1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright 2019 Joyent, Inc.
26 * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
27 * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
28 * Copyright 2024 Oxide Computer Company
29 */
30
31 /* This file contains all TCP input processing functions. */
32
33 #include <sys/types.h>
34 #include <sys/stream.h>
35 #include <sys/strsun.h>
36 #include <sys/strsubr.h>
37 #include <sys/stropts.h>
38 #include <sys/strlog.h>
39 #define _SUN_TPI_VERSION 2
40 #include <sys/tihdr.h>
41 #include <sys/suntpi.h>
42 #include <sys/xti_inet.h>
43 #include <sys/squeue_impl.h>
44 #include <sys/squeue.h>
45 #include <sys/tsol/tnet.h>
46
47 #include <inet/common.h>
48 #include <inet/ip.h>
49 #include <inet/tcp.h>
50 #include <inet/tcp_impl.h>
51 #include <inet/tcp_cluster.h>
52 #include <inet/proto_set.h>
53 #include <inet/ipsec_impl.h>
54 #include <inet/tcp_sig.h>
55
56 /*
57 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
58 */
59
60 #ifdef _BIG_ENDIAN
61 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
62 (TCPOPT_TSTAMP << 8) | 10)
63 #else
64 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
65 (TCPOPT_NOP << 8) | TCPOPT_NOP)
66 #endif
67
68 /*
69 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
70 */
71 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
72
73 /*
74 * Since tcp_listener is not cleared atomically with tcp_detached
75 * being cleared we need this extra bit to tell a detached connection
76 * apart from one that is in the process of being accepted.
77 */
78 #define TCP_IS_DETACHED_NONEAGER(tcp) \
79 (TCP_IS_DETACHED(tcp) && \
80 (!(tcp)->tcp_hard_binding))
81
82 /*
83 * Steps to do when a tcp_t moves to TIME-WAIT state.
84 *
85 * This connection is done, we don't need to account for it. Decrement
86 * the listener connection counter if needed.
87 *
88 * Decrement the connection counter of the stack. Note that this counter
89 * is per CPU. So the total number of connections in a stack is the sum of all
90 * of them. Since there is no lock for handling all of them exclusively, the
91 * resulting sum is only an approximation.
92 *
93 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
94 * connection won't interfere with new ones.
95 *
96 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
97 * the timer is handled within the context of this tcp_t. When the timer
98 * fires, tcp_clean_death() is called. If upper layer closes the connection
99 * during this period, tcp_time_wait_append() will be called to add this
100 * tcp_t to the global TIME-WAIT list. Note that this means that the
101 * actual wait time in TIME-WAIT state will be longer than the
102 * tcps_time_wait_interval since the period before upper layer closes the
103 * connection is not accounted for when tcp_time_wait_append() is called.
104 *
105 * If upper layer has closed the connection, call tcp_time_wait_append()
106 * directly.
107 *
108 */
109 #define SET_TIME_WAIT(tcps, tcp, connp) \
110 { \
111 (tcp)->tcp_state = TCPS_TIME_WAIT; \
112 if ((tcp)->tcp_listen_cnt != NULL) \
113 TCP_DECR_LISTEN_CNT(tcp); \
114 atomic_dec_64( \
115 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
116 (connp)->conn_exclbind = 0; \
117 if (!TCP_IS_DETACHED(tcp)) { \
118 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
119 } else { \
120 tcp_time_wait_append(tcp); \
121 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
122 } \
123 }
124
125 /*
126 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
127 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
128 * data, TCP will not respond with an ACK. RFC 793 requires that
129 * TCP responds with an ACK for such a bogus ACK. By not following
130 * the RFC, we prevent TCP from getting into an ACK storm if somehow
131 * an attacker successfully spoofs an acceptable segment to our
132 * peer; or when our peer is "confused."
133 */
134 static uint32_t tcp_drop_ack_unsent_cnt = 10;
135
136 /*
137 * To protect TCP against attacker using a small window and requesting
138 * large amount of data (DoS attack by conuming memory), TCP checks the
139 * window advertised in the last ACK of the 3-way handshake. TCP uses
140 * the tcp_mss (the size of one packet) value for comparion. The window
141 * should be larger than tcp_mss. But while a sane TCP should advertise
142 * a receive window larger than or equal to 4*MSS to avoid stop and go
143 * tarrfic, not all TCP stacks do that. This is especially true when
144 * tcp_mss is a big value.
145 *
146 * To work around this issue, an additional fixed value for comparison
147 * is also used. If the advertised window is smaller than both tcp_mss
148 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
149 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
150 * smaller than 8K is considered to be OK.
151 */
152 static uint32_t tcp_init_wnd_chk = 4096;
153
154 /* Process ICMP source quench message or not. */
155 static boolean_t tcp_icmp_source_quench = B_FALSE;
156
157 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
158
159 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
160 ip_recv_attr_t *);
161 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
162 ip_recv_attr_t *);
163 static boolean_t tcp_drop_q0(tcp_t *);
164 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
165 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
166 ip_recv_attr_t *);
167 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
168 static boolean_t tcp_process_options(mblk_t *mp, tcp_t *, tcpha_t *,
169 ip_recv_attr_t *);
170 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
171 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
172 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
173 static void tcp_set_rto(tcp_t *, hrtime_t);
174 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
175
176 /*
177 * CC wrapper hook functions
178 */
179 static void
cc_ack_received(tcp_t * tcp,uint32_t seg_ack,int32_t bytes_acked,uint16_t type)180 cc_ack_received(tcp_t *tcp, uint32_t seg_ack, int32_t bytes_acked,
181 uint16_t type)
182 {
183 uint32_t old_cwnd = tcp->tcp_cwnd;
184
185 tcp->tcp_ccv.bytes_this_ack = bytes_acked;
186 if (tcp->tcp_cwnd <= tcp->tcp_swnd)
187 tcp->tcp_ccv.flags |= CCF_CWND_LIMITED;
188 else
189 tcp->tcp_ccv.flags &= ~CCF_CWND_LIMITED;
190
191 if (type == CC_ACK) {
192 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
193 if (tcp->tcp_ccv.flags & CCF_RTO)
194 tcp->tcp_ccv.flags &= ~CCF_RTO;
195
196 tcp->tcp_ccv.t_bytes_acked +=
197 min(tcp->tcp_ccv.bytes_this_ack,
198 tcp->tcp_tcps->tcps_abc_l_var * tcp->tcp_mss);
199 if (tcp->tcp_ccv.t_bytes_acked >= tcp->tcp_cwnd) {
200 tcp->tcp_ccv.t_bytes_acked -= tcp->tcp_cwnd;
201 tcp->tcp_ccv.flags |= CCF_ABC_SENTAWND;
202 }
203 } else {
204 tcp->tcp_ccv.flags &= ~CCF_ABC_SENTAWND;
205 tcp->tcp_ccv.t_bytes_acked = 0;
206 }
207 }
208
209 if (CC_ALGO(tcp)->ack_received != NULL) {
210 /*
211 * The FreeBSD code where this originated had a comment "Find
212 * a way to live without this" in several places where curack
213 * got set. If they eventually dump curack from the cc
214 * variables, we'll need to adapt our code.
215 */
216 tcp->tcp_ccv.curack = seg_ack;
217 CC_ALGO(tcp)->ack_received(&tcp->tcp_ccv, type);
218 }
219
220 DTRACE_PROBE3(cwnd__cc__ack__received, tcp_t *, tcp, uint32_t, old_cwnd,
221 uint32_t, tcp->tcp_cwnd);
222 }
223
224 void
cc_cong_signal(tcp_t * tcp,uint32_t seg_ack,uint32_t type)225 cc_cong_signal(tcp_t *tcp, uint32_t seg_ack, uint32_t type)
226 {
227 uint32_t old_cwnd = tcp->tcp_cwnd;
228 uint32_t old_cwnd_ssthresh = tcp->tcp_cwnd_ssthresh;
229 switch (type) {
230 case CC_NDUPACK:
231 if (!IN_FASTRECOVERY(tcp->tcp_ccv.flags)) {
232 tcp->tcp_rexmit_max = tcp->tcp_snxt;
233 if (tcp->tcp_ecn_ok) {
234 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
235 tcp->tcp_cwr = B_TRUE;
236 tcp->tcp_ecn_cwr_sent = B_FALSE;
237 }
238 }
239 break;
240 case CC_ECN:
241 if (!IN_CONGRECOVERY(tcp->tcp_ccv.flags)) {
242 tcp->tcp_rexmit_max = tcp->tcp_snxt;
243 if (tcp->tcp_ecn_ok) {
244 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
245 tcp->tcp_cwr = B_TRUE;
246 tcp->tcp_ecn_cwr_sent = B_FALSE;
247 }
248 }
249 break;
250 case CC_RTO:
251 tcp->tcp_ccv.flags |= CCF_RTO;
252 tcp->tcp_dupack_cnt = 0;
253 tcp->tcp_ccv.t_bytes_acked = 0;
254 /*
255 * Give up on fast recovery and congestion recovery if we were
256 * attempting either.
257 */
258 EXIT_RECOVERY(tcp->tcp_ccv.flags);
259 if (CC_ALGO(tcp)->cong_signal == NULL) {
260 /*
261 * RFC5681 Section 3.1
262 * ssthresh = max (FlightSize / 2, 2*SMSS) eq (4)
263 */
264 tcp->tcp_cwnd_ssthresh = max(
265 (tcp->tcp_snxt - tcp->tcp_suna) / 2 / tcp->tcp_mss,
266 2) * tcp->tcp_mss;
267 tcp->tcp_cwnd = tcp->tcp_mss;
268 }
269
270 if (tcp->tcp_ecn_ok) {
271 tcp->tcp_cwr = B_TRUE;
272 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
273 tcp->tcp_ecn_cwr_sent = B_FALSE;
274 }
275 break;
276 }
277
278 if (CC_ALGO(tcp)->cong_signal != NULL) {
279 tcp->tcp_ccv.curack = seg_ack;
280 CC_ALGO(tcp)->cong_signal(&tcp->tcp_ccv, type);
281 }
282
283 DTRACE_PROBE6(cwnd__cc__cong__signal, tcp_t *, tcp, uint32_t, old_cwnd,
284 uint32_t, tcp->tcp_cwnd, uint32_t, old_cwnd_ssthresh,
285 uint32_t, tcp->tcp_cwnd_ssthresh, uint32_t, type);
286 }
287
288 static void
cc_post_recovery(tcp_t * tcp,uint32_t seg_ack)289 cc_post_recovery(tcp_t *tcp, uint32_t seg_ack)
290 {
291 uint32_t old_cwnd = tcp->tcp_cwnd;
292
293 if (CC_ALGO(tcp)->post_recovery != NULL) {
294 tcp->tcp_ccv.curack = seg_ack;
295 CC_ALGO(tcp)->post_recovery(&tcp->tcp_ccv);
296 }
297 tcp->tcp_ccv.t_bytes_acked = 0;
298
299 DTRACE_PROBE3(cwnd__cc__post__recovery, tcp_t *, tcp,
300 uint32_t, old_cwnd, uint32_t, tcp->tcp_cwnd);
301 }
302
303 /*
304 * Set the MSS associated with a particular tcp based on its current value,
305 * and a new one passed in. Observe minimums and maximums, and reset other
306 * state variables that we want to view as multiples of MSS.
307 *
308 * The value of MSS could be either increased or descreased.
309 */
310 void
tcp_mss_set(tcp_t * tcp,uint32_t mss)311 tcp_mss_set(tcp_t *tcp, uint32_t mss)
312 {
313 uint32_t mss_max;
314 tcp_stack_t *tcps = tcp->tcp_tcps;
315 conn_t *connp = tcp->tcp_connp;
316
317 if (connp->conn_ipversion == IPV4_VERSION)
318 mss_max = tcps->tcps_mss_max_ipv4;
319 else
320 mss_max = tcps->tcps_mss_max_ipv6;
321
322 if (mss < tcps->tcps_mss_min)
323 mss = tcps->tcps_mss_min;
324 if (mss > mss_max)
325 mss = mss_max;
326 /*
327 * Unless naglim has been set by our client to
328 * a non-mss value, force naglim to track mss.
329 * This can help to aggregate small writes.
330 */
331 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
332 tcp->tcp_naglim = mss;
333 /*
334 * TCP should be able to buffer at least 4 MSS data for obvious
335 * performance reason.
336 */
337 if ((mss << 2) > connp->conn_sndbuf)
338 connp->conn_sndbuf = mss << 2;
339
340 /*
341 * Set the send lowater to at least twice of MSS.
342 */
343 if ((mss << 1) > connp->conn_sndlowat)
344 connp->conn_sndlowat = mss << 1;
345
346 /*
347 * Update tcp_cwnd according to the new value of MSS. Keep the
348 * previous ratio to preserve the transmit rate.
349 */
350 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
351 tcp->tcp_cwnd_cnt = 0;
352
353 tcp->tcp_mss = mss;
354 (void) tcp_maxpsz_set(tcp, B_TRUE);
355 }
356
357 /*
358 * Extract option values from a tcp header. We put any found values into the
359 * tcpopt struct and return a bitmask saying which options were found.
360 */
361 int
tcp_parse_options(tcpha_t * tcpha,tcp_opt_t * tcpopt)362 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
363 {
364 uchar_t *endp;
365 int len;
366 uint32_t mss;
367 uchar_t *up = (uchar_t *)tcpha;
368 int found = 0;
369 int32_t sack_len;
370 tcp_seq sack_begin, sack_end;
371 tcp_t *tcp;
372
373 endp = up + TCP_HDR_LENGTH(tcpha);
374 up += TCP_MIN_HEADER_LENGTH;
375 /*
376 * If timestamp option is aligned as recommended in RFC 7323 Appendix
377 * A, and is the only option, return quickly.
378 */
379 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
380 TCPOPT_REAL_TS_LEN &&
381 OK_32PTR(up) &&
382 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
383 tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4));
384 tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
385
386 return (TCP_OPT_TSTAMP_PRESENT);
387 }
388 while (up < endp) {
389 len = endp - up;
390 switch (*up) {
391 case TCPOPT_EOL:
392 break;
393
394 case TCPOPT_NOP:
395 up++;
396 continue;
397
398 case TCPOPT_MAXSEG:
399 if (len < TCPOPT_MAXSEG_LEN ||
400 up[1] != TCPOPT_MAXSEG_LEN)
401 break;
402
403 mss = BE16_TO_U16(up+2);
404 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
405 tcpopt->tcp_opt_mss = mss;
406 found |= TCP_OPT_MSS_PRESENT;
407
408 up += TCPOPT_MAXSEG_LEN;
409 continue;
410
411 case TCPOPT_WSCALE:
412 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
413 break;
414
415 if (up[2] > TCP_MAX_WINSHIFT)
416 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
417 else
418 tcpopt->tcp_opt_wscale = up[2];
419 found |= TCP_OPT_WSCALE_PRESENT;
420
421 up += TCPOPT_WS_LEN;
422 continue;
423
424 case TCPOPT_SACK_PERMITTED:
425 if (len < TCPOPT_SACK_OK_LEN ||
426 up[1] != TCPOPT_SACK_OK_LEN)
427 break;
428 found |= TCP_OPT_SACK_OK_PRESENT;
429 up += TCPOPT_SACK_OK_LEN;
430 continue;
431
432 case TCPOPT_SACK:
433 if (len <= 2 || up[1] <= 2 || len < up[1])
434 break;
435
436 /* If TCP is not interested in SACK blks... */
437 if ((tcp = tcpopt->tcp) == NULL) {
438 up += up[1];
439 continue;
440 }
441 sack_len = up[1] - TCPOPT_HEADER_LEN;
442 up += TCPOPT_HEADER_LEN;
443
444 /*
445 * If the list is empty, allocate one and assume
446 * nothing is sack'ed.
447 */
448 if (tcp->tcp_notsack_list == NULL) {
449 tcp_notsack_update(&(tcp->tcp_notsack_list),
450 tcp->tcp_suna, tcp->tcp_snxt,
451 &(tcp->tcp_num_notsack_blk),
452 &(tcp->tcp_cnt_notsack_list));
453
454 /*
455 * Make sure tcp_notsack_list is not NULL.
456 * This happens when kmem_alloc(KM_NOSLEEP)
457 * returns NULL.
458 */
459 if (tcp->tcp_notsack_list == NULL) {
460 up += sack_len;
461 continue;
462 }
463 tcp->tcp_fack = tcp->tcp_suna;
464 }
465
466 while (sack_len > 0) {
467 if (up + 8 > endp) {
468 up = endp;
469 break;
470 }
471 sack_begin = BE32_TO_U32(up);
472 up += 4;
473 sack_end = BE32_TO_U32(up);
474 up += 4;
475 sack_len -= 8;
476 /*
477 * Bounds checking. Make sure the SACK
478 * info is within tcp_suna and tcp_snxt.
479 * If this SACK blk is out of bound, ignore
480 * it but continue to parse the following
481 * blks.
482 */
483 if (SEQ_LEQ(sack_end, sack_begin) ||
484 SEQ_LT(sack_begin, tcp->tcp_suna) ||
485 SEQ_GT(sack_end, tcp->tcp_snxt)) {
486 continue;
487 }
488 tcp_notsack_insert(&(tcp->tcp_notsack_list),
489 sack_begin, sack_end,
490 &(tcp->tcp_num_notsack_blk),
491 &(tcp->tcp_cnt_notsack_list));
492 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
493 tcp->tcp_fack = sack_end;
494 }
495 }
496 found |= TCP_OPT_SACK_PRESENT;
497 continue;
498
499 case TCPOPT_TSTAMP:
500 if (len < TCPOPT_TSTAMP_LEN ||
501 up[1] != TCPOPT_TSTAMP_LEN)
502 break;
503
504 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
505 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
506
507 found |= TCP_OPT_TSTAMP_PRESENT;
508
509 up += TCPOPT_TSTAMP_LEN;
510 continue;
511
512 case TCPOPT_MD5:
513 if (len < TCPOPT_MD5_LEN || up[1] != TCPOPT_MD5_LEN)
514 break;
515
516 bcopy(up + 2, tcpopt->tcp_opt_sig,
517 sizeof (tcpopt->tcp_opt_sig));
518
519 found |= TCP_OPT_SIG_PRESENT;
520 up += TCPOPT_MD5_LEN;
521 continue;
522
523 default:
524 if (len <= 1 || len < (int)up[1] || up[1] == 0)
525 break;
526 up += up[1];
527 continue;
528 }
529 break;
530 }
531 return (found);
532 }
533
534 /*
535 * Process all TCP option in SYN segment. Note that this function should
536 * be called after tcp_set_destination() is called so that the necessary info
537 * from IRE is already set in the tcp structure.
538 *
539 * This function sets up the correct tcp_mss value according to the
540 * MSS option value and our header size. It also sets up the window scale
541 * and timestamp values, and initialize SACK info blocks. But it does not
542 * change receive window size after setting the tcp_mss value. The caller
543 * should do the appropriate change.
544 */
545 static boolean_t
tcp_process_options(mblk_t * mp,tcp_t * tcp,tcpha_t * tcpha,ip_recv_attr_t * ira)546 tcp_process_options(mblk_t *mp, tcp_t *tcp, tcpha_t *tcpha, ip_recv_attr_t *ira)
547 {
548 int options;
549 tcp_opt_t tcpopt;
550 uint32_t mss_max;
551 char *tmp_tcph;
552 tcp_stack_t *tcps = tcp->tcp_tcps;
553 conn_t *connp = tcp->tcp_connp;
554
555 tcpopt.tcp = NULL;
556 options = tcp_parse_options(tcpha, &tcpopt);
557
558 if (tcp->tcp_md5sig) {
559 if ((options & TCP_OPT_SIG_PRESENT) == 0) {
560 TCP_STAT(tcp->tcp_tcps, tcp_sig_no_option);
561 return (B_FALSE);
562 }
563 if (!tcpsig_verify(mp->b_cont, tcp, tcpha, ira,
564 tcpopt.tcp_opt_sig)) {
565 return (B_FALSE);
566 }
567 }
568
569 /*
570 * Process MSS option. Note that MSS option value does not account
571 * for IP or TCP options. This means that it is equal to MTU - minimum
572 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
573 * IPv6.
574 */
575 if (!(options & TCP_OPT_MSS_PRESENT)) {
576 if (connp->conn_ipversion == IPV4_VERSION)
577 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
578 else
579 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
580 } else {
581 if (connp->conn_ipversion == IPV4_VERSION)
582 mss_max = tcps->tcps_mss_max_ipv4;
583 else
584 mss_max = tcps->tcps_mss_max_ipv6;
585 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
586 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
587 else if (tcpopt.tcp_opt_mss > mss_max)
588 tcpopt.tcp_opt_mss = mss_max;
589 }
590
591 /* Process Window Scale option. */
592 if (options & TCP_OPT_WSCALE_PRESENT) {
593 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
594 tcp->tcp_snd_ws_ok = B_TRUE;
595 } else {
596 tcp->tcp_snd_ws = B_FALSE;
597 tcp->tcp_snd_ws_ok = B_FALSE;
598 tcp->tcp_rcv_ws = B_FALSE;
599 }
600
601 /* Process Timestamp option. */
602 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
603 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
604 tmp_tcph = (char *)tcp->tcp_tcpha;
605
606 tcp->tcp_snd_ts_ok = B_TRUE;
607 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
608 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
609 ASSERT(OK_32PTR(tmp_tcph));
610 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
611
612 /* Fill in our template header with basic timestamp option. */
613 tmp_tcph += connp->conn_ht_ulp_len;
614 tmp_tcph[0] = TCPOPT_NOP;
615 tmp_tcph[1] = TCPOPT_NOP;
616 tmp_tcph[2] = TCPOPT_TSTAMP;
617 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
618 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
619 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
620 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
621 } else {
622 tcp->tcp_snd_ts_ok = B_FALSE;
623 }
624
625 /*
626 * Process SACK options. If SACK is enabled for this connection,
627 * then allocate the SACK info structure. Note the following ways
628 * when tcp_snd_sack_ok is set to true.
629 *
630 * For active connection: in tcp_set_destination() called in
631 * tcp_connect().
632 *
633 * For passive connection: in tcp_set_destination() called in
634 * tcp_input_listener().
635 *
636 * That's the reason why the extra TCP_IS_DETACHED() check is there.
637 * That check makes sure that if we did not send a SACK OK option,
638 * we will not enable SACK for this connection even though the other
639 * side sends us SACK OK option. For active connection, the SACK
640 * info structure has already been allocated. So we need to free
641 * it if SACK is disabled.
642 */
643 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
644 (tcp->tcp_snd_sack_ok ||
645 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
646 ASSERT(tcp->tcp_num_sack_blk == 0);
647 ASSERT(tcp->tcp_notsack_list == NULL);
648
649 tcp->tcp_snd_sack_ok = B_TRUE;
650 if (tcp->tcp_snd_ts_ok) {
651 tcp->tcp_max_sack_blk = 3;
652 } else {
653 tcp->tcp_max_sack_blk = 4;
654 }
655 } else if (tcp->tcp_snd_sack_ok) {
656 /*
657 * Resetting tcp_snd_sack_ok to B_FALSE so that
658 * no SACK info will be used for this
659 * connection. This assumes that SACK usage
660 * permission is negotiated. This may need
661 * to be changed once this is clarified.
662 */
663 ASSERT(tcp->tcp_num_sack_blk == 0);
664 ASSERT(tcp->tcp_notsack_list == NULL);
665 tcp->tcp_snd_sack_ok = B_FALSE;
666 }
667
668 /*
669 * Now we know the exact TCP/IP header length, subtract
670 * that from tcp_mss to get our side's MSS.
671 */
672 tcp->tcp_mss -= connp->conn_ht_iphc_len;
673
674 /*
675 * Here we assume that the other side's header size will be equal to
676 * our header size. We calculate the real MSS accordingly. Need to
677 * take into additional stuffs IPsec puts in.
678 *
679 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
680 */
681 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
682 tcp->tcp_ipsec_overhead -
683 ((connp->conn_ipversion == IPV4_VERSION ?
684 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
685
686 /*
687 * Set MSS to the smaller one of both ends of the connection.
688 * We should not have called tcp_mss_set() before, but our
689 * side of the MSS should have been set to a proper value
690 * by tcp_set_destination(). tcp_mss_set() will also set up the
691 * STREAM head parameters properly.
692 *
693 * If we have a larger-than-16-bit window but the other side
694 * didn't want to do window scale, tcp_rwnd_set() will take
695 * care of that.
696 */
697 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
698
699 /*
700 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
701 * updated properly.
702 */
703 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
704
705 if (tcp->tcp_cc_algo->conn_init != NULL)
706 tcp->tcp_cc_algo->conn_init(&tcp->tcp_ccv);
707
708 return (B_TRUE);
709 }
710
711 /*
712 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
713 * is filled, return as much as we can. The message passed in may be
714 * multi-part, chained using b_cont. "start" is the starting sequence
715 * number for this piece.
716 */
717 static mblk_t *
tcp_reass(tcp_t * tcp,mblk_t * mp,uint32_t start)718 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
719 {
720 uint32_t end, bytes;
721 mblk_t *mp1;
722 mblk_t *mp2;
723 mblk_t *next_mp;
724 uint32_t u1;
725 tcp_stack_t *tcps = tcp->tcp_tcps;
726
727
728 /* Walk through all the new pieces. */
729 do {
730 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
731 (uintptr_t)INT_MAX);
732 end = start + (int)(mp->b_wptr - mp->b_rptr);
733 next_mp = mp->b_cont;
734 if (start == end) {
735 /* Empty. Blast it. */
736 freeb(mp);
737 continue;
738 }
739 bytes = end - start;
740 mp->b_cont = NULL;
741 TCP_REASS_SET_SEQ(mp, start);
742 TCP_REASS_SET_END(mp, end);
743 mp1 = tcp->tcp_reass_tail;
744 if (mp1 == NULL || SEQ_GEQ(start, TCP_REASS_END(mp1))) {
745 if (mp1 != NULL) {
746 /*
747 * New stuff is beyond the tail; link it on the
748 * end.
