1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright (c) 2013, 2017 by Delphix. All rights reserved.
26 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
27 * Copyright 2020 Joyent, Inc.
28 * Copyright 2022 Oxide Computer Company
29 */
30 /* Copyright (c) 1990 Mentat Inc. */
31
32 #include <sys/types.h>
33 #include <sys/stream.h>
34 #include <sys/strsun.h>
35 #include <sys/strsubr.h>
36 #include <sys/stropts.h>
37 #include <sys/strlog.h>
38 #define _SUN_TPI_VERSION 2
39 #include <sys/tihdr.h>
40 #include <sys/timod.h>
41 #include <sys/ddi.h>
42 #include <sys/sunddi.h>
43 #include <sys/suntpi.h>
44 #include <sys/xti_inet.h>
45 #include <sys/cmn_err.h>
46 #include <sys/debug.h>
47 #include <sys/sdt.h>
48 #include <sys/vtrace.h>
49 #include <sys/kmem.h>
50 #include <sys/ethernet.h>
51 #include <sys/cpuvar.h>
52 #include <sys/dlpi.h>
53 #include <sys/pattr.h>
54 #include <sys/policy.h>
55 #include <sys/priv.h>
56 #include <sys/zone.h>
57 #include <sys/sunldi.h>
58
59 #include <sys/errno.h>
60 #include <sys/signal.h>
61 #include <sys/socket.h>
62 #include <sys/socketvar.h>
63 #include <sys/sockio.h>
64 #include <sys/isa_defs.h>
65 #include <sys/md5.h>
66 #include <sys/random.h>
67 #include <sys/uio.h>
68 #include <sys/systm.h>
69 #include <netinet/in.h>
70 #include <netinet/tcp.h>
71 #include <netinet/ip6.h>
72 #include <netinet/icmp6.h>
73 #include <net/if.h>
74 #include <net/route.h>
75 #include <inet/ipsec_impl.h>
76
77 #include <inet/common.h>
78 #include <inet/cc.h>
79 #include <inet/ip.h>
80 #include <inet/ip_impl.h>
81 #include <inet/ip6.h>
82 #include <inet/ip_ndp.h>
83 #include <inet/proto_set.h>
84 #include <inet/mib2.h>
85 #include <inet/optcom.h>
86 #include <inet/snmpcom.h>
87 #include <inet/kstatcom.h>
88 #include <inet/tcp.h>
89 #include <inet/tcp_impl.h>
90 #include <inet/tcp_cluster.h>
91 #include <inet/udp_impl.h>
92 #include <net/pfkeyv2.h>
93 #include <inet/ipdrop.h>
94
95 #include <inet/ipclassifier.h>
96 #include <inet/ip_ire.h>
97 #include <inet/ip_ftable.h>
98 #include <inet/ip_if.h>
99 #include <inet/ipp_common.h>
100 #include <inet/ip_rts.h>
101 #include <inet/ip_netinfo.h>
102 #include <sys/squeue_impl.h>
103 #include <sys/squeue.h>
104 #include <sys/tsol/label.h>
105 #include <sys/tsol/tnet.h>
106 #include <rpc/pmap_prot.h>
107 #include <sys/callo.h>
108
109 /*
110 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)
111 *
112 * (Read the detailed design doc in PSARC case directory)
113 *
114 * The entire tcp state is contained in tcp_t and conn_t structure
115 * which are allocated in tandem using ipcl_conn_create() and passing
116 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect
117 * the references on the tcp_t. The tcp_t structure is never compressed
118 * and packets always land on the correct TCP perimeter from the time
119 * eager is created till the time tcp_t dies (as such the old mentat
120 * TCP global queue is not used for detached state and no IPSEC checking
121 * is required). The global queue is still allocated to send out resets
122 * for connection which have no listeners and IP directly calls
123 * tcp_xmit_listeners_reset() which does any policy check.
124 *
125 * Protection and Synchronisation mechanism:
126 *
127 * The tcp data structure does not use any kind of lock for protecting
128 * its state but instead uses 'squeues' for mutual exclusion from various
129 * read and write side threads. To access a tcp member, the thread should
130 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS,
131 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller
132 * can pass any tcp function having prototype of edesc_t as argument
133 * (different from traditional STREAMs model where packets come in only
134 * designated entry points). The list of functions that can be directly
135 * called via squeue are listed before the usual function prototype.
136 *
137 * Referencing:
138 *
139 * TCP is MT-Hot and we use a reference based scheme to make sure that the
140 * tcp structure doesn't disappear when its needed. When the application
141 * creates an outgoing connection or accepts an incoming connection, we
142 * start out with 2 references on 'conn_ref'. One for TCP and one for IP.
143 * The IP reference is just a symbolic reference since ip_tcpclose()
144 * looks at tcp structure after tcp_close_output() returns which could
145 * have dropped the last TCP reference. So as long as the connection is
146 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the
147 * conn_t. The classifier puts its own reference when the connection is
148 * inserted in listen or connected hash. Anytime a thread needs to enter
149 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr
150 * on write side or by doing a classify on read side and then puts a
151 * reference on the conn before doing squeue_enter/tryenter/fill. For
152 * read side, the classifier itself puts the reference under fanout lock
153 * to make sure that tcp can't disappear before it gets processed. The
154 * squeue will drop this reference automatically so the called function
155 * doesn't have to do a DEC_REF.
156 *
157 * Opening a new connection:
158 *
159 * The outgoing connection open is pretty simple. tcp_open() does the
160 * work in creating the conn/tcp structure and initializing it. The
161 * squeue assignment is done based on the CPU the application
162 * is running on. So for outbound connections, processing is always done
163 * on application CPU which might be different from the incoming CPU
164 * being interrupted by the NIC. An optimal way would be to figure out
165 * the NIC <-> CPU binding at listen time, and assign the outgoing
166 * connection to the squeue attached to the CPU that will be interrupted
167 * for incoming packets (we know the NIC based on the bind IP address).
168 * This might seem like a problem if more data is going out but the
169 * fact is that in most cases the transmit is ACK driven transmit where
170 * the outgoing data normally sits on TCP's xmit queue waiting to be
171 * transmitted.
172 *
173 * Accepting a connection:
174 *
175 * This is a more interesting case because of various races involved in
176 * establishing a eager in its own perimeter. Read the meta comment on
177 * top of tcp_input_listener(). But briefly, the squeue is picked by
178 * ip_fanout based on the ring or the sender (if loopback).
179 *
180 * Closing a connection:
181 *
182 * The close is fairly straight forward. tcp_close() calls tcp_close_output()
183 * via squeue to do the close and mark the tcp as detached if the connection
184 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its
185 * reference but tcp_close() drop IP's reference always. So if tcp was
186 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP
187 * and 1 because it is in classifier's connected hash. This is the condition
188 * we use to determine that its OK to clean up the tcp outside of squeue
189 * when time wait expires (check the ref under fanout and conn_lock and
190 * if it is 2, remove it from fanout hash and kill it).
191 *
192 * Although close just drops the necessary references and marks the
193 * tcp_detached state, tcp_close needs to know the tcp_detached has been
194 * set (under squeue) before letting the STREAM go away (because a
195 * inbound packet might attempt to go up the STREAM while the close
196 * has happened and tcp_detached is not set). So a special lock and
197 * flag is used along with a condition variable (tcp_closelock, tcp_closed,
198 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked
199 * tcp_detached.
200 *
201 * Special provisions and fast paths:
202 *
203 * We make special provisions for sockfs by marking tcp_issocket
204 * whenever we have only sockfs on top of TCP. This allows us to skip
205 * putting the tcp in acceptor hash since a sockfs listener can never
206 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM
207 * since eager has already been allocated and the accept now happens
208 * on acceptor STREAM. There is a big blob of comment on top of
209 * tcp_input_listener explaining the new accept. When socket is POP'd,
210 * sockfs sends us an ioctl to mark the fact and we go back to old
211 * behaviour. Once tcp_issocket is unset, its never set for the
212 * life of that connection.
213 *
214 * IPsec notes :
215 *
216 * Since a packet is always executed on the correct TCP perimeter
217 * all IPsec processing is defered to IP including checking new
218 * connections and setting IPSEC policies for new connection. The
219 * only exception is tcp_xmit_listeners_reset() which is called
220 * directly from IP and needs to policy check to see if TH_RST
221 * can be sent out.
222 */
223
224 /*
225 * Values for squeue switch:
226 * 1: SQ_NODRAIN
227 * 2: SQ_PROCESS
228 * 3: SQ_FILL
229 */
230 int tcp_squeue_wput = 2; /* /etc/systems */
231 int tcp_squeue_flag;
232
233 /*
234 * To prevent memory hog, limit the number of entries in tcp_free_list
235 * to 1% of available memory / number of cpus
236 */
237 uint_t tcp_free_list_max_cnt = 0;
238
239 #define TIDUSZ 4096 /* transport interface data unit size */
240
241 /*
242 * Size of acceptor hash list. It has to be a power of 2 for hashing.
243 */
244 #define TCP_ACCEPTOR_FANOUT_SIZE 512
245
246 #ifdef _ILP32
247 #define TCP_ACCEPTOR_HASH(accid) \
248 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
249 #else
250 #define TCP_ACCEPTOR_HASH(accid) \
251 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
252 #endif /* _ILP32 */
253
254 /*
255 * Minimum number of connections which can be created per listener. Used
256 * when the listener connection count is in effect.
257 */
258 static uint32_t tcp_min_conn_listener = 2;
259
260 uint32_t tcp_early_abort = 30;
261
262 /* TCP Timer control structure */
263 typedef struct tcpt_s {
264 pfv_t tcpt_pfv; /* The routine we are to call */
265 tcp_t *tcpt_tcp; /* The parameter we are to pass in */
266 } tcpt_t;
267
268 /*
269 * Functions called directly via squeue having a prototype of edesc_t.
270 */
271 void tcp_input_data(void *arg, mblk_t *mp, void *arg2,
272 ip_recv_attr_t *ira);
273 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2,
274 ip_recv_attr_t *dummy);
275
276
277 /* Prototype for TCP functions */
278 static void tcp_random_init(void);
279 int tcp_random(void);
280 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp,
281 in_port_t dstport, uint_t srcid);
282 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp,
283 in_port_t dstport, uint32_t flowinfo,
284 uint_t srcid, uint32_t scope_id);
285 static void tcp_iss_init(tcp_t *tcp);
286 static void tcp_reinit(tcp_t *tcp);
287 static void tcp_reinit_values(tcp_t *tcp);
288
289 static int tcp_wsrv(queue_t *q);
290 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa);
291 static void tcp_update_zcopy(tcp_t *tcp);
292 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t,
293 ixa_notify_arg_t);
294 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns);
295 static void tcp_stack_fini(netstackid_t stackid, void *arg);
296
297 static int tcp_squeue_switch(int);
298
299 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t);
300 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *);
301 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *);
302
303 static void tcp_squeue_add(squeue_t *);
304
305 struct module_info tcp_rinfo = {
306 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER
307 };
308
309 static struct module_info tcp_winfo = {
310 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16
311 };
312
313 /*
314 * Entry points for TCP as a device. The normal case which supports
315 * the TCP functionality.
316 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices.
317 */
318 struct qinit tcp_rinitv4 = {
319 NULL, tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo
320 };
321
322 struct qinit tcp_rinitv6 = {
323 NULL, tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo
324 };
325
326 struct qinit tcp_winit = {
327 tcp_wput, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
328 };
329
330 /* Initial entry point for TCP in socket mode. */
331 struct qinit tcp_sock_winit = {
332 tcp_wput_sock, tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
333 };
334
335 /* TCP entry point during fallback */
336 struct qinit tcp_fallback_sock_winit = {
337 tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo
338 };
339
340 /*
341 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing
342 * an accept. Avoid allocating data structures since eager has already
343 * been created.
344 */
345 struct qinit tcp_acceptor_rinit = {
346 NULL, tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo
347 };
348
349 struct qinit tcp_acceptor_winit = {
350 tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo
351 };
352
353 /* For AF_INET aka /dev/tcp */
354 struct streamtab tcpinfov4 = {
355 &tcp_rinitv4, &tcp_winit
356 };
357
358 /* For AF_INET6 aka /dev/tcp6 */
359 struct streamtab tcpinfov6 = {
360 &tcp_rinitv6, &tcp_winit
361 };
362
363 /*
364 * Following assumes TPI alignment requirements stay along 32 bit
365 * boundaries
366 */
367 #define ROUNDUP32(x) \
368 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1))
369
370 /* Template for response to info request. */
371 struct T_info_ack tcp_g_t_info_ack = {
372 T_INFO_ACK, /* PRIM_type */
373 0, /* TSDU_size */
374 T_INFINITE, /* ETSDU_size */
375 T_INVALID, /* CDATA_size */
376 T_INVALID, /* DDATA_size */
377 sizeof (sin_t), /* ADDR_size */
378 0, /* OPT_size - not initialized here */
379 TIDUSZ, /* TIDU_size */
380 T_COTS_ORD, /* SERV_type */
381 TCPS_IDLE, /* CURRENT_state */
382 (XPG4_1|EXPINLINE) /* PROVIDER_flag */
383 };
384
385 struct T_info_ack tcp_g_t_info_ack_v6 = {
386 T_INFO_ACK, /* PRIM_type */
387 0, /* TSDU_size */
388 T_INFINITE, /* ETSDU_size */
389 T_INVALID, /* CDATA_size */
390 T_INVALID, /* DDATA_size */
391 sizeof (sin6_t), /* ADDR_size */
392 0, /* OPT_size - not initialized here */
393 TIDUSZ, /* TIDU_size */
394 T_COTS_ORD, /* SERV_type */
395 TCPS_IDLE, /* CURRENT_state */
396 (XPG4_1|EXPINLINE) /* PROVIDER_flag */
397 };
398
399 /*
400 * TCP tunables related declarations. Definitions are in tcp_tunables.c
401 */
402 extern mod_prop_info_t tcp_propinfo_tbl[];
403 extern int tcp_propinfo_count;
404
405 #define IS_VMLOANED_MBLK(mp) \
406 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0)
407
408 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */
409
410 /*
411 * Forces all connections to obey the value of the tcps_maxpsz_multiplier
412 * tunable settable via NDD. Otherwise, the per-connection behavior is
413 * determined dynamically during tcp_set_destination(), which is the default.
414 */
415 boolean_t tcp_static_maxpsz = B_FALSE;
416
417 /*
418 * If the receive buffer size is changed, this function is called to update
419 * the upper socket layer on the new delayed receive wake up threshold.
420 */
421 static void
tcp_set_recv_threshold(tcp_t * tcp,uint32_t new_rcvthresh)422 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh)
423 {
424 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3;
425
426 if (IPCL_IS_NONSTR(tcp->tcp_connp)) {
427 conn_t *connp = tcp->tcp_connp;
428 struct sock_proto_props sopp;
429
430 /*
431 * only increase rcvthresh upto default_threshold
432 */
433 if (new_rcvthresh > default_threshold)
434 new_rcvthresh = default_threshold;
435
436 sopp.sopp_flags = SOCKOPT_RCVTHRESH;
437 sopp.sopp_rcvthresh = new_rcvthresh;
438
439 (*connp->conn_upcalls->su_set_proto_props)
440 (connp->conn_upper_handle, &sopp);
441 }
442 }
443
444 /*
445 * Figure out the value of window scale opton. Note that the rwnd is
446 * ASSUMED to be rounded up to the nearest MSS before the calculation.
447 * We cannot find the scale value and then do a round up of tcp_rwnd
448 * because the scale value may not be correct after that.
449 *
450 * Set the compiler flag to make this function inline.
451 */
452 void
tcp_set_ws_value(tcp_t * tcp)453 tcp_set_ws_value(tcp_t *tcp)
454 {
455 int i;
456 uint32_t rwnd = tcp->tcp_rwnd;
457
458 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT;
459 i++, rwnd >>= 1)
460 ;
461 tcp->tcp_rcv_ws = i;
462 }
463
464 /*
465 * Remove cached/latched IPsec references.
466 */
467 void
tcp_ipsec_cleanup(tcp_t * tcp)468 tcp_ipsec_cleanup(tcp_t *tcp)
469 {
470 conn_t *connp = tcp->tcp_connp;
471
472 ASSERT(connp->conn_flags & IPCL_TCPCONN);
473
474 if (connp->conn_latch != NULL) {
475 IPLATCH_REFRELE(connp->conn_latch);
476 connp->conn_latch = NULL;
477 }
478 if (connp->conn_latch_in_policy != NULL) {
479 IPPOL_REFRELE(connp->conn_latch_in_policy);
480 connp->conn_latch_in_policy = NULL;
481 }
482 if (connp->conn_latch_in_action != NULL) {
483 IPACT_REFRELE(connp->conn_latch_in_action);
484 connp->conn_latch_in_action = NULL;
485 }
486 if (connp->conn_policy != NULL) {
487 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
488 connp->conn_policy = NULL;
489 }
490 }
491
492 /*
493 * Cleaup before placing on free list.
494 * Disassociate from the netstack/tcp_stack_t since the freelist
495 * is per squeue and not per netstack.
496 */
497 void
tcp_cleanup(tcp_t * tcp)498 tcp_cleanup(tcp_t *tcp)
499 {
500 mblk_t *mp;
501 conn_t *connp = tcp->tcp_connp;
502 tcp_stack_t *tcps = tcp->tcp_tcps;
503 netstack_t *ns = tcps->tcps_netstack;
504 mblk_t *tcp_rsrv_mp;
505
506 tcp_bind_hash_remove(tcp);
507
508 /* Cleanup that which needs the netstack first */
509 tcp_ipsec_cleanup(tcp);
510 ixa_cleanup(connp->conn_ixa);
511
512 if (connp->conn_ht_iphc != NULL) {
513 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
514 connp->conn_ht_iphc = NULL;
515 connp->conn_ht_iphc_allocated = 0;
516 connp->conn_ht_iphc_len = 0;
517 connp->conn_ht_ulp = NULL;
518 connp->conn_ht_ulp_len = 0;
519 tcp->tcp_ipha = NULL;
520 tcp->tcp_ip6h = NULL;
521 tcp->tcp_tcpha = NULL;
522 }
523
524 /* We clear any IP_OPTIONS and extension headers */
525 ip_pkt_free(&connp->conn_xmit_ipp);
526
527 tcp_free(tcp);
528
529 /*
530 * Since we will bzero the entire structure, we need to
531 * remove it and reinsert it in global hash list. We
532 * know the walkers can't get to this conn because we
533 * had set CONDEMNED flag earlier and checked reference
534 * under conn_lock so walker won't pick it and when we
535 * go the ipcl_globalhash_remove() below, no walker
536 * can get to it.
537 */
538 ipcl_globalhash_remove(connp);
539
540 /* Save some state */
541 mp = tcp->tcp_timercache;
542
543 tcp_rsrv_mp = tcp->tcp_rsrv_mp;
544
545 if (connp->conn_cred != NULL) {
546 crfree(connp->conn_cred);
547 connp->conn_cred = NULL;
548 }
549 ipcl_conn_cleanup(connp);
550 connp->conn_flags = IPCL_TCPCONN;
551
552 /*
553 * Now it is safe to decrement the reference counts.
554 * This might be the last reference on the netstack
555 * in which case it will cause the freeing of the IP Instance.
556 */
557 connp->conn_netstack = NULL;
558 connp->conn_ixa->ixa_ipst = NULL;
559 netstack_rele(ns);
560 ASSERT(tcps != NULL);
561 tcp->tcp_tcps = NULL;
562
563 bzero(tcp, sizeof (tcp_t));
564
565 /* restore the state */
566 tcp->tcp_timercache = mp;
567
568 tcp->tcp_rsrv_mp = tcp_rsrv_mp;
569
570 tcp->tcp_connp = connp;
571
572 ASSERT(connp->conn_tcp == tcp);
573 ASSERT(connp->conn_flags & IPCL_TCPCONN);
574 connp->conn_state_flags = CONN_INCIPIENT;
575 ASSERT(connp->conn_proto == IPPROTO_TCP);
576 ASSERT(connp->conn_ref == 1);
577 }
578
579 /*
580 * Adapt to the information, such as rtt and rtt_sd, provided from the
581 * DCE and IRE maintained by IP.
582 *
583 * Checks for multicast and broadcast destination address.
584 * Returns zero if ok; an errno on failure.
