1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 1991, 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright (c) 2011, Joyent Inc. All rights reserved. 25 * Copyright (c) 2011 Nexenta Systems, Inc. All rights reserved. 26 */ 27 /* Copyright (c) 1990 Mentat Inc. */ 28 29 #include <sys/types.h> 30 #include <sys/stream.h> 31 #include <sys/strsun.h> 32 #include <sys/strsubr.h> 33 #include <sys/stropts.h> 34 #include <sys/strlog.h> 35 #define _SUN_TPI_VERSION 2 36 #include <sys/tihdr.h> 37 #include <sys/timod.h> 38 #include <sys/ddi.h> 39 #include <sys/sunddi.h> 40 #include <sys/suntpi.h> 41 #include <sys/xti_inet.h> 42 #include <sys/cmn_err.h> 43 #include <sys/debug.h> 44 #include <sys/sdt.h> 45 #include <sys/vtrace.h> 46 #include <sys/kmem.h> 47 #include <sys/ethernet.h> 48 #include <sys/cpuvar.h> 49 #include <sys/dlpi.h> 50 #include <sys/pattr.h> 51 #include <sys/policy.h> 52 #include <sys/priv.h> 53 #include <sys/zone.h> 54 #include <sys/sunldi.h> 55 56 #include <sys/errno.h> 57 #include <sys/signal.h> 58 #include <sys/socket.h> 59 #include <sys/socketvar.h> 60 #include <sys/sockio.h> 61 #include <sys/isa_defs.h> 62 #include <sys/md5.h> 63 #include <sys/random.h> 64 #include <sys/uio.h> 65 #include <sys/systm.h> 66 #include <netinet/in.h> 67 #include <netinet/tcp.h> 68 #include <netinet/ip6.h> 69 #include <netinet/icmp6.h> 70 #include <net/if.h> 71 #include <net/route.h> 72 #include <inet/ipsec_impl.h> 73 74 #include <inet/common.h> 75 #include <inet/ip.h> 76 #include <inet/ip_impl.h> 77 #include <inet/ip6.h> 78 #include <inet/ip_ndp.h> 79 #include <inet/proto_set.h> 80 #include <inet/mib2.h> 81 #include <inet/optcom.h> 82 #include <inet/snmpcom.h> 83 #include <inet/kstatcom.h> 84 #include <inet/tcp.h> 85 #include <inet/tcp_impl.h> 86 #include <inet/tcp_cluster.h> 87 #include <inet/udp_impl.h> 88 #include <net/pfkeyv2.h> 89 #include <inet/ipdrop.h> 90 91 #include <inet/ipclassifier.h> 92 #include <inet/ip_ire.h> 93 #include <inet/ip_ftable.h> 94 #include <inet/ip_if.h> 95 #include <inet/ipp_common.h> 96 #include <inet/ip_rts.h> 97 #include <inet/ip_netinfo.h> 98 #include <sys/squeue_impl.h> 99 #include <sys/squeue.h> 100 #include <sys/tsol/label.h> 101 #include <sys/tsol/tnet.h> 102 #include <rpc/pmap_prot.h> 103 #include <sys/callo.h> 104 105 /* 106 * TCP Notes: aka FireEngine Phase I (PSARC 2002/433) 107 * 108 * (Read the detailed design doc in PSARC case directory) 109 * 110 * The entire tcp state is contained in tcp_t and conn_t structure 111 * which are allocated in tandem using ipcl_conn_create() and passing 112 * IPCL_TCPCONN as a flag. We use 'conn_ref' and 'conn_lock' to protect 113 * the references on the tcp_t. The tcp_t structure is never compressed 114 * and packets always land on the correct TCP perimeter from the time 115 * eager is created till the time tcp_t dies (as such the old mentat 116 * TCP global queue is not used for detached state and no IPSEC checking 117 * is required). The global queue is still allocated to send out resets 118 * for connection which have no listeners and IP directly calls 119 * tcp_xmit_listeners_reset() which does any policy check. 120 * 121 * Protection and Synchronisation mechanism: 122 * 123 * The tcp data structure does not use any kind of lock for protecting 124 * its state but instead uses 'squeues' for mutual exclusion from various 125 * read and write side threads. To access a tcp member, the thread should 126 * always be behind squeue (via squeue_enter with flags as SQ_FILL, SQ_PROCESS, 127 * or SQ_NODRAIN). Since the squeues allow a direct function call, caller 128 * can pass any tcp function having prototype of edesc_t as argument 129 * (different from traditional STREAMs model where packets come in only 130 * designated entry points). The list of functions that can be directly 131 * called via squeue are listed before the usual function prototype. 132 * 133 * Referencing: 134 * 135 * TCP is MT-Hot and we use a reference based scheme to make sure that the 136 * tcp structure doesn't disappear when its needed. When the application 137 * creates an outgoing connection or accepts an incoming connection, we 138 * start out with 2 references on 'conn_ref'. One for TCP and one for IP. 139 * The IP reference is just a symbolic reference since ip_tcpclose() 140 * looks at tcp structure after tcp_close_output() returns which could 141 * have dropped the last TCP reference. So as long as the connection is 142 * in attached state i.e. !TCP_IS_DETACHED, we have 2 references on the 143 * conn_t. The classifier puts its own reference when the connection is 144 * inserted in listen or connected hash. Anytime a thread needs to enter 145 * the tcp connection perimeter, it retrieves the conn/tcp from q->ptr 146 * on write side or by doing a classify on read side and then puts a 147 * reference on the conn before doing squeue_enter/tryenter/fill. For 148 * read side, the classifier itself puts the reference under fanout lock 149 * to make sure that tcp can't disappear before it gets processed. The 150 * squeue will drop this reference automatically so the called function 151 * doesn't have to do a DEC_REF. 152 * 153 * Opening a new connection: 154 * 155 * The outgoing connection open is pretty simple. tcp_open() does the 156 * work in creating the conn/tcp structure and initializing it. The 157 * squeue assignment is done based on the CPU the application 158 * is running on. So for outbound connections, processing is always done 159 * on application CPU which might be different from the incoming CPU 160 * being interrupted by the NIC. An optimal way would be to figure out 161 * the NIC <-> CPU binding at listen time, and assign the outgoing 162 * connection to the squeue attached to the CPU that will be interrupted 163 * for incoming packets (we know the NIC based on the bind IP address). 164 * This might seem like a problem if more data is going out but the 165 * fact is that in most cases the transmit is ACK driven transmit where 166 * the outgoing data normally sits on TCP's xmit queue waiting to be 167 * transmitted. 168 * 169 * Accepting a connection: 170 * 171 * This is a more interesting case because of various races involved in 172 * establishing a eager in its own perimeter. Read the meta comment on 173 * top of tcp_input_listener(). But briefly, the squeue is picked by 174 * ip_fanout based on the ring or the sender (if loopback). 175 * 176 * Closing a connection: 177 * 178 * The close is fairly straight forward. tcp_close() calls tcp_close_output() 179 * via squeue to do the close and mark the tcp as detached if the connection 180 * was in state TCPS_ESTABLISHED or greater. In the later case, TCP keep its 181 * reference but tcp_close() drop IP's reference always. So if tcp was 182 * not killed, it is sitting in time_wait list with 2 reference - 1 for TCP 183 * and 1 because it is in classifier's connected hash. This is the condition 184 * we use to determine that its OK to clean up the tcp outside of squeue 185 * when time wait expires (check the ref under fanout and conn_lock and 186 * if it is 2, remove it from fanout hash and kill it). 187 * 188 * Although close just drops the necessary references and marks the 189 * tcp_detached state, tcp_close needs to know the tcp_detached has been 190 * set (under squeue) before letting the STREAM go away (because a 191 * inbound packet might attempt to go up the STREAM while the close 192 * has happened and tcp_detached is not set). So a special lock and 193 * flag is used along with a condition variable (tcp_closelock, tcp_closed, 194 * and tcp_closecv) to signal tcp_close that tcp_close_out() has marked 195 * tcp_detached. 196 * 197 * Special provisions and fast paths: 198 * 199 * We make special provisions for sockfs by marking tcp_issocket 200 * whenever we have only sockfs on top of TCP. This allows us to skip 201 * putting the tcp in acceptor hash since a sockfs listener can never 202 * become acceptor and also avoid allocating a tcp_t for acceptor STREAM 203 * since eager has already been allocated and the accept now happens 204 * on acceptor STREAM. There is a big blob of comment on top of 205 * tcp_input_listener explaining the new accept. When socket is POP'd, 206 * sockfs sends us an ioctl to mark the fact and we go back to old 207 * behaviour. Once tcp_issocket is unset, its never set for the 208 * life of that connection. 209 * 210 * IPsec notes : 211 * 212 * Since a packet is always executed on the correct TCP perimeter 213 * all IPsec processing is defered to IP including checking new 214 * connections and setting IPSEC policies for new connection. The 215 * only exception is tcp_xmit_listeners_reset() which is called 216 * directly from IP and needs to policy check to see if TH_RST 217 * can be sent out. 218 */ 219 220 /* 221 * Values for squeue switch: 222 * 1: SQ_NODRAIN 223 * 2: SQ_PROCESS 224 * 3: SQ_FILL 225 */ 226 int tcp_squeue_wput = 2; /* /etc/systems */ 227 int tcp_squeue_flag; 228 229 /* 230 * To prevent memory hog, limit the number of entries in tcp_free_list 231 * to 1% of available memory / number of cpus 232 */ 233 uint_t tcp_free_list_max_cnt = 0; 234 235 #define TCP_XMIT_LOWATER 4096 236 #define TCP_XMIT_HIWATER 49152 237 #define TCP_RECV_LOWATER 2048 238 #define TCP_RECV_HIWATER 128000 239 240 #define TIDUSZ 4096 /* transport interface data unit size */ 241 242 /* 243 * Size of acceptor hash list. It has to be a power of 2 for hashing. 244 */ 245 #define TCP_ACCEPTOR_FANOUT_SIZE 512 246 247 #ifdef _ILP32 248 #define TCP_ACCEPTOR_HASH(accid) \ 249 (((uint_t)(accid) >> 8) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 250 #else 251 #define TCP_ACCEPTOR_HASH(accid) \ 252 ((uint_t)(accid) & (TCP_ACCEPTOR_FANOUT_SIZE - 1)) 253 #endif /* _ILP32 */ 254 255 /* 256 * Minimum number of connections which can be created per listener. Used 257 * when the listener connection count is in effect. 258 */ 259 static uint32_t tcp_min_conn_listener = 2; 260 261 uint32_t tcp_early_abort = 30; 262 263 /* TCP Timer control structure */ 264 typedef struct tcpt_s { 265 pfv_t tcpt_pfv; /* The routine we are to call */ 266 tcp_t *tcpt_tcp; /* The parameter we are to pass in */ 267 } tcpt_t; 268 269 /* 270 * Functions called directly via squeue having a prototype of edesc_t. 271 */ 272 void tcp_input_listener(void *arg, mblk_t *mp, void *arg2, 273 ip_recv_attr_t *ira); 274 void tcp_input_data(void *arg, mblk_t *mp, void *arg2, 275 ip_recv_attr_t *ira); 276 static void tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, 277 ip_recv_attr_t *dummy); 278 279 280 /* Prototype for TCP functions */ 281 static void tcp_random_init(void); 282 int tcp_random(void); 283 static int tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, 284 in_port_t dstport, uint_t srcid); 285 static int tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, 286 in_port_t dstport, uint32_t flowinfo, 287 uint_t srcid, uint32_t scope_id); 288 static void tcp_iss_init(tcp_t *tcp); 289 static void tcp_reinit(tcp_t *tcp); 290 static void tcp_reinit_values(tcp_t *tcp); 291 292 static void tcp_wsrv(queue_t *q); 293 static void tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa); 294 static void tcp_update_zcopy(tcp_t *tcp); 295 static void tcp_notify(void *, ip_xmit_attr_t *, ixa_notify_type_t, 296 ixa_notify_arg_t); 297 static void *tcp_stack_init(netstackid_t stackid, netstack_t *ns); 298 static void tcp_stack_fini(netstackid_t stackid, void *arg); 299 300 static int tcp_squeue_switch(int); 301 302 static int tcp_open(queue_t *, dev_t *, int, int, cred_t *, boolean_t); 303 static int tcp_openv4(queue_t *, dev_t *, int, int, cred_t *); 304 static int tcp_openv6(queue_t *, dev_t *, int, int, cred_t *); 305 306 static void tcp_squeue_add(squeue_t *); 307 308 struct module_info tcp_rinfo = { 309 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, TCP_RECV_HIWATER, TCP_RECV_LOWATER 310 }; 311 312 static struct module_info tcp_winfo = { 313 TCP_MOD_ID, TCP_MOD_NAME, 0, INFPSZ, 127, 16 314 }; 315 316 /* 317 * Entry points for TCP as a device. The normal case which supports 318 * the TCP functionality. 319 * We have separate open functions for the /dev/tcp and /dev/tcp6 devices. 320 */ 321 struct qinit tcp_rinitv4 = { 322 NULL, (pfi_t)tcp_rsrv, tcp_openv4, tcp_tpi_close, NULL, &tcp_rinfo 323 }; 324 325 struct qinit tcp_rinitv6 = { 326 NULL, (pfi_t)tcp_rsrv, tcp_openv6, tcp_tpi_close, NULL, &tcp_rinfo 327 }; 328 329 struct qinit tcp_winit = { 330 (pfi_t)tcp_wput, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 331 }; 332 333 /* Initial entry point for TCP in socket mode. */ 334 struct qinit tcp_sock_winit = { 335 (pfi_t)tcp_wput_sock, (pfi_t)tcp_wsrv, NULL, NULL, NULL, &tcp_winfo 336 }; 337 338 /* TCP entry point during fallback */ 339 struct qinit tcp_fallback_sock_winit = { 340 (pfi_t)tcp_wput_fallback, NULL, NULL, NULL, NULL, &tcp_winfo 341 }; 342 343 /* 344 * Entry points for TCP as a acceptor STREAM opened by sockfs when doing 345 * an accept. Avoid allocating data structures since eager has already 346 * been created. 347 */ 348 struct qinit tcp_acceptor_rinit = { 349 NULL, (pfi_t)tcp_rsrv, NULL, tcp_tpi_close_accept, NULL, &tcp_winfo 350 }; 351 352 struct qinit tcp_acceptor_winit = { 353 (pfi_t)tcp_tpi_accept, NULL, NULL, NULL, NULL, &tcp_winfo 354 }; 355 356 /* For AF_INET aka /dev/tcp */ 357 struct streamtab tcpinfov4 = { 358 &tcp_rinitv4, &tcp_winit 359 }; 360 361 /* For AF_INET6 aka /dev/tcp6 */ 362 struct streamtab tcpinfov6 = { 363 &tcp_rinitv6, &tcp_winit 364 }; 365 366 /* 367 * Following assumes TPI alignment requirements stay along 32 bit 368 * boundaries 369 */ 370 #define ROUNDUP32(x) \ 371 (((x) + (sizeof (int32_t) - 1)) & ~(sizeof (int32_t) - 1)) 372 373 /* Template for response to info request. */ 374 struct T_info_ack tcp_g_t_info_ack = { 375 T_INFO_ACK, /* PRIM_type */ 376 0, /* TSDU_size */ 377 T_INFINITE, /* ETSDU_size */ 378 T_INVALID, /* CDATA_size */ 379 T_INVALID, /* DDATA_size */ 380 sizeof (sin_t), /* ADDR_size */ 381 0, /* OPT_size - not initialized here */ 382 TIDUSZ, /* TIDU_size */ 383 T_COTS_ORD, /* SERV_type */ 384 TCPS_IDLE, /* CURRENT_state */ 385 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 386 }; 387 388 struct T_info_ack tcp_g_t_info_ack_v6 = { 389 T_INFO_ACK, /* PRIM_type */ 390 0, /* TSDU_size */ 391 T_INFINITE, /* ETSDU_size */ 392 T_INVALID, /* CDATA_size */ 393 T_INVALID, /* DDATA_size */ 394 sizeof (sin6_t), /* ADDR_size */ 395 0, /* OPT_size - not initialized here */ 396 TIDUSZ, /* TIDU_size */ 397 T_COTS_ORD, /* SERV_type */ 398 TCPS_IDLE, /* CURRENT_state */ 399 (XPG4_1|EXPINLINE) /* PROVIDER_flag */ 400 }; 401 402 /* 403 * TCP tunables related declarations. Definitions are in tcp_tunables.c 404 */ 405 extern mod_prop_info_t tcp_propinfo_tbl[]; 406 extern int tcp_propinfo_count; 407 408 #define IS_VMLOANED_MBLK(mp) \ 409 (((mp)->b_datap->db_struioflag & STRUIO_ZC) != 0) 410 411 uint32_t do_tcpzcopy = 1; /* 0: disable, 1: enable, 2: force */ 412 413 /* 414 * Forces all connections to obey the value of the tcps_maxpsz_multiplier 415 * tunable settable via NDD. Otherwise, the per-connection behavior is 416 * determined dynamically during tcp_set_destination(), which is the default. 417 */ 418 boolean_t tcp_static_maxpsz = B_FALSE; 419 420 /* 421 * If the receive buffer size is changed, this function is called to update 422 * the upper socket layer on the new delayed receive wake up threshold. 423 */ 424 static void 425 tcp_set_recv_threshold(tcp_t *tcp, uint32_t new_rcvthresh) 426 { 427 uint32_t default_threshold = SOCKET_RECVHIWATER >> 3; 428 429 if (IPCL_IS_NONSTR(tcp->tcp_connp)) { 430 conn_t *connp = tcp->tcp_connp; 431 struct sock_proto_props sopp; 432 433 /* 434 * only increase rcvthresh upto default_threshold 435 */ 436 if (new_rcvthresh > default_threshold) 437 new_rcvthresh = default_threshold; 438 439 sopp.sopp_flags = SOCKOPT_RCVTHRESH; 440 sopp.sopp_rcvthresh = new_rcvthresh; 441 442 (*connp->conn_upcalls->su_set_proto_props) 443 (connp->conn_upper_handle, &sopp); 444 } 445 } 446 447 /* 448 * Figure out the value of window scale opton. Note that the rwnd is 449 * ASSUMED to be rounded up to the nearest MSS before the calculation. 450 * We cannot find the scale value and then do a round up of tcp_rwnd 451 * because the scale value may not be correct after that. 452 * 453 * Set the compiler flag to make this function inline. 454 */ 455 void 456 tcp_set_ws_value(tcp_t *tcp) 457 { 458 int i; 459 uint32_t rwnd = tcp->tcp_rwnd; 460 461 for (i = 0; rwnd > TCP_MAXWIN && i < TCP_MAX_WINSHIFT; 462 i++, rwnd >>= 1) 463 ; 464 tcp->tcp_rcv_ws = i; 465 } 466 467 /* 468 * Remove cached/latched IPsec references. 469 */ 470 void 471 tcp_ipsec_cleanup(tcp_t *tcp) 472 { 473 conn_t *connp = tcp->tcp_connp; 474 475 ASSERT(connp->conn_flags & IPCL_TCPCONN); 476 477 if (connp->conn_latch != NULL) { 478 IPLATCH_REFRELE(connp->conn_latch); 479 connp->conn_latch = NULL; 480 } 481 if (connp->conn_latch_in_policy != NULL) { 482 IPPOL_REFRELE(connp->conn_latch_in_policy); 483 connp->conn_latch_in_policy = NULL; 484 } 485 if (connp->conn_latch_in_action != NULL) { 486 IPACT_REFRELE(connp->conn_latch_in_action); 487 connp->conn_latch_in_action = NULL; 488 } 489 if (connp->conn_policy != NULL) { 490 IPPH_REFRELE(connp->conn_policy, connp->conn_netstack); 491 connp->conn_policy = NULL; 492 } 493 } 494 495 /* 496 * Cleaup before placing on free list. 497 * Disassociate from the netstack/tcp_stack_t since the freelist 498 * is per squeue and not per netstack. 