749 */
750 mp1->b_cont = mp;
751 } else {
752 tcp->tcp_reass_head = mp;
753 }
754 tcp->tcp_reass_tail = mp;
755 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
756 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, bytes);
757 tcp->tcp_cs.tcp_in_data_unorder_segs++;
758 tcp->tcp_cs.tcp_in_data_unorder_bytes += bytes;
759 continue;
760 }
761 mp1 = tcp->tcp_reass_head;
762 u1 = TCP_REASS_SEQ(mp1);
763 /* New stuff at the front? */
764 if (SEQ_LT(start, u1)) {
765 /* Yes... Check for overlap. */
766 mp->b_cont = mp1;
767 tcp->tcp_reass_head = mp;
768 tcp_reass_elim_overlap(tcp, mp);
769 continue;
770 }
771 /*
772 * The new piece fits somewhere between the head and tail.
773 * We find our slot, where mp1 precedes us and mp2 trails.
774 */
775 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
776 u1 = TCP_REASS_SEQ(mp2);
777 if (SEQ_LEQ(start, u1))
778 break;
779 }
780 /* Link ourselves in */
781 mp->b_cont = mp2;
782 mp1->b_cont = mp;
783
784 /* Trim overlap with following mblk(s) first */
785 tcp_reass_elim_overlap(tcp, mp);
786
787 /* Trim overlap with preceding mblk */
788 tcp_reass_elim_overlap(tcp, mp1);
789
790 } while (start = end, mp = next_mp);
791 mp1 = tcp->tcp_reass_head;
792 /* Anything ready to go? */
793 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
794 return (NULL);
795 /* Eat what we can off the queue */
796 for (;;) {
797 mp = mp1->b_cont;
798 end = TCP_REASS_END(mp1);
799 TCP_REASS_SET_SEQ(mp1, 0);
800 TCP_REASS_SET_END(mp1, 0);
801 if (!mp) {
802 tcp->tcp_reass_tail = NULL;
803 break;
804 }
805 if (end != TCP_REASS_SEQ(mp)) {
806 mp1->b_cont = NULL;
807 break;
808 }
809 mp1 = mp;
810 }
811 mp1 = tcp->tcp_reass_head;
812 tcp->tcp_reass_head = mp;
813 return (mp1);
814 }
815
816 /* Eliminate any overlap that mp may have over later mblks */
817 static void
tcp_reass_elim_overlap(tcp_t * tcp,mblk_t * mp)818 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
819 {
820 uint32_t end;
821 mblk_t *mp1;
822 uint32_t u1;
823 tcp_stack_t *tcps = tcp->tcp_tcps;
824
825 end = TCP_REASS_END(mp);
826 while ((mp1 = mp->b_cont) != NULL) {
827 u1 = TCP_REASS_SEQ(mp1);
828 if (!SEQ_GT(end, u1))
829 break;
830 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
831 mp->b_wptr -= end - u1;
832 TCP_REASS_SET_END(mp, u1);
833 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
834 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
835 end - u1);
836 break;
837 }
838 mp->b_cont = mp1->b_cont;
839 TCP_REASS_SET_SEQ(mp1, 0);
840 TCP_REASS_SET_END(mp1, 0);
841 freeb(mp1);
842 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
843 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
844 }
845 if (!mp1)
846 tcp->tcp_reass_tail = mp;
847 }
848
849 /*
850 * This function does PAWS protection check, per RFC 7323 section 5. Requires
851 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
852 * the segment passes the PAWS test, else returns B_FALSE.
853 */
854 boolean_t
tcp_paws_check(tcp_t * tcp,const tcp_opt_t * tcpoptp)855 tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp)
856 {
857 if (TSTMP_LT(tcpoptp->tcp_opt_ts_val,
858 tcp->tcp_ts_recent)) {
859 if (LBOLT_FASTPATH64 <
860 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
861 /* This segment is not acceptable. */
862 return (B_FALSE);
863 } else {
864 /*
865 * Connection has been idle for
866 * too long. Reset the timestamp
867 */
868 tcp->tcp_ts_recent =
869 tcpoptp->tcp_opt_ts_val;
870 }
871 }
872 return (B_TRUE);
873 }
874
875 /*
876 * Defense for the SYN attack -
877 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
878 * one from the list of droppable eagers. This list is a subset of q0.
879 * see comments before the definition of MAKE_DROPPABLE().
880 * 2. Don't drop a SYN request before its first timeout. This gives every
881 * request at least til the first timeout to complete its 3-way handshake.
882 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
883 * requests currently on the queue that has timed out. This will be used
884 * as an indicator of whether an attack is under way, so that appropriate
885 * actions can be taken. (It's incremented in tcp_timer() and decremented
886 * either when eager goes into ESTABLISHED, or gets freed up.)
887 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
888 * # of timeout drops back to <= q0len/32 => SYN alert off
889 */
890 static boolean_t
tcp_drop_q0(tcp_t * tcp)891 tcp_drop_q0(tcp_t *tcp)
892 {
893 tcp_t *eager;
894 mblk_t *mp;
895 tcp_stack_t *tcps = tcp->tcp_tcps;
896
897 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
898 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
899
900 /* Pick oldest eager from the list of droppable eagers */
901 eager = tcp->tcp_eager_prev_drop_q0;
902
903 /* If list is empty. return B_FALSE */
904 if (eager == tcp) {
905 return (B_FALSE);
906 }
907
908 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
909 if ((mp = allocb(0, BPRI_HI)) == NULL)
910 return (B_FALSE);
911
912 /*
913 * Take this eager out from the list of droppable eagers since we are
914 * going to drop it.
915 */
916 MAKE_UNDROPPABLE(eager);
917
918 if (tcp->tcp_connp->conn_debug) {
919 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
920 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
921 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
922 tcp->tcp_conn_req_cnt_q0,
923 tcp_display(tcp, NULL, DISP_PORT_ONLY));
924 }
925
926 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
927
928 /* Put a reference on the conn as we are enqueueing it in the sqeue */
929 CONN_INC_REF(eager->tcp_connp);
930
931 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
932 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
933 SQ_FILL, SQTAG_TCP_DROP_Q0);
934
935 return (B_TRUE);
936 }
937
938 /*
939 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
940 */
941 static mblk_t *
tcp_conn_create_v6(conn_t * lconnp,conn_t * connp,mblk_t * mp,ip_recv_attr_t * ira)942 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
943 ip_recv_attr_t *ira)
944 {
945 tcp_t *ltcp = lconnp->conn_tcp;
946 tcp_t *tcp = connp->conn_tcp;
947 mblk_t *tpi_mp;
948 ipha_t *ipha;
949 ip6_t *ip6h;
950 sin6_t sin6;
951 uint_t ifindex = ira->ira_ruifindex;
952 tcp_stack_t *tcps = tcp->tcp_tcps;
953
954 if (ira->ira_flags & IRAF_IS_IPV4) {
955 ipha = (ipha_t *)mp->b_rptr;
956
957 connp->conn_ipversion = IPV4_VERSION;
958 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
959 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
960 connp->conn_saddr_v6 = connp->conn_laddr_v6;
961
962 sin6 = sin6_null;
963 sin6.sin6_addr = connp->conn_faddr_v6;
964 sin6.sin6_port = connp->conn_fport;
965 sin6.sin6_family = AF_INET6;
966 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
967 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
968
969 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
970 sin6_t sin6d;
971
972 sin6d = sin6_null;
973 sin6d.sin6_addr = connp->conn_laddr_v6;
974 sin6d.sin6_port = connp->conn_lport;
975 sin6d.sin6_family = AF_INET;
976 tpi_mp = mi_tpi_extconn_ind(NULL,
977 (char *)&sin6d, sizeof (sin6_t),
978 (char *)&tcp,
979 (t_scalar_t)sizeof (intptr_t),
980 (char *)&sin6d, sizeof (sin6_t),
981 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
982 } else {
983 tpi_mp = mi_tpi_conn_ind(NULL,
984 (char *)&sin6, sizeof (sin6_t),
985 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
986 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
987 }
988 } else {
989 ip6h = (ip6_t *)mp->b_rptr;
990
991 connp->conn_ipversion = IPV6_VERSION;
992 connp->conn_laddr_v6 = ip6h->ip6_dst;
993 connp->conn_faddr_v6 = ip6h->ip6_src;
994 connp->conn_saddr_v6 = connp->conn_laddr_v6;
995
996 sin6 = sin6_null;
997 sin6.sin6_addr = connp->conn_faddr_v6;
998 sin6.sin6_port = connp->conn_fport;
999 sin6.sin6_family = AF_INET6;
1000 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
1001 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
1002 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
1003
1004 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
1005 /* Pass up the scope_id of remote addr */
1006 sin6.sin6_scope_id = ifindex;
1007 } else {
1008 sin6.sin6_scope_id = 0;
1009 }
1010 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
1011 sin6_t sin6d;
1012
1013 sin6d = sin6_null;
1014 sin6.sin6_addr = connp->conn_laddr_v6;
1015 sin6d.sin6_port = connp->conn_lport;
1016 sin6d.sin6_family = AF_INET6;
1017 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
1018 sin6d.sin6_scope_id = ifindex;
1019
1020 tpi_mp = mi_tpi_extconn_ind(NULL,
1021 (char *)&sin6d, sizeof (sin6_t),
1022 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
1023 (char *)&sin6d, sizeof (sin6_t),
1024 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1025 } else {
1026 tpi_mp = mi_tpi_conn_ind(NULL,
1027 (char *)&sin6, sizeof (sin6_t),
1028 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
1029 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1030 }
1031 }
1032
1033 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
1034 return (tpi_mp);
1035 }
1036
1037 /* Handle a SYN on an AF_INET socket */
1038 static mblk_t *
tcp_conn_create_v4(conn_t * lconnp,conn_t * connp,mblk_t * mp,ip_recv_attr_t * ira)1039 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
1040 ip_recv_attr_t *ira)
1041 {
1042 tcp_t *ltcp = lconnp->conn_tcp;
1043 tcp_t *tcp = connp->conn_tcp;
1044 sin_t sin;
1045 mblk_t *tpi_mp = NULL;
1046 tcp_stack_t *tcps = tcp->tcp_tcps;
1047 ipha_t *ipha;
1048
1049 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
1050 ipha = (ipha_t *)mp->b_rptr;
1051
1052 connp->conn_ipversion = IPV4_VERSION;
1053 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
1054 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
1055 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1056
1057 sin = sin_null;
1058 sin.sin_addr.s_addr = connp->conn_faddr_v4;
1059 sin.sin_port = connp->conn_fport;
1060 sin.sin_family = AF_INET;
1061 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
1062 sin_t sind;
1063
1064 sind = sin_null;
1065 sind.sin_addr.s_addr = connp->conn_laddr_v4;
1066 sind.sin_port = connp->conn_lport;
1067 sind.sin_family = AF_INET;
1068 tpi_mp = mi_tpi_extconn_ind(NULL,
1069 (char *)&sind, sizeof (sin_t), (char *)&tcp,
1070 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
1071 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1072 } else {
1073 tpi_mp = mi_tpi_conn_ind(NULL,
1074 (char *)&sin, sizeof (sin_t),
1075 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
1076 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1077 }
1078
1079 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
1080 return (tpi_mp);
1081 }
1082
1083 /*
1084 * Called via squeue to get on to eager's perimeter. It sends a
1085 * TH_RST if eager is in the fanout table. The listener wants the
1086 * eager to disappear either by means of tcp_eager_blowoff() or
1087 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
1088 * called (via squeue) if the eager cannot be inserted in the
1089 * fanout table in tcp_input_listener().
1090 */
1091 /* ARGSUSED */
1092 void
tcp_eager_kill(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)1093 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1094 {
1095 conn_t *econnp = (conn_t *)arg;
1096 tcp_t *eager = econnp->conn_tcp;
1097 tcp_t *listener = eager->tcp_listener;
1098
1099 /*
1100 * We could be called because listener is closing. Since
1101 * the eager was using listener's queue's, we avoid
1102 * using the listeners queues from now on.
1103 */
1104 ASSERT(eager->tcp_detached);
1105 econnp->conn_rq = NULL;
1106 econnp->conn_wq = NULL;
1107
1108 /*
1109 * An eager's conn_fanout will be NULL if it's a duplicate
1110 * for an existing 4-tuples in the conn fanout table.
1111 * We don't want to send an RST out in such case.
1112 */
1113 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1114 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1115 eager, eager->tcp_snxt, 0, TH_RST);
1116 }
1117
1118 /* We are here because listener wants this eager gone */
1119 if (listener != NULL) {
1120 mutex_enter(&listener->tcp_eager_lock);
1121 tcp_eager_unlink(eager);
1122 if (eager->tcp_tconnind_started) {
1123 /*
1124 * The eager has sent a conn_ind up to the
1125 * listener but listener decides to close
1126 * instead. We need to drop the extra ref
1127 * placed on eager in tcp_input_data() before
1128 * sending the conn_ind to listener.
1129 */
1130 CONN_DEC_REF(econnp);
1131 }
1132 mutex_exit(&listener->tcp_eager_lock);
1133 CONN_DEC_REF(listener->tcp_connp);
1134 }
1135
1136 if (eager->tcp_state != TCPS_CLOSED)
1137 tcp_close_detached(eager);
1138 }
1139
1140 /*
1141 * Reset any eager connection hanging off this listener marked
1142 * with 'seqnum' and then reclaim it's resources.
1143 */
1144 boolean_t
tcp_eager_blowoff(tcp_t * listener,t_scalar_t seqnum)1145 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1146 {
1147 tcp_t *eager;
1148 mblk_t *mp;
1149
1150 eager = listener;
1151 mutex_enter(&listener->tcp_eager_lock);
1152 do {
1153 eager = eager->tcp_eager_next_q;
1154 if (eager == NULL) {
1155 mutex_exit(&listener->tcp_eager_lock);
1156 return (B_FALSE);
1157 }
1158 } while (eager->tcp_conn_req_seqnum != seqnum);
1159
1160 if (eager->tcp_closemp_used) {
1161 mutex_exit(&listener->tcp_eager_lock);
1162 return (B_TRUE);
1163 }
1164 eager->tcp_closemp_used = B_TRUE;
1165 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1166 CONN_INC_REF(eager->tcp_connp);
1167 mutex_exit(&listener->tcp_eager_lock);
1168 mp = &eager->tcp_closemp;
1169 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1170 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1171 return (B_TRUE);
1172 }
1173
1174 /*
1175 * Reset any eager connection hanging off this listener
1176 * and then reclaim it's resources.
1177 */
1178 void
tcp_eager_cleanup(tcp_t * listener,boolean_t q0_only)1179 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1180 {
1181 tcp_t *eager;
1182 mblk_t *mp;
1183 tcp_stack_t *tcps = listener->tcp_tcps;
1184
1185 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1186
1187 if (!q0_only) {
1188 /* First cleanup q */
1189 TCP_STAT(tcps, tcp_eager_blowoff_q);
1190 eager = listener->tcp_eager_next_q;
1191 while (eager != NULL) {
1192 if (!eager->tcp_closemp_used) {
1193 eager->tcp_closemp_used = B_TRUE;
1194 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1195 CONN_INC_REF(eager->tcp_connp);
1196 mp = &eager->tcp_closemp;
1197 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1198 tcp_eager_kill, eager->tcp_connp, NULL,
1199 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1200 }
1201 eager = eager->tcp_eager_next_q;
1202 }
1203 }
1204 /* Then cleanup q0 */
1205 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1206 eager = listener->tcp_eager_next_q0;
1207 while (eager != listener) {
1208 if (!eager->tcp_closemp_used) {
1209 eager->tcp_closemp_used = B_TRUE;
1210 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1211 CONN_INC_REF(eager->tcp_connp);
1212 mp = &eager->tcp_closemp;
1213 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1214 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1215 SQTAG_TCP_EAGER_CLEANUP_Q0);
1216 }
1217 eager = eager->tcp_eager_next_q0;
1218 }
1219 }
1220
1221 /*
1222 * If we are an eager connection hanging off a listener that hasn't
1223 * formally accepted the connection yet, get off its list and blow off
1224 * any data that we have accumulated.
1225 */
1226 void
tcp_eager_unlink(tcp_t * tcp)1227 tcp_eager_unlink(tcp_t *tcp)
1228 {
1229 tcp_t *listener = tcp->tcp_listener;
1230
1231 ASSERT(listener != NULL);
1232 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1233 if (tcp->tcp_eager_next_q0 != NULL) {
1234 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1235
1236 /* Remove the eager tcp from q0 */
1237 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1238 tcp->tcp_eager_prev_q0;
1239 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1240 tcp->tcp_eager_next_q0;
1241 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1242 listener->tcp_conn_req_cnt_q0--;
1243
1244 tcp->tcp_eager_next_q0 = NULL;
1245 tcp->tcp_eager_prev_q0 = NULL;
1246
1247 /*
1248 * Take the eager out, if it is in the list of droppable
1249 * eagers.
1250 */
1251 MAKE_UNDROPPABLE(tcp);
1252
1253 if (tcp->tcp_syn_rcvd_timeout != 0) {
1254 /* we have timed out before */
1255 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1256 listener->tcp_syn_rcvd_timeout--;
1257 }
1258 } else {
1259 tcp_t **tcpp = &listener->tcp_eager_next_q;
1260 tcp_t *prev = NULL;
1261
1262 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1263 if (tcpp[0] == tcp) {
1264 if (listener->tcp_eager_last_q == tcp) {
1265 /*
1266 * If we are unlinking the last
1267 * element on the list, adjust
1268 * tail pointer. Set tail pointer
1269 * to nil when list is empty.
1270 */
1271 ASSERT(tcp->tcp_eager_next_q == NULL);
1272 if (listener->tcp_eager_last_q ==
1273 listener->tcp_eager_next_q) {
1274 listener->tcp_eager_last_q =
1275 NULL;
1276 } else {
1277 /*
1278 * We won't get here if there
1279 * is only one eager in the
1280 * list.
1281 */
1282 ASSERT(prev != NULL);
1283 listener->tcp_eager_last_q =
1284 prev;
1285 }
1286 }
1287 tcpp[0] = tcp->tcp_eager_next_q;
1288 tcp->tcp_eager_next_q = NULL;
1289 tcp->tcp_eager_last_q = NULL;
1290 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1291 listener->tcp_conn_req_cnt_q--;
1292 break;
1293 }
1294 prev = tcpp[0];
1295 }
1296 }
1297 tcp->tcp_listener = NULL;
1298 }
1299
1300 /* BEGIN CSTYLED */
1301 /*
1302 *
1303 * The sockfs ACCEPT path:
1304 * =======================
1305 *
1306 * The eager is now established in its own perimeter as soon as SYN is
1307 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1308 * completes the accept processing on the acceptor STREAM. The sending
1309 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1310 * listener but a TLI/XTI listener completes the accept processing
1311 * on the listener perimeter.
1312 *
1313 * Common control flow for 3 way handshake:
1314 * ----------------------------------------
1315 *
1316 * incoming SYN (listener perimeter) -> tcp_input_listener()
1317 *
1318 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1319 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1320 *
1321 * Sockfs ACCEPT Path:
1322 * -------------------
1323 *
1324 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1325 * as STREAM entry point)
1326 *
1327 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1328 *
1329 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1330 * association (we are not behind eager's squeue but sockfs is protecting us
1331 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1332 * is changed to point at tcp_wput().
1333 *
1334 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1335 * listener (done on listener's perimeter).
1336 *
1337 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1338 * accept.
1339 *
1340 * TLI/XTI client ACCEPT path:
1341 * ---------------------------
1342 *
1343 * soaccept() sends T_CONN_RES on the listener STREAM.
1344 *
1345 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1346 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1347 *
1348 * Locks:
1349 * ======
1350 *
1351 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1352 * and listeners->tcp_eager_next_q.
1353 *
1354 * Referencing:
1355 * ============
1356 *
1357 * 1) We start out in tcp_input_listener by eager placing a ref on
1358 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1359 *
1360 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1361 * doing so we place a ref on the eager. This ref is finally dropped at the
1362 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1363 * reference is dropped by the squeue framework.
1364 *
1365 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1366 *
1367 * The reference must be released by the same entity that added the reference
1368 * In the above scheme, the eager is the entity that adds and releases the
1369 * references. Note that tcp_accept_finish executes in the squeue of the eager
1370 * (albeit after it is attached to the acceptor stream). Though 1. executes
1371 * in the listener's squeue, the eager is nascent at this point and the
1372 * reference can be considered to have been added on behalf of the eager.
1373 *
1374 * Eager getting a Reset or listener closing:
1375 * ==========================================
1376 *
1377 * Once the listener and eager are linked, the listener never does the unlink.
1378 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1379 * a message on all eager perimeter. The eager then does the unlink, clears
1380 * any pointers to the listener's queue and drops the reference to the
1381 * listener. The listener waits in tcp_close outside the squeue until its
1382 * refcount has dropped to 1. This ensures that the listener has waited for
1383 * all eagers to clear their association with the listener.
1384 *
1385 * Similarly, if eager decides to go away, it can unlink itself and close.
1386 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1387 * the reference to eager is still valid because of the extra ref we put
1388 * in tcp_send_conn_ind.
1389 *
1390 * Listener can always locate the eager under the protection
1391 * of the listener->tcp_eager_lock, and then do a refhold
1392 * on the eager during the accept processing.
1393 *
1394 * The acceptor stream accesses the eager in the accept processing
1395 * based on the ref placed on eager before sending T_conn_ind.
1396 * The only entity that can negate this refhold is a listener close
1397 * which is mutually exclusive with an active acceptor stream.
1398 *
1399 * Eager's reference on the listener
1400 * ===================================
1401 *
1402 * If the accept happens (even on a closed eager) the eager drops its
1403 * reference on the listener at the start of tcp_accept_finish. If the
1404 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1405 * the reference is dropped in tcp_closei_local. If the listener closes,
1406 * the reference is dropped in tcp_eager_kill. In all cases the reference
1407 * is dropped while executing in the eager's context (squeue).
1408 */
1409 /* END CSTYLED */
1410
1411 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1412
1413 /*
1414 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1415 * tcp_input_data will not see any packets for listeners since the listener
1416 * has conn_recv set to tcp_input_listener.
1417 */
1418 /* ARGSUSED */
1419 static void
tcp_input_listener(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * ira)1420 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1421 {
1422 tcpha_t *tcpha;
1423 uint32_t seg_seq;
1424 tcp_t *eager;
1425 int err;
1426 conn_t *econnp = NULL;
1427 squeue_t *new_sqp;
1428 mblk_t *mp1;
1429 uint_t ip_hdr_len;
1430 conn_t *lconnp = (conn_t *)arg;
1431 tcp_t *listener = lconnp->conn_tcp;
1432 tcp_stack_t *tcps = listener->tcp_tcps;
1433 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1434 uint_t flags;
1435 mblk_t *tpi_mp;
1436 uint_t ifindex = ira->ira_ruifindex;
1437 boolean_t tlc_set = B_FALSE;
1438
1439 ip_hdr_len = ira->ira_ip_hdr_length;
1440 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1441 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1442
1443 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1444 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1445 __dtrace_tcp_tcph_t *, tcpha);
1446
1447 if (!(flags & TH_SYN)) {
1448 if ((flags & TH_RST) || (flags & TH_URG)) {
1449 freemsg(mp);
1450 return;
1451 }
1452 if (flags & TH_ACK) {
1453 /* Note this executes in listener's squeue */
1454 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1455 return;
1456 }
1457
1458 freemsg(mp);
1459 return;
1460 }
1461
1462 if (listener->tcp_state != TCPS_LISTEN)
1463 goto error2;
1464
1465 ASSERT(IPCL_IS_BOUND(lconnp));
1466
1467 mutex_enter(&listener->tcp_eager_lock);
1468
1469 /*
1470 * The system is under memory pressure, so we need to do our part
1471 * to relieve the pressure. So we only accept new request if there
1472 * is nothing waiting to be accepted or waiting to complete the 3-way
1473 * handshake. This means that busy listener will not get too many
1474 * new requests which they cannot handle in time while non-busy
1475 * listener is still functioning properly.
1476 */
1477 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1478 listener->tcp_conn_req_cnt_q0 > 0)) {
1479 mutex_exit(&listener->tcp_eager_lock);
1480 TCP_STAT(tcps, tcp_listen_mem_drop);
1481 goto error2;
1482 }
1483
1484 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1485 mutex_exit(&listener->tcp_eager_lock);
1486 TCP_STAT(tcps, tcp_listendrop);
1487 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1488 if (lconnp->conn_debug) {
1489 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1490 "tcp_input_listener: listen backlog (max=%d) "
1491 "overflow (%d pending) on %s",
1492 listener->tcp_conn_req_max,
1493 listener->tcp_conn_req_cnt_q,
1494 tcp_display(listener, NULL, DISP_PORT_ONLY));
1495 }
1496 goto error2;
1497 }
1498
1499 if (listener->tcp_conn_req_cnt_q0 >=
1500 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1501 /*
1502 * Q0 is full. Drop a pending half-open req from the queue
1503 * to make room for the new SYN req. Also mark the time we
1504 * drop a SYN.