585 *
586 * Note that the MSS calculation here is based on the info given in
587 * the DCE and IRE. We do not do any calculation based on TCP options. They
588 * will be handled in tcp_input_data() when TCP knows which options to use.
589 *
590 * Note on how TCP gets its parameters for a connection.
591 *
592 * When a tcp_t structure is allocated, it gets all the default parameters.
593 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd,
594 * spipe, rpipe, ... from the route metrics. Route metric overrides the
595 * default.
596 *
597 * An incoming SYN with a multicast or broadcast destination address is dropped
598 * in ip_fanout_v4/v6.
599 *
600 * An incoming SYN with a multicast or broadcast source address is always
601 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in
602 * conn_connect.
603 * The same logic in tcp_set_destination also serves to
604 * reject an attempt to connect to a broadcast or multicast (destination)
605 * address.
606 */
607 int
tcp_set_destination(tcp_t * tcp)608 tcp_set_destination(tcp_t *tcp)
609 {
610 uint32_t mss_max;
611 uint32_t mss;
612 boolean_t tcp_detached = TCP_IS_DETACHED(tcp);
613 conn_t *connp = tcp->tcp_connp;
614 tcp_stack_t *tcps = tcp->tcp_tcps;
615 iulp_t uinfo;
616 int error;
617 uint32_t flags;
618
619 flags = IPDF_LSO | IPDF_ZCOPY;
620 /*
621 * Make sure we have a dce for the destination to avoid dce_ident
622 * contention for connected sockets.
623 */
624 flags |= IPDF_UNIQUE_DCE;
625
626 if (!tcps->tcps_ignore_path_mtu)
627 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
628
629 /* Use conn_lock to satify ASSERT; tcp is already serialized */
630 mutex_enter(&connp->conn_lock);
631 error = conn_connect(connp, &uinfo, flags);
632 mutex_exit(&connp->conn_lock);
633 if (error != 0)
634 return (error);
635
636 error = tcp_build_hdrs(tcp);
637 if (error != 0)
638 return (error);
639
640 tcp->tcp_localnet = uinfo.iulp_localnet;
641
642 if (uinfo.iulp_rtt != 0) {
643 tcp->tcp_rtt_sa = MSEC2NSEC(uinfo.iulp_rtt);
644 tcp->tcp_rtt_sd = MSEC2NSEC(uinfo.iulp_rtt_sd);
645 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0);
646 }
647 if (uinfo.iulp_ssthresh != 0)
648 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh;
649 else
650 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
651 if (uinfo.iulp_spipe > 0) {
652 connp->conn_sndbuf = MIN(uinfo.iulp_spipe,
653 tcps->tcps_max_buf);
654 if (tcps->tcps_snd_lowat_fraction != 0) {
655 connp->conn_sndlowat = connp->conn_sndbuf /
656 tcps->tcps_snd_lowat_fraction;
657 }
658 (void) tcp_maxpsz_set(tcp, B_TRUE);
659 }
660 /*
661 * Note that up till now, acceptor always inherits receive
662 * window from the listener. But if there is a metrics
663 * associated with a host, we should use that instead of
664 * inheriting it from listener. Thus we need to pass this
665 * info back to the caller.
666 */
667 if (uinfo.iulp_rpipe > 0) {
668 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe,
669 tcps->tcps_max_buf);
670 }
671
672 if (uinfo.iulp_rtomax > 0) {
673 tcp->tcp_second_timer_threshold =
674 uinfo.iulp_rtomax;
675 }
676
677 /*
678 * Use the metric option settings, iulp_tstamp_ok and
679 * iulp_wscale_ok, only for active open. What this means
680 * is that if the other side uses timestamp or window
681 * scale option, TCP will also use those options. That
682 * is for passive open. If the application sets a
683 * large window, window scale is enabled regardless of
684 * the value in iulp_wscale_ok. This is the behavior
685 * since 2.6. So we keep it.
686 * The only case left in passive open processing is the
687 * check for SACK.
688 * For ECN, it should probably be like SACK. But the
689 * current value is binary, so we treat it like the other
690 * cases. The metric only controls active open.For passive
691 * open, the ndd param, tcp_ecn_permitted, controls the
692 * behavior.
693 */
694 if (!tcp_detached) {
695 /*
696 * The if check means that the following can only
697 * be turned on by the metrics only IRE, but not off.
698 */
699 if (uinfo.iulp_tstamp_ok)
700 tcp->tcp_snd_ts_ok = B_TRUE;
701 if (uinfo.iulp_wscale_ok)
702 tcp->tcp_snd_ws_ok = B_TRUE;
703 if (uinfo.iulp_sack == 2)
704 tcp->tcp_snd_sack_ok = B_TRUE;
705 if (uinfo.iulp_ecn_ok)
706 tcp->tcp_ecn_ok = B_TRUE;
707 } else {
708 /*
709 * Passive open.
710 *
711 * As above, the if check means that SACK can only be
712 * turned on by the metric only IRE.
713 */
714 if (uinfo.iulp_sack > 0) {
715 tcp->tcp_snd_sack_ok = B_TRUE;
716 }
717 }
718
719 /*
720 * XXX Note that currently, iulp_mtu can be as small as 68
721 * because of PMTUd. So tcp_mss may go to negative if combined
722 * length of all those options exceeds 28 bytes. But because
723 * of the tcp_mss_min check below, we may not have a problem if
724 * tcp_mss_min is of a reasonable value. The default is 1 so
725 * the negative problem still exists. And the check defeats PMTUd.
726 * In fact, if PMTUd finds that the MSS should be smaller than
727 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min
728 * value.
729 *
730 * We do not deal with that now. All those problems related to
731 * PMTUd will be fixed later.
732 */
733 ASSERT(uinfo.iulp_mtu != 0);
734 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu;
735
736 /* Sanity check for MSS value. */
737 if (connp->conn_ipversion == IPV4_VERSION)
738 mss_max = tcps->tcps_mss_max_ipv4;
739 else
740 mss_max = tcps->tcps_mss_max_ipv6;
741
742 if (tcp->tcp_ipsec_overhead == 0)
743 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp);
744
745 mss -= tcp->tcp_ipsec_overhead;
746
747 if (mss < tcps->tcps_mss_min)
748 mss = tcps->tcps_mss_min;
749 if (mss > mss_max)
750 mss = mss_max;
751
752 /* Note that this is the maximum MSS, excluding all options. */
753 tcp->tcp_mss = mss;
754
755 /*
756 * Update the tcp connection with LSO capability.
757 */
758 tcp_update_lso(tcp, connp->conn_ixa);
759
760 /*
761 * Initialize the ISS here now that we have the full connection ID.
762 * The RFC 1948 method of initial sequence number generation requires
763 * knowledge of the full connection ID before setting the ISS.
764 */
765 tcp_iss_init(tcp);
766
767 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local);
768
769 /*
770 * Make sure that conn is not marked incipient
771 * for incoming connections. A blind
772 * removal of incipient flag is cheaper than
773 * check and removal.
774 */
775 mutex_enter(&connp->conn_lock);
776 connp->conn_state_flags &= ~CONN_INCIPIENT;
777 mutex_exit(&connp->conn_lock);
778 return (0);
779 }
780
781 /*
782 * tcp_clean_death / tcp_close_detached must not be called more than once
783 * on a tcp. Thus every function that potentially calls tcp_clean_death
784 * must check for the tcp state before calling tcp_clean_death.
785 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper,
786 * tcp_timer_handler, all check for the tcp state.
787 */
788 /* ARGSUSED */
789 void
tcp_clean_death_wrapper(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)790 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2,
791 ip_recv_attr_t *dummy)
792 {
793 tcp_t *tcp = ((conn_t *)arg)->conn_tcp;
794
795 freemsg(mp);
796 if (tcp->tcp_state > TCPS_BOUND)
797 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT);
798 }
799
800 /*
801 * We are dying for some reason. Try to do it gracefully. (May be called
802 * as writer.)
803 *
804 * Return -1 if the structure was not cleaned up (if the cleanup had to be
805 * done by a service procedure).
806 * TBD - Should the return value distinguish between the tcp_t being
807 * freed and it being reinitialized?
808 */
809 int
tcp_clean_death(tcp_t * tcp,int err)810 tcp_clean_death(tcp_t *tcp, int err)
811 {
812 mblk_t *mp;
813 queue_t *q;
814 conn_t *connp = tcp->tcp_connp;
815 tcp_stack_t *tcps = tcp->tcp_tcps;
816
817 if (tcp->tcp_fused)
818 tcp_unfuse(tcp);
819
820 if (tcp->tcp_linger_tid != 0 &&
821 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
822 tcp_stop_lingering(tcp);
823 }
824
825 ASSERT(tcp != NULL);
826 ASSERT((connp->conn_family == AF_INET &&
827 connp->conn_ipversion == IPV4_VERSION) ||
828 (connp->conn_family == AF_INET6 &&
829 (connp->conn_ipversion == IPV4_VERSION ||
830 connp->conn_ipversion == IPV6_VERSION)));
831
832 if (TCP_IS_DETACHED(tcp)) {
833 if (tcp->tcp_hard_binding) {
834 /*
835 * Its an eager that we are dealing with. We close the
836 * eager but in case a conn_ind has already gone to the
837 * listener, let tcp_accept_finish() send a discon_ind
838 * to the listener and drop the last reference. If the
839 * listener doesn't even know about the eager i.e. the
840 * conn_ind hasn't gone up, blow away the eager and drop
841 * the last reference as well. If the conn_ind has gone
842 * up, state should be BOUND. tcp_accept_finish
843 * will figure out that the connection has received a
844 * RST and will send a DISCON_IND to the application.
845 */
846 tcp_closei_local(tcp);
847 if (!tcp->tcp_tconnind_started) {
848 CONN_DEC_REF(connp);
849 } else {
850 tcp->tcp_state = TCPS_BOUND;
851 DTRACE_TCP6(state__change, void, NULL,
852 ip_xmit_attr_t *, connp->conn_ixa,
853 void, NULL, tcp_t *, tcp, void, NULL,
854 int32_t, TCPS_CLOSED);
855 }
856 } else {
857 tcp_close_detached(tcp);
858 }
859 return (0);
860 }
861
862 TCP_STAT(tcps, tcp_clean_death_nondetached);
863
864 /*
865 * The connection is dead. Decrement listener connection counter if
866 * necessary.
867 */
868 if (tcp->tcp_listen_cnt != NULL)
869 TCP_DECR_LISTEN_CNT(tcp);
870
871 /*
872 * When a connection is moved to TIME_WAIT state, the connection
873 * counter is already decremented. So no need to decrement here
874 * again. See SET_TIME_WAIT() macro.
875 */
876 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
877 tcp->tcp_state < TCPS_TIME_WAIT) {
878 TCPS_CONN_DEC(tcps);
879 }
880
881 q = connp->conn_rq;
882
883 /* Trash all inbound data */
884 if (!IPCL_IS_NONSTR(connp)) {
885 ASSERT(q != NULL);
886 flushq(q, FLUSHALL);
887 }
888
889 /*
890 * If we are at least part way open and there is error
891 * (err==0 implies no error)
892 * notify our client by a T_DISCON_IND.
893 */
894 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) {
895 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
896 !TCP_IS_SOCKET(tcp)) {
897 /*
898 * Send M_FLUSH according to TPI. Because sockets will
899 * (and must) ignore FLUSHR we do that only for TPI
900 * endpoints and sockets in STREAMS mode.
901 */
902 (void) putnextctl1(q, M_FLUSH, FLUSHR);
903 }
904 if (connp->conn_debug) {
905 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
906 "tcp_clean_death: discon err %d", err);
907 }
908 if (IPCL_IS_NONSTR(connp)) {
909 /* Direct socket, use upcall */
910 (*connp->conn_upcalls->su_disconnected)(
911 connp->conn_upper_handle, tcp->tcp_connid, err);
912 } else {
913 mp = mi_tpi_discon_ind(NULL, err, 0);
914 if (mp != NULL) {
915 putnext(q, mp);
916 } else {
917 if (connp->conn_debug) {
918 (void) strlog(TCP_MOD_ID, 0, 1,
919 SL_ERROR|SL_TRACE,
920 "tcp_clean_death, sending M_ERROR");
921 }
922 (void) putnextctl1(q, M_ERROR, EPROTO);
923 }
924 }
925 if (tcp->tcp_state <= TCPS_SYN_RCVD) {
926 /* SYN_SENT or SYN_RCVD */
927 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
928 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) {
929 /* ESTABLISHED or CLOSE_WAIT */
930 TCPS_BUMP_MIB(tcps, tcpEstabResets);
931 }
932 }
933
934 /*
935 * ESTABLISHED non-STREAMS eagers are not 'detached' because
936 * an upper handle is obtained when the SYN-ACK comes in. So it
937 * should receive the 'disconnected' upcall, but tcp_reinit should
938 * not be called since this is an eager.
939 */
940 if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) {
941 tcp_closei_local(tcp);
942 tcp->tcp_state = TCPS_BOUND;
943 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
944 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
945 int32_t, TCPS_CLOSED);
946 return (0);
947 }
948
949 tcp_reinit(tcp);
950 if (IPCL_IS_NONSTR(connp))
951 (void) tcp_do_unbind(connp);
952
953 return (-1);
954 }
955
956 /*
957 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout
958 * to expire, stop the wait and finish the close.
959 */
960 void
tcp_stop_lingering(tcp_t * tcp)961 tcp_stop_lingering(tcp_t *tcp)
962 {
963 clock_t delta = 0;
964 tcp_stack_t *tcps = tcp->tcp_tcps;
965 conn_t *connp = tcp->tcp_connp;
966
967 tcp->tcp_linger_tid = 0;
968 if (tcp->tcp_state > TCPS_LISTEN) {
969 tcp_acceptor_hash_remove(tcp);
970 mutex_enter(&tcp->tcp_non_sq_lock);
971 if (tcp->tcp_flow_stopped) {
972 tcp_clrqfull(tcp);
973 }
974 mutex_exit(&tcp->tcp_non_sq_lock);
975
976 if (tcp->tcp_timer_tid != 0) {
977 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
978 tcp->tcp_timer_tid = 0;
979 }
980 /*
981 * Need to cancel those timers which will not be used when
982 * TCP is detached. This has to be done before the conn_wq
983 * is cleared.
984 */
985 tcp_timers_stop(tcp);
986
987 tcp->tcp_detached = B_TRUE;
988 connp->conn_rq = NULL;
989 connp->conn_wq = NULL;
990
991 if (tcp->tcp_state == TCPS_TIME_WAIT) {
992 tcp_time_wait_append(tcp);
993 TCP_DBGSTAT(tcps, tcp_detach_time_wait);
994 goto finish;
995 }
996
997 /*
998 * If delta is zero the timer event wasn't executed and was
999 * successfully canceled. In this case we need to restart it
1000 * with the minimal delta possible.
1001 */
1002 if (delta >= 0) {
1003 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
1004 delta ? delta : 1);
1005 }
1006 } else {
1007 tcp_closei_local(tcp);
1008 CONN_DEC_REF(connp);
1009 }
1010 finish:
1011 tcp->tcp_detached = B_TRUE;
1012 connp->conn_rq = NULL;
1013 connp->conn_wq = NULL;
1014
1015 /* Signal closing thread that it can complete close */
1016 mutex_enter(&tcp->tcp_closelock);
1017 tcp->tcp_closed = 1;
1018 cv_signal(&tcp->tcp_closecv);
1019 mutex_exit(&tcp->tcp_closelock);
1020
1021 /* If we have an upper handle (socket), release it */
1022 if (IPCL_IS_NONSTR(connp)) {
1023 sock_upcalls_t *upcalls = connp->conn_upcalls;
1024 sock_upper_handle_t handle = connp->conn_upper_handle;
1025
1026 ASSERT(upcalls != NULL);
1027 ASSERT(upcalls->su_closed != NULL);
1028 ASSERT(handle != NULL);
1029 /*
1030 * Set these to NULL first because closed() will free upper
1031 * structures. Acquire conn_lock because an external caller
1032 * like conn_get_socket_info() will upcall if these are
1033 * non-NULL.
1034 */
1035 mutex_enter(&connp->conn_lock);
1036 connp->conn_upper_handle = NULL;
1037 connp->conn_upcalls = NULL;
1038 mutex_exit(&connp->conn_lock);
1039 upcalls->su_closed(handle);
1040 }
1041 }
1042
1043 void
tcp_close_common(conn_t * connp,int flags)1044 tcp_close_common(conn_t *connp, int flags)
1045 {
1046 tcp_t *tcp = connp->conn_tcp;
1047 mblk_t *mp = &tcp->tcp_closemp;
1048 boolean_t conn_ioctl_cleanup_reqd = B_FALSE;
1049 mblk_t *bp;
1050
1051 ASSERT(connp->conn_ref >= 2);
1052
1053 /*
1054 * Mark the conn as closing. ipsq_pending_mp_add will not
1055 * add any mp to the pending mp list, after this conn has
1056 * started closing.
1057 */
1058 mutex_enter(&connp->conn_lock);
1059 connp->conn_state_flags |= CONN_CLOSING;
1060 if (connp->conn_oper_pending_ill != NULL)
1061 conn_ioctl_cleanup_reqd = B_TRUE;
1062 CONN_INC_REF_LOCKED(connp);
1063 mutex_exit(&connp->conn_lock);
1064 tcp->tcp_closeflags = (uint8_t)flags;
1065 ASSERT(connp->conn_ref >= 3);
1066
1067 /*
1068 * tcp_closemp_used is used below without any protection of a lock
1069 * as we don't expect any one else to use it concurrently at this
1070 * point otherwise it would be a major defect.
1071 */
1072
1073 if (mp->b_prev == NULL)
1074 tcp->tcp_closemp_used = B_TRUE;
1075 else
1076 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: "
1077 "connp %p tcp %p\n", (void *)connp, (void *)tcp);
1078
1079 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15);
1080
1081 /*
1082 * Cleanup any queued ioctls here. This must be done before the wq/rq
1083 * are re-written by tcp_close_output().
1084 */
1085 if (conn_ioctl_cleanup_reqd)
1086 conn_ioctl_cleanup(connp);
1087
1088 /*
1089 * As CONN_CLOSING is set, no further ioctls should be passed down to
1090 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and
1091 * tcp_wput_iocdata). If the ioctl was queued on an ipsq,
1092 * conn_ioctl_cleanup should have found it and removed it. If the ioctl
1093 * was still in flight at the time, we wait for it here. See comments
1094 * for CONN_INC_IOCTLREF in ip.h for details.
1095 */
1096 mutex_enter(&connp->conn_lock);
1097 while (connp->conn_ioctlref > 0)
1098 cv_wait(&connp->conn_cv, &connp->conn_lock);
1099 ASSERT(connp->conn_ioctlref == 0);
1100 ASSERT(connp->conn_oper_pending_ill == NULL);
1101 mutex_exit(&connp->conn_lock);
1102
1103 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp,
1104 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1105
1106 /*
1107 * For non-STREAMS sockets, the normal case is that the conn makes
1108 * an upcall when it's finally closed, so there is no need to wait
1109 * in the protocol. But in case of SO_LINGER the thread sleeps here
1110 * so it can properly deal with the thread being interrupted.
1111 */
1112 if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0)
1113 goto nowait;
1114
1115 mutex_enter(&tcp->tcp_closelock);
1116 while (!tcp->tcp_closed) {
1117 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) {
1118 /*
1119 * The cv_wait_sig() was interrupted. We now do the
1120 * following:
1121 *
1122 * 1) If the endpoint was lingering, we allow this
1123 * to be interrupted by cancelling the linger timeout
1124 * and closing normally.
1125 *
1126 * 2) Revert to calling cv_wait()
1127 *
1128 * We revert to using cv_wait() to avoid an
1129 * infinite loop which can occur if the calling
1130 * thread is higher priority than the squeue worker
1131 * thread and is bound to the same cpu.
1132 */
1133 if (connp->conn_linger && connp->conn_lingertime > 0) {
1134 mutex_exit(&tcp->tcp_closelock);
1135 /* Entering squeue, bump ref count. */
1136 CONN_INC_REF(connp);
1137 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL);
1138 SQUEUE_ENTER_ONE(connp->conn_sqp, bp,
1139 tcp_linger_interrupted, connp, NULL,
1140 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1141 mutex_enter(&tcp->tcp_closelock);
1142 }
1143 break;
1144 }
1145 }
1146 while (!tcp->tcp_closed)
1147 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock);
1148 mutex_exit(&tcp->tcp_closelock);
1149
1150 /*
1151 * In the case of listener streams that have eagers in the q or q0
1152 * we wait for the eagers to drop their reference to us. conn_rq and
1153 * conn_wq of the eagers point to our queues. By waiting for the
1154 * refcnt to drop to 1, we are sure that the eagers have cleaned
1155 * up their queue pointers and also dropped their references to us.
1156 *
1157 * For non-STREAMS sockets we do not have to wait here; the
1158 * listener will instead make a su_closed upcall when the last
1159 * reference is dropped.
1160 */
1161 if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) {
1162 mutex_enter(&connp->conn_lock);
1163 while (connp->conn_ref != 1) {
1164 cv_wait(&connp->conn_cv, &connp->conn_lock);
1165 }
1166 mutex_exit(&connp->conn_lock);
1167 }
1168
1169 nowait:
1170 connp->conn_cpid = NOPID;
1171 }
1172
1173 /*
1174 * Called by tcp_close() routine via squeue when lingering is
1175 * interrupted by a signal.
1176 */
1177
1178 /* ARGSUSED */
1179 static void
tcp_linger_interrupted(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)1180 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1181 {
1182 conn_t *connp = (conn_t *)arg;
1183 tcp_t *tcp = connp->conn_tcp;
1184
1185 freeb(mp);
1186 if (tcp->tcp_linger_tid != 0 &&
1187 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
1188 tcp_stop_lingering(tcp);
1189 tcp->tcp_client_errno = EINTR;
1190 }
1191 }
1192
1193 /*
1194 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp.
1195 * Some stream heads get upset if they see these later on as anything but NULL.
1196 */
1197 void
tcp_close_mpp(mblk_t ** mpp)1198 tcp_close_mpp(mblk_t **mpp)
1199 {
1200 mblk_t *mp;
1201
1202 if ((mp = *mpp) != NULL) {
1203 do {
1204 mp->b_next = NULL;
1205 mp->b_prev = NULL;
1206 } while ((mp = mp->b_cont) != NULL);
1207
1208 mp = *mpp;
1209 *mpp = NULL;
1210 freemsg(mp);
1211 }
1212 }
1213
1214 /* Do detached close. */
1215 void
tcp_close_detached(tcp_t * tcp)1216 tcp_close_detached(tcp_t *tcp)
1217 {
1218 if (tcp->tcp_fused)
1219 tcp_unfuse(tcp);
1220
1221 /*
1222 * Clustering code serializes TCP disconnect callbacks and
1223 * cluster tcp list walks by blocking a TCP disconnect callback
1224 * if a cluster tcp list walk is in progress. This ensures
1225 * accurate accounting of TCPs in the cluster code even though
1226 * the TCP list walk itself is not atomic.
1227 */
1228 tcp_closei_local(tcp);
1229 CONN_DEC_REF(tcp->tcp_connp);
1230 }
1231
1232 /*
1233 * The tcp_t is going away. Remove it from all lists and set it
1234 * to TCPS_CLOSED. The freeing up of memory is deferred until
1235 * tcp_inactive. This is needed since a thread in tcp_rput might have
1236 * done a CONN_INC_REF on this structure before it was removed from the
1237 * hashes.
1238 */
1239 void
tcp_closei_local(tcp_t * tcp)1240 tcp_closei_local(tcp_t *tcp)
1241 {
1242 conn_t *connp = tcp->tcp_connp;
1243 tcp_stack_t *tcps = tcp->tcp_tcps;
1244 int32_t oldstate;
1245
1246 if (!TCP_IS_SOCKET(tcp))
1247 tcp_acceptor_hash_remove(tcp);
1248
1249 /*
1250 * This can be called via tcp_time_wait_processing() if TCP gets a
1251 * SYN with sequence number outside the TIME-WAIT connection's
1252 * window. So we need to check for TIME-WAIT state here as the
1253 * connection counter is already decremented. See SET_TIME_WAIT()
1254 * macro
1255 */
1256 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
1257 tcp->tcp_state < TCPS_TIME_WAIT) {
1258 TCPS_CONN_DEC(tcps);
1259 }
1260
1261 /*
1262 * If we are an eager connection hanging off a listener that
1263 * hasn't formally accepted the connection yet, get off its
1264 * list and blow off any data that we have accumulated.
1265 */
1266 if (tcp->tcp_listener != NULL) {
1267 tcp_t *listener = tcp->tcp_listener;
1268 mutex_enter(&listener->tcp_eager_lock);
1269 /*
1270 * tcp_tconnind_started == B_TRUE means that the
1271 * conn_ind has already gone to listener. At
1272 * this point, eager will be closed but we
1273 * leave it in listeners eager list so that
1274 * if listener decides to close without doing
1275 * accept, we can clean this up. In tcp_tli_accept
1276 * we take care of the case of accept on closed
1277 * eager.
1278 */
1279 if (!tcp->tcp_tconnind_started) {
1280 tcp_eager_unlink(tcp);
1281 mutex_exit(&listener->tcp_eager_lock);
1282 /*
1283 * We don't want to have any pointers to the
1284 * listener queue, after we have released our
1285 * reference on the listener
1286 */
1287 ASSERT(tcp->tcp_detached);
1288 connp->conn_rq = NULL;
1289 connp->conn_wq = NULL;
1290 CONN_DEC_REF(listener->tcp_connp);
1291 } else {
1292 mutex_exit(&listener->tcp_eager_lock);
1293 }
1294 }
1295
1296 /* Stop all the timers */
1297 tcp_timers_stop(tcp);
1298
1299 if (tcp->tcp_state == TCPS_LISTEN) {
1300 if (tcp->tcp_ip_addr_cache) {
1301 kmem_free((void *)tcp->tcp_ip_addr_cache,
1302 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
1303 tcp->tcp_ip_addr_cache = NULL;
1304 }
1305 }
1306
1307 /* Decrement listerner connection counter if necessary. */
1308 if (tcp->tcp_listen_cnt != NULL)
1309 TCP_DECR_LISTEN_CNT(tcp);
1310
1311 mutex_enter(&tcp->tcp_non_sq_lock);
1312 if (tcp->tcp_flow_stopped)
1313 tcp_clrqfull(tcp);
1314 mutex_exit(&tcp->tcp_non_sq_lock);
1315
1316 tcp_bind_hash_remove(tcp);
1317 /*
1318 * If the tcp_time_wait_collector (which runs outside the squeue)
1319 * is trying to remove this tcp from the time wait list, we will
1320 * block in tcp_time_wait_remove while trying to acquire the
1321 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also
1322 * requires the ipcl_hash_remove to be ordered after the
1323 * tcp_time_wait_remove for the refcnt checks to work correctly.
1324 */
1325 if (tcp->tcp_state == TCPS_TIME_WAIT)
1326 (void) tcp_time_wait_remove(tcp, NULL);
1327 CL_INET_DISCONNECT(connp);
1328 ipcl_hash_remove(connp);
1329 oldstate = tcp->tcp_state;
1330 tcp->tcp_state = TCPS_CLOSED;
1331 /* Need to probe before ixa_cleanup() is called */
1332 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1333 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
1334 int32_t, oldstate);
1335 ixa_cleanup(connp->conn_ixa);
1336
1337 /*
1338 * Mark the conn as CONDEMNED
1339 */
1340 mutex_enter(&connp->conn_lock);
1341 connp->conn_state_flags |= CONN_CONDEMNED;
1342 mutex_exit(&connp->conn_lock);
1343
1344 ASSERT(tcp->tcp_time_wait_next == NULL);
1345 ASSERT(tcp->tcp_time_wait_prev == NULL);
1346 ASSERT(tcp->tcp_time_wait_expire == 0);
1347
1348 tcp_ipsec_cleanup(tcp);
1349 }
1350
1351 /*
1352 * tcp is dying (called from ipcl_conn_destroy and error cases).
1353 * Free the tcp_t in either case.
1354 */
1355 void
tcp_free(tcp_t * tcp)1356 tcp_free(tcp_t *tcp)
1357 {
1358 mblk_t *mp;
1359 conn_t *connp = tcp->tcp_connp;
1360
1361 ASSERT(tcp != NULL);
1362 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL);
1363
1364 connp->conn_rq = NULL;
1365 connp->conn_wq = NULL;
1366
1367 tcp_close_mpp(&tcp->tcp_xmit_head);
1368 tcp_close_mpp(&tcp->tcp_reass_head);
1369 if (tcp->tcp_rcv_list != NULL) {
1370 /* Free b_next chain */
1371 tcp_close_mpp(&tcp->tcp_rcv_list);
1372 }
1373 if ((mp = tcp->tcp_urp_mp) != NULL) {
1374 freemsg(mp);
1375 }
1376 if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1377 freemsg(mp);
1378 }
1379
1380 if (tcp->tcp_fused_sigurg_mp != NULL) {
1381 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1382 freeb(tcp->tcp_fused_sigurg_mp);
1383 tcp->tcp_fused_sigurg_mp = NULL;
1384 }
1385
1386 if (tcp->tcp_ordrel_mp != NULL) {
1387 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1388 freeb(tcp->tcp_ordrel_mp);
1389 tcp->tcp_ordrel_mp = NULL;
1390 }
1391
1392 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
1393 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
1394
1395 if (tcp->tcp_hopopts != NULL) {
1396 mi_free(tcp->tcp_hopopts);
1397 tcp->tcp_hopopts = NULL;
1398 tcp->tcp_hopoptslen = 0;
1399 }
1400 ASSERT(tcp->tcp_hopoptslen == 0);
1401 if (tcp->tcp_dstopts != NULL) {
1402 mi_free(tcp->tcp_dstopts);
1403 tcp->tcp_dstopts = NULL;
1404 tcp->tcp_dstoptslen = 0;
1405 }
1406 ASSERT(tcp->tcp_dstoptslen == 0);
1407 if (tcp->tcp_rthdrdstopts != NULL) {
1408 mi_free(tcp->tcp_rthdrdstopts);
1409 tcp->tcp_rthdrdstopts = NULL;
1410 tcp->tcp_rthdrdstoptslen = 0;
1411 }
1412 ASSERT(tcp->tcp_rthdrdstoptslen == 0);
1413 if (tcp->tcp_rthdr != NULL) {
1414 mi_free(tcp->tcp_rthdr);
1415 tcp->tcp_rthdr = NULL;
1416 tcp->tcp_rthdrlen = 0;
1417 }
1418 ASSERT(tcp->tcp_rthdrlen == 0);
1419
1420 /*
1421 * Following is really a blowing away a union.
1422 * It happens to have exactly two members of identical size
1423 * the following code is enough.
1424 */
1425 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1426
1427 /* Allow the CC algorithm to clean up after itself. */
1428 if (tcp->tcp_cc_algo != NULL && tcp->tcp_cc_algo->cb_destroy != NULL)
1429 tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv);
1430
1431 /*
1432 * If this is a non-STREAM socket still holding on to an upper
1433 * handle, release it. As a result of fallback we might also see
1434 * STREAMS based conns with upper handles, in which case there is
1435 * nothing to do other than clearing the field.
1436 */
1437 if (connp->conn_upper_handle != NULL) {
1438 sock_upcalls_t *upcalls = connp->conn_upcalls;
1439 sock_upper_handle_t handle = connp->conn_upper_handle;
1440
1441 /*
1442 * Set these to NULL first because closed() will free upper
1443 * structures. Acquire conn_lock because an external caller
1444 * like conn_get_socket_info() will upcall if these are
1445 * non-NULL.
1446 */
1447 mutex_enter(&connp->conn_lock);
1448 connp->conn_upper_handle = NULL;
1449 connp->conn_upcalls = NULL;
1450 mutex_exit(&connp->conn_lock);
1451 if (IPCL_IS_NONSTR(connp)) {
1452 ASSERT(upcalls != NULL);
1453 ASSERT(upcalls->su_closed != NULL);
1454 ASSERT(handle != NULL);
1455 upcalls->su_closed(handle);
1456 tcp->tcp_detached = B_TRUE;
1457 }
1458 }
1459 }
1460
1461 /*
1462 * tcp_get_conn/tcp_free_conn
1463 *
1464 * tcp_get_conn is used to get a clean tcp connection structure.
1465 * It tries to reuse the connections put on the freelist by the
1466 * time_wait_collector failing which it goes to kmem_cache. This
1467 * way has two benefits compared to just allocating from and
1468 * freeing to kmem_cache.
1469 * 1) The time_wait_collector can free (which includes the cleanup)
1470 * outside the squeue. So when the interrupt comes, we have a clean
1471 * connection sitting in the freelist. Obviously, this buys us
1472 * performance.
1473 *
1474 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener
1475 * has multiple disadvantages - tying up the squeue during alloc.
1476 * But allocating the conn/tcp in IP land is also not the best since
1477 * we can't check the 'q' and 'q0' which are protected by squeue and
1478 * blindly allocate memory which might have to be freed here if we are
1479 * not allowed to accept the connection. By using the freelist and
1480 * putting the conn/tcp back in freelist, we don't pay a penalty for
1481 * allocating memory without checking 'q/q0' and freeing it if we can't
1482 * accept the connection.
1483 *
1484 * Care should be taken to put the conn back in the same squeue's freelist
1485 * from which it was allocated. Best results are obtained if conn is
1486 * allocated from listener's squeue and freed to the same. Time wait
1487 * collector will free up the freelist is the connection ends up sitting
1488 * there for too long.
1489 */
1490 conn_t *
tcp_get_conn(void * arg,tcp_stack_t * tcps)1491 tcp_get_conn(void *arg, tcp_stack_t *tcps)
1492 {
1493 tcp_t *tcp = NULL;
1494 conn_t *connp = NULL;
1495 squeue_t *sqp = (squeue_t *)arg;
1496 tcp_squeue_priv_t *tcp_time_wait;
1497 netstack_t *ns;
1498 mblk_t *tcp_rsrv_mp = NULL;
1499
1500 tcp_time_wait =
1501 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
1502
1503 mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1504 tcp = tcp_time_wait->tcp_free_list;
1505 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0));
1506 if (tcp != NULL) {
1507 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
1508 tcp_time_wait->tcp_free_list_cnt--;
1509 mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1510 tcp->tcp_time_wait_next = NULL;
1511 connp = tcp->tcp_connp;
1512 connp->conn_flags |= IPCL_REUSED;
1513
1514 ASSERT(tcp->tcp_tcps == NULL);
1515 ASSERT(connp->conn_netstack == NULL);
1516 ASSERT(tcp->tcp_rsrv_mp != NULL);
1517 ns = tcps->tcps_netstack;
1518 netstack_hold(ns);
1519 connp->conn_netstack = ns;
1520 connp->conn_ixa->ixa_ipst = ns->netstack_ip;
1521 tcp->tcp_tcps = tcps;
1522 ipcl_globalhash_insert(connp);
1523
1524 connp->conn_ixa->ixa_notify_cookie = tcp;
1525 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify);
1526 connp->conn_recv = tcp_input_data;
1527 ASSERT(connp->conn_recvicmp == tcp_icmp_input);
1528 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp);
1529 return (connp);
1530 }
1531 mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1532 /*
1533 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until
1534 * this conn_t/tcp_t is freed at ipcl_conn_destroy().
1535 */
1536 tcp_rsrv_mp = allocb(0, BPRI_HI);
1537 if (tcp_rsrv_mp == NULL)
1538 return (NULL);
1539
1540 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP,
1541 tcps->tcps_netstack)) == NULL) {
1542 freeb(tcp_rsrv_mp);
1543 return (NULL);
1544 }
1545
1546 tcp = connp->conn_tcp;
1547 tcp->tcp_rsrv_mp = tcp_rsrv_mp;
1548 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL);
1549
1550 tcp->tcp_tcps = tcps;
1551
1552 connp->conn_recv = tcp_input_data;
1553 connp->conn_recvicmp = tcp_icmp_input;
1554 connp->conn_verifyicmp = tcp_verifyicmp;
1555
1556 /*
1557 * Register tcp_notify to listen to capability changes detected by IP.
1558 * This upcall is made in the context of the call to conn_ip_output
1559 * thus it is inside the squeue.
1560 */
1561 connp->conn_ixa->ixa_notify = tcp_notify;
1562 connp->conn_ixa->ixa_notify_cookie = tcp;
1563
1564 return (connp);
1565 }
1566
1567 /*
1568 * Handle connect to IPv4 destinations, including connections for AF_INET6
1569 * sockets connecting to IPv4 mapped IPv6 destinations.
1570 * Returns zero if OK, a positive errno, or a negative TLI error.
1571 */
1572 static int
tcp_connect_ipv4(tcp_t * tcp,ipaddr_t * dstaddrp,in_port_t dstport,uint_t srcid)1573 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport,
1574 uint_t srcid)
1575 {
1576 ipaddr_t dstaddr = *dstaddrp;
1577 uint16_t lport;
1578 conn_t *connp = tcp->tcp_connp;
1579 tcp_stack_t *tcps = tcp->tcp_tcps;
1580 int error;
1581
1582 ASSERT(connp->conn_ipversion == IPV4_VERSION);
1583
1584 /* Check for attempt to connect to INADDR_ANY */
1585 if (dstaddr == INADDR_ANY) {
1586 /*
1587 * SunOS 4.x and 4.3 BSD allow an application
1588 * to connect a TCP socket to INADDR_ANY.
1589 * When they do this, the kernel picks the
1590 * address of one interface and uses it
1591 * instead. The kernel usually ends up
1592 * picking the address of the loopback
1593 * interface. This is an undocumented feature.
1594 * However, we provide the same thing here
1595 * in order to have source and binary
1596 * compatibility with SunOS 4.x.
1597 * Update the T_CONN_REQ (sin/sin6) since it is used to
1598 * generate the T_CONN_CON.
1599 */
1600 dstaddr = htonl(INADDR_LOOPBACK);
1601 *dstaddrp = dstaddr;
1602 }
1603
1604 /* Handle __sin6_src_id if socket not bound to an IP address */
1605 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) {
1606 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1607 IPCL_ZONEID(connp), B_TRUE, tcps->tcps_netstack)) {
1608 /* Mismatch - conn_laddr_v6 would be v6 address. */
1609 return (EADDRNOTAVAIL);
1610 }
1611 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1612 }
1613
1614 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6);
1615 connp->conn_fport = dstport;
1616
1617 /*
1618 * At this point the remote destination address and remote port fields
1619 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1620 * have to see which state tcp was in so we can take appropriate action.
1621 */
1622 if (tcp->tcp_state == TCPS_IDLE) {
1623 /*
1624 * We support a quick connect capability here, allowing
1625 * clients to transition directly from IDLE to SYN_SENT
1626 * tcp_bindi will pick an unused port, insert the connection
1627 * in the bind hash and transition to BOUND state.
1628 */
1629 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1630 tcp, B_TRUE);
1631 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1632 B_FALSE, B_FALSE);
1633 if (lport == 0)
1634 return (-TNOADDR);
1635 }
1636
1637 /*
1638 * Lookup the route to determine a source address and the uinfo.
1639 * Setup TCP parameters based on the metrics/DCE.
1640 */
1641 error = tcp_set_destination(tcp);
1642 if (error != 0)
1643 return (error);
1644
1645 /*
1646 * Don't let an endpoint connect to itself.
1647 */
1648 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 &&
1649 connp->conn_fport == connp->conn_lport)
1650 return (-TBADADDR);
1651
1652 tcp->tcp_state = TCPS_SYN_SENT;
1653
1654 return (ipcl_conn_insert_v4(connp));
1655 }
1656
1657 /*
1658 * Handle connect to IPv6 destinations.
1659 * Returns zero if OK, a positive errno, or a negative TLI error.
1660 */
1661 static int
tcp_connect_ipv6(tcp_t * tcp,in6_addr_t * dstaddrp,in_port_t dstport,uint32_t flowinfo,uint_t srcid,uint32_t scope_id)1662 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport,
1663 uint32_t flowinfo, uint_t srcid, uint32_t scope_id)
1664 {
1665 uint16_t lport;
1666 conn_t *connp = tcp->tcp_connp;
1667 tcp_stack_t *tcps = tcp->tcp_tcps;
1668 int error;
1669
1670 ASSERT(connp->conn_family == AF_INET6);
1671
1672 /*
1673 * If we're here, it means that the destination address is a native
1674 * IPv6 address. Return an error if conn_ipversion is not IPv6. A
1675 * reason why it might not be IPv6 is if the socket was bound to an
1676 * IPv4-mapped IPv6 address.
