1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2017 Joyent, Inc.
25 * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved.
26 * Copyright (c) 2013,2014 by Delphix. All rights reserved.
27 * Copyright 2014, OmniTI Computer Consulting, Inc. All rights reserved.
28 */
29 /* Copyright (c) 1990 Mentat Inc. */
30
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/strsun.h>
34 #include <sys/strsubr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #define _SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/timod.h>
40 #include <sys/ddi.h>
41 #include <sys/sunddi.h>
42 #include <sys/suntpi.h>
43 #include <sys/xti_inet.h>
44 #include <sys/cmn_err.h>
45 #include <sys/debug.h>
46 #include <sys/sdt.h>
47 #include <sys/vtrace.h>
48 #include <sys/kmem.h>
49 #include <sys/ethernet.h>
50 #include <sys/cpuvar.h>
51 #include <sys/dlpi.h>
52 #include <sys/pattr.h>
53 #include <sys/policy.h>
54 #include <sys/priv.h>
55 #include <sys/zone.h>
56 #include <sys/sunldi.h>
57
58 #include <sys/errno.h>
59 #include <sys/signal.h>
60 #include <sys/socket.h>
61 #include <sys/socketvar.h>
62 #include <sys/sockio.h>
63 #include <sys/isa_defs.h>
64 #include <sys/md5.h>
65 #include <sys/random.h>
66 #include <sys/uio.h>
67 #include <sys/systm.h>
68 #include <netinet/in.h>
69 #include <netinet/tcp.h>
70 #include <netinet/ip6.h>
71 #include <netinet/icmp6.h>
72 #include <net/if.h>
73 #include <net/route.h>
74 #include <inet/ipsec_impl.h>
75
76 #include <inet/common.h>
77 #include <inet/ip.h>
78 #include <inet/ip_impl.h>
79 #include <inet/ip6.h>
80 #include <inet/ip_ndp.h>
81 #include <inet/proto_set.h>
82 #include <inet/mib2.h>
83 #include <inet/optcom.h>
84 #include <inet/snmpcom.h>
85 #include <inet/kstatcom.h>
86 #include <inet/tcp.h>
87 #include <inet/tcp_impl.h>
88 #include <inet/tcp_cluster.h>
89 #include <inet/udp_impl.h>
90 #include <net/pfkeyv2.h>
91 #include <inet/ipdrop.h>
92
93 #include <inet/ipclassifier.h>
94 #include <inet/ip_ire.h>
95 #include <inet/ip_ftable.h>
96 #include <inet/ip_if.h>
97 #include <inet/ipp_common.h>
98 #include <inet/ip_rts.h>
99 #include <inet/ip_netinfo.h>
100 #include <sys/squeue_impl.h>
101 #include <sys/squeue.h>
102 #include <sys/tsol/label.h>
103 #include <sys/tsol/tnet.h>
104 #include <rpc/pmap_prot.h>
105 #include <sys/callo.h>
106
107 /*
108 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433)
109 *
110 * (Read the detailed design doc in PSARC case directory)
111 *
112 * The entire tcp state is contained in tcp_t and conn_t structure
113 * which are allocated in tandem using ipcl_conn_create() and passing
114 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect
115 * the references on the tcp_t. The tcp_t structure is never compressed
116 * and packets always land on the correct TCP perimeter from the time
117 * eager is created till the time tcp_t dies (as such the old mentat
118 * TCP global queue is not used for detached state and no IPSEC checking
119 * is required). The global queue is still allocated to send out resets
120 * for connection which have no listeners and IP directly calls
121 * tcp_xmit_listeners_reset() which does any policy check.
122 *
123 * Protection and Synchronisation mechanism:
124 *
125 * The tcp data structure does not use any kind of lock for protecting
126 * its state but instead uses 'squeues' for mutual exclusion from various
127 * read and write side threads. To access a tcp member, the thread should
128 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS,
129 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller
130 * can pass any tcp function having prototype of edesc_t as argument
131 * (different from traditional STREAMs model where packets come in only
132 * designated entry points). The list of functions that can be directly
133 * called via squeue are listed before the usual function prototype.
134 *
135 * Referencing:
136 *
137 * TCP is MT-Hot and we use a reference based scheme to make sure that the
138 * tcp structure doesn't disappear when its needed. When the application
139 * creates an outgoing connection or accepts an incoming connection, we
140 * start out with 2 references on 'conn_ref'. One for TCP and one for IP.
141 * The IP reference is just a symbolic reference since ip_tcpclose()
142 * looks at tcp structure after tcp_close_output() returns which could
143 * have dropped the last TCP reference. So as long as the connection is
144 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the
145 * conn_t. The classifier puts its own reference when the connection is
146 * inserted in listen or connected hash. Anytime a thread needs to enter
147 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr
148 * on write side or by doing a classify on read side and then puts a
149 * reference on the conn before doing squeue_enter/tryenter/fill. For
150 * read side, the classifier itself puts the reference under fanout lock
151 * to make sure that tcp can't disappear before it gets processed. The
152 * squeue will drop this reference automatically so the called function
153 * doesn't have to do a DEC_REF.
154 *
155 * Opening a new connection:
156 *
157 * The outgoing connection open is pretty simple. tcp_open() does the
158 * work in creating the conn/tcp structure and initializing it. The
159 * squeue assignment is done based on the CPU the application
160 * is running on. So for outbound connections, processing is always done
161 * on application CPU which might be different from the incoming CPU
162 * being interrupted by the NIC. An optimal way would be to figure out
163 * the NIC <-> CPU binding at listen time, and assign the outgoing
164 * connection to the squeue attached to the CPU that will be interrupted
165 * for incoming packets (we know the NIC based on the bind IP address).
166 * This might seem like a problem if more data is going out but the
167 * fact is that in most cases the transmit is ACK driven transmit where
168 * the outgoing data normally sits on TCP's xmit queue waiting to be
169 * transmitted.
170 *
171 * Accepting a connection:
172 *
173 * This is a more interesting case because of various races involved in
174 * establishing a eager in its own perimeter. Read the meta comment on
175 * top of tcp_input_listener(). But briefly, the squeue is picked by
176 * ip_fanout based on the ring or the sender (if loopback).
177 *
178 * Closing a connection:
179 *
180 * The close is fairly straight forward. tcp_close() calls tcp_close_output()
181 * via squeue to do the close and mark the tcp as detached if the connection
182 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its
183 * reference but tcp_close() drop IP's reference always. So if tcp was
184 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP
185 * and 1 because it is in classifier's connected hash. This is the condition
186 * we use to determine that its OK to clean up the tcp outside of squeue
187 * when time wait expires (check the ref under fanout and conn_lock and
188 * if it is 2, remove it from fanout hash and kill it).
189 *
190 * Although close just drops the necessary references and marks the
191 * tcp_detached state, tcp_close needs to know the tcp_detached has been
192 * set (under squeue) before letting the STREAM go away (because a
193 * inbound packet might attempt to go up the STREAM while the close
194 * has happened and tcp_detached is not set). So a special lock and
195 * flag is used along with a condition variable (tcp_closelock, tcp_closed,
196 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked
197 * tcp_detached.
198 *
199 * Special provisions and fast paths:
200 *
201 * We make special provisions for sockfs by marking tcp_issocket
202 * whenever we have only sockfs on top of TCP. This allows us to skip
203 * putting the tcp in acceptor hash since a sockfs listener can never
204 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM
205 * since eager has already been allocated and the accept now happens
206 * on acceptor STREAM. There is a big blob of comment on top of
207 * tcp_input_listener explaining the new accept. When socket is POP'd,
208 * sockfs sends us an ioctl to mark the fact and we go back to old
209 * behaviour. Once tcp_issocket is unset, its never set for the
210 * life of that connection.
211 *
212 * IPsec notes :
213 *
214 * Since a packet is always executed on the correct TCP perimeter
215 * all IPsec processing is defered to IP including checking new
216 * connections and setting IPSEC policies for new connection. The
217 * only exception is tcp_xmit_listeners_reset() which is called
218 * directly from IP and needs to policy check to see if TH_RST
219 * can be sent out.
220 */
221
222 /*
223 * Values for squeue switch:
224 * 1: SQ_NODRAIN
225 * 2: SQ_PROCESS
226 * 3: SQ_FILL
227 */
228 int tcp_squeue_wput = 2; /* /etc/systems */
229 int tcp_squeue_flag;
230
231 /*
232 * To prevent memory hog, limit the number of entries in tcp_free_list
233 * to 1% of available memory / number of cpus
234 */
235 uint_t tcp_free_list_max_cnt = 0;
236
237 #define TIDUSZ 4096 /* transport interface data unit size */
238
239 /*
240 * Size of acceptor hash list. It has to be a power of 2 for hashing.
241 */
242 #define TCP_ACCEPTOR_FANOUT_SIZE 512
243
244 #ifdef _ILP32
245 #define TCP_ACCEPTOR_HASH(accid) \
246 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
247 #else
248 #define TCP_ACCEPTOR_HASH(accid) \
249 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1))
250 #endif /* _ILP32 */
251
252 /*
253 * Minimum number of connections which can be created per listener. Used
254 * when the listener connection count is in effect.
255 */
256 static uint32_t tcp_min_conn_listener = 2;
257
258 uint32_t tcp_early_abort = 30;
259
260 /* TCP Timer control structure */
261 typedef struct tcpt_s {
262 pfv_t tcpt_pfv; /* The routine we are to call */
263 tcp_t *tcpt_tcp; /* The parameter we are to pass in */
264 } tcpt_t;
265
266 /*
267 * Functions called directly via squeue having a prototype of edesc_t.
268 */
269 void tcp_input_listener(void *arg, mblk_t *mp, void *arg2,
270 ip_recv_attr_t *ira);
271 void tcp_input_data(void *arg, mblk_t *mp, void *arg2,
272 ip_recv_attr_t *ira);
273 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2,
274 ip_recv_attr_t *dummy);
275
276
277 /* Prototype for TCP functions */
278 static void tcp_random_init(void);
279 int tcp_random(void);
280 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp,
281 in_port_t dstport, uint_t srcid);
282 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp,
283 in_port_t dstport, uint32_t flowinfo,
284 uint_t srcid, uint32_t scope_id);
285 static void tcp_iss_init(tcp_t *tcp);
286 static void tcp_reinit(tcp_t *tcp);
287 static void tcp_reinit_values(tcp_t *tcp);
288
289 static void tcp_wsrv(queue_t *q);
290 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa);
291 static void tcp_update_zcopy(tcp_t *tcp);
292 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t,
293 ixa_notify_arg_t);
294 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns);
295 static void tcp_stack_fini(netstackid_t stackid, void *arg);
296
297 static int tcp_squeue_switch(int);
298
299 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t);
300 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *);
301 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *);
302
303 static void tcp_squeue_add(squeue_t *);
304
305 struct module_info tcp_rinfo = {
306 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER
307 };
308
309 static struct module_info tcp_winfo = {
310 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16
311 };
312
313 /*
314 * Entry points for TCP as a device. The normal case which supports
315 * the TCP functionality.
316 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices.
317 */
318 struct qinit tcp_rinitv4 = {
319 NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo
320 };
321
322 struct qinit tcp_rinitv6 = {
323 NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo
324 };
325
326 struct qinit tcp_winit = {
327 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
328 };
329
330 /* Initial entry point for TCP in socket mode. */
331 struct qinit tcp_sock_winit = {
332 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo
333 };
334
335 /* TCP entry point during fallback */
336 struct qinit tcp_fallback_sock_winit = {
337 (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo
338 };
339
340 /*
341 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing
342 * an accept. Avoid allocating data structures since eager has already
343 * been created.
344 */
345 struct qinit tcp_acceptor_rinit = {
346 NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo
347 };
348
349 struct qinit tcp_acceptor_winit = {
350 (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo
351 };
352
353 /* For AF_INET aka /dev/tcp */
354 struct streamtab tcpinfov4 = {
355 &tcp_rinitv4, &tcp_winit
356 };
357
358 /* For AF_INET6 aka /dev/tcp6 */
359 struct streamtab tcpinfov6 = {
360 &tcp_rinitv6, &tcp_winit
361 };
362
363 /*
364 * Following assumes TPI alignment requirements stay along 32 bit
365 * boundaries
366 */
367 #define ROUNDUP32(x) \
368 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1))
369
370 /* Template for response to info request. */
371 struct T_info_ack tcp_g_t_info_ack = {
372 T_INFO_ACK, /* PRIM_type */
373 0, /* TSDU_size */
374 T_INFINITE, /* ETSDU_size */
375 T_INVALID, /* CDATA_size */
376 T_INVALID, /* DDATA_size */
377 sizeof (sin_t), /* ADDR_size */
378 0, /* OPT_size - not initialized here */
379 TIDUSZ, /* TIDU_size */
380 T_COTS_ORD, /* SERV_type */
381 TCPS_IDLE, /* CURRENT_state */
382 (XPG4_1|EXPINLINE) /* PROVIDER_flag */
383 };
384
385 struct T_info_ack tcp_g_t_info_ack_v6 = {
386 T_INFO_ACK, /* PRIM_type */
387 0, /* TSDU_size */
388 T_INFINITE, /* ETSDU_size */
389 T_INVALID, /* CDATA_size */
390 T_INVALID, /* DDATA_size */
391 sizeof (sin6_t), /* ADDR_size */
392 0, /* OPT_size - not initialized here */
393 TIDUSZ, /* TIDU_size */
394 T_COTS_ORD, /* SERV_type */
395 TCPS_IDLE, /* CURRENT_state */
396 (XPG4_1|EXPINLINE) /* PROVIDER_flag */
397 };
398
399 /*
400 * TCP tunables related declarations. Definitions are in tcp_tunables.c
401 */
402 extern mod_prop_info_t tcp_propinfo_tbl[];
403 extern int tcp_propinfo_count;
404
405 #define IS_VMLOANED_MBLK(mp) \
406 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0)
407
408 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */
409
410 /*
411 * Forces all connections to obey the value of the tcps_maxpsz_multiplier
412 * tunable settable via NDD. Otherwise, the per-connection behavior is
413 * determined dynamically during tcp_set_destination(), which is the default.
414 */
415 boolean_t tcp_static_maxpsz = B_FALSE;
416
417 /*
418 * If the receive buffer size is changed, this function is called to update
419 * the upper socket layer on the new delayed receive wake up threshold.
420 */
421 static void
422 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh)
423 {
424 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3;
425
426 if (IPCL_IS_NONSTR(tcp->tcp_connp)) {
427 conn_t *connp = tcp->tcp_connp;
428 struct sock_proto_props sopp;
429
430 /*
431 * only increase rcvthresh upto default_threshold
432 */
433 if (new_rcvthresh > default_threshold)
434 new_rcvthresh = default_threshold;
435
436 sopp.sopp_flags = SOCKOPT_RCVTHRESH;
437 sopp.sopp_rcvthresh = new_rcvthresh;
438
439 (*connp->conn_upcalls->su_set_proto_props)
440 (connp->conn_upper_handle, &sopp);
441 }
442 }
443
444 /*
445 * Figure out the value of window scale opton. Note that the rwnd is
446 * ASSUMED to be rounded up to the nearest MSS before the calculation.
447 * We cannot find the scale value and then do a round up of tcp_rwnd
448 * because the scale value may not be correct after that.
449 *
450 * Set the compiler flag to make this function inline.
451 */
452 void
453 tcp_set_ws_value(tcp_t *tcp)
454 {
455 int i;
456 uint32_t rwnd = tcp->tcp_rwnd;
457
458 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT;
459 i++, rwnd >>= 1)
460 ;
461 tcp->tcp_rcv_ws = i;
462 }
463
464 /*
465 * Remove cached/latched IPsec references.
466 */
467 void
468 tcp_ipsec_cleanup(tcp_t *tcp)
469 {
470 conn_t *connp = tcp->tcp_connp;
471
472 ASSERT(connp->conn_flags & IPCL_TCPCONN);
473
474 if (connp->conn_latch != NULL) {
475 IPLATCH_REFRELE(connp->conn_latch);
476 connp->conn_latch = NULL;
477 }
478 if (connp->conn_latch_in_policy != NULL) {
479 IPPOL_REFRELE(connp->conn_latch_in_policy);
480 connp->conn_latch_in_policy = NULL;
481 }
482 if (connp->conn_latch_in_action != NULL) {
483 IPACT_REFRELE(connp->conn_latch_in_action);
484 connp->conn_latch_in_action = NULL;
485 }
486 if (connp->conn_policy != NULL) {
487 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack);
488 connp->conn_policy = NULL;
489 }
490 }
491
492 /*
493 * Cleaup before placing on free list.
494 * Disassociate from the netstack/tcp_stack_t since the freelist
495 * is per squeue and not per netstack.
496 */
497 void
498 tcp_cleanup(tcp_t *tcp)
499 {
500 mblk_t *mp;
501 conn_t *connp = tcp->tcp_connp;
502 tcp_stack_t *tcps = tcp->tcp_tcps;
503 netstack_t *ns = tcps->tcps_netstack;
504 mblk_t *tcp_rsrv_mp;
505
506 tcp_bind_hash_remove(tcp);
507
508 /* Cleanup that which needs the netstack first */
509 tcp_ipsec_cleanup(tcp);
510 ixa_cleanup(connp->conn_ixa);
511
512 if (connp->conn_ht_iphc != NULL) {
513 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
514 connp->conn_ht_iphc = NULL;
515 connp->conn_ht_iphc_allocated = 0;
516 connp->conn_ht_iphc_len = 0;
517 connp->conn_ht_ulp = NULL;
518 connp->conn_ht_ulp_len = 0;
519 tcp->tcp_ipha = NULL;
520 tcp->tcp_ip6h = NULL;
521 tcp->tcp_tcpha = NULL;
522 }
523
524 /* We clear any IP_OPTIONS and extension headers */
525 ip_pkt_free(&connp->conn_xmit_ipp);
526
527 tcp_free(tcp);
528
529 /*
530 * Since we will bzero the entire structure, we need to
531 * remove it and reinsert it in global hash list. We
532 * know the walkers can't get to this conn because we
533 * had set CONDEMNED flag earlier and checked reference
534 * under conn_lock so walker won't pick it and when we
535 * go the ipcl_globalhash_remove() below, no walker
536 * can get to it.
537 */
538 ipcl_globalhash_remove(connp);
539
540 /* Save some state */
541 mp = tcp->tcp_timercache;
542
543 tcp_rsrv_mp = tcp->tcp_rsrv_mp;
544
545 if (connp->conn_cred != NULL) {
546 crfree(connp->conn_cred);
547 connp->conn_cred = NULL;
548 }
549 ipcl_conn_cleanup(connp);
550 connp->conn_flags = IPCL_TCPCONN;
551
552 /*
553 * Now it is safe to decrement the reference counts.
554 * This might be the last reference on the netstack
555 * in which case it will cause the freeing of the IP Instance.
556 */
557 connp->conn_netstack = NULL;
558 connp->conn_ixa->ixa_ipst = NULL;
559 netstack_rele(ns);
560 ASSERT(tcps != NULL);
561 tcp->tcp_tcps = NULL;
562
563 bzero(tcp, sizeof (tcp_t));
564
565 /* restore the state */
566 tcp->tcp_timercache = mp;
567
568 tcp->tcp_rsrv_mp = tcp_rsrv_mp;
569
570 tcp->tcp_connp = connp;
571
572 ASSERT(connp->conn_tcp == tcp);
573 ASSERT(connp->conn_flags & IPCL_TCPCONN);
574 connp->conn_state_flags = CONN_INCIPIENT;
575 ASSERT(connp->conn_proto == IPPROTO_TCP);
576 ASSERT(connp->conn_ref == 1);
577 }
578
579 /*
580 * Adapt to the information, such as rtt and rtt_sd, provided from the
581 * DCE and IRE maintained by IP.
582 *
583 * Checks for multicast and broadcast destination address.
584 * Returns zero if ok; an errno on failure.