1505 *
1506 * A more aggressive defense against SYN attack will
1507 * be to set the "tcp_syn_defense" flag now.
1508 */
1509 TCP_STAT(tcps, tcp_listendropq0);
1510 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1511 if (!tcp_drop_q0(listener)) {
1512 mutex_exit(&listener->tcp_eager_lock);
1513 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1514 if (lconnp->conn_debug) {
1515 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1516 "tcp_input_listener: listen half-open "
1517 "queue (max=%d) full (%d pending) on %s",
1518 tcps->tcps_conn_req_max_q0,
1519 listener->tcp_conn_req_cnt_q0,
1520 tcp_display(listener, NULL,
1521 DISP_PORT_ONLY));
1522 }
1523 goto error2;
1524 }
1525 }
1526
1527 /*
1528 * Enforce the limit set on the number of connections per listener.
1529 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1530 * for comparison.
1531 */
1532 if (listener->tcp_listen_cnt != NULL) {
1533 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1534 int64_t now;
1535
1536 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1537 mutex_exit(&listener->tcp_eager_lock);
1538 now = ddi_get_lbolt64();
1539 atomic_dec_32(&tlc->tlc_cnt);
1540 TCP_STAT(tcps, tcp_listen_cnt_drop);
1541 tlc->tlc_drop++;
1542 if (now - tlc->tlc_report_time >
1543 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1544 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1545 "Listener (port %d) connection max (%u) "
1546 "reached: %u attempts dropped total\n",
1547 ntohs(listener->tcp_connp->conn_lport),
1548 tlc->tlc_max, tlc->tlc_drop);
1549 tlc->tlc_report_time = now;
1550 }
1551 goto error2;
1552 }
1553 tlc_set = B_TRUE;
1554 }
1555
1556 mutex_exit(&listener->tcp_eager_lock);
1557
1558 /*
1559 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1560 * or based on the ring (for packets from GLD). Otherwise it is
1561 * set based on lbolt i.e., a somewhat random number.
1562 */
1563 ASSERT(ira->ira_sqp != NULL);
1564 new_sqp = ira->ira_sqp;
1565
1566 econnp = tcp_get_conn(arg2, tcps);
1567 if (econnp == NULL)
1568 goto error2;
1569
1570 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1571 econnp->conn_sqp = new_sqp;
1572 econnp->conn_initial_sqp = new_sqp;
1573 econnp->conn_ixa->ixa_sqp = new_sqp;
1574
1575 econnp->conn_fport = tcpha->tha_lport;
1576 econnp->conn_lport = tcpha->tha_fport;
1577
1578 err = conn_inherit_parent(lconnp, econnp);
1579 if (err != 0)
1580 goto error3;
1581
1582 /* We already know the laddr of the new connection is ours */
1583 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1584
1585 ASSERT(OK_32PTR(mp->b_rptr));
1586 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1587 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1588
1589 if (lconnp->conn_family == AF_INET) {
1590 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1591 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1592 } else {
1593 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1594 }
1595
1596 if (tpi_mp == NULL)
1597 goto error3;
1598
1599 eager = econnp->conn_tcp;
1600 eager->tcp_detached = B_TRUE;
1601 SOCK_CONNID_INIT(eager->tcp_connid);
1602
1603 /*
1604 * Initialize the eager's tcp_t and inherit some parameters from
1605 * the listener.
1606 */
1607 tcp_init_values(eager, listener);
1608
1609 ASSERT((econnp->conn_ixa->ixa_flags &
1610 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1611 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1612 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1613 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1614
1615 if (!tcps->tcps_dev_flow_ctl)
1616 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1617
1618 /* Prepare for diffing against previous packets */
1619 eager->tcp_recvifindex = 0;
1620 eager->tcp_recvhops = 0xffffffffU;
1621
1622 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1623 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1624 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1625 econnp->conn_incoming_ifindex = ifindex;
1626 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1627 econnp->conn_ixa->ixa_scopeid = ifindex;
1628 }
1629 }
1630
1631 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1632 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1633 tcps->tcps_rev_src_routes) {
1634 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1635 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1636
1637 /* Source routing option copyover (reverse it) */
1638 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1639 if (err != 0) {
1640 freemsg(tpi_mp);
1641 goto error3;
1642 }
1643 ip_pkt_source_route_reverse_v4(ipp);
1644 }
1645
1646 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1647 ASSERT(!eager->tcp_tconnind_started);
1648 /*
1649 * If the SYN came with a credential, it's a loopback packet or a
1650 * labeled packet; attach the credential to the TPI message.
1651 */
1652 if (ira->ira_cred != NULL)
1653 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1654
1655 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1656 ASSERT(eager->tcp_ordrel_mp == NULL);
1657
1658 /* Inherit the listener's non-STREAMS flag */
1659 if (IPCL_IS_NONSTR(lconnp)) {
1660 econnp->conn_flags |= IPCL_NONSTR;
1661 /* All non-STREAMS tcp_ts are sockets */
1662 eager->tcp_issocket = B_TRUE;
1663 } else {
1664 /*
1665 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1666 * at close time, we will always have that to send up.
1667 * Otherwise, we need to do special handling in case the
1668 * allocation fails at that time.
1669 */
1670 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1671 goto error3;
1672 }
1673 /*
1674 * Now that the IP addresses and ports are setup in econnp we
1675 * can do the IPsec policy work.
1676 */
1677 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1678 if (lconnp->conn_policy != NULL) {
1679 /*
1680 * Inherit the policy from the listener; use
1681 * actions from ira
1682 */
1683 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1684 CONN_DEC_REF(econnp);
1685 freemsg(mp);
1686 goto error3;
1687 }
1688 }
1689 }
1690
1691 /*
1692 * tcp_set_destination() may set tcp_rwnd according to the route
1693 * metrics. If it does not, the eager's receive window will be set
1694 * to the listener's receive window later in this function.
1695 */
1696 eager->tcp_rwnd = 0;
1697
1698 if (is_system_labeled()) {
1699 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1700
1701 ASSERT(ira->ira_tsl != NULL);
1702 /* Discard any old label */
1703 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1704 ASSERT(ixa->ixa_tsl != NULL);
1705 label_rele(ixa->ixa_tsl);
1706 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1707 ixa->ixa_tsl = NULL;
1708 }
1709 if ((lconnp->conn_mlp_type != mlptSingle ||
1710 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1711 ira->ira_tsl != NULL) {
1712 /*
1713 * If this is an MLP connection or a MAC-Exempt
1714 * connection with an unlabeled node, packets are to be
1715 * exchanged using the security label of the received
1716 * SYN packet instead of the server application's label.
1717 * tsol_check_dest called from ip_set_destination
1718 * might later update TSF_UNLABELED by replacing
1719 * ixa_tsl with a new label.
1720 */
1721 label_hold(ira->ira_tsl);
1722 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1723 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1724 econnp, ts_label_t *, ixa->ixa_tsl)
1725 } else {
1726 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1727 DTRACE_PROBE2(syn_accept, conn_t *,
1728 econnp, ts_label_t *, ixa->ixa_tsl)
1729 }
1730 /*
1731 * conn_connect() called from tcp_set_destination will verify
1732 * the destination is allowed to receive packets at the
1733 * security label of the SYN-ACK we are generating. As part of
1734 * that, tsol_check_dest() may create a new effective label for
1735 * this connection.
1736 * Finally conn_connect() will call conn_update_label.
1737 * All that remains for TCP to do is to call
1738 * conn_build_hdr_template which is done as part of
1739 * tcp_set_destination.
1740 */
1741 }
1742
1743 /*
1744 * Since we will clear tcp_listener before we clear tcp_detached
1745 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1746 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1747 */
1748 eager->tcp_hard_binding = B_TRUE;
1749
1750 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1751 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1752
1753 CL_INET_CONNECT(econnp, B_FALSE, err);
1754 if (err != 0) {
1755 tcp_bind_hash_remove(eager);
1756 goto error3;
1757 }
1758
1759 SOCK_CONNID_BUMP(eager->tcp_connid);
1760
1761 /*
1762 * Adapt our mss, ttl, ... based on the remote address.
1763 */
1764
1765 if (tcp_set_destination(eager) != 0) {
1766 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1767 /* Undo the bind_hash_insert */
1768 tcp_bind_hash_remove(eager);
1769 goto error3;
1770 }
1771
1772 /* Process all TCP options. */
1773 if (!tcp_process_options(mp, eager, tcpha, ira)) {
1774 tcp_bind_hash_remove(eager);
1775 goto error3;
1776 }
1777
1778 /* Is the other end ECN capable? */
1779 if (tcps->tcps_ecn_permitted >= 1 &&
1780 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1781 eager->tcp_ecn_ok = B_TRUE;
1782 }
1783
1784 /*
1785 * The listener's conn_rcvbuf should be the default window size or a
1786 * window size changed via SO_RCVBUF option. First round up the
1787 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1788 * scale option value if needed. Call tcp_rwnd_set() to finish the
1789 * setting.
1790 *
1791 * Note if there is a rpipe metric associated with the remote host,
1792 * we should not inherit receive window size from listener.
1793 */
1794 eager->tcp_rwnd = MSS_ROUNDUP(
1795 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1796 eager->tcp_rwnd), eager->tcp_mss);
1797 if (eager->tcp_snd_ws_ok)
1798 tcp_set_ws_value(eager);
1799 /*
1800 * Note that this is the only place tcp_rwnd_set() is called for
1801 * accepting a connection. We need to call it here instead of
1802 * after the 3-way handshake because we need to tell the other
1803 * side our rwnd in the SYN-ACK segment.
1804 */
1805 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1806
1807 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1808 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1809
1810 ASSERT(econnp->conn_rcvbuf != 0 &&
1811 econnp->conn_rcvbuf == eager->tcp_rwnd);
1812
1813 /* Put a ref on the listener for the eager. */
1814 CONN_INC_REF(lconnp);
1815 mutex_enter(&listener->tcp_eager_lock);
1816 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1817 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1818 listener->tcp_eager_next_q0 = eager;
1819 eager->tcp_eager_prev_q0 = listener;
1820
1821 /* Set tcp_listener before adding it to tcp_conn_fanout */
1822 eager->tcp_listener = listener;
1823 eager->tcp_saved_listener = listener;
1824
1825 /*
1826 * Set tcp_listen_cnt so that when the connection is done, the counter
1827 * is decremented.
1828 */
1829 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1830
1831 /*
1832 * Tag this detached tcp vector for later retrieval
1833 * by our listener client in tcp_accept().
1834 */
1835 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1836 listener->tcp_conn_req_cnt_q0++;
1837 if (++listener->tcp_conn_req_seqnum == -1) {
1838 /*
1839 * -1 is "special" and defined in TPI as something
1840 * that should never be used in T_CONN_IND
1841 */
1842 ++listener->tcp_conn_req_seqnum;
1843 }
1844 mutex_exit(&listener->tcp_eager_lock);
1845
1846 if (listener->tcp_syn_defense) {
1847 /* Don't drop the SYN that comes from a good IP source */
1848 ipaddr_t *addr_cache;
1849
1850 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1851 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1852 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1853 eager->tcp_dontdrop = B_TRUE;
1854 }
1855 }
1856
1857 /*
1858 * We need to insert the eager in its own perimeter but as soon
1859 * as we do that, we expose the eager to the classifier and
1860 * should not touch any field outside the eager's perimeter.
1861 * So do all the work necessary before inserting the eager
1862 * in its own perimeter. Be optimistic that conn_connect()
1863 * will succeed but undo everything if it fails.
1864 */
1865 seg_seq = ntohl(tcpha->tha_seq);
1866 eager->tcp_irs = seg_seq;
1867 eager->tcp_rack = seg_seq;
1868 eager->tcp_rnxt = seg_seq + 1;
1869 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1870 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1871 eager->tcp_state = TCPS_SYN_RCVD;
1872 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1873 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1874 int32_t, TCPS_LISTEN);
1875
1876 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1877 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1878 if (mp1 == NULL) {
1879 /*
1880 * Increment the ref count as we are going to
1881 * enqueueing an mp in squeue
1882 */
1883 CONN_INC_REF(econnp);
1884 goto error;
1885 }
1886
1887 /*
1888 * We need to start the rto timer. In normal case, we start
1889 * the timer after sending the packet on the wire (or at
1890 * least believing that packet was sent by waiting for
1891 * conn_ip_output() to return). Since this is the first packet
1892 * being sent on the wire for the eager, our initial tcp_rto
1893 * is at least tcp_rexmit_interval_min which is a fairly
1894 * large value to allow the algorithm to adjust slowly to large
1895 * fluctuations of RTT during first few transmissions.
1896 *
1897 * Starting the timer first and then sending the packet in this
1898 * case shouldn't make much difference since tcp_rexmit_interval_min
1899 * is of the order of several 100ms and starting the timer
1900 * first and then sending the packet will result in difference
1901 * of few micro seconds.
1902 *
1903 * Without this optimization, we are forced to hold the fanout
1904 * lock across the ipcl_bind_insert() and sending the packet
1905 * so that we don't race against an incoming packet (maybe RST)
1906 * for this eager.
1907 *
1908 * It is necessary to acquire an extra reference on the eager
1909 * at this point and hold it until after tcp_send_data() to
1910 * ensure against an eager close race.
1911 */
1912
1913 CONN_INC_REF(econnp);
1914
1915 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1916
1917 /*
1918 * Insert the eager in its own perimeter now. We are ready to deal
1919 * with any packets on eager.
1920 */
1921 if (ipcl_conn_insert(econnp) != 0)
1922 goto error;
1923
1924 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1925 freemsg(mp);
1926 /*
1927 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1928 * only used by one thread at a time.
1929 */
1930 if (econnp->conn_sqp == lconnp->conn_sqp) {
1931 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1932 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1933 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1934 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1935 (void) conn_ip_output(mp1, econnp->conn_ixa);
1936 CONN_DEC_REF(econnp);
1937 } else {
1938 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1939 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1940 }
1941 return;
1942 error:
1943 freemsg(mp1);
1944 eager->tcp_closemp_used = B_TRUE;
1945 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1946 mp1 = &eager->tcp_closemp;
1947 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1948 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1949
1950 /*
1951 * If a connection already exists, send the mp to that connections so
1952 * that it can be appropriately dealt with.
1953 */
1954 ipst = tcps->tcps_netstack->netstack_ip;
1955
1956 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1957 if (!IPCL_IS_CONNECTED(econnp)) {
1958 /*
1959 * Something bad happened. ipcl_conn_insert()
1960 * failed because a connection already existed
1961 * in connected hash but we can't find it
1962 * anymore (someone blew it away). Just
1963 * free this message and hopefully remote
1964 * will retransmit at which time the SYN can be
1965 * treated as a new connection or dealth with
1966 * a TH_RST if a connection already exists.
1967 */
1968 CONN_DEC_REF(econnp);
1969 freemsg(mp);
1970 } else {
1971 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1972 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1973 }
1974 } else {
1975 /* Nobody wants this packet */
1976 freemsg(mp);
1977 }
1978 return;
1979 error3:
1980 CONN_DEC_REF(econnp);
1981 error2:
1982 freemsg(mp);
1983 if (tlc_set)
1984 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1985 }
1986
1987 /*
1988 * In an ideal case of vertical partition in NUMA architecture, its
1989 * beneficial to have the listener and all the incoming connections
1990 * tied to the same squeue. The other constraint is that incoming
1991 * connections should be tied to the squeue attached to interrupted
1992 * CPU for obvious locality reason so this leaves the listener to
1993 * be tied to the same squeue. Our only problem is that when listener
1994 * is binding, the CPU that will get interrupted by the NIC whose
1995 * IP address the listener is binding to is not even known. So
1996 * the code below allows us to change that binding at the time the
1997 * CPU is interrupted by virtue of incoming connection's squeue.
1998 *
1999 * This is usefull only in case of a listener bound to a specific IP
2000 * address. For other kind of listeners, they get bound the
2001 * very first time and there is no attempt to rebind them.
2002 */
2003 void
tcp_input_listener_unbound(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * ira)2004 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
2005 ip_recv_attr_t *ira)
2006 {
2007 conn_t *connp = (conn_t *)arg;
2008 squeue_t *sqp = (squeue_t *)arg2;
2009 squeue_t *new_sqp;
2010 uint32_t conn_flags;
2011
2012 /*
2013 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
2014 * or based on the ring (for packets from GLD). Otherwise it is
2015 * set based on lbolt i.e., a somewhat random number.
2016 */
2017 ASSERT(ira->ira_sqp != NULL);
2018 new_sqp = ira->ira_sqp;
2019
2020 if (connp->conn_fanout == NULL)
2021 goto done;
2022
2023 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
2024 mutex_enter(&connp->conn_fanout->connf_lock);
2025 mutex_enter(&connp->conn_lock);
2026 /*
2027 * No one from read or write side can access us now
2028 * except for already queued packets on this squeue.
2029 * But since we haven't changed the squeue yet, they
2030 * can't execute. If they are processed after we have
2031 * changed the squeue, they are sent back to the
2032 * correct squeue down below.
2033 * But a listner close can race with processing of
2034 * incoming SYN. If incoming SYN processing changes
2035 * the squeue then the listener close which is waiting
2036 * to enter the squeue would operate on the wrong
2037 * squeue. Hence we don't change the squeue here unless
2038 * the refcount is exactly the minimum refcount. The
2039 * minimum refcount of 4 is counted as - 1 each for
2040 * TCP and IP, 1 for being in the classifier hash, and
2041 * 1 for the mblk being processed.
2042 */
2043
2044 if (connp->conn_ref != 4 ||
2045 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
2046 mutex_exit(&connp->conn_lock);
2047 mutex_exit(&connp->conn_fanout->connf_lock);
2048 goto done;
2049 }
2050 if (connp->conn_sqp != new_sqp) {
2051 while (connp->conn_sqp != new_sqp)
2052 (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
2053 new_sqp);
2054 /* No special MT issues for outbound ixa_sqp hint */
2055 connp->conn_ixa->ixa_sqp = new_sqp;
2056 }
2057
2058 do {
2059 conn_flags = connp->conn_flags;
2060 conn_flags |= IPCL_FULLY_BOUND;
2061 (void) atomic_cas_32(&connp->conn_flags,
2062 connp->conn_flags, conn_flags);
2063 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
2064
2065 mutex_exit(&connp->conn_fanout->connf_lock);
2066 mutex_exit(&connp->conn_lock);
2067
2068 /*
2069 * Assume we have picked a good squeue for the listener. Make
2070 * subsequent SYNs not try to change the squeue.
2071 */
2072 connp->conn_recv = tcp_input_listener;
2073 }
2074
2075 done:
2076 if (connp->conn_sqp != sqp) {
2077 CONN_INC_REF(connp);
2078 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
2079 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
2080 } else {
2081 tcp_input_listener(connp, mp, sqp, ira);
2082 }
2083 }
2084
2085 /*
2086 * Send up all messages queued on tcp_rcv_list.
2087 */
2088 uint_t
tcp_rcv_drain(tcp_t * tcp)2089 tcp_rcv_drain(tcp_t *tcp)
2090 {
2091 mblk_t *mp;
2092 uint_t ret = 0;
2093 #ifdef DEBUG
2094 uint_t cnt = 0;
2095 #endif
2096 queue_t *q = tcp->tcp_connp->conn_rq;
2097
2098 /* Can't drain on an eager connection */
2099 if (tcp->tcp_listener != NULL)
2100 return (ret);
2101
2102 /* Can't be a non-STREAMS connection */
2103 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
2104
2105 /* No need for the push timer now. */
2106 if (tcp->tcp_push_tid != 0) {
2107 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
2108 tcp->tcp_push_tid = 0;
2109 }
2110
2111 /*
2112 * Handle two cases here: we are currently fused or we were
2113 * previously fused and have some urgent data to be delivered
2114 * upstream. The latter happens because we either ran out of
2115 * memory or were detached and therefore sending the SIGURG was
2116 * deferred until this point. In either case we pass control
2117 * over to tcp_fuse_rcv_drain() since it may need to complete
2118 * some work.
2119 */
2120 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2121 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2122 &tcp->tcp_fused_sigurg_mp))
2123 return (ret);
2124 }
2125
2126 while ((mp = tcp->tcp_rcv_list) != NULL) {
2127 tcp->tcp_rcv_list = mp->b_next;
2128 mp->b_next = NULL;
2129 #ifdef DEBUG
2130 cnt += msgdsize(mp);
2131 #endif
2132 putnext(q, mp);
2133 }
2134 #ifdef DEBUG
2135 ASSERT(cnt == tcp->tcp_rcv_cnt);
2136 #endif
2137 tcp->tcp_rcv_last_head = NULL;
2138 tcp->tcp_rcv_last_tail = NULL;
2139 tcp->tcp_rcv_cnt = 0;
2140
2141 if (canputnext(q))
2142 return (tcp_rwnd_reopen(tcp));
2143
2144 return (ret);
2145 }
2146
2147 /*
2148 * Queue data on tcp_rcv_list which is a b_next chain.
2149 * tcp_rcv_last_head/tail is the last element of this chain.
2150 * Each element of the chain is a b_cont chain.
2151 *
2152 * M_DATA messages are added to the current element.
2153 * Other messages are added as new (b_next) elements.
2154 */
2155 void
tcp_rcv_enqueue(tcp_t * tcp,mblk_t * mp,uint_t seg_len,cred_t * cr)2156 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2157 {
2158 ASSERT(seg_len == msgdsize(mp));
2159 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2160
2161 if (is_system_labeled()) {
2162 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2163 /*
2164 * Provide for protocols above TCP such as RPC. NOPID leaves
2165 * db_cpid unchanged.
2166 * The cred could have already been set.
2167 */
2168 if (cr != NULL)
2169 mblk_setcred(mp, cr, NOPID);
2170 }
2171
2172 if (tcp->tcp_rcv_list == NULL) {
2173 ASSERT(tcp->tcp_rcv_last_head == NULL);
2174 tcp->tcp_rcv_list = mp;
2175 tcp->tcp_rcv_last_head = mp;
2176 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2177 tcp->tcp_rcv_last_tail->b_cont = mp;
2178 } else {
2179 tcp->tcp_rcv_last_head->b_next = mp;
2180 tcp->tcp_rcv_last_head = mp;
2181 }
2182
2183 while (mp->b_cont)
2184 mp = mp->b_cont;
2185
2186 tcp->tcp_rcv_last_tail = mp;
2187 tcp->tcp_rcv_cnt += seg_len;
2188 tcp->tcp_rwnd -= seg_len;
2189 }
2190
2191 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2192 mblk_t *
tcp_ack_mp(tcp_t * tcp)2193 tcp_ack_mp(tcp_t *tcp)
2194 {
2195 uint32_t seq_no;
2196 tcp_stack_t *tcps = tcp->tcp_tcps;
2197 conn_t *connp = tcp->tcp_connp;
2198
2199 /*
2200 * There are a few cases to be considered while setting the sequence no.
2201 * Essentially, we can come here while processing an unacceptable pkt
2202 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2203 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2204 * If we are here for a zero window probe, stick with suna. In all
2205 * other cases, we check if suna + swnd encompasses snxt and set
2206 * the sequence number to snxt, if so. If snxt falls outside the
2207 * window (the receiver probably shrunk its window), we will go with
2208 * suna + swnd, otherwise the sequence no will be unacceptable to the
2209 * receiver.
2210 */
2211 if (tcp->tcp_zero_win_probe) {
2212 seq_no = tcp->tcp_suna;
2213 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2214 ASSERT(tcp->tcp_swnd == 0);
2215 seq_no = tcp->tcp_snxt;
2216 } else {
2217 seq_no = SEQ_GT(tcp->tcp_snxt,
2218 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2219 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2220 }
2221
2222 if (tcp->tcp_valid_bits || tcp->tcp_md5sig) {
2223 /*
2224 * For the complex cases where we have to send some
2225 * controls (FIN or SYN), or add an MD5 signature
2226 * option, let tcp_xmit_mp do it.
2227 */
2228 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2229 NULL, B_FALSE));
2230 } else {
2231 /* Generate a simple ACK */
2232 int data_length;
2233 uchar_t *rptr;
2234 tcpha_t *tcpha;
2235 mblk_t *mp1;
2236 int32_t total_hdr_len;
2237 int32_t tcp_hdr_len;
2238 int32_t num_sack_blk = 0;
2239 int32_t sack_opt_len;
2240 ip_xmit_attr_t *ixa = connp->conn_ixa;
2241
2242 /*
2243 * Allocate space for TCP + IP headers
2244 * and link-level header
2245 */
2246 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2247 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2248 tcp->tcp_num_sack_blk);
2249 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2250 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2251 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2252 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2253 } else {
2254 total_hdr_len = connp->conn_ht_iphc_len;
2255 tcp_hdr_len = connp->conn_ht_ulp_len;
2256 }
2257 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2258 if (!mp1)
2259 return (NULL);
2260
2261 /* Update the latest receive window size in TCP header. */
2262 tcp->tcp_tcpha->tha_win =
2263 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2264 /* copy in prototype TCP + IP header */
2265 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2266 mp1->b_rptr = rptr;
2267 mp1->b_wptr = rptr + total_hdr_len;
2268 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2269
2270 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2271
2272 /* Set the TCP sequence number. */
2273 tcpha->tha_seq = htonl(seq_no);
2274
2275 /* Set up the TCP flag field. */
2276 tcpha->tha_flags = (uchar_t)TH_ACK;
2277 if (tcp->tcp_ecn_echo_on)
2278 tcpha->tha_flags |= TH_ECE;
2279
2280 tcp->tcp_rack = tcp->tcp_rnxt;
2281 tcp->tcp_rack_cnt = 0;
2282
2283 /* fill in timestamp option if in use */
2284 if (tcp->tcp_snd_ts_ok) {
2285 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2286
2287 U32_TO_BE32(llbolt,
2288 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2289 U32_TO_BE32(tcp->tcp_ts_recent,
2290 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2291 }
2292
2293 /* Fill in SACK options */
2294 if (num_sack_blk > 0) {
2295 uchar_t *wptr = (uchar_t *)tcpha +
2296 connp->conn_ht_ulp_len;
2297 sack_blk_t *tmp;
2298 int32_t i;
2299
2300 wptr[0] = TCPOPT_NOP;
2301 wptr[1] = TCPOPT_NOP;
2302 wptr[2] = TCPOPT_SACK;
2303 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2304 sizeof (sack_blk_t);
2305 wptr += TCPOPT_REAL_SACK_LEN;
2306
2307 tmp = tcp->tcp_sack_list;
2308 for (i = 0; i < num_sack_blk; i++) {
2309 U32_TO_BE32(tmp[i].begin, wptr);
2310 wptr += sizeof (tcp_seq);
2311 U32_TO_BE32(tmp[i].end, wptr);
2312 wptr += sizeof (tcp_seq);
2313 }
2314 tcpha->tha_offset_and_reserved +=
2315 ((num_sack_blk * 2 + 1) << 4);
2316 }
2317
2318 ixa->ixa_pktlen = total_hdr_len;
2319
2320 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2321 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2322 } else {
2323 ip6_t *ip6 = (ip6_t *)rptr;
2324
2325 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2326 }
2327
2328 /*
2329 * Prime pump for checksum calculation in IP. Include the
2330 * adjustment for a source route if any.
