Print this page
DLPX-25998 TCP congestion control is inadequate
Reviewed at: http://reviews.delphix.com/r/34808/
DLPX-45697 Adding Avg. RTT to connstat
DLPX-43064 include high-resolution round-trip times in connstat (EP-652)
DLPX-42721 Create inline function for TCP RTO calculation
DLPX-37540 TCP per-connection kernel statistics DLPX-37544 connstat command to display per-connection TCP statistics
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/tcp/tcp_input.c
+++ new/usr/src/uts/common/inet/tcp/tcp_input.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
|
↓ open down ↓ |
15 lines elided |
↑ open up ↑ |
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 25 * Copyright 2017 Joyent, Inc.
26 - * Copyright (c) 2014 by Delphix. All rights reserved.
26 + * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
27 27 */
28 28
29 29 /* This file contains all TCP input processing functions. */
30 30
31 31 #include <sys/types.h>
32 32 #include <sys/stream.h>
33 33 #include <sys/strsun.h>
34 34 #include <sys/strsubr.h>
35 35 #include <sys/stropts.h>
36 36 #include <sys/strlog.h>
37 37 #define _SUN_TPI_VERSION 2
38 38 #include <sys/tihdr.h>
39 39 #include <sys/suntpi.h>
40 40 #include <sys/xti_inet.h>
41 41 #include <sys/squeue_impl.h>
42 42 #include <sys/squeue.h>
43 43 #include <sys/tsol/tnet.h>
44 44
45 45 #include <inet/common.h>
46 46 #include <inet/ip.h>
47 47 #include <inet/tcp.h>
48 48 #include <inet/tcp_impl.h>
49 49 #include <inet/tcp_cluster.h>
50 50 #include <inet/proto_set.h>
51 51 #include <inet/ipsec_impl.h>
52 52
53 53 /*
54 54 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
55 55 */
56 56
57 57 #ifdef _BIG_ENDIAN
58 58 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
59 59 (TCPOPT_TSTAMP << 8) | 10)
60 60 #else
61 61 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
62 62 (TCPOPT_NOP << 8) | TCPOPT_NOP)
63 63 #endif
64 64
65 65 /*
66 66 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
67 67 */
68 68 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
69 69
70 70 /*
71 71 * Since tcp_listener is not cleared atomically with tcp_detached
72 72 * being cleared we need this extra bit to tell a detached connection
73 73 * apart from one that is in the process of being accepted.
74 74 */
75 75 #define TCP_IS_DETACHED_NONEAGER(tcp) \
76 76 (TCP_IS_DETACHED(tcp) && \
77 77 (!(tcp)->tcp_hard_binding))
78 78
79 79 /*
80 80 * Steps to do when a tcp_t moves to TIME-WAIT state.
81 81 *
82 82 * This connection is done, we don't need to account for it. Decrement
83 83 * the listener connection counter if needed.
84 84 *
85 85 * Decrement the connection counter of the stack. Note that this counter
86 86 * is per CPU. So the total number of connections in a stack is the sum of all
87 87 * of them. Since there is no lock for handling all of them exclusively, the
88 88 * resulting sum is only an approximation.
89 89 *
90 90 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
91 91 * connection won't interfere with new ones.
92 92 *
93 93 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
94 94 * the timer is handled within the context of this tcp_t. When the timer
95 95 * fires, tcp_clean_death() is called. If upper layer closes the connection
96 96 * during this period, tcp_time_wait_append() will be called to add this
97 97 * tcp_t to the global TIME-WAIT list. Note that this means that the
98 98 * actual wait time in TIME-WAIT state will be longer than the
99 99 * tcps_time_wait_interval since the period before upper layer closes the
100 100 * connection is not accounted for when tcp_time_wait_append() is called.
101 101 *
102 102 * If upper layer has closed the connection, call tcp_time_wait_append()
103 103 * directly.
104 104 *
105 105 */
106 106 #define SET_TIME_WAIT(tcps, tcp, connp) \
107 107 { \
108 108 (tcp)->tcp_state = TCPS_TIME_WAIT; \
109 109 if ((tcp)->tcp_listen_cnt != NULL) \
110 110 TCP_DECR_LISTEN_CNT(tcp); \
111 111 atomic_dec_64( \
112 112 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
113 113 (connp)->conn_exclbind = 0; \
114 114 if (!TCP_IS_DETACHED(tcp)) { \
115 115 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
116 116 } else { \
117 117 tcp_time_wait_append(tcp); \
118 118 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
119 119 } \
120 120 }
121 121
122 122 /*
123 123 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
124 124 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
125 125 * data, TCP will not respond with an ACK. RFC 793 requires that
126 126 * TCP responds with an ACK for such a bogus ACK. By not following
127 127 * the RFC, we prevent TCP from getting into an ACK storm if somehow
128 128 * an attacker successfully spoofs an acceptable segment to our
129 129 * peer; or when our peer is "confused."
130 130 */
131 131 static uint32_t tcp_drop_ack_unsent_cnt = 10;
132 132
133 133 /*
134 134 * To protect TCP against attacker using a small window and requesting
135 135 * large amount of data (DoS attack by conuming memory), TCP checks the
136 136 * window advertised in the last ACK of the 3-way handshake. TCP uses
137 137 * the tcp_mss (the size of one packet) value for comparion. The window
138 138 * should be larger than tcp_mss. But while a sane TCP should advertise
139 139 * a receive window larger than or equal to 4*MSS to avoid stop and go
140 140 * tarrfic, not all TCP stacks do that. This is especially true when
141 141 * tcp_mss is a big value.
142 142 *
143 143 * To work around this issue, an additional fixed value for comparison
144 144 * is also used. If the advertised window is smaller than both tcp_mss
145 145 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
146 146 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
147 147 * smaller than 8K is considered to be OK.
148 148 */
149 149 static uint32_t tcp_init_wnd_chk = 4096;
150 150
151 151 /* Process ICMP source quench message or not. */
152 152 static boolean_t tcp_icmp_source_quench = B_FALSE;
153 153
154 154 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
155 155
156 156 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
157 157 ip_recv_attr_t *);
158 158 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
|
↓ open down ↓ |
122 lines elided |
↑ open up ↑ |
159 159 ip_recv_attr_t *);
160 160 static boolean_t tcp_drop_q0(tcp_t *);
161 161 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
162 162 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
163 163 ip_recv_attr_t *);
164 164 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
165 165 static void tcp_process_options(tcp_t *, tcpha_t *);
166 166 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
167 167 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
168 168 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
169 -static void tcp_set_rto(tcp_t *, time_t);
169 +static void tcp_set_rto(tcp_t *, hrtime_t);
170 170 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
171 171
172 172 /*
173 + * CC wrapper hook functions
174 + */
175 +static void
176 +cc_ack_received(tcp_t *tcp, uint32_t seg_ack, int32_t bytes_acked,
177 + uint16_t type)
178 +{
179 + uint32_t old_cwnd = tcp->tcp_cwnd;
180 +
181 + tcp->tcp_ccv.bytes_this_ack = bytes_acked;
182 + if (tcp->tcp_cwnd <= tcp->tcp_swnd)
183 + tcp->tcp_ccv.flags |= CCF_CWND_LIMITED;
184 + else
185 + tcp->tcp_ccv.flags &= ~CCF_CWND_LIMITED;
186 +
187 + if (type == CC_ACK) {
188 + if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
189 + if (tcp->tcp_ccv.flags & CCF_RTO)
190 + tcp->tcp_ccv.flags &= ~CCF_RTO;
191 +
192 + tcp->tcp_ccv.t_bytes_acked +=
193 + min(tcp->tcp_ccv.bytes_this_ack,
194 + tcp->tcp_tcps->tcps_abc_l_var * tcp->tcp_mss);
195 + if (tcp->tcp_ccv.t_bytes_acked >= tcp->tcp_cwnd) {
196 + tcp->tcp_ccv.t_bytes_acked -= tcp->tcp_cwnd;
197 + tcp->tcp_ccv.flags |= CCF_ABC_SENTAWND;
198 + }
199 + } else {
200 + tcp->tcp_ccv.flags &= ~CCF_ABC_SENTAWND;
201 + tcp->tcp_ccv.t_bytes_acked = 0;
202 + }
203 + }
204 +
205 + if (CC_ALGO(tcp)->ack_received != NULL) {
206 + /*
207 + * The FreeBSD code where this originated had a comment "Find
208 + * a way to live without this" in several places where curack
209 + * got set. If they eventually dump curack from from the cc
210 + * variables, we'll need to adapt our code.
211 + */
212 + tcp->tcp_ccv.curack = seg_ack;
213 + CC_ALGO(tcp)->ack_received(&tcp->tcp_ccv, type);
214 + }
215 +
216 + DTRACE_PROBE3(cwnd__cc__ack__received, tcp_t *, tcp, uint32_t, old_cwnd,
217 + uint32_t, tcp->tcp_cwnd);
218 +}
219 +
220 +void
221 +cc_cong_signal(tcp_t *tcp, uint32_t seg_ack, uint32_t type)
222 +{
223 + uint32_t old_cwnd = tcp->tcp_cwnd;
224 + uint32_t old_cwnd_ssthresh = tcp->tcp_cwnd_ssthresh;
225 + switch (type) {
226 + case CC_NDUPACK:
227 + if (!IN_FASTRECOVERY(tcp->tcp_ccv.flags)) {
228 + tcp->tcp_rexmit_max = tcp->tcp_snxt;
229 + if (tcp->tcp_ecn_ok) {
230 + tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
231 + tcp->tcp_cwr = B_TRUE;
232 + tcp->tcp_ecn_cwr_sent = B_FALSE;
233 + }
234 + }
235 + break;
236 + case CC_ECN:
237 + if (!IN_CONGRECOVERY(tcp->tcp_ccv.flags)) {
238 + tcp->tcp_rexmit_max = tcp->tcp_snxt;
239 + if (tcp->tcp_ecn_ok) {
240 + tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
241 + tcp->tcp_cwr = B_TRUE;
242 + tcp->tcp_ecn_cwr_sent = B_FALSE;
243 + }
244 + }
245 + break;
246 + case CC_RTO:
247 + tcp->tcp_ccv.flags |= CCF_RTO;
248 + tcp->tcp_dupack_cnt = 0;
249 + tcp->tcp_ccv.t_bytes_acked = 0;
250 + /*
251 + * Give up on fast recovery and congestion recovery if we were
252 + * attempting either.
253 + */
254 + EXIT_RECOVERY(tcp->tcp_ccv.flags);
255 + if (CC_ALGO(tcp)->cong_signal == NULL) {
256 + /*
257 + * RFC5681 Section 3.1
258 + * ssthresh = max (FlightSize / 2, 2*SMSS) eq (4)
259 + */
260 + tcp->tcp_cwnd_ssthresh = max(
261 + (tcp->tcp_snxt - tcp->tcp_suna) / 2 / tcp->tcp_mss,
262 + 2) * tcp->tcp_mss;
263 + tcp->tcp_cwnd = tcp->tcp_mss;
264 + }
265 +
266 + if (tcp->tcp_ecn_ok) {
267 + tcp->tcp_cwr = B_TRUE;
268 + tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
269 + tcp->tcp_ecn_cwr_sent = B_FALSE;
270 + }
271 + break;
272 + }
273 +
274 + if (CC_ALGO(tcp)->cong_signal != NULL) {
275 + tcp->tcp_ccv.curack = seg_ack;
276 + CC_ALGO(tcp)->cong_signal(&tcp->tcp_ccv, type);
277 + }
278 +
279 + DTRACE_PROBE6(cwnd__cc__cong__signal, tcp_t *, tcp, uint32_t, old_cwnd,
280 + uint32_t, tcp->tcp_cwnd, uint32_t, old_cwnd_ssthresh,
281 + uint32_t, tcp->tcp_cwnd_ssthresh, uint32_t, type);
282 +}
283 +
284 +static void
285 +cc_post_recovery(tcp_t *tcp, uint32_t seg_ack)
286 +{
287 + uint32_t old_cwnd = tcp->tcp_cwnd;
288 +
289 + if (CC_ALGO(tcp)->post_recovery != NULL) {
290 + tcp->tcp_ccv.curack = seg_ack;
291 + CC_ALGO(tcp)->post_recovery(&tcp->tcp_ccv);
292 + }
293 + tcp->tcp_ccv.t_bytes_acked = 0;
294 +
295 + DTRACE_PROBE3(cwnd__cc__post__recovery, tcp_t *, tcp,
296 + uint32_t, old_cwnd, uint32_t, tcp->tcp_cwnd);
297 +}
298 +
299 +/*
173 300 * Set the MSS associated with a particular tcp based on its current value,
174 301 * and a new one passed in. Observe minimums and maximums, and reset other
175 302 * state variables that we want to view as multiples of MSS.
176 303 *
177 304 * The value of MSS could be either increased or descreased.
178 305 */
179 306 void
180 307 tcp_mss_set(tcp_t *tcp, uint32_t mss)
181 308 {
182 309 uint32_t mss_max;
183 310 tcp_stack_t *tcps = tcp->tcp_tcps;
184 311 conn_t *connp = tcp->tcp_connp;
185 312
186 313 if (connp->conn_ipversion == IPV4_VERSION)
187 314 mss_max = tcps->tcps_mss_max_ipv4;
188 315 else
189 316 mss_max = tcps->tcps_mss_max_ipv6;
190 317
191 318 if (mss < tcps->tcps_mss_min)
192 319 mss = tcps->tcps_mss_min;
193 320 if (mss > mss_max)
194 321 mss = mss_max;
195 322 /*
196 323 * Unless naglim has been set by our client to
197 324 * a non-mss value, force naglim to track mss.
198 325 * This can help to aggregate small writes.
199 326 */
200 327 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
201 328 tcp->tcp_naglim = mss;
202 329 /*
203 330 * TCP should be able to buffer at least 4 MSS data for obvious
204 331 * performance reason.
205 332 */
206 333 if ((mss << 2) > connp->conn_sndbuf)
207 334 connp->conn_sndbuf = mss << 2;
208 335
209 336 /*
210 337 * Set the send lowater to at least twice of MSS.
211 338 */
212 339 if ((mss << 1) > connp->conn_sndlowat)
213 340 connp->conn_sndlowat = mss << 1;
214 341
215 342 /*
216 343 * Update tcp_cwnd according to the new value of MSS. Keep the
217 344 * previous ratio to preserve the transmit rate.
218 345 */
219 346 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
220 347 tcp->tcp_cwnd_cnt = 0;
221 348
222 349 tcp->tcp_mss = mss;
223 350 (void) tcp_maxpsz_set(tcp, B_TRUE);
224 351 }
225 352
226 353 /*
227 354 * Extract option values from a tcp header. We put any found values into the
228 355 * tcpopt struct and return a bitmask saying which options were found.
229 356 */
230 357 int
231 358 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
232 359 {
233 360 uchar_t *endp;
234 361 int len;
235 362 uint32_t mss;
236 363 uchar_t *up = (uchar_t *)tcpha;
237 364 int found = 0;
238 365 int32_t sack_len;
239 366 tcp_seq sack_begin, sack_end;
240 367 tcp_t *tcp;
241 368
242 369 endp = up + TCP_HDR_LENGTH(tcpha);
243 370 up += TCP_MIN_HEADER_LENGTH;
244 371 /*
245 372 * If timestamp option is aligned as recommended in RFC 7323 Appendix
246 373 * A, and is the only option, return quickly.
247 374 */
248 375 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
249 376 TCPOPT_REAL_TS_LEN &&
250 377 OK_32PTR(up) &&
251 378 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
252 379 tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4));
253 380 tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
254 381
255 382 return (TCP_OPT_TSTAMP_PRESENT);
256 383 }
257 384 while (up < endp) {
258 385 len = endp - up;
259 386 switch (*up) {
260 387 case TCPOPT_EOL:
261 388 break;
262 389
263 390 case TCPOPT_NOP:
264 391 up++;
265 392 continue;
266 393
267 394 case TCPOPT_MAXSEG:
268 395 if (len < TCPOPT_MAXSEG_LEN ||
269 396 up[1] != TCPOPT_MAXSEG_LEN)
270 397 break;
271 398
272 399 mss = BE16_TO_U16(up+2);
273 400 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
274 401 tcpopt->tcp_opt_mss = mss;
275 402 found |= TCP_OPT_MSS_PRESENT;
276 403
277 404 up += TCPOPT_MAXSEG_LEN;
278 405 continue;
279 406
280 407 case TCPOPT_WSCALE:
281 408 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
282 409 break;
283 410
284 411 if (up[2] > TCP_MAX_WINSHIFT)
285 412 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
286 413 else
287 414 tcpopt->tcp_opt_wscale = up[2];
288 415 found |= TCP_OPT_WSCALE_PRESENT;
289 416
290 417 up += TCPOPT_WS_LEN;
291 418 continue;
292 419
293 420 case TCPOPT_SACK_PERMITTED:
294 421 if (len < TCPOPT_SACK_OK_LEN ||
295 422 up[1] != TCPOPT_SACK_OK_LEN)
296 423 break;
297 424 found |= TCP_OPT_SACK_OK_PRESENT;
298 425 up += TCPOPT_SACK_OK_LEN;
299 426 continue;
300 427
301 428 case TCPOPT_SACK:
302 429 if (len <= 2 || up[1] <= 2 || len < up[1])
303 430 break;
304 431
305 432 /* If TCP is not interested in SACK blks... */
306 433 if ((tcp = tcpopt->tcp) == NULL) {
307 434 up += up[1];
308 435 continue;
309 436 }
310 437 sack_len = up[1] - TCPOPT_HEADER_LEN;
311 438 up += TCPOPT_HEADER_LEN;
312 439
313 440 /*
314 441 * If the list is empty, allocate one and assume
315 442 * nothing is sack'ed.
316 443 */
317 444 if (tcp->tcp_notsack_list == NULL) {
318 445 tcp_notsack_update(&(tcp->tcp_notsack_list),
319 446 tcp->tcp_suna, tcp->tcp_snxt,
320 447 &(tcp->tcp_num_notsack_blk),
321 448 &(tcp->tcp_cnt_notsack_list));
322 449
323 450 /*
324 451 * Make sure tcp_notsack_list is not NULL.
325 452 * This happens when kmem_alloc(KM_NOSLEEP)
326 453 * returns NULL.
327 454 */
328 455 if (tcp->tcp_notsack_list == NULL) {
329 456 up += sack_len;
330 457 continue;
331 458 }
332 459 tcp->tcp_fack = tcp->tcp_suna;
333 460 }
334 461
335 462 while (sack_len > 0) {
336 463 if (up + 8 > endp) {
337 464 up = endp;
338 465 break;
339 466 }
340 467 sack_begin = BE32_TO_U32(up);
341 468 up += 4;
342 469 sack_end = BE32_TO_U32(up);
343 470 up += 4;
344 471 sack_len -= 8;
345 472 /*
346 473 * Bounds checking. Make sure the SACK
347 474 * info is within tcp_suna and tcp_snxt.
348 475 * If this SACK blk is out of bound, ignore
349 476 * it but continue to parse the following
350 477 * blks.
351 478 */
352 479 if (SEQ_LEQ(sack_end, sack_begin) ||
353 480 SEQ_LT(sack_begin, tcp->tcp_suna) ||
354 481 SEQ_GT(sack_end, tcp->tcp_snxt)) {
355 482 continue;
356 483 }
357 484 tcp_notsack_insert(&(tcp->tcp_notsack_list),
358 485 sack_begin, sack_end,
359 486 &(tcp->tcp_num_notsack_blk),
360 487 &(tcp->tcp_cnt_notsack_list));
361 488 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
362 489 tcp->tcp_fack = sack_end;
363 490 }
364 491 }
365 492 found |= TCP_OPT_SACK_PRESENT;
366 493 continue;
367 494
368 495 case TCPOPT_TSTAMP:
369 496 if (len < TCPOPT_TSTAMP_LEN ||
370 497 up[1] != TCPOPT_TSTAMP_LEN)
371 498 break;
372 499
373 500 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
374 501 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
375 502
376 503 found |= TCP_OPT_TSTAMP_PRESENT;
377 504
378 505 up += TCPOPT_TSTAMP_LEN;
379 506 continue;
380 507
381 508 default:
382 509 if (len <= 1 || len < (int)up[1] || up[1] == 0)
383 510 break;
384 511 up += up[1];
385 512 continue;
386 513 }
387 514 break;
388 515 }
389 516 return (found);
390 517 }
391 518
392 519 /*
393 520 * Process all TCP option in SYN segment. Note that this function should
394 521 * be called after tcp_set_destination() is called so that the necessary info
395 522 * from IRE is already set in the tcp structure.
396 523 *
397 524 * This function sets up the correct tcp_mss value according to the
398 525 * MSS option value and our header size. It also sets up the window scale
399 526 * and timestamp values, and initialize SACK info blocks. But it does not
400 527 * change receive window size after setting the tcp_mss value. The caller
401 528 * should do the appropriate change.
402 529 */
403 530 static void
404 531 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
405 532 {
406 533 int options;
407 534 tcp_opt_t tcpopt;
408 535 uint32_t mss_max;
409 536 char *tmp_tcph;
410 537 tcp_stack_t *tcps = tcp->tcp_tcps;
411 538 conn_t *connp = tcp->tcp_connp;
412 539
413 540 tcpopt.tcp = NULL;
414 541 options = tcp_parse_options(tcpha, &tcpopt);
415 542
416 543 /*
417 544 * Process MSS option. Note that MSS option value does not account
418 545 * for IP or TCP options. This means that it is equal to MTU - minimum
419 546 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
420 547 * IPv6.
421 548 */
422 549 if (!(options & TCP_OPT_MSS_PRESENT)) {
423 550 if (connp->conn_ipversion == IPV4_VERSION)
424 551 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
425 552 else
426 553 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
427 554 } else {
428 555 if (connp->conn_ipversion == IPV4_VERSION)
429 556 mss_max = tcps->tcps_mss_max_ipv4;
430 557 else
431 558 mss_max = tcps->tcps_mss_max_ipv6;
432 559 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
433 560 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
434 561 else if (tcpopt.tcp_opt_mss > mss_max)
435 562 tcpopt.tcp_opt_mss = mss_max;
436 563 }
437 564
438 565 /* Process Window Scale option. */
439 566 if (options & TCP_OPT_WSCALE_PRESENT) {
440 567 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
441 568 tcp->tcp_snd_ws_ok = B_TRUE;
442 569 } else {
443 570 tcp->tcp_snd_ws = B_FALSE;
444 571 tcp->tcp_snd_ws_ok = B_FALSE;
445 572 tcp->tcp_rcv_ws = B_FALSE;
446 573 }
447 574
448 575 /* Process Timestamp option. */
449 576 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
450 577 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
451 578 tmp_tcph = (char *)tcp->tcp_tcpha;
452 579
453 580 tcp->tcp_snd_ts_ok = B_TRUE;
454 581 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
455 582 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
456 583 ASSERT(OK_32PTR(tmp_tcph));
457 584 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
458 585
459 586 /* Fill in our template header with basic timestamp option. */
460 587 tmp_tcph += connp->conn_ht_ulp_len;
461 588 tmp_tcph[0] = TCPOPT_NOP;
462 589 tmp_tcph[1] = TCPOPT_NOP;
463 590 tmp_tcph[2] = TCPOPT_TSTAMP;
464 591 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
465 592 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
466 593 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
467 594 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
468 595 } else {
469 596 tcp->tcp_snd_ts_ok = B_FALSE;
470 597 }
471 598
472 599 /*
473 600 * Process SACK options. If SACK is enabled for this connection,
474 601 * then allocate the SACK info structure. Note the following ways
475 602 * when tcp_snd_sack_ok is set to true.
476 603 *
477 604 * For active connection: in tcp_set_destination() called in
478 605 * tcp_connect().
479 606 *
480 607 * For passive connection: in tcp_set_destination() called in
481 608 * tcp_input_listener().
482 609 *
483 610 * That's the reason why the extra TCP_IS_DETACHED() check is there.
484 611 * That check makes sure that if we did not send a SACK OK option,
485 612 * we will not enable SACK for this connection even though the other
486 613 * side sends us SACK OK option. For active connection, the SACK
487 614 * info structure has already been allocated. So we need to free
488 615 * it if SACK is disabled.
489 616 */
490 617 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
491 618 (tcp->tcp_snd_sack_ok ||
492 619 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
493 620 ASSERT(tcp->tcp_num_sack_blk == 0);
494 621 ASSERT(tcp->tcp_notsack_list == NULL);
495 622
496 623 tcp->tcp_snd_sack_ok = B_TRUE;
497 624 if (tcp->tcp_snd_ts_ok) {
498 625 tcp->tcp_max_sack_blk = 3;
499 626 } else {
500 627 tcp->tcp_max_sack_blk = 4;
501 628 }
502 629 } else if (tcp->tcp_snd_sack_ok) {
503 630 /*
504 631 * Resetting tcp_snd_sack_ok to B_FALSE so that
505 632 * no SACK info will be used for this
506 633 * connection. This assumes that SACK usage
507 634 * permission is negotiated. This may need
508 635 * to be changed once this is clarified.
509 636 */
510 637 ASSERT(tcp->tcp_num_sack_blk == 0);
511 638 ASSERT(tcp->tcp_notsack_list == NULL);
512 639 tcp->tcp_snd_sack_ok = B_FALSE;
513 640 }
514 641
515 642 /*
516 643 * Now we know the exact TCP/IP header length, subtract
517 644 * that from tcp_mss to get our side's MSS.
518 645 */
519 646 tcp->tcp_mss -= connp->conn_ht_iphc_len;
520 647
521 648 /*
522 649 * Here we assume that the other side's header size will be equal to
523 650 * our header size. We calculate the real MSS accordingly. Need to
524 651 * take into additional stuffs IPsec puts in.
525 652 *
526 653 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
527 654 */
528 655 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
529 656 tcp->tcp_ipsec_overhead -
530 657 ((connp->conn_ipversion == IPV4_VERSION ?
531 658 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
532 659
533 660 /*
534 661 * Set MSS to the smaller one of both ends of the connection.
535 662 * We should not have called tcp_mss_set() before, but our
536 663 * side of the MSS should have been set to a proper value
537 664 * by tcp_set_destination(). tcp_mss_set() will also set up the
538 665 * STREAM head parameters properly.
539 666 *
540 667 * If we have a larger-than-16-bit window but the other side
|
↓ open down ↓ |
358 lines elided |
↑ open up ↑ |
541 668 * didn't want to do window scale, tcp_rwnd_set() will take
542 669 * care of that.
543 670 */
544 671 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
545 672
546 673 /*
547 674 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
548 675 * updated properly.
549 676 */
550 677 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
678 +
679 + if (tcp->tcp_cc_algo->conn_init != NULL)
680 + tcp->tcp_cc_algo->conn_init(&tcp->tcp_ccv);
551 681 }
552 682
553 683 /*
554 684 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
555 685 * is filled, return as much as we can. The message passed in may be
556 686 * multi-part, chained using b_cont. "start" is the starting sequence
557 687 * number for this piece.
558 688 */
559 689 static mblk_t *
560 690 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
561 691 {
562 - uint32_t end;
692 + uint32_t end, bytes;
563 693 mblk_t *mp1;
564 694 mblk_t *mp2;
565 695 mblk_t *next_mp;
566 696 uint32_t u1;
567 697 tcp_stack_t *tcps = tcp->tcp_tcps;
568 698
569 699
570 700 /* Walk through all the new pieces. */
571 701 do {
572 702 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
573 703 (uintptr_t)INT_MAX);
574 704 end = start + (int)(mp->b_wptr - mp->b_rptr);
575 705 next_mp = mp->b_cont;
576 706 if (start == end) {
577 707 /* Empty. Blast it. */
578 708 freeb(mp);
579 709 continue;
580 710 }
711 + bytes = end - start;
581 712 mp->b_cont = NULL;
582 713 TCP_REASS_SET_SEQ(mp, start);
583 714 TCP_REASS_SET_END(mp, end);
584 715 mp1 = tcp->tcp_reass_tail;
585 - if (!mp1) {
716 + if (mp1 == NULL || SEQ_GEQ(start, TCP_REASS_END(mp1))) {
717 + if (mp1 != NULL) {
718 + /*
719 + * New stuff is beyond the tail; link it on the
720 + * end.
721 + */
722 + mp1->b_cont = mp;
723 + } else {
724 + tcp->tcp_reass_head = mp;
725 + }
586 726 tcp->tcp_reass_tail = mp;
587 - tcp->tcp_reass_head = mp;
588 727 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
589 - TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
590 - end - start);
728 + TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, bytes);
729 + tcp->tcp_cs.tcp_in_data_unorder_segs++;
730 + tcp->tcp_cs.tcp_in_data_unorder_bytes += bytes;
591 731 continue;
592 732 }
593 - /* New stuff completely beyond tail? */
594 - if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
595 - /* Link it on end. */
596 - mp1->b_cont = mp;
597 - tcp->tcp_reass_tail = mp;
598 - TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
599 - TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
600 - end - start);
601 - continue;
602 - }
603 733 mp1 = tcp->tcp_reass_head;
604 734 u1 = TCP_REASS_SEQ(mp1);
605 735 /* New stuff at the front? */
606 736 if (SEQ_LT(start, u1)) {
607 737 /* Yes... Check for overlap. */
608 738 mp->b_cont = mp1;
609 739 tcp->tcp_reass_head = mp;
610 740 tcp_reass_elim_overlap(tcp, mp);
611 741 continue;
612 742 }
613 743 /*
614 744 * The new piece fits somewhere between the head and tail.
615 745 * We find our slot, where mp1 precedes us and mp2 trails.