1677 */
1678 if (connp->conn_ipversion != IPV6_VERSION)
1679 return (-TBADADDR);
1680
1681 /*
1682 * Interpret a zero destination to mean loopback.
1683 * Update the T_CONN_REQ (sin/sin6) since it is used to
1684 * generate the T_CONN_CON.
1685 */
1686 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp))
1687 *dstaddrp = ipv6_loopback;
1688
1689 /* Handle __sin6_src_id if socket not bound to an IP address */
1690 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1691 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1692 IPCL_ZONEID(connp), B_FALSE, tcps->tcps_netstack)) {
1693 /* Mismatch - conn_laddr_v6 would be v4-mapped. */
1694 return (EADDRNOTAVAIL);
1695 }
1696 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1697 }
1698
1699 /*
1700 * Take care of the scope_id now.
1701 */
1702 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) {
1703 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1704 connp->conn_ixa->ixa_scopeid = scope_id;
1705 } else {
1706 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
1707 }
1708
1709 connp->conn_flowinfo = flowinfo;
1710 connp->conn_faddr_v6 = *dstaddrp;
1711 connp->conn_fport = dstport;
1712
1713 /*
1714 * At this point the remote destination address and remote port fields
1715 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1716 * have to see which state tcp was in so we can take appropriate action.
1717 */
1718 if (tcp->tcp_state == TCPS_IDLE) {
1719 /*
1720 * We support a quick connect capability here, allowing
1721 * clients to transition directly from IDLE to SYN_SENT
1722 * tcp_bindi will pick an unused port, insert the connection
1723 * in the bind hash and transition to BOUND state.
1724 */
1725 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1726 tcp, B_TRUE);
1727 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1728 B_FALSE, B_FALSE);
1729 if (lport == 0)
1730 return (-TNOADDR);
1731 }
1732
1733 /*
1734 * Lookup the route to determine a source address and the uinfo.
1735 * Setup TCP parameters based on the metrics/DCE.
1736 */
1737 error = tcp_set_destination(tcp);
1738 if (error != 0)
1739 return (error);
1740
1741 /*
1742 * Don't let an endpoint connect to itself.
1743 */
1744 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) &&
1745 connp->conn_fport == connp->conn_lport)
1746 return (-TBADADDR);
1747
1748 tcp->tcp_state = TCPS_SYN_SENT;
1749
1750 return (ipcl_conn_insert_v6(connp));
1751 }
1752
1753 /*
1754 * Disconnect
1755 * Note that unlike other functions this returns a positive tli error
1756 * when it fails; it never returns an errno.
1757 */
1758 static int
tcp_disconnect_common(tcp_t * tcp,t_scalar_t seqnum)1759 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum)
1760 {
1761 conn_t *lconnp;
1762 tcp_stack_t *tcps = tcp->tcp_tcps;
1763 conn_t *connp = tcp->tcp_connp;
1764
1765 /*
1766 * Right now, upper modules pass down a T_DISCON_REQ to TCP,
1767 * when the stream is in BOUND state. Do not send a reset,
1768 * since the destination IP address is not valid, and it can
1769 * be the initialized value of all zeros (broadcast address).
1770 */
1771 if (tcp->tcp_state <= TCPS_BOUND) {
1772 if (connp->conn_debug) {
1773 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
1774 "tcp_disconnect: bad state, %d", tcp->tcp_state);
1775 }
1776 return (TOUTSTATE);
1777 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1778 TCPS_CONN_DEC(tcps);
1779 }
1780
1781 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) {
1782
1783 /*
1784 * According to TPI, for non-listeners, ignore seqnum
1785 * and disconnect.
1786 * Following interpretation of -1 seqnum is historical
1787 * and implied TPI ? (TPI only states that for T_CONN_IND,
1788 * a valid seqnum should not be -1).
1789 *
1790 * -1 means disconnect everything
1791 * regardless even on a listener.
1792 */
1793
1794 int old_state = tcp->tcp_state;
1795 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1796
1797 /*
1798 * The connection can't be on the tcp_time_wait_head list
1799 * since it is not detached.
1800 */
1801 ASSERT(tcp->tcp_time_wait_next == NULL);
1802 ASSERT(tcp->tcp_time_wait_prev == NULL);
1803 ASSERT(tcp->tcp_time_wait_expire == 0);
1804 /*
1805 * If it used to be a listener, check to make sure no one else
1806 * has taken the port before switching back to LISTEN state.
1807 */
1808 if (connp->conn_ipversion == IPV4_VERSION) {
1809 lconnp = ipcl_lookup_listener_v4(connp->conn_lport,
1810 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst);
1811 } else {
1812 uint_t ifindex = 0;
1813
1814 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)
1815 ifindex = connp->conn_ixa->ixa_scopeid;
1816
1817 /* Allow conn_bound_if listeners? */
1818 lconnp = ipcl_lookup_listener_v6(connp->conn_lport,
1819 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp),
1820 ipst);
1821 }
1822 if (tcp->tcp_conn_req_max && lconnp == NULL) {
1823 tcp->tcp_state = TCPS_LISTEN;
1824 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1825 connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1826 NULL, int32_t, old_state);
1827 } else if (old_state > TCPS_BOUND) {
1828 tcp->tcp_conn_req_max = 0;
1829 tcp->tcp_state = TCPS_BOUND;
1830 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1831 connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1832 NULL, int32_t, old_state);
1833
1834 /*
1835 * If this end point is not going to become a listener,
1836 * decrement the listener connection count if
1837 * necessary. Note that we do not do this if it is
1838 * going to be a listner (the above if case) since
1839 * then it may remove the counter struct.
1840 */
1841 if (tcp->tcp_listen_cnt != NULL)
1842 TCP_DECR_LISTEN_CNT(tcp);
1843 }
1844 if (lconnp != NULL)
1845 CONN_DEC_REF(lconnp);
1846 switch (old_state) {
1847 case TCPS_SYN_SENT:
1848 case TCPS_SYN_RCVD:
1849 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1850 break;
1851 case TCPS_ESTABLISHED:
1852 case TCPS_CLOSE_WAIT:
1853 TCPS_BUMP_MIB(tcps, tcpEstabResets);
1854 break;
1855 }
1856
1857 if (tcp->tcp_fused)
1858 tcp_unfuse(tcp);
1859
1860 mutex_enter(&tcp->tcp_eager_lock);
1861 if ((tcp->tcp_conn_req_cnt_q0 != 0) ||
1862 (tcp->tcp_conn_req_cnt_q != 0)) {
1863 tcp_eager_cleanup(tcp, 0);
1864 }
1865 mutex_exit(&tcp->tcp_eager_lock);
1866
1867 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt,
1868 tcp->tcp_rnxt, TH_RST | TH_ACK);
1869
1870 tcp_reinit(tcp);
1871
1872 return (0);
1873 } else if (!tcp_eager_blowoff(tcp, seqnum)) {
1874 return (TBADSEQ);
1875 }
1876 return (0);
1877 }
1878
1879 /*
1880 * Our client hereby directs us to reject the connection request
1881 * that tcp_input_listener() marked with 'seqnum'. Rejection consists
1882 * of sending the appropriate RST, not an ICMP error.
1883 */
1884 void
tcp_disconnect(tcp_t * tcp,mblk_t * mp)1885 tcp_disconnect(tcp_t *tcp, mblk_t *mp)
1886 {
1887 t_scalar_t seqnum;
1888 int error;
1889 conn_t *connp = tcp->tcp_connp;
1890
1891 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
1892 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) {
1893 tcp_err_ack(tcp, mp, TPROTO, 0);
1894 return;
1895 }
1896 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number;
1897 error = tcp_disconnect_common(tcp, seqnum);
1898 if (error != 0)
1899 tcp_err_ack(tcp, mp, error, 0);
1900 else {
1901 if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1902 /* Send M_FLUSH according to TPI */
1903 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW);
1904 }
1905 mp = mi_tpi_ok_ack_alloc(mp);
1906 if (mp != NULL)
1907 putnext(connp->conn_rq, mp);
1908 }
1909 }
1910
1911 /*
1912 * Handle reinitialization of a tcp structure.
1913 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE.
1914 */
1915 static void
tcp_reinit(tcp_t * tcp)1916 tcp_reinit(tcp_t *tcp)
1917 {
1918 mblk_t *mp;
1919 tcp_stack_t *tcps = tcp->tcp_tcps;
1920 conn_t *connp = tcp->tcp_connp;
1921 int32_t oldstate;
1922
1923 /* tcp_reinit should never be called for detached tcp_t's */
1924 ASSERT(tcp->tcp_listener == NULL);
1925 ASSERT((connp->conn_family == AF_INET &&
1926 connp->conn_ipversion == IPV4_VERSION) ||
1927 (connp->conn_family == AF_INET6 &&
1928 (connp->conn_ipversion == IPV4_VERSION ||
1929 connp->conn_ipversion == IPV6_VERSION)));
1930
1931 /* Cancel outstanding timers */
1932 tcp_timers_stop(tcp);
1933
1934 tcp_close_mpp(&tcp->tcp_xmit_head);
1935 if (tcp->tcp_snd_zcopy_aware)
1936 tcp_zcopy_notify(tcp);
1937 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL;
1938 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0;
1939 mutex_enter(&tcp->tcp_non_sq_lock);
1940 if (tcp->tcp_flow_stopped &&
1941 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) {
1942 tcp_clrqfull(tcp);
1943 }
1944 mutex_exit(&tcp->tcp_non_sq_lock);
1945 tcp_close_mpp(&tcp->tcp_reass_head);
1946 tcp->tcp_reass_tail = NULL;
1947 if (tcp->tcp_rcv_list != NULL) {
1948 /* Free b_next chain */
1949 tcp_close_mpp(&tcp->tcp_rcv_list);
1950 tcp->tcp_rcv_last_head = NULL;
1951 tcp->tcp_rcv_last_tail = NULL;
1952 tcp->tcp_rcv_cnt = 0;
1953 }
1954 tcp->tcp_rcv_last_tail = NULL;
1955
1956 if ((mp = tcp->tcp_urp_mp) != NULL) {
1957 freemsg(mp);
1958 tcp->tcp_urp_mp = NULL;
1959 }
1960 if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1961 freemsg(mp);
1962 tcp->tcp_urp_mark_mp = NULL;
1963 }
1964 if (tcp->tcp_fused_sigurg_mp != NULL) {
1965 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1966 freeb(tcp->tcp_fused_sigurg_mp);
1967 tcp->tcp_fused_sigurg_mp = NULL;
1968 }
1969 if (tcp->tcp_ordrel_mp != NULL) {
1970 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1971 freeb(tcp->tcp_ordrel_mp);
1972 tcp->tcp_ordrel_mp = NULL;
1973 }
1974
1975 /*
1976 * Following is a union with two members which are
1977 * identical types and size so the following cleanup
1978 * is enough.
1979 */
1980 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1981
1982 CL_INET_DISCONNECT(connp);
1983
1984 /*
1985 * The connection can't be on the tcp_time_wait_head list
1986 * since it is not detached.
1987 */
1988 ASSERT(tcp->tcp_time_wait_next == NULL);
1989 ASSERT(tcp->tcp_time_wait_prev == NULL);
1990 ASSERT(tcp->tcp_time_wait_expire == 0);
1991
1992 /*
1993 * Reset/preserve other values
1994 */
1995 tcp_reinit_values(tcp);
1996 ipcl_hash_remove(connp);
1997 /* Note that ixa_cred gets cleared in ixa_cleanup */
1998 ixa_cleanup(connp->conn_ixa);
1999 tcp_ipsec_cleanup(tcp);
2000
2001 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
2002 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2003 oldstate = tcp->tcp_state;
2004
2005 if (tcp->tcp_conn_req_max != 0) {
2006 /*
2007 * This is the case when a TLI program uses the same
2008 * transport end point to accept a connection. This
2009 * makes the TCP both a listener and acceptor. When
2010 * this connection is closed, we need to set the state
2011 * back to TCPS_LISTEN. Make sure that the eager list
2012 * is reinitialized.
2013 *
2014 * Note that this stream is still bound to the four
2015 * tuples of the previous connection in IP. If a new
2016 * SYN with different foreign address comes in, IP will
2017 * not find it and will send it to the global queue. In
2018 * the global queue, TCP will do a tcp_lookup_listener()
2019 * to find this stream. This works because this stream
2020 * is only removed from connected hash.
2021 *
2022 */
2023 tcp->tcp_state = TCPS_LISTEN;
2024 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
2025 tcp->tcp_eager_next_drop_q0 = tcp;
2026 tcp->tcp_eager_prev_drop_q0 = tcp;
2027 /*
2028 * Initially set conn_recv to tcp_input_listener_unbound to try
2029 * to pick a good squeue for the listener when the first SYN
2030 * arrives. tcp_input_listener_unbound sets it to
2031 * tcp_input_listener on that first SYN.
2032 */
2033 connp->conn_recv = tcp_input_listener_unbound;
2034
2035 connp->conn_proto = IPPROTO_TCP;
2036 connp->conn_faddr_v6 = ipv6_all_zeros;
2037 connp->conn_fport = 0;
2038
2039 (void) ipcl_bind_insert(connp);
2040 } else {
2041 tcp->tcp_state = TCPS_BOUND;
2042 }
2043
2044 /*
2045 * Initialize to default values
2046 */
2047 tcp_init_values(tcp, NULL);
2048
2049 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2050 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
2051 int32_t, oldstate);
2052
2053 ASSERT(tcp->tcp_ptpbhn != NULL);
2054 tcp->tcp_rwnd = connp->conn_rcvbuf;
2055 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ?
2056 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4;
2057 }
2058
2059 /*
2060 * Force values to zero that need be zero.
2061 * Do not touch values asociated with the BOUND or LISTEN state
2062 * since the connection will end up in that state after the reinit.
2063 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t
2064 * structure!
2065 */
2066 static void
tcp_reinit_values(tcp_t * tcp)2067 tcp_reinit_values(tcp_t *tcp)
2068 {
2069 tcp_stack_t *tcps = tcp->tcp_tcps;
2070 conn_t *connp = tcp->tcp_connp;
2071
2072 #ifndef lint
2073 #define DONTCARE(x)
2074 #define PRESERVE(x)
2075 #else
2076 #define DONTCARE(x) ((x) = (x))
2077 #define PRESERVE(x) ((x) = (x))
2078 #endif /* lint */
2079
2080 PRESERVE(tcp->tcp_bind_hash_port);
2081 PRESERVE(tcp->tcp_bind_hash);
2082 PRESERVE(tcp->tcp_ptpbhn);
2083 PRESERVE(tcp->tcp_acceptor_hash);
2084 PRESERVE(tcp->tcp_ptpahn);
2085
2086 /* Should be ASSERT NULL on these with new code! */
2087 ASSERT(tcp->tcp_time_wait_next == NULL);
2088 ASSERT(tcp->tcp_time_wait_prev == NULL);
2089 ASSERT(tcp->tcp_time_wait_expire == 0);
2090 PRESERVE(tcp->tcp_state);
2091 PRESERVE(connp->conn_rq);
2092 PRESERVE(connp->conn_wq);
2093
2094 ASSERT(tcp->tcp_xmit_head == NULL);
2095 ASSERT(tcp->tcp_xmit_last == NULL);
2096 ASSERT(tcp->tcp_unsent == 0);
2097 ASSERT(tcp->tcp_xmit_tail == NULL);
2098 ASSERT(tcp->tcp_xmit_tail_unsent == 0);
2099
2100 tcp->tcp_snxt = 0; /* Displayed in mib */
2101 tcp->tcp_suna = 0; /* Displayed in mib */
2102 tcp->tcp_swnd = 0;
2103 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */
2104
2105 if (connp->conn_ht_iphc != NULL) {
2106 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
2107 connp->conn_ht_iphc = NULL;
2108 connp->conn_ht_iphc_allocated = 0;
2109 connp->conn_ht_iphc_len = 0;
2110 connp->conn_ht_ulp = NULL;
2111 connp->conn_ht_ulp_len = 0;
2112 tcp->tcp_ipha = NULL;
2113 tcp->tcp_ip6h = NULL;
2114 tcp->tcp_tcpha = NULL;
2115 }
2116
2117 /* We clear any IP_OPTIONS and extension headers */
2118 ip_pkt_free(&connp->conn_xmit_ipp);
2119
2120 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */
2121 DONTCARE(tcp->tcp_ipha);
2122 DONTCARE(tcp->tcp_ip6h);
2123 DONTCARE(tcp->tcp_tcpha);
2124 tcp->tcp_valid_bits = 0;
2125
2126 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */
2127 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */
2128 tcp->tcp_last_rcv_lbolt = 0;
2129
2130 tcp->tcp_init_cwnd = 0;
2131
2132 tcp->tcp_urp_last_valid = 0;
2133 tcp->tcp_hard_binding = 0;
2134
2135 tcp->tcp_fin_acked = 0;
2136 tcp->tcp_fin_rcvd = 0;
2137 tcp->tcp_fin_sent = 0;
2138 tcp->tcp_ordrel_done = 0;
2139
2140 tcp->tcp_detached = 0;
2141
2142 tcp->tcp_snd_ws_ok = B_FALSE;
2143 tcp->tcp_snd_ts_ok = B_FALSE;
2144 tcp->tcp_zero_win_probe = 0;
2145
2146 tcp->tcp_loopback = 0;
2147 tcp->tcp_localnet = 0;
2148 tcp->tcp_syn_defense = 0;
2149 tcp->tcp_set_timer = 0;
2150
2151 tcp->tcp_active_open = 0;
2152 tcp->tcp_rexmit = B_FALSE;
2153 tcp->tcp_xmit_zc_clean = B_FALSE;
2154
2155 tcp->tcp_snd_sack_ok = B_FALSE;
2156 tcp->tcp_hwcksum = B_FALSE;
2157
2158 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */
2159
2160 tcp->tcp_conn_def_q0 = 0;
2161 tcp->tcp_ip_forward_progress = B_FALSE;
2162 tcp->tcp_ecn_ok = B_FALSE;
2163
2164 tcp->tcp_cwr = B_FALSE;
2165 tcp->tcp_ecn_echo_on = B_FALSE;
2166 tcp->tcp_is_wnd_shrnk = B_FALSE;
2167
2168 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
2169 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
2170
2171 tcp->tcp_rcv_ws = 0;
2172 tcp->tcp_snd_ws = 0;
2173 tcp->tcp_ts_recent = 0;
2174 tcp->tcp_rnxt = 0; /* Displayed in mib */
2175 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */
2176 tcp->tcp_initial_pmtu = 0;
2177
2178 ASSERT(tcp->tcp_reass_head == NULL);
2179 ASSERT(tcp->tcp_reass_tail == NULL);
2180
2181 tcp->tcp_cwnd_cnt = 0;
2182
2183 ASSERT(tcp->tcp_rcv_list == NULL);
2184 ASSERT(tcp->tcp_rcv_last_head == NULL);
2185 ASSERT(tcp->tcp_rcv_last_tail == NULL);
2186 ASSERT(tcp->tcp_rcv_cnt == 0);
2187
2188 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */
2189 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */
2190 tcp->tcp_csuna = 0;
2191
2192 tcp->tcp_rto = 0; /* Displayed in MIB */
2193 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */
2194 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */
2195 tcp->tcp_rtt_update = 0;
2196 tcp->tcp_rtt_sum = 0;
2197 tcp->tcp_rtt_cnt = 0;
2198
2199 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2200 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2201
2202 tcp->tcp_rack = 0; /* Displayed in mib */
2203 tcp->tcp_rack_cnt = 0;
2204 tcp->tcp_rack_cur_max = 0;
2205 tcp->tcp_rack_abs_max = 0;
2206
2207 tcp->tcp_max_swnd = 0;
2208
2209 ASSERT(tcp->tcp_listener == NULL);
2210
2211 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */
2212 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */
2213 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */
2214 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */
2215
2216 ASSERT(tcp->tcp_conn_req_cnt_q == 0);
2217 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0);
2218 PRESERVE(tcp->tcp_conn_req_max);
2219 PRESERVE(tcp->tcp_conn_req_seqnum);
2220
2221 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */
2222 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */
2223 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */
2224 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */
2225
2226 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */
2227 ASSERT(tcp->tcp_urp_mp == NULL);
2228 ASSERT(tcp->tcp_urp_mark_mp == NULL);
2229 ASSERT(tcp->tcp_fused_sigurg_mp == NULL);
2230
2231 ASSERT(tcp->tcp_eager_next_q == NULL);
2232 ASSERT(tcp->tcp_eager_last_q == NULL);
2233 ASSERT((tcp->tcp_eager_next_q0 == NULL &&
2234 tcp->tcp_eager_prev_q0 == NULL) ||
2235 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0);
2236 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
2237
2238 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL &&
2239 tcp->tcp_eager_prev_drop_q0 == NULL) ||
2240 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0);
2241
2242 DONTCARE(tcp->tcp_ka_rinterval); /* Init in tcp_init_values */
2243 DONTCARE(tcp->tcp_ka_abort_thres); /* Init in tcp_init_values */
2244 DONTCARE(tcp->tcp_ka_cnt); /* Init in tcp_init_values */
2245
2246 tcp->tcp_client_errno = 0;
2247
2248 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */
2249
2250 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */
2251
2252 PRESERVE(connp->conn_bound_addr_v6);
2253 tcp->tcp_last_sent_len = 0;
2254 tcp->tcp_dupack_cnt = 0;
2255
2256 connp->conn_fport = 0; /* Displayed in MIB */
2257 PRESERVE(connp->conn_lport);
2258
2259 PRESERVE(tcp->tcp_acceptor_lockp);
2260
2261 ASSERT(tcp->tcp_ordrel_mp == NULL);
2262 PRESERVE(tcp->tcp_acceptor_id);
2263 DONTCARE(tcp->tcp_ipsec_overhead);
2264
2265 PRESERVE(connp->conn_family);
2266 /* Remove any remnants of mapped address binding */
2267 if (connp->conn_family == AF_INET6) {
2268 connp->conn_ipversion = IPV6_VERSION;
2269 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2270 } else {
2271 connp->conn_ipversion = IPV4_VERSION;
2272 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2273 }
2274
2275 connp->conn_bound_if = 0;
2276 connp->conn_recv_ancillary.crb_all = 0;
2277 tcp->tcp_recvifindex = 0;
2278 tcp->tcp_recvhops = 0;
2279 tcp->tcp_closed = 0;
2280 if (tcp->tcp_hopopts != NULL) {
2281 mi_free(tcp->tcp_hopopts);
2282 tcp->tcp_hopopts = NULL;
2283 tcp->tcp_hopoptslen = 0;
2284 }
2285 ASSERT(tcp->tcp_hopoptslen == 0);
2286 if (tcp->tcp_dstopts != NULL) {
2287 mi_free(tcp->tcp_dstopts);
2288 tcp->tcp_dstopts = NULL;
2289 tcp->tcp_dstoptslen = 0;
2290 }
2291 ASSERT(tcp->tcp_dstoptslen == 0);
2292 if (tcp->tcp_rthdrdstopts != NULL) {
2293 mi_free(tcp->tcp_rthdrdstopts);
2294 tcp->tcp_rthdrdstopts = NULL;
2295 tcp->tcp_rthdrdstoptslen = 0;
2296 }
2297 ASSERT(tcp->tcp_rthdrdstoptslen == 0);
2298 if (tcp->tcp_rthdr != NULL) {
2299 mi_free(tcp->tcp_rthdr);
2300 tcp->tcp_rthdr = NULL;
2301 tcp->tcp_rthdrlen = 0;
2302 }
2303 ASSERT(tcp->tcp_rthdrlen == 0);
2304
2305 /* Reset fusion-related fields */
2306 tcp->tcp_fused = B_FALSE;
2307 tcp->tcp_unfusable = B_FALSE;
2308 tcp->tcp_fused_sigurg = B_FALSE;
2309 tcp->tcp_loopback_peer = NULL;
2310
2311 tcp->tcp_lso = B_FALSE;
2312
2313 tcp->tcp_in_ack_unsent = 0;
2314 tcp->tcp_cork = B_FALSE;
2315 tcp->tcp_tconnind_started = B_FALSE;
2316
2317 PRESERVE(tcp->tcp_squeue_bytes);
2318
2319 tcp->tcp_closemp_used = B_FALSE;
2320
2321 PRESERVE(tcp->tcp_rsrv_mp);
2322 PRESERVE(tcp->tcp_rsrv_mp_lock);
2323
2324 #ifdef DEBUG
2325 DONTCARE(tcp->tcmp_stk[0]);
2326 #endif
2327
2328 PRESERVE(tcp->tcp_connid);
2329
2330 ASSERT(tcp->tcp_listen_cnt == NULL);
2331 ASSERT(tcp->tcp_reass_tid == 0);
2332
2333 /* Allow the CC algorithm to clean up after itself. */
2334 if (tcp->tcp_cc_algo->cb_destroy != NULL)
2335 tcp->tcp_cc_algo->cb_destroy(&tcp->tcp_ccv);
2336 tcp->tcp_cc_algo = NULL;
2337
2338 #undef DONTCARE
2339 #undef PRESERVE
2340 }
2341
2342 /*
2343 * Initialize the various fields in tcp_t. If parent (the listener) is non
2344 * NULL, certain values will be inheritted from it.