585 *
586 * Note that the MSS calculation here is based on the info given in
587 * the DCE and IRE. We do not do any calculation based on TCP options. They
588 * will be handled in tcp_input_data() when TCP knows which options to use.
589 *
590 * Note on how TCP gets its parameters for a connection.
591 *
592 * When a tcp_t structure is allocated, it gets all the default parameters.
593 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd,
594 * spipe, rpipe, ... from the route metrics. Route metric overrides the
595 * default.
596 *
597 * An incoming SYN with a multicast or broadcast destination address is dropped
598 * in ip_fanout_v4/v6.
599 *
600 * An incoming SYN with a multicast or broadcast source address is always
601 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in
602 * conn_connect.
603 * The same logic in tcp_set_destination also serves to
604 * reject an attempt to connect to a broadcast or multicast (destination)
605 * address.
606 */
607 int
608 tcp_set_destination(tcp_t *tcp)
609 {
610 uint32_t mss_max;
611 uint32_t mss;
612 boolean_t tcp_detached = TCP_IS_DETACHED(tcp);
613 conn_t *connp = tcp->tcp_connp;
614 tcp_stack_t *tcps = tcp->tcp_tcps;
615 iulp_t uinfo;
616 int error;
617 uint32_t flags;
618
619 flags = IPDF_LSO | IPDF_ZCOPY;
620 /*
621 * Make sure we have a dce for the destination to avoid dce_ident
622 * contention for connected sockets.
623 */
624 flags |= IPDF_UNIQUE_DCE;
625
626 if (!tcps->tcps_ignore_path_mtu)
627 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY;
628
629 /* Use conn_lock to satify ASSERT; tcp is already serialized */
630 mutex_enter(&connp->conn_lock);
631 error = conn_connect(connp, &uinfo, flags);
632 mutex_exit(&connp->conn_lock);
633 if (error != 0)
634 return (error);
635
636 error = tcp_build_hdrs(tcp);
637 if (error != 0)
638 return (error);
639
640 tcp->tcp_localnet = uinfo.iulp_localnet;
641
642 if (uinfo.iulp_rtt != 0) {
643 clock_t rto;
644
645 tcp->tcp_rtt_sa = uinfo.iulp_rtt;
646 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd;
647 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
648 tcps->tcps_rexmit_interval_extra +
649 (tcp->tcp_rtt_sa >> 5);
650
651 TCP_SET_RTO(tcp, rto);
652 }
653 if (uinfo.iulp_ssthresh != 0)
654 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh;
655 else
656 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
657 if (uinfo.iulp_spipe > 0) {
658 connp->conn_sndbuf = MIN(uinfo.iulp_spipe,
659 tcps->tcps_max_buf);
660 if (tcps->tcps_snd_lowat_fraction != 0) {
661 connp->conn_sndlowat = connp->conn_sndbuf /
662 tcps->tcps_snd_lowat_fraction;
663 }
664 (void) tcp_maxpsz_set(tcp, B_TRUE);
665 }
666 /*
667 * Note that up till now, acceptor always inherits receive
668 * window from the listener. But if there is a metrics
669 * associated with a host, we should use that instead of
670 * inheriting it from listener. Thus we need to pass this
671 * info back to the caller.
672 */
673 if (uinfo.iulp_rpipe > 0) {
674 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe,
675 tcps->tcps_max_buf);
676 }
677
678 if (uinfo.iulp_rtomax > 0) {
679 tcp->tcp_second_timer_threshold =
680 uinfo.iulp_rtomax;
681 }
682
683 /*
684 * Use the metric option settings, iulp_tstamp_ok and
685 * iulp_wscale_ok, only for active open. What this means
686 * is that if the other side uses timestamp or window
687 * scale option, TCP will also use those options. That
688 * is for passive open. If the application sets a
689 * large window, window scale is enabled regardless of
690 * the value in iulp_wscale_ok. This is the behavior
691 * since 2.6. So we keep it.
692 * The only case left in passive open processing is the
693 * check for SACK.
694 * For ECN, it should probably be like SACK. But the
695 * current value is binary, so we treat it like the other
696 * cases. The metric only controls active open.For passive
697 * open, the ndd param, tcp_ecn_permitted, controls the
698 * behavior.
699 */
700 if (!tcp_detached) {
701 /*
702 * The if check means that the following can only
703 * be turned on by the metrics only IRE, but not off.
704 */
705 if (uinfo.iulp_tstamp_ok)
706 tcp->tcp_snd_ts_ok = B_TRUE;
707 if (uinfo.iulp_wscale_ok)
708 tcp->tcp_snd_ws_ok = B_TRUE;
709 if (uinfo.iulp_sack == 2)
710 tcp->tcp_snd_sack_ok = B_TRUE;
711 if (uinfo.iulp_ecn_ok)
712 tcp->tcp_ecn_ok = B_TRUE;
713 } else {
714 /*
715 * Passive open.
716 *
717 * As above, the if check means that SACK can only be
718 * turned on by the metric only IRE.
719 */
720 if (uinfo.iulp_sack > 0) {
721 tcp->tcp_snd_sack_ok = B_TRUE;
722 }
723 }
724
725 /*
726 * XXX Note that currently, iulp_mtu can be as small as 68
727 * because of PMTUd. So tcp_mss may go to negative if combined
728 * length of all those options exceeds 28 bytes. But because
729 * of the tcp_mss_min check below, we may not have a problem if
730 * tcp_mss_min is of a reasonable value. The default is 1 so
731 * the negative problem still exists. And the check defeats PMTUd.
732 * In fact, if PMTUd finds that the MSS should be smaller than
733 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min
734 * value.
735 *
736 * We do not deal with that now. All those problems related to
737 * PMTUd will be fixed later.
738 */
739 ASSERT(uinfo.iulp_mtu != 0);
740 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu;
741
742 /* Sanity check for MSS value. */
743 if (connp->conn_ipversion == IPV4_VERSION)
744 mss_max = tcps->tcps_mss_max_ipv4;
745 else
746 mss_max = tcps->tcps_mss_max_ipv6;
747
748 if (tcp->tcp_ipsec_overhead == 0)
749 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp);
750
751 mss -= tcp->tcp_ipsec_overhead;
752
753 if (mss < tcps->tcps_mss_min)
754 mss = tcps->tcps_mss_min;
755 if (mss > mss_max)
756 mss = mss_max;
757
758 /* Note that this is the maximum MSS, excluding all options. */
759 tcp->tcp_mss = mss;
760
761 /*
762 * Update the tcp connection with LSO capability.
763 */
764 tcp_update_lso(tcp, connp->conn_ixa);
765
766 /*
767 * Initialize the ISS here now that we have the full connection ID.
768 * The RFC 1948 method of initial sequence number generation requires
769 * knowledge of the full connection ID before setting the ISS.
770 */
771 tcp_iss_init(tcp);
772
773 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local);
774
775 /*
776 * Make sure that conn is not marked incipient
777 * for incoming connections. A blind
778 * removal of incipient flag is cheaper than
779 * check and removal.
780 */
781 mutex_enter(&connp->conn_lock);
782 connp->conn_state_flags &= ~CONN_INCIPIENT;
783 mutex_exit(&connp->conn_lock);
784 return (0);
785 }
786
787 /*
788 * tcp_clean_death / tcp_close_detached must not be called more than once
789 * on a tcp. Thus every function that potentially calls tcp_clean_death
790 * must check for the tcp state before calling tcp_clean_death.
791 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper,
792 * tcp_timer_handler, all check for the tcp state.
793 */
794 /* ARGSUSED */
795 void
796 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2,
797 ip_recv_attr_t *dummy)
798 {
799 tcp_t *tcp = ((conn_t *)arg)->conn_tcp;
800
801 freemsg(mp);
802 if (tcp->tcp_state > TCPS_BOUND)
803 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT);
804 }
805
806 /*
807 * We are dying for some reason. Try to do it gracefully. (May be called
808 * as writer.)
809 *
810 * Return -1 if the structure was not cleaned up (if the cleanup had to be
811 * done by a service procedure).
812 * TBD - Should the return value distinguish between the tcp_t being
813 * freed and it being reinitialized?
814 */
815 int
816 tcp_clean_death(tcp_t *tcp, int err)
817 {
818 mblk_t *mp;
819 queue_t *q;
820 conn_t *connp = tcp->tcp_connp;
821 tcp_stack_t *tcps = tcp->tcp_tcps;
822
823 if (tcp->tcp_fused)
824 tcp_unfuse(tcp);
825
826 if (tcp->tcp_linger_tid != 0 &&
827 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
828 tcp_stop_lingering(tcp);
829 }
830
831 ASSERT(tcp != NULL);
832 ASSERT((connp->conn_family == AF_INET &&
833 connp->conn_ipversion == IPV4_VERSION) ||
834 (connp->conn_family == AF_INET6 &&
835 (connp->conn_ipversion == IPV4_VERSION ||
836 connp->conn_ipversion == IPV6_VERSION)));
837
838 if (TCP_IS_DETACHED(tcp)) {
839 if (tcp->tcp_hard_binding) {
840 /*
841 * Its an eager that we are dealing with. We close the
842 * eager but in case a conn_ind has already gone to the
843 * listener, let tcp_accept_finish() send a discon_ind
844 * to the listener and drop the last reference. If the
845 * listener doesn't even know about the eager i.e. the
846 * conn_ind hasn't gone up, blow away the eager and drop
847 * the last reference as well. If the conn_ind has gone
848 * up, state should be BOUND. tcp_accept_finish
849 * will figure out that the connection has received a
850 * RST and will send a DISCON_IND to the application.
851 */
852 tcp_closei_local(tcp);
853 if (!tcp->tcp_tconnind_started) {
854 CONN_DEC_REF(connp);
855 } else {
856 tcp->tcp_state = TCPS_BOUND;
857 DTRACE_TCP6(state__change, void, NULL,
858 ip_xmit_attr_t *, connp->conn_ixa,
859 void, NULL, tcp_t *, tcp, void, NULL,
860 int32_t, TCPS_CLOSED);
861 }
862 } else {
863 tcp_close_detached(tcp);
864 }
865 return (0);
866 }
867
868 TCP_STAT(tcps, tcp_clean_death_nondetached);
869
870 /*
871 * The connection is dead. Decrement listener connection counter if
872 * necessary.
873 */
874 if (tcp->tcp_listen_cnt != NULL)
875 TCP_DECR_LISTEN_CNT(tcp);
876
877 /*
878 * When a connection is moved to TIME_WAIT state, the connection
879 * counter is already decremented. So no need to decrement here
880 * again. See SET_TIME_WAIT() macro.
881 */
882 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
883 tcp->tcp_state < TCPS_TIME_WAIT) {
884 TCPS_CONN_DEC(tcps);
885 }
886
887 q = connp->conn_rq;
888
889 /* Trash all inbound data */
890 if (!IPCL_IS_NONSTR(connp)) {
891 ASSERT(q != NULL);
892 flushq(q, FLUSHALL);
893 }
894
895 /*
896 * If we are at least part way open and there is error
897 * (err==0 implies no error)
898 * notify our client by a T_DISCON_IND.
899 */
900 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) {
901 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
902 !TCP_IS_SOCKET(tcp)) {
903 /*
904 * Send M_FLUSH according to TPI. Because sockets will
905 * (and must) ignore FLUSHR we do that only for TPI
906 * endpoints and sockets in STREAMS mode.
907 */
908 (void) putnextctl1(q, M_FLUSH, FLUSHR);
909 }
910 if (connp->conn_debug) {
911 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
912 "tcp_clean_death: discon err %d", err);
913 }
914 if (IPCL_IS_NONSTR(connp)) {
915 /* Direct socket, use upcall */
916 (*connp->conn_upcalls->su_disconnected)(
917 connp->conn_upper_handle, tcp->tcp_connid, err);
918 } else {
919 mp = mi_tpi_discon_ind(NULL, err, 0);
920 if (mp != NULL) {
921 putnext(q, mp);
922 } else {
923 if (connp->conn_debug) {
924 (void) strlog(TCP_MOD_ID, 0, 1,
925 SL_ERROR|SL_TRACE,
926 "tcp_clean_death, sending M_ERROR");
927 }
928 (void) putnextctl1(q, M_ERROR, EPROTO);
929 }
930 }
931 if (tcp->tcp_state <= TCPS_SYN_RCVD) {
932 /* SYN_SENT or SYN_RCVD */
933 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
934 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) {
935 /* ESTABLISHED or CLOSE_WAIT */
936 TCPS_BUMP_MIB(tcps, tcpEstabResets);
937 }
938 }
939
940 /*
941 * ESTABLISHED non-STREAMS eagers are not 'detached' because
942 * an upper handle is obtained when the SYN-ACK comes in. So it
943 * should receive the 'disconnected' upcall, but tcp_reinit should
944 * not be called since this is an eager.
945 */
946 if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) {
947 tcp_closei_local(tcp);
948 tcp->tcp_state = TCPS_BOUND;
949 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
950 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
951 int32_t, TCPS_CLOSED);
952 return (0);
953 }
954
955 tcp_reinit(tcp);
956 if (IPCL_IS_NONSTR(connp))
957 (void) tcp_do_unbind(connp);
958
959 return (-1);
960 }
961
962 /*
963 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout
964 * to expire, stop the wait and finish the close.
965 */
966 void
967 tcp_stop_lingering(tcp_t *tcp)
968 {
969 clock_t delta = 0;
970 conn_t *connp = tcp->tcp_connp;
971
972 tcp->tcp_linger_tid = 0;
973 if (tcp->tcp_state > TCPS_LISTEN) {
974 tcp_acceptor_hash_remove(tcp);
975 mutex_enter(&tcp->tcp_non_sq_lock);
976 if (tcp->tcp_flow_stopped) {
977 tcp_clrqfull(tcp);
978 }
979 mutex_exit(&tcp->tcp_non_sq_lock);
980
981 if (tcp->tcp_timer_tid != 0) {
982 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid);
983 tcp->tcp_timer_tid = 0;
984 }
985 /*
986 * Need to cancel those timers which will not be used when
987 * TCP is detached. This has to be done before the conn_wq
988 * is cleared.
989 */
990 tcp_timers_stop(tcp);
991
992 tcp->tcp_detached = B_TRUE;
993 connp->conn_rq = NULL;
994 connp->conn_wq = NULL;
995
996 if (tcp->tcp_state == TCPS_TIME_WAIT) {
997 tcp_time_wait_append(tcp);
998 TCP_DBGSTAT(tcp->tcp_tcps, tcp_detach_time_wait);
999 goto finish;
1000 }
1001
1002 /*
1003 * If delta is zero the timer event wasn't executed and was
1004 * successfully canceled. In this case we need to restart it
1005 * with the minimal delta possible.
1006 */
1007 if (delta >= 0) {
1008 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer,
1009 delta ? delta : 1);
1010 }
1011 } else {
1012 tcp_closei_local(tcp);
1013 CONN_DEC_REF(connp);
1014 }
1015 finish:
1016 tcp->tcp_detached = B_TRUE;
1017 connp->conn_rq = NULL;
1018 connp->conn_wq = NULL;
1019
1020 /* Signal closing thread that it can complete close */
1021 mutex_enter(&tcp->tcp_closelock);
1022 tcp->tcp_closed = 1;
1023 cv_signal(&tcp->tcp_closecv);
1024 mutex_exit(&tcp->tcp_closelock);
1025
1026 /* If we have an upper handle (socket), release it */
1027 if (IPCL_IS_NONSTR(connp)) {
1028 ASSERT(connp->conn_upper_handle != NULL);
1029 (*connp->conn_upcalls->su_closed)(connp->conn_upper_handle);
1030 connp->conn_upper_handle = NULL;
1031 connp->conn_upcalls = NULL;
1032 }
1033 }
1034
1035 void
1036 tcp_close_common(conn_t *connp, int flags)
1037 {
1038 tcp_t *tcp = connp->conn_tcp;
1039 mblk_t *mp = &tcp->tcp_closemp;
1040 boolean_t conn_ioctl_cleanup_reqd = B_FALSE;
1041 mblk_t *bp;
1042
1043 ASSERT(connp->conn_ref >= 2);
1044
1045 /*
1046 * Mark the conn as closing. ipsq_pending_mp_add will not
1047 * add any mp to the pending mp list, after this conn has
1048 * started closing.
1049 */
1050 mutex_enter(&connp->conn_lock);
1051 connp->conn_state_flags |= CONN_CLOSING;
1052 if (connp->conn_oper_pending_ill != NULL)
1053 conn_ioctl_cleanup_reqd = B_TRUE;
1054 CONN_INC_REF_LOCKED(connp);
1055 mutex_exit(&connp->conn_lock);
1056 tcp->tcp_closeflags = (uint8_t)flags;
1057 ASSERT(connp->conn_ref >= 3);
1058
1059 /*
1060 * tcp_closemp_used is used below without any protection of a lock
1061 * as we don't expect any one else to use it concurrently at this
1062 * point otherwise it would be a major defect.
1063 */
1064
1065 if (mp->b_prev == NULL)
1066 tcp->tcp_closemp_used = B_TRUE;
1067 else
1068 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: "
1069 "connp %p tcp %p\n", (void *)connp, (void *)tcp);
1070
1071 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15);
1072
1073 /*
1074 * Cleanup any queued ioctls here. This must be done before the wq/rq
1075 * are re-written by tcp_close_output().
1076 */
1077 if (conn_ioctl_cleanup_reqd)
1078 conn_ioctl_cleanup(connp);
1079
1080 /*
1081 * As CONN_CLOSING is set, no further ioctls should be passed down to
1082 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and
1083 * tcp_wput_iocdata). If the ioctl was queued on an ipsq,
1084 * conn_ioctl_cleanup should have found it and removed it. If the ioctl
1085 * was still in flight at the time, we wait for it here. See comments
1086 * for CONN_INC_IOCTLREF in ip.h for details.
1087 */
1088 mutex_enter(&connp->conn_lock);
1089 while (connp->conn_ioctlref > 0)
1090 cv_wait(&connp->conn_cv, &connp->conn_lock);
1091 ASSERT(connp->conn_ioctlref == 0);
1092 ASSERT(connp->conn_oper_pending_ill == NULL);
1093 mutex_exit(&connp->conn_lock);
1094
1095 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp,
1096 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1097
1098 /*
1099 * For non-STREAMS sockets, the normal case is that the conn makes
1100 * an upcall when it's finally closed, so there is no need to wait
1101 * in the protocol. But in case of SO_LINGER the thread sleeps here
1102 * so it can properly deal with the thread being interrupted.
1103 */
1104 if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0)
1105 goto nowait;
1106
1107 mutex_enter(&tcp->tcp_closelock);
1108 while (!tcp->tcp_closed) {
1109 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) {
1110 /*
1111 * The cv_wait_sig() was interrupted. We now do the
1112 * following:
1113 *
1114 * 1) If the endpoint was lingering, we allow this
1115 * to be interrupted by cancelling the linger timeout
1116 * and closing normally.
1117 *
1118 * 2) Revert to calling cv_wait()
1119 *
1120 * We revert to using cv_wait() to avoid an
1121 * infinite loop which can occur if the calling
1122 * thread is higher priority than the squeue worker
1123 * thread and is bound to the same cpu.
1124 */
1125 if (connp->conn_linger && connp->conn_lingertime > 0) {
1126 mutex_exit(&tcp->tcp_closelock);
1127 /* Entering squeue, bump ref count. */
1128 CONN_INC_REF(connp);
1129 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL);
1130 SQUEUE_ENTER_ONE(connp->conn_sqp, bp,
1131 tcp_linger_interrupted, connp, NULL,
1132 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE);
1133 mutex_enter(&tcp->tcp_closelock);
1134 }
1135 break;
1136 }
1137 }
1138 while (!tcp->tcp_closed)
1139 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock);
1140 mutex_exit(&tcp->tcp_closelock);
1141
1142 /*
1143 * In the case of listener streams that have eagers in the q or q0
1144 * we wait for the eagers to drop their reference to us. conn_rq and
1145 * conn_wq of the eagers point to our queues. By waiting for the
1146 * refcnt to drop to 1, we are sure that the eagers have cleaned
1147 * up their queue pointers and also dropped their references to us.