616 746 */
617 747 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
618 748 u1 = TCP_REASS_SEQ(mp2);
619 749 if (SEQ_LEQ(start, u1))
620 750 break;
621 751 }
622 752 /* Link ourselves in */
623 753 mp->b_cont = mp2;
624 754 mp1->b_cont = mp;
625 755
626 756 /* Trim overlap with following mblk(s) first */
627 757 tcp_reass_elim_overlap(tcp, mp);
628 758
629 759 /* Trim overlap with preceding mblk */
630 760 tcp_reass_elim_overlap(tcp, mp1);
631 761
632 762 } while (start = end, mp = next_mp);
633 763 mp1 = tcp->tcp_reass_head;
634 764 /* Anything ready to go? */
635 765 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
636 766 return (NULL);
637 767 /* Eat what we can off the queue */
638 768 for (;;) {
639 769 mp = mp1->b_cont;
640 770 end = TCP_REASS_END(mp1);
641 771 TCP_REASS_SET_SEQ(mp1, 0);
642 772 TCP_REASS_SET_END(mp1, 0);
643 773 if (!mp) {
644 774 tcp->tcp_reass_tail = NULL;
645 775 break;
646 776 }
647 777 if (end != TCP_REASS_SEQ(mp)) {
648 778 mp1->b_cont = NULL;
649 779 break;
650 780 }
651 781 mp1 = mp;
652 782 }
653 783 mp1 = tcp->tcp_reass_head;
654 784 tcp->tcp_reass_head = mp;
655 785 return (mp1);
656 786 }
657 787
658 788 /* Eliminate any overlap that mp may have over later mblks */
659 789 static void
660 790 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
661 791 {
662 792 uint32_t end;
663 793 mblk_t *mp1;
664 794 uint32_t u1;
665 795 tcp_stack_t *tcps = tcp->tcp_tcps;
666 796
667 797 end = TCP_REASS_END(mp);
668 798 while ((mp1 = mp->b_cont) != NULL) {
669 799 u1 = TCP_REASS_SEQ(mp1);
670 800 if (!SEQ_GT(end, u1))
671 801 break;
672 802 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
673 803 mp->b_wptr -= end - u1;
674 804 TCP_REASS_SET_END(mp, u1);
675 805 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
676 806 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
677 807 end - u1);
678 808 break;
679 809 }
680 810 mp->b_cont = mp1->b_cont;
681 811 TCP_REASS_SET_SEQ(mp1, 0);
682 812 TCP_REASS_SET_END(mp1, 0);
683 813 freeb(mp1);
684 814 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
685 815 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
686 816 }
687 817 if (!mp1)
688 818 tcp->tcp_reass_tail = mp;
689 819 }
690 820
691 821 /*
692 822 * This function does PAWS protection check, per RFC 7323 section 5. Requires
693 823 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
694 824 * the segment passes the PAWS test, else returns B_FALSE.
695 825 */
696 826 boolean_t
697 827 tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp)
698 828 {
699 829 if (TSTMP_LT(tcpoptp->tcp_opt_ts_val,
700 830 tcp->tcp_ts_recent)) {
701 831 if (LBOLT_FASTPATH64 <
702 832 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
703 833 /* This segment is not acceptable. */
704 834 return (B_FALSE);
705 835 } else {
706 836 /*
707 837 * Connection has been idle for
708 838 * too long. Reset the timestamp
709 839 */
710 840 tcp->tcp_ts_recent =
711 841 tcpoptp->tcp_opt_ts_val;
712 842 }
713 843 }
714 844 return (B_TRUE);
715 845 }
716 846
717 847 /*
718 848 * Defense for the SYN attack -
719 849 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
720 850 * one from the list of droppable eagers. This list is a subset of q0.
721 851 * see comments before the definition of MAKE_DROPPABLE().
722 852 * 2. Don't drop a SYN request before its first timeout. This gives every
723 853 * request at least til the first timeout to complete its 3-way handshake.
724 854 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
725 855 * requests currently on the queue that has timed out. This will be used
726 856 * as an indicator of whether an attack is under way, so that appropriate
727 857 * actions can be taken. (It's incremented in tcp_timer() and decremented
728 858 * either when eager goes into ESTABLISHED, or gets freed up.)
729 859 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
730 860 * # of timeout drops back to <= q0len/32 => SYN alert off
731 861 */
732 862 static boolean_t
733 863 tcp_drop_q0(tcp_t *tcp)
734 864 {
735 865 tcp_t *eager;
736 866 mblk_t *mp;
737 867 tcp_stack_t *tcps = tcp->tcp_tcps;
738 868
739 869 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
740 870 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
741 871
742 872 /* Pick oldest eager from the list of droppable eagers */
743 873 eager = tcp->tcp_eager_prev_drop_q0;
744 874
745 875 /* If list is empty. return B_FALSE */
746 876 if (eager == tcp) {
747 877 return (B_FALSE);
748 878 }
749 879
750 880 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
751 881 if ((mp = allocb(0, BPRI_HI)) == NULL)
752 882 return (B_FALSE);
753 883
754 884 /*
755 885 * Take this eager out from the list of droppable eagers since we are
756 886 * going to drop it.
757 887 */
758 888 MAKE_UNDROPPABLE(eager);
759 889
760 890 if (tcp->tcp_connp->conn_debug) {
761 891 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
762 892 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
763 893 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
764 894 tcp->tcp_conn_req_cnt_q0,
765 895 tcp_display(tcp, NULL, DISP_PORT_ONLY));
766 896 }
767 897
768 898 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
769 899
770 900 /* Put a reference on the conn as we are enqueueing it in the sqeue */
771 901 CONN_INC_REF(eager->tcp_connp);
772 902
773 903 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
774 904 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
775 905 SQ_FILL, SQTAG_TCP_DROP_Q0);
776 906
777 907 return (B_TRUE);
778 908 }
779 909
780 910 /*
781 911 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
782 912 */
783 913 static mblk_t *
784 914 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
785 915 ip_recv_attr_t *ira)
786 916 {
787 917 tcp_t *ltcp = lconnp->conn_tcp;
788 918 tcp_t *tcp = connp->conn_tcp;
789 919 mblk_t *tpi_mp;
790 920 ipha_t *ipha;
791 921 ip6_t *ip6h;
792 922 sin6_t sin6;
793 923 uint_t ifindex = ira->ira_ruifindex;
794 924 tcp_stack_t *tcps = tcp->tcp_tcps;
795 925
796 926 if (ira->ira_flags & IRAF_IS_IPV4) {
797 927 ipha = (ipha_t *)mp->b_rptr;
798 928
799 929 connp->conn_ipversion = IPV4_VERSION;
800 930 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
801 931 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
802 932 connp->conn_saddr_v6 = connp->conn_laddr_v6;
803 933
804 934 sin6 = sin6_null;
805 935 sin6.sin6_addr = connp->conn_faddr_v6;
806 936 sin6.sin6_port = connp->conn_fport;
807 937 sin6.sin6_family = AF_INET6;
808 938 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
809 939 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
810 940
811 941 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
812 942 sin6_t sin6d;
813 943
814 944 sin6d = sin6_null;
815 945 sin6d.sin6_addr = connp->conn_laddr_v6;
816 946 sin6d.sin6_port = connp->conn_lport;
817 947 sin6d.sin6_family = AF_INET;
818 948 tpi_mp = mi_tpi_extconn_ind(NULL,
819 949 (char *)&sin6d, sizeof (sin6_t),
820 950 (char *)&tcp,
821 951 (t_scalar_t)sizeof (intptr_t),
822 952 (char *)&sin6d, sizeof (sin6_t),
823 953 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
824 954 } else {
825 955 tpi_mp = mi_tpi_conn_ind(NULL,
826 956 (char *)&sin6, sizeof (sin6_t),
827 957 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
828 958 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
829 959 }
830 960 } else {
831 961 ip6h = (ip6_t *)mp->b_rptr;
832 962
833 963 connp->conn_ipversion = IPV6_VERSION;
834 964 connp->conn_laddr_v6 = ip6h->ip6_dst;
835 965 connp->conn_faddr_v6 = ip6h->ip6_src;
836 966 connp->conn_saddr_v6 = connp->conn_laddr_v6;
837 967
838 968 sin6 = sin6_null;
839 969 sin6.sin6_addr = connp->conn_faddr_v6;
840 970 sin6.sin6_port = connp->conn_fport;
841 971 sin6.sin6_family = AF_INET6;
842 972 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
843 973 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
844 974 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
845 975
846 976 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
847 977 /* Pass up the scope_id of remote addr */
848 978 sin6.sin6_scope_id = ifindex;
849 979 } else {
850 980 sin6.sin6_scope_id = 0;
851 981 }
852 982 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
853 983 sin6_t sin6d;
854 984
855 985 sin6d = sin6_null;
856 986 sin6.sin6_addr = connp->conn_laddr_v6;
857 987 sin6d.sin6_port = connp->conn_lport;
858 988 sin6d.sin6_family = AF_INET6;
859 989 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
860 990 sin6d.sin6_scope_id = ifindex;
861 991
862 992 tpi_mp = mi_tpi_extconn_ind(NULL,
863 993 (char *)&sin6d, sizeof (sin6_t),
864 994 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
865 995 (char *)&sin6d, sizeof (sin6_t),
866 996 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
867 997 } else {
868 998 tpi_mp = mi_tpi_conn_ind(NULL,
869 999 (char *)&sin6, sizeof (sin6_t),
870 1000 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
871 1001 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
872 1002 }
873 1003 }
874 1004
875 1005 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
876 1006 return (tpi_mp);
877 1007 }
878 1008
879 1009 /* Handle a SYN on an AF_INET socket */
880 1010 static mblk_t *
881 1011 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
882 1012 ip_recv_attr_t *ira)
883 1013 {
884 1014 tcp_t *ltcp = lconnp->conn_tcp;
885 1015 tcp_t *tcp = connp->conn_tcp;
886 1016 sin_t sin;
887 1017 mblk_t *tpi_mp = NULL;
888 1018 tcp_stack_t *tcps = tcp->tcp_tcps;
889 1019 ipha_t *ipha;
890 1020
891 1021 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
892 1022 ipha = (ipha_t *)mp->b_rptr;
893 1023
894 1024 connp->conn_ipversion = IPV4_VERSION;
895 1025 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
896 1026 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
897 1027 connp->conn_saddr_v6 = connp->conn_laddr_v6;
898 1028
899 1029 sin = sin_null;
900 1030 sin.sin_addr.s_addr = connp->conn_faddr_v4;
901 1031 sin.sin_port = connp->conn_fport;
902 1032 sin.sin_family = AF_INET;
903 1033 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
904 1034 sin_t sind;
905 1035
906 1036 sind = sin_null;
907 1037 sind.sin_addr.s_addr = connp->conn_laddr_v4;
908 1038 sind.sin_port = connp->conn_lport;
909 1039 sind.sin_family = AF_INET;
910 1040 tpi_mp = mi_tpi_extconn_ind(NULL,
911 1041 (char *)&sind, sizeof (sin_t), (char *)&tcp,
912 1042 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
913 1043 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
914 1044 } else {
915 1045 tpi_mp = mi_tpi_conn_ind(NULL,
916 1046 (char *)&sin, sizeof (sin_t),
917 1047 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
918 1048 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
919 1049 }
920 1050
921 1051 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
922 1052 return (tpi_mp);
923 1053 }
924 1054
925 1055 /*
926 1056 * Called via squeue to get on to eager's perimeter. It sends a
927 1057 * TH_RST if eager is in the fanout table. The listener wants the
928 1058 * eager to disappear either by means of tcp_eager_blowoff() or
929 1059 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
930 1060 * called (via squeue) if the eager cannot be inserted in the
931 1061 * fanout table in tcp_input_listener().
932 1062 */
933 1063 /* ARGSUSED */
934 1064 void
935 1065 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
936 1066 {
937 1067 conn_t *econnp = (conn_t *)arg;
938 1068 tcp_t *eager = econnp->conn_tcp;
939 1069 tcp_t *listener = eager->tcp_listener;
940 1070
941 1071 /*
942 1072 * We could be called because listener is closing. Since
943 1073 * the eager was using listener's queue's, we avoid
944 1074 * using the listeners queues from now on.
945 1075 */
946 1076 ASSERT(eager->tcp_detached);
947 1077 econnp->conn_rq = NULL;
948 1078 econnp->conn_wq = NULL;
949 1079
950 1080 /*
951 1081 * An eager's conn_fanout will be NULL if it's a duplicate
952 1082 * for an existing 4-tuples in the conn fanout table.
953 1083 * We don't want to send an RST out in such case.
954 1084 */
955 1085 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
956 1086 tcp_xmit_ctl("tcp_eager_kill, can't wait",
957 1087 eager, eager->tcp_snxt, 0, TH_RST);
958 1088 }
959 1089
960 1090 /* We are here because listener wants this eager gone */
961 1091 if (listener != NULL) {
962 1092 mutex_enter(&listener->tcp_eager_lock);
963 1093 tcp_eager_unlink(eager);
964 1094 if (eager->tcp_tconnind_started) {
965 1095 /*
966 1096 * The eager has sent a conn_ind up to the
967 1097 * listener but listener decides to close
968 1098 * instead. We need to drop the extra ref
969 1099 * placed on eager in tcp_input_data() before
970 1100 * sending the conn_ind to listener.
971 1101 */
972 1102 CONN_DEC_REF(econnp);
973 1103 }
974 1104 mutex_exit(&listener->tcp_eager_lock);
975 1105 CONN_DEC_REF(listener->tcp_connp);
976 1106 }
977 1107
978 1108 if (eager->tcp_state != TCPS_CLOSED)
979 1109 tcp_close_detached(eager);
980 1110 }
981 1111
982 1112 /*
983 1113 * Reset any eager connection hanging off this listener marked
984 1114 * with 'seqnum' and then reclaim it's resources.
985 1115 */
986 1116 boolean_t
987 1117 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
988 1118 {
989 1119 tcp_t *eager;
990 1120 mblk_t *mp;
991 1121
992 1122 eager = listener;
993 1123 mutex_enter(&listener->tcp_eager_lock);
994 1124 do {
995 1125 eager = eager->tcp_eager_next_q;
996 1126 if (eager == NULL) {
997 1127 mutex_exit(&listener->tcp_eager_lock);
998 1128 return (B_FALSE);
999 1129 }
1000 1130 } while (eager->tcp_conn_req_seqnum != seqnum);
1001 1131
1002 1132 if (eager->tcp_closemp_used) {
1003 1133 mutex_exit(&listener->tcp_eager_lock);
1004 1134 return (B_TRUE);
1005 1135 }
1006 1136 eager->tcp_closemp_used = B_TRUE;
1007 1137 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1008 1138 CONN_INC_REF(eager->tcp_connp);
1009 1139 mutex_exit(&listener->tcp_eager_lock);
1010 1140 mp = &eager->tcp_closemp;
1011 1141 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1012 1142 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1013 1143 return (B_TRUE);
1014 1144 }
1015 1145
1016 1146 /*
1017 1147 * Reset any eager connection hanging off this listener
1018 1148 * and then reclaim it's resources.
1019 1149 */
1020 1150 void
1021 1151 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1022 1152 {
1023 1153 tcp_t *eager;
1024 1154 mblk_t *mp;
1025 1155 tcp_stack_t *tcps = listener->tcp_tcps;
1026 1156
1027 1157 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1028 1158
1029 1159 if (!q0_only) {
1030 1160 /* First cleanup q */
1031 1161 TCP_STAT(tcps, tcp_eager_blowoff_q);
1032 1162 eager = listener->tcp_eager_next_q;
1033 1163 while (eager != NULL) {
1034 1164 if (!eager->tcp_closemp_used) {
1035 1165 eager->tcp_closemp_used = B_TRUE;
1036 1166 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1037 1167 CONN_INC_REF(eager->tcp_connp);
1038 1168 mp = &eager->tcp_closemp;
1039 1169 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1040 1170 tcp_eager_kill, eager->tcp_connp, NULL,
1041 1171 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1042 1172 }
1043 1173 eager = eager->tcp_eager_next_q;
1044 1174 }
1045 1175 }
1046 1176 /* Then cleanup q0 */
1047 1177 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1048 1178 eager = listener->tcp_eager_next_q0;
1049 1179 while (eager != listener) {
1050 1180 if (!eager->tcp_closemp_used) {
1051 1181 eager->tcp_closemp_used = B_TRUE;
1052 1182 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1053 1183 CONN_INC_REF(eager->tcp_connp);
1054 1184 mp = &eager->tcp_closemp;
1055 1185 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1056 1186 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1057 1187 SQTAG_TCP_EAGER_CLEANUP_Q0);
1058 1188 }
1059 1189 eager = eager->tcp_eager_next_q0;
1060 1190 }
1061 1191 }
1062 1192
1063 1193 /*
1064 1194 * If we are an eager connection hanging off a listener that hasn't
1065 1195 * formally accepted the connection yet, get off its list and blow off
1066 1196 * any data that we have accumulated.
1067 1197 */
1068 1198 void
1069 1199 tcp_eager_unlink(tcp_t *tcp)
1070 1200 {
1071 1201 tcp_t *listener = tcp->tcp_listener;
1072 1202
1073 1203 ASSERT(listener != NULL);
1074 1204 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1075 1205 if (tcp->tcp_eager_next_q0 != NULL) {
1076 1206 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1077 1207
1078 1208 /* Remove the eager tcp from q0 */
1079 1209 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1080 1210 tcp->tcp_eager_prev_q0;
1081 1211 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1082 1212 tcp->tcp_eager_next_q0;
1083 1213 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1084 1214 listener->tcp_conn_req_cnt_q0--;
1085 1215
1086 1216 tcp->tcp_eager_next_q0 = NULL;
1087 1217 tcp->tcp_eager_prev_q0 = NULL;
1088 1218
1089 1219 /*
1090 1220 * Take the eager out, if it is in the list of droppable
1091 1221 * eagers.
1092 1222 */
1093 1223 MAKE_UNDROPPABLE(tcp);
1094 1224
1095 1225 if (tcp->tcp_syn_rcvd_timeout != 0) {
1096 1226 /* we have timed out before */
1097 1227 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1098 1228 listener->tcp_syn_rcvd_timeout--;
1099 1229 }
1100 1230 } else {
1101 1231 tcp_t **tcpp = &listener->tcp_eager_next_q;
1102 1232 tcp_t *prev = NULL;
1103 1233
1104 1234 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1105 1235 if (tcpp[0] == tcp) {
1106 1236 if (listener->tcp_eager_last_q == tcp) {
1107 1237 /*
1108 1238 * If we are unlinking the last
1109 1239 * element on the list, adjust
1110 1240 * tail pointer. Set tail pointer
1111 1241 * to nil when list is empty.
1112 1242 */
1113 1243 ASSERT(tcp->tcp_eager_next_q == NULL);
1114 1244 if (listener->tcp_eager_last_q ==
1115 1245 listener->tcp_eager_next_q) {
1116 1246 listener->tcp_eager_last_q =
1117 1247 NULL;
1118 1248 } else {
1119 1249 /*
1120 1250 * We won't get here if there
1121 1251 * is only one eager in the
1122 1252 * list.
1123 1253 */
1124 1254 ASSERT(prev != NULL);
1125 1255 listener->tcp_eager_last_q =
1126 1256 prev;
1127 1257 }
1128 1258 }
1129 1259 tcpp[0] = tcp->tcp_eager_next_q;
1130 1260 tcp->tcp_eager_next_q = NULL;
1131 1261 tcp->tcp_eager_last_q = NULL;
1132 1262 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1133 1263 listener->tcp_conn_req_cnt_q--;
1134 1264 break;
1135 1265 }
1136 1266 prev = tcpp[0];
1137 1267 }
1138 1268 }
1139 1269 tcp->tcp_listener = NULL;
1140 1270 }
1141 1271
1142 1272 /* BEGIN CSTYLED */
1143 1273 /*
1144 1274 *
1145 1275 * The sockfs ACCEPT path:
1146 1276 * =======================
1147 1277 *
1148 1278 * The eager is now established in its own perimeter as soon as SYN is
1149 1279 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1150 1280 * completes the accept processing on the acceptor STREAM. The sending
1151 1281 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1152 1282 * listener but a TLI/XTI listener completes the accept processing
1153 1283 * on the listener perimeter.
1154 1284 *
1155 1285 * Common control flow for 3 way handshake:
1156 1286 * ----------------------------------------
1157 1287 *
1158 1288 * incoming SYN (listener perimeter) -> tcp_input_listener()
1159 1289 *
1160 1290 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1161 1291 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1162 1292 *
1163 1293 * Sockfs ACCEPT Path:
1164 1294 * -------------------
1165 1295 *
1166 1296 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1167 1297 * as STREAM entry point)
1168 1298 *
1169 1299 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1170 1300 *
1171 1301 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1172 1302 * association (we are not behind eager's squeue but sockfs is protecting us
1173 1303 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1174 1304 * is changed to point at tcp_wput().
1175 1305 *
1176 1306 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1177 1307 * listener (done on listener's perimeter).
1178 1308 *
1179 1309 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1180 1310 * accept.
1181 1311 *
1182 1312 * TLI/XTI client ACCEPT path:
1183 1313 * ---------------------------
1184 1314 *
1185 1315 * soaccept() sends T_CONN_RES on the listener STREAM.
1186 1316 *
1187 1317 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1188 1318 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1189 1319 *
1190 1320 * Locks:
1191 1321 * ======
1192 1322 *
1193 1323 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1194 1324 * and listeners->tcp_eager_next_q.
1195 1325 *
1196 1326 * Referencing:
1197 1327 * ============
1198 1328 *
1199 1329 * 1) We start out in tcp_input_listener by eager placing a ref on
1200 1330 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1201 1331 *
1202 1332 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1203 1333 * doing so we place a ref on the eager. This ref is finally dropped at the
1204 1334 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1205 1335 * reference is dropped by the squeue framework.
1206 1336 *
1207 1337 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1208 1338 *
1209 1339 * The reference must be released by the same entity that added the reference
1210 1340 * In the above scheme, the eager is the entity that adds and releases the
1211 1341 * references. Note that tcp_accept_finish executes in the squeue of the eager
1212 1342 * (albeit after it is attached to the acceptor stream). Though 1. executes
1213 1343 * in the listener's squeue, the eager is nascent at this point and the
1214 1344 * reference can be considered to have been added on behalf of the eager.
1215 1345 *
1216 1346 * Eager getting a Reset or listener closing:
1217 1347 * ==========================================
1218 1348 *
1219 1349 * Once the listener and eager are linked, the listener never does the unlink.
1220 1350 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1221 1351 * a message on all eager perimeter. The eager then does the unlink, clears
1222 1352 * any pointers to the listener's queue and drops the reference to the
1223 1353 * listener. The listener waits in tcp_close outside the squeue until its
1224 1354 * refcount has dropped to 1. This ensures that the listener has waited for
1225 1355 * all eagers to clear their association with the listener.
1226 1356 *
1227 1357 * Similarly, if eager decides to go away, it can unlink itself and close.
1228 1358 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1229 1359 * the reference to eager is still valid because of the extra ref we put
1230 1360 * in tcp_send_conn_ind.
1231 1361 *
1232 1362 * Listener can always locate the eager under the protection
1233 1363 * of the listener->tcp_eager_lock, and then do a refhold
1234 1364 * on the eager during the accept processing.
1235 1365 *
1236 1366 * The acceptor stream accesses the eager in the accept processing
1237 1367 * based on the ref placed on eager before sending T_conn_ind.
1238 1368 * The only entity that can negate this refhold is a listener close
1239 1369 * which is mutually exclusive with an active acceptor stream.
1240 1370 *
1241 1371 * Eager's reference on the listener
1242 1372 * ===================================
1243 1373 *
1244 1374 * If the accept happens (even on a closed eager) the eager drops its
1245 1375 * reference on the listener at the start of tcp_accept_finish. If the
1246 1376 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1247 1377 * the reference is dropped in tcp_closei_local. If the listener closes,
1248 1378 * the reference is dropped in tcp_eager_kill. In all cases the reference
1249 1379 * is dropped while executing in the eager's context (squeue).
1250 1380 */
1251 1381 /* END CSTYLED */
1252 1382
1253 1383 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1254 1384
1255 1385 /*
1256 1386 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1257 1387 * tcp_input_data will not see any packets for listeners since the listener
1258 1388 * has conn_recv set to tcp_input_listener.
1259 1389 */
1260 1390 /* ARGSUSED */
1261 1391 static void
1262 1392 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1263 1393 {
1264 1394 tcpha_t *tcpha;
1265 1395 uint32_t seg_seq;
1266 1396 tcp_t *eager;
1267 1397 int err;
1268 1398 conn_t *econnp = NULL;
1269 1399 squeue_t *new_sqp;
1270 1400 mblk_t *mp1;
1271 1401 uint_t ip_hdr_len;
1272 1402 conn_t *lconnp = (conn_t *)arg;
1273 1403 tcp_t *listener = lconnp->conn_tcp;
1274 1404 tcp_stack_t *tcps = listener->tcp_tcps;
1275 1405 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1276 1406 uint_t flags;
1277 1407 mblk_t *tpi_mp;
1278 1408 uint_t ifindex = ira->ira_ruifindex;
1279 1409 boolean_t tlc_set = B_FALSE;
1280 1410
1281 1411 ip_hdr_len = ira->ira_ip_hdr_length;
1282 1412 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1283 1413 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1284 1414
1285 1415 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1286 1416 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1287 1417 __dtrace_tcp_tcph_t *, tcpha);
1288 1418
1289 1419 if (!(flags & TH_SYN)) {
1290 1420 if ((flags & TH_RST) || (flags & TH_URG)) {
1291 1421 freemsg(mp);
1292 1422 return;
1293 1423 }
1294 1424 if (flags & TH_ACK) {
1295 1425 /* Note this executes in listener's squeue */
1296 1426 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1297 1427 return;
1298 1428 }
1299 1429
1300 1430 freemsg(mp);
1301 1431 return;
1302 1432 }
1303 1433
1304 1434 if (listener->tcp_state != TCPS_LISTEN)
1305 1435 goto error2;
1306 1436
1307 1437 ASSERT(IPCL_IS_BOUND(lconnp));
1308 1438
1309 1439 mutex_enter(&listener->tcp_eager_lock);
1310 1440
1311 1441 /*
1312 1442 * The system is under memory pressure, so we need to do our part
1313 1443 * to relieve the pressure. So we only accept new request if there
1314 1444 * is nothing waiting to be accepted or waiting to complete the 3-way
1315 1445 * handshake. This means that busy listener will not get too many
1316 1446 * new requests which they cannot handle in time while non-busy
1317 1447 * listener is still functioning properly.
1318 1448 */
1319 1449 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1320 1450 listener->tcp_conn_req_cnt_q0 > 0)) {
1321 1451 mutex_exit(&listener->tcp_eager_lock);
1322 1452 TCP_STAT(tcps, tcp_listen_mem_drop);
1323 1453 goto error2;
1324 1454 }
1325 1455
1326 1456 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1327 1457 mutex_exit(&listener->tcp_eager_lock);
1328 1458 TCP_STAT(tcps, tcp_listendrop);
1329 1459 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1330 1460 if (lconnp->conn_debug) {
1331 1461 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1332 1462 "tcp_input_listener: listen backlog (max=%d) "
1333 1463 "overflow (%d pending) on %s",
1334 1464 listener->tcp_conn_req_max,
1335 1465 listener->tcp_conn_req_cnt_q,
1336 1466 tcp_display(listener, NULL, DISP_PORT_ONLY));
1337 1467 }
1338 1468 goto error2;
1339 1469 }
1340 1470
1341 1471 if (listener->tcp_conn_req_cnt_q0 >=
1342 1472 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1343 1473 /*
1344 1474 * Q0 is full. Drop a pending half-open req from the queue
1345 1475 * to make room for the new SYN req. Also mark the time we
1346 1476 * drop a SYN.
1347 1477 *
1348 1478 * A more aggressive defense against SYN attack will
1349 1479 * be to set the "tcp_syn_defense" flag now.
1350 1480 */
1351 1481 TCP_STAT(tcps, tcp_listendropq0);
1352 1482 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1353 1483 if (!tcp_drop_q0(listener)) {
1354 1484 mutex_exit(&listener->tcp_eager_lock);
1355 1485 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1356 1486 if (lconnp->conn_debug) {
1357 1487 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1358 1488 "tcp_input_listener: listen half-open "
1359 1489 "queue (max=%d) full (%d pending) on %s",
1360 1490 tcps->tcps_conn_req_max_q0,
1361 1491 listener->tcp_conn_req_cnt_q0,
1362 1492 tcp_display(listener, NULL,
1363 1493 DISP_PORT_ONLY));
1364 1494 }
1365 1495 goto error2;
1366 1496 }
1367 1497 }
1368 1498
1369 1499 /*
1370 1500 * Enforce the limit set on the number of connections per listener.
1371 1501 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1372 1502 * for comparison.
1373 1503 */
1374 1504 if (listener->tcp_listen_cnt != NULL) {
1375 1505 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1376 1506 int64_t now;
1377 1507
1378 1508 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1379 1509 mutex_exit(&listener->tcp_eager_lock);
1380 1510 now = ddi_get_lbolt64();
1381 1511 atomic_dec_32(&tlc->tlc_cnt);
1382 1512 TCP_STAT(tcps, tcp_listen_cnt_drop);
1383 1513 tlc->tlc_drop++;
1384 1514 if (now - tlc->tlc_report_time >
1385 1515 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1386 1516 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1387 1517 "Listener (port %d) connection max (%u) "
1388 1518 "reached: %u attempts dropped total\n",
1389 1519 ntohs(listener->tcp_connp->conn_lport),
1390 1520 tlc->tlc_max, tlc->tlc_drop);
1391 1521 tlc->tlc_report_time = now;
1392 1522 }
1393 1523 goto error2;
1394 1524 }
1395 1525 tlc_set = B_TRUE;
1396 1526 }
1397 1527
1398 1528 mutex_exit(&listener->tcp_eager_lock);
1399 1529
1400 1530 /*
1401 1531 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1402 1532 * or based on the ring (for packets from GLD). Otherwise it is
1403 1533 * set based on lbolt i.e., a somewhat random number.
1404 1534 */
1405 1535 ASSERT(ira->ira_sqp != NULL);
1406 1536 new_sqp = ira->ira_sqp;
1407 1537
1408 1538 econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1409 1539 if (econnp == NULL)
1410 1540 goto error2;
1411 1541
1412 1542 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1413 1543 econnp->conn_sqp = new_sqp;
1414 1544 econnp->conn_initial_sqp = new_sqp;
1415 1545 econnp->conn_ixa->ixa_sqp = new_sqp;
1416 1546
1417 1547 econnp->conn_fport = tcpha->tha_lport;
1418 1548 econnp->conn_lport = tcpha->tha_fport;
1419 1549
1420 1550 err = conn_inherit_parent(lconnp, econnp);
1421 1551 if (err != 0)
1422 1552 goto error3;
1423 1553
1424 1554 /* We already know the laddr of the new connection is ours */
1425 1555 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1426 1556
1427 1557 ASSERT(OK_32PTR(mp->b_rptr));
1428 1558 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1429 1559 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1430 1560
1431 1561 if (lconnp->conn_family == AF_INET) {
1432 1562 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1433 1563 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1434 1564 } else {
1435 1565 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1436 1566 }
1437 1567
1438 1568 if (tpi_mp == NULL)
1439 1569 goto error3;
1440 1570
1441 1571 eager = econnp->conn_tcp;
1442 1572 eager->tcp_detached = B_TRUE;
1443 1573 SOCK_CONNID_INIT(eager->tcp_connid);
1444 1574
1445 1575 /*
1446 1576 * Initialize the eager's tcp_t and inherit some parameters from
1447 1577 * the listener.