2345 */
2346 void
tcp_init_values(tcp_t * tcp,tcp_t * parent)2347 tcp_init_values(tcp_t *tcp, tcp_t *parent)
2348 {
2349 tcp_stack_t *tcps = tcp->tcp_tcps;
2350 conn_t *connp = tcp->tcp_connp;
2351
2352 ASSERT((connp->conn_family == AF_INET &&
2353 connp->conn_ipversion == IPV4_VERSION) ||
2354 (connp->conn_family == AF_INET6 &&
2355 (connp->conn_ipversion == IPV4_VERSION ||
2356 connp->conn_ipversion == IPV6_VERSION)));
2357
2358 tcp->tcp_ccv.type = IPPROTO_TCP;
2359 tcp->tcp_ccv.ccvc.tcp = tcp;
2360
2361 if (parent == NULL) {
2362 tcp->tcp_cc_algo = tcps->tcps_default_cc_algo;
2363
2364 tcp->tcp_naglim = tcps->tcps_naglim_def;
2365
2366 tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial;
2367 tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min;
2368 tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max;
2369
2370 tcp->tcp_first_ctimer_threshold =
2371 tcps->tcps_ip_notify_cinterval;
2372 tcp->tcp_second_ctimer_threshold =
2373 tcps->tcps_ip_abort_cinterval;
2374 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval;
2375 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval;
2376
2377 tcp->tcp_fin_wait_2_flush_interval =
2378 tcps->tcps_fin_wait_2_flush_interval;
2379
2380 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval;
2381 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval;
2382 tcp->tcp_ka_cnt = 0;
2383 tcp->tcp_ka_rinterval = 0;
2384
2385 /*
2386 * Default value of tcp_init_cwnd is 0, so no need to set here
2387 * if parent is NULL. But we need to inherit it from parent.
2388 */
2389 } else {
2390 /* Inherit various TCP parameters from the parent. */
2391 tcp->tcp_cc_algo = parent->tcp_cc_algo;
2392
2393 tcp->tcp_naglim = parent->tcp_naglim;
2394
2395 tcp->tcp_rto_initial = parent->tcp_rto_initial;
2396 tcp->tcp_rto_min = parent->tcp_rto_min;
2397 tcp->tcp_rto_max = parent->tcp_rto_max;
2398
2399 tcp->tcp_first_ctimer_threshold =
2400 parent->tcp_first_ctimer_threshold;
2401 tcp->tcp_second_ctimer_threshold =
2402 parent->tcp_second_ctimer_threshold;
2403 tcp->tcp_first_timer_threshold =
2404 parent->tcp_first_timer_threshold;
2405 tcp->tcp_second_timer_threshold =
2406 parent->tcp_second_timer_threshold;
2407
2408 tcp->tcp_fin_wait_2_flush_interval =
2409 parent->tcp_fin_wait_2_flush_interval;
2410 tcp->tcp_quickack = parent->tcp_quickack;
2411
2412 tcp->tcp_ka_interval = parent->tcp_ka_interval;
2413 tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres;
2414 tcp->tcp_ka_cnt = parent->tcp_ka_cnt;
2415 tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval;
2416
2417 tcp->tcp_init_cwnd = parent->tcp_init_cwnd;
2418 }
2419
2420 if (tcp->tcp_cc_algo->cb_init != NULL)
2421 VERIFY(tcp->tcp_cc_algo->cb_init(&tcp->tcp_ccv) == 0);
2422
2423 /*
2424 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
2425 * will be close to tcp_rexmit_interval_initial. By doing this, we
2426 * allow the algorithm to adjust slowly to large fluctuations of RTT
2427 * during first few transmissions of a connection as seen in slow
2428 * links.
2429 */
2430 tcp->tcp_rtt_sa = MSEC2NSEC(tcp->tcp_rto_initial) << 2;
2431 tcp->tcp_rtt_sd = MSEC2NSEC(tcp->tcp_rto_initial) >> 1;
2432 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps,
2433 tcps->tcps_conn_grace_period);
2434
2435 tcp->tcp_timer_backoff = 0;
2436 tcp->tcp_ms_we_have_waited = 0;
2437 tcp->tcp_last_recv_time = ddi_get_lbolt();
2438 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_;
2439 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
2440
2441 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier;
2442
2443 /* NOTE: ISS is now set in tcp_set_destination(). */
2444
2445 /* Reset fusion-related fields */
2446 tcp->tcp_fused = B_FALSE;
2447 tcp->tcp_unfusable = B_FALSE;
2448 tcp->tcp_fused_sigurg = B_FALSE;
2449 tcp->tcp_loopback_peer = NULL;
2450
2451 /* We rebuild the header template on the next connect/conn_request */
2452
2453 connp->conn_mlp_type = mlptSingle;
2454
2455 /*
2456 * Init the window scale to the max so tcp_rwnd_set() won't pare
2457 * down tcp_rwnd. tcp_set_destination() will set the right value later.
2458 */
2459 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
2460 tcp->tcp_rwnd = connp->conn_rcvbuf;
2461
2462 tcp->tcp_cork = B_FALSE;
2463 /*
2464 * Init the tcp_debug option if it wasn't already set. This value
2465 * determines whether TCP
2466 * calls strlog() to print out debug messages. Doing this
2467 * initialization here means that this value is not inherited thru
2468 * tcp_reinit().
2469 */
2470 if (!connp->conn_debug)
2471 connp->conn_debug = tcps->tcps_dbg;
2472 }
2473
2474 /*
2475 * Update the TCP connection according to change of PMTU.
2476 *
2477 * Path MTU might have changed by either increase or decrease, so need to
2478 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny
2479 * or negative MSS, since tcp_mss_set() will do it.
2480 */
2481 void
tcp_update_pmtu(tcp_t * tcp,boolean_t decrease_only)2482 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
2483 {
2484 uint32_t pmtu;
2485 int32_t mss;
2486 conn_t *connp = tcp->tcp_connp;
2487 ip_xmit_attr_t *ixa = connp->conn_ixa;
2488 iaflags_t ixaflags;
2489
2490 if (tcp->tcp_tcps->tcps_ignore_path_mtu)
2491 return;
2492
2493 if (tcp->tcp_state < TCPS_ESTABLISHED)
2494 return;
2495
2496 /*
2497 * Always call ip_get_pmtu() to make sure that IP has updated
2498 * ixa_flags properly.
2499 */
2500 pmtu = ip_get_pmtu(ixa);
2501 ixaflags = ixa->ixa_flags;
2502
2503 /*
2504 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and
2505 * IPsec overhead if applied. Make sure to use the most recent
2506 * IPsec information.
2507 */
2508 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp);
2509
2510 /*
2511 * Nothing to change, so just return.
2512 */
2513 if (mss == tcp->tcp_mss)
2514 return;
2515
2516 /*
2517 * Currently, for ICMP errors, only PMTU decrease is handled.
2518 */
2519 if (mss > tcp->tcp_mss && decrease_only)
2520 return;
2521
2522 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss);
2523
2524 /*
2525 * Update ixa_fragsize and ixa_pmtu.
2526 */
2527 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu;
2528
2529 /*
2530 * Adjust MSS and all relevant variables.
2531 */
2532 tcp_mss_set(tcp, mss);
2533
2534 /*
2535 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu
2536 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP
2537 * has a (potentially different) min size we do the same. Make sure to
2538 * clear IXAF_DONTFRAG, which is used by IP to decide whether to
2539 * fragment the packet.
2540 *
2541 * LSO over IPv6 can not be fragmented. So need to disable LSO
2542 * when IPv6 fragmentation is needed.
2543 */
2544 if (mss < tcp->tcp_tcps->tcps_mss_min)
2545 ixaflags |= IXAF_PMTU_TOO_SMALL;
2546
2547 if (ixaflags & IXAF_PMTU_TOO_SMALL)
2548 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
2549
2550 if ((connp->conn_ipversion == IPV4_VERSION) &&
2551 !(ixaflags & IXAF_PMTU_IPV4_DF)) {
2552 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
2553 }
2554 ixa->ixa_flags = ixaflags;
2555 }
2556
2557 int
tcp_maxpsz_set(tcp_t * tcp,boolean_t set_maxblk)2558 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk)
2559 {
2560 conn_t *connp = tcp->tcp_connp;
2561 queue_t *q = connp->conn_rq;
2562 int32_t mss = tcp->tcp_mss;
2563 int maxpsz;
2564
2565 if (TCP_IS_DETACHED(tcp))
2566 return (mss);
2567 if (tcp->tcp_fused) {
2568 maxpsz = tcp_fuse_maxpsz(tcp);
2569 mss = INFPSZ;
2570 } else if (tcp->tcp_maxpsz_multiplier == 0) {
2571 /*
2572 * Set the sd_qn_maxpsz according to the socket send buffer
2573 * size, and sd_maxblk to INFPSZ (-1). This will essentially
2574 * instruct the stream head to copyin user data into contiguous
2575 * kernel-allocated buffers without breaking it up into smaller
2576 * chunks. We round up the buffer size to the nearest SMSS.
2577 */
2578 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss);
2579 mss = INFPSZ;
2580 } else {
2581 /*
2582 * Set sd_qn_maxpsz to approx half the (receivers) buffer
2583 * (and a multiple of the mss). This instructs the stream
2584 * head to break down larger than SMSS writes into SMSS-
2585 * size mblks, up to tcp_maxpsz_multiplier mblks at a time.
2586 */
2587 maxpsz = tcp->tcp_maxpsz_multiplier * mss;
2588 if (maxpsz > connp->conn_sndbuf / 2) {
2589 maxpsz = connp->conn_sndbuf / 2;
2590 /* Round up to nearest mss */
2591 maxpsz = MSS_ROUNDUP(maxpsz, mss);
2592 }
2593 }
2594
2595 (void) proto_set_maxpsz(q, connp, maxpsz);
2596 if (!(IPCL_IS_NONSTR(connp)))
2597 connp->conn_wq->q_maxpsz = maxpsz;
2598 if (set_maxblk)
2599 (void) proto_set_tx_maxblk(q, connp, mss);
2600 return (mss);
2601 }
2602
2603 /* For /dev/tcp aka AF_INET open */
2604 static int
tcp_openv4(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp)2605 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2606 {
2607 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE));
2608 }
2609
2610 /* For /dev/tcp6 aka AF_INET6 open */
2611 static int
tcp_openv6(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp)2612 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2613 {
2614 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE));
2615 }
2616
2617 conn_t *
tcp_create_common(cred_t * credp,boolean_t isv6,boolean_t issocket,int * errorp)2618 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket,
2619 int *errorp)
2620 {
2621 tcp_t *tcp = NULL;
2622 conn_t *connp;
2623 zoneid_t zoneid;
2624 tcp_stack_t *tcps;
2625 squeue_t *sqp;
2626
2627 ASSERT(errorp != NULL);
2628 /*
2629 * Find the proper zoneid and netstack.
2630 */
2631 /*
2632 * Special case for install: miniroot needs to be able to
2633 * access files via NFS as though it were always in the
2634 * global zone.
2635 */
2636 if (credp == kcred && nfs_global_client_only != 0) {
2637 zoneid = GLOBAL_ZONEID;
2638 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)->
2639 netstack_tcp;
2640 ASSERT(tcps != NULL);
2641 } else {
2642 netstack_t *ns;
2643 int err;
2644
2645 if ((err = secpolicy_basic_net_access(credp)) != 0) {
2646 *errorp = err;
2647 return (NULL);
2648 }
2649
2650 ns = netstack_find_by_cred(credp);
2651 ASSERT(ns != NULL);
2652 tcps = ns->netstack_tcp;
2653 ASSERT(tcps != NULL);
2654
2655 /*
2656 * For exclusive stacks we set the zoneid to zero
2657 * to make TCP operate as if in the global zone.
2658 */
2659 if (tcps->tcps_netstack->netstack_stackid !=
2660 GLOBAL_NETSTACKID)
2661 zoneid = GLOBAL_ZONEID;
2662 else
2663 zoneid = crgetzoneid(credp);
2664 }
2665
2666 sqp = IP_SQUEUE_GET((uint_t)gethrtime());
2667 connp = tcp_get_conn(sqp, tcps);
2668 /*
2669 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt,
2670 * so we drop it by one.
2671 */
2672 netstack_rele(tcps->tcps_netstack);
2673 if (connp == NULL) {
2674 *errorp = ENOSR;
2675 return (NULL);
2676 }
2677 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
2678
2679 connp->conn_sqp = sqp;
2680 connp->conn_initial_sqp = connp->conn_sqp;
2681 connp->conn_ixa->ixa_sqp = connp->conn_sqp;
2682 tcp = connp->conn_tcp;
2683
2684 /*
2685 * Besides asking IP to set the checksum for us, have conn_ip_output
2686 * to do the following checks when necessary:
2687 *
2688 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid
2689 * IXAF_VERIFY_PMTU: verify PMTU changes
2690 * IXAF_VERIFY_LSO: verify LSO capability changes
2691 */
2692 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
2693 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO;
2694
2695 if (!tcps->tcps_dev_flow_ctl)
2696 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
2697
2698 if (isv6) {
2699 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
2700 connp->conn_ipversion = IPV6_VERSION;
2701 connp->conn_family = AF_INET6;
2702 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2703 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit;
2704 } else {
2705 connp->conn_ipversion = IPV4_VERSION;
2706 connp->conn_family = AF_INET;
2707 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2708 connp->conn_default_ttl = tcps->tcps_ipv4_ttl;
2709 }
2710 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
2711
2712 crhold(credp);
2713 connp->conn_cred = credp;
2714 connp->conn_cpid = curproc->p_pid;
2715 connp->conn_open_time = ddi_get_lbolt64();
2716
2717 /* Cache things in the ixa without any refhold */
2718 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
2719 connp->conn_ixa->ixa_cred = credp;
2720 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
2721
2722 connp->conn_zoneid = zoneid;
2723 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
2724 connp->conn_ixa->ixa_zoneid = zoneid;
2725 connp->conn_mlp_type = mlptSingle;
2726 ASSERT(connp->conn_netstack == tcps->tcps_netstack);
2727 ASSERT(tcp->tcp_tcps == tcps);
2728
2729 /*
2730 * If the caller has the process-wide flag set, then default to MAC
2731 * exempt mode. This allows read-down to unlabeled hosts.
2732 */
2733 if (getpflags(NET_MAC_AWARE, credp) != 0)
2734 connp->conn_mac_mode = CONN_MAC_AWARE;
2735
2736 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
2737
2738 if (issocket) {
2739 tcp->tcp_issocket = 1;
2740 }
2741
2742 connp->conn_rcvbuf = tcps->tcps_recv_hiwat;
2743 connp->conn_sndbuf = tcps->tcps_xmit_hiwat;
2744 if (tcps->tcps_snd_lowat_fraction != 0) {
2745 connp->conn_sndlowat = connp->conn_sndbuf /
2746 tcps->tcps_snd_lowat_fraction;
2747 } else {
2748 connp->conn_sndlowat = tcps->tcps_xmit_lowat;
2749 }
2750 connp->conn_so_type = SOCK_STREAM;
2751 connp->conn_wroff = connp->conn_ht_iphc_allocated +
2752 tcps->tcps_wroff_xtra;
2753
2754 SOCK_CONNID_INIT(tcp->tcp_connid);
2755 /* DTrace ignores this - it isn't a tcp:::state-change */
2756 tcp->tcp_state = TCPS_IDLE;
2757 tcp_init_values(tcp, NULL);
2758 return (connp);
2759 }
2760
2761 static int
tcp_open(queue_t * q,dev_t * devp,int flag,int sflag,cred_t * credp,boolean_t isv6)2762 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
2763 boolean_t isv6)
2764 {
2765 tcp_t *tcp = NULL;
2766 conn_t *connp = NULL;
2767 int err;
2768 vmem_t *minor_arena = NULL;
2769 dev_t conn_dev;
2770 boolean_t issocket;
2771
2772 if (q->q_ptr != NULL)
2773 return (0);
2774
2775 if (sflag == MODOPEN)
2776 return (EINVAL);
2777
2778 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
2779 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
2780 minor_arena = ip_minor_arena_la;
2781 } else {
2782 /*
2783 * Either minor numbers in the large arena were exhausted
2784 * or a non socket application is doing the open.
