Print this page
5295 remove maxburst logic from TCP's send algorithm Reviewed by: Dan McDonald <danmcd@omniti.com>
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/tcp/tcp_input.c
+++ new/usr/src/uts/common/inet/tcp/tcp_input.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
|
↓ open down ↓ |
15 lines elided |
↑ open up ↑ |
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 25 * Copyright (c) 2011 Joyent, Inc. All rights reserved.
26 + * Copyright (c) 2014 by Delphix. All rights reserved.
26 27 */
27 28
28 29 /* This file contains all TCP input processing functions. */
29 30
30 31 #include <sys/types.h>
31 32 #include <sys/stream.h>
32 33 #include <sys/strsun.h>
33 34 #include <sys/strsubr.h>
34 35 #include <sys/stropts.h>
35 36 #include <sys/strlog.h>
36 37 #define _SUN_TPI_VERSION 2
37 38 #include <sys/tihdr.h>
38 39 #include <sys/suntpi.h>
39 40 #include <sys/xti_inet.h>
40 41 #include <sys/squeue_impl.h>
41 42 #include <sys/squeue.h>
42 43 #include <sys/tsol/tnet.h>
43 44
44 45 #include <inet/common.h>
45 46 #include <inet/ip.h>
46 47 #include <inet/tcp.h>
47 48 #include <inet/tcp_impl.h>
48 49 #include <inet/tcp_cluster.h>
49 50 #include <inet/proto_set.h>
50 51 #include <inet/ipsec_impl.h>
51 52
52 53 /*
53 54 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
54 55 */
55 56
56 57 #ifdef _BIG_ENDIAN
57 58 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
58 59 (TCPOPT_TSTAMP << 8) | 10)
59 60 #else
60 61 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
61 62 (TCPOPT_NOP << 8) | TCPOPT_NOP)
62 63 #endif
63 64
64 65 /*
65 66 * Flags returned from tcp_parse_options.
66 67 */
67 68 #define TCP_OPT_MSS_PRESENT 1
68 69 #define TCP_OPT_WSCALE_PRESENT 2
69 70 #define TCP_OPT_TSTAMP_PRESENT 4
70 71 #define TCP_OPT_SACK_OK_PRESENT 8
71 72 #define TCP_OPT_SACK_PRESENT 16
72 73
73 74 /*
74 75 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
75 76 */
76 77 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
77 78
78 79 /*
79 80 * Since tcp_listener is not cleared atomically with tcp_detached
80 81 * being cleared we need this extra bit to tell a detached connection
81 82 * apart from one that is in the process of being accepted.
82 83 */
83 84 #define TCP_IS_DETACHED_NONEAGER(tcp) \
84 85 (TCP_IS_DETACHED(tcp) && \
85 86 (!(tcp)->tcp_hard_binding))
86 87
87 88 /*
88 89 * Steps to do when a tcp_t moves to TIME-WAIT state.
89 90 *
90 91 * This connection is done, we don't need to account for it. Decrement
91 92 * the listener connection counter if needed.
92 93 *
93 94 * Decrement the connection counter of the stack. Note that this counter
94 95 * is per CPU. So the total number of connections in a stack is the sum of all
95 96 * of them. Since there is no lock for handling all of them exclusively, the
96 97 * resulting sum is only an approximation.
97 98 *
98 99 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
99 100 * connection won't interfere with new ones.
100 101 *
101 102 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
102 103 * the timer is handled within the context of this tcp_t. When the timer
103 104 * fires, tcp_clean_death() is called. If upper layer closes the connection
104 105 * during this period, tcp_time_wait_append() will be called to add this
105 106 * tcp_t to the global TIME-WAIT list. Note that this means that the
106 107 * actual wait time in TIME-WAIT state will be longer than the
107 108 * tcps_time_wait_interval since the period before upper layer closes the
108 109 * connection is not accounted for when tcp_time_wait_append() is called.
109 110 *
110 111 * If uppser layer has closed the connection, call tcp_time_wait_append()
111 112 * directly.
112 113 *
113 114 */
114 115 #define SET_TIME_WAIT(tcps, tcp, connp) \
115 116 { \
116 117 (tcp)->tcp_state = TCPS_TIME_WAIT; \
117 118 if ((tcp)->tcp_listen_cnt != NULL) \
118 119 TCP_DECR_LISTEN_CNT(tcp); \
119 120 atomic_dec_64( \
120 121 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
121 122 (connp)->conn_exclbind = 0; \
122 123 if (!TCP_IS_DETACHED(tcp)) { \
123 124 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
124 125 } else { \
125 126 tcp_time_wait_append(tcp); \
126 127 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
127 128 } \
128 129 }
129 130
130 131 /*
131 132 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
132 133 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
133 134 * data, TCP will not respond with an ACK. RFC 793 requires that
134 135 * TCP responds with an ACK for such a bogus ACK. By not following
135 136 * the RFC, we prevent TCP from getting into an ACK storm if somehow
136 137 * an attacker successfully spoofs an acceptable segment to our
137 138 * peer; or when our peer is "confused."
138 139 */
139 140 static uint32_t tcp_drop_ack_unsent_cnt = 10;
140 141
141 142 /*
142 143 * To protect TCP against attacker using a small window and requesting
143 144 * large amount of data (DoS attack by conuming memory), TCP checks the
144 145 * window advertised in the last ACK of the 3-way handshake. TCP uses
145 146 * the tcp_mss (the size of one packet) value for comparion. The window
146 147 * should be larger than tcp_mss. But while a sane TCP should advertise
147 148 * a receive window larger than or equal to 4*MSS to avoid stop and go
148 149 * tarrfic, not all TCP stacks do that. This is especially true when
149 150 * tcp_mss is a big value.
150 151 *
151 152 * To work around this issue, an additional fixed value for comparison
152 153 * is also used. If the advertised window is smaller than both tcp_mss
153 154 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
154 155 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
155 156 * smaller than 8K is considered to be OK.
156 157 */
157 158 static uint32_t tcp_init_wnd_chk = 4096;
158 159
159 160 /* Process ICMP source quench message or not. */
160 161 static boolean_t tcp_icmp_source_quench = B_FALSE;
161 162
162 163 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
163 164
164 165 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
165 166 ip_recv_attr_t *);
166 167 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
167 168 ip_recv_attr_t *);
168 169 static boolean_t tcp_drop_q0(tcp_t *);
169 170 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
170 171 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
171 172 ip_recv_attr_t *);
172 173 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
173 174 static int tcp_parse_options(tcpha_t *, tcp_opt_t *);
174 175 static void tcp_process_options(tcp_t *, tcpha_t *);
175 176 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
176 177 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
177 178 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
178 179 static void tcp_set_rto(tcp_t *, time_t);
179 180 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
180 181
181 182 /*
182 183 * Set the MSS associated with a particular tcp based on its current value,
183 184 * and a new one passed in. Observe minimums and maximums, and reset other
184 185 * state variables that we want to view as multiples of MSS.
185 186 *
186 187 * The value of MSS could be either increased or descreased.
187 188 */
188 189 void
189 190 tcp_mss_set(tcp_t *tcp, uint32_t mss)
190 191 {
191 192 uint32_t mss_max;
192 193 tcp_stack_t *tcps = tcp->tcp_tcps;
193 194 conn_t *connp = tcp->tcp_connp;
194 195
195 196 if (connp->conn_ipversion == IPV4_VERSION)
196 197 mss_max = tcps->tcps_mss_max_ipv4;
197 198 else
198 199 mss_max = tcps->tcps_mss_max_ipv6;
199 200
200 201 if (mss < tcps->tcps_mss_min)
201 202 mss = tcps->tcps_mss_min;
202 203 if (mss > mss_max)
203 204 mss = mss_max;
204 205 /*
205 206 * Unless naglim has been set by our client to
206 207 * a non-mss value, force naglim to track mss.
207 208 * This can help to aggregate small writes.
208 209 */
209 210 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
210 211 tcp->tcp_naglim = mss;
211 212 /*
212 213 * TCP should be able to buffer at least 4 MSS data for obvious
213 214 * performance reason.
214 215 */
215 216 if ((mss << 2) > connp->conn_sndbuf)
216 217 connp->conn_sndbuf = mss << 2;
217 218
218 219 /*
219 220 * Set the send lowater to at least twice of MSS.
220 221 */
221 222 if ((mss << 1) > connp->conn_sndlowat)
222 223 connp->conn_sndlowat = mss << 1;
223 224
224 225 /*
225 226 * Update tcp_cwnd according to the new value of MSS. Keep the
226 227 * previous ratio to preserve the transmit rate.
227 228 */
228 229 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
229 230 tcp->tcp_cwnd_cnt = 0;
230 231
231 232 tcp->tcp_mss = mss;
232 233 (void) tcp_maxpsz_set(tcp, B_TRUE);
233 234 }
234 235
235 236 /*
236 237 * Extract option values from a tcp header. We put any found values into the
237 238 * tcpopt struct and return a bitmask saying which options were found.
238 239 */
239 240 static int
240 241 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
241 242 {
242 243 uchar_t *endp;
243 244 int len;
244 245 uint32_t mss;
245 246 uchar_t *up = (uchar_t *)tcpha;
246 247 int found = 0;
247 248 int32_t sack_len;
248 249 tcp_seq sack_begin, sack_end;
249 250 tcp_t *tcp;
250 251
251 252 endp = up + TCP_HDR_LENGTH(tcpha);
252 253 up += TCP_MIN_HEADER_LENGTH;
253 254 while (up < endp) {
254 255 len = endp - up;
255 256 switch (*up) {
256 257 case TCPOPT_EOL:
257 258 break;
258 259
259 260 case TCPOPT_NOP:
260 261 up++;
261 262 continue;
262 263
263 264 case TCPOPT_MAXSEG:
264 265 if (len < TCPOPT_MAXSEG_LEN ||
265 266 up[1] != TCPOPT_MAXSEG_LEN)
266 267 break;
267 268
268 269 mss = BE16_TO_U16(up+2);
269 270 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
270 271 tcpopt->tcp_opt_mss = mss;
271 272 found |= TCP_OPT_MSS_PRESENT;
272 273
273 274 up += TCPOPT_MAXSEG_LEN;
274 275 continue;
275 276
276 277 case TCPOPT_WSCALE:
277 278 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
278 279 break;
279 280
280 281 if (up[2] > TCP_MAX_WINSHIFT)
281 282 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
282 283 else
283 284 tcpopt->tcp_opt_wscale = up[2];
284 285 found |= TCP_OPT_WSCALE_PRESENT;
285 286
286 287 up += TCPOPT_WS_LEN;
287 288 continue;
288 289
289 290 case TCPOPT_SACK_PERMITTED:
290 291 if (len < TCPOPT_SACK_OK_LEN ||
291 292 up[1] != TCPOPT_SACK_OK_LEN)
292 293 break;
293 294 found |= TCP_OPT_SACK_OK_PRESENT;
294 295 up += TCPOPT_SACK_OK_LEN;
295 296 continue;
296 297
297 298 case TCPOPT_SACK:
298 299 if (len <= 2 || up[1] <= 2 || len < up[1])
299 300 break;
300 301
301 302 /* If TCP is not interested in SACK blks... */
302 303 if ((tcp = tcpopt->tcp) == NULL) {
303 304 up += up[1];
304 305 continue;
305 306 }
306 307 sack_len = up[1] - TCPOPT_HEADER_LEN;
307 308 up += TCPOPT_HEADER_LEN;
308 309
309 310 /*
310 311 * If the list is empty, allocate one and assume
311 312 * nothing is sack'ed.
312 313 */
313 314 if (tcp->tcp_notsack_list == NULL) {
314 315 tcp_notsack_update(&(tcp->tcp_notsack_list),
315 316 tcp->tcp_suna, tcp->tcp_snxt,
316 317 &(tcp->tcp_num_notsack_blk),
317 318 &(tcp->tcp_cnt_notsack_list));
318 319
319 320 /*
320 321 * Make sure tcp_notsack_list is not NULL.
321 322 * This happens when kmem_alloc(KM_NOSLEEP)
322 323 * returns NULL.
323 324 */
324 325 if (tcp->tcp_notsack_list == NULL) {
325 326 up += sack_len;
326 327 continue;
327 328 }
328 329 tcp->tcp_fack = tcp->tcp_suna;
329 330 }
330 331
331 332 while (sack_len > 0) {
332 333 if (up + 8 > endp) {
333 334 up = endp;
334 335 break;
335 336 }
336 337 sack_begin = BE32_TO_U32(up);
337 338 up += 4;
338 339 sack_end = BE32_TO_U32(up);
339 340 up += 4;
340 341 sack_len -= 8;
341 342 /*
342 343 * Bounds checking. Make sure the SACK
343 344 * info is within tcp_suna and tcp_snxt.
344 345 * If this SACK blk is out of bound, ignore
345 346 * it but continue to parse the following
346 347 * blks.
347 348 */
348 349 if (SEQ_LEQ(sack_end, sack_begin) ||
349 350 SEQ_LT(sack_begin, tcp->tcp_suna) ||
350 351 SEQ_GT(sack_end, tcp->tcp_snxt)) {
351 352 continue;
352 353 }
353 354 tcp_notsack_insert(&(tcp->tcp_notsack_list),
354 355 sack_begin, sack_end,
355 356 &(tcp->tcp_num_notsack_blk),
356 357 &(tcp->tcp_cnt_notsack_list));
357 358 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
358 359 tcp->tcp_fack = sack_end;
359 360 }
360 361 }
361 362 found |= TCP_OPT_SACK_PRESENT;
362 363 continue;
363 364
364 365 case TCPOPT_TSTAMP:
365 366 if (len < TCPOPT_TSTAMP_LEN ||
366 367 up[1] != TCPOPT_TSTAMP_LEN)
367 368 break;
368 369
369 370 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
370 371 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
371 372
372 373 found |= TCP_OPT_TSTAMP_PRESENT;
373 374
374 375 up += TCPOPT_TSTAMP_LEN;
375 376 continue;
376 377
377 378 default:
378 379 if (len <= 1 || len < (int)up[1] || up[1] == 0)
379 380 break;
380 381 up += up[1];
381 382 continue;
382 383 }
383 384 break;
384 385 }
385 386 return (found);
386 387 }
387 388
388 389 /*
389 390 * Process all TCP option in SYN segment. Note that this function should
390 391 * be called after tcp_set_destination() is called so that the necessary info
391 392 * from IRE is already set in the tcp structure.
392 393 *
393 394 * This function sets up the correct tcp_mss value according to the
394 395 * MSS option value and our header size. It also sets up the window scale
395 396 * and timestamp values, and initialize SACK info blocks. But it does not
396 397 * change receive window size after setting the tcp_mss value. The caller
397 398 * should do the appropriate change.
398 399 */
399 400 static void
400 401 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
401 402 {
402 403 int options;
403 404 tcp_opt_t tcpopt;
404 405 uint32_t mss_max;
405 406 char *tmp_tcph;
406 407 tcp_stack_t *tcps = tcp->tcp_tcps;
407 408 conn_t *connp = tcp->tcp_connp;
408 409
409 410 tcpopt.tcp = NULL;
410 411 options = tcp_parse_options(tcpha, &tcpopt);
411 412
412 413 /*
413 414 * Process MSS option. Note that MSS option value does not account
414 415 * for IP or TCP options. This means that it is equal to MTU - minimum
415 416 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
416 417 * IPv6.
417 418 */
418 419 if (!(options & TCP_OPT_MSS_PRESENT)) {
419 420 if (connp->conn_ipversion == IPV4_VERSION)
420 421 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
421 422 else
422 423 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
423 424 } else {
424 425 if (connp->conn_ipversion == IPV4_VERSION)
425 426 mss_max = tcps->tcps_mss_max_ipv4;
426 427 else
427 428 mss_max = tcps->tcps_mss_max_ipv6;
428 429 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
429 430 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
430 431 else if (tcpopt.tcp_opt_mss > mss_max)
431 432 tcpopt.tcp_opt_mss = mss_max;
432 433 }
433 434
434 435 /* Process Window Scale option. */
435 436 if (options & TCP_OPT_WSCALE_PRESENT) {
436 437 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
437 438 tcp->tcp_snd_ws_ok = B_TRUE;
438 439 } else {
439 440 tcp->tcp_snd_ws = B_FALSE;
440 441 tcp->tcp_snd_ws_ok = B_FALSE;
441 442 tcp->tcp_rcv_ws = B_FALSE;
442 443 }
443 444
444 445 /* Process Timestamp option. */
445 446 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
446 447 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
447 448 tmp_tcph = (char *)tcp->tcp_tcpha;
448 449
449 450 tcp->tcp_snd_ts_ok = B_TRUE;
450 451 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
451 452 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
452 453 ASSERT(OK_32PTR(tmp_tcph));
453 454 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
454 455
455 456 /* Fill in our template header with basic timestamp option. */
456 457 tmp_tcph += connp->conn_ht_ulp_len;
457 458 tmp_tcph[0] = TCPOPT_NOP;
458 459 tmp_tcph[1] = TCPOPT_NOP;
459 460 tmp_tcph[2] = TCPOPT_TSTAMP;
460 461 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
461 462 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
462 463 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
463 464 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
464 465 } else {
465 466 tcp->tcp_snd_ts_ok = B_FALSE;
466 467 }
467 468
468 469 /*
469 470 * Process SACK options. If SACK is enabled for this connection,
470 471 * then allocate the SACK info structure. Note the following ways
471 472 * when tcp_snd_sack_ok is set to true.
472 473 *
473 474 * For active connection: in tcp_set_destination() called in
474 475 * tcp_connect().
475 476 *
476 477 * For passive connection: in tcp_set_destination() called in
477 478 * tcp_input_listener().
478 479 *
479 480 * That's the reason why the extra TCP_IS_DETACHED() check is there.
480 481 * That check makes sure that if we did not send a SACK OK option,
481 482 * we will not enable SACK for this connection even though the other
482 483 * side sends us SACK OK option. For active connection, the SACK
483 484 * info structure has already been allocated. So we need to free
484 485 * it if SACK is disabled.
485 486 */
486 487 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
487 488 (tcp->tcp_snd_sack_ok ||
488 489 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
489 490 ASSERT(tcp->tcp_num_sack_blk == 0);
490 491 ASSERT(tcp->tcp_notsack_list == NULL);
491 492
492 493 tcp->tcp_snd_sack_ok = B_TRUE;
493 494 if (tcp->tcp_snd_ts_ok) {
494 495 tcp->tcp_max_sack_blk = 3;
495 496 } else {
496 497 tcp->tcp_max_sack_blk = 4;
497 498 }
498 499 } else if (tcp->tcp_snd_sack_ok) {
499 500 /*
500 501 * Resetting tcp_snd_sack_ok to B_FALSE so that
501 502 * no SACK info will be used for this
502 503 * connection. This assumes that SACK usage
503 504 * permission is negotiated. This may need
504 505 * to be changed once this is clarified.
505 506 */
506 507 ASSERT(tcp->tcp_num_sack_blk == 0);
507 508 ASSERT(tcp->tcp_notsack_list == NULL);
508 509 tcp->tcp_snd_sack_ok = B_FALSE;
509 510 }
510 511
511 512 /*
512 513 * Now we know the exact TCP/IP header length, subtract
513 514 * that from tcp_mss to get our side's MSS.
514 515 */
515 516 tcp->tcp_mss -= connp->conn_ht_iphc_len;
516 517
517 518 /*
518 519 * Here we assume that the other side's header size will be equal to
519 520 * our header size. We calculate the real MSS accordingly. Need to
520 521 * take into additional stuffs IPsec puts in.
521 522 *
522 523 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
523 524 */
524 525 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
525 526 tcp->tcp_ipsec_overhead -
526 527 ((connp->conn_ipversion == IPV4_VERSION ?
527 528 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
528 529
529 530 /*
530 531 * Set MSS to the smaller one of both ends of the connection.
531 532 * We should not have called tcp_mss_set() before, but our
532 533 * side of the MSS should have been set to a proper value
533 534 * by tcp_set_destination(). tcp_mss_set() will also set up the
534 535 * STREAM head parameters properly.
535 536 *
536 537 * If we have a larger-than-16-bit window but the other side
537 538 * didn't want to do window scale, tcp_rwnd_set() will take
538 539 * care of that.
539 540 */
540 541 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
541 542
542 543 /*
543 544 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
544 545 * updated properly.
545 546 */
546 547 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
547 548 }
548 549
549 550 /*
550 551 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
551 552 * is filled, return as much as we can. The message passed in may be
552 553 * multi-part, chained using b_cont. "start" is the starting sequence
553 554 * number for this piece.
554 555 */
555 556 static mblk_t *
556 557 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
557 558 {
558 559 uint32_t end;
559 560 mblk_t *mp1;
560 561 mblk_t *mp2;
561 562 mblk_t *next_mp;
562 563 uint32_t u1;
563 564 tcp_stack_t *tcps = tcp->tcp_tcps;
564 565
565 566
566 567 /* Walk through all the new pieces. */
567 568 do {
568 569 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
569 570 (uintptr_t)INT_MAX);
570 571 end = start + (int)(mp->b_wptr - mp->b_rptr);
571 572 next_mp = mp->b_cont;
572 573 if (start == end) {
573 574 /* Empty. Blast it. */
574 575 freeb(mp);
575 576 continue;
576 577 }
577 578 mp->b_cont = NULL;
578 579 TCP_REASS_SET_SEQ(mp, start);
579 580 TCP_REASS_SET_END(mp, end);
580 581 mp1 = tcp->tcp_reass_tail;
581 582 if (!mp1) {
582 583 tcp->tcp_reass_tail = mp;
583 584 tcp->tcp_reass_head = mp;
584 585 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
585 586 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
586 587 end - start);
587 588 continue;
588 589 }
589 590 /* New stuff completely beyond tail? */
590 591 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
591 592 /* Link it on end. */
592 593 mp1->b_cont = mp;
593 594 tcp->tcp_reass_tail = mp;
594 595 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
595 596 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
596 597 end - start);
597 598 continue;
598 599 }
599 600 mp1 = tcp->tcp_reass_head;
600 601 u1 = TCP_REASS_SEQ(mp1);
601 602 /* New stuff at the front? */
602 603 if (SEQ_LT(start, u1)) {
603 604 /* Yes... Check for overlap. */
604 605 mp->b_cont = mp1;
605 606 tcp->tcp_reass_head = mp;
606 607 tcp_reass_elim_overlap(tcp, mp);
607 608 continue;
608 609 }
609 610 /*
610 611 * The new piece fits somewhere between the head and tail.
611 612 * We find our slot, where mp1 precedes us and mp2 trails.
612 613 */
613 614 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
614 615 u1 = TCP_REASS_SEQ(mp2);
615 616 if (SEQ_LEQ(start, u1))
616 617 break;
617 618 }
618 619 /* Link ourselves in */
619 620 mp->b_cont = mp2;
620 621 mp1->b_cont = mp;
621 622
622 623 /* Trim overlap with following mblk(s) first */
623 624 tcp_reass_elim_overlap(tcp, mp);
624 625
625 626 /* Trim overlap with preceding mblk */
626 627 tcp_reass_elim_overlap(tcp, mp1);
627 628
628 629 } while (start = end, mp = next_mp);
629 630 mp1 = tcp->tcp_reass_head;
630 631 /* Anything ready to go? */
631 632 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
632 633 return (NULL);
633 634 /* Eat what we can off the queue */
634 635 for (;;) {
635 636 mp = mp1->b_cont;
636 637 end = TCP_REASS_END(mp1);
637 638 TCP_REASS_SET_SEQ(mp1, 0);
638 639 TCP_REASS_SET_END(mp1, 0);
639 640 if (!mp) {
640 641 tcp->tcp_reass_tail = NULL;
641 642 break;
642 643 }
643 644 if (end != TCP_REASS_SEQ(mp)) {
644 645 mp1->b_cont = NULL;
645 646 break;
646 647 }
647 648 mp1 = mp;
648 649 }
649 650 mp1 = tcp->tcp_reass_head;
650 651 tcp->tcp_reass_head = mp;
651 652 return (mp1);
652 653 }
653 654
654 655 /* Eliminate any overlap that mp may have over later mblks */
655 656 static void
656 657 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
657 658 {
658 659 uint32_t end;
659 660 mblk_t *mp1;
660 661 uint32_t u1;
661 662 tcp_stack_t *tcps = tcp->tcp_tcps;
662 663
663 664 end = TCP_REASS_END(mp);
664 665 while ((mp1 = mp->b_cont) != NULL) {
665 666 u1 = TCP_REASS_SEQ(mp1);
666 667 if (!SEQ_GT(end, u1))
667 668 break;
668 669 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
669 670 mp->b_wptr -= end - u1;
670 671 TCP_REASS_SET_END(mp, u1);
671 672 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
672 673 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
673 674 end - u1);
674 675 break;
675 676 }
676 677 mp->b_cont = mp1->b_cont;
677 678 TCP_REASS_SET_SEQ(mp1, 0);
678 679 TCP_REASS_SET_END(mp1, 0);
679 680 freeb(mp1);
680 681 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
681 682 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
682 683 }
683 684 if (!mp1)
684 685 tcp->tcp_reass_tail = mp;
685 686 }
686 687
687 688 /*
688 689 * This function does PAWS protection check. Returns B_TRUE if the
689 690 * segment passes the PAWS test, else returns B_FALSE.
690 691 */
691 692 boolean_t
692 693 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp)
693 694 {
694 695 uint8_t flags;
695 696 int options;
696 697 uint8_t *up;
697 698 conn_t *connp = tcp->tcp_connp;
698 699
699 700 flags = (unsigned int)tcpha->tha_flags & 0xFF;
700 701 /*
701 702 * If timestamp option is aligned nicely, get values inline,
702 703 * otherwise call general routine to parse. Only do that
703 704 * if timestamp is the only option.
704 705 */
705 706 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
706 707 TCPOPT_REAL_TS_LEN &&
707 708 OK_32PTR((up = ((uint8_t *)tcpha) +
708 709 TCP_MIN_HEADER_LENGTH)) &&
709 710 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
710 711 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
711 712 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
712 713
713 714 options = TCP_OPT_TSTAMP_PRESENT;
714 715 } else {
715 716 if (tcp->tcp_snd_sack_ok) {
716 717 tcpoptp->tcp = tcp;
717 718 } else {
718 719 tcpoptp->tcp = NULL;
719 720 }
720 721 options = tcp_parse_options(tcpha, tcpoptp);
721 722 }
722 723
723 724 if (options & TCP_OPT_TSTAMP_PRESENT) {
724 725 /*
725 726 * Do PAWS per RFC 1323 section 4.2. Accept RST
726 727 * regardless of the timestamp, page 18 RFC 1323.bis.
727 728 */
728 729 if ((flags & TH_RST) == 0 &&
729 730 TSTMP_LT(tcpoptp->tcp_opt_ts_val,
730 731 tcp->tcp_ts_recent)) {
731 732 if (LBOLT_FASTPATH64 <
732 733 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
733 734 /* This segment is not acceptable. */
734 735 return (B_FALSE);
735 736 } else {
736 737 /*
737 738 * Connection has been idle for
738 739 * too long. Reset the timestamp
739 740 * and assume the segment is valid.
740 741 */
741 742 tcp->tcp_ts_recent =
742 743 tcpoptp->tcp_opt_ts_val;
743 744 }
744 745 }
745 746 } else {
746 747 /*
747 748 * If we don't get a timestamp on every packet, we
748 749 * figure we can't really trust 'em, so we stop sending
749 750 * and parsing them.
750 751 */
751 752 tcp->tcp_snd_ts_ok = B_FALSE;
752 753
753 754 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN;
754 755 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN;
755 756 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4);
756 757 /*
757 758 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
758 759 * doing a slow start here so as to not to lose on the
759 760 * transfer rate built up so far.
760 761 */
761 762 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
762 763 if (tcp->tcp_snd_sack_ok)
763 764 tcp->tcp_max_sack_blk = 4;
764 765 }
765 766 return (B_TRUE);
766 767 }
767 768
768 769 /*
769 770 * Defense for the SYN attack -
770 771 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
771 772 * one from the list of droppable eagers. This list is a subset of q0.
772 773 * see comments before the definition of MAKE_DROPPABLE().
773 774 * 2. Don't drop a SYN request before its first timeout. This gives every
774 775 * request at least til the first timeout to complete its 3-way handshake.
775 776 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
776 777 * requests currently on the queue that has timed out. This will be used
777 778 * as an indicator of whether an attack is under way, so that appropriate
778 779 * actions can be taken. (It's incremented in tcp_timer() and decremented
779 780 * either when eager goes into ESTABLISHED, or gets freed up.)
780 781 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
781 782 * # of timeout drops back to <= q0len/32 => SYN alert off
782 783 */
783 784 static boolean_t
784 785 tcp_drop_q0(tcp_t *tcp)
785 786 {
786 787 tcp_t *eager;
787 788 mblk_t *mp;
788 789 tcp_stack_t *tcps = tcp->tcp_tcps;
789 790
790 791 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
791 792 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
792 793
793 794 /* Pick oldest eager from the list of droppable eagers */
794 795 eager = tcp->tcp_eager_prev_drop_q0;
795 796
796 797 /* If list is empty. return B_FALSE */
797 798 if (eager == tcp) {
798 799 return (B_FALSE);
799 800 }
800 801
801 802 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
802 803 if ((mp = allocb(0, BPRI_HI)) == NULL)
803 804 return (B_FALSE);
804 805
805 806 /*
806 807 * Take this eager out from the list of droppable eagers since we are
807 808 * going to drop it.
808 809 */
809 810 MAKE_UNDROPPABLE(eager);
810 811
811 812 if (tcp->tcp_connp->conn_debug) {
812 813 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
813 814 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
814 815 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
815 816 tcp->tcp_conn_req_cnt_q0,
816 817 tcp_display(tcp, NULL, DISP_PORT_ONLY));
817 818 }
818 819
819 820 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
820 821
821 822 /* Put a reference on the conn as we are enqueueing it in the sqeue */
822 823 CONN_INC_REF(eager->tcp_connp);
823 824
824 825 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
825 826 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
826 827 SQ_FILL, SQTAG_TCP_DROP_Q0);
827 828
828 829 return (B_TRUE);
829 830 }
830 831
831 832 /*
832 833 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
833 834 */
834 835 static mblk_t *
835 836 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
836 837 ip_recv_attr_t *ira)
837 838 {
838 839 tcp_t *ltcp = lconnp->conn_tcp;
839 840 tcp_t *tcp = connp->conn_tcp;
840 841 mblk_t *tpi_mp;
841 842 ipha_t *ipha;
842 843 ip6_t *ip6h;
843 844 sin6_t sin6;
844 845 uint_t ifindex = ira->ira_ruifindex;
845 846 tcp_stack_t *tcps = tcp->tcp_tcps;
846 847
847 848 if (ira->ira_flags & IRAF_IS_IPV4) {
848 849 ipha = (ipha_t *)mp->b_rptr;
849 850
850 851 connp->conn_ipversion = IPV4_VERSION;
851 852 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
852 853 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
853 854 connp->conn_saddr_v6 = connp->conn_laddr_v6;
854 855
855 856 sin6 = sin6_null;
856 857 sin6.sin6_addr = connp->conn_faddr_v6;
857 858 sin6.sin6_port = connp->conn_fport;
858 859 sin6.sin6_family = AF_INET6;
859 860 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
860 861 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
861 862
862 863 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
863 864 sin6_t sin6d;
864 865
865 866 sin6d = sin6_null;
866 867 sin6d.sin6_addr = connp->conn_laddr_v6;
867 868 sin6d.sin6_port = connp->conn_lport;
868 869 sin6d.sin6_family = AF_INET;
869 870 tpi_mp = mi_tpi_extconn_ind(NULL,
870 871 (char *)&sin6d, sizeof (sin6_t),
871 872 (char *)&tcp,
872 873 (t_scalar_t)sizeof (intptr_t),
873 874 (char *)&sin6d, sizeof (sin6_t),
874 875 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
875 876 } else {
876 877 tpi_mp = mi_tpi_conn_ind(NULL,
877 878 (char *)&sin6, sizeof (sin6_t),
878 879 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
879 880 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
880 881 }
881 882 } else {
882 883 ip6h = (ip6_t *)mp->b_rptr;
883 884
884 885 connp->conn_ipversion = IPV6_VERSION;
885 886 connp->conn_laddr_v6 = ip6h->ip6_dst;
886 887 connp->conn_faddr_v6 = ip6h->ip6_src;
887 888 connp->conn_saddr_v6 = connp->conn_laddr_v6;
888 889
889 890 sin6 = sin6_null;
890 891 sin6.sin6_addr = connp->conn_faddr_v6;
891 892 sin6.sin6_port = connp->conn_fport;
892 893 sin6.sin6_family = AF_INET6;
893 894 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
894 895 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
895 896 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
896 897
897 898 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
898 899 /* Pass up the scope_id of remote addr */
899 900 sin6.sin6_scope_id = ifindex;
900 901 } else {
901 902 sin6.sin6_scope_id = 0;
902 903 }
903 904 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
904 905 sin6_t sin6d;
905 906
906 907 sin6d = sin6_null;
907 908 sin6.sin6_addr = connp->conn_laddr_v6;
908 909 sin6d.sin6_port = connp->conn_lport;
909 910 sin6d.sin6_family = AF_INET6;
910 911 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
911 912 sin6d.sin6_scope_id = ifindex;
912 913
913 914 tpi_mp = mi_tpi_extconn_ind(NULL,
914 915 (char *)&sin6d, sizeof (sin6_t),
915 916 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
916 917 (char *)&sin6d, sizeof (sin6_t),
917 918 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
918 919 } else {
919 920 tpi_mp = mi_tpi_conn_ind(NULL,
920 921 (char *)&sin6, sizeof (sin6_t),
921 922 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
922 923 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
923 924 }
924 925 }
925 926
926 927 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
927 928 return (tpi_mp);
928 929 }
929 930
930 931 /* Handle a SYN on an AF_INET socket */
931 932 static mblk_t *
932 933 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
933 934 ip_recv_attr_t *ira)
934 935 {
935 936 tcp_t *ltcp = lconnp->conn_tcp;
936 937 tcp_t *tcp = connp->conn_tcp;
937 938 sin_t sin;
938 939 mblk_t *tpi_mp = NULL;
939 940 tcp_stack_t *tcps = tcp->tcp_tcps;
940 941 ipha_t *ipha;
941 942
942 943 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
943 944 ipha = (ipha_t *)mp->b_rptr;
944 945
945 946 connp->conn_ipversion = IPV4_VERSION;
946 947 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
947 948 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
948 949 connp->conn_saddr_v6 = connp->conn_laddr_v6;
949 950
950 951 sin = sin_null;
951 952 sin.sin_addr.s_addr = connp->conn_faddr_v4;
952 953 sin.sin_port = connp->conn_fport;
953 954 sin.sin_family = AF_INET;
954 955 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
955 956 sin_t sind;
956 957
957 958 sind = sin_null;
958 959 sind.sin_addr.s_addr = connp->conn_laddr_v4;
959 960 sind.sin_port = connp->conn_lport;
960 961 sind.sin_family = AF_INET;
961 962 tpi_mp = mi_tpi_extconn_ind(NULL,
962 963 (char *)&sind, sizeof (sin_t), (char *)&tcp,
963 964 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
964 965 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
965 966 } else {
966 967 tpi_mp = mi_tpi_conn_ind(NULL,
967 968 (char *)&sin, sizeof (sin_t),
968 969 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
969 970 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
970 971 }
971 972
972 973 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
973 974 return (tpi_mp);
974 975 }
975 976
976 977 /*
977 978 * Called via squeue to get on to eager's perimeter. It sends a
978 979 * TH_RST if eager is in the fanout table. The listener wants the
979 980 * eager to disappear either by means of tcp_eager_blowoff() or
980 981 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
981 982 * called (via squeue) if the eager cannot be inserted in the
982 983 * fanout table in tcp_input_listener().
983 984 */
984 985 /* ARGSUSED */
985 986 void
986 987 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
987 988 {
988 989 conn_t *econnp = (conn_t *)arg;
989 990 tcp_t *eager = econnp->conn_tcp;
990 991 tcp_t *listener = eager->tcp_listener;
991 992
992 993 /*
993 994 * We could be called because listener is closing. Since
994 995 * the eager was using listener's queue's, we avoid
995 996 * using the listeners queues from now on.
996 997 */
997 998 ASSERT(eager->tcp_detached);
998 999 econnp->conn_rq = NULL;
999 1000 econnp->conn_wq = NULL;
1000 1001
1001 1002 /*
1002 1003 * An eager's conn_fanout will be NULL if it's a duplicate
1003 1004 * for an existing 4-tuples in the conn fanout table.
1004 1005 * We don't want to send an RST out in such case.
1005 1006 */
1006 1007 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1007 1008 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1008 1009 eager, eager->tcp_snxt, 0, TH_RST);
1009 1010 }
1010 1011
1011 1012 /* We are here because listener wants this eager gone */
1012 1013 if (listener != NULL) {
1013 1014 mutex_enter(&listener->tcp_eager_lock);
1014 1015 tcp_eager_unlink(eager);
1015 1016 if (eager->tcp_tconnind_started) {
1016 1017 /*
1017 1018 * The eager has sent a conn_ind up to the
1018 1019 * listener but listener decides to close
1019 1020 * instead. We need to drop the extra ref
1020 1021 * placed on eager in tcp_input_data() before
1021 1022 * sending the conn_ind to listener.
1022 1023 */
1023 1024 CONN_DEC_REF(econnp);
1024 1025 }
1025 1026 mutex_exit(&listener->tcp_eager_lock);
1026 1027 CONN_DEC_REF(listener->tcp_connp);
1027 1028 }
1028 1029
1029 1030 if (eager->tcp_state != TCPS_CLOSED)
1030 1031 tcp_close_detached(eager);
1031 1032 }
1032 1033
1033 1034 /*
1034 1035 * Reset any eager connection hanging off this listener marked
1035 1036 * with 'seqnum' and then reclaim it's resources.
1036 1037 */
1037 1038 boolean_t
1038 1039 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1039 1040 {
1040 1041 tcp_t *eager;
1041 1042 mblk_t *mp;
1042 1043
1043 1044 eager = listener;
1044 1045 mutex_enter(&listener->tcp_eager_lock);
1045 1046 do {
1046 1047 eager = eager->tcp_eager_next_q;
1047 1048 if (eager == NULL) {
1048 1049 mutex_exit(&listener->tcp_eager_lock);
1049 1050 return (B_FALSE);
1050 1051 }
1051 1052 } while (eager->tcp_conn_req_seqnum != seqnum);
1052 1053
1053 1054 if (eager->tcp_closemp_used) {
1054 1055 mutex_exit(&listener->tcp_eager_lock);
1055 1056 return (B_TRUE);
1056 1057 }
1057 1058 eager->tcp_closemp_used = B_TRUE;
1058 1059 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1059 1060 CONN_INC_REF(eager->tcp_connp);
1060 1061 mutex_exit(&listener->tcp_eager_lock);
1061 1062 mp = &eager->tcp_closemp;
1062 1063 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1063 1064 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1064 1065 return (B_TRUE);
1065 1066 }
1066 1067
1067 1068 /*
1068 1069 * Reset any eager connection hanging off this listener
1069 1070 * and then reclaim it's resources.
1070 1071 */
1071 1072 void
1072 1073 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1073 1074 {
1074 1075 tcp_t *eager;
1075 1076 mblk_t *mp;
1076 1077 tcp_stack_t *tcps = listener->tcp_tcps;
1077 1078
1078 1079 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1079 1080
1080 1081 if (!q0_only) {
1081 1082 /* First cleanup q */
1082 1083 TCP_STAT(tcps, tcp_eager_blowoff_q);
1083 1084 eager = listener->tcp_eager_next_q;
1084 1085 while (eager != NULL) {
1085 1086 if (!eager->tcp_closemp_used) {
1086 1087 eager->tcp_closemp_used = B_TRUE;
1087 1088 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1088 1089 CONN_INC_REF(eager->tcp_connp);
1089 1090 mp = &eager->tcp_closemp;
1090 1091 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1091 1092 tcp_eager_kill, eager->tcp_connp, NULL,
1092 1093 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1093 1094 }
1094 1095 eager = eager->tcp_eager_next_q;
1095 1096 }
1096 1097 }
1097 1098 /* Then cleanup q0 */
1098 1099 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1099 1100 eager = listener->tcp_eager_next_q0;
1100 1101 while (eager != listener) {
1101 1102 if (!eager->tcp_closemp_used) {
1102 1103 eager->tcp_closemp_used = B_TRUE;
1103 1104 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1104 1105 CONN_INC_REF(eager->tcp_connp);
1105 1106 mp = &eager->tcp_closemp;
1106 1107 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1107 1108 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1108 1109 SQTAG_TCP_EAGER_CLEANUP_Q0);
1109 1110 }
1110 1111 eager = eager->tcp_eager_next_q0;
1111 1112 }
1112 1113 }
1113 1114
1114 1115 /*
1115 1116 * If we are an eager connection hanging off a listener that hasn't
1116 1117 * formally accepted the connection yet, get off his list and blow off
1117 1118 * any data that we have accumulated.
1118 1119 */
1119 1120 void
1120 1121 tcp_eager_unlink(tcp_t *tcp)
1121 1122 {
1122 1123 tcp_t *listener = tcp->tcp_listener;
1123 1124
1124 1125 ASSERT(listener != NULL);
1125 1126 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1126 1127 if (tcp->tcp_eager_next_q0 != NULL) {
1127 1128 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1128 1129
1129 1130 /* Remove the eager tcp from q0 */
1130 1131 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1131 1132 tcp->tcp_eager_prev_q0;
1132 1133 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1133 1134 tcp->tcp_eager_next_q0;
1134 1135 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1135 1136 listener->tcp_conn_req_cnt_q0--;
1136 1137
1137 1138 tcp->tcp_eager_next_q0 = NULL;
1138 1139 tcp->tcp_eager_prev_q0 = NULL;
1139 1140
1140 1141 /*
1141 1142 * Take the eager out, if it is in the list of droppable
1142 1143 * eagers.
1143 1144 */
1144 1145 MAKE_UNDROPPABLE(tcp);
1145 1146
1146 1147 if (tcp->tcp_syn_rcvd_timeout != 0) {
1147 1148 /* we have timed out before */
1148 1149 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1149 1150 listener->tcp_syn_rcvd_timeout--;
1150 1151 }
1151 1152 } else {
1152 1153 tcp_t **tcpp = &listener->tcp_eager_next_q;
1153 1154 tcp_t *prev = NULL;
1154 1155
1155 1156 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1156 1157 if (tcpp[0] == tcp) {
1157 1158 if (listener->tcp_eager_last_q == tcp) {
1158 1159 /*
1159 1160 * If we are unlinking the last
1160 1161 * element on the list, adjust
1161 1162 * tail pointer. Set tail pointer
1162 1163 * to nil when list is empty.
1163 1164 */
1164 1165 ASSERT(tcp->tcp_eager_next_q == NULL);
1165 1166 if (listener->tcp_eager_last_q ==
1166 1167 listener->tcp_eager_next_q) {
1167 1168 listener->tcp_eager_last_q =
1168 1169 NULL;
1169 1170 } else {
1170 1171 /*
1171 1172 * We won't get here if there
1172 1173 * is only one eager in the
1173 1174 * list.
1174 1175 */
1175 1176 ASSERT(prev != NULL);
1176 1177 listener->tcp_eager_last_q =
1177 1178 prev;
1178 1179 }
1179 1180 }
1180 1181 tcpp[0] = tcp->tcp_eager_next_q;
1181 1182 tcp->tcp_eager_next_q = NULL;
1182 1183 tcp->tcp_eager_last_q = NULL;
1183 1184 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1184 1185 listener->tcp_conn_req_cnt_q--;
1185 1186 break;
1186 1187 }
1187 1188 prev = tcpp[0];
1188 1189 }
1189 1190 }
1190 1191 tcp->tcp_listener = NULL;
1191 1192 }
1192 1193
1193 1194 /* BEGIN CSTYLED */
1194 1195 /*
1195 1196 *
1196 1197 * The sockfs ACCEPT path:
1197 1198 * =======================
1198 1199 *
1199 1200 * The eager is now established in its own perimeter as soon as SYN is
1200 1201 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1201 1202 * completes the accept processing on the acceptor STREAM. The sending
1202 1203 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1203 1204 * listener but a TLI/XTI listener completes the accept processing
1204 1205 * on the listener perimeter.
1205 1206 *
1206 1207 * Common control flow for 3 way handshake:
1207 1208 * ----------------------------------------
1208 1209 *
1209 1210 * incoming SYN (listener perimeter) -> tcp_input_listener()
1210 1211 *
1211 1212 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1212 1213 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1213 1214 *
1214 1215 * Sockfs ACCEPT Path:
1215 1216 * -------------------
1216 1217 *
1217 1218 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1218 1219 * as STREAM entry point)
1219 1220 *
1220 1221 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1221 1222 *
1222 1223 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1223 1224 * association (we are not behind eager's squeue but sockfs is protecting us
1224 1225 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1225 1226 * is changed to point at tcp_wput().
1226 1227 *
1227 1228 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1228 1229 * listener (done on listener's perimeter).
1229 1230 *
1230 1231 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1231 1232 * accept.
1232 1233 *
1233 1234 * TLI/XTI client ACCEPT path:
1234 1235 * ---------------------------
1235 1236 *
1236 1237 * soaccept() sends T_CONN_RES on the listener STREAM.
1237 1238 *
1238 1239 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1239 1240 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1240 1241 *
1241 1242 * Locks:
1242 1243 * ======
1243 1244 *
1244 1245 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1245 1246 * and listeners->tcp_eager_next_q.
1246 1247 *
1247 1248 * Referencing:
1248 1249 * ============
1249 1250 *
1250 1251 * 1) We start out in tcp_input_listener by eager placing a ref on
1251 1252 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1252 1253 *
1253 1254 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1254 1255 * doing so we place a ref on the eager. This ref is finally dropped at the
1255 1256 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1256 1257 * reference is dropped by the squeue framework.
1257 1258 *
1258 1259 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1259 1260 *
1260 1261 * The reference must be released by the same entity that added the reference
1261 1262 * In the above scheme, the eager is the entity that adds and releases the
1262 1263 * references. Note that tcp_accept_finish executes in the squeue of the eager
1263 1264 * (albeit after it is attached to the acceptor stream). Though 1. executes
1264 1265 * in the listener's squeue, the eager is nascent at this point and the
1265 1266 * reference can be considered to have been added on behalf of the eager.
1266 1267 *
1267 1268 * Eager getting a Reset or listener closing:
1268 1269 * ==========================================
1269 1270 *
1270 1271 * Once the listener and eager are linked, the listener never does the unlink.
1271 1272 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1272 1273 * a message on all eager perimeter. The eager then does the unlink, clears
1273 1274 * any pointers to the listener's queue and drops the reference to the
1274 1275 * listener. The listener waits in tcp_close outside the squeue until its
1275 1276 * refcount has dropped to 1. This ensures that the listener has waited for
1276 1277 * all eagers to clear their association with the listener.
1277 1278 *
1278 1279 * Similarly, if eager decides to go away, it can unlink itself and close.
1279 1280 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1280 1281 * the reference to eager is still valid because of the extra ref we put
1281 1282 * in tcp_send_conn_ind.
1282 1283 *
1283 1284 * Listener can always locate the eager under the protection
1284 1285 * of the listener->tcp_eager_lock, and then do a refhold
1285 1286 * on the eager during the accept processing.
1286 1287 *
1287 1288 * The acceptor stream accesses the eager in the accept processing
1288 1289 * based on the ref placed on eager before sending T_conn_ind.
1289 1290 * The only entity that can negate this refhold is a listener close
1290 1291 * which is mutually exclusive with an active acceptor stream.
1291 1292 *
1292 1293 * Eager's reference on the listener
1293 1294 * ===================================
1294 1295 *
1295 1296 * If the accept happens (even on a closed eager) the eager drops its
1296 1297 * reference on the listener at the start of tcp_accept_finish. If the
1297 1298 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1298 1299 * the reference is dropped in tcp_closei_local. If the listener closes,
1299 1300 * the reference is dropped in tcp_eager_kill. In all cases the reference
1300 1301 * is dropped while executing in the eager's context (squeue).
1301 1302 */
1302 1303 /* END CSTYLED */
1303 1304
1304 1305 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1305 1306
1306 1307 /*
1307 1308 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1308 1309 * tcp_input_data will not see any packets for listeners since the listener
1309 1310 * has conn_recv set to tcp_input_listener.
1310 1311 */
1311 1312 /* ARGSUSED */
1312 1313 static void
1313 1314 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1314 1315 {
1315 1316 tcpha_t *tcpha;
1316 1317 uint32_t seg_seq;
1317 1318 tcp_t *eager;
1318 1319 int err;
1319 1320 conn_t *econnp = NULL;
1320 1321 squeue_t *new_sqp;
1321 1322 mblk_t *mp1;
1322 1323 uint_t ip_hdr_len;
1323 1324 conn_t *lconnp = (conn_t *)arg;
1324 1325 tcp_t *listener = lconnp->conn_tcp;
1325 1326 tcp_stack_t *tcps = listener->tcp_tcps;
1326 1327 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1327 1328 uint_t flags;
1328 1329 mblk_t *tpi_mp;
1329 1330 uint_t ifindex = ira->ira_ruifindex;
1330 1331 boolean_t tlc_set = B_FALSE;
1331 1332
1332 1333 ip_hdr_len = ira->ira_ip_hdr_length;
1333 1334 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1334 1335 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1335 1336
1336 1337 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1337 1338 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1338 1339 __dtrace_tcp_tcph_t *, tcpha);
1339 1340
1340 1341 if (!(flags & TH_SYN)) {
1341 1342 if ((flags & TH_RST) || (flags & TH_URG)) {
1342 1343 freemsg(mp);
1343 1344 return;
1344 1345 }
1345 1346 if (flags & TH_ACK) {
1346 1347 /* Note this executes in listener's squeue */
1347 1348 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1348 1349 return;
1349 1350 }
1350 1351
1351 1352 freemsg(mp);
1352 1353 return;
1353 1354 }
1354 1355
1355 1356 if (listener->tcp_state != TCPS_LISTEN)
1356 1357 goto error2;
1357 1358
1358 1359 ASSERT(IPCL_IS_BOUND(lconnp));
1359 1360
1360 1361 mutex_enter(&listener->tcp_eager_lock);
1361 1362
1362 1363 /*
1363 1364 * The system is under memory pressure, so we need to do our part
1364 1365 * to relieve the pressure. So we only accept new request if there
1365 1366 * is nothing waiting to be accepted or waiting to complete the 3-way
1366 1367 * handshake. This means that busy listener will not get too many
1367 1368 * new requests which they cannot handle in time while non-busy
1368 1369 * listener is still functioning properly.
1369 1370 */
1370 1371 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1371 1372 listener->tcp_conn_req_cnt_q0 > 0)) {
1372 1373 mutex_exit(&listener->tcp_eager_lock);
1373 1374 TCP_STAT(tcps, tcp_listen_mem_drop);
1374 1375 goto error2;
1375 1376 }
1376 1377
1377 1378 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1378 1379 mutex_exit(&listener->tcp_eager_lock);
1379 1380 TCP_STAT(tcps, tcp_listendrop);
1380 1381 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1381 1382 if (lconnp->conn_debug) {
1382 1383 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1383 1384 "tcp_input_listener: listen backlog (max=%d) "
1384 1385 "overflow (%d pending) on %s",
1385 1386 listener->tcp_conn_req_max,
1386 1387 listener->tcp_conn_req_cnt_q,
1387 1388 tcp_display(listener, NULL, DISP_PORT_ONLY));
1388 1389 }
1389 1390 goto error2;
1390 1391 }
1391 1392
1392 1393 if (listener->tcp_conn_req_cnt_q0 >=
1393 1394 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1394 1395 /*
1395 1396 * Q0 is full. Drop a pending half-open req from the queue
1396 1397 * to make room for the new SYN req. Also mark the time we
1397 1398 * drop a SYN.
1398 1399 *
1399 1400 * A more aggressive defense against SYN attack will
1400 1401 * be to set the "tcp_syn_defense" flag now.
1401 1402 */
1402 1403 TCP_STAT(tcps, tcp_listendropq0);
1403 1404 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1404 1405 if (!tcp_drop_q0(listener)) {
1405 1406 mutex_exit(&listener->tcp_eager_lock);
1406 1407 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1407 1408 if (lconnp->conn_debug) {
1408 1409 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1409 1410 "tcp_input_listener: listen half-open "
1410 1411 "queue (max=%d) full (%d pending) on %s",
1411 1412 tcps->tcps_conn_req_max_q0,
1412 1413 listener->tcp_conn_req_cnt_q0,
1413 1414 tcp_display(listener, NULL,
1414 1415 DISP_PORT_ONLY));
1415 1416 }
1416 1417 goto error2;
1417 1418 }
1418 1419 }
1419 1420
1420 1421 /*
1421 1422 * Enforce the limit set on the number of connections per listener.
1422 1423 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1423 1424 * for comparison.
1424 1425 */
1425 1426 if (listener->tcp_listen_cnt != NULL) {
1426 1427 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1427 1428 int64_t now;
1428 1429
1429 1430 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1430 1431 mutex_exit(&listener->tcp_eager_lock);
1431 1432 now = ddi_get_lbolt64();
1432 1433 atomic_dec_32(&tlc->tlc_cnt);
1433 1434 TCP_STAT(tcps, tcp_listen_cnt_drop);
1434 1435 tlc->tlc_drop++;
1435 1436 if (now - tlc->tlc_report_time >
1436 1437 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1437 1438 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1438 1439 "Listener (port %d) connection max (%u) "
1439 1440 "reached: %u attempts dropped total\n",
1440 1441 ntohs(listener->tcp_connp->conn_lport),
1441 1442 tlc->tlc_max, tlc->tlc_drop);
1442 1443 tlc->tlc_report_time = now;
1443 1444 }
1444 1445 goto error2;
1445 1446 }
1446 1447 tlc_set = B_TRUE;
1447 1448 }
1448 1449
1449 1450 mutex_exit(&listener->tcp_eager_lock);
1450 1451
1451 1452 /*
1452 1453 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1453 1454 * or based on the ring (for packets from GLD). Otherwise it is
1454 1455 * set based on lbolt i.e., a somewhat random number.
1455 1456 */
1456 1457 ASSERT(ira->ira_sqp != NULL);
1457 1458 new_sqp = ira->ira_sqp;
1458 1459
1459 1460 econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1460 1461 if (econnp == NULL)
1461 1462 goto error2;
1462 1463
1463 1464 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1464 1465 econnp->conn_sqp = new_sqp;
1465 1466 econnp->conn_initial_sqp = new_sqp;
1466 1467 econnp->conn_ixa->ixa_sqp = new_sqp;
1467 1468
1468 1469 econnp->conn_fport = tcpha->tha_lport;
1469 1470 econnp->conn_lport = tcpha->tha_fport;
1470 1471
1471 1472 err = conn_inherit_parent(lconnp, econnp);
1472 1473 if (err != 0)
1473 1474 goto error3;
1474 1475
1475 1476 /* We already know the laddr of the new connection is ours */
1476 1477 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1477 1478
1478 1479 ASSERT(OK_32PTR(mp->b_rptr));
1479 1480 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1480 1481 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1481 1482
1482 1483 if (lconnp->conn_family == AF_INET) {
1483 1484 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1484 1485 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1485 1486 } else {
1486 1487 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1487 1488 }
1488 1489
1489 1490 if (tpi_mp == NULL)
1490 1491 goto error3;
1491 1492
1492 1493 eager = econnp->conn_tcp;
1493 1494 eager->tcp_detached = B_TRUE;
1494 1495 SOCK_CONNID_INIT(eager->tcp_connid);
1495 1496
1496 1497 /*
1497 1498 * Initialize the eager's tcp_t and inherit some parameters from
1498 1499 * the listener.
1499 1500 */
1500 1501 tcp_init_values(eager, listener);
1501 1502
1502 1503 ASSERT((econnp->conn_ixa->ixa_flags &
1503 1504 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1504 1505 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1505 1506 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1506 1507 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1507 1508
1508 1509 if (!tcps->tcps_dev_flow_ctl)
1509 1510 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1510 1511
1511 1512 /* Prepare for diffing against previous packets */
1512 1513 eager->tcp_recvifindex = 0;
1513 1514 eager->tcp_recvhops = 0xffffffffU;
1514 1515
1515 1516 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1516 1517 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1517 1518 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1518 1519 econnp->conn_incoming_ifindex = ifindex;
1519 1520 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1520 1521 econnp->conn_ixa->ixa_scopeid = ifindex;
1521 1522 }
1522 1523 }
1523 1524
1524 1525 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1525 1526 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1526 1527 tcps->tcps_rev_src_routes) {
1527 1528 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1528 1529 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1529 1530
1530 1531 /* Source routing option copyover (reverse it) */
1531 1532 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1532 1533 if (err != 0) {
1533 1534 freemsg(tpi_mp);
1534 1535 goto error3;
1535 1536 }
1536 1537 ip_pkt_source_route_reverse_v4(ipp);
1537 1538 }
1538 1539
1539 1540 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1540 1541 ASSERT(!eager->tcp_tconnind_started);
1541 1542 /*
1542 1543 * If the SYN came with a credential, it's a loopback packet or a
1543 1544 * labeled packet; attach the credential to the TPI message.