1148 *
1149 * For non-STREAMS sockets we do not have to wait here; the
1150 * listener will instead make a su_closed upcall when the last
1151 * reference is dropped.
1152 */
1153 if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) {
1154 mutex_enter(&connp->conn_lock);
1155 while (connp->conn_ref != 1) {
1156 cv_wait(&connp->conn_cv, &connp->conn_lock);
1157 }
1158 mutex_exit(&connp->conn_lock);
1159 }
1160
1161 nowait:
1162 connp->conn_cpid = NOPID;
1163 }
1164
1165 /*
1166 * Called by tcp_close() routine via squeue when lingering is
1167 * interrupted by a signal.
1168 */
1169
1170 /* ARGSUSED */
1171 static void
1172 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1173 {
1174 conn_t *connp = (conn_t *)arg;
1175 tcp_t *tcp = connp->conn_tcp;
1176
1177 freeb(mp);
1178 if (tcp->tcp_linger_tid != 0 &&
1179 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) {
1180 tcp_stop_lingering(tcp);
1181 tcp->tcp_client_errno = EINTR;
1182 }
1183 }
1184
1185 /*
1186 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp.
1187 * Some stream heads get upset if they see these later on as anything but NULL.
1188 */
1189 void
1190 tcp_close_mpp(mblk_t **mpp)
1191 {
1192 mblk_t *mp;
1193
1194 if ((mp = *mpp) != NULL) {
1195 do {
1196 mp->b_next = NULL;
1197 mp->b_prev = NULL;
1198 } while ((mp = mp->b_cont) != NULL);
1199
1200 mp = *mpp;
1201 *mpp = NULL;
1202 freemsg(mp);
1203 }
1204 }
1205
1206 /* Do detached close. */
1207 void
1208 tcp_close_detached(tcp_t *tcp)
1209 {
1210 if (tcp->tcp_fused)
1211 tcp_unfuse(tcp);
1212
1213 /*
1214 * Clustering code serializes TCP disconnect callbacks and
1215 * cluster tcp list walks by blocking a TCP disconnect callback
1216 * if a cluster tcp list walk is in progress. This ensures
1217 * accurate accounting of TCPs in the cluster code even though
1218 * the TCP list walk itself is not atomic.
1219 */
1220 tcp_closei_local(tcp);
1221 CONN_DEC_REF(tcp->tcp_connp);
1222 }
1223
1224 /*
1225 * The tcp_t is going away. Remove it from all lists and set it
1226 * to TCPS_CLOSED. The freeing up of memory is deferred until
1227 * tcp_inactive. This is needed since a thread in tcp_rput might have
1228 * done a CONN_INC_REF on this structure before it was removed from the
1229 * hashes.
1230 */
1231 void
1232 tcp_closei_local(tcp_t *tcp)
1233 {
1234 conn_t *connp = tcp->tcp_connp;
1235 tcp_stack_t *tcps = tcp->tcp_tcps;
1236 int32_t oldstate;
1237
1238 if (!TCP_IS_SOCKET(tcp))
1239 tcp_acceptor_hash_remove(tcp);
1240
1241 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs);
1242 tcp->tcp_ibsegs = 0;
1243 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs);
1244 tcp->tcp_obsegs = 0;
1245
1246 /*
1247 * This can be called via tcp_time_wait_processing() if TCP gets a
1248 * SYN with sequence number outside the TIME-WAIT connection's
1249 * window. So we need to check for TIME-WAIT state here as the
1250 * connection counter is already decremented. See SET_TIME_WAIT()
1251 * macro
1252 */
1253 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
1254 tcp->tcp_state < TCPS_TIME_WAIT) {
1255 TCPS_CONN_DEC(tcps);
1256 }
1257
1258 /*
1259 * If we are an eager connection hanging off a listener that
1260 * hasn't formally accepted the connection yet, get off its
1261 * list and blow off any data that we have accumulated.
1262 */
1263 if (tcp->tcp_listener != NULL) {
1264 tcp_t *listener = tcp->tcp_listener;
1265 mutex_enter(&listener->tcp_eager_lock);
1266 /*
1267 * tcp_tconnind_started == B_TRUE means that the
1268 * conn_ind has already gone to listener. At
1269 * this point, eager will be closed but we
1270 * leave it in listeners eager list so that
1271 * if listener decides to close without doing
1272 * accept, we can clean this up. In tcp_tli_accept
1273 * we take care of the case of accept on closed
1274 * eager.
1275 */
1276 if (!tcp->tcp_tconnind_started) {
1277 tcp_eager_unlink(tcp);
1278 mutex_exit(&listener->tcp_eager_lock);
1279 /*
1280 * We don't want to have any pointers to the
1281 * listener queue, after we have released our
1282 * reference on the listener
1283 */
1284 ASSERT(tcp->tcp_detached);
1285 connp->conn_rq = NULL;
1286 connp->conn_wq = NULL;
1287 CONN_DEC_REF(listener->tcp_connp);
1288 } else {
1289 mutex_exit(&listener->tcp_eager_lock);
1290 }
1291 }
1292
1293 /* Stop all the timers */
1294 tcp_timers_stop(tcp);
1295
1296 if (tcp->tcp_state == TCPS_LISTEN) {
1297 if (tcp->tcp_ip_addr_cache) {
1298 kmem_free((void *)tcp->tcp_ip_addr_cache,
1299 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t));
1300 tcp->tcp_ip_addr_cache = NULL;
1301 }
1302 }
1303
1304 /* Decrement listerner connection counter if necessary. */
1305 if (tcp->tcp_listen_cnt != NULL)
1306 TCP_DECR_LISTEN_CNT(tcp);
1307
1308 mutex_enter(&tcp->tcp_non_sq_lock);
1309 if (tcp->tcp_flow_stopped)
1310 tcp_clrqfull(tcp);
1311 mutex_exit(&tcp->tcp_non_sq_lock);
1312
1313 tcp_bind_hash_remove(tcp);
1314 /*
1315 * If the tcp_time_wait_collector (which runs outside the squeue)
1316 * is trying to remove this tcp from the time wait list, we will
1317 * block in tcp_time_wait_remove while trying to acquire the
1318 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also
1319 * requires the ipcl_hash_remove to be ordered after the
1320 * tcp_time_wait_remove for the refcnt checks to work correctly.
1321 */
1322 if (tcp->tcp_state == TCPS_TIME_WAIT)
1323 (void) tcp_time_wait_remove(tcp, NULL);
1324 CL_INET_DISCONNECT(connp);
1325 ipcl_hash_remove(connp);
1326 oldstate = tcp->tcp_state;
1327 tcp->tcp_state = TCPS_CLOSED;
1328 /* Need to probe before ixa_cleanup() is called */
1329 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1330 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
1331 int32_t, oldstate);
1332 ixa_cleanup(connp->conn_ixa);
1333
1334 /*
1335 * Mark the conn as CONDEMNED
1336 */
1337 mutex_enter(&connp->conn_lock);
1338 connp->conn_state_flags |= CONN_CONDEMNED;
1339 mutex_exit(&connp->conn_lock);
1340
1341 ASSERT(tcp->tcp_time_wait_next == NULL);
1342 ASSERT(tcp->tcp_time_wait_prev == NULL);
1343 ASSERT(tcp->tcp_time_wait_expire == 0);
1344
1345 tcp_ipsec_cleanup(tcp);
1346 }
1347
1348 /*
1349 * tcp is dying (called from ipcl_conn_destroy and error cases).
1350 * Free the tcp_t in either case.
1351 */
1352 void
1353 tcp_free(tcp_t *tcp)
1354 {
1355 mblk_t *mp;
1356 conn_t *connp = tcp->tcp_connp;
1357
1358 ASSERT(tcp != NULL);
1359 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL);
1360
1361 connp->conn_rq = NULL;
1362 connp->conn_wq = NULL;
1363
1364 tcp_close_mpp(&tcp->tcp_xmit_head);
1365 tcp_close_mpp(&tcp->tcp_reass_head);
1366 if (tcp->tcp_rcv_list != NULL) {
1367 /* Free b_next chain */
1368 tcp_close_mpp(&tcp->tcp_rcv_list);
1369 }
1370 if ((mp = tcp->tcp_urp_mp) != NULL) {
1371 freemsg(mp);
1372 }
1373 if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1374 freemsg(mp);
1375 }
1376
1377 if (tcp->tcp_fused_sigurg_mp != NULL) {
1378 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1379 freeb(tcp->tcp_fused_sigurg_mp);
1380 tcp->tcp_fused_sigurg_mp = NULL;
1381 }
1382
1383 if (tcp->tcp_ordrel_mp != NULL) {
1384 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1385 freeb(tcp->tcp_ordrel_mp);
1386 tcp->tcp_ordrel_mp = NULL;
1387 }
1388
1389 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
1390 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
1391
1392 if (tcp->tcp_hopopts != NULL) {
1393 mi_free(tcp->tcp_hopopts);
1394 tcp->tcp_hopopts = NULL;
1395 tcp->tcp_hopoptslen = 0;
1396 }
1397 ASSERT(tcp->tcp_hopoptslen == 0);
1398 if (tcp->tcp_dstopts != NULL) {
1399 mi_free(tcp->tcp_dstopts);
1400 tcp->tcp_dstopts = NULL;
1401 tcp->tcp_dstoptslen = 0;
1402 }
1403 ASSERT(tcp->tcp_dstoptslen == 0);
1404 if (tcp->tcp_rthdrdstopts != NULL) {
1405 mi_free(tcp->tcp_rthdrdstopts);
1406 tcp->tcp_rthdrdstopts = NULL;
1407 tcp->tcp_rthdrdstoptslen = 0;
1408 }
1409 ASSERT(tcp->tcp_rthdrdstoptslen == 0);
1410 if (tcp->tcp_rthdr != NULL) {
1411 mi_free(tcp->tcp_rthdr);
1412 tcp->tcp_rthdr = NULL;
1413 tcp->tcp_rthdrlen = 0;
1414 }
1415 ASSERT(tcp->tcp_rthdrlen == 0);
1416
1417 /*
1418 * Following is really a blowing away a union.
1419 * It happens to have exactly two members of identical size
1420 * the following code is enough.
1421 */
1422 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1423
1424 /*
1425 * Destroy any association with SO_REUSEPORT group.
1426 */
1427 if (tcp->tcp_rg_bind != NULL) {
1428 /*
1429 * This is only necessary for connections which enabled
1430 * SO_REUSEPORT but were never bound. Such connections should
1431 * be the one and only member of the tcp_rg_tp to which they
1432 * have been associated.
1433 */
1434 VERIFY(tcp_rg_remove(tcp->tcp_rg_bind, tcp));
1435 tcp_rg_destroy(tcp->tcp_rg_bind);
1436 tcp->tcp_rg_bind = NULL;
1437 }
1438
1439 /*
1440 * If this is a non-STREAM socket still holding on to an upper
1441 * handle, release it. As a result of fallback we might also see
1442 * STREAMS based conns with upper handles, in which case there is
1443 * nothing to do other than clearing the field.
1444 */
1445 if (connp->conn_upper_handle != NULL) {
1446 if (IPCL_IS_NONSTR(connp)) {
1447 (*connp->conn_upcalls->su_closed)(
1448 connp->conn_upper_handle);
1449 tcp->tcp_detached = B_TRUE;
1450 }
1451 connp->conn_upper_handle = NULL;
1452 connp->conn_upcalls = NULL;
1453 }
1454 }
1455
1456 /*
1457 * tcp_get_conn/tcp_free_conn
1458 *
1459 * tcp_get_conn is used to get a clean tcp connection structure.
1460 * It tries to reuse the connections put on the freelist by the
1461 * time_wait_collector failing which it goes to kmem_cache. This
1462 * way has two benefits compared to just allocating from and
1463 * freeing to kmem_cache.
1464 * 1) The time_wait_collector can free (which includes the cleanup)
1465 * outside the squeue. So when the interrupt comes, we have a clean
1466 * connection sitting in the freelist. Obviously, this buys us
1467 * performance.
1468 *
1469 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener
1470 * has multiple disadvantages - tying up the squeue during alloc.
1471 * But allocating the conn/tcp in IP land is also not the best since
1472 * we can't check the 'q' and 'q0' which are protected by squeue and
1473 * blindly allocate memory which might have to be freed here if we are
1474 * not allowed to accept the connection. By using the freelist and
1475 * putting the conn/tcp back in freelist, we don't pay a penalty for
1476 * allocating memory without checking 'q/q0' and freeing it if we can't
1477 * accept the connection.
1478 *
1479 * Care should be taken to put the conn back in the same squeue's freelist
1480 * from which it was allocated. Best results are obtained if conn is
1481 * allocated from listener's squeue and freed to the same. Time wait
1482 * collector will free up the freelist is the connection ends up sitting
1483 * there for too long.
1484 */
1485 void *
1486 tcp_get_conn(void *arg, tcp_stack_t *tcps)
1487 {
1488 tcp_t *tcp = NULL;
1489 conn_t *connp = NULL;
1490 squeue_t *sqp = (squeue_t *)arg;
1491 tcp_squeue_priv_t *tcp_time_wait;
1492 netstack_t *ns;
1493 mblk_t *tcp_rsrv_mp = NULL;
1494
1495 tcp_time_wait =
1496 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP));
1497
1498 mutex_enter(&tcp_time_wait->tcp_time_wait_lock);
1499 tcp = tcp_time_wait->tcp_free_list;
1500 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0));
1501 if (tcp != NULL) {
1502 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next;
1503 tcp_time_wait->tcp_free_list_cnt--;
1504 mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1505 tcp->tcp_time_wait_next = NULL;
1506 connp = tcp->tcp_connp;
1507 connp->conn_flags |= IPCL_REUSED;
1508
1509 ASSERT(tcp->tcp_tcps == NULL);
1510 ASSERT(connp->conn_netstack == NULL);
1511 ASSERT(tcp->tcp_rsrv_mp != NULL);
1512 ns = tcps->tcps_netstack;
1513 netstack_hold(ns);
1514 connp->conn_netstack = ns;
1515 connp->conn_ixa->ixa_ipst = ns->netstack_ip;
1516 tcp->tcp_tcps = tcps;
1517 ipcl_globalhash_insert(connp);
1518
1519 connp->conn_ixa->ixa_notify_cookie = tcp;
1520 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify);
1521 connp->conn_recv = tcp_input_data;
1522 ASSERT(connp->conn_recvicmp == tcp_icmp_input);
1523 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp);
1524 return ((void *)connp);
1525 }
1526 mutex_exit(&tcp_time_wait->tcp_time_wait_lock);
1527 /*
1528 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until
1529 * this conn_t/tcp_t is freed at ipcl_conn_destroy().
1530 */
1531 tcp_rsrv_mp = allocb(0, BPRI_HI);
1532 if (tcp_rsrv_mp == NULL)
1533 return (NULL);
1534
1535 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP,
1536 tcps->tcps_netstack)) == NULL) {
1537 freeb(tcp_rsrv_mp);
1538 return (NULL);
1539 }
1540
1541 tcp = connp->conn_tcp;
1542 tcp->tcp_rsrv_mp = tcp_rsrv_mp;
1543 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL);
1544
1545 tcp->tcp_tcps = tcps;
1546
1547 connp->conn_recv = tcp_input_data;
1548 connp->conn_recvicmp = tcp_icmp_input;
1549 connp->conn_verifyicmp = tcp_verifyicmp;
1550
1551 /*
1552 * Register tcp_notify to listen to capability changes detected by IP.
1553 * This upcall is made in the context of the call to conn_ip_output
1554 * thus it is inside the squeue.
1555 */
1556 connp->conn_ixa->ixa_notify = tcp_notify;
1557 connp->conn_ixa->ixa_notify_cookie = tcp;
1558
1559 return ((void *)connp);
1560 }
1561
1562 /*
1563 * Handle connect to IPv4 destinations, including connections for AF_INET6
1564 * sockets connecting to IPv4 mapped IPv6 destinations.
1565 * Returns zero if OK, a positive errno, or a negative TLI error.
1566 */
1567 static int
1568 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport,
1569 uint_t srcid)
1570 {
1571 ipaddr_t dstaddr = *dstaddrp;
1572 uint16_t lport;
1573 conn_t *connp = tcp->tcp_connp;
1574 tcp_stack_t *tcps = tcp->tcp_tcps;
1575 int error;
1576
1577 ASSERT(connp->conn_ipversion == IPV4_VERSION);
1578
1579 /* Check for attempt to connect to INADDR_ANY */
1580 if (dstaddr == INADDR_ANY) {
1581 /*
1582 * SunOS 4.x and 4.3 BSD allow an application
1583 * to connect a TCP socket to INADDR_ANY.
1584 * When they do this, the kernel picks the
1585 * address of one interface and uses it
1586 * instead. The kernel usually ends up
1587 * picking the address of the loopback
1588 * interface. This is an undocumented feature.
1589 * However, we provide the same thing here
1590 * in order to have source and binary
1591 * compatibility with SunOS 4.x.
1592 * Update the T_CONN_REQ (sin/sin6) since it is used to
1593 * generate the T_CONN_CON.
1594 */
1595 dstaddr = htonl(INADDR_LOOPBACK);
1596 *dstaddrp = dstaddr;
1597 }
1598
1599 /* Handle __sin6_src_id if socket not bound to an IP address */
1600 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) {
1601 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1602 IPCL_ZONEID(connp), B_TRUE, tcps->tcps_netstack)) {
1603 /* Mismatch - conn_laddr_v6 would be v6 address. */
1604 return (EADDRNOTAVAIL);
1605 }
1606 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1607 }
1608
1609 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6);
1610 connp->conn_fport = dstport;
1611
1612 /*
1613 * At this point the remote destination address and remote port fields
1614 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1615 * have to see which state tcp was in so we can take appropriate action.
1616 */
1617 if (tcp->tcp_state == TCPS_IDLE) {
1618 /*
1619 * We support a quick connect capability here, allowing
1620 * clients to transition directly from IDLE to SYN_SENT
1621 * tcp_bindi will pick an unused port, insert the connection
1622 * in the bind hash and transition to BOUND state.
1623 */
1624 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1625 tcp, B_TRUE);
1626 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1627 B_FALSE, B_FALSE);
1628 if (lport == 0)
1629 return (-TNOADDR);
1630 }
1631
1632 /*
1633 * Lookup the route to determine a source address and the uinfo.
1634 * Setup TCP parameters based on the metrics/DCE.
1635 */
1636 error = tcp_set_destination(tcp);
1637 if (error != 0)
1638 return (error);
1639
1640 /*
1641 * Don't let an endpoint connect to itself.
1642 */
1643 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 &&
1644 connp->conn_fport == connp->conn_lport)
1645 return (-TBADADDR);
1646
1647 tcp->tcp_state = TCPS_SYN_SENT;
1648
1649 return (ipcl_conn_insert_v4(connp));
1650 }
1651
1652 /*
1653 * Handle connect to IPv6 destinations.
1654 * Returns zero if OK, a positive errno, or a negative TLI error.
1655 */
1656 static int
1657 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport,
1658 uint32_t flowinfo, uint_t srcid, uint32_t scope_id)
1659 {
1660 uint16_t lport;
1661 conn_t *connp = tcp->tcp_connp;
1662 tcp_stack_t *tcps = tcp->tcp_tcps;
1663 int error;
1664
1665 ASSERT(connp->conn_family == AF_INET6);
1666
1667 /*
1668 * If we're here, it means that the destination address is a native
1669 * IPv6 address. Return an error if conn_ipversion is not IPv6. A
1670 * reason why it might not be IPv6 is if the socket was bound to an
1671 * IPv4-mapped IPv6 address.
1672 */
1673 if (connp->conn_ipversion != IPV6_VERSION)
1674 return (-TBADADDR);
1675
1676 /*
1677 * Interpret a zero destination to mean loopback.