2785 * Try to allocate from the small arena.
2786 */
2787 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
2788 return (EBUSY);
2789 }
2790 minor_arena = ip_minor_arena_sa;
2791 }
2792
2793 ASSERT(minor_arena != NULL);
2794
2795 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev);
2796
2797 if (flag & SO_FALLBACK) {
2798 /*
2799 * Non streams socket needs a stream to fallback to
2800 */
2801 RD(q)->q_ptr = (void *)conn_dev;
2802 WR(q)->q_qinfo = &tcp_fallback_sock_winit;
2803 WR(q)->q_ptr = (void *)minor_arena;
2804 qprocson(q);
2805 return (0);
2806 } else if (flag & SO_ACCEPTOR) {
2807 q->q_qinfo = &tcp_acceptor_rinit;
2808 /*
2809 * the conn_dev and minor_arena will be subsequently used by
2810 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out
2811 * the minor device number for this connection from the q_ptr.
2812 */
2813 RD(q)->q_ptr = (void *)conn_dev;
2814 WR(q)->q_qinfo = &tcp_acceptor_winit;
2815 WR(q)->q_ptr = (void *)minor_arena;
2816 qprocson(q);
2817 return (0);
2818 }
2819
2820 issocket = flag & SO_SOCKSTR;
2821 connp = tcp_create_common(credp, isv6, issocket, &err);
2822
2823 if (connp == NULL) {
2824 inet_minor_free(minor_arena, conn_dev);
2825 q->q_ptr = WR(q)->q_ptr = NULL;
2826 return (err);
2827 }
2828
2829 connp->conn_rq = q;
2830 connp->conn_wq = WR(q);
2831 q->q_ptr = WR(q)->q_ptr = connp;
2832
2833 connp->conn_dev = conn_dev;
2834 connp->conn_minor_arena = minor_arena;
2835
2836 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6);
2837 ASSERT(WR(q)->q_qinfo == &tcp_winit);
2838
2839 tcp = connp->conn_tcp;
2840
2841 if (issocket) {
2842 WR(q)->q_qinfo = &tcp_sock_winit;
2843 } else {
2844 #ifdef _ILP32
2845 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
2846 #else
2847 tcp->tcp_acceptor_id = conn_dev;
2848 #endif /* _ILP32 */
2849 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
2850 }
2851
2852 /*
2853 * Put the ref for TCP. Ref for IP was already put
2854 * by ipcl_conn_create. Also Make the conn_t globally
2855 * visible to walkers
2856 */
2857 mutex_enter(&connp->conn_lock);
2858 CONN_INC_REF_LOCKED(connp);
2859 ASSERT(connp->conn_ref == 2);
2860 connp->conn_state_flags &= ~CONN_INCIPIENT;
2861 mutex_exit(&connp->conn_lock);
2862
2863 qprocson(q);
2864 return (0);
2865 }
2866
2867 /*
2868 * Build/update the tcp header template (in conn_ht_iphc) based on
2869 * conn_xmit_ipp. The headers include ip6_t, any extension
2870 * headers, and the maximum size tcp header (to avoid reallocation
2871 * on the fly for additional tcp options).
2872 *
2873 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}.
2874 * Returns failure if can't allocate memory.
2875 */
2876 int
tcp_build_hdrs(tcp_t * tcp)2877 tcp_build_hdrs(tcp_t *tcp)
2878 {
2879 tcp_stack_t *tcps = tcp->tcp_tcps;
2880 conn_t *connp = tcp->tcp_connp;
2881 char buf[TCP_MAX_HDR_LENGTH];
2882 uint_t buflen;
2883 uint_t ulplen = TCP_MIN_HEADER_LENGTH;
2884 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH;
2885 tcpha_t *tcpha;
2886 uint32_t cksum;
2887 int error;
2888
2889 /*
2890 * We might be called after the connection is set up, and we might
2891 * have TS options already in the TCP header. Thus we save any
2892 * existing tcp header.
2893 */
2894 buflen = connp->conn_ht_ulp_len;
2895 if (buflen != 0) {
2896 bcopy(connp->conn_ht_ulp, buf, buflen);
2897 extralen -= buflen - ulplen;
2898 ulplen = buflen;
2899 }
2900
2901 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */
2902 mutex_enter(&connp->conn_lock);
2903 error = conn_build_hdr_template(connp, ulplen, extralen,
2904 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo);
2905 mutex_exit(&connp->conn_lock);
2906 if (error != 0)
2907 return (error);
2908
2909 /*
2910 * Any routing header/option has been massaged. The checksum difference
2911 * is stored in conn_sum for later use.
2912 */
2913 tcpha = (tcpha_t *)connp->conn_ht_ulp;
2914 tcp->tcp_tcpha = tcpha;
2915
2916 /* restore any old tcp header */
2917 if (buflen != 0) {
2918 bcopy(buf, connp->conn_ht_ulp, buflen);
2919 } else {
2920 tcpha->tha_sum = 0;
2921 tcpha->tha_urp = 0;
2922 tcpha->tha_ack = 0;
2923 tcpha->tha_offset_and_reserved = (5 << 4);
2924 tcpha->tha_lport = connp->conn_lport;
2925 tcpha->tha_fport = connp->conn_fport;
2926 }
2927
2928 /*
2929 * IP wants our header length in the checksum field to
2930 * allow it to perform a single pseudo-header+checksum
2931 * calculation on behalf of TCP.
2932 * Include the adjustment for a source route once IP_OPTIONS is set.
2933 */
2934 cksum = sizeof (tcpha_t) + connp->conn_sum;
2935 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2936 ASSERT(cksum < 0x10000);
2937 tcpha->tha_sum = htons(cksum);
2938
2939 if (connp->conn_ipversion == IPV4_VERSION)
2940 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc;
2941 else
2942 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc;
2943
2944 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra >
2945 connp->conn_wroff) {
2946 connp->conn_wroff = connp->conn_ht_iphc_allocated +
2947 tcps->tcps_wroff_xtra;
2948 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2949 connp->conn_wroff);
2950 }
2951 return (0);
2952 }
2953
2954 /*
2955 * tcp_rwnd_set() is called to adjust the receive window to a desired value.
2956 * We do not allow the receive window to shrink. After setting rwnd,
2957 * set the flow control hiwat of the stream.
2958 *
2959 * This function is called in 2 cases:
2960 *
2961 * 1) Before data transfer begins, in tcp_input_listener() for accepting a
2962 * connection (passive open) and in tcp_input_data() for active connect.
2963 * This is called after tcp_mss_set() when the desired MSS value is known.
2964 * This makes sure that our window size is a mutiple of the other side's
2965 * MSS.
2966 * 2) Handling SO_RCVBUF option.
2967 *
2968 * It is ASSUMED that the requested size is a multiple of the current MSS.
2969 *
2970 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
2971 * user requests so.
2972 */
2973 int
tcp_rwnd_set(tcp_t * tcp,uint32_t rwnd)2974 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
2975 {
2976 uint32_t mss = tcp->tcp_mss;
2977 uint32_t old_max_rwnd;
2978 uint32_t max_transmittable_rwnd;
2979 boolean_t tcp_detached = TCP_IS_DETACHED(tcp);
2980 tcp_stack_t *tcps = tcp->tcp_tcps;
2981 conn_t *connp = tcp->tcp_connp;
2982
2983 /*
2984 * Insist on a receive window that is at least
2985 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
2986 * funny TCP interactions of Nagle algorithm, SWS avoidance
2987 * and delayed acknowledgement.
2988 */
2989 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss);
2990
2991 if (tcp->tcp_fused) {
2992 size_t sth_hiwat;
2993 tcp_t *peer_tcp = tcp->tcp_loopback_peer;
2994
2995 ASSERT(peer_tcp != NULL);
2996 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd);
2997 if (!tcp_detached) {
2998 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2999 sth_hiwat);
3000 tcp_set_recv_threshold(tcp, sth_hiwat >> 3);
3001 }
3002
3003 /* Caller could have changed tcp_rwnd; update tha_win */
3004 if (tcp->tcp_tcpha != NULL) {
3005 tcp->tcp_tcpha->tha_win =
3006 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3007 }
3008 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3009 tcp->tcp_cwnd_max = rwnd;
3010
3011 /*
3012 * In the fusion case, the maxpsz stream head value of
3013 * our peer is set according to its send buffer size
3014 * and our receive buffer size; since the latter may
3015 * have changed we need to update the peer's maxpsz.
3016 */
3017 (void) tcp_maxpsz_set(peer_tcp, B_TRUE);
3018 return (sth_hiwat);
3019 }
3020
3021 if (tcp_detached)
3022 old_max_rwnd = tcp->tcp_rwnd;
3023 else
3024 old_max_rwnd = connp->conn_rcvbuf;
3025
3026
3027 /*
3028 * If window size info has already been exchanged, TCP should not
3029 * shrink the window. Shrinking window is doable if done carefully.
3030 * We may add that support later. But so far there is not a real
3031 * need to do that.
3032 */
3033 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
3034 /* MSS may have changed, do a round up again. */
3035 rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
3036 }
3037
3038 /*
3039 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
3040 * can be applied even before the window scale option is decided.
3041 */
3042 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
3043 if (rwnd > max_transmittable_rwnd) {
3044 rwnd = max_transmittable_rwnd -
3045 (max_transmittable_rwnd % mss);
3046 if (rwnd < mss)
3047 rwnd = max_transmittable_rwnd;
3048 /*
3049 * If we're over the limit we may have to back down tcp_rwnd.
3050 * The increment below won't work for us. So we set all three
3051 * here and the increment below will have no effect.
3052 */
3053 tcp->tcp_rwnd = old_max_rwnd = rwnd;
3054 }
3055 if (tcp->tcp_localnet) {
3056 tcp->tcp_rack_abs_max =
3057 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2);
3058 } else {
3059 /*
3060 * For a remote host on a different subnet (through a router),
3061 * we ack every other packet to be conforming to RFC1122.
3062 * tcp_deferred_acks_max is default to 2.
3063 */
3064 tcp->tcp_rack_abs_max =
3065 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2);
3066 }
3067 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max)
3068 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
3069 else
3070 tcp->tcp_rack_cur_max = 0;
3071 /*
3072 * Increment the current rwnd by the amount the maximum grew (we
3073 * can not overwrite it since we might be in the middle of a
3074 * connection.)
3075 */
3076 tcp->tcp_rwnd += rwnd - old_max_rwnd;
3077 connp->conn_rcvbuf = rwnd;
3078
3079 /* Are we already connected? */
3080 if (tcp->tcp_tcpha != NULL) {
3081 tcp->tcp_tcpha->tha_win =
3082 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3083 }
3084
3085 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3086 tcp->tcp_cwnd_max = rwnd;
3087
3088 if (tcp_detached)
3089 return (rwnd);
3090
3091 tcp_set_recv_threshold(tcp, rwnd >> 3);
3092
3093 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd);
3094 return (rwnd);
3095 }
3096
3097 int
tcp_do_unbind(conn_t * connp)3098 tcp_do_unbind(conn_t *connp)
3099 {
3100 tcp_t *tcp = connp->conn_tcp;
3101 int32_t oldstate;
3102
3103 switch (tcp->tcp_state) {
3104 case TCPS_BOUND:
3105 case TCPS_LISTEN:
3106 break;
3107 default:
3108 return (-TOUTSTATE);
3109 }
3110
3111 /*
3112 * Need to clean up all the eagers since after the unbind, segments
3113 * will no longer be delivered to this listener stream.
3114 */
3115 mutex_enter(&tcp->tcp_eager_lock);
3116 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
3117 tcp_eager_cleanup(tcp, 0);
3118 }
3119 mutex_exit(&tcp->tcp_eager_lock);
3120
3121 /* Clean up the listener connection counter if necessary. */
3122 if (tcp->tcp_listen_cnt != NULL)
3123 TCP_DECR_LISTEN_CNT(tcp);
3124 connp->conn_laddr_v6 = ipv6_all_zeros;
3125 connp->conn_saddr_v6 = ipv6_all_zeros;
3126 tcp_bind_hash_remove(tcp);
3127 oldstate = tcp->tcp_state;
3128 tcp->tcp_state = TCPS_IDLE;
3129 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3130 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3131 int32_t, oldstate);
3132
3133 ip_unbind(connp);
3134 bzero(&connp->conn_ports, sizeof (connp->conn_ports));
3135
3136 return (0);
3137 }
3138
3139 /*
3140 * Collect protocol properties to send to the upper handle.
3141 */
3142 void
tcp_get_proto_props(tcp_t * tcp,struct sock_proto_props * sopp)3143 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp)
3144 {
3145 conn_t *connp = tcp->tcp_connp;
3146
3147 sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF;
3148 sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE);
3149
3150 sopp->sopp_rxhiwat = tcp->tcp_fused ?
3151 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) :
3152 connp->conn_rcvbuf;
3153 /*
3154 * Determine what write offset value to use depending on SACK and
3155 * whether the endpoint is fused or not.
3156 */
3157 if (tcp->tcp_fused) {
3158 ASSERT(tcp->tcp_loopback);
3159 ASSERT(tcp->tcp_loopback_peer != NULL);
3160 /*
3161 * For fused tcp loopback, set the stream head's write
3162 * offset value to zero since we won't be needing any room
3163 * for TCP/IP headers. This would also improve performance
3164 * since it would reduce the amount of work done by kmem.
3165 * Non-fused tcp loopback case is handled separately below.
3166 */
3167 sopp->sopp_wroff = 0;
3168 /*
3169 * Update the peer's transmit parameters according to
3170 * our recently calculated high water mark value.
3171 */
3172 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE);
3173 } else if (tcp->tcp_snd_sack_ok) {
3174 sopp->sopp_wroff = connp->conn_ht_iphc_allocated +
3175 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3176 } else {
3177 sopp->sopp_wroff = connp->conn_ht_iphc_len +
3178 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3179 }
3180
3181 if (tcp->tcp_loopback) {
3182 sopp->sopp_flags |= SOCKOPT_LOOPBACK;
3183 sopp->sopp_loopback = B_TRUE;
3184 }
3185 }
3186
3187 /*
3188 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP.
3189 */
3190 boolean_t
tcp_zcopy_check(tcp_t * tcp)3191 tcp_zcopy_check(tcp_t *tcp)
3192 {
3193 conn_t *connp = tcp->tcp_connp;
3194 ip_xmit_attr_t *ixa = connp->conn_ixa;
3195 boolean_t zc_enabled = B_FALSE;
3196 tcp_stack_t *tcps = tcp->tcp_tcps;
3197
3198 if (do_tcpzcopy == 2)
3199 zc_enabled = B_TRUE;
3200 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB))
3201 zc_enabled = B_TRUE;
3202
3203 tcp->tcp_snd_zcopy_on = zc_enabled;
3204 if (!TCP_IS_DETACHED(tcp)) {
3205 if (zc_enabled) {
3206 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY;
3207 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3208 ZCVMSAFE);
3209 TCP_STAT(tcps, tcp_zcopy_on);
3210 } else {
3211 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY;
3212 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3213 ZCVMUNSAFE);
3214 TCP_STAT(tcps, tcp_zcopy_off);
3215 }
3216 }
3217 return (zc_enabled);
3218 }
3219
3220 /*
3221 * Backoff from a zero-copy message by copying data to a new allocated
3222 * message and freeing the original desballoca'ed segmapped message.
3223 *
3224 * This function is called by following two callers:
3225 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free
3226 * the origial desballoca'ed message and notify sockfs. This is in re-
3227 * transmit state.
3228 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need
3229 * to be copied to new message.
3230 */
3231 mblk_t *
tcp_zcopy_backoff(tcp_t * tcp,mblk_t * bp,boolean_t fix_xmitlist)3232 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist)
3233 {
3234 mblk_t *nbp;
3235 mblk_t *head = NULL;
3236 mblk_t *tail = NULL;
3237 tcp_stack_t *tcps = tcp->tcp_tcps;
3238
3239 ASSERT(bp != NULL);
3240 while (bp != NULL) {
3241 if (IS_VMLOANED_MBLK(bp)) {
3242 TCP_STAT(tcps, tcp_zcopy_backoff);
3243 if ((nbp = copyb(bp)) == NULL) {
3244 tcp->tcp_xmit_zc_clean = B_FALSE;
3245 if (tail != NULL)
3246 tail->b_cont = bp;
3247 return ((head == NULL) ? bp : head);
3248 }
3249
3250 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
3251 if (fix_xmitlist)
3252 tcp_zcopy_notify(tcp);
3253 else
3254 nbp->b_datap->db_struioflag |=
3255 STRUIO_ZCNOTIFY;
3256 }
3257 nbp->b_cont = bp->b_cont;
3258
3259 /*
3260 * Copy saved information and adjust tcp_xmit_tail
3261 * if needed.
3262 */
3263 if (fix_xmitlist) {
3264 nbp->b_prev = bp->b_prev;
3265 nbp->b_next = bp->b_next;
3266
3267 if (tcp->tcp_xmit_tail == bp)
3268 tcp->tcp_xmit_tail = nbp;
3269 }
3270
3271 /* Free the original message. */
3272 bp->b_prev = NULL;
3273 bp->b_next = NULL;
3274 freeb(bp);
3275
3276 bp = nbp;
3277 }
3278
3279 if (head == NULL) {
3280 head = bp;
3281 }
3282 if (tail == NULL) {
3283 tail = bp;
3284 } else {
3285 tail->b_cont = bp;
3286 tail = bp;
3287 }
3288
3289 /* Move forward. */
3290 bp = bp->b_cont;
3291 }
3292
3293 if (fix_xmitlist) {
3294 tcp->tcp_xmit_last = tail;
3295 tcp->tcp_xmit_zc_clean = B_TRUE;
3296 }
3297
3298 return (head);
3299 }
3300
3301 void
tcp_zcopy_notify(tcp_t * tcp)3302 tcp_zcopy_notify(tcp_t *tcp)
3303 {
3304 struct stdata *stp;
3305 conn_t *connp;
3306
3307 if (tcp->tcp_detached)
3308 return;
3309 connp = tcp->tcp_connp;
3310 if (IPCL_IS_NONSTR(connp)) {
3311 (*connp->conn_upcalls->su_zcopy_notify)
3312 (connp->conn_upper_handle);
3313 return;
3314 }
3315 stp = STREAM(connp->conn_rq);
3316 mutex_enter(&stp->sd_lock);
3317 stp->sd_flag |= STZCNOTIFY;
3318 cv_broadcast(&stp->sd_zcopy_wait);
3319 mutex_exit(&stp->sd_lock);
3320 }
3321
3322 /*
3323 * Update the TCP connection according to change of LSO capability.
3324 */
3325 static void
tcp_update_lso(tcp_t * tcp,ip_xmit_attr_t * ixa)3326 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa)
3327 {
3328 /*
3329 * We check against IPv4 header length to preserve the old behavior
3330 * of only enabling LSO when there are no IP options.
3331 * But this restriction might not be necessary at all. Before removing
3332 * it, need to verify how LSO is handled for source routing case, with
3333 * which IP does software checksum.
3334 *
3335 * For IPv6, whenever any extension header is needed, LSO is supressed.
3336 */
3337 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ?
3338 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN))
3339 return;
3340
3341 /*
3342 * Either the LSO capability newly became usable, or it has changed.
3343 */
3344 if (ixa->ixa_flags & IXAF_LSO_CAPAB) {
3345 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab;
3346 uint_t lso_max = (ixa->ixa_flags & IXAF_IS_IPV4) ?