1544 1545 */
1545 1546 if (ira->ira_cred != NULL)
1546 1547 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1547 1548
1548 1549 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1549 1550 ASSERT(eager->tcp_ordrel_mp == NULL);
1550 1551
1551 1552 /* Inherit the listener's non-STREAMS flag */
1552 1553 if (IPCL_IS_NONSTR(lconnp)) {
1553 1554 econnp->conn_flags |= IPCL_NONSTR;
1554 1555 /* All non-STREAMS tcp_ts are sockets */
1555 1556 eager->tcp_issocket = B_TRUE;
1556 1557 } else {
1557 1558 /*
1558 1559 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1559 1560 * at close time, we will always have that to send up.
1560 1561 * Otherwise, we need to do special handling in case the
1561 1562 * allocation fails at that time.
1562 1563 */
1563 1564 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1564 1565 goto error3;
1565 1566 }
1566 1567 /*
1567 1568 * Now that the IP addresses and ports are setup in econnp we
1568 1569 * can do the IPsec policy work.
1569 1570 */
1570 1571 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1571 1572 if (lconnp->conn_policy != NULL) {
1572 1573 /*
1573 1574 * Inherit the policy from the listener; use
1574 1575 * actions from ira
1575 1576 */
1576 1577 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1577 1578 CONN_DEC_REF(econnp);
1578 1579 freemsg(mp);
1579 1580 goto error3;
1580 1581 }
1581 1582 }
1582 1583 }
1583 1584
1584 1585 /*
1585 1586 * tcp_set_destination() may set tcp_rwnd according to the route
1586 1587 * metrics. If it does not, the eager's receive window will be set
1587 1588 * to the listener's receive window later in this function.
1588 1589 */
1589 1590 eager->tcp_rwnd = 0;
1590 1591
1591 1592 if (is_system_labeled()) {
1592 1593 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1593 1594
1594 1595 ASSERT(ira->ira_tsl != NULL);
1595 1596 /* Discard any old label */
1596 1597 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1597 1598 ASSERT(ixa->ixa_tsl != NULL);
1598 1599 label_rele(ixa->ixa_tsl);
1599 1600 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1600 1601 ixa->ixa_tsl = NULL;
1601 1602 }
1602 1603 if ((lconnp->conn_mlp_type != mlptSingle ||
1603 1604 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1604 1605 ira->ira_tsl != NULL) {
1605 1606 /*
1606 1607 * If this is an MLP connection or a MAC-Exempt
1607 1608 * connection with an unlabeled node, packets are to be
1608 1609 * exchanged using the security label of the received
1609 1610 * SYN packet instead of the server application's label.
1610 1611 * tsol_check_dest called from ip_set_destination
1611 1612 * might later update TSF_UNLABELED by replacing
1612 1613 * ixa_tsl with a new label.
1613 1614 */
1614 1615 label_hold(ira->ira_tsl);
1615 1616 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1616 1617 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1617 1618 econnp, ts_label_t *, ixa->ixa_tsl)
1618 1619 } else {
1619 1620 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1620 1621 DTRACE_PROBE2(syn_accept, conn_t *,
1621 1622 econnp, ts_label_t *, ixa->ixa_tsl)
1622 1623 }
1623 1624 /*
1624 1625 * conn_connect() called from tcp_set_destination will verify
1625 1626 * the destination is allowed to receive packets at the
1626 1627 * security label of the SYN-ACK we are generating. As part of
1627 1628 * that, tsol_check_dest() may create a new effective label for
1628 1629 * this connection.
1629 1630 * Finally conn_connect() will call conn_update_label.
1630 1631 * All that remains for TCP to do is to call
1631 1632 * conn_build_hdr_template which is done as part of
1632 1633 * tcp_set_destination.
1633 1634 */
1634 1635 }
1635 1636
1636 1637 /*
1637 1638 * Since we will clear tcp_listener before we clear tcp_detached
1638 1639 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1639 1640 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1640 1641 */
1641 1642 eager->tcp_hard_binding = B_TRUE;
1642 1643
1643 1644 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1644 1645 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1645 1646
1646 1647 CL_INET_CONNECT(econnp, B_FALSE, err);
1647 1648 if (err != 0) {
1648 1649 tcp_bind_hash_remove(eager);
1649 1650 goto error3;
1650 1651 }
1651 1652
1652 1653 SOCK_CONNID_BUMP(eager->tcp_connid);
1653 1654
1654 1655 /*
1655 1656 * Adapt our mss, ttl, ... based on the remote address.
1656 1657 */
1657 1658
1658 1659 if (tcp_set_destination(eager) != 0) {
1659 1660 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1660 1661 /* Undo the bind_hash_insert */
1661 1662 tcp_bind_hash_remove(eager);
1662 1663 goto error3;
1663 1664 }
1664 1665
1665 1666 /* Process all TCP options. */
1666 1667 tcp_process_options(eager, tcpha);
1667 1668
1668 1669 /* Is the other end ECN capable? */
1669 1670 if (tcps->tcps_ecn_permitted >= 1 &&
1670 1671 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1671 1672 eager->tcp_ecn_ok = B_TRUE;
1672 1673 }
1673 1674
1674 1675 /*
1675 1676 * The listener's conn_rcvbuf should be the default window size or a
1676 1677 * window size changed via SO_RCVBUF option. First round up the
1677 1678 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1678 1679 * scale option value if needed. Call tcp_rwnd_set() to finish the
1679 1680 * setting.
1680 1681 *
1681 1682 * Note if there is a rpipe metric associated with the remote host,
1682 1683 * we should not inherit receive window size from listener.
1683 1684 */
1684 1685 eager->tcp_rwnd = MSS_ROUNDUP(
1685 1686 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1686 1687 eager->tcp_rwnd), eager->tcp_mss);
1687 1688 if (eager->tcp_snd_ws_ok)
1688 1689 tcp_set_ws_value(eager);
1689 1690 /*
1690 1691 * Note that this is the only place tcp_rwnd_set() is called for
1691 1692 * accepting a connection. We need to call it here instead of
1692 1693 * after the 3-way handshake because we need to tell the other
1693 1694 * side our rwnd in the SYN-ACK segment.
1694 1695 */
1695 1696 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1696 1697
1697 1698 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1698 1699 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1699 1700
1700 1701 ASSERT(econnp->conn_rcvbuf != 0 &&
1701 1702 econnp->conn_rcvbuf == eager->tcp_rwnd);
1702 1703
1703 1704 /* Put a ref on the listener for the eager. */
1704 1705 CONN_INC_REF(lconnp);
1705 1706 mutex_enter(&listener->tcp_eager_lock);
1706 1707 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1707 1708 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1708 1709 listener->tcp_eager_next_q0 = eager;
1709 1710 eager->tcp_eager_prev_q0 = listener;
1710 1711
1711 1712 /* Set tcp_listener before adding it to tcp_conn_fanout */
1712 1713 eager->tcp_listener = listener;
1713 1714 eager->tcp_saved_listener = listener;
1714 1715
1715 1716 /*
1716 1717 * Set tcp_listen_cnt so that when the connection is done, the counter
1717 1718 * is decremented.
1718 1719 */
1719 1720 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1720 1721
1721 1722 /*
1722 1723 * Tag this detached tcp vector for later retrieval
1723 1724 * by our listener client in tcp_accept().
1724 1725 */
1725 1726 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1726 1727 listener->tcp_conn_req_cnt_q0++;
1727 1728 if (++listener->tcp_conn_req_seqnum == -1) {
1728 1729 /*
1729 1730 * -1 is "special" and defined in TPI as something
1730 1731 * that should never be used in T_CONN_IND
1731 1732 */
1732 1733 ++listener->tcp_conn_req_seqnum;
1733 1734 }
1734 1735 mutex_exit(&listener->tcp_eager_lock);
1735 1736
1736 1737 if (listener->tcp_syn_defense) {
1737 1738 /* Don't drop the SYN that comes from a good IP source */
1738 1739 ipaddr_t *addr_cache;
1739 1740
1740 1741 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1741 1742 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1742 1743 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1743 1744 eager->tcp_dontdrop = B_TRUE;
1744 1745 }
1745 1746 }
1746 1747
1747 1748 /*
1748 1749 * We need to insert the eager in its own perimeter but as soon
1749 1750 * as we do that, we expose the eager to the classifier and
1750 1751 * should not touch any field outside the eager's perimeter.
1751 1752 * So do all the work necessary before inserting the eager
1752 1753 * in its own perimeter. Be optimistic that conn_connect()
1753 1754 * will succeed but undo everything if it fails.
1754 1755 */
1755 1756 seg_seq = ntohl(tcpha->tha_seq);
1756 1757 eager->tcp_irs = seg_seq;
1757 1758 eager->tcp_rack = seg_seq;
1758 1759 eager->tcp_rnxt = seg_seq + 1;
1759 1760 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1760 1761 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1761 1762 eager->tcp_state = TCPS_SYN_RCVD;
1762 1763 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1763 1764 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1764 1765 int32_t, TCPS_LISTEN);
1765 1766
1766 1767 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1767 1768 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1768 1769 if (mp1 == NULL) {
1769 1770 /*
1770 1771 * Increment the ref count as we are going to
1771 1772 * enqueueing an mp in squeue
1772 1773 */
1773 1774 CONN_INC_REF(econnp);
1774 1775 goto error;
1775 1776 }
1776 1777
1777 1778 /*
1778 1779 * We need to start the rto timer. In normal case, we start
1779 1780 * the timer after sending the packet on the wire (or at
1780 1781 * least believing that packet was sent by waiting for
1781 1782 * conn_ip_output() to return). Since this is the first packet
1782 1783 * being sent on the wire for the eager, our initial tcp_rto
1783 1784 * is at least tcp_rexmit_interval_min which is a fairly
1784 1785 * large value to allow the algorithm to adjust slowly to large
1785 1786 * fluctuations of RTT during first few transmissions.
1786 1787 *
1787 1788 * Starting the timer first and then sending the packet in this
1788 1789 * case shouldn't make much difference since tcp_rexmit_interval_min
1789 1790 * is of the order of several 100ms and starting the timer
1790 1791 * first and then sending the packet will result in difference
1791 1792 * of few micro seconds.
1792 1793 *
1793 1794 * Without this optimization, we are forced to hold the fanout
1794 1795 * lock across the ipcl_bind_insert() and sending the packet
1795 1796 * so that we don't race against an incoming packet (maybe RST)
1796 1797 * for this eager.
1797 1798 *
1798 1799 * It is necessary to acquire an extra reference on the eager
1799 1800 * at this point and hold it until after tcp_send_data() to
1800 1801 * ensure against an eager close race.
1801 1802 */
1802 1803
1803 1804 CONN_INC_REF(econnp);
1804 1805
1805 1806 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1806 1807
1807 1808 /*
1808 1809 * Insert the eager in its own perimeter now. We are ready to deal
1809 1810 * with any packets on eager.
1810 1811 */
1811 1812 if (ipcl_conn_insert(econnp) != 0)
1812 1813 goto error;
1813 1814
1814 1815 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1815 1816 freemsg(mp);
1816 1817 /*
1817 1818 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1818 1819 * only used by one thread at a time.
1819 1820 */
1820 1821 if (econnp->conn_sqp == lconnp->conn_sqp) {
1821 1822 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1822 1823 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1823 1824 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1824 1825 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1825 1826 (void) conn_ip_output(mp1, econnp->conn_ixa);
1826 1827 CONN_DEC_REF(econnp);
1827 1828 } else {
1828 1829 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1829 1830 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1830 1831 }
1831 1832 return;
1832 1833 error:
1833 1834 freemsg(mp1);
1834 1835 eager->tcp_closemp_used = B_TRUE;
1835 1836 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1836 1837 mp1 = &eager->tcp_closemp;
1837 1838 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1838 1839 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1839 1840
1840 1841 /*
1841 1842 * If a connection already exists, send the mp to that connections so
1842 1843 * that it can be appropriately dealt with.
1843 1844 */
1844 1845 ipst = tcps->tcps_netstack->netstack_ip;
1845 1846
1846 1847 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1847 1848 if (!IPCL_IS_CONNECTED(econnp)) {
1848 1849 /*
1849 1850 * Something bad happened. ipcl_conn_insert()
1850 1851 * failed because a connection already existed
1851 1852 * in connected hash but we can't find it
1852 1853 * anymore (someone blew it away). Just
1853 1854 * free this message and hopefully remote
1854 1855 * will retransmit at which time the SYN can be
1855 1856 * treated as a new connection or dealth with
1856 1857 * a TH_RST if a connection already exists.
1857 1858 */
1858 1859 CONN_DEC_REF(econnp);
1859 1860 freemsg(mp);
1860 1861 } else {
1861 1862 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1862 1863 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1863 1864 }
1864 1865 } else {
1865 1866 /* Nobody wants this packet */
1866 1867 freemsg(mp);
1867 1868 }
1868 1869 return;
1869 1870 error3:
1870 1871 CONN_DEC_REF(econnp);
1871 1872 error2:
1872 1873 freemsg(mp);
1873 1874 if (tlc_set)
1874 1875 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1875 1876 }
1876 1877
1877 1878 /*
1878 1879 * In an ideal case of vertical partition in NUMA architecture, its
1879 1880 * beneficial to have the listener and all the incoming connections
1880 1881 * tied to the same squeue. The other constraint is that incoming
1881 1882 * connections should be tied to the squeue attached to interrupted
1882 1883 * CPU for obvious locality reason so this leaves the listener to
1883 1884 * be tied to the same squeue. Our only problem is that when listener
1884 1885 * is binding, the CPU that will get interrupted by the NIC whose
1885 1886 * IP address the listener is binding to is not even known. So
1886 1887 * the code below allows us to change that binding at the time the
1887 1888 * CPU is interrupted by virtue of incoming connection's squeue.
1888 1889 *
1889 1890 * This is usefull only in case of a listener bound to a specific IP
1890 1891 * address. For other kind of listeners, they get bound the
1891 1892 * very first time and there is no attempt to rebind them.
1892 1893 */
1893 1894 void
1894 1895 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1895 1896 ip_recv_attr_t *ira)
1896 1897 {
1897 1898 conn_t *connp = (conn_t *)arg;
1898 1899 squeue_t *sqp = (squeue_t *)arg2;
1899 1900 squeue_t *new_sqp;
1900 1901 uint32_t conn_flags;
1901 1902
1902 1903 /*
1903 1904 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1904 1905 * or based on the ring (for packets from GLD). Otherwise it is
1905 1906 * set based on lbolt i.e., a somewhat random number.
1906 1907 */
1907 1908 ASSERT(ira->ira_sqp != NULL);
1908 1909 new_sqp = ira->ira_sqp;
1909 1910
1910 1911 if (connp->conn_fanout == NULL)
1911 1912 goto done;
1912 1913
1913 1914 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1914 1915 mutex_enter(&connp->conn_fanout->connf_lock);
1915 1916 mutex_enter(&connp->conn_lock);
1916 1917 /*
1917 1918 * No one from read or write side can access us now
1918 1919 * except for already queued packets on this squeue.
1919 1920 * But since we haven't changed the squeue yet, they
1920 1921 * can't execute. If they are processed after we have
1921 1922 * changed the squeue, they are sent back to the
1922 1923 * correct squeue down below.
1923 1924 * But a listner close can race with processing of
1924 1925 * incoming SYN. If incoming SYN processing changes
1925 1926 * the squeue then the listener close which is waiting
1926 1927 * to enter the squeue would operate on the wrong
1927 1928 * squeue. Hence we don't change the squeue here unless
1928 1929 * the refcount is exactly the minimum refcount. The
1929 1930 * minimum refcount of 4 is counted as - 1 each for
1930 1931 * TCP and IP, 1 for being in the classifier hash, and
1931 1932 * 1 for the mblk being processed.
1932 1933 */
1933 1934
1934 1935 if (connp->conn_ref != 4 ||
1935 1936 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1936 1937 mutex_exit(&connp->conn_lock);
1937 1938 mutex_exit(&connp->conn_fanout->connf_lock);
1938 1939 goto done;
1939 1940 }
1940 1941 if (connp->conn_sqp != new_sqp) {
1941 1942 while (connp->conn_sqp != new_sqp)
1942 1943 (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
1943 1944 new_sqp);
1944 1945 /* No special MT issues for outbound ixa_sqp hint */
1945 1946 connp->conn_ixa->ixa_sqp = new_sqp;
1946 1947 }
1947 1948
1948 1949 do {
1949 1950 conn_flags = connp->conn_flags;
1950 1951 conn_flags |= IPCL_FULLY_BOUND;
1951 1952 (void) atomic_cas_32(&connp->conn_flags,
1952 1953 connp->conn_flags, conn_flags);
1953 1954 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1954 1955
1955 1956 mutex_exit(&connp->conn_fanout->connf_lock);
1956 1957 mutex_exit(&connp->conn_lock);
1957 1958
1958 1959 /*
1959 1960 * Assume we have picked a good squeue for the listener. Make
1960 1961 * subsequent SYNs not try to change the squeue.
1961 1962 */
1962 1963 connp->conn_recv = tcp_input_listener;
1963 1964 }
1964 1965
1965 1966 done:
1966 1967 if (connp->conn_sqp != sqp) {
1967 1968 CONN_INC_REF(connp);
1968 1969 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1969 1970 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1970 1971 } else {
1971 1972 tcp_input_listener(connp, mp, sqp, ira);
1972 1973 }
1973 1974 }
1974 1975
1975 1976 /*
1976 1977 * Send up all messages queued on tcp_rcv_list.
1977 1978 */
1978 1979 uint_t
1979 1980 tcp_rcv_drain(tcp_t *tcp)
1980 1981 {
1981 1982 mblk_t *mp;
1982 1983 uint_t ret = 0;
1983 1984 #ifdef DEBUG
1984 1985 uint_t cnt = 0;
1985 1986 #endif
1986 1987 queue_t *q = tcp->tcp_connp->conn_rq;
1987 1988
1988 1989 /* Can't drain on an eager connection */
1989 1990 if (tcp->tcp_listener != NULL)
1990 1991 return (ret);
1991 1992
1992 1993 /* Can't be a non-STREAMS connection */
1993 1994 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1994 1995
1995 1996 /* No need for the push timer now. */
1996 1997 if (tcp->tcp_push_tid != 0) {
1997 1998 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1998 1999 tcp->tcp_push_tid = 0;
1999 2000 }
2000 2001
2001 2002 /*
2002 2003 * Handle two cases here: we are currently fused or we were
2003 2004 * previously fused and have some urgent data to be delivered
2004 2005 * upstream. The latter happens because we either ran out of
2005 2006 * memory or were detached and therefore sending the SIGURG was
2006 2007 * deferred until this point. In either case we pass control
2007 2008 * over to tcp_fuse_rcv_drain() since it may need to complete
2008 2009 * some work.
2009 2010 */
2010 2011 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2011 2012 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2012 2013 &tcp->tcp_fused_sigurg_mp))
2013 2014 return (ret);
2014 2015 }
2015 2016
2016 2017 while ((mp = tcp->tcp_rcv_list) != NULL) {
2017 2018 tcp->tcp_rcv_list = mp->b_next;
2018 2019 mp->b_next = NULL;
2019 2020 #ifdef DEBUG
2020 2021 cnt += msgdsize(mp);
2021 2022 #endif
2022 2023 putnext(q, mp);
2023 2024 }
2024 2025 #ifdef DEBUG
2025 2026 ASSERT(cnt == tcp->tcp_rcv_cnt);
2026 2027 #endif
2027 2028 tcp->tcp_rcv_last_head = NULL;
2028 2029 tcp->tcp_rcv_last_tail = NULL;
2029 2030 tcp->tcp_rcv_cnt = 0;
2030 2031
2031 2032 if (canputnext(q))
2032 2033 return (tcp_rwnd_reopen(tcp));
2033 2034
2034 2035 return (ret);
2035 2036 }
2036 2037
2037 2038 /*
2038 2039 * Queue data on tcp_rcv_list which is a b_next chain.
2039 2040 * tcp_rcv_last_head/tail is the last element of this chain.
2040 2041 * Each element of the chain is a b_cont chain.
2041 2042 *
2042 2043 * M_DATA messages are added to the current element.
2043 2044 * Other messages are added as new (b_next) elements.
2044 2045 */
2045 2046 void
2046 2047 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2047 2048 {
2048 2049 ASSERT(seg_len == msgdsize(mp));
2049 2050 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2050 2051
2051 2052 if (is_system_labeled()) {
2052 2053 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2053 2054 /*
2054 2055 * Provide for protocols above TCP such as RPC. NOPID leaves
2055 2056 * db_cpid unchanged.
2056 2057 * The cred could have already been set.
2057 2058 */
2058 2059 if (cr != NULL)
2059 2060 mblk_setcred(mp, cr, NOPID);
2060 2061 }
2061 2062
2062 2063 if (tcp->tcp_rcv_list == NULL) {
2063 2064 ASSERT(tcp->tcp_rcv_last_head == NULL);
2064 2065 tcp->tcp_rcv_list = mp;
2065 2066 tcp->tcp_rcv_last_head = mp;
2066 2067 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2067 2068 tcp->tcp_rcv_last_tail->b_cont = mp;
2068 2069 } else {
2069 2070 tcp->tcp_rcv_last_head->b_next = mp;
2070 2071 tcp->tcp_rcv_last_head = mp;
2071 2072 }
2072 2073
2073 2074 while (mp->b_cont)
2074 2075 mp = mp->b_cont;
2075 2076
2076 2077 tcp->tcp_rcv_last_tail = mp;
2077 2078 tcp->tcp_rcv_cnt += seg_len;
2078 2079 tcp->tcp_rwnd -= seg_len;
2079 2080 }
2080 2081
2081 2082 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2082 2083 mblk_t *
2083 2084 tcp_ack_mp(tcp_t *tcp)
2084 2085 {
2085 2086 uint32_t seq_no;
2086 2087 tcp_stack_t *tcps = tcp->tcp_tcps;
2087 2088 conn_t *connp = tcp->tcp_connp;
2088 2089
2089 2090 /*
2090 2091 * There are a few cases to be considered while setting the sequence no.
2091 2092 * Essentially, we can come here while processing an unacceptable pkt
2092 2093 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2093 2094 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2094 2095 * If we are here for a zero window probe, stick with suna. In all
2095 2096 * other cases, we check if suna + swnd encompasses snxt and set
2096 2097 * the sequence number to snxt, if so. If snxt falls outside the
2097 2098 * window (the receiver probably shrunk its window), we will go with
2098 2099 * suna + swnd, otherwise the sequence no will be unacceptable to the
2099 2100 * receiver.
2100 2101 */
2101 2102 if (tcp->tcp_zero_win_probe) {
2102 2103 seq_no = tcp->tcp_suna;
2103 2104 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2104 2105 ASSERT(tcp->tcp_swnd == 0);
2105 2106 seq_no = tcp->tcp_snxt;
2106 2107 } else {
2107 2108 seq_no = SEQ_GT(tcp->tcp_snxt,
2108 2109 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2109 2110 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2110 2111 }
2111 2112
2112 2113 if (tcp->tcp_valid_bits) {
2113 2114 /*
2114 2115 * For the complex case where we have to send some
2115 2116 * controls (FIN or SYN), let tcp_xmit_mp do it.
2116 2117 */
2117 2118 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2118 2119 NULL, B_FALSE));
2119 2120 } else {
2120 2121 /* Generate a simple ACK */
2121 2122 int data_length;
2122 2123 uchar_t *rptr;
2123 2124 tcpha_t *tcpha;
2124 2125 mblk_t *mp1;
2125 2126 int32_t total_hdr_len;
2126 2127 int32_t tcp_hdr_len;
2127 2128 int32_t num_sack_blk = 0;
2128 2129 int32_t sack_opt_len;
2129 2130 ip_xmit_attr_t *ixa = connp->conn_ixa;
2130 2131
2131 2132 /*
2132 2133 * Allocate space for TCP + IP headers
2133 2134 * and link-level header
2134 2135 */
2135 2136 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2136 2137 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2137 2138 tcp->tcp_num_sack_blk);
2138 2139 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2139 2140 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2140 2141 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2141 2142 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2142 2143 } else {
2143 2144 total_hdr_len = connp->conn_ht_iphc_len;
2144 2145 tcp_hdr_len = connp->conn_ht_ulp_len;
2145 2146 }
2146 2147 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2147 2148 if (!mp1)
2148 2149 return (NULL);
2149 2150
2150 2151 /* Update the latest receive window size in TCP header. */
2151 2152 tcp->tcp_tcpha->tha_win =
2152 2153 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2153 2154 /* copy in prototype TCP + IP header */
2154 2155 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2155 2156 mp1->b_rptr = rptr;
2156 2157 mp1->b_wptr = rptr + total_hdr_len;
2157 2158 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2158 2159
2159 2160 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2160 2161
2161 2162 /* Set the TCP sequence number. */
2162 2163 tcpha->tha_seq = htonl(seq_no);
2163 2164
2164 2165 /* Set up the TCP flag field. */
2165 2166 tcpha->tha_flags = (uchar_t)TH_ACK;
2166 2167 if (tcp->tcp_ecn_echo_on)
2167 2168 tcpha->tha_flags |= TH_ECE;
2168 2169
2169 2170 tcp->tcp_rack = tcp->tcp_rnxt;
2170 2171 tcp->tcp_rack_cnt = 0;
2171 2172
2172 2173 /* fill in timestamp option if in use */
2173 2174 if (tcp->tcp_snd_ts_ok) {
2174 2175 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2175 2176
2176 2177 U32_TO_BE32(llbolt,
2177 2178 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2178 2179 U32_TO_BE32(tcp->tcp_ts_recent,
2179 2180 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2180 2181 }
2181 2182
2182 2183 /* Fill in SACK options */
2183 2184 if (num_sack_blk > 0) {
2184 2185 uchar_t *wptr = (uchar_t *)tcpha +
2185 2186 connp->conn_ht_ulp_len;
2186 2187 sack_blk_t *tmp;
2187 2188 int32_t i;
2188 2189
2189 2190 wptr[0] = TCPOPT_NOP;
2190 2191 wptr[1] = TCPOPT_NOP;
2191 2192 wptr[2] = TCPOPT_SACK;
2192 2193 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2193 2194 sizeof (sack_blk_t);
2194 2195 wptr += TCPOPT_REAL_SACK_LEN;
2195 2196
2196 2197 tmp = tcp->tcp_sack_list;
2197 2198 for (i = 0; i < num_sack_blk; i++) {
2198 2199 U32_TO_BE32(tmp[i].begin, wptr);
2199 2200 wptr += sizeof (tcp_seq);
2200 2201 U32_TO_BE32(tmp[i].end, wptr);
2201 2202 wptr += sizeof (tcp_seq);
2202 2203 }
2203 2204 tcpha->tha_offset_and_reserved +=
2204 2205 ((num_sack_blk * 2 + 1) << 4);
2205 2206 }
2206 2207
2207 2208 ixa->ixa_pktlen = total_hdr_len;
2208 2209
2209 2210 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2210 2211 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2211 2212 } else {
2212 2213 ip6_t *ip6 = (ip6_t *)rptr;
2213 2214
2214 2215 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2215 2216 }
2216 2217
2217 2218 /*
2218 2219 * Prime pump for checksum calculation in IP. Include the
2219 2220 * adjustment for a source route if any.
2220 2221 */
2221 2222 data_length = tcp_hdr_len + connp->conn_sum;
2222 2223 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2223 2224 tcpha->tha_sum = htons(data_length);
2224 2225
2225 2226 if (tcp->tcp_ip_forward_progress) {
2226 2227 tcp->tcp_ip_forward_progress = B_FALSE;
2227 2228 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2228 2229 } else {
2229 2230 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2230 2231 }
2231 2232 return (mp1);
2232 2233 }
2233 2234 }
2234 2235
2235 2236 /*
2236 2237 * Dummy socket upcalls for if/when the conn_t gets detached from a
2237 2238 * direct-callback sonode via a user-driven close(). Easy to catch with
2238 2239 * DTrace FBT, and should be mostly harmless.
2239 2240 */
2240 2241
2241 2242 /* ARGSUSED */
2242 2243 static sock_upper_handle_t
2243 2244 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2244 2245 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2245 2246 {
2246 2247 ASSERT(0); /* Panic in debug, otherwise ignore. */
2247 2248 return (NULL);
2248 2249 }
2249 2250
2250 2251 /* ARGSUSED */
2251 2252 static void
2252 2253 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2253 2254 pid_t pid)
2254 2255 {
2255 2256 ASSERT(x == NULL);
2256 2257 /* Normally we'd crhold(cr) and attach it to socket state. */
2257 2258 /* LINTED */
2258 2259 }
2259 2260
2260 2261 /* ARGSUSED */
2261 2262 static int
2262 2263 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2263 2264 {
2264 2265 ASSERT(0); /* Panic in debug, otherwise ignore. */
2265 2266 return (-1);
2266 2267 }
2267 2268
2268 2269 /* ARGSUSED */
2269 2270 static void
2270 2271 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2271 2272 {
2272 2273 ASSERT(x == NULL);
2273 2274 /* We really want this one to be a harmless NOP for now. */
2274 2275 /* LINTED */
2275 2276 }
2276 2277
2277 2278 /* ARGSUSED */
2278 2279 static ssize_t
2279 2280 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2280 2281 int *error, boolean_t *push)
2281 2282 {
2282 2283 ASSERT(x == NULL);
2283 2284
2284 2285 /*
2285 2286 * Consume the message, set ESHUTDOWN, and return an error.