499 */ 500 void 501 tcp_cleanup(tcp_t *tcp) 502 { 503 mblk_t *mp; 504 conn_t *connp = tcp->tcp_connp; 505 tcp_stack_t *tcps = tcp->tcp_tcps; 506 netstack_t *ns = tcps->tcps_netstack; 507 mblk_t *tcp_rsrv_mp; 508 509 tcp_bind_hash_remove(tcp); 510 511 /* Cleanup that which needs the netstack first */ 512 tcp_ipsec_cleanup(tcp); 513 ixa_cleanup(connp->conn_ixa); 514 515 if (connp->conn_ht_iphc != NULL) { 516 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 517 connp->conn_ht_iphc = NULL; 518 connp->conn_ht_iphc_allocated = 0; 519 connp->conn_ht_iphc_len = 0; 520 connp->conn_ht_ulp = NULL; 521 connp->conn_ht_ulp_len = 0; 522 tcp->tcp_ipha = NULL; 523 tcp->tcp_ip6h = NULL; 524 tcp->tcp_tcpha = NULL; 525 } 526 527 /* We clear any IP_OPTIONS and extension headers */ 528 ip_pkt_free(&connp->conn_xmit_ipp); 529 530 tcp_free(tcp); 531 532 /* 533 * Since we will bzero the entire structure, we need to 534 * remove it and reinsert it in global hash list. We 535 * know the walkers can't get to this conn because we 536 * had set CONDEMNED flag earlier and checked reference 537 * under conn_lock so walker won't pick it and when we 538 * go the ipcl_globalhash_remove() below, no walker 539 * can get to it. 540 */ 541 ipcl_globalhash_remove(connp); 542 543 /* Save some state */ 544 mp = tcp->tcp_timercache; 545 546 tcp_rsrv_mp = tcp->tcp_rsrv_mp; 547 548 if (connp->conn_cred != NULL) { 549 crfree(connp->conn_cred); 550 connp->conn_cred = NULL; 551 } 552 ipcl_conn_cleanup(connp); 553 connp->conn_flags = IPCL_TCPCONN; 554 555 /* 556 * Now it is safe to decrement the reference counts. 557 * This might be the last reference on the netstack 558 * in which case it will cause the freeing of the IP Instance. 559 */ 560 connp->conn_netstack = NULL; 561 connp->conn_ixa->ixa_ipst = NULL; 562 netstack_rele(ns); 563 ASSERT(tcps != NULL); 564 tcp->tcp_tcps = NULL; 565 566 bzero(tcp, sizeof (tcp_t)); 567 568 /* restore the state */ 569 tcp->tcp_timercache = mp; 570 571 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 572 573 tcp->tcp_connp = connp; 574 575 ASSERT(connp->conn_tcp == tcp); 576 ASSERT(connp->conn_flags & IPCL_TCPCONN); 577 connp->conn_state_flags = CONN_INCIPIENT; 578 ASSERT(connp->conn_proto == IPPROTO_TCP); 579 ASSERT(connp->conn_ref == 1); 580 } 581 582 /* 583 * Adapt to the information, such as rtt and rtt_sd, provided from the 584 * DCE and IRE maintained by IP. 585 * 586 * Checks for multicast and broadcast destination address. 587 * Returns zero if ok; an errno on failure. 588 * 589 * Note that the MSS calculation here is based on the info given in 590 * the DCE and IRE. We do not do any calculation based on TCP options. They 591 * will be handled in tcp_input_data() when TCP knows which options to use. 592 * 593 * Note on how TCP gets its parameters for a connection. 594 * 595 * When a tcp_t structure is allocated, it gets all the default parameters. 596 * In tcp_set_destination(), it gets those metric parameters, like rtt, rtt_sd, 597 * spipe, rpipe, ... from the route metrics. Route metric overrides the 598 * default. 599 * 600 * An incoming SYN with a multicast or broadcast destination address is dropped 601 * in ip_fanout_v4/v6. 602 * 603 * An incoming SYN with a multicast or broadcast source address is always 604 * dropped in tcp_set_destination, since IPDF_ALLOW_MCBC is not set in 605 * conn_connect. 606 * The same logic in tcp_set_destination also serves to 607 * reject an attempt to connect to a broadcast or multicast (destination) 608 * address. 609 */ 610 int 611 tcp_set_destination(tcp_t *tcp) 612 { 613 uint32_t mss_max; 614 uint32_t mss; 615 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 616 conn_t *connp = tcp->tcp_connp; 617 tcp_stack_t *tcps = tcp->tcp_tcps; 618 iulp_t uinfo; 619 int error; 620 uint32_t flags; 621 622 flags = IPDF_LSO | IPDF_ZCOPY; 623 /* 624 * Make sure we have a dce for the destination to avoid dce_ident 625 * contention for connected sockets. 626 */ 627 flags |= IPDF_UNIQUE_DCE; 628 629 if (!tcps->tcps_ignore_path_mtu) 630 connp->conn_ixa->ixa_flags |= IXAF_PMTU_DISCOVERY; 631 632 /* Use conn_lock to satify ASSERT; tcp is already serialized */ 633 mutex_enter(&connp->conn_lock); 634 error = conn_connect(connp, &uinfo, flags); 635 mutex_exit(&connp->conn_lock); 636 if (error != 0) 637 return (error); 638 639 error = tcp_build_hdrs(tcp); 640 if (error != 0) 641 return (error); 642 643 tcp->tcp_localnet = uinfo.iulp_localnet; 644 645 if (uinfo.iulp_rtt != 0) { 646 clock_t rto; 647 648 tcp->tcp_rtt_sa = uinfo.iulp_rtt; 649 tcp->tcp_rtt_sd = uinfo.iulp_rtt_sd; 650 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 651 tcps->tcps_rexmit_interval_extra + 652 (tcp->tcp_rtt_sa >> 5); 653 654 TCP_SET_RTO(tcp, rto); 655 } 656 if (uinfo.iulp_ssthresh != 0) 657 tcp->tcp_cwnd_ssthresh = uinfo.iulp_ssthresh; 658 else 659 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 660 if (uinfo.iulp_spipe > 0) { 661 connp->conn_sndbuf = MIN(uinfo.iulp_spipe, 662 tcps->tcps_max_buf); 663 if (tcps->tcps_snd_lowat_fraction != 0) { 664 connp->conn_sndlowat = connp->conn_sndbuf / 665 tcps->tcps_snd_lowat_fraction; 666 } 667 (void) tcp_maxpsz_set(tcp, B_TRUE); 668 } 669 /* 670 * Note that up till now, acceptor always inherits receive 671 * window from the listener. But if there is a metrics 672 * associated with a host, we should use that instead of 673 * inheriting it from listener. Thus we need to pass this 674 * info back to the caller. 675 */ 676 if (uinfo.iulp_rpipe > 0) { 677 tcp->tcp_rwnd = MIN(uinfo.iulp_rpipe, 678 tcps->tcps_max_buf); 679 } 680 681 if (uinfo.iulp_rtomax > 0) { 682 tcp->tcp_second_timer_threshold = 683 uinfo.iulp_rtomax; 684 } 685 686 /* 687 * Use the metric option settings, iulp_tstamp_ok and 688 * iulp_wscale_ok, only for active open. What this means 689 * is that if the other side uses timestamp or window 690 * scale option, TCP will also use those options. That 691 * is for passive open. If the application sets a 692 * large window, window scale is enabled regardless of 693 * the value in iulp_wscale_ok. This is the behavior 694 * since 2.6. So we keep it. 695 * The only case left in passive open processing is the 696 * check for SACK. 697 * For ECN, it should probably be like SACK. But the 698 * current value is binary, so we treat it like the other 699 * cases. The metric only controls active open.For passive 700 * open, the ndd param, tcp_ecn_permitted, controls the 701 * behavior. 702 */ 703 if (!tcp_detached) { 704 /* 705 * The if check means that the following can only 706 * be turned on by the metrics only IRE, but not off. 707 */ 708 if (uinfo.iulp_tstamp_ok) 709 tcp->tcp_snd_ts_ok = B_TRUE; 710 if (uinfo.iulp_wscale_ok) 711 tcp->tcp_snd_ws_ok = B_TRUE; 712 if (uinfo.iulp_sack == 2) 713 tcp->tcp_snd_sack_ok = B_TRUE; 714 if (uinfo.iulp_ecn_ok) 715 tcp->tcp_ecn_ok = B_TRUE; 716 } else { 717 /* 718 * Passive open. 719 * 720 * As above, the if check means that SACK can only be 721 * turned on by the metric only IRE. 722 */ 723 if (uinfo.iulp_sack > 0) { 724 tcp->tcp_snd_sack_ok = B_TRUE; 725 } 726 } 727 728 /* 729 * XXX Note that currently, iulp_mtu can be as small as 68 730 * because of PMTUd. So tcp_mss may go to negative if combined 731 * length of all those options exceeds 28 bytes. But because 732 * of the tcp_mss_min check below, we may not have a problem if 733 * tcp_mss_min is of a reasonable value. The default is 1 so 734 * the negative problem still exists. And the check defeats PMTUd. 735 * In fact, if PMTUd finds that the MSS should be smaller than 736 * tcp_mss_min, TCP should turn off PMUTd and use the tcp_mss_min 737 * value. 738 * 739 * We do not deal with that now. All those problems related to 740 * PMTUd will be fixed later. 741 */ 742 ASSERT(uinfo.iulp_mtu != 0); 743 mss = tcp->tcp_initial_pmtu = uinfo.iulp_mtu; 744 745 /* Sanity check for MSS value. */ 746 if (connp->conn_ipversion == IPV4_VERSION) 747 mss_max = tcps->tcps_mss_max_ipv4; 748 else 749 mss_max = tcps->tcps_mss_max_ipv6; 750 751 if (tcp->tcp_ipsec_overhead == 0) 752 tcp->tcp_ipsec_overhead = conn_ipsec_length(connp); 753 754 mss -= tcp->tcp_ipsec_overhead; 755 756 if (mss < tcps->tcps_mss_min) 757 mss = tcps->tcps_mss_min; 758 if (mss > mss_max) 759 mss = mss_max; 760 761 /* Note that this is the maximum MSS, excluding all options. */ 762 tcp->tcp_mss = mss; 763 764 /* 765 * Update the tcp connection with LSO capability. 766 */ 767 tcp_update_lso(tcp, connp->conn_ixa); 768 769 /* 770 * Initialize the ISS here now that we have the full connection ID. 771 * The RFC 1948 method of initial sequence number generation requires 772 * knowledge of the full connection ID before setting the ISS. 773 */ 774 tcp_iss_init(tcp); 775 776 tcp->tcp_loopback = (uinfo.iulp_loopback | uinfo.iulp_local); 777 778 /* 779 * Make sure that conn is not marked incipient 780 * for incoming connections. A blind 781 * removal of incipient flag is cheaper than 782 * check and removal. 783 */ 784 mutex_enter(&connp->conn_lock); 785 connp->conn_state_flags &= ~CONN_INCIPIENT; 786 mutex_exit(&connp->conn_lock); 787 return (0); 788 } 789 790 /* 791 * tcp_clean_death / tcp_close_detached must not be called more than once 792 * on a tcp. Thus every function that potentially calls tcp_clean_death 793 * must check for the tcp state before calling tcp_clean_death. 794 * Eg. tcp_input_data, tcp_eager_kill, tcp_clean_death_wrapper, 795 * tcp_timer_handler, all check for the tcp state. 796 */ 797 /* ARGSUSED */ 798 void 799 tcp_clean_death_wrapper(void *arg, mblk_t *mp, void *arg2, 800 ip_recv_attr_t *dummy) 801 { 802 tcp_t *tcp = ((conn_t *)arg)->conn_tcp; 803 804 freemsg(mp); 805 if (tcp->tcp_state > TCPS_BOUND) 806 (void) tcp_clean_death(((conn_t *)arg)->conn_tcp, ETIMEDOUT); 807 } 808 809 /* 810 * We are dying for some reason. Try to do it gracefully. (May be called 811 * as writer.) 812 * 813 * Return -1 if the structure was not cleaned up (if the cleanup had to be 814 * done by a service procedure). 815 * TBD - Should the return value distinguish between the tcp_t being 816 * freed and it being reinitialized? 817 */ 818 int 819 tcp_clean_death(tcp_t *tcp, int err) 820 { 821 mblk_t *mp; 822 queue_t *q; 823 conn_t *connp = tcp->tcp_connp; 824 tcp_stack_t *tcps = tcp->tcp_tcps; 825 826 if (tcp->tcp_fused) 827 tcp_unfuse(tcp); 828 829 if (tcp->tcp_linger_tid != 0 && 830 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 831 tcp_stop_lingering(tcp); 832 } 833 834 ASSERT(tcp != NULL); 835 ASSERT((connp->conn_family == AF_INET && 836 connp->conn_ipversion == IPV4_VERSION) || 837 (connp->conn_family == AF_INET6 && 838 (connp->conn_ipversion == IPV4_VERSION || 839 connp->conn_ipversion == IPV6_VERSION))); 840 841 if (TCP_IS_DETACHED(tcp)) { 842 if (tcp->tcp_hard_binding) { 843 /* 844 * Its an eager that we are dealing with. We close the 845 * eager but in case a conn_ind has already gone to the 846 * listener, let tcp_accept_finish() send a discon_ind 847 * to the listener and drop the last reference. If the 848 * listener doesn't even know about the eager i.e. the 849 * conn_ind hasn't gone up, blow away the eager and drop 850 * the last reference as well. If the conn_ind has gone 851 * up, state should be BOUND. tcp_accept_finish 852 * will figure out that the connection has received a 853 * RST and will send a DISCON_IND to the application. 854 */ 855 tcp_closei_local(tcp); 856 if (!tcp->tcp_tconnind_started) { 857 CONN_DEC_REF(connp); 858 } else { 859 tcp->tcp_state = TCPS_BOUND; 860 DTRACE_TCP6(state__change, void, NULL, 861 ip_xmit_attr_t *, connp->conn_ixa, 862 void, NULL, tcp_t *, tcp, void, NULL, 863 int32_t, TCPS_CLOSED); 864 } 865 } else { 866 tcp_close_detached(tcp); 867 } 868 return (0); 869 } 870 871 TCP_STAT(tcps, tcp_clean_death_nondetached); 872 873 /* 874 * The connection is dead. Decrement listener connection counter if 875 * necessary. 876 */ 877 if (tcp->tcp_listen_cnt != NULL) 878 TCP_DECR_LISTEN_CNT(tcp); 879 880 /* 881 * When a connection is moved to TIME_WAIT state, the connection 882 * counter is already decremented. So no need to decrement here 883 * again. See SET_TIME_WAIT() macro. 884 */ 885 if (tcp->tcp_state >= TCPS_ESTABLISHED && 886 tcp->tcp_state < TCPS_TIME_WAIT) { 887 TCPS_CONN_DEC(tcps); 888 } 889 890 q = connp->conn_rq; 891 892 /* Trash all inbound data */ 893 if (!IPCL_IS_NONSTR(connp)) { 894 ASSERT(q != NULL); 895 flushq(q, FLUSHALL); 896 } 897 898 /* 899 * If we are at least part way open and there is error 900 * (err==0 implies no error) 901 * notify our client by a T_DISCON_IND. 902 */ 903 if ((tcp->tcp_state >= TCPS_SYN_SENT) && err) { 904 if (tcp->tcp_state >= TCPS_ESTABLISHED && 905 !TCP_IS_SOCKET(tcp)) { 906 /* 907 * Send M_FLUSH according to TPI. Because sockets will 908 * (and must) ignore FLUSHR we do that only for TPI 909 * endpoints and sockets in STREAMS mode. 910 */ 911 (void) putnextctl1(q, M_FLUSH, FLUSHR); 912 } 913 if (connp->conn_debug) { 914 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 915 "tcp_clean_death: discon err %d", err); 916 } 917 if (IPCL_IS_NONSTR(connp)) { 918 /* Direct socket, use upcall */ 919 (*connp->conn_upcalls->su_disconnected)( 920 connp->conn_upper_handle, tcp->tcp_connid, err); 921 } else { 922 mp = mi_tpi_discon_ind(NULL, err, 0); 923 if (mp != NULL) { 924 putnext(q, mp); 925 } else { 926 if (connp->conn_debug) { 927 (void) strlog(TCP_MOD_ID, 0, 1, 928 SL_ERROR|SL_TRACE, 929 "tcp_clean_death, sending M_ERROR"); 930 } 931 (void) putnextctl1(q, M_ERROR, EPROTO); 932 } 933 } 934 if (tcp->tcp_state <= TCPS_SYN_RCVD) { 935 /* SYN_SENT or SYN_RCVD */ 936 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 937 } else if (tcp->tcp_state <= TCPS_CLOSE_WAIT) { 938 /* ESTABLISHED or CLOSE_WAIT */ 939 TCPS_BUMP_MIB(tcps, tcpEstabResets); 940 } 941 } 942 943 /* 944 * ESTABLISHED non-STREAMS eagers are not 'detached' because 945 * an upper handle is obtained when the SYN-ACK comes in. So it 946 * should receive the 'disconnected' upcall, but tcp_reinit should 947 * not be called since this is an eager. 948 */ 949 if (tcp->tcp_listener != NULL && IPCL_IS_NONSTR(connp)) { 950 tcp_closei_local(tcp); 951 tcp->tcp_state = TCPS_BOUND; 952 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 953 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 954 int32_t, TCPS_CLOSED); 955 return (0); 956 } 957 958 tcp_reinit(tcp); 959 if (IPCL_IS_NONSTR(connp)) 960 (void) tcp_do_unbind(connp); 961 962 return (-1); 963 } 964 965 /* 966 * In case tcp is in the "lingering state" and waits for the SO_LINGER timeout 967 * to expire, stop the wait and finish the close. 968 */ 969 void 970 tcp_stop_lingering(tcp_t *tcp) 971 { 972 clock_t delta = 0; 973 tcp_stack_t *tcps = tcp->tcp_tcps; 974 conn_t *connp = tcp->tcp_connp; 975 976 tcp->tcp_linger_tid = 0; 977 if (tcp->tcp_state > TCPS_LISTEN) { 978 tcp_acceptor_hash_remove(tcp); 979 mutex_enter(&tcp->tcp_non_sq_lock); 980 if (tcp->tcp_flow_stopped) { 981 tcp_clrqfull(tcp); 982 } 983 mutex_exit(&tcp->tcp_non_sq_lock); 984 985 if (tcp->tcp_timer_tid != 0) { 986 delta = TCP_TIMER_CANCEL(tcp, tcp->tcp_timer_tid); 987 tcp->tcp_timer_tid = 0; 988 } 989 /* 990 * Need to cancel those timers which will not be used when 991 * TCP is detached. This has to be done before the conn_wq 992 * is cleared. 993 */ 994 tcp_timers_stop(tcp); 995 996 tcp->tcp_detached = B_TRUE; 997 connp->conn_rq = NULL; 998 connp->conn_wq = NULL; 999 1000 if (tcp->tcp_state == TCPS_TIME_WAIT) { 1001 tcp_time_wait_append(tcp); 1002 TCP_DBGSTAT(tcps, tcp_detach_time_wait); 1003 goto finish; 1004 } 1005 1006 /* 1007 * If delta is zero the timer event wasn't executed and was 1008 * successfully canceled. In this case we need to restart it 1009 * with the minimal delta possible. 1010 */ 1011 if (delta >= 0) { 1012 tcp->tcp_timer_tid = TCP_TIMER(tcp, tcp_timer, 1013 delta ? delta : 1); 1014 } 1015 } else { 1016 tcp_closei_local(tcp); 1017 CONN_DEC_REF(connp); 1018 } 1019 finish: 1020 tcp->tcp_detached = B_TRUE; 1021 connp->conn_rq = NULL; 1022 connp->conn_wq = NULL; 1023 1024 /* Signal closing thread that it can complete close */ 1025 mutex_enter(&tcp->tcp_closelock); 1026 tcp->tcp_closed = 1; 1027 cv_signal(&tcp->tcp_closecv); 1028 mutex_exit(&tcp->tcp_closelock); 1029 1030 /* If we have an upper handle (socket), release it */ 1031 if (IPCL_IS_NONSTR(connp)) { 1032 ASSERT(connp->conn_upper_handle != NULL); 1033 (*connp->conn_upcalls->su_closed)(connp->conn_upper_handle); 1034 connp->conn_upper_handle = NULL; 1035 connp->conn_upcalls = NULL; 1036 } 1037 } 1038 1039 void 1040 tcp_close_common(conn_t *connp, int flags) 1041 { 1042 tcp_t *tcp = connp->conn_tcp; 1043 mblk_t *mp = &tcp->tcp_closemp; 1044 boolean_t conn_ioctl_cleanup_reqd = B_FALSE; 1045 mblk_t *bp; 1046 1047 ASSERT(connp->conn_ref >= 2); 1048 1049 /* 1050 * Mark the conn as closing. ipsq_pending_mp_add will not 1051 * add any mp to the pending mp list, after this conn has 1052 * started closing. 1053 */ 1054 mutex_enter(&connp->conn_lock); 1055 connp->conn_state_flags |= CONN_CLOSING; 1056 if (connp->conn_oper_pending_ill != NULL) 1057 conn_ioctl_cleanup_reqd = B_TRUE; 1058 CONN_INC_REF_LOCKED(connp); 1059 mutex_exit(&connp->conn_lock); 1060 tcp->tcp_closeflags = (uint8_t)flags; 1061 ASSERT(connp->conn_ref >= 3); 1062 1063 /* 1064 * tcp_closemp_used is used below without any protection of a lock 1065 * as we don't expect any one else to use it concurrently at this 1066 * point otherwise it would be a major defect. 1067 */ 1068 1069 if (mp->b_prev == NULL) 1070 tcp->tcp_closemp_used = B_TRUE; 1071 else 1072 cmn_err(CE_PANIC, "tcp_close: concurrent use of tcp_closemp: " 1073 "connp %p tcp %p\n", (void *)connp, (void *)tcp); 1074 1075 TCP_DEBUG_GETPCSTACK(tcp->tcmp_stk, 15); 1076 1077 /* 1078 * Cleanup any queued ioctls here. This must be done before the wq/rq 1079 * are re-written by tcp_close_output(). 1080 */ 1081 if (conn_ioctl_cleanup_reqd) 1082 conn_ioctl_cleanup(connp); 1083 1084 /* 1085 * As CONN_CLOSING is set, no further ioctls should be passed down to 1086 * IP for this conn (see the guards in tcp_ioctl, tcp_wput_ioctl and 1087 * tcp_wput_iocdata). If the ioctl was queued on an ipsq, 1088 * conn_ioctl_cleanup should have found it and removed it. If the ioctl 1089 * was still in flight at the time, we wait for it here. See comments 1090 * for CONN_INC_IOCTLREF in ip.h for details. 