3347 lsoc->ill_lso_max_tcpv4 : lsoc->ill_lso_max_tcpv6;
3348
3349 ASSERT3U(lso_max, >, 0);
3350 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lso_max);
3351
3352 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3353 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max);
3354
3355 /*
3356 * If LSO to be enabled, notify the STREAM header with larger
3357 * data block.
3358 */
3359 if (!tcp->tcp_lso)
3360 tcp->tcp_maxpsz_multiplier = 0;
3361
3362 tcp->tcp_lso = B_TRUE;
3363 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled);
3364 } else { /* LSO capability is not usable any more. */
3365 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3366 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max);
3367
3368 /*
3369 * If LSO to be disabled, notify the STREAM header with smaller
3370 * data block. And need to restore fragsize to PMTU.
3371 */
3372 if (tcp->tcp_lso) {
3373 tcp->tcp_maxpsz_multiplier =
3374 tcp->tcp_tcps->tcps_maxpsz_multiplier;
3375 ixa->ixa_fragsize = ixa->ixa_pmtu;
3376 tcp->tcp_lso = B_FALSE;
3377 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled);
3378 }
3379 }
3380
3381 (void) tcp_maxpsz_set(tcp, B_TRUE);
3382 }
3383
3384 /*
3385 * Update the TCP connection according to change of ZEROCOPY capability.
3386 */
3387 static void
tcp_update_zcopy(tcp_t * tcp)3388 tcp_update_zcopy(tcp_t *tcp)
3389 {
3390 conn_t *connp = tcp->tcp_connp;
3391 tcp_stack_t *tcps = tcp->tcp_tcps;
3392
3393 if (tcp->tcp_snd_zcopy_on) {
3394 tcp->tcp_snd_zcopy_on = B_FALSE;
3395 if (!TCP_IS_DETACHED(tcp)) {
3396 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3397 ZCVMUNSAFE);
3398 TCP_STAT(tcps, tcp_zcopy_off);
3399 }
3400 } else {
3401 tcp->tcp_snd_zcopy_on = B_TRUE;
3402 if (!TCP_IS_DETACHED(tcp)) {
3403 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3404 ZCVMSAFE);
3405 TCP_STAT(tcps, tcp_zcopy_on);
3406 }
3407 }
3408 }
3409
3410 /*
3411 * Notify function registered with ip_xmit_attr_t. It's called in the squeue
3412 * so it's safe to update the TCP connection.
3413 */
3414 /* ARGSUSED1 */
3415 static void
tcp_notify(void * arg,ip_xmit_attr_t * ixa,ixa_notify_type_t ntype,ixa_notify_arg_t narg)3416 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype,
3417 ixa_notify_arg_t narg)
3418 {
3419 tcp_t *tcp = (tcp_t *)arg;
3420 conn_t *connp = tcp->tcp_connp;
3421
3422 switch (ntype) {
3423 case IXAN_LSO:
3424 tcp_update_lso(tcp, connp->conn_ixa);
3425 break;
3426 case IXAN_PMTU:
3427 tcp_update_pmtu(tcp, B_FALSE);
3428 break;
3429 case IXAN_ZCOPY:
3430 tcp_update_zcopy(tcp);
3431 break;
3432 default:
3433 break;
3434 }
3435 }
3436
3437 /*
3438 * The TCP write service routine should never be called...
3439 */
3440 /* ARGSUSED */
3441 static int
tcp_wsrv(queue_t * q)3442 tcp_wsrv(queue_t *q)
3443 {
3444 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps;
3445
3446 TCP_STAT(tcps, tcp_wsrv_called);
3447 return (0);
3448 }
3449
3450 /*
3451 * Hash list lookup routine for tcp_t structures.
3452 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF.
3453 */
3454 tcp_t *
tcp_acceptor_hash_lookup(t_uscalar_t id,tcp_stack_t * tcps)3455 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps)
3456 {
3457 tf_t *tf;
3458 tcp_t *tcp;
3459
3460 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3461 mutex_enter(&tf->tf_lock);
3462 for (tcp = tf->tf_tcp; tcp != NULL;
3463 tcp = tcp->tcp_acceptor_hash) {
3464 if (tcp->tcp_acceptor_id == id) {
3465 CONN_INC_REF(tcp->tcp_connp);
3466 mutex_exit(&tf->tf_lock);
3467 return (tcp);
3468 }
3469 }
3470 mutex_exit(&tf->tf_lock);
3471 return (NULL);
3472 }
3473
3474 /*
3475 * Hash list insertion routine for tcp_t structures.
3476 */
3477 void
tcp_acceptor_hash_insert(t_uscalar_t id,tcp_t * tcp)3478 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp)
3479 {
3480 tf_t *tf;
3481 tcp_t **tcpp;
3482 tcp_t *tcpnext;
3483 tcp_stack_t *tcps = tcp->tcp_tcps;
3484
3485 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3486
3487 if (tcp->tcp_ptpahn != NULL)
3488 tcp_acceptor_hash_remove(tcp);
3489 tcpp = &tf->tf_tcp;
3490 mutex_enter(&tf->tf_lock);
3491 tcpnext = tcpp[0];
3492 if (tcpnext)
3493 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash;
3494 tcp->tcp_acceptor_hash = tcpnext;
3495 tcp->tcp_ptpahn = tcpp;
3496 tcpp[0] = tcp;
3497 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */
3498 mutex_exit(&tf->tf_lock);
3499 }
3500
3501 /*
3502 * Hash list removal routine for tcp_t structures.
3503 */
3504 void
tcp_acceptor_hash_remove(tcp_t * tcp)3505 tcp_acceptor_hash_remove(tcp_t *tcp)
3506 {
3507 tcp_t *tcpnext;
3508 kmutex_t *lockp;
3509
3510 /*
3511 * Extract the lock pointer in case there are concurrent
3512 * hash_remove's for this instance.
3513 */
3514 lockp = tcp->tcp_acceptor_lockp;
3515
3516 if (tcp->tcp_ptpahn == NULL)
3517 return;
3518
3519 ASSERT(lockp != NULL);
3520 mutex_enter(lockp);
3521 if (tcp->tcp_ptpahn) {
3522 tcpnext = tcp->tcp_acceptor_hash;
3523 if (tcpnext) {
3524 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn;
3525 tcp->tcp_acceptor_hash = NULL;
3526 }
3527 *tcp->tcp_ptpahn = tcpnext;
3528 tcp->tcp_ptpahn = NULL;
3529 }
3530 mutex_exit(lockp);
3531 tcp->tcp_acceptor_lockp = NULL;
3532 }
3533
3534 /*
3535 * Type three generator adapted from the random() function in 4.4 BSD:
3536 */
3537
3538 /*
3539 * Copyright (c) 1983, 1993
3540 * The Regents of the University of California. All rights reserved.
3541 *
3542 * Redistribution and use in source and binary forms, with or without
3543 * modification, are permitted provided that the following conditions
3544 * are met:
3545 * 1. Redistributions of source code must retain the above copyright
3546 * notice, this list of conditions and the following disclaimer.
3547 * 2. Redistributions in binary form must reproduce the above copyright
3548 * notice, this list of conditions and the following disclaimer in the
3549 * documentation and/or other materials provided with the distribution.
3550 * 3. All advertising materials mentioning features or use of this software
3551 * must display the following acknowledgement:
3552 * This product includes software developed by the University of
3553 * California, Berkeley and its contributors.
3554 * 4. Neither the name of the University nor the names of its contributors
3555 * may be used to endorse or promote products derived from this software
3556 * without specific prior written permission.
3557 *
3558 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
3559 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3560 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
3561 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
3562 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
3563 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
3564 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3565 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
3566 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
3567 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3568 * SUCH DAMAGE.
3569 */
3570
3571 /* Type 3 -- x**31 + x**3 + 1 */
3572 #define DEG_3 31
3573 #define SEP_3 3
3574
3575
3576 /* Protected by tcp_random_lock */
3577 static int tcp_randtbl[DEG_3 + 1];
3578
3579 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1];
3580 static int *tcp_random_rptr = &tcp_randtbl[1];
3581
3582 static int *tcp_random_state = &tcp_randtbl[1];
3583 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1];
3584
3585 kmutex_t tcp_random_lock;
3586
3587 void
tcp_random_init(void)3588 tcp_random_init(void)
3589 {
3590 int i;
3591 hrtime_t hrt;
3592 time_t wallclock;
3593 uint64_t result;
3594
3595 /*
3596 * Use high-res timer and current time for seed. Gethrtime() returns
3597 * a longlong, which may contain resolution down to nanoseconds.
3598 * The current time will either be a 32-bit or a 64-bit quantity.
3599 * XOR the two together in a 64-bit result variable.
3600 * Convert the result to a 32-bit value by multiplying the high-order
3601 * 32-bits by the low-order 32-bits.
3602 */
3603
3604 hrt = gethrtime();
3605 (void) drv_getparm(TIME, &wallclock);
3606 result = (uint64_t)wallclock ^ (uint64_t)hrt;
3607 mutex_enter(&tcp_random_lock);
3608 tcp_random_state[0] = ((result >> 32) & 0xffffffff) *
3609 (result & 0xffffffff);
3610
3611 for (i = 1; i < DEG_3; i++)
3612 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1]
3613 + 12345;
3614 tcp_random_fptr = &tcp_random_state[SEP_3];
3615 tcp_random_rptr = &tcp_random_state[0];
3616 mutex_exit(&tcp_random_lock);
3617 for (i = 0; i < 10 * DEG_3; i++)
3618 (void) tcp_random();
3619 }
3620
3621 /*
3622 * tcp_random: Return a random number in the range [1 - (128K + 1)].
3623 * This range is selected to be approximately centered on TCP_ISS / 2,
3624 * and easy to compute. We get this value by generating a 32-bit random
3625 * number, selecting out the high-order 17 bits, and then adding one so
3626 * that we never return zero.
3627 */
3628 int
tcp_random(void)3629 tcp_random(void)
3630 {
3631 int i;
3632
3633 mutex_enter(&tcp_random_lock);
3634 *tcp_random_fptr += *tcp_random_rptr;
3635
3636 /*
3637 * The high-order bits are more random than the low-order bits,
3638 * so we select out the high-order 17 bits and add one so that
3639 * we never return zero.
3640 */
3641 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1;
3642 if (++tcp_random_fptr >= tcp_random_end_ptr) {
3643 tcp_random_fptr = tcp_random_state;
3644 ++tcp_random_rptr;
3645 } else if (++tcp_random_rptr >= tcp_random_end_ptr)
3646 tcp_random_rptr = tcp_random_state;
3647
3648 mutex_exit(&tcp_random_lock);
3649 return (i);
3650 }
3651
3652 /*
3653 * Split this function out so that if the secret changes, I'm okay.
3654 *
3655 * Initialize the tcp_iss_cookie and tcp_iss_key.
3656 */
3657
3658 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */
3659
3660 void
tcp_iss_key_init(uint8_t * phrase,int len,tcp_stack_t * tcps)3661 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps)
3662 {
3663 struct {
3664 int32_t current_time;
3665 uint32_t randnum;
3666 uint16_t pad;
3667 uint8_t ether[6];
3668 uint8_t passwd[PASSWD_SIZE];
3669 } tcp_iss_cookie;
3670 time_t t;
3671
3672 /*
3673 * Start with the current absolute time.
3674 */
3675 (void) drv_getparm(TIME, &t);
3676 tcp_iss_cookie.current_time = t;
3677
3678 /*
3679 * XXX - Need a more random number per RFC 1750, not this crap.
3680 * OTOH, if what follows is pretty random, then I'm in better shape.
3681 */
3682 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random());
3683 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */
3684
3685 /*
3686 * The cpu_type_info is pretty non-random. Ugggh. It does serve
3687 * as a good template.
3688 */
3689 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd,
3690 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info)));
3691
3692 /*
3693 * The pass-phrase. Normally this is supplied by user-called NDD.
3694 */
3695 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len));
3696
3697 /*
3698 * See 4010593 if this section becomes a problem again,
3699 * but the local ethernet address is useful here.
3700 */
3701 (void) localetheraddr(NULL,
3702 (struct ether_addr *)&tcp_iss_cookie.ether);
3703
3704 /*
3705 * Hash 'em all together. The MD5Final is called per-connection.
3706 */
3707 mutex_enter(&tcps->tcps_iss_key_lock);
3708 MD5Init(&tcps->tcps_iss_key);
3709 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie,
3710 sizeof (tcp_iss_cookie));
3711 mutex_exit(&tcps->tcps_iss_key_lock);
3712 }
3713
3714 /*
3715 * Called by IP when IP is loaded into the kernel
3716 */
3717 void
tcp_ddi_g_init(void)3718 tcp_ddi_g_init(void)
3719 {
3720 tcp_timercache = kmem_cache_create("tcp_timercache",
3721 sizeof (tcp_timer_t) + sizeof (mblk_t), 0,
3722 NULL, NULL, NULL, NULL, NULL, 0);
3723
3724 tcp_notsack_blk_cache = kmem_cache_create("tcp_notsack_blk_cache",
3725 sizeof (notsack_blk_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
3726
3727 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL);
3728
3729 /* Initialize the random number generator */
3730 tcp_random_init();
3731
3732 /* A single callback independently of how many netstacks we have */
3733 ip_squeue_init(tcp_squeue_add);
3734
3735 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics);
3736
3737 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput);
3738
3739 /*
3740 * We want to be informed each time a stack is created or
3741 * destroyed in the kernel, so we can maintain the
3742 * set of tcp_stack_t's.
3743 */
3744 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini);
3745 }
3746
3747
3748 #define INET_NAME "ip"
3749
3750 /*
3751 * Initialize the TCP stack instance.
3752 */
3753 static void *
tcp_stack_init(netstackid_t stackid,netstack_t * ns)3754 tcp_stack_init(netstackid_t stackid, netstack_t *ns)
3755 {
3756 tcp_stack_t *tcps;
3757 int i;
3758 int error = 0;
3759 major_t major;
3760 size_t arrsz;
3761
3762 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP);
3763 tcps->tcps_netstack = ns;
3764
3765 /* Initialize locks */
3766 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL);
3767 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
3768
3769 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS;
3770 tcps->tcps_g_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
3771 tcps->tcps_g_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
3772 tcps->tcps_min_anonpriv_port = 512;
3773
3774 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) *
3775 TCP_BIND_FANOUT_SIZE, KM_SLEEP);
3776 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) *
3777 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP);
3778
3779 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3780 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL,
3781 MUTEX_DEFAULT, NULL);
3782 }
3783
3784 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3785 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL,
3786 MUTEX_DEFAULT, NULL);
3787 }
3788
3789 /* TCP's IPsec code calls the packet dropper. */
3790 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement");
3791
3792 arrsz = tcp_propinfo_count * sizeof (mod_prop_info_t);
3793 tcps->tcps_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
3794 KM_SLEEP);
3795 bcopy(tcp_propinfo_tbl, tcps->tcps_propinfo_tbl, arrsz);
3796
3797 /*
3798 * Note: To really walk the device tree you need the devinfo
3799 * pointer to your device which is only available after probe/attach.
3800 * The following is safe only because it uses ddi_root_node()
3801 */
3802 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr,
3803 tcp_opt_obj.odb_opt_arr_cnt);
3804
3805 /*
3806 * Initialize RFC 1948 secret values. This will probably be reset once
3807 * by the boot scripts.
3808 *
3809 * Use NULL name, as the name is caught by the new lockstats.
3810 *
3811 * Initialize with some random, non-guessable string, like the global
3812 * T_INFO_ACK.
3813 */
3814
3815 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack,
3816 sizeof (tcp_g_t_info_ack), tcps);
3817
3818 tcps->tcps_kstat = tcp_kstat2_init(stackid);
3819 tcps->tcps_mibkp = tcp_kstat_init(stackid);
3820
3821 major = mod_name_to_major(INET_NAME);
3822 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident);
3823 ASSERT(error == 0);
3824 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL);
3825 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL);
3826 cv_init(&tcps->tcps_ixa_cleanup_ready_cv, NULL, CV_DEFAULT, NULL);
3827 cv_init(&tcps->tcps_ixa_cleanup_done_cv, NULL, CV_DEFAULT, NULL);
3828 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL);
3829
3830 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL);
3831 tcps->tcps_reclaim = B_FALSE;
3832 tcps->tcps_reclaim_tid = 0;
3833 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max;
3834
3835 /*
3836 * ncpus is the current number of CPUs, which can be bigger than
3837 * boot_ncpus. But we don't want to use ncpus to allocate all the
3838 * tcp_stats_cpu_t at system boot up time since it will be 1. While
3839 * we handle adding CPU in tcp_cpu_update(), it will be slow if
3840 * there are many CPUs as we will be adding them 1 by 1.
3841 *
3842 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers
3843 * are not freed until the stack is going away. So there is no need
3844 * to grab a lock to access the per CPU tcps_sc[x] pointer.
3845 */
3846 mutex_enter(&cpu_lock);
3847 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus);
3848 mutex_exit(&cpu_lock);
3849 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *),
3850 KM_SLEEP);
3851 for (i = 0; i < tcps->tcps_sc_cnt; i++) {
3852 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t),
3853 KM_SLEEP);
3854 }
3855
3856 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL);
3857 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t),
3858 offsetof(tcp_listener_t, tl_link));
3859
3860 tcps->tcps_default_cc_algo = cc_load_algo(CC_DEFAULT_ALGO_NAME);
3861 VERIFY3P(tcps->tcps_default_cc_algo, !=, NULL);
3862
3863 return (tcps);
3864 }
3865
3866 /*
3867 * Called when the IP module is about to be unloaded.
3868 */
3869 void
tcp_ddi_g_destroy(void)3870 tcp_ddi_g_destroy(void)
3871 {
3872 tcp_g_kstat_fini(tcp_g_kstat);
3873 tcp_g_kstat = NULL;
3874 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics));
3875
3876 mutex_destroy(&tcp_random_lock);
3877
3878 kmem_cache_destroy(tcp_timercache);
3879 kmem_cache_destroy(tcp_notsack_blk_cache);
3880
3881 netstack_unregister(NS_TCP);
3882 }
3883
3884 /*
3885 * Free the TCP stack instance.
3886 */
3887 static void
tcp_stack_fini(netstackid_t stackid,void * arg)3888 tcp_stack_fini(netstackid_t stackid, void *arg)
3889 {
3890 tcp_stack_t *tcps = (tcp_stack_t *)arg;
3891 int i;
3892
3893 freeb(tcps->tcps_ixa_cleanup_mp);
3894 tcps->tcps_ixa_cleanup_mp = NULL;
3895 cv_destroy(&tcps->tcps_ixa_cleanup_ready_cv);
3896 cv_destroy(&tcps->tcps_ixa_cleanup_done_cv);
3897 mutex_destroy(&tcps->tcps_ixa_cleanup_lock);
3898
3899 /*
3900 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart
3901 * the timer.
3902 */
3903 mutex_enter(&tcps->tcps_reclaim_lock);
3904 tcps->tcps_reclaim = B_FALSE;
3905 mutex_exit(&tcps->tcps_reclaim_lock);
3906 if (tcps->tcps_reclaim_tid != 0)
3907 (void) untimeout(tcps->tcps_reclaim_tid);
3908 mutex_destroy(&tcps->tcps_reclaim_lock);
3909
3910 tcp_listener_conf_cleanup(tcps);
3911
3912 for (i = 0; i < tcps->tcps_sc_cnt; i++)
3913 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t));
3914 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *));
3915
3916 kmem_free(tcps->tcps_propinfo_tbl,
3917 tcp_propinfo_count * sizeof (mod_prop_info_t));
3918 tcps->tcps_propinfo_tbl = NULL;
3919
3920 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3921 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL);
3922 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock);
3923 }
3924
3925 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3926 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL);
3927 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock);
3928 }
3929
3930 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE);
3931 tcps->tcps_bind_fanout = NULL;
3932
3933 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) *
3934 TCP_ACCEPTOR_FANOUT_SIZE);
3935 tcps->tcps_acceptor_fanout = NULL;
3936
3937 mutex_destroy(&tcps->tcps_iss_key_lock);
3938 mutex_destroy(&tcps->tcps_epriv_port_lock);
3939
3940 ip_drop_unregister(&tcps->tcps_dropper);
3941
3942 tcp_kstat2_fini(stackid, tcps->tcps_kstat);
3943 tcps->tcps_kstat = NULL;
3944
3945 tcp_kstat_fini(stackid, tcps->tcps_mibkp);
3946 tcps->tcps_mibkp = NULL;
3947
3948 ldi_ident_release(tcps->tcps_ldi_ident);
3949 kmem_free(tcps, sizeof (*tcps));
3950 }
3951
3952 /*
3953 * Generate ISS, taking into account NDD changes may happen halfway through.