2286 2287 * Nobody's home!
2287 2288 */
2288 2289 freemsg(mp);
2289 2290 *error = ESHUTDOWN;
2290 2291 return (-1);
2291 2292 }
2292 2293
2293 2294 /* ARGSUSED */
2294 2295 static void
2295 2296 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2296 2297 {
2297 2298 ASSERT(0); /* Panic in debug, otherwise ignore. */
2298 2299 }
2299 2300
2300 2301 /* ARGSUSED */
2301 2302 static void
2302 2303 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2303 2304 {
2304 2305 ASSERT(0); /* Panic in debug, otherwise ignore. */
2305 2306 }
2306 2307
2307 2308 /* ARGSUSED */
2308 2309 static void
2309 2310 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2310 2311 {
2311 2312 ASSERT(x == NULL);
2312 2313 /* Otherwise, this would signal socket state about OOB data. */
2313 2314 }
2314 2315
2315 2316 /* ARGSUSED */
2316 2317 static void
2317 2318 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2318 2319 {
2319 2320 ASSERT(0); /* Panic in debug, otherwise ignore. */
2320 2321 }
2321 2322
2322 2323 /* ARGSUSED */
2323 2324 static void
2324 2325 tcp_dummy_onearg(sock_upper_handle_t x)
2325 2326 {
2326 2327 ASSERT(0); /* Panic in debug, otherwise ignore. */
2327 2328 }
2328 2329
2329 2330 static sock_upcalls_t tcp_dummy_upcalls = {
2330 2331 tcp_dummy_newconn,
2331 2332 tcp_dummy_connected,
2332 2333 tcp_dummy_disconnected,
2333 2334 tcp_dummy_opctl,
2334 2335 tcp_dummy_recv,
2335 2336 tcp_dummy_set_proto_props,
2336 2337 tcp_dummy_txq_full,
2337 2338 tcp_dummy_signal_oob,
2338 2339 tcp_dummy_onearg,
2339 2340 tcp_dummy_set_error,
2340 2341 tcp_dummy_onearg
2341 2342 };
2342 2343
2343 2344 /*
2344 2345 * Handle M_DATA messages from IP. Its called directly from IP via
2345 2346 * squeue for received IP packets.
2346 2347 *
2347 2348 * The first argument is always the connp/tcp to which the mp belongs.
2348 2349 * There are no exceptions to this rule. The caller has already put
2349 2350 * a reference on this connp/tcp and once tcp_input_data() returns,
2350 2351 * the squeue will do the refrele.
2351 2352 *
2352 2353 * The TH_SYN for the listener directly go to tcp_input_listener via
2353 2354 * squeue. ICMP errors go directly to tcp_icmp_input().
2354 2355 *
2355 2356 * sqp: NULL = recursive, sqp != NULL means called from squeue
2356 2357 */
2357 2358 void
2358 2359 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2359 2360 {
2360 2361 int32_t bytes_acked;
2361 2362 int32_t gap;
2362 2363 mblk_t *mp1;
2363 2364 uint_t flags;
2364 2365 uint32_t new_swnd = 0;
2365 2366 uchar_t *iphdr;
2366 2367 uchar_t *rptr;
2367 2368 int32_t rgap;
2368 2369 uint32_t seg_ack;
2369 2370 int seg_len;
2370 2371 uint_t ip_hdr_len;
2371 2372 uint32_t seg_seq;
2372 2373 tcpha_t *tcpha;
2373 2374 int urp;
2374 2375 tcp_opt_t tcpopt;
2375 2376 ip_pkt_t ipp;
2376 2377 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2377 2378 uint32_t cwnd;
2378 2379 uint32_t add;
2379 2380 int npkt;
2380 2381 int mss;
2381 2382 conn_t *connp = (conn_t *)arg;
2382 2383 squeue_t *sqp = (squeue_t *)arg2;
2383 2384 tcp_t *tcp = connp->conn_tcp;
2384 2385 tcp_stack_t *tcps = tcp->tcp_tcps;
2385 2386 sock_upcalls_t *sockupcalls;
2386 2387
2387 2388 /*
2388 2389 * RST from fused tcp loopback peer should trigger an unfuse.
2389 2390 */
2390 2391 if (tcp->tcp_fused) {
2391 2392 TCP_STAT(tcps, tcp_fusion_aborted);
2392 2393 tcp_unfuse(tcp);
2393 2394 }
2394 2395
2395 2396 iphdr = mp->b_rptr;
2396 2397 rptr = mp->b_rptr;
2397 2398 ASSERT(OK_32PTR(rptr));
2398 2399
2399 2400 ip_hdr_len = ira->ira_ip_hdr_length;
2400 2401 if (connp->conn_recv_ancillary.crb_all != 0) {
2401 2402 /*
2402 2403 * Record packet information in the ip_pkt_t
2403 2404 */
2404 2405 ipp.ipp_fields = 0;
2405 2406 if (ira->ira_flags & IRAF_IS_IPV4) {
2406 2407 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2407 2408 B_FALSE);
2408 2409 } else {
2409 2410 uint8_t nexthdrp;
2410 2411
2411 2412 /*
2412 2413 * IPv6 packets can only be received by applications
2413 2414 * that are prepared to receive IPv6 addresses.
2414 2415 * The IP fanout must ensure this.
2415 2416 */
2416 2417 ASSERT(connp->conn_family == AF_INET6);
2417 2418
2418 2419 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2419 2420 &nexthdrp);
2420 2421 ASSERT(nexthdrp == IPPROTO_TCP);
2421 2422
2422 2423 /* Could have caused a pullup? */
2423 2424 iphdr = mp->b_rptr;
2424 2425 rptr = mp->b_rptr;
2425 2426 }
2426 2427 }
2427 2428 ASSERT(DB_TYPE(mp) == M_DATA);
2428 2429 ASSERT(mp->b_next == NULL);
2429 2430
2430 2431 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2431 2432 seg_seq = ntohl(tcpha->tha_seq);
2432 2433 seg_ack = ntohl(tcpha->tha_ack);
2433 2434 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2434 2435 seg_len = (int)(mp->b_wptr - rptr) -
2435 2436 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2436 2437 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2437 2438 do {
2438 2439 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2439 2440 (uintptr_t)INT_MAX);
2440 2441 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2441 2442 } while ((mp1 = mp1->b_cont) != NULL &&
2442 2443 mp1->b_datap->db_type == M_DATA);
2443 2444 }
2444 2445
2445 2446 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2446 2447 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2447 2448 __dtrace_tcp_tcph_t *, tcpha);
2448 2449
2449 2450 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2450 2451 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2451 2452 seg_len, tcpha, ira);
2452 2453 return;
2453 2454 }
2454 2455
2455 2456 if (sqp != NULL) {
2456 2457 /*
2457 2458 * This is the correct place to update tcp_last_recv_time. Note
2458 2459 * that it is also updated for tcp structure that belongs to
2459 2460 * global and listener queues which do not really need updating.
2460 2461 * But that should not cause any harm. And it is updated for
2461 2462 * all kinds of incoming segments, not only for data segments.
2462 2463 */
2463 2464 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2464 2465 }
2465 2466
2466 2467 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2467 2468
2468 2469 BUMP_LOCAL(tcp->tcp_ibsegs);
2469 2470 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2470 2471
2471 2472 if ((flags & TH_URG) && sqp != NULL) {
2472 2473 /*
2473 2474 * TCP can't handle urgent pointers that arrive before
2474 2475 * the connection has been accept()ed since it can't
2475 2476 * buffer OOB data. Discard segment if this happens.
2476 2477 *
2477 2478 * We can't just rely on a non-null tcp_listener to indicate
2478 2479 * that the accept() has completed since unlinking of the
2479 2480 * eager and completion of the accept are not atomic.
2480 2481 * tcp_detached, when it is not set (B_FALSE) indicates
2481 2482 * that the accept() has completed.
2482 2483 *
2483 2484 * Nor can it reassemble urgent pointers, so discard
2484 2485 * if it's not the next segment expected.
2485 2486 *
2486 2487 * Otherwise, collapse chain into one mblk (discard if
2487 2488 * that fails). This makes sure the headers, retransmitted
2488 2489 * data, and new data all are in the same mblk.
2489 2490 */
2490 2491 ASSERT(mp != NULL);
2491 2492 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2492 2493 freemsg(mp);
2493 2494 return;
2494 2495 }
2495 2496 /* Update pointers into message */
2496 2497 iphdr = rptr = mp->b_rptr;
2497 2498 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2498 2499 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2499 2500 /*
2500 2501 * Since we can't handle any data with this urgent
2501 2502 * pointer that is out of sequence, we expunge
2502 2503 * the data. This allows us to still register
2503 2504 * the urgent mark and generate the M_PCSIG,
2504 2505 * which we can do.
2505 2506 */
2506 2507 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2507 2508 seg_len = 0;
2508 2509 }
2509 2510 }
2510 2511
2511 2512 sockupcalls = connp->conn_upcalls;
2512 2513 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2513 2514 if (sockupcalls == NULL)
2514 2515 sockupcalls = &tcp_dummy_upcalls;
2515 2516
2516 2517 switch (tcp->tcp_state) {
2517 2518 case TCPS_SYN_SENT:
2518 2519 if (connp->conn_final_sqp == NULL &&
2519 2520 tcp_outbound_squeue_switch && sqp != NULL) {
2520 2521 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2521 2522 connp->conn_final_sqp = sqp;
2522 2523 if (connp->conn_final_sqp != connp->conn_sqp) {
2523 2524 DTRACE_PROBE1(conn__final__sqp__switch,
2524 2525 conn_t *, connp);
2525 2526 CONN_INC_REF(connp);
2526 2527 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2527 2528 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2528 2529 tcp_input_data, connp, ira, ip_squeue_flag,
2529 2530 SQTAG_CONNECT_FINISH);
2530 2531 return;
2531 2532 }
2532 2533 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2533 2534 }
2534 2535 if (flags & TH_ACK) {
2535 2536 /*
2536 2537 * Note that our stack cannot send data before a
2537 2538 * connection is established, therefore the
2538 2539 * following check is valid. Otherwise, it has
2539 2540 * to be changed.
2540 2541 */
2541 2542 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2542 2543 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2543 2544 freemsg(mp);
2544 2545 if (flags & TH_RST)
2545 2546 return;
2546 2547 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2547 2548 tcp, seg_ack, 0, TH_RST);
2548 2549 return;
2549 2550 }
2550 2551 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2551 2552 }
2552 2553 if (flags & TH_RST) {
2553 2554 if (flags & TH_ACK) {
2554 2555 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2555 2556 ip_xmit_attr_t *, connp->conn_ixa,
2556 2557 void_ip_t *, iphdr, tcp_t *, tcp,
2557 2558 tcph_t *, tcpha);
2558 2559 (void) tcp_clean_death(tcp, ECONNREFUSED);
2559 2560 }
2560 2561 freemsg(mp);
2561 2562 return;
2562 2563 }
2563 2564 if (!(flags & TH_SYN)) {
2564 2565 freemsg(mp);
2565 2566 return;
2566 2567 }
2567 2568
2568 2569 /* Process all TCP options. */
2569 2570 tcp_process_options(tcp, tcpha);
2570 2571 /*
2571 2572 * The following changes our rwnd to be a multiple of the
2572 2573 * MIN(peer MSS, our MSS) for performance reason.
2573 2574 */
2574 2575 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2575 2576 tcp->tcp_mss));
2576 2577
2577 2578 /* Is the other end ECN capable? */
2578 2579 if (tcp->tcp_ecn_ok) {
2579 2580 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2580 2581 tcp->tcp_ecn_ok = B_FALSE;
2581 2582 }
2582 2583 }
2583 2584 /*
2584 2585 * Clear ECN flags because it may interfere with later
2585 2586 * processing.
2586 2587 */
2587 2588 flags &= ~(TH_ECE|TH_CWR);
2588 2589
2589 2590 tcp->tcp_irs = seg_seq;
2590 2591 tcp->tcp_rack = seg_seq;
2591 2592 tcp->tcp_rnxt = seg_seq + 1;
2592 2593 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2593 2594 if (!TCP_IS_DETACHED(tcp)) {
2594 2595 /* Allocate room for SACK options if needed. */
2595 2596 connp->conn_wroff = connp->conn_ht_iphc_len;
2596 2597 if (tcp->tcp_snd_sack_ok)
2597 2598 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2598 2599 if (!tcp->tcp_loopback)
2599 2600 connp->conn_wroff += tcps->tcps_wroff_xtra;
2600 2601
2601 2602 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2602 2603 connp->conn_wroff);
2603 2604 }
2604 2605 if (flags & TH_ACK) {
2605 2606 /*
2606 2607 * If we can't get the confirmation upstream, pretend
2607 2608 * we didn't even see this one.
2608 2609 *
2609 2610 * XXX: how can we pretend we didn't see it if we
2610 2611 * have updated rnxt et. al.
2611 2612 *
2612 2613 * For loopback we defer sending up the T_CONN_CON
2613 2614 * until after some checks below.
2614 2615 */
2615 2616 mp1 = NULL;
2616 2617 /*
2617 2618 * tcp_sendmsg() checks tcp_state without entering
2618 2619 * the squeue so tcp_state should be updated before
2619 2620 * sending up connection confirmation. Probe the
2620 2621 * state change below when we are sure the connection
2621 2622 * confirmation has been sent.
2622 2623 */
2623 2624 tcp->tcp_state = TCPS_ESTABLISHED;
2624 2625 if (!tcp_conn_con(tcp, iphdr, mp,
2625 2626 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2626 2627 tcp->tcp_state = TCPS_SYN_SENT;
2627 2628 freemsg(mp);
2628 2629 return;
2629 2630 }
2630 2631 TCPS_CONN_INC(tcps);
2631 2632 /* SYN was acked - making progress */
2632 2633 tcp->tcp_ip_forward_progress = B_TRUE;
2633 2634
2634 2635 /* One for the SYN */
2635 2636 tcp->tcp_suna = tcp->tcp_iss + 1;
2636 2637 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
|
↓ open down ↓ |
2601 lines elided |
↑ open up ↑ |
2637 2638
2638 2639 /*
2639 2640 * If SYN was retransmitted, need to reset all
2640 2641 * retransmission info. This is because this
2641 2642 * segment will be treated as a dup ACK.
2642 2643 */
2643 2644 if (tcp->tcp_rexmit) {
2644 2645 tcp->tcp_rexmit = B_FALSE;
2645 2646 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2646 2647 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2647 - tcp->tcp_snd_burst = tcp->tcp_localnet ?
2648 - TCP_CWND_INFINITE : TCP_CWND_NORMAL;
2649 2648 tcp->tcp_ms_we_have_waited = 0;
2650 2649
2651 2650 /*
2652 2651 * Set tcp_cwnd back to 1 MSS, per
2653 2652 * recommendation from
2654 2653 * draft-floyd-incr-init-win-01.txt,
2655 2654 * Increasing TCP's Initial Window.
2656 2655 */
2657 2656 tcp->tcp_cwnd = tcp->tcp_mss;
2658 2657 }
2659 2658
2660 2659 tcp->tcp_swl1 = seg_seq;
2661 2660 tcp->tcp_swl2 = seg_ack;
2662 2661
2663 2662 new_swnd = ntohs(tcpha->tha_win);
2664 2663 tcp->tcp_swnd = new_swnd;
2665 2664 if (new_swnd > tcp->tcp_max_swnd)
2666 2665 tcp->tcp_max_swnd = new_swnd;
2667 2666
2668 2667 /*
2669 2668 * Always send the three-way handshake ack immediately
2670 2669 * in order to make the connection complete as soon as
2671 2670 * possible on the accepting host.
2672 2671 */
2673 2672 flags |= TH_ACK_NEEDED;
2674 2673
2675 2674 /*
2676 2675 * Trace connect-established here.
2677 2676 */
2678 2677 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2679 2678 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2680 2679 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2681 2680
2682 2681 /* Trace change from SYN_SENT -> ESTABLISHED here */
2683 2682 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2684 2683 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2685 2684 void, NULL, int32_t, TCPS_SYN_SENT);
2686 2685
2687 2686 /*
2688 2687 * Special case for loopback. At this point we have
2689 2688 * received SYN-ACK from the remote endpoint. In
2690 2689 * order to ensure that both endpoints reach the
2691 2690 * fused state prior to any data exchange, the final
2692 2691 * ACK needs to be sent before we indicate T_CONN_CON
2693 2692 * to the module upstream.
2694 2693 */
2695 2694 if (tcp->tcp_loopback) {
2696 2695 mblk_t *ack_mp;
2697 2696
2698 2697 ASSERT(!tcp->tcp_unfusable);
2699 2698 ASSERT(mp1 != NULL);
2700 2699 /*
2701 2700 * For loopback, we always get a pure SYN-ACK
2702 2701 * and only need to send back the final ACK
2703 2702 * with no data (this is because the other
2704 2703 * tcp is ours and we don't do T/TCP). This
2705 2704 * final ACK triggers the passive side to
2706 2705 * perform fusion in ESTABLISHED state.
2707 2706 */
2708 2707 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2709 2708 if (tcp->tcp_ack_tid != 0) {
2710 2709 (void) TCP_TIMER_CANCEL(tcp,
2711 2710 tcp->tcp_ack_tid);
2712 2711 tcp->tcp_ack_tid = 0;
2713 2712 }
2714 2713 tcp_send_data(tcp, ack_mp);
2715 2714 BUMP_LOCAL(tcp->tcp_obsegs);
2716 2715 TCPS_BUMP_MIB(tcps, tcpOutAck);
2717 2716
2718 2717 if (!IPCL_IS_NONSTR(connp)) {
2719 2718 /* Send up T_CONN_CON */
2720 2719 if (ira->ira_cred != NULL) {
2721 2720 mblk_setcred(mp1,
2722 2721 ira->ira_cred,
2723 2722 ira->ira_cpid);
2724 2723 }
2725 2724 putnext(connp->conn_rq, mp1);
2726 2725 } else {
2727 2726 (*sockupcalls->su_connected)
2728 2727 (connp->conn_upper_handle,
2729 2728 tcp->tcp_connid,
2730 2729 ira->ira_cred,
2731 2730 ira->ira_cpid);
2732 2731 freemsg(mp1);
2733 2732 }
2734 2733
2735 2734 freemsg(mp);
2736 2735 return;
2737 2736 }
2738 2737 /*
2739 2738 * Forget fusion; we need to handle more
2740 2739 * complex cases below. Send the deferred
2741 2740 * T_CONN_CON message upstream and proceed
2742 2741 * as usual. Mark this tcp as not capable
2743 2742 * of fusion.
2744 2743 */
2745 2744 TCP_STAT(tcps, tcp_fusion_unfusable);
2746 2745 tcp->tcp_unfusable = B_TRUE;
2747 2746 if (!IPCL_IS_NONSTR(connp)) {
2748 2747 if (ira->ira_cred != NULL) {
2749 2748 mblk_setcred(mp1, ira->ira_cred,
2750 2749 ira->ira_cpid);
2751 2750 }
2752 2751 putnext(connp->conn_rq, mp1);
2753 2752 } else {
2754 2753 (*sockupcalls->su_connected)
2755 2754 (connp->conn_upper_handle,
2756 2755 tcp->tcp_connid, ira->ira_cred,
2757 2756 ira->ira_cpid);
2758 2757 freemsg(mp1);
2759 2758 }
2760 2759 }
2761 2760
2762 2761 /*
2763 2762 * Check to see if there is data to be sent. If
2764 2763 * yes, set the transmit flag. Then check to see
2765 2764 * if received data processing needs to be done.
2766 2765 * If not, go straight to xmit_check. This short
2767 2766 * cut is OK as we don't support T/TCP.
2768 2767 */
2769 2768 if (tcp->tcp_unsent)
2770 2769 flags |= TH_XMIT_NEEDED;
2771 2770
2772 2771 if (seg_len == 0 && !(flags & TH_URG)) {
2773 2772 freemsg(mp);
2774 2773 goto xmit_check;
2775 2774 }
2776 2775
2777 2776 flags &= ~TH_SYN;
2778 2777 seg_seq++;
2779 2778 break;
2780 2779 }
2781 2780 tcp->tcp_state = TCPS_SYN_RCVD;
2782 2781 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2783 2782 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2784 2783 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2785 2784 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2786 2785 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2787 2786 if (mp1 != NULL) {
2788 2787 tcp_send_data(tcp, mp1);
2789 2788 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2790 2789 }
2791 2790 freemsg(mp);
2792 2791 return;
2793 2792 case TCPS_SYN_RCVD:
2794 2793 if (flags & TH_ACK) {
2795 2794 uint32_t pinit_wnd;
2796 2795
2797 2796 /*
2798 2797 * In this state, a SYN|ACK packet is either bogus
2799 2798 * because the other side must be ACKing our SYN which
2800 2799 * indicates it has seen the ACK for their SYN and
2801 2800 * shouldn't retransmit it or we're crossing SYNs
2802 2801 * on active open.
2803 2802 */
2804 2803 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2805 2804 freemsg(mp);
2806 2805 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2807 2806 tcp, seg_ack, 0, TH_RST);
2808 2807 return;
2809 2808 }
2810 2809 /*
2811 2810 * NOTE: RFC 793 pg. 72 says this should be
2812 2811 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2813 2812 * but that would mean we have an ack that ignored
2814 2813 * our SYN.
2815 2814 */
2816 2815 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2817 2816 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2818 2817 freemsg(mp);
2819 2818 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2820 2819 tcp, seg_ack, 0, TH_RST);
2821 2820 return;
2822 2821 }
2823 2822 /*
2824 2823 * No sane TCP stack will send such a small window
2825 2824 * without receiving any data. Just drop this invalid
2826 2825 * ACK. We also shorten the abort timeout in case
2827 2826 * this is an attack.
2828 2827 */
2829 2828 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2830 2829 if (pinit_wnd < tcp->tcp_mss &&
2831 2830 pinit_wnd < tcp_init_wnd_chk) {
2832 2831 freemsg(mp);
2833 2832 TCP_STAT(tcps, tcp_zwin_ack_syn);
2834 2833 tcp->tcp_second_ctimer_threshold =
2835 2834 tcp_early_abort * SECONDS;
2836 2835 return;
2837 2836 }
2838 2837 }
2839 2838 break;
2840 2839 case TCPS_LISTEN:
2841 2840 /*
2842 2841 * Only a TLI listener can come through this path when a
2843 2842 * acceptor is going back to be a listener and a packet
2844 2843 * for the acceptor hits the classifier. For a socket
2845 2844 * listener, this can never happen because a listener
2846 2845 * can never accept connection on itself and hence a
2847 2846 * socket acceptor can not go back to being a listener.
2848 2847 */
2849 2848 ASSERT(!TCP_IS_SOCKET(tcp));
2850 2849 /*FALLTHRU*/
2851 2850 case TCPS_CLOSED:
2852 2851 case TCPS_BOUND: {
2853 2852 conn_t *new_connp;
2854 2853 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2855 2854
2856 2855 /*
2857 2856 * Don't accept any input on a closed tcp as this TCP logically
2858 2857 * does not exist on the system. Don't proceed further with
2859 2858 * this TCP. For instance, this packet could trigger another
2860 2859 * close of this tcp which would be disastrous for tcp_refcnt.
2861 2860 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2862 2861 * be called at most once on a TCP. In this case we need to
2863 2862 * refeed the packet into the classifier and figure out where
2864 2863 * the packet should go.
2865 2864 */
2866 2865 new_connp = ipcl_classify(mp, ira, ipst);
2867 2866 if (new_connp != NULL) {
2868 2867 /* Drops ref on new_connp */
2869 2868 tcp_reinput(new_connp, mp, ira, ipst);
2870 2869 return;
2871 2870 }
2872 2871 /* We failed to classify. For now just drop the packet */
2873 2872 freemsg(mp);
2874 2873 return;
2875 2874 }
2876 2875 case TCPS_IDLE:
2877 2876 /*
2878 2877 * Handle the case where the tcp_clean_death() has happened
2879 2878 * on a connection (application hasn't closed yet) but a packet
2880 2879 * was already queued on squeue before tcp_clean_death()
2881 2880 * was processed. Calling tcp_clean_death() twice on same
2882 2881 * connection can result in weird behaviour.
2883 2882 */
2884 2883 freemsg(mp);
2885 2884 return;
2886 2885 default:
2887 2886 break;
2888 2887 }
2889 2888
2890 2889 /*
2891 2890 * Already on the correct queue/perimeter.
2892 2891 * If this is a detached connection and not an eager
2893 2892 * connection hanging off a listener then new data
2894 2893 * (past the FIN) will cause a reset.
2895 2894 * We do a special check here where it
2896 2895 * is out of the main line, rather than check
2897 2896 * if we are detached every time we see new
2898 2897 * data down below.
2899 2898 */
2900 2899 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2901 2900 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2902 2901 TCPS_BUMP_MIB(tcps, tcpInClosed);
2903 2902 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2904 2903 freemsg(mp);
2905 2904 tcp_xmit_ctl("new data when detached", tcp,
2906 2905 tcp->tcp_snxt, 0, TH_RST);
2907 2906 (void) tcp_clean_death(tcp, EPROTO);
2908 2907 return;
2909 2908 }
2910 2909
2911 2910 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2912 2911 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2913 2912 new_swnd = ntohs(tcpha->tha_win) <<
2914 2913 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2915 2914
2916 2915 if (tcp->tcp_snd_ts_ok) {
2917 2916 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
2918 2917 /*
2919 2918 * This segment is not acceptable.
2920 2919 * Drop it and send back an ACK.
2921 2920 */
2922 2921 freemsg(mp);
2923 2922 flags |= TH_ACK_NEEDED;
2924 2923 goto ack_check;
2925 2924 }
2926 2925 } else if (tcp->tcp_snd_sack_ok) {
2927 2926 tcpopt.tcp = tcp;
2928 2927 /*
2929 2928 * SACK info in already updated in tcp_parse_options. Ignore
2930 2929 * all other TCP options...
2931 2930 */
2932 2931 (void) tcp_parse_options(tcpha, &tcpopt);
2933 2932 }
2934 2933 try_again:;
2935 2934 mss = tcp->tcp_mss;
2936 2935 gap = seg_seq - tcp->tcp_rnxt;
2937 2936 rgap = tcp->tcp_rwnd - (gap + seg_len);
2938 2937 /*
2939 2938 * gap is the amount of sequence space between what we expect to see
2940 2939 * and what we got for seg_seq. A positive value for gap means
2941 2940 * something got lost. A negative value means we got some old stuff.
2942 2941 */
2943 2942 if (gap < 0) {
2944 2943 /* Old stuff present. Is the SYN in there? */
2945 2944 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2946 2945 (seg_len != 0)) {
2947 2946 flags &= ~TH_SYN;
2948 2947 seg_seq++;
2949 2948 urp--;
2950 2949 /* Recompute the gaps after noting the SYN. */
2951 2950 goto try_again;
2952 2951 }
2953 2952 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2954 2953 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2955 2954 (seg_len > -gap ? -gap : seg_len));
2956 2955 /* Remove the old stuff from seg_len. */
2957 2956 seg_len += gap;
2958 2957 /*
2959 2958 * Anything left?
2960 2959 * Make sure to check for unack'd FIN when rest of data
2961 2960 * has been previously ack'd.
2962 2961 */
2963 2962 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2964 2963 /*
2965 2964 * Resets are only valid if they lie within our offered
2966 2965 * window. If the RST bit is set, we just ignore this
2967 2966 * segment.
2968 2967 */
2969 2968 if (flags & TH_RST) {
2970 2969 freemsg(mp);
2971 2970 return;
2972 2971 }
2973 2972
2974 2973 /*
2975 2974 * The arriving of dup data packets indicate that we
2976 2975 * may have postponed an ack for too long, or the other
2977 2976 * side's RTT estimate is out of shape. Start acking
2978 2977 * more often.
2979 2978 */
2980 2979 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2981 2980 tcp->tcp_rack_cnt >= 1 &&
2982 2981 tcp->tcp_rack_abs_max > 2) {
2983 2982 tcp->tcp_rack_abs_max--;
2984 2983 }
2985 2984 tcp->tcp_rack_cur_max = 1;
2986 2985
2987 2986 /*
2988 2987 * This segment is "unacceptable". None of its
2989 2988 * sequence space lies within our advertized window.
2990 2989 *
2991 2990 * Adjust seg_len to the original value for tracing.
2992 2991 */
2993 2992 seg_len -= gap;
2994 2993 if (connp->conn_debug) {
2995 2994 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2996 2995 "tcp_rput: unacceptable, gap %d, rgap %d, "
2997 2996 "flags 0x%x, seg_seq %u, seg_ack %u, "
2998 2997 "seg_len %d, rnxt %u, snxt %u, %s",
2999 2998 gap, rgap, flags, seg_seq, seg_ack,
3000 2999 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3001 3000 tcp_display(tcp, NULL,
3002 3001 DISP_ADDR_AND_PORT));
3003 3002 }
3004 3003
3005 3004 /*
3006 3005 * Arrange to send an ACK in response to the
3007 3006 * unacceptable segment per RFC 793 page 69. There
3008 3007 * is only one small difference between ours and the
3009 3008 * acceptability test in the RFC - we accept ACK-only
3010 3009 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3011 3010 * will be generated.
3012 3011 *
3013 3012 * Note that we have to ACK an ACK-only packet at least
3014 3013 * for stacks that send 0-length keep-alives with
3015 3014 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3016 3015 * section 4.2.3.6. As long as we don't ever generate
3017 3016 * an unacceptable packet in response to an incoming
3018 3017 * packet that is unacceptable, it should not cause
3019 3018 * "ACK wars".
3020 3019 */
3021 3020 flags |= TH_ACK_NEEDED;
3022 3021
3023 3022 /*
3024 3023 * Continue processing this segment in order to use the
3025 3024 * ACK information it contains, but skip all other
3026 3025 * sequence-number processing. Processing the ACK
3027 3026 * information is necessary in order to
3028 3027 * re-synchronize connections that may have lost
3029 3028 * synchronization.
3030 3029 *
3031 3030 * We clear seg_len and flag fields related to
3032 3031 * sequence number processing as they are not
3033 3032 * to be trusted for an unacceptable segment.
3034 3033 */
3035 3034 seg_len = 0;
3036 3035 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3037 3036 goto process_ack;
3038 3037 }
3039 3038
3040 3039 /* Fix seg_seq, and chew the gap off the front. */
3041 3040 seg_seq = tcp->tcp_rnxt;
3042 3041 urp += gap;
3043 3042 do {
3044 3043 mblk_t *mp2;
3045 3044 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3046 3045 (uintptr_t)UINT_MAX);
3047 3046 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3048 3047 if (gap > 0) {
3049 3048 mp->b_rptr = mp->b_wptr - gap;
3050 3049 break;
3051 3050 }
3052 3051 mp2 = mp;
3053 3052 mp = mp->b_cont;
3054 3053 freeb(mp2);
3055 3054 } while (gap < 0);
3056 3055 /*
3057 3056 * If the urgent data has already been acknowledged, we
3058 3057 * should ignore TH_URG below
3059 3058 */
3060 3059 if (urp < 0)
3061 3060 flags &= ~TH_URG;
3062 3061 }
3063 3062 /*
3064 3063 * rgap is the amount of stuff received out of window. A negative
3065 3064 * value is the amount out of window.
3066 3065 */
3067 3066 if (rgap < 0) {
3068 3067 mblk_t *mp2;
3069 3068
3070 3069 if (tcp->tcp_rwnd == 0) {
3071 3070 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3072 3071 } else {
3073 3072 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3074 3073 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3075 3074 }
3076 3075
3077 3076 /*
3078 3077 * seg_len does not include the FIN, so if more than
3079 3078 * just the FIN is out of window, we act like we don't
3080 3079 * see it. (If just the FIN is out of window, rgap
3081 3080 * will be zero and we will go ahead and acknowledge
3082 3081 * the FIN.)
3083 3082 */
3084 3083 flags &= ~TH_FIN;
3085 3084
3086 3085 /* Fix seg_len and make sure there is something left. */
3087 3086 seg_len += rgap;
3088 3087 if (seg_len <= 0) {
3089 3088 /*
3090 3089 * Resets are only valid if they lie within our offered
3091 3090 * window. If the RST bit is set, we just ignore this
3092 3091 * segment.
3093 3092 */
3094 3093 if (flags & TH_RST) {
3095 3094 freemsg(mp);
3096 3095 return;
3097 3096 }
3098 3097
3099 3098 /* Per RFC 793, we need to send back an ACK. */
3100 3099 flags |= TH_ACK_NEEDED;
3101 3100
3102 3101 /*
3103 3102 * Send SIGURG as soon as possible i.e. even
3104 3103 * if the TH_URG was delivered in a window probe
3105 3104 * packet (which will be unacceptable).
3106 3105 *
3107 3106 * We generate a signal if none has been generated
3108 3107 * for this connection or if this is a new urgent
3109 3108 * byte. Also send a zero-length "unmarked" message
3110 3109 * to inform SIOCATMARK that this is not the mark.
3111 3110 *
3112 3111 * tcp_urp_last_valid is cleared when the T_exdata_ind
3113 3112 * is sent up. This plus the check for old data
3114 3113 * (gap >= 0) handles the wraparound of the sequence
3115 3114 * number space without having to always track the
3116 3115 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3117 3116 * this max in its rcv_up variable).
3118 3117 *
3119 3118 * This prevents duplicate SIGURGS due to a "late"
3120 3119 * zero-window probe when the T_EXDATA_IND has already
3121 3120 * been sent up.
3122 3121 */
3123 3122 if ((flags & TH_URG) &&
3124 3123 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3125 3124 tcp->tcp_urp_last))) {
3126 3125 if (IPCL_IS_NONSTR(connp)) {
3127 3126 if (!TCP_IS_DETACHED(tcp)) {
3128 3127 (*sockupcalls->su_signal_oob)
3129 3128 (connp->conn_upper_handle,
3130 3129 urp);
3131 3130 }
3132 3131 } else {
3133 3132 mp1 = allocb(0, BPRI_MED);
3134 3133 if (mp1 == NULL) {
3135 3134 freemsg(mp);
3136 3135 return;
3137 3136 }
3138 3137 if (!TCP_IS_DETACHED(tcp) &&
3139 3138 !putnextctl1(connp->conn_rq,
3140 3139 M_PCSIG, SIGURG)) {
3141 3140 /* Try again on the rexmit. */
3142 3141 freemsg(mp1);
3143 3142 freemsg(mp);
3144 3143 return;
3145 3144 }
3146 3145 /*
3147 3146 * If the next byte would be the mark
3148 3147 * then mark with MARKNEXT else mark
3149 3148 * with NOTMARKNEXT.
3150 3149 */
3151 3150 if (gap == 0 && urp == 0)
3152 3151 mp1->b_flag |= MSGMARKNEXT;
3153 3152 else
3154 3153 mp1->b_flag |= MSGNOTMARKNEXT;
3155 3154 freemsg(tcp->tcp_urp_mark_mp);
3156 3155 tcp->tcp_urp_mark_mp = mp1;
3157 3156 flags |= TH_SEND_URP_MARK;
3158 3157 }
3159 3158 tcp->tcp_urp_last_valid = B_TRUE;
3160 3159 tcp->tcp_urp_last = urp + seg_seq;
3161 3160 }
3162 3161 /*
3163 3162 * If this is a zero window probe, continue to
3164 3163 * process the ACK part. But we need to set seg_len
3165 3164 * to 0 to avoid data processing. Otherwise just
3166 3165 * drop the segment and send back an ACK.
3167 3166 */
3168 3167 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3169 3168 flags &= ~(TH_SYN | TH_URG);
3170 3169 seg_len = 0;
3171 3170 goto process_ack;
3172 3171 } else {
3173 3172 freemsg(mp);
3174 3173 goto ack_check;
3175 3174 }
3176 3175 }
3177 3176 /* Pitch out of window stuff off the end. */
3178 3177 rgap = seg_len;
3179 3178 mp2 = mp;
3180 3179 do {
3181 3180 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3182 3181 (uintptr_t)INT_MAX);
3183 3182 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3184 3183 if (rgap < 0) {
3185 3184 mp2->b_wptr += rgap;
3186 3185 if ((mp1 = mp2->b_cont) != NULL) {
3187 3186 mp2->b_cont = NULL;
3188 3187 freemsg(mp1);
3189 3188 }
3190 3189 break;
3191 3190 }
3192 3191 } while ((mp2 = mp2->b_cont) != NULL);
3193 3192 }
3194 3193 ok:;
3195 3194 /*
3196 3195 * TCP should check ECN info for segments inside the window only.
3197 3196 * Therefore the check should be done here.
3198 3197 */
3199 3198 if (tcp->tcp_ecn_ok) {
3200 3199 if (flags & TH_CWR) {
3201 3200 tcp->tcp_ecn_echo_on = B_FALSE;
3202 3201 }
3203 3202 /*
3204 3203 * Note that both ECN_CE and CWR can be set in the
3205 3204 * same segment. In this case, we once again turn
3206 3205 * on ECN_ECHO.
3207 3206 */
3208 3207 if (connp->conn_ipversion == IPV4_VERSION) {
3209 3208 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3210 3209
3211 3210 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3212 3211 tcp->tcp_ecn_echo_on = B_TRUE;
3213 3212 }
3214 3213 } else {
3215 3214 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3216 3215
3217 3216 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3218 3217 htonl(IPH_ECN_CE << 20)) {
3219 3218 tcp->tcp_ecn_echo_on = B_TRUE;
3220 3219 }
3221 3220 }
3222 3221 }
3223 3222
3224 3223 /*
3225 3224 * Check whether we can update tcp_ts_recent. This test is
3226 3225 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP
3227 3226 * Extensions for High Performance: An Update", Internet Draft.
3228 3227 */
3229 3228 if (tcp->tcp_snd_ts_ok &&
3230 3229 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3231 3230 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3232 3231 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3233 3232 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3234 3233 }
3235 3234
3236 3235 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3237 3236 /*
3238 3237 * FIN in an out of order segment. We record this in
3239 3238 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3240 3239 * Clear the FIN so that any check on FIN flag will fail.
3241 3240 * Remember that FIN also counts in the sequence number
3242 3241 * space. So we need to ack out of order FIN only segments.
3243 3242 */
3244 3243 if (flags & TH_FIN) {
3245 3244 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3246 3245 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3247 3246 flags &= ~TH_FIN;
3248 3247 flags |= TH_ACK_NEEDED;
3249 3248 }
3250 3249 if (seg_len > 0) {
3251 3250 /* Fill in the SACK blk list. */
3252 3251 if (tcp->tcp_snd_sack_ok) {
3253 3252 tcp_sack_insert(tcp->tcp_sack_list,
3254 3253 seg_seq, seg_seq + seg_len,
3255 3254 &(tcp->tcp_num_sack_blk));
3256 3255 }
3257 3256
3258 3257 /*
3259 3258 * Attempt reassembly and see if we have something
3260 3259 * ready to go.
3261 3260 */
3262 3261 mp = tcp_reass(tcp, mp, seg_seq);
3263 3262 /* Always ack out of order packets */
3264 3263 flags |= TH_ACK_NEEDED | TH_PUSH;
3265 3264 if (mp) {
3266 3265 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3267 3266 (uintptr_t)INT_MAX);
3268 3267 seg_len = mp->b_cont ? msgdsize(mp) :
3269 3268 (int)(mp->b_wptr - mp->b_rptr);
3270 3269 seg_seq = tcp->tcp_rnxt;
3271 3270 /*
3272 3271 * A gap is filled and the seq num and len
3273 3272 * of the gap match that of a previously
3274 3273 * received FIN, put the FIN flag back in.
3275 3274 */
3276 3275 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3277 3276 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3278 3277 flags |= TH_FIN;
3279 3278 tcp->tcp_valid_bits &=
3280 3279 ~TCP_OFO_FIN_VALID;
3281 3280 }
3282 3281 if (tcp->tcp_reass_tid != 0) {
3283 3282 (void) TCP_TIMER_CANCEL(tcp,
3284 3283 tcp->tcp_reass_tid);
3285 3284 /*
3286 3285 * Restart the timer if there is still
3287 3286 * data in the reassembly queue.
3288 3287 */
3289 3288 if (tcp->tcp_reass_head != NULL) {
3290 3289 tcp->tcp_reass_tid = TCP_TIMER(
3291 3290 tcp, tcp_reass_timer,
3292 3291 tcps->tcps_reass_timeout);
3293 3292 } else {
3294 3293 tcp->tcp_reass_tid = 0;
3295 3294 }
3296 3295 }
3297 3296 } else {
3298 3297 /*
3299 3298 * Keep going even with NULL mp.
3300 3299 * There may be a useful ACK or something else
3301 3300 * we don't want to miss.
3302 3301 *
3303 3302 * But TCP should not perform fast retransmit
3304 3303 * because of the ack number. TCP uses
3305 3304 * seg_len == 0 to determine if it is a pure
3306 3305 * ACK. And this is not a pure ACK.
3307 3306 */
3308 3307 seg_len = 0;
3309 3308 ofo_seg = B_TRUE;
3310 3309
3311 3310 if (tcps->tcps_reass_timeout != 0 &&
3312 3311 tcp->tcp_reass_tid == 0) {
3313 3312 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3314 3313 tcp_reass_timer,
3315 3314 tcps->tcps_reass_timeout);
3316 3315 }
3317 3316 }
3318 3317 }
3319 3318 } else if (seg_len > 0) {
3320 3319 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3321 3320 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3322 3321 /*
3323 3322 * If an out of order FIN was received before, and the seq
3324 3323 * num and len of the new segment match that of the FIN,
3325 3324 * put the FIN flag back in.
3326 3325 */
3327 3326 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3328 3327 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3329 3328 flags |= TH_FIN;
3330 3329 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3331 3330 }
3332 3331 }
3333 3332 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3334 3333 if (flags & TH_RST) {
3335 3334 freemsg(mp);
3336 3335 switch (tcp->tcp_state) {
3337 3336 case TCPS_SYN_RCVD:
3338 3337 (void) tcp_clean_death(tcp, ECONNREFUSED);
3339 3338 break;
3340 3339 case TCPS_ESTABLISHED:
3341 3340 case TCPS_FIN_WAIT_1:
3342 3341 case TCPS_FIN_WAIT_2:
3343 3342 case TCPS_CLOSE_WAIT:
3344 3343 (void) tcp_clean_death(tcp, ECONNRESET);
3345 3344 break;
3346 3345 case TCPS_CLOSING:
3347 3346 case TCPS_LAST_ACK:
3348 3347 (void) tcp_clean_death(tcp, 0);
3349 3348 break;
3350 3349 default:
3351 3350 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3352 3351 (void) tcp_clean_death(tcp, ENXIO);
3353 3352 break;
3354 3353 }
3355 3354 return;
3356 3355 }
3357 3356 if (flags & TH_SYN) {
3358 3357 /*
3359 3358 * See RFC 793, Page 71
3360 3359 *
3361 3360 * The seq number must be in the window as it should
3362 3361 * be "fixed" above. If it is outside window, it should
3363 3362 * be already rejected. Note that we allow seg_seq to be
3364 3363 * rnxt + rwnd because we want to accept 0 window probe.
3365 3364 */
3366 3365 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3367 3366 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3368 3367 freemsg(mp);
3369 3368 /*
3370 3369 * If the ACK flag is not set, just use our snxt as the
3371 3370 * seq number of the RST segment.
3372 3371 */
3373 3372 if (!(flags & TH_ACK)) {
3374 3373 seg_ack = tcp->tcp_snxt;
3375 3374 }
3376 3375 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3377 3376 TH_RST|TH_ACK);
3378 3377 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3379 3378 (void) tcp_clean_death(tcp, ECONNRESET);
3380 3379 return;
3381 3380 }
3382 3381 /*
3383 3382 * urp could be -1 when the urp field in the packet is 0
3384 3383 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3385 3384 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3386 3385 */
3387 3386 if (flags & TH_URG && urp >= 0) {
3388 3387 if (!tcp->tcp_urp_last_valid ||
3389 3388 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3390 3389 /*
3391 3390 * Non-STREAMS sockets handle the urgent data a litte
3392 3391 * differently from STREAMS based sockets. There is no
3393 3392 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3394 3393 * flags to keep SIOCATMARK happy. Instead a
3395 3394 * su_signal_oob upcall is made to update the mark.
3396 3395 * Neither is a T_EXDATA_IND mblk needed to be
3397 3396 * prepended to the urgent data. The urgent data is
3398 3397 * delivered using the su_recv upcall, where we set
3399 3398 * the MSG_OOB flag to indicate that it is urg data.
3400 3399 *
3401 3400 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3402 3401 * are used by non-STREAMS sockets.
3403 3402 */
3404 3403 if (IPCL_IS_NONSTR(connp)) {
3405 3404 if (!TCP_IS_DETACHED(tcp)) {
3406 3405 (*sockupcalls->su_signal_oob)
3407 3406 (connp->conn_upper_handle, urp);
3408 3407 }
3409 3408 } else {
3410 3409 /*
3411 3410 * If we haven't generated the signal yet for
3412 3411 * this urgent pointer value, do it now. Also,
3413 3412 * send up a zero-length M_DATA indicating
3414 3413 * whether or not this is the mark. The latter
3415 3414 * is not needed when a T_EXDATA_IND is sent up.
3416 3415 * However, if there are allocation failures
3417 3416 * this code relies on the sender retransmitting
3418 3417 * and the socket code for determining the mark
3419 3418 * should not block waiting for the peer to
3420 3419 * transmit. Thus, for simplicity we always
3421 3420 * send up the mark indication.
3422 3421 */
3423 3422 mp1 = allocb(0, BPRI_MED);
3424 3423 if (mp1 == NULL) {
3425 3424 freemsg(mp);
3426 3425 return;
3427 3426 }
3428 3427 if (!TCP_IS_DETACHED(tcp) &&
3429 3428 !putnextctl1(connp->conn_rq, M_PCSIG,
3430 3429 SIGURG)) {
3431 3430 /* Try again on the rexmit. */
3432 3431 freemsg(mp1);
3433 3432 freemsg(mp);
3434 3433 return;
3435 3434 }
3436 3435 /*
3437 3436 * Mark with NOTMARKNEXT for now.
3438 3437 * The code below will change this to MARKNEXT
3439 3438 * if we are at the mark.
3440 3439 *
3441 3440 * If there are allocation failures (e.g. in
3442 3441 * dupmsg below) the next time tcp_input_data
3443 3442 * sees the urgent segment it will send up the
3444 3443 * MSGMARKNEXT message.
3445 3444 */
3446 3445 mp1->b_flag |= MSGNOTMARKNEXT;
3447 3446 freemsg(tcp->tcp_urp_mark_mp);
3448 3447 tcp->tcp_urp_mark_mp = mp1;
3449 3448 flags |= TH_SEND_URP_MARK;
3450 3449 #ifdef DEBUG
3451 3450 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3452 3451 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3453 3452 "last %x, %s",
3454 3453 seg_seq, urp, tcp->tcp_urp_last,
3455 3454 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3456 3455 #endif /* DEBUG */
3457 3456 }
3458 3457 tcp->tcp_urp_last_valid = B_TRUE;
3459 3458 tcp->tcp_urp_last = urp + seg_seq;
3460 3459 } else if (tcp->tcp_urp_mark_mp != NULL) {
3461 3460 /*
3462 3461 * An allocation failure prevented the previous
3463 3462 * tcp_input_data from sending up the allocated
3464 3463 * MSG*MARKNEXT message - send it up this time
3465 3464 * around.
3466 3465 */
3467 3466 flags |= TH_SEND_URP_MARK;
3468 3467 }
3469 3468
3470 3469 /*
3471 3470 * If the urgent byte is in this segment, make sure that it is
3472 3471 * all by itself. This makes it much easier to deal with the
3473 3472 * possibility of an allocation failure on the T_exdata_ind.
3474 3473 * Note that seg_len is the number of bytes in the segment, and
3475 3474 * urp is the offset into the segment of the urgent byte.
3476 3475 * urp < seg_len means that the urgent byte is in this segment.
3477 3476 */
3478 3477 if (urp < seg_len) {
3479 3478 if (seg_len != 1) {
3480 3479 uint32_t tmp_rnxt;
3481 3480 /*
3482 3481 * Break it up and feed it back in.
3483 3482 * Re-attach the IP header.
3484 3483 */
3485 3484 mp->b_rptr = iphdr;
3486 3485 if (urp > 0) {
3487 3486 /*
3488 3487 * There is stuff before the urgent
3489 3488 * byte.
3490 3489 */
3491 3490 mp1 = dupmsg(mp);
3492 3491 if (!mp1) {
3493 3492 /*
3494 3493 * Trim from urgent byte on.
3495 3494 * The rest will come back.
3496 3495 */
3497 3496 (void) adjmsg(mp,
3498 3497 urp - seg_len);
3499 3498 tcp_input_data(connp,
3500 3499 mp, NULL, ira);
3501 3500 return;
3502 3501 }
3503 3502 (void) adjmsg(mp1, urp - seg_len);
3504 3503 /* Feed this piece back in. */
3505 3504 tmp_rnxt = tcp->tcp_rnxt;
3506 3505 tcp_input_data(connp, mp1, NULL, ira);
3507 3506 /*
3508 3507 * If the data passed back in was not
3509 3508 * processed (ie: bad ACK) sending
3510 3509 * the remainder back in will cause a
3511 3510 * loop. In this case, drop the
3512 3511 * packet and let the sender try
3513 3512 * sending a good packet.
3514 3513 */
3515 3514 if (tmp_rnxt == tcp->tcp_rnxt) {
3516 3515 freemsg(mp);
3517 3516 return;
3518 3517 }
3519 3518 }
3520 3519 if (urp != seg_len - 1) {
3521 3520 uint32_t tmp_rnxt;
3522 3521 /*
3523 3522 * There is stuff after the urgent
3524 3523 * byte.
3525 3524 */
3526 3525 mp1 = dupmsg(mp);
3527 3526 if (!mp1) {
3528 3527 /*
3529 3528 * Trim everything beyond the
3530 3529 * urgent byte. The rest will
3531 3530 * come back.
3532 3531 */
3533 3532 (void) adjmsg(mp,
3534 3533 urp + 1 - seg_len);
3535 3534 tcp_input_data(connp,
3536 3535 mp, NULL, ira);
3537 3536 return;
3538 3537 }
3539 3538 (void) adjmsg(mp1, urp + 1 - seg_len);
3540 3539 tmp_rnxt = tcp->tcp_rnxt;
3541 3540 tcp_input_data(connp, mp1, NULL, ira);
3542 3541 /*
3543 3542 * If the data passed back in was not
3544 3543 * processed (ie: bad ACK) sending
3545 3544 * the remainder back in will cause a
3546 3545 * loop. In this case, drop the
3547 3546 * packet and let the sender try
3548 3547 * sending a good packet.
3549 3548 */
3550 3549 if (tmp_rnxt == tcp->tcp_rnxt) {
3551 3550 freemsg(mp);
3552 3551 return;
3553 3552 }
3554 3553 }
3555 3554 tcp_input_data(connp, mp, NULL, ira);
3556 3555 return;
3557 3556 }
3558 3557 /*
3559 3558 * This segment contains only the urgent byte. We
3560 3559 * have to allocate the T_exdata_ind, if we can.
3561 3560 */
3562 3561 if (IPCL_IS_NONSTR(connp)) {
3563 3562 int error;
3564 3563
3565 3564 (*sockupcalls->su_recv)
3566 3565 (connp->conn_upper_handle, mp, seg_len,
3567 3566 MSG_OOB, &error, NULL);
3568 3567 /*
3569 3568 * We should never be in middle of a
3570 3569 * fallback, the squeue guarantees that.
3571 3570 */
3572 3571 ASSERT(error != EOPNOTSUPP);
3573 3572 mp = NULL;
3574 3573 goto update_ack;
3575 3574 } else if (!tcp->tcp_urp_mp) {
3576 3575 struct T_exdata_ind *tei;
3577 3576 mp1 = allocb(sizeof (struct T_exdata_ind),
3578 3577 BPRI_MED);
3579 3578 if (!mp1) {
3580 3579 /*
3581 3580 * Sigh... It'll be back.
3582 3581 * Generate any MSG*MARK message now.
3583 3582 */
3584 3583 freemsg(mp);
3585 3584 seg_len = 0;
3586 3585 if (flags & TH_SEND_URP_MARK) {
3587 3586
3588 3587
3589 3588 ASSERT(tcp->tcp_urp_mark_mp);
3590 3589 tcp->tcp_urp_mark_mp->b_flag &=
3591 3590 ~MSGNOTMARKNEXT;
3592 3591 tcp->tcp_urp_mark_mp->b_flag |=
3593 3592 MSGMARKNEXT;
3594 3593 }
3595 3594 goto ack_check;
3596 3595 }
3597 3596 mp1->b_datap->db_type = M_PROTO;
3598 3597 tei = (struct T_exdata_ind *)mp1->b_rptr;
3599 3598 tei->PRIM_type = T_EXDATA_IND;
3600 3599 tei->MORE_flag = 0;
3601 3600 mp1->b_wptr = (uchar_t *)&tei[1];
3602 3601 tcp->tcp_urp_mp = mp1;
3603 3602 #ifdef DEBUG
3604 3603 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3605 3604 "tcp_rput: allocated exdata_ind %s",
3606 3605 tcp_display(tcp, NULL,
3607 3606 DISP_PORT_ONLY));
3608 3607 #endif /* DEBUG */
3609 3608 /*
3610 3609 * There is no need to send a separate MSG*MARK
3611 3610 * message since the T_EXDATA_IND will be sent
3612 3611 * now.
3613 3612 */
3614 3613 flags &= ~TH_SEND_URP_MARK;
3615 3614 freemsg(tcp->tcp_urp_mark_mp);
3616 3615 tcp->tcp_urp_mark_mp = NULL;
3617 3616 }
3618 3617 /*
3619 3618 * Now we are all set. On the next putnext upstream,
3620 3619 * tcp_urp_mp will be non-NULL and will get prepended
3621 3620 * to what has to be this piece containing the urgent
3622 3621 * byte. If for any reason we abort this segment below,
3623 3622 * if it comes back, we will have this ready, or it
3624 3623 * will get blown off in close.
3625 3624 */
3626 3625 } else if (urp == seg_len) {
3627 3626 /*
3628 3627 * The urgent byte is the next byte after this sequence
3629 3628 * number. If this endpoint is non-STREAMS, then there
3630 3629 * is nothing to do here since the socket has already
3631 3630 * been notified about the urg pointer by the
3632 3631 * su_signal_oob call above.
3633 3632 *
3634 3633 * In case of STREAMS, some more work might be needed.
3635 3634 * If there is data it is marked with MSGMARKNEXT and
3636 3635 * and any tcp_urp_mark_mp is discarded since it is not
3637 3636 * needed. Otherwise, if the code above just allocated
3638 3637 * a zero-length tcp_urp_mark_mp message, that message
3639 3638 * is tagged with MSGMARKNEXT. Sending up these
3640 3639 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3641 3640 * even though the T_EXDATA_IND will not be sent up
3642 3641 * until the urgent byte arrives.
3643 3642 */
3644 3643 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3645 3644 if (seg_len != 0) {
3646 3645 flags |= TH_MARKNEXT_NEEDED;
3647 3646 freemsg(tcp->tcp_urp_mark_mp);
3648 3647 tcp->tcp_urp_mark_mp = NULL;
3649 3648 flags &= ~TH_SEND_URP_MARK;
3650 3649 } else if (tcp->tcp_urp_mark_mp != NULL) {
3651 3650 flags |= TH_SEND_URP_MARK;
3652 3651 tcp->tcp_urp_mark_mp->b_flag &=
3653 3652 ~MSGNOTMARKNEXT;
3654 3653 tcp->tcp_urp_mark_mp->b_flag |=
3655 3654 MSGMARKNEXT;
3656 3655 }
3657 3656 }
3658 3657 #ifdef DEBUG
3659 3658 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3660 3659 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3661 3660 seg_len, flags,
3662 3661 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3663 3662 #endif /* DEBUG */
3664 3663 }
3665 3664 #ifdef DEBUG
3666 3665 else {
3667 3666 /* Data left until we hit mark */
3668 3667 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3669 3668 "tcp_rput: URP %d bytes left, %s",
3670 3669 urp - seg_len, tcp_display(tcp, NULL,
3671 3670 DISP_PORT_ONLY));
3672 3671 }
3673 3672 #endif /* DEBUG */
3674 3673 }
3675 3674
3676 3675 process_ack:
3677 3676 if (!(flags & TH_ACK)) {
3678 3677 freemsg(mp);
3679 3678 goto xmit_check;
3680 3679 }
3681 3680 }
3682 3681 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3683 3682
3684 3683 if (bytes_acked > 0)
3685 3684 tcp->tcp_ip_forward_progress = B_TRUE;
3686 3685 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3687 3686 /*
3688 3687 * tcp_sendmsg() checks tcp_state without entering
3689 3688 * the squeue so tcp_state should be updated before
3690 3689 * sending up a connection confirmation or a new
3691 3690 * connection indication.
3692 3691 */
3693 3692 tcp->tcp_state = TCPS_ESTABLISHED;
3694 3693
3695 3694 /*
3696 3695 * We are seeing the final ack in the three way
3697 3696 * hand shake of a active open'ed connection
3698 3697 * so we must send up a T_CONN_CON
3699 3698 */
3700 3699 if (tcp->tcp_active_open) {
3701 3700 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3702 3701 freemsg(mp);
3703 3702 tcp->tcp_state = TCPS_SYN_RCVD;
3704 3703 return;
3705 3704 }
3706 3705 /*
3707 3706 * Don't fuse the loopback endpoints for
3708 3707 * simultaneous active opens.
3709 3708 */
3710 3709 if (tcp->tcp_loopback) {
3711 3710 TCP_STAT(tcps, tcp_fusion_unfusable);
3712 3711 tcp->tcp_unfusable = B_TRUE;
3713 3712 }
3714 3713 /*
3715 3714 * For simultaneous active open, trace receipt of final
3716 3715 * ACK as tcp:::connect-established.
3717 3716 */
3718 3717 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3719 3718 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3720 3719 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3721 3720 } else if (IPCL_IS_NONSTR(connp)) {
3722 3721 /*
3723 3722 * 3-way handshake has completed, so notify socket
3724 3723 * of the new connection.
3725 3724 *
3726 3725 * We are here means eager is fine but it can
3727 3726 * get a TH_RST at any point between now and till
3728 3727 * accept completes and disappear. We need to
3729 3728 * ensure that reference to eager is valid after
3730 3729 * we get out of eager's perimeter. So we do
3731 3730 * an extra refhold.
3732 3731 */
3733 3732 CONN_INC_REF(connp);
3734 3733
3735 3734 if (!tcp_newconn_notify(tcp, ira)) {
3736 3735 /*
3737 3736 * The state-change probe for SYN_RCVD ->
3738 3737 * ESTABLISHED has not fired yet. We reset
3739 3738 * the state to SYN_RCVD so that future
3740 3739 * state-change probes report correct state
3741 3740 * transistions.
3742 3741 */
3743 3742 tcp->tcp_state = TCPS_SYN_RCVD;
3744 3743 freemsg(mp);
3745 3744 /* notification did not go up, so drop ref */
3746 3745 CONN_DEC_REF(connp);
3747 3746 /* ... and close the eager */
3748 3747 ASSERT(TCP_IS_DETACHED(tcp));
3749 3748 (void) tcp_close_detached(tcp);
3750 3749 return;
3751 3750 }
3752 3751 /*
3753 3752 * tcp_newconn_notify() changes conn_upcalls and
3754 3753 * connp->conn_upper_handle. Fix things now, in case
3755 3754 * there's data attached to this ack.
3756 3755 */
3757 3756 if (connp->conn_upcalls != NULL)
3758 3757 sockupcalls = connp->conn_upcalls;
3759 3758 /*
3760 3759 * For passive open, trace receipt of final ACK as
3761 3760 * tcp:::accept-established.
3762 3761 */
3763 3762 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3764 3763 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3765 3764 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3766 3765 } else {
3767 3766 /*
3768 3767 * 3-way handshake complete - this is a STREAMS based
3769 3768 * socket, so pass up the T_CONN_IND.
3770 3769 */
3771 3770 tcp_t *listener = tcp->tcp_listener;
3772 3771 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3773 3772
3774 3773 tcp->tcp_tconnind_started = B_TRUE;
3775 3774 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3776 3775 ASSERT(mp != NULL);
3777 3776 /*
3778 3777 * We are here means eager is fine but it can
3779 3778 * get a TH_RST at any point between now and till
3780 3779 * accept completes and disappear. We need to
3781 3780 * ensure that reference to eager is valid after
3782 3781 * we get out of eager's perimeter. So we do
3783 3782 * an extra refhold.
3784 3783 */
3785 3784 CONN_INC_REF(connp);
3786 3785
3787 3786 /*
3788 3787 * The listener also exists because of the refhold
3789 3788 * done in tcp_input_listener. Its possible that it
3790 3789 * might have closed. We will check that once we
3791 3790 * get inside listeners context.
3792 3791 */
3793 3792 CONN_INC_REF(listener->tcp_connp);
3794 3793 if (listener->tcp_connp->conn_sqp ==
3795 3794 connp->conn_sqp) {
3796 3795 /*
3797 3796 * We optimize by not calling an SQUEUE_ENTER
3798 3797 * on the listener since we know that the
3799 3798 * listener and eager squeues are the same.
3800 3799 * We are able to make this check safely only
3801 3800 * because neither the eager nor the listener
3802 3801 * can change its squeue. Only an active connect
3803 3802 * can change its squeue
3804 3803 */
3805 3804 tcp_send_conn_ind(listener->tcp_connp, mp,
3806 3805 listener->tcp_connp->conn_sqp);
3807 3806 CONN_DEC_REF(listener->tcp_connp);
3808 3807 } else if (!tcp->tcp_loopback) {
3809 3808 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3810 3809 mp, tcp_send_conn_ind,
3811 3810 listener->tcp_connp, NULL, SQ_FILL,
3812 3811 SQTAG_TCP_CONN_IND);
3813 3812 } else {
3814 3813 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3815 3814 mp, tcp_send_conn_ind,
3816 3815 listener->tcp_connp, NULL, SQ_NODRAIN,
3817 3816 SQTAG_TCP_CONN_IND);
3818 3817 }
3819 3818 /*
3820 3819 * For passive open, trace receipt of final ACK as
3821 3820 * tcp:::accept-established.
3822 3821 */
3823 3822 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3824 3823 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3825 3824 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3826 3825 }
3827 3826 TCPS_CONN_INC(tcps);
3828 3827
3829 3828 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3830 3829 bytes_acked--;
3831 3830 /* SYN was acked - making progress */
3832 3831 tcp->tcp_ip_forward_progress = B_TRUE;
|
↓ open down ↓ |
1174 lines elided |
↑ open up ↑ |
3833 3832
3834 3833 /*
3835 3834 * If SYN was retransmitted, need to reset all
3836 3835 * retransmission info as this segment will be
3837 3836 * treated as a dup ACK.
3838 3837 */
3839 3838 if (tcp->tcp_rexmit) {
3840 3839 tcp->tcp_rexmit = B_FALSE;
3841 3840 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3842 3841 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3843 - tcp->tcp_snd_burst = tcp->tcp_localnet ?
3844 - TCP_CWND_INFINITE : TCP_CWND_NORMAL;
3845 3842 tcp->tcp_ms_we_have_waited = 0;
3846 3843 tcp->tcp_cwnd = mss;
3847 3844 }
3848 3845
3849 3846 /*
3850 3847 * We set the send window to zero here.
3851 3848 * This is needed if there is data to be
3852 3849 * processed already on the queue.
3853 3850 * Later (at swnd_update label), the
3854 3851 * "new_swnd > tcp_swnd" condition is satisfied
3855 3852 * the XMIT_NEEDED flag is set in the current
3856 3853 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3857 3854 * called if there is already data on queue in
3858 3855 * this state.
3859 3856 */
3860 3857 tcp->tcp_swnd = 0;
3861 3858
3862 3859 if (new_swnd > tcp->tcp_max_swnd)
3863 3860 tcp->tcp_max_swnd = new_swnd;
3864 3861 tcp->tcp_swl1 = seg_seq;
3865 3862 tcp->tcp_swl2 = seg_ack;
3866 3863 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3867 3864
3868 3865 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3869 3866 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3870 3867 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3871 3868 int32_t, TCPS_SYN_RCVD);
3872 3869
3873 3870 /* Fuse when both sides are in ESTABLISHED state */
3874 3871 if (tcp->tcp_loopback && do_tcp_fusion)
3875 3872 tcp_fuse(tcp, iphdr, tcpha);
3876 3873
3877 3874 }
3878 3875 /* This code follows 4.4BSD-Lite2 mostly. */
3879 3876 if (bytes_acked < 0)
3880 3877 goto est;
3881 3878
3882 3879 /*
3883 3880 * If TCP is ECN capable and the congestion experience bit is
3884 3881 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3885 3882 * done once per window (or more loosely, per RTT).
3886 3883 */
3887 3884 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3888 3885 tcp->tcp_cwr = B_FALSE;
3889 3886 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3890 3887 if (!tcp->tcp_cwr) {
3891 3888 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3892 3889 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3893 3890 tcp->tcp_cwnd = npkt * mss;
3894 3891 /*
3895 3892 * If the cwnd is 0, use the timer to clock out
3896 3893 * new segments. This is required by the ECN spec.
3897 3894 */
3898 3895 if (npkt == 0) {
3899 3896 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3900 3897 /*
3901 3898 * This makes sure that when the ACK comes
3902 3899 * back, we will increase tcp_cwnd by 1 MSS.
3903 3900 */
3904 3901 tcp->tcp_cwnd_cnt = 0;
3905 3902 }
3906 3903 tcp->tcp_cwr = B_TRUE;
3907 3904 /*
3908 3905 * This marks the end of the current window of in
3909 3906 * flight data. That is why we don't use
3910 3907 * tcp_suna + tcp_swnd. Only data in flight can
3911 3908 * provide ECN info.
3912 3909 */
3913 3910 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3914 3911 tcp->tcp_ecn_cwr_sent = B_FALSE;
3915 3912 }
3916 3913 }
3917 3914
3918 3915 mp1 = tcp->tcp_xmit_head;
3919 3916 if (bytes_acked == 0) {
3920 3917 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3921 3918 int dupack_cnt;
3922 3919
3923 3920 TCPS_BUMP_MIB(tcps, tcpInDupAck);
3924 3921 /*
3925 3922 * Fast retransmit. When we have seen exactly three
3926 3923 * identical ACKs while we have unacked data
3927 3924 * outstanding we take it as a hint that our peer
3928 3925 * dropped something.
3929 3926 *
3930 3927 * If TCP is retransmitting, don't do fast retransmit.
3931 3928 */
3932 3929 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3933 3930 ! tcp->tcp_rexmit) {
3934 3931 /* Do Limited Transmit */
3935 3932 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3936 3933 tcps->tcps_dupack_fast_retransmit) {
3937 3934 /*
3938 3935 * RFC 3042
3939 3936 *
3940 3937 * What we need to do is temporarily
3941 3938 * increase tcp_cwnd so that new
3942 3939 * data can be sent if it is allowed
3943 3940 * by the receive window (tcp_rwnd).
3944 3941 * tcp_wput_data() will take care of
3945 3942 * the rest.
3946 3943 *
3947 3944 * If the connection is SACK capable,
3948 3945 * only do limited xmit when there
3949 3946 * is SACK info.
3950 3947 *
3951 3948 * Note how tcp_cwnd is incremented.
3952 3949 * The first dup ACK will increase
3953 3950 * it by 1 MSS. The second dup ACK
3954 3951 * will increase it by 2 MSS. This
3955 3952 * means that only 1 new segment will
3956 3953 * be sent for each dup ACK.
3957 3954 */
3958 3955 if (tcp->tcp_unsent > 0 &&
3959 3956 (!tcp->tcp_snd_sack_ok ||
3960 3957 (tcp->tcp_snd_sack_ok &&
3961 3958 tcp->tcp_notsack_list != NULL))) {
3962 3959 tcp->tcp_cwnd += mss <<
3963 3960 (tcp->tcp_dupack_cnt - 1);
3964 3961 flags |= TH_LIMIT_XMIT;
3965 3962 }
3966 3963 } else if (dupack_cnt ==
3967 3964 tcps->tcps_dupack_fast_retransmit) {
3968 3965
3969 3966 /*
3970 3967 * If we have reduced tcp_ssthresh
3971 3968 * because of ECN, do not reduce it again
3972 3969 * unless it is already one window of data
3973 3970 * away. After one window of data, tcp_cwr
3974 3971 * should then be cleared. Note that
3975 3972 * for non ECN capable connection, tcp_cwr
3976 3973 * should always be false.
3977 3974 *
3978 3975 * Adjust cwnd since the duplicate
3979 3976 * ack indicates that a packet was
3980 3977 * dropped (due to congestion.)
3981 3978 */
3982 3979 if (!tcp->tcp_cwr) {
3983 3980 npkt = ((tcp->tcp_snxt -
3984 3981 tcp->tcp_suna) >> 1) / mss;
3985 3982 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3986 3983 mss;
3987 3984 tcp->tcp_cwnd = (npkt +
3988 3985 tcp->tcp_dupack_cnt) * mss;
3989 3986 }
3990 3987 if (tcp->tcp_ecn_ok) {
3991 3988 tcp->tcp_cwr = B_TRUE;
3992 3989 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3993 3990 tcp->tcp_ecn_cwr_sent = B_FALSE;
3994 3991 }
3995 3992
3996 3993 /*
3997 3994 * We do Hoe's algorithm. Refer to her
3998 3995 * paper "Improving the Start-up Behavior
3999 3996 * of a Congestion Control Scheme for TCP,"
4000 3997 * appeared in SIGCOMM'96.
4001 3998 *
4002 3999 * Save highest seq no we have sent so far.
|
↓ open down ↓ |
148 lines elided |
↑ open up ↑ |
4003 4000 * Be careful about the invisible FIN byte.
4004 4001 */
4005 4002 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
4006 4003 (tcp->tcp_unsent == 0)) {
4007 4004 tcp->tcp_rexmit_max = tcp->tcp_fss;
4008 4005 } else {
4009 4006 tcp->tcp_rexmit_max = tcp->tcp_snxt;
4010 4007 }
4011 4008
4012 4009 /*
4013 - * Do not allow bursty traffic during.
4014 - * fast recovery. Refer to Fall and Floyd's
4015 - * paper "Simulation-based Comparisons of
4016 - * Tahoe, Reno and SACK TCP" (in CCR?)
4017 - * This is a best current practise.
4018 - */
4019 - tcp->tcp_snd_burst = TCP_CWND_SS;
4020 -
4021 - /*
4022 4010 * For SACK:
4023 4011 * Calculate tcp_pipe, which is the
4024 4012 * estimated number of bytes in
4025 4013 * network.
4026 4014 *
4027 4015 * tcp_fack is the highest sack'ed seq num
4028 4016 * TCP has received.
4029 4017 *
4030 4018 * tcp_pipe is explained in the above quoted
4031 4019 * Fall and Floyd's paper. tcp_fack is
4032 4020 * explained in Mathis and Mahdavi's
4033 4021 * "Forward Acknowledgment: Refining TCP
4034 4022 * Congestion Control" in SIGCOMM '96.
4035 4023 */
4036 4024 if (tcp->tcp_snd_sack_ok) {
4037 4025 if (tcp->tcp_notsack_list != NULL) {
4038 4026 tcp->tcp_pipe = tcp->tcp_snxt -
4039 4027 tcp->tcp_fack;
4040 4028 tcp->tcp_sack_snxt = seg_ack;
4041 4029 flags |= TH_NEED_SACK_REXMIT;
4042 4030 } else {
4043 4031 /*
4044 4032 * Always initialize tcp_pipe
4045 4033 * even though we don't have
4046 4034 * any SACK info. If later
4047 4035 * we get SACK info and
4048 4036 * tcp_pipe is not initialized,
4049 4037 * funny things will happen.
4050 4038 */
4051 4039 tcp->tcp_pipe =
4052 4040 tcp->tcp_cwnd_ssthresh;
4053 4041 }
4054 4042 } else {
4055 4043 flags |= TH_REXMIT_NEEDED;
4056 4044 } /* tcp_snd_sack_ok */
4057 4045
4058 4046 } else {
4059 4047 /*
4060 4048 * Here we perform congestion
4061 4049 * avoidance, but NOT slow start.
4062 4050 * This is known as the Fast
4063 4051 * Recovery Algorithm.
4064 4052 */
4065 4053 if (tcp->tcp_snd_sack_ok &&
4066 4054 tcp->tcp_notsack_list != NULL) {
4067 4055 flags |= TH_NEED_SACK_REXMIT;
4068 4056 tcp->tcp_pipe -= mss;
4069 4057 if (tcp->tcp_pipe < 0)
4070 4058 tcp->tcp_pipe = 0;
4071 4059 } else {
4072 4060 /*
4073 4061 * We know that one more packet has
4074 4062 * left the pipe thus we can update
4075 4063 * cwnd.
4076 4064 */
4077 4065 cwnd = tcp->tcp_cwnd + mss;
4078 4066 if (cwnd > tcp->tcp_cwnd_max)
4079 4067 cwnd = tcp->tcp_cwnd_max;
4080 4068 tcp->tcp_cwnd = cwnd;
4081 4069 if (tcp->tcp_unsent > 0)
4082 4070 flags |= TH_XMIT_NEEDED;
4083 4071 }
4084 4072 }
4085 4073 }
4086 4074 } else if (tcp->tcp_zero_win_probe) {
4087 4075 /*
4088 4076 * If the window has opened, need to arrange
4089 4077 * to send additional data.
4090 4078 */
4091 4079 if (new_swnd != 0) {
4092 4080 /* tcp_suna != tcp_snxt */
4093 4081 /* Packet contains a window update */
4094 4082 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4095 4083 tcp->tcp_zero_win_probe = 0;
4096 4084 tcp->tcp_timer_backoff = 0;
4097 4085 tcp->tcp_ms_we_have_waited = 0;
4098 4086
4099 4087 /*
4100 4088 * Transmit starting with tcp_suna since
4101 4089 * the one byte probe is not ack'ed.
4102 4090 * If TCP has sent more than one identical
4103 4091 * probe, tcp_rexmit will be set. That means
4104 4092 * tcp_ss_rexmit() will send out the one
4105 4093 * byte along with new data. Otherwise,
4106 4094 * fake the retransmission.
4107 4095 */
4108 4096 flags |= TH_XMIT_NEEDED;
4109 4097 if (!tcp->tcp_rexmit) {
4110 4098 tcp->tcp_rexmit = B_TRUE;
4111 4099 tcp->tcp_dupack_cnt = 0;
4112 4100 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4113 4101 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4114 4102 }
4115 4103 }
4116 4104 }
4117 4105 goto swnd_update;
4118 4106 }
4119 4107
4120 4108 /*
4121 4109 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4122 4110 * If the ACK value acks something that we have not yet sent, it might
4123 4111 * be an old duplicate segment. Send an ACK to re-synchronize the
4124 4112 * other side.
4125 4113 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4126 4114 * state is handled above, so we can always just drop the segment and
4127 4115 * send an ACK here.
4128 4116 *
4129 4117 * In the case where the peer shrinks the window, we see the new window
4130 4118 * update, but all the data sent previously is queued up by the peer.
4131 4119 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4132 4120 * number, which was already sent, and within window, is recorded.
4133 4121 * tcp_snxt is then updated.
4134 4122 *
4135 4123 * If the window has previously shrunk, and an ACK for data not yet
4136 4124 * sent, according to tcp_snxt is recieved, it may still be valid. If
4137 4125 * the ACK is for data within the window at the time the window was
4138 4126 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4139 4127 * the sequence number ACK'ed.
4140 4128 *
4141 4129 * If the ACK covers all the data sent at the time the window was
4142 4130 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4143 4131 *
4144 4132 * Should we send ACKs in response to ACK only segments?
4145 4133 */
4146 4134
4147 4135 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4148 4136 if ((tcp->tcp_is_wnd_shrnk) &&
4149 4137 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4150 4138 uint32_t data_acked_ahead_snxt;
4151 4139
4152 4140 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4153 4141 tcp_update_xmit_tail(tcp, seg_ack);
4154 4142 tcp->tcp_unsent -= data_acked_ahead_snxt;
4155 4143 } else {
4156 4144 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4157 4145 /* drop the received segment */
4158 4146 freemsg(mp);
4159 4147
4160 4148 /*
4161 4149 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4162 4150 * greater than 0, check if the number of such
4163 4151 * bogus ACks is greater than that count. If yes,
4164 4152 * don't send back any ACK. This prevents TCP from
4165 4153 * getting into an ACK storm if somehow an attacker
4166 4154 * successfully spoofs an acceptable segment to our
4167 4155 * peer. If this continues (count > 2 X threshold),
4168 4156 * we should abort this connection.
4169 4157 */
4170 4158 if (tcp_drop_ack_unsent_cnt > 0 &&
4171 4159 ++tcp->tcp_in_ack_unsent >
4172 4160 tcp_drop_ack_unsent_cnt) {
4173 4161 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4174 4162 if (tcp->tcp_in_ack_unsent > 2 *
4175 4163 tcp_drop_ack_unsent_cnt) {
4176 4164 (void) tcp_clean_death(tcp, EPROTO);
4177 4165 }
4178 4166 return;
4179 4167 }
4180 4168 mp = tcp_ack_mp(tcp);
4181 4169 if (mp != NULL) {
4182 4170 BUMP_LOCAL(tcp->tcp_obsegs);
4183 4171 TCPS_BUMP_MIB(tcps, tcpOutAck);
4184 4172 tcp_send_data(tcp, mp);
4185 4173 }
4186 4174 return;
4187 4175 }
4188 4176 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4189 4177 tcp->tcp_snxt_shrunk)) {
4190 4178 tcp->tcp_is_wnd_shrnk = B_FALSE;
4191 4179 }
4192 4180
4193 4181 /*
4194 4182 * TCP gets a new ACK, update the notsack'ed list to delete those
4195 4183 * blocks that are covered by this ACK.
4196 4184 */
4197 4185 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4198 4186 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4199 4187 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4200 4188 }
4201 4189
4202 4190 /*
4203 4191 * If we got an ACK after fast retransmit, check to see
4204 4192 * if it is a partial ACK. If it is not and the congestion
4205 4193 * window was inflated to account for the other side's
4206 4194 * cached packets, retract it. If it is, do Hoe's algorithm.
4207 4195 */
4208 4196 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4209 4197 ASSERT(tcp->tcp_rexmit == B_FALSE);
4210 4198 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
|
↓ open down ↓ |
179 lines elided |
↑ open up ↑ |
4211 4199 tcp->tcp_dupack_cnt = 0;
4212 4200 /*
4213 4201 * Restore the orig tcp_cwnd_ssthresh after
4214 4202 * fast retransmit phase.
4215 4203 */
4216 4204 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4217 4205 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4218 4206 }
4219 4207 tcp->tcp_rexmit_max = seg_ack;
4220 4208 tcp->tcp_cwnd_cnt = 0;
4221 - tcp->tcp_snd_burst = tcp->tcp_localnet ?
4222 - TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4223 4209
4224 4210 /*
4225 4211 * Remove all notsack info to avoid confusion with
4226 4212 * the next fast retrasnmit/recovery phase.
4227 4213 */
4228 4214 if (tcp->tcp_snd_sack_ok) {
4229 4215 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4230 4216 tcp);
4231 4217 }
4232 4218 } else {
4233 4219 if (tcp->tcp_snd_sack_ok &&
4234 4220 tcp->tcp_notsack_list != NULL) {
4235 4221 flags |= TH_NEED_SACK_REXMIT;
4236 4222 tcp->tcp_pipe -= mss;
4237 4223 if (tcp->tcp_pipe < 0)
4238 4224 tcp->tcp_pipe = 0;
4239 4225 } else {
4240 4226 /*
4241 4227 * Hoe's algorithm:
4242 4228 *
4243 4229 * Retransmit the unack'ed segment and
4244 4230 * restart fast recovery. Note that we
4245 4231 * need to scale back tcp_cwnd to the
4246 4232 * original value when we started fast
4247 4233 * recovery. This is to prevent overly
4248 4234 * aggressive behaviour in sending new
4249 4235 * segments.
4250 4236 */
4251 4237 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4252 4238 tcps->tcps_dupack_fast_retransmit * mss;
4253 4239 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4254 4240 flags |= TH_REXMIT_NEEDED;
4255 4241 }
4256 4242 }
4257 4243 } else {
4258 4244 tcp->tcp_dupack_cnt = 0;
4259 4245 if (tcp->tcp_rexmit) {
4260 4246 /*
4261 4247 * TCP is retranmitting. If the ACK ack's all
4262 4248 * outstanding data, update tcp_rexmit_max and
4263 4249 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4264 4250 * to the correct value.
4265 4251 *
4266 4252 * Note that SEQ_LEQ() is used. This is to avoid
4267 4253 * unnecessary fast retransmit caused by dup ACKs
4268 4254 * received when TCP does slow start retransmission
4269 4255 * after a time out. During this phase, TCP may
4270 4256 * send out segments which are already received.
4271 4257 * This causes dup ACKs to be sent back.
4272 4258 */
|
↓ open down ↓ |
40 lines elided |
↑ open up ↑ |
4273 4259 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4274 4260 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4275 4261 tcp->tcp_rexmit_nxt = seg_ack;
4276 4262 }
4277 4263 if (seg_ack != tcp->tcp_rexmit_max) {
4278 4264 flags |= TH_XMIT_NEEDED;
4279 4265 }
4280 4266 } else {
4281 4267 tcp->tcp_rexmit = B_FALSE;
4282 4268 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4283 - tcp->tcp_snd_burst = tcp->tcp_localnet ?
4284 - TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4285 4269 }
4286 4270 tcp->tcp_ms_we_have_waited = 0;
4287 4271 }
4288 4272 }
4289 4273
4290 4274 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4291 4275 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4292 4276 tcp->tcp_suna = seg_ack;
4293 4277 if (tcp->tcp_zero_win_probe != 0) {
4294 4278 tcp->tcp_zero_win_probe = 0;
4295 4279 tcp->tcp_timer_backoff = 0;
4296 4280 }
4297 4281
4298 4282 /*
4299 4283 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4300 4284 * Note that it cannot be the SYN being ack'ed. The code flow
4301 4285 * will not reach here.
4302 4286 */
4303 4287 if (mp1 == NULL) {
4304 4288 goto fin_acked;
4305 4289 }
4306 4290
4307 4291 /*
4308 4292 * Update the congestion window.
4309 4293 *
4310 4294 * If TCP is not ECN capable or TCP is ECN capable but the
4311 4295 * congestion experience bit is not set, increase the tcp_cwnd as
4312 4296 * usual.
4313 4297 */
4314 4298 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4315 4299 cwnd = tcp->tcp_cwnd;
4316 4300 add = mss;
4317 4301
4318 4302 if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4319 4303 /*
4320 4304 * This is to prevent an increase of less than 1 MSS of
4321 4305 * tcp_cwnd. With partial increase, tcp_wput_data()
4322 4306 * may send out tinygrams in order to preserve mblk
4323 4307 * boundaries.
4324 4308 *
4325 4309 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4326 4310 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4327 4311 * increased by 1 MSS for every RTTs.
4328 4312 */
4329 4313 if (tcp->tcp_cwnd_cnt <= 0) {
4330 4314 tcp->tcp_cwnd_cnt = cwnd + add;
4331 4315 } else {
4332 4316 tcp->tcp_cwnd_cnt -= add;
4333 4317 add = 0;
4334 4318 }
4335 4319 }
4336 4320 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4337 4321 }
4338 4322
4339 4323 /* See if the latest urgent data has been acknowledged */
4340 4324 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4341 4325 SEQ_GT(seg_ack, tcp->tcp_urg))
4342 4326 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4343 4327
4344 4328 /* Can we update the RTT estimates? */
4345 4329 if (tcp->tcp_snd_ts_ok) {
4346 4330 /* Ignore zero timestamp echo-reply. */
4347 4331 if (tcpopt.tcp_opt_ts_ecr != 0) {
4348 4332 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4349 4333 (int32_t)tcpopt.tcp_opt_ts_ecr);
4350 4334 }
4351 4335
4352 4336 /* If needed, restart the timer. */
4353 4337 if (tcp->tcp_set_timer == 1) {
4354 4338 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4355 4339 tcp->tcp_set_timer = 0;
4356 4340 }
4357 4341 /*
4358 4342 * Update tcp_csuna in case the other side stops sending
4359 4343 * us timestamps.
4360 4344 */
4361 4345 tcp->tcp_csuna = tcp->tcp_snxt;
4362 4346 } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4363 4347 /*
4364 4348 * An ACK sequence we haven't seen before, so get the RTT
4365 4349 * and update the RTO. But first check if the timestamp is
4366 4350 * valid to use.
4367 4351 */
4368 4352 if ((mp1->b_next != NULL) &&
4369 4353 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4370 4354 tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4371 4355 (int32_t)(intptr_t)mp1->b_prev);
4372 4356 else
4373 4357 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4374 4358
4375 4359 /* Remeber the last sequence to be ACKed */
4376 4360 tcp->tcp_csuna = seg_ack;
4377 4361 if (tcp->tcp_set_timer == 1) {
4378 4362 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4379 4363 tcp->tcp_set_timer = 0;
4380 4364 }
4381 4365 } else {
4382 4366 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4383 4367 }
4384 4368
4385 4369 /* Eat acknowledged bytes off the xmit queue. */
4386 4370 for (;;) {
4387 4371 mblk_t *mp2;
4388 4372 uchar_t *wptr;
4389 4373
4390 4374 wptr = mp1->b_wptr;
4391 4375 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4392 4376 bytes_acked -= (int)(wptr - mp1->b_rptr);
4393 4377 if (bytes_acked < 0) {
4394 4378 mp1->b_rptr = wptr + bytes_acked;
4395 4379 /*
4396 4380 * Set a new timestamp if all the bytes timed by the
4397 4381 * old timestamp have been ack'ed.
4398 4382 */
4399 4383 if (SEQ_GT(seg_ack,
4400 4384 (uint32_t)(uintptr_t)(mp1->b_next))) {
4401 4385 mp1->b_prev =
4402 4386 (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4403 4387 mp1->b_next = NULL;
4404 4388 }
4405 4389 break;
4406 4390 }
4407 4391 mp1->b_next = NULL;
4408 4392 mp1->b_prev = NULL;
4409 4393 mp2 = mp1;
4410 4394 mp1 = mp1->b_cont;
4411 4395
4412 4396 /*
4413 4397 * This notification is required for some zero-copy
4414 4398 * clients to maintain a copy semantic. After the data
4415 4399 * is ack'ed, client is safe to modify or reuse the buffer.
4416 4400 */
4417 4401 if (tcp->tcp_snd_zcopy_aware &&
4418 4402 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4419 4403 tcp_zcopy_notify(tcp);
4420 4404 freeb(mp2);
4421 4405 if (bytes_acked == 0) {
4422 4406 if (mp1 == NULL) {
4423 4407 /* Everything is ack'ed, clear the tail. */
4424 4408 tcp->tcp_xmit_tail = NULL;
4425 4409 /*
4426 4410 * Cancel the timer unless we are still
4427 4411 * waiting for an ACK for the FIN packet.
4428 4412 */
4429 4413 if (tcp->tcp_timer_tid != 0 &&
4430 4414 tcp->tcp_snxt == tcp->tcp_suna) {
4431 4415 (void) TCP_TIMER_CANCEL(tcp,
4432 4416 tcp->tcp_timer_tid);
4433 4417 tcp->tcp_timer_tid = 0;
4434 4418 }
4435 4419 goto pre_swnd_update;
4436 4420 }
4437 4421 if (mp2 != tcp->tcp_xmit_tail)
4438 4422 break;
4439 4423 tcp->tcp_xmit_tail = mp1;
4440 4424 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4441 4425 (uintptr_t)INT_MAX);
4442 4426 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4443 4427 mp1->b_rptr);
4444 4428 break;
4445 4429 }
4446 4430 if (mp1 == NULL) {
4447 4431 /*
4448 4432 * More was acked but there is nothing more
4449 4433 * outstanding. This means that the FIN was
4450 4434 * just acked or that we're talking to a clown.
4451 4435 */
4452 4436 fin_acked:
4453 4437 ASSERT(tcp->tcp_fin_sent);
4454 4438 tcp->tcp_xmit_tail = NULL;
4455 4439 if (tcp->tcp_fin_sent) {
4456 4440 /* FIN was acked - making progress */
4457 4441 if (!tcp->tcp_fin_acked)
4458 4442 tcp->tcp_ip_forward_progress = B_TRUE;
4459 4443 tcp->tcp_fin_acked = B_TRUE;
4460 4444 if (tcp->tcp_linger_tid != 0 &&
4461 4445 TCP_TIMER_CANCEL(tcp,
4462 4446 tcp->tcp_linger_tid) >= 0) {
4463 4447 tcp_stop_lingering(tcp);
4464 4448 freemsg(mp);
4465 4449 mp = NULL;
4466 4450 }
4467 4451 } else {
4468 4452 /*
4469 4453 * We should never get here because
4470 4454 * we have already checked that the
4471 4455 * number of bytes ack'ed should be
4472 4456 * smaller than or equal to what we
4473 4457 * have sent so far (it is the
4474 4458 * acceptability check of the ACK).
4475 4459 * We can only get here if the send
4476 4460 * queue is corrupted.
4477 4461 *
4478 4462 * Terminate the connection and
4479 4463 * panic the system. It is better
4480 4464 * for us to panic instead of
4481 4465 * continuing to avoid other disaster.
4482 4466 */
4483 4467 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4484 4468 tcp->tcp_rnxt, TH_RST|TH_ACK);
4485 4469 panic("Memory corruption "
4486 4470 "detected for connection %s.",
4487 4471 tcp_display(tcp, NULL,
4488 4472 DISP_ADDR_AND_PORT));
4489 4473 /*NOTREACHED*/
4490 4474 }
4491 4475 goto pre_swnd_update;
4492 4476 }
4493 4477 ASSERT(mp2 != tcp->tcp_xmit_tail);
4494 4478 }
4495 4479 if (tcp->tcp_unsent) {
4496 4480 flags |= TH_XMIT_NEEDED;
4497 4481 }
4498 4482 pre_swnd_update:
4499 4483 tcp->tcp_xmit_head = mp1;
4500 4484 swnd_update:
4501 4485 /*
4502 4486 * The following check is different from most other implementations.
4503 4487 * For bi-directional transfer, when segments are dropped, the
4504 4488 * "normal" check will not accept a window update in those
4505 4489 * retransmitted segemnts. Failing to do that, TCP may send out
4506 4490 * segments which are outside receiver's window. As TCP accepts
4507 4491 * the ack in those retransmitted segments, if the window update in
4508 4492 * the same segment is not accepted, TCP will incorrectly calculates
4509 4493 * that it can send more segments. This can create a deadlock
4510 4494 * with the receiver if its window becomes zero.
4511 4495 */
4512 4496 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4513 4497 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4514 4498 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4515 4499 /*
4516 4500 * The criteria for update is:
4517 4501 *
4518 4502 * 1. the segment acknowledges some data. Or
4519 4503 * 2. the segment is new, i.e. it has a higher seq num. Or
4520 4504 * 3. the segment is not old and the advertised window is
4521 4505 * larger than the previous advertised window.
4522 4506 */
4523 4507 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4524 4508 flags |= TH_XMIT_NEEDED;
4525 4509 tcp->tcp_swnd = new_swnd;
4526 4510 if (new_swnd > tcp->tcp_max_swnd)
4527 4511 tcp->tcp_max_swnd = new_swnd;
4528 4512 tcp->tcp_swl1 = seg_seq;
4529 4513 tcp->tcp_swl2 = seg_ack;
4530 4514 }
4531 4515 est:
4532 4516 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4533 4517
4534 4518 switch (tcp->tcp_state) {
4535 4519 case TCPS_FIN_WAIT_1:
4536 4520 if (tcp->tcp_fin_acked) {
4537 4521 tcp->tcp_state = TCPS_FIN_WAIT_2;
4538 4522 DTRACE_TCP6(state__change, void, NULL,
4539 4523 ip_xmit_attr_t *, connp->conn_ixa,
4540 4524 void, NULL, tcp_t *, tcp, void, NULL,
4541 4525 int32_t, TCPS_FIN_WAIT_1);
4542 4526 /*
4543 4527 * We implement the non-standard BSD/SunOS
4544 4528 * FIN_WAIT_2 flushing algorithm.
4545 4529 * If there is no user attached to this
4546 4530 * TCP endpoint, then this TCP struct
4547 4531 * could hang around forever in FIN_WAIT_2
4548 4532 * state if the peer forgets to send us
4549 4533 * a FIN. To prevent this, we wait only
4550 4534 * 2*MSL (a convenient time value) for
4551 4535 * the FIN to arrive. If it doesn't show up,
4552 4536 * we flush the TCP endpoint. This algorithm,
4553 4537 * though a violation of RFC-793, has worked
4554 4538 * for over 10 years in BSD systems.
4555 4539 * Note: SunOS 4.x waits 675 seconds before
4556 4540 * flushing the FIN_WAIT_2 connection.
4557 4541 */
4558 4542 TCP_TIMER_RESTART(tcp,
4559 4543 tcp->tcp_fin_wait_2_flush_interval);
4560 4544 }
4561 4545 break;
4562 4546 case TCPS_FIN_WAIT_2:
4563 4547 break; /* Shutdown hook? */
4564 4548 case TCPS_LAST_ACK:
4565 4549 freemsg(mp);
4566 4550 if (tcp->tcp_fin_acked) {
4567 4551 (void) tcp_clean_death(tcp, 0);
4568 4552 return;
4569 4553 }
4570 4554 goto xmit_check;
4571 4555 case TCPS_CLOSING:
4572 4556 if (tcp->tcp_fin_acked) {
4573 4557 SET_TIME_WAIT(tcps, tcp, connp);
4574 4558 DTRACE_TCP6(state__change, void, NULL,
4575 4559 ip_xmit_attr_t *, connp->conn_ixa, void,
4576 4560 NULL, tcp_t *, tcp, void, NULL, int32_t,
4577 4561 TCPS_CLOSING);
4578 4562 }
4579 4563 /*FALLTHRU*/
4580 4564 case TCPS_CLOSE_WAIT:
4581 4565 freemsg(mp);
4582 4566 goto xmit_check;
4583 4567 default:
4584 4568 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4585 4569 break;
4586 4570 }
4587 4571 }
4588 4572 if (flags & TH_FIN) {
4589 4573 /* Make sure we ack the fin */
4590 4574 flags |= TH_ACK_NEEDED;
4591 4575 if (!tcp->tcp_fin_rcvd) {
4592 4576 tcp->tcp_fin_rcvd = B_TRUE;
4593 4577 tcp->tcp_rnxt++;
4594 4578 tcpha = tcp->tcp_tcpha;
4595 4579 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4596 4580
4597 4581 /*
4598 4582 * Generate the ordrel_ind at the end unless the
4599 4583 * conn is detached or it is a STREAMS based eager.
4600 4584 * In the eager case we defer the notification until
4601 4585 * tcp_accept_finish has run.
4602 4586 */
4603 4587 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4604 4588 (tcp->tcp_listener == NULL &&
4605 4589 !tcp->tcp_hard_binding)))
4606 4590 flags |= TH_ORDREL_NEEDED;
4607 4591 switch (tcp->tcp_state) {
4608 4592 case TCPS_SYN_RCVD:
4609 4593 tcp->tcp_state = TCPS_CLOSE_WAIT;
4610 4594 DTRACE_TCP6(state__change, void, NULL,
4611 4595 ip_xmit_attr_t *, connp->conn_ixa,
4612 4596 void, NULL, tcp_t *, tcp, void, NULL,
4613 4597 int32_t, TCPS_SYN_RCVD);
4614 4598 /* Keepalive? */
4615 4599 break;
4616 4600 case TCPS_ESTABLISHED:
4617 4601 tcp->tcp_state = TCPS_CLOSE_WAIT;
4618 4602 DTRACE_TCP6(state__change, void, NULL,
4619 4603 ip_xmit_attr_t *, connp->conn_ixa,
4620 4604 void, NULL, tcp_t *, tcp, void, NULL,
4621 4605 int32_t, TCPS_ESTABLISHED);
4622 4606 /* Keepalive? */
4623 4607 break;
4624 4608 case TCPS_FIN_WAIT_1:
4625 4609 if (!tcp->tcp_fin_acked) {
4626 4610 tcp->tcp_state = TCPS_CLOSING;
4627 4611 DTRACE_TCP6(state__change, void, NULL,
4628 4612 ip_xmit_attr_t *, connp->conn_ixa,
4629 4613 void, NULL, tcp_t *, tcp, void,
4630 4614 NULL, int32_t, TCPS_FIN_WAIT_1);
4631 4615 break;
4632 4616 }
4633 4617 /* FALLTHRU */
4634 4618 case TCPS_FIN_WAIT_2:
4635 4619 SET_TIME_WAIT(tcps, tcp, connp);
4636 4620 DTRACE_TCP6(state__change, void, NULL,
4637 4621 ip_xmit_attr_t *, connp->conn_ixa, void,
4638 4622 NULL, tcp_t *, tcp, void, NULL, int32_t,
4639 4623 TCPS_FIN_WAIT_2);
4640 4624 if (seg_len) {
4641 4625 /*
4642 4626 * implies data piggybacked on FIN.
4643 4627 * break to handle data.
4644 4628 */
4645 4629 break;
4646 4630 }
4647 4631 freemsg(mp);
4648 4632 goto ack_check;
4649 4633 }
4650 4634 }
4651 4635 }
4652 4636 if (mp == NULL)
4653 4637 goto xmit_check;
4654 4638 if (seg_len == 0) {
4655 4639 freemsg(mp);
4656 4640 goto xmit_check;
4657 4641 }
4658 4642 if (mp->b_rptr == mp->b_wptr) {
4659 4643 /*
4660 4644 * The header has been consumed, so we remove the
4661 4645 * zero-length mblk here.
4662 4646 */
4663 4647 mp1 = mp;
4664 4648 mp = mp->b_cont;
4665 4649 freeb(mp1);
4666 4650 }
4667 4651 update_ack:
4668 4652 tcpha = tcp->tcp_tcpha;
4669 4653 tcp->tcp_rack_cnt++;
4670 4654 {
4671 4655 uint32_t cur_max;
4672 4656
4673 4657 cur_max = tcp->tcp_rack_cur_max;
4674 4658 if (tcp->tcp_rack_cnt >= cur_max) {
4675 4659 /*
4676 4660 * We have more unacked data than we should - send
4677 4661 * an ACK now.
4678 4662 */
4679 4663 flags |= TH_ACK_NEEDED;
4680 4664 cur_max++;
4681 4665 if (cur_max > tcp->tcp_rack_abs_max)
4682 4666 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4683 4667 else
4684 4668 tcp->tcp_rack_cur_max = cur_max;
4685 4669 } else if (TCP_IS_DETACHED(tcp)) {
4686 4670 /* We don't have an ACK timer for detached TCP. */
4687 4671 flags |= TH_ACK_NEEDED;
4688 4672 } else if (seg_len < mss) {
4689 4673 /*
4690 4674 * If we get a segment that is less than an mss, and we
4691 4675 * already have unacknowledged data, and the amount
4692 4676 * unacknowledged is not a multiple of mss, then we
4693 4677 * better generate an ACK now. Otherwise, this may be
4694 4678 * the tail piece of a transaction, and we would rather
4695 4679 * wait for the response.
4696 4680 */
4697 4681 uint32_t udif;
4698 4682 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4699 4683 (uintptr_t)INT_MAX);
4700 4684 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4701 4685 if (udif && (udif % mss))
4702 4686 flags |= TH_ACK_NEEDED;
4703 4687 else
4704 4688 flags |= TH_ACK_TIMER_NEEDED;
4705 4689 } else {
4706 4690 /* Start delayed ack timer */
4707 4691 flags |= TH_ACK_TIMER_NEEDED;
4708 4692 }
4709 4693 }
4710 4694 tcp->tcp_rnxt += seg_len;
4711 4695 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4712 4696
4713 4697 if (mp == NULL)
4714 4698 goto xmit_check;
4715 4699
4716 4700 /* Update SACK list */
4717 4701 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4718 4702 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4719 4703 &(tcp->tcp_num_sack_blk));
4720 4704 }
4721 4705
4722 4706 if (tcp->tcp_urp_mp) {
4723 4707 tcp->tcp_urp_mp->b_cont = mp;
4724 4708 mp = tcp->tcp_urp_mp;
4725 4709 tcp->tcp_urp_mp = NULL;
4726 4710 /* Ready for a new signal. */
4727 4711 tcp->tcp_urp_last_valid = B_FALSE;
4728 4712 #ifdef DEBUG
4729 4713 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4730 4714 "tcp_rput: sending exdata_ind %s",
4731 4715 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4732 4716 #endif /* DEBUG */
4733 4717 }
4734 4718
4735 4719 /*
4736 4720 * Check for ancillary data changes compared to last segment.
4737 4721 */
4738 4722 if (connp->conn_recv_ancillary.crb_all != 0) {
4739 4723 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4740 4724 if (mp == NULL)
4741 4725 return;
4742 4726 }
4743 4727
4744 4728 if (IPCL_IS_NONSTR(connp)) {
4745 4729 /*
4746 4730 * Non-STREAMS socket
4747 4731 */
4748 4732 boolean_t push = flags & (TH_PUSH|TH_FIN);
4749 4733 int error;
4750 4734
4751 4735 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4752 4736 mp, seg_len, 0, &error, &push) <= 0) {
4753 4737 /*
4754 4738 * We should never be in middle of a
4755 4739 * fallback, the squeue guarantees that.
4756 4740 */
4757 4741 ASSERT(error != EOPNOTSUPP);
4758 4742 if (error == ENOSPC)
4759 4743 tcp->tcp_rwnd -= seg_len;
4760 4744 } else if (push) {
4761 4745 /* PUSH bit set and sockfs is not flow controlled */
4762 4746 flags |= tcp_rwnd_reopen(tcp);
4763 4747 }
4764 4748 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4765 4749 /*
4766 4750 * Side queue inbound data until the accept happens.
4767 4751 * tcp_accept/tcp_rput drains this when the accept happens.
4768 4752 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4769 4753 * T_EXDATA_IND) it is queued on b_next.
4770 4754 * XXX Make urgent data use this. Requires:
4771 4755 * Removing tcp_listener check for TH_URG
4772 4756 * Making M_PCPROTO and MARK messages skip the eager case
4773 4757 */
4774 4758
4775 4759 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4776 4760 } else {
4777 4761 /* Active STREAMS socket */
4778 4762 if (mp->b_datap->db_type != M_DATA ||
4779 4763 (flags & TH_MARKNEXT_NEEDED)) {
4780 4764 if (tcp->tcp_rcv_list != NULL) {
4781 4765 flags |= tcp_rcv_drain(tcp);
4782 4766 }
4783 4767 ASSERT(tcp->tcp_rcv_list == NULL ||
4784 4768 tcp->tcp_fused_sigurg);
4785 4769
4786 4770 if (flags & TH_MARKNEXT_NEEDED) {
4787 4771 #ifdef DEBUG
4788 4772 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4789 4773 "tcp_rput: sending MSGMARKNEXT %s",
4790 4774 tcp_display(tcp, NULL,
4791 4775 DISP_PORT_ONLY));
4792 4776 #endif /* DEBUG */
4793 4777 mp->b_flag |= MSGMARKNEXT;
4794 4778 flags &= ~TH_MARKNEXT_NEEDED;
4795 4779 }
4796 4780
4797 4781 if (is_system_labeled())
4798 4782 tcp_setcred_data(mp, ira);
4799 4783
4800 4784 putnext(connp->conn_rq, mp);
4801 4785 if (!canputnext(connp->conn_rq))
4802 4786 tcp->tcp_rwnd -= seg_len;
4803 4787 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4804 4788 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4805 4789 if (tcp->tcp_rcv_list != NULL) {
4806 4790 /*
4807 4791 * Enqueue the new segment first and then
4808 4792 * call tcp_rcv_drain() to send all data
4809 4793 * up. The other way to do this is to
4810 4794 * send all queued data up and then call
4811 4795 * putnext() to send the new segment up.
4812 4796 * This way can remove the else part later
4813 4797 * on.
4814 4798 *
4815 4799 * We don't do this to avoid one more call to
4816 4800 * canputnext() as tcp_rcv_drain() needs to
4817 4801 * call canputnext().
4818 4802 */
4819 4803 tcp_rcv_enqueue(tcp, mp, seg_len,
4820 4804 ira->ira_cred);
4821 4805 flags |= tcp_rcv_drain(tcp);
4822 4806 } else {
4823 4807 if (is_system_labeled())
4824 4808 tcp_setcred_data(mp, ira);
4825 4809
4826 4810 putnext(connp->conn_rq, mp);
4827 4811 if (!canputnext(connp->conn_rq))
4828 4812 tcp->tcp_rwnd -= seg_len;
4829 4813 }
4830 4814 } else {
4831 4815 /*
4832 4816 * Enqueue all packets when processing an mblk
4833 4817 * from the co queue and also enqueue normal packets.
4834 4818 */
4835 4819 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4836 4820 }
4837 4821 /*
4838 4822 * Make sure the timer is running if we have data waiting
4839 4823 * for a push bit. This provides resiliency against
4840 4824 * implementations that do not correctly generate push bits.
4841 4825 */
4842 4826 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4843 4827 /*
4844 4828 * The connection may be closed at this point, so don't
4845 4829 * do anything for a detached tcp.
4846 4830 */
4847 4831 if (!TCP_IS_DETACHED(tcp))
4848 4832 tcp->tcp_push_tid = TCP_TIMER(tcp,
4849 4833 tcp_push_timer,
4850 4834 tcps->tcps_push_timer_interval);
4851 4835 }
4852 4836 }
4853 4837
4854 4838 xmit_check:
4855 4839 /* Is there anything left to do? */
4856 4840 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4857 4841 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4858 4842 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4859 4843 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4860 4844 goto done;
4861 4845
4862 4846 /* Any transmit work to do and a non-zero window? */
4863 4847 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4864 4848 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4865 4849 if (flags & TH_REXMIT_NEEDED) {
4866 4850 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4867 4851
4868 4852 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4869 4853 if (snd_size > mss)
4870 4854 snd_size = mss;
4871 4855 if (snd_size > tcp->tcp_swnd)
4872 4856 snd_size = tcp->tcp_swnd;
4873 4857 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4874 4858 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4875 4859 B_TRUE);
4876 4860
4877 4861 if (mp1 != NULL) {
4878 4862 tcp->tcp_xmit_head->b_prev =
4879 4863 (mblk_t *)LBOLT_FASTPATH;
4880 4864 tcp->tcp_csuna = tcp->tcp_snxt;
4881 4865 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4882 4866 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4883 4867 snd_size);
4884 4868 tcp_send_data(tcp, mp1);
4885 4869 }
4886 4870 }
4887 4871 if (flags & TH_NEED_SACK_REXMIT) {
4888 4872 tcp_sack_rexmit(tcp, &flags);
4889 4873 }
4890 4874 /*
4891 4875 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4892 4876 * out new segment. Note that tcp_rexmit should not be
4893 4877 * set, otherwise TH_LIMIT_XMIT should not be set.
4894 4878 */
4895 4879 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4896 4880 if (!tcp->tcp_rexmit) {
4897 4881 tcp_wput_data(tcp, NULL, B_FALSE);
4898 4882 } else {
4899 4883 tcp_ss_rexmit(tcp);
4900 4884 }
4901 4885 }
4902 4886 /*
4903 4887 * Adjust tcp_cwnd back to normal value after sending
4904 4888 * new data segments.
4905 4889 */
4906 4890 if (flags & TH_LIMIT_XMIT) {
4907 4891 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4908 4892 /*
4909 4893 * This will restart the timer. Restarting the
4910 4894 * timer is used to avoid a timeout before the
4911 4895 * limited transmitted segment's ACK gets back.
4912 4896 */
4913 4897 if (tcp->tcp_xmit_head != NULL)
4914 4898 tcp->tcp_xmit_head->b_prev =
4915 4899 (mblk_t *)LBOLT_FASTPATH;
4916 4900 }
4917 4901
4918 4902 /* Anything more to do? */
4919 4903 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4920 4904 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4921 4905 goto done;
4922 4906 }
4923 4907 ack_check:
4924 4908 if (flags & TH_SEND_URP_MARK) {
4925 4909 ASSERT(tcp->tcp_urp_mark_mp);
4926 4910 ASSERT(!IPCL_IS_NONSTR(connp));
4927 4911 /*
4928 4912 * Send up any queued data and then send the mark message
4929 4913 */
4930 4914 if (tcp->tcp_rcv_list != NULL) {
4931 4915 flags |= tcp_rcv_drain(tcp);
4932 4916
4933 4917 }
4934 4918 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4935 4919 mp1 = tcp->tcp_urp_mark_mp;
4936 4920 tcp->tcp_urp_mark_mp = NULL;
4937 4921 if (is_system_labeled())
4938 4922 tcp_setcred_data(mp1, ira);
4939 4923
4940 4924 putnext(connp->conn_rq, mp1);
4941 4925 #ifdef DEBUG
4942 4926 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4943 4927 "tcp_rput: sending zero-length %s %s",
4944 4928 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4945 4929 "MSGNOTMARKNEXT"),
4946 4930 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4947 4931 #endif /* DEBUG */
4948 4932 flags &= ~TH_SEND_URP_MARK;
4949 4933 }
4950 4934 if (flags & TH_ACK_NEEDED) {
4951 4935 /*
4952 4936 * Time to send an ack for some reason.
4953 4937 */
4954 4938 mp1 = tcp_ack_mp(tcp);
4955 4939
4956 4940 if (mp1 != NULL) {
4957 4941 tcp_send_data(tcp, mp1);
4958 4942 BUMP_LOCAL(tcp->tcp_obsegs);
4959 4943 TCPS_BUMP_MIB(tcps, tcpOutAck);
4960 4944 }
4961 4945 if (tcp->tcp_ack_tid != 0) {
4962 4946 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4963 4947 tcp->tcp_ack_tid = 0;
4964 4948 }
4965 4949 }
4966 4950 if (flags & TH_ACK_TIMER_NEEDED) {
4967 4951 /*
4968 4952 * Arrange for deferred ACK or push wait timeout.
4969 4953 * Start timer if it is not already running.
4970 4954 */
4971 4955 if (tcp->tcp_ack_tid == 0) {
4972 4956 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4973 4957 tcp->tcp_localnet ?
4974 4958 tcps->tcps_local_dack_interval :
4975 4959 tcps->tcps_deferred_ack_interval);
4976 4960 }
4977 4961 }
4978 4962 if (flags & TH_ORDREL_NEEDED) {
4979 4963 /*
4980 4964 * Notify upper layer about an orderly release. If this is
4981 4965 * a non-STREAMS socket, then just make an upcall. For STREAMS
4982 4966 * we send up an ordrel_ind, unless this is an eager, in which
4983 4967 * case the ordrel will be sent when tcp_accept_finish runs.
4984 4968 * Note that for non-STREAMS we make an upcall even if it is an
4985 4969 * eager, because we have an upper handle to send it to.
4986 4970 */
4987 4971 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4988 4972 ASSERT(!tcp->tcp_detached);
4989 4973
4990 4974 if (IPCL_IS_NONSTR(connp)) {
4991 4975 ASSERT(tcp->tcp_ordrel_mp == NULL);
4992 4976 tcp->tcp_ordrel_done = B_TRUE;
4993 4977 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4994 4978 SOCK_OPCTL_SHUT_RECV, 0);
4995 4979 goto done;
4996 4980 }
4997 4981
4998 4982 if (tcp->tcp_rcv_list != NULL) {
4999 4983 /*
5000 4984 * Push any mblk(s) enqueued from co processing.
5001 4985 */
5002 4986 flags |= tcp_rcv_drain(tcp);
5003 4987 }
5004 4988 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5005 4989
5006 4990 mp1 = tcp->tcp_ordrel_mp;
5007 4991 tcp->tcp_ordrel_mp = NULL;
5008 4992 tcp->tcp_ordrel_done = B_TRUE;
5009 4993 putnext(connp->conn_rq, mp1);
5010 4994 }
5011 4995 done:
5012 4996 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5013 4997 }
5014 4998
5015 4999 /*
5016 5000 * Attach ancillary data to a received TCP segments for the
5017 5001 * ancillary pieces requested by the application that are
5018 5002 * different than they were in the previous data segment.
5019 5003 *
5020 5004 * Save the "current" values once memory allocation is ok so that
5021 5005 * when memory allocation fails we can just wait for the next data segment.
5022 5006 */
5023 5007 static mblk_t *
5024 5008 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5025 5009 ip_recv_attr_t *ira)
5026 5010 {
5027 5011 struct T_optdata_ind *todi;
5028 5012 int optlen;
5029 5013 uchar_t *optptr;
5030 5014 struct T_opthdr *toh;
5031 5015 crb_t addflag; /* Which pieces to add */
5032 5016 mblk_t *mp1;
5033 5017 conn_t *connp = tcp->tcp_connp;
5034 5018
5035 5019 optlen = 0;
5036 5020 addflag.crb_all = 0;
5037 5021 /* If app asked for pktinfo and the index has changed ... */
5038 5022 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5039 5023 ira->ira_ruifindex != tcp->tcp_recvifindex) {
5040 5024 optlen += sizeof (struct T_opthdr) +
5041 5025 sizeof (struct in6_pktinfo);
5042 5026 addflag.crb_ip_recvpktinfo = 1;
5043 5027 }
5044 5028 /* If app asked for hoplimit and it has changed ... */
5045 5029 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5046 5030 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5047 5031 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5048 5032 addflag.crb_ipv6_recvhoplimit = 1;
5049 5033 }
5050 5034 /* If app asked for tclass and it has changed ... */
5051 5035 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5052 5036 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5053 5037 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5054 5038 addflag.crb_ipv6_recvtclass = 1;
5055 5039 }
5056 5040 /*
5057 5041 * If app asked for hopbyhop headers and it has changed ...
5058 5042 * For security labels, note that (1) security labels can't change on
5059 5043 * a connected socket at all, (2) we're connected to at most one peer,
5060 5044 * (3) if anything changes, then it must be some other extra option.
5061 5045 */
5062 5046 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5063 5047 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5064 5048 (ipp->ipp_fields & IPPF_HOPOPTS),
5065 5049 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5066 5050 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5067 5051 addflag.crb_ipv6_recvhopopts = 1;
5068 5052 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5069 5053 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5070 5054 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5071 5055 return (mp);
5072 5056 }
5073 5057 /* If app asked for dst headers before routing headers ... */
5074 5058 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5075 5059 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5076 5060 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5077 5061 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5078 5062 optlen += sizeof (struct T_opthdr) +
5079 5063 ipp->ipp_rthdrdstoptslen;
5080 5064 addflag.crb_ipv6_recvrthdrdstopts = 1;
5081 5065 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5082 5066 &tcp->tcp_rthdrdstoptslen,
5083 5067 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5084 5068 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5085 5069 return (mp);
5086 5070 }
5087 5071 /* If app asked for routing headers and it has changed ... */
5088 5072 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5089 5073 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5090 5074 (ipp->ipp_fields & IPPF_RTHDR),
5091 5075 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5092 5076 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5093 5077 addflag.crb_ipv6_recvrthdr = 1;
5094 5078 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5095 5079 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5096 5080 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5097 5081 return (mp);
5098 5082 }
5099 5083 /* If app asked for dest headers and it has changed ... */
5100 5084 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5101 5085 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5102 5086 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5103 5087 (ipp->ipp_fields & IPPF_DSTOPTS),
5104 5088 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5105 5089 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5106 5090 addflag.crb_ipv6_recvdstopts = 1;
5107 5091 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5108 5092 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5109 5093 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5110 5094 return (mp);
5111 5095 }
5112 5096
5113 5097 if (optlen == 0) {
5114 5098 /* Nothing to add */
5115 5099 return (mp);
5116 5100 }
5117 5101 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5118 5102 if (mp1 == NULL) {
5119 5103 /*
5120 5104 * Defer sending ancillary data until the next TCP segment
5121 5105 * arrives.
5122 5106 */
5123 5107 return (mp);
5124 5108 }
5125 5109 mp1->b_cont = mp;
5126 5110 mp = mp1;
5127 5111 mp->b_wptr += sizeof (*todi) + optlen;
5128 5112 mp->b_datap->db_type = M_PROTO;
5129 5113 todi = (struct T_optdata_ind *)mp->b_rptr;
5130 5114 todi->PRIM_type = T_OPTDATA_IND;
5131 5115 todi->DATA_flag = 1; /* MORE data */
5132 5116 todi->OPT_length = optlen;
5133 5117 todi->OPT_offset = sizeof (*todi);
5134 5118 optptr = (uchar_t *)&todi[1];
5135 5119 /*
5136 5120 * If app asked for pktinfo and the index has changed ...
5137 5121 * Note that the local address never changes for the connection.
5138 5122 */
5139 5123 if (addflag.crb_ip_recvpktinfo) {
5140 5124 struct in6_pktinfo *pkti;
5141 5125 uint_t ifindex;
5142 5126
5143 5127 ifindex = ira->ira_ruifindex;
5144 5128 toh = (struct T_opthdr *)optptr;
5145 5129 toh->level = IPPROTO_IPV6;
5146 5130 toh->name = IPV6_PKTINFO;
5147 5131 toh->len = sizeof (*toh) + sizeof (*pkti);
5148 5132 toh->status = 0;
5149 5133 optptr += sizeof (*toh);
5150 5134 pkti = (struct in6_pktinfo *)optptr;
5151 5135 pkti->ipi6_addr = connp->conn_laddr_v6;
5152 5136 pkti->ipi6_ifindex = ifindex;
5153 5137 optptr += sizeof (*pkti);
5154 5138 ASSERT(OK_32PTR(optptr));
5155 5139 /* Save as "last" value */
5156 5140 tcp->tcp_recvifindex = ifindex;
5157 5141 }
5158 5142 /* If app asked for hoplimit and it has changed ... */
5159 5143 if (addflag.crb_ipv6_recvhoplimit) {
5160 5144 toh = (struct T_opthdr *)optptr;
5161 5145 toh->level = IPPROTO_IPV6;
5162 5146 toh->name = IPV6_HOPLIMIT;
5163 5147 toh->len = sizeof (*toh) + sizeof (uint_t);
5164 5148 toh->status = 0;
5165 5149 optptr += sizeof (*toh);
5166 5150 *(uint_t *)optptr = ipp->ipp_hoplimit;
5167 5151 optptr += sizeof (uint_t);
5168 5152 ASSERT(OK_32PTR(optptr));
5169 5153 /* Save as "last" value */
5170 5154 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5171 5155 }
5172 5156 /* If app asked for tclass and it has changed ... */
5173 5157 if (addflag.crb_ipv6_recvtclass) {
5174 5158 toh = (struct T_opthdr *)optptr;
5175 5159 toh->level = IPPROTO_IPV6;
5176 5160 toh->name = IPV6_TCLASS;
5177 5161 toh->len = sizeof (*toh) + sizeof (uint_t);
5178 5162 toh->status = 0;
5179 5163 optptr += sizeof (*toh);
5180 5164 *(uint_t *)optptr = ipp->ipp_tclass;
5181 5165 optptr += sizeof (uint_t);
5182 5166 ASSERT(OK_32PTR(optptr));
5183 5167 /* Save as "last" value */
5184 5168 tcp->tcp_recvtclass = ipp->ipp_tclass;
5185 5169 }
5186 5170 if (addflag.crb_ipv6_recvhopopts) {
5187 5171 toh = (struct T_opthdr *)optptr;
5188 5172 toh->level = IPPROTO_IPV6;
5189 5173 toh->name = IPV6_HOPOPTS;
5190 5174 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5191 5175 toh->status = 0;
5192 5176 optptr += sizeof (*toh);
5193 5177 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5194 5178 optptr += ipp->ipp_hopoptslen;
5195 5179 ASSERT(OK_32PTR(optptr));
5196 5180 /* Save as last value */
5197 5181 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5198 5182 (ipp->ipp_fields & IPPF_HOPOPTS),
5199 5183 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5200 5184 }
5201 5185 if (addflag.crb_ipv6_recvrthdrdstopts) {
5202 5186 toh = (struct T_opthdr *)optptr;
5203 5187 toh->level = IPPROTO_IPV6;
5204 5188 toh->name = IPV6_RTHDRDSTOPTS;
5205 5189 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5206 5190 toh->status = 0;
5207 5191 optptr += sizeof (*toh);
5208 5192 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5209 5193 optptr += ipp->ipp_rthdrdstoptslen;
5210 5194 ASSERT(OK_32PTR(optptr));
5211 5195 /* Save as last value */
5212 5196 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5213 5197 &tcp->tcp_rthdrdstoptslen,
5214 5198 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5215 5199 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5216 5200 }
5217 5201 if (addflag.crb_ipv6_recvrthdr) {
5218 5202 toh = (struct T_opthdr *)optptr;
5219 5203 toh->level = IPPROTO_IPV6;
5220 5204 toh->name = IPV6_RTHDR;
5221 5205 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5222 5206 toh->status = 0;
5223 5207 optptr += sizeof (*toh);
5224 5208 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5225 5209 optptr += ipp->ipp_rthdrlen;
5226 5210 ASSERT(OK_32PTR(optptr));
5227 5211 /* Save as last value */
5228 5212 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5229 5213 (ipp->ipp_fields & IPPF_RTHDR),
5230 5214 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5231 5215 }
5232 5216 if (addflag.crb_ipv6_recvdstopts) {
5233 5217 toh = (struct T_opthdr *)optptr;
5234 5218 toh->level = IPPROTO_IPV6;
5235 5219 toh->name = IPV6_DSTOPTS;
5236 5220 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5237 5221 toh->status = 0;
5238 5222 optptr += sizeof (*toh);
5239 5223 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5240 5224 optptr += ipp->ipp_dstoptslen;
5241 5225 ASSERT(OK_32PTR(optptr));
5242 5226 /* Save as last value */
5243 5227 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5244 5228 (ipp->ipp_fields & IPPF_DSTOPTS),
5245 5229 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5246 5230 }
5247 5231 ASSERT(optptr == mp->b_wptr);
5248 5232 return (mp);
5249 5233 }
5250 5234
5251 5235 /* The minimum of smoothed mean deviation in RTO calculation. */
5252 5236 #define TCP_SD_MIN 400
5253 5237
5254 5238 /*
5255 5239 * Set RTO for this connection. The formula is from Jacobson and Karels'
5256 5240 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names
5257 5241 * are the same as those in Appendix A.2 of that paper.
5258 5242 *
5259 5243 * m = new measurement
5260 5244 * sa = smoothed RTT average (8 * average estimates).
5261 5245 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5262 5246 */
5263 5247 static void
5264 5248 tcp_set_rto(tcp_t *tcp, clock_t rtt)
5265 5249 {
5266 5250 long m = TICK_TO_MSEC(rtt);
5267 5251 clock_t sa = tcp->tcp_rtt_sa;
5268 5252 clock_t sv = tcp->tcp_rtt_sd;
5269 5253 clock_t rto;
5270 5254 tcp_stack_t *tcps = tcp->tcp_tcps;
5271 5255
5272 5256 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5273 5257 tcp->tcp_rtt_update++;
5274 5258
5275 5259 /* tcp_rtt_sa is not 0 means this is a new sample. */
5276 5260 if (sa != 0) {
5277 5261 /*
5278 5262 * Update average estimator:
5279 5263 * new rtt = 7/8 old rtt + 1/8 Error
5280 5264 */
5281 5265
5282 5266 /* m is now Error in estimate. */
5283 5267 m -= sa >> 3;
5284 5268 if ((sa += m) <= 0) {
5285 5269 /*
5286 5270 * Don't allow the smoothed average to be negative.
5287 5271 * We use 0 to denote reinitialization of the
5288 5272 * variables.
5289 5273 */
5290 5274 sa = 1;
5291 5275 }
5292 5276
5293 5277 /*
5294 5278 * Update deviation estimator:
5295 5279 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5296 5280 */
5297 5281 if (m < 0)
5298 5282 m = -m;
5299 5283 m -= sv >> 2;
5300 5284 sv += m;
5301 5285 } else {
5302 5286 /*
5303 5287 * This follows BSD's implementation. So the reinitialized
5304 5288 * RTO is 3 * m. We cannot go less than 2 because if the
5305 5289 * link is bandwidth dominated, doubling the window size
5306 5290 * during slow start means doubling the RTT. We want to be
5307 5291 * more conservative when we reinitialize our estimates. 3
5308 5292 * is just a convenient number.
5309 5293 */
5310 5294 sa = m << 3;
5311 5295 sv = m << 1;
5312 5296 }
5313 5297 if (sv < TCP_SD_MIN) {
5314 5298 /*
5315 5299 * We do not know that if sa captures the delay ACK
5316 5300 * effect as in a long train of segments, a receiver
5317 5301 * does not delay its ACKs. So set the minimum of sv
5318 5302 * to be TCP_SD_MIN, which is default to 400 ms, twice
5319 5303 * of BSD DATO. That means the minimum of mean
5320 5304 * deviation is 100 ms.
5321 5305 *
5322 5306 */
5323 5307 sv = TCP_SD_MIN;
5324 5308 }
5325 5309 tcp->tcp_rtt_sa = sa;
5326 5310 tcp->tcp_rtt_sd = sv;
5327 5311 /*
5328 5312 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5329 5313 *
5330 5314 * Add tcp_rexmit_interval extra in case of extreme environment
5331 5315 * where the algorithm fails to work. The default value of
5332 5316 * tcp_rexmit_interval_extra should be 0.
5333 5317 *
5334 5318 * As we use a finer grained clock than BSD and update
5335 5319 * RTO for every ACKs, add in another .25 of RTT to the
5336 5320 * deviation of RTO to accomodate burstiness of 1/4 of
5337 5321 * window size.
5338 5322 */
5339 5323 rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5340 5324
5341 5325 TCP_SET_RTO(tcp, rto);
5342 5326
5343 5327 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5344 5328 tcp->tcp_timer_backoff = 0;
5345 5329 }
5346 5330
5347 5331 /*
5348 5332 * On a labeled system we have some protocols above TCP, such as RPC, which
5349 5333 * appear to assume that every mblk in a chain has a db_credp.
5350 5334 */
5351 5335 static void
5352 5336 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5353 5337 {
5354 5338 ASSERT(is_system_labeled());
5355 5339 ASSERT(ira->ira_cred != NULL);
5356 5340
5357 5341 while (mp != NULL) {
5358 5342 mblk_setcred(mp, ira->ira_cred, NOPID);
5359 5343 mp = mp->b_cont;
5360 5344 }
5361 5345 }
5362 5346
5363 5347 uint_t
5364 5348 tcp_rwnd_reopen(tcp_t *tcp)
5365 5349 {
5366 5350 uint_t ret = 0;
5367 5351 uint_t thwin;
5368 5352 conn_t *connp = tcp->tcp_connp;
5369 5353
5370 5354 /* Learn the latest rwnd information that we sent to the other side. */
5371 5355 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5372 5356 << tcp->tcp_rcv_ws;
5373 5357 /* This is peer's calculated send window (our receive window). */
5374 5358 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5375 5359 /*
5376 5360 * Increase the receive window to max. But we need to do receiver
5377 5361 * SWS avoidance. This means that we need to check the increase of
5378 5362 * of receive window is at least 1 MSS.
5379 5363 */
5380 5364 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5381 5365 /*
5382 5366 * If the window that the other side knows is less than max
5383 5367 * deferred acks segments, send an update immediately.
5384 5368 */
5385 5369 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5386 5370 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5387 5371 ret = TH_ACK_NEEDED;
5388 5372 }
5389 5373 tcp->tcp_rwnd = connp->conn_rcvbuf;
5390 5374 }
5391 5375 return (ret);
5392 5376 }
5393 5377
5394 5378 /*
5395 5379 * Handle a packet that has been reclassified by TCP.
5396 5380 * This function drops the ref on connp that the caller had.
5397 5381 */
5398 5382 void
5399 5383 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5400 5384 {
5401 5385 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5402 5386
5403 5387 if (connp->conn_incoming_ifindex != 0 &&
5404 5388 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5405 5389 freemsg(mp);
5406 5390 CONN_DEC_REF(connp);
5407 5391 return;
5408 5392 }
5409 5393
5410 5394 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5411 5395 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5412 5396 ip6_t *ip6h;
5413 5397 ipha_t *ipha;
5414 5398
5415 5399 if (ira->ira_flags & IRAF_IS_IPV4) {
5416 5400 ipha = (ipha_t *)mp->b_rptr;
5417 5401 ip6h = NULL;
5418 5402 } else {
5419 5403 ipha = NULL;
5420 5404 ip6h = (ip6_t *)mp->b_rptr;
5421 5405 }
5422 5406 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5423 5407 if (mp == NULL) {
5424 5408 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5425 5409 /* Note that mp is NULL */
5426 5410 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5427 5411 CONN_DEC_REF(connp);
5428 5412 return;
5429 5413 }
5430 5414 }
5431 5415
5432 5416 if (IPCL_IS_TCP(connp)) {
5433 5417 /*
5434 5418 * do not drain, certain use cases can blow
5435 5419 * the stack
5436 5420 */
5437 5421 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5438 5422 connp->conn_recv, connp, ira,
5439 5423 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5440 5424 } else {
5441 5425 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5442 5426 (connp->conn_recv)(connp, mp, NULL,
5443 5427 ira);
5444 5428 CONN_DEC_REF(connp);
5445 5429 }
5446 5430
5447 5431 }
5448 5432
5449 5433 /* ARGSUSED */
5450 5434 static void
5451 5435 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5452 5436 {
5453 5437 conn_t *connp = (conn_t *)arg;
5454 5438 tcp_t *tcp = connp->conn_tcp;
5455 5439 queue_t *q = connp->conn_rq;
5456 5440
5457 5441 ASSERT(!IPCL_IS_NONSTR(connp));
5458 5442 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5459 5443 tcp->tcp_rsrv_mp = mp;
5460 5444 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5461 5445
5462 5446 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5463 5447 return;
5464 5448 }
5465 5449
5466 5450 if (tcp->tcp_fused) {
5467 5451 tcp_fuse_backenable(tcp);
5468 5452 return;
5469 5453 }
5470 5454
5471 5455 if (canputnext(q)) {
5472 5456 /* Not flow-controlled, open rwnd */
5473 5457 tcp->tcp_rwnd = connp->conn_rcvbuf;
5474 5458
5475 5459 /*
5476 5460 * Send back a window update immediately if TCP is above
5477 5461 * ESTABLISHED state and the increase of the rcv window
5478 5462 * that the other side knows is at least 1 MSS after flow
5479 5463 * control is lifted.
5480 5464 */
5481 5465 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5482 5466 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5483 5467 tcp_xmit_ctl(NULL, tcp,
5484 5468 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5485 5469 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5486 5470 }
5487 5471 }
5488 5472 }
5489 5473
5490 5474 /*
5491 5475 * The read side service routine is called mostly when we get back-enabled as a
5492 5476 * result of flow control relief. Since we don't actually queue anything in
5493 5477 * TCP, we have no data to send out of here. What we do is clear the receive
5494 5478 * window, and send out a window update.
5495 5479 */
5496 5480 void
5497 5481 tcp_rsrv(queue_t *q)
5498 5482 {
5499 5483 conn_t *connp = Q_TO_CONN(q);
5500 5484 tcp_t *tcp = connp->conn_tcp;
5501 5485 mblk_t *mp;
5502 5486
5503 5487 /* No code does a putq on the read side */
5504 5488 ASSERT(q->q_first == NULL);
5505 5489
5506 5490 /*
5507 5491 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5508 5492 * been run. So just return.
5509 5493 */
5510 5494 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5511 5495 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5512 5496 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5513 5497 return;
5514 5498 }
5515 5499 tcp->tcp_rsrv_mp = NULL;
5516 5500 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5517 5501
5518 5502 CONN_INC_REF(connp);
5519 5503 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5520 5504 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5521 5505 }
5522 5506
5523 5507 /* At minimum we need 8 bytes in the TCP header for the lookup */
5524 5508 #define ICMP_MIN_TCP_HDR 8
5525 5509
5526 5510 /*
5527 5511 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5528 5512 * passed up by IP. The message is always received on the correct tcp_t.
5529 5513 * Assumes that IP has pulled up everything up to and including the ICMP header.
5530 5514 */
5531 5515 /* ARGSUSED2 */
5532 5516 void
5533 5517 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5534 5518 {
5535 5519 conn_t *connp = (conn_t *)arg1;
5536 5520 icmph_t *icmph;
5537 5521 ipha_t *ipha;
5538 5522 int iph_hdr_length;
5539 5523 tcpha_t *tcpha;
5540 5524 uint32_t seg_seq;
5541 5525 tcp_t *tcp = connp->conn_tcp;
5542 5526
5543 5527 /* Assume IP provides aligned packets */
5544 5528 ASSERT(OK_32PTR(mp->b_rptr));
5545 5529 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5546 5530
5547 5531 /*
5548 5532 * It's possible we have a closed, but not yet destroyed, TCP
5549 5533 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5550 5534 * in the closed state, so don't take any chances and drop the packet.
5551 5535 */
5552 5536 if (tcp->tcp_state == TCPS_CLOSED) {
5553 5537 freemsg(mp);
5554 5538 return;
5555 5539 }
5556 5540
5557 5541 /*
5558 5542 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5559 5543 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5560 5544 */
5561 5545 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5562 5546 tcp_icmp_error_ipv6(tcp, mp, ira);
5563 5547 return;
5564 5548 }
5565 5549
5566 5550 /* Skip past the outer IP and ICMP headers */
5567 5551 iph_hdr_length = ira->ira_ip_hdr_length;
5568 5552 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5569 5553 /*
5570 5554 * If we don't have the correct outer IP header length
5571 5555 * or if we don't have a complete inner IP header
5572 5556 * drop it.
5573 5557 */
5574 5558 if (iph_hdr_length < sizeof (ipha_t) ||
5575 5559 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5576 5560 noticmpv4:
5577 5561 freemsg(mp);
5578 5562 return;
5579 5563 }
5580 5564 ipha = (ipha_t *)&icmph[1];
5581 5565
5582 5566 /* Skip past the inner IP and find the ULP header */
5583 5567 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5584 5568 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5585 5569 /*
5586 5570 * If we don't have the correct inner IP header length or if the ULP
5587 5571 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5588 5572 * bytes of TCP header, drop it.
5589 5573 */
5590 5574 if (iph_hdr_length < sizeof (ipha_t) ||
5591 5575 ipha->ipha_protocol != IPPROTO_TCP ||
5592 5576 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5593 5577 goto noticmpv4;
5594 5578 }
5595 5579
5596 5580 seg_seq = ntohl(tcpha->tha_seq);
5597 5581 switch (icmph->icmph_type) {
5598 5582 case ICMP_DEST_UNREACHABLE:
5599 5583 switch (icmph->icmph_code) {
5600 5584 case ICMP_FRAGMENTATION_NEEDED:
5601 5585 /*
5602 5586 * Update Path MTU, then try to send something out.
5603 5587 */
5604 5588 tcp_update_pmtu(tcp, B_TRUE);
5605 5589 tcp_rexmit_after_error(tcp);
5606 5590 break;
5607 5591 case ICMP_PORT_UNREACHABLE:
5608 5592 case ICMP_PROTOCOL_UNREACHABLE:
5609 5593 switch (tcp->tcp_state) {
5610 5594 case TCPS_SYN_SENT:
5611 5595 case TCPS_SYN_RCVD:
5612 5596 /*
5613 5597 * ICMP can snipe away incipient
5614 5598 * TCP connections as long as
5615 5599 * seq number is same as initial
5616 5600 * send seq number.
5617 5601 */
5618 5602 if (seg_seq == tcp->tcp_iss) {
5619 5603 (void) tcp_clean_death(tcp,
5620 5604 ECONNREFUSED);
5621 5605 }
5622 5606 break;
5623 5607 }
5624 5608 break;
5625 5609 case ICMP_HOST_UNREACHABLE:
5626 5610 case ICMP_NET_UNREACHABLE:
5627 5611 /* Record the error in case we finally time out. */
5628 5612 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5629 5613 tcp->tcp_client_errno = EHOSTUNREACH;
5630 5614 else
5631 5615 tcp->tcp_client_errno = ENETUNREACH;
5632 5616 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5633 5617 if (tcp->tcp_listener != NULL &&
5634 5618 tcp->tcp_listener->tcp_syn_defense) {
5635 5619 /*
5636 5620 * Ditch the half-open connection if we
5637 5621 * suspect a SYN attack is under way.
5638 5622 */
5639 5623 (void) tcp_clean_death(tcp,
5640 5624 tcp->tcp_client_errno);
5641 5625 }
5642 5626 }
5643 5627 break;
5644 5628 default:
5645 5629 break;
5646 5630 }
5647 5631 break;
5648 5632 case ICMP_SOURCE_QUENCH: {
5649 5633 /*
5650 5634 * use a global boolean to control
5651 5635 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5652 5636 * The default is false.
5653 5637 */
5654 5638 if (tcp_icmp_source_quench) {
5655 5639 /*
5656 5640 * Reduce the sending rate as if we got a
5657 5641 * retransmit timeout
5658 5642 */
5659 5643 uint32_t npkt;
5660 5644
5661 5645 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5662 5646 tcp->tcp_mss;
5663 5647 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5664 5648 tcp->tcp_cwnd = tcp->tcp_mss;
5665 5649 tcp->tcp_cwnd_cnt = 0;
5666 5650 }
5667 5651 break;
5668 5652 }
5669 5653 }
5670 5654 freemsg(mp);
5671 5655 }
5672 5656
5673 5657 /*
5674 5658 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5675 5659 * error messages passed up by IP.
5676 5660 * Assumes that IP has pulled up all the extension headers as well
5677 5661 * as the ICMPv6 header.
5678 5662 */
5679 5663 static void
5680 5664 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5681 5665 {
5682 5666 icmp6_t *icmp6;
5683 5667 ip6_t *ip6h;
5684 5668 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5685 5669 tcpha_t *tcpha;
5686 5670 uint8_t *nexthdrp;
5687 5671 uint32_t seg_seq;
5688 5672
5689 5673 /*
5690 5674 * Verify that we have a complete IP header.
5691 5675 */
5692 5676 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5693 5677
5694 5678 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5695 5679 ip6h = (ip6_t *)&icmp6[1];
5696 5680 /*
5697 5681 * Verify if we have a complete ICMP and inner IP header.
5698 5682 */
5699 5683 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5700 5684 noticmpv6:
5701 5685 freemsg(mp);
5702 5686 return;
5703 5687 }
5704 5688
5705 5689 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5706 5690 goto noticmpv6;
5707 5691 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5708 5692 /*
5709 5693 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5710 5694 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5711 5695 * packet.
5712 5696 */
5713 5697 if ((*nexthdrp != IPPROTO_TCP) ||
5714 5698 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5715 5699 goto noticmpv6;
5716 5700 }
5717 5701
5718 5702 seg_seq = ntohl(tcpha->tha_seq);
5719 5703 switch (icmp6->icmp6_type) {
5720 5704 case ICMP6_PACKET_TOO_BIG:
5721 5705 /*
5722 5706 * Update Path MTU, then try to send something out.
5723 5707 */
5724 5708 tcp_update_pmtu(tcp, B_TRUE);
5725 5709 tcp_rexmit_after_error(tcp);
5726 5710 break;
5727 5711 case ICMP6_DST_UNREACH:
5728 5712 switch (icmp6->icmp6_code) {
5729 5713 case ICMP6_DST_UNREACH_NOPORT:
5730 5714 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5731 5715 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5732 5716 (seg_seq == tcp->tcp_iss)) {
5733 5717 (void) tcp_clean_death(tcp, ECONNREFUSED);
5734 5718 }
5735 5719 break;
5736 5720 case ICMP6_DST_UNREACH_ADMIN:
5737 5721 case ICMP6_DST_UNREACH_NOROUTE:
5738 5722 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5739 5723 case ICMP6_DST_UNREACH_ADDR:
5740 5724 /* Record the error in case we finally time out. */
5741 5725 tcp->tcp_client_errno = EHOSTUNREACH;
5742 5726 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5743 5727 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5744 5728 (seg_seq == tcp->tcp_iss)) {
5745 5729 if (tcp->tcp_listener != NULL &&
5746 5730 tcp->tcp_listener->tcp_syn_defense) {
5747 5731 /*
5748 5732 * Ditch the half-open connection if we
5749 5733 * suspect a SYN attack is under way.
5750 5734 */
5751 5735 (void) tcp_clean_death(tcp,
5752 5736 tcp->tcp_client_errno);
5753 5737 }
5754 5738 }
5755 5739
5756 5740
5757 5741 break;
5758 5742 default:
5759 5743 break;
5760 5744 }
5761 5745 break;
5762 5746 case ICMP6_PARAM_PROB:
5763 5747 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5764 5748 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5765 5749 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5766 5750 (uchar_t *)nexthdrp) {
5767 5751 if (tcp->tcp_state == TCPS_SYN_SENT ||
5768 5752 tcp->tcp_state == TCPS_SYN_RCVD) {
5769 5753 (void) tcp_clean_death(tcp, ECONNREFUSED);
5770 5754 }
5771 5755 break;
5772 5756 }
5773 5757 break;
5774 5758
5775 5759 case ICMP6_TIME_EXCEEDED:
5776 5760 default:
5777 5761 break;
5778 5762 }
5779 5763 freemsg(mp);
5780 5764 }
5781 5765
5782 5766 /*
5783 5767 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5784 5768 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5785 5769 *
5786 5770 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5787 5771 * error messages received by IP. The message is always received on the correct
5788 5772 * tcp_t.
5789 5773 */
5790 5774 /* ARGSUSED */
5791 5775 boolean_t
5792 5776 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5793 5777 ip_recv_attr_t *ira)
5794 5778 {
5795 5779 tcpha_t *tcpha = (tcpha_t *)arg2;
5796 5780 uint32_t seq = ntohl(tcpha->tha_seq);
5797 5781 tcp_t *tcp = connp->conn_tcp;
5798 5782
5799 5783 /*
5800 5784 * TCP sequence number contained in payload of the ICMP error message
5801 5785 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5802 5786 * the message is either a stale ICMP error, or an attack from the
5803 5787 * network. Fail the verification.
5804 5788 */
5805 5789 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5806 5790 return (B_FALSE);
5807 5791
5808 5792 /* For "too big" we also check the ignore flag */
5809 5793 if (ira->ira_flags & IRAF_IS_IPV4) {
5810 5794 ASSERT(icmph != NULL);
5811 5795 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5812 5796 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5813 5797 tcp->tcp_tcps->tcps_ignore_path_mtu)
5814 5798 return (B_FALSE);
5815 5799 } else {
5816 5800 ASSERT(icmp6 != NULL);
5817 5801 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5818 5802 tcp->tcp_tcps->tcps_ignore_path_mtu)
5819 5803 return (B_FALSE);
5820 5804 }
5821 5805 return (B_TRUE);
5822 5806 }
|
↓ open down ↓ |
1528 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX