1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright (c) 2011 Joyent, Inc. All rights reserved.
26 */
27
28 /* This file contains all TCP input processing functions. */
29
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/strsun.h>
33 #include <sys/strsubr.h>
34 #include <sys/stropts.h>
35 #include <sys/strlog.h>
36 #define _SUN_TPI_VERSION 2
37 #include <sys/tihdr.h>
38 #include <sys/suntpi.h>
39 #include <sys/xti_inet.h>
40 #include <sys/squeue_impl.h>
41 #include <sys/squeue.h>
42 #include <sys/tsol/tnet.h>
43
44 #include <inet/common.h>
45 #include <inet/ip.h>
46 #include <inet/tcp.h>
47 #include <inet/tcp_impl.h>
48 #include <inet/tcp_cluster.h>
49 #include <inet/proto_set.h>
50 #include <inet/ipsec_impl.h>
51
52 /*
53 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
54 */
55
56 #ifdef _BIG_ENDIAN
57 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
58 (TCPOPT_TSTAMP << 8) | 10)
59 #else
60 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
61 (TCPOPT_NOP << 8) | TCPOPT_NOP)
62 #endif
63
64 /*
65 * Flags returned from tcp_parse_options.
66 */
67 #define TCP_OPT_MSS_PRESENT 1
68 #define TCP_OPT_WSCALE_PRESENT 2
69 #define TCP_OPT_TSTAMP_PRESENT 4
70 #define TCP_OPT_SACK_OK_PRESENT 8
71 #define TCP_OPT_SACK_PRESENT 16
72
73 /*
74 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
75 */
76 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
77
78 /*
79 * Since tcp_listener is not cleared atomically with tcp_detached
80 * being cleared we need this extra bit to tell a detached connection
81 * apart from one that is in the process of being accepted.
82 */
83 #define TCP_IS_DETACHED_NONEAGER(tcp) \
84 (TCP_IS_DETACHED(tcp) && \
85 (!(tcp)->tcp_hard_binding))
86
87 /*
88 * Steps to do when a tcp_t moves to TIME-WAIT state.
89 *
90 * This connection is done, we don't need to account for it. Decrement
91 * the listener connection counter if needed.
92 *
93 * Decrement the connection counter of the stack. Note that this counter
94 * is per CPU. So the total number of connections in a stack is the sum of all
95 * of them. Since there is no lock for handling all of them exclusively, the
96 * resulting sum is only an approximation.
97 *
98 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
99 * connection won't interfere with new ones.
100 *
101 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
102 * the timer is handled within the context of this tcp_t. When the timer
103 * fires, tcp_clean_death() is called. If upper layer closes the connection
104 * during this period, tcp_time_wait_append() will be called to add this
105 * tcp_t to the global TIME-WAIT list. Note that this means that the
106 * actual wait time in TIME-WAIT state will be longer than the
107 * tcps_time_wait_interval since the period before upper layer closes the
108 * connection is not accounted for when tcp_time_wait_append() is called.
109 *
110 * If uppser layer has closed the connection, call tcp_time_wait_append()
111 * directly.
112 *
113 */
114 #define SET_TIME_WAIT(tcps, tcp, connp) \
115 { \
116 (tcp)->tcp_state = TCPS_TIME_WAIT; \
117 if ((tcp)->tcp_listen_cnt != NULL) \
118 TCP_DECR_LISTEN_CNT(tcp); \
119 atomic_dec_64( \
120 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
121 (connp)->conn_exclbind = 0; \
122 if (!TCP_IS_DETACHED(tcp)) { \
123 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
124 } else { \
125 tcp_time_wait_append(tcp); \
126 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
127 } \
128 }
129
130 /*
131 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
132 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
133 * data, TCP will not respond with an ACK. RFC 793 requires that
134 * TCP responds with an ACK for such a bogus ACK. By not following
135 * the RFC, we prevent TCP from getting into an ACK storm if somehow
136 * an attacker successfully spoofs an acceptable segment to our
137 * peer; or when our peer is "confused."
138 */
139 static uint32_t tcp_drop_ack_unsent_cnt = 10;
140
141 /*
142 * To protect TCP against attacker using a small window and requesting
143 * large amount of data (DoS attack by conuming memory), TCP checks the
144 * window advertised in the last ACK of the 3-way handshake. TCP uses
145 * the tcp_mss (the size of one packet) value for comparion. The window
146 * should be larger than tcp_mss. But while a sane TCP should advertise
147 * a receive window larger than or equal to 4*MSS to avoid stop and go
148 * tarrfic, not all TCP stacks do that. This is especially true when
149 * tcp_mss is a big value.
150 *
151 * To work around this issue, an additional fixed value for comparison
152 * is also used. If the advertised window is smaller than both tcp_mss
153 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
154 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
155 * smaller than 8K is considered to be OK.
156 */
157 static uint32_t tcp_init_wnd_chk = 4096;
158
159 /* Process ICMP source quench message or not. */
160 static boolean_t tcp_icmp_source_quench = B_FALSE;
161
162 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
163
164 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
165 ip_recv_attr_t *);
166 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
167 ip_recv_attr_t *);
168 static boolean_t tcp_drop_q0(tcp_t *);
169 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
170 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
171 ip_recv_attr_t *);
172 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
173 static int tcp_parse_options(tcpha_t *, tcp_opt_t *);
174 static void tcp_process_options(tcp_t *, tcpha_t *);
175 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
176 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
177 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
178 static void tcp_set_rto(tcp_t *, time_t);
179 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
180
181 /*
182 * Set the MSS associated with a particular tcp based on its current value,
183 * and a new one passed in. Observe minimums and maximums, and reset other
184 * state variables that we want to view as multiples of MSS.
185 *
186 * The value of MSS could be either increased or descreased.
187 */
188 void
189 tcp_mss_set(tcp_t *tcp, uint32_t mss)
190 {
191 uint32_t mss_max;
192 tcp_stack_t *tcps = tcp->tcp_tcps;
193 conn_t *connp = tcp->tcp_connp;
194
195 if (connp->conn_ipversion == IPV4_VERSION)
196 mss_max = tcps->tcps_mss_max_ipv4;
197 else
198 mss_max = tcps->tcps_mss_max_ipv6;
199
200 if (mss < tcps->tcps_mss_min)
201 mss = tcps->tcps_mss_min;
202 if (mss > mss_max)
203 mss = mss_max;
204 /*
205 * Unless naglim has been set by our client to
206 * a non-mss value, force naglim to track mss.
207 * This can help to aggregate small writes.
208 */
209 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
210 tcp->tcp_naglim = mss;
211 /*
212 * TCP should be able to buffer at least 4 MSS data for obvious
213 * performance reason.
214 */
215 if ((mss << 2) > connp->conn_sndbuf)
216 connp->conn_sndbuf = mss << 2;
217
218 /*
219 * Set the send lowater to at least twice of MSS.
220 */
221 if ((mss << 1) > connp->conn_sndlowat)
222 connp->conn_sndlowat = mss << 1;
223
224 /*
225 * Update tcp_cwnd according to the new value of MSS. Keep the
226 * previous ratio to preserve the transmit rate.
227 */
228 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
229 tcp->tcp_cwnd_cnt = 0;
230
231 tcp->tcp_mss = mss;
232 (void) tcp_maxpsz_set(tcp, B_TRUE);
233 }
234
235 /*
236 * Extract option values from a tcp header. We put any found values into the
237 * tcpopt struct and return a bitmask saying which options were found.
238 */
239 static int
240 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
241 {
242 uchar_t *endp;
243 int len;
244 uint32_t mss;
245 uchar_t *up = (uchar_t *)tcpha;
246 int found = 0;
247 int32_t sack_len;
248 tcp_seq sack_begin, sack_end;
249 tcp_t *tcp;
250
251 endp = up + TCP_HDR_LENGTH(tcpha);
252 up += TCP_MIN_HEADER_LENGTH;
253 while (up < endp) {
254 len = endp - up;
255 switch (*up) {
256 case TCPOPT_EOL:
257 break;
258
259 case TCPOPT_NOP:
260 up++;
261 continue;
262
263 case TCPOPT_MAXSEG:
264 if (len < TCPOPT_MAXSEG_LEN ||
265 up[1] != TCPOPT_MAXSEG_LEN)
266 break;
267
268 mss = BE16_TO_U16(up+2);
269 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
270 tcpopt->tcp_opt_mss = mss;
271 found |= TCP_OPT_MSS_PRESENT;
272
273 up += TCPOPT_MAXSEG_LEN;
274 continue;
275
276 case TCPOPT_WSCALE:
277 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
278 break;
279
280 if (up[2] > TCP_MAX_WINSHIFT)
281 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
282 else
283 tcpopt->tcp_opt_wscale = up[2];
284 found |= TCP_OPT_WSCALE_PRESENT;
285
286 up += TCPOPT_WS_LEN;
287 continue;
288
289 case TCPOPT_SACK_PERMITTED:
290 if (len < TCPOPT_SACK_OK_LEN ||
291 up[1] != TCPOPT_SACK_OK_LEN)
292 break;
293 found |= TCP_OPT_SACK_OK_PRESENT;
294 up += TCPOPT_SACK_OK_LEN;
295 continue;
296
297 case TCPOPT_SACK:
298 if (len <= 2 || up[1] <= 2 || len < up[1])
299 break;
300
301 /* If TCP is not interested in SACK blks... */
302 if ((tcp = tcpopt->tcp) == NULL) {
303 up += up[1];
304 continue;
305 }
306 sack_len = up[1] - TCPOPT_HEADER_LEN;
307 up += TCPOPT_HEADER_LEN;
308
309 /*
310 * If the list is empty, allocate one and assume
311 * nothing is sack'ed.
312 */
313 if (tcp->tcp_notsack_list == NULL) {
314 tcp_notsack_update(&(tcp->tcp_notsack_list),
315 tcp->tcp_suna, tcp->tcp_snxt,
316 &(tcp->tcp_num_notsack_blk),
317 &(tcp->tcp_cnt_notsack_list));
318
319 /*
320 * Make sure tcp_notsack_list is not NULL.
321 * This happens when kmem_alloc(KM_NOSLEEP)
322 * returns NULL.
323 */
324 if (tcp->tcp_notsack_list == NULL) {
325 up += sack_len;
326 continue;
327 }
328 tcp->tcp_fack = tcp->tcp_suna;
329 }
330
331 while (sack_len > 0) {
332 if (up + 8 > endp) {
333 up = endp;
334 break;
335 }
336 sack_begin = BE32_TO_U32(up);
337 up += 4;
338 sack_end = BE32_TO_U32(up);
339 up += 4;
340 sack_len -= 8;
341 /*
342 * Bounds checking. Make sure the SACK
343 * info is within tcp_suna and tcp_snxt.
344 * If this SACK blk is out of bound, ignore
345 * it but continue to parse the following
346 * blks.
347 */
348 if (SEQ_LEQ(sack_end, sack_begin) ||
349 SEQ_LT(sack_begin, tcp->tcp_suna) ||
350 SEQ_GT(sack_end, tcp->tcp_snxt)) {
351 continue;
352 }
353 tcp_notsack_insert(&(tcp->tcp_notsack_list),
354 sack_begin, sack_end,
355 &(tcp->tcp_num_notsack_blk),
356 &(tcp->tcp_cnt_notsack_list));
357 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
358 tcp->tcp_fack = sack_end;
359 }
360 }
361 found |= TCP_OPT_SACK_PRESENT;
362 continue;
363
364 case TCPOPT_TSTAMP:
365 if (len < TCPOPT_TSTAMP_LEN ||
366 up[1] != TCPOPT_TSTAMP_LEN)
367 break;
368
369 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
370 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
371
372 found |= TCP_OPT_TSTAMP_PRESENT;
373
374 up += TCPOPT_TSTAMP_LEN;
375 continue;
376
377 default:
378 if (len <= 1 || len < (int)up[1] || up[1] == 0)
379 break;
380 up += up[1];
381 continue;
382 }
383 break;
384 }
385 return (found);
386 }
387
388 /*
389 * Process all TCP option in SYN segment. Note that this function should
390 * be called after tcp_set_destination() is called so that the necessary info
391 * from IRE is already set in the tcp structure.
392 *
393 * This function sets up the correct tcp_mss value according to the
394 * MSS option value and our header size. It also sets up the window scale
395 * and timestamp values, and initialize SACK info blocks. But it does not
396 * change receive window size after setting the tcp_mss value. The caller
397 * should do the appropriate change.
398 */
399 static void
400 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
401 {
402 int options;
403 tcp_opt_t tcpopt;
404 uint32_t mss_max;
405 char *tmp_tcph;
406 tcp_stack_t *tcps = tcp->tcp_tcps;
407 conn_t *connp = tcp->tcp_connp;
408
409 tcpopt.tcp = NULL;
410 options = tcp_parse_options(tcpha, &tcpopt);
411
412 /*
413 * Process MSS option. Note that MSS option value does not account
414 * for IP or TCP options. This means that it is equal to MTU - minimum
415 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
416 * IPv6.
417 */
418 if (!(options & TCP_OPT_MSS_PRESENT)) {
419 if (connp->conn_ipversion == IPV4_VERSION)
420 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
421 else
422 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
423 } else {
424 if (connp->conn_ipversion == IPV4_VERSION)
425 mss_max = tcps->tcps_mss_max_ipv4;
426 else
427 mss_max = tcps->tcps_mss_max_ipv6;
428 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
429 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
430 else if (tcpopt.tcp_opt_mss > mss_max)
431 tcpopt.tcp_opt_mss = mss_max;
432 }
433
434 /* Process Window Scale option. */
435 if (options & TCP_OPT_WSCALE_PRESENT) {
436 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
437 tcp->tcp_snd_ws_ok = B_TRUE;
438 } else {
439 tcp->tcp_snd_ws = B_FALSE;
440 tcp->tcp_snd_ws_ok = B_FALSE;
441 tcp->tcp_rcv_ws = B_FALSE;
442 }
443
444 /* Process Timestamp option. */
445 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
446 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
447 tmp_tcph = (char *)tcp->tcp_tcpha;
448
449 tcp->tcp_snd_ts_ok = B_TRUE;
450 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
451 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
452 ASSERT(OK_32PTR(tmp_tcph));
453 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
454
455 /* Fill in our template header with basic timestamp option. */
456 tmp_tcph += connp->conn_ht_ulp_len;
457 tmp_tcph[0] = TCPOPT_NOP;
458 tmp_tcph[1] = TCPOPT_NOP;
459 tmp_tcph[2] = TCPOPT_TSTAMP;
460 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
461 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
462 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
463 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
464 } else {
465 tcp->tcp_snd_ts_ok = B_FALSE;
466 }
467
468 /*
469 * Process SACK options. If SACK is enabled for this connection,
470 * then allocate the SACK info structure. Note the following ways
471 * when tcp_snd_sack_ok is set to true.
472 *
473 * For active connection: in tcp_set_destination() called in
474 * tcp_connect().
475 *
476 * For passive connection: in tcp_set_destination() called in
477 * tcp_input_listener().
478 *
479 * That's the reason why the extra TCP_IS_DETACHED() check is there.
480 * That check makes sure that if we did not send a SACK OK option,
481 * we will not enable SACK for this connection even though the other
482 * side sends us SACK OK option. For active connection, the SACK
483 * info structure has already been allocated. So we need to free
484 * it if SACK is disabled.
485 */
486 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
487 (tcp->tcp_snd_sack_ok ||
488 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
489 ASSERT(tcp->tcp_num_sack_blk == 0);
490 ASSERT(tcp->tcp_notsack_list == NULL);
491
492 tcp->tcp_snd_sack_ok = B_TRUE;
493 if (tcp->tcp_snd_ts_ok) {
494 tcp->tcp_max_sack_blk = 3;
495 } else {
496 tcp->tcp_max_sack_blk = 4;
497 }
498 } else if (tcp->tcp_snd_sack_ok) {
499 /*
500 * Resetting tcp_snd_sack_ok to B_FALSE so that
501 * no SACK info will be used for this
502 * connection. This assumes that SACK usage
503 * permission is negotiated. This may need
504 * to be changed once this is clarified.
505 */
506 ASSERT(tcp->tcp_num_sack_blk == 0);
507 ASSERT(tcp->tcp_notsack_list == NULL);
508 tcp->tcp_snd_sack_ok = B_FALSE;
509 }
510
511 /*
512 * Now we know the exact TCP/IP header length, subtract
513 * that from tcp_mss to get our side's MSS.
514 */
515 tcp->tcp_mss -= connp->conn_ht_iphc_len;
516
517 /*
518 * Here we assume that the other side's header size will be equal to
519 * our header size. We calculate the real MSS accordingly. Need to
520 * take into additional stuffs IPsec puts in.
521 *
522 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
523 */
524 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
525 tcp->tcp_ipsec_overhead -
526 ((connp->conn_ipversion == IPV4_VERSION ?
527 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
528
529 /*
530 * Set MSS to the smaller one of both ends of the connection.
531 * We should not have called tcp_mss_set() before, but our
532 * side of the MSS should have been set to a proper value
533 * by tcp_set_destination(). tcp_mss_set() will also set up the
534 * STREAM head parameters properly.
535 *
536 * If we have a larger-than-16-bit window but the other side
537 * didn't want to do window scale, tcp_rwnd_set() will take
538 * care of that.
539 */
540 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
541
542 /*
543 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
544 * updated properly.
545 */
546 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
547 }
548
549 /*
550 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
551 * is filled, return as much as we can. The message passed in may be
552 * multi-part, chained using b_cont. "start" is the starting sequence
553 * number for this piece.
554 */
555 static mblk_t *
556 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
557 {
558 uint32_t end;
559 mblk_t *mp1;
560 mblk_t *mp2;
561 mblk_t *next_mp;
562 uint32_t u1;
563 tcp_stack_t *tcps = tcp->tcp_tcps;
564
565
566 /* Walk through all the new pieces. */
567 do {
568 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
569 (uintptr_t)INT_MAX);
570 end = start + (int)(mp->b_wptr - mp->b_rptr);
571 next_mp = mp->b_cont;
572 if (start == end) {
573 /* Empty. Blast it. */
574 freeb(mp);
575 continue;
576 }
577 mp->b_cont = NULL;
578 TCP_REASS_SET_SEQ(mp, start);
579 TCP_REASS_SET_END(mp, end);
580 mp1 = tcp->tcp_reass_tail;
581 if (!mp1) {
582 tcp->tcp_reass_tail = mp;
583 tcp->tcp_reass_head = mp;
584 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
585 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
586 end - start);
587 continue;
588 }
589 /* New stuff completely beyond tail? */
590 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
591 /* Link it on end. */
592 mp1->b_cont = mp;
593 tcp->tcp_reass_tail = mp;
594 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
595 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
596 end - start);
597 continue;
598 }
599 mp1 = tcp->tcp_reass_head;
600 u1 = TCP_REASS_SEQ(mp1);
601 /* New stuff at the front? */
602 if (SEQ_LT(start, u1)) {
603 /* Yes... Check for overlap. */
604 mp->b_cont = mp1;
605 tcp->tcp_reass_head = mp;
606 tcp_reass_elim_overlap(tcp, mp);
607 continue;
608 }
609 /*
610 * The new piece fits somewhere between the head and tail.
611 * We find our slot, where mp1 precedes us and mp2 trails.
612 */
613 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
614 u1 = TCP_REASS_SEQ(mp2);
615 if (SEQ_LEQ(start, u1))
616 break;
617 }
618 /* Link ourselves in */
619 mp->b_cont = mp2;
620 mp1->b_cont = mp;
621
622 /* Trim overlap with following mblk(s) first */
623 tcp_reass_elim_overlap(tcp, mp);
624
625 /* Trim overlap with preceding mblk */
626 tcp_reass_elim_overlap(tcp, mp1);
627
628 } while (start = end, mp = next_mp);
629 mp1 = tcp->tcp_reass_head;
630 /* Anything ready to go? */
631 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
632 return (NULL);
633 /* Eat what we can off the queue */
634 for (;;) {
635 mp = mp1->b_cont;
636 end = TCP_REASS_END(mp1);
637 TCP_REASS_SET_SEQ(mp1, 0);
638 TCP_REASS_SET_END(mp1, 0);
639 if (!mp) {
640 tcp->tcp_reass_tail = NULL;
641 break;
642 }
643 if (end != TCP_REASS_SEQ(mp)) {
644 mp1->b_cont = NULL;
645 break;
646 }
647 mp1 = mp;
648 }
649 mp1 = tcp->tcp_reass_head;
650 tcp->tcp_reass_head = mp;
651 return (mp1);
652 }
653
654 /* Eliminate any overlap that mp may have over later mblks */
655 static void
656 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
657 {
658 uint32_t end;
659 mblk_t *mp1;
660 uint32_t u1;
661 tcp_stack_t *tcps = tcp->tcp_tcps;
662
663 end = TCP_REASS_END(mp);
664 while ((mp1 = mp->b_cont) != NULL) {
665 u1 = TCP_REASS_SEQ(mp1);
666 if (!SEQ_GT(end, u1))
667 break;
668 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
669 mp->b_wptr -= end - u1;
670 TCP_REASS_SET_END(mp, u1);
671 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
672 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
673 end - u1);
674 break;
675 }
676 mp->b_cont = mp1->b_cont;
677 TCP_REASS_SET_SEQ(mp1, 0);
678 TCP_REASS_SET_END(mp1, 0);
679 freeb(mp1);
680 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
681 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
682 }
683 if (!mp1)
684 tcp->tcp_reass_tail = mp;
685 }
686
687 /*
688 * This function does PAWS protection check. Returns B_TRUE if the
689 * segment passes the PAWS test, else returns B_FALSE.
690 */
691 boolean_t
692 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp)
693 {
694 uint8_t flags;
695 int options;
696 uint8_t *up;
697 conn_t *connp = tcp->tcp_connp;
698
699 flags = (unsigned int)tcpha->tha_flags & 0xFF;
700 /*
701 * If timestamp option is aligned nicely, get values inline,
702 * otherwise call general routine to parse. Only do that
703 * if timestamp is the only option.
704 */
705 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
706 TCPOPT_REAL_TS_LEN &&
707 OK_32PTR((up = ((uint8_t *)tcpha) +
708 TCP_MIN_HEADER_LENGTH)) &&
709 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
710 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
711 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
712
713 options = TCP_OPT_TSTAMP_PRESENT;
714 } else {
715 if (tcp->tcp_snd_sack_ok) {
716 tcpoptp->tcp = tcp;
717 } else {
718 tcpoptp->tcp = NULL;
719 }
720 options = tcp_parse_options(tcpha, tcpoptp);
721 }
722
723 if (options & TCP_OPT_TSTAMP_PRESENT) {
724 /*
725 * Do PAWS per RFC 1323 section 4.2. Accept RST
726 * regardless of the timestamp, page 18 RFC 1323.bis.
727 */
728 if ((flags & TH_RST) == 0 &&
729 TSTMP_LT(tcpoptp->tcp_opt_ts_val,
730 tcp->tcp_ts_recent)) {
731 if (LBOLT_FASTPATH64 <
732 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
733 /* This segment is not acceptable. */
734 return (B_FALSE);
735 } else {
736 /*
737 * Connection has been idle for
738 * too long. Reset the timestamp
739 * and assume the segment is valid.
740 */
741 tcp->tcp_ts_recent =
742 tcpoptp->tcp_opt_ts_val;
743 }
744 }
745 } else {
746 /*
747 * If we don't get a timestamp on every packet, we
748 * figure we can't really trust 'em, so we stop sending
749 * and parsing them.
750 */
751 tcp->tcp_snd_ts_ok = B_FALSE;
752
753 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN;
754 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN;
755 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4);
756 /*
757 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
758 * doing a slow start here so as to not to lose on the
759 * transfer rate built up so far.
760 */
761 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
762 if (tcp->tcp_snd_sack_ok)
763 tcp->tcp_max_sack_blk = 4;
764 }
765 return (B_TRUE);
766 }
767
768 /*
769 * Defense for the SYN attack -
770 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
771 * one from the list of droppable eagers. This list is a subset of q0.
772 * see comments before the definition of MAKE_DROPPABLE().
773 * 2. Don't drop a SYN request before its first timeout. This gives every
774 * request at least til the first timeout to complete its 3-way handshake.
775 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
776 * requests currently on the queue that has timed out. This will be used
777 * as an indicator of whether an attack is under way, so that appropriate
778 * actions can be taken. (It's incremented in tcp_timer() and decremented
779 * either when eager goes into ESTABLISHED, or gets freed up.)
780 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
781 * # of timeout drops back to <= q0len/32 => SYN alert off
782 */
783 static boolean_t
784 tcp_drop_q0(tcp_t *tcp)
785 {
786 tcp_t *eager;
787 mblk_t *mp;
788 tcp_stack_t *tcps = tcp->tcp_tcps;
789
790 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
791 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
792
793 /* Pick oldest eager from the list of droppable eagers */
794 eager = tcp->tcp_eager_prev_drop_q0;
795
796 /* If list is empty. return B_FALSE */
797 if (eager == tcp) {
798 return (B_FALSE);
799 }
800
801 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
802 if ((mp = allocb(0, BPRI_HI)) == NULL)
803 return (B_FALSE);
804
805 /*
806 * Take this eager out from the list of droppable eagers since we are
807 * going to drop it.
808 */
809 MAKE_UNDROPPABLE(eager);
810
811 if (tcp->tcp_connp->conn_debug) {
812 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
813 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
814 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
815 tcp->tcp_conn_req_cnt_q0,
816 tcp_display(tcp, NULL, DISP_PORT_ONLY));
817 }
818
819 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
820
821 /* Put a reference on the conn as we are enqueueing it in the sqeue */
822 CONN_INC_REF(eager->tcp_connp);
823
824 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
825 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
826 SQ_FILL, SQTAG_TCP_DROP_Q0);
827
828 return (B_TRUE);
829 }
830
831 /*
832 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
833 */
834 static mblk_t *
835 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
836 ip_recv_attr_t *ira)
837 {
838 tcp_t *ltcp = lconnp->conn_tcp;
839 tcp_t *tcp = connp->conn_tcp;
840 mblk_t *tpi_mp;
841 ipha_t *ipha;
842 ip6_t *ip6h;
843 sin6_t sin6;
844 uint_t ifindex = ira->ira_ruifindex;
845 tcp_stack_t *tcps = tcp->tcp_tcps;
846
847 if (ira->ira_flags & IRAF_IS_IPV4) {
848 ipha = (ipha_t *)mp->b_rptr;
849
850 connp->conn_ipversion = IPV4_VERSION;
851 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
852 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
853 connp->conn_saddr_v6 = connp->conn_laddr_v6;
854
855 sin6 = sin6_null;
856 sin6.sin6_addr = connp->conn_faddr_v6;
857 sin6.sin6_port = connp->conn_fport;
858 sin6.sin6_family = AF_INET6;
859 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
860 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
861
862 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
863 sin6_t sin6d;
864
865 sin6d = sin6_null;
866 sin6d.sin6_addr = connp->conn_laddr_v6;
867 sin6d.sin6_port = connp->conn_lport;
868 sin6d.sin6_family = AF_INET;
869 tpi_mp = mi_tpi_extconn_ind(NULL,
870 (char *)&sin6d, sizeof (sin6_t),
871 (char *)&tcp,
872 (t_scalar_t)sizeof (intptr_t),
873 (char *)&sin6d, sizeof (sin6_t),
874 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
875 } else {
876 tpi_mp = mi_tpi_conn_ind(NULL,
877 (char *)&sin6, sizeof (sin6_t),
878 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
879 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
880 }
881 } else {
882 ip6h = (ip6_t *)mp->b_rptr;
883
884 connp->conn_ipversion = IPV6_VERSION;
885 connp->conn_laddr_v6 = ip6h->ip6_dst;
886 connp->conn_faddr_v6 = ip6h->ip6_src;
887 connp->conn_saddr_v6 = connp->conn_laddr_v6;
888
889 sin6 = sin6_null;
890 sin6.sin6_addr = connp->conn_faddr_v6;
891 sin6.sin6_port = connp->conn_fport;
892 sin6.sin6_family = AF_INET6;
893 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
894 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
895 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
896
897 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
898 /* Pass up the scope_id of remote addr */
899 sin6.sin6_scope_id = ifindex;
900 } else {
901 sin6.sin6_scope_id = 0;
902 }
903 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
904 sin6_t sin6d;
905
906 sin6d = sin6_null;
907 sin6.sin6_addr = connp->conn_laddr_v6;
908 sin6d.sin6_port = connp->conn_lport;
909 sin6d.sin6_family = AF_INET6;
910 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
911 sin6d.sin6_scope_id = ifindex;
912
913 tpi_mp = mi_tpi_extconn_ind(NULL,
914 (char *)&sin6d, sizeof (sin6_t),
915 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
916 (char *)&sin6d, sizeof (sin6_t),
917 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
918 } else {
919 tpi_mp = mi_tpi_conn_ind(NULL,
920 (char *)&sin6, sizeof (sin6_t),
921 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
922 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
923 }
924 }
925
926 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
927 return (tpi_mp);
928 }
929
930 /* Handle a SYN on an AF_INET socket */
931 static mblk_t *
932 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
933 ip_recv_attr_t *ira)
934 {
935 tcp_t *ltcp = lconnp->conn_tcp;
936 tcp_t *tcp = connp->conn_tcp;
937 sin_t sin;
938 mblk_t *tpi_mp = NULL;
939 tcp_stack_t *tcps = tcp->tcp_tcps;
940 ipha_t *ipha;
941
942 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
943 ipha = (ipha_t *)mp->b_rptr;
944
945 connp->conn_ipversion = IPV4_VERSION;
946 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
947 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
948 connp->conn_saddr_v6 = connp->conn_laddr_v6;
949
950 sin = sin_null;
951 sin.sin_addr.s_addr = connp->conn_faddr_v4;
952 sin.sin_port = connp->conn_fport;
953 sin.sin_family = AF_INET;
954 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
955 sin_t sind;
956
957 sind = sin_null;
958 sind.sin_addr.s_addr = connp->conn_laddr_v4;
959 sind.sin_port = connp->conn_lport;
960 sind.sin_family = AF_INET;
961 tpi_mp = mi_tpi_extconn_ind(NULL,
962 (char *)&sind, sizeof (sin_t), (char *)&tcp,
963 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
964 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
965 } else {
966 tpi_mp = mi_tpi_conn_ind(NULL,
967 (char *)&sin, sizeof (sin_t),
968 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
969 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
970 }
971
972 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
973 return (tpi_mp);
974 }
975
976 /*
977 * Called via squeue to get on to eager's perimeter. It sends a
978 * TH_RST if eager is in the fanout table. The listener wants the
979 * eager to disappear either by means of tcp_eager_blowoff() or
980 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
981 * called (via squeue) if the eager cannot be inserted in the
982 * fanout table in tcp_input_listener().
983 */
984 /* ARGSUSED */
985 void
986 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
987 {
988 conn_t *econnp = (conn_t *)arg;
989 tcp_t *eager = econnp->conn_tcp;
990 tcp_t *listener = eager->tcp_listener;
991
992 /*
993 * We could be called because listener is closing. Since
994 * the eager was using listener's queue's, we avoid
995 * using the listeners queues from now on.
996 */
997 ASSERT(eager->tcp_detached);
998 econnp->conn_rq = NULL;
999 econnp->conn_wq = NULL;
1000
1001 /*
1002 * An eager's conn_fanout will be NULL if it's a duplicate
1003 * for an existing 4-tuples in the conn fanout table.
1004 * We don't want to send an RST out in such case.
1005 */
1006 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1007 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1008 eager, eager->tcp_snxt, 0, TH_RST);
1009 }
1010
1011 /* We are here because listener wants this eager gone */
1012 if (listener != NULL) {
1013 mutex_enter(&listener->tcp_eager_lock);
1014 tcp_eager_unlink(eager);
1015 if (eager->tcp_tconnind_started) {
1016 /*
1017 * The eager has sent a conn_ind up to the
1018 * listener but listener decides to close
1019 * instead. We need to drop the extra ref
1020 * placed on eager in tcp_input_data() before
1021 * sending the conn_ind to listener.
1022 */
1023 CONN_DEC_REF(econnp);
1024 }
1025 mutex_exit(&listener->tcp_eager_lock);
1026 CONN_DEC_REF(listener->tcp_connp);
1027 }
1028
1029 if (eager->tcp_state != TCPS_CLOSED)
1030 tcp_close_detached(eager);
1031 }
1032
1033 /*
1034 * Reset any eager connection hanging off this listener marked
1035 * with 'seqnum' and then reclaim it's resources.
1036 */
1037 boolean_t
1038 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1039 {
1040 tcp_t *eager;
1041 mblk_t *mp;
1042
1043 eager = listener;
1044 mutex_enter(&listener->tcp_eager_lock);
1045 do {
1046 eager = eager->tcp_eager_next_q;
1047 if (eager == NULL) {
1048 mutex_exit(&listener->tcp_eager_lock);
1049 return (B_FALSE);
1050 }
1051 } while (eager->tcp_conn_req_seqnum != seqnum);
1052
1053 if (eager->tcp_closemp_used) {
1054 mutex_exit(&listener->tcp_eager_lock);
1055 return (B_TRUE);
1056 }
1057 eager->tcp_closemp_used = B_TRUE;
1058 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1059 CONN_INC_REF(eager->tcp_connp);
1060 mutex_exit(&listener->tcp_eager_lock);
1061 mp = &eager->tcp_closemp;
1062 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1063 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1064 return (B_TRUE);
1065 }
1066
1067 /*
1068 * Reset any eager connection hanging off this listener
1069 * and then reclaim it's resources.
1070 */
1071 void
1072 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1073 {
1074 tcp_t *eager;
1075 mblk_t *mp;
1076 tcp_stack_t *tcps = listener->tcp_tcps;
1077
1078 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1079
1080 if (!q0_only) {
1081 /* First cleanup q */
1082 TCP_STAT(tcps, tcp_eager_blowoff_q);
1083 eager = listener->tcp_eager_next_q;
1084 while (eager != NULL) {
1085 if (!eager->tcp_closemp_used) {
1086 eager->tcp_closemp_used = B_TRUE;
1087 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1088 CONN_INC_REF(eager->tcp_connp);
1089 mp = &eager->tcp_closemp;
1090 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1091 tcp_eager_kill, eager->tcp_connp, NULL,
1092 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1093 }
1094 eager = eager->tcp_eager_next_q;
1095 }
1096 }
1097 /* Then cleanup q0 */
1098 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1099 eager = listener->tcp_eager_next_q0;
1100 while (eager != listener) {
1101 if (!eager->tcp_closemp_used) {
1102 eager->tcp_closemp_used = B_TRUE;
1103 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1104 CONN_INC_REF(eager->tcp_connp);
1105 mp = &eager->tcp_closemp;
1106 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1107 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1108 SQTAG_TCP_EAGER_CLEANUP_Q0);
1109 }
1110 eager = eager->tcp_eager_next_q0;
1111 }
1112 }
1113
1114 /*
1115 * If we are an eager connection hanging off a listener that hasn't
1116 * formally accepted the connection yet, get off his list and blow off
1117 * any data that we have accumulated.
1118 */
1119 void
1120 tcp_eager_unlink(tcp_t *tcp)
1121 {
1122 tcp_t *listener = tcp->tcp_listener;
1123
1124 ASSERT(listener != NULL);
1125 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1126 if (tcp->tcp_eager_next_q0 != NULL) {
1127 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1128
1129 /* Remove the eager tcp from q0 */
1130 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1131 tcp->tcp_eager_prev_q0;
1132 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1133 tcp->tcp_eager_next_q0;
1134 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1135 listener->tcp_conn_req_cnt_q0--;
1136
1137 tcp->tcp_eager_next_q0 = NULL;
1138 tcp->tcp_eager_prev_q0 = NULL;
1139
1140 /*
1141 * Take the eager out, if it is in the list of droppable
1142 * eagers.
1143 */
1144 MAKE_UNDROPPABLE(tcp);
1145
1146 if (tcp->tcp_syn_rcvd_timeout != 0) {
1147 /* we have timed out before */
1148 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1149 listener->tcp_syn_rcvd_timeout--;
1150 }
1151 } else {
1152 tcp_t **tcpp = &listener->tcp_eager_next_q;
1153 tcp_t *prev = NULL;
1154
1155 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1156 if (tcpp[0] == tcp) {
1157 if (listener->tcp_eager_last_q == tcp) {
1158 /*
1159 * If we are unlinking the last
1160 * element on the list, adjust
1161 * tail pointer. Set tail pointer
1162 * to nil when list is empty.
1163 */
1164 ASSERT(tcp->tcp_eager_next_q == NULL);
1165 if (listener->tcp_eager_last_q ==
1166 listener->tcp_eager_next_q) {
1167 listener->tcp_eager_last_q =
1168 NULL;
1169 } else {
1170 /*
1171 * We won't get here if there
1172 * is only one eager in the
1173 * list.
1174 */
1175 ASSERT(prev != NULL);
1176 listener->tcp_eager_last_q =
1177 prev;
1178 }
1179 }
1180 tcpp[0] = tcp->tcp_eager_next_q;
1181 tcp->tcp_eager_next_q = NULL;
1182 tcp->tcp_eager_last_q = NULL;
1183 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1184 listener->tcp_conn_req_cnt_q--;
1185 break;
1186 }
1187 prev = tcpp[0];
1188 }
1189 }
1190 tcp->tcp_listener = NULL;
1191 }
1192
1193 /* BEGIN CSTYLED */
1194 /*
1195 *
1196 * The sockfs ACCEPT path:
1197 * =======================
1198 *
1199 * The eager is now established in its own perimeter as soon as SYN is
1200 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1201 * completes the accept processing on the acceptor STREAM. The sending
1202 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1203 * listener but a TLI/XTI listener completes the accept processing
1204 * on the listener perimeter.
1205 *
1206 * Common control flow for 3 way handshake:
1207 * ----------------------------------------
1208 *
1209 * incoming SYN (listener perimeter) -> tcp_input_listener()
1210 *
1211 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1212 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1213 *
1214 * Sockfs ACCEPT Path:
1215 * -------------------
1216 *
1217 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1218 * as STREAM entry point)
1219 *
1220 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1221 *
1222 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1223 * association (we are not behind eager's squeue but sockfs is protecting us
1224 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1225 * is changed to point at tcp_wput().
1226 *
1227 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1228 * listener (done on listener's perimeter).
1229 *
1230 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1231 * accept.
1232 *
1233 * TLI/XTI client ACCEPT path:
1234 * ---------------------------
1235 *
1236 * soaccept() sends T_CONN_RES on the listener STREAM.
1237 *
1238 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1239 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1240 *
1241 * Locks:
1242 * ======
1243 *
1244 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1245 * and listeners->tcp_eager_next_q.
1246 *
1247 * Referencing:
1248 * ============
1249 *
1250 * 1) We start out in tcp_input_listener by eager placing a ref on
1251 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1252 *
1253 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1254 * doing so we place a ref on the eager. This ref is finally dropped at the
1255 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1256 * reference is dropped by the squeue framework.
1257 *
1258 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1259 *
1260 * The reference must be released by the same entity that added the reference
1261 * In the above scheme, the eager is the entity that adds and releases the
1262 * references. Note that tcp_accept_finish executes in the squeue of the eager
1263 * (albeit after it is attached to the acceptor stream). Though 1. executes
1264 * in the listener's squeue, the eager is nascent at this point and the
1265 * reference can be considered to have been added on behalf of the eager.
1266 *
1267 * Eager getting a Reset or listener closing:
1268 * ==========================================
1269 *
1270 * Once the listener and eager are linked, the listener never does the unlink.
1271 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1272 * a message on all eager perimeter. The eager then does the unlink, clears
1273 * any pointers to the listener's queue and drops the reference to the
1274 * listener. The listener waits in tcp_close outside the squeue until its
1275 * refcount has dropped to 1. This ensures that the listener has waited for
1276 * all eagers to clear their association with the listener.
1277 *
1278 * Similarly, if eager decides to go away, it can unlink itself and close.
1279 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1280 * the reference to eager is still valid because of the extra ref we put
1281 * in tcp_send_conn_ind.
1282 *
1283 * Listener can always locate the eager under the protection
1284 * of the listener->tcp_eager_lock, and then do a refhold
1285 * on the eager during the accept processing.
1286 *
1287 * The acceptor stream accesses the eager in the accept processing
1288 * based on the ref placed on eager before sending T_conn_ind.
1289 * The only entity that can negate this refhold is a listener close
1290 * which is mutually exclusive with an active acceptor stream.
1291 *
1292 * Eager's reference on the listener
1293 * ===================================
1294 *
1295 * If the accept happens (even on a closed eager) the eager drops its
1296 * reference on the listener at the start of tcp_accept_finish. If the
1297 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1298 * the reference is dropped in tcp_closei_local. If the listener closes,
1299 * the reference is dropped in tcp_eager_kill. In all cases the reference
1300 * is dropped while executing in the eager's context (squeue).
1301 */
1302 /* END CSTYLED */
1303
1304 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1305
1306 /*
1307 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1308 * tcp_input_data will not see any packets for listeners since the listener
1309 * has conn_recv set to tcp_input_listener.
1310 */
1311 /* ARGSUSED */
1312 static void
1313 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1314 {
1315 tcpha_t *tcpha;
1316 uint32_t seg_seq;
1317 tcp_t *eager;
1318 int err;
1319 conn_t *econnp = NULL;
1320 squeue_t *new_sqp;
1321 mblk_t *mp1;
1322 uint_t ip_hdr_len;
1323 conn_t *lconnp = (conn_t *)arg;
1324 tcp_t *listener = lconnp->conn_tcp;
1325 tcp_stack_t *tcps = listener->tcp_tcps;
1326 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1327 uint_t flags;
1328 mblk_t *tpi_mp;
1329 uint_t ifindex = ira->ira_ruifindex;
1330 boolean_t tlc_set = B_FALSE;
1331
1332 ip_hdr_len = ira->ira_ip_hdr_length;
1333 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1334 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1335
1336 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1337 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1338 __dtrace_tcp_tcph_t *, tcpha);
1339
1340 if (!(flags & TH_SYN)) {
1341 if ((flags & TH_RST) || (flags & TH_URG)) {
1342 freemsg(mp);
1343 return;
1344 }
1345 if (flags & TH_ACK) {
1346 /* Note this executes in listener's squeue */
1347 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1348 return;
1349 }
1350
1351 freemsg(mp);
1352 return;
1353 }
1354
1355 if (listener->tcp_state != TCPS_LISTEN)
1356 goto error2;
1357
1358 ASSERT(IPCL_IS_BOUND(lconnp));
1359
1360 mutex_enter(&listener->tcp_eager_lock);
1361
1362 /*
1363 * The system is under memory pressure, so we need to do our part
1364 * to relieve the pressure. So we only accept new request if there
1365 * is nothing waiting to be accepted or waiting to complete the 3-way
1366 * handshake. This means that busy listener will not get too many
1367 * new requests which they cannot handle in time while non-busy
1368 * listener is still functioning properly.
1369 */
1370 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1371 listener->tcp_conn_req_cnt_q0 > 0)) {
1372 mutex_exit(&listener->tcp_eager_lock);
1373 TCP_STAT(tcps, tcp_listen_mem_drop);
1374 goto error2;
1375 }
1376
1377 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1378 mutex_exit(&listener->tcp_eager_lock);
1379 TCP_STAT(tcps, tcp_listendrop);
1380 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1381 if (lconnp->conn_debug) {
1382 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1383 "tcp_input_listener: listen backlog (max=%d) "
1384 "overflow (%d pending) on %s",
1385 listener->tcp_conn_req_max,
1386 listener->tcp_conn_req_cnt_q,
1387 tcp_display(listener, NULL, DISP_PORT_ONLY));
1388 }
1389 goto error2;
1390 }
1391
1392 if (listener->tcp_conn_req_cnt_q0 >=
1393 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1394 /*
1395 * Q0 is full. Drop a pending half-open req from the queue
1396 * to make room for the new SYN req. Also mark the time we
1397 * drop a SYN.
1398 *
1399 * A more aggressive defense against SYN attack will
1400 * be to set the "tcp_syn_defense" flag now.
1401 */
1402 TCP_STAT(tcps, tcp_listendropq0);
1403 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1404 if (!tcp_drop_q0(listener)) {
1405 mutex_exit(&listener->tcp_eager_lock);
1406 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1407 if (lconnp->conn_debug) {
1408 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1409 "tcp_input_listener: listen half-open "
1410 "queue (max=%d) full (%d pending) on %s",
1411 tcps->tcps_conn_req_max_q0,
1412 listener->tcp_conn_req_cnt_q0,
1413 tcp_display(listener, NULL,
1414 DISP_PORT_ONLY));
1415 }
1416 goto error2;
1417 }
1418 }
1419
1420 /*
1421 * Enforce the limit set on the number of connections per listener.
1422 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1423 * for comparison.
1424 */
1425 if (listener->tcp_listen_cnt != NULL) {
1426 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1427 int64_t now;
1428
1429 if (atomic_add_32_nv(&tlc->tlc_cnt, 1) > tlc->tlc_max + 1) {
1430 mutex_exit(&listener->tcp_eager_lock);
1431 now = ddi_get_lbolt64();
1432 atomic_add_32(&tlc->tlc_cnt, -1);
1433 TCP_STAT(tcps, tcp_listen_cnt_drop);
1434 tlc->tlc_drop++;
1435 if (now - tlc->tlc_report_time >
1436 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1437 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1438 "Listener (port %d) connection max (%u) "
1439 "reached: %u attempts dropped total\n",
1440 ntohs(listener->tcp_connp->conn_lport),
1441 tlc->tlc_max, tlc->tlc_drop);
1442 tlc->tlc_report_time = now;
1443 }
1444 goto error2;
1445 }
1446 tlc_set = B_TRUE;
1447 }
1448
1449 mutex_exit(&listener->tcp_eager_lock);
1450
1451 /*
1452 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1453 * or based on the ring (for packets from GLD). Otherwise it is
1454 * set based on lbolt i.e., a somewhat random number.
1455 */
1456 ASSERT(ira->ira_sqp != NULL);
1457 new_sqp = ira->ira_sqp;
1458
1459 econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1460 if (econnp == NULL)
1461 goto error2;
1462
1463 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1464 econnp->conn_sqp = new_sqp;
1465 econnp->conn_initial_sqp = new_sqp;
1466 econnp->conn_ixa->ixa_sqp = new_sqp;
1467
1468 econnp->conn_fport = tcpha->tha_lport;
1469 econnp->conn_lport = tcpha->tha_fport;
1470
1471 err = conn_inherit_parent(lconnp, econnp);
1472 if (err != 0)
1473 goto error3;
1474
1475 /* We already know the laddr of the new connection is ours */
1476 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1477
1478 ASSERT(OK_32PTR(mp->b_rptr));
1479 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1480 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1481
1482 if (lconnp->conn_family == AF_INET) {
1483 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1484 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1485 } else {
1486 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1487 }
1488
1489 if (tpi_mp == NULL)
1490 goto error3;
1491
1492 eager = econnp->conn_tcp;
1493 eager->tcp_detached = B_TRUE;
1494 SOCK_CONNID_INIT(eager->tcp_connid);
1495
1496 /*
1497 * Initialize the eager's tcp_t and inherit some parameters from
1498 * the listener.
1499 */
1500 tcp_init_values(eager, listener);
1501
1502 ASSERT((econnp->conn_ixa->ixa_flags &
1503 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1504 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1505 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1506 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1507
1508 if (!tcps->tcps_dev_flow_ctl)
1509 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1510
1511 /* Prepare for diffing against previous packets */
1512 eager->tcp_recvifindex = 0;
1513 eager->tcp_recvhops = 0xffffffffU;
1514
1515 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1516 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1517 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1518 econnp->conn_incoming_ifindex = ifindex;
1519 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1520 econnp->conn_ixa->ixa_scopeid = ifindex;
1521 }
1522 }
1523
1524 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1525 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1526 tcps->tcps_rev_src_routes) {
1527 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1528 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1529
1530 /* Source routing option copyover (reverse it) */
1531 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1532 if (err != 0) {
1533 freemsg(tpi_mp);
1534 goto error3;
1535 }
1536 ip_pkt_source_route_reverse_v4(ipp);
1537 }
1538
1539 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1540 ASSERT(!eager->tcp_tconnind_started);
1541 /*
1542 * If the SYN came with a credential, it's a loopback packet or a
1543 * labeled packet; attach the credential to the TPI message.
1544 */
1545 if (ira->ira_cred != NULL)
1546 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1547
1548 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1549 ASSERT(eager->tcp_ordrel_mp == NULL);
1550
1551 /* Inherit the listener's non-STREAMS flag */
1552 if (IPCL_IS_NONSTR(lconnp)) {
1553 econnp->conn_flags |= IPCL_NONSTR;
1554 /* All non-STREAMS tcp_ts are sockets */
1555 eager->tcp_issocket = B_TRUE;
1556 } else {
1557 /*
1558 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1559 * at close time, we will always have that to send up.
1560 * Otherwise, we need to do special handling in case the
1561 * allocation fails at that time.
1562 */
1563 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1564 goto error3;
1565 }
1566 /*
1567 * Now that the IP addresses and ports are setup in econnp we
1568 * can do the IPsec policy work.
1569 */
1570 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1571 if (lconnp->conn_policy != NULL) {
1572 /*
1573 * Inherit the policy from the listener; use
1574 * actions from ira
1575 */
1576 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1577 CONN_DEC_REF(econnp);
1578 freemsg(mp);
1579 goto error3;
1580 }
1581 }
1582 }
1583
1584 /*
1585 * tcp_set_destination() may set tcp_rwnd according to the route
1586 * metrics. If it does not, the eager's receive window will be set
1587 * to the listener's receive window later in this function.
1588 */
1589 eager->tcp_rwnd = 0;
1590
1591 if (is_system_labeled()) {
1592 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1593
1594 ASSERT(ira->ira_tsl != NULL);
1595 /* Discard any old label */
1596 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1597 ASSERT(ixa->ixa_tsl != NULL);
1598 label_rele(ixa->ixa_tsl);
1599 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1600 ixa->ixa_tsl = NULL;
1601 }
1602 if ((lconnp->conn_mlp_type != mlptSingle ||
1603 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1604 ira->ira_tsl != NULL) {
1605 /*
1606 * If this is an MLP connection or a MAC-Exempt
1607 * connection with an unlabeled node, packets are to be
1608 * exchanged using the security label of the received
1609 * SYN packet instead of the server application's label.
1610 * tsol_check_dest called from ip_set_destination
1611 * might later update TSF_UNLABELED by replacing
1612 * ixa_tsl with a new label.
1613 */
1614 label_hold(ira->ira_tsl);
1615 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1616 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1617 econnp, ts_label_t *, ixa->ixa_tsl)
1618 } else {
1619 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1620 DTRACE_PROBE2(syn_accept, conn_t *,
1621 econnp, ts_label_t *, ixa->ixa_tsl)
1622 }
1623 /*
1624 * conn_connect() called from tcp_set_destination will verify
1625 * the destination is allowed to receive packets at the
1626 * security label of the SYN-ACK we are generating. As part of
1627 * that, tsol_check_dest() may create a new effective label for
1628 * this connection.
1629 * Finally conn_connect() will call conn_update_label.
1630 * All that remains for TCP to do is to call
1631 * conn_build_hdr_template which is done as part of
1632 * tcp_set_destination.
1633 */
1634 }
1635
1636 /*
1637 * Since we will clear tcp_listener before we clear tcp_detached
1638 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1639 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1640 */
1641 eager->tcp_hard_binding = B_TRUE;
1642
1643 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1644 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1645
1646 CL_INET_CONNECT(econnp, B_FALSE, err);
1647 if (err != 0) {
1648 tcp_bind_hash_remove(eager);
1649 goto error3;
1650 }
1651
1652 SOCK_CONNID_BUMP(eager->tcp_connid);
1653
1654 /*
1655 * Adapt our mss, ttl, ... based on the remote address.
1656 */
1657
1658 if (tcp_set_destination(eager) != 0) {
1659 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1660 /* Undo the bind_hash_insert */
1661 tcp_bind_hash_remove(eager);
1662 goto error3;
1663 }
1664
1665 /* Process all TCP options. */
1666 tcp_process_options(eager, tcpha);
1667
1668 /* Is the other end ECN capable? */
1669 if (tcps->tcps_ecn_permitted >= 1 &&
1670 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1671 eager->tcp_ecn_ok = B_TRUE;
1672 }
1673
1674 /*
1675 * The listener's conn_rcvbuf should be the default window size or a
1676 * window size changed via SO_RCVBUF option. First round up the
1677 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1678 * scale option value if needed. Call tcp_rwnd_set() to finish the
1679 * setting.
1680 *
1681 * Note if there is a rpipe metric associated with the remote host,
1682 * we should not inherit receive window size from listener.
1683 */
1684 eager->tcp_rwnd = MSS_ROUNDUP(
1685 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1686 eager->tcp_rwnd), eager->tcp_mss);
1687 if (eager->tcp_snd_ws_ok)
1688 tcp_set_ws_value(eager);
1689 /*
1690 * Note that this is the only place tcp_rwnd_set() is called for
1691 * accepting a connection. We need to call it here instead of
1692 * after the 3-way handshake because we need to tell the other
1693 * side our rwnd in the SYN-ACK segment.
1694 */
1695 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1696
1697 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1698 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1699
1700 ASSERT(econnp->conn_rcvbuf != 0 &&
1701 econnp->conn_rcvbuf == eager->tcp_rwnd);
1702
1703 /* Put a ref on the listener for the eager. */
1704 CONN_INC_REF(lconnp);
1705 mutex_enter(&listener->tcp_eager_lock);
1706 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1707 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1708 listener->tcp_eager_next_q0 = eager;
1709 eager->tcp_eager_prev_q0 = listener;
1710
1711 /* Set tcp_listener before adding it to tcp_conn_fanout */
1712 eager->tcp_listener = listener;
1713 eager->tcp_saved_listener = listener;
1714
1715 /*
1716 * Set tcp_listen_cnt so that when the connection is done, the counter
1717 * is decremented.
1718 */
1719 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1720
1721 /*
1722 * Tag this detached tcp vector for later retrieval
1723 * by our listener client in tcp_accept().
1724 */
1725 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1726 listener->tcp_conn_req_cnt_q0++;
1727 if (++listener->tcp_conn_req_seqnum == -1) {
1728 /*
1729 * -1 is "special" and defined in TPI as something
1730 * that should never be used in T_CONN_IND
1731 */
1732 ++listener->tcp_conn_req_seqnum;
1733 }
1734 mutex_exit(&listener->tcp_eager_lock);
1735
1736 if (listener->tcp_syn_defense) {
1737 /* Don't drop the SYN that comes from a good IP source */
1738 ipaddr_t *addr_cache;
1739
1740 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1741 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1742 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1743 eager->tcp_dontdrop = B_TRUE;
1744 }
1745 }
1746
1747 /*
1748 * We need to insert the eager in its own perimeter but as soon
1749 * as we do that, we expose the eager to the classifier and
1750 * should not touch any field outside the eager's perimeter.
1751 * So do all the work necessary before inserting the eager
1752 * in its own perimeter. Be optimistic that conn_connect()
1753 * will succeed but undo everything if it fails.
1754 */
1755 seg_seq = ntohl(tcpha->tha_seq);
1756 eager->tcp_irs = seg_seq;
1757 eager->tcp_rack = seg_seq;
1758 eager->tcp_rnxt = seg_seq + 1;
1759 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1760 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1761 eager->tcp_state = TCPS_SYN_RCVD;
1762 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1763 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1764 int32_t, TCPS_LISTEN);
1765
1766 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1767 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1768 if (mp1 == NULL) {
1769 /*
1770 * Increment the ref count as we are going to
1771 * enqueueing an mp in squeue
1772 */
1773 CONN_INC_REF(econnp);
1774 goto error;
1775 }
1776
1777 /*
1778 * We need to start the rto timer. In normal case, we start
1779 * the timer after sending the packet on the wire (or at
1780 * least believing that packet was sent by waiting for
1781 * conn_ip_output() to return). Since this is the first packet
1782 * being sent on the wire for the eager, our initial tcp_rto
1783 * is at least tcp_rexmit_interval_min which is a fairly
1784 * large value to allow the algorithm to adjust slowly to large
1785 * fluctuations of RTT during first few transmissions.
1786 *
1787 * Starting the timer first and then sending the packet in this
1788 * case shouldn't make much difference since tcp_rexmit_interval_min
1789 * is of the order of several 100ms and starting the timer
1790 * first and then sending the packet will result in difference
1791 * of few micro seconds.
1792 *
1793 * Without this optimization, we are forced to hold the fanout
1794 * lock across the ipcl_bind_insert() and sending the packet
1795 * so that we don't race against an incoming packet (maybe RST)
1796 * for this eager.
1797 *
1798 * It is necessary to acquire an extra reference on the eager
1799 * at this point and hold it until after tcp_send_data() to
1800 * ensure against an eager close race.
1801 */
1802
1803 CONN_INC_REF(econnp);
1804
1805 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1806
1807 /*
1808 * Insert the eager in its own perimeter now. We are ready to deal
1809 * with any packets on eager.
1810 */
1811 if (ipcl_conn_insert(econnp) != 0)
1812 goto error;
1813
1814 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1815 freemsg(mp);
1816 /*
1817 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1818 * only used by one thread at a time.
1819 */
1820 if (econnp->conn_sqp == lconnp->conn_sqp) {
1821 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1822 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1823 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1824 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1825 (void) conn_ip_output(mp1, econnp->conn_ixa);
1826 CONN_DEC_REF(econnp);
1827 } else {
1828 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1829 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1830 }
1831 return;
1832 error:
1833 freemsg(mp1);
1834 eager->tcp_closemp_used = B_TRUE;
1835 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1836 mp1 = &eager->tcp_closemp;
1837 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1838 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1839
1840 /*
1841 * If a connection already exists, send the mp to that connections so
1842 * that it can be appropriately dealt with.
1843 */
1844 ipst = tcps->tcps_netstack->netstack_ip;
1845
1846 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1847 if (!IPCL_IS_CONNECTED(econnp)) {
1848 /*
1849 * Something bad happened. ipcl_conn_insert()
1850 * failed because a connection already existed
1851 * in connected hash but we can't find it
1852 * anymore (someone blew it away). Just
1853 * free this message and hopefully remote
1854 * will retransmit at which time the SYN can be
1855 * treated as a new connection or dealth with
1856 * a TH_RST if a connection already exists.
1857 */
1858 CONN_DEC_REF(econnp);
1859 freemsg(mp);
1860 } else {
1861 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1862 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1863 }
1864 } else {
1865 /* Nobody wants this packet */
1866 freemsg(mp);
1867 }
1868 return;
1869 error3:
1870 CONN_DEC_REF(econnp);
1871 error2:
1872 freemsg(mp);
1873 if (tlc_set)
1874 atomic_add_32(&listener->tcp_listen_cnt->tlc_cnt, -1);
1875 }
1876
1877 /*
1878 * In an ideal case of vertical partition in NUMA architecture, its
1879 * beneficial to have the listener and all the incoming connections
1880 * tied to the same squeue. The other constraint is that incoming
1881 * connections should be tied to the squeue attached to interrupted
1882 * CPU for obvious locality reason so this leaves the listener to
1883 * be tied to the same squeue. Our only problem is that when listener
1884 * is binding, the CPU that will get interrupted by the NIC whose
1885 * IP address the listener is binding to is not even known. So
1886 * the code below allows us to change that binding at the time the
1887 * CPU is interrupted by virtue of incoming connection's squeue.
1888 *
1889 * This is usefull only in case of a listener bound to a specific IP
1890 * address. For other kind of listeners, they get bound the
1891 * very first time and there is no attempt to rebind them.
1892 */
1893 void
1894 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1895 ip_recv_attr_t *ira)
1896 {
1897 conn_t *connp = (conn_t *)arg;
1898 squeue_t *sqp = (squeue_t *)arg2;
1899 squeue_t *new_sqp;
1900 uint32_t conn_flags;
1901
1902 /*
1903 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1904 * or based on the ring (for packets from GLD). Otherwise it is
1905 * set based on lbolt i.e., a somewhat random number.
1906 */
1907 ASSERT(ira->ira_sqp != NULL);
1908 new_sqp = ira->ira_sqp;
1909
1910 if (connp->conn_fanout == NULL)
1911 goto done;
1912
1913 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1914 mutex_enter(&connp->conn_fanout->connf_lock);
1915 mutex_enter(&connp->conn_lock);
1916 /*
1917 * No one from read or write side can access us now
1918 * except for already queued packets on this squeue.
1919 * But since we haven't changed the squeue yet, they
1920 * can't execute. If they are processed after we have
1921 * changed the squeue, they are sent back to the
1922 * correct squeue down below.
1923 * But a listner close can race with processing of
1924 * incoming SYN. If incoming SYN processing changes
1925 * the squeue then the listener close which is waiting
1926 * to enter the squeue would operate on the wrong
1927 * squeue. Hence we don't change the squeue here unless
1928 * the refcount is exactly the minimum refcount. The
1929 * minimum refcount of 4 is counted as - 1 each for
1930 * TCP and IP, 1 for being in the classifier hash, and
1931 * 1 for the mblk being processed.
1932 */
1933
1934 if (connp->conn_ref != 4 ||
1935 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1936 mutex_exit(&connp->conn_lock);
1937 mutex_exit(&connp->conn_fanout->connf_lock);
1938 goto done;
1939 }
1940 if (connp->conn_sqp != new_sqp) {
1941 while (connp->conn_sqp != new_sqp)
1942 (void) casptr(&connp->conn_sqp, sqp, new_sqp);
1943 /* No special MT issues for outbound ixa_sqp hint */
1944 connp->conn_ixa->ixa_sqp = new_sqp;
1945 }
1946
1947 do {
1948 conn_flags = connp->conn_flags;
1949 conn_flags |= IPCL_FULLY_BOUND;
1950 (void) cas32(&connp->conn_flags, connp->conn_flags,
1951 conn_flags);
1952 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1953
1954 mutex_exit(&connp->conn_fanout->connf_lock);
1955 mutex_exit(&connp->conn_lock);
1956
1957 /*
1958 * Assume we have picked a good squeue for the listener. Make
1959 * subsequent SYNs not try to change the squeue.
1960 */
1961 connp->conn_recv = tcp_input_listener;
1962 }
1963
1964 done:
1965 if (connp->conn_sqp != sqp) {
1966 CONN_INC_REF(connp);
1967 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1968 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1969 } else {
1970 tcp_input_listener(connp, mp, sqp, ira);
1971 }
1972 }
1973
1974 /*
1975 * Send up all messages queued on tcp_rcv_list.
1976 */
1977 uint_t
1978 tcp_rcv_drain(tcp_t *tcp)
1979 {
1980 mblk_t *mp;
1981 uint_t ret = 0;
1982 #ifdef DEBUG
1983 uint_t cnt = 0;
1984 #endif
1985 queue_t *q = tcp->tcp_connp->conn_rq;
1986
1987 /* Can't drain on an eager connection */
1988 if (tcp->tcp_listener != NULL)
1989 return (ret);
1990
1991 /* Can't be a non-STREAMS connection */
1992 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1993
1994 /* No need for the push timer now. */
1995 if (tcp->tcp_push_tid != 0) {
1996 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1997 tcp->tcp_push_tid = 0;
1998 }
1999
2000 /*
2001 * Handle two cases here: we are currently fused or we were
2002 * previously fused and have some urgent data to be delivered
2003 * upstream. The latter happens because we either ran out of
2004 * memory or were detached and therefore sending the SIGURG was
2005 * deferred until this point. In either case we pass control
2006 * over to tcp_fuse_rcv_drain() since it may need to complete
2007 * some work.
2008 */
2009 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2010 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2011 &tcp->tcp_fused_sigurg_mp))
2012 return (ret);
2013 }
2014
2015 while ((mp = tcp->tcp_rcv_list) != NULL) {
2016 tcp->tcp_rcv_list = mp->b_next;
2017 mp->b_next = NULL;
2018 #ifdef DEBUG
2019 cnt += msgdsize(mp);
2020 #endif
2021 putnext(q, mp);
2022 }
2023 #ifdef DEBUG
2024 ASSERT(cnt == tcp->tcp_rcv_cnt);
2025 #endif
2026 tcp->tcp_rcv_last_head = NULL;
2027 tcp->tcp_rcv_last_tail = NULL;
2028 tcp->tcp_rcv_cnt = 0;
2029
2030 if (canputnext(q))
2031 return (tcp_rwnd_reopen(tcp));
2032
2033 return (ret);
2034 }
2035
2036 /*
2037 * Queue data on tcp_rcv_list which is a b_next chain.
2038 * tcp_rcv_last_head/tail is the last element of this chain.
2039 * Each element of the chain is a b_cont chain.
2040 *
2041 * M_DATA messages are added to the current element.
2042 * Other messages are added as new (b_next) elements.
2043 */
2044 void
2045 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2046 {
2047 ASSERT(seg_len == msgdsize(mp));
2048 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2049
2050 if (is_system_labeled()) {
2051 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2052 /*
2053 * Provide for protocols above TCP such as RPC. NOPID leaves
2054 * db_cpid unchanged.
2055 * The cred could have already been set.
2056 */
2057 if (cr != NULL)
2058 mblk_setcred(mp, cr, NOPID);
2059 }
2060
2061 if (tcp->tcp_rcv_list == NULL) {
2062 ASSERT(tcp->tcp_rcv_last_head == NULL);
2063 tcp->tcp_rcv_list = mp;
2064 tcp->tcp_rcv_last_head = mp;
2065 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2066 tcp->tcp_rcv_last_tail->b_cont = mp;
2067 } else {
2068 tcp->tcp_rcv_last_head->b_next = mp;
2069 tcp->tcp_rcv_last_head = mp;
2070 }
2071
2072 while (mp->b_cont)
2073 mp = mp->b_cont;
2074
2075 tcp->tcp_rcv_last_tail = mp;
2076 tcp->tcp_rcv_cnt += seg_len;
2077 tcp->tcp_rwnd -= seg_len;
2078 }
2079
2080 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2081 mblk_t *
2082 tcp_ack_mp(tcp_t *tcp)
2083 {
2084 uint32_t seq_no;
2085 tcp_stack_t *tcps = tcp->tcp_tcps;
2086 conn_t *connp = tcp->tcp_connp;
2087
2088 /*
2089 * There are a few cases to be considered while setting the sequence no.
2090 * Essentially, we can come here while processing an unacceptable pkt
2091 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2092 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2093 * If we are here for a zero window probe, stick with suna. In all
2094 * other cases, we check if suna + swnd encompasses snxt and set
2095 * the sequence number to snxt, if so. If snxt falls outside the
2096 * window (the receiver probably shrunk its window), we will go with
2097 * suna + swnd, otherwise the sequence no will be unacceptable to the
2098 * receiver.
2099 */
2100 if (tcp->tcp_zero_win_probe) {
2101 seq_no = tcp->tcp_suna;
2102 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2103 ASSERT(tcp->tcp_swnd == 0);
2104 seq_no = tcp->tcp_snxt;
2105 } else {
2106 seq_no = SEQ_GT(tcp->tcp_snxt,
2107 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2108 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2109 }
2110
2111 if (tcp->tcp_valid_bits) {
2112 /*
2113 * For the complex case where we have to send some
2114 * controls (FIN or SYN), let tcp_xmit_mp do it.
2115 */
2116 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2117 NULL, B_FALSE));
2118 } else {
2119 /* Generate a simple ACK */
2120 int data_length;
2121 uchar_t *rptr;
2122 tcpha_t *tcpha;
2123 mblk_t *mp1;
2124 int32_t total_hdr_len;
2125 int32_t tcp_hdr_len;
2126 int32_t num_sack_blk = 0;
2127 int32_t sack_opt_len;
2128 ip_xmit_attr_t *ixa = connp->conn_ixa;
2129
2130 /*
2131 * Allocate space for TCP + IP headers
2132 * and link-level header
2133 */
2134 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2135 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2136 tcp->tcp_num_sack_blk);
2137 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2138 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2139 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2140 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2141 } else {
2142 total_hdr_len = connp->conn_ht_iphc_len;
2143 tcp_hdr_len = connp->conn_ht_ulp_len;
2144 }
2145 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2146 if (!mp1)
2147 return (NULL);
2148
2149 /* Update the latest receive window size in TCP header. */
2150 tcp->tcp_tcpha->tha_win =
2151 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2152 /* copy in prototype TCP + IP header */
2153 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2154 mp1->b_rptr = rptr;
2155 mp1->b_wptr = rptr + total_hdr_len;
2156 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2157
2158 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2159
2160 /* Set the TCP sequence number. */
2161 tcpha->tha_seq = htonl(seq_no);
2162
2163 /* Set up the TCP flag field. */
2164 tcpha->tha_flags = (uchar_t)TH_ACK;
2165 if (tcp->tcp_ecn_echo_on)
2166 tcpha->tha_flags |= TH_ECE;
2167
2168 tcp->tcp_rack = tcp->tcp_rnxt;
2169 tcp->tcp_rack_cnt = 0;
2170
2171 /* fill in timestamp option if in use */
2172 if (tcp->tcp_snd_ts_ok) {
2173 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2174
2175 U32_TO_BE32(llbolt,
2176 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2177 U32_TO_BE32(tcp->tcp_ts_recent,
2178 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2179 }
2180
2181 /* Fill in SACK options */
2182 if (num_sack_blk > 0) {
2183 uchar_t *wptr = (uchar_t *)tcpha +
2184 connp->conn_ht_ulp_len;
2185 sack_blk_t *tmp;
2186 int32_t i;
2187
2188 wptr[0] = TCPOPT_NOP;
2189 wptr[1] = TCPOPT_NOP;
2190 wptr[2] = TCPOPT_SACK;
2191 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2192 sizeof (sack_blk_t);
2193 wptr += TCPOPT_REAL_SACK_LEN;
2194
2195 tmp = tcp->tcp_sack_list;
2196 for (i = 0; i < num_sack_blk; i++) {
2197 U32_TO_BE32(tmp[i].begin, wptr);
2198 wptr += sizeof (tcp_seq);
2199 U32_TO_BE32(tmp[i].end, wptr);
2200 wptr += sizeof (tcp_seq);
2201 }
2202 tcpha->tha_offset_and_reserved +=
2203 ((num_sack_blk * 2 + 1) << 4);
2204 }
2205
2206 ixa->ixa_pktlen = total_hdr_len;
2207
2208 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2209 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2210 } else {
2211 ip6_t *ip6 = (ip6_t *)rptr;
2212
2213 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2214 }
2215
2216 /*
2217 * Prime pump for checksum calculation in IP. Include the
2218 * adjustment for a source route if any.
2219 */
2220 data_length = tcp_hdr_len + connp->conn_sum;
2221 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2222 tcpha->tha_sum = htons(data_length);
2223
2224 if (tcp->tcp_ip_forward_progress) {
2225 tcp->tcp_ip_forward_progress = B_FALSE;
2226 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2227 } else {
2228 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2229 }
2230 return (mp1);
2231 }
2232 }
2233
2234 /*
2235 * Dummy socket upcalls for if/when the conn_t gets detached from a
2236 * direct-callback sonode via a user-driven close(). Easy to catch with
2237 * DTrace FBT, and should be mostly harmless.
2238 */
2239
2240 /* ARGSUSED */
2241 static sock_upper_handle_t
2242 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2243 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2244 {
2245 ASSERT(0); /* Panic in debug, otherwise ignore. */
2246 return (NULL);
2247 }
2248
2249 /* ARGSUSED */
2250 static void
2251 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2252 pid_t pid)
2253 {
2254 ASSERT(x == NULL);
2255 /* Normally we'd crhold(cr) and attach it to socket state. */
2256 /* LINTED */
2257 }
2258
2259 /* ARGSUSED */
2260 static int
2261 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2262 {
2263 ASSERT(0); /* Panic in debug, otherwise ignore. */
2264 return (-1);
2265 }
2266
2267 /* ARGSUSED */
2268 static void
2269 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2270 {
2271 ASSERT(x == NULL);
2272 /* We really want this one to be a harmless NOP for now. */
2273 /* LINTED */
2274 }
2275
2276 /* ARGSUSED */
2277 static ssize_t
2278 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2279 int *error, boolean_t *push)
2280 {
2281 ASSERT(x == NULL);
2282
2283 /*
2284 * Consume the message, set ESHUTDOWN, and return an error.
2285 * Nobody's home!
2286 */
2287 freemsg(mp);
2288 *error = ESHUTDOWN;
2289 return (-1);
2290 }
2291
2292 /* ARGSUSED */
2293 static void
2294 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2295 {
2296 ASSERT(0); /* Panic in debug, otherwise ignore. */
2297 }
2298
2299 /* ARGSUSED */
2300 static void
2301 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2302 {
2303 ASSERT(0); /* Panic in debug, otherwise ignore. */
2304 }
2305
2306 /* ARGSUSED */
2307 static void
2308 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2309 {
2310 ASSERT(x == NULL);
2311 /* Otherwise, this would signal socket state about OOB data. */
2312 }
2313
2314 /* ARGSUSED */
2315 static void
2316 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2317 {
2318 ASSERT(0); /* Panic in debug, otherwise ignore. */
2319 }
2320
2321 /* ARGSUSED */
2322 static void
2323 tcp_dummy_onearg(sock_upper_handle_t x)
2324 {
2325 ASSERT(0); /* Panic in debug, otherwise ignore. */
2326 }
2327
2328 static sock_upcalls_t tcp_dummy_upcalls = {
2329 tcp_dummy_newconn,
2330 tcp_dummy_connected,
2331 tcp_dummy_disconnected,
2332 tcp_dummy_opctl,
2333 tcp_dummy_recv,
2334 tcp_dummy_set_proto_props,
2335 tcp_dummy_txq_full,
2336 tcp_dummy_signal_oob,
2337 tcp_dummy_onearg,
2338 tcp_dummy_set_error,
2339 tcp_dummy_onearg
2340 };
2341
2342 /*
2343 * Handle M_DATA messages from IP. Its called directly from IP via
2344 * squeue for received IP packets.
2345 *
2346 * The first argument is always the connp/tcp to which the mp belongs.
2347 * There are no exceptions to this rule. The caller has already put
2348 * a reference on this connp/tcp and once tcp_input_data() returns,
2349 * the squeue will do the refrele.
2350 *
2351 * The TH_SYN for the listener directly go to tcp_input_listener via
2352 * squeue. ICMP errors go directly to tcp_icmp_input().
2353 *
2354 * sqp: NULL = recursive, sqp != NULL means called from squeue
2355 */
2356 void
2357 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2358 {
2359 int32_t bytes_acked;
2360 int32_t gap;
2361 mblk_t *mp1;
2362 uint_t flags;
2363 uint32_t new_swnd = 0;
2364 uchar_t *iphdr;
2365 uchar_t *rptr;
2366 int32_t rgap;
2367 uint32_t seg_ack;
2368 int seg_len;
2369 uint_t ip_hdr_len;
2370 uint32_t seg_seq;
2371 tcpha_t *tcpha;
2372 int urp;
2373 tcp_opt_t tcpopt;
2374 ip_pkt_t ipp;
2375 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2376 uint32_t cwnd;
2377 uint32_t add;
2378 int npkt;
2379 int mss;
2380 conn_t *connp = (conn_t *)arg;
2381 squeue_t *sqp = (squeue_t *)arg2;
2382 tcp_t *tcp = connp->conn_tcp;
2383 tcp_stack_t *tcps = tcp->tcp_tcps;
2384 sock_upcalls_t *sockupcalls;
2385
2386 /*
2387 * RST from fused tcp loopback peer should trigger an unfuse.
2388 */
2389 if (tcp->tcp_fused) {
2390 TCP_STAT(tcps, tcp_fusion_aborted);
2391 tcp_unfuse(tcp);
2392 }
2393
2394 iphdr = mp->b_rptr;
2395 rptr = mp->b_rptr;
2396 ASSERT(OK_32PTR(rptr));
2397
2398 ip_hdr_len = ira->ira_ip_hdr_length;
2399 if (connp->conn_recv_ancillary.crb_all != 0) {
2400 /*
2401 * Record packet information in the ip_pkt_t
2402 */
2403 ipp.ipp_fields = 0;
2404 if (ira->ira_flags & IRAF_IS_IPV4) {
2405 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2406 B_FALSE);
2407 } else {
2408 uint8_t nexthdrp;
2409
2410 /*
2411 * IPv6 packets can only be received by applications
2412 * that are prepared to receive IPv6 addresses.
2413 * The IP fanout must ensure this.
2414 */
2415 ASSERT(connp->conn_family == AF_INET6);
2416
2417 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2418 &nexthdrp);
2419 ASSERT(nexthdrp == IPPROTO_TCP);
2420
2421 /* Could have caused a pullup? */
2422 iphdr = mp->b_rptr;
2423 rptr = mp->b_rptr;
2424 }
2425 }
2426 ASSERT(DB_TYPE(mp) == M_DATA);
2427 ASSERT(mp->b_next == NULL);
2428
2429 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2430 seg_seq = ntohl(tcpha->tha_seq);
2431 seg_ack = ntohl(tcpha->tha_ack);
2432 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2433 seg_len = (int)(mp->b_wptr - rptr) -
2434 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2435 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2436 do {
2437 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2438 (uintptr_t)INT_MAX);
2439 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2440 } while ((mp1 = mp1->b_cont) != NULL &&
2441 mp1->b_datap->db_type == M_DATA);
2442 }
2443
2444 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2445 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2446 __dtrace_tcp_tcph_t *, tcpha);
2447
2448 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2449 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2450 seg_len, tcpha, ira);
2451 return;
2452 }
2453
2454 if (sqp != NULL) {
2455 /*
2456 * This is the correct place to update tcp_last_recv_time. Note
2457 * that it is also updated for tcp structure that belongs to
2458 * global and listener queues which do not really need updating.
2459 * But that should not cause any harm. And it is updated for
2460 * all kinds of incoming segments, not only for data segments.
2461 */
2462 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2463 }
2464
2465 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2466
2467 BUMP_LOCAL(tcp->tcp_ibsegs);
2468 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2469
2470 if ((flags & TH_URG) && sqp != NULL) {
2471 /*
2472 * TCP can't handle urgent pointers that arrive before
2473 * the connection has been accept()ed since it can't
2474 * buffer OOB data. Discard segment if this happens.
2475 *
2476 * We can't just rely on a non-null tcp_listener to indicate
2477 * that the accept() has completed since unlinking of the
2478 * eager and completion of the accept are not atomic.
2479 * tcp_detached, when it is not set (B_FALSE) indicates
2480 * that the accept() has completed.
2481 *
2482 * Nor can it reassemble urgent pointers, so discard
2483 * if it's not the next segment expected.
2484 *
2485 * Otherwise, collapse chain into one mblk (discard if
2486 * that fails). This makes sure the headers, retransmitted
2487 * data, and new data all are in the same mblk.
2488 */
2489 ASSERT(mp != NULL);
2490 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2491 freemsg(mp);
2492 return;
2493 }
2494 /* Update pointers into message */
2495 iphdr = rptr = mp->b_rptr;
2496 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2497 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2498 /*
2499 * Since we can't handle any data with this urgent
2500 * pointer that is out of sequence, we expunge
2501 * the data. This allows us to still register
2502 * the urgent mark and generate the M_PCSIG,
2503 * which we can do.
2504 */
2505 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2506 seg_len = 0;
2507 }
2508 }
2509
2510 sockupcalls = connp->conn_upcalls;
2511 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2512 if (sockupcalls == NULL)
2513 sockupcalls = &tcp_dummy_upcalls;
2514
2515 switch (tcp->tcp_state) {
2516 case TCPS_SYN_SENT:
2517 if (connp->conn_final_sqp == NULL &&
2518 tcp_outbound_squeue_switch && sqp != NULL) {
2519 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2520 connp->conn_final_sqp = sqp;
2521 if (connp->conn_final_sqp != connp->conn_sqp) {
2522 DTRACE_PROBE1(conn__final__sqp__switch,
2523 conn_t *, connp);
2524 CONN_INC_REF(connp);
2525 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2526 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2527 tcp_input_data, connp, ira, ip_squeue_flag,
2528 SQTAG_CONNECT_FINISH);
2529 return;
2530 }
2531 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2532 }
2533 if (flags & TH_ACK) {
2534 /*
2535 * Note that our stack cannot send data before a
2536 * connection is established, therefore the
2537 * following check is valid. Otherwise, it has
2538 * to be changed.
2539 */
2540 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2541 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2542 freemsg(mp);
2543 if (flags & TH_RST)
2544 return;
2545 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2546 tcp, seg_ack, 0, TH_RST);
2547 return;
2548 }
2549 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2550 }
2551 if (flags & TH_RST) {
2552 if (flags & TH_ACK) {
2553 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2554 ip_xmit_attr_t *, connp->conn_ixa,
2555 void_ip_t *, iphdr, tcp_t *, tcp,
2556 tcph_t *, tcpha);
2557 (void) tcp_clean_death(tcp, ECONNREFUSED);
2558 }
2559 freemsg(mp);
2560 return;
2561 }
2562 if (!(flags & TH_SYN)) {
2563 freemsg(mp);
2564 return;
2565 }
2566
2567 /* Process all TCP options. */
2568 tcp_process_options(tcp, tcpha);
2569 /*
2570 * The following changes our rwnd to be a multiple of the
2571 * MIN(peer MSS, our MSS) for performance reason.
2572 */
2573 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2574 tcp->tcp_mss));
2575
2576 /* Is the other end ECN capable? */
2577 if (tcp->tcp_ecn_ok) {
2578 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2579 tcp->tcp_ecn_ok = B_FALSE;
2580 }
2581 }
2582 /*
2583 * Clear ECN flags because it may interfere with later
2584 * processing.
2585 */
2586 flags &= ~(TH_ECE|TH_CWR);
2587
2588 tcp->tcp_irs = seg_seq;
2589 tcp->tcp_rack = seg_seq;
2590 tcp->tcp_rnxt = seg_seq + 1;
2591 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2592 if (!TCP_IS_DETACHED(tcp)) {
2593 /* Allocate room for SACK options if needed. */
2594 connp->conn_wroff = connp->conn_ht_iphc_len;
2595 if (tcp->tcp_snd_sack_ok)
2596 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2597 if (!tcp->tcp_loopback)
2598 connp->conn_wroff += tcps->tcps_wroff_xtra;
2599
2600 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2601 connp->conn_wroff);
2602 }
2603 if (flags & TH_ACK) {
2604 /*
2605 * If we can't get the confirmation upstream, pretend
2606 * we didn't even see this one.
2607 *
2608 * XXX: how can we pretend we didn't see it if we
2609 * have updated rnxt et. al.
2610 *
2611 * For loopback we defer sending up the T_CONN_CON
2612 * until after some checks below.
2613 */
2614 mp1 = NULL;
2615 /*
2616 * tcp_sendmsg() checks tcp_state without entering
2617 * the squeue so tcp_state should be updated before
2618 * sending up connection confirmation. Probe the
2619 * state change below when we are sure the connection
2620 * confirmation has been sent.
2621 */
2622 tcp->tcp_state = TCPS_ESTABLISHED;
2623 if (!tcp_conn_con(tcp, iphdr, mp,
2624 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2625 tcp->tcp_state = TCPS_SYN_SENT;
2626 freemsg(mp);
2627 return;
2628 }
2629 TCPS_CONN_INC(tcps);
2630 /* SYN was acked - making progress */
2631 tcp->tcp_ip_forward_progress = B_TRUE;
2632
2633 /* One for the SYN */
2634 tcp->tcp_suna = tcp->tcp_iss + 1;
2635 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2636
2637 /*
2638 * If SYN was retransmitted, need to reset all
2639 * retransmission info. This is because this
2640 * segment will be treated as a dup ACK.
2641 */
2642 if (tcp->tcp_rexmit) {
2643 tcp->tcp_rexmit = B_FALSE;
2644 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2645 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2646 tcp->tcp_snd_burst = tcp->tcp_localnet ?
2647 TCP_CWND_INFINITE : TCP_CWND_NORMAL;
2648 tcp->tcp_ms_we_have_waited = 0;
2649
2650 /*
2651 * Set tcp_cwnd back to 1 MSS, per
2652 * recommendation from
2653 * draft-floyd-incr-init-win-01.txt,
2654 * Increasing TCP's Initial Window.
2655 */
2656 tcp->tcp_cwnd = tcp->tcp_mss;
2657 }
2658
2659 tcp->tcp_swl1 = seg_seq;
2660 tcp->tcp_swl2 = seg_ack;
2661
2662 new_swnd = ntohs(tcpha->tha_win);
2663 tcp->tcp_swnd = new_swnd;
2664 if (new_swnd > tcp->tcp_max_swnd)
2665 tcp->tcp_max_swnd = new_swnd;
2666
2667 /*
2668 * Always send the three-way handshake ack immediately
2669 * in order to make the connection complete as soon as
2670 * possible on the accepting host.
2671 */
2672 flags |= TH_ACK_NEEDED;
2673
2674 /*
2675 * Trace connect-established here.
2676 */
2677 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2678 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2679 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2680
2681 /* Trace change from SYN_SENT -> ESTABLISHED here */
2682 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2683 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2684 void, NULL, int32_t, TCPS_SYN_SENT);
2685
2686 /*
2687 * Special case for loopback. At this point we have
2688 * received SYN-ACK from the remote endpoint. In
2689 * order to ensure that both endpoints reach the
2690 * fused state prior to any data exchange, the final
2691 * ACK needs to be sent before we indicate T_CONN_CON
2692 * to the module upstream.
2693 */
2694 if (tcp->tcp_loopback) {
2695 mblk_t *ack_mp;
2696
2697 ASSERT(!tcp->tcp_unfusable);
2698 ASSERT(mp1 != NULL);
2699 /*
2700 * For loopback, we always get a pure SYN-ACK
2701 * and only need to send back the final ACK
2702 * with no data (this is because the other
2703 * tcp is ours and we don't do T/TCP). This
2704 * final ACK triggers the passive side to
2705 * perform fusion in ESTABLISHED state.
2706 */
2707 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2708 if (tcp->tcp_ack_tid != 0) {
2709 (void) TCP_TIMER_CANCEL(tcp,
2710 tcp->tcp_ack_tid);
2711 tcp->tcp_ack_tid = 0;
2712 }
2713 tcp_send_data(tcp, ack_mp);
2714 BUMP_LOCAL(tcp->tcp_obsegs);
2715 TCPS_BUMP_MIB(tcps, tcpOutAck);
2716
2717 if (!IPCL_IS_NONSTR(connp)) {
2718 /* Send up T_CONN_CON */
2719 if (ira->ira_cred != NULL) {
2720 mblk_setcred(mp1,
2721 ira->ira_cred,
2722 ira->ira_cpid);
2723 }
2724 putnext(connp->conn_rq, mp1);
2725 } else {
2726 (*sockupcalls->su_connected)
2727 (connp->conn_upper_handle,
2728 tcp->tcp_connid,
2729 ira->ira_cred,
2730 ira->ira_cpid);
2731 freemsg(mp1);
2732 }
2733
2734 freemsg(mp);
2735 return;
2736 }
2737 /*
2738 * Forget fusion; we need to handle more
2739 * complex cases below. Send the deferred
2740 * T_CONN_CON message upstream and proceed
2741 * as usual. Mark this tcp as not capable
2742 * of fusion.
2743 */
2744 TCP_STAT(tcps, tcp_fusion_unfusable);
2745 tcp->tcp_unfusable = B_TRUE;
2746 if (!IPCL_IS_NONSTR(connp)) {
2747 if (ira->ira_cred != NULL) {
2748 mblk_setcred(mp1, ira->ira_cred,
2749 ira->ira_cpid);
2750 }
2751 putnext(connp->conn_rq, mp1);
2752 } else {
2753 (*sockupcalls->su_connected)
2754 (connp->conn_upper_handle,
2755 tcp->tcp_connid, ira->ira_cred,
2756 ira->ira_cpid);
2757 freemsg(mp1);
2758 }
2759 }
2760
2761 /*
2762 * Check to see if there is data to be sent. If
2763 * yes, set the transmit flag. Then check to see
2764 * if received data processing needs to be done.
2765 * If not, go straight to xmit_check. This short
2766 * cut is OK as we don't support T/TCP.
2767 */
2768 if (tcp->tcp_unsent)
2769 flags |= TH_XMIT_NEEDED;
2770
2771 if (seg_len == 0 && !(flags & TH_URG)) {
2772 freemsg(mp);
2773 goto xmit_check;
2774 }
2775
2776 flags &= ~TH_SYN;
2777 seg_seq++;
2778 break;
2779 }
2780 tcp->tcp_state = TCPS_SYN_RCVD;
2781 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2782 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2783 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2784 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2785 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2786 if (mp1 != NULL) {
2787 tcp_send_data(tcp, mp1);
2788 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2789 }
2790 freemsg(mp);
2791 return;
2792 case TCPS_SYN_RCVD:
2793 if (flags & TH_ACK) {
2794 uint32_t pinit_wnd;
2795
2796 /*
2797 * In this state, a SYN|ACK packet is either bogus
2798 * because the other side must be ACKing our SYN which
2799 * indicates it has seen the ACK for their SYN and
2800 * shouldn't retransmit it or we're crossing SYNs
2801 * on active open.
2802 */
2803 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2804 freemsg(mp);
2805 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2806 tcp, seg_ack, 0, TH_RST);
2807 return;
2808 }
2809 /*
2810 * NOTE: RFC 793 pg. 72 says this should be
2811 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2812 * but that would mean we have an ack that ignored
2813 * our SYN.
2814 */
2815 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2816 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2817 freemsg(mp);
2818 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2819 tcp, seg_ack, 0, TH_RST);
2820 return;
2821 }
2822 /*
2823 * No sane TCP stack will send such a small window
2824 * without receiving any data. Just drop this invalid
2825 * ACK. We also shorten the abort timeout in case
2826 * this is an attack.
2827 */
2828 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2829 if (pinit_wnd < tcp->tcp_mss &&
2830 pinit_wnd < tcp_init_wnd_chk) {
2831 freemsg(mp);
2832 TCP_STAT(tcps, tcp_zwin_ack_syn);
2833 tcp->tcp_second_ctimer_threshold =
2834 tcp_early_abort * SECONDS;
2835 return;
2836 }
2837 }
2838 break;
2839 case TCPS_LISTEN:
2840 /*
2841 * Only a TLI listener can come through this path when a
2842 * acceptor is going back to be a listener and a packet
2843 * for the acceptor hits the classifier. For a socket
2844 * listener, this can never happen because a listener
2845 * can never accept connection on itself and hence a
2846 * socket acceptor can not go back to being a listener.
2847 */
2848 ASSERT(!TCP_IS_SOCKET(tcp));
2849 /*FALLTHRU*/
2850 case TCPS_CLOSED:
2851 case TCPS_BOUND: {
2852 conn_t *new_connp;
2853 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2854
2855 /*
2856 * Don't accept any input on a closed tcp as this TCP logically
2857 * does not exist on the system. Don't proceed further with
2858 * this TCP. For instance, this packet could trigger another
2859 * close of this tcp which would be disastrous for tcp_refcnt.
2860 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2861 * be called at most once on a TCP. In this case we need to
2862 * refeed the packet into the classifier and figure out where
2863 * the packet should go.
2864 */
2865 new_connp = ipcl_classify(mp, ira, ipst);
2866 if (new_connp != NULL) {
2867 /* Drops ref on new_connp */
2868 tcp_reinput(new_connp, mp, ira, ipst);
2869 return;
2870 }
2871 /* We failed to classify. For now just drop the packet */
2872 freemsg(mp);
2873 return;
2874 }
2875 case TCPS_IDLE:
2876 /*
2877 * Handle the case where the tcp_clean_death() has happened
2878 * on a connection (application hasn't closed yet) but a packet
2879 * was already queued on squeue before tcp_clean_death()
2880 * was processed. Calling tcp_clean_death() twice on same
2881 * connection can result in weird behaviour.
2882 */
2883 freemsg(mp);
2884 return;
2885 default:
2886 break;
2887 }
2888
2889 /*
2890 * Already on the correct queue/perimeter.
2891 * If this is a detached connection and not an eager
2892 * connection hanging off a listener then new data
2893 * (past the FIN) will cause a reset.
2894 * We do a special check here where it
2895 * is out of the main line, rather than check
2896 * if we are detached every time we see new
2897 * data down below.
2898 */
2899 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2900 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2901 TCPS_BUMP_MIB(tcps, tcpInClosed);
2902 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2903 freemsg(mp);
2904 tcp_xmit_ctl("new data when detached", tcp,
2905 tcp->tcp_snxt, 0, TH_RST);
2906 (void) tcp_clean_death(tcp, EPROTO);
2907 return;
2908 }
2909
2910 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2911 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2912 new_swnd = ntohs(tcpha->tha_win) <<
2913 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2914
2915 if (tcp->tcp_snd_ts_ok) {
2916 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
2917 /*
2918 * This segment is not acceptable.
2919 * Drop it and send back an ACK.
2920 */
2921 freemsg(mp);
2922 flags |= TH_ACK_NEEDED;
2923 goto ack_check;
2924 }
2925 } else if (tcp->tcp_snd_sack_ok) {
2926 tcpopt.tcp = tcp;
2927 /*
2928 * SACK info in already updated in tcp_parse_options. Ignore
2929 * all other TCP options...
2930 */
2931 (void) tcp_parse_options(tcpha, &tcpopt);
2932 }
2933 try_again:;
2934 mss = tcp->tcp_mss;
2935 gap = seg_seq - tcp->tcp_rnxt;
2936 rgap = tcp->tcp_rwnd - (gap + seg_len);
2937 /*
2938 * gap is the amount of sequence space between what we expect to see
2939 * and what we got for seg_seq. A positive value for gap means
2940 * something got lost. A negative value means we got some old stuff.
2941 */
2942 if (gap < 0) {
2943 /* Old stuff present. Is the SYN in there? */
2944 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2945 (seg_len != 0)) {
2946 flags &= ~TH_SYN;
2947 seg_seq++;
2948 urp--;
2949 /* Recompute the gaps after noting the SYN. */
2950 goto try_again;
2951 }
2952 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2953 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2954 (seg_len > -gap ? -gap : seg_len));
2955 /* Remove the old stuff from seg_len. */
2956 seg_len += gap;
2957 /*
2958 * Anything left?
2959 * Make sure to check for unack'd FIN when rest of data
2960 * has been previously ack'd.
2961 */
2962 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2963 /*
2964 * Resets are only valid if they lie within our offered
2965 * window. If the RST bit is set, we just ignore this
2966 * segment.
2967 */
2968 if (flags & TH_RST) {
2969 freemsg(mp);
2970 return;
2971 }
2972
2973 /*
2974 * The arriving of dup data packets indicate that we
2975 * may have postponed an ack for too long, or the other
2976 * side's RTT estimate is out of shape. Start acking
2977 * more often.
2978 */
2979 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2980 tcp->tcp_rack_cnt >= 1 &&
2981 tcp->tcp_rack_abs_max > 2) {
2982 tcp->tcp_rack_abs_max--;
2983 }
2984 tcp->tcp_rack_cur_max = 1;
2985
2986 /*
2987 * This segment is "unacceptable". None of its
2988 * sequence space lies within our advertized window.
2989 *
2990 * Adjust seg_len to the original value for tracing.
2991 */
2992 seg_len -= gap;
2993 if (connp->conn_debug) {
2994 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2995 "tcp_rput: unacceptable, gap %d, rgap %d, "
2996 "flags 0x%x, seg_seq %u, seg_ack %u, "
2997 "seg_len %d, rnxt %u, snxt %u, %s",
2998 gap, rgap, flags, seg_seq, seg_ack,
2999 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3000 tcp_display(tcp, NULL,
3001 DISP_ADDR_AND_PORT));
3002 }
3003
3004 /*
3005 * Arrange to send an ACK in response to the
3006 * unacceptable segment per RFC 793 page 69. There
3007 * is only one small difference between ours and the
3008 * acceptability test in the RFC - we accept ACK-only
3009 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3010 * will be generated.
3011 *
3012 * Note that we have to ACK an ACK-only packet at least
3013 * for stacks that send 0-length keep-alives with
3014 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3015 * section 4.2.3.6. As long as we don't ever generate
3016 * an unacceptable packet in response to an incoming
3017 * packet that is unacceptable, it should not cause
3018 * "ACK wars".
3019 */
3020 flags |= TH_ACK_NEEDED;
3021
3022 /*
3023 * Continue processing this segment in order to use the
3024 * ACK information it contains, but skip all other
3025 * sequence-number processing. Processing the ACK
3026 * information is necessary in order to
3027 * re-synchronize connections that may have lost
3028 * synchronization.
3029 *
3030 * We clear seg_len and flag fields related to
3031 * sequence number processing as they are not
3032 * to be trusted for an unacceptable segment.
3033 */
3034 seg_len = 0;
3035 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3036 goto process_ack;
3037 }
3038
3039 /* Fix seg_seq, and chew the gap off the front. */
3040 seg_seq = tcp->tcp_rnxt;
3041 urp += gap;
3042 do {
3043 mblk_t *mp2;
3044 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3045 (uintptr_t)UINT_MAX);
3046 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3047 if (gap > 0) {
3048 mp->b_rptr = mp->b_wptr - gap;
3049 break;
3050 }
3051 mp2 = mp;
3052 mp = mp->b_cont;
3053 freeb(mp2);
3054 } while (gap < 0);
3055 /*
3056 * If the urgent data has already been acknowledged, we
3057 * should ignore TH_URG below
3058 */
3059 if (urp < 0)
3060 flags &= ~TH_URG;
3061 }
3062 /*
3063 * rgap is the amount of stuff received out of window. A negative
3064 * value is the amount out of window.
3065 */
3066 if (rgap < 0) {
3067 mblk_t *mp2;
3068
3069 if (tcp->tcp_rwnd == 0) {
3070 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3071 } else {
3072 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3073 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3074 }
3075
3076 /*
3077 * seg_len does not include the FIN, so if more than
3078 * just the FIN is out of window, we act like we don't
3079 * see it. (If just the FIN is out of window, rgap
3080 * will be zero and we will go ahead and acknowledge
3081 * the FIN.)
3082 */
3083 flags &= ~TH_FIN;
3084
3085 /* Fix seg_len and make sure there is something left. */
3086 seg_len += rgap;
3087 if (seg_len <= 0) {
3088 /*
3089 * Resets are only valid if they lie within our offered
3090 * window. If the RST bit is set, we just ignore this
3091 * segment.
3092 */
3093 if (flags & TH_RST) {
3094 freemsg(mp);
3095 return;
3096 }
3097
3098 /* Per RFC 793, we need to send back an ACK. */
3099 flags |= TH_ACK_NEEDED;
3100
3101 /*
3102 * Send SIGURG as soon as possible i.e. even
3103 * if the TH_URG was delivered in a window probe
3104 * packet (which will be unacceptable).
3105 *
3106 * We generate a signal if none has been generated
3107 * for this connection or if this is a new urgent
3108 * byte. Also send a zero-length "unmarked" message
3109 * to inform SIOCATMARK that this is not the mark.
3110 *
3111 * tcp_urp_last_valid is cleared when the T_exdata_ind
3112 * is sent up. This plus the check for old data
3113 * (gap >= 0) handles the wraparound of the sequence
3114 * number space without having to always track the
3115 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3116 * this max in its rcv_up variable).
3117 *
3118 * This prevents duplicate SIGURGS due to a "late"
3119 * zero-window probe when the T_EXDATA_IND has already
3120 * been sent up.
3121 */
3122 if ((flags & TH_URG) &&
3123 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3124 tcp->tcp_urp_last))) {
3125 if (IPCL_IS_NONSTR(connp)) {
3126 if (!TCP_IS_DETACHED(tcp)) {
3127 (*sockupcalls->su_signal_oob)
3128 (connp->conn_upper_handle,
3129 urp);
3130 }
3131 } else {
3132 mp1 = allocb(0, BPRI_MED);
3133 if (mp1 == NULL) {
3134 freemsg(mp);
3135 return;
3136 }
3137 if (!TCP_IS_DETACHED(tcp) &&
3138 !putnextctl1(connp->conn_rq,
3139 M_PCSIG, SIGURG)) {
3140 /* Try again on the rexmit. */
3141 freemsg(mp1);
3142 freemsg(mp);
3143 return;
3144 }
3145 /*
3146 * If the next byte would be the mark
3147 * then mark with MARKNEXT else mark
3148 * with NOTMARKNEXT.
3149 */
3150 if (gap == 0 && urp == 0)
3151 mp1->b_flag |= MSGMARKNEXT;
3152 else
3153 mp1->b_flag |= MSGNOTMARKNEXT;
3154 freemsg(tcp->tcp_urp_mark_mp);
3155 tcp->tcp_urp_mark_mp = mp1;
3156 flags |= TH_SEND_URP_MARK;
3157 }
3158 tcp->tcp_urp_last_valid = B_TRUE;
3159 tcp->tcp_urp_last = urp + seg_seq;
3160 }
3161 /*
3162 * If this is a zero window probe, continue to
3163 * process the ACK part. But we need to set seg_len
3164 * to 0 to avoid data processing. Otherwise just
3165 * drop the segment and send back an ACK.
3166 */
3167 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3168 flags &= ~(TH_SYN | TH_URG);
3169 seg_len = 0;
3170 goto process_ack;
3171 } else {
3172 freemsg(mp);
3173 goto ack_check;
3174 }
3175 }
3176 /* Pitch out of window stuff off the end. */
3177 rgap = seg_len;
3178 mp2 = mp;
3179 do {
3180 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3181 (uintptr_t)INT_MAX);
3182 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3183 if (rgap < 0) {
3184 mp2->b_wptr += rgap;
3185 if ((mp1 = mp2->b_cont) != NULL) {
3186 mp2->b_cont = NULL;
3187 freemsg(mp1);
3188 }
3189 break;
3190 }
3191 } while ((mp2 = mp2->b_cont) != NULL);
3192 }
3193 ok:;
3194 /*
3195 * TCP should check ECN info for segments inside the window only.
3196 * Therefore the check should be done here.
3197 */
3198 if (tcp->tcp_ecn_ok) {
3199 if (flags & TH_CWR) {
3200 tcp->tcp_ecn_echo_on = B_FALSE;
3201 }
3202 /*
3203 * Note that both ECN_CE and CWR can be set in the
3204 * same segment. In this case, we once again turn
3205 * on ECN_ECHO.
3206 */
3207 if (connp->conn_ipversion == IPV4_VERSION) {
3208 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3209
3210 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3211 tcp->tcp_ecn_echo_on = B_TRUE;
3212 }
3213 } else {
3214 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3215
3216 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3217 htonl(IPH_ECN_CE << 20)) {
3218 tcp->tcp_ecn_echo_on = B_TRUE;
3219 }
3220 }
3221 }
3222
3223 /*
3224 * Check whether we can update tcp_ts_recent. This test is
3225 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP
3226 * Extensions for High Performance: An Update", Internet Draft.
3227 */
3228 if (tcp->tcp_snd_ts_ok &&
3229 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3230 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3231 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3232 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3233 }
3234
3235 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3236 /*
3237 * FIN in an out of order segment. We record this in
3238 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3239 * Clear the FIN so that any check on FIN flag will fail.
3240 * Remember that FIN also counts in the sequence number
3241 * space. So we need to ack out of order FIN only segments.
3242 */
3243 if (flags & TH_FIN) {
3244 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3245 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3246 flags &= ~TH_FIN;
3247 flags |= TH_ACK_NEEDED;
3248 }
3249 if (seg_len > 0) {
3250 /* Fill in the SACK blk list. */
3251 if (tcp->tcp_snd_sack_ok) {
3252 tcp_sack_insert(tcp->tcp_sack_list,
3253 seg_seq, seg_seq + seg_len,
3254 &(tcp->tcp_num_sack_blk));
3255 }
3256
3257 /*
3258 * Attempt reassembly and see if we have something
3259 * ready to go.
3260 */
3261 mp = tcp_reass(tcp, mp, seg_seq);
3262 /* Always ack out of order packets */
3263 flags |= TH_ACK_NEEDED | TH_PUSH;
3264 if (mp) {
3265 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3266 (uintptr_t)INT_MAX);
3267 seg_len = mp->b_cont ? msgdsize(mp) :
3268 (int)(mp->b_wptr - mp->b_rptr);
3269 seg_seq = tcp->tcp_rnxt;
3270 /*
3271 * A gap is filled and the seq num and len
3272 * of the gap match that of a previously
3273 * received FIN, put the FIN flag back in.
3274 */
3275 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3276 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3277 flags |= TH_FIN;
3278 tcp->tcp_valid_bits &=
3279 ~TCP_OFO_FIN_VALID;
3280 }
3281 if (tcp->tcp_reass_tid != 0) {
3282 (void) TCP_TIMER_CANCEL(tcp,
3283 tcp->tcp_reass_tid);
3284 /*
3285 * Restart the timer if there is still
3286 * data in the reassembly queue.
3287 */
3288 if (tcp->tcp_reass_head != NULL) {
3289 tcp->tcp_reass_tid = TCP_TIMER(
3290 tcp, tcp_reass_timer,
3291 tcps->tcps_reass_timeout);
3292 } else {
3293 tcp->tcp_reass_tid = 0;
3294 }
3295 }
3296 } else {
3297 /*
3298 * Keep going even with NULL mp.
3299 * There may be a useful ACK or something else
3300 * we don't want to miss.
3301 *
3302 * But TCP should not perform fast retransmit
3303 * because of the ack number. TCP uses
3304 * seg_len == 0 to determine if it is a pure
3305 * ACK. And this is not a pure ACK.
3306 */
3307 seg_len = 0;
3308 ofo_seg = B_TRUE;
3309
3310 if (tcps->tcps_reass_timeout != 0 &&
3311 tcp->tcp_reass_tid == 0) {
3312 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3313 tcp_reass_timer,
3314 tcps->tcps_reass_timeout);
3315 }
3316 }
3317 }
3318 } else if (seg_len > 0) {
3319 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3320 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3321 /*
3322 * If an out of order FIN was received before, and the seq
3323 * num and len of the new segment match that of the FIN,
3324 * put the FIN flag back in.
3325 */
3326 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3327 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3328 flags |= TH_FIN;
3329 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3330 }
3331 }
3332 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3333 if (flags & TH_RST) {
3334 freemsg(mp);
3335 switch (tcp->tcp_state) {
3336 case TCPS_SYN_RCVD:
3337 (void) tcp_clean_death(tcp, ECONNREFUSED);
3338 break;
3339 case TCPS_ESTABLISHED:
3340 case TCPS_FIN_WAIT_1:
3341 case TCPS_FIN_WAIT_2:
3342 case TCPS_CLOSE_WAIT:
3343 (void) tcp_clean_death(tcp, ECONNRESET);
3344 break;
3345 case TCPS_CLOSING:
3346 case TCPS_LAST_ACK:
3347 (void) tcp_clean_death(tcp, 0);
3348 break;
3349 default:
3350 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3351 (void) tcp_clean_death(tcp, ENXIO);
3352 break;
3353 }
3354 return;
3355 }
3356 if (flags & TH_SYN) {
3357 /*
3358 * See RFC 793, Page 71
3359 *
3360 * The seq number must be in the window as it should
3361 * be "fixed" above. If it is outside window, it should
3362 * be already rejected. Note that we allow seg_seq to be
3363 * rnxt + rwnd because we want to accept 0 window probe.
3364 */
3365 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3366 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3367 freemsg(mp);
3368 /*
3369 * If the ACK flag is not set, just use our snxt as the
3370 * seq number of the RST segment.
3371 */
3372 if (!(flags & TH_ACK)) {
3373 seg_ack = tcp->tcp_snxt;
3374 }
3375 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3376 TH_RST|TH_ACK);
3377 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3378 (void) tcp_clean_death(tcp, ECONNRESET);
3379 return;
3380 }
3381 /*
3382 * urp could be -1 when the urp field in the packet is 0
3383 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3384 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3385 */
3386 if (flags & TH_URG && urp >= 0) {
3387 if (!tcp->tcp_urp_last_valid ||
3388 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3389 /*
3390 * Non-STREAMS sockets handle the urgent data a litte
3391 * differently from STREAMS based sockets. There is no
3392 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3393 * flags to keep SIOCATMARK happy. Instead a
3394 * su_signal_oob upcall is made to update the mark.
3395 * Neither is a T_EXDATA_IND mblk needed to be
3396 * prepended to the urgent data. The urgent data is
3397 * delivered using the su_recv upcall, where we set
3398 * the MSG_OOB flag to indicate that it is urg data.
3399 *
3400 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3401 * are used by non-STREAMS sockets.
3402 */
3403 if (IPCL_IS_NONSTR(connp)) {
3404 if (!TCP_IS_DETACHED(tcp)) {
3405 (*sockupcalls->su_signal_oob)
3406 (connp->conn_upper_handle, urp);
3407 }
3408 } else {
3409 /*
3410 * If we haven't generated the signal yet for
3411 * this urgent pointer value, do it now. Also,
3412 * send up a zero-length M_DATA indicating
3413 * whether or not this is the mark. The latter
3414 * is not needed when a T_EXDATA_IND is sent up.
3415 * However, if there are allocation failures
3416 * this code relies on the sender retransmitting
3417 * and the socket code for determining the mark
3418 * should not block waiting for the peer to
3419 * transmit. Thus, for simplicity we always
3420 * send up the mark indication.
3421 */
3422 mp1 = allocb(0, BPRI_MED);
3423 if (mp1 == NULL) {
3424 freemsg(mp);
3425 return;
3426 }
3427 if (!TCP_IS_DETACHED(tcp) &&
3428 !putnextctl1(connp->conn_rq, M_PCSIG,
3429 SIGURG)) {
3430 /* Try again on the rexmit. */
3431 freemsg(mp1);
3432 freemsg(mp);
3433 return;
3434 }
3435 /*
3436 * Mark with NOTMARKNEXT for now.
3437 * The code below will change this to MARKNEXT
3438 * if we are at the mark.
3439 *
3440 * If there are allocation failures (e.g. in
3441 * dupmsg below) the next time tcp_input_data
3442 * sees the urgent segment it will send up the
3443 * MSGMARKNEXT message.
3444 */
3445 mp1->b_flag |= MSGNOTMARKNEXT;
3446 freemsg(tcp->tcp_urp_mark_mp);
3447 tcp->tcp_urp_mark_mp = mp1;
3448 flags |= TH_SEND_URP_MARK;
3449 #ifdef DEBUG
3450 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3451 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3452 "last %x, %s",
3453 seg_seq, urp, tcp->tcp_urp_last,
3454 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3455 #endif /* DEBUG */
3456 }
3457 tcp->tcp_urp_last_valid = B_TRUE;
3458 tcp->tcp_urp_last = urp + seg_seq;
3459 } else if (tcp->tcp_urp_mark_mp != NULL) {
3460 /*
3461 * An allocation failure prevented the previous
3462 * tcp_input_data from sending up the allocated
3463 * MSG*MARKNEXT message - send it up this time
3464 * around.
3465 */
3466 flags |= TH_SEND_URP_MARK;
3467 }
3468
3469 /*
3470 * If the urgent byte is in this segment, make sure that it is
3471 * all by itself. This makes it much easier to deal with the
3472 * possibility of an allocation failure on the T_exdata_ind.
3473 * Note that seg_len is the number of bytes in the segment, and
3474 * urp is the offset into the segment of the urgent byte.
3475 * urp < seg_len means that the urgent byte is in this segment.
3476 */
3477 if (urp < seg_len) {
3478 if (seg_len != 1) {
3479 uint32_t tmp_rnxt;
3480 /*
3481 * Break it up and feed it back in.
3482 * Re-attach the IP header.
3483 */
3484 mp->b_rptr = iphdr;
3485 if (urp > 0) {
3486 /*
3487 * There is stuff before the urgent
3488 * byte.
3489 */
3490 mp1 = dupmsg(mp);
3491 if (!mp1) {
3492 /*
3493 * Trim from urgent byte on.
3494 * The rest will come back.
3495 */
3496 (void) adjmsg(mp,
3497 urp - seg_len);
3498 tcp_input_data(connp,
3499 mp, NULL, ira);
3500 return;
3501 }
3502 (void) adjmsg(mp1, urp - seg_len);
3503 /* Feed this piece back in. */
3504 tmp_rnxt = tcp->tcp_rnxt;
3505 tcp_input_data(connp, mp1, NULL, ira);
3506 /*
3507 * If the data passed back in was not
3508 * processed (ie: bad ACK) sending
3509 * the remainder back in will cause a
3510 * loop. In this case, drop the
3511 * packet and let the sender try
3512 * sending a good packet.
3513 */
3514 if (tmp_rnxt == tcp->tcp_rnxt) {
3515 freemsg(mp);
3516 return;
3517 }
3518 }
3519 if (urp != seg_len - 1) {
3520 uint32_t tmp_rnxt;
3521 /*
3522 * There is stuff after the urgent
3523 * byte.
3524 */
3525 mp1 = dupmsg(mp);
3526 if (!mp1) {
3527 /*
3528 * Trim everything beyond the
3529 * urgent byte. The rest will
3530 * come back.
3531 */
3532 (void) adjmsg(mp,
3533 urp + 1 - seg_len);
3534 tcp_input_data(connp,
3535 mp, NULL, ira);
3536 return;
3537 }
3538 (void) adjmsg(mp1, urp + 1 - seg_len);
3539 tmp_rnxt = tcp->tcp_rnxt;
3540 tcp_input_data(connp, mp1, NULL, ira);
3541 /*
3542 * If the data passed back in was not
3543 * processed (ie: bad ACK) sending
3544 * the remainder back in will cause a
3545 * loop. In this case, drop the
3546 * packet and let the sender try
3547 * sending a good packet.
3548 */
3549 if (tmp_rnxt == tcp->tcp_rnxt) {
3550 freemsg(mp);
3551 return;
3552 }
3553 }
3554 tcp_input_data(connp, mp, NULL, ira);
3555 return;
3556 }
3557 /*
3558 * This segment contains only the urgent byte. We
3559 * have to allocate the T_exdata_ind, if we can.
3560 */
3561 if (IPCL_IS_NONSTR(connp)) {
3562 int error;
3563
3564 (*sockupcalls->su_recv)
3565 (connp->conn_upper_handle, mp, seg_len,
3566 MSG_OOB, &error, NULL);
3567 /*
3568 * We should never be in middle of a
3569 * fallback, the squeue guarantees that.
3570 */
3571 ASSERT(error != EOPNOTSUPP);
3572 mp = NULL;
3573 goto update_ack;
3574 } else if (!tcp->tcp_urp_mp) {
3575 struct T_exdata_ind *tei;
3576 mp1 = allocb(sizeof (struct T_exdata_ind),
3577 BPRI_MED);
3578 if (!mp1) {
3579 /*
3580 * Sigh... It'll be back.
3581 * Generate any MSG*MARK message now.
3582 */
3583 freemsg(mp);
3584 seg_len = 0;
3585 if (flags & TH_SEND_URP_MARK) {
3586
3587
3588 ASSERT(tcp->tcp_urp_mark_mp);
3589 tcp->tcp_urp_mark_mp->b_flag &=
3590 ~MSGNOTMARKNEXT;
3591 tcp->tcp_urp_mark_mp->b_flag |=
3592 MSGMARKNEXT;
3593 }
3594 goto ack_check;
3595 }
3596 mp1->b_datap->db_type = M_PROTO;
3597 tei = (struct T_exdata_ind *)mp1->b_rptr;
3598 tei->PRIM_type = T_EXDATA_IND;
3599 tei->MORE_flag = 0;
3600 mp1->b_wptr = (uchar_t *)&tei[1];
3601 tcp->tcp_urp_mp = mp1;
3602 #ifdef DEBUG
3603 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3604 "tcp_rput: allocated exdata_ind %s",
3605 tcp_display(tcp, NULL,
3606 DISP_PORT_ONLY));
3607 #endif /* DEBUG */
3608 /*
3609 * There is no need to send a separate MSG*MARK
3610 * message since the T_EXDATA_IND will be sent
3611 * now.
3612 */
3613 flags &= ~TH_SEND_URP_MARK;
3614 freemsg(tcp->tcp_urp_mark_mp);
3615 tcp->tcp_urp_mark_mp = NULL;
3616 }
3617 /*
3618 * Now we are all set. On the next putnext upstream,
3619 * tcp_urp_mp will be non-NULL and will get prepended
3620 * to what has to be this piece containing the urgent
3621 * byte. If for any reason we abort this segment below,
3622 * if it comes back, we will have this ready, or it
3623 * will get blown off in close.
3624 */
3625 } else if (urp == seg_len) {
3626 /*
3627 * The urgent byte is the next byte after this sequence
3628 * number. If this endpoint is non-STREAMS, then there
3629 * is nothing to do here since the socket has already
3630 * been notified about the urg pointer by the
3631 * su_signal_oob call above.
3632 *
3633 * In case of STREAMS, some more work might be needed.
3634 * If there is data it is marked with MSGMARKNEXT and
3635 * and any tcp_urp_mark_mp is discarded since it is not
3636 * needed. Otherwise, if the code above just allocated
3637 * a zero-length tcp_urp_mark_mp message, that message
3638 * is tagged with MSGMARKNEXT. Sending up these
3639 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3640 * even though the T_EXDATA_IND will not be sent up
3641 * until the urgent byte arrives.
3642 */
3643 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3644 if (seg_len != 0) {
3645 flags |= TH_MARKNEXT_NEEDED;
3646 freemsg(tcp->tcp_urp_mark_mp);
3647 tcp->tcp_urp_mark_mp = NULL;
3648 flags &= ~TH_SEND_URP_MARK;
3649 } else if (tcp->tcp_urp_mark_mp != NULL) {
3650 flags |= TH_SEND_URP_MARK;
3651 tcp->tcp_urp_mark_mp->b_flag &=
3652 ~MSGNOTMARKNEXT;
3653 tcp->tcp_urp_mark_mp->b_flag |=
3654 MSGMARKNEXT;
3655 }
3656 }
3657 #ifdef DEBUG
3658 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3659 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3660 seg_len, flags,
3661 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3662 #endif /* DEBUG */
3663 }
3664 #ifdef DEBUG
3665 else {
3666 /* Data left until we hit mark */
3667 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3668 "tcp_rput: URP %d bytes left, %s",
3669 urp - seg_len, tcp_display(tcp, NULL,
3670 DISP_PORT_ONLY));
3671 }
3672 #endif /* DEBUG */
3673 }
3674
3675 process_ack:
3676 if (!(flags & TH_ACK)) {
3677 freemsg(mp);
3678 goto xmit_check;
3679 }
3680 }
3681 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3682
3683 if (bytes_acked > 0)
3684 tcp->tcp_ip_forward_progress = B_TRUE;
3685 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3686 /*
3687 * tcp_sendmsg() checks tcp_state without entering
3688 * the squeue so tcp_state should be updated before
3689 * sending up a connection confirmation or a new
3690 * connection indication.
3691 */
3692 tcp->tcp_state = TCPS_ESTABLISHED;
3693
3694 /*
3695 * We are seeing the final ack in the three way
3696 * hand shake of a active open'ed connection
3697 * so we must send up a T_CONN_CON
3698 */
3699 if (tcp->tcp_active_open) {
3700 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3701 freemsg(mp);
3702 tcp->tcp_state = TCPS_SYN_RCVD;
3703 return;
3704 }
3705 /*
3706 * Don't fuse the loopback endpoints for
3707 * simultaneous active opens.
3708 */
3709 if (tcp->tcp_loopback) {
3710 TCP_STAT(tcps, tcp_fusion_unfusable);
3711 tcp->tcp_unfusable = B_TRUE;
3712 }
3713 /*
3714 * For simultaneous active open, trace receipt of final
3715 * ACK as tcp:::connect-established.
3716 */
3717 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3718 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3719 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3720 } else if (IPCL_IS_NONSTR(connp)) {
3721 /*
3722 * 3-way handshake has completed, so notify socket
3723 * of the new connection.
3724 *
3725 * We are here means eager is fine but it can
3726 * get a TH_RST at any point between now and till
3727 * accept completes and disappear. We need to
3728 * ensure that reference to eager is valid after
3729 * we get out of eager's perimeter. So we do
3730 * an extra refhold.
3731 */
3732 CONN_INC_REF(connp);
3733
3734 if (!tcp_newconn_notify(tcp, ira)) {
3735 /*
3736 * The state-change probe for SYN_RCVD ->
3737 * ESTABLISHED has not fired yet. We reset
3738 * the state to SYN_RCVD so that future
3739 * state-change probes report correct state
3740 * transistions.
3741 */
3742 tcp->tcp_state = TCPS_SYN_RCVD;
3743 freemsg(mp);
3744 /* notification did not go up, so drop ref */
3745 CONN_DEC_REF(connp);
3746 /* ... and close the eager */
3747 ASSERT(TCP_IS_DETACHED(tcp));
3748 (void) tcp_close_detached(tcp);
3749 return;
3750 }
3751 /*
3752 * For passive open, trace receipt of final ACK as
3753 * tcp:::accept-established.
3754 */
3755 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3756 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3757 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3758 } else {
3759 /*
3760 * 3-way handshake complete - this is a STREAMS based
3761 * socket, so pass up the T_CONN_IND.
3762 */
3763 tcp_t *listener = tcp->tcp_listener;
3764 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3765
3766 tcp->tcp_tconnind_started = B_TRUE;
3767 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3768 ASSERT(mp != NULL);
3769 /*
3770 * We are here means eager is fine but it can
3771 * get a TH_RST at any point between now and till
3772 * accept completes and disappear. We need to
3773 * ensure that reference to eager is valid after
3774 * we get out of eager's perimeter. So we do
3775 * an extra refhold.
3776 */
3777 CONN_INC_REF(connp);
3778
3779 /*
3780 * The listener also exists because of the refhold
3781 * done in tcp_input_listener. Its possible that it
3782 * might have closed. We will check that once we
3783 * get inside listeners context.
3784 */
3785 CONN_INC_REF(listener->tcp_connp);
3786 if (listener->tcp_connp->conn_sqp ==
3787 connp->conn_sqp) {
3788 /*
3789 * We optimize by not calling an SQUEUE_ENTER
3790 * on the listener since we know that the
3791 * listener and eager squeues are the same.
3792 * We are able to make this check safely only
3793 * because neither the eager nor the listener
3794 * can change its squeue. Only an active connect
3795 * can change its squeue
3796 */
3797 tcp_send_conn_ind(listener->tcp_connp, mp,
3798 listener->tcp_connp->conn_sqp);
3799 CONN_DEC_REF(listener->tcp_connp);
3800 } else if (!tcp->tcp_loopback) {
3801 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3802 mp, tcp_send_conn_ind,
3803 listener->tcp_connp, NULL, SQ_FILL,
3804 SQTAG_TCP_CONN_IND);
3805 } else {
3806 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3807 mp, tcp_send_conn_ind,
3808 listener->tcp_connp, NULL, SQ_NODRAIN,
3809 SQTAG_TCP_CONN_IND);
3810 }
3811 /*
3812 * For passive open, trace receipt of final ACK as
3813 * tcp:::accept-established.
3814 */
3815 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3816 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3817 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3818 }
3819 TCPS_CONN_INC(tcps);
3820
3821 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3822 bytes_acked--;
3823 /* SYN was acked - making progress */
3824 tcp->tcp_ip_forward_progress = B_TRUE;
3825
3826 /*
3827 * If SYN was retransmitted, need to reset all
3828 * retransmission info as this segment will be
3829 * treated as a dup ACK.
3830 */
3831 if (tcp->tcp_rexmit) {
3832 tcp->tcp_rexmit = B_FALSE;
3833 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3834 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3835 tcp->tcp_snd_burst = tcp->tcp_localnet ?
3836 TCP_CWND_INFINITE : TCP_CWND_NORMAL;
3837 tcp->tcp_ms_we_have_waited = 0;
3838 tcp->tcp_cwnd = mss;
3839 }
3840
3841 /*
3842 * We set the send window to zero here.
3843 * This is needed if there is data to be
3844 * processed already on the queue.
3845 * Later (at swnd_update label), the
3846 * "new_swnd > tcp_swnd" condition is satisfied
3847 * the XMIT_NEEDED flag is set in the current
3848 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3849 * called if there is already data on queue in
3850 * this state.
3851 */
3852 tcp->tcp_swnd = 0;
3853
3854 if (new_swnd > tcp->tcp_max_swnd)
3855 tcp->tcp_max_swnd = new_swnd;
3856 tcp->tcp_swl1 = seg_seq;
3857 tcp->tcp_swl2 = seg_ack;
3858 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3859
3860 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3861 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3862 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3863 int32_t, TCPS_SYN_RCVD);
3864
3865 /* Fuse when both sides are in ESTABLISHED state */
3866 if (tcp->tcp_loopback && do_tcp_fusion)
3867 tcp_fuse(tcp, iphdr, tcpha);
3868
3869 }
3870 /* This code follows 4.4BSD-Lite2 mostly. */
3871 if (bytes_acked < 0)
3872 goto est;
3873
3874 /*
3875 * If TCP is ECN capable and the congestion experience bit is
3876 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3877 * done once per window (or more loosely, per RTT).
3878 */
3879 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3880 tcp->tcp_cwr = B_FALSE;
3881 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3882 if (!tcp->tcp_cwr) {
3883 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3884 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3885 tcp->tcp_cwnd = npkt * mss;
3886 /*
3887 * If the cwnd is 0, use the timer to clock out
3888 * new segments. This is required by the ECN spec.
3889 */
3890 if (npkt == 0) {
3891 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3892 /*
3893 * This makes sure that when the ACK comes
3894 * back, we will increase tcp_cwnd by 1 MSS.
3895 */
3896 tcp->tcp_cwnd_cnt = 0;
3897 }
3898 tcp->tcp_cwr = B_TRUE;
3899 /*
3900 * This marks the end of the current window of in
3901 * flight data. That is why we don't use
3902 * tcp_suna + tcp_swnd. Only data in flight can
3903 * provide ECN info.
3904 */
3905 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3906 tcp->tcp_ecn_cwr_sent = B_FALSE;
3907 }
3908 }
3909
3910 mp1 = tcp->tcp_xmit_head;
3911 if (bytes_acked == 0) {
3912 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3913 int dupack_cnt;
3914
3915 TCPS_BUMP_MIB(tcps, tcpInDupAck);
3916 /*
3917 * Fast retransmit. When we have seen exactly three
3918 * identical ACKs while we have unacked data
3919 * outstanding we take it as a hint that our peer
3920 * dropped something.
3921 *
3922 * If TCP is retransmitting, don't do fast retransmit.
3923 */
3924 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3925 ! tcp->tcp_rexmit) {
3926 /* Do Limited Transmit */
3927 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3928 tcps->tcps_dupack_fast_retransmit) {
3929 /*
3930 * RFC 3042
3931 *
3932 * What we need to do is temporarily
3933 * increase tcp_cwnd so that new
3934 * data can be sent if it is allowed
3935 * by the receive window (tcp_rwnd).
3936 * tcp_wput_data() will take care of
3937 * the rest.
3938 *
3939 * If the connection is SACK capable,
3940 * only do limited xmit when there
3941 * is SACK info.
3942 *
3943 * Note how tcp_cwnd is incremented.
3944 * The first dup ACK will increase
3945 * it by 1 MSS. The second dup ACK
3946 * will increase it by 2 MSS. This
3947 * means that only 1 new segment will
3948 * be sent for each dup ACK.
3949 */
3950 if (tcp->tcp_unsent > 0 &&
3951 (!tcp->tcp_snd_sack_ok ||
3952 (tcp->tcp_snd_sack_ok &&
3953 tcp->tcp_notsack_list != NULL))) {
3954 tcp->tcp_cwnd += mss <<
3955 (tcp->tcp_dupack_cnt - 1);
3956 flags |= TH_LIMIT_XMIT;
3957 }
3958 } else if (dupack_cnt ==
3959 tcps->tcps_dupack_fast_retransmit) {
3960
3961 /*
3962 * If we have reduced tcp_ssthresh
3963 * because of ECN, do not reduce it again
3964 * unless it is already one window of data
3965 * away. After one window of data, tcp_cwr
3966 * should then be cleared. Note that
3967 * for non ECN capable connection, tcp_cwr
3968 * should always be false.
3969 *
3970 * Adjust cwnd since the duplicate
3971 * ack indicates that a packet was
3972 * dropped (due to congestion.)
3973 */
3974 if (!tcp->tcp_cwr) {
3975 npkt = ((tcp->tcp_snxt -
3976 tcp->tcp_suna) >> 1) / mss;
3977 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3978 mss;
3979 tcp->tcp_cwnd = (npkt +
3980 tcp->tcp_dupack_cnt) * mss;
3981 }
3982 if (tcp->tcp_ecn_ok) {
3983 tcp->tcp_cwr = B_TRUE;
3984 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3985 tcp->tcp_ecn_cwr_sent = B_FALSE;
3986 }
3987
3988 /*
3989 * We do Hoe's algorithm. Refer to her
3990 * paper "Improving the Start-up Behavior
3991 * of a Congestion Control Scheme for TCP,"
3992 * appeared in SIGCOMM'96.
3993 *
3994 * Save highest seq no we have sent so far.
3995 * Be careful about the invisible FIN byte.
3996 */
3997 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
3998 (tcp->tcp_unsent == 0)) {
3999 tcp->tcp_rexmit_max = tcp->tcp_fss;
4000 } else {
4001 tcp->tcp_rexmit_max = tcp->tcp_snxt;
4002 }
4003
4004 /*
4005 * Do not allow bursty traffic during.
4006 * fast recovery. Refer to Fall and Floyd's
4007 * paper "Simulation-based Comparisons of
4008 * Tahoe, Reno and SACK TCP" (in CCR?)
4009 * This is a best current practise.
4010 */
4011 tcp->tcp_snd_burst = TCP_CWND_SS;
4012
4013 /*
4014 * For SACK:
4015 * Calculate tcp_pipe, which is the
4016 * estimated number of bytes in
4017 * network.
4018 *
4019 * tcp_fack is the highest sack'ed seq num
4020 * TCP has received.
4021 *
4022 * tcp_pipe is explained in the above quoted
4023 * Fall and Floyd's paper. tcp_fack is
4024 * explained in Mathis and Mahdavi's
4025 * "Forward Acknowledgment: Refining TCP
4026 * Congestion Control" in SIGCOMM '96.
4027 */
4028 if (tcp->tcp_snd_sack_ok) {
4029 if (tcp->tcp_notsack_list != NULL) {
4030 tcp->tcp_pipe = tcp->tcp_snxt -
4031 tcp->tcp_fack;
4032 tcp->tcp_sack_snxt = seg_ack;
4033 flags |= TH_NEED_SACK_REXMIT;
4034 } else {
4035 /*
4036 * Always initialize tcp_pipe
4037 * even though we don't have
4038 * any SACK info. If later
4039 * we get SACK info and
4040 * tcp_pipe is not initialized,
4041 * funny things will happen.
4042 */
4043 tcp->tcp_pipe =
4044 tcp->tcp_cwnd_ssthresh;
4045 }
4046 } else {
4047 flags |= TH_REXMIT_NEEDED;
4048 } /* tcp_snd_sack_ok */
4049
4050 } else {
4051 /*
4052 * Here we perform congestion
4053 * avoidance, but NOT slow start.
4054 * This is known as the Fast
4055 * Recovery Algorithm.
4056 */
4057 if (tcp->tcp_snd_sack_ok &&
4058 tcp->tcp_notsack_list != NULL) {
4059 flags |= TH_NEED_SACK_REXMIT;
4060 tcp->tcp_pipe -= mss;
4061 if (tcp->tcp_pipe < 0)
4062 tcp->tcp_pipe = 0;
4063 } else {
4064 /*
4065 * We know that one more packet has
4066 * left the pipe thus we can update
4067 * cwnd.
4068 */
4069 cwnd = tcp->tcp_cwnd + mss;
4070 if (cwnd > tcp->tcp_cwnd_max)
4071 cwnd = tcp->tcp_cwnd_max;
4072 tcp->tcp_cwnd = cwnd;
4073 if (tcp->tcp_unsent > 0)
4074 flags |= TH_XMIT_NEEDED;
4075 }
4076 }
4077 }
4078 } else if (tcp->tcp_zero_win_probe) {
4079 /*
4080 * If the window has opened, need to arrange
4081 * to send additional data.
4082 */
4083 if (new_swnd != 0) {
4084 /* tcp_suna != tcp_snxt */
4085 /* Packet contains a window update */
4086 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4087 tcp->tcp_zero_win_probe = 0;
4088 tcp->tcp_timer_backoff = 0;
4089 tcp->tcp_ms_we_have_waited = 0;
4090
4091 /*
4092 * Transmit starting with tcp_suna since
4093 * the one byte probe is not ack'ed.
4094 * If TCP has sent more than one identical
4095 * probe, tcp_rexmit will be set. That means
4096 * tcp_ss_rexmit() will send out the one
4097 * byte along with new data. Otherwise,
4098 * fake the retransmission.
4099 */
4100 flags |= TH_XMIT_NEEDED;
4101 if (!tcp->tcp_rexmit) {
4102 tcp->tcp_rexmit = B_TRUE;
4103 tcp->tcp_dupack_cnt = 0;
4104 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4105 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4106 }
4107 }
4108 }
4109 goto swnd_update;
4110 }
4111
4112 /*
4113 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4114 * If the ACK value acks something that we have not yet sent, it might
4115 * be an old duplicate segment. Send an ACK to re-synchronize the
4116 * other side.
4117 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4118 * state is handled above, so we can always just drop the segment and
4119 * send an ACK here.
4120 *
4121 * In the case where the peer shrinks the window, we see the new window
4122 * update, but all the data sent previously is queued up by the peer.
4123 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4124 * number, which was already sent, and within window, is recorded.
4125 * tcp_snxt is then updated.
4126 *
4127 * If the window has previously shrunk, and an ACK for data not yet
4128 * sent, according to tcp_snxt is recieved, it may still be valid. If
4129 * the ACK is for data within the window at the time the window was
4130 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4131 * the sequence number ACK'ed.
4132 *
4133 * If the ACK covers all the data sent at the time the window was
4134 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4135 *
4136 * Should we send ACKs in response to ACK only segments?
4137 */
4138
4139 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4140 if ((tcp->tcp_is_wnd_shrnk) &&
4141 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4142 uint32_t data_acked_ahead_snxt;
4143
4144 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4145 tcp_update_xmit_tail(tcp, seg_ack);
4146 tcp->tcp_unsent -= data_acked_ahead_snxt;
4147 } else {
4148 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4149 /* drop the received segment */
4150 freemsg(mp);
4151
4152 /*
4153 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4154 * greater than 0, check if the number of such
4155 * bogus ACks is greater than that count. If yes,
4156 * don't send back any ACK. This prevents TCP from
4157 * getting into an ACK storm if somehow an attacker
4158 * successfully spoofs an acceptable segment to our
4159 * peer. If this continues (count > 2 X threshold),
4160 * we should abort this connection.
4161 */
4162 if (tcp_drop_ack_unsent_cnt > 0 &&
4163 ++tcp->tcp_in_ack_unsent >
4164 tcp_drop_ack_unsent_cnt) {
4165 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4166 if (tcp->tcp_in_ack_unsent > 2 *
4167 tcp_drop_ack_unsent_cnt) {
4168 (void) tcp_clean_death(tcp, EPROTO);
4169 }
4170 return;
4171 }
4172 mp = tcp_ack_mp(tcp);
4173 if (mp != NULL) {
4174 BUMP_LOCAL(tcp->tcp_obsegs);
4175 TCPS_BUMP_MIB(tcps, tcpOutAck);
4176 tcp_send_data(tcp, mp);
4177 }
4178 return;
4179 }
4180 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4181 tcp->tcp_snxt_shrunk)) {
4182 tcp->tcp_is_wnd_shrnk = B_FALSE;
4183 }
4184
4185 /*
4186 * TCP gets a new ACK, update the notsack'ed list to delete those
4187 * blocks that are covered by this ACK.
4188 */
4189 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4190 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4191 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4192 }
4193
4194 /*
4195 * If we got an ACK after fast retransmit, check to see
4196 * if it is a partial ACK. If it is not and the congestion
4197 * window was inflated to account for the other side's
4198 * cached packets, retract it. If it is, do Hoe's algorithm.
4199 */
4200 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4201 ASSERT(tcp->tcp_rexmit == B_FALSE);
4202 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4203 tcp->tcp_dupack_cnt = 0;
4204 /*
4205 * Restore the orig tcp_cwnd_ssthresh after
4206 * fast retransmit phase.
4207 */
4208 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4209 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4210 }
4211 tcp->tcp_rexmit_max = seg_ack;
4212 tcp->tcp_cwnd_cnt = 0;
4213 tcp->tcp_snd_burst = tcp->tcp_localnet ?
4214 TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4215
4216 /*
4217 * Remove all notsack info to avoid confusion with
4218 * the next fast retrasnmit/recovery phase.
4219 */
4220 if (tcp->tcp_snd_sack_ok) {
4221 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4222 tcp);
4223 }
4224 } else {
4225 if (tcp->tcp_snd_sack_ok &&
4226 tcp->tcp_notsack_list != NULL) {
4227 flags |= TH_NEED_SACK_REXMIT;
4228 tcp->tcp_pipe -= mss;
4229 if (tcp->tcp_pipe < 0)
4230 tcp->tcp_pipe = 0;
4231 } else {
4232 /*
4233 * Hoe's algorithm:
4234 *
4235 * Retransmit the unack'ed segment and
4236 * restart fast recovery. Note that we
4237 * need to scale back tcp_cwnd to the
4238 * original value when we started fast
4239 * recovery. This is to prevent overly
4240 * aggressive behaviour in sending new
4241 * segments.
4242 */
4243 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4244 tcps->tcps_dupack_fast_retransmit * mss;
4245 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4246 flags |= TH_REXMIT_NEEDED;
4247 }
4248 }
4249 } else {
4250 tcp->tcp_dupack_cnt = 0;
4251 if (tcp->tcp_rexmit) {
4252 /*
4253 * TCP is retranmitting. If the ACK ack's all
4254 * outstanding data, update tcp_rexmit_max and
4255 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4256 * to the correct value.
4257 *
4258 * Note that SEQ_LEQ() is used. This is to avoid
4259 * unnecessary fast retransmit caused by dup ACKs
4260 * received when TCP does slow start retransmission
4261 * after a time out. During this phase, TCP may
4262 * send out segments which are already received.
4263 * This causes dup ACKs to be sent back.
4264 */
4265 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4266 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4267 tcp->tcp_rexmit_nxt = seg_ack;
4268 }
4269 if (seg_ack != tcp->tcp_rexmit_max) {
4270 flags |= TH_XMIT_NEEDED;
4271 }
4272 } else {
4273 tcp->tcp_rexmit = B_FALSE;
4274 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4275 tcp->tcp_snd_burst = tcp->tcp_localnet ?
4276 TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4277 }
4278 tcp->tcp_ms_we_have_waited = 0;
4279 }
4280 }
4281
4282 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4283 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4284 tcp->tcp_suna = seg_ack;
4285 if (tcp->tcp_zero_win_probe != 0) {
4286 tcp->tcp_zero_win_probe = 0;
4287 tcp->tcp_timer_backoff = 0;
4288 }
4289
4290 /*
4291 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4292 * Note that it cannot be the SYN being ack'ed. The code flow
4293 * will not reach here.
4294 */
4295 if (mp1 == NULL) {
4296 goto fin_acked;
4297 }
4298
4299 /*
4300 * Update the congestion window.
4301 *
4302 * If TCP is not ECN capable or TCP is ECN capable but the
4303 * congestion experience bit is not set, increase the tcp_cwnd as
4304 * usual.
4305 */
4306 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4307 cwnd = tcp->tcp_cwnd;
4308 add = mss;
4309
4310 if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4311 /*
4312 * This is to prevent an increase of less than 1 MSS of
4313 * tcp_cwnd. With partial increase, tcp_wput_data()
4314 * may send out tinygrams in order to preserve mblk
4315 * boundaries.
4316 *
4317 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4318 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4319 * increased by 1 MSS for every RTTs.
4320 */
4321 if (tcp->tcp_cwnd_cnt <= 0) {
4322 tcp->tcp_cwnd_cnt = cwnd + add;
4323 } else {
4324 tcp->tcp_cwnd_cnt -= add;
4325 add = 0;
4326 }
4327 }
4328 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4329 }
4330
4331 /* See if the latest urgent data has been acknowledged */
4332 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4333 SEQ_GT(seg_ack, tcp->tcp_urg))
4334 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4335
4336 /* Can we update the RTT estimates? */
4337 if (tcp->tcp_snd_ts_ok) {
4338 /* Ignore zero timestamp echo-reply. */
4339 if (tcpopt.tcp_opt_ts_ecr != 0) {
4340 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4341 (int32_t)tcpopt.tcp_opt_ts_ecr);
4342 }
4343
4344 /* If needed, restart the timer. */
4345 if (tcp->tcp_set_timer == 1) {
4346 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4347 tcp->tcp_set_timer = 0;
4348 }
4349 /*
4350 * Update tcp_csuna in case the other side stops sending
4351 * us timestamps.
4352 */
4353 tcp->tcp_csuna = tcp->tcp_snxt;
4354 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4355 /*
4356 * An ACK sequence we haven't seen before, so get the RTT
4357 * and update the RTO. But first check if the timestamp is
4358 * valid to use.
4359 */
4360 if ((mp1->b_next != NULL) &&
4361 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4362 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4363 (int32_t)(intptr_t)mp1->b_prev);
4364 else
4365 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4366
4367 /* Remeber the last sequence to be ACKed */
4368 tcp->tcp_csuna = seg_ack;
4369 if (tcp->tcp_set_timer == 1) {
4370 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4371 tcp->tcp_set_timer = 0;
4372 }
4373 } else {
4374 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4375 }
4376
4377 /* Eat acknowledged bytes off the xmit queue. */
4378 for (;;) {
4379 mblk_t *mp2;
4380 uchar_t *wptr;
4381
4382 wptr = mp1->b_wptr;
4383 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4384 bytes_acked -= (int)(wptr - mp1->b_rptr);
4385 if (bytes_acked < 0) {
4386 mp1->b_rptr = wptr + bytes_acked;
4387 /*
4388 * Set a new timestamp if all the bytes timed by the
4389 * old timestamp have been ack'ed.
4390 */
4391 if (SEQ_GT(seg_ack,
4392 (uint32_t)(uintptr_t)(mp1->b_next))) {
4393 mp1->b_prev =
4394 (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4395 mp1->b_next = NULL;
4396 }
4397 break;
4398 }
4399 mp1->b_next = NULL;
4400 mp1->b_prev = NULL;
4401 mp2 = mp1;
4402 mp1 = mp1->b_cont;
4403
4404 /*
4405 * This notification is required for some zero-copy
4406 * clients to maintain a copy semantic. After the data
4407 * is ack'ed, client is safe to modify or reuse the buffer.
4408 */
4409 if (tcp->tcp_snd_zcopy_aware &&
4410 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4411 tcp_zcopy_notify(tcp);
4412 freeb(mp2);
4413 if (bytes_acked == 0) {
4414 if (mp1 == NULL) {
4415 /* Everything is ack'ed, clear the tail. */
4416 tcp->tcp_xmit_tail = NULL;
4417 /*
4418 * Cancel the timer unless we are still
4419 * waiting for an ACK for the FIN packet.
4420 */
4421 if (tcp->tcp_timer_tid != 0 &&
4422 tcp->tcp_snxt == tcp->tcp_suna) {
4423 (void) TCP_TIMER_CANCEL(tcp,
4424 tcp->tcp_timer_tid);
4425 tcp->tcp_timer_tid = 0;
4426 }
4427 goto pre_swnd_update;
4428 }
4429 if (mp2 != tcp->tcp_xmit_tail)
4430 break;
4431 tcp->tcp_xmit_tail = mp1;
4432 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4433 (uintptr_t)INT_MAX);
4434 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4435 mp1->b_rptr);
4436 break;
4437 }
4438 if (mp1 == NULL) {
4439 /*
4440 * More was acked but there is nothing more
4441 * outstanding. This means that the FIN was
4442 * just acked or that we're talking to a clown.
4443 */
4444 fin_acked:
4445 ASSERT(tcp->tcp_fin_sent);
4446 tcp->tcp_xmit_tail = NULL;
4447 if (tcp->tcp_fin_sent) {
4448 /* FIN was acked - making progress */
4449 if (!tcp->tcp_fin_acked)
4450 tcp->tcp_ip_forward_progress = B_TRUE;
4451 tcp->tcp_fin_acked = B_TRUE;
4452 if (tcp->tcp_linger_tid != 0 &&
4453 TCP_TIMER_CANCEL(tcp,
4454 tcp->tcp_linger_tid) >= 0) {
4455 tcp_stop_lingering(tcp);
4456 freemsg(mp);
4457 mp = NULL;
4458 }
4459 } else {
4460 /*
4461 * We should never get here because
4462 * we have already checked that the
4463 * number of bytes ack'ed should be
4464 * smaller than or equal to what we
4465 * have sent so far (it is the
4466 * acceptability check of the ACK).
4467 * We can only get here if the send
4468 * queue is corrupted.
4469 *
4470 * Terminate the connection and
4471 * panic the system. It is better
4472 * for us to panic instead of
4473 * continuing to avoid other disaster.
4474 */
4475 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4476 tcp->tcp_rnxt, TH_RST|TH_ACK);
4477 panic("Memory corruption "
4478 "detected for connection %s.",
4479 tcp_display(tcp, NULL,
4480 DISP_ADDR_AND_PORT));
4481 /*NOTREACHED*/
4482 }
4483 goto pre_swnd_update;
4484 }
4485 ASSERT(mp2 != tcp->tcp_xmit_tail);
4486 }
4487 if (tcp->tcp_unsent) {
4488 flags |= TH_XMIT_NEEDED;
4489 }
4490 pre_swnd_update:
4491 tcp->tcp_xmit_head = mp1;
4492 swnd_update:
4493 /*
4494 * The following check is different from most other implementations.
4495 * For bi-directional transfer, when segments are dropped, the
4496 * "normal" check will not accept a window update in those
4497 * retransmitted segemnts. Failing to do that, TCP may send out
4498 * segments which are outside receiver's window. As TCP accepts
4499 * the ack in those retransmitted segments, if the window update in
4500 * the same segment is not accepted, TCP will incorrectly calculates
4501 * that it can send more segments. This can create a deadlock
4502 * with the receiver if its window becomes zero.
4503 */
4504 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4505 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4506 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4507 /*
4508 * The criteria for update is:
4509 *
4510 * 1. the segment acknowledges some data. Or
4511 * 2. the segment is new, i.e. it has a higher seq num. Or
4512 * 3. the segment is not old and the advertised window is
4513 * larger than the previous advertised window.
4514 */
4515 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4516 flags |= TH_XMIT_NEEDED;
4517 tcp->tcp_swnd = new_swnd;
4518 if (new_swnd > tcp->tcp_max_swnd)
4519 tcp->tcp_max_swnd = new_swnd;
4520 tcp->tcp_swl1 = seg_seq;
4521 tcp->tcp_swl2 = seg_ack;
4522 }
4523 est:
4524 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4525
4526 switch (tcp->tcp_state) {
4527 case TCPS_FIN_WAIT_1:
4528 if (tcp->tcp_fin_acked) {
4529 tcp->tcp_state = TCPS_FIN_WAIT_2;
4530 DTRACE_TCP6(state__change, void, NULL,
4531 ip_xmit_attr_t *, connp->conn_ixa,
4532 void, NULL, tcp_t *, tcp, void, NULL,
4533 int32_t, TCPS_FIN_WAIT_1);
4534 /*
4535 * We implement the non-standard BSD/SunOS
4536 * FIN_WAIT_2 flushing algorithm.
4537 * If there is no user attached to this
4538 * TCP endpoint, then this TCP struct
4539 * could hang around forever in FIN_WAIT_2
4540 * state if the peer forgets to send us
4541 * a FIN. To prevent this, we wait only
4542 * 2*MSL (a convenient time value) for
4543 * the FIN to arrive. If it doesn't show up,
4544 * we flush the TCP endpoint. This algorithm,
4545 * though a violation of RFC-793, has worked
4546 * for over 10 years in BSD systems.
4547 * Note: SunOS 4.x waits 675 seconds before
4548 * flushing the FIN_WAIT_2 connection.
4549 */
4550 TCP_TIMER_RESTART(tcp,
4551 tcp->tcp_fin_wait_2_flush_interval);
4552 }
4553 break;
4554 case TCPS_FIN_WAIT_2:
4555 break; /* Shutdown hook? */
4556 case TCPS_LAST_ACK:
4557 freemsg(mp);
4558 if (tcp->tcp_fin_acked) {
4559 (void) tcp_clean_death(tcp, 0);
4560 return;
4561 }
4562 goto xmit_check;
4563 case TCPS_CLOSING:
4564 if (tcp->tcp_fin_acked) {
4565 SET_TIME_WAIT(tcps, tcp, connp);
4566 DTRACE_TCP6(state__change, void, NULL,
4567 ip_xmit_attr_t *, connp->conn_ixa, void,
4568 NULL, tcp_t *, tcp, void, NULL, int32_t,
4569 TCPS_CLOSING);
4570 }
4571 /*FALLTHRU*/
4572 case TCPS_CLOSE_WAIT:
4573 freemsg(mp);
4574 goto xmit_check;
4575 default:
4576 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4577 break;
4578 }
4579 }
4580 if (flags & TH_FIN) {
4581 /* Make sure we ack the fin */
4582 flags |= TH_ACK_NEEDED;
4583 if (!tcp->tcp_fin_rcvd) {
4584 tcp->tcp_fin_rcvd = B_TRUE;
4585 tcp->tcp_rnxt++;
4586 tcpha = tcp->tcp_tcpha;
4587 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4588
4589 /*
4590 * Generate the ordrel_ind at the end unless the
4591 * conn is detached or it is a STREAMS based eager.
4592 * In the eager case we defer the notification until
4593 * tcp_accept_finish has run.
4594 */
4595 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4596 (tcp->tcp_listener == NULL &&
4597 !tcp->tcp_hard_binding)))
4598 flags |= TH_ORDREL_NEEDED;
4599 switch (tcp->tcp_state) {
4600 case TCPS_SYN_RCVD:
4601 tcp->tcp_state = TCPS_CLOSE_WAIT;
4602 DTRACE_TCP6(state__change, void, NULL,
4603 ip_xmit_attr_t *, connp->conn_ixa,
4604 void, NULL, tcp_t *, tcp, void, NULL,
4605 int32_t, TCPS_SYN_RCVD);
4606 /* Keepalive? */
4607 break;
4608 case TCPS_ESTABLISHED:
4609 tcp->tcp_state = TCPS_CLOSE_WAIT;
4610 DTRACE_TCP6(state__change, void, NULL,
4611 ip_xmit_attr_t *, connp->conn_ixa,
4612 void, NULL, tcp_t *, tcp, void, NULL,
4613 int32_t, TCPS_ESTABLISHED);
4614 /* Keepalive? */
4615 break;
4616 case TCPS_FIN_WAIT_1:
4617 if (!tcp->tcp_fin_acked) {
4618 tcp->tcp_state = TCPS_CLOSING;
4619 DTRACE_TCP6(state__change, void, NULL,
4620 ip_xmit_attr_t *, connp->conn_ixa,
4621 void, NULL, tcp_t *, tcp, void,
4622 NULL, int32_t, TCPS_FIN_WAIT_1);
4623 break;
4624 }
4625 /* FALLTHRU */
4626 case TCPS_FIN_WAIT_2:
4627 SET_TIME_WAIT(tcps, tcp, connp);
4628 DTRACE_TCP6(state__change, void, NULL,
4629 ip_xmit_attr_t *, connp->conn_ixa, void,
4630 NULL, tcp_t *, tcp, void, NULL, int32_t,
4631 TCPS_FIN_WAIT_2);
4632 if (seg_len) {
4633 /*
4634 * implies data piggybacked on FIN.
4635 * break to handle data.
4636 */
4637 break;
4638 }
4639 freemsg(mp);
4640 goto ack_check;
4641 }
4642 }
4643 }
4644 if (mp == NULL)
4645 goto xmit_check;
4646 if (seg_len == 0) {
4647 freemsg(mp);
4648 goto xmit_check;
4649 }
4650 if (mp->b_rptr == mp->b_wptr) {
4651 /*
4652 * The header has been consumed, so we remove the
4653 * zero-length mblk here.
4654 */
4655 mp1 = mp;
4656 mp = mp->b_cont;
4657 freeb(mp1);
4658 }
4659 update_ack:
4660 tcpha = tcp->tcp_tcpha;
4661 tcp->tcp_rack_cnt++;
4662 {
4663 uint32_t cur_max;
4664
4665 cur_max = tcp->tcp_rack_cur_max;
4666 if (tcp->tcp_rack_cnt >= cur_max) {
4667 /*
4668 * We have more unacked data than we should - send
4669 * an ACK now.
4670 */
4671 flags |= TH_ACK_NEEDED;
4672 cur_max++;
4673 if (cur_max > tcp->tcp_rack_abs_max)
4674 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4675 else
4676 tcp->tcp_rack_cur_max = cur_max;
4677 } else if (TCP_IS_DETACHED(tcp)) {
4678 /* We don't have an ACK timer for detached TCP. */
4679 flags |= TH_ACK_NEEDED;
4680 } else if (seg_len < mss) {
4681 /*
4682 * If we get a segment that is less than an mss, and we
4683 * already have unacknowledged data, and the amount
4684 * unacknowledged is not a multiple of mss, then we
4685 * better generate an ACK now. Otherwise, this may be
4686 * the tail piece of a transaction, and we would rather
4687 * wait for the response.
4688 */
4689 uint32_t udif;
4690 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4691 (uintptr_t)INT_MAX);
4692 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4693 if (udif && (udif % mss))
4694 flags |= TH_ACK_NEEDED;
4695 else
4696 flags |= TH_ACK_TIMER_NEEDED;
4697 } else {
4698 /* Start delayed ack timer */
4699 flags |= TH_ACK_TIMER_NEEDED;
4700 }
4701 }
4702 tcp->tcp_rnxt += seg_len;
4703 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4704
4705 if (mp == NULL)
4706 goto xmit_check;
4707
4708 /* Update SACK list */
4709 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4710 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4711 &(tcp->tcp_num_sack_blk));
4712 }
4713
4714 if (tcp->tcp_urp_mp) {
4715 tcp->tcp_urp_mp->b_cont = mp;
4716 mp = tcp->tcp_urp_mp;
4717 tcp->tcp_urp_mp = NULL;
4718 /* Ready for a new signal. */
4719 tcp->tcp_urp_last_valid = B_FALSE;
4720 #ifdef DEBUG
4721 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4722 "tcp_rput: sending exdata_ind %s",
4723 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4724 #endif /* DEBUG */
4725 }
4726
4727 /*
4728 * Check for ancillary data changes compared to last segment.
4729 */
4730 if (connp->conn_recv_ancillary.crb_all != 0) {
4731 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4732 if (mp == NULL)
4733 return;
4734 }
4735
4736 if (IPCL_IS_NONSTR(connp)) {
4737 /*
4738 * Non-STREAMS socket
4739 */
4740 boolean_t push = flags & (TH_PUSH|TH_FIN);
4741 int error;
4742
4743 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4744 mp, seg_len, 0, &error, &push) <= 0) {
4745 /*
4746 * We should never be in middle of a
4747 * fallback, the squeue guarantees that.
4748 */
4749 ASSERT(error != EOPNOTSUPP);
4750 if (error == ENOSPC)
4751 tcp->tcp_rwnd -= seg_len;
4752 } else if (push) {
4753 /* PUSH bit set and sockfs is not flow controlled */
4754 flags |= tcp_rwnd_reopen(tcp);
4755 }
4756 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4757 /*
4758 * Side queue inbound data until the accept happens.
4759 * tcp_accept/tcp_rput drains this when the accept happens.
4760 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4761 * T_EXDATA_IND) it is queued on b_next.
4762 * XXX Make urgent data use this. Requires:
4763 * Removing tcp_listener check for TH_URG
4764 * Making M_PCPROTO and MARK messages skip the eager case
4765 */
4766
4767 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4768 } else {
4769 /* Active STREAMS socket */
4770 if (mp->b_datap->db_type != M_DATA ||
4771 (flags & TH_MARKNEXT_NEEDED)) {
4772 if (tcp->tcp_rcv_list != NULL) {
4773 flags |= tcp_rcv_drain(tcp);
4774 }
4775 ASSERT(tcp->tcp_rcv_list == NULL ||
4776 tcp->tcp_fused_sigurg);
4777
4778 if (flags & TH_MARKNEXT_NEEDED) {
4779 #ifdef DEBUG
4780 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4781 "tcp_rput: sending MSGMARKNEXT %s",
4782 tcp_display(tcp, NULL,
4783 DISP_PORT_ONLY));
4784 #endif /* DEBUG */
4785 mp->b_flag |= MSGMARKNEXT;
4786 flags &= ~TH_MARKNEXT_NEEDED;
4787 }
4788
4789 if (is_system_labeled())
4790 tcp_setcred_data(mp, ira);
4791
4792 putnext(connp->conn_rq, mp);
4793 if (!canputnext(connp->conn_rq))
4794 tcp->tcp_rwnd -= seg_len;
4795 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4796 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4797 if (tcp->tcp_rcv_list != NULL) {
4798 /*
4799 * Enqueue the new segment first and then
4800 * call tcp_rcv_drain() to send all data
4801 * up. The other way to do this is to
4802 * send all queued data up and then call
4803 * putnext() to send the new segment up.
4804 * This way can remove the else part later
4805 * on.
4806 *
4807 * We don't do this to avoid one more call to
4808 * canputnext() as tcp_rcv_drain() needs to
4809 * call canputnext().
4810 */
4811 tcp_rcv_enqueue(tcp, mp, seg_len,
4812 ira->ira_cred);
4813 flags |= tcp_rcv_drain(tcp);
4814 } else {
4815 if (is_system_labeled())
4816 tcp_setcred_data(mp, ira);
4817
4818 putnext(connp->conn_rq, mp);
4819 if (!canputnext(connp->conn_rq))
4820 tcp->tcp_rwnd -= seg_len;
4821 }
4822 } else {
4823 /*
4824 * Enqueue all packets when processing an mblk
4825 * from the co queue and also enqueue normal packets.
4826 */
4827 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4828 }
4829 /*
4830 * Make sure the timer is running if we have data waiting
4831 * for a push bit. This provides resiliency against
4832 * implementations that do not correctly generate push bits.
4833 */
4834 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4835 /*
4836 * The connection may be closed at this point, so don't
4837 * do anything for a detached tcp.
4838 */
4839 if (!TCP_IS_DETACHED(tcp))
4840 tcp->tcp_push_tid = TCP_TIMER(tcp,
4841 tcp_push_timer,
4842 tcps->tcps_push_timer_interval);
4843 }
4844 }
4845
4846 xmit_check:
4847 /* Is there anything left to do? */
4848 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4849 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4850 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4851 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4852 goto done;
4853
4854 /* Any transmit work to do and a non-zero window? */
4855 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4856 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4857 if (flags & TH_REXMIT_NEEDED) {
4858 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4859
4860 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4861 if (snd_size > mss)
4862 snd_size = mss;
4863 if (snd_size > tcp->tcp_swnd)
4864 snd_size = tcp->tcp_swnd;
4865 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4866 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4867 B_TRUE);
4868
4869 if (mp1 != NULL) {
4870 tcp->tcp_xmit_head->b_prev =
4871 (mblk_t *)LBOLT_FASTPATH;
4872 tcp->tcp_csuna = tcp->tcp_snxt;
4873 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4874 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4875 snd_size);
4876 tcp_send_data(tcp, mp1);
4877 }
4878 }
4879 if (flags & TH_NEED_SACK_REXMIT) {
4880 tcp_sack_rexmit(tcp, &flags);
4881 }
4882 /*
4883 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4884 * out new segment. Note that tcp_rexmit should not be
4885 * set, otherwise TH_LIMIT_XMIT should not be set.
4886 */
4887 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4888 if (!tcp->tcp_rexmit) {
4889 tcp_wput_data(tcp, NULL, B_FALSE);
4890 } else {
4891 tcp_ss_rexmit(tcp);
4892 }
4893 }
4894 /*
4895 * Adjust tcp_cwnd back to normal value after sending
4896 * new data segments.
4897 */
4898 if (flags & TH_LIMIT_XMIT) {
4899 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4900 /*
4901 * This will restart the timer. Restarting the
4902 * timer is used to avoid a timeout before the
4903 * limited transmitted segment's ACK gets back.
4904 */
4905 if (tcp->tcp_xmit_head != NULL)
4906 tcp->tcp_xmit_head->b_prev =
4907 (mblk_t *)LBOLT_FASTPATH;
4908 }
4909
4910 /* Anything more to do? */
4911 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4912 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4913 goto done;
4914 }
4915 ack_check:
4916 if (flags & TH_SEND_URP_MARK) {
4917 ASSERT(tcp->tcp_urp_mark_mp);
4918 ASSERT(!IPCL_IS_NONSTR(connp));
4919 /*
4920 * Send up any queued data and then send the mark message
4921 */
4922 if (tcp->tcp_rcv_list != NULL) {
4923 flags |= tcp_rcv_drain(tcp);
4924
4925 }
4926 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4927 mp1 = tcp->tcp_urp_mark_mp;
4928 tcp->tcp_urp_mark_mp = NULL;
4929 if (is_system_labeled())
4930 tcp_setcred_data(mp1, ira);
4931
4932 putnext(connp->conn_rq, mp1);
4933 #ifdef DEBUG
4934 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4935 "tcp_rput: sending zero-length %s %s",
4936 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4937 "MSGNOTMARKNEXT"),
4938 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4939 #endif /* DEBUG */
4940 flags &= ~TH_SEND_URP_MARK;
4941 }
4942 if (flags & TH_ACK_NEEDED) {
4943 /*
4944 * Time to send an ack for some reason.
4945 */
4946 mp1 = tcp_ack_mp(tcp);
4947
4948 if (mp1 != NULL) {
4949 tcp_send_data(tcp, mp1);
4950 BUMP_LOCAL(tcp->tcp_obsegs);
4951 TCPS_BUMP_MIB(tcps, tcpOutAck);
4952 }
4953 if (tcp->tcp_ack_tid != 0) {
4954 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4955 tcp->tcp_ack_tid = 0;
4956 }
4957 }
4958 if (flags & TH_ACK_TIMER_NEEDED) {
4959 /*
4960 * Arrange for deferred ACK or push wait timeout.
4961 * Start timer if it is not already running.
4962 */
4963 if (tcp->tcp_ack_tid == 0) {
4964 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4965 tcp->tcp_localnet ?
4966 tcps->tcps_local_dack_interval :
4967 tcps->tcps_deferred_ack_interval);
4968 }
4969 }
4970 if (flags & TH_ORDREL_NEEDED) {
4971 /*
4972 * Notify upper layer about an orderly release. If this is
4973 * a non-STREAMS socket, then just make an upcall. For STREAMS
4974 * we send up an ordrel_ind, unless this is an eager, in which
4975 * case the ordrel will be sent when tcp_accept_finish runs.
4976 * Note that for non-STREAMS we make an upcall even if it is an
4977 * eager, because we have an upper handle to send it to.
4978 */
4979 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4980 ASSERT(!tcp->tcp_detached);
4981
4982 if (IPCL_IS_NONSTR(connp)) {
4983 ASSERT(tcp->tcp_ordrel_mp == NULL);
4984 tcp->tcp_ordrel_done = B_TRUE;
4985 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4986 SOCK_OPCTL_SHUT_RECV, 0);
4987 goto done;
4988 }
4989
4990 if (tcp->tcp_rcv_list != NULL) {
4991 /*
4992 * Push any mblk(s) enqueued from co processing.
4993 */
4994 flags |= tcp_rcv_drain(tcp);
4995 }
4996 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4997
4998 mp1 = tcp->tcp_ordrel_mp;
4999 tcp->tcp_ordrel_mp = NULL;
5000 tcp->tcp_ordrel_done = B_TRUE;
5001 putnext(connp->conn_rq, mp1);
5002 }
5003 done:
5004 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5005 }
5006
5007 /*
5008 * Attach ancillary data to a received TCP segments for the
5009 * ancillary pieces requested by the application that are
5010 * different than they were in the previous data segment.
5011 *
5012 * Save the "current" values once memory allocation is ok so that
5013 * when memory allocation fails we can just wait for the next data segment.
5014 */
5015 static mblk_t *
5016 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5017 ip_recv_attr_t *ira)
5018 {
5019 struct T_optdata_ind *todi;
5020 int optlen;
5021 uchar_t *optptr;
5022 struct T_opthdr *toh;
5023 crb_t addflag; /* Which pieces to add */
5024 mblk_t *mp1;
5025 conn_t *connp = tcp->tcp_connp;
5026
5027 optlen = 0;
5028 addflag.crb_all = 0;
5029 /* If app asked for pktinfo and the index has changed ... */
5030 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5031 ira->ira_ruifindex != tcp->tcp_recvifindex) {
5032 optlen += sizeof (struct T_opthdr) +
5033 sizeof (struct in6_pktinfo);
5034 addflag.crb_ip_recvpktinfo = 1;
5035 }
5036 /* If app asked for hoplimit and it has changed ... */
5037 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5038 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5039 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5040 addflag.crb_ipv6_recvhoplimit = 1;
5041 }
5042 /* If app asked for tclass and it has changed ... */
5043 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5044 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5045 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5046 addflag.crb_ipv6_recvtclass = 1;
5047 }
5048 /*
5049 * If app asked for hopbyhop headers and it has changed ...
5050 * For security labels, note that (1) security labels can't change on
5051 * a connected socket at all, (2) we're connected to at most one peer,
5052 * (3) if anything changes, then it must be some other extra option.
5053 */
5054 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5055 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5056 (ipp->ipp_fields & IPPF_HOPOPTS),
5057 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5058 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5059 addflag.crb_ipv6_recvhopopts = 1;
5060 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5061 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5062 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5063 return (mp);
5064 }
5065 /* If app asked for dst headers before routing headers ... */
5066 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5067 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5068 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5069 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5070 optlen += sizeof (struct T_opthdr) +
5071 ipp->ipp_rthdrdstoptslen;
5072 addflag.crb_ipv6_recvrthdrdstopts = 1;
5073 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5074 &tcp->tcp_rthdrdstoptslen,
5075 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5076 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5077 return (mp);
5078 }
5079 /* If app asked for routing headers and it has changed ... */
5080 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5081 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5082 (ipp->ipp_fields & IPPF_RTHDR),
5083 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5084 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5085 addflag.crb_ipv6_recvrthdr = 1;
5086 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5087 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5088 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5089 return (mp);
5090 }
5091 /* If app asked for dest headers and it has changed ... */
5092 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5093 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5094 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5095 (ipp->ipp_fields & IPPF_DSTOPTS),
5096 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5097 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5098 addflag.crb_ipv6_recvdstopts = 1;
5099 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5100 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5101 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5102 return (mp);
5103 }
5104
5105 if (optlen == 0) {
5106 /* Nothing to add */
5107 return (mp);
5108 }
5109 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5110 if (mp1 == NULL) {
5111 /*
5112 * Defer sending ancillary data until the next TCP segment
5113 * arrives.
5114 */
5115 return (mp);
5116 }
5117 mp1->b_cont = mp;
5118 mp = mp1;
5119 mp->b_wptr += sizeof (*todi) + optlen;
5120 mp->b_datap->db_type = M_PROTO;
5121 todi = (struct T_optdata_ind *)mp->b_rptr;
5122 todi->PRIM_type = T_OPTDATA_IND;
5123 todi->DATA_flag = 1; /* MORE data */
5124 todi->OPT_length = optlen;
5125 todi->OPT_offset = sizeof (*todi);
5126 optptr = (uchar_t *)&todi[1];
5127 /*
5128 * If app asked for pktinfo and the index has changed ...
5129 * Note that the local address never changes for the connection.
5130 */
5131 if (addflag.crb_ip_recvpktinfo) {
5132 struct in6_pktinfo *pkti;
5133 uint_t ifindex;
5134
5135 ifindex = ira->ira_ruifindex;
5136 toh = (struct T_opthdr *)optptr;
5137 toh->level = IPPROTO_IPV6;
5138 toh->name = IPV6_PKTINFO;
5139 toh->len = sizeof (*toh) + sizeof (*pkti);
5140 toh->status = 0;
5141 optptr += sizeof (*toh);
5142 pkti = (struct in6_pktinfo *)optptr;
5143 pkti->ipi6_addr = connp->conn_laddr_v6;
5144 pkti->ipi6_ifindex = ifindex;
5145 optptr += sizeof (*pkti);
5146 ASSERT(OK_32PTR(optptr));
5147 /* Save as "last" value */
5148 tcp->tcp_recvifindex = ifindex;
5149 }
5150 /* If app asked for hoplimit and it has changed ... */
5151 if (addflag.crb_ipv6_recvhoplimit) {
5152 toh = (struct T_opthdr *)optptr;
5153 toh->level = IPPROTO_IPV6;
5154 toh->name = IPV6_HOPLIMIT;
5155 toh->len = sizeof (*toh) + sizeof (uint_t);
5156 toh->status = 0;
5157 optptr += sizeof (*toh);
5158 *(uint_t *)optptr = ipp->ipp_hoplimit;
5159 optptr += sizeof (uint_t);
5160 ASSERT(OK_32PTR(optptr));
5161 /* Save as "last" value */
5162 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5163 }
5164 /* If app asked for tclass and it has changed ... */
5165 if (addflag.crb_ipv6_recvtclass) {
5166 toh = (struct T_opthdr *)optptr;
5167 toh->level = IPPROTO_IPV6;
5168 toh->name = IPV6_TCLASS;
5169 toh->len = sizeof (*toh) + sizeof (uint_t);
5170 toh->status = 0;
5171 optptr += sizeof (*toh);
5172 *(uint_t *)optptr = ipp->ipp_tclass;
5173 optptr += sizeof (uint_t);
5174 ASSERT(OK_32PTR(optptr));
5175 /* Save as "last" value */
5176 tcp->tcp_recvtclass = ipp->ipp_tclass;
5177 }
5178 if (addflag.crb_ipv6_recvhopopts) {
5179 toh = (struct T_opthdr *)optptr;
5180 toh->level = IPPROTO_IPV6;
5181 toh->name = IPV6_HOPOPTS;
5182 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5183 toh->status = 0;
5184 optptr += sizeof (*toh);
5185 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5186 optptr += ipp->ipp_hopoptslen;
5187 ASSERT(OK_32PTR(optptr));
5188 /* Save as last value */
5189 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5190 (ipp->ipp_fields & IPPF_HOPOPTS),
5191 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5192 }
5193 if (addflag.crb_ipv6_recvrthdrdstopts) {
5194 toh = (struct T_opthdr *)optptr;
5195 toh->level = IPPROTO_IPV6;
5196 toh->name = IPV6_RTHDRDSTOPTS;
5197 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5198 toh->status = 0;
5199 optptr += sizeof (*toh);
5200 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5201 optptr += ipp->ipp_rthdrdstoptslen;
5202 ASSERT(OK_32PTR(optptr));
5203 /* Save as last value */
5204 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5205 &tcp->tcp_rthdrdstoptslen,
5206 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5207 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5208 }
5209 if (addflag.crb_ipv6_recvrthdr) {
5210 toh = (struct T_opthdr *)optptr;
5211 toh->level = IPPROTO_IPV6;
5212 toh->name = IPV6_RTHDR;
5213 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5214 toh->status = 0;
5215 optptr += sizeof (*toh);
5216 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5217 optptr += ipp->ipp_rthdrlen;
5218 ASSERT(OK_32PTR(optptr));
5219 /* Save as last value */
5220 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5221 (ipp->ipp_fields & IPPF_RTHDR),
5222 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5223 }
5224 if (addflag.crb_ipv6_recvdstopts) {
5225 toh = (struct T_opthdr *)optptr;
5226 toh->level = IPPROTO_IPV6;
5227 toh->name = IPV6_DSTOPTS;
5228 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5229 toh->status = 0;
5230 optptr += sizeof (*toh);
5231 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5232 optptr += ipp->ipp_dstoptslen;
5233 ASSERT(OK_32PTR(optptr));
5234 /* Save as last value */
5235 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5236 (ipp->ipp_fields & IPPF_DSTOPTS),
5237 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5238 }
5239 ASSERT(optptr == mp->b_wptr);
5240 return (mp);
5241 }
5242
5243 /* The minimum of smoothed mean deviation in RTO calculation. */
5244 #define TCP_SD_MIN 400
5245
5246 /*
5247 * Set RTO for this connection. The formula is from Jacobson and Karels'
5248 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names
5249 * are the same as those in Appendix A.2 of that paper.
5250 *
5251 * m = new measurement
5252 * sa = smoothed RTT average (8 * average estimates).
5253 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5254 */
5255 static void
5256 tcp_set_rto(tcp_t *tcp, clock_t rtt)
5257 {
5258 long m = TICK_TO_MSEC(rtt);
5259 clock_t sa = tcp->tcp_rtt_sa;
5260 clock_t sv = tcp->tcp_rtt_sd;
5261 clock_t rto;
5262 tcp_stack_t *tcps = tcp->tcp_tcps;
5263
5264 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5265 tcp->tcp_rtt_update++;
5266
5267 /* tcp_rtt_sa is not 0 means this is a new sample. */
5268 if (sa != 0) {
5269 /*
5270 * Update average estimator:
5271 * new rtt = 7/8 old rtt + 1/8 Error
5272 */
5273
5274 /* m is now Error in estimate. */
5275 m -= sa >> 3;
5276 if ((sa += m) <= 0) {
5277 /*
5278 * Don't allow the smoothed average to be negative.
5279 * We use 0 to denote reinitialization of the
5280 * variables.
5281 */
5282 sa = 1;
5283 }
5284
5285 /*
5286 * Update deviation estimator:
5287 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5288 */
5289 if (m < 0)
5290 m = -m;
5291 m -= sv >> 2;
5292 sv += m;
5293 } else {
5294 /*
5295 * This follows BSD's implementation. So the reinitialized
5296 * RTO is 3 * m. We cannot go less than 2 because if the
5297 * link is bandwidth dominated, doubling the window size
5298 * during slow start means doubling the RTT. We want to be
5299 * more conservative when we reinitialize our estimates. 3
5300 * is just a convenient number.
5301 */
5302 sa = m << 3;
5303 sv = m << 1;
5304 }
5305 if (sv < TCP_SD_MIN) {
5306 /*
5307 * We do not know that if sa captures the delay ACK
5308 * effect as in a long train of segments, a receiver
5309 * does not delay its ACKs. So set the minimum of sv
5310 * to be TCP_SD_MIN, which is default to 400 ms, twice
5311 * of BSD DATO. That means the minimum of mean
5312 * deviation is 100 ms.
5313 *
5314 */
5315 sv = TCP_SD_MIN;
5316 }
5317 tcp->tcp_rtt_sa = sa;
5318 tcp->tcp_rtt_sd = sv;
5319 /*
5320 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5321 *
5322 * Add tcp_rexmit_interval extra in case of extreme environment
5323 * where the algorithm fails to work. The default value of
5324 * tcp_rexmit_interval_extra should be 0.
5325 *
5326 * As we use a finer grained clock than BSD and update
5327 * RTO for every ACKs, add in another .25 of RTT to the
5328 * deviation of RTO to accomodate burstiness of 1/4 of
5329 * window size.
5330 */
5331 rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5332
5333 TCP_SET_RTO(tcp, rto);
5334
5335 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5336 tcp->tcp_timer_backoff = 0;
5337 }
5338
5339 /*
5340 * On a labeled system we have some protocols above TCP, such as RPC, which
5341 * appear to assume that every mblk in a chain has a db_credp.
5342 */
5343 static void
5344 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5345 {
5346 ASSERT(is_system_labeled());
5347 ASSERT(ira->ira_cred != NULL);
5348
5349 while (mp != NULL) {
5350 mblk_setcred(mp, ira->ira_cred, NOPID);
5351 mp = mp->b_cont;
5352 }
5353 }
5354
5355 uint_t
5356 tcp_rwnd_reopen(tcp_t *tcp)
5357 {
5358 uint_t ret = 0;
5359 uint_t thwin;
5360 conn_t *connp = tcp->tcp_connp;
5361
5362 /* Learn the latest rwnd information that we sent to the other side. */
5363 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5364 << tcp->tcp_rcv_ws;
5365 /* This is peer's calculated send window (our receive window). */
5366 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5367 /*
5368 * Increase the receive window to max. But we need to do receiver
5369 * SWS avoidance. This means that we need to check the increase of
5370 * of receive window is at least 1 MSS.
5371 */
5372 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5373 /*
5374 * If the window that the other side knows is less than max
5375 * deferred acks segments, send an update immediately.
5376 */
5377 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5378 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5379 ret = TH_ACK_NEEDED;
5380 }
5381 tcp->tcp_rwnd = connp->conn_rcvbuf;
5382 }
5383 return (ret);
5384 }
5385
5386 /*
5387 * Handle a packet that has been reclassified by TCP.
5388 * This function drops the ref on connp that the caller had.
5389 */
5390 void
5391 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5392 {
5393 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5394
5395 if (connp->conn_incoming_ifindex != 0 &&
5396 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5397 freemsg(mp);
5398 CONN_DEC_REF(connp);
5399 return;
5400 }
5401
5402 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5403 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5404 ip6_t *ip6h;
5405 ipha_t *ipha;
5406
5407 if (ira->ira_flags & IRAF_IS_IPV4) {
5408 ipha = (ipha_t *)mp->b_rptr;
5409 ip6h = NULL;
5410 } else {
5411 ipha = NULL;
5412 ip6h = (ip6_t *)mp->b_rptr;
5413 }
5414 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5415 if (mp == NULL) {
5416 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5417 /* Note that mp is NULL */
5418 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5419 CONN_DEC_REF(connp);
5420 return;
5421 }
5422 }
5423
5424 if (IPCL_IS_TCP(connp)) {
5425 /*
5426 * do not drain, certain use cases can blow
5427 * the stack
5428 */
5429 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5430 connp->conn_recv, connp, ira,
5431 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5432 } else {
5433 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5434 (connp->conn_recv)(connp, mp, NULL,
5435 ira);
5436 CONN_DEC_REF(connp);
5437 }
5438
5439 }
5440
5441 /* ARGSUSED */
5442 static void
5443 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5444 {
5445 conn_t *connp = (conn_t *)arg;
5446 tcp_t *tcp = connp->conn_tcp;
5447 queue_t *q = connp->conn_rq;
5448
5449 ASSERT(!IPCL_IS_NONSTR(connp));
5450 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5451 tcp->tcp_rsrv_mp = mp;
5452 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5453
5454 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5455 return;
5456 }
5457
5458 if (tcp->tcp_fused) {
5459 tcp_fuse_backenable(tcp);
5460 return;
5461 }
5462
5463 if (canputnext(q)) {
5464 /* Not flow-controlled, open rwnd */
5465 tcp->tcp_rwnd = connp->conn_rcvbuf;
5466
5467 /*
5468 * Send back a window update immediately if TCP is above
5469 * ESTABLISHED state and the increase of the rcv window
5470 * that the other side knows is at least 1 MSS after flow
5471 * control is lifted.
5472 */
5473 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5474 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5475 tcp_xmit_ctl(NULL, tcp,
5476 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5477 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5478 }
5479 }
5480 }
5481
5482 /*
5483 * The read side service routine is called mostly when we get back-enabled as a
5484 * result of flow control relief. Since we don't actually queue anything in
5485 * TCP, we have no data to send out of here. What we do is clear the receive
5486 * window, and send out a window update.
5487 */
5488 void
5489 tcp_rsrv(queue_t *q)
5490 {
5491 conn_t *connp = Q_TO_CONN(q);
5492 tcp_t *tcp = connp->conn_tcp;
5493 mblk_t *mp;
5494
5495 /* No code does a putq on the read side */
5496 ASSERT(q->q_first == NULL);
5497
5498 /*
5499 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5500 * been run. So just return.
5501 */
5502 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5503 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5504 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5505 return;
5506 }
5507 tcp->tcp_rsrv_mp = NULL;
5508 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5509
5510 CONN_INC_REF(connp);
5511 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5512 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5513 }
5514
5515 /* At minimum we need 8 bytes in the TCP header for the lookup */
5516 #define ICMP_MIN_TCP_HDR 8
5517
5518 /*
5519 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5520 * passed up by IP. The message is always received on the correct tcp_t.
5521 * Assumes that IP has pulled up everything up to and including the ICMP header.
5522 */
5523 /* ARGSUSED2 */
5524 void
5525 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5526 {
5527 conn_t *connp = (conn_t *)arg1;
5528 icmph_t *icmph;
5529 ipha_t *ipha;
5530 int iph_hdr_length;
5531 tcpha_t *tcpha;
5532 uint32_t seg_seq;
5533 tcp_t *tcp = connp->conn_tcp;
5534
5535 /* Assume IP provides aligned packets */
5536 ASSERT(OK_32PTR(mp->b_rptr));
5537 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5538
5539 /*
5540 * It's possible we have a closed, but not yet destroyed, TCP
5541 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5542 * in the closed state, so don't take any chances and drop the packet.
5543 */
5544 if (tcp->tcp_state == TCPS_CLOSED) {
5545 freemsg(mp);
5546 return;
5547 }
5548
5549 /*
5550 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5551 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5552 */
5553 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5554 tcp_icmp_error_ipv6(tcp, mp, ira);
5555 return;
5556 }
5557
5558 /* Skip past the outer IP and ICMP headers */
5559 iph_hdr_length = ira->ira_ip_hdr_length;
5560 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5561 /*
5562 * If we don't have the correct outer IP header length
5563 * or if we don't have a complete inner IP header
5564 * drop it.
5565 */
5566 if (iph_hdr_length < sizeof (ipha_t) ||
5567 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5568 noticmpv4:
5569 freemsg(mp);
5570 return;
5571 }
5572 ipha = (ipha_t *)&icmph[1];
5573
5574 /* Skip past the inner IP and find the ULP header */
5575 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5576 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5577 /*
5578 * If we don't have the correct inner IP header length or if the ULP
5579 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5580 * bytes of TCP header, drop it.
5581 */
5582 if (iph_hdr_length < sizeof (ipha_t) ||
5583 ipha->ipha_protocol != IPPROTO_TCP ||
5584 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5585 goto noticmpv4;
5586 }
5587
5588 seg_seq = ntohl(tcpha->tha_seq);
5589 switch (icmph->icmph_type) {
5590 case ICMP_DEST_UNREACHABLE:
5591 switch (icmph->icmph_code) {
5592 case ICMP_FRAGMENTATION_NEEDED:
5593 /*
5594 * Update Path MTU, then try to send something out.
5595 */
5596 tcp_update_pmtu(tcp, B_TRUE);
5597 tcp_rexmit_after_error(tcp);
5598 break;
5599 case ICMP_PORT_UNREACHABLE:
5600 case ICMP_PROTOCOL_UNREACHABLE:
5601 switch (tcp->tcp_state) {
5602 case TCPS_SYN_SENT:
5603 case TCPS_SYN_RCVD:
5604 /*
5605 * ICMP can snipe away incipient
5606 * TCP connections as long as
5607 * seq number is same as initial
5608 * send seq number.
5609 */
5610 if (seg_seq == tcp->tcp_iss) {
5611 (void) tcp_clean_death(tcp,
5612 ECONNREFUSED);
5613 }
5614 break;
5615 }
5616 break;
5617 case ICMP_HOST_UNREACHABLE:
5618 case ICMP_NET_UNREACHABLE:
5619 /* Record the error in case we finally time out. */
5620 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5621 tcp->tcp_client_errno = EHOSTUNREACH;
5622 else
5623 tcp->tcp_client_errno = ENETUNREACH;
5624 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5625 if (tcp->tcp_listener != NULL &&
5626 tcp->tcp_listener->tcp_syn_defense) {
5627 /*
5628 * Ditch the half-open connection if we
5629 * suspect a SYN attack is under way.
5630 */
5631 (void) tcp_clean_death(tcp,
5632 tcp->tcp_client_errno);
5633 }
5634 }
5635 break;
5636 default:
5637 break;
5638 }
5639 break;
5640 case ICMP_SOURCE_QUENCH: {
5641 /*
5642 * use a global boolean to control
5643 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5644 * The default is false.
5645 */
5646 if (tcp_icmp_source_quench) {
5647 /*
5648 * Reduce the sending rate as if we got a
5649 * retransmit timeout
5650 */
5651 uint32_t npkt;
5652
5653 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5654 tcp->tcp_mss;
5655 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5656 tcp->tcp_cwnd = tcp->tcp_mss;
5657 tcp->tcp_cwnd_cnt = 0;
5658 }
5659 break;
5660 }
5661 }
5662 freemsg(mp);
5663 }
5664
5665 /*
5666 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5667 * error messages passed up by IP.
5668 * Assumes that IP has pulled up all the extension headers as well
5669 * as the ICMPv6 header.
5670 */
5671 static void
5672 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5673 {
5674 icmp6_t *icmp6;
5675 ip6_t *ip6h;
5676 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5677 tcpha_t *tcpha;
5678 uint8_t *nexthdrp;
5679 uint32_t seg_seq;
5680
5681 /*
5682 * Verify that we have a complete IP header.
5683 */
5684 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5685
5686 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5687 ip6h = (ip6_t *)&icmp6[1];
5688 /*
5689 * Verify if we have a complete ICMP and inner IP header.
5690 */
5691 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5692 noticmpv6:
5693 freemsg(mp);
5694 return;
5695 }
5696
5697 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5698 goto noticmpv6;
5699 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5700 /*
5701 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5702 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5703 * packet.
5704 */
5705 if ((*nexthdrp != IPPROTO_TCP) ||
5706 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5707 goto noticmpv6;
5708 }
5709
5710 seg_seq = ntohl(tcpha->tha_seq);
5711 switch (icmp6->icmp6_type) {
5712 case ICMP6_PACKET_TOO_BIG:
5713 /*
5714 * Update Path MTU, then try to send something out.
5715 */
5716 tcp_update_pmtu(tcp, B_TRUE);
5717 tcp_rexmit_after_error(tcp);
5718 break;
5719 case ICMP6_DST_UNREACH:
5720 switch (icmp6->icmp6_code) {
5721 case ICMP6_DST_UNREACH_NOPORT:
5722 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5723 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5724 (seg_seq == tcp->tcp_iss)) {
5725 (void) tcp_clean_death(tcp, ECONNREFUSED);
5726 }
5727 break;
5728 case ICMP6_DST_UNREACH_ADMIN:
5729 case ICMP6_DST_UNREACH_NOROUTE:
5730 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5731 case ICMP6_DST_UNREACH_ADDR:
5732 /* Record the error in case we finally time out. */
5733 tcp->tcp_client_errno = EHOSTUNREACH;
5734 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5735 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5736 (seg_seq == tcp->tcp_iss)) {
5737 if (tcp->tcp_listener != NULL &&
5738 tcp->tcp_listener->tcp_syn_defense) {
5739 /*
5740 * Ditch the half-open connection if we
5741 * suspect a SYN attack is under way.
5742 */
5743 (void) tcp_clean_death(tcp,
5744 tcp->tcp_client_errno);
5745 }
5746 }
5747
5748
5749 break;
5750 default:
5751 break;
5752 }
5753 break;
5754 case ICMP6_PARAM_PROB:
5755 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5756 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5757 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5758 (uchar_t *)nexthdrp) {
5759 if (tcp->tcp_state == TCPS_SYN_SENT ||
5760 tcp->tcp_state == TCPS_SYN_RCVD) {
5761 (void) tcp_clean_death(tcp, ECONNREFUSED);
5762 }
5763 break;
5764 }
5765 break;
5766
5767 case ICMP6_TIME_EXCEEDED:
5768 default:
5769 break;
5770 }
5771 freemsg(mp);
5772 }
5773
5774 /*
5775 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5776 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5777 *
5778 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5779 * error messages received by IP. The message is always received on the correct
5780 * tcp_t.
5781 */
5782 /* ARGSUSED */
5783 boolean_t
5784 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5785 ip_recv_attr_t *ira)
5786 {
5787 tcpha_t *tcpha = (tcpha_t *)arg2;
5788 uint32_t seq = ntohl(tcpha->tha_seq);
5789 tcp_t *tcp = connp->conn_tcp;
5790
5791 /*
5792 * TCP sequence number contained in payload of the ICMP error message
5793 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5794 * the message is either a stale ICMP error, or an attack from the
5795 * network. Fail the verification.
5796 */
5797 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5798 return (B_FALSE);
5799
5800 /* For "too big" we also check the ignore flag */
5801 if (ira->ira_flags & IRAF_IS_IPV4) {
5802 ASSERT(icmph != NULL);
5803 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5804 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5805 tcp->tcp_tcps->tcps_ignore_path_mtu)
5806 return (B_FALSE);
5807 } else {
5808 ASSERT(icmp6 != NULL);
5809 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5810 tcp->tcp_tcps->tcps_ignore_path_mtu)
5811 return (B_FALSE);
5812 }
5813 return (B_TRUE);
5814 }