3954 * (If the iss is not zero, set it.)
3955 */
3956
3957 static void
tcp_iss_init(tcp_t * tcp)3958 tcp_iss_init(tcp_t *tcp)
3959 {
3960 MD5_CTX context;
3961 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg;
3962 uint32_t answer[4];
3963 tcp_stack_t *tcps = tcp->tcp_tcps;
3964 conn_t *connp = tcp->tcp_connp;
3965
3966 tcps->tcps_iss_incr_extra += (tcps->tcps_iss_incr >> 1);
3967 tcp->tcp_iss = tcps->tcps_iss_incr_extra;
3968 switch (tcps->tcps_strong_iss) {
3969 case 2:
3970 mutex_enter(&tcps->tcps_iss_key_lock);
3971 context = tcps->tcps_iss_key;
3972 mutex_exit(&tcps->tcps_iss_key_lock);
3973 arg.ports = connp->conn_ports;
3974 arg.src = connp->conn_laddr_v6;
3975 arg.dst = connp->conn_faddr_v6;
3976 MD5Update(&context, (uchar_t *)&arg, sizeof (arg));
3977 MD5Final((uchar_t *)answer, &context);
3978 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3];
3979 /*
3980 * Now that we've hashed into a unique per-connection sequence
3981 * space, add a random increment per strong_iss == 1. So I
3982 * guess we'll have to...
3983 */
3984 /* FALLTHRU */
3985 case 1:
3986 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random();
3987 break;
3988 default:
3989 tcp->tcp_iss += (uint32_t)gethrestime_sec() *
3990 tcps->tcps_iss_incr;
3991 break;
3992 }
3993 tcp->tcp_valid_bits = TCP_ISS_VALID;
3994 tcp->tcp_fss = tcp->tcp_iss - 1;
3995 tcp->tcp_suna = tcp->tcp_iss;
3996 tcp->tcp_snxt = tcp->tcp_iss + 1;
3997 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3998 tcp->tcp_csuna = tcp->tcp_snxt;
3999 }
4000
4001 /*
4002 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL
4003 * on the specified backing STREAMS q. Note, the caller may make the
4004 * decision to call based on the tcp_t.tcp_flow_stopped value which
4005 * when check outside the q's lock is only an advisory check ...
4006 */
4007 void
tcp_setqfull(tcp_t * tcp)4008 tcp_setqfull(tcp_t *tcp)
4009 {
4010 tcp_stack_t *tcps = tcp->tcp_tcps;
4011 conn_t *connp = tcp->tcp_connp;
4012
4013 if (tcp->tcp_closed)
4014 return;
4015
4016 conn_setqfull(connp, &tcp->tcp_flow_stopped);
4017 if (tcp->tcp_flow_stopped)
4018 TCP_STAT(tcps, tcp_flwctl_on);
4019 }
4020
4021 void
tcp_clrqfull(tcp_t * tcp)4022 tcp_clrqfull(tcp_t *tcp)
4023 {
4024 conn_t *connp = tcp->tcp_connp;
4025
4026 if (tcp->tcp_closed)
4027 return;
4028 conn_clrqfull(connp, &tcp->tcp_flow_stopped);
4029 }
4030
4031 static int
tcp_squeue_switch(int val)4032 tcp_squeue_switch(int val)
4033 {
4034 int rval = SQ_FILL;
4035
4036 switch (val) {
4037 case 1:
4038 rval = SQ_NODRAIN;
4039 break;
4040 case 2:
4041 rval = SQ_PROCESS;
4042 break;
4043 default:
4044 break;
4045 }
4046 return (rval);
4047 }
4048
4049 /*
4050 * This is called once for each squeue - globally for all stack
4051 * instances.
4052 */
4053 static void
tcp_squeue_add(squeue_t * sqp)4054 tcp_squeue_add(squeue_t *sqp)
4055 {
4056 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc(
4057 sizeof (tcp_squeue_priv_t), KM_SLEEP);
4058
4059 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait;
4060 if (tcp_free_list_max_cnt == 0) {
4061 int tcp_ncpus = ((boot_max_ncpus == -1) ?
4062 max_ncpus : boot_max_ncpus);
4063
4064 /*
4065 * Limit number of entries to 1% of availble memory / tcp_ncpus
4066 */
4067 tcp_free_list_max_cnt = (freemem * PAGESIZE) /
4068 (tcp_ncpus * sizeof (tcp_t) * 100);
4069 }
4070 tcp_time_wait->tcp_free_list_cnt = 0;
4071 }
4072 /*
4073 * Return unix error is tli error is TSYSERR, otherwise return a negative
4074 * tli error.
4075 */
4076 int
tcp_do_bind(conn_t * connp,struct sockaddr * sa,socklen_t len,cred_t * cr,boolean_t bind_to_req_port_only)4077 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4078 boolean_t bind_to_req_port_only)
4079 {
4080 int error;
4081 tcp_t *tcp = connp->conn_tcp;
4082
4083 if (tcp->tcp_state >= TCPS_BOUND) {
4084 if (connp->conn_debug) {
4085 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4086 "tcp_bind: bad state, %d", tcp->tcp_state);
4087 }
4088 return (-TOUTSTATE);
4089 }
4090
4091 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only);
4092 if (error != 0)
4093 return (error);
4094
4095 ASSERT(tcp->tcp_state == TCPS_BOUND);
4096 tcp->tcp_conn_req_max = 0;
4097 return (0);
4098 }
4099
4100 /*
4101 * If the return value from this function is positive, it's a UNIX error.
4102 * Otherwise, if it's negative, then the absolute value is a TLI error.
4103 * the TPI routine tcp_tpi_connect() is a wrapper function for this.
4104 */
4105 int
tcp_do_connect(conn_t * connp,const struct sockaddr * sa,socklen_t len,cred_t * cr,pid_t pid)4106 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
4107 cred_t *cr, pid_t pid)
4108 {
4109 tcp_t *tcp = connp->conn_tcp;
4110 sin_t *sin = (sin_t *)sa;
4111 sin6_t *sin6 = (sin6_t *)sa;
4112 ipaddr_t *dstaddrp;
4113 in_port_t dstport;
4114 uint_t srcid;
4115 int error;
4116 uint32_t mss;
4117 mblk_t *syn_mp;
4118 tcp_stack_t *tcps = tcp->tcp_tcps;
4119 int32_t oldstate;
4120 ip_xmit_attr_t *ixa = connp->conn_ixa;
4121
4122 oldstate = tcp->tcp_state;
4123
4124 switch (len) {
4125 default:
4126 /*
4127 * Should never happen
4128 */
4129 return (EINVAL);
4130
4131 case sizeof (sin_t):
4132 sin = (sin_t *)sa;
4133 if (sin->sin_port == 0) {
4134 return (-TBADADDR);
4135 }
4136 if (connp->conn_ipv6_v6only) {
4137 return (EAFNOSUPPORT);
4138 }
4139 break;
4140
4141 case sizeof (sin6_t):
4142 sin6 = (sin6_t *)sa;
4143 if (sin6->sin6_port == 0) {
4144 return (-TBADADDR);
4145 }
4146 break;
4147 }
4148 /*
4149 * If we're connecting to an IPv4-mapped IPv6 address, we need to
4150 * make sure that the conn_ipversion is IPV4_VERSION. We
4151 * need to this before we call tcp_bindi() so that the port lookup
4152 * code will look for ports in the correct port space (IPv4 and
4153 * IPv6 have separate port spaces).
4154 */
4155 if (connp->conn_family == AF_INET6 &&
4156 connp->conn_ipversion == IPV6_VERSION &&
4157 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4158 if (connp->conn_ipv6_v6only)
4159 return (EADDRNOTAVAIL);
4160
4161 connp->conn_ipversion = IPV4_VERSION;
4162 }
4163
4164 switch (tcp->tcp_state) {
4165 case TCPS_LISTEN:
4166 /*
4167 * Listening sockets are not allowed to issue connect().
4168 */
4169 if (IPCL_IS_NONSTR(connp))
4170 return (EOPNOTSUPP);
4171 /* FALLTHRU */
4172 case TCPS_IDLE:
4173 /*
4174 * We support quick connect, refer to comments in
4175 * tcp_connect_*()
4176 */
4177 /* FALLTHRU */
4178 case TCPS_BOUND:
4179 break;
4180 default:
4181 return (-TOUTSTATE);
4182 }
4183
4184 /*
4185 * We update our cred/cpid based on the caller of connect
4186 */
4187 if (connp->conn_cred != cr) {
4188 crhold(cr);
4189 crfree(connp->conn_cred);
4190 connp->conn_cred = cr;
4191 }
4192 connp->conn_cpid = pid;
4193
4194 /* Cache things in the ixa without any refhold */
4195 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4196 ixa->ixa_cred = cr;
4197 ixa->ixa_cpid = pid;
4198 if (is_system_labeled()) {
4199 /* We need to restart with a label based on the cred */
4200 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
4201 }
4202
4203 if (connp->conn_family == AF_INET6) {
4204 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4205 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr,
4206 sin6->sin6_port, sin6->sin6_flowinfo,
4207 sin6->__sin6_src_id, sin6->sin6_scope_id);
4208 } else {
4209 /*
4210 * Destination adress is mapped IPv6 address.
4211 * Source bound address should be unspecified or
4212 * IPv6 mapped address as well.
4213 */
4214 if (!IN6_IS_ADDR_UNSPECIFIED(
4215 &connp->conn_bound_addr_v6) &&
4216 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
4217 return (EADDRNOTAVAIL);
4218 }
4219 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr));
4220 dstport = sin6->sin6_port;
4221 srcid = sin6->__sin6_src_id;
4222 error = tcp_connect_ipv4(tcp, dstaddrp, dstport,
4223 srcid);
4224 }
4225 } else {
4226 dstaddrp = &sin->sin_addr.s_addr;
4227 dstport = sin->sin_port;
4228 srcid = 0;
4229 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid);
4230 }
4231
4232 if (error != 0)
4233 goto connect_failed;
4234
4235 CL_INET_CONNECT(connp, B_TRUE, error);
4236 if (error != 0)
4237 goto connect_failed;
4238
4239 /* connect succeeded */
4240 TCPS_BUMP_MIB(tcps, tcpActiveOpens);
4241 tcp->tcp_active_open = 1;
4242
4243 /*
4244 * tcp_set_destination() does not adjust for TCP/IP header length.
4245 */
4246 mss = tcp->tcp_mss - connp->conn_ht_iphc_len;
4247
4248 /*
4249 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up
4250 * to the nearest MSS.
4251 *
4252 * We do the round up here because we need to get the interface MTU
4253 * first before we can do the round up.
4254 */
4255 tcp->tcp_rwnd = connp->conn_rcvbuf;
4256 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss),
4257 tcps->tcps_recv_hiwat_minmss * mss);
4258 connp->conn_rcvbuf = tcp->tcp_rwnd;
4259 tcp_set_ws_value(tcp);
4260 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
4261 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always)
4262 tcp->tcp_snd_ws_ok = B_TRUE;
4263
4264 /*
4265 * Set tcp_snd_ts_ok to true
4266 * so that tcp_xmit_mp will
4267 * include the timestamp
4268 * option in the SYN segment.
4269 */
4270 if (tcps->tcps_tstamp_always ||
4271 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) {
4272 tcp->tcp_snd_ts_ok = B_TRUE;
4273 }
4274
4275 /*
4276 * Note that tcp_snd_sack_ok can be set in tcp_set_destination() if
4277 * the SACK metric is set. So here we just check the per stack SACK
4278 * permitted param.
4279 */
4280 if (tcps->tcps_sack_permitted == 2) {
4281 ASSERT(tcp->tcp_num_sack_blk == 0);
4282 ASSERT(tcp->tcp_notsack_list == NULL);
4283 tcp->tcp_snd_sack_ok = B_TRUE;
4284 }
4285
4286 /*
4287 * Should we use ECN? Note that the current
4288 * default value (SunOS 5.9) of tcp_ecn_permitted
4289 * is 1. The reason for doing this is that there
4290 * are equipments out there that will drop ECN
4291 * enabled IP packets. Setting it to 1 avoids
4292 * compatibility problems.
4293 */
4294 if (tcps->tcps_ecn_permitted == 2)
4295 tcp->tcp_ecn_ok = B_TRUE;
4296
4297 /* Trace change from BOUND -> SYN_SENT here */
4298 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4299 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4300 int32_t, TCPS_BOUND);
4301
4302 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4303 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
4304 tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
4305 if (syn_mp != NULL) {
4306 /*
4307 * We must bump the generation before sending the syn
4308 * to ensure that we use the right generation in case
4309 * this thread issues a "connected" up call.
4310 */
4311 SOCK_CONNID_BUMP(tcp->tcp_connid);
4312 /*
4313 * DTrace sending the first SYN as a
4314 * tcp:::connect-request event.
4315 */
4316 DTRACE_TCP5(connect__request, mblk_t *, NULL,
4317 ip_xmit_attr_t *, connp->conn_ixa,
4318 void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp,
4319 tcph_t *,
4320 &syn_mp->b_rptr[connp->conn_ixa->ixa_ip_hdr_length]);
4321 tcp_send_data(tcp, syn_mp);
4322 }
4323
4324 if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4325 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4326 return (0);
4327
4328 connect_failed:
4329 connp->conn_faddr_v6 = ipv6_all_zeros;
4330 connp->conn_fport = 0;
4331 tcp->tcp_state = oldstate;
4332 if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4333 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4334 return (error);
4335 }
4336
4337 int
tcp_do_listen(conn_t * connp,struct sockaddr * sa,socklen_t len,int backlog,cred_t * cr,boolean_t bind_to_req_port_only)4338 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len,
4339 int backlog, cred_t *cr, boolean_t bind_to_req_port_only)
4340 {
4341 tcp_t *tcp = connp->conn_tcp;
4342 int error = 0;
4343 tcp_stack_t *tcps = tcp->tcp_tcps;
4344 int32_t oldstate;
4345
4346 /* All Solaris components should pass a cred for this operation. */
4347 ASSERT(cr != NULL);
4348
4349 if (tcp->tcp_state >= TCPS_BOUND) {
4350 if ((tcp->tcp_state == TCPS_BOUND ||
4351 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) {
4352 /*
4353 * Handle listen() increasing backlog.
4354 * This is more "liberal" then what the TPI spec
4355 * requires but is needed to avoid a t_unbind
4356 * when handling listen() since the port number
4357 * might be "stolen" between the unbind and bind.
4358 */
4359 goto do_listen;
4360 }
4361 if (connp->conn_debug) {
4362 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4363 "tcp_listen: bad state, %d", tcp->tcp_state);
4364 }
4365 return (-TOUTSTATE);
4366 } else {
4367 sin6_t addr;
4368 sin_t *sin;
4369 sin6_t *sin6;
4370
4371 if (sa == NULL) {
4372 ASSERT(IPCL_IS_NONSTR(connp));
4373 /* Do an implicit bind: Request for a generic port. */
4374 if (connp->conn_family == AF_INET) {
4375 len = sizeof (sin_t);
4376 sin = (sin_t *)&addr;
4377 *sin = sin_null;
4378 sin->sin_family = AF_INET;
4379 } else {
4380 ASSERT(connp->conn_family == AF_INET6);
4381 len = sizeof (sin6_t);
4382 sin6 = (sin6_t *)&addr;
4383 *sin6 = sin6_null;
4384 sin6->sin6_family = AF_INET6;
4385 }
4386 sa = (struct sockaddr *)&addr;
4387 }
4388
4389 error = tcp_bind_check(connp, sa, len, cr,
4390 bind_to_req_port_only);
4391 if (error)
4392 return (error);
4393 /* Fall through and do the fanout insertion */
4394 }
4395
4396 do_listen:
4397 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN);
4398 tcp->tcp_conn_req_max = backlog;
4399 if (tcp->tcp_conn_req_max) {
4400 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min)
4401 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min;
4402 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q)
4403 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q;
4404 /*
4405 * If this is a listener, do not reset the eager list
4406 * and other stuffs. Note that we don't check if the
4407 * existing eager list meets the new tcp_conn_req_max
4408 * requirement.
4409 */
4410 if (tcp->tcp_state != TCPS_LISTEN) {
4411 tcp->tcp_state = TCPS_LISTEN;
4412 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4413 connp->conn_ixa, void, NULL, tcp_t *, tcp,
4414 void, NULL, int32_t, TCPS_BOUND);
4415 /* Initialize the chain. Don't need the eager_lock */
4416 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
4417 tcp->tcp_eager_next_drop_q0 = tcp;
4418 tcp->tcp_eager_prev_drop_q0 = tcp;
4419 tcp->tcp_second_ctimer_threshold =
4420 tcps->tcps_ip_abort_linterval;
4421 }
4422 }
4423
4424 /*
4425 * We need to make sure that the conn_recv is set to a non-null
4426 * value before we insert the conn into the classifier table.
4427 * This is to avoid a race with an incoming packet which does an
4428 * ipcl_classify().
4429 * We initially set it to tcp_input_listener_unbound to try to
4430 * pick a good squeue for the listener when the first SYN arrives.
4431 * tcp_input_listener_unbound sets it to tcp_input_listener on that
4432 * first SYN.
4433 */
4434 connp->conn_recv = tcp_input_listener_unbound;
4435
4436 /* Insert the listener in the classifier table */
4437 error = ip_laddr_fanout_insert(connp);
4438 if (error != 0) {
4439 /* Undo the bind - release the port number */
4440 oldstate = tcp->tcp_state;
4441 tcp->tcp_state = TCPS_IDLE;
4442 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4443 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4444 int32_t, oldstate);
4445 connp->conn_bound_addr_v6 = ipv6_all_zeros;
4446
4447 connp->conn_laddr_v6 = ipv6_all_zeros;
4448 connp->conn_saddr_v6 = ipv6_all_zeros;
4449 connp->conn_ports = 0;
4450
4451 if (connp->conn_anon_port) {
4452 zone_t *zone;
4453
4454 zone = crgetzone(cr);
4455 connp->conn_anon_port = B_FALSE;
4456 (void) tsol_mlp_anon(zone, connp->conn_mlp_type,
4457 connp->conn_proto, connp->conn_lport, B_FALSE);
4458 }
4459 connp->conn_mlp_type = mlptSingle;
4460
4461 tcp_bind_hash_remove(tcp);
4462 return (error);
4463 } else {
4464 /*
4465 * If there is a connection limit, allocate and initialize
4466 * the counter struct. Note that since listen can be called
4467 * multiple times, the struct may have been allready allocated.
4468 */
4469 if (!list_is_empty(&tcps->tcps_listener_conf) &&
4470 tcp->tcp_listen_cnt == NULL) {
4471 tcp_listen_cnt_t *tlc;
4472 uint32_t ratio;
4473
4474 ratio = tcp_find_listener_conf(tcps,
4475 ntohs(connp->conn_lport));
4476 if (ratio != 0) {
4477 uint32_t mem_ratio, tot_buf;
4478
4479 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t),
4480 KM_SLEEP);
4481 /*
4482 * Calculate the connection limit based on
4483 * the configured ratio and maxusers. Maxusers
4484 * are calculated based on memory size,
4485 * ~ 1 user per MB. Note that the conn_rcvbuf
4486 * and conn_sndbuf may change after a
4487 * connection is accepted. So what we have
4488 * is only an approximation.
4489 */
4490 if ((tot_buf = connp->conn_rcvbuf +
4491 connp->conn_sndbuf) < MB) {
4492 mem_ratio = MB / tot_buf;
4493 tlc->tlc_max = maxusers / ratio *
4494 mem_ratio;
4495 } else {
4496 mem_ratio = tot_buf / MB;
4497 tlc->tlc_max = maxusers / ratio /
4498 mem_ratio;
4499 }
4500 /* At least we should allow two connections! */
4501 if (tlc->tlc_max <= tcp_min_conn_listener)
4502 tlc->tlc_max = tcp_min_conn_listener;
4503 tlc->tlc_cnt = 1;
4504 tlc->tlc_drop = 0;
4505 tcp->tcp_listen_cnt = tlc;
4506 }
4507 }
4508 }
4509 return (error);
4510 }
4511