1448 1578 */
1449 1579 tcp_init_values(eager, listener);
1450 1580
1451 1581 ASSERT((econnp->conn_ixa->ixa_flags &
1452 1582 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1453 1583 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1454 1584 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1455 1585 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1456 1586
1457 1587 if (!tcps->tcps_dev_flow_ctl)
1458 1588 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1459 1589
1460 1590 /* Prepare for diffing against previous packets */
1461 1591 eager->tcp_recvifindex = 0;
1462 1592 eager->tcp_recvhops = 0xffffffffU;
1463 1593
1464 1594 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1465 1595 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1466 1596 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1467 1597 econnp->conn_incoming_ifindex = ifindex;
1468 1598 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1469 1599 econnp->conn_ixa->ixa_scopeid = ifindex;
1470 1600 }
1471 1601 }
1472 1602
1473 1603 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1474 1604 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1475 1605 tcps->tcps_rev_src_routes) {
1476 1606 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1477 1607 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1478 1608
1479 1609 /* Source routing option copyover (reverse it) */
1480 1610 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1481 1611 if (err != 0) {
1482 1612 freemsg(tpi_mp);
1483 1613 goto error3;
1484 1614 }
1485 1615 ip_pkt_source_route_reverse_v4(ipp);
1486 1616 }
1487 1617
1488 1618 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1489 1619 ASSERT(!eager->tcp_tconnind_started);
1490 1620 /*
1491 1621 * If the SYN came with a credential, it's a loopback packet or a
1492 1622 * labeled packet; attach the credential to the TPI message.
1493 1623 */
1494 1624 if (ira->ira_cred != NULL)
1495 1625 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1496 1626
1497 1627 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1498 1628 ASSERT(eager->tcp_ordrel_mp == NULL);
1499 1629
1500 1630 /* Inherit the listener's non-STREAMS flag */
1501 1631 if (IPCL_IS_NONSTR(lconnp)) {
1502 1632 econnp->conn_flags |= IPCL_NONSTR;
1503 1633 /* All non-STREAMS tcp_ts are sockets */
1504 1634 eager->tcp_issocket = B_TRUE;
1505 1635 } else {
1506 1636 /*
1507 1637 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1508 1638 * at close time, we will always have that to send up.
1509 1639 * Otherwise, we need to do special handling in case the
1510 1640 * allocation fails at that time.
1511 1641 */
1512 1642 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1513 1643 goto error3;
1514 1644 }
1515 1645 /*
1516 1646 * Now that the IP addresses and ports are setup in econnp we
1517 1647 * can do the IPsec policy work.
1518 1648 */
1519 1649 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1520 1650 if (lconnp->conn_policy != NULL) {
1521 1651 /*
1522 1652 * Inherit the policy from the listener; use
1523 1653 * actions from ira
1524 1654 */
1525 1655 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1526 1656 CONN_DEC_REF(econnp);
1527 1657 freemsg(mp);
1528 1658 goto error3;
1529 1659 }
1530 1660 }
1531 1661 }
1532 1662
1533 1663 /*
1534 1664 * tcp_set_destination() may set tcp_rwnd according to the route
1535 1665 * metrics. If it does not, the eager's receive window will be set
1536 1666 * to the listener's receive window later in this function.
1537 1667 */
1538 1668 eager->tcp_rwnd = 0;
1539 1669
1540 1670 if (is_system_labeled()) {
1541 1671 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1542 1672
1543 1673 ASSERT(ira->ira_tsl != NULL);
1544 1674 /* Discard any old label */
1545 1675 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1546 1676 ASSERT(ixa->ixa_tsl != NULL);
1547 1677 label_rele(ixa->ixa_tsl);
1548 1678 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1549 1679 ixa->ixa_tsl = NULL;
1550 1680 }
1551 1681 if ((lconnp->conn_mlp_type != mlptSingle ||
1552 1682 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1553 1683 ira->ira_tsl != NULL) {
1554 1684 /*
1555 1685 * If this is an MLP connection or a MAC-Exempt
1556 1686 * connection with an unlabeled node, packets are to be
1557 1687 * exchanged using the security label of the received
1558 1688 * SYN packet instead of the server application's label.
1559 1689 * tsol_check_dest called from ip_set_destination
1560 1690 * might later update TSF_UNLABELED by replacing
1561 1691 * ixa_tsl with a new label.
1562 1692 */
1563 1693 label_hold(ira->ira_tsl);
1564 1694 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1565 1695 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1566 1696 econnp, ts_label_t *, ixa->ixa_tsl)
1567 1697 } else {
1568 1698 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1569 1699 DTRACE_PROBE2(syn_accept, conn_t *,
1570 1700 econnp, ts_label_t *, ixa->ixa_tsl)
1571 1701 }
1572 1702 /*
1573 1703 * conn_connect() called from tcp_set_destination will verify
1574 1704 * the destination is allowed to receive packets at the
1575 1705 * security label of the SYN-ACK we are generating. As part of
1576 1706 * that, tsol_check_dest() may create a new effective label for
1577 1707 * this connection.
1578 1708 * Finally conn_connect() will call conn_update_label.
1579 1709 * All that remains for TCP to do is to call
1580 1710 * conn_build_hdr_template which is done as part of
1581 1711 * tcp_set_destination.
1582 1712 */
1583 1713 }
1584 1714
1585 1715 /*
1586 1716 * Since we will clear tcp_listener before we clear tcp_detached
1587 1717 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1588 1718 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1589 1719 */
1590 1720 eager->tcp_hard_binding = B_TRUE;
1591 1721
1592 1722 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1593 1723 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1594 1724
1595 1725 CL_INET_CONNECT(econnp, B_FALSE, err);
1596 1726 if (err != 0) {
1597 1727 tcp_bind_hash_remove(eager);
1598 1728 goto error3;
1599 1729 }
1600 1730
1601 1731 SOCK_CONNID_BUMP(eager->tcp_connid);
1602 1732
1603 1733 /*
1604 1734 * Adapt our mss, ttl, ... based on the remote address.
1605 1735 */
1606 1736
1607 1737 if (tcp_set_destination(eager) != 0) {
1608 1738 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1609 1739 /* Undo the bind_hash_insert */
1610 1740 tcp_bind_hash_remove(eager);
1611 1741 goto error3;
1612 1742 }
1613 1743
1614 1744 /* Process all TCP options. */
1615 1745 tcp_process_options(eager, tcpha);
1616 1746
1617 1747 /* Is the other end ECN capable? */
1618 1748 if (tcps->tcps_ecn_permitted >= 1 &&
1619 1749 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1620 1750 eager->tcp_ecn_ok = B_TRUE;
1621 1751 }
1622 1752
1623 1753 /*
1624 1754 * The listener's conn_rcvbuf should be the default window size or a
1625 1755 * window size changed via SO_RCVBUF option. First round up the
1626 1756 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1627 1757 * scale option value if needed. Call tcp_rwnd_set() to finish the
1628 1758 * setting.
1629 1759 *
1630 1760 * Note if there is a rpipe metric associated with the remote host,
1631 1761 * we should not inherit receive window size from listener.
1632 1762 */
1633 1763 eager->tcp_rwnd = MSS_ROUNDUP(
1634 1764 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1635 1765 eager->tcp_rwnd), eager->tcp_mss);
1636 1766 if (eager->tcp_snd_ws_ok)
1637 1767 tcp_set_ws_value(eager);
1638 1768 /*
1639 1769 * Note that this is the only place tcp_rwnd_set() is called for
1640 1770 * accepting a connection. We need to call it here instead of
1641 1771 * after the 3-way handshake because we need to tell the other
1642 1772 * side our rwnd in the SYN-ACK segment.
1643 1773 */
1644 1774 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1645 1775
1646 1776 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1647 1777 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1648 1778
1649 1779 ASSERT(econnp->conn_rcvbuf != 0 &&
1650 1780 econnp->conn_rcvbuf == eager->tcp_rwnd);
1651 1781
1652 1782 /* Put a ref on the listener for the eager. */
1653 1783 CONN_INC_REF(lconnp);
1654 1784 mutex_enter(&listener->tcp_eager_lock);
1655 1785 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1656 1786 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1657 1787 listener->tcp_eager_next_q0 = eager;
1658 1788 eager->tcp_eager_prev_q0 = listener;
1659 1789
1660 1790 /* Set tcp_listener before adding it to tcp_conn_fanout */
1661 1791 eager->tcp_listener = listener;
1662 1792 eager->tcp_saved_listener = listener;
1663 1793
1664 1794 /*
1665 1795 * Set tcp_listen_cnt so that when the connection is done, the counter
1666 1796 * is decremented.
1667 1797 */
1668 1798 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1669 1799
1670 1800 /*
1671 1801 * Tag this detached tcp vector for later retrieval
1672 1802 * by our listener client in tcp_accept().
1673 1803 */
1674 1804 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1675 1805 listener->tcp_conn_req_cnt_q0++;
1676 1806 if (++listener->tcp_conn_req_seqnum == -1) {
1677 1807 /*
1678 1808 * -1 is "special" and defined in TPI as something
1679 1809 * that should never be used in T_CONN_IND
1680 1810 */
1681 1811 ++listener->tcp_conn_req_seqnum;
1682 1812 }
1683 1813 mutex_exit(&listener->tcp_eager_lock);
1684 1814
1685 1815 if (listener->tcp_syn_defense) {
1686 1816 /* Don't drop the SYN that comes from a good IP source */
1687 1817 ipaddr_t *addr_cache;
1688 1818
1689 1819 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1690 1820 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1691 1821 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1692 1822 eager->tcp_dontdrop = B_TRUE;
1693 1823 }
1694 1824 }
1695 1825
1696 1826 /*
1697 1827 * We need to insert the eager in its own perimeter but as soon
1698 1828 * as we do that, we expose the eager to the classifier and
1699 1829 * should not touch any field outside the eager's perimeter.
1700 1830 * So do all the work necessary before inserting the eager
1701 1831 * in its own perimeter. Be optimistic that conn_connect()
1702 1832 * will succeed but undo everything if it fails.
1703 1833 */
1704 1834 seg_seq = ntohl(tcpha->tha_seq);
1705 1835 eager->tcp_irs = seg_seq;
1706 1836 eager->tcp_rack = seg_seq;
1707 1837 eager->tcp_rnxt = seg_seq + 1;
1708 1838 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1709 1839 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1710 1840 eager->tcp_state = TCPS_SYN_RCVD;
1711 1841 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1712 1842 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1713 1843 int32_t, TCPS_LISTEN);
1714 1844
1715 1845 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1716 1846 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1717 1847 if (mp1 == NULL) {
1718 1848 /*
1719 1849 * Increment the ref count as we are going to
1720 1850 * enqueueing an mp in squeue
1721 1851 */
1722 1852 CONN_INC_REF(econnp);
1723 1853 goto error;
1724 1854 }
1725 1855
1726 1856 /*
1727 1857 * We need to start the rto timer. In normal case, we start
1728 1858 * the timer after sending the packet on the wire (or at
1729 1859 * least believing that packet was sent by waiting for
1730 1860 * conn_ip_output() to return). Since this is the first packet
1731 1861 * being sent on the wire for the eager, our initial tcp_rto
1732 1862 * is at least tcp_rexmit_interval_min which is a fairly
1733 1863 * large value to allow the algorithm to adjust slowly to large
1734 1864 * fluctuations of RTT during first few transmissions.
1735 1865 *
1736 1866 * Starting the timer first and then sending the packet in this
1737 1867 * case shouldn't make much difference since tcp_rexmit_interval_min
1738 1868 * is of the order of several 100ms and starting the timer
1739 1869 * first and then sending the packet will result in difference
1740 1870 * of few micro seconds.
1741 1871 *
1742 1872 * Without this optimization, we are forced to hold the fanout
1743 1873 * lock across the ipcl_bind_insert() and sending the packet
1744 1874 * so that we don't race against an incoming packet (maybe RST)
1745 1875 * for this eager.
1746 1876 *
1747 1877 * It is necessary to acquire an extra reference on the eager
1748 1878 * at this point and hold it until after tcp_send_data() to
1749 1879 * ensure against an eager close race.
1750 1880 */
1751 1881
1752 1882 CONN_INC_REF(econnp);
1753 1883
1754 1884 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1755 1885
1756 1886 /*
1757 1887 * Insert the eager in its own perimeter now. We are ready to deal
1758 1888 * with any packets on eager.
1759 1889 */
1760 1890 if (ipcl_conn_insert(econnp) != 0)
1761 1891 goto error;
1762 1892
1763 1893 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1764 1894 freemsg(mp);
1765 1895 /*
1766 1896 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1767 1897 * only used by one thread at a time.
1768 1898 */
1769 1899 if (econnp->conn_sqp == lconnp->conn_sqp) {
1770 1900 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1771 1901 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1772 1902 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1773 1903 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1774 1904 (void) conn_ip_output(mp1, econnp->conn_ixa);
1775 1905 CONN_DEC_REF(econnp);
1776 1906 } else {
1777 1907 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1778 1908 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1779 1909 }
1780 1910 return;
1781 1911 error:
1782 1912 freemsg(mp1);
1783 1913 eager->tcp_closemp_used = B_TRUE;
1784 1914 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1785 1915 mp1 = &eager->tcp_closemp;
1786 1916 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1787 1917 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1788 1918
1789 1919 /*
1790 1920 * If a connection already exists, send the mp to that connections so
1791 1921 * that it can be appropriately dealt with.
1792 1922 */
1793 1923 ipst = tcps->tcps_netstack->netstack_ip;
1794 1924
1795 1925 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1796 1926 if (!IPCL_IS_CONNECTED(econnp)) {
1797 1927 /*
1798 1928 * Something bad happened. ipcl_conn_insert()
1799 1929 * failed because a connection already existed
1800 1930 * in connected hash but we can't find it
1801 1931 * anymore (someone blew it away). Just
1802 1932 * free this message and hopefully remote
1803 1933 * will retransmit at which time the SYN can be
1804 1934 * treated as a new connection or dealth with
1805 1935 * a TH_RST if a connection already exists.
1806 1936 */
1807 1937 CONN_DEC_REF(econnp);
1808 1938 freemsg(mp);
1809 1939 } else {
1810 1940 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1811 1941 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1812 1942 }
1813 1943 } else {
1814 1944 /* Nobody wants this packet */
1815 1945 freemsg(mp);
1816 1946 }
1817 1947 return;
1818 1948 error3:
1819 1949 CONN_DEC_REF(econnp);
1820 1950 error2:
1821 1951 freemsg(mp);
1822 1952 if (tlc_set)
1823 1953 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1824 1954 }
1825 1955
1826 1956 /*
1827 1957 * In an ideal case of vertical partition in NUMA architecture, its
1828 1958 * beneficial to have the listener and all the incoming connections
1829 1959 * tied to the same squeue. The other constraint is that incoming
1830 1960 * connections should be tied to the squeue attached to interrupted
1831 1961 * CPU for obvious locality reason so this leaves the listener to
1832 1962 * be tied to the same squeue. Our only problem is that when listener
1833 1963 * is binding, the CPU that will get interrupted by the NIC whose
1834 1964 * IP address the listener is binding to is not even known. So
1835 1965 * the code below allows us to change that binding at the time the
1836 1966 * CPU is interrupted by virtue of incoming connection's squeue.
1837 1967 *
1838 1968 * This is usefull only in case of a listener bound to a specific IP
1839 1969 * address. For other kind of listeners, they get bound the
1840 1970 * very first time and there is no attempt to rebind them.
1841 1971 */
1842 1972 void
1843 1973 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1844 1974 ip_recv_attr_t *ira)
1845 1975 {
1846 1976 conn_t *connp = (conn_t *)arg;
1847 1977 squeue_t *sqp = (squeue_t *)arg2;
1848 1978 squeue_t *new_sqp;
1849 1979 uint32_t conn_flags;
1850 1980
1851 1981 /*
1852 1982 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1853 1983 * or based on the ring (for packets from GLD). Otherwise it is
1854 1984 * set based on lbolt i.e., a somewhat random number.
1855 1985 */
1856 1986 ASSERT(ira->ira_sqp != NULL);
1857 1987 new_sqp = ira->ira_sqp;
1858 1988
1859 1989 if (connp->conn_fanout == NULL)
1860 1990 goto done;
1861 1991
1862 1992 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1863 1993 mutex_enter(&connp->conn_fanout->connf_lock);
1864 1994 mutex_enter(&connp->conn_lock);
1865 1995 /*
1866 1996 * No one from read or write side can access us now
1867 1997 * except for already queued packets on this squeue.
1868 1998 * But since we haven't changed the squeue yet, they
1869 1999 * can't execute. If they are processed after we have
1870 2000 * changed the squeue, they are sent back to the
1871 2001 * correct squeue down below.
1872 2002 * But a listner close can race with processing of
1873 2003 * incoming SYN. If incoming SYN processing changes
1874 2004 * the squeue then the listener close which is waiting
1875 2005 * to enter the squeue would operate on the wrong
1876 2006 * squeue. Hence we don't change the squeue here unless
1877 2007 * the refcount is exactly the minimum refcount. The
1878 2008 * minimum refcount of 4 is counted as - 1 each for
1879 2009 * TCP and IP, 1 for being in the classifier hash, and
1880 2010 * 1 for the mblk being processed.
1881 2011 */
1882 2012
1883 2013 if (connp->conn_ref != 4 ||
1884 2014 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1885 2015 mutex_exit(&connp->conn_lock);
1886 2016 mutex_exit(&connp->conn_fanout->connf_lock);
1887 2017 goto done;
1888 2018 }
1889 2019 if (connp->conn_sqp != new_sqp) {
1890 2020 while (connp->conn_sqp != new_sqp)
1891 2021 (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
1892 2022 new_sqp);
1893 2023 /* No special MT issues for outbound ixa_sqp hint */
1894 2024 connp->conn_ixa->ixa_sqp = new_sqp;
1895 2025 }
1896 2026
1897 2027 do {
1898 2028 conn_flags = connp->conn_flags;
1899 2029 conn_flags |= IPCL_FULLY_BOUND;
1900 2030 (void) atomic_cas_32(&connp->conn_flags,
1901 2031 connp->conn_flags, conn_flags);
1902 2032 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1903 2033
1904 2034 mutex_exit(&connp->conn_fanout->connf_lock);
1905 2035 mutex_exit(&connp->conn_lock);
1906 2036
1907 2037 /*
1908 2038 * Assume we have picked a good squeue for the listener. Make
1909 2039 * subsequent SYNs not try to change the squeue.
1910 2040 */
1911 2041 connp->conn_recv = tcp_input_listener;
1912 2042 }
1913 2043
1914 2044 done:
1915 2045 if (connp->conn_sqp != sqp) {
1916 2046 CONN_INC_REF(connp);
1917 2047 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1918 2048 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1919 2049 } else {
1920 2050 tcp_input_listener(connp, mp, sqp, ira);
1921 2051 }
1922 2052 }
1923 2053
1924 2054 /*
1925 2055 * Send up all messages queued on tcp_rcv_list.
1926 2056 */
1927 2057 uint_t
1928 2058 tcp_rcv_drain(tcp_t *tcp)
1929 2059 {
1930 2060 mblk_t *mp;
1931 2061 uint_t ret = 0;
1932 2062 #ifdef DEBUG
1933 2063 uint_t cnt = 0;
1934 2064 #endif
1935 2065 queue_t *q = tcp->tcp_connp->conn_rq;
1936 2066
1937 2067 /* Can't drain on an eager connection */
1938 2068 if (tcp->tcp_listener != NULL)
1939 2069 return (ret);
1940 2070
1941 2071 /* Can't be a non-STREAMS connection */
1942 2072 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1943 2073
1944 2074 /* No need for the push timer now. */
1945 2075 if (tcp->tcp_push_tid != 0) {
1946 2076 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1947 2077 tcp->tcp_push_tid = 0;
1948 2078 }
1949 2079
1950 2080 /*
1951 2081 * Handle two cases here: we are currently fused or we were
1952 2082 * previously fused and have some urgent data to be delivered
1953 2083 * upstream. The latter happens because we either ran out of
1954 2084 * memory or were detached and therefore sending the SIGURG was
1955 2085 * deferred until this point. In either case we pass control
1956 2086 * over to tcp_fuse_rcv_drain() since it may need to complete
1957 2087 * some work.
1958 2088 */
1959 2089 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
1960 2090 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
1961 2091 &tcp->tcp_fused_sigurg_mp))
1962 2092 return (ret);
1963 2093 }
1964 2094
1965 2095 while ((mp = tcp->tcp_rcv_list) != NULL) {
1966 2096 tcp->tcp_rcv_list = mp->b_next;
1967 2097 mp->b_next = NULL;
1968 2098 #ifdef DEBUG
1969 2099 cnt += msgdsize(mp);
1970 2100 #endif
1971 2101 putnext(q, mp);
1972 2102 }
1973 2103 #ifdef DEBUG
1974 2104 ASSERT(cnt == tcp->tcp_rcv_cnt);
1975 2105 #endif
1976 2106 tcp->tcp_rcv_last_head = NULL;
1977 2107 tcp->tcp_rcv_last_tail = NULL;
1978 2108 tcp->tcp_rcv_cnt = 0;
1979 2109
1980 2110 if (canputnext(q))
1981 2111 return (tcp_rwnd_reopen(tcp));
1982 2112
1983 2113 return (ret);
1984 2114 }
1985 2115
1986 2116 /*
1987 2117 * Queue data on tcp_rcv_list which is a b_next chain.
1988 2118 * tcp_rcv_last_head/tail is the last element of this chain.
1989 2119 * Each element of the chain is a b_cont chain.
1990 2120 *
1991 2121 * M_DATA messages are added to the current element.
1992 2122 * Other messages are added as new (b_next) elements.
1993 2123 */
1994 2124 void
1995 2125 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
1996 2126 {
1997 2127 ASSERT(seg_len == msgdsize(mp));
1998 2128 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
1999 2129
2000 2130 if (is_system_labeled()) {
2001 2131 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2002 2132 /*
2003 2133 * Provide for protocols above TCP such as RPC. NOPID leaves
2004 2134 * db_cpid unchanged.
2005 2135 * The cred could have already been set.
2006 2136 */
2007 2137 if (cr != NULL)
2008 2138 mblk_setcred(mp, cr, NOPID);
2009 2139 }
2010 2140
2011 2141 if (tcp->tcp_rcv_list == NULL) {
2012 2142 ASSERT(tcp->tcp_rcv_last_head == NULL);
2013 2143 tcp->tcp_rcv_list = mp;
2014 2144 tcp->tcp_rcv_last_head = mp;
2015 2145 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2016 2146 tcp->tcp_rcv_last_tail->b_cont = mp;
2017 2147 } else {
2018 2148 tcp->tcp_rcv_last_head->b_next = mp;
2019 2149 tcp->tcp_rcv_last_head = mp;
2020 2150 }
2021 2151
2022 2152 while (mp->b_cont)
2023 2153 mp = mp->b_cont;
2024 2154
2025 2155 tcp->tcp_rcv_last_tail = mp;
2026 2156 tcp->tcp_rcv_cnt += seg_len;
2027 2157 tcp->tcp_rwnd -= seg_len;
2028 2158 }
2029 2159
2030 2160 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2031 2161 mblk_t *
2032 2162 tcp_ack_mp(tcp_t *tcp)
2033 2163 {
2034 2164 uint32_t seq_no;
2035 2165 tcp_stack_t *tcps = tcp->tcp_tcps;
2036 2166 conn_t *connp = tcp->tcp_connp;
2037 2167
2038 2168 /*
2039 2169 * There are a few cases to be considered while setting the sequence no.
2040 2170 * Essentially, we can come here while processing an unacceptable pkt
2041 2171 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2042 2172 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2043 2173 * If we are here for a zero window probe, stick with suna. In all
2044 2174 * other cases, we check if suna + swnd encompasses snxt and set
2045 2175 * the sequence number to snxt, if so. If snxt falls outside the
2046 2176 * window (the receiver probably shrunk its window), we will go with
2047 2177 * suna + swnd, otherwise the sequence no will be unacceptable to the
2048 2178 * receiver.
2049 2179 */
2050 2180 if (tcp->tcp_zero_win_probe) {
2051 2181 seq_no = tcp->tcp_suna;
2052 2182 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2053 2183 ASSERT(tcp->tcp_swnd == 0);
2054 2184 seq_no = tcp->tcp_snxt;
2055 2185 } else {
2056 2186 seq_no = SEQ_GT(tcp->tcp_snxt,
2057 2187 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2058 2188 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2059 2189 }
2060 2190
2061 2191 if (tcp->tcp_valid_bits) {
2062 2192 /*
2063 2193 * For the complex case where we have to send some
2064 2194 * controls (FIN or SYN), let tcp_xmit_mp do it.
2065 2195 */
2066 2196 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2067 2197 NULL, B_FALSE));
2068 2198 } else {
2069 2199 /* Generate a simple ACK */
2070 2200 int data_length;
2071 2201 uchar_t *rptr;
2072 2202 tcpha_t *tcpha;
2073 2203 mblk_t *mp1;
2074 2204 int32_t total_hdr_len;
2075 2205 int32_t tcp_hdr_len;
2076 2206 int32_t num_sack_blk = 0;
2077 2207 int32_t sack_opt_len;
2078 2208 ip_xmit_attr_t *ixa = connp->conn_ixa;
2079 2209
2080 2210 /*
2081 2211 * Allocate space for TCP + IP headers
2082 2212 * and link-level header
2083 2213 */
2084 2214 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2085 2215 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2086 2216 tcp->tcp_num_sack_blk);
2087 2217 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2088 2218 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2089 2219 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2090 2220 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2091 2221 } else {
2092 2222 total_hdr_len = connp->conn_ht_iphc_len;
2093 2223 tcp_hdr_len = connp->conn_ht_ulp_len;
2094 2224 }
2095 2225 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2096 2226 if (!mp1)
2097 2227 return (NULL);
2098 2228
2099 2229 /* Update the latest receive window size in TCP header. */
2100 2230 tcp->tcp_tcpha->tha_win =
2101 2231 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2102 2232 /* copy in prototype TCP + IP header */
2103 2233 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2104 2234 mp1->b_rptr = rptr;
2105 2235 mp1->b_wptr = rptr + total_hdr_len;
2106 2236 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2107 2237
2108 2238 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2109 2239
2110 2240 /* Set the TCP sequence number. */
2111 2241 tcpha->tha_seq = htonl(seq_no);
2112 2242
2113 2243 /* Set up the TCP flag field. */
2114 2244 tcpha->tha_flags = (uchar_t)TH_ACK;
2115 2245 if (tcp->tcp_ecn_echo_on)
2116 2246 tcpha->tha_flags |= TH_ECE;
2117 2247
2118 2248 tcp->tcp_rack = tcp->tcp_rnxt;
2119 2249 tcp->tcp_rack_cnt = 0;
2120 2250
2121 2251 /* fill in timestamp option if in use */
2122 2252 if (tcp->tcp_snd_ts_ok) {
2123 2253 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2124 2254
2125 2255 U32_TO_BE32(llbolt,
2126 2256 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2127 2257 U32_TO_BE32(tcp->tcp_ts_recent,
2128 2258 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2129 2259 }
2130 2260
2131 2261 /* Fill in SACK options */
2132 2262 if (num_sack_blk > 0) {
2133 2263 uchar_t *wptr = (uchar_t *)tcpha +
2134 2264 connp->conn_ht_ulp_len;
2135 2265 sack_blk_t *tmp;
2136 2266 int32_t i;
2137 2267
2138 2268 wptr[0] = TCPOPT_NOP;
2139 2269 wptr[1] = TCPOPT_NOP;
2140 2270 wptr[2] = TCPOPT_SACK;
2141 2271 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2142 2272 sizeof (sack_blk_t);
2143 2273 wptr += TCPOPT_REAL_SACK_LEN;
2144 2274
2145 2275 tmp = tcp->tcp_sack_list;
2146 2276 for (i = 0; i < num_sack_blk; i++) {
2147 2277 U32_TO_BE32(tmp[i].begin, wptr);
2148 2278 wptr += sizeof (tcp_seq);
2149 2279 U32_TO_BE32(tmp[i].end, wptr);
2150 2280 wptr += sizeof (tcp_seq);
2151 2281 }
2152 2282 tcpha->tha_offset_and_reserved +=
2153 2283 ((num_sack_blk * 2 + 1) << 4);
2154 2284 }
2155 2285
2156 2286 ixa->ixa_pktlen = total_hdr_len;
2157 2287
2158 2288 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2159 2289 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2160 2290 } else {
2161 2291 ip6_t *ip6 = (ip6_t *)rptr;
2162 2292
2163 2293 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2164 2294 }
2165 2295
2166 2296 /*
2167 2297 * Prime pump for checksum calculation in IP. Include the
2168 2298 * adjustment for a source route if any.
2169 2299 */
2170 2300 data_length = tcp_hdr_len + connp->conn_sum;
2171 2301 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2172 2302 tcpha->tha_sum = htons(data_length);
2173 2303
2174 2304 if (tcp->tcp_ip_forward_progress) {
2175 2305 tcp->tcp_ip_forward_progress = B_FALSE;
2176 2306 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2177 2307 } else {
2178 2308 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2179 2309 }
2180 2310 return (mp1);
2181 2311 }
2182 2312 }
2183 2313
2184 2314 /*
2185 2315 * Dummy socket upcalls for if/when the conn_t gets detached from a
2186 2316 * direct-callback sonode via a user-driven close(). Easy to catch with
2187 2317 * DTrace FBT, and should be mostly harmless.
2188 2318 */
2189 2319
2190 2320 /* ARGSUSED */
2191 2321 static sock_upper_handle_t
2192 2322 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2193 2323 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2194 2324 {
2195 2325 ASSERT(0); /* Panic in debug, otherwise ignore. */
2196 2326 return (NULL);
2197 2327 }
2198 2328
2199 2329 /* ARGSUSED */
2200 2330 static void
2201 2331 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2202 2332 pid_t pid)
2203 2333 {
2204 2334 ASSERT(x == NULL);
2205 2335 /* Normally we'd crhold(cr) and attach it to socket state. */
2206 2336 /* LINTED */
2207 2337 }
2208 2338
2209 2339 /* ARGSUSED */
2210 2340 static int
2211 2341 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2212 2342 {
2213 2343 ASSERT(0); /* Panic in debug, otherwise ignore. */
2214 2344 return (-1);
2215 2345 }
2216 2346
2217 2347 /* ARGSUSED */
2218 2348 static void
2219 2349 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2220 2350 {
2221 2351 ASSERT(x == NULL);
2222 2352 /* We really want this one to be a harmless NOP for now. */
2223 2353 /* LINTED */
2224 2354 }
2225 2355
2226 2356 /* ARGSUSED */
2227 2357 static ssize_t
2228 2358 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2229 2359 int *error, boolean_t *push)
2230 2360 {
2231 2361 ASSERT(x == NULL);
2232 2362
2233 2363 /*
2234 2364 * Consume the message, set ESHUTDOWN, and return an error.
2235 2365 * Nobody's home!
2236 2366 */
2237 2367 freemsg(mp);
2238 2368 *error = ESHUTDOWN;
2239 2369 return (-1);
2240 2370 }
2241 2371
2242 2372 /* ARGSUSED */
2243 2373 static void
2244 2374 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2245 2375 {
2246 2376 ASSERT(0); /* Panic in debug, otherwise ignore. */
2247 2377 }
2248 2378
2249 2379 /* ARGSUSED */
2250 2380 static void
2251 2381 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2252 2382 {
2253 2383 ASSERT(0); /* Panic in debug, otherwise ignore. */
2254 2384 }
2255 2385
2256 2386 /* ARGSUSED */
2257 2387 static void
2258 2388 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2259 2389 {
2260 2390 ASSERT(x == NULL);
2261 2391 /* Otherwise, this would signal socket state about OOB data. */
2262 2392 }
2263 2393
2264 2394 /* ARGSUSED */
2265 2395 static void
2266 2396 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2267 2397 {
2268 2398 ASSERT(0); /* Panic in debug, otherwise ignore. */
2269 2399 }
2270 2400
2271 2401 /* ARGSUSED */
2272 2402 static void
2273 2403 tcp_dummy_onearg(sock_upper_handle_t x)
2274 2404 {
2275 2405 ASSERT(0); /* Panic in debug, otherwise ignore. */
2276 2406 }
2277 2407
2278 2408 static sock_upcalls_t tcp_dummy_upcalls = {
2279 2409 tcp_dummy_newconn,
2280 2410 tcp_dummy_connected,
2281 2411 tcp_dummy_disconnected,
2282 2412 tcp_dummy_opctl,
2283 2413 tcp_dummy_recv,
2284 2414 tcp_dummy_set_proto_props,
2285 2415 tcp_dummy_txq_full,
2286 2416 tcp_dummy_signal_oob,
2287 2417 tcp_dummy_onearg,
2288 2418 tcp_dummy_set_error,
2289 2419 tcp_dummy_onearg
2290 2420 };
2291 2421
2292 2422 /*
2293 2423 * Handle M_DATA messages from IP. Its called directly from IP via
2294 2424 * squeue for received IP packets.
2295 2425 *
2296 2426 * The first argument is always the connp/tcp to which the mp belongs.
2297 2427 * There are no exceptions to this rule. The caller has already put
2298 2428 * a reference on this connp/tcp and once tcp_input_data() returns,
2299 2429 * the squeue will do the refrele.
2300 2430 *
2301 2431 * The TH_SYN for the listener directly go to tcp_input_listener via
2302 2432 * squeue. ICMP errors go directly to tcp_icmp_input().
2303 2433 *
2304 2434 * sqp: NULL = recursive, sqp != NULL means called from squeue
2305 2435 */
2306 2436 void
2307 2437 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2308 2438 {
2309 2439 int32_t bytes_acked;
2310 2440 int32_t gap;
2311 2441 mblk_t *mp1;
2312 2442 uint_t flags;
2313 2443 uint32_t new_swnd = 0;
2314 2444 uchar_t *iphdr;
2315 2445 uchar_t *rptr;
2316 2446 int32_t rgap;
|
↓ open down ↓ |
1704 lines elided |
↑ open up ↑ |
2317 2447 uint32_t seg_ack;
2318 2448 int seg_len;
2319 2449 uint_t ip_hdr_len;
2320 2450 uint32_t seg_seq;
2321 2451 tcpha_t *tcpha;
2322 2452 int urp;
2323 2453 tcp_opt_t tcpopt;
2324 2454 ip_pkt_t ipp;
2325 2455 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2326 2456 uint32_t cwnd;
2327 - uint32_t add;
2328 - int npkt;
2329 2457 int mss;
2330 2458 conn_t *connp = (conn_t *)arg;
2331 2459 squeue_t *sqp = (squeue_t *)arg2;
2332 2460 tcp_t *tcp = connp->conn_tcp;
2333 2461 tcp_stack_t *tcps = tcp->tcp_tcps;
2334 2462 sock_upcalls_t *sockupcalls;
2335 2463
2336 2464 /*
2337 2465 * RST from fused tcp loopback peer should trigger an unfuse.
2338 2466 */
2339 2467 if (tcp->tcp_fused) {
2340 2468 TCP_STAT(tcps, tcp_fusion_aborted);
2341 2469 tcp_unfuse(tcp);
2342 2470 }
2343 2471
2344 2472 iphdr = mp->b_rptr;
2345 2473 rptr = mp->b_rptr;
2346 2474 ASSERT(OK_32PTR(rptr));
2347 2475
2348 2476 ip_hdr_len = ira->ira_ip_hdr_length;
2349 2477 if (connp->conn_recv_ancillary.crb_all != 0) {
2350 2478 /*
2351 2479 * Record packet information in the ip_pkt_t
2352 2480 */
2353 2481 ipp.ipp_fields = 0;
2354 2482 if (ira->ira_flags & IRAF_IS_IPV4) {
2355 2483 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2356 2484 B_FALSE);
2357 2485 } else {
2358 2486 uint8_t nexthdrp;
2359 2487
2360 2488 /*
2361 2489 * IPv6 packets can only be received by applications
2362 2490 * that are prepared to receive IPv6 addresses.
2363 2491 * The IP fanout must ensure this.
2364 2492 */
2365 2493 ASSERT(connp->conn_family == AF_INET6);
2366 2494
2367 2495 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2368 2496 &nexthdrp);
2369 2497 ASSERT(nexthdrp == IPPROTO_TCP);
2370 2498
2371 2499 /* Could have caused a pullup? */
2372 2500 iphdr = mp->b_rptr;
2373 2501 rptr = mp->b_rptr;
2374 2502 }
2375 2503 }
2376 2504 ASSERT(DB_TYPE(mp) == M_DATA);
2377 2505 ASSERT(mp->b_next == NULL);
2378 2506
2379 2507 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2380 2508 seg_seq = ntohl(tcpha->tha_seq);
2381 2509 seg_ack = ntohl(tcpha->tha_ack);
2382 2510 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2383 2511 seg_len = (int)(mp->b_wptr - rptr) -
2384 2512 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2385 2513 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2386 2514 do {
2387 2515 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2388 2516 (uintptr_t)INT_MAX);
2389 2517 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2390 2518 } while ((mp1 = mp1->b_cont) != NULL &&
2391 2519 mp1->b_datap->db_type == M_DATA);
2392 2520 }
2393 2521
2394 2522 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2395 2523 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2396 2524 __dtrace_tcp_tcph_t *, tcpha);
2397 2525
2398 2526 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2399 2527 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2400 2528 seg_len, tcpha, ira);
2401 2529 return;
2402 2530 }
2403 2531
2404 2532 if (sqp != NULL) {
2405 2533 /*
2406 2534 * This is the correct place to update tcp_last_recv_time. Note
|
↓ open down ↓ |
68 lines elided |
↑ open up ↑ |
2407 2535 * that it is also updated for tcp structure that belongs to
2408 2536 * global and listener queues which do not really need updating.
2409 2537 * But that should not cause any harm. And it is updated for
2410 2538 * all kinds of incoming segments, not only for data segments.
2411 2539 */
2412 2540 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2413 2541 }
2414 2542
2415 2543 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2416 2544
2417 - BUMP_LOCAL(tcp->tcp_ibsegs);
2545 + TCPS_BUMP_MIB(tcps, tcpHCInSegs);
2418 2546 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2419 2547
2420 2548 if ((flags & TH_URG) && sqp != NULL) {
2421 2549 /*
2422 2550 * TCP can't handle urgent pointers that arrive before
2423 2551 * the connection has been accept()ed since it can't
2424 2552 * buffer OOB data. Discard segment if this happens.
2425 2553 *
2426 2554 * We can't just rely on a non-null tcp_listener to indicate
2427 2555 * that the accept() has completed since unlinking of the
2428 2556 * eager and completion of the accept are not atomic.
2429 2557 * tcp_detached, when it is not set (B_FALSE) indicates
2430 2558 * that the accept() has completed.
2431 2559 *
2432 2560 * Nor can it reassemble urgent pointers, so discard
2433 2561 * if it's not the next segment expected.
2434 2562 *
2435 2563 * Otherwise, collapse chain into one mblk (discard if
2436 2564 * that fails). This makes sure the headers, retransmitted
2437 2565 * data, and new data all are in the same mblk.
2438 2566 */
2439 2567 ASSERT(mp != NULL);
2440 2568 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2441 2569 freemsg(mp);
2442 2570 return;
2443 2571 }
2444 2572 /* Update pointers into message */
2445 2573 iphdr = rptr = mp->b_rptr;
2446 2574 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2447 2575 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2448 2576 /*
2449 2577 * Since we can't handle any data with this urgent
2450 2578 * pointer that is out of sequence, we expunge
2451 2579 * the data. This allows us to still register
2452 2580 * the urgent mark and generate the M_PCSIG,
2453 2581 * which we can do.
2454 2582 */
2455 2583 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2456 2584 seg_len = 0;
2457 2585 }
2458 2586 }
2459 2587
2460 2588 sockupcalls = connp->conn_upcalls;
2461 2589 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2462 2590 if (sockupcalls == NULL)
2463 2591 sockupcalls = &tcp_dummy_upcalls;
2464 2592
2465 2593 switch (tcp->tcp_state) {
2466 2594 case TCPS_SYN_SENT:
2467 2595 if (connp->conn_final_sqp == NULL &&
2468 2596 tcp_outbound_squeue_switch && sqp != NULL) {
2469 2597 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2470 2598 connp->conn_final_sqp = sqp;
2471 2599 if (connp->conn_final_sqp != connp->conn_sqp) {
2472 2600 DTRACE_PROBE1(conn__final__sqp__switch,
2473 2601 conn_t *, connp);
2474 2602 CONN_INC_REF(connp);
2475 2603 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2476 2604 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2477 2605 tcp_input_data, connp, ira, ip_squeue_flag,
2478 2606 SQTAG_CONNECT_FINISH);
2479 2607 return;
2480 2608 }
2481 2609 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2482 2610 }
2483 2611 if (flags & TH_ACK) {
2484 2612 /*
2485 2613 * Note that our stack cannot send data before a
2486 2614 * connection is established, therefore the
2487 2615 * following check is valid. Otherwise, it has
2488 2616 * to be changed.
2489 2617 */
2490 2618 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2491 2619 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2492 2620 freemsg(mp);
2493 2621 if (flags & TH_RST)
2494 2622 return;
2495 2623 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2496 2624 tcp, seg_ack, 0, TH_RST);
2497 2625 return;
2498 2626 }
2499 2627 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2500 2628 }
2501 2629 if (flags & TH_RST) {
2502 2630 if (flags & TH_ACK) {
2503 2631 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2504 2632 ip_xmit_attr_t *, connp->conn_ixa,
2505 2633 void_ip_t *, iphdr, tcp_t *, tcp,
2506 2634 tcph_t *, tcpha);
2507 2635 (void) tcp_clean_death(tcp, ECONNREFUSED);
2508 2636 }
2509 2637 freemsg(mp);
2510 2638 return;
2511 2639 }
2512 2640 if (!(flags & TH_SYN)) {
2513 2641 freemsg(mp);
2514 2642 return;
2515 2643 }
2516 2644
2517 2645 /* Process all TCP options. */
2518 2646 tcp_process_options(tcp, tcpha);
2519 2647 /*
2520 2648 * The following changes our rwnd to be a multiple of the
2521 2649 * MIN(peer MSS, our MSS) for performance reason.
2522 2650 */
2523 2651 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2524 2652 tcp->tcp_mss));
2525 2653
2526 2654 /* Is the other end ECN capable? */
2527 2655 if (tcp->tcp_ecn_ok) {
2528 2656 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2529 2657 tcp->tcp_ecn_ok = B_FALSE;
2530 2658 }
2531 2659 }
2532 2660 /*
2533 2661 * Clear ECN flags because it may interfere with later
2534 2662 * processing.
2535 2663 */
2536 2664 flags &= ~(TH_ECE|TH_CWR);
2537 2665
2538 2666 tcp->tcp_irs = seg_seq;
2539 2667 tcp->tcp_rack = seg_seq;
2540 2668 tcp->tcp_rnxt = seg_seq + 1;
2541 2669 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2542 2670 if (!TCP_IS_DETACHED(tcp)) {
2543 2671 /* Allocate room for SACK options if needed. */
2544 2672 connp->conn_wroff = connp->conn_ht_iphc_len;
2545 2673 if (tcp->tcp_snd_sack_ok)
2546 2674 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2547 2675 if (!tcp->tcp_loopback)
2548 2676 connp->conn_wroff += tcps->tcps_wroff_xtra;
2549 2677
2550 2678 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2551 2679 connp->conn_wroff);
2552 2680 }
2553 2681 if (flags & TH_ACK) {
2554 2682 /*
2555 2683 * If we can't get the confirmation upstream, pretend
2556 2684 * we didn't even see this one.
2557 2685 *
2558 2686 * XXX: how can we pretend we didn't see it if we
2559 2687 * have updated rnxt et. al.
2560 2688 *
2561 2689 * For loopback we defer sending up the T_CONN_CON
2562 2690 * until after some checks below.
2563 2691 */
2564 2692 mp1 = NULL;
2565 2693 /*
2566 2694 * tcp_sendmsg() checks tcp_state without entering
2567 2695 * the squeue so tcp_state should be updated before
2568 2696 * sending up connection confirmation. Probe the
2569 2697 * state change below when we are sure the connection
2570 2698 * confirmation has been sent.
2571 2699 */
2572 2700 tcp->tcp_state = TCPS_ESTABLISHED;
2573 2701 if (!tcp_conn_con(tcp, iphdr, mp,
2574 2702 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2575 2703 tcp->tcp_state = TCPS_SYN_SENT;
2576 2704 freemsg(mp);
2577 2705 return;
2578 2706 }
2579 2707 TCPS_CONN_INC(tcps);
2580 2708 /* SYN was acked - making progress */
2581 2709 tcp->tcp_ip_forward_progress = B_TRUE;
2582 2710
2583 2711 /* One for the SYN */
2584 2712 tcp->tcp_suna = tcp->tcp_iss + 1;
2585 2713 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2586 2714
2587 2715 /*
2588 2716 * If SYN was retransmitted, need to reset all
2589 2717 * retransmission info. This is because this
2590 2718 * segment will be treated as a dup ACK.
2591 2719 */
2592 2720 if (tcp->tcp_rexmit) {
2593 2721 tcp->tcp_rexmit = B_FALSE;
|
↓ open down ↓ |
166 lines elided |
↑ open up ↑ |
2594 2722 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2595 2723 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2596 2724 tcp->tcp_ms_we_have_waited = 0;
2597 2725
2598 2726 /*
2599 2727 * Set tcp_cwnd back to 1 MSS, per
2600 2728 * recommendation from
2601 2729 * draft-floyd-incr-init-win-01.txt,
2602 2730 * Increasing TCP's Initial Window.
2603 2731 */
2732 + DTRACE_PROBE3(cwnd__retransmitted__syn,
2733 + tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
2734 + uint32_t, tcp->tcp_mss);
2604 2735 tcp->tcp_cwnd = tcp->tcp_mss;
2605 2736 }
2606 2737
2607 2738 tcp->tcp_swl1 = seg_seq;
2608 2739 tcp->tcp_swl2 = seg_ack;
2609 2740
2610 2741 new_swnd = ntohs(tcpha->tha_win);
2611 2742 tcp->tcp_swnd = new_swnd;
2612 2743 if (new_swnd > tcp->tcp_max_swnd)
2613 2744 tcp->tcp_max_swnd = new_swnd;
2614 2745
2615 2746 /*
2616 2747 * Always send the three-way handshake ack immediately
2617 2748 * in order to make the connection complete as soon as
2618 2749 * possible on the accepting host.
2619 2750 */
2620 2751 flags |= TH_ACK_NEEDED;
2621 2752
2622 2753 /*
2623 2754 * Trace connect-established here.
2624 2755 */
2625 2756 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2626 2757 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2627 2758 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2628 2759
2629 2760 /* Trace change from SYN_SENT -> ESTABLISHED here */
2630 2761 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2631 2762 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2632 2763 void, NULL, int32_t, TCPS_SYN_SENT);
2633 2764
2634 2765 /*
2635 2766 * Special case for loopback. At this point we have
2636 2767 * received SYN-ACK from the remote endpoint. In
2637 2768 * order to ensure that both endpoints reach the
2638 2769 * fused state prior to any data exchange, the final
2639 2770 * ACK needs to be sent before we indicate T_CONN_CON
2640 2771 * to the module upstream.
2641 2772 */
2642 2773 if (tcp->tcp_loopback) {
2643 2774 mblk_t *ack_mp;
2644 2775
2645 2776 ASSERT(!tcp->tcp_unfusable);
2646 2777 ASSERT(mp1 != NULL);
2647 2778 /*
2648 2779 * For loopback, we always get a pure SYN-ACK
2649 2780 * and only need to send back the final ACK
2650 2781 * with no data (this is because the other
2651 2782 * tcp is ours and we don't do T/TCP). This
|
↓ open down ↓ |
38 lines elided |
↑ open up ↑ |
2652 2783 * final ACK triggers the passive side to
2653 2784 * perform fusion in ESTABLISHED state.
2654 2785 */
2655 2786 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2656 2787 if (tcp->tcp_ack_tid != 0) {
2657 2788 (void) TCP_TIMER_CANCEL(tcp,
2658 2789 tcp->tcp_ack_tid);
2659 2790 tcp->tcp_ack_tid = 0;
2660 2791 }
2661 2792 tcp_send_data(tcp, ack_mp);
2662 - BUMP_LOCAL(tcp->tcp_obsegs);
2793 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
2663 2794 TCPS_BUMP_MIB(tcps, tcpOutAck);
2664 2795
2665 2796 if (!IPCL_IS_NONSTR(connp)) {
2666 2797 /* Send up T_CONN_CON */
2667 2798 if (ira->ira_cred != NULL) {
2668 2799 mblk_setcred(mp1,
2669 2800 ira->ira_cred,
2670 2801 ira->ira_cpid);
2671 2802 }
2672 2803 putnext(connp->conn_rq, mp1);
2673 2804 } else {
2674 2805 (*sockupcalls->su_connected)
2675 2806 (connp->conn_upper_handle,
2676 2807 tcp->tcp_connid,
2677 2808 ira->ira_cred,
2678 2809 ira->ira_cpid);
2679 2810 freemsg(mp1);
2680 2811 }
2681 2812
2682 2813 freemsg(mp);
2683 2814 return;
2684 2815 }
2685 2816 /*
2686 2817 * Forget fusion; we need to handle more
2687 2818 * complex cases below. Send the deferred
2688 2819 * T_CONN_CON message upstream and proceed
2689 2820 * as usual. Mark this tcp as not capable
2690 2821 * of fusion.
2691 2822 */
2692 2823 TCP_STAT(tcps, tcp_fusion_unfusable);
2693 2824 tcp->tcp_unfusable = B_TRUE;
2694 2825 if (!IPCL_IS_NONSTR(connp)) {
2695 2826 if (ira->ira_cred != NULL) {
2696 2827 mblk_setcred(mp1, ira->ira_cred,
2697 2828 ira->ira_cpid);
2698 2829 }
2699 2830 putnext(connp->conn_rq, mp1);
2700 2831 } else {
2701 2832 (*sockupcalls->su_connected)
2702 2833 (connp->conn_upper_handle,
2703 2834 tcp->tcp_connid, ira->ira_cred,
2704 2835 ira->ira_cpid);
2705 2836 freemsg(mp1);
2706 2837 }
2707 2838 }
2708 2839
2709 2840 /*
2710 2841 * Check to see if there is data to be sent. If
2711 2842 * yes, set the transmit flag. Then check to see
2712 2843 * if received data processing needs to be done.
2713 2844 * If not, go straight to xmit_check. This short
2714 2845 * cut is OK as we don't support T/TCP.
2715 2846 */
2716 2847 if (tcp->tcp_unsent)
2717 2848 flags |= TH_XMIT_NEEDED;
2718 2849
2719 2850 if (seg_len == 0 && !(flags & TH_URG)) {
2720 2851 freemsg(mp);
2721 2852 goto xmit_check;
2722 2853 }
2723 2854
2724 2855 flags &= ~TH_SYN;
2725 2856 seg_seq++;
2726 2857 break;
2727 2858 }
2728 2859 tcp->tcp_state = TCPS_SYN_RCVD;
2729 2860 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2730 2861 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2731 2862 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2732 2863 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2733 2864 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2734 2865 if (mp1 != NULL) {
2735 2866 tcp_send_data(tcp, mp1);
2736 2867 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2737 2868 }
2738 2869 freemsg(mp);
2739 2870 return;
2740 2871 case TCPS_SYN_RCVD:
2741 2872 if (flags & TH_ACK) {
2742 2873 uint32_t pinit_wnd;
2743 2874
2744 2875 /*
2745 2876 * In this state, a SYN|ACK packet is either bogus
2746 2877 * because the other side must be ACKing our SYN which
2747 2878 * indicates it has seen the ACK for their SYN and
2748 2879 * shouldn't retransmit it or we're crossing SYNs
2749 2880 * on active open.
2750 2881 */
2751 2882 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2752 2883 freemsg(mp);
2753 2884 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2754 2885 tcp, seg_ack, 0, TH_RST);
2755 2886 return;
2756 2887 }
2757 2888 /*
2758 2889 * NOTE: RFC 793 pg. 72 says this should be
2759 2890 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2760 2891 * but that would mean we have an ack that ignored
2761 2892 * our SYN.
2762 2893 */
2763 2894 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2764 2895 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2765 2896 freemsg(mp);
2766 2897 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2767 2898 tcp, seg_ack, 0, TH_RST);
2768 2899 return;
2769 2900 }
2770 2901 /*
2771 2902 * No sane TCP stack will send such a small window
2772 2903 * without receiving any data. Just drop this invalid
2773 2904 * ACK. We also shorten the abort timeout in case
2774 2905 * this is an attack.
2775 2906 */
2776 2907 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2777 2908 if (pinit_wnd < tcp->tcp_mss &&
2778 2909 pinit_wnd < tcp_init_wnd_chk) {
2779 2910 freemsg(mp);
2780 2911 TCP_STAT(tcps, tcp_zwin_ack_syn);
2781 2912 tcp->tcp_second_ctimer_threshold =
2782 2913 tcp_early_abort * SECONDS;
2783 2914 return;
2784 2915 }
2785 2916 }
2786 2917 break;
2787 2918 case TCPS_LISTEN:
2788 2919 /*
2789 2920 * Only a TLI listener can come through this path when a
2790 2921 * acceptor is going back to be a listener and a packet
2791 2922 * for the acceptor hits the classifier. For a socket
2792 2923 * listener, this can never happen because a listener
2793 2924 * can never accept connection on itself and hence a
2794 2925 * socket acceptor can not go back to being a listener.
2795 2926 */
2796 2927 ASSERT(!TCP_IS_SOCKET(tcp));
2797 2928 /*FALLTHRU*/
2798 2929 case TCPS_CLOSED:
2799 2930 case TCPS_BOUND: {
2800 2931 conn_t *new_connp;
2801 2932 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2802 2933
2803 2934 /*
2804 2935 * Don't accept any input on a closed tcp as this TCP logically
2805 2936 * does not exist on the system. Don't proceed further with
2806 2937 * this TCP. For instance, this packet could trigger another
2807 2938 * close of this tcp which would be disastrous for tcp_refcnt.
2808 2939 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2809 2940 * be called at most once on a TCP. In this case we need to
2810 2941 * refeed the packet into the classifier and figure out where
2811 2942 * the packet should go.
2812 2943 */
2813 2944 new_connp = ipcl_classify(mp, ira, ipst);
2814 2945 if (new_connp != NULL) {
2815 2946 /* Drops ref on new_connp */
2816 2947 tcp_reinput(new_connp, mp, ira, ipst);
2817 2948 return;
2818 2949 }
2819 2950 /* We failed to classify. For now just drop the packet */
2820 2951 freemsg(mp);
2821 2952 return;
2822 2953 }
2823 2954 case TCPS_IDLE:
2824 2955 /*
2825 2956 * Handle the case where the tcp_clean_death() has happened
2826 2957 * on a connection (application hasn't closed yet) but a packet
2827 2958 * was already queued on squeue before tcp_clean_death()
2828 2959 * was processed. Calling tcp_clean_death() twice on same
2829 2960 * connection can result in weird behaviour.
2830 2961 */
2831 2962 freemsg(mp);
2832 2963 return;
2833 2964 default:
2834 2965 break;
2835 2966 }
2836 2967
2837 2968 /*
2838 2969 * Already on the correct queue/perimeter.
2839 2970 * If this is a detached connection and not an eager
2840 2971 * connection hanging off a listener then new data
2841 2972 * (past the FIN) will cause a reset.
2842 2973 * We do a special check here where it
2843 2974 * is out of the main line, rather than check
2844 2975 * if we are detached every time we see new
2845 2976 * data down below.
2846 2977 */
2847 2978 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2848 2979 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2849 2980 TCPS_BUMP_MIB(tcps, tcpInClosed);
2850 2981 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2851 2982 freemsg(mp);
2852 2983 tcp_xmit_ctl("new data when detached", tcp,
2853 2984 tcp->tcp_snxt, 0, TH_RST);
2854 2985 (void) tcp_clean_death(tcp, EPROTO);
2855 2986 return;
2856 2987 }
2857 2988
2858 2989 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2859 2990 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2860 2991 new_swnd = ntohs(tcpha->tha_win) <<
2861 2992 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2862 2993
2863 2994 /*
2864 2995 * We are interested in two TCP options: timestamps (if negotiated) and
2865 2996 * SACK (if negotiated). Skip option parsing if neither is negotiated.
2866 2997 */
2867 2998 if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok) {
2868 2999 int options;
2869 3000 if (tcp->tcp_snd_sack_ok)
2870 3001 tcpopt.tcp = tcp;
2871 3002 else
2872 3003 tcpopt.tcp = NULL;
2873 3004 options = tcp_parse_options(tcpha, &tcpopt);
2874 3005 /*
2875 3006 * RST segments must not be subject to PAWS and are not
2876 3007 * required to have timestamps.
2877 3008 * We do not drop keepalive segments without
2878 3009 * timestamps, to maintain compatibility with legacy TCP stacks.
2879 3010 */
2880 3011 boolean_t keepalive = (seg_len == 0 || seg_len == 1) &&
2881 3012 (seg_seq + 1 == tcp->tcp_rnxt);
2882 3013 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) {
2883 3014 /*
2884 3015 * Per RFC 7323 section 3.2., silently drop non-RST
2885 3016 * segments without expected TSopt. This is a 'SHOULD'
2886 3017 * requirement.
2887 3018 * We accept keepalives without TSopt to maintain
2888 3019 * interoperability with tcp implementations that omit
2889 3020 * the TSopt on these. Keepalive data is discarded, so
2890 3021 * there is no risk corrupting data by accepting these.
2891 3022 */
2892 3023 if (!(options & TCP_OPT_TSTAMP_PRESENT)) {
2893 3024 /*
2894 3025 * Leave a breadcrumb for people to detect this
2895 3026 * behavior.
2896 3027 */
2897 3028 DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp);
2898 3029 freemsg(mp);
2899 3030 return;
2900 3031 }
2901 3032
2902 3033 if (!tcp_paws_check(tcp, &tcpopt)) {
2903 3034 /*
2904 3035 * This segment is not acceptable.
2905 3036 * Drop it and send back an ACK.
2906 3037 */
2907 3038 freemsg(mp);
2908 3039 flags |= TH_ACK_NEEDED;
2909 3040 goto ack_check;
2910 3041 }
2911 3042 }
2912 3043 }
2913 3044 try_again:;
2914 3045 mss = tcp->tcp_mss;
2915 3046 gap = seg_seq - tcp->tcp_rnxt;
2916 3047 rgap = tcp->tcp_rwnd - (gap + seg_len);
2917 3048 /*
2918 3049 * gap is the amount of sequence space between what we expect to see
2919 3050 * and what we got for seg_seq. A positive value for gap means
2920 3051 * something got lost. A negative value means we got some old stuff.
2921 3052 */
2922 3053 if (gap < 0) {
2923 3054 /* Old stuff present. Is the SYN in there? */
2924 3055 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2925 3056 (seg_len != 0)) {
2926 3057 flags &= ~TH_SYN;
2927 3058 seg_seq++;
2928 3059 urp--;
2929 3060 /* Recompute the gaps after noting the SYN. */
2930 3061 goto try_again;
2931 3062 }
2932 3063 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2933 3064 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2934 3065 (seg_len > -gap ? -gap : seg_len));
2935 3066 /* Remove the old stuff from seg_len. */
2936 3067 seg_len += gap;
2937 3068 /*
2938 3069 * Anything left?
2939 3070 * Make sure to check for unack'd FIN when rest of data
2940 3071 * has been previously ack'd.
2941 3072 */
2942 3073 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2943 3074 /*
2944 3075 * Resets are only valid if they lie within our offered
2945 3076 * window. If the RST bit is set, we just ignore this
2946 3077 * segment.
2947 3078 */
2948 3079 if (flags & TH_RST) {
2949 3080 freemsg(mp);
2950 3081 return;
2951 3082 }
2952 3083
2953 3084 /*
2954 3085 * The arriving of dup data packets indicate that we
2955 3086 * may have postponed an ack for too long, or the other
2956 3087 * side's RTT estimate is out of shape. Start acking
2957 3088 * more often.
2958 3089 */
2959 3090 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2960 3091 tcp->tcp_rack_cnt >= 1 &&
2961 3092 tcp->tcp_rack_abs_max > 2) {
2962 3093 tcp->tcp_rack_abs_max--;
2963 3094 }
2964 3095 tcp->tcp_rack_cur_max = 1;
2965 3096
2966 3097 /*
2967 3098 * This segment is "unacceptable". None of its
2968 3099 * sequence space lies within our advertized window.