1091 */ 1092 mutex_enter(&connp->conn_lock); 1093 while (connp->conn_ioctlref > 0) 1094 cv_wait(&connp->conn_cv, &connp->conn_lock); 1095 ASSERT(connp->conn_ioctlref == 0); 1096 ASSERT(connp->conn_oper_pending_ill == NULL); 1097 mutex_exit(&connp->conn_lock); 1098 1099 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_close_output, connp, 1100 NULL, tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1101 1102 /* 1103 * For non-STREAMS sockets, the normal case is that the conn makes 1104 * an upcall when it's finally closed, so there is no need to wait 1105 * in the protocol. But in case of SO_LINGER the thread sleeps here 1106 * so it can properly deal with the thread being interrupted. 1107 */ 1108 if (IPCL_IS_NONSTR(connp) && connp->conn_linger == 0) 1109 goto nowait; 1110 1111 mutex_enter(&tcp->tcp_closelock); 1112 while (!tcp->tcp_closed) { 1113 if (!cv_wait_sig(&tcp->tcp_closecv, &tcp->tcp_closelock)) { 1114 /* 1115 * The cv_wait_sig() was interrupted. We now do the 1116 * following: 1117 * 1118 * 1) If the endpoint was lingering, we allow this 1119 * to be interrupted by cancelling the linger timeout 1120 * and closing normally. 1121 * 1122 * 2) Revert to calling cv_wait() 1123 * 1124 * We revert to using cv_wait() to avoid an 1125 * infinite loop which can occur if the calling 1126 * thread is higher priority than the squeue worker 1127 * thread and is bound to the same cpu. 1128 */ 1129 if (connp->conn_linger && connp->conn_lingertime > 0) { 1130 mutex_exit(&tcp->tcp_closelock); 1131 /* Entering squeue, bump ref count. */ 1132 CONN_INC_REF(connp); 1133 bp = allocb_wait(0, BPRI_HI, STR_NOSIG, NULL); 1134 SQUEUE_ENTER_ONE(connp->conn_sqp, bp, 1135 tcp_linger_interrupted, connp, NULL, 1136 tcp_squeue_flag, SQTAG_IP_TCP_CLOSE); 1137 mutex_enter(&tcp->tcp_closelock); 1138 } 1139 break; 1140 } 1141 } 1142 while (!tcp->tcp_closed) 1143 cv_wait(&tcp->tcp_closecv, &tcp->tcp_closelock); 1144 mutex_exit(&tcp->tcp_closelock); 1145 1146 /* 1147 * In the case of listener streams that have eagers in the q or q0 1148 * we wait for the eagers to drop their reference to us. conn_rq and 1149 * conn_wq of the eagers point to our queues. By waiting for the 1150 * refcnt to drop to 1, we are sure that the eagers have cleaned 1151 * up their queue pointers and also dropped their references to us. 1152 * 1153 * For non-STREAMS sockets we do not have to wait here; the 1154 * listener will instead make a su_closed upcall when the last 1155 * reference is dropped. 1156 */ 1157 if (tcp->tcp_wait_for_eagers && !IPCL_IS_NONSTR(connp)) { 1158 mutex_enter(&connp->conn_lock); 1159 while (connp->conn_ref != 1) { 1160 cv_wait(&connp->conn_cv, &connp->conn_lock); 1161 } 1162 mutex_exit(&connp->conn_lock); 1163 } 1164 1165 nowait: 1166 connp->conn_cpid = NOPID; 1167 } 1168 1169 /* 1170 * Called by tcp_close() routine via squeue when lingering is 1171 * interrupted by a signal. 1172 */ 1173 1174 /* ARGSUSED */ 1175 static void 1176 tcp_linger_interrupted(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 1177 { 1178 conn_t *connp = (conn_t *)arg; 1179 tcp_t *tcp = connp->conn_tcp; 1180 1181 freeb(mp); 1182 if (tcp->tcp_linger_tid != 0 && 1183 TCP_TIMER_CANCEL(tcp, tcp->tcp_linger_tid) >= 0) { 1184 tcp_stop_lingering(tcp); 1185 tcp->tcp_client_errno = EINTR; 1186 } 1187 } 1188 1189 /* 1190 * Clean up the b_next and b_prev fields of every mblk pointed at by *mpp. 1191 * Some stream heads get upset if they see these later on as anything but NULL. 1192 */ 1193 void 1194 tcp_close_mpp(mblk_t **mpp) 1195 { 1196 mblk_t *mp; 1197 1198 if ((mp = *mpp) != NULL) { 1199 do { 1200 mp->b_next = NULL; 1201 mp->b_prev = NULL; 1202 } while ((mp = mp->b_cont) != NULL); 1203 1204 mp = *mpp; 1205 *mpp = NULL; 1206 freemsg(mp); 1207 } 1208 } 1209 1210 /* Do detached close. */ 1211 void 1212 tcp_close_detached(tcp_t *tcp) 1213 { 1214 if (tcp->tcp_fused) 1215 tcp_unfuse(tcp); 1216 1217 /* 1218 * Clustering code serializes TCP disconnect callbacks and 1219 * cluster tcp list walks by blocking a TCP disconnect callback 1220 * if a cluster tcp list walk is in progress. This ensures 1221 * accurate accounting of TCPs in the cluster code even though 1222 * the TCP list walk itself is not atomic. 1223 */ 1224 tcp_closei_local(tcp); 1225 CONN_DEC_REF(tcp->tcp_connp); 1226 } 1227 1228 /* 1229 * The tcp_t is going away. Remove it from all lists and set it 1230 * to TCPS_CLOSED. The freeing up of memory is deferred until 1231 * tcp_inactive. This is needed since a thread in tcp_rput might have 1232 * done a CONN_INC_REF on this structure before it was removed from the 1233 * hashes. 1234 */ 1235 void 1236 tcp_closei_local(tcp_t *tcp) 1237 { 1238 conn_t *connp = tcp->tcp_connp; 1239 tcp_stack_t *tcps = tcp->tcp_tcps; 1240 int32_t oldstate; 1241 1242 if (!TCP_IS_SOCKET(tcp)) 1243 tcp_acceptor_hash_remove(tcp); 1244 1245 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 1246 tcp->tcp_ibsegs = 0; 1247 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 1248 tcp->tcp_obsegs = 0; 1249 1250 /* 1251 * This can be called via tcp_time_wait_processing() if TCP gets a 1252 * SYN with sequence number outside the TIME-WAIT connection's 1253 * window. So we need to check for TIME-WAIT state here as the 1254 * connection counter is already decremented. See SET_TIME_WAIT() 1255 * macro 1256 */ 1257 if (tcp->tcp_state >= TCPS_ESTABLISHED && 1258 tcp->tcp_state < TCPS_TIME_WAIT) { 1259 TCPS_CONN_DEC(tcps); 1260 } 1261 1262 /* 1263 * If we are an eager connection hanging off a listener that 1264 * hasn't formally accepted the connection yet, get off his 1265 * list and blow off any data that we have accumulated. 1266 */ 1267 if (tcp->tcp_listener != NULL) { 1268 tcp_t *listener = tcp->tcp_listener; 1269 mutex_enter(&listener->tcp_eager_lock); 1270 /* 1271 * tcp_tconnind_started == B_TRUE means that the 1272 * conn_ind has already gone to listener. At 1273 * this point, eager will be closed but we 1274 * leave it in listeners eager list so that 1275 * if listener decides to close without doing 1276 * accept, we can clean this up. In tcp_tli_accept 1277 * we take care of the case of accept on closed 1278 * eager. 1279 */ 1280 if (!tcp->tcp_tconnind_started) { 1281 tcp_eager_unlink(tcp); 1282 mutex_exit(&listener->tcp_eager_lock); 1283 /* 1284 * We don't want to have any pointers to the 1285 * listener queue, after we have released our 1286 * reference on the listener 1287 */ 1288 ASSERT(tcp->tcp_detached); 1289 connp->conn_rq = NULL; 1290 connp->conn_wq = NULL; 1291 CONN_DEC_REF(listener->tcp_connp); 1292 } else { 1293 mutex_exit(&listener->tcp_eager_lock); 1294 } 1295 } 1296 1297 /* Stop all the timers */ 1298 tcp_timers_stop(tcp); 1299 1300 if (tcp->tcp_state == TCPS_LISTEN) { 1301 if (tcp->tcp_ip_addr_cache) { 1302 kmem_free((void *)tcp->tcp_ip_addr_cache, 1303 IP_ADDR_CACHE_SIZE * sizeof (ipaddr_t)); 1304 tcp->tcp_ip_addr_cache = NULL; 1305 } 1306 } 1307 1308 /* Decrement listerner connection counter if necessary. */ 1309 if (tcp->tcp_listen_cnt != NULL) 1310 TCP_DECR_LISTEN_CNT(tcp); 1311 1312 mutex_enter(&tcp->tcp_non_sq_lock); 1313 if (tcp->tcp_flow_stopped) 1314 tcp_clrqfull(tcp); 1315 mutex_exit(&tcp->tcp_non_sq_lock); 1316 1317 tcp_bind_hash_remove(tcp); 1318 /* 1319 * If the tcp_time_wait_collector (which runs outside the squeue) 1320 * is trying to remove this tcp from the time wait list, we will 1321 * block in tcp_time_wait_remove while trying to acquire the 1322 * tcp_time_wait_lock. The logic in tcp_time_wait_collector also 1323 * requires the ipcl_hash_remove to be ordered after the 1324 * tcp_time_wait_remove for the refcnt checks to work correctly. 1325 */ 1326 if (tcp->tcp_state == TCPS_TIME_WAIT) 1327 (void) tcp_time_wait_remove(tcp, NULL); 1328 CL_INET_DISCONNECT(connp); 1329 ipcl_hash_remove(connp); 1330 oldstate = tcp->tcp_state; 1331 tcp->tcp_state = TCPS_CLOSED; 1332 /* Need to probe before ixa_cleanup() is called */ 1333 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1334 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 1335 int32_t, oldstate); 1336 ixa_cleanup(connp->conn_ixa); 1337 1338 /* 1339 * Mark the conn as CONDEMNED 1340 */ 1341 mutex_enter(&connp->conn_lock); 1342 connp->conn_state_flags |= CONN_CONDEMNED; 1343 mutex_exit(&connp->conn_lock); 1344 1345 ASSERT(tcp->tcp_time_wait_next == NULL); 1346 ASSERT(tcp->tcp_time_wait_prev == NULL); 1347 ASSERT(tcp->tcp_time_wait_expire == 0); 1348 1349 tcp_ipsec_cleanup(tcp); 1350 } 1351 1352 /* 1353 * tcp is dying (called from ipcl_conn_destroy and error cases). 1354 * Free the tcp_t in either case. 1355 */ 1356 void 1357 tcp_free(tcp_t *tcp) 1358 { 1359 mblk_t *mp; 1360 conn_t *connp = tcp->tcp_connp; 1361 1362 ASSERT(tcp != NULL); 1363 ASSERT(tcp->tcp_ptpahn == NULL && tcp->tcp_acceptor_hash == NULL); 1364 1365 connp->conn_rq = NULL; 1366 connp->conn_wq = NULL; 1367 1368 tcp_close_mpp(&tcp->tcp_xmit_head); 1369 tcp_close_mpp(&tcp->tcp_reass_head); 1370 if (tcp->tcp_rcv_list != NULL) { 1371 /* Free b_next chain */ 1372 tcp_close_mpp(&tcp->tcp_rcv_list); 1373 } 1374 if ((mp = tcp->tcp_urp_mp) != NULL) { 1375 freemsg(mp); 1376 } 1377 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1378 freemsg(mp); 1379 } 1380 1381 if (tcp->tcp_fused_sigurg_mp != NULL) { 1382 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1383 freeb(tcp->tcp_fused_sigurg_mp); 1384 tcp->tcp_fused_sigurg_mp = NULL; 1385 } 1386 1387 if (tcp->tcp_ordrel_mp != NULL) { 1388 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1389 freeb(tcp->tcp_ordrel_mp); 1390 tcp->tcp_ordrel_mp = NULL; 1391 } 1392 1393 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 1394 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 1395 1396 if (tcp->tcp_hopopts != NULL) { 1397 mi_free(tcp->tcp_hopopts); 1398 tcp->tcp_hopopts = NULL; 1399 tcp->tcp_hopoptslen = 0; 1400 } 1401 ASSERT(tcp->tcp_hopoptslen == 0); 1402 if (tcp->tcp_dstopts != NULL) { 1403 mi_free(tcp->tcp_dstopts); 1404 tcp->tcp_dstopts = NULL; 1405 tcp->tcp_dstoptslen = 0; 1406 } 1407 ASSERT(tcp->tcp_dstoptslen == 0); 1408 if (tcp->tcp_rthdrdstopts != NULL) { 1409 mi_free(tcp->tcp_rthdrdstopts); 1410 tcp->tcp_rthdrdstopts = NULL; 1411 tcp->tcp_rthdrdstoptslen = 0; 1412 } 1413 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 1414 if (tcp->tcp_rthdr != NULL) { 1415 mi_free(tcp->tcp_rthdr); 1416 tcp->tcp_rthdr = NULL; 1417 tcp->tcp_rthdrlen = 0; 1418 } 1419 ASSERT(tcp->tcp_rthdrlen == 0); 1420 1421 /* 1422 * Following is really a blowing away a union. 1423 * It happens to have exactly two members of identical size 1424 * the following code is enough. 1425 */ 1426 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1427 1428 /* 1429 * If this is a non-STREAM socket still holding on to an upper 1430 * handle, release it. As a result of fallback we might also see 1431 * STREAMS based conns with upper handles, in which case there is 1432 * nothing to do other than clearing the field. 1433 */ 1434 if (connp->conn_upper_handle != NULL) { 1435 if (IPCL_IS_NONSTR(connp)) { 1436 (*connp->conn_upcalls->su_closed)( 1437 connp->conn_upper_handle); 1438 tcp->tcp_detached = B_TRUE; 1439 } 1440 connp->conn_upper_handle = NULL; 1441 connp->conn_upcalls = NULL; 1442 } 1443 } 1444 1445 /* 1446 * tcp_get_conn/tcp_free_conn 1447 * 1448 * tcp_get_conn is used to get a clean tcp connection structure. 1449 * It tries to reuse the connections put on the freelist by the 1450 * time_wait_collector failing which it goes to kmem_cache. This 1451 * way has two benefits compared to just allocating from and 1452 * freeing to kmem_cache. 1453 * 1) The time_wait_collector can free (which includes the cleanup) 1454 * outside the squeue. So when the interrupt comes, we have a clean 1455 * connection sitting in the freelist. Obviously, this buys us 1456 * performance. 1457 * 1458 * 2) Defence against DOS attack. Allocating a tcp/conn in tcp_input_listener 1459 * has multiple disadvantages - tying up the squeue during alloc. 1460 * But allocating the conn/tcp in IP land is also not the best since 1461 * we can't check the 'q' and 'q0' which are protected by squeue and 1462 * blindly allocate memory which might have to be freed here if we are 1463 * not allowed to accept the connection. By using the freelist and 1464 * putting the conn/tcp back in freelist, we don't pay a penalty for 1465 * allocating memory without checking 'q/q0' and freeing it if we can't 1466 * accept the connection. 1467 * 1468 * Care should be taken to put the conn back in the same squeue's freelist 1469 * from which it was allocated. Best results are obtained if conn is 1470 * allocated from listener's squeue and freed to the same. Time wait 1471 * collector will free up the freelist is the connection ends up sitting 1472 * there for too long. 1473 */ 1474 void * 1475 tcp_get_conn(void *arg, tcp_stack_t *tcps) 1476 { 1477 tcp_t *tcp = NULL; 1478 conn_t *connp = NULL; 1479 squeue_t *sqp = (squeue_t *)arg; 1480 tcp_squeue_priv_t *tcp_time_wait; 1481 netstack_t *ns; 1482 mblk_t *tcp_rsrv_mp = NULL; 1483 1484 tcp_time_wait = 1485 *((tcp_squeue_priv_t **)squeue_getprivate(sqp, SQPRIVATE_TCP)); 1486 1487 mutex_enter(&tcp_time_wait->tcp_time_wait_lock); 1488 tcp = tcp_time_wait->tcp_free_list; 1489 ASSERT((tcp != NULL) ^ (tcp_time_wait->tcp_free_list_cnt == 0)); 1490 if (tcp != NULL) { 1491 tcp_time_wait->tcp_free_list = tcp->tcp_time_wait_next; 1492 tcp_time_wait->tcp_free_list_cnt--; 1493 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1494 tcp->tcp_time_wait_next = NULL; 1495 connp = tcp->tcp_connp; 1496 connp->conn_flags |= IPCL_REUSED; 1497 1498 ASSERT(tcp->tcp_tcps == NULL); 1499 ASSERT(connp->conn_netstack == NULL); 1500 ASSERT(tcp->tcp_rsrv_mp != NULL); 1501 ns = tcps->tcps_netstack; 1502 netstack_hold(ns); 1503 connp->conn_netstack = ns; 1504 connp->conn_ixa->ixa_ipst = ns->netstack_ip; 1505 tcp->tcp_tcps = tcps; 1506 ipcl_globalhash_insert(connp); 1507 1508 connp->conn_ixa->ixa_notify_cookie = tcp; 1509 ASSERT(connp->conn_ixa->ixa_notify == tcp_notify); 1510 connp->conn_recv = tcp_input_data; 1511 ASSERT(connp->conn_recvicmp == tcp_icmp_input); 1512 ASSERT(connp->conn_verifyicmp == tcp_verifyicmp); 1513 return ((void *)connp); 1514 } 1515 mutex_exit(&tcp_time_wait->tcp_time_wait_lock); 1516 /* 1517 * Pre-allocate the tcp_rsrv_mp. This mblk will not be freed until 1518 * this conn_t/tcp_t is freed at ipcl_conn_destroy(). 1519 */ 1520 tcp_rsrv_mp = allocb(0, BPRI_HI); 1521 if (tcp_rsrv_mp == NULL) 1522 return (NULL); 1523 1524 if ((connp = ipcl_conn_create(IPCL_TCPCONN, KM_NOSLEEP, 1525 tcps->tcps_netstack)) == NULL) { 1526 freeb(tcp_rsrv_mp); 1527 return (NULL); 1528 } 1529 1530 tcp = connp->conn_tcp; 1531 tcp->tcp_rsrv_mp = tcp_rsrv_mp; 1532 mutex_init(&tcp->tcp_rsrv_mp_lock, NULL, MUTEX_DEFAULT, NULL); 1533 1534 tcp->tcp_tcps = tcps; 1535 1536 connp->conn_recv = tcp_input_data; 1537 connp->conn_recvicmp = tcp_icmp_input; 1538 connp->conn_verifyicmp = tcp_verifyicmp; 1539 1540 /* 1541 * Register tcp_notify to listen to capability changes detected by IP. 1542 * This upcall is made in the context of the call to conn_ip_output 1543 * thus it is inside the squeue. 1544 */ 1545 connp->conn_ixa->ixa_notify = tcp_notify; 1546 connp->conn_ixa->ixa_notify_cookie = tcp; 1547 1548 return ((void *)connp); 1549 } 1550 1551 /* 1552 * Handle connect to IPv4 destinations, including connections for AF_INET6 1553 * sockets connecting to IPv4 mapped IPv6 destinations. 1554 * Returns zero if OK, a positive errno, or a negative TLI error. 1555 */ 1556 static int 1557 tcp_connect_ipv4(tcp_t *tcp, ipaddr_t *dstaddrp, in_port_t dstport, 1558 uint_t srcid) 1559 { 1560 ipaddr_t dstaddr = *dstaddrp; 1561 uint16_t lport; 1562 conn_t *connp = tcp->tcp_connp; 1563 tcp_stack_t *tcps = tcp->tcp_tcps; 1564 int error; 1565 1566 ASSERT(connp->conn_ipversion == IPV4_VERSION); 1567 1568 /* Check for attempt to connect to INADDR_ANY */ 1569 if (dstaddr == INADDR_ANY) { 1570 /* 1571 * SunOS 4.x and 4.3 BSD allow an application 1572 * to connect a TCP socket to INADDR_ANY. 1573 * When they do this, the kernel picks the 1574 * address of one interface and uses it 1575 * instead. The kernel usually ends up 1576 * picking the address of the loopback 1577 * interface. This is an undocumented feature. 1578 * However, we provide the same thing here 1579 * in order to have source and binary 1580 * compatibility with SunOS 4.x. 1581 * Update the T_CONN_REQ (sin/sin6) since it is used to 1582 * generate the T_CONN_CON. 1583 */ 1584 dstaddr = htonl(INADDR_LOOPBACK); 1585 *dstaddrp = dstaddr; 1586 } 1587 1588 /* Handle __sin6_src_id if socket not bound to an IP address */ 1589 if (srcid != 0 && connp->conn_laddr_v4 == INADDR_ANY) { 1590 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1591 IPCL_ZONEID(connp), tcps->tcps_netstack); 1592 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1593 } 1594 1595 IN6_IPADDR_TO_V4MAPPED(dstaddr, &connp->conn_faddr_v6); 1596 connp->conn_fport = dstport; 1597 1598 /* 1599 * At this point the remote destination address and remote port fields 1600 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1601 * have to see which state tcp was in so we can take appropriate action. 1602 */ 1603 if (tcp->tcp_state == TCPS_IDLE) { 1604 /* 1605 * We support a quick connect capability here, allowing 1606 * clients to transition directly from IDLE to SYN_SENT 1607 * tcp_bindi will pick an unused port, insert the connection 1608 * in the bind hash and transition to BOUND state. 1609 */ 1610 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1611 tcp, B_TRUE); 1612 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1613 B_FALSE, B_FALSE); 1614 if (lport == 0) 1615 return (-TNOADDR); 1616 } 1617 1618 /* 1619 * Lookup the route to determine a source address and the uinfo. 1620 * Setup TCP parameters based on the metrics/DCE. 1621 */ 1622 error = tcp_set_destination(tcp); 1623 if (error != 0) 1624 return (error); 1625 1626 /* 1627 * Don't let an endpoint connect to itself. 1628 */ 1629 if (connp->conn_faddr_v4 == connp->conn_laddr_v4 && 1630 connp->conn_fport == connp->conn_lport) 1631 return (-TBADADDR); 1632 1633 tcp->tcp_state = TCPS_SYN_SENT; 1634 1635 return (ipcl_conn_insert_v4(connp)); 1636 } 1637 1638 /* 1639 * Handle connect to IPv6 destinations. 1640 * Returns zero if OK, a positive errno, or a negative TLI error. 1641 */ 1642 static int 1643 tcp_connect_ipv6(tcp_t *tcp, in6_addr_t *dstaddrp, in_port_t dstport, 1644 uint32_t flowinfo, uint_t srcid, uint32_t scope_id) 1645 { 1646 uint16_t lport; 1647 conn_t *connp = tcp->tcp_connp; 1648 tcp_stack_t *tcps = tcp->tcp_tcps; 1649 int error; 1650 1651 ASSERT(connp->conn_family == AF_INET6); 1652 1653 /* 1654 * If we're here, it means that the destination address is a native 1655 * IPv6 address. Return an error if conn_ipversion is not IPv6. A 1656 * reason why it might not be IPv6 is if the socket was bound to an 1657 * IPv4-mapped IPv6 address. 1658 */ 1659 if (connp->conn_ipversion != IPV6_VERSION) 1660 return (-TBADADDR); 1661 1662 /* 1663 * Interpret a zero destination to mean loopback. 1664 * Update the T_CONN_REQ (sin/sin6) since it is used to 1665 * generate the T_CONN_CON. 1666 */ 1667 if (IN6_IS_ADDR_UNSPECIFIED(dstaddrp)) 1668 *dstaddrp = ipv6_loopback; 1669 1670 /* Handle __sin6_src_id if socket not bound to an IP address */ 1671 if (srcid != 0 && IN6_IS_ADDR_UNSPECIFIED(&connp->conn_laddr_v6)) { 1672 ip_srcid_find_id(srcid, &connp->conn_laddr_v6, 1673 IPCL_ZONEID(connp), tcps->tcps_netstack); 1674 connp->conn_saddr_v6 = connp->conn_laddr_v6; 1675 } 1676 1677 /* 1678 * Take care of the scope_id now. 1679 */ 1680 if (scope_id != 0 && IN6_IS_ADDR_LINKSCOPE(dstaddrp)) { 1681 connp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1682 connp->conn_ixa->ixa_scopeid = scope_id; 1683 } else { 1684 connp->conn_ixa->ixa_flags &= ~IXAF_SCOPEID_SET; 1685 } 1686 1687 connp->conn_flowinfo = flowinfo; 1688 connp->conn_faddr_v6 = *dstaddrp; 1689 connp->conn_fport = dstport; 1690 1691 /* 1692 * At this point the remote destination address and remote port fields 1693 * in the tcp-four-tuple have been filled in the tcp structure. Now we 1694 * have to see which state tcp was in so we can take appropriate action. 1695 */ 1696 if (tcp->tcp_state == TCPS_IDLE) { 1697 /* 1698 * We support a quick connect capability here, allowing 1699 * clients to transition directly from IDLE to SYN_SENT 1700 * tcp_bindi will pick an unused port, insert the connection 1701 * in the bind hash and transition to BOUND state. 1702 */ 1703 lport = tcp_update_next_port(tcps->tcps_next_port_to_try, 1704 tcp, B_TRUE); 1705 lport = tcp_bindi(tcp, lport, &connp->conn_laddr_v6, 0, B_TRUE, 1706 B_FALSE, B_FALSE); 1707 if (lport == 0) 1708 return (-TNOADDR); 1709 } 1710 1711 /* 1712 * Lookup the route to determine a source address and the uinfo. 1713 * Setup TCP parameters based on the metrics/DCE. 1714 */ 1715 error = tcp_set_destination(tcp); 1716 if (error != 0) 1717 return (error); 1718 1719 /* 1720 * Don't let an endpoint connect to itself. 1721 */ 1722 if (IN6_ARE_ADDR_EQUAL(&connp->conn_faddr_v6, &connp->conn_laddr_v6) && 1723 connp->conn_fport == connp->conn_lport) 1724 return (-TBADADDR); 1725 1726 tcp->tcp_state = TCPS_SYN_SENT; 1727 1728 return (ipcl_conn_insert_v6(connp)); 1729 } 1730 1731 /* 1732 * Disconnect 1733 * Note that unlike other functions this returns a positive tli error 1734 * when it fails; it never returns an errno. 1735 */ 1736 static int 1737 tcp_disconnect_common(tcp_t *tcp, t_scalar_t seqnum) 1738 { 1739 conn_t *lconnp; 1740 tcp_stack_t *tcps = tcp->tcp_tcps; 1741 conn_t *connp = tcp->tcp_connp; 1742 1743 /* 1744 * Right now, upper modules pass down a T_DISCON_REQ to TCP, 1745 * when the stream is in BOUND state. Do not send a reset, 1746 * since the destination IP address is not valid, and it can 1747 * be the initialized value of all zeros (broadcast address). 1748 */ 1749 if (tcp->tcp_state <= TCPS_BOUND) { 1750 if (connp->conn_debug) { 1751 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 1752 "tcp_disconnect: bad state, %d", tcp->tcp_state); 1753 } 1754 return (TOUTSTATE); 1755 } else if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1756 TCPS_CONN_DEC(tcps); 1757 } 1758 1759 if (seqnum == -1 || tcp->tcp_conn_req_max == 0) { 1760 1761 /* 1762 * According to TPI, for non-listeners, ignore seqnum 1763 * and disconnect. 1764 * Following interpretation of -1 seqnum is historical 1765 * and implied TPI ? (TPI only states that for T_CONN_IND, 1766 * a valid seqnum should not be -1). 1767 * 1768 * -1 means disconnect everything 1769 * regardless even on a listener. 1770 */ 1771 1772 int old_state = tcp->tcp_state; 1773 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1774 1775 /* 1776 * The connection can't be on the tcp_time_wait_head list 1777 * since it is not detached. 1778 */ 1779 ASSERT(tcp->tcp_time_wait_next == NULL); 1780 ASSERT(tcp->tcp_time_wait_prev == NULL); 1781 ASSERT(tcp->tcp_time_wait_expire == 0); 1782 /* 1783 * If it used to be a listener, check to make sure no one else 1784 * has taken the port before switching back to LISTEN state. 1785 */ 1786 if (connp->conn_ipversion == IPV4_VERSION) { 1787 lconnp = ipcl_lookup_listener_v4(connp->conn_lport, 1788 connp->conn_laddr_v4, IPCL_ZONEID(connp), ipst); 1789 } else { 1790 uint_t ifindex = 0; 1791 1792 if (connp->conn_ixa->ixa_flags & IXAF_SCOPEID_SET) 1793 ifindex = connp->conn_ixa->ixa_scopeid; 1794 1795 /* Allow conn_bound_if listeners? */ 1796 lconnp = ipcl_lookup_listener_v6(connp->conn_lport, 1797 &connp->conn_laddr_v6, ifindex, IPCL_ZONEID(connp), 1798 ipst); 1799 } 1800 if (tcp->tcp_conn_req_max && lconnp == NULL) { 1801 tcp->tcp_state = TCPS_LISTEN; 1802 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1803 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, 1804 NULL, int32_t, old_state); 1805 } else if (old_state > TCPS_BOUND) { 1806 tcp->tcp_conn_req_max = 0; 1807 tcp->tcp_state = TCPS_BOUND; 1808 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1809 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, 1810 NULL, int32_t, old_state); 1811 1812 /* 1813 * If this end point is not going to become a listener, 1814 * decrement the listener connection count if 1815 * necessary. Note that we do not do this if it is 1816 * going to be a listner (the above if case) since 1817 * then it may remove the counter struct. 1818 */ 1819 if (tcp->tcp_listen_cnt != NULL) 1820 TCP_DECR_LISTEN_CNT(tcp); 1821 } 1822 if (lconnp != NULL) 1823 CONN_DEC_REF(lconnp); 1824 switch (old_state) { 1825 case TCPS_SYN_SENT: 1826 case TCPS_SYN_RCVD: 1827 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1828 break; 1829 case TCPS_ESTABLISHED: 1830 case TCPS_CLOSE_WAIT: 1831 TCPS_BUMP_MIB(tcps, tcpEstabResets); 1832 break; 1833 } 1834 1835 if (tcp->tcp_fused) 1836 tcp_unfuse(tcp); 1837 1838 mutex_enter(&tcp->tcp_eager_lock); 1839 if ((tcp->tcp_conn_req_cnt_q0 != 0) || 1840 (tcp->tcp_conn_req_cnt_q != 0)) { 1841 tcp_eager_cleanup(tcp, 0); 1842 } 1843 mutex_exit(&tcp->tcp_eager_lock); 1844 1845 tcp_xmit_ctl("tcp_disconnect", tcp, tcp->tcp_snxt, 1846 tcp->tcp_rnxt, TH_RST | TH_ACK); 1847 1848 tcp_reinit(tcp); 1849 1850 return (0); 1851 } else if (!tcp_eager_blowoff(tcp, seqnum)) { 1852 return (TBADSEQ); 1853 } 1854 return (0); 1855 } 1856 1857 /* 1858 * Our client hereby directs us to reject the connection request 1859 * that tcp_input_listener() marked with 'seqnum'. Rejection consists 1860 * of sending the appropriate RST, not an ICMP error. 1861 */ 1862 void 1863 tcp_disconnect(tcp_t *tcp, mblk_t *mp) 1864 { 1865 t_scalar_t seqnum; 1866 int error; 1867 conn_t *connp = tcp->tcp_connp; 1868 1869 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= (uintptr_t)INT_MAX); 1870 if ((mp->b_wptr - mp->b_rptr) < sizeof (struct T_discon_req)) { 1871 tcp_err_ack(tcp, mp, TPROTO, 0); 1872 return; 1873 } 1874 seqnum = ((struct T_discon_req *)mp->b_rptr)->SEQ_number; 1875 error = tcp_disconnect_common(tcp, seqnum); 1876 if (error != 0) 1877 tcp_err_ack(tcp, mp, error, 0); 1878 else { 1879 if (tcp->tcp_state >= TCPS_ESTABLISHED) { 1880 /* Send M_FLUSH according to TPI */ 1881 (void) putnextctl1(connp->conn_rq, M_FLUSH, FLUSHRW); 1882 } 1883 mp = mi_tpi_ok_ack_alloc(mp); 1884 if (mp != NULL) 1885 putnext(connp->conn_rq, mp); 1886 } 1887 } 1888 1889 /* 1890 * Handle reinitialization of a tcp structure. 1891 * Maintain "binding state" resetting the state to BOUND, LISTEN, or IDLE. 1892 */ 1893 static void 1894 tcp_reinit(tcp_t *tcp) 1895 { 1896 mblk_t *mp; 1897 tcp_stack_t *tcps = tcp->tcp_tcps; 1898 conn_t *connp = tcp->tcp_connp; 1899 int32_t oldstate; 1900 1901 /* tcp_reinit should never be called for detached tcp_t's */ 1902 ASSERT(tcp->tcp_listener == NULL); 1903 ASSERT((connp->conn_family == AF_INET && 1904 connp->conn_ipversion == IPV4_VERSION) || 1905 (connp->conn_family == AF_INET6 && 1906 (connp->conn_ipversion == IPV4_VERSION || 1907 connp->conn_ipversion == IPV6_VERSION))); 1908 1909 /* Cancel outstanding timers */ 1910 tcp_timers_stop(tcp); 1911 1912 /* 1913 * Reset everything in the state vector, after updating global 1914 * MIB data from instance counters. 1915 */ 1916 TCPS_UPDATE_MIB(tcps, tcpHCInSegs, tcp->tcp_ibsegs); 1917 tcp->tcp_ibsegs = 0; 1918 TCPS_UPDATE_MIB(tcps, tcpHCOutSegs, tcp->tcp_obsegs); 1919 tcp->tcp_obsegs = 0; 1920 1921 tcp_close_mpp(&tcp->tcp_xmit_head); 1922 if (tcp->tcp_snd_zcopy_aware) 1923 tcp_zcopy_notify(tcp); 1924 tcp->tcp_xmit_last = tcp->tcp_xmit_tail = NULL; 1925 tcp->tcp_unsent = tcp->tcp_xmit_tail_unsent = 0; 1926 mutex_enter(&tcp->tcp_non_sq_lock); 1927 if (tcp->tcp_flow_stopped && 1928 TCP_UNSENT_BYTES(tcp) <= connp->conn_sndlowat) { 1929 tcp_clrqfull(tcp); 1930 } 1931 mutex_exit(&tcp->tcp_non_sq_lock); 1932 tcp_close_mpp(&tcp->tcp_reass_head); 1933 tcp->tcp_reass_tail = NULL; 1934 if (tcp->tcp_rcv_list != NULL) { 1935 /* Free b_next chain */ 1936 tcp_close_mpp(&tcp->tcp_rcv_list); 1937 tcp->tcp_rcv_last_head = NULL; 1938 tcp->tcp_rcv_last_tail = NULL; 1939 tcp->tcp_rcv_cnt = 0; 1940 } 1941 tcp->tcp_rcv_last_tail = NULL; 1942 1943 if ((mp = tcp->tcp_urp_mp) != NULL) { 1944 freemsg(mp); 1945 tcp->tcp_urp_mp = NULL; 1946 } 1947 if ((mp = tcp->tcp_urp_mark_mp) != NULL) { 1948 freemsg(mp); 1949 tcp->tcp_urp_mark_mp = NULL; 1950 } 1951 if (tcp->tcp_fused_sigurg_mp != NULL) { 1952 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1953 freeb(tcp->tcp_fused_sigurg_mp); 1954 tcp->tcp_fused_sigurg_mp = NULL; 1955 } 1956 if (tcp->tcp_ordrel_mp != NULL) { 1957 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1958 freeb(tcp->tcp_ordrel_mp); 1959 tcp->tcp_ordrel_mp = NULL; 1960 } 1961 1962 /* 1963 * Following is a union with two members which are 1964 * identical types and size so the following cleanup 1965 * is enough. 1966 */ 1967 tcp_close_mpp(&tcp->tcp_conn.tcp_eager_conn_ind); 1968 1969 CL_INET_DISCONNECT(connp); 1970 1971 /* 1972 * The connection can't be on the tcp_time_wait_head list 1973 * since it is not detached. 1974 */ 1975 ASSERT(tcp->tcp_time_wait_next == NULL); 1976 ASSERT(tcp->tcp_time_wait_prev == NULL); 1977 ASSERT(tcp->tcp_time_wait_expire == 0); 1978 1979 /* 1980 * Reset/preserve other values 1981 */ 1982 tcp_reinit_values(tcp); 1983 ipcl_hash_remove(connp); 1984 /* Note that ixa_cred gets cleared in ixa_cleanup */ 1985 ixa_cleanup(connp->conn_ixa); 1986 tcp_ipsec_cleanup(tcp); 1987 1988 connp->conn_laddr_v6 = connp->conn_bound_addr_v6; 1989 connp->conn_saddr_v6 = connp->conn_bound_addr_v6; 1990 oldstate = tcp->tcp_state; 1991 1992 if (tcp->tcp_conn_req_max != 0) { 1993 /* 1994 * This is the case when a TLI program uses the same 1995 * transport end point to accept a connection. This 1996 * makes the TCP both a listener and acceptor. When 1997 * this connection is closed, we need to set the state 1998 * back to TCPS_LISTEN. Make sure that the eager list 1999 * is reinitialized. 2000 * 2001 * Note that this stream is still bound to the four 2002 * tuples of the previous connection in IP. If a new 2003 * SYN with different foreign address comes in, IP will 2004 * not find it and will send it to the global queue. In 2005 * the global queue, TCP will do a tcp_lookup_listener() 2006 * to find this stream. This works because this stream 2007 * is only removed from connected hash. 2008 * 2009 */ 2010 tcp->tcp_state = TCPS_LISTEN; 2011 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 2012 tcp->tcp_eager_next_drop_q0 = tcp; 2013 tcp->tcp_eager_prev_drop_q0 = tcp; 2014 /* 2015 * Initially set conn_recv to tcp_input_listener_unbound to try 2016 * to pick a good squeue for the listener when the first SYN 2017 * arrives. tcp_input_listener_unbound sets it to 2018 * tcp_input_listener on that first SYN. 2019 */ 2020 connp->conn_recv = tcp_input_listener_unbound; 2021 2022 connp->conn_proto = IPPROTO_TCP; 2023 connp->conn_faddr_v6 = ipv6_all_zeros; 2024 connp->conn_fport = 0; 2025 2026 (void) ipcl_bind_insert(connp); 2027 } else { 2028 tcp->tcp_state = TCPS_BOUND; 2029 } 2030 2031 /* 2032 * Initialize to default values 2033 */ 2034 tcp_init_values(tcp, NULL); 2035 2036 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2037 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 2038 int32_t, oldstate); 2039 2040 ASSERT(tcp->tcp_ptpbhn != NULL); 2041 tcp->tcp_rwnd = connp->conn_rcvbuf; 2042 tcp->tcp_mss = connp->conn_ipversion != IPV4_VERSION ? 2043 tcps->tcps_mss_def_ipv6 : tcps->tcps_mss_def_ipv4; 2044 } 2045 2046 /* 2047 * Force values to zero that need be zero. 2048 * Do not touch values asociated with the BOUND or LISTEN state 2049 * since the connection will end up in that state after the reinit. 2050 * NOTE: tcp_reinit_values MUST have a line for each field in the tcp_t 2051 * structure! 2052 */ 2053 static void 2054 tcp_reinit_values(tcp) 2055 tcp_t *tcp; 2056 { 2057 tcp_stack_t *tcps = tcp->tcp_tcps; 2058 conn_t *connp = tcp->tcp_connp; 2059 2060 #ifndef lint 2061 #define DONTCARE(x) 2062 #define PRESERVE(x) 2063 #else 2064 #define DONTCARE(x) ((x) = (x)) 2065 #define PRESERVE(x) ((x) = (x)) 2066 #endif /* lint */ 2067 2068 PRESERVE(tcp->tcp_bind_hash_port); 2069 PRESERVE(tcp->tcp_bind_hash); 2070 PRESERVE(tcp->tcp_ptpbhn); 2071 PRESERVE(tcp->tcp_acceptor_hash); 2072 PRESERVE(tcp->tcp_ptpahn); 2073 2074 /* Should be ASSERT NULL on these with new code! */ 2075 ASSERT(tcp->tcp_time_wait_next == NULL); 2076 ASSERT(tcp->tcp_time_wait_prev == NULL); 2077 ASSERT(tcp->tcp_time_wait_expire == 0); 2078 PRESERVE(tcp->tcp_state); 2079 PRESERVE(connp->conn_rq); 2080 PRESERVE(connp->conn_wq); 2081 2082 ASSERT(tcp->tcp_xmit_head == NULL); 2083 ASSERT(tcp->tcp_xmit_last == NULL); 2084 ASSERT(tcp->tcp_unsent == 0); 2085 ASSERT(tcp->tcp_xmit_tail == NULL); 2086 ASSERT(tcp->tcp_xmit_tail_unsent == 0); 2087 2088 tcp->tcp_snxt = 0; /* Displayed in mib */ 2089 tcp->tcp_suna = 0; /* Displayed in mib */ 2090 tcp->tcp_swnd = 0; 2091 DONTCARE(tcp->tcp_cwnd); /* Init in tcp_process_options */ 2092 2093 ASSERT(tcp->tcp_ibsegs == 0); 2094 ASSERT(tcp->tcp_obsegs == 0); 2095 2096 if (connp->conn_ht_iphc != NULL) { 2097 kmem_free(connp->conn_ht_iphc, connp->conn_ht_iphc_allocated); 2098 connp->conn_ht_iphc = NULL; 2099 connp->conn_ht_iphc_allocated = 0; 2100 connp->conn_ht_iphc_len = 0; 2101 connp->conn_ht_ulp = NULL; 2102 connp->conn_ht_ulp_len = 0; 2103 tcp->tcp_ipha = NULL; 2104 tcp->tcp_ip6h = NULL; 2105 tcp->tcp_tcpha = NULL; 2106 } 2107 2108 /* We clear any IP_OPTIONS and extension headers */ 2109 ip_pkt_free(&connp->conn_xmit_ipp); 2110 2111 DONTCARE(tcp->tcp_naglim); /* Init in tcp_init_values */ 2112 DONTCARE(tcp->tcp_ipha); 2113 DONTCARE(tcp->tcp_ip6h); 2114 DONTCARE(tcp->tcp_tcpha); 2115 tcp->tcp_valid_bits = 0; 2116 2117 DONTCARE(tcp->tcp_timer_backoff); /* Init in tcp_init_values */ 2118 DONTCARE(tcp->tcp_last_recv_time); /* Init in tcp_init_values */ 2119 tcp->tcp_last_rcv_lbolt = 0; 2120 2121 tcp->tcp_init_cwnd = 0; 2122 2123 tcp->tcp_urp_last_valid = 0; 2124 tcp->tcp_hard_binding = 0; 2125 2126 tcp->tcp_fin_acked = 0; 2127 tcp->tcp_fin_rcvd = 0; 2128 tcp->tcp_fin_sent = 0; 2129 tcp->tcp_ordrel_done = 0; 2130 2131 tcp->tcp_detached = 0; 2132 2133 tcp->tcp_snd_ws_ok = B_FALSE; 2134 tcp->tcp_snd_ts_ok = B_FALSE; 2135 tcp->tcp_zero_win_probe = 0; 2136 2137 tcp->tcp_loopback = 0; 2138 tcp->tcp_localnet = 0; 2139 tcp->tcp_syn_defense = 0; 2140 tcp->tcp_set_timer = 0; 2141 2142 tcp->tcp_active_open = 0; 2143 tcp->tcp_rexmit = B_FALSE; 2144 tcp->tcp_xmit_zc_clean = B_FALSE; 2145 2146 tcp->tcp_snd_sack_ok = B_FALSE; 2147 tcp->tcp_hwcksum = B_FALSE; 2148 2149 DONTCARE(tcp->tcp_maxpsz_multiplier); /* Init in tcp_init_values */ 2150 2151 tcp->tcp_conn_def_q0 = 0; 2152 tcp->tcp_ip_forward_progress = B_FALSE; 2153 tcp->tcp_ecn_ok = B_FALSE; 2154 2155 tcp->tcp_cwr = B_FALSE; 2156 tcp->tcp_ecn_echo_on = B_FALSE; 2157 tcp->tcp_is_wnd_shrnk = B_FALSE; 2158 2159 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, tcp); 2160 bzero(&tcp->tcp_sack_info, sizeof (tcp_sack_info_t)); 2161 2162 tcp->tcp_rcv_ws = 0; 2163 tcp->tcp_snd_ws = 0; 2164 tcp->tcp_ts_recent = 0; 2165 tcp->tcp_rnxt = 0; /* Displayed in mib */ 2166 DONTCARE(tcp->tcp_rwnd); /* Set in tcp_reinit() */ 2167 tcp->tcp_initial_pmtu = 0; 2168 2169 ASSERT(tcp->tcp_reass_head == NULL); 2170 ASSERT(tcp->tcp_reass_tail == NULL); 2171 2172 tcp->tcp_cwnd_cnt = 0; 2173 2174 ASSERT(tcp->tcp_rcv_list == NULL); 2175 ASSERT(tcp->tcp_rcv_last_head == NULL); 2176 ASSERT(tcp->tcp_rcv_last_tail == NULL); 2177 ASSERT(tcp->tcp_rcv_cnt == 0); 2178 2179 DONTCARE(tcp->tcp_cwnd_ssthresh); /* Init in tcp_set_destination */ 2180 DONTCARE(tcp->tcp_cwnd_max); /* Init in tcp_init_values */ 2181 tcp->tcp_csuna = 0; 2182 2183 tcp->tcp_rto = 0; /* Displayed in MIB */ 2184 DONTCARE(tcp->tcp_rtt_sa); /* Init in tcp_init_values */ 2185 DONTCARE(tcp->tcp_rtt_sd); /* Init in tcp_init_values */ 2186 tcp->tcp_rtt_update = 0; 2187 2188 DONTCARE(tcp->tcp_swl1); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2189 DONTCARE(tcp->tcp_swl2); /* Init in case TCPS_LISTEN/TCPS_SYN_SENT */ 2190 2191 tcp->tcp_rack = 0; /* Displayed in mib */ 2192 tcp->tcp_rack_cnt = 0; 2193 tcp->tcp_rack_cur_max = 0; 2194 tcp->tcp_rack_abs_max = 0; 2195 2196 tcp->tcp_max_swnd = 0; 2197 2198 ASSERT(tcp->tcp_listener == NULL); 2199 2200 DONTCARE(tcp->tcp_irs); /* tcp_valid_bits cleared */ 2201 DONTCARE(tcp->tcp_iss); /* tcp_valid_bits cleared */ 2202 DONTCARE(tcp->tcp_fss); /* tcp_valid_bits cleared */ 2203 DONTCARE(tcp->tcp_urg); /* tcp_valid_bits cleared */ 2204 2205 ASSERT(tcp->tcp_conn_req_cnt_q == 0); 2206 ASSERT(tcp->tcp_conn_req_cnt_q0 == 0); 2207 PRESERVE(tcp->tcp_conn_req_max); 2208 PRESERVE(tcp->tcp_conn_req_seqnum); 2209 2210 DONTCARE(tcp->tcp_first_timer_threshold); /* Init in tcp_init_values */ 2211 DONTCARE(tcp->tcp_second_timer_threshold); /* Init in tcp_init_values */ 2212 DONTCARE(tcp->tcp_first_ctimer_threshold); /* Init in tcp_init_values */ 2213 DONTCARE(tcp->tcp_second_ctimer_threshold); /* in tcp_init_values */ 2214 2215 DONTCARE(tcp->tcp_urp_last); /* tcp_urp_last_valid is cleared */ 2216 ASSERT(tcp->tcp_urp_mp == NULL); 2217 ASSERT(tcp->tcp_urp_mark_mp == NULL); 2218 ASSERT(tcp->tcp_fused_sigurg_mp == NULL); 2219 2220 ASSERT(tcp->tcp_eager_next_q == NULL); 2221 ASSERT(tcp->tcp_eager_last_q == NULL); 2222 ASSERT((tcp->tcp_eager_next_q0 == NULL && 2223 tcp->tcp_eager_prev_q0 == NULL) || 2224 tcp->tcp_eager_next_q0 == tcp->tcp_eager_prev_q0); 2225 ASSERT(tcp->tcp_conn.tcp_eager_conn_ind == NULL); 2226 2227 ASSERT((tcp->tcp_eager_next_drop_q0 == NULL && 2228 tcp->tcp_eager_prev_drop_q0 == NULL) || 2229 tcp->tcp_eager_next_drop_q0 == tcp->tcp_eager_prev_drop_q0); 2230 2231 DONTCARE(tcp->tcp_ka_rinterval); /* Init in tcp_init_values */ 2232 DONTCARE(tcp->tcp_ka_abort_thres); /* Init in tcp_init_values */ 2233 DONTCARE(tcp->tcp_ka_cnt); /* Init in tcp_init_values */ 2234 2235 tcp->tcp_client_errno = 0; 2236 2237 DONTCARE(connp->conn_sum); /* Init in tcp_init_values */ 2238 2239 connp->conn_faddr_v6 = ipv6_all_zeros; /* Displayed in MIB */ 2240 2241 PRESERVE(connp->conn_bound_addr_v6); 2242 tcp->tcp_last_sent_len = 0; 2243 tcp->tcp_dupack_cnt = 0; 2244 2245 connp->conn_fport = 0; /* Displayed in MIB */ 2246 PRESERVE(connp->conn_lport); 2247 2248 PRESERVE(tcp->tcp_acceptor_lockp); 2249 2250 ASSERT(tcp->tcp_ordrel_mp == NULL); 2251 PRESERVE(tcp->tcp_acceptor_id); 2252 DONTCARE(tcp->tcp_ipsec_overhead); 2253 2254 PRESERVE(connp->conn_family); 2255 /* Remove any remnants of mapped address binding */ 2256 if (connp->conn_family == AF_INET6) { 2257 connp->conn_ipversion = IPV6_VERSION; 2258 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2259 } else { 2260 connp->conn_ipversion = IPV4_VERSION; 2261 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2262 } 2263 2264 connp->conn_bound_if = 0; 2265 connp->conn_recv_ancillary.crb_all = 0; 2266 tcp->tcp_recvifindex = 0; 2267 tcp->tcp_recvhops = 0; 2268 tcp->tcp_closed = 0; 2269 if (tcp->tcp_hopopts != NULL) { 2270 mi_free(tcp->tcp_hopopts); 2271 tcp->tcp_hopopts = NULL; 2272 tcp->tcp_hopoptslen = 0; 2273 } 2274 ASSERT(tcp->tcp_hopoptslen == 0); 2275 if (tcp->tcp_dstopts != NULL) { 2276 mi_free(tcp->tcp_dstopts); 2277 tcp->tcp_dstopts = NULL; 2278 tcp->tcp_dstoptslen = 0; 2279 } 2280 ASSERT(tcp->tcp_dstoptslen == 0); 2281 if (tcp->tcp_rthdrdstopts != NULL) { 2282 mi_free(tcp->tcp_rthdrdstopts); 2283 tcp->tcp_rthdrdstopts = NULL; 2284 tcp->tcp_rthdrdstoptslen = 0; 2285 } 2286 ASSERT(tcp->tcp_rthdrdstoptslen == 0); 2287 if (tcp->tcp_rthdr != NULL) { 2288 mi_free(tcp->tcp_rthdr); 2289 tcp->tcp_rthdr = NULL; 2290 tcp->tcp_rthdrlen = 0; 2291 } 2292 ASSERT(tcp->tcp_rthdrlen == 0); 2293 2294 /* Reset fusion-related fields */ 2295 tcp->tcp_fused = B_FALSE; 2296 tcp->tcp_unfusable = B_FALSE; 2297 tcp->tcp_fused_sigurg = B_FALSE; 2298 tcp->tcp_loopback_peer = NULL; 2299 2300 tcp->tcp_lso = B_FALSE; 2301 2302 tcp->tcp_in_ack_unsent = 0; 2303 tcp->tcp_cork = B_FALSE; 2304 tcp->tcp_tconnind_started = B_FALSE; 2305 2306 PRESERVE(tcp->tcp_squeue_bytes); 2307 2308 tcp->tcp_closemp_used = B_FALSE; 2309 2310 PRESERVE(tcp->tcp_rsrv_mp); 2311 PRESERVE(tcp->tcp_rsrv_mp_lock); 2312 2313 #ifdef DEBUG 2314 DONTCARE(tcp->tcmp_stk[0]); 2315 #endif 2316 2317 PRESERVE(tcp->tcp_connid); 2318 2319 ASSERT(tcp->tcp_listen_cnt == NULL); 2320 ASSERT(tcp->tcp_reass_tid == 0); 2321 2322 #undef DONTCARE 2323 #undef PRESERVE 2324 } 2325 2326 /* 2327 * Initialize the various fields in tcp_t. If parent (the listener) is non 2328 * NULL, certain values will be inheritted from it. 2329 */ 2330 void 2331 tcp_init_values(tcp_t *tcp, tcp_t *parent) 2332 { 2333 tcp_stack_t *tcps = tcp->tcp_tcps; 2334 conn_t *connp = tcp->tcp_connp; 2335 clock_t rto; 2336 2337 ASSERT((connp->conn_family == AF_INET && 2338 connp->conn_ipversion == IPV4_VERSION) || 2339 (connp->conn_family == AF_INET6 && 2340 (connp->conn_ipversion == IPV4_VERSION || 2341 connp->conn_ipversion == IPV6_VERSION))); 2342 2343 if (parent == NULL) { 2344 tcp->tcp_naglim = tcps->tcps_naglim_def; 2345 2346 tcp->tcp_rto_initial = tcps->tcps_rexmit_interval_initial; 2347 tcp->tcp_rto_min = tcps->tcps_rexmit_interval_min; 2348 tcp->tcp_rto_max = tcps->tcps_rexmit_interval_max; 2349 2350 tcp->tcp_first_ctimer_threshold = 2351 tcps->tcps_ip_notify_cinterval; 2352 tcp->tcp_second_ctimer_threshold = 2353 tcps->tcps_ip_abort_cinterval; 2354 tcp->tcp_first_timer_threshold = tcps->tcps_ip_notify_interval; 2355 tcp->tcp_second_timer_threshold = tcps->tcps_ip_abort_interval; 2356 2357 tcp->tcp_fin_wait_2_flush_interval = 2358 tcps->tcps_fin_wait_2_flush_interval; 2359 2360 tcp->tcp_ka_interval = tcps->tcps_keepalive_interval; 2361 tcp->tcp_ka_abort_thres = tcps->tcps_keepalive_abort_interval; 2362 tcp->tcp_ka_cnt = 0; 2363 tcp->tcp_ka_rinterval = 0; 2364 2365 /* 2366 * Default value of tcp_init_cwnd is 0, so no need to set here 2367 * if parent is NULL. But we need to inherit it from parent. 2368 */ 2369 } else { 2370 /* Inherit various TCP parameters from the parent. */ 2371 tcp->tcp_naglim = parent->tcp_naglim; 2372 2373 tcp->tcp_rto_initial = parent->tcp_rto_initial; 2374 tcp->tcp_rto_min = parent->tcp_rto_min; 2375 tcp->tcp_rto_max = parent->tcp_rto_max; 2376 2377 tcp->tcp_first_ctimer_threshold = 2378 parent->tcp_first_ctimer_threshold; 2379 tcp->tcp_second_ctimer_threshold = 2380 parent->tcp_second_ctimer_threshold; 2381 tcp->tcp_first_timer_threshold = 2382 parent->tcp_first_timer_threshold; 2383 tcp->tcp_second_timer_threshold = 2384 parent->tcp_second_timer_threshold; 2385 2386 tcp->tcp_fin_wait_2_flush_interval = 2387 parent->tcp_fin_wait_2_flush_interval; 2388 2389 tcp->tcp_ka_interval = parent->tcp_ka_interval; 2390 tcp->tcp_ka_abort_thres = parent->tcp_ka_abort_thres; 2391 tcp->tcp_ka_cnt = parent->tcp_ka_cnt; 2392 tcp->tcp_ka_rinterval = parent->tcp_ka_rinterval; 2393 2394 tcp->tcp_init_cwnd = parent->tcp_init_cwnd; 2395 } 2396 2397 /* 2398 * Initialize tcp_rtt_sa and tcp_rtt_sd so that the calculated RTO 2399 * will be close to tcp_rexmit_interval_initial. By doing this, we 2400 * allow the algorithm to adjust slowly to large fluctuations of RTT 2401 * during first few transmissions of a connection as seen in slow 2402 * links. 2403 */ 2404 tcp->tcp_rtt_sa = tcp->tcp_rto_initial << 2; 2405 tcp->tcp_rtt_sd = tcp->tcp_rto_initial >> 1; 2406 rto = (tcp->tcp_rtt_sa >> 3) + tcp->tcp_rtt_sd + 2407 tcps->tcps_rexmit_interval_extra + (tcp->tcp_rtt_sa >> 5) + 2408 tcps->tcps_conn_grace_period; 2409 TCP_SET_RTO(tcp, rto); 2410 2411 tcp->tcp_timer_backoff = 0; 2412 tcp->tcp_ms_we_have_waited = 0; 2413 tcp->tcp_last_recv_time = ddi_get_lbolt(); 2414 tcp->tcp_cwnd_max = tcps->tcps_cwnd_max_; 2415 tcp->tcp_cwnd_ssthresh = TCP_MAX_LARGEWIN; 2416 tcp->tcp_snd_burst = TCP_CWND_INFINITE; 2417 2418 tcp->tcp_maxpsz_multiplier = tcps->tcps_maxpsz_multiplier; 2419 2420 /* NOTE: ISS is now set in tcp_set_destination(). */ 2421 2422 /* Reset fusion-related fields */ 2423 tcp->tcp_fused = B_FALSE; 2424 tcp->tcp_unfusable = B_FALSE; 2425 tcp->tcp_fused_sigurg = B_FALSE; 2426 tcp->tcp_loopback_peer = NULL; 2427 2428 /* We rebuild the header template on the next connect/conn_request */ 2429 2430 connp->conn_mlp_type = mlptSingle; 2431 2432 /* 2433 * Init the window scale to the max so tcp_rwnd_set() won't pare 2434 * down tcp_rwnd. tcp_set_destination() will set the right value later. 2435 */ 2436 tcp->tcp_rcv_ws = TCP_MAX_WINSHIFT; 2437 tcp->tcp_rwnd = connp->conn_rcvbuf; 2438 2439 tcp->tcp_cork = B_FALSE; 2440 /* 2441 * Init the tcp_debug option if it wasn't already set. This value 2442 * determines whether TCP 2443 * calls strlog() to print out debug messages. Doing this 2444 * initialization here means that this value is not inherited thru 2445 * tcp_reinit(). 2446 */ 2447 if (!connp->conn_debug) 2448 connp->conn_debug = tcps->tcps_dbg; 2449 } 2450 2451 /* 2452 * Update the TCP connection according to change of PMTU. 2453 * 2454 * Path MTU might have changed by either increase or decrease, so need to 2455 * adjust the MSS based on the value of ixa_pmtu. No need to handle tiny 2456 * or negative MSS, since tcp_mss_set() will do it. 2457 */ 2458 void 2459 tcp_update_pmtu(tcp_t *tcp, boolean_t decrease_only) 2460 { 2461 uint32_t pmtu; 2462 int32_t mss; 2463 conn_t *connp = tcp->tcp_connp; 2464 ip_xmit_attr_t *ixa = connp->conn_ixa; 2465 iaflags_t ixaflags; 2466 2467 if (tcp->tcp_tcps->tcps_ignore_path_mtu) 2468 return; 2469 2470 if (tcp->tcp_state < TCPS_ESTABLISHED) 2471 return; 2472 2473 /* 2474 * Always call ip_get_pmtu() to make sure that IP has updated 2475 * ixa_flags properly. 2476 */ 2477 pmtu = ip_get_pmtu(ixa); 2478 ixaflags = ixa->ixa_flags; 2479 2480 /* 2481 * Calculate the MSS by decreasing the PMTU by conn_ht_iphc_len and 2482 * IPsec overhead if applied. Make sure to use the most recent 2483 * IPsec information. 2484 */ 2485 mss = pmtu - connp->conn_ht_iphc_len - conn_ipsec_length(connp); 2486 2487 /* 2488 * Nothing to change, so just return. 2489 */ 2490 if (mss == tcp->tcp_mss) 2491 return; 2492 2493 /* 2494 * Currently, for ICMP errors, only PMTU decrease is handled. 2495 */ 2496 if (mss > tcp->tcp_mss && decrease_only) 2497 return; 2498 2499 DTRACE_PROBE2(tcp_update_pmtu, int32_t, tcp->tcp_mss, uint32_t, mss); 2500 2501 /* 2502 * Update ixa_fragsize and ixa_pmtu. 2503 */ 2504 ixa->ixa_fragsize = ixa->ixa_pmtu = pmtu; 2505 2506 /* 2507 * Adjust MSS and all relevant variables. 2508 */ 2509 tcp_mss_set(tcp, mss); 2510 2511 /* 2512 * If the PMTU is below the min size maintained by IP, then ip_get_pmtu 2513 * has set IXAF_PMTU_TOO_SMALL and cleared IXAF_PMTU_IPV4_DF. Since TCP 2514 * has a (potentially different) min size we do the same. Make sure to 2515 * clear IXAF_DONTFRAG, which is used by IP to decide whether to 2516 * fragment the packet. 2517 * 2518 * LSO over IPv6 can not be fragmented. So need to disable LSO 2519 * when IPv6 fragmentation is needed. 2520 */ 2521 if (mss < tcp->tcp_tcps->tcps_mss_min) 2522 ixaflags |= IXAF_PMTU_TOO_SMALL; 2523 2524 if (ixaflags & IXAF_PMTU_TOO_SMALL) 2525 ixaflags &= ~(IXAF_DONTFRAG | IXAF_PMTU_IPV4_DF); 2526 2527 if ((connp->conn_ipversion == IPV4_VERSION) && 2528 !(ixaflags & IXAF_PMTU_IPV4_DF)) { 2529 tcp->tcp_ipha->ipha_fragment_offset_and_flags = 0; 2530 } 2531 ixa->ixa_flags = ixaflags; 2532 } 2533 2534 int 2535 tcp_maxpsz_set(tcp_t *tcp, boolean_t set_maxblk) 2536 { 2537 conn_t *connp = tcp->tcp_connp; 2538 queue_t *q = connp->conn_rq; 2539 int32_t mss = tcp->tcp_mss; 2540 int maxpsz; 2541 2542 if (TCP_IS_DETACHED(tcp)) 2543 return (mss); 2544 if (tcp->tcp_fused) { 2545 maxpsz = tcp_fuse_maxpsz(tcp); 2546 mss = INFPSZ; 2547 } else if (tcp->tcp_maxpsz_multiplier == 0) { 2548 /* 2549 * Set the sd_qn_maxpsz according to the socket send buffer 2550 * size, and sd_maxblk to INFPSZ (-1). This will essentially 2551 * instruct the stream head to copyin user data into contiguous 2552 * kernel-allocated buffers without breaking it up into smaller 2553 * chunks. We round up the buffer size to the nearest SMSS. 2554 */ 2555 maxpsz = MSS_ROUNDUP(connp->conn_sndbuf, mss); 2556 mss = INFPSZ; 2557 } else { 2558 /* 2559 * Set sd_qn_maxpsz to approx half the (receivers) buffer 2560 * (and a multiple of the mss). This instructs the stream 2561 * head to break down larger than SMSS writes into SMSS- 2562 * size mblks, up to tcp_maxpsz_multiplier mblks at a time. 2563 */ 2564 maxpsz = tcp->tcp_maxpsz_multiplier * mss; 2565 if (maxpsz > connp->conn_sndbuf / 2) { 2566 maxpsz = connp->conn_sndbuf / 2; 2567 /* Round up to nearest mss */ 2568 maxpsz = MSS_ROUNDUP(maxpsz, mss); 2569 } 2570 } 2571 2572 (void) proto_set_maxpsz(q, connp, maxpsz); 2573 if (!(IPCL_IS_NONSTR(connp))) 2574 connp->conn_wq->q_maxpsz = maxpsz; 2575 if (set_maxblk) 2576 (void) proto_set_tx_maxblk(q, connp, mss); 2577 return (mss); 2578 } 2579 2580 /* For /dev/tcp aka AF_INET open */ 2581 static int 2582 tcp_openv4(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2583 { 2584 return (tcp_open(q, devp, flag, sflag, credp, B_FALSE)); 2585 } 2586 2587 /* For /dev/tcp6 aka AF_INET6 open */ 2588 static int 2589 tcp_openv6(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp) 2590 { 2591 return (tcp_open(q, devp, flag, sflag, credp, B_TRUE)); 2592 } 2593 2594 conn_t * 2595 tcp_create_common(cred_t *credp, boolean_t isv6, boolean_t issocket, 2596 int *errorp) 2597 { 2598 tcp_t *tcp = NULL; 2599 conn_t *connp; 2600 zoneid_t zoneid; 2601 tcp_stack_t *tcps; 2602 squeue_t *sqp; 2603 2604 ASSERT(errorp != NULL); 2605 /* 2606 * Find the proper zoneid and netstack. 2607 */ 2608 /* 2609 * Special case for install: miniroot needs to be able to 2610 * access files via NFS as though it were always in the 2611 * global zone. 2612 */ 2613 if (credp == kcred && nfs_global_client_only != 0) { 2614 zoneid = GLOBAL_ZONEID; 2615 tcps = netstack_find_by_stackid(GLOBAL_NETSTACKID)-> 2616 netstack_tcp; 2617 ASSERT(tcps != NULL); 2618 } else { 2619 netstack_t *ns; 2620 int err; 2621 2622 if ((err = secpolicy_basic_net_access(credp)) != 0) { 2623 *errorp = err; 2624 return (NULL); 2625 } 2626 2627 ns = netstack_find_by_cred(credp); 2628 ASSERT(ns != NULL); 2629 tcps = ns->netstack_tcp; 2630 ASSERT(tcps != NULL); 2631 2632 /* 2633 * For exclusive stacks we set the zoneid to zero 2634 * to make TCP operate as if in the global zone. 2635 */ 2636 if (tcps->tcps_netstack->netstack_stackid != 2637 GLOBAL_NETSTACKID) 2638 zoneid = GLOBAL_ZONEID; 2639 else 2640 zoneid = crgetzoneid(credp); 2641 } 2642 2643 sqp = IP_SQUEUE_GET((uint_t)gethrtime()); 2644 connp = (conn_t *)tcp_get_conn(sqp, tcps); 2645 /* 2646 * Both tcp_get_conn and netstack_find_by_cred incremented refcnt, 2647 * so we drop it by one. 2648 */ 2649 netstack_rele(tcps->tcps_netstack); 2650 if (connp == NULL) { 2651 *errorp = ENOSR; 2652 return (NULL); 2653 } 2654 ASSERT(connp->conn_ixa->ixa_protocol == connp->conn_proto); 2655 2656 connp->conn_sqp = sqp; 2657 connp->conn_initial_sqp = connp->conn_sqp; 2658 connp->conn_ixa->ixa_sqp = connp->conn_sqp; 2659 tcp = connp->conn_tcp; 2660 2661 /* 2662 * Besides asking IP to set the checksum for us, have conn_ip_output 2663 * to do the following checks when necessary: 2664 * 2665 * IXAF_VERIFY_SOURCE: drop packets when our outer source goes invalid 2666 * IXAF_VERIFY_PMTU: verify PMTU changes 2667 * IXAF_VERIFY_LSO: verify LSO capability changes 2668 */ 2669 connp->conn_ixa->ixa_flags |= IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 2670 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO; 2671 2672 if (!tcps->tcps_dev_flow_ctl) 2673 connp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 2674 2675 if (isv6) { 2676 connp->conn_ixa->ixa_src_preferences = IPV6_PREFER_SRC_DEFAULT; 2677 connp->conn_ipversion = IPV6_VERSION; 2678 connp->conn_family = AF_INET6; 2679 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 2680 connp->conn_default_ttl = tcps->tcps_ipv6_hoplimit; 2681 } else { 2682 connp->conn_ipversion = IPV4_VERSION; 2683 connp->conn_family = AF_INET; 2684 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 2685 connp->conn_default_ttl = tcps->tcps_ipv4_ttl; 2686 } 2687 connp->conn_xmit_ipp.ipp_unicast_hops = connp->conn_default_ttl; 2688 2689 crhold(credp); 2690 connp->conn_cred = credp; 2691 connp->conn_cpid = curproc->p_pid; 2692 connp->conn_open_time = ddi_get_lbolt64(); 2693 2694 /* Cache things in the ixa without any refhold */ 2695 ASSERT(!(connp->conn_ixa->ixa_free_flags & IXA_FREE_CRED)); 2696 connp->conn_ixa->ixa_cred = credp; 2697 connp->conn_ixa->ixa_cpid = connp->conn_cpid; 2698 2699 connp->conn_zoneid = zoneid; 2700 /* conn_allzones can not be set this early, hence no IPCL_ZONEID */ 2701 connp->conn_ixa->ixa_zoneid = zoneid; 2702 connp->conn_mlp_type = mlptSingle; 2703 ASSERT(connp->conn_netstack == tcps->tcps_netstack); 2704 ASSERT(tcp->tcp_tcps == tcps); 2705 2706 /* 2707 * If the caller has the process-wide flag set, then default to MAC 2708 * exempt mode. This allows read-down to unlabeled hosts. 2709 */ 2710 if (getpflags(NET_MAC_AWARE, credp) != 0) 2711 connp->conn_mac_mode = CONN_MAC_AWARE; 2712 2713 connp->conn_zone_is_global = (crgetzoneid(credp) == GLOBAL_ZONEID); 2714 2715 if (issocket) { 2716 tcp->tcp_issocket = 1; 2717 } 2718 2719 connp->conn_rcvbuf = tcps->tcps_recv_hiwat; 2720 connp->conn_sndbuf = tcps->tcps_xmit_hiwat; 2721 connp->conn_sndlowat = tcps->tcps_xmit_lowat; 2722 connp->conn_so_type = SOCK_STREAM; 2723 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2724 tcps->tcps_wroff_xtra; 2725 2726 SOCK_CONNID_INIT(tcp->tcp_connid); 2727 /* DTrace ignores this - it isn't a tcp:::state-change */ 2728 tcp->tcp_state = TCPS_IDLE; 2729 tcp_init_values(tcp, NULL); 2730 return (connp); 2731 } 2732 2733 static int 2734 tcp_open(queue_t *q, dev_t *devp, int flag, int sflag, cred_t *credp, 2735 boolean_t isv6) 2736 { 2737 tcp_t *tcp = NULL; 2738 conn_t *connp = NULL; 2739 int err; 2740 vmem_t *minor_arena = NULL; 2741 dev_t conn_dev; 2742 boolean_t issocket; 2743 2744 if (q->q_ptr != NULL) 2745 return (0); 2746 2747 if (sflag == MODOPEN) 2748 return (EINVAL); 2749 2750 if ((ip_minor_arena_la != NULL) && (flag & SO_SOCKSTR) && 2751 ((conn_dev = inet_minor_alloc(ip_minor_arena_la)) != 0)) { 2752 minor_arena = ip_minor_arena_la; 2753 } else { 2754 /* 2755 * Either minor numbers in the large arena were exhausted 2756 * or a non socket application is doing the open. 2757 * Try to allocate from the small arena. 2758 */ 2759 if ((conn_dev = inet_minor_alloc(ip_minor_arena_sa)) == 0) { 2760 return (EBUSY); 2761 } 2762 minor_arena = ip_minor_arena_sa; 2763 } 2764 2765 ASSERT(minor_arena != NULL); 2766 2767 *devp = makedevice(getmajor(*devp), (minor_t)conn_dev); 2768 2769 if (flag & SO_FALLBACK) { 2770 /* 2771 * Non streams socket needs a stream to fallback to 2772 */ 2773 RD(q)->q_ptr = (void *)conn_dev; 2774 WR(q)->q_qinfo = &tcp_fallback_sock_winit; 2775 WR(q)->q_ptr = (void *)minor_arena; 2776 qprocson(q); 2777 return (0); 2778 } else if (flag & SO_ACCEPTOR) { 2779 q->q_qinfo = &tcp_acceptor_rinit; 2780 /* 2781 * the conn_dev and minor_arena will be subsequently used by 2782 * tcp_tli_accept() and tcp_tpi_close_accept() to figure out 2783 * the minor device number for this connection from the q_ptr. 2784 */ 2785 RD(q)->q_ptr = (void *)conn_dev; 2786 WR(q)->q_qinfo = &tcp_acceptor_winit; 2787 WR(q)->q_ptr = (void *)minor_arena; 2788 qprocson(q); 2789 return (0); 2790 } 2791 2792 issocket = flag & SO_SOCKSTR; 2793 connp = tcp_create_common(credp, isv6, issocket, &err); 2794 2795 if (connp == NULL) { 2796 inet_minor_free(minor_arena, conn_dev); 2797 q->q_ptr = WR(q)->q_ptr = NULL; 2798 return (err); 2799 } 2800 2801 connp->conn_rq = q; 2802 connp->conn_wq = WR(q); 2803 q->q_ptr = WR(q)->q_ptr = connp; 2804 2805 connp->conn_dev = conn_dev; 2806 connp->conn_minor_arena = minor_arena; 2807 2808 ASSERT(q->q_qinfo == &tcp_rinitv4 || q->q_qinfo == &tcp_rinitv6); 2809 ASSERT(WR(q)->q_qinfo == &tcp_winit); 2810 2811 tcp = connp->conn_tcp; 2812 2813 if (issocket) { 2814 WR(q)->q_qinfo = &tcp_sock_winit; 2815 } else { 2816 #ifdef _ILP32 2817 tcp->tcp_acceptor_id = (t_uscalar_t)RD(q); 2818 #else 2819 tcp->tcp_acceptor_id = conn_dev; 2820 #endif /* _ILP32 */ 2821 tcp_acceptor_hash_insert(tcp->tcp_acceptor_id, tcp); 2822 } 2823 2824 /* 2825 * Put the ref for TCP. Ref for IP was already put 2826 * by ipcl_conn_create. Also Make the conn_t globally 2827 * visible to walkers 2828 */ 2829 mutex_enter(&connp->conn_lock); 2830 CONN_INC_REF_LOCKED(connp); 2831 ASSERT(connp->conn_ref == 2); 2832 connp->conn_state_flags &= ~CONN_INCIPIENT; 2833 mutex_exit(&connp->conn_lock); 2834 2835 qprocson(q); 2836 return (0); 2837 } 2838 2839 /* 2840 * Build/update the tcp header template (in conn_ht_iphc) based on 2841 * conn_xmit_ipp. The headers include ip6_t, any extension 2842 * headers, and the maximum size tcp header (to avoid reallocation 2843 * on the fly for additional tcp options). 2844 * 2845 * Assumes the caller has already set conn_{faddr,laddr,fport,lport,flowinfo}. 2846 * Returns failure if can't allocate memory. 2847 */ 2848 int 2849 tcp_build_hdrs(tcp_t *tcp) 2850 { 2851 tcp_stack_t *tcps = tcp->tcp_tcps; 2852 conn_t *connp = tcp->tcp_connp; 2853 char buf[TCP_MAX_HDR_LENGTH]; 2854 uint_t buflen; 2855 uint_t ulplen = TCP_MIN_HEADER_LENGTH; 2856 uint_t extralen = TCP_MAX_TCP_OPTIONS_LENGTH; 2857 tcpha_t *tcpha; 2858 uint32_t cksum; 2859 int error; 2860 2861 /* 2862 * We might be called after the connection is set up, and we might 2863 * have TS options already in the TCP header. Thus we save any 2864 * existing tcp header. 2865 */ 2866 buflen = connp->conn_ht_ulp_len; 2867 if (buflen != 0) { 2868 bcopy(connp->conn_ht_ulp, buf, buflen); 2869 extralen -= buflen - ulplen; 2870 ulplen = buflen; 2871 } 2872 2873 /* Grab lock to satisfy ASSERT; TCP is serialized using squeue */ 2874 mutex_enter(&connp->conn_lock); 2875 error = conn_build_hdr_template(connp, ulplen, extralen, 2876 &connp->conn_laddr_v6, &connp->conn_faddr_v6, connp->conn_flowinfo); 2877 mutex_exit(&connp->conn_lock); 2878 if (error != 0) 2879 return (error); 2880 2881 /* 2882 * Any routing header/option has been massaged. The checksum difference 2883 * is stored in conn_sum for later use. 2884 */ 2885 tcpha = (tcpha_t *)connp->conn_ht_ulp; 2886 tcp->tcp_tcpha = tcpha; 2887 2888 /* restore any old tcp header */ 2889 if (buflen != 0) { 2890 bcopy(buf, connp->conn_ht_ulp, buflen); 2891 } else { 2892 tcpha->tha_sum = 0; 2893 tcpha->tha_urp = 0; 2894 tcpha->tha_ack = 0; 2895 tcpha->tha_offset_and_reserved = (5 << 4); 2896 tcpha->tha_lport = connp->conn_lport; 2897 tcpha->tha_fport = connp->conn_fport; 2898 } 2899 2900 /* 2901 * IP wants our header length in the checksum field to 2902 * allow it to perform a single pseudo-header+checksum 2903 * calculation on behalf of TCP. 2904 * Include the adjustment for a source route once IP_OPTIONS is set. 2905 */ 2906 cksum = sizeof (tcpha_t) + connp->conn_sum; 2907 cksum = (cksum >> 16) + (cksum & 0xFFFF); 2908 ASSERT(cksum < 0x10000); 2909 tcpha->tha_sum = htons(cksum); 2910 2911 if (connp->conn_ipversion == IPV4_VERSION) 2912 tcp->tcp_ipha = (ipha_t *)connp->conn_ht_iphc; 2913 else 2914 tcp->tcp_ip6h = (ip6_t *)connp->conn_ht_iphc; 2915 2916 if (connp->conn_ht_iphc_allocated + tcps->tcps_wroff_xtra > 2917 connp->conn_wroff) { 2918 connp->conn_wroff = connp->conn_ht_iphc_allocated + 2919 tcps->tcps_wroff_xtra; 2920 (void) proto_set_tx_wroff(connp->conn_rq, connp, 2921 connp->conn_wroff); 2922 } 2923 return (0); 2924 } 2925 2926 /* 2927 * tcp_rwnd_set() is called to adjust the receive window to a desired value. 2928 * We do not allow the receive window to shrink. After setting rwnd, 2929 * set the flow control hiwat of the stream. 2930 * 2931 * This function is called in 2 cases: 2932 * 2933 * 1) Before data transfer begins, in tcp_input_listener() for accepting a 2934 * connection (passive open) and in tcp_input_data() for active connect. 2935 * This is called after tcp_mss_set() when the desired MSS value is known. 2936 * This makes sure that our window size is a mutiple of the other side's 2937 * MSS. 2938 * 2) Handling SO_RCVBUF option. 2939 * 2940 * It is ASSUMED that the requested size is a multiple of the current MSS. 2941 * 2942 * XXX - Should allow a lower rwnd than tcp_recv_hiwat_minmss * mss if the 2943 * user requests so. 2944 */ 2945 int 2946 tcp_rwnd_set(tcp_t *tcp, uint32_t rwnd) 2947 { 2948 uint32_t mss = tcp->tcp_mss; 2949 uint32_t old_max_rwnd; 2950 uint32_t max_transmittable_rwnd; 2951 boolean_t tcp_detached = TCP_IS_DETACHED(tcp); 2952 tcp_stack_t *tcps = tcp->tcp_tcps; 2953 conn_t *connp = tcp->tcp_connp; 2954 2955 /* 2956 * Insist on a receive window that is at least 2957 * tcp_recv_hiwat_minmss * MSS (default 4 * MSS) to avoid 2958 * funny TCP interactions of Nagle algorithm, SWS avoidance 2959 * and delayed acknowledgement. 2960 */ 2961 rwnd = MAX(rwnd, tcps->tcps_recv_hiwat_minmss * mss); 2962 2963 if (tcp->tcp_fused) { 2964 size_t sth_hiwat; 2965 tcp_t *peer_tcp = tcp->tcp_loopback_peer; 2966 2967 ASSERT(peer_tcp != NULL); 2968 sth_hiwat = tcp_fuse_set_rcv_hiwat(tcp, rwnd); 2969 if (!tcp_detached) { 2970 (void) proto_set_rx_hiwat(connp->conn_rq, connp, 2971 sth_hiwat); 2972 tcp_set_recv_threshold(tcp, sth_hiwat >> 3); 2973 } 2974 2975 /* Caller could have changed tcp_rwnd; update tha_win */ 2976 if (tcp->tcp_tcpha != NULL) { 2977 tcp->tcp_tcpha->tha_win = 2978 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 2979 } 2980 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 2981 tcp->tcp_cwnd_max = rwnd; 2982 2983 /* 2984 * In the fusion case, the maxpsz stream head value of 2985 * our peer is set according to its send buffer size 2986 * and our receive buffer size; since the latter may 2987 * have changed we need to update the peer's maxpsz. 2988 */ 2989 (void) tcp_maxpsz_set(peer_tcp, B_TRUE); 2990 return (sth_hiwat); 2991 } 2992 2993 if (tcp_detached) 2994 old_max_rwnd = tcp->tcp_rwnd; 2995 else 2996 old_max_rwnd = connp->conn_rcvbuf; 2997 2998 2999 /* 3000 * If window size info has already been exchanged, TCP should not 3001 * shrink the window. Shrinking window is doable if done carefully. 3002 * We may add that support later. But so far there is not a real 3003 * need to do that. 3004 */ 3005 if (rwnd < old_max_rwnd && tcp->tcp_state > TCPS_SYN_SENT) { 3006 /* MSS may have changed, do a round up again. */ 3007 rwnd = MSS_ROUNDUP(old_max_rwnd, mss); 3008 } 3009 3010 /* 3011 * tcp_rcv_ws starts with TCP_MAX_WINSHIFT so the following check 3012 * can be applied even before the window scale option is decided. 3013 */ 3014 max_transmittable_rwnd = TCP_MAXWIN << tcp->tcp_rcv_ws; 3015 if (rwnd > max_transmittable_rwnd) { 3016 rwnd = max_transmittable_rwnd - 3017 (max_transmittable_rwnd % mss); 3018 if (rwnd < mss) 3019 rwnd = max_transmittable_rwnd; 3020 /* 3021 * If we're over the limit we may have to back down tcp_rwnd. 3022 * The increment below won't work for us. So we set all three 3023 * here and the increment below will have no effect. 3024 */ 3025 tcp->tcp_rwnd = old_max_rwnd = rwnd; 3026 } 3027 if (tcp->tcp_localnet) { 3028 tcp->tcp_rack_abs_max = 3029 MIN(tcps->tcps_local_dacks_max, rwnd / mss / 2); 3030 } else { 3031 /* 3032 * For a remote host on a different subnet (through a router), 3033 * we ack every other packet to be conforming to RFC1122. 3034 * tcp_deferred_acks_max is default to 2. 3035 */ 3036 tcp->tcp_rack_abs_max = 3037 MIN(tcps->tcps_deferred_acks_max, rwnd / mss / 2); 3038 } 3039 if (tcp->tcp_rack_cur_max > tcp->tcp_rack_abs_max) 3040 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 3041 else 3042 tcp->tcp_rack_cur_max = 0; 3043 /* 3044 * Increment the current rwnd by the amount the maximum grew (we 3045 * can not overwrite it since we might be in the middle of a 3046 * connection.) 3047 */ 3048 tcp->tcp_rwnd += rwnd - old_max_rwnd; 3049 connp->conn_rcvbuf = rwnd; 3050 3051 /* Are we already connected? */ 3052 if (tcp->tcp_tcpha != NULL) { 3053 tcp->tcp_tcpha->tha_win = 3054 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 3055 } 3056 3057 if ((tcp->tcp_rcv_ws > 0) && rwnd > tcp->tcp_cwnd_max) 3058 tcp->tcp_cwnd_max = rwnd; 3059 3060 if (tcp_detached) 3061 return (rwnd); 3062 3063 tcp_set_recv_threshold(tcp, rwnd >> 3); 3064 3065 (void) proto_set_rx_hiwat(connp->conn_rq, connp, rwnd); 3066 return (rwnd); 3067 } 3068 3069 int 3070 tcp_do_unbind(conn_t *connp) 3071 { 3072 tcp_t *tcp = connp->conn_tcp; 3073 int32_t oldstate; 3074 3075 switch (tcp->tcp_state) { 3076 case TCPS_BOUND: 3077 case TCPS_LISTEN: 3078 break; 3079 default: 3080 return (-TOUTSTATE); 3081 } 3082 3083 /* 3084 * Need to clean up all the eagers since after the unbind, segments 3085 * will no longer be delivered to this listener stream. 3086 */ 3087 mutex_enter(&tcp->tcp_eager_lock); 3088 if (tcp->tcp_conn_req_cnt_q0 != 0 || tcp->tcp_conn_req_cnt_q != 0) { 3089 tcp_eager_cleanup(tcp, 0); 3090 } 3091 mutex_exit(&tcp->tcp_eager_lock); 3092 3093 /* Clean up the listener connection counter if necessary. */ 3094 if (tcp->tcp_listen_cnt != NULL) 3095 TCP_DECR_LISTEN_CNT(tcp); 3096 connp->conn_laddr_v6 = ipv6_all_zeros; 3097 connp->conn_saddr_v6 = ipv6_all_zeros; 3098 tcp_bind_hash_remove(tcp); 3099 oldstate = tcp->tcp_state; 3100 tcp->tcp_state = TCPS_IDLE; 3101 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 3102 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 3103 int32_t, oldstate); 3104 3105 ip_unbind(connp); 3106 bzero(&connp->conn_ports, sizeof (connp->conn_ports)); 3107 3108 return (0); 3109 } 3110 3111 /* 3112 * Collect protocol properties to send to the upper handle. 3113 */ 3114 void 3115 tcp_get_proto_props(tcp_t *tcp, struct sock_proto_props *sopp) 3116 { 3117 conn_t *connp = tcp->tcp_connp; 3118 3119 sopp->sopp_flags = SOCKOPT_RCVHIWAT | SOCKOPT_MAXBLK | SOCKOPT_WROFF; 3120 sopp->sopp_maxblk = tcp_maxpsz_set(tcp, B_FALSE); 3121 3122 sopp->sopp_rxhiwat = tcp->tcp_fused ? 3123 tcp_fuse_set_rcv_hiwat(tcp, connp->conn_rcvbuf) : 3124 connp->conn_rcvbuf; 3125 /* 3126 * Determine what write offset value to use depending on SACK and 3127 * whether the endpoint is fused or not. 3128 */ 3129 if (tcp->tcp_fused) { 3130 ASSERT(tcp->tcp_loopback); 3131 ASSERT(tcp->tcp_loopback_peer != NULL); 3132 /* 3133 * For fused tcp loopback, set the stream head's write 3134 * offset value to zero since we won't be needing any room 3135 * for TCP/IP headers. This would also improve performance 3136 * since it would reduce the amount of work done by kmem. 3137 * Non-fused tcp loopback case is handled separately below. 3138 */ 3139 sopp->sopp_wroff = 0; 3140 /* 3141 * Update the peer's transmit parameters according to 3142 * our recently calculated high water mark value. 3143 */ 3144 (void) tcp_maxpsz_set(tcp->tcp_loopback_peer, B_TRUE); 3145 } else if (tcp->tcp_snd_sack_ok) { 3146 sopp->sopp_wroff = connp->conn_ht_iphc_allocated + 3147 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra); 3148 } else { 3149 sopp->sopp_wroff = connp->conn_ht_iphc_len + 3150 (tcp->tcp_loopback ? 0 : tcp->tcp_tcps->tcps_wroff_xtra); 3151 } 3152 3153 if (tcp->tcp_loopback) { 3154 sopp->sopp_flags |= SOCKOPT_LOOPBACK; 3155 sopp->sopp_loopback = B_TRUE; 3156 } 3157 } 3158 3159 /* 3160 * Check the usability of ZEROCOPY. It's instead checking the flag set by IP. 3161 */ 3162 boolean_t 3163 tcp_zcopy_check(tcp_t *tcp) 3164 { 3165 conn_t *connp = tcp->tcp_connp; 3166 ip_xmit_attr_t *ixa = connp->conn_ixa; 3167 boolean_t zc_enabled = B_FALSE; 3168 tcp_stack_t *tcps = tcp->tcp_tcps; 3169 3170 if (do_tcpzcopy == 2) 3171 zc_enabled = B_TRUE; 3172 else if ((do_tcpzcopy == 1) && (ixa->ixa_flags & IXAF_ZCOPY_CAPAB)) 3173 zc_enabled = B_TRUE; 3174 3175 tcp->tcp_snd_zcopy_on = zc_enabled; 3176 if (!TCP_IS_DETACHED(tcp)) { 3177 if (zc_enabled) { 3178 ixa->ixa_flags |= IXAF_VERIFY_ZCOPY; 3179 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3180 ZCVMSAFE); 3181 TCP_STAT(tcps, tcp_zcopy_on); 3182 } else { 3183 ixa->ixa_flags &= ~IXAF_VERIFY_ZCOPY; 3184 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3185 ZCVMUNSAFE); 3186 TCP_STAT(tcps, tcp_zcopy_off); 3187 } 3188 } 3189 return (zc_enabled); 3190 } 3191 3192 /* 3193 * Backoff from a zero-copy message by copying data to a new allocated 3194 * message and freeing the original desballoca'ed segmapped message. 3195 * 3196 * This function is called by following two callers: 3197 * 1. tcp_timer: fix_xmitlist is set to B_TRUE, because it's safe to free 3198 * the origial desballoca'ed message and notify sockfs. This is in re- 3199 * transmit state. 3200 * 2. tcp_output: fix_xmitlist is set to B_FALSE. Flag STRUIO_ZCNOTIFY need 3201 * to be copied to new message. 3202 */ 3203 mblk_t * 3204 tcp_zcopy_backoff(tcp_t *tcp, mblk_t *bp, boolean_t fix_xmitlist) 3205 { 3206 mblk_t *nbp; 3207 mblk_t *head = NULL; 3208 mblk_t *tail = NULL; 3209 tcp_stack_t *tcps = tcp->tcp_tcps; 3210 3211 ASSERT(bp != NULL); 3212 while (bp != NULL) { 3213 if (IS_VMLOANED_MBLK(bp)) { 3214 TCP_STAT(tcps, tcp_zcopy_backoff); 3215 if ((nbp = copyb(bp)) == NULL) { 3216 tcp->tcp_xmit_zc_clean = B_FALSE; 3217 if (tail != NULL) 3218 tail->b_cont = bp; 3219 return ((head == NULL) ? bp : head); 3220 } 3221 3222 if (bp->b_datap->db_struioflag & STRUIO_ZCNOTIFY) { 3223 if (fix_xmitlist) 3224 tcp_zcopy_notify(tcp); 3225 else 3226 nbp->b_datap->db_struioflag |= 3227 STRUIO_ZCNOTIFY; 3228 } 3229 nbp->b_cont = bp->b_cont; 3230 3231 /* 3232 * Copy saved information and adjust tcp_xmit_tail 3233 * if needed. 3234 */ 3235 if (fix_xmitlist) { 3236 nbp->b_prev = bp->b_prev; 3237 nbp->b_next = bp->b_next; 3238 3239 if (tcp->tcp_xmit_tail == bp) 3240 tcp->tcp_xmit_tail = nbp; 3241 } 3242 3243 /* Free the original message. */ 3244 bp->b_prev = NULL; 3245 bp->b_next = NULL; 3246 freeb(bp); 3247 3248 bp = nbp; 3249 } 3250 3251 if (head == NULL) { 3252 head = bp; 3253 } 3254 if (tail == NULL) { 3255 tail = bp; 3256 } else { 3257 tail->b_cont = bp; 3258 tail = bp; 3259 } 3260 3261 /* Move forward. */ 3262 bp = bp->b_cont; 3263 } 3264 3265 if (fix_xmitlist) { 3266 tcp->tcp_xmit_last = tail; 3267 tcp->tcp_xmit_zc_clean = B_TRUE; 3268 } 3269 3270 return (head); 3271 } 3272 3273 void 3274 tcp_zcopy_notify(tcp_t *tcp) 3275 { 3276 struct stdata *stp; 3277 conn_t *connp; 3278 3279 if (tcp->tcp_detached) 3280 return; 3281 connp = tcp->tcp_connp; 3282 if (IPCL_IS_NONSTR(connp)) { 3283 (*connp->conn_upcalls->su_zcopy_notify) 3284 (connp->conn_upper_handle); 3285 return; 3286 } 3287 stp = STREAM(connp->conn_rq); 3288 mutex_enter(&stp->sd_lock); 3289 stp->sd_flag |= STZCNOTIFY; 3290 cv_broadcast(&stp->sd_zcopy_wait); 3291 mutex_exit(&stp->sd_lock); 3292 } 3293 3294 /* 3295 * Update the TCP connection according to change of LSO capability. 3296 */ 3297 static void 3298 tcp_update_lso(tcp_t *tcp, ip_xmit_attr_t *ixa) 3299 { 3300 /* 3301 * We check against IPv4 header length to preserve the old behavior 3302 * of only enabling LSO when there are no IP options. 3303 * But this restriction might not be necessary at all. Before removing 3304 * it, need to verify how LSO is handled for source routing case, with 3305 * which IP does software checksum. 3306 * 3307 * For IPv6, whenever any extension header is needed, LSO is supressed. 3308 */ 3309 if (ixa->ixa_ip_hdr_length != ((ixa->ixa_flags & IXAF_IS_IPV4) ? 3310 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN)) 3311 return; 3312 3313 /* 3314 * Either the LSO capability newly became usable, or it has changed. 3315 */ 3316 if (ixa->ixa_flags & IXAF_LSO_CAPAB) { 3317 ill_lso_capab_t *lsoc = &ixa->ixa_lso_capab; 3318 3319 ASSERT(lsoc->ill_lso_max > 0); 3320 tcp->tcp_lso_max = MIN(TCP_MAX_LSO_LENGTH, lsoc->ill_lso_max); 3321 3322 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3323 boolean_t, B_TRUE, uint32_t, tcp->tcp_lso_max); 3324 3325 /* 3326 * If LSO to be enabled, notify the STREAM header with larger 3327 * data block. 3328 */ 3329 if (!tcp->tcp_lso) 3330 tcp->tcp_maxpsz_multiplier = 0; 3331 3332 tcp->tcp_lso = B_TRUE; 3333 TCP_STAT(tcp->tcp_tcps, tcp_lso_enabled); 3334 } else { /* LSO capability is not usable any more. */ 3335 DTRACE_PROBE3(tcp_update_lso, boolean_t, tcp->tcp_lso, 3336 boolean_t, B_FALSE, uint32_t, tcp->tcp_lso_max); 3337 3338 /* 3339 * If LSO to be disabled, notify the STREAM header with smaller 3340 * data block. And need to restore fragsize to PMTU. 3341 */ 3342 if (tcp->tcp_lso) { 3343 tcp->tcp_maxpsz_multiplier = 3344 tcp->tcp_tcps->tcps_maxpsz_multiplier; 3345 ixa->ixa_fragsize = ixa->ixa_pmtu; 3346 tcp->tcp_lso = B_FALSE; 3347 TCP_STAT(tcp->tcp_tcps, tcp_lso_disabled); 3348 } 3349 } 3350 3351 (void) tcp_maxpsz_set(tcp, B_TRUE); 3352 } 3353 3354 /* 3355 * Update the TCP connection according to change of ZEROCOPY capability. 3356 */ 3357 static void 3358 tcp_update_zcopy(tcp_t *tcp) 3359 { 3360 conn_t *connp = tcp->tcp_connp; 3361 tcp_stack_t *tcps = tcp->tcp_tcps; 3362 3363 if (tcp->tcp_snd_zcopy_on) { 3364 tcp->tcp_snd_zcopy_on = B_FALSE; 3365 if (!TCP_IS_DETACHED(tcp)) { 3366 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3367 ZCVMUNSAFE); 3368 TCP_STAT(tcps, tcp_zcopy_off); 3369 } 3370 } else { 3371 tcp->tcp_snd_zcopy_on = B_TRUE; 3372 if (!TCP_IS_DETACHED(tcp)) { 3373 (void) proto_set_tx_copyopt(connp->conn_rq, connp, 3374 ZCVMSAFE); 3375 TCP_STAT(tcps, tcp_zcopy_on); 3376 } 3377 } 3378 } 3379 3380 /* 3381 * Notify function registered with ip_xmit_attr_t. It's called in the squeue 3382 * so it's safe to update the TCP connection. 3383 */ 3384 /* ARGSUSED1 */ 3385 static void 3386 tcp_notify(void *arg, ip_xmit_attr_t *ixa, ixa_notify_type_t ntype, 3387 ixa_notify_arg_t narg) 3388 { 3389 tcp_t *tcp = (tcp_t *)arg; 3390 conn_t *connp = tcp->tcp_connp; 3391 3392 switch (ntype) { 3393 case IXAN_LSO: 3394 tcp_update_lso(tcp, connp->conn_ixa); 3395 break; 3396 case IXAN_PMTU: 3397 tcp_update_pmtu(tcp, B_FALSE); 3398 break; 3399 case IXAN_ZCOPY: 3400 tcp_update_zcopy(tcp); 3401 break; 3402 default: 3403 break; 3404 } 3405 } 3406 3407 /* 3408 * The TCP write service routine should never be called... 3409 */ 3410 /* ARGSUSED */ 3411 static void 3412 tcp_wsrv(queue_t *q) 3413 { 3414 tcp_stack_t *tcps = Q_TO_TCP(q)->tcp_tcps; 3415 3416 TCP_STAT(tcps, tcp_wsrv_called); 3417 } 3418 3419 /* 3420 * Hash list lookup routine for tcp_t structures. 3421 * Returns with a CONN_INC_REF tcp structure. Caller must do a CONN_DEC_REF. 3422 */ 3423 tcp_t * 3424 tcp_acceptor_hash_lookup(t_uscalar_t id, tcp_stack_t *tcps) 3425 { 3426 tf_t *tf; 3427 tcp_t *tcp; 3428 3429 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 3430 mutex_enter(&tf->tf_lock); 3431 for (tcp = tf->tf_tcp; tcp != NULL; 3432 tcp = tcp->tcp_acceptor_hash) { 3433 if (tcp->tcp_acceptor_id == id) { 3434 CONN_INC_REF(tcp->tcp_connp); 3435 mutex_exit(&tf->tf_lock); 3436 return (tcp); 3437 } 3438 } 3439 mutex_exit(&tf->tf_lock); 3440 return (NULL); 3441 } 3442 3443 /* 3444 * Hash list insertion routine for tcp_t structures. 3445 */ 3446 void 3447 tcp_acceptor_hash_insert(t_uscalar_t id, tcp_t *tcp) 3448 { 3449 tf_t *tf; 3450 tcp_t **tcpp; 3451 tcp_t *tcpnext; 3452 tcp_stack_t *tcps = tcp->tcp_tcps; 3453 3454 tf = &tcps->tcps_acceptor_fanout[TCP_ACCEPTOR_HASH(id)]; 3455 3456 if (tcp->tcp_ptpahn != NULL) 3457 tcp_acceptor_hash_remove(tcp); 3458 tcpp = &tf->tf_tcp; 3459 mutex_enter(&tf->tf_lock); 3460 tcpnext = tcpp[0]; 3461 if (tcpnext) 3462 tcpnext->tcp_ptpahn = &tcp->tcp_acceptor_hash; 3463 tcp->tcp_acceptor_hash = tcpnext; 3464 tcp->tcp_ptpahn = tcpp; 3465 tcpp[0] = tcp; 3466 tcp->tcp_acceptor_lockp = &tf->tf_lock; /* For tcp_*_hash_remove */ 3467 mutex_exit(&tf->tf_lock); 3468 } 3469 3470 /* 3471 * Hash list removal routine for tcp_t structures. 3472 */ 3473 void 3474 tcp_acceptor_hash_remove(tcp_t *tcp) 3475 { 3476 tcp_t *tcpnext; 3477 kmutex_t *lockp; 3478 3479 /* 3480 * Extract the lock pointer in case there are concurrent 3481 * hash_remove's for this instance. 3482 */ 3483 lockp = tcp->tcp_acceptor_lockp; 3484 3485 if (tcp->tcp_ptpahn == NULL) 3486 return; 3487 3488 ASSERT(lockp != NULL); 3489 mutex_enter(lockp); 3490 if (tcp->tcp_ptpahn) { 3491 tcpnext = tcp->tcp_acceptor_hash; 3492 if (tcpnext) { 3493 tcpnext->tcp_ptpahn = tcp->tcp_ptpahn; 3494 tcp->tcp_acceptor_hash = NULL; 3495 } 3496 *tcp->tcp_ptpahn = tcpnext; 3497 tcp->tcp_ptpahn = NULL; 3498 } 3499 mutex_exit(lockp); 3500 tcp->tcp_acceptor_lockp = NULL; 3501 } 3502 3503 /* 3504 * Type three generator adapted from the random() function in 4.4 BSD: 3505 */ 3506 3507 /* 3508 * Copyright (c) 1983, 1993 3509 * The Regents of the University of California. All rights reserved. 3510 * 3511 * Redistribution and use in source and binary forms, with or without 3512 * modification, are permitted provided that the following conditions 3513 * are met: 3514 * 1. Redistributions of source code must retain the above copyright 3515 * notice, this list of conditions and the following disclaimer. 3516 * 2. Redistributions in binary form must reproduce the above copyright 3517 * notice, this list of conditions and the following disclaimer in the 3518 * documentation and/or other materials provided with the distribution. 3519 * 3. All advertising materials mentioning features or use of this software 3520 * must display the following acknowledgement: 3521 * This product includes software developed by the University of 3522 * California, Berkeley and its contributors. 3523 * 4. Neither the name of the University nor the names of its contributors 3524 * may be used to endorse or promote products derived from this software 3525 * without specific prior written permission. 3526 * 3527 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND 3528 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE 3529 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE 3530 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE 3531 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL 3532 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS 3533 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) 3534 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT 3535 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY 3536 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF 3537 * SUCH DAMAGE. 3538 */ 3539 3540 /* Type 3 -- x**31 + x**3 + 1 */ 3541 #define DEG_3 31 3542 #define SEP_3 3 3543 3544 3545 /* Protected by tcp_random_lock */ 3546 static int tcp_randtbl[DEG_3 + 1]; 3547 3548 static int *tcp_random_fptr = &tcp_randtbl[SEP_3 + 1]; 3549 static int *tcp_random_rptr = &tcp_randtbl[1]; 3550 3551 static int *tcp_random_state = &tcp_randtbl[1]; 3552 static int *tcp_random_end_ptr = &tcp_randtbl[DEG_3 + 1]; 3553 3554 kmutex_t tcp_random_lock; 3555 3556 void 3557 tcp_random_init(void) 3558 { 3559 int i; 3560 hrtime_t hrt; 3561 time_t wallclock; 3562 uint64_t result; 3563 3564 /* 3565 * Use high-res timer and current time for seed. Gethrtime() returns 3566 * a longlong, which may contain resolution down to nanoseconds. 3567 * The current time will either be a 32-bit or a 64-bit quantity. 3568 * XOR the two together in a 64-bit result variable. 3569 * Convert the result to a 32-bit value by multiplying the high-order 3570 * 32-bits by the low-order 32-bits. 3571 */ 3572 3573 hrt = gethrtime(); 3574 (void) drv_getparm(TIME, &wallclock); 3575 result = (uint64_t)wallclock ^ (uint64_t)hrt; 3576 mutex_enter(&tcp_random_lock); 3577 tcp_random_state[0] = ((result >> 32) & 0xffffffff) * 3578 (result & 0xffffffff); 3579 3580 for (i = 1; i < DEG_3; i++) 3581 tcp_random_state[i] = 1103515245 * tcp_random_state[i - 1] 3582 + 12345; 3583 tcp_random_fptr = &tcp_random_state[SEP_3]; 3584 tcp_random_rptr = &tcp_random_state[0]; 3585 mutex_exit(&tcp_random_lock); 3586 for (i = 0; i < 10 * DEG_3; i++) 3587 (void) tcp_random(); 3588 } 3589 3590 /* 3591 * tcp_random: Return a random number in the range [1 - (128K + 1)]. 3592 * This range is selected to be approximately centered on TCP_ISS / 2, 3593 * and easy to compute. We get this value by generating a 32-bit random 3594 * number, selecting out the high-order 17 bits, and then adding one so 3595 * that we never return zero. 3596 */ 3597 int 3598 tcp_random(void) 3599 { 3600 int i; 3601 3602 mutex_enter(&tcp_random_lock); 3603 *tcp_random_fptr += *tcp_random_rptr; 3604 3605 /* 3606 * The high-order bits are more random than the low-order bits, 3607 * so we select out the high-order 17 bits and add one so that 3608 * we never return zero. 3609 */ 3610 i = ((*tcp_random_fptr >> 15) & 0x1ffff) + 1; 3611 if (++tcp_random_fptr >= tcp_random_end_ptr) { 3612 tcp_random_fptr = tcp_random_state; 3613 ++tcp_random_rptr; 3614 } else if (++tcp_random_rptr >= tcp_random_end_ptr) 3615 tcp_random_rptr = tcp_random_state; 3616 3617 mutex_exit(&tcp_random_lock); 3618 return (i); 3619 } 3620 3621 /* 3622 * Split this function out so that if the secret changes, I'm okay. 3623 * 3624 * Initialize the tcp_iss_cookie and tcp_iss_key. 3625 */ 3626 3627 #define PASSWD_SIZE 16 /* MUST be multiple of 4 */ 3628 3629 void 3630 tcp_iss_key_init(uint8_t *phrase, int len, tcp_stack_t *tcps) 3631 { 3632 struct { 3633 int32_t current_time; 3634 uint32_t randnum; 3635 uint16_t pad; 3636 uint8_t ether[6]; 3637 uint8_t passwd[PASSWD_SIZE]; 3638 } tcp_iss_cookie; 3639 time_t t; 3640 3641 /* 3642 * Start with the current absolute time. 3643 */ 3644 (void) drv_getparm(TIME, &t); 3645 tcp_iss_cookie.current_time = t; 3646 3647 /* 3648 * XXX - Need a more random number per RFC 1750, not this crap. 3649 * OTOH, if what follows is pretty random, then I'm in better shape. 3650 */ 3651 tcp_iss_cookie.randnum = (uint32_t)(gethrtime() + tcp_random()); 3652 tcp_iss_cookie.pad = 0x365c; /* Picked from HMAC pad values. */ 3653 3654 /* 3655 * The cpu_type_info is pretty non-random. Ugggh. It does serve 3656 * as a good template. 3657 */ 3658 bcopy(&cpu_list->cpu_type_info, &tcp_iss_cookie.passwd, 3659 min(PASSWD_SIZE, sizeof (cpu_list->cpu_type_info))); 3660 3661 /* 3662 * The pass-phrase. Normally this is supplied by user-called NDD. 3663 */ 3664 bcopy(phrase, &tcp_iss_cookie.passwd, min(PASSWD_SIZE, len)); 3665 3666 /* 3667 * See 4010593 if this section becomes a problem again, 3668 * but the local ethernet address is useful here. 3669 */ 3670 (void) localetheraddr(NULL, 3671 (struct ether_addr *)&tcp_iss_cookie.ether); 3672 3673 /* 3674 * Hash 'em all together. The MD5Final is called per-connection. 3675 */ 3676 mutex_enter(&tcps->tcps_iss_key_lock); 3677 MD5Init(&tcps->tcps_iss_key); 3678 MD5Update(&tcps->tcps_iss_key, (uchar_t *)&tcp_iss_cookie, 3679 sizeof (tcp_iss_cookie)); 3680 mutex_exit(&tcps->tcps_iss_key_lock); 3681 } 3682 3683 /* 3684 * Called by IP when IP is loaded into the kernel 3685 */ 3686 void 3687 tcp_ddi_g_init(void) 3688 { 3689 tcp_timercache = kmem_cache_create("tcp_timercache", 3690 sizeof (tcp_timer_t) + sizeof (mblk_t), 0, 3691 NULL, NULL, NULL, NULL, NULL, 0); 3692 3693 tcp_notsack_blk_cache = kmem_cache_create("tcp_notsack_blk_cache", 3694 sizeof (notsack_blk_t), 0, NULL, NULL, NULL, NULL, NULL, 0); 3695 3696 mutex_init(&tcp_random_lock, NULL, MUTEX_DEFAULT, NULL); 3697 3698 /* Initialize the random number generator */ 3699 tcp_random_init(); 3700 3701 /* A single callback independently of how many netstacks we have */ 3702 ip_squeue_init(tcp_squeue_add); 3703 3704 tcp_g_kstat = tcp_g_kstat_init(&tcp_g_statistics); 3705 3706 tcp_squeue_flag = tcp_squeue_switch(tcp_squeue_wput); 3707 3708 /* 3709 * We want to be informed each time a stack is created or 3710 * destroyed in the kernel, so we can maintain the 3711 * set of tcp_stack_t's. 3712 */ 3713 netstack_register(NS_TCP, tcp_stack_init, NULL, tcp_stack_fini); 3714 } 3715 3716 3717 #define INET_NAME "ip" 3718 3719 /* 3720 * Initialize the TCP stack instance. 3721 */ 3722 static void * 3723 tcp_stack_init(netstackid_t stackid, netstack_t *ns) 3724 { 3725 tcp_stack_t *tcps; 3726 int i; 3727 int error = 0; 3728 major_t major; 3729 size_t arrsz; 3730 3731 tcps = (tcp_stack_t *)kmem_zalloc(sizeof (*tcps), KM_SLEEP); 3732 tcps->tcps_netstack = ns; 3733 3734 /* Initialize locks */ 3735 mutex_init(&tcps->tcps_iss_key_lock, NULL, MUTEX_DEFAULT, NULL); 3736 mutex_init(&tcps->tcps_epriv_port_lock, NULL, MUTEX_DEFAULT, NULL); 3737 3738 tcps->tcps_g_num_epriv_ports = TCP_NUM_EPRIV_PORTS; 3739 tcps->tcps_g_epriv_ports[0] = ULP_DEF_EPRIV_PORT1; 3740 tcps->tcps_g_epriv_ports[1] = ULP_DEF_EPRIV_PORT2; 3741 tcps->tcps_min_anonpriv_port = 512; 3742 3743 tcps->tcps_bind_fanout = kmem_zalloc(sizeof (tf_t) * 3744 TCP_BIND_FANOUT_SIZE, KM_SLEEP); 3745 tcps->tcps_acceptor_fanout = kmem_zalloc(sizeof (tf_t) * 3746 TCP_ACCEPTOR_FANOUT_SIZE, KM_SLEEP); 3747 3748 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 3749 mutex_init(&tcps->tcps_bind_fanout[i].tf_lock, NULL, 3750 MUTEX_DEFAULT, NULL); 3751 } 3752 3753 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 3754 mutex_init(&tcps->tcps_acceptor_fanout[i].tf_lock, NULL, 3755 MUTEX_DEFAULT, NULL); 3756 } 3757 3758 /* TCP's IPsec code calls the packet dropper. */ 3759 ip_drop_register(&tcps->tcps_dropper, "TCP IPsec policy enforcement"); 3760 3761 arrsz = tcp_propinfo_count * sizeof (mod_prop_info_t); 3762 tcps->tcps_propinfo_tbl = (mod_prop_info_t *)kmem_alloc(arrsz, 3763 KM_SLEEP); 3764 bcopy(tcp_propinfo_tbl, tcps->tcps_propinfo_tbl, arrsz); 3765 3766 /* 3767 * Note: To really walk the device tree you need the devinfo 3768 * pointer to your device which is only available after probe/attach. 3769 * The following is safe only because it uses ddi_root_node() 3770 */ 3771 tcp_max_optsize = optcom_max_optsize(tcp_opt_obj.odb_opt_des_arr, 3772 tcp_opt_obj.odb_opt_arr_cnt); 3773 3774 /* 3775 * Initialize RFC 1948 secret values. This will probably be reset once 3776 * by the boot scripts. 3777 * 3778 * Use NULL name, as the name is caught by the new lockstats. 3779 * 3780 * Initialize with some random, non-guessable string, like the global 3781 * T_INFO_ACK. 3782 */ 3783 3784 tcp_iss_key_init((uint8_t *)&tcp_g_t_info_ack, 3785 sizeof (tcp_g_t_info_ack), tcps); 3786 3787 tcps->tcps_kstat = tcp_kstat2_init(stackid); 3788 tcps->tcps_mibkp = tcp_kstat_init(stackid); 3789 3790 major = mod_name_to_major(INET_NAME); 3791 error = ldi_ident_from_major(major, &tcps->tcps_ldi_ident); 3792 ASSERT(error == 0); 3793 tcps->tcps_ixa_cleanup_mp = allocb_wait(0, BPRI_MED, STR_NOSIG, NULL); 3794 ASSERT(tcps->tcps_ixa_cleanup_mp != NULL); 3795 cv_init(&tcps->tcps_ixa_cleanup_cv, NULL, CV_DEFAULT, NULL); 3796 mutex_init(&tcps->tcps_ixa_cleanup_lock, NULL, MUTEX_DEFAULT, NULL); 3797 3798 mutex_init(&tcps->tcps_reclaim_lock, NULL, MUTEX_DEFAULT, NULL); 3799 tcps->tcps_reclaim = B_FALSE; 3800 tcps->tcps_reclaim_tid = 0; 3801 tcps->tcps_reclaim_period = tcps->tcps_rexmit_interval_max; 3802 3803 /* 3804 * ncpus is the current number of CPUs, which can be bigger than 3805 * boot_ncpus. But we don't want to use ncpus to allocate all the 3806 * tcp_stats_cpu_t at system boot up time since it will be 1. While 3807 * we handle adding CPU in tcp_cpu_update(), it will be slow if 3808 * there are many CPUs as we will be adding them 1 by 1. 3809 * 3810 * Note that tcps_sc_cnt never decreases and the tcps_sc[x] pointers 3811 * are not freed until the stack is going away. So there is no need 3812 * to grab a lock to access the per CPU tcps_sc[x] pointer. 3813 */ 3814 mutex_enter(&cpu_lock); 3815 tcps->tcps_sc_cnt = MAX(ncpus, boot_ncpus); 3816 mutex_exit(&cpu_lock); 3817 tcps->tcps_sc = kmem_zalloc(max_ncpus * sizeof (tcp_stats_cpu_t *), 3818 KM_SLEEP); 3819 for (i = 0; i < tcps->tcps_sc_cnt; i++) { 3820 tcps->tcps_sc[i] = kmem_zalloc(sizeof (tcp_stats_cpu_t), 3821 KM_SLEEP); 3822 } 3823 3824 mutex_init(&tcps->tcps_listener_conf_lock, NULL, MUTEX_DEFAULT, NULL); 3825 list_create(&tcps->tcps_listener_conf, sizeof (tcp_listener_t), 3826 offsetof(tcp_listener_t, tl_link)); 3827 3828 return (tcps); 3829 } 3830 3831 /* 3832 * Called when the IP module is about to be unloaded. 3833 */ 3834 void 3835 tcp_ddi_g_destroy(void) 3836 { 3837 tcp_g_kstat_fini(tcp_g_kstat); 3838 tcp_g_kstat = NULL; 3839 bzero(&tcp_g_statistics, sizeof (tcp_g_statistics)); 3840 3841 mutex_destroy(&tcp_random_lock); 3842 3843 kmem_cache_destroy(tcp_timercache); 3844 kmem_cache_destroy(tcp_notsack_blk_cache); 3845 3846 netstack_unregister(NS_TCP); 3847 } 3848 3849 /* 3850 * Free the TCP stack instance. 3851 */ 3852 static void 3853 tcp_stack_fini(netstackid_t stackid, void *arg) 3854 { 3855 tcp_stack_t *tcps = (tcp_stack_t *)arg; 3856 int i; 3857 3858 freeb(tcps->tcps_ixa_cleanup_mp); 3859 tcps->tcps_ixa_cleanup_mp = NULL; 3860 cv_destroy(&tcps->tcps_ixa_cleanup_cv); 3861 mutex_destroy(&tcps->tcps_ixa_cleanup_lock); 3862 3863 /* 3864 * Set tcps_reclaim to false tells tcp_reclaim_timer() not to restart 3865 * the timer. 3866 */ 3867 mutex_enter(&tcps->tcps_reclaim_lock); 3868 tcps->tcps_reclaim = B_FALSE; 3869 mutex_exit(&tcps->tcps_reclaim_lock); 3870 if (tcps->tcps_reclaim_tid != 0) 3871 (void) untimeout(tcps->tcps_reclaim_tid); 3872 mutex_destroy(&tcps->tcps_reclaim_lock); 3873 3874 tcp_listener_conf_cleanup(tcps); 3875 3876 for (i = 0; i < tcps->tcps_sc_cnt; i++) 3877 kmem_free(tcps->tcps_sc[i], sizeof (tcp_stats_cpu_t)); 3878 kmem_free(tcps->tcps_sc, max_ncpus * sizeof (tcp_stats_cpu_t *)); 3879 3880 kmem_free(tcps->tcps_propinfo_tbl, 3881 tcp_propinfo_count * sizeof (mod_prop_info_t)); 3882 tcps->tcps_propinfo_tbl = NULL; 3883 3884 for (i = 0; i < TCP_BIND_FANOUT_SIZE; i++) { 3885 ASSERT(tcps->tcps_bind_fanout[i].tf_tcp == NULL); 3886 mutex_destroy(&tcps->tcps_bind_fanout[i].tf_lock); 3887 } 3888 3889 for (i = 0; i < TCP_ACCEPTOR_FANOUT_SIZE; i++) { 3890 ASSERT(tcps->tcps_acceptor_fanout[i].tf_tcp == NULL); 3891 mutex_destroy(&tcps->tcps_acceptor_fanout[i].tf_lock); 3892 } 3893 3894 kmem_free(tcps->tcps_bind_fanout, sizeof (tf_t) * TCP_BIND_FANOUT_SIZE); 3895 tcps->tcps_bind_fanout = NULL; 3896 3897 kmem_free(tcps->tcps_acceptor_fanout, sizeof (tf_t) * 3898 TCP_ACCEPTOR_FANOUT_SIZE); 3899 tcps->tcps_acceptor_fanout = NULL; 3900 3901 mutex_destroy(&tcps->tcps_iss_key_lock); 3902 mutex_destroy(&tcps->tcps_epriv_port_lock); 3903 3904 ip_drop_unregister(&tcps->tcps_dropper); 3905 3906 tcp_kstat2_fini(stackid, tcps->tcps_kstat); 3907 tcps->tcps_kstat = NULL; 3908 3909 tcp_kstat_fini(stackid, tcps->tcps_mibkp); 3910 tcps->tcps_mibkp = NULL; 3911 3912 ldi_ident_release(tcps->tcps_ldi_ident); 3913 kmem_free(tcps, sizeof (*tcps)); 3914 } 3915 3916 /* 3917 * Generate ISS, taking into account NDD changes may happen halfway through. 3918 * (If the iss is not zero, set it.) 3919 */ 3920 3921 static void 3922 tcp_iss_init(tcp_t *tcp) 3923 { 3924 MD5_CTX context; 3925 struct { uint32_t ports; in6_addr_t src; in6_addr_t dst; } arg; 3926 uint32_t answer[4]; 3927 tcp_stack_t *tcps = tcp->tcp_tcps; 3928 conn_t *connp = tcp->tcp_connp; 3929 3930 tcps->tcps_iss_incr_extra += (tcps->tcps_iss_incr >> 1); 3931 tcp->tcp_iss = tcps->tcps_iss_incr_extra; 3932 switch (tcps->tcps_strong_iss) { 3933 case 2: 3934 mutex_enter(&tcps->tcps_iss_key_lock); 3935 context = tcps->tcps_iss_key; 3936 mutex_exit(&tcps->tcps_iss_key_lock); 3937 arg.ports = connp->conn_ports; 3938 arg.src = connp->conn_laddr_v6; 3939 arg.dst = connp->conn_faddr_v6; 3940 MD5Update(&context, (uchar_t *)&arg, sizeof (arg)); 3941 MD5Final((uchar_t *)answer, &context); 3942 tcp->tcp_iss += answer[0] ^ answer[1] ^ answer[2] ^ answer[3]; 3943 /* 3944 * Now that we've hashed into a unique per-connection sequence 3945 * space, add a random increment per strong_iss == 1. So I 3946 * guess we'll have to... 3947 */ 3948 /* FALLTHRU */ 3949 case 1: 3950 tcp->tcp_iss += (gethrtime() >> ISS_NSEC_SHT) + tcp_random(); 3951 break; 3952 default: 3953 tcp->tcp_iss += (uint32_t)gethrestime_sec() * 3954 tcps->tcps_iss_incr; 3955 break; 3956 } 3957 tcp->tcp_valid_bits = TCP_ISS_VALID; 3958 tcp->tcp_fss = tcp->tcp_iss - 1; 3959 tcp->tcp_suna = tcp->tcp_iss; 3960 tcp->tcp_snxt = tcp->tcp_iss + 1; 3961 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 3962 tcp->tcp_csuna = tcp->tcp_snxt; 3963 } 3964 3965 /* 3966 * tcp_{set,clr}qfull() functions are used to either set or clear QFULL 3967 * on the specified backing STREAMS q. Note, the caller may make the 3968 * decision to call based on the tcp_t.tcp_flow_stopped value which 3969 * when check outside the q's lock is only an advisory check ... 3970 */ 3971 void 3972 tcp_setqfull(tcp_t *tcp) 3973 { 3974 tcp_stack_t *tcps = tcp->tcp_tcps; 3975 conn_t *connp = tcp->tcp_connp; 3976 3977 if (tcp->tcp_closed) 3978 return; 3979 3980 conn_setqfull(connp, &tcp->tcp_flow_stopped); 3981 if (tcp->tcp_flow_stopped) 3982 TCP_STAT(tcps, tcp_flwctl_on); 3983 } 3984 3985 void 3986 tcp_clrqfull(tcp_t *tcp) 3987 { 3988 conn_t *connp = tcp->tcp_connp; 3989 3990 if (tcp->tcp_closed) 3991 return; 3992 conn_clrqfull(connp, &tcp->tcp_flow_stopped); 3993 } 3994 3995 static int 3996 tcp_squeue_switch(int val) 3997 { 3998 int rval = SQ_FILL; 3999 4000 switch (val) { 4001 case 1: 4002 rval = SQ_NODRAIN; 4003 break; 4004 case 2: 4005 rval = SQ_PROCESS; 4006 break; 4007 default: 4008 break; 4009 } 4010 return (rval); 4011 } 4012 4013 /* 4014 * This is called once for each squeue - globally for all stack 4015 * instances. 4016 */ 4017 static void 4018 tcp_squeue_add(squeue_t *sqp) 4019 { 4020 tcp_squeue_priv_t *tcp_time_wait = kmem_zalloc( 4021 sizeof (tcp_squeue_priv_t), KM_SLEEP); 4022 4023 *squeue_getprivate(sqp, SQPRIVATE_TCP) = (intptr_t)tcp_time_wait; 4024 if (tcp_free_list_max_cnt == 0) { 4025 int tcp_ncpus = ((boot_max_ncpus == -1) ? 4026 max_ncpus : boot_max_ncpus); 4027 4028 /* 4029 * Limit number of entries to 1% of availble memory / tcp_ncpus 4030 */ 4031 tcp_free_list_max_cnt = (freemem * PAGESIZE) / 4032 (tcp_ncpus * sizeof (tcp_t) * 100); 4033 } 4034 tcp_time_wait->tcp_free_list_cnt = 0; 4035 } 4036 /* 4037 * Return unix error is tli error is TSYSERR, otherwise return a negative 4038 * tli error. 4039 */ 4040 int 4041 tcp_do_bind(conn_t *connp, struct sockaddr *sa, socklen_t len, cred_t *cr, 4042 boolean_t bind_to_req_port_only) 4043 { 4044 int error; 4045 tcp_t *tcp = connp->conn_tcp; 4046 4047 if (tcp->tcp_state >= TCPS_BOUND) { 4048 if (connp->conn_debug) { 4049 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4050 "tcp_bind: bad state, %d", tcp->tcp_state); 4051 } 4052 return (-TOUTSTATE); 4053 } 4054 4055 error = tcp_bind_check(connp, sa, len, cr, bind_to_req_port_only); 4056 if (error != 0) 4057 return (error); 4058 4059 ASSERT(tcp->tcp_state == TCPS_BOUND); 4060 tcp->tcp_conn_req_max = 0; 4061 return (0); 4062 } 4063 4064 /* 4065 * If the return value from this function is positive, it's a UNIX error. 4066 * Otherwise, if it's negative, then the absolute value is a TLI error. 4067 * the TPI routine tcp_tpi_connect() is a wrapper function for this. 4068 */ 4069 int 4070 tcp_do_connect(conn_t *connp, const struct sockaddr *sa, socklen_t len, 4071 cred_t *cr, pid_t pid) 4072 { 4073 tcp_t *tcp = connp->conn_tcp; 4074 sin_t *sin = (sin_t *)sa; 4075 sin6_t *sin6 = (sin6_t *)sa; 4076 ipaddr_t *dstaddrp; 4077 in_port_t dstport; 4078 uint_t srcid; 4079 int error; 4080 uint32_t mss; 4081 mblk_t *syn_mp; 4082 tcp_stack_t *tcps = tcp->tcp_tcps; 4083 int32_t oldstate; 4084 ip_xmit_attr_t *ixa = connp->conn_ixa; 4085 4086 oldstate = tcp->tcp_state; 4087 4088 switch (len) { 4089 default: 4090 /* 4091 * Should never happen 4092 */ 4093 return (EINVAL); 4094 4095 case sizeof (sin_t): 4096 sin = (sin_t *)sa; 4097 if (sin->sin_port == 0) { 4098 return (-TBADADDR); 4099 } 4100 if (connp->conn_ipv6_v6only) { 4101 return (EAFNOSUPPORT); 4102 } 4103 break; 4104 4105 case sizeof (sin6_t): 4106 sin6 = (sin6_t *)sa; 4107 if (sin6->sin6_port == 0) { 4108 return (-TBADADDR); 4109 } 4110 break; 4111 } 4112 /* 4113 * If we're connecting to an IPv4-mapped IPv6 address, we need to 4114 * make sure that the conn_ipversion is IPV4_VERSION. We 4115 * need to this before we call tcp_bindi() so that the port lookup 4116 * code will look for ports in the correct port space (IPv4 and 4117 * IPv6 have separate port spaces). 4118 */ 4119 if (connp->conn_family == AF_INET6 && 4120 connp->conn_ipversion == IPV6_VERSION && 4121 IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4122 if (connp->conn_ipv6_v6only) 4123 return (EADDRNOTAVAIL); 4124 4125 connp->conn_ipversion = IPV4_VERSION; 4126 } 4127 4128 switch (tcp->tcp_state) { 4129 case TCPS_LISTEN: 4130 /* 4131 * Listening sockets are not allowed to issue connect(). 4132 */ 4133 if (IPCL_IS_NONSTR(connp)) 4134 return (EOPNOTSUPP); 4135 /* FALLTHRU */ 4136 case TCPS_IDLE: 4137 /* 4138 * We support quick connect, refer to comments in 4139 * tcp_connect_*() 4140 */ 4141 /* FALLTHRU */ 4142 case TCPS_BOUND: 4143 break; 4144 default: 4145 return (-TOUTSTATE); 4146 } 4147 4148 /* 4149 * We update our cred/cpid based on the caller of connect 4150 */ 4151 if (connp->conn_cred != cr) { 4152 crhold(cr); 4153 crfree(connp->conn_cred); 4154 connp->conn_cred = cr; 4155 } 4156 connp->conn_cpid = pid; 4157 4158 /* Cache things in the ixa without any refhold */ 4159 ASSERT(!(ixa->ixa_free_flags & IXA_FREE_CRED)); 4160 ixa->ixa_cred = cr; 4161 ixa->ixa_cpid = pid; 4162 if (is_system_labeled()) { 4163 /* We need to restart with a label based on the cred */ 4164 ip_xmit_attr_restore_tsl(ixa, ixa->ixa_cred); 4165 } 4166 4167 if (connp->conn_family == AF_INET6) { 4168 if (!IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) { 4169 error = tcp_connect_ipv6(tcp, &sin6->sin6_addr, 4170 sin6->sin6_port, sin6->sin6_flowinfo, 4171 sin6->__sin6_src_id, sin6->sin6_scope_id); 4172 } else { 4173 /* 4174 * Destination adress is mapped IPv6 address. 4175 * Source bound address should be unspecified or 4176 * IPv6 mapped address as well. 4177 */ 4178 if (!IN6_IS_ADDR_UNSPECIFIED( 4179 &connp->conn_bound_addr_v6) && 4180 !IN6_IS_ADDR_V4MAPPED(&connp->conn_bound_addr_v6)) { 4181 return (EADDRNOTAVAIL); 4182 } 4183 dstaddrp = &V4_PART_OF_V6((sin6->sin6_addr)); 4184 dstport = sin6->sin6_port; 4185 srcid = sin6->__sin6_src_id; 4186 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, 4187 srcid); 4188 } 4189 } else { 4190 dstaddrp = &sin->sin_addr.s_addr; 4191 dstport = sin->sin_port; 4192 srcid = 0; 4193 error = tcp_connect_ipv4(tcp, dstaddrp, dstport, srcid); 4194 } 4195 4196 if (error != 0) 4197 goto connect_failed; 4198 4199 CL_INET_CONNECT(connp, B_TRUE, error); 4200 if (error != 0) 4201 goto connect_failed; 4202 4203 /* connect succeeded */ 4204 TCPS_BUMP_MIB(tcps, tcpActiveOpens); 4205 tcp->tcp_active_open = 1; 4206 4207 /* 4208 * tcp_set_destination() does not adjust for TCP/IP header length. 4209 */ 4210 mss = tcp->tcp_mss - connp->conn_ht_iphc_len; 4211 4212 /* 4213 * Just make sure our rwnd is at least rcvbuf * MSS large, and round up 4214 * to the nearest MSS. 4215 * 4216 * We do the round up here because we need to get the interface MTU 4217 * first before we can do the round up. 4218 */ 4219 tcp->tcp_rwnd = connp->conn_rcvbuf; 4220 tcp->tcp_rwnd = MAX(MSS_ROUNDUP(tcp->tcp_rwnd, mss), 4221 tcps->tcps_recv_hiwat_minmss * mss); 4222 connp->conn_rcvbuf = tcp->tcp_rwnd; 4223 tcp_set_ws_value(tcp); 4224 tcp->tcp_tcpha->tha_win = htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 4225 if (tcp->tcp_rcv_ws > 0 || tcps->tcps_wscale_always) 4226 tcp->tcp_snd_ws_ok = B_TRUE; 4227 4228 /* 4229 * Set tcp_snd_ts_ok to true 4230 * so that tcp_xmit_mp will 4231 * include the timestamp 4232 * option in the SYN segment. 4233 */ 4234 if (tcps->tcps_tstamp_always || 4235 (tcp->tcp_rcv_ws && tcps->tcps_tstamp_if_wscale)) { 4236 tcp->tcp_snd_ts_ok = B_TRUE; 4237 } 4238 4239 /* 4240 * Note that tcp_snd_sack_ok can be set in tcp_set_destination() if 4241 * the SACK metric is set. So here we just check the per stack SACK 4242 * permitted param. 4243 */ 4244 if (tcps->tcps_sack_permitted == 2) { 4245 ASSERT(tcp->tcp_num_sack_blk == 0); 4246 ASSERT(tcp->tcp_notsack_list == NULL); 4247 tcp->tcp_snd_sack_ok = B_TRUE; 4248 } 4249 4250 /* 4251 * Should we use ECN? Note that the current 4252 * default value (SunOS 5.9) of tcp_ecn_permitted 4253 * is 1. The reason for doing this is that there 4254 * are equipments out there that will drop ECN 4255 * enabled IP packets. Setting it to 1 avoids 4256 * compatibility problems. 4257 */ 4258 if (tcps->tcps_ecn_permitted == 2) 4259 tcp->tcp_ecn_ok = B_TRUE; 4260 4261 /* Trace change from BOUND -> SYN_SENT here */ 4262 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4263 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 4264 int32_t, TCPS_BOUND); 4265 4266 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4267 syn_mp = tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, 4268 tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 4269 if (syn_mp != NULL) { 4270 /* 4271 * We must bump the generation before sending the syn 4272 * to ensure that we use the right generation in case 4273 * this thread issues a "connected" up call. 4274 */ 4275 SOCK_CONNID_BUMP(tcp->tcp_connid); 4276 /* 4277 * DTrace sending the first SYN as a 4278 * tcp:::connect-request event. 4279 */ 4280 DTRACE_TCP5(connect__request, mblk_t *, NULL, 4281 ip_xmit_attr_t *, connp->conn_ixa, 4282 void_ip_t *, syn_mp->b_rptr, tcp_t *, tcp, 4283 tcph_t *, 4284 &syn_mp->b_rptr[connp->conn_ixa->ixa_ip_hdr_length]); 4285 tcp_send_data(tcp, syn_mp); 4286 } 4287 4288 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4289 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4290 return (0); 4291 4292 connect_failed: 4293 connp->conn_faddr_v6 = ipv6_all_zeros; 4294 connp->conn_fport = 0; 4295 tcp->tcp_state = oldstate; 4296 if (tcp->tcp_conn.tcp_opts_conn_req != NULL) 4297 tcp_close_mpp(&tcp->tcp_conn.tcp_opts_conn_req); 4298 return (error); 4299 } 4300 4301 int 4302 tcp_do_listen(conn_t *connp, struct sockaddr *sa, socklen_t len, 4303 int backlog, cred_t *cr, boolean_t bind_to_req_port_only) 4304 { 4305 tcp_t *tcp = connp->conn_tcp; 4306 int error = 0; 4307 tcp_stack_t *tcps = tcp->tcp_tcps; 4308 int32_t oldstate; 4309 4310 /* All Solaris components should pass a cred for this operation. */ 4311 ASSERT(cr != NULL); 4312 4313 if (tcp->tcp_state >= TCPS_BOUND) { 4314 if ((tcp->tcp_state == TCPS_BOUND || 4315 tcp->tcp_state == TCPS_LISTEN) && backlog > 0) { 4316 /* 4317 * Handle listen() increasing backlog. 4318 * This is more "liberal" then what the TPI spec 4319 * requires but is needed to avoid a t_unbind 4320 * when handling listen() since the port number 4321 * might be "stolen" between the unbind and bind. 4322 */ 4323 goto do_listen; 4324 } 4325 if (connp->conn_debug) { 4326 (void) strlog(TCP_MOD_ID, 0, 1, SL_ERROR|SL_TRACE, 4327 "tcp_listen: bad state, %d", tcp->tcp_state); 4328 } 4329 return (-TOUTSTATE); 4330 } else { 4331 if (sa == NULL) { 4332 sin6_t addr; 4333 sin_t *sin; 4334 sin6_t *sin6; 4335 4336 ASSERT(IPCL_IS_NONSTR(connp)); 4337 /* Do an implicit bind: Request for a generic port. */ 4338 if (connp->conn_family == AF_INET) { 4339 len = sizeof (sin_t); 4340 sin = (sin_t *)&addr; 4341 *sin = sin_null; 4342 sin->sin_family = AF_INET; 4343 } else { 4344 ASSERT(connp->conn_family == AF_INET6); 4345 len = sizeof (sin6_t); 4346 sin6 = (sin6_t *)&addr; 4347 *sin6 = sin6_null; 4348 sin6->sin6_family = AF_INET6; 4349 } 4350 sa = (struct sockaddr *)&addr; 4351 } 4352 4353 error = tcp_bind_check(connp, sa, len, cr, 4354 bind_to_req_port_only); 4355 if (error) 4356 return (error); 4357 /* Fall through and do the fanout insertion */ 4358 } 4359 4360 do_listen: 4361 ASSERT(tcp->tcp_state == TCPS_BOUND || tcp->tcp_state == TCPS_LISTEN); 4362 tcp->tcp_conn_req_max = backlog; 4363 if (tcp->tcp_conn_req_max) { 4364 if (tcp->tcp_conn_req_max < tcps->tcps_conn_req_min) 4365 tcp->tcp_conn_req_max = tcps->tcps_conn_req_min; 4366 if (tcp->tcp_conn_req_max > tcps->tcps_conn_req_max_q) 4367 tcp->tcp_conn_req_max = tcps->tcps_conn_req_max_q; 4368 /* 4369 * If this is a listener, do not reset the eager list 4370 * and other stuffs. Note that we don't check if the 4371 * existing eager list meets the new tcp_conn_req_max 4372 * requirement. 4373 */ 4374 if (tcp->tcp_state != TCPS_LISTEN) { 4375 tcp->tcp_state = TCPS_LISTEN; 4376 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4377 connp->conn_ixa, void, NULL, tcp_t *, tcp, 4378 void, NULL, int32_t, TCPS_BOUND); 4379 /* Initialize the chain. Don't need the eager_lock */ 4380 tcp->tcp_eager_next_q0 = tcp->tcp_eager_prev_q0 = tcp; 4381 tcp->tcp_eager_next_drop_q0 = tcp; 4382 tcp->tcp_eager_prev_drop_q0 = tcp; 4383 tcp->tcp_second_ctimer_threshold = 4384 tcps->tcps_ip_abort_linterval; 4385 } 4386 } 4387 4388 /* 4389 * We need to make sure that the conn_recv is set to a non-null 4390 * value before we insert the conn into the classifier table. 4391 * This is to avoid a race with an incoming packet which does an 4392 * ipcl_classify(). 4393 * We initially set it to tcp_input_listener_unbound to try to 4394 * pick a good squeue for the listener when the first SYN arrives. 4395 * tcp_input_listener_unbound sets it to tcp_input_listener on that 4396 * first SYN. 4397 */ 4398 connp->conn_recv = tcp_input_listener_unbound; 4399 4400 /* Insert the listener in the classifier table */ 4401 error = ip_laddr_fanout_insert(connp); 4402 if (error != 0) { 4403 /* Undo the bind - release the port number */ 4404 oldstate = tcp->tcp_state; 4405 tcp->tcp_state = TCPS_IDLE; 4406 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 4407 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 4408 int32_t, oldstate); 4409 connp->conn_bound_addr_v6 = ipv6_all_zeros; 4410 4411 connp->conn_laddr_v6 = ipv6_all_zeros; 4412 connp->conn_saddr_v6 = ipv6_all_zeros; 4413 connp->conn_ports = 0; 4414 4415 if (connp->conn_anon_port) { 4416 zone_t *zone; 4417 4418 zone = crgetzone(cr); 4419 connp->conn_anon_port = B_FALSE; 4420 (void) tsol_mlp_anon(zone, connp->conn_mlp_type, 4421 connp->conn_proto, connp->conn_lport, B_FALSE); 4422 } 4423 connp->conn_mlp_type = mlptSingle; 4424 4425 tcp_bind_hash_remove(tcp); 4426 return (error); 4427 } else { 4428 /* 4429 * If there is a connection limit, allocate and initialize 4430 * the counter struct. Note that since listen can be called 4431 * multiple times, the struct may have been allready allocated. 4432 */ 4433 if (!list_is_empty(&tcps->tcps_listener_conf) && 4434 tcp->tcp_listen_cnt == NULL) { 4435 tcp_listen_cnt_t *tlc; 4436 uint32_t ratio; 4437 4438 ratio = tcp_find_listener_conf(tcps, 4439 ntohs(connp->conn_lport)); 4440 if (ratio != 0) { 4441 uint32_t mem_ratio, tot_buf; 4442 4443 tlc = kmem_alloc(sizeof (tcp_listen_cnt_t), 4444 KM_SLEEP); 4445 /* 4446 * Calculate the connection limit based on 4447 * the configured ratio and maxusers. Maxusers 4448 * are calculated based on memory size, 4449 * ~ 1 user per MB. Note that the conn_rcvbuf 4450 * and conn_sndbuf may change after a 4451 * connection is accepted. So what we have 4452 * is only an approximation. 4453 */ 4454 if ((tot_buf = connp->conn_rcvbuf + 4455 connp->conn_sndbuf) < MB) { 4456 mem_ratio = MB / tot_buf; 4457 tlc->tlc_max = maxusers / ratio * 4458 mem_ratio; 4459 } else { 4460 mem_ratio = tot_buf / MB; 4461 tlc->tlc_max = maxusers / ratio / 4462 mem_ratio; 4463 } 4464 /* At least we should allow two connections! */ 4465 if (tlc->tlc_max <= tcp_min_conn_listener) 4466 tlc->tlc_max = tcp_min_conn_listener; 4467 tlc->tlc_cnt = 1; 4468 tlc->tlc_drop = 0; 4469 tcp->tcp_listen_cnt = tlc; 4470 } 4471 } 4472 } 4473 return (error); 4474 }