1678 * Update the T_CONN_REQ (sin/sin6) since it is used to
1679 * generate the T_CONN_CON.
1680 */
1681 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp))
1682 *dstaddrp = ipv6_loopback;
1683
1684 /* Handle __sin6_src_id if socket not bound to an IP address */
1685 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) {
1686 if (!ip_srcid_find_id(srcid, &connp->conn_laddr_v6,
1687 IPCL_ZONEID(connp), B_FALSE, tcps->tcps_netstack)) {
1688 /* Mismatch - conn_laddr_v6 would be v4-mapped. */
1689 return (EADDRNOTAVAIL);
1690 }
1691 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1692 }
1693
1694 /*
1695 * Take care of the scope_id now.
1696 */
1697 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) {
1698 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1699 connp->conn_ixa->ixa_scopeid = scope_id;
1700 } else {
1701 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET;
1702 }
1703
1704 connp->conn_flowinfo = flowinfo;
1705 connp->conn_faddr_v6 = *dstaddrp;
1706 connp->conn_fport = dstport;
1707
1708 /*
1709 * At this point the remote destination address and remote port fields
1710 * in the tcp-four-tuple have been filled in the tcp structure. Now we
1711 * have to see which state tcp was in so we can take appropriate action.
1712 */
1713 if (tcp->tcp_state == TCPS_IDLE) {
1714 /*
1715 * We support a quick connect capability here, allowing
1716 * clients to transition directly from IDLE to SYN_SENT
1717 * tcp_bindi will pick an unused port, insert the connection
1718 * in the bind hash and transition to BOUND state.
1719 */
1720 lport = tcp_update_next_port(tcps->tcps_next_port_to_try,
1721 tcp, B_TRUE);
1722 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE,
1723 B_FALSE, B_FALSE);
1724 if (lport == 0)
1725 return (-TNOADDR);
1726 }
1727
1728 /*
1729 * Lookup the route to determine a source address and the uinfo.
1730 * Setup TCP parameters based on the metrics/DCE.
1731 */
1732 error = tcp_set_destination(tcp);
1733 if (error != 0)
1734 return (error);
1735
1736 /*
1737 * Don't let an endpoint connect to itself.
1738 */
1739 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) &&
1740 connp->conn_fport == connp->conn_lport)
1741 return (-TBADADDR);
1742
1743 tcp->tcp_state = TCPS_SYN_SENT;
1744
1745 return (ipcl_conn_insert_v6(connp));
1746 }
1747
1748 /*
1749 * Disconnect
1750 * Note that unlike other functions this returns a positive tli error
1751 * when it fails; it never returns an errno.
1752 */
1753 static int
1754 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum)
1755 {
1756 conn_t *lconnp;
1757 tcp_stack_t *tcps = tcp->tcp_tcps;
1758 conn_t *connp = tcp->tcp_connp;
1759
1760 /*
1761 * Right now, upper modules pass down a T_DISCON_REQ to TCP,
1762 * when the stream is in BOUND state. Do not send a reset,
1763 * since the destination IP address is not valid, and it can
1764 * be the initialized value of all zeros (broadcast address).
1765 */
1766 if (tcp->tcp_state <= TCPS_BOUND) {
1767 if (connp->conn_debug) {
1768 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
1769 "tcp_disconnect: bad state, %d", tcp->tcp_state);
1770 }
1771 return (TOUTSTATE);
1772 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1773 TCPS_CONN_DEC(tcps);
1774 }
1775
1776 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) {
1777
1778 /*
1779 * According to TPI, for non-listeners, ignore seqnum
1780 * and disconnect.
1781 * Following interpretation of -1 seqnum is historical
1782 * and implied TPI ? (TPI only states that for T_CONN_IND,
1783 * a valid seqnum should not be -1).
1784 *
1785 * -1 means disconnect everything
1786 * regardless even on a listener.
1787 */
1788
1789 int old_state = tcp->tcp_state;
1790 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1791
1792 /*
1793 * The connection can't be on the tcp_time_wait_head list
1794 * since it is not detached.
1795 */
1796 ASSERT(tcp->tcp_time_wait_next == NULL);
1797 ASSERT(tcp->tcp_time_wait_prev == NULL);
1798 ASSERT(tcp->tcp_time_wait_expire == 0);
1799 /*
1800 * If it used to be a listener, check to make sure no one else
1801 * has taken the port before switching back to LISTEN state.
1802 */
1803 if (connp->conn_ipversion == IPV4_VERSION) {
1804 lconnp = ipcl_lookup_listener_v4(connp->conn_lport,
1805 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst);
1806 } else {
1807 uint_t ifindex = 0;
1808
1809 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET)
1810 ifindex = connp->conn_ixa->ixa_scopeid;
1811
1812 /* Allow conn_bound_if listeners? */
1813 lconnp = ipcl_lookup_listener_v6(connp->conn_lport,
1814 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp),
1815 ipst);
1816 }
1817 if (tcp->tcp_conn_req_max && lconnp == NULL) {
1818 tcp->tcp_state = TCPS_LISTEN;
1819 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1820 connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1821 NULL, int32_t, old_state);
1822 } else if (old_state > TCPS_BOUND) {
1823 tcp->tcp_conn_req_max = 0;
1824 tcp->tcp_state = TCPS_BOUND;
1825 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1826 connp->conn_ixa, void, NULL, tcp_t *, tcp, void,
1827 NULL, int32_t, old_state);
1828
1829 /*
1830 * If this end point is not going to become a listener,
1831 * decrement the listener connection count if
1832 * necessary. Note that we do not do this if it is
1833 * going to be a listner (the above if case) since
1834 * then it may remove the counter struct.
1835 */
1836 if (tcp->tcp_listen_cnt != NULL)
1837 TCP_DECR_LISTEN_CNT(tcp);
1838 }
1839 if (lconnp != NULL)
1840 CONN_DEC_REF(lconnp);
1841 switch (old_state) {
1842 case TCPS_SYN_SENT:
1843 case TCPS_SYN_RCVD:
1844 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1845 break;
1846 case TCPS_ESTABLISHED:
1847 case TCPS_CLOSE_WAIT:
1848 TCPS_BUMP_MIB(tcps, tcpEstabResets);
1849 break;
1850 }
1851
1852 if (tcp->tcp_fused)
1853 tcp_unfuse(tcp);
1854
1855 mutex_enter(&tcp->tcp_eager_lock);
1856 if ((tcp->tcp_conn_req_cnt_q0 != 0) ||
1857 (tcp->tcp_conn_req_cnt_q != 0)) {
1858 tcp_eager_cleanup(tcp, 0);
1859 }
1860 mutex_exit(&tcp->tcp_eager_lock);
1861
1862 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt,
1863 tcp->tcp_rnxt, TH_RST | TH_ACK);
1864
1865 tcp_reinit(tcp);
1866
1867 return (0);
1868 } else if (!tcp_eager_blowoff(tcp, seqnum)) {
1869 return (TBADSEQ);
1870 }
1871 return (0);
1872 }
1873
1874 /*
1875 * Our client hereby directs us to reject the connection request
1876 * that tcp_input_listener() marked with 'seqnum'. Rejection consists
1877 * of sending the appropriate RST, not an ICMP error.
1878 */
1879 void
1880 tcp_disconnect(tcp_t *tcp, mblk_t *mp)
1881 {
1882 t_scalar_t seqnum;
1883 int error;
1884 conn_t *connp = tcp->tcp_connp;
1885
1886 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX);
1887 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) {
1888 tcp_err_ack(tcp, mp, TPROTO, 0);
1889 return;
1890 }
1891 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number;
1892 error = tcp_disconnect_common(tcp, seqnum);
1893 if (error != 0)
1894 tcp_err_ack(tcp, mp, error, 0);
1895 else {
1896 if (tcp->tcp_state >= TCPS_ESTABLISHED) {
1897 /* Send M_FLUSH according to TPI */
1898 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW);
1899 }
1900 mp = mi_tpi_ok_ack_alloc(mp);
1901 if (mp != NULL)
1902 putnext(connp->conn_rq, mp);
1903 }
1904 }
1905
1906 /*
1907 * Handle reinitialization of a tcp structure.
1908 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE.
1909 */
1910 static void
1911 tcp_reinit(tcp_t *tcp)
1912 {
1913 mblk_t *mp;
1914 tcp_stack_t *tcps = tcp->tcp_tcps;
1915 conn_t *connp = tcp->tcp_connp;
1916 int32_t oldstate;
1917
1918 /* tcp_reinit should never be called for detached tcp_t's */
1919 ASSERT(tcp->tcp_listener == NULL);
1920 ASSERT((connp->conn_family == AF_INET &&
1921 connp->conn_ipversion == IPV4_VERSION) ||
1922 (connp->conn_family == AF_INET6 &&
1923 (connp->conn_ipversion == IPV4_VERSION ||
1924 connp->conn_ipversion == IPV6_VERSION)));
1925
1926 /* Cancel outstanding timers */
1927 tcp_timers_stop(tcp);
1928
1929 /*
1930 * Reset everything in the state vector, after updating global
1931 * MIB data from instance counters.
1932 */
1933 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs);
1934 tcp->tcp_ibsegs = 0;
1935 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs);
1936 tcp->tcp_obsegs = 0;
1937
1938 tcp_close_mpp(&tcp->tcp_xmit_head);
1939 if (tcp->tcp_snd_zcopy_aware)
1940 tcp_zcopy_notify(tcp);
1941 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL;
1942 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0;
1943 mutex_enter(&tcp->tcp_non_sq_lock);
1944 if (tcp->tcp_flow_stopped &&
1945 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) {
1946 tcp_clrqfull(tcp);
1947 }
1948 mutex_exit(&tcp->tcp_non_sq_lock);
1949 tcp_close_mpp(&tcp->tcp_reass_head);
1950 tcp->tcp_reass_tail = NULL;
1951 if (tcp->tcp_rcv_list != NULL) {
1952 /* Free b_next chain */
1953 tcp_close_mpp(&tcp->tcp_rcv_list);
1954 tcp->tcp_rcv_last_head = NULL;
1955 tcp->tcp_rcv_last_tail = NULL;
1956 tcp->tcp_rcv_cnt = 0;
1957 }
1958 tcp->tcp_rcv_last_tail = NULL;
1959
1960 if ((mp = tcp->tcp_urp_mp) != NULL) {
1961 freemsg(mp);
1962 tcp->tcp_urp_mp = NULL;
1963 }
1964 if ((mp = tcp->tcp_urp_mark_mp) != NULL) {
1965 freemsg(mp);
1966 tcp->tcp_urp_mark_mp = NULL;
1967 }
1968 if (tcp->tcp_fused_sigurg_mp != NULL) {
1969 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1970 freeb(tcp->tcp_fused_sigurg_mp);
1971 tcp->tcp_fused_sigurg_mp = NULL;
1972 }
1973 if (tcp->tcp_ordrel_mp != NULL) {
1974 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1975 freeb(tcp->tcp_ordrel_mp);
1976 tcp->tcp_ordrel_mp = NULL;
1977 }
1978
1979 /*
1980 * Following is a union with two members which are
1981 * identical types and size so the following cleanup
1982 * is enough.
1983 */
1984 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind);
1985
1986 CL_INET_DISCONNECT(connp);
1987
1988 /*
1989 * The connection can't be on the tcp_time_wait_head list
1990 * since it is not detached.
1991 */
1992 ASSERT(tcp->tcp_time_wait_next == NULL);
1993 ASSERT(tcp->tcp_time_wait_prev == NULL);
1994 ASSERT(tcp->tcp_time_wait_expire == 0);
1995
1996 /*
1997 * Reset/preserve other values
1998 */
1999 tcp_reinit_values(tcp);
2000 ipcl_hash_remove(connp);
2001 /* Note that ixa_cred gets cleared in ixa_cleanup */
2002 ixa_cleanup(connp->conn_ixa);
2003 tcp_ipsec_cleanup(tcp);
2004
2005 connp->conn_laddr_v6 = connp->conn_bound_addr_v6;
2006 connp->conn_saddr_v6 = connp->conn_bound_addr_v6;
2007 oldstate = tcp->tcp_state;
2008
2009 if (tcp->tcp_conn_req_max != 0) {
2010 /*
2011 * This is the case when a TLI program uses the same
2012 * transport end point to accept a connection. This
2013 * makes the TCP both a listener and acceptor. When
2014 * this connection is closed, we need to set the state
2015 * back to TCPS_LISTEN. Make sure that the eager list
2016 * is reinitialized.
2017 *
2018 * Note that this stream is still bound to the four
2019 * tuples of the previous connection in IP. If a new
2020 * SYN with different foreign address comes in, IP will
2021 * not find it and will send it to the global queue. In
2022 * the global queue, TCP will do a tcp_lookup_listener()
2023 * to find this stream. This works because this stream
2024 * is only removed from connected hash.
2025 *
2026 */
2027 tcp->tcp_state = TCPS_LISTEN;
2028 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
2029 tcp->tcp_eager_next_drop_q0 = tcp;
2030 tcp->tcp_eager_prev_drop_q0 = tcp;
2031 /*
2032 * Initially set conn_recv to tcp_input_listener_unbound to try
2033 * to pick a good squeue for the listener when the first SYN
2034 * arrives. tcp_input_listener_unbound sets it to
2035 * tcp_input_listener on that first SYN.
2036 */
2037 connp->conn_recv = tcp_input_listener_unbound;
2038
2039 connp->conn_proto = IPPROTO_TCP;
2040 connp->conn_faddr_v6 = ipv6_all_zeros;
2041 connp->conn_fport = 0;
2042
2043 (void) ipcl_bind_insert(connp);
2044 } else {
2045 tcp->tcp_state = TCPS_BOUND;
2046 }
2047
2048 /*
2049 * Initialize to default values
2050 */
2051 tcp_init_values(tcp, NULL);
2052
2053 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2054 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
2055 int32_t, oldstate);
2056
2057 ASSERT(tcp->tcp_ptpbhn != NULL);
2058 tcp->tcp_rwnd = connp->conn_rcvbuf;
2059 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ?
2060 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4;
2061 }
2062
2063 /*
2064 * Force values to zero that need be zero.
2065 * Do not touch values asociated with the BOUND or LISTEN state
2066 * since the connection will end up in that state after the reinit.
2067 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t
2068 * structure!
2069 */
2070 static void
2071 tcp_reinit_values(tcp_t *tcp)
2072 {
2073 tcp_stack_t *tcps = tcp->tcp_tcps;
2074 conn_t *connp = tcp->tcp_connp;
2075
2076 #ifndef lint
2077 #define DONTCARE(x)
2078 #define PRESERVE(x)
2079 #else
2080 #define DONTCARE(x) ((x) = (x))
2081 #define PRESERVE(x) ((x) = (x))
2082 #endif /* lint */
2083
2084 PRESERVE(tcp->tcp_bind_hash_port);
2085 PRESERVE(tcp->tcp_bind_hash);
2086 PRESERVE(tcp->tcp_ptpbhn);
2087 PRESERVE(tcp->tcp_acceptor_hash);
2088 PRESERVE(tcp->tcp_ptpahn);
2089
2090 /* Should be ASSERT NULL on these with new code! */
2091 ASSERT(tcp->tcp_time_wait_next == NULL);
2092 ASSERT(tcp->tcp_time_wait_prev == NULL);
2093 ASSERT(tcp->tcp_time_wait_expire == 0);
2094 PRESERVE(tcp->tcp_state);
2095 PRESERVE(connp->conn_rq);
2096 PRESERVE(connp->conn_wq);
2097
2098 ASSERT(tcp->tcp_xmit_head == NULL);
2099 ASSERT(tcp->tcp_xmit_last == NULL);
2100 ASSERT(tcp->tcp_unsent == 0);
2101 ASSERT(tcp->tcp_xmit_tail == NULL);
2102 ASSERT(tcp->tcp_xmit_tail_unsent == 0);
2103
2104 tcp->tcp_snxt = 0; /* Displayed in mib */
2105 tcp->tcp_suna = 0; /* Displayed in mib */
2106 tcp->tcp_swnd = 0;
2107 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */
2108
2109 ASSERT(tcp->tcp_ibsegs == 0);
2110 ASSERT(tcp->tcp_obsegs == 0);
2111
2112 if (connp->conn_ht_iphc != NULL) {
2113 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated);
2114 connp->conn_ht_iphc = NULL;
2115 connp->conn_ht_iphc_allocated = 0;
2116 connp->conn_ht_iphc_len = 0;
2117 connp->conn_ht_ulp = NULL;
2118 connp->conn_ht_ulp_len = 0;
2119 tcp->tcp_ipha = NULL;
2120 tcp->tcp_ip6h = NULL;
2121 tcp->tcp_tcpha = NULL;
2122 }
2123
2124 /* We clear any IP_OPTIONS and extension headers */
2125 ip_pkt_free(&connp->conn_xmit_ipp);
2126
2127 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */
2128 DONTCARE(tcp->tcp_ipha);
2129 DONTCARE(tcp->tcp_ip6h);
2130 DONTCARE(tcp->tcp_tcpha);
2131 tcp->tcp_valid_bits = 0;
2132
2133 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */
2134 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */
2135 tcp->tcp_last_rcv_lbolt = 0;
2136
2137 tcp->tcp_init_cwnd = 0;
2138
2139 tcp->tcp_urp_last_valid = 0;
2140 tcp->tcp_hard_binding = 0;
2141
2142 tcp->tcp_fin_acked = 0;
2143 tcp->tcp_fin_rcvd = 0;
2144 tcp->tcp_fin_sent = 0;
2145 tcp->tcp_ordrel_done = 0;
2146
2147 tcp->tcp_detached = 0;
2148
2149 tcp->tcp_snd_ws_ok = B_FALSE;
2150 tcp->tcp_snd_ts_ok = B_FALSE;
2151 tcp->tcp_zero_win_probe = 0;
2152
2153 tcp->tcp_loopback = 0;
2154 tcp->tcp_localnet = 0;
2155 tcp->tcp_syn_defense = 0;
2156 tcp->tcp_set_timer = 0;
2157
2158 tcp->tcp_active_open = 0;
2159 tcp->tcp_rexmit = B_FALSE;
2160 tcp->tcp_xmit_zc_clean = B_FALSE;
2161
2162 tcp->tcp_snd_sack_ok = B_FALSE;
2163 tcp->tcp_hwcksum = B_FALSE;
2164
2165 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */
2166
2167 tcp->tcp_conn_def_q0 = 0;
2168 tcp->tcp_ip_forward_progress = B_FALSE;
2169 tcp->tcp_ecn_ok = B_FALSE;
2170
2171 tcp->tcp_cwr = B_FALSE;
2172 tcp->tcp_ecn_echo_on = B_FALSE;
2173 tcp->tcp_is_wnd_shrnk = B_FALSE;
2174
2175 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp);
2176 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t));
2177
2178 tcp->tcp_rcv_ws = 0;
2179 tcp->tcp_snd_ws = 0;
2180 tcp->tcp_ts_recent = 0;
2181 tcp->tcp_rnxt = 0; /* Displayed in mib */
2182 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */
2183 tcp->tcp_initial_pmtu = 0;
2184
2185 ASSERT(tcp->tcp_reass_head == NULL);
2186 ASSERT(tcp->tcp_reass_tail == NULL);
2187
2188 tcp->tcp_cwnd_cnt = 0;
2189
2190 ASSERT(tcp->tcp_rcv_list == NULL);
2191 ASSERT(tcp->tcp_rcv_last_head == NULL);
2192 ASSERT(tcp->tcp_rcv_last_tail == NULL);
2193 ASSERT(tcp->tcp_rcv_cnt == 0);
2194
2195 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */
2196 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */
2197 tcp->tcp_csuna = 0;
2198
2199 tcp->tcp_rto = 0; /* Displayed in MIB */
2200 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */
2201 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */
2202 tcp->tcp_rtt_update = 0;
2203
2204 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2205 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */
2206
2207 tcp->tcp_rack = 0; /* Displayed in mib */
2208 tcp->tcp_rack_cnt = 0;
2209 tcp->tcp_rack_cur_max = 0;
2210 tcp->tcp_rack_abs_max = 0;
2211
2212 tcp->tcp_max_swnd = 0;
2213
2214 ASSERT(tcp->tcp_listener == NULL);
2215
2216 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */
2217 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */
2218 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */
2219 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */
2220
2221 ASSERT(tcp->tcp_conn_req_cnt_q == 0);
2222 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0);
2223 PRESERVE(tcp->tcp_conn_req_max);
2224 PRESERVE(tcp->tcp_conn_req_seqnum);
2225
2226 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */
2227 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */
2228 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */
2229 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */
2230
2231 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */
2232 ASSERT(tcp->tcp_urp_mp == NULL);
2233 ASSERT(tcp->tcp_urp_mark_mp == NULL);
2234 ASSERT(tcp->tcp_fused_sigurg_mp == NULL);
2235
2236 ASSERT(tcp->tcp_eager_next_q == NULL);
2237 ASSERT(tcp->tcp_eager_last_q == NULL);
2238 ASSERT((tcp->tcp_eager_next_q0 == NULL &&
2239 tcp->tcp_eager_prev_q0 == NULL) ||
2240 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0);
2241 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL);
2242
2243 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL &&
2244 tcp->tcp_eager_prev_drop_q0 == NULL) ||
2245 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0);
2246
2247 DONTCARE(tcp->tcp_ka_rinterval); /* Init in tcp_init_values */
2248 DONTCARE(tcp->tcp_ka_abort_thres); /* Init in tcp_init_values */
2249 DONTCARE(tcp->tcp_ka_cnt); /* Init in tcp_init_values */
2250
2251 tcp->tcp_client_errno = 0;
2252
2253 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */
2254
2255 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */
2256
2257 PRESERVE(connp->conn_bound_addr_v6);
2258 tcp->tcp_last_sent_len = 0;
2259 tcp->tcp_dupack_cnt = 0;
2260
2261 connp->conn_fport = 0; /* Displayed in MIB */
2262 PRESERVE(connp->conn_lport);
2263
2264 PRESERVE(tcp->tcp_acceptor_lockp);
2265
2266 ASSERT(tcp->tcp_ordrel_mp == NULL);
2267 PRESERVE(tcp->tcp_acceptor_id);
2268 DONTCARE(tcp->tcp_ipsec_overhead);
2269
2270 PRESERVE(connp->conn_family);
2271 /* Remove any remnants of mapped address binding */
2272 if (connp->conn_family == AF_INET6) {
2273 connp->conn_ipversion = IPV6_VERSION;
2274 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2275 } else {
2276 connp->conn_ipversion = IPV4_VERSION;
2277 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2278 }
2279
2280 connp->conn_bound_if = 0;
2281 connp->conn_recv_ancillary.crb_all = 0;
2282 tcp->tcp_recvifindex = 0;
2283 tcp->tcp_recvhops = 0;
2284 tcp->tcp_closed = 0;
2285 if (tcp->tcp_hopopts != NULL) {
2286 mi_free(tcp->tcp_hopopts);
2287 tcp->tcp_hopopts = NULL;
2288 tcp->tcp_hopoptslen = 0;
2289 }
2290 ASSERT(tcp->tcp_hopoptslen == 0);
2291 if (tcp->tcp_dstopts != NULL) {
2292 mi_free(tcp->tcp_dstopts);
2293 tcp->tcp_dstopts = NULL;
2294 tcp->tcp_dstoptslen = 0;
2295 }
2296 ASSERT(tcp->tcp_dstoptslen == 0);
2297 if (tcp->tcp_rthdrdstopts != NULL) {
2298 mi_free(tcp->tcp_rthdrdstopts);
2299 tcp->tcp_rthdrdstopts = NULL;
2300 tcp->tcp_rthdrdstoptslen = 0;
2301 }
2302 ASSERT(tcp->tcp_rthdrdstoptslen == 0);
2303 if (tcp->tcp_rthdr != NULL) {
2304 mi_free(tcp->tcp_rthdr);
2305 tcp->tcp_rthdr = NULL;
2306 tcp->tcp_rthdrlen = 0;
2307 }
2308 ASSERT(tcp->tcp_rthdrlen == 0);
2309
2310 /* Reset fusion-related fields */
2311 tcp->tcp_fused = B_FALSE;
2312 tcp->tcp_unfusable = B_FALSE;
2313 tcp->tcp_fused_sigurg = B_FALSE;
2314 tcp->tcp_loopback_peer = NULL;
2315
2316 tcp->tcp_lso = B_FALSE;
2317
2318 tcp->tcp_in_ack_unsent = 0;
2319 tcp->tcp_cork = B_FALSE;
2320 tcp->tcp_tconnind_started = B_FALSE;
2321
2322 PRESERVE(tcp->tcp_squeue_bytes);
2323
2324 tcp->tcp_closemp_used = B_FALSE;
2325
2326 PRESERVE(tcp->tcp_rsrv_mp);
2327 PRESERVE(tcp->tcp_rsrv_mp_lock);
2328
2329 #ifdef DEBUG
2330 DONTCARE(tcp->tcmp_stk[0]);
2331 #endif
2332
2333 PRESERVE(tcp->tcp_connid);
2334
2335 ASSERT(tcp->tcp_listen_cnt == NULL);
2336 ASSERT(tcp->tcp_reass_tid == 0);
2337
2338 #undef DONTCARE
2339 #undef PRESERVE
2340 }
2341
2342 /*
2343 * Initialize the various fields in tcp_t. If parent (the listener) is non
2344 * NULL, certain values will be inheritted from it.
2345 */
2346 void
2347 tcp_init_values(tcp_t *tcp, tcp_t *parent)
2348 {
2349 tcp_stack_t *tcps = tcp->tcp_tcps;
2350 conn_t *connp = tcp->tcp_connp;
2351 clock_t rto;
2352
2353 ASSERT((connp->conn_family == AF_INET &&
2354 connp->conn_ipversion == IPV4_VERSION) ||
2355 (connp->conn_family == AF_INET6 &&
2356 (connp->conn_ipversion == IPV4_VERSION ||
2357 connp->conn_ipversion == IPV6_VERSION)));
2358
2359 if (parent == NULL) {
2360 tcp->tcp_naglim = tcps->tcps_naglim_def;
2361
2362 tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial;
2363 tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min;
2364 tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max;
2365
2366 tcp->tcp_first_ctimer_threshold =
2367 tcps->tcps_ip_notify_cinterval;
2368 tcp->tcp_second_ctimer_threshold =
2369 tcps->tcps_ip_abort_cinterval;
2370 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval;
2371 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval;
2372
2373 tcp->tcp_fin_wait_2_flush_interval =
2374 tcps->tcps_fin_wait_2_flush_interval;
2375
2376 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval;
2377 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval;
2378 tcp->tcp_ka_cnt = 0;
2379 tcp->tcp_ka_rinterval = 0;
2380
2381 /*
2382 * Default value of tcp_init_cwnd is 0, so no need to set here
2383 * if parent is NULL. But we need to inherit it from parent.
2384 */
2385 } else {
2386 /* Inherit various TCP parameters from the parent. */
2387 tcp->tcp_naglim = parent->tcp_naglim;
2388
2389 tcp->tcp_rto_initial = parent->tcp_rto_initial;
2390 tcp->tcp_rto_min = parent->tcp_rto_min;
2391 tcp->tcp_rto_max = parent->tcp_rto_max;
2392
2393 tcp->tcp_first_ctimer_threshold =
2394 parent->tcp_first_ctimer_threshold;
2395 tcp->tcp_second_ctimer_threshold =
2396 parent->tcp_second_ctimer_threshold;
2397 tcp->tcp_first_timer_threshold =
2398 parent->tcp_first_timer_threshold;
2399 tcp->tcp_second_timer_threshold =
2400 parent->tcp_second_timer_threshold;
2401
2402 tcp->tcp_fin_wait_2_flush_interval =
2403 parent->tcp_fin_wait_2_flush_interval;
2404
2405 tcp->tcp_ka_interval = parent->tcp_ka_interval;
2406 tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres;
2407 tcp->tcp_ka_cnt = parent->tcp_ka_cnt;
2408 tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval;
2409
2410 tcp->tcp_init_cwnd = parent->tcp_init_cwnd;
2411 }
2412
2413 /*
2414 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO
2415 * will be close to tcp_rexmit_interval_initial. By doing this, we
2416 * allow the algorithm to adjust slowly to large fluctuations of RTT
2417 * during first few transmissions of a connection as seen in slow
2418 * links.
2419 */
2420 tcp->tcp_rtt_sa = tcp->tcp_rto_initial << 2;
2421 tcp->tcp_rtt_sd = tcp->tcp_rto_initial >> 1;
2422 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd +
2423 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) +
2424 tcps->tcps_conn_grace_period;
2425 TCP_SET_RTO(tcp, rto);
2426
2427 tcp->tcp_timer_backoff = 0;
2428 tcp->tcp_ms_we_have_waited = 0;
2429 tcp->tcp_last_recv_time = ddi_get_lbolt();
2430 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_;
2431 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN;
2432
2433 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier;
2434
2435 /* NOTE: ISS is now set in tcp_set_destination(). */
2436
2437 /* Reset fusion-related fields */
2438 tcp->tcp_fused = B_FALSE;
2439 tcp->tcp_unfusable = B_FALSE;
2440 tcp->tcp_fused_sigurg = B_FALSE;
2441 tcp->tcp_loopback_peer = NULL;
2442
2443 /* We rebuild the header template on the next connect/conn_request */
2444
2445 connp->conn_mlp_type = mlptSingle;
2446
2447 /*
2448 * Init the window scale to the max so tcp_rwnd_set() won't pare
2449 * down tcp_rwnd. tcp_set_destination() will set the right value later.
2450 */
2451 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT;
2452 tcp->tcp_rwnd = connp->conn_rcvbuf;
2453
2454 tcp->tcp_cork = B_FALSE;
2455 /*
2456 * Init the tcp_debug option if it wasn't already set. This value
2457 * determines whether TCP
2458 * calls strlog() to print out debug messages. Doing this
2459 * initialization here means that this value is not inherited thru
2460 * tcp_reinit().
2461 */
2462 if (!connp->conn_debug)
2463 connp->conn_debug = tcps->tcps_dbg;
2464 }
2465
2466 /*
2467 * Update the TCP connection according to change of PMTU.
2468 *
2469 * Path MTU might have changed by either increase or decrease, so need to
2470 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny
2471 * or negative MSS, since tcp_mss_set() will do it.
2472 *
2473 * Returns B_TRUE when the connection PMTU changes, otherwise B_FALSE.
2474 */
2475 boolean_t
2476 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only)
2477 {
2478 uint32_t pmtu;
2479 int32_t mss;
2480 conn_t *connp = tcp->tcp_connp;
2481 ip_xmit_attr_t *ixa = connp->conn_ixa;
2482 iaflags_t ixaflags;
2483
2484 if (tcp->tcp_tcps->tcps_ignore_path_mtu)
2485 return (B_FALSE);
2486
2487 if (tcp->tcp_state < TCPS_ESTABLISHED)
2488 return (B_FALSE);
2489
2490 /*
2491 * Always call ip_get_pmtu() to make sure that IP has updated
2492 * ixa_flags properly.
2493 */
2494 pmtu = ip_get_pmtu(ixa);
2495 ixaflags = ixa->ixa_flags;
2496
2497 /*
2498 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and
2499 * IPsec overhead if applied. Make sure to use the most recent
2500 * IPsec information.
2501 */
2502 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp);
2503
2504 /*
2505 * Nothing to change, so just return.
2506 */
2507 if (mss == tcp->tcp_mss)
2508 return (B_FALSE);
2509
2510 /*
2511 * Currently, for ICMP errors, only PMTU decrease is handled.
2512 */
2513 if (mss > tcp->tcp_mss && decrease_only)
2514 return (B_FALSE);
2515
2516 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss);
2517
2518 /*
2519 * Update ixa_fragsize and ixa_pmtu.
2520 */
2521 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu;
2522
2523 /*
2524 * Adjust MSS and all relevant variables.
2525 */
2526 tcp_mss_set(tcp, mss);
2527
2528 /*
2529 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu
2530 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP
2531 * has a (potentially different) min size we do the same. Make sure to
2532 * clear IXAF_DONTFRAG, which is used by IP to decide whether to
2533 * fragment the packet.
2534 *
2535 * LSO over IPv6 can not be fragmented. So need to disable LSO
2536 * when IPv6 fragmentation is needed.
2537 */
2538 if (mss < tcp->tcp_tcps->tcps_mss_min)
2539 ixaflags |= IXAF_PMTU_TOO_SMALL;
2540
2541 if (ixaflags & IXAF_PMTU_TOO_SMALL)
2542 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF);
2543
2544 if ((connp->conn_ipversion == IPV4_VERSION) &&
2545 !(ixaflags & IXAF_PMTU_IPV4_DF)) {
2546 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0;
2547 }
2548 ixa->ixa_flags = ixaflags;
2549 return (B_TRUE);
2550 }
2551
2552 int
2553 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk)
2554 {
2555 conn_t *connp = tcp->tcp_connp;
2556 queue_t *q = connp->conn_rq;
2557 int32_t mss = tcp->tcp_mss;
2558 int maxpsz;
2559
2560 if (TCP_IS_DETACHED(tcp))
2561 return (mss);
2562 if (tcp->tcp_fused) {
2563 maxpsz = tcp_fuse_maxpsz(tcp);
2564 mss = INFPSZ;
2565 } else if (tcp->tcp_maxpsz_multiplier == 0) {
2566 /*
2567 * Set the sd_qn_maxpsz according to the socket send buffer
2568 * size, and sd_maxblk to INFPSZ (-1). This will essentially
2569 * instruct the stream head to copyin user data into contiguous
2570 * kernel-allocated buffers without breaking it up into smaller
2571 * chunks. We round up the buffer size to the nearest SMSS.
2572 */
2573 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss);
2574 mss = INFPSZ;
2575 } else {
2576 /*
2577 * Set sd_qn_maxpsz to approx half the (receivers) buffer
2578 * (and a multiple of the mss). This instructs the stream
2579 * head to break down larger than SMSS writes into SMSS-
2580 * size mblks, up to tcp_maxpsz_multiplier mblks at a time.
2581 */
2582 maxpsz = tcp->tcp_maxpsz_multiplier * mss;
2583 if (maxpsz > connp->conn_sndbuf / 2) {
2584 maxpsz = connp->conn_sndbuf / 2;
2585 /* Round up to nearest mss */
2586 maxpsz = MSS_ROUNDUP(maxpsz, mss);
2587 }
2588 }
2589
2590 (void) proto_set_maxpsz(q, connp, maxpsz);
2591 if (!(IPCL_IS_NONSTR(connp)))
2592 connp->conn_wq->q_maxpsz = maxpsz;
2593 if (set_maxblk)
2594 (void) proto_set_tx_maxblk(q, connp, mss);
2595 return (mss);
2596 }
2597
2598 /* For /dev/tcp aka AF_INET open */
2599 static int
2600 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2601 {
2602 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE));
2603 }
2604
2605 /* For /dev/tcp6 aka AF_INET6 open */
2606 static int
2607 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp)
2608 {
2609 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE));
2610 }
2611
2612 conn_t *
2613 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket,
2614 int *errorp)
2615 {
2616 tcp_t *tcp = NULL;
2617 conn_t *connp;
2618 zoneid_t zoneid;
2619 tcp_stack_t *tcps;
2620 squeue_t *sqp;
2621
2622 ASSERT(errorp != NULL);
2623 /*
2624 * Find the proper zoneid and netstack.
2625 */
2626 /*
2627 * Special case for install: miniroot needs to be able to
2628 * access files via NFS as though it were always in the
2629 * global zone.
2630 */
2631 if (credp == kcred && nfs_global_client_only != 0) {
2632 zoneid = GLOBAL_ZONEID;
2633 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)->
2634 netstack_tcp;
2635 ASSERT(tcps != NULL);
2636 } else {
2637 netstack_t *ns;
2638 int err;
2639
2640 if ((err = secpolicy_basic_net_access(credp)) != 0) {
2641 *errorp = err;
2642 return (NULL);
2643 }
2644
2645 ns = netstack_find_by_cred(credp);
2646 ASSERT(ns != NULL);
2647 tcps = ns->netstack_tcp;
2648 ASSERT(tcps != NULL);
2649
2650 /*
2651 * For exclusive stacks we set the zoneid to zero
2652 * to make TCP operate as if in the global zone.
2653 */
2654 if (tcps->tcps_netstack->netstack_stackid !=
2655 GLOBAL_NETSTACKID)
2656 zoneid = GLOBAL_ZONEID;
2657 else
2658 zoneid = crgetzoneid(credp);
2659 }
2660
2661 sqp = IP_SQUEUE_GET((uint_t)gethrtime());
2662 connp = (conn_t *)tcp_get_conn(sqp, tcps);
2663 /*
2664 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt,
2665 * so we drop it by one.
2666 */
2667 netstack_rele(tcps->tcps_netstack);
2668 if (connp == NULL) {
2669 *errorp = ENOSR;
2670 return (NULL);
2671 }
2672 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto);
2673
2674 connp->conn_sqp = sqp;
2675 connp->conn_initial_sqp = connp->conn_sqp;
2676 connp->conn_ixa->ixa_sqp = connp->conn_sqp;
2677 tcp = connp->conn_tcp;
2678
2679 /*
2680 * Besides asking IP to set the checksum for us, have conn_ip_output
2681 * to do the following checks when necessary:
2682 *
2683 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid
2684 * IXAF_VERIFY_PMTU: verify PMTU changes
2685 * IXAF_VERIFY_LSO: verify LSO capability changes
2686 */
2687 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
2688 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO;
2689
2690 if (!tcps->tcps_dev_flow_ctl)
2691 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
2692
2693 if (isv6) {
2694 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT;
2695 connp->conn_ipversion = IPV6_VERSION;
2696 connp->conn_family = AF_INET6;
2697 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
2698 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit;
2699 } else {
2700 connp->conn_ipversion = IPV4_VERSION;
2701 connp->conn_family = AF_INET;
2702 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
2703 connp->conn_default_ttl = tcps->tcps_ipv4_ttl;
2704 }
2705 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl;
2706
2707 crhold(credp);
2708 connp->conn_cred = credp;
2709 connp->conn_cpid = curproc->p_pid;
2710 connp->conn_open_time = ddi_get_lbolt64();
2711
2712 /* Cache things in the ixa without any refhold */
2713 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED));
2714 connp->conn_ixa->ixa_cred = credp;
2715 connp->conn_ixa->ixa_cpid = connp->conn_cpid;
2716
2717 connp->conn_zoneid = zoneid;
2718 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */
2719 connp->conn_ixa->ixa_zoneid = zoneid;
2720 connp->conn_mlp_type = mlptSingle;
2721 ASSERT(connp->conn_netstack == tcps->tcps_netstack);
2722 ASSERT(tcp->tcp_tcps == tcps);
2723
2724 /*
2725 * If the caller has the process-wide flag set, then default to MAC
2726 * exempt mode. This allows read-down to unlabeled hosts.
2727 */
2728 if (getpflags(NET_MAC_AWARE, credp) != 0)
2729 connp->conn_mac_mode = CONN_MAC_AWARE;
2730
2731 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID);
2732
2733 if (issocket) {
2734 tcp->tcp_issocket = 1;
2735 }
2736
2737 connp->conn_rcvbuf = tcps->tcps_recv_hiwat;
2738 connp->conn_sndbuf = tcps->tcps_xmit_hiwat;
2739 if (tcps->tcps_snd_lowat_fraction != 0) {
2740 connp->conn_sndlowat = connp->conn_sndbuf /
2741 tcps->tcps_snd_lowat_fraction;
2742 } else {
2743 connp->conn_sndlowat = tcps->tcps_xmit_lowat;
2744 }
2745 connp->conn_so_type = SOCK_STREAM;
2746 connp->conn_wroff = connp->conn_ht_iphc_allocated +
2747 tcps->tcps_wroff_xtra;
2748
2749 SOCK_CONNID_INIT(tcp->tcp_connid);
2750 /* DTrace ignores this - it isn't a tcp:::state-change */
2751 tcp->tcp_state = TCPS_IDLE;
2752 tcp_init_values(tcp, NULL);
2753 return (connp);
2754 }
2755
2756 static int
2757 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp,
2758 boolean_t isv6)
2759 {
2760 tcp_t *tcp = NULL;
2761 conn_t *connp = NULL;
2762 int err;
2763 vmem_t *minor_arena = NULL;
2764 dev_t conn_dev;
2765 boolean_t issocket;
2766
2767 if (q->q_ptr != NULL)
2768 return (0);
2769
2770 if (sflag == MODOPEN)
2771 return (EINVAL);
2772
2773 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) &&
2774 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) {
2775 minor_arena = ip_minor_arena_la;
2776 } else {
2777 /*
2778 * Either minor numbers in the large arena were exhausted
2779 * or a non socket application is doing the open.
2780 * Try to allocate from the small arena.
2781 */
2782 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) {
2783 return (EBUSY);
2784 }
2785 minor_arena = ip_minor_arena_sa;
2786 }
2787
2788 ASSERT(minor_arena != NULL);
2789
2790 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev);
2791
2792 if (flag & SO_FALLBACK) {
2793 /*
2794 * Non streams socket needs a stream to fallback to
2795 */
2796 RD(q)->q_ptr = (void *)conn_dev;
2797 WR(q)->q_qinfo = &tcp_fallback_sock_winit;
2798 WR(q)->q_ptr = (void *)minor_arena;
2799 qprocson(q);
2800 return (0);
2801 } else if (flag & SO_ACCEPTOR) {
2802 q->q_qinfo = &tcp_acceptor_rinit;
2803 /*
2804 * the conn_dev and minor_arena will be subsequently used by
2805 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out
2806 * the minor device number for this connection from the q_ptr.
2807 */
2808 RD(q)->q_ptr = (void *)conn_dev;
2809 WR(q)->q_qinfo = &tcp_acceptor_winit;
2810 WR(q)->q_ptr = (void *)minor_arena;
2811 qprocson(q);
2812 return (0);
2813 }
2814
2815 issocket = flag & SO_SOCKSTR;
2816 connp = tcp_create_common(credp, isv6, issocket, &err);
2817
2818 if (connp == NULL) {
2819 inet_minor_free(minor_arena, conn_dev);
2820 q->q_ptr = WR(q)->q_ptr = NULL;
2821 return (err);
2822 }
2823
2824 connp->conn_rq = q;
2825 connp->conn_wq = WR(q);
2826 q->q_ptr = WR(q)->q_ptr = connp;
2827
2828 connp->conn_dev = conn_dev;
2829 connp->conn_minor_arena = minor_arena;
2830
2831 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6);
2832 ASSERT(WR(q)->q_qinfo == &tcp_winit);
2833
2834 tcp = connp->conn_tcp;
2835
2836 if (issocket) {
2837 WR(q)->q_qinfo = &tcp_sock_winit;
2838 } else {
2839 #ifdef _ILP32
2840 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q);
2841 #else
2842 tcp->tcp_acceptor_id = conn_dev;
2843 #endif /* _ILP32 */
2844 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp);
2845 }
2846
2847 /*
2848 * Put the ref for TCP. Ref for IP was already put
2849 * by ipcl_conn_create. Also Make the conn_t globally
2850 * visible to walkers
2851 */
2852 mutex_enter(&connp->conn_lock);
2853 CONN_INC_REF_LOCKED(connp);
2854 ASSERT(connp->conn_ref == 2);
2855 connp->conn_state_flags &= ~CONN_INCIPIENT;
2856 mutex_exit(&connp->conn_lock);
2857
2858 qprocson(q);
2859 return (0);
2860 }
2861
2862 /*
2863 * Build/update the tcp header template (in conn_ht_iphc) based on
2864 * conn_xmit_ipp. The headers include ip6_t, any extension
2865 * headers, and the maximum size tcp header (to avoid reallocation
2866 * on the fly for additional tcp options).
2867 *
2868 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}.
2869 * Returns failure if can't allocate memory.
2870 */
2871 int
2872 tcp_build_hdrs(tcp_t *tcp)
2873 {
2874 tcp_stack_t *tcps = tcp->tcp_tcps;
2875 conn_t *connp = tcp->tcp_connp;
2876 char buf[TCP_MAX_HDR_LENGTH];
2877 uint_t buflen;
2878 uint_t ulplen = TCP_MIN_HEADER_LENGTH;
2879 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH;
2880 tcpha_t *tcpha;
2881 uint32_t cksum;
2882 int error;
2883
2884 /*
2885 * We might be called after the connection is set up, and we might
2886 * have TS options already in the TCP header. Thus we save any
2887 * existing tcp header.
2888 */
2889 buflen = connp->conn_ht_ulp_len;
2890 if (buflen != 0) {
2891 bcopy(connp->conn_ht_ulp, buf, buflen);
2892 extralen -= buflen - ulplen;
2893 ulplen = buflen;
2894 }
2895
2896 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */
2897 mutex_enter(&connp->conn_lock);
2898 error = conn_build_hdr_template(connp, ulplen, extralen,
2899 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo);
2900 mutex_exit(&connp->conn_lock);
2901 if (error != 0)
2902 return (error);
2903
2904 /*
2905 * Any routing header/option has been massaged. The checksum difference
2906 * is stored in conn_sum for later use.
2907 */
2908 tcpha = (tcpha_t *)connp->conn_ht_ulp;
2909 tcp->tcp_tcpha = tcpha;
2910
2911 /* restore any old tcp header */
2912 if (buflen != 0) {
2913 bcopy(buf, connp->conn_ht_ulp, buflen);
2914 } else {
2915 tcpha->tha_sum = 0;
2916 tcpha->tha_urp = 0;
2917 tcpha->tha_ack = 0;
2918 tcpha->tha_offset_and_reserved = (5 << 4);
2919 tcpha->tha_lport = connp->conn_lport;
2920 tcpha->tha_fport = connp->conn_fport;
2921 }
2922
2923 /*
2924 * IP wants our header length in the checksum field to
2925 * allow it to perform a single pseudo-header+checksum
2926 * calculation on behalf of TCP.
2927 * Include the adjustment for a source route once IP_OPTIONS is set.
2928 */
2929 cksum = sizeof (tcpha_t) + connp->conn_sum;
2930 cksum = (cksum >> 16) + (cksum & 0xFFFF);
2931 ASSERT(cksum < 0x10000);
2932 tcpha->tha_sum = htons(cksum);
2933
2934 if (connp->conn_ipversion == IPV4_VERSION)
2935 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc;
2936 else
2937 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc;
2938
2939 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra >
2940 connp->conn_wroff) {
2941 connp->conn_wroff = connp->conn_ht_iphc_allocated +
2942 tcps->tcps_wroff_xtra;
2943 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2944 connp->conn_wroff);
2945 }
2946 return (0);
2947 }
2948
2949 /*
2950 * tcp_rwnd_set() is called to adjust the receive window to a desired value.
2951 * We do not allow the receive window to shrink. After setting rwnd,
2952 * set the flow control hiwat of the stream.
2953 *
2954 * This function is called in 2 cases:
2955 *
2956 * 1) Before data transfer begins, in tcp_input_listener() for accepting a
2957 * connection (passive open) and in tcp_input_data() for active connect.
2958 * This is called after tcp_mss_set() when the desired MSS value is known.
2959 * This makes sure that our window size is a mutiple of the other side's
2960 * MSS.
2961 * 2) Handling SO_RCVBUF option.
2962 *
2963 * It is ASSUMED that the requested size is a multiple of the current MSS.
2964 *
2965 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the
2966 * user requests so.
2967 */
2968 int
2969 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd)
2970 {
2971 uint32_t mss = tcp->tcp_mss;
2972 uint32_t old_max_rwnd;
2973 uint32_t max_transmittable_rwnd;
2974 boolean_t tcp_detached = TCP_IS_DETACHED(tcp);
2975 tcp_stack_t *tcps = tcp->tcp_tcps;
2976 conn_t *connp = tcp->tcp_connp;
2977
2978 /*
2979 * Insist on a receive window that is at least
2980 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid
2981 * funny TCP interactions of Nagle algorithm, SWS avoidance
2982 * and delayed acknowledgement.
2983 */
2984 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss);
2985
2986 if (tcp->tcp_fused) {
2987 size_t sth_hiwat;
2988 tcp_t *peer_tcp = tcp->tcp_loopback_peer;
2989
2990 ASSERT(peer_tcp != NULL);
2991 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd);
2992 if (!tcp_detached) {
2993 (void) proto_set_rx_hiwat(connp->conn_rq, connp,
2994 sth_hiwat);
2995 tcp_set_recv_threshold(tcp, sth_hiwat >> 3);
2996 }
2997
2998 /* Caller could have changed tcp_rwnd; update tha_win */
2999 if (tcp->tcp_tcpha != NULL) {
3000 tcp->tcp_tcpha->tha_win =
3001 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3002 }
3003 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3004 tcp->tcp_cwnd_max = rwnd;
3005
3006 /*
3007 * In the fusion case, the maxpsz stream head value of
3008 * our peer is set according to its send buffer size
3009 * and our receive buffer size; since the latter may
3010 * have changed we need to update the peer's maxpsz.
3011 */
3012 (void) tcp_maxpsz_set(peer_tcp, B_TRUE);
3013 return (sth_hiwat);
3014 }
3015
3016 if (tcp_detached)
3017 old_max_rwnd = tcp->tcp_rwnd;
3018 else
3019 old_max_rwnd = connp->conn_rcvbuf;
3020
3021
3022 /*
3023 * If window size info has already been exchanged, TCP should not
3024 * shrink the window. Shrinking window is doable if done carefully.
3025 * We may add that support later. But so far there is not a real
3026 * need to do that.
3027 */
3028 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) {
3029 /* MSS may have changed, do a round up again. */
3030 rwnd = MSS_ROUNDUP(old_max_rwnd, mss);
3031 }
3032
3033 /*
3034 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check
3035 * can be applied even before the window scale option is decided.
3036 */
3037 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws;
3038 if (rwnd > max_transmittable_rwnd) {
3039 rwnd = max_transmittable_rwnd -
3040 (max_transmittable_rwnd % mss);
3041 if (rwnd < mss)
3042 rwnd = max_transmittable_rwnd;
3043 /*
3044 * If we're over the limit we may have to back down tcp_rwnd.
3045 * The increment below won't work for us. So we set all three
3046 * here and the increment below will have no effect.
3047 */
3048 tcp->tcp_rwnd = old_max_rwnd = rwnd;
3049 }
3050 if (tcp->tcp_localnet) {
3051 tcp->tcp_rack_abs_max =
3052 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2);
3053 } else {
3054 /*
3055 * For a remote host on a different subnet (through a router),
3056 * we ack every other packet to be conforming to RFC1122.
3057 * tcp_deferred_acks_max is default to 2.
3058 */
3059 tcp->tcp_rack_abs_max =
3060 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2);
3061 }
3062 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max)
3063 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
3064 else
3065 tcp->tcp_rack_cur_max = 0;
3066 /*
3067 * Increment the current rwnd by the amount the maximum grew (we
3068 * can not overwrite it since we might be in the middle of a
3069 * connection.)
3070 */
3071 tcp->tcp_rwnd += rwnd - old_max_rwnd;
3072 connp->conn_rcvbuf = rwnd;
3073
3074 /* Are we already connected? */
3075 if (tcp->tcp_tcpha != NULL) {
3076 tcp->tcp_tcpha->tha_win =
3077 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
3078 }
3079
3080 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max)
3081 tcp->tcp_cwnd_max = rwnd;
3082
3083 if (tcp_detached)
3084 return (rwnd);
3085
3086 tcp_set_recv_threshold(tcp, rwnd >> 3);
3087
3088 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd);
3089 return (rwnd);
3090 }
3091
3092 int
3093 tcp_do_unbind(conn_t *connp)
3094 {
3095 tcp_t *tcp = connp->conn_tcp;
3096 int32_t oldstate;
3097
3098 switch (tcp->tcp_state) {
3099 case TCPS_BOUND:
3100 case TCPS_LISTEN:
3101 break;
3102 default:
3103 return (-TOUTSTATE);
3104 }
3105
3106 /*
3107 * Need to clean up all the eagers since after the unbind, segments
3108 * will no longer be delivered to this listener stream.
3109 */
3110 mutex_enter(&tcp->tcp_eager_lock);
3111 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) {
3112 tcp_eager_cleanup(tcp, 0);
3113 }
3114 mutex_exit(&tcp->tcp_eager_lock);
3115
3116 /* Clean up the listener connection counter if necessary. */
3117 if (tcp->tcp_listen_cnt != NULL)
3118 TCP_DECR_LISTEN_CNT(tcp);
3119 connp->conn_laddr_v6 = ipv6_all_zeros;
3120 connp->conn_saddr_v6 = ipv6_all_zeros;
3121 tcp_bind_hash_remove(tcp);
3122 oldstate = tcp->tcp_state;
3123 tcp->tcp_state = TCPS_IDLE;
3124 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3125 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3126 int32_t, oldstate);
3127
3128 ip_unbind(connp);
3129 bzero(&connp->conn_ports, sizeof (connp->conn_ports));
3130
3131 return (0);
3132 }
3133
3134 /*
3135 * Collect protocol properties to send to the upper handle.
3136 */
3137 void
3138 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp)
3139 {
3140 conn_t *connp = tcp->tcp_connp;
3141
3142 sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF;
3143 sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE);
3144
3145 sopp->sopp_rxhiwat = tcp->tcp_fused ?
3146 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) :
3147 connp->conn_rcvbuf;
3148 /*
3149 * Determine what write offset value to use depending on SACK and
3150 * whether the endpoint is fused or not.
3151 */
3152 if (tcp->tcp_fused) {
3153 ASSERT(tcp->tcp_loopback);
3154 ASSERT(tcp->tcp_loopback_peer != NULL);
3155 /*
3156 * For fused tcp loopback, set the stream head's write
3157 * offset value to zero since we won't be needing any room
3158 * for TCP/IP headers. This would also improve performance
3159 * since it would reduce the amount of work done by kmem.
3160 * Non-fused tcp loopback case is handled separately below.
3161 */
3162 sopp->sopp_wroff = 0;
3163 /*
3164 * Update the peer's transmit parameters according to
3165 * our recently calculated high water mark value.
3166 */
3167 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE);
3168 } else if (tcp->tcp_snd_sack_ok) {
3169 sopp->sopp_wroff = connp->conn_ht_iphc_allocated +
3170 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3171 } else {
3172 sopp->sopp_wroff = connp->conn_ht_iphc_len +
3173 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra);
3174 }
3175
3176 if (tcp->tcp_loopback) {
3177 sopp->sopp_flags |= SOCKOPT_LOOPBACK;
3178 sopp->sopp_loopback = B_TRUE;
3179 }
3180 }
3181
3182 /*
3183 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP.
3184 */
3185 boolean_t
3186 tcp_zcopy_check(tcp_t *tcp)
3187 {
3188 conn_t *connp = tcp->tcp_connp;
3189 ip_xmit_attr_t *ixa = connp->conn_ixa;
3190 boolean_t zc_enabled = B_FALSE;
3191 tcp_stack_t *tcps = tcp->tcp_tcps;
3192
3193 if (do_tcpzcopy == 2)
3194 zc_enabled = B_TRUE;
3195 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB))
3196 zc_enabled = B_TRUE;
3197
3198 tcp->tcp_snd_zcopy_on = zc_enabled;
3199 if (!TCP_IS_DETACHED(tcp)) {
3200 if (zc_enabled) {
3201 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY;
3202 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3203 ZCVMSAFE);
3204 TCP_STAT(tcps, tcp_zcopy_on);
3205 } else {
3206 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY;
3207 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3208 ZCVMUNSAFE);
3209 TCP_STAT(tcps, tcp_zcopy_off);
3210 }
3211 }
3212 return (zc_enabled);
3213 }
3214
3215 /*
3216 * Backoff from a zero-copy message by copying data to a new allocated
3217 * message and freeing the original desballoca'ed segmapped message.
3218 *
3219 * This function is called by following two callers:
3220 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free
3221 * the origial desballoca'ed message and notify sockfs. This is in re-
3222 * transmit state.
3223 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need
3224 * to be copied to new message.
3225 */
3226 mblk_t *
3227 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist)
3228 {
3229 mblk_t *nbp;
3230 mblk_t *head = NULL;
3231 mblk_t *tail = NULL;
3232 tcp_stack_t *tcps = tcp->tcp_tcps;
3233
3234 ASSERT(bp != NULL);
3235 while (bp != NULL) {
3236 if (IS_VMLOANED_MBLK(bp)) {
3237 TCP_STAT(tcps, tcp_zcopy_backoff);
3238 if ((nbp = copyb(bp)) == NULL) {
3239 tcp->tcp_xmit_zc_clean = B_FALSE;
3240 if (tail != NULL)
3241 tail->b_cont = bp;
3242 return ((head == NULL) ? bp : head);
3243 }
3244
3245 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) {
3246 if (fix_xmitlist)
3247 tcp_zcopy_notify(tcp);
3248 else
3249 nbp->b_datap->db_struioflag |=
3250 STRUIO_ZCNOTIFY;
3251 }
3252 nbp->b_cont = bp->b_cont;
3253
3254 /*
3255 * Copy saved information and adjust tcp_xmit_tail
3256 * if needed.
3257 */
3258 if (fix_xmitlist) {
3259 nbp->b_prev = bp->b_prev;
3260 nbp->b_next = bp->b_next;
3261
3262 if (tcp->tcp_xmit_tail == bp)
3263 tcp->tcp_xmit_tail = nbp;
3264 }
3265
3266 /* Free the original message. */
3267 bp->b_prev = NULL;
3268 bp->b_next = NULL;
3269 freeb(bp);
3270
3271 bp = nbp;
3272 }
3273
3274 if (head == NULL) {
3275 head = bp;
3276 }
3277 if (tail == NULL) {
3278 tail = bp;
3279 } else {
3280 tail->b_cont = bp;
3281 tail = bp;
3282 }
3283
3284 /* Move forward. */
3285 bp = bp->b_cont;
3286 }
3287
3288 if (fix_xmitlist) {
3289 tcp->tcp_xmit_last = tail;
3290 tcp->tcp_xmit_zc_clean = B_TRUE;
3291 }
3292
3293 return (head);
3294 }
3295
3296 void
3297 tcp_zcopy_notify(tcp_t *tcp)
3298 {
3299 struct stdata *stp;
3300 conn_t *connp;
3301
3302 if (tcp->tcp_detached)
3303 return;
3304 connp = tcp->tcp_connp;
3305 if (IPCL_IS_NONSTR(connp)) {
3306 (*connp->conn_upcalls->su_zcopy_notify)
3307 (connp->conn_upper_handle);
3308 return;
3309 }
3310 stp = STREAM(connp->conn_rq);
3311 mutex_enter(&stp->sd_lock);
3312 stp->sd_flag |= STZCNOTIFY;
3313 cv_broadcast(&stp->sd_zcopy_wait);
3314 mutex_exit(&stp->sd_lock);
3315 }
3316
3317 /*
3318 * Update the TCP connection according to change of LSO capability.
3319 */
3320 static void
3321 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa)
3322 {
3323 /*
3324 * We check against IPv4 header length to preserve the old behavior
3325 * of only enabling LSO when there are no IP options.
3326 * But this restriction might not be necessary at all. Before removing
3327 * it, need to verify how LSO is handled for source routing case, with
3328 * which IP does software checksum.
3329 *
3330 * For IPv6, whenever any extension header is needed, LSO is supressed.
3331 */
3332 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ?
3333 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN))
3334 return;
3335
3336 /*
3337 * Either the LSO capability newly became usable, or it has changed.
3338 */
3339 if (ixa->ixa_flags & IXAF_LSO_CAPAB) {
3340 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab;
3341
3342 ASSERT(lsoc->ill_lso_max > 0);
3343 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max);
3344
3345 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3346 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max);
3347
3348 /*
3349 * If LSO to be enabled, notify the STREAM header with larger
3350 * data block.
3351 */
3352 if (!tcp->tcp_lso)
3353 tcp->tcp_maxpsz_multiplier = 0;
3354
3355 tcp->tcp_lso = B_TRUE;
3356 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled);
3357 } else { /* LSO capability is not usable any more. */
3358 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso,
3359 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max);
3360
3361 /*
3362 * If LSO to be disabled, notify the STREAM header with smaller
3363 * data block. And need to restore fragsize to PMTU.
3364 */
3365 if (tcp->tcp_lso) {
3366 tcp->tcp_maxpsz_multiplier =
3367 tcp->tcp_tcps->tcps_maxpsz_multiplier;
3368 ixa->ixa_fragsize = ixa->ixa_pmtu;
3369 tcp->tcp_lso = B_FALSE;
3370 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled);
3371 }
3372 }
3373
3374 (void) tcp_maxpsz_set(tcp, B_TRUE);
3375 }
3376
3377 /*
3378 * Update the TCP connection according to change of ZEROCOPY capability.
3379 */
3380 static void
3381 tcp_update_zcopy(tcp_t *tcp)
3382 {
3383 conn_t *connp = tcp->tcp_connp;
3384 tcp_stack_t *tcps = tcp->tcp_tcps;
3385
3386 if (tcp->tcp_snd_zcopy_on) {
3387 tcp->tcp_snd_zcopy_on = B_FALSE;
3388 if (!TCP_IS_DETACHED(tcp)) {
3389 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3390 ZCVMUNSAFE);
3391 TCP_STAT(tcps, tcp_zcopy_off);
3392 }
3393 } else {
3394 tcp->tcp_snd_zcopy_on = B_TRUE;
3395 if (!TCP_IS_DETACHED(tcp)) {
3396 (void) proto_set_tx_copyopt(connp->conn_rq, connp,
3397 ZCVMSAFE);
3398 TCP_STAT(tcps, tcp_zcopy_on);
3399 }
3400 }
3401 }
3402
3403 /*
3404 * Notify function registered with ip_xmit_attr_t. It's called in the squeue
3405 * so it's safe to update the TCP connection.
3406 */
3407 /* ARGSUSED1 */
3408 static void
3409 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype,
3410 ixa_notify_arg_t narg)
3411 {
3412 tcp_t *tcp = (tcp_t *)arg;
3413 conn_t *connp = tcp->tcp_connp;
3414
3415 switch (ntype) {
3416 case IXAN_LSO:
3417 tcp_update_lso(tcp, connp->conn_ixa);
3418 break;
3419 case IXAN_PMTU:
3420 (void) tcp_update_pmtu(tcp, B_FALSE);
3421 break;
3422 case IXAN_ZCOPY:
3423 tcp_update_zcopy(tcp);
3424 break;
3425 default:
3426 break;
3427 }
3428 }
3429
3430 /*
3431 * The TCP write service routine should never be called...
3432 */
3433 /* ARGSUSED */
3434 static void
3435 tcp_wsrv(queue_t *q)
3436 {
3437 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps;
3438
3439 TCP_STAT(tcps, tcp_wsrv_called);
3440 }
3441
3442 /*
3443 * Hash list lookup routine for tcp_t structures.
3444 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF.
3445 */
3446 tcp_t *
3447 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps)
3448 {
3449 tf_t *tf;
3450 tcp_t *tcp;
3451
3452 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3453 mutex_enter(&tf->tf_lock);
3454 for (tcp = tf->tf_tcp; tcp != NULL;
3455 tcp = tcp->tcp_acceptor_hash) {
3456 if (tcp->tcp_acceptor_id == id) {
3457 CONN_INC_REF(tcp->tcp_connp);
3458 mutex_exit(&tf->tf_lock);
3459 return (tcp);
3460 }
3461 }
3462 mutex_exit(&tf->tf_lock);
3463 return (NULL);
3464 }
3465
3466 /*
3467 * Hash list insertion routine for tcp_t structures.
3468 */
3469 void
3470 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp)
3471 {
3472 tf_t *tf;
3473 tcp_t **tcpp;
3474 tcp_t *tcpnext;
3475 tcp_stack_t *tcps = tcp->tcp_tcps;
3476
3477 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)];
3478
3479 if (tcp->tcp_ptpahn != NULL)
3480 tcp_acceptor_hash_remove(tcp);
3481 tcpp = &tf->tf_tcp;
3482 mutex_enter(&tf->tf_lock);
3483 tcpnext = tcpp[0];
3484 if (tcpnext)
3485 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash;
3486 tcp->tcp_acceptor_hash = tcpnext;
3487 tcp->tcp_ptpahn = tcpp;
3488 tcpp[0] = tcp;
3489 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */
3490 mutex_exit(&tf->tf_lock);
3491 }
3492
3493 /*
3494 * Hash list removal routine for tcp_t structures.
3495 */
3496 void
3497 tcp_acceptor_hash_remove(tcp_t *tcp)
3498 {
3499 tcp_t *tcpnext;
3500 kmutex_t *lockp;
3501
3502 /*
3503 * Extract the lock pointer in case there are concurrent
3504 * hash_remove's for this instance.
3505 */
3506 lockp = tcp->tcp_acceptor_lockp;
3507
3508 if (tcp->tcp_ptpahn == NULL)
3509 return;
3510
3511 ASSERT(lockp != NULL);
3512 mutex_enter(lockp);
3513 if (tcp->tcp_ptpahn) {
3514 tcpnext = tcp->tcp_acceptor_hash;
3515 if (tcpnext) {
3516 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn;
3517 tcp->tcp_acceptor_hash = NULL;
3518 }
3519 *tcp->tcp_ptpahn = tcpnext;
3520 tcp->tcp_ptpahn = NULL;
3521 }
3522 mutex_exit(lockp);
3523 tcp->tcp_acceptor_lockp = NULL;
3524 }
3525
3526 /*
3527 * Type three generator adapted from the random() function in 4.4 BSD:
3528 */
3529
3530 /*
3531 * Copyright (c) 1983, 1993
3532 * The Regents of the University of California. All rights reserved.
3533 *
3534 * Redistribution and use in source and binary forms, with or without
3535 * modification, are permitted provided that the following conditions
3536 * are met:
3537 * 1. Redistributions of source code must retain the above copyright
3538 * notice, this list of conditions and the following disclaimer.
3539 * 2. Redistributions in binary form must reproduce the above copyright
3540 * notice, this list of conditions and the following disclaimer in the
3541 * documentation and/or other materials provided with the distribution.
3542 * 3. All advertising materials mentioning features or use of this software
3543 * must display the following acknowledgement:
3544 * This product includes software developed by the University of
3545 * California, Berkeley and its contributors.
3546 * 4. Neither the name of the University nor the names of its contributors
3547 * may be used to endorse or promote products derived from this software
3548 * without specific prior written permission.
3549 *
3550 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
3551 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
3552 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
3553 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
3554 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
3555 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
3556 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
3557 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
3558 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
3559 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
3560 * SUCH DAMAGE.
3561 */
3562
3563 /* Type 3 -- x**31 + x**3 + 1 */
3564 #define DEG_3 31
3565 #define SEP_3 3
3566
3567
3568 /* Protected by tcp_random_lock */
3569 static int tcp_randtbl[DEG_3 + 1];
3570
3571 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1];
3572 static int *tcp_random_rptr = &tcp_randtbl[1];
3573
3574 static int *tcp_random_state = &tcp_randtbl[1];
3575 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1];
3576
3577 kmutex_t tcp_random_lock;
3578
3579 void
3580 tcp_random_init(void)
3581 {
3582 int i;
3583 hrtime_t hrt;
3584 time_t wallclock;
3585 uint64_t result;
3586
3587 /*
3588 * Use high-res timer and current time for seed. Gethrtime() returns
3589 * a longlong, which may contain resolution down to nanoseconds.
3590 * The current time will either be a 32-bit or a 64-bit quantity.
3591 * XOR the two together in a 64-bit result variable.
3592 * Convert the result to a 32-bit value by multiplying the high-order
3593 * 32-bits by the low-order 32-bits.
3594 */
3595
3596 hrt = gethrtime();
3597 (void) drv_getparm(TIME, &wallclock);
3598 result = (uint64_t)wallclock ^ (uint64_t)hrt;
3599 mutex_enter(&tcp_random_lock);
3600 tcp_random_state[0] = ((result >> 32) & 0xffffffff) *
3601 (result & 0xffffffff);
3602
3603 for (i = 1; i < DEG_3; i++)
3604 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1]
3605 + 12345;
3606 tcp_random_fptr = &tcp_random_state[SEP_3];
3607 tcp_random_rptr = &tcp_random_state[0];
3608 mutex_exit(&tcp_random_lock);
3609 for (i = 0; i < 10 * DEG_3; i++)
3610 (void) tcp_random();
3611 }
3612
3613 /*
3614 * tcp_random: Return a random number in the range [1 - (128K + 1)].
3615 * This range is selected to be approximately centered on TCP_ISS / 2,
3616 * and easy to compute. We get this value by generating a 32-bit random
3617 * number, selecting out the high-order 17 bits, and then adding one so
3618 * that we never return zero.
3619 */
3620 int
3621 tcp_random(void)
3622 {
3623 int i;
3624
3625 mutex_enter(&tcp_random_lock);
3626 *tcp_random_fptr += *tcp_random_rptr;
3627
3628 /*
3629 * The high-order bits are more random than the low-order bits,
3630 * so we select out the high-order 17 bits and add one so that
3631 * we never return zero.
3632 */
3633 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1;
3634 if (++tcp_random_fptr >= tcp_random_end_ptr) {
3635 tcp_random_fptr = tcp_random_state;
3636 ++tcp_random_rptr;
3637 } else if (++tcp_random_rptr >= tcp_random_end_ptr)
3638 tcp_random_rptr = tcp_random_state;
3639
3640 mutex_exit(&tcp_random_lock);
3641 return (i);
3642 }
3643
3644 /*
3645 * Split this function out so that if the secret changes, I'm okay.
3646 *
3647 * Initialize the tcp_iss_cookie and tcp_iss_key.
3648 */
3649
3650 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */
3651
3652 void
3653 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps)
3654 {
3655 struct {
3656 int32_t current_time;
3657 uint32_t randnum;
3658 uint16_t pad;
3659 uint8_t ether[6];
3660 uint8_t passwd[PASSWD_SIZE];
3661 } tcp_iss_cookie;
3662 time_t t;
3663
3664 /*
3665 * Start with the current absolute time.
3666 */
3667 (void) drv_getparm(TIME, &t);
3668 tcp_iss_cookie.current_time = t;
3669
3670 /*
3671 * XXX - Need a more random number per RFC 1750, not this crap.
3672 * OTOH, if what follows is pretty random, then I'm in better shape.
3673 */
3674 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random());
3675 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */
3676
3677 /*
3678 * The cpu_type_info is pretty non-random. Ugggh. It does serve
3679 * as a good template.
3680 */
3681 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd,
3682 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info)));
3683
3684 /*
3685 * The pass-phrase. Normally this is supplied by user-called NDD.
3686 */
3687 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len));
3688
3689 /*
3690 * See 4010593 if this section becomes a problem again,
3691 * but the local ethernet address is useful here.
3692 */
3693 (void) localetheraddr(NULL,
3694 (struct ether_addr *)&tcp_iss_cookie.ether);
3695
3696 /*
3697 * Hash 'em all together. The MD5Final is called per-connection.
3698 */
3699 mutex_enter(&tcps->tcps_iss_key_lock);
3700 MD5Init(&tcps->tcps_iss_key);
3701 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie,
3702 sizeof (tcp_iss_cookie));
3703 mutex_exit(&tcps->tcps_iss_key_lock);
3704 }
3705
3706 /*
3707 * Called by IP when IP is loaded into the kernel
3708 */
3709 void
3710 tcp_ddi_g_init(void)
3711 {
3712 tcp_timercache = kmem_cache_create("tcp_timercache",
3713 sizeof (tcp_timer_t) + sizeof (mblk_t), 0,
3714 NULL, NULL, NULL, NULL, NULL, 0);
3715
3716 tcp_notsack_blk_cache = kmem_cache_create("tcp_notsack_blk_cache",
3717 sizeof (notsack_blk_t), 0, NULL, NULL, NULL, NULL, NULL, 0);
3718
3719 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL);
3720
3721 /* Initialize the random number generator */
3722 tcp_random_init();
3723
3724 /* A single callback independently of how many netstacks we have */
3725 ip_squeue_init(tcp_squeue_add);
3726
3727 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics);
3728
3729 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput);
3730
3731 /*
3732 * We want to be informed each time a stack is created or
3733 * destroyed in the kernel, so we can maintain the
3734 * set of tcp_stack_t's.
3735 */
3736 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini);
3737 }
3738
3739
3740 #define INET_NAME "ip"
3741
3742 /*
3743 * Initialize the TCP stack instance.
3744 */
3745 static void *
3746 tcp_stack_init(netstackid_t stackid, netstack_t *ns)
3747 {
3748 tcp_stack_t *tcps;
3749 int i;
3750 major_t major;
3751 size_t arrsz;
3752
3753 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP);
3754 tcps->tcps_netstack = ns;
3755
3756 /* Initialize locks */
3757 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL);
3758 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL);
3759
3760 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS;
3761 tcps->tcps_g_epriv_ports[0] = ULP_DEF_EPRIV_PORT1;
3762 tcps->tcps_g_epriv_ports[1] = ULP_DEF_EPRIV_PORT2;
3763 tcps->tcps_min_anonpriv_port = 512;
3764
3765 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) *
3766 TCP_BIND_FANOUT_SIZE, KM_SLEEP);
3767 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) *
3768 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP);
3769
3770 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3771 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL,
3772 MUTEX_DEFAULT, NULL);
3773 }
3774
3775 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3776 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL,
3777 MUTEX_DEFAULT, NULL);
3778 }
3779
3780 /* TCP's IPsec code calls the packet dropper. */
3781 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement");
3782
3783 arrsz = tcp_propinfo_count * sizeof (mod_prop_info_t);
3784 tcps->tcps_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz,
3785 KM_SLEEP);
3786 bcopy(tcp_propinfo_tbl, tcps->tcps_propinfo_tbl, arrsz);
3787
3788 /*
3789 * Note: To really walk the device tree you need the devinfo
3790 * pointer to your device which is only available after probe/attach.
3791 * The following is safe only because it uses ddi_root_node()
3792 */
3793 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr,
3794 tcp_opt_obj.odb_opt_arr_cnt);
3795
3796 /*
3797 * Initialize RFC 1948 secret values. This will probably be reset once
3798 * by the boot scripts.
3799 *
3800 * Use NULL name, as the name is caught by the new lockstats.
3801 *
3802 * Initialize with some random, non-guessable string, like the global
3803 * T_INFO_ACK.
3804 */
3805
3806 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack,
3807 sizeof (tcp_g_t_info_ack), tcps);
3808
3809 tcps->tcps_kstat = tcp_kstat2_init(stackid);
3810 tcps->tcps_mibkp = tcp_kstat_init(stackid);
3811
3812 major = mod_name_to_major(INET_NAME);
3813 VERIFY0(ldi_ident_from_major(major, &tcps->tcps_ldi_ident));
3814 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL);
3815 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL);
3816 cv_init(&tcps->tcps_ixa_cleanup_ready_cv, NULL, CV_DEFAULT, NULL);
3817 cv_init(&tcps->tcps_ixa_cleanup_done_cv, NULL, CV_DEFAULT, NULL);
3818 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL);
3819
3820 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL);
3821 tcps->tcps_reclaim = B_FALSE;
3822 tcps->tcps_reclaim_tid = 0;
3823 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max;
3824
3825 /*
3826 * ncpus is the current number of CPUs, which can be bigger than
3827 * boot_ncpus. But we don't want to use ncpus to allocate all the
3828 * tcp_stats_cpu_t at system boot up time since it will be 1. While
3829 * we handle adding CPU in tcp_cpu_update(), it will be slow if
3830 * there are many CPUs as we will be adding them 1 by 1.
3831 *
3832 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers
3833 * are not freed until the stack is going away. So there is no need
3834 * to grab a lock to access the per CPU tcps_sc[x] pointer.
3835 */
3836 mutex_enter(&cpu_lock);
3837 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus);
3838 mutex_exit(&cpu_lock);
3839 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *),
3840 KM_SLEEP);
3841 for (i = 0; i < tcps->tcps_sc_cnt; i++) {
3842 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t),
3843 KM_SLEEP);
3844 }
3845
3846 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL);
3847 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t),
3848 offsetof(tcp_listener_t, tl_link));
3849
3850 return (tcps);
3851 }
3852
3853 /*
3854 * Called when the IP module is about to be unloaded.
3855 */
3856 void
3857 tcp_ddi_g_destroy(void)
3858 {
3859 tcp_g_kstat_fini(tcp_g_kstat);
3860 tcp_g_kstat = NULL;
3861 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics));
3862
3863 mutex_destroy(&tcp_random_lock);
3864
3865 kmem_cache_destroy(tcp_timercache);
3866 kmem_cache_destroy(tcp_notsack_blk_cache);
3867
3868 netstack_unregister(NS_TCP);
3869 }
3870
3871 /*
3872 * Free the TCP stack instance.
3873 */
3874 static void
3875 tcp_stack_fini(netstackid_t stackid, void *arg)
3876 {
3877 tcp_stack_t *tcps = (tcp_stack_t *)arg;
3878 int i;
3879
3880 freeb(tcps->tcps_ixa_cleanup_mp);
3881 tcps->tcps_ixa_cleanup_mp = NULL;
3882 cv_destroy(&tcps->tcps_ixa_cleanup_ready_cv);
3883 cv_destroy(&tcps->tcps_ixa_cleanup_done_cv);
3884 mutex_destroy(&tcps->tcps_ixa_cleanup_lock);
3885
3886 /*
3887 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart
3888 * the timer.
3889 */
3890 mutex_enter(&tcps->tcps_reclaim_lock);
3891 tcps->tcps_reclaim = B_FALSE;
3892 mutex_exit(&tcps->tcps_reclaim_lock);
3893 if (tcps->tcps_reclaim_tid != 0)
3894 (void) untimeout(tcps->tcps_reclaim_tid);
3895 mutex_destroy(&tcps->tcps_reclaim_lock);
3896
3897 tcp_listener_conf_cleanup(tcps);
3898
3899 for (i = 0; i < tcps->tcps_sc_cnt; i++)
3900 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t));
3901 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *));
3902
3903 kmem_free(tcps->tcps_propinfo_tbl,
3904 tcp_propinfo_count * sizeof (mod_prop_info_t));
3905 tcps->tcps_propinfo_tbl = NULL;
3906
3907 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) {
3908 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL);
3909 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock);
3910 }
3911
3912 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) {
3913 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL);
3914 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock);
3915 }
3916
3917 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE);
3918 tcps->tcps_bind_fanout = NULL;
3919
3920 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) *
3921 TCP_ACCEPTOR_FANOUT_SIZE);
3922 tcps->tcps_acceptor_fanout = NULL;
3923
3924 mutex_destroy(&tcps->tcps_iss_key_lock);
3925 mutex_destroy(&tcps->tcps_epriv_port_lock);
3926
3927 ip_drop_unregister(&tcps->tcps_dropper);
3928
3929 tcp_kstat2_fini(stackid, tcps->tcps_kstat);
3930 tcps->tcps_kstat = NULL;
3931
3932 tcp_kstat_fini(stackid, tcps->tcps_mibkp);
3933 tcps->tcps_mibkp = NULL;
3934
3935 ldi_ident_release(tcps->tcps_ldi_ident);
3936 kmem_free(tcps, sizeof (*tcps));
3937 }
3938
3939 /*
3940 * Generate ISS, taking into account NDD changes may happen halfway through.
3941 * (If the iss is not zero, set it.)
3942 */
3943
3944 static void
3945 tcp_iss_init(tcp_t *tcp)
3946 {
3947 MD5_CTX context;
3948 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg;
3949 uint32_t answer[4];
3950 tcp_stack_t *tcps = tcp->tcp_tcps;
3951 conn_t *connp = tcp->tcp_connp;
3952
3953 tcps->tcps_iss_incr_extra += (tcps->tcps_iss_incr >> 1);
3954 tcp->tcp_iss = tcps->tcps_iss_incr_extra;
3955 switch (tcps->tcps_strong_iss) {
3956 case 2:
3957 mutex_enter(&tcps->tcps_iss_key_lock);
3958 context = tcps->tcps_iss_key;
3959 mutex_exit(&tcps->tcps_iss_key_lock);
3960 arg.ports = connp->conn_ports;
3961 arg.src = connp->conn_laddr_v6;
3962 arg.dst = connp->conn_faddr_v6;
3963 MD5Update(&context, (uchar_t *)&arg, sizeof (arg));
3964 MD5Final((uchar_t *)answer, &context);
3965 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3];
3966 /*
3967 * Now that we've hashed into a unique per-connection sequence
3968 * space, add a random increment per strong_iss == 1. So I
3969 * guess we'll have to...
3970 */
3971 /* FALLTHRU */
3972 case 1:
3973 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random();
3974 break;
3975 default:
3976 tcp->tcp_iss += (uint32_t)gethrestime_sec() *
3977 tcps->tcps_iss_incr;
3978 break;
3979 }
3980 tcp->tcp_valid_bits = TCP_ISS_VALID;
3981 tcp->tcp_fss = tcp->tcp_iss - 1;
3982 tcp->tcp_suna = tcp->tcp_iss;
3983 tcp->tcp_snxt = tcp->tcp_iss + 1;
3984 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3985 tcp->tcp_csuna = tcp->tcp_snxt;
3986 }
3987
3988 /*
3989 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL
3990 * on the specified backing STREAMS q. Note, the caller may make the
3991 * decision to call based on the tcp_t.tcp_flow_stopped value which
3992 * when check outside the q's lock is only an advisory check ...
3993 */
3994 void
3995 tcp_setqfull(tcp_t *tcp)
3996 {
3997 tcp_stack_t *tcps = tcp->tcp_tcps;
3998 conn_t *connp = tcp->tcp_connp;
3999
4000 if (tcp->tcp_closed)
4001 return;
4002
4003 conn_setqfull(connp, &tcp->tcp_flow_stopped);
4004 if (tcp->tcp_flow_stopped)
4005 TCP_STAT(tcps, tcp_flwctl_on);
4006 }
4007
4008 void
4009 tcp_clrqfull(tcp_t *tcp)
4010 {
4011 conn_t *connp = tcp->tcp_connp;
4012
4013 if (tcp->tcp_closed)
4014 return;
4015 conn_clrqfull(connp, &tcp->tcp_flow_stopped);
4016 }
4017
4018 static int
4019 tcp_squeue_switch(int val)
4020 {
4021 int rval = SQ_FILL;
4022
4023 switch (val) {
4024 case 1:
4025 rval = SQ_NODRAIN;
4026 break;
4027 case 2:
4028 rval = SQ_PROCESS;
4029 break;
4030 default:
4031 break;
4032 }
4033 return (rval);
4034 }
4035
4036 /*
4037 * This is called once for each squeue - globally for all stack
4038 * instances.
4039 */
4040 static void
4041 tcp_squeue_add(squeue_t *sqp)
4042 {
4043 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc(
4044 sizeof (tcp_squeue_priv_t), KM_SLEEP);
4045
4046 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait;
4047 if (tcp_free_list_max_cnt == 0) {
4048 int tcp_ncpus = ((boot_max_ncpus == -1) ?
4049 max_ncpus : boot_max_ncpus);
4050
4051 /*
4052 * Limit number of entries to 1% of availble memory / tcp_ncpus
4053 */
4054 tcp_free_list_max_cnt = (freemem * PAGESIZE) /
4055 (tcp_ncpus * sizeof (tcp_t) * 100);
4056 }
4057 tcp_time_wait->tcp_free_list_cnt = 0;
4058 }
4059 /*
4060 * Return unix error is tli error is TSYSERR, otherwise return a negative
4061 * tli error.
4062 */
4063 int
4064 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr,
4065 boolean_t bind_to_req_port_only)
4066 {
4067 int error;
4068 tcp_t *tcp = connp->conn_tcp;
4069
4070 if (tcp->tcp_state >= TCPS_BOUND) {
4071 if (connp->conn_debug) {
4072 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4073 "tcp_bind: bad state, %d", tcp->tcp_state);
4074 }
4075 return (-TOUTSTATE);
4076 }
4077
4078 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only);
4079 if (error != 0)
4080 return (error);
4081
4082 ASSERT(tcp->tcp_state == TCPS_BOUND);
4083 tcp->tcp_conn_req_max = 0;
4084 return (0);
4085 }
4086
4087 /*
4088 * If the return value from this function is positive, it's a UNIX error.
4089 * Otherwise, if it's negative, then the absolute value is a TLI error.
4090 * the TPI routine tcp_tpi_connect() is a wrapper function for this.
4091 */
4092 int
4093 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len,
4094 cred_t *cr, pid_t pid)
4095 {
4096 tcp_t *tcp = connp->conn_tcp;
4097 sin_t *sin = (sin_t *)sa;
4098 sin6_t *sin6 = (sin6_t *)sa;
4099 ipaddr_t *dstaddrp;
4100 in_port_t dstport;
4101 uint_t srcid;
4102 int error;
4103 uint32_t mss;
4104 mblk_t *syn_mp;
4105 tcp_stack_t *tcps = tcp->tcp_tcps;
4106 int32_t oldstate;
4107 ip_xmit_attr_t *ixa = connp->conn_ixa;
4108
4109 oldstate = tcp->tcp_state;
4110
4111 switch (len) {
4112 default:
4113 /*
4114 * Should never happen
4115 */
4116 return (EINVAL);
4117
4118 case sizeof (sin_t):
4119 sin = (sin_t *)sa;
4120 if (sin->sin_port == 0) {
4121 return (-TBADADDR);
4122 }
4123 if (connp->conn_ipv6_v6only) {
4124 return (EAFNOSUPPORT);
4125 }
4126 break;
4127
4128 case sizeof (sin6_t):
4129 sin6 = (sin6_t *)sa;
4130 if (sin6->sin6_port == 0) {
4131 return (-TBADADDR);
4132 }
4133 break;
4134 }
4135 /*
4136 * If we're connecting to an IPv4-mapped IPv6 address, we need to
4137 * make sure that the conn_ipversion is IPV4_VERSION. We
4138 * need to this before we call tcp_bindi() so that the port lookup
4139 * code will look for ports in the correct port space (IPv4 and
4140 * IPv6 have separate port spaces).
4141 */
4142 if (connp->conn_family == AF_INET6 &&
4143 connp->conn_ipversion == IPV6_VERSION &&
4144 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4145 if (connp->conn_ipv6_v6only)
4146 return (EADDRNOTAVAIL);
4147
4148 connp->conn_ipversion = IPV4_VERSION;
4149 }
4150
4151 switch (tcp->tcp_state) {
4152 case TCPS_LISTEN:
4153 /*
4154 * Listening sockets are not allowed to issue connect().
4155 */
4156 if (IPCL_IS_NONSTR(connp))
4157 return (EOPNOTSUPP);
4158 /* FALLTHRU */
4159 case TCPS_IDLE:
4160 /*
4161 * We support quick connect, refer to comments in
4162 * tcp_connect_*()
4163 */
4164 /* FALLTHRU */
4165 case TCPS_BOUND:
4166 break;
4167 default:
4168 return (-TOUTSTATE);
4169 }
4170
4171 /*
4172 * We update our cred/cpid based on the caller of connect
4173 */
4174 if (connp->conn_cred != cr) {
4175 crhold(cr);
4176 crfree(connp->conn_cred);
4177 connp->conn_cred = cr;
4178 }
4179 connp->conn_cpid = pid;
4180
4181 /* Cache things in the ixa without any refhold */
4182 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED));
4183 ixa->ixa_cred = cr;
4184 ixa->ixa_cpid = pid;
4185 if (is_system_labeled()) {
4186 /* We need to restart with a label based on the cred */
4187 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred);
4188 }
4189
4190 if (connp->conn_family == AF_INET6) {
4191 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
4192 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr,
4193 sin6->sin6_port, sin6->sin6_flowinfo,
4194 sin6->__sin6_src_id, sin6->sin6_scope_id);
4195 } else {
4196 /*
4197 * Destination adress is mapped IPv6 address.
4198 * Source bound address should be unspecified or
4199 * IPv6 mapped address as well.
4200 */
4201 if (!IN6_IS_ADDR_UNSPECIFIED(
4202 &connp->conn_bound_addr_v6) &&
4203 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) {
4204 return (EADDRNOTAVAIL);
4205 }
4206 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr));
4207 dstport = sin6->sin6_port;
4208 srcid = sin6->__sin6_src_id;
4209 error = tcp_connect_ipv4(tcp, dstaddrp, dstport,
4210 srcid);
4211 }
4212 } else {
4213 dstaddrp = &sin->sin_addr.s_addr;
4214 dstport = sin->sin_port;
4215 srcid = 0;
4216 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid);
4217 }
4218
4219 if (error != 0)
4220 goto connect_failed;
4221
4222 CL_INET_CONNECT(connp, B_TRUE, error);
4223 if (error != 0)
4224 goto connect_failed;
4225
4226 /* connect succeeded */
4227 TCPS_BUMP_MIB(tcps, tcpActiveOpens);
4228 tcp->tcp_active_open = 1;
4229
4230 /*
4231 * tcp_set_destination() does not adjust for TCP/IP header length.
4232 */
4233 mss = tcp->tcp_mss - connp->conn_ht_iphc_len;
4234
4235 /*
4236 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up
4237 * to the nearest MSS.
4238 *
4239 * We do the round up here because we need to get the interface MTU
4240 * first before we can do the round up.
4241 */
4242 tcp->tcp_rwnd = connp->conn_rcvbuf;
4243 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss),
4244 tcps->tcps_recv_hiwat_minmss * mss);
4245 connp->conn_rcvbuf = tcp->tcp_rwnd;
4246 tcp_set_ws_value(tcp);
4247 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
4248 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always)
4249 tcp->tcp_snd_ws_ok = B_TRUE;
4250
4251 /*
4252 * Set tcp_snd_ts_ok to true
4253 * so that tcp_xmit_mp will
4254 * include the timestamp
4255 * option in the SYN segment.
4256 */
4257 if (tcps->tcps_tstamp_always ||
4258 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) {
4259 tcp->tcp_snd_ts_ok = B_TRUE;
4260 }
4261
4262 /*
4263 * Note that tcp_snd_sack_ok can be set in tcp_set_destination() if
4264 * the SACK metric is set. So here we just check the per stack SACK
4265 * permitted param.
4266 */
4267 if (tcps->tcps_sack_permitted == 2) {
4268 ASSERT(tcp->tcp_num_sack_blk == 0);
4269 ASSERT(tcp->tcp_notsack_list == NULL);
4270 tcp->tcp_snd_sack_ok = B_TRUE;
4271 }
4272
4273 /*
4274 * Should we use ECN? Note that the current
4275 * default value (SunOS 5.9) of tcp_ecn_permitted
4276 * is 1. The reason for doing this is that there
4277 * are equipments out there that will drop ECN
4278 * enabled IP packets. Setting it to 1 avoids
4279 * compatibility problems.
4280 */
4281 if (tcps->tcps_ecn_permitted == 2)
4282 tcp->tcp_ecn_ok = B_TRUE;
4283
4284 /* Trace change from BOUND -> SYN_SENT here */
4285 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4286 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4287 int32_t, TCPS_BOUND);
4288
4289 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4290 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL,
4291 tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
4292 if (syn_mp != NULL) {
4293 /*
4294 * We must bump the generation before sending the syn
4295 * to ensure that we use the right generation in case
4296 * this thread issues a "connected" up call.
4297 */
4298 SOCK_CONNID_BUMP(tcp->tcp_connid);
4299 /*
4300 * DTrace sending the first SYN as a
4301 * tcp:::connect-request event.
4302 */
4303 DTRACE_TCP5(connect__request, mblk_t *, NULL,
4304 ip_xmit_attr_t *, connp->conn_ixa,
4305 void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp,
4306 tcph_t *,
4307 &syn_mp->b_rptr[connp->conn_ixa->ixa_ip_hdr_length]);
4308 tcp_send_data(tcp, syn_mp);
4309 }
4310
4311 if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4312 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4313 return (0);
4314
4315 connect_failed:
4316 connp->conn_faddr_v6 = ipv6_all_zeros;
4317 connp->conn_fport = 0;
4318 tcp->tcp_state = oldstate;
4319 if (tcp->tcp_conn.tcp_opts_conn_req != NULL)
4320 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req);
4321 return (error);
4322 }
4323
4324 int
4325 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len,
4326 int backlog, cred_t *cr, boolean_t bind_to_req_port_only)
4327 {
4328 tcp_t *tcp = connp->conn_tcp;
4329 int error = 0;
4330 tcp_stack_t *tcps = tcp->tcp_tcps;
4331 int32_t oldstate;
4332
4333 /* All Solaris components should pass a cred for this operation. */
4334 ASSERT(cr != NULL);
4335
4336 if (tcp->tcp_state >= TCPS_BOUND) {
4337 if ((tcp->tcp_state == TCPS_BOUND ||
4338 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) {
4339 /*
4340 * Handle listen() increasing backlog.
4341 * This is more "liberal" then what the TPI spec
4342 * requires but is needed to avoid a t_unbind
4343 * when handling listen() since the port number
4344 * might be "stolen" between the unbind and bind.
4345 */
4346 goto do_listen;
4347 }
4348 if (connp->conn_debug) {
4349 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE,
4350 "tcp_listen: bad state, %d", tcp->tcp_state);
4351 }
4352 return (-TOUTSTATE);
4353 } else {
4354 if (sa == NULL) {
4355 sin6_t addr;
4356 sin_t *sin;
4357 sin6_t *sin6;
4358
4359 ASSERT(IPCL_IS_NONSTR(connp));
4360 /* Do an implicit bind: Request for a generic port. */
4361 if (connp->conn_family == AF_INET) {
4362 len = sizeof (sin_t);
4363 sin = (sin_t *)&addr;
4364 *sin = sin_null;
4365 sin->sin_family = AF_INET;
4366 } else {
4367 ASSERT(connp->conn_family == AF_INET6);
4368 len = sizeof (sin6_t);
4369 sin6 = (sin6_t *)&addr;
4370 *sin6 = sin6_null;
4371 sin6->sin6_family = AF_INET6;
4372 }
4373 sa = (struct sockaddr *)&addr;
4374 }
4375
4376 error = tcp_bind_check(connp, sa, len, cr,
4377 bind_to_req_port_only);
4378 if (error)
4379 return (error);
4380 /* Fall through and do the fanout insertion */
4381 }
4382
4383 do_listen:
4384 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN);
4385 tcp->tcp_conn_req_max = backlog;
4386 if (tcp->tcp_conn_req_max) {
4387 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min)
4388 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min;
4389 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q)
4390 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q;
4391 /*
4392 * If this is a listener, do not reset the eager list
4393 * and other stuffs. Note that we don't check if the
4394 * existing eager list meets the new tcp_conn_req_max
4395 * requirement.
4396 */
4397 if (tcp->tcp_state != TCPS_LISTEN) {
4398 tcp->tcp_state = TCPS_LISTEN;
4399 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4400 connp->conn_ixa, void, NULL, tcp_t *, tcp,
4401 void, NULL, int32_t, TCPS_BOUND);
4402 /* Initialize the chain. Don't need the eager_lock */
4403 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp;
4404 tcp->tcp_eager_next_drop_q0 = tcp;
4405 tcp->tcp_eager_prev_drop_q0 = tcp;
4406 tcp->tcp_second_ctimer_threshold =
4407 tcps->tcps_ip_abort_linterval;
4408 }
4409 }
4410
4411 /*
4412 * We need to make sure that the conn_recv is set to a non-null
4413 * value before we insert the conn into the classifier table.
4414 * This is to avoid a race with an incoming packet which does an
4415 * ipcl_classify().
4416 * We initially set it to tcp_input_listener_unbound to try to
4417 * pick a good squeue for the listener when the first SYN arrives.
4418 * tcp_input_listener_unbound sets it to tcp_input_listener on that
4419 * first SYN.
4420 */
4421 connp->conn_recv = tcp_input_listener_unbound;
4422
4423 /* Insert the listener in the classifier table */
4424 error = ip_laddr_fanout_insert(connp);
4425 if (error != 0) {
4426 /* Undo the bind - release the port number */
4427 oldstate = tcp->tcp_state;
4428 tcp->tcp_state = TCPS_IDLE;
4429 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
4430 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
4431 int32_t, oldstate);
4432 connp->conn_bound_addr_v6 = ipv6_all_zeros;
4433
4434 connp->conn_laddr_v6 = ipv6_all_zeros;
4435 connp->conn_saddr_v6 = ipv6_all_zeros;
4436 connp->conn_ports = 0;
4437
4438 if (connp->conn_anon_port) {
4439 zone_t *zone;
4440
4441 zone = crgetzone(cr);
4442 connp->conn_anon_port = B_FALSE;
4443 (void) tsol_mlp_anon(zone, connp->conn_mlp_type,
4444 connp->conn_proto, connp->conn_lport, B_FALSE);
4445 }
4446 connp->conn_mlp_type = mlptSingle;
4447
4448 tcp_bind_hash_remove(tcp);
4449 return (error);
4450 } else {
4451 /*
4452 * If there is a connection limit, allocate and initialize
4453 * the counter struct. Note that since listen can be called
4454 * multiple times, the struct may have been allready allocated.
4455 */
4456 if (!list_is_empty(&tcps->tcps_listener_conf) &&
4457 tcp->tcp_listen_cnt == NULL) {
4458 tcp_listen_cnt_t *tlc;
4459 uint32_t ratio;
4460
4461 ratio = tcp_find_listener_conf(tcps,
4462 ntohs(connp->conn_lport));
4463 if (ratio != 0) {
4464 uint32_t mem_ratio, tot_buf;
4465
4466 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t),
4467 KM_SLEEP);
4468 /*
4469 * Calculate the connection limit based on
4470 * the configured ratio and maxusers. Maxusers
4471 * are calculated based on memory size,
4472 * ~ 1 user per MB. Note that the conn_rcvbuf
4473 * and conn_sndbuf may change after a
4474 * connection is accepted. So what we have
4475 * is only an approximation.
4476 */
4477 if ((tot_buf = connp->conn_rcvbuf +
4478 connp->conn_sndbuf) < MB) {
4479 mem_ratio = MB / tot_buf;
4480 tlc->tlc_max = maxusers / ratio *
4481 mem_ratio;
4482 } else {
4483 mem_ratio = tot_buf / MB;
4484 tlc->tlc_max = maxusers / ratio /
4485 mem_ratio;
4486 }
4487 /* At least we should allow two connections! */
4488 if (tlc->tlc_max <= tcp_min_conn_listener)
4489 tlc->tlc_max = tcp_min_conn_listener;
4490 tlc->tlc_cnt = 1;
4491 tlc->tlc_drop = 0;
4492 tcp->tcp_listen_cnt = tlc;
4493 }
4494 }
4495 }
4496 return (error);
4497 }