2969 3100 *
2970 3101 * Adjust seg_len to the original value for tracing.
2971 3102 */
2972 3103 seg_len -= gap;
2973 3104 if (connp->conn_debug) {
2974 3105 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2975 3106 "tcp_rput: unacceptable, gap %d, rgap %d, "
2976 3107 "flags 0x%x, seg_seq %u, seg_ack %u, "
2977 3108 "seg_len %d, rnxt %u, snxt %u, %s",
2978 3109 gap, rgap, flags, seg_seq, seg_ack,
2979 3110 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
2980 3111 tcp_display(tcp, NULL,
2981 3112 DISP_ADDR_AND_PORT));
2982 3113 }
2983 3114
2984 3115 /*
2985 3116 * Arrange to send an ACK in response to the
2986 3117 * unacceptable segment per RFC 793 page 69. There
2987 3118 * is only one small difference between ours and the
2988 3119 * acceptability test in the RFC - we accept ACK-only
2989 3120 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
2990 3121 * will be generated.
2991 3122 *
2992 3123 * Note that we have to ACK an ACK-only packet at least
2993 3124 * for stacks that send 0-length keep-alives with
2994 3125 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
2995 3126 * section 4.2.3.6. As long as we don't ever generate
2996 3127 * an unacceptable packet in response to an incoming
2997 3128 * packet that is unacceptable, it should not cause
2998 3129 * "ACK wars".
2999 3130 */
3000 3131 flags |= TH_ACK_NEEDED;
3001 3132
3002 3133 /*
3003 3134 * Continue processing this segment in order to use the
3004 3135 * ACK information it contains, but skip all other
3005 3136 * sequence-number processing. Processing the ACK
3006 3137 * information is necessary in order to
3007 3138 * re-synchronize connections that may have lost
3008 3139 * synchronization.
3009 3140 *
3010 3141 * We clear seg_len and flag fields related to
3011 3142 * sequence number processing as they are not
3012 3143 * to be trusted for an unacceptable segment.
3013 3144 */
3014 3145 seg_len = 0;
3015 3146 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3016 3147 goto process_ack;
3017 3148 }
3018 3149
3019 3150 /* Fix seg_seq, and chew the gap off the front. */
3020 3151 seg_seq = tcp->tcp_rnxt;
3021 3152 urp += gap;
3022 3153 do {
3023 3154 mblk_t *mp2;
3024 3155 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3025 3156 (uintptr_t)UINT_MAX);
3026 3157 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3027 3158 if (gap > 0) {
3028 3159 mp->b_rptr = mp->b_wptr - gap;
3029 3160 break;
3030 3161 }
3031 3162 mp2 = mp;
3032 3163 mp = mp->b_cont;
3033 3164 freeb(mp2);
3034 3165 } while (gap < 0);
3035 3166 /*
3036 3167 * If the urgent data has already been acknowledged, we
3037 3168 * should ignore TH_URG below
3038 3169 */
3039 3170 if (urp < 0)
3040 3171 flags &= ~TH_URG;
|
↓ open down ↓ |
368 lines elided |
↑ open up ↑ |
3041 3172 }
3042 3173 /*
3043 3174 * rgap is the amount of stuff received out of window. A negative
3044 3175 * value is the amount out of window.
3045 3176 */
3046 3177 if (rgap < 0) {
3047 3178 mblk_t *mp2;
3048 3179
3049 3180 if (tcp->tcp_rwnd == 0) {
3050 3181 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3182 + tcp->tcp_cs.tcp_in_zwnd_probes++;
3051 3183 } else {
3052 3184 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3053 3185 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3054 3186 }
3055 3187
3056 3188 /*
3057 3189 * seg_len does not include the FIN, so if more than
3058 3190 * just the FIN is out of window, we act like we don't
3059 3191 * see it. (If just the FIN is out of window, rgap
3060 3192 * will be zero and we will go ahead and acknowledge
3061 3193 * the FIN.)
3062 3194 */
3063 3195 flags &= ~TH_FIN;
3064 3196
3065 3197 /* Fix seg_len and make sure there is something left. */
3066 3198 seg_len += rgap;
3067 3199 if (seg_len <= 0) {
3068 3200 /*
3069 3201 * Resets are only valid if they lie within our offered
3070 3202 * window. If the RST bit is set, we just ignore this
3071 3203 * segment.
3072 3204 */
3073 3205 if (flags & TH_RST) {
3074 3206 freemsg(mp);
3075 3207 return;
3076 3208 }
3077 3209
3078 3210 /* Per RFC 793, we need to send back an ACK. */
3079 3211 flags |= TH_ACK_NEEDED;
3080 3212
3081 3213 /*
3082 3214 * Send SIGURG as soon as possible i.e. even
3083 3215 * if the TH_URG was delivered in a window probe
3084 3216 * packet (which will be unacceptable).
3085 3217 *
3086 3218 * We generate a signal if none has been generated
3087 3219 * for this connection or if this is a new urgent
3088 3220 * byte. Also send a zero-length "unmarked" message
3089 3221 * to inform SIOCATMARK that this is not the mark.
3090 3222 *
3091 3223 * tcp_urp_last_valid is cleared when the T_exdata_ind
3092 3224 * is sent up. This plus the check for old data
3093 3225 * (gap >= 0) handles the wraparound of the sequence
3094 3226 * number space without having to always track the
3095 3227 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3096 3228 * this max in its rcv_up variable).
3097 3229 *
3098 3230 * This prevents duplicate SIGURGS due to a "late"
3099 3231 * zero-window probe when the T_EXDATA_IND has already
3100 3232 * been sent up.
3101 3233 */
3102 3234 if ((flags & TH_URG) &&
3103 3235 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3104 3236 tcp->tcp_urp_last))) {
3105 3237 if (IPCL_IS_NONSTR(connp)) {
3106 3238 if (!TCP_IS_DETACHED(tcp)) {
3107 3239 (*sockupcalls->su_signal_oob)
3108 3240 (connp->conn_upper_handle,
3109 3241 urp);
3110 3242 }
3111 3243 } else {
3112 3244 mp1 = allocb(0, BPRI_MED);
3113 3245 if (mp1 == NULL) {
3114 3246 freemsg(mp);
3115 3247 return;
3116 3248 }
3117 3249 if (!TCP_IS_DETACHED(tcp) &&
3118 3250 !putnextctl1(connp->conn_rq,
3119 3251 M_PCSIG, SIGURG)) {
3120 3252 /* Try again on the rexmit. */
3121 3253 freemsg(mp1);
3122 3254 freemsg(mp);
3123 3255 return;
3124 3256 }
3125 3257 /*
3126 3258 * If the next byte would be the mark
3127 3259 * then mark with MARKNEXT else mark
3128 3260 * with NOTMARKNEXT.
3129 3261 */
3130 3262 if (gap == 0 && urp == 0)
3131 3263 mp1->b_flag |= MSGMARKNEXT;
3132 3264 else
3133 3265 mp1->b_flag |= MSGNOTMARKNEXT;
3134 3266 freemsg(tcp->tcp_urp_mark_mp);
3135 3267 tcp->tcp_urp_mark_mp = mp1;
3136 3268 flags |= TH_SEND_URP_MARK;
3137 3269 }
3138 3270 tcp->tcp_urp_last_valid = B_TRUE;
3139 3271 tcp->tcp_urp_last = urp + seg_seq;
3140 3272 }
3141 3273 /*
3142 3274 * If this is a zero window probe, continue to
3143 3275 * process the ACK part. But we need to set seg_len
3144 3276 * to 0 to avoid data processing. Otherwise just
3145 3277 * drop the segment and send back an ACK.
3146 3278 */
3147 3279 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3148 3280 flags &= ~(TH_SYN | TH_URG);
3149 3281 seg_len = 0;
3150 3282 goto process_ack;
3151 3283 } else {
3152 3284 freemsg(mp);
3153 3285 goto ack_check;
3154 3286 }
3155 3287 }
3156 3288 /* Pitch out of window stuff off the end. */
3157 3289 rgap = seg_len;
3158 3290 mp2 = mp;
3159 3291 do {
3160 3292 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3161 3293 (uintptr_t)INT_MAX);
3162 3294 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3163 3295 if (rgap < 0) {
3164 3296 mp2->b_wptr += rgap;
3165 3297 if ((mp1 = mp2->b_cont) != NULL) {
3166 3298 mp2->b_cont = NULL;
3167 3299 freemsg(mp1);
3168 3300 }
3169 3301 break;
3170 3302 }
3171 3303 } while ((mp2 = mp2->b_cont) != NULL);
3172 3304 }
3173 3305 ok:;
3174 3306 /*
3175 3307 * TCP should check ECN info for segments inside the window only.
3176 3308 * Therefore the check should be done here.
3177 3309 */
3178 3310 if (tcp->tcp_ecn_ok) {
3179 3311 if (flags & TH_CWR) {
3180 3312 tcp->tcp_ecn_echo_on = B_FALSE;
3181 3313 }
3182 3314 /*
3183 3315 * Note that both ECN_CE and CWR can be set in the
3184 3316 * same segment. In this case, we once again turn
3185 3317 * on ECN_ECHO.
3186 3318 */
3187 3319 if (connp->conn_ipversion == IPV4_VERSION) {
3188 3320 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3189 3321
3190 3322 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3191 3323 tcp->tcp_ecn_echo_on = B_TRUE;
3192 3324 }
3193 3325 } else {
3194 3326 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3195 3327
3196 3328 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3197 3329 htonl(IPH_ECN_CE << 20)) {
3198 3330 tcp->tcp_ecn_echo_on = B_TRUE;
3199 3331 }
3200 3332 }
3201 3333 }
3202 3334
3203 3335 /*
3204 3336 * Check whether we can update tcp_ts_recent. This test is from RFC
3205 3337 * 7323, section 5.3.
3206 3338 */
3207 3339 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) &&
3208 3340 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3209 3341 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3210 3342 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3211 3343 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3212 3344 }
3213 3345
3214 3346 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3215 3347 /*
3216 3348 * FIN in an out of order segment. We record this in
3217 3349 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3218 3350 * Clear the FIN so that any check on FIN flag will fail.
3219 3351 * Remember that FIN also counts in the sequence number
3220 3352 * space. So we need to ack out of order FIN only segments.
3221 3353 */
3222 3354 if (flags & TH_FIN) {
3223 3355 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3224 3356 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3225 3357 flags &= ~TH_FIN;
3226 3358 flags |= TH_ACK_NEEDED;
3227 3359 }
3228 3360 if (seg_len > 0) {
3229 3361 /* Fill in the SACK blk list. */
3230 3362 if (tcp->tcp_snd_sack_ok) {
3231 3363 tcp_sack_insert(tcp->tcp_sack_list,
3232 3364 seg_seq, seg_seq + seg_len,
3233 3365 &(tcp->tcp_num_sack_blk));
3234 3366 }
3235 3367
3236 3368 /*
3237 3369 * Attempt reassembly and see if we have something
3238 3370 * ready to go.
3239 3371 */
3240 3372 mp = tcp_reass(tcp, mp, seg_seq);
3241 3373 /* Always ack out of order packets */
3242 3374 flags |= TH_ACK_NEEDED | TH_PUSH;
3243 3375 if (mp) {
3244 3376 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3245 3377 (uintptr_t)INT_MAX);
3246 3378 seg_len = mp->b_cont ? msgdsize(mp) :
3247 3379 (int)(mp->b_wptr - mp->b_rptr);
3248 3380 seg_seq = tcp->tcp_rnxt;
3249 3381 /*
3250 3382 * A gap is filled and the seq num and len
3251 3383 * of the gap match that of a previously
3252 3384 * received FIN, put the FIN flag back in.
3253 3385 */
3254 3386 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3255 3387 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3256 3388 flags |= TH_FIN;
3257 3389 tcp->tcp_valid_bits &=
3258 3390 ~TCP_OFO_FIN_VALID;
3259 3391 }
3260 3392 if (tcp->tcp_reass_tid != 0) {
3261 3393 (void) TCP_TIMER_CANCEL(tcp,
3262 3394 tcp->tcp_reass_tid);
3263 3395 /*
3264 3396 * Restart the timer if there is still
3265 3397 * data in the reassembly queue.
3266 3398 */
3267 3399 if (tcp->tcp_reass_head != NULL) {
3268 3400 tcp->tcp_reass_tid = TCP_TIMER(
3269 3401 tcp, tcp_reass_timer,
3270 3402 tcps->tcps_reass_timeout);
3271 3403 } else {
3272 3404 tcp->tcp_reass_tid = 0;
3273 3405 }
3274 3406 }
3275 3407 } else {
3276 3408 /*
3277 3409 * Keep going even with NULL mp.
3278 3410 * There may be a useful ACK or something else
3279 3411 * we don't want to miss.
3280 3412 *
3281 3413 * But TCP should not perform fast retransmit
3282 3414 * because of the ack number. TCP uses
3283 3415 * seg_len == 0 to determine if it is a pure
3284 3416 * ACK. And this is not a pure ACK.
3285 3417 */
3286 3418 seg_len = 0;
3287 3419 ofo_seg = B_TRUE;
3288 3420
3289 3421 if (tcps->tcps_reass_timeout != 0 &&
|
↓ open down ↓ |
229 lines elided |
↑ open up ↑ |
3290 3422 tcp->tcp_reass_tid == 0) {
3291 3423 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3292 3424 tcp_reass_timer,
3293 3425 tcps->tcps_reass_timeout);
3294 3426 }
3295 3427 }
3296 3428 }
3297 3429 } else if (seg_len > 0) {
3298 3430 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3299 3431 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3432 + tcp->tcp_cs.tcp_in_data_inorder_segs++;
3433 + tcp->tcp_cs.tcp_in_data_inorder_bytes += seg_len;
3434 +
3300 3435 /*
3301 3436 * If an out of order FIN was received before, and the seq
3302 3437 * num and len of the new segment match that of the FIN,
3303 3438 * put the FIN flag back in.
3304 3439 */
3305 3440 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3306 3441 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3307 3442 flags |= TH_FIN;
3308 3443 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3309 3444 }
3310 3445 }
3311 3446 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3312 3447 if (flags & TH_RST) {
3313 3448 freemsg(mp);
3314 3449 switch (tcp->tcp_state) {
3315 3450 case TCPS_SYN_RCVD:
3316 3451 (void) tcp_clean_death(tcp, ECONNREFUSED);
3317 3452 break;
3318 3453 case TCPS_ESTABLISHED:
3319 3454 case TCPS_FIN_WAIT_1:
3320 3455 case TCPS_FIN_WAIT_2:
3321 3456 case TCPS_CLOSE_WAIT:
3322 3457 (void) tcp_clean_death(tcp, ECONNRESET);
3323 3458 break;
3324 3459 case TCPS_CLOSING:
3325 3460 case TCPS_LAST_ACK:
3326 3461 (void) tcp_clean_death(tcp, 0);
3327 3462 break;
3328 3463 default:
3329 3464 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3330 3465 (void) tcp_clean_death(tcp, ENXIO);
3331 3466 break;
3332 3467 }
3333 3468 return;
3334 3469 }
3335 3470 if (flags & TH_SYN) {
3336 3471 /*
3337 3472 * See RFC 793, Page 71
3338 3473 *
3339 3474 * The seq number must be in the window as it should
3340 3475 * be "fixed" above. If it is outside window, it should
3341 3476 * be already rejected. Note that we allow seg_seq to be
3342 3477 * rnxt + rwnd because we want to accept 0 window probe.
3343 3478 */
3344 3479 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3345 3480 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3346 3481 freemsg(mp);
3347 3482 /*
3348 3483 * If the ACK flag is not set, just use our snxt as the
3349 3484 * seq number of the RST segment.
3350 3485 */
3351 3486 if (!(flags & TH_ACK)) {
3352 3487 seg_ack = tcp->tcp_snxt;
3353 3488 }
3354 3489 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
|
↓ open down ↓ |
45 lines elided |
↑ open up ↑ |
3355 3490 TH_RST|TH_ACK);
3356 3491 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3357 3492 (void) tcp_clean_death(tcp, ECONNRESET);
3358 3493 return;
3359 3494 }
3360 3495 /*
3361 3496 * urp could be -1 when the urp field in the packet is 0
3362 3497 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3363 3498 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3364 3499 */
3365 - if (flags & TH_URG && urp >= 0) {
3500 + if ((flags & TH_URG) && urp >= 0) {
3366 3501 if (!tcp->tcp_urp_last_valid ||
3367 3502 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3368 3503 /*
3369 3504 * Non-STREAMS sockets handle the urgent data a litte
3370 3505 * differently from STREAMS based sockets. There is no
3371 3506 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3372 3507 * flags to keep SIOCATMARK happy. Instead a
3373 3508 * su_signal_oob upcall is made to update the mark.
3374 3509 * Neither is a T_EXDATA_IND mblk needed to be
3375 3510 * prepended to the urgent data. The urgent data is
3376 3511 * delivered using the su_recv upcall, where we set
3377 3512 * the MSG_OOB flag to indicate that it is urg data.
3378 3513 *
3379 3514 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3380 3515 * are used by non-STREAMS sockets.
3381 3516 */
3382 3517 if (IPCL_IS_NONSTR(connp)) {
3383 3518 if (!TCP_IS_DETACHED(tcp)) {
3384 3519 (*sockupcalls->su_signal_oob)
3385 3520 (connp->conn_upper_handle, urp);
3386 3521 }
3387 3522 } else {
3388 3523 /*
3389 3524 * If we haven't generated the signal yet for
3390 3525 * this urgent pointer value, do it now. Also,
3391 3526 * send up a zero-length M_DATA indicating
3392 3527 * whether or not this is the mark. The latter
3393 3528 * is not needed when a T_EXDATA_IND is sent up.
3394 3529 * However, if there are allocation failures
3395 3530 * this code relies on the sender retransmitting
3396 3531 * and the socket code for determining the mark
3397 3532 * should not block waiting for the peer to
3398 3533 * transmit. Thus, for simplicity we always
3399 3534 * send up the mark indication.
3400 3535 */
3401 3536 mp1 = allocb(0, BPRI_MED);
3402 3537 if (mp1 == NULL) {
3403 3538 freemsg(mp);
3404 3539 return;
3405 3540 }
3406 3541 if (!TCP_IS_DETACHED(tcp) &&
3407 3542 !putnextctl1(connp->conn_rq, M_PCSIG,
3408 3543 SIGURG)) {
3409 3544 /* Try again on the rexmit. */
3410 3545 freemsg(mp1);
3411 3546 freemsg(mp);
3412 3547 return;
3413 3548 }
3414 3549 /*
3415 3550 * Mark with NOTMARKNEXT for now.
3416 3551 * The code below will change this to MARKNEXT
3417 3552 * if we are at the mark.
3418 3553 *
3419 3554 * If there are allocation failures (e.g. in
3420 3555 * dupmsg below) the next time tcp_input_data
3421 3556 * sees the urgent segment it will send up the
3422 3557 * MSGMARKNEXT message.
3423 3558 */
3424 3559 mp1->b_flag |= MSGNOTMARKNEXT;
3425 3560 freemsg(tcp->tcp_urp_mark_mp);
3426 3561 tcp->tcp_urp_mark_mp = mp1;
3427 3562 flags |= TH_SEND_URP_MARK;
3428 3563 #ifdef DEBUG
3429 3564 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3430 3565 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3431 3566 "last %x, %s",
3432 3567 seg_seq, urp, tcp->tcp_urp_last,
3433 3568 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3434 3569 #endif /* DEBUG */
3435 3570 }
3436 3571 tcp->tcp_urp_last_valid = B_TRUE;
3437 3572 tcp->tcp_urp_last = urp + seg_seq;
3438 3573 } else if (tcp->tcp_urp_mark_mp != NULL) {
3439 3574 /*
3440 3575 * An allocation failure prevented the previous
3441 3576 * tcp_input_data from sending up the allocated
3442 3577 * MSG*MARKNEXT message - send it up this time
3443 3578 * around.
3444 3579 */
3445 3580 flags |= TH_SEND_URP_MARK;
3446 3581 }
3447 3582
3448 3583 /*
3449 3584 * If the urgent byte is in this segment, make sure that it is
3450 3585 * all by itself. This makes it much easier to deal with the
3451 3586 * possibility of an allocation failure on the T_exdata_ind.
3452 3587 * Note that seg_len is the number of bytes in the segment, and
3453 3588 * urp is the offset into the segment of the urgent byte.
3454 3589 * urp < seg_len means that the urgent byte is in this segment.
3455 3590 */
3456 3591 if (urp < seg_len) {
3457 3592 if (seg_len != 1) {
3458 3593 uint32_t tmp_rnxt;
3459 3594 /*
3460 3595 * Break it up and feed it back in.
3461 3596 * Re-attach the IP header.
3462 3597 */
3463 3598 mp->b_rptr = iphdr;
3464 3599 if (urp > 0) {
3465 3600 /*
3466 3601 * There is stuff before the urgent
3467 3602 * byte.
3468 3603 */
3469 3604 mp1 = dupmsg(mp);
3470 3605 if (!mp1) {
3471 3606 /*
3472 3607 * Trim from urgent byte on.
3473 3608 * The rest will come back.
3474 3609 */
3475 3610 (void) adjmsg(mp,
3476 3611 urp - seg_len);
3477 3612 tcp_input_data(connp,
3478 3613 mp, NULL, ira);
3479 3614 return;
3480 3615 }
3481 3616 (void) adjmsg(mp1, urp - seg_len);
3482 3617 /* Feed this piece back in. */
3483 3618 tmp_rnxt = tcp->tcp_rnxt;
3484 3619 tcp_input_data(connp, mp1, NULL, ira);
3485 3620 /*
3486 3621 * If the data passed back in was not
3487 3622 * processed (ie: bad ACK) sending
3488 3623 * the remainder back in will cause a
3489 3624 * loop. In this case, drop the
3490 3625 * packet and let the sender try
3491 3626 * sending a good packet.
3492 3627 */
3493 3628 if (tmp_rnxt == tcp->tcp_rnxt) {
3494 3629 freemsg(mp);
3495 3630 return;
3496 3631 }
3497 3632 }
3498 3633 if (urp != seg_len - 1) {
3499 3634 uint32_t tmp_rnxt;
3500 3635 /*
3501 3636 * There is stuff after the urgent
3502 3637 * byte.
3503 3638 */
3504 3639 mp1 = dupmsg(mp);
3505 3640 if (!mp1) {
3506 3641 /*
3507 3642 * Trim everything beyond the
3508 3643 * urgent byte. The rest will
3509 3644 * come back.
3510 3645 */
3511 3646 (void) adjmsg(mp,
3512 3647 urp + 1 - seg_len);
3513 3648 tcp_input_data(connp,
3514 3649 mp, NULL, ira);
3515 3650 return;
3516 3651 }
3517 3652 (void) adjmsg(mp1, urp + 1 - seg_len);
3518 3653 tmp_rnxt = tcp->tcp_rnxt;
3519 3654 tcp_input_data(connp, mp1, NULL, ira);
3520 3655 /*
3521 3656 * If the data passed back in was not
3522 3657 * processed (ie: bad ACK) sending
3523 3658 * the remainder back in will cause a
3524 3659 * loop. In this case, drop the
3525 3660 * packet and let the sender try
3526 3661 * sending a good packet.
3527 3662 */
3528 3663 if (tmp_rnxt == tcp->tcp_rnxt) {
3529 3664 freemsg(mp);
3530 3665 return;
3531 3666 }
3532 3667 }
3533 3668 tcp_input_data(connp, mp, NULL, ira);
3534 3669 return;
3535 3670 }
3536 3671 /*
3537 3672 * This segment contains only the urgent byte. We
3538 3673 * have to allocate the T_exdata_ind, if we can.
3539 3674 */
3540 3675 if (IPCL_IS_NONSTR(connp)) {
3541 3676 int error;
3542 3677
3543 3678 (*sockupcalls->su_recv)
3544 3679 (connp->conn_upper_handle, mp, seg_len,
3545 3680 MSG_OOB, &error, NULL);
3546 3681 /*
3547 3682 * We should never be in middle of a
3548 3683 * fallback, the squeue guarantees that.
3549 3684 */
3550 3685 ASSERT(error != EOPNOTSUPP);
3551 3686 mp = NULL;
3552 3687 goto update_ack;
3553 3688 } else if (!tcp->tcp_urp_mp) {
3554 3689 struct T_exdata_ind *tei;
3555 3690 mp1 = allocb(sizeof (struct T_exdata_ind),
3556 3691 BPRI_MED);
3557 3692 if (!mp1) {
3558 3693 /*
3559 3694 * Sigh... It'll be back.
3560 3695 * Generate any MSG*MARK message now.
3561 3696 */
3562 3697 freemsg(mp);
3563 3698 seg_len = 0;
3564 3699 if (flags & TH_SEND_URP_MARK) {
3565 3700
3566 3701
3567 3702 ASSERT(tcp->tcp_urp_mark_mp);
3568 3703 tcp->tcp_urp_mark_mp->b_flag &=
3569 3704 ~MSGNOTMARKNEXT;
3570 3705 tcp->tcp_urp_mark_mp->b_flag |=
3571 3706 MSGMARKNEXT;
3572 3707 }
3573 3708 goto ack_check;
3574 3709 }
3575 3710 mp1->b_datap->db_type = M_PROTO;
3576 3711 tei = (struct T_exdata_ind *)mp1->b_rptr;
3577 3712 tei->PRIM_type = T_EXDATA_IND;
3578 3713 tei->MORE_flag = 0;
3579 3714 mp1->b_wptr = (uchar_t *)&tei[1];
3580 3715 tcp->tcp_urp_mp = mp1;
3581 3716 #ifdef DEBUG
3582 3717 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3583 3718 "tcp_rput: allocated exdata_ind %s",
3584 3719 tcp_display(tcp, NULL,
3585 3720 DISP_PORT_ONLY));
3586 3721 #endif /* DEBUG */
3587 3722 /*
3588 3723 * There is no need to send a separate MSG*MARK
3589 3724 * message since the T_EXDATA_IND will be sent
3590 3725 * now.
3591 3726 */
3592 3727 flags &= ~TH_SEND_URP_MARK;
3593 3728 freemsg(tcp->tcp_urp_mark_mp);
3594 3729 tcp->tcp_urp_mark_mp = NULL;
3595 3730 }
3596 3731 /*
3597 3732 * Now we are all set. On the next putnext upstream,
3598 3733 * tcp_urp_mp will be non-NULL and will get prepended
3599 3734 * to what has to be this piece containing the urgent
3600 3735 * byte. If for any reason we abort this segment below,
3601 3736 * if it comes back, we will have this ready, or it
3602 3737 * will get blown off in close.
3603 3738 */
3604 3739 } else if (urp == seg_len) {
3605 3740 /*
3606 3741 * The urgent byte is the next byte after this sequence
3607 3742 * number. If this endpoint is non-STREAMS, then there
3608 3743 * is nothing to do here since the socket has already
3609 3744 * been notified about the urg pointer by the
3610 3745 * su_signal_oob call above.
3611 3746 *
3612 3747 * In case of STREAMS, some more work might be needed.
3613 3748 * If there is data it is marked with MSGMARKNEXT and
3614 3749 * and any tcp_urp_mark_mp is discarded since it is not
3615 3750 * needed. Otherwise, if the code above just allocated
3616 3751 * a zero-length tcp_urp_mark_mp message, that message
3617 3752 * is tagged with MSGMARKNEXT. Sending up these
3618 3753 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3619 3754 * even though the T_EXDATA_IND will not be sent up
3620 3755 * until the urgent byte arrives.
3621 3756 */
3622 3757 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3623 3758 if (seg_len != 0) {
3624 3759 flags |= TH_MARKNEXT_NEEDED;
3625 3760 freemsg(tcp->tcp_urp_mark_mp);
3626 3761 tcp->tcp_urp_mark_mp = NULL;
3627 3762 flags &= ~TH_SEND_URP_MARK;
3628 3763 } else if (tcp->tcp_urp_mark_mp != NULL) {
3629 3764 flags |= TH_SEND_URP_MARK;
3630 3765 tcp->tcp_urp_mark_mp->b_flag &=
3631 3766 ~MSGNOTMARKNEXT;
3632 3767 tcp->tcp_urp_mark_mp->b_flag |=
3633 3768 MSGMARKNEXT;
3634 3769 }
3635 3770 }
3636 3771 #ifdef DEBUG
3637 3772 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3638 3773 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3639 3774 seg_len, flags,
3640 3775 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3641 3776 #endif /* DEBUG */
3642 3777 }
3643 3778 #ifdef DEBUG
3644 3779 else {
3645 3780 /* Data left until we hit mark */
3646 3781 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3647 3782 "tcp_rput: URP %d bytes left, %s",
3648 3783 urp - seg_len, tcp_display(tcp, NULL,
3649 3784 DISP_PORT_ONLY));
3650 3785 }
3651 3786 #endif /* DEBUG */
3652 3787 }
3653 3788
3654 3789 process_ack:
3655 3790 if (!(flags & TH_ACK)) {
3656 3791 freemsg(mp);
3657 3792 goto xmit_check;
3658 3793 }
3659 3794 }
3660 3795 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3661 3796
3662 3797 if (bytes_acked > 0)
3663 3798 tcp->tcp_ip_forward_progress = B_TRUE;
3664 3799 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3665 3800 /*
3666 3801 * tcp_sendmsg() checks tcp_state without entering
3667 3802 * the squeue so tcp_state should be updated before
3668 3803 * sending up a connection confirmation or a new
3669 3804 * connection indication.
3670 3805 */
3671 3806 tcp->tcp_state = TCPS_ESTABLISHED;
3672 3807
3673 3808 /*
3674 3809 * We are seeing the final ack in the three way
3675 3810 * hand shake of a active open'ed connection
3676 3811 * so we must send up a T_CONN_CON
3677 3812 */
3678 3813 if (tcp->tcp_active_open) {
3679 3814 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3680 3815 freemsg(mp);
3681 3816 tcp->tcp_state = TCPS_SYN_RCVD;
3682 3817 return;
3683 3818 }
3684 3819 /*
3685 3820 * Don't fuse the loopback endpoints for
3686 3821 * simultaneous active opens.
3687 3822 */
3688 3823 if (tcp->tcp_loopback) {
3689 3824 TCP_STAT(tcps, tcp_fusion_unfusable);
3690 3825 tcp->tcp_unfusable = B_TRUE;
3691 3826 }
3692 3827 /*
3693 3828 * For simultaneous active open, trace receipt of final
3694 3829 * ACK as tcp:::connect-established.
