data and the accept is not yet finished. 2053 */ 2054 if (!TCP_IS_DETACHED(peer_tcp) && 2055 ((mp1 = allocb(1, BPRI_HI)) != NULL || 2056 (mp1 = allocb_tryhard(1)) != NULL)) { 2057 peer_tcp->tcp_fused_sigurg = B_FALSE; 2058 /* Send up the signal */ 2059 DB_TYPE(mp1) = M_PCSIG; 2060 *mp1->b_wptr++ = (uchar_t)SIGURG; 2061 putnext(peer_tcp->tcp_rq, mp1); 2062 } else { 2063 peer_tcp->tcp_fused_sigurg = B_TRUE; 2064 } 2065 2066 /* Reuse T_EXDATA_REQ mblk for T_EXDATA_IND */ 2067 DB_TYPE(mp) = M_PROTO; 2068 tei = (struct T_exdata_ind *)mp->b_rptr; 2069 tei->PRIM_type = T_EXDATA_IND; 2070 tei->MORE_flag = 0; 2071 mp->b_wptr = (uchar_t *)&tei[1]; 2072 2073 TCP_STAT(tcp_fusion_urg); 2074 BUMP_MIB(&tcp_mib, tcpOutUrg); 2075 2076 head = peer_tcp->tcp_rcv_list; 2077 while (head != NULL) { 2078 /* 2079 * Remove existing T_EXDATA_IND, keep the data which follows 2080 * it and relink our list. Note that we don't modify the 2081 * tcp_rcv_last_tail since it never points to T_EXDATA_IND. 2082 */ 2083 if (DB_TYPE(head) != M_DATA) { 2084 mp1 = head; 2085 2086 ASSERT(DB_TYPE(mp1->b_cont) == M_DATA); 2087 head = mp1->b_cont; 2088 mp1->b_cont = NULL; 2089 head->b_next = mp1->b_next; 2090 mp1->b_next = NULL; 2091 if (prev_head != NULL) 2092 prev_head->b_next = head; 2093 if (peer_tcp->tcp_rcv_list == mp1) 2094 peer_tcp->tcp_rcv_list = head; 2095 if (peer_tcp->tcp_rcv_last_head == mp1) 2096 peer_tcp->tcp_rcv_last_head = head; 2097 freeb(mp1); 2098 } 2099 prev_head = head; 2100 head = head->b_next; 2101 } 2102 } 2103 2104 /* 2105 * Fusion output routine, called by tcp_output() and tcp_wput_proto(). 2106 */ 2107 static boolean_t 2108 tcp_fuse_output(tcp_t *tcp, mblk_t *mp) 2109 { 2110 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2111 queue_t *peer_rq; 2112 mblk_t *mp_tail = mp; 2113 uint32_t send_size = 0; 2114 2115 ASSERT(tcp->tcp_fused); 2116 ASSERT(peer_tcp != NULL && peer_tcp->tcp_loopback_peer == tcp); 2117 ASSERT(tcp->tcp_connp->conn_sqp == peer_tcp->tcp_connp->conn_sqp); 2118 ASSERT(DB_TYPE(mp) == M_DATA || DB_TYPE(mp) == M_PROTO || 2119 DB_TYPE(mp) == M_PCPROTO); 2120 2121 peer_rq = peer_tcp->tcp_rq; 2122 2123 /* If this connection requires IP, unfuse and use regular path */ 2124 if (TCP_LOOPBACK_IP(tcp) || TCP_LOOPBACK_IP(peer_tcp) || 2125 IPP_ENABLED(IPP_LOCAL_OUT|IPP_LOCAL_IN)) { 2126 TCP_STAT(tcp_fusion_aborted); 2127 tcp_unfuse(tcp); 2128 return (B_FALSE); 2129 } 2130 2131 for (;;) { 2132 if (DB_TYPE(mp_tail) == M_DATA) 2133 send_size += MBLKL(mp_tail); 2134 if (mp_tail->b_cont == NULL) 2135 break; 2136 mp_tail = mp_tail->b_cont; 2137 } 2138 2139 if (send_size == 0) { 2140 freemsg(mp); 2141 return (B_TRUE); 2142 } 2143 2144 /* 2145 * Handle urgent data; we either send up SIGURG to the peer now 2146 * or do it later when we drain, in case the peer is detached 2147 * or if we're short of memory for M_PCSIG mblk. 2148 */ 2149 if (DB_TYPE(mp) != M_DATA) 2150 tcp_fuse_output_urg(tcp, mp); 2151 2152 /* 2153 * Enqueue data into the peer's receive list; we may or may not 2154 * drain the contents depending on the conditions below. 2155 */ 2156 tcp_rcv_enqueue(peer_tcp, mp, send_size); 2157 2158 /* In case it wrapped around and also to keep it constant */ 2159 peer_tcp->tcp_rwnd += send_size; 2160 2161 /* 2162 * If peer is detached, exercise flow-control when needed; we will 2163 * get back-enabled either in tcp_accept_finish() or tcp_unfuse(). 2164 */ 2165 if (TCP_IS_DETACHED(peer_tcp) && 2166 peer_tcp->tcp_rcv_cnt > peer_rq->q_hiwat) { 2167 tcp_setqfull(tcp); 2168 tcp->tcp_flow_stopped = B_TRUE; 2169 TCP_STAT(tcp_fusion_flowctl); 2170 } 2171 2172 loopback_packets++; 2173 tcp->tcp_last_sent_len = send_size; 2174 2175 /* Need to adjust the following SNMP MIB-related variables */ 2176 tcp->tcp_snxt += send_size; 2177 tcp->tcp_suna = tcp->tcp_snxt; 2178 peer_tcp->tcp_rnxt += send_size; 2179 peer_tcp->tcp_rack = peer_tcp->tcp_rnxt; 2180 2181 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 2182 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, send_size); 2183 2184 BUMP_MIB(&tcp_mib, tcpInSegs); 2185 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 2186 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, send_size); 2187 2188 BUMP_LOCAL(tcp->tcp_obsegs); 2189 BUMP_LOCAL(peer_tcp->tcp_ibsegs); 2190 2191 if (!TCP_IS_DETACHED(peer_tcp)) { 2192 /* 2193 * If we can't send SIGURG above due to lack of memory, 2194 * schedule push timer and try again. Otherwise drain 2195 * the data if we're not flow-controlled. 2196 */ 2197 if (peer_tcp->tcp_fused_sigurg) { 2198 if (peer_tcp->tcp_push_tid == 0) { 2199 peer_tcp->tcp_push_tid = 2200 TCP_TIMER(peer_tcp, tcp_push_timer, 2201 MSEC_TO_TICK(tcp_push_timer_interval)); 2202 } 2203 } else if (!tcp->tcp_flow_stopped) { 2204 if (!canputnext(peer_rq)) { 2205 tcp_setqfull(tcp); 2206 tcp->tcp_flow_stopped = B_TRUE; 2207 TCP_STAT(tcp_fusion_flowctl); 2208 } else { 2209 ASSERT(peer_tcp->tcp_rcv_list != NULL); 2210 (void) tcp_fuse_rcv_drain(peer_rq, 2211 peer_tcp, NULL); 2212 TCP_STAT(tcp_fusion_putnext); 2213 } 2214 } 2215 } 2216 return (B_TRUE); 2217 } 2218 2219 /* 2220 * This routine gets called to deliver data upstream on a fused or 2221 * previously fused tcp loopback endpoint; the latter happens only 2222 * when there is a pending SIGURG signal plus urgent data that can't 2223 * be sent upstream in the past. 2224 */ 2225 static boolean_t 2226 tcp_fuse_rcv_drain(queue_t *q, tcp_t *tcp, mblk_t **sigurg_mpp) 2227 { 2228 mblk_t *mp; 2229 #ifdef DEBUG 2230 uint_t cnt = 0; 2231 #endif 2232 2233 ASSERT(tcp->tcp_loopback); 2234 ASSERT(tcp->tcp_fused || tcp->tcp_fused_sigurg); 2235 ASSERT(!tcp->tcp_fused || tcp->tcp_loopback_peer != NULL); 2236 ASSERT(sigurg_mpp != NULL || tcp->tcp_fused); 2237 2238 /* No need for the push timer now, in case it was scheduled */ 2239 if (tcp->tcp_push_tid != 0) { 2240 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 2241 tcp->tcp_push_tid = 0; 2242 } 2243 /* 2244 * If there's urgent data sitting in receive list and we didn't 2245 * get a chance to send up a SIGURG signal, make sure we send 2246 * it first before draining in order to ensure that SIOCATMARK 2247 * works properly. 2248 */ 2249 if (tcp->tcp_fused_sigurg) { 2250 /* 2251 * sigurg_mpp is normally NULL, i.e. when we're still 2252 * fused and didn't get here because of tcp_unfuse(). 2253 * In this case try hard to allocate the M_PCSIG mblk. 2254 */ 2255 if (sigurg_mpp == NULL && 2256 (mp = allocb(1, BPRI_HI)) == NULL && 2257 (mp = allocb_tryhard(1)) == NULL) { 2258 /* Alloc failed; try again next time */ 2259 tcp->tcp_push_tid = TCP_TIMER(tcp, tcp_push_timer, 2260 MSEC_TO_TICK(tcp_push_timer_interval)); 2261 return (B_TRUE); 2262 } else if (sigurg_mpp != NULL) { 2263 /* 2264 * Use the supplied M_PCSIG mblk; it means we're 2265 * either unfused or in the process of unfusing, 2266 * and the drain must happen now. 2267 */ 2268 mp = *sigurg_mpp; 2269 *sigurg_mpp = NULL; 2270 } 2271 ASSERT(mp != NULL); 2272 2273 tcp->tcp_fused_sigurg = B_FALSE; 2274 /* Send up the signal */ 2275 DB_TYPE(mp) = M_PCSIG; 2276 *mp->b_wptr++ = (uchar_t)SIGURG; 2277 putnext(q, mp); 2278 /* 2279 * Let the regular tcp_rcv_drain() path handle 2280 * draining the data if we're no longer fused. 2281 */ 2282 if (!tcp->tcp_fused) 2283 return (B_FALSE); 2284 } 2285 2286 /* Drain the data */ 2287 while ((mp = tcp->tcp_rcv_list) != NULL) { 2288 tcp->tcp_rcv_list = mp->b_next; 2289 mp->b_next = NULL; 2290 #ifdef DEBUG 2291 cnt += msgdsize(mp); 2292 #endif 2293 putnext(q, mp); 2294 } 2295 2296 ASSERT(cnt == tcp->tcp_rcv_cnt); 2297 tcp->tcp_rcv_last_head = NULL; 2298 tcp->tcp_rcv_last_tail = NULL; 2299 tcp->tcp_rcv_cnt = 0; 2300 tcp->tcp_rwnd = q->q_hiwat; 2301 2302 return (B_TRUE); 2303 } 2304 2305 /* 2306 * This is the walker function, which is TCP specific. 2307 * It walks through the conn_hash bucket searching for the 2308 * next valid connp/tcp in the list, selecting connp/tcp 2309 * which haven't closed or condemned. It also REFHOLDS the 2310 * reference for the tcp, ensuring that the tcp exists 2311 * when the caller uses the tcp. 2312 * 2313 * tcp_get_next_conn 2314 * get the next entry in the conn global list 2315 * and put a reference on the next_conn. 2316 * decrement the reference on the current conn. 2317 */ 2318 conn_t * 2319 tcp_get_next_conn(connf_t *connfp, conn_t *connp) 2320 { 2321 conn_t *next_connp; 2322 2323 if (connfp == NULL) 2324 return (NULL); 2325 2326 mutex_enter(&connfp->connf_lock); 2327 2328 next_connp = (connp == NULL) ? 2329 connfp->connf_head : connp->conn_g_next; 2330 2331 while (next_connp != NULL) { 2332 mutex_enter(&next_connp->conn_lock); 2333 if ((next_connp->conn_state_flags & 2334 (CONN_CONDEMNED | CONN_INCIPIENT)) || 2335 !IPCL_IS_TCP(next_connp)) { 2336 /* 2337 * This conn has been condemned or 2338 * is closing. 2339 */ 2340 mutex_exit(&next_connp->conn_lock); 2341 next_connp = next_connp->conn_g_next; 2342 continue; 2343 } 2344 ASSERT(next_connp->conn_tcp != NULL); 2345 CONN_INC_REF_LOCKED(next_connp); 2346 mutex_exit(&next_connp->conn_lock); 2347 break; 2348 } 2349 2350 mutex_exit(&connfp->connf_lock); 2351 2352 if (connp != NULL) { 2353 CONN_DEC_REF(connp); 2354 } 2355 2356 return (next_connp); 2357 } 2358 2359 /* 2360 * Figure out the value of window scale opton. Note that the rwnd is 2361 * ASSUMED to be rounded up to the nearest MSS before the calculation. 2362 * We cannot find the scale value and then do a round up of tcp_rwnd 2363 * because the scale value may not be correct after that. 2364 * 2365 * Set the compiler flag to make this function inline. 2366 */ 2367 static void 2368 tcp_set_ws_value(tcp_t *tcp) 2369 { 2370 int i; 2371 uint32_t rwnd = tcp->tcp_rwnd; 2372 2373 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 2374 i++, rwnd >>= 1) 2375 ; 2376 tcp->tcp_rcv_ws = i; 2377 } 2378 2379 /* 2380 * Remove a connection from the list of detached TIME_WAIT connections. 2381 */ 2382 static void 2383 tcp_time_wait_remove(tcp_t *tcp, tcp_squeue_priv_t *tcp_time_wait) 2384 { 2385 boolean_t locked = B_FALSE; 2386 2387 if (tcp_time_wait == NULL) { 2388 tcp_time_wait = *((tcp_squeue_priv_t **) 2389 squeue_getprivate(tcp->tcp_connp->conn_sqp, SQPRIVATE_TCP)); 2390 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2391 locked = B_TRUE; 2392 } 2393 2394 if (tcp->tcp_time_wait_expire == 0) { 2395 ASSERT(tcp->tcp_time_wait_next == NULL); 2396 ASSERT(tcp->tcp_time_wait_prev == NULL); 2397 if (locked) 2398 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2399 return; 2400 } 2401 ASSERT(TCP_IS_DETACHED(tcp)); 2402 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 2403 2404 if (tcp == tcp_time_wait->tcp_time_wait_head) { 2405 ASSERT(tcp->tcp_time_wait_prev == NULL); 2406 tcp_time_wait->tcp_time_wait_head = tcp->tcp_time_wait_next; 2407 if (tcp_time_wait->tcp_time_wait_head != NULL) { 2408 tcp_time_wait->tcp_time_wait_head->tcp_time_wait_prev = 2409 NULL; 2410 } else { 2411 tcp_time_wait->tcp_time_wait_tail = NULL; 2412 } 2413 } else if (tcp == tcp_time_wait->tcp_time_wait_tail) { 2414 ASSERT(tcp != tcp_time_wait->tcp_time_wait_head); 2415 ASSERT(tcp->tcp_time_wait_next == NULL); 2416 tcp_time_wait->tcp_time_wait_tail = tcp->tcp_time_wait_prev; 2417 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 2418 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = NULL; 2419 } else { 2420 ASSERT(tcp->tcp_time_wait_prev->tcp_time_wait_next == tcp); 2421 ASSERT(tcp->tcp_time_wait_next->tcp_time_wait_prev == tcp); 2422 tcp->tcp_time_wait_prev->tcp_time_wait_next = 2423 tcp->tcp_time_wait_next; 2424 tcp->tcp_time_wait_next->tcp_time_wait_prev = 2425 tcp->tcp_time_wait_prev; 2426 } 2427 tcp->tcp_time_wait_next = NULL; 2428 tcp->tcp_time_wait_prev = NULL; 2429 tcp->tcp_time_wait_expire = 0; 2430 2431 if (locked) 2432 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2433 } 2434 2435 /* 2436 * Add a connection to the list of detached TIME_WAIT connections 2437 * and set its time to expire. 2438 */ 2439 static void 2440 tcp_time_wait_append(tcp_t *tcp) 2441 { 2442 tcp_squeue_priv_t *tcp_time_wait = 2443 *((tcp_squeue_priv_t **)squeue_getprivate(tcp->tcp_connp->conn_sqp, 2444 SQPRIVATE_TCP)); 2445 2446 tcp_timers_stop(tcp); 2447 2448 /* Freed above */ 2449 ASSERT(tcp->tcp_timer_tid == 0); 2450 ASSERT(tcp->tcp_ack_tid == 0); 2451 2452 /* must have happened at the time of detaching the tcp */ 2453 ASSERT(tcp->tcp_ptpahn == NULL); 2454 ASSERT(tcp->tcp_flow_stopped == 0); 2455 ASSERT(tcp->tcp_time_wait_next == NULL); 2456 ASSERT(tcp->tcp_time_wait_prev == NULL); 2457 ASSERT(tcp->tcp_time_wait_expire == NULL); 2458 ASSERT(tcp->tcp_listener == NULL); 2459 2460 tcp->tcp_time_wait_expire = ddi_get_lbolt(); 2461 /* 2462 * The value computed below in tcp->tcp_time_wait_expire may 2463 * appear negative or wrap around. That is ok since our 2464 * interest is only in the difference between the current lbolt 2465 * value and tcp->tcp_time_wait_expire. But the value should not 2466 * be zero, since it means the tcp is not in the TIME_WAIT list. 2467 * The corresponding comparison in tcp_time_wait_collector() uses 2468 * modular arithmetic. 2469 */ 2470 tcp->tcp_time_wait_expire += 2471 drv_usectohz(tcp_time_wait_interval * 1000); 2472 if (tcp->tcp_time_wait_expire == 0) 2473 tcp->tcp_time_wait_expire = 1; 2474 2475 ASSERT(TCP_IS_DETACHED(tcp)); 2476 ASSERT(tcp->tcp_state == TCPS_TIME_WAIT); 2477 ASSERT(tcp->tcp_time_wait_next == NULL); 2478 ASSERT(tcp->tcp_time_wait_prev == NULL); 2479 TCP_DBGSTAT(tcp_time_wait); 2480 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2481 if (tcp_time_wait->tcp_time_wait_head == NULL) { 2482 ASSERT(tcp_time_wait->tcp_time_wait_tail == NULL); 2483 tcp_time_wait->tcp_time_wait_head = tcp; 2484 } else { 2485 ASSERT(tcp_time_wait->tcp_time_wait_tail != NULL); 2486 ASSERT(tcp_time_wait->tcp_time_wait_tail->tcp_state == 2487 TCPS_TIME_WAIT); 2488 tcp_time_wait->tcp_time_wait_tail->tcp_time_wait_next = tcp; 2489 tcp->tcp_time_wait_prev = tcp_time_wait->tcp_time_wait_tail; 2490 } 2491 tcp_time_wait->tcp_time_wait_tail = tcp; 2492 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2493 } 2494 2495 /* ARGSUSED */ 2496 void 2497 tcp_timewait_output(void *arg, mblk_t *mp, void *arg2) 2498 { 2499 conn_t *connp = (conn_t *)arg; 2500 tcp_t *tcp = connp->conn_tcp; 2501 2502 ASSERT(tcp != NULL); 2503 if (tcp->tcp_state == TCPS_CLOSED) { 2504 return; 2505 } 2506 2507 ASSERT((tcp->tcp_family == AF_INET && 2508 tcp->tcp_ipversion == IPV4_VERSION) || 2509 (tcp->tcp_family == AF_INET6 && 2510 (tcp->tcp_ipversion == IPV4_VERSION || 2511 tcp->tcp_ipversion == IPV6_VERSION))); 2512 ASSERT(!tcp->tcp_listener); 2513 2514 TCP_STAT(tcp_time_wait_reap); 2515 ASSERT(TCP_IS_DETACHED(tcp)); 2516 2517 /* 2518 * Because they have no upstream client to rebind or tcp_close() 2519 * them later, we axe the connection here and now. 2520 */ 2521 tcp_close_detached(tcp); 2522 } 2523 2524 void 2525 tcp_cleanup(tcp_t *tcp) 2526 { 2527 mblk_t *mp; 2528 char *tcp_iphc; 2529 int tcp_iphc_len; 2530 int tcp_hdr_grown; 2531 tcp_sack_info_t *tcp_sack_info; 2532 conn_t *connp = tcp->tcp_connp; 2533 2534 tcp_bind_hash_remove(tcp); 2535 CL_INET_DISCONNECT(tcp); 2536 tcp_free(tcp); 2537 2538 conn_delete_ire(connp, NULL); 2539 if (connp->conn_flags & IPCL_TCPCONN) { 2540 if (connp->conn_latch != NULL) 2541 IPLATCH_REFRELE(connp->conn_latch); 2542 if (connp->conn_policy != NULL) 2543 IPPH_REFRELE(connp->conn_policy); 2544 } 2545 2546 /* 2547 * Since we will bzero the entire structure, we need to 2548 * remove it and reinsert it in global hash list. We 2549 * know the walkers can't get to this conn because we 2550 * had set CONDEMNED flag earlier and checked reference 2551 * under conn_lock so walker won't pick it and when we 2552 * go the ipcl_globalhash_remove() below, no walker 2553 * can get to it. 2554 */ 2555 ipcl_globalhash_remove(connp); 2556 2557 /* Save some state */ 2558 mp = tcp->tcp_timercache; 2559 2560 tcp_sack_info = tcp->tcp_sack_info; 2561 tcp_iphc = tcp->tcp_iphc; 2562 tcp_iphc_len = tcp->tcp_iphc_len; 2563 tcp_hdr_grown = tcp->tcp_hdr_grown; 2564 2565 bzero(connp, sizeof (conn_t)); 2566 bzero(tcp, sizeof (tcp_t)); 2567 2568 /* restore the state */ 2569 tcp->tcp_timercache = mp; 2570 2571 tcp->tcp_sack_info = tcp_sack_info; 2572 tcp->tcp_iphc = tcp_iphc; 2573 tcp->tcp_iphc_len = tcp_iphc_len; 2574 tcp->tcp_hdr_grown = tcp_hdr_grown; 2575 2576 2577 tcp->tcp_connp = connp; 2578 2579 connp->conn_tcp = tcp; 2580 connp->conn_flags = IPCL_TCPCONN; 2581 connp->conn_state_flags = CONN_INCIPIENT; 2582 connp->conn_ulp = IPPROTO_TCP; 2583 connp->conn_ref = 1; 2584 2585 ipcl_globalhash_insert(connp); 2586 } 2587 2588 /* 2589 * Blows away all tcps whose TIME_WAIT has expired. List traversal 2590 * is done forwards from the head. 2591 */ 2592 /* ARGSUSED */ 2593 void 2594 tcp_time_wait_collector(void *arg) 2595 { 2596 tcp_t *tcp; 2597 clock_t now; 2598 mblk_t *mp; 2599 conn_t *connp; 2600 kmutex_t *lock; 2601 2602 squeue_t *sqp = (squeue_t *)arg; 2603 tcp_squeue_priv_t *tcp_time_wait = 2604 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 2605 2606 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2607 tcp_time_wait->tcp_time_wait_tid = 0; 2608 2609 if (tcp_time_wait->tcp_free_list != NULL && 2610 tcp_time_wait->tcp_free_list->tcp_in_free_list == B_TRUE) { 2611 TCP_STAT(tcp_freelist_cleanup); 2612 while ((tcp = tcp_time_wait->tcp_free_list) != NULL) { 2613 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 2614 CONN_DEC_REF(tcp->tcp_connp); 2615 } 2616 } 2617 2618 /* 2619 * In order to reap time waits reliably, we should use a 2620 * source of time that is not adjustable by the user -- hence 2621 * the call to ddi_get_lbolt(). 2622 */ 2623 now = ddi_get_lbolt(); 2624 while ((tcp = tcp_time_wait->tcp_time_wait_head) != NULL) { 2625 /* 2626 * Compare times using modular arithmetic, since 2627 * lbolt can wrapover. 2628 */ 2629 if ((now - tcp->tcp_time_wait_expire) < 0) { 2630 break; 2631 } 2632 2633 tcp_time_wait_remove(tcp, tcp_time_wait); 2634 2635 connp = tcp->tcp_connp; 2636 ASSERT(connp->conn_fanout != NULL); 2637 lock = &connp->conn_fanout->connf_lock; 2638 /* 2639 * This is essentially a TW reclaim fastpath where timewait 2640 * collector checks under fanout lock (so no one else can 2641 * get access to the conn_t) that refcnt is 2 i.e. one for 2642 * TCP and one for the classifier hash list. If ref count 2643 * is indeed 2, we can just remove the conn under lock and 2644 * avoid cleaning up the conn under squeue. This gives us 2645 * improved performance. Also please see the comments in 2646 * tcp_closei_local regarding the refcnt logic. 2647 * 2648 * Since we are holding the tcp_time_wait_lock, its better 2649 * not to block on the fanout_lock because other connections 2650 * can't add themselves to time_wait list. So we do a 2651 * tryenter instead of mutex_enter. 2652 */ 2653 if (mutex_tryenter(lock)) { 2654 mutex_enter(&connp->conn_lock); 2655 if (connp->conn_ref == 2) { 2656 ipcl_hash_remove_locked(connp, 2657 connp->conn_fanout); 2658 /* 2659 * Set the CONDEMNED flag now itself so that 2660 * the refcnt cannot increase due to any 2661 * walker. But we have still not cleaned up 2662 * conn_ire_cache. This is still ok since 2663 * we are going to clean it up in tcp_cleanup 2664 * immediately and any interface unplumb 2665 * thread will wait till the ire is blown away 2666 */ 2667 connp->conn_state_flags |= CONN_CONDEMNED; 2668 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2669 mutex_exit(lock); 2670 mutex_exit(&connp->conn_lock); 2671 tcp_cleanup(tcp); 2672 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2673 tcp->tcp_time_wait_next = 2674 tcp_time_wait->tcp_free_list; 2675 tcp_time_wait->tcp_free_list = tcp; 2676 continue; 2677 } else { 2678 CONN_INC_REF_LOCKED(connp); 2679 mutex_exit(lock); 2680 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2681 mutex_exit(&connp->conn_lock); 2682 /* 2683 * We can reuse the closemp here since conn has 2684 * detached (otherwise we wouldn't even be in 2685 * time_wait list). 2686 */ 2687 mp = &tcp->tcp_closemp; 2688 squeue_fill(connp->conn_sqp, mp, 2689 tcp_timewait_output, connp, 2690 SQTAG_TCP_TIMEWAIT); 2691 } 2692 } else { 2693 mutex_enter(&connp->conn_lock); 2694 CONN_INC_REF_LOCKED(connp); 2695 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2696 mutex_exit(&connp->conn_lock); 2697 /* 2698 * We can reuse the closemp here since conn has 2699 * detached (otherwise we wouldn't even be in 2700 * time_wait list). 2701 */ 2702 mp = &tcp->tcp_closemp; 2703 squeue_fill(connp->conn_sqp, mp, 2704 tcp_timewait_output, connp, 0); 2705 } 2706 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 2707 } 2708 2709 if (tcp_time_wait->tcp_free_list != NULL) 2710 tcp_time_wait->tcp_free_list->tcp_in_free_list = B_TRUE; 2711 2712 tcp_time_wait->tcp_time_wait_tid = 2713 timeout(tcp_time_wait_collector, sqp, TCP_TIME_WAIT_DELAY); 2714 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 2715 } 2716 2717 /* 2718 * Reply to a clients T_CONN_RES TPI message. This function 2719 * is used only for TLI/XTI listener. Sockfs sends T_CONN_RES 2720 * on the acceptor STREAM and processed in tcp_wput_accept(). 2721 * Read the block comment on top of tcp_conn_request(). 2722 */ 2723 static void 2724 tcp_accept(tcp_t *listener, mblk_t *mp) 2725 { 2726 tcp_t *acceptor; 2727 tcp_t *eager; 2728 tcp_t *tcp; 2729 struct T_conn_res *tcr; 2730 t_uscalar_t acceptor_id; 2731 t_scalar_t seqnum; 2732 mblk_t *opt_mp = NULL; /* T_OPTMGMT_REQ messages */ 2733 mblk_t *ok_mp; 2734 mblk_t *mp1; 2735 2736 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 2737 tcp_err_ack(listener, mp, TPROTO, 0); 2738 return; 2739 } 2740 tcr = (struct T_conn_res *)mp->b_rptr; 2741 2742 /* 2743 * Under ILP32 the stream head points tcr->ACCEPTOR_id at the 2744 * read side queue of the streams device underneath us i.e. the 2745 * read side queue of 'ip'. Since we can't deference QUEUE_ptr we 2746 * look it up in the queue_hash. Under LP64 it sends down the 2747 * minor_t of the accepting endpoint. 2748 * 2749 * Once the acceptor/eager are modified (in tcp_accept_swap) the 2750 * fanout hash lock is held. 2751 * This prevents any thread from entering the acceptor queue from 2752 * below (since it has not been hard bound yet i.e. any inbound 2753 * packets will arrive on the listener or default tcp queue and 2754 * go through tcp_lookup). 2755 * The CONN_INC_REF will prevent the acceptor from closing. 2756 * 2757 * XXX It is still possible for a tli application to send down data 2758 * on the accepting stream while another thread calls t_accept. 2759 * This should not be a problem for well-behaved applications since 2760 * the T_OK_ACK is sent after the queue swapping is completed. 2761 * 2762 * If the accepting fd is the same as the listening fd, avoid 2763 * queue hash lookup since that will return an eager listener in a 2764 * already established state. 2765 */ 2766 acceptor_id = tcr->ACCEPTOR_id; 2767 mutex_enter(&listener->tcp_eager_lock); 2768 if (listener->tcp_acceptor_id == acceptor_id) { 2769 eager = listener->tcp_eager_next_q; 2770 /* only count how many T_CONN_INDs so don't count q0 */ 2771 if ((listener->tcp_conn_req_cnt_q != 1) || 2772 (eager->tcp_conn_req_seqnum != tcr->SEQ_number)) { 2773 mutex_exit(&listener->tcp_eager_lock); 2774 tcp_err_ack(listener, mp, TBADF, 0); 2775 return; 2776 } 2777 if (listener->tcp_conn_req_cnt_q0 != 0) { 2778 /* Throw away all the eagers on q0. */ 2779 tcp_eager_cleanup(listener, 1); 2780 } 2781 if (listener->tcp_syn_defense) { 2782 listener->tcp_syn_defense = B_FALSE; 2783 if (listener->tcp_ip_addr_cache != NULL) { 2784 kmem_free(listener->tcp_ip_addr_cache, 2785 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 2786 listener->tcp_ip_addr_cache = NULL; 2787 } 2788 } 2789 /* 2790 * Transfer tcp_conn_req_max to the eager so that when 2791 * a disconnect occurs we can revert the endpoint to the 2792 * listen state. 2793 */ 2794 eager->tcp_conn_req_max = listener->tcp_conn_req_max; 2795 ASSERT(listener->tcp_conn_req_cnt_q0 == 0); 2796 /* 2797 * Get a reference on the acceptor just like the 2798 * tcp_acceptor_hash_lookup below. 2799 */ 2800 acceptor = listener; 2801 CONN_INC_REF(acceptor->tcp_connp); 2802 } else { 2803 acceptor = tcp_acceptor_hash_lookup(acceptor_id); 2804 if (acceptor == NULL) { 2805 if (listener->tcp_debug) { 2806 (void) strlog(TCP_MODULE_ID, 0, 1, 2807 SL_ERROR|SL_TRACE, 2808 "tcp_accept: did not find acceptor 0x%x\n", 2809 acceptor_id); 2810 } 2811 mutex_exit(&listener->tcp_eager_lock); 2812 tcp_err_ack(listener, mp, TPROVMISMATCH, 0); 2813 return; 2814 } 2815 /* 2816 * Verify acceptor state. The acceptable states for an acceptor 2817 * include TCPS_IDLE and TCPS_BOUND. 2818 */ 2819 switch (acceptor->tcp_state) { 2820 case TCPS_IDLE: 2821 /* FALLTHRU */ 2822 case TCPS_BOUND: 2823 break; 2824 default: 2825 CONN_DEC_REF(acceptor->tcp_connp); 2826 mutex_exit(&listener->tcp_eager_lock); 2827 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2828 return; 2829 } 2830 } 2831 2832 /* The listener must be in TCPS_LISTEN */ 2833 if (listener->tcp_state != TCPS_LISTEN) { 2834 CONN_DEC_REF(acceptor->tcp_connp); 2835 mutex_exit(&listener->tcp_eager_lock); 2836 tcp_err_ack(listener, mp, TOUTSTATE, 0); 2837 return; 2838 } 2839 2840 /* 2841 * Rendezvous with an eager connection request packet hanging off 2842 * 'tcp' that has the 'seqnum' tag. We tagged the detached open 2843 * tcp structure when the connection packet arrived in 2844 * tcp_conn_request(). 2845 */ 2846 seqnum = tcr->SEQ_number; 2847 eager = listener; 2848 do { 2849 eager = eager->tcp_eager_next_q; 2850 if (eager == NULL) { 2851 CONN_DEC_REF(acceptor->tcp_connp); 2852 mutex_exit(&listener->tcp_eager_lock); 2853 tcp_err_ack(listener, mp, TBADSEQ, 0); 2854 return; 2855 } 2856 } while (eager->tcp_conn_req_seqnum != seqnum); 2857 mutex_exit(&listener->tcp_eager_lock); 2858 2859 /* 2860 * At this point, both acceptor and listener have 2 ref 2861 * that they begin with. Acceptor has one additional ref 2862 * we placed in lookup while listener has 3 additional 2863 * ref for being behind the squeue (tcp_accept() is 2864 * done on listener's squeue); being in classifier hash; 2865 * and eager's ref on listener. 2866 */ 2867 ASSERT(listener->tcp_connp->conn_ref >= 5); 2868 ASSERT(acceptor->tcp_connp->conn_ref >= 3); 2869 2870 /* 2871 * The eager at this point is set in its own squeue and 2872 * could easily have been killed (tcp_accept_finish will 2873 * deal with that) because of a TH_RST so we can only 2874 * ASSERT for a single ref. 2875 */ 2876 ASSERT(eager->tcp_connp->conn_ref >= 1); 2877 2878 /* Pre allocate the stroptions mblk also */ 2879 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 2880 if (opt_mp == NULL) { 2881 CONN_DEC_REF(acceptor->tcp_connp); 2882 CONN_DEC_REF(eager->tcp_connp); 2883 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2884 return; 2885 } 2886 DB_TYPE(opt_mp) = M_SETOPTS; 2887 opt_mp->b_wptr += sizeof (struct stroptions); 2888 2889 /* 2890 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 2891 * from listener to acceptor. The message is chained on opt_mp 2892 * which will be sent onto eager's squeue. 2893 */ 2894 if (listener->tcp_bound_if != 0) { 2895 /* allocate optmgmt req */ 2896 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2897 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 2898 sizeof (int)); 2899 if (mp1 != NULL) 2900 linkb(opt_mp, mp1); 2901 } 2902 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 2903 uint_t on = 1; 2904 2905 /* allocate optmgmt req */ 2906 mp1 = tcp_setsockopt_mp(IPPROTO_IPV6, 2907 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 2908 if (mp1 != NULL) 2909 linkb(opt_mp, mp1); 2910 } 2911 2912 /* Re-use mp1 to hold a copy of mp, in case reallocb fails */ 2913 if ((mp1 = copymsg(mp)) == NULL) { 2914 CONN_DEC_REF(acceptor->tcp_connp); 2915 CONN_DEC_REF(eager->tcp_connp); 2916 freemsg(opt_mp); 2917 tcp_err_ack(listener, mp, TSYSERR, ENOMEM); 2918 return; 2919 } 2920 2921 tcr = (struct T_conn_res *)mp1->b_rptr; 2922 2923 /* 2924 * This is an expanded version of mi_tpi_ok_ack_alloc() 2925 * which allocates a larger mblk and appends the new 2926 * local address to the ok_ack. The address is copied by 2927 * soaccept() for getsockname(). 2928 */ 2929 { 2930 int extra; 2931 2932 extra = (eager->tcp_family == AF_INET) ? 2933 sizeof (sin_t) : sizeof (sin6_t); 2934 2935 /* 2936 * Try to re-use mp, if possible. Otherwise, allocate 2937 * an mblk and return it as ok_mp. In any case, mp 2938 * is no longer usable upon return. 2939 */ 2940 if ((ok_mp = mi_tpi_ok_ack_alloc_extra(mp, extra)) == NULL) { 2941 CONN_DEC_REF(acceptor->tcp_connp); 2942 CONN_DEC_REF(eager->tcp_connp); 2943 freemsg(opt_mp); 2944 /* Original mp has been freed by now, so use mp1 */ 2945 tcp_err_ack(listener, mp1, TSYSERR, ENOMEM); 2946 return; 2947 } 2948 2949 mp = NULL; /* We should never use mp after this point */ 2950 2951 switch (extra) { 2952 case sizeof (sin_t): { 2953 sin_t *sin = (sin_t *)ok_mp->b_wptr; 2954 2955 ok_mp->b_wptr += extra; 2956 sin->sin_family = AF_INET; 2957 sin->sin_port = eager->tcp_lport; 2958 sin->sin_addr.s_addr = 2959 eager->tcp_ipha->ipha_src; 2960 break; 2961 } 2962 case sizeof (sin6_t): { 2963 sin6_t *sin6 = (sin6_t *)ok_mp->b_wptr; 2964 2965 ok_mp->b_wptr += extra; 2966 sin6->sin6_family = AF_INET6; 2967 sin6->sin6_port = eager->tcp_lport; 2968 if (eager->tcp_ipversion == IPV4_VERSION) { 2969 sin6->sin6_flowinfo = 0; 2970 IN6_IPADDR_TO_V4MAPPED( 2971 eager->tcp_ipha->ipha_src, 2972 &sin6->sin6_addr); 2973 } else { 2974 ASSERT(eager->tcp_ip6h != NULL); 2975 sin6->sin6_flowinfo = 2976 eager->tcp_ip6h->ip6_vcf & 2977 ~IPV6_VERS_AND_FLOW_MASK; 2978 sin6->sin6_addr = 2979 eager->tcp_ip6h->ip6_src; 2980 } 2981 break; 2982 } 2983 default: 2984 break; 2985 } 2986 ASSERT(ok_mp->b_wptr <= ok_mp->b_datap->db_lim); 2987 } 2988 2989 /* 2990 * If there are no options we know that the T_CONN_RES will 2991 * succeed. However, we can't send the T_OK_ACK upstream until 2992 * the tcp_accept_swap is done since it would be dangerous to 2993 * let the application start using the new fd prior to the swap. 2994 */ 2995 tcp_accept_swap(listener, acceptor, eager); 2996 2997 /* 2998 * tcp_accept_swap unlinks eager from listener but does not drop 2999 * the eager's reference on the listener. 3000 */ 3001 ASSERT(eager->tcp_listener == NULL); 3002 ASSERT(listener->tcp_connp->conn_ref >= 5); 3003 3004 /* 3005 * The eager is now associated with its own queue. Insert in 3006 * the hash so that the connection can be reused for a future 3007 * T_CONN_RES. 3008 */ 3009 tcp_acceptor_hash_insert(acceptor_id, eager); 3010 3011 /* 3012 * We now do the processing of options with T_CONN_RES. 3013 * We delay till now since we wanted to have queue to pass to 3014 * option processing routines that points back to the right 3015 * instance structure which does not happen until after 3016 * tcp_accept_swap(). 3017 * 3018 * Note: 3019 * The sanity of the logic here assumes that whatever options 3020 * are appropriate to inherit from listner=>eager are done 3021 * before this point, and whatever were to be overridden (or not) 3022 * in transfer logic from eager=>acceptor in tcp_accept_swap(). 3023 * [ Warning: acceptor endpoint can have T_OPTMGMT_REQ done to it 3024 * before its ACCEPTOR_id comes down in T_CONN_RES ] 3025 * This may not be true at this point in time but can be fixed 3026 * independently. This option processing code starts with 3027 * the instantiated acceptor instance and the final queue at 3028 * this point. 3029 */ 3030 3031 if (tcr->OPT_length != 0) { 3032 /* Options to process */ 3033 int t_error = 0; 3034 int sys_error = 0; 3035 int do_disconnect = 0; 3036 3037 if (tcp_conprim_opt_process(eager, mp1, 3038 &do_disconnect, &t_error, &sys_error) < 0) { 3039 eager->tcp_accept_error = 1; 3040 if (do_disconnect) { 3041 /* 3042 * An option failed which does not allow 3043 * connection to be accepted. 3044 * 3045 * We allow T_CONN_RES to succeed and 3046 * put a T_DISCON_IND on the eager queue. 3047 */ 3048 ASSERT(t_error == 0 && sys_error == 0); 3049 eager->tcp_send_discon_ind = 1; 3050 } else { 3051 ASSERT(t_error != 0); 3052 freemsg(ok_mp); 3053 /* 3054 * Original mp was either freed or set 3055 * to ok_mp above, so use mp1 instead. 3056 */ 3057 tcp_err_ack(listener, mp1, t_error, sys_error); 3058 goto finish; 3059 } 3060 } 3061 /* 3062 * Most likely success in setting options (except if 3063 * eager->tcp_send_discon_ind set). 3064 * mp1 option buffer represented by OPT_length/offset 3065 * potentially modified and contains results of setting 3066 * options at this point 3067 */ 3068 } 3069 3070 /* We no longer need mp1, since all options processing has passed */ 3071 freemsg(mp1); 3072 3073 putnext(listener->tcp_rq, ok_mp); 3074 3075 mutex_enter(&listener->tcp_eager_lock); 3076 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 3077 tcp_t *tail; 3078 mblk_t *conn_ind; 3079 3080 /* 3081 * This path should not be executed if listener and 3082 * acceptor streams are the same. 3083 */ 3084 ASSERT(listener != acceptor); 3085 3086 tcp = listener->tcp_eager_prev_q0; 3087 /* 3088 * listener->tcp_eager_prev_q0 points to the TAIL of the 3089 * deferred T_conn_ind queue. We need to get to the head of 3090 * the queue in order to send up T_conn_ind the same order as 3091 * how the 3WHS is completed. 3092 */ 3093 while (tcp != listener) { 3094 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 3095 break; 3096 else 3097 tcp = tcp->tcp_eager_prev_q0; 3098 } 3099 ASSERT(tcp != listener); 3100 conn_ind = tcp->tcp_conn.tcp_eager_conn_ind; 3101 ASSERT(conn_ind != NULL); 3102 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3103 3104 /* Move from q0 to q */ 3105 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 3106 listener->tcp_conn_req_cnt_q0--; 3107 listener->tcp_conn_req_cnt_q++; 3108 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 3109 tcp->tcp_eager_prev_q0; 3110 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 3111 tcp->tcp_eager_next_q0; 3112 tcp->tcp_eager_prev_q0 = NULL; 3113 tcp->tcp_eager_next_q0 = NULL; 3114 tcp->tcp_conn_def_q0 = B_FALSE; 3115 3116 /* 3117 * Insert at end of the queue because sockfs sends 3118 * down T_CONN_RES in chronological order. Leaving 3119 * the older conn indications at front of the queue 3120 * helps reducing search time. 3121 */ 3122 tail = listener->tcp_eager_last_q; 3123 if (tail != NULL) 3124 tail->tcp_eager_next_q = tcp; 3125 else 3126 listener->tcp_eager_next_q = tcp; 3127 listener->tcp_eager_last_q = tcp; 3128 tcp->tcp_eager_next_q = NULL; 3129 mutex_exit(&listener->tcp_eager_lock); 3130 putnext(tcp->tcp_rq, conn_ind); 3131 } else { 3132 mutex_exit(&listener->tcp_eager_lock); 3133 } 3134 3135 /* 3136 * Done with the acceptor - free it 3137 * 3138 * Note: from this point on, no access to listener should be made 3139 * as listener can be equal to acceptor. 3140 */ 3141 finish: 3142 ASSERT(acceptor->tcp_detached); 3143 acceptor->tcp_rq = tcp_g_q; 3144 acceptor->tcp_wq = WR(tcp_g_q); 3145 (void) tcp_clean_death(acceptor, 0, 2); 3146 CONN_DEC_REF(acceptor->tcp_connp); 3147 3148 /* 3149 * In case we already received a FIN we have to make tcp_rput send 3150 * the ordrel_ind. This will also send up a window update if the window 3151 * has opened up. 3152 * 3153 * In the normal case of a successful connection acceptance 3154 * we give the O_T_BIND_REQ to the read side put procedure as an 3155 * indication that this was just accepted. This tells tcp_rput to 3156 * pass up any data queued in tcp_rcv_list. 3157 * 3158 * In the fringe case where options sent with T_CONN_RES failed and 3159 * we required, we would be indicating a T_DISCON_IND to blow 3160 * away this connection. 3161 */ 3162 3163 /* 3164 * XXX: we currently have a problem if XTI application closes the 3165 * acceptor stream in between. This problem exists in on10-gate also 3166 * and is well know but nothing can be done short of major rewrite 3167 * to fix it. Now it is possible to take care of it by assigning TLI/XTI 3168 * eager same squeue as listener (we can distinguish non socket 3169 * listeners at the time of handling a SYN in tcp_conn_request) 3170 * and do most of the work that tcp_accept_finish does here itself 3171 * and then get behind the acceptor squeue to access the acceptor 3172 * queue. 3173 */ 3174 /* 3175 * We already have a ref on tcp so no need to do one before squeue_fill 3176 */ 3177 squeue_fill(eager->tcp_connp->conn_sqp, opt_mp, 3178 tcp_accept_finish, eager->tcp_connp, SQTAG_TCP_ACCEPT_FINISH); 3179 } 3180 3181 /* 3182 * Swap information between the eager and acceptor for a TLI/XTI client. 3183 * The sockfs accept is done on the acceptor stream and control goes 3184 * through tcp_wput_accept() and tcp_accept()/tcp_accept_swap() is not 3185 * called. In either case, both the eager and listener are in their own 3186 * perimeter (squeue) and the code has to deal with potential race. 3187 * 3188 * See the block comment on top of tcp_accept() and tcp_wput_accept(). 3189 */ 3190 static void 3191 tcp_accept_swap(tcp_t *listener, tcp_t *acceptor, tcp_t *eager) 3192 { 3193 conn_t *econnp, *aconnp; 3194 3195 ASSERT(eager->tcp_rq == listener->tcp_rq); 3196 ASSERT(eager->tcp_detached && !acceptor->tcp_detached); 3197 ASSERT(!eager->tcp_hard_bound); 3198 ASSERT(!TCP_IS_SOCKET(acceptor)); 3199 ASSERT(!TCP_IS_SOCKET(eager)); 3200 ASSERT(!TCP_IS_SOCKET(listener)); 3201 3202 acceptor->tcp_detached = B_TRUE; 3203 /* 3204 * To permit stream re-use by TLI/XTI, the eager needs a copy of 3205 * the acceptor id. 3206 */ 3207 eager->tcp_acceptor_id = acceptor->tcp_acceptor_id; 3208 3209 /* remove eager from listen list... */ 3210 mutex_enter(&listener->tcp_eager_lock); 3211 tcp_eager_unlink(eager); 3212 ASSERT(eager->tcp_eager_next_q == NULL && 3213 eager->tcp_eager_last_q == NULL); 3214 ASSERT(eager->tcp_eager_next_q0 == NULL && 3215 eager->tcp_eager_prev_q0 == NULL); 3216 mutex_exit(&listener->tcp_eager_lock); 3217 eager->tcp_rq = acceptor->tcp_rq; 3218 eager->tcp_wq = acceptor->tcp_wq; 3219 3220 econnp = eager->tcp_connp; 3221 aconnp = acceptor->tcp_connp; 3222 3223 eager->tcp_rq->q_ptr = econnp; 3224 eager->tcp_wq->q_ptr = econnp; 3225 eager->tcp_detached = B_FALSE; 3226 3227 ASSERT(eager->tcp_ack_tid == 0); 3228 3229 econnp->conn_dev = aconnp->conn_dev; 3230 eager->tcp_cred = econnp->conn_cred = aconnp->conn_cred; 3231 econnp->conn_zoneid = aconnp->conn_zoneid; 3232 aconnp->conn_cred = NULL; 3233 3234 /* Do the IPC initialization */ 3235 CONN_INC_REF(econnp); 3236 3237 econnp->conn_multicast_loop = aconnp->conn_multicast_loop; 3238 econnp->conn_af_isv6 = aconnp->conn_af_isv6; 3239 econnp->conn_pkt_isv6 = aconnp->conn_pkt_isv6; 3240 econnp->conn_ulp = aconnp->conn_ulp; 3241 3242 /* Done with old IPC. Drop its ref on its connp */ 3243 CONN_DEC_REF(aconnp); 3244 } 3245 3246 3247 /* 3248 * Adapt to the information, such as rtt and rtt_sd, provided from the 3249 * ire cached in conn_cache_ire. If no ire cached, do a ire lookup. 3250 * 3251 * Checks for multicast and broadcast destination address. 3252 * Returns zero on failure; non-zero if ok. 3253 * 3254 * Note that the MSS calculation here is based on the info given in 3255 * the IRE. We do not do any calculation based on TCP options. They 3256 * will be handled in tcp_rput_other() and tcp_rput_data() when TCP 3257 * knows which options to use. 3258 * 3259 * Note on how TCP gets its parameters for a connection. 3260 * 3261 * When a tcp_t structure is allocated, it gets all the default parameters. 3262 * In tcp_adapt_ire(), it gets those metric parameters, like rtt, rtt_sd, 3263 * spipe, rpipe, ... from the route metrics. Route metric overrides the 3264 * default. But if there is an associated tcp_host_param, it will override 3265 * the metrics. 3266 * 3267 * An incoming SYN with a multicast or broadcast destination address, is dropped 3268 * in 1 of 2 places. 3269 * 3270 * 1. If the packet was received over the wire it is dropped in 3271 * ip_rput_process_broadcast() 3272 * 3273 * 2. If the packet was received through internal IP loopback, i.e. the packet 3274 * was generated and received on the same machine, it is dropped in 3275 * ip_wput_local() 3276 * 3277 * An incoming SYN with a multicast or broadcast source address is always 3278 * dropped in tcp_adapt_ire. The same logic in tcp_adapt_ire also serves to 3279 * reject an attempt to connect to a broadcast or multicast (destination) 3280 * address. 3281 */ 3282 static int 3283 tcp_adapt_ire(tcp_t *tcp, mblk_t *ire_mp) 3284 { 3285 tcp_hsp_t *hsp; 3286 ire_t *ire; 3287 ire_t *sire = NULL; 3288 iulp_t *ire_uinfo; 3289 uint32_t mss_max; 3290 uint32_t mss; 3291 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 3292 conn_t *connp = tcp->tcp_connp; 3293 boolean_t ire_cacheable = B_FALSE; 3294 zoneid_t zoneid = connp->conn_zoneid; 3295 ill_t *ill = NULL; 3296 boolean_t incoming = (ire_mp == NULL); 3297 3298 ASSERT(connp->conn_ire_cache == NULL); 3299 3300 if (tcp->tcp_ipversion == IPV4_VERSION) { 3301 3302 if (CLASSD(tcp->tcp_connp->conn_rem)) { 3303 BUMP_MIB(&ip_mib, ipInDiscards); 3304 return (0); 3305 } 3306 3307 ire = ire_cache_lookup(tcp->tcp_connp->conn_rem, zoneid); 3308 if (ire != NULL) { 3309 ire_cacheable = B_TRUE; 3310 ire_uinfo = (ire_mp != NULL) ? 3311 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 3312 &ire->ire_uinfo; 3313 3314 } else { 3315 if (ire_mp == NULL) { 3316 ire = ire_ftable_lookup( 3317 tcp->tcp_connp->conn_rem, 3318 0, 0, 0, NULL, &sire, zoneid, 0, 3319 (MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT)); 3320 if (ire == NULL) 3321 return (0); 3322 ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : 3323 &ire->ire_uinfo; 3324 } else { 3325 ire = (ire_t *)ire_mp->b_rptr; 3326 ire_uinfo = 3327 &((ire_t *)ire_mp->b_rptr)->ire_uinfo; 3328 } 3329 } 3330 ASSERT(ire != NULL); 3331 ASSERT(ire_uinfo != NULL); 3332 3333 if ((ire->ire_src_addr == INADDR_ANY) || 3334 (ire->ire_type & IRE_BROADCAST)) { 3335 /* 3336 * ire->ire_mp is non null when ire_mp passed in is used 3337 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 3338 */ 3339 if (ire->ire_mp == NULL) 3340 ire_refrele(ire); 3341 if (sire != NULL) 3342 ire_refrele(sire); 3343 return (0); 3344 } 3345 3346 if (tcp->tcp_ipha->ipha_src == INADDR_ANY) { 3347 ipaddr_t src_addr; 3348 3349 /* 3350 * ip_bind_connected() has stored the correct source 3351 * address in conn_src. 3352 */ 3353 src_addr = tcp->tcp_connp->conn_src; 3354 tcp->tcp_ipha->ipha_src = src_addr; 3355 /* 3356 * Copy of the src addr. in tcp_t is needed 3357 * for the lookup funcs. 3358 */ 3359 IN6_IPADDR_TO_V4MAPPED(src_addr, &tcp->tcp_ip_src_v6); 3360 } 3361 /* 3362 * Set the fragment bit so that IP will tell us if the MTU 3363 * should change. IP tells us the latest setting of 3364 * ip_path_mtu_discovery through ire_frag_flag. 3365 */ 3366 if (ip_path_mtu_discovery) { 3367 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 3368 htons(IPH_DF); 3369 } 3370 tcp->tcp_localnet = (ire->ire_gateway_addr == 0); 3371 } else { 3372 /* 3373 * For incoming connection ire_mp = NULL 3374 * For outgoing connection ire_mp != NULL 3375 * Technically we should check conn_incoming_ill 3376 * when ire_mp is NULL and conn_outgoing_ill when 3377 * ire_mp is non-NULL. But this is performance 3378 * critical path and for IPV*_BOUND_IF, outgoing 3379 * and incoming ill are always set to the same value. 3380 */ 3381 ill_t *dst_ill = NULL; 3382 ipif_t *dst_ipif = NULL; 3383 int match_flags = MATCH_IRE_RECURSIVE | MATCH_IRE_DEFAULT; 3384 3385 ASSERT(connp->conn_outgoing_ill == connp->conn_incoming_ill); 3386 3387 if (connp->conn_outgoing_ill != NULL) { 3388 /* Outgoing or incoming path */ 3389 int err; 3390 3391 dst_ill = conn_get_held_ill(connp, 3392 &connp->conn_outgoing_ill, &err); 3393 if (err == ILL_LOOKUP_FAILED || dst_ill == NULL) { 3394 ip1dbg(("tcp_adapt_ire: ill_lookup failed\n")); 3395 return (0); 3396 } 3397 match_flags |= MATCH_IRE_ILL; 3398 dst_ipif = dst_ill->ill_ipif; 3399 } 3400 ire = ire_ctable_lookup_v6(&tcp->tcp_connp->conn_remv6, 3401 0, 0, dst_ipif, zoneid, match_flags); 3402 3403 if (ire != NULL) { 3404 ire_cacheable = B_TRUE; 3405 ire_uinfo = (ire_mp != NULL) ? 3406 &((ire_t *)ire_mp->b_rptr)->ire_uinfo: 3407 &ire->ire_uinfo; 3408 } else { 3409 if (ire_mp == NULL) { 3410 ire = ire_ftable_lookup_v6( 3411 &tcp->tcp_connp->conn_remv6, 3412 0, 0, 0, dst_ipif, &sire, zoneid, 3413 0, match_flags); 3414 if (ire == NULL) { 3415 if (dst_ill != NULL) 3416 ill_refrele(dst_ill); 3417 return (0); 3418 } 3419 ire_uinfo = (sire != NULL) ? &sire->ire_uinfo : 3420 &ire->ire_uinfo; 3421 } else { 3422 ire = (ire_t *)ire_mp->b_rptr; 3423 ire_uinfo = 3424 &((ire_t *)ire_mp->b_rptr)->ire_uinfo; 3425 } 3426 } 3427 if (dst_ill != NULL) 3428 ill_refrele(dst_ill); 3429 3430 ASSERT(ire != NULL); 3431 ASSERT(ire_uinfo != NULL); 3432 3433 if (IN6_IS_ADDR_UNSPECIFIED(&ire->ire_src_addr_v6) || 3434 IN6_IS_ADDR_MULTICAST(&ire->ire_addr_v6)) { 3435 /* 3436 * ire->ire_mp is non null when ire_mp passed in is used 3437 * ire->ire_mp is set in ip_bind_insert_ire[_v6](). 3438 */ 3439 if (ire->ire_mp == NULL) 3440 ire_refrele(ire); 3441 if (sire != NULL) 3442 ire_refrele(sire); 3443 return (0); 3444 } 3445 3446 if (IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 3447 in6_addr_t src_addr; 3448 3449 /* 3450 * ip_bind_connected_v6() has stored the correct source 3451 * address per IPv6 addr. selection policy in 3452 * conn_src_v6. 3453 */ 3454 src_addr = tcp->tcp_connp->conn_srcv6; 3455 3456 tcp->tcp_ip6h->ip6_src = src_addr; 3457 /* 3458 * Copy of the src addr. in tcp_t is needed 3459 * for the lookup funcs. 3460 */ 3461 tcp->tcp_ip_src_v6 = src_addr; 3462 ASSERT(IN6_ARE_ADDR_EQUAL(&tcp->tcp_ip6h->ip6_src, 3463 &connp->conn_srcv6)); 3464 } 3465 tcp->tcp_localnet = 3466 IN6_IS_ADDR_UNSPECIFIED(&ire->ire_gateway_addr_v6); 3467 } 3468 3469 /* 3470 * This allows applications to fail quickly when connections are made 3471 * to dead hosts. Hosts can be labeled dead by adding a reject route 3472 * with both the RTF_REJECT and RTF_PRIVATE flags set. 3473 */ 3474 if ((ire->ire_flags & RTF_REJECT) && 3475 (ire->ire_flags & RTF_PRIVATE)) 3476 goto error; 3477 3478 /* 3479 * Make use of the cached rtt and rtt_sd values to calculate the 3480 * initial RTO. Note that they are already initialized in 3481 * tcp_init_values(). 3482 */ 3483 if (ire_uinfo->iulp_rtt != 0) { 3484 clock_t rto; 3485 3486 tcp->tcp_rtt_sa = ire_uinfo->iulp_rtt; 3487 tcp->tcp_rtt_sd = ire_uinfo->iulp_rtt_sd; 3488 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 3489 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5); 3490 3491 if (rto > tcp_rexmit_interval_max) { 3492 tcp->tcp_rto = tcp_rexmit_interval_max; 3493 } else if (rto < tcp_rexmit_interval_min) { 3494 tcp->tcp_rto = tcp_rexmit_interval_min; 3495 } else { 3496 tcp->tcp_rto = rto; 3497 } 3498 } 3499 if (ire_uinfo->iulp_ssthresh != 0) 3500 tcp->tcp_cwnd_ssthresh = ire_uinfo->iulp_ssthresh; 3501 else 3502 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 3503 if (ire_uinfo->iulp_spipe > 0) { 3504 tcp->tcp_xmit_hiwater = MIN(ire_uinfo->iulp_spipe, 3505 tcp_max_buf); 3506 if (tcp_snd_lowat_fraction != 0) 3507 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 3508 tcp_snd_lowat_fraction; 3509 (void) tcp_maxpsz_set(tcp, B_TRUE); 3510 } 3511 /* 3512 * Note that up till now, acceptor always inherits receive 3513 * window from the listener. But if there is a metrics associated 3514 * with a host, we should use that instead of inheriting it from 3515 * listener. Thus we need to pass this info back to the caller. 3516 */ 3517 if (ire_uinfo->iulp_rpipe > 0) { 3518 tcp->tcp_rwnd = MIN(ire_uinfo->iulp_rpipe, tcp_max_buf); 3519 } else { 3520 /* 3521 * For passive open, set tcp_rwnd to 0 so that the caller 3522 * knows that there is no rpipe metric for this connection. 3523 */ 3524 if (tcp_detached) 3525 tcp->tcp_rwnd = 0; 3526 } 3527 if (ire_uinfo->iulp_rtomax > 0) { 3528 tcp->tcp_second_timer_threshold = ire_uinfo->iulp_rtomax; 3529 } 3530 3531 /* 3532 * Use the metric option settings, iulp_tstamp_ok and iulp_wscale_ok, 3533 * only for active open. What this means is that if the other side 3534 * uses timestamp or window scale option, TCP will also use those 3535 * options. That is for passive open. If the application sets a 3536 * large window, window scale is enabled regardless of the value in 3537 * iulp_wscale_ok. This is the behavior since 2.6. So we keep it. 3538 * The only case left in passive open processing is the check for SACK. 3539 * 3540 * For ECN, it should probably be like SACK. But the current 3541 * value is binary, so we treat it like the other cases. The 3542 * metric only controls active open. For passive open, the ndd 3543 * param, tcp_ecn_permitted, controls the behavior. 3544 */ 3545 if (!tcp_detached) { 3546 /* 3547 * The if check means that the following can only be turned 3548 * on by the metrics only IRE, but not off. 3549 */ 3550 if (ire_uinfo->iulp_tstamp_ok) 3551 tcp->tcp_snd_ts_ok = B_TRUE; 3552 if (ire_uinfo->iulp_wscale_ok) 3553 tcp->tcp_snd_ws_ok = B_TRUE; 3554 if (ire_uinfo->iulp_sack == 2) 3555 tcp->tcp_snd_sack_ok = B_TRUE; 3556 if (ire_uinfo->iulp_ecn_ok) 3557 tcp->tcp_ecn_ok = B_TRUE; 3558 } else { 3559 /* 3560 * Passive open. 3561 * 3562 * As above, the if check means that SACK can only be 3563 * turned on by the metric only IRE. 3564 */ 3565 if (ire_uinfo->iulp_sack > 0) { 3566 tcp->tcp_snd_sack_ok = B_TRUE; 3567 } 3568 } 3569 3570 /* 3571 * XXX: Note that currently, ire_max_frag can be as small as 68 3572 * because of PMTUd. So tcp_mss may go to negative if combined 3573 * length of all those options exceeds 28 bytes. But because 3574 * of the tcp_mss_min check below, we may not have a problem if 3575 * tcp_mss_min is of a reasonable value. The default is 1 so 3576 * the negative problem still exists. And the check defeats PMTUd. 3577 * In fact, if PMTUd finds that the MSS should be smaller than 3578 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 3579 * value. 3580 * 3581 * We do not deal with that now. All those problems related to 3582 * PMTUd will be fixed later. 3583 */ 3584 ASSERT(ire->ire_max_frag != 0); 3585 mss = tcp->tcp_if_mtu = ire->ire_max_frag; 3586 if (tcp->tcp_ipp_fields & IPPF_USE_MIN_MTU) { 3587 if (tcp->tcp_ipp_use_min_mtu == IPV6_USE_MIN_MTU_NEVER) { 3588 mss = MIN(mss, IPV6_MIN_MTU); 3589 } 3590 } 3591 3592 /* Sanity check for MSS value. */ 3593 if (tcp->tcp_ipversion == IPV4_VERSION) 3594 mss_max = tcp_mss_max_ipv4; 3595 else 3596 mss_max = tcp_mss_max_ipv6; 3597 3598 if (tcp->tcp_ipversion == IPV6_VERSION && 3599 (ire->ire_frag_flag & IPH_FRAG_HDR)) { 3600 /* 3601 * After receiving an ICMPv6 "packet too big" message with a 3602 * MTU < 1280, and for multirouted IPv6 packets, the IP layer 3603 * will insert a 8-byte fragment header in every packet; we 3604 * reduce the MSS by that amount here. 3605 */ 3606 mss -= sizeof (ip6_frag_t); 3607 } 3608 3609 if (tcp->tcp_ipsec_overhead == 0) 3610 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 3611 3612 mss -= tcp->tcp_ipsec_overhead; 3613 3614 if (mss < tcp_mss_min) 3615 mss = tcp_mss_min; 3616 if (mss > mss_max) 3617 mss = mss_max; 3618 3619 /* Note that this is the maximum MSS, excluding all options. */ 3620 tcp->tcp_mss = mss; 3621 3622 /* 3623 * Initialize the ISS here now that we have the full connection ID. 3624 * The RFC 1948 method of initial sequence number generation requires 3625 * knowledge of the full connection ID before setting the ISS. 3626 */ 3627 3628 tcp_iss_init(tcp); 3629 3630 if (ire->ire_type & (IRE_LOOPBACK | IRE_LOCAL)) 3631 tcp->tcp_loopback = B_TRUE; 3632 3633 if (tcp->tcp_ipversion == IPV4_VERSION) { 3634 hsp = tcp_hsp_lookup(tcp->tcp_remote); 3635 } else { 3636 hsp = tcp_hsp_lookup_ipv6(&tcp->tcp_remote_v6); 3637 } 3638 3639 if (hsp != NULL) { 3640 /* Only modify if we're going to make them bigger */ 3641 if (hsp->tcp_hsp_sendspace > tcp->tcp_xmit_hiwater) { 3642 tcp->tcp_xmit_hiwater = hsp->tcp_hsp_sendspace; 3643 if (tcp_snd_lowat_fraction != 0) 3644 tcp->tcp_xmit_lowater = tcp->tcp_xmit_hiwater / 3645 tcp_snd_lowat_fraction; 3646 } 3647 3648 if (hsp->tcp_hsp_recvspace > tcp->tcp_rwnd) { 3649 tcp->tcp_rwnd = hsp->tcp_hsp_recvspace; 3650 } 3651 3652 /* Copy timestamp flag only for active open */ 3653 if (!tcp_detached) 3654 tcp->tcp_snd_ts_ok = hsp->tcp_hsp_tstamp; 3655 } 3656 3657 if (sire != NULL) 3658 IRE_REFRELE(sire); 3659 3660 /* 3661 * If we got an IRE_CACHE and an ILL, go through their properties; 3662 * otherwise, this is deferred until later when we have an IRE_CACHE. 3663 */ 3664 if (tcp->tcp_loopback || 3665 (ire_cacheable && (ill = ire_to_ill(ire)) != NULL)) { 3666 /* 3667 * For incoming, see if this tcp may be MDT-capable. For 3668 * outgoing, this process has been taken care of through 3669 * tcp_rput_other. 3670 */ 3671 tcp_ire_ill_check(tcp, ire, ill, incoming); 3672 tcp->tcp_ire_ill_check_done = B_TRUE; 3673 } 3674 3675 mutex_enter(&connp->conn_lock); 3676 /* 3677 * Make sure that conn is not marked incipient 3678 * for incoming connections. A blind 3679 * removal of incipient flag is cheaper than 3680 * check and removal. 3681 */ 3682 connp->conn_state_flags &= ~CONN_INCIPIENT; 3683 3684 /* Must not cache forwarding table routes. */ 3685 if (ire_cacheable) { 3686 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 3687 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 3688 connp->conn_ire_cache = ire; 3689 IRE_UNTRACE_REF(ire); 3690 rw_exit(&ire->ire_bucket->irb_lock); 3691 mutex_exit(&connp->conn_lock); 3692 return (1); 3693 } 3694 rw_exit(&ire->ire_bucket->irb_lock); 3695 } 3696 mutex_exit(&connp->conn_lock); 3697 3698 if (ire->ire_mp == NULL) 3699 ire_refrele(ire); 3700 return (1); 3701 3702 error: 3703 if (ire->ire_mp == NULL) 3704 ire_refrele(ire); 3705 if (sire != NULL) 3706 ire_refrele(sire); 3707 return (0); 3708 } 3709 3710 /* 3711 * tcp_bind is called (holding the writer lock) by tcp_wput_proto to process a 3712 * O_T_BIND_REQ/T_BIND_REQ message. 3713 */ 3714 static void 3715 tcp_bind(tcp_t *tcp, mblk_t *mp) 3716 { 3717 sin_t *sin; 3718 sin6_t *sin6; 3719 mblk_t *mp1; 3720 in_port_t requested_port; 3721 in_port_t allocated_port; 3722 struct T_bind_req *tbr; 3723 boolean_t bind_to_req_port_only; 3724 boolean_t backlog_update = B_FALSE; 3725 boolean_t user_specified; 3726 in6_addr_t v6addr; 3727 ipaddr_t v4addr; 3728 uint_t origipversion; 3729 int err; 3730 queue_t *q = tcp->tcp_wq; 3731 3732 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 3733 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tbr)) { 3734 if (tcp->tcp_debug) { 3735 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3736 "tcp_bind: bad req, len %u", 3737 (uint_t)(mp->b_wptr - mp->b_rptr)); 3738 } 3739 tcp_err_ack(tcp, mp, TPROTO, 0); 3740 return; 3741 } 3742 /* Make sure the largest address fits */ 3743 mp1 = reallocb(mp, sizeof (struct T_bind_ack) + sizeof (sin6_t) + 1, 1); 3744 if (mp1 == NULL) { 3745 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3746 return; 3747 } 3748 mp = mp1; 3749 tbr = (struct T_bind_req *)mp->b_rptr; 3750 if (tcp->tcp_state >= TCPS_BOUND) { 3751 if ((tcp->tcp_state == TCPS_BOUND || 3752 tcp->tcp_state == TCPS_LISTEN) && 3753 tcp->tcp_conn_req_max != tbr->CONIND_number && 3754 tbr->CONIND_number > 0) { 3755 /* 3756 * Handle listen() increasing CONIND_number. 3757 * This is more "liberal" then what the TPI spec 3758 * requires but is needed to avoid a t_unbind 3759 * when handling listen() since the port number 3760 * might be "stolen" between the unbind and bind. 3761 */ 3762 backlog_update = B_TRUE; 3763 goto do_bind; 3764 } 3765 if (tcp->tcp_debug) { 3766 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3767 "tcp_bind: bad state, %d", tcp->tcp_state); 3768 } 3769 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 3770 return; 3771 } 3772 origipversion = tcp->tcp_ipversion; 3773 3774 switch (tbr->ADDR_length) { 3775 case 0: /* request for a generic port */ 3776 tbr->ADDR_offset = sizeof (struct T_bind_req); 3777 if (tcp->tcp_family == AF_INET) { 3778 tbr->ADDR_length = sizeof (sin_t); 3779 sin = (sin_t *)&tbr[1]; 3780 *sin = sin_null; 3781 sin->sin_family = AF_INET; 3782 mp->b_wptr = (uchar_t *)&sin[1]; 3783 tcp->tcp_ipversion = IPV4_VERSION; 3784 IN6_IPADDR_TO_V4MAPPED(INADDR_ANY, &v6addr); 3785 } else { 3786 ASSERT(tcp->tcp_family == AF_INET6); 3787 tbr->ADDR_length = sizeof (sin6_t); 3788 sin6 = (sin6_t *)&tbr[1]; 3789 *sin6 = sin6_null; 3790 sin6->sin6_family = AF_INET6; 3791 mp->b_wptr = (uchar_t *)&sin6[1]; 3792 tcp->tcp_ipversion = IPV6_VERSION; 3793 V6_SET_ZERO(v6addr); 3794 } 3795 requested_port = 0; 3796 break; 3797 3798 case sizeof (sin_t): /* Complete IPv4 address */ 3799 sin = (sin_t *)mi_offset_param(mp, tbr->ADDR_offset, 3800 sizeof (sin_t)); 3801 if (sin == NULL || !OK_32PTR((char *)sin)) { 3802 if (tcp->tcp_debug) { 3803 (void) strlog(TCP_MODULE_ID, 0, 1, 3804 SL_ERROR|SL_TRACE, 3805 "tcp_bind: bad address parameter, " 3806 "offset %d, len %d", 3807 tbr->ADDR_offset, tbr->ADDR_length); 3808 } 3809 tcp_err_ack(tcp, mp, TPROTO, 0); 3810 return; 3811 } 3812 /* 3813 * With sockets sockfs will accept bogus sin_family in 3814 * bind() and replace it with the family used in the socket 3815 * call. 3816 */ 3817 if (sin->sin_family != AF_INET || 3818 tcp->tcp_family != AF_INET) { 3819 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3820 return; 3821 } 3822 requested_port = ntohs(sin->sin_port); 3823 tcp->tcp_ipversion = IPV4_VERSION; 3824 v4addr = sin->sin_addr.s_addr; 3825 IN6_IPADDR_TO_V4MAPPED(v4addr, &v6addr); 3826 break; 3827 3828 case sizeof (sin6_t): /* Complete IPv6 address */ 3829 sin6 = (sin6_t *)mi_offset_param(mp, 3830 tbr->ADDR_offset, sizeof (sin6_t)); 3831 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 3832 if (tcp->tcp_debug) { 3833 (void) strlog(TCP_MODULE_ID, 0, 1, 3834 SL_ERROR|SL_TRACE, 3835 "tcp_bind: bad IPv6 address parameter, " 3836 "offset %d, len %d", tbr->ADDR_offset, 3837 tbr->ADDR_length); 3838 } 3839 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 3840 return; 3841 } 3842 if (sin6->sin6_family != AF_INET6 || 3843 tcp->tcp_family != AF_INET6) { 3844 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 3845 return; 3846 } 3847 requested_port = ntohs(sin6->sin6_port); 3848 tcp->tcp_ipversion = IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr) ? 3849 IPV4_VERSION : IPV6_VERSION; 3850 v6addr = sin6->sin6_addr; 3851 break; 3852 3853 default: 3854 if (tcp->tcp_debug) { 3855 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 3856 "tcp_bind: bad address length, %d", 3857 tbr->ADDR_length); 3858 } 3859 tcp_err_ack(tcp, mp, TBADADDR, 0); 3860 return; 3861 } 3862 tcp->tcp_bound_source_v6 = v6addr; 3863 3864 /* Check for change in ipversion */ 3865 if (origipversion != tcp->tcp_ipversion) { 3866 ASSERT(tcp->tcp_family == AF_INET6); 3867 err = tcp->tcp_ipversion == IPV6_VERSION ? 3868 tcp_header_init_ipv6(tcp) : tcp_header_init_ipv4(tcp); 3869 if (err) { 3870 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 3871 return; 3872 } 3873 } 3874 3875 /* 3876 * Initialize family specific fields. Copy of the src addr. 3877 * in tcp_t is needed for the lookup funcs. 3878 */ 3879 if (tcp->tcp_ipversion == IPV6_VERSION) { 3880 tcp->tcp_ip6h->ip6_src = v6addr; 3881 } else { 3882 IN6_V4MAPPED_TO_IPADDR(&v6addr, tcp->tcp_ipha->ipha_src); 3883 } 3884 tcp->tcp_ip_src_v6 = v6addr; 3885 3886 /* 3887 * For O_T_BIND_REQ: 3888 * Verify that the target port/addr is available, or choose 3889 * another. 3890 * For T_BIND_REQ: 3891 * Verify that the target port/addr is available or fail. 3892 * In both cases when it succeeds the tcp is inserted in the 3893 * bind hash table. This ensures that the operation is atomic 3894 * under the lock on the hash bucket. 3895 */ 3896 bind_to_req_port_only = requested_port != 0 && 3897 tbr->PRIM_type != O_T_BIND_REQ; 3898 /* 3899 * Get a valid port (within the anonymous range and should not 3900 * be a privileged one) to use if the user has not given a port. 3901 * If multiple threads are here, they may all start with 3902 * with the same initial port. But, it should be fine as long as 3903 * tcp_bindi will ensure that no two threads will be assigned 3904 * the same port. 3905 * 3906 * NOTE: XXX If a privileged process asks for an anonymous port, we 3907 * still check for ports only in the range > tcp_smallest_non_priv_port, 3908 * unless TCP_ANONPRIVBIND option is set. 3909 */ 3910 if (requested_port == 0) { 3911 requested_port = tcp->tcp_anon_priv_bind ? 3912 tcp_get_next_priv_port() : 3913 tcp_update_next_port(tcp_next_port_to_try, B_TRUE); 3914 user_specified = B_FALSE; 3915 } else { 3916 int i; 3917 boolean_t priv = B_FALSE; 3918 /* 3919 * If the requested_port is in the well-known privileged range, 3920 * verify that the stream was opened by a privileged user. 3921 * Note: No locks are held when inspecting tcp_g_*epriv_ports 3922 * but instead the code relies on: 3923 * - the fact that the address of the array and its size never 3924 * changes 3925 * - the atomic assignment of the elements of the array 3926 */ 3927 if (requested_port < tcp_smallest_nonpriv_port) { 3928 priv = B_TRUE; 3929 } else { 3930 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 3931 if (requested_port == 3932 tcp_g_epriv_ports[i]) { 3933 priv = B_TRUE; 3934 break; 3935 } 3936 } 3937 } 3938 if (priv) { 3939 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 3940 3941 if (secpolicy_net_privaddr(cr, requested_port) != 0) { 3942 if (tcp->tcp_debug) { 3943 (void) strlog(TCP_MODULE_ID, 0, 1, 3944 SL_ERROR|SL_TRACE, 3945 "tcp_bind: no priv for port %d", 3946 requested_port); 3947 } 3948 tcp_err_ack(tcp, mp, TACCES, 0); 3949 return; 3950 } 3951 } 3952 user_specified = B_TRUE; 3953 } 3954 3955 allocated_port = tcp_bindi(tcp, requested_port, &v6addr, 3956 tcp->tcp_reuseaddr, bind_to_req_port_only, user_specified); 3957 3958 if (allocated_port == 0) { 3959 if (bind_to_req_port_only) { 3960 if (tcp->tcp_debug) { 3961 (void) strlog(TCP_MODULE_ID, 0, 1, 3962 SL_ERROR|SL_TRACE, 3963 "tcp_bind: requested addr busy"); 3964 } 3965 tcp_err_ack(tcp, mp, TADDRBUSY, 0); 3966 } else { 3967 /* If we are out of ports, fail the bind. */ 3968 if (tcp->tcp_debug) { 3969 (void) strlog(TCP_MODULE_ID, 0, 1, 3970 SL_ERROR|SL_TRACE, 3971 "tcp_bind: out of ports?"); 3972 } 3973 tcp_err_ack(tcp, mp, TNOADDR, 0); 3974 } 3975 return; 3976 } 3977 ASSERT(tcp->tcp_state == TCPS_BOUND); 3978 do_bind: 3979 if (!backlog_update) { 3980 if (tcp->tcp_family == AF_INET) 3981 sin->sin_port = htons(allocated_port); 3982 else 3983 sin6->sin6_port = htons(allocated_port); 3984 } 3985 if (tcp->tcp_family == AF_INET) { 3986 if (tbr->CONIND_number != 0) { 3987 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3988 sizeof (sin_t)); 3989 } else { 3990 /* Just verify the local IP address */ 3991 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, IP_ADDR_LEN); 3992 } 3993 } else { 3994 if (tbr->CONIND_number != 0) { 3995 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 3996 sizeof (sin6_t)); 3997 } else { 3998 /* Just verify the local IP address */ 3999 mp1 = tcp_ip_bind_mp(tcp, tbr->PRIM_type, 4000 IPV6_ADDR_LEN); 4001 } 4002 } 4003 if (!mp1) { 4004 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 4005 return; 4006 } 4007 4008 tbr->PRIM_type = T_BIND_ACK; 4009 mp->b_datap->db_type = M_PCPROTO; 4010 4011 /* Chain in the reply mp for tcp_rput() */ 4012 mp1->b_cont = mp; 4013 mp = mp1; 4014 4015 tcp->tcp_conn_req_max = tbr->CONIND_number; 4016 if (tcp->tcp_conn_req_max) { 4017 if (tcp->tcp_conn_req_max < tcp_conn_req_min) 4018 tcp->tcp_conn_req_max = tcp_conn_req_min; 4019 if (tcp->tcp_conn_req_max > tcp_conn_req_max_q) 4020 tcp->tcp_conn_req_max = tcp_conn_req_max_q; 4021 /* 4022 * If this is a listener, do not reset the eager list 4023 * and other stuffs. Note that we don't check if the 4024 * existing eager list meets the new tcp_conn_req_max 4025 * requirement. 4026 */ 4027 if (tcp->tcp_state != TCPS_LISTEN) { 4028 tcp->tcp_state = TCPS_LISTEN; 4029 /* Initialize the chain. Don't need the eager_lock */ 4030 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 4031 tcp->tcp_second_ctimer_threshold = 4032 tcp_ip_abort_linterval; 4033 } 4034 } 4035 4036 /* 4037 * We can call ip_bind directly which returns a T_BIND_ACK mp. The 4038 * processing continues in tcp_rput_other(). 4039 */ 4040 if (tcp->tcp_family == AF_INET6) { 4041 ASSERT(tcp->tcp_connp->conn_af_isv6); 4042 mp = ip_bind_v6(q, mp, tcp->tcp_connp, &tcp->tcp_sticky_ipp); 4043 } else { 4044 ASSERT(!tcp->tcp_connp->conn_af_isv6); 4045 mp = ip_bind_v4(q, mp, tcp->tcp_connp); 4046 } 4047 /* 4048 * If the bind cannot complete immediately 4049 * IP will arrange to call tcp_rput_other 4050 * when the bind completes. 4051 */ 4052 if (mp != NULL) { 4053 tcp_rput_other(tcp, mp); 4054 } else { 4055 /* 4056 * Bind will be resumed later. Need to ensure 4057 * that conn doesn't disappear when that happens. 4058 * This will be decremented in ip_resume_tcp_bind(). 4059 */ 4060 CONN_INC_REF(tcp->tcp_connp); 4061 } 4062 } 4063 4064 4065 /* 4066 * If the "bind_to_req_port_only" parameter is set, if the requested port 4067 * number is available, return it, If not return 0 4068 * 4069 * If "bind_to_req_port_only" parameter is not set and 4070 * If the requested port number is available, return it. If not, return 4071 * the first anonymous port we happen across. If no anonymous ports are 4072 * available, return 0. addr is the requested local address, if any. 4073 * 4074 * In either case, when succeeding update the tcp_t to record the port number 4075 * and insert it in the bind hash table. 4076 * 4077 * Note that TCP over IPv4 and IPv6 sockets can use the same port number 4078 * without setting SO_REUSEADDR. This is needed so that they 4079 * can be viewed as two independent transport protocols. 4080 */ 4081 static in_port_t 4082 tcp_bindi(tcp_t *tcp, in_port_t port, const in6_addr_t *laddr, int reuseaddr, 4083 boolean_t bind_to_req_port_only, boolean_t user_specified) 4084 { 4085 /* number of times we have run around the loop */ 4086 int count = 0; 4087 /* maximum number of times to run around the loop */ 4088 int loopmax; 4089 zoneid_t zoneid = tcp->tcp_connp->conn_zoneid; 4090 4091 /* 4092 * Lookup for free addresses is done in a loop and "loopmax" 4093 * influences how long we spin in the loop 4094 */ 4095 if (bind_to_req_port_only) { 4096 /* 4097 * If the requested port is busy, don't bother to look 4098 * for a new one. Setting loop maximum count to 1 has 4099 * that effect. 4100 */ 4101 loopmax = 1; 4102 } else { 4103 /* 4104 * If the requested port is busy, look for a free one 4105 * in the anonymous port range. 4106 * Set loopmax appropriately so that one does not look 4107 * forever in the case all of the anonymous ports are in use. 4108 */ 4109 if (tcp->tcp_anon_priv_bind) { 4110 /* 4111 * loopmax = 4112 * (IPPORT_RESERVED-1) - tcp_min_anonpriv_port + 1 4113 */ 4114 loopmax = IPPORT_RESERVED - tcp_min_anonpriv_port; 4115 } else { 4116 loopmax = (tcp_largest_anon_port - 4117 tcp_smallest_anon_port + 1); 4118 } 4119 } 4120 do { 4121 uint16_t lport; 4122 tf_t *tbf; 4123 tcp_t *ltcp; 4124 4125 lport = htons(port); 4126 4127 /* 4128 * Ensure that the tcp_t is not currently in the bind hash. 4129 * Hold the lock on the hash bucket to ensure that 4130 * the duplicate check plus the insertion is an atomic 4131 * operation. 4132 * 4133 * This function does an inline lookup on the bind hash list 4134 * Make sure that we access only members of tcp_t 4135 * and that we don't look at tcp_tcp, since we are not 4136 * doing a CONN_INC_REF. 4137 */ 4138 tcp_bind_hash_remove(tcp); 4139 tbf = &tcp_bind_fanout[TCP_BIND_HASH(lport)]; 4140 mutex_enter(&tbf->tf_lock); 4141 for (ltcp = tbf->tf_tcp; ltcp != NULL; 4142 ltcp = ltcp->tcp_bind_hash) { 4143 if (lport != ltcp->tcp_lport || 4144 ltcp->tcp_connp->conn_zoneid != zoneid) { 4145 continue; 4146 } 4147 4148 /* 4149 * If TCP_EXCLBIND is set for either the bound or 4150 * binding endpoint, the semantics of bind 4151 * is changed according to the following. 4152 * 4153 * spec = specified address (v4 or v6) 4154 * unspec = unspecified address (v4 or v6) 4155 * A = specified addresses are different for endpoints 4156 * 4157 * bound bind to allowed 4158 * ------------------------------------- 4159 * unspec unspec no 4160 * unspec spec no 4161 * spec unspec no 4162 * spec spec yes if A 4163 * 4164 * Note: 4165 * 4166 * 1. Because of TLI semantics, an endpoint can go 4167 * back from, say TCP_ESTABLISHED to TCPS_LISTEN or 4168 * TCPS_BOUND, depending on whether it is originally 4169 * a listener or not. That is why we need to check 4170 * for states greater than or equal to TCPS_BOUND 4171 * here. 4172 * 4173 * 2. Ideally, we should only check for state equals 4174 * to TCPS_LISTEN. And the following check should be 4175 * added. 4176 * 4177 * if (ltcp->tcp_state == TCPS_LISTEN || 4178 * !reuseaddr || !ltcp->tcp_reuseaddr) { 4179 * ... 4180 * } 4181 * 4182 * The semantics will be changed to this. If the 4183 * endpoint on the list is in state not equal to 4184 * TCPS_LISTEN and both endpoints have SO_REUSEADDR 4185 * set, let the bind succeed. 4186 * 4187 * But because of (1), we cannot do that now. If 4188 * in future, we can change this going back semantics, 4189 * we can add the above check. 4190 */ 4191 if (ltcp->tcp_exclbind || tcp->tcp_exclbind) { 4192 if (V6_OR_V4_INADDR_ANY( 4193 ltcp->tcp_bound_source_v6) || 4194 V6_OR_V4_INADDR_ANY(*laddr) || 4195 IN6_ARE_ADDR_EQUAL(laddr, 4196 <cp->tcp_bound_source_v6)) { 4197 break; 4198 } 4199 continue; 4200 } 4201 4202 /* 4203 * Check ipversion to allow IPv4 and IPv6 sockets to 4204 * have disjoint port number spaces, if *_EXCLBIND 4205 * is not set and only if the application binds to a 4206 * specific port. We use the same autoassigned port 4207 * number space for IPv4 and IPv6 sockets. 4208 */ 4209 if (tcp->tcp_ipversion != ltcp->tcp_ipversion && 4210 bind_to_req_port_only) 4211 continue; 4212 4213 if (!reuseaddr) { 4214 /* 4215 * No socket option SO_REUSEADDR. 4216 * 4217 * If existing port is bound to 4218 * a non-wildcard IP address 4219 * and the requesting stream is 4220 * bound to a distinct 4221 * different IP addresses 4222 * (non-wildcard, also), keep 4223 * going. 4224 */ 4225 if (!V6_OR_V4_INADDR_ANY(*laddr) && 4226 !V6_OR_V4_INADDR_ANY( 4227 ltcp->tcp_bound_source_v6) && 4228 !IN6_ARE_ADDR_EQUAL(laddr, 4229 <cp->tcp_bound_source_v6)) 4230 continue; 4231 if (ltcp->tcp_state >= TCPS_BOUND) { 4232 /* 4233 * This port is being used and 4234 * its state is >= TCPS_BOUND, 4235 * so we can't bind to it. 4236 */ 4237 break; 4238 } 4239 } else { 4240 /* 4241 * socket option SO_REUSEADDR is set on the 4242 * binding tcp_t. 4243 * 4244 * If two streams are bound to 4245 * same IP address or both addr 4246 * and bound source are wildcards 4247 * (INADDR_ANY), we want to stop 4248 * searching. 4249 * We have found a match of IP source 4250 * address and source port, which is 4251 * refused regardless of the 4252 * SO_REUSEADDR setting, so we break. 4253 */ 4254 if (IN6_ARE_ADDR_EQUAL(laddr, 4255 <cp->tcp_bound_source_v6) && 4256 (ltcp->tcp_state == TCPS_LISTEN || 4257 ltcp->tcp_state == TCPS_BOUND)) 4258 break; 4259 } 4260 } 4261 if (ltcp != NULL) { 4262 /* The port number is busy */ 4263 mutex_exit(&tbf->tf_lock); 4264 } else { 4265 /* 4266 * This port is ours. Insert in fanout and mark as 4267 * bound to prevent others from getting the port 4268 * number. 4269 */ 4270 tcp->tcp_state = TCPS_BOUND; 4271 tcp->tcp_lport = htons(port); 4272 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 4273 4274 ASSERT(&tcp_bind_fanout[TCP_BIND_HASH( 4275 tcp->tcp_lport)] == tbf); 4276 tcp_bind_hash_insert(tbf, tcp, 1); 4277 4278 mutex_exit(&tbf->tf_lock); 4279 4280 /* 4281 * We don't want tcp_next_port_to_try to "inherit" 4282 * a port number supplied by the user in a bind. 4283 */ 4284 if (user_specified) 4285 return (port); 4286 4287 /* 4288 * This is the only place where tcp_next_port_to_try 4289 * is updated. After the update, it may or may not 4290 * be in the valid range. 4291 */ 4292 if (!tcp->tcp_anon_priv_bind) 4293 tcp_next_port_to_try = port + 1; 4294 return (port); 4295 } 4296 4297 if (tcp->tcp_anon_priv_bind) { 4298 port = tcp_get_next_priv_port(); 4299 } else { 4300 if (count == 0 && user_specified) { 4301 /* 4302 * We may have to return an anonymous port. So 4303 * get one to start with. 4304 */ 4305 port = 4306 tcp_update_next_port(tcp_next_port_to_try, 4307 B_TRUE); 4308 user_specified = B_FALSE; 4309 } else { 4310 port = tcp_update_next_port(port + 1, B_FALSE); 4311 } 4312 } 4313 4314 /* 4315 * Don't let this loop run forever in the case where 4316 * all of the anonymous ports are in use. 4317 */ 4318 } while (++count < loopmax); 4319 return (0); 4320 } 4321 4322 /* 4323 * We are dying for some reason. Try to do it gracefully. (May be called 4324 * as writer.) 4325 * 4326 * Return -1 if the structure was not cleaned up (if the cleanup had to be 4327 * done by a service procedure). 4328 * TBD - Should the return value distinguish between the tcp_t being 4329 * freed and it being reinitialized? 4330 */ 4331 static int 4332 tcp_clean_death(tcp_t *tcp, int err, uint8_t tag) 4333 { 4334 mblk_t *mp; 4335 queue_t *q; 4336 4337 TCP_CLD_STAT(tag); 4338 4339 #if TCP_TAG_CLEAN_DEATH 4340 tcp->tcp_cleandeathtag = tag; 4341 #endif 4342 4343 if (tcp->tcp_linger_tid != 0 && 4344 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 4345 tcp_stop_lingering(tcp); 4346 } 4347 4348 ASSERT(tcp != NULL); 4349 ASSERT((tcp->tcp_family == AF_INET && 4350 tcp->tcp_ipversion == IPV4_VERSION) || 4351 (tcp->tcp_family == AF_INET6 && 4352 (tcp->tcp_ipversion == IPV4_VERSION || 4353 tcp->tcp_ipversion == IPV6_VERSION))); 4354 4355 if (TCP_IS_DETACHED(tcp)) { 4356 if (tcp->tcp_hard_binding) { 4357 /* 4358 * Its an eager that we are dealing with. We close the 4359 * eager but in case a conn_ind has already gone to the 4360 * listener, let tcp_accept_finish() send a discon_ind 4361 * to the listener and drop the last reference. If the 4362 * listener doesn't even know about the eager i.e. the 4363 * conn_ind hasn't gone up, blow away the eager and drop 4364 * the last reference as well. If the conn_ind has gone 4365 * up, state should be BOUND. tcp_accept_finish 4366 * will figure out that the connection has received a 4367 * RST and will send a DISCON_IND to the application. 4368 */ 4369 tcp_closei_local(tcp); 4370 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 4371 CONN_DEC_REF(tcp->tcp_connp); 4372 } else { 4373 tcp->tcp_state = TCPS_BOUND; 4374 } 4375 } else { 4376 tcp_close_detached(tcp); 4377 } 4378 return (0); 4379 } 4380 4381 TCP_STAT(tcp_clean_death_nondetached); 4382 4383 /* 4384 * If T_ORDREL_IND has not been sent yet (done when service routine 4385 * is run) postpone cleaning up the endpoint until service routine 4386 * has sent up the T_ORDREL_IND. Avoid clearing out an existing 4387 * client_errno since tcp_close uses the client_errno field. 4388 */ 4389 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 4390 if (err != 0) 4391 tcp->tcp_client_errno = err; 4392 4393 tcp->tcp_deferred_clean_death = B_TRUE; 4394 return (-1); 4395 } 4396 4397 q = tcp->tcp_rq; 4398 4399 /* Trash all inbound data */ 4400 flushq(q, FLUSHALL); 4401 4402 /* 4403 * If we are at least part way open and there is error 4404 * (err==0 implies no error) 4405 * notify our client by a T_DISCON_IND. 4406 */ 4407 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 4408 if (tcp->tcp_state >= TCPS_ESTABLISHED && 4409 !TCP_IS_SOCKET(tcp)) { 4410 /* 4411 * Send M_FLUSH according to TPI. Because sockets will 4412 * (and must) ignore FLUSHR we do that only for TPI 4413 * endpoints and sockets in STREAMS mode. 4414 */ 4415 (void) putnextctl1(q, M_FLUSH, FLUSHR); 4416 } 4417 if (tcp->tcp_debug) { 4418 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 4419 "tcp_clean_death: discon err %d", err); 4420 } 4421 mp = mi_tpi_discon_ind(NULL, err, 0); 4422 if (mp != NULL) { 4423 putnext(q, mp); 4424 } else { 4425 if (tcp->tcp_debug) { 4426 (void) strlog(TCP_MODULE_ID, 0, 1, 4427 SL_ERROR|SL_TRACE, 4428 "tcp_clean_death, sending M_ERROR"); 4429 } 4430 (void) putnextctl1(q, M_ERROR, EPROTO); 4431 } 4432 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 4433 /* SYN_SENT or SYN_RCVD */ 4434 BUMP_MIB(&tcp_mib, tcpAttemptFails); 4435 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 4436 /* ESTABLISHED or CLOSE_WAIT */ 4437 BUMP_MIB(&tcp_mib, tcpEstabResets); 4438 } 4439 } 4440 4441 tcp_reinit(tcp); 4442 return (-1); 4443 } 4444 4445 /* 4446 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 4447 * to expire, stop the wait and finish the close. 4448 */ 4449 static void 4450 tcp_stop_lingering(tcp_t *tcp) 4451 { 4452 clock_t delta = 0; 4453 4454 tcp->tcp_linger_tid = 0; 4455 if (tcp->tcp_state > TCPS_LISTEN) { 4456 tcp_acceptor_hash_remove(tcp); 4457 if (tcp->tcp_flow_stopped) { 4458 tcp->tcp_flow_stopped = B_FALSE; 4459 tcp_clrqfull(tcp); 4460 } 4461 4462 if (tcp->tcp_timer_tid != 0) { 4463 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4464 tcp->tcp_timer_tid = 0; 4465 } 4466 /* 4467 * Need to cancel those timers which will not be used when 4468 * TCP is detached. This has to be done before the tcp_wq 4469 * is set to the global queue. 4470 */ 4471 tcp_timers_stop(tcp); 4472 4473 4474 tcp->tcp_detached = B_TRUE; 4475 tcp->tcp_rq = tcp_g_q; 4476 tcp->tcp_wq = WR(tcp_g_q); 4477 4478 if (tcp->tcp_state == TCPS_TIME_WAIT) { 4479 tcp_time_wait_append(tcp); 4480 TCP_DBGSTAT(tcp_detach_time_wait); 4481 goto finish; 4482 } 4483 4484 /* 4485 * If delta is zero the timer event wasn't executed and was 4486 * successfully canceled. In this case we need to restart it 4487 * with the minimal delta possible. 4488 */ 4489 if (delta >= 0) { 4490 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 4491 delta ? delta : 1); 4492 } 4493 } else { 4494 tcp_closei_local(tcp); 4495 CONN_DEC_REF(tcp->tcp_connp); 4496 } 4497 finish: 4498 /* Signal closing thread that it can complete close */ 4499 mutex_enter(&tcp->tcp_closelock); 4500 tcp->tcp_detached = B_TRUE; 4501 tcp->tcp_rq = tcp_g_q; 4502 tcp->tcp_wq = WR(tcp_g_q); 4503 tcp->tcp_closed = 1; 4504 cv_signal(&tcp->tcp_closecv); 4505 mutex_exit(&tcp->tcp_closelock); 4506 } 4507 4508 /* 4509 * Handle lingering timeouts. This function is called when the SO_LINGER timeout 4510 * expires. 4511 */ 4512 static void 4513 tcp_close_linger_timeout(void *arg) 4514 { 4515 conn_t *connp = (conn_t *)arg; 4516 tcp_t *tcp = connp->conn_tcp; 4517 4518 tcp->tcp_client_errno = ETIMEDOUT; 4519 tcp_stop_lingering(tcp); 4520 } 4521 4522 static int 4523 tcp_close(queue_t *q, int flags) 4524 { 4525 conn_t *connp = Q_TO_CONN(q); 4526 tcp_t *tcp = connp->conn_tcp; 4527 mblk_t *mp = &tcp->tcp_closemp; 4528 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 4529 4530 ASSERT(WR(q)->q_next == NULL); 4531 ASSERT(connp->conn_ref >= 2); 4532 ASSERT((connp->conn_flags & IPCL_TCPMOD) == 0); 4533 4534 /* 4535 * We are being closed as /dev/tcp or /dev/tcp6. 4536 * 4537 * Mark the conn as closing. ill_pending_mp_add will not 4538 * add any mp to the pending mp list, after this conn has 4539 * started closing. Same for sq_pending_mp_add 4540 */ 4541 mutex_enter(&connp->conn_lock); 4542 connp->conn_state_flags |= CONN_CLOSING; 4543 if (connp->conn_oper_pending_ill != NULL) 4544 conn_ioctl_cleanup_reqd = B_TRUE; 4545 CONN_INC_REF_LOCKED(connp); 4546 mutex_exit(&connp->conn_lock); 4547 tcp->tcp_closeflags = (uint8_t)flags; 4548 ASSERT(connp->conn_ref >= 3); 4549 4550 (*tcp_squeue_close_proc)(connp->conn_sqp, mp, 4551 tcp_close_output, connp, SQTAG_IP_TCP_CLOSE); 4552 4553 mutex_enter(&tcp->tcp_closelock); 4554 while (!tcp->tcp_closed) 4555 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 4556 mutex_exit(&tcp->tcp_closelock); 4557 /* 4558 * In the case of listener streams that have eagers in the q or q0 4559 * we wait for the eagers to drop their reference to us. tcp_rq and 4560 * tcp_wq of the eagers point to our queues. By waiting for the 4561 * refcnt to drop to 1, we are sure that the eagers have cleaned 4562 * up their queue pointers and also dropped their references to us. 4563 */ 4564 if (tcp->tcp_wait_for_eagers) { 4565 mutex_enter(&connp->conn_lock); 4566 while (connp->conn_ref != 1) { 4567 cv_wait(&connp->conn_cv, &connp->conn_lock); 4568 } 4569 mutex_exit(&connp->conn_lock); 4570 } 4571 /* 4572 * ioctl cleanup. The mp is queued in the 4573 * ill_pending_mp or in the sq_pending_mp. 4574 */ 4575 if (conn_ioctl_cleanup_reqd) 4576 conn_ioctl_cleanup(connp); 4577 4578 qprocsoff(q); 4579 inet_minor_free(ip_minor_arena, connp->conn_dev); 4580 4581 ASSERT(connp->conn_cred != NULL); 4582 crfree(connp->conn_cred); 4583 tcp->tcp_cred = connp->conn_cred = NULL; 4584 tcp->tcp_cpid = -1; 4585 4586 /* 4587 * Drop IP's reference on the conn. This is the last reference 4588 * on the connp if the state was less than established. If the 4589 * connection has gone into timewait state, then we will have 4590 * one ref for the TCP and one more ref (total of two) for the 4591 * classifier connected hash list (a timewait connections stays 4592 * in connected hash till closed). 4593 * 4594 * We can't assert the references because there might be other 4595 * transient reference places because of some walkers or queued 4596 * packets in squeue for the timewait state. 4597 */ 4598 CONN_DEC_REF(connp); 4599 q->q_ptr = WR(q)->q_ptr = NULL; 4600 return (0); 4601 } 4602 4603 int 4604 tcp_modclose(queue_t *q) 4605 { 4606 conn_t *connp = Q_TO_CONN(q); 4607 ASSERT((connp->conn_flags & IPCL_TCPMOD) != 0); 4608 4609 qprocsoff(q); 4610 4611 if (connp->conn_cred != NULL) { 4612 crfree(connp->conn_cred); 4613 connp->conn_cred = NULL; 4614 } 4615 CONN_DEC_REF(connp); 4616 q->q_ptr = WR(q)->q_ptr = NULL; 4617 return (0); 4618 } 4619 4620 static int 4621 tcpclose_accept(queue_t *q) 4622 { 4623 ASSERT(WR(q)->q_qinfo == &tcp_acceptor_winit); 4624 4625 /* 4626 * We had opened an acceptor STREAM for sockfs which is 4627 * now being closed due to some error. 4628 */ 4629 qprocsoff(q); 4630 inet_minor_free(ip_minor_arena, (dev_t)q->q_ptr); 4631 q->q_ptr = WR(q)->q_ptr = NULL; 4632 return (0); 4633 } 4634 4635 4636 /* 4637 * Called by streams close routine via squeues when our client blows off her 4638 * descriptor, we take this to mean: "close the stream state NOW, close the tcp 4639 * connection politely" When SO_LINGER is set (with a non-zero linger time and 4640 * it is not a nonblocking socket) then this routine sleeps until the FIN is 4641 * acked. 4642 * 4643 * NOTE: tcp_close potentially returns error when lingering. 4644 * However, the stream head currently does not pass these errors 4645 * to the application. 4.4BSD only returns EINTR and EWOULDBLOCK 4646 * errors to the application (from tsleep()) and not errors 4647 * like ECONNRESET caused by receiving a reset packet. 4648 */ 4649 4650 /* ARGSUSED */ 4651 static void 4652 tcp_close_output(void *arg, mblk_t *mp, void *arg2) 4653 { 4654 char *msg; 4655 conn_t *connp = (conn_t *)arg; 4656 tcp_t *tcp = connp->conn_tcp; 4657 clock_t delta = 0; 4658 4659 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 4660 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 4661 4662 /* Cancel any pending timeout */ 4663 if (tcp->tcp_ordrelid != 0) { 4664 if (tcp->tcp_timeout) { 4665 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ordrelid); 4666 } 4667 tcp->tcp_ordrelid = 0; 4668 tcp->tcp_timeout = B_FALSE; 4669 } 4670 4671 mutex_enter(&tcp->tcp_eager_lock); 4672 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 4673 /* Cleanup for listener */ 4674 tcp_eager_cleanup(tcp, 0); 4675 tcp->tcp_wait_for_eagers = 1; 4676 } 4677 mutex_exit(&tcp->tcp_eager_lock); 4678 4679 connp->conn_mdt_ok = B_FALSE; 4680 tcp->tcp_mdt = B_FALSE; 4681 4682 msg = NULL; 4683 switch (tcp->tcp_state) { 4684 case TCPS_CLOSED: 4685 case TCPS_IDLE: 4686 case TCPS_BOUND: 4687 case TCPS_LISTEN: 4688 break; 4689 case TCPS_SYN_SENT: 4690 msg = "tcp_close, during connect"; 4691 break; 4692 case TCPS_SYN_RCVD: 4693 /* 4694 * Close during the connect 3-way handshake 4695 * but here there may or may not be pending data 4696 * already on queue. Process almost same as in 4697 * the ESTABLISHED state. 4698 */ 4699 /* FALLTHRU */ 4700 default: 4701 if (tcp->tcp_fused) 4702 tcp_unfuse(tcp); 4703 4704 /* 4705 * If SO_LINGER has set a zero linger time, abort the 4706 * connection with a reset. 4707 */ 4708 if (tcp->tcp_linger && tcp->tcp_lingertime == 0) { 4709 msg = "tcp_close, zero lingertime"; 4710 break; 4711 } 4712 4713 ASSERT(tcp->tcp_hard_bound || tcp->tcp_hard_binding); 4714 /* 4715 * Abort connection if there is unread data queued. 4716 */ 4717 if (tcp->tcp_rcv_list || tcp->tcp_reass_head) { 4718 msg = "tcp_close, unread data"; 4719 break; 4720 } 4721 /* 4722 * tcp_hard_bound is now cleared thus all packets go through 4723 * tcp_lookup. This fact is used by tcp_detach below. 4724 * 4725 * We have done a qwait() above which could have possibly 4726 * drained more messages in turn causing transition to a 4727 * different state. Check whether we have to do the rest 4728 * of the processing or not. 4729 */ 4730 if (tcp->tcp_state <= TCPS_LISTEN) 4731 break; 4732 4733 /* 4734 * Transmit the FIN before detaching the tcp_t. 4735 * After tcp_detach returns this queue/perimeter 4736 * no longer owns the tcp_t thus others can modify it. 4737 */ 4738 (void) tcp_xmit_end(tcp); 4739 4740 /* 4741 * If lingering on close then wait until the fin is acked, 4742 * the SO_LINGER time passes, or a reset is sent/received. 4743 */ 4744 if (tcp->tcp_linger && tcp->tcp_lingertime > 0 && 4745 !(tcp->tcp_fin_acked) && 4746 tcp->tcp_state >= TCPS_ESTABLISHED) { 4747 if (tcp->tcp_closeflags & (FNDELAY|FNONBLOCK)) { 4748 tcp->tcp_client_errno = EWOULDBLOCK; 4749 } else if (tcp->tcp_client_errno == 0) { 4750 4751 ASSERT(tcp->tcp_linger_tid == 0); 4752 4753 tcp->tcp_linger_tid = TCP_TIMER(tcp, 4754 tcp_close_linger_timeout, 4755 tcp->tcp_lingertime * hz); 4756 4757 /* tcp_close_linger_timeout will finish close */ 4758 if (tcp->tcp_linger_tid == 0) 4759 tcp->tcp_client_errno = ENOSR; 4760 else 4761 return; 4762 } 4763 4764 /* 4765 * Check if we need to detach or just close 4766 * the instance. 4767 */ 4768 if (tcp->tcp_state <= TCPS_LISTEN) 4769 break; 4770 } 4771 4772 /* 4773 * Make sure that no other thread will access the tcp_rq of 4774 * this instance (through lookups etc.) as tcp_rq will go 4775 * away shortly. 4776 */ 4777 tcp_acceptor_hash_remove(tcp); 4778 4779 if (tcp->tcp_flow_stopped) { 4780 tcp->tcp_flow_stopped = B_FALSE; 4781 tcp_clrqfull(tcp); 4782 } 4783 4784 if (tcp->tcp_timer_tid != 0) { 4785 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4786 tcp->tcp_timer_tid = 0; 4787 } 4788 /* 4789 * Need to cancel those timers which will not be used when 4790 * TCP is detached. This has to be done before the tcp_wq 4791 * is set to the global queue. 4792 */ 4793 tcp_timers_stop(tcp); 4794 4795 tcp->tcp_detached = B_TRUE; 4796 if (tcp->tcp_state == TCPS_TIME_WAIT) { 4797 tcp_time_wait_append(tcp); 4798 TCP_DBGSTAT(tcp_detach_time_wait); 4799 ASSERT(connp->conn_ref >= 3); 4800 goto finish; 4801 } 4802 4803 /* 4804 * If delta is zero the timer event wasn't executed and was 4805 * successfully canceled. In this case we need to restart it 4806 * with the minimal delta possible. 4807 */ 4808 if (delta >= 0) 4809 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 4810 delta ? delta : 1); 4811 4812 ASSERT(connp->conn_ref >= 3); 4813 goto finish; 4814 } 4815 4816 /* Detach did not complete. Still need to remove q from stream. */ 4817 if (msg) { 4818 if (tcp->tcp_state == TCPS_ESTABLISHED || 4819 tcp->tcp_state == TCPS_CLOSE_WAIT) 4820 BUMP_MIB(&tcp_mib, tcpEstabResets); 4821 if (tcp->tcp_state == TCPS_SYN_SENT || 4822 tcp->tcp_state == TCPS_SYN_RCVD) 4823 BUMP_MIB(&tcp_mib, tcpAttemptFails); 4824 tcp_xmit_ctl(msg, tcp, tcp->tcp_snxt, 0, TH_RST); 4825 } 4826 4827 tcp_closei_local(tcp); 4828 CONN_DEC_REF(connp); 4829 ASSERT(connp->conn_ref >= 2); 4830 4831 finish: 4832 /* 4833 * Although packets are always processed on the correct 4834 * tcp's perimeter and access is serialized via squeue's, 4835 * IP still needs a queue when sending packets in time_wait 4836 * state so use WR(tcp_g_q) till ip_output() can be 4837 * changed to deal with just connp. For read side, we 4838 * could have set tcp_rq to NULL but there are some cases 4839 * in tcp_rput_data() from early days of this code which 4840 * do a putnext without checking if tcp is closed. Those 4841 * need to be identified before both tcp_rq and tcp_wq 4842 * can be set to NULL and tcp_q_q can disappear forever. 4843 */ 4844 mutex_enter(&tcp->tcp_closelock); 4845 /* 4846 * Don't change the queues in the case of a listener that has 4847 * eagers in its q or q0. It could surprise the eagers. 4848 * Instead wait for the eagers outside the squeue. 4849 */ 4850 if (!tcp->tcp_wait_for_eagers) { 4851 tcp->tcp_detached = B_TRUE; 4852 tcp->tcp_rq = tcp_g_q; 4853 tcp->tcp_wq = WR(tcp_g_q); 4854 } 4855 /* Signal tcp_close() to finish closing. */ 4856 tcp->tcp_closed = 1; 4857 cv_signal(&tcp->tcp_closecv); 4858 mutex_exit(&tcp->tcp_closelock); 4859 } 4860 4861 4862 /* 4863 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 4864 * Some stream heads get upset if they see these later on as anything but NULL. 4865 */ 4866 static void 4867 tcp_close_mpp(mblk_t **mpp) 4868 { 4869 mblk_t *mp; 4870 4871 if ((mp = *mpp) != NULL) { 4872 do { 4873 mp->b_next = NULL; 4874 mp->b_prev = NULL; 4875 } while ((mp = mp->b_cont) != NULL); 4876 4877 mp = *mpp; 4878 *mpp = NULL; 4879 freemsg(mp); 4880 } 4881 } 4882 4883 /* Do detached close. */ 4884 static void 4885 tcp_close_detached(tcp_t *tcp) 4886 { 4887 if (tcp->tcp_fused) 4888 tcp_unfuse(tcp); 4889 4890 /* 4891 * Clustering code serializes TCP disconnect callbacks and 4892 * cluster tcp list walks by blocking a TCP disconnect callback 4893 * if a cluster tcp list walk is in progress. This ensures 4894 * accurate accounting of TCPs in the cluster code even though 4895 * the TCP list walk itself is not atomic. 4896 */ 4897 tcp_closei_local(tcp); 4898 CONN_DEC_REF(tcp->tcp_connp); 4899 } 4900 4901 /* 4902 * Stop all TCP timers, and free the timer mblks if requested. 4903 */ 4904 static void 4905 tcp_timers_stop(tcp_t *tcp) 4906 { 4907 if (tcp->tcp_timer_tid != 0) { 4908 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 4909 tcp->tcp_timer_tid = 0; 4910 } 4911 if (tcp->tcp_ka_tid != 0) { 4912 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ka_tid); 4913 tcp->tcp_ka_tid = 0; 4914 } 4915 if (tcp->tcp_ack_tid != 0) { 4916 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 4917 tcp->tcp_ack_tid = 0; 4918 } 4919 if (tcp->tcp_push_tid != 0) { 4920 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 4921 tcp->tcp_push_tid = 0; 4922 } 4923 } 4924 4925 /* 4926 * The tcp_t is going away. Remove it from all lists and set it 4927 * to TCPS_CLOSED. The freeing up of memory is deferred until 4928 * tcp_inactive. This is needed since a thread in tcp_rput might have 4929 * done a CONN_INC_REF on this structure before it was removed from the 4930 * hashes. 4931 */ 4932 static void 4933 tcp_closei_local(tcp_t *tcp) 4934 { 4935 ire_t *ire; 4936 conn_t *connp = tcp->tcp_connp; 4937 4938 if (!TCP_IS_SOCKET(tcp)) 4939 tcp_acceptor_hash_remove(tcp); 4940 4941 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 4942 tcp->tcp_ibsegs = 0; 4943 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 4944 tcp->tcp_obsegs = 0; 4945 /* 4946 * If we are an eager connection hanging off a listener that 4947 * hasn't formally accepted the connection yet, get off his 4948 * list and blow off any data that we have accumulated. 4949 */ 4950 if (tcp->tcp_listener != NULL) { 4951 tcp_t *listener = tcp->tcp_listener; 4952 mutex_enter(&listener->tcp_eager_lock); 4953 /* 4954 * tcp_eager_conn_ind == NULL means that the 4955 * conn_ind has already gone to listener. At 4956 * this point, eager will be closed but we 4957 * leave it in listeners eager list so that 4958 * if listener decides to close without doing 4959 * accept, we can clean this up. In tcp_wput_accept 4960 * we take case of the case of accept on closed 4961 * eager. 4962 */ 4963 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 4964 tcp_eager_unlink(tcp); 4965 mutex_exit(&listener->tcp_eager_lock); 4966 /* 4967 * We don't want to have any pointers to the 4968 * listener queue, after we have released our 4969 * reference on the listener 4970 */ 4971 tcp->tcp_rq = tcp_g_q; 4972 tcp->tcp_wq = WR(tcp_g_q); 4973 CONN_DEC_REF(listener->tcp_connp); 4974 } else { 4975 mutex_exit(&listener->tcp_eager_lock); 4976 } 4977 } 4978 4979 /* Stop all the timers */ 4980 tcp_timers_stop(tcp); 4981 4982 if (tcp->tcp_state == TCPS_LISTEN) { 4983 if (tcp->tcp_ip_addr_cache) { 4984 kmem_free((void *)tcp->tcp_ip_addr_cache, 4985 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 4986 tcp->tcp_ip_addr_cache = NULL; 4987 } 4988 } 4989 if (tcp->tcp_flow_stopped) 4990 tcp_clrqfull(tcp); 4991 4992 tcp_bind_hash_remove(tcp); 4993 /* 4994 * If the tcp_time_wait_collector (which runs outside the squeue) 4995 * is trying to remove this tcp from the time wait list, we will 4996 * block in tcp_time_wait_remove while trying to acquire the 4997 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 4998 * requires the ipcl_hash_remove to be ordered after the 4999 * tcp_time_wait_remove for the refcnt checks to work correctly. 5000 */ 5001 if (tcp->tcp_state == TCPS_TIME_WAIT) 5002 tcp_time_wait_remove(tcp, NULL); 5003 CL_INET_DISCONNECT(tcp); 5004 ipcl_hash_remove(connp); 5005 5006 /* 5007 * Delete the cached ire in conn_ire_cache and also mark 5008 * the conn as CONDEMNED 5009 */ 5010 mutex_enter(&connp->conn_lock); 5011 connp->conn_state_flags |= CONN_CONDEMNED; 5012 ire = connp->conn_ire_cache; 5013 connp->conn_ire_cache = NULL; 5014 mutex_exit(&connp->conn_lock); 5015 if (ire != NULL) 5016 IRE_REFRELE_NOTR(ire); 5017 5018 /* Need to cleanup any pending ioctls */ 5019 ASSERT(tcp->tcp_time_wait_next == NULL); 5020 ASSERT(tcp->tcp_time_wait_prev == NULL); 5021 ASSERT(tcp->tcp_time_wait_expire == 0); 5022 tcp->tcp_state = TCPS_CLOSED; 5023 } 5024 5025 /* 5026 * tcp is dying (called from ipcl_conn_destroy and error cases). 5027 * Free the tcp_t in either case. 5028 */ 5029 void 5030 tcp_free(tcp_t *tcp) 5031 { 5032 mblk_t *mp; 5033 ip6_pkt_t *ipp; 5034 5035 ASSERT(tcp != NULL); 5036 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 5037 5038 tcp->tcp_rq = NULL; 5039 tcp->tcp_wq = NULL; 5040 5041 tcp_close_mpp(&tcp->tcp_xmit_head); 5042 tcp_close_mpp(&tcp->tcp_reass_head); 5043 if (tcp->tcp_rcv_list != NULL) { 5044 /* Free b_next chain */ 5045 tcp_close_mpp(&tcp->tcp_rcv_list); 5046 } 5047 if ((mp = tcp->tcp_urp_mp) != NULL) { 5048 freemsg(mp); 5049 } 5050 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 5051 freemsg(mp); 5052 } 5053 5054 if (tcp->tcp_fused_sigurg_mp != NULL) { 5055 freeb(tcp->tcp_fused_sigurg_mp); 5056 tcp->tcp_fused_sigurg_mp = NULL; 5057 } 5058 5059 if (tcp->tcp_sack_info != NULL) { 5060 if (tcp->tcp_notsack_list != NULL) { 5061 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 5062 } 5063 bzero(tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 5064 } 5065 5066 if (tcp->tcp_hopopts != NULL) { 5067 mi_free(tcp->tcp_hopopts); 5068 tcp->tcp_hopopts = NULL; 5069 tcp->tcp_hopoptslen = 0; 5070 } 5071 ASSERT(tcp->tcp_hopoptslen == 0); 5072 if (tcp->tcp_dstopts != NULL) { 5073 mi_free(tcp->tcp_dstopts); 5074 tcp->tcp_dstopts = NULL; 5075 tcp->tcp_dstoptslen = 0; 5076 } 5077 ASSERT(tcp->tcp_dstoptslen == 0); 5078 if (tcp->tcp_rtdstopts != NULL) { 5079 mi_free(tcp->tcp_rtdstopts); 5080 tcp->tcp_rtdstopts = NULL; 5081 tcp->tcp_rtdstoptslen = 0; 5082 } 5083 ASSERT(tcp->tcp_rtdstoptslen == 0); 5084 if (tcp->tcp_rthdr != NULL) { 5085 mi_free(tcp->tcp_rthdr); 5086 tcp->tcp_rthdr = NULL; 5087 tcp->tcp_rthdrlen = 0; 5088 } 5089 ASSERT(tcp->tcp_rthdrlen == 0); 5090 5091 ipp = &tcp->tcp_sticky_ipp; 5092 if ((ipp->ipp_fields & (IPPF_HOPOPTS | IPPF_RTDSTOPTS | 5093 IPPF_DSTOPTS | IPPF_RTHDR)) != 0) { 5094 if ((ipp->ipp_fields & IPPF_HOPOPTS) != 0) { 5095 kmem_free(ipp->ipp_hopopts, ipp->ipp_hopoptslen); 5096 ipp->ipp_hopopts = NULL; 5097 ipp->ipp_hopoptslen = 0; 5098 } 5099 if ((ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) { 5100 kmem_free(ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 5101 ipp->ipp_rtdstopts = NULL; 5102 ipp->ipp_rtdstoptslen = 0; 5103 } 5104 if ((ipp->ipp_fields & IPPF_DSTOPTS) != 0) { 5105 kmem_free(ipp->ipp_dstopts, ipp->ipp_dstoptslen); 5106 ipp->ipp_dstopts = NULL; 5107 ipp->ipp_dstoptslen = 0; 5108 } 5109 if ((ipp->ipp_fields & IPPF_RTHDR) != 0) { 5110 kmem_free(ipp->ipp_rthdr, ipp->ipp_rthdrlen); 5111 ipp->ipp_rthdr = NULL; 5112 ipp->ipp_rthdrlen = 0; 5113 } 5114 ipp->ipp_fields &= ~(IPPF_HOPOPTS | IPPF_RTDSTOPTS | 5115 IPPF_DSTOPTS | IPPF_RTHDR); 5116 } 5117 5118 /* 5119 * Free memory associated with the tcp/ip header template. 5120 */ 5121 5122 if (tcp->tcp_iphc != NULL) 5123 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 5124 5125 /* 5126 * Following is really a blowing away a union. 5127 * It happens to have exactly two members of identical size 5128 * the following code is enough. 5129 */ 5130 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 5131 5132 if (tcp->tcp_tracebuf != NULL) { 5133 kmem_free(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 5134 tcp->tcp_tracebuf = NULL; 5135 } 5136 } 5137 5138 5139 /* 5140 * Put a connection confirmation message upstream built from the 5141 * address information within 'iph' and 'tcph'. Report our success or failure. 5142 */ 5143 static boolean_t 5144 tcp_conn_con(tcp_t *tcp, uchar_t *iphdr, tcph_t *tcph, mblk_t *idmp, 5145 mblk_t **defermp) 5146 { 5147 sin_t sin; 5148 sin6_t sin6; 5149 mblk_t *mp; 5150 char *optp = NULL; 5151 int optlen = 0; 5152 cred_t *cr; 5153 5154 if (defermp != NULL) 5155 *defermp = NULL; 5156 5157 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) { 5158 /* 5159 * Return in T_CONN_CON results of option negotiation through 5160 * the T_CONN_REQ. Note: If there is an real end-to-end option 5161 * negotiation, then what is received from remote end needs 5162 * to be taken into account but there is no such thing (yet?) 5163 * in our TCP/IP. 5164 * Note: We do not use mi_offset_param() here as 5165 * tcp_opts_conn_req contents do not directly come from 5166 * an application and are either generated in kernel or 5167 * from user input that was already verified. 5168 */ 5169 mp = tcp->tcp_conn.tcp_opts_conn_req; 5170 optp = (char *)(mp->b_rptr + 5171 ((struct T_conn_req *)mp->b_rptr)->OPT_offset); 5172 optlen = (int) 5173 ((struct T_conn_req *)mp->b_rptr)->OPT_length; 5174 } 5175 5176 if (IPH_HDR_VERSION(iphdr) == IPV4_VERSION) { 5177 ipha_t *ipha = (ipha_t *)iphdr; 5178 5179 /* packet is IPv4 */ 5180 if (tcp->tcp_family == AF_INET) { 5181 sin = sin_null; 5182 sin.sin_addr.s_addr = ipha->ipha_src; 5183 sin.sin_port = *(uint16_t *)tcph->th_lport; 5184 sin.sin_family = AF_INET; 5185 mp = mi_tpi_conn_con(NULL, (char *)&sin, 5186 (int)sizeof (sin_t), optp, optlen); 5187 } else { 5188 sin6 = sin6_null; 5189 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 5190 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5191 sin6.sin6_family = AF_INET6; 5192 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 5193 (int)sizeof (sin6_t), optp, optlen); 5194 5195 } 5196 } else { 5197 ip6_t *ip6h = (ip6_t *)iphdr; 5198 5199 ASSERT(IPH_HDR_VERSION(iphdr) == IPV6_VERSION); 5200 ASSERT(tcp->tcp_family == AF_INET6); 5201 sin6 = sin6_null; 5202 sin6.sin6_addr = ip6h->ip6_src; 5203 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5204 sin6.sin6_family = AF_INET6; 5205 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 5206 mp = mi_tpi_conn_con(NULL, (char *)&sin6, 5207 (int)sizeof (sin6_t), optp, optlen); 5208 } 5209 5210 if (!mp) 5211 return (B_FALSE); 5212 5213 if ((cr = DB_CRED(idmp)) != NULL) { 5214 mblk_setcred(mp, cr); 5215 DB_CPID(mp) = DB_CPID(idmp); 5216 } 5217 5218 if (defermp == NULL) 5219 putnext(tcp->tcp_rq, mp); 5220 else 5221 *defermp = mp; 5222 5223 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 5224 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 5225 return (B_TRUE); 5226 } 5227 5228 /* 5229 * Defense for the SYN attack - 5230 * 1. When q0 is full, drop from the tail (tcp_eager_prev_q0) the oldest 5231 * one that doesn't have the dontdrop bit set. 5232 * 2. Don't drop a SYN request before its first timeout. This gives every 5233 * request at least til the first timeout to complete its 3-way handshake. 5234 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 5235 * requests currently on the queue that has timed out. This will be used 5236 * as an indicator of whether an attack is under way, so that appropriate 5237 * actions can be taken. (It's incremented in tcp_timer() and decremented 5238 * either when eager goes into ESTABLISHED, or gets freed up.) 5239 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 5240 * # of timeout drops back to <= q0len/32 => SYN alert off 5241 */ 5242 static boolean_t 5243 tcp_drop_q0(tcp_t *tcp) 5244 { 5245 tcp_t *eager; 5246 5247 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 5248 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 5249 /* 5250 * New one is added after next_q0 so prev_q0 points to the oldest 5251 * Also do not drop any established connections that are deferred on 5252 * q0 due to q being full 5253 */ 5254 5255 eager = tcp->tcp_eager_prev_q0; 5256 while (eager->tcp_dontdrop || eager->tcp_conn_def_q0) { 5257 eager = eager->tcp_eager_prev_q0; 5258 if (eager == tcp) { 5259 eager = tcp->tcp_eager_prev_q0; 5260 break; 5261 } 5262 } 5263 if (eager->tcp_syn_rcvd_timeout == 0) 5264 return (B_FALSE); 5265 5266 if (tcp->tcp_debug) { 5267 (void) strlog(TCP_MODULE_ID, 0, 3, SL_TRACE, 5268 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 5269 " (%d pending) on %s, drop one", tcp_conn_req_max_q0, 5270 tcp->tcp_conn_req_cnt_q0, 5271 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 5272 } 5273 5274 BUMP_MIB(&tcp_mib, tcpHalfOpenDrop); 5275 5276 /* 5277 * need to do refhold here because the selected eager could 5278 * be removed by someone else if we release the eager lock. 5279 */ 5280 CONN_INC_REF(eager->tcp_connp); 5281 mutex_exit(&tcp->tcp_eager_lock); 5282 5283 /* Mark the IRE created for this SYN request temporary */ 5284 tcp_ip_ire_mark_advice(eager); 5285 (void) tcp_clean_death(eager, ETIMEDOUT, 5); 5286 CONN_DEC_REF(eager->tcp_connp); 5287 5288 mutex_enter(&tcp->tcp_eager_lock); 5289 return (B_TRUE); 5290 } 5291 5292 int 5293 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 5294 tcph_t *tcph, uint_t ipvers, mblk_t *idmp) 5295 { 5296 tcp_t *ltcp = lconnp->conn_tcp; 5297 tcp_t *tcp = connp->conn_tcp; 5298 mblk_t *tpi_mp; 5299 ipha_t *ipha; 5300 ip6_t *ip6h; 5301 sin6_t sin6; 5302 in6_addr_t v6dst; 5303 int err; 5304 int ifindex = 0; 5305 cred_t *cr; 5306 5307 if (ipvers == IPV4_VERSION) { 5308 ipha = (ipha_t *)mp->b_rptr; 5309 5310 connp->conn_send = ip_output; 5311 connp->conn_recv = tcp_input; 5312 5313 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 5314 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 5315 5316 sin6 = sin6_null; 5317 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &sin6.sin6_addr); 5318 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &v6dst); 5319 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5320 sin6.sin6_family = AF_INET6; 5321 sin6.__sin6_src_id = ip_srcid_find_addr(&v6dst, 5322 lconnp->conn_zoneid); 5323 if (tcp->tcp_recvdstaddr) { 5324 sin6_t sin6d; 5325 5326 sin6d = sin6_null; 5327 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, 5328 &sin6d.sin6_addr); 5329 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 5330 sin6d.sin6_family = AF_INET; 5331 tpi_mp = mi_tpi_extconn_ind(NULL, 5332 (char *)&sin6d, sizeof (sin6_t), 5333 (char *)&tcp, 5334 (t_scalar_t)sizeof (intptr_t), 5335 (char *)&sin6d, sizeof (sin6_t), 5336 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5337 } else { 5338 tpi_mp = mi_tpi_conn_ind(NULL, 5339 (char *)&sin6, sizeof (sin6_t), 5340 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5341 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5342 } 5343 } else { 5344 ip6h = (ip6_t *)mp->b_rptr; 5345 5346 connp->conn_send = ip_output_v6; 5347 connp->conn_recv = tcp_input; 5348 5349 connp->conn_srcv6 = ip6h->ip6_dst; 5350 connp->conn_remv6 = ip6h->ip6_src; 5351 5352 /* db_cksumstuff is set at ip_fanout_tcp_v6 */ 5353 ifindex = (int)mp->b_datap->db_cksumstuff; 5354 mp->b_datap->db_cksumstuff = 0; 5355 5356 sin6 = sin6_null; 5357 sin6.sin6_addr = ip6h->ip6_src; 5358 sin6.sin6_port = *(uint16_t *)tcph->th_lport; 5359 sin6.sin6_family = AF_INET6; 5360 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 5361 sin6.__sin6_src_id = ip_srcid_find_addr(&ip6h->ip6_dst, 5362 lconnp->conn_zoneid); 5363 5364 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 5365 /* Pass up the scope_id of remote addr */ 5366 sin6.sin6_scope_id = ifindex; 5367 } else { 5368 sin6.sin6_scope_id = 0; 5369 } 5370 if (tcp->tcp_recvdstaddr) { 5371 sin6_t sin6d; 5372 5373 sin6d = sin6_null; 5374 sin6.sin6_addr = ip6h->ip6_dst; 5375 sin6d.sin6_port = *(uint16_t *)tcph->th_fport; 5376 sin6d.sin6_family = AF_INET; 5377 tpi_mp = mi_tpi_extconn_ind(NULL, 5378 (char *)&sin6d, sizeof (sin6_t), 5379 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5380 (char *)&sin6d, sizeof (sin6_t), 5381 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5382 } else { 5383 tpi_mp = mi_tpi_conn_ind(NULL, 5384 (char *)&sin6, sizeof (sin6_t), 5385 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5386 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5387 } 5388 } 5389 5390 if (tpi_mp == NULL) 5391 return (ENOMEM); 5392 5393 connp->conn_fport = *(uint16_t *)tcph->th_lport; 5394 connp->conn_lport = *(uint16_t *)tcph->th_fport; 5395 connp->conn_flags |= (IPCL_TCP6|IPCL_EAGER); 5396 connp->conn_fully_bound = B_FALSE; 5397 5398 if (tcp_trace) 5399 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 5400 5401 /* Inherit information from the "parent" */ 5402 tcp->tcp_ipversion = ltcp->tcp_ipversion; 5403 tcp->tcp_family = ltcp->tcp_family; 5404 tcp->tcp_wq = ltcp->tcp_wq; 5405 tcp->tcp_rq = ltcp->tcp_rq; 5406 tcp->tcp_mss = tcp_mss_def_ipv6; 5407 tcp->tcp_detached = B_TRUE; 5408 if ((err = tcp_init_values(tcp)) != 0) { 5409 freemsg(tpi_mp); 5410 return (err); 5411 } 5412 5413 if (ipvers == IPV4_VERSION) { 5414 if ((err = tcp_header_init_ipv4(tcp)) != 0) { 5415 freemsg(tpi_mp); 5416 return (err); 5417 } 5418 ASSERT(tcp->tcp_ipha != NULL); 5419 } else { 5420 /* ifindex must be already set */ 5421 ASSERT(ifindex != 0); 5422 5423 if (ltcp->tcp_bound_if != 0) { 5424 /* 5425 * Set newtcp's bound_if equal to 5426 * listener's value. If ifindex is 5427 * not the same as ltcp->tcp_bound_if, 5428 * it must be a packet for the ipmp group 5429 * of interfaces 5430 */ 5431 tcp->tcp_bound_if = ltcp->tcp_bound_if; 5432 } else if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 5433 tcp->tcp_bound_if = ifindex; 5434 } 5435 5436 tcp->tcp_ipv6_recvancillary = ltcp->tcp_ipv6_recvancillary; 5437 tcp->tcp_recvifindex = 0; 5438 tcp->tcp_recvhops = 0xffffffffU; 5439 ASSERT(tcp->tcp_ip6h != NULL); 5440 } 5441 5442 tcp->tcp_lport = ltcp->tcp_lport; 5443 5444 if (ltcp->tcp_ipversion == tcp->tcp_ipversion) { 5445 if (tcp->tcp_iphc_len != ltcp->tcp_iphc_len) { 5446 /* 5447 * Listener had options of some sort; eager inherits. 5448 * Free up the eager template and allocate one 5449 * of the right size. 5450 */ 5451 if (tcp->tcp_hdr_grown) { 5452 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 5453 } else { 5454 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 5455 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 5456 } 5457 tcp->tcp_iphc = kmem_zalloc(ltcp->tcp_iphc_len, 5458 KM_NOSLEEP); 5459 if (tcp->tcp_iphc == NULL) { 5460 tcp->tcp_iphc_len = 0; 5461 freemsg(tpi_mp); 5462 return (ENOMEM); 5463 } 5464 tcp->tcp_iphc_len = ltcp->tcp_iphc_len; 5465 tcp->tcp_hdr_grown = B_TRUE; 5466 } 5467 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 5468 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 5469 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5470 tcp->tcp_ip6_hops = ltcp->tcp_ip6_hops; 5471 tcp->tcp_ip6_vcf = ltcp->tcp_ip6_vcf; 5472 5473 /* 5474 * Copy the IP+TCP header template from listener to eager 5475 */ 5476 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 5477 if (tcp->tcp_ipversion == IPV6_VERSION) { 5478 if (((ip6i_t *)(tcp->tcp_iphc))->ip6i_nxt == 5479 IPPROTO_RAW) { 5480 tcp->tcp_ip6h = 5481 (ip6_t *)(tcp->tcp_iphc + 5482 sizeof (ip6i_t)); 5483 } else { 5484 tcp->tcp_ip6h = 5485 (ip6_t *)(tcp->tcp_iphc); 5486 } 5487 tcp->tcp_ipha = NULL; 5488 } else { 5489 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 5490 tcp->tcp_ip6h = NULL; 5491 } 5492 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 5493 tcp->tcp_ip_hdr_len); 5494 } else { 5495 /* 5496 * only valid case when ipversion of listener and 5497 * eager differ is when listener is IPv6 and 5498 * eager is IPv4. 5499 * Eager header template has been initialized to the 5500 * maximum v4 header sizes, which includes space for 5501 * TCP and IP options. 5502 */ 5503 ASSERT((ltcp->tcp_ipversion == IPV6_VERSION) && 5504 (tcp->tcp_ipversion == IPV4_VERSION)); 5505 ASSERT(tcp->tcp_iphc_len >= 5506 TCP_MAX_COMBINED_HEADER_LENGTH); 5507 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5508 /* copy IP header fields individually */ 5509 tcp->tcp_ipha->ipha_ttl = 5510 ltcp->tcp_ip6h->ip6_hops; 5511 bcopy(ltcp->tcp_tcph->th_lport, 5512 tcp->tcp_tcph->th_lport, sizeof (ushort_t)); 5513 } 5514 5515 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 5516 bcopy(tcp->tcp_tcph->th_fport, &tcp->tcp_fport, 5517 sizeof (in_port_t)); 5518 5519 if (ltcp->tcp_lport == 0) { 5520 tcp->tcp_lport = *(in_port_t *)tcph->th_fport; 5521 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, 5522 sizeof (in_port_t)); 5523 } 5524 5525 if (tcp->tcp_ipversion == IPV4_VERSION) { 5526 ASSERT(ipha != NULL); 5527 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 5528 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 5529 5530 /* Source routing option copyover (reverse it) */ 5531 if (tcp_rev_src_routes) 5532 tcp_opt_reverse(tcp, ipha); 5533 } else { 5534 ASSERT(ip6h != NULL); 5535 tcp->tcp_ip6h->ip6_dst = ip6h->ip6_src; 5536 tcp->tcp_ip6h->ip6_src = ip6h->ip6_dst; 5537 } 5538 5539 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 5540 /* 5541 * If the SYN contains a credential, it's a loopback packet; attach 5542 * the credential to the TPI message. 5543 */ 5544 if ((cr = DB_CRED(idmp)) != NULL) { 5545 mblk_setcred(tpi_mp, cr); 5546 DB_CPID(tpi_mp) = DB_CPID(idmp); 5547 } 5548 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 5549 5550 return (0); 5551 } 5552 5553 5554 int 5555 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, ipha_t *ipha, 5556 tcph_t *tcph, mblk_t *idmp) 5557 { 5558 tcp_t *ltcp = lconnp->conn_tcp; 5559 tcp_t *tcp = connp->conn_tcp; 5560 sin_t sin; 5561 mblk_t *tpi_mp = NULL; 5562 int err; 5563 cred_t *cr; 5564 5565 sin = sin_null; 5566 sin.sin_addr.s_addr = ipha->ipha_src; 5567 sin.sin_port = *(uint16_t *)tcph->th_lport; 5568 sin.sin_family = AF_INET; 5569 if (ltcp->tcp_recvdstaddr) { 5570 sin_t sind; 5571 5572 sind = sin_null; 5573 sind.sin_addr.s_addr = ipha->ipha_dst; 5574 sind.sin_port = *(uint16_t *)tcph->th_fport; 5575 sind.sin_family = AF_INET; 5576 tpi_mp = mi_tpi_extconn_ind(NULL, 5577 (char *)&sind, sizeof (sin_t), (char *)&tcp, 5578 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 5579 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5580 } else { 5581 tpi_mp = mi_tpi_conn_ind(NULL, 5582 (char *)&sin, sizeof (sin_t), 5583 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 5584 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 5585 } 5586 5587 if (tpi_mp == NULL) { 5588 return (ENOMEM); 5589 } 5590 5591 connp->conn_flags |= (IPCL_TCP4|IPCL_EAGER); 5592 connp->conn_send = ip_output; 5593 connp->conn_recv = tcp_input; 5594 connp->conn_fully_bound = B_FALSE; 5595 5596 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_srcv6); 5597 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_remv6); 5598 connp->conn_fport = *(uint16_t *)tcph->th_lport; 5599 connp->conn_lport = *(uint16_t *)tcph->th_fport; 5600 5601 if (tcp_trace) { 5602 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_NOSLEEP); 5603 } 5604 5605 /* Inherit information from the "parent" */ 5606 tcp->tcp_ipversion = ltcp->tcp_ipversion; 5607 tcp->tcp_family = ltcp->tcp_family; 5608 tcp->tcp_wq = ltcp->tcp_wq; 5609 tcp->tcp_rq = ltcp->tcp_rq; 5610 tcp->tcp_mss = tcp_mss_def_ipv4; 5611 tcp->tcp_detached = B_TRUE; 5612 if ((err = tcp_init_values(tcp)) != 0) { 5613 freemsg(tpi_mp); 5614 return (err); 5615 } 5616 5617 /* 5618 * Let's make sure that eager tcp template has enough space to 5619 * copy IPv4 listener's tcp template. Since the conn_t structure is 5620 * preserved and tcp_iphc_len is also preserved, an eager conn_t may 5621 * have a tcp_template of total len TCP_MAX_COMBINED_HEADER_LENGTH or 5622 * more (in case of re-allocation of conn_t with tcp-IPv6 template with 5623 * extension headers or with ip6i_t struct). Note that bcopy() below 5624 * copies listener tcp's hdr_len which cannot be greater than TCP_MAX_ 5625 * COMBINED_HEADER_LENGTH as this listener must be a IPv4 listener. 5626 */ 5627 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 5628 ASSERT(ltcp->tcp_hdr_len <= TCP_MAX_COMBINED_HEADER_LENGTH); 5629 5630 tcp->tcp_hdr_len = ltcp->tcp_hdr_len; 5631 tcp->tcp_ip_hdr_len = ltcp->tcp_ip_hdr_len; 5632 tcp->tcp_tcp_hdr_len = ltcp->tcp_tcp_hdr_len; 5633 tcp->tcp_ttl = ltcp->tcp_ttl; 5634 tcp->tcp_tos = ltcp->tcp_tos; 5635 5636 /* Copy the IP+TCP header template from listener to eager */ 5637 bcopy(ltcp->tcp_iphc, tcp->tcp_iphc, ltcp->tcp_hdr_len); 5638 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 5639 tcp->tcp_ip6h = NULL; 5640 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + 5641 tcp->tcp_ip_hdr_len); 5642 5643 /* Initialize the IP addresses and Ports */ 5644 tcp->tcp_ipha->ipha_dst = ipha->ipha_src; 5645 tcp->tcp_ipha->ipha_src = ipha->ipha_dst; 5646 bcopy(tcph->th_lport, tcp->tcp_tcph->th_fport, sizeof (in_port_t)); 5647 bcopy(tcph->th_fport, tcp->tcp_tcph->th_lport, sizeof (in_port_t)); 5648 5649 /* Source routing option copyover (reverse it) */ 5650 if (tcp_rev_src_routes) 5651 tcp_opt_reverse(tcp, ipha); 5652 5653 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 5654 5655 /* 5656 * If the SYN contains a credential, it's a loopback packet; attach 5657 * the credential to the TPI message. 5658 */ 5659 if ((cr = DB_CRED(idmp)) != NULL) { 5660 mblk_setcred(tpi_mp, cr); 5661 DB_CPID(tpi_mp) = DB_CPID(idmp); 5662 } 5663 tcp->tcp_conn.tcp_eager_conn_ind = tpi_mp; 5664 5665 return (0); 5666 } 5667 5668 /* 5669 * sets up conn for ipsec. 5670 * if the first mblk is M_CTL it is consumed and mpp is updated. 5671 * in case of error mpp is freed. 5672 */ 5673 conn_t * 5674 tcp_get_ipsec_conn(tcp_t *tcp, squeue_t *sqp, mblk_t **mpp) 5675 { 5676 conn_t *connp = tcp->tcp_connp; 5677 conn_t *econnp; 5678 squeue_t *new_sqp; 5679 mblk_t *first_mp = *mpp; 5680 mblk_t *mp = *mpp; 5681 boolean_t mctl_present = B_FALSE; 5682 uint_t ipvers; 5683 5684 econnp = tcp_get_conn(sqp); 5685 if (econnp == NULL) { 5686 freemsg(first_mp); 5687 return (NULL); 5688 } 5689 if (DB_TYPE(mp) == M_CTL) { 5690 if (mp->b_cont == NULL || 5691 mp->b_cont->b_datap->db_type != M_DATA) { 5692 freemsg(first_mp); 5693 return (NULL); 5694 } 5695 mp = mp->b_cont; 5696 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) == 0) { 5697 freemsg(first_mp); 5698 return (NULL); 5699 } 5700 5701 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 5702 first_mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5703 mctl_present = B_TRUE; 5704 } else { 5705 ASSERT(mp->b_datap->db_struioflag & STRUIO_POLICY); 5706 mp->b_datap->db_struioflag &= ~STRUIO_POLICY; 5707 } 5708 5709 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 5710 mp->b_datap->db_cksumstart = 0; 5711 5712 ASSERT(OK_32PTR(mp->b_rptr)); 5713 ipvers = IPH_HDR_VERSION(mp->b_rptr); 5714 if (ipvers == IPV4_VERSION) { 5715 uint16_t *up; 5716 uint32_t ports; 5717 ipha_t *ipha; 5718 5719 ipha = (ipha_t *)mp->b_rptr; 5720 up = (uint16_t *)((uchar_t *)ipha + 5721 IPH_HDR_LENGTH(ipha) + TCP_PORTS_OFFSET); 5722 ports = *(uint32_t *)up; 5723 IPCL_TCP_EAGER_INIT(econnp, IPPROTO_TCP, 5724 ipha->ipha_dst, ipha->ipha_src, ports); 5725 } else { 5726 uint16_t *up; 5727 uint32_t ports; 5728 uint16_t ip_hdr_len; 5729 uint8_t *nexthdrp; 5730 ip6_t *ip6h; 5731 tcph_t *tcph; 5732 5733 ip6h = (ip6_t *)mp->b_rptr; 5734 if (ip6h->ip6_nxt == IPPROTO_TCP) { 5735 ip_hdr_len = IPV6_HDR_LEN; 5736 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &ip_hdr_len, 5737 &nexthdrp) || *nexthdrp != IPPROTO_TCP) { 5738 CONN_DEC_REF(econnp); 5739 freemsg(first_mp); 5740 return (NULL); 5741 } 5742 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 5743 up = (uint16_t *)tcph->th_lport; 5744 ports = *(uint32_t *)up; 5745 IPCL_TCP_EAGER_INIT_V6(econnp, IPPROTO_TCP, 5746 ip6h->ip6_dst, ip6h->ip6_src, ports); 5747 } 5748 5749 /* 5750 * The caller already ensured that there is a sqp present. 5751 */ 5752 econnp->conn_sqp = new_sqp; 5753 5754 if (connp->conn_policy != NULL) { 5755 ipsec_in_t *ii; 5756 ii = (ipsec_in_t *)(first_mp->b_rptr); 5757 ASSERT(ii->ipsec_in_policy == NULL); 5758 IPPH_REFHOLD(connp->conn_policy); 5759 ii->ipsec_in_policy = connp->conn_policy; 5760 5761 first_mp->b_datap->db_type = IPSEC_POLICY_SET; 5762 if (!ip_bind_ipsec_policy_set(econnp, first_mp)) { 5763 CONN_DEC_REF(econnp); 5764 freemsg(first_mp); 5765 return (NULL); 5766 } 5767 } 5768 5769 if (ipsec_conn_cache_policy(econnp, ipvers == IPV4_VERSION) != 0) { 5770 CONN_DEC_REF(econnp); 5771 freemsg(first_mp); 5772 return (NULL); 5773 } 5774 5775 /* 5776 * If we know we have some policy, pass the "IPSEC" 5777 * options size TCP uses this adjust the MSS. 5778 */ 5779 econnp->conn_tcp->tcp_ipsec_overhead = conn_ipsec_length(econnp); 5780 if (mctl_present) { 5781 freeb(first_mp); 5782 *mpp = mp; 5783 } 5784 5785 return (econnp); 5786 } 5787 5788 /* 5789 * tcp_get_conn/tcp_free_conn 5790 * 5791 * tcp_get_conn is used to get a clean tcp connection structure. 5792 * It tries to reuse the connections put on the freelist by the 5793 * time_wait_collector failing which it goes to kmem_cache. This 5794 * way has two benefits compared to just allocating from and 5795 * freeing to kmem_cache. 5796 * 1) The time_wait_collector can free (which includes the cleanup) 5797 * outside the squeue. So when the interrupt comes, we have a clean 5798 * connection sitting in the freelist. Obviously, this buys us 5799 * performance. 5800 * 5801 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_conn_request 5802 * has multiple disadvantages - tying up the squeue during alloc, and the 5803 * fact that IPSec policy initialization has to happen here which 5804 * requires us sending a M_CTL and checking for it i.e. real ugliness. 5805 * But allocating the conn/tcp in IP land is also not the best since 5806 * we can't check the 'q' and 'q0' which are protected by squeue and 5807 * blindly allocate memory which might have to be freed here if we are 5808 * not allowed to accept the connection. By using the freelist and 5809 * putting the conn/tcp back in freelist, we don't pay a penalty for 5810 * allocating memory without checking 'q/q0' and freeing it if we can't 5811 * accept the connection. 5812 * 5813 * Care should be taken to put the conn back in the same squeue's freelist 5814 * from which it was allocated. Best results are obtained if conn is 5815 * allocated from listener's squeue and freed to the same. Time wait 5816 * collector will free up the freelist is the connection ends up sitting 5817 * there for too long. 5818 */ 5819 void * 5820 tcp_get_conn(void *arg) 5821 { 5822 tcp_t *tcp = NULL; 5823 conn_t *connp = NULL; 5824 squeue_t *sqp = (squeue_t *)arg; 5825 tcp_squeue_priv_t *tcp_time_wait; 5826 5827 tcp_time_wait = 5828 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 5829 5830 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 5831 tcp = tcp_time_wait->tcp_free_list; 5832 if (tcp != NULL) { 5833 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 5834 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5835 tcp->tcp_time_wait_next = NULL; 5836 connp = tcp->tcp_connp; 5837 connp->conn_flags |= IPCL_REUSED; 5838 return ((void *)connp); 5839 } 5840 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 5841 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP)) == NULL) 5842 return (NULL); 5843 return ((void *)connp); 5844 } 5845 5846 /* BEGIN CSTYLED */ 5847 /* 5848 * 5849 * The sockfs ACCEPT path: 5850 * ======================= 5851 * 5852 * The eager is now established in its own perimeter as soon as SYN is 5853 * received in tcp_conn_request(). When sockfs receives conn_ind, it 5854 * completes the accept processing on the acceptor STREAM. The sending 5855 * of conn_ind part is common for both sockfs listener and a TLI/XTI 5856 * listener but a TLI/XTI listener completes the accept processing 5857 * on the listener perimeter. 5858 * 5859 * Common control flow for 3 way handshake: 5860 * ---------------------------------------- 5861 * 5862 * incoming SYN (listener perimeter) -> tcp_rput_data() 5863 * -> tcp_conn_request() 5864 * 5865 * incoming SYN-ACK-ACK (eager perim) -> tcp_rput_data() 5866 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 5867 * 5868 * Sockfs ACCEPT Path: 5869 * ------------------- 5870 * 5871 * open acceptor stream (ip_tcpopen allocates tcp_wput_accept() 5872 * as STREAM entry point) 5873 * 5874 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_wput_accept() 5875 * 5876 * tcp_wput_accept() extracts the eager and makes the q->q_ptr <-> eager 5877 * association (we are not behind eager's squeue but sockfs is protecting us 5878 * and no one knows about this stream yet. The STREAMS entry point q->q_info 5879 * is changed to point at tcp_wput(). 5880 * 5881 * tcp_wput_accept() sends any deferred eagers via tcp_send_pending() to 5882 * listener (done on listener's perimeter). 5883 * 5884 * tcp_wput_accept() calls tcp_accept_finish() on eagers perimeter to finish 5885 * accept. 5886 * 5887 * TLI/XTI client ACCEPT path: 5888 * --------------------------- 5889 * 5890 * soaccept() sends T_CONN_RES on the listener STREAM. 5891 * 5892 * tcp_accept() -> tcp_accept_swap() complete the processing and send 5893 * the bind_mp to eager perimeter to finish accept (tcp_rput_other()). 5894 * 5895 * Locks: 5896 * ====== 5897 * 5898 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 5899 * and listeners->tcp_eager_next_q. 5900 * 5901 * Referencing: 5902 * ============ 5903 * 5904 * 1) We start out in tcp_conn_request by eager placing a ref on 5905 * listener and listener adding eager to listeners->tcp_eager_next_q0. 5906 * 5907 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 5908 * doing so we place a ref on the eager. This ref is finally dropped at the 5909 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 5910 * reference is dropped by the squeue framework. 5911 * 5912 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 5913 * 5914 * The reference must be released by the same entity that added the reference 5915 * In the above scheme, the eager is the entity that adds and releases the 5916 * references. Note that tcp_accept_finish executes in the squeue of the eager 5917 * (albeit after it is attached to the acceptor stream). Though 1. executes 5918 * in the listener's squeue, the eager is nascent at this point and the 5919 * reference can be considered to have been added on behalf of the eager. 5920 * 5921 * Eager getting a Reset or listener closing: 5922 * ========================================== 5923 * 5924 * Once the listener and eager are linked, the listener never does the unlink. 5925 * If the listener needs to close, tcp_eager_cleanup() is called which queues 5926 * a message on all eager perimeter. The eager then does the unlink, clears 5927 * any pointers to the listener's queue and drops the reference to the 5928 * listener. The listener waits in tcp_close outside the squeue until its 5929 * refcount has dropped to 1. This ensures that the listener has waited for 5930 * all eagers to clear their association with the listener. 5931 * 5932 * Similarly, if eager decides to go away, it can unlink itself and close. 5933 * When the T_CONN_RES comes down, we check if eager has closed. Note that 5934 * the reference to eager is still valid because of the extra ref we put 5935 * in tcp_send_conn_ind. 5936 * 5937 * Listener can always locate the eager under the protection 5938 * of the listener->tcp_eager_lock, and then do a refhold 5939 * on the eager during the accept processing. 5940 * 5941 * The acceptor stream accesses the eager in the accept processing 5942 * based on the ref placed on eager before sending T_conn_ind. 5943 * The only entity that can negate this refhold is a listener close 5944 * which is mutually exclusive with an active acceptor stream. 5945 * 5946 * Eager's reference on the listener 5947 * =================================== 5948 * 5949 * If the accept happens (even on a closed eager) the eager drops its 5950 * reference on the listener at the start of tcp_accept_finish. If the 5951 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 5952 * the reference is dropped in tcp_closei_local. If the listener closes, 5953 * the reference is dropped in tcp_eager_kill. In all cases the reference 5954 * is dropped while executing in the eager's context (squeue). 5955 */ 5956 /* END CSTYLED */ 5957 5958 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 5959 5960 /* 5961 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 5962 * tcp_rput_data will not see any SYN packets. 5963 */ 5964 /* ARGSUSED */ 5965 void 5966 tcp_conn_request(void *arg, mblk_t *mp, void *arg2) 5967 { 5968 tcph_t *tcph; 5969 uint32_t seg_seq; 5970 tcp_t *eager; 5971 uint_t ipvers; 5972 ipha_t *ipha; 5973 ip6_t *ip6h; 5974 int err; 5975 conn_t *econnp = NULL; 5976 squeue_t *new_sqp; 5977 mblk_t *mp1; 5978 uint_t ip_hdr_len; 5979 conn_t *connp = (conn_t *)arg; 5980 tcp_t *tcp = connp->conn_tcp; 5981 ire_t *ire; 5982 5983 if (tcp->tcp_state != TCPS_LISTEN) 5984 goto error2; 5985 5986 ASSERT((tcp->tcp_connp->conn_flags & IPCL_BOUND) != 0); 5987 5988 mutex_enter(&tcp->tcp_eager_lock); 5989 if (tcp->tcp_conn_req_cnt_q >= tcp->tcp_conn_req_max) { 5990 mutex_exit(&tcp->tcp_eager_lock); 5991 TCP_STAT(tcp_listendrop); 5992 BUMP_MIB(&tcp_mib, tcpListenDrop); 5993 if (tcp->tcp_debug) { 5994 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 5995 "tcp_conn_request: listen backlog (max=%d) " 5996 "overflow (%d pending) on %s", 5997 tcp->tcp_conn_req_max, tcp->tcp_conn_req_cnt_q, 5998 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 5999 } 6000 goto error2; 6001 } 6002 6003 if (tcp->tcp_conn_req_cnt_q0 >= 6004 tcp->tcp_conn_req_max + tcp_conn_req_max_q0) { 6005 /* 6006 * Q0 is full. Drop a pending half-open req from the queue 6007 * to make room for the new SYN req. Also mark the time we 6008 * drop a SYN. 6009 * 6010 * A more aggressive defense against SYN attack will 6011 * be to set the "tcp_syn_defense" flag now. 6012 */ 6013 TCP_STAT(tcp_listendropq0); 6014 tcp->tcp_last_rcv_lbolt = lbolt64; 6015 if (!tcp_drop_q0(tcp)) { 6016 mutex_exit(&tcp->tcp_eager_lock); 6017 BUMP_MIB(&tcp_mib, tcpListenDropQ0); 6018 if (tcp->tcp_debug) { 6019 (void) strlog(TCP_MODULE_ID, 0, 3, SL_TRACE, 6020 "tcp_conn_request: listen half-open queue " 6021 "(max=%d) full (%d pending) on %s", 6022 tcp_conn_req_max_q0, 6023 tcp->tcp_conn_req_cnt_q0, 6024 tcp_display(tcp, NULL, 6025 DISP_PORT_ONLY)); 6026 } 6027 goto error2; 6028 } 6029 } 6030 mutex_exit(&tcp->tcp_eager_lock); 6031 6032 /* 6033 * IP adds STRUIO_EAGER and ensures that the received packet is 6034 * M_DATA even if conn_ipv6_recvpktinfo is enabled or for ip6 6035 * link local address. If IPSec is enabled, db_struioflag has 6036 * STRUIO_POLICY set (mutually exclusive from STRUIO_EAGER); 6037 * otherwise an error case if neither of them is set. 6038 */ 6039 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 6040 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 6041 mp->b_datap->db_cksumstart = 0; 6042 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 6043 econnp = (conn_t *)tcp_get_conn(arg2); 6044 if (econnp == NULL) 6045 goto error2; 6046 econnp->conn_sqp = new_sqp; 6047 } else if ((mp->b_datap->db_struioflag & STRUIO_POLICY) != 0) { 6048 /* 6049 * mp is updated in tcp_get_ipsec_conn(). 6050 */ 6051 econnp = tcp_get_ipsec_conn(tcp, arg2, &mp); 6052 if (econnp == NULL) { 6053 /* 6054 * mp freed by tcp_get_ipsec_conn. 6055 */ 6056 return; 6057 } 6058 } else { 6059 goto error2; 6060 } 6061 6062 ASSERT(DB_TYPE(mp) == M_DATA); 6063 6064 ipvers = IPH_HDR_VERSION(mp->b_rptr); 6065 ASSERT(ipvers == IPV6_VERSION || ipvers == IPV4_VERSION); 6066 ASSERT(OK_32PTR(mp->b_rptr)); 6067 if (ipvers == IPV4_VERSION) { 6068 ipha = (ipha_t *)mp->b_rptr; 6069 ip_hdr_len = IPH_HDR_LENGTH(ipha); 6070 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 6071 } else { 6072 ip6h = (ip6_t *)mp->b_rptr; 6073 ip_hdr_len = ip_hdr_length_v6(mp, ip6h); 6074 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 6075 } 6076 6077 if (tcp->tcp_family == AF_INET) { 6078 ASSERT(ipvers == IPV4_VERSION); 6079 err = tcp_conn_create_v4(connp, econnp, ipha, tcph, mp); 6080 } else { 6081 err = tcp_conn_create_v6(connp, econnp, mp, tcph, ipvers, mp); 6082 } 6083 6084 if (err) 6085 goto error3; 6086 6087 eager = econnp->conn_tcp; 6088 6089 /* Inherit various TCP parameters from the listener */ 6090 eager->tcp_naglim = tcp->tcp_naglim; 6091 eager->tcp_first_timer_threshold = 6092 tcp->tcp_first_timer_threshold; 6093 eager->tcp_second_timer_threshold = 6094 tcp->tcp_second_timer_threshold; 6095 6096 eager->tcp_first_ctimer_threshold = 6097 tcp->tcp_first_ctimer_threshold; 6098 eager->tcp_second_ctimer_threshold = 6099 tcp->tcp_second_ctimer_threshold; 6100 6101 /* 6102 * Zones: tcp_adapt_ire() and tcp_send_data() both need the 6103 * zone id before the accept is completed in tcp_wput_accept(). 6104 */ 6105 econnp->conn_zoneid = connp->conn_zoneid; 6106 6107 eager->tcp_hard_binding = B_TRUE; 6108 6109 tcp_bind_hash_insert(&tcp_bind_fanout[ 6110 TCP_BIND_HASH(eager->tcp_lport)], eager, 0); 6111 6112 CL_INET_CONNECT(eager); 6113 6114 /* 6115 * No need to check for multicast destination since ip will only pass 6116 * up multicasts to those that have expressed interest 6117 * TODO: what about rejecting broadcasts? 6118 * Also check that source is not a multicast or broadcast address. 6119 */ 6120 eager->tcp_state = TCPS_SYN_RCVD; 6121 6122 6123 /* 6124 * There should be no ire in the mp as we are being called after 6125 * receiving the SYN. 6126 */ 6127 ASSERT(tcp_ire_mp(mp) == NULL); 6128 6129 /* 6130 * Adapt our mss, ttl, ... according to information provided in IRE. 6131 */ 6132 6133 if (tcp_adapt_ire(eager, NULL) == 0) { 6134 /* Undo the bind_hash_insert */ 6135 tcp_bind_hash_remove(eager); 6136 goto error3; 6137 } 6138 6139 /* Process all TCP options. */ 6140 tcp_process_options(eager, tcph); 6141 6142 /* Is the other end ECN capable? */ 6143 if (tcp_ecn_permitted >= 1 && 6144 (tcph->th_flags[0] & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 6145 eager->tcp_ecn_ok = B_TRUE; 6146 } 6147 6148 /* 6149 * listener->tcp_rq->q_hiwat should be the default window size or a 6150 * window size changed via SO_RCVBUF option. First round up the 6151 * eager's tcp_rwnd to the nearest MSS. Then find out the window 6152 * scale option value if needed. Call tcp_rwnd_set() to finish the 6153 * setting. 6154 * 6155 * Note if there is a rpipe metric associated with the remote host, 6156 * we should not inherit receive window size from listener. 6157 */ 6158 eager->tcp_rwnd = MSS_ROUNDUP( 6159 (eager->tcp_rwnd == 0 ? tcp->tcp_rq->q_hiwat : 6160 eager->tcp_rwnd), eager->tcp_mss); 6161 if (eager->tcp_snd_ws_ok) 6162 tcp_set_ws_value(eager); 6163 /* 6164 * Note that this is the only place tcp_rwnd_set() is called for 6165 * accepting a connection. We need to call it here instead of 6166 * after the 3-way handshake because we need to tell the other 6167 * side our rwnd in the SYN-ACK segment. 6168 */ 6169 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 6170 6171 /* 6172 * We eliminate the need for sockfs to send down a T_SVR4_OPTMGMT_REQ 6173 * via soaccept()->soinheritoptions() which essentially applies 6174 * all the listener options to the new STREAM. The options that we 6175 * need to take care of are: 6176 * SO_DEBUG, SO_REUSEADDR, SO_KEEPALIVE, SO_DONTROUTE, SO_BROADCAST, 6177 * SO_USELOOPBACK, SO_OOBINLINE, SO_DGRAM_ERRIND, SO_LINGER, 6178 * SO_SNDBUF, SO_RCVBUF. 6179 * 6180 * SO_RCVBUF: tcp_rwnd_set() above takes care of it. 6181 * SO_SNDBUF: Set the tcp_xmit_hiwater for the eager. When 6182 * tcp_maxpsz_set() gets called later from 6183 * tcp_accept_finish(), the option takes effect. 6184 * 6185 */ 6186 /* Set the TCP options */ 6187 eager->tcp_xmit_hiwater = tcp->tcp_xmit_hiwater; 6188 eager->tcp_dgram_errind = tcp->tcp_dgram_errind; 6189 eager->tcp_oobinline = tcp->tcp_oobinline; 6190 eager->tcp_reuseaddr = tcp->tcp_reuseaddr; 6191 eager->tcp_broadcast = tcp->tcp_broadcast; 6192 eager->tcp_useloopback = tcp->tcp_useloopback; 6193 eager->tcp_dontroute = tcp->tcp_dontroute; 6194 eager->tcp_linger = tcp->tcp_linger; 6195 eager->tcp_lingertime = tcp->tcp_lingertime; 6196 if (tcp->tcp_ka_enabled) 6197 eager->tcp_ka_enabled = 1; 6198 6199 /* Set the IP options */ 6200 econnp->conn_broadcast = connp->conn_broadcast; 6201 econnp->conn_loopback = connp->conn_loopback; 6202 econnp->conn_dontroute = connp->conn_dontroute; 6203 econnp->conn_reuseaddr = connp->conn_reuseaddr; 6204 6205 /* Put a ref on the listener for the eager. */ 6206 CONN_INC_REF(connp); 6207 mutex_enter(&tcp->tcp_eager_lock); 6208 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 6209 eager->tcp_eager_next_q0 = tcp->tcp_eager_next_q0; 6210 tcp->tcp_eager_next_q0 = eager; 6211 eager->tcp_eager_prev_q0 = tcp; 6212 6213 /* Set tcp_listener before adding it to tcp_conn_fanout */ 6214 eager->tcp_listener = tcp; 6215 eager->tcp_saved_listener = tcp; 6216 6217 /* 6218 * Tag this detached tcp vector for later retrieval 6219 * by our listener client in tcp_accept(). 6220 */ 6221 eager->tcp_conn_req_seqnum = tcp->tcp_conn_req_seqnum; 6222 tcp->tcp_conn_req_cnt_q0++; 6223 if (++tcp->tcp_conn_req_seqnum == -1) { 6224 /* 6225 * -1 is "special" and defined in TPI as something 6226 * that should never be used in T_CONN_IND 6227 */ 6228 ++tcp->tcp_conn_req_seqnum; 6229 } 6230 mutex_exit(&tcp->tcp_eager_lock); 6231 6232 if (tcp->tcp_syn_defense) { 6233 /* Don't drop the SYN that comes from a good IP source */ 6234 ipaddr_t *addr_cache = (ipaddr_t *)(tcp->tcp_ip_addr_cache); 6235 if (addr_cache != NULL && eager->tcp_remote == 6236 addr_cache[IP_ADDR_CACHE_HASH(eager->tcp_remote)]) { 6237 eager->tcp_dontdrop = B_TRUE; 6238 } 6239 } 6240 6241 /* 6242 * We need to insert the eager in its own perimeter but as soon 6243 * as we do that, we expose the eager to the classifier and 6244 * should not touch any field outside the eager's perimeter. 6245 * So do all the work necessary before inserting the eager 6246 * in its own perimeter. Be optimistic that ipcl_conn_insert() 6247 * will succeed but undo everything if it fails. 6248 */ 6249 seg_seq = ABE32_TO_U32(tcph->th_seq); 6250 eager->tcp_irs = seg_seq; 6251 eager->tcp_rack = seg_seq; 6252 eager->tcp_rnxt = seg_seq + 1; 6253 U32_TO_ABE32(eager->tcp_rnxt, eager->tcp_tcph->th_ack); 6254 BUMP_MIB(&tcp_mib, tcpPassiveOpens); 6255 eager->tcp_state = TCPS_SYN_RCVD; 6256 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 6257 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 6258 if (mp1 == NULL) 6259 goto error1; 6260 mblk_setcred(mp1, tcp->tcp_cred); 6261 DB_CPID(mp1) = tcp->tcp_cpid; 6262 6263 /* 6264 * We need to start the rto timer. In normal case, we start 6265 * the timer after sending the packet on the wire (or at 6266 * least believing that packet was sent by waiting for 6267 * CALL_IP_WPUT() to return). Since this is the first packet 6268 * being sent on the wire for the eager, our initial tcp_rto 6269 * is at least tcp_rexmit_interval_min which is a fairly 6270 * large value to allow the algorithm to adjust slowly to large 6271 * fluctuations of RTT during first few transmissions. 6272 * 6273 * Starting the timer first and then sending the packet in this 6274 * case shouldn't make much difference since tcp_rexmit_interval_min 6275 * is of the order of several 100ms and starting the timer 6276 * first and then sending the packet will result in difference 6277 * of few micro seconds. 6278 * 6279 * Without this optimization, we are forced to hold the fanout 6280 * lock across the ipcl_bind_insert() and sending the packet 6281 * so that we don't race against an incoming packet (maybe RST) 6282 * for this eager. 6283 */ 6284 6285 TCP_RECORD_TRACE(eager, mp1, TCP_TRACE_SEND_PKT); 6286 TCP_TIMER_RESTART(eager, eager->tcp_rto); 6287 6288 6289 /* 6290 * Insert the eager in its own perimeter now. We are ready to deal 6291 * with any packets on eager. 6292 */ 6293 if (eager->tcp_ipversion == IPV4_VERSION) { 6294 if (ipcl_conn_insert(econnp, IPPROTO_TCP, 0, 0, 0) != 0) { 6295 goto error; 6296 } 6297 } else { 6298 if (ipcl_conn_insert_v6(econnp, IPPROTO_TCP, 0, 0, 0, 0) != 0) { 6299 goto error; 6300 } 6301 } 6302 6303 /* mark conn as fully-bound */ 6304 econnp->conn_fully_bound = B_TRUE; 6305 6306 /* Send the SYN-ACK */ 6307 tcp_send_data(eager, eager->tcp_wq, mp1); 6308 freemsg(mp); 6309 6310 return; 6311 error: 6312 (void) TCP_TIMER_CANCEL(eager, eager->tcp_timer_tid); 6313 freemsg(mp1); 6314 error1: 6315 /* Undo what we did above */ 6316 mutex_enter(&tcp->tcp_eager_lock); 6317 tcp_eager_unlink(eager); 6318 mutex_exit(&tcp->tcp_eager_lock); 6319 /* Drop eager's reference on the listener */ 6320 CONN_DEC_REF(connp); 6321 6322 /* 6323 * Delete the cached ire in conn_ire_cache and also mark 6324 * the conn as CONDEMNED 6325 */ 6326 mutex_enter(&econnp->conn_lock); 6327 econnp->conn_state_flags |= CONN_CONDEMNED; 6328 ire = econnp->conn_ire_cache; 6329 econnp->conn_ire_cache = NULL; 6330 mutex_exit(&econnp->conn_lock); 6331 if (ire != NULL) 6332 IRE_REFRELE_NOTR(ire); 6333 6334 /* 6335 * tcp_accept_comm inserts the eager to the bind_hash 6336 * we need to remove it from the hash if ipcl_conn_insert 6337 * fails. 6338 */ 6339 tcp_bind_hash_remove(eager); 6340 /* Drop the eager ref placed in tcp_open_detached */ 6341 CONN_DEC_REF(econnp); 6342 6343 /* 6344 * If a connection already exists, send the mp to that connections so 6345 * that it can be appropriately dealt with. 6346 */ 6347 if ((econnp = ipcl_classify(mp, connp->conn_zoneid)) != NULL) { 6348 if (!IPCL_IS_CONNECTED(econnp)) { 6349 /* 6350 * Something bad happened. ipcl_conn_insert() 6351 * failed because a connection already existed 6352 * in connected hash but we can't find it 6353 * anymore (someone blew it away). Just 6354 * free this message and hopefully remote 6355 * will retransmit at which time the SYN can be 6356 * treated as a new connection or dealth with 6357 * a TH_RST if a connection already exists. 6358 */ 6359 freemsg(mp); 6360 } else { 6361 squeue_fill(econnp->conn_sqp, mp, tcp_input, 6362 econnp, SQTAG_TCP_CONN_REQ); 6363 } 6364 } else { 6365 /* Nobody wants this packet */ 6366 freemsg(mp); 6367 } 6368 return; 6369 error2: 6370 freemsg(mp); 6371 return; 6372 error3: 6373 CONN_DEC_REF(econnp); 6374 freemsg(mp); 6375 } 6376 6377 /* 6378 * In an ideal case of vertical partition in NUMA architecture, its 6379 * beneficial to have the listener and all the incoming connections 6380 * tied to the same squeue. The other constraint is that incoming 6381 * connections should be tied to the squeue attached to interrupted 6382 * CPU for obvious locality reason so this leaves the listener to 6383 * be tied to the same squeue. Our only problem is that when listener 6384 * is binding, the CPU that will get interrupted by the NIC whose 6385 * IP address the listener is binding to is not even known. So 6386 * the code below allows us to change that binding at the time the 6387 * CPU is interrupted by virtue of incoming connection's squeue. 6388 * 6389 * This is usefull only in case of a listener bound to a specific IP 6390 * address. For other kind of listeners, they get bound the 6391 * very first time and there is no attempt to rebind them. 6392 */ 6393 void 6394 tcp_conn_request_unbound(void *arg, mblk_t *mp, void *arg2) 6395 { 6396 conn_t *connp = (conn_t *)arg; 6397 squeue_t *sqp = (squeue_t *)arg2; 6398 squeue_t *new_sqp; 6399 uint32_t conn_flags; 6400 6401 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 6402 new_sqp = (squeue_t *)mp->b_datap->db_cksumstart; 6403 } else { 6404 goto done; 6405 } 6406 6407 if (connp->conn_fanout == NULL) 6408 goto done; 6409 6410 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 6411 mutex_enter(&connp->conn_fanout->connf_lock); 6412 mutex_enter(&connp->conn_lock); 6413 /* 6414 * No one from read or write side can access us now 6415 * except for already queued packets on this squeue. 6416 * But since we haven't changed the squeue yet, they 6417 * can't execute. If they are processed after we have 6418 * changed the squeue, they are sent back to the 6419 * correct squeue down below. 6420 */ 6421 if (connp->conn_sqp != new_sqp) { 6422 while (connp->conn_sqp != new_sqp) 6423 (void) casptr(&connp->conn_sqp, sqp, new_sqp); 6424 } 6425 6426 do { 6427 conn_flags = connp->conn_flags; 6428 conn_flags |= IPCL_FULLY_BOUND; 6429 (void) cas32(&connp->conn_flags, connp->conn_flags, 6430 conn_flags); 6431 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 6432 6433 mutex_exit(&connp->conn_fanout->connf_lock); 6434 mutex_exit(&connp->conn_lock); 6435 } 6436 6437 done: 6438 if (connp->conn_sqp != sqp) { 6439 CONN_INC_REF(connp); 6440 squeue_fill(connp->conn_sqp, mp, 6441 connp->conn_recv, connp, SQTAG_TCP_CONN_REQ_UNBOUND); 6442 } else { 6443 tcp_conn_request(connp, mp, sqp); 6444 } 6445 } 6446 6447 /* 6448 * Successful connect request processing begins when our client passes 6449 * a T_CONN_REQ message into tcp_wput() and ends when tcp_rput() passes 6450 * our T_OK_ACK reply message upstream. The control flow looks like this: 6451 * upstream -> tcp_wput() -> tcp_wput_proto() -> tcp_connect() -> IP 6452 * upstream <- tcp_rput() <- IP 6453 * After various error checks are completed, tcp_connect() lays 6454 * the target address and port into the composite header template, 6455 * preallocates the T_OK_ACK reply message, construct a full 12 byte bind 6456 * request followed by an IRE request, and passes the three mblk message 6457 * down to IP looking like this: 6458 * O_T_BIND_REQ for IP --> IRE req --> T_OK_ACK for our client 6459 * Processing continues in tcp_rput() when we receive the following message: 6460 * T_BIND_ACK from IP --> IRE ack --> T_OK_ACK for our client 6461 * After consuming the first two mblks, tcp_rput() calls tcp_timer(), 6462 * to fire off the connection request, and then passes the T_OK_ACK mblk 6463 * upstream that we filled in below. There are, of course, numerous 6464 * error conditions along the way which truncate the processing described 6465 * above. 6466 */ 6467 static void 6468 tcp_connect(tcp_t *tcp, mblk_t *mp) 6469 { 6470 sin_t *sin; 6471 sin6_t *sin6; 6472 in_port_t lport; 6473 queue_t *q = tcp->tcp_wq; 6474 struct T_conn_req *tcr; 6475 ipaddr_t *dstaddrp; 6476 in_port_t dstport; 6477 uint_t srcid; 6478 6479 tcr = (struct T_conn_req *)mp->b_rptr; 6480 6481 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 6482 if ((mp->b_wptr - mp->b_rptr) < sizeof (*tcr)) { 6483 tcp_err_ack(tcp, mp, TPROTO, 0); 6484 return; 6485 } 6486 6487 /* 6488 * Determine packet type based on type of address passed in 6489 * the request should contain an IPv4 or IPv6 address. 6490 * Make sure that address family matches the type of 6491 * family of the the address passed down 6492 */ 6493 switch (tcr->DEST_length) { 6494 default: 6495 tcp_err_ack(tcp, mp, TBADADDR, 0); 6496 return; 6497 6498 case (sizeof (sin_t) - sizeof (sin->sin_zero)): { 6499 /* 6500 * XXX: The check for valid DEST_length was not there 6501 * in earlier releases and some buggy 6502 * TLI apps (e.g Sybase) got away with not feeding 6503 * in sin_zero part of address. 6504 * We allow that bug to keep those buggy apps humming. 6505 * Test suites require the check on DEST_length. 6506 * We construct a new mblk with valid DEST_length 6507 * free the original so the rest of the code does 6508 * not have to keep track of this special shorter 6509 * length address case. 6510 */ 6511 mblk_t *nmp; 6512 struct T_conn_req *ntcr; 6513 sin_t *nsin; 6514 6515 nmp = allocb(sizeof (struct T_conn_req) + sizeof (sin_t) + 6516 tcr->OPT_length, BPRI_HI); 6517 if (nmp == NULL) { 6518 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 6519 return; 6520 } 6521 ntcr = (struct T_conn_req *)nmp->b_rptr; 6522 bzero(ntcr, sizeof (struct T_conn_req)); /* zero fill */ 6523 ntcr->PRIM_type = T_CONN_REQ; 6524 ntcr->DEST_length = sizeof (sin_t); 6525 ntcr->DEST_offset = sizeof (struct T_conn_req); 6526 6527 nsin = (sin_t *)((uchar_t *)ntcr + ntcr->DEST_offset); 6528 *nsin = sin_null; 6529 /* Get pointer to shorter address to copy from original mp */ 6530 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6531 tcr->DEST_length); /* extract DEST_length worth of sin_t */ 6532 if (sin == NULL || !OK_32PTR((char *)sin)) { 6533 freemsg(nmp); 6534 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6535 return; 6536 } 6537 nsin->sin_family = sin->sin_family; 6538 nsin->sin_port = sin->sin_port; 6539 nsin->sin_addr = sin->sin_addr; 6540 /* Note:nsin->sin_zero zero-fill with sin_null assign above */ 6541 nmp->b_wptr = (uchar_t *)&nsin[1]; 6542 if (tcr->OPT_length != 0) { 6543 ntcr->OPT_length = tcr->OPT_length; 6544 ntcr->OPT_offset = nmp->b_wptr - nmp->b_rptr; 6545 bcopy((uchar_t *)tcr + tcr->OPT_offset, 6546 (uchar_t *)ntcr + ntcr->OPT_offset, 6547 tcr->OPT_length); 6548 nmp->b_wptr += tcr->OPT_length; 6549 } 6550 freemsg(mp); /* original mp freed */ 6551 mp = nmp; /* re-initialize original variables */ 6552 tcr = ntcr; 6553 } 6554 /* FALLTHRU */ 6555 6556 case sizeof (sin_t): 6557 sin = (sin_t *)mi_offset_param(mp, tcr->DEST_offset, 6558 sizeof (sin_t)); 6559 if (sin == NULL || !OK_32PTR((char *)sin)) { 6560 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6561 return; 6562 } 6563 if (tcp->tcp_family != AF_INET || 6564 sin->sin_family != AF_INET) { 6565 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6566 return; 6567 } 6568 if (sin->sin_port == 0) { 6569 tcp_err_ack(tcp, mp, TBADADDR, 0); 6570 return; 6571 } 6572 if (tcp->tcp_connp && tcp->tcp_connp->conn_ipv6_v6only) { 6573 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6574 return; 6575 } 6576 6577 break; 6578 6579 case sizeof (sin6_t): 6580 sin6 = (sin6_t *)mi_offset_param(mp, tcr->DEST_offset, 6581 sizeof (sin6_t)); 6582 if (sin6 == NULL || !OK_32PTR((char *)sin6)) { 6583 tcp_err_ack(tcp, mp, TSYSERR, EINVAL); 6584 return; 6585 } 6586 if (tcp->tcp_family != AF_INET6 || 6587 sin6->sin6_family != AF_INET6) { 6588 tcp_err_ack(tcp, mp, TSYSERR, EAFNOSUPPORT); 6589 return; 6590 } 6591 if (sin6->sin6_port == 0) { 6592 tcp_err_ack(tcp, mp, TBADADDR, 0); 6593 return; 6594 } 6595 break; 6596 } 6597 /* 6598 * TODO: If someone in TCPS_TIME_WAIT has this dst/port we 6599 * should key on their sequence number and cut them loose. 6600 */ 6601 6602 /* 6603 * If options passed in, feed it for verification and handling 6604 */ 6605 if (tcr->OPT_length != 0) { 6606 mblk_t *ok_mp; 6607 mblk_t *discon_mp; 6608 mblk_t *conn_opts_mp; 6609 int t_error, sys_error, do_disconnect; 6610 6611 conn_opts_mp = NULL; 6612 6613 if (tcp_conprim_opt_process(tcp, mp, 6614 &do_disconnect, &t_error, &sys_error) < 0) { 6615 if (do_disconnect) { 6616 ASSERT(t_error == 0 && sys_error == 0); 6617 discon_mp = mi_tpi_discon_ind(NULL, 6618 ECONNREFUSED, 0); 6619 if (!discon_mp) { 6620 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6621 TSYSERR, ENOMEM); 6622 return; 6623 } 6624 ok_mp = mi_tpi_ok_ack_alloc(mp); 6625 if (!ok_mp) { 6626 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6627 TSYSERR, ENOMEM); 6628 return; 6629 } 6630 qreply(q, ok_mp); 6631 qreply(q, discon_mp); /* no flush! */ 6632 } else { 6633 ASSERT(t_error != 0); 6634 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, t_error, 6635 sys_error); 6636 } 6637 return; 6638 } 6639 /* 6640 * Success in setting options, the mp option buffer represented 6641 * by OPT_length/offset has been potentially modified and 6642 * contains results of option processing. We copy it in 6643 * another mp to save it for potentially influencing returning 6644 * it in T_CONN_CONN. 6645 */ 6646 if (tcr->OPT_length != 0) { /* there are resulting options */ 6647 conn_opts_mp = copyb(mp); 6648 if (!conn_opts_mp) { 6649 tcp_err_ack_prim(tcp, mp, T_CONN_REQ, 6650 TSYSERR, ENOMEM); 6651 return; 6652 } 6653 ASSERT(tcp->tcp_conn.tcp_opts_conn_req == NULL); 6654 tcp->tcp_conn.tcp_opts_conn_req = conn_opts_mp; 6655 /* 6656 * Note: 6657 * These resulting option negotiation can include any 6658 * end-to-end negotiation options but there no such 6659 * thing (yet?) in our TCP/IP. 6660 */ 6661 } 6662 } 6663 6664 /* 6665 * If we're connecting to an IPv4-mapped IPv6 address, we need to 6666 * make sure that the template IP header in the tcp structure is an 6667 * IPv4 header, and that the tcp_ipversion is IPV4_VERSION. We 6668 * need to this before we call tcp_bindi() so that the port lookup 6669 * code will look for ports in the correct port space (IPv4 and 6670 * IPv6 have separate port spaces). 6671 */ 6672 if (tcp->tcp_family == AF_INET6 && tcp->tcp_ipversion == IPV6_VERSION && 6673 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6674 int err = 0; 6675 6676 err = tcp_header_init_ipv4(tcp); 6677 if (err != 0) { 6678 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6679 goto connect_failed; 6680 } 6681 if (tcp->tcp_lport != 0) 6682 *(uint16_t *)tcp->tcp_tcph->th_lport = tcp->tcp_lport; 6683 } 6684 6685 switch (tcp->tcp_state) { 6686 case TCPS_IDLE: 6687 /* 6688 * We support a quick connect capability here, allowing 6689 * clients to transition directly from IDLE to SYN_SENT 6690 * tcp_bindi will pick an unused port, insert the connection 6691 * in the bind hash and transition to BOUND state. 6692 */ 6693 lport = tcp_update_next_port(tcp_next_port_to_try, B_TRUE); 6694 lport = tcp_bindi(tcp, lport, &ipv6_all_zeros, 0, 0, 0); 6695 if (lport == 0) { 6696 mp = mi_tpi_err_ack_alloc(mp, TNOADDR, 0); 6697 break; 6698 } 6699 /* FALLTHRU */ 6700 6701 case TCPS_BOUND: 6702 case TCPS_LISTEN: 6703 if (tcp->tcp_family == AF_INET6) { 6704 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 6705 tcp_connect_ipv6(tcp, mp, 6706 &sin6->sin6_addr, 6707 sin6->sin6_port, sin6->sin6_flowinfo, 6708 sin6->__sin6_src_id, sin6->sin6_scope_id); 6709 return; 6710 } 6711 /* 6712 * Destination adress is mapped IPv6 address. 6713 * Source bound address should be unspecified or 6714 * IPv6 mapped address as well. 6715 */ 6716 if (!IN6_IS_ADDR_UNSPECIFIED( 6717 &tcp->tcp_bound_source_v6) && 6718 !IN6_IS_ADDR_V4MAPPED(&tcp->tcp_bound_source_v6)) { 6719 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, 6720 EADDRNOTAVAIL); 6721 break; 6722 } 6723 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 6724 dstport = sin6->sin6_port; 6725 srcid = sin6->__sin6_src_id; 6726 } else { 6727 dstaddrp = &sin->sin_addr.s_addr; 6728 dstport = sin->sin_port; 6729 srcid = 0; 6730 } 6731 6732 tcp_connect_ipv4(tcp, mp, dstaddrp, dstport, srcid); 6733 return; 6734 default: 6735 mp = mi_tpi_err_ack_alloc(mp, TOUTSTATE, 0); 6736 break; 6737 } 6738 /* 6739 * Note: Code below is the "failure" case 6740 */ 6741 /* return error ack and blow away saved option results if any */ 6742 connect_failed: 6743 if (mp != NULL) 6744 putnext(tcp->tcp_rq, mp); 6745 else { 6746 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6747 TSYSERR, ENOMEM); 6748 } 6749 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6750 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6751 } 6752 6753 /* 6754 * Handle connect to IPv4 destinations, including connections for AF_INET6 6755 * sockets connecting to IPv4 mapped IPv6 destinations. 6756 */ 6757 static void 6758 tcp_connect_ipv4(tcp_t *tcp, mblk_t *mp, ipaddr_t *dstaddrp, in_port_t dstport, 6759 uint_t srcid) 6760 { 6761 tcph_t *tcph; 6762 mblk_t *mp1; 6763 ipaddr_t dstaddr = *dstaddrp; 6764 int32_t oldstate; 6765 6766 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 6767 6768 /* Check for attempt to connect to INADDR_ANY */ 6769 if (dstaddr == INADDR_ANY) { 6770 /* 6771 * SunOS 4.x and 4.3 BSD allow an application 6772 * to connect a TCP socket to INADDR_ANY. 6773 * When they do this, the kernel picks the 6774 * address of one interface and uses it 6775 * instead. The kernel usually ends up 6776 * picking the address of the loopback 6777 * interface. This is an undocumented feature. 6778 * However, we provide the same thing here 6779 * in order to have source and binary 6780 * compatibility with SunOS 4.x. 6781 * Update the T_CONN_REQ (sin/sin6) since it is used to 6782 * generate the T_CONN_CON. 6783 */ 6784 dstaddr = htonl(INADDR_LOOPBACK); 6785 *dstaddrp = dstaddr; 6786 } 6787 6788 /* Handle __sin6_src_id if socket not bound to an IP address */ 6789 if (srcid != 0 && tcp->tcp_ipha->ipha_src == INADDR_ANY) { 6790 ip_srcid_find_id(srcid, &tcp->tcp_ip_src_v6, 6791 tcp->tcp_connp->conn_zoneid); 6792 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_ip_src_v6, 6793 tcp->tcp_ipha->ipha_src); 6794 } 6795 6796 /* 6797 * Don't let an endpoint connect to itself. Note that 6798 * the test here does not catch the case where the 6799 * source IP addr was left unspecified by the user. In 6800 * this case, the source addr is set in tcp_adapt_ire() 6801 * using the reply to the T_BIND message that we send 6802 * down to IP here and the check is repeated in tcp_rput_other. 6803 */ 6804 if (dstaddr == tcp->tcp_ipha->ipha_src && 6805 dstport == tcp->tcp_lport) { 6806 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6807 goto failed; 6808 } 6809 6810 tcp->tcp_ipha->ipha_dst = dstaddr; 6811 IN6_IPADDR_TO_V4MAPPED(dstaddr, &tcp->tcp_remote_v6); 6812 6813 /* 6814 * Massage a source route if any putting the first hop 6815 * in iph_dst. Compute a starting value for the checksum which 6816 * takes into account that the original iph_dst should be 6817 * included in the checksum but that ip will include the 6818 * first hop in the source route in the tcp checksum. 6819 */ 6820 tcp->tcp_sum = ip_massage_options(tcp->tcp_ipha); 6821 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6822 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 6823 (tcp->tcp_ipha->ipha_dst & 0xffff)); 6824 if ((int)tcp->tcp_sum < 0) 6825 tcp->tcp_sum--; 6826 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 6827 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 6828 (tcp->tcp_sum >> 16)); 6829 tcph = tcp->tcp_tcph; 6830 *(uint16_t *)tcph->th_fport = dstport; 6831 tcp->tcp_fport = dstport; 6832 6833 oldstate = tcp->tcp_state; 6834 tcp->tcp_state = TCPS_SYN_SENT; 6835 6836 /* 6837 * TODO: allow data with connect requests 6838 * by unlinking M_DATA trailers here and 6839 * linking them in behind the T_OK_ACK mblk. 6840 * The tcp_rput() bind ack handler would then 6841 * feed them to tcp_wput_data() rather than call 6842 * tcp_timer(). 6843 */ 6844 mp = mi_tpi_ok_ack_alloc(mp); 6845 if (!mp) { 6846 tcp->tcp_state = oldstate; 6847 goto failed; 6848 } 6849 if (tcp->tcp_family == AF_INET) { 6850 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6851 sizeof (ipa_conn_t)); 6852 } else { 6853 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 6854 sizeof (ipa6_conn_t)); 6855 } 6856 if (mp1) { 6857 /* Hang onto the T_OK_ACK for later. */ 6858 linkb(mp1, mp); 6859 if (tcp->tcp_family == AF_INET) 6860 mp1 = ip_bind_v4(tcp->tcp_wq, mp1, tcp->tcp_connp); 6861 else { 6862 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 6863 &tcp->tcp_sticky_ipp); 6864 } 6865 BUMP_MIB(&tcp_mib, tcpActiveOpens); 6866 tcp->tcp_active_open = 1; 6867 /* 6868 * If the bind cannot complete immediately 6869 * IP will arrange to call tcp_rput_other 6870 * when the bind completes. 6871 */ 6872 if (mp1 != NULL) 6873 tcp_rput_other(tcp, mp1); 6874 return; 6875 } 6876 /* Error case */ 6877 tcp->tcp_state = oldstate; 6878 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 6879 6880 failed: 6881 /* return error ack and blow away saved option results if any */ 6882 if (mp != NULL) 6883 putnext(tcp->tcp_rq, mp); 6884 else { 6885 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 6886 TSYSERR, ENOMEM); 6887 } 6888 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 6889 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 6890 6891 } 6892 6893 /* 6894 * Handle connect to IPv6 destinations. 6895 */ 6896 static void 6897 tcp_connect_ipv6(tcp_t *tcp, mblk_t *mp, in6_addr_t *dstaddrp, 6898 in_port_t dstport, uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 6899 { 6900 tcph_t *tcph; 6901 mblk_t *mp1; 6902 ip6_rthdr_t *rth; 6903 int32_t oldstate; 6904 6905 ASSERT(tcp->tcp_family == AF_INET6); 6906 6907 /* 6908 * If we're here, it means that the destination address is a native 6909 * IPv6 address. Return an error if tcp_ipversion is not IPv6. A 6910 * reason why it might not be IPv6 is if the socket was bound to an 6911 * IPv4-mapped IPv6 address. 6912 */ 6913 if (tcp->tcp_ipversion != IPV6_VERSION) { 6914 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6915 goto failed; 6916 } 6917 6918 /* 6919 * Interpret a zero destination to mean loopback. 6920 * Update the T_CONN_REQ (sin/sin6) since it is used to 6921 * generate the T_CONN_CON. 6922 */ 6923 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) { 6924 *dstaddrp = ipv6_loopback; 6925 } 6926 6927 /* Handle __sin6_src_id if socket not bound to an IP address */ 6928 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip6h->ip6_src)) { 6929 ip_srcid_find_id(srcid, &tcp->tcp_ip6h->ip6_src, 6930 tcp->tcp_connp->conn_zoneid); 6931 tcp->tcp_ip_src_v6 = tcp->tcp_ip6h->ip6_src; 6932 } 6933 6934 /* 6935 * Take care of the scope_id now and add ip6i_t 6936 * if ip6i_t is not already allocated through TCP 6937 * sticky options. At this point tcp_ip6h does not 6938 * have dst info, thus use dstaddrp. 6939 */ 6940 if (scope_id != 0 && 6941 IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 6942 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 6943 ip6i_t *ip6i; 6944 6945 ipp->ipp_ifindex = scope_id; 6946 ip6i = (ip6i_t *)tcp->tcp_iphc; 6947 6948 if ((ipp->ipp_fields & IPPF_HAS_IP6I) && 6949 ip6i != NULL && (ip6i->ip6i_nxt == IPPROTO_RAW)) { 6950 /* Already allocated */ 6951 ip6i->ip6i_flags |= IP6I_IFINDEX; 6952 ip6i->ip6i_ifindex = ipp->ipp_ifindex; 6953 ipp->ipp_fields |= IPPF_SCOPE_ID; 6954 } else { 6955 int reterr; 6956 6957 ipp->ipp_fields |= IPPF_SCOPE_ID; 6958 if (ipp->ipp_fields & IPPF_HAS_IP6I) 6959 ip2dbg(("tcp_connect_v6: SCOPE_ID set\n")); 6960 reterr = tcp_build_hdrs(tcp->tcp_rq, tcp); 6961 if (reterr != 0) 6962 goto failed; 6963 ip1dbg(("tcp_connect_ipv6: tcp_bld_hdrs returned\n")); 6964 } 6965 } 6966 6967 /* 6968 * Don't let an endpoint connect to itself. Note that 6969 * the test here does not catch the case where the 6970 * source IP addr was left unspecified by the user. In 6971 * this case, the source addr is set in tcp_adapt_ire() 6972 * using the reply to the T_BIND message that we send 6973 * down to IP here and the check is repeated in tcp_rput_other. 6974 */ 6975 if (IN6_ARE_ADDR_EQUAL(dstaddrp, &tcp->tcp_ip6h->ip6_src) && 6976 (dstport == tcp->tcp_lport)) { 6977 mp = mi_tpi_err_ack_alloc(mp, TBADADDR, 0); 6978 goto failed; 6979 } 6980 6981 tcp->tcp_ip6h->ip6_dst = *dstaddrp; 6982 tcp->tcp_remote_v6 = *dstaddrp; 6983 tcp->tcp_ip6h->ip6_vcf = 6984 (IPV6_DEFAULT_VERS_AND_FLOW & IPV6_VERS_AND_FLOW_MASK) | 6985 (flowinfo & ~IPV6_VERS_AND_FLOW_MASK); 6986 6987 6988 /* 6989 * Massage a routing header (if present) putting the first hop 6990 * in ip6_dst. Compute a starting value for the checksum which 6991 * takes into account that the original ip6_dst should be 6992 * included in the checksum but that ip will include the 6993 * first hop in the source route in the tcp checksum. 6994 */ 6995 rth = ip_find_rthdr_v6(tcp->tcp_ip6h, (uint8_t *)tcp->tcp_tcph); 6996 if (rth != NULL) { 6997 6998 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, rth); 6999 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 7000 (tcp->tcp_sum >> 16)); 7001 } else { 7002 tcp->tcp_sum = 0; 7003 } 7004 7005 tcph = tcp->tcp_tcph; 7006 *(uint16_t *)tcph->th_fport = dstport; 7007 tcp->tcp_fport = dstport; 7008 7009 oldstate = tcp->tcp_state; 7010 tcp->tcp_state = TCPS_SYN_SENT; 7011 7012 /* 7013 * TODO: allow data with connect requests 7014 * by unlinking M_DATA trailers here and 7015 * linking them in behind the T_OK_ACK mblk. 7016 * The tcp_rput() bind ack handler would then 7017 * feed them to tcp_wput_data() rather than call 7018 * tcp_timer(). 7019 */ 7020 mp = mi_tpi_ok_ack_alloc(mp); 7021 if (!mp) { 7022 tcp->tcp_state = oldstate; 7023 goto failed; 7024 } 7025 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, sizeof (ipa6_conn_t)); 7026 if (mp1) { 7027 /* Hang onto the T_OK_ACK for later. */ 7028 linkb(mp1, mp); 7029 mp1 = ip_bind_v6(tcp->tcp_wq, mp1, tcp->tcp_connp, 7030 &tcp->tcp_sticky_ipp); 7031 BUMP_MIB(&tcp_mib, tcpActiveOpens); 7032 tcp->tcp_active_open = 1; 7033 /* ip_bind_v6() may return ACK or ERROR */ 7034 if (mp1 != NULL) 7035 tcp_rput_other(tcp, mp1); 7036 return; 7037 } 7038 /* Error case */ 7039 tcp->tcp_state = oldstate; 7040 mp = mi_tpi_err_ack_alloc(mp, TSYSERR, ENOMEM); 7041 7042 failed: 7043 /* return error ack and blow away saved option results if any */ 7044 if (mp != NULL) 7045 putnext(tcp->tcp_rq, mp); 7046 else { 7047 tcp_err_ack_prim(tcp, NULL, T_CONN_REQ, 7048 TSYSERR, ENOMEM); 7049 } 7050 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 7051 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 7052 } 7053 7054 /* 7055 * We need a stream q for detached closing tcp connections 7056 * to use. Our client hereby indicates that this q is the 7057 * one to use. 7058 */ 7059 static void 7060 tcp_def_q_set(tcp_t *tcp, mblk_t *mp) 7061 { 7062 struct iocblk *iocp = (struct iocblk *)mp->b_rptr; 7063 queue_t *q = tcp->tcp_wq; 7064 7065 mp->b_datap->db_type = M_IOCACK; 7066 iocp->ioc_count = 0; 7067 mutex_enter(&tcp_g_q_lock); 7068 if (tcp_g_q != NULL) { 7069 mutex_exit(&tcp_g_q_lock); 7070 iocp->ioc_error = EALREADY; 7071 } else { 7072 mblk_t *mp1; 7073 7074 mp1 = tcp_ip_bind_mp(tcp, O_T_BIND_REQ, 0); 7075 if (mp1 == NULL) { 7076 mutex_exit(&tcp_g_q_lock); 7077 iocp->ioc_error = ENOMEM; 7078 } else { 7079 tcp_g_q = tcp->tcp_rq; 7080 mutex_exit(&tcp_g_q_lock); 7081 iocp->ioc_error = 0; 7082 iocp->ioc_rval = 0; 7083 /* 7084 * We are passing tcp_sticky_ipp as NULL 7085 * as it is not useful for tcp_default queue 7086 */ 7087 mp1 = ip_bind_v6(q, mp1, tcp->tcp_connp, NULL); 7088 if (mp1 != NULL) 7089 tcp_rput_other(tcp, mp1); 7090 } 7091 } 7092 qreply(q, mp); 7093 } 7094 7095 /* 7096 * Our client hereby directs us to reject the connection request 7097 * that tcp_conn_request() marked with 'seqnum'. Rejection consists 7098 * of sending the appropriate RST, not an ICMP error. 7099 */ 7100 static void 7101 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 7102 { 7103 tcp_t *ltcp = NULL; 7104 t_scalar_t seqnum; 7105 conn_t *connp; 7106 7107 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 7108 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 7109 tcp_err_ack(tcp, mp, TPROTO, 0); 7110 return; 7111 } 7112 7113 /* 7114 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 7115 * when the stream is in BOUND state. Do not send a reset, 7116 * since the destination IP address is not valid, and it can 7117 * be the initialized value of all zeros (broadcast address). 7118 * 7119 * If TCP has sent down a bind request to IP and has not 7120 * received the reply, reject the request. Otherwise, TCP 7121 * will be confused. 7122 */ 7123 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_hard_binding) { 7124 if (tcp->tcp_debug) { 7125 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 7126 "tcp_disconnect: bad state, %d", tcp->tcp_state); 7127 } 7128 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 7129 return; 7130 } 7131 7132 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 7133 7134 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 7135 7136 /* 7137 * According to TPI, for non-listeners, ignore seqnum 7138 * and disconnect. 7139 * Following interpretation of -1 seqnum is historical 7140 * and implied TPI ? (TPI only states that for T_CONN_IND, 7141 * a valid seqnum should not be -1). 7142 * 7143 * -1 means disconnect everything 7144 * regardless even on a listener. 7145 */ 7146 7147 int old_state = tcp->tcp_state; 7148 7149 /* 7150 * The connection can't be on the tcp_time_wait_head list 7151 * since it is not detached. 7152 */ 7153 ASSERT(tcp->tcp_time_wait_next == NULL); 7154 ASSERT(tcp->tcp_time_wait_prev == NULL); 7155 ASSERT(tcp->tcp_time_wait_expire == 0); 7156 ltcp = NULL; 7157 /* 7158 * If it used to be a listener, check to make sure no one else 7159 * has taken the port before switching back to LISTEN state. 7160 */ 7161 if (tcp->tcp_ipversion == IPV4_VERSION) { 7162 connp = ipcl_lookup_listener_v4(tcp->tcp_lport, 7163 tcp->tcp_ipha->ipha_src, 7164 tcp->tcp_connp->conn_zoneid); 7165 if (connp != NULL) 7166 ltcp = connp->conn_tcp; 7167 } else { 7168 /* Allow tcp_bound_if listeners? */ 7169 connp = ipcl_lookup_listener_v6(tcp->tcp_lport, 7170 &tcp->tcp_ip6h->ip6_src, 0, 7171 tcp->tcp_connp->conn_zoneid); 7172 if (connp != NULL) 7173 ltcp = connp->conn_tcp; 7174 } 7175 if (tcp->tcp_conn_req_max && ltcp == NULL) { 7176 tcp->tcp_state = TCPS_LISTEN; 7177 } else if (old_state > TCPS_BOUND) { 7178 tcp->tcp_conn_req_max = 0; 7179 tcp->tcp_state = TCPS_BOUND; 7180 } 7181 if (ltcp != NULL) 7182 CONN_DEC_REF(ltcp->tcp_connp); 7183 if (old_state == TCPS_SYN_SENT || old_state == TCPS_SYN_RCVD) { 7184 BUMP_MIB(&tcp_mib, tcpAttemptFails); 7185 } else if (old_state == TCPS_ESTABLISHED || 7186 old_state == TCPS_CLOSE_WAIT) { 7187 BUMP_MIB(&tcp_mib, tcpEstabResets); 7188 } 7189 7190 if (tcp->tcp_fused) 7191 tcp_unfuse(tcp); 7192 7193 mutex_enter(&tcp->tcp_eager_lock); 7194 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 7195 (tcp->tcp_conn_req_cnt_q != 0)) { 7196 tcp_eager_cleanup(tcp, 0); 7197 } 7198 mutex_exit(&tcp->tcp_eager_lock); 7199 7200 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 7201 tcp->tcp_rnxt, TH_RST | TH_ACK); 7202 7203 tcp_reinit(tcp); 7204 7205 if (old_state >= TCPS_ESTABLISHED) { 7206 /* Send M_FLUSH according to TPI */ 7207 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 7208 } 7209 mp = mi_tpi_ok_ack_alloc(mp); 7210 if (mp) 7211 putnext(tcp->tcp_rq, mp); 7212 return; 7213 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 7214 tcp_err_ack(tcp, mp, TBADSEQ, 0); 7215 return; 7216 } 7217 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 7218 /* Send M_FLUSH according to TPI */ 7219 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 7220 } 7221 mp = mi_tpi_ok_ack_alloc(mp); 7222 if (mp) 7223 putnext(tcp->tcp_rq, mp); 7224 } 7225 7226 /* 7227 * Diagnostic routine used to return a string associated with the tcp state. 7228 * Note that if the caller does not supply a buffer, it will use an internal 7229 * static string. This means that if multiple threads call this function at 7230 * the same time, output can be corrupted... Note also that this function 7231 * does not check the size of the supplied buffer. The caller has to make 7232 * sure that it is big enough. 7233 */ 7234 static char * 7235 tcp_display(tcp_t *tcp, char *sup_buf, char format) 7236 { 7237 char buf1[30]; 7238 static char priv_buf[INET6_ADDRSTRLEN * 2 + 80]; 7239 char *buf; 7240 char *cp; 7241 in6_addr_t local, remote; 7242 char local_addrbuf[INET6_ADDRSTRLEN]; 7243 char remote_addrbuf[INET6_ADDRSTRLEN]; 7244 7245 if (sup_buf != NULL) 7246 buf = sup_buf; 7247 else 7248 buf = priv_buf; 7249 7250 if (tcp == NULL) 7251 return ("NULL_TCP"); 7252 switch (tcp->tcp_state) { 7253 case TCPS_CLOSED: 7254 cp = "TCP_CLOSED"; 7255 break; 7256 case TCPS_IDLE: 7257 cp = "TCP_IDLE"; 7258 break; 7259 case TCPS_BOUND: 7260 cp = "TCP_BOUND"; 7261 break; 7262 case TCPS_LISTEN: 7263 cp = "TCP_LISTEN"; 7264 break; 7265 case TCPS_SYN_SENT: 7266 cp = "TCP_SYN_SENT"; 7267 break; 7268 case TCPS_SYN_RCVD: 7269 cp = "TCP_SYN_RCVD"; 7270 break; 7271 case TCPS_ESTABLISHED: 7272 cp = "TCP_ESTABLISHED"; 7273 break; 7274 case TCPS_CLOSE_WAIT: 7275 cp = "TCP_CLOSE_WAIT"; 7276 break; 7277 case TCPS_FIN_WAIT_1: 7278 cp = "TCP_FIN_WAIT_1"; 7279 break; 7280 case TCPS_CLOSING: 7281 cp = "TCP_CLOSING"; 7282 break; 7283 case TCPS_LAST_ACK: 7284 cp = "TCP_LAST_ACK"; 7285 break; 7286 case TCPS_FIN_WAIT_2: 7287 cp = "TCP_FIN_WAIT_2"; 7288 break; 7289 case TCPS_TIME_WAIT: 7290 cp = "TCP_TIME_WAIT"; 7291 break; 7292 default: 7293 (void) mi_sprintf(buf1, "TCPUnkState(%d)", tcp->tcp_state); 7294 cp = buf1; 7295 break; 7296 } 7297 switch (format) { 7298 case DISP_ADDR_AND_PORT: 7299 if (tcp->tcp_ipversion == IPV4_VERSION) { 7300 /* 7301 * Note that we use the remote address in the tcp_b 7302 * structure. This means that it will print out 7303 * the real destination address, not the next hop's 7304 * address if source routing is used. 7305 */ 7306 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ip_src, &local); 7307 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &remote); 7308 7309 } else { 7310 local = tcp->tcp_ip_src_v6; 7311 remote = tcp->tcp_remote_v6; 7312 } 7313 (void) inet_ntop(AF_INET6, &local, local_addrbuf, 7314 sizeof (local_addrbuf)); 7315 (void) inet_ntop(AF_INET6, &remote, remote_addrbuf, 7316 sizeof (remote_addrbuf)); 7317 (void) mi_sprintf(buf, "[%s.%u, %s.%u] %s", 7318 local_addrbuf, ntohs(tcp->tcp_lport), remote_addrbuf, 7319 ntohs(tcp->tcp_fport), cp); 7320 break; 7321 case DISP_PORT_ONLY: 7322 default: 7323 (void) mi_sprintf(buf, "[%u, %u] %s", 7324 ntohs(tcp->tcp_lport), ntohs(tcp->tcp_fport), cp); 7325 break; 7326 } 7327 7328 return (buf); 7329 } 7330 7331 /* 7332 * Called via squeue to get on to eager's perimeter to send a 7333 * TH_RST. The listener wants the eager to disappear either 7334 * by means of tcp_eager_blowoff() or tcp_eager_cleanup() 7335 * being called. 7336 */ 7337 /* ARGSUSED */ 7338 void 7339 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2) 7340 { 7341 conn_t *econnp = (conn_t *)arg; 7342 tcp_t *eager = econnp->conn_tcp; 7343 tcp_t *listener = eager->tcp_listener; 7344 7345 /* 7346 * We could be called because listener is closing. Since 7347 * the eager is using listener's queue's, its not safe. 7348 * Better use the default queue just to send the TH_RST 7349 * out. 7350 */ 7351 eager->tcp_rq = tcp_g_q; 7352 eager->tcp_wq = WR(tcp_g_q); 7353 7354 if (eager->tcp_state > TCPS_LISTEN) { 7355 tcp_xmit_ctl("tcp_eager_kill, can't wait", 7356 eager, eager->tcp_snxt, 0, TH_RST); 7357 } 7358 7359 /* We are here because listener wants this eager gone */ 7360 if (listener != NULL) { 7361 mutex_enter(&listener->tcp_eager_lock); 7362 tcp_eager_unlink(eager); 7363 if (eager->tcp_conn.tcp_eager_conn_ind == NULL) { 7364 /* 7365 * The eager has sent a conn_ind up to the 7366 * listener but listener decides to close 7367 * instead. We need to drop the extra ref 7368 * placed on eager in tcp_rput_data() before 7369 * sending the conn_ind to listener. 7370 */ 7371 CONN_DEC_REF(econnp); 7372 } 7373 mutex_exit(&listener->tcp_eager_lock); 7374 CONN_DEC_REF(listener->tcp_connp); 7375 } 7376 7377 if (eager->tcp_state > TCPS_BOUND) 7378 tcp_close_detached(eager); 7379 } 7380 7381 /* 7382 * Reset any eager connection hanging off this listener marked 7383 * with 'seqnum' and then reclaim it's resources. 7384 */ 7385 static boolean_t 7386 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 7387 { 7388 tcp_t *eager; 7389 mblk_t *mp; 7390 7391 TCP_STAT(tcp_eager_blowoff_calls); 7392 eager = listener; 7393 mutex_enter(&listener->tcp_eager_lock); 7394 do { 7395 eager = eager->tcp_eager_next_q; 7396 if (eager == NULL) { 7397 mutex_exit(&listener->tcp_eager_lock); 7398 return (B_FALSE); 7399 } 7400 } while (eager->tcp_conn_req_seqnum != seqnum); 7401 CONN_INC_REF(eager->tcp_connp); 7402 mutex_exit(&listener->tcp_eager_lock); 7403 mp = &eager->tcp_closemp; 7404 squeue_fill(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 7405 eager->tcp_connp, SQTAG_TCP_EAGER_BLOWOFF); 7406 return (B_TRUE); 7407 } 7408 7409 /* 7410 * Reset any eager connection hanging off this listener 7411 * and then reclaim it's resources. 7412 */ 7413 static void 7414 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 7415 { 7416 tcp_t *eager; 7417 mblk_t *mp; 7418 7419 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7420 7421 if (!q0_only) { 7422 /* First cleanup q */ 7423 TCP_STAT(tcp_eager_blowoff_q); 7424 eager = listener->tcp_eager_next_q; 7425 while (eager != NULL) { 7426 CONN_INC_REF(eager->tcp_connp); 7427 mp = &eager->tcp_closemp; 7428 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7429 tcp_eager_kill, eager->tcp_connp, 7430 SQTAG_TCP_EAGER_CLEANUP); 7431 eager = eager->tcp_eager_next_q; 7432 } 7433 } 7434 /* Then cleanup q0 */ 7435 TCP_STAT(tcp_eager_blowoff_q0); 7436 eager = listener->tcp_eager_next_q0; 7437 while (eager != listener) { 7438 CONN_INC_REF(eager->tcp_connp); 7439 mp = &eager->tcp_closemp; 7440 squeue_fill(eager->tcp_connp->conn_sqp, mp, 7441 tcp_eager_kill, eager->tcp_connp, 7442 SQTAG_TCP_EAGER_CLEANUP_Q0); 7443 eager = eager->tcp_eager_next_q0; 7444 } 7445 } 7446 7447 /* 7448 * If we are an eager connection hanging off a listener that hasn't 7449 * formally accepted the connection yet, get off his list and blow off 7450 * any data that we have accumulated. 7451 */ 7452 static void 7453 tcp_eager_unlink(tcp_t *tcp) 7454 { 7455 tcp_t *listener = tcp->tcp_listener; 7456 7457 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 7458 ASSERT(listener != NULL); 7459 if (tcp->tcp_eager_next_q0 != NULL) { 7460 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 7461 7462 /* Remove the eager tcp from q0 */ 7463 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 7464 tcp->tcp_eager_prev_q0; 7465 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 7466 tcp->tcp_eager_next_q0; 7467 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 7468 listener->tcp_conn_req_cnt_q0--; 7469 7470 tcp->tcp_eager_next_q0 = NULL; 7471 tcp->tcp_eager_prev_q0 = NULL; 7472 7473 if (tcp->tcp_syn_rcvd_timeout != 0) { 7474 /* we have timed out before */ 7475 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 7476 listener->tcp_syn_rcvd_timeout--; 7477 } 7478 } else { 7479 tcp_t **tcpp = &listener->tcp_eager_next_q; 7480 tcp_t *prev = NULL; 7481 7482 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 7483 if (tcpp[0] == tcp) { 7484 if (listener->tcp_eager_last_q == tcp) { 7485 /* 7486 * If we are unlinking the last 7487 * element on the list, adjust 7488 * tail pointer. Set tail pointer 7489 * to nil when list is empty. 7490 */ 7491 ASSERT(tcp->tcp_eager_next_q == NULL); 7492 if (listener->tcp_eager_last_q == 7493 listener->tcp_eager_next_q) { 7494 listener->tcp_eager_last_q = 7495 NULL; 7496 } else { 7497 /* 7498 * We won't get here if there 7499 * is only one eager in the 7500 * list. 7501 */ 7502 ASSERT(prev != NULL); 7503 listener->tcp_eager_last_q = 7504 prev; 7505 } 7506 } 7507 tcpp[0] = tcp->tcp_eager_next_q; 7508 tcp->tcp_eager_next_q = NULL; 7509 tcp->tcp_eager_last_q = NULL; 7510 ASSERT(listener->tcp_conn_req_cnt_q > 0); 7511 listener->tcp_conn_req_cnt_q--; 7512 break; 7513 } 7514 prev = tcpp[0]; 7515 } 7516 } 7517 tcp->tcp_listener = NULL; 7518 } 7519 7520 /* Shorthand to generate and send TPI error acks to our client */ 7521 static void 7522 tcp_err_ack(tcp_t *tcp, mblk_t *mp, int t_error, int sys_error) 7523 { 7524 if ((mp = mi_tpi_err_ack_alloc(mp, t_error, sys_error)) != NULL) 7525 putnext(tcp->tcp_rq, mp); 7526 } 7527 7528 /* Shorthand to generate and send TPI error acks to our client */ 7529 static void 7530 tcp_err_ack_prim(tcp_t *tcp, mblk_t *mp, int primitive, 7531 int t_error, int sys_error) 7532 { 7533 struct T_error_ack *teackp; 7534 7535 if ((mp = tpi_ack_alloc(mp, sizeof (struct T_error_ack), 7536 M_PCPROTO, T_ERROR_ACK)) != NULL) { 7537 teackp = (struct T_error_ack *)mp->b_rptr; 7538 teackp->ERROR_prim = primitive; 7539 teackp->TLI_error = t_error; 7540 teackp->UNIX_error = sys_error; 7541 putnext(tcp->tcp_rq, mp); 7542 } 7543 } 7544 7545 /* 7546 * Note: No locks are held when inspecting tcp_g_*epriv_ports 7547 * but instead the code relies on: 7548 * - the fact that the address of the array and its size never changes 7549 * - the atomic assignment of the elements of the array 7550 */ 7551 /* ARGSUSED */ 7552 static int 7553 tcp_extra_priv_ports_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 7554 { 7555 int i; 7556 7557 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7558 if (tcp_g_epriv_ports[i] != 0) 7559 (void) mi_mpprintf(mp, "%d ", tcp_g_epriv_ports[i]); 7560 } 7561 return (0); 7562 } 7563 7564 /* 7565 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7566 * threads from changing it at the same time. 7567 */ 7568 /* ARGSUSED */ 7569 static int 7570 tcp_extra_priv_ports_add(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7571 cred_t *cr) 7572 { 7573 long new_value; 7574 int i; 7575 7576 /* 7577 * Fail the request if the new value does not lie within the 7578 * port number limits. 7579 */ 7580 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 7581 new_value <= 0 || new_value >= 65536) { 7582 return (EINVAL); 7583 } 7584 7585 mutex_enter(&tcp_epriv_port_lock); 7586 /* Check if the value is already in the list */ 7587 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7588 if (new_value == tcp_g_epriv_ports[i]) { 7589 mutex_exit(&tcp_epriv_port_lock); 7590 return (EEXIST); 7591 } 7592 } 7593 /* Find an empty slot */ 7594 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7595 if (tcp_g_epriv_ports[i] == 0) 7596 break; 7597 } 7598 if (i == tcp_g_num_epriv_ports) { 7599 mutex_exit(&tcp_epriv_port_lock); 7600 return (EOVERFLOW); 7601 } 7602 /* Set the new value */ 7603 tcp_g_epriv_ports[i] = (uint16_t)new_value; 7604 mutex_exit(&tcp_epriv_port_lock); 7605 return (0); 7606 } 7607 7608 /* 7609 * Hold a lock while changing tcp_g_epriv_ports to prevent multiple 7610 * threads from changing it at the same time. 7611 */ 7612 /* ARGSUSED */ 7613 static int 7614 tcp_extra_priv_ports_del(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 7615 cred_t *cr) 7616 { 7617 long new_value; 7618 int i; 7619 7620 /* 7621 * Fail the request if the new value does not lie within the 7622 * port number limits. 7623 */ 7624 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || new_value <= 0 || 7625 new_value >= 65536) { 7626 return (EINVAL); 7627 } 7628 7629 mutex_enter(&tcp_epriv_port_lock); 7630 /* Check that the value is already in the list */ 7631 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 7632 if (tcp_g_epriv_ports[i] == new_value) 7633 break; 7634 } 7635 if (i == tcp_g_num_epriv_ports) { 7636 mutex_exit(&tcp_epriv_port_lock); 7637 return (ESRCH); 7638 } 7639 /* Clear the value */ 7640 tcp_g_epriv_ports[i] = 0; 7641 mutex_exit(&tcp_epriv_port_lock); 7642 return (0); 7643 } 7644 7645 /* Return the TPI/TLI equivalent of our current tcp_state */ 7646 static int 7647 tcp_tpistate(tcp_t *tcp) 7648 { 7649 switch (tcp->tcp_state) { 7650 case TCPS_IDLE: 7651 return (TS_UNBND); 7652 case TCPS_LISTEN: 7653 /* 7654 * Return whether there are outstanding T_CONN_IND waiting 7655 * for the matching T_CONN_RES. Therefore don't count q0. 7656 */ 7657 if (tcp->tcp_conn_req_cnt_q > 0) 7658 return (TS_WRES_CIND); 7659 else 7660 return (TS_IDLE); 7661 case TCPS_BOUND: 7662 return (TS_IDLE); 7663 case TCPS_SYN_SENT: 7664 return (TS_WCON_CREQ); 7665 case TCPS_SYN_RCVD: 7666 /* 7667 * Note: assumption: this has to the active open SYN_RCVD. 7668 * The passive instance is detached in SYN_RCVD stage of 7669 * incoming connection processing so we cannot get request 7670 * for T_info_ack on it. 7671 */ 7672 return (TS_WACK_CRES); 7673 case TCPS_ESTABLISHED: 7674 return (TS_DATA_XFER); 7675 case TCPS_CLOSE_WAIT: 7676 return (TS_WREQ_ORDREL); 7677 case TCPS_FIN_WAIT_1: 7678 return (TS_WIND_ORDREL); 7679 case TCPS_FIN_WAIT_2: 7680 return (TS_WIND_ORDREL); 7681 7682 case TCPS_CLOSING: 7683 case TCPS_LAST_ACK: 7684 case TCPS_TIME_WAIT: 7685 case TCPS_CLOSED: 7686 /* 7687 * Following TS_WACK_DREQ7 is a rendition of "not 7688 * yet TS_IDLE" TPI state. There is no best match to any 7689 * TPI state for TCPS_{CLOSING, LAST_ACK, TIME_WAIT} but we 7690 * choose a value chosen that will map to TLI/XTI level 7691 * state of TSTATECHNG (state is process of changing) which 7692 * captures what this dummy state represents. 7693 */ 7694 return (TS_WACK_DREQ7); 7695 default: 7696 cmn_err(CE_WARN, "tcp_tpistate: strange state (%d) %s", 7697 tcp->tcp_state, tcp_display(tcp, NULL, 7698 DISP_PORT_ONLY)); 7699 return (TS_UNBND); 7700 } 7701 } 7702 7703 static void 7704 tcp_copy_info(struct T_info_ack *tia, tcp_t *tcp) 7705 { 7706 if (tcp->tcp_family == AF_INET6) 7707 *tia = tcp_g_t_info_ack_v6; 7708 else 7709 *tia = tcp_g_t_info_ack; 7710 tia->CURRENT_state = tcp_tpistate(tcp); 7711 tia->OPT_size = tcp_max_optsize; 7712 if (tcp->tcp_mss == 0) { 7713 /* Not yet set - tcp_open does not set mss */ 7714 if (tcp->tcp_ipversion == IPV4_VERSION) 7715 tia->TIDU_size = tcp_mss_def_ipv4; 7716 else 7717 tia->TIDU_size = tcp_mss_def_ipv6; 7718 } else { 7719 tia->TIDU_size = tcp->tcp_mss; 7720 } 7721 /* TODO: Default ETSDU is 1. Is that correct for tcp? */ 7722 } 7723 7724 /* 7725 * This routine responds to T_CAPABILITY_REQ messages. It is called by 7726 * tcp_wput. Much of the T_CAPABILITY_ACK information is copied from 7727 * tcp_g_t_info_ack. The current state of the stream is copied from 7728 * tcp_state. 7729 */ 7730 static void 7731 tcp_capability_req(tcp_t *tcp, mblk_t *mp) 7732 { 7733 t_uscalar_t cap_bits1; 7734 struct T_capability_ack *tcap; 7735 7736 if (MBLKL(mp) < sizeof (struct T_capability_req)) { 7737 freemsg(mp); 7738 return; 7739 } 7740 7741 cap_bits1 = ((struct T_capability_req *)mp->b_rptr)->CAP_bits1; 7742 7743 mp = tpi_ack_alloc(mp, sizeof (struct T_capability_ack), 7744 mp->b_datap->db_type, T_CAPABILITY_ACK); 7745 if (mp == NULL) 7746 return; 7747 7748 tcap = (struct T_capability_ack *)mp->b_rptr; 7749 tcap->CAP_bits1 = 0; 7750 7751 if (cap_bits1 & TC1_INFO) { 7752 tcp_copy_info(&tcap->INFO_ack, tcp); 7753 tcap->CAP_bits1 |= TC1_INFO; 7754 } 7755 7756 if (cap_bits1 & TC1_ACCEPTOR_ID) { 7757 tcap->ACCEPTOR_id = tcp->tcp_acceptor_id; 7758 tcap->CAP_bits1 |= TC1_ACCEPTOR_ID; 7759 } 7760 7761 putnext(tcp->tcp_rq, mp); 7762 } 7763 7764 /* 7765 * This routine responds to T_INFO_REQ messages. It is called by tcp_wput. 7766 * Most of the T_INFO_ACK information is copied from tcp_g_t_info_ack. 7767 * The current state of the stream is copied from tcp_state. 7768 */ 7769 static void 7770 tcp_info_req(tcp_t *tcp, mblk_t *mp) 7771 { 7772 mp = tpi_ack_alloc(mp, sizeof (struct T_info_ack), M_PCPROTO, 7773 T_INFO_ACK); 7774 if (!mp) { 7775 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7776 return; 7777 } 7778 tcp_copy_info((struct T_info_ack *)mp->b_rptr, tcp); 7779 putnext(tcp->tcp_rq, mp); 7780 } 7781 7782 /* Respond to the TPI addr request */ 7783 static void 7784 tcp_addr_req(tcp_t *tcp, mblk_t *mp) 7785 { 7786 sin_t *sin; 7787 mblk_t *ackmp; 7788 struct T_addr_ack *taa; 7789 7790 /* Make it large enough for worst case */ 7791 ackmp = reallocb(mp, sizeof (struct T_addr_ack) + 7792 2 * sizeof (sin6_t), 1); 7793 if (ackmp == NULL) { 7794 tcp_err_ack(tcp, mp, TSYSERR, ENOMEM); 7795 return; 7796 } 7797 7798 if (tcp->tcp_ipversion == IPV6_VERSION) { 7799 tcp_addr_req_ipv6(tcp, ackmp); 7800 return; 7801 } 7802 taa = (struct T_addr_ack *)ackmp->b_rptr; 7803 7804 bzero(taa, sizeof (struct T_addr_ack)); 7805 ackmp->b_wptr = (uchar_t *)&taa[1]; 7806 7807 taa->PRIM_type = T_ADDR_ACK; 7808 ackmp->b_datap->db_type = M_PCPROTO; 7809 7810 /* 7811 * Note: Following code assumes 32 bit alignment of basic 7812 * data structures like sin_t and struct T_addr_ack. 7813 */ 7814 if (tcp->tcp_state >= TCPS_BOUND) { 7815 /* 7816 * Fill in local address 7817 */ 7818 taa->LOCADDR_length = sizeof (sin_t); 7819 taa->LOCADDR_offset = sizeof (*taa); 7820 7821 sin = (sin_t *)&taa[1]; 7822 7823 /* Fill zeroes and then intialize non-zero fields */ 7824 *sin = sin_null; 7825 7826 sin->sin_family = AF_INET; 7827 7828 sin->sin_addr.s_addr = tcp->tcp_ipha->ipha_src; 7829 sin->sin_port = *(uint16_t *)tcp->tcp_tcph->th_lport; 7830 7831 ackmp->b_wptr = (uchar_t *)&sin[1]; 7832 7833 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7834 /* 7835 * Fill in Remote address 7836 */ 7837 taa->REMADDR_length = sizeof (sin_t); 7838 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7839 taa->LOCADDR_length); 7840 7841 sin = (sin_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7842 *sin = sin_null; 7843 sin->sin_family = AF_INET; 7844 sin->sin_addr.s_addr = tcp->tcp_remote; 7845 sin->sin_port = tcp->tcp_fport; 7846 7847 ackmp->b_wptr = (uchar_t *)&sin[1]; 7848 } 7849 } 7850 putnext(tcp->tcp_rq, ackmp); 7851 } 7852 7853 /* Assumes that tcp_addr_req gets enough space and alignment */ 7854 static void 7855 tcp_addr_req_ipv6(tcp_t *tcp, mblk_t *ackmp) 7856 { 7857 sin6_t *sin6; 7858 struct T_addr_ack *taa; 7859 7860 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 7861 ASSERT(OK_32PTR(ackmp->b_rptr)); 7862 ASSERT(ackmp->b_wptr - ackmp->b_rptr >= sizeof (struct T_addr_ack) + 7863 2 * sizeof (sin6_t)); 7864 7865 taa = (struct T_addr_ack *)ackmp->b_rptr; 7866 7867 bzero(taa, sizeof (struct T_addr_ack)); 7868 ackmp->b_wptr = (uchar_t *)&taa[1]; 7869 7870 taa->PRIM_type = T_ADDR_ACK; 7871 ackmp->b_datap->db_type = M_PCPROTO; 7872 7873 /* 7874 * Note: Following code assumes 32 bit alignment of basic 7875 * data structures like sin6_t and struct T_addr_ack. 7876 */ 7877 if (tcp->tcp_state >= TCPS_BOUND) { 7878 /* 7879 * Fill in local address 7880 */ 7881 taa->LOCADDR_length = sizeof (sin6_t); 7882 taa->LOCADDR_offset = sizeof (*taa); 7883 7884 sin6 = (sin6_t *)&taa[1]; 7885 *sin6 = sin6_null; 7886 7887 sin6->sin6_family = AF_INET6; 7888 sin6->sin6_addr = tcp->tcp_ip6h->ip6_src; 7889 sin6->sin6_port = tcp->tcp_lport; 7890 7891 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7892 7893 if (tcp->tcp_state >= TCPS_SYN_RCVD) { 7894 /* 7895 * Fill in Remote address 7896 */ 7897 taa->REMADDR_length = sizeof (sin6_t); 7898 taa->REMADDR_offset = ROUNDUP32(taa->LOCADDR_offset + 7899 taa->LOCADDR_length); 7900 7901 sin6 = (sin6_t *)(ackmp->b_rptr + taa->REMADDR_offset); 7902 *sin6 = sin6_null; 7903 sin6->sin6_family = AF_INET6; 7904 sin6->sin6_flowinfo = 7905 tcp->tcp_ip6h->ip6_vcf & 7906 ~IPV6_VERS_AND_FLOW_MASK; 7907 sin6->sin6_addr = tcp->tcp_remote_v6; 7908 sin6->sin6_port = tcp->tcp_fport; 7909 7910 ackmp->b_wptr = (uchar_t *)&sin6[1]; 7911 } 7912 } 7913 putnext(tcp->tcp_rq, ackmp); 7914 } 7915 7916 /* 7917 * Handle reinitialization of a tcp structure. 7918 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 7919 */ 7920 static void 7921 tcp_reinit(tcp_t *tcp) 7922 { 7923 mblk_t *mp; 7924 int err; 7925 7926 TCP_STAT(tcp_reinit_calls); 7927 7928 /* tcp_reinit should never be called for detached tcp_t's */ 7929 ASSERT(tcp->tcp_listener == NULL); 7930 ASSERT((tcp->tcp_family == AF_INET && 7931 tcp->tcp_ipversion == IPV4_VERSION) || 7932 (tcp->tcp_family == AF_INET6 && 7933 (tcp->tcp_ipversion == IPV4_VERSION || 7934 tcp->tcp_ipversion == IPV6_VERSION))); 7935 7936 /* Cancel outstanding timers */ 7937 tcp_timers_stop(tcp); 7938 7939 if (tcp->tcp_flow_stopped) { 7940 tcp->tcp_flow_stopped = B_FALSE; 7941 tcp_clrqfull(tcp); 7942 } 7943 /* 7944 * Reset everything in the state vector, after updating global 7945 * MIB data from instance counters. 7946 */ 7947 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 7948 tcp->tcp_ibsegs = 0; 7949 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 7950 tcp->tcp_obsegs = 0; 7951 7952 tcp_close_mpp(&tcp->tcp_xmit_head); 7953 if (tcp->tcp_snd_zcopy_aware) 7954 tcp_zcopy_notify(tcp); 7955 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 7956 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 7957 tcp_close_mpp(&tcp->tcp_reass_head); 7958 tcp->tcp_reass_tail = NULL; 7959 if (tcp->tcp_rcv_list != NULL) { 7960 /* Free b_next chain */ 7961 tcp_close_mpp(&tcp->tcp_rcv_list); 7962 tcp->tcp_rcv_last_head = NULL; 7963 tcp->tcp_rcv_last_tail = NULL; 7964 tcp->tcp_rcv_cnt = 0; 7965 } 7966 tcp->tcp_rcv_last_tail = NULL; 7967 7968 if ((mp = tcp->tcp_urp_mp) != NULL) { 7969 freemsg(mp); 7970 tcp->tcp_urp_mp = NULL; 7971 } 7972 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 7973 freemsg(mp); 7974 tcp->tcp_urp_mark_mp = NULL; 7975 } 7976 if (tcp->tcp_fused_sigurg_mp != NULL) { 7977 freeb(tcp->tcp_fused_sigurg_mp); 7978 tcp->tcp_fused_sigurg_mp = NULL; 7979 } 7980 7981 /* 7982 * Following is a union with two members which are 7983 * identical types and size so the following cleanup 7984 * is enough. 7985 */ 7986 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 7987 7988 CL_INET_DISCONNECT(tcp); 7989 7990 /* 7991 * The connection can't be on the tcp_time_wait_head list 7992 * since it is not detached. 7993 */ 7994 ASSERT(tcp->tcp_time_wait_next == NULL); 7995 ASSERT(tcp->tcp_time_wait_prev == NULL); 7996 ASSERT(tcp->tcp_time_wait_expire == 0); 7997 7998 /* 7999 * Reset/preserve other values 8000 */ 8001 tcp_reinit_values(tcp); 8002 ipcl_hash_remove(tcp->tcp_connp); 8003 conn_delete_ire(tcp->tcp_connp, NULL); 8004 8005 if (tcp->tcp_conn_req_max != 0) { 8006 /* 8007 * This is the case when a TLI program uses the same 8008 * transport end point to accept a connection. This 8009 * makes the TCP both a listener and acceptor. When 8010 * this connection is closed, we need to set the state 8011 * back to TCPS_LISTEN. Make sure that the eager list 8012 * is reinitialized. 8013 * 8014 * Note that this stream is still bound to the four 8015 * tuples of the previous connection in IP. If a new 8016 * SYN with different foreign address comes in, IP will 8017 * not find it and will send it to the global queue. In 8018 * the global queue, TCP will do a tcp_lookup_listener() 8019 * to find this stream. This works because this stream 8020 * is only removed from connected hash. 8021 * 8022 */ 8023 tcp->tcp_state = TCPS_LISTEN; 8024 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 8025 tcp->tcp_connp->conn_recv = tcp_conn_request; 8026 if (tcp->tcp_family == AF_INET6) { 8027 ASSERT(tcp->tcp_connp->conn_af_isv6); 8028 (void) ipcl_bind_insert_v6(tcp->tcp_connp, IPPROTO_TCP, 8029 &tcp->tcp_ip6h->ip6_src, tcp->tcp_lport); 8030 } else { 8031 ASSERT(!tcp->tcp_connp->conn_af_isv6); 8032 (void) ipcl_bind_insert(tcp->tcp_connp, IPPROTO_TCP, 8033 tcp->tcp_ipha->ipha_src, tcp->tcp_lport); 8034 } 8035 } else { 8036 tcp->tcp_state = TCPS_BOUND; 8037 } 8038 8039 /* 8040 * Initialize to default values 8041 * Can't fail since enough header template space already allocated 8042 * at open(). 8043 */ 8044 err = tcp_init_values(tcp); 8045 ASSERT(err == 0); 8046 /* Restore state in tcp_tcph */ 8047 bcopy(&tcp->tcp_lport, tcp->tcp_tcph->th_lport, TCP_PORT_LEN); 8048 if (tcp->tcp_ipversion == IPV4_VERSION) 8049 tcp->tcp_ipha->ipha_src = tcp->tcp_bound_source; 8050 else 8051 tcp->tcp_ip6h->ip6_src = tcp->tcp_bound_source_v6; 8052 /* 8053 * Copy of the src addr. in tcp_t is needed in tcp_t 8054 * since the lookup funcs can only lookup on tcp_t 8055 */ 8056 tcp->tcp_ip_src_v6 = tcp->tcp_bound_source_v6; 8057 8058 ASSERT(tcp->tcp_ptpbhn != NULL); 8059 tcp->tcp_rq->q_hiwat = tcp_recv_hiwat; 8060 tcp->tcp_rwnd = tcp_recv_hiwat; 8061 tcp->tcp_mss = tcp->tcp_ipversion != IPV4_VERSION ? 8062 tcp_mss_def_ipv6 : tcp_mss_def_ipv4; 8063 } 8064 8065 /* 8066 * Force values to zero that need be zero. 8067 * Do not touch values asociated with the BOUND or LISTEN state 8068 * since the connection will end up in that state after the reinit. 8069 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 8070 * structure! 8071 */ 8072 static void 8073 tcp_reinit_values(tcp) 8074 tcp_t *tcp; 8075 { 8076 #ifndef lint 8077 #define DONTCARE(x) 8078 #define PRESERVE(x) 8079 #else 8080 #define DONTCARE(x) ((x) = (x)) 8081 #define PRESERVE(x) ((x) = (x)) 8082 #endif /* lint */ 8083 8084 PRESERVE(tcp->tcp_bind_hash); 8085 PRESERVE(tcp->tcp_ptpbhn); 8086 PRESERVE(tcp->tcp_acceptor_hash); 8087 PRESERVE(tcp->tcp_ptpahn); 8088 8089 /* Should be ASSERT NULL on these with new code! */ 8090 ASSERT(tcp->tcp_time_wait_next == NULL); 8091 ASSERT(tcp->tcp_time_wait_prev == NULL); 8092 ASSERT(tcp->tcp_time_wait_expire == 0); 8093 PRESERVE(tcp->tcp_state); 8094 PRESERVE(tcp->tcp_rq); 8095 PRESERVE(tcp->tcp_wq); 8096 8097 ASSERT(tcp->tcp_xmit_head == NULL); 8098 ASSERT(tcp->tcp_xmit_last == NULL); 8099 ASSERT(tcp->tcp_unsent == 0); 8100 ASSERT(tcp->tcp_xmit_tail == NULL); 8101 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 8102 8103 tcp->tcp_snxt = 0; /* Displayed in mib */ 8104 tcp->tcp_suna = 0; /* Displayed in mib */ 8105 tcp->tcp_swnd = 0; 8106 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_mss_set */ 8107 8108 ASSERT(tcp->tcp_ibsegs == 0); 8109 ASSERT(tcp->tcp_obsegs == 0); 8110 8111 if (tcp->tcp_iphc != NULL) { 8112 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8113 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 8114 } 8115 8116 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 8117 DONTCARE(tcp->tcp_hdr_len); /* Init in tcp_init_values */ 8118 DONTCARE(tcp->tcp_ipha); 8119 DONTCARE(tcp->tcp_ip6h); 8120 DONTCARE(tcp->tcp_ip_hdr_len); 8121 DONTCARE(tcp->tcp_tcph); 8122 DONTCARE(tcp->tcp_tcp_hdr_len); /* Init in tcp_init_values */ 8123 tcp->tcp_valid_bits = 0; 8124 8125 DONTCARE(tcp->tcp_xmit_hiwater); /* Init in tcp_init_values */ 8126 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 8127 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 8128 tcp->tcp_last_rcv_lbolt = 0; 8129 8130 tcp->tcp_init_cwnd = 0; 8131 8132 tcp->tcp_urp_last_valid = 0; 8133 tcp->tcp_hard_binding = 0; 8134 tcp->tcp_hard_bound = 0; 8135 PRESERVE(tcp->tcp_cred); 8136 PRESERVE(tcp->tcp_cpid); 8137 PRESERVE(tcp->tcp_exclbind); 8138 8139 tcp->tcp_fin_acked = 0; 8140 tcp->tcp_fin_rcvd = 0; 8141 tcp->tcp_fin_sent = 0; 8142 tcp->tcp_ordrel_done = 0; 8143 8144 ASSERT(tcp->tcp_flow_stopped == 0); 8145 tcp->tcp_debug = 0; 8146 tcp->tcp_dontroute = 0; 8147 tcp->tcp_broadcast = 0; 8148 8149 tcp->tcp_useloopback = 0; 8150 tcp->tcp_reuseaddr = 0; 8151 tcp->tcp_oobinline = 0; 8152 tcp->tcp_dgram_errind = 0; 8153 8154 tcp->tcp_detached = 0; 8155 tcp->tcp_bind_pending = 0; 8156 tcp->tcp_unbind_pending = 0; 8157 tcp->tcp_deferred_clean_death = 0; 8158 8159 tcp->tcp_snd_ws_ok = B_FALSE; 8160 tcp->tcp_snd_ts_ok = B_FALSE; 8161 tcp->tcp_linger = 0; 8162 tcp->tcp_ka_enabled = 0; 8163 tcp->tcp_zero_win_probe = 0; 8164 8165 tcp->tcp_loopback = 0; 8166 tcp->tcp_localnet = 0; 8167 tcp->tcp_syn_defense = 0; 8168 tcp->tcp_set_timer = 0; 8169 8170 tcp->tcp_active_open = 0; 8171 ASSERT(tcp->tcp_timeout == B_FALSE); 8172 tcp->tcp_rexmit = B_FALSE; 8173 tcp->tcp_xmit_zc_clean = B_FALSE; 8174 8175 tcp->tcp_snd_sack_ok = B_FALSE; 8176 PRESERVE(tcp->tcp_recvdstaddr); 8177 tcp->tcp_hwcksum = B_FALSE; 8178 8179 tcp->tcp_ire_ill_check_done = B_FALSE; 8180 DONTCARE(tcp->tcp_maxpsz); /* Init in tcp_init_values */ 8181 8182 tcp->tcp_mdt = B_FALSE; 8183 tcp->tcp_mdt_hdr_head = 0; 8184 tcp->tcp_mdt_hdr_tail = 0; 8185 8186 tcp->tcp_conn_def_q0 = 0; 8187 tcp->tcp_ip_forward_progress = B_FALSE; 8188 tcp->tcp_anon_priv_bind = 0; 8189 tcp->tcp_ecn_ok = B_FALSE; 8190 8191 tcp->tcp_cwr = B_FALSE; 8192 tcp->tcp_ecn_echo_on = B_FALSE; 8193 8194 if (tcp->tcp_sack_info != NULL) { 8195 if (tcp->tcp_notsack_list != NULL) { 8196 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 8197 } 8198 kmem_cache_free(tcp_sack_info_cache, tcp->tcp_sack_info); 8199 tcp->tcp_sack_info = NULL; 8200 } 8201 8202 tcp->tcp_rcv_ws = 0; 8203 tcp->tcp_snd_ws = 0; 8204 tcp->tcp_ts_recent = 0; 8205 tcp->tcp_rnxt = 0; /* Displayed in mib */ 8206 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 8207 tcp->tcp_if_mtu = 0; 8208 8209 ASSERT(tcp->tcp_reass_head == NULL); 8210 ASSERT(tcp->tcp_reass_tail == NULL); 8211 8212 tcp->tcp_cwnd_cnt = 0; 8213 8214 ASSERT(tcp->tcp_rcv_list == NULL); 8215 ASSERT(tcp->tcp_rcv_last_head == NULL); 8216 ASSERT(tcp->tcp_rcv_last_tail == NULL); 8217 ASSERT(tcp->tcp_rcv_cnt == 0); 8218 8219 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_adapt_ire */ 8220 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 8221 tcp->tcp_csuna = 0; 8222 8223 tcp->tcp_rto = 0; /* Displayed in MIB */ 8224 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 8225 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 8226 tcp->tcp_rtt_update = 0; 8227 8228 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 8229 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 8230 8231 tcp->tcp_rack = 0; /* Displayed in mib */ 8232 tcp->tcp_rack_cnt = 0; 8233 tcp->tcp_rack_cur_max = 0; 8234 tcp->tcp_rack_abs_max = 0; 8235 8236 tcp->tcp_max_swnd = 0; 8237 8238 ASSERT(tcp->tcp_listener == NULL); 8239 8240 DONTCARE(tcp->tcp_xmit_lowater); /* Init in tcp_init_values */ 8241 8242 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 8243 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 8244 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 8245 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 8246 8247 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 8248 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 8249 PRESERVE(tcp->tcp_conn_req_max); 8250 PRESERVE(tcp->tcp_conn_req_seqnum); 8251 8252 DONTCARE(tcp->tcp_ip_hdr_len); /* Init in tcp_init_values */ 8253 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 8254 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 8255 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 8256 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 8257 8258 tcp->tcp_lingertime = 0; 8259 8260 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 8261 ASSERT(tcp->tcp_urp_mp == NULL); 8262 ASSERT(tcp->tcp_urp_mark_mp == NULL); 8263 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 8264 8265 ASSERT(tcp->tcp_eager_next_q == NULL); 8266 ASSERT(tcp->tcp_eager_last_q == NULL); 8267 ASSERT((tcp->tcp_eager_next_q0 == NULL && 8268 tcp->tcp_eager_prev_q0 == NULL) || 8269 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 8270 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 8271 8272 tcp->tcp_client_errno = 0; 8273 8274 DONTCARE(tcp->tcp_sum); /* Init in tcp_init_values */ 8275 8276 tcp->tcp_remote_v6 = ipv6_all_zeros; /* Displayed in MIB */ 8277 8278 PRESERVE(tcp->tcp_bound_source_v6); 8279 tcp->tcp_last_sent_len = 0; 8280 tcp->tcp_dupack_cnt = 0; 8281 8282 tcp->tcp_fport = 0; /* Displayed in MIB */ 8283 PRESERVE(tcp->tcp_lport); 8284 8285 PRESERVE(tcp->tcp_acceptor_lockp); 8286 8287 ASSERT(tcp->tcp_ordrelid == 0); 8288 PRESERVE(tcp->tcp_acceptor_id); 8289 DONTCARE(tcp->tcp_ipsec_overhead); 8290 8291 /* 8292 * If tcp_tracing flag is ON (i.e. We have a trace buffer 8293 * in tcp structure and now tracing), Re-initialize all 8294 * members of tcp_traceinfo. 8295 */ 8296 if (tcp->tcp_tracebuf != NULL) { 8297 bzero(tcp->tcp_tracebuf, sizeof (tcptrch_t)); 8298 } 8299 8300 PRESERVE(tcp->tcp_family); 8301 if (tcp->tcp_family == AF_INET6) { 8302 tcp->tcp_ipversion = IPV6_VERSION; 8303 tcp->tcp_mss = tcp_mss_def_ipv6; 8304 } else { 8305 tcp->tcp_ipversion = IPV4_VERSION; 8306 tcp->tcp_mss = tcp_mss_def_ipv4; 8307 } 8308 8309 tcp->tcp_bound_if = 0; 8310 tcp->tcp_ipv6_recvancillary = 0; 8311 tcp->tcp_recvifindex = 0; 8312 tcp->tcp_recvhops = 0; 8313 tcp->tcp_closed = 0; 8314 tcp->tcp_cleandeathtag = 0; 8315 if (tcp->tcp_hopopts != NULL) { 8316 mi_free(tcp->tcp_hopopts); 8317 tcp->tcp_hopopts = NULL; 8318 tcp->tcp_hopoptslen = 0; 8319 } 8320 ASSERT(tcp->tcp_hopoptslen == 0); 8321 if (tcp->tcp_dstopts != NULL) { 8322 mi_free(tcp->tcp_dstopts); 8323 tcp->tcp_dstopts = NULL; 8324 tcp->tcp_dstoptslen = 0; 8325 } 8326 ASSERT(tcp->tcp_dstoptslen == 0); 8327 if (tcp->tcp_rtdstopts != NULL) { 8328 mi_free(tcp->tcp_rtdstopts); 8329 tcp->tcp_rtdstopts = NULL; 8330 tcp->tcp_rtdstoptslen = 0; 8331 } 8332 ASSERT(tcp->tcp_rtdstoptslen == 0); 8333 if (tcp->tcp_rthdr != NULL) { 8334 mi_free(tcp->tcp_rthdr); 8335 tcp->tcp_rthdr = NULL; 8336 tcp->tcp_rthdrlen = 0; 8337 } 8338 ASSERT(tcp->tcp_rthdrlen == 0); 8339 PRESERVE(tcp->tcp_drop_opt_ack_cnt); 8340 8341 tcp->tcp_fused = B_FALSE; 8342 tcp->tcp_unfusable = B_FALSE; 8343 tcp->tcp_fused_sigurg = B_FALSE; 8344 tcp->tcp_loopback_peer = NULL; 8345 8346 tcp->tcp_in_ack_unsent = 0; 8347 tcp->tcp_cork = B_FALSE; 8348 8349 #undef DONTCARE 8350 #undef PRESERVE 8351 } 8352 8353 /* 8354 * Allocate necessary resources and initialize state vector. 8355 * Guaranteed not to fail so that when an error is returned, 8356 * the caller doesn't need to do any additional cleanup. 8357 */ 8358 int 8359 tcp_init(tcp_t *tcp, queue_t *q) 8360 { 8361 int err; 8362 8363 tcp->tcp_rq = q; 8364 tcp->tcp_wq = WR(q); 8365 tcp->tcp_state = TCPS_IDLE; 8366 if ((err = tcp_init_values(tcp)) != 0) 8367 tcp_timers_stop(tcp); 8368 return (err); 8369 } 8370 8371 static int 8372 tcp_init_values(tcp_t *tcp) 8373 { 8374 int err; 8375 8376 ASSERT((tcp->tcp_family == AF_INET && 8377 tcp->tcp_ipversion == IPV4_VERSION) || 8378 (tcp->tcp_family == AF_INET6 && 8379 (tcp->tcp_ipversion == IPV4_VERSION || 8380 tcp->tcp_ipversion == IPV6_VERSION))); 8381 8382 /* 8383 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 8384 * will be close to tcp_rexmit_interval_initial. By doing this, we 8385 * allow the algorithm to adjust slowly to large fluctuations of RTT 8386 * during first few transmissions of a connection as seen in slow 8387 * links. 8388 */ 8389 tcp->tcp_rtt_sa = tcp_rexmit_interval_initial << 2; 8390 tcp->tcp_rtt_sd = tcp_rexmit_interval_initial >> 1; 8391 tcp->tcp_rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 8392 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 8393 tcp_conn_grace_period; 8394 if (tcp->tcp_rto < tcp_rexmit_interval_min) 8395 tcp->tcp_rto = tcp_rexmit_interval_min; 8396 tcp->tcp_timer_backoff = 0; 8397 tcp->tcp_ms_we_have_waited = 0; 8398 tcp->tcp_last_recv_time = lbolt; 8399 tcp->tcp_cwnd_max = tcp_cwnd_max_; 8400 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 8401 8402 tcp->tcp_maxpsz = tcp_maxpsz_multiplier; 8403 8404 tcp->tcp_first_timer_threshold = tcp_ip_notify_interval; 8405 tcp->tcp_first_ctimer_threshold = tcp_ip_notify_cinterval; 8406 tcp->tcp_second_timer_threshold = tcp_ip_abort_interval; 8407 /* 8408 * Fix it to tcp_ip_abort_linterval later if it turns out to be a 8409 * passive open. 8410 */ 8411 tcp->tcp_second_ctimer_threshold = tcp_ip_abort_cinterval; 8412 8413 tcp->tcp_naglim = tcp_naglim_def; 8414 8415 /* NOTE: ISS is now set in tcp_adapt_ire(). */ 8416 8417 tcp->tcp_mdt_hdr_head = 0; 8418 tcp->tcp_mdt_hdr_tail = 0; 8419 8420 tcp->tcp_fused = B_FALSE; 8421 tcp->tcp_unfusable = B_FALSE; 8422 tcp->tcp_fused_sigurg = B_FALSE; 8423 tcp->tcp_loopback_peer = NULL; 8424 8425 /* Initialize the header template */ 8426 if (tcp->tcp_ipversion == IPV4_VERSION) { 8427 err = tcp_header_init_ipv4(tcp); 8428 } else { 8429 err = tcp_header_init_ipv6(tcp); 8430 } 8431 if (err) 8432 return (err); 8433 8434 /* 8435 * Init the window scale to the max so tcp_rwnd_set() won't pare 8436 * down tcp_rwnd. tcp_adapt_ire() will set the right value later. 8437 */ 8438 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 8439 tcp->tcp_xmit_lowater = tcp_xmit_lowat; 8440 tcp->tcp_xmit_hiwater = tcp_xmit_hiwat; 8441 8442 tcp->tcp_cork = B_FALSE; 8443 /* 8444 * Init the tcp_debug option. This value determines whether TCP 8445 * calls strlog() to print out debug messages. Doing this 8446 * initialization here means that this value is not inherited thru 8447 * tcp_reinit(). 8448 */ 8449 tcp->tcp_debug = tcp_dbg; 8450 8451 tcp->tcp_ka_interval = tcp_keepalive_interval; 8452 tcp->tcp_ka_abort_thres = tcp_keepalive_abort_interval; 8453 8454 return (0); 8455 } 8456 8457 /* 8458 * Initialize the IPv4 header. Loses any record of any IP options. 8459 */ 8460 static int 8461 tcp_header_init_ipv4(tcp_t *tcp) 8462 { 8463 tcph_t *tcph; 8464 uint32_t sum; 8465 8466 /* 8467 * This is a simple initialization. If there's 8468 * already a template, it should never be too small, 8469 * so reuse it. Otherwise, allocate space for the new one. 8470 */ 8471 if (tcp->tcp_iphc == NULL) { 8472 ASSERT(tcp->tcp_iphc_len == 0); 8473 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8474 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8475 if (tcp->tcp_iphc == NULL) { 8476 tcp->tcp_iphc_len = 0; 8477 return (ENOMEM); 8478 } 8479 } 8480 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8481 tcp->tcp_ipha = (ipha_t *)tcp->tcp_iphc; 8482 tcp->tcp_ip6h = NULL; 8483 tcp->tcp_ipversion = IPV4_VERSION; 8484 tcp->tcp_hdr_len = sizeof (ipha_t) + sizeof (tcph_t); 8485 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8486 tcp->tcp_ip_hdr_len = sizeof (ipha_t); 8487 tcp->tcp_ipha->ipha_length = htons(sizeof (ipha_t) + sizeof (tcph_t)); 8488 tcp->tcp_ipha->ipha_version_and_hdr_length 8489 = (IP_VERSION << 4) | IP_SIMPLE_HDR_LENGTH_IN_WORDS; 8490 tcp->tcp_ipha->ipha_ident = 0; 8491 8492 tcp->tcp_ttl = (uchar_t)tcp_ipv4_ttl; 8493 tcp->tcp_tos = 0; 8494 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 8495 tcp->tcp_ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 8496 tcp->tcp_ipha->ipha_protocol = IPPROTO_TCP; 8497 8498 tcph = (tcph_t *)(tcp->tcp_iphc + sizeof (ipha_t)); 8499 tcp->tcp_tcph = tcph; 8500 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8501 /* 8502 * IP wants our header length in the checksum field to 8503 * allow it to perform a single pseudo-header+checksum 8504 * calculation on behalf of TCP. 8505 * Include the adjustment for a source route once IP_OPTIONS is set. 8506 */ 8507 sum = sizeof (tcph_t) + tcp->tcp_sum; 8508 sum = (sum >> 16) + (sum & 0xFFFF); 8509 U16_TO_ABE16(sum, tcph->th_sum); 8510 return (0); 8511 } 8512 8513 /* 8514 * Initialize the IPv6 header. Loses any record of any IPv6 extension headers. 8515 */ 8516 static int 8517 tcp_header_init_ipv6(tcp_t *tcp) 8518 { 8519 tcph_t *tcph; 8520 uint32_t sum; 8521 8522 /* 8523 * This is a simple initialization. If there's 8524 * already a template, it should never be too small, 8525 * so reuse it. Otherwise, allocate space for the new one. 8526 * Ensure that there is enough space to "downgrade" the tcp_t 8527 * to an IPv4 tcp_t. This requires having space for a full load 8528 * of IPv4 options, as well as a full load of TCP options 8529 * (TCP_MAX_COMBINED_HEADER_LENGTH, 120 bytes); this is more space 8530 * than a v6 header and a TCP header with a full load of TCP options 8531 * (IPV6_HDR_LEN is 40 bytes; TCP_MAX_HDR_LENGTH is 60 bytes). 8532 * We want to avoid reallocation in the "downgraded" case when 8533 * processing outbound IPv4 options. 8534 */ 8535 if (tcp->tcp_iphc == NULL) { 8536 ASSERT(tcp->tcp_iphc_len == 0); 8537 tcp->tcp_iphc_len = TCP_MAX_COMBINED_HEADER_LENGTH; 8538 tcp->tcp_iphc = kmem_cache_alloc(tcp_iphc_cache, KM_NOSLEEP); 8539 if (tcp->tcp_iphc == NULL) { 8540 tcp->tcp_iphc_len = 0; 8541 return (ENOMEM); 8542 } 8543 } 8544 ASSERT(tcp->tcp_iphc_len >= TCP_MAX_COMBINED_HEADER_LENGTH); 8545 tcp->tcp_ipversion = IPV6_VERSION; 8546 tcp->tcp_hdr_len = IPV6_HDR_LEN + sizeof (tcph_t); 8547 tcp->tcp_tcp_hdr_len = sizeof (tcph_t); 8548 tcp->tcp_ip_hdr_len = IPV6_HDR_LEN; 8549 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 8550 tcp->tcp_ipha = NULL; 8551 8552 /* Initialize the header template */ 8553 8554 tcp->tcp_ip6h->ip6_vcf = IPV6_DEFAULT_VERS_AND_FLOW; 8555 tcp->tcp_ip6h->ip6_plen = ntohs(sizeof (tcph_t)); 8556 tcp->tcp_ip6h->ip6_nxt = IPPROTO_TCP; 8557 tcp->tcp_ip6h->ip6_hops = (uint8_t)tcp_ipv6_hoplimit; 8558 8559 tcph = (tcph_t *)(tcp->tcp_iphc + IPV6_HDR_LEN); 8560 tcp->tcp_tcph = tcph; 8561 tcph->th_offset_and_rsrvd[0] = (5 << 4); 8562 /* 8563 * IP wants our header length in the checksum field to 8564 * allow it to perform a single psuedo-header+checksum 8565 * calculation on behalf of TCP. 8566 * Include the adjustment for a source route when IPV6_RTHDR is set. 8567 */ 8568 sum = sizeof (tcph_t) + tcp->tcp_sum; 8569 sum = (sum >> 16) + (sum & 0xFFFF); 8570 U16_TO_ABE16(sum, tcph->th_sum); 8571 return (0); 8572 } 8573 8574 /* At minimum we need 4 bytes in the TCP header for the lookup */ 8575 #define ICMP_MIN_TCP_HDR 4 8576 8577 /* 8578 * tcp_icmp_error is called by tcp_rput_other to process ICMP error messages 8579 * passed up by IP. The message is always received on the correct tcp_t. 8580 * Assumes that IP has pulled up everything up to and including the ICMP header. 8581 */ 8582 void 8583 tcp_icmp_error(tcp_t *tcp, mblk_t *mp) 8584 { 8585 icmph_t *icmph; 8586 ipha_t *ipha; 8587 int iph_hdr_length; 8588 tcph_t *tcph; 8589 boolean_t ipsec_mctl = B_FALSE; 8590 boolean_t secure; 8591 mblk_t *first_mp = mp; 8592 uint32_t new_mss; 8593 uint32_t ratio; 8594 size_t mp_size = MBLKL(mp); 8595 uint32_t seg_ack; 8596 uint32_t seg_seq; 8597 8598 /* Assume IP provides aligned packets - otherwise toss */ 8599 if (!OK_32PTR(mp->b_rptr)) { 8600 freemsg(mp); 8601 return; 8602 } 8603 8604 /* 8605 * Since ICMP errors are normal data marked with M_CTL when sent 8606 * to TCP or UDP, we have to look for a IPSEC_IN value to identify 8607 * packets starting with an ipsec_info_t, see ipsec_info.h. 8608 */ 8609 if ((mp_size == sizeof (ipsec_info_t)) && 8610 (((ipsec_info_t *)mp->b_rptr)->ipsec_info_type == IPSEC_IN)) { 8611 ASSERT(mp->b_cont != NULL); 8612 mp = mp->b_cont; 8613 /* IP should have done this */ 8614 ASSERT(OK_32PTR(mp->b_rptr)); 8615 mp_size = MBLKL(mp); 8616 ipsec_mctl = B_TRUE; 8617 } 8618 8619 /* 8620 * Verify that we have a complete outer IP header. If not, drop it. 8621 */ 8622 if (mp_size < sizeof (ipha_t)) { 8623 noticmpv4: 8624 freemsg(first_mp); 8625 return; 8626 } 8627 8628 ipha = (ipha_t *)mp->b_rptr; 8629 /* 8630 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 8631 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 8632 */ 8633 switch (IPH_HDR_VERSION(ipha)) { 8634 case IPV6_VERSION: 8635 tcp_icmp_error_ipv6(tcp, first_mp, ipsec_mctl); 8636 return; 8637 case IPV4_VERSION: 8638 break; 8639 default: 8640 goto noticmpv4; 8641 } 8642 8643 /* Skip past the outer IP and ICMP headers */ 8644 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8645 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 8646 /* 8647 * If we don't have the correct outer IP header length or if the ULP 8648 * is not IPPROTO_ICMP or if we don't have a complete inner IP header 8649 * send it upstream. 8650 */ 8651 if (iph_hdr_length < sizeof (ipha_t) || 8652 ipha->ipha_protocol != IPPROTO_ICMP || 8653 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 8654 goto noticmpv4; 8655 } 8656 ipha = (ipha_t *)&icmph[1]; 8657 8658 /* Skip past the inner IP and find the ULP header */ 8659 iph_hdr_length = IPH_HDR_LENGTH(ipha); 8660 tcph = (tcph_t *)((char *)ipha + iph_hdr_length); 8661 /* 8662 * If we don't have the correct inner IP header length or if the ULP 8663 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 8664 * bytes of TCP header, drop it. 8665 */ 8666 if (iph_hdr_length < sizeof (ipha_t) || 8667 ipha->ipha_protocol != IPPROTO_TCP || 8668 (uchar_t *)tcph + ICMP_MIN_TCP_HDR > mp->b_wptr) { 8669 goto noticmpv4; 8670 } 8671 8672 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 8673 if (ipsec_mctl) { 8674 secure = ipsec_in_is_secure(first_mp); 8675 } else { 8676 secure = B_FALSE; 8677 } 8678 if (secure) { 8679 /* 8680 * If we are willing to accept this in clear 8681 * we don't have to verify policy. 8682 */ 8683 if (!ipsec_inbound_accept_clear(mp, ipha, NULL)) { 8684 if (!tcp_check_policy(tcp, first_mp, 8685 ipha, NULL, secure, ipsec_mctl)) { 8686 /* 8687 * tcp_check_policy called 8688 * ip_drop_packet() on failure. 8689 */ 8690 return; 8691 } 8692 } 8693 } 8694 } else if (ipsec_mctl) { 8695 /* 8696 * This is a hard_bound connection. IP has already 8697 * verified policy. We don't have to do it again. 8698 */ 8699 freeb(first_mp); 8700 first_mp = mp; 8701 ipsec_mctl = B_FALSE; 8702 } 8703 8704 seg_ack = ABE32_TO_U32(tcph->th_ack); 8705 seg_seq = ABE32_TO_U32(tcph->th_seq); 8706 /* 8707 * TCP SHOULD check that the TCP sequence number contained in 8708 * payload of the ICMP error message is within the range 8709 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8710 */ 8711 if (SEQ_LT(seg_seq, tcp->tcp_suna) || 8712 SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8713 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8714 /* 8715 * If the ICMP message is bogus, should we kill the 8716 * connection, or should we just drop the bogus ICMP 8717 * message? It would probably make more sense to just 8718 * drop the message so that if this one managed to get 8719 * in, the real connection should not suffer. 8720 */ 8721 goto noticmpv4; 8722 } 8723 8724 switch (icmph->icmph_type) { 8725 case ICMP_DEST_UNREACHABLE: 8726 switch (icmph->icmph_code) { 8727 case ICMP_FRAGMENTATION_NEEDED: 8728 /* 8729 * Reduce the MSS based on the new MTU. This will 8730 * eliminate any fragmentation locally. 8731 * N.B. There may well be some funny side-effects on 8732 * the local send policy and the remote receive policy. 8733 * Pending further research, we provide 8734 * tcp_ignore_path_mtu just in case this proves 8735 * disastrous somewhere. 8736 * 8737 * After updating the MSS, retransmit part of the 8738 * dropped segment using the new mss by calling 8739 * tcp_wput_data(). Need to adjust all those 8740 * params to make sure tcp_wput_data() work properly. 8741 */ 8742 if (tcp_ignore_path_mtu) 8743 break; 8744 8745 /* 8746 * Decrease the MSS by time stamp options 8747 * IP options and IPSEC options. tcp_hdr_len 8748 * includes time stamp option and IP option 8749 * length. 8750 */ 8751 8752 new_mss = ntohs(icmph->icmph_du_mtu) - 8753 tcp->tcp_hdr_len - tcp->tcp_ipsec_overhead; 8754 8755 /* 8756 * Only update the MSS if the new one is 8757 * smaller than the previous one. This is 8758 * to avoid problems when getting multiple 8759 * ICMP errors for the same MTU. 8760 */ 8761 if (new_mss >= tcp->tcp_mss) 8762 break; 8763 8764 /* 8765 * Stop doing PMTU if new_mss is less than 68 8766 * or less than tcp_mss_min. 8767 * The value 68 comes from rfc 1191. 8768 */ 8769 if (new_mss < MAX(68, tcp_mss_min)) 8770 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 8771 0; 8772 8773 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 8774 ASSERT(ratio >= 1); 8775 tcp_mss_set(tcp, new_mss); 8776 8777 /* 8778 * Make sure we have something to 8779 * send. 8780 */ 8781 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 8782 (tcp->tcp_xmit_head != NULL)) { 8783 /* 8784 * Shrink tcp_cwnd in 8785 * proportion to the old MSS/new MSS. 8786 */ 8787 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 8788 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 8789 (tcp->tcp_unsent == 0)) { 8790 tcp->tcp_rexmit_max = tcp->tcp_fss; 8791 } else { 8792 tcp->tcp_rexmit_max = tcp->tcp_snxt; 8793 } 8794 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 8795 tcp->tcp_rexmit = B_TRUE; 8796 tcp->tcp_dupack_cnt = 0; 8797 tcp->tcp_snd_burst = TCP_CWND_SS; 8798 tcp_ss_rexmit(tcp); 8799 } 8800 break; 8801 case ICMP_PORT_UNREACHABLE: 8802 case ICMP_PROTOCOL_UNREACHABLE: 8803 switch (tcp->tcp_state) { 8804 case TCPS_SYN_SENT: 8805 case TCPS_SYN_RCVD: 8806 /* 8807 * ICMP can snipe away incipient 8808 * TCP connections as long as 8809 * seq number is same as initial 8810 * send seq number. 8811 */ 8812 if (seg_seq == tcp->tcp_iss) { 8813 (void) tcp_clean_death(tcp, 8814 ECONNREFUSED, 6); 8815 } 8816 break; 8817 } 8818 break; 8819 case ICMP_HOST_UNREACHABLE: 8820 case ICMP_NET_UNREACHABLE: 8821 /* Record the error in case we finally time out. */ 8822 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 8823 tcp->tcp_client_errno = EHOSTUNREACH; 8824 else 8825 tcp->tcp_client_errno = ENETUNREACH; 8826 if (tcp->tcp_state == TCPS_SYN_RCVD) { 8827 if (tcp->tcp_listener != NULL && 8828 tcp->tcp_listener->tcp_syn_defense) { 8829 /* 8830 * Ditch the half-open connection if we 8831 * suspect a SYN attack is under way. 8832 */ 8833 tcp_ip_ire_mark_advice(tcp); 8834 (void) tcp_clean_death(tcp, 8835 tcp->tcp_client_errno, 7); 8836 } 8837 } 8838 break; 8839 default: 8840 break; 8841 } 8842 break; 8843 case ICMP_SOURCE_QUENCH: { 8844 /* 8845 * use a global boolean to control 8846 * whether TCP should respond to ICMP_SOURCE_QUENCH. 8847 * The default is false. 8848 */ 8849 if (tcp_icmp_source_quench) { 8850 /* 8851 * Reduce the sending rate as if we got a 8852 * retransmit timeout 8853 */ 8854 uint32_t npkt; 8855 8856 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 8857 tcp->tcp_mss; 8858 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 8859 tcp->tcp_cwnd = tcp->tcp_mss; 8860 tcp->tcp_cwnd_cnt = 0; 8861 } 8862 break; 8863 } 8864 } 8865 freemsg(first_mp); 8866 } 8867 8868 /* 8869 * tcp_icmp_error_ipv6 is called by tcp_rput_other to process ICMPv6 8870 * error messages passed up by IP. 8871 * Assumes that IP has pulled up all the extension headers as well 8872 * as the ICMPv6 header. 8873 */ 8874 static void 8875 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, boolean_t ipsec_mctl) 8876 { 8877 icmp6_t *icmp6; 8878 ip6_t *ip6h; 8879 uint16_t iph_hdr_length; 8880 tcpha_t *tcpha; 8881 uint8_t *nexthdrp; 8882 uint32_t new_mss; 8883 uint32_t ratio; 8884 boolean_t secure; 8885 mblk_t *first_mp = mp; 8886 size_t mp_size; 8887 uint32_t seg_ack; 8888 uint32_t seg_seq; 8889 8890 /* 8891 * The caller has determined if this is an IPSEC_IN packet and 8892 * set ipsec_mctl appropriately (see tcp_icmp_error). 8893 */ 8894 if (ipsec_mctl) 8895 mp = mp->b_cont; 8896 8897 mp_size = MBLKL(mp); 8898 8899 /* 8900 * Verify that we have a complete IP header. If not, send it upstream. 8901 */ 8902 if (mp_size < sizeof (ip6_t)) { 8903 noticmpv6: 8904 freemsg(first_mp); 8905 return; 8906 } 8907 8908 /* 8909 * Verify this is an ICMPV6 packet, else send it upstream. 8910 */ 8911 ip6h = (ip6_t *)mp->b_rptr; 8912 if (ip6h->ip6_nxt == IPPROTO_ICMPV6) { 8913 iph_hdr_length = IPV6_HDR_LEN; 8914 } else if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, 8915 &nexthdrp) || 8916 *nexthdrp != IPPROTO_ICMPV6) { 8917 goto noticmpv6; 8918 } 8919 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 8920 ip6h = (ip6_t *)&icmp6[1]; 8921 /* 8922 * Verify if we have a complete ICMP and inner IP header. 8923 */ 8924 if ((uchar_t *)&ip6h[1] > mp->b_wptr) 8925 goto noticmpv6; 8926 8927 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 8928 goto noticmpv6; 8929 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 8930 /* 8931 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 8932 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 8933 * packet. 8934 */ 8935 if ((*nexthdrp != IPPROTO_TCP) || 8936 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 8937 goto noticmpv6; 8938 } 8939 8940 /* 8941 * ICMP errors come on the right queue or come on 8942 * listener/global queue for detached connections and 8943 * get switched to the right queue. If it comes on the 8944 * right queue, policy check has already been done by IP 8945 * and thus free the first_mp without verifying the policy. 8946 * If it has come for a non-hard bound connection, we need 8947 * to verify policy as IP may not have done it. 8948 */ 8949 if (!tcp->tcp_hard_bound) { 8950 if (ipsec_mctl) { 8951 secure = ipsec_in_is_secure(first_mp); 8952 } else { 8953 secure = B_FALSE; 8954 } 8955 if (secure) { 8956 /* 8957 * If we are willing to accept this in clear 8958 * we don't have to verify policy. 8959 */ 8960 if (!ipsec_inbound_accept_clear(mp, NULL, ip6h)) { 8961 if (!tcp_check_policy(tcp, first_mp, 8962 NULL, ip6h, secure, ipsec_mctl)) { 8963 /* 8964 * tcp_check_policy called 8965 * ip_drop_packet() on failure. 8966 */ 8967 return; 8968 } 8969 } 8970 } 8971 } else if (ipsec_mctl) { 8972 /* 8973 * This is a hard_bound connection. IP has already 8974 * verified policy. We don't have to do it again. 8975 */ 8976 freeb(first_mp); 8977 first_mp = mp; 8978 ipsec_mctl = B_FALSE; 8979 } 8980 8981 seg_ack = ntohl(tcpha->tha_ack); 8982 seg_seq = ntohl(tcpha->tha_seq); 8983 /* 8984 * TCP SHOULD check that the TCP sequence number contained in 8985 * payload of the ICMP error message is within the range 8986 * SND.UNA <= SEG.SEQ < SND.NXT. and also SEG.ACK <= RECV.NXT 8987 */ 8988 if (SEQ_LT(seg_seq, tcp->tcp_suna) || SEQ_GEQ(seg_seq, tcp->tcp_snxt) || 8989 SEQ_GT(seg_ack, tcp->tcp_rnxt)) { 8990 /* 8991 * If the ICMP message is bogus, should we kill the 8992 * connection, or should we just drop the bogus ICMP 8993 * message? It would probably make more sense to just 8994 * drop the message so that if this one managed to get 8995 * in, the real connection should not suffer. 8996 */ 8997 goto noticmpv6; 8998 } 8999 9000 switch (icmp6->icmp6_type) { 9001 case ICMP6_PACKET_TOO_BIG: 9002 /* 9003 * Reduce the MSS based on the new MTU. This will 9004 * eliminate any fragmentation locally. 9005 * N.B. There may well be some funny side-effects on 9006 * the local send policy and the remote receive policy. 9007 * Pending further research, we provide 9008 * tcp_ignore_path_mtu just in case this proves 9009 * disastrous somewhere. 9010 * 9011 * After updating the MSS, retransmit part of the 9012 * dropped segment using the new mss by calling 9013 * tcp_wput_data(). Need to adjust all those 9014 * params to make sure tcp_wput_data() work properly. 9015 */ 9016 if (tcp_ignore_path_mtu) 9017 break; 9018 9019 /* 9020 * Decrease the MSS by time stamp options 9021 * IP options and IPSEC options. tcp_hdr_len 9022 * includes time stamp option and IP option 9023 * length. 9024 */ 9025 new_mss = ntohs(icmp6->icmp6_mtu) - tcp->tcp_hdr_len - 9026 tcp->tcp_ipsec_overhead; 9027 9028 /* 9029 * Only update the MSS if the new one is 9030 * smaller than the previous one. This is 9031 * to avoid problems when getting multiple 9032 * ICMP errors for the same MTU. 9033 */ 9034 if (new_mss >= tcp->tcp_mss) 9035 break; 9036 9037 ratio = tcp->tcp_cwnd / tcp->tcp_mss; 9038 ASSERT(ratio >= 1); 9039 tcp_mss_set(tcp, new_mss); 9040 9041 /* 9042 * Make sure we have something to 9043 * send. 9044 */ 9045 if (SEQ_LT(tcp->tcp_suna, tcp->tcp_snxt) && 9046 (tcp->tcp_xmit_head != NULL)) { 9047 /* 9048 * Shrink tcp_cwnd in 9049 * proportion to the old MSS/new MSS. 9050 */ 9051 tcp->tcp_cwnd = ratio * tcp->tcp_mss; 9052 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 9053 (tcp->tcp_unsent == 0)) { 9054 tcp->tcp_rexmit_max = tcp->tcp_fss; 9055 } else { 9056 tcp->tcp_rexmit_max = tcp->tcp_snxt; 9057 } 9058 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 9059 tcp->tcp_rexmit = B_TRUE; 9060 tcp->tcp_dupack_cnt = 0; 9061 tcp->tcp_snd_burst = TCP_CWND_SS; 9062 tcp_ss_rexmit(tcp); 9063 } 9064 break; 9065 9066 case ICMP6_DST_UNREACH: 9067 switch (icmp6->icmp6_code) { 9068 case ICMP6_DST_UNREACH_NOPORT: 9069 if (((tcp->tcp_state == TCPS_SYN_SENT) || 9070 (tcp->tcp_state == TCPS_SYN_RCVD)) && 9071 (tcpha->tha_seq == tcp->tcp_iss)) { 9072 (void) tcp_clean_death(tcp, 9073 ECONNREFUSED, 8); 9074 } 9075 break; 9076 9077 case ICMP6_DST_UNREACH_ADMIN: 9078 case ICMP6_DST_UNREACH_NOROUTE: 9079 case ICMP6_DST_UNREACH_BEYONDSCOPE: 9080 case ICMP6_DST_UNREACH_ADDR: 9081 /* Record the error in case we finally time out. */ 9082 tcp->tcp_client_errno = EHOSTUNREACH; 9083 if (((tcp->tcp_state == TCPS_SYN_SENT) || 9084 (tcp->tcp_state == TCPS_SYN_RCVD)) && 9085 (tcpha->tha_seq == tcp->tcp_iss)) { 9086 if (tcp->tcp_listener != NULL && 9087 tcp->tcp_listener->tcp_syn_defense) { 9088 /* 9089 * Ditch the half-open connection if we 9090 * suspect a SYN attack is under way. 9091 */ 9092 tcp_ip_ire_mark_advice(tcp); 9093 (void) tcp_clean_death(tcp, 9094 tcp->tcp_client_errno, 9); 9095 } 9096 } 9097 9098 9099 break; 9100 default: 9101 break; 9102 } 9103 break; 9104 9105 case ICMP6_PARAM_PROB: 9106 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 9107 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 9108 (uchar_t *)ip6h + icmp6->icmp6_pptr == 9109 (uchar_t *)nexthdrp) { 9110 if (tcp->tcp_state == TCPS_SYN_SENT || 9111 tcp->tcp_state == TCPS_SYN_RCVD) { 9112 (void) tcp_clean_death(tcp, 9113 ECONNREFUSED, 10); 9114 } 9115 break; 9116 } 9117 break; 9118 9119 case ICMP6_TIME_EXCEEDED: 9120 default: 9121 break; 9122 } 9123 freemsg(first_mp); 9124 } 9125 9126 /* 9127 * IP recognizes seven kinds of bind requests: 9128 * 9129 * - A zero-length address binds only to the protocol number. 9130 * 9131 * - A 4-byte address is treated as a request to 9132 * validate that the address is a valid local IPv4 9133 * address, appropriate for an application to bind to. 9134 * IP does the verification, but does not make any note 9135 * of the address at this time. 9136 * 9137 * - A 16-byte address contains is treated as a request 9138 * to validate a local IPv6 address, as the 4-byte 9139 * address case above. 9140 * 9141 * - A 16-byte sockaddr_in to validate the local IPv4 address and also 9142 * use it for the inbound fanout of packets. 9143 * 9144 * - A 24-byte sockaddr_in6 to validate the local IPv6 address and also 9145 * use it for the inbound fanout of packets. 9146 * 9147 * - A 12-byte address (ipa_conn_t) containing complete IPv4 fanout 9148 * information consisting of local and remote addresses 9149 * and ports. In this case, the addresses are both 9150 * validated as appropriate for this operation, and, if 9151 * so, the information is retained for use in the 9152 * inbound fanout. 9153 * 9154 * - A 36-byte address address (ipa6_conn_t) containing complete IPv6 9155 * fanout information, like the 12-byte case above. 9156 * 9157 * IP will also fill in the IRE request mblk with information 9158 * regarding our peer. In all cases, we notify IP of our protocol 9159 * type by appending a single protocol byte to the bind request. 9160 */ 9161 static mblk_t * 9162 tcp_ip_bind_mp(tcp_t *tcp, t_scalar_t bind_prim, t_scalar_t addr_length) 9163 { 9164 char *cp; 9165 mblk_t *mp; 9166 struct T_bind_req *tbr; 9167 ipa_conn_t *ac; 9168 ipa6_conn_t *ac6; 9169 sin_t *sin; 9170 sin6_t *sin6; 9171 9172 ASSERT(bind_prim == O_T_BIND_REQ || bind_prim == T_BIND_REQ); 9173 ASSERT((tcp->tcp_family == AF_INET && 9174 tcp->tcp_ipversion == IPV4_VERSION) || 9175 (tcp->tcp_family == AF_INET6 && 9176 (tcp->tcp_ipversion == IPV4_VERSION || 9177 tcp->tcp_ipversion == IPV6_VERSION))); 9178 9179 mp = allocb(sizeof (*tbr) + addr_length + 1, BPRI_HI); 9180 if (!mp) 9181 return (mp); 9182 mp->b_datap->db_type = M_PROTO; 9183 tbr = (struct T_bind_req *)mp->b_rptr; 9184 tbr->PRIM_type = bind_prim; 9185 tbr->ADDR_offset = sizeof (*tbr); 9186 tbr->CONIND_number = 0; 9187 tbr->ADDR_length = addr_length; 9188 cp = (char *)&tbr[1]; 9189 switch (addr_length) { 9190 case sizeof (ipa_conn_t): 9191 ASSERT(tcp->tcp_family == AF_INET); 9192 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 9193 9194 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 9195 if (mp->b_cont == NULL) { 9196 freemsg(mp); 9197 return (NULL); 9198 } 9199 mp->b_cont->b_wptr += sizeof (ire_t); 9200 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 9201 9202 /* cp known to be 32 bit aligned */ 9203 ac = (ipa_conn_t *)cp; 9204 ac->ac_laddr = tcp->tcp_ipha->ipha_src; 9205 ac->ac_faddr = tcp->tcp_remote; 9206 ac->ac_fport = tcp->tcp_fport; 9207 ac->ac_lport = tcp->tcp_lport; 9208 tcp->tcp_hard_binding = 1; 9209 break; 9210 9211 case sizeof (ipa6_conn_t): 9212 ASSERT(tcp->tcp_family == AF_INET6); 9213 9214 mp->b_cont = allocb(sizeof (ire_t), BPRI_HI); 9215 if (mp->b_cont == NULL) { 9216 freemsg(mp); 9217 return (NULL); 9218 } 9219 mp->b_cont->b_wptr += sizeof (ire_t); 9220 mp->b_cont->b_datap->db_type = IRE_DB_REQ_TYPE; 9221 9222 /* cp known to be 32 bit aligned */ 9223 ac6 = (ipa6_conn_t *)cp; 9224 if (tcp->tcp_ipversion == IPV4_VERSION) { 9225 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 9226 &ac6->ac6_laddr); 9227 } else { 9228 ac6->ac6_laddr = tcp->tcp_ip6h->ip6_src; 9229 } 9230 ac6->ac6_faddr = tcp->tcp_remote_v6; 9231 ac6->ac6_fport = tcp->tcp_fport; 9232 ac6->ac6_lport = tcp->tcp_lport; 9233 tcp->tcp_hard_binding = 1; 9234 break; 9235 9236 case sizeof (sin_t): 9237 /* 9238 * NOTE: IPV6_ADDR_LEN also has same size. 9239 * Use family to discriminate. 9240 */ 9241 if (tcp->tcp_family == AF_INET) { 9242 sin = (sin_t *)cp; 9243 9244 *sin = sin_null; 9245 sin->sin_family = AF_INET; 9246 sin->sin_addr.s_addr = tcp->tcp_bound_source; 9247 sin->sin_port = tcp->tcp_lport; 9248 break; 9249 } else { 9250 *(in6_addr_t *)cp = tcp->tcp_bound_source_v6; 9251 } 9252 break; 9253 9254 case sizeof (sin6_t): 9255 ASSERT(tcp->tcp_family == AF_INET6); 9256 sin6 = (sin6_t *)cp; 9257 9258 *sin6 = sin6_null; 9259 sin6->sin6_family = AF_INET6; 9260 sin6->sin6_addr = tcp->tcp_bound_source_v6; 9261 sin6->sin6_port = tcp->tcp_lport; 9262 break; 9263 9264 case IP_ADDR_LEN: 9265 ASSERT(tcp->tcp_ipversion == IPV4_VERSION); 9266 *(uint32_t *)cp = tcp->tcp_ipha->ipha_src; 9267 break; 9268 9269 } 9270 /* Add protocol number to end */ 9271 cp[addr_length] = (char)IPPROTO_TCP; 9272 mp->b_wptr = (uchar_t *)&cp[addr_length + 1]; 9273 return (mp); 9274 } 9275 9276 /* 9277 * Notify IP that we are having trouble with this connection. IP should 9278 * blow the IRE away and start over. 9279 */ 9280 static void 9281 tcp_ip_notify(tcp_t *tcp) 9282 { 9283 struct iocblk *iocp; 9284 ipid_t *ipid; 9285 mblk_t *mp; 9286 9287 /* IPv6 has NUD thus notification to delete the IRE is not needed */ 9288 if (tcp->tcp_ipversion == IPV6_VERSION) 9289 return; 9290 9291 mp = mkiocb(IP_IOCTL); 9292 if (mp == NULL) 9293 return; 9294 9295 iocp = (struct iocblk *)mp->b_rptr; 9296 iocp->ioc_count = sizeof (ipid_t) + sizeof (tcp->tcp_ipha->ipha_dst); 9297 9298 mp->b_cont = allocb(iocp->ioc_count, BPRI_HI); 9299 if (!mp->b_cont) { 9300 freeb(mp); 9301 return; 9302 } 9303 9304 ipid = (ipid_t *)mp->b_cont->b_rptr; 9305 mp->b_cont->b_wptr += iocp->ioc_count; 9306 bzero(ipid, sizeof (*ipid)); 9307 ipid->ipid_cmd = IP_IOC_IRE_DELETE_NO_REPLY; 9308 ipid->ipid_ire_type = IRE_CACHE; 9309 ipid->ipid_addr_offset = sizeof (ipid_t); 9310 ipid->ipid_addr_length = sizeof (tcp->tcp_ipha->ipha_dst); 9311 /* 9312 * Note: in the case of source routing we want to blow away the 9313 * route to the first source route hop. 9314 */ 9315 bcopy(&tcp->tcp_ipha->ipha_dst, &ipid[1], 9316 sizeof (tcp->tcp_ipha->ipha_dst)); 9317 9318 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 9319 } 9320 9321 /* Unlink and return any mblk that looks like it contains an ire */ 9322 static mblk_t * 9323 tcp_ire_mp(mblk_t *mp) 9324 { 9325 mblk_t *prev_mp; 9326 9327 for (;;) { 9328 prev_mp = mp; 9329 mp = mp->b_cont; 9330 if (mp == NULL) 9331 break; 9332 switch (DB_TYPE(mp)) { 9333 case IRE_DB_TYPE: 9334 case IRE_DB_REQ_TYPE: 9335 if (prev_mp != NULL) 9336 prev_mp->b_cont = mp->b_cont; 9337 mp->b_cont = NULL; 9338 return (mp); 9339 default: 9340 break; 9341 } 9342 } 9343 return (mp); 9344 } 9345 9346 /* 9347 * Timer callback routine for keepalive probe. We do a fake resend of 9348 * last ACKed byte. Then set a timer using RTO. When the timer expires, 9349 * check to see if we have heard anything from the other end for the last 9350 * RTO period. If we have, set the timer to expire for another 9351 * tcp_keepalive_intrvl and check again. If we have not, set a timer using 9352 * RTO << 1 and check again when it expires. Keep exponentially increasing 9353 * the timeout if we have not heard from the other side. If for more than 9354 * (tcp_ka_interval + tcp_ka_abort_thres) we have not heard anything, 9355 * kill the connection unless the keepalive abort threshold is 0. In 9356 * that case, we will probe "forever." 9357 */ 9358 static void 9359 tcp_keepalive_killer(void *arg) 9360 { 9361 mblk_t *mp; 9362 conn_t *connp = (conn_t *)arg; 9363 tcp_t *tcp = connp->conn_tcp; 9364 int32_t firetime; 9365 int32_t idletime; 9366 int32_t ka_intrvl; 9367 9368 tcp->tcp_ka_tid = 0; 9369 9370 if (tcp->tcp_fused) 9371 return; 9372 9373 BUMP_MIB(&tcp_mib, tcpTimKeepalive); 9374 ka_intrvl = tcp->tcp_ka_interval; 9375 9376 /* 9377 * Keepalive probe should only be sent if the application has not 9378 * done a close on the connection. 9379 */ 9380 if (tcp->tcp_state > TCPS_CLOSE_WAIT) { 9381 return; 9382 } 9383 /* Timer fired too early, restart it. */ 9384 if (tcp->tcp_state < TCPS_ESTABLISHED) { 9385 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9386 MSEC_TO_TICK(ka_intrvl)); 9387 return; 9388 } 9389 9390 idletime = TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time); 9391 /* 9392 * If we have not heard from the other side for a long 9393 * time, kill the connection unless the keepalive abort 9394 * threshold is 0. In that case, we will probe "forever." 9395 */ 9396 if (tcp->tcp_ka_abort_thres != 0 && 9397 idletime > (ka_intrvl + tcp->tcp_ka_abort_thres)) { 9398 BUMP_MIB(&tcp_mib, tcpTimKeepaliveDrop); 9399 (void) tcp_clean_death(tcp, tcp->tcp_client_errno ? 9400 tcp->tcp_client_errno : ETIMEDOUT, 11); 9401 return; 9402 } 9403 9404 if (tcp->tcp_snxt == tcp->tcp_suna && 9405 idletime >= ka_intrvl) { 9406 /* Fake resend of last ACKed byte. */ 9407 mblk_t *mp1 = allocb(1, BPRI_LO); 9408 9409 if (mp1 != NULL) { 9410 *mp1->b_wptr++ = '\0'; 9411 mp = tcp_xmit_mp(tcp, mp1, 1, NULL, NULL, 9412 tcp->tcp_suna - 1, B_FALSE, NULL, B_TRUE); 9413 freeb(mp1); 9414 /* 9415 * if allocation failed, fall through to start the 9416 * timer back. 9417 */ 9418 if (mp != NULL) { 9419 TCP_RECORD_TRACE(tcp, mp, 9420 TCP_TRACE_SEND_PKT); 9421 tcp_send_data(tcp, tcp->tcp_wq, mp); 9422 BUMP_MIB(&tcp_mib, tcpTimKeepaliveProbe); 9423 if (tcp->tcp_ka_last_intrvl != 0) { 9424 /* 9425 * We should probe again at least 9426 * in ka_intrvl, but not more than 9427 * tcp_rexmit_interval_max. 9428 */ 9429 firetime = MIN(ka_intrvl - 1, 9430 tcp->tcp_ka_last_intrvl << 1); 9431 if (firetime > tcp_rexmit_interval_max) 9432 firetime = 9433 tcp_rexmit_interval_max; 9434 } else { 9435 firetime = tcp->tcp_rto; 9436 } 9437 tcp->tcp_ka_tid = TCP_TIMER(tcp, 9438 tcp_keepalive_killer, 9439 MSEC_TO_TICK(firetime)); 9440 tcp->tcp_ka_last_intrvl = firetime; 9441 return; 9442 } 9443 } 9444 } else { 9445 tcp->tcp_ka_last_intrvl = 0; 9446 } 9447 9448 /* firetime can be negative if (mp1 == NULL || mp == NULL) */ 9449 if ((firetime = ka_intrvl - idletime) < 0) { 9450 firetime = ka_intrvl; 9451 } 9452 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 9453 MSEC_TO_TICK(firetime)); 9454 } 9455 9456 static int 9457 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 9458 { 9459 queue_t *q = tcp->tcp_rq; 9460 int32_t mss = tcp->tcp_mss; 9461 int maxpsz; 9462 9463 if (TCP_IS_DETACHED(tcp)) 9464 return (mss); 9465 9466 if (tcp->tcp_mdt || tcp->tcp_maxpsz == 0) { 9467 /* 9468 * Set the sd_qn_maxpsz according to the socket send buffer 9469 * size, and sd_maxblk to INFPSZ (-1). This will essentially 9470 * instruct the stream head to copyin user data into contiguous 9471 * kernel-allocated buffers without breaking it up into smaller 9472 * chunks. We round up the buffer size to the nearest SMSS. 9473 */ 9474 maxpsz = MSS_ROUNDUP(tcp->tcp_xmit_hiwater, mss); 9475 mss = INFPSZ; 9476 } else { 9477 /* 9478 * Set sd_qn_maxpsz to approx half the (receivers) buffer 9479 * (and a multiple of the mss). This instructs the stream 9480 * head to break down larger than SMSS writes into SMSS- 9481 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 9482 */ 9483 maxpsz = tcp->tcp_maxpsz * mss; 9484 if (maxpsz > tcp->tcp_xmit_hiwater/2) { 9485 maxpsz = tcp->tcp_xmit_hiwater/2; 9486 /* Round up to nearest mss */ 9487 maxpsz = MSS_ROUNDUP(maxpsz, mss); 9488 } 9489 } 9490 (void) setmaxps(q, maxpsz); 9491 tcp->tcp_wq->q_maxpsz = maxpsz; 9492 9493 if (set_maxblk) 9494 (void) mi_set_sth_maxblk(q, mss); 9495 9496 if (tcp->tcp_loopback) 9497 (void) mi_set_sth_copyopt(tcp->tcp_rq, COPYCACHED); 9498 9499 return (mss); 9500 } 9501 9502 /* 9503 * Extract option values from a tcp header. We put any found values into the 9504 * tcpopt struct and return a bitmask saying which options were found. 9505 */ 9506 static int 9507 tcp_parse_options(tcph_t *tcph, tcp_opt_t *tcpopt) 9508 { 9509 uchar_t *endp; 9510 int len; 9511 uint32_t mss; 9512 uchar_t *up = (uchar_t *)tcph; 9513 int found = 0; 9514 int32_t sack_len; 9515 tcp_seq sack_begin, sack_end; 9516 tcp_t *tcp; 9517 9518 endp = up + TCP_HDR_LENGTH(tcph); 9519 up += TCP_MIN_HEADER_LENGTH; 9520 while (up < endp) { 9521 len = endp - up; 9522 switch (*up) { 9523 case TCPOPT_EOL: 9524 break; 9525 9526 case TCPOPT_NOP: 9527 up++; 9528 continue; 9529 9530 case TCPOPT_MAXSEG: 9531 if (len < TCPOPT_MAXSEG_LEN || 9532 up[1] != TCPOPT_MAXSEG_LEN) 9533 break; 9534 9535 mss = BE16_TO_U16(up+2); 9536 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 9537 tcpopt->tcp_opt_mss = mss; 9538 found |= TCP_OPT_MSS_PRESENT; 9539 9540 up += TCPOPT_MAXSEG_LEN; 9541 continue; 9542 9543 case TCPOPT_WSCALE: 9544 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 9545 break; 9546 9547 if (up[2] > TCP_MAX_WINSHIFT) 9548 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 9549 else 9550 tcpopt->tcp_opt_wscale = up[2]; 9551 found |= TCP_OPT_WSCALE_PRESENT; 9552 9553 up += TCPOPT_WS_LEN; 9554 continue; 9555 9556 case TCPOPT_SACK_PERMITTED: 9557 if (len < TCPOPT_SACK_OK_LEN || 9558 up[1] != TCPOPT_SACK_OK_LEN) 9559 break; 9560 found |= TCP_OPT_SACK_OK_PRESENT; 9561 up += TCPOPT_SACK_OK_LEN; 9562 continue; 9563 9564 case TCPOPT_SACK: 9565 if (len <= 2 || up[1] <= 2 || len < up[1]) 9566 break; 9567 9568 /* If TCP is not interested in SACK blks... */ 9569 if ((tcp = tcpopt->tcp) == NULL) { 9570 up += up[1]; 9571 continue; 9572 } 9573 sack_len = up[1] - TCPOPT_HEADER_LEN; 9574 up += TCPOPT_HEADER_LEN; 9575 9576 /* 9577 * If the list is empty, allocate one and assume 9578 * nothing is sack'ed. 9579 */ 9580 ASSERT(tcp->tcp_sack_info != NULL); 9581 if (tcp->tcp_notsack_list == NULL) { 9582 tcp_notsack_update(&(tcp->tcp_notsack_list), 9583 tcp->tcp_suna, tcp->tcp_snxt, 9584 &(tcp->tcp_num_notsack_blk), 9585 &(tcp->tcp_cnt_notsack_list)); 9586 9587 /* 9588 * Make sure tcp_notsack_list is not NULL. 9589 * This happens when kmem_alloc(KM_NOSLEEP) 9590 * returns NULL. 9591 */ 9592 if (tcp->tcp_notsack_list == NULL) { 9593 up += sack_len; 9594 continue; 9595 } 9596 tcp->tcp_fack = tcp->tcp_suna; 9597 } 9598 9599 while (sack_len > 0) { 9600 if (up + 8 > endp) { 9601 up = endp; 9602 break; 9603 } 9604 sack_begin = BE32_TO_U32(up); 9605 up += 4; 9606 sack_end = BE32_TO_U32(up); 9607 up += 4; 9608 sack_len -= 8; 9609 /* 9610 * Bounds checking. Make sure the SACK 9611 * info is within tcp_suna and tcp_snxt. 9612 * If this SACK blk is out of bound, ignore 9613 * it but continue to parse the following 9614 * blks. 9615 */ 9616 if (SEQ_LEQ(sack_end, sack_begin) || 9617 SEQ_LT(sack_begin, tcp->tcp_suna) || 9618 SEQ_GT(sack_end, tcp->tcp_snxt)) { 9619 continue; 9620 } 9621 tcp_notsack_insert(&(tcp->tcp_notsack_list), 9622 sack_begin, sack_end, 9623 &(tcp->tcp_num_notsack_blk), 9624 &(tcp->tcp_cnt_notsack_list)); 9625 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 9626 tcp->tcp_fack = sack_end; 9627 } 9628 } 9629 found |= TCP_OPT_SACK_PRESENT; 9630 continue; 9631 9632 case TCPOPT_TSTAMP: 9633 if (len < TCPOPT_TSTAMP_LEN || 9634 up[1] != TCPOPT_TSTAMP_LEN) 9635 break; 9636 9637 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 9638 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 9639 9640 found |= TCP_OPT_TSTAMP_PRESENT; 9641 9642 up += TCPOPT_TSTAMP_LEN; 9643 continue; 9644 9645 default: 9646 if (len <= 1 || len < (int)up[1] || up[1] == 0) 9647 break; 9648 up += up[1]; 9649 continue; 9650 } 9651 break; 9652 } 9653 return (found); 9654 } 9655 9656 /* 9657 * Set the mss associated with a particular tcp based on its current value, 9658 * and a new one passed in. Observe minimums and maximums, and reset 9659 * other state variables that we want to view as multiples of mss. 9660 * 9661 * This function is called in various places mainly because 9662 * 1) Various stuffs, tcp_mss, tcp_cwnd, ... need to be adjusted when the 9663 * other side's SYN/SYN-ACK packet arrives. 9664 * 2) PMTUd may get us a new MSS. 9665 * 3) If the other side stops sending us timestamp option, we need to 9666 * increase the MSS size to use the extra bytes available. 9667 */ 9668 static void 9669 tcp_mss_set(tcp_t *tcp, uint32_t mss) 9670 { 9671 uint32_t mss_max; 9672 9673 if (tcp->tcp_ipversion == IPV4_VERSION) 9674 mss_max = tcp_mss_max_ipv4; 9675 else 9676 mss_max = tcp_mss_max_ipv6; 9677 9678 if (mss < tcp_mss_min) 9679 mss = tcp_mss_min; 9680 if (mss > mss_max) 9681 mss = mss_max; 9682 /* 9683 * Unless naglim has been set by our client to 9684 * a non-mss value, force naglim to track mss. 9685 * This can help to aggregate small writes. 9686 */ 9687 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 9688 tcp->tcp_naglim = mss; 9689 /* 9690 * TCP should be able to buffer at least 4 MSS data for obvious 9691 * performance reason. 9692 */ 9693 if ((mss << 2) > tcp->tcp_xmit_hiwater) 9694 tcp->tcp_xmit_hiwater = mss << 2; 9695 9696 /* 9697 * Check if we need to apply the tcp_init_cwnd here. If 9698 * it is set and the MSS gets bigger (should not happen 9699 * normally), we need to adjust the resulting tcp_cwnd properly. 9700 * The new tcp_cwnd should not get bigger. 9701 */ 9702 if (tcp->tcp_init_cwnd == 0) { 9703 tcp->tcp_cwnd = MIN(tcp_slow_start_initial * mss, 9704 MIN(4 * mss, MAX(2 * mss, 4380 / mss * mss))); 9705 } else { 9706 if (tcp->tcp_mss < mss) { 9707 tcp->tcp_cwnd = MAX(1, 9708 (tcp->tcp_init_cwnd * tcp->tcp_mss / mss)) * mss; 9709 } else { 9710 tcp->tcp_cwnd = tcp->tcp_init_cwnd * mss; 9711 } 9712 } 9713 tcp->tcp_mss = mss; 9714 tcp->tcp_cwnd_cnt = 0; 9715 (void) tcp_maxpsz_set(tcp, B_TRUE); 9716 } 9717 9718 static int 9719 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 9720 { 9721 tcp_t *tcp = NULL; 9722 conn_t *connp; 9723 int err; 9724 dev_t conn_dev; 9725 zoneid_t zoneid = getzoneid(); 9726 9727 if (q->q_ptr != NULL) 9728 return (0); 9729 9730 if (sflag == MODOPEN) { 9731 /* 9732 * This is a special case. The purpose of a modopen 9733 * is to allow just the T_SVR4_OPTMGMT_REQ to pass 9734 * through for MIB browsers. Everything else is failed. 9735 */ 9736 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9737 9738 if (connp == NULL) 9739 return (ENOMEM); 9740 9741 connp->conn_flags |= IPCL_TCPMOD; 9742 connp->conn_cred = credp; 9743 connp->conn_zoneid = zoneid; 9744 q->q_ptr = WR(q)->q_ptr = connp; 9745 crhold(credp); 9746 q->q_qinfo = &tcp_mod_rinit; 9747 WR(q)->q_qinfo = &tcp_mod_winit; 9748 qprocson(q); 9749 return (0); 9750 } 9751 9752 if ((conn_dev = inet_minor_alloc(ip_minor_arena)) == 0) 9753 return (EBUSY); 9754 9755 *devp = makedevice(getemajor(*devp), (minor_t)conn_dev); 9756 9757 if (flag & SO_ACCEPTOR) { 9758 q->q_qinfo = &tcp_acceptor_rinit; 9759 q->q_ptr = (void *)conn_dev; 9760 WR(q)->q_qinfo = &tcp_acceptor_winit; 9761 WR(q)->q_ptr = (void *)conn_dev; 9762 qprocson(q); 9763 return (0); 9764 } 9765 9766 connp = (conn_t *)tcp_get_conn(IP_SQUEUE_GET(lbolt)); 9767 if (connp == NULL) { 9768 inet_minor_free(ip_minor_arena, conn_dev); 9769 q->q_ptr = NULL; 9770 return (ENOSR); 9771 } 9772 connp->conn_sqp = IP_SQUEUE_GET(lbolt); 9773 tcp = connp->conn_tcp; 9774 9775 q->q_ptr = WR(q)->q_ptr = connp; 9776 if (getmajor(*devp) == TCP6_MAJ) { 9777 connp->conn_flags |= (IPCL_TCP6|IPCL_ISV6); 9778 connp->conn_send = ip_output_v6; 9779 connp->conn_af_isv6 = B_TRUE; 9780 connp->conn_pkt_isv6 = B_TRUE; 9781 connp->conn_src_preferences = IPV6_PREFER_SRC_DEFAULT; 9782 tcp->tcp_ipversion = IPV6_VERSION; 9783 tcp->tcp_family = AF_INET6; 9784 tcp->tcp_mss = tcp_mss_def_ipv6; 9785 } else { 9786 connp->conn_flags |= IPCL_TCP4; 9787 connp->conn_send = ip_output; 9788 connp->conn_af_isv6 = B_FALSE; 9789 connp->conn_pkt_isv6 = B_FALSE; 9790 tcp->tcp_ipversion = IPV4_VERSION; 9791 tcp->tcp_family = AF_INET; 9792 tcp->tcp_mss = tcp_mss_def_ipv4; 9793 } 9794 9795 /* 9796 * TCP keeps a copy of cred for cache locality reasons but 9797 * we put a reference only once. If connp->conn_cred 9798 * becomes invalid, tcp_cred should also be set to NULL. 9799 */ 9800 tcp->tcp_cred = connp->conn_cred = credp; 9801 crhold(connp->conn_cred); 9802 tcp->tcp_cpid = curproc->p_pid; 9803 connp->conn_zoneid = zoneid; 9804 9805 connp->conn_dev = conn_dev; 9806 9807 ASSERT(q->q_qinfo == &tcp_rinit); 9808 ASSERT(WR(q)->q_qinfo == &tcp_winit); 9809 9810 if (flag & SO_SOCKSTR) { 9811 /* 9812 * No need to insert a socket in tcp acceptor hash. 9813 * If it was a socket acceptor stream, we dealt with 9814 * it above. A socket listener can never accept a 9815 * connection and doesn't need acceptor_id. 9816 */ 9817 connp->conn_flags |= IPCL_SOCKET; 9818 tcp->tcp_issocket = 1; 9819 9820 WR(q)->q_qinfo = &tcp_sock_winit; 9821 } else { 9822 #ifdef _ILP32 9823 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 9824 #else 9825 tcp->tcp_acceptor_id = conn_dev; 9826 #endif /* _ILP32 */ 9827 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 9828 } 9829 9830 if (tcp_trace) 9831 tcp->tcp_tracebuf = kmem_zalloc(sizeof (tcptrch_t), KM_SLEEP); 9832 9833 err = tcp_init(tcp, q); 9834 if (err != 0) { 9835 inet_minor_free(ip_minor_arena, connp->conn_dev); 9836 tcp_acceptor_hash_remove(tcp); 9837 CONN_DEC_REF(connp); 9838 q->q_ptr = WR(q)->q_ptr = NULL; 9839 return (err); 9840 } 9841 9842 RD(q)->q_hiwat = tcp_recv_hiwat; 9843 tcp->tcp_rwnd = tcp_recv_hiwat; 9844 9845 /* Non-zero default values */ 9846 connp->conn_multicast_loop = IP_DEFAULT_MULTICAST_LOOP; 9847 /* 9848 * Put the ref for TCP. Ref for IP was already put 9849 * by ipcl_conn_create. Also Make the conn_t globally 9850 * visible to walkers 9851 */ 9852 mutex_enter(&connp->conn_lock); 9853 CONN_INC_REF_LOCKED(connp); 9854 ASSERT(connp->conn_ref == 2); 9855 connp->conn_state_flags &= ~CONN_INCIPIENT; 9856 mutex_exit(&connp->conn_lock); 9857 9858 qprocson(q); 9859 return (0); 9860 } 9861 9862 /* 9863 * Some TCP options can be "set" by requesting them in the option 9864 * buffer. This is needed for XTI feature test though we do not 9865 * allow it in general. We interpret that this mechanism is more 9866 * applicable to OSI protocols and need not be allowed in general. 9867 * This routine filters out options for which it is not allowed (most) 9868 * and lets through those (few) for which it is. [ The XTI interface 9869 * test suite specifics will imply that any XTI_GENERIC level XTI_* if 9870 * ever implemented will have to be allowed here ]. 9871 */ 9872 static boolean_t 9873 tcp_allow_connopt_set(int level, int name) 9874 { 9875 9876 switch (level) { 9877 case IPPROTO_TCP: 9878 switch (name) { 9879 case TCP_NODELAY: 9880 return (B_TRUE); 9881 default: 9882 return (B_FALSE); 9883 } 9884 /*NOTREACHED*/ 9885 default: 9886 return (B_FALSE); 9887 } 9888 /*NOTREACHED*/ 9889 } 9890 9891 /* 9892 * This routine gets default values of certain options whose default 9893 * values are maintained by protocol specific code 9894 */ 9895 /* ARGSUSED */ 9896 int 9897 tcp_opt_default(queue_t *q, int level, int name, uchar_t *ptr) 9898 { 9899 int32_t *i1 = (int32_t *)ptr; 9900 9901 switch (level) { 9902 case IPPROTO_TCP: 9903 switch (name) { 9904 case TCP_NOTIFY_THRESHOLD: 9905 *i1 = tcp_ip_notify_interval; 9906 break; 9907 case TCP_ABORT_THRESHOLD: 9908 *i1 = tcp_ip_abort_interval; 9909 break; 9910 case TCP_CONN_NOTIFY_THRESHOLD: 9911 *i1 = tcp_ip_notify_cinterval; 9912 break; 9913 case TCP_CONN_ABORT_THRESHOLD: 9914 *i1 = tcp_ip_abort_cinterval; 9915 break; 9916 default: 9917 return (-1); 9918 } 9919 break; 9920 case IPPROTO_IP: 9921 switch (name) { 9922 case IP_TTL: 9923 *i1 = tcp_ipv4_ttl; 9924 break; 9925 default: 9926 return (-1); 9927 } 9928 break; 9929 case IPPROTO_IPV6: 9930 switch (name) { 9931 case IPV6_UNICAST_HOPS: 9932 *i1 = tcp_ipv6_hoplimit; 9933 break; 9934 default: 9935 return (-1); 9936 } 9937 break; 9938 default: 9939 return (-1); 9940 } 9941 return (sizeof (int)); 9942 } 9943 9944 9945 /* 9946 * TCP routine to get the values of options. 9947 */ 9948 int 9949 tcp_opt_get(queue_t *q, int level, int name, uchar_t *ptr) 9950 { 9951 int *i1 = (int *)ptr; 9952 conn_t *connp = Q_TO_CONN(q); 9953 tcp_t *tcp = connp->conn_tcp; 9954 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 9955 9956 switch (level) { 9957 case SOL_SOCKET: 9958 switch (name) { 9959 case SO_LINGER: { 9960 struct linger *lgr = (struct linger *)ptr; 9961 9962 lgr->l_onoff = tcp->tcp_linger ? SO_LINGER : 0; 9963 lgr->l_linger = tcp->tcp_lingertime; 9964 } 9965 return (sizeof (struct linger)); 9966 case SO_DEBUG: 9967 *i1 = tcp->tcp_debug ? SO_DEBUG : 0; 9968 break; 9969 case SO_KEEPALIVE: 9970 *i1 = tcp->tcp_ka_enabled ? SO_KEEPALIVE : 0; 9971 break; 9972 case SO_DONTROUTE: 9973 *i1 = tcp->tcp_dontroute ? SO_DONTROUTE : 0; 9974 break; 9975 case SO_USELOOPBACK: 9976 *i1 = tcp->tcp_useloopback ? SO_USELOOPBACK : 0; 9977 break; 9978 case SO_BROADCAST: 9979 *i1 = tcp->tcp_broadcast ? SO_BROADCAST : 0; 9980 break; 9981 case SO_REUSEADDR: 9982 *i1 = tcp->tcp_reuseaddr ? SO_REUSEADDR : 0; 9983 break; 9984 case SO_OOBINLINE: 9985 *i1 = tcp->tcp_oobinline ? SO_OOBINLINE : 0; 9986 break; 9987 case SO_DGRAM_ERRIND: 9988 *i1 = tcp->tcp_dgram_errind ? SO_DGRAM_ERRIND : 0; 9989 break; 9990 case SO_TYPE: 9991 *i1 = SOCK_STREAM; 9992 break; 9993 case SO_SNDBUF: 9994 *i1 = tcp->tcp_xmit_hiwater; 9995 break; 9996 case SO_RCVBUF: 9997 *i1 = RD(q)->q_hiwat; 9998 break; 9999 case SO_SND_COPYAVOID: 10000 *i1 = tcp->tcp_snd_zcopy_on ? 10001 SO_SND_COPYAVOID : 0; 10002 break; 10003 default: 10004 return (-1); 10005 } 10006 break; 10007 case IPPROTO_TCP: 10008 switch (name) { 10009 case TCP_NODELAY: 10010 *i1 = (tcp->tcp_naglim == 1) ? TCP_NODELAY : 0; 10011 break; 10012 case TCP_MAXSEG: 10013 *i1 = tcp->tcp_mss; 10014 break; 10015 case TCP_NOTIFY_THRESHOLD: 10016 *i1 = (int)tcp->tcp_first_timer_threshold; 10017 break; 10018 case TCP_ABORT_THRESHOLD: 10019 *i1 = tcp->tcp_second_timer_threshold; 10020 break; 10021 case TCP_CONN_NOTIFY_THRESHOLD: 10022 *i1 = tcp->tcp_first_ctimer_threshold; 10023 break; 10024 case TCP_CONN_ABORT_THRESHOLD: 10025 *i1 = tcp->tcp_second_ctimer_threshold; 10026 break; 10027 case TCP_RECVDSTADDR: 10028 *i1 = tcp->tcp_recvdstaddr; 10029 break; 10030 case TCP_ANONPRIVBIND: 10031 *i1 = tcp->tcp_anon_priv_bind; 10032 break; 10033 case TCP_EXCLBIND: 10034 *i1 = tcp->tcp_exclbind ? TCP_EXCLBIND : 0; 10035 break; 10036 case TCP_INIT_CWND: 10037 *i1 = tcp->tcp_init_cwnd; 10038 break; 10039 case TCP_KEEPALIVE_THRESHOLD: 10040 *i1 = tcp->tcp_ka_interval; 10041 break; 10042 case TCP_KEEPALIVE_ABORT_THRESHOLD: 10043 *i1 = tcp->tcp_ka_abort_thres; 10044 break; 10045 case TCP_CORK: 10046 *i1 = tcp->tcp_cork; 10047 break; 10048 default: 10049 return (-1); 10050 } 10051 break; 10052 case IPPROTO_IP: 10053 if (tcp->tcp_family != AF_INET) 10054 return (-1); 10055 switch (name) { 10056 case IP_OPTIONS: 10057 case T_IP_OPTIONS: { 10058 /* 10059 * This is compatible with BSD in that in only return 10060 * the reverse source route with the final destination 10061 * as the last entry. The first 4 bytes of the option 10062 * will contain the final destination. 10063 */ 10064 char *opt_ptr; 10065 int opt_len; 10066 opt_ptr = (char *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; 10067 opt_len = (char *)tcp->tcp_tcph - opt_ptr; 10068 /* Caller ensures enough space */ 10069 if (opt_len > 0) { 10070 /* 10071 * TODO: Do we have to handle getsockopt on an 10072 * initiator as well? 10073 */ 10074 return (tcp_opt_get_user(tcp->tcp_ipha, ptr)); 10075 } 10076 return (0); 10077 } 10078 case IP_TOS: 10079 case T_IP_TOS: 10080 *i1 = (int)tcp->tcp_ipha->ipha_type_of_service; 10081 break; 10082 case IP_TTL: 10083 *i1 = (int)tcp->tcp_ipha->ipha_ttl; 10084 break; 10085 default: 10086 return (-1); 10087 } 10088 break; 10089 case IPPROTO_IPV6: 10090 /* 10091 * IPPROTO_IPV6 options are only supported for sockets 10092 * that are using IPv6 on the wire. 10093 */ 10094 if (tcp->tcp_ipversion != IPV6_VERSION) { 10095 return (-1); 10096 } 10097 switch (name) { 10098 case IPV6_UNICAST_HOPS: 10099 *i1 = (unsigned int) tcp->tcp_ip6h->ip6_hops; 10100 break; /* goto sizeof (int) option return */ 10101 case IPV6_BOUND_IF: 10102 /* Zero if not set */ 10103 *i1 = tcp->tcp_bound_if; 10104 break; /* goto sizeof (int) option return */ 10105 case IPV6_RECVPKTINFO: 10106 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) 10107 *i1 = 1; 10108 else 10109 *i1 = 0; 10110 break; /* goto sizeof (int) option return */ 10111 case IPV6_RECVTCLASS: 10112 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS) 10113 *i1 = 1; 10114 else 10115 *i1 = 0; 10116 break; /* goto sizeof (int) option return */ 10117 case IPV6_RECVHOPLIMIT: 10118 if (tcp->tcp_ipv6_recvancillary & 10119 TCP_IPV6_RECVHOPLIMIT) 10120 *i1 = 1; 10121 else 10122 *i1 = 0; 10123 break; /* goto sizeof (int) option return */ 10124 case IPV6_RECVHOPOPTS: 10125 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) 10126 *i1 = 1; 10127 else 10128 *i1 = 0; 10129 break; /* goto sizeof (int) option return */ 10130 case IPV6_RECVDSTOPTS: 10131 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVDSTOPTS) 10132 *i1 = 1; 10133 else 10134 *i1 = 0; 10135 break; /* goto sizeof (int) option return */ 10136 case _OLD_IPV6_RECVDSTOPTS: 10137 if (tcp->tcp_ipv6_recvancillary & 10138 TCP_OLD_IPV6_RECVDSTOPTS) 10139 *i1 = 1; 10140 else 10141 *i1 = 0; 10142 break; /* goto sizeof (int) option return */ 10143 case IPV6_RECVRTHDR: 10144 if (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) 10145 *i1 = 1; 10146 else 10147 *i1 = 0; 10148 break; /* goto sizeof (int) option return */ 10149 case IPV6_RECVRTHDRDSTOPTS: 10150 if (tcp->tcp_ipv6_recvancillary & 10151 TCP_IPV6_RECVRTDSTOPTS) 10152 *i1 = 1; 10153 else 10154 *i1 = 0; 10155 break; /* goto sizeof (int) option return */ 10156 case IPV6_PKTINFO: { 10157 /* XXX assumes that caller has room for max size! */ 10158 struct in6_pktinfo *pkti; 10159 10160 pkti = (struct in6_pktinfo *)ptr; 10161 if (ipp->ipp_fields & IPPF_IFINDEX) 10162 pkti->ipi6_ifindex = ipp->ipp_ifindex; 10163 else 10164 pkti->ipi6_ifindex = 0; 10165 if (ipp->ipp_fields & IPPF_ADDR) 10166 pkti->ipi6_addr = ipp->ipp_addr; 10167 else 10168 pkti->ipi6_addr = ipv6_all_zeros; 10169 return (sizeof (struct in6_pktinfo)); 10170 } 10171 case IPV6_HOPLIMIT: 10172 if (ipp->ipp_fields & IPPF_HOPLIMIT) 10173 *i1 = ipp->ipp_hoplimit; 10174 else 10175 *i1 = -1; /* Not set */ 10176 break; /* goto sizeof (int) option return */ 10177 case IPV6_TCLASS: 10178 if (ipp->ipp_fields & IPPF_TCLASS) 10179 *i1 = ipp->ipp_tclass; 10180 else 10181 *i1 = IPV6_FLOW_TCLASS( 10182 IPV6_DEFAULT_VERS_AND_FLOW); 10183 break; /* goto sizeof (int) option return */ 10184 case IPV6_NEXTHOP: { 10185 sin6_t *sin6 = (sin6_t *)ptr; 10186 10187 if (!(ipp->ipp_fields & IPPF_NEXTHOP)) 10188 return (0); 10189 *sin6 = sin6_null; 10190 sin6->sin6_family = AF_INET6; 10191 sin6->sin6_addr = ipp->ipp_nexthop; 10192 return (sizeof (sin6_t)); 10193 } 10194 case IPV6_HOPOPTS: 10195 if (!(ipp->ipp_fields & IPPF_HOPOPTS)) 10196 return (0); 10197 bcopy(ipp->ipp_hopopts, ptr, ipp->ipp_hopoptslen); 10198 return (ipp->ipp_hopoptslen); 10199 case IPV6_RTHDRDSTOPTS: 10200 if (!(ipp->ipp_fields & IPPF_RTDSTOPTS)) 10201 return (0); 10202 bcopy(ipp->ipp_rtdstopts, ptr, ipp->ipp_rtdstoptslen); 10203 return (ipp->ipp_rtdstoptslen); 10204 case IPV6_RTHDR: 10205 if (!(ipp->ipp_fields & IPPF_RTHDR)) 10206 return (0); 10207 bcopy(ipp->ipp_rthdr, ptr, ipp->ipp_rthdrlen); 10208 return (ipp->ipp_rthdrlen); 10209 case IPV6_DSTOPTS: 10210 if (!(ipp->ipp_fields & IPPF_DSTOPTS)) 10211 return (0); 10212 bcopy(ipp->ipp_dstopts, ptr, ipp->ipp_dstoptslen); 10213 return (ipp->ipp_dstoptslen); 10214 case IPV6_SRC_PREFERENCES: 10215 return (ip6_get_src_preferences(connp, 10216 (uint32_t *)ptr)); 10217 case IPV6_PATHMTU: { 10218 struct ip6_mtuinfo *mtuinfo = (struct ip6_mtuinfo *)ptr; 10219 10220 if (tcp->tcp_state < TCPS_ESTABLISHED) 10221 return (-1); 10222 10223 return (ip_fill_mtuinfo(&connp->conn_remv6, 10224 connp->conn_fport, mtuinfo)); 10225 } 10226 default: 10227 return (-1); 10228 } 10229 break; 10230 default: 10231 return (-1); 10232 } 10233 return (sizeof (int)); 10234 } 10235 10236 /* 10237 * We declare as 'int' rather than 'void' to satisfy pfi_t arg requirements. 10238 * Parameters are assumed to be verified by the caller. 10239 */ 10240 /* ARGSUSED */ 10241 int 10242 tcp_opt_set(queue_t *q, uint_t optset_context, int level, int name, 10243 uint_t inlen, uchar_t *invalp, uint_t *outlenp, uchar_t *outvalp, 10244 void *thisdg_attrs, cred_t *cr, mblk_t *mblk) 10245 { 10246 tcp_t *tcp = Q_TO_TCP(q); 10247 int *i1 = (int *)invalp; 10248 boolean_t onoff = (*i1 == 0) ? 0 : 1; 10249 boolean_t checkonly; 10250 int reterr; 10251 10252 switch (optset_context) { 10253 case SETFN_OPTCOM_CHECKONLY: 10254 checkonly = B_TRUE; 10255 /* 10256 * Note: Implies T_CHECK semantics for T_OPTCOM_REQ 10257 * inlen != 0 implies value supplied and 10258 * we have to "pretend" to set it. 10259 * inlen == 0 implies that there is no 10260 * value part in T_CHECK request and just validation 10261 * done elsewhere should be enough, we just return here. 10262 */ 10263 if (inlen == 0) { 10264 *outlenp = 0; 10265 return (0); 10266 } 10267 break; 10268 case SETFN_OPTCOM_NEGOTIATE: 10269 checkonly = B_FALSE; 10270 break; 10271 case SETFN_UD_NEGOTIATE: /* error on conn-oriented transports ? */ 10272 case SETFN_CONN_NEGOTIATE: 10273 checkonly = B_FALSE; 10274 /* 10275 * Negotiating local and "association-related" options 10276 * from other (T_CONN_REQ, T_CONN_RES,T_UNITDATA_REQ) 10277 * primitives is allowed by XTI, but we choose 10278 * to not implement this style negotiation for Internet 10279 * protocols (We interpret it is a must for OSI world but 10280 * optional for Internet protocols) for all options. 10281 * [ Will do only for the few options that enable test 10282 * suites that our XTI implementation of this feature 10283 * works for transports that do allow it ] 10284 */ 10285 if (!tcp_allow_connopt_set(level, name)) { 10286 *outlenp = 0; 10287 return (EINVAL); 10288 } 10289 break; 10290 default: 10291 /* 10292 * We should never get here 10293 */ 10294 *outlenp = 0; 10295 return (EINVAL); 10296 } 10297 10298 ASSERT((optset_context != SETFN_OPTCOM_CHECKONLY) || 10299 (optset_context == SETFN_OPTCOM_CHECKONLY && inlen != 0)); 10300 10301 /* 10302 * For TCP, we should have no ancillary data sent down 10303 * (sendmsg isn't supported for SOCK_STREAM), so thisdg_attrs 10304 * has to be zero. 10305 */ 10306 ASSERT(thisdg_attrs == NULL); 10307 10308 /* 10309 * For fixed length options, no sanity check 10310 * of passed in length is done. It is assumed *_optcom_req() 10311 * routines do the right thing. 10312 */ 10313 10314 switch (level) { 10315 case SOL_SOCKET: 10316 switch (name) { 10317 case SO_LINGER: { 10318 struct linger *lgr = (struct linger *)invalp; 10319 10320 if (!checkonly) { 10321 if (lgr->l_onoff) { 10322 tcp->tcp_linger = 1; 10323 tcp->tcp_lingertime = lgr->l_linger; 10324 } else { 10325 tcp->tcp_linger = 0; 10326 tcp->tcp_lingertime = 0; 10327 } 10328 /* struct copy */ 10329 *(struct linger *)outvalp = *lgr; 10330 } else { 10331 if (!lgr->l_onoff) { 10332 ((struct linger *)outvalp)->l_onoff = 0; 10333 ((struct linger *)outvalp)->l_linger = 0; 10334 } else { 10335 /* struct copy */ 10336 *(struct linger *)outvalp = *lgr; 10337 } 10338 } 10339 *outlenp = sizeof (struct linger); 10340 return (0); 10341 } 10342 case SO_DEBUG: 10343 if (!checkonly) 10344 tcp->tcp_debug = onoff; 10345 break; 10346 case SO_KEEPALIVE: 10347 if (checkonly) { 10348 /* T_CHECK case */ 10349 break; 10350 } 10351 10352 if (!onoff) { 10353 if (tcp->tcp_ka_enabled) { 10354 if (tcp->tcp_ka_tid != 0) { 10355 (void) TCP_TIMER_CANCEL(tcp, 10356 tcp->tcp_ka_tid); 10357 tcp->tcp_ka_tid = 0; 10358 } 10359 tcp->tcp_ka_enabled = 0; 10360 } 10361 break; 10362 } 10363 if (!tcp->tcp_ka_enabled) { 10364 /* Crank up the keepalive timer */ 10365 tcp->tcp_ka_last_intrvl = 0; 10366 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10367 tcp_keepalive_killer, 10368 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10369 tcp->tcp_ka_enabled = 1; 10370 } 10371 break; 10372 case SO_DONTROUTE: 10373 /* 10374 * SO_DONTROUTE, SO_USELOOPBACK and SO_BROADCAST are 10375 * only of interest to IP. We track them here only so 10376 * that we can report their current value. 10377 */ 10378 if (!checkonly) { 10379 tcp->tcp_dontroute = onoff; 10380 tcp->tcp_connp->conn_dontroute = onoff; 10381 } 10382 break; 10383 case SO_USELOOPBACK: 10384 if (!checkonly) { 10385 tcp->tcp_useloopback = onoff; 10386 tcp->tcp_connp->conn_loopback = onoff; 10387 } 10388 break; 10389 case SO_BROADCAST: 10390 if (!checkonly) { 10391 tcp->tcp_broadcast = onoff; 10392 tcp->tcp_connp->conn_broadcast = onoff; 10393 } 10394 break; 10395 case SO_REUSEADDR: 10396 if (!checkonly) { 10397 tcp->tcp_reuseaddr = onoff; 10398 tcp->tcp_connp->conn_reuseaddr = onoff; 10399 } 10400 break; 10401 case SO_OOBINLINE: 10402 if (!checkonly) 10403 tcp->tcp_oobinline = onoff; 10404 break; 10405 case SO_DGRAM_ERRIND: 10406 if (!checkonly) 10407 tcp->tcp_dgram_errind = onoff; 10408 break; 10409 case SO_SNDBUF: 10410 if (*i1 > tcp_max_buf) { 10411 *outlenp = 0; 10412 return (ENOBUFS); 10413 } 10414 if (!checkonly) { 10415 tcp->tcp_xmit_hiwater = *i1; 10416 if (tcp_snd_lowat_fraction != 0) 10417 tcp->tcp_xmit_lowater = 10418 tcp->tcp_xmit_hiwater / 10419 tcp_snd_lowat_fraction; 10420 (void) tcp_maxpsz_set(tcp, B_TRUE); 10421 /* 10422 * If we are flow-controlled, recheck the 10423 * condition. There are apps that increase 10424 * SO_SNDBUF size when flow-controlled 10425 * (EWOULDBLOCK), and expect the flow control 10426 * condition to be lifted right away. 10427 */ 10428 if (tcp->tcp_flow_stopped && 10429 tcp->tcp_unsent < tcp->tcp_xmit_hiwater) { 10430 tcp->tcp_flow_stopped = B_FALSE; 10431 tcp_clrqfull(tcp); 10432 } 10433 } 10434 break; 10435 case SO_RCVBUF: 10436 if (*i1 > tcp_max_buf) { 10437 *outlenp = 0; 10438 return (ENOBUFS); 10439 } 10440 /* Silently ignore zero */ 10441 if (!checkonly && *i1 != 0) { 10442 *i1 = MSS_ROUNDUP(*i1, tcp->tcp_mss); 10443 (void) tcp_rwnd_set(tcp, *i1); 10444 } 10445 /* 10446 * XXX should we return the rwnd here 10447 * and tcp_opt_get ? 10448 */ 10449 break; 10450 case SO_SND_COPYAVOID: 10451 if (!checkonly) { 10452 /* we only allow enable at most once for now */ 10453 if (!tcp->tcp_snd_zcopy_aware && 10454 (onoff != 1 || !tcp_zcopy_check(tcp))) { 10455 *outlenp = 0; 10456 return (EOPNOTSUPP); 10457 } 10458 tcp->tcp_snd_zcopy_aware = 1; 10459 } 10460 break; 10461 default: 10462 *outlenp = 0; 10463 return (EINVAL); 10464 } 10465 break; 10466 case IPPROTO_TCP: 10467 switch (name) { 10468 case TCP_NODELAY: 10469 if (!checkonly) 10470 tcp->tcp_naglim = *i1 ? 1 : tcp->tcp_mss; 10471 break; 10472 case TCP_NOTIFY_THRESHOLD: 10473 if (!checkonly) 10474 tcp->tcp_first_timer_threshold = *i1; 10475 break; 10476 case TCP_ABORT_THRESHOLD: 10477 if (!checkonly) 10478 tcp->tcp_second_timer_threshold = *i1; 10479 break; 10480 case TCP_CONN_NOTIFY_THRESHOLD: 10481 if (!checkonly) 10482 tcp->tcp_first_ctimer_threshold = *i1; 10483 break; 10484 case TCP_CONN_ABORT_THRESHOLD: 10485 if (!checkonly) 10486 tcp->tcp_second_ctimer_threshold = *i1; 10487 break; 10488 case TCP_RECVDSTADDR: 10489 if (tcp->tcp_state > TCPS_LISTEN) 10490 return (EOPNOTSUPP); 10491 if (!checkonly) 10492 tcp->tcp_recvdstaddr = onoff; 10493 break; 10494 case TCP_ANONPRIVBIND: 10495 if ((reterr = secpolicy_net_privaddr(cr, 0)) != 0) { 10496 *outlenp = 0; 10497 return (reterr); 10498 } 10499 if (!checkonly) { 10500 tcp->tcp_anon_priv_bind = onoff; 10501 } 10502 break; 10503 case TCP_EXCLBIND: 10504 if (!checkonly) 10505 tcp->tcp_exclbind = onoff; 10506 break; /* goto sizeof (int) option return */ 10507 case TCP_INIT_CWND: { 10508 uint32_t init_cwnd = *((uint32_t *)invalp); 10509 10510 if (checkonly) 10511 break; 10512 10513 /* 10514 * Only allow socket with network configuration 10515 * privilege to set the initial cwnd to be larger 10516 * than allowed by RFC 3390. 10517 */ 10518 if (init_cwnd <= MIN(4, MAX(2, 4380 / tcp->tcp_mss))) { 10519 tcp->tcp_init_cwnd = init_cwnd; 10520 break; 10521 } 10522 if ((reterr = secpolicy_net_config(cr, B_TRUE)) != 0) { 10523 *outlenp = 0; 10524 return (reterr); 10525 } 10526 if (init_cwnd > TCP_MAX_INIT_CWND) { 10527 *outlenp = 0; 10528 return (EINVAL); 10529 } 10530 tcp->tcp_init_cwnd = init_cwnd; 10531 break; 10532 } 10533 case TCP_KEEPALIVE_THRESHOLD: 10534 if (checkonly) 10535 break; 10536 10537 if (*i1 < tcp_keepalive_interval_low || 10538 *i1 > tcp_keepalive_interval_high) { 10539 *outlenp = 0; 10540 return (EINVAL); 10541 } 10542 if (*i1 != tcp->tcp_ka_interval) { 10543 tcp->tcp_ka_interval = *i1; 10544 /* 10545 * Check if we need to restart the 10546 * keepalive timer. 10547 */ 10548 if (tcp->tcp_ka_tid != 0) { 10549 ASSERT(tcp->tcp_ka_enabled); 10550 (void) TCP_TIMER_CANCEL(tcp, 10551 tcp->tcp_ka_tid); 10552 tcp->tcp_ka_last_intrvl = 0; 10553 tcp->tcp_ka_tid = TCP_TIMER(tcp, 10554 tcp_keepalive_killer, 10555 MSEC_TO_TICK(tcp->tcp_ka_interval)); 10556 } 10557 } 10558 break; 10559 case TCP_KEEPALIVE_ABORT_THRESHOLD: 10560 if (!checkonly) { 10561 if (*i1 < tcp_keepalive_abort_interval_low || 10562 *i1 > tcp_keepalive_abort_interval_high) { 10563 *outlenp = 0; 10564 return (EINVAL); 10565 } 10566 tcp->tcp_ka_abort_thres = *i1; 10567 } 10568 break; 10569 case TCP_CORK: 10570 if (!checkonly) { 10571 /* 10572 * if tcp->tcp_cork was set and is now 10573 * being unset, we have to make sure that 10574 * the remaining data gets sent out. Also 10575 * unset tcp->tcp_cork so that tcp_wput_data() 10576 * can send data even if it is less than mss 10577 */ 10578 if (tcp->tcp_cork && onoff == 0 && 10579 tcp->tcp_unsent > 0) { 10580 tcp->tcp_cork = B_FALSE; 10581 tcp_wput_data(tcp, NULL, B_FALSE); 10582 } 10583 tcp->tcp_cork = onoff; 10584 } 10585 break; 10586 default: 10587 *outlenp = 0; 10588 return (EINVAL); 10589 } 10590 break; 10591 case IPPROTO_IP: 10592 if (tcp->tcp_family != AF_INET) { 10593 *outlenp = 0; 10594 return (ENOPROTOOPT); 10595 } 10596 switch (name) { 10597 case IP_OPTIONS: 10598 case T_IP_OPTIONS: 10599 reterr = tcp_opt_set_header(tcp, checkonly, 10600 invalp, inlen); 10601 if (reterr) { 10602 *outlenp = 0; 10603 return (reterr); 10604 } 10605 /* OK return - copy input buffer into output buffer */ 10606 if (invalp != outvalp) { 10607 /* don't trust bcopy for identical src/dst */ 10608 bcopy(invalp, outvalp, inlen); 10609 } 10610 *outlenp = inlen; 10611 return (0); 10612 case IP_TOS: 10613 case T_IP_TOS: 10614 if (!checkonly) { 10615 tcp->tcp_ipha->ipha_type_of_service = 10616 (uchar_t)*i1; 10617 tcp->tcp_tos = (uchar_t)*i1; 10618 } 10619 break; 10620 case IP_TTL: 10621 if (!checkonly) { 10622 tcp->tcp_ipha->ipha_ttl = (uchar_t)*i1; 10623 tcp->tcp_ttl = (uchar_t)*i1; 10624 } 10625 break; 10626 case IP_BOUND_IF: 10627 /* Handled at the IP level */ 10628 return (-EINVAL); 10629 case IP_SEC_OPT: 10630 /* 10631 * We should not allow policy setting after 10632 * we start listening for connections. 10633 */ 10634 if (tcp->tcp_state == TCPS_LISTEN) { 10635 return (EINVAL); 10636 } else { 10637 /* Handled at the IP level */ 10638 return (-EINVAL); 10639 } 10640 default: 10641 *outlenp = 0; 10642 return (EINVAL); 10643 } 10644 break; 10645 case IPPROTO_IPV6: { 10646 ip6_pkt_t *ipp; 10647 10648 /* 10649 * IPPROTO_IPV6 options are only supported for sockets 10650 * that are using IPv6 on the wire. 10651 */ 10652 if (tcp->tcp_ipversion != IPV6_VERSION) { 10653 *outlenp = 0; 10654 return (ENOPROTOOPT); 10655 } 10656 /* 10657 * Only sticky options; no ancillary data 10658 */ 10659 ASSERT(thisdg_attrs == NULL); 10660 ipp = &tcp->tcp_sticky_ipp; 10661 10662 switch (name) { 10663 case IPV6_UNICAST_HOPS: 10664 /* -1 means use default */ 10665 if (*i1 < -1 || *i1 > IPV6_MAX_HOPS) { 10666 *outlenp = 0; 10667 return (EINVAL); 10668 } 10669 if (!checkonly) { 10670 if (*i1 == -1) { 10671 tcp->tcp_ip6h->ip6_hops = 10672 ipp->ipp_hoplimit = 10673 (uint8_t)tcp_ipv6_hoplimit; 10674 ipp->ipp_fields &= ~IPPF_HOPLIMIT; 10675 /* Pass modified value to IP. */ 10676 *i1 = tcp->tcp_ip6h->ip6_hops; 10677 } else { 10678 tcp->tcp_ip6h->ip6_hops = 10679 ipp->ipp_hoplimit = (uint8_t)*i1; 10680 ipp->ipp_fields |= IPPF_HOPLIMIT; 10681 } 10682 } 10683 break; 10684 case IPV6_BOUND_IF: 10685 if (!checkonly) { 10686 int error = 0; 10687 10688 tcp->tcp_bound_if = *i1; 10689 error = ip_opt_set_ill(tcp->tcp_connp, *i1, 10690 B_TRUE, checkonly, level, name, mblk); 10691 if (error != 0) { 10692 *outlenp = 0; 10693 return (error); 10694 } 10695 } 10696 break; 10697 /* 10698 * Set boolean switches for ancillary data delivery 10699 */ 10700 case IPV6_RECVPKTINFO: 10701 if (!checkonly) { 10702 if (onoff) 10703 tcp->tcp_ipv6_recvancillary |= 10704 TCP_IPV6_RECVPKTINFO; 10705 else 10706 tcp->tcp_ipv6_recvancillary &= 10707 ~TCP_IPV6_RECVPKTINFO; 10708 /* Force it to be sent up with the next msg */ 10709 tcp->tcp_recvifindex = 0; 10710 } 10711 break; 10712 case IPV6_RECVTCLASS: 10713 if (!checkonly) { 10714 if (onoff) 10715 tcp->tcp_ipv6_recvancillary |= 10716 TCP_IPV6_RECVTCLASS; 10717 else 10718 tcp->tcp_ipv6_recvancillary &= 10719 ~TCP_IPV6_RECVTCLASS; 10720 } 10721 break; 10722 case IPV6_RECVHOPLIMIT: 10723 if (!checkonly) { 10724 if (onoff) 10725 tcp->tcp_ipv6_recvancillary |= 10726 TCP_IPV6_RECVHOPLIMIT; 10727 else 10728 tcp->tcp_ipv6_recvancillary &= 10729 ~TCP_IPV6_RECVHOPLIMIT; 10730 /* Force it to be sent up with the next msg */ 10731 tcp->tcp_recvhops = 0xffffffffU; 10732 } 10733 break; 10734 case IPV6_RECVHOPOPTS: 10735 if (!checkonly) { 10736 if (onoff) 10737 tcp->tcp_ipv6_recvancillary |= 10738 TCP_IPV6_RECVHOPOPTS; 10739 else 10740 tcp->tcp_ipv6_recvancillary &= 10741 ~TCP_IPV6_RECVHOPOPTS; 10742 } 10743 break; 10744 case IPV6_RECVDSTOPTS: 10745 if (!checkonly) { 10746 if (onoff) 10747 tcp->tcp_ipv6_recvancillary |= 10748 TCP_IPV6_RECVDSTOPTS; 10749 else 10750 tcp->tcp_ipv6_recvancillary &= 10751 ~TCP_IPV6_RECVDSTOPTS; 10752 } 10753 break; 10754 case _OLD_IPV6_RECVDSTOPTS: 10755 if (!checkonly) { 10756 if (onoff) 10757 tcp->tcp_ipv6_recvancillary |= 10758 TCP_OLD_IPV6_RECVDSTOPTS; 10759 else 10760 tcp->tcp_ipv6_recvancillary &= 10761 ~TCP_OLD_IPV6_RECVDSTOPTS; 10762 } 10763 break; 10764 case IPV6_RECVRTHDR: 10765 if (!checkonly) { 10766 if (onoff) 10767 tcp->tcp_ipv6_recvancillary |= 10768 TCP_IPV6_RECVRTHDR; 10769 else 10770 tcp->tcp_ipv6_recvancillary &= 10771 ~TCP_IPV6_RECVRTHDR; 10772 } 10773 break; 10774 case IPV6_RECVRTHDRDSTOPTS: 10775 if (!checkonly) { 10776 if (onoff) 10777 tcp->tcp_ipv6_recvancillary |= 10778 TCP_IPV6_RECVRTDSTOPTS; 10779 else 10780 tcp->tcp_ipv6_recvancillary &= 10781 ~TCP_IPV6_RECVRTDSTOPTS; 10782 } 10783 break; 10784 case IPV6_PKTINFO: 10785 if (inlen != 0 && inlen != sizeof (struct in6_pktinfo)) 10786 return (EINVAL); 10787 if (checkonly) 10788 break; 10789 10790 if (inlen == 0) { 10791 ipp->ipp_fields &= ~(IPPF_IFINDEX|IPPF_ADDR); 10792 } else { 10793 struct in6_pktinfo *pkti; 10794 10795 pkti = (struct in6_pktinfo *)invalp; 10796 /* 10797 * RFC 3542 states that ipi6_addr must be 10798 * the unspecified address when setting the 10799 * IPV6_PKTINFO sticky socket option on a 10800 * TCP socket. 10801 */ 10802 if (!IN6_IS_ADDR_UNSPECIFIED(&pkti->ipi6_addr)) 10803 return (EINVAL); 10804 /* 10805 * ip6_set_pktinfo() validates the source 10806 * address and interface index. 10807 */ 10808 reterr = ip6_set_pktinfo(cr, tcp->tcp_connp, 10809 pkti, mblk); 10810 if (reterr != 0) 10811 return (reterr); 10812 ipp->ipp_ifindex = pkti->ipi6_ifindex; 10813 ipp->ipp_addr = pkti->ipi6_addr; 10814 if (ipp->ipp_ifindex != 0) 10815 ipp->ipp_fields |= IPPF_IFINDEX; 10816 else 10817 ipp->ipp_fields &= ~IPPF_IFINDEX; 10818 if (!IN6_IS_ADDR_UNSPECIFIED(&ipp->ipp_addr)) 10819 ipp->ipp_fields |= IPPF_ADDR; 10820 else 10821 ipp->ipp_fields &= ~IPPF_ADDR; 10822 } 10823 reterr = tcp_build_hdrs(q, tcp); 10824 if (reterr != 0) 10825 return (reterr); 10826 break; 10827 case IPV6_HOPLIMIT: 10828 if (inlen != 0 && inlen != sizeof (int)) 10829 return (EINVAL); 10830 if (checkonly) 10831 break; 10832 10833 if (inlen == 0) { 10834 ipp->ipp_fields &= ~IPPF_HOPLIMIT; 10835 tcp->tcp_ip6_hops = 10836 (uint8_t)tcp_ipv6_hoplimit; 10837 } else { 10838 if (*i1 > 255 || *i1 < -1) 10839 return (EINVAL); 10840 if (*i1 == -1) { 10841 ipp->ipp_hoplimit = tcp_ipv6_hoplimit; 10842 *i1 = tcp_ipv6_hoplimit; 10843 } else { 10844 ipp->ipp_hoplimit = *i1; 10845 } 10846 ipp->ipp_fields |= IPPF_HOPLIMIT; 10847 tcp->tcp_ip6_hops = 10848 ipp->ipp_hoplimit; 10849 } 10850 reterr = tcp_build_hdrs(q, tcp); 10851 if (reterr != 0) 10852 return (reterr); 10853 break; 10854 case IPV6_TCLASS: 10855 if (inlen != 0 && inlen != sizeof (int)) 10856 return (EINVAL); 10857 if (checkonly) 10858 break; 10859 10860 if (inlen == 0) { 10861 ipp->ipp_fields &= ~IPPF_TCLASS; 10862 } else { 10863 if (*i1 > 255 || *i1 < -1) 10864 return (EINVAL); 10865 if (*i1 == -1) { 10866 ipp->ipp_tclass = 0; 10867 *i1 = 0; 10868 } else { 10869 ipp->ipp_tclass = *i1; 10870 } 10871 ipp->ipp_fields |= IPPF_TCLASS; 10872 } 10873 reterr = tcp_build_hdrs(q, tcp); 10874 if (reterr != 0) 10875 return (reterr); 10876 break; 10877 case IPV6_NEXTHOP: 10878 /* 10879 * IP will verify that the nexthop is reachable 10880 * and fail for sticky options. 10881 */ 10882 if (inlen != 0 && inlen != sizeof (sin6_t)) 10883 return (EINVAL); 10884 if (checkonly) 10885 break; 10886 10887 if (inlen == 0) { 10888 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10889 } else { 10890 sin6_t *sin6 = (sin6_t *)invalp; 10891 10892 if (sin6->sin6_family != AF_INET6) 10893 return (EAFNOSUPPORT); 10894 if (IN6_IS_ADDR_V4MAPPED( 10895 &sin6->sin6_addr)) 10896 return (EADDRNOTAVAIL); 10897 ipp->ipp_nexthop = sin6->sin6_addr; 10898 if (!IN6_IS_ADDR_UNSPECIFIED( 10899 &ipp->ipp_nexthop)) 10900 ipp->ipp_fields |= IPPF_NEXTHOP; 10901 else 10902 ipp->ipp_fields &= ~IPPF_NEXTHOP; 10903 } 10904 reterr = tcp_build_hdrs(q, tcp); 10905 if (reterr != 0) 10906 return (reterr); 10907 break; 10908 case IPV6_HOPOPTS: { 10909 ip6_hbh_t *hopts = (ip6_hbh_t *)invalp; 10910 /* 10911 * Sanity checks - minimum size, size a multiple of 10912 * eight bytes, and matching size passed in. 10913 */ 10914 if (inlen != 0 && 10915 inlen != (8 * (hopts->ip6h_len + 1))) 10916 return (EINVAL); 10917 10918 if (checkonly) 10919 break; 10920 10921 if (inlen == 0) { 10922 if ((ipp->ipp_fields & IPPF_HOPOPTS) != 0) { 10923 kmem_free(ipp->ipp_hopopts, 10924 ipp->ipp_hopoptslen); 10925 ipp->ipp_hopopts = NULL; 10926 ipp->ipp_hopoptslen = 0; 10927 } 10928 ipp->ipp_fields &= ~IPPF_HOPOPTS; 10929 } else { 10930 reterr = tcp_pkt_set(invalp, inlen, 10931 (uchar_t **)&ipp->ipp_hopopts, 10932 &ipp->ipp_hopoptslen); 10933 if (reterr != 0) 10934 return (reterr); 10935 ipp->ipp_fields |= IPPF_HOPOPTS; 10936 } 10937 reterr = tcp_build_hdrs(q, tcp); 10938 if (reterr != 0) 10939 return (reterr); 10940 break; 10941 } 10942 case IPV6_RTHDRDSTOPTS: { 10943 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10944 10945 /* 10946 * Sanity checks - minimum size, size a multiple of 10947 * eight bytes, and matching size passed in. 10948 */ 10949 if (inlen != 0 && 10950 inlen != (8 * (dopts->ip6d_len + 1))) 10951 return (EINVAL); 10952 10953 if (checkonly) 10954 break; 10955 10956 if (inlen == 0) { 10957 if ((ipp->ipp_fields & IPPF_RTDSTOPTS) != 0) { 10958 kmem_free(ipp->ipp_rtdstopts, 10959 ipp->ipp_rtdstoptslen); 10960 ipp->ipp_rtdstopts = NULL; 10961 ipp->ipp_rtdstoptslen = 0; 10962 } 10963 ipp->ipp_fields &= ~IPPF_RTDSTOPTS; 10964 } else { 10965 reterr = tcp_pkt_set(invalp, inlen, 10966 (uchar_t **)&ipp->ipp_rtdstopts, 10967 &ipp->ipp_rtdstoptslen); 10968 if (reterr != 0) 10969 return (reterr); 10970 ipp->ipp_fields |= IPPF_RTDSTOPTS; 10971 } 10972 reterr = tcp_build_hdrs(q, tcp); 10973 if (reterr != 0) 10974 return (reterr); 10975 break; 10976 } 10977 case IPV6_DSTOPTS: { 10978 ip6_dest_t *dopts = (ip6_dest_t *)invalp; 10979 10980 /* 10981 * Sanity checks - minimum size, size a multiple of 10982 * eight bytes, and matching size passed in. 10983 */ 10984 if (inlen != 0 && 10985 inlen != (8 * (dopts->ip6d_len + 1))) 10986 return (EINVAL); 10987 10988 if (checkonly) 10989 break; 10990 10991 if (inlen == 0) { 10992 if ((ipp->ipp_fields & IPPF_DSTOPTS) != 0) { 10993 kmem_free(ipp->ipp_dstopts, 10994 ipp->ipp_dstoptslen); 10995 ipp->ipp_dstopts = NULL; 10996 ipp->ipp_dstoptslen = 0; 10997 } 10998 ipp->ipp_fields &= ~IPPF_DSTOPTS; 10999 } else { 11000 reterr = tcp_pkt_set(invalp, inlen, 11001 (uchar_t **)&ipp->ipp_dstopts, 11002 &ipp->ipp_dstoptslen); 11003 if (reterr != 0) 11004 return (reterr); 11005 ipp->ipp_fields |= IPPF_DSTOPTS; 11006 } 11007 reterr = tcp_build_hdrs(q, tcp); 11008 if (reterr != 0) 11009 return (reterr); 11010 break; 11011 } 11012 case IPV6_RTHDR: { 11013 ip6_rthdr_t *rt = (ip6_rthdr_t *)invalp; 11014 11015 /* 11016 * Sanity checks - minimum size, size a multiple of 11017 * eight bytes, and matching size passed in. 11018 */ 11019 if (inlen != 0 && 11020 inlen != (8 * (rt->ip6r_len + 1))) 11021 return (EINVAL); 11022 11023 if (checkonly) 11024 break; 11025 11026 if (inlen == 0) { 11027 if ((ipp->ipp_fields & IPPF_RTHDR) != 0) { 11028 kmem_free(ipp->ipp_rthdr, 11029 ipp->ipp_rthdrlen); 11030 ipp->ipp_rthdr = NULL; 11031 ipp->ipp_rthdrlen = 0; 11032 } 11033 ipp->ipp_fields &= ~IPPF_RTHDR; 11034 } else { 11035 reterr = tcp_pkt_set(invalp, inlen, 11036 (uchar_t **)&ipp->ipp_rthdr, 11037 &ipp->ipp_rthdrlen); 11038 if (reterr != 0) 11039 return (reterr); 11040 ipp->ipp_fields |= IPPF_RTHDR; 11041 } 11042 reterr = tcp_build_hdrs(q, tcp); 11043 if (reterr != 0) 11044 return (reterr); 11045 break; 11046 } 11047 case IPV6_V6ONLY: 11048 if (!checkonly) 11049 tcp->tcp_connp->conn_ipv6_v6only = onoff; 11050 break; 11051 case IPV6_USE_MIN_MTU: 11052 if (inlen != sizeof (int)) 11053 return (EINVAL); 11054 11055 if (*i1 < -1 || *i1 > 1) 11056 return (EINVAL); 11057 11058 if (checkonly) 11059 break; 11060 11061 ipp->ipp_fields |= IPPF_USE_MIN_MTU; 11062 ipp->ipp_use_min_mtu = *i1; 11063 break; 11064 case IPV6_BOUND_PIF: 11065 /* Handled at the IP level */ 11066 return (-EINVAL); 11067 case IPV6_SEC_OPT: 11068 /* 11069 * We should not allow policy setting after 11070 * we start listening for connections. 11071 */ 11072 if (tcp->tcp_state == TCPS_LISTEN) { 11073 return (EINVAL); 11074 } else { 11075 /* Handled at the IP level */ 11076 return (-EINVAL); 11077 } 11078 case IPV6_SRC_PREFERENCES: 11079 if (inlen != sizeof (uint32_t)) 11080 return (EINVAL); 11081 reterr = ip6_set_src_preferences(tcp->tcp_connp, 11082 *(uint32_t *)invalp); 11083 if (reterr != 0) { 11084 *outlenp = 0; 11085 return (reterr); 11086 } 11087 break; 11088 default: 11089 *outlenp = 0; 11090 return (EINVAL); 11091 } 11092 break; 11093 } /* end IPPROTO_IPV6 */ 11094 default: 11095 *outlenp = 0; 11096 return (EINVAL); 11097 } 11098 /* 11099 * Common case of OK return with outval same as inval 11100 */ 11101 if (invalp != outvalp) { 11102 /* don't trust bcopy for identical src/dst */ 11103 (void) bcopy(invalp, outvalp, inlen); 11104 } 11105 *outlenp = inlen; 11106 return (0); 11107 } 11108 11109 /* 11110 * Update tcp_sticky_hdrs based on tcp_sticky_ipp. 11111 * The headers include ip6i_t (if needed), ip6_t, any sticky extension 11112 * headers, and the maximum size tcp header (to avoid reallocation 11113 * on the fly for additional tcp options). 11114 * Returns failure if can't allocate memory. 11115 */ 11116 static int 11117 tcp_build_hdrs(queue_t *q, tcp_t *tcp) 11118 { 11119 char *hdrs; 11120 uint_t hdrs_len; 11121 ip6i_t *ip6i; 11122 char buf[TCP_MAX_HDR_LENGTH]; 11123 ip6_pkt_t *ipp = &tcp->tcp_sticky_ipp; 11124 in6_addr_t src, dst; 11125 uint8_t hops; 11126 11127 /* 11128 * save the existing tcp header and source/dest IP addresses 11129 */ 11130 bcopy(tcp->tcp_tcph, buf, tcp->tcp_tcp_hdr_len); 11131 src = tcp->tcp_ip6h->ip6_src; 11132 dst = tcp->tcp_ip6h->ip6_dst; 11133 hops = tcp->tcp_ip6h->ip6_hops; 11134 hdrs_len = ip_total_hdrs_len_v6(ipp) + TCP_MAX_HDR_LENGTH; 11135 ASSERT(hdrs_len != 0); 11136 if (hdrs_len > tcp->tcp_iphc_len) { 11137 /* Need to reallocate */ 11138 hdrs = kmem_zalloc(hdrs_len, KM_NOSLEEP); 11139 if (hdrs == NULL) 11140 return (ENOMEM); 11141 if (tcp->tcp_iphc != NULL) { 11142 if (tcp->tcp_hdr_grown) { 11143 kmem_free(tcp->tcp_iphc, tcp->tcp_iphc_len); 11144 } else { 11145 bzero(tcp->tcp_iphc, tcp->tcp_iphc_len); 11146 kmem_cache_free(tcp_iphc_cache, tcp->tcp_iphc); 11147 } 11148 tcp->tcp_iphc_len = 0; 11149 } 11150 ASSERT(tcp->tcp_iphc_len == 0); 11151 tcp->tcp_iphc = hdrs; 11152 tcp->tcp_iphc_len = hdrs_len; 11153 tcp->tcp_hdr_grown = B_TRUE; 11154 } 11155 ip_build_hdrs_v6((uchar_t *)tcp->tcp_iphc, 11156 hdrs_len - TCP_MAX_HDR_LENGTH, ipp, IPPROTO_TCP); 11157 11158 /* Set header fields not in ipp */ 11159 if (ipp->ipp_fields & IPPF_HAS_IP6I) { 11160 ip6i = (ip6i_t *)tcp->tcp_iphc; 11161 tcp->tcp_ip6h = (ip6_t *)&ip6i[1]; 11162 } else { 11163 tcp->tcp_ip6h = (ip6_t *)tcp->tcp_iphc; 11164 } 11165 /* 11166 * tcp->tcp_ip_hdr_len will include ip6i_t if there is one. 11167 * 11168 * tcp->tcp_tcp_hdr_len doesn't change here. 11169 */ 11170 tcp->tcp_ip_hdr_len = hdrs_len - TCP_MAX_HDR_LENGTH; 11171 tcp->tcp_tcph = (tcph_t *)(tcp->tcp_iphc + tcp->tcp_ip_hdr_len); 11172 tcp->tcp_hdr_len = tcp->tcp_ip_hdr_len + tcp->tcp_tcp_hdr_len; 11173 11174 bcopy(buf, tcp->tcp_tcph, tcp->tcp_tcp_hdr_len); 11175 11176 tcp->tcp_ip6h->ip6_src = src; 11177 tcp->tcp_ip6h->ip6_dst = dst; 11178 11179 /* 11180 * If the hop limit was not set by ip_build_hdrs_v6(), restore 11181 * the saved value. 11182 */ 11183 if (!(ipp->ipp_fields & IPPF_HOPLIMIT)) 11184 tcp->tcp_ip6h->ip6_hops = hops; 11185 11186 /* 11187 * Set the IPv6 header payload length. 11188 * If there's an ip6i_t included, don't count it in the length. 11189 */ 11190 tcp->tcp_ip6h->ip6_plen = tcp->tcp_hdr_len - IPV6_HDR_LEN; 11191 if (ipp->ipp_fields & IPPF_HAS_IP6I) 11192 tcp->tcp_ip6h->ip6_plen -= sizeof (ip6i_t); 11193 /* 11194 * If we're setting extension headers after a connection 11195 * has been established, and if we have a routing header 11196 * among the extension headers, call ip_massage_options_v6 to 11197 * manipulate the routing header/ip6_dst set the checksum 11198 * difference in the tcp header template. 11199 * (This happens in tcp_connect_ipv6 if the routing header 11200 * is set prior to the connect.) 11201 * Set the tcp_sum to zero first in case we've cleared a 11202 * routing header or don't have one at all. 11203 */ 11204 tcp->tcp_sum = 0; 11205 if ((tcp->tcp_state >= TCPS_SYN_SENT) && 11206 (tcp->tcp_ipp_fields & IPPF_RTHDR)) { 11207 ip6_rthdr_t *rth = ip_find_rthdr_v6(tcp->tcp_ip6h, 11208 (uint8_t *)tcp->tcp_tcph); 11209 if (rth != NULL) { 11210 tcp->tcp_sum = ip_massage_options_v6(tcp->tcp_ip6h, 11211 rth); 11212 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + 11213 (tcp->tcp_sum >> 16)); 11214 } 11215 } 11216 11217 /* Try to get everything in a single mblk */ 11218 (void) mi_set_sth_wroff(RD(q), hdrs_len + tcp_wroff_xtra); 11219 return (0); 11220 } 11221 11222 /* 11223 * Set optbuf and optlen for the option. 11224 * Allocate memory (if not already present). 11225 * Otherwise just point optbuf and optlen at invalp and inlen. 11226 * Returns failure if memory can not be allocated. 11227 */ 11228 static int 11229 tcp_pkt_set(uchar_t *invalp, uint_t inlen, uchar_t **optbufp, uint_t *optlenp) 11230 { 11231 uchar_t *optbuf; 11232 11233 if (inlen == *optlenp) { 11234 /* Unchanged length - no need to realocate */ 11235 bcopy(invalp, *optbufp, inlen); 11236 return (0); 11237 } 11238 if (inlen != 0) { 11239 /* Allocate new buffer before free */ 11240 optbuf = kmem_alloc(inlen, KM_NOSLEEP); 11241 if (optbuf == NULL) 11242 return (ENOMEM); 11243 } else { 11244 optbuf = NULL; 11245 } 11246 /* Free old buffer */ 11247 if (*optlenp != 0) 11248 kmem_free(*optbufp, *optlenp); 11249 11250 bcopy(invalp, optbuf, inlen); 11251 *optbufp = optbuf; 11252 *optlenp = inlen; 11253 return (0); 11254 } 11255 11256 11257 /* 11258 * Use the outgoing IP header to create an IP_OPTIONS option the way 11259 * it was passed down from the application. 11260 */ 11261 static int 11262 tcp_opt_get_user(ipha_t *ipha, uchar_t *buf) 11263 { 11264 ipoptp_t opts; 11265 uchar_t *opt; 11266 uint8_t optval; 11267 uint8_t optlen; 11268 uint32_t len = 0; 11269 uchar_t *buf1 = buf; 11270 11271 buf += IP_ADDR_LEN; /* Leave room for final destination */ 11272 len += IP_ADDR_LEN; 11273 bzero(buf1, IP_ADDR_LEN); 11274 11275 for (optval = ipoptp_first(&opts, ipha); 11276 optval != IPOPT_EOL; 11277 optval = ipoptp_next(&opts)) { 11278 opt = opts.ipoptp_cur; 11279 optlen = opts.ipoptp_len; 11280 switch (optval) { 11281 int off; 11282 case IPOPT_SSRR: 11283 case IPOPT_LSRR: 11284 11285 /* 11286 * Insert ipha_dst as the first entry in the source 11287 * route and move down the entries on step. 11288 * The last entry gets placed at buf1. 11289 */ 11290 buf[IPOPT_OPTVAL] = optval; 11291 buf[IPOPT_OLEN] = optlen; 11292 buf[IPOPT_OFFSET] = optlen; 11293 11294 off = optlen - IP_ADDR_LEN; 11295 if (off < 0) { 11296 /* No entries in source route */ 11297 break; 11298 } 11299 /* Last entry in source route */ 11300 bcopy(opt + off, buf1, IP_ADDR_LEN); 11301 off -= IP_ADDR_LEN; 11302 11303 while (off > 0) { 11304 bcopy(opt + off, 11305 buf + off + IP_ADDR_LEN, 11306 IP_ADDR_LEN); 11307 off -= IP_ADDR_LEN; 11308 } 11309 /* ipha_dst into first slot */ 11310 bcopy(&ipha->ipha_dst, 11311 buf + off + IP_ADDR_LEN, 11312 IP_ADDR_LEN); 11313 buf += optlen; 11314 len += optlen; 11315 break; 11316 default: 11317 bcopy(opt, buf, optlen); 11318 buf += optlen; 11319 len += optlen; 11320 break; 11321 } 11322 } 11323 done: 11324 /* Pad the resulting options */ 11325 while (len & 0x3) { 11326 *buf++ = IPOPT_EOL; 11327 len++; 11328 } 11329 return (len); 11330 } 11331 11332 /* 11333 * Transfer any source route option from ipha to buf/dst in reversed form. 11334 */ 11335 static int 11336 tcp_opt_rev_src_route(ipha_t *ipha, char *buf, uchar_t *dst) 11337 { 11338 ipoptp_t opts; 11339 uchar_t *opt; 11340 uint8_t optval; 11341 uint8_t optlen; 11342 uint32_t len = 0; 11343 11344 for (optval = ipoptp_first(&opts, ipha); 11345 optval != IPOPT_EOL; 11346 optval = ipoptp_next(&opts)) { 11347 opt = opts.ipoptp_cur; 11348 optlen = opts.ipoptp_len; 11349 switch (optval) { 11350 int off1, off2; 11351 case IPOPT_SSRR: 11352 case IPOPT_LSRR: 11353 11354 /* Reverse source route */ 11355 /* 11356 * First entry should be the next to last one in the 11357 * current source route (the last entry is our 11358 * address.) 11359 * The last entry should be the final destination. 11360 */ 11361 buf[IPOPT_OPTVAL] = (uint8_t)optval; 11362 buf[IPOPT_OLEN] = (uint8_t)optlen; 11363 off1 = IPOPT_MINOFF_SR - 1; 11364 off2 = opt[IPOPT_OFFSET] - IP_ADDR_LEN - 1; 11365 if (off2 < 0) { 11366 /* No entries in source route */ 11367 break; 11368 } 11369 bcopy(opt + off2, dst, IP_ADDR_LEN); 11370 /* 11371 * Note: use src since ipha has not had its src 11372 * and dst reversed (it is in the state it was 11373 * received. 11374 */ 11375 bcopy(&ipha->ipha_src, buf + off2, 11376 IP_ADDR_LEN); 11377 off2 -= IP_ADDR_LEN; 11378 11379 while (off2 > 0) { 11380 bcopy(opt + off2, buf + off1, 11381 IP_ADDR_LEN); 11382 off1 += IP_ADDR_LEN; 11383 off2 -= IP_ADDR_LEN; 11384 } 11385 buf[IPOPT_OFFSET] = IPOPT_MINOFF_SR; 11386 buf += optlen; 11387 len += optlen; 11388 break; 11389 } 11390 } 11391 done: 11392 /* Pad the resulting options */ 11393 while (len & 0x3) { 11394 *buf++ = IPOPT_EOL; 11395 len++; 11396 } 11397 return (len); 11398 } 11399 11400 11401 /* 11402 * Extract and revert a source route from ipha (if any) 11403 * and then update the relevant fields in both tcp_t and the standard header. 11404 */ 11405 static void 11406 tcp_opt_reverse(tcp_t *tcp, ipha_t *ipha) 11407 { 11408 char buf[TCP_MAX_HDR_LENGTH]; 11409 uint_t tcph_len; 11410 int len; 11411 11412 ASSERT(IPH_HDR_VERSION(ipha) == IPV4_VERSION); 11413 len = IPH_HDR_LENGTH(ipha); 11414 if (len == IP_SIMPLE_HDR_LENGTH) 11415 /* Nothing to do */ 11416 return; 11417 if (len > IP_SIMPLE_HDR_LENGTH + TCP_MAX_IP_OPTIONS_LENGTH || 11418 (len & 0x3)) 11419 return; 11420 11421 tcph_len = tcp->tcp_tcp_hdr_len; 11422 bcopy(tcp->tcp_tcph, buf, tcph_len); 11423 tcp->tcp_sum = (tcp->tcp_ipha->ipha_dst >> 16) + 11424 (tcp->tcp_ipha->ipha_dst & 0xffff); 11425 len = tcp_opt_rev_src_route(ipha, (char *)tcp->tcp_ipha + 11426 IP_SIMPLE_HDR_LENGTH, (uchar_t *)&tcp->tcp_ipha->ipha_dst); 11427 len += IP_SIMPLE_HDR_LENGTH; 11428 tcp->tcp_sum -= ((tcp->tcp_ipha->ipha_dst >> 16) + 11429 (tcp->tcp_ipha->ipha_dst & 0xffff)); 11430 if ((int)tcp->tcp_sum < 0) 11431 tcp->tcp_sum--; 11432 tcp->tcp_sum = (tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16); 11433 tcp->tcp_sum = ntohs((tcp->tcp_sum & 0xFFFF) + (tcp->tcp_sum >> 16)); 11434 tcp->tcp_tcph = (tcph_t *)((char *)tcp->tcp_ipha + len); 11435 bcopy(buf, tcp->tcp_tcph, tcph_len); 11436 tcp->tcp_ip_hdr_len = len; 11437 tcp->tcp_ipha->ipha_version_and_hdr_length = 11438 (IP_VERSION << 4) | (len >> 2); 11439 len += tcph_len; 11440 tcp->tcp_hdr_len = len; 11441 } 11442 11443 /* 11444 * Copy the standard header into its new location, 11445 * lay in the new options and then update the relevant 11446 * fields in both tcp_t and the standard header. 11447 */ 11448 static int 11449 tcp_opt_set_header(tcp_t *tcp, boolean_t checkonly, uchar_t *ptr, uint_t len) 11450 { 11451 uint_t tcph_len; 11452 char *ip_optp; 11453 tcph_t *new_tcph; 11454 11455 if (checkonly) { 11456 /* 11457 * do not really set, just pretend to - T_CHECK 11458 */ 11459 if (len != 0) { 11460 /* 11461 * there is value supplied, validate it as if 11462 * for a real set operation. 11463 */ 11464 if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) 11465 return (EINVAL); 11466 } 11467 return (0); 11468 } 11469 11470 if ((len > TCP_MAX_IP_OPTIONS_LENGTH) || (len & 0x3)) 11471 return (EINVAL); 11472 11473 ip_optp = (char *)tcp->tcp_ipha + IP_SIMPLE_HDR_LENGTH; 11474 tcph_len = tcp->tcp_tcp_hdr_len; 11475 new_tcph = (tcph_t *)(ip_optp + len); 11476 ovbcopy((char *)tcp->tcp_tcph, (char *)new_tcph, tcph_len); 11477 tcp->tcp_tcph = new_tcph; 11478 bcopy(ptr, ip_optp, len); 11479 11480 len += IP_SIMPLE_HDR_LENGTH; 11481 11482 tcp->tcp_ip_hdr_len = len; 11483 tcp->tcp_ipha->ipha_version_and_hdr_length = 11484 (IP_VERSION << 4) | (len >> 2); 11485 len += tcph_len; 11486 tcp->tcp_hdr_len = len; 11487 if (!TCP_IS_DETACHED(tcp)) { 11488 /* Always allocate room for all options. */ 11489 (void) mi_set_sth_wroff(tcp->tcp_rq, 11490 TCP_MAX_COMBINED_HEADER_LENGTH + tcp_wroff_xtra); 11491 } 11492 return (0); 11493 } 11494 11495 /* Get callback routine passed to nd_load by tcp_param_register */ 11496 /* ARGSUSED */ 11497 static int 11498 tcp_param_get(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 11499 { 11500 tcpparam_t *tcppa = (tcpparam_t *)cp; 11501 11502 (void) mi_mpprintf(mp, "%u", tcppa->tcp_param_val); 11503 return (0); 11504 } 11505 11506 /* 11507 * Walk through the param array specified registering each element with the 11508 * named dispatch handler. 11509 */ 11510 static boolean_t 11511 tcp_param_register(tcpparam_t *tcppa, int cnt) 11512 { 11513 for (; cnt-- > 0; tcppa++) { 11514 if (tcppa->tcp_param_name && tcppa->tcp_param_name[0]) { 11515 if (!nd_load(&tcp_g_nd, tcppa->tcp_param_name, 11516 tcp_param_get, tcp_param_set, 11517 (caddr_t)tcppa)) { 11518 nd_free(&tcp_g_nd); 11519 return (B_FALSE); 11520 } 11521 } 11522 } 11523 if (!nd_load(&tcp_g_nd, tcp_wroff_xtra_param.tcp_param_name, 11524 tcp_param_get, tcp_param_set_aligned, 11525 (caddr_t)&tcp_wroff_xtra_param)) { 11526 nd_free(&tcp_g_nd); 11527 return (B_FALSE); 11528 } 11529 if (!nd_load(&tcp_g_nd, tcp_mdt_head_param.tcp_param_name, 11530 tcp_param_get, tcp_param_set_aligned, 11531 (caddr_t)&tcp_mdt_head_param)) { 11532 nd_free(&tcp_g_nd); 11533 return (B_FALSE); 11534 } 11535 if (!nd_load(&tcp_g_nd, tcp_mdt_tail_param.tcp_param_name, 11536 tcp_param_get, tcp_param_set_aligned, 11537 (caddr_t)&tcp_mdt_tail_param)) { 11538 nd_free(&tcp_g_nd); 11539 return (B_FALSE); 11540 } 11541 if (!nd_load(&tcp_g_nd, tcp_mdt_max_pbufs_param.tcp_param_name, 11542 tcp_param_get, tcp_param_set, 11543 (caddr_t)&tcp_mdt_max_pbufs_param)) { 11544 nd_free(&tcp_g_nd); 11545 return (B_FALSE); 11546 } 11547 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports", 11548 tcp_extra_priv_ports_get, NULL, NULL)) { 11549 nd_free(&tcp_g_nd); 11550 return (B_FALSE); 11551 } 11552 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_add", 11553 NULL, tcp_extra_priv_ports_add, NULL)) { 11554 nd_free(&tcp_g_nd); 11555 return (B_FALSE); 11556 } 11557 if (!nd_load(&tcp_g_nd, "tcp_extra_priv_ports_del", 11558 NULL, tcp_extra_priv_ports_del, NULL)) { 11559 nd_free(&tcp_g_nd); 11560 return (B_FALSE); 11561 } 11562 if (!nd_load(&tcp_g_nd, "tcp_status", tcp_status_report, NULL, 11563 NULL)) { 11564 nd_free(&tcp_g_nd); 11565 return (B_FALSE); 11566 } 11567 if (!nd_load(&tcp_g_nd, "tcp_bind_hash", tcp_bind_hash_report, 11568 NULL, NULL)) { 11569 nd_free(&tcp_g_nd); 11570 return (B_FALSE); 11571 } 11572 if (!nd_load(&tcp_g_nd, "tcp_listen_hash", tcp_listen_hash_report, 11573 NULL, NULL)) { 11574 nd_free(&tcp_g_nd); 11575 return (B_FALSE); 11576 } 11577 if (!nd_load(&tcp_g_nd, "tcp_conn_hash", tcp_conn_hash_report, 11578 NULL, NULL)) { 11579 nd_free(&tcp_g_nd); 11580 return (B_FALSE); 11581 } 11582 if (!nd_load(&tcp_g_nd, "tcp_acceptor_hash", tcp_acceptor_hash_report, 11583 NULL, NULL)) { 11584 nd_free(&tcp_g_nd); 11585 return (B_FALSE); 11586 } 11587 if (!nd_load(&tcp_g_nd, "tcp_host_param", tcp_host_param_report, 11588 tcp_host_param_set, NULL)) { 11589 nd_free(&tcp_g_nd); 11590 return (B_FALSE); 11591 } 11592 if (!nd_load(&tcp_g_nd, "tcp_host_param_ipv6", tcp_host_param_report, 11593 tcp_host_param_set_ipv6, NULL)) { 11594 nd_free(&tcp_g_nd); 11595 return (B_FALSE); 11596 } 11597 if (!nd_load(&tcp_g_nd, "tcp_1948_phrase", NULL, tcp_1948_phrase_set, 11598 NULL)) { 11599 nd_free(&tcp_g_nd); 11600 return (B_FALSE); 11601 } 11602 if (!nd_load(&tcp_g_nd, "tcp_reserved_port_list", 11603 tcp_reserved_port_list, NULL, NULL)) { 11604 nd_free(&tcp_g_nd); 11605 return (B_FALSE); 11606 } 11607 /* 11608 * Dummy ndd variables - only to convey obsolescence information 11609 * through printing of their name (no get or set routines) 11610 * XXX Remove in future releases ? 11611 */ 11612 if (!nd_load(&tcp_g_nd, 11613 "tcp_close_wait_interval(obsoleted - " 11614 "use tcp_time_wait_interval)", NULL, NULL, NULL)) { 11615 nd_free(&tcp_g_nd); 11616 return (B_FALSE); 11617 } 11618 return (B_TRUE); 11619 } 11620 11621 /* ndd set routine for tcp_wroff_xtra, tcp_mdt_hdr_{head,tail}_min. */ 11622 /* ARGSUSED */ 11623 static int 11624 tcp_param_set_aligned(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 11625 cred_t *cr) 11626 { 11627 long new_value; 11628 tcpparam_t *tcppa = (tcpparam_t *)cp; 11629 11630 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11631 new_value < tcppa->tcp_param_min || 11632 new_value > tcppa->tcp_param_max) { 11633 return (EINVAL); 11634 } 11635 /* 11636 * Need to make sure new_value is a multiple of 4. If it is not, 11637 * round it up. For future 64 bit requirement, we actually make it 11638 * a multiple of 8. 11639 */ 11640 if (new_value & 0x7) { 11641 new_value = (new_value & ~0x7) + 0x8; 11642 } 11643 tcppa->tcp_param_val = new_value; 11644 return (0); 11645 } 11646 11647 /* Set callback routine passed to nd_load by tcp_param_register */ 11648 /* ARGSUSED */ 11649 static int 11650 tcp_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 11651 { 11652 long new_value; 11653 tcpparam_t *tcppa = (tcpparam_t *)cp; 11654 11655 if (ddi_strtol(value, NULL, 10, &new_value) != 0 || 11656 new_value < tcppa->tcp_param_min || 11657 new_value > tcppa->tcp_param_max) { 11658 return (EINVAL); 11659 } 11660 tcppa->tcp_param_val = new_value; 11661 return (0); 11662 } 11663 11664 /* 11665 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 11666 * is filled, return as much as we can. The message passed in may be 11667 * multi-part, chained using b_cont. "start" is the starting sequence 11668 * number for this piece. 11669 */ 11670 static mblk_t * 11671 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 11672 { 11673 uint32_t end; 11674 mblk_t *mp1; 11675 mblk_t *mp2; 11676 mblk_t *next_mp; 11677 uint32_t u1; 11678 11679 /* Walk through all the new pieces. */ 11680 do { 11681 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 11682 (uintptr_t)INT_MAX); 11683 end = start + (int)(mp->b_wptr - mp->b_rptr); 11684 next_mp = mp->b_cont; 11685 if (start == end) { 11686 /* Empty. Blast it. */ 11687 freeb(mp); 11688 continue; 11689 } 11690 mp->b_cont = NULL; 11691 TCP_REASS_SET_SEQ(mp, start); 11692 TCP_REASS_SET_END(mp, end); 11693 mp1 = tcp->tcp_reass_tail; 11694 if (!mp1) { 11695 tcp->tcp_reass_tail = mp; 11696 tcp->tcp_reass_head = mp; 11697 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11698 UPDATE_MIB(&tcp_mib, 11699 tcpInDataUnorderBytes, end - start); 11700 continue; 11701 } 11702 /* New stuff completely beyond tail? */ 11703 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) { 11704 /* Link it on end. */ 11705 mp1->b_cont = mp; 11706 tcp->tcp_reass_tail = mp; 11707 BUMP_MIB(&tcp_mib, tcpInDataUnorderSegs); 11708 UPDATE_MIB(&tcp_mib, 11709 tcpInDataUnorderBytes, end - start); 11710 continue; 11711 } 11712 mp1 = tcp->tcp_reass_head; 11713 u1 = TCP_REASS_SEQ(mp1); 11714 /* New stuff at the front? */ 11715 if (SEQ_LT(start, u1)) { 11716 /* Yes... Check for overlap. */ 11717 mp->b_cont = mp1; 11718 tcp->tcp_reass_head = mp; 11719 tcp_reass_elim_overlap(tcp, mp); 11720 continue; 11721 } 11722 /* 11723 * The new piece fits somewhere between the head and tail. 11724 * We find our slot, where mp1 precedes us and mp2 trails. 11725 */ 11726 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 11727 u1 = TCP_REASS_SEQ(mp2); 11728 if (SEQ_LEQ(start, u1)) 11729 break; 11730 } 11731 /* Link ourselves in */ 11732 mp->b_cont = mp2; 11733 mp1->b_cont = mp; 11734 11735 /* Trim overlap with following mblk(s) first */ 11736 tcp_reass_elim_overlap(tcp, mp); 11737 11738 /* Trim overlap with preceding mblk */ 11739 tcp_reass_elim_overlap(tcp, mp1); 11740 11741 } while (start = end, mp = next_mp); 11742 mp1 = tcp->tcp_reass_head; 11743 /* Anything ready to go? */ 11744 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 11745 return (NULL); 11746 /* Eat what we can off the queue */ 11747 for (;;) { 11748 mp = mp1->b_cont; 11749 end = TCP_REASS_END(mp1); 11750 TCP_REASS_SET_SEQ(mp1, 0); 11751 TCP_REASS_SET_END(mp1, 0); 11752 if (!mp) { 11753 tcp->tcp_reass_tail = NULL; 11754 break; 11755 } 11756 if (end != TCP_REASS_SEQ(mp)) { 11757 mp1->b_cont = NULL; 11758 break; 11759 } 11760 mp1 = mp; 11761 } 11762 mp1 = tcp->tcp_reass_head; 11763 tcp->tcp_reass_head = mp; 11764 return (mp1); 11765 } 11766 11767 /* Eliminate any overlap that mp may have over later mblks */ 11768 static void 11769 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 11770 { 11771 uint32_t end; 11772 mblk_t *mp1; 11773 uint32_t u1; 11774 11775 end = TCP_REASS_END(mp); 11776 while ((mp1 = mp->b_cont) != NULL) { 11777 u1 = TCP_REASS_SEQ(mp1); 11778 if (!SEQ_GT(end, u1)) 11779 break; 11780 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 11781 mp->b_wptr -= end - u1; 11782 TCP_REASS_SET_END(mp, u1); 11783 BUMP_MIB(&tcp_mib, tcpInDataPartDupSegs); 11784 UPDATE_MIB(&tcp_mib, tcpInDataPartDupBytes, end - u1); 11785 break; 11786 } 11787 mp->b_cont = mp1->b_cont; 11788 TCP_REASS_SET_SEQ(mp1, 0); 11789 TCP_REASS_SET_END(mp1, 0); 11790 freeb(mp1); 11791 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 11792 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, end - u1); 11793 } 11794 if (!mp1) 11795 tcp->tcp_reass_tail = mp; 11796 } 11797 11798 /* 11799 * Send up all messages queued on tcp_rcv_list. 11800 */ 11801 static uint_t 11802 tcp_rcv_drain(queue_t *q, tcp_t *tcp) 11803 { 11804 mblk_t *mp; 11805 uint_t ret = 0; 11806 uint_t thwin; 11807 #ifdef DEBUG 11808 uint_t cnt = 0; 11809 #endif 11810 /* Can't drain on an eager connection */ 11811 if (tcp->tcp_listener != NULL) 11812 return (ret); 11813 11814 /* 11815 * Handle two cases here: we are currently fused or we were 11816 * previously fused and have some urgent data to be delivered 11817 * upstream. The latter happens because we either ran out of 11818 * memory or were detached and therefore sending the SIGURG was 11819 * deferred until this point. In either case we pass control 11820 * over to tcp_fuse_rcv_drain() since it may need to complete 11821 * some work. 11822 */ 11823 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 11824 ASSERT(tcp->tcp_fused_sigurg_mp != NULL); 11825 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 11826 &tcp->tcp_fused_sigurg_mp)) 11827 return (ret); 11828 } 11829 11830 while ((mp = tcp->tcp_rcv_list) != NULL) { 11831 tcp->tcp_rcv_list = mp->b_next; 11832 mp->b_next = NULL; 11833 #ifdef DEBUG 11834 cnt += msgdsize(mp); 11835 #endif 11836 putnext(q, mp); 11837 } 11838 ASSERT(cnt == tcp->tcp_rcv_cnt); 11839 tcp->tcp_rcv_last_head = NULL; 11840 tcp->tcp_rcv_last_tail = NULL; 11841 tcp->tcp_rcv_cnt = 0; 11842 11843 /* Learn the latest rwnd information that we sent to the other side. */ 11844 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 11845 << tcp->tcp_rcv_ws; 11846 /* This is peer's calculated send window (our receive window). */ 11847 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 11848 /* 11849 * Increase the receive window to max. But we need to do receiver 11850 * SWS avoidance. This means that we need to check the increase of 11851 * of receive window is at least 1 MSS. 11852 */ 11853 if (canputnext(q) && (q->q_hiwat - thwin >= tcp->tcp_mss)) { 11854 /* 11855 * If the window that the other side knows is less than max 11856 * deferred acks segments, send an update immediately. 11857 */ 11858 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 11859 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 11860 ret = TH_ACK_NEEDED; 11861 } 11862 tcp->tcp_rwnd = q->q_hiwat; 11863 } 11864 /* No need for the push timer now. */ 11865 if (tcp->tcp_push_tid != 0) { 11866 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 11867 tcp->tcp_push_tid = 0; 11868 } 11869 return (ret); 11870 } 11871 11872 /* 11873 * Queue data on tcp_rcv_list which is a b_next chain. 11874 * tcp_rcv_last_head/tail is the last element of this chain. 11875 * Each element of the chain is a b_cont chain. 11876 * 11877 * M_DATA messages are added to the current element. 11878 * Other messages are added as new (b_next) elements. 11879 */ 11880 static void 11881 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len) 11882 { 11883 ASSERT(seg_len == msgdsize(mp)); 11884 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 11885 11886 if (tcp->tcp_rcv_list == NULL) { 11887 ASSERT(tcp->tcp_rcv_last_head == NULL); 11888 tcp->tcp_rcv_list = mp; 11889 tcp->tcp_rcv_last_head = mp; 11890 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 11891 tcp->tcp_rcv_last_tail->b_cont = mp; 11892 } else { 11893 tcp->tcp_rcv_last_head->b_next = mp; 11894 tcp->tcp_rcv_last_head = mp; 11895 } 11896 11897 while (mp->b_cont) 11898 mp = mp->b_cont; 11899 11900 tcp->tcp_rcv_last_tail = mp; 11901 tcp->tcp_rcv_cnt += seg_len; 11902 tcp->tcp_rwnd -= seg_len; 11903 } 11904 11905 /* 11906 * DEFAULT TCP ENTRY POINT via squeue on READ side. 11907 * 11908 * This is the default entry function into TCP on the read side. TCP is 11909 * always entered via squeue i.e. using squeue's for mutual exclusion. 11910 * When classifier does a lookup to find the tcp, it also puts a reference 11911 * on the conn structure associated so the tcp is guaranteed to exist 11912 * when we come here. We still need to check the state because it might 11913 * as well has been closed. The squeue processing function i.e. squeue_enter, 11914 * squeue_enter_nodrain, or squeue_drain is responsible for doing the 11915 * CONN_DEC_REF. 11916 * 11917 * Apart from the default entry point, IP also sends packets directly to 11918 * tcp_rput_data for AF_INET fast path and tcp_conn_request for incoming 11919 * connections. 11920 */ 11921 void 11922 tcp_input(void *arg, mblk_t *mp, void *arg2) 11923 { 11924 conn_t *connp = (conn_t *)arg; 11925 tcp_t *tcp = (tcp_t *)connp->conn_tcp; 11926 11927 /* arg2 is the sqp */ 11928 ASSERT(arg2 != NULL); 11929 ASSERT(mp != NULL); 11930 11931 /* 11932 * Don't accept any input on a closed tcp as this TCP logically does 11933 * not exist on the system. Don't proceed further with this TCP. 11934 * For eg. this packet could trigger another close of this tcp 11935 * which would be disastrous for tcp_refcnt. tcp_close_detached / 11936 * tcp_clean_death / tcp_closei_local must be called at most once 11937 * on a TCP. In this case we need to refeed the packet into the 11938 * classifier and figure out where the packet should go. Need to 11939 * preserve the recv_ill somehow. Until we figure that out, for 11940 * now just drop the packet if we can't classify the packet. 11941 */ 11942 if (tcp->tcp_state == TCPS_CLOSED || 11943 tcp->tcp_state == TCPS_BOUND) { 11944 conn_t *new_connp; 11945 11946 new_connp = ipcl_classify(mp, connp->conn_zoneid); 11947 if (new_connp != NULL) { 11948 tcp_reinput(new_connp, mp, arg2); 11949 return; 11950 } 11951 /* We failed to classify. For now just drop the packet */ 11952 freemsg(mp); 11953 return; 11954 } 11955 11956 if (DB_TYPE(mp) == M_DATA) 11957 tcp_rput_data(connp, mp, arg2); 11958 else 11959 tcp_rput_common(tcp, mp); 11960 } 11961 11962 /* 11963 * The read side put procedure. 11964 * The packets passed up by ip are assume to be aligned according to 11965 * OK_32PTR and the IP+TCP headers fitting in the first mblk. 11966 */ 11967 static void 11968 tcp_rput_common(tcp_t *tcp, mblk_t *mp) 11969 { 11970 /* 11971 * tcp_rput_data() does not expect M_CTL except for the case 11972 * where tcp_ipv6_recvancillary is set and we get a IN_PKTINFO 11973 * type. Need to make sure that any other M_CTLs don't make 11974 * it to tcp_rput_data since it is not expecting any and doesn't 11975 * check for it. 11976 */ 11977 if (DB_TYPE(mp) == M_CTL) { 11978 switch (*(uint32_t *)(mp->b_rptr)) { 11979 case TCP_IOC_ABORT_CONN: 11980 /* 11981 * Handle connection abort request. 11982 */ 11983 tcp_ioctl_abort_handler(tcp, mp); 11984 return; 11985 case IPSEC_IN: 11986 /* 11987 * Only secure icmp arrive in TCP and they 11988 * don't go through data path. 11989 */ 11990 tcp_icmp_error(tcp, mp); 11991 return; 11992 case IN_PKTINFO: 11993 /* 11994 * Handle IPV6_RECVPKTINFO socket option on AF_INET6 11995 * sockets that are receiving IPv4 traffic. tcp 11996 */ 11997 ASSERT(tcp->tcp_family == AF_INET6); 11998 ASSERT(tcp->tcp_ipv6_recvancillary & 11999 TCP_IPV6_RECVPKTINFO); 12000 tcp_rput_data(tcp->tcp_connp, mp, 12001 tcp->tcp_connp->conn_sqp); 12002 return; 12003 case MDT_IOC_INFO_UPDATE: 12004 /* 12005 * Handle Multidata information update; the 12006 * following routine will free the message. 12007 */ 12008 if (tcp->tcp_connp->conn_mdt_ok) { 12009 tcp_mdt_update(tcp, 12010 &((ip_mdt_info_t *)mp->b_rptr)->mdt_capab, 12011 B_FALSE); 12012 } 12013 freemsg(mp); 12014 return; 12015 default: 12016 break; 12017 } 12018 } 12019 12020 /* No point processing the message if tcp is already closed */ 12021 if (TCP_IS_DETACHED_NONEAGER(tcp)) { 12022 freemsg(mp); 12023 return; 12024 } 12025 12026 tcp_rput_other(tcp, mp); 12027 } 12028 12029 12030 /* The minimum of smoothed mean deviation in RTO calculation. */ 12031 #define TCP_SD_MIN 400 12032 12033 /* 12034 * Set RTO for this connection. The formula is from Jacobson and Karels' 12035 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names 12036 * are the same as those in Appendix A.2 of that paper. 12037 * 12038 * m = new measurement 12039 * sa = smoothed RTT average (8 * average estimates). 12040 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 12041 */ 12042 static void 12043 tcp_set_rto(tcp_t *tcp, clock_t rtt) 12044 { 12045 long m = TICK_TO_MSEC(rtt); 12046 clock_t sa = tcp->tcp_rtt_sa; 12047 clock_t sv = tcp->tcp_rtt_sd; 12048 clock_t rto; 12049 12050 BUMP_MIB(&tcp_mib, tcpRttUpdate); 12051 tcp->tcp_rtt_update++; 12052 12053 /* tcp_rtt_sa is not 0 means this is a new sample. */ 12054 if (sa != 0) { 12055 /* 12056 * Update average estimator: 12057 * new rtt = 7/8 old rtt + 1/8 Error 12058 */ 12059 12060 /* m is now Error in estimate. */ 12061 m -= sa >> 3; 12062 if ((sa += m) <= 0) { 12063 /* 12064 * Don't allow the smoothed average to be negative. 12065 * We use 0 to denote reinitialization of the 12066 * variables. 12067 */ 12068 sa = 1; 12069 } 12070 12071 /* 12072 * Update deviation estimator: 12073 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev) 12074 */ 12075 if (m < 0) 12076 m = -m; 12077 m -= sv >> 2; 12078 sv += m; 12079 } else { 12080 /* 12081 * This follows BSD's implementation. So the reinitialized 12082 * RTO is 3 * m. We cannot go less than 2 because if the 12083 * link is bandwidth dominated, doubling the window size 12084 * during slow start means doubling the RTT. We want to be 12085 * more conservative when we reinitialize our estimates. 3 12086 * is just a convenient number. 12087 */ 12088 sa = m << 3; 12089 sv = m << 1; 12090 } 12091 if (sv < TCP_SD_MIN) { 12092 /* 12093 * We do not know that if sa captures the delay ACK 12094 * effect as in a long train of segments, a receiver 12095 * does not delay its ACKs. So set the minimum of sv 12096 * to be TCP_SD_MIN, which is default to 400 ms, twice 12097 * of BSD DATO. That means the minimum of mean 12098 * deviation is 100 ms. 12099 * 12100 */ 12101 sv = TCP_SD_MIN; 12102 } 12103 tcp->tcp_rtt_sa = sa; 12104 tcp->tcp_rtt_sd = sv; 12105 /* 12106 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv) 12107 * 12108 * Add tcp_rexmit_interval extra in case of extreme environment 12109 * where the algorithm fails to work. The default value of 12110 * tcp_rexmit_interval_extra should be 0. 12111 * 12112 * As we use a finer grained clock than BSD and update 12113 * RTO for every ACKs, add in another .25 of RTT to the 12114 * deviation of RTO to accomodate burstiness of 1/4 of 12115 * window size. 12116 */ 12117 rto = (sa >> 3) + sv + tcp_rexmit_interval_extra + (sa >> 5); 12118 12119 if (rto > tcp_rexmit_interval_max) { 12120 tcp->tcp_rto = tcp_rexmit_interval_max; 12121 } else if (rto < tcp_rexmit_interval_min) { 12122 tcp->tcp_rto = tcp_rexmit_interval_min; 12123 } else { 12124 tcp->tcp_rto = rto; 12125 } 12126 12127 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 12128 tcp->tcp_timer_backoff = 0; 12129 } 12130 12131 /* 12132 * tcp_get_seg_mp() is called to get the pointer to a segment in the 12133 * send queue which starts at the given seq. no. 12134 * 12135 * Parameters: 12136 * tcp_t *tcp: the tcp instance pointer. 12137 * uint32_t seq: the starting seq. no of the requested segment. 12138 * int32_t *off: after the execution, *off will be the offset to 12139 * the returned mblk which points to the requested seq no. 12140 * It is the caller's responsibility to send in a non-null off. 12141 * 12142 * Return: 12143 * A mblk_t pointer pointing to the requested segment in send queue. 12144 */ 12145 static mblk_t * 12146 tcp_get_seg_mp(tcp_t *tcp, uint32_t seq, int32_t *off) 12147 { 12148 int32_t cnt; 12149 mblk_t *mp; 12150 12151 /* Defensive coding. Make sure we don't send incorrect data. */ 12152 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 12153 return (NULL); 12154 12155 cnt = seq - tcp->tcp_suna; 12156 mp = tcp->tcp_xmit_head; 12157 while (cnt > 0 && mp != NULL) { 12158 cnt -= mp->b_wptr - mp->b_rptr; 12159 if (cnt < 0) { 12160 cnt += mp->b_wptr - mp->b_rptr; 12161 break; 12162 } 12163 mp = mp->b_cont; 12164 } 12165 ASSERT(mp != NULL); 12166 *off = cnt; 12167 return (mp); 12168 } 12169 12170 /* 12171 * This function handles all retransmissions if SACK is enabled for this 12172 * connection. First it calculates how many segments can be retransmitted 12173 * based on tcp_pipe. Then it goes thru the notsack list to find eligible 12174 * segments. A segment is eligible if sack_cnt for that segment is greater 12175 * than or equal tcp_dupack_fast_retransmit. After it has retransmitted 12176 * all eligible segments, it checks to see if TCP can send some new segments 12177 * (fast recovery). If it can, set the appropriate flag for tcp_rput_data(). 12178 * 12179 * Parameters: 12180 * tcp_t *tcp: the tcp structure of the connection. 12181 * uint_t *flags: in return, appropriate value will be set for 12182 * tcp_rput_data(). 12183 */ 12184 static void 12185 tcp_sack_rxmit(tcp_t *tcp, uint_t *flags) 12186 { 12187 notsack_blk_t *notsack_blk; 12188 int32_t usable_swnd; 12189 int32_t mss; 12190 uint32_t seg_len; 12191 mblk_t *xmit_mp; 12192 12193 ASSERT(tcp->tcp_sack_info != NULL); 12194 ASSERT(tcp->tcp_notsack_list != NULL); 12195 ASSERT(tcp->tcp_rexmit == B_FALSE); 12196 12197 /* Defensive coding in case there is a bug... */ 12198 if (tcp->tcp_notsack_list == NULL) { 12199 return; 12200 } 12201 notsack_blk = tcp->tcp_notsack_list; 12202 mss = tcp->tcp_mss; 12203 12204 /* 12205 * Limit the num of outstanding data in the network to be 12206 * tcp_cwnd_ssthresh, which is half of the original congestion wnd. 12207 */ 12208 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 12209 12210 /* At least retransmit 1 MSS of data. */ 12211 if (usable_swnd <= 0) { 12212 usable_swnd = mss; 12213 } 12214 12215 /* Make sure no new RTT samples will be taken. */ 12216 tcp->tcp_csuna = tcp->tcp_snxt; 12217 12218 notsack_blk = tcp->tcp_notsack_list; 12219 while (usable_swnd > 0) { 12220 mblk_t *snxt_mp, *tmp_mp; 12221 tcp_seq begin = tcp->tcp_sack_snxt; 12222 tcp_seq end; 12223 int32_t off; 12224 12225 for (; notsack_blk != NULL; notsack_blk = notsack_blk->next) { 12226 if (SEQ_GT(notsack_blk->end, begin) && 12227 (notsack_blk->sack_cnt >= 12228 tcp_dupack_fast_retransmit)) { 12229 end = notsack_blk->end; 12230 if (SEQ_LT(begin, notsack_blk->begin)) { 12231 begin = notsack_blk->begin; 12232 } 12233 break; 12234 } 12235 } 12236 /* 12237 * All holes are filled. Manipulate tcp_cwnd to send more 12238 * if we can. Note that after the SACK recovery, tcp_cwnd is 12239 * set to tcp_cwnd_ssthresh. 12240 */ 12241 if (notsack_blk == NULL) { 12242 usable_swnd = tcp->tcp_cwnd_ssthresh - tcp->tcp_pipe; 12243 if (usable_swnd <= 0 || tcp->tcp_unsent == 0) { 12244 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna; 12245 ASSERT(tcp->tcp_cwnd > 0); 12246 return; 12247 } else { 12248 usable_swnd = usable_swnd / mss; 12249 tcp->tcp_cwnd = tcp->tcp_snxt - tcp->tcp_suna + 12250 MAX(usable_swnd * mss, mss); 12251 *flags |= TH_XMIT_NEEDED; 12252 return; 12253 } 12254 } 12255 12256 /* 12257 * Note that we may send more than usable_swnd allows here 12258 * because of round off, but no more than 1 MSS of data. 12259 */ 12260 seg_len = end - begin; 12261 if (seg_len > mss) 12262 seg_len = mss; 12263 snxt_mp = tcp_get_seg_mp(tcp, begin, &off); 12264 ASSERT(snxt_mp != NULL); 12265 /* This should not happen. Defensive coding again... */ 12266 if (snxt_mp == NULL) { 12267 return; 12268 } 12269 12270 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, seg_len, &off, 12271 &tmp_mp, begin, B_TRUE, &seg_len, B_TRUE); 12272 if (xmit_mp == NULL) 12273 return; 12274 12275 usable_swnd -= seg_len; 12276 tcp->tcp_pipe += seg_len; 12277 tcp->tcp_sack_snxt = begin + seg_len; 12278 TCP_RECORD_TRACE(tcp, xmit_mp, TCP_TRACE_SEND_PKT); 12279 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 12280 12281 /* 12282 * Update the send timestamp to avoid false retransmission. 12283 */ 12284 snxt_mp->b_prev = (mblk_t *)lbolt; 12285 12286 BUMP_MIB(&tcp_mib, tcpRetransSegs); 12287 UPDATE_MIB(&tcp_mib, tcpRetransBytes, seg_len); 12288 BUMP_MIB(&tcp_mib, tcpOutSackRetransSegs); 12289 /* 12290 * Update tcp_rexmit_max to extend this SACK recovery phase. 12291 * This happens when new data sent during fast recovery is 12292 * also lost. If TCP retransmits those new data, it needs 12293 * to extend SACK recover phase to avoid starting another 12294 * fast retransmit/recovery unnecessarily. 12295 */ 12296 if (SEQ_GT(tcp->tcp_sack_snxt, tcp->tcp_rexmit_max)) { 12297 tcp->tcp_rexmit_max = tcp->tcp_sack_snxt; 12298 } 12299 } 12300 } 12301 12302 /* 12303 * This function handles policy checking at TCP level for non-hard_bound/ 12304 * detached connections. 12305 */ 12306 static boolean_t 12307 tcp_check_policy(tcp_t *tcp, mblk_t *first_mp, ipha_t *ipha, ip6_t *ip6h, 12308 boolean_t secure, boolean_t mctl_present) 12309 { 12310 ipsec_latch_t *ipl = NULL; 12311 ipsec_action_t *act = NULL; 12312 mblk_t *data_mp; 12313 ipsec_in_t *ii; 12314 const char *reason; 12315 kstat_named_t *counter; 12316 12317 ASSERT(mctl_present || !secure); 12318 12319 ASSERT((ipha == NULL && ip6h != NULL) || 12320 (ip6h == NULL && ipha != NULL)); 12321 12322 /* 12323 * We don't necessarily have an ipsec_in_act action to verify 12324 * policy because of assymetrical policy where we have only 12325 * outbound policy and no inbound policy (possible with global 12326 * policy). 12327 */ 12328 if (!secure) { 12329 if (act == NULL || act->ipa_act.ipa_type == IPSEC_ACT_BYPASS || 12330 act->ipa_act.ipa_type == IPSEC_ACT_CLEAR) 12331 return (B_TRUE); 12332 ipsec_log_policy_failure(tcp->tcp_wq, IPSEC_POLICY_MISMATCH, 12333 "tcp_check_policy", ipha, ip6h, secure); 12334 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 12335 &ipdrops_tcp_clear, &tcp_dropper); 12336 return (B_FALSE); 12337 } 12338 12339 /* 12340 * We have a secure packet. 12341 */ 12342 if (act == NULL) { 12343 ipsec_log_policy_failure(tcp->tcp_wq, 12344 IPSEC_POLICY_NOT_NEEDED, "tcp_check_policy", ipha, ip6h, 12345 secure); 12346 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, 12347 &ipdrops_tcp_secure, &tcp_dropper); 12348 return (B_FALSE); 12349 } 12350 12351 /* 12352 * XXX This whole routine is currently incorrect. ipl should 12353 * be set to the latch pointer, but is currently not set, so 12354 * we initialize it to NULL to avoid picking up random garbage. 12355 */ 12356 if (ipl == NULL) 12357 return (B_TRUE); 12358 12359 data_mp = first_mp->b_cont; 12360 12361 ii = (ipsec_in_t *)first_mp->b_rptr; 12362 12363 if (ipsec_check_ipsecin_latch(ii, data_mp, ipl, ipha, ip6h, &reason, 12364 &counter)) { 12365 BUMP_MIB(&ip_mib, ipsecInSucceeded); 12366 return (B_TRUE); 12367 } 12368 (void) strlog(TCP_MODULE_ID, 0, 0, SL_ERROR|SL_WARN|SL_CONSOLE, 12369 "tcp inbound policy mismatch: %s, packet dropped\n", 12370 reason); 12371 BUMP_MIB(&ip_mib, ipsecInFailed); 12372 12373 ip_drop_packet(first_mp, B_TRUE, NULL, NULL, counter, &tcp_dropper); 12374 return (B_FALSE); 12375 } 12376 12377 /* 12378 * tcp_ss_rexmit() is called in tcp_rput_data() to do slow start 12379 * retransmission after a timeout. 12380 * 12381 * To limit the number of duplicate segments, we limit the number of segment 12382 * to be sent in one time to tcp_snd_burst, the burst variable. 12383 */ 12384 static void 12385 tcp_ss_rexmit(tcp_t *tcp) 12386 { 12387 uint32_t snxt; 12388 uint32_t smax; 12389 int32_t win; 12390 int32_t mss; 12391 int32_t off; 12392 int32_t burst = tcp->tcp_snd_burst; 12393 mblk_t *snxt_mp; 12394 12395 /* 12396 * Note that tcp_rexmit can be set even though TCP has retransmitted 12397 * all unack'ed segments. 12398 */ 12399 if (SEQ_LT(tcp->tcp_rexmit_nxt, tcp->tcp_rexmit_max)) { 12400 smax = tcp->tcp_rexmit_max; 12401 snxt = tcp->tcp_rexmit_nxt; 12402 if (SEQ_LT(snxt, tcp->tcp_suna)) { 12403 snxt = tcp->tcp_suna; 12404 } 12405 win = MIN(tcp->tcp_cwnd, tcp->tcp_swnd); 12406 win -= snxt - tcp->tcp_suna; 12407 mss = tcp->tcp_mss; 12408 snxt_mp = tcp_get_seg_mp(tcp, snxt, &off); 12409 12410 while (SEQ_LT(snxt, smax) && (win > 0) && 12411 (burst > 0) && (snxt_mp != NULL)) { 12412 mblk_t *xmit_mp; 12413 mblk_t *old_snxt_mp = snxt_mp; 12414 uint32_t cnt = mss; 12415 12416 if (win < cnt) { 12417 cnt = win; 12418 } 12419 if (SEQ_GT(snxt + cnt, smax)) { 12420 cnt = smax - snxt; 12421 } 12422 xmit_mp = tcp_xmit_mp(tcp, snxt_mp, cnt, &off, 12423 &snxt_mp, snxt, B_TRUE, &cnt, B_TRUE); 12424 if (xmit_mp == NULL) 12425 return; 12426 12427 tcp_send_data(tcp, tcp->tcp_wq, xmit_mp); 12428 12429 snxt += cnt; 12430 win -= cnt; 12431 /* 12432 * Update the send timestamp to avoid false 12433 * retransmission. 12434 */ 12435 old_snxt_mp->b_prev = (mblk_t *)lbolt; 12436 BUMP_MIB(&tcp_mib, tcpRetransSegs); 12437 UPDATE_MIB(&tcp_mib, tcpRetransBytes, cnt); 12438 12439 tcp->tcp_rexmit_nxt = snxt; 12440 burst--; 12441 } 12442 /* 12443 * If we have transmitted all we have at the time 12444 * we started the retranmission, we can leave 12445 * the rest of the job to tcp_wput_data(). But we 12446 * need to check the send window first. If the 12447 * win is not 0, go on with tcp_wput_data(). 12448 */ 12449 if (SEQ_LT(snxt, smax) || win == 0) { 12450 return; 12451 } 12452 } 12453 /* Only call tcp_wput_data() if there is data to be sent. */ 12454 if (tcp->tcp_unsent) { 12455 tcp_wput_data(tcp, NULL, B_FALSE); 12456 } 12457 } 12458 12459 /* 12460 * Process all TCP option in SYN segment. Note that this function should 12461 * be called after tcp_adapt_ire() is called so that the necessary info 12462 * from IRE is already set in the tcp structure. 12463 * 12464 * This function sets up the correct tcp_mss value according to the 12465 * MSS option value and our header size. It also sets up the window scale 12466 * and timestamp values, and initialize SACK info blocks. But it does not 12467 * change receive window size after setting the tcp_mss value. The caller 12468 * should do the appropriate change. 12469 */ 12470 void 12471 tcp_process_options(tcp_t *tcp, tcph_t *tcph) 12472 { 12473 int options; 12474 tcp_opt_t tcpopt; 12475 uint32_t mss_max; 12476 char *tmp_tcph; 12477 12478 tcpopt.tcp = NULL; 12479 options = tcp_parse_options(tcph, &tcpopt); 12480 12481 /* 12482 * Process MSS option. Note that MSS option value does not account 12483 * for IP or TCP options. This means that it is equal to MTU - minimum 12484 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 12485 * IPv6. 12486 */ 12487 if (!(options & TCP_OPT_MSS_PRESENT)) { 12488 if (tcp->tcp_ipversion == IPV4_VERSION) 12489 tcpopt.tcp_opt_mss = tcp_mss_def_ipv4; 12490 else 12491 tcpopt.tcp_opt_mss = tcp_mss_def_ipv6; 12492 } else { 12493 if (tcp->tcp_ipversion == IPV4_VERSION) 12494 mss_max = tcp_mss_max_ipv4; 12495 else 12496 mss_max = tcp_mss_max_ipv6; 12497 if (tcpopt.tcp_opt_mss < tcp_mss_min) 12498 tcpopt.tcp_opt_mss = tcp_mss_min; 12499 else if (tcpopt.tcp_opt_mss > mss_max) 12500 tcpopt.tcp_opt_mss = mss_max; 12501 } 12502 12503 /* Process Window Scale option. */ 12504 if (options & TCP_OPT_WSCALE_PRESENT) { 12505 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 12506 tcp->tcp_snd_ws_ok = B_TRUE; 12507 } else { 12508 tcp->tcp_snd_ws = B_FALSE; 12509 tcp->tcp_snd_ws_ok = B_FALSE; 12510 tcp->tcp_rcv_ws = B_FALSE; 12511 } 12512 12513 /* Process Timestamp option. */ 12514 if ((options & TCP_OPT_TSTAMP_PRESENT) && 12515 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 12516 tmp_tcph = (char *)tcp->tcp_tcph; 12517 12518 tcp->tcp_snd_ts_ok = B_TRUE; 12519 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 12520 tcp->tcp_last_rcv_lbolt = lbolt64; 12521 ASSERT(OK_32PTR(tmp_tcph)); 12522 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 12523 12524 /* Fill in our template header with basic timestamp option. */ 12525 tmp_tcph += tcp->tcp_tcp_hdr_len; 12526 tmp_tcph[0] = TCPOPT_NOP; 12527 tmp_tcph[1] = TCPOPT_NOP; 12528 tmp_tcph[2] = TCPOPT_TSTAMP; 12529 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 12530 tcp->tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12531 tcp->tcp_tcp_hdr_len += TCPOPT_REAL_TS_LEN; 12532 tcp->tcp_tcph->th_offset_and_rsrvd[0] += (3 << 4); 12533 } else { 12534 tcp->tcp_snd_ts_ok = B_FALSE; 12535 } 12536 12537 /* 12538 * Process SACK options. If SACK is enabled for this connection, 12539 * then allocate the SACK info structure. Note the following ways 12540 * when tcp_snd_sack_ok is set to true. 12541 * 12542 * For active connection: in tcp_adapt_ire() called in 12543 * tcp_rput_other(), or in tcp_rput_other() when tcp_sack_permitted 12544 * is checked. 12545 * 12546 * For passive connection: in tcp_adapt_ire() called in 12547 * tcp_accept_comm(). 12548 * 12549 * That's the reason why the extra TCP_IS_DETACHED() check is there. 12550 * That check makes sure that if we did not send a SACK OK option, 12551 * we will not enable SACK for this connection even though the other 12552 * side sends us SACK OK option. For active connection, the SACK 12553 * info structure has already been allocated. So we need to free 12554 * it if SACK is disabled. 12555 */ 12556 if ((options & TCP_OPT_SACK_OK_PRESENT) && 12557 (tcp->tcp_snd_sack_ok || 12558 (tcp_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 12559 /* This should be true only in the passive case. */ 12560 if (tcp->tcp_sack_info == NULL) { 12561 ASSERT(TCP_IS_DETACHED(tcp)); 12562 tcp->tcp_sack_info = 12563 kmem_cache_alloc(tcp_sack_info_cache, KM_NOSLEEP); 12564 } 12565 if (tcp->tcp_sack_info == NULL) { 12566 tcp->tcp_snd_sack_ok = B_FALSE; 12567 } else { 12568 tcp->tcp_snd_sack_ok = B_TRUE; 12569 if (tcp->tcp_snd_ts_ok) { 12570 tcp->tcp_max_sack_blk = 3; 12571 } else { 12572 tcp->tcp_max_sack_blk = 4; 12573 } 12574 } 12575 } else { 12576 /* 12577 * Resetting tcp_snd_sack_ok to B_FALSE so that 12578 * no SACK info will be used for this 12579 * connection. This assumes that SACK usage 12580 * permission is negotiated. This may need 12581 * to be changed once this is clarified. 12582 */ 12583 if (tcp->tcp_sack_info != NULL) { 12584 kmem_cache_free(tcp_sack_info_cache, 12585 tcp->tcp_sack_info); 12586 tcp->tcp_sack_info = NULL; 12587 } 12588 tcp->tcp_snd_sack_ok = B_FALSE; 12589 } 12590 12591 /* 12592 * Now we know the exact TCP/IP header length, subtract 12593 * that from tcp_mss to get our side's MSS. 12594 */ 12595 tcp->tcp_mss -= tcp->tcp_hdr_len; 12596 /* 12597 * Here we assume that the other side's header size will be equal to 12598 * our header size. We calculate the real MSS accordingly. Need to 12599 * take into additional stuffs IPsec puts in. 12600 * 12601 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 12602 */ 12603 tcpopt.tcp_opt_mss -= tcp->tcp_hdr_len + tcp->tcp_ipsec_overhead - 12604 ((tcp->tcp_ipversion == IPV4_VERSION ? 12605 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 12606 12607 /* 12608 * Set MSS to the smaller one of both ends of the connection. 12609 * We should not have called tcp_mss_set() before, but our 12610 * side of the MSS should have been set to a proper value 12611 * by tcp_adapt_ire(). tcp_mss_set() will also set up the 12612 * STREAM head parameters properly. 12613 * 12614 * If we have a larger-than-16-bit window but the other side 12615 * didn't want to do window scale, tcp_rwnd_set() will take 12616 * care of that. 12617 */ 12618 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 12619 } 12620 12621 /* 12622 * Sends the T_CONN_IND to the listener. The caller calls this 12623 * functions via squeue to get inside the listener's perimeter 12624 * once the 3 way hand shake is done a T_CONN_IND needs to be 12625 * sent. As an optimization, the caller can call this directly 12626 * if listener's perimeter is same as eager's. 12627 */ 12628 /* ARGSUSED */ 12629 void 12630 tcp_send_conn_ind(void *arg, mblk_t *mp, void *arg2) 12631 { 12632 conn_t *lconnp = (conn_t *)arg; 12633 tcp_t *listener = lconnp->conn_tcp; 12634 tcp_t *tcp; 12635 struct T_conn_ind *conn_ind; 12636 ipaddr_t *addr_cache; 12637 boolean_t need_send_conn_ind = B_FALSE; 12638 12639 /* retrieve the eager */ 12640 conn_ind = (struct T_conn_ind *)mp->b_rptr; 12641 ASSERT(conn_ind->OPT_offset != 0 && 12642 conn_ind->OPT_length == sizeof (intptr_t)); 12643 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 12644 conn_ind->OPT_length); 12645 12646 /* 12647 * TLI/XTI applications will get confused by 12648 * sending eager as an option since it violates 12649 * the option semantics. So remove the eager as 12650 * option since TLI/XTI app doesn't need it anyway. 12651 */ 12652 if (!TCP_IS_SOCKET(listener)) { 12653 conn_ind->OPT_length = 0; 12654 conn_ind->OPT_offset = 0; 12655 } 12656 if (listener->tcp_state == TCPS_CLOSED || 12657 TCP_IS_DETACHED(listener)) { 12658 /* 12659 * If listener has closed, it would have caused a 12660 * a cleanup/blowoff to happen for the eager. We 12661 * just need to return. 12662 */ 12663 freemsg(mp); 12664 return; 12665 } 12666 12667 12668 /* 12669 * if the conn_req_q is full defer passing up the 12670 * T_CONN_IND until space is availabe after t_accept() 12671 * processing 12672 */ 12673 mutex_enter(&listener->tcp_eager_lock); 12674 if (listener->tcp_conn_req_cnt_q < listener->tcp_conn_req_max) { 12675 tcp_t *tail; 12676 12677 /* 12678 * The eager already has an extra ref put in tcp_rput_data 12679 * so that it stays till accept comes back even though it 12680 * might get into TCPS_CLOSED as a result of a TH_RST etc. 12681 */ 12682 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 12683 listener->tcp_conn_req_cnt_q0--; 12684 listener->tcp_conn_req_cnt_q++; 12685 12686 /* Move from SYN_RCVD to ESTABLISHED list */ 12687 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12688 tcp->tcp_eager_prev_q0; 12689 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12690 tcp->tcp_eager_next_q0; 12691 tcp->tcp_eager_prev_q0 = NULL; 12692 tcp->tcp_eager_next_q0 = NULL; 12693 12694 /* 12695 * Insert at end of the queue because sockfs 12696 * sends down T_CONN_RES in chronological 12697 * order. Leaving the older conn indications 12698 * at front of the queue helps reducing search 12699 * time. 12700 */ 12701 tail = listener->tcp_eager_last_q; 12702 if (tail != NULL) 12703 tail->tcp_eager_next_q = tcp; 12704 else 12705 listener->tcp_eager_next_q = tcp; 12706 listener->tcp_eager_last_q = tcp; 12707 tcp->tcp_eager_next_q = NULL; 12708 /* 12709 * Delay sending up the T_conn_ind until we are 12710 * done with the eager. Once we have have sent up 12711 * the T_conn_ind, the accept can potentially complete 12712 * any time and release the refhold we have on the eager. 12713 */ 12714 need_send_conn_ind = B_TRUE; 12715 } else { 12716 /* 12717 * Defer connection on q0 and set deferred 12718 * connection bit true 12719 */ 12720 tcp->tcp_conn_def_q0 = B_TRUE; 12721 12722 /* take tcp out of q0 ... */ 12723 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 12724 tcp->tcp_eager_next_q0; 12725 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 12726 tcp->tcp_eager_prev_q0; 12727 12728 /* ... and place it at the end of q0 */ 12729 tcp->tcp_eager_prev_q0 = listener->tcp_eager_prev_q0; 12730 tcp->tcp_eager_next_q0 = listener; 12731 listener->tcp_eager_prev_q0->tcp_eager_next_q0 = tcp; 12732 listener->tcp_eager_prev_q0 = tcp; 12733 tcp->tcp_conn.tcp_eager_conn_ind = mp; 12734 } 12735 12736 /* we have timed out before */ 12737 if (tcp->tcp_syn_rcvd_timeout != 0) { 12738 tcp->tcp_syn_rcvd_timeout = 0; 12739 listener->tcp_syn_rcvd_timeout--; 12740 if (listener->tcp_syn_defense && 12741 listener->tcp_syn_rcvd_timeout <= 12742 (tcp_conn_req_max_q0 >> 5) && 12743 10*MINUTES < TICK_TO_MSEC(lbolt64 - 12744 listener->tcp_last_rcv_lbolt)) { 12745 /* 12746 * Turn off the defense mode if we 12747 * believe the SYN attack is over. 12748 */ 12749 listener->tcp_syn_defense = B_FALSE; 12750 if (listener->tcp_ip_addr_cache) { 12751 kmem_free((void *)listener->tcp_ip_addr_cache, 12752 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 12753 listener->tcp_ip_addr_cache = NULL; 12754 } 12755 } 12756 } 12757 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 12758 if (addr_cache != NULL) { 12759 /* 12760 * We have finished a 3-way handshake with this 12761 * remote host. This proves the IP addr is good. 12762 * Cache it! 12763 */ 12764 addr_cache[IP_ADDR_CACHE_HASH( 12765 tcp->tcp_remote)] = tcp->tcp_remote; 12766 } 12767 mutex_exit(&listener->tcp_eager_lock); 12768 if (need_send_conn_ind) 12769 putnext(listener->tcp_rq, mp); 12770 } 12771 12772 mblk_t * 12773 tcp_find_pktinfo(tcp_t *tcp, mblk_t *mp, uint_t *ipversp, uint_t *ip_hdr_lenp, 12774 uint_t *ifindexp, ip6_pkt_t *ippp) 12775 { 12776 in_pktinfo_t *pinfo; 12777 ip6_t *ip6h; 12778 uchar_t *rptr; 12779 mblk_t *first_mp = mp; 12780 boolean_t mctl_present = B_FALSE; 12781 uint_t ifindex = 0; 12782 ip6_pkt_t ipp; 12783 uint_t ipvers; 12784 uint_t ip_hdr_len; 12785 12786 rptr = mp->b_rptr; 12787 ASSERT(OK_32PTR(rptr)); 12788 ASSERT(tcp != NULL); 12789 ipp.ipp_fields = 0; 12790 12791 switch DB_TYPE(mp) { 12792 case M_CTL: 12793 mp = mp->b_cont; 12794 if (mp == NULL) { 12795 freemsg(first_mp); 12796 return (NULL); 12797 } 12798 if (DB_TYPE(mp) != M_DATA) { 12799 freemsg(first_mp); 12800 return (NULL); 12801 } 12802 mctl_present = B_TRUE; 12803 break; 12804 case M_DATA: 12805 break; 12806 default: 12807 cmn_err(CE_NOTE, "tcp_find_pktinfo: unknown db_type"); 12808 freemsg(mp); 12809 return (NULL); 12810 } 12811 ipvers = IPH_HDR_VERSION(rptr); 12812 if (ipvers == IPV4_VERSION) { 12813 if (tcp == NULL) { 12814 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12815 goto done; 12816 } 12817 12818 ipp.ipp_fields |= IPPF_HOPLIMIT; 12819 ipp.ipp_hoplimit = ((ipha_t *)rptr)->ipha_ttl; 12820 12821 /* 12822 * If we have IN_PKTINFO in an M_CTL and tcp_ipv6_recvancillary 12823 * has TCP_IPV6_RECVPKTINFO set, pass I/F index along in ipp. 12824 */ 12825 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) && 12826 mctl_present) { 12827 pinfo = (in_pktinfo_t *)first_mp->b_rptr; 12828 if ((MBLKL(first_mp) == sizeof (in_pktinfo_t)) && 12829 (pinfo->in_pkt_ulp_type == IN_PKTINFO) && 12830 (pinfo->in_pkt_flags & IPF_RECVIF)) { 12831 ipp.ipp_fields |= IPPF_IFINDEX; 12832 ipp.ipp_ifindex = pinfo->in_pkt_ifindex; 12833 ifindex = pinfo->in_pkt_ifindex; 12834 } 12835 freeb(first_mp); 12836 mctl_present = B_FALSE; 12837 } 12838 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12839 } else { 12840 ip6h = (ip6_t *)rptr; 12841 12842 ASSERT(ipvers == IPV6_VERSION); 12843 ipp.ipp_fields = IPPF_HOPLIMIT | IPPF_TCLASS; 12844 ipp.ipp_tclass = (ip6h->ip6_flow & 0x0FF00000) >> 20; 12845 ipp.ipp_hoplimit = ip6h->ip6_hops; 12846 12847 if (ip6h->ip6_nxt != IPPROTO_TCP) { 12848 uint8_t nexthdrp; 12849 12850 /* Look for ifindex information */ 12851 if (ip6h->ip6_nxt == IPPROTO_RAW) { 12852 ip6i_t *ip6i = (ip6i_t *)ip6h; 12853 if ((uchar_t *)&ip6i[1] > mp->b_wptr) { 12854 BUMP_MIB(&ip_mib, tcpInErrs); 12855 freemsg(first_mp); 12856 return (NULL); 12857 } 12858 12859 if (ip6i->ip6i_flags & IP6I_IFINDEX) { 12860 ASSERT(ip6i->ip6i_ifindex != 0); 12861 ipp.ipp_fields |= IPPF_IFINDEX; 12862 ipp.ipp_ifindex = ip6i->ip6i_ifindex; 12863 ifindex = ip6i->ip6i_ifindex; 12864 } 12865 rptr = (uchar_t *)&ip6i[1]; 12866 mp->b_rptr = rptr; 12867 if (rptr == mp->b_wptr) { 12868 mblk_t *mp1; 12869 mp1 = mp->b_cont; 12870 freeb(mp); 12871 mp = mp1; 12872 rptr = mp->b_rptr; 12873 } 12874 if (MBLKL(mp) < IPV6_HDR_LEN + 12875 sizeof (tcph_t)) { 12876 BUMP_MIB(&ip_mib, tcpInErrs); 12877 freemsg(first_mp); 12878 return (NULL); 12879 } 12880 ip6h = (ip6_t *)rptr; 12881 } 12882 12883 /* 12884 * Find any potentially interesting extension headers 12885 * as well as the length of the IPv6 + extension 12886 * headers. 12887 */ 12888 ip_hdr_len = ip_find_hdr_v6(mp, ip6h, &ipp, &nexthdrp); 12889 /* Verify if this is a TCP packet */ 12890 if (nexthdrp != IPPROTO_TCP) { 12891 BUMP_MIB(&ip_mib, tcpInErrs); 12892 freemsg(first_mp); 12893 return (NULL); 12894 } 12895 } else { 12896 ip_hdr_len = IPV6_HDR_LEN; 12897 } 12898 } 12899 12900 done: 12901 if (ipversp != NULL) 12902 *ipversp = ipvers; 12903 if (ip_hdr_lenp != NULL) 12904 *ip_hdr_lenp = ip_hdr_len; 12905 if (ippp != NULL) 12906 *ippp = ipp; 12907 if (ifindexp != NULL) 12908 *ifindexp = ifindex; 12909 if (mctl_present) { 12910 freeb(first_mp); 12911 } 12912 return (mp); 12913 } 12914 12915 /* 12916 * Handle M_DATA messages from IP. Its called directly from IP via 12917 * squeue for AF_INET type sockets fast path. No M_CTL are expected 12918 * in this path. 12919 * 12920 * For everything else (including AF_INET6 sockets with 'tcp_ipversion' 12921 * v4 and v6), we are called through tcp_input() and a M_CTL can 12922 * be present for options but tcp_find_pktinfo() deals with it. We 12923 * only expect M_DATA packets after tcp_find_pktinfo() is done. 12924 * 12925 * The first argument is always the connp/tcp to which the mp belongs. 12926 * There are no exceptions to this rule. The caller has already put 12927 * a reference on this connp/tcp and once tcp_rput_data() returns, 12928 * the squeue will do the refrele. 12929 * 12930 * The TH_SYN for the listener directly go to tcp_conn_request via 12931 * squeue. 12932 * 12933 * sqp: NULL = recursive, sqp != NULL means called from squeue 12934 */ 12935 void 12936 tcp_rput_data(void *arg, mblk_t *mp, void *arg2) 12937 { 12938 int32_t bytes_acked; 12939 int32_t gap; 12940 mblk_t *mp1; 12941 uint_t flags; 12942 uint32_t new_swnd = 0; 12943 uchar_t *iphdr; 12944 uchar_t *rptr; 12945 int32_t rgap; 12946 uint32_t seg_ack; 12947 int seg_len; 12948 uint_t ip_hdr_len; 12949 uint32_t seg_seq; 12950 tcph_t *tcph; 12951 int urp; 12952 tcp_opt_t tcpopt; 12953 uint_t ipvers; 12954 ip6_pkt_t ipp; 12955 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 12956 uint32_t cwnd; 12957 uint32_t add; 12958 int npkt; 12959 int mss; 12960 conn_t *connp = (conn_t *)arg; 12961 squeue_t *sqp = (squeue_t *)arg2; 12962 tcp_t *tcp = connp->conn_tcp; 12963 12964 /* 12965 * RST from fused tcp loopback peer should trigger an unfuse. 12966 */ 12967 if (tcp->tcp_fused) { 12968 TCP_STAT(tcp_fusion_aborted); 12969 tcp_unfuse(tcp); 12970 } 12971 12972 iphdr = mp->b_rptr; 12973 rptr = mp->b_rptr; 12974 ASSERT(OK_32PTR(rptr)); 12975 12976 /* 12977 * An AF_INET socket is not capable of receiving any pktinfo. Do inline 12978 * processing here. For rest call tcp_find_pktinfo to fill up the 12979 * necessary information. 12980 */ 12981 if (IPCL_IS_TCP4(connp)) { 12982 ipvers = IPV4_VERSION; 12983 ip_hdr_len = IPH_HDR_LENGTH(rptr); 12984 } else { 12985 mp = tcp_find_pktinfo(tcp, mp, &ipvers, &ip_hdr_len, 12986 NULL, &ipp); 12987 if (mp == NULL) { 12988 TCP_STAT(tcp_rput_v6_error); 12989 return; 12990 } 12991 iphdr = mp->b_rptr; 12992 rptr = mp->b_rptr; 12993 } 12994 ASSERT(DB_TYPE(mp) == M_DATA); 12995 12996 tcph = (tcph_t *)&rptr[ip_hdr_len]; 12997 seg_seq = ABE32_TO_U32(tcph->th_seq); 12998 seg_ack = ABE32_TO_U32(tcph->th_ack); 12999 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 13000 seg_len = (int)(mp->b_wptr - rptr) - 13001 (ip_hdr_len + TCP_HDR_LENGTH(tcph)); 13002 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 13003 do { 13004 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 13005 (uintptr_t)INT_MAX); 13006 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 13007 } while ((mp1 = mp1->b_cont) != NULL && 13008 mp1->b_datap->db_type == M_DATA); 13009 } 13010 13011 if (tcp->tcp_state == TCPS_TIME_WAIT) { 13012 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 13013 seg_len, tcph); 13014 return; 13015 } 13016 13017 if (sqp != NULL) { 13018 /* 13019 * This is the correct place to update tcp_last_recv_time. Note 13020 * that it is also updated for tcp structure that belongs to 13021 * global and listener queues which do not really need updating. 13022 * But that should not cause any harm. And it is updated for 13023 * all kinds of incoming segments, not only for data segments. 13024 */ 13025 tcp->tcp_last_recv_time = lbolt; 13026 } 13027 13028 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 13029 13030 BUMP_LOCAL(tcp->tcp_ibsegs); 13031 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 13032 13033 if ((flags & TH_URG) && sqp != NULL) { 13034 /* 13035 * TCP can't handle urgent pointers that arrive before 13036 * the connection has been accept()ed since it can't 13037 * buffer OOB data. Discard segment if this happens. 13038 * 13039 * Nor can it reassemble urgent pointers, so discard 13040 * if it's not the next segment expected. 13041 * 13042 * Otherwise, collapse chain into one mblk (discard if 13043 * that fails). This makes sure the headers, retransmitted 13044 * data, and new data all are in the same mblk. 13045 */ 13046 ASSERT(mp != NULL); 13047 if (tcp->tcp_listener || !pullupmsg(mp, -1)) { 13048 freemsg(mp); 13049 return; 13050 } 13051 /* Update pointers into message */ 13052 iphdr = rptr = mp->b_rptr; 13053 tcph = (tcph_t *)&rptr[ip_hdr_len]; 13054 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 13055 /* 13056 * Since we can't handle any data with this urgent 13057 * pointer that is out of sequence, we expunge 13058 * the data. This allows us to still register 13059 * the urgent mark and generate the M_PCSIG, 13060 * which we can do. 13061 */ 13062 mp->b_wptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 13063 seg_len = 0; 13064 } 13065 } 13066 13067 switch (tcp->tcp_state) { 13068 case TCPS_SYN_SENT: 13069 if (flags & TH_ACK) { 13070 /* 13071 * Note that our stack cannot send data before a 13072 * connection is established, therefore the 13073 * following check is valid. Otherwise, it has 13074 * to be changed. 13075 */ 13076 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 13077 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 13078 freemsg(mp); 13079 if (flags & TH_RST) 13080 return; 13081 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 13082 tcp, seg_ack, 0, TH_RST); 13083 return; 13084 } 13085 ASSERT(tcp->tcp_suna + 1 == seg_ack); 13086 } 13087 if (flags & TH_RST) { 13088 freemsg(mp); 13089 if (flags & TH_ACK) 13090 (void) tcp_clean_death(tcp, 13091 ECONNREFUSED, 13); 13092 return; 13093 } 13094 if (!(flags & TH_SYN)) { 13095 freemsg(mp); 13096 return; 13097 } 13098 13099 /* Process all TCP options. */ 13100 tcp_process_options(tcp, tcph); 13101 /* 13102 * The following changes our rwnd to be a multiple of the 13103 * MIN(peer MSS, our MSS) for performance reason. 13104 */ 13105 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(tcp->tcp_rq->q_hiwat, 13106 tcp->tcp_mss)); 13107 13108 /* Is the other end ECN capable? */ 13109 if (tcp->tcp_ecn_ok) { 13110 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 13111 tcp->tcp_ecn_ok = B_FALSE; 13112 } 13113 } 13114 /* 13115 * Clear ECN flags because it may interfere with later 13116 * processing. 13117 */ 13118 flags &= ~(TH_ECE|TH_CWR); 13119 13120 tcp->tcp_irs = seg_seq; 13121 tcp->tcp_rack = seg_seq; 13122 tcp->tcp_rnxt = seg_seq + 1; 13123 U32_TO_ABE32(tcp->tcp_rnxt, tcp->tcp_tcph->th_ack); 13124 if (!TCP_IS_DETACHED(tcp)) { 13125 /* Allocate room for SACK options if needed. */ 13126 if (tcp->tcp_snd_sack_ok) { 13127 (void) mi_set_sth_wroff(tcp->tcp_rq, 13128 tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 13129 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 13130 } else { 13131 (void) mi_set_sth_wroff(tcp->tcp_rq, 13132 tcp->tcp_hdr_len + 13133 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra)); 13134 } 13135 } 13136 if (flags & TH_ACK) { 13137 /* 13138 * If we can't get the confirmation upstream, pretend 13139 * we didn't even see this one. 13140 * 13141 * XXX: how can we pretend we didn't see it if we 13142 * have updated rnxt et. al. 13143 * 13144 * For loopback we defer sending up the T_CONN_CON 13145 * until after some checks below. 13146 */ 13147 mp1 = NULL; 13148 if (!tcp_conn_con(tcp, iphdr, tcph, mp, 13149 tcp->tcp_loopback ? &mp1 : NULL)) { 13150 freemsg(mp); 13151 return; 13152 } 13153 /* SYN was acked - making progress */ 13154 if (tcp->tcp_ipversion == IPV6_VERSION) 13155 tcp->tcp_ip_forward_progress = B_TRUE; 13156 13157 /* One for the SYN */ 13158 tcp->tcp_suna = tcp->tcp_iss + 1; 13159 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 13160 tcp->tcp_state = TCPS_ESTABLISHED; 13161 13162 /* 13163 * If SYN was retransmitted, need to reset all 13164 * retransmission info. This is because this 13165 * segment will be treated as a dup ACK. 13166 */ 13167 if (tcp->tcp_rexmit) { 13168 tcp->tcp_rexmit = B_FALSE; 13169 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 13170 tcp->tcp_rexmit_max = tcp->tcp_snxt; 13171 tcp->tcp_snd_burst = tcp->tcp_localnet ? 13172 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 13173 tcp->tcp_ms_we_have_waited = 0; 13174 13175 /* 13176 * Set tcp_cwnd back to 1 MSS, per 13177 * recommendation from 13178 * draft-floyd-incr-init-win-01.txt, 13179 * Increasing TCP's Initial Window. 13180 */ 13181 tcp->tcp_cwnd = tcp->tcp_mss; 13182 } 13183 13184 tcp->tcp_swl1 = seg_seq; 13185 tcp->tcp_swl2 = seg_ack; 13186 13187 new_swnd = BE16_TO_U16(tcph->th_win); 13188 tcp->tcp_swnd = new_swnd; 13189 if (new_swnd > tcp->tcp_max_swnd) 13190 tcp->tcp_max_swnd = new_swnd; 13191 13192 /* 13193 * Always send the three-way handshake ack immediately 13194 * in order to make the connection complete as soon as 13195 * possible on the accepting host. 13196 */ 13197 flags |= TH_ACK_NEEDED; 13198 13199 /* 13200 * Special case for loopback. At this point we have 13201 * received SYN-ACK from the remote endpoint. In 13202 * order to ensure that both endpoints reach the 13203 * fused state prior to any data exchange, the final 13204 * ACK needs to be sent before we indicate T_CONN_CON 13205 * to the module upstream. 13206 */ 13207 if (tcp->tcp_loopback) { 13208 mblk_t *ack_mp; 13209 13210 ASSERT(!tcp->tcp_unfusable); 13211 ASSERT(mp1 != NULL); 13212 /* 13213 * For loopback, we always get a pure SYN-ACK 13214 * and only need to send back the final ACK 13215 * with no data (this is because the other 13216 * tcp is ours and we don't do T/TCP). This 13217 * final ACK triggers the passive side to 13218 * perform fusion in ESTABLISHED state. 13219 */ 13220 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 13221 if (tcp->tcp_ack_tid != 0) { 13222 (void) TCP_TIMER_CANCEL(tcp, 13223 tcp->tcp_ack_tid); 13224 tcp->tcp_ack_tid = 0; 13225 } 13226 TCP_RECORD_TRACE(tcp, ack_mp, 13227 TCP_TRACE_SEND_PKT); 13228 tcp_send_data(tcp, tcp->tcp_wq, ack_mp); 13229 BUMP_LOCAL(tcp->tcp_obsegs); 13230 BUMP_MIB(&tcp_mib, tcpOutAck); 13231 13232 /* Send up T_CONN_CON */ 13233 putnext(tcp->tcp_rq, mp1); 13234 13235 freemsg(mp); 13236 return; 13237 } 13238 /* 13239 * Forget fusion; we need to handle more 13240 * complex cases below. Send the deferred 13241 * T_CONN_CON message upstream and proceed 13242 * as usual. Mark this tcp as not capable 13243 * of fusion. 13244 */ 13245 TCP_STAT(tcp_fusion_unfusable); 13246 tcp->tcp_unfusable = B_TRUE; 13247 putnext(tcp->tcp_rq, mp1); 13248 } 13249 13250 /* 13251 * Check to see if there is data to be sent. If 13252 * yes, set the transmit flag. Then check to see 13253 * if received data processing needs to be done. 13254 * If not, go straight to xmit_check. This short 13255 * cut is OK as we don't support T/TCP. 13256 */ 13257 if (tcp->tcp_unsent) 13258 flags |= TH_XMIT_NEEDED; 13259 13260 if (seg_len == 0 && !(flags & TH_URG)) { 13261 freemsg(mp); 13262 goto xmit_check; 13263 } 13264 13265 flags &= ~TH_SYN; 13266 seg_seq++; 13267 break; 13268 } 13269 tcp->tcp_state = TCPS_SYN_RCVD; 13270 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 13271 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 13272 if (mp1) { 13273 mblk_setcred(mp1, tcp->tcp_cred); 13274 DB_CPID(mp1) = tcp->tcp_cpid; 13275 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 13276 tcp_send_data(tcp, tcp->tcp_wq, mp1); 13277 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 13278 } 13279 freemsg(mp); 13280 return; 13281 case TCPS_SYN_RCVD: 13282 if (flags & TH_ACK) { 13283 /* 13284 * In this state, a SYN|ACK packet is either bogus 13285 * because the other side must be ACKing our SYN which 13286 * indicates it has seen the ACK for their SYN and 13287 * shouldn't retransmit it or we're crossing SYNs 13288 * on active open. 13289 */ 13290 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 13291 freemsg(mp); 13292 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 13293 tcp, seg_ack, 0, TH_RST); 13294 return; 13295 } 13296 /* 13297 * NOTE: RFC 793 pg. 72 says this should be 13298 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 13299 * but that would mean we have an ack that ignored 13300 * our SYN. 13301 */ 13302 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 13303 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 13304 freemsg(mp); 13305 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 13306 tcp, seg_ack, 0, TH_RST); 13307 return; 13308 } 13309 } 13310 break; 13311 case TCPS_LISTEN: 13312 /* 13313 * Only a TLI listener can come through this path when a 13314 * acceptor is going back to be a listener and a packet 13315 * for the acceptor hits the classifier. For a socket 13316 * listener, this can never happen because a listener 13317 * can never accept connection on itself and hence a 13318 * socket acceptor can not go back to being a listener. 13319 */ 13320 ASSERT(!TCP_IS_SOCKET(tcp)); 13321 /*FALLTHRU*/ 13322 case TCPS_CLOSED: 13323 case TCPS_BOUND: { 13324 conn_t *new_connp; 13325 13326 new_connp = ipcl_classify(mp, connp->conn_zoneid); 13327 if (new_connp != NULL) { 13328 tcp_reinput(new_connp, mp, connp->conn_sqp); 13329 return; 13330 } 13331 /* We failed to classify. For now just drop the packet */ 13332 freemsg(mp); 13333 return; 13334 } 13335 case TCPS_IDLE: 13336 /* 13337 * Handle the case where the tcp_clean_death() has happened 13338 * on a connection (application hasn't closed yet) but a packet 13339 * was already queued on squeue before tcp_clean_death() 13340 * was processed. Calling tcp_clean_death() twice on same 13341 * connection can result in weird behaviour. 13342 */ 13343 freemsg(mp); 13344 return; 13345 default: 13346 break; 13347 } 13348 13349 /* 13350 * Already on the correct queue/perimeter. 13351 * If this is a detached connection and not an eager 13352 * connection hanging off a listener then new data 13353 * (past the FIN) will cause a reset. 13354 * We do a special check here where it 13355 * is out of the main line, rather than check 13356 * if we are detached every time we see new 13357 * data down below. 13358 */ 13359 if (TCP_IS_DETACHED_NONEAGER(tcp) && 13360 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 13361 BUMP_MIB(&tcp_mib, tcpInClosed); 13362 TCP_RECORD_TRACE(tcp, 13363 mp, TCP_TRACE_RECV_PKT); 13364 freemsg(mp); 13365 tcp_xmit_ctl("new data when detached", tcp, 13366 tcp->tcp_snxt, 0, TH_RST); 13367 (void) tcp_clean_death(tcp, EPROTO, 12); 13368 return; 13369 } 13370 13371 mp->b_rptr = (uchar_t *)tcph + TCP_HDR_LENGTH(tcph); 13372 urp = BE16_TO_U16(tcph->th_urp) - TCP_OLD_URP_INTERPRETATION; 13373 new_swnd = BE16_TO_U16(tcph->th_win) << 13374 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 13375 mss = tcp->tcp_mss; 13376 13377 if (tcp->tcp_snd_ts_ok) { 13378 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 13379 /* 13380 * This segment is not acceptable. 13381 * Drop it and send back an ACK. 13382 */ 13383 freemsg(mp); 13384 flags |= TH_ACK_NEEDED; 13385 goto ack_check; 13386 } 13387 } else if (tcp->tcp_snd_sack_ok) { 13388 ASSERT(tcp->tcp_sack_info != NULL); 13389 tcpopt.tcp = tcp; 13390 /* 13391 * SACK info in already updated in tcp_parse_options. Ignore 13392 * all other TCP options... 13393 */ 13394 (void) tcp_parse_options(tcph, &tcpopt); 13395 } 13396 try_again:; 13397 gap = seg_seq - tcp->tcp_rnxt; 13398 rgap = tcp->tcp_rwnd - (gap + seg_len); 13399 /* 13400 * gap is the amount of sequence space between what we expect to see 13401 * and what we got for seg_seq. A positive value for gap means 13402 * something got lost. A negative value means we got some old stuff. 13403 */ 13404 if (gap < 0) { 13405 /* Old stuff present. Is the SYN in there? */ 13406 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 13407 (seg_len != 0)) { 13408 flags &= ~TH_SYN; 13409 seg_seq++; 13410 urp--; 13411 /* Recompute the gaps after noting the SYN. */ 13412 goto try_again; 13413 } 13414 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 13415 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 13416 (seg_len > -gap ? -gap : seg_len)); 13417 /* Remove the old stuff from seg_len. */ 13418 seg_len += gap; 13419 /* 13420 * Anything left? 13421 * Make sure to check for unack'd FIN when rest of data 13422 * has been previously ack'd. 13423 */ 13424 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 13425 /* 13426 * Resets are only valid if they lie within our offered 13427 * window. If the RST bit is set, we just ignore this 13428 * segment. 13429 */ 13430 if (flags & TH_RST) { 13431 freemsg(mp); 13432 return; 13433 } 13434 13435 /* 13436 * The arriving of dup data packets indicate that we 13437 * may have postponed an ack for too long, or the other 13438 * side's RTT estimate is out of shape. Start acking 13439 * more often. 13440 */ 13441 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 13442 tcp->tcp_rack_cnt >= 1 && 13443 tcp->tcp_rack_abs_max > 2) { 13444 tcp->tcp_rack_abs_max--; 13445 } 13446 tcp->tcp_rack_cur_max = 1; 13447 13448 /* 13449 * This segment is "unacceptable". None of its 13450 * sequence space lies within our advertized window. 13451 * 13452 * Adjust seg_len to the original value for tracing. 13453 */ 13454 seg_len -= gap; 13455 if (tcp->tcp_debug) { 13456 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 13457 "tcp_rput: unacceptable, gap %d, rgap %d, " 13458 "flags 0x%x, seg_seq %u, seg_ack %u, " 13459 "seg_len %d, rnxt %u, snxt %u, %s", 13460 gap, rgap, flags, seg_seq, seg_ack, 13461 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 13462 tcp_display(tcp, NULL, 13463 DISP_ADDR_AND_PORT)); 13464 } 13465 13466 /* 13467 * Arrange to send an ACK in response to the 13468 * unacceptable segment per RFC 793 page 69. There 13469 * is only one small difference between ours and the 13470 * acceptability test in the RFC - we accept ACK-only 13471 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 13472 * will be generated. 13473 * 13474 * Note that we have to ACK an ACK-only packet at least 13475 * for stacks that send 0-length keep-alives with 13476 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 13477 * section 4.2.3.6. As long as we don't ever generate 13478 * an unacceptable packet in response to an incoming 13479 * packet that is unacceptable, it should not cause 13480 * "ACK wars". 13481 */ 13482 flags |= TH_ACK_NEEDED; 13483 13484 /* 13485 * Continue processing this segment in order to use the 13486 * ACK information it contains, but skip all other 13487 * sequence-number processing. Processing the ACK 13488 * information is necessary in order to 13489 * re-synchronize connections that may have lost 13490 * synchronization. 13491 * 13492 * We clear seg_len and flag fields related to 13493 * sequence number processing as they are not 13494 * to be trusted for an unacceptable segment. 13495 */ 13496 seg_len = 0; 13497 flags &= ~(TH_SYN | TH_FIN | TH_URG); 13498 goto process_ack; 13499 } 13500 13501 /* Fix seg_seq, and chew the gap off the front. */ 13502 seg_seq = tcp->tcp_rnxt; 13503 urp += gap; 13504 do { 13505 mblk_t *mp2; 13506 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13507 (uintptr_t)UINT_MAX); 13508 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 13509 if (gap > 0) { 13510 mp->b_rptr = mp->b_wptr - gap; 13511 break; 13512 } 13513 mp2 = mp; 13514 mp = mp->b_cont; 13515 freeb(mp2); 13516 } while (gap < 0); 13517 /* 13518 * If the urgent data has already been acknowledged, we 13519 * should ignore TH_URG below 13520 */ 13521 if (urp < 0) 13522 flags &= ~TH_URG; 13523 } 13524 /* 13525 * rgap is the amount of stuff received out of window. A negative 13526 * value is the amount out of window. 13527 */ 13528 if (rgap < 0) { 13529 mblk_t *mp2; 13530 13531 if (tcp->tcp_rwnd == 0) { 13532 BUMP_MIB(&tcp_mib, tcpInWinProbe); 13533 } else { 13534 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 13535 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 13536 } 13537 13538 /* 13539 * seg_len does not include the FIN, so if more than 13540 * just the FIN is out of window, we act like we don't 13541 * see it. (If just the FIN is out of window, rgap 13542 * will be zero and we will go ahead and acknowledge 13543 * the FIN.) 13544 */ 13545 flags &= ~TH_FIN; 13546 13547 /* Fix seg_len and make sure there is something left. */ 13548 seg_len += rgap; 13549 if (seg_len <= 0) { 13550 /* 13551 * Resets are only valid if they lie within our offered 13552 * window. If the RST bit is set, we just ignore this 13553 * segment. 13554 */ 13555 if (flags & TH_RST) { 13556 freemsg(mp); 13557 return; 13558 } 13559 13560 /* Per RFC 793, we need to send back an ACK. */ 13561 flags |= TH_ACK_NEEDED; 13562 13563 /* 13564 * Send SIGURG as soon as possible i.e. even 13565 * if the TH_URG was delivered in a window probe 13566 * packet (which will be unacceptable). 13567 * 13568 * We generate a signal if none has been generated 13569 * for this connection or if this is a new urgent 13570 * byte. Also send a zero-length "unmarked" message 13571 * to inform SIOCATMARK that this is not the mark. 13572 * 13573 * tcp_urp_last_valid is cleared when the T_exdata_ind 13574 * is sent up. This plus the check for old data 13575 * (gap >= 0) handles the wraparound of the sequence 13576 * number space without having to always track the 13577 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 13578 * this max in its rcv_up variable). 13579 * 13580 * This prevents duplicate SIGURGS due to a "late" 13581 * zero-window probe when the T_EXDATA_IND has already 13582 * been sent up. 13583 */ 13584 if ((flags & TH_URG) && 13585 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 13586 tcp->tcp_urp_last))) { 13587 mp1 = allocb(0, BPRI_MED); 13588 if (mp1 == NULL) { 13589 freemsg(mp); 13590 return; 13591 } 13592 if (!TCP_IS_DETACHED(tcp) && 13593 !putnextctl1(tcp->tcp_rq, M_PCSIG, 13594 SIGURG)) { 13595 /* Try again on the rexmit. */ 13596 freemsg(mp1); 13597 freemsg(mp); 13598 return; 13599 } 13600 /* 13601 * If the next byte would be the mark 13602 * then mark with MARKNEXT else mark 13603 * with NOTMARKNEXT. 13604 */ 13605 if (gap == 0 && urp == 0) 13606 mp1->b_flag |= MSGMARKNEXT; 13607 else 13608 mp1->b_flag |= MSGNOTMARKNEXT; 13609 freemsg(tcp->tcp_urp_mark_mp); 13610 tcp->tcp_urp_mark_mp = mp1; 13611 flags |= TH_SEND_URP_MARK; 13612 tcp->tcp_urp_last_valid = B_TRUE; 13613 tcp->tcp_urp_last = urp + seg_seq; 13614 } 13615 /* 13616 * If this is a zero window probe, continue to 13617 * process the ACK part. But we need to set seg_len 13618 * to 0 to avoid data processing. Otherwise just 13619 * drop the segment and send back an ACK. 13620 */ 13621 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 13622 flags &= ~(TH_SYN | TH_URG); 13623 seg_len = 0; 13624 goto process_ack; 13625 } else { 13626 freemsg(mp); 13627 goto ack_check; 13628 } 13629 } 13630 /* Pitch out of window stuff off the end. */ 13631 rgap = seg_len; 13632 mp2 = mp; 13633 do { 13634 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 13635 (uintptr_t)INT_MAX); 13636 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 13637 if (rgap < 0) { 13638 mp2->b_wptr += rgap; 13639 if ((mp1 = mp2->b_cont) != NULL) { 13640 mp2->b_cont = NULL; 13641 freemsg(mp1); 13642 } 13643 break; 13644 } 13645 } while ((mp2 = mp2->b_cont) != NULL); 13646 } 13647 ok:; 13648 /* 13649 * TCP should check ECN info for segments inside the window only. 13650 * Therefore the check should be done here. 13651 */ 13652 if (tcp->tcp_ecn_ok) { 13653 if (flags & TH_CWR) { 13654 tcp->tcp_ecn_echo_on = B_FALSE; 13655 } 13656 /* 13657 * Note that both ECN_CE and CWR can be set in the 13658 * same segment. In this case, we once again turn 13659 * on ECN_ECHO. 13660 */ 13661 if (tcp->tcp_ipversion == IPV4_VERSION) { 13662 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 13663 13664 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 13665 tcp->tcp_ecn_echo_on = B_TRUE; 13666 } 13667 } else { 13668 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 13669 13670 if ((vcf & htonl(IPH_ECN_CE << 20)) == 13671 htonl(IPH_ECN_CE << 20)) { 13672 tcp->tcp_ecn_echo_on = B_TRUE; 13673 } 13674 } 13675 } 13676 13677 /* 13678 * Check whether we can update tcp_ts_recent. This test is 13679 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 13680 * Extensions for High Performance: An Update", Internet Draft. 13681 */ 13682 if (tcp->tcp_snd_ts_ok && 13683 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 13684 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 13685 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 13686 tcp->tcp_last_rcv_lbolt = lbolt64; 13687 } 13688 13689 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 13690 /* 13691 * FIN in an out of order segment. We record this in 13692 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 13693 * Clear the FIN so that any check on FIN flag will fail. 13694 * Remember that FIN also counts in the sequence number 13695 * space. So we need to ack out of order FIN only segments. 13696 */ 13697 if (flags & TH_FIN) { 13698 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 13699 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 13700 flags &= ~TH_FIN; 13701 flags |= TH_ACK_NEEDED; 13702 } 13703 if (seg_len > 0) { 13704 /* Fill in the SACK blk list. */ 13705 if (tcp->tcp_snd_sack_ok) { 13706 ASSERT(tcp->tcp_sack_info != NULL); 13707 tcp_sack_insert(tcp->tcp_sack_list, 13708 seg_seq, seg_seq + seg_len, 13709 &(tcp->tcp_num_sack_blk)); 13710 } 13711 13712 /* 13713 * Attempt reassembly and see if we have something 13714 * ready to go. 13715 */ 13716 mp = tcp_reass(tcp, mp, seg_seq); 13717 /* Always ack out of order packets */ 13718 flags |= TH_ACK_NEEDED | TH_PUSH; 13719 if (mp) { 13720 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 13721 (uintptr_t)INT_MAX); 13722 seg_len = mp->b_cont ? msgdsize(mp) : 13723 (int)(mp->b_wptr - mp->b_rptr); 13724 seg_seq = tcp->tcp_rnxt; 13725 /* 13726 * A gap is filled and the seq num and len 13727 * of the gap match that of a previously 13728 * received FIN, put the FIN flag back in. 13729 */ 13730 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13731 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13732 flags |= TH_FIN; 13733 tcp->tcp_valid_bits &= 13734 ~TCP_OFO_FIN_VALID; 13735 } 13736 } else { 13737 /* 13738 * Keep going even with NULL mp. 13739 * There may be a useful ACK or something else 13740 * we don't want to miss. 13741 * 13742 * But TCP should not perform fast retransmit 13743 * because of the ack number. TCP uses 13744 * seg_len == 0 to determine if it is a pure 13745 * ACK. And this is not a pure ACK. 13746 */ 13747 seg_len = 0; 13748 ofo_seg = B_TRUE; 13749 } 13750 } 13751 } else if (seg_len > 0) { 13752 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 13753 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 13754 /* 13755 * If an out of order FIN was received before, and the seq 13756 * num and len of the new segment match that of the FIN, 13757 * put the FIN flag back in. 13758 */ 13759 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 13760 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 13761 flags |= TH_FIN; 13762 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 13763 } 13764 } 13765 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 13766 if (flags & TH_RST) { 13767 freemsg(mp); 13768 switch (tcp->tcp_state) { 13769 case TCPS_SYN_RCVD: 13770 (void) tcp_clean_death(tcp, ECONNREFUSED, 14); 13771 break; 13772 case TCPS_ESTABLISHED: 13773 case TCPS_FIN_WAIT_1: 13774 case TCPS_FIN_WAIT_2: 13775 case TCPS_CLOSE_WAIT: 13776 (void) tcp_clean_death(tcp, ECONNRESET, 15); 13777 break; 13778 case TCPS_CLOSING: 13779 case TCPS_LAST_ACK: 13780 (void) tcp_clean_death(tcp, 0, 16); 13781 break; 13782 default: 13783 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13784 (void) tcp_clean_death(tcp, ENXIO, 17); 13785 break; 13786 } 13787 return; 13788 } 13789 if (flags & TH_SYN) { 13790 /* 13791 * See RFC 793, Page 71 13792 * 13793 * The seq number must be in the window as it should 13794 * be "fixed" above. If it is outside window, it should 13795 * be already rejected. Note that we allow seg_seq to be 13796 * rnxt + rwnd because we want to accept 0 window probe. 13797 */ 13798 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 13799 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 13800 freemsg(mp); 13801 /* 13802 * If the ACK flag is not set, just use our snxt as the 13803 * seq number of the RST segment. 13804 */ 13805 if (!(flags & TH_ACK)) { 13806 seg_ack = tcp->tcp_snxt; 13807 } 13808 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 13809 TH_RST|TH_ACK); 13810 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 13811 (void) tcp_clean_death(tcp, ECONNRESET, 18); 13812 return; 13813 } 13814 /* 13815 * urp could be -1 when the urp field in the packet is 0 13816 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 13817 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 13818 */ 13819 if (flags & TH_URG && urp >= 0) { 13820 if (!tcp->tcp_urp_last_valid || 13821 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 13822 /* 13823 * If we haven't generated the signal yet for this 13824 * urgent pointer value, do it now. Also, send up a 13825 * zero-length M_DATA indicating whether or not this is 13826 * the mark. The latter is not needed when a 13827 * T_EXDATA_IND is sent up. However, if there are 13828 * allocation failures this code relies on the sender 13829 * retransmitting and the socket code for determining 13830 * the mark should not block waiting for the peer to 13831 * transmit. Thus, for simplicity we always send up the 13832 * mark indication. 13833 */ 13834 mp1 = allocb(0, BPRI_MED); 13835 if (mp1 == NULL) { 13836 freemsg(mp); 13837 return; 13838 } 13839 if (!TCP_IS_DETACHED(tcp) && 13840 !putnextctl1(tcp->tcp_rq, M_PCSIG, SIGURG)) { 13841 /* Try again on the rexmit. */ 13842 freemsg(mp1); 13843 freemsg(mp); 13844 return; 13845 } 13846 /* 13847 * Mark with NOTMARKNEXT for now. 13848 * The code below will change this to MARKNEXT 13849 * if we are at the mark. 13850 * 13851 * If there are allocation failures (e.g. in dupmsg 13852 * below) the next time tcp_rput_data sees the urgent 13853 * segment it will send up the MSG*MARKNEXT message. 13854 */ 13855 mp1->b_flag |= MSGNOTMARKNEXT; 13856 freemsg(tcp->tcp_urp_mark_mp); 13857 tcp->tcp_urp_mark_mp = mp1; 13858 flags |= TH_SEND_URP_MARK; 13859 #ifdef DEBUG 13860 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 13861 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 13862 "last %x, %s", 13863 seg_seq, urp, tcp->tcp_urp_last, 13864 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 13865 #endif /* DEBUG */ 13866 tcp->tcp_urp_last_valid = B_TRUE; 13867 tcp->tcp_urp_last = urp + seg_seq; 13868 } else if (tcp->tcp_urp_mark_mp != NULL) { 13869 /* 13870 * An allocation failure prevented the previous 13871 * tcp_rput_data from sending up the allocated 13872 * MSG*MARKNEXT message - send it up this time 13873 * around. 13874 */ 13875 flags |= TH_SEND_URP_MARK; 13876 } 13877 13878 /* 13879 * If the urgent byte is in this segment, make sure that it is 13880 * all by itself. This makes it much easier to deal with the 13881 * possibility of an allocation failure on the T_exdata_ind. 13882 * Note that seg_len is the number of bytes in the segment, and 13883 * urp is the offset into the segment of the urgent byte. 13884 * urp < seg_len means that the urgent byte is in this segment. 13885 */ 13886 if (urp < seg_len) { 13887 if (seg_len != 1) { 13888 uint32_t tmp_rnxt; 13889 /* 13890 * Break it up and feed it back in. 13891 * Re-attach the IP header. 13892 */ 13893 mp->b_rptr = iphdr; 13894 if (urp > 0) { 13895 /* 13896 * There is stuff before the urgent 13897 * byte. 13898 */ 13899 mp1 = dupmsg(mp); 13900 if (!mp1) { 13901 /* 13902 * Trim from urgent byte on. 13903 * The rest will come back. 13904 */ 13905 (void) adjmsg(mp, 13906 urp - seg_len); 13907 tcp_rput_data(connp, 13908 mp, NULL); 13909 return; 13910 } 13911 (void) adjmsg(mp1, urp - seg_len); 13912 /* Feed this piece back in. */ 13913 tmp_rnxt = tcp->tcp_rnxt; 13914 tcp_rput_data(connp, mp1, NULL); 13915 /* 13916 * If the data passed back in was not 13917 * processed (ie: bad ACK) sending 13918 * the remainder back in will cause a 13919 * loop. In this case, drop the 13920 * packet and let the sender try 13921 * sending a good packet. 13922 */ 13923 if (tmp_rnxt == tcp->tcp_rnxt) { 13924 freemsg(mp); 13925 return; 13926 } 13927 } 13928 if (urp != seg_len - 1) { 13929 uint32_t tmp_rnxt; 13930 /* 13931 * There is stuff after the urgent 13932 * byte. 13933 */ 13934 mp1 = dupmsg(mp); 13935 if (!mp1) { 13936 /* 13937 * Trim everything beyond the 13938 * urgent byte. The rest will 13939 * come back. 13940 */ 13941 (void) adjmsg(mp, 13942 urp + 1 - seg_len); 13943 tcp_rput_data(connp, 13944 mp, NULL); 13945 return; 13946 } 13947 (void) adjmsg(mp1, urp + 1 - seg_len); 13948 tmp_rnxt = tcp->tcp_rnxt; 13949 tcp_rput_data(connp, mp1, NULL); 13950 /* 13951 * If the data passed back in was not 13952 * processed (ie: bad ACK) sending 13953 * the remainder back in will cause a 13954 * loop. In this case, drop the 13955 * packet and let the sender try 13956 * sending a good packet. 13957 */ 13958 if (tmp_rnxt == tcp->tcp_rnxt) { 13959 freemsg(mp); 13960 return; 13961 } 13962 } 13963 tcp_rput_data(connp, mp, NULL); 13964 return; 13965 } 13966 /* 13967 * This segment contains only the urgent byte. We 13968 * have to allocate the T_exdata_ind, if we can. 13969 */ 13970 if (!tcp->tcp_urp_mp) { 13971 struct T_exdata_ind *tei; 13972 mp1 = allocb(sizeof (struct T_exdata_ind), 13973 BPRI_MED); 13974 if (!mp1) { 13975 /* 13976 * Sigh... It'll be back. 13977 * Generate any MSG*MARK message now. 13978 */ 13979 freemsg(mp); 13980 seg_len = 0; 13981 if (flags & TH_SEND_URP_MARK) { 13982 13983 13984 ASSERT(tcp->tcp_urp_mark_mp); 13985 tcp->tcp_urp_mark_mp->b_flag &= 13986 ~MSGNOTMARKNEXT; 13987 tcp->tcp_urp_mark_mp->b_flag |= 13988 MSGMARKNEXT; 13989 } 13990 goto ack_check; 13991 } 13992 mp1->b_datap->db_type = M_PROTO; 13993 tei = (struct T_exdata_ind *)mp1->b_rptr; 13994 tei->PRIM_type = T_EXDATA_IND; 13995 tei->MORE_flag = 0; 13996 mp1->b_wptr = (uchar_t *)&tei[1]; 13997 tcp->tcp_urp_mp = mp1; 13998 #ifdef DEBUG 13999 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14000 "tcp_rput: allocated exdata_ind %s", 14001 tcp_display(tcp, NULL, 14002 DISP_PORT_ONLY)); 14003 #endif /* DEBUG */ 14004 /* 14005 * There is no need to send a separate MSG*MARK 14006 * message since the T_EXDATA_IND will be sent 14007 * now. 14008 */ 14009 flags &= ~TH_SEND_URP_MARK; 14010 freemsg(tcp->tcp_urp_mark_mp); 14011 tcp->tcp_urp_mark_mp = NULL; 14012 } 14013 /* 14014 * Now we are all set. On the next putnext upstream, 14015 * tcp_urp_mp will be non-NULL and will get prepended 14016 * to what has to be this piece containing the urgent 14017 * byte. If for any reason we abort this segment below, 14018 * if it comes back, we will have this ready, or it 14019 * will get blown off in close. 14020 */ 14021 } else if (urp == seg_len) { 14022 /* 14023 * The urgent byte is the next byte after this sequence 14024 * number. If there is data it is marked with 14025 * MSGMARKNEXT and any tcp_urp_mark_mp is discarded 14026 * since it is not needed. Otherwise, if the code 14027 * above just allocated a zero-length tcp_urp_mark_mp 14028 * message, that message is tagged with MSGMARKNEXT. 14029 * Sending up these MSGMARKNEXT messages makes 14030 * SIOCATMARK work correctly even though 14031 * the T_EXDATA_IND will not be sent up until the 14032 * urgent byte arrives. 14033 */ 14034 if (seg_len != 0) { 14035 flags |= TH_MARKNEXT_NEEDED; 14036 freemsg(tcp->tcp_urp_mark_mp); 14037 tcp->tcp_urp_mark_mp = NULL; 14038 flags &= ~TH_SEND_URP_MARK; 14039 } else if (tcp->tcp_urp_mark_mp != NULL) { 14040 flags |= TH_SEND_URP_MARK; 14041 tcp->tcp_urp_mark_mp->b_flag &= 14042 ~MSGNOTMARKNEXT; 14043 tcp->tcp_urp_mark_mp->b_flag |= MSGMARKNEXT; 14044 } 14045 #ifdef DEBUG 14046 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14047 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 14048 seg_len, flags, 14049 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14050 #endif /* DEBUG */ 14051 } else { 14052 /* Data left until we hit mark */ 14053 #ifdef DEBUG 14054 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14055 "tcp_rput: URP %d bytes left, %s", 14056 urp - seg_len, tcp_display(tcp, NULL, 14057 DISP_PORT_ONLY)); 14058 #endif /* DEBUG */ 14059 } 14060 } 14061 14062 process_ack: 14063 if (!(flags & TH_ACK)) { 14064 freemsg(mp); 14065 goto xmit_check; 14066 } 14067 } 14068 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 14069 14070 if (tcp->tcp_ipversion == IPV6_VERSION && bytes_acked > 0) 14071 tcp->tcp_ip_forward_progress = B_TRUE; 14072 if (tcp->tcp_state == TCPS_SYN_RCVD) { 14073 if (tcp->tcp_conn.tcp_eager_conn_ind != NULL) { 14074 /* 3-way handshake complete - pass up the T_CONN_IND */ 14075 tcp_t *listener = tcp->tcp_listener; 14076 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 14077 14078 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 14079 /* 14080 * We are here means eager is fine but it can 14081 * get a TH_RST at any point between now and till 14082 * accept completes and disappear. We need to 14083 * ensure that reference to eager is valid after 14084 * we get out of eager's perimeter. So we do 14085 * an extra refhold. 14086 */ 14087 CONN_INC_REF(connp); 14088 14089 /* 14090 * The listener also exists because of the refhold 14091 * done in tcp_conn_request. Its possible that it 14092 * might have closed. We will check that once we 14093 * get inside listeners context. 14094 */ 14095 CONN_INC_REF(listener->tcp_connp); 14096 if (listener->tcp_connp->conn_sqp == 14097 connp->conn_sqp) { 14098 tcp_send_conn_ind(listener->tcp_connp, mp, 14099 listener->tcp_connp->conn_sqp); 14100 CONN_DEC_REF(listener->tcp_connp); 14101 } else if (!tcp->tcp_loopback) { 14102 squeue_fill(listener->tcp_connp->conn_sqp, mp, 14103 tcp_send_conn_ind, 14104 listener->tcp_connp, SQTAG_TCP_CONN_IND); 14105 } else { 14106 squeue_enter(listener->tcp_connp->conn_sqp, mp, 14107 tcp_send_conn_ind, listener->tcp_connp, 14108 SQTAG_TCP_CONN_IND); 14109 } 14110 } 14111 14112 if (tcp->tcp_active_open) { 14113 /* 14114 * We are seeing the final ack in the three way 14115 * hand shake of a active open'ed connection 14116 * so we must send up a T_CONN_CON 14117 */ 14118 if (!tcp_conn_con(tcp, iphdr, tcph, mp, NULL)) { 14119 freemsg(mp); 14120 return; 14121 } 14122 /* 14123 * Don't fuse the loopback endpoints for 14124 * simultaneous active opens. 14125 */ 14126 if (tcp->tcp_loopback) { 14127 TCP_STAT(tcp_fusion_unfusable); 14128 tcp->tcp_unfusable = B_TRUE; 14129 } 14130 } 14131 14132 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 14133 bytes_acked--; 14134 /* SYN was acked - making progress */ 14135 if (tcp->tcp_ipversion == IPV6_VERSION) 14136 tcp->tcp_ip_forward_progress = B_TRUE; 14137 14138 /* 14139 * If SYN was retransmitted, need to reset all 14140 * retransmission info as this segment will be 14141 * treated as a dup ACK. 14142 */ 14143 if (tcp->tcp_rexmit) { 14144 tcp->tcp_rexmit = B_FALSE; 14145 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 14146 tcp->tcp_rexmit_max = tcp->tcp_snxt; 14147 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14148 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14149 tcp->tcp_ms_we_have_waited = 0; 14150 tcp->tcp_cwnd = mss; 14151 } 14152 14153 /* 14154 * We set the send window to zero here. 14155 * This is needed if there is data to be 14156 * processed already on the queue. 14157 * Later (at swnd_update label), the 14158 * "new_swnd > tcp_swnd" condition is satisfied 14159 * the XMIT_NEEDED flag is set in the current 14160 * (SYN_RCVD) state. This ensures tcp_wput_data() is 14161 * called if there is already data on queue in 14162 * this state. 14163 */ 14164 tcp->tcp_swnd = 0; 14165 14166 if (new_swnd > tcp->tcp_max_swnd) 14167 tcp->tcp_max_swnd = new_swnd; 14168 tcp->tcp_swl1 = seg_seq; 14169 tcp->tcp_swl2 = seg_ack; 14170 tcp->tcp_state = TCPS_ESTABLISHED; 14171 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 14172 14173 /* Fuse when both sides are in ESTABLISHED state */ 14174 if (tcp->tcp_loopback && do_tcp_fusion) 14175 tcp_fuse(tcp, iphdr, tcph); 14176 14177 } 14178 /* This code follows 4.4BSD-Lite2 mostly. */ 14179 if (bytes_acked < 0) 14180 goto est; 14181 14182 /* 14183 * If TCP is ECN capable and the congestion experience bit is 14184 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 14185 * done once per window (or more loosely, per RTT). 14186 */ 14187 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 14188 tcp->tcp_cwr = B_FALSE; 14189 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 14190 if (!tcp->tcp_cwr) { 14191 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 14192 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 14193 tcp->tcp_cwnd = npkt * mss; 14194 /* 14195 * If the cwnd is 0, use the timer to clock out 14196 * new segments. This is required by the ECN spec. 14197 */ 14198 if (npkt == 0) { 14199 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14200 /* 14201 * This makes sure that when the ACK comes 14202 * back, we will increase tcp_cwnd by 1 MSS. 14203 */ 14204 tcp->tcp_cwnd_cnt = 0; 14205 } 14206 tcp->tcp_cwr = B_TRUE; 14207 /* 14208 * This marks the end of the current window of in 14209 * flight data. That is why we don't use 14210 * tcp_suna + tcp_swnd. Only data in flight can 14211 * provide ECN info. 14212 */ 14213 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 14214 tcp->tcp_ecn_cwr_sent = B_FALSE; 14215 } 14216 } 14217 14218 mp1 = tcp->tcp_xmit_head; 14219 if (bytes_acked == 0) { 14220 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 14221 int dupack_cnt; 14222 14223 BUMP_MIB(&tcp_mib, tcpInDupAck); 14224 /* 14225 * Fast retransmit. When we have seen exactly three 14226 * identical ACKs while we have unacked data 14227 * outstanding we take it as a hint that our peer 14228 * dropped something. 14229 * 14230 * If TCP is retransmitting, don't do fast retransmit. 14231 */ 14232 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 14233 ! tcp->tcp_rexmit) { 14234 /* Do Limited Transmit */ 14235 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 14236 tcp_dupack_fast_retransmit) { 14237 /* 14238 * RFC 3042 14239 * 14240 * What we need to do is temporarily 14241 * increase tcp_cwnd so that new 14242 * data can be sent if it is allowed 14243 * by the receive window (tcp_rwnd). 14244 * tcp_wput_data() will take care of 14245 * the rest. 14246 * 14247 * If the connection is SACK capable, 14248 * only do limited xmit when there 14249 * is SACK info. 14250 * 14251 * Note how tcp_cwnd is incremented. 14252 * The first dup ACK will increase 14253 * it by 1 MSS. The second dup ACK 14254 * will increase it by 2 MSS. This 14255 * means that only 1 new segment will 14256 * be sent for each dup ACK. 14257 */ 14258 if (tcp->tcp_unsent > 0 && 14259 (!tcp->tcp_snd_sack_ok || 14260 (tcp->tcp_snd_sack_ok && 14261 tcp->tcp_notsack_list != NULL))) { 14262 tcp->tcp_cwnd += mss << 14263 (tcp->tcp_dupack_cnt - 1); 14264 flags |= TH_LIMIT_XMIT; 14265 } 14266 } else if (dupack_cnt == 14267 tcp_dupack_fast_retransmit) { 14268 14269 /* 14270 * If we have reduced tcp_ssthresh 14271 * because of ECN, do not reduce it again 14272 * unless it is already one window of data 14273 * away. After one window of data, tcp_cwr 14274 * should then be cleared. Note that 14275 * for non ECN capable connection, tcp_cwr 14276 * should always be false. 14277 * 14278 * Adjust cwnd since the duplicate 14279 * ack indicates that a packet was 14280 * dropped (due to congestion.) 14281 */ 14282 if (!tcp->tcp_cwr) { 14283 npkt = ((tcp->tcp_snxt - 14284 tcp->tcp_suna) >> 1) / mss; 14285 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 14286 mss; 14287 tcp->tcp_cwnd = (npkt + 14288 tcp->tcp_dupack_cnt) * mss; 14289 } 14290 if (tcp->tcp_ecn_ok) { 14291 tcp->tcp_cwr = B_TRUE; 14292 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 14293 tcp->tcp_ecn_cwr_sent = B_FALSE; 14294 } 14295 14296 /* 14297 * We do Hoe's algorithm. Refer to her 14298 * paper "Improving the Start-up Behavior 14299 * of a Congestion Control Scheme for TCP," 14300 * appeared in SIGCOMM'96. 14301 * 14302 * Save highest seq no we have sent so far. 14303 * Be careful about the invisible FIN byte. 14304 */ 14305 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 14306 (tcp->tcp_unsent == 0)) { 14307 tcp->tcp_rexmit_max = tcp->tcp_fss; 14308 } else { 14309 tcp->tcp_rexmit_max = tcp->tcp_snxt; 14310 } 14311 14312 /* 14313 * Do not allow bursty traffic during. 14314 * fast recovery. Refer to Fall and Floyd's 14315 * paper "Simulation-based Comparisons of 14316 * Tahoe, Reno and SACK TCP" (in CCR?) 14317 * This is a best current practise. 14318 */ 14319 tcp->tcp_snd_burst = TCP_CWND_SS; 14320 14321 /* 14322 * For SACK: 14323 * Calculate tcp_pipe, which is the 14324 * estimated number of bytes in 14325 * network. 14326 * 14327 * tcp_fack is the highest sack'ed seq num 14328 * TCP has received. 14329 * 14330 * tcp_pipe is explained in the above quoted 14331 * Fall and Floyd's paper. tcp_fack is 14332 * explained in Mathis and Mahdavi's 14333 * "Forward Acknowledgment: Refining TCP 14334 * Congestion Control" in SIGCOMM '96. 14335 */ 14336 if (tcp->tcp_snd_sack_ok) { 14337 ASSERT(tcp->tcp_sack_info != NULL); 14338 if (tcp->tcp_notsack_list != NULL) { 14339 tcp->tcp_pipe = tcp->tcp_snxt - 14340 tcp->tcp_fack; 14341 tcp->tcp_sack_snxt = seg_ack; 14342 flags |= TH_NEED_SACK_REXMIT; 14343 } else { 14344 /* 14345 * Always initialize tcp_pipe 14346 * even though we don't have 14347 * any SACK info. If later 14348 * we get SACK info and 14349 * tcp_pipe is not initialized, 14350 * funny things will happen. 14351 */ 14352 tcp->tcp_pipe = 14353 tcp->tcp_cwnd_ssthresh; 14354 } 14355 } else { 14356 flags |= TH_REXMIT_NEEDED; 14357 } /* tcp_snd_sack_ok */ 14358 14359 } else { 14360 /* 14361 * Here we perform congestion 14362 * avoidance, but NOT slow start. 14363 * This is known as the Fast 14364 * Recovery Algorithm. 14365 */ 14366 if (tcp->tcp_snd_sack_ok && 14367 tcp->tcp_notsack_list != NULL) { 14368 flags |= TH_NEED_SACK_REXMIT; 14369 tcp->tcp_pipe -= mss; 14370 if (tcp->tcp_pipe < 0) 14371 tcp->tcp_pipe = 0; 14372 } else { 14373 /* 14374 * We know that one more packet has 14375 * left the pipe thus we can update 14376 * cwnd. 14377 */ 14378 cwnd = tcp->tcp_cwnd + mss; 14379 if (cwnd > tcp->tcp_cwnd_max) 14380 cwnd = tcp->tcp_cwnd_max; 14381 tcp->tcp_cwnd = cwnd; 14382 if (tcp->tcp_unsent > 0) 14383 flags |= TH_XMIT_NEEDED; 14384 } 14385 } 14386 } 14387 } else if (tcp->tcp_zero_win_probe) { 14388 /* 14389 * If the window has opened, need to arrange 14390 * to send additional data. 14391 */ 14392 if (new_swnd != 0) { 14393 /* tcp_suna != tcp_snxt */ 14394 /* Packet contains a window update */ 14395 BUMP_MIB(&tcp_mib, tcpInWinUpdate); 14396 tcp->tcp_zero_win_probe = 0; 14397 tcp->tcp_timer_backoff = 0; 14398 tcp->tcp_ms_we_have_waited = 0; 14399 14400 /* 14401 * Transmit starting with tcp_suna since 14402 * the one byte probe is not ack'ed. 14403 * If TCP has sent more than one identical 14404 * probe, tcp_rexmit will be set. That means 14405 * tcp_ss_rexmit() will send out the one 14406 * byte along with new data. Otherwise, 14407 * fake the retransmission. 14408 */ 14409 flags |= TH_XMIT_NEEDED; 14410 if (!tcp->tcp_rexmit) { 14411 tcp->tcp_rexmit = B_TRUE; 14412 tcp->tcp_dupack_cnt = 0; 14413 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 14414 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 14415 } 14416 } 14417 } 14418 goto swnd_update; 14419 } 14420 14421 /* 14422 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 14423 * If the ACK value acks something that we have not yet sent, it might 14424 * be an old duplicate segment. Send an ACK to re-synchronize the 14425 * other side. 14426 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 14427 * state is handled above, so we can always just drop the segment and 14428 * send an ACK here. 14429 * 14430 * Should we send ACKs in response to ACK only segments? 14431 */ 14432 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 14433 BUMP_MIB(&tcp_mib, tcpInAckUnsent); 14434 /* drop the received segment */ 14435 freemsg(mp); 14436 14437 /* 14438 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 14439 * greater than 0, check if the number of such 14440 * bogus ACks is greater than that count. If yes, 14441 * don't send back any ACK. This prevents TCP from 14442 * getting into an ACK storm if somehow an attacker 14443 * successfully spoofs an acceptable segment to our 14444 * peer. 14445 */ 14446 if (tcp_drop_ack_unsent_cnt > 0 && 14447 ++tcp->tcp_in_ack_unsent > tcp_drop_ack_unsent_cnt) { 14448 TCP_STAT(tcp_in_ack_unsent_drop); 14449 return; 14450 } 14451 mp = tcp_ack_mp(tcp); 14452 if (mp != NULL) { 14453 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 14454 BUMP_LOCAL(tcp->tcp_obsegs); 14455 BUMP_MIB(&tcp_mib, tcpOutAck); 14456 tcp_send_data(tcp, tcp->tcp_wq, mp); 14457 } 14458 return; 14459 } 14460 14461 /* 14462 * TCP gets a new ACK, update the notsack'ed list to delete those 14463 * blocks that are covered by this ACK. 14464 */ 14465 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 14466 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 14467 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 14468 } 14469 14470 /* 14471 * If we got an ACK after fast retransmit, check to see 14472 * if it is a partial ACK. If it is not and the congestion 14473 * window was inflated to account for the other side's 14474 * cached packets, retract it. If it is, do Hoe's algorithm. 14475 */ 14476 if (tcp->tcp_dupack_cnt >= tcp_dupack_fast_retransmit) { 14477 ASSERT(tcp->tcp_rexmit == B_FALSE); 14478 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 14479 tcp->tcp_dupack_cnt = 0; 14480 /* 14481 * Restore the orig tcp_cwnd_ssthresh after 14482 * fast retransmit phase. 14483 */ 14484 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 14485 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 14486 } 14487 tcp->tcp_rexmit_max = seg_ack; 14488 tcp->tcp_cwnd_cnt = 0; 14489 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14490 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14491 14492 /* 14493 * Remove all notsack info to avoid confusion with 14494 * the next fast retrasnmit/recovery phase. 14495 */ 14496 if (tcp->tcp_snd_sack_ok && 14497 tcp->tcp_notsack_list != NULL) { 14498 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 14499 } 14500 } else { 14501 if (tcp->tcp_snd_sack_ok && 14502 tcp->tcp_notsack_list != NULL) { 14503 flags |= TH_NEED_SACK_REXMIT; 14504 tcp->tcp_pipe -= mss; 14505 if (tcp->tcp_pipe < 0) 14506 tcp->tcp_pipe = 0; 14507 } else { 14508 /* 14509 * Hoe's algorithm: 14510 * 14511 * Retransmit the unack'ed segment and 14512 * restart fast recovery. Note that we 14513 * need to scale back tcp_cwnd to the 14514 * original value when we started fast 14515 * recovery. This is to prevent overly 14516 * aggressive behaviour in sending new 14517 * segments. 14518 */ 14519 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 14520 tcp_dupack_fast_retransmit * mss; 14521 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 14522 flags |= TH_REXMIT_NEEDED; 14523 } 14524 } 14525 } else { 14526 tcp->tcp_dupack_cnt = 0; 14527 if (tcp->tcp_rexmit) { 14528 /* 14529 * TCP is retranmitting. If the ACK ack's all 14530 * outstanding data, update tcp_rexmit_max and 14531 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 14532 * to the correct value. 14533 * 14534 * Note that SEQ_LEQ() is used. This is to avoid 14535 * unnecessary fast retransmit caused by dup ACKs 14536 * received when TCP does slow start retransmission 14537 * after a time out. During this phase, TCP may 14538 * send out segments which are already received. 14539 * This causes dup ACKs to be sent back. 14540 */ 14541 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 14542 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 14543 tcp->tcp_rexmit_nxt = seg_ack; 14544 } 14545 if (seg_ack != tcp->tcp_rexmit_max) { 14546 flags |= TH_XMIT_NEEDED; 14547 } 14548 } else { 14549 tcp->tcp_rexmit = B_FALSE; 14550 tcp->tcp_xmit_zc_clean = B_FALSE; 14551 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 14552 tcp->tcp_snd_burst = tcp->tcp_localnet ? 14553 TCP_CWND_INFINITE : TCP_CWND_NORMAL; 14554 } 14555 tcp->tcp_ms_we_have_waited = 0; 14556 } 14557 } 14558 14559 BUMP_MIB(&tcp_mib, tcpInAckSegs); 14560 UPDATE_MIB(&tcp_mib, tcpInAckBytes, bytes_acked); 14561 tcp->tcp_suna = seg_ack; 14562 if (tcp->tcp_zero_win_probe != 0) { 14563 tcp->tcp_zero_win_probe = 0; 14564 tcp->tcp_timer_backoff = 0; 14565 } 14566 14567 /* 14568 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 14569 * Note that it cannot be the SYN being ack'ed. The code flow 14570 * will not reach here. 14571 */ 14572 if (mp1 == NULL) { 14573 goto fin_acked; 14574 } 14575 14576 /* 14577 * Update the congestion window. 14578 * 14579 * If TCP is not ECN capable or TCP is ECN capable but the 14580 * congestion experience bit is not set, increase the tcp_cwnd as 14581 * usual. 14582 */ 14583 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 14584 cwnd = tcp->tcp_cwnd; 14585 add = mss; 14586 14587 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 14588 /* 14589 * This is to prevent an increase of less than 1 MSS of 14590 * tcp_cwnd. With partial increase, tcp_wput_data() 14591 * may send out tinygrams in order to preserve mblk 14592 * boundaries. 14593 * 14594 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 14595 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 14596 * increased by 1 MSS for every RTTs. 14597 */ 14598 if (tcp->tcp_cwnd_cnt <= 0) { 14599 tcp->tcp_cwnd_cnt = cwnd + add; 14600 } else { 14601 tcp->tcp_cwnd_cnt -= add; 14602 add = 0; 14603 } 14604 } 14605 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 14606 } 14607 14608 /* See if the latest urgent data has been acknowledged */ 14609 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 14610 SEQ_GT(seg_ack, tcp->tcp_urg)) 14611 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 14612 14613 /* Can we update the RTT estimates? */ 14614 if (tcp->tcp_snd_ts_ok) { 14615 /* Ignore zero timestamp echo-reply. */ 14616 if (tcpopt.tcp_opt_ts_ecr != 0) { 14617 tcp_set_rto(tcp, (int32_t)lbolt - 14618 (int32_t)tcpopt.tcp_opt_ts_ecr); 14619 } 14620 14621 /* If needed, restart the timer. */ 14622 if (tcp->tcp_set_timer == 1) { 14623 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14624 tcp->tcp_set_timer = 0; 14625 } 14626 /* 14627 * Update tcp_csuna in case the other side stops sending 14628 * us timestamps. 14629 */ 14630 tcp->tcp_csuna = tcp->tcp_snxt; 14631 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 14632 /* 14633 * An ACK sequence we haven't seen before, so get the RTT 14634 * and update the RTO. But first check if the timestamp is 14635 * valid to use. 14636 */ 14637 if ((mp1->b_next != NULL) && 14638 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) 14639 tcp_set_rto(tcp, (int32_t)lbolt - 14640 (int32_t)(intptr_t)mp1->b_prev); 14641 else 14642 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14643 14644 /* Remeber the last sequence to be ACKed */ 14645 tcp->tcp_csuna = seg_ack; 14646 if (tcp->tcp_set_timer == 1) { 14647 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 14648 tcp->tcp_set_timer = 0; 14649 } 14650 } else { 14651 BUMP_MIB(&tcp_mib, tcpRttNoUpdate); 14652 } 14653 14654 /* Eat acknowledged bytes off the xmit queue. */ 14655 for (;;) { 14656 mblk_t *mp2; 14657 uchar_t *wptr; 14658 14659 wptr = mp1->b_wptr; 14660 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 14661 bytes_acked -= (int)(wptr - mp1->b_rptr); 14662 if (bytes_acked < 0) { 14663 mp1->b_rptr = wptr + bytes_acked; 14664 /* 14665 * Set a new timestamp if all the bytes timed by the 14666 * old timestamp have been ack'ed. 14667 */ 14668 if (SEQ_GT(seg_ack, 14669 (uint32_t)(uintptr_t)(mp1->b_next))) { 14670 mp1->b_prev = (mblk_t *)(uintptr_t)lbolt; 14671 mp1->b_next = NULL; 14672 } 14673 break; 14674 } 14675 mp1->b_next = NULL; 14676 mp1->b_prev = NULL; 14677 mp2 = mp1; 14678 mp1 = mp1->b_cont; 14679 14680 /* 14681 * This notification is required for some zero-copy 14682 * clients to maintain a copy semantic. After the data 14683 * is ack'ed, client is safe to modify or reuse the buffer. 14684 */ 14685 if (tcp->tcp_snd_zcopy_aware && 14686 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 14687 tcp_zcopy_notify(tcp); 14688 freeb(mp2); 14689 if (bytes_acked == 0) { 14690 if (mp1 == NULL) { 14691 /* Everything is ack'ed, clear the tail. */ 14692 tcp->tcp_xmit_tail = NULL; 14693 /* 14694 * Cancel the timer unless we are still 14695 * waiting for an ACK for the FIN packet. 14696 */ 14697 if (tcp->tcp_timer_tid != 0 && 14698 tcp->tcp_snxt == tcp->tcp_suna) { 14699 (void) TCP_TIMER_CANCEL(tcp, 14700 tcp->tcp_timer_tid); 14701 tcp->tcp_timer_tid = 0; 14702 } 14703 goto pre_swnd_update; 14704 } 14705 if (mp2 != tcp->tcp_xmit_tail) 14706 break; 14707 tcp->tcp_xmit_tail = mp1; 14708 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 14709 (uintptr_t)INT_MAX); 14710 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 14711 mp1->b_rptr); 14712 break; 14713 } 14714 if (mp1 == NULL) { 14715 /* 14716 * More was acked but there is nothing more 14717 * outstanding. This means that the FIN was 14718 * just acked or that we're talking to a clown. 14719 */ 14720 fin_acked: 14721 ASSERT(tcp->tcp_fin_sent); 14722 tcp->tcp_xmit_tail = NULL; 14723 if (tcp->tcp_fin_sent) { 14724 /* FIN was acked - making progress */ 14725 if (tcp->tcp_ipversion == IPV6_VERSION && 14726 !tcp->tcp_fin_acked) 14727 tcp->tcp_ip_forward_progress = B_TRUE; 14728 tcp->tcp_fin_acked = B_TRUE; 14729 if (tcp->tcp_linger_tid != 0 && 14730 TCP_TIMER_CANCEL(tcp, 14731 tcp->tcp_linger_tid) >= 0) { 14732 tcp_stop_lingering(tcp); 14733 } 14734 } else { 14735 /* 14736 * We should never get here because 14737 * we have already checked that the 14738 * number of bytes ack'ed should be 14739 * smaller than or equal to what we 14740 * have sent so far (it is the 14741 * acceptability check of the ACK). 14742 * We can only get here if the send 14743 * queue is corrupted. 14744 * 14745 * Terminate the connection and 14746 * panic the system. It is better 14747 * for us to panic instead of 14748 * continuing to avoid other disaster. 14749 */ 14750 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 14751 tcp->tcp_rnxt, TH_RST|TH_ACK); 14752 panic("Memory corruption " 14753 "detected for connection %s.", 14754 tcp_display(tcp, NULL, 14755 DISP_ADDR_AND_PORT)); 14756 /*NOTREACHED*/ 14757 } 14758 goto pre_swnd_update; 14759 } 14760 ASSERT(mp2 != tcp->tcp_xmit_tail); 14761 } 14762 if (tcp->tcp_unsent) { 14763 flags |= TH_XMIT_NEEDED; 14764 } 14765 pre_swnd_update: 14766 tcp->tcp_xmit_head = mp1; 14767 swnd_update: 14768 /* 14769 * The following check is different from most other implementations. 14770 * For bi-directional transfer, when segments are dropped, the 14771 * "normal" check will not accept a window update in those 14772 * retransmitted segemnts. Failing to do that, TCP may send out 14773 * segments which are outside receiver's window. As TCP accepts 14774 * the ack in those retransmitted segments, if the window update in 14775 * the same segment is not accepted, TCP will incorrectly calculates 14776 * that it can send more segments. This can create a deadlock 14777 * with the receiver if its window becomes zero. 14778 */ 14779 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 14780 SEQ_LT(tcp->tcp_swl1, seg_seq) || 14781 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 14782 /* 14783 * The criteria for update is: 14784 * 14785 * 1. the segment acknowledges some data. Or 14786 * 2. the segment is new, i.e. it has a higher seq num. Or 14787 * 3. the segment is not old and the advertised window is 14788 * larger than the previous advertised window. 14789 */ 14790 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 14791 flags |= TH_XMIT_NEEDED; 14792 tcp->tcp_swnd = new_swnd; 14793 if (new_swnd > tcp->tcp_max_swnd) 14794 tcp->tcp_max_swnd = new_swnd; 14795 tcp->tcp_swl1 = seg_seq; 14796 tcp->tcp_swl2 = seg_ack; 14797 } 14798 est: 14799 if (tcp->tcp_state > TCPS_ESTABLISHED) { 14800 switch (tcp->tcp_state) { 14801 case TCPS_FIN_WAIT_1: 14802 if (tcp->tcp_fin_acked) { 14803 tcp->tcp_state = TCPS_FIN_WAIT_2; 14804 /* 14805 * We implement the non-standard BSD/SunOS 14806 * FIN_WAIT_2 flushing algorithm. 14807 * If there is no user attached to this 14808 * TCP endpoint, then this TCP struct 14809 * could hang around forever in FIN_WAIT_2 14810 * state if the peer forgets to send us 14811 * a FIN. To prevent this, we wait only 14812 * 2*MSL (a convenient time value) for 14813 * the FIN to arrive. If it doesn't show up, 14814 * we flush the TCP endpoint. This algorithm, 14815 * though a violation of RFC-793, has worked 14816 * for over 10 years in BSD systems. 14817 * Note: SunOS 4.x waits 675 seconds before 14818 * flushing the FIN_WAIT_2 connection. 14819 */ 14820 TCP_TIMER_RESTART(tcp, 14821 tcp_fin_wait_2_flush_interval); 14822 } 14823 break; 14824 case TCPS_FIN_WAIT_2: 14825 break; /* Shutdown hook? */ 14826 case TCPS_LAST_ACK: 14827 freemsg(mp); 14828 if (tcp->tcp_fin_acked) { 14829 (void) tcp_clean_death(tcp, 0, 19); 14830 return; 14831 } 14832 goto xmit_check; 14833 case TCPS_CLOSING: 14834 if (tcp->tcp_fin_acked) { 14835 tcp->tcp_state = TCPS_TIME_WAIT; 14836 if (!TCP_IS_DETACHED(tcp)) { 14837 TCP_TIMER_RESTART(tcp, 14838 tcp_time_wait_interval); 14839 } else { 14840 tcp_time_wait_append(tcp); 14841 TCP_DBGSTAT(tcp_rput_time_wait); 14842 } 14843 } 14844 /*FALLTHRU*/ 14845 case TCPS_CLOSE_WAIT: 14846 freemsg(mp); 14847 goto xmit_check; 14848 default: 14849 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 14850 break; 14851 } 14852 } 14853 if (flags & TH_FIN) { 14854 /* Make sure we ack the fin */ 14855 flags |= TH_ACK_NEEDED; 14856 if (!tcp->tcp_fin_rcvd) { 14857 tcp->tcp_fin_rcvd = B_TRUE; 14858 tcp->tcp_rnxt++; 14859 tcph = tcp->tcp_tcph; 14860 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14861 14862 /* 14863 * Generate the ordrel_ind at the end unless we 14864 * are an eager guy. 14865 * In the eager case tcp_rsrv will do this when run 14866 * after tcp_accept is done. 14867 */ 14868 if (tcp->tcp_listener == NULL && 14869 !TCP_IS_DETACHED(tcp) && (!tcp->tcp_hard_binding)) 14870 flags |= TH_ORDREL_NEEDED; 14871 switch (tcp->tcp_state) { 14872 case TCPS_SYN_RCVD: 14873 case TCPS_ESTABLISHED: 14874 tcp->tcp_state = TCPS_CLOSE_WAIT; 14875 /* Keepalive? */ 14876 break; 14877 case TCPS_FIN_WAIT_1: 14878 if (!tcp->tcp_fin_acked) { 14879 tcp->tcp_state = TCPS_CLOSING; 14880 break; 14881 } 14882 /* FALLTHRU */ 14883 case TCPS_FIN_WAIT_2: 14884 tcp->tcp_state = TCPS_TIME_WAIT; 14885 if (!TCP_IS_DETACHED(tcp)) { 14886 TCP_TIMER_RESTART(tcp, 14887 tcp_time_wait_interval); 14888 } else { 14889 tcp_time_wait_append(tcp); 14890 TCP_DBGSTAT(tcp_rput_time_wait); 14891 } 14892 if (seg_len) { 14893 /* 14894 * implies data piggybacked on FIN. 14895 * break to handle data. 14896 */ 14897 break; 14898 } 14899 freemsg(mp); 14900 goto ack_check; 14901 } 14902 } 14903 } 14904 if (mp == NULL) 14905 goto xmit_check; 14906 if (seg_len == 0) { 14907 freemsg(mp); 14908 goto xmit_check; 14909 } 14910 if (mp->b_rptr == mp->b_wptr) { 14911 /* 14912 * The header has been consumed, so we remove the 14913 * zero-length mblk here. 14914 */ 14915 mp1 = mp; 14916 mp = mp->b_cont; 14917 freeb(mp1); 14918 } 14919 tcph = tcp->tcp_tcph; 14920 tcp->tcp_rack_cnt++; 14921 { 14922 uint32_t cur_max; 14923 14924 cur_max = tcp->tcp_rack_cur_max; 14925 if (tcp->tcp_rack_cnt >= cur_max) { 14926 /* 14927 * We have more unacked data than we should - send 14928 * an ACK now. 14929 */ 14930 flags |= TH_ACK_NEEDED; 14931 cur_max++; 14932 if (cur_max > tcp->tcp_rack_abs_max) 14933 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 14934 else 14935 tcp->tcp_rack_cur_max = cur_max; 14936 } else if (TCP_IS_DETACHED(tcp)) { 14937 /* We don't have an ACK timer for detached TCP. */ 14938 flags |= TH_ACK_NEEDED; 14939 } else if (seg_len < mss) { 14940 /* 14941 * If we get a segment that is less than an mss, and we 14942 * already have unacknowledged data, and the amount 14943 * unacknowledged is not a multiple of mss, then we 14944 * better generate an ACK now. Otherwise, this may be 14945 * the tail piece of a transaction, and we would rather 14946 * wait for the response. 14947 */ 14948 uint32_t udif; 14949 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 14950 (uintptr_t)INT_MAX); 14951 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 14952 if (udif && (udif % mss)) 14953 flags |= TH_ACK_NEEDED; 14954 else 14955 flags |= TH_ACK_TIMER_NEEDED; 14956 } else { 14957 /* Start delayed ack timer */ 14958 flags |= TH_ACK_TIMER_NEEDED; 14959 } 14960 } 14961 tcp->tcp_rnxt += seg_len; 14962 U32_TO_ABE32(tcp->tcp_rnxt, tcph->th_ack); 14963 14964 /* Update SACK list */ 14965 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 14966 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 14967 &(tcp->tcp_num_sack_blk)); 14968 } 14969 14970 if (tcp->tcp_urp_mp) { 14971 tcp->tcp_urp_mp->b_cont = mp; 14972 mp = tcp->tcp_urp_mp; 14973 tcp->tcp_urp_mp = NULL; 14974 /* Ready for a new signal. */ 14975 tcp->tcp_urp_last_valid = B_FALSE; 14976 #ifdef DEBUG 14977 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 14978 "tcp_rput: sending exdata_ind %s", 14979 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 14980 #endif /* DEBUG */ 14981 } 14982 14983 /* 14984 * Check for ancillary data changes compared to last segment. 14985 */ 14986 if (tcp->tcp_ipv6_recvancillary != 0) { 14987 mp = tcp_rput_add_ancillary(tcp, mp, &ipp); 14988 if (mp == NULL) 14989 return; 14990 } 14991 14992 if (tcp->tcp_listener || tcp->tcp_hard_binding) { 14993 /* 14994 * Side queue inbound data until the accept happens. 14995 * tcp_accept/tcp_rput drains this when the accept happens. 14996 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 14997 * T_EXDATA_IND) it is queued on b_next. 14998 * XXX Make urgent data use this. Requires: 14999 * Removing tcp_listener check for TH_URG 15000 * Making M_PCPROTO and MARK messages skip the eager case 15001 */ 15002 tcp_rcv_enqueue(tcp, mp, seg_len); 15003 } else { 15004 if (mp->b_datap->db_type != M_DATA || 15005 (flags & TH_MARKNEXT_NEEDED)) { 15006 if (tcp->tcp_rcv_list != NULL) { 15007 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15008 } 15009 ASSERT(tcp->tcp_rcv_list == NULL || 15010 tcp->tcp_fused_sigurg); 15011 if (flags & TH_MARKNEXT_NEEDED) { 15012 #ifdef DEBUG 15013 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 15014 "tcp_rput: sending MSGMARKNEXT %s", 15015 tcp_display(tcp, NULL, 15016 DISP_PORT_ONLY)); 15017 #endif /* DEBUG */ 15018 mp->b_flag |= MSGMARKNEXT; 15019 flags &= ~TH_MARKNEXT_NEEDED; 15020 } 15021 putnext(tcp->tcp_rq, mp); 15022 if (!canputnext(tcp->tcp_rq)) 15023 tcp->tcp_rwnd -= seg_len; 15024 } else if (((flags & (TH_PUSH|TH_FIN)) || 15025 tcp->tcp_rcv_cnt + seg_len >= tcp->tcp_rq->q_hiwat >> 3) && 15026 (sqp != NULL)) { 15027 if (tcp->tcp_rcv_list != NULL) { 15028 /* 15029 * Enqueue the new segment first and then 15030 * call tcp_rcv_drain() to send all data 15031 * up. The other way to do this is to 15032 * send all queued data up and then call 15033 * putnext() to send the new segment up. 15034 * This way can remove the else part later 15035 * on. 15036 * 15037 * We don't this to avoid one more call to 15038 * canputnext() as tcp_rcv_drain() needs to 15039 * call canputnext(). 15040 */ 15041 tcp_rcv_enqueue(tcp, mp, seg_len); 15042 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15043 } else { 15044 putnext(tcp->tcp_rq, mp); 15045 if (!canputnext(tcp->tcp_rq)) 15046 tcp->tcp_rwnd -= seg_len; 15047 } 15048 } else { 15049 /* 15050 * Enqueue all packets when processing an mblk 15051 * from the co queue and also enqueue normal packets. 15052 */ 15053 tcp_rcv_enqueue(tcp, mp, seg_len); 15054 } 15055 /* 15056 * Make sure the timer is running if we have data waiting 15057 * for a push bit. This provides resiliency against 15058 * implementations that do not correctly generate push bits. 15059 */ 15060 if ((sqp != NULL) && tcp->tcp_rcv_list != NULL && 15061 tcp->tcp_push_tid == 0) { 15062 /* 15063 * The connection may be closed at this point, so don't 15064 * do anything for a detached tcp. 15065 */ 15066 if (!TCP_IS_DETACHED(tcp)) 15067 tcp->tcp_push_tid = TCP_TIMER(tcp, 15068 tcp_push_timer, 15069 MSEC_TO_TICK(tcp_push_timer_interval)); 15070 } 15071 } 15072 xmit_check: 15073 /* Is there anything left to do? */ 15074 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 15075 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 15076 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 15077 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 15078 goto done; 15079 15080 /* Any transmit work to do and a non-zero window? */ 15081 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 15082 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 15083 if (flags & TH_REXMIT_NEEDED) { 15084 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 15085 15086 BUMP_MIB(&tcp_mib, tcpOutFastRetrans); 15087 if (snd_size > mss) 15088 snd_size = mss; 15089 if (snd_size > tcp->tcp_swnd) 15090 snd_size = tcp->tcp_swnd; 15091 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 15092 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 15093 B_TRUE); 15094 15095 if (mp1 != NULL) { 15096 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 15097 tcp->tcp_csuna = tcp->tcp_snxt; 15098 BUMP_MIB(&tcp_mib, tcpRetransSegs); 15099 UPDATE_MIB(&tcp_mib, tcpRetransBytes, snd_size); 15100 TCP_RECORD_TRACE(tcp, mp1, 15101 TCP_TRACE_SEND_PKT); 15102 tcp_send_data(tcp, tcp->tcp_wq, mp1); 15103 } 15104 } 15105 if (flags & TH_NEED_SACK_REXMIT) { 15106 tcp_sack_rxmit(tcp, &flags); 15107 } 15108 /* 15109 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 15110 * out new segment. Note that tcp_rexmit should not be 15111 * set, otherwise TH_LIMIT_XMIT should not be set. 15112 */ 15113 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 15114 if (!tcp->tcp_rexmit) { 15115 tcp_wput_data(tcp, NULL, B_FALSE); 15116 } else { 15117 tcp_ss_rexmit(tcp); 15118 } 15119 } 15120 /* 15121 * Adjust tcp_cwnd back to normal value after sending 15122 * new data segments. 15123 */ 15124 if (flags & TH_LIMIT_XMIT) { 15125 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 15126 /* 15127 * This will restart the timer. Restarting the 15128 * timer is used to avoid a timeout before the 15129 * limited transmitted segment's ACK gets back. 15130 */ 15131 if (tcp->tcp_xmit_head != NULL) 15132 tcp->tcp_xmit_head->b_prev = (mblk_t *)lbolt; 15133 } 15134 15135 /* Anything more to do? */ 15136 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 15137 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 15138 goto done; 15139 } 15140 ack_check: 15141 if (flags & TH_SEND_URP_MARK) { 15142 ASSERT(tcp->tcp_urp_mark_mp); 15143 /* 15144 * Send up any queued data and then send the mark message 15145 */ 15146 if (tcp->tcp_rcv_list != NULL) { 15147 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15148 } 15149 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 15150 15151 mp1 = tcp->tcp_urp_mark_mp; 15152 tcp->tcp_urp_mark_mp = NULL; 15153 #ifdef DEBUG 15154 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 15155 "tcp_rput: sending zero-length %s %s", 15156 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 15157 "MSGNOTMARKNEXT"), 15158 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 15159 #endif /* DEBUG */ 15160 putnext(tcp->tcp_rq, mp1); 15161 flags &= ~TH_SEND_URP_MARK; 15162 } 15163 if (flags & TH_ACK_NEEDED) { 15164 /* 15165 * Time to send an ack for some reason. 15166 */ 15167 mp1 = tcp_ack_mp(tcp); 15168 15169 if (mp1 != NULL) { 15170 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 15171 tcp_send_data(tcp, tcp->tcp_wq, mp1); 15172 BUMP_LOCAL(tcp->tcp_obsegs); 15173 BUMP_MIB(&tcp_mib, tcpOutAck); 15174 } 15175 if (tcp->tcp_ack_tid != 0) { 15176 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 15177 tcp->tcp_ack_tid = 0; 15178 } 15179 } 15180 if (flags & TH_ACK_TIMER_NEEDED) { 15181 /* 15182 * Arrange for deferred ACK or push wait timeout. 15183 * Start timer if it is not already running. 15184 */ 15185 if (tcp->tcp_ack_tid == 0) { 15186 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 15187 MSEC_TO_TICK(tcp->tcp_localnet ? 15188 (clock_t)tcp_local_dack_interval : 15189 (clock_t)tcp_deferred_ack_interval)); 15190 } 15191 } 15192 if (flags & TH_ORDREL_NEEDED) { 15193 /* 15194 * Send up the ordrel_ind unless we are an eager guy. 15195 * In the eager case tcp_rsrv will do this when run 15196 * after tcp_accept is done. 15197 */ 15198 ASSERT(tcp->tcp_listener == NULL); 15199 if (tcp->tcp_rcv_list != NULL) { 15200 /* 15201 * Push any mblk(s) enqueued from co processing. 15202 */ 15203 flags |= tcp_rcv_drain(tcp->tcp_rq, tcp); 15204 } 15205 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 15206 if ((mp1 = mi_tpi_ordrel_ind()) != NULL) { 15207 tcp->tcp_ordrel_done = B_TRUE; 15208 putnext(tcp->tcp_rq, mp1); 15209 if (tcp->tcp_deferred_clean_death) { 15210 /* 15211 * tcp_clean_death was deferred 15212 * for T_ORDREL_IND - do it now 15213 */ 15214 (void) tcp_clean_death(tcp, 15215 tcp->tcp_client_errno, 20); 15216 tcp->tcp_deferred_clean_death = B_FALSE; 15217 } 15218 } else { 15219 /* 15220 * Run the orderly release in the 15221 * service routine. 15222 */ 15223 qenable(tcp->tcp_rq); 15224 /* 15225 * Caveat(XXX): The machine may be so 15226 * overloaded that tcp_rsrv() is not scheduled 15227 * until after the endpoint has transitioned 15228 * to TCPS_TIME_WAIT 15229 * and tcp_time_wait_interval expires. Then 15230 * tcp_timer() will blow away state in tcp_t 15231 * and T_ORDREL_IND will never be delivered 15232 * upstream. Unlikely but potentially 15233 * a problem. 15234 */ 15235 } 15236 } 15237 done: 15238 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 15239 } 15240 15241 /* 15242 * This function does PAWS protection check. Returns B_TRUE if the 15243 * segment passes the PAWS test, else returns B_FALSE. 15244 */ 15245 boolean_t 15246 tcp_paws_check(tcp_t *tcp, tcph_t *tcph, tcp_opt_t *tcpoptp) 15247 { 15248 uint8_t flags; 15249 int options; 15250 uint8_t *up; 15251 15252 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 15253 /* 15254 * If timestamp option is aligned nicely, get values inline, 15255 * otherwise call general routine to parse. Only do that 15256 * if timestamp is the only option. 15257 */ 15258 if (TCP_HDR_LENGTH(tcph) == (uint32_t)TCP_MIN_HEADER_LENGTH + 15259 TCPOPT_REAL_TS_LEN && 15260 OK_32PTR((up = ((uint8_t *)tcph) + 15261 TCP_MIN_HEADER_LENGTH)) && 15262 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 15263 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 15264 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 15265 15266 options = TCP_OPT_TSTAMP_PRESENT; 15267 } else { 15268 if (tcp->tcp_snd_sack_ok) { 15269 tcpoptp->tcp = tcp; 15270 } else { 15271 tcpoptp->tcp = NULL; 15272 } 15273 options = tcp_parse_options(tcph, tcpoptp); 15274 } 15275 15276 if (options & TCP_OPT_TSTAMP_PRESENT) { 15277 /* 15278 * Do PAWS per RFC 1323 section 4.2. Accept RST 15279 * regardless of the timestamp, page 18 RFC 1323.bis. 15280 */ 15281 if ((flags & TH_RST) == 0 && 15282 TSTMP_LT(tcpoptp->tcp_opt_ts_val, 15283 tcp->tcp_ts_recent)) { 15284 if (TSTMP_LT(lbolt64, tcp->tcp_last_rcv_lbolt + 15285 PAWS_TIMEOUT)) { 15286 /* This segment is not acceptable. */ 15287 return (B_FALSE); 15288 } else { 15289 /* 15290 * Connection has been idle for 15291 * too long. Reset the timestamp 15292 * and assume the segment is valid. 15293 */ 15294 tcp->tcp_ts_recent = 15295 tcpoptp->tcp_opt_ts_val; 15296 } 15297 } 15298 } else { 15299 /* 15300 * If we don't get a timestamp on every packet, we 15301 * figure we can't really trust 'em, so we stop sending 15302 * and parsing them. 15303 */ 15304 tcp->tcp_snd_ts_ok = B_FALSE; 15305 15306 tcp->tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 15307 tcp->tcp_tcp_hdr_len -= TCPOPT_REAL_TS_LEN; 15308 tcp->tcp_tcph->th_offset_and_rsrvd[0] -= (3 << 4); 15309 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN); 15310 if (tcp->tcp_snd_sack_ok) { 15311 ASSERT(tcp->tcp_sack_info != NULL); 15312 tcp->tcp_max_sack_blk = 4; 15313 } 15314 } 15315 return (B_TRUE); 15316 } 15317 15318 /* 15319 * Attach ancillary data to a received TCP segments for the 15320 * ancillary pieces requested by the application that are 15321 * different than they were in the previous data segment. 15322 * 15323 * Save the "current" values once memory allocation is ok so that 15324 * when memory allocation fails we can just wait for the next data segment. 15325 */ 15326 static mblk_t * 15327 tcp_rput_add_ancillary(tcp_t *tcp, mblk_t *mp, ip6_pkt_t *ipp) 15328 { 15329 struct T_optdata_ind *todi; 15330 int optlen; 15331 uchar_t *optptr; 15332 struct T_opthdr *toh; 15333 uint_t addflag; /* Which pieces to add */ 15334 mblk_t *mp1; 15335 15336 optlen = 0; 15337 addflag = 0; 15338 /* If app asked for pktinfo and the index has changed ... */ 15339 if ((ipp->ipp_fields & IPPF_IFINDEX) && 15340 ipp->ipp_ifindex != tcp->tcp_recvifindex && 15341 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO)) { 15342 optlen += sizeof (struct T_opthdr) + 15343 sizeof (struct in6_pktinfo); 15344 addflag |= TCP_IPV6_RECVPKTINFO; 15345 } 15346 /* If app asked for hoplimit and it has changed ... */ 15347 if ((ipp->ipp_fields & IPPF_HOPLIMIT) && 15348 ipp->ipp_hoplimit != tcp->tcp_recvhops && 15349 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPLIMIT)) { 15350 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 15351 addflag |= TCP_IPV6_RECVHOPLIMIT; 15352 } 15353 /* If app asked for tclass and it has changed ... */ 15354 if ((ipp->ipp_fields & IPPF_TCLASS) && 15355 ipp->ipp_tclass != tcp->tcp_recvtclass && 15356 (tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVTCLASS)) { 15357 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 15358 addflag |= TCP_IPV6_RECVTCLASS; 15359 } 15360 /* If app asked for hopbyhop headers and it has changed ... */ 15361 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVHOPOPTS) && 15362 tcp_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 15363 (ipp->ipp_fields & IPPF_HOPOPTS), 15364 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 15365 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen; 15366 addflag |= TCP_IPV6_RECVHOPOPTS; 15367 if (!tcp_allocbuf((void **)&tcp->tcp_hopopts, 15368 &tcp->tcp_hopoptslen, 15369 (ipp->ipp_fields & IPPF_HOPOPTS), 15370 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 15371 return (mp); 15372 } 15373 /* If app asked for dst headers before routing headers ... */ 15374 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTDSTOPTS) && 15375 tcp_cmpbuf(tcp->tcp_rtdstopts, tcp->tcp_rtdstoptslen, 15376 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15377 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) { 15378 optlen += sizeof (struct T_opthdr) + 15379 ipp->ipp_rtdstoptslen; 15380 addflag |= TCP_IPV6_RECVRTDSTOPTS; 15381 if (!tcp_allocbuf((void **)&tcp->tcp_rtdstopts, 15382 &tcp->tcp_rtdstoptslen, 15383 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15384 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen)) 15385 return (mp); 15386 } 15387 /* If app asked for routing headers and it has changed ... */ 15388 if ((tcp->tcp_ipv6_recvancillary & TCP_IPV6_RECVRTHDR) && 15389 tcp_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 15390 (ipp->ipp_fields & IPPF_RTHDR), 15391 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 15392 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 15393 addflag |= TCP_IPV6_RECVRTHDR; 15394 if (!tcp_allocbuf((void **)&tcp->tcp_rthdr, 15395 &tcp->tcp_rthdrlen, 15396 (ipp->ipp_fields & IPPF_RTHDR), 15397 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 15398 return (mp); 15399 } 15400 /* If app asked for dest headers and it has changed ... */ 15401 if ((tcp->tcp_ipv6_recvancillary & 15402 (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) && 15403 tcp_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 15404 (ipp->ipp_fields & IPPF_DSTOPTS), 15405 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 15406 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 15407 addflag |= TCP_IPV6_RECVDSTOPTS; 15408 if (!tcp_allocbuf((void **)&tcp->tcp_dstopts, 15409 &tcp->tcp_dstoptslen, 15410 (ipp->ipp_fields & IPPF_DSTOPTS), 15411 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 15412 return (mp); 15413 } 15414 15415 if (optlen == 0) { 15416 /* Nothing to add */ 15417 return (mp); 15418 } 15419 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 15420 if (mp1 == NULL) { 15421 /* 15422 * Defer sending ancillary data until the next TCP segment 15423 * arrives. 15424 */ 15425 return (mp); 15426 } 15427 mp1->b_cont = mp; 15428 mp = mp1; 15429 mp->b_wptr += sizeof (*todi) + optlen; 15430 mp->b_datap->db_type = M_PROTO; 15431 todi = (struct T_optdata_ind *)mp->b_rptr; 15432 todi->PRIM_type = T_OPTDATA_IND; 15433 todi->DATA_flag = 1; /* MORE data */ 15434 todi->OPT_length = optlen; 15435 todi->OPT_offset = sizeof (*todi); 15436 optptr = (uchar_t *)&todi[1]; 15437 /* 15438 * If app asked for pktinfo and the index has changed ... 15439 * Note that the local address never changes for the connection. 15440 */ 15441 if (addflag & TCP_IPV6_RECVPKTINFO) { 15442 struct in6_pktinfo *pkti; 15443 15444 toh = (struct T_opthdr *)optptr; 15445 toh->level = IPPROTO_IPV6; 15446 toh->name = IPV6_PKTINFO; 15447 toh->len = sizeof (*toh) + sizeof (*pkti); 15448 toh->status = 0; 15449 optptr += sizeof (*toh); 15450 pkti = (struct in6_pktinfo *)optptr; 15451 if (tcp->tcp_ipversion == IPV6_VERSION) 15452 pkti->ipi6_addr = tcp->tcp_ip6h->ip6_src; 15453 else 15454 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 15455 &pkti->ipi6_addr); 15456 pkti->ipi6_ifindex = ipp->ipp_ifindex; 15457 optptr += sizeof (*pkti); 15458 ASSERT(OK_32PTR(optptr)); 15459 /* Save as "last" value */ 15460 tcp->tcp_recvifindex = ipp->ipp_ifindex; 15461 } 15462 /* If app asked for hoplimit and it has changed ... */ 15463 if (addflag & TCP_IPV6_RECVHOPLIMIT) { 15464 toh = (struct T_opthdr *)optptr; 15465 toh->level = IPPROTO_IPV6; 15466 toh->name = IPV6_HOPLIMIT; 15467 toh->len = sizeof (*toh) + sizeof (uint_t); 15468 toh->status = 0; 15469 optptr += sizeof (*toh); 15470 *(uint_t *)optptr = ipp->ipp_hoplimit; 15471 optptr += sizeof (uint_t); 15472 ASSERT(OK_32PTR(optptr)); 15473 /* Save as "last" value */ 15474 tcp->tcp_recvhops = ipp->ipp_hoplimit; 15475 } 15476 /* If app asked for tclass and it has changed ... */ 15477 if (addflag & TCP_IPV6_RECVTCLASS) { 15478 toh = (struct T_opthdr *)optptr; 15479 toh->level = IPPROTO_IPV6; 15480 toh->name = IPV6_TCLASS; 15481 toh->len = sizeof (*toh) + sizeof (uint_t); 15482 toh->status = 0; 15483 optptr += sizeof (*toh); 15484 *(uint_t *)optptr = ipp->ipp_tclass; 15485 optptr += sizeof (uint_t); 15486 ASSERT(OK_32PTR(optptr)); 15487 /* Save as "last" value */ 15488 tcp->tcp_recvtclass = ipp->ipp_tclass; 15489 } 15490 if (addflag & TCP_IPV6_RECVHOPOPTS) { 15491 toh = (struct T_opthdr *)optptr; 15492 toh->level = IPPROTO_IPV6; 15493 toh->name = IPV6_HOPOPTS; 15494 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen; 15495 toh->status = 0; 15496 optptr += sizeof (*toh); 15497 bcopy(ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 15498 optptr += ipp->ipp_hopoptslen; 15499 ASSERT(OK_32PTR(optptr)); 15500 /* Save as last value */ 15501 tcp_savebuf((void **)&tcp->tcp_hopopts, 15502 &tcp->tcp_hopoptslen, 15503 (ipp->ipp_fields & IPPF_HOPOPTS), 15504 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 15505 } 15506 if (addflag & TCP_IPV6_RECVRTDSTOPTS) { 15507 toh = (struct T_opthdr *)optptr; 15508 toh->level = IPPROTO_IPV6; 15509 toh->name = IPV6_RTHDRDSTOPTS; 15510 toh->len = sizeof (*toh) + ipp->ipp_rtdstoptslen; 15511 toh->status = 0; 15512 optptr += sizeof (*toh); 15513 bcopy(ipp->ipp_rtdstopts, optptr, ipp->ipp_rtdstoptslen); 15514 optptr += ipp->ipp_rtdstoptslen; 15515 ASSERT(OK_32PTR(optptr)); 15516 /* Save as last value */ 15517 tcp_savebuf((void **)&tcp->tcp_rtdstopts, 15518 &tcp->tcp_rtdstoptslen, 15519 (ipp->ipp_fields & IPPF_RTDSTOPTS), 15520 ipp->ipp_rtdstopts, ipp->ipp_rtdstoptslen); 15521 } 15522 if (addflag & TCP_IPV6_RECVRTHDR) { 15523 toh = (struct T_opthdr *)optptr; 15524 toh->level = IPPROTO_IPV6; 15525 toh->name = IPV6_RTHDR; 15526 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 15527 toh->status = 0; 15528 optptr += sizeof (*toh); 15529 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 15530 optptr += ipp->ipp_rthdrlen; 15531 ASSERT(OK_32PTR(optptr)); 15532 /* Save as last value */ 15533 tcp_savebuf((void **)&tcp->tcp_rthdr, 15534 &tcp->tcp_rthdrlen, 15535 (ipp->ipp_fields & IPPF_RTHDR), 15536 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 15537 } 15538 if (addflag & (TCP_IPV6_RECVDSTOPTS | TCP_OLD_IPV6_RECVDSTOPTS)) { 15539 toh = (struct T_opthdr *)optptr; 15540 toh->level = IPPROTO_IPV6; 15541 toh->name = IPV6_DSTOPTS; 15542 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 15543 toh->status = 0; 15544 optptr += sizeof (*toh); 15545 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 15546 optptr += ipp->ipp_dstoptslen; 15547 ASSERT(OK_32PTR(optptr)); 15548 /* Save as last value */ 15549 tcp_savebuf((void **)&tcp->tcp_dstopts, 15550 &tcp->tcp_dstoptslen, 15551 (ipp->ipp_fields & IPPF_DSTOPTS), 15552 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 15553 } 15554 ASSERT(optptr == mp->b_wptr); 15555 return (mp); 15556 } 15557 15558 15559 /* 15560 * Handle a *T_BIND_REQ that has failed either due to a T_ERROR_ACK 15561 * or a "bad" IRE detected by tcp_adapt_ire. 15562 * We can't tell if the failure was due to the laddr or the faddr 15563 * thus we clear out all addresses and ports. 15564 */ 15565 static void 15566 tcp_bind_failed(tcp_t *tcp, mblk_t *mp, int error) 15567 { 15568 queue_t *q = tcp->tcp_rq; 15569 tcph_t *tcph; 15570 struct T_error_ack *tea; 15571 conn_t *connp = tcp->tcp_connp; 15572 15573 15574 ASSERT(mp->b_datap->db_type == M_PCPROTO); 15575 15576 if (mp->b_cont) { 15577 freemsg(mp->b_cont); 15578 mp->b_cont = NULL; 15579 } 15580 tea = (struct T_error_ack *)mp->b_rptr; 15581 switch (tea->PRIM_type) { 15582 case T_BIND_ACK: 15583 /* 15584 * Need to unbind with classifier since we were just told that 15585 * our bind succeeded. 15586 */ 15587 tcp->tcp_hard_bound = B_FALSE; 15588 tcp->tcp_hard_binding = B_FALSE; 15589 15590 ipcl_hash_remove(connp); 15591 /* Reuse the mblk if possible */ 15592 ASSERT(mp->b_datap->db_lim - mp->b_datap->db_base >= 15593 sizeof (*tea)); 15594 mp->b_rptr = mp->b_datap->db_base; 15595 mp->b_wptr = mp->b_rptr + sizeof (*tea); 15596 tea = (struct T_error_ack *)mp->b_rptr; 15597 tea->PRIM_type = T_ERROR_ACK; 15598 tea->TLI_error = TSYSERR; 15599 tea->UNIX_error = error; 15600 if (tcp->tcp_state >= TCPS_SYN_SENT) { 15601 tea->ERROR_prim = T_CONN_REQ; 15602 } else { 15603 tea->ERROR_prim = O_T_BIND_REQ; 15604 } 15605 break; 15606 15607 case T_ERROR_ACK: 15608 if (tcp->tcp_state >= TCPS_SYN_SENT) 15609 tea->ERROR_prim = T_CONN_REQ; 15610 break; 15611 default: 15612 panic("tcp_bind_failed: unexpected TPI type"); 15613 /*NOTREACHED*/ 15614 } 15615 15616 tcp->tcp_state = TCPS_IDLE; 15617 if (tcp->tcp_ipversion == IPV4_VERSION) 15618 tcp->tcp_ipha->ipha_src = 0; 15619 else 15620 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 15621 /* 15622 * Copy of the src addr. in tcp_t is needed since 15623 * the lookup funcs. can only look at tcp_t 15624 */ 15625 V6_SET_ZERO(tcp->tcp_ip_src_v6); 15626 15627 tcph = tcp->tcp_tcph; 15628 tcph->th_lport[0] = 0; 15629 tcph->th_lport[1] = 0; 15630 tcp_bind_hash_remove(tcp); 15631 bzero(&connp->u_port, sizeof (connp->u_port)); 15632 /* blow away saved option results if any */ 15633 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 15634 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 15635 15636 putnext(q, mp); 15637 } 15638 15639 /* 15640 * tcp_rput_other is called by tcp_rput to handle everything other than M_DATA 15641 * messages. 15642 */ 15643 void 15644 tcp_rput_other(tcp_t *tcp, mblk_t *mp) 15645 { 15646 mblk_t *mp1; 15647 uchar_t *rptr = mp->b_rptr; 15648 queue_t *q = tcp->tcp_rq; 15649 struct T_error_ack *tea; 15650 uint32_t mss; 15651 mblk_t *syn_mp; 15652 mblk_t *mdti; 15653 int retval; 15654 mblk_t *ire_mp; 15655 15656 switch (mp->b_datap->db_type) { 15657 case M_PROTO: 15658 case M_PCPROTO: 15659 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 15660 if ((mp->b_wptr - rptr) < sizeof (t_scalar_t)) 15661 break; 15662 tea = (struct T_error_ack *)rptr; 15663 switch (tea->PRIM_type) { 15664 case T_BIND_ACK: 15665 /* 15666 * Adapt Multidata information, if any. The 15667 * following tcp_mdt_update routine will free 15668 * the message. 15669 */ 15670 if ((mdti = tcp_mdt_info_mp(mp)) != NULL) { 15671 tcp_mdt_update(tcp, &((ip_mdt_info_t *)mdti-> 15672 b_rptr)->mdt_capab, B_TRUE); 15673 freemsg(mdti); 15674 } 15675 15676 /* Get the IRE, if we had requested for it */ 15677 ire_mp = tcp_ire_mp(mp); 15678 15679 if (tcp->tcp_hard_binding) { 15680 tcp->tcp_hard_binding = B_FALSE; 15681 tcp->tcp_hard_bound = B_TRUE; 15682 CL_INET_CONNECT(tcp); 15683 } else { 15684 if (ire_mp != NULL) 15685 freeb(ire_mp); 15686 goto after_syn_sent; 15687 } 15688 15689 retval = tcp_adapt_ire(tcp, ire_mp); 15690 if (ire_mp != NULL) 15691 freeb(ire_mp); 15692 if (retval == 0) { 15693 tcp_bind_failed(tcp, mp, 15694 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15695 ENETUNREACH : EADDRNOTAVAIL)); 15696 return; 15697 } 15698 /* 15699 * Don't let an endpoint connect to itself. 15700 * Also checked in tcp_connect() but that 15701 * check can't handle the case when the 15702 * local IP address is INADDR_ANY. 15703 */ 15704 if (tcp->tcp_ipversion == IPV4_VERSION) { 15705 if ((tcp->tcp_ipha->ipha_dst == 15706 tcp->tcp_ipha->ipha_src) && 15707 (BE16_EQL(tcp->tcp_tcph->th_lport, 15708 tcp->tcp_tcph->th_fport))) { 15709 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15710 return; 15711 } 15712 } else { 15713 if (IN6_ARE_ADDR_EQUAL( 15714 &tcp->tcp_ip6h->ip6_dst, 15715 &tcp->tcp_ip6h->ip6_src) && 15716 (BE16_EQL(tcp->tcp_tcph->th_lport, 15717 tcp->tcp_tcph->th_fport))) { 15718 tcp_bind_failed(tcp, mp, EADDRNOTAVAIL); 15719 return; 15720 } 15721 } 15722 ASSERT(tcp->tcp_state == TCPS_SYN_SENT); 15723 /* 15724 * This should not be possible! Just for 15725 * defensive coding... 15726 */ 15727 if (tcp->tcp_state != TCPS_SYN_SENT) 15728 goto after_syn_sent; 15729 15730 ASSERT(q == tcp->tcp_rq); 15731 /* 15732 * tcp_adapt_ire() does not adjust 15733 * for TCP/IP header length. 15734 */ 15735 mss = tcp->tcp_mss - tcp->tcp_hdr_len; 15736 15737 /* 15738 * Just make sure our rwnd is at 15739 * least tcp_recv_hiwat_mss * MSS 15740 * large, and round up to the nearest 15741 * MSS. 15742 * 15743 * We do the round up here because 15744 * we need to get the interface 15745 * MTU first before we can do the 15746 * round up. 15747 */ 15748 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 15749 tcp_recv_hiwat_minmss * mss); 15750 q->q_hiwat = tcp->tcp_rwnd; 15751 tcp_set_ws_value(tcp); 15752 U32_TO_ABE16((tcp->tcp_rwnd >> tcp->tcp_rcv_ws), 15753 tcp->tcp_tcph->th_win); 15754 if (tcp->tcp_rcv_ws > 0 || tcp_wscale_always) 15755 tcp->tcp_snd_ws_ok = B_TRUE; 15756 15757 /* 15758 * Set tcp_snd_ts_ok to true 15759 * so that tcp_xmit_mp will 15760 * include the timestamp 15761 * option in the SYN segment. 15762 */ 15763 if (tcp_tstamp_always || 15764 (tcp->tcp_rcv_ws && tcp_tstamp_if_wscale)) { 15765 tcp->tcp_snd_ts_ok = B_TRUE; 15766 } 15767 15768 /* 15769 * tcp_snd_sack_ok can be set in 15770 * tcp_adapt_ire() if the sack metric 15771 * is set. So check it here also. 15772 */ 15773 if (tcp_sack_permitted == 2 || 15774 tcp->tcp_snd_sack_ok) { 15775 if (tcp->tcp_sack_info == NULL) { 15776 tcp->tcp_sack_info = 15777 kmem_cache_alloc(tcp_sack_info_cache, 15778 KM_SLEEP); 15779 } 15780 tcp->tcp_snd_sack_ok = B_TRUE; 15781 } 15782 15783 /* 15784 * Should we use ECN? Note that the current 15785 * default value (SunOS 5.9) of tcp_ecn_permitted 15786 * is 1. The reason for doing this is that there 15787 * are equipments out there that will drop ECN 15788 * enabled IP packets. Setting it to 1 avoids 15789 * compatibility problems. 15790 */ 15791 if (tcp_ecn_permitted == 2) 15792 tcp->tcp_ecn_ok = B_TRUE; 15793 15794 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 15795 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 15796 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 15797 if (syn_mp) { 15798 cred_t *cr; 15799 pid_t pid; 15800 15801 /* 15802 * Obtain the credential from the 15803 * thread calling connect(); the credential 15804 * lives on in the second mblk which 15805 * originated from T_CONN_REQ and is echoed 15806 * with the T_BIND_ACK from ip. If none 15807 * can be found, default to the creator 15808 * of the socket. 15809 */ 15810 if (mp->b_cont == NULL || 15811 (cr = DB_CRED(mp->b_cont)) == NULL) { 15812 cr = tcp->tcp_cred; 15813 pid = tcp->tcp_cpid; 15814 } else { 15815 pid = DB_CPID(mp->b_cont); 15816 } 15817 15818 TCP_RECORD_TRACE(tcp, syn_mp, 15819 TCP_TRACE_SEND_PKT); 15820 mblk_setcred(syn_mp, cr); 15821 DB_CPID(syn_mp) = pid; 15822 tcp_send_data(tcp, tcp->tcp_wq, syn_mp); 15823 } 15824 after_syn_sent: 15825 /* 15826 * A trailer mblk indicates a waiting client upstream. 15827 * We complete here the processing begun in 15828 * either tcp_bind() or tcp_connect() by passing 15829 * upstream the reply message they supplied. 15830 */ 15831 mp1 = mp; 15832 mp = mp->b_cont; 15833 freeb(mp1); 15834 if (mp) 15835 break; 15836 return; 15837 case T_ERROR_ACK: 15838 if (tcp->tcp_debug) { 15839 (void) strlog(TCP_MODULE_ID, 0, 1, 15840 SL_TRACE|SL_ERROR, 15841 "tcp_rput_other: case T_ERROR_ACK, " 15842 "ERROR_prim == %d", 15843 tea->ERROR_prim); 15844 } 15845 switch (tea->ERROR_prim) { 15846 case O_T_BIND_REQ: 15847 case T_BIND_REQ: 15848 tcp_bind_failed(tcp, mp, 15849 (int)((tcp->tcp_state >= TCPS_SYN_SENT) ? 15850 ENETUNREACH : EADDRNOTAVAIL)); 15851 return; 15852 case T_UNBIND_REQ: 15853 tcp->tcp_hard_binding = B_FALSE; 15854 tcp->tcp_hard_bound = B_FALSE; 15855 if (mp->b_cont) { 15856 freemsg(mp->b_cont); 15857 mp->b_cont = NULL; 15858 } 15859 if (tcp->tcp_unbind_pending) 15860 tcp->tcp_unbind_pending = 0; 15861 else { 15862 /* From tcp_ip_unbind() - free */ 15863 freemsg(mp); 15864 return; 15865 } 15866 break; 15867 case T_SVR4_OPTMGMT_REQ: 15868 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15869 /* T_OPTMGMT_REQ generated by TCP */ 15870 printf("T_SVR4_OPTMGMT_REQ failed " 15871 "%d/%d - dropped (cnt %d)\n", 15872 tea->TLI_error, tea->UNIX_error, 15873 tcp->tcp_drop_opt_ack_cnt); 15874 freemsg(mp); 15875 tcp->tcp_drop_opt_ack_cnt--; 15876 return; 15877 } 15878 break; 15879 } 15880 if (tea->ERROR_prim == T_SVR4_OPTMGMT_REQ && 15881 tcp->tcp_drop_opt_ack_cnt > 0) { 15882 printf("T_SVR4_OPTMGMT_REQ failed %d/%d " 15883 "- dropped (cnt %d)\n", 15884 tea->TLI_error, tea->UNIX_error, 15885 tcp->tcp_drop_opt_ack_cnt); 15886 freemsg(mp); 15887 tcp->tcp_drop_opt_ack_cnt--; 15888 return; 15889 } 15890 break; 15891 case T_OPTMGMT_ACK: 15892 if (tcp->tcp_drop_opt_ack_cnt > 0) { 15893 /* T_OPTMGMT_REQ generated by TCP */ 15894 freemsg(mp); 15895 tcp->tcp_drop_opt_ack_cnt--; 15896 return; 15897 } 15898 break; 15899 default: 15900 break; 15901 } 15902 break; 15903 case M_CTL: 15904 /* 15905 * ICMP messages. 15906 */ 15907 tcp_icmp_error(tcp, mp); 15908 return; 15909 case M_FLUSH: 15910 if (*rptr & FLUSHR) 15911 flushq(q, FLUSHDATA); 15912 break; 15913 default: 15914 break; 15915 } 15916 /* 15917 * Make sure we set this bit before sending the ACK for 15918 * bind. Otherwise accept could possibly run and free 15919 * this tcp struct. 15920 */ 15921 putnext(q, mp); 15922 } 15923 15924 /* 15925 * Called as the result of a qbufcall or a qtimeout to remedy a failure 15926 * to allocate a T_ordrel_ind in tcp_rsrv(). qenable(q) will make 15927 * tcp_rsrv() try again. 15928 */ 15929 static void 15930 tcp_ordrel_kick(void *arg) 15931 { 15932 conn_t *connp = (conn_t *)arg; 15933 tcp_t *tcp = connp->conn_tcp; 15934 15935 tcp->tcp_ordrelid = 0; 15936 tcp->tcp_timeout = B_FALSE; 15937 if (!TCP_IS_DETACHED(tcp) && tcp->tcp_rq != NULL && 15938 tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 15939 qenable(tcp->tcp_rq); 15940 } 15941 } 15942 15943 /* ARGSUSED */ 15944 static void 15945 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2) 15946 { 15947 conn_t *connp = (conn_t *)arg; 15948 tcp_t *tcp = connp->conn_tcp; 15949 queue_t *q = tcp->tcp_rq; 15950 uint_t thwin; 15951 15952 freeb(mp); 15953 15954 TCP_STAT(tcp_rsrv_calls); 15955 15956 if (TCP_IS_DETACHED(tcp) || q == NULL) { 15957 return; 15958 } 15959 15960 if (tcp->tcp_fused) { 15961 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 15962 15963 ASSERT(tcp->tcp_fused); 15964 ASSERT(peer_tcp != NULL && peer_tcp->tcp_fused); 15965 ASSERT(peer_tcp->tcp_loopback_peer == tcp); 15966 ASSERT(!TCP_IS_DETACHED(tcp)); 15967 ASSERT(tcp->tcp_connp->conn_sqp == 15968 peer_tcp->tcp_connp->conn_sqp); 15969 15970 if (tcp->tcp_rcv_list != NULL) 15971 (void) tcp_rcv_drain(tcp->tcp_rq, tcp); 15972 15973 tcp_clrqfull(peer_tcp); 15974 peer_tcp->tcp_flow_stopped = B_FALSE; 15975 TCP_STAT(tcp_fusion_backenabled); 15976 return; 15977 } 15978 15979 if (canputnext(q)) { 15980 tcp->tcp_rwnd = q->q_hiwat; 15981 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 15982 << tcp->tcp_rcv_ws; 15983 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 15984 /* 15985 * Send back a window update immediately if TCP is above 15986 * ESTABLISHED state and the increase of the rcv window 15987 * that the other side knows is at least 1 MSS after flow 15988 * control is lifted. 15989 */ 15990 if (tcp->tcp_state >= TCPS_ESTABLISHED && 15991 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 15992 tcp_xmit_ctl(NULL, tcp, 15993 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 15994 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 15995 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 15996 } 15997 } 15998 /* Handle a failure to allocate a T_ORDREL_IND here */ 15999 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 16000 ASSERT(tcp->tcp_listener == NULL); 16001 if (tcp->tcp_rcv_list != NULL) { 16002 (void) tcp_rcv_drain(q, tcp); 16003 } 16004 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 16005 mp = mi_tpi_ordrel_ind(); 16006 if (mp) { 16007 tcp->tcp_ordrel_done = B_TRUE; 16008 putnext(q, mp); 16009 if (tcp->tcp_deferred_clean_death) { 16010 /* 16011 * tcp_clean_death was deferred for 16012 * T_ORDREL_IND - do it now 16013 */ 16014 tcp->tcp_deferred_clean_death = B_FALSE; 16015 (void) tcp_clean_death(tcp, 16016 tcp->tcp_client_errno, 22); 16017 } 16018 } else if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 16019 /* 16020 * If there isn't already a timer running 16021 * start one. Use a 4 second 16022 * timer as a fallback since it can't fail. 16023 */ 16024 tcp->tcp_timeout = B_TRUE; 16025 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 16026 MSEC_TO_TICK(4000)); 16027 } 16028 } 16029 } 16030 16031 /* 16032 * The read side service routine is called mostly when we get back-enabled as a 16033 * result of flow control relief. Since we don't actually queue anything in 16034 * TCP, we have no data to send out of here. What we do is clear the receive 16035 * window, and send out a window update. 16036 * This routine is also called to drive an orderly release message upstream 16037 * if the attempt in tcp_rput failed. 16038 */ 16039 static void 16040 tcp_rsrv(queue_t *q) 16041 { 16042 conn_t *connp = Q_TO_CONN(q); 16043 tcp_t *tcp = connp->conn_tcp; 16044 mblk_t *mp; 16045 16046 /* No code does a putq on the read side */ 16047 ASSERT(q->q_first == NULL); 16048 16049 /* Nothing to do for the default queue */ 16050 if (q == tcp_g_q) { 16051 return; 16052 } 16053 16054 mp = allocb(0, BPRI_HI); 16055 if (mp == NULL) { 16056 /* 16057 * We are under memory pressure. Return for now and we 16058 * we will be called again later. 16059 */ 16060 if (!tcp->tcp_timeout && tcp->tcp_ordrelid == 0) { 16061 /* 16062 * If there isn't already a timer running 16063 * start one. Use a 4 second 16064 * timer as a fallback since it can't fail. 16065 */ 16066 tcp->tcp_timeout = B_TRUE; 16067 tcp->tcp_ordrelid = TCP_TIMER(tcp, tcp_ordrel_kick, 16068 MSEC_TO_TICK(4000)); 16069 } 16070 return; 16071 } 16072 CONN_INC_REF(connp); 16073 squeue_enter(connp->conn_sqp, mp, tcp_rsrv_input, connp, 16074 SQTAG_TCP_RSRV); 16075 } 16076 16077 /* 16078 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 16079 * We do not allow the receive window to shrink. After setting rwnd, 16080 * set the flow control hiwat of the stream. 16081 * 16082 * This function is called in 2 cases: 16083 * 16084 * 1) Before data transfer begins, in tcp_accept_comm() for accepting a 16085 * connection (passive open) and in tcp_rput_data() for active connect. 16086 * This is called after tcp_mss_set() when the desired MSS value is known. 16087 * This makes sure that our window size is a mutiple of the other side's 16088 * MSS. 16089 * 2) Handling SO_RCVBUF option. 16090 * 16091 * It is ASSUMED that the requested size is a multiple of the current MSS. 16092 * 16093 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 16094 * user requests so. 16095 */ 16096 static int 16097 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 16098 { 16099 uint32_t mss = tcp->tcp_mss; 16100 uint32_t old_max_rwnd; 16101 uint32_t max_transmittable_rwnd; 16102 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 16103 16104 if (tcp_detached) 16105 old_max_rwnd = tcp->tcp_rwnd; 16106 else 16107 old_max_rwnd = tcp->tcp_rq->q_hiwat; 16108 16109 /* 16110 * Insist on a receive window that is at least 16111 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 16112 * funny TCP interactions of Nagle algorithm, SWS avoidance 16113 * and delayed acknowledgement. 16114 */ 16115 rwnd = MAX(rwnd, tcp_recv_hiwat_minmss * mss); 16116 16117 /* 16118 * If window size info has already been exchanged, TCP should not 16119 * shrink the window. Shrinking window is doable if done carefully. 16120 * We may add that support later. But so far there is not a real 16121 * need to do that. 16122 */ 16123 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 16124 /* MSS may have changed, do a round up again. */ 16125 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 16126 } 16127 16128 /* 16129 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 16130 * can be applied even before the window scale option is decided. 16131 */ 16132 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 16133 if (rwnd > max_transmittable_rwnd) { 16134 rwnd = max_transmittable_rwnd - 16135 (max_transmittable_rwnd % mss); 16136 if (rwnd < mss) 16137 rwnd = max_transmittable_rwnd; 16138 /* 16139 * If we're over the limit we may have to back down tcp_rwnd. 16140 * The increment below won't work for us. So we set all three 16141 * here and the increment below will have no effect. 16142 */ 16143 tcp->tcp_rwnd = old_max_rwnd = rwnd; 16144 } 16145 if (tcp->tcp_localnet) { 16146 tcp->tcp_rack_abs_max = 16147 MIN(tcp_local_dacks_max, rwnd / mss / 2); 16148 } else { 16149 /* 16150 * For a remote host on a different subnet (through a router), 16151 * we ack every other packet to be conforming to RFC1122. 16152 * tcp_deferred_acks_max is default to 2. 16153 */ 16154 tcp->tcp_rack_abs_max = 16155 MIN(tcp_deferred_acks_max, rwnd / mss / 2); 16156 } 16157 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 16158 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 16159 else 16160 tcp->tcp_rack_cur_max = 0; 16161 /* 16162 * Increment the current rwnd by the amount the maximum grew (we 16163 * can not overwrite it since we might be in the middle of a 16164 * connection.) 16165 */ 16166 tcp->tcp_rwnd += rwnd - old_max_rwnd; 16167 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, tcp->tcp_tcph->th_win); 16168 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 16169 tcp->tcp_cwnd_max = rwnd; 16170 16171 if (tcp_detached) 16172 return (rwnd); 16173 /* 16174 * We set the maximum receive window into rq->q_hiwat. 16175 * This is not actually used for flow control. 16176 */ 16177 tcp->tcp_rq->q_hiwat = rwnd; 16178 /* 16179 * Set the Stream head high water mark. This doesn't have to be 16180 * here, since we are simply using default values, but we would 16181 * prefer to choose these values algorithmically, with a likely 16182 * relationship to rwnd. For fused loopback tcp, we double the 16183 * amount of buffer in order to simulate the normal tcp case. 16184 */ 16185 if (tcp->tcp_fused) { 16186 (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd << 1, 16187 tcp_sth_rcv_hiwat)); 16188 } else { 16189 (void) mi_set_sth_hiwat(tcp->tcp_rq, MAX(rwnd, 16190 tcp_sth_rcv_hiwat)); 16191 } 16192 return (rwnd); 16193 } 16194 16195 /* 16196 * Return SNMP stuff in buffer in mpdata. 16197 */ 16198 static int 16199 tcp_snmp_get(queue_t *q, mblk_t *mpctl) 16200 { 16201 mblk_t *mpdata; 16202 mblk_t *mp_conn_ctl = NULL; 16203 mblk_t *mp_conn_data; 16204 mblk_t *mp6_conn_ctl = NULL; 16205 mblk_t *mp6_conn_data; 16206 mblk_t *mp_conn_tail = NULL; 16207 mblk_t *mp6_conn_tail = NULL; 16208 struct opthdr *optp; 16209 mib2_tcpConnEntry_t tce; 16210 mib2_tcp6ConnEntry_t tce6; 16211 connf_t *connfp; 16212 conn_t *connp; 16213 int i; 16214 boolean_t ispriv; 16215 zoneid_t zoneid; 16216 16217 if (mpctl == NULL || 16218 (mpdata = mpctl->b_cont) == NULL || 16219 (mp_conn_ctl = copymsg(mpctl)) == NULL || 16220 (mp6_conn_ctl = copymsg(mpctl)) == NULL) { 16221 if (mp_conn_ctl != NULL) 16222 freemsg(mp_conn_ctl); 16223 if (mp6_conn_ctl != NULL) 16224 freemsg(mp6_conn_ctl); 16225 return (0); 16226 } 16227 16228 /* build table of connections -- need count in fixed part */ 16229 mp_conn_data = mp_conn_ctl->b_cont; 16230 mp6_conn_data = mp6_conn_ctl->b_cont; 16231 SET_MIB(tcp_mib.tcpRtoAlgorithm, 4); /* vanj */ 16232 SET_MIB(tcp_mib.tcpRtoMin, tcp_rexmit_interval_min); 16233 SET_MIB(tcp_mib.tcpRtoMax, tcp_rexmit_interval_max); 16234 SET_MIB(tcp_mib.tcpMaxConn, -1); 16235 SET_MIB(tcp_mib.tcpCurrEstab, 0); 16236 16237 ispriv = 16238 secpolicy_net_config((Q_TO_CONN(q))->conn_cred, B_TRUE) == 0; 16239 zoneid = Q_TO_CONN(q)->conn_zoneid; 16240 16241 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 16242 16243 connfp = &ipcl_globalhash_fanout[i]; 16244 16245 connp = NULL; 16246 16247 while ((connp = tcp_get_next_conn(connfp, connp))) { 16248 tcp_t *tcp; 16249 16250 if (connp->conn_zoneid != zoneid) 16251 continue; /* not in this zone */ 16252 16253 tcp = connp->conn_tcp; 16254 UPDATE_MIB(&tcp_mib, tcpInSegs, tcp->tcp_ibsegs); 16255 tcp->tcp_ibsegs = 0; 16256 UPDATE_MIB(&tcp_mib, tcpOutSegs, tcp->tcp_obsegs); 16257 tcp->tcp_obsegs = 0; 16258 16259 tce6.tcp6ConnState = tce.tcpConnState = 16260 tcp_snmp_state(tcp); 16261 if (tce.tcpConnState == MIB2_TCP_established || 16262 tce.tcpConnState == MIB2_TCP_closeWait) 16263 BUMP_MIB(&tcp_mib, tcpCurrEstab); 16264 16265 /* Create a message to report on IPv6 entries */ 16266 if (tcp->tcp_ipversion == IPV6_VERSION) { 16267 tce6.tcp6ConnLocalAddress = tcp->tcp_ip_src_v6; 16268 tce6.tcp6ConnRemAddress = tcp->tcp_remote_v6; 16269 tce6.tcp6ConnLocalPort = ntohs(tcp->tcp_lport); 16270 tce6.tcp6ConnRemPort = ntohs(tcp->tcp_fport); 16271 tce6.tcp6ConnIfIndex = tcp->tcp_bound_if; 16272 /* Don't want just anybody seeing these... */ 16273 if (ispriv) { 16274 tce6.tcp6ConnEntryInfo.ce_snxt = 16275 tcp->tcp_snxt; 16276 tce6.tcp6ConnEntryInfo.ce_suna = 16277 tcp->tcp_suna; 16278 tce6.tcp6ConnEntryInfo.ce_rnxt = 16279 tcp->tcp_rnxt; 16280 tce6.tcp6ConnEntryInfo.ce_rack = 16281 tcp->tcp_rack; 16282 } else { 16283 /* 16284 * Netstat, unfortunately, uses this to 16285 * get send/receive queue sizes. How to fix? 16286 * Why not compute the difference only? 16287 */ 16288 tce6.tcp6ConnEntryInfo.ce_snxt = 16289 tcp->tcp_snxt - tcp->tcp_suna; 16290 tce6.tcp6ConnEntryInfo.ce_suna = 0; 16291 tce6.tcp6ConnEntryInfo.ce_rnxt = 16292 tcp->tcp_rnxt - tcp->tcp_rack; 16293 tce6.tcp6ConnEntryInfo.ce_rack = 0; 16294 } 16295 16296 tce6.tcp6ConnEntryInfo.ce_swnd = tcp->tcp_swnd; 16297 tce6.tcp6ConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 16298 tce6.tcp6ConnEntryInfo.ce_rto = tcp->tcp_rto; 16299 tce6.tcp6ConnEntryInfo.ce_mss = tcp->tcp_mss; 16300 tce6.tcp6ConnEntryInfo.ce_state = tcp->tcp_state; 16301 (void) snmp_append_data2(mp6_conn_data, &mp6_conn_tail, 16302 (char *)&tce6, sizeof (tce6)); 16303 } 16304 /* 16305 * Create an IPv4 table entry for IPv4 entries and also 16306 * for IPv6 entries which are bound to in6addr_any 16307 * but don't have IPV6_V6ONLY set. 16308 * (i.e. anything an IPv4 peer could connect to) 16309 */ 16310 if (tcp->tcp_ipversion == IPV4_VERSION || 16311 (tcp->tcp_state <= TCPS_LISTEN && 16312 !tcp->tcp_connp->conn_ipv6_v6only && 16313 IN6_IS_ADDR_UNSPECIFIED(&tcp->tcp_ip_src_v6))) { 16314 if (tcp->tcp_ipversion == IPV6_VERSION) { 16315 tce.tcpConnRemAddress = INADDR_ANY; 16316 tce.tcpConnLocalAddress = INADDR_ANY; 16317 } else { 16318 tce.tcpConnRemAddress = 16319 tcp->tcp_remote; 16320 tce.tcpConnLocalAddress = 16321 tcp->tcp_ip_src; 16322 } 16323 tce.tcpConnLocalPort = ntohs(tcp->tcp_lport); 16324 tce.tcpConnRemPort = ntohs(tcp->tcp_fport); 16325 /* Don't want just anybody seeing these... */ 16326 if (ispriv) { 16327 tce.tcpConnEntryInfo.ce_snxt = 16328 tcp->tcp_snxt; 16329 tce.tcpConnEntryInfo.ce_suna = 16330 tcp->tcp_suna; 16331 tce.tcpConnEntryInfo.ce_rnxt = 16332 tcp->tcp_rnxt; 16333 tce.tcpConnEntryInfo.ce_rack = 16334 tcp->tcp_rack; 16335 } else { 16336 /* 16337 * Netstat, unfortunately, uses this to 16338 * get send/receive queue sizes. How 16339 * to fix? 16340 * Why not compute the difference only? 16341 */ 16342 tce.tcpConnEntryInfo.ce_snxt = 16343 tcp->tcp_snxt - tcp->tcp_suna; 16344 tce.tcpConnEntryInfo.ce_suna = 0; 16345 tce.tcpConnEntryInfo.ce_rnxt = 16346 tcp->tcp_rnxt - tcp->tcp_rack; 16347 tce.tcpConnEntryInfo.ce_rack = 0; 16348 } 16349 16350 tce.tcpConnEntryInfo.ce_swnd = tcp->tcp_swnd; 16351 tce.tcpConnEntryInfo.ce_rwnd = tcp->tcp_rwnd; 16352 tce.tcpConnEntryInfo.ce_rto = tcp->tcp_rto; 16353 tce.tcpConnEntryInfo.ce_mss = tcp->tcp_mss; 16354 tce.tcpConnEntryInfo.ce_state = 16355 tcp->tcp_state; 16356 (void) snmp_append_data2(mp_conn_data, 16357 &mp_conn_tail, (char *)&tce, sizeof (tce)); 16358 } 16359 } 16360 } 16361 16362 /* fixed length structure for IPv4 and IPv6 counters */ 16363 SET_MIB(tcp_mib.tcpConnTableSize, sizeof (mib2_tcpConnEntry_t)); 16364 SET_MIB(tcp_mib.tcp6ConnTableSize, sizeof (mib2_tcp6ConnEntry_t)); 16365 optp = (struct opthdr *)&mpctl->b_rptr[sizeof (struct T_optmgmt_ack)]; 16366 optp->level = MIB2_TCP; 16367 optp->name = 0; 16368 (void) snmp_append_data(mpdata, (char *)&tcp_mib, sizeof (tcp_mib)); 16369 optp->len = msgdsize(mpdata); 16370 qreply(q, mpctl); 16371 16372 /* table of connections... */ 16373 optp = (struct opthdr *)&mp_conn_ctl->b_rptr[ 16374 sizeof (struct T_optmgmt_ack)]; 16375 optp->level = MIB2_TCP; 16376 optp->name = MIB2_TCP_CONN; 16377 optp->len = msgdsize(mp_conn_data); 16378 qreply(q, mp_conn_ctl); 16379 16380 /* table of IPv6 connections... */ 16381 optp = (struct opthdr *)&mp6_conn_ctl->b_rptr[ 16382 sizeof (struct T_optmgmt_ack)]; 16383 optp->level = MIB2_TCP6; 16384 optp->name = MIB2_TCP6_CONN; 16385 optp->len = msgdsize(mp6_conn_data); 16386 qreply(q, mp6_conn_ctl); 16387 return (1); 16388 } 16389 16390 /* Return 0 if invalid set request, 1 otherwise, including non-tcp requests */ 16391 /* ARGSUSED */ 16392 static int 16393 tcp_snmp_set(queue_t *q, int level, int name, uchar_t *ptr, int len) 16394 { 16395 mib2_tcpConnEntry_t *tce = (mib2_tcpConnEntry_t *)ptr; 16396 16397 switch (level) { 16398 case MIB2_TCP: 16399 switch (name) { 16400 case 13: 16401 if (tce->tcpConnState != MIB2_TCP_deleteTCB) 16402 return (0); 16403 /* TODO: delete entry defined by tce */ 16404 return (1); 16405 default: 16406 return (0); 16407 } 16408 default: 16409 return (1); 16410 } 16411 } 16412 16413 /* Translate TCP state to MIB2 TCP state. */ 16414 static int 16415 tcp_snmp_state(tcp_t *tcp) 16416 { 16417 if (tcp == NULL) 16418 return (0); 16419 16420 switch (tcp->tcp_state) { 16421 case TCPS_CLOSED: 16422 case TCPS_IDLE: /* RFC1213 doesn't have analogue for IDLE & BOUND */ 16423 case TCPS_BOUND: 16424 return (MIB2_TCP_closed); 16425 case TCPS_LISTEN: 16426 return (MIB2_TCP_listen); 16427 case TCPS_SYN_SENT: 16428 return (MIB2_TCP_synSent); 16429 case TCPS_SYN_RCVD: 16430 return (MIB2_TCP_synReceived); 16431 case TCPS_ESTABLISHED: 16432 return (MIB2_TCP_established); 16433 case TCPS_CLOSE_WAIT: 16434 return (MIB2_TCP_closeWait); 16435 case TCPS_FIN_WAIT_1: 16436 return (MIB2_TCP_finWait1); 16437 case TCPS_CLOSING: 16438 return (MIB2_TCP_closing); 16439 case TCPS_LAST_ACK: 16440 return (MIB2_TCP_lastAck); 16441 case TCPS_FIN_WAIT_2: 16442 return (MIB2_TCP_finWait2); 16443 case TCPS_TIME_WAIT: 16444 return (MIB2_TCP_timeWait); 16445 default: 16446 return (0); 16447 } 16448 } 16449 16450 static char tcp_report_header[] = 16451 "TCP " MI_COL_HDRPAD_STR 16452 "zone dest snxt suna " 16453 "swnd rnxt rack rwnd rto mss w sw rw t " 16454 "recent [lport,fport] state"; 16455 16456 /* 16457 * TCP status report triggered via the Named Dispatch mechanism. 16458 */ 16459 /* ARGSUSED */ 16460 static void 16461 tcp_report_item(mblk_t *mp, tcp_t *tcp, int hashval, tcp_t *thisstream, 16462 cred_t *cr) 16463 { 16464 char hash[10], addrbuf[INET6_ADDRSTRLEN]; 16465 boolean_t ispriv = secpolicy_net_config(cr, B_TRUE) == 0; 16466 char cflag; 16467 in6_addr_t v6dst; 16468 char buf[80]; 16469 uint_t print_len, buf_len; 16470 16471 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16472 if (buf_len <= 0) 16473 return; 16474 16475 if (hashval >= 0) 16476 (void) sprintf(hash, "%03d ", hashval); 16477 else 16478 hash[0] = '\0'; 16479 16480 /* 16481 * Note that we use the remote address in the tcp_b structure. 16482 * This means that it will print out the real destination address, 16483 * not the next hop's address if source routing is used. This 16484 * avoid the confusion on the output because user may not 16485 * know that source routing is used for a connection. 16486 */ 16487 if (tcp->tcp_ipversion == IPV4_VERSION) { 16488 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_remote, &v6dst); 16489 } else { 16490 v6dst = tcp->tcp_remote_v6; 16491 } 16492 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16493 /* 16494 * the ispriv checks are so that normal users cannot determine 16495 * sequence number information using NDD. 16496 */ 16497 16498 if (TCP_IS_DETACHED(tcp)) 16499 cflag = '*'; 16500 else 16501 cflag = ' '; 16502 print_len = snprintf((char *)mp->b_wptr, buf_len, 16503 "%s " MI_COL_PTRFMT_STR "%d %s %08x %08x %010d %08x %08x " 16504 "%010d %05ld %05d %1d %02d %02d %1d %08x %s%c\n", 16505 hash, 16506 (void *)tcp, 16507 tcp->tcp_connp->conn_zoneid, 16508 addrbuf, 16509 (ispriv) ? tcp->tcp_snxt : 0, 16510 (ispriv) ? tcp->tcp_suna : 0, 16511 tcp->tcp_swnd, 16512 (ispriv) ? tcp->tcp_rnxt : 0, 16513 (ispriv) ? tcp->tcp_rack : 0, 16514 tcp->tcp_rwnd, 16515 tcp->tcp_rto, 16516 tcp->tcp_mss, 16517 tcp->tcp_snd_ws_ok, 16518 tcp->tcp_snd_ws, 16519 tcp->tcp_rcv_ws, 16520 tcp->tcp_snd_ts_ok, 16521 tcp->tcp_ts_recent, 16522 tcp_display(tcp, buf, DISP_PORT_ONLY), cflag); 16523 if (print_len < buf_len) { 16524 ((mblk_t *)mp)->b_wptr += print_len; 16525 } else { 16526 ((mblk_t *)mp)->b_wptr += buf_len; 16527 } 16528 } 16529 16530 /* 16531 * TCP status report (for listeners only) triggered via the Named Dispatch 16532 * mechanism. 16533 */ 16534 /* ARGSUSED */ 16535 static void 16536 tcp_report_listener(mblk_t *mp, tcp_t *tcp, int hashval) 16537 { 16538 char addrbuf[INET6_ADDRSTRLEN]; 16539 in6_addr_t v6dst; 16540 uint_t print_len, buf_len; 16541 16542 buf_len = mp->b_datap->db_lim - mp->b_wptr; 16543 if (buf_len <= 0) 16544 return; 16545 16546 if (tcp->tcp_ipversion == IPV4_VERSION) { 16547 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, &v6dst); 16548 (void) inet_ntop(AF_INET6, &v6dst, addrbuf, sizeof (addrbuf)); 16549 } else { 16550 (void) inet_ntop(AF_INET6, &tcp->tcp_ip6h->ip6_src, 16551 addrbuf, sizeof (addrbuf)); 16552 } 16553 print_len = snprintf((char *)mp->b_wptr, buf_len, 16554 "%03d " 16555 MI_COL_PTRFMT_STR 16556 "%d %s %05u %08u %d/%d/%d%c\n", 16557 hashval, (void *)tcp, 16558 tcp->tcp_connp->conn_zoneid, 16559 addrbuf, 16560 (uint_t)BE16_TO_U16(tcp->tcp_tcph->th_lport), 16561 tcp->tcp_conn_req_seqnum, 16562 tcp->tcp_conn_req_cnt_q0, tcp->tcp_conn_req_cnt_q, 16563 tcp->tcp_conn_req_max, 16564 tcp->tcp_syn_defense ? '*' : ' '); 16565 if (print_len < buf_len) { 16566 ((mblk_t *)mp)->b_wptr += print_len; 16567 } else { 16568 ((mblk_t *)mp)->b_wptr += buf_len; 16569 } 16570 } 16571 16572 /* TCP status report triggered via the Named Dispatch mechanism. */ 16573 /* ARGSUSED */ 16574 static int 16575 tcp_status_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16576 { 16577 tcp_t *tcp; 16578 int i; 16579 conn_t *connp; 16580 connf_t *connfp; 16581 zoneid_t zoneid; 16582 16583 /* 16584 * Because of the ndd constraint, at most we can have 64K buffer 16585 * to put in all TCP info. So to be more efficient, just 16586 * allocate a 64K buffer here, assuming we need that large buffer. 16587 * This may be a problem as any user can read tcp_status. Therefore 16588 * we limit the rate of doing this using tcp_ndd_get_info_interval. 16589 * This should be OK as normal users should not do this too often. 16590 */ 16591 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16592 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16593 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16594 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16595 return (0); 16596 } 16597 } 16598 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16599 /* The following may work even if we cannot get a large buf. */ 16600 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16601 return (0); 16602 } 16603 16604 (void) mi_mpprintf(mp, "%s", tcp_report_header); 16605 16606 zoneid = Q_TO_CONN(q)->conn_zoneid; 16607 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 16608 16609 connfp = &ipcl_globalhash_fanout[i]; 16610 16611 connp = NULL; 16612 16613 while ((connp = tcp_get_next_conn(connfp, connp))) { 16614 tcp = connp->conn_tcp; 16615 if (zoneid != GLOBAL_ZONEID && 16616 zoneid != connp->conn_zoneid) 16617 continue; 16618 tcp_report_item(mp->b_cont, tcp, -1, tcp, 16619 cr); 16620 } 16621 16622 } 16623 16624 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16625 return (0); 16626 } 16627 16628 /* TCP status report triggered via the Named Dispatch mechanism. */ 16629 /* ARGSUSED */ 16630 static int 16631 tcp_bind_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16632 { 16633 tf_t *tbf; 16634 tcp_t *tcp; 16635 int i; 16636 zoneid_t zoneid; 16637 16638 /* Refer to comments in tcp_status_report(). */ 16639 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16640 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16641 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16642 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16643 return (0); 16644 } 16645 } 16646 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16647 /* The following may work even if we cannot get a large buf. */ 16648 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16649 return (0); 16650 } 16651 16652 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16653 16654 zoneid = Q_TO_CONN(q)->conn_zoneid; 16655 16656 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 16657 tbf = &tcp_bind_fanout[i]; 16658 mutex_enter(&tbf->tf_lock); 16659 for (tcp = tbf->tf_tcp; tcp != NULL; 16660 tcp = tcp->tcp_bind_hash) { 16661 if (zoneid != GLOBAL_ZONEID && 16662 zoneid != tcp->tcp_connp->conn_zoneid) 16663 continue; 16664 CONN_INC_REF(tcp->tcp_connp); 16665 tcp_report_item(mp->b_cont, tcp, i, 16666 Q_TO_TCP(q), cr); 16667 CONN_DEC_REF(tcp->tcp_connp); 16668 } 16669 mutex_exit(&tbf->tf_lock); 16670 } 16671 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16672 return (0); 16673 } 16674 16675 /* TCP status report triggered via the Named Dispatch mechanism. */ 16676 /* ARGSUSED */ 16677 static int 16678 tcp_listen_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16679 { 16680 connf_t *connfp; 16681 conn_t *connp; 16682 tcp_t *tcp; 16683 int i; 16684 zoneid_t zoneid; 16685 16686 /* Refer to comments in tcp_status_report(). */ 16687 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16688 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16689 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16690 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16691 return (0); 16692 } 16693 } 16694 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16695 /* The following may work even if we cannot get a large buf. */ 16696 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16697 return (0); 16698 } 16699 16700 (void) mi_mpprintf(mp, 16701 " TCP " MI_COL_HDRPAD_STR 16702 "zone IP addr port seqnum backlog (q0/q/max)"); 16703 16704 zoneid = Q_TO_CONN(q)->conn_zoneid; 16705 16706 for (i = 0; i < ipcl_bind_fanout_size; i++) { 16707 connfp = &ipcl_bind_fanout[i]; 16708 connp = NULL; 16709 while ((connp = tcp_get_next_conn(connfp, connp))) { 16710 tcp = connp->conn_tcp; 16711 if (zoneid != GLOBAL_ZONEID && 16712 zoneid != connp->conn_zoneid) 16713 continue; 16714 tcp_report_listener(mp->b_cont, tcp, i); 16715 } 16716 } 16717 16718 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16719 return (0); 16720 } 16721 16722 /* TCP status report triggered via the Named Dispatch mechanism. */ 16723 /* ARGSUSED */ 16724 static int 16725 tcp_conn_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16726 { 16727 connf_t *connfp; 16728 conn_t *connp; 16729 tcp_t *tcp; 16730 int i; 16731 zoneid_t zoneid; 16732 16733 /* Refer to comments in tcp_status_report(). */ 16734 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16735 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16736 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16737 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16738 return (0); 16739 } 16740 } 16741 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16742 /* The following may work even if we cannot get a large buf. */ 16743 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16744 return (0); 16745 } 16746 16747 (void) mi_mpprintf(mp, "tcp_conn_hash_size = %d", 16748 ipcl_conn_fanout_size); 16749 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16750 16751 zoneid = Q_TO_CONN(q)->conn_zoneid; 16752 16753 for (i = 0; i < ipcl_conn_fanout_size; i++) { 16754 connfp = &ipcl_conn_fanout[i]; 16755 connp = NULL; 16756 while ((connp = tcp_get_next_conn(connfp, connp))) { 16757 tcp = connp->conn_tcp; 16758 if (zoneid != GLOBAL_ZONEID && 16759 zoneid != connp->conn_zoneid) 16760 continue; 16761 tcp_report_item(mp->b_cont, tcp, i, 16762 Q_TO_TCP(q), cr); 16763 } 16764 } 16765 16766 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16767 return (0); 16768 } 16769 16770 /* TCP status report triggered via the Named Dispatch mechanism. */ 16771 /* ARGSUSED */ 16772 static int 16773 tcp_acceptor_hash_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 16774 { 16775 tf_t *tf; 16776 tcp_t *tcp; 16777 int i; 16778 zoneid_t zoneid; 16779 16780 /* Refer to comments in tcp_status_report(). */ 16781 if (cr == NULL || secpolicy_net_config(cr, B_TRUE) != 0) { 16782 if (ddi_get_lbolt() - tcp_last_ndd_get_info_time < 16783 drv_usectohz(tcp_ndd_get_info_interval * 1000)) { 16784 (void) mi_mpprintf(mp, NDD_TOO_QUICK_MSG); 16785 return (0); 16786 } 16787 } 16788 if ((mp->b_cont = allocb(ND_MAX_BUF_LEN, BPRI_HI)) == NULL) { 16789 /* The following may work even if we cannot get a large buf. */ 16790 (void) mi_mpprintf(mp, NDD_OUT_OF_BUF_MSG); 16791 return (0); 16792 } 16793 16794 (void) mi_mpprintf(mp, " %s", tcp_report_header); 16795 16796 zoneid = Q_TO_CONN(q)->conn_zoneid; 16797 16798 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 16799 tf = &tcp_acceptor_fanout[i]; 16800 mutex_enter(&tf->tf_lock); 16801 for (tcp = tf->tf_tcp; tcp != NULL; 16802 tcp = tcp->tcp_acceptor_hash) { 16803 if (zoneid != GLOBAL_ZONEID && 16804 zoneid != tcp->tcp_connp->conn_zoneid) 16805 continue; 16806 tcp_report_item(mp->b_cont, tcp, i, 16807 Q_TO_TCP(q), cr); 16808 } 16809 mutex_exit(&tf->tf_lock); 16810 } 16811 tcp_last_ndd_get_info_time = ddi_get_lbolt(); 16812 return (0); 16813 } 16814 16815 /* 16816 * tcp_timer is the timer service routine. It handles the retransmission, 16817 * FIN_WAIT_2 flush, and zero window probe timeout events. It figures out 16818 * from the state of the tcp instance what kind of action needs to be done 16819 * at the time it is called. 16820 */ 16821 static void 16822 tcp_timer(void *arg) 16823 { 16824 mblk_t *mp; 16825 clock_t first_threshold; 16826 clock_t second_threshold; 16827 clock_t ms; 16828 uint32_t mss; 16829 conn_t *connp = (conn_t *)arg; 16830 tcp_t *tcp = connp->conn_tcp; 16831 16832 tcp->tcp_timer_tid = 0; 16833 16834 if (tcp->tcp_fused) 16835 return; 16836 16837 first_threshold = tcp->tcp_first_timer_threshold; 16838 second_threshold = tcp->tcp_second_timer_threshold; 16839 switch (tcp->tcp_state) { 16840 case TCPS_IDLE: 16841 case TCPS_BOUND: 16842 case TCPS_LISTEN: 16843 return; 16844 case TCPS_SYN_RCVD: { 16845 tcp_t *listener = tcp->tcp_listener; 16846 16847 if (tcp->tcp_syn_rcvd_timeout == 0 && (listener != NULL)) { 16848 ASSERT(tcp->tcp_rq == listener->tcp_rq); 16849 /* it's our first timeout */ 16850 tcp->tcp_syn_rcvd_timeout = 1; 16851 mutex_enter(&listener->tcp_eager_lock); 16852 listener->tcp_syn_rcvd_timeout++; 16853 if (!listener->tcp_syn_defense && 16854 (listener->tcp_syn_rcvd_timeout > 16855 (tcp_conn_req_max_q0 >> 2)) && 16856 (tcp_conn_req_max_q0 > 200)) { 16857 /* We may be under attack. Put on a defense. */ 16858 listener->tcp_syn_defense = B_TRUE; 16859 cmn_err(CE_WARN, "High TCP connect timeout " 16860 "rate! System (port %d) may be under a " 16861 "SYN flood attack!", 16862 BE16_TO_U16(listener->tcp_tcph->th_lport)); 16863 16864 listener->tcp_ip_addr_cache = kmem_zalloc( 16865 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t), 16866 KM_NOSLEEP); 16867 } 16868 mutex_exit(&listener->tcp_eager_lock); 16869 } 16870 } 16871 /* FALLTHRU */ 16872 case TCPS_SYN_SENT: 16873 first_threshold = tcp->tcp_first_ctimer_threshold; 16874 second_threshold = tcp->tcp_second_ctimer_threshold; 16875 break; 16876 case TCPS_ESTABLISHED: 16877 case TCPS_FIN_WAIT_1: 16878 case TCPS_CLOSING: 16879 case TCPS_CLOSE_WAIT: 16880 case TCPS_LAST_ACK: 16881 /* If we have data to rexmit */ 16882 if (tcp->tcp_suna != tcp->tcp_snxt) { 16883 clock_t time_to_wait; 16884 16885 BUMP_MIB(&tcp_mib, tcpTimRetrans); 16886 if (!tcp->tcp_xmit_head) 16887 break; 16888 time_to_wait = lbolt - 16889 (clock_t)tcp->tcp_xmit_head->b_prev; 16890 time_to_wait = tcp->tcp_rto - 16891 TICK_TO_MSEC(time_to_wait); 16892 /* 16893 * If the timer fires too early, 1 clock tick earlier, 16894 * restart the timer. 16895 */ 16896 if (time_to_wait > msec_per_tick) { 16897 TCP_STAT(tcp_timer_fire_early); 16898 TCP_TIMER_RESTART(tcp, time_to_wait); 16899 return; 16900 } 16901 /* 16902 * When we probe zero windows, we force the swnd open. 16903 * If our peer acks with a closed window swnd will be 16904 * set to zero by tcp_rput(). As long as we are 16905 * receiving acks tcp_rput will 16906 * reset 'tcp_ms_we_have_waited' so as not to trip the 16907 * first and second interval actions. NOTE: the timer 16908 * interval is allowed to continue its exponential 16909 * backoff. 16910 */ 16911 if (tcp->tcp_swnd == 0 || tcp->tcp_zero_win_probe) { 16912 if (tcp->tcp_debug) { 16913 (void) strlog(TCP_MODULE_ID, 0, 1, 16914 SL_TRACE, "tcp_timer: zero win"); 16915 } 16916 } else { 16917 /* 16918 * After retransmission, we need to do 16919 * slow start. Set the ssthresh to one 16920 * half of current effective window and 16921 * cwnd to one MSS. Also reset 16922 * tcp_cwnd_cnt. 16923 * 16924 * Note that if tcp_ssthresh is reduced because 16925 * of ECN, do not reduce it again unless it is 16926 * already one window of data away (tcp_cwr 16927 * should then be cleared) or this is a 16928 * timeout for a retransmitted segment. 16929 */ 16930 uint32_t npkt; 16931 16932 if (!tcp->tcp_cwr || tcp->tcp_rexmit) { 16933 npkt = ((tcp->tcp_timer_backoff ? 16934 tcp->tcp_cwnd_ssthresh : 16935 tcp->tcp_snxt - 16936 tcp->tcp_suna) >> 1) / tcp->tcp_mss; 16937 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 16938 tcp->tcp_mss; 16939 } 16940 tcp->tcp_cwnd = tcp->tcp_mss; 16941 tcp->tcp_cwnd_cnt = 0; 16942 if (tcp->tcp_ecn_ok) { 16943 tcp->tcp_cwr = B_TRUE; 16944 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 16945 tcp->tcp_ecn_cwr_sent = B_FALSE; 16946 } 16947 } 16948 break; 16949 } 16950 /* 16951 * We have something to send yet we cannot send. The 16952 * reason can be: 16953 * 16954 * 1. Zero send window: we need to do zero window probe. 16955 * 2. Zero cwnd: because of ECN, we need to "clock out 16956 * segments. 16957 * 3. SWS avoidance: receiver may have shrunk window, 16958 * reset our knowledge. 16959 * 16960 * Note that condition 2 can happen with either 1 or 16961 * 3. But 1 and 3 are exclusive. 16962 */ 16963 if (tcp->tcp_unsent != 0) { 16964 if (tcp->tcp_cwnd == 0) { 16965 /* 16966 * Set tcp_cwnd to 1 MSS so that a 16967 * new segment can be sent out. We 16968 * are "clocking out" new data when 16969 * the network is really congested. 16970 */ 16971 ASSERT(tcp->tcp_ecn_ok); 16972 tcp->tcp_cwnd = tcp->tcp_mss; 16973 } 16974 if (tcp->tcp_swnd == 0) { 16975 /* Extend window for zero window probe */ 16976 tcp->tcp_swnd++; 16977 tcp->tcp_zero_win_probe = B_TRUE; 16978 BUMP_MIB(&tcp_mib, tcpOutWinProbe); 16979 } else { 16980 /* 16981 * Handle timeout from sender SWS avoidance. 16982 * Reset our knowledge of the max send window 16983 * since the receiver might have reduced its 16984 * receive buffer. Avoid setting tcp_max_swnd 16985 * to one since that will essentially disable 16986 * the SWS checks. 16987 * 16988 * Note that since we don't have a SWS 16989 * state variable, if the timeout is set 16990 * for ECN but not for SWS, this 16991 * code will also be executed. This is 16992 * fine as tcp_max_swnd is updated 16993 * constantly and it will not affect 16994 * anything. 16995 */ 16996 tcp->tcp_max_swnd = MAX(tcp->tcp_swnd, 2); 16997 } 16998 tcp_wput_data(tcp, NULL, B_FALSE); 16999 return; 17000 } 17001 /* Is there a FIN that needs to be to re retransmitted? */ 17002 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 17003 !tcp->tcp_fin_acked) 17004 break; 17005 /* Nothing to do, return without restarting timer. */ 17006 TCP_STAT(tcp_timer_fire_miss); 17007 return; 17008 case TCPS_FIN_WAIT_2: 17009 /* 17010 * User closed the TCP endpoint and peer ACK'ed our FIN. 17011 * We waited some time for for peer's FIN, but it hasn't 17012 * arrived. We flush the connection now to avoid 17013 * case where the peer has rebooted. 17014 */ 17015 if (TCP_IS_DETACHED(tcp)) { 17016 (void) tcp_clean_death(tcp, 0, 23); 17017 } else { 17018 TCP_TIMER_RESTART(tcp, tcp_fin_wait_2_flush_interval); 17019 } 17020 return; 17021 case TCPS_TIME_WAIT: 17022 (void) tcp_clean_death(tcp, 0, 24); 17023 return; 17024 default: 17025 if (tcp->tcp_debug) { 17026 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE|SL_ERROR, 17027 "tcp_timer: strange state (%d) %s", 17028 tcp->tcp_state, tcp_display(tcp, NULL, 17029 DISP_PORT_ONLY)); 17030 } 17031 return; 17032 } 17033 if ((ms = tcp->tcp_ms_we_have_waited) > second_threshold) { 17034 /* 17035 * For zero window probe, we need to send indefinitely, 17036 * unless we have not heard from the other side for some 17037 * time... 17038 */ 17039 if ((tcp->tcp_zero_win_probe == 0) || 17040 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) > 17041 second_threshold)) { 17042 BUMP_MIB(&tcp_mib, tcpTimRetransDrop); 17043 /* 17044 * If TCP is in SYN_RCVD state, send back a 17045 * RST|ACK as BSD does. Note that tcp_zero_win_probe 17046 * should be zero in TCPS_SYN_RCVD state. 17047 */ 17048 if (tcp->tcp_state == TCPS_SYN_RCVD) { 17049 tcp_xmit_ctl("tcp_timer: RST sent on timeout " 17050 "in SYN_RCVD", 17051 tcp, tcp->tcp_snxt, 17052 tcp->tcp_rnxt, TH_RST | TH_ACK); 17053 } 17054 (void) tcp_clean_death(tcp, 17055 tcp->tcp_client_errno ? 17056 tcp->tcp_client_errno : ETIMEDOUT, 25); 17057 return; 17058 } else { 17059 /* 17060 * Set tcp_ms_we_have_waited to second_threshold 17061 * so that in next timeout, we will do the above 17062 * check (lbolt - tcp_last_recv_time). This is 17063 * also to avoid overflow. 17064 * 17065 * We don't need to decrement tcp_timer_backoff 17066 * to avoid overflow because it will be decremented 17067 * later if new timeout value is greater than 17068 * tcp_rexmit_interval_max. In the case when 17069 * tcp_rexmit_interval_max is greater than 17070 * second_threshold, it means that we will wait 17071 * longer than second_threshold to send the next 17072 * window probe. 17073 */ 17074 tcp->tcp_ms_we_have_waited = second_threshold; 17075 } 17076 } else if (ms > first_threshold) { 17077 if (tcp->tcp_snd_zcopy_aware && (!tcp->tcp_xmit_zc_clean) && 17078 tcp->tcp_xmit_head != NULL) { 17079 tcp->tcp_xmit_head = 17080 tcp_zcopy_backoff(tcp, tcp->tcp_xmit_head, 1); 17081 } 17082 /* 17083 * We have been retransmitting for too long... The RTT 17084 * we calculated is probably incorrect. Reinitialize it. 17085 * Need to compensate for 0 tcp_rtt_sa. Reset 17086 * tcp_rtt_update so that we won't accidentally cache a 17087 * bad value. But only do this if this is not a zero 17088 * window probe. 17089 */ 17090 if (tcp->tcp_rtt_sa != 0 && tcp->tcp_zero_win_probe == 0) { 17091 tcp->tcp_rtt_sd += (tcp->tcp_rtt_sa >> 3) + 17092 (tcp->tcp_rtt_sa >> 5); 17093 tcp->tcp_rtt_sa = 0; 17094 tcp_ip_notify(tcp); 17095 tcp->tcp_rtt_update = 0; 17096 } 17097 } 17098 tcp->tcp_timer_backoff++; 17099 if ((ms = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 17100 tcp_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5)) < 17101 tcp_rexmit_interval_min) { 17102 /* 17103 * This means the original RTO is tcp_rexmit_interval_min. 17104 * So we will use tcp_rexmit_interval_min as the RTO value 17105 * and do the backoff. 17106 */ 17107 ms = tcp_rexmit_interval_min << tcp->tcp_timer_backoff; 17108 } else { 17109 ms <<= tcp->tcp_timer_backoff; 17110 } 17111 if (ms > tcp_rexmit_interval_max) { 17112 ms = tcp_rexmit_interval_max; 17113 /* 17114 * ms is at max, decrement tcp_timer_backoff to avoid 17115 * overflow. 17116 */ 17117 tcp->tcp_timer_backoff--; 17118 } 17119 tcp->tcp_ms_we_have_waited += ms; 17120 if (tcp->tcp_zero_win_probe == 0) { 17121 tcp->tcp_rto = ms; 17122 } 17123 TCP_TIMER_RESTART(tcp, ms); 17124 /* 17125 * This is after a timeout and tcp_rto is backed off. Set 17126 * tcp_set_timer to 1 so that next time RTO is updated, we will 17127 * restart the timer with a correct value. 17128 */ 17129 tcp->tcp_set_timer = 1; 17130 mss = tcp->tcp_snxt - tcp->tcp_suna; 17131 if (mss > tcp->tcp_mss) 17132 mss = tcp->tcp_mss; 17133 if (mss > tcp->tcp_swnd && tcp->tcp_swnd != 0) 17134 mss = tcp->tcp_swnd; 17135 17136 if ((mp = tcp->tcp_xmit_head) != NULL) 17137 mp->b_prev = (mblk_t *)lbolt; 17138 mp = tcp_xmit_mp(tcp, mp, mss, NULL, NULL, tcp->tcp_suna, B_TRUE, &mss, 17139 B_TRUE); 17140 17141 /* 17142 * When slow start after retransmission begins, start with 17143 * this seq no. tcp_rexmit_max marks the end of special slow 17144 * start phase. tcp_snd_burst controls how many segments 17145 * can be sent because of an ack. 17146 */ 17147 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 17148 tcp->tcp_snd_burst = TCP_CWND_SS; 17149 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 17150 (tcp->tcp_unsent == 0)) { 17151 tcp->tcp_rexmit_max = tcp->tcp_fss; 17152 } else { 17153 tcp->tcp_rexmit_max = tcp->tcp_snxt; 17154 } 17155 tcp->tcp_rexmit = B_TRUE; 17156 tcp->tcp_dupack_cnt = 0; 17157 17158 /* 17159 * Remove all rexmit SACK blk to start from fresh. 17160 */ 17161 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 17162 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list); 17163 tcp->tcp_num_notsack_blk = 0; 17164 tcp->tcp_cnt_notsack_list = 0; 17165 } 17166 if (mp == NULL) { 17167 return; 17168 } 17169 /* Attach credentials to retransmitted initial SYNs. */ 17170 if (tcp->tcp_state == TCPS_SYN_SENT) { 17171 mblk_setcred(mp, tcp->tcp_cred); 17172 DB_CPID(mp) = tcp->tcp_cpid; 17173 } 17174 17175 tcp->tcp_csuna = tcp->tcp_snxt; 17176 BUMP_MIB(&tcp_mib, tcpRetransSegs); 17177 UPDATE_MIB(&tcp_mib, tcpRetransBytes, mss); 17178 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 17179 tcp_send_data(tcp, tcp->tcp_wq, mp); 17180 17181 } 17182 17183 /* tcp_unbind is called by tcp_wput_proto to handle T_UNBIND_REQ messages. */ 17184 static void 17185 tcp_unbind(tcp_t *tcp, mblk_t *mp) 17186 { 17187 conn_t *connp; 17188 17189 switch (tcp->tcp_state) { 17190 case TCPS_BOUND: 17191 case TCPS_LISTEN: 17192 break; 17193 default: 17194 tcp_err_ack(tcp, mp, TOUTSTATE, 0); 17195 return; 17196 } 17197 17198 /* 17199 * Need to clean up all the eagers since after the unbind, segments 17200 * will no longer be delivered to this listener stream. 17201 */ 17202 mutex_enter(&tcp->tcp_eager_lock); 17203 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 17204 tcp_eager_cleanup(tcp, 0); 17205 } 17206 mutex_exit(&tcp->tcp_eager_lock); 17207 17208 if (tcp->tcp_ipversion == IPV4_VERSION) { 17209 tcp->tcp_ipha->ipha_src = 0; 17210 } else { 17211 V6_SET_ZERO(tcp->tcp_ip6h->ip6_src); 17212 } 17213 V6_SET_ZERO(tcp->tcp_ip_src_v6); 17214 bzero(tcp->tcp_tcph->th_lport, sizeof (tcp->tcp_tcph->th_lport)); 17215 tcp_bind_hash_remove(tcp); 17216 tcp->tcp_state = TCPS_IDLE; 17217 tcp->tcp_mdt = B_FALSE; 17218 /* Send M_FLUSH according to TPI */ 17219 (void) putnextctl1(tcp->tcp_rq, M_FLUSH, FLUSHRW); 17220 connp = tcp->tcp_connp; 17221 connp->conn_mdt_ok = B_FALSE; 17222 ipcl_hash_remove(connp); 17223 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 17224 mp = mi_tpi_ok_ack_alloc(mp); 17225 putnext(tcp->tcp_rq, mp); 17226 } 17227 17228 /* 17229 * Don't let port fall into the privileged range. 17230 * Since the extra privileged ports can be arbitrary we also 17231 * ensure that we exclude those from consideration. 17232 * tcp_g_epriv_ports is not sorted thus we loop over it until 17233 * there are no changes. 17234 * 17235 * Note: No locks are held when inspecting tcp_g_*epriv_ports 17236 * but instead the code relies on: 17237 * - the fact that the address of the array and its size never changes 17238 * - the atomic assignment of the elements of the array 17239 */ 17240 static in_port_t 17241 tcp_update_next_port(in_port_t port, boolean_t random) 17242 { 17243 int i; 17244 17245 if (random && tcp_random_anon_port != 0) { 17246 (void) random_get_pseudo_bytes((uint8_t *)&port, 17247 sizeof (in_port_t)); 17248 /* 17249 * Unless changed by a sys admin, the smallest anon port 17250 * is 32768 and the largest anon port is 65535. It is 17251 * very likely (50%) for the random port to be smaller 17252 * than the smallest anon port. When that happens, 17253 * add port % (anon port range) to the smallest anon 17254 * port to get the random port. It should fall into the 17255 * valid anon port range. 17256 */ 17257 if (port < tcp_smallest_anon_port) { 17258 port = tcp_smallest_anon_port + 17259 port % (tcp_largest_anon_port - 17260 tcp_smallest_anon_port); 17261 } 17262 } 17263 17264 retry: 17265 if (port < tcp_smallest_anon_port || port > tcp_largest_anon_port) 17266 port = (in_port_t)tcp_smallest_anon_port; 17267 17268 if (port < tcp_smallest_nonpriv_port) 17269 port = (in_port_t)tcp_smallest_nonpriv_port; 17270 17271 for (i = 0; i < tcp_g_num_epriv_ports; i++) { 17272 if (port == tcp_g_epriv_ports[i]) { 17273 port++; 17274 /* 17275 * Make sure whether the port is in the 17276 * valid range. 17277 * 17278 * XXX Note that if tcp_g_epriv_ports contains 17279 * all the anonymous ports this will be an 17280 * infinite loop. 17281 */ 17282 goto retry; 17283 } 17284 } 17285 return (port); 17286 } 17287 17288 /* 17289 * Return the next anonymous port in the priviledged port range for 17290 * bind checking. It starts at IPPORT_RESERVED - 1 and goes 17291 * downwards. This is the same behavior as documented in the userland 17292 * library call rresvport(3N). 17293 */ 17294 static in_port_t 17295 tcp_get_next_priv_port(void) 17296 { 17297 static in_port_t next_priv_port = IPPORT_RESERVED - 1; 17298 17299 if (next_priv_port < tcp_min_anonpriv_port) { 17300 next_priv_port = IPPORT_RESERVED - 1; 17301 } 17302 return (next_priv_port--); 17303 } 17304 17305 /* The write side r/w procedure. */ 17306 17307 #if CCS_STATS 17308 struct { 17309 struct { 17310 int64_t count, bytes; 17311 } tot, hit; 17312 } wrw_stats; 17313 #endif 17314 17315 /* 17316 * Call by tcp_wput() to handle all non data, except M_PROTO and M_PCPROTO, 17317 * messages. 17318 */ 17319 /* ARGSUSED */ 17320 static void 17321 tcp_wput_nondata(void *arg, mblk_t *mp, void *arg2) 17322 { 17323 conn_t *connp = (conn_t *)arg; 17324 tcp_t *tcp = connp->conn_tcp; 17325 queue_t *q = tcp->tcp_wq; 17326 17327 ASSERT(DB_TYPE(mp) != M_IOCTL); 17328 /* 17329 * TCP is D_MP and qprocsoff() is done towards the end of the tcp_close. 17330 * Once the close starts, streamhead and sockfs will not let any data 17331 * packets come down (close ensures that there are no threads using the 17332 * queue and no new threads will come down) but since qprocsoff() 17333 * hasn't happened yet, a M_FLUSH or some non data message might 17334 * get reflected back (in response to our own FLUSHRW) and get 17335 * processed after tcp_close() is done. The conn would still be valid 17336 * because a ref would have added but we need to check the state 17337 * before actually processing the packet. 17338 */ 17339 if (TCP_IS_DETACHED(tcp) || (tcp->tcp_state == TCPS_CLOSED)) { 17340 freemsg(mp); 17341 return; 17342 } 17343 17344 switch (DB_TYPE(mp)) { 17345 case M_IOCDATA: 17346 tcp_wput_iocdata(tcp, mp); 17347 break; 17348 case M_FLUSH: 17349 tcp_wput_flush(tcp, mp); 17350 break; 17351 default: 17352 CALL_IP_WPUT(connp, q, mp); 17353 break; 17354 } 17355 } 17356 17357 /* 17358 * Write side put procedure for TCP module instance. 17359 * TCP as a module is only used for MIB browsers that push TCP over IP or 17360 * ARP. The only supported primitives are T_SVR4_OPTMGMT_REQ and 17361 * T_OPTMGMT_REQ. M_FLUSH messages are only passed downstream; we don't flush 17362 * our queues as we never enqueue messages there. All ioctls are NAKed and 17363 * everything else is freed. 17364 */ 17365 static void 17366 tcp_wput_mod(queue_t *q, mblk_t *mp) 17367 { 17368 switch (DB_TYPE(mp)) { 17369 case M_PROTO: 17370 case M_PCPROTO: 17371 if ((MBLKL(mp) >= sizeof (t_scalar_t)) && 17372 ((((union T_primitives *)mp->b_rptr)->type == 17373 T_SVR4_OPTMGMT_REQ) || 17374 (((union T_primitives *)mp->b_rptr)->type == 17375 T_OPTMGMT_REQ))) { 17376 /* 17377 * This is the only TPI primitive supported. Its 17378 * handling does not require tcp_t, but it does require 17379 * conn_t to check permissions. 17380 */ 17381 cred_t *cr = DB_CREDDEF(mp, Q_TO_CONN(q)->conn_cred); 17382 if (!snmpcom_req(q, mp, tcp_snmp_set, 17383 tcp_snmp_get, cr)) { 17384 freemsg(mp); 17385 return; 17386 } 17387 } else if ((mp = mi_tpi_err_ack_alloc(mp, TPROTO, ENOTSUP)) 17388 != NULL) 17389 qreply(q, mp); 17390 break; 17391 case M_FLUSH: 17392 putnext(q, mp); 17393 break; 17394 case M_IOCTL: 17395 miocnak(q, mp, 0, ENOTSUP); 17396 break; 17397 default: 17398 freemsg(mp); 17399 break; 17400 } 17401 } 17402 17403 /* 17404 * The TCP fast path write put procedure. 17405 * NOTE: the logic of the fast path is duplicated from tcp_wput_data() 17406 */ 17407 /* ARGSUSED */ 17408 static void 17409 tcp_output(void *arg, mblk_t *mp, void *arg2) 17410 { 17411 int len; 17412 int hdrlen; 17413 int plen; 17414 mblk_t *mp1; 17415 uchar_t *rptr; 17416 uint32_t snxt; 17417 tcph_t *tcph; 17418 struct datab *db; 17419 uint32_t suna; 17420 uint32_t mss; 17421 ipaddr_t *dst; 17422 ipaddr_t *src; 17423 uint32_t sum; 17424 int usable; 17425 conn_t *connp = (conn_t *)arg; 17426 tcp_t *tcp = connp->conn_tcp; 17427 17428 /* 17429 * Try and ASSERT the minimum possible references on the 17430 * conn early enough. Since we are executing on write side, 17431 * the connection is obviously not detached and that means 17432 * there is a ref each for TCP and IP. Since we are behind 17433 * the squeue, the minimum references needed are 3. If the 17434 * conn is in classifier hash list, there should be an 17435 * extra ref for that (we check both the possibilities). 17436 */ 17437 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17438 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17439 17440 /* Bypass tcp protocol for fused tcp loopback */ 17441 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp)) 17442 return; 17443 17444 mss = tcp->tcp_mss; 17445 if (tcp->tcp_xmit_zc_clean) 17446 mp = tcp_zcopy_backoff(tcp, mp, 0); 17447 17448 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 17449 len = (int)(mp->b_wptr - mp->b_rptr); 17450 17451 /* 17452 * Criteria for fast path: 17453 * 17454 * 1. no unsent data 17455 * 2. single mblk in request 17456 * 3. connection established 17457 * 4. data in mblk 17458 * 5. len <= mss 17459 * 6. no tcp_valid bits 17460 */ 17461 if ((tcp->tcp_unsent != 0) || 17462 (tcp->tcp_cork) || 17463 (mp->b_cont != NULL) || 17464 (tcp->tcp_state != TCPS_ESTABLISHED) || 17465 (len == 0) || 17466 (len > mss) || 17467 (tcp->tcp_valid_bits != 0)) { 17468 tcp_wput_data(tcp, mp, B_FALSE); 17469 return; 17470 } 17471 17472 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 17473 ASSERT(tcp->tcp_fin_sent == 0); 17474 17475 /* queue new packet onto retransmission queue */ 17476 if (tcp->tcp_xmit_head == NULL) { 17477 tcp->tcp_xmit_head = mp; 17478 } else { 17479 tcp->tcp_xmit_last->b_cont = mp; 17480 } 17481 tcp->tcp_xmit_last = mp; 17482 tcp->tcp_xmit_tail = mp; 17483 17484 /* find out how much we can send */ 17485 /* BEGIN CSTYLED */ 17486 /* 17487 * un-acked usable 17488 * |--------------|-----------------| 17489 * tcp_suna tcp_snxt tcp_suna+tcp_swnd 17490 */ 17491 /* END CSTYLED */ 17492 17493 /* start sending from tcp_snxt */ 17494 snxt = tcp->tcp_snxt; 17495 17496 /* 17497 * Check to see if this connection has been idled for some 17498 * time and no ACK is expected. If it is, we need to slow 17499 * start again to get back the connection's "self-clock" as 17500 * described in VJ's paper. 17501 * 17502 * Refer to the comment in tcp_mss_set() for the calculation 17503 * of tcp_cwnd after idle. 17504 */ 17505 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 17506 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 17507 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 17508 } 17509 17510 usable = tcp->tcp_swnd; /* tcp window size */ 17511 if (usable > tcp->tcp_cwnd) 17512 usable = tcp->tcp_cwnd; /* congestion window smaller */ 17513 usable -= snxt; /* subtract stuff already sent */ 17514 suna = tcp->tcp_suna; 17515 usable += suna; 17516 /* usable can be < 0 if the congestion window is smaller */ 17517 if (len > usable) { 17518 /* Can't send complete M_DATA in one shot */ 17519 goto slow; 17520 } 17521 17522 /* 17523 * determine if anything to send (Nagle). 17524 * 17525 * 1. len < tcp_mss (i.e. small) 17526 * 2. unacknowledged data present 17527 * 3. len < nagle limit 17528 * 4. last packet sent < nagle limit (previous packet sent) 17529 */ 17530 if ((len < mss) && (snxt != suna) && 17531 (len < (int)tcp->tcp_naglim) && 17532 (tcp->tcp_last_sent_len < tcp->tcp_naglim)) { 17533 /* 17534 * This was the first unsent packet and normally 17535 * mss < xmit_hiwater so there is no need to worry 17536 * about flow control. The next packet will go 17537 * through the flow control check in tcp_wput_data(). 17538 */ 17539 /* leftover work from above */ 17540 tcp->tcp_unsent = len; 17541 tcp->tcp_xmit_tail_unsent = len; 17542 17543 return; 17544 } 17545 17546 /* len <= tcp->tcp_mss && len == unsent so no silly window */ 17547 17548 if (snxt == suna) { 17549 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 17550 } 17551 17552 /* we have always sent something */ 17553 tcp->tcp_rack_cnt = 0; 17554 17555 tcp->tcp_snxt = snxt + len; 17556 tcp->tcp_rack = tcp->tcp_rnxt; 17557 17558 if ((mp1 = dupb(mp)) == 0) 17559 goto no_memory; 17560 mp->b_prev = (mblk_t *)(uintptr_t)lbolt; 17561 mp->b_next = (mblk_t *)(uintptr_t)snxt; 17562 17563 /* adjust tcp header information */ 17564 tcph = tcp->tcp_tcph; 17565 tcph->th_flags[0] = (TH_ACK|TH_PUSH); 17566 17567 sum = len + tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 17568 sum = (sum >> 16) + (sum & 0xFFFF); 17569 U16_TO_ABE16(sum, tcph->th_sum); 17570 17571 U32_TO_ABE32(snxt, tcph->th_seq); 17572 17573 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 17574 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 17575 BUMP_LOCAL(tcp->tcp_obsegs); 17576 17577 /* Update the latest receive window size in TCP header. */ 17578 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 17579 tcph->th_win); 17580 17581 tcp->tcp_last_sent_len = (ushort_t)len; 17582 17583 plen = len + tcp->tcp_hdr_len; 17584 17585 if (tcp->tcp_ipversion == IPV4_VERSION) { 17586 tcp->tcp_ipha->ipha_length = htons(plen); 17587 } else { 17588 tcp->tcp_ip6h->ip6_plen = htons(plen - 17589 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 17590 } 17591 17592 /* see if we need to allocate a mblk for the headers */ 17593 hdrlen = tcp->tcp_hdr_len; 17594 rptr = mp1->b_rptr - hdrlen; 17595 db = mp1->b_datap; 17596 if ((db->db_ref != 2) || rptr < db->db_base || 17597 (!OK_32PTR(rptr))) { 17598 /* NOTE: we assume allocb returns an OK_32PTR */ 17599 mp = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 17600 tcp_wroff_xtra, BPRI_MED); 17601 if (!mp) { 17602 freemsg(mp1); 17603 goto no_memory; 17604 } 17605 mp->b_cont = mp1; 17606 mp1 = mp; 17607 /* Leave room for Link Level header */ 17608 /* hdrlen = tcp->tcp_hdr_len; */ 17609 rptr = &mp1->b_rptr[tcp_wroff_xtra]; 17610 mp1->b_wptr = &rptr[hdrlen]; 17611 } 17612 mp1->b_rptr = rptr; 17613 17614 /* Fill in the timestamp option. */ 17615 if (tcp->tcp_snd_ts_ok) { 17616 U32_TO_BE32((uint32_t)lbolt, 17617 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 17618 U32_TO_BE32(tcp->tcp_ts_recent, 17619 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 17620 } else { 17621 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 17622 } 17623 17624 /* copy header into outgoing packet */ 17625 dst = (ipaddr_t *)rptr; 17626 src = (ipaddr_t *)tcp->tcp_iphc; 17627 dst[0] = src[0]; 17628 dst[1] = src[1]; 17629 dst[2] = src[2]; 17630 dst[3] = src[3]; 17631 dst[4] = src[4]; 17632 dst[5] = src[5]; 17633 dst[6] = src[6]; 17634 dst[7] = src[7]; 17635 dst[8] = src[8]; 17636 dst[9] = src[9]; 17637 if (hdrlen -= 40) { 17638 hdrlen >>= 2; 17639 dst += 10; 17640 src += 10; 17641 do { 17642 *dst++ = *src++; 17643 } while (--hdrlen); 17644 } 17645 17646 /* 17647 * Set the ECN info in the TCP header. Note that this 17648 * is not the template header. 17649 */ 17650 if (tcp->tcp_ecn_ok) { 17651 SET_ECT(tcp, rptr); 17652 17653 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 17654 if (tcp->tcp_ecn_echo_on) 17655 tcph->th_flags[0] |= TH_ECE; 17656 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 17657 tcph->th_flags[0] |= TH_CWR; 17658 tcp->tcp_ecn_cwr_sent = B_TRUE; 17659 } 17660 } 17661 17662 if (tcp->tcp_ip_forward_progress) { 17663 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 17664 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 17665 tcp->tcp_ip_forward_progress = B_FALSE; 17666 } 17667 TCP_RECORD_TRACE(tcp, mp1, TCP_TRACE_SEND_PKT); 17668 tcp_send_data(tcp, tcp->tcp_wq, mp1); 17669 return; 17670 17671 /* 17672 * If we ran out of memory, we pretend to have sent the packet 17673 * and that it was lost on the wire. 17674 */ 17675 no_memory: 17676 return; 17677 17678 slow: 17679 /* leftover work from above */ 17680 tcp->tcp_unsent = len; 17681 tcp->tcp_xmit_tail_unsent = len; 17682 tcp_wput_data(tcp, NULL, B_FALSE); 17683 } 17684 17685 /* 17686 * The function called through squeue to get behind eager's perimeter to 17687 * finish the accept processing. 17688 */ 17689 /* ARGSUSED */ 17690 void 17691 tcp_accept_finish(void *arg, mblk_t *mp, void *arg2) 17692 { 17693 conn_t *connp = (conn_t *)arg; 17694 tcp_t *tcp = connp->conn_tcp; 17695 queue_t *q = tcp->tcp_rq; 17696 mblk_t *mp1; 17697 mblk_t *stropt_mp = mp; 17698 struct stroptions *stropt; 17699 uint_t thwin; 17700 17701 /* 17702 * Drop the eager's ref on the listener, that was placed when 17703 * this eager began life in tcp_conn_request. 17704 */ 17705 CONN_DEC_REF(tcp->tcp_saved_listener->tcp_connp); 17706 17707 if (tcp->tcp_state <= TCPS_BOUND || tcp->tcp_accept_error) { 17708 /* 17709 * Someone blewoff the eager before we could finish 17710 * the accept. 17711 * 17712 * The only reason eager exists it because we put in 17713 * a ref on it when conn ind went up. We need to send 17714 * a disconnect indication up while the last reference 17715 * on the eager will be dropped by the squeue when we 17716 * return. 17717 */ 17718 ASSERT(tcp->tcp_listener == NULL); 17719 if (tcp->tcp_issocket || tcp->tcp_send_discon_ind) { 17720 struct T_discon_ind *tdi; 17721 17722 (void) putnextctl1(q, M_FLUSH, FLUSHRW); 17723 /* 17724 * Let us reuse the incoming mblk to avoid memory 17725 * allocation failure problems. We know that the 17726 * size of the incoming mblk i.e. stroptions is greater 17727 * than sizeof T_discon_ind. So the reallocb below 17728 * can't fail. 17729 */ 17730 freemsg(mp->b_cont); 17731 mp->b_cont = NULL; 17732 ASSERT(DB_REF(mp) == 1); 17733 mp = reallocb(mp, sizeof (struct T_discon_ind), 17734 B_FALSE); 17735 ASSERT(mp != NULL); 17736 DB_TYPE(mp) = M_PROTO; 17737 ((union T_primitives *)mp->b_rptr)->type = T_DISCON_IND; 17738 tdi = (struct T_discon_ind *)mp->b_rptr; 17739 if (tcp->tcp_issocket) { 17740 tdi->DISCON_reason = ECONNREFUSED; 17741 tdi->SEQ_number = 0; 17742 } else { 17743 tdi->DISCON_reason = ENOPROTOOPT; 17744 tdi->SEQ_number = 17745 tcp->tcp_conn_req_seqnum; 17746 } 17747 mp->b_wptr = mp->b_rptr + sizeof (struct T_discon_ind); 17748 putnext(q, mp); 17749 } else { 17750 freemsg(mp); 17751 } 17752 if (tcp->tcp_hard_binding) { 17753 tcp->tcp_hard_binding = B_FALSE; 17754 tcp->tcp_hard_bound = B_TRUE; 17755 } 17756 tcp->tcp_detached = B_FALSE; 17757 return; 17758 } 17759 17760 mp1 = stropt_mp->b_cont; 17761 stropt_mp->b_cont = NULL; 17762 ASSERT(DB_TYPE(stropt_mp) == M_SETOPTS); 17763 stropt = (struct stroptions *)stropt_mp->b_rptr; 17764 17765 while (mp1 != NULL) { 17766 mp = mp1; 17767 mp1 = mp1->b_cont; 17768 mp->b_cont = NULL; 17769 tcp->tcp_drop_opt_ack_cnt++; 17770 CALL_IP_WPUT(connp, tcp->tcp_wq, mp); 17771 } 17772 mp = NULL; 17773 17774 /* 17775 * Set the max window size (tcp_rq->q_hiwat) of the acceptor 17776 * properly. This is the first time we know of the acceptor' 17777 * queue. So we do it here. 17778 */ 17779 if (tcp->tcp_rcv_list == NULL) { 17780 /* 17781 * Recv queue is empty, tcp_rwnd should not have changed. 17782 * That means it should be equal to the listener's tcp_rwnd. 17783 */ 17784 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd; 17785 } else { 17786 #ifdef DEBUG 17787 uint_t cnt = 0; 17788 17789 mp1 = tcp->tcp_rcv_list; 17790 while ((mp = mp1) != NULL) { 17791 mp1 = mp->b_next; 17792 cnt += msgdsize(mp); 17793 } 17794 ASSERT(cnt != 0 && tcp->tcp_rcv_cnt == cnt); 17795 #endif 17796 /* There is some data, add them back to get the max. */ 17797 tcp->tcp_rq->q_hiwat = tcp->tcp_rwnd + tcp->tcp_rcv_cnt; 17798 } 17799 17800 stropt->so_flags = SO_HIWAT; 17801 stropt->so_hiwat = MAX(q->q_hiwat, tcp_sth_rcv_hiwat); 17802 17803 stropt->so_flags |= SO_MAXBLK; 17804 stropt->so_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 17805 17806 /* 17807 * This is the first time we run on the correct 17808 * queue after tcp_accept. So fix all the q parameters 17809 * here. 17810 */ 17811 /* Allocate room for SACK options if needed. */ 17812 stropt->so_flags |= SO_WROFF; 17813 if (tcp->tcp_fused) { 17814 size_t sth_hiwat; 17815 17816 ASSERT(tcp->tcp_loopback); 17817 /* 17818 * For fused tcp loopback, set the stream head's write 17819 * offset value to zero since we won't be needing any room 17820 * for TCP/IP headers. This would also improve performance 17821 * since it would reduce the amount of work done by kmem. 17822 * Non-fused tcp loopback case is handled separately below. 17823 */ 17824 stropt->so_wroff = 0; 17825 17826 /* 17827 * Override q_hiwat and set it to be twice that of the 17828 * previous value; this is to simulate non-fusion case. 17829 */ 17830 sth_hiwat = q->q_hiwat << 1; 17831 if (sth_hiwat > tcp_max_buf) 17832 sth_hiwat = tcp_max_buf; 17833 17834 stropt->so_hiwat = MAX(sth_hiwat, tcp_sth_rcv_hiwat); 17835 } else if (tcp->tcp_snd_sack_ok) { 17836 stropt->so_wroff = tcp->tcp_hdr_len + TCPOPT_MAX_SACK_LEN + 17837 (tcp->tcp_loopback ? 0 : tcp_wroff_xtra); 17838 } else { 17839 stropt->so_wroff = tcp->tcp_hdr_len + (tcp->tcp_loopback ? 0 : 17840 tcp_wroff_xtra); 17841 } 17842 17843 /* 17844 * If loopback, set COPYCACHED option to make sure NOT to use 17845 * non-temporal access. 17846 */ 17847 if (tcp->tcp_loopback) { 17848 stropt->so_flags |= SO_COPYOPT; 17849 stropt->so_copyopt = COPYCACHED; 17850 } 17851 17852 /* Send the options up */ 17853 putnext(q, stropt_mp); 17854 17855 /* 17856 * Pass up any data and/or a fin that has been received. 17857 * 17858 * Adjust receive window in case it had decreased 17859 * (because there is data <=> tcp_rcv_list != NULL) 17860 * while the connection was detached. Note that 17861 * in case the eager was flow-controlled, w/o this 17862 * code, the rwnd may never open up again! 17863 */ 17864 if (tcp->tcp_rcv_list != NULL) { 17865 /* We drain directly in case of fused tcp loopback */ 17866 if (!tcp->tcp_fused && canputnext(q)) { 17867 tcp->tcp_rwnd = q->q_hiwat; 17868 thwin = ((uint_t)BE16_TO_U16(tcp->tcp_tcph->th_win)) 17869 << tcp->tcp_rcv_ws; 17870 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 17871 if (tcp->tcp_state >= TCPS_ESTABLISHED && 17872 (q->q_hiwat - thwin >= tcp->tcp_mss)) { 17873 tcp_xmit_ctl(NULL, 17874 tcp, (tcp->tcp_swnd == 0) ? 17875 tcp->tcp_suna : tcp->tcp_snxt, 17876 tcp->tcp_rnxt, TH_ACK); 17877 BUMP_MIB(&tcp_mib, tcpOutWinUpdate); 17878 } 17879 17880 } 17881 (void) tcp_rcv_drain(q, tcp); 17882 17883 /* 17884 * For fused tcp loopback, back-enable peer endpoint 17885 * if it's currently flow-controlled. 17886 */ 17887 if (tcp->tcp_fused && 17888 tcp->tcp_loopback_peer->tcp_flow_stopped) { 17889 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 17890 17891 ASSERT(peer_tcp != NULL); 17892 ASSERT(peer_tcp->tcp_fused); 17893 17894 tcp_clrqfull(peer_tcp); 17895 peer_tcp->tcp_flow_stopped = B_FALSE; 17896 TCP_STAT(tcp_fusion_backenabled); 17897 } 17898 } 17899 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 17900 if (tcp->tcp_fin_rcvd && !tcp->tcp_ordrel_done) { 17901 mp = mi_tpi_ordrel_ind(); 17902 if (mp) { 17903 tcp->tcp_ordrel_done = B_TRUE; 17904 putnext(q, mp); 17905 if (tcp->tcp_deferred_clean_death) { 17906 /* 17907 * tcp_clean_death was deferred 17908 * for T_ORDREL_IND - do it now 17909 */ 17910 (void) tcp_clean_death( 17911 tcp, 17912 tcp->tcp_client_errno, 21); 17913 tcp->tcp_deferred_clean_death = 17914 B_FALSE; 17915 } 17916 } else { 17917 /* 17918 * Run the orderly release in the 17919 * service routine. 17920 */ 17921 qenable(q); 17922 } 17923 } 17924 if (tcp->tcp_hard_binding) { 17925 tcp->tcp_hard_binding = B_FALSE; 17926 tcp->tcp_hard_bound = B_TRUE; 17927 } 17928 tcp->tcp_detached = B_FALSE; 17929 17930 if (tcp->tcp_ka_enabled) { 17931 tcp->tcp_ka_last_intrvl = 0; 17932 tcp->tcp_ka_tid = TCP_TIMER(tcp, tcp_keepalive_killer, 17933 MSEC_TO_TICK(tcp->tcp_ka_interval)); 17934 } 17935 17936 /* 17937 * At this point, eager is fully established and will 17938 * have the following references - 17939 * 17940 * 2 references for connection to exist (1 for TCP and 1 for IP). 17941 * 1 reference for the squeue which will be dropped by the squeue as 17942 * soon as this function returns. 17943 * There will be 1 additonal reference for being in classifier 17944 * hash list provided something bad hasn't happened. 17945 */ 17946 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 17947 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 17948 } 17949 17950 /* 17951 * The function called through squeue to get behind listener's perimeter to 17952 * send a deffered conn_ind. 17953 */ 17954 /* ARGSUSED */ 17955 void 17956 tcp_send_pending(void *arg, mblk_t *mp, void *arg2) 17957 { 17958 conn_t *connp = (conn_t *)arg; 17959 tcp_t *listener = connp->conn_tcp; 17960 17961 if (listener->tcp_state == TCPS_CLOSED || 17962 TCP_IS_DETACHED(listener)) { 17963 /* 17964 * If listener has closed, it would have caused a 17965 * a cleanup/blowoff to happen for the eager. 17966 */ 17967 tcp_t *tcp; 17968 struct T_conn_ind *conn_ind; 17969 17970 conn_ind = (struct T_conn_ind *)mp->b_rptr; 17971 bcopy(mp->b_rptr + conn_ind->OPT_offset, &tcp, 17972 conn_ind->OPT_length); 17973 /* 17974 * We need to drop the ref on eager that was put 17975 * tcp_rput_data() before trying to send the conn_ind 17976 * to listener. The conn_ind was deferred in tcp_send_conn_ind 17977 * and tcp_wput_accept() is sending this deferred conn_ind but 17978 * listener is closed so we drop the ref. 17979 */ 17980 CONN_DEC_REF(tcp->tcp_connp); 17981 freemsg(mp); 17982 return; 17983 } 17984 putnext(listener->tcp_rq, mp); 17985 } 17986 17987 17988 /* 17989 * This is the STREAMS entry point for T_CONN_RES coming down on 17990 * Acceptor STREAM when sockfs listener does accept processing. 17991 * Read the block comment on top pf tcp_conn_request(). 17992 */ 17993 void 17994 tcp_wput_accept(queue_t *q, mblk_t *mp) 17995 { 17996 queue_t *rq = RD(q); 17997 struct T_conn_res *conn_res; 17998 tcp_t *eager; 17999 tcp_t *listener; 18000 struct T_ok_ack *ok; 18001 t_scalar_t PRIM_type; 18002 mblk_t *opt_mp; 18003 conn_t *econnp; 18004 18005 ASSERT(DB_TYPE(mp) == M_PROTO); 18006 18007 conn_res = (struct T_conn_res *)mp->b_rptr; 18008 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 18009 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_conn_res)) { 18010 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 18011 if (mp != NULL) 18012 putnext(rq, mp); 18013 return; 18014 } 18015 switch (conn_res->PRIM_type) { 18016 case O_T_CONN_RES: 18017 case T_CONN_RES: 18018 /* 18019 * We pass up an err ack if allocb fails. This will 18020 * cause sockfs to issue a T_DISCON_REQ which will cause 18021 * tcp_eager_blowoff to be called. sockfs will then call 18022 * rq->q_qinfo->qi_qclose to cleanup the acceptor stream. 18023 * we need to do the allocb up here because we have to 18024 * make sure rq->q_qinfo->qi_qclose still points to the 18025 * correct function (tcpclose_accept) in case allocb 18026 * fails. 18027 */ 18028 opt_mp = allocb(sizeof (struct stroptions), BPRI_HI); 18029 if (opt_mp == NULL) { 18030 mp = mi_tpi_err_ack_alloc(mp, TPROTO, 0); 18031 if (mp != NULL) 18032 putnext(rq, mp); 18033 return; 18034 } 18035 18036 bcopy(mp->b_rptr + conn_res->OPT_offset, 18037 &eager, conn_res->OPT_length); 18038 PRIM_type = conn_res->PRIM_type; 18039 mp->b_datap->db_type = M_PCPROTO; 18040 mp->b_wptr = mp->b_rptr + sizeof (struct T_ok_ack); 18041 ok = (struct T_ok_ack *)mp->b_rptr; 18042 ok->PRIM_type = T_OK_ACK; 18043 ok->CORRECT_prim = PRIM_type; 18044 econnp = eager->tcp_connp; 18045 econnp->conn_dev = (dev_t)q->q_ptr; 18046 eager->tcp_rq = rq; 18047 eager->tcp_wq = q; 18048 rq->q_ptr = econnp; 18049 rq->q_qinfo = &tcp_rinit; 18050 q->q_ptr = econnp; 18051 q->q_qinfo = &tcp_winit; 18052 listener = eager->tcp_listener; 18053 eager->tcp_issocket = B_TRUE; 18054 eager->tcp_cred = econnp->conn_cred = 18055 listener->tcp_connp->conn_cred; 18056 crhold(econnp->conn_cred); 18057 econnp->conn_zoneid = listener->tcp_connp->conn_zoneid; 18058 18059 /* Put the ref for IP */ 18060 CONN_INC_REF(econnp); 18061 18062 /* 18063 * We should have minimum of 3 references on the conn 18064 * at this point. One each for TCP and IP and one for 18065 * the T_conn_ind that was sent up when the 3-way handshake 18066 * completed. In the normal case we would also have another 18067 * reference (making a total of 4) for the conn being in the 18068 * classifier hash list. However the eager could have received 18069 * an RST subsequently and tcp_closei_local could have removed 18070 * the eager from the classifier hash list, hence we can't 18071 * assert that reference. 18072 */ 18073 ASSERT(econnp->conn_ref >= 3); 18074 18075 /* 18076 * Send the new local address also up to sockfs. There 18077 * should already be enough space in the mp that came 18078 * down from soaccept(). 18079 */ 18080 if (eager->tcp_family == AF_INET) { 18081 sin_t *sin; 18082 18083 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 18084 (sizeof (struct T_ok_ack) + sizeof (sin_t))); 18085 sin = (sin_t *)mp->b_wptr; 18086 mp->b_wptr += sizeof (sin_t); 18087 sin->sin_family = AF_INET; 18088 sin->sin_port = eager->tcp_lport; 18089 sin->sin_addr.s_addr = eager->tcp_ipha->ipha_src; 18090 } else { 18091 sin6_t *sin6; 18092 18093 ASSERT((mp->b_datap->db_lim - mp->b_datap->db_base) >= 18094 sizeof (struct T_ok_ack) + sizeof (sin6_t)); 18095 sin6 = (sin6_t *)mp->b_wptr; 18096 mp->b_wptr += sizeof (sin6_t); 18097 sin6->sin6_family = AF_INET6; 18098 sin6->sin6_port = eager->tcp_lport; 18099 if (eager->tcp_ipversion == IPV4_VERSION) { 18100 sin6->sin6_flowinfo = 0; 18101 IN6_IPADDR_TO_V4MAPPED( 18102 eager->tcp_ipha->ipha_src, 18103 &sin6->sin6_addr); 18104 } else { 18105 ASSERT(eager->tcp_ip6h != NULL); 18106 sin6->sin6_flowinfo = 18107 eager->tcp_ip6h->ip6_vcf & 18108 ~IPV6_VERS_AND_FLOW_MASK; 18109 sin6->sin6_addr = eager->tcp_ip6h->ip6_src; 18110 } 18111 sin6->sin6_scope_id = 0; 18112 sin6->__sin6_src_id = 0; 18113 } 18114 18115 putnext(rq, mp); 18116 18117 opt_mp->b_datap->db_type = M_SETOPTS; 18118 opt_mp->b_wptr += sizeof (struct stroptions); 18119 18120 /* 18121 * Prepare for inheriting IPV6_BOUND_IF and IPV6_RECVPKTINFO 18122 * from listener to acceptor. The message is chained on the 18123 * bind_mp which tcp_rput_other will send down to IP. 18124 */ 18125 if (listener->tcp_bound_if != 0) { 18126 /* allocate optmgmt req */ 18127 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 18128 IPV6_BOUND_IF, (char *)&listener->tcp_bound_if, 18129 sizeof (int)); 18130 if (mp != NULL) 18131 linkb(opt_mp, mp); 18132 } 18133 if (listener->tcp_ipv6_recvancillary & TCP_IPV6_RECVPKTINFO) { 18134 uint_t on = 1; 18135 18136 /* allocate optmgmt req */ 18137 mp = tcp_setsockopt_mp(IPPROTO_IPV6, 18138 IPV6_RECVPKTINFO, (char *)&on, sizeof (on)); 18139 if (mp != NULL) 18140 linkb(opt_mp, mp); 18141 } 18142 18143 18144 mutex_enter(&listener->tcp_eager_lock); 18145 18146 if (listener->tcp_eager_prev_q0->tcp_conn_def_q0) { 18147 18148 tcp_t *tail; 18149 tcp_t *tcp; 18150 mblk_t *mp1; 18151 18152 tcp = listener->tcp_eager_prev_q0; 18153 /* 18154 * listener->tcp_eager_prev_q0 points to the TAIL of the 18155 * deferred T_conn_ind queue. We need to get to the head 18156 * of the queue in order to send up T_conn_ind the same 18157 * order as how the 3WHS is completed. 18158 */ 18159 while (tcp != listener) { 18160 if (!tcp->tcp_eager_prev_q0->tcp_conn_def_q0) 18161 break; 18162 else 18163 tcp = tcp->tcp_eager_prev_q0; 18164 } 18165 ASSERT(tcp != listener); 18166 mp1 = tcp->tcp_conn.tcp_eager_conn_ind; 18167 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 18168 /* Move from q0 to q */ 18169 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 18170 listener->tcp_conn_req_cnt_q0--; 18171 listener->tcp_conn_req_cnt_q++; 18172 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 18173 tcp->tcp_eager_prev_q0; 18174 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 18175 tcp->tcp_eager_next_q0; 18176 tcp->tcp_eager_prev_q0 = NULL; 18177 tcp->tcp_eager_next_q0 = NULL; 18178 tcp->tcp_conn_def_q0 = B_FALSE; 18179 18180 /* 18181 * Insert at end of the queue because sockfs sends 18182 * down T_CONN_RES in chronological order. Leaving 18183 * the older conn indications at front of the queue 18184 * helps reducing search time. 18185 */ 18186 tail = listener->tcp_eager_last_q; 18187 if (tail != NULL) { 18188 tail->tcp_eager_next_q = tcp; 18189 } else { 18190 listener->tcp_eager_next_q = tcp; 18191 } 18192 listener->tcp_eager_last_q = tcp; 18193 tcp->tcp_eager_next_q = NULL; 18194 18195 /* Need to get inside the listener perimeter */ 18196 CONN_INC_REF(listener->tcp_connp); 18197 squeue_fill(listener->tcp_connp->conn_sqp, mp1, 18198 tcp_send_pending, listener->tcp_connp, 18199 SQTAG_TCP_SEND_PENDING); 18200 } 18201 tcp_eager_unlink(eager); 18202 mutex_exit(&listener->tcp_eager_lock); 18203 18204 /* 18205 * At this point, the eager is detached from the listener 18206 * but we still have an extra refs on eager (apart from the 18207 * usual tcp references). The ref was placed in tcp_rput_data 18208 * before sending the conn_ind in tcp_send_conn_ind. 18209 * The ref will be dropped in tcp_accept_finish(). 18210 */ 18211 squeue_enter_nodrain(econnp->conn_sqp, opt_mp, 18212 tcp_accept_finish, econnp, SQTAG_TCP_ACCEPT_FINISH_Q0); 18213 return; 18214 default: 18215 mp = mi_tpi_err_ack_alloc(mp, TNOTSUPPORT, 0); 18216 if (mp != NULL) 18217 putnext(rq, mp); 18218 return; 18219 } 18220 } 18221 18222 static void 18223 tcp_wput(queue_t *q, mblk_t *mp) 18224 { 18225 conn_t *connp = Q_TO_CONN(q); 18226 tcp_t *tcp; 18227 void (*output_proc)(); 18228 t_scalar_t type; 18229 uchar_t *rptr; 18230 struct iocblk *iocp; 18231 18232 ASSERT(connp->conn_ref >= 2); 18233 18234 switch (DB_TYPE(mp)) { 18235 case M_DATA: 18236 CONN_INC_REF(connp); 18237 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 18238 tcp_output, connp, SQTAG_TCP_OUTPUT); 18239 return; 18240 case M_PROTO: 18241 case M_PCPROTO: 18242 /* 18243 * if it is a snmp message, don't get behind the squeue 18244 */ 18245 tcp = connp->conn_tcp; 18246 rptr = mp->b_rptr; 18247 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 18248 type = ((union T_primitives *)rptr)->type; 18249 } else { 18250 if (tcp->tcp_debug) { 18251 (void) strlog(TCP_MODULE_ID, 0, 1, 18252 SL_ERROR|SL_TRACE, 18253 "tcp_wput_proto, dropping one..."); 18254 } 18255 freemsg(mp); 18256 return; 18257 } 18258 if (type == T_SVR4_OPTMGMT_REQ) { 18259 cred_t *cr = DB_CREDDEF(mp, 18260 tcp->tcp_cred); 18261 if (snmpcom_req(q, mp, tcp_snmp_set, tcp_snmp_get, 18262 cr)) { 18263 /* 18264 * This was a SNMP request 18265 */ 18266 return; 18267 } else { 18268 output_proc = tcp_wput_proto; 18269 } 18270 } else { 18271 output_proc = tcp_wput_proto; 18272 } 18273 break; 18274 case M_IOCTL: 18275 /* 18276 * Most ioctls can be processed right away without going via 18277 * squeues - process them right here. Those that do require 18278 * squeue (currently TCP_IOC_DEFAULT_Q and SIOCPOPSOCKFS) 18279 * are processed by tcp_wput_ioctl(). 18280 */ 18281 iocp = (struct iocblk *)mp->b_rptr; 18282 tcp = connp->conn_tcp; 18283 18284 switch (iocp->ioc_cmd) { 18285 case TCP_IOC_ABORT_CONN: 18286 tcp_ioctl_abort_conn(q, mp); 18287 return; 18288 case TI_GETPEERNAME: 18289 if (tcp->tcp_state < TCPS_SYN_RCVD) { 18290 iocp->ioc_error = ENOTCONN; 18291 iocp->ioc_count = 0; 18292 mp->b_datap->db_type = M_IOCACK; 18293 qreply(q, mp); 18294 return; 18295 } 18296 /* FALLTHRU */ 18297 case TI_GETMYNAME: 18298 mi_copyin(q, mp, NULL, 18299 SIZEOF_STRUCT(strbuf, iocp->ioc_flag)); 18300 return; 18301 case ND_SET: 18302 /* nd_getset does the necessary checks */ 18303 case ND_GET: 18304 if (!nd_getset(q, tcp_g_nd, mp)) { 18305 CALL_IP_WPUT(connp, q, mp); 18306 return; 18307 } 18308 qreply(q, mp); 18309 return; 18310 case TCP_IOC_DEFAULT_Q: 18311 /* 18312 * Wants to be the default wq. Check the credentials 18313 * first, the rest is executed via squeue. 18314 */ 18315 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 18316 iocp->ioc_error = EPERM; 18317 iocp->ioc_count = 0; 18318 mp->b_datap->db_type = M_IOCACK; 18319 qreply(q, mp); 18320 return; 18321 } 18322 output_proc = tcp_wput_ioctl; 18323 break; 18324 default: 18325 output_proc = tcp_wput_ioctl; 18326 break; 18327 } 18328 break; 18329 default: 18330 output_proc = tcp_wput_nondata; 18331 break; 18332 } 18333 18334 CONN_INC_REF(connp); 18335 (*tcp_squeue_wput_proc)(connp->conn_sqp, mp, 18336 output_proc, connp, SQTAG_TCP_WPUT_OTHER); 18337 } 18338 18339 /* 18340 * Initial STREAMS write side put() procedure for sockets. It tries to 18341 * handle the T_CAPABILITY_REQ which sockfs sends down while setting 18342 * up the socket without using the squeue. Non T_CAPABILITY_REQ messages 18343 * are handled by tcp_wput() as usual. 18344 * 18345 * All further messages will also be handled by tcp_wput() because we cannot 18346 * be sure that the above short cut is safe later. 18347 */ 18348 static void 18349 tcp_wput_sock(queue_t *wq, mblk_t *mp) 18350 { 18351 conn_t *connp = Q_TO_CONN(wq); 18352 tcp_t *tcp = connp->conn_tcp; 18353 struct T_capability_req *car = (struct T_capability_req *)mp->b_rptr; 18354 18355 ASSERT(wq->q_qinfo == &tcp_sock_winit); 18356 wq->q_qinfo = &tcp_winit; 18357 18358 ASSERT(IS_TCP_CONN(connp)); 18359 ASSERT(TCP_IS_SOCKET(tcp)); 18360 18361 if (DB_TYPE(mp) == M_PCPROTO && 18362 MBLKL(mp) == sizeof (struct T_capability_req) && 18363 car->PRIM_type == T_CAPABILITY_REQ) { 18364 tcp_capability_req(tcp, mp); 18365 return; 18366 } 18367 18368 tcp_wput(wq, mp); 18369 } 18370 18371 static boolean_t 18372 tcp_zcopy_check(tcp_t *tcp) 18373 { 18374 conn_t *connp = tcp->tcp_connp; 18375 ire_t *ire; 18376 boolean_t zc_enabled = B_FALSE; 18377 18378 if (do_tcpzcopy == 2) 18379 zc_enabled = B_TRUE; 18380 else if (tcp->tcp_ipversion == IPV4_VERSION && 18381 IPCL_IS_CONNECTED(connp) && 18382 (connp->conn_flags & IPCL_CHECK_POLICY) == 0 && 18383 connp->conn_dontroute == 0 && 18384 connp->conn_xmit_if_ill == NULL && 18385 connp->conn_nofailover_ill == NULL && 18386 do_tcpzcopy == 1) { 18387 /* 18388 * the checks above closely resemble the fast path checks 18389 * in tcp_send_data(). 18390 */ 18391 mutex_enter(&connp->conn_lock); 18392 ire = connp->conn_ire_cache; 18393 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18394 if (ire != NULL && !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18395 IRE_REFHOLD(ire); 18396 if (ire->ire_stq != NULL) { 18397 ill_t *ill = (ill_t *)ire->ire_stq->q_ptr; 18398 18399 zc_enabled = ill && (ill->ill_capabilities & 18400 ILL_CAPAB_ZEROCOPY) && 18401 (ill->ill_zerocopy_capab-> 18402 ill_zerocopy_flags != 0); 18403 } 18404 IRE_REFRELE(ire); 18405 } 18406 mutex_exit(&connp->conn_lock); 18407 } 18408 tcp->tcp_snd_zcopy_on = zc_enabled; 18409 if (!TCP_IS_DETACHED(tcp)) { 18410 if (zc_enabled) { 18411 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMSAFE); 18412 TCP_STAT(tcp_zcopy_on); 18413 } else { 18414 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18415 TCP_STAT(tcp_zcopy_off); 18416 } 18417 } 18418 return (zc_enabled); 18419 } 18420 18421 static mblk_t * 18422 tcp_zcopy_disable(tcp_t *tcp, mblk_t *bp) 18423 { 18424 if (do_tcpzcopy == 2) 18425 return (bp); 18426 else if (tcp->tcp_snd_zcopy_on) { 18427 tcp->tcp_snd_zcopy_on = B_FALSE; 18428 if (!TCP_IS_DETACHED(tcp)) { 18429 (void) mi_set_sth_copyopt(tcp->tcp_rq, ZCVMUNSAFE); 18430 TCP_STAT(tcp_zcopy_disable); 18431 } 18432 } 18433 return (tcp_zcopy_backoff(tcp, bp, 0)); 18434 } 18435 18436 /* 18437 * Backoff from a zero-copy mblk by copying data to a new mblk and freeing 18438 * the original desballoca'ed segmapped mblk. 18439 */ 18440 static mblk_t * 18441 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, int fix_xmitlist) 18442 { 18443 mblk_t *head, *tail, *nbp; 18444 if (IS_VMLOANED_MBLK(bp)) { 18445 TCP_STAT(tcp_zcopy_backoff); 18446 if ((head = copyb(bp)) == NULL) { 18447 /* fail to backoff; leave it for the next backoff */ 18448 tcp->tcp_xmit_zc_clean = B_FALSE; 18449 return (bp); 18450 } 18451 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18452 if (fix_xmitlist) 18453 tcp_zcopy_notify(tcp); 18454 else 18455 head->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18456 } 18457 nbp = bp->b_cont; 18458 if (fix_xmitlist) { 18459 head->b_prev = bp->b_prev; 18460 head->b_next = bp->b_next; 18461 if (tcp->tcp_xmit_tail == bp) 18462 tcp->tcp_xmit_tail = head; 18463 } 18464 bp->b_next = NULL; 18465 bp->b_prev = NULL; 18466 freeb(bp); 18467 } else { 18468 head = bp; 18469 nbp = bp->b_cont; 18470 } 18471 tail = head; 18472 while (nbp) { 18473 if (IS_VMLOANED_MBLK(nbp)) { 18474 TCP_STAT(tcp_zcopy_backoff); 18475 if ((tail->b_cont = copyb(nbp)) == NULL) { 18476 tcp->tcp_xmit_zc_clean = B_FALSE; 18477 tail->b_cont = nbp; 18478 return (head); 18479 } 18480 tail = tail->b_cont; 18481 if (nbp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 18482 if (fix_xmitlist) 18483 tcp_zcopy_notify(tcp); 18484 else 18485 tail->b_datap->db_struioflag |= 18486 STRUIO_ZCNOTIFY; 18487 } 18488 bp = nbp; 18489 nbp = nbp->b_cont; 18490 if (fix_xmitlist) { 18491 tail->b_prev = bp->b_prev; 18492 tail->b_next = bp->b_next; 18493 if (tcp->tcp_xmit_tail == bp) 18494 tcp->tcp_xmit_tail = tail; 18495 } 18496 bp->b_next = NULL; 18497 bp->b_prev = NULL; 18498 freeb(bp); 18499 } else { 18500 tail->b_cont = nbp; 18501 tail = nbp; 18502 nbp = nbp->b_cont; 18503 } 18504 } 18505 if (fix_xmitlist) { 18506 tcp->tcp_xmit_last = tail; 18507 tcp->tcp_xmit_zc_clean = B_TRUE; 18508 } 18509 return (head); 18510 } 18511 18512 static void 18513 tcp_zcopy_notify(tcp_t *tcp) 18514 { 18515 struct stdata *stp; 18516 18517 if (tcp->tcp_detached) 18518 return; 18519 stp = STREAM(tcp->tcp_rq); 18520 mutex_enter(&stp->sd_lock); 18521 stp->sd_flag |= STZCNOTIFY; 18522 cv_broadcast(&stp->sd_zcopy_wait); 18523 mutex_exit(&stp->sd_lock); 18524 } 18525 18526 18527 static void 18528 tcp_send_data(tcp_t *tcp, queue_t *q, mblk_t *mp) 18529 { 18530 ipha_t *ipha; 18531 ipaddr_t src; 18532 ipaddr_t dst; 18533 uint32_t cksum; 18534 ire_t *ire; 18535 uint16_t *up; 18536 ill_t *ill; 18537 conn_t *connp = tcp->tcp_connp; 18538 uint32_t hcksum_txflags = 0; 18539 mblk_t *ire_fp_mp; 18540 uint_t ire_fp_mp_len; 18541 ill_poll_capab_t *ill_poll; 18542 18543 ASSERT(DB_TYPE(mp) == M_DATA); 18544 18545 ipha = (ipha_t *)mp->b_rptr; 18546 src = ipha->ipha_src; 18547 dst = ipha->ipha_dst; 18548 18549 /* 18550 * Drop off slow path for IPv6 and also if options are present. 18551 */ 18552 if (tcp->tcp_ipversion != IPV4_VERSION || 18553 !IPCL_IS_CONNECTED(connp) || 18554 (connp->conn_flags & IPCL_CHECK_POLICY) != 0 || 18555 connp->conn_dontroute || 18556 connp->conn_xmit_if_ill != NULL || 18557 connp->conn_nofailover_ill != NULL || 18558 ipha->ipha_ident == IP_HDR_INCLUDED || 18559 ipha->ipha_version_and_hdr_length != IP_SIMPLE_HDR_VERSION || 18560 IPP_ENABLED(IPP_LOCAL_OUT)) { 18561 if (tcp->tcp_snd_zcopy_aware) 18562 mp = tcp_zcopy_disable(tcp, mp); 18563 TCP_STAT(tcp_ip_send); 18564 CALL_IP_WPUT(connp, q, mp); 18565 return; 18566 } 18567 18568 mutex_enter(&connp->conn_lock); 18569 ire = connp->conn_ire_cache; 18570 ASSERT(!(connp->conn_state_flags & CONN_INCIPIENT)); 18571 if (ire != NULL && ire->ire_addr == dst && 18572 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18573 IRE_REFHOLD(ire); 18574 mutex_exit(&connp->conn_lock); 18575 } else { 18576 boolean_t cached = B_FALSE; 18577 18578 /* force a recheck later on */ 18579 tcp->tcp_ire_ill_check_done = B_FALSE; 18580 18581 TCP_DBGSTAT(tcp_ire_null1); 18582 connp->conn_ire_cache = NULL; 18583 mutex_exit(&connp->conn_lock); 18584 if (ire != NULL) 18585 IRE_REFRELE_NOTR(ire); 18586 ire = ire_cache_lookup(dst, connp->conn_zoneid); 18587 if (ire == NULL) { 18588 if (tcp->tcp_snd_zcopy_aware) 18589 mp = tcp_zcopy_backoff(tcp, mp, 0); 18590 TCP_STAT(tcp_ire_null); 18591 CALL_IP_WPUT(connp, q, mp); 18592 return; 18593 } 18594 IRE_REFHOLD_NOTR(ire); 18595 /* 18596 * Since we are inside the squeue, there cannot be another 18597 * thread in TCP trying to set the conn_ire_cache now. The 18598 * check for IRE_MARK_CONDEMNED ensures that an interface 18599 * unplumb thread has not yet started cleaning up the conns. 18600 * Hence we don't need to grab the conn lock. 18601 */ 18602 if (!(connp->conn_state_flags & CONN_CLOSING)) { 18603 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 18604 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 18605 connp->conn_ire_cache = ire; 18606 cached = B_TRUE; 18607 } 18608 rw_exit(&ire->ire_bucket->irb_lock); 18609 } 18610 18611 /* 18612 * We can continue to use the ire but since it was 18613 * not cached, we should drop the extra reference. 18614 */ 18615 if (!cached) 18616 IRE_REFRELE_NOTR(ire); 18617 } 18618 18619 if (ire->ire_flags & RTF_MULTIRT || 18620 ire->ire_stq == NULL || 18621 ire->ire_max_frag < ntohs(ipha->ipha_length) || 18622 (ire_fp_mp = ire->ire_fp_mp) == NULL || 18623 (ire_fp_mp_len = MBLKL(ire_fp_mp)) > MBLKHEAD(mp)) { 18624 if (tcp->tcp_snd_zcopy_aware) 18625 mp = tcp_zcopy_disable(tcp, mp); 18626 TCP_STAT(tcp_ip_ire_send); 18627 IRE_REFRELE(ire); 18628 CALL_IP_WPUT(connp, q, mp); 18629 return; 18630 } 18631 18632 ill = ire_to_ill(ire); 18633 if (connp->conn_outgoing_ill != NULL) { 18634 ill_t *conn_outgoing_ill = NULL; 18635 /* 18636 * Choose a good ill in the group to send the packets on. 18637 */ 18638 ire = conn_set_outgoing_ill(connp, ire, &conn_outgoing_ill); 18639 ill = ire_to_ill(ire); 18640 } 18641 ASSERT(ill != NULL); 18642 18643 if (!tcp->tcp_ire_ill_check_done) { 18644 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 18645 tcp->tcp_ire_ill_check_done = B_TRUE; 18646 } 18647 18648 ASSERT(ipha->ipha_ident == 0 || ipha->ipha_ident == IP_HDR_INCLUDED); 18649 ipha->ipha_ident = (uint16_t)atomic_add_32_nv(&ire->ire_ident, 1); 18650 #ifndef _BIG_ENDIAN 18651 ipha->ipha_ident = (ipha->ipha_ident << 8) | (ipha->ipha_ident >> 8); 18652 #endif 18653 18654 /* 18655 * Check to see if we need to re-enable MDT for this connection 18656 * because it was previously disabled due to changes in the ill; 18657 * note that by doing it here, this re-enabling only applies when 18658 * the packet is not dispatched through CALL_IP_WPUT(). 18659 * 18660 * That means for IPv4, it is worth re-enabling MDT for the fastpath 18661 * case, since that's how we ended up here. For IPv6, we do the 18662 * re-enabling work in ip_xmit_v6(), albeit indirectly via squeue. 18663 */ 18664 if (connp->conn_mdt_ok && !tcp->tcp_mdt && ILL_MDT_USABLE(ill)) { 18665 /* 18666 * Restore MDT for this connection, so that next time around 18667 * it is eligible to go through tcp_multisend() path again. 18668 */ 18669 TCP_STAT(tcp_mdt_conn_resumed1); 18670 tcp->tcp_mdt = B_TRUE; 18671 ip1dbg(("tcp_send_data: reenabling MDT for connp %p on " 18672 "interface %s\n", (void *)connp, ill->ill_name)); 18673 } 18674 18675 if (tcp->tcp_snd_zcopy_aware) { 18676 if ((ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) == 0 || 18677 (ill->ill_zerocopy_capab->ill_zerocopy_flags == 0)) 18678 mp = tcp_zcopy_disable(tcp, mp); 18679 /* 18680 * we shouldn't need to reset ipha as the mp containing 18681 * ipha should never be a zero-copy mp. 18682 */ 18683 } 18684 18685 if ((ill->ill_capabilities & ILL_CAPAB_HCKSUM) && dohwcksum) { 18686 ASSERT(ill->ill_hcksum_capab != NULL); 18687 hcksum_txflags = ill->ill_hcksum_capab->ill_hcksum_txflags; 18688 } 18689 18690 /* pseudo-header checksum (do it in parts for IP header checksum) */ 18691 cksum = (dst >> 16) + (dst & 0xFFFF) + (src >> 16) + (src & 0xFFFF); 18692 18693 ASSERT(ipha->ipha_version_and_hdr_length == IP_SIMPLE_HDR_VERSION); 18694 up = IPH_TCPH_CHECKSUMP(ipha, IP_SIMPLE_HDR_LENGTH); 18695 18696 /* 18697 * Underlying interface supports hardware checksum offload for 18698 * the tcp payload, along with M_DATA fast path; leave the payload 18699 * checksum for the hardware to calculate. 18700 * 18701 * N.B: We only need to set up checksum info on the first mblk. 18702 */ 18703 if (hcksum_txflags & HCKSUM_INET_FULL_V4) { 18704 /* 18705 * Hardware calculates pseudo-header, header and payload 18706 * checksums, so clear checksum field in TCP header. 18707 */ 18708 *up = 0; 18709 mp->b_datap->db_struioun.cksum.flags |= HCK_FULLCKSUM; 18710 } else if (hcksum_txflags & HCKSUM_INET_PARTIAL) { 18711 uint32_t sum; 18712 /* 18713 * Partial checksum offload has been enabled. Fill the 18714 * checksum field in the TCP header with the pseudo-header 18715 * checksum value. 18716 */ 18717 sum = *up + cksum + IP_TCP_CSUM_COMP; 18718 sum = (sum & 0xFFFF) + (sum >> 16); 18719 *up = (sum & 0xFFFF) + (sum >> 16); 18720 mp->b_datap->db_cksumstart = IP_SIMPLE_HDR_LENGTH; 18721 mp->b_datap->db_cksumstuff = IP_SIMPLE_HDR_LENGTH + 16; 18722 mp->b_datap->db_cksumend = ntohs(ipha->ipha_length); 18723 mp->b_datap->db_struioun.cksum.flags |= HCK_PARTIALCKSUM; 18724 } else { 18725 /* software checksumming */ 18726 TCP_STAT(tcp_out_sw_cksum); 18727 *up = IP_CSUM(mp, IP_SIMPLE_HDR_LENGTH, 18728 cksum + IP_TCP_CSUM_COMP); 18729 mp->b_datap->db_struioun.cksum.flags = 0; 18730 } 18731 18732 ipha->ipha_fragment_offset_and_flags |= 18733 (uint32_t)htons(ire->ire_frag_flag); 18734 18735 /* 18736 * Hardware supports IP header checksum offload; clear contents 18737 * of IP header checksum field. Otherwise we calculate it. 18738 */ 18739 if (hcksum_txflags & HCKSUM_IPHDRCKSUM) { 18740 ipha->ipha_hdr_checksum = 0; 18741 mp->b_datap->db_struioun.cksum.flags |= HCK_IPV4_HDRCKSUM; 18742 } else { 18743 IP_HDR_CKSUM(ipha, cksum, ((uint32_t *)ipha)[0], 18744 ((uint16_t *)ipha)[4]); 18745 } 18746 18747 ASSERT(DB_TYPE(ire_fp_mp) == M_DATA); 18748 mp->b_rptr = (uchar_t *)ipha - ire_fp_mp_len; 18749 bcopy(ire_fp_mp->b_rptr, mp->b_rptr, ire_fp_mp_len); 18750 18751 UPDATE_OB_PKT_COUNT(ire); 18752 ire->ire_last_used_time = lbolt; 18753 BUMP_MIB(&ip_mib, ipOutRequests); 18754 18755 if (ill->ill_capabilities & ILL_CAPAB_POLL) { 18756 ill_poll = ill->ill_poll_capab; 18757 ASSERT(ill_poll != NULL); 18758 ASSERT(ill_poll->ill_tx != NULL); 18759 ASSERT(ill_poll->ill_tx_handle != NULL); 18760 18761 mp = ill_poll->ill_tx(ill_poll->ill_tx_handle, mp); 18762 /* 18763 * Driver couldn't send it. Drop it here and the connections 18764 * will automatically slow down when no ack comes back. We 18765 * should make this a better mechanism but this is a very 18766 * rare case. 18767 */ 18768 if (mp != NULL) 18769 freemsg(mp); 18770 } else { 18771 putnext(ire->ire_stq, mp); 18772 } 18773 IRE_REFRELE(ire); 18774 } 18775 18776 /* 18777 * This handles the case when the receiver has shrunk its win. Per RFC 1122 18778 * if the receiver shrinks the window, i.e. moves the right window to the 18779 * left, the we should not send new data, but should retransmit normally the 18780 * old unacked data between suna and suna + swnd. We might has sent data 18781 * that is now outside the new window, pretend that we didn't send it. 18782 */ 18783 static void 18784 tcp_process_shrunk_swnd(tcp_t *tcp, uint32_t shrunk_count) 18785 { 18786 uint32_t snxt = tcp->tcp_snxt; 18787 mblk_t *xmit_tail; 18788 int32_t offset; 18789 18790 ASSERT(shrunk_count > 0); 18791 18792 /* Pretend we didn't send the data outside the window */ 18793 snxt -= shrunk_count; 18794 18795 /* Get the mblk and the offset in it per the shrunk window */ 18796 xmit_tail = tcp_get_seg_mp(tcp, snxt, &offset); 18797 18798 ASSERT(xmit_tail != NULL); 18799 18800 /* Reset all the values per the now shrunk window */ 18801 tcp->tcp_snxt = snxt; 18802 tcp->tcp_xmit_tail = xmit_tail; 18803 tcp->tcp_xmit_tail_unsent = xmit_tail->b_wptr - xmit_tail->b_rptr - 18804 offset; 18805 tcp->tcp_unsent += shrunk_count; 18806 18807 if (tcp->tcp_suna == tcp->tcp_snxt && tcp->tcp_swnd == 0) 18808 /* 18809 * Make sure the timer is running so that we will probe a zero 18810 * window. 18811 */ 18812 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 18813 } 18814 18815 18816 /* 18817 * The TCP normal data output path. 18818 * NOTE: the logic of the fast path is duplicated from this function. 18819 */ 18820 static void 18821 tcp_wput_data(tcp_t *tcp, mblk_t *mp, boolean_t urgent) 18822 { 18823 int len; 18824 mblk_t *local_time; 18825 mblk_t *mp1; 18826 uint32_t snxt; 18827 int tail_unsent; 18828 int tcpstate; 18829 int usable = 0; 18830 mblk_t *xmit_tail; 18831 queue_t *q = tcp->tcp_wq; 18832 int32_t mss; 18833 int32_t num_sack_blk = 0; 18834 int32_t tcp_hdr_len; 18835 int32_t tcp_tcp_hdr_len; 18836 int mdt_thres; 18837 int rc; 18838 18839 tcpstate = tcp->tcp_state; 18840 if (mp == NULL) { 18841 /* 18842 * tcp_wput_data() with NULL mp should only be called when 18843 * there is unsent data. 18844 */ 18845 ASSERT(tcp->tcp_unsent > 0); 18846 /* Really tacky... but we need this for detached closes. */ 18847 len = tcp->tcp_unsent; 18848 goto data_null; 18849 } 18850 18851 #if CCS_STATS 18852 wrw_stats.tot.count++; 18853 wrw_stats.tot.bytes += msgdsize(mp); 18854 #endif 18855 ASSERT(mp->b_datap->db_type == M_DATA); 18856 /* 18857 * Don't allow data after T_ORDREL_REQ or T_DISCON_REQ, 18858 * or before a connection attempt has begun. 18859 */ 18860 if (tcpstate < TCPS_SYN_SENT || tcpstate > TCPS_CLOSE_WAIT || 18861 (tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18862 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) != 0) { 18863 #ifdef DEBUG 18864 cmn_err(CE_WARN, 18865 "tcp_wput_data: data after ordrel, %s", 18866 tcp_display(tcp, NULL, 18867 DISP_ADDR_AND_PORT)); 18868 #else 18869 if (tcp->tcp_debug) { 18870 (void) strlog(TCP_MODULE_ID, 0, 1, 18871 SL_TRACE|SL_ERROR, 18872 "tcp_wput_data: data after ordrel, %s\n", 18873 tcp_display(tcp, NULL, 18874 DISP_ADDR_AND_PORT)); 18875 } 18876 #endif /* DEBUG */ 18877 } 18878 if (tcp->tcp_snd_zcopy_aware && 18879 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) != 0) 18880 tcp_zcopy_notify(tcp); 18881 freemsg(mp); 18882 return; 18883 } 18884 18885 /* Strip empties */ 18886 for (;;) { 18887 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 18888 (uintptr_t)INT_MAX); 18889 len = (int)(mp->b_wptr - mp->b_rptr); 18890 if (len > 0) 18891 break; 18892 mp1 = mp; 18893 mp = mp->b_cont; 18894 freeb(mp1); 18895 if (!mp) { 18896 return; 18897 } 18898 } 18899 18900 /* If we are the first on the list ... */ 18901 if (tcp->tcp_xmit_head == NULL) { 18902 tcp->tcp_xmit_head = mp; 18903 tcp->tcp_xmit_tail = mp; 18904 tcp->tcp_xmit_tail_unsent = len; 18905 } else { 18906 /* If tiny tx and room in txq tail, pullup to save mblks. */ 18907 struct datab *dp; 18908 18909 mp1 = tcp->tcp_xmit_last; 18910 if (len < tcp_tx_pull_len && 18911 (dp = mp1->b_datap)->db_ref == 1 && 18912 dp->db_lim - mp1->b_wptr >= len) { 18913 ASSERT(len > 0); 18914 ASSERT(!mp1->b_cont); 18915 if (len == 1) { 18916 *mp1->b_wptr++ = *mp->b_rptr; 18917 } else { 18918 bcopy(mp->b_rptr, mp1->b_wptr, len); 18919 mp1->b_wptr += len; 18920 } 18921 if (mp1 == tcp->tcp_xmit_tail) 18922 tcp->tcp_xmit_tail_unsent += len; 18923 mp1->b_cont = mp->b_cont; 18924 if (tcp->tcp_snd_zcopy_aware && 18925 (mp->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 18926 mp1->b_datap->db_struioflag |= STRUIO_ZCNOTIFY; 18927 freeb(mp); 18928 mp = mp1; 18929 } else { 18930 tcp->tcp_xmit_last->b_cont = mp; 18931 } 18932 len += tcp->tcp_unsent; 18933 } 18934 18935 /* Tack on however many more positive length mblks we have */ 18936 if ((mp1 = mp->b_cont) != NULL) { 18937 do { 18938 int tlen; 18939 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 18940 (uintptr_t)INT_MAX); 18941 tlen = (int)(mp1->b_wptr - mp1->b_rptr); 18942 if (tlen <= 0) { 18943 mp->b_cont = mp1->b_cont; 18944 freeb(mp1); 18945 } else { 18946 len += tlen; 18947 mp = mp1; 18948 } 18949 } while ((mp1 = mp->b_cont) != NULL); 18950 } 18951 tcp->tcp_xmit_last = mp; 18952 tcp->tcp_unsent = len; 18953 18954 if (urgent) 18955 usable = 1; 18956 18957 data_null: 18958 snxt = tcp->tcp_snxt; 18959 xmit_tail = tcp->tcp_xmit_tail; 18960 tail_unsent = tcp->tcp_xmit_tail_unsent; 18961 18962 /* 18963 * Note that tcp_mss has been adjusted to take into account the 18964 * timestamp option if applicable. Because SACK options do not 18965 * appear in every TCP segments and they are of variable lengths, 18966 * they cannot be included in tcp_mss. Thus we need to calculate 18967 * the actual segment length when we need to send a segment which 18968 * includes SACK options. 18969 */ 18970 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 18971 int32_t opt_len; 18972 18973 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 18974 tcp->tcp_num_sack_blk); 18975 opt_len = num_sack_blk * sizeof (sack_blk_t) + TCPOPT_NOP_LEN * 18976 2 + TCPOPT_HEADER_LEN; 18977 mss = tcp->tcp_mss - opt_len; 18978 tcp_hdr_len = tcp->tcp_hdr_len + opt_len; 18979 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + opt_len; 18980 } else { 18981 mss = tcp->tcp_mss; 18982 tcp_hdr_len = tcp->tcp_hdr_len; 18983 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 18984 } 18985 18986 if ((tcp->tcp_suna == snxt) && !tcp->tcp_localnet && 18987 (TICK_TO_MSEC(lbolt - tcp->tcp_last_recv_time) >= tcp->tcp_rto)) { 18988 SET_TCP_INIT_CWND(tcp, mss, tcp_slow_start_after_idle); 18989 } 18990 if (tcpstate == TCPS_SYN_RCVD) { 18991 /* 18992 * The three-way connection establishment handshake is not 18993 * complete yet. We want to queue the data for transmission 18994 * after entering ESTABLISHED state (RFC793). A jump to 18995 * "done" label effectively leaves data on the queue. 18996 */ 18997 goto done; 18998 } else { 18999 int usable_r = tcp->tcp_swnd; 19000 19001 /* 19002 * In the special case when cwnd is zero, which can only 19003 * happen if the connection is ECN capable, return now. 19004 * New segments is sent using tcp_timer(). The timer 19005 * is set in tcp_rput_data(). 19006 */ 19007 if (tcp->tcp_cwnd == 0) { 19008 /* 19009 * Note that tcp_cwnd is 0 before 3-way handshake is 19010 * finished. 19011 */ 19012 ASSERT(tcp->tcp_ecn_ok || 19013 tcp->tcp_state < TCPS_ESTABLISHED); 19014 return; 19015 } 19016 19017 /* NOTE: trouble if xmitting while SYN not acked? */ 19018 usable_r -= snxt; 19019 usable_r += tcp->tcp_suna; 19020 19021 /* 19022 * Check if the receiver has shrunk the window. If 19023 * tcp_wput_data() with NULL mp is called, tcp_fin_sent 19024 * cannot be set as there is unsent data, so FIN cannot 19025 * be sent out. Otherwise, we need to take into account 19026 * of FIN as it consumes an "invisible" sequence number. 19027 */ 19028 ASSERT(tcp->tcp_fin_sent == 0); 19029 if (usable_r < 0) { 19030 /* 19031 * The receiver has shrunk the window and we have sent 19032 * -usable_r date beyond the window, re-adjust. 19033 * 19034 * If TCP window scaling is enabled, there can be 19035 * round down error as the advertised receive window 19036 * is actually right shifted n bits. This means that 19037 * the lower n bits info is wiped out. It will look 19038 * like the window is shrunk. Do a check here to 19039 * see if the shrunk amount is actually within the 19040 * error in window calculation. If it is, just 19041 * return. Note that this check is inside the 19042 * shrunk window check. This makes sure that even 19043 * though tcp_process_shrunk_swnd() is not called, 19044 * we will stop further processing. 19045 */ 19046 if ((-usable_r >> tcp->tcp_snd_ws) > 0) { 19047 tcp_process_shrunk_swnd(tcp, -usable_r); 19048 } 19049 return; 19050 } 19051 19052 /* usable = MIN(swnd, cwnd) - unacked_bytes */ 19053 if (tcp->tcp_swnd > tcp->tcp_cwnd) 19054 usable_r -= tcp->tcp_swnd - tcp->tcp_cwnd; 19055 19056 /* usable = MIN(usable, unsent) */ 19057 if (usable_r > len) 19058 usable_r = len; 19059 19060 /* usable = MAX(usable, {1 for urgent, 0 for data}) */ 19061 if (usable_r > 0) { 19062 usable = usable_r; 19063 } else { 19064 /* Bypass all other unnecessary processing. */ 19065 goto done; 19066 } 19067 } 19068 19069 local_time = (mblk_t *)lbolt; 19070 19071 /* 19072 * "Our" Nagle Algorithm. This is not the same as in the old 19073 * BSD. This is more in line with the true intent of Nagle. 19074 * 19075 * The conditions are: 19076 * 1. The amount of unsent data (or amount of data which can be 19077 * sent, whichever is smaller) is less than Nagle limit. 19078 * 2. The last sent size is also less than Nagle limit. 19079 * 3. There is unack'ed data. 19080 * 4. Urgent pointer is not set. Send urgent data ignoring the 19081 * Nagle algorithm. This reduces the probability that urgent 19082 * bytes get "merged" together. 19083 * 5. The app has not closed the connection. This eliminates the 19084 * wait time of the receiving side waiting for the last piece of 19085 * (small) data. 19086 * 19087 * If all are satisified, exit without sending anything. Note 19088 * that Nagle limit can be smaller than 1 MSS. Nagle limit is 19089 * the smaller of 1 MSS and global tcp_naglim_def (default to be 19090 * 4095). 19091 */ 19092 if (usable < (int)tcp->tcp_naglim && 19093 tcp->tcp_naglim > tcp->tcp_last_sent_len && 19094 snxt != tcp->tcp_suna && 19095 !(tcp->tcp_valid_bits & TCP_URG_VALID) && 19096 !(tcp->tcp_valid_bits & TCP_FSS_VALID)) { 19097 goto done; 19098 } 19099 19100 if (tcp->tcp_cork) { 19101 /* 19102 * if the tcp->tcp_cork option is set, then we have to force 19103 * TCP not to send partial segment (smaller than MSS bytes). 19104 * We are calculating the usable now based on full mss and 19105 * will save the rest of remaining data for later. 19106 */ 19107 if (usable < mss) 19108 goto done; 19109 usable = (usable / mss) * mss; 19110 } 19111 19112 /* Update the latest receive window size in TCP header. */ 19113 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 19114 tcp->tcp_tcph->th_win); 19115 19116 /* 19117 * Determine if it's worthwhile to attempt MDT, based on: 19118 * 19119 * 1. Simple TCP/IP{v4,v6} (no options). 19120 * 2. IPSEC/IPQoS processing is not needed for the TCP connection. 19121 * 3. If the TCP connection is in ESTABLISHED state. 19122 * 4. The TCP is not detached. 19123 * 19124 * If any of the above conditions have changed during the 19125 * connection, stop using MDT and restore the stream head 19126 * parameters accordingly. 19127 */ 19128 if (tcp->tcp_mdt && 19129 ((tcp->tcp_ipversion == IPV4_VERSION && 19130 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 19131 (tcp->tcp_ipversion == IPV6_VERSION && 19132 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN) || 19133 tcp->tcp_state != TCPS_ESTABLISHED || 19134 TCP_IS_DETACHED(tcp) || !CONN_IS_MD_FASTPATH(tcp->tcp_connp) || 19135 CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp) || 19136 IPP_ENABLED(IPP_LOCAL_OUT))) { 19137 tcp->tcp_connp->conn_mdt_ok = B_FALSE; 19138 tcp->tcp_mdt = B_FALSE; 19139 19140 /* Anything other than detached is considered pathological */ 19141 if (!TCP_IS_DETACHED(tcp)) { 19142 TCP_STAT(tcp_mdt_conn_halted1); 19143 (void) tcp_maxpsz_set(tcp, B_TRUE); 19144 } 19145 } 19146 19147 /* Use MDT if sendable amount is greater than the threshold */ 19148 if (tcp->tcp_mdt && 19149 (mdt_thres = mss << tcp_mdt_smss_threshold, usable > mdt_thres) && 19150 (tail_unsent > mdt_thres || (xmit_tail->b_cont != NULL && 19151 MBLKL(xmit_tail->b_cont) > mdt_thres)) && 19152 (tcp->tcp_valid_bits == 0 || 19153 tcp->tcp_valid_bits == TCP_FSS_VALID)) { 19154 ASSERT(tcp->tcp_connp->conn_mdt_ok); 19155 rc = tcp_multisend(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 19156 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 19157 local_time, mdt_thres); 19158 } else { 19159 rc = tcp_send(q, tcp, mss, tcp_hdr_len, tcp_tcp_hdr_len, 19160 num_sack_blk, &usable, &snxt, &tail_unsent, &xmit_tail, 19161 local_time, INT_MAX); 19162 } 19163 19164 /* Pretend that all we were trying to send really got sent */ 19165 if (rc < 0 && tail_unsent < 0) { 19166 do { 19167 xmit_tail = xmit_tail->b_cont; 19168 xmit_tail->b_prev = local_time; 19169 ASSERT((uintptr_t)(xmit_tail->b_wptr - 19170 xmit_tail->b_rptr) <= (uintptr_t)INT_MAX); 19171 tail_unsent += (int)(xmit_tail->b_wptr - 19172 xmit_tail->b_rptr); 19173 } while (tail_unsent < 0); 19174 } 19175 done:; 19176 tcp->tcp_xmit_tail = xmit_tail; 19177 tcp->tcp_xmit_tail_unsent = tail_unsent; 19178 len = tcp->tcp_snxt - snxt; 19179 if (len) { 19180 /* 19181 * If new data was sent, need to update the notsack 19182 * list, which is, afterall, data blocks that have 19183 * not been sack'ed by the receiver. New data is 19184 * not sack'ed. 19185 */ 19186 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 19187 /* len is a negative value. */ 19188 tcp->tcp_pipe -= len; 19189 tcp_notsack_update(&(tcp->tcp_notsack_list), 19190 tcp->tcp_snxt, snxt, 19191 &(tcp->tcp_num_notsack_blk), 19192 &(tcp->tcp_cnt_notsack_list)); 19193 } 19194 tcp->tcp_snxt = snxt + tcp->tcp_fin_sent; 19195 tcp->tcp_rack = tcp->tcp_rnxt; 19196 tcp->tcp_rack_cnt = 0; 19197 if ((snxt + len) == tcp->tcp_suna) { 19198 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 19199 } 19200 } else if (snxt == tcp->tcp_suna && tcp->tcp_swnd == 0) { 19201 /* 19202 * Didn't send anything. Make sure the timer is running 19203 * so that we will probe a zero window. 19204 */ 19205 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 19206 } 19207 /* Note that len is the amount we just sent but with a negative sign */ 19208 len += tcp->tcp_unsent; 19209 tcp->tcp_unsent = len; 19210 if (tcp->tcp_flow_stopped) { 19211 if (len <= tcp->tcp_xmit_lowater) { 19212 tcp->tcp_flow_stopped = B_FALSE; 19213 tcp_clrqfull(tcp); 19214 } 19215 } else if (len >= tcp->tcp_xmit_hiwater) { 19216 tcp->tcp_flow_stopped = B_TRUE; 19217 tcp_setqfull(tcp); 19218 } 19219 } 19220 19221 /* 19222 * tcp_fill_header is called by tcp_send() and tcp_multisend() to fill the 19223 * outgoing TCP header with the template header, as well as other 19224 * options such as time-stamp, ECN and/or SACK. 19225 */ 19226 static void 19227 tcp_fill_header(tcp_t *tcp, uchar_t *rptr, clock_t now, int num_sack_blk) 19228 { 19229 tcph_t *tcp_tmpl, *tcp_h; 19230 uint32_t *dst, *src; 19231 int hdrlen; 19232 19233 ASSERT(OK_32PTR(rptr)); 19234 19235 /* Template header */ 19236 tcp_tmpl = tcp->tcp_tcph; 19237 19238 /* Header of outgoing packet */ 19239 tcp_h = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 19240 19241 /* dst and src are opaque 32-bit fields, used for copying */ 19242 dst = (uint32_t *)rptr; 19243 src = (uint32_t *)tcp->tcp_iphc; 19244 hdrlen = tcp->tcp_hdr_len; 19245 19246 /* Fill time-stamp option if needed */ 19247 if (tcp->tcp_snd_ts_ok) { 19248 U32_TO_BE32((uint32_t)now, 19249 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 4); 19250 U32_TO_BE32(tcp->tcp_ts_recent, 19251 (char *)tcp_tmpl + TCP_MIN_HEADER_LENGTH + 8); 19252 } else { 19253 ASSERT(tcp->tcp_tcp_hdr_len == TCP_MIN_HEADER_LENGTH); 19254 } 19255 19256 /* 19257 * Copy the template header; is this really more efficient than 19258 * calling bcopy()? For simple IPv4/TCP, it may be the case, 19259 * but perhaps not for other scenarios. 19260 */ 19261 dst[0] = src[0]; 19262 dst[1] = src[1]; 19263 dst[2] = src[2]; 19264 dst[3] = src[3]; 19265 dst[4] = src[4]; 19266 dst[5] = src[5]; 19267 dst[6] = src[6]; 19268 dst[7] = src[7]; 19269 dst[8] = src[8]; 19270 dst[9] = src[9]; 19271 if (hdrlen -= 40) { 19272 hdrlen >>= 2; 19273 dst += 10; 19274 src += 10; 19275 do { 19276 *dst++ = *src++; 19277 } while (--hdrlen); 19278 } 19279 19280 /* 19281 * Set the ECN info in the TCP header if it is not a zero 19282 * window probe. Zero window probe is only sent in 19283 * tcp_wput_data() and tcp_timer(). 19284 */ 19285 if (tcp->tcp_ecn_ok && !tcp->tcp_zero_win_probe) { 19286 SET_ECT(tcp, rptr); 19287 19288 if (tcp->tcp_ecn_echo_on) 19289 tcp_h->th_flags[0] |= TH_ECE; 19290 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 19291 tcp_h->th_flags[0] |= TH_CWR; 19292 tcp->tcp_ecn_cwr_sent = B_TRUE; 19293 } 19294 } 19295 19296 /* Fill in SACK options */ 19297 if (num_sack_blk > 0) { 19298 uchar_t *wptr = rptr + tcp->tcp_hdr_len; 19299 sack_blk_t *tmp; 19300 int32_t i; 19301 19302 wptr[0] = TCPOPT_NOP; 19303 wptr[1] = TCPOPT_NOP; 19304 wptr[2] = TCPOPT_SACK; 19305 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 19306 sizeof (sack_blk_t); 19307 wptr += TCPOPT_REAL_SACK_LEN; 19308 19309 tmp = tcp->tcp_sack_list; 19310 for (i = 0; i < num_sack_blk; i++) { 19311 U32_TO_BE32(tmp[i].begin, wptr); 19312 wptr += sizeof (tcp_seq); 19313 U32_TO_BE32(tmp[i].end, wptr); 19314 wptr += sizeof (tcp_seq); 19315 } 19316 tcp_h->th_offset_and_rsrvd[0] += 19317 ((num_sack_blk * 2 + 1) << 4); 19318 } 19319 } 19320 19321 /* 19322 * tcp_mdt_add_attrs() is called by tcp_multisend() in order to attach 19323 * the destination address and SAP attribute, and if necessary, the 19324 * hardware checksum offload attribute to a Multidata message. 19325 */ 19326 static int 19327 tcp_mdt_add_attrs(multidata_t *mmd, const mblk_t *dlmp, const boolean_t hwcksum, 19328 const uint32_t start, const uint32_t stuff, const uint32_t end, 19329 const uint32_t flags) 19330 { 19331 /* Add global destination address & SAP attribute */ 19332 if (dlmp == NULL || !ip_md_addr_attr(mmd, NULL, dlmp)) { 19333 ip1dbg(("tcp_mdt_add_attrs: can't add global physical " 19334 "destination address+SAP\n")); 19335 19336 if (dlmp != NULL) 19337 TCP_STAT(tcp_mdt_allocfail); 19338 return (-1); 19339 } 19340 19341 /* Add global hwcksum attribute */ 19342 if (hwcksum && 19343 !ip_md_hcksum_attr(mmd, NULL, start, stuff, end, flags)) { 19344 ip1dbg(("tcp_mdt_add_attrs: can't add global hardware " 19345 "checksum attribute\n")); 19346 19347 TCP_STAT(tcp_mdt_allocfail); 19348 return (-1); 19349 } 19350 19351 return (0); 19352 } 19353 19354 /* 19355 * tcp_multisend() is called by tcp_wput_data() for Multidata Transmit 19356 * scheme, and returns one the following: 19357 * 19358 * -1 = failed allocation. 19359 * 0 = success; burst count reached, or usable send window is too small, 19360 * and that we'd rather wait until later before sending again. 19361 */ 19362 static int 19363 tcp_multisend(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 19364 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 19365 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 19366 const int mdt_thres) 19367 { 19368 mblk_t *md_mp_head, *md_mp, *md_pbuf, *md_pbuf_nxt, *md_hbuf; 19369 multidata_t *mmd; 19370 uint_t obsegs, obbytes, hdr_frag_sz; 19371 uint_t cur_hdr_off, cur_pld_off, base_pld_off, first_snxt; 19372 int num_burst_seg, max_pld; 19373 pdesc_t *pkt; 19374 tcp_pdescinfo_t tcp_pkt_info; 19375 pdescinfo_t *pkt_info; 19376 int pbuf_idx, pbuf_idx_nxt; 19377 int seg_len, len, spill, af; 19378 boolean_t add_buffer, zcopy, clusterwide; 19379 boolean_t rconfirm = B_FALSE; 19380 boolean_t done = B_FALSE; 19381 uint32_t cksum; 19382 uint32_t hwcksum_flags; 19383 ire_t *ire; 19384 ill_t *ill; 19385 ipha_t *ipha; 19386 ip6_t *ip6h; 19387 ipaddr_t src, dst; 19388 ill_zerocopy_capab_t *zc_cap = NULL; 19389 uint16_t *up; 19390 int err; 19391 19392 #ifdef _BIG_ENDIAN 19393 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 28) & 0x7) 19394 #else 19395 #define IPVER(ip6h) ((((uint32_t *)ip6h)[0] >> 4) & 0x7) 19396 #endif 19397 19398 #define TCP_CSUM_OFFSET 16 19399 #define TCP_CSUM_SIZE 2 19400 19401 #define PREP_NEW_MULTIDATA() { \ 19402 mmd = NULL; \ 19403 md_mp = md_hbuf = NULL; \ 19404 cur_hdr_off = 0; \ 19405 max_pld = tcp->tcp_mdt_max_pld; \ 19406 pbuf_idx = pbuf_idx_nxt = -1; \ 19407 add_buffer = B_TRUE; \ 19408 zcopy = B_FALSE; \ 19409 } 19410 19411 #define PREP_NEW_PBUF() { \ 19412 md_pbuf = md_pbuf_nxt = NULL; \ 19413 pbuf_idx = pbuf_idx_nxt = -1; \ 19414 cur_pld_off = 0; \ 19415 first_snxt = *snxt; \ 19416 ASSERT(*tail_unsent > 0); \ 19417 base_pld_off = MBLKL(*xmit_tail) - *tail_unsent; \ 19418 } 19419 19420 ASSERT(mdt_thres >= mss); 19421 ASSERT(*usable > 0 && *usable > mdt_thres); 19422 ASSERT(tcp->tcp_state == TCPS_ESTABLISHED); 19423 ASSERT(!TCP_IS_DETACHED(tcp)); 19424 ASSERT(tcp->tcp_valid_bits == 0 || 19425 tcp->tcp_valid_bits == TCP_FSS_VALID); 19426 ASSERT((tcp->tcp_ipversion == IPV4_VERSION && 19427 tcp->tcp_ip_hdr_len == IP_SIMPLE_HDR_LENGTH) || 19428 (tcp->tcp_ipversion == IPV6_VERSION && 19429 tcp->tcp_ip_hdr_len == IPV6_HDR_LEN)); 19430 ASSERT(tcp->tcp_connp != NULL); 19431 ASSERT(CONN_IS_MD_FASTPATH(tcp->tcp_connp)); 19432 ASSERT(!CONN_IPSEC_OUT_ENCAPSULATED(tcp->tcp_connp)); 19433 19434 /* 19435 * Note that tcp will only declare at most 2 payload spans per 19436 * packet, which is much lower than the maximum allowable number 19437 * of packet spans per Multidata. For this reason, we use the 19438 * privately declared and smaller descriptor info structure, in 19439 * order to save some stack space. 19440 */ 19441 pkt_info = (pdescinfo_t *)&tcp_pkt_info; 19442 19443 af = (tcp->tcp_ipversion == IPV4_VERSION) ? AF_INET : AF_INET6; 19444 if (af == AF_INET) { 19445 dst = tcp->tcp_ipha->ipha_dst; 19446 src = tcp->tcp_ipha->ipha_src; 19447 ASSERT(!CLASSD(dst)); 19448 } 19449 ASSERT(af == AF_INET || 19450 !IN6_IS_ADDR_MULTICAST(&tcp->tcp_ip6h->ip6_dst)); 19451 19452 obsegs = obbytes = 0; 19453 num_burst_seg = tcp->tcp_snd_burst; 19454 md_mp_head = NULL; 19455 PREP_NEW_MULTIDATA(); 19456 19457 /* 19458 * Before we go on further, make sure there is an IRE that we can 19459 * use, and that the ILL supports MDT. Otherwise, there's no point 19460 * in proceeding any further, and we should just hand everything 19461 * off to the legacy path. 19462 */ 19463 mutex_enter(&tcp->tcp_connp->conn_lock); 19464 ire = tcp->tcp_connp->conn_ire_cache; 19465 ASSERT(!(tcp->tcp_connp->conn_state_flags & CONN_INCIPIENT)); 19466 if (ire != NULL && ((af == AF_INET && ire->ire_addr == dst) || 19467 (af == AF_INET6 && IN6_ARE_ADDR_EQUAL(&ire->ire_addr_v6, 19468 &tcp->tcp_ip6h->ip6_dst))) && 19469 !(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19470 IRE_REFHOLD(ire); 19471 mutex_exit(&tcp->tcp_connp->conn_lock); 19472 } else { 19473 boolean_t cached = B_FALSE; 19474 19475 /* force a recheck later on */ 19476 tcp->tcp_ire_ill_check_done = B_FALSE; 19477 19478 TCP_DBGSTAT(tcp_ire_null1); 19479 tcp->tcp_connp->conn_ire_cache = NULL; 19480 mutex_exit(&tcp->tcp_connp->conn_lock); 19481 19482 /* Release the old ire */ 19483 if (ire != NULL) 19484 IRE_REFRELE_NOTR(ire); 19485 19486 ire = (af == AF_INET) ? 19487 ire_cache_lookup(dst, tcp->tcp_connp->conn_zoneid) : 19488 ire_cache_lookup_v6(&tcp->tcp_ip6h->ip6_dst, 19489 tcp->tcp_connp->conn_zoneid); 19490 19491 if (ire == NULL) { 19492 TCP_STAT(tcp_ire_null); 19493 goto legacy_send_no_md; 19494 } 19495 19496 IRE_REFHOLD_NOTR(ire); 19497 /* 19498 * Since we are inside the squeue, there cannot be another 19499 * thread in TCP trying to set the conn_ire_cache now. The 19500 * check for IRE_MARK_CONDEMNED ensures that an interface 19501 * unplumb thread has not yet started cleaning up the conns. 19502 * Hence we don't need to grab the conn lock. 19503 */ 19504 if (!(tcp->tcp_connp->conn_state_flags & CONN_CLOSING)) { 19505 rw_enter(&ire->ire_bucket->irb_lock, RW_READER); 19506 if (!(ire->ire_marks & IRE_MARK_CONDEMNED)) { 19507 tcp->tcp_connp->conn_ire_cache = ire; 19508 cached = B_TRUE; 19509 } 19510 rw_exit(&ire->ire_bucket->irb_lock); 19511 } 19512 19513 /* 19514 * We can continue to use the ire but since it was not 19515 * cached, we should drop the extra reference. 19516 */ 19517 if (!cached) 19518 IRE_REFRELE_NOTR(ire); 19519 } 19520 19521 ASSERT(ire != NULL); 19522 ASSERT(af != AF_INET || ire->ire_ipversion == IPV4_VERSION); 19523 ASSERT(af == AF_INET || !IN6_IS_ADDR_V4MAPPED(&(ire->ire_addr_v6))); 19524 ASSERT(af == AF_INET || ire->ire_nce != NULL); 19525 ASSERT(!(ire->ire_type & IRE_BROADCAST)); 19526 /* 19527 * If we do support loopback for MDT (which requires modifications 19528 * to the receiving paths), the following assertions should go away, 19529 * and we would be sending the Multidata to loopback conn later on. 19530 */ 19531 ASSERT(!IRE_IS_LOCAL(ire)); 19532 ASSERT(ire->ire_stq != NULL); 19533 19534 ill = ire_to_ill(ire); 19535 ASSERT(ill != NULL); 19536 ASSERT((ill->ill_capabilities & ILL_CAPAB_MDT) == 0 || 19537 ill->ill_mdt_capab != NULL); 19538 19539 if (!tcp->tcp_ire_ill_check_done) { 19540 tcp_ire_ill_check(tcp, ire, ill, B_TRUE); 19541 tcp->tcp_ire_ill_check_done = B_TRUE; 19542 } 19543 19544 /* 19545 * If the underlying interface conditions have changed, or if the 19546 * new interface does not support MDT, go back to legacy path. 19547 */ 19548 if (!ILL_MDT_USABLE(ill) || (ire->ire_flags & RTF_MULTIRT) != 0) { 19549 /* don't go through this path anymore for this connection */ 19550 TCP_STAT(tcp_mdt_conn_halted2); 19551 tcp->tcp_mdt = B_FALSE; 19552 ip1dbg(("tcp_multisend: disabling MDT for connp %p on " 19553 "interface %s\n", (void *)tcp->tcp_connp, ill->ill_name)); 19554 /* IRE will be released prior to returning */ 19555 goto legacy_send_no_md; 19556 } 19557 19558 if (ill->ill_capabilities & ILL_CAPAB_ZEROCOPY) 19559 zc_cap = ill->ill_zerocopy_capab; 19560 19561 /* go to legacy path if interface doesn't support zerocopy */ 19562 if (tcp->tcp_snd_zcopy_aware && do_tcpzcopy != 2 && 19563 (zc_cap == NULL || zc_cap->ill_zerocopy_flags == 0)) { 19564 /* IRE will be released prior to returning */ 19565 goto legacy_send_no_md; 19566 } 19567 19568 /* does the interface support hardware checksum offload? */ 19569 hwcksum_flags = 0; 19570 if ((ill->ill_capabilities & ILL_CAPAB_HCKSUM) && 19571 (ill->ill_hcksum_capab->ill_hcksum_txflags & 19572 (HCKSUM_INET_FULL_V4 | HCKSUM_INET_PARTIAL | HCKSUM_IPHDRCKSUM)) && 19573 dohwcksum) { 19574 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19575 HCKSUM_IPHDRCKSUM) 19576 hwcksum_flags = HCK_IPV4_HDRCKSUM; 19577 19578 if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19579 HCKSUM_INET_FULL_V4) 19580 hwcksum_flags |= HCK_FULLCKSUM; 19581 else if (ill->ill_hcksum_capab->ill_hcksum_txflags & 19582 HCKSUM_INET_PARTIAL) 19583 hwcksum_flags |= HCK_PARTIALCKSUM; 19584 } 19585 19586 /* 19587 * Each header fragment consists of the leading extra space, 19588 * followed by the TCP/IP header, and the trailing extra space. 19589 * We make sure that each header fragment begins on a 32-bit 19590 * aligned memory address (tcp_mdt_hdr_head is already 32-bit 19591 * aligned in tcp_mdt_update). 19592 */ 19593 hdr_frag_sz = roundup((tcp->tcp_mdt_hdr_head + tcp_hdr_len + 19594 tcp->tcp_mdt_hdr_tail), 4); 19595 19596 /* are we starting from the beginning of data block? */ 19597 if (*tail_unsent == 0) { 19598 *xmit_tail = (*xmit_tail)->b_cont; 19599 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= (uintptr_t)INT_MAX); 19600 *tail_unsent = (int)MBLKL(*xmit_tail); 19601 } 19602 19603 /* 19604 * Here we create one or more Multidata messages, each made up of 19605 * one header buffer and up to N payload buffers. This entire 19606 * operation is done within two loops: 19607 * 19608 * The outer loop mostly deals with creating the Multidata message, 19609 * as well as the header buffer that gets added to it. It also 19610 * links the Multidata messages together such that all of them can 19611 * be sent down to the lower layer in a single putnext call; this 19612 * linking behavior depends on the tcp_mdt_chain tunable. 19613 * 19614 * The inner loop takes an existing Multidata message, and adds 19615 * one or more (up to tcp_mdt_max_pld) payload buffers to it. It 19616 * packetizes those buffers by filling up the corresponding header 19617 * buffer fragments with the proper IP and TCP headers, and by 19618 * describing the layout of each packet in the packet descriptors 19619 * that get added to the Multidata. 19620 */ 19621 do { 19622 /* 19623 * If usable send window is too small, or data blocks in 19624 * transmit list are smaller than our threshold (i.e. app 19625 * performs large writes followed by small ones), we hand 19626 * off the control over to the legacy path. Note that we'll 19627 * get back the control once it encounters a large block. 19628 */ 19629 if (*usable < mss || (*tail_unsent <= mdt_thres && 19630 (*xmit_tail)->b_cont != NULL && 19631 MBLKL((*xmit_tail)->b_cont) <= mdt_thres)) { 19632 /* send down what we've got so far */ 19633 if (md_mp_head != NULL) { 19634 tcp_multisend_data(tcp, ire, ill, md_mp_head, 19635 obsegs, obbytes, &rconfirm); 19636 } 19637 /* 19638 * Pass control over to tcp_send(), but tell it to 19639 * return to us once a large-size transmission is 19640 * possible. 19641 */ 19642 TCP_STAT(tcp_mdt_legacy_small); 19643 if ((err = tcp_send(q, tcp, mss, tcp_hdr_len, 19644 tcp_tcp_hdr_len, num_sack_blk, usable, snxt, 19645 tail_unsent, xmit_tail, local_time, 19646 mdt_thres)) <= 0) { 19647 /* burst count reached, or alloc failed */ 19648 IRE_REFRELE(ire); 19649 return (err); 19650 } 19651 19652 /* tcp_send() may have sent everything, so check */ 19653 if (*usable <= 0) { 19654 IRE_REFRELE(ire); 19655 return (0); 19656 } 19657 19658 TCP_STAT(tcp_mdt_legacy_ret); 19659 /* 19660 * We may have delivered the Multidata, so make sure 19661 * to re-initialize before the next round. 19662 */ 19663 md_mp_head = NULL; 19664 obsegs = obbytes = 0; 19665 num_burst_seg = tcp->tcp_snd_burst; 19666 PREP_NEW_MULTIDATA(); 19667 19668 /* are we starting from the beginning of data block? */ 19669 if (*tail_unsent == 0) { 19670 *xmit_tail = (*xmit_tail)->b_cont; 19671 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 19672 (uintptr_t)INT_MAX); 19673 *tail_unsent = (int)MBLKL(*xmit_tail); 19674 } 19675 } 19676 19677 /* 19678 * max_pld limits the number of mblks in tcp's transmit 19679 * queue that can be added to a Multidata message. Once 19680 * this counter reaches zero, no more additional mblks 19681 * can be added to it. What happens afterwards depends 19682 * on whether or not we are set to chain the Multidata 19683 * messages. If we are to link them together, reset 19684 * max_pld to its original value (tcp_mdt_max_pld) and 19685 * prepare to create a new Multidata message which will 19686 * get linked to md_mp_head. Else, leave it alone and 19687 * let the inner loop break on its own. 19688 */ 19689 if (tcp_mdt_chain && max_pld == 0) 19690 PREP_NEW_MULTIDATA(); 19691 19692 /* adding a payload buffer; re-initialize values */ 19693 if (add_buffer) 19694 PREP_NEW_PBUF(); 19695 19696 /* 19697 * If we don't have a Multidata, either because we just 19698 * (re)entered this outer loop, or after we branched off 19699 * to tcp_send above, setup the Multidata and header 19700 * buffer to be used. 19701 */ 19702 if (md_mp == NULL) { 19703 int md_hbuflen; 19704 uint32_t start, stuff; 19705 19706 /* 19707 * Calculate Multidata header buffer size large enough 19708 * to hold all of the headers that can possibly be 19709 * sent at this moment. We'd rather over-estimate 19710 * the size than running out of space; this is okay 19711 * since this buffer is small anyway. 19712 */ 19713 md_hbuflen = (howmany(*usable, mss) + 1) * hdr_frag_sz; 19714 19715 /* 19716 * Start and stuff offset for partial hardware 19717 * checksum offload; these are currently for IPv4. 19718 * For full checksum offload, they are set to zero. 19719 */ 19720 if (af == AF_INET && 19721 (hwcksum_flags & HCK_PARTIALCKSUM)) { 19722 start = IP_SIMPLE_HDR_LENGTH; 19723 stuff = IP_SIMPLE_HDR_LENGTH + TCP_CSUM_OFFSET; 19724 } else { 19725 start = stuff = 0; 19726 } 19727 19728 /* 19729 * Create the header buffer, Multidata, as well as 19730 * any necessary attributes (destination address, 19731 * SAP and hardware checksum offload) that should 19732 * be associated with the Multidata message. 19733 */ 19734 ASSERT(cur_hdr_off == 0); 19735 if ((md_hbuf = allocb(md_hbuflen, BPRI_HI)) == NULL || 19736 ((md_hbuf->b_wptr += md_hbuflen), 19737 (mmd = mmd_alloc(md_hbuf, &md_mp, 19738 KM_NOSLEEP)) == NULL) || (tcp_mdt_add_attrs(mmd, 19739 /* fastpath mblk */ 19740 (af == AF_INET) ? ire->ire_dlureq_mp : 19741 ire->ire_nce->nce_res_mp, 19742 /* hardware checksum enabled (IPv4 only) */ 19743 (af == AF_INET && hwcksum_flags != 0), 19744 /* hardware checksum offsets */ 19745 start, stuff, 0, 19746 /* hardware checksum flag */ 19747 hwcksum_flags) != 0)) { 19748 legacy_send: 19749 if (md_mp != NULL) { 19750 /* Unlink message from the chain */ 19751 if (md_mp_head != NULL) { 19752 err = (intptr_t)rmvb(md_mp_head, 19753 md_mp); 19754 /* 19755 * We can't assert that rmvb 19756 * did not return -1, since we 19757 * may get here before linkb 19758 * happens. We do, however, 19759 * check if we just removed the 19760 * only element in the list. 19761 */ 19762 if (err == 0) 19763 md_mp_head = NULL; 19764 } 19765 /* md_hbuf gets freed automatically */ 19766 TCP_STAT(tcp_mdt_discarded); 19767 freeb(md_mp); 19768 } else { 19769 /* Either allocb or mmd_alloc failed */ 19770 TCP_STAT(tcp_mdt_allocfail); 19771 if (md_hbuf != NULL) 19772 freeb(md_hbuf); 19773 } 19774 19775 /* send down what we've got so far */ 19776 if (md_mp_head != NULL) { 19777 tcp_multisend_data(tcp, ire, ill, 19778 md_mp_head, obsegs, obbytes, 19779 &rconfirm); 19780 } 19781 legacy_send_no_md: 19782 if (ire != NULL) 19783 IRE_REFRELE(ire); 19784 /* 19785 * Too bad; let the legacy path handle this. 19786 * We specify INT_MAX for the threshold, since 19787 * we gave up with the Multidata processings 19788 * and let the old path have it all. 19789 */ 19790 TCP_STAT(tcp_mdt_legacy_all); 19791 return (tcp_send(q, tcp, mss, tcp_hdr_len, 19792 tcp_tcp_hdr_len, num_sack_blk, usable, 19793 snxt, tail_unsent, xmit_tail, local_time, 19794 INT_MAX)); 19795 } 19796 19797 /* link to any existing ones, if applicable */ 19798 TCP_STAT(tcp_mdt_allocd); 19799 if (md_mp_head == NULL) { 19800 md_mp_head = md_mp; 19801 } else if (tcp_mdt_chain) { 19802 TCP_STAT(tcp_mdt_linked); 19803 linkb(md_mp_head, md_mp); 19804 } 19805 } 19806 19807 ASSERT(md_mp_head != NULL); 19808 ASSERT(tcp_mdt_chain || md_mp_head->b_cont == NULL); 19809 ASSERT(md_mp != NULL && mmd != NULL); 19810 ASSERT(md_hbuf != NULL); 19811 19812 /* 19813 * Packetize the transmittable portion of the data block; 19814 * each data block is essentially added to the Multidata 19815 * as a payload buffer. We also deal with adding more 19816 * than one payload buffers, which happens when the remaining 19817 * packetized portion of the current payload buffer is less 19818 * than MSS, while the next data block in transmit queue 19819 * has enough data to make up for one. This "spillover" 19820 * case essentially creates a split-packet, where portions 19821 * of the packet's payload fragments may span across two 19822 * virtually discontiguous address blocks. 19823 */ 19824 seg_len = mss; 19825 do { 19826 len = seg_len; 19827 19828 ASSERT(len > 0); 19829 ASSERT(max_pld >= 0); 19830 ASSERT(!add_buffer || cur_pld_off == 0); 19831 19832 /* 19833 * First time around for this payload buffer; note 19834 * in the case of a spillover, the following has 19835 * been done prior to adding the split-packet 19836 * descriptor to Multidata, and we don't want to 19837 * repeat the process. 19838 */ 19839 if (add_buffer) { 19840 ASSERT(mmd != NULL); 19841 ASSERT(md_pbuf == NULL); 19842 ASSERT(md_pbuf_nxt == NULL); 19843 ASSERT(pbuf_idx == -1 && pbuf_idx_nxt == -1); 19844 19845 /* 19846 * Have we reached the limit? We'd get to 19847 * this case when we're not chaining the 19848 * Multidata messages together, and since 19849 * we're done, terminate this loop. 19850 */ 19851 if (max_pld == 0) 19852 break; /* done */ 19853 19854 if ((md_pbuf = dupb(*xmit_tail)) == NULL) { 19855 TCP_STAT(tcp_mdt_allocfail); 19856 goto legacy_send; /* out_of_mem */ 19857 } 19858 19859 if (IS_VMLOANED_MBLK(md_pbuf) && !zcopy && 19860 zc_cap != NULL) { 19861 if (!ip_md_zcopy_attr(mmd, NULL, 19862 zc_cap->ill_zerocopy_flags)) { 19863 freeb(md_pbuf); 19864 TCP_STAT(tcp_mdt_allocfail); 19865 /* out_of_mem */ 19866 goto legacy_send; 19867 } 19868 zcopy = B_TRUE; 19869 } 19870 19871 md_pbuf->b_rptr += base_pld_off; 19872 19873 /* 19874 * Add a payload buffer to the Multidata; this 19875 * operation must not fail, or otherwise our 19876 * logic in this routine is broken. There 19877 * is no memory allocation done by the 19878 * routine, so any returned failure simply 19879 * tells us that we've done something wrong. 19880 * 19881 * A failure tells us that either we're adding 19882 * the same payload buffer more than once, or 19883 * we're trying to add more buffers than 19884 * allowed (max_pld calculation is wrong). 19885 * None of the above cases should happen, and 19886 * we panic because either there's horrible 19887 * heap corruption, and/or programming mistake. 19888 */ 19889 pbuf_idx = mmd_addpldbuf(mmd, md_pbuf); 19890 if (pbuf_idx < 0) { 19891 cmn_err(CE_PANIC, "tcp_multisend: " 19892 "payload buffer logic error " 19893 "detected for tcp %p mmd %p " 19894 "pbuf %p (%d)\n", 19895 (void *)tcp, (void *)mmd, 19896 (void *)md_pbuf, pbuf_idx); 19897 } 19898 19899 ASSERT(max_pld > 0); 19900 --max_pld; 19901 add_buffer = B_FALSE; 19902 } 19903 19904 ASSERT(md_mp_head != NULL); 19905 ASSERT(md_pbuf != NULL); 19906 ASSERT(md_pbuf_nxt == NULL); 19907 ASSERT(pbuf_idx != -1); 19908 ASSERT(pbuf_idx_nxt == -1); 19909 ASSERT(*usable > 0); 19910 19911 /* 19912 * We spillover to the next payload buffer only 19913 * if all of the following is true: 19914 * 19915 * 1. There is not enough data on the current 19916 * payload buffer to make up `len', 19917 * 2. We are allowed to send `len', 19918 * 3. The next payload buffer length is large 19919 * enough to accomodate `spill'. 19920 */ 19921 if ((spill = len - *tail_unsent) > 0 && 19922 *usable >= len && 19923 MBLKL((*xmit_tail)->b_cont) >= spill && 19924 max_pld > 0) { 19925 md_pbuf_nxt = dupb((*xmit_tail)->b_cont); 19926 if (md_pbuf_nxt == NULL) { 19927 TCP_STAT(tcp_mdt_allocfail); 19928 goto legacy_send; /* out_of_mem */ 19929 } 19930 19931 if (IS_VMLOANED_MBLK(md_pbuf_nxt) && !zcopy && 19932 zc_cap != NULL) { 19933 if (!ip_md_zcopy_attr(mmd, NULL, 19934 zc_cap->ill_zerocopy_flags)) { 19935 freeb(md_pbuf_nxt); 19936 TCP_STAT(tcp_mdt_allocfail); 19937 /* out_of_mem */ 19938 goto legacy_send; 19939 } 19940 zcopy = B_TRUE; 19941 } 19942 19943 /* 19944 * See comments above on the first call to 19945 * mmd_addpldbuf for explanation on the panic. 19946 */ 19947 pbuf_idx_nxt = mmd_addpldbuf(mmd, md_pbuf_nxt); 19948 if (pbuf_idx_nxt < 0) { 19949 panic("tcp_multisend: " 19950 "next payload buffer logic error " 19951 "detected for tcp %p mmd %p " 19952 "pbuf %p (%d)\n", 19953 (void *)tcp, (void *)mmd, 19954 (void *)md_pbuf_nxt, pbuf_idx_nxt); 19955 } 19956 19957 ASSERT(max_pld > 0); 19958 --max_pld; 19959 } else if (spill > 0) { 19960 /* 19961 * If there's a spillover, but the following 19962 * xmit_tail couldn't give us enough octets 19963 * to reach "len", then stop the current 19964 * Multidata creation and let the legacy 19965 * tcp_send() path take over. We don't want 19966 * to send the tiny segment as part of this 19967 * Multidata for performance reasons; instead, 19968 * we let the legacy path deal with grouping 19969 * it with the subsequent small mblks. 19970 */ 19971 if (*usable >= len && 19972 MBLKL((*xmit_tail)->b_cont) < spill) { 19973 max_pld = 0; 19974 break; /* done */ 19975 } 19976 19977 /* 19978 * We can't spillover, and we are near 19979 * the end of the current payload buffer, 19980 * so send what's left. 19981 */ 19982 ASSERT(*tail_unsent > 0); 19983 len = *tail_unsent; 19984 } 19985 19986 /* tail_unsent is negated if there is a spillover */ 19987 *tail_unsent -= len; 19988 *usable -= len; 19989 ASSERT(*usable >= 0); 19990 19991 if (*usable < mss) 19992 seg_len = *usable; 19993 /* 19994 * Sender SWS avoidance; see comments in tcp_send(); 19995 * everything else is the same, except that we only 19996 * do this here if there is no more data to be sent 19997 * following the current xmit_tail. We don't check 19998 * for 1-byte urgent data because we shouldn't get 19999 * here if TCP_URG_VALID is set. 20000 */ 20001 if (*usable > 0 && *usable < mss && 20002 ((md_pbuf_nxt == NULL && 20003 (*xmit_tail)->b_cont == NULL) || 20004 (md_pbuf_nxt != NULL && 20005 (*xmit_tail)->b_cont->b_cont == NULL)) && 20006 seg_len < (tcp->tcp_max_swnd >> 1) && 20007 (tcp->tcp_unsent - 20008 ((*snxt + len) - tcp->tcp_snxt)) > seg_len && 20009 !tcp->tcp_zero_win_probe) { 20010 if ((*snxt + len) == tcp->tcp_snxt && 20011 (*snxt + len) == tcp->tcp_suna) { 20012 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20013 } 20014 done = B_TRUE; 20015 } 20016 20017 /* 20018 * Prime pump for IP's checksumming on our behalf; 20019 * include the adjustment for a source route if any. 20020 * Do this only for software/partial hardware checksum 20021 * offload, as this field gets zeroed out later for 20022 * the full hardware checksum offload case. 20023 */ 20024 if (!(hwcksum_flags & HCK_FULLCKSUM)) { 20025 cksum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 20026 cksum = (cksum >> 16) + (cksum & 0xFFFF); 20027 U16_TO_ABE16(cksum, tcp->tcp_tcph->th_sum); 20028 } 20029 20030 U32_TO_ABE32(*snxt, tcp->tcp_tcph->th_seq); 20031 *snxt += len; 20032 20033 tcp->tcp_tcph->th_flags[0] = TH_ACK; 20034 /* 20035 * We set the PUSH bit only if TCP has no more buffered 20036 * data to be transmitted (or if sender SWS avoidance 20037 * takes place), as opposed to setting it for every 20038 * last packet in the burst. 20039 */ 20040 if (done || 20041 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) == 0) 20042 tcp->tcp_tcph->th_flags[0] |= TH_PUSH; 20043 20044 /* 20045 * Set FIN bit if this is our last segment; snxt 20046 * already includes its length, and it will not 20047 * be adjusted after this point. 20048 */ 20049 if (tcp->tcp_valid_bits == TCP_FSS_VALID && 20050 *snxt == tcp->tcp_fss) { 20051 if (!tcp->tcp_fin_acked) { 20052 tcp->tcp_tcph->th_flags[0] |= TH_FIN; 20053 BUMP_MIB(&tcp_mib, tcpOutControl); 20054 } 20055 if (!tcp->tcp_fin_sent) { 20056 tcp->tcp_fin_sent = B_TRUE; 20057 /* 20058 * tcp state must be ESTABLISHED 20059 * in order for us to get here in 20060 * the first place. 20061 */ 20062 tcp->tcp_state = TCPS_FIN_WAIT_1; 20063 20064 /* 20065 * Upon returning from this routine, 20066 * tcp_wput_data() will set tcp_snxt 20067 * to be equal to snxt + tcp_fin_sent. 20068 * This is essentially the same as 20069 * setting it to tcp_fss + 1. 20070 */ 20071 } 20072 } 20073 20074 tcp->tcp_last_sent_len = (ushort_t)len; 20075 20076 len += tcp_hdr_len; 20077 if (tcp->tcp_ipversion == IPV4_VERSION) 20078 tcp->tcp_ipha->ipha_length = htons(len); 20079 else 20080 tcp->tcp_ip6h->ip6_plen = htons(len - 20081 ((char *)&tcp->tcp_ip6h[1] - 20082 tcp->tcp_iphc)); 20083 20084 pkt_info->flags = (PDESC_HBUF_REF | PDESC_PBUF_REF); 20085 20086 /* setup header fragment */ 20087 PDESC_HDR_ADD(pkt_info, 20088 md_hbuf->b_rptr + cur_hdr_off, /* base */ 20089 tcp->tcp_mdt_hdr_head, /* head room */ 20090 tcp_hdr_len, /* len */ 20091 tcp->tcp_mdt_hdr_tail); /* tail room */ 20092 20093 ASSERT(pkt_info->hdr_lim - pkt_info->hdr_base == 20094 hdr_frag_sz); 20095 ASSERT(MBLKIN(md_hbuf, 20096 (pkt_info->hdr_base - md_hbuf->b_rptr), 20097 PDESC_HDRSIZE(pkt_info))); 20098 20099 /* setup first payload fragment */ 20100 PDESC_PLD_INIT(pkt_info); 20101 PDESC_PLD_SPAN_ADD(pkt_info, 20102 pbuf_idx, /* index */ 20103 md_pbuf->b_rptr + cur_pld_off, /* start */ 20104 tcp->tcp_last_sent_len); /* len */ 20105 20106 /* create a split-packet in case of a spillover */ 20107 if (md_pbuf_nxt != NULL) { 20108 ASSERT(spill > 0); 20109 ASSERT(pbuf_idx_nxt > pbuf_idx); 20110 ASSERT(!add_buffer); 20111 20112 md_pbuf = md_pbuf_nxt; 20113 md_pbuf_nxt = NULL; 20114 pbuf_idx = pbuf_idx_nxt; 20115 pbuf_idx_nxt = -1; 20116 cur_pld_off = spill; 20117 20118 /* trim out first payload fragment */ 20119 PDESC_PLD_SPAN_TRIM(pkt_info, 0, spill); 20120 20121 /* setup second payload fragment */ 20122 PDESC_PLD_SPAN_ADD(pkt_info, 20123 pbuf_idx, /* index */ 20124 md_pbuf->b_rptr, /* start */ 20125 spill); /* len */ 20126 20127 if ((*xmit_tail)->b_next == NULL) { 20128 /* 20129 * Store the lbolt used for RTT 20130 * estimation. We can only record one 20131 * timestamp per mblk so we do it when 20132 * we reach the end of the payload 20133 * buffer. Also we only take a new 20134 * timestamp sample when the previous 20135 * timed data from the same mblk has 20136 * been ack'ed. 20137 */ 20138 (*xmit_tail)->b_prev = local_time; 20139 (*xmit_tail)->b_next = 20140 (mblk_t *)(uintptr_t)first_snxt; 20141 } 20142 20143 first_snxt = *snxt - spill; 20144 20145 /* 20146 * Advance xmit_tail; usable could be 0 by 20147 * the time we got here, but we made sure 20148 * above that we would only spillover to 20149 * the next data block if usable includes 20150 * the spilled-over amount prior to the 20151 * subtraction. Therefore, we are sure 20152 * that xmit_tail->b_cont can't be NULL. 20153 */ 20154 ASSERT((*xmit_tail)->b_cont != NULL); 20155 *xmit_tail = (*xmit_tail)->b_cont; 20156 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 20157 (uintptr_t)INT_MAX); 20158 *tail_unsent = (int)MBLKL(*xmit_tail) - spill; 20159 } else { 20160 cur_pld_off += tcp->tcp_last_sent_len; 20161 } 20162 20163 /* 20164 * Fill in the header using the template header, and 20165 * add options such as time-stamp, ECN and/or SACK, 20166 * as needed. 20167 */ 20168 tcp_fill_header(tcp, pkt_info->hdr_rptr, 20169 (clock_t)local_time, num_sack_blk); 20170 20171 /* take care of some IP header businesses */ 20172 if (af == AF_INET) { 20173 ipha = (ipha_t *)pkt_info->hdr_rptr; 20174 20175 ASSERT(OK_32PTR((uchar_t *)ipha)); 20176 ASSERT(PDESC_HDRL(pkt_info) >= 20177 IP_SIMPLE_HDR_LENGTH); 20178 ASSERT(ipha->ipha_version_and_hdr_length == 20179 IP_SIMPLE_HDR_VERSION); 20180 20181 /* 20182 * Assign ident value for current packet; see 20183 * related comments in ip_wput_ire() about the 20184 * contract private interface with clustering 20185 * group. 20186 */ 20187 clusterwide = B_FALSE; 20188 if (cl_inet_ipident != NULL) { 20189 ASSERT(cl_inet_isclusterwide != NULL); 20190 if ((*cl_inet_isclusterwide)(IPPROTO_IP, 20191 AF_INET, 20192 (uint8_t *)(uintptr_t)src)) { 20193 ipha->ipha_ident = 20194 (*cl_inet_ipident) 20195 (IPPROTO_IP, AF_INET, 20196 (uint8_t *)(uintptr_t)src, 20197 (uint8_t *)(uintptr_t)dst); 20198 clusterwide = B_TRUE; 20199 } 20200 } 20201 20202 if (!clusterwide) { 20203 ipha->ipha_ident = (uint16_t) 20204 atomic_add_32_nv( 20205 &ire->ire_ident, 1); 20206 } 20207 #ifndef _BIG_ENDIAN 20208 ipha->ipha_ident = (ipha->ipha_ident << 8) | 20209 (ipha->ipha_ident >> 8); 20210 #endif 20211 } else { 20212 ip6h = (ip6_t *)pkt_info->hdr_rptr; 20213 20214 ASSERT(OK_32PTR((uchar_t *)ip6h)); 20215 ASSERT(IPVER(ip6h) == IPV6_VERSION); 20216 ASSERT(ip6h->ip6_nxt == IPPROTO_TCP); 20217 ASSERT(PDESC_HDRL(pkt_info) >= 20218 (IPV6_HDR_LEN + TCP_CSUM_OFFSET + 20219 TCP_CSUM_SIZE)); 20220 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 20221 20222 if (tcp->tcp_ip_forward_progress) { 20223 rconfirm = B_TRUE; 20224 tcp->tcp_ip_forward_progress = B_FALSE; 20225 } 20226 } 20227 20228 /* at least one payload span, and at most two */ 20229 ASSERT(pkt_info->pld_cnt > 0 && pkt_info->pld_cnt < 3); 20230 20231 /* add the packet descriptor to Multidata */ 20232 if ((pkt = mmd_addpdesc(mmd, pkt_info, &err, 20233 KM_NOSLEEP)) == NULL) { 20234 /* 20235 * Any failure other than ENOMEM indicates 20236 * that we have passed in invalid pkt_info 20237 * or parameters to mmd_addpdesc, which must 20238 * not happen. 20239 * 20240 * EINVAL is a result of failure on boundary 20241 * checks against the pkt_info contents. It 20242 * should not happen, and we panic because 20243 * either there's horrible heap corruption, 20244 * and/or programming mistake. 20245 */ 20246 if (err != ENOMEM) { 20247 cmn_err(CE_PANIC, "tcp_multisend: " 20248 "pdesc logic error detected for " 20249 "tcp %p mmd %p pinfo %p (%d)\n", 20250 (void *)tcp, (void *)mmd, 20251 (void *)pkt_info, err); 20252 } 20253 TCP_STAT(tcp_mdt_addpdescfail); 20254 goto legacy_send; /* out_of_mem */ 20255 } 20256 ASSERT(pkt != NULL); 20257 20258 /* calculate IP header and TCP checksums */ 20259 if (af == AF_INET) { 20260 /* calculate pseudo-header checksum */ 20261 cksum = (dst >> 16) + (dst & 0xFFFF) + 20262 (src >> 16) + (src & 0xFFFF); 20263 20264 /* offset for TCP header checksum */ 20265 up = IPH_TCPH_CHECKSUMP(ipha, 20266 IP_SIMPLE_HDR_LENGTH); 20267 20268 if (hwcksum_flags & HCK_FULLCKSUM) { 20269 /* 20270 * Hardware calculates pseudo-header, 20271 * header and payload checksums, so 20272 * zero out this field. 20273 */ 20274 *up = 0; 20275 } else if (hwcksum_flags & HCK_PARTIALCKSUM) { 20276 uint32_t sum; 20277 20278 /* pseudo-header checksumming */ 20279 sum = *up + cksum + IP_TCP_CSUM_COMP; 20280 sum = (sum & 0xFFFF) + (sum >> 16); 20281 *up = (sum & 0xFFFF) + (sum >> 16); 20282 } else { 20283 /* software checksumming */ 20284 TCP_STAT(tcp_out_sw_cksum); 20285 *up = IP_MD_CSUM(pkt, 20286 IP_SIMPLE_HDR_LENGTH, 20287 cksum + IP_TCP_CSUM_COMP); 20288 } 20289 20290 ipha->ipha_fragment_offset_and_flags |= 20291 (uint32_t)htons(ire->ire_frag_flag); 20292 20293 if (hwcksum_flags & HCK_IPV4_HDRCKSUM) { 20294 ipha->ipha_hdr_checksum = 0; 20295 } else { 20296 IP_HDR_CKSUM(ipha, cksum, 20297 ((uint32_t *)ipha)[0], 20298 ((uint16_t *)ipha)[4]); 20299 } 20300 } else { 20301 up = (uint16_t *)(((uchar_t *)ip6h) + 20302 IPV6_HDR_LEN + TCP_CSUM_OFFSET); 20303 20304 /* 20305 * Software checksumming (hardware checksum 20306 * offload for IPv6 will hopefully be 20307 * implemented one day). 20308 */ 20309 TCP_STAT(tcp_out_sw_cksum); 20310 *up = IP_MD_CSUM(pkt, 20311 IPV6_HDR_LEN - 2 * sizeof (in6_addr_t), 20312 htons(IPPROTO_TCP)); 20313 } 20314 20315 /* advance header offset */ 20316 cur_hdr_off += hdr_frag_sz; 20317 20318 obbytes += tcp->tcp_last_sent_len; 20319 ++obsegs; 20320 } while (!done && *usable > 0 && --num_burst_seg > 0 && 20321 *tail_unsent > 0); 20322 20323 if ((*xmit_tail)->b_next == NULL) { 20324 /* 20325 * Store the lbolt used for RTT estimation. We can only 20326 * record one timestamp per mblk so we do it when we 20327 * reach the end of the payload buffer. Also we only 20328 * take a new timestamp sample when the previous timed 20329 * data from the same mblk has been ack'ed. 20330 */ 20331 (*xmit_tail)->b_prev = local_time; 20332 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)first_snxt; 20333 } 20334 20335 ASSERT(*tail_unsent >= 0); 20336 if (*tail_unsent > 0) { 20337 /* 20338 * We got here because we broke out of the above 20339 * loop due to of one of the following cases: 20340 * 20341 * 1. len < adjusted MSS (i.e. small), 20342 * 2. Sender SWS avoidance, 20343 * 3. max_pld is zero. 20344 * 20345 * We are done for this Multidata, so trim our 20346 * last payload buffer (if any) accordingly. 20347 */ 20348 if (md_pbuf != NULL) 20349 md_pbuf->b_wptr -= *tail_unsent; 20350 } else if (*usable > 0) { 20351 *xmit_tail = (*xmit_tail)->b_cont; 20352 ASSERT((uintptr_t)MBLKL(*xmit_tail) <= 20353 (uintptr_t)INT_MAX); 20354 *tail_unsent = (int)MBLKL(*xmit_tail); 20355 add_buffer = B_TRUE; 20356 } 20357 } while (!done && *usable > 0 && num_burst_seg > 0 && 20358 (tcp_mdt_chain || max_pld > 0)); 20359 20360 /* send everything down */ 20361 tcp_multisend_data(tcp, ire, ill, md_mp_head, obsegs, obbytes, 20362 &rconfirm); 20363 20364 #undef PREP_NEW_MULTIDATA 20365 #undef PREP_NEW_PBUF 20366 #undef IPVER 20367 #undef TCP_CSUM_OFFSET 20368 #undef TCP_CSUM_SIZE 20369 20370 IRE_REFRELE(ire); 20371 return (0); 20372 } 20373 20374 /* 20375 * A wrapper function for sending one or more Multidata messages down to 20376 * the module below ip; this routine does not release the reference of the 20377 * IRE (caller does that). This routine is analogous to tcp_send_data(). 20378 */ 20379 static void 20380 tcp_multisend_data(tcp_t *tcp, ire_t *ire, const ill_t *ill, mblk_t *md_mp_head, 20381 const uint_t obsegs, const uint_t obbytes, boolean_t *rconfirm) 20382 { 20383 uint64_t delta; 20384 nce_t *nce; 20385 20386 ASSERT(ire != NULL && ill != NULL); 20387 ASSERT(ire->ire_stq != NULL); 20388 ASSERT(md_mp_head != NULL); 20389 ASSERT(rconfirm != NULL); 20390 20391 /* adjust MIBs and IRE timestamp */ 20392 TCP_RECORD_TRACE(tcp, md_mp_head, TCP_TRACE_SEND_PKT); 20393 tcp->tcp_obsegs += obsegs; 20394 UPDATE_MIB(&tcp_mib, tcpOutDataSegs, obsegs); 20395 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, obbytes); 20396 TCP_STAT_UPDATE(tcp_mdt_pkt_out, obsegs); 20397 20398 if (tcp->tcp_ipversion == IPV4_VERSION) { 20399 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v4, obsegs); 20400 UPDATE_MIB(&ip_mib, ipOutRequests, obsegs); 20401 } else { 20402 TCP_STAT_UPDATE(tcp_mdt_pkt_out_v6, obsegs); 20403 UPDATE_MIB(&ip6_mib, ipv6OutRequests, obsegs); 20404 } 20405 20406 ire->ire_ob_pkt_count += obsegs; 20407 if (ire->ire_ipif != NULL) 20408 atomic_add_32(&ire->ire_ipif->ipif_ob_pkt_count, obsegs); 20409 ire->ire_last_used_time = lbolt; 20410 20411 /* send it down */ 20412 putnext(ire->ire_stq, md_mp_head); 20413 20414 /* we're done for TCP/IPv4 */ 20415 if (tcp->tcp_ipversion == IPV4_VERSION) 20416 return; 20417 20418 nce = ire->ire_nce; 20419 20420 ASSERT(nce != NULL); 20421 ASSERT(!(nce->nce_flags & (NCE_F_NONUD|NCE_F_PERMANENT))); 20422 ASSERT(nce->nce_state != ND_INCOMPLETE); 20423 20424 /* reachability confirmation? */ 20425 if (*rconfirm) { 20426 nce->nce_last = TICK_TO_MSEC(lbolt64); 20427 if (nce->nce_state != ND_REACHABLE) { 20428 mutex_enter(&nce->nce_lock); 20429 nce->nce_state = ND_REACHABLE; 20430 nce->nce_pcnt = ND_MAX_UNICAST_SOLICIT; 20431 mutex_exit(&nce->nce_lock); 20432 (void) untimeout(nce->nce_timeout_id); 20433 if (ip_debug > 2) { 20434 /* ip1dbg */ 20435 pr_addr_dbg("tcp_multisend_data: state " 20436 "for %s changed to REACHABLE\n", 20437 AF_INET6, &ire->ire_addr_v6); 20438 } 20439 } 20440 /* reset transport reachability confirmation */ 20441 *rconfirm = B_FALSE; 20442 } 20443 20444 delta = TICK_TO_MSEC(lbolt64) - nce->nce_last; 20445 ip1dbg(("tcp_multisend_data: delta = %" PRId64 20446 " ill_reachable_time = %d \n", delta, ill->ill_reachable_time)); 20447 20448 if (delta > (uint64_t)ill->ill_reachable_time) { 20449 mutex_enter(&nce->nce_lock); 20450 switch (nce->nce_state) { 20451 case ND_REACHABLE: 20452 case ND_STALE: 20453 /* 20454 * ND_REACHABLE is identical to ND_STALE in this 20455 * specific case. If reachable time has expired for 20456 * this neighbor (delta is greater than reachable 20457 * time), conceptually, the neighbor cache is no 20458 * longer in REACHABLE state, but already in STALE 20459 * state. So the correct transition here is to 20460 * ND_DELAY. 20461 */ 20462 nce->nce_state = ND_DELAY; 20463 mutex_exit(&nce->nce_lock); 20464 NDP_RESTART_TIMER(nce, delay_first_probe_time); 20465 if (ip_debug > 3) { 20466 /* ip2dbg */ 20467 pr_addr_dbg("tcp_multisend_data: state " 20468 "for %s changed to DELAY\n", 20469 AF_INET6, &ire->ire_addr_v6); 20470 } 20471 break; 20472 case ND_DELAY: 20473 case ND_PROBE: 20474 mutex_exit(&nce->nce_lock); 20475 /* Timers have already started */ 20476 break; 20477 case ND_UNREACHABLE: 20478 /* 20479 * ndp timer has detected that this nce is 20480 * unreachable and initiated deleting this nce 20481 * and all its associated IREs. This is a race 20482 * where we found the ire before it was deleted 20483 * and have just sent out a packet using this 20484 * unreachable nce. 20485 */ 20486 mutex_exit(&nce->nce_lock); 20487 break; 20488 default: 20489 ASSERT(0); 20490 } 20491 } 20492 } 20493 20494 /* 20495 * tcp_send() is called by tcp_wput_data() for non-Multidata transmission 20496 * scheme, and returns one of the following: 20497 * 20498 * -1 = failed allocation. 20499 * 0 = success; burst count reached, or usable send window is too small, 20500 * and that we'd rather wait until later before sending again. 20501 * 1 = success; we are called from tcp_multisend(), and both usable send 20502 * window and tail_unsent are greater than the MDT threshold, and thus 20503 * Multidata Transmit should be used instead. 20504 */ 20505 static int 20506 tcp_send(queue_t *q, tcp_t *tcp, const int mss, const int tcp_hdr_len, 20507 const int tcp_tcp_hdr_len, const int num_sack_blk, int *usable, 20508 uint_t *snxt, int *tail_unsent, mblk_t **xmit_tail, mblk_t *local_time, 20509 const int mdt_thres) 20510 { 20511 int num_burst_seg = tcp->tcp_snd_burst; 20512 20513 for (;;) { 20514 struct datab *db; 20515 tcph_t *tcph; 20516 uint32_t sum; 20517 mblk_t *mp, *mp1; 20518 uchar_t *rptr; 20519 int len; 20520 20521 /* 20522 * If we're called by tcp_multisend(), and the amount of 20523 * sendable data as well as the size of current xmit_tail 20524 * is beyond the MDT threshold, return to the caller and 20525 * let the large data transmit be done using MDT. 20526 */ 20527 if (*usable > 0 && *usable > mdt_thres && 20528 (*tail_unsent > mdt_thres || (*tail_unsent == 0 && 20529 MBLKL((*xmit_tail)->b_cont) > mdt_thres))) { 20530 ASSERT(tcp->tcp_mdt); 20531 return (1); /* success; do large send */ 20532 } 20533 20534 if (num_burst_seg-- == 0) 20535 break; /* success; burst count reached */ 20536 20537 len = mss; 20538 if (len > *usable) { 20539 len = *usable; 20540 if (len <= 0) { 20541 /* Terminate the loop */ 20542 break; /* success; too small */ 20543 } 20544 /* 20545 * Sender silly-window avoidance. 20546 * Ignore this if we are going to send a 20547 * zero window probe out. 20548 * 20549 * TODO: force data into microscopic window? 20550 * ==> (!pushed || (unsent > usable)) 20551 */ 20552 if (len < (tcp->tcp_max_swnd >> 1) && 20553 (tcp->tcp_unsent - (*snxt - tcp->tcp_snxt)) > len && 20554 !((tcp->tcp_valid_bits & TCP_URG_VALID) && 20555 len == 1) && (! tcp->tcp_zero_win_probe)) { 20556 /* 20557 * If the retransmit timer is not running 20558 * we start it so that we will retransmit 20559 * in the case when the the receiver has 20560 * decremented the window. 20561 */ 20562 if (*snxt == tcp->tcp_snxt && 20563 *snxt == tcp->tcp_suna) { 20564 /* 20565 * We are not supposed to send 20566 * anything. So let's wait a little 20567 * bit longer before breaking SWS 20568 * avoidance. 20569 * 20570 * What should the value be? 20571 * Suggestion: MAX(init rexmit time, 20572 * tcp->tcp_rto) 20573 */ 20574 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 20575 } 20576 break; /* success; too small */ 20577 } 20578 } 20579 20580 tcph = tcp->tcp_tcph; 20581 20582 *usable -= len; /* Approximate - can be adjusted later */ 20583 if (*usable > 0) 20584 tcph->th_flags[0] = TH_ACK; 20585 else 20586 tcph->th_flags[0] = (TH_ACK | TH_PUSH); 20587 20588 /* 20589 * Prime pump for IP's checksumming on our behalf 20590 * Include the adjustment for a source route if any. 20591 */ 20592 sum = len + tcp_tcp_hdr_len + tcp->tcp_sum; 20593 sum = (sum >> 16) + (sum & 0xFFFF); 20594 U16_TO_ABE16(sum, tcph->th_sum); 20595 20596 U32_TO_ABE32(*snxt, tcph->th_seq); 20597 20598 /* 20599 * Branch off to tcp_xmit_mp() if any of the VALID bits is 20600 * set. For the case when TCP_FSS_VALID is the only valid 20601 * bit (normal active close), branch off only when we think 20602 * that the FIN flag needs to be set. Note for this case, 20603 * that (snxt + len) may not reflect the actual seg_len, 20604 * as len may be further reduced in tcp_xmit_mp(). If len 20605 * gets modified, we will end up here again. 20606 */ 20607 if (tcp->tcp_valid_bits != 0 && 20608 (tcp->tcp_valid_bits != TCP_FSS_VALID || 20609 ((*snxt + len) == tcp->tcp_fss))) { 20610 uchar_t *prev_rptr; 20611 uint32_t prev_snxt = tcp->tcp_snxt; 20612 20613 if (*tail_unsent == 0) { 20614 ASSERT((*xmit_tail)->b_cont != NULL); 20615 *xmit_tail = (*xmit_tail)->b_cont; 20616 prev_rptr = (*xmit_tail)->b_rptr; 20617 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20618 (*xmit_tail)->b_rptr); 20619 } else { 20620 prev_rptr = (*xmit_tail)->b_rptr; 20621 (*xmit_tail)->b_rptr = (*xmit_tail)->b_wptr - 20622 *tail_unsent; 20623 } 20624 mp = tcp_xmit_mp(tcp, *xmit_tail, len, NULL, NULL, 20625 *snxt, B_FALSE, (uint32_t *)&len, B_FALSE); 20626 /* Restore tcp_snxt so we get amount sent right. */ 20627 tcp->tcp_snxt = prev_snxt; 20628 if (prev_rptr == (*xmit_tail)->b_rptr) { 20629 /* 20630 * If the previous timestamp is still in use, 20631 * don't stomp on it. 20632 */ 20633 if ((*xmit_tail)->b_next == NULL) { 20634 (*xmit_tail)->b_prev = local_time; 20635 (*xmit_tail)->b_next = 20636 (mblk_t *)(uintptr_t)(*snxt); 20637 } 20638 } else 20639 (*xmit_tail)->b_rptr = prev_rptr; 20640 20641 if (mp == NULL) 20642 return (-1); 20643 mp1 = mp->b_cont; 20644 20645 tcp->tcp_last_sent_len = (ushort_t)len; 20646 while (mp1->b_cont) { 20647 *xmit_tail = (*xmit_tail)->b_cont; 20648 (*xmit_tail)->b_prev = local_time; 20649 (*xmit_tail)->b_next = 20650 (mblk_t *)(uintptr_t)(*snxt); 20651 mp1 = mp1->b_cont; 20652 } 20653 *snxt += len; 20654 *tail_unsent = (*xmit_tail)->b_wptr - mp1->b_wptr; 20655 BUMP_LOCAL(tcp->tcp_obsegs); 20656 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20657 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20658 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20659 tcp_send_data(tcp, q, mp); 20660 continue; 20661 } 20662 20663 *snxt += len; /* Adjust later if we don't send all of len */ 20664 BUMP_MIB(&tcp_mib, tcpOutDataSegs); 20665 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, len); 20666 20667 if (*tail_unsent) { 20668 /* Are the bytes above us in flight? */ 20669 rptr = (*xmit_tail)->b_wptr - *tail_unsent; 20670 if (rptr != (*xmit_tail)->b_rptr) { 20671 *tail_unsent -= len; 20672 tcp->tcp_last_sent_len = (ushort_t)len; 20673 len += tcp_hdr_len; 20674 if (tcp->tcp_ipversion == IPV4_VERSION) 20675 tcp->tcp_ipha->ipha_length = htons(len); 20676 else 20677 tcp->tcp_ip6h->ip6_plen = 20678 htons(len - 20679 ((char *)&tcp->tcp_ip6h[1] - 20680 tcp->tcp_iphc)); 20681 mp = dupb(*xmit_tail); 20682 if (!mp) 20683 return (-1); /* out_of_mem */ 20684 mp->b_rptr = rptr; 20685 /* 20686 * If the old timestamp is no longer in use, 20687 * sample a new timestamp now. 20688 */ 20689 if ((*xmit_tail)->b_next == NULL) { 20690 (*xmit_tail)->b_prev = local_time; 20691 (*xmit_tail)->b_next = 20692 (mblk_t *)(uintptr_t)(*snxt-len); 20693 } 20694 goto must_alloc; 20695 } 20696 } else { 20697 *xmit_tail = (*xmit_tail)->b_cont; 20698 ASSERT((uintptr_t)((*xmit_tail)->b_wptr - 20699 (*xmit_tail)->b_rptr) <= (uintptr_t)INT_MAX); 20700 *tail_unsent = (int)((*xmit_tail)->b_wptr - 20701 (*xmit_tail)->b_rptr); 20702 } 20703 20704 (*xmit_tail)->b_prev = local_time; 20705 (*xmit_tail)->b_next = (mblk_t *)(uintptr_t)(*snxt - len); 20706 20707 *tail_unsent -= len; 20708 tcp->tcp_last_sent_len = (ushort_t)len; 20709 20710 len += tcp_hdr_len; 20711 if (tcp->tcp_ipversion == IPV4_VERSION) 20712 tcp->tcp_ipha->ipha_length = htons(len); 20713 else 20714 tcp->tcp_ip6h->ip6_plen = htons(len - 20715 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 20716 20717 mp = dupb(*xmit_tail); 20718 if (!mp) 20719 return (-1); /* out_of_mem */ 20720 20721 len = tcp_hdr_len; 20722 /* 20723 * There are four reasons to allocate a new hdr mblk: 20724 * 1) The bytes above us are in use by another packet 20725 * 2) We don't have good alignment 20726 * 3) The mblk is being shared 20727 * 4) We don't have enough room for a header 20728 */ 20729 rptr = mp->b_rptr - len; 20730 if (!OK_32PTR(rptr) || 20731 ((db = mp->b_datap), db->db_ref != 2) || 20732 rptr < db->db_base) { 20733 /* NOTE: we assume allocb returns an OK_32PTR */ 20734 20735 must_alloc:; 20736 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + 20737 tcp_wroff_xtra, BPRI_MED); 20738 if (!mp1) { 20739 freemsg(mp); 20740 return (-1); /* out_of_mem */ 20741 } 20742 mp1->b_cont = mp; 20743 mp = mp1; 20744 /* Leave room for Link Level header */ 20745 len = tcp_hdr_len; 20746 rptr = &mp->b_rptr[tcp_wroff_xtra]; 20747 mp->b_wptr = &rptr[len]; 20748 } 20749 20750 /* 20751 * Fill in the header using the template header, and add 20752 * options such as time-stamp, ECN and/or SACK, as needed. 20753 */ 20754 tcp_fill_header(tcp, rptr, (clock_t)local_time, num_sack_blk); 20755 20756 mp->b_rptr = rptr; 20757 20758 if (*tail_unsent) { 20759 int spill = *tail_unsent; 20760 20761 mp1 = mp->b_cont; 20762 if (!mp1) 20763 mp1 = mp; 20764 20765 /* 20766 * If we're a little short, tack on more mblks until 20767 * there is no more spillover. 20768 */ 20769 while (spill < 0) { 20770 mblk_t *nmp; 20771 int nmpsz; 20772 20773 nmp = (*xmit_tail)->b_cont; 20774 nmpsz = MBLKL(nmp); 20775 20776 /* 20777 * Excess data in mblk; can we split it? 20778 * If MDT is enabled for the connection, 20779 * keep on splitting as this is a transient 20780 * send path. 20781 */ 20782 if (!tcp->tcp_mdt && (spill + nmpsz > 0)) { 20783 /* 20784 * Don't split if stream head was 20785 * told to break up larger writes 20786 * into smaller ones. 20787 */ 20788 if (tcp->tcp_maxpsz > 0) 20789 break; 20790 20791 /* 20792 * Next mblk is less than SMSS/2 20793 * rounded up to nearest 64-byte; 20794 * let it get sent as part of the 20795 * next segment. 20796 */ 20797 if (tcp->tcp_localnet && 20798 !tcp->tcp_cork && 20799 (nmpsz < roundup((mss >> 1), 64))) 20800 break; 20801 } 20802 20803 *xmit_tail = nmp; 20804 ASSERT((uintptr_t)nmpsz <= (uintptr_t)INT_MAX); 20805 /* Stash for rtt use later */ 20806 (*xmit_tail)->b_prev = local_time; 20807 (*xmit_tail)->b_next = 20808 (mblk_t *)(uintptr_t)(*snxt - len); 20809 mp1->b_cont = dupb(*xmit_tail); 20810 mp1 = mp1->b_cont; 20811 20812 spill += nmpsz; 20813 if (mp1 == NULL) { 20814 *tail_unsent = spill; 20815 freemsg(mp); 20816 return (-1); /* out_of_mem */ 20817 } 20818 } 20819 20820 /* Trim back any surplus on the last mblk */ 20821 if (spill >= 0) { 20822 mp1->b_wptr -= spill; 20823 *tail_unsent = spill; 20824 } else { 20825 /* 20826 * We did not send everything we could in 20827 * order to remain within the b_cont limit. 20828 */ 20829 *usable -= spill; 20830 *snxt += spill; 20831 tcp->tcp_last_sent_len += spill; 20832 UPDATE_MIB(&tcp_mib, tcpOutDataBytes, spill); 20833 /* 20834 * Adjust the checksum 20835 */ 20836 tcph = (tcph_t *)(rptr + tcp->tcp_ip_hdr_len); 20837 sum += spill; 20838 sum = (sum >> 16) + (sum & 0xFFFF); 20839 U16_TO_ABE16(sum, tcph->th_sum); 20840 if (tcp->tcp_ipversion == IPV4_VERSION) { 20841 sum = ntohs( 20842 ((ipha_t *)rptr)->ipha_length) + 20843 spill; 20844 ((ipha_t *)rptr)->ipha_length = 20845 htons(sum); 20846 } else { 20847 sum = ntohs( 20848 ((ip6_t *)rptr)->ip6_plen) + 20849 spill; 20850 ((ip6_t *)rptr)->ip6_plen = 20851 htons(sum); 20852 } 20853 *tail_unsent = 0; 20854 } 20855 } 20856 if (tcp->tcp_ip_forward_progress) { 20857 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 20858 *(uint32_t *)mp->b_rptr |= IP_FORWARD_PROG; 20859 tcp->tcp_ip_forward_progress = B_FALSE; 20860 } 20861 20862 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 20863 tcp_send_data(tcp, q, mp); 20864 BUMP_LOCAL(tcp->tcp_obsegs); 20865 } 20866 20867 return (0); 20868 } 20869 20870 /* Unlink and return any mblk that looks like it contains a MDT info */ 20871 static mblk_t * 20872 tcp_mdt_info_mp(mblk_t *mp) 20873 { 20874 mblk_t *prev_mp; 20875 20876 for (;;) { 20877 prev_mp = mp; 20878 /* no more to process? */ 20879 if ((mp = mp->b_cont) == NULL) 20880 break; 20881 20882 switch (DB_TYPE(mp)) { 20883 case M_CTL: 20884 if (*(uint32_t *)mp->b_rptr != MDT_IOC_INFO_UPDATE) 20885 continue; 20886 ASSERT(prev_mp != NULL); 20887 prev_mp->b_cont = mp->b_cont; 20888 mp->b_cont = NULL; 20889 return (mp); 20890 default: 20891 break; 20892 } 20893 } 20894 return (mp); 20895 } 20896 20897 /* MDT info update routine, called when IP notifies us about MDT */ 20898 static void 20899 tcp_mdt_update(tcp_t *tcp, ill_mdt_capab_t *mdt_capab, boolean_t first) 20900 { 20901 boolean_t prev_state; 20902 20903 /* 20904 * IP is telling us to abort MDT on this connection? We know 20905 * this because the capability is only turned off when IP 20906 * encounters some pathological cases, e.g. link-layer change 20907 * where the new driver doesn't support MDT, or in situation 20908 * where MDT usage on the link-layer has been switched off. 20909 * IP would not have sent us the initial MDT_IOC_INFO_UPDATE 20910 * if the link-layer doesn't support MDT, and if it does, it 20911 * will indicate that the feature is to be turned on. 20912 */ 20913 prev_state = tcp->tcp_mdt; 20914 tcp->tcp_mdt = (mdt_capab->ill_mdt_on != 0); 20915 if (!tcp->tcp_mdt && !first) { 20916 TCP_STAT(tcp_mdt_conn_halted3); 20917 ip1dbg(("tcp_mdt_update: disabling MDT for connp %p\n", 20918 (void *)tcp->tcp_connp)); 20919 } 20920 20921 /* 20922 * We currently only support MDT on simple TCP/{IPv4,IPv6}, 20923 * so disable MDT otherwise. The checks are done here 20924 * and in tcp_wput_data(). 20925 */ 20926 if (tcp->tcp_mdt && 20927 (tcp->tcp_ipversion == IPV4_VERSION && 20928 tcp->tcp_ip_hdr_len != IP_SIMPLE_HDR_LENGTH) || 20929 (tcp->tcp_ipversion == IPV6_VERSION && 20930 tcp->tcp_ip_hdr_len != IPV6_HDR_LEN)) 20931 tcp->tcp_mdt = B_FALSE; 20932 20933 if (tcp->tcp_mdt) { 20934 if (mdt_capab->ill_mdt_version != MDT_VERSION_2) { 20935 cmn_err(CE_NOTE, "tcp_mdt_update: unknown MDT " 20936 "version (%d), expected version is %d", 20937 mdt_capab->ill_mdt_version, MDT_VERSION_2); 20938 tcp->tcp_mdt = B_FALSE; 20939 return; 20940 } 20941 20942 /* 20943 * We need the driver to be able to handle at least three 20944 * spans per packet in order for tcp MDT to be utilized. 20945 * The first is for the header portion, while the rest are 20946 * needed to handle a packet that straddles across two 20947 * virtually non-contiguous buffers; a typical tcp packet 20948 * therefore consists of only two spans. Note that we take 20949 * a zero as "don't care". 20950 */ 20951 if (mdt_capab->ill_mdt_span_limit > 0 && 20952 mdt_capab->ill_mdt_span_limit < 3) { 20953 tcp->tcp_mdt = B_FALSE; 20954 return; 20955 } 20956 20957 /* a zero means driver wants default value */ 20958 tcp->tcp_mdt_max_pld = MIN(mdt_capab->ill_mdt_max_pld, 20959 tcp_mdt_max_pbufs); 20960 if (tcp->tcp_mdt_max_pld == 0) 20961 tcp->tcp_mdt_max_pld = tcp_mdt_max_pbufs; 20962 20963 /* ensure 32-bit alignment */ 20964 tcp->tcp_mdt_hdr_head = roundup(MAX(tcp_mdt_hdr_head_min, 20965 mdt_capab->ill_mdt_hdr_head), 4); 20966 tcp->tcp_mdt_hdr_tail = roundup(MAX(tcp_mdt_hdr_tail_min, 20967 mdt_capab->ill_mdt_hdr_tail), 4); 20968 20969 if (!first && !prev_state) { 20970 TCP_STAT(tcp_mdt_conn_resumed2); 20971 ip1dbg(("tcp_mdt_update: reenabling MDT for connp %p\n", 20972 (void *)tcp->tcp_connp)); 20973 } 20974 } 20975 } 20976 20977 static void 20978 tcp_ire_ill_check(tcp_t *tcp, ire_t *ire, ill_t *ill, boolean_t check_mdt) 20979 { 20980 conn_t *connp = tcp->tcp_connp; 20981 20982 ASSERT(ire != NULL); 20983 20984 /* 20985 * We may be in the fastpath here, and although we essentially do 20986 * similar checks as in ip_bind_connected{_v6}/ip_mdinfo_return, 20987 * we try to keep things as brief as possible. After all, these 20988 * are only best-effort checks, and we do more thorough ones prior 20989 * to calling tcp_multisend(). 20990 */ 20991 if (ip_multidata_outbound && check_mdt && 20992 !(ire->ire_type & (IRE_LOCAL | IRE_LOOPBACK)) && 20993 ill != NULL && (ill->ill_capabilities & ILL_CAPAB_MDT) && 20994 !CONN_IPSEC_OUT_ENCAPSULATED(connp) && 20995 !(ire->ire_flags & RTF_MULTIRT) && 20996 !IPP_ENABLED(IPP_LOCAL_OUT) && 20997 CONN_IS_MD_FASTPATH(connp)) { 20998 /* Remember the result */ 20999 connp->conn_mdt_ok = B_TRUE; 21000 21001 ASSERT(ill->ill_mdt_capab != NULL); 21002 if (!ill->ill_mdt_capab->ill_mdt_on) { 21003 /* 21004 * If MDT has been previously turned off in the past, 21005 * and we currently can do MDT (due to IPQoS policy 21006 * removal, etc.) then enable it for this interface. 21007 */ 21008 ill->ill_mdt_capab->ill_mdt_on = 1; 21009 ip1dbg(("tcp_ire_ill_check: connp %p enables MDT for " 21010 "interface %s\n", (void *)connp, ill->ill_name)); 21011 } 21012 tcp_mdt_update(tcp, ill->ill_mdt_capab, B_TRUE); 21013 } 21014 21015 /* 21016 * The goal is to reduce the number of generated tcp segments by 21017 * setting the maxpsz multiplier to 0; this will have an affect on 21018 * tcp_maxpsz_set(). With this behavior, tcp will pack more data 21019 * into each packet, up to SMSS bytes. Doing this reduces the number 21020 * of outbound segments and incoming ACKs, thus allowing for better 21021 * network and system performance. In contrast the legacy behavior 21022 * may result in sending less than SMSS size, because the last mblk 21023 * for some packets may have more data than needed to make up SMSS, 21024 * and the legacy code refused to "split" it. 21025 * 21026 * We apply the new behavior on following situations: 21027 * 21028 * 1) Loopback connections, 21029 * 2) Connections in which the remote peer is not on local subnet, 21030 * 3) Local subnet connections over the bge interface (see below). 21031 * 21032 * Ideally, we would like this behavior to apply for interfaces other 21033 * than bge. However, doing so would negatively impact drivers which 21034 * perform dynamic mapping and unmapping of DMA resources, which are 21035 * increased by setting the maxpsz multiplier to 0 (more mblks per 21036 * packet will be generated by tcp). The bge driver does not suffer 21037 * from this, as it copies the mblks into pre-mapped buffers, and 21038 * therefore does not require more I/O resources than before. 21039 * 21040 * Otherwise, this behavior is present on all network interfaces when 21041 * the destination endpoint is non-local, since reducing the number 21042 * of packets in general is good for the network. 21043 * 21044 * TODO We need to remove this hard-coded conditional for bge once 21045 * a better "self-tuning" mechanism, or a way to comprehend 21046 * the driver transmit strategy is devised. Until the solution 21047 * is found and well understood, we live with this hack. 21048 */ 21049 if (!tcp_static_maxpsz && 21050 (tcp->tcp_loopback || !tcp->tcp_localnet || 21051 (ill->ill_name_length > 3 && bcmp(ill->ill_name, "bge", 3) == 0))) { 21052 /* override the default value */ 21053 tcp->tcp_maxpsz = 0; 21054 21055 ip3dbg(("tcp_ire_ill_check: connp %p tcp_maxpsz %d on " 21056 "interface %s\n", (void *)connp, tcp->tcp_maxpsz, 21057 ill != NULL ? ill->ill_name : ipif_loopback_name)); 21058 } 21059 21060 /* set the stream head parameters accordingly */ 21061 (void) tcp_maxpsz_set(tcp, B_TRUE); 21062 } 21063 21064 /* tcp_wput_flush is called by tcp_wput_nondata to handle M_FLUSH messages. */ 21065 static void 21066 tcp_wput_flush(tcp_t *tcp, mblk_t *mp) 21067 { 21068 uchar_t fval = *mp->b_rptr; 21069 mblk_t *tail; 21070 queue_t *q = tcp->tcp_wq; 21071 21072 /* TODO: How should flush interact with urgent data? */ 21073 if ((fval & FLUSHW) && tcp->tcp_xmit_head && 21074 !(tcp->tcp_valid_bits & TCP_URG_VALID)) { 21075 /* 21076 * Flush only data that has not yet been put on the wire. If 21077 * we flush data that we have already transmitted, life, as we 21078 * know it, may come to an end. 21079 */ 21080 tail = tcp->tcp_xmit_tail; 21081 tail->b_wptr -= tcp->tcp_xmit_tail_unsent; 21082 tcp->tcp_xmit_tail_unsent = 0; 21083 tcp->tcp_unsent = 0; 21084 if (tail->b_wptr != tail->b_rptr) 21085 tail = tail->b_cont; 21086 if (tail) { 21087 mblk_t **excess = &tcp->tcp_xmit_head; 21088 for (;;) { 21089 mblk_t *mp1 = *excess; 21090 if (mp1 == tail) 21091 break; 21092 tcp->tcp_xmit_tail = mp1; 21093 tcp->tcp_xmit_last = mp1; 21094 excess = &mp1->b_cont; 21095 } 21096 *excess = NULL; 21097 tcp_close_mpp(&tail); 21098 if (tcp->tcp_snd_zcopy_aware) 21099 tcp_zcopy_notify(tcp); 21100 } 21101 /* 21102 * We have no unsent data, so unsent must be less than 21103 * tcp_xmit_lowater, so re-enable flow. 21104 */ 21105 if (tcp->tcp_flow_stopped) { 21106 tcp->tcp_flow_stopped = B_FALSE; 21107 tcp_clrqfull(tcp); 21108 } 21109 } 21110 /* 21111 * TODO: you can't just flush these, you have to increase rwnd for one 21112 * thing. For another, how should urgent data interact? 21113 */ 21114 if (fval & FLUSHR) { 21115 *mp->b_rptr = fval & ~FLUSHW; 21116 /* XXX */ 21117 qreply(q, mp); 21118 return; 21119 } 21120 freemsg(mp); 21121 } 21122 21123 /* 21124 * tcp_wput_iocdata is called by tcp_wput_nondata to handle all M_IOCDATA 21125 * messages. 21126 */ 21127 static void 21128 tcp_wput_iocdata(tcp_t *tcp, mblk_t *mp) 21129 { 21130 mblk_t *mp1; 21131 STRUCT_HANDLE(strbuf, sb); 21132 uint16_t port; 21133 queue_t *q = tcp->tcp_wq; 21134 in6_addr_t v6addr; 21135 ipaddr_t v4addr; 21136 uint32_t flowinfo = 0; 21137 int addrlen; 21138 21139 /* Make sure it is one of ours. */ 21140 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 21141 case TI_GETMYNAME: 21142 case TI_GETPEERNAME: 21143 break; 21144 default: 21145 CALL_IP_WPUT(tcp->tcp_connp, q, mp); 21146 return; 21147 } 21148 switch (mi_copy_state(q, mp, &mp1)) { 21149 case -1: 21150 return; 21151 case MI_COPY_CASE(MI_COPY_IN, 1): 21152 break; 21153 case MI_COPY_CASE(MI_COPY_OUT, 1): 21154 /* Copy out the strbuf. */ 21155 mi_copyout(q, mp); 21156 return; 21157 case MI_COPY_CASE(MI_COPY_OUT, 2): 21158 /* All done. */ 21159 mi_copy_done(q, mp, 0); 21160 return; 21161 default: 21162 mi_copy_done(q, mp, EPROTO); 21163 return; 21164 } 21165 /* Check alignment of the strbuf */ 21166 if (!OK_32PTR(mp1->b_rptr)) { 21167 mi_copy_done(q, mp, EINVAL); 21168 return; 21169 } 21170 21171 STRUCT_SET_HANDLE(sb, ((struct iocblk *)mp->b_rptr)->ioc_flag, 21172 (void *)mp1->b_rptr); 21173 addrlen = tcp->tcp_family == AF_INET ? sizeof (sin_t) : sizeof (sin6_t); 21174 21175 if (STRUCT_FGET(sb, maxlen) < addrlen) { 21176 mi_copy_done(q, mp, EINVAL); 21177 return; 21178 } 21179 switch (((struct iocblk *)mp->b_rptr)->ioc_cmd) { 21180 case TI_GETMYNAME: 21181 if (tcp->tcp_family == AF_INET) { 21182 if (tcp->tcp_ipversion == IPV4_VERSION) { 21183 v4addr = tcp->tcp_ipha->ipha_src; 21184 } else { 21185 /* can't return an address in this case */ 21186 v4addr = 0; 21187 } 21188 } else { 21189 /* tcp->tcp_family == AF_INET6 */ 21190 if (tcp->tcp_ipversion == IPV4_VERSION) { 21191 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 21192 &v6addr); 21193 } else { 21194 v6addr = tcp->tcp_ip6h->ip6_src; 21195 } 21196 } 21197 port = tcp->tcp_lport; 21198 break; 21199 case TI_GETPEERNAME: 21200 if (tcp->tcp_family == AF_INET) { 21201 if (tcp->tcp_ipversion == IPV4_VERSION) { 21202 IN6_V4MAPPED_TO_IPADDR(&tcp->tcp_remote_v6, 21203 v4addr); 21204 } else { 21205 /* can't return an address in this case */ 21206 v4addr = 0; 21207 } 21208 } else { 21209 /* tcp->tcp_family == AF_INET6) */ 21210 v6addr = tcp->tcp_remote_v6; 21211 if (tcp->tcp_ipversion == IPV6_VERSION) { 21212 /* 21213 * No flowinfo if tcp->tcp_ipversion is v4. 21214 * 21215 * flowinfo was already initialized to zero 21216 * where it was declared above, so only 21217 * set it if ipversion is v6. 21218 */ 21219 flowinfo = tcp->tcp_ip6h->ip6_vcf & 21220 ~IPV6_VERS_AND_FLOW_MASK; 21221 } 21222 } 21223 port = tcp->tcp_fport; 21224 break; 21225 default: 21226 mi_copy_done(q, mp, EPROTO); 21227 return; 21228 } 21229 mp1 = mi_copyout_alloc(q, mp, STRUCT_FGETP(sb, buf), addrlen, B_TRUE); 21230 if (!mp1) 21231 return; 21232 21233 if (tcp->tcp_family == AF_INET) { 21234 sin_t *sin; 21235 21236 STRUCT_FSET(sb, len, (int)sizeof (sin_t)); 21237 sin = (sin_t *)mp1->b_rptr; 21238 mp1->b_wptr = (uchar_t *)&sin[1]; 21239 *sin = sin_null; 21240 sin->sin_family = AF_INET; 21241 sin->sin_addr.s_addr = v4addr; 21242 sin->sin_port = port; 21243 } else { 21244 /* tcp->tcp_family == AF_INET6 */ 21245 sin6_t *sin6; 21246 21247 STRUCT_FSET(sb, len, (int)sizeof (sin6_t)); 21248 sin6 = (sin6_t *)mp1->b_rptr; 21249 mp1->b_wptr = (uchar_t *)&sin6[1]; 21250 *sin6 = sin6_null; 21251 sin6->sin6_family = AF_INET6; 21252 sin6->sin6_flowinfo = flowinfo; 21253 sin6->sin6_addr = v6addr; 21254 sin6->sin6_port = port; 21255 } 21256 /* Copy out the address */ 21257 mi_copyout(q, mp); 21258 } 21259 21260 /* 21261 * tcp_wput_ioctl is called by tcp_wput_nondata() to handle all M_IOCTL 21262 * messages. 21263 */ 21264 /* ARGSUSED */ 21265 static void 21266 tcp_wput_ioctl(void *arg, mblk_t *mp, void *arg2) 21267 { 21268 conn_t *connp = (conn_t *)arg; 21269 tcp_t *tcp = connp->conn_tcp; 21270 queue_t *q = tcp->tcp_wq; 21271 struct iocblk *iocp; 21272 21273 ASSERT(DB_TYPE(mp) == M_IOCTL); 21274 /* 21275 * Try and ASSERT the minimum possible references on the 21276 * conn early enough. Since we are executing on write side, 21277 * the connection is obviously not detached and that means 21278 * there is a ref each for TCP and IP. Since we are behind 21279 * the squeue, the minimum references needed are 3. If the 21280 * conn is in classifier hash list, there should be an 21281 * extra ref for that (we check both the possibilities). 21282 */ 21283 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21284 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21285 21286 iocp = (struct iocblk *)mp->b_rptr; 21287 switch (iocp->ioc_cmd) { 21288 case TCP_IOC_DEFAULT_Q: 21289 /* Wants to be the default wq. */ 21290 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 21291 iocp->ioc_error = EPERM; 21292 iocp->ioc_count = 0; 21293 mp->b_datap->db_type = M_IOCACK; 21294 qreply(q, mp); 21295 return; 21296 } 21297 tcp_def_q_set(tcp, mp); 21298 return; 21299 case SIOCPOPSOCKFS: 21300 /* 21301 * sockfs is being I_POP'ed, reset the flag 21302 * indicating this 21303 */ 21304 tcp->tcp_issocket = B_FALSE; 21305 21306 /* 21307 * Insert this socket into the acceptor hash. 21308 * We might need it for T_CONN_RES message 21309 */ 21310 #ifdef _ILP32 21311 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 21312 #else 21313 tcp->tcp_acceptor_id = tcp->tcp_connp->conn_dev; 21314 #endif 21315 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 21316 mp->b_datap->db_type = M_IOCACK; 21317 iocp->ioc_count = 0; 21318 iocp->ioc_error = 0; 21319 iocp->ioc_rval = 0; 21320 qreply(q, mp); 21321 return; 21322 } 21323 CALL_IP_WPUT(connp, q, mp); 21324 } 21325 21326 /* 21327 * This routine is called by tcp_wput() to handle all TPI requests. 21328 */ 21329 /* ARGSUSED */ 21330 static void 21331 tcp_wput_proto(void *arg, mblk_t *mp, void *arg2) 21332 { 21333 conn_t *connp = (conn_t *)arg; 21334 tcp_t *tcp = connp->conn_tcp; 21335 union T_primitives *tprim = (union T_primitives *)mp->b_rptr; 21336 uchar_t *rptr; 21337 t_scalar_t type; 21338 int len; 21339 cred_t *cr = DB_CREDDEF(mp, tcp->tcp_cred); 21340 21341 /* 21342 * Try and ASSERT the minimum possible references on the 21343 * conn early enough. Since we are executing on write side, 21344 * the connection is obviously not detached and that means 21345 * there is a ref each for TCP and IP. Since we are behind 21346 * the squeue, the minimum references needed are 3. If the 21347 * conn is in classifier hash list, there should be an 21348 * extra ref for that (we check both the possibilities). 21349 */ 21350 ASSERT((connp->conn_fanout != NULL && connp->conn_ref >= 4) || 21351 (connp->conn_fanout == NULL && connp->conn_ref >= 3)); 21352 21353 rptr = mp->b_rptr; 21354 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 21355 if ((mp->b_wptr - rptr) >= sizeof (t_scalar_t)) { 21356 type = ((union T_primitives *)rptr)->type; 21357 if (type == T_EXDATA_REQ) { 21358 len = msgdsize(mp->b_cont) - 1; 21359 if (len < 0) { 21360 freemsg(mp); 21361 return; 21362 } 21363 /* 21364 * Try to force urgent data out on the wire. 21365 * Even if we have unsent data this will 21366 * at least send the urgent flag. 21367 * XXX does not handle more flag correctly. 21368 */ 21369 len += tcp->tcp_unsent; 21370 len += tcp->tcp_snxt; 21371 tcp->tcp_urg = len; 21372 tcp->tcp_valid_bits |= TCP_URG_VALID; 21373 21374 /* Bypass tcp protocol for fused tcp loopback */ 21375 if (tcp->tcp_fused && tcp_fuse_output(tcp, mp)) 21376 return; 21377 } else if (type != T_DATA_REQ) { 21378 goto non_urgent_data; 21379 } 21380 /* TODO: options, flags, ... from user */ 21381 /* Set length to zero for reclamation below */ 21382 tcp_wput_data(tcp, mp->b_cont, B_TRUE); 21383 freeb(mp); 21384 return; 21385 } else { 21386 if (tcp->tcp_debug) { 21387 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 21388 "tcp_wput_proto, dropping one..."); 21389 } 21390 freemsg(mp); 21391 return; 21392 } 21393 21394 non_urgent_data: 21395 21396 switch ((int)tprim->type) { 21397 case O_T_BIND_REQ: /* bind request */ 21398 case T_BIND_REQ: /* new semantics bind request */ 21399 tcp_bind(tcp, mp); 21400 break; 21401 case T_UNBIND_REQ: /* unbind request */ 21402 tcp_unbind(tcp, mp); 21403 break; 21404 case O_T_CONN_RES: /* old connection response XXX */ 21405 case T_CONN_RES: /* connection response */ 21406 tcp_accept(tcp, mp); 21407 break; 21408 case T_CONN_REQ: /* connection request */ 21409 tcp_connect(tcp, mp); 21410 break; 21411 case T_DISCON_REQ: /* disconnect request */ 21412 tcp_disconnect(tcp, mp); 21413 break; 21414 case T_CAPABILITY_REQ: 21415 tcp_capability_req(tcp, mp); /* capability request */ 21416 break; 21417 case T_INFO_REQ: /* information request */ 21418 tcp_info_req(tcp, mp); 21419 break; 21420 case T_SVR4_OPTMGMT_REQ: /* manage options req */ 21421 /* Only IP is allowed to return meaningful value */ 21422 (void) svr4_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21423 break; 21424 case T_OPTMGMT_REQ: 21425 /* 21426 * Note: no support for snmpcom_req() through new 21427 * T_OPTMGMT_REQ. See comments in ip.c 21428 */ 21429 /* Only IP is allowed to return meaningful value */ 21430 (void) tpi_optcom_req(tcp->tcp_wq, mp, cr, &tcp_opt_obj); 21431 break; 21432 21433 case T_UNITDATA_REQ: /* unitdata request */ 21434 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21435 break; 21436 case T_ORDREL_REQ: /* orderly release req */ 21437 freemsg(mp); 21438 21439 if (tcp->tcp_fused) 21440 tcp_unfuse(tcp); 21441 21442 if (tcp_xmit_end(tcp) != 0) { 21443 /* 21444 * We were crossing FINs and got a reset from 21445 * the other side. Just ignore it. 21446 */ 21447 if (tcp->tcp_debug) { 21448 (void) strlog(TCP_MODULE_ID, 0, 1, 21449 SL_ERROR|SL_TRACE, 21450 "tcp_wput_proto, T_ORDREL_REQ out of " 21451 "state %s", 21452 tcp_display(tcp, NULL, 21453 DISP_ADDR_AND_PORT)); 21454 } 21455 } 21456 break; 21457 case T_ADDR_REQ: 21458 tcp_addr_req(tcp, mp); 21459 break; 21460 default: 21461 if (tcp->tcp_debug) { 21462 (void) strlog(TCP_MODULE_ID, 0, 1, SL_ERROR|SL_TRACE, 21463 "tcp_wput_proto, bogus TPI msg, type %d", 21464 tprim->type); 21465 } 21466 /* 21467 * We used to M_ERROR. Sending TNOTSUPPORT gives the user 21468 * to recover. 21469 */ 21470 tcp_err_ack(tcp, mp, TNOTSUPPORT, 0); 21471 break; 21472 } 21473 } 21474 21475 /* 21476 * The TCP write service routine should never be called... 21477 */ 21478 /* ARGSUSED */ 21479 static void 21480 tcp_wsrv(queue_t *q) 21481 { 21482 TCP_STAT(tcp_wsrv_called); 21483 } 21484 21485 /* Non overlapping byte exchanger */ 21486 static void 21487 tcp_xchg(uchar_t *a, uchar_t *b, int len) 21488 { 21489 uchar_t uch; 21490 21491 while (len-- > 0) { 21492 uch = a[len]; 21493 a[len] = b[len]; 21494 b[len] = uch; 21495 } 21496 } 21497 21498 /* 21499 * Send out a control packet on the tcp connection specified. This routine 21500 * is typically called where we need a simple ACK or RST generated. 21501 */ 21502 static void 21503 tcp_xmit_ctl(char *str, tcp_t *tcp, uint32_t seq, uint32_t ack, int ctl) 21504 { 21505 uchar_t *rptr; 21506 tcph_t *tcph; 21507 ipha_t *ipha = NULL; 21508 ip6_t *ip6h = NULL; 21509 uint32_t sum; 21510 int tcp_hdr_len; 21511 int tcp_ip_hdr_len; 21512 mblk_t *mp; 21513 21514 /* 21515 * Save sum for use in source route later. 21516 */ 21517 ASSERT(tcp != NULL); 21518 sum = tcp->tcp_tcp_hdr_len + tcp->tcp_sum; 21519 tcp_hdr_len = tcp->tcp_hdr_len; 21520 tcp_ip_hdr_len = tcp->tcp_ip_hdr_len; 21521 21522 /* If a text string is passed in with the request, pass it to strlog. */ 21523 if (str != NULL && tcp->tcp_debug) { 21524 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 21525 "tcp_xmit_ctl: '%s', seq 0x%x, ack 0x%x, ctl 0x%x", 21526 str, seq, ack, ctl); 21527 } 21528 mp = allocb(tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 21529 BPRI_MED); 21530 if (mp == NULL) { 21531 return; 21532 } 21533 rptr = &mp->b_rptr[tcp_wroff_xtra]; 21534 mp->b_rptr = rptr; 21535 mp->b_wptr = &rptr[tcp_hdr_len]; 21536 bcopy(tcp->tcp_iphc, rptr, tcp_hdr_len); 21537 21538 if (tcp->tcp_ipversion == IPV4_VERSION) { 21539 ipha = (ipha_t *)rptr; 21540 ipha->ipha_length = htons(tcp_hdr_len); 21541 } else { 21542 ip6h = (ip6_t *)rptr; 21543 ASSERT(tcp != NULL); 21544 ip6h->ip6_plen = htons(tcp->tcp_hdr_len - 21545 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 21546 } 21547 tcph = (tcph_t *)&rptr[tcp_ip_hdr_len]; 21548 tcph->th_flags[0] = (uint8_t)ctl; 21549 if (ctl & TH_RST) { 21550 BUMP_MIB(&tcp_mib, tcpOutRsts); 21551 BUMP_MIB(&tcp_mib, tcpOutControl); 21552 /* 21553 * Don't send TSopt w/ TH_RST packets per RFC 1323. 21554 */ 21555 if (tcp->tcp_snd_ts_ok && 21556 tcp->tcp_state > TCPS_SYN_SENT) { 21557 mp->b_wptr = &rptr[tcp_hdr_len - TCPOPT_REAL_TS_LEN]; 21558 *(mp->b_wptr) = TCPOPT_EOL; 21559 if (tcp->tcp_ipversion == IPV4_VERSION) { 21560 ipha->ipha_length = htons(tcp_hdr_len - 21561 TCPOPT_REAL_TS_LEN); 21562 } else { 21563 ip6h->ip6_plen = htons(ntohs(ip6h->ip6_plen) - 21564 TCPOPT_REAL_TS_LEN); 21565 } 21566 tcph->th_offset_and_rsrvd[0] -= (3 << 4); 21567 sum -= TCPOPT_REAL_TS_LEN; 21568 } 21569 } 21570 if (ctl & TH_ACK) { 21571 if (tcp->tcp_snd_ts_ok) { 21572 U32_TO_BE32(lbolt, 21573 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 21574 U32_TO_BE32(tcp->tcp_ts_recent, 21575 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 21576 } 21577 21578 /* Update the latest receive window size in TCP header. */ 21579 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 21580 tcph->th_win); 21581 tcp->tcp_rack = ack; 21582 tcp->tcp_rack_cnt = 0; 21583 BUMP_MIB(&tcp_mib, tcpOutAck); 21584 } 21585 BUMP_LOCAL(tcp->tcp_obsegs); 21586 U32_TO_BE32(seq, tcph->th_seq); 21587 U32_TO_BE32(ack, tcph->th_ack); 21588 /* 21589 * Include the adjustment for a source route if any. 21590 */ 21591 sum = (sum >> 16) + (sum & 0xFFFF); 21592 U16_TO_BE16(sum, tcph->th_sum); 21593 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21594 tcp_send_data(tcp, tcp->tcp_wq, mp); 21595 } 21596 21597 /* 21598 * If this routine returns B_TRUE, TCP can generate a RST in response 21599 * to a segment. If it returns B_FALSE, TCP should not respond. 21600 */ 21601 static boolean_t 21602 tcp_send_rst_chk(void) 21603 { 21604 clock_t now; 21605 21606 /* 21607 * TCP needs to protect itself from generating too many RSTs. 21608 * This can be a DoS attack by sending us random segments 21609 * soliciting RSTs. 21610 * 21611 * What we do here is to have a limit of tcp_rst_sent_rate RSTs 21612 * in each 1 second interval. In this way, TCP still generate 21613 * RSTs in normal cases but when under attack, the impact is 21614 * limited. 21615 */ 21616 if (tcp_rst_sent_rate_enabled != 0) { 21617 now = lbolt; 21618 /* lbolt can wrap around. */ 21619 if ((tcp_last_rst_intrvl > now) || 21620 (TICK_TO_MSEC(now - tcp_last_rst_intrvl) > 1*SECONDS)) { 21621 tcp_last_rst_intrvl = now; 21622 tcp_rst_cnt = 1; 21623 } else if (++tcp_rst_cnt > tcp_rst_sent_rate) { 21624 return (B_FALSE); 21625 } 21626 } 21627 return (B_TRUE); 21628 } 21629 21630 /* 21631 * Send down the advice IP ioctl to tell IP to mark an IRE temporary. 21632 */ 21633 static void 21634 tcp_ip_ire_mark_advice(tcp_t *tcp) 21635 { 21636 mblk_t *mp; 21637 ipic_t *ipic; 21638 21639 if (tcp->tcp_ipversion == IPV4_VERSION) { 21640 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21641 &ipic); 21642 } else { 21643 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21644 &ipic); 21645 } 21646 if (mp == NULL) 21647 return; 21648 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21649 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21650 } 21651 21652 /* 21653 * Return an IP advice ioctl mblk and set ipic to be the pointer 21654 * to the advice structure. 21655 */ 21656 static mblk_t * 21657 tcp_ip_advise_mblk(void *addr, int addr_len, ipic_t **ipic) 21658 { 21659 struct iocblk *ioc; 21660 mblk_t *mp, *mp1; 21661 21662 mp = allocb(sizeof (ipic_t) + addr_len, BPRI_HI); 21663 if (mp == NULL) 21664 return (NULL); 21665 bzero(mp->b_rptr, sizeof (ipic_t) + addr_len); 21666 *ipic = (ipic_t *)mp->b_rptr; 21667 (*ipic)->ipic_cmd = IP_IOC_IRE_ADVISE_NO_REPLY; 21668 (*ipic)->ipic_addr_offset = sizeof (ipic_t); 21669 21670 bcopy(addr, *ipic + 1, addr_len); 21671 21672 (*ipic)->ipic_addr_length = addr_len; 21673 mp->b_wptr = &mp->b_rptr[sizeof (ipic_t) + addr_len]; 21674 21675 mp1 = mkiocb(IP_IOCTL); 21676 if (mp1 == NULL) { 21677 freemsg(mp); 21678 return (NULL); 21679 } 21680 mp1->b_cont = mp; 21681 ioc = (struct iocblk *)mp1->b_rptr; 21682 ioc->ioc_count = sizeof (ipic_t) + addr_len; 21683 21684 return (mp1); 21685 } 21686 21687 /* 21688 * Generate a reset based on an inbound packet for which there is no active 21689 * tcp state that we can find. 21690 * 21691 * IPSEC NOTE : Try to send the reply with the same protection as it came 21692 * in. We still have the ipsec_mp that the packet was attached to. Thus 21693 * the packet will go out at the same level of protection as it came in by 21694 * converting the IPSEC_IN to IPSEC_OUT. 21695 */ 21696 static void 21697 tcp_xmit_early_reset(char *str, mblk_t *mp, uint32_t seq, 21698 uint32_t ack, int ctl, uint_t ip_hdr_len) 21699 { 21700 ipha_t *ipha = NULL; 21701 ip6_t *ip6h = NULL; 21702 ushort_t len; 21703 tcph_t *tcph; 21704 int i; 21705 mblk_t *ipsec_mp; 21706 boolean_t mctl_present; 21707 ipic_t *ipic; 21708 ipaddr_t v4addr; 21709 in6_addr_t v6addr; 21710 int addr_len; 21711 void *addr; 21712 queue_t *q = tcp_g_q; 21713 tcp_t *tcp = Q_TO_TCP(q); 21714 21715 if (!tcp_send_rst_chk()) { 21716 tcp_rst_unsent++; 21717 freemsg(mp); 21718 return; 21719 } 21720 21721 if (mp->b_datap->db_type == M_CTL) { 21722 ipsec_mp = mp; 21723 mp = mp->b_cont; 21724 mctl_present = B_TRUE; 21725 } else { 21726 ipsec_mp = mp; 21727 mctl_present = B_FALSE; 21728 } 21729 21730 if (str && q && tcp_dbg) { 21731 (void) strlog(TCP_MODULE_ID, 0, 1, SL_TRACE, 21732 "tcp_xmit_early_reset: '%s', seq 0x%x, ack 0x%x, " 21733 "flags 0x%x", 21734 str, seq, ack, ctl); 21735 } 21736 if (mp->b_datap->db_ref != 1) { 21737 mblk_t *mp1 = copyb(mp); 21738 freemsg(mp); 21739 mp = mp1; 21740 if (!mp) { 21741 if (mctl_present) 21742 freeb(ipsec_mp); 21743 return; 21744 } else { 21745 if (mctl_present) { 21746 ipsec_mp->b_cont = mp; 21747 } else { 21748 ipsec_mp = mp; 21749 } 21750 } 21751 } else if (mp->b_cont) { 21752 freemsg(mp->b_cont); 21753 mp->b_cont = NULL; 21754 } 21755 /* 21756 * We skip reversing source route here. 21757 * (for now we replace all IP options with EOL) 21758 */ 21759 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21760 ipha = (ipha_t *)mp->b_rptr; 21761 for (i = IP_SIMPLE_HDR_LENGTH; i < (int)ip_hdr_len; i++) 21762 mp->b_rptr[i] = IPOPT_EOL; 21763 /* 21764 * Make sure that src address isn't flagrantly invalid. 21765 * Not all broadcast address checking for the src address 21766 * is possible, since we don't know the netmask of the src 21767 * addr. No check for destination address is done, since 21768 * IP will not pass up a packet with a broadcast dest 21769 * address to TCP. Similar checks are done below for IPv6. 21770 */ 21771 if (ipha->ipha_src == 0 || ipha->ipha_src == INADDR_BROADCAST || 21772 CLASSD(ipha->ipha_src)) { 21773 freemsg(ipsec_mp); 21774 BUMP_MIB(&ip_mib, ipInDiscards); 21775 return; 21776 } 21777 } else { 21778 ip6h = (ip6_t *)mp->b_rptr; 21779 21780 if (IN6_IS_ADDR_UNSPECIFIED(&ip6h->ip6_src) || 21781 IN6_IS_ADDR_MULTICAST(&ip6h->ip6_src)) { 21782 freemsg(ipsec_mp); 21783 BUMP_MIB(&ip6_mib, ipv6InDiscards); 21784 return; 21785 } 21786 21787 /* Remove any extension headers assuming partial overlay */ 21788 if (ip_hdr_len > IPV6_HDR_LEN) { 21789 uint8_t *to; 21790 21791 to = mp->b_rptr + ip_hdr_len - IPV6_HDR_LEN; 21792 ovbcopy(ip6h, to, IPV6_HDR_LEN); 21793 mp->b_rptr += ip_hdr_len - IPV6_HDR_LEN; 21794 ip_hdr_len = IPV6_HDR_LEN; 21795 ip6h = (ip6_t *)mp->b_rptr; 21796 ip6h->ip6_nxt = IPPROTO_TCP; 21797 } 21798 } 21799 tcph = (tcph_t *)&mp->b_rptr[ip_hdr_len]; 21800 if (tcph->th_flags[0] & TH_RST) { 21801 freemsg(ipsec_mp); 21802 return; 21803 } 21804 tcph->th_offset_and_rsrvd[0] = (5 << 4); 21805 len = ip_hdr_len + sizeof (tcph_t); 21806 mp->b_wptr = &mp->b_rptr[len]; 21807 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 21808 ipha->ipha_length = htons(len); 21809 /* Swap addresses */ 21810 v4addr = ipha->ipha_src; 21811 ipha->ipha_src = ipha->ipha_dst; 21812 ipha->ipha_dst = v4addr; 21813 ipha->ipha_ident = 0; 21814 ipha->ipha_ttl = (uchar_t)tcp_ipv4_ttl; 21815 addr_len = IP_ADDR_LEN; 21816 addr = &v4addr; 21817 } else { 21818 /* No ip6i_t in this case */ 21819 ip6h->ip6_plen = htons(len - IPV6_HDR_LEN); 21820 /* Swap addresses */ 21821 v6addr = ip6h->ip6_src; 21822 ip6h->ip6_src = ip6h->ip6_dst; 21823 ip6h->ip6_dst = v6addr; 21824 ip6h->ip6_hops = (uchar_t)tcp_ipv6_hoplimit; 21825 addr_len = IPV6_ADDR_LEN; 21826 addr = &v6addr; 21827 } 21828 tcp_xchg(tcph->th_fport, tcph->th_lport, 2); 21829 U32_TO_BE32(ack, tcph->th_ack); 21830 U32_TO_BE32(seq, tcph->th_seq); 21831 U16_TO_BE16(0, tcph->th_win); 21832 U16_TO_BE16(sizeof (tcph_t), tcph->th_sum); 21833 tcph->th_flags[0] = (uint8_t)ctl; 21834 if (ctl & TH_RST) { 21835 BUMP_MIB(&tcp_mib, tcpOutRsts); 21836 BUMP_MIB(&tcp_mib, tcpOutControl); 21837 } 21838 if (mctl_present) { 21839 ipsec_in_t *ii = (ipsec_in_t *)ipsec_mp->b_rptr; 21840 21841 ASSERT(ii->ipsec_in_type == IPSEC_IN); 21842 if (!ipsec_in_to_out(ipsec_mp, ipha, ip6h)) { 21843 return; 21844 } 21845 } 21846 /* 21847 * NOTE: one might consider tracing a TCP packet here, but 21848 * this function has no active TCP state nd no tcp structure 21849 * which has trace buffer. If we traced here, we would have 21850 * to keep a local trace buffer in tcp_record_trace(). 21851 */ 21852 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, ipsec_mp); 21853 21854 /* 21855 * Tell IP to mark the IRE used for this destination temporary. 21856 * This way, we can limit our exposure to DoS attack because IP 21857 * creates an IRE for each destination. If there are too many, 21858 * the time to do any routing lookup will be extremely long. And 21859 * the lookup can be in interrupt context. 21860 * 21861 * Note that in normal circumstances, this marking should not 21862 * affect anything. It would be nice if only 1 message is 21863 * needed to inform IP that the IRE created for this RST should 21864 * not be added to the cache table. But there is currently 21865 * not such communication mechanism between TCP and IP. So 21866 * the best we can do now is to send the advice ioctl to IP 21867 * to mark the IRE temporary. 21868 */ 21869 if ((mp = tcp_ip_advise_mblk(addr, addr_len, &ipic)) != NULL) { 21870 ipic->ipic_ire_marks |= IRE_MARK_TEMPORARY; 21871 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21872 } 21873 } 21874 21875 /* 21876 * Initiate closedown sequence on an active connection. (May be called as 21877 * writer.) Return value zero for OK return, non-zero for error return. 21878 */ 21879 static int 21880 tcp_xmit_end(tcp_t *tcp) 21881 { 21882 ipic_t *ipic; 21883 mblk_t *mp; 21884 21885 if (tcp->tcp_state < TCPS_SYN_RCVD || 21886 tcp->tcp_state > TCPS_CLOSE_WAIT) { 21887 /* 21888 * Invalid state, only states TCPS_SYN_RCVD, 21889 * TCPS_ESTABLISHED and TCPS_CLOSE_WAIT are valid 21890 */ 21891 return (-1); 21892 } 21893 21894 tcp->tcp_fss = tcp->tcp_snxt + tcp->tcp_unsent; 21895 tcp->tcp_valid_bits |= TCP_FSS_VALID; 21896 /* 21897 * If there is nothing more unsent, send the FIN now. 21898 * Otherwise, it will go out with the last segment. 21899 */ 21900 if (tcp->tcp_unsent == 0) { 21901 mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 21902 tcp->tcp_fss, B_FALSE, NULL, B_FALSE); 21903 21904 if (mp) { 21905 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 21906 tcp_send_data(tcp, tcp->tcp_wq, mp); 21907 } else { 21908 /* 21909 * Couldn't allocate msg. Pretend we got it out. 21910 * Wait for rexmit timeout. 21911 */ 21912 tcp->tcp_snxt = tcp->tcp_fss + 1; 21913 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 21914 } 21915 21916 /* 21917 * If needed, update tcp_rexmit_snxt as tcp_snxt is 21918 * changed. 21919 */ 21920 if (tcp->tcp_rexmit && tcp->tcp_rexmit_nxt == tcp->tcp_fss) { 21921 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 21922 } 21923 } else { 21924 /* 21925 * If tcp->tcp_cork is set, then the data will not get sent, 21926 * so we have to check that and unset it first. 21927 */ 21928 if (tcp->tcp_cork) 21929 tcp->tcp_cork = B_FALSE; 21930 tcp_wput_data(tcp, NULL, B_FALSE); 21931 } 21932 21933 /* 21934 * If TCP does not get enough samples of RTT or tcp_rtt_updates 21935 * is 0, don't update the cache. 21936 */ 21937 if (tcp_rtt_updates == 0 || tcp->tcp_rtt_update < tcp_rtt_updates) 21938 return (0); 21939 21940 /* 21941 * NOTE: should not update if source routes i.e. if tcp_remote if 21942 * different from the destination. 21943 */ 21944 if (tcp->tcp_ipversion == IPV4_VERSION) { 21945 if (tcp->tcp_remote != tcp->tcp_ipha->ipha_dst) { 21946 return (0); 21947 } 21948 mp = tcp_ip_advise_mblk(&tcp->tcp_ipha->ipha_dst, IP_ADDR_LEN, 21949 &ipic); 21950 } else { 21951 if (!(IN6_ARE_ADDR_EQUAL(&tcp->tcp_remote_v6, 21952 &tcp->tcp_ip6h->ip6_dst))) { 21953 return (0); 21954 } 21955 mp = tcp_ip_advise_mblk(&tcp->tcp_ip6h->ip6_dst, IPV6_ADDR_LEN, 21956 &ipic); 21957 } 21958 21959 /* Record route attributes in the IRE for use by future connections. */ 21960 if (mp == NULL) 21961 return (0); 21962 21963 /* 21964 * We do not have a good algorithm to update ssthresh at this time. 21965 * So don't do any update. 21966 */ 21967 ipic->ipic_rtt = tcp->tcp_rtt_sa; 21968 ipic->ipic_rtt_sd = tcp->tcp_rtt_sd; 21969 21970 CALL_IP_WPUT(tcp->tcp_connp, tcp->tcp_wq, mp); 21971 return (0); 21972 } 21973 21974 /* 21975 * Generate a "no listener here" RST in response to an "unknown" segment. 21976 * Note that we are reusing the incoming mp to construct the outgoing 21977 * RST. 21978 */ 21979 void 21980 tcp_xmit_listeners_reset(mblk_t *mp, uint_t ip_hdr_len) 21981 { 21982 uchar_t *rptr; 21983 uint32_t seg_len; 21984 tcph_t *tcph; 21985 uint32_t seg_seq; 21986 uint32_t seg_ack; 21987 uint_t flags; 21988 mblk_t *ipsec_mp; 21989 ipha_t *ipha; 21990 ip6_t *ip6h; 21991 boolean_t mctl_present = B_FALSE; 21992 boolean_t check = B_TRUE; 21993 boolean_t policy_present; 21994 21995 TCP_STAT(tcp_no_listener); 21996 21997 ipsec_mp = mp; 21998 21999 if (mp->b_datap->db_type == M_CTL) { 22000 ipsec_in_t *ii; 22001 22002 mctl_present = B_TRUE; 22003 mp = mp->b_cont; 22004 22005 ii = (ipsec_in_t *)ipsec_mp->b_rptr; 22006 ASSERT(ii->ipsec_in_type == IPSEC_IN); 22007 if (ii->ipsec_in_dont_check) { 22008 check = B_FALSE; 22009 if (!ii->ipsec_in_secure) { 22010 freeb(ipsec_mp); 22011 mctl_present = B_FALSE; 22012 ipsec_mp = mp; 22013 } 22014 } 22015 } 22016 22017 if (IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION) { 22018 policy_present = ipsec_inbound_v4_policy_present; 22019 ipha = (ipha_t *)mp->b_rptr; 22020 ip6h = NULL; 22021 } else { 22022 policy_present = ipsec_inbound_v6_policy_present; 22023 ipha = NULL; 22024 ip6h = (ip6_t *)mp->b_rptr; 22025 } 22026 22027 if (check && policy_present) { 22028 /* 22029 * The conn_t parameter is NULL because we already know 22030 * nobody's home. 22031 */ 22032 ipsec_mp = ipsec_check_global_policy( 22033 ipsec_mp, (conn_t *)NULL, ipha, ip6h, mctl_present); 22034 if (ipsec_mp == NULL) 22035 return; 22036 } 22037 22038 22039 rptr = mp->b_rptr; 22040 22041 tcph = (tcph_t *)&rptr[ip_hdr_len]; 22042 seg_seq = BE32_TO_U32(tcph->th_seq); 22043 seg_ack = BE32_TO_U32(tcph->th_ack); 22044 flags = tcph->th_flags[0]; 22045 22046 seg_len = msgdsize(mp) - (TCP_HDR_LENGTH(tcph) + ip_hdr_len); 22047 if (flags & TH_RST) { 22048 freemsg(ipsec_mp); 22049 } else if (flags & TH_ACK) { 22050 tcp_xmit_early_reset("no tcp, reset", 22051 ipsec_mp, seg_ack, 0, TH_RST, ip_hdr_len); 22052 } else { 22053 if (flags & TH_SYN) { 22054 seg_len++; 22055 } else { 22056 /* 22057 * Here we violate the RFC. Note that a normal 22058 * TCP will never send a segment without the ACK 22059 * flag, except for RST or SYN segment. This 22060 * segment is neither. Just drop it on the 22061 * floor. 22062 */ 22063 freemsg(ipsec_mp); 22064 tcp_rst_unsent++; 22065 return; 22066 } 22067 22068 tcp_xmit_early_reset("no tcp, reset/ack", 22069 ipsec_mp, 0, seg_seq + seg_len, 22070 TH_RST | TH_ACK, ip_hdr_len); 22071 } 22072 } 22073 22074 /* 22075 * tcp_xmit_mp is called to return a pointer to an mblk chain complete with 22076 * ip and tcp header ready to pass down to IP. If the mp passed in is 22077 * non-NULL, then up to max_to_send bytes of data will be dup'ed off that 22078 * mblk. (If sendall is not set the dup'ing will stop at an mblk boundary 22079 * otherwise it will dup partial mblks.) 22080 * Otherwise, an appropriate ACK packet will be generated. This 22081 * routine is not usually called to send new data for the first time. It 22082 * is mostly called out of the timer for retransmits, and to generate ACKs. 22083 * 22084 * If offset is not NULL, the returned mblk chain's first mblk's b_rptr will 22085 * be adjusted by *offset. And after dupb(), the offset and the ending mblk 22086 * of the original mblk chain will be returned in *offset and *end_mp. 22087 */ 22088 static mblk_t * 22089 tcp_xmit_mp(tcp_t *tcp, mblk_t *mp, int32_t max_to_send, int32_t *offset, 22090 mblk_t **end_mp, uint32_t seq, boolean_t sendall, uint32_t *seg_len, 22091 boolean_t rexmit) 22092 { 22093 int data_length; 22094 int32_t off = 0; 22095 uint_t flags; 22096 mblk_t *mp1; 22097 mblk_t *mp2; 22098 uchar_t *rptr; 22099 tcph_t *tcph; 22100 int32_t num_sack_blk = 0; 22101 int32_t sack_opt_len = 0; 22102 22103 /* Allocate for our maximum TCP header + link-level */ 22104 mp1 = allocb(tcp->tcp_ip_hdr_len + TCP_MAX_HDR_LENGTH + tcp_wroff_xtra, 22105 BPRI_MED); 22106 if (!mp1) 22107 return (NULL); 22108 data_length = 0; 22109 22110 /* 22111 * Note that tcp_mss has been adjusted to take into account the 22112 * timestamp option if applicable. Because SACK options do not 22113 * appear in every TCP segments and they are of variable lengths, 22114 * they cannot be included in tcp_mss. Thus we need to calculate 22115 * the actual segment length when we need to send a segment which 22116 * includes SACK options. 22117 */ 22118 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 22119 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 22120 tcp->tcp_num_sack_blk); 22121 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 22122 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 22123 if (max_to_send + sack_opt_len > tcp->tcp_mss) 22124 max_to_send -= sack_opt_len; 22125 } 22126 22127 if (offset != NULL) { 22128 off = *offset; 22129 /* We use offset as an indicator that end_mp is not NULL. */ 22130 *end_mp = NULL; 22131 } 22132 for (mp2 = mp1; mp && data_length != max_to_send; mp = mp->b_cont) { 22133 /* This could be faster with cooperation from downstream */ 22134 if (mp2 != mp1 && !sendall && 22135 data_length + (int)(mp->b_wptr - mp->b_rptr) > 22136 max_to_send) 22137 /* 22138 * Don't send the next mblk since the whole mblk 22139 * does not fit. 22140 */ 22141 break; 22142 mp2->b_cont = dupb(mp); 22143 mp2 = mp2->b_cont; 22144 if (!mp2) { 22145 freemsg(mp1); 22146 return (NULL); 22147 } 22148 mp2->b_rptr += off; 22149 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 22150 (uintptr_t)INT_MAX); 22151 22152 data_length += (int)(mp2->b_wptr - mp2->b_rptr); 22153 if (data_length > max_to_send) { 22154 mp2->b_wptr -= data_length - max_to_send; 22155 data_length = max_to_send; 22156 off = mp2->b_wptr - mp->b_rptr; 22157 break; 22158 } else { 22159 off = 0; 22160 } 22161 } 22162 if (offset != NULL) { 22163 *offset = off; 22164 *end_mp = mp; 22165 } 22166 if (seg_len != NULL) { 22167 *seg_len = data_length; 22168 } 22169 22170 /* Update the latest receive window size in TCP header. */ 22171 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22172 tcp->tcp_tcph->th_win); 22173 22174 rptr = mp1->b_rptr + tcp_wroff_xtra; 22175 mp1->b_rptr = rptr; 22176 mp1->b_wptr = rptr + tcp->tcp_hdr_len + sack_opt_len; 22177 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22178 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22179 U32_TO_ABE32(seq, tcph->th_seq); 22180 22181 /* 22182 * Use tcp_unsent to determine if the PUSH bit should be used assumes 22183 * that this function was called from tcp_wput_data. Thus, when called 22184 * to retransmit data the setting of the PUSH bit may appear some 22185 * what random in that it might get set when it should not. This 22186 * should not pose any performance issues. 22187 */ 22188 if (data_length != 0 && (tcp->tcp_unsent == 0 || 22189 tcp->tcp_unsent == data_length)) { 22190 flags = TH_ACK | TH_PUSH; 22191 } else { 22192 flags = TH_ACK; 22193 } 22194 22195 if (tcp->tcp_ecn_ok) { 22196 if (tcp->tcp_ecn_echo_on) 22197 flags |= TH_ECE; 22198 22199 /* 22200 * Only set ECT bit and ECN_CWR if a segment contains new data. 22201 * There is no TCP flow control for non-data segments, and 22202 * only data segment is transmitted reliably. 22203 */ 22204 if (data_length > 0 && !rexmit) { 22205 SET_ECT(tcp, rptr); 22206 if (tcp->tcp_cwr && !tcp->tcp_ecn_cwr_sent) { 22207 flags |= TH_CWR; 22208 tcp->tcp_ecn_cwr_sent = B_TRUE; 22209 } 22210 } 22211 } 22212 22213 if (tcp->tcp_valid_bits) { 22214 uint32_t u1; 22215 22216 if ((tcp->tcp_valid_bits & TCP_ISS_VALID) && 22217 seq == tcp->tcp_iss) { 22218 uchar_t *wptr; 22219 22220 /* 22221 * If TCP_ISS_VALID and the seq number is tcp_iss, 22222 * TCP can only be in SYN-SENT, SYN-RCVD or 22223 * FIN-WAIT-1 state. It can be FIN-WAIT-1 if 22224 * our SYN is not ack'ed but the app closes this 22225 * TCP connection. 22226 */ 22227 ASSERT(tcp->tcp_state == TCPS_SYN_SENT || 22228 tcp->tcp_state == TCPS_SYN_RCVD || 22229 tcp->tcp_state == TCPS_FIN_WAIT_1); 22230 22231 /* 22232 * Tack on the MSS option. It is always needed 22233 * for both active and passive open. 22234 * 22235 * MSS option value should be interface MTU - MIN 22236 * TCP/IP header according to RFC 793 as it means 22237 * the maximum segment size TCP can receive. But 22238 * to get around some broken middle boxes/end hosts 22239 * out there, we allow the option value to be the 22240 * same as the MSS option size on the peer side. 22241 * In this way, the other side will not send 22242 * anything larger than they can receive. 22243 * 22244 * Note that for SYN_SENT state, the ndd param 22245 * tcp_use_smss_as_mss_opt has no effect as we 22246 * don't know the peer's MSS option value. So 22247 * the only case we need to take care of is in 22248 * SYN_RCVD state, which is done later. 22249 */ 22250 wptr = mp1->b_wptr; 22251 wptr[0] = TCPOPT_MAXSEG; 22252 wptr[1] = TCPOPT_MAXSEG_LEN; 22253 wptr += 2; 22254 u1 = tcp->tcp_if_mtu - 22255 (tcp->tcp_ipversion == IPV4_VERSION ? 22256 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) - 22257 TCP_MIN_HEADER_LENGTH; 22258 U16_TO_BE16(u1, wptr); 22259 mp1->b_wptr = wptr + 2; 22260 /* Update the offset to cover the additional word */ 22261 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22262 22263 /* 22264 * Note that the following way of filling in 22265 * TCP options are not optimal. Some NOPs can 22266 * be saved. But there is no need at this time 22267 * to optimize it. When it is needed, we will 22268 * do it. 22269 */ 22270 switch (tcp->tcp_state) { 22271 case TCPS_SYN_SENT: 22272 flags = TH_SYN; 22273 22274 if (tcp->tcp_snd_ts_ok) { 22275 uint32_t llbolt = (uint32_t)lbolt; 22276 22277 wptr = mp1->b_wptr; 22278 wptr[0] = TCPOPT_NOP; 22279 wptr[1] = TCPOPT_NOP; 22280 wptr[2] = TCPOPT_TSTAMP; 22281 wptr[3] = TCPOPT_TSTAMP_LEN; 22282 wptr += 4; 22283 U32_TO_BE32(llbolt, wptr); 22284 wptr += 4; 22285 ASSERT(tcp->tcp_ts_recent == 0); 22286 U32_TO_BE32(0L, wptr); 22287 mp1->b_wptr += TCPOPT_REAL_TS_LEN; 22288 tcph->th_offset_and_rsrvd[0] += 22289 (3 << 4); 22290 } 22291 22292 /* 22293 * Set up all the bits to tell other side 22294 * we are ECN capable. 22295 */ 22296 if (tcp->tcp_ecn_ok) { 22297 flags |= (TH_ECE | TH_CWR); 22298 } 22299 break; 22300 case TCPS_SYN_RCVD: 22301 flags |= TH_SYN; 22302 22303 /* 22304 * Reset the MSS option value to be SMSS 22305 * We should probably add back the bytes 22306 * for timestamp option and IPsec. We 22307 * don't do that as this is a workaround 22308 * for broken middle boxes/end hosts, it 22309 * is better for us to be more cautious. 22310 * They may not take these things into 22311 * account in their SMSS calculation. Thus 22312 * the peer's calculated SMSS may be smaller 22313 * than what it can be. This should be OK. 22314 */ 22315 if (tcp_use_smss_as_mss_opt) { 22316 u1 = tcp->tcp_mss; 22317 U16_TO_BE16(u1, wptr); 22318 } 22319 22320 /* 22321 * If the other side is ECN capable, reply 22322 * that we are also ECN capable. 22323 */ 22324 if (tcp->tcp_ecn_ok) 22325 flags |= TH_ECE; 22326 break; 22327 default: 22328 /* 22329 * The above ASSERT() makes sure that this 22330 * must be FIN-WAIT-1 state. Our SYN has 22331 * not been ack'ed so retransmit it. 22332 */ 22333 flags |= TH_SYN; 22334 break; 22335 } 22336 22337 if (tcp->tcp_snd_ws_ok) { 22338 wptr = mp1->b_wptr; 22339 wptr[0] = TCPOPT_NOP; 22340 wptr[1] = TCPOPT_WSCALE; 22341 wptr[2] = TCPOPT_WS_LEN; 22342 wptr[3] = (uchar_t)tcp->tcp_rcv_ws; 22343 mp1->b_wptr += TCPOPT_REAL_WS_LEN; 22344 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22345 } 22346 22347 if (tcp->tcp_snd_sack_ok) { 22348 wptr = mp1->b_wptr; 22349 wptr[0] = TCPOPT_NOP; 22350 wptr[1] = TCPOPT_NOP; 22351 wptr[2] = TCPOPT_SACK_PERMITTED; 22352 wptr[3] = TCPOPT_SACK_OK_LEN; 22353 mp1->b_wptr += TCPOPT_REAL_SACK_OK_LEN; 22354 tcph->th_offset_and_rsrvd[0] += (1 << 4); 22355 } 22356 22357 /* allocb() of adequate mblk assures space */ 22358 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 22359 (uintptr_t)INT_MAX); 22360 u1 = (int)(mp1->b_wptr - mp1->b_rptr); 22361 /* 22362 * Get IP set to checksum on our behalf 22363 * Include the adjustment for a source route if any. 22364 */ 22365 u1 += tcp->tcp_sum; 22366 u1 = (u1 >> 16) + (u1 & 0xFFFF); 22367 U16_TO_BE16(u1, tcph->th_sum); 22368 BUMP_MIB(&tcp_mib, tcpOutControl); 22369 } 22370 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 22371 (seq + data_length) == tcp->tcp_fss) { 22372 if (!tcp->tcp_fin_acked) { 22373 flags |= TH_FIN; 22374 BUMP_MIB(&tcp_mib, tcpOutControl); 22375 } 22376 if (!tcp->tcp_fin_sent) { 22377 tcp->tcp_fin_sent = B_TRUE; 22378 switch (tcp->tcp_state) { 22379 case TCPS_SYN_RCVD: 22380 case TCPS_ESTABLISHED: 22381 tcp->tcp_state = TCPS_FIN_WAIT_1; 22382 break; 22383 case TCPS_CLOSE_WAIT: 22384 tcp->tcp_state = TCPS_LAST_ACK; 22385 break; 22386 } 22387 if (tcp->tcp_suna == tcp->tcp_snxt) 22388 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 22389 tcp->tcp_snxt = tcp->tcp_fss + 1; 22390 } 22391 } 22392 /* 22393 * Note the trick here. u1 is unsigned. When tcp_urg 22394 * is smaller than seq, u1 will become a very huge value. 22395 * So the comparison will fail. Also note that tcp_urp 22396 * should be positive, see RFC 793 page 17. 22397 */ 22398 u1 = tcp->tcp_urg - seq + TCP_OLD_URP_INTERPRETATION; 22399 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && u1 != 0 && 22400 u1 < (uint32_t)(64 * 1024)) { 22401 flags |= TH_URG; 22402 BUMP_MIB(&tcp_mib, tcpOutUrg); 22403 U32_TO_ABE16(u1, tcph->th_urp); 22404 } 22405 } 22406 tcph->th_flags[0] = (uchar_t)flags; 22407 tcp->tcp_rack = tcp->tcp_rnxt; 22408 tcp->tcp_rack_cnt = 0; 22409 22410 if (tcp->tcp_snd_ts_ok) { 22411 if (tcp->tcp_state != TCPS_SYN_SENT) { 22412 uint32_t llbolt = (uint32_t)lbolt; 22413 22414 U32_TO_BE32(llbolt, 22415 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22416 U32_TO_BE32(tcp->tcp_ts_recent, 22417 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22418 } 22419 } 22420 22421 if (num_sack_blk > 0) { 22422 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22423 sack_blk_t *tmp; 22424 int32_t i; 22425 22426 wptr[0] = TCPOPT_NOP; 22427 wptr[1] = TCPOPT_NOP; 22428 wptr[2] = TCPOPT_SACK; 22429 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22430 sizeof (sack_blk_t); 22431 wptr += TCPOPT_REAL_SACK_LEN; 22432 22433 tmp = tcp->tcp_sack_list; 22434 for (i = 0; i < num_sack_blk; i++) { 22435 U32_TO_BE32(tmp[i].begin, wptr); 22436 wptr += sizeof (tcp_seq); 22437 U32_TO_BE32(tmp[i].end, wptr); 22438 wptr += sizeof (tcp_seq); 22439 } 22440 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) << 4); 22441 } 22442 ASSERT((uintptr_t)(mp1->b_wptr - rptr) <= (uintptr_t)INT_MAX); 22443 data_length += (int)(mp1->b_wptr - rptr); 22444 if (tcp->tcp_ipversion == IPV4_VERSION) { 22445 ((ipha_t *)rptr)->ipha_length = htons(data_length); 22446 } else { 22447 ip6_t *ip6 = (ip6_t *)(rptr + 22448 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22449 sizeof (ip6i_t) : 0)); 22450 22451 ip6->ip6_plen = htons(data_length - 22452 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22453 } 22454 22455 /* 22456 * Prime pump for IP 22457 * Include the adjustment for a source route if any. 22458 */ 22459 data_length -= tcp->tcp_ip_hdr_len; 22460 data_length += tcp->tcp_sum; 22461 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22462 U16_TO_ABE16(data_length, tcph->th_sum); 22463 if (tcp->tcp_ip_forward_progress) { 22464 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22465 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22466 tcp->tcp_ip_forward_progress = B_FALSE; 22467 } 22468 return (mp1); 22469 } 22470 22471 /* This function handles the push timeout. */ 22472 static void 22473 tcp_push_timer(void *arg) 22474 { 22475 conn_t *connp = (conn_t *)arg; 22476 tcp_t *tcp = connp->conn_tcp; 22477 22478 TCP_DBGSTAT(tcp_push_timer_cnt); 22479 22480 ASSERT(tcp->tcp_listener == NULL); 22481 22482 tcp->tcp_push_tid = 0; 22483 if ((tcp->tcp_rcv_list != NULL) && 22484 (tcp_rcv_drain(tcp->tcp_rq, tcp) == TH_ACK_NEEDED)) 22485 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 22486 } 22487 22488 /* 22489 * This function handles delayed ACK timeout. 22490 */ 22491 static void 22492 tcp_ack_timer(void *arg) 22493 { 22494 conn_t *connp = (conn_t *)arg; 22495 tcp_t *tcp = connp->conn_tcp; 22496 mblk_t *mp; 22497 22498 TCP_DBGSTAT(tcp_ack_timer_cnt); 22499 22500 tcp->tcp_ack_tid = 0; 22501 22502 if (tcp->tcp_fused) 22503 return; 22504 22505 /* 22506 * Do not send ACK if there is no outstanding unack'ed data. 22507 */ 22508 if (tcp->tcp_rnxt == tcp->tcp_rack) { 22509 return; 22510 } 22511 22512 if ((tcp->tcp_rnxt - tcp->tcp_rack) > tcp->tcp_mss) { 22513 /* 22514 * Make sure we don't allow deferred ACKs to result in 22515 * timer-based ACKing. If we have held off an ACK 22516 * when there was more than an mss here, and the timer 22517 * goes off, we have to worry about the possibility 22518 * that the sender isn't doing slow-start, or is out 22519 * of step with us for some other reason. We fall 22520 * permanently back in the direction of 22521 * ACK-every-other-packet as suggested in RFC 1122. 22522 */ 22523 if (tcp->tcp_rack_abs_max > 2) 22524 tcp->tcp_rack_abs_max--; 22525 tcp->tcp_rack_cur_max = 2; 22526 } 22527 mp = tcp_ack_mp(tcp); 22528 22529 if (mp != NULL) { 22530 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_SEND_PKT); 22531 BUMP_LOCAL(tcp->tcp_obsegs); 22532 BUMP_MIB(&tcp_mib, tcpOutAck); 22533 BUMP_MIB(&tcp_mib, tcpOutAckDelayed); 22534 tcp_send_data(tcp, tcp->tcp_wq, mp); 22535 } 22536 } 22537 22538 22539 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 22540 static mblk_t * 22541 tcp_ack_mp(tcp_t *tcp) 22542 { 22543 uint32_t seq_no; 22544 22545 /* 22546 * There are a few cases to be considered while setting the sequence no. 22547 * Essentially, we can come here while processing an unacceptable pkt 22548 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 22549 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 22550 * If we are here for a zero window probe, stick with suna. In all 22551 * other cases, we check if suna + swnd encompasses snxt and set 22552 * the sequence number to snxt, if so. If snxt falls outside the 22553 * window (the receiver probably shrunk its window), we will go with 22554 * suna + swnd, otherwise the sequence no will be unacceptable to the 22555 * receiver. 22556 */ 22557 if (tcp->tcp_zero_win_probe) { 22558 seq_no = tcp->tcp_suna; 22559 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 22560 ASSERT(tcp->tcp_swnd == 0); 22561 seq_no = tcp->tcp_snxt; 22562 } else { 22563 seq_no = SEQ_GT(tcp->tcp_snxt, 22564 (tcp->tcp_suna + tcp->tcp_swnd)) ? 22565 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 22566 } 22567 22568 if (tcp->tcp_valid_bits) { 22569 /* 22570 * For the complex case where we have to send some 22571 * controls (FIN or SYN), let tcp_xmit_mp do it. 22572 */ 22573 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 22574 NULL, B_FALSE)); 22575 } else { 22576 /* Generate a simple ACK */ 22577 int data_length; 22578 uchar_t *rptr; 22579 tcph_t *tcph; 22580 mblk_t *mp1; 22581 int32_t tcp_hdr_len; 22582 int32_t tcp_tcp_hdr_len; 22583 int32_t num_sack_blk = 0; 22584 int32_t sack_opt_len; 22585 22586 /* 22587 * Allocate space for TCP + IP headers 22588 * and link-level header 22589 */ 22590 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 22591 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 22592 tcp->tcp_num_sack_blk); 22593 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 22594 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 22595 tcp_hdr_len = tcp->tcp_hdr_len + sack_opt_len; 22596 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len + sack_opt_len; 22597 } else { 22598 tcp_hdr_len = tcp->tcp_hdr_len; 22599 tcp_tcp_hdr_len = tcp->tcp_tcp_hdr_len; 22600 } 22601 mp1 = allocb(tcp_hdr_len + tcp_wroff_xtra, BPRI_MED); 22602 if (!mp1) 22603 return (NULL); 22604 22605 /* Update the latest receive window size in TCP header. */ 22606 U32_TO_ABE16(tcp->tcp_rwnd >> tcp->tcp_rcv_ws, 22607 tcp->tcp_tcph->th_win); 22608 /* copy in prototype TCP + IP header */ 22609 rptr = mp1->b_rptr + tcp_wroff_xtra; 22610 mp1->b_rptr = rptr; 22611 mp1->b_wptr = rptr + tcp_hdr_len; 22612 bcopy(tcp->tcp_iphc, rptr, tcp->tcp_hdr_len); 22613 22614 tcph = (tcph_t *)&rptr[tcp->tcp_ip_hdr_len]; 22615 22616 /* Set the TCP sequence number. */ 22617 U32_TO_ABE32(seq_no, tcph->th_seq); 22618 22619 /* Set up the TCP flag field. */ 22620 tcph->th_flags[0] = (uchar_t)TH_ACK; 22621 if (tcp->tcp_ecn_echo_on) 22622 tcph->th_flags[0] |= TH_ECE; 22623 22624 tcp->tcp_rack = tcp->tcp_rnxt; 22625 tcp->tcp_rack_cnt = 0; 22626 22627 /* fill in timestamp option if in use */ 22628 if (tcp->tcp_snd_ts_ok) { 22629 uint32_t llbolt = (uint32_t)lbolt; 22630 22631 U32_TO_BE32(llbolt, 22632 (char *)tcph+TCP_MIN_HEADER_LENGTH+4); 22633 U32_TO_BE32(tcp->tcp_ts_recent, 22634 (char *)tcph+TCP_MIN_HEADER_LENGTH+8); 22635 } 22636 22637 /* Fill in SACK options */ 22638 if (num_sack_blk > 0) { 22639 uchar_t *wptr = (uchar_t *)tcph + tcp->tcp_tcp_hdr_len; 22640 sack_blk_t *tmp; 22641 int32_t i; 22642 22643 wptr[0] = TCPOPT_NOP; 22644 wptr[1] = TCPOPT_NOP; 22645 wptr[2] = TCPOPT_SACK; 22646 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 22647 sizeof (sack_blk_t); 22648 wptr += TCPOPT_REAL_SACK_LEN; 22649 22650 tmp = tcp->tcp_sack_list; 22651 for (i = 0; i < num_sack_blk; i++) { 22652 U32_TO_BE32(tmp[i].begin, wptr); 22653 wptr += sizeof (tcp_seq); 22654 U32_TO_BE32(tmp[i].end, wptr); 22655 wptr += sizeof (tcp_seq); 22656 } 22657 tcph->th_offset_and_rsrvd[0] += ((num_sack_blk * 2 + 1) 22658 << 4); 22659 } 22660 22661 if (tcp->tcp_ipversion == IPV4_VERSION) { 22662 ((ipha_t *)rptr)->ipha_length = htons(tcp_hdr_len); 22663 } else { 22664 /* Check for ip6i_t header in sticky hdrs */ 22665 ip6_t *ip6 = (ip6_t *)(rptr + 22666 (((ip6_t *)rptr)->ip6_nxt == IPPROTO_RAW ? 22667 sizeof (ip6i_t) : 0)); 22668 22669 ip6->ip6_plen = htons(tcp_hdr_len - 22670 ((char *)&tcp->tcp_ip6h[1] - tcp->tcp_iphc)); 22671 } 22672 22673 /* 22674 * Prime pump for checksum calculation in IP. Include the 22675 * adjustment for a source route if any. 22676 */ 22677 data_length = tcp_tcp_hdr_len + tcp->tcp_sum; 22678 data_length = (data_length >> 16) + (data_length & 0xFFFF); 22679 U16_TO_ABE16(data_length, tcph->th_sum); 22680 22681 if (tcp->tcp_ip_forward_progress) { 22682 ASSERT(tcp->tcp_ipversion == IPV6_VERSION); 22683 *(uint32_t *)mp1->b_rptr |= IP_FORWARD_PROG; 22684 tcp->tcp_ip_forward_progress = B_FALSE; 22685 } 22686 return (mp1); 22687 } 22688 } 22689 22690 /* 22691 * To create a temporary tcp structure for inserting into bind hash list. 22692 * The parameter is assumed to be in network byte order, ready for use. 22693 */ 22694 /* ARGSUSED */ 22695 static tcp_t * 22696 tcp_alloc_temp_tcp(in_port_t port) 22697 { 22698 conn_t *connp; 22699 tcp_t *tcp; 22700 22701 connp = ipcl_conn_create(IPCL_TCPCONN, KM_SLEEP); 22702 if (connp == NULL) 22703 return (NULL); 22704 22705 tcp = connp->conn_tcp; 22706 22707 /* 22708 * Only initialize the necessary info in those structures. Note 22709 * that since INADDR_ANY is all 0, we do not need to set 22710 * tcp_bound_source to INADDR_ANY here. 22711 */ 22712 tcp->tcp_state = TCPS_BOUND; 22713 tcp->tcp_lport = port; 22714 tcp->tcp_exclbind = 1; 22715 tcp->tcp_reserved_port = 1; 22716 22717 /* Just for place holding... */ 22718 tcp->tcp_ipversion = IPV4_VERSION; 22719 22720 return (tcp); 22721 } 22722 22723 /* 22724 * To remove a port range specified by lo_port and hi_port from the 22725 * reserved port ranges. This is one of the three public functions of 22726 * the reserved port interface. Note that a port range has to be removed 22727 * as a whole. Ports in a range cannot be removed individually. 22728 * 22729 * Params: 22730 * in_port_t lo_port: the beginning port of the reserved port range to 22731 * be deleted. 22732 * in_port_t hi_port: the ending port of the reserved port range to 22733 * be deleted. 22734 * 22735 * Return: 22736 * B_TRUE if the deletion is successful, B_FALSE otherwise. 22737 */ 22738 boolean_t 22739 tcp_reserved_port_del(in_port_t lo_port, in_port_t hi_port) 22740 { 22741 int i, j; 22742 int size; 22743 tcp_t **temp_tcp_array; 22744 tcp_t *tcp; 22745 22746 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22747 22748 /* First make sure that the port ranage is indeed reserved. */ 22749 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22750 if (tcp_reserved_port[i].lo_port == lo_port) { 22751 hi_port = tcp_reserved_port[i].hi_port; 22752 temp_tcp_array = tcp_reserved_port[i].temp_tcp_array; 22753 break; 22754 } 22755 } 22756 if (i == tcp_reserved_port_array_size) { 22757 rw_exit(&tcp_reserved_port_lock); 22758 return (B_FALSE); 22759 } 22760 22761 /* 22762 * Remove the range from the array. This simple loop is possible 22763 * because port ranges are inserted in ascending order. 22764 */ 22765 for (j = i; j < tcp_reserved_port_array_size - 1; j++) { 22766 tcp_reserved_port[j].lo_port = tcp_reserved_port[j+1].lo_port; 22767 tcp_reserved_port[j].hi_port = tcp_reserved_port[j+1].hi_port; 22768 tcp_reserved_port[j].temp_tcp_array = 22769 tcp_reserved_port[j+1].temp_tcp_array; 22770 } 22771 22772 /* Remove all the temporary tcp structures. */ 22773 size = hi_port - lo_port + 1; 22774 while (size > 0) { 22775 tcp = temp_tcp_array[size - 1]; 22776 ASSERT(tcp != NULL); 22777 tcp_bind_hash_remove(tcp); 22778 CONN_DEC_REF(tcp->tcp_connp); 22779 size--; 22780 } 22781 kmem_free(temp_tcp_array, (hi_port - lo_port + 1) * sizeof (tcp_t *)); 22782 tcp_reserved_port_array_size--; 22783 rw_exit(&tcp_reserved_port_lock); 22784 return (B_TRUE); 22785 } 22786 22787 /* 22788 * Macro to remove temporary tcp structure from the bind hash list. The 22789 * first parameter is the list of tcp to be removed. The second parameter 22790 * is the number of tcps in the array. 22791 */ 22792 #define TCP_TMP_TCP_REMOVE(tcp_array, num) \ 22793 { \ 22794 while ((num) > 0) { \ 22795 tcp_t *tcp = (tcp_array)[(num) - 1]; \ 22796 tf_t *tbf; \ 22797 tcp_t *tcpnext; \ 22798 tbf = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)]; \ 22799 mutex_enter(&tbf->tf_lock); \ 22800 tcpnext = tcp->tcp_bind_hash; \ 22801 if (tcpnext) { \ 22802 tcpnext->tcp_ptpbhn = \ 22803 tcp->tcp_ptpbhn; \ 22804 } \ 22805 *tcp->tcp_ptpbhn = tcpnext; \ 22806 mutex_exit(&tbf->tf_lock); \ 22807 kmem_free(tcp, sizeof (tcp_t)); \ 22808 (tcp_array)[(num) - 1] = NULL; \ 22809 (num)--; \ 22810 } \ 22811 } 22812 22813 /* 22814 * The public interface for other modules to call to reserve a port range 22815 * in TCP. The caller passes in how large a port range it wants. TCP 22816 * will try to find a range and return it via lo_port and hi_port. This is 22817 * used by NCA's nca_conn_init. 22818 * NCA can only be used in the global zone so this only affects the global 22819 * zone's ports. 22820 * 22821 * Params: 22822 * int size: the size of the port range to be reserved. 22823 * in_port_t *lo_port (referenced): returns the beginning port of the 22824 * reserved port range added. 22825 * in_port_t *hi_port (referenced): returns the ending port of the 22826 * reserved port range added. 22827 * 22828 * Return: 22829 * B_TRUE if the port reservation is successful, B_FALSE otherwise. 22830 */ 22831 boolean_t 22832 tcp_reserved_port_add(int size, in_port_t *lo_port, in_port_t *hi_port) 22833 { 22834 tcp_t *tcp; 22835 tcp_t *tmp_tcp; 22836 tcp_t **temp_tcp_array; 22837 tf_t *tbf; 22838 in_port_t net_port; 22839 in_port_t port; 22840 int32_t cur_size; 22841 int i, j; 22842 boolean_t used; 22843 tcp_rport_t tmp_ports[TCP_RESERVED_PORTS_ARRAY_MAX_SIZE]; 22844 zoneid_t zoneid = GLOBAL_ZONEID; 22845 22846 /* Sanity check. */ 22847 if (size <= 0 || size > TCP_RESERVED_PORTS_RANGE_MAX) { 22848 return (B_FALSE); 22849 } 22850 22851 rw_enter(&tcp_reserved_port_lock, RW_WRITER); 22852 if (tcp_reserved_port_array_size == TCP_RESERVED_PORTS_ARRAY_MAX_SIZE) { 22853 rw_exit(&tcp_reserved_port_lock); 22854 return (B_FALSE); 22855 } 22856 22857 /* 22858 * Find the starting port to try. Since the port ranges are ordered 22859 * in the reserved port array, we can do a simple search here. 22860 */ 22861 *lo_port = TCP_SMALLEST_RESERVED_PORT; 22862 *hi_port = TCP_LARGEST_RESERVED_PORT; 22863 for (i = 0; i < tcp_reserved_port_array_size; 22864 *lo_port = tcp_reserved_port[i].hi_port + 1, i++) { 22865 if (tcp_reserved_port[i].lo_port - *lo_port >= size) { 22866 *hi_port = tcp_reserved_port[i].lo_port - 1; 22867 break; 22868 } 22869 } 22870 /* No available port range. */ 22871 if (i == tcp_reserved_port_array_size && *hi_port - *lo_port < size) { 22872 rw_exit(&tcp_reserved_port_lock); 22873 return (B_FALSE); 22874 } 22875 22876 temp_tcp_array = kmem_zalloc(size * sizeof (tcp_t *), KM_NOSLEEP); 22877 if (temp_tcp_array == NULL) { 22878 rw_exit(&tcp_reserved_port_lock); 22879 return (B_FALSE); 22880 } 22881 22882 /* Go thru the port range to see if some ports are already bound. */ 22883 for (port = *lo_port, cur_size = 0; 22884 cur_size < size && port <= *hi_port; 22885 cur_size++, port++) { 22886 used = B_FALSE; 22887 net_port = htons(port); 22888 tbf = &tcp_bind_fanout[TCP_BIND_HASH(net_port)]; 22889 mutex_enter(&tbf->tf_lock); 22890 for (tcp = tbf->tf_tcp; tcp != NULL; 22891 tcp = tcp->tcp_bind_hash) { 22892 if (zoneid == tcp->tcp_connp->conn_zoneid && 22893 net_port == tcp->tcp_lport) { 22894 /* 22895 * A port is already bound. Search again 22896 * starting from port + 1. Release all 22897 * temporary tcps. 22898 */ 22899 mutex_exit(&tbf->tf_lock); 22900 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22901 *lo_port = port + 1; 22902 cur_size = -1; 22903 used = B_TRUE; 22904 break; 22905 } 22906 } 22907 if (!used) { 22908 if ((tmp_tcp = tcp_alloc_temp_tcp(net_port)) == NULL) { 22909 /* 22910 * Allocation failure. Just fail the request. 22911 * Need to remove all those temporary tcp 22912 * structures. 22913 */ 22914 mutex_exit(&tbf->tf_lock); 22915 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22916 rw_exit(&tcp_reserved_port_lock); 22917 kmem_free(temp_tcp_array, 22918 (hi_port - lo_port + 1) * 22919 sizeof (tcp_t *)); 22920 return (B_FALSE); 22921 } 22922 temp_tcp_array[cur_size] = tmp_tcp; 22923 tcp_bind_hash_insert(tbf, tmp_tcp, B_TRUE); 22924 mutex_exit(&tbf->tf_lock); 22925 } 22926 } 22927 22928 /* 22929 * The current range is not large enough. We can actually do another 22930 * search if this search is done between 2 reserved port ranges. But 22931 * for first release, we just stop here and return saying that no port 22932 * range is available. 22933 */ 22934 if (cur_size < size) { 22935 TCP_TMP_TCP_REMOVE(temp_tcp_array, cur_size); 22936 rw_exit(&tcp_reserved_port_lock); 22937 kmem_free(temp_tcp_array, size * sizeof (tcp_t *)); 22938 return (B_FALSE); 22939 } 22940 *hi_port = port - 1; 22941 22942 /* 22943 * Insert range into array in ascending order. Since this function 22944 * must not be called often, we choose to use the simplest method. 22945 * The above array should not consume excessive stack space as 22946 * the size must be very small. If in future releases, we find 22947 * that we should provide more reserved port ranges, this function 22948 * has to be modified to be more efficient. 22949 */ 22950 if (tcp_reserved_port_array_size == 0) { 22951 tcp_reserved_port[0].lo_port = *lo_port; 22952 tcp_reserved_port[0].hi_port = *hi_port; 22953 tcp_reserved_port[0].temp_tcp_array = temp_tcp_array; 22954 } else { 22955 for (i = 0, j = 0; i < tcp_reserved_port_array_size; i++, j++) { 22956 if (*lo_port < tcp_reserved_port[i].lo_port && i == j) { 22957 tmp_ports[j].lo_port = *lo_port; 22958 tmp_ports[j].hi_port = *hi_port; 22959 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22960 j++; 22961 } 22962 tmp_ports[j].lo_port = tcp_reserved_port[i].lo_port; 22963 tmp_ports[j].hi_port = tcp_reserved_port[i].hi_port; 22964 tmp_ports[j].temp_tcp_array = 22965 tcp_reserved_port[i].temp_tcp_array; 22966 } 22967 if (j == i) { 22968 tmp_ports[j].lo_port = *lo_port; 22969 tmp_ports[j].hi_port = *hi_port; 22970 tmp_ports[j].temp_tcp_array = temp_tcp_array; 22971 } 22972 bcopy(tmp_ports, tcp_reserved_port, sizeof (tmp_ports)); 22973 } 22974 tcp_reserved_port_array_size++; 22975 rw_exit(&tcp_reserved_port_lock); 22976 return (B_TRUE); 22977 } 22978 22979 /* 22980 * Check to see if a port is in any reserved port range. 22981 * 22982 * Params: 22983 * in_port_t port: the port to be verified. 22984 * 22985 * Return: 22986 * B_TRUE is the port is inside a reserved port range, B_FALSE otherwise. 22987 */ 22988 boolean_t 22989 tcp_reserved_port_check(in_port_t port) 22990 { 22991 int i; 22992 22993 rw_enter(&tcp_reserved_port_lock, RW_READER); 22994 for (i = 0; i < tcp_reserved_port_array_size; i++) { 22995 if (port >= tcp_reserved_port[i].lo_port || 22996 port <= tcp_reserved_port[i].hi_port) { 22997 rw_exit(&tcp_reserved_port_lock); 22998 return (B_TRUE); 22999 } 23000 } 23001 rw_exit(&tcp_reserved_port_lock); 23002 return (B_FALSE); 23003 } 23004 23005 /* 23006 * To list all reserved port ranges. This is the function to handle 23007 * ndd tcp_reserved_port_list. 23008 */ 23009 /* ARGSUSED */ 23010 static int 23011 tcp_reserved_port_list(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 23012 { 23013 int i; 23014 23015 rw_enter(&tcp_reserved_port_lock, RW_READER); 23016 if (tcp_reserved_port_array_size > 0) 23017 (void) mi_mpprintf(mp, "The following ports are reserved:"); 23018 else 23019 (void) mi_mpprintf(mp, "No port is reserved."); 23020 for (i = 0; i < tcp_reserved_port_array_size; i++) { 23021 (void) mi_mpprintf(mp, "%d-%d", 23022 tcp_reserved_port[i].lo_port, tcp_reserved_port[i].hi_port); 23023 } 23024 rw_exit(&tcp_reserved_port_lock); 23025 return (0); 23026 } 23027 23028 /* 23029 * Hash list insertion routine for tcp_t structures. 23030 * Inserts entries with the ones bound to a specific IP address first 23031 * followed by those bound to INADDR_ANY. 23032 */ 23033 static void 23034 tcp_bind_hash_insert(tf_t *tbf, tcp_t *tcp, int caller_holds_lock) 23035 { 23036 tcp_t **tcpp; 23037 tcp_t *tcpnext; 23038 23039 if (tcp->tcp_ptpbhn != NULL) { 23040 ASSERT(!caller_holds_lock); 23041 tcp_bind_hash_remove(tcp); 23042 } 23043 tcpp = &tbf->tf_tcp; 23044 if (!caller_holds_lock) { 23045 mutex_enter(&tbf->tf_lock); 23046 } else { 23047 ASSERT(MUTEX_HELD(&tbf->tf_lock)); 23048 } 23049 tcpnext = tcpp[0]; 23050 if (tcpnext) { 23051 /* 23052 * If the new tcp bound to the INADDR_ANY address 23053 * and the first one in the list is not bound to 23054 * INADDR_ANY we skip all entries until we find the 23055 * first one bound to INADDR_ANY. 23056 * This makes sure that applications binding to a 23057 * specific address get preference over those binding to 23058 * INADDR_ANY. 23059 */ 23060 if (V6_OR_V4_INADDR_ANY(tcp->tcp_bound_source_v6) && 23061 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) { 23062 while ((tcpnext = tcpp[0]) != NULL && 23063 !V6_OR_V4_INADDR_ANY(tcpnext->tcp_bound_source_v6)) 23064 tcpp = &(tcpnext->tcp_bind_hash); 23065 if (tcpnext) 23066 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 23067 } else 23068 tcpnext->tcp_ptpbhn = &tcp->tcp_bind_hash; 23069 } 23070 tcp->tcp_bind_hash = tcpnext; 23071 tcp->tcp_ptpbhn = tcpp; 23072 tcpp[0] = tcp; 23073 if (!caller_holds_lock) 23074 mutex_exit(&tbf->tf_lock); 23075 } 23076 23077 /* 23078 * Hash list removal routine for tcp_t structures. 23079 */ 23080 static void 23081 tcp_bind_hash_remove(tcp_t *tcp) 23082 { 23083 tcp_t *tcpnext; 23084 kmutex_t *lockp; 23085 23086 if (tcp->tcp_ptpbhn == NULL) 23087 return; 23088 23089 /* 23090 * Extract the lock pointer in case there are concurrent 23091 * hash_remove's for this instance. 23092 */ 23093 ASSERT(tcp->tcp_lport != 0); 23094 lockp = &tcp_bind_fanout[TCP_BIND_HASH(tcp->tcp_lport)].tf_lock; 23095 23096 ASSERT(lockp != NULL); 23097 mutex_enter(lockp); 23098 if (tcp->tcp_ptpbhn) { 23099 tcpnext = tcp->tcp_bind_hash; 23100 if (tcpnext) { 23101 tcpnext->tcp_ptpbhn = tcp->tcp_ptpbhn; 23102 tcp->tcp_bind_hash = NULL; 23103 } 23104 *tcp->tcp_ptpbhn = tcpnext; 23105 tcp->tcp_ptpbhn = NULL; 23106 } 23107 mutex_exit(lockp); 23108 } 23109 23110 23111 /* 23112 * Hash list lookup routine for tcp_t structures. 23113 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 23114 */ 23115 static tcp_t * 23116 tcp_acceptor_hash_lookup(t_uscalar_t id) 23117 { 23118 tf_t *tf; 23119 tcp_t *tcp; 23120 23121 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 23122 mutex_enter(&tf->tf_lock); 23123 for (tcp = tf->tf_tcp; tcp != NULL; 23124 tcp = tcp->tcp_acceptor_hash) { 23125 if (tcp->tcp_acceptor_id == id) { 23126 CONN_INC_REF(tcp->tcp_connp); 23127 mutex_exit(&tf->tf_lock); 23128 return (tcp); 23129 } 23130 } 23131 mutex_exit(&tf->tf_lock); 23132 return (NULL); 23133 } 23134 23135 23136 /* 23137 * Hash list insertion routine for tcp_t structures. 23138 */ 23139 void 23140 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 23141 { 23142 tf_t *tf; 23143 tcp_t **tcpp; 23144 tcp_t *tcpnext; 23145 23146 tf = &tcp_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 23147 23148 if (tcp->tcp_ptpahn != NULL) 23149 tcp_acceptor_hash_remove(tcp); 23150 tcpp = &tf->tf_tcp; 23151 mutex_enter(&tf->tf_lock); 23152 tcpnext = tcpp[0]; 23153 if (tcpnext) 23154 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 23155 tcp->tcp_acceptor_hash = tcpnext; 23156 tcp->tcp_ptpahn = tcpp; 23157 tcpp[0] = tcp; 23158 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 23159 mutex_exit(&tf->tf_lock); 23160 } 23161 23162 /* 23163 * Hash list removal routine for tcp_t structures. 23164 */ 23165 static void 23166 tcp_acceptor_hash_remove(tcp_t *tcp) 23167 { 23168 tcp_t *tcpnext; 23169 kmutex_t *lockp; 23170 23171 /* 23172 * Extract the lock pointer in case there are concurrent 23173 * hash_remove's for this instance. 23174 */ 23175 lockp = tcp->tcp_acceptor_lockp; 23176 23177 if (tcp->tcp_ptpahn == NULL) 23178 return; 23179 23180 ASSERT(lockp != NULL); 23181 mutex_enter(lockp); 23182 if (tcp->tcp_ptpahn) { 23183 tcpnext = tcp->tcp_acceptor_hash; 23184 if (tcpnext) { 23185 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 23186 tcp->tcp_acceptor_hash = NULL; 23187 } 23188 *tcp->tcp_ptpahn = tcpnext; 23189 tcp->tcp_ptpahn = NULL; 23190 } 23191 mutex_exit(lockp); 23192 tcp->tcp_acceptor_lockp = NULL; 23193 } 23194 23195 /* ARGSUSED */ 23196 static int 23197 tcp_host_param_setvalue(queue_t *q, mblk_t *mp, char *value, caddr_t cp, int af) 23198 { 23199 int error = 0; 23200 int retval; 23201 char *end; 23202 23203 tcp_hsp_t *hsp; 23204 tcp_hsp_t *hspprev; 23205 23206 ipaddr_t addr = 0; /* Address we're looking for */ 23207 in6_addr_t v6addr; /* Address we're looking for */ 23208 uint32_t hash; /* Hash of that address */ 23209 23210 /* 23211 * If the following variables are still zero after parsing the input 23212 * string, the user didn't specify them and we don't change them in 23213 * the HSP. 23214 */ 23215 23216 ipaddr_t mask = 0; /* Subnet mask */ 23217 in6_addr_t v6mask; 23218 long sendspace = 0; /* Send buffer size */ 23219 long recvspace = 0; /* Receive buffer size */ 23220 long timestamp = 0; /* Originate TCP TSTAMP option, 1 = yes */ 23221 boolean_t delete = B_FALSE; /* User asked to delete this HSP */ 23222 23223 rw_enter(&tcp_hsp_lock, RW_WRITER); 23224 23225 /* Parse and validate address */ 23226 if (af == AF_INET) { 23227 retval = inet_pton(af, value, &addr); 23228 if (retval == 1) 23229 IN6_IPADDR_TO_V4MAPPED(addr, &v6addr); 23230 } else if (af == AF_INET6) { 23231 retval = inet_pton(af, value, &v6addr); 23232 } else { 23233 error = EINVAL; 23234 goto done; 23235 } 23236 if (retval == 0) { 23237 error = EINVAL; 23238 goto done; 23239 } 23240 23241 while ((*value) && *value != ' ') 23242 value++; 23243 23244 /* Parse individual keywords, set variables if found */ 23245 while (*value) { 23246 /* Skip leading blanks */ 23247 23248 while (*value == ' ' || *value == '\t') 23249 value++; 23250 23251 /* If at end of string, we're done */ 23252 23253 if (!*value) 23254 break; 23255 23256 /* We have a word, figure out what it is */ 23257 23258 if (strncmp("mask", value, 4) == 0) { 23259 value += 4; 23260 while (*value == ' ' || *value == '\t') 23261 value++; 23262 /* Parse subnet mask */ 23263 if (af == AF_INET) { 23264 retval = inet_pton(af, value, &mask); 23265 if (retval == 1) { 23266 V4MASK_TO_V6(mask, v6mask); 23267 } 23268 } else if (af == AF_INET6) { 23269 retval = inet_pton(af, value, &v6mask); 23270 } 23271 if (retval != 1) { 23272 error = EINVAL; 23273 goto done; 23274 } 23275 while ((*value) && *value != ' ') 23276 value++; 23277 } else if (strncmp("sendspace", value, 9) == 0) { 23278 value += 9; 23279 23280 if (ddi_strtol(value, &end, 0, &sendspace) != 0 || 23281 sendspace < TCP_XMIT_HIWATER || 23282 sendspace >= (1L<<30)) { 23283 error = EINVAL; 23284 goto done; 23285 } 23286 value = end; 23287 } else if (strncmp("recvspace", value, 9) == 0) { 23288 value += 9; 23289 23290 if (ddi_strtol(value, &end, 0, &recvspace) != 0 || 23291 recvspace < TCP_RECV_HIWATER || 23292 recvspace >= (1L<<30)) { 23293 error = EINVAL; 23294 goto done; 23295 } 23296 value = end; 23297 } else if (strncmp("timestamp", value, 9) == 0) { 23298 value += 9; 23299 23300 if (ddi_strtol(value, &end, 0, ×tamp) != 0 || 23301 timestamp < 0 || timestamp > 1) { 23302 error = EINVAL; 23303 goto done; 23304 } 23305 23306 /* 23307 * We increment timestamp so we know it's been set; 23308 * this is undone when we put it in the HSP 23309 */ 23310 timestamp++; 23311 value = end; 23312 } else if (strncmp("delete", value, 6) == 0) { 23313 value += 6; 23314 delete = B_TRUE; 23315 } else { 23316 error = EINVAL; 23317 goto done; 23318 } 23319 } 23320 23321 /* Hash address for lookup */ 23322 23323 hash = TCP_HSP_HASH(addr); 23324 23325 if (delete) { 23326 /* 23327 * Note that deletes don't return an error if the thing 23328 * we're trying to delete isn't there. 23329 */ 23330 if (tcp_hsp_hash == NULL) 23331 goto done; 23332 hsp = tcp_hsp_hash[hash]; 23333 23334 if (hsp) { 23335 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23336 &v6addr)) { 23337 tcp_hsp_hash[hash] = hsp->tcp_hsp_next; 23338 mi_free((char *)hsp); 23339 } else { 23340 hspprev = hsp; 23341 while ((hsp = hsp->tcp_hsp_next) != NULL) { 23342 if (IN6_ARE_ADDR_EQUAL( 23343 &hsp->tcp_hsp_addr_v6, &v6addr)) { 23344 hspprev->tcp_hsp_next = 23345 hsp->tcp_hsp_next; 23346 mi_free((char *)hsp); 23347 break; 23348 } 23349 hspprev = hsp; 23350 } 23351 } 23352 } 23353 } else { 23354 /* 23355 * We're adding/modifying an HSP. If we haven't already done 23356 * so, allocate the hash table. 23357 */ 23358 23359 if (!tcp_hsp_hash) { 23360 tcp_hsp_hash = (tcp_hsp_t **) 23361 mi_zalloc(sizeof (tcp_hsp_t *) * TCP_HSP_HASH_SIZE); 23362 if (!tcp_hsp_hash) { 23363 error = EINVAL; 23364 goto done; 23365 } 23366 } 23367 23368 /* Get head of hash chain */ 23369 23370 hsp = tcp_hsp_hash[hash]; 23371 23372 /* Try to find pre-existing hsp on hash chain */ 23373 /* Doesn't handle CIDR prefixes. */ 23374 while (hsp) { 23375 if (IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, &v6addr)) 23376 break; 23377 hsp = hsp->tcp_hsp_next; 23378 } 23379 23380 /* 23381 * If we didn't, create one with default values and put it 23382 * at head of hash chain 23383 */ 23384 23385 if (!hsp) { 23386 hsp = (tcp_hsp_t *)mi_zalloc(sizeof (tcp_hsp_t)); 23387 if (!hsp) { 23388 error = EINVAL; 23389 goto done; 23390 } 23391 hsp->tcp_hsp_next = tcp_hsp_hash[hash]; 23392 tcp_hsp_hash[hash] = hsp; 23393 } 23394 23395 /* Set values that the user asked us to change */ 23396 23397 hsp->tcp_hsp_addr_v6 = v6addr; 23398 if (IN6_IS_ADDR_V4MAPPED(&v6addr)) 23399 hsp->tcp_hsp_vers = IPV4_VERSION; 23400 else 23401 hsp->tcp_hsp_vers = IPV6_VERSION; 23402 hsp->tcp_hsp_subnet_v6 = v6mask; 23403 if (sendspace > 0) 23404 hsp->tcp_hsp_sendspace = sendspace; 23405 if (recvspace > 0) 23406 hsp->tcp_hsp_recvspace = recvspace; 23407 if (timestamp > 0) 23408 hsp->tcp_hsp_tstamp = timestamp - 1; 23409 } 23410 23411 done: 23412 rw_exit(&tcp_hsp_lock); 23413 return (error); 23414 } 23415 23416 /* Set callback routine passed to nd_load by tcp_param_register. */ 23417 /* ARGSUSED */ 23418 static int 23419 tcp_host_param_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, cred_t *cr) 23420 { 23421 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET)); 23422 } 23423 /* ARGSUSED */ 23424 static int 23425 tcp_host_param_set_ipv6(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23426 cred_t *cr) 23427 { 23428 return (tcp_host_param_setvalue(q, mp, value, cp, AF_INET6)); 23429 } 23430 23431 /* TCP host parameters report triggered via the Named Dispatch mechanism. */ 23432 /* ARGSUSED */ 23433 static int 23434 tcp_host_param_report(queue_t *q, mblk_t *mp, caddr_t cp, cred_t *cr) 23435 { 23436 tcp_hsp_t *hsp; 23437 int i; 23438 char addrbuf[INET6_ADDRSTRLEN], subnetbuf[INET6_ADDRSTRLEN]; 23439 23440 rw_enter(&tcp_hsp_lock, RW_READER); 23441 (void) mi_mpprintf(mp, 23442 "Hash HSP " MI_COL_HDRPAD_STR 23443 "Address Subnet Mask Send Receive TStamp"); 23444 if (tcp_hsp_hash) { 23445 for (i = 0; i < TCP_HSP_HASH_SIZE; i++) { 23446 hsp = tcp_hsp_hash[i]; 23447 while (hsp) { 23448 if (hsp->tcp_hsp_vers == IPV4_VERSION) { 23449 (void) inet_ntop(AF_INET, 23450 &hsp->tcp_hsp_addr, 23451 addrbuf, sizeof (addrbuf)); 23452 (void) inet_ntop(AF_INET, 23453 &hsp->tcp_hsp_subnet, 23454 subnetbuf, sizeof (subnetbuf)); 23455 } else { 23456 (void) inet_ntop(AF_INET6, 23457 &hsp->tcp_hsp_addr_v6, 23458 addrbuf, sizeof (addrbuf)); 23459 (void) inet_ntop(AF_INET6, 23460 &hsp->tcp_hsp_subnet_v6, 23461 subnetbuf, sizeof (subnetbuf)); 23462 } 23463 (void) mi_mpprintf(mp, 23464 " %03d " MI_COL_PTRFMT_STR 23465 "%s %s %010d %010d %d", 23466 i, 23467 (void *)hsp, 23468 addrbuf, 23469 subnetbuf, 23470 hsp->tcp_hsp_sendspace, 23471 hsp->tcp_hsp_recvspace, 23472 hsp->tcp_hsp_tstamp); 23473 23474 hsp = hsp->tcp_hsp_next; 23475 } 23476 } 23477 } 23478 rw_exit(&tcp_hsp_lock); 23479 return (0); 23480 } 23481 23482 23483 /* Data for fast netmask macro used by tcp_hsp_lookup */ 23484 23485 static ipaddr_t netmasks[] = { 23486 IN_CLASSA_NET, IN_CLASSA_NET, IN_CLASSB_NET, 23487 IN_CLASSC_NET | IN_CLASSD_NET /* Class C,D,E */ 23488 }; 23489 23490 #define netmask(addr) (netmasks[(ipaddr_t)(addr) >> 30]) 23491 23492 /* 23493 * XXX This routine should go away and instead we should use the metrics 23494 * associated with the routes to determine the default sndspace and rcvspace. 23495 */ 23496 static tcp_hsp_t * 23497 tcp_hsp_lookup(ipaddr_t addr) 23498 { 23499 tcp_hsp_t *hsp = NULL; 23500 23501 /* Quick check without acquiring the lock. */ 23502 if (tcp_hsp_hash == NULL) 23503 return (NULL); 23504 23505 rw_enter(&tcp_hsp_lock, RW_READER); 23506 23507 /* This routine finds the best-matching HSP for address addr. */ 23508 23509 if (tcp_hsp_hash) { 23510 int i; 23511 ipaddr_t srchaddr; 23512 tcp_hsp_t *hsp_net; 23513 23514 /* We do three passes: host, network, and subnet. */ 23515 23516 srchaddr = addr; 23517 23518 for (i = 1; i <= 3; i++) { 23519 /* Look for exact match on srchaddr */ 23520 23521 hsp = tcp_hsp_hash[TCP_HSP_HASH(srchaddr)]; 23522 while (hsp) { 23523 if (hsp->tcp_hsp_vers == IPV4_VERSION && 23524 hsp->tcp_hsp_addr == srchaddr) 23525 break; 23526 hsp = hsp->tcp_hsp_next; 23527 } 23528 ASSERT(hsp == NULL || 23529 hsp->tcp_hsp_vers == IPV4_VERSION); 23530 23531 /* 23532 * If this is the first pass: 23533 * If we found a match, great, return it. 23534 * If not, search for the network on the second pass. 23535 */ 23536 23537 if (i == 1) 23538 if (hsp) 23539 break; 23540 else 23541 { 23542 srchaddr = addr & netmask(addr); 23543 continue; 23544 } 23545 23546 /* 23547 * If this is the second pass: 23548 * If we found a match, but there's a subnet mask, 23549 * save the match but try again using the subnet 23550 * mask on the third pass. 23551 * Otherwise, return whatever we found. 23552 */ 23553 23554 if (i == 2) { 23555 if (hsp && hsp->tcp_hsp_subnet) { 23556 hsp_net = hsp; 23557 srchaddr = addr & hsp->tcp_hsp_subnet; 23558 continue; 23559 } else { 23560 break; 23561 } 23562 } 23563 23564 /* 23565 * This must be the third pass. If we didn't find 23566 * anything, return the saved network HSP instead. 23567 */ 23568 23569 if (!hsp) 23570 hsp = hsp_net; 23571 } 23572 } 23573 23574 rw_exit(&tcp_hsp_lock); 23575 return (hsp); 23576 } 23577 23578 /* 23579 * XXX Equally broken as the IPv4 routine. Doesn't handle longest 23580 * match lookup. 23581 */ 23582 static tcp_hsp_t * 23583 tcp_hsp_lookup_ipv6(in6_addr_t *v6addr) 23584 { 23585 tcp_hsp_t *hsp = NULL; 23586 23587 /* Quick check without acquiring the lock. */ 23588 if (tcp_hsp_hash == NULL) 23589 return (NULL); 23590 23591 rw_enter(&tcp_hsp_lock, RW_READER); 23592 23593 /* This routine finds the best-matching HSP for address addr. */ 23594 23595 if (tcp_hsp_hash) { 23596 int i; 23597 in6_addr_t v6srchaddr; 23598 tcp_hsp_t *hsp_net; 23599 23600 /* We do three passes: host, network, and subnet. */ 23601 23602 v6srchaddr = *v6addr; 23603 23604 for (i = 1; i <= 3; i++) { 23605 /* Look for exact match on srchaddr */ 23606 23607 hsp = tcp_hsp_hash[TCP_HSP_HASH( 23608 V4_PART_OF_V6(v6srchaddr))]; 23609 while (hsp) { 23610 if (hsp->tcp_hsp_vers == IPV6_VERSION && 23611 IN6_ARE_ADDR_EQUAL(&hsp->tcp_hsp_addr_v6, 23612 &v6srchaddr)) 23613 break; 23614 hsp = hsp->tcp_hsp_next; 23615 } 23616 23617 /* 23618 * If this is the first pass: 23619 * If we found a match, great, return it. 23620 * If not, search for the network on the second pass. 23621 */ 23622 23623 if (i == 1) 23624 if (hsp) 23625 break; 23626 else { 23627 /* Assume a 64 bit mask */ 23628 v6srchaddr.s6_addr32[0] = 23629 v6addr->s6_addr32[0]; 23630 v6srchaddr.s6_addr32[1] = 23631 v6addr->s6_addr32[1]; 23632 v6srchaddr.s6_addr32[2] = 0; 23633 v6srchaddr.s6_addr32[3] = 0; 23634 continue; 23635 } 23636 23637 /* 23638 * If this is the second pass: 23639 * If we found a match, but there's a subnet mask, 23640 * save the match but try again using the subnet 23641 * mask on the third pass. 23642 * Otherwise, return whatever we found. 23643 */ 23644 23645 if (i == 2) { 23646 ASSERT(hsp == NULL || 23647 hsp->tcp_hsp_vers == IPV6_VERSION); 23648 if (hsp && 23649 !IN6_IS_ADDR_UNSPECIFIED( 23650 &hsp->tcp_hsp_subnet_v6)) { 23651 hsp_net = hsp; 23652 V6_MASK_COPY(*v6addr, 23653 hsp->tcp_hsp_subnet_v6, v6srchaddr); 23654 continue; 23655 } else { 23656 break; 23657 } 23658 } 23659 23660 /* 23661 * This must be the third pass. If we didn't find 23662 * anything, return the saved network HSP instead. 23663 */ 23664 23665 if (!hsp) 23666 hsp = hsp_net; 23667 } 23668 } 23669 23670 rw_exit(&tcp_hsp_lock); 23671 return (hsp); 23672 } 23673 23674 /* 23675 * Type three generator adapted from the random() function in 4.4 BSD: 23676 */ 23677 23678 /* 23679 * Copyright (c) 1983, 1993 23680 * The Regents of the University of California. All rights reserved. 23681 * 23682 * Redistribution and use in source and binary forms, with or without 23683 * modification, are permitted provided that the following conditions 23684 * are met: 23685 * 1. Redistributions of source code must retain the above copyright 23686 * notice, this list of conditions and the following disclaimer. 23687 * 2. Redistributions in binary form must reproduce the above copyright 23688 * notice, this list of conditions and the following disclaimer in the 23689 * documentation and/or other materials provided with the distribution. 23690 * 3. All advertising materials mentioning features or use of this software 23691 * must display the following acknowledgement: 23692 * This product includes software developed by the University of 23693 * California, Berkeley and its contributors. 23694 * 4. Neither the name of the University nor the names of its contributors 23695 * may be used to endorse or promote products derived from this software 23696 * without specific prior written permission. 23697 * 23698 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 23699 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 23700 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 23701 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 23702 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 23703 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 23704 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 23705 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 23706 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 23707 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 23708 * SUCH DAMAGE. 23709 */ 23710 23711 /* Type 3 -- x**31 + x**3 + 1 */ 23712 #define DEG_3 31 23713 #define SEP_3 3 23714 23715 23716 /* Protected by tcp_random_lock */ 23717 static int tcp_randtbl[DEG_3 + 1]; 23718 23719 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 23720 static int *tcp_random_rptr = &tcp_randtbl[1]; 23721 23722 static int *tcp_random_state = &tcp_randtbl[1]; 23723 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 23724 23725 kmutex_t tcp_random_lock; 23726 23727 void 23728 tcp_random_init(void) 23729 { 23730 int i; 23731 hrtime_t hrt; 23732 time_t wallclock; 23733 uint64_t result; 23734 23735 /* 23736 * Use high-res timer and current time for seed. Gethrtime() returns 23737 * a longlong, which may contain resolution down to nanoseconds. 23738 * The current time will either be a 32-bit or a 64-bit quantity. 23739 * XOR the two together in a 64-bit result variable. 23740 * Convert the result to a 32-bit value by multiplying the high-order 23741 * 32-bits by the low-order 32-bits. 23742 */ 23743 23744 hrt = gethrtime(); 23745 (void) drv_getparm(TIME, &wallclock); 23746 result = (uint64_t)wallclock ^ (uint64_t)hrt; 23747 mutex_enter(&tcp_random_lock); 23748 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 23749 (result & 0xffffffff); 23750 23751 for (i = 1; i < DEG_3; i++) 23752 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 23753 + 12345; 23754 tcp_random_fptr = &tcp_random_state[SEP_3]; 23755 tcp_random_rptr = &tcp_random_state[0]; 23756 mutex_exit(&tcp_random_lock); 23757 for (i = 0; i < 10 * DEG_3; i++) 23758 (void) tcp_random(); 23759 } 23760 23761 /* 23762 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 23763 * This range is selected to be approximately centered on TCP_ISS / 2, 23764 * and easy to compute. We get this value by generating a 32-bit random 23765 * number, selecting out the high-order 17 bits, and then adding one so 23766 * that we never return zero. 23767 */ 23768 int 23769 tcp_random(void) 23770 { 23771 int i; 23772 23773 mutex_enter(&tcp_random_lock); 23774 *tcp_random_fptr += *tcp_random_rptr; 23775 23776 /* 23777 * The high-order bits are more random than the low-order bits, 23778 * so we select out the high-order 17 bits and add one so that 23779 * we never return zero. 23780 */ 23781 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 23782 if (++tcp_random_fptr >= tcp_random_end_ptr) { 23783 tcp_random_fptr = tcp_random_state; 23784 ++tcp_random_rptr; 23785 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 23786 tcp_random_rptr = tcp_random_state; 23787 23788 mutex_exit(&tcp_random_lock); 23789 return (i); 23790 } 23791 23792 /* 23793 * XXX This will go away when TPI is extended to send 23794 * info reqs to sockfs/timod ..... 23795 * Given a queue, set the max packet size for the write 23796 * side of the queue below stream head. This value is 23797 * cached on the stream head. 23798 * Returns 1 on success, 0 otherwise. 23799 */ 23800 static int 23801 setmaxps(queue_t *q, int maxpsz) 23802 { 23803 struct stdata *stp; 23804 queue_t *wq; 23805 stp = STREAM(q); 23806 23807 /* 23808 * At this point change of a queue parameter is not allowed 23809 * when a multiplexor is sitting on top. 23810 */ 23811 if (stp->sd_flag & STPLEX) 23812 return (0); 23813 23814 claimstr(stp->sd_wrq); 23815 wq = stp->sd_wrq->q_next; 23816 ASSERT(wq != NULL); 23817 (void) strqset(wq, QMAXPSZ, 0, maxpsz); 23818 releasestr(stp->sd_wrq); 23819 return (1); 23820 } 23821 23822 static int 23823 tcp_conprim_opt_process(tcp_t *tcp, mblk_t *mp, int *do_disconnectp, 23824 int *t_errorp, int *sys_errorp) 23825 { 23826 int error; 23827 int is_absreq_failure; 23828 t_scalar_t *opt_lenp; 23829 t_scalar_t opt_offset; 23830 int prim_type; 23831 struct T_conn_req *tcreqp; 23832 struct T_conn_res *tcresp; 23833 cred_t *cr; 23834 23835 cr = DB_CREDDEF(mp, tcp->tcp_cred); 23836 23837 prim_type = ((union T_primitives *)mp->b_rptr)->type; 23838 ASSERT(prim_type == T_CONN_REQ || prim_type == O_T_CONN_RES || 23839 prim_type == T_CONN_RES); 23840 23841 switch (prim_type) { 23842 case T_CONN_REQ: 23843 tcreqp = (struct T_conn_req *)mp->b_rptr; 23844 opt_offset = tcreqp->OPT_offset; 23845 opt_lenp = (t_scalar_t *)&tcreqp->OPT_length; 23846 break; 23847 case O_T_CONN_RES: 23848 case T_CONN_RES: 23849 tcresp = (struct T_conn_res *)mp->b_rptr; 23850 opt_offset = tcresp->OPT_offset; 23851 opt_lenp = (t_scalar_t *)&tcresp->OPT_length; 23852 break; 23853 } 23854 23855 *t_errorp = 0; 23856 *sys_errorp = 0; 23857 *do_disconnectp = 0; 23858 23859 error = tpi_optcom_buf(tcp->tcp_wq, mp, opt_lenp, 23860 opt_offset, cr, &tcp_opt_obj, 23861 NULL, &is_absreq_failure); 23862 23863 switch (error) { 23864 case 0: /* no error */ 23865 ASSERT(is_absreq_failure == 0); 23866 return (0); 23867 case ENOPROTOOPT: 23868 *t_errorp = TBADOPT; 23869 break; 23870 case EACCES: 23871 *t_errorp = TACCES; 23872 break; 23873 default: 23874 *t_errorp = TSYSERR; *sys_errorp = error; 23875 break; 23876 } 23877 if (is_absreq_failure != 0) { 23878 /* 23879 * The connection request should get the local ack 23880 * T_OK_ACK and then a T_DISCON_IND. 23881 */ 23882 *do_disconnectp = 1; 23883 } 23884 return (-1); 23885 } 23886 23887 /* 23888 * Split this function out so that if the secret changes, I'm okay. 23889 * 23890 * Initialize the tcp_iss_cookie and tcp_iss_key. 23891 */ 23892 23893 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 23894 23895 static void 23896 tcp_iss_key_init(uint8_t *phrase, int len) 23897 { 23898 struct { 23899 int32_t current_time; 23900 uint32_t randnum; 23901 uint16_t pad; 23902 uint8_t ether[6]; 23903 uint8_t passwd[PASSWD_SIZE]; 23904 } tcp_iss_cookie; 23905 time_t t; 23906 23907 /* 23908 * Start with the current absolute time. 23909 */ 23910 (void) drv_getparm(TIME, &t); 23911 tcp_iss_cookie.current_time = t; 23912 23913 /* 23914 * XXX - Need a more random number per RFC 1750, not this crap. 23915 * OTOH, if what follows is pretty random, then I'm in better shape. 23916 */ 23917 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 23918 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 23919 23920 /* 23921 * The cpu_type_info is pretty non-random. Ugggh. It does serve 23922 * as a good template. 23923 */ 23924 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 23925 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 23926 23927 /* 23928 * The pass-phrase. Normally this is supplied by user-called NDD. 23929 */ 23930 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 23931 23932 /* 23933 * See 4010593 if this section becomes a problem again, 23934 * but the local ethernet address is useful here. 23935 */ 23936 (void) localetheraddr(NULL, 23937 (struct ether_addr *)&tcp_iss_cookie.ether); 23938 23939 /* 23940 * Hash 'em all together. The MD5Final is called per-connection. 23941 */ 23942 mutex_enter(&tcp_iss_key_lock); 23943 MD5Init(&tcp_iss_key); 23944 MD5Update(&tcp_iss_key, (uchar_t *)&tcp_iss_cookie, 23945 sizeof (tcp_iss_cookie)); 23946 mutex_exit(&tcp_iss_key_lock); 23947 } 23948 23949 /* 23950 * Set the RFC 1948 pass phrase 23951 */ 23952 /* ARGSUSED */ 23953 static int 23954 tcp_1948_phrase_set(queue_t *q, mblk_t *mp, char *value, caddr_t cp, 23955 cred_t *cr) 23956 { 23957 /* 23958 * Basically, value contains a new pass phrase. Pass it along! 23959 */ 23960 tcp_iss_key_init((uint8_t *)value, strlen(value)); 23961 return (0); 23962 } 23963 23964 /* ARGSUSED */ 23965 static int 23966 tcp_sack_info_constructor(void *buf, void *cdrarg, int kmflags) 23967 { 23968 bzero(buf, sizeof (tcp_sack_info_t)); 23969 return (0); 23970 } 23971 23972 /* ARGSUSED */ 23973 static int 23974 tcp_iphc_constructor(void *buf, void *cdrarg, int kmflags) 23975 { 23976 bzero(buf, TCP_MAX_COMBINED_HEADER_LENGTH); 23977 return (0); 23978 } 23979 23980 void 23981 tcp_ddi_init(void) 23982 { 23983 int i; 23984 23985 /* Initialize locks */ 23986 rw_init(&tcp_hsp_lock, NULL, RW_DEFAULT, NULL); 23987 mutex_init(&tcp_g_q_lock, NULL, MUTEX_DEFAULT, NULL); 23988 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 23989 mutex_init(&tcp_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 23990 mutex_init(&tcp_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 23991 rw_init(&tcp_reserved_port_lock, NULL, RW_DEFAULT, NULL); 23992 23993 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 23994 mutex_init(&tcp_bind_fanout[i].tf_lock, NULL, 23995 MUTEX_DEFAULT, NULL); 23996 } 23997 23998 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 23999 mutex_init(&tcp_acceptor_fanout[i].tf_lock, NULL, 24000 MUTEX_DEFAULT, NULL); 24001 } 24002 24003 /* TCP's IPsec code calls the packet dropper. */ 24004 ip_drop_register(&tcp_dropper, "TCP IPsec policy enforcement"); 24005 24006 if (!tcp_g_nd) { 24007 if (!tcp_param_register(tcp_param_arr, A_CNT(tcp_param_arr))) { 24008 nd_free(&tcp_g_nd); 24009 } 24010 } 24011 24012 /* 24013 * Note: To really walk the device tree you need the devinfo 24014 * pointer to your device which is only available after probe/attach. 24015 * The following is safe only because it uses ddi_root_node() 24016 */ 24017 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 24018 tcp_opt_obj.odb_opt_arr_cnt); 24019 24020 tcp_timercache = kmem_cache_create("tcp_timercache", 24021 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 24022 NULL, NULL, NULL, NULL, NULL, 0); 24023 24024 tcp_sack_info_cache = kmem_cache_create("tcp_sack_info_cache", 24025 sizeof (tcp_sack_info_t), 0, 24026 tcp_sack_info_constructor, NULL, NULL, NULL, NULL, 0); 24027 24028 tcp_iphc_cache = kmem_cache_create("tcp_iphc_cache", 24029 TCP_MAX_COMBINED_HEADER_LENGTH, 0, 24030 tcp_iphc_constructor, NULL, NULL, NULL, NULL, 0); 24031 24032 tcp_squeue_wput_proc = tcp_squeue_switch(tcp_squeue_wput); 24033 tcp_squeue_close_proc = tcp_squeue_switch(tcp_squeue_close); 24034 24035 ip_squeue_init(tcp_squeue_add); 24036 24037 /* Initialize the random number generator */ 24038 tcp_random_init(); 24039 24040 /* 24041 * Initialize RFC 1948 secret values. This will probably be reset once 24042 * by the boot scripts. 24043 * 24044 * Use NULL name, as the name is caught by the new lockstats. 24045 * 24046 * Initialize with some random, non-guessable string, like the global 24047 * T_INFO_ACK. 24048 */ 24049 24050 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 24051 sizeof (tcp_g_t_info_ack)); 24052 24053 #if TCP_COUNTERS || TCP_DEBUG_COUNTER 24054 if ((tcp_kstat = kstat_create("tcp", 0, "tcpstat", 24055 "net", KSTAT_TYPE_NAMED, 24056 sizeof (tcp_statistics) / sizeof (kstat_named_t), 24057 KSTAT_FLAG_VIRTUAL)) != NULL) { 24058 tcp_kstat->ks_data = &tcp_statistics; 24059 kstat_install(tcp_kstat); 24060 } 24061 #endif 24062 tcp_kstat_init(); 24063 } 24064 24065 void 24066 tcp_ddi_destroy(void) 24067 { 24068 int i; 24069 24070 nd_free(&tcp_g_nd); 24071 24072 for (i = 0; i < A_CNT(tcp_bind_fanout); i++) { 24073 mutex_destroy(&tcp_bind_fanout[i].tf_lock); 24074 } 24075 24076 for (i = 0; i < A_CNT(tcp_acceptor_fanout); i++) { 24077 mutex_destroy(&tcp_acceptor_fanout[i].tf_lock); 24078 } 24079 24080 mutex_destroy(&tcp_iss_key_lock); 24081 rw_destroy(&tcp_hsp_lock); 24082 mutex_destroy(&tcp_g_q_lock); 24083 mutex_destroy(&tcp_random_lock); 24084 mutex_destroy(&tcp_epriv_port_lock); 24085 rw_destroy(&tcp_reserved_port_lock); 24086 24087 ip_drop_unregister(&tcp_dropper); 24088 24089 kmem_cache_destroy(tcp_timercache); 24090 kmem_cache_destroy(tcp_sack_info_cache); 24091 kmem_cache_destroy(tcp_iphc_cache); 24092 24093 tcp_kstat_fini(); 24094 } 24095 24096 /* 24097 * Generate ISS, taking into account NDD changes may happen halfway through. 24098 * (If the iss is not zero, set it.) 24099 */ 24100 24101 static void 24102 tcp_iss_init(tcp_t *tcp) 24103 { 24104 MD5_CTX context; 24105 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 24106 uint32_t answer[4]; 24107 24108 tcp_iss_incr_extra += (ISS_INCR >> 1); 24109 tcp->tcp_iss = tcp_iss_incr_extra; 24110 switch (tcp_strong_iss) { 24111 case 2: 24112 mutex_enter(&tcp_iss_key_lock); 24113 context = tcp_iss_key; 24114 mutex_exit(&tcp_iss_key_lock); 24115 arg.ports = tcp->tcp_ports; 24116 if (tcp->tcp_ipversion == IPV4_VERSION) { 24117 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_src, 24118 &arg.src); 24119 IN6_IPADDR_TO_V4MAPPED(tcp->tcp_ipha->ipha_dst, 24120 &arg.dst); 24121 } else { 24122 arg.src = tcp->tcp_ip6h->ip6_src; 24123 arg.dst = tcp->tcp_ip6h->ip6_dst; 24124 } 24125 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 24126 MD5Final((uchar_t *)answer, &context); 24127 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 24128 /* 24129 * Now that we've hashed into a unique per-connection sequence 24130 * space, add a random increment per strong_iss == 1. So I 24131 * guess we'll have to... 24132 */ 24133 /* FALLTHRU */ 24134 case 1: 24135 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 24136 break; 24137 default: 24138 tcp->tcp_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 24139 break; 24140 } 24141 tcp->tcp_valid_bits = TCP_ISS_VALID; 24142 tcp->tcp_fss = tcp->tcp_iss - 1; 24143 tcp->tcp_suna = tcp->tcp_iss; 24144 tcp->tcp_snxt = tcp->tcp_iss + 1; 24145 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 24146 tcp->tcp_csuna = tcp->tcp_snxt; 24147 } 24148 24149 /* 24150 * Exported routine for extracting active tcp connection status. 24151 * 24152 * This is used by the Solaris Cluster Networking software to 24153 * gather a list of connections that need to be forwarded to 24154 * specific nodes in the cluster when configuration changes occur. 24155 * 24156 * The callback is invoked for each tcp_t structure. Returning 24157 * non-zero from the callback routine terminates the search. 24158 */ 24159 int 24160 cl_tcp_walk_list(int (*callback)(cl_tcp_info_t *, void *), void *arg) 24161 { 24162 tcp_t *tcp; 24163 cl_tcp_info_t cl_tcpi; 24164 connf_t *connfp; 24165 conn_t *connp; 24166 int i; 24167 24168 ASSERT(callback != NULL); 24169 24170 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 24171 24172 connfp = &ipcl_globalhash_fanout[i]; 24173 connp = NULL; 24174 24175 while ((connp = tcp_get_next_conn(connfp, connp))) { 24176 24177 tcp = connp->conn_tcp; 24178 cl_tcpi.cl_tcpi_version = CL_TCPI_V1; 24179 cl_tcpi.cl_tcpi_ipversion = tcp->tcp_ipversion; 24180 cl_tcpi.cl_tcpi_state = tcp->tcp_state; 24181 cl_tcpi.cl_tcpi_lport = tcp->tcp_lport; 24182 cl_tcpi.cl_tcpi_fport = tcp->tcp_fport; 24183 /* 24184 * The macros tcp_laddr and tcp_faddr give the IPv4 24185 * addresses. They are copied implicitly below as 24186 * mapped addresses. 24187 */ 24188 cl_tcpi.cl_tcpi_laddr_v6 = tcp->tcp_ip_src_v6; 24189 if (tcp->tcp_ipversion == IPV4_VERSION) { 24190 cl_tcpi.cl_tcpi_faddr = 24191 tcp->tcp_ipha->ipha_dst; 24192 } else { 24193 cl_tcpi.cl_tcpi_faddr_v6 = 24194 tcp->tcp_ip6h->ip6_dst; 24195 } 24196 24197 /* 24198 * If the callback returns non-zero 24199 * we terminate the traversal. 24200 */ 24201 if ((*callback)(&cl_tcpi, arg) != 0) { 24202 CONN_DEC_REF(tcp->tcp_connp); 24203 return (1); 24204 } 24205 } 24206 } 24207 24208 return (0); 24209 } 24210 24211 /* 24212 * Macros used for accessing the different types of sockaddr 24213 * structures inside a tcp_ioc_abort_conn_t. 24214 */ 24215 #define TCP_AC_V4LADDR(acp) ((sin_t *)&(acp)->ac_local) 24216 #define TCP_AC_V4RADDR(acp) ((sin_t *)&(acp)->ac_remote) 24217 #define TCP_AC_V4LOCAL(acp) (TCP_AC_V4LADDR(acp)->sin_addr.s_addr) 24218 #define TCP_AC_V4REMOTE(acp) (TCP_AC_V4RADDR(acp)->sin_addr.s_addr) 24219 #define TCP_AC_V4LPORT(acp) (TCP_AC_V4LADDR(acp)->sin_port) 24220 #define TCP_AC_V4RPORT(acp) (TCP_AC_V4RADDR(acp)->sin_port) 24221 #define TCP_AC_V6LADDR(acp) ((sin6_t *)&(acp)->ac_local) 24222 #define TCP_AC_V6RADDR(acp) ((sin6_t *)&(acp)->ac_remote) 24223 #define TCP_AC_V6LOCAL(acp) (TCP_AC_V6LADDR(acp)->sin6_addr) 24224 #define TCP_AC_V6REMOTE(acp) (TCP_AC_V6RADDR(acp)->sin6_addr) 24225 #define TCP_AC_V6LPORT(acp) (TCP_AC_V6LADDR(acp)->sin6_port) 24226 #define TCP_AC_V6RPORT(acp) (TCP_AC_V6RADDR(acp)->sin6_port) 24227 24228 /* 24229 * Return the correct error code to mimic the behavior 24230 * of a connection reset. 24231 */ 24232 #define TCP_AC_GET_ERRCODE(state, err) { \ 24233 switch ((state)) { \ 24234 case TCPS_SYN_SENT: \ 24235 case TCPS_SYN_RCVD: \ 24236 (err) = ECONNREFUSED; \ 24237 break; \ 24238 case TCPS_ESTABLISHED: \ 24239 case TCPS_FIN_WAIT_1: \ 24240 case TCPS_FIN_WAIT_2: \ 24241 case TCPS_CLOSE_WAIT: \ 24242 (err) = ECONNRESET; \ 24243 break; \ 24244 case TCPS_CLOSING: \ 24245 case TCPS_LAST_ACK: \ 24246 case TCPS_TIME_WAIT: \ 24247 (err) = 0; \ 24248 break; \ 24249 default: \ 24250 (err) = ENXIO; \ 24251 } \ 24252 } 24253 24254 /* 24255 * Check if a tcp structure matches the info in acp. 24256 */ 24257 #define TCP_AC_ADDR_MATCH(acp, tcp) \ 24258 (((acp)->ac_local.ss_family == AF_INET) ? \ 24259 ((TCP_AC_V4LOCAL((acp)) == INADDR_ANY || \ 24260 TCP_AC_V4LOCAL((acp)) == (tcp)->tcp_ip_src) && \ 24261 (TCP_AC_V4REMOTE((acp)) == INADDR_ANY || \ 24262 TCP_AC_V4REMOTE((acp)) == (tcp)->tcp_remote) && \ 24263 (TCP_AC_V4LPORT((acp)) == 0 || \ 24264 TCP_AC_V4LPORT((acp)) == (tcp)->tcp_lport) && \ 24265 (TCP_AC_V4RPORT((acp)) == 0 || \ 24266 TCP_AC_V4RPORT((acp)) == (tcp)->tcp_fport) && \ 24267 (acp)->ac_start <= (tcp)->tcp_state && \ 24268 (acp)->ac_end >= (tcp)->tcp_state) : \ 24269 ((IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL((acp))) || \ 24270 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6LOCAL((acp)), \ 24271 &(tcp)->tcp_ip_src_v6)) && \ 24272 (IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE((acp))) || \ 24273 IN6_ARE_ADDR_EQUAL(&TCP_AC_V6REMOTE((acp)), \ 24274 &(tcp)->tcp_remote_v6)) && \ 24275 (TCP_AC_V6LPORT((acp)) == 0 || \ 24276 TCP_AC_V6LPORT((acp)) == (tcp)->tcp_lport) && \ 24277 (TCP_AC_V6RPORT((acp)) == 0 || \ 24278 TCP_AC_V6RPORT((acp)) == (tcp)->tcp_fport) && \ 24279 (acp)->ac_start <= (tcp)->tcp_state && \ 24280 (acp)->ac_end >= (tcp)->tcp_state)) 24281 24282 #define TCP_AC_MATCH(acp, tcp) \ 24283 (((acp)->ac_zoneid == ALL_ZONES || \ 24284 (acp)->ac_zoneid == tcp->tcp_connp->conn_zoneid) ? \ 24285 TCP_AC_ADDR_MATCH(acp, tcp) : 0) 24286 24287 /* 24288 * Build a message containing a tcp_ioc_abort_conn_t structure 24289 * which is filled in with information from acp and tp. 24290 */ 24291 static mblk_t * 24292 tcp_ioctl_abort_build_msg(tcp_ioc_abort_conn_t *acp, tcp_t *tp) 24293 { 24294 mblk_t *mp; 24295 tcp_ioc_abort_conn_t *tacp; 24296 24297 mp = allocb(sizeof (uint32_t) + sizeof (*acp), BPRI_LO); 24298 if (mp == NULL) 24299 return (NULL); 24300 24301 mp->b_datap->db_type = M_CTL; 24302 24303 *((uint32_t *)mp->b_rptr) = TCP_IOC_ABORT_CONN; 24304 tacp = (tcp_ioc_abort_conn_t *)((uchar_t *)mp->b_rptr + 24305 sizeof (uint32_t)); 24306 24307 tacp->ac_start = acp->ac_start; 24308 tacp->ac_end = acp->ac_end; 24309 tacp->ac_zoneid = acp->ac_zoneid; 24310 24311 if (acp->ac_local.ss_family == AF_INET) { 24312 tacp->ac_local.ss_family = AF_INET; 24313 tacp->ac_remote.ss_family = AF_INET; 24314 TCP_AC_V4LOCAL(tacp) = tp->tcp_ip_src; 24315 TCP_AC_V4REMOTE(tacp) = tp->tcp_remote; 24316 TCP_AC_V4LPORT(tacp) = tp->tcp_lport; 24317 TCP_AC_V4RPORT(tacp) = tp->tcp_fport; 24318 } else { 24319 tacp->ac_local.ss_family = AF_INET6; 24320 tacp->ac_remote.ss_family = AF_INET6; 24321 TCP_AC_V6LOCAL(tacp) = tp->tcp_ip_src_v6; 24322 TCP_AC_V6REMOTE(tacp) = tp->tcp_remote_v6; 24323 TCP_AC_V6LPORT(tacp) = tp->tcp_lport; 24324 TCP_AC_V6RPORT(tacp) = tp->tcp_fport; 24325 } 24326 mp->b_wptr = (uchar_t *)mp->b_rptr + sizeof (uint32_t) + sizeof (*acp); 24327 return (mp); 24328 } 24329 24330 /* 24331 * Print a tcp_ioc_abort_conn_t structure. 24332 */ 24333 static void 24334 tcp_ioctl_abort_dump(tcp_ioc_abort_conn_t *acp) 24335 { 24336 char lbuf[128]; 24337 char rbuf[128]; 24338 sa_family_t af; 24339 in_port_t lport, rport; 24340 ushort_t logflags; 24341 24342 af = acp->ac_local.ss_family; 24343 24344 if (af == AF_INET) { 24345 (void) inet_ntop(af, (const void *)&TCP_AC_V4LOCAL(acp), 24346 lbuf, 128); 24347 (void) inet_ntop(af, (const void *)&TCP_AC_V4REMOTE(acp), 24348 rbuf, 128); 24349 lport = ntohs(TCP_AC_V4LPORT(acp)); 24350 rport = ntohs(TCP_AC_V4RPORT(acp)); 24351 } else { 24352 (void) inet_ntop(af, (const void *)&TCP_AC_V6LOCAL(acp), 24353 lbuf, 128); 24354 (void) inet_ntop(af, (const void *)&TCP_AC_V6REMOTE(acp), 24355 rbuf, 128); 24356 lport = ntohs(TCP_AC_V6LPORT(acp)); 24357 rport = ntohs(TCP_AC_V6RPORT(acp)); 24358 } 24359 24360 logflags = SL_TRACE | SL_NOTE; 24361 /* 24362 * Don't print this message to the console if the operation was done 24363 * to a non-global zone. 24364 */ 24365 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24366 logflags |= SL_CONSOLE; 24367 (void) strlog(TCP_MODULE_ID, 0, 1, logflags, 24368 "TCP_IOC_ABORT_CONN: local = %s:%d, remote = %s:%d, " 24369 "start = %d, end = %d\n", lbuf, lport, rbuf, rport, 24370 acp->ac_start, acp->ac_end); 24371 } 24372 24373 /* 24374 * Called inside tcp_rput when a message built using 24375 * tcp_ioctl_abort_build_msg is put into a queue. 24376 * Note that when we get here there is no wildcard in acp any more. 24377 */ 24378 static void 24379 tcp_ioctl_abort_handler(tcp_t *tcp, mblk_t *mp) 24380 { 24381 tcp_ioc_abort_conn_t *acp; 24382 24383 acp = (tcp_ioc_abort_conn_t *)(mp->b_rptr + sizeof (uint32_t)); 24384 if (tcp->tcp_state <= acp->ac_end) { 24385 /* 24386 * If we get here, we are already on the correct 24387 * squeue. This ioctl follows the following path 24388 * tcp_wput -> tcp_wput_ioctl -> tcp_ioctl_abort_conn 24389 * ->tcp_ioctl_abort->squeue_fill (if on a 24390 * different squeue) 24391 */ 24392 int errcode; 24393 24394 TCP_AC_GET_ERRCODE(tcp->tcp_state, errcode); 24395 (void) tcp_clean_death(tcp, errcode, 26); 24396 } 24397 freemsg(mp); 24398 } 24399 24400 /* 24401 * Abort all matching connections on a hash chain. 24402 */ 24403 static int 24404 tcp_ioctl_abort_bucket(tcp_ioc_abort_conn_t *acp, int index, int *count, 24405 boolean_t exact) 24406 { 24407 int nmatch, err = 0; 24408 tcp_t *tcp; 24409 MBLKP mp, last, listhead = NULL; 24410 conn_t *tconnp; 24411 connf_t *connfp = &ipcl_conn_fanout[index]; 24412 24413 startover: 24414 nmatch = 0; 24415 24416 mutex_enter(&connfp->connf_lock); 24417 for (tconnp = connfp->connf_head; tconnp != NULL; 24418 tconnp = tconnp->conn_next) { 24419 tcp = tconnp->conn_tcp; 24420 if (TCP_AC_MATCH(acp, tcp)) { 24421 CONN_INC_REF(tcp->tcp_connp); 24422 mp = tcp_ioctl_abort_build_msg(acp, tcp); 24423 if (mp == NULL) { 24424 err = ENOMEM; 24425 CONN_DEC_REF(tcp->tcp_connp); 24426 break; 24427 } 24428 mp->b_prev = (mblk_t *)tcp; 24429 24430 if (listhead == NULL) { 24431 listhead = mp; 24432 last = mp; 24433 } else { 24434 last->b_next = mp; 24435 last = mp; 24436 } 24437 nmatch++; 24438 if (exact) 24439 break; 24440 } 24441 24442 /* Avoid holding lock for too long. */ 24443 if (nmatch >= 500) 24444 break; 24445 } 24446 mutex_exit(&connfp->connf_lock); 24447 24448 /* Pass mp into the correct tcp */ 24449 while ((mp = listhead) != NULL) { 24450 listhead = listhead->b_next; 24451 tcp = (tcp_t *)mp->b_prev; 24452 mp->b_next = mp->b_prev = NULL; 24453 squeue_fill(tcp->tcp_connp->conn_sqp, mp, 24454 tcp_input, tcp->tcp_connp, SQTAG_TCP_ABORT_BUCKET); 24455 } 24456 24457 *count += nmatch; 24458 if (nmatch >= 500 && err == 0) 24459 goto startover; 24460 return (err); 24461 } 24462 24463 /* 24464 * Abort all connections that matches the attributes specified in acp. 24465 */ 24466 static int 24467 tcp_ioctl_abort(tcp_ioc_abort_conn_t *acp) 24468 { 24469 sa_family_t af; 24470 uint32_t ports; 24471 uint16_t *pports; 24472 int err = 0, count = 0; 24473 boolean_t exact = B_FALSE; /* set when there is no wildcard */ 24474 int index = -1; 24475 ushort_t logflags; 24476 24477 af = acp->ac_local.ss_family; 24478 24479 if (af == AF_INET) { 24480 if (TCP_AC_V4REMOTE(acp) != INADDR_ANY && 24481 TCP_AC_V4LPORT(acp) != 0 && TCP_AC_V4RPORT(acp) != 0) { 24482 pports = (uint16_t *)&ports; 24483 pports[1] = TCP_AC_V4LPORT(acp); 24484 pports[0] = TCP_AC_V4RPORT(acp); 24485 exact = (TCP_AC_V4LOCAL(acp) != INADDR_ANY); 24486 } 24487 } else { 24488 if (!IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6REMOTE(acp)) && 24489 TCP_AC_V6LPORT(acp) != 0 && TCP_AC_V6RPORT(acp) != 0) { 24490 pports = (uint16_t *)&ports; 24491 pports[1] = TCP_AC_V6LPORT(acp); 24492 pports[0] = TCP_AC_V6RPORT(acp); 24493 exact = !IN6_IS_ADDR_UNSPECIFIED(&TCP_AC_V6LOCAL(acp)); 24494 } 24495 } 24496 24497 /* 24498 * For cases where remote addr, local port, and remote port are non- 24499 * wildcards, tcp_ioctl_abort_bucket will only be called once. 24500 */ 24501 if (index != -1) { 24502 err = tcp_ioctl_abort_bucket(acp, index, 24503 &count, exact); 24504 } else { 24505 /* 24506 * loop through all entries for wildcard case 24507 */ 24508 for (index = 0; index < ipcl_conn_fanout_size; index++) { 24509 err = tcp_ioctl_abort_bucket(acp, index, 24510 &count, exact); 24511 if (err != 0) 24512 break; 24513 } 24514 } 24515 24516 logflags = SL_TRACE | SL_NOTE; 24517 /* 24518 * Don't print this message to the console if the operation was done 24519 * to a non-global zone. 24520 */ 24521 if (acp->ac_zoneid == GLOBAL_ZONEID || acp->ac_zoneid == ALL_ZONES) 24522 logflags |= SL_CONSOLE; 24523 (void) strlog(TCP_MODULE_ID, 0, 1, logflags, "TCP_IOC_ABORT_CONN: " 24524 "aborted %d connection%c\n", count, ((count > 1) ? 's' : ' ')); 24525 if (err == 0 && count == 0) 24526 err = ENOENT; 24527 return (err); 24528 } 24529 24530 /* 24531 * Process the TCP_IOC_ABORT_CONN ioctl request. 24532 */ 24533 static void 24534 tcp_ioctl_abort_conn(queue_t *q, mblk_t *mp) 24535 { 24536 int err; 24537 IOCP iocp; 24538 MBLKP mp1; 24539 sa_family_t laf, raf; 24540 tcp_ioc_abort_conn_t *acp; 24541 zone_t *zptr; 24542 zoneid_t zoneid = Q_TO_CONN(q)->conn_zoneid; 24543 24544 iocp = (IOCP)mp->b_rptr; 24545 24546 if ((mp1 = mp->b_cont) == NULL || 24547 iocp->ioc_count != sizeof (tcp_ioc_abort_conn_t)) { 24548 err = EINVAL; 24549 goto out; 24550 } 24551 24552 /* check permissions */ 24553 if (secpolicy_net_config(iocp->ioc_cr, B_FALSE) != 0) { 24554 err = EPERM; 24555 goto out; 24556 } 24557 24558 if (mp1->b_cont != NULL) { 24559 freemsg(mp1->b_cont); 24560 mp1->b_cont = NULL; 24561 } 24562 24563 acp = (tcp_ioc_abort_conn_t *)mp1->b_rptr; 24564 laf = acp->ac_local.ss_family; 24565 raf = acp->ac_remote.ss_family; 24566 24567 /* check that a zone with the supplied zoneid exists */ 24568 if (acp->ac_zoneid != GLOBAL_ZONEID && acp->ac_zoneid != ALL_ZONES) { 24569 zptr = zone_find_by_id(zoneid); 24570 if (zptr != NULL) { 24571 zone_rele(zptr); 24572 } else { 24573 err = EINVAL; 24574 goto out; 24575 } 24576 } 24577 24578 if (acp->ac_start < TCPS_SYN_SENT || acp->ac_end > TCPS_TIME_WAIT || 24579 acp->ac_start > acp->ac_end || laf != raf || 24580 (laf != AF_INET && laf != AF_INET6)) { 24581 err = EINVAL; 24582 goto out; 24583 } 24584 24585 tcp_ioctl_abort_dump(acp); 24586 err = tcp_ioctl_abort(acp); 24587 24588 out: 24589 if (mp1 != NULL) { 24590 freemsg(mp1); 24591 mp->b_cont = NULL; 24592 } 24593 24594 if (err != 0) 24595 miocnak(q, mp, 0, err); 24596 else 24597 miocack(q, mp, 0, 0); 24598 } 24599 24600 /* 24601 * tcp_time_wait_processing() handles processing of incoming packets when 24602 * the tcp is in the TIME_WAIT state. 24603 * A TIME_WAIT tcp that has an associated open TCP stream is never put 24604 * on the time wait list. 24605 */ 24606 void 24607 tcp_time_wait_processing(tcp_t *tcp, mblk_t *mp, uint32_t seg_seq, 24608 uint32_t seg_ack, int seg_len, tcph_t *tcph) 24609 { 24610 int32_t bytes_acked; 24611 int32_t gap; 24612 int32_t rgap; 24613 tcp_opt_t tcpopt; 24614 uint_t flags; 24615 uint32_t new_swnd = 0; 24616 conn_t *connp; 24617 24618 BUMP_LOCAL(tcp->tcp_ibsegs); 24619 TCP_RECORD_TRACE(tcp, mp, TCP_TRACE_RECV_PKT); 24620 24621 flags = (unsigned int)tcph->th_flags[0] & 0xFF; 24622 new_swnd = BE16_TO_U16(tcph->th_win) << 24623 ((tcph->th_flags[0] & TH_SYN) ? 0 : tcp->tcp_snd_ws); 24624 if (tcp->tcp_snd_ts_ok) { 24625 if (!tcp_paws_check(tcp, tcph, &tcpopt)) { 24626 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24627 tcp->tcp_rnxt, TH_ACK); 24628 goto done; 24629 } 24630 } 24631 gap = seg_seq - tcp->tcp_rnxt; 24632 rgap = tcp->tcp_rwnd - (gap + seg_len); 24633 if (gap < 0) { 24634 BUMP_MIB(&tcp_mib, tcpInDataDupSegs); 24635 UPDATE_MIB(&tcp_mib, tcpInDataDupBytes, 24636 (seg_len > -gap ? -gap : seg_len)); 24637 seg_len += gap; 24638 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 24639 if (flags & TH_RST) { 24640 goto done; 24641 } 24642 if ((flags & TH_FIN) && seg_len == -1) { 24643 /* 24644 * When TCP receives a duplicate FIN in 24645 * TIME_WAIT state, restart the 2 MSL timer. 24646 * See page 73 in RFC 793. Make sure this TCP 24647 * is already on the TIME_WAIT list. If not, 24648 * just restart the timer. 24649 */ 24650 if (TCP_IS_DETACHED(tcp)) { 24651 tcp_time_wait_remove(tcp, NULL); 24652 tcp_time_wait_append(tcp); 24653 TCP_DBGSTAT(tcp_rput_time_wait); 24654 } else { 24655 ASSERT(tcp != NULL); 24656 TCP_TIMER_RESTART(tcp, 24657 tcp_time_wait_interval); 24658 } 24659 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24660 tcp->tcp_rnxt, TH_ACK); 24661 goto done; 24662 } 24663 flags |= TH_ACK_NEEDED; 24664 seg_len = 0; 24665 goto process_ack; 24666 } 24667 24668 /* Fix seg_seq, and chew the gap off the front. */ 24669 seg_seq = tcp->tcp_rnxt; 24670 } 24671 24672 if ((flags & TH_SYN) && gap > 0 && rgap < 0) { 24673 /* 24674 * Make sure that when we accept the connection, pick 24675 * an ISS greater than (tcp_snxt + ISS_INCR/2) for the 24676 * old connection. 24677 * 24678 * The next ISS generated is equal to tcp_iss_incr_extra 24679 * + ISS_INCR/2 + other components depending on the 24680 * value of tcp_strong_iss. We pre-calculate the new 24681 * ISS here and compare with tcp_snxt to determine if 24682 * we need to make adjustment to tcp_iss_incr_extra. 24683 * 24684 * The above calculation is ugly and is a 24685 * waste of CPU cycles... 24686 */ 24687 uint32_t new_iss = tcp_iss_incr_extra; 24688 int32_t adj; 24689 24690 switch (tcp_strong_iss) { 24691 case 2: { 24692 /* Add time and MD5 components. */ 24693 uint32_t answer[4]; 24694 struct { 24695 uint32_t ports; 24696 in6_addr_t src; 24697 in6_addr_t dst; 24698 } arg; 24699 MD5_CTX context; 24700 24701 mutex_enter(&tcp_iss_key_lock); 24702 context = tcp_iss_key; 24703 mutex_exit(&tcp_iss_key_lock); 24704 arg.ports = tcp->tcp_ports; 24705 /* We use MAPPED addresses in tcp_iss_init */ 24706 arg.src = tcp->tcp_ip_src_v6; 24707 if (tcp->tcp_ipversion == IPV4_VERSION) { 24708 IN6_IPADDR_TO_V4MAPPED( 24709 tcp->tcp_ipha->ipha_dst, 24710 &arg.dst); 24711 } else { 24712 arg.dst = 24713 tcp->tcp_ip6h->ip6_dst; 24714 } 24715 MD5Update(&context, (uchar_t *)&arg, 24716 sizeof (arg)); 24717 MD5Final((uchar_t *)answer, &context); 24718 answer[0] ^= answer[1] ^ answer[2] ^ answer[3]; 24719 new_iss += (gethrtime() >> ISS_NSEC_SHT) + answer[0]; 24720 break; 24721 } 24722 case 1: 24723 /* Add time component and min random (i.e. 1). */ 24724 new_iss += (gethrtime() >> ISS_NSEC_SHT) + 1; 24725 break; 24726 default: 24727 /* Add only time component. */ 24728 new_iss += (uint32_t)gethrestime_sec() * ISS_INCR; 24729 break; 24730 } 24731 if ((adj = (int32_t)(tcp->tcp_snxt - new_iss)) > 0) { 24732 /* 24733 * New ISS not guaranteed to be ISS_INCR/2 24734 * ahead of the current tcp_snxt, so add the 24735 * difference to tcp_iss_incr_extra. 24736 */ 24737 tcp_iss_incr_extra += adj; 24738 } 24739 /* 24740 * If tcp_clean_death() can not perform the task now, 24741 * drop the SYN packet and let the other side re-xmit. 24742 * Otherwise pass the SYN packet back in, since the 24743 * old tcp state has been cleaned up or freed. 24744 */ 24745 if (tcp_clean_death(tcp, 0, 27) == -1) 24746 goto done; 24747 /* 24748 * We will come back to tcp_rput_data 24749 * on the global queue. Packets destined 24750 * for the global queue will be checked 24751 * with global policy. But the policy for 24752 * this packet has already been checked as 24753 * this was destined for the detached 24754 * connection. We need to bypass policy 24755 * check this time by attaching a dummy 24756 * ipsec_in with ipsec_in_dont_check set. 24757 */ 24758 if ((connp = ipcl_classify(mp, tcp->tcp_connp->conn_zoneid)) != 24759 NULL) { 24760 TCP_STAT(tcp_time_wait_syn_success); 24761 tcp_reinput(connp, mp, tcp->tcp_connp->conn_sqp); 24762 return; 24763 } 24764 goto done; 24765 } 24766 24767 /* 24768 * rgap is the amount of stuff received out of window. A negative 24769 * value is the amount out of window. 24770 */ 24771 if (rgap < 0) { 24772 BUMP_MIB(&tcp_mib, tcpInDataPastWinSegs); 24773 UPDATE_MIB(&tcp_mib, tcpInDataPastWinBytes, -rgap); 24774 /* Fix seg_len and make sure there is something left. */ 24775 seg_len += rgap; 24776 if (seg_len <= 0) { 24777 if (flags & TH_RST) { 24778 goto done; 24779 } 24780 flags |= TH_ACK_NEEDED; 24781 seg_len = 0; 24782 goto process_ack; 24783 } 24784 } 24785 /* 24786 * Check whether we can update tcp_ts_recent. This test is 24787 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP 24788 * Extensions for High Performance: An Update", Internet Draft. 24789 */ 24790 if (tcp->tcp_snd_ts_ok && 24791 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 24792 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 24793 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 24794 tcp->tcp_last_rcv_lbolt = lbolt64; 24795 } 24796 24797 if (seg_seq != tcp->tcp_rnxt && seg_len > 0) { 24798 /* Always ack out of order packets */ 24799 flags |= TH_ACK_NEEDED; 24800 seg_len = 0; 24801 } else if (seg_len > 0) { 24802 BUMP_MIB(&tcp_mib, tcpInClosed); 24803 BUMP_MIB(&tcp_mib, tcpInDataInorderSegs); 24804 UPDATE_MIB(&tcp_mib, tcpInDataInorderBytes, seg_len); 24805 } 24806 if (flags & TH_RST) { 24807 (void) tcp_clean_death(tcp, 0, 28); 24808 goto done; 24809 } 24810 if (flags & TH_SYN) { 24811 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 24812 TH_RST|TH_ACK); 24813 /* 24814 * Do not delete the TCP structure if it is in 24815 * TIME_WAIT state. Refer to RFC 1122, 4.2.2.13. 24816 */ 24817 goto done; 24818 } 24819 process_ack: 24820 if (flags & TH_ACK) { 24821 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 24822 if (bytes_acked <= 0) { 24823 if (bytes_acked == 0 && seg_len == 0 && 24824 new_swnd == tcp->tcp_swnd) 24825 BUMP_MIB(&tcp_mib, tcpInDupAck); 24826 } else { 24827 /* Acks something not sent */ 24828 flags |= TH_ACK_NEEDED; 24829 } 24830 } 24831 if (flags & TH_ACK_NEEDED) { 24832 /* 24833 * Time to send an ack for some reason. 24834 */ 24835 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 24836 tcp->tcp_rnxt, TH_ACK); 24837 } 24838 done: 24839 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 24840 mp->b_datap->db_cksumstart = 0; 24841 mp->b_datap->db_struioflag &= ~STRUIO_EAGER; 24842 TCP_STAT(tcp_time_wait_syn_fail); 24843 } 24844 freemsg(mp); 24845 } 24846 24847 /* 24848 * Return zero if the buffers are identical in length and content. 24849 * This is used for comparing extension header buffers. 24850 * Note that an extension header would be declared different 24851 * even if all that changed was the next header value in that header i.e. 24852 * what really changed is the next extension header. 24853 */ 24854 static boolean_t 24855 tcp_cmpbuf(void *a, uint_t alen, boolean_t b_valid, void *b, uint_t blen) 24856 { 24857 if (!b_valid) 24858 blen = 0; 24859 24860 if (alen != blen) 24861 return (B_TRUE); 24862 if (alen == 0) 24863 return (B_FALSE); /* Both zero length */ 24864 return (bcmp(a, b, alen)); 24865 } 24866 24867 /* 24868 * Preallocate memory for tcp_savebuf(). Returns B_TRUE if ok. 24869 * Return B_FALSE if memory allocation fails - don't change any state! 24870 */ 24871 static boolean_t 24872 tcp_allocbuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 24873 void *src, uint_t srclen) 24874 { 24875 void *dst; 24876 24877 if (!src_valid) 24878 srclen = 0; 24879 24880 ASSERT(*dstlenp == 0); 24881 if (src != NULL && srclen != 0) { 24882 dst = mi_alloc(srclen, BPRI_MED); 24883 if (dst == NULL) 24884 return (B_FALSE); 24885 } else { 24886 dst = NULL; 24887 } 24888 if (*dstp != NULL) { 24889 mi_free(*dstp); 24890 *dstp = NULL; 24891 *dstlenp = 0; 24892 } 24893 *dstp = dst; 24894 if (dst != NULL) 24895 *dstlenp = srclen; 24896 else 24897 *dstlenp = 0; 24898 return (B_TRUE); 24899 } 24900 24901 /* 24902 * Replace what is in *dst, *dstlen with the source. 24903 * Assumes tcp_allocbuf has already been called. 24904 */ 24905 static void 24906 tcp_savebuf(void **dstp, uint_t *dstlenp, boolean_t src_valid, 24907 void *src, uint_t srclen) 24908 { 24909 if (!src_valid) 24910 srclen = 0; 24911 24912 ASSERT(*dstlenp == srclen); 24913 if (src != NULL && srclen != 0) { 24914 bcopy(src, *dstp, srclen); 24915 } 24916 } 24917 24918 /* 24919 * Allocate a T_SVR4_OPTMGMT_REQ. 24920 * The caller needs to increment tcp_drop_opt_ack_cnt when sending these so 24921 * that tcp_rput_other can drop the acks. 24922 */ 24923 static mblk_t * 24924 tcp_setsockopt_mp(int level, int cmd, char *opt, int optlen) 24925 { 24926 mblk_t *mp; 24927 struct T_optmgmt_req *tor; 24928 struct opthdr *oh; 24929 uint_t size; 24930 char *optptr; 24931 24932 size = sizeof (*tor) + sizeof (*oh) + optlen; 24933 mp = allocb(size, BPRI_MED); 24934 if (mp == NULL) 24935 return (NULL); 24936 24937 mp->b_wptr += size; 24938 mp->b_datap->db_type = M_PROTO; 24939 tor = (struct T_optmgmt_req *)mp->b_rptr; 24940 tor->PRIM_type = T_SVR4_OPTMGMT_REQ; 24941 tor->MGMT_flags = T_NEGOTIATE; 24942 tor->OPT_length = sizeof (*oh) + optlen; 24943 tor->OPT_offset = (t_scalar_t)sizeof (*tor); 24944 24945 oh = (struct opthdr *)&tor[1]; 24946 oh->level = level; 24947 oh->name = cmd; 24948 oh->len = optlen; 24949 if (optlen != 0) { 24950 optptr = (char *)&oh[1]; 24951 bcopy(opt, optptr, optlen); 24952 } 24953 return (mp); 24954 } 24955 24956 /* 24957 * TCP Timers Implementation. 24958 */ 24959 static timeout_id_t 24960 tcp_timeout(conn_t *connp, void (*f)(void *), clock_t tim) 24961 { 24962 mblk_t *mp; 24963 tcp_timer_t *tcpt; 24964 tcp_t *tcp = connp->conn_tcp; 24965 24966 ASSERT(connp->conn_sqp != NULL); 24967 24968 TCP_DBGSTAT(tcp_timeout_calls); 24969 24970 if (tcp->tcp_timercache == NULL) { 24971 mp = tcp_timermp_alloc(KM_NOSLEEP | KM_PANIC); 24972 } else { 24973 TCP_DBGSTAT(tcp_timeout_cached_alloc); 24974 mp = tcp->tcp_timercache; 24975 tcp->tcp_timercache = mp->b_next; 24976 mp->b_next = NULL; 24977 ASSERT(mp->b_wptr == NULL); 24978 } 24979 24980 CONN_INC_REF(connp); 24981 tcpt = (tcp_timer_t *)mp->b_rptr; 24982 tcpt->connp = connp; 24983 tcpt->tcpt_proc = f; 24984 tcpt->tcpt_tid = timeout(tcp_timer_callback, mp, tim); 24985 return ((timeout_id_t)mp); 24986 } 24987 24988 static void 24989 tcp_timer_callback(void *arg) 24990 { 24991 mblk_t *mp = (mblk_t *)arg; 24992 tcp_timer_t *tcpt; 24993 conn_t *connp; 24994 24995 tcpt = (tcp_timer_t *)mp->b_rptr; 24996 connp = tcpt->connp; 24997 squeue_fill(connp->conn_sqp, mp, 24998 tcp_timer_handler, connp, SQTAG_TCP_TIMER); 24999 } 25000 25001 static void 25002 tcp_timer_handler(void *arg, mblk_t *mp, void *arg2) 25003 { 25004 tcp_timer_t *tcpt; 25005 conn_t *connp = (conn_t *)arg; 25006 tcp_t *tcp = connp->conn_tcp; 25007 25008 tcpt = (tcp_timer_t *)mp->b_rptr; 25009 ASSERT(connp == tcpt->connp); 25010 ASSERT((squeue_t *)arg2 == connp->conn_sqp); 25011 25012 /* 25013 * If the TCP has reached the closed state, don't proceed any 25014 * further. This TCP logically does not exist on the system. 25015 * tcpt_proc could for example access queues, that have already 25016 * been qprocoff'ed off. Also see comments at the start of tcp_input 25017 */ 25018 if (tcp->tcp_state != TCPS_CLOSED) { 25019 (*tcpt->tcpt_proc)(connp); 25020 } else { 25021 tcp->tcp_timer_tid = 0; 25022 } 25023 tcp_timer_free(connp->conn_tcp, mp); 25024 } 25025 25026 /* 25027 * There is potential race with untimeout and the handler firing at the same 25028 * time. The mblock may be freed by the handler while we are trying to use 25029 * it. But since both should execute on the same squeue, this race should not 25030 * occur. 25031 */ 25032 static clock_t 25033 tcp_timeout_cancel(conn_t *connp, timeout_id_t id) 25034 { 25035 mblk_t *mp = (mblk_t *)id; 25036 tcp_timer_t *tcpt; 25037 clock_t delta; 25038 25039 TCP_DBGSTAT(tcp_timeout_cancel_reqs); 25040 25041 if (mp == NULL) 25042 return (-1); 25043 25044 tcpt = (tcp_timer_t *)mp->b_rptr; 25045 ASSERT(tcpt->connp == connp); 25046 25047 delta = untimeout(tcpt->tcpt_tid); 25048 25049 if (delta >= 0) { 25050 TCP_DBGSTAT(tcp_timeout_canceled); 25051 tcp_timer_free(connp->conn_tcp, mp); 25052 CONN_DEC_REF(connp); 25053 } 25054 25055 return (delta); 25056 } 25057 25058 /* 25059 * Allocate space for the timer event. The allocation looks like mblk, but it is 25060 * not a proper mblk. To avoid confusion we set b_wptr to NULL. 25061 * 25062 * Dealing with failures: If we can't allocate from the timer cache we try 25063 * allocating from dblock caches using allocb_tryhard(). In this case b_wptr 25064 * points to b_rptr. 25065 * If we can't allocate anything using allocb_tryhard(), we perform a last 25066 * attempt and use kmem_alloc_tryhard(). In this case we set b_wptr to -1 and 25067 * save the actual allocation size in b_datap. 25068 */ 25069 mblk_t * 25070 tcp_timermp_alloc(int kmflags) 25071 { 25072 mblk_t *mp = (mblk_t *)kmem_cache_alloc(tcp_timercache, 25073 kmflags & ~KM_PANIC); 25074 25075 if (mp != NULL) { 25076 mp->b_next = mp->b_prev = NULL; 25077 mp->b_rptr = (uchar_t *)(&mp[1]); 25078 mp->b_wptr = NULL; 25079 mp->b_datap = NULL; 25080 mp->b_queue = NULL; 25081 } else if (kmflags & KM_PANIC) { 25082 /* 25083 * Failed to allocate memory for the timer. Try allocating from 25084 * dblock caches. 25085 */ 25086 TCP_STAT(tcp_timermp_allocfail); 25087 mp = allocb_tryhard(sizeof (tcp_timer_t)); 25088 if (mp == NULL) { 25089 size_t size = 0; 25090 /* 25091 * Memory is really low. Try tryhard allocation. 25092 */ 25093 TCP_STAT(tcp_timermp_allocdblfail); 25094 mp = kmem_alloc_tryhard(sizeof (mblk_t) + 25095 sizeof (tcp_timer_t), &size, kmflags); 25096 mp->b_rptr = (uchar_t *)(&mp[1]); 25097 mp->b_next = mp->b_prev = NULL; 25098 mp->b_wptr = (uchar_t *)-1; 25099 mp->b_datap = (dblk_t *)size; 25100 mp->b_queue = NULL; 25101 } 25102 ASSERT(mp->b_wptr != NULL); 25103 } 25104 TCP_DBGSTAT(tcp_timermp_alloced); 25105 25106 return (mp); 25107 } 25108 25109 /* 25110 * Free per-tcp timer cache. 25111 * It can only contain entries from tcp_timercache. 25112 */ 25113 void 25114 tcp_timermp_free(tcp_t *tcp) 25115 { 25116 mblk_t *mp; 25117 25118 while ((mp = tcp->tcp_timercache) != NULL) { 25119 ASSERT(mp->b_wptr == NULL); 25120 tcp->tcp_timercache = tcp->tcp_timercache->b_next; 25121 kmem_cache_free(tcp_timercache, mp); 25122 } 25123 } 25124 25125 /* 25126 * Free timer event. Put it on the per-tcp timer cache if there is not too many 25127 * events there already (currently at most two events are cached). 25128 * If the event is not allocated from the timer cache, free it right away. 25129 */ 25130 static void 25131 tcp_timer_free(tcp_t *tcp, mblk_t *mp) 25132 { 25133 mblk_t *mp1 = tcp->tcp_timercache; 25134 25135 if (mp->b_wptr != NULL) { 25136 /* 25137 * This allocation is not from a timer cache, free it right 25138 * away. 25139 */ 25140 if (mp->b_wptr != (uchar_t *)-1) 25141 freeb(mp); 25142 else 25143 kmem_free(mp, (size_t)mp->b_datap); 25144 } else if (mp1 == NULL || mp1->b_next == NULL) { 25145 /* Cache this timer block for future allocations */ 25146 mp->b_rptr = (uchar_t *)(&mp[1]); 25147 mp->b_next = mp1; 25148 tcp->tcp_timercache = mp; 25149 } else { 25150 kmem_cache_free(tcp_timercache, mp); 25151 TCP_DBGSTAT(tcp_timermp_freed); 25152 } 25153 } 25154 25155 /* 25156 * End of TCP Timers implementation. 25157 */ 25158 25159 static void 25160 tcp_setqfull(tcp_t *tcp) 25161 { 25162 queue_t *q = tcp->tcp_wq; 25163 25164 if (!(q->q_flag & QFULL)) { 25165 TCP_STAT(tcp_flwctl_on); 25166 mutex_enter(QLOCK(q)); 25167 q->q_flag |= QFULL; 25168 mutex_exit(QLOCK(q)); 25169 } 25170 } 25171 25172 static void 25173 tcp_clrqfull(tcp_t *tcp) 25174 { 25175 queue_t *q = tcp->tcp_wq; 25176 25177 if (q->q_flag & QFULL) { 25178 mutex_enter(QLOCK(q)); 25179 q->q_flag &= ~QFULL; 25180 mutex_exit(QLOCK(q)); 25181 if (q->q_flag & QWANTW) 25182 qbackenable(q, 0); 25183 } 25184 } 25185 25186 /* 25187 * TCP Kstats implementation 25188 */ 25189 static void 25190 tcp_kstat_init(void) 25191 { 25192 tcp_named_kstat_t template = { 25193 { "rtoAlgorithm", KSTAT_DATA_INT32, 0 }, 25194 { "rtoMin", KSTAT_DATA_INT32, 0 }, 25195 { "rtoMax", KSTAT_DATA_INT32, 0 }, 25196 { "maxConn", KSTAT_DATA_INT32, 0 }, 25197 { "activeOpens", KSTAT_DATA_UINT32, 0 }, 25198 { "passiveOpens", KSTAT_DATA_UINT32, 0 }, 25199 { "attemptFails", KSTAT_DATA_UINT32, 0 }, 25200 { "estabResets", KSTAT_DATA_UINT32, 0 }, 25201 { "currEstab", KSTAT_DATA_UINT32, 0 }, 25202 { "inSegs", KSTAT_DATA_UINT32, 0 }, 25203 { "outSegs", KSTAT_DATA_UINT32, 0 }, 25204 { "retransSegs", KSTAT_DATA_UINT32, 0 }, 25205 { "connTableSize", KSTAT_DATA_INT32, 0 }, 25206 { "outRsts", KSTAT_DATA_UINT32, 0 }, 25207 { "outDataSegs", KSTAT_DATA_UINT32, 0 }, 25208 { "outDataBytes", KSTAT_DATA_UINT32, 0 }, 25209 { "retransBytes", KSTAT_DATA_UINT32, 0 }, 25210 { "outAck", KSTAT_DATA_UINT32, 0 }, 25211 { "outAckDelayed", KSTAT_DATA_UINT32, 0 }, 25212 { "outUrg", KSTAT_DATA_UINT32, 0 }, 25213 { "outWinUpdate", KSTAT_DATA_UINT32, 0 }, 25214 { "outWinProbe", KSTAT_DATA_UINT32, 0 }, 25215 { "outControl", KSTAT_DATA_UINT32, 0 }, 25216 { "outFastRetrans", KSTAT_DATA_UINT32, 0 }, 25217 { "inAckSegs", KSTAT_DATA_UINT32, 0 }, 25218 { "inAckBytes", KSTAT_DATA_UINT32, 0 }, 25219 { "inDupAck", KSTAT_DATA_UINT32, 0 }, 25220 { "inAckUnsent", KSTAT_DATA_UINT32, 0 }, 25221 { "inDataInorderSegs", KSTAT_DATA_UINT32, 0 }, 25222 { "inDataInorderBytes", KSTAT_DATA_UINT32, 0 }, 25223 { "inDataUnorderSegs", KSTAT_DATA_UINT32, 0 }, 25224 { "inDataUnorderBytes", KSTAT_DATA_UINT32, 0 }, 25225 { "inDataDupSegs", KSTAT_DATA_UINT32, 0 }, 25226 { "inDataDupBytes", KSTAT_DATA_UINT32, 0 }, 25227 { "inDataPartDupSegs", KSTAT_DATA_UINT32, 0 }, 25228 { "inDataPartDupBytes", KSTAT_DATA_UINT32, 0 }, 25229 { "inDataPastWinSegs", KSTAT_DATA_UINT32, 0 }, 25230 { "inDataPastWinBytes", KSTAT_DATA_UINT32, 0 }, 25231 { "inWinProbe", KSTAT_DATA_UINT32, 0 }, 25232 { "inWinUpdate", KSTAT_DATA_UINT32, 0 }, 25233 { "inClosed", KSTAT_DATA_UINT32, 0 }, 25234 { "rttUpdate", KSTAT_DATA_UINT32, 0 }, 25235 { "rttNoUpdate", KSTAT_DATA_UINT32, 0 }, 25236 { "timRetrans", KSTAT_DATA_UINT32, 0 }, 25237 { "timRetransDrop", KSTAT_DATA_UINT32, 0 }, 25238 { "timKeepalive", KSTAT_DATA_UINT32, 0 }, 25239 { "timKeepaliveProbe", KSTAT_DATA_UINT32, 0 }, 25240 { "timKeepaliveDrop", KSTAT_DATA_UINT32, 0 }, 25241 { "listenDrop", KSTAT_DATA_UINT32, 0 }, 25242 { "listenDropQ0", KSTAT_DATA_UINT32, 0 }, 25243 { "halfOpenDrop", KSTAT_DATA_UINT32, 0 }, 25244 { "outSackRetransSegs", KSTAT_DATA_UINT32, 0 }, 25245 { "connTableSize6", KSTAT_DATA_INT32, 0 } 25246 }; 25247 25248 tcp_mibkp = kstat_create("tcp", 0, "tcp", "mib2", KSTAT_TYPE_NAMED, 25249 NUM_OF_FIELDS(tcp_named_kstat_t), 0); 25250 25251 if (tcp_mibkp == NULL) 25252 return; 25253 25254 template.rtoAlgorithm.value.ui32 = 4; 25255 template.rtoMin.value.ui32 = tcp_rexmit_interval_min; 25256 template.rtoMax.value.ui32 = tcp_rexmit_interval_max; 25257 template.maxConn.value.i32 = -1; 25258 25259 bcopy(&template, tcp_mibkp->ks_data, sizeof (template)); 25260 25261 tcp_mibkp->ks_update = tcp_kstat_update; 25262 25263 kstat_install(tcp_mibkp); 25264 } 25265 25266 static void 25267 tcp_kstat_fini(void) 25268 { 25269 25270 if (tcp_mibkp != NULL) { 25271 kstat_delete(tcp_mibkp); 25272 tcp_mibkp = NULL; 25273 } 25274 } 25275 25276 static int 25277 tcp_kstat_update(kstat_t *kp, int rw) 25278 { 25279 tcp_named_kstat_t *tcpkp; 25280 tcp_t *tcp; 25281 connf_t *connfp; 25282 conn_t *connp; 25283 int i; 25284 25285 if (!kp || !kp->ks_data) 25286 return (EIO); 25287 25288 if (rw == KSTAT_WRITE) 25289 return (EACCES); 25290 25291 tcpkp = (tcp_named_kstat_t *)kp->ks_data; 25292 25293 tcpkp->currEstab.value.ui32 = 0; 25294 25295 for (i = 0; i < CONN_G_HASH_SIZE; i++) { 25296 connfp = &ipcl_globalhash_fanout[i]; 25297 connp = NULL; 25298 while ((connp = tcp_get_next_conn(connfp, connp))) { 25299 tcp = connp->conn_tcp; 25300 switch (tcp_snmp_state(tcp)) { 25301 case MIB2_TCP_established: 25302 case MIB2_TCP_closeWait: 25303 tcpkp->currEstab.value.ui32++; 25304 break; 25305 } 25306 } 25307 } 25308 25309 tcpkp->activeOpens.value.ui32 = tcp_mib.tcpActiveOpens; 25310 tcpkp->passiveOpens.value.ui32 = tcp_mib.tcpPassiveOpens; 25311 tcpkp->attemptFails.value.ui32 = tcp_mib.tcpAttemptFails; 25312 tcpkp->estabResets.value.ui32 = tcp_mib.tcpEstabResets; 25313 tcpkp->inSegs.value.ui32 = tcp_mib.tcpInSegs; 25314 tcpkp->outSegs.value.ui32 = tcp_mib.tcpOutSegs; 25315 tcpkp->retransSegs.value.ui32 = tcp_mib.tcpRetransSegs; 25316 tcpkp->connTableSize.value.i32 = tcp_mib.tcpConnTableSize; 25317 tcpkp->outRsts.value.ui32 = tcp_mib.tcpOutRsts; 25318 tcpkp->outDataSegs.value.ui32 = tcp_mib.tcpOutDataSegs; 25319 tcpkp->outDataBytes.value.ui32 = tcp_mib.tcpOutDataBytes; 25320 tcpkp->retransBytes.value.ui32 = tcp_mib.tcpRetransBytes; 25321 tcpkp->outAck.value.ui32 = tcp_mib.tcpOutAck; 25322 tcpkp->outAckDelayed.value.ui32 = tcp_mib.tcpOutAckDelayed; 25323 tcpkp->outUrg.value.ui32 = tcp_mib.tcpOutUrg; 25324 tcpkp->outWinUpdate.value.ui32 = tcp_mib.tcpOutWinUpdate; 25325 tcpkp->outWinProbe.value.ui32 = tcp_mib.tcpOutWinProbe; 25326 tcpkp->outControl.value.ui32 = tcp_mib.tcpOutControl; 25327 tcpkp->outFastRetrans.value.ui32 = tcp_mib.tcpOutFastRetrans; 25328 tcpkp->inAckSegs.value.ui32 = tcp_mib.tcpInAckSegs; 25329 tcpkp->inAckBytes.value.ui32 = tcp_mib.tcpInAckBytes; 25330 tcpkp->inDupAck.value.ui32 = tcp_mib.tcpInDupAck; 25331 tcpkp->inAckUnsent.value.ui32 = tcp_mib.tcpInAckUnsent; 25332 tcpkp->inDataInorderSegs.value.ui32 = tcp_mib.tcpInDataInorderSegs; 25333 tcpkp->inDataInorderBytes.value.ui32 = tcp_mib.tcpInDataInorderBytes; 25334 tcpkp->inDataUnorderSegs.value.ui32 = tcp_mib.tcpInDataUnorderSegs; 25335 tcpkp->inDataUnorderBytes.value.ui32 = tcp_mib.tcpInDataUnorderBytes; 25336 tcpkp->inDataDupSegs.value.ui32 = tcp_mib.tcpInDataDupSegs; 25337 tcpkp->inDataDupBytes.value.ui32 = tcp_mib.tcpInDataDupBytes; 25338 tcpkp->inDataPartDupSegs.value.ui32 = tcp_mib.tcpInDataPartDupSegs; 25339 tcpkp->inDataPartDupBytes.value.ui32 = tcp_mib.tcpInDataPartDupBytes; 25340 tcpkp->inDataPastWinSegs.value.ui32 = tcp_mib.tcpInDataPastWinSegs; 25341 tcpkp->inDataPastWinBytes.value.ui32 = tcp_mib.tcpInDataPastWinBytes; 25342 tcpkp->inWinProbe.value.ui32 = tcp_mib.tcpInWinProbe; 25343 tcpkp->inWinUpdate.value.ui32 = tcp_mib.tcpInWinUpdate; 25344 tcpkp->inClosed.value.ui32 = tcp_mib.tcpInClosed; 25345 tcpkp->rttNoUpdate.value.ui32 = tcp_mib.tcpRttNoUpdate; 25346 tcpkp->rttUpdate.value.ui32 = tcp_mib.tcpRttUpdate; 25347 tcpkp->timRetrans.value.ui32 = tcp_mib.tcpTimRetrans; 25348 tcpkp->timRetransDrop.value.ui32 = tcp_mib.tcpTimRetransDrop; 25349 tcpkp->timKeepalive.value.ui32 = tcp_mib.tcpTimKeepalive; 25350 tcpkp->timKeepaliveProbe.value.ui32 = tcp_mib.tcpTimKeepaliveProbe; 25351 tcpkp->timKeepaliveDrop.value.ui32 = tcp_mib.tcpTimKeepaliveDrop; 25352 tcpkp->listenDrop.value.ui32 = tcp_mib.tcpListenDrop; 25353 tcpkp->listenDropQ0.value.ui32 = tcp_mib.tcpListenDropQ0; 25354 tcpkp->halfOpenDrop.value.ui32 = tcp_mib.tcpHalfOpenDrop; 25355 tcpkp->outSackRetransSegs.value.ui32 = tcp_mib.tcpOutSackRetransSegs; 25356 tcpkp->connTableSize6.value.i32 = tcp_mib.tcp6ConnTableSize; 25357 25358 return (0); 25359 } 25360 25361 void 25362 tcp_reinput(conn_t *connp, mblk_t *mp, squeue_t *sqp) 25363 { 25364 uint16_t hdr_len; 25365 ipha_t *ipha; 25366 uint8_t *nexthdrp; 25367 tcph_t *tcph; 25368 25369 /* Already has an eager */ 25370 if ((mp->b_datap->db_struioflag & STRUIO_EAGER) != 0) { 25371 TCP_STAT(tcp_reinput_syn); 25372 squeue_enter(connp->conn_sqp, mp, connp->conn_recv, 25373 connp, SQTAG_TCP_REINPUT_EAGER); 25374 return; 25375 } 25376 25377 switch (IPH_HDR_VERSION(mp->b_rptr)) { 25378 case IPV4_VERSION: 25379 ipha = (ipha_t *)mp->b_rptr; 25380 hdr_len = IPH_HDR_LENGTH(ipha); 25381 break; 25382 case IPV6_VERSION: 25383 if (!ip_hdr_length_nexthdr_v6(mp, (ip6_t *)mp->b_rptr, 25384 &hdr_len, &nexthdrp)) { 25385 CONN_DEC_REF(connp); 25386 freemsg(mp); 25387 return; 25388 } 25389 break; 25390 } 25391 25392 tcph = (tcph_t *)&mp->b_rptr[hdr_len]; 25393 if ((tcph->th_flags[0] & (TH_SYN|TH_ACK|TH_RST|TH_URG)) == TH_SYN) { 25394 mp->b_datap->db_struioflag |= STRUIO_EAGER; 25395 mp->b_datap->db_cksumstart = (intptr_t)sqp; 25396 } 25397 25398 squeue_fill(connp->conn_sqp, mp, connp->conn_recv, connp, 25399 SQTAG_TCP_REINPUT); 25400 } 25401 25402 static squeue_func_t 25403 tcp_squeue_switch(int val) 25404 { 25405 squeue_func_t rval = squeue_fill; 25406 25407 switch (val) { 25408 case 1: 25409 rval = squeue_enter_nodrain; 25410 break; 25411 case 2: 25412 rval = squeue_enter; 25413 break; 25414 default: 25415 break; 25416 } 25417 return (rval); 25418 } 25419 25420 static void 25421 tcp_squeue_add(squeue_t *sqp) 25422 { 25423 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 25424 sizeof (tcp_squeue_priv_t), KM_SLEEP); 25425 25426 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 25427 tcp_time_wait->tcp_time_wait_tid = timeout(tcp_time_wait_collector, 25428 sqp, TCP_TIME_WAIT_DELAY); 25429 } 25430