1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22 /*
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright 2019 Joyent, Inc.
26 * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
27 * Copyright 2020 OmniOS Community Edition (OmniOSce) Association.
28 */
29
30 /* This file contains all TCP input processing functions. */
31
32 #include <sys/types.h>
33 #include <sys/stream.h>
34 #include <sys/strsun.h>
35 #include <sys/strsubr.h>
36 #include <sys/stropts.h>
37 #include <sys/strlog.h>
38 #define _SUN_TPI_VERSION 2
39 #include <sys/tihdr.h>
40 #include <sys/suntpi.h>
41 #include <sys/xti_inet.h>
42 #include <sys/squeue_impl.h>
43 #include <sys/squeue.h>
44 #include <sys/tsol/tnet.h>
45
46 #include <inet/common.h>
47 #include <inet/ip.h>
48 #include <inet/tcp.h>
49 #include <inet/tcp_impl.h>
50 #include <inet/tcp_cluster.h>
51 #include <inet/proto_set.h>
52 #include <inet/ipsec_impl.h>
53
54 /*
55 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
56 */
57
58 #ifdef _BIG_ENDIAN
59 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
60 (TCPOPT_TSTAMP << 8) | 10)
61 #else
62 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
63 (TCPOPT_NOP << 8) | TCPOPT_NOP)
64 #endif
65
66 /*
67 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
68 */
69 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
70
71 /*
72 * Since tcp_listener is not cleared atomically with tcp_detached
73 * being cleared we need this extra bit to tell a detached connection
74 * apart from one that is in the process of being accepted.
75 */
76 #define TCP_IS_DETACHED_NONEAGER(tcp) \
77 (TCP_IS_DETACHED(tcp) && \
78 (!(tcp)->tcp_hard_binding))
79
80 /*
81 * Steps to do when a tcp_t moves to TIME-WAIT state.
82 *
83 * This connection is done, we don't need to account for it. Decrement
84 * the listener connection counter if needed.
85 *
86 * Decrement the connection counter of the stack. Note that this counter
87 * is per CPU. So the total number of connections in a stack is the sum of all
88 * of them. Since there is no lock for handling all of them exclusively, the
89 * resulting sum is only an approximation.
90 *
91 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
92 * connection won't interfere with new ones.
93 *
94 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
95 * the timer is handled within the context of this tcp_t. When the timer
96 * fires, tcp_clean_death() is called. If upper layer closes the connection
97 * during this period, tcp_time_wait_append() will be called to add this
98 * tcp_t to the global TIME-WAIT list. Note that this means that the
99 * actual wait time in TIME-WAIT state will be longer than the
100 * tcps_time_wait_interval since the period before upper layer closes the
101 * connection is not accounted for when tcp_time_wait_append() is called.
102 *
103 * If upper layer has closed the connection, call tcp_time_wait_append()
104 * directly.
105 *
106 */
107 #define SET_TIME_WAIT(tcps, tcp, connp) \
108 { \
109 (tcp)->tcp_state = TCPS_TIME_WAIT; \
110 if ((tcp)->tcp_listen_cnt != NULL) \
111 TCP_DECR_LISTEN_CNT(tcp); \
112 atomic_dec_64( \
113 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
114 (connp)->conn_exclbind = 0; \
115 if (!TCP_IS_DETACHED(tcp)) { \
116 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
117 } else { \
118 tcp_time_wait_append(tcp); \
119 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
120 } \
121 }
122
123 /*
124 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
125 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
126 * data, TCP will not respond with an ACK. RFC 793 requires that
127 * TCP responds with an ACK for such a bogus ACK. By not following
128 * the RFC, we prevent TCP from getting into an ACK storm if somehow
129 * an attacker successfully spoofs an acceptable segment to our
130 * peer; or when our peer is "confused."
131 */
132 static uint32_t tcp_drop_ack_unsent_cnt = 10;
133
134 /*
135 * To protect TCP against attacker using a small window and requesting
136 * large amount of data (DoS attack by conuming memory), TCP checks the
137 * window advertised in the last ACK of the 3-way handshake. TCP uses
138 * the tcp_mss (the size of one packet) value for comparion. The window
139 * should be larger than tcp_mss. But while a sane TCP should advertise
140 * a receive window larger than or equal to 4*MSS to avoid stop and go
141 * tarrfic, not all TCP stacks do that. This is especially true when
142 * tcp_mss is a big value.
143 *
144 * To work around this issue, an additional fixed value for comparison
145 * is also used. If the advertised window is smaller than both tcp_mss
146 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
147 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
148 * smaller than 8K is considered to be OK.
149 */
150 static uint32_t tcp_init_wnd_chk = 4096;
151
152 /* Process ICMP source quench message or not. */
153 static boolean_t tcp_icmp_source_quench = B_FALSE;
154
155 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
156
157 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
158 ip_recv_attr_t *);
159 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
160 ip_recv_attr_t *);
161 static boolean_t tcp_drop_q0(tcp_t *);
162 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
163 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
164 ip_recv_attr_t *);
165 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
166 static void tcp_process_options(tcp_t *, tcpha_t *);
167 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
168 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
169 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
170 static void tcp_set_rto(tcp_t *, hrtime_t);
171 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
172
173 /*
174 * CC wrapper hook functions
175 */
176 static void
177 cc_ack_received(tcp_t *tcp, uint32_t seg_ack, int32_t bytes_acked,
178 uint16_t type)
179 {
180 uint32_t old_cwnd = tcp->tcp_cwnd;
181
182 tcp->tcp_ccv.bytes_this_ack = bytes_acked;
183 if (tcp->tcp_cwnd <= tcp->tcp_swnd)
184 tcp->tcp_ccv.flags |= CCF_CWND_LIMITED;
185 else
186 tcp->tcp_ccv.flags &= ~CCF_CWND_LIMITED;
187
188 if (type == CC_ACK) {
189 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
190 if (tcp->tcp_ccv.flags & CCF_RTO)
191 tcp->tcp_ccv.flags &= ~CCF_RTO;
192
193 tcp->tcp_ccv.t_bytes_acked +=
194 min(tcp->tcp_ccv.bytes_this_ack,
195 tcp->tcp_tcps->tcps_abc_l_var * tcp->tcp_mss);
196 if (tcp->tcp_ccv.t_bytes_acked >= tcp->tcp_cwnd) {
197 tcp->tcp_ccv.t_bytes_acked -= tcp->tcp_cwnd;
198 tcp->tcp_ccv.flags |= CCF_ABC_SENTAWND;
199 }
200 } else {
201 tcp->tcp_ccv.flags &= ~CCF_ABC_SENTAWND;
202 tcp->tcp_ccv.t_bytes_acked = 0;
203 }
204 }
205
206 if (CC_ALGO(tcp)->ack_received != NULL) {
207 /*
208 * The FreeBSD code where this originated had a comment "Find
209 * a way to live without this" in several places where curack
210 * got set. If they eventually dump curack from the cc
211 * variables, we'll need to adapt our code.
212 */
213 tcp->tcp_ccv.curack = seg_ack;
214 CC_ALGO(tcp)->ack_received(&tcp->tcp_ccv, type);
215 }
216
217 DTRACE_PROBE3(cwnd__cc__ack__received, tcp_t *, tcp, uint32_t, old_cwnd,
218 uint32_t, tcp->tcp_cwnd);
219 }
220
221 void
222 cc_cong_signal(tcp_t *tcp, uint32_t seg_ack, uint32_t type)
223 {
224 uint32_t old_cwnd = tcp->tcp_cwnd;
225 uint32_t old_cwnd_ssthresh = tcp->tcp_cwnd_ssthresh;
226 switch (type) {
227 case CC_NDUPACK:
228 if (!IN_FASTRECOVERY(tcp->tcp_ccv.flags)) {
229 tcp->tcp_rexmit_max = tcp->tcp_snxt;
230 if (tcp->tcp_ecn_ok) {
231 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
232 tcp->tcp_cwr = B_TRUE;
233 tcp->tcp_ecn_cwr_sent = B_FALSE;
234 }
235 }
236 break;
237 case CC_ECN:
238 if (!IN_CONGRECOVERY(tcp->tcp_ccv.flags)) {
239 tcp->tcp_rexmit_max = tcp->tcp_snxt;
240 if (tcp->tcp_ecn_ok) {
241 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
242 tcp->tcp_cwr = B_TRUE;
243 tcp->tcp_ecn_cwr_sent = B_FALSE;
244 }
245 }
246 break;
247 case CC_RTO:
248 tcp->tcp_ccv.flags |= CCF_RTO;
249 tcp->tcp_dupack_cnt = 0;
250 tcp->tcp_ccv.t_bytes_acked = 0;
251 /*
252 * Give up on fast recovery and congestion recovery if we were
253 * attempting either.
254 */
255 EXIT_RECOVERY(tcp->tcp_ccv.flags);
256 if (CC_ALGO(tcp)->cong_signal == NULL) {
257 /*
258 * RFC5681 Section 3.1
259 * ssthresh = max (FlightSize / 2, 2*SMSS) eq (4)
260 */
261 tcp->tcp_cwnd_ssthresh = max(
262 (tcp->tcp_snxt - tcp->tcp_suna) / 2 / tcp->tcp_mss,
263 2) * tcp->tcp_mss;
264 tcp->tcp_cwnd = tcp->tcp_mss;
265 }
266
267 if (tcp->tcp_ecn_ok) {
268 tcp->tcp_cwr = B_TRUE;
269 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
270 tcp->tcp_ecn_cwr_sent = B_FALSE;
271 }
272 break;
273 }
274
275 if (CC_ALGO(tcp)->cong_signal != NULL) {
276 tcp->tcp_ccv.curack = seg_ack;
277 CC_ALGO(tcp)->cong_signal(&tcp->tcp_ccv, type);
278 }
279
280 DTRACE_PROBE6(cwnd__cc__cong__signal, tcp_t *, tcp, uint32_t, old_cwnd,
281 uint32_t, tcp->tcp_cwnd, uint32_t, old_cwnd_ssthresh,
282 uint32_t, tcp->tcp_cwnd_ssthresh, uint32_t, type);
283 }
284
285 static void
286 cc_post_recovery(tcp_t *tcp, uint32_t seg_ack)
287 {
288 uint32_t old_cwnd = tcp->tcp_cwnd;
289
290 if (CC_ALGO(tcp)->post_recovery != NULL) {
291 tcp->tcp_ccv.curack = seg_ack;
292 CC_ALGO(tcp)->post_recovery(&tcp->tcp_ccv);
293 }
294 tcp->tcp_ccv.t_bytes_acked = 0;
295
296 DTRACE_PROBE3(cwnd__cc__post__recovery, tcp_t *, tcp,
297 uint32_t, old_cwnd, uint32_t, tcp->tcp_cwnd);
298 }
299
300 /*
301 * Set the MSS associated with a particular tcp based on its current value,
302 * and a new one passed in. Observe minimums and maximums, and reset other
303 * state variables that we want to view as multiples of MSS.
304 *
305 * The value of MSS could be either increased or descreased.
306 */
307 void
308 tcp_mss_set(tcp_t *tcp, uint32_t mss)
309 {
310 uint32_t mss_max;
311 tcp_stack_t *tcps = tcp->tcp_tcps;
312 conn_t *connp = tcp->tcp_connp;
313
314 if (connp->conn_ipversion == IPV4_VERSION)
315 mss_max = tcps->tcps_mss_max_ipv4;
316 else
317 mss_max = tcps->tcps_mss_max_ipv6;
318
319 if (mss < tcps->tcps_mss_min)
320 mss = tcps->tcps_mss_min;
321 if (mss > mss_max)
322 mss = mss_max;
323 /*
324 * Unless naglim has been set by our client to
325 * a non-mss value, force naglim to track mss.
326 * This can help to aggregate small writes.
327 */
328 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
329 tcp->tcp_naglim = mss;
330 /*
331 * TCP should be able to buffer at least 4 MSS data for obvious
332 * performance reason.
333 */
334 if ((mss << 2) > connp->conn_sndbuf)
335 connp->conn_sndbuf = mss << 2;
336
337 /*
338 * Set the send lowater to at least twice of MSS.
339 */
340 if ((mss << 1) > connp->conn_sndlowat)
341 connp->conn_sndlowat = mss << 1;
342
343 /*
344 * Update tcp_cwnd according to the new value of MSS. Keep the
345 * previous ratio to preserve the transmit rate.
346 */
347 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
348 tcp->tcp_cwnd_cnt = 0;
349
350 tcp->tcp_mss = mss;
351 (void) tcp_maxpsz_set(tcp, B_TRUE);
352 }
353
354 /*
355 * Extract option values from a tcp header. We put any found values into the
356 * tcpopt struct and return a bitmask saying which options were found.
357 */
358 int
359 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
360 {
361 uchar_t *endp;
362 int len;
363 uint32_t mss;
364 uchar_t *up = (uchar_t *)tcpha;
365 int found = 0;
366 int32_t sack_len;
367 tcp_seq sack_begin, sack_end;
368 tcp_t *tcp;
369
370 endp = up + TCP_HDR_LENGTH(tcpha);
371 up += TCP_MIN_HEADER_LENGTH;
372 /*
373 * If timestamp option is aligned as recommended in RFC 7323 Appendix
374 * A, and is the only option, return quickly.
375 */
376 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
377 TCPOPT_REAL_TS_LEN &&
378 OK_32PTR(up) &&
379 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
380 tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4));
381 tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
382
383 return (TCP_OPT_TSTAMP_PRESENT);
384 }
385 while (up < endp) {
386 len = endp - up;
387 switch (*up) {
388 case TCPOPT_EOL:
389 break;
390
391 case TCPOPT_NOP:
392 up++;
393 continue;
394
395 case TCPOPT_MAXSEG:
396 if (len < TCPOPT_MAXSEG_LEN ||
397 up[1] != TCPOPT_MAXSEG_LEN)
398 break;
399
400 mss = BE16_TO_U16(up+2);
401 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
402 tcpopt->tcp_opt_mss = mss;
403 found |= TCP_OPT_MSS_PRESENT;
404
405 up += TCPOPT_MAXSEG_LEN;
406 continue;
407
408 case TCPOPT_WSCALE:
409 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
410 break;
411
412 if (up[2] > TCP_MAX_WINSHIFT)
413 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
414 else
415 tcpopt->tcp_opt_wscale = up[2];
416 found |= TCP_OPT_WSCALE_PRESENT;
417
418 up += TCPOPT_WS_LEN;
419 continue;
420
421 case TCPOPT_SACK_PERMITTED:
422 if (len < TCPOPT_SACK_OK_LEN ||
423 up[1] != TCPOPT_SACK_OK_LEN)
424 break;
425 found |= TCP_OPT_SACK_OK_PRESENT;
426 up += TCPOPT_SACK_OK_LEN;
427 continue;
428
429 case TCPOPT_SACK:
430 if (len <= 2 || up[1] <= 2 || len < up[1])
431 break;
432
433 /* If TCP is not interested in SACK blks... */
434 if ((tcp = tcpopt->tcp) == NULL) {
435 up += up[1];
436 continue;
437 }
438 sack_len = up[1] - TCPOPT_HEADER_LEN;
439 up += TCPOPT_HEADER_LEN;
440
441 /*
442 * If the list is empty, allocate one and assume
443 * nothing is sack'ed.
444 */
445 if (tcp->tcp_notsack_list == NULL) {
446 tcp_notsack_update(&(tcp->tcp_notsack_list),
447 tcp->tcp_suna, tcp->tcp_snxt,
448 &(tcp->tcp_num_notsack_blk),
449 &(tcp->tcp_cnt_notsack_list));
450
451 /*
452 * Make sure tcp_notsack_list is not NULL.
453 * This happens when kmem_alloc(KM_NOSLEEP)
454 * returns NULL.
455 */
456 if (tcp->tcp_notsack_list == NULL) {
457 up += sack_len;
458 continue;
459 }
460 tcp->tcp_fack = tcp->tcp_suna;
461 }
462
463 while (sack_len > 0) {
464 if (up + 8 > endp) {
465 up = endp;
466 break;
467 }
468 sack_begin = BE32_TO_U32(up);
469 up += 4;
470 sack_end = BE32_TO_U32(up);
471 up += 4;
472 sack_len -= 8;
473 /*
474 * Bounds checking. Make sure the SACK
475 * info is within tcp_suna and tcp_snxt.
476 * If this SACK blk is out of bound, ignore
477 * it but continue to parse the following
478 * blks.
479 */
480 if (SEQ_LEQ(sack_end, sack_begin) ||
481 SEQ_LT(sack_begin, tcp->tcp_suna) ||
482 SEQ_GT(sack_end, tcp->tcp_snxt)) {
483 continue;
484 }
485 tcp_notsack_insert(&(tcp->tcp_notsack_list),
486 sack_begin, sack_end,
487 &(tcp->tcp_num_notsack_blk),
488 &(tcp->tcp_cnt_notsack_list));
489 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
490 tcp->tcp_fack = sack_end;
491 }
492 }
493 found |= TCP_OPT_SACK_PRESENT;
494 continue;
495
496 case TCPOPT_TSTAMP:
497 if (len < TCPOPT_TSTAMP_LEN ||
498 up[1] != TCPOPT_TSTAMP_LEN)
499 break;
500
501 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
502 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
503
504 found |= TCP_OPT_TSTAMP_PRESENT;
505
506 up += TCPOPT_TSTAMP_LEN;
507 continue;
508
509 default:
510 if (len <= 1 || len < (int)up[1] || up[1] == 0)
511 break;
512 up += up[1];
513 continue;
514 }
515 break;
516 }
517 return (found);
518 }
519
520 /*
521 * Process all TCP option in SYN segment. Note that this function should
522 * be called after tcp_set_destination() is called so that the necessary info
523 * from IRE is already set in the tcp structure.
524 *
525 * This function sets up the correct tcp_mss value according to the
526 * MSS option value and our header size. It also sets up the window scale
527 * and timestamp values, and initialize SACK info blocks. But it does not
528 * change receive window size after setting the tcp_mss value. The caller
529 * should do the appropriate change.
530 */
531 static void
532 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
533 {
534 int options;
535 tcp_opt_t tcpopt;
536 uint32_t mss_max;
537 char *tmp_tcph;
538 tcp_stack_t *tcps = tcp->tcp_tcps;
539 conn_t *connp = tcp->tcp_connp;
540
541 tcpopt.tcp = NULL;
542 options = tcp_parse_options(tcpha, &tcpopt);
543
544 /*
545 * Process MSS option. Note that MSS option value does not account
546 * for IP or TCP options. This means that it is equal to MTU - minimum
547 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
548 * IPv6.
549 */
550 if (!(options & TCP_OPT_MSS_PRESENT)) {
551 if (connp->conn_ipversion == IPV4_VERSION)
552 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
553 else
554 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
555 } else {
556 if (connp->conn_ipversion == IPV4_VERSION)
557 mss_max = tcps->tcps_mss_max_ipv4;
558 else
559 mss_max = tcps->tcps_mss_max_ipv6;
560 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
561 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
562 else if (tcpopt.tcp_opt_mss > mss_max)
563 tcpopt.tcp_opt_mss = mss_max;
564 }
565
566 /* Process Window Scale option. */
567 if (options & TCP_OPT_WSCALE_PRESENT) {
568 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
569 tcp->tcp_snd_ws_ok = B_TRUE;
570 } else {
571 tcp->tcp_snd_ws = B_FALSE;
572 tcp->tcp_snd_ws_ok = B_FALSE;
573 tcp->tcp_rcv_ws = B_FALSE;
574 }
575
576 /* Process Timestamp option. */
577 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
578 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
579 tmp_tcph = (char *)tcp->tcp_tcpha;
580
581 tcp->tcp_snd_ts_ok = B_TRUE;
582 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
583 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
584 ASSERT(OK_32PTR(tmp_tcph));
585 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
586
587 /* Fill in our template header with basic timestamp option. */
588 tmp_tcph += connp->conn_ht_ulp_len;
589 tmp_tcph[0] = TCPOPT_NOP;
590 tmp_tcph[1] = TCPOPT_NOP;
591 tmp_tcph[2] = TCPOPT_TSTAMP;
592 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
593 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
594 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
595 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
596 } else {
597 tcp->tcp_snd_ts_ok = B_FALSE;
598 }
599
600 /*
601 * Process SACK options. If SACK is enabled for this connection,
602 * then allocate the SACK info structure. Note the following ways
603 * when tcp_snd_sack_ok is set to true.
604 *
605 * For active connection: in tcp_set_destination() called in
606 * tcp_connect().
607 *
608 * For passive connection: in tcp_set_destination() called in
609 * tcp_input_listener().
610 *
611 * That's the reason why the extra TCP_IS_DETACHED() check is there.
612 * That check makes sure that if we did not send a SACK OK option,
613 * we will not enable SACK for this connection even though the other
614 * side sends us SACK OK option. For active connection, the SACK
615 * info structure has already been allocated. So we need to free
616 * it if SACK is disabled.
617 */
618 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
619 (tcp->tcp_snd_sack_ok ||
620 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
621 ASSERT(tcp->tcp_num_sack_blk == 0);
622 ASSERT(tcp->tcp_notsack_list == NULL);
623
624 tcp->tcp_snd_sack_ok = B_TRUE;
625 if (tcp->tcp_snd_ts_ok) {
626 tcp->tcp_max_sack_blk = 3;
627 } else {
628 tcp->tcp_max_sack_blk = 4;
629 }
630 } else if (tcp->tcp_snd_sack_ok) {
631 /*
632 * Resetting tcp_snd_sack_ok to B_FALSE so that
633 * no SACK info will be used for this
634 * connection. This assumes that SACK usage
635 * permission is negotiated. This may need
636 * to be changed once this is clarified.
637 */
638 ASSERT(tcp->tcp_num_sack_blk == 0);
639 ASSERT(tcp->tcp_notsack_list == NULL);
640 tcp->tcp_snd_sack_ok = B_FALSE;
641 }
642
643 /*
644 * Now we know the exact TCP/IP header length, subtract
645 * that from tcp_mss to get our side's MSS.
646 */
647 tcp->tcp_mss -= connp->conn_ht_iphc_len;
648
649 /*
650 * Here we assume that the other side's header size will be equal to
651 * our header size. We calculate the real MSS accordingly. Need to
652 * take into additional stuffs IPsec puts in.
653 *
654 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
655 */
656 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
657 tcp->tcp_ipsec_overhead -
658 ((connp->conn_ipversion == IPV4_VERSION ?
659 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
660
661 /*
662 * Set MSS to the smaller one of both ends of the connection.
663 * We should not have called tcp_mss_set() before, but our
664 * side of the MSS should have been set to a proper value
665 * by tcp_set_destination(). tcp_mss_set() will also set up the
666 * STREAM head parameters properly.
667 *
668 * If we have a larger-than-16-bit window but the other side
669 * didn't want to do window scale, tcp_rwnd_set() will take
670 * care of that.
671 */
672 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
673
674 /*
675 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
676 * updated properly.
677 */
678 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
679
680 if (tcp->tcp_cc_algo->conn_init != NULL)
681 tcp->tcp_cc_algo->conn_init(&tcp->tcp_ccv);
682 }
683
684 /*
685 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
686 * is filled, return as much as we can. The message passed in may be
687 * multi-part, chained using b_cont. "start" is the starting sequence
688 * number for this piece.
689 */
690 static mblk_t *
691 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
692 {
693 uint32_t end, bytes;
694 mblk_t *mp1;
695 mblk_t *mp2;
696 mblk_t *next_mp;
697 uint32_t u1;
698 tcp_stack_t *tcps = tcp->tcp_tcps;
699
700
701 /* Walk through all the new pieces. */
702 do {
703 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
704 (uintptr_t)INT_MAX);
705 end = start + (int)(mp->b_wptr - mp->b_rptr);
706 next_mp = mp->b_cont;
707 if (start == end) {
708 /* Empty. Blast it. */
709 freeb(mp);
710 continue;
711 }
712 bytes = end - start;
713 mp->b_cont = NULL;
714 TCP_REASS_SET_SEQ(mp, start);
715 TCP_REASS_SET_END(mp, end);
716 mp1 = tcp->tcp_reass_tail;
717 if (mp1 == NULL || SEQ_GEQ(start, TCP_REASS_END(mp1))) {
718 if (mp1 != NULL) {
719 /*
720 * New stuff is beyond the tail; link it on the
721 * end.
722 */
723 mp1->b_cont = mp;
724 } else {
725 tcp->tcp_reass_head = mp;
726 }
727 tcp->tcp_reass_tail = mp;
728 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
729 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, bytes);
730 tcp->tcp_cs.tcp_in_data_unorder_segs++;
731 tcp->tcp_cs.tcp_in_data_unorder_bytes += bytes;
732 continue;
733 }
734 mp1 = tcp->tcp_reass_head;
735 u1 = TCP_REASS_SEQ(mp1);
736 /* New stuff at the front? */
737 if (SEQ_LT(start, u1)) {
738 /* Yes... Check for overlap. */
739 mp->b_cont = mp1;
740 tcp->tcp_reass_head = mp;
741 tcp_reass_elim_overlap(tcp, mp);
742 continue;
743 }
744 /*
745 * The new piece fits somewhere between the head and tail.
746 * We find our slot, where mp1 precedes us and mp2 trails.
747 */
748 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
749 u1 = TCP_REASS_SEQ(mp2);
750 if (SEQ_LEQ(start, u1))
751 break;
752 }
753 /* Link ourselves in */
754 mp->b_cont = mp2;
755 mp1->b_cont = mp;
756
757 /* Trim overlap with following mblk(s) first */
758 tcp_reass_elim_overlap(tcp, mp);
759
760 /* Trim overlap with preceding mblk */
761 tcp_reass_elim_overlap(tcp, mp1);
762
763 } while (start = end, mp = next_mp);
764 mp1 = tcp->tcp_reass_head;
765 /* Anything ready to go? */
766 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
767 return (NULL);
768 /* Eat what we can off the queue */
769 for (;;) {
770 mp = mp1->b_cont;
771 end = TCP_REASS_END(mp1);
772 TCP_REASS_SET_SEQ(mp1, 0);
773 TCP_REASS_SET_END(mp1, 0);
774 if (!mp) {
775 tcp->tcp_reass_tail = NULL;
776 break;
777 }
778 if (end != TCP_REASS_SEQ(mp)) {
779 mp1->b_cont = NULL;
780 break;
781 }
782 mp1 = mp;
783 }
784 mp1 = tcp->tcp_reass_head;
785 tcp->tcp_reass_head = mp;
786 return (mp1);
787 }
788
789 /* Eliminate any overlap that mp may have over later mblks */
790 static void
791 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
792 {
793 uint32_t end;
794 mblk_t *mp1;
795 uint32_t u1;
796 tcp_stack_t *tcps = tcp->tcp_tcps;
797
798 end = TCP_REASS_END(mp);
799 while ((mp1 = mp->b_cont) != NULL) {
800 u1 = TCP_REASS_SEQ(mp1);
801 if (!SEQ_GT(end, u1))
802 break;
803 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
804 mp->b_wptr -= end - u1;
805 TCP_REASS_SET_END(mp, u1);
806 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
807 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
808 end - u1);
809 break;
810 }
811 mp->b_cont = mp1->b_cont;
812 TCP_REASS_SET_SEQ(mp1, 0);
813 TCP_REASS_SET_END(mp1, 0);
814 freeb(mp1);
815 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
816 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
817 }
818 if (!mp1)
819 tcp->tcp_reass_tail = mp;
820 }
821
822 /*
823 * This function does PAWS protection check, per RFC 7323 section 5. Requires
824 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
825 * the segment passes the PAWS test, else returns B_FALSE.
826 */
827 boolean_t
828 tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp)
829 {
830 if (TSTMP_LT(tcpoptp->tcp_opt_ts_val,
831 tcp->tcp_ts_recent)) {
832 if (LBOLT_FASTPATH64 <
833 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
834 /* This segment is not acceptable. */
835 return (B_FALSE);
836 } else {
837 /*
838 * Connection has been idle for
839 * too long. Reset the timestamp
840 */
841 tcp->tcp_ts_recent =
842 tcpoptp->tcp_opt_ts_val;
843 }
844 }
845 return (B_TRUE);
846 }
847
848 /*
849 * Defense for the SYN attack -
850 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
851 * one from the list of droppable eagers. This list is a subset of q0.
852 * see comments before the definition of MAKE_DROPPABLE().
853 * 2. Don't drop a SYN request before its first timeout. This gives every
854 * request at least til the first timeout to complete its 3-way handshake.
855 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
856 * requests currently on the queue that has timed out. This will be used
857 * as an indicator of whether an attack is under way, so that appropriate
858 * actions can be taken. (It's incremented in tcp_timer() and decremented
859 * either when eager goes into ESTABLISHED, or gets freed up.)
860 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
861 * # of timeout drops back to <= q0len/32 => SYN alert off
862 */
863 static boolean_t
864 tcp_drop_q0(tcp_t *tcp)
865 {
866 tcp_t *eager;
867 mblk_t *mp;
868 tcp_stack_t *tcps = tcp->tcp_tcps;
869
870 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
871 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
872
873 /* Pick oldest eager from the list of droppable eagers */
874 eager = tcp->tcp_eager_prev_drop_q0;
875
876 /* If list is empty. return B_FALSE */
877 if (eager == tcp) {
878 return (B_FALSE);
879 }
880
881 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
882 if ((mp = allocb(0, BPRI_HI)) == NULL)
883 return (B_FALSE);
884
885 /*
886 * Take this eager out from the list of droppable eagers since we are
887 * going to drop it.
888 */
889 MAKE_UNDROPPABLE(eager);
890
891 if (tcp->tcp_connp->conn_debug) {
892 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
893 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
894 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
895 tcp->tcp_conn_req_cnt_q0,
896 tcp_display(tcp, NULL, DISP_PORT_ONLY));
897 }
898
899 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
900
901 /* Put a reference on the conn as we are enqueueing it in the sqeue */
902 CONN_INC_REF(eager->tcp_connp);
903
904 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
905 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
906 SQ_FILL, SQTAG_TCP_DROP_Q0);
907
908 return (B_TRUE);
909 }
910
911 /*
912 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
913 */
914 static mblk_t *
915 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
916 ip_recv_attr_t *ira)
917 {
918 tcp_t *ltcp = lconnp->conn_tcp;
919 tcp_t *tcp = connp->conn_tcp;
920 mblk_t *tpi_mp;
921 ipha_t *ipha;
922 ip6_t *ip6h;
923 sin6_t sin6;
924 uint_t ifindex = ira->ira_ruifindex;
925 tcp_stack_t *tcps = tcp->tcp_tcps;
926
927 if (ira->ira_flags & IRAF_IS_IPV4) {
928 ipha = (ipha_t *)mp->b_rptr;
929
930 connp->conn_ipversion = IPV4_VERSION;
931 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
932 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
933 connp->conn_saddr_v6 = connp->conn_laddr_v6;
934
935 sin6 = sin6_null;
936 sin6.sin6_addr = connp->conn_faddr_v6;
937 sin6.sin6_port = connp->conn_fport;
938 sin6.sin6_family = AF_INET6;
939 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
940 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
941
942 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
943 sin6_t sin6d;
944
945 sin6d = sin6_null;
946 sin6d.sin6_addr = connp->conn_laddr_v6;
947 sin6d.sin6_port = connp->conn_lport;
948 sin6d.sin6_family = AF_INET;
949 tpi_mp = mi_tpi_extconn_ind(NULL,
950 (char *)&sin6d, sizeof (sin6_t),
951 (char *)&tcp,
952 (t_scalar_t)sizeof (intptr_t),
953 (char *)&sin6d, sizeof (sin6_t),
954 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
955 } else {
956 tpi_mp = mi_tpi_conn_ind(NULL,
957 (char *)&sin6, sizeof (sin6_t),
958 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
959 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
960 }
961 } else {
962 ip6h = (ip6_t *)mp->b_rptr;
963
964 connp->conn_ipversion = IPV6_VERSION;
965 connp->conn_laddr_v6 = ip6h->ip6_dst;
966 connp->conn_faddr_v6 = ip6h->ip6_src;
967 connp->conn_saddr_v6 = connp->conn_laddr_v6;
968
969 sin6 = sin6_null;
970 sin6.sin6_addr = connp->conn_faddr_v6;
971 sin6.sin6_port = connp->conn_fport;
972 sin6.sin6_family = AF_INET6;
973 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
974 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
975 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
976
977 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
978 /* Pass up the scope_id of remote addr */
979 sin6.sin6_scope_id = ifindex;
980 } else {
981 sin6.sin6_scope_id = 0;
982 }
983 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
984 sin6_t sin6d;
985
986 sin6d = sin6_null;
987 sin6.sin6_addr = connp->conn_laddr_v6;
988 sin6d.sin6_port = connp->conn_lport;
989 sin6d.sin6_family = AF_INET6;
990 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
991 sin6d.sin6_scope_id = ifindex;
992
993 tpi_mp = mi_tpi_extconn_ind(NULL,
994 (char *)&sin6d, sizeof (sin6_t),
995 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
996 (char *)&sin6d, sizeof (sin6_t),
997 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
998 } else {
999 tpi_mp = mi_tpi_conn_ind(NULL,
1000 (char *)&sin6, sizeof (sin6_t),
1001 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
1002 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1003 }
1004 }
1005
1006 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
1007 return (tpi_mp);
1008 }
1009
1010 /* Handle a SYN on an AF_INET socket */
1011 static mblk_t *
1012 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
1013 ip_recv_attr_t *ira)
1014 {
1015 tcp_t *ltcp = lconnp->conn_tcp;
1016 tcp_t *tcp = connp->conn_tcp;
1017 sin_t sin;
1018 mblk_t *tpi_mp = NULL;
1019 tcp_stack_t *tcps = tcp->tcp_tcps;
1020 ipha_t *ipha;
1021
1022 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
1023 ipha = (ipha_t *)mp->b_rptr;
1024
1025 connp->conn_ipversion = IPV4_VERSION;
1026 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
1027 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
1028 connp->conn_saddr_v6 = connp->conn_laddr_v6;
1029
1030 sin = sin_null;
1031 sin.sin_addr.s_addr = connp->conn_faddr_v4;
1032 sin.sin_port = connp->conn_fport;
1033 sin.sin_family = AF_INET;
1034 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
1035 sin_t sind;
1036
1037 sind = sin_null;
1038 sind.sin_addr.s_addr = connp->conn_laddr_v4;
1039 sind.sin_port = connp->conn_lport;
1040 sind.sin_family = AF_INET;
1041 tpi_mp = mi_tpi_extconn_ind(NULL,
1042 (char *)&sind, sizeof (sin_t), (char *)&tcp,
1043 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
1044 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1045 } else {
1046 tpi_mp = mi_tpi_conn_ind(NULL,
1047 (char *)&sin, sizeof (sin_t),
1048 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
1049 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
1050 }
1051
1052 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
1053 return (tpi_mp);
1054 }
1055
1056 /*
1057 * Called via squeue to get on to eager's perimeter. It sends a
1058 * TH_RST if eager is in the fanout table. The listener wants the
1059 * eager to disappear either by means of tcp_eager_blowoff() or
1060 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
1061 * called (via squeue) if the eager cannot be inserted in the
1062 * fanout table in tcp_input_listener().
1063 */
1064 /* ARGSUSED */
1065 void
1066 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
1067 {
1068 conn_t *econnp = (conn_t *)arg;
1069 tcp_t *eager = econnp->conn_tcp;
1070 tcp_t *listener = eager->tcp_listener;
1071
1072 /*
1073 * We could be called because listener is closing. Since
1074 * the eager was using listener's queue's, we avoid
1075 * using the listeners queues from now on.
1076 */
1077 ASSERT(eager->tcp_detached);
1078 econnp->conn_rq = NULL;
1079 econnp->conn_wq = NULL;
1080
1081 /*
1082 * An eager's conn_fanout will be NULL if it's a duplicate
1083 * for an existing 4-tuples in the conn fanout table.
1084 * We don't want to send an RST out in such case.
1085 */
1086 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1087 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1088 eager, eager->tcp_snxt, 0, TH_RST);
1089 }
1090
1091 /* We are here because listener wants this eager gone */
1092 if (listener != NULL) {
1093 mutex_enter(&listener->tcp_eager_lock);
1094 tcp_eager_unlink(eager);
1095 if (eager->tcp_tconnind_started) {
1096 /*
1097 * The eager has sent a conn_ind up to the
1098 * listener but listener decides to close
1099 * instead. We need to drop the extra ref
1100 * placed on eager in tcp_input_data() before
1101 * sending the conn_ind to listener.
1102 */
1103 CONN_DEC_REF(econnp);
1104 }
1105 mutex_exit(&listener->tcp_eager_lock);
1106 CONN_DEC_REF(listener->tcp_connp);
1107 }
1108
1109 if (eager->tcp_state != TCPS_CLOSED)
1110 tcp_close_detached(eager);
1111 }
1112
1113 /*
1114 * Reset any eager connection hanging off this listener marked
1115 * with 'seqnum' and then reclaim it's resources.
1116 */
1117 boolean_t
1118 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1119 {
1120 tcp_t *eager;
1121 mblk_t *mp;
1122
1123 eager = listener;
1124 mutex_enter(&listener->tcp_eager_lock);
1125 do {
1126 eager = eager->tcp_eager_next_q;
1127 if (eager == NULL) {
1128 mutex_exit(&listener->tcp_eager_lock);
1129 return (B_FALSE);
1130 }
1131 } while (eager->tcp_conn_req_seqnum != seqnum);
1132
1133 if (eager->tcp_closemp_used) {
1134 mutex_exit(&listener->tcp_eager_lock);
1135 return (B_TRUE);
1136 }
1137 eager->tcp_closemp_used = B_TRUE;
1138 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1139 CONN_INC_REF(eager->tcp_connp);
1140 mutex_exit(&listener->tcp_eager_lock);
1141 mp = &eager->tcp_closemp;
1142 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1143 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1144 return (B_TRUE);
1145 }
1146
1147 /*
1148 * Reset any eager connection hanging off this listener
1149 * and then reclaim it's resources.
1150 */
1151 void
1152 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1153 {
1154 tcp_t *eager;
1155 mblk_t *mp;
1156 tcp_stack_t *tcps = listener->tcp_tcps;
1157
1158 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1159
1160 if (!q0_only) {
1161 /* First cleanup q */
1162 TCP_STAT(tcps, tcp_eager_blowoff_q);
1163 eager = listener->tcp_eager_next_q;
1164 while (eager != NULL) {
1165 if (!eager->tcp_closemp_used) {
1166 eager->tcp_closemp_used = B_TRUE;
1167 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1168 CONN_INC_REF(eager->tcp_connp);
1169 mp = &eager->tcp_closemp;
1170 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1171 tcp_eager_kill, eager->tcp_connp, NULL,
1172 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1173 }
1174 eager = eager->tcp_eager_next_q;
1175 }
1176 }
1177 /* Then cleanup q0 */
1178 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1179 eager = listener->tcp_eager_next_q0;
1180 while (eager != listener) {
1181 if (!eager->tcp_closemp_used) {
1182 eager->tcp_closemp_used = B_TRUE;
1183 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1184 CONN_INC_REF(eager->tcp_connp);
1185 mp = &eager->tcp_closemp;
1186 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1187 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1188 SQTAG_TCP_EAGER_CLEANUP_Q0);
1189 }
1190 eager = eager->tcp_eager_next_q0;
1191 }
1192 }
1193
1194 /*
1195 * If we are an eager connection hanging off a listener that hasn't
1196 * formally accepted the connection yet, get off its list and blow off
1197 * any data that we have accumulated.
1198 */
1199 void
1200 tcp_eager_unlink(tcp_t *tcp)
1201 {
1202 tcp_t *listener = tcp->tcp_listener;
1203
1204 ASSERT(listener != NULL);
1205 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1206 if (tcp->tcp_eager_next_q0 != NULL) {
1207 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1208
1209 /* Remove the eager tcp from q0 */
1210 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1211 tcp->tcp_eager_prev_q0;
1212 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1213 tcp->tcp_eager_next_q0;
1214 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1215 listener->tcp_conn_req_cnt_q0--;
1216
1217 tcp->tcp_eager_next_q0 = NULL;
1218 tcp->tcp_eager_prev_q0 = NULL;
1219
1220 /*
1221 * Take the eager out, if it is in the list of droppable
1222 * eagers.
1223 */
1224 MAKE_UNDROPPABLE(tcp);
1225
1226 if (tcp->tcp_syn_rcvd_timeout != 0) {
1227 /* we have timed out before */
1228 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1229 listener->tcp_syn_rcvd_timeout--;
1230 }
1231 } else {
1232 tcp_t **tcpp = &listener->tcp_eager_next_q;
1233 tcp_t *prev = NULL;
1234
1235 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1236 if (tcpp[0] == tcp) {
1237 if (listener->tcp_eager_last_q == tcp) {
1238 /*
1239 * If we are unlinking the last
1240 * element on the list, adjust
1241 * tail pointer. Set tail pointer
1242 * to nil when list is empty.
1243 */
1244 ASSERT(tcp->tcp_eager_next_q == NULL);
1245 if (listener->tcp_eager_last_q ==
1246 listener->tcp_eager_next_q) {
1247 listener->tcp_eager_last_q =
1248 NULL;
1249 } else {
1250 /*
1251 * We won't get here if there
1252 * is only one eager in the
1253 * list.
1254 */
1255 ASSERT(prev != NULL);
1256 listener->tcp_eager_last_q =
1257 prev;
1258 }
1259 }
1260 tcpp[0] = tcp->tcp_eager_next_q;
1261 tcp->tcp_eager_next_q = NULL;
1262 tcp->tcp_eager_last_q = NULL;
1263 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1264 listener->tcp_conn_req_cnt_q--;
1265 break;
1266 }
1267 prev = tcpp[0];
1268 }
1269 }
1270 tcp->tcp_listener = NULL;
1271 }
1272
1273 /* BEGIN CSTYLED */
1274 /*
1275 *
1276 * The sockfs ACCEPT path:
1277 * =======================
1278 *
1279 * The eager is now established in its own perimeter as soon as SYN is
1280 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1281 * completes the accept processing on the acceptor STREAM. The sending
1282 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1283 * listener but a TLI/XTI listener completes the accept processing
1284 * on the listener perimeter.
1285 *
1286 * Common control flow for 3 way handshake:
1287 * ----------------------------------------
1288 *
1289 * incoming SYN (listener perimeter) -> tcp_input_listener()
1290 *
1291 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1292 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1293 *
1294 * Sockfs ACCEPT Path:
1295 * -------------------
1296 *
1297 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1298 * as STREAM entry point)
1299 *
1300 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1301 *
1302 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1303 * association (we are not behind eager's squeue but sockfs is protecting us
1304 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1305 * is changed to point at tcp_wput().
1306 *
1307 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1308 * listener (done on listener's perimeter).
1309 *
1310 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1311 * accept.
1312 *
1313 * TLI/XTI client ACCEPT path:
1314 * ---------------------------
1315 *
1316 * soaccept() sends T_CONN_RES on the listener STREAM.
1317 *
1318 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1319 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1320 *
1321 * Locks:
1322 * ======
1323 *
1324 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1325 * and listeners->tcp_eager_next_q.
1326 *
1327 * Referencing:
1328 * ============
1329 *
1330 * 1) We start out in tcp_input_listener by eager placing a ref on
1331 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1332 *
1333 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1334 * doing so we place a ref on the eager. This ref is finally dropped at the
1335 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1336 * reference is dropped by the squeue framework.
1337 *
1338 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1339 *
1340 * The reference must be released by the same entity that added the reference
1341 * In the above scheme, the eager is the entity that adds and releases the
1342 * references. Note that tcp_accept_finish executes in the squeue of the eager
1343 * (albeit after it is attached to the acceptor stream). Though 1. executes
1344 * in the listener's squeue, the eager is nascent at this point and the
1345 * reference can be considered to have been added on behalf of the eager.
1346 *
1347 * Eager getting a Reset or listener closing:
1348 * ==========================================
1349 *
1350 * Once the listener and eager are linked, the listener never does the unlink.
1351 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1352 * a message on all eager perimeter. The eager then does the unlink, clears
1353 * any pointers to the listener's queue and drops the reference to the
1354 * listener. The listener waits in tcp_close outside the squeue until its
1355 * refcount has dropped to 1. This ensures that the listener has waited for
1356 * all eagers to clear their association with the listener.
1357 *
1358 * Similarly, if eager decides to go away, it can unlink itself and close.
1359 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1360 * the reference to eager is still valid because of the extra ref we put
1361 * in tcp_send_conn_ind.
1362 *
1363 * Listener can always locate the eager under the protection
1364 * of the listener->tcp_eager_lock, and then do a refhold
1365 * on the eager during the accept processing.
1366 *
1367 * The acceptor stream accesses the eager in the accept processing
1368 * based on the ref placed on eager before sending T_conn_ind.
1369 * The only entity that can negate this refhold is a listener close
1370 * which is mutually exclusive with an active acceptor stream.
1371 *
1372 * Eager's reference on the listener
1373 * ===================================
1374 *
1375 * If the accept happens (even on a closed eager) the eager drops its
1376 * reference on the listener at the start of tcp_accept_finish. If the
1377 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1378 * the reference is dropped in tcp_closei_local. If the listener closes,
1379 * the reference is dropped in tcp_eager_kill. In all cases the reference
1380 * is dropped while executing in the eager's context (squeue).
1381 */
1382 /* END CSTYLED */
1383
1384 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1385
1386 /*
1387 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1388 * tcp_input_data will not see any packets for listeners since the listener
1389 * has conn_recv set to tcp_input_listener.
1390 */
1391 /* ARGSUSED */
1392 static void
1393 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1394 {
1395 tcpha_t *tcpha;
1396 uint32_t seg_seq;
1397 tcp_t *eager;
1398 int err;
1399 conn_t *econnp = NULL;
1400 squeue_t *new_sqp;
1401 mblk_t *mp1;
1402 uint_t ip_hdr_len;
1403 conn_t *lconnp = (conn_t *)arg;
1404 tcp_t *listener = lconnp->conn_tcp;
1405 tcp_stack_t *tcps = listener->tcp_tcps;
1406 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1407 uint_t flags;
1408 mblk_t *tpi_mp;
1409 uint_t ifindex = ira->ira_ruifindex;
1410 boolean_t tlc_set = B_FALSE;
1411
1412 ip_hdr_len = ira->ira_ip_hdr_length;
1413 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1414 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1415
1416 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1417 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1418 __dtrace_tcp_tcph_t *, tcpha);
1419
1420 if (!(flags & TH_SYN)) {
1421 if ((flags & TH_RST) || (flags & TH_URG)) {
1422 freemsg(mp);
1423 return;
1424 }
1425 if (flags & TH_ACK) {
1426 /* Note this executes in listener's squeue */
1427 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1428 return;
1429 }
1430
1431 freemsg(mp);
1432 return;
1433 }
1434
1435 if (listener->tcp_state != TCPS_LISTEN)
1436 goto error2;
1437
1438 ASSERT(IPCL_IS_BOUND(lconnp));
1439
1440 mutex_enter(&listener->tcp_eager_lock);
1441
1442 /*
1443 * The system is under memory pressure, so we need to do our part
1444 * to relieve the pressure. So we only accept new request if there
1445 * is nothing waiting to be accepted or waiting to complete the 3-way
1446 * handshake. This means that busy listener will not get too many
1447 * new requests which they cannot handle in time while non-busy
1448 * listener is still functioning properly.
1449 */
1450 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1451 listener->tcp_conn_req_cnt_q0 > 0)) {
1452 mutex_exit(&listener->tcp_eager_lock);
1453 TCP_STAT(tcps, tcp_listen_mem_drop);
1454 goto error2;
1455 }
1456
1457 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1458 mutex_exit(&listener->tcp_eager_lock);
1459 TCP_STAT(tcps, tcp_listendrop);
1460 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1461 if (lconnp->conn_debug) {
1462 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1463 "tcp_input_listener: listen backlog (max=%d) "
1464 "overflow (%d pending) on %s",
1465 listener->tcp_conn_req_max,
1466 listener->tcp_conn_req_cnt_q,
1467 tcp_display(listener, NULL, DISP_PORT_ONLY));
1468 }
1469 goto error2;
1470 }
1471
1472 if (listener->tcp_conn_req_cnt_q0 >=
1473 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1474 /*
1475 * Q0 is full. Drop a pending half-open req from the queue
1476 * to make room for the new SYN req. Also mark the time we
1477 * drop a SYN.
1478 *
1479 * A more aggressive defense against SYN attack will
1480 * be to set the "tcp_syn_defense" flag now.
1481 */
1482 TCP_STAT(tcps, tcp_listendropq0);
1483 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1484 if (!tcp_drop_q0(listener)) {
1485 mutex_exit(&listener->tcp_eager_lock);
1486 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1487 if (lconnp->conn_debug) {
1488 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1489 "tcp_input_listener: listen half-open "
1490 "queue (max=%d) full (%d pending) on %s",
1491 tcps->tcps_conn_req_max_q0,
1492 listener->tcp_conn_req_cnt_q0,
1493 tcp_display(listener, NULL,
1494 DISP_PORT_ONLY));
1495 }
1496 goto error2;
1497 }
1498 }
1499
1500 /*
1501 * Enforce the limit set on the number of connections per listener.
1502 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1503 * for comparison.
1504 */
1505 if (listener->tcp_listen_cnt != NULL) {
1506 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1507 int64_t now;
1508
1509 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1510 mutex_exit(&listener->tcp_eager_lock);
1511 now = ddi_get_lbolt64();
1512 atomic_dec_32(&tlc->tlc_cnt);
1513 TCP_STAT(tcps, tcp_listen_cnt_drop);
1514 tlc->tlc_drop++;
1515 if (now - tlc->tlc_report_time >
1516 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1517 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1518 "Listener (port %d) connection max (%u) "
1519 "reached: %u attempts dropped total\n",
1520 ntohs(listener->tcp_connp->conn_lport),
1521 tlc->tlc_max, tlc->tlc_drop);
1522 tlc->tlc_report_time = now;
1523 }
1524 goto error2;
1525 }
1526 tlc_set = B_TRUE;
1527 }
1528
1529 mutex_exit(&listener->tcp_eager_lock);
1530
1531 /*
1532 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1533 * or based on the ring (for packets from GLD). Otherwise it is
1534 * set based on lbolt i.e., a somewhat random number.
1535 */
1536 ASSERT(ira->ira_sqp != NULL);
1537 new_sqp = ira->ira_sqp;
1538
1539 econnp = tcp_get_conn(arg2, tcps);
1540 if (econnp == NULL)
1541 goto error2;
1542
1543 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1544 econnp->conn_sqp = new_sqp;
1545 econnp->conn_initial_sqp = new_sqp;
1546 econnp->conn_ixa->ixa_sqp = new_sqp;
1547
1548 econnp->conn_fport = tcpha->tha_lport;
1549 econnp->conn_lport = tcpha->tha_fport;
1550
1551 err = conn_inherit_parent(lconnp, econnp);
1552 if (err != 0)
1553 goto error3;
1554
1555 /* We already know the laddr of the new connection is ours */
1556 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1557
1558 ASSERT(OK_32PTR(mp->b_rptr));
1559 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1560 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1561
1562 if (lconnp->conn_family == AF_INET) {
1563 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1564 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1565 } else {
1566 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1567 }
1568
1569 if (tpi_mp == NULL)
1570 goto error3;
1571
1572 eager = econnp->conn_tcp;
1573 eager->tcp_detached = B_TRUE;
1574 SOCK_CONNID_INIT(eager->tcp_connid);
1575
1576 /*
1577 * Initialize the eager's tcp_t and inherit some parameters from
1578 * the listener.
1579 */
1580 tcp_init_values(eager, listener);
1581
1582 ASSERT((econnp->conn_ixa->ixa_flags &
1583 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1584 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1585 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1586 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1587
1588 if (!tcps->tcps_dev_flow_ctl)
1589 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1590
1591 /* Prepare for diffing against previous packets */
1592 eager->tcp_recvifindex = 0;
1593 eager->tcp_recvhops = 0xffffffffU;
1594
1595 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1596 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1597 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1598 econnp->conn_incoming_ifindex = ifindex;
1599 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1600 econnp->conn_ixa->ixa_scopeid = ifindex;
1601 }
1602 }
1603
1604 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1605 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1606 tcps->tcps_rev_src_routes) {
1607 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1608 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1609
1610 /* Source routing option copyover (reverse it) */
1611 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1612 if (err != 0) {
1613 freemsg(tpi_mp);
1614 goto error3;
1615 }
1616 ip_pkt_source_route_reverse_v4(ipp);
1617 }
1618
1619 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1620 ASSERT(!eager->tcp_tconnind_started);
1621 /*
1622 * If the SYN came with a credential, it's a loopback packet or a
1623 * labeled packet; attach the credential to the TPI message.
1624 */
1625 if (ira->ira_cred != NULL)
1626 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1627
1628 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1629 ASSERT(eager->tcp_ordrel_mp == NULL);
1630
1631 /* Inherit the listener's non-STREAMS flag */
1632 if (IPCL_IS_NONSTR(lconnp)) {
1633 econnp->conn_flags |= IPCL_NONSTR;
1634 /* All non-STREAMS tcp_ts are sockets */
1635 eager->tcp_issocket = B_TRUE;
1636 } else {
1637 /*
1638 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1639 * at close time, we will always have that to send up.
1640 * Otherwise, we need to do special handling in case the
1641 * allocation fails at that time.
1642 */
1643 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1644 goto error3;
1645 }
1646 /*
1647 * Now that the IP addresses and ports are setup in econnp we
1648 * can do the IPsec policy work.
1649 */
1650 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1651 if (lconnp->conn_policy != NULL) {
1652 /*
1653 * Inherit the policy from the listener; use
1654 * actions from ira
1655 */
1656 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1657 CONN_DEC_REF(econnp);
1658 freemsg(mp);
1659 goto error3;
1660 }
1661 }
1662 }
1663
1664 /*
1665 * tcp_set_destination() may set tcp_rwnd according to the route
1666 * metrics. If it does not, the eager's receive window will be set
1667 * to the listener's receive window later in this function.
1668 */
1669 eager->tcp_rwnd = 0;
1670
1671 if (is_system_labeled()) {
1672 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1673
1674 ASSERT(ira->ira_tsl != NULL);
1675 /* Discard any old label */
1676 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1677 ASSERT(ixa->ixa_tsl != NULL);
1678 label_rele(ixa->ixa_tsl);
1679 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1680 ixa->ixa_tsl = NULL;
1681 }
1682 if ((lconnp->conn_mlp_type != mlptSingle ||
1683 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1684 ira->ira_tsl != NULL) {
1685 /*
1686 * If this is an MLP connection or a MAC-Exempt
1687 * connection with an unlabeled node, packets are to be
1688 * exchanged using the security label of the received
1689 * SYN packet instead of the server application's label.
1690 * tsol_check_dest called from ip_set_destination
1691 * might later update TSF_UNLABELED by replacing
1692 * ixa_tsl with a new label.
1693 */
1694 label_hold(ira->ira_tsl);
1695 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1696 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1697 econnp, ts_label_t *, ixa->ixa_tsl)
1698 } else {
1699 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1700 DTRACE_PROBE2(syn_accept, conn_t *,
1701 econnp, ts_label_t *, ixa->ixa_tsl)
1702 }
1703 /*
1704 * conn_connect() called from tcp_set_destination will verify
1705 * the destination is allowed to receive packets at the
1706 * security label of the SYN-ACK we are generating. As part of
1707 * that, tsol_check_dest() may create a new effective label for
1708 * this connection.
1709 * Finally conn_connect() will call conn_update_label.
1710 * All that remains for TCP to do is to call
1711 * conn_build_hdr_template which is done as part of
1712 * tcp_set_destination.
1713 */
1714 }
1715
1716 /*
1717 * Since we will clear tcp_listener before we clear tcp_detached
1718 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1719 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1720 */
1721 eager->tcp_hard_binding = B_TRUE;
1722
1723 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1724 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1725
1726 CL_INET_CONNECT(econnp, B_FALSE, err);
1727 if (err != 0) {
1728 tcp_bind_hash_remove(eager);
1729 goto error3;
1730 }
1731
1732 SOCK_CONNID_BUMP(eager->tcp_connid);
1733
1734 /*
1735 * Adapt our mss, ttl, ... based on the remote address.
1736 */
1737
1738 if (tcp_set_destination(eager) != 0) {
1739 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1740 /* Undo the bind_hash_insert */
1741 tcp_bind_hash_remove(eager);
1742 goto error3;
1743 }
1744
1745 /* Process all TCP options. */
1746 tcp_process_options(eager, tcpha);
1747
1748 /* Is the other end ECN capable? */
1749 if (tcps->tcps_ecn_permitted >= 1 &&
1750 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1751 eager->tcp_ecn_ok = B_TRUE;
1752 }
1753
1754 /*
1755 * The listener's conn_rcvbuf should be the default window size or a
1756 * window size changed via SO_RCVBUF option. First round up the
1757 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1758 * scale option value if needed. Call tcp_rwnd_set() to finish the
1759 * setting.
1760 *
1761 * Note if there is a rpipe metric associated with the remote host,
1762 * we should not inherit receive window size from listener.
1763 */
1764 eager->tcp_rwnd = MSS_ROUNDUP(
1765 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1766 eager->tcp_rwnd), eager->tcp_mss);
1767 if (eager->tcp_snd_ws_ok)
1768 tcp_set_ws_value(eager);
1769 /*
1770 * Note that this is the only place tcp_rwnd_set() is called for
1771 * accepting a connection. We need to call it here instead of
1772 * after the 3-way handshake because we need to tell the other
1773 * side our rwnd in the SYN-ACK segment.
1774 */
1775 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1776
1777 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1778 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1779
1780 ASSERT(econnp->conn_rcvbuf != 0 &&
1781 econnp->conn_rcvbuf == eager->tcp_rwnd);
1782
1783 /* Put a ref on the listener for the eager. */
1784 CONN_INC_REF(lconnp);
1785 mutex_enter(&listener->tcp_eager_lock);
1786 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1787 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1788 listener->tcp_eager_next_q0 = eager;
1789 eager->tcp_eager_prev_q0 = listener;
1790
1791 /* Set tcp_listener before adding it to tcp_conn_fanout */
1792 eager->tcp_listener = listener;
1793 eager->tcp_saved_listener = listener;
1794
1795 /*
1796 * Set tcp_listen_cnt so that when the connection is done, the counter
1797 * is decremented.
1798 */
1799 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1800
1801 /*
1802 * Tag this detached tcp vector for later retrieval
1803 * by our listener client in tcp_accept().
1804 */
1805 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1806 listener->tcp_conn_req_cnt_q0++;
1807 if (++listener->tcp_conn_req_seqnum == -1) {
1808 /*
1809 * -1 is "special" and defined in TPI as something
1810 * that should never be used in T_CONN_IND
1811 */
1812 ++listener->tcp_conn_req_seqnum;
1813 }
1814 mutex_exit(&listener->tcp_eager_lock);
1815
1816 if (listener->tcp_syn_defense) {
1817 /* Don't drop the SYN that comes from a good IP source */
1818 ipaddr_t *addr_cache;
1819
1820 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1821 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1822 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1823 eager->tcp_dontdrop = B_TRUE;
1824 }
1825 }
1826
1827 /*
1828 * We need to insert the eager in its own perimeter but as soon
1829 * as we do that, we expose the eager to the classifier and
1830 * should not touch any field outside the eager's perimeter.
1831 * So do all the work necessary before inserting the eager
1832 * in its own perimeter. Be optimistic that conn_connect()
1833 * will succeed but undo everything if it fails.
1834 */
1835 seg_seq = ntohl(tcpha->tha_seq);
1836 eager->tcp_irs = seg_seq;
1837 eager->tcp_rack = seg_seq;
1838 eager->tcp_rnxt = seg_seq + 1;
1839 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1840 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1841 eager->tcp_state = TCPS_SYN_RCVD;
1842 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1843 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1844 int32_t, TCPS_LISTEN);
1845
1846 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1847 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1848 if (mp1 == NULL) {
1849 /*
1850 * Increment the ref count as we are going to
1851 * enqueueing an mp in squeue
1852 */
1853 CONN_INC_REF(econnp);
1854 goto error;
1855 }
1856
1857 /*
1858 * We need to start the rto timer. In normal case, we start
1859 * the timer after sending the packet on the wire (or at
1860 * least believing that packet was sent by waiting for
1861 * conn_ip_output() to return). Since this is the first packet
1862 * being sent on the wire for the eager, our initial tcp_rto
1863 * is at least tcp_rexmit_interval_min which is a fairly
1864 * large value to allow the algorithm to adjust slowly to large
1865 * fluctuations of RTT during first few transmissions.
1866 *
1867 * Starting the timer first and then sending the packet in this
1868 * case shouldn't make much difference since tcp_rexmit_interval_min
1869 * is of the order of several 100ms and starting the timer
1870 * first and then sending the packet will result in difference
1871 * of few micro seconds.
1872 *
1873 * Without this optimization, we are forced to hold the fanout
1874 * lock across the ipcl_bind_insert() and sending the packet
1875 * so that we don't race against an incoming packet (maybe RST)
1876 * for this eager.
1877 *
1878 * It is necessary to acquire an extra reference on the eager
1879 * at this point and hold it until after tcp_send_data() to
1880 * ensure against an eager close race.
1881 */
1882
1883 CONN_INC_REF(econnp);
1884
1885 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1886
1887 /*
1888 * Insert the eager in its own perimeter now. We are ready to deal
1889 * with any packets on eager.
1890 */
1891 if (ipcl_conn_insert(econnp) != 0)
1892 goto error;
1893
1894 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1895 freemsg(mp);
1896 /*
1897 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1898 * only used by one thread at a time.
1899 */
1900 if (econnp->conn_sqp == lconnp->conn_sqp) {
1901 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1902 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1903 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1904 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1905 (void) conn_ip_output(mp1, econnp->conn_ixa);
1906 CONN_DEC_REF(econnp);
1907 } else {
1908 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1909 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1910 }
1911 return;
1912 error:
1913 freemsg(mp1);
1914 eager->tcp_closemp_used = B_TRUE;
1915 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1916 mp1 = &eager->tcp_closemp;
1917 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1918 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1919
1920 /*
1921 * If a connection already exists, send the mp to that connections so
1922 * that it can be appropriately dealt with.
1923 */
1924 ipst = tcps->tcps_netstack->netstack_ip;
1925
1926 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1927 if (!IPCL_IS_CONNECTED(econnp)) {
1928 /*
1929 * Something bad happened. ipcl_conn_insert()
1930 * failed because a connection already existed
1931 * in connected hash but we can't find it
1932 * anymore (someone blew it away). Just
1933 * free this message and hopefully remote
1934 * will retransmit at which time the SYN can be
1935 * treated as a new connection or dealth with
1936 * a TH_RST if a connection already exists.
1937 */
1938 CONN_DEC_REF(econnp);
1939 freemsg(mp);
1940 } else {
1941 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1942 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1943 }
1944 } else {
1945 /* Nobody wants this packet */
1946 freemsg(mp);
1947 }
1948 return;
1949 error3:
1950 CONN_DEC_REF(econnp);
1951 error2:
1952 freemsg(mp);
1953 if (tlc_set)
1954 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1955 }
1956
1957 /*
1958 * In an ideal case of vertical partition in NUMA architecture, its
1959 * beneficial to have the listener and all the incoming connections
1960 * tied to the same squeue. The other constraint is that incoming
1961 * connections should be tied to the squeue attached to interrupted
1962 * CPU for obvious locality reason so this leaves the listener to
1963 * be tied to the same squeue. Our only problem is that when listener
1964 * is binding, the CPU that will get interrupted by the NIC whose
1965 * IP address the listener is binding to is not even known. So
1966 * the code below allows us to change that binding at the time the
1967 * CPU is interrupted by virtue of incoming connection's squeue.
1968 *
1969 * This is usefull only in case of a listener bound to a specific IP
1970 * address. For other kind of listeners, they get bound the
1971 * very first time and there is no attempt to rebind them.
1972 */
1973 void
1974 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1975 ip_recv_attr_t *ira)
1976 {
1977 conn_t *connp = (conn_t *)arg;
1978 squeue_t *sqp = (squeue_t *)arg2;
1979 squeue_t *new_sqp;
1980 uint32_t conn_flags;
1981
1982 /*
1983 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1984 * or based on the ring (for packets from GLD). Otherwise it is
1985 * set based on lbolt i.e., a somewhat random number.
1986 */
1987 ASSERT(ira->ira_sqp != NULL);
1988 new_sqp = ira->ira_sqp;
1989
1990 if (connp->conn_fanout == NULL)
1991 goto done;
1992
1993 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1994 mutex_enter(&connp->conn_fanout->connf_lock);
1995 mutex_enter(&connp->conn_lock);
1996 /*
1997 * No one from read or write side can access us now
1998 * except for already queued packets on this squeue.
1999 * But since we haven't changed the squeue yet, they
2000 * can't execute. If they are processed after we have
2001 * changed the squeue, they are sent back to the
2002 * correct squeue down below.
2003 * But a listner close can race with processing of
2004 * incoming SYN. If incoming SYN processing changes
2005 * the squeue then the listener close which is waiting
2006 * to enter the squeue would operate on the wrong
2007 * squeue. Hence we don't change the squeue here unless
2008 * the refcount is exactly the minimum refcount. The
2009 * minimum refcount of 4 is counted as - 1 each for
2010 * TCP and IP, 1 for being in the classifier hash, and
2011 * 1 for the mblk being processed.
2012 */
2013
2014 if (connp->conn_ref != 4 ||
2015 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
2016 mutex_exit(&connp->conn_lock);
2017 mutex_exit(&connp->conn_fanout->connf_lock);
2018 goto done;
2019 }
2020 if (connp->conn_sqp != new_sqp) {
2021 while (connp->conn_sqp != new_sqp)
2022 (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
2023 new_sqp);
2024 /* No special MT issues for outbound ixa_sqp hint */
2025 connp->conn_ixa->ixa_sqp = new_sqp;
2026 }
2027
2028 do {
2029 conn_flags = connp->conn_flags;
2030 conn_flags |= IPCL_FULLY_BOUND;
2031 (void) atomic_cas_32(&connp->conn_flags,
2032 connp->conn_flags, conn_flags);
2033 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
2034
2035 mutex_exit(&connp->conn_fanout->connf_lock);
2036 mutex_exit(&connp->conn_lock);
2037
2038 /*
2039 * Assume we have picked a good squeue for the listener. Make
2040 * subsequent SYNs not try to change the squeue.
2041 */
2042 connp->conn_recv = tcp_input_listener;
2043 }
2044
2045 done:
2046 if (connp->conn_sqp != sqp) {
2047 CONN_INC_REF(connp);
2048 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
2049 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
2050 } else {
2051 tcp_input_listener(connp, mp, sqp, ira);
2052 }
2053 }
2054
2055 /*
2056 * Send up all messages queued on tcp_rcv_list.
2057 */
2058 uint_t
2059 tcp_rcv_drain(tcp_t *tcp)
2060 {
2061 mblk_t *mp;
2062 uint_t ret = 0;
2063 #ifdef DEBUG
2064 uint_t cnt = 0;
2065 #endif
2066 queue_t *q = tcp->tcp_connp->conn_rq;
2067
2068 /* Can't drain on an eager connection */
2069 if (tcp->tcp_listener != NULL)
2070 return (ret);
2071
2072 /* Can't be a non-STREAMS connection */
2073 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
2074
2075 /* No need for the push timer now. */
2076 if (tcp->tcp_push_tid != 0) {
2077 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
2078 tcp->tcp_push_tid = 0;
2079 }
2080
2081 /*
2082 * Handle two cases here: we are currently fused or we were
2083 * previously fused and have some urgent data to be delivered
2084 * upstream. The latter happens because we either ran out of
2085 * memory or were detached and therefore sending the SIGURG was
2086 * deferred until this point. In either case we pass control
2087 * over to tcp_fuse_rcv_drain() since it may need to complete
2088 * some work.
2089 */
2090 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2091 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2092 &tcp->tcp_fused_sigurg_mp))
2093 return (ret);
2094 }
2095
2096 while ((mp = tcp->tcp_rcv_list) != NULL) {
2097 tcp->tcp_rcv_list = mp->b_next;
2098 mp->b_next = NULL;
2099 #ifdef DEBUG
2100 cnt += msgdsize(mp);
2101 #endif
2102 putnext(q, mp);
2103 }
2104 #ifdef DEBUG
2105 ASSERT(cnt == tcp->tcp_rcv_cnt);
2106 #endif
2107 tcp->tcp_rcv_last_head = NULL;
2108 tcp->tcp_rcv_last_tail = NULL;
2109 tcp->tcp_rcv_cnt = 0;
2110
2111 if (canputnext(q))
2112 return (tcp_rwnd_reopen(tcp));
2113
2114 return (ret);
2115 }
2116
2117 /*
2118 * Queue data on tcp_rcv_list which is a b_next chain.
2119 * tcp_rcv_last_head/tail is the last element of this chain.
2120 * Each element of the chain is a b_cont chain.
2121 *
2122 * M_DATA messages are added to the current element.
2123 * Other messages are added as new (b_next) elements.
2124 */
2125 void
2126 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2127 {
2128 ASSERT(seg_len == msgdsize(mp));
2129 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2130
2131 if (is_system_labeled()) {
2132 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2133 /*
2134 * Provide for protocols above TCP such as RPC. NOPID leaves
2135 * db_cpid unchanged.
2136 * The cred could have already been set.
2137 */
2138 if (cr != NULL)
2139 mblk_setcred(mp, cr, NOPID);
2140 }
2141
2142 if (tcp->tcp_rcv_list == NULL) {
2143 ASSERT(tcp->tcp_rcv_last_head == NULL);
2144 tcp->tcp_rcv_list = mp;
2145 tcp->tcp_rcv_last_head = mp;
2146 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2147 tcp->tcp_rcv_last_tail->b_cont = mp;
2148 } else {
2149 tcp->tcp_rcv_last_head->b_next = mp;
2150 tcp->tcp_rcv_last_head = mp;
2151 }
2152
2153 while (mp->b_cont)
2154 mp = mp->b_cont;
2155
2156 tcp->tcp_rcv_last_tail = mp;
2157 tcp->tcp_rcv_cnt += seg_len;
2158 tcp->tcp_rwnd -= seg_len;
2159 }
2160
2161 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2162 mblk_t *
2163 tcp_ack_mp(tcp_t *tcp)
2164 {
2165 uint32_t seq_no;
2166 tcp_stack_t *tcps = tcp->tcp_tcps;
2167 conn_t *connp = tcp->tcp_connp;
2168
2169 /*
2170 * There are a few cases to be considered while setting the sequence no.
2171 * Essentially, we can come here while processing an unacceptable pkt
2172 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2173 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2174 * If we are here for a zero window probe, stick with suna. In all
2175 * other cases, we check if suna + swnd encompasses snxt and set
2176 * the sequence number to snxt, if so. If snxt falls outside the
2177 * window (the receiver probably shrunk its window), we will go with
2178 * suna + swnd, otherwise the sequence no will be unacceptable to the
2179 * receiver.
2180 */
2181 if (tcp->tcp_zero_win_probe) {
2182 seq_no = tcp->tcp_suna;
2183 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2184 ASSERT(tcp->tcp_swnd == 0);
2185 seq_no = tcp->tcp_snxt;
2186 } else {
2187 seq_no = SEQ_GT(tcp->tcp_snxt,
2188 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2189 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2190 }
2191
2192 if (tcp->tcp_valid_bits) {
2193 /*
2194 * For the complex case where we have to send some
2195 * controls (FIN or SYN), let tcp_xmit_mp do it.
2196 */
2197 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2198 NULL, B_FALSE));
2199 } else {
2200 /* Generate a simple ACK */
2201 int data_length;
2202 uchar_t *rptr;
2203 tcpha_t *tcpha;
2204 mblk_t *mp1;
2205 int32_t total_hdr_len;
2206 int32_t tcp_hdr_len;
2207 int32_t num_sack_blk = 0;
2208 int32_t sack_opt_len;
2209 ip_xmit_attr_t *ixa = connp->conn_ixa;
2210
2211 /*
2212 * Allocate space for TCP + IP headers
2213 * and link-level header
2214 */
2215 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2216 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2217 tcp->tcp_num_sack_blk);
2218 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2219 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2220 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2221 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2222 } else {
2223 total_hdr_len = connp->conn_ht_iphc_len;
2224 tcp_hdr_len = connp->conn_ht_ulp_len;
2225 }
2226 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2227 if (!mp1)
2228 return (NULL);
2229
2230 /* Update the latest receive window size in TCP header. */
2231 tcp->tcp_tcpha->tha_win =
2232 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2233 /* copy in prototype TCP + IP header */
2234 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2235 mp1->b_rptr = rptr;
2236 mp1->b_wptr = rptr + total_hdr_len;
2237 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2238
2239 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2240
2241 /* Set the TCP sequence number. */
2242 tcpha->tha_seq = htonl(seq_no);
2243
2244 /* Set up the TCP flag field. */
2245 tcpha->tha_flags = (uchar_t)TH_ACK;
2246 if (tcp->tcp_ecn_echo_on)
2247 tcpha->tha_flags |= TH_ECE;
2248
2249 tcp->tcp_rack = tcp->tcp_rnxt;
2250 tcp->tcp_rack_cnt = 0;
2251
2252 /* fill in timestamp option if in use */
2253 if (tcp->tcp_snd_ts_ok) {
2254 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2255
2256 U32_TO_BE32(llbolt,
2257 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2258 U32_TO_BE32(tcp->tcp_ts_recent,
2259 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2260 }
2261
2262 /* Fill in SACK options */
2263 if (num_sack_blk > 0) {
2264 uchar_t *wptr = (uchar_t *)tcpha +
2265 connp->conn_ht_ulp_len;
2266 sack_blk_t *tmp;
2267 int32_t i;
2268
2269 wptr[0] = TCPOPT_NOP;
2270 wptr[1] = TCPOPT_NOP;
2271 wptr[2] = TCPOPT_SACK;
2272 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2273 sizeof (sack_blk_t);
2274 wptr += TCPOPT_REAL_SACK_LEN;
2275
2276 tmp = tcp->tcp_sack_list;
2277 for (i = 0; i < num_sack_blk; i++) {
2278 U32_TO_BE32(tmp[i].begin, wptr);
2279 wptr += sizeof (tcp_seq);
2280 U32_TO_BE32(tmp[i].end, wptr);
2281 wptr += sizeof (tcp_seq);
2282 }
2283 tcpha->tha_offset_and_reserved +=
2284 ((num_sack_blk * 2 + 1) << 4);
2285 }
2286
2287 ixa->ixa_pktlen = total_hdr_len;
2288
2289 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2290 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2291 } else {
2292 ip6_t *ip6 = (ip6_t *)rptr;
2293
2294 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2295 }
2296
2297 /*
2298 * Prime pump for checksum calculation in IP. Include the
2299 * adjustment for a source route if any.
2300 */
2301 data_length = tcp_hdr_len + connp->conn_sum;
2302 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2303 tcpha->tha_sum = htons(data_length);
2304
2305 if (tcp->tcp_ip_forward_progress) {
2306 tcp->tcp_ip_forward_progress = B_FALSE;
2307 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2308 } else {
2309 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2310 }
2311 return (mp1);
2312 }
2313 }
2314
2315 /*
2316 * Dummy socket upcalls for if/when the conn_t gets detached from a
2317 * direct-callback sonode via a user-driven close(). Easy to catch with
2318 * DTrace FBT, and should be mostly harmless.
2319 */
2320
2321 /* ARGSUSED */
2322 static sock_upper_handle_t
2323 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2324 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2325 {
2326 ASSERT(0); /* Panic in debug, otherwise ignore. */
2327 return (NULL);
2328 }
2329
2330 /* ARGSUSED */
2331 static void
2332 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2333 pid_t pid)
2334 {
2335 ASSERT(x == NULL);
2336 /* Normally we'd crhold(cr) and attach it to socket state. */
2337 /* LINTED */
2338 }
2339
2340 /* ARGSUSED */
2341 static int
2342 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2343 {
2344 ASSERT(0); /* Panic in debug, otherwise ignore. */
2345 return (-1);
2346 }
2347
2348 /* ARGSUSED */
2349 static void
2350 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2351 {
2352 ASSERT(x == NULL);
2353 /* We really want this one to be a harmless NOP for now. */
2354 /* LINTED */
2355 }
2356
2357 /* ARGSUSED */
2358 static ssize_t
2359 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2360 int *error, boolean_t *push)
2361 {
2362 ASSERT(x == NULL);
2363
2364 /*
2365 * Consume the message, set ESHUTDOWN, and return an error.
2366 * Nobody's home!
2367 */
2368 freemsg(mp);
2369 *error = ESHUTDOWN;
2370 return (-1);
2371 }
2372
2373 /* ARGSUSED */
2374 static void
2375 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2376 {
2377 ASSERT(0); /* Panic in debug, otherwise ignore. */
2378 }
2379
2380 /* ARGSUSED */
2381 static void
2382 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2383 {
2384 ASSERT(0); /* Panic in debug, otherwise ignore. */
2385 }
2386
2387 /* ARGSUSED */
2388 static void
2389 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2390 {
2391 ASSERT(x == NULL);
2392 /* Otherwise, this would signal socket state about OOB data. */
2393 }
2394
2395 /* ARGSUSED */
2396 static void
2397 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2398 {
2399 ASSERT(0); /* Panic in debug, otherwise ignore. */
2400 }
2401
2402 /* ARGSUSED */
2403 static void
2404 tcp_dummy_onearg(sock_upper_handle_t x)
2405 {
2406 ASSERT(0); /* Panic in debug, otherwise ignore. */
2407 }
2408
2409 static sock_upcalls_t tcp_dummy_upcalls = {
2410 tcp_dummy_newconn,
2411 tcp_dummy_connected,
2412 tcp_dummy_disconnected,
2413 tcp_dummy_opctl,
2414 tcp_dummy_recv,
2415 tcp_dummy_set_proto_props,
2416 tcp_dummy_txq_full,
2417 tcp_dummy_signal_oob,
2418 tcp_dummy_onearg,
2419 tcp_dummy_set_error,
2420 tcp_dummy_onearg
2421 };
2422
2423 /*
2424 * Handle M_DATA messages from IP. Its called directly from IP via
2425 * squeue for received IP packets.
2426 *
2427 * The first argument is always the connp/tcp to which the mp belongs.
2428 * There are no exceptions to this rule. The caller has already put
2429 * a reference on this connp/tcp and once tcp_input_data() returns,
2430 * the squeue will do the refrele.
2431 *
2432 * The TH_SYN for the listener directly go to tcp_input_listener via
2433 * squeue. ICMP errors go directly to tcp_icmp_input().
2434 *
2435 * sqp: NULL = recursive, sqp != NULL means called from squeue
2436 */
2437 void
2438 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2439 {
2440 int32_t bytes_acked;
2441 int32_t gap;
2442 mblk_t *mp1;
2443 uint_t flags;
2444 uint32_t new_swnd = 0;
2445 uchar_t *iphdr;
2446 uchar_t *rptr;
2447 int32_t rgap;
2448 uint32_t seg_ack;
2449 int seg_len;
2450 uint_t ip_hdr_len;
2451 uint32_t seg_seq;
2452 tcpha_t *tcpha;
2453 int urp;
2454 tcp_opt_t tcpopt;
2455 ip_pkt_t ipp;
2456 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2457 uint32_t cwnd;
2458 int mss;
2459 conn_t *connp = (conn_t *)arg;
2460 squeue_t *sqp = (squeue_t *)arg2;
2461 tcp_t *tcp = connp->conn_tcp;
2462 tcp_stack_t *tcps = tcp->tcp_tcps;
2463 sock_upcalls_t *sockupcalls;
2464
2465 /*
2466 * RST from fused tcp loopback peer should trigger an unfuse.
2467 */
2468 if (tcp->tcp_fused) {
2469 TCP_STAT(tcps, tcp_fusion_aborted);
2470 tcp_unfuse(tcp);
2471 }
2472
2473 mss = 0;
2474 iphdr = mp->b_rptr;
2475 rptr = mp->b_rptr;
2476 ASSERT(OK_32PTR(rptr));
2477
2478 ip_hdr_len = ira->ira_ip_hdr_length;
2479 if (connp->conn_recv_ancillary.crb_all != 0) {
2480 /*
2481 * Record packet information in the ip_pkt_t
2482 */
2483 ipp.ipp_fields = 0;
2484 if (ira->ira_flags & IRAF_IS_IPV4) {
2485 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2486 B_FALSE);
2487 } else {
2488 uint8_t nexthdrp;
2489
2490 /*
2491 * IPv6 packets can only be received by applications
2492 * that are prepared to receive IPv6 addresses.
2493 * The IP fanout must ensure this.
2494 */
2495 ASSERT(connp->conn_family == AF_INET6);
2496
2497 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2498 &nexthdrp);
2499 ASSERT(nexthdrp == IPPROTO_TCP);
2500
2501 /* Could have caused a pullup? */
2502 iphdr = mp->b_rptr;
2503 rptr = mp->b_rptr;
2504 }
2505 }
2506 ASSERT(DB_TYPE(mp) == M_DATA);
2507 ASSERT(mp->b_next == NULL);
2508
2509 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2510 seg_seq = ntohl(tcpha->tha_seq);
2511 seg_ack = ntohl(tcpha->tha_ack);
2512 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2513 seg_len = (int)(mp->b_wptr - rptr) -
2514 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2515 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2516 do {
2517 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2518 (uintptr_t)INT_MAX);
2519 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2520 } while ((mp1 = mp1->b_cont) != NULL &&
2521 mp1->b_datap->db_type == M_DATA);
2522 }
2523
2524 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2525 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2526 __dtrace_tcp_tcph_t *, tcpha);
2527
2528 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2529 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2530 seg_len, tcpha, ira);
2531 return;
2532 }
2533
2534 if (sqp != NULL) {
2535 /*
2536 * This is the correct place to update tcp_last_recv_time. Note
2537 * that it is also updated for tcp structure that belongs to
2538 * global and listener queues which do not really need updating.
2539 * But that should not cause any harm. And it is updated for
2540 * all kinds of incoming segments, not only for data segments.
2541 */
2542 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2543 }
2544
2545 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2546
2547 TCPS_BUMP_MIB(tcps, tcpHCInSegs);
2548 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2549
2550 if ((flags & TH_URG) && sqp != NULL) {
2551 /*
2552 * TCP can't handle urgent pointers that arrive before
2553 * the connection has been accept()ed since it can't
2554 * buffer OOB data. Discard segment if this happens.
2555 *
2556 * We can't just rely on a non-null tcp_listener to indicate
2557 * that the accept() has completed since unlinking of the
2558 * eager and completion of the accept are not atomic.
2559 * tcp_detached, when it is not set (B_FALSE) indicates
2560 * that the accept() has completed.
2561 *
2562 * Nor can it reassemble urgent pointers, so discard
2563 * if it's not the next segment expected.
2564 *
2565 * Otherwise, collapse chain into one mblk (discard if
2566 * that fails). This makes sure the headers, retransmitted
2567 * data, and new data all are in the same mblk.
2568 */
2569 ASSERT(mp != NULL);
2570 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2571 freemsg(mp);
2572 return;
2573 }
2574 /* Update pointers into message */
2575 iphdr = rptr = mp->b_rptr;
2576 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2577 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2578 /*
2579 * Since we can't handle any data with this urgent
2580 * pointer that is out of sequence, we expunge
2581 * the data. This allows us to still register
2582 * the urgent mark and generate the M_PCSIG,
2583 * which we can do.
2584 */
2585 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2586 seg_len = 0;
2587 }
2588 }
2589
2590 sockupcalls = connp->conn_upcalls;
2591 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2592 if (sockupcalls == NULL)
2593 sockupcalls = &tcp_dummy_upcalls;
2594
2595 switch (tcp->tcp_state) {
2596 case TCPS_SYN_SENT:
2597 if (connp->conn_final_sqp == NULL &&
2598 tcp_outbound_squeue_switch && sqp != NULL) {
2599 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2600 connp->conn_final_sqp = sqp;
2601 if (connp->conn_final_sqp != connp->conn_sqp) {
2602 DTRACE_PROBE1(conn__final__sqp__switch,
2603 conn_t *, connp);
2604 CONN_INC_REF(connp);
2605 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2606 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2607 tcp_input_data, connp, ira, ip_squeue_flag,
2608 SQTAG_CONNECT_FINISH);
2609 return;
2610 }
2611 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2612 }
2613 if (flags & TH_ACK) {
2614 /*
2615 * Note that our stack cannot send data before a
2616 * connection is established, therefore the
2617 * following check is valid. Otherwise, it has
2618 * to be changed.
2619 */
2620 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2621 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2622 freemsg(mp);
2623 if (flags & TH_RST)
2624 return;
2625 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2626 tcp, seg_ack, 0, TH_RST);
2627 return;
2628 }
2629 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2630 }
2631 if (flags & TH_RST) {
2632 if (flags & TH_ACK) {
2633 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2634 ip_xmit_attr_t *, connp->conn_ixa,
2635 void_ip_t *, iphdr, tcp_t *, tcp,
2636 tcph_t *, tcpha);
2637 (void) tcp_clean_death(tcp, ECONNREFUSED);
2638 }
2639 freemsg(mp);
2640 return;
2641 }
2642 if (!(flags & TH_SYN)) {
2643 freemsg(mp);
2644 return;
2645 }
2646
2647 /* Process all TCP options. */
2648 tcp_process_options(tcp, tcpha);
2649 /*
2650 * The following changes our rwnd to be a multiple of the
2651 * MIN(peer MSS, our MSS) for performance reason.
2652 */
2653 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2654 tcp->tcp_mss));
2655
2656 /* Is the other end ECN capable? */
2657 if (tcp->tcp_ecn_ok) {
2658 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2659 tcp->tcp_ecn_ok = B_FALSE;
2660 }
2661 }
2662 /*
2663 * Clear ECN flags because it may interfere with later
2664 * processing.
2665 */
2666 flags &= ~(TH_ECE|TH_CWR);
2667
2668 tcp->tcp_irs = seg_seq;
2669 tcp->tcp_rack = seg_seq;
2670 tcp->tcp_rnxt = seg_seq + 1;
2671 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2672 if (!TCP_IS_DETACHED(tcp)) {
2673 /* Allocate room for SACK options if needed. */
2674 connp->conn_wroff = connp->conn_ht_iphc_len;
2675 if (tcp->tcp_snd_sack_ok)
2676 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2677 if (!tcp->tcp_loopback)
2678 connp->conn_wroff += tcps->tcps_wroff_xtra;
2679
2680 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2681 connp->conn_wroff);
2682 }
2683 if (flags & TH_ACK) {
2684 /*
2685 * If we can't get the confirmation upstream, pretend
2686 * we didn't even see this one.
2687 *
2688 * XXX: how can we pretend we didn't see it if we
2689 * have updated rnxt et. al.
2690 *
2691 * For loopback we defer sending up the T_CONN_CON
2692 * until after some checks below.
2693 */
2694 mp1 = NULL;
2695 /*
2696 * tcp_sendmsg() checks tcp_state without entering
2697 * the squeue so tcp_state should be updated before
2698 * sending up connection confirmation. Probe the
2699 * state change below when we are sure the connection
2700 * confirmation has been sent.
2701 */
2702 tcp->tcp_state = TCPS_ESTABLISHED;
2703 if (!tcp_conn_con(tcp, iphdr, mp,
2704 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2705 tcp->tcp_state = TCPS_SYN_SENT;
2706 freemsg(mp);
2707 return;
2708 }
2709 TCPS_CONN_INC(tcps);
2710 /* SYN was acked - making progress */
2711 tcp->tcp_ip_forward_progress = B_TRUE;
2712
2713 /* One for the SYN */
2714 tcp->tcp_suna = tcp->tcp_iss + 1;
2715 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2716
2717 /*
2718 * If SYN was retransmitted, need to reset all
2719 * retransmission info. This is because this
2720 * segment will be treated as a dup ACK.
2721 */
2722 if (tcp->tcp_rexmit) {
2723 tcp->tcp_rexmit = B_FALSE;
2724 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2725 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2726 tcp->tcp_ms_we_have_waited = 0;
2727
2728 /*
2729 * Set tcp_cwnd back to 1 MSS, per
2730 * recommendation from
2731 * draft-floyd-incr-init-win-01.txt,
2732 * Increasing TCP's Initial Window.
2733 */
2734 DTRACE_PROBE3(cwnd__retransmitted__syn,
2735 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
2736 uint32_t, tcp->tcp_mss);
2737 tcp->tcp_cwnd = tcp->tcp_mss;
2738 }
2739
2740 tcp->tcp_swl1 = seg_seq;
2741 tcp->tcp_swl2 = seg_ack;
2742
2743 new_swnd = ntohs(tcpha->tha_win);
2744 tcp->tcp_swnd = new_swnd;
2745 if (new_swnd > tcp->tcp_max_swnd)
2746 tcp->tcp_max_swnd = new_swnd;
2747
2748 /*
2749 * Always send the three-way handshake ack immediately
2750 * in order to make the connection complete as soon as
2751 * possible on the accepting host.
2752 */
2753 flags |= TH_ACK_NEEDED;
2754
2755 /*
2756 * Trace connect-established here.
2757 */
2758 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2759 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2760 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2761
2762 /* Trace change from SYN_SENT -> ESTABLISHED here */
2763 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2764 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2765 void, NULL, int32_t, TCPS_SYN_SENT);
2766
2767 /*
2768 * Special case for loopback. At this point we have
2769 * received SYN-ACK from the remote endpoint. In
2770 * order to ensure that both endpoints reach the
2771 * fused state prior to any data exchange, the final
2772 * ACK needs to be sent before we indicate T_CONN_CON
2773 * to the module upstream.
2774 */
2775 if (tcp->tcp_loopback) {
2776 mblk_t *ack_mp;
2777
2778 ASSERT(!tcp->tcp_unfusable);
2779 ASSERT(mp1 != NULL);
2780 /*
2781 * For loopback, we always get a pure SYN-ACK
2782 * and only need to send back the final ACK
2783 * with no data (this is because the other
2784 * tcp is ours and we don't do T/TCP). This
2785 * final ACK triggers the passive side to
2786 * perform fusion in ESTABLISHED state.
2787 */
2788 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2789 if (tcp->tcp_ack_tid != 0) {
2790 (void) TCP_TIMER_CANCEL(tcp,
2791 tcp->tcp_ack_tid);
2792 tcp->tcp_ack_tid = 0;
2793 }
2794 tcp_send_data(tcp, ack_mp);
2795 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
2796 TCPS_BUMP_MIB(tcps, tcpOutAck);
2797
2798 if (!IPCL_IS_NONSTR(connp)) {
2799 /* Send up T_CONN_CON */
2800 if (ira->ira_cred != NULL) {
2801 mblk_setcred(mp1,
2802 ira->ira_cred,
2803 ira->ira_cpid);
2804 }
2805 putnext(connp->conn_rq, mp1);
2806 } else {
2807 (*sockupcalls->su_connected)
2808 (connp->conn_upper_handle,
2809 tcp->tcp_connid,
2810 ira->ira_cred,
2811 ira->ira_cpid);
2812 freemsg(mp1);
2813 }
2814
2815 freemsg(mp);
2816 return;
2817 }
2818 /*
2819 * Forget fusion; we need to handle more
2820 * complex cases below. Send the deferred
2821 * T_CONN_CON message upstream and proceed
2822 * as usual. Mark this tcp as not capable
2823 * of fusion.
2824 */
2825 TCP_STAT(tcps, tcp_fusion_unfusable);
2826 tcp->tcp_unfusable = B_TRUE;
2827 if (!IPCL_IS_NONSTR(connp)) {
2828 if (ira->ira_cred != NULL) {
2829 mblk_setcred(mp1, ira->ira_cred,
2830 ira->ira_cpid);
2831 }
2832 putnext(connp->conn_rq, mp1);
2833 } else {
2834 (*sockupcalls->su_connected)
2835 (connp->conn_upper_handle,
2836 tcp->tcp_connid, ira->ira_cred,
2837 ira->ira_cpid);
2838 freemsg(mp1);
2839 }
2840 }
2841
2842 /*
2843 * Check to see if there is data to be sent. If
2844 * yes, set the transmit flag. Then check to see
2845 * if received data processing needs to be done.
2846 * If not, go straight to xmit_check. This short
2847 * cut is OK as we don't support T/TCP.
2848 */
2849 if (tcp->tcp_unsent)
2850 flags |= TH_XMIT_NEEDED;
2851
2852 if (seg_len == 0 && !(flags & TH_URG)) {
2853 freemsg(mp);
2854 goto xmit_check;
2855 }
2856
2857 flags &= ~TH_SYN;
2858 seg_seq++;
2859 break;
2860 }
2861 tcp->tcp_state = TCPS_SYN_RCVD;
2862 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2863 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2864 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2865 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2866 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2867 if (mp1 != NULL) {
2868 tcp_send_data(tcp, mp1);
2869 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2870 }
2871 freemsg(mp);
2872 return;
2873 case TCPS_SYN_RCVD:
2874 if (flags & TH_ACK) {
2875 uint32_t pinit_wnd;
2876
2877 /*
2878 * In this state, a SYN|ACK packet is either bogus
2879 * because the other side must be ACKing our SYN which
2880 * indicates it has seen the ACK for their SYN and
2881 * shouldn't retransmit it or we're crossing SYNs
2882 * on active open.
2883 */
2884 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2885 freemsg(mp);
2886 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2887 tcp, seg_ack, 0, TH_RST);
2888 return;
2889 }
2890 /*
2891 * NOTE: RFC 793 pg. 72 says this should be
2892 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2893 * but that would mean we have an ack that ignored
2894 * our SYN.
2895 */
2896 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2897 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2898 freemsg(mp);
2899 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2900 tcp, seg_ack, 0, TH_RST);
2901 return;
2902 }
2903 /*
2904 * No sane TCP stack will send such a small window
2905 * without receiving any data. Just drop this invalid
2906 * ACK. We also shorten the abort timeout in case
2907 * this is an attack.
2908 */
2909 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2910 if (pinit_wnd < tcp->tcp_mss &&
2911 pinit_wnd < tcp_init_wnd_chk) {
2912 freemsg(mp);
2913 TCP_STAT(tcps, tcp_zwin_ack_syn);
2914 tcp->tcp_second_ctimer_threshold =
2915 tcp_early_abort * SECONDS;
2916 return;
2917 }
2918 }
2919 break;
2920 case TCPS_LISTEN:
2921 /*
2922 * Only a TLI listener can come through this path when a
2923 * acceptor is going back to be a listener and a packet
2924 * for the acceptor hits the classifier. For a socket
2925 * listener, this can never happen because a listener
2926 * can never accept connection on itself and hence a
2927 * socket acceptor can not go back to being a listener.
2928 */
2929 ASSERT(!TCP_IS_SOCKET(tcp));
2930 /*FALLTHRU*/
2931 case TCPS_CLOSED:
2932 case TCPS_BOUND: {
2933 conn_t *new_connp;
2934 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2935
2936 /*
2937 * Don't accept any input on a closed tcp as this TCP logically
2938 * does not exist on the system. Don't proceed further with
2939 * this TCP. For instance, this packet could trigger another
2940 * close of this tcp which would be disastrous for tcp_refcnt.
2941 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2942 * be called at most once on a TCP. In this case we need to
2943 * refeed the packet into the classifier and figure out where
2944 * the packet should go.
2945 */
2946 new_connp = ipcl_classify(mp, ira, ipst);
2947 if (new_connp != NULL) {
2948 /* Drops ref on new_connp */
2949 tcp_reinput(new_connp, mp, ira, ipst);
2950 return;
2951 }
2952 /* We failed to classify. For now just drop the packet */
2953 freemsg(mp);
2954 return;
2955 }
2956 case TCPS_IDLE:
2957 /*
2958 * Handle the case where the tcp_clean_death() has happened
2959 * on a connection (application hasn't closed yet) but a packet
2960 * was already queued on squeue before tcp_clean_death()
2961 * was processed. Calling tcp_clean_death() twice on same
2962 * connection can result in weird behaviour.
2963 */
2964 freemsg(mp);
2965 return;
2966 default:
2967 break;
2968 }
2969
2970 /*
2971 * Already on the correct queue/perimeter.
2972 * If this is a detached connection and not an eager
2973 * connection hanging off a listener then new data
2974 * (past the FIN) will cause a reset.
2975 * We do a special check here where it
2976 * is out of the main line, rather than check
2977 * if we are detached every time we see new
2978 * data down below.
2979 */
2980 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2981 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2982 TCPS_BUMP_MIB(tcps, tcpInClosed);
2983 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2984 freemsg(mp);
2985 tcp_xmit_ctl("new data when detached", tcp,
2986 tcp->tcp_snxt, 0, TH_RST);
2987 (void) tcp_clean_death(tcp, EPROTO);
2988 return;
2989 }
2990
2991 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2992 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2993 new_swnd = ntohs(tcpha->tha_win) <<
2994 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2995
2996 /*
2997 * We are interested in two TCP options: timestamps (if negotiated) and
2998 * SACK (if negotiated). Skip option parsing if neither is negotiated.
2999 */
3000 if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok) {
3001 int options;
3002 if (tcp->tcp_snd_sack_ok)
3003 tcpopt.tcp = tcp;
3004 else
3005 tcpopt.tcp = NULL;
3006 options = tcp_parse_options(tcpha, &tcpopt);
3007 /*
3008 * RST segments must not be subject to PAWS and are not
3009 * required to have timestamps.
3010 * We do not drop keepalive segments without
3011 * timestamps, to maintain compatibility with legacy TCP stacks.
3012 */
3013 boolean_t keepalive = (seg_len == 0 || seg_len == 1) &&
3014 (seg_seq + 1 == tcp->tcp_rnxt);
3015 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) {
3016 /*
3017 * Per RFC 7323 section 3.2., silently drop non-RST
3018 * segments without expected TSopt. This is a 'SHOULD'
3019 * requirement.
3020 * We accept keepalives without TSopt to maintain
3021 * interoperability with tcp implementations that omit
3022 * the TSopt on these. Keepalive data is discarded, so
3023 * there is no risk corrupting data by accepting these.
3024 */
3025 if (!(options & TCP_OPT_TSTAMP_PRESENT)) {
3026 /*
3027 * Leave a breadcrumb for people to detect this
3028 * behavior.
3029 */
3030 DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp);
3031 freemsg(mp);
3032 return;
3033 }
3034
3035 if (!tcp_paws_check(tcp, &tcpopt)) {
3036 /*
3037 * This segment is not acceptable.
3038 * Drop it and send back an ACK.
3039 */
3040 freemsg(mp);
3041 flags |= TH_ACK_NEEDED;
3042 goto ack_check;
3043 }
3044 }
3045 }
3046 try_again:;
3047 mss = tcp->tcp_mss;
3048 gap = seg_seq - tcp->tcp_rnxt;
3049 rgap = tcp->tcp_rwnd - (gap + seg_len);
3050 /*
3051 * gap is the amount of sequence space between what we expect to see
3052 * and what we got for seg_seq. A positive value for gap means
3053 * something got lost. A negative value means we got some old stuff.
3054 */
3055 if (gap < 0) {
3056 /* Old stuff present. Is the SYN in there? */
3057 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
3058 (seg_len != 0)) {
3059 flags &= ~TH_SYN;
3060 seg_seq++;
3061 urp--;
3062 /* Recompute the gaps after noting the SYN. */
3063 goto try_again;
3064 }
3065 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
3066 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
3067 (seg_len > -gap ? -gap : seg_len));
3068 /* Remove the old stuff from seg_len. */
3069 seg_len += gap;
3070 /*
3071 * Anything left?
3072 * Make sure to check for unack'd FIN when rest of data
3073 * has been previously ack'd.
3074 */
3075 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
3076 /*
3077 * Resets are only valid if they lie within our offered
3078 * window. If the RST bit is set, we just ignore this
3079 * segment.
3080 */
3081 if (flags & TH_RST) {
3082 freemsg(mp);
3083 return;
3084 }
3085
3086 /*
3087 * The arriving of dup data packets indicate that we
3088 * may have postponed an ack for too long, or the other
3089 * side's RTT estimate is out of shape. Start acking
3090 * more often.
3091 */
3092 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
3093 tcp->tcp_rack_cnt >= 1 &&
3094 tcp->tcp_rack_abs_max > 2) {
3095 tcp->tcp_rack_abs_max--;
3096 }
3097 tcp->tcp_rack_cur_max = 1;
3098
3099 /*
3100 * This segment is "unacceptable". None of its
3101 * sequence space lies within our advertized window.
3102 *
3103 * Adjust seg_len to the original value for tracing.
3104 */
3105 seg_len -= gap;
3106 if (connp->conn_debug) {
3107 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3108 "tcp_rput: unacceptable, gap %d, rgap %d, "
3109 "flags 0x%x, seg_seq %u, seg_ack %u, "
3110 "seg_len %d, rnxt %u, snxt %u, %s",
3111 gap, rgap, flags, seg_seq, seg_ack,
3112 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3113 tcp_display(tcp, NULL,
3114 DISP_ADDR_AND_PORT));
3115 }
3116
3117 /*
3118 * Arrange to send an ACK in response to the
3119 * unacceptable segment per RFC 793 page 69. There
3120 * is only one small difference between ours and the
3121 * acceptability test in the RFC - we accept ACK-only
3122 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3123 * will be generated.
3124 *
3125 * Note that we have to ACK an ACK-only packet at least
3126 * for stacks that send 0-length keep-alives with
3127 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3128 * section 4.2.3.6. As long as we don't ever generate
3129 * an unacceptable packet in response to an incoming
3130 * packet that is unacceptable, it should not cause
3131 * "ACK wars".
3132 */
3133 flags |= TH_ACK_NEEDED;
3134
3135 /*
3136 * Continue processing this segment in order to use the
3137 * ACK information it contains, but skip all other
3138 * sequence-number processing. Processing the ACK
3139 * information is necessary in order to
3140 * re-synchronize connections that may have lost
3141 * synchronization.
3142 *
3143 * We clear seg_len and flag fields related to
3144 * sequence number processing as they are not
3145 * to be trusted for an unacceptable segment.
3146 */
3147 seg_len = 0;
3148 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3149 goto process_ack;
3150 }
3151
3152 /* Fix seg_seq, and chew the gap off the front. */
3153 seg_seq = tcp->tcp_rnxt;
3154 urp += gap;
3155 do {
3156 mblk_t *mp2;
3157 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3158 (uintptr_t)UINT_MAX);
3159 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3160 if (gap > 0) {
3161 mp->b_rptr = mp->b_wptr - gap;
3162 break;
3163 }
3164 mp2 = mp;
3165 mp = mp->b_cont;
3166 freeb(mp2);
3167 } while (gap < 0);
3168 /*
3169 * If the urgent data has already been acknowledged, we
3170 * should ignore TH_URG below
3171 */
3172 if (urp < 0)
3173 flags &= ~TH_URG;
3174 }
3175 /*
3176 * rgap is the amount of stuff received out of window. A negative
3177 * value is the amount out of window.
3178 */
3179 if (rgap < 0) {
3180 mblk_t *mp2;
3181
3182 if (tcp->tcp_rwnd == 0) {
3183 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3184 tcp->tcp_cs.tcp_in_zwnd_probes++;
3185 } else {
3186 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3187 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3188 }
3189
3190 /*
3191 * seg_len does not include the FIN, so if more than
3192 * just the FIN is out of window, we act like we don't
3193 * see it. (If just the FIN is out of window, rgap
3194 * will be zero and we will go ahead and acknowledge
3195 * the FIN.)
3196 */
3197 flags &= ~TH_FIN;
3198
3199 /* Fix seg_len and make sure there is something left. */
3200 seg_len += rgap;
3201 if (seg_len <= 0) {
3202 /*
3203 * Resets are only valid if they lie within our offered
3204 * window. If the RST bit is set, we just ignore this
3205 * segment.
3206 */
3207 if (flags & TH_RST) {
3208 freemsg(mp);
3209 return;
3210 }
3211
3212 /* Per RFC 793, we need to send back an ACK. */
3213 flags |= TH_ACK_NEEDED;
3214
3215 /*
3216 * Send SIGURG as soon as possible i.e. even
3217 * if the TH_URG was delivered in a window probe
3218 * packet (which will be unacceptable).
3219 *
3220 * We generate a signal if none has been generated
3221 * for this connection or if this is a new urgent
3222 * byte. Also send a zero-length "unmarked" message
3223 * to inform SIOCATMARK that this is not the mark.
3224 *
3225 * tcp_urp_last_valid is cleared when the T_exdata_ind
3226 * is sent up. This plus the check for old data
3227 * (gap >= 0) handles the wraparound of the sequence
3228 * number space without having to always track the
3229 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3230 * this max in its rcv_up variable).
3231 *
3232 * This prevents duplicate SIGURGS due to a "late"
3233 * zero-window probe when the T_EXDATA_IND has already
3234 * been sent up.
3235 */
3236 if ((flags & TH_URG) &&
3237 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3238 tcp->tcp_urp_last))) {
3239 if (IPCL_IS_NONSTR(connp)) {
3240 if (!TCP_IS_DETACHED(tcp)) {
3241 (*sockupcalls->su_signal_oob)
3242 (connp->conn_upper_handle,
3243 urp);
3244 }
3245 } else {
3246 mp1 = allocb(0, BPRI_MED);
3247 if (mp1 == NULL) {
3248 freemsg(mp);
3249 return;
3250 }
3251 if (!TCP_IS_DETACHED(tcp) &&
3252 !putnextctl1(connp->conn_rq,
3253 M_PCSIG, SIGURG)) {
3254 /* Try again on the rexmit. */
3255 freemsg(mp1);
3256 freemsg(mp);
3257 return;
3258 }
3259 /*
3260 * If the next byte would be the mark
3261 * then mark with MARKNEXT else mark
3262 * with NOTMARKNEXT.
3263 */
3264 if (gap == 0 && urp == 0)
3265 mp1->b_flag |= MSGMARKNEXT;
3266 else
3267 mp1->b_flag |= MSGNOTMARKNEXT;
3268 freemsg(tcp->tcp_urp_mark_mp);
3269 tcp->tcp_urp_mark_mp = mp1;
3270 flags |= TH_SEND_URP_MARK;
3271 }
3272 tcp->tcp_urp_last_valid = B_TRUE;
3273 tcp->tcp_urp_last = urp + seg_seq;
3274 }
3275 /*
3276 * If this is a zero window probe, continue to
3277 * process the ACK part. But we need to set seg_len
3278 * to 0 to avoid data processing. Otherwise just
3279 * drop the segment and send back an ACK.
3280 */
3281 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3282 flags &= ~(TH_SYN | TH_URG);
3283 seg_len = 0;
3284 goto process_ack;
3285 } else {
3286 freemsg(mp);
3287 goto ack_check;
3288 }
3289 }
3290 /* Pitch out of window stuff off the end. */
3291 rgap = seg_len;
3292 mp2 = mp;
3293 do {
3294 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3295 (uintptr_t)INT_MAX);
3296 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3297 if (rgap < 0) {
3298 mp2->b_wptr += rgap;
3299 if ((mp1 = mp2->b_cont) != NULL) {
3300 mp2->b_cont = NULL;
3301 freemsg(mp1);
3302 }
3303 break;
3304 }
3305 } while ((mp2 = mp2->b_cont) != NULL);
3306 }
3307 ok:;
3308 /*
3309 * TCP should check ECN info for segments inside the window only.
3310 * Therefore the check should be done here.
3311 */
3312 if (tcp->tcp_ecn_ok) {
3313 if (flags & TH_CWR) {
3314 tcp->tcp_ecn_echo_on = B_FALSE;
3315 }
3316 /*
3317 * Note that both ECN_CE and CWR can be set in the
3318 * same segment. In this case, we once again turn
3319 * on ECN_ECHO.
3320 */
3321 if (connp->conn_ipversion == IPV4_VERSION) {
3322 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3323
3324 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3325 tcp->tcp_ecn_echo_on = B_TRUE;
3326 }
3327 } else {
3328 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3329
3330 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3331 htonl(IPH_ECN_CE << 20)) {
3332 tcp->tcp_ecn_echo_on = B_TRUE;
3333 }
3334 }
3335 }
3336
3337 /*
3338 * Check whether we can update tcp_ts_recent. This test is from RFC
3339 * 7323, section 5.3.
3340 */
3341 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) &&
3342 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3343 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3344 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3345 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3346 }
3347
3348 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3349 /*
3350 * FIN in an out of order segment. We record this in
3351 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3352 * Clear the FIN so that any check on FIN flag will fail.
3353 * Remember that FIN also counts in the sequence number
3354 * space. So we need to ack out of order FIN only segments.
3355 */
3356 if (flags & TH_FIN) {
3357 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3358 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3359 flags &= ~TH_FIN;
3360 flags |= TH_ACK_NEEDED;
3361 }
3362 if (seg_len > 0) {
3363 /* Fill in the SACK blk list. */
3364 if (tcp->tcp_snd_sack_ok) {
3365 tcp_sack_insert(tcp->tcp_sack_list,
3366 seg_seq, seg_seq + seg_len,
3367 &(tcp->tcp_num_sack_blk));
3368 }
3369
3370 /*
3371 * Attempt reassembly and see if we have something
3372 * ready to go.
3373 */
3374 mp = tcp_reass(tcp, mp, seg_seq);
3375 /* Always ack out of order packets */
3376 flags |= TH_ACK_NEEDED | TH_PUSH;
3377 if (mp) {
3378 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3379 (uintptr_t)INT_MAX);
3380 seg_len = mp->b_cont ? msgdsize(mp) :
3381 (int)(mp->b_wptr - mp->b_rptr);
3382 seg_seq = tcp->tcp_rnxt;
3383 /*
3384 * A gap is filled and the seq num and len
3385 * of the gap match that of a previously
3386 * received FIN, put the FIN flag back in.
3387 */
3388 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3389 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3390 flags |= TH_FIN;
3391 tcp->tcp_valid_bits &=
3392 ~TCP_OFO_FIN_VALID;
3393 }
3394 if (tcp->tcp_reass_tid != 0) {
3395 (void) TCP_TIMER_CANCEL(tcp,
3396 tcp->tcp_reass_tid);
3397 /*
3398 * Restart the timer if there is still
3399 * data in the reassembly queue.
3400 */
3401 if (tcp->tcp_reass_head != NULL) {
3402 tcp->tcp_reass_tid = TCP_TIMER(
3403 tcp, tcp_reass_timer,
3404 tcps->tcps_reass_timeout);
3405 } else {
3406 tcp->tcp_reass_tid = 0;
3407 }
3408 }
3409 } else {
3410 /*
3411 * Keep going even with NULL mp.
3412 * There may be a useful ACK or something else
3413 * we don't want to miss.
3414 *
3415 * But TCP should not perform fast retransmit
3416 * because of the ack number. TCP uses
3417 * seg_len == 0 to determine if it is a pure
3418 * ACK. And this is not a pure ACK.
3419 */
3420 seg_len = 0;
3421 ofo_seg = B_TRUE;
3422
3423 if (tcps->tcps_reass_timeout != 0 &&
3424 tcp->tcp_reass_tid == 0) {
3425 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3426 tcp_reass_timer,
3427 tcps->tcps_reass_timeout);
3428 }
3429 }
3430 }
3431 } else if (seg_len > 0) {
3432 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3433 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3434 tcp->tcp_cs.tcp_in_data_inorder_segs++;
3435 tcp->tcp_cs.tcp_in_data_inorder_bytes += seg_len;
3436
3437 /*
3438 * If an out of order FIN was received before, and the seq
3439 * num and len of the new segment match that of the FIN,
3440 * put the FIN flag back in.
3441 */
3442 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3443 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3444 flags |= TH_FIN;
3445 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3446 }
3447 }
3448 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3449 if (flags & TH_RST) {
3450 freemsg(mp);
3451 switch (tcp->tcp_state) {
3452 case TCPS_SYN_RCVD:
3453 (void) tcp_clean_death(tcp, ECONNREFUSED);
3454 break;
3455 case TCPS_ESTABLISHED:
3456 case TCPS_FIN_WAIT_1:
3457 case TCPS_FIN_WAIT_2:
3458 case TCPS_CLOSE_WAIT:
3459 (void) tcp_clean_death(tcp, ECONNRESET);
3460 break;
3461 case TCPS_CLOSING:
3462 case TCPS_LAST_ACK:
3463 (void) tcp_clean_death(tcp, 0);
3464 break;
3465 default:
3466 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3467 (void) tcp_clean_death(tcp, ENXIO);
3468 break;
3469 }
3470 return;
3471 }
3472 if (flags & TH_SYN) {
3473 /*
3474 * See RFC 793, Page 71
3475 *
3476 * The seq number must be in the window as it should
3477 * be "fixed" above. If it is outside window, it should
3478 * be already rejected. Note that we allow seg_seq to be
3479 * rnxt + rwnd because we want to accept 0 window probe.
3480 */
3481 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3482 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3483 freemsg(mp);
3484 /*
3485 * If the ACK flag is not set, just use our snxt as the
3486 * seq number of the RST segment.
3487 */
3488 if (!(flags & TH_ACK)) {
3489 seg_ack = tcp->tcp_snxt;
3490 }
3491 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3492 TH_RST|TH_ACK);
3493 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3494 (void) tcp_clean_death(tcp, ECONNRESET);
3495 return;
3496 }
3497 /*
3498 * urp could be -1 when the urp field in the packet is 0
3499 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3500 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3501 */
3502 if ((flags & TH_URG) && urp >= 0) {
3503 if (!tcp->tcp_urp_last_valid ||
3504 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3505 /*
3506 * Non-STREAMS sockets handle the urgent data a litte
3507 * differently from STREAMS based sockets. There is no
3508 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3509 * flags to keep SIOCATMARK happy. Instead a
3510 * su_signal_oob upcall is made to update the mark.
3511 * Neither is a T_EXDATA_IND mblk needed to be
3512 * prepended to the urgent data. The urgent data is
3513 * delivered using the su_recv upcall, where we set
3514 * the MSG_OOB flag to indicate that it is urg data.
3515 *
3516 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3517 * are used by non-STREAMS sockets.
3518 */
3519 if (IPCL_IS_NONSTR(connp)) {
3520 if (!TCP_IS_DETACHED(tcp)) {
3521 (*sockupcalls->su_signal_oob)
3522 (connp->conn_upper_handle, urp);
3523 }
3524 } else {
3525 /*
3526 * If we haven't generated the signal yet for
3527 * this urgent pointer value, do it now. Also,
3528 * send up a zero-length M_DATA indicating
3529 * whether or not this is the mark. The latter
3530 * is not needed when a T_EXDATA_IND is sent up.
3531 * However, if there are allocation failures
3532 * this code relies on the sender retransmitting
3533 * and the socket code for determining the mark
3534 * should not block waiting for the peer to
3535 * transmit. Thus, for simplicity we always
3536 * send up the mark indication.
3537 */
3538 mp1 = allocb(0, BPRI_MED);
3539 if (mp1 == NULL) {
3540 freemsg(mp);
3541 return;
3542 }
3543 if (!TCP_IS_DETACHED(tcp) &&
3544 !putnextctl1(connp->conn_rq, M_PCSIG,
3545 SIGURG)) {
3546 /* Try again on the rexmit. */
3547 freemsg(mp1);
3548 freemsg(mp);
3549 return;
3550 }
3551 /*
3552 * Mark with NOTMARKNEXT for now.
3553 * The code below will change this to MARKNEXT
3554 * if we are at the mark.
3555 *
3556 * If there are allocation failures (e.g. in
3557 * dupmsg below) the next time tcp_input_data
3558 * sees the urgent segment it will send up the
3559 * MSGMARKNEXT message.
3560 */
3561 mp1->b_flag |= MSGNOTMARKNEXT;
3562 freemsg(tcp->tcp_urp_mark_mp);
3563 tcp->tcp_urp_mark_mp = mp1;
3564 flags |= TH_SEND_URP_MARK;
3565 #ifdef DEBUG
3566 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3567 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3568 "last %x, %s",
3569 seg_seq, urp, tcp->tcp_urp_last,
3570 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3571 #endif /* DEBUG */
3572 }
3573 tcp->tcp_urp_last_valid = B_TRUE;
3574 tcp->tcp_urp_last = urp + seg_seq;
3575 } else if (tcp->tcp_urp_mark_mp != NULL) {
3576 /*
3577 * An allocation failure prevented the previous
3578 * tcp_input_data from sending up the allocated
3579 * MSG*MARKNEXT message - send it up this time
3580 * around.
3581 */
3582 flags |= TH_SEND_URP_MARK;
3583 }
3584
3585 /*
3586 * If the urgent byte is in this segment, make sure that it is
3587 * all by itself. This makes it much easier to deal with the
3588 * possibility of an allocation failure on the T_exdata_ind.
3589 * Note that seg_len is the number of bytes in the segment, and
3590 * urp is the offset into the segment of the urgent byte.
3591 * urp < seg_len means that the urgent byte is in this segment.
3592 */
3593 if (urp < seg_len) {
3594 if (seg_len != 1) {
3595 uint32_t tmp_rnxt;
3596 /*
3597 * Break it up and feed it back in.
3598 * Re-attach the IP header.
3599 */
3600 mp->b_rptr = iphdr;
3601 if (urp > 0) {
3602 /*
3603 * There is stuff before the urgent
3604 * byte.
3605 */
3606 mp1 = dupmsg(mp);
3607 if (!mp1) {
3608 /*
3609 * Trim from urgent byte on.
3610 * The rest will come back.
3611 */
3612 (void) adjmsg(mp,
3613 urp - seg_len);
3614 tcp_input_data(connp,
3615 mp, NULL, ira);
3616 return;
3617 }
3618 (void) adjmsg(mp1, urp - seg_len);
3619 /* Feed this piece back in. */
3620 tmp_rnxt = tcp->tcp_rnxt;
3621 tcp_input_data(connp, mp1, NULL, ira);
3622 /*
3623 * If the data passed back in was not
3624 * processed (ie: bad ACK) sending
3625 * the remainder back in will cause a
3626 * loop. In this case, drop the
3627 * packet and let the sender try
3628 * sending a good packet.
3629 */
3630 if (tmp_rnxt == tcp->tcp_rnxt) {
3631 freemsg(mp);
3632 return;
3633 }
3634 }
3635 if (urp != seg_len - 1) {
3636 uint32_t tmp_rnxt;
3637 /*
3638 * There is stuff after the urgent
3639 * byte.
3640 */
3641 mp1 = dupmsg(mp);
3642 if (!mp1) {
3643 /*
3644 * Trim everything beyond the
3645 * urgent byte. The rest will
3646 * come back.
3647 */
3648 (void) adjmsg(mp,
3649 urp + 1 - seg_len);
3650 tcp_input_data(connp,
3651 mp, NULL, ira);
3652 return;
3653 }
3654 (void) adjmsg(mp1, urp + 1 - seg_len);
3655 tmp_rnxt = tcp->tcp_rnxt;
3656 tcp_input_data(connp, mp1, NULL, ira);
3657 /*
3658 * If the data passed back in was not
3659 * processed (ie: bad ACK) sending
3660 * the remainder back in will cause a
3661 * loop. In this case, drop the
3662 * packet and let the sender try
3663 * sending a good packet.
3664 */
3665 if (tmp_rnxt == tcp->tcp_rnxt) {
3666 freemsg(mp);
3667 return;
3668 }
3669 }
3670 tcp_input_data(connp, mp, NULL, ira);
3671 return;
3672 }
3673 /*
3674 * This segment contains only the urgent byte. We
3675 * have to allocate the T_exdata_ind, if we can.
3676 */
3677 if (IPCL_IS_NONSTR(connp)) {
3678 int error;
3679
3680 (*sockupcalls->su_recv)
3681 (connp->conn_upper_handle, mp, seg_len,
3682 MSG_OOB, &error, NULL);
3683 /*
3684 * We should never be in middle of a
3685 * fallback, the squeue guarantees that.
3686 */
3687 ASSERT(error != EOPNOTSUPP);
3688 mp = NULL;
3689 goto update_ack;
3690 } else if (!tcp->tcp_urp_mp) {
3691 struct T_exdata_ind *tei;
3692 mp1 = allocb(sizeof (struct T_exdata_ind),
3693 BPRI_MED);
3694 if (!mp1) {
3695 /*
3696 * Sigh... It'll be back.
3697 * Generate any MSG*MARK message now.
3698 */
3699 freemsg(mp);
3700 seg_len = 0;
3701 if (flags & TH_SEND_URP_MARK) {
3702
3703
3704 ASSERT(tcp->tcp_urp_mark_mp);
3705 tcp->tcp_urp_mark_mp->b_flag &=
3706 ~MSGNOTMARKNEXT;
3707 tcp->tcp_urp_mark_mp->b_flag |=
3708 MSGMARKNEXT;
3709 }
3710 goto ack_check;
3711 }
3712 mp1->b_datap->db_type = M_PROTO;
3713 tei = (struct T_exdata_ind *)mp1->b_rptr;
3714 tei->PRIM_type = T_EXDATA_IND;
3715 tei->MORE_flag = 0;
3716 mp1->b_wptr = (uchar_t *)&tei[1];
3717 tcp->tcp_urp_mp = mp1;
3718 #ifdef DEBUG
3719 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3720 "tcp_rput: allocated exdata_ind %s",
3721 tcp_display(tcp, NULL,
3722 DISP_PORT_ONLY));
3723 #endif /* DEBUG */
3724 /*
3725 * There is no need to send a separate MSG*MARK
3726 * message since the T_EXDATA_IND will be sent
3727 * now.
3728 */
3729 flags &= ~TH_SEND_URP_MARK;
3730 freemsg(tcp->tcp_urp_mark_mp);
3731 tcp->tcp_urp_mark_mp = NULL;
3732 }
3733 /*
3734 * Now we are all set. On the next putnext upstream,
3735 * tcp_urp_mp will be non-NULL and will get prepended
3736 * to what has to be this piece containing the urgent
3737 * byte. If for any reason we abort this segment below,
3738 * if it comes back, we will have this ready, or it
3739 * will get blown off in close.
3740 */
3741 } else if (urp == seg_len) {
3742 /*
3743 * The urgent byte is the next byte after this sequence
3744 * number. If this endpoint is non-STREAMS, then there
3745 * is nothing to do here since the socket has already
3746 * been notified about the urg pointer by the
3747 * su_signal_oob call above.
3748 *
3749 * In case of STREAMS, some more work might be needed.
3750 * If there is data it is marked with MSGMARKNEXT and
3751 * and any tcp_urp_mark_mp is discarded since it is not
3752 * needed. Otherwise, if the code above just allocated
3753 * a zero-length tcp_urp_mark_mp message, that message
3754 * is tagged with MSGMARKNEXT. Sending up these
3755 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3756 * even though the T_EXDATA_IND will not be sent up
3757 * until the urgent byte arrives.
3758 */
3759 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3760 if (seg_len != 0) {
3761 flags |= TH_MARKNEXT_NEEDED;
3762 freemsg(tcp->tcp_urp_mark_mp);
3763 tcp->tcp_urp_mark_mp = NULL;
3764 flags &= ~TH_SEND_URP_MARK;
3765 } else if (tcp->tcp_urp_mark_mp != NULL) {
3766 flags |= TH_SEND_URP_MARK;
3767 tcp->tcp_urp_mark_mp->b_flag &=
3768 ~MSGNOTMARKNEXT;
3769 tcp->tcp_urp_mark_mp->b_flag |=
3770 MSGMARKNEXT;
3771 }
3772 }
3773 #ifdef DEBUG
3774 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3775 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3776 seg_len, flags,
3777 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3778 #endif /* DEBUG */
3779 }
3780 #ifdef DEBUG
3781 else {
3782 /* Data left until we hit mark */
3783 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3784 "tcp_rput: URP %d bytes left, %s",
3785 urp - seg_len, tcp_display(tcp, NULL,
3786 DISP_PORT_ONLY));
3787 }
3788 #endif /* DEBUG */
3789 }
3790
3791 process_ack:
3792 if (!(flags & TH_ACK)) {
3793 freemsg(mp);
3794 goto xmit_check;
3795 }
3796 }
3797 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3798
3799 if (bytes_acked > 0)
3800 tcp->tcp_ip_forward_progress = B_TRUE;
3801 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3802 /*
3803 * tcp_sendmsg() checks tcp_state without entering
3804 * the squeue so tcp_state should be updated before
3805 * sending up a connection confirmation or a new
3806 * connection indication.
3807 */
3808 tcp->tcp_state = TCPS_ESTABLISHED;
3809
3810 /*
3811 * We are seeing the final ack in the three way
3812 * hand shake of a active open'ed connection
3813 * so we must send up a T_CONN_CON
3814 */
3815 if (tcp->tcp_active_open) {
3816 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3817 freemsg(mp);
3818 tcp->tcp_state = TCPS_SYN_RCVD;
3819 return;
3820 }
3821 /*
3822 * Don't fuse the loopback endpoints for
3823 * simultaneous active opens.
3824 */
3825 if (tcp->tcp_loopback) {
3826 TCP_STAT(tcps, tcp_fusion_unfusable);
3827 tcp->tcp_unfusable = B_TRUE;
3828 }
3829 /*
3830 * For simultaneous active open, trace receipt of final
3831 * ACK as tcp:::connect-established.
3832 */
3833 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3834 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3835 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3836 } else if (IPCL_IS_NONSTR(connp)) {
3837 /*
3838 * 3-way handshake has completed, so notify socket
3839 * of the new connection.
3840 *
3841 * We are here means eager is fine but it can
3842 * get a TH_RST at any point between now and till
3843 * accept completes and disappear. We need to
3844 * ensure that reference to eager is valid after
3845 * we get out of eager's perimeter. So we do
3846 * an extra refhold.
3847 */
3848 CONN_INC_REF(connp);
3849
3850 if (!tcp_newconn_notify(tcp, ira)) {
3851 /*
3852 * The state-change probe for SYN_RCVD ->
3853 * ESTABLISHED has not fired yet. We reset
3854 * the state to SYN_RCVD so that future
3855 * state-change probes report correct state
3856 * transistions.
3857 */
3858 tcp->tcp_state = TCPS_SYN_RCVD;
3859 freemsg(mp);
3860 /* notification did not go up, so drop ref */
3861 CONN_DEC_REF(connp);
3862 /* ... and close the eager */
3863 ASSERT(TCP_IS_DETACHED(tcp));
3864 (void) tcp_close_detached(tcp);
3865 return;
3866 }
3867 /*
3868 * tcp_newconn_notify() changes conn_upcalls and
3869 * connp->conn_upper_handle. Fix things now, in case
3870 * there's data attached to this ack.
3871 */
3872 if (connp->conn_upcalls != NULL)
3873 sockupcalls = connp->conn_upcalls;
3874 /*
3875 * For passive open, trace receipt of final ACK as
3876 * tcp:::accept-established.
3877 */
3878 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3879 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3880 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3881 } else {
3882 /*
3883 * 3-way handshake complete - this is a STREAMS based
3884 * socket, so pass up the T_CONN_IND.
3885 */
3886 tcp_t *listener = tcp->tcp_listener;
3887 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3888
3889 tcp->tcp_tconnind_started = B_TRUE;
3890 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3891 ASSERT(mp != NULL);
3892 /*
3893 * We are here means eager is fine but it can
3894 * get a TH_RST at any point between now and till
3895 * accept completes and disappear. We need to
3896 * ensure that reference to eager is valid after
3897 * we get out of eager's perimeter. So we do
3898 * an extra refhold.
3899 */
3900 CONN_INC_REF(connp);
3901
3902 /*
3903 * The listener also exists because of the refhold
3904 * done in tcp_input_listener. Its possible that it
3905 * might have closed. We will check that once we
3906 * get inside listeners context.
3907 */
3908 CONN_INC_REF(listener->tcp_connp);
3909 if (listener->tcp_connp->conn_sqp ==
3910 connp->conn_sqp) {
3911 /*
3912 * We optimize by not calling an SQUEUE_ENTER
3913 * on the listener since we know that the
3914 * listener and eager squeues are the same.
3915 * We are able to make this check safely only
3916 * because neither the eager nor the listener
3917 * can change its squeue. Only an active connect
3918 * can change its squeue
3919 */
3920 tcp_send_conn_ind(listener->tcp_connp, mp,
3921 listener->tcp_connp->conn_sqp);
3922 CONN_DEC_REF(listener->tcp_connp);
3923 } else if (!tcp->tcp_loopback) {
3924 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3925 mp, tcp_send_conn_ind,
3926 listener->tcp_connp, NULL, SQ_FILL,
3927 SQTAG_TCP_CONN_IND);
3928 } else {
3929 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3930 mp, tcp_send_conn_ind,
3931 listener->tcp_connp, NULL, SQ_NODRAIN,
3932 SQTAG_TCP_CONN_IND);
3933 }
3934 /*
3935 * For passive open, trace receipt of final ACK as
3936 * tcp:::accept-established.
3937 */
3938 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3939 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3940 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3941 }
3942 TCPS_CONN_INC(tcps);
3943
3944 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3945 bytes_acked--;
3946 /* SYN was acked - making progress */
3947 tcp->tcp_ip_forward_progress = B_TRUE;
3948
3949 /*
3950 * If SYN was retransmitted, need to reset all
3951 * retransmission info as this segment will be
3952 * treated as a dup ACK.
3953 */
3954 if (tcp->tcp_rexmit) {
3955 tcp->tcp_rexmit = B_FALSE;
3956 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3957 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3958 tcp->tcp_ms_we_have_waited = 0;
3959 DTRACE_PROBE3(cwnd__retransmitted__syn,
3960 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
3961 uint32_t, tcp->tcp_mss);
3962 tcp->tcp_cwnd = mss;
3963 }
3964
3965 /*
3966 * We set the send window to zero here.
3967 * This is needed if there is data to be
3968 * processed already on the queue.
3969 * Later (at swnd_update label), the
3970 * "new_swnd > tcp_swnd" condition is satisfied
3971 * the XMIT_NEEDED flag is set in the current
3972 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3973 * called if there is already data on queue in
3974 * this state.
3975 */
3976 tcp->tcp_swnd = 0;
3977
3978 if (new_swnd > tcp->tcp_max_swnd)
3979 tcp->tcp_max_swnd = new_swnd;
3980 tcp->tcp_swl1 = seg_seq;
3981 tcp->tcp_swl2 = seg_ack;
3982 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3983
3984 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3985 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3986 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3987 int32_t, TCPS_SYN_RCVD);
3988
3989 /* Fuse when both sides are in ESTABLISHED state */
3990 if (tcp->tcp_loopback && do_tcp_fusion)
3991 tcp_fuse(tcp, iphdr, tcpha);
3992
3993 }
3994 /* This code follows 4.4BSD-Lite2 mostly. */
3995 if (bytes_acked < 0)
3996 goto est;
3997
3998 /*
3999 * If TCP is ECN capable and the congestion experience bit is
4000 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
4001 * done once per window (or more loosely, per RTT).
4002 */
4003 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
4004 tcp->tcp_cwr = B_FALSE;
4005 if (tcp->tcp_ecn_ok && (flags & TH_ECE) && !tcp->tcp_cwr) {
4006 cc_cong_signal(tcp, seg_ack, CC_ECN);
4007 /*
4008 * If the cwnd is 0, use the timer to clock out
4009 * new segments. This is required by the ECN spec.
4010 */
4011 if (tcp->tcp_cwnd == 0)
4012 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4013 tcp->tcp_cwr = B_TRUE;
4014 /*
4015 * This marks the end of the current window of in
4016 * flight data. That is why we don't use
4017 * tcp_suna + tcp_swnd. Only data in flight can
4018 * provide ECN info.
4019 */
4020 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
4021 }
4022
4023 mp1 = tcp->tcp_xmit_head;
4024 if (bytes_acked == 0) {
4025 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
4026 int dupack_cnt;
4027
4028 TCPS_BUMP_MIB(tcps, tcpInDupAck);
4029 /*
4030 * Fast retransmit. When we have seen exactly three
4031 * identical ACKs while we have unacked data
4032 * outstanding we take it as a hint that our peer
4033 * dropped something.
4034 *
4035 * If TCP is retransmitting, don't do fast retransmit.
4036 */
4037 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
4038 ! tcp->tcp_rexmit) {
4039 /* Do Limited Transmit */
4040 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
4041 tcps->tcps_dupack_fast_retransmit) {
4042 cc_ack_received(tcp, seg_ack,
4043 bytes_acked, CC_DUPACK);
4044 /*
4045 * RFC 3042
4046 *
4047 * What we need to do is temporarily
4048 * increase tcp_cwnd so that new
4049 * data can be sent if it is allowed
4050 * by the receive window (tcp_rwnd).
4051 * tcp_wput_data() will take care of
4052 * the rest.
4053 *
4054 * If the connection is SACK capable,
4055 * only do limited xmit when there
4056 * is SACK info.
4057 *
4058 * Note how tcp_cwnd is incremented.
4059 * The first dup ACK will increase
4060 * it by 1 MSS. The second dup ACK
4061 * will increase it by 2 MSS. This
4062 * means that only 1 new segment will
4063 * be sent for each dup ACK.
4064 */
4065 if (tcp->tcp_unsent > 0 &&
4066 (!tcp->tcp_snd_sack_ok ||
4067 (tcp->tcp_snd_sack_ok &&
4068 tcp->tcp_notsack_list != NULL))) {
4069 tcp->tcp_cwnd += mss <<
4070 (tcp->tcp_dupack_cnt - 1);
4071 flags |= TH_LIMIT_XMIT;
4072 }
4073 } else if (dupack_cnt ==
4074 tcps->tcps_dupack_fast_retransmit) {
4075
4076 /*
4077 * If we have reduced tcp_ssthresh
4078 * because of ECN, do not reduce it again
4079 * unless it is already one window of data
4080 * away. After one window of data, tcp_cwr
4081 * should then be cleared. Note that
4082 * for non ECN capable connection, tcp_cwr
4083 * should always be false.
4084 *
4085 * Adjust cwnd since the duplicate
4086 * ack indicates that a packet was
4087 * dropped (due to congestion.)
4088 */
4089 if (!tcp->tcp_cwr) {
4090 cc_cong_signal(tcp, seg_ack,
4091 CC_NDUPACK);
4092 cc_ack_received(tcp, seg_ack,
4093 bytes_acked, CC_DUPACK);
4094 }
4095 if (tcp->tcp_ecn_ok) {
4096 tcp->tcp_cwr = B_TRUE;
4097 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
4098 tcp->tcp_ecn_cwr_sent = B_FALSE;
4099 }
4100
4101 /*
4102 * We do Hoe's algorithm. Refer to her
4103 * paper "Improving the Start-up Behavior
4104 * of a Congestion Control Scheme for TCP,"
4105 * appeared in SIGCOMM'96.
4106 *
4107 * Save highest seq no we have sent so far.
4108 * Be careful about the invisible FIN byte.
4109 */
4110 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
4111 (tcp->tcp_unsent == 0)) {
4112 tcp->tcp_rexmit_max = tcp->tcp_fss;
4113 } else {
4114 tcp->tcp_rexmit_max = tcp->tcp_snxt;
4115 }
4116
4117 /*
4118 * For SACK:
4119 * Calculate tcp_pipe, which is the
4120 * estimated number of bytes in
4121 * network.
4122 *
4123 * tcp_fack is the highest sack'ed seq num
4124 * TCP has received.
4125 *
4126 * tcp_pipe is explained in the above quoted
4127 * Fall and Floyd's paper. tcp_fack is
4128 * explained in Mathis and Mahdavi's
4129 * "Forward Acknowledgment: Refining TCP
4130 * Congestion Control" in SIGCOMM '96.
4131 */
4132 if (tcp->tcp_snd_sack_ok) {
4133 if (tcp->tcp_notsack_list != NULL) {
4134 tcp->tcp_pipe = tcp->tcp_snxt -
4135 tcp->tcp_fack;
4136 tcp->tcp_sack_snxt = seg_ack;
4137 flags |= TH_NEED_SACK_REXMIT;
4138 } else {
4139 /*
4140 * Always initialize tcp_pipe
4141 * even though we don't have
4142 * any SACK info. If later
4143 * we get SACK info and
4144 * tcp_pipe is not initialized,
4145 * funny things will happen.
4146 */
4147 tcp->tcp_pipe =
4148 tcp->tcp_cwnd_ssthresh;
4149 }
4150 } else {
4151 flags |= TH_REXMIT_NEEDED;
4152 } /* tcp_snd_sack_ok */
4153
4154 } else {
4155 cc_ack_received(tcp, seg_ack,
4156 bytes_acked, CC_DUPACK);
4157 /*
4158 * Here we perform congestion
4159 * avoidance, but NOT slow start.
4160 * This is known as the Fast
4161 * Recovery Algorithm.
4162 */
4163 if (tcp->tcp_snd_sack_ok &&
4164 tcp->tcp_notsack_list != NULL) {
4165 flags |= TH_NEED_SACK_REXMIT;
4166 tcp->tcp_pipe -= mss;
4167 if (tcp->tcp_pipe < 0)
4168 tcp->tcp_pipe = 0;
4169 } else {
4170 /*
4171 * We know that one more packet has
4172 * left the pipe thus we can update
4173 * cwnd.
4174 */
4175 cwnd = tcp->tcp_cwnd + mss;
4176 if (cwnd > tcp->tcp_cwnd_max)
4177 cwnd = tcp->tcp_cwnd_max;
4178 DTRACE_PROBE3(cwnd__fast__recovery,
4179 tcp_t *, tcp,
4180 uint32_t, tcp->tcp_cwnd,
4181 uint32_t, cwnd);
4182 tcp->tcp_cwnd = cwnd;
4183 if (tcp->tcp_unsent > 0)
4184 flags |= TH_XMIT_NEEDED;
4185 }
4186 }
4187 }
4188 } else if (tcp->tcp_zero_win_probe) {
4189 /*
4190 * If the window has opened, need to arrange
4191 * to send additional data.
4192 */
4193 if (new_swnd != 0) {
4194 /* tcp_suna != tcp_snxt */
4195 /* Packet contains a window update */
4196 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4197 tcp->tcp_zero_win_probe = 0;
4198 tcp->tcp_timer_backoff = 0;
4199 tcp->tcp_ms_we_have_waited = 0;
4200
4201 /*
4202 * Transmit starting with tcp_suna since
4203 * the one byte probe is not ack'ed.
4204 * If TCP has sent more than one identical
4205 * probe, tcp_rexmit will be set. That means
4206 * tcp_ss_rexmit() will send out the one
4207 * byte along with new data. Otherwise,
4208 * fake the retransmission.
4209 */
4210 flags |= TH_XMIT_NEEDED;
4211 if (!tcp->tcp_rexmit) {
4212 tcp->tcp_rexmit = B_TRUE;
4213 tcp->tcp_dupack_cnt = 0;
4214 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4215 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4216 }
4217 }
4218 }
4219 goto swnd_update;
4220 }
4221
4222 /*
4223 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4224 * If the ACK value acks something that we have not yet sent, it might
4225 * be an old duplicate segment. Send an ACK to re-synchronize the
4226 * other side.
4227 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4228 * state is handled above, so we can always just drop the segment and
4229 * send an ACK here.
4230 *
4231 * In the case where the peer shrinks the window, we see the new window
4232 * update, but all the data sent previously is queued up by the peer.
4233 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4234 * number, which was already sent, and within window, is recorded.
4235 * tcp_snxt is then updated.
4236 *
4237 * If the window has previously shrunk, and an ACK for data not yet
4238 * sent, according to tcp_snxt is recieved, it may still be valid. If
4239 * the ACK is for data within the window at the time the window was
4240 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4241 * the sequence number ACK'ed.
4242 *
4243 * If the ACK covers all the data sent at the time the window was
4244 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4245 *
4246 * Should we send ACKs in response to ACK only segments?
4247 */
4248
4249 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4250 if ((tcp->tcp_is_wnd_shrnk) &&
4251 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4252 uint32_t data_acked_ahead_snxt;
4253
4254 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4255 tcp_update_xmit_tail(tcp, seg_ack);
4256 tcp->tcp_unsent -= data_acked_ahead_snxt;
4257 } else {
4258 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4259 /* drop the received segment */
4260 freemsg(mp);
4261
4262 /*
4263 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4264 * greater than 0, check if the number of such
4265 * bogus ACks is greater than that count. If yes,
4266 * don't send back any ACK. This prevents TCP from
4267 * getting into an ACK storm if somehow an attacker
4268 * successfully spoofs an acceptable segment to our
4269 * peer. If this continues (count > 2 X threshold),
4270 * we should abort this connection.
4271 */
4272 if (tcp_drop_ack_unsent_cnt > 0 &&
4273 ++tcp->tcp_in_ack_unsent >
4274 tcp_drop_ack_unsent_cnt) {
4275 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4276 if (tcp->tcp_in_ack_unsent > 2 *
4277 tcp_drop_ack_unsent_cnt) {
4278 (void) tcp_clean_death(tcp, EPROTO);
4279 }
4280 return;
4281 }
4282 mp = tcp_ack_mp(tcp);
4283 if (mp != NULL) {
4284 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4285 TCPS_BUMP_MIB(tcps, tcpOutAck);
4286 tcp_send_data(tcp, mp);
4287 }
4288 return;
4289 }
4290 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4291 tcp->tcp_snxt_shrunk)) {
4292 tcp->tcp_is_wnd_shrnk = B_FALSE;
4293 }
4294
4295 /*
4296 * TCP gets a new ACK, update the notsack'ed list to delete those
4297 * blocks that are covered by this ACK.
4298 */
4299 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4300 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4301 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4302 }
4303
4304 /*
4305 * If we got an ACK after fast retransmit, check to see
4306 * if it is a partial ACK. If it is not and the congestion
4307 * window was inflated to account for the other side's
4308 * cached packets, retract it. If it is, do Hoe's algorithm.
4309 */
4310 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4311 ASSERT(tcp->tcp_rexmit == B_FALSE);
4312 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4313 tcp->tcp_dupack_cnt = 0;
4314
4315 cc_post_recovery(tcp, seg_ack);
4316
4317 tcp->tcp_rexmit_max = seg_ack;
4318
4319 /*
4320 * Remove all notsack info to avoid confusion with
4321 * the next fast retrasnmit/recovery phase.
4322 */
4323 if (tcp->tcp_snd_sack_ok) {
4324 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4325 tcp);
4326 }
4327 } else {
4328 if (tcp->tcp_snd_sack_ok &&
4329 tcp->tcp_notsack_list != NULL) {
4330 flags |= TH_NEED_SACK_REXMIT;
4331 tcp->tcp_pipe -= mss;
4332 if (tcp->tcp_pipe < 0)
4333 tcp->tcp_pipe = 0;
4334 } else {
4335 /*
4336 * Hoe's algorithm:
4337 *
4338 * Retransmit the unack'ed segment and
4339 * restart fast recovery. Note that we
4340 * need to scale back tcp_cwnd to the
4341 * original value when we started fast
4342 * recovery. This is to prevent overly
4343 * aggressive behaviour in sending new
4344 * segments.
4345 */
4346 cwnd = tcp->tcp_cwnd_ssthresh +
4347 tcps->tcps_dupack_fast_retransmit * mss;
4348 DTRACE_PROBE3(cwnd__fast__retransmit__part__ack,
4349 tcp_t *, tcp, uint32_t, tcp->tcp_cwnd,
4350 uint32_t, cwnd);
4351 tcp->tcp_cwnd = cwnd;
4352 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4353 flags |= TH_REXMIT_NEEDED;
4354 }
4355 }
4356 } else {
4357 tcp->tcp_dupack_cnt = 0;
4358 if (tcp->tcp_rexmit) {
4359 /*
4360 * TCP is retranmitting. If the ACK ack's all
4361 * outstanding data, update tcp_rexmit_max and
4362 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4363 * to the correct value.
4364 *
4365 * Note that SEQ_LEQ() is used. This is to avoid
4366 * unnecessary fast retransmit caused by dup ACKs
4367 * received when TCP does slow start retransmission
4368 * after a time out. During this phase, TCP may
4369 * send out segments which are already received.
4370 * This causes dup ACKs to be sent back.
4371 */
4372 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4373 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4374 tcp->tcp_rexmit_nxt = seg_ack;
4375 }
4376 if (seg_ack != tcp->tcp_rexmit_max) {
4377 flags |= TH_XMIT_NEEDED;
4378 }
4379 } else {
4380 tcp->tcp_rexmit = B_FALSE;
4381 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4382 }
4383 tcp->tcp_ms_we_have_waited = 0;
4384 }
4385 }
4386
4387 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4388 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4389 tcp->tcp_suna = seg_ack;
4390 if (tcp->tcp_zero_win_probe != 0) {
4391 tcp->tcp_zero_win_probe = 0;
4392 tcp->tcp_timer_backoff = 0;
4393 }
4394
4395 /*
4396 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4397 * Note that it cannot be the SYN being ack'ed. The code flow
4398 * will not reach here.
4399 */
4400 if (mp1 == NULL) {
4401 goto fin_acked;
4402 }
4403
4404 /*
4405 * Update the congestion window.
4406 *
4407 * If TCP is not ECN capable or TCP is ECN capable but the
4408 * congestion experience bit is not set, increase the tcp_cwnd as
4409 * usual.
4410 */
4411 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4412 if (IN_RECOVERY(tcp->tcp_ccv.flags)) {
4413 EXIT_RECOVERY(tcp->tcp_ccv.flags);
4414 }
4415 cc_ack_received(tcp, seg_ack, bytes_acked, CC_ACK);
4416 }
4417
4418 /* See if the latest urgent data has been acknowledged */
4419 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4420 SEQ_GT(seg_ack, tcp->tcp_urg))
4421 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4422
4423 /*
4424 * Update the RTT estimates. Note that we don't use the TCP
4425 * timestamp option to calculate RTT even if one is present. This is
4426 * because the timestamp option's resolution (CPU tick) is
4427 * too coarse to measure modern datacenter networks' microsecond
4428 * latencies. The timestamp field's resolution is limited by its
4429 * 4-byte width (see RFC1323), and since we always store a
4430 * high-resolution nanosecond presision timestamp along with the data,
4431 * there is no point to ever using the timestamp option.
4432 */
4433 if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4434 /*
4435 * An ACK sequence we haven't seen before, so get the RTT
4436 * and update the RTO. But first check if the timestamp is
4437 * valid to use.
4438 */
4439 if ((mp1->b_next != NULL) &&
4440 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) {
4441 tcp_set_rto(tcp, gethrtime() -
4442 (hrtime_t)(intptr_t)mp1->b_prev);
4443 } else {
4444 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4445 }
4446
4447 /* Remeber the last sequence to be ACKed */
4448 tcp->tcp_csuna = seg_ack;
4449 if (tcp->tcp_set_timer == 1) {
4450 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4451 tcp->tcp_set_timer = 0;
4452 }
4453 } else {
4454 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4455 }
4456
4457 /* Eat acknowledged bytes off the xmit queue. */
4458 for (;;) {
4459 mblk_t *mp2;
4460 uchar_t *wptr;
4461
4462 wptr = mp1->b_wptr;
4463 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4464 bytes_acked -= (int)(wptr - mp1->b_rptr);
4465 if (bytes_acked < 0) {
4466 mp1->b_rptr = wptr + bytes_acked;
4467 /*
4468 * Set a new timestamp if all the bytes timed by the
4469 * old timestamp have been ack'ed.
4470 */
4471 if (SEQ_GT(seg_ack,
4472 (uint32_t)(uintptr_t)(mp1->b_next))) {
4473 mp1->b_prev =
4474 (mblk_t *)(intptr_t)gethrtime();
4475 mp1->b_next = NULL;
4476 }
4477 break;
4478 }
4479 mp1->b_next = NULL;
4480 mp1->b_prev = NULL;
4481 mp2 = mp1;
4482 mp1 = mp1->b_cont;
4483
4484 /*
4485 * This notification is required for some zero-copy
4486 * clients to maintain a copy semantic. After the data
4487 * is ack'ed, client is safe to modify or reuse the buffer.
4488 */
4489 if (tcp->tcp_snd_zcopy_aware &&
4490 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4491 tcp_zcopy_notify(tcp);
4492 freeb(mp2);
4493 if (bytes_acked == 0) {
4494 if (mp1 == NULL) {
4495 /* Everything is ack'ed, clear the tail. */
4496 tcp->tcp_xmit_tail = NULL;
4497 /*
4498 * Cancel the timer unless we are still
4499 * waiting for an ACK for the FIN packet.
4500 */
4501 if (tcp->tcp_timer_tid != 0 &&
4502 tcp->tcp_snxt == tcp->tcp_suna) {
4503 (void) TCP_TIMER_CANCEL(tcp,
4504 tcp->tcp_timer_tid);
4505 tcp->tcp_timer_tid = 0;
4506 }
4507 goto pre_swnd_update;
4508 }
4509 if (mp2 != tcp->tcp_xmit_tail)
4510 break;
4511 tcp->tcp_xmit_tail = mp1;
4512 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4513 (uintptr_t)INT_MAX);
4514 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4515 mp1->b_rptr);
4516 break;
4517 }
4518 if (mp1 == NULL) {
4519 /*
4520 * More was acked but there is nothing more
4521 * outstanding. This means that the FIN was
4522 * just acked or that we're talking to a clown.
4523 */
4524 fin_acked:
4525 ASSERT(tcp->tcp_fin_sent);
4526 tcp->tcp_xmit_tail = NULL;
4527 if (tcp->tcp_fin_sent) {
4528 /* FIN was acked - making progress */
4529 if (!tcp->tcp_fin_acked)
4530 tcp->tcp_ip_forward_progress = B_TRUE;
4531 tcp->tcp_fin_acked = B_TRUE;
4532 if (tcp->tcp_linger_tid != 0 &&
4533 TCP_TIMER_CANCEL(tcp,
4534 tcp->tcp_linger_tid) >= 0) {
4535 tcp_stop_lingering(tcp);
4536 freemsg(mp);
4537 mp = NULL;
4538 }
4539 } else {
4540 /*
4541 * We should never get here because
4542 * we have already checked that the
4543 * number of bytes ack'ed should be
4544 * smaller than or equal to what we
4545 * have sent so far (it is the
4546 * acceptability check of the ACK).
4547 * We can only get here if the send
4548 * queue is corrupted.
4549 *
4550 * Terminate the connection and
4551 * panic the system. It is better
4552 * for us to panic instead of
4553 * continuing to avoid other disaster.
4554 */
4555 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4556 tcp->tcp_rnxt, TH_RST|TH_ACK);
4557 panic("Memory corruption "
4558 "detected for connection %s.",
4559 tcp_display(tcp, NULL,
4560 DISP_ADDR_AND_PORT));
4561 /*NOTREACHED*/
4562 }
4563 goto pre_swnd_update;
4564 }
4565 ASSERT(mp2 != tcp->tcp_xmit_tail);
4566 }
4567 if (tcp->tcp_unsent) {
4568 flags |= TH_XMIT_NEEDED;
4569 }
4570 pre_swnd_update:
4571 tcp->tcp_xmit_head = mp1;
4572 swnd_update:
4573 /*
4574 * The following check is different from most other implementations.
4575 * For bi-directional transfer, when segments are dropped, the
4576 * "normal" check will not accept a window update in those
4577 * retransmitted segemnts. Failing to do that, TCP may send out
4578 * segments which are outside receiver's window. As TCP accepts
4579 * the ack in those retransmitted segments, if the window update in
4580 * the same segment is not accepted, TCP will incorrectly calculates
4581 * that it can send more segments. This can create a deadlock
4582 * with the receiver if its window becomes zero.
4583 */
4584 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4585 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4586 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4587 /*
4588 * The criteria for update is:
4589 *
4590 * 1. the segment acknowledges some data. Or
4591 * 2. the segment is new, i.e. it has a higher seq num. Or
4592 * 3. the segment is not old and the advertised window is
4593 * larger than the previous advertised window.
4594 */
4595 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4596 flags |= TH_XMIT_NEEDED;
4597 tcp->tcp_swnd = new_swnd;
4598 if (new_swnd > tcp->tcp_max_swnd)
4599 tcp->tcp_max_swnd = new_swnd;
4600 tcp->tcp_swl1 = seg_seq;
4601 tcp->tcp_swl2 = seg_ack;
4602 }
4603 est:
4604 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4605
4606 switch (tcp->tcp_state) {
4607 case TCPS_FIN_WAIT_1:
4608 if (tcp->tcp_fin_acked) {
4609 tcp->tcp_state = TCPS_FIN_WAIT_2;
4610 DTRACE_TCP6(state__change, void, NULL,
4611 ip_xmit_attr_t *, connp->conn_ixa,
4612 void, NULL, tcp_t *, tcp, void, NULL,
4613 int32_t, TCPS_FIN_WAIT_1);
4614 /*
4615 * We implement the non-standard BSD/SunOS
4616 * FIN_WAIT_2 flushing algorithm.
4617 * If there is no user attached to this
4618 * TCP endpoint, then this TCP struct
4619 * could hang around forever in FIN_WAIT_2
4620 * state if the peer forgets to send us
4621 * a FIN. To prevent this, we wait only
4622 * 2*MSL (a convenient time value) for
4623 * the FIN to arrive. If it doesn't show up,
4624 * we flush the TCP endpoint. This algorithm,
4625 * though a violation of RFC-793, has worked
4626 * for over 10 years in BSD systems.
4627 * Note: SunOS 4.x waits 675 seconds before
4628 * flushing the FIN_WAIT_2 connection.
4629 */
4630 TCP_TIMER_RESTART(tcp,
4631 tcp->tcp_fin_wait_2_flush_interval);
4632 }
4633 break;
4634 case TCPS_FIN_WAIT_2:
4635 break; /* Shutdown hook? */
4636 case TCPS_LAST_ACK:
4637 freemsg(mp);
4638 if (tcp->tcp_fin_acked) {
4639 (void) tcp_clean_death(tcp, 0);
4640 return;
4641 }
4642 goto xmit_check;
4643 case TCPS_CLOSING:
4644 if (tcp->tcp_fin_acked) {
4645 SET_TIME_WAIT(tcps, tcp, connp);
4646 DTRACE_TCP6(state__change, void, NULL,
4647 ip_xmit_attr_t *, connp->conn_ixa, void,
4648 NULL, tcp_t *, tcp, void, NULL, int32_t,
4649 TCPS_CLOSING);
4650 }
4651 /*FALLTHRU*/
4652 case TCPS_CLOSE_WAIT:
4653 freemsg(mp);
4654 goto xmit_check;
4655 default:
4656 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4657 break;
4658 }
4659 }
4660 if (flags & TH_FIN) {
4661 /* Make sure we ack the fin */
4662 flags |= TH_ACK_NEEDED;
4663 if (!tcp->tcp_fin_rcvd) {
4664 tcp->tcp_fin_rcvd = B_TRUE;
4665 tcp->tcp_rnxt++;
4666 tcpha = tcp->tcp_tcpha;
4667 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4668
4669 /*
4670 * Generate the ordrel_ind at the end unless the
4671 * conn is detached or it is a STREAMS based eager.
4672 * In the eager case we defer the notification until
4673 * tcp_accept_finish has run.
4674 */
4675 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4676 (tcp->tcp_listener == NULL &&
4677 !tcp->tcp_hard_binding)))
4678 flags |= TH_ORDREL_NEEDED;
4679 switch (tcp->tcp_state) {
4680 case TCPS_SYN_RCVD:
4681 tcp->tcp_state = TCPS_CLOSE_WAIT;
4682 DTRACE_TCP6(state__change, void, NULL,
4683 ip_xmit_attr_t *, connp->conn_ixa,
4684 void, NULL, tcp_t *, tcp, void, NULL,
4685 int32_t, TCPS_SYN_RCVD);
4686 /* Keepalive? */
4687 break;
4688 case TCPS_ESTABLISHED:
4689 tcp->tcp_state = TCPS_CLOSE_WAIT;
4690 DTRACE_TCP6(state__change, void, NULL,
4691 ip_xmit_attr_t *, connp->conn_ixa,
4692 void, NULL, tcp_t *, tcp, void, NULL,
4693 int32_t, TCPS_ESTABLISHED);
4694 /* Keepalive? */
4695 break;
4696 case TCPS_FIN_WAIT_1:
4697 if (!tcp->tcp_fin_acked) {
4698 tcp->tcp_state = TCPS_CLOSING;
4699 DTRACE_TCP6(state__change, void, NULL,
4700 ip_xmit_attr_t *, connp->conn_ixa,
4701 void, NULL, tcp_t *, tcp, void,
4702 NULL, int32_t, TCPS_FIN_WAIT_1);
4703 break;
4704 }
4705 /* FALLTHRU */
4706 case TCPS_FIN_WAIT_2:
4707 SET_TIME_WAIT(tcps, tcp, connp);
4708 DTRACE_TCP6(state__change, void, NULL,
4709 ip_xmit_attr_t *, connp->conn_ixa, void,
4710 NULL, tcp_t *, tcp, void, NULL, int32_t,
4711 TCPS_FIN_WAIT_2);
4712 if (seg_len) {
4713 /*
4714 * implies data piggybacked on FIN.
4715 * break to handle data.
4716 */
4717 break;
4718 }
4719 freemsg(mp);
4720 goto ack_check;
4721 }
4722 }
4723 }
4724 if (mp == NULL)
4725 goto xmit_check;
4726 if (seg_len == 0) {
4727 freemsg(mp);
4728 goto xmit_check;
4729 }
4730 if (mp->b_rptr == mp->b_wptr) {
4731 /*
4732 * The header has been consumed, so we remove the
4733 * zero-length mblk here.
4734 */
4735 mp1 = mp;
4736 mp = mp->b_cont;
4737 freeb(mp1);
4738 }
4739 update_ack:
4740 tcpha = tcp->tcp_tcpha;
4741 tcp->tcp_rack_cnt++;
4742 {
4743 uint32_t cur_max;
4744
4745 cur_max = tcp->tcp_rack_cur_max;
4746 if (tcp->tcp_rack_cnt >= cur_max) {
4747 /*
4748 * We have more unacked data than we should - send
4749 * an ACK now.
4750 */
4751 flags |= TH_ACK_NEEDED;
4752 cur_max++;
4753 if (cur_max > tcp->tcp_rack_abs_max)
4754 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4755 else
4756 tcp->tcp_rack_cur_max = cur_max;
4757 } else if (TCP_IS_DETACHED(tcp)) {
4758 /* We don't have an ACK timer for detached TCP. */
4759 flags |= TH_ACK_NEEDED;
4760 } else if (seg_len < mss) {
4761 /*
4762 * If we get a segment that is less than an mss, and we
4763 * already have unacknowledged data, and the amount
4764 * unacknowledged is not a multiple of mss, then we
4765 * better generate an ACK now. Otherwise, this may be
4766 * the tail piece of a transaction, and we would rather
4767 * wait for the response.
4768 */
4769 uint32_t udif;
4770 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4771 (uintptr_t)INT_MAX);
4772 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4773 if (udif && (udif % mss))
4774 flags |= TH_ACK_NEEDED;
4775 else
4776 flags |= TH_ACK_TIMER_NEEDED;
4777 } else {
4778 /* Start delayed ack timer */
4779 flags |= TH_ACK_TIMER_NEEDED;
4780 }
4781 }
4782 tcp->tcp_rnxt += seg_len;
4783 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4784
4785 if (mp == NULL)
4786 goto xmit_check;
4787
4788 /* Update SACK list */
4789 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4790 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4791 &(tcp->tcp_num_sack_blk));
4792 }
4793
4794 if (tcp->tcp_urp_mp) {
4795 tcp->tcp_urp_mp->b_cont = mp;
4796 mp = tcp->tcp_urp_mp;
4797 tcp->tcp_urp_mp = NULL;
4798 /* Ready for a new signal. */
4799 tcp->tcp_urp_last_valid = B_FALSE;
4800 #ifdef DEBUG
4801 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4802 "tcp_rput: sending exdata_ind %s",
4803 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4804 #endif /* DEBUG */
4805 }
4806
4807 /*
4808 * Check for ancillary data changes compared to last segment.
4809 */
4810 if (connp->conn_recv_ancillary.crb_all != 0) {
4811 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4812 if (mp == NULL)
4813 return;
4814 }
4815
4816 if (IPCL_IS_NONSTR(connp)) {
4817 /*
4818 * Non-STREAMS socket
4819 */
4820 boolean_t push = flags & (TH_PUSH|TH_FIN);
4821 int error;
4822
4823 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4824 mp, seg_len, 0, &error, &push) <= 0) {
4825 /*
4826 * We should never be in middle of a
4827 * fallback, the squeue guarantees that.
4828 */
4829 ASSERT(error != EOPNOTSUPP);
4830 if (error == ENOSPC)
4831 tcp->tcp_rwnd -= seg_len;
4832 } else if (push) {
4833 /* PUSH bit set and sockfs is not flow controlled */
4834 flags |= tcp_rwnd_reopen(tcp);
4835 }
4836 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4837 /*
4838 * Side queue inbound data until the accept happens.
4839 * tcp_accept/tcp_rput drains this when the accept happens.
4840 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4841 * T_EXDATA_IND) it is queued on b_next.
4842 * XXX Make urgent data use this. Requires:
4843 * Removing tcp_listener check for TH_URG
4844 * Making M_PCPROTO and MARK messages skip the eager case
4845 */
4846
4847 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4848 } else {
4849 /* Active STREAMS socket */
4850 if (mp->b_datap->db_type != M_DATA ||
4851 (flags & TH_MARKNEXT_NEEDED)) {
4852 if (tcp->tcp_rcv_list != NULL) {
4853 flags |= tcp_rcv_drain(tcp);
4854 }
4855 ASSERT(tcp->tcp_rcv_list == NULL ||
4856 tcp->tcp_fused_sigurg);
4857
4858 if (flags & TH_MARKNEXT_NEEDED) {
4859 #ifdef DEBUG
4860 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4861 "tcp_rput: sending MSGMARKNEXT %s",
4862 tcp_display(tcp, NULL,
4863 DISP_PORT_ONLY));
4864 #endif /* DEBUG */
4865 mp->b_flag |= MSGMARKNEXT;
4866 flags &= ~TH_MARKNEXT_NEEDED;
4867 }
4868
4869 if (is_system_labeled())
4870 tcp_setcred_data(mp, ira);
4871
4872 putnext(connp->conn_rq, mp);
4873 if (!canputnext(connp->conn_rq))
4874 tcp->tcp_rwnd -= seg_len;
4875 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4876 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4877 if (tcp->tcp_rcv_list != NULL) {
4878 /*
4879 * Enqueue the new segment first and then
4880 * call tcp_rcv_drain() to send all data
4881 * up. The other way to do this is to
4882 * send all queued data up and then call
4883 * putnext() to send the new segment up.
4884 * This way can remove the else part later
4885 * on.
4886 *
4887 * We don't do this to avoid one more call to
4888 * canputnext() as tcp_rcv_drain() needs to
4889 * call canputnext().
4890 */
4891 tcp_rcv_enqueue(tcp, mp, seg_len,
4892 ira->ira_cred);
4893 flags |= tcp_rcv_drain(tcp);
4894 } else {
4895 if (is_system_labeled())
4896 tcp_setcred_data(mp, ira);
4897
4898 putnext(connp->conn_rq, mp);
4899 if (!canputnext(connp->conn_rq))
4900 tcp->tcp_rwnd -= seg_len;
4901 }
4902 } else {
4903 /*
4904 * Enqueue all packets when processing an mblk
4905 * from the co queue and also enqueue normal packets.
4906 */
4907 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4908 }
4909 /*
4910 * Make sure the timer is running if we have data waiting
4911 * for a push bit. This provides resiliency against
4912 * implementations that do not correctly generate push bits.
4913 */
4914 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4915 /*
4916 * The connection may be closed at this point, so don't
4917 * do anything for a detached tcp.
4918 */
4919 if (!TCP_IS_DETACHED(tcp))
4920 tcp->tcp_push_tid = TCP_TIMER(tcp,
4921 tcp_push_timer,
4922 tcps->tcps_push_timer_interval);
4923 }
4924 }
4925
4926 xmit_check:
4927 /* Is there anything left to do? */
4928 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4929 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4930 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4931 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4932 goto done;
4933
4934 /* Any transmit work to do and a non-zero window? */
4935 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4936 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4937 if (flags & TH_REXMIT_NEEDED) {
4938 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4939
4940 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4941 if (snd_size > mss)
4942 snd_size = mss;
4943 if (snd_size > tcp->tcp_swnd)
4944 snd_size = tcp->tcp_swnd;
4945 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4946 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4947 B_TRUE);
4948
4949 if (mp1 != NULL) {
4950 tcp->tcp_xmit_head->b_prev =
4951 (mblk_t *)(intptr_t)gethrtime();
4952 tcp->tcp_csuna = tcp->tcp_snxt;
4953 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4954 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4955 snd_size);
4956 tcp->tcp_cs.tcp_out_retrans_segs++;
4957 tcp->tcp_cs.tcp_out_retrans_bytes += snd_size;
4958 tcp_send_data(tcp, mp1);
4959 }
4960 }
4961 if (flags & TH_NEED_SACK_REXMIT) {
4962 tcp_sack_rexmit(tcp, &flags);
4963 }
4964 /*
4965 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4966 * out new segment. Note that tcp_rexmit should not be
4967 * set, otherwise TH_LIMIT_XMIT should not be set.
4968 */
4969 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4970 if (!tcp->tcp_rexmit) {
4971 tcp_wput_data(tcp, NULL, B_FALSE);
4972 } else {
4973 tcp_ss_rexmit(tcp);
4974 }
4975 }
4976 /*
4977 * Adjust tcp_cwnd back to normal value after sending
4978 * new data segments.
4979 */
4980 if (flags & TH_LIMIT_XMIT) {
4981 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4982 /*
4983 * This will restart the timer. Restarting the
4984 * timer is used to avoid a timeout before the
4985 * limited transmitted segment's ACK gets back.
4986 */
4987 if (tcp->tcp_xmit_head != NULL) {
4988 tcp->tcp_xmit_head->b_prev =
4989 (mblk_t *)(intptr_t)gethrtime();
4990 }
4991 }
4992
4993 /* Anything more to do? */
4994 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4995 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4996 goto done;
4997 }
4998 ack_check:
4999 if (flags & TH_SEND_URP_MARK) {
5000 ASSERT(tcp->tcp_urp_mark_mp);
5001 ASSERT(!IPCL_IS_NONSTR(connp));
5002 /*
5003 * Send up any queued data and then send the mark message
5004 */
5005 if (tcp->tcp_rcv_list != NULL) {
5006 flags |= tcp_rcv_drain(tcp);
5007
5008 }
5009 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5010 mp1 = tcp->tcp_urp_mark_mp;
5011 tcp->tcp_urp_mark_mp = NULL;
5012 if (is_system_labeled())
5013 tcp_setcred_data(mp1, ira);
5014
5015 putnext(connp->conn_rq, mp1);
5016 #ifdef DEBUG
5017 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
5018 "tcp_rput: sending zero-length %s %s",
5019 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
5020 "MSGNOTMARKNEXT"),
5021 tcp_display(tcp, NULL, DISP_PORT_ONLY));
5022 #endif /* DEBUG */
5023 flags &= ~TH_SEND_URP_MARK;
5024 }
5025 if (flags & TH_ACK_NEEDED) {
5026 /*
5027 * Time to send an ack for some reason.
5028 */
5029 mp1 = tcp_ack_mp(tcp);
5030
5031 if (mp1 != NULL) {
5032 tcp_send_data(tcp, mp1);
5033 TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
5034 TCPS_BUMP_MIB(tcps, tcpOutAck);
5035 }
5036 if (tcp->tcp_ack_tid != 0) {
5037 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
5038 tcp->tcp_ack_tid = 0;
5039 }
5040 }
5041 if (flags & TH_ACK_TIMER_NEEDED) {
5042 /*
5043 * Arrange for deferred ACK or push wait timeout.
5044 * Start timer if it is not already running.
5045 */
5046 if (tcp->tcp_ack_tid == 0) {
5047 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
5048 tcp->tcp_localnet ?
5049 tcps->tcps_local_dack_interval :
5050 tcps->tcps_deferred_ack_interval);
5051 }
5052 }
5053 if (flags & TH_ORDREL_NEEDED) {
5054 /*
5055 * Notify upper layer about an orderly release. If this is
5056 * a non-STREAMS socket, then just make an upcall. For STREAMS
5057 * we send up an ordrel_ind, unless this is an eager, in which
5058 * case the ordrel will be sent when tcp_accept_finish runs.
5059 * Note that for non-STREAMS we make an upcall even if it is an
5060 * eager, because we have an upper handle to send it to.
5061 */
5062 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
5063 ASSERT(!tcp->tcp_detached);
5064
5065 if (IPCL_IS_NONSTR(connp)) {
5066 ASSERT(tcp->tcp_ordrel_mp == NULL);
5067 tcp->tcp_ordrel_done = B_TRUE;
5068 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
5069 SOCK_OPCTL_SHUT_RECV, 0);
5070 goto done;
5071 }
5072
5073 if (tcp->tcp_rcv_list != NULL) {
5074 /*
5075 * Push any mblk(s) enqueued from co processing.
5076 */
5077 flags |= tcp_rcv_drain(tcp);
5078 }
5079 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5080
5081 mp1 = tcp->tcp_ordrel_mp;
5082 tcp->tcp_ordrel_mp = NULL;
5083 tcp->tcp_ordrel_done = B_TRUE;
5084 putnext(connp->conn_rq, mp1);
5085 }
5086 done:
5087 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5088 }
5089
5090 /*
5091 * Attach ancillary data to a received TCP segments for the
5092 * ancillary pieces requested by the application that are
5093 * different than they were in the previous data segment.
5094 *
5095 * Save the "current" values once memory allocation is ok so that
5096 * when memory allocation fails we can just wait for the next data segment.
5097 */
5098 static mblk_t *
5099 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5100 ip_recv_attr_t *ira)
5101 {
5102 struct T_optdata_ind *todi;
5103 int optlen;
5104 uchar_t *optptr;
5105 struct T_opthdr *toh;
5106 crb_t addflag; /* Which pieces to add */
5107 mblk_t *mp1;
5108 conn_t *connp = tcp->tcp_connp;
5109
5110 optlen = 0;
5111 addflag.crb_all = 0;
5112
5113 /* If app asked for TOS and it has changed ... */
5114 if (connp->conn_recv_ancillary.crb_recvtos &&
5115 ipp->ipp_type_of_service != tcp->tcp_recvtos &&
5116 (ira->ira_flags & IRAF_IS_IPV4)) {
5117 optlen += sizeof (struct T_opthdr) +
5118 P2ROUNDUP(sizeof (uint8_t), __TPI_ALIGN_SIZE);
5119 addflag.crb_recvtos = 1;
5120 }
5121 /* If app asked for pktinfo and the index has changed ... */
5122 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5123 ira->ira_ruifindex != tcp->tcp_recvifindex) {
5124 optlen += sizeof (struct T_opthdr) +
5125 sizeof (struct in6_pktinfo);
5126 addflag.crb_ip_recvpktinfo = 1;
5127 }
5128 /* If app asked for hoplimit and it has changed ... */
5129 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5130 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5131 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5132 addflag.crb_ipv6_recvhoplimit = 1;
5133 }
5134 /* If app asked for tclass and it has changed ... */
5135 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5136 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5137 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5138 addflag.crb_ipv6_recvtclass = 1;
5139 }
5140
5141 /*
5142 * If app asked for hop-by-hop headers and it has changed ...
5143 * For security labels, note that (1) security labels can't change on
5144 * a connected socket at all, (2) we're connected to at most one peer,
5145 * (3) if anything changes, then it must be some other extra option.
5146 */
5147 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5148 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5149 (ipp->ipp_fields & IPPF_HOPOPTS),
5150 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5151 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5152 addflag.crb_ipv6_recvhopopts = 1;
5153 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5154 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5155 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5156 return (mp);
5157 }
5158 /* If app asked for dst headers before routing headers ... */
5159 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5160 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5161 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5162 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5163 optlen += sizeof (struct T_opthdr) +
5164 ipp->ipp_rthdrdstoptslen;
5165 addflag.crb_ipv6_recvrthdrdstopts = 1;
5166 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5167 &tcp->tcp_rthdrdstoptslen,
5168 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5169 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5170 return (mp);
5171 }
5172 /* If app asked for routing headers and it has changed ... */
5173 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5174 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5175 (ipp->ipp_fields & IPPF_RTHDR),
5176 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5177 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5178 addflag.crb_ipv6_recvrthdr = 1;
5179 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5180 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5181 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5182 return (mp);
5183 }
5184 /* If app asked for dest headers and it has changed ... */
5185 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5186 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5187 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5188 (ipp->ipp_fields & IPPF_DSTOPTS),
5189 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5190 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5191 addflag.crb_ipv6_recvdstopts = 1;
5192 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5193 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5194 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5195 return (mp);
5196 }
5197
5198 if (optlen == 0) {
5199 /* Nothing to add */
5200 return (mp);
5201 }
5202 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5203 if (mp1 == NULL) {
5204 /*
5205 * Defer sending ancillary data until the next TCP segment
5206 * arrives.
5207 */
5208 return (mp);
5209 }
5210 mp1->b_cont = mp;
5211 mp = mp1;
5212 mp->b_wptr += sizeof (*todi) + optlen;
5213 mp->b_datap->db_type = M_PROTO;
5214 todi = (struct T_optdata_ind *)mp->b_rptr;
5215 todi->PRIM_type = T_OPTDATA_IND;
5216 todi->DATA_flag = 1; /* MORE data */
5217 todi->OPT_length = optlen;
5218 todi->OPT_offset = sizeof (*todi);
5219 optptr = (uchar_t *)&todi[1];
5220
5221 /* If app asked for TOS and it has changed ... */
5222 if (addflag.crb_recvtos) {
5223 toh = (struct T_opthdr *)optptr;
5224 toh->level = IPPROTO_IP;
5225 toh->name = IP_RECVTOS;
5226 toh->len = sizeof (*toh) +
5227 P2ROUNDUP(sizeof (uint8_t), __TPI_ALIGN_SIZE);
5228 toh->status = 0;
5229 optptr += sizeof (*toh);
5230 *(uint8_t *)optptr = ipp->ipp_type_of_service;
5231 optptr = (uchar_t *)toh + toh->len;
5232 ASSERT(__TPI_TOPT_ISALIGNED(optptr));
5233 /* Save as "last" value */
5234 tcp->tcp_recvtos = ipp->ipp_type_of_service;
5235 }
5236
5237 /*
5238 * If app asked for pktinfo and the index has changed ...
5239 * Note that the local address never changes for the connection.
5240 */
5241 if (addflag.crb_ip_recvpktinfo) {
5242 struct in6_pktinfo *pkti;
5243 uint_t ifindex;
5244
5245 ifindex = ira->ira_ruifindex;
5246 toh = (struct T_opthdr *)optptr;
5247 toh->level = IPPROTO_IPV6;
5248 toh->name = IPV6_PKTINFO;
5249 toh->len = sizeof (*toh) + sizeof (*pkti);
5250 toh->status = 0;
5251 optptr += sizeof (*toh);
5252 pkti = (struct in6_pktinfo *)optptr;
5253 pkti->ipi6_addr = connp->conn_laddr_v6;
5254 pkti->ipi6_ifindex = ifindex;
5255 optptr += sizeof (*pkti);
5256 ASSERT(OK_32PTR(optptr));
5257 /* Save as "last" value */
5258 tcp->tcp_recvifindex = ifindex;
5259 }
5260 /* If app asked for hoplimit and it has changed ... */
5261 if (addflag.crb_ipv6_recvhoplimit) {
5262 toh = (struct T_opthdr *)optptr;
5263 toh->level = IPPROTO_IPV6;
5264 toh->name = IPV6_HOPLIMIT;
5265 toh->len = sizeof (*toh) + sizeof (uint_t);
5266 toh->status = 0;
5267 optptr += sizeof (*toh);
5268 *(uint_t *)optptr = ipp->ipp_hoplimit;
5269 optptr += sizeof (uint_t);
5270 ASSERT(OK_32PTR(optptr));
5271 /* Save as "last" value */
5272 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5273 }
5274 /* If app asked for tclass and it has changed ... */
5275 if (addflag.crb_ipv6_recvtclass) {
5276 toh = (struct T_opthdr *)optptr;
5277 toh->level = IPPROTO_IPV6;
5278 toh->name = IPV6_TCLASS;
5279 toh->len = sizeof (*toh) + sizeof (uint_t);
5280 toh->status = 0;
5281 optptr += sizeof (*toh);
5282 *(uint_t *)optptr = ipp->ipp_tclass;
5283 optptr += sizeof (uint_t);
5284 ASSERT(OK_32PTR(optptr));
5285 /* Save as "last" value */
5286 tcp->tcp_recvtclass = ipp->ipp_tclass;
5287 }
5288 if (addflag.crb_ipv6_recvhopopts) {
5289 toh = (struct T_opthdr *)optptr;
5290 toh->level = IPPROTO_IPV6;
5291 toh->name = IPV6_HOPOPTS;
5292 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5293 toh->status = 0;
5294 optptr += sizeof (*toh);
5295 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5296 optptr += ipp->ipp_hopoptslen;
5297 ASSERT(OK_32PTR(optptr));
5298 /* Save as last value */
5299 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5300 (ipp->ipp_fields & IPPF_HOPOPTS),
5301 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5302 }
5303 if (addflag.crb_ipv6_recvrthdrdstopts) {
5304 toh = (struct T_opthdr *)optptr;
5305 toh->level = IPPROTO_IPV6;
5306 toh->name = IPV6_RTHDRDSTOPTS;
5307 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5308 toh->status = 0;
5309 optptr += sizeof (*toh);
5310 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5311 optptr += ipp->ipp_rthdrdstoptslen;
5312 ASSERT(OK_32PTR(optptr));
5313 /* Save as last value */
5314 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5315 &tcp->tcp_rthdrdstoptslen,
5316 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5317 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5318 }
5319 if (addflag.crb_ipv6_recvrthdr) {
5320 toh = (struct T_opthdr *)optptr;
5321 toh->level = IPPROTO_IPV6;
5322 toh->name = IPV6_RTHDR;
5323 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5324 toh->status = 0;
5325 optptr += sizeof (*toh);
5326 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5327 optptr += ipp->ipp_rthdrlen;
5328 ASSERT(OK_32PTR(optptr));
5329 /* Save as last value */
5330 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5331 (ipp->ipp_fields & IPPF_RTHDR),
5332 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5333 }
5334 if (addflag.crb_ipv6_recvdstopts) {
5335 toh = (struct T_opthdr *)optptr;
5336 toh->level = IPPROTO_IPV6;
5337 toh->name = IPV6_DSTOPTS;
5338 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5339 toh->status = 0;
5340 optptr += sizeof (*toh);
5341 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5342 optptr += ipp->ipp_dstoptslen;
5343 ASSERT(OK_32PTR(optptr));
5344 /* Save as last value */
5345 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5346 (ipp->ipp_fields & IPPF_DSTOPTS),
5347 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5348 }
5349 ASSERT(optptr == mp->b_wptr);
5350 return (mp);
5351 }
5352
5353 /* The minimum of smoothed mean deviation in RTO calculation (nsec). */
5354 #define TCP_SD_MIN 400000000
5355
5356 /*
5357 * Set RTO for this connection based on a new round-trip time measurement.
5358 * The formula is from Jacobson and Karels' "Congestion Avoidance and Control"
5359 * in SIGCOMM '88. The variable names are the same as those in Appendix A.2
5360 * of that paper.
5361 *
5362 * m = new measurement
5363 * sa = smoothed RTT average (8 * average estimates).
5364 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5365 */
5366 static void
5367 tcp_set_rto(tcp_t *tcp, hrtime_t rtt)
5368 {
5369 hrtime_t m = rtt;
5370 hrtime_t sa = tcp->tcp_rtt_sa;
5371 hrtime_t sv = tcp->tcp_rtt_sd;
5372 tcp_stack_t *tcps = tcp->tcp_tcps;
5373
5374 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5375 tcp->tcp_rtt_update++;
5376 tcp->tcp_rtt_sum += m;
5377 tcp->tcp_rtt_cnt++;
5378
5379 /* tcp_rtt_sa is not 0 means this is a new sample. */
5380 if (sa != 0) {
5381 /*
5382 * Update average estimator (see section 2.3 of RFC6298):
5383 * SRTT = 7/8 SRTT + 1/8 rtt
5384 *
5385 * We maintain tcp_rtt_sa as 8 * SRTT, so this reduces to:
5386 * tcp_rtt_sa = 7 * SRTT + rtt
5387 * tcp_rtt_sa = 7 * (tcp_rtt_sa / 8) + rtt
5388 * tcp_rtt_sa = tcp_rtt_sa - (tcp_rtt_sa / 8) + rtt
5389 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 8))
5390 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 2^3))
5391 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa >> 3))
5392 *
5393 * (rtt - tcp_rtt_sa / 8) is simply the difference
5394 * between the new rtt measurement and the existing smoothed
5395 * RTT average. This is referred to as "Error" in subsequent
5396 * calculations.
5397 */
5398
5399 /* m is now Error. */
5400 m -= sa >> 3;
5401 if ((sa += m) <= 0) {
5402 /*
5403 * Don't allow the smoothed average to be negative.
5404 * We use 0 to denote reinitialization of the
5405 * variables.
5406 */
5407 sa = 1;
5408 }
5409
5410 /*
5411 * Update deviation estimator:
5412 * mdev = 3/4 mdev + 1/4 abs(Error)
5413 *
5414 * We maintain tcp_rtt_sd as 4 * mdev, so this reduces to:
5415 * tcp_rtt_sd = 3 * mdev + abs(Error)
5416 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 4) + abs(Error)
5417 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 2^2) + abs(Error)
5418 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd >> 2) + abs(Error)
5419 */
5420 if (m < 0)
5421 m = -m;
5422 m -= sv >> 2;
5423 sv += m;
5424 } else {
5425 /*
5426 * This follows BSD's implementation. So the reinitialized
5427 * RTO is 3 * m. We cannot go less than 2 because if the
5428 * link is bandwidth dominated, doubling the window size
5429 * during slow start means doubling the RTT. We want to be
5430 * more conservative when we reinitialize our estimates. 3
5431 * is just a convenient number.
5432 */
5433 sa = m << 3;
5434 sv = m << 1;
5435 }
5436 if (sv < TCP_SD_MIN) {
5437 /*
5438 * Since a receiver doesn't delay its ACKs during a long run of
5439 * segments, sa may not have captured the effect of delayed ACK
5440 * timeouts on the RTT. To make sure we always account for the
5441 * possible delay (and avoid the unnecessary retransmission),
5442 * TCP_SD_MIN is set to 400ms, twice the delayed ACK timeout of
5443 * 200ms on older SunOS/BSD systems and modern Windows systems
5444 * (as of 2019). This means that the minimum possible mean
5445 * deviation is 100 ms.
5446 */
5447 sv = TCP_SD_MIN;
5448 }
5449 tcp->tcp_rtt_sa = sa;
5450 tcp->tcp_rtt_sd = sv;
5451
5452 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0);
5453
5454 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5455 tcp->tcp_timer_backoff = 0;
5456 }
5457
5458 /*
5459 * On a labeled system we have some protocols above TCP, such as RPC, which
5460 * appear to assume that every mblk in a chain has a db_credp.
5461 */
5462 static void
5463 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5464 {
5465 ASSERT(is_system_labeled());
5466 ASSERT(ira->ira_cred != NULL);
5467
5468 while (mp != NULL) {
5469 mblk_setcred(mp, ira->ira_cred, NOPID);
5470 mp = mp->b_cont;
5471 }
5472 }
5473
5474 uint_t
5475 tcp_rwnd_reopen(tcp_t *tcp)
5476 {
5477 uint_t ret = 0;
5478 uint_t thwin;
5479 conn_t *connp = tcp->tcp_connp;
5480
5481 /* Learn the latest rwnd information that we sent to the other side. */
5482 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5483 << tcp->tcp_rcv_ws;
5484 /* This is peer's calculated send window (our receive window). */
5485 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5486 /*
5487 * Increase the receive window to max. But we need to do receiver
5488 * SWS avoidance. This means that we need to check the increase of
5489 * of receive window is at least 1 MSS.
5490 */
5491 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5492 /*
5493 * If the window that the other side knows is less than max
5494 * deferred acks segments, send an update immediately.
5495 */
5496 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5497 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5498 ret = TH_ACK_NEEDED;
5499 }
5500 tcp->tcp_rwnd = connp->conn_rcvbuf;
5501 }
5502 return (ret);
5503 }
5504
5505 /*
5506 * Handle a packet that has been reclassified by TCP.
5507 * This function drops the ref on connp that the caller had.
5508 */
5509 void
5510 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5511 {
5512 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5513
5514 if (connp->conn_incoming_ifindex != 0 &&
5515 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5516 freemsg(mp);
5517 CONN_DEC_REF(connp);
5518 return;
5519 }
5520
5521 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5522 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5523 ip6_t *ip6h;
5524 ipha_t *ipha;
5525
5526 if (ira->ira_flags & IRAF_IS_IPV4) {
5527 ipha = (ipha_t *)mp->b_rptr;
5528 ip6h = NULL;
5529 } else {
5530 ipha = NULL;
5531 ip6h = (ip6_t *)mp->b_rptr;
5532 }
5533 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5534 if (mp == NULL) {
5535 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5536 /* Note that mp is NULL */
5537 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5538 CONN_DEC_REF(connp);
5539 return;
5540 }
5541 }
5542
5543 if (IPCL_IS_TCP(connp)) {
5544 /*
5545 * do not drain, certain use cases can blow
5546 * the stack
5547 */
5548 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5549 connp->conn_recv, connp, ira,
5550 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5551 } else {
5552 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5553 (connp->conn_recv)(connp, mp, NULL,
5554 ira);
5555 CONN_DEC_REF(connp);
5556 }
5557
5558 }
5559
5560 /* ARGSUSED */
5561 static void
5562 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5563 {
5564 conn_t *connp = (conn_t *)arg;
5565 tcp_t *tcp = connp->conn_tcp;
5566 queue_t *q = connp->conn_rq;
5567
5568 ASSERT(!IPCL_IS_NONSTR(connp));
5569 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5570 tcp->tcp_rsrv_mp = mp;
5571 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5572
5573 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5574 return;
5575 }
5576
5577 if (tcp->tcp_fused) {
5578 tcp_fuse_backenable(tcp);
5579 return;
5580 }
5581
5582 if (canputnext(q)) {
5583 /* Not flow-controlled, open rwnd */
5584 tcp->tcp_rwnd = connp->conn_rcvbuf;
5585
5586 /*
5587 * Send back a window update immediately if TCP is above
5588 * ESTABLISHED state and the increase of the rcv window
5589 * that the other side knows is at least 1 MSS after flow
5590 * control is lifted.
5591 */
5592 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5593 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5594 tcp_xmit_ctl(NULL, tcp,
5595 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5596 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5597 }
5598 }
5599 }
5600
5601 /*
5602 * The read side service routine is called mostly when we get back-enabled as a
5603 * result of flow control relief. Since we don't actually queue anything in
5604 * TCP, we have no data to send out of here. What we do is clear the receive
5605 * window, and send out a window update.
5606 */
5607 int
5608 tcp_rsrv(queue_t *q)
5609 {
5610 conn_t *connp = Q_TO_CONN(q);
5611 tcp_t *tcp = connp->conn_tcp;
5612 mblk_t *mp;
5613
5614 /* No code does a putq on the read side */
5615 ASSERT(q->q_first == NULL);
5616
5617 /*
5618 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5619 * been run. So just return.
5620 */
5621 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5622 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5623 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5624 return (0);
5625 }
5626 tcp->tcp_rsrv_mp = NULL;
5627 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5628
5629 CONN_INC_REF(connp);
5630 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5631 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5632 return (0);
5633 }
5634
5635 /* At minimum we need 8 bytes in the TCP header for the lookup */
5636 #define ICMP_MIN_TCP_HDR 8
5637
5638 /*
5639 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5640 * passed up by IP. The message is always received on the correct tcp_t.
5641 * Assumes that IP has pulled up everything up to and including the ICMP header.
5642 */
5643 /* ARGSUSED2 */
5644 void
5645 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5646 {
5647 conn_t *connp = (conn_t *)arg1;
5648 icmph_t *icmph;
5649 ipha_t *ipha;
5650 int iph_hdr_length;
5651 tcpha_t *tcpha;
5652 uint32_t seg_seq;
5653 tcp_t *tcp = connp->conn_tcp;
5654
5655 /* Assume IP provides aligned packets */
5656 ASSERT(OK_32PTR(mp->b_rptr));
5657 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5658
5659 /*
5660 * It's possible we have a closed, but not yet destroyed, TCP
5661 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5662 * in the closed state, so don't take any chances and drop the packet.
5663 */
5664 if (tcp->tcp_state == TCPS_CLOSED) {
5665 freemsg(mp);
5666 return;
5667 }
5668
5669 /*
5670 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5671 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5672 */
5673 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5674 tcp_icmp_error_ipv6(tcp, mp, ira);
5675 return;
5676 }
5677
5678 /* Skip past the outer IP and ICMP headers */
5679 iph_hdr_length = ira->ira_ip_hdr_length;
5680 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5681 /*
5682 * If we don't have the correct outer IP header length
5683 * or if we don't have a complete inner IP header
5684 * drop it.
5685 */
5686 if (iph_hdr_length < sizeof (ipha_t) ||
5687 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5688 noticmpv4:
5689 freemsg(mp);
5690 return;
5691 }
5692 ipha = (ipha_t *)&icmph[1];
5693
5694 /* Skip past the inner IP and find the ULP header */
5695 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5696 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5697 /*
5698 * If we don't have the correct inner IP header length or if the ULP
5699 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5700 * bytes of TCP header, drop it.
5701 */
5702 if (iph_hdr_length < sizeof (ipha_t) ||
5703 ipha->ipha_protocol != IPPROTO_TCP ||
5704 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5705 goto noticmpv4;
5706 }
5707
5708 seg_seq = ntohl(tcpha->tha_seq);
5709 switch (icmph->icmph_type) {
5710 case ICMP_DEST_UNREACHABLE:
5711 switch (icmph->icmph_code) {
5712 case ICMP_FRAGMENTATION_NEEDED:
5713 /*
5714 * Update Path MTU, then try to send something out.
5715 */
5716 tcp_update_pmtu(tcp, B_TRUE);
5717 tcp_rexmit_after_error(tcp);
5718 break;
5719 case ICMP_PORT_UNREACHABLE:
5720 case ICMP_PROTOCOL_UNREACHABLE:
5721 switch (tcp->tcp_state) {
5722 case TCPS_SYN_SENT:
5723 case TCPS_SYN_RCVD:
5724 /*
5725 * ICMP can snipe away incipient
5726 * TCP connections as long as
5727 * seq number is same as initial
5728 * send seq number.
5729 */
5730 if (seg_seq == tcp->tcp_iss) {
5731 (void) tcp_clean_death(tcp,
5732 ECONNREFUSED);
5733 }
5734 break;
5735 }
5736 break;
5737 case ICMP_HOST_UNREACHABLE:
5738 case ICMP_NET_UNREACHABLE:
5739 /* Record the error in case we finally time out. */
5740 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5741 tcp->tcp_client_errno = EHOSTUNREACH;
5742 else
5743 tcp->tcp_client_errno = ENETUNREACH;
5744 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5745 if (tcp->tcp_listener != NULL &&
5746 tcp->tcp_listener->tcp_syn_defense) {
5747 /*
5748 * Ditch the half-open connection if we
5749 * suspect a SYN attack is under way.
5750 */
5751 (void) tcp_clean_death(tcp,
5752 tcp->tcp_client_errno);
5753 }
5754 }
5755 break;
5756 default:
5757 break;
5758 }
5759 break;
5760 case ICMP_SOURCE_QUENCH: {
5761 /*
5762 * use a global boolean to control
5763 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5764 * The default is false.
5765 */
5766 if (tcp_icmp_source_quench) {
5767 /*
5768 * Reduce the sending rate as if we got a
5769 * retransmit timeout
5770 */
5771 uint32_t npkt;
5772
5773 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5774 tcp->tcp_mss;
5775 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5776
5777 DTRACE_PROBE3(cwnd__source__quench, tcp_t *, tcp,
5778 uint32_t, tcp->tcp_cwnd,
5779 uint32_t, tcp->tcp_mss);
5780 tcp->tcp_cwnd = tcp->tcp_mss;
5781 tcp->tcp_cwnd_cnt = 0;
5782 }
5783 break;
5784 }
5785 }
5786 freemsg(mp);
5787 }
5788
5789 /*
5790 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5791 * error messages passed up by IP.
5792 * Assumes that IP has pulled up all the extension headers as well
5793 * as the ICMPv6 header.
5794 */
5795 static void
5796 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5797 {
5798 icmp6_t *icmp6;
5799 ip6_t *ip6h;
5800 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5801 tcpha_t *tcpha;
5802 uint8_t *nexthdrp;
5803 uint32_t seg_seq;
5804
5805 /*
5806 * Verify that we have a complete IP header.
5807 */
5808 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5809
5810 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5811 ip6h = (ip6_t *)&icmp6[1];
5812 /*
5813 * Verify if we have a complete ICMP and inner IP header.
5814 */
5815 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5816 noticmpv6:
5817 freemsg(mp);
5818 return;
5819 }
5820
5821 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5822 goto noticmpv6;
5823 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5824 /*
5825 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5826 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5827 * packet.
5828 */
5829 if ((*nexthdrp != IPPROTO_TCP) ||
5830 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5831 goto noticmpv6;
5832 }
5833
5834 seg_seq = ntohl(tcpha->tha_seq);
5835 switch (icmp6->icmp6_type) {
5836 case ICMP6_PACKET_TOO_BIG:
5837 /*
5838 * Update Path MTU, then try to send something out.
5839 */
5840 tcp_update_pmtu(tcp, B_TRUE);
5841 tcp_rexmit_after_error(tcp);
5842 break;
5843 case ICMP6_DST_UNREACH:
5844 switch (icmp6->icmp6_code) {
5845 case ICMP6_DST_UNREACH_NOPORT:
5846 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5847 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5848 (seg_seq == tcp->tcp_iss)) {
5849 (void) tcp_clean_death(tcp, ECONNREFUSED);
5850 }
5851 break;
5852 case ICMP6_DST_UNREACH_ADMIN:
5853 case ICMP6_DST_UNREACH_NOROUTE:
5854 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5855 case ICMP6_DST_UNREACH_ADDR:
5856 /* Record the error in case we finally time out. */
5857 tcp->tcp_client_errno = EHOSTUNREACH;
5858 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5859 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5860 (seg_seq == tcp->tcp_iss)) {
5861 if (tcp->tcp_listener != NULL &&
5862 tcp->tcp_listener->tcp_syn_defense) {
5863 /*
5864 * Ditch the half-open connection if we
5865 * suspect a SYN attack is under way.
5866 */
5867 (void) tcp_clean_death(tcp,
5868 tcp->tcp_client_errno);
5869 }
5870 }
5871
5872
5873 break;
5874 default:
5875 break;
5876 }
5877 break;
5878 case ICMP6_PARAM_PROB:
5879 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5880 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5881 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5882 (uchar_t *)nexthdrp) {
5883 if (tcp->tcp_state == TCPS_SYN_SENT ||
5884 tcp->tcp_state == TCPS_SYN_RCVD) {
5885 (void) tcp_clean_death(tcp, ECONNREFUSED);
5886 }
5887 break;
5888 }
5889 break;
5890
5891 case ICMP6_TIME_EXCEEDED:
5892 default:
5893 break;
5894 }
5895 freemsg(mp);
5896 }
5897
5898 /*
5899 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5900 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5901 *
5902 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5903 * error messages received by IP. The message is always received on the correct
5904 * tcp_t.
5905 */
5906 /* ARGSUSED */
5907 boolean_t
5908 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5909 ip_recv_attr_t *ira)
5910 {
5911 tcpha_t *tcpha = (tcpha_t *)arg2;
5912 uint32_t seq = ntohl(tcpha->tha_seq);
5913 tcp_t *tcp = connp->conn_tcp;
5914
5915 /*
5916 * TCP sequence number contained in payload of the ICMP error message
5917 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5918 * the message is either a stale ICMP error, or an attack from the
5919 * network. Fail the verification.
5920 */
5921 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5922 return (B_FALSE);
5923
5924 /* For "too big" we also check the ignore flag */
5925 if (ira->ira_flags & IRAF_IS_IPV4) {
5926 ASSERT(icmph != NULL);
5927 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5928 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5929 tcp->tcp_tcps->tcps_ignore_path_mtu)
5930 return (B_FALSE);
5931 } else {
5932 ASSERT(icmp6 != NULL);
5933 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5934 tcp->tcp_tcps->tcps_ignore_path_mtu)
5935 return (B_FALSE);
5936 }
5937 return (B_TRUE);
5938 }