2331 */
2332 data_length = tcp_hdr_len + connp->conn_sum;
2333 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2334 tcpha->tha_sum = htons(data_length);
2335
2336 if (tcp->tcp_ip_forward_progress) {
2337 tcp->tcp_ip_forward_progress = B_FALSE;
2338 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2339 } else {
2340 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2341 }
2342 return (mp1);
2343 }
2344 }
2345
2346 /*
2347 * Dummy socket upcalls for if/when the conn_t gets detached from a
2348 * direct-callback sonode via a user-driven close(). Easy to catch with
2349 * DTrace FBT, and should be mostly harmless.
2350 */
2351
2352 /* ARGSUSED */
2353 static sock_upper_handle_t
tcp_dummy_newconn(sock_upper_handle_t x,sock_lower_handle_t y,sock_downcalls_t * z,cred_t * cr,pid_t pid,sock_upcalls_t ** ignored)2354 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2355 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2356 {
2357 ASSERT(0); /* Panic in debug, otherwise ignore. */
2358 return (NULL);
2359 }
2360
2361 /* ARGSUSED */
2362 static void
tcp_dummy_connected(sock_upper_handle_t x,sock_connid_t y,cred_t * cr,pid_t pid)2363 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2364 pid_t pid)
2365 {
2366 ASSERT(x == NULL);
2367 /* Normally we'd crhold(cr) and attach it to socket state. */
2368 /* LINTED */
2369 }
2370
2371 /* ARGSUSED */
2372 static int
tcp_dummy_disconnected(sock_upper_handle_t x,sock_connid_t y,int blah)2373 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2374 {
2375 ASSERT(0); /* Panic in debug, otherwise ignore. */
2376 return (-1);
2377 }
2378
2379 /* ARGSUSED */
2380 static void
tcp_dummy_opctl(sock_upper_handle_t x,sock_opctl_action_t y,uintptr_t blah)2381 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2382 {
2383 ASSERT(x == NULL);
2384 /* We really want this one to be a harmless NOP for now. */
2385 /* LINTED */
2386 }
2387
2388 /* ARGSUSED */
2389 static ssize_t
tcp_dummy_recv(sock_upper_handle_t x,mblk_t * mp,size_t len,int flags,int * error,boolean_t * push)2390 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2391 int *error, boolean_t *push)
2392 {
2393 ASSERT(x == NULL);
2394
2395 /*
2396 * Consume the message, set ESHUTDOWN, and return an error.
2397 * Nobody's home!
2398 */
2399 freemsg(mp);
2400 *error = ESHUTDOWN;
2401 return (-1);
2402 }
2403
2404 /* ARGSUSED */
2405 static void
tcp_dummy_set_proto_props(sock_upper_handle_t x,struct sock_proto_props * y)2406 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2407 {
2408 ASSERT(0); /* Panic in debug, otherwise ignore. */
2409 }
2410
2411 /* ARGSUSED */
2412 static void
tcp_dummy_txq_full(sock_upper_handle_t x,boolean_t y)2413 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2414 {
2415 ASSERT(0); /* Panic in debug, otherwise ignore. */
2416 }
2417
2418 /* ARGSUSED */
2419 static void
tcp_dummy_signal_oob(sock_upper_handle_t x,ssize_t len)2420 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2421 {
2422 ASSERT(x == NULL);
2423 /* Otherwise, this would signal socket state about OOB data. */
2424 }
2425
2426 /* ARGSUSED */
2427 static void
tcp_dummy_set_error(sock_upper_handle_t x,int err)2428 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2429 {
2430 ASSERT(0); /* Panic in debug, otherwise ignore. */
2431 }
2432
2433 /* ARGSUSED */
2434 static void
tcp_dummy_onearg(sock_upper_handle_t x)2435 tcp_dummy_onearg(sock_upper_handle_t x)
2436 {
2437 ASSERT(0); /* Panic in debug, otherwise ignore. */
2438 }
2439
2440 static sock_upcalls_t tcp_dummy_upcalls = {
2441 tcp_dummy_newconn,
2442 tcp_dummy_connected,
2443 tcp_dummy_disconnected,
2444 tcp_dummy_opctl,
2445 tcp_dummy_recv,
2446 tcp_dummy_set_proto_props,
2447 tcp_dummy_txq_full,
2448 tcp_dummy_signal_oob,
2449 tcp_dummy_onearg,
2450 tcp_dummy_set_error,
2451 tcp_dummy_onearg
2452 };
2453
2454 /*
2455 * Handle M_DATA messages from IP. Its called directly from IP via
2456 * squeue for received IP packets.
2457 *
2458 * The first argument is always the connp/tcp to which the mp belongs.
2459 * There are no exceptions to this rule. The caller has already put
2460 * a reference on this connp/tcp and once tcp_input_data() returns,
2461 * the squeue will do the refrele.
2462 *
2463 * The TH_SYN for the listener directly go to tcp_input_listener via
2464 * squeue. ICMP errors go directly to tcp_icmp_input().
2465 *
2466 * sqp: NULL = recursive, sqp != NULL means called from squeue
2467 */
2468 void
tcp_input_data(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * ira)2469 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2470 {
2471 int32_t bytes_acked;
2472 int32_t gap;
2473 mblk_t *mp1;
2474 uint_t flags;
2475 uint32_t new_swnd = 0;
2476 uchar_t *iphdr;
2477 uchar_t *rptr;
2478 int32_t rgap;
2479 uint32_t seg_ack;
2480 int seg_len;
2481 uint_t ip_hdr_len;
2482 uint32_t seg_seq;
2483 tcpha_t *tcpha;
2484 int urp;
2485 tcp_opt_t tcpopt;
2486 ip_pkt_t ipp;
2487 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2488 uint32_t cwnd;
2489 int mss;
2490 conn_t *connp = (conn_t *)arg;
2491 squeue_t *sqp = (squeue_t *)arg2;
2492 tcp_t *tcp = connp->conn_tcp;
2493 tcp_stack_t *tcps = tcp->tcp_tcps;
2494 sock_upcalls_t *sockupcalls;
2495
2496 /*
2497 * RST from fused tcp loopback peer should trigger an unfuse.
2498 */
2499 if (tcp->tcp_fused) {
2500 TCP_STAT(tcps, tcp_fusion_aborted);
2501 tcp_unfuse(tcp);
2502 }
2503
2504 mss = 0;
2505 iphdr = mp->b_rptr;
2506 rptr = mp->b_rptr;
2507 ASSERT(OK_32PTR(rptr));
2508
2509 ip_hdr_len = ira->ira_ip_hdr_length;
2510 if (connp->conn_recv_ancillary.crb_all != 0) {
2511 /*
2512 * Record packet information in the ip_pkt_t
2513 */
2514 ipp.ipp_fields = 0;
2515 if (ira->ira_flags & IRAF_IS_IPV4) {
2516 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2517 B_FALSE);
2518 } else {
2519 uint8_t nexthdrp;
2520
2521 /*
2522 * IPv6 packets can only be received by applications
2523 * that are prepared to receive IPv6 addresses.
2524 * The IP fanout must ensure this.
2525 */
2526 ASSERT(connp->conn_family == AF_INET6);
2527
2528 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2529 &nexthdrp);
2530 ASSERT(nexthdrp == IPPROTO_TCP);
2531
2532 /* Could have caused a pullup? */
2533 iphdr = mp->b_rptr;
2534 rptr = mp->b_rptr;
2535 }
2536 }
2537 ASSERT(DB_TYPE(mp) == M_DATA);
2538 ASSERT(mp->b_next == NULL);
2539
2540 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2541 seg_seq = ntohl(tcpha->tha_seq);
2542 seg_ack = ntohl(tcpha->tha_ack);
2543 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2544 seg_len = (int)(mp->b_wptr - rptr) -
2545 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2546 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2547 do {
2548 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2549 (uintptr_t)INT_MAX);
2550 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2551 } while ((mp1 = mp1->b_cont) != NULL &&
2552 mp1->b_datap->db_type == M_DATA);
2553 }
2554
2555 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2556 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2557 __dtrace_tcp_tcph_t *, tcpha);
2558
2559 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2560 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2561 seg_len, tcpha, ira);
2562 return;
2563 }
2564
2565 if (sqp != NULL) {
2566 /*
2567 * This is the correct place to update tcp_last_recv_time. Note
2568 * that it is also updated for tcp structure that belongs to
2569 * global and listener queues which do not really need updating.
2570 * But that should not cause any harm. And it is updated for
2571 * all kinds of incoming segments, not only for data segments.
2572 */
2573 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2574 }
2575
2576 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2577
2578 TCPS_BUMP_MIB(tcps, tcpHCInSegs);
2579 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2580
2581 if ((flags & TH_URG) && sqp != NULL) {
2582 /*
2583 * TCP can't handle urgent pointers that arrive before
2584 * the connection has been accept()ed since it can't
2585 * buffer OOB data. Discard segment if this happens.
2586 *
2587 * We can't just rely on a non-null tcp_listener to indicate
2588 * that the accept() has completed since unlinking of the
2589 * eager and completion of the accept are not atomic.
2590 * tcp_detached, when it is not set (B_FALSE) indicates
2591 * that the accept() has completed.
2592 *
2593 * Nor can it reassemble urgent pointers, so discard
2594 * if it's not the next segment expected.
2595 *
2596 * Otherwise, collapse chain into one mblk (discard if
2597 * that fails). This makes sure the headers, retransmitted
2598 * data, and new data all are in the same mblk.
2599 */
2600 ASSERT(mp != NULL);
2601 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2602 freemsg(mp);
2603 return;
2604 }
2605 /* Update pointers into message */
2606 iphdr = rptr = mp->b_rptr;
2607 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2608 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2609 /*
2610 * Since we can't handle any data with this urgent
2611 * pointer that is out of sequence, we expunge
2612 * the data. This allows us to still register
2613 * the urgent mark and generate the M_PCSIG,
2614 * which we can do.
2615 */
2616 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2617 seg_len = 0;
2618 }
2619 }
2620
2621 sockupcalls = connp->conn_upcalls;
2622 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2623 if (sockupcalls == NULL)
2624 sockupcalls = &tcp_dummy_upcalls;
2625
2626 switch (tcp->tcp_state) {
2627 case TCPS_SYN_SENT:
2628 if (connp->conn_final_sqp == NULL &&
2629 tcp_outbound_squeue_switch && sqp != NULL) {
2630 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2631 connp->conn_final_sqp = sqp;
2632 if (connp->conn_final_sqp != connp->conn_sqp) {
2633 DTRACE_PROBE1(conn__final__sqp__switch,
2634 conn_t *, connp);
2635 CONN_INC_REF(connp);
2636 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2637 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2638 tcp_input_data, connp, ira, ip_squeue_flag,
2639 SQTAG_CONNECT_FINISH);
2640 return;
2641 }
2642 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2643 }
2644 if (flags & TH_ACK) {
2645 /*
2646 * Note that our stack cannot send data before a
2647 * connection is established, therefore the
2648 * following check is valid. Otherwise, it has
2649 * to be changed.
2650 */
2651 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2652 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2653 freemsg(mp);
2654 if (flags & TH_RST)
2655 return;
2656 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2657 tcp, seg_ack, 0, TH_RST);
2658 return;
2659 }
2660 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2661 }
2662 if (flags & TH_RST) {
2663 if (flags & TH_ACK) {
2664 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2665 ip_xmit_attr_t *, connp->conn_ixa,
2666 void_ip_t *, iphdr, tcp_t *, tcp,
2667 tcph_t *, tcpha);
2668 (void) tcp_clean_death(tcp, ECONNREFUSED);
2669 }
2670 freemsg(mp);
2671 return;
2672 }
2673 if (!(flags & TH_SYN)) {
2674 freemsg(mp);
2675 return;
2676 }
2677
2678 /* Process all TCP options. */
2679 if (!tcp_process_options(mp, tcp, tcpha, ira)) {
2680 freemsg(mp);
2681 return;
2682 }
2683 /*
2684 * The following changes our rwnd to be a multiple of the
2685 * MIN(peer MSS, our MSS) for performance reason.
2686 */
2687 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2688 tcp->tcp_mss));
2689
2690 /* Is the other end ECN capable? */
2691 if (tcp->tcp_ecn_ok) {
2692 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2693 tcp->tcp_ecn_ok = B_FALSE;
2694 }
2695 }
2696 /*
2697 * Clear ECN flags because it may interfere with later
2698 * processing.
2699 */
2700 flags &= ~(TH_ECE|TH_CWR);
2701
2702 tcp->tcp_irs = seg_seq;
2703 tcp->tcp_rack = seg_seq;
2704 tcp->tcp_rnxt = seg_seq + 1;
2705 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2706 if (!TCP_IS_DETACHED(tcp)) {
2707 /* Allocate room for SACK options if needed. */
2708 connp->conn_wroff = connp->conn_ht_iphc_len;
2709 if (tcp->tcp_snd_sack_ok)
2710 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2711 if (!tcp->tcp_loopback)
2712 connp->conn_wroff += tcps->tcps_wroff_xtra;
2713
2714 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2715 connp->conn_wroff);
2716 }
2717 if (flags & TH_ACK) {
2718 /*
2719 * If we can't get the confirmation upstream, pretend
2720 * we didn't even see this one.
2721 *
2722 * XXX: how can we pretend we didn't see it if we
2723 * have updated rnxt et. al.
2724 *
2725 * For loopback we defer sending up the T_CONN_CON
2726 * until after some checks below.
2727 */
2728 mp1 = NULL;
2729 /*
2730 * tcp_sendmsg() checks tcp_state without entering
2731 * the squeue so tcp_state should be updated before
2732 * sending up connection confirmation. Probe the
2733 * state change below when we are sure the connection
2734 * confirmation has been sent.
2735 */
2736 tcp->tcp_state = TCPS_ESTABLISHED;
2737 if (!tcp_conn_con(tcp, iphdr, mp,
2738 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2739 tcp->tcp_state = TCPS_SYN_SENT;
2740 freemsg(mp);
2741 return;
2742 }
2743 TCPS_CONN_INC(tcps);
2744 /* SYN was acked - making progress */
2745 tcp->tcp_ip_forward_progress = B_TRUE;
2746
2747 /* One for the SYN */
2748 tcp->tcp_suna = tcp->tcp_iss + 1;
2749 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2750
2751 /*
2752 * If SYN was retransmitted, need to reset all
2753 * retransmission info. This is because this
2754 * segment will be treated as a dup ACK.
2755 */
2756 if (tcp->tcp_rexmit) {
2757 tcp->tcp_rexmit = B_FALSE;
2758 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2759 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2760 tcp->tcp_ms_we_have_waited = 0;
2761
2762 /*
2763 * Set tcp_cwnd back to 1 MSS, per
2764 * recommendation from
2765 * draft-floyd-incr-init-win-01.txt,
2766 * Increasing TCP's Initial Window.
2767 */
2768 DTRACE_PROBE3(cwnd__retransmitted__syn,
2769 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
2770 uint32_t, tcp->tcp_mss);
2771 tcp->tcp_cwnd = tcp->tcp_mss;
2772 }
2773
2774 tcp->tcp_swl1 = seg_seq;
2775 tcp->tcp_swl2 = seg_ack;
2776
2777 new_swnd = ntohs(tcpha->tha_win);
2778 tcp->tcp_swnd = new_swnd;
2779 if (new_swnd > tcp->tcp_max_swnd)
2780 tcp->tcp_max_swnd = new_swnd;
2781
2782 /*
2783 * Always send the three-way handshake ack immediately
2784 * in order to make the connection complete as soon as
2785 * possible on the accepting host.
2786 */
2787 flags |= TH_ACK_NEEDED;
2788
2789 /*
2790 * Trace connect-established here.
2791 */
2792 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2793 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2794 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2795
2796 /* Trace change from SYN_SENT -> ESTABLISHED here */
2797 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2798 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2799 void, NULL, int32_t, TCPS_SYN_SENT);
2800
2801 /*
2802 * Special case for loopback. At this point we have
2803 * received SYN-ACK from the remote endpoint. In
2804 * order to ensure that both endpoints reach the
2805 * fused state prior to any data exchange, the final
2806 * ACK needs to be sent before we indicate T_CONN_CON
2807 * to the module upstream.
2808 */
2809 if (tcp->tcp_loopback) {
2810 mblk_t *ack_mp;
2811
2812 ASSERT(!tcp->tcp_unfusable);
2813 ASSERT(mp1 != NULL);
2814 /*
2815 * For loopback, we always get a pure SYN-ACK
2816 * and only need to send back the final ACK
2817 * with no data (this is because the other
2818 * tcp is ours and we don't do T/TCP). This
2819 * final ACK triggers the passive side to
2820 * perform fusion in ESTABLISHED state.
2821 */
2822 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2823 if (tcp->tcp_ack_tid != 0) {
2824 (void) TCP_TIMER_CANCEL(tcp,
2825 tcp->tcp_ack_tid);
2826 tcp->tcp_ack_tid = 0;
2827 }
2828 tcp_send_data(tcp, ack_mp);
2829 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
2830 TCPS_BUMP_MIB(tcps, tcpOutAck);
2831
2832 if (!IPCL_IS_NONSTR(connp)) {
2833 /* Send up T_CONN_CON */
2834 if (ira->ira_cred != NULL) {
2835 mblk_setcred(mp1,
2836 ira->ira_cred,
2837 ira->ira_cpid);
2838 }
2839 putnext(connp->conn_rq, mp1);
2840 } else {
2841 (*sockupcalls->su_connected)
2842 (connp->conn_upper_handle,
2843 tcp->tcp_connid,
2844 ira->ira_cred,
2845 ira->ira_cpid);
2846 freemsg(mp1);
2847 }
2848
2849 freemsg(mp);
2850 return;
2851 }
2852 /*
2853 * Forget fusion; we need to handle more
2854 * complex cases below. Send the deferred
2855 * T_CONN_CON message upstream and proceed
2856 * as usual. Mark this tcp as not capable
2857 * of fusion.
2858 */
2859 TCP_STAT(tcps, tcp_fusion_unfusable);
2860 tcp->tcp_unfusable = B_TRUE;
2861 if (!IPCL_IS_NONSTR(connp)) {
2862 if (ira->ira_cred != NULL) {
2863 mblk_setcred(mp1, ira->ira_cred,
2864 ira->ira_cpid);
2865 }
2866 putnext(connp->conn_rq, mp1);
2867 } else {
2868 (*sockupcalls->su_connected)
2869 (connp->conn_upper_handle,
2870 tcp->tcp_connid, ira->ira_cred,
2871 ira->ira_cpid);
2872 freemsg(mp1);
2873 }
2874 }
2875
2876 /*
2877 * Check to see if there is data to be sent. If
2878 * yes, set the transmit flag. Then check to see
2879 * if received data processing needs to be done.
2880 * If not, go straight to xmit_check. This short
2881 * cut is OK as we don't support T/TCP.
2882 */
2883 if (tcp->tcp_unsent)
2884 flags |= TH_XMIT_NEEDED;
2885
2886 if (seg_len == 0 && !(flags & TH_URG)) {
2887 freemsg(mp);
2888 goto xmit_check;
2889 }
2890
2891 flags &= ~TH_SYN;
2892 seg_seq++;
2893 break;
2894 }
2895 tcp->tcp_state = TCPS_SYN_RCVD;
2896 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2897 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2898 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2899 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2900 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2901 if (mp1 != NULL) {
2902 tcp_send_data(tcp, mp1);
2903 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2904 }
2905 freemsg(mp);
2906 return;
2907 case TCPS_SYN_RCVD:
2908 if (flags & TH_ACK) {
2909 uint32_t pinit_wnd;
2910
2911 /*
2912 * In this state, a SYN|ACK packet is either bogus
2913 * because the other side must be ACKing our SYN which
2914 * indicates it has seen the ACK for their SYN and
2915 * shouldn't retransmit it or we're crossing SYNs
2916 * on active open.
2917 */
2918 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2919 freemsg(mp);
2920 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2921 tcp, seg_ack, 0, TH_RST);
2922 return;
2923 }
2924 /*
2925 * NOTE: RFC 793 pg. 72 says this should be
2926 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2927 * but that would mean we have an ack that ignored
2928 * our SYN.
2929 */
2930 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2931 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2932 freemsg(mp);
2933 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2934 tcp, seg_ack, 0, TH_RST);
2935 return;
2936 }
2937 /*
2938 * No sane TCP stack will send such a small window
2939 * without receiving any data. Just drop this invalid
2940 * ACK. We also shorten the abort timeout in case
2941 * this is an attack.
2942 */
2943 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2944 if (pinit_wnd < tcp->tcp_mss &&
2945 pinit_wnd < tcp_init_wnd_chk) {
2946 freemsg(mp);
2947 TCP_STAT(tcps, tcp_zwin_ack_syn);
2948 tcp->tcp_second_ctimer_threshold =
2949 tcp_early_abort * SECONDS;
2950 return;
2951 }
2952 }
2953 break;
2954 case TCPS_LISTEN:
2955 /*
2956 * Only a TLI listener can come through this path when a
2957 * acceptor is going back to be a listener and a packet
2958 * for the acceptor hits the classifier. For a socket
2959 * listener, this can never happen because a listener
2960 * can never accept connection on itself and hence a
2961 * socket acceptor can not go back to being a listener.
2962 */
2963 ASSERT(!TCP_IS_SOCKET(tcp));
2964 /*FALLTHRU*/
2965 case TCPS_CLOSED:
2966 case TCPS_BOUND: {
2967 conn_t *new_connp;
2968 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2969
2970 /*
2971 * Don't accept any input on a closed tcp as this TCP logically
2972 * does not exist on the system. Don't proceed further with
2973 * this TCP. For instance, this packet could trigger another
2974 * close of this tcp which would be disastrous for tcp_refcnt.
2975 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2976 * be called at most once on a TCP. In this case we need to
2977 * refeed the packet into the classifier and figure out where
2978 * the packet should go.
2979 */
2980 new_connp = ipcl_classify(mp, ira, ipst);
2981 if (new_connp != NULL) {
2982 /* Drops ref on new_connp */
2983 tcp_reinput(new_connp, mp, ira, ipst);
2984 return;
2985 }
2986 /* We failed to classify. For now just drop the packet */
2987 freemsg(mp);
2988 return;
2989 }
2990 case TCPS_IDLE:
2991 /*
2992 * Handle the case where the tcp_clean_death() has happened
2993 * on a connection (application hasn't closed yet) but a packet
2994 * was already queued on squeue before tcp_clean_death()
2995 * was processed. Calling tcp_clean_death() twice on same
2996 * connection can result in weird behaviour.
2997 */
2998 freemsg(mp);
2999 return;
3000 default:
3001 break;
3002 }
3003
3004 /*
3005 * Already on the correct queue/perimeter.
3006 * If this is a detached connection and not an eager
3007 * connection hanging off a listener then new data
3008 * (past the FIN) will cause a reset.
3009 * We do a special check here where it
3010 * is out of the main line, rather than check
3011 * if we are detached every time we see new
3012 * data down below.
3013 */
3014 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
3015 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
3016 TCPS_BUMP_MIB(tcps, tcpInClosed);
3017 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
3018 freemsg(mp);
3019 tcp_xmit_ctl("new data when detached", tcp,
3020 tcp->tcp_snxt, 0, TH_RST);
3021 (void) tcp_clean_death(tcp, EPROTO);
3022 return;
3023 }
3024
3025 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
3026 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
3027 new_swnd = ntohs(tcpha->tha_win) <<
3028 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
3029
3030 /*
3031 * We are interested in three TCP options: timestamps (if negotiated),
3032 * SACK (if negotiated) and MD5. Skip option parsing if none of these
3033 * is enabled/negotiated.
3034 */
3035 if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok || tcp->tcp_md5sig) {
3036 int options;
3037
3038 if (tcp->tcp_snd_sack_ok)
3039 tcpopt.tcp = tcp;
3040 else
3041 tcpopt.tcp = NULL;
3042
3043 options = tcp_parse_options(tcpha, &tcpopt);
3044
3045 if (tcp->tcp_md5sig) {
3046 if ((options & TCP_OPT_SIG_PRESENT) == 0) {
3047 TCP_STAT(tcp->tcp_tcps, tcp_sig_no_option);
3048 freemsg(mp);
3049 return;
3050 }
3051 if (!tcpsig_verify(mp, tcp, tcpha, ira,
3052 tcpopt.tcp_opt_sig)) {
3053 freemsg(mp);
3054 return;
3055 }
3056 }
3057 /*
3058 * RST segments must not be subject to PAWS and are not
3059 * required to have timestamps.
3060 * We do not drop keepalive segments without
3061 * timestamps, to maintain compatibility with legacy TCP stacks.
3062 */
3063 boolean_t keepalive = (seg_len == 0 || seg_len == 1) &&
3064 (seg_seq + 1 == tcp->tcp_rnxt);
3065 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) {
3066 /*
3067 * Per RFC 7323 section 3.2., silently drop non-RST
3068 * segments without expected TSopt. This is a 'SHOULD'
3069 * requirement.
3070 * We accept keepalives without TSopt to maintain
3071 * interoperability with tcp implementations that omit
3072 * the TSopt on these. Keepalive data is discarded, so
3073 * there is no risk corrupting data by accepting these.
3074 */
3075 if (!(options & TCP_OPT_TSTAMP_PRESENT)) {
3076 /*
3077 * Leave a breadcrumb for people to detect this
3078 * behavior.
3079 */
3080 DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp);
3081 freemsg(mp);
3082 return;
3083 }
3084
3085 if (!tcp_paws_check(tcp, &tcpopt)) {
3086 /*
3087 * This segment is not acceptable.
3088 * Drop it and send back an ACK.
3089 */
3090 freemsg(mp);
3091 flags |= TH_ACK_NEEDED;
3092 goto ack_check;
3093 }
3094 }
3095 }
3096 try_again:;
3097 mss = tcp->tcp_mss;
3098 gap = seg_seq - tcp->tcp_rnxt;
3099 rgap = tcp->tcp_rwnd - (gap + seg_len);
3100 /*
3101 * gap is the amount of sequence space between what we expect to see
3102 * and what we got for seg_seq. A positive value for gap means
3103 * something got lost. A negative value means we got some old stuff.
3104 */
3105 if (gap < 0) {
3106 /* Old stuff present. Is the SYN in there? */
3107 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
3108 (seg_len != 0)) {
3109 flags &= ~TH_SYN;
3110 seg_seq++;
3111 urp--;
3112 /* Recompute the gaps after noting the SYN. */
3113 goto try_again;
3114 }
3115 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
3116 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
3117 (seg_len > -gap ? -gap : seg_len));
3118 /* Remove the old stuff from seg_len. */
3119 seg_len += gap;
3120 /*
3121 * Anything left?
3122 * Make sure to check for unack'd FIN when rest of data
3123 * has been previously ack'd.
3124 */
3125 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
3126 /*
3127 * Resets are only valid if they lie within our offered
3128 * window. If the RST bit is set, we just ignore this
3129 * segment.
3130 */
3131 if (flags & TH_RST) {
3132 freemsg(mp);
3133 return;
3134 }
3135
3136 /*
3137 * The arriving of dup data packets indicate that we
3138 * may have postponed an ack for too long, or the other
3139 * side's RTT estimate is out of shape. Start acking
3140 * more often.
3141 */
3142 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
3143 tcp->tcp_rack_cnt >= 1 &&
3144 tcp->tcp_rack_abs_max > 2) {
3145 tcp->tcp_rack_abs_max--;
3146 }
3147 tcp->tcp_rack_cur_max = 1;
3148
3149 /*
3150 * This segment is "unacceptable". None of its
3151 * sequence space lies within our advertized window.
3152 *
3153 * Adjust seg_len to the original value for tracing.
3154 */
3155 seg_len -= gap;
3156 if (connp->conn_debug) {
3157 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3158 "tcp_rput: unacceptable, gap %d, rgap %d, "
3159 "flags 0x%x, seg_seq %u, seg_ack %u, "
3160 "seg_len %d, rnxt %u, snxt %u, %s",
3161 gap, rgap, flags, seg_seq, seg_ack,
3162 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3163 tcp_display(tcp, NULL,
3164 DISP_ADDR_AND_PORT));
3165 }
3166
3167 /*
3168 * Arrange to send an ACK in response to the
3169 * unacceptable segment per RFC 793 page 69. There
3170 * is only one small difference between ours and the
3171 * acceptability test in the RFC - we accept ACK-only
3172 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3173 * will be generated.
3174 *
3175 * Note that we have to ACK an ACK-only packet at least
3176 * for stacks that send 0-length keep-alives with
3177 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3178 * section 4.2.3.6. As long as we don't ever generate
3179 * an unacceptable packet in response to an incoming
3180 * packet that is unacceptable, it should not cause
3181 * "ACK wars".
3182 */
3183 flags |= TH_ACK_NEEDED;
3184
3185 /*
3186 * Continue processing this segment in order to use the
3187 * ACK information it contains, but skip all other
3188 * sequence-number processing. Processing the ACK
3189 * information is necessary in order to
3190 * re-synchronize connections that may have lost
3191 * synchronization.
3192 *
3193 * We clear seg_len and flag fields related to
3194 * sequence number processing as they are not
3195 * to be trusted for an unacceptable segment.
3196 */
3197 seg_len = 0;
3198 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3199 goto process_ack;
3200 }
3201
3202 /* Fix seg_seq, and chew the gap off the front. */
3203 seg_seq = tcp->tcp_rnxt;
3204 urp += gap;
3205 do {
3206 mblk_t *mp2;
3207 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3208 (uintptr_t)UINT_MAX);
3209 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3210 if (gap > 0) {
3211 mp->b_rptr = mp->b_wptr - gap;
3212 break;
3213 }
3214 mp2 = mp;
3215 mp = mp->b_cont;
3216 freeb(mp2);
3217 } while (gap < 0);
3218 /*
3219 * If the urgent data has already been acknowledged, we
3220 * should ignore TH_URG below
3221 */
3222 if (urp < 0)
3223 flags &= ~TH_URG;
3224 }
3225 /*
3226 * rgap is the amount of stuff received out of window. A negative
3227 * value is the amount out of window.
3228 */
3229 if (rgap < 0) {
3230 mblk_t *mp2;
3231
3232 if (tcp->tcp_rwnd == 0) {
3233 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3234 tcp->tcp_cs.tcp_in_zwnd_probes++;
3235 } else {
3236 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3237 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3238 }
3239
3240 /*
3241 * seg_len does not include the FIN, so if more than
3242 * just the FIN is out of window, we act like we don't
3243 * see it. (If just the FIN is out of window, rgap
3244 * will be zero and we will go ahead and acknowledge
3245 * the FIN.)
3246 */
3247 flags &= ~TH_FIN;
3248
3249 /* Fix seg_len and make sure there is something left. */
3250 seg_len += rgap;
3251 if (seg_len <= 0) {
3252 /*
3253 * Resets are only valid if they lie within our offered
3254 * window. If the RST bit is set, we just ignore this
3255 * segment.
3256 */
3257 if (flags & TH_RST) {
3258 freemsg(mp);
3259 return;
3260 }
3261
3262 /* Per RFC 793, we need to send back an ACK. */
3263 flags |= TH_ACK_NEEDED;
3264
3265 /*
3266 * Send SIGURG as soon as possible i.e. even
3267 * if the TH_URG was delivered in a window probe
3268 * packet (which will be unacceptable).
3269 *
3270 * We generate a signal if none has been generated
3271 * for this connection or if this is a new urgent
3272 * byte. Also send a zero-length "unmarked" message
3273 * to inform SIOCATMARK that this is not the mark.
3274 *
3275 * tcp_urp_last_valid is cleared when the T_exdata_ind
3276 * is sent up. This plus the check for old data
3277 * (gap >= 0) handles the wraparound of the sequence
3278 * number space without having to always track the
3279 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3280 * this max in its rcv_up variable).
3281 *
3282 * This prevents duplicate SIGURGS due to a "late"
3283 * zero-window probe when the T_EXDATA_IND has already
3284 * been sent up.
3285 */
3286 if ((flags & TH_URG) &&
3287 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3288 tcp->tcp_urp_last))) {
3289 if (IPCL_IS_NONSTR(connp)) {
3290 if (!TCP_IS_DETACHED(tcp)) {
3291 (*sockupcalls->su_signal_oob)
3292 (connp->conn_upper_handle,
3293 urp);
3294 }
3295 } else {
3296 mp1 = allocb(0, BPRI_MED);
3297 if (mp1 == NULL) {
3298 freemsg(mp);
3299 return;
3300 }
3301 if (!TCP_IS_DETACHED(tcp) &&
3302 !putnextctl1(connp->conn_rq,
3303 M_PCSIG, SIGURG)) {
3304 /* Try again on the rexmit. */
3305 freemsg(mp1);
3306 freemsg(mp);
3307 return;
3308 }
3309 /*
3310 * If the next byte would be the mark
3311 * then mark with MARKNEXT else mark
3312 * with NOTMARKNEXT.
3313 */
3314 if (gap == 0 && urp == 0)
3315 mp1->b_flag |= MSGMARKNEXT;
3316 else
3317 mp1->b_flag |= MSGNOTMARKNEXT;
3318 freemsg(tcp->tcp_urp_mark_mp);
3319 tcp->tcp_urp_mark_mp = mp1;
3320 flags |= TH_SEND_URP_MARK;
3321 }
3322 tcp->tcp_urp_last_valid = B_TRUE;
3323 tcp->tcp_urp_last = urp + seg_seq;
3324 }
3325 /*
3326 * If this is a zero window probe, continue to
3327 * process the ACK part. But we need to set seg_len
3328 * to 0 to avoid data processing. Otherwise just
3329 * drop the segment and send back an ACK.
3330 */
3331 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3332 flags &= ~(TH_SYN | TH_URG);
3333 seg_len = 0;
3334 goto process_ack;
3335 } else {
3336 freemsg(mp);
3337 goto ack_check;
3338 }
3339 }
3340 /* Pitch out of window stuff off the end. */
3341 rgap = seg_len;
3342 mp2 = mp;
3343 do {
3344 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3345 (uintptr_t)INT_MAX);
3346 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3347 if (rgap < 0) {
3348 mp2->b_wptr += rgap;
3349 if ((mp1 = mp2->b_cont) != NULL) {
3350 mp2->b_cont = NULL;
3351 freemsg(mp1);
3352 }
3353 break;
3354 }
3355 } while ((mp2 = mp2->b_cont) != NULL);
3356 }
3357 ok:;
3358 /*
3359 * TCP should check ECN info for segments inside the window only.
3360 * Therefore the check should be done here.
3361 */
3362 if (tcp->tcp_ecn_ok) {
3363 if (flags & TH_CWR) {
3364 tcp->tcp_ecn_echo_on = B_FALSE;
3365 }
3366 /*
3367 * Note that both ECN_CE and CWR can be set in the
3368 * same segment. In this case, we once again turn
3369 * on ECN_ECHO.
3370 */
3371 if (connp->conn_ipversion == IPV4_VERSION) {
3372 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3373
3374 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3375 tcp->tcp_ecn_echo_on = B_TRUE;
3376 }
3377 } else {
3378 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3379
3380 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3381 htonl(IPH_ECN_CE << 20)) {
3382 tcp->tcp_ecn_echo_on = B_TRUE;
3383 }
3384 }
3385 }
3386
3387 /*
3388 * Check whether we can update tcp_ts_recent. This test is from RFC
3389 * 7323, section 5.3.
3390 */
3391 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) &&
3392 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3393 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3394 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3395 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3396 }
3397
3398 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3399 /*
3400 * FIN in an out of order segment. We record this in
3401 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3402 * Clear the FIN so that any check on FIN flag will fail.
3403 * Remember that FIN also counts in the sequence number
3404 * space. So we need to ack out of order FIN only segments.
3405 */
3406 if (flags & TH_FIN) {
3407 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3408 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3409 flags &= ~TH_FIN;
3410 flags |= TH_ACK_NEEDED;
3411 }
3412 if (seg_len > 0) {
3413 /* Fill in the SACK blk list. */
3414 if (tcp->tcp_snd_sack_ok) {
3415 tcp_sack_insert(tcp->tcp_sack_list,
3416 seg_seq, seg_seq + seg_len,
3417 &(tcp->tcp_num_sack_blk));
3418 }
3419
3420 /*
3421 * Attempt reassembly and see if we have something
3422 * ready to go.
3423 */
3424 mp = tcp_reass(tcp, mp, seg_seq);
3425 /* Always ack out of order packets */
3426 flags |= TH_ACK_NEEDED | TH_PUSH;
3427 if (mp) {
3428 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3429 (uintptr_t)INT_MAX);
3430 seg_len = mp->b_cont ? msgdsize(mp) :
3431 (int)(mp->b_wptr - mp->b_rptr);
3432 seg_seq = tcp->tcp_rnxt;
3433 /*
3434 * A gap is filled and the seq num and len
3435 * of the gap match that of a previously
3436 * received FIN, put the FIN flag back in.
3437 */
3438 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3439 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3440 flags |= TH_FIN;
3441 tcp->tcp_valid_bits &=
3442 ~TCP_OFO_FIN_VALID;
3443 }
3444 if (tcp->tcp_reass_tid != 0) {
3445 (void) TCP_TIMER_CANCEL(tcp,
3446 tcp->tcp_reass_tid);
3447 /*
3448 * Restart the timer if there is still
3449 * data in the reassembly queue.
3450 */
3451 if (tcp->tcp_reass_head != NULL) {
3452 tcp->tcp_reass_tid = TCP_TIMER(
3453 tcp, tcp_reass_timer,
3454 tcps->tcps_reass_timeout);
3455 } else {
3456 tcp->tcp_reass_tid = 0;
3457 }
3458 }
3459 } else {
3460 /*
3461 * Keep going even with NULL mp.
3462 * There may be a useful ACK or something else
3463 * we don't want to miss.
3464 *
3465 * But TCP should not perform fast retransmit
3466 * because of the ack number. TCP uses
3467 * seg_len == 0 to determine if it is a pure
3468 * ACK. And this is not a pure ACK.
3469 */
3470 seg_len = 0;
3471 ofo_seg = B_TRUE;
3472
3473 if (tcps->tcps_reass_timeout != 0 &&
3474 tcp->tcp_reass_tid == 0) {
3475 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3476 tcp_reass_timer,
3477 tcps->tcps_reass_timeout);
3478 }
3479 }
3480 }
3481 } else if (seg_len > 0) {
3482 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3483 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3484 tcp->tcp_cs.tcp_in_data_inorder_segs++;
3485 tcp->tcp_cs.tcp_in_data_inorder_bytes += seg_len;
3486
3487 /*
3488 * If an out of order FIN was received before, and the seq
3489 * num and len of the new segment match that of the FIN,
3490 * put the FIN flag back in.
3491 */
3492 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3493 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3494 flags |= TH_FIN;
3495 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3496 }
3497 }
3498 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3499 if (flags & TH_RST) {
3500 freemsg(mp);
3501 switch (tcp->tcp_state) {
3502 case TCPS_SYN_RCVD:
3503 (void) tcp_clean_death(tcp, ECONNREFUSED);
3504 break;
3505 case TCPS_ESTABLISHED:
3506 case TCPS_FIN_WAIT_1:
3507 case TCPS_FIN_WAIT_2:
3508 case TCPS_CLOSE_WAIT:
3509 (void) tcp_clean_death(tcp, ECONNRESET);
3510 break;
3511 case TCPS_CLOSING:
3512 case TCPS_LAST_ACK:
3513 (void) tcp_clean_death(tcp, 0);
3514 break;
3515 default:
3516 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3517 (void) tcp_clean_death(tcp, ENXIO);
3518 break;
3519 }
3520 return;
3521 }
3522 if (flags & TH_SYN) {
3523 /*
3524 * See RFC 793, Page 71
3525 *
3526 * The seq number must be in the window as it should
3527 * be "fixed" above. If it is outside window, it should
3528 * be already rejected. Note that we allow seg_seq to be
3529 * rnxt + rwnd because we want to accept 0 window probe.
3530 */
3531 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3532 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3533 freemsg(mp);
3534 /*
3535 * If the ACK flag is not set, just use our snxt as the
3536 * seq number of the RST segment.
3537 */
3538 if (!(flags & TH_ACK)) {
3539 seg_ack = tcp->tcp_snxt;
3540 }
3541 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3542 TH_RST|TH_ACK);
3543 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3544 (void) tcp_clean_death(tcp, ECONNRESET);
3545 return;
3546 }
3547 /*
3548 * urp could be -1 when the urp field in the packet is 0
3549 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3550 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3551 */
3552 if ((flags & TH_URG) && urp >= 0) {
3553 if (!tcp->tcp_urp_last_valid ||
3554 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3555 /*
3556 * Non-STREAMS sockets handle the urgent data a litte
3557 * differently from STREAMS based sockets. There is no
3558 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3559 * flags to keep SIOCATMARK happy. Instead a
3560 * su_signal_oob upcall is made to update the mark.
3561 * Neither is a T_EXDATA_IND mblk needed to be
3562 * prepended to the urgent data. The urgent data is
3563 * delivered using the su_recv upcall, where we set
3564 * the MSG_OOB flag to indicate that it is urg data.
3565 *
3566 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3567 * are used by non-STREAMS sockets.
3568 */
3569 if (IPCL_IS_NONSTR(connp)) {
3570 if (!TCP_IS_DETACHED(tcp)) {
3571 (*sockupcalls->su_signal_oob)
3572 (connp->conn_upper_handle, urp);
3573 }
3574 } else {
3575 /*
3576 * If we haven't generated the signal yet for
3577 * this urgent pointer value, do it now. Also,
3578 * send up a zero-length M_DATA indicating
3579 * whether or not this is the mark. The latter
3580 * is not needed when a T_EXDATA_IND is sent up.
3581 * However, if there are allocation failures
3582 * this code relies on the sender retransmitting
3583 * and the socket code for determining the mark
3584 * should not block waiting for the peer to
3585 * transmit. Thus, for simplicity we always
3586 * send up the mark indication.
3587 */
3588 mp1 = allocb(0, BPRI_MED);
3589 if (mp1 == NULL) {
3590 freemsg(mp);
3591 return;
3592 }
3593 if (!TCP_IS_DETACHED(tcp) &&
3594 !putnextctl1(connp->conn_rq, M_PCSIG,
3595 SIGURG)) {
3596 /* Try again on the rexmit. */
3597 freemsg(mp1);
3598 freemsg(mp);
3599 return;
3600 }
3601 /*
3602 * Mark with NOTMARKNEXT for now.
3603 * The code below will change this to MARKNEXT
3604 * if we are at the mark.
3605 *
3606 * If there are allocation failures (e.g. in
3607 * dupmsg below) the next time tcp_input_data
3608 * sees the urgent segment it will send up the
3609 * MSGMARKNEXT message.
3610 */
3611 mp1->b_flag |= MSGNOTMARKNEXT;
3612 freemsg(tcp->tcp_urp_mark_mp);
3613 tcp->tcp_urp_mark_mp = mp1;
3614 flags |= TH_SEND_URP_MARK;
3615 #ifdef DEBUG
3616 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3617 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3618 "last %x, %s",
3619 seg_seq, urp, tcp->tcp_urp_last,
3620 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3621 #endif /* DEBUG */
3622 }
3623 tcp->tcp_urp_last_valid = B_TRUE;
3624 tcp->tcp_urp_last = urp + seg_seq;
3625 } else if (tcp->tcp_urp_mark_mp != NULL) {
3626 /*
3627 * An allocation failure prevented the previous
3628 * tcp_input_data from sending up the allocated
3629 * MSG*MARKNEXT message - send it up this time
3630 * around.
3631 */
3632 flags |= TH_SEND_URP_MARK;
3633 }
3634
3635 /*
3636 * If the urgent byte is in this segment, make sure that it is
3637 * all by itself. This makes it much easier to deal with the
3638 * possibility of an allocation failure on the T_exdata_ind.
3639 * Note that seg_len is the number of bytes in the segment, and
3640 * urp is the offset into the segment of the urgent byte.
3641 * urp < seg_len means that the urgent byte is in this segment.
3642 */
3643 if (urp < seg_len) {
3644 if (seg_len != 1) {
3645 uint32_t tmp_rnxt;
3646 /*
3647 * Break it up and feed it back in.
3648 * Re-attach the IP header.
3649 */
3650 mp->b_rptr = iphdr;
3651 if (urp > 0) {
3652 /*
3653 * There is stuff before the urgent
3654 * byte.
3655 */
3656 mp1 = dupmsg(mp);
3657 if (!mp1) {
3658 /*
3659 * Trim from urgent byte on.
3660 * The rest will come back.
3661 */
3662 (void) adjmsg(mp,
3663 urp - seg_len);
3664 tcp_input_data(connp,
3665 mp, NULL, ira);
3666 return;
3667 }
3668 (void) adjmsg(mp1, urp - seg_len);
3669 /* Feed this piece back in. */
3670 tmp_rnxt = tcp->tcp_rnxt;
3671 tcp_input_data(connp, mp1, NULL, ira);
3672 /*
3673 * If the data passed back in was not
3674 * processed (ie: bad ACK) sending
3675 * the remainder back in will cause a
3676 * loop. In this case, drop the
3677 * packet and let the sender try
3678 * sending a good packet.
3679 */
3680 if (tmp_rnxt == tcp->tcp_rnxt) {
3681 freemsg(mp);
3682 return;
3683 }
3684 }
3685 if (urp != seg_len - 1) {
3686 uint32_t tmp_rnxt;
3687 /*
3688 * There is stuff after the urgent
3689 * byte.
3690 */
3691 mp1 = dupmsg(mp);
3692 if (!mp1) {
3693 /*
3694 * Trim everything beyond the
3695 * urgent byte. The rest will
3696 * come back.
3697 */
3698 (void) adjmsg(mp,
3699 urp + 1 - seg_len);
3700 tcp_input_data(connp,
3701 mp, NULL, ira);
3702 return;
3703 }
3704 (void) adjmsg(mp1, urp + 1 - seg_len);
3705 tmp_rnxt = tcp->tcp_rnxt;
3706 tcp_input_data(connp, mp1, NULL, ira);
3707 /*
3708 * If the data passed back in was not
3709 * processed (ie: bad ACK) sending
3710 * the remainder back in will cause a
3711 * loop. In this case, drop the
3712 * packet and let the sender try
3713 * sending a good packet.
3714 */
3715 if (tmp_rnxt == tcp->tcp_rnxt) {
3716 freemsg(mp);
3717 return;
3718 }
3719 }
3720 tcp_input_data(connp, mp, NULL, ira);
3721 return;
3722 }
3723 /*
3724 * This segment contains only the urgent byte. We
3725 * have to allocate the T_exdata_ind, if we can.
3726 */
3727 if (IPCL_IS_NONSTR(connp)) {
3728 int error;
3729
3730 (*sockupcalls->su_recv)
3731 (connp->conn_upper_handle, mp, seg_len,
3732 MSG_OOB, &error, NULL);
3733 /*
3734 * We should never be in middle of a
3735 * fallback, the squeue guarantees that.
3736 */
3737 ASSERT(error != EOPNOTSUPP);
3738 mp = NULL;
3739 goto update_ack;
3740 } else if (!tcp->tcp_urp_mp) {
3741 struct T_exdata_ind *tei;
3742 mp1 = allocb(sizeof (struct T_exdata_ind),
3743 BPRI_MED);
3744 if (!mp1) {
3745 /*
3746 * Sigh... It'll be back.
3747 * Generate any MSG*MARK message now.
3748 */
3749 freemsg(mp);
3750 seg_len = 0;
3751 if (flags & TH_SEND_URP_MARK) {
3752
3753
3754 ASSERT(tcp->tcp_urp_mark_mp);
3755 tcp->tcp_urp_mark_mp->b_flag &=
3756 ~MSGNOTMARKNEXT;
3757 tcp->tcp_urp_mark_mp->b_flag |=
3758 MSGMARKNEXT;
3759 }
3760 goto ack_check;
3761 }
3762 mp1->b_datap->db_type = M_PROTO;
3763 tei = (struct T_exdata_ind *)mp1->b_rptr;
3764 tei->PRIM_type = T_EXDATA_IND;
3765 tei->MORE_flag = 0;
3766 mp1->b_wptr = (uchar_t *)&tei[1];
3767 tcp->tcp_urp_mp = mp1;
3768 #ifdef DEBUG
3769 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3770 "tcp_rput: allocated exdata_ind %s",
3771 tcp_display(tcp, NULL,
3772 DISP_PORT_ONLY));
3773 #endif /* DEBUG */
3774 /*
3775 * There is no need to send a separate MSG*MARK
3776 * message since the T_EXDATA_IND will be sent
3777 * now.
3778 */
3779 flags &= ~TH_SEND_URP_MARK;
3780 freemsg(tcp->tcp_urp_mark_mp);
3781 tcp->tcp_urp_mark_mp = NULL;
3782 }
3783 /*
3784 * Now we are all set. On the next putnext upstream,
3785 * tcp_urp_mp will be non-NULL and will get prepended
3786 * to what has to be this piece containing the urgent
3787 * byte. If for any reason we abort this segment below,
3788 * if it comes back, we will have this ready, or it
3789 * will get blown off in close.
3790 */
3791 } else if (urp == seg_len) {
3792 /*
3793 * The urgent byte is the next byte after this sequence
3794 * number. If this endpoint is non-STREAMS, then there
3795 * is nothing to do here since the socket has already
3796 * been notified about the urg pointer by the
3797 * su_signal_oob call above.
3798 *
3799 * In case of STREAMS, some more work might be needed.
3800 * If there is data it is marked with MSGMARKNEXT and
3801 * and any tcp_urp_mark_mp is discarded since it is not
3802 * needed. Otherwise, if the code above just allocated
3803 * a zero-length tcp_urp_mark_mp message, that message
3804 * is tagged with MSGMARKNEXT. Sending up these
3805 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3806 * even though the T_EXDATA_IND will not be sent up
3807 * until the urgent byte arrives.
3808 */
3809 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3810 if (seg_len != 0) {
3811 flags |= TH_MARKNEXT_NEEDED;
3812 freemsg(tcp->tcp_urp_mark_mp);
3813 tcp->tcp_urp_mark_mp = NULL;
3814 flags &= ~TH_SEND_URP_MARK;
3815 } else if (tcp->tcp_urp_mark_mp != NULL) {
3816 flags |= TH_SEND_URP_MARK;
3817 tcp->tcp_urp_mark_mp->b_flag &=
3818 ~MSGNOTMARKNEXT;
3819 tcp->tcp_urp_mark_mp->b_flag |=
3820 MSGMARKNEXT;
3821 }
3822 }
3823 #ifdef DEBUG
3824 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3825 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3826 seg_len, flags,
3827 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3828 #endif /* DEBUG */
3829 }
3830 #ifdef DEBUG
3831 else {
3832 /* Data left until we hit mark */
3833 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3834 "tcp_rput: URP %d bytes left, %s",
3835 urp - seg_len, tcp_display(tcp, NULL,
3836 DISP_PORT_ONLY));
3837 }
3838 #endif /* DEBUG */
3839 }
3840
3841 process_ack:
3842 if (!(flags & TH_ACK)) {
3843 freemsg(mp);
3844 goto xmit_check;
3845 }
3846 }
3847 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3848
3849 if (bytes_acked > 0)
3850 tcp->tcp_ip_forward_progress = B_TRUE;
3851 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3852 /*
3853 * tcp_sendmsg() checks tcp_state without entering
3854 * the squeue so tcp_state should be updated before
3855 * sending up a connection confirmation or a new
3856 * connection indication.
3857 */
3858 tcp->tcp_state = TCPS_ESTABLISHED;
3859
3860 /*
3861 * We are seeing the final ack in the three way
3862 * hand shake of a active open'ed connection
3863 * so we must send up a T_CONN_CON
3864 */
3865 if (tcp->tcp_active_open) {
3866 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3867 freemsg(mp);
3868 tcp->tcp_state = TCPS_SYN_RCVD;
3869 return;
3870 }
3871 /*
3872 * Don't fuse the loopback endpoints for
3873 * simultaneous active opens.
3874 */
3875 if (tcp->tcp_loopback) {
3876 TCP_STAT(tcps, tcp_fusion_unfusable);
3877 tcp->tcp_unfusable = B_TRUE;
3878 }
3879 /*
3880 * For simultaneous active open, trace receipt of final
3881 * ACK as tcp:::connect-established.
3882 */
3883 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3884 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3885 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3886 } else if (IPCL_IS_NONSTR(connp)) {
3887 /*
3888 * 3-way handshake has completed, so notify socket
3889 * of the new connection.
3890 *
3891 * We are here means eager is fine but it can
3892 * get a TH_RST at any point between now and till
3893 * accept completes and disappear. We need to
3894 * ensure that reference to eager is valid after
3895 * we get out of eager's perimeter. So we do
3896 * an extra refhold.
3897 */
3898 CONN_INC_REF(connp);
3899
3900 if (!tcp_newconn_notify(tcp, ira)) {
3901 /*
3902 * The state-change probe for SYN_RCVD ->
3903 * ESTABLISHED has not fired yet. We reset
3904 * the state to SYN_RCVD so that future
3905 * state-change probes report correct state
3906 * transistions.
3907 */
3908 tcp->tcp_state = TCPS_SYN_RCVD;
3909 freemsg(mp);
3910 /* notification did not go up, so drop ref */
3911 CONN_DEC_REF(connp);
3912 /* ... and close the eager */
3913 ASSERT(TCP_IS_DETACHED(tcp));
3914 (void) tcp_close_detached(tcp);
3915 return;
3916 }
3917 /*
3918 * tcp_newconn_notify() changes conn_upcalls and
3919 * connp->conn_upper_handle. Fix things now, in case
3920 * there's data attached to this ack.
3921 */
3922 if (connp->conn_upcalls != NULL)
3923 sockupcalls = connp->conn_upcalls;
3924 /*
3925 * For passive open, trace receipt of final ACK as
3926 * tcp:::accept-established.
3927 */
3928 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3929 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3930 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3931 } else {
3932 /*
3933 * 3-way handshake complete - this is a STREAMS based
3934 * socket, so pass up the T_CONN_IND.
3935 */
3936 tcp_t *listener = tcp->tcp_listener;
3937 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3938
3939 tcp->tcp_tconnind_started = B_TRUE;
3940 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3941 ASSERT(mp != NULL);
3942 /*
3943 * We are here means eager is fine but it can
3944 * get a TH_RST at any point between now and till
3945 * accept completes and disappear. We need to
3946 * ensure that reference to eager is valid after
3947 * we get out of eager's perimeter. So we do
3948 * an extra refhold.
3949 */
3950 CONN_INC_REF(connp);
3951
3952 /*
3953 * The listener also exists because of the refhold
3954 * done in tcp_input_listener. Its possible that it
3955 * might have closed. We will check that once we
3956 * get inside listeners context.
3957 */
3958 CONN_INC_REF(listener->tcp_connp);
3959 if (listener->tcp_connp->conn_sqp ==
3960 connp->conn_sqp) {
3961 /*
3962 * We optimize by not calling an SQUEUE_ENTER
3963 * on the listener since we know that the
3964 * listener and eager squeues are the same.
3965 * We are able to make this check safely only
3966 * because neither the eager nor the listener
3967 * can change its squeue. Only an active connect
3968 * can change its squeue
3969 */
3970 tcp_send_conn_ind(listener->tcp_connp, mp,
3971 listener->tcp_connp->conn_sqp);
3972 CONN_DEC_REF(listener->tcp_connp);
3973 } else if (!tcp->tcp_loopback) {
3974 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3975 mp, tcp_send_conn_ind,
3976 listener->tcp_connp, NULL, SQ_FILL,
3977 SQTAG_TCP_CONN_IND);
3978 } else {
3979 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3980 mp, tcp_send_conn_ind,
3981 listener->tcp_connp, NULL, SQ_NODRAIN,
3982 SQTAG_TCP_CONN_IND);
3983 }
3984 /*
3985 * For passive open, trace receipt of final ACK as
3986 * tcp:::accept-established.
3987 */
3988 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3989 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3990 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3991 }
3992 TCPS_CONN_INC(tcps);
3993
3994 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3995 bytes_acked--;
3996 /* SYN was acked - making progress */
3997 tcp->tcp_ip_forward_progress = B_TRUE;
3998
3999 /*
4000 * If SYN was retransmitted, need to reset all
4001 * retransmission info as this segment will be
4002 * treated as a dup ACK.
4003 */
4004 if (tcp->tcp_rexmit) {
4005 tcp->tcp_rexmit = B_FALSE;
4006 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4007 tcp->tcp_rexmit_max = tcp->tcp_snxt;
4008 tcp->tcp_ms_we_have_waited = 0;
4009 DTRACE_PROBE3(cwnd__retransmitted__syn,
4010 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
4011 uint32_t, tcp->tcp_mss);
4012 tcp->tcp_cwnd = mss;
4013 }
4014
4015 /*
4016 * We set the send window to zero here.
4017 * This is needed if there is data to be
4018 * processed already on the queue.
4019 * Later (at swnd_update label), the
4020 * "new_swnd > tcp_swnd" condition is satisfied
4021 * the XMIT_NEEDED flag is set in the current
4022 * (SYN_RCVD) state. This ensures tcp_wput_data() is
4023 * called if there is already data on queue in
4024 * this state.
4025 */
4026 tcp->tcp_swnd = 0;
4027
4028 if (new_swnd > tcp->tcp_max_swnd)
4029 tcp->tcp_max_swnd = new_swnd;
4030 tcp->tcp_swl1 = seg_seq;
4031 tcp->tcp_swl2 = seg_ack;
4032 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
4033
4034 /* Trace change from SYN_RCVD -> ESTABLISHED here */
4035 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4036 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4037 int32_t, TCPS_SYN_RCVD);
4038
4039 /* Fuse when both sides are in ESTABLISHED state */
4040 if (tcp->tcp_loopback && do_tcp_fusion)
4041 tcp_fuse(tcp, iphdr, tcpha);
4042
4043 }
4044 /* This code follows 4.4BSD-Lite2 mostly. */
4045 if (bytes_acked < 0)
4046 goto est;
4047
4048 /*
4049 * If TCP is ECN capable and the congestion experience bit is
4050 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
4051 * done once per window (or more loosely, per RTT).
4052 */
4053 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
4054 tcp->tcp_cwr = B_FALSE;
4055 if (tcp->tcp_ecn_ok && (flags & TH_ECE) && !tcp->tcp_cwr) {
4056 cc_cong_signal(tcp, seg_ack, CC_ECN);
4057 /*
4058 * If the cwnd is 0, use the timer to clock out
4059 * new segments. This is required by the ECN spec.
4060 */
4061 if (tcp->tcp_cwnd == 0)
4062 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4063 tcp->tcp_cwr = B_TRUE;
4064 /*
4065 * This marks the end of the current window of in
4066 * flight data. That is why we don't use
4067 * tcp_suna + tcp_swnd. Only data in flight can
4068 * provide ECN info.
4069 */
4070 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
4071 }
4072
4073 mp1 = tcp->tcp_xmit_head;
4074 if (bytes_acked == 0) {
4075 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
4076 int dupack_cnt;
4077
4078 TCPS_BUMP_MIB(tcps, tcpInDupAck);
4079 /*
4080 * Fast retransmit. When we have seen exactly three
4081 * identical ACKs while we have unacked data
4082 * outstanding we take it as a hint that our peer
4083 * dropped something.
4084 *
4085 * If TCP is retransmitting, don't do fast retransmit.
4086 */
4087 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
4088 ! tcp->tcp_rexmit) {
4089 /* Do Limited Transmit */
4090 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
4091 tcps->tcps_dupack_fast_retransmit) {
4092 cc_ack_received(tcp, seg_ack,
4093 bytes_acked, CC_DUPACK);
4094 /*
4095 * RFC 3042
4096 *
4097 * What we need to do is temporarily
4098 * increase tcp_cwnd so that new
4099 * data can be sent if it is allowed
4100 * by the receive window (tcp_rwnd).
4101 * tcp_wput_data() will take care of
4102 * the rest.
4103 *
4104 * If the connection is SACK capable,
4105 * only do limited xmit when there
4106 * is SACK info.
4107 *
4108 * Note how tcp_cwnd is incremented.
4109 * The first dup ACK will increase
4110 * it by 1 MSS. The second dup ACK
4111 * will increase it by 2 MSS. This
4112 * means that only 1 new segment will
4113 * be sent for each dup ACK.
4114 */
4115 if (tcp->tcp_unsent > 0 &&
4116 (!tcp->tcp_snd_sack_ok ||
4117 (tcp->tcp_snd_sack_ok &&
4118 tcp->tcp_notsack_list != NULL))) {
4119 tcp->tcp_cwnd += mss <<
4120 (tcp->tcp_dupack_cnt - 1);
4121 flags |= TH_LIMIT_XMIT;
4122 }
4123 } else if (dupack_cnt ==
4124 tcps->tcps_dupack_fast_retransmit) {
4125
4126 /*
4127 * If we have reduced tcp_ssthresh
4128 * because of ECN, do not reduce it again
4129 * unless it is already one window of data
4130 * away. After one window of data, tcp_cwr
4131 * should then be cleared. Note that
4132 * for non ECN capable connection, tcp_cwr
4133 * should always be false.
4134 *
4135 * Adjust cwnd since the duplicate
4136 * ack indicates that a packet was
4137 * dropped (due to congestion.)
4138 */
4139 if (!tcp->tcp_cwr) {
4140 cc_cong_signal(tcp, seg_ack,
4141 CC_NDUPACK);
4142 cc_ack_received(tcp, seg_ack,
4143 bytes_acked, CC_DUPACK);
4144 }
4145 if (tcp->tcp_ecn_ok) {
4146 tcp->tcp_cwr = B_TRUE;
4147 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
4148 tcp->tcp_ecn_cwr_sent = B_FALSE;
4149 }
4150
4151 /*
4152 * We do Hoe's algorithm. Refer to her
4153 * paper "Improving the Start-up Behavior
4154 * of a Congestion Control Scheme for TCP,"
4155 * appeared in SIGCOMM'96.
4156 *
4157 * Save highest seq no we have sent so far.
4158 * Be careful about the invisible FIN byte.
4159 */
4160 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
4161 (tcp->tcp_unsent == 0)) {
4162 tcp->tcp_rexmit_max = tcp->tcp_fss;
4163 } else {
4164 tcp->tcp_rexmit_max = tcp->tcp_snxt;
4165 }
4166
4167 /*
4168 * For SACK:
4169 * Calculate tcp_pipe, which is the
4170 * estimated number of bytes in
4171 * network.
4172 *
4173 * tcp_fack is the highest sack'ed seq num
4174 * TCP has received.
4175 *
4176 * tcp_pipe is explained in the above quoted
4177 * Fall and Floyd's paper. tcp_fack is
4178 * explained in Mathis and Mahdavi's
4179 * "Forward Acknowledgment: Refining TCP
4180 * Congestion Control" in SIGCOMM '96.
4181 */
4182 if (tcp->tcp_snd_sack_ok) {
4183 if (tcp->tcp_notsack_list != NULL) {
4184 tcp->tcp_pipe = tcp->tcp_snxt -
4185 tcp->tcp_fack;
4186 tcp->tcp_sack_snxt = seg_ack;
4187 flags |= TH_NEED_SACK_REXMIT;
4188 } else {
4189 /*
4190 * Always initialize tcp_pipe
4191 * even though we don't have
4192 * any SACK info. If later
4193 * we get SACK info and
4194 * tcp_pipe is not initialized,
4195 * funny things will happen.
4196 */
4197 tcp->tcp_pipe =
4198 tcp->tcp_cwnd_ssthresh;
4199 }
4200 } else {
4201 flags |= TH_REXMIT_NEEDED;
4202 } /* tcp_snd_sack_ok */
4203
4204 } else {
4205 cc_ack_received(tcp, seg_ack,
4206 bytes_acked, CC_DUPACK);
4207 /*
4208 * Here we perform congestion
4209 * avoidance, but NOT slow start.
4210 * This is known as the Fast
4211 * Recovery Algorithm.
4212 */
4213 if (tcp->tcp_snd_sack_ok &&
4214 tcp->tcp_notsack_list != NULL) {
4215 flags |= TH_NEED_SACK_REXMIT;
4216 tcp->tcp_pipe -= mss;
4217 if (tcp->tcp_pipe < 0)
4218 tcp->tcp_pipe = 0;
4219 } else {
4220 /*
4221 * We know that one more packet has
4222 * left the pipe thus we can update
4223 * cwnd.
4224 */
4225 cwnd = tcp->tcp_cwnd + mss;
4226 if (cwnd > tcp->tcp_cwnd_max)
4227 cwnd = tcp->tcp_cwnd_max;
4228 DTRACE_PROBE3(cwnd__fast__recovery,
4229 tcp_t *, tcp,
4230 uint32_t, tcp->tcp_cwnd,
4231 uint32_t, cwnd);
4232 tcp->tcp_cwnd = cwnd;
4233 if (tcp->tcp_unsent > 0)
4234 flags |= TH_XMIT_NEEDED;
4235 }
4236 }
4237 }
4238 } else if (tcp->tcp_zero_win_probe) {
4239 /*
4240 * If the window has opened, need to arrange
4241 * to send additional data.
4242 */
4243 if (new_swnd != 0) {
4244 /* tcp_suna != tcp_snxt */
4245 /* Packet contains a window update */
4246 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4247 tcp->tcp_zero_win_probe = 0;
4248 tcp->tcp_timer_backoff = 0;
4249 tcp->tcp_ms_we_have_waited = 0;
4250
4251 /*
4252 * Transmit starting with tcp_suna since
4253 * the one byte probe is not ack'ed.
4254 * If TCP has sent more than one identical
4255 * probe, tcp_rexmit will be set. That means
4256 * tcp_ss_rexmit() will send out the one
4257 * byte along with new data. Otherwise,
4258 * fake the retransmission.
4259 */
4260 flags |= TH_XMIT_NEEDED;
4261 if (!tcp->tcp_rexmit) {
4262 tcp->tcp_rexmit = B_TRUE;
4263 tcp->tcp_dupack_cnt = 0;
4264 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4265 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4266 }
4267 }
4268 }
4269 goto swnd_update;
4270 }
4271
4272 /*
4273 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4274 * If the ACK value acks something that we have not yet sent, it might
4275 * be an old duplicate segment. Send an ACK to re-synchronize the
4276 * other side.
4277 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4278 * state is handled above, so we can always just drop the segment and
4279 * send an ACK here.
4280 *
4281 * In the case where the peer shrinks the window, we see the new window
4282 * update, but all the data sent previously is queued up by the peer.
4283 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4284 * number, which was already sent, and within window, is recorded.
4285 * tcp_snxt is then updated.
4286 *
4287 * If the window has previously shrunk, and an ACK for data not yet
4288 * sent, according to tcp_snxt is recieved, it may still be valid. If
4289 * the ACK is for data within the window at the time the window was
4290 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4291 * the sequence number ACK'ed.
4292 *
4293 * If the ACK covers all the data sent at the time the window was
4294 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4295 *
4296 * Should we send ACKs in response to ACK only segments?
4297 */
4298
4299 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4300 if ((tcp->tcp_is_wnd_shrnk) &&
4301 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4302 uint32_t data_acked_ahead_snxt;
4303
4304 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4305 tcp_update_xmit_tail(tcp, seg_ack);
4306 tcp->tcp_unsent -= data_acked_ahead_snxt;
4307 } else {
4308 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4309 /* drop the received segment */
4310 freemsg(mp);
4311
4312 /*
4313 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4314 * greater than 0, check if the number of such
4315 * bogus ACks is greater than that count. If yes,
4316 * don't send back any ACK. This prevents TCP from
4317 * getting into an ACK storm if somehow an attacker
4318 * successfully spoofs an acceptable segment to our
4319 * peer. If this continues (count > 2 X threshold),
4320 * we should abort this connection.
4321 */
4322 if (tcp_drop_ack_unsent_cnt > 0 &&
4323 ++tcp->tcp_in_ack_unsent >
4324 tcp_drop_ack_unsent_cnt) {
4325 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4326 if (tcp->tcp_in_ack_unsent > 2 *
4327 tcp_drop_ack_unsent_cnt) {
4328 (void) tcp_clean_death(tcp, EPROTO);
4329 }
4330 return;
4331 }
4332 mp = tcp_ack_mp(tcp);
4333 if (mp != NULL) {
4334 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4335 TCPS_BUMP_MIB(tcps, tcpOutAck);
4336 tcp_send_data(tcp, mp);
4337 }
4338 return;
4339 }
4340 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4341 tcp->tcp_snxt_shrunk)) {
4342 tcp->tcp_is_wnd_shrnk = B_FALSE;
4343 }
4344
4345 /*
4346 * TCP gets a new ACK, update the notsack'ed list to delete those
4347 * blocks that are covered by this ACK.
4348 */
4349 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4350 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4351 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4352 }
4353
4354 /*
4355 * If we got an ACK after fast retransmit, check to see
4356 * if it is a partial ACK. If it is not and the congestion
4357 * window was inflated to account for the other side's
4358 * cached packets, retract it. If it is, do Hoe's algorithm.
4359 */
4360 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4361 ASSERT(tcp->tcp_rexmit == B_FALSE);
4362 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4363 tcp->tcp_dupack_cnt = 0;
4364
4365 cc_post_recovery(tcp, seg_ack);
4366
4367 tcp->tcp_rexmit_max = seg_ack;
4368
4369 /*
4370 * Remove all notsack info to avoid confusion with
4371 * the next fast retrasnmit/recovery phase.
4372 */
4373 if (tcp->tcp_snd_sack_ok) {
4374 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4375 tcp);
4376 }
4377 } else {
4378 if (tcp->tcp_snd_sack_ok &&
4379 tcp->tcp_notsack_list != NULL) {
4380 flags |= TH_NEED_SACK_REXMIT;
4381 tcp->tcp_pipe -= mss;
4382 if (tcp->tcp_pipe < 0)
4383 tcp->tcp_pipe = 0;
4384 } else {
4385 /*
4386 * Hoe's algorithm:
4387 *
4388 * Retransmit the unack'ed segment and
4389 * restart fast recovery. Note that we
4390 * need to scale back tcp_cwnd to the
4391 * original value when we started fast
4392 * recovery. This is to prevent overly
4393 * aggressive behaviour in sending new
4394 * segments.
4395 */
4396 cwnd = tcp->tcp_cwnd_ssthresh +
4397 tcps->tcps_dupack_fast_retransmit * mss;
4398 DTRACE_PROBE3(cwnd__fast__retransmit__part__ack,
4399 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
4400 uint32_t, cwnd);
4401 tcp->tcp_cwnd = cwnd;
4402 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4403 flags |= TH_REXMIT_NEEDED;
4404 }
4405 }
4406 } else {
4407 tcp->tcp_dupack_cnt = 0;
4408 if (tcp->tcp_rexmit) {
4409 /*
4410 * TCP is retranmitting. If the ACK ack's all
4411 * outstanding data, update tcp_rexmit_max and
4412 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4413 * to the correct value.
4414 *
4415 * Note that SEQ_LEQ() is used. This is to avoid
4416 * unnecessary fast retransmit caused by dup ACKs
4417 * received when TCP does slow start retransmission
4418 * after a time out. During this phase, TCP may
4419 * send out segments which are already received.
4420 * This causes dup ACKs to be sent back.
4421 */
4422 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4423 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4424 tcp->tcp_rexmit_nxt = seg_ack;
4425 }
4426 if (seg_ack != tcp->tcp_rexmit_max) {
4427 flags |= TH_XMIT_NEEDED;
4428 }
4429 } else {
4430 tcp->tcp_rexmit = B_FALSE;
4431 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4432 }
4433 tcp->tcp_ms_we_have_waited = 0;
4434 }
4435 }
4436
4437 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4438 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4439 tcp->tcp_suna = seg_ack;
4440 if (tcp->tcp_zero_win_probe != 0) {
4441 tcp->tcp_zero_win_probe = 0;
4442 tcp->tcp_timer_backoff = 0;
4443 }
4444
4445 /*
4446 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4447 * Note that it cannot be the SYN being ack'ed. The code flow
4448 * will not reach here.
4449 */
4450 if (mp1 == NULL) {
4451 goto fin_acked;
4452 }
4453
4454 /*
4455 * Update the congestion window.
4456 *
4457 * If TCP is not ECN capable or TCP is ECN capable but the
4458 * congestion experience bit is not set, increase the tcp_cwnd as
4459 * usual.
4460 */
4461 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4462 if (IN_RECOVERY(tcp->tcp_ccv.flags)) {
4463 EXIT_RECOVERY(tcp->tcp_ccv.flags);
4464 }
4465 cc_ack_received(tcp, seg_ack, bytes_acked, CC_ACK);
4466 }
4467
4468 /* See if the latest urgent data has been acknowledged */
4469 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4470 SEQ_GT(seg_ack, tcp->tcp_urg))
4471 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4472
4473 /*
4474 * Update the RTT estimates. Note that we don't use the TCP
4475 * timestamp option to calculate RTT even if one is present. This is
4476 * because the timestamp option's resolution (CPU tick) is
4477 * too coarse to measure modern datacenter networks' microsecond
4478 * latencies. The timestamp field's resolution is limited by its
4479 * 4-byte width (see RFC1323), and since we always store a
4480 * high-resolution nanosecond presision timestamp along with the data,
4481 * there is no point to ever using the timestamp option.
4482 */
4483 if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4484 /*
4485 * An ACK sequence we haven't seen before, so get the RTT
4486 * and update the RTO. But first check if the timestamp is
4487 * valid to use.
4488 */
4489 if ((mp1->b_next != NULL) &&
4490 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) {
4491 tcp_set_rto(tcp, gethrtime() -
4492 (hrtime_t)(intptr_t)mp1->b_prev);
4493 } else {
4494 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4495 }
4496
4497 /* Remeber the last sequence to be ACKed */
4498 tcp->tcp_csuna = seg_ack;
4499 if (tcp->tcp_set_timer == 1) {
4500 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4501 tcp->tcp_set_timer = 0;
4502 }
4503 } else {
4504 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4505 }
4506
4507 /* Eat acknowledged bytes off the xmit queue. */
4508 for (;;) {
4509 mblk_t *mp2;
4510 uchar_t *wptr;
4511
4512 wptr = mp1->b_wptr;
4513 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4514 bytes_acked -= (int)(wptr - mp1->b_rptr);
4515 if (bytes_acked < 0) {
4516 mp1->b_rptr = wptr + bytes_acked;
4517 /*
4518 * Set a new timestamp if all the bytes timed by the
4519 * old timestamp have been ack'ed.
4520 */
4521 if (SEQ_GT(seg_ack,
4522 (uint32_t)(uintptr_t)(mp1->b_next))) {
4523 mp1->b_prev =
4524 (mblk_t *)(intptr_t)gethrtime();
4525 mp1->b_next = NULL;
4526 }
4527 break;
4528 }
4529 mp1->b_next = NULL;
4530 mp1->b_prev = NULL;
4531 mp2 = mp1;
4532 mp1 = mp1->b_cont;
4533
4534 /*
4535 * This notification is required for some zero-copy
4536 * clients to maintain a copy semantic. After the data
4537 * is ack'ed, client is safe to modify or reuse the buffer.
4538 */
4539 if (tcp->tcp_snd_zcopy_aware &&
4540 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4541 tcp_zcopy_notify(tcp);
4542 freeb(mp2);
4543 if (bytes_acked == 0) {
4544 if (mp1 == NULL) {
4545 /* Everything is ack'ed, clear the tail. */
4546 tcp->tcp_xmit_tail = NULL;
4547 /*
4548 * Cancel the timer unless we are still
4549 * waiting for an ACK for the FIN packet.
4550 */
4551 if (tcp->tcp_timer_tid != 0 &&
4552 tcp->tcp_snxt == tcp->tcp_suna) {
4553 (void) TCP_TIMER_CANCEL(tcp,
4554 tcp->tcp_timer_tid);
4555 tcp->tcp_timer_tid = 0;
4556 }
4557 goto pre_swnd_update;
4558 }
4559 if (mp2 != tcp->tcp_xmit_tail)
4560 break;
4561 tcp->tcp_xmit_tail = mp1;
4562 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4563 (uintptr_t)INT_MAX);
4564 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4565 mp1->b_rptr);
4566 break;
4567 }
4568 if (mp1 == NULL) {
4569 /*
4570 * More was acked but there is nothing more
4571 * outstanding. This means that the FIN was
4572 * just acked or that we're talking to a clown.
4573 */
4574 fin_acked:
4575 ASSERT(tcp->tcp_fin_sent);
4576 tcp->tcp_xmit_tail = NULL;
4577 if (tcp->tcp_fin_sent) {
4578 /* FIN was acked - making progress */
4579 if (!tcp->tcp_fin_acked)
4580 tcp->tcp_ip_forward_progress = B_TRUE;
4581 tcp->tcp_fin_acked = B_TRUE;
4582 if (tcp->tcp_linger_tid != 0 &&
4583 TCP_TIMER_CANCEL(tcp,
4584 tcp->tcp_linger_tid) >= 0) {
4585 tcp_stop_lingering(tcp);
4586 freemsg(mp);
4587 mp = NULL;
4588 }
4589 } else {
4590 /*
4591 * We should never get here because
4592 * we have already checked that the
4593 * number of bytes ack'ed should be
4594 * smaller than or equal to what we
4595 * have sent so far (it is the
4596 * acceptability check of the ACK).
4597 * We can only get here if the send
4598 * queue is corrupted.
4599 *
4600 * Terminate the connection and
4601 * panic the system. It is better
4602 * for us to panic instead of
4603 * continuing to avoid other disaster.
4604 */
4605 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4606 tcp->tcp_rnxt, TH_RST|TH_ACK);
4607 panic("Memory corruption "
4608 "detected for connection %s.",
4609 tcp_display(tcp, NULL,
4610 DISP_ADDR_AND_PORT));
4611 /*NOTREACHED*/
4612 }
4613 goto pre_swnd_update;
4614 }
4615 ASSERT(mp2 != tcp->tcp_xmit_tail);
4616 }
4617 if (tcp->tcp_unsent) {
4618 flags |= TH_XMIT_NEEDED;
4619 }
4620 pre_swnd_update:
4621 tcp->tcp_xmit_head = mp1;
4622 swnd_update:
4623 /*
4624 * The following check is different from most other implementations.
4625 * For bi-directional transfer, when segments are dropped, the
4626 * "normal" check will not accept a window update in those
4627 * retransmitted segemnts. Failing to do that, TCP may send out
4628 * segments which are outside receiver's window. As TCP accepts
4629 * the ack in those retransmitted segments, if the window update in
4630 * the same segment is not accepted, TCP will incorrectly calculates
4631 * that it can send more segments. This can create a deadlock
4632 * with the receiver if its window becomes zero.
4633 */
4634 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4635 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4636 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4637 /*
4638 * The criteria for update is:
4639 *
4640 * 1. the segment acknowledges some data. Or
4641 * 2. the segment is new, i.e. it has a higher seq num. Or
4642 * 3. the segment is not old and the advertised window is
4643 * larger than the previous advertised window.
4644 */
4645 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4646 flags |= TH_XMIT_NEEDED;
4647 tcp->tcp_swnd = new_swnd;
4648 if (new_swnd > tcp->tcp_max_swnd)
4649 tcp->tcp_max_swnd = new_swnd;
4650 tcp->tcp_swl1 = seg_seq;
4651 tcp->tcp_swl2 = seg_ack;
4652 }
4653 est:
4654 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4655
4656 switch (tcp->tcp_state) {
4657 case TCPS_FIN_WAIT_1:
4658 if (tcp->tcp_fin_acked) {
4659 tcp->tcp_state = TCPS_FIN_WAIT_2;
4660 DTRACE_TCP6(state__change, void, NULL,
4661 ip_xmit_attr_t *, connp->conn_ixa,
4662 void, NULL, tcp_t *, tcp, void, NULL,
4663 int32_t, TCPS_FIN_WAIT_1);
4664 /*
4665 * We implement the non-standard BSD/SunOS
4666 * FIN_WAIT_2 flushing algorithm.
4667 * If there is no user attached to this
4668 * TCP endpoint, then this TCP struct
4669 * could hang around forever in FIN_WAIT_2
4670 * state if the peer forgets to send us
4671 * a FIN. To prevent this, we wait only
4672 * 2*MSL (a convenient time value) for
4673 * the FIN to arrive. If it doesn't show up,
4674 * we flush the TCP endpoint. This algorithm,
4675 * though a violation of RFC-793, has worked
4676 * for over 10 years in BSD systems.
4677 * Note: SunOS 4.x waits 675 seconds before
4678 * flushing the FIN_WAIT_2 connection.
4679 */
4680 TCP_TIMER_RESTART(tcp,
4681 tcp->tcp_fin_wait_2_flush_interval);
4682 }
4683 break;
4684 case TCPS_FIN_WAIT_2:
4685 break; /* Shutdown hook? */
4686 case TCPS_LAST_ACK:
4687 freemsg(mp);
4688 if (tcp->tcp_fin_acked) {
4689 (void) tcp_clean_death(tcp, 0);
4690 return;
4691 }
4692 goto xmit_check;
4693 case TCPS_CLOSING:
4694 if (tcp->tcp_fin_acked) {
4695 SET_TIME_WAIT(tcps, tcp, connp);
4696 DTRACE_TCP6(state__change, void, NULL,
4697 ip_xmit_attr_t *, connp->conn_ixa, void,
4698 NULL, tcp_t *, tcp, void, NULL, int32_t,
4699 TCPS_CLOSING);
4700 }
4701 /*FALLTHRU*/
4702 case TCPS_CLOSE_WAIT:
4703 freemsg(mp);
4704 goto xmit_check;
4705 default:
4706 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4707 break;
4708 }
4709 }
4710 if (flags & TH_FIN) {
4711 /* Make sure we ack the fin */
4712 flags |= TH_ACK_NEEDED;
4713 if (!tcp->tcp_fin_rcvd) {
4714 tcp->tcp_fin_rcvd = B_TRUE;
4715 tcp->tcp_rnxt++;
4716 tcpha = tcp->tcp_tcpha;
4717 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4718
4719 /*
4720 * Generate the ordrel_ind at the end unless the
4721 * conn is detached or it is a STREAMS based eager.
4722 * In the eager case we defer the notification until
4723 * tcp_accept_finish has run.
4724 */
4725 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4726 (tcp->tcp_listener == NULL &&
4727 !tcp->tcp_hard_binding)))
4728 flags |= TH_ORDREL_NEEDED;
4729 switch (tcp->tcp_state) {
4730 case TCPS_SYN_RCVD:
4731 tcp->tcp_state = TCPS_CLOSE_WAIT;
4732 DTRACE_TCP6(state__change, void, NULL,
4733 ip_xmit_attr_t *, connp->conn_ixa,
4734 void, NULL, tcp_t *, tcp, void, NULL,
4735 int32_t, TCPS_SYN_RCVD);
4736 /* Keepalive? */
4737 break;
4738 case TCPS_ESTABLISHED:
4739 tcp->tcp_state = TCPS_CLOSE_WAIT;
4740 DTRACE_TCP6(state__change, void, NULL,
4741 ip_xmit_attr_t *, connp->conn_ixa,
4742 void, NULL, tcp_t *, tcp, void, NULL,
4743 int32_t, TCPS_ESTABLISHED);
4744 /* Keepalive? */
4745 break;
4746 case TCPS_FIN_WAIT_1:
4747 if (!tcp->tcp_fin_acked) {
4748 tcp->tcp_state = TCPS_CLOSING;
4749 DTRACE_TCP6(state__change, void, NULL,
4750 ip_xmit_attr_t *, connp->conn_ixa,
4751 void, NULL, tcp_t *, tcp, void,
4752 NULL, int32_t, TCPS_FIN_WAIT_1);
4753 break;
4754 }
4755 /* FALLTHRU */
4756 case TCPS_FIN_WAIT_2:
4757 SET_TIME_WAIT(tcps, tcp, connp);
4758 DTRACE_TCP6(state__change, void, NULL,
4759 ip_xmit_attr_t *, connp->conn_ixa, void,
4760 NULL, tcp_t *, tcp, void, NULL, int32_t,
4761 TCPS_FIN_WAIT_2);
4762 if (seg_len) {
4763 /*
4764 * implies data piggybacked on FIN.
4765 * break to handle data.
4766 */
4767 break;
4768 }
4769 freemsg(mp);
4770 goto ack_check;
4771 }
4772 }
4773 }
4774 if (mp == NULL)
4775 goto xmit_check;
4776 if (seg_len == 0) {
4777 freemsg(mp);
4778 goto xmit_check;
4779 }
4780 if (mp->b_rptr == mp->b_wptr) {
4781 /*
4782 * The header has been consumed, so we remove the
4783 * zero-length mblk here.
4784 */
4785 mp1 = mp;
4786 mp = mp->b_cont;
4787 freeb(mp1);
4788 }
4789 update_ack:
4790 tcpha = tcp->tcp_tcpha;
4791 tcp->tcp_rack_cnt++;
4792 {
4793 uint32_t cur_max;
4794
4795 cur_max = tcp->tcp_rack_cur_max;
4796 if (tcp->tcp_rack_cnt >= cur_max) {
4797 /*
4798 * We have more unacked data than we should - send
4799 * an ACK now.
4800 */
4801 flags |= TH_ACK_NEEDED;
4802 cur_max++;
4803 if (cur_max > tcp->tcp_rack_abs_max)
4804 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4805 else
4806 tcp->tcp_rack_cur_max = cur_max;
4807 } else if (tcp->tcp_quickack) {
4808 /* The executable asked that we ack each packet */
4809 flags |= TH_ACK_NEEDED;
4810 } else if (TCP_IS_DETACHED(tcp)) {
4811 /* We don't have an ACK timer for detached TCP. */
4812 flags |= TH_ACK_NEEDED;
4813 } else if (seg_len < mss) {
4814 /*
4815 * If we get a segment that is less than an mss, and we
4816 * already have unacknowledged data, and the amount
4817 * unacknowledged is not a multiple of mss, then we
4818 * better generate an ACK now. Otherwise, this may be
4819 * the tail piece of a transaction, and we would rather
4820 * wait for the response.
4821 */
4822 uint32_t udif;
4823 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4824 (uintptr_t)INT_MAX);
4825 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4826 if (udif && (udif % mss))
4827 flags |= TH_ACK_NEEDED;
4828 else
4829 flags |= TH_ACK_TIMER_NEEDED;
4830 } else {
4831 /* Start delayed ack timer */
4832 flags |= TH_ACK_TIMER_NEEDED;
4833 }
4834 }
4835 tcp->tcp_rnxt += seg_len;
4836 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4837
4838 if (mp == NULL)
4839 goto xmit_check;
4840
4841 /* Update SACK list */
4842 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4843 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4844 &(tcp->tcp_num_sack_blk));
4845 }
4846
4847 if (tcp->tcp_urp_mp) {
4848 tcp->tcp_urp_mp->b_cont = mp;
4849 mp = tcp->tcp_urp_mp;
4850 tcp->tcp_urp_mp = NULL;
4851 /* Ready for a new signal. */
4852 tcp->tcp_urp_last_valid = B_FALSE;
4853 #ifdef DEBUG
4854 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4855 "tcp_rput: sending exdata_ind %s",
4856 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4857 #endif /* DEBUG */
4858 }
4859
4860 /*
4861 * Check for ancillary data changes compared to last segment.
4862 */
4863 if (connp->conn_recv_ancillary.crb_all != 0) {
4864 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4865 if (mp == NULL)
4866 return;
4867 }
4868
4869 if (IPCL_IS_NONSTR(connp)) {
4870 /*
4871 * Non-STREAMS socket
4872 */
4873 boolean_t push = flags & (TH_PUSH|TH_FIN);
4874 int error;
4875
4876 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4877 mp, seg_len, 0, &error, &push) <= 0) {
4878 /*
4879 * We should never be in middle of a
4880 * fallback, the squeue guarantees that.
4881 */
4882 ASSERT(error != EOPNOTSUPP);
4883 if (error == ENOSPC)
4884 tcp->tcp_rwnd -= seg_len;
4885 } else if (push) {
4886 /* PUSH bit set and sockfs is not flow controlled */
4887 flags |= tcp_rwnd_reopen(tcp);
4888 }
4889 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4890 /*
4891 * Side queue inbound data until the accept happens.
4892 * tcp_accept/tcp_rput drains this when the accept happens.
4893 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4894 * T_EXDATA_IND) it is queued on b_next.
4895 * XXX Make urgent data use this. Requires:
4896 * Removing tcp_listener check for TH_URG
4897 * Making M_PCPROTO and MARK messages skip the eager case
4898 */
4899
4900 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4901 } else {
4902 /* Active STREAMS socket */
4903 if (mp->b_datap->db_type != M_DATA ||
4904 (flags & TH_MARKNEXT_NEEDED)) {
4905 if (tcp->tcp_rcv_list != NULL) {
4906 flags |= tcp_rcv_drain(tcp);
4907 }
4908 ASSERT(tcp->tcp_rcv_list == NULL ||
4909 tcp->tcp_fused_sigurg);
4910
4911 if (flags & TH_MARKNEXT_NEEDED) {
4912 #ifdef DEBUG
4913 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4914 "tcp_rput: sending MSGMARKNEXT %s",
4915 tcp_display(tcp, NULL,
4916 DISP_PORT_ONLY));
4917 #endif /* DEBUG */
4918 mp->b_flag |= MSGMARKNEXT;
4919 flags &= ~TH_MARKNEXT_NEEDED;
4920 }
4921
4922 if (is_system_labeled())
4923 tcp_setcred_data(mp, ira);
4924
4925 putnext(connp->conn_rq, mp);
4926 if (!canputnext(connp->conn_rq))
4927 tcp->tcp_rwnd -= seg_len;
4928 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4929 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4930 if (tcp->tcp_rcv_list != NULL) {
4931 /*
4932 * Enqueue the new segment first and then
4933 * call tcp_rcv_drain() to send all data
4934 * up. The other way to do this is to
4935 * send all queued data up and then call
4936 * putnext() to send the new segment up.
4937 * This way can remove the else part later
4938 * on.
4939 *
4940 * We don't do this to avoid one more call to
4941 * canputnext() as tcp_rcv_drain() needs to
4942 * call canputnext().
4943 */
4944 tcp_rcv_enqueue(tcp, mp, seg_len,
4945 ira->ira_cred);
4946 flags |= tcp_rcv_drain(tcp);
4947 } else {
4948 if (is_system_labeled())
4949 tcp_setcred_data(mp, ira);
4950
4951 putnext(connp->conn_rq, mp);
4952 if (!canputnext(connp->conn_rq))
4953 tcp->tcp_rwnd -= seg_len;
4954 }
4955 } else {
4956 /*
4957 * Enqueue all packets when processing an mblk
4958 * from the co queue and also enqueue normal packets.
4959 */
4960 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4961 }
4962 /*
4963 * Make sure the timer is running if we have data waiting
4964 * for a push bit. This provides resiliency against
4965 * implementations that do not correctly generate push bits.
4966 */
4967 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4968 /*
4969 * The connection may be closed at this point, so don't
4970 * do anything for a detached tcp.
4971 */
4972 if (!TCP_IS_DETACHED(tcp))
4973 tcp->tcp_push_tid = TCP_TIMER(tcp,
4974 tcp_push_timer,
4975 tcps->tcps_push_timer_interval);
4976 }
4977 }
4978
4979 xmit_check:
4980 /* Is there anything left to do? */
4981 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4982 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4983 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4984 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4985 goto done;
4986
4987 /* Any transmit work to do and a non-zero window? */
4988 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4989 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4990 if (flags & TH_REXMIT_NEEDED) {
4991 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4992
4993 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4994 if (snd_size > mss)
4995 snd_size = mss;
4996 if (snd_size > tcp->tcp_swnd)
4997 snd_size = tcp->tcp_swnd;
4998 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4999 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
5000 B_TRUE);
5001
5002 if (mp1 != NULL) {
5003 tcp->tcp_xmit_head->b_prev =
5004 (mblk_t *)(intptr_t)gethrtime();
5005 tcp->tcp_csuna = tcp->tcp_snxt;
5006 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
5007 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
5008 snd_size);
5009 tcp->tcp_cs.tcp_out_retrans_segs++;
5010 tcp->tcp_cs.tcp_out_retrans_bytes += snd_size;
5011 tcp_send_data(tcp, mp1);
5012 }
5013 }
5014 if (flags & TH_NEED_SACK_REXMIT) {
5015 tcp_sack_rexmit(tcp, &flags);
5016 }
5017 /*
5018 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
5019 * out new segment. Note that tcp_rexmit should not be
5020 * set, otherwise TH_LIMIT_XMIT should not be set.
5021 */
5022 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
5023 if (!tcp->tcp_rexmit) {
5024 tcp_wput_data(tcp, NULL, B_FALSE);
5025 } else {
5026 tcp_ss_rexmit(tcp);
5027 }
5028 }
5029 /*
5030 * Adjust tcp_cwnd back to normal value after sending
5031 * new data segments.
5032 */
5033 if (flags & TH_LIMIT_XMIT) {
5034 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
5035 /*
5036 * This will restart the timer. Restarting the
5037 * timer is used to avoid a timeout before the
5038 * limited transmitted segment's ACK gets back.
5039 */
5040 if (tcp->tcp_xmit_head != NULL) {
5041 tcp->tcp_xmit_head->b_prev =
5042 (mblk_t *)(intptr_t)gethrtime();
5043 }
5044 }
5045
5046 /* Anything more to do? */
5047 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
5048 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
5049 goto done;
5050 }
5051 ack_check:
5052 if (flags & TH_SEND_URP_MARK) {
5053 ASSERT(tcp->tcp_urp_mark_mp);
5054 ASSERT(!IPCL_IS_NONSTR(connp));
5055 /*
5056 * Send up any queued data and then send the mark message
5057 */
5058 if (tcp->tcp_rcv_list != NULL) {
5059 flags |= tcp_rcv_drain(tcp);
5060
5061 }
5062 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5063 mp1 = tcp->tcp_urp_mark_mp;
5064 tcp->tcp_urp_mark_mp = NULL;
5065 if (is_system_labeled())
5066 tcp_setcred_data(mp1, ira);
5067
5068 putnext(connp->conn_rq, mp1);
5069 #ifdef DEBUG
5070 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
5071 "tcp_rput: sending zero-length %s %s",
5072 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
5073 "MSGNOTMARKNEXT"),
5074 tcp_display(tcp, NULL, DISP_PORT_ONLY));
5075 #endif /* DEBUG */
5076 flags &= ~TH_SEND_URP_MARK;
5077 }
5078 if (flags & TH_ACK_NEEDED) {
5079 /*
5080 * Time to send an ack for some reason.
5081 */
5082 mp1 = tcp_ack_mp(tcp);
5083
5084 if (mp1 != NULL) {
5085 tcp_send_data(tcp, mp1);
5086 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
5087 TCPS_BUMP_MIB(tcps, tcpOutAck);
5088 }
5089 if (tcp->tcp_ack_tid != 0) {
5090 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
5091 tcp->tcp_ack_tid = 0;
5092 }
5093 }
5094 if (flags & TH_ACK_TIMER_NEEDED) {
5095 /*
5096 * Arrange for deferred ACK or push wait timeout.
5097 * Start timer if it is not already running.
5098 */
5099 if (tcp->tcp_ack_tid == 0) {
5100 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
5101 tcp->tcp_localnet ?
5102 tcps->tcps_local_dack_interval :
5103 tcps->tcps_deferred_ack_interval);
5104 }
5105 }
5106 if (flags & TH_ORDREL_NEEDED) {
5107 /*
5108 * Notify upper layer about an orderly release. If this is
5109 * a non-STREAMS socket, then just make an upcall. For STREAMS
5110 * we send up an ordrel_ind, unless this is an eager, in which
5111 * case the ordrel will be sent when tcp_accept_finish runs.
5112 * Note that for non-STREAMS we make an upcall even if it is an
5113 * eager, because we have an upper handle to send it to.
5114 */
5115 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
5116 ASSERT(!tcp->tcp_detached);
5117
5118 if (IPCL_IS_NONSTR(connp)) {
5119 ASSERT(tcp->tcp_ordrel_mp == NULL);
5120 tcp->tcp_ordrel_done = B_TRUE;
5121 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
5122 SOCK_OPCTL_SHUT_RECV, 0);
5123 goto done;
5124 }
5125
5126 if (tcp->tcp_rcv_list != NULL) {
5127 /*
5128 * Push any mblk(s) enqueued from co processing.
5129 */
5130 flags |= tcp_rcv_drain(tcp);
5131 }
5132 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5133
5134 mp1 = tcp->tcp_ordrel_mp;
5135 tcp->tcp_ordrel_mp = NULL;
5136 tcp->tcp_ordrel_done = B_TRUE;
5137 putnext(connp->conn_rq, mp1);
5138 }
5139 done:
5140 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5141 }
5142
5143 /*
5144 * Attach ancillary data to a received TCP segments for the
5145 * ancillary pieces requested by the application that are
5146 * different than they were in the previous data segment.
5147 *
5148 * Save the "current" values once memory allocation is ok so that
5149 * when memory allocation fails we can just wait for the next data segment.
5150 */
5151 static mblk_t *
tcp_input_add_ancillary(tcp_t * tcp,mblk_t * mp,ip_pkt_t * ipp,ip_recv_attr_t * ira)5152 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5153 ip_recv_attr_t *ira)
5154 {
5155 struct T_optdata_ind *todi;
5156 int optlen;
5157 uchar_t *optptr;
5158 struct T_opthdr *toh;
5159 crb_t addflag; /* Which pieces to add */
5160 mblk_t *mp1;
5161 conn_t *connp = tcp->tcp_connp;
5162
5163 optlen = 0;
5164 addflag.crb_all = 0;
5165
5166 /* If app asked for TOS and it has changed ... */
5167 if (connp->conn_recv_ancillary.crb_recvtos &&
5168 ipp->ipp_type_of_service != tcp->tcp_recvtos &&
5169 (ira->ira_flags & IRAF_IS_IPV4)) {
5170 optlen += sizeof (struct T_opthdr) +
5171 P2ROUNDUP(sizeof (uint8_t), __TPI_ALIGN_SIZE);
5172 addflag.crb_recvtos = 1;
5173 }
5174 /* If app asked for pktinfo and the index has changed ... */
5175 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5176 ira->ira_ruifindex != tcp->tcp_recvifindex) {
5177 optlen += sizeof (struct T_opthdr) +
5178 sizeof (struct in6_pktinfo);
5179 addflag.crb_ip_recvpktinfo = 1;
5180 }
5181 /* If app asked for hoplimit and it has changed ... */
5182 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5183 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5184 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5185 addflag.crb_ipv6_recvhoplimit = 1;
5186 }
5187 /* If app asked for tclass and it has changed ... */
5188 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5189 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5190 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5191 addflag.crb_ipv6_recvtclass = 1;
5192 }
5193
5194 /*
5195 * If app asked for hop-by-hop headers and it has changed ...
5196 * For security labels, note that (1) security labels can't change on
5197 * a connected socket at all, (2) we're connected to at most one peer,
5198 * (3) if anything changes, then it must be some other extra option.
5199 */
5200 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5201 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5202 (ipp->ipp_fields & IPPF_HOPOPTS),
5203 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5204 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5205 addflag.crb_ipv6_recvhopopts = 1;
5206 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5207 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5208 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5209 return (mp);
5210 }
5211 /* If app asked for dst headers before routing headers ... */
5212 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5213 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5214 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5215 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5216 optlen += sizeof (struct T_opthdr) +
5217 ipp->ipp_rthdrdstoptslen;
5218 addflag.crb_ipv6_recvrthdrdstopts = 1;
5219 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5220 &tcp->tcp_rthdrdstoptslen,
5221 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5222 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5223 return (mp);
5224 }
5225 /* If app asked for routing headers and it has changed ... */
5226 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5227 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5228 (ipp->ipp_fields & IPPF_RTHDR),
5229 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5230 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5231 addflag.crb_ipv6_recvrthdr = 1;
5232 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5233 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5234 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5235 return (mp);
5236 }
5237 /* If app asked for dest headers and it has changed ... */
5238 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5239 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5240 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5241 (ipp->ipp_fields & IPPF_DSTOPTS),
5242 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5243 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5244 addflag.crb_ipv6_recvdstopts = 1;
5245 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5246 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5247 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5248 return (mp);
5249 }
5250
5251 if (optlen == 0) {
5252 /* Nothing to add */
5253 return (mp);
5254 }
5255 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5256 if (mp1 == NULL) {
5257 /*
5258 * Defer sending ancillary data until the next TCP segment
5259 * arrives.
5260 */
5261 return (mp);
5262 }
5263 mp1->b_cont = mp;
5264 mp = mp1;
5265 mp->b_wptr += sizeof (*todi) + optlen;
5266 mp->b_datap->db_type = M_PROTO;
5267 todi = (struct T_optdata_ind *)mp->b_rptr;
5268 todi->PRIM_type = T_OPTDATA_IND;
5269 todi->DATA_flag = 1; /* MORE data */
5270 todi->OPT_length = optlen;
5271 todi->OPT_offset = sizeof (*todi);
5272 optptr = (uchar_t *)&todi[1];
5273
5274 /* If app asked for TOS and it has changed ... */
5275 if (addflag.crb_recvtos) {
5276 toh = (struct T_opthdr *)optptr;
5277 toh->level = IPPROTO_IP;
5278 toh->name = IP_RECVTOS;
5279 toh->len = sizeof (*toh) +
5280 P2ROUNDUP(sizeof (uint8_t), __TPI_ALIGN_SIZE);
5281 toh->status = 0;
5282 optptr += sizeof (*toh);
5283 *(uint8_t *)optptr = ipp->ipp_type_of_service;
5284 optptr = (uchar_t *)toh + toh->len;
5285 ASSERT(__TPI_TOPT_ISALIGNED(optptr));
5286 /* Save as "last" value */
5287 tcp->tcp_recvtos = ipp->ipp_type_of_service;
5288 }
5289
5290 /*
5291 * If app asked for pktinfo and the index has changed ...
5292 * Note that the local address never changes for the connection.
5293 */
5294 if (addflag.crb_ip_recvpktinfo) {
5295 struct in6_pktinfo *pkti;
5296 uint_t ifindex;
5297
5298 ifindex = ira->ira_ruifindex;
5299 toh = (struct T_opthdr *)optptr;
5300 toh->level = IPPROTO_IPV6;
5301 toh->name = IPV6_PKTINFO;
5302 toh->len = sizeof (*toh) + sizeof (*pkti);
5303 toh->status = 0;
5304 optptr += sizeof (*toh);
5305 pkti = (struct in6_pktinfo *)optptr;
5306 pkti->ipi6_addr = connp->conn_laddr_v6;
5307 pkti->ipi6_ifindex = ifindex;
5308 optptr += sizeof (*pkti);
5309 ASSERT(OK_32PTR(optptr));
5310 /* Save as "last" value */
5311 tcp->tcp_recvifindex = ifindex;
5312 }
5313 /* If app asked for hoplimit and it has changed ... */
5314 if (addflag.crb_ipv6_recvhoplimit) {
5315 toh = (struct T_opthdr *)optptr;
5316 toh->level = IPPROTO_IPV6;
5317 toh->name = IPV6_HOPLIMIT;
5318 toh->len = sizeof (*toh) + sizeof (uint_t);
5319 toh->status = 0;
5320 optptr += sizeof (*toh);
5321 *(uint_t *)optptr = ipp->ipp_hoplimit;
5322 optptr += sizeof (uint_t);
5323 ASSERT(OK_32PTR(optptr));
5324 /* Save as "last" value */
5325 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5326 }
5327 /* If app asked for tclass and it has changed ... */
5328 if (addflag.crb_ipv6_recvtclass) {
5329 toh = (struct T_opthdr *)optptr;
5330 toh->level = IPPROTO_IPV6;
5331 toh->name = IPV6_TCLASS;
5332 toh->len = sizeof (*toh) + sizeof (uint_t);
5333 toh->status = 0;
5334 optptr += sizeof (*toh);
5335 *(uint_t *)optptr = ipp->ipp_tclass;
5336 optptr += sizeof (uint_t);
5337 ASSERT(OK_32PTR(optptr));
5338 /* Save as "last" value */
5339 tcp->tcp_recvtclass = ipp->ipp_tclass;
5340 }
5341 if (addflag.crb_ipv6_recvhopopts) {
5342 toh = (struct T_opthdr *)optptr;
5343 toh->level = IPPROTO_IPV6;
5344 toh->name = IPV6_HOPOPTS;
5345 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5346 toh->status = 0;
5347 optptr += sizeof (*toh);
5348 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5349 optptr += ipp->ipp_hopoptslen;
5350 ASSERT(OK_32PTR(optptr));
5351 /* Save as last value */
5352 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5353 (ipp->ipp_fields & IPPF_HOPOPTS),
5354 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5355 }
5356 if (addflag.crb_ipv6_recvrthdrdstopts) {
5357 toh = (struct T_opthdr *)optptr;
5358 toh->level = IPPROTO_IPV6;
5359 toh->name = IPV6_RTHDRDSTOPTS;
5360 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5361 toh->status = 0;
5362 optptr += sizeof (*toh);
5363 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5364 optptr += ipp->ipp_rthdrdstoptslen;
5365 ASSERT(OK_32PTR(optptr));
5366 /* Save as last value */
5367 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5368 &tcp->tcp_rthdrdstoptslen,
5369 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5370 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5371 }
5372 if (addflag.crb_ipv6_recvrthdr) {
5373 toh = (struct T_opthdr *)optptr;
5374 toh->level = IPPROTO_IPV6;
5375 toh->name = IPV6_RTHDR;
5376 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5377 toh->status = 0;
5378 optptr += sizeof (*toh);
5379 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5380 optptr += ipp->ipp_rthdrlen;
5381 ASSERT(OK_32PTR(optptr));
5382 /* Save as last value */
5383 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5384 (ipp->ipp_fields & IPPF_RTHDR),
5385 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5386 }
5387 if (addflag.crb_ipv6_recvdstopts) {
5388 toh = (struct T_opthdr *)optptr;
5389 toh->level = IPPROTO_IPV6;
5390 toh->name = IPV6_DSTOPTS;
5391 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5392 toh->status = 0;
5393 optptr += sizeof (*toh);
5394 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5395 optptr += ipp->ipp_dstoptslen;
5396 ASSERT(OK_32PTR(optptr));
5397 /* Save as last value */
5398 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5399 (ipp->ipp_fields & IPPF_DSTOPTS),
5400 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5401 }
5402 ASSERT(optptr == mp->b_wptr);
5403 return (mp);
5404 }
5405
5406 /* The minimum of smoothed mean deviation in RTO calculation (nsec). */
5407 #define TCP_SD_MIN 400000000
5408
5409 /*
5410 * Set RTO for this connection based on a new round-trip time measurement.
5411 * The formula is from Jacobson and Karels' "Congestion Avoidance and Control"
5412 * in SIGCOMM '88. The variable names are the same as those in Appendix A.2
5413 * of that paper.
5414 *
5415 * m = new measurement
5416 * sa = smoothed RTT average (8 * average estimates).
5417 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5418 */
5419 static void
tcp_set_rto(tcp_t * tcp,hrtime_t rtt)5420 tcp_set_rto(tcp_t *tcp, hrtime_t rtt)
5421 {
5422 hrtime_t m = rtt;
5423 hrtime_t sa = tcp->tcp_rtt_sa;
5424 hrtime_t sv = tcp->tcp_rtt_sd;
5425 tcp_stack_t *tcps = tcp->tcp_tcps;
5426
5427 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5428 tcp->tcp_rtt_update++;
5429 tcp->tcp_rtt_sum += m;
5430 tcp->tcp_rtt_cnt++;
5431
5432 /* tcp_rtt_sa is not 0 means this is a new sample. */
5433 if (sa != 0) {
5434 /*
5435 * Update average estimator (see section 2.3 of RFC6298):
5436 * SRTT = 7/8 SRTT + 1/8 rtt
5437 *
5438 * We maintain tcp_rtt_sa as 8 * SRTT, so this reduces to:
5439 * tcp_rtt_sa = 7 * SRTT + rtt
5440 * tcp_rtt_sa = 7 * (tcp_rtt_sa / 8) + rtt
5441 * tcp_rtt_sa = tcp_rtt_sa - (tcp_rtt_sa / 8) + rtt
5442 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 8))
5443 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 2^3))
5444 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa >> 3))
5445 *
5446 * (rtt - tcp_rtt_sa / 8) is simply the difference
5447 * between the new rtt measurement and the existing smoothed
5448 * RTT average. This is referred to as "Error" in subsequent
5449 * calculations.
5450 */
5451
5452 /* m is now Error. */
5453 m -= sa >> 3;
5454 if ((sa += m) <= 0) {
5455 /*
5456 * Don't allow the smoothed average to be negative.
5457 * We use 0 to denote reinitialization of the
5458 * variables.
5459 */
5460 sa = 1;
5461 }
5462
5463 /*
5464 * Update deviation estimator:
5465 * mdev = 3/4 mdev + 1/4 abs(Error)
5466 *
5467 * We maintain tcp_rtt_sd as 4 * mdev, so this reduces to:
5468 * tcp_rtt_sd = 3 * mdev + abs(Error)
5469 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 4) + abs(Error)
5470 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 2^2) + abs(Error)
5471 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd >> 2) + abs(Error)
5472 */
5473 if (m < 0)
5474 m = -m;
5475 m -= sv >> 2;
5476 sv += m;
5477 } else {
5478 /*
5479 * This follows BSD's implementation. So the reinitialized
5480 * RTO is 3 * m. We cannot go less than 2 because if the
5481 * link is bandwidth dominated, doubling the window size
5482 * during slow start means doubling the RTT. We want to be
5483 * more conservative when we reinitialize our estimates. 3
5484 * is just a convenient number.
5485 */
5486 sa = m << 3;
5487 sv = m << 1;
5488 }
5489 if (sv < TCP_SD_MIN) {
5490 /*
5491 * Since a receiver doesn't delay its ACKs during a long run of
5492 * segments, sa may not have captured the effect of delayed ACK
5493 * timeouts on the RTT. To make sure we always account for the
5494 * possible delay (and avoid the unnecessary retransmission),
5495 * TCP_SD_MIN is set to 400ms, twice the delayed ACK timeout of
5496 * 200ms on older SunOS/BSD systems and modern Windows systems
5497 * (as of 2019). This means that the minimum possible mean
5498 * deviation is 100 ms.
5499 */
5500 sv = TCP_SD_MIN;
5501 }
5502 tcp->tcp_rtt_sa = sa;
5503 tcp->tcp_rtt_sd = sv;
5504
5505 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0);
5506
5507 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5508 tcp->tcp_timer_backoff = 0;
5509 }
5510
5511 /*
5512 * On a labeled system we have some protocols above TCP, such as RPC, which
5513 * appear to assume that every mblk in a chain has a db_credp.
5514 */
5515 static void
tcp_setcred_data(mblk_t * mp,ip_recv_attr_t * ira)5516 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5517 {
5518 ASSERT(is_system_labeled());
5519 ASSERT(ira->ira_cred != NULL);
5520
5521 while (mp != NULL) {
5522 mblk_setcred(mp, ira->ira_cred, NOPID);
5523 mp = mp->b_cont;
5524 }
5525 }
5526
5527 uint_t
tcp_rwnd_reopen(tcp_t * tcp)5528 tcp_rwnd_reopen(tcp_t *tcp)
5529 {
5530 uint_t ret = 0;
5531 uint_t thwin;
5532 conn_t *connp = tcp->tcp_connp;
5533
5534 /* Learn the latest rwnd information that we sent to the other side. */
5535 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5536 << tcp->tcp_rcv_ws;
5537 /* This is peer's calculated send window (our receive window). */
5538 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5539 /*
5540 * Increase the receive window to max. But we need to do receiver
5541 * SWS avoidance. This means that we need to check the increase of
5542 * of receive window is at least 1 MSS.
5543 */
5544 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5545 /*
5546 * If the window that the other side knows is less than max
5547 * deferred acks segments, send an update immediately.
5548 */
5549 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5550 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5551 ret = TH_ACK_NEEDED;
5552 }
5553 tcp->tcp_rwnd = connp->conn_rcvbuf;
5554 }
5555 return (ret);
5556 }
5557
5558 /*
5559 * Handle a packet that has been reclassified by TCP.
5560 * This function drops the ref on connp that the caller had.
5561 */
5562 void
tcp_reinput(conn_t * connp,mblk_t * mp,ip_recv_attr_t * ira,ip_stack_t * ipst)5563 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5564 {
5565 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5566
5567 if (connp->conn_incoming_ifindex != 0 &&
5568 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5569 freemsg(mp);
5570 CONN_DEC_REF(connp);
5571 return;
5572 }
5573 if (connp->conn_min_ttl != 0 && connp->conn_min_ttl > ira->ira_ttl) {
5574 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5575 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5576 freemsg(mp);
5577 CONN_DEC_REF(connp);
5578 return;
5579 }
5580 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5581 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5582 ip6_t *ip6h;
5583 ipha_t *ipha;
5584
5585 if (ira->ira_flags & IRAF_IS_IPV4) {
5586 ipha = (ipha_t *)mp->b_rptr;
5587 ip6h = NULL;
5588 } else {
5589 ipha = NULL;
5590 ip6h = (ip6_t *)mp->b_rptr;
5591 }
5592 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5593 if (mp == NULL) {
5594 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5595 /* Note that mp is NULL */
5596 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5597 CONN_DEC_REF(connp);
5598 return;
5599 }
5600 }
5601
5602 if (IPCL_IS_TCP(connp)) {
5603 /*
5604 * do not drain, certain use cases can blow
5605 * the stack
5606 */
5607 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5608 connp->conn_recv, connp, ira,
5609 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5610 } else {
5611 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5612 (connp->conn_recv)(connp, mp, NULL,
5613 ira);
5614 CONN_DEC_REF(connp);
5615 }
5616
5617 }
5618
5619 /* ARGSUSED */
5620 static void
tcp_rsrv_input(void * arg,mblk_t * mp,void * arg2,ip_recv_attr_t * dummy)5621 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5622 {
5623 conn_t *connp = (conn_t *)arg;
5624 tcp_t *tcp = connp->conn_tcp;
5625 queue_t *q = connp->conn_rq;
5626
5627 ASSERT(!IPCL_IS_NONSTR(connp));
5628 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5629 tcp->tcp_rsrv_mp = mp;
5630 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5631
5632 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5633 return;
5634 }
5635
5636 if (tcp->tcp_fused) {
5637 tcp_fuse_backenable(tcp);
5638 return;
5639 }
5640
5641 if (canputnext(q)) {
5642 /* Not flow-controlled, open rwnd */
5643 tcp->tcp_rwnd = connp->conn_rcvbuf;
5644
5645 /*
5646 * Send back a window update immediately if TCP is above
5647 * ESTABLISHED state and the increase of the rcv window
5648 * that the other side knows is at least 1 MSS after flow
5649 * control is lifted.
5650 */
5651 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5652 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5653 tcp_xmit_ctl(NULL, tcp,
5654 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5655 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5656 }
5657 }
5658 }
5659
5660 /*
5661 * The read side service routine is called mostly when we get back-enabled as a
5662 * result of flow control relief. Since we don't actually queue anything in
5663 * TCP, we have no data to send out of here. What we do is clear the receive
5664 * window, and send out a window update.
5665 */
5666 int
tcp_rsrv(queue_t * q)5667 tcp_rsrv(queue_t *q)
5668 {
5669 conn_t *connp = Q_TO_CONN(q);
5670 tcp_t *tcp = connp->conn_tcp;
5671 mblk_t *mp;
5672
5673 /* No code does a putq on the read side */
5674 ASSERT(q->q_first == NULL);
5675
5676 /*
5677 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5678 * been run. So just return.
5679 */
5680 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5681 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5682 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5683 return (0);
5684 }
5685 tcp->tcp_rsrv_mp = NULL;
5686 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5687
5688 CONN_INC_REF(connp);
5689 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5690 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5691 return (0);
5692 }
5693
5694 /* At minimum we need 8 bytes in the TCP header for the lookup */
5695 #define ICMP_MIN_TCP_HDR 8
5696
5697 /*
5698 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5699 * passed up by IP. The message is always received on the correct tcp_t.
5700 * Assumes that IP has pulled up everything up to and including the ICMP header.
5701 */
5702 /* ARGSUSED2 */
5703 void
tcp_icmp_input(void * arg1,mblk_t * mp,void * arg2,ip_recv_attr_t * ira)5704 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5705 {
5706 conn_t *connp = (conn_t *)arg1;
5707 icmph_t *icmph;
5708 ipha_t *ipha;
5709 int iph_hdr_length;
5710 tcpha_t *tcpha;
5711 uint32_t seg_seq;
5712 tcp_t *tcp = connp->conn_tcp;
5713
5714 /* Assume IP provides aligned packets */
5715 ASSERT(OK_32PTR(mp->b_rptr));
5716 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5717
5718 /*
5719 * It's possible we have a closed, but not yet destroyed, TCP
5720 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5721 * in the closed state, so don't take any chances and drop the packet.
5722 */
5723 if (tcp->tcp_state == TCPS_CLOSED) {
5724 freemsg(mp);
5725 return;
5726 }
5727
5728 /*
5729 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5730 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5731 */
5732 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5733 tcp_icmp_error_ipv6(tcp, mp, ira);
5734 return;
5735 }
5736
5737 /* Skip past the outer IP and ICMP headers */
5738 iph_hdr_length = ira->ira_ip_hdr_length;
5739 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5740 /*
5741 * If we don't have the correct outer IP header length
5742 * or if we don't have a complete inner IP header
5743 * drop it.
5744 */
5745 if (iph_hdr_length < sizeof (ipha_t) ||
5746 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5747 noticmpv4:
5748 freemsg(mp);
5749 return;
5750 }
5751 ipha = (ipha_t *)&icmph[1];
5752
5753 /* Skip past the inner IP and find the ULP header */
5754 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5755 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5756 /*
5757 * If we don't have the correct inner IP header length or if the ULP
5758 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5759 * bytes of TCP header, drop it.
5760 */
5761 if (iph_hdr_length < sizeof (ipha_t) ||
5762 ipha->ipha_protocol != IPPROTO_TCP ||
5763 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5764 goto noticmpv4;
5765 }
5766
5767 seg_seq = ntohl(tcpha->tha_seq);
5768 switch (icmph->icmph_type) {
5769 case ICMP_DEST_UNREACHABLE:
5770 switch (icmph->icmph_code) {
5771 case ICMP_FRAGMENTATION_NEEDED:
5772 /*
5773 * Update Path MTU, then try to send something out.
5774 */
5775 tcp_update_pmtu(tcp, B_TRUE);
5776 tcp_rexmit_after_error(tcp);
5777 break;
5778 case ICMP_PORT_UNREACHABLE:
5779 case ICMP_PROTOCOL_UNREACHABLE:
5780 switch (tcp->tcp_state) {
5781 case TCPS_SYN_SENT:
5782 case TCPS_SYN_RCVD:
5783 /*
5784 * ICMP can snipe away incipient
5785 * TCP connections as long as
5786 * seq number is same as initial
5787 * send seq number.
5788 */
5789 if (seg_seq == tcp->tcp_iss) {
5790 (void) tcp_clean_death(tcp,
5791 ECONNREFUSED);
5792 }
5793 break;
5794 }
5795 break;
5796 case ICMP_HOST_UNREACHABLE:
5797 case ICMP_NET_UNREACHABLE:
5798 /* Record the error in case we finally time out. */
5799 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5800 tcp->tcp_client_errno = EHOSTUNREACH;
5801 else
5802 tcp->tcp_client_errno = ENETUNREACH;
5803 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5804 if (tcp->tcp_listener != NULL &&
5805 tcp->tcp_listener->tcp_syn_defense) {
5806 /*
5807 * Ditch the half-open connection if we
5808 * suspect a SYN attack is under way.
5809 */
5810 (void) tcp_clean_death(tcp,
5811 tcp->tcp_client_errno);
5812 }
5813 }
5814 break;
5815 default:
5816 break;
5817 }
5818 break;
5819 case ICMP_SOURCE_QUENCH: {
5820 /*
5821 * use a global boolean to control
5822 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5823 * The default is false.
5824 */
5825 if (tcp_icmp_source_quench) {
5826 /*
5827 * Reduce the sending rate as if we got a
5828 * retransmit timeout
5829 */
5830 uint32_t npkt;
5831
5832 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5833 tcp->tcp_mss;
5834 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5835
5836 DTRACE_PROBE3(cwnd__source__quench, tcp_t *, tcp,
5837 uint32_t, tcp->tcp_cwnd,
5838 uint32_t, tcp->tcp_mss);
5839 tcp->tcp_cwnd = tcp->tcp_mss;
5840 tcp->tcp_cwnd_cnt = 0;
5841 }
5842 break;
5843 }
5844 }
5845 freemsg(mp);
5846 }
5847
5848 /*
5849 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5850 * error messages passed up by IP.
5851 * Assumes that IP has pulled up all the extension headers as well
5852 * as the ICMPv6 header.
5853 */
5854 static void
tcp_icmp_error_ipv6(tcp_t * tcp,mblk_t * mp,ip_recv_attr_t * ira)5855 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5856 {
5857 icmp6_t *icmp6;
5858 ip6_t *ip6h;
5859 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5860 tcpha_t *tcpha;
5861 uint8_t *nexthdrp;
5862 uint32_t seg_seq;
5863
5864 /*
5865 * Verify that we have a complete IP header.
5866 */
5867 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5868
5869 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5870 ip6h = (ip6_t *)&icmp6[1];
5871 /*
5872 * Verify if we have a complete ICMP and inner IP header.
5873 */
5874 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5875 noticmpv6:
5876 freemsg(mp);
5877 return;
5878 }
5879
5880 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5881 goto noticmpv6;
5882 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5883 /*
5884 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5885 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5886 * packet.
5887 */
5888 if ((*nexthdrp != IPPROTO_TCP) ||
5889 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5890 goto noticmpv6;
5891 }
5892
5893 seg_seq = ntohl(tcpha->tha_seq);
5894 switch (icmp6->icmp6_type) {
5895 case ICMP6_PACKET_TOO_BIG:
5896 /*
5897 * Update Path MTU, then try to send something out.
5898 */
5899 tcp_update_pmtu(tcp, B_TRUE);
5900 tcp_rexmit_after_error(tcp);
5901 break;
5902 case ICMP6_DST_UNREACH:
5903 switch (icmp6->icmp6_code) {
5904 case ICMP6_DST_UNREACH_NOPORT:
5905 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5906 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5907 (seg_seq == tcp->tcp_iss)) {
5908 (void) tcp_clean_death(tcp, ECONNREFUSED);
5909 }
5910 break;
5911 case ICMP6_DST_UNREACH_ADMIN:
5912 case ICMP6_DST_UNREACH_NOROUTE:
5913 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5914 case ICMP6_DST_UNREACH_ADDR:
5915 /* Record the error in case we finally time out. */
5916 tcp->tcp_client_errno = EHOSTUNREACH;
5917 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5918 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5919 (seg_seq == tcp->tcp_iss)) {
5920 if (tcp->tcp_listener != NULL &&
5921 tcp->tcp_listener->tcp_syn_defense) {
5922 /*
5923 * Ditch the half-open connection if we
5924 * suspect a SYN attack is under way.
5925 */
5926 (void) tcp_clean_death(tcp,
5927 tcp->tcp_client_errno);
5928 }
5929 }
5930
5931
5932 break;
5933 default:
5934 break;
5935 }
5936 break;
5937 case ICMP6_PARAM_PROB:
5938 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5939 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5940 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5941 (uchar_t *)nexthdrp) {
5942 if (tcp->tcp_state == TCPS_SYN_SENT ||
5943 tcp->tcp_state == TCPS_SYN_RCVD) {
5944 (void) tcp_clean_death(tcp, ECONNREFUSED);
5945 }
5946 break;
5947 }
5948 break;
5949
5950 case ICMP6_TIME_EXCEEDED:
5951 default:
5952 break;
5953 }
5954 freemsg(mp);
5955 }
5956
5957 /*
5958 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5959 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5960 *
5961 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5962 * error messages received by IP. The message is always received on the correct
5963 * tcp_t.
5964 */
5965 /* ARGSUSED */
5966 boolean_t
tcp_verifyicmp(conn_t * connp,void * arg2,icmph_t * icmph,icmp6_t * icmp6,ip_recv_attr_t * ira)5967 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5968 ip_recv_attr_t *ira)
5969 {
5970 tcpha_t *tcpha = (tcpha_t *)arg2;
5971 uint32_t seq = ntohl(tcpha->tha_seq);
5972 tcp_t *tcp = connp->conn_tcp;
5973
5974 /*
5975 * TCP sequence number contained in payload of the ICMP error message
5976 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5977 * the message is either a stale ICMP error, or an attack from the
5978 * network. Fail the verification.
5979 */
5980 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5981 return (B_FALSE);
5982
5983 /* For "too big" we also check the ignore flag */
5984 if (ira->ira_flags & IRAF_IS_IPV4) {
5985 ASSERT(icmph != NULL);
5986 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5987 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5988 tcp->tcp_tcps->tcps_ignore_path_mtu)
5989 return (B_FALSE);
5990 } else {
5991 ASSERT(icmp6 != NULL);
5992 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5993 tcp->tcp_tcps->tcps_ignore_path_mtu)
5994 return (B_FALSE);
5995 }
5996 return (B_TRUE);
5997 }
5998