3695 3830 */
3696 3831 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3697 3832 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3698 3833 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3699 3834 } else if (IPCL_IS_NONSTR(connp)) {
3700 3835 /*
3701 3836 * 3-way handshake has completed, so notify socket
3702 3837 * of the new connection.
3703 3838 *
3704 3839 * We are here means eager is fine but it can
3705 3840 * get a TH_RST at any point between now and till
3706 3841 * accept completes and disappear. We need to
3707 3842 * ensure that reference to eager is valid after
3708 3843 * we get out of eager's perimeter. So we do
3709 3844 * an extra refhold.
3710 3845 */
3711 3846 CONN_INC_REF(connp);
3712 3847
3713 3848 if (!tcp_newconn_notify(tcp, ira)) {
3714 3849 /*
3715 3850 * The state-change probe for SYN_RCVD ->
3716 3851 * ESTABLISHED has not fired yet. We reset
3717 3852 * the state to SYN_RCVD so that future
3718 3853 * state-change probes report correct state
3719 3854 * transistions.
3720 3855 */
3721 3856 tcp->tcp_state = TCPS_SYN_RCVD;
3722 3857 freemsg(mp);
3723 3858 /* notification did not go up, so drop ref */
3724 3859 CONN_DEC_REF(connp);
3725 3860 /* ... and close the eager */
3726 3861 ASSERT(TCP_IS_DETACHED(tcp));
3727 3862 (void) tcp_close_detached(tcp);
3728 3863 return;
3729 3864 }
3730 3865 /*
3731 3866 * tcp_newconn_notify() changes conn_upcalls and
3732 3867 * connp->conn_upper_handle. Fix things now, in case
3733 3868 * there's data attached to this ack.
3734 3869 */
3735 3870 if (connp->conn_upcalls != NULL)
3736 3871 sockupcalls = connp->conn_upcalls;
3737 3872 /*
3738 3873 * For passive open, trace receipt of final ACK as
3739 3874 * tcp:::accept-established.
3740 3875 */
3741 3876 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3742 3877 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3743 3878 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3744 3879 } else {
3745 3880 /*
3746 3881 * 3-way handshake complete - this is a STREAMS based
3747 3882 * socket, so pass up the T_CONN_IND.
3748 3883 */
3749 3884 tcp_t *listener = tcp->tcp_listener;
3750 3885 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3751 3886
3752 3887 tcp->tcp_tconnind_started = B_TRUE;
3753 3888 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3754 3889 ASSERT(mp != NULL);
3755 3890 /*
3756 3891 * We are here means eager is fine but it can
3757 3892 * get a TH_RST at any point between now and till
3758 3893 * accept completes and disappear. We need to
3759 3894 * ensure that reference to eager is valid after
3760 3895 * we get out of eager's perimeter. So we do
3761 3896 * an extra refhold.
3762 3897 */
3763 3898 CONN_INC_REF(connp);
3764 3899
3765 3900 /*
3766 3901 * The listener also exists because of the refhold
3767 3902 * done in tcp_input_listener. Its possible that it
3768 3903 * might have closed. We will check that once we
3769 3904 * get inside listeners context.
3770 3905 */
3771 3906 CONN_INC_REF(listener->tcp_connp);
3772 3907 if (listener->tcp_connp->conn_sqp ==
3773 3908 connp->conn_sqp) {
3774 3909 /*
3775 3910 * We optimize by not calling an SQUEUE_ENTER
3776 3911 * on the listener since we know that the
3777 3912 * listener and eager squeues are the same.
3778 3913 * We are able to make this check safely only
3779 3914 * because neither the eager nor the listener
3780 3915 * can change its squeue. Only an active connect
3781 3916 * can change its squeue
3782 3917 */
3783 3918 tcp_send_conn_ind(listener->tcp_connp, mp,
3784 3919 listener->tcp_connp->conn_sqp);
3785 3920 CONN_DEC_REF(listener->tcp_connp);
3786 3921 } else if (!tcp->tcp_loopback) {
3787 3922 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3788 3923 mp, tcp_send_conn_ind,
3789 3924 listener->tcp_connp, NULL, SQ_FILL,
3790 3925 SQTAG_TCP_CONN_IND);
3791 3926 } else {
3792 3927 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3793 3928 mp, tcp_send_conn_ind,
3794 3929 listener->tcp_connp, NULL, SQ_NODRAIN,
3795 3930 SQTAG_TCP_CONN_IND);
3796 3931 }
3797 3932 /*
3798 3933 * For passive open, trace receipt of final ACK as
3799 3934 * tcp:::accept-established.
3800 3935 */
3801 3936 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3802 3937 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3803 3938 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3804 3939 }
3805 3940 TCPS_CONN_INC(tcps);
3806 3941
3807 3942 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3808 3943 bytes_acked--;
3809 3944 /* SYN was acked - making progress */
3810 3945 tcp->tcp_ip_forward_progress = B_TRUE;
3811 3946
|
↓ open down ↓ |
436 lines elided |
↑ open up ↑ |
3812 3947 /*
3813 3948 * If SYN was retransmitted, need to reset all
3814 3949 * retransmission info as this segment will be
3815 3950 * treated as a dup ACK.
3816 3951 */
3817 3952 if (tcp->tcp_rexmit) {
3818 3953 tcp->tcp_rexmit = B_FALSE;
3819 3954 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3820 3955 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3821 3956 tcp->tcp_ms_we_have_waited = 0;
3957 + DTRACE_PROBE3(cwnd__retransmitted__syn,
3958 + tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
3959 + uint32_t, tcp->tcp_mss);
3822 3960 tcp->tcp_cwnd = mss;
3823 3961 }
3824 3962
3825 3963 /*
3826 3964 * We set the send window to zero here.
3827 3965 * This is needed if there is data to be
3828 3966 * processed already on the queue.
3829 3967 * Later (at swnd_update label), the
3830 3968 * "new_swnd > tcp_swnd" condition is satisfied
3831 3969 * the XMIT_NEEDED flag is set in the current
3832 3970 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3833 3971 * called if there is already data on queue in
3834 3972 * this state.
3835 3973 */
3836 3974 tcp->tcp_swnd = 0;
3837 3975
3838 3976 if (new_swnd > tcp->tcp_max_swnd)
3839 3977 tcp->tcp_max_swnd = new_swnd;
3840 3978 tcp->tcp_swl1 = seg_seq;
3841 3979 tcp->tcp_swl2 = seg_ack;
3842 3980 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3843 3981
3844 3982 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3845 3983 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3846 3984 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3847 3985 int32_t, TCPS_SYN_RCVD);
3848 3986
3849 3987 /* Fuse when both sides are in ESTABLISHED state */
3850 3988 if (tcp->tcp_loopback && do_tcp_fusion)
3851 3989 tcp_fuse(tcp, iphdr, tcpha);
3852 3990
3853 3991 }
3854 3992 /* This code follows 4.4BSD-Lite2 mostly. */
|
↓ open down ↓ |
23 lines elided |
↑ open up ↑ |
3855 3993 if (bytes_acked < 0)
3856 3994 goto est;
3857 3995
3858 3996 /*
3859 3997 * If TCP is ECN capable and the congestion experience bit is
3860 3998 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3861 3999 * done once per window (or more loosely, per RTT).
3862 4000 */
3863 4001 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3864 4002 tcp->tcp_cwr = B_FALSE;
3865 - if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3866 - if (!tcp->tcp_cwr) {
3867 - npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3868 - tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3869 - tcp->tcp_cwnd = npkt * mss;
3870 - /*
3871 - * If the cwnd is 0, use the timer to clock out
3872 - * new segments. This is required by the ECN spec.
3873 - */
3874 - if (npkt == 0) {
3875 - TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3876 - /*
3877 - * This makes sure that when the ACK comes
3878 - * back, we will increase tcp_cwnd by 1 MSS.
3879 - */
3880 - tcp->tcp_cwnd_cnt = 0;
3881 - }
3882 - tcp->tcp_cwr = B_TRUE;
3883 - /*
3884 - * This marks the end of the current window of in
3885 - * flight data. That is why we don't use
3886 - * tcp_suna + tcp_swnd. Only data in flight can
3887 - * provide ECN info.
3888 - */
3889 - tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3890 - tcp->tcp_ecn_cwr_sent = B_FALSE;
3891 - }
4003 + if (tcp->tcp_ecn_ok && (flags & TH_ECE) && !tcp->tcp_cwr) {
4004 + cc_cong_signal(tcp, seg_ack, CC_ECN);
4005 + /*
4006 + * If the cwnd is 0, use the timer to clock out
4007 + * new segments. This is required by the ECN spec.
4008 + */
4009 + if (tcp->tcp_cwnd == 0)
4010 + TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4011 + tcp->tcp_cwr = B_TRUE;
4012 + /*
4013 + * This marks the end of the current window of in
4014 + * flight data. That is why we don't use
4015 + * tcp_suna + tcp_swnd. Only data in flight can
4016 + * provide ECN info.
4017 + */
4018 + tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3892 4019 }
3893 4020
3894 4021 mp1 = tcp->tcp_xmit_head;
3895 4022 if (bytes_acked == 0) {
3896 4023 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3897 4024 int dupack_cnt;
3898 4025
3899 4026 TCPS_BUMP_MIB(tcps, tcpInDupAck);
3900 4027 /*
3901 4028 * Fast retransmit. When we have seen exactly three
3902 4029 * identical ACKs while we have unacked data
|
↓ open down ↓ |
1 lines elided |
↑ open up ↑ |
3903 4030 * outstanding we take it as a hint that our peer
3904 4031 * dropped something.
3905 4032 *
3906 4033 * If TCP is retransmitting, don't do fast retransmit.
3907 4034 */
3908 4035 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3909 4036 ! tcp->tcp_rexmit) {
3910 4037 /* Do Limited Transmit */
3911 4038 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3912 4039 tcps->tcps_dupack_fast_retransmit) {
4040 + cc_ack_received(tcp, seg_ack,
4041 + bytes_acked, CC_DUPACK);
3913 4042 /*
3914 4043 * RFC 3042
3915 4044 *
3916 4045 * What we need to do is temporarily
3917 4046 * increase tcp_cwnd so that new
3918 4047 * data can be sent if it is allowed
3919 4048 * by the receive window (tcp_rwnd).
3920 4049 * tcp_wput_data() will take care of
3921 4050 * the rest.
3922 4051 *
3923 4052 * If the connection is SACK capable,
3924 4053 * only do limited xmit when there
3925 4054 * is SACK info.
3926 4055 *
3927 4056 * Note how tcp_cwnd is incremented.
3928 4057 * The first dup ACK will increase
3929 4058 * it by 1 MSS. The second dup ACK
3930 4059 * will increase it by 2 MSS. This
3931 4060 * means that only 1 new segment will
3932 4061 * be sent for each dup ACK.
3933 4062 */
3934 4063 if (tcp->tcp_unsent > 0 &&
3935 4064 (!tcp->tcp_snd_sack_ok ||
3936 4065 (tcp->tcp_snd_sack_ok &&
3937 4066 tcp->tcp_notsack_list != NULL))) {
3938 4067 tcp->tcp_cwnd += mss <<
3939 4068 (tcp->tcp_dupack_cnt - 1);
3940 4069 flags |= TH_LIMIT_XMIT;
3941 4070 }
3942 4071 } else if (dupack_cnt ==
3943 4072 tcps->tcps_dupack_fast_retransmit) {
3944 4073
3945 4074 /*
3946 4075 * If we have reduced tcp_ssthresh
3947 4076 * because of ECN, do not reduce it again
3948 4077 * unless it is already one window of data
|
↓ open down ↓ |
26 lines elided |
↑ open up ↑ |
3949 4078 * away. After one window of data, tcp_cwr
3950 4079 * should then be cleared. Note that
3951 4080 * for non ECN capable connection, tcp_cwr
3952 4081 * should always be false.
3953 4082 *
3954 4083 * Adjust cwnd since the duplicate
3955 4084 * ack indicates that a packet was
3956 4085 * dropped (due to congestion.)
3957 4086 */
3958 4087 if (!tcp->tcp_cwr) {
3959 - npkt = ((tcp->tcp_snxt -
3960 - tcp->tcp_suna) >> 1) / mss;
3961 - tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3962 - mss;
3963 - tcp->tcp_cwnd = (npkt +
3964 - tcp->tcp_dupack_cnt) * mss;
4088 + cc_cong_signal(tcp, seg_ack,
4089 + CC_NDUPACK);
4090 + cc_ack_received(tcp, seg_ack,
4091 + bytes_acked, CC_DUPACK);
3965 4092 }
3966 4093 if (tcp->tcp_ecn_ok) {
3967 4094 tcp->tcp_cwr = B_TRUE;
3968 4095 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3969 4096 tcp->tcp_ecn_cwr_sent = B_FALSE;
3970 4097 }
3971 4098
3972 4099 /*
3973 4100 * We do Hoe's algorithm. Refer to her
3974 4101 * paper "Improving the Start-up Behavior
3975 4102 * of a Congestion Control Scheme for TCP,"
3976 4103 * appeared in SIGCOMM'96.
3977 4104 *
3978 4105 * Save highest seq no we have sent so far.
3979 4106 * Be careful about the invisible FIN byte.
3980 4107 */
3981 4108 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
3982 4109 (tcp->tcp_unsent == 0)) {
3983 4110 tcp->tcp_rexmit_max = tcp->tcp_fss;
3984 4111 } else {
3985 4112 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3986 4113 }
3987 4114
3988 4115 /*
3989 4116 * For SACK:
3990 4117 * Calculate tcp_pipe, which is the
3991 4118 * estimated number of bytes in
3992 4119 * network.
3993 4120 *
3994 4121 * tcp_fack is the highest sack'ed seq num
3995 4122 * TCP has received.
3996 4123 *
3997 4124 * tcp_pipe is explained in the above quoted
3998 4125 * Fall and Floyd's paper. tcp_fack is
3999 4126 * explained in Mathis and Mahdavi's
4000 4127 * "Forward Acknowledgment: Refining TCP
4001 4128 * Congestion Control" in SIGCOMM '96.
4002 4129 */
4003 4130 if (tcp->tcp_snd_sack_ok) {
4004 4131 if (tcp->tcp_notsack_list != NULL) {
4005 4132 tcp->tcp_pipe = tcp->tcp_snxt -
4006 4133 tcp->tcp_fack;
4007 4134 tcp->tcp_sack_snxt = seg_ack;
4008 4135 flags |= TH_NEED_SACK_REXMIT;
4009 4136 } else {
4010 4137 /*
4011 4138 * Always initialize tcp_pipe
4012 4139 * even though we don't have
4013 4140 * any SACK info. If later
4014 4141 * we get SACK info and
4015 4142 * tcp_pipe is not initialized,
|
↓ open down ↓ |
41 lines elided |
↑ open up ↑ |
4016 4143 * funny things will happen.
4017 4144 */
4018 4145 tcp->tcp_pipe =
4019 4146 tcp->tcp_cwnd_ssthresh;
4020 4147 }
4021 4148 } else {
4022 4149 flags |= TH_REXMIT_NEEDED;
4023 4150 } /* tcp_snd_sack_ok */
4024 4151
4025 4152 } else {
4153 + cc_ack_received(tcp, seg_ack,
4154 + bytes_acked, CC_DUPACK);
4026 4155 /*
4027 4156 * Here we perform congestion
4028 4157 * avoidance, but NOT slow start.
4029 4158 * This is known as the Fast
4030 4159 * Recovery Algorithm.
4031 4160 */
4032 4161 if (tcp->tcp_snd_sack_ok &&
4033 4162 tcp->tcp_notsack_list != NULL) {
4034 4163 flags |= TH_NEED_SACK_REXMIT;
4035 4164 tcp->tcp_pipe -= mss;
4036 4165 if (tcp->tcp_pipe < 0)
|
↓ open down ↓ |
1 lines elided |
↑ open up ↑ |
4037 4166 tcp->tcp_pipe = 0;
4038 4167 } else {
4039 4168 /*
4040 4169 * We know that one more packet has
4041 4170 * left the pipe thus we can update
4042 4171 * cwnd.
4043 4172 */
4044 4173 cwnd = tcp->tcp_cwnd + mss;
4045 4174 if (cwnd > tcp->tcp_cwnd_max)
4046 4175 cwnd = tcp->tcp_cwnd_max;
4176 + DTRACE_PROBE3(cwnd__fast__recovery,
4177 + tcp_t *, tcp,
4178 + uint32_t, tcp->tcp_cwnd,
4179 + uint32_t, cwnd);
4047 4180 tcp->tcp_cwnd = cwnd;
4048 4181 if (tcp->tcp_unsent > 0)
4049 4182 flags |= TH_XMIT_NEEDED;
4050 4183 }
4051 4184 }
4052 4185 }
4053 4186 } else if (tcp->tcp_zero_win_probe) {
4054 4187 /*
4055 4188 * If the window has opened, need to arrange
4056 4189 * to send additional data.
4057 4190 */
4058 4191 if (new_swnd != 0) {
4059 4192 /* tcp_suna != tcp_snxt */
4060 4193 /* Packet contains a window update */
4061 4194 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4062 4195 tcp->tcp_zero_win_probe = 0;
4063 4196 tcp->tcp_timer_backoff = 0;
4064 4197 tcp->tcp_ms_we_have_waited = 0;
4065 4198
4066 4199 /*
4067 4200 * Transmit starting with tcp_suna since
4068 4201 * the one byte probe is not ack'ed.
4069 4202 * If TCP has sent more than one identical
4070 4203 * probe, tcp_rexmit will be set. That means
4071 4204 * tcp_ss_rexmit() will send out the one
4072 4205 * byte along with new data. Otherwise,
4073 4206 * fake the retransmission.
4074 4207 */
4075 4208 flags |= TH_XMIT_NEEDED;
4076 4209 if (!tcp->tcp_rexmit) {
4077 4210 tcp->tcp_rexmit = B_TRUE;
4078 4211 tcp->tcp_dupack_cnt = 0;
4079 4212 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4080 4213 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4081 4214 }
4082 4215 }
4083 4216 }
4084 4217 goto swnd_update;
4085 4218 }
4086 4219
4087 4220 /*
4088 4221 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4089 4222 * If the ACK value acks something that we have not yet sent, it might
4090 4223 * be an old duplicate segment. Send an ACK to re-synchronize the
4091 4224 * other side.
4092 4225 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4093 4226 * state is handled above, so we can always just drop the segment and
4094 4227 * send an ACK here.
4095 4228 *
4096 4229 * In the case where the peer shrinks the window, we see the new window
4097 4230 * update, but all the data sent previously is queued up by the peer.
4098 4231 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4099 4232 * number, which was already sent, and within window, is recorded.
4100 4233 * tcp_snxt is then updated.
4101 4234 *
4102 4235 * If the window has previously shrunk, and an ACK for data not yet
4103 4236 * sent, according to tcp_snxt is recieved, it may still be valid. If
4104 4237 * the ACK is for data within the window at the time the window was
4105 4238 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4106 4239 * the sequence number ACK'ed.
4107 4240 *
4108 4241 * If the ACK covers all the data sent at the time the window was
4109 4242 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4110 4243 *
4111 4244 * Should we send ACKs in response to ACK only segments?
4112 4245 */
4113 4246
4114 4247 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4115 4248 if ((tcp->tcp_is_wnd_shrnk) &&
4116 4249 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4117 4250 uint32_t data_acked_ahead_snxt;
4118 4251
4119 4252 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4120 4253 tcp_update_xmit_tail(tcp, seg_ack);
4121 4254 tcp->tcp_unsent -= data_acked_ahead_snxt;
4122 4255 } else {
4123 4256 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4124 4257 /* drop the received segment */
4125 4258 freemsg(mp);
4126 4259
4127 4260 /*
4128 4261 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4129 4262 * greater than 0, check if the number of such
4130 4263 * bogus ACks is greater than that count. If yes,
4131 4264 * don't send back any ACK. This prevents TCP from
4132 4265 * getting into an ACK storm if somehow an attacker
4133 4266 * successfully spoofs an acceptable segment to our
4134 4267 * peer. If this continues (count > 2 X threshold),
4135 4268 * we should abort this connection.
4136 4269 */
4137 4270 if (tcp_drop_ack_unsent_cnt > 0 &&
4138 4271 ++tcp->tcp_in_ack_unsent >
|
↓ open down ↓ |
82 lines elided |
↑ open up ↑ |
4139 4272 tcp_drop_ack_unsent_cnt) {
4140 4273 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4141 4274 if (tcp->tcp_in_ack_unsent > 2 *
4142 4275 tcp_drop_ack_unsent_cnt) {
4143 4276 (void) tcp_clean_death(tcp, EPROTO);
4144 4277 }
4145 4278 return;
4146 4279 }
4147 4280 mp = tcp_ack_mp(tcp);
4148 4281 if (mp != NULL) {
4149 - BUMP_LOCAL(tcp->tcp_obsegs);
4282 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4150 4283 TCPS_BUMP_MIB(tcps, tcpOutAck);
4151 4284 tcp_send_data(tcp, mp);
4152 4285 }
4153 4286 return;
4154 4287 }
4155 4288 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4156 4289 tcp->tcp_snxt_shrunk)) {
4157 4290 tcp->tcp_is_wnd_shrnk = B_FALSE;
4158 4291 }
4159 4292
4160 4293 /*
4161 4294 * TCP gets a new ACK, update the notsack'ed list to delete those
4162 4295 * blocks that are covered by this ACK.
4163 4296 */
4164 4297 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4165 4298 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4166 4299 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4167 4300 }
4168 4301
|
↓ open down ↓ |
9 lines elided |
↑ open up ↑ |
4169 4302 /*
4170 4303 * If we got an ACK after fast retransmit, check to see
4171 4304 * if it is a partial ACK. If it is not and the congestion
4172 4305 * window was inflated to account for the other side's
4173 4306 * cached packets, retract it. If it is, do Hoe's algorithm.
4174 4307 */
4175 4308 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4176 4309 ASSERT(tcp->tcp_rexmit == B_FALSE);
4177 4310 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4178 4311 tcp->tcp_dupack_cnt = 0;
4179 - /*
4180 - * Restore the orig tcp_cwnd_ssthresh after
4181 - * fast retransmit phase.
4182 - */
4183 - if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4184 - tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4185 - }
4312 +
4313 + cc_post_recovery(tcp, seg_ack);
4314 +
4186 4315 tcp->tcp_rexmit_max = seg_ack;
4187 - tcp->tcp_cwnd_cnt = 0;
4188 4316
4189 4317 /*
4190 4318 * Remove all notsack info to avoid confusion with
4191 4319 * the next fast retrasnmit/recovery phase.
4192 4320 */
4193 4321 if (tcp->tcp_snd_sack_ok) {
4194 4322 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4195 4323 tcp);
4196 4324 }
4197 4325 } else {
4198 4326 if (tcp->tcp_snd_sack_ok &&
4199 4327 tcp->tcp_notsack_list != NULL) {
4200 4328 flags |= TH_NEED_SACK_REXMIT;
4201 4329 tcp->tcp_pipe -= mss;
4202 4330 if (tcp->tcp_pipe < 0)
4203 4331 tcp->tcp_pipe = 0;
4204 4332 } else {
4205 4333 /*
|
↓ open down ↓ |
8 lines elided |
↑ open up ↑ |
4206 4334 * Hoe's algorithm:
4207 4335 *
4208 4336 * Retransmit the unack'ed segment and
4209 4337 * restart fast recovery. Note that we
4210 4338 * need to scale back tcp_cwnd to the
4211 4339 * original value when we started fast
4212 4340 * recovery. This is to prevent overly
4213 4341 * aggressive behaviour in sending new
4214 4342 * segments.
4215 4343 */
4216 - tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4344 + cwnd = tcp->tcp_cwnd_ssthresh +
4217 4345 tcps->tcps_dupack_fast_retransmit * mss;
4346 + DTRACE_PROBE3(cwnd__fast__retransmit__part__ack,
4347 + tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
4348 + uint32_t, cwnd);
4349 + tcp->tcp_cwnd = cwnd;
4218 4350 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4219 4351 flags |= TH_REXMIT_NEEDED;
4220 4352 }
4221 4353 }
4222 4354 } else {
4223 4355 tcp->tcp_dupack_cnt = 0;
4224 4356 if (tcp->tcp_rexmit) {
4225 4357 /*
4226 4358 * TCP is retranmitting. If the ACK ack's all
4227 4359 * outstanding data, update tcp_rexmit_max and
4228 4360 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4229 4361 * to the correct value.
4230 4362 *
4231 4363 * Note that SEQ_LEQ() is used. This is to avoid
4232 4364 * unnecessary fast retransmit caused by dup ACKs
4233 4365 * received when TCP does slow start retransmission
4234 4366 * after a time out. During this phase, TCP may
4235 4367 * send out segments which are already received.
4236 4368 * This causes dup ACKs to be sent back.
4237 4369 */
4238 4370 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4239 4371 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4240 4372 tcp->tcp_rexmit_nxt = seg_ack;
4241 4373 }
4242 4374 if (seg_ack != tcp->tcp_rexmit_max) {
4243 4375 flags |= TH_XMIT_NEEDED;
4244 4376 }
4245 4377 } else {
4246 4378 tcp->tcp_rexmit = B_FALSE;
4247 4379 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4248 4380 }
4249 4381 tcp->tcp_ms_we_have_waited = 0;
4250 4382 }
4251 4383 }
4252 4384
4253 4385 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4254 4386 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4255 4387 tcp->tcp_suna = seg_ack;
4256 4388 if (tcp->tcp_zero_win_probe != 0) {
4257 4389 tcp->tcp_zero_win_probe = 0;
4258 4390 tcp->tcp_timer_backoff = 0;
4259 4391 }
4260 4392
4261 4393 /*
4262 4394 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4263 4395 * Note that it cannot be the SYN being ack'ed. The code flow
4264 4396 * will not reach here.
4265 4397 */
4266 4398 if (mp1 == NULL) {
4267 4399 goto fin_acked;
|
↓ open down ↓ |
40 lines elided |
↑ open up ↑ |
4268 4400 }
4269 4401
4270 4402 /*
4271 4403 * Update the congestion window.
4272 4404 *
4273 4405 * If TCP is not ECN capable or TCP is ECN capable but the
4274 4406 * congestion experience bit is not set, increase the tcp_cwnd as
4275 4407 * usual.
4276 4408 */
4277 4409 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4278 - cwnd = tcp->tcp_cwnd;
4279 - add = mss;
4280 -
4281 - if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4282 - /*
4283 - * This is to prevent an increase of less than 1 MSS of
4284 - * tcp_cwnd. With partial increase, tcp_wput_data()
4285 - * may send out tinygrams in order to preserve mblk
4286 - * boundaries.
4287 - *
4288 - * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4289 - * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4290 - * increased by 1 MSS for every RTTs.
4291 - */
4292 - if (tcp->tcp_cwnd_cnt <= 0) {
4293 - tcp->tcp_cwnd_cnt = cwnd + add;
4294 - } else {
4295 - tcp->tcp_cwnd_cnt -= add;
4296 - add = 0;
4297 - }
4410 + if (IN_RECOVERY(tcp->tcp_ccv.flags)) {
4411 + EXIT_RECOVERY(tcp->tcp_ccv.flags);
4298 4412 }
4299 - tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4413 + cc_ack_received(tcp, seg_ack, bytes_acked, CC_ACK);
4300 4414 }
4301 4415
4302 4416 /* See if the latest urgent data has been acknowledged */
4303 4417 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4304 4418 SEQ_GT(seg_ack, tcp->tcp_urg))
4305 4419 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4306 4420
4307 - /* Can we update the RTT estimates? */
4308 - if (tcp->tcp_snd_ts_ok) {
4309 - /* Ignore zero timestamp echo-reply. */
4310 - if (tcpopt.tcp_opt_ts_ecr != 0) {
4311 - tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4312 - (int32_t)tcpopt.tcp_opt_ts_ecr);
4313 - }
4314 -
4315 - /* If needed, restart the timer. */
4316 - if (tcp->tcp_set_timer == 1) {
4317 - TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4318 - tcp->tcp_set_timer = 0;
4319 - }
4421 + /*
4422 + * Update the RTT estimates. Note that we don't use the TCP
4423 + * timestamp option to calculate RTT even if one is present. This is
4424 + * because the timestamp option's resolution (CPU tick) is
4425 + * too coarse to measure modern datacenter networks' microsecond
4426 + * latencies. The timestamp field's resolution is limited by its
4427 + * 4-byte width (see RFC1323), and since we always store a
4428 + * high-resolution nanosecond presision timestamp along with the data,
4429 + * there is no point to ever using the timestamp option.
4430 + */
4431 + if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4320 4432 /*
4321 - * Update tcp_csuna in case the other side stops sending
4322 - * us timestamps.
4323 - */
4324 - tcp->tcp_csuna = tcp->tcp_snxt;
4325 - } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4326 - /*
4327 4433 * An ACK sequence we haven't seen before, so get the RTT
4328 4434 * and update the RTO. But first check if the timestamp is
4329 4435 * valid to use.
4330 4436 */
4331 4437 if ((mp1->b_next != NULL) &&
4332 - SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4438 + SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) {
4439 +#ifdef KERNEL_32
4333 4440 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4334 4441 (int32_t)(intptr_t)mp1->b_prev);
4335 - else
4442 +#else
4443 + tcp_set_rto(tcp, gethrtime() -
4444 + (hrtime_t)(intptr_t)mp1->b_prev);
4445 +#endif
4446 + } else {
4336 4447 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4448 + }
4337 4449
4338 4450 /* Remeber the last sequence to be ACKed */
4339 4451 tcp->tcp_csuna = seg_ack;
4340 4452 if (tcp->tcp_set_timer == 1) {
4341 4453 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4342 4454 tcp->tcp_set_timer = 0;
4343 4455 }
4344 4456 } else {
4345 4457 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4346 4458 }
4347 4459
4348 4460 /* Eat acknowledged bytes off the xmit queue. */
4349 4461 for (;;) {
4350 4462 mblk_t *mp2;
4351 4463 uchar_t *wptr;
4352 4464
4353 4465 wptr = mp1->b_wptr;
|
↓ open down ↓ |
7 lines elided |
↑ open up ↑ |
4354 4466 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4355 4467 bytes_acked -= (int)(wptr - mp1->b_rptr);
4356 4468 if (bytes_acked < 0) {
4357 4469 mp1->b_rptr = wptr + bytes_acked;
4358 4470 /*
4359 4471 * Set a new timestamp if all the bytes timed by the
4360 4472 * old timestamp have been ack'ed.
4361 4473 */
4362 4474 if (SEQ_GT(seg_ack,
4363 4475 (uint32_t)(uintptr_t)(mp1->b_next))) {
4476 +#ifdef KERNEL_32
4364 4477 mp1->b_prev =
4365 4478 (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4479 +#else
4480 + mp1->b_prev =
4481 + (mblk_t *)(intptr_t)gethrtime();
4482 +#endif
4366 4483 mp1->b_next = NULL;
4367 4484 }
4368 4485 break;
4369 4486 }
4370 4487 mp1->b_next = NULL;
4371 4488 mp1->b_prev = NULL;
4372 4489 mp2 = mp1;
4373 4490 mp1 = mp1->b_cont;
4374 4491
4375 4492 /*
4376 4493 * This notification is required for some zero-copy
4377 4494 * clients to maintain a copy semantic. After the data
4378 4495 * is ack'ed, client is safe to modify or reuse the buffer.
4379 4496 */
4380 4497 if (tcp->tcp_snd_zcopy_aware &&
4381 4498 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4382 4499 tcp_zcopy_notify(tcp);
4383 4500 freeb(mp2);
4384 4501 if (bytes_acked == 0) {
4385 4502 if (mp1 == NULL) {
4386 4503 /* Everything is ack'ed, clear the tail. */
4387 4504 tcp->tcp_xmit_tail = NULL;
4388 4505 /*
4389 4506 * Cancel the timer unless we are still
4390 4507 * waiting for an ACK for the FIN packet.
4391 4508 */
4392 4509 if (tcp->tcp_timer_tid != 0 &&
4393 4510 tcp->tcp_snxt == tcp->tcp_suna) {
4394 4511 (void) TCP_TIMER_CANCEL(tcp,
4395 4512 tcp->tcp_timer_tid);
4396 4513 tcp->tcp_timer_tid = 0;
4397 4514 }
4398 4515 goto pre_swnd_update;
4399 4516 }
4400 4517 if (mp2 != tcp->tcp_xmit_tail)
4401 4518 break;
4402 4519 tcp->tcp_xmit_tail = mp1;
4403 4520 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4404 4521 (uintptr_t)INT_MAX);
4405 4522 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4406 4523 mp1->b_rptr);
4407 4524 break;
4408 4525 }
4409 4526 if (mp1 == NULL) {
4410 4527 /*
4411 4528 * More was acked but there is nothing more
4412 4529 * outstanding. This means that the FIN was
4413 4530 * just acked or that we're talking to a clown.
4414 4531 */
4415 4532 fin_acked:
4416 4533 ASSERT(tcp->tcp_fin_sent);
4417 4534 tcp->tcp_xmit_tail = NULL;
4418 4535 if (tcp->tcp_fin_sent) {
4419 4536 /* FIN was acked - making progress */
4420 4537 if (!tcp->tcp_fin_acked)
4421 4538 tcp->tcp_ip_forward_progress = B_TRUE;
4422 4539 tcp->tcp_fin_acked = B_TRUE;
4423 4540 if (tcp->tcp_linger_tid != 0 &&
4424 4541 TCP_TIMER_CANCEL(tcp,
4425 4542 tcp->tcp_linger_tid) >= 0) {
4426 4543 tcp_stop_lingering(tcp);
4427 4544 freemsg(mp);
4428 4545 mp = NULL;
4429 4546 }
4430 4547 } else {
4431 4548 /*
4432 4549 * We should never get here because
4433 4550 * we have already checked that the
4434 4551 * number of bytes ack'ed should be
4435 4552 * smaller than or equal to what we
4436 4553 * have sent so far (it is the
4437 4554 * acceptability check of the ACK).
4438 4555 * We can only get here if the send
4439 4556 * queue is corrupted.
4440 4557 *
4441 4558 * Terminate the connection and
4442 4559 * panic the system. It is better
4443 4560 * for us to panic instead of
4444 4561 * continuing to avoid other disaster.
4445 4562 */
4446 4563 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4447 4564 tcp->tcp_rnxt, TH_RST|TH_ACK);
4448 4565 panic("Memory corruption "
4449 4566 "detected for connection %s.",
4450 4567 tcp_display(tcp, NULL,
4451 4568 DISP_ADDR_AND_PORT));
4452 4569 /*NOTREACHED*/
4453 4570 }
4454 4571 goto pre_swnd_update;
4455 4572 }
4456 4573 ASSERT(mp2 != tcp->tcp_xmit_tail);
4457 4574 }
4458 4575 if (tcp->tcp_unsent) {
4459 4576 flags |= TH_XMIT_NEEDED;
4460 4577 }
4461 4578 pre_swnd_update:
4462 4579 tcp->tcp_xmit_head = mp1;
4463 4580 swnd_update:
4464 4581 /*
4465 4582 * The following check is different from most other implementations.
4466 4583 * For bi-directional transfer, when segments are dropped, the
4467 4584 * "normal" check will not accept a window update in those
4468 4585 * retransmitted segemnts. Failing to do that, TCP may send out
4469 4586 * segments which are outside receiver's window. As TCP accepts
4470 4587 * the ack in those retransmitted segments, if the window update in
4471 4588 * the same segment is not accepted, TCP will incorrectly calculates
4472 4589 * that it can send more segments. This can create a deadlock
4473 4590 * with the receiver if its window becomes zero.
4474 4591 */
4475 4592 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4476 4593 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4477 4594 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4478 4595 /*
4479 4596 * The criteria for update is:
4480 4597 *
4481 4598 * 1. the segment acknowledges some data. Or
4482 4599 * 2. the segment is new, i.e. it has a higher seq num. Or
4483 4600 * 3. the segment is not old and the advertised window is
4484 4601 * larger than the previous advertised window.
4485 4602 */
4486 4603 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4487 4604 flags |= TH_XMIT_NEEDED;
4488 4605 tcp->tcp_swnd = new_swnd;
4489 4606 if (new_swnd > tcp->tcp_max_swnd)
4490 4607 tcp->tcp_max_swnd = new_swnd;
4491 4608 tcp->tcp_swl1 = seg_seq;
4492 4609 tcp->tcp_swl2 = seg_ack;
4493 4610 }
4494 4611 est:
4495 4612 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4496 4613
4497 4614 switch (tcp->tcp_state) {
4498 4615 case TCPS_FIN_WAIT_1:
4499 4616 if (tcp->tcp_fin_acked) {
4500 4617 tcp->tcp_state = TCPS_FIN_WAIT_2;
4501 4618 DTRACE_TCP6(state__change, void, NULL,
4502 4619 ip_xmit_attr_t *, connp->conn_ixa,
4503 4620 void, NULL, tcp_t *, tcp, void, NULL,
4504 4621 int32_t, TCPS_FIN_WAIT_1);
4505 4622 /*
4506 4623 * We implement the non-standard BSD/SunOS
4507 4624 * FIN_WAIT_2 flushing algorithm.
4508 4625 * If there is no user attached to this
4509 4626 * TCP endpoint, then this TCP struct
4510 4627 * could hang around forever in FIN_WAIT_2
4511 4628 * state if the peer forgets to send us
4512 4629 * a FIN. To prevent this, we wait only
4513 4630 * 2*MSL (a convenient time value) for
4514 4631 * the FIN to arrive. If it doesn't show up,
4515 4632 * we flush the TCP endpoint. This algorithm,
4516 4633 * though a violation of RFC-793, has worked
4517 4634 * for over 10 years in BSD systems.
4518 4635 * Note: SunOS 4.x waits 675 seconds before
4519 4636 * flushing the FIN_WAIT_2 connection.
4520 4637 */
4521 4638 TCP_TIMER_RESTART(tcp,
4522 4639 tcp->tcp_fin_wait_2_flush_interval);
4523 4640 }
4524 4641 break;
4525 4642 case TCPS_FIN_WAIT_2:
4526 4643 break; /* Shutdown hook? */
4527 4644 case TCPS_LAST_ACK:
4528 4645 freemsg(mp);
4529 4646 if (tcp->tcp_fin_acked) {
4530 4647 (void) tcp_clean_death(tcp, 0);
4531 4648 return;
4532 4649 }
4533 4650 goto xmit_check;
4534 4651 case TCPS_CLOSING:
4535 4652 if (tcp->tcp_fin_acked) {
4536 4653 SET_TIME_WAIT(tcps, tcp, connp);
4537 4654 DTRACE_TCP6(state__change, void, NULL,
4538 4655 ip_xmit_attr_t *, connp->conn_ixa, void,
4539 4656 NULL, tcp_t *, tcp, void, NULL, int32_t,
4540 4657 TCPS_CLOSING);
4541 4658 }
4542 4659 /*FALLTHRU*/
4543 4660 case TCPS_CLOSE_WAIT:
4544 4661 freemsg(mp);
4545 4662 goto xmit_check;
4546 4663 default:
4547 4664 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4548 4665 break;
4549 4666 }
4550 4667 }
4551 4668 if (flags & TH_FIN) {
4552 4669 /* Make sure we ack the fin */
4553 4670 flags |= TH_ACK_NEEDED;
4554 4671 if (!tcp->tcp_fin_rcvd) {
4555 4672 tcp->tcp_fin_rcvd = B_TRUE;
4556 4673 tcp->tcp_rnxt++;
4557 4674 tcpha = tcp->tcp_tcpha;
4558 4675 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4559 4676
4560 4677 /*
4561 4678 * Generate the ordrel_ind at the end unless the
4562 4679 * conn is detached or it is a STREAMS based eager.
4563 4680 * In the eager case we defer the notification until
4564 4681 * tcp_accept_finish has run.
4565 4682 */
4566 4683 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4567 4684 (tcp->tcp_listener == NULL &&
4568 4685 !tcp->tcp_hard_binding)))
4569 4686 flags |= TH_ORDREL_NEEDED;
4570 4687 switch (tcp->tcp_state) {
4571 4688 case TCPS_SYN_RCVD:
4572 4689 tcp->tcp_state = TCPS_CLOSE_WAIT;
4573 4690 DTRACE_TCP6(state__change, void, NULL,
4574 4691 ip_xmit_attr_t *, connp->conn_ixa,
4575 4692 void, NULL, tcp_t *, tcp, void, NULL,
4576 4693 int32_t, TCPS_SYN_RCVD);
4577 4694 /* Keepalive? */
4578 4695 break;
4579 4696 case TCPS_ESTABLISHED:
4580 4697 tcp->tcp_state = TCPS_CLOSE_WAIT;
4581 4698 DTRACE_TCP6(state__change, void, NULL,
4582 4699 ip_xmit_attr_t *, connp->conn_ixa,
4583 4700 void, NULL, tcp_t *, tcp, void, NULL,
4584 4701 int32_t, TCPS_ESTABLISHED);
4585 4702 /* Keepalive? */
4586 4703 break;
4587 4704 case TCPS_FIN_WAIT_1:
4588 4705 if (!tcp->tcp_fin_acked) {
4589 4706 tcp->tcp_state = TCPS_CLOSING;
4590 4707 DTRACE_TCP6(state__change, void, NULL,
4591 4708 ip_xmit_attr_t *, connp->conn_ixa,
4592 4709 void, NULL, tcp_t *, tcp, void,
4593 4710 NULL, int32_t, TCPS_FIN_WAIT_1);
4594 4711 break;
4595 4712 }
4596 4713 /* FALLTHRU */
4597 4714 case TCPS_FIN_WAIT_2:
4598 4715 SET_TIME_WAIT(tcps, tcp, connp);
4599 4716 DTRACE_TCP6(state__change, void, NULL,
4600 4717 ip_xmit_attr_t *, connp->conn_ixa, void,
4601 4718 NULL, tcp_t *, tcp, void, NULL, int32_t,
4602 4719 TCPS_FIN_WAIT_2);
4603 4720 if (seg_len) {
4604 4721 /*
4605 4722 * implies data piggybacked on FIN.
4606 4723 * break to handle data.
4607 4724 */
4608 4725 break;
4609 4726 }
4610 4727 freemsg(mp);
4611 4728 goto ack_check;
4612 4729 }
4613 4730 }
4614 4731 }
4615 4732 if (mp == NULL)
4616 4733 goto xmit_check;
4617 4734 if (seg_len == 0) {
4618 4735 freemsg(mp);
4619 4736 goto xmit_check;
4620 4737 }
4621 4738 if (mp->b_rptr == mp->b_wptr) {
4622 4739 /*
4623 4740 * The header has been consumed, so we remove the
4624 4741 * zero-length mblk here.
4625 4742 */
4626 4743 mp1 = mp;
4627 4744 mp = mp->b_cont;
4628 4745 freeb(mp1);
4629 4746 }
4630 4747 update_ack:
4631 4748 tcpha = tcp->tcp_tcpha;
4632 4749 tcp->tcp_rack_cnt++;
4633 4750 {
4634 4751 uint32_t cur_max;
4635 4752
4636 4753 cur_max = tcp->tcp_rack_cur_max;
4637 4754 if (tcp->tcp_rack_cnt >= cur_max) {
4638 4755 /*
4639 4756 * We have more unacked data than we should - send
4640 4757 * an ACK now.
4641 4758 */
4642 4759 flags |= TH_ACK_NEEDED;
4643 4760 cur_max++;
4644 4761 if (cur_max > tcp->tcp_rack_abs_max)
4645 4762 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4646 4763 else
4647 4764 tcp->tcp_rack_cur_max = cur_max;
4648 4765 } else if (TCP_IS_DETACHED(tcp)) {
4649 4766 /* We don't have an ACK timer for detached TCP. */
4650 4767 flags |= TH_ACK_NEEDED;
4651 4768 } else if (seg_len < mss) {
4652 4769 /*
4653 4770 * If we get a segment that is less than an mss, and we
4654 4771 * already have unacknowledged data, and the amount
4655 4772 * unacknowledged is not a multiple of mss, then we
4656 4773 * better generate an ACK now. Otherwise, this may be
4657 4774 * the tail piece of a transaction, and we would rather
4658 4775 * wait for the response.
4659 4776 */
4660 4777 uint32_t udif;
4661 4778 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4662 4779 (uintptr_t)INT_MAX);
4663 4780 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4664 4781 if (udif && (udif % mss))
4665 4782 flags |= TH_ACK_NEEDED;
4666 4783 else
4667 4784 flags |= TH_ACK_TIMER_NEEDED;
4668 4785 } else {
4669 4786 /* Start delayed ack timer */
4670 4787 flags |= TH_ACK_TIMER_NEEDED;
4671 4788 }
4672 4789 }
4673 4790 tcp->tcp_rnxt += seg_len;
4674 4791 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4675 4792
4676 4793 if (mp == NULL)
4677 4794 goto xmit_check;
4678 4795
4679 4796 /* Update SACK list */
4680 4797 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4681 4798 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4682 4799 &(tcp->tcp_num_sack_blk));
4683 4800 }
4684 4801
4685 4802 if (tcp->tcp_urp_mp) {
4686 4803 tcp->tcp_urp_mp->b_cont = mp;
4687 4804 mp = tcp->tcp_urp_mp;
4688 4805 tcp->tcp_urp_mp = NULL;
4689 4806 /* Ready for a new signal. */
4690 4807 tcp->tcp_urp_last_valid = B_FALSE;
4691 4808 #ifdef DEBUG
4692 4809 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4693 4810 "tcp_rput: sending exdata_ind %s",
4694 4811 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4695 4812 #endif /* DEBUG */
4696 4813 }
4697 4814
4698 4815 /*
4699 4816 * Check for ancillary data changes compared to last segment.
4700 4817 */
4701 4818 if (connp->conn_recv_ancillary.crb_all != 0) {
4702 4819 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4703 4820 if (mp == NULL)
4704 4821 return;
4705 4822 }
4706 4823
4707 4824 if (IPCL_IS_NONSTR(connp)) {
4708 4825 /*
4709 4826 * Non-STREAMS socket
4710 4827 */
4711 4828 boolean_t push = flags & (TH_PUSH|TH_FIN);
4712 4829 int error;
4713 4830
4714 4831 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4715 4832 mp, seg_len, 0, &error, &push) <= 0) {
4716 4833 /*
4717 4834 * We should never be in middle of a
4718 4835 * fallback, the squeue guarantees that.
4719 4836 */
4720 4837 ASSERT(error != EOPNOTSUPP);
4721 4838 if (error == ENOSPC)
4722 4839 tcp->tcp_rwnd -= seg_len;
4723 4840 } else if (push) {
4724 4841 /* PUSH bit set and sockfs is not flow controlled */
4725 4842 flags |= tcp_rwnd_reopen(tcp);
4726 4843 }
4727 4844 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4728 4845 /*
4729 4846 * Side queue inbound data until the accept happens.
4730 4847 * tcp_accept/tcp_rput drains this when the accept happens.
4731 4848 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4732 4849 * T_EXDATA_IND) it is queued on b_next.
4733 4850 * XXX Make urgent data use this. Requires:
4734 4851 * Removing tcp_listener check for TH_URG
4735 4852 * Making M_PCPROTO and MARK messages skip the eager case
4736 4853 */
4737 4854
4738 4855 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4739 4856 } else {
4740 4857 /* Active STREAMS socket */
4741 4858 if (mp->b_datap->db_type != M_DATA ||
4742 4859 (flags & TH_MARKNEXT_NEEDED)) {
4743 4860 if (tcp->tcp_rcv_list != NULL) {
4744 4861 flags |= tcp_rcv_drain(tcp);
4745 4862 }
4746 4863 ASSERT(tcp->tcp_rcv_list == NULL ||
4747 4864 tcp->tcp_fused_sigurg);
4748 4865
4749 4866 if (flags & TH_MARKNEXT_NEEDED) {
4750 4867 #ifdef DEBUG
4751 4868 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4752 4869 "tcp_rput: sending MSGMARKNEXT %s",
4753 4870 tcp_display(tcp, NULL,
4754 4871 DISP_PORT_ONLY));
4755 4872 #endif /* DEBUG */
4756 4873 mp->b_flag |= MSGMARKNEXT;
4757 4874 flags &= ~TH_MARKNEXT_NEEDED;
4758 4875 }
4759 4876
4760 4877 if (is_system_labeled())
4761 4878 tcp_setcred_data(mp, ira);
4762 4879
4763 4880 putnext(connp->conn_rq, mp);
4764 4881 if (!canputnext(connp->conn_rq))
4765 4882 tcp->tcp_rwnd -= seg_len;
4766 4883 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4767 4884 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4768 4885 if (tcp->tcp_rcv_list != NULL) {
4769 4886 /*
4770 4887 * Enqueue the new segment first and then
4771 4888 * call tcp_rcv_drain() to send all data
4772 4889 * up. The other way to do this is to
4773 4890 * send all queued data up and then call
4774 4891 * putnext() to send the new segment up.
4775 4892 * This way can remove the else part later
4776 4893 * on.
4777 4894 *
4778 4895 * We don't do this to avoid one more call to
4779 4896 * canputnext() as tcp_rcv_drain() needs to
4780 4897 * call canputnext().
4781 4898 */
4782 4899 tcp_rcv_enqueue(tcp, mp, seg_len,
4783 4900 ira->ira_cred);
4784 4901 flags |= tcp_rcv_drain(tcp);
4785 4902 } else {
4786 4903 if (is_system_labeled())
4787 4904 tcp_setcred_data(mp, ira);
4788 4905
4789 4906 putnext(connp->conn_rq, mp);
4790 4907 if (!canputnext(connp->conn_rq))
4791 4908 tcp->tcp_rwnd -= seg_len;
4792 4909 }
4793 4910 } else {
4794 4911 /*
4795 4912 * Enqueue all packets when processing an mblk
4796 4913 * from the co queue and also enqueue normal packets.
4797 4914 */
4798 4915 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4799 4916 }
4800 4917 /*
4801 4918 * Make sure the timer is running if we have data waiting
4802 4919 * for a push bit. This provides resiliency against
4803 4920 * implementations that do not correctly generate push bits.
4804 4921 */
4805 4922 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4806 4923 /*
4807 4924 * The connection may be closed at this point, so don't
4808 4925 * do anything for a detached tcp.
4809 4926 */
4810 4927 if (!TCP_IS_DETACHED(tcp))
4811 4928 tcp->tcp_push_tid = TCP_TIMER(tcp,
4812 4929 tcp_push_timer,
4813 4930 tcps->tcps_push_timer_interval);
4814 4931 }
4815 4932 }
4816 4933
4817 4934 xmit_check:
4818 4935 /* Is there anything left to do? */
4819 4936 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4820 4937 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4821 4938 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4822 4939 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4823 4940 goto done;
4824 4941
4825 4942 /* Any transmit work to do and a non-zero window? */
4826 4943 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4827 4944 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4828 4945 if (flags & TH_REXMIT_NEEDED) {
4829 4946 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4830 4947
|
↓ open down ↓ |
455 lines elided |
↑ open up ↑ |
4831 4948 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4832 4949 if (snd_size > mss)
4833 4950 snd_size = mss;
4834 4951 if (snd_size > tcp->tcp_swnd)
4835 4952 snd_size = tcp->tcp_swnd;
4836 4953 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4837 4954 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4838 4955 B_TRUE);
4839 4956
4840 4957 if (mp1 != NULL) {
4958 +#ifdef KERNEL_32
4841 4959 tcp->tcp_xmit_head->b_prev =
4842 4960 (mblk_t *)LBOLT_FASTPATH;
4961 +#else
4962 + tcp->tcp_xmit_head->b_prev =
4963 + (mblk_t *)(intptr_t)gethrtime();
4964 +#endif
4843 4965 tcp->tcp_csuna = tcp->tcp_snxt;
4844 4966 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4845 4967 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4846 4968 snd_size);
4969 + tcp->tcp_cs.tcp_out_retrans_segs++;
4970 + tcp->tcp_cs.tcp_out_retrans_bytes += snd_size;
4847 4971 tcp_send_data(tcp, mp1);
4848 4972 }
4849 4973 }
4850 4974 if (flags & TH_NEED_SACK_REXMIT) {
4851 4975 tcp_sack_rexmit(tcp, &flags);
4852 4976 }
4853 4977 /*
4854 4978 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4855 4979 * out new segment. Note that tcp_rexmit should not be
4856 4980 * set, otherwise TH_LIMIT_XMIT should not be set.
4857 4981 */
4858 4982 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4859 4983 if (!tcp->tcp_rexmit) {
4860 4984 tcp_wput_data(tcp, NULL, B_FALSE);
4861 4985 } else {
4862 4986 tcp_ss_rexmit(tcp);
4863 4987 }
4864 4988 }
4865 4989 /*
|
↓ open down ↓ |
9 lines elided |
↑ open up ↑ |
4866 4990 * Adjust tcp_cwnd back to normal value after sending
4867 4991 * new data segments.
4868 4992 */
4869 4993 if (flags & TH_LIMIT_XMIT) {
4870 4994 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4871 4995 /*
4872 4996 * This will restart the timer. Restarting the
4873 4997 * timer is used to avoid a timeout before the
4874 4998 * limited transmitted segment's ACK gets back.
4875 4999 */
4876 - if (tcp->tcp_xmit_head != NULL)
5000 + if (tcp->tcp_xmit_head != NULL) {
5001 +#ifdef KERNEL_32
4877 5002 tcp->tcp_xmit_head->b_prev =
4878 5003 (mblk_t *)LBOLT_FASTPATH;
5004 +#else
5005 + tcp->tcp_xmit_head->b_prev =
5006 + (mblk_t *)(intptr_t)gethrtime();
5007 +#endif
5008 + }
4879 5009 }
4880 5010
4881 5011 /* Anything more to do? */
4882 5012 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4883 5013 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4884 5014 goto done;
4885 5015 }
4886 5016 ack_check:
4887 5017 if (flags & TH_SEND_URP_MARK) {
4888 5018 ASSERT(tcp->tcp_urp_mark_mp);
4889 5019 ASSERT(!IPCL_IS_NONSTR(connp));
4890 5020 /*
4891 5021 * Send up any queued data and then send the mark message
4892 5022 */
4893 5023 if (tcp->tcp_rcv_list != NULL) {
4894 5024 flags |= tcp_rcv_drain(tcp);
4895 5025
4896 5026 }
4897 5027 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4898 5028 mp1 = tcp->tcp_urp_mark_mp;
4899 5029 tcp->tcp_urp_mark_mp = NULL;
4900 5030 if (is_system_labeled())
4901 5031 tcp_setcred_data(mp1, ira);
4902 5032
4903 5033 putnext(connp->conn_rq, mp1);
4904 5034 #ifdef DEBUG
4905 5035 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4906 5036 "tcp_rput: sending zero-length %s %s",
4907 5037 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4908 5038 "MSGNOTMARKNEXT"),
4909 5039 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4910 5040 #endif /* DEBUG */
|
↓ open down ↓ |
22 lines elided |
↑ open up ↑ |
4911 5041 flags &= ~TH_SEND_URP_MARK;
4912 5042 }
4913 5043 if (flags & TH_ACK_NEEDED) {
4914 5044 /*
4915 5045 * Time to send an ack for some reason.
4916 5046 */
4917 5047 mp1 = tcp_ack_mp(tcp);
4918 5048
4919 5049 if (mp1 != NULL) {
4920 5050 tcp_send_data(tcp, mp1);
4921 - BUMP_LOCAL(tcp->tcp_obsegs);
5051 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4922 5052 TCPS_BUMP_MIB(tcps, tcpOutAck);
4923 5053 }
4924 5054 if (tcp->tcp_ack_tid != 0) {
4925 5055 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4926 5056 tcp->tcp_ack_tid = 0;
4927 5057 }
4928 5058 }
4929 5059 if (flags & TH_ACK_TIMER_NEEDED) {
4930 5060 /*
4931 5061 * Arrange for deferred ACK or push wait timeout.
4932 5062 * Start timer if it is not already running.
4933 5063 */
4934 5064 if (tcp->tcp_ack_tid == 0) {
4935 5065 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4936 5066 tcp->tcp_localnet ?
4937 5067 tcps->tcps_local_dack_interval :
4938 5068 tcps->tcps_deferred_ack_interval);
4939 5069 }
4940 5070 }
4941 5071 if (flags & TH_ORDREL_NEEDED) {
4942 5072 /*
4943 5073 * Notify upper layer about an orderly release. If this is
4944 5074 * a non-STREAMS socket, then just make an upcall. For STREAMS
4945 5075 * we send up an ordrel_ind, unless this is an eager, in which
4946 5076 * case the ordrel will be sent when tcp_accept_finish runs.
4947 5077 * Note that for non-STREAMS we make an upcall even if it is an
4948 5078 * eager, because we have an upper handle to send it to.
4949 5079 */
4950 5080 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4951 5081 ASSERT(!tcp->tcp_detached);
4952 5082
4953 5083 if (IPCL_IS_NONSTR(connp)) {
4954 5084 ASSERT(tcp->tcp_ordrel_mp == NULL);
4955 5085 tcp->tcp_ordrel_done = B_TRUE;
4956 5086 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4957 5087 SOCK_OPCTL_SHUT_RECV, 0);
4958 5088 goto done;
4959 5089 }
4960 5090
4961 5091 if (tcp->tcp_rcv_list != NULL) {
4962 5092 /*
4963 5093 * Push any mblk(s) enqueued from co processing.
4964 5094 */
4965 5095 flags |= tcp_rcv_drain(tcp);
4966 5096 }
4967 5097 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4968 5098
4969 5099 mp1 = tcp->tcp_ordrel_mp;
4970 5100 tcp->tcp_ordrel_mp = NULL;
4971 5101 tcp->tcp_ordrel_done = B_TRUE;
4972 5102 putnext(connp->conn_rq, mp1);
4973 5103 }
4974 5104 done:
4975 5105 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4976 5106 }
4977 5107
4978 5108 /*
4979 5109 * Attach ancillary data to a received TCP segments for the
4980 5110 * ancillary pieces requested by the application that are
4981 5111 * different than they were in the previous data segment.
4982 5112 *
4983 5113 * Save the "current" values once memory allocation is ok so that
4984 5114 * when memory allocation fails we can just wait for the next data segment.
4985 5115 */
4986 5116 static mblk_t *
4987 5117 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
4988 5118 ip_recv_attr_t *ira)
4989 5119 {
4990 5120 struct T_optdata_ind *todi;
4991 5121 int optlen;
4992 5122 uchar_t *optptr;
4993 5123 struct T_opthdr *toh;
4994 5124 crb_t addflag; /* Which pieces to add */
4995 5125 mblk_t *mp1;
4996 5126 conn_t *connp = tcp->tcp_connp;
4997 5127
4998 5128 optlen = 0;
4999 5129 addflag.crb_all = 0;
5000 5130 /* If app asked for pktinfo and the index has changed ... */
5001 5131 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5002 5132 ira->ira_ruifindex != tcp->tcp_recvifindex) {
5003 5133 optlen += sizeof (struct T_opthdr) +
5004 5134 sizeof (struct in6_pktinfo);
5005 5135 addflag.crb_ip_recvpktinfo = 1;
5006 5136 }
5007 5137 /* If app asked for hoplimit and it has changed ... */
5008 5138 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5009 5139 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5010 5140 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5011 5141 addflag.crb_ipv6_recvhoplimit = 1;
5012 5142 }
5013 5143 /* If app asked for tclass and it has changed ... */
5014 5144 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5015 5145 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5016 5146 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5017 5147 addflag.crb_ipv6_recvtclass = 1;
5018 5148 }
5019 5149 /*
5020 5150 * If app asked for hopbyhop headers and it has changed ...
5021 5151 * For security labels, note that (1) security labels can't change on
5022 5152 * a connected socket at all, (2) we're connected to at most one peer,
5023 5153 * (3) if anything changes, then it must be some other extra option.
5024 5154 */
5025 5155 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5026 5156 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5027 5157 (ipp->ipp_fields & IPPF_HOPOPTS),
5028 5158 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5029 5159 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5030 5160 addflag.crb_ipv6_recvhopopts = 1;
5031 5161 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5032 5162 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5033 5163 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5034 5164 return (mp);
5035 5165 }
5036 5166 /* If app asked for dst headers before routing headers ... */
5037 5167 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5038 5168 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5039 5169 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5040 5170 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5041 5171 optlen += sizeof (struct T_opthdr) +
5042 5172 ipp->ipp_rthdrdstoptslen;
5043 5173 addflag.crb_ipv6_recvrthdrdstopts = 1;
5044 5174 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5045 5175 &tcp->tcp_rthdrdstoptslen,
5046 5176 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5047 5177 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5048 5178 return (mp);
5049 5179 }
5050 5180 /* If app asked for routing headers and it has changed ... */
5051 5181 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5052 5182 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5053 5183 (ipp->ipp_fields & IPPF_RTHDR),
5054 5184 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5055 5185 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5056 5186 addflag.crb_ipv6_recvrthdr = 1;
5057 5187 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5058 5188 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5059 5189 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5060 5190 return (mp);
5061 5191 }
5062 5192 /* If app asked for dest headers and it has changed ... */
5063 5193 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5064 5194 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5065 5195 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5066 5196 (ipp->ipp_fields & IPPF_DSTOPTS),
5067 5197 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5068 5198 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5069 5199 addflag.crb_ipv6_recvdstopts = 1;
5070 5200 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5071 5201 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5072 5202 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5073 5203 return (mp);
5074 5204 }
5075 5205
5076 5206 if (optlen == 0) {
5077 5207 /* Nothing to add */
5078 5208 return (mp);
5079 5209 }
5080 5210 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5081 5211 if (mp1 == NULL) {
5082 5212 /*
5083 5213 * Defer sending ancillary data until the next TCP segment
5084 5214 * arrives.
5085 5215 */
5086 5216 return (mp);
5087 5217 }
5088 5218 mp1->b_cont = mp;
5089 5219 mp = mp1;
5090 5220 mp->b_wptr += sizeof (*todi) + optlen;
5091 5221 mp->b_datap->db_type = M_PROTO;
5092 5222 todi = (struct T_optdata_ind *)mp->b_rptr;
5093 5223 todi->PRIM_type = T_OPTDATA_IND;
5094 5224 todi->DATA_flag = 1; /* MORE data */
5095 5225 todi->OPT_length = optlen;
5096 5226 todi->OPT_offset = sizeof (*todi);
5097 5227 optptr = (uchar_t *)&todi[1];
5098 5228 /*
5099 5229 * If app asked for pktinfo and the index has changed ...
5100 5230 * Note that the local address never changes for the connection.
5101 5231 */
5102 5232 if (addflag.crb_ip_recvpktinfo) {
5103 5233 struct in6_pktinfo *pkti;
5104 5234 uint_t ifindex;
5105 5235
5106 5236 ifindex = ira->ira_ruifindex;
5107 5237 toh = (struct T_opthdr *)optptr;
5108 5238 toh->level = IPPROTO_IPV6;
5109 5239 toh->name = IPV6_PKTINFO;
5110 5240 toh->len = sizeof (*toh) + sizeof (*pkti);
5111 5241 toh->status = 0;
5112 5242 optptr += sizeof (*toh);
5113 5243 pkti = (struct in6_pktinfo *)optptr;
5114 5244 pkti->ipi6_addr = connp->conn_laddr_v6;
5115 5245 pkti->ipi6_ifindex = ifindex;
5116 5246 optptr += sizeof (*pkti);
5117 5247 ASSERT(OK_32PTR(optptr));
5118 5248 /* Save as "last" value */
5119 5249 tcp->tcp_recvifindex = ifindex;
5120 5250 }
5121 5251 /* If app asked for hoplimit and it has changed ... */
5122 5252 if (addflag.crb_ipv6_recvhoplimit) {
5123 5253 toh = (struct T_opthdr *)optptr;
5124 5254 toh->level = IPPROTO_IPV6;
5125 5255 toh->name = IPV6_HOPLIMIT;
5126 5256 toh->len = sizeof (*toh) + sizeof (uint_t);
5127 5257 toh->status = 0;
5128 5258 optptr += sizeof (*toh);
5129 5259 *(uint_t *)optptr = ipp->ipp_hoplimit;
5130 5260 optptr += sizeof (uint_t);
5131 5261 ASSERT(OK_32PTR(optptr));
5132 5262 /* Save as "last" value */
5133 5263 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5134 5264 }
5135 5265 /* If app asked for tclass and it has changed ... */
5136 5266 if (addflag.crb_ipv6_recvtclass) {
5137 5267 toh = (struct T_opthdr *)optptr;
5138 5268 toh->level = IPPROTO_IPV6;
5139 5269 toh->name = IPV6_TCLASS;
5140 5270 toh->len = sizeof (*toh) + sizeof (uint_t);
5141 5271 toh->status = 0;
5142 5272 optptr += sizeof (*toh);
5143 5273 *(uint_t *)optptr = ipp->ipp_tclass;
5144 5274 optptr += sizeof (uint_t);
5145 5275 ASSERT(OK_32PTR(optptr));
5146 5276 /* Save as "last" value */
5147 5277 tcp->tcp_recvtclass = ipp->ipp_tclass;
5148 5278 }
5149 5279 if (addflag.crb_ipv6_recvhopopts) {
5150 5280 toh = (struct T_opthdr *)optptr;
5151 5281 toh->level = IPPROTO_IPV6;
5152 5282 toh->name = IPV6_HOPOPTS;
5153 5283 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5154 5284 toh->status = 0;
5155 5285 optptr += sizeof (*toh);
5156 5286 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5157 5287 optptr += ipp->ipp_hopoptslen;
5158 5288 ASSERT(OK_32PTR(optptr));
5159 5289 /* Save as last value */
5160 5290 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5161 5291 (ipp->ipp_fields & IPPF_HOPOPTS),
5162 5292 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5163 5293 }
5164 5294 if (addflag.crb_ipv6_recvrthdrdstopts) {
5165 5295 toh = (struct T_opthdr *)optptr;
5166 5296 toh->level = IPPROTO_IPV6;
5167 5297 toh->name = IPV6_RTHDRDSTOPTS;
5168 5298 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5169 5299 toh->status = 0;
5170 5300 optptr += sizeof (*toh);
5171 5301 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5172 5302 optptr += ipp->ipp_rthdrdstoptslen;
5173 5303 ASSERT(OK_32PTR(optptr));
5174 5304 /* Save as last value */
5175 5305 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5176 5306 &tcp->tcp_rthdrdstoptslen,
5177 5307 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5178 5308 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5179 5309 }
5180 5310 if (addflag.crb_ipv6_recvrthdr) {
5181 5311 toh = (struct T_opthdr *)optptr;
5182 5312 toh->level = IPPROTO_IPV6;
5183 5313 toh->name = IPV6_RTHDR;
5184 5314 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5185 5315 toh->status = 0;
5186 5316 optptr += sizeof (*toh);
5187 5317 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5188 5318 optptr += ipp->ipp_rthdrlen;
5189 5319 ASSERT(OK_32PTR(optptr));
5190 5320 /* Save as last value */
5191 5321 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5192 5322 (ipp->ipp_fields & IPPF_RTHDR),
5193 5323 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5194 5324 }
5195 5325 if (addflag.crb_ipv6_recvdstopts) {
5196 5326 toh = (struct T_opthdr *)optptr;
5197 5327 toh->level = IPPROTO_IPV6;
5198 5328 toh->name = IPV6_DSTOPTS;
5199 5329 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5200 5330 toh->status = 0;
5201 5331 optptr += sizeof (*toh);
5202 5332 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5203 5333 optptr += ipp->ipp_dstoptslen;
|
↓ open down ↓ |
272 lines elided |
↑ open up ↑ |
5204 5334 ASSERT(OK_32PTR(optptr));
5205 5335 /* Save as last value */
5206 5336 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5207 5337 (ipp->ipp_fields & IPPF_DSTOPTS),
5208 5338 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5209 5339 }
5210 5340 ASSERT(optptr == mp->b_wptr);
5211 5341 return (mp);
5212 5342 }
5213 5343
5214 -/* The minimum of smoothed mean deviation in RTO calculation. */
5215 -#define TCP_SD_MIN 400
5344 +/* The minimum of smoothed mean deviation in RTO calculation (nsec). */
5345 +#define TCP_SD_MIN 400000000
5216 5346
5217 5347 /*
5218 - * Set RTO for this connection. The formula is from Jacobson and Karels'
5219 - * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names
5220 - * are the same as those in Appendix A.2 of that paper.
5348 + * Set RTO for this connection based on a new round-trip time measurement.
5349 + * The formula is from Jacobson and Karels' "Congestion Avoidance and Control"
5350 + * in SIGCOMM '88. The variable names are the same as those in Appendix A.2
5351 + * of that paper.
5221 5352 *
5222 5353 * m = new measurement
5223 5354 * sa = smoothed RTT average (8 * average estimates).
5224 5355 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5225 5356 */
5226 5357 static void
5227 -tcp_set_rto(tcp_t *tcp, clock_t rtt)
5358 +tcp_set_rto(tcp_t *tcp, hrtime_t rtt)
5228 5359 {
5229 - long m = TICK_TO_MSEC(rtt);
5230 - clock_t sa = tcp->tcp_rtt_sa;
5231 - clock_t sv = tcp->tcp_rtt_sd;
5232 - clock_t rto;
5233 - tcp_stack_t *tcps = tcp->tcp_tcps;
5360 + hrtime_t m = rtt;
5361 + hrtime_t sa = tcp->tcp_rtt_sa;
5362 + hrtime_t sv = tcp->tcp_rtt_sd;
5363 + tcp_stack_t *tcps = tcp->tcp_tcps;
5234 5364
5235 5365 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5236 5366 tcp->tcp_rtt_update++;
5367 + tcp->tcp_rtt_sum += m;
5368 + tcp->tcp_rtt_cnt++;
5237 5369
5238 5370 /* tcp_rtt_sa is not 0 means this is a new sample. */
5239 5371 if (sa != 0) {
5240 5372 /*
5241 - * Update average estimator:
5242 - * new rtt = 7/8 old rtt + 1/8 Error
5373 + * Update average estimator (see section 2.3 of RFC6298):
5374 + * SRTT = 7/8 SRTT + 1/8 rtt
5375 + *
5376 + * We maintain tcp_rtt_sa as 8 * SRTT, so this reduces to:
5377 + * tcp_rtt_sa = 7 SRTT + rtt
5378 + * tcp_rtt_sa = tcp_rtt_sa - 1/8 tcp_rtt_sa + rtt
5379 + * tcp_rtt_sa = tcp_rtt_sa + (rtt - 1/8 tcp_rtt_sa)
5380 + *
5381 + * (rtt - 1/8 tcp_rtt_sa) is simply the difference
5382 + * between the new rtt measurement and the existing smoothed
5383 + * RTT average. This is referred to as "Error" in subsequent
5384 + * calculations.
5243 5385 */
5244 5386
5245 - /* m is now Error in estimate. */
5387 + /* m is now Error. */
5246 5388 m -= sa >> 3;
5247 5389 if ((sa += m) <= 0) {
5248 5390 /*
5249 5391 * Don't allow the smoothed average to be negative.
5250 5392 * We use 0 to denote reinitialization of the
5251 5393 * variables.
5252 5394 */
5253 5395 sa = 1;
5254 5396 }
5255 5397
5256 5398 /*
5257 5399 * Update deviation estimator:
5258 - * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5400 + * mdev = 3/4 mdev + 1/4 abs(Error)
5401 + *
5402 + * We maintain tcp_rtt_sd as 4 * mdev, so this reduces to:
5403 + * tcp_rtt_sd = 3 mdev + abs(Error)
5404 + * tcp_rtt_sd = tcp_rtt_sd - 1/4 tcp_rtt_sd + abs(Error)
5259 5405 */
5260 5406 if (m < 0)
5261 5407 m = -m;
5262 5408 m -= sv >> 2;
5263 5409 sv += m;
5264 5410 } else {
5265 5411 /*
5266 5412 * This follows BSD's implementation. So the reinitialized
5267 5413 * RTO is 3 * m. We cannot go less than 2 because if the
5268 5414 * link is bandwidth dominated, doubling the window size
5269 5415 * during slow start means doubling the RTT. We want to be
5270 5416 * more conservative when we reinitialize our estimates. 3
5271 5417 * is just a convenient number.
5272 5418 */
5273 5419 sa = m << 3;
|
↓ open down ↓ |
5 lines elided |
↑ open up ↑ |
5274 5420 sv = m << 1;
5275 5421 }
5276 5422 if (sv < TCP_SD_MIN) {
5277 5423 /*
5278 5424 * We do not know that if sa captures the delay ACK
5279 5425 * effect as in a long train of segments, a receiver
5280 5426 * does not delay its ACKs. So set the minimum of sv
5281 5427 * to be TCP_SD_MIN, which is default to 400 ms, twice
5282 5428 * of BSD DATO. That means the minimum of mean
5283 5429 * deviation is 100 ms.
5284 - *
5285 5430 */
5286 5431 sv = TCP_SD_MIN;
5287 5432 }
5288 5433 tcp->tcp_rtt_sa = sa;
5289 5434 tcp->tcp_rtt_sd = sv;
5290 - /*
5291 - * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5292 - *
5293 - * Add tcp_rexmit_interval extra in case of extreme environment
5294 - * where the algorithm fails to work. The default value of
5295 - * tcp_rexmit_interval_extra should be 0.
5296 - *
5297 - * As we use a finer grained clock than BSD and update
5298 - * RTO for every ACKs, add in another .25 of RTT to the
5299 - * deviation of RTO to accomodate burstiness of 1/4 of
5300 - * window size.
5301 - */
5302 - rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5303 5435
5304 - TCP_SET_RTO(tcp, rto);
5436 + tcp->tcp_rto = tcp_calculate_rto(tcp, tcps);
5305 5437
5306 5438 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5307 5439 tcp->tcp_timer_backoff = 0;
5308 5440 }
5309 5441
5310 5442 /*
5311 5443 * On a labeled system we have some protocols above TCP, such as RPC, which
5312 5444 * appear to assume that every mblk in a chain has a db_credp.
5313 5445 */
5314 5446 static void
5315 5447 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5316 5448 {
5317 5449 ASSERT(is_system_labeled());
5318 5450 ASSERT(ira->ira_cred != NULL);
5319 5451
5320 5452 while (mp != NULL) {
5321 5453 mblk_setcred(mp, ira->ira_cred, NOPID);
5322 5454 mp = mp->b_cont;
5323 5455 }
5324 5456 }
5325 5457
5326 5458 uint_t
5327 5459 tcp_rwnd_reopen(tcp_t *tcp)
5328 5460 {
5329 5461 uint_t ret = 0;
5330 5462 uint_t thwin;
5331 5463 conn_t *connp = tcp->tcp_connp;
5332 5464
5333 5465 /* Learn the latest rwnd information that we sent to the other side. */
5334 5466 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5335 5467 << tcp->tcp_rcv_ws;
5336 5468 /* This is peer's calculated send window (our receive window). */
5337 5469 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5338 5470 /*
5339 5471 * Increase the receive window to max. But we need to do receiver
5340 5472 * SWS avoidance. This means that we need to check the increase of
5341 5473 * of receive window is at least 1 MSS.
5342 5474 */
5343 5475 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5344 5476 /*
5345 5477 * If the window that the other side knows is less than max
5346 5478 * deferred acks segments, send an update immediately.
5347 5479 */
5348 5480 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5349 5481 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5350 5482 ret = TH_ACK_NEEDED;
5351 5483 }
5352 5484 tcp->tcp_rwnd = connp->conn_rcvbuf;
5353 5485 }
5354 5486 return (ret);
5355 5487 }
5356 5488
5357 5489 /*
5358 5490 * Handle a packet that has been reclassified by TCP.
5359 5491 * This function drops the ref on connp that the caller had.
5360 5492 */
5361 5493 void
5362 5494 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5363 5495 {
5364 5496 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5365 5497
5366 5498 if (connp->conn_incoming_ifindex != 0 &&
5367 5499 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5368 5500 freemsg(mp);
5369 5501 CONN_DEC_REF(connp);
5370 5502 return;
5371 5503 }
5372 5504
5373 5505 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5374 5506 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5375 5507 ip6_t *ip6h;
5376 5508 ipha_t *ipha;
5377 5509
5378 5510 if (ira->ira_flags & IRAF_IS_IPV4) {
5379 5511 ipha = (ipha_t *)mp->b_rptr;
5380 5512 ip6h = NULL;
5381 5513 } else {
5382 5514 ipha = NULL;
5383 5515 ip6h = (ip6_t *)mp->b_rptr;
5384 5516 }
5385 5517 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5386 5518 if (mp == NULL) {
5387 5519 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5388 5520 /* Note that mp is NULL */
5389 5521 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5390 5522 CONN_DEC_REF(connp);
5391 5523 return;
5392 5524 }
5393 5525 }
5394 5526
5395 5527 if (IPCL_IS_TCP(connp)) {
5396 5528 /*
5397 5529 * do not drain, certain use cases can blow
5398 5530 * the stack
5399 5531 */
5400 5532 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5401 5533 connp->conn_recv, connp, ira,
5402 5534 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5403 5535 } else {
5404 5536 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5405 5537 (connp->conn_recv)(connp, mp, NULL,
5406 5538 ira);
5407 5539 CONN_DEC_REF(connp);
5408 5540 }
5409 5541
5410 5542 }
5411 5543
5412 5544 /* ARGSUSED */
5413 5545 static void
5414 5546 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5415 5547 {
5416 5548 conn_t *connp = (conn_t *)arg;
5417 5549 tcp_t *tcp = connp->conn_tcp;
5418 5550 queue_t *q = connp->conn_rq;
5419 5551
5420 5552 ASSERT(!IPCL_IS_NONSTR(connp));
5421 5553 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5422 5554 tcp->tcp_rsrv_mp = mp;
5423 5555 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5424 5556
5425 5557 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5426 5558 return;
5427 5559 }
5428 5560
5429 5561 if (tcp->tcp_fused) {
5430 5562 tcp_fuse_backenable(tcp);
5431 5563 return;
5432 5564 }
5433 5565
5434 5566 if (canputnext(q)) {
5435 5567 /* Not flow-controlled, open rwnd */
5436 5568 tcp->tcp_rwnd = connp->conn_rcvbuf;
5437 5569
5438 5570 /*
5439 5571 * Send back a window update immediately if TCP is above
5440 5572 * ESTABLISHED state and the increase of the rcv window
5441 5573 * that the other side knows is at least 1 MSS after flow
5442 5574 * control is lifted.
5443 5575 */
5444 5576 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5445 5577 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5446 5578 tcp_xmit_ctl(NULL, tcp,
5447 5579 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5448 5580 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5449 5581 }
5450 5582 }
5451 5583 }
5452 5584
5453 5585 /*
5454 5586 * The read side service routine is called mostly when we get back-enabled as a
5455 5587 * result of flow control relief. Since we don't actually queue anything in
5456 5588 * TCP, we have no data to send out of here. What we do is clear the receive
5457 5589 * window, and send out a window update.
5458 5590 */
5459 5591 void
5460 5592 tcp_rsrv(queue_t *q)
5461 5593 {
5462 5594 conn_t *connp = Q_TO_CONN(q);
5463 5595 tcp_t *tcp = connp->conn_tcp;
5464 5596 mblk_t *mp;
5465 5597
5466 5598 /* No code does a putq on the read side */
5467 5599 ASSERT(q->q_first == NULL);
5468 5600
5469 5601 /*
5470 5602 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5471 5603 * been run. So just return.
5472 5604 */
5473 5605 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5474 5606 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5475 5607 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5476 5608 return;
5477 5609 }
5478 5610 tcp->tcp_rsrv_mp = NULL;
5479 5611 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5480 5612
5481 5613 CONN_INC_REF(connp);
5482 5614 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5483 5615 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5484 5616 }
5485 5617
5486 5618 /* At minimum we need 8 bytes in the TCP header for the lookup */
5487 5619 #define ICMP_MIN_TCP_HDR 8
5488 5620
5489 5621 /*
5490 5622 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5491 5623 * passed up by IP. The message is always received on the correct tcp_t.
5492 5624 * Assumes that IP has pulled up everything up to and including the ICMP header.
5493 5625 */
5494 5626 /* ARGSUSED2 */
5495 5627 void
5496 5628 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5497 5629 {
5498 5630 conn_t *connp = (conn_t *)arg1;
5499 5631 icmph_t *icmph;
5500 5632 ipha_t *ipha;
5501 5633 int iph_hdr_length;
5502 5634 tcpha_t *tcpha;
5503 5635 uint32_t seg_seq;
5504 5636 tcp_t *tcp = connp->conn_tcp;
5505 5637
5506 5638 /* Assume IP provides aligned packets */
5507 5639 ASSERT(OK_32PTR(mp->b_rptr));
5508 5640 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5509 5641
5510 5642 /*
5511 5643 * It's possible we have a closed, but not yet destroyed, TCP
5512 5644 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5513 5645 * in the closed state, so don't take any chances and drop the packet.
5514 5646 */
5515 5647 if (tcp->tcp_state == TCPS_CLOSED) {
5516 5648 freemsg(mp);
5517 5649 return;
5518 5650 }
5519 5651
5520 5652 /*
5521 5653 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5522 5654 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5523 5655 */
5524 5656 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5525 5657 tcp_icmp_error_ipv6(tcp, mp, ira);
5526 5658 return;
5527 5659 }
5528 5660
5529 5661 /* Skip past the outer IP and ICMP headers */
5530 5662 iph_hdr_length = ira->ira_ip_hdr_length;
5531 5663 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5532 5664 /*
5533 5665 * If we don't have the correct outer IP header length
5534 5666 * or if we don't have a complete inner IP header
5535 5667 * drop it.
5536 5668 */
5537 5669 if (iph_hdr_length < sizeof (ipha_t) ||
5538 5670 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5539 5671 noticmpv4:
5540 5672 freemsg(mp);
5541 5673 return;
5542 5674 }
5543 5675 ipha = (ipha_t *)&icmph[1];
5544 5676
5545 5677 /* Skip past the inner IP and find the ULP header */
5546 5678 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5547 5679 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5548 5680 /*
5549 5681 * If we don't have the correct inner IP header length or if the ULP
5550 5682 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5551 5683 * bytes of TCP header, drop it.
5552 5684 */
5553 5685 if (iph_hdr_length < sizeof (ipha_t) ||
5554 5686 ipha->ipha_protocol != IPPROTO_TCP ||
5555 5687 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5556 5688 goto noticmpv4;
5557 5689 }
5558 5690
5559 5691 seg_seq = ntohl(tcpha->tha_seq);
5560 5692 switch (icmph->icmph_type) {
5561 5693 case ICMP_DEST_UNREACHABLE:
5562 5694 switch (icmph->icmph_code) {
5563 5695 case ICMP_FRAGMENTATION_NEEDED:
5564 5696 /*
5565 5697 * Attempt to update path MTU and, if the MSS of the
5566 5698 * connection is altered, retransmit outstanding data.
5567 5699 */
5568 5700 if (tcp_update_pmtu(tcp, B_TRUE)) {
5569 5701 tcp_rexmit_after_error(tcp);
5570 5702 }
5571 5703 break;
5572 5704 case ICMP_PORT_UNREACHABLE:
5573 5705 case ICMP_PROTOCOL_UNREACHABLE:
5574 5706 switch (tcp->tcp_state) {
5575 5707 case TCPS_SYN_SENT:
5576 5708 case TCPS_SYN_RCVD:
5577 5709 /*
5578 5710 * ICMP can snipe away incipient
5579 5711 * TCP connections as long as
5580 5712 * seq number is same as initial
5581 5713 * send seq number.
5582 5714 */
5583 5715 if (seg_seq == tcp->tcp_iss) {
5584 5716 (void) tcp_clean_death(tcp,
5585 5717 ECONNREFUSED);
5586 5718 }
5587 5719 break;
5588 5720 }
5589 5721 break;
5590 5722 case ICMP_HOST_UNREACHABLE:
5591 5723 case ICMP_NET_UNREACHABLE:
5592 5724 /* Record the error in case we finally time out. */
5593 5725 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5594 5726 tcp->tcp_client_errno = EHOSTUNREACH;
5595 5727 else
5596 5728 tcp->tcp_client_errno = ENETUNREACH;
5597 5729 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5598 5730 if (tcp->tcp_listener != NULL &&
5599 5731 tcp->tcp_listener->tcp_syn_defense) {
5600 5732 /*
5601 5733 * Ditch the half-open connection if we
5602 5734 * suspect a SYN attack is under way.
5603 5735 */
5604 5736 (void) tcp_clean_death(tcp,
5605 5737 tcp->tcp_client_errno);
5606 5738 }
5607 5739 }
5608 5740 break;
5609 5741 default:
5610 5742 break;
5611 5743 }
5612 5744 break;
5613 5745 case ICMP_SOURCE_QUENCH:
5614 5746 /*
5615 5747 * use a global boolean to control
5616 5748 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5617 5749 * The default is false.
5618 5750 */
|
↓ open down ↓ |
304 lines elided |
↑ open up ↑ |
5619 5751 if (tcp_icmp_source_quench) {
5620 5752 /*
5621 5753 * Reduce the sending rate as if we got a
5622 5754 * retransmit timeout
5623 5755 */
5624 5756 uint32_t npkt;
5625 5757
5626 5758 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5627 5759 tcp->tcp_mss;
5628 5760 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5761 +
5762 + DTRACE_PROBE3(cwnd__source__quench, tcp_t *, tcp,
5763 + uint32_t, tcp->tcp_cwnd,
5764 + uint32_t, tcp->tcp_mss);
5629 5765 tcp->tcp_cwnd = tcp->tcp_mss;
5630 5766 tcp->tcp_cwnd_cnt = 0;
5631 5767 }
5632 5768 break;
5633 5769 }
5634 5770 freemsg(mp);
5635 5771 }
5636 5772
5637 5773 /*
5638 5774 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5639 5775 * error messages passed up by IP.
5640 5776 * Assumes that IP has pulled up all the extension headers as well
5641 5777 * as the ICMPv6 header.
5642 5778 */
5643 5779 static void
5644 5780 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5645 5781 {
5646 5782 icmp6_t *icmp6;
5647 5783 ip6_t *ip6h;
5648 5784 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5649 5785 tcpha_t *tcpha;
5650 5786 uint8_t *nexthdrp;
5651 5787 uint32_t seg_seq;
5652 5788
5653 5789 /*
5654 5790 * Verify that we have a complete IP header.
5655 5791 */
5656 5792 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5657 5793
5658 5794 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5659 5795 ip6h = (ip6_t *)&icmp6[1];
5660 5796 /*
5661 5797 * Verify if we have a complete ICMP and inner IP header.
5662 5798 */
5663 5799 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5664 5800 noticmpv6:
5665 5801 freemsg(mp);
5666 5802 return;
5667 5803 }
5668 5804
5669 5805 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5670 5806 goto noticmpv6;
5671 5807 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5672 5808 /*
5673 5809 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5674 5810 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5675 5811 * packet.
5676 5812 */
5677 5813 if ((*nexthdrp != IPPROTO_TCP) ||
5678 5814 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5679 5815 goto noticmpv6;
5680 5816 }
5681 5817
5682 5818 seg_seq = ntohl(tcpha->tha_seq);
5683 5819 switch (icmp6->icmp6_type) {
5684 5820 case ICMP6_PACKET_TOO_BIG:
5685 5821 /*
5686 5822 * Attempt to update path MTU and, if the MSS of the connection
5687 5823 * is altered, retransmit outstanding data.
5688 5824 */
5689 5825 if (tcp_update_pmtu(tcp, B_TRUE)) {
5690 5826 tcp_rexmit_after_error(tcp);
5691 5827 }
5692 5828 break;
5693 5829 case ICMP6_DST_UNREACH:
5694 5830 switch (icmp6->icmp6_code) {
5695 5831 case ICMP6_DST_UNREACH_NOPORT:
5696 5832 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5697 5833 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5698 5834 (seg_seq == tcp->tcp_iss)) {
5699 5835 (void) tcp_clean_death(tcp, ECONNREFUSED);
5700 5836 }
5701 5837 break;
5702 5838 case ICMP6_DST_UNREACH_ADMIN:
5703 5839 case ICMP6_DST_UNREACH_NOROUTE:
5704 5840 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5705 5841 case ICMP6_DST_UNREACH_ADDR:
5706 5842 /* Record the error in case we finally time out. */
5707 5843 tcp->tcp_client_errno = EHOSTUNREACH;
5708 5844 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5709 5845 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5710 5846 (seg_seq == tcp->tcp_iss)) {
5711 5847 if (tcp->tcp_listener != NULL &&
5712 5848 tcp->tcp_listener->tcp_syn_defense) {
5713 5849 /*
5714 5850 * Ditch the half-open connection if we
5715 5851 * suspect a SYN attack is under way.
5716 5852 */
5717 5853 (void) tcp_clean_death(tcp,
5718 5854 tcp->tcp_client_errno);
5719 5855 }
5720 5856 }
5721 5857
5722 5858
5723 5859 break;
5724 5860 default:
5725 5861 break;
5726 5862 }
5727 5863 break;
5728 5864 case ICMP6_PARAM_PROB:
5729 5865 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5730 5866 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5731 5867 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5732 5868 (uchar_t *)nexthdrp) {
5733 5869 if (tcp->tcp_state == TCPS_SYN_SENT ||
5734 5870 tcp->tcp_state == TCPS_SYN_RCVD) {
5735 5871 (void) tcp_clean_death(tcp, ECONNREFUSED);
5736 5872 }
5737 5873 break;
5738 5874 }
5739 5875 break;
5740 5876
5741 5877 case ICMP6_TIME_EXCEEDED:
5742 5878 default:
5743 5879 break;
5744 5880 }
5745 5881 freemsg(mp);
5746 5882 }
5747 5883
5748 5884 /*
5749 5885 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5750 5886 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5751 5887 *
5752 5888 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5753 5889 * error messages received by IP. The message is always received on the correct
5754 5890 * tcp_t.
5755 5891 */
5756 5892 /* ARGSUSED */
5757 5893 boolean_t
5758 5894 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5759 5895 ip_recv_attr_t *ira)
5760 5896 {
5761 5897 tcpha_t *tcpha = (tcpha_t *)arg2;
5762 5898 uint32_t seq = ntohl(tcpha->tha_seq);
5763 5899 tcp_t *tcp = connp->conn_tcp;
5764 5900
5765 5901 /*
5766 5902 * TCP sequence number contained in payload of the ICMP error message
5767 5903 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5768 5904 * the message is either a stale ICMP error, or an attack from the
5769 5905 * network. Fail the verification.
5770 5906 */
5771 5907 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5772 5908 return (B_FALSE);
5773 5909
5774 5910 /* For "too big" we also check the ignore flag */
5775 5911 if (ira->ira_flags & IRAF_IS_IPV4) {
5776 5912 ASSERT(icmph != NULL);
5777 5913 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5778 5914 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5779 5915 tcp->tcp_tcps->tcps_ignore_path_mtu)
5780 5916 return (B_FALSE);
5781 5917 } else {
5782 5918 ASSERT(icmp6 != NULL);
5783 5919 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5784 5920 tcp->tcp_tcps->tcps_ignore_path_mtu)
5785 5921 return (B_FALSE);
5786 5922 }
5787 5923 return (B_TRUE);
5788 5924 }
|
↓ open down ↓ |
150 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX