Print this page
11547 Want connstat(1M) command to display per-connection TCP statistics
Portions contributed by: Cody Peter Mello <cody.mello@joyent.com>
Portions contributed by: Ahmed G <ahmedg@delphix.com>
Reviewed by: Jason King <jason.king@joyent.com>
Reviewed by: Robert Mustacchi <rm@joyent.com>
Reviewed by: Dan McDonald <danmcd@joyent.com>
| Split |
Close |
| Expand all |
| Collapse all |
--- old/usr/src/uts/common/inet/tcp/tcp_input.c
+++ new/usr/src/uts/common/inet/tcp/tcp_input.c
1 1 /*
2 2 * CDDL HEADER START
3 3 *
4 4 * The contents of this file are subject to the terms of the
5 5 * Common Development and Distribution License (the "License").
6 6 * You may not use this file except in compliance with the License.
7 7 *
8 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 9 * or http://www.opensolaris.org/os/licensing.
10 10 * See the License for the specific language governing permissions
11 11 * and limitations under the License.
12 12 *
13 13 * When distributing Covered Code, include this CDDL HEADER in each
14 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 15 * If applicable, add the following below this CDDL HEADER, with the
16 16 * fields enclosed by brackets "[]" replaced with your own identifying
17 17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 18 *
19 19 * CDDL HEADER END
20 20 */
21 21
22 22 /*
23 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 25 * Copyright 2019 Joyent, Inc.
26 26 * Copyright (c) 2014, 2016 by Delphix. All rights reserved.
27 27 */
28 28
29 29 /* This file contains all TCP input processing functions. */
30 30
31 31 #include <sys/types.h>
32 32 #include <sys/stream.h>
33 33 #include <sys/strsun.h>
34 34 #include <sys/strsubr.h>
35 35 #include <sys/stropts.h>
36 36 #include <sys/strlog.h>
37 37 #define _SUN_TPI_VERSION 2
38 38 #include <sys/tihdr.h>
39 39 #include <sys/suntpi.h>
40 40 #include <sys/xti_inet.h>
41 41 #include <sys/squeue_impl.h>
42 42 #include <sys/squeue.h>
43 43 #include <sys/tsol/tnet.h>
44 44
45 45 #include <inet/common.h>
46 46 #include <inet/ip.h>
47 47 #include <inet/tcp.h>
48 48 #include <inet/tcp_impl.h>
49 49 #include <inet/tcp_cluster.h>
50 50 #include <inet/proto_set.h>
51 51 #include <inet/ipsec_impl.h>
52 52
53 53 /*
54 54 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
55 55 */
56 56
57 57 #ifdef _BIG_ENDIAN
58 58 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
59 59 (TCPOPT_TSTAMP << 8) | 10)
60 60 #else
61 61 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
62 62 (TCPOPT_NOP << 8) | TCPOPT_NOP)
63 63 #endif
64 64
65 65 /*
66 66 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
67 67 */
68 68 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
69 69
70 70 /*
71 71 * Since tcp_listener is not cleared atomically with tcp_detached
72 72 * being cleared we need this extra bit to tell a detached connection
73 73 * apart from one that is in the process of being accepted.
74 74 */
75 75 #define TCP_IS_DETACHED_NONEAGER(tcp) \
76 76 (TCP_IS_DETACHED(tcp) && \
77 77 (!(tcp)->tcp_hard_binding))
78 78
79 79 /*
80 80 * Steps to do when a tcp_t moves to TIME-WAIT state.
81 81 *
82 82 * This connection is done, we don't need to account for it. Decrement
83 83 * the listener connection counter if needed.
84 84 *
85 85 * Decrement the connection counter of the stack. Note that this counter
86 86 * is per CPU. So the total number of connections in a stack is the sum of all
87 87 * of them. Since there is no lock for handling all of them exclusively, the
88 88 * resulting sum is only an approximation.
89 89 *
90 90 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
91 91 * connection won't interfere with new ones.
92 92 *
93 93 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
94 94 * the timer is handled within the context of this tcp_t. When the timer
95 95 * fires, tcp_clean_death() is called. If upper layer closes the connection
96 96 * during this period, tcp_time_wait_append() will be called to add this
97 97 * tcp_t to the global TIME-WAIT list. Note that this means that the
98 98 * actual wait time in TIME-WAIT state will be longer than the
99 99 * tcps_time_wait_interval since the period before upper layer closes the
100 100 * connection is not accounted for when tcp_time_wait_append() is called.
101 101 *
102 102 * If upper layer has closed the connection, call tcp_time_wait_append()
103 103 * directly.
104 104 *
105 105 */
106 106 #define SET_TIME_WAIT(tcps, tcp, connp) \
107 107 { \
108 108 (tcp)->tcp_state = TCPS_TIME_WAIT; \
109 109 if ((tcp)->tcp_listen_cnt != NULL) \
110 110 TCP_DECR_LISTEN_CNT(tcp); \
111 111 atomic_dec_64( \
112 112 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
113 113 (connp)->conn_exclbind = 0; \
114 114 if (!TCP_IS_DETACHED(tcp)) { \
115 115 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
116 116 } else { \
117 117 tcp_time_wait_append(tcp); \
118 118 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
119 119 } \
120 120 }
121 121
122 122 /*
123 123 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
124 124 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
125 125 * data, TCP will not respond with an ACK. RFC 793 requires that
126 126 * TCP responds with an ACK for such a bogus ACK. By not following
127 127 * the RFC, we prevent TCP from getting into an ACK storm if somehow
128 128 * an attacker successfully spoofs an acceptable segment to our
129 129 * peer; or when our peer is "confused."
130 130 */
131 131 static uint32_t tcp_drop_ack_unsent_cnt = 10;
132 132
133 133 /*
134 134 * To protect TCP against attacker using a small window and requesting
135 135 * large amount of data (DoS attack by conuming memory), TCP checks the
136 136 * window advertised in the last ACK of the 3-way handshake. TCP uses
137 137 * the tcp_mss (the size of one packet) value for comparion. The window
138 138 * should be larger than tcp_mss. But while a sane TCP should advertise
139 139 * a receive window larger than or equal to 4*MSS to avoid stop and go
140 140 * tarrfic, not all TCP stacks do that. This is especially true when
141 141 * tcp_mss is a big value.
142 142 *
143 143 * To work around this issue, an additional fixed value for comparison
144 144 * is also used. If the advertised window is smaller than both tcp_mss
145 145 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
146 146 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
147 147 * smaller than 8K is considered to be OK.
148 148 */
149 149 static uint32_t tcp_init_wnd_chk = 4096;
150 150
151 151 /* Process ICMP source quench message or not. */
152 152 static boolean_t tcp_icmp_source_quench = B_FALSE;
153 153
154 154 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
155 155
156 156 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
157 157 ip_recv_attr_t *);
158 158 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
159 159 ip_recv_attr_t *);
160 160 static boolean_t tcp_drop_q0(tcp_t *);
161 161 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
162 162 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
163 163 ip_recv_attr_t *);
164 164 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
165 165 static void tcp_process_options(tcp_t *, tcpha_t *);
166 166 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t);
167 167 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *);
168 168 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
169 169 static void tcp_set_rto(tcp_t *, hrtime_t);
170 170 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
171 171
172 172 /*
173 173 * Set the MSS associated with a particular tcp based on its current value,
174 174 * and a new one passed in. Observe minimums and maximums, and reset other
175 175 * state variables that we want to view as multiples of MSS.
176 176 *
177 177 * The value of MSS could be either increased or descreased.
178 178 */
179 179 void
180 180 tcp_mss_set(tcp_t *tcp, uint32_t mss)
181 181 {
182 182 uint32_t mss_max;
183 183 tcp_stack_t *tcps = tcp->tcp_tcps;
184 184 conn_t *connp = tcp->tcp_connp;
185 185
186 186 if (connp->conn_ipversion == IPV4_VERSION)
187 187 mss_max = tcps->tcps_mss_max_ipv4;
188 188 else
189 189 mss_max = tcps->tcps_mss_max_ipv6;
190 190
191 191 if (mss < tcps->tcps_mss_min)
192 192 mss = tcps->tcps_mss_min;
193 193 if (mss > mss_max)
194 194 mss = mss_max;
195 195 /*
196 196 * Unless naglim has been set by our client to
197 197 * a non-mss value, force naglim to track mss.
198 198 * This can help to aggregate small writes.
199 199 */
200 200 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
201 201 tcp->tcp_naglim = mss;
202 202 /*
203 203 * TCP should be able to buffer at least 4 MSS data for obvious
204 204 * performance reason.
205 205 */
206 206 if ((mss << 2) > connp->conn_sndbuf)
207 207 connp->conn_sndbuf = mss << 2;
208 208
209 209 /*
210 210 * Set the send lowater to at least twice of MSS.
211 211 */
212 212 if ((mss << 1) > connp->conn_sndlowat)
213 213 connp->conn_sndlowat = mss << 1;
214 214
215 215 /*
216 216 * Update tcp_cwnd according to the new value of MSS. Keep the
217 217 * previous ratio to preserve the transmit rate.
218 218 */
219 219 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
220 220 tcp->tcp_cwnd_cnt = 0;
221 221
222 222 tcp->tcp_mss = mss;
223 223 (void) tcp_maxpsz_set(tcp, B_TRUE);
224 224 }
225 225
226 226 /*
227 227 * Extract option values from a tcp header. We put any found values into the
228 228 * tcpopt struct and return a bitmask saying which options were found.
229 229 */
230 230 int
231 231 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
232 232 {
233 233 uchar_t *endp;
234 234 int len;
235 235 uint32_t mss;
236 236 uchar_t *up = (uchar_t *)tcpha;
237 237 int found = 0;
238 238 int32_t sack_len;
239 239 tcp_seq sack_begin, sack_end;
240 240 tcp_t *tcp;
241 241
242 242 endp = up + TCP_HDR_LENGTH(tcpha);
243 243 up += TCP_MIN_HEADER_LENGTH;
244 244 /*
245 245 * If timestamp option is aligned as recommended in RFC 7323 Appendix
246 246 * A, and is the only option, return quickly.
247 247 */
248 248 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
249 249 TCPOPT_REAL_TS_LEN &&
250 250 OK_32PTR(up) &&
251 251 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
252 252 tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4));
253 253 tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
254 254
255 255 return (TCP_OPT_TSTAMP_PRESENT);
256 256 }
257 257 while (up < endp) {
258 258 len = endp - up;
259 259 switch (*up) {
260 260 case TCPOPT_EOL:
261 261 break;
262 262
263 263 case TCPOPT_NOP:
264 264 up++;
265 265 continue;
266 266
267 267 case TCPOPT_MAXSEG:
268 268 if (len < TCPOPT_MAXSEG_LEN ||
269 269 up[1] != TCPOPT_MAXSEG_LEN)
270 270 break;
271 271
272 272 mss = BE16_TO_U16(up+2);
273 273 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
274 274 tcpopt->tcp_opt_mss = mss;
275 275 found |= TCP_OPT_MSS_PRESENT;
276 276
277 277 up += TCPOPT_MAXSEG_LEN;
278 278 continue;
279 279
280 280 case TCPOPT_WSCALE:
281 281 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
282 282 break;
283 283
284 284 if (up[2] > TCP_MAX_WINSHIFT)
285 285 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
286 286 else
287 287 tcpopt->tcp_opt_wscale = up[2];
288 288 found |= TCP_OPT_WSCALE_PRESENT;
289 289
290 290 up += TCPOPT_WS_LEN;
291 291 continue;
292 292
293 293 case TCPOPT_SACK_PERMITTED:
294 294 if (len < TCPOPT_SACK_OK_LEN ||
295 295 up[1] != TCPOPT_SACK_OK_LEN)
296 296 break;
297 297 found |= TCP_OPT_SACK_OK_PRESENT;
298 298 up += TCPOPT_SACK_OK_LEN;
299 299 continue;
300 300
301 301 case TCPOPT_SACK:
302 302 if (len <= 2 || up[1] <= 2 || len < up[1])
303 303 break;
304 304
305 305 /* If TCP is not interested in SACK blks... */
306 306 if ((tcp = tcpopt->tcp) == NULL) {
307 307 up += up[1];
308 308 continue;
309 309 }
310 310 sack_len = up[1] - TCPOPT_HEADER_LEN;
311 311 up += TCPOPT_HEADER_LEN;
312 312
313 313 /*
314 314 * If the list is empty, allocate one and assume
315 315 * nothing is sack'ed.
316 316 */
317 317 if (tcp->tcp_notsack_list == NULL) {
318 318 tcp_notsack_update(&(tcp->tcp_notsack_list),
319 319 tcp->tcp_suna, tcp->tcp_snxt,
320 320 &(tcp->tcp_num_notsack_blk),
321 321 &(tcp->tcp_cnt_notsack_list));
322 322
323 323 /*
324 324 * Make sure tcp_notsack_list is not NULL.
325 325 * This happens when kmem_alloc(KM_NOSLEEP)
326 326 * returns NULL.
327 327 */
328 328 if (tcp->tcp_notsack_list == NULL) {
329 329 up += sack_len;
330 330 continue;
331 331 }
332 332 tcp->tcp_fack = tcp->tcp_suna;
333 333 }
334 334
335 335 while (sack_len > 0) {
336 336 if (up + 8 > endp) {
337 337 up = endp;
338 338 break;
339 339 }
340 340 sack_begin = BE32_TO_U32(up);
341 341 up += 4;
342 342 sack_end = BE32_TO_U32(up);
343 343 up += 4;
344 344 sack_len -= 8;
345 345 /*
346 346 * Bounds checking. Make sure the SACK
347 347 * info is within tcp_suna and tcp_snxt.
348 348 * If this SACK blk is out of bound, ignore
349 349 * it but continue to parse the following
350 350 * blks.
351 351 */
352 352 if (SEQ_LEQ(sack_end, sack_begin) ||
353 353 SEQ_LT(sack_begin, tcp->tcp_suna) ||
354 354 SEQ_GT(sack_end, tcp->tcp_snxt)) {
355 355 continue;
356 356 }
357 357 tcp_notsack_insert(&(tcp->tcp_notsack_list),
358 358 sack_begin, sack_end,
359 359 &(tcp->tcp_num_notsack_blk),
360 360 &(tcp->tcp_cnt_notsack_list));
361 361 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
362 362 tcp->tcp_fack = sack_end;
363 363 }
364 364 }
365 365 found |= TCP_OPT_SACK_PRESENT;
366 366 continue;
367 367
368 368 case TCPOPT_TSTAMP:
369 369 if (len < TCPOPT_TSTAMP_LEN ||
370 370 up[1] != TCPOPT_TSTAMP_LEN)
371 371 break;
372 372
373 373 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
374 374 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
375 375
376 376 found |= TCP_OPT_TSTAMP_PRESENT;
377 377
378 378 up += TCPOPT_TSTAMP_LEN;
379 379 continue;
380 380
381 381 default:
382 382 if (len <= 1 || len < (int)up[1] || up[1] == 0)
383 383 break;
384 384 up += up[1];
385 385 continue;
386 386 }
387 387 break;
388 388 }
389 389 return (found);
390 390 }
391 391
392 392 /*
393 393 * Process all TCP option in SYN segment. Note that this function should
394 394 * be called after tcp_set_destination() is called so that the necessary info
395 395 * from IRE is already set in the tcp structure.
396 396 *
397 397 * This function sets up the correct tcp_mss value according to the
398 398 * MSS option value and our header size. It also sets up the window scale
399 399 * and timestamp values, and initialize SACK info blocks. But it does not
400 400 * change receive window size after setting the tcp_mss value. The caller
401 401 * should do the appropriate change.
402 402 */
403 403 static void
404 404 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
405 405 {
406 406 int options;
407 407 tcp_opt_t tcpopt;
408 408 uint32_t mss_max;
409 409 char *tmp_tcph;
410 410 tcp_stack_t *tcps = tcp->tcp_tcps;
411 411 conn_t *connp = tcp->tcp_connp;
412 412
413 413 tcpopt.tcp = NULL;
414 414 options = tcp_parse_options(tcpha, &tcpopt);
415 415
416 416 /*
417 417 * Process MSS option. Note that MSS option value does not account
418 418 * for IP or TCP options. This means that it is equal to MTU - minimum
419 419 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
420 420 * IPv6.
421 421 */
422 422 if (!(options & TCP_OPT_MSS_PRESENT)) {
423 423 if (connp->conn_ipversion == IPV4_VERSION)
424 424 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
425 425 else
426 426 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
427 427 } else {
428 428 if (connp->conn_ipversion == IPV4_VERSION)
429 429 mss_max = tcps->tcps_mss_max_ipv4;
430 430 else
431 431 mss_max = tcps->tcps_mss_max_ipv6;
432 432 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
433 433 tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
434 434 else if (tcpopt.tcp_opt_mss > mss_max)
435 435 tcpopt.tcp_opt_mss = mss_max;
436 436 }
437 437
438 438 /* Process Window Scale option. */
439 439 if (options & TCP_OPT_WSCALE_PRESENT) {
440 440 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
441 441 tcp->tcp_snd_ws_ok = B_TRUE;
442 442 } else {
443 443 tcp->tcp_snd_ws = B_FALSE;
444 444 tcp->tcp_snd_ws_ok = B_FALSE;
445 445 tcp->tcp_rcv_ws = B_FALSE;
446 446 }
447 447
448 448 /* Process Timestamp option. */
449 449 if ((options & TCP_OPT_TSTAMP_PRESENT) &&
450 450 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
451 451 tmp_tcph = (char *)tcp->tcp_tcpha;
452 452
453 453 tcp->tcp_snd_ts_ok = B_TRUE;
454 454 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
455 455 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
456 456 ASSERT(OK_32PTR(tmp_tcph));
457 457 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
458 458
459 459 /* Fill in our template header with basic timestamp option. */
460 460 tmp_tcph += connp->conn_ht_ulp_len;
461 461 tmp_tcph[0] = TCPOPT_NOP;
462 462 tmp_tcph[1] = TCPOPT_NOP;
463 463 tmp_tcph[2] = TCPOPT_TSTAMP;
464 464 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
465 465 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
466 466 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
467 467 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
468 468 } else {
469 469 tcp->tcp_snd_ts_ok = B_FALSE;
470 470 }
471 471
472 472 /*
473 473 * Process SACK options. If SACK is enabled for this connection,
474 474 * then allocate the SACK info structure. Note the following ways
475 475 * when tcp_snd_sack_ok is set to true.
476 476 *
477 477 * For active connection: in tcp_set_destination() called in
478 478 * tcp_connect().
479 479 *
480 480 * For passive connection: in tcp_set_destination() called in
481 481 * tcp_input_listener().
482 482 *
483 483 * That's the reason why the extra TCP_IS_DETACHED() check is there.
484 484 * That check makes sure that if we did not send a SACK OK option,
485 485 * we will not enable SACK for this connection even though the other
486 486 * side sends us SACK OK option. For active connection, the SACK
487 487 * info structure has already been allocated. So we need to free
488 488 * it if SACK is disabled.
489 489 */
490 490 if ((options & TCP_OPT_SACK_OK_PRESENT) &&
491 491 (tcp->tcp_snd_sack_ok ||
492 492 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
493 493 ASSERT(tcp->tcp_num_sack_blk == 0);
494 494 ASSERT(tcp->tcp_notsack_list == NULL);
495 495
496 496 tcp->tcp_snd_sack_ok = B_TRUE;
497 497 if (tcp->tcp_snd_ts_ok) {
498 498 tcp->tcp_max_sack_blk = 3;
499 499 } else {
500 500 tcp->tcp_max_sack_blk = 4;
501 501 }
502 502 } else if (tcp->tcp_snd_sack_ok) {
503 503 /*
504 504 * Resetting tcp_snd_sack_ok to B_FALSE so that
505 505 * no SACK info will be used for this
506 506 * connection. This assumes that SACK usage
507 507 * permission is negotiated. This may need
508 508 * to be changed once this is clarified.
509 509 */
510 510 ASSERT(tcp->tcp_num_sack_blk == 0);
511 511 ASSERT(tcp->tcp_notsack_list == NULL);
512 512 tcp->tcp_snd_sack_ok = B_FALSE;
513 513 }
514 514
515 515 /*
516 516 * Now we know the exact TCP/IP header length, subtract
517 517 * that from tcp_mss to get our side's MSS.
518 518 */
519 519 tcp->tcp_mss -= connp->conn_ht_iphc_len;
520 520
521 521 /*
522 522 * Here we assume that the other side's header size will be equal to
523 523 * our header size. We calculate the real MSS accordingly. Need to
524 524 * take into additional stuffs IPsec puts in.
525 525 *
526 526 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
527 527 */
528 528 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
529 529 tcp->tcp_ipsec_overhead -
530 530 ((connp->conn_ipversion == IPV4_VERSION ?
531 531 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
532 532
533 533 /*
534 534 * Set MSS to the smaller one of both ends of the connection.
535 535 * We should not have called tcp_mss_set() before, but our
536 536 * side of the MSS should have been set to a proper value
537 537 * by tcp_set_destination(). tcp_mss_set() will also set up the
538 538 * STREAM head parameters properly.
539 539 *
540 540 * If we have a larger-than-16-bit window but the other side
541 541 * didn't want to do window scale, tcp_rwnd_set() will take
542 542 * care of that.
543 543 */
544 544 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
545 545
546 546 /*
547 547 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
548 548 * updated properly.
549 549 */
550 550 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
551 551 }
|
↓ open down ↓ |
551 lines elided |
↑ open up ↑ |
552 552
553 553 /*
554 554 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
555 555 * is filled, return as much as we can. The message passed in may be
556 556 * multi-part, chained using b_cont. "start" is the starting sequence
557 557 * number for this piece.
558 558 */
559 559 static mblk_t *
560 560 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
561 561 {
562 - uint32_t end;
562 + uint32_t end, bytes;
563 563 mblk_t *mp1;
564 564 mblk_t *mp2;
565 565 mblk_t *next_mp;
566 566 uint32_t u1;
567 567 tcp_stack_t *tcps = tcp->tcp_tcps;
568 568
569 569
570 570 /* Walk through all the new pieces. */
571 571 do {
572 572 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
573 573 (uintptr_t)INT_MAX);
574 574 end = start + (int)(mp->b_wptr - mp->b_rptr);
575 575 next_mp = mp->b_cont;
576 576 if (start == end) {
577 577 /* Empty. Blast it. */
578 578 freeb(mp);
579 579 continue;
580 580 }
581 + bytes = end - start;
581 582 mp->b_cont = NULL;
582 583 TCP_REASS_SET_SEQ(mp, start);
583 584 TCP_REASS_SET_END(mp, end);
584 585 mp1 = tcp->tcp_reass_tail;
585 - if (!mp1) {
586 + if (mp1 == NULL || SEQ_GEQ(start, TCP_REASS_END(mp1))) {
587 + if (mp1 != NULL) {
588 + /*
589 + * New stuff is beyond the tail; link it on the
590 + * end.
591 + */
592 + mp1->b_cont = mp;
593 + } else {
594 + tcp->tcp_reass_head = mp;
595 + }
586 596 tcp->tcp_reass_tail = mp;
587 - tcp->tcp_reass_head = mp;
588 597 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
589 - TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
590 - end - start);
598 + TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, bytes);
599 + tcp->tcp_cs.tcp_in_data_unorder_segs++;
600 + tcp->tcp_cs.tcp_in_data_unorder_bytes += bytes;
591 601 continue;
592 602 }
593 - /* New stuff completely beyond tail? */
594 - if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
595 - /* Link it on end. */
596 - mp1->b_cont = mp;
597 - tcp->tcp_reass_tail = mp;
598 - TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
599 - TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
600 - end - start);
601 - continue;
602 - }
603 603 mp1 = tcp->tcp_reass_head;
604 604 u1 = TCP_REASS_SEQ(mp1);
605 605 /* New stuff at the front? */
606 606 if (SEQ_LT(start, u1)) {
607 607 /* Yes... Check for overlap. */
608 608 mp->b_cont = mp1;
609 609 tcp->tcp_reass_head = mp;
610 610 tcp_reass_elim_overlap(tcp, mp);
611 611 continue;
612 612 }
613 613 /*
614 614 * The new piece fits somewhere between the head and tail.
615 615 * We find our slot, where mp1 precedes us and mp2 trails.
616 616 */
617 617 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
618 618 u1 = TCP_REASS_SEQ(mp2);
619 619 if (SEQ_LEQ(start, u1))
620 620 break;
621 621 }
622 622 /* Link ourselves in */
623 623 mp->b_cont = mp2;
624 624 mp1->b_cont = mp;
625 625
626 626 /* Trim overlap with following mblk(s) first */
627 627 tcp_reass_elim_overlap(tcp, mp);
628 628
629 629 /* Trim overlap with preceding mblk */
630 630 tcp_reass_elim_overlap(tcp, mp1);
631 631
632 632 } while (start = end, mp = next_mp);
633 633 mp1 = tcp->tcp_reass_head;
634 634 /* Anything ready to go? */
635 635 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
636 636 return (NULL);
637 637 /* Eat what we can off the queue */
638 638 for (;;) {
639 639 mp = mp1->b_cont;
640 640 end = TCP_REASS_END(mp1);
641 641 TCP_REASS_SET_SEQ(mp1, 0);
642 642 TCP_REASS_SET_END(mp1, 0);
643 643 if (!mp) {
644 644 tcp->tcp_reass_tail = NULL;
645 645 break;
646 646 }
647 647 if (end != TCP_REASS_SEQ(mp)) {
648 648 mp1->b_cont = NULL;
649 649 break;
650 650 }
651 651 mp1 = mp;
652 652 }
653 653 mp1 = tcp->tcp_reass_head;
654 654 tcp->tcp_reass_head = mp;
655 655 return (mp1);
656 656 }
657 657
658 658 /* Eliminate any overlap that mp may have over later mblks */
659 659 static void
660 660 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
661 661 {
662 662 uint32_t end;
663 663 mblk_t *mp1;
664 664 uint32_t u1;
665 665 tcp_stack_t *tcps = tcp->tcp_tcps;
666 666
667 667 end = TCP_REASS_END(mp);
668 668 while ((mp1 = mp->b_cont) != NULL) {
669 669 u1 = TCP_REASS_SEQ(mp1);
670 670 if (!SEQ_GT(end, u1))
671 671 break;
672 672 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
673 673 mp->b_wptr -= end - u1;
674 674 TCP_REASS_SET_END(mp, u1);
675 675 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
676 676 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
677 677 end - u1);
678 678 break;
679 679 }
680 680 mp->b_cont = mp1->b_cont;
681 681 TCP_REASS_SET_SEQ(mp1, 0);
682 682 TCP_REASS_SET_END(mp1, 0);
683 683 freeb(mp1);
684 684 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
685 685 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
686 686 }
687 687 if (!mp1)
688 688 tcp->tcp_reass_tail = mp;
689 689 }
690 690
691 691 /*
692 692 * This function does PAWS protection check, per RFC 7323 section 5. Requires
693 693 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
694 694 * the segment passes the PAWS test, else returns B_FALSE.
695 695 */
696 696 boolean_t
697 697 tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp)
698 698 {
699 699 if (TSTMP_LT(tcpoptp->tcp_opt_ts_val,
700 700 tcp->tcp_ts_recent)) {
701 701 if (LBOLT_FASTPATH64 <
702 702 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
703 703 /* This segment is not acceptable. */
704 704 return (B_FALSE);
705 705 } else {
706 706 /*
707 707 * Connection has been idle for
708 708 * too long. Reset the timestamp
709 709 */
710 710 tcp->tcp_ts_recent =
711 711 tcpoptp->tcp_opt_ts_val;
712 712 }
713 713 }
714 714 return (B_TRUE);
715 715 }
716 716
717 717 /*
718 718 * Defense for the SYN attack -
719 719 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
720 720 * one from the list of droppable eagers. This list is a subset of q0.
721 721 * see comments before the definition of MAKE_DROPPABLE().
722 722 * 2. Don't drop a SYN request before its first timeout. This gives every
723 723 * request at least til the first timeout to complete its 3-way handshake.
724 724 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
725 725 * requests currently on the queue that has timed out. This will be used
726 726 * as an indicator of whether an attack is under way, so that appropriate
727 727 * actions can be taken. (It's incremented in tcp_timer() and decremented
728 728 * either when eager goes into ESTABLISHED, or gets freed up.)
729 729 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
730 730 * # of timeout drops back to <= q0len/32 => SYN alert off
731 731 */
732 732 static boolean_t
733 733 tcp_drop_q0(tcp_t *tcp)
734 734 {
735 735 tcp_t *eager;
736 736 mblk_t *mp;
737 737 tcp_stack_t *tcps = tcp->tcp_tcps;
738 738
739 739 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
740 740 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
741 741
742 742 /* Pick oldest eager from the list of droppable eagers */
743 743 eager = tcp->tcp_eager_prev_drop_q0;
744 744
745 745 /* If list is empty. return B_FALSE */
746 746 if (eager == tcp) {
747 747 return (B_FALSE);
748 748 }
749 749
750 750 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
751 751 if ((mp = allocb(0, BPRI_HI)) == NULL)
752 752 return (B_FALSE);
753 753
754 754 /*
755 755 * Take this eager out from the list of droppable eagers since we are
756 756 * going to drop it.
757 757 */
758 758 MAKE_UNDROPPABLE(eager);
759 759
760 760 if (tcp->tcp_connp->conn_debug) {
761 761 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
762 762 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
763 763 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
764 764 tcp->tcp_conn_req_cnt_q0,
765 765 tcp_display(tcp, NULL, DISP_PORT_ONLY));
766 766 }
767 767
768 768 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
769 769
770 770 /* Put a reference on the conn as we are enqueueing it in the sqeue */
771 771 CONN_INC_REF(eager->tcp_connp);
772 772
773 773 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
774 774 tcp_clean_death_wrapper, eager->tcp_connp, NULL,
775 775 SQ_FILL, SQTAG_TCP_DROP_Q0);
776 776
777 777 return (B_TRUE);
778 778 }
779 779
780 780 /*
781 781 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
782 782 */
783 783 static mblk_t *
784 784 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
785 785 ip_recv_attr_t *ira)
786 786 {
787 787 tcp_t *ltcp = lconnp->conn_tcp;
788 788 tcp_t *tcp = connp->conn_tcp;
789 789 mblk_t *tpi_mp;
790 790 ipha_t *ipha;
791 791 ip6_t *ip6h;
792 792 sin6_t sin6;
793 793 uint_t ifindex = ira->ira_ruifindex;
794 794 tcp_stack_t *tcps = tcp->tcp_tcps;
795 795
796 796 if (ira->ira_flags & IRAF_IS_IPV4) {
797 797 ipha = (ipha_t *)mp->b_rptr;
798 798
799 799 connp->conn_ipversion = IPV4_VERSION;
800 800 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
801 801 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
802 802 connp->conn_saddr_v6 = connp->conn_laddr_v6;
803 803
804 804 sin6 = sin6_null;
805 805 sin6.sin6_addr = connp->conn_faddr_v6;
806 806 sin6.sin6_port = connp->conn_fport;
807 807 sin6.sin6_family = AF_INET6;
808 808 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
809 809 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
810 810
811 811 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
812 812 sin6_t sin6d;
813 813
814 814 sin6d = sin6_null;
815 815 sin6d.sin6_addr = connp->conn_laddr_v6;
816 816 sin6d.sin6_port = connp->conn_lport;
817 817 sin6d.sin6_family = AF_INET;
818 818 tpi_mp = mi_tpi_extconn_ind(NULL,
819 819 (char *)&sin6d, sizeof (sin6_t),
820 820 (char *)&tcp,
821 821 (t_scalar_t)sizeof (intptr_t),
822 822 (char *)&sin6d, sizeof (sin6_t),
823 823 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
824 824 } else {
825 825 tpi_mp = mi_tpi_conn_ind(NULL,
826 826 (char *)&sin6, sizeof (sin6_t),
827 827 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
828 828 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
829 829 }
830 830 } else {
831 831 ip6h = (ip6_t *)mp->b_rptr;
832 832
833 833 connp->conn_ipversion = IPV6_VERSION;
834 834 connp->conn_laddr_v6 = ip6h->ip6_dst;
835 835 connp->conn_faddr_v6 = ip6h->ip6_src;
836 836 connp->conn_saddr_v6 = connp->conn_laddr_v6;
837 837
838 838 sin6 = sin6_null;
839 839 sin6.sin6_addr = connp->conn_faddr_v6;
840 840 sin6.sin6_port = connp->conn_fport;
841 841 sin6.sin6_family = AF_INET6;
842 842 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
843 843 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
844 844 IPCL_ZONEID(lconnp), tcps->tcps_netstack);
845 845
846 846 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
847 847 /* Pass up the scope_id of remote addr */
848 848 sin6.sin6_scope_id = ifindex;
849 849 } else {
850 850 sin6.sin6_scope_id = 0;
851 851 }
852 852 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
853 853 sin6_t sin6d;
854 854
855 855 sin6d = sin6_null;
856 856 sin6.sin6_addr = connp->conn_laddr_v6;
857 857 sin6d.sin6_port = connp->conn_lport;
858 858 sin6d.sin6_family = AF_INET6;
859 859 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
860 860 sin6d.sin6_scope_id = ifindex;
861 861
862 862 tpi_mp = mi_tpi_extconn_ind(NULL,
863 863 (char *)&sin6d, sizeof (sin6_t),
864 864 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
865 865 (char *)&sin6d, sizeof (sin6_t),
866 866 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
867 867 } else {
868 868 tpi_mp = mi_tpi_conn_ind(NULL,
869 869 (char *)&sin6, sizeof (sin6_t),
870 870 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
871 871 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
872 872 }
873 873 }
874 874
875 875 tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
876 876 return (tpi_mp);
877 877 }
878 878
879 879 /* Handle a SYN on an AF_INET socket */
880 880 static mblk_t *
881 881 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
882 882 ip_recv_attr_t *ira)
883 883 {
884 884 tcp_t *ltcp = lconnp->conn_tcp;
885 885 tcp_t *tcp = connp->conn_tcp;
886 886 sin_t sin;
887 887 mblk_t *tpi_mp = NULL;
888 888 tcp_stack_t *tcps = tcp->tcp_tcps;
889 889 ipha_t *ipha;
890 890
891 891 ASSERT(ira->ira_flags & IRAF_IS_IPV4);
892 892 ipha = (ipha_t *)mp->b_rptr;
893 893
894 894 connp->conn_ipversion = IPV4_VERSION;
895 895 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
896 896 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
897 897 connp->conn_saddr_v6 = connp->conn_laddr_v6;
898 898
899 899 sin = sin_null;
900 900 sin.sin_addr.s_addr = connp->conn_faddr_v4;
901 901 sin.sin_port = connp->conn_fport;
902 902 sin.sin_family = AF_INET;
903 903 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
904 904 sin_t sind;
905 905
906 906 sind = sin_null;
907 907 sind.sin_addr.s_addr = connp->conn_laddr_v4;
908 908 sind.sin_port = connp->conn_lport;
909 909 sind.sin_family = AF_INET;
910 910 tpi_mp = mi_tpi_extconn_ind(NULL,
911 911 (char *)&sind, sizeof (sin_t), (char *)&tcp,
912 912 (t_scalar_t)sizeof (intptr_t), (char *)&sind,
913 913 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
914 914 } else {
915 915 tpi_mp = mi_tpi_conn_ind(NULL,
916 916 (char *)&sin, sizeof (sin_t),
917 917 (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
918 918 (t_scalar_t)ltcp->tcp_conn_req_seqnum);
919 919 }
920 920
921 921 tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
922 922 return (tpi_mp);
923 923 }
924 924
925 925 /*
926 926 * Called via squeue to get on to eager's perimeter. It sends a
927 927 * TH_RST if eager is in the fanout table. The listener wants the
928 928 * eager to disappear either by means of tcp_eager_blowoff() or
929 929 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
930 930 * called (via squeue) if the eager cannot be inserted in the
931 931 * fanout table in tcp_input_listener().
932 932 */
933 933 /* ARGSUSED */
934 934 void
935 935 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
936 936 {
937 937 conn_t *econnp = (conn_t *)arg;
938 938 tcp_t *eager = econnp->conn_tcp;
939 939 tcp_t *listener = eager->tcp_listener;
940 940
941 941 /*
942 942 * We could be called because listener is closing. Since
943 943 * the eager was using listener's queue's, we avoid
944 944 * using the listeners queues from now on.
945 945 */
946 946 ASSERT(eager->tcp_detached);
947 947 econnp->conn_rq = NULL;
948 948 econnp->conn_wq = NULL;
949 949
950 950 /*
951 951 * An eager's conn_fanout will be NULL if it's a duplicate
952 952 * for an existing 4-tuples in the conn fanout table.
953 953 * We don't want to send an RST out in such case.
954 954 */
955 955 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
956 956 tcp_xmit_ctl("tcp_eager_kill, can't wait",
957 957 eager, eager->tcp_snxt, 0, TH_RST);
958 958 }
959 959
960 960 /* We are here because listener wants this eager gone */
961 961 if (listener != NULL) {
962 962 mutex_enter(&listener->tcp_eager_lock);
963 963 tcp_eager_unlink(eager);
964 964 if (eager->tcp_tconnind_started) {
965 965 /*
966 966 * The eager has sent a conn_ind up to the
967 967 * listener but listener decides to close
968 968 * instead. We need to drop the extra ref
969 969 * placed on eager in tcp_input_data() before
970 970 * sending the conn_ind to listener.
971 971 */
972 972 CONN_DEC_REF(econnp);
973 973 }
974 974 mutex_exit(&listener->tcp_eager_lock);
975 975 CONN_DEC_REF(listener->tcp_connp);
976 976 }
977 977
978 978 if (eager->tcp_state != TCPS_CLOSED)
979 979 tcp_close_detached(eager);
980 980 }
981 981
982 982 /*
983 983 * Reset any eager connection hanging off this listener marked
984 984 * with 'seqnum' and then reclaim it's resources.
985 985 */
986 986 boolean_t
987 987 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
988 988 {
989 989 tcp_t *eager;
990 990 mblk_t *mp;
991 991
992 992 eager = listener;
993 993 mutex_enter(&listener->tcp_eager_lock);
994 994 do {
995 995 eager = eager->tcp_eager_next_q;
996 996 if (eager == NULL) {
997 997 mutex_exit(&listener->tcp_eager_lock);
998 998 return (B_FALSE);
999 999 }
1000 1000 } while (eager->tcp_conn_req_seqnum != seqnum);
1001 1001
1002 1002 if (eager->tcp_closemp_used) {
1003 1003 mutex_exit(&listener->tcp_eager_lock);
1004 1004 return (B_TRUE);
1005 1005 }
1006 1006 eager->tcp_closemp_used = B_TRUE;
1007 1007 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1008 1008 CONN_INC_REF(eager->tcp_connp);
1009 1009 mutex_exit(&listener->tcp_eager_lock);
1010 1010 mp = &eager->tcp_closemp;
1011 1011 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1012 1012 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1013 1013 return (B_TRUE);
1014 1014 }
1015 1015
1016 1016 /*
1017 1017 * Reset any eager connection hanging off this listener
1018 1018 * and then reclaim it's resources.
1019 1019 */
1020 1020 void
1021 1021 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1022 1022 {
1023 1023 tcp_t *eager;
1024 1024 mblk_t *mp;
1025 1025 tcp_stack_t *tcps = listener->tcp_tcps;
1026 1026
1027 1027 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1028 1028
1029 1029 if (!q0_only) {
1030 1030 /* First cleanup q */
1031 1031 TCP_STAT(tcps, tcp_eager_blowoff_q);
1032 1032 eager = listener->tcp_eager_next_q;
1033 1033 while (eager != NULL) {
1034 1034 if (!eager->tcp_closemp_used) {
1035 1035 eager->tcp_closemp_used = B_TRUE;
1036 1036 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1037 1037 CONN_INC_REF(eager->tcp_connp);
1038 1038 mp = &eager->tcp_closemp;
1039 1039 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1040 1040 tcp_eager_kill, eager->tcp_connp, NULL,
1041 1041 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1042 1042 }
1043 1043 eager = eager->tcp_eager_next_q;
1044 1044 }
1045 1045 }
1046 1046 /* Then cleanup q0 */
1047 1047 TCP_STAT(tcps, tcp_eager_blowoff_q0);
1048 1048 eager = listener->tcp_eager_next_q0;
1049 1049 while (eager != listener) {
1050 1050 if (!eager->tcp_closemp_used) {
1051 1051 eager->tcp_closemp_used = B_TRUE;
1052 1052 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1053 1053 CONN_INC_REF(eager->tcp_connp);
1054 1054 mp = &eager->tcp_closemp;
1055 1055 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1056 1056 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1057 1057 SQTAG_TCP_EAGER_CLEANUP_Q0);
1058 1058 }
1059 1059 eager = eager->tcp_eager_next_q0;
1060 1060 }
1061 1061 }
1062 1062
1063 1063 /*
1064 1064 * If we are an eager connection hanging off a listener that hasn't
1065 1065 * formally accepted the connection yet, get off its list and blow off
1066 1066 * any data that we have accumulated.
1067 1067 */
1068 1068 void
1069 1069 tcp_eager_unlink(tcp_t *tcp)
1070 1070 {
1071 1071 tcp_t *listener = tcp->tcp_listener;
1072 1072
1073 1073 ASSERT(listener != NULL);
1074 1074 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1075 1075 if (tcp->tcp_eager_next_q0 != NULL) {
1076 1076 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1077 1077
1078 1078 /* Remove the eager tcp from q0 */
1079 1079 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1080 1080 tcp->tcp_eager_prev_q0;
1081 1081 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1082 1082 tcp->tcp_eager_next_q0;
1083 1083 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1084 1084 listener->tcp_conn_req_cnt_q0--;
1085 1085
1086 1086 tcp->tcp_eager_next_q0 = NULL;
1087 1087 tcp->tcp_eager_prev_q0 = NULL;
1088 1088
1089 1089 /*
1090 1090 * Take the eager out, if it is in the list of droppable
1091 1091 * eagers.
1092 1092 */
1093 1093 MAKE_UNDROPPABLE(tcp);
1094 1094
1095 1095 if (tcp->tcp_syn_rcvd_timeout != 0) {
1096 1096 /* we have timed out before */
1097 1097 ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1098 1098 listener->tcp_syn_rcvd_timeout--;
1099 1099 }
1100 1100 } else {
1101 1101 tcp_t **tcpp = &listener->tcp_eager_next_q;
1102 1102 tcp_t *prev = NULL;
1103 1103
1104 1104 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1105 1105 if (tcpp[0] == tcp) {
1106 1106 if (listener->tcp_eager_last_q == tcp) {
1107 1107 /*
1108 1108 * If we are unlinking the last
1109 1109 * element on the list, adjust
1110 1110 * tail pointer. Set tail pointer
1111 1111 * to nil when list is empty.
1112 1112 */
1113 1113 ASSERT(tcp->tcp_eager_next_q == NULL);
1114 1114 if (listener->tcp_eager_last_q ==
1115 1115 listener->tcp_eager_next_q) {
1116 1116 listener->tcp_eager_last_q =
1117 1117 NULL;
1118 1118 } else {
1119 1119 /*
1120 1120 * We won't get here if there
1121 1121 * is only one eager in the
1122 1122 * list.
1123 1123 */
1124 1124 ASSERT(prev != NULL);
1125 1125 listener->tcp_eager_last_q =
1126 1126 prev;
1127 1127 }
1128 1128 }
1129 1129 tcpp[0] = tcp->tcp_eager_next_q;
1130 1130 tcp->tcp_eager_next_q = NULL;
1131 1131 tcp->tcp_eager_last_q = NULL;
1132 1132 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1133 1133 listener->tcp_conn_req_cnt_q--;
1134 1134 break;
1135 1135 }
1136 1136 prev = tcpp[0];
1137 1137 }
1138 1138 }
1139 1139 tcp->tcp_listener = NULL;
1140 1140 }
1141 1141
1142 1142 /* BEGIN CSTYLED */
1143 1143 /*
1144 1144 *
1145 1145 * The sockfs ACCEPT path:
1146 1146 * =======================
1147 1147 *
1148 1148 * The eager is now established in its own perimeter as soon as SYN is
1149 1149 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1150 1150 * completes the accept processing on the acceptor STREAM. The sending
1151 1151 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1152 1152 * listener but a TLI/XTI listener completes the accept processing
1153 1153 * on the listener perimeter.
1154 1154 *
1155 1155 * Common control flow for 3 way handshake:
1156 1156 * ----------------------------------------
1157 1157 *
1158 1158 * incoming SYN (listener perimeter) -> tcp_input_listener()
1159 1159 *
1160 1160 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1161 1161 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1162 1162 *
1163 1163 * Sockfs ACCEPT Path:
1164 1164 * -------------------
1165 1165 *
1166 1166 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1167 1167 * as STREAM entry point)
1168 1168 *
1169 1169 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1170 1170 *
1171 1171 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1172 1172 * association (we are not behind eager's squeue but sockfs is protecting us
1173 1173 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1174 1174 * is changed to point at tcp_wput().
1175 1175 *
1176 1176 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1177 1177 * listener (done on listener's perimeter).
1178 1178 *
1179 1179 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1180 1180 * accept.
1181 1181 *
1182 1182 * TLI/XTI client ACCEPT path:
1183 1183 * ---------------------------
1184 1184 *
1185 1185 * soaccept() sends T_CONN_RES on the listener STREAM.
1186 1186 *
1187 1187 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1188 1188 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1189 1189 *
1190 1190 * Locks:
1191 1191 * ======
1192 1192 *
1193 1193 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1194 1194 * and listeners->tcp_eager_next_q.
1195 1195 *
1196 1196 * Referencing:
1197 1197 * ============
1198 1198 *
1199 1199 * 1) We start out in tcp_input_listener by eager placing a ref on
1200 1200 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1201 1201 *
1202 1202 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1203 1203 * doing so we place a ref on the eager. This ref is finally dropped at the
1204 1204 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1205 1205 * reference is dropped by the squeue framework.
1206 1206 *
1207 1207 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1208 1208 *
1209 1209 * The reference must be released by the same entity that added the reference
1210 1210 * In the above scheme, the eager is the entity that adds and releases the
1211 1211 * references. Note that tcp_accept_finish executes in the squeue of the eager
1212 1212 * (albeit after it is attached to the acceptor stream). Though 1. executes
1213 1213 * in the listener's squeue, the eager is nascent at this point and the
1214 1214 * reference can be considered to have been added on behalf of the eager.
1215 1215 *
1216 1216 * Eager getting a Reset or listener closing:
1217 1217 * ==========================================
1218 1218 *
1219 1219 * Once the listener and eager are linked, the listener never does the unlink.
1220 1220 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1221 1221 * a message on all eager perimeter. The eager then does the unlink, clears
1222 1222 * any pointers to the listener's queue and drops the reference to the
1223 1223 * listener. The listener waits in tcp_close outside the squeue until its
1224 1224 * refcount has dropped to 1. This ensures that the listener has waited for
1225 1225 * all eagers to clear their association with the listener.
1226 1226 *
1227 1227 * Similarly, if eager decides to go away, it can unlink itself and close.
1228 1228 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1229 1229 * the reference to eager is still valid because of the extra ref we put
1230 1230 * in tcp_send_conn_ind.
1231 1231 *
1232 1232 * Listener can always locate the eager under the protection
1233 1233 * of the listener->tcp_eager_lock, and then do a refhold
1234 1234 * on the eager during the accept processing.
1235 1235 *
1236 1236 * The acceptor stream accesses the eager in the accept processing
1237 1237 * based on the ref placed on eager before sending T_conn_ind.
1238 1238 * The only entity that can negate this refhold is a listener close
1239 1239 * which is mutually exclusive with an active acceptor stream.
1240 1240 *
1241 1241 * Eager's reference on the listener
1242 1242 * ===================================
1243 1243 *
1244 1244 * If the accept happens (even on a closed eager) the eager drops its
1245 1245 * reference on the listener at the start of tcp_accept_finish. If the
1246 1246 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1247 1247 * the reference is dropped in tcp_closei_local. If the listener closes,
1248 1248 * the reference is dropped in tcp_eager_kill. In all cases the reference
1249 1249 * is dropped while executing in the eager's context (squeue).
1250 1250 */
1251 1251 /* END CSTYLED */
1252 1252
1253 1253 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1254 1254
1255 1255 /*
1256 1256 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1257 1257 * tcp_input_data will not see any packets for listeners since the listener
1258 1258 * has conn_recv set to tcp_input_listener.
1259 1259 */
1260 1260 /* ARGSUSED */
1261 1261 static void
1262 1262 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1263 1263 {
1264 1264 tcpha_t *tcpha;
1265 1265 uint32_t seg_seq;
1266 1266 tcp_t *eager;
1267 1267 int err;
1268 1268 conn_t *econnp = NULL;
1269 1269 squeue_t *new_sqp;
1270 1270 mblk_t *mp1;
1271 1271 uint_t ip_hdr_len;
1272 1272 conn_t *lconnp = (conn_t *)arg;
1273 1273 tcp_t *listener = lconnp->conn_tcp;
1274 1274 tcp_stack_t *tcps = listener->tcp_tcps;
1275 1275 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
1276 1276 uint_t flags;
1277 1277 mblk_t *tpi_mp;
1278 1278 uint_t ifindex = ira->ira_ruifindex;
1279 1279 boolean_t tlc_set = B_FALSE;
1280 1280
1281 1281 ip_hdr_len = ira->ira_ip_hdr_length;
1282 1282 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1283 1283 flags = (unsigned int)tcpha->tha_flags & 0xFF;
1284 1284
1285 1285 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1286 1286 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1287 1287 __dtrace_tcp_tcph_t *, tcpha);
1288 1288
1289 1289 if (!(flags & TH_SYN)) {
1290 1290 if ((flags & TH_RST) || (flags & TH_URG)) {
1291 1291 freemsg(mp);
1292 1292 return;
1293 1293 }
1294 1294 if (flags & TH_ACK) {
1295 1295 /* Note this executes in listener's squeue */
1296 1296 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1297 1297 return;
1298 1298 }
1299 1299
1300 1300 freemsg(mp);
1301 1301 return;
1302 1302 }
1303 1303
1304 1304 if (listener->tcp_state != TCPS_LISTEN)
1305 1305 goto error2;
1306 1306
1307 1307 ASSERT(IPCL_IS_BOUND(lconnp));
1308 1308
1309 1309 mutex_enter(&listener->tcp_eager_lock);
1310 1310
1311 1311 /*
1312 1312 * The system is under memory pressure, so we need to do our part
1313 1313 * to relieve the pressure. So we only accept new request if there
1314 1314 * is nothing waiting to be accepted or waiting to complete the 3-way
1315 1315 * handshake. This means that busy listener will not get too many
1316 1316 * new requests which they cannot handle in time while non-busy
1317 1317 * listener is still functioning properly.
1318 1318 */
1319 1319 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1320 1320 listener->tcp_conn_req_cnt_q0 > 0)) {
1321 1321 mutex_exit(&listener->tcp_eager_lock);
1322 1322 TCP_STAT(tcps, tcp_listen_mem_drop);
1323 1323 goto error2;
1324 1324 }
1325 1325
1326 1326 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1327 1327 mutex_exit(&listener->tcp_eager_lock);
1328 1328 TCP_STAT(tcps, tcp_listendrop);
1329 1329 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1330 1330 if (lconnp->conn_debug) {
1331 1331 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1332 1332 "tcp_input_listener: listen backlog (max=%d) "
1333 1333 "overflow (%d pending) on %s",
1334 1334 listener->tcp_conn_req_max,
1335 1335 listener->tcp_conn_req_cnt_q,
1336 1336 tcp_display(listener, NULL, DISP_PORT_ONLY));
1337 1337 }
1338 1338 goto error2;
1339 1339 }
1340 1340
1341 1341 if (listener->tcp_conn_req_cnt_q0 >=
1342 1342 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1343 1343 /*
1344 1344 * Q0 is full. Drop a pending half-open req from the queue
1345 1345 * to make room for the new SYN req. Also mark the time we
1346 1346 * drop a SYN.
1347 1347 *
1348 1348 * A more aggressive defense against SYN attack will
1349 1349 * be to set the "tcp_syn_defense" flag now.
1350 1350 */
1351 1351 TCP_STAT(tcps, tcp_listendropq0);
1352 1352 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1353 1353 if (!tcp_drop_q0(listener)) {
1354 1354 mutex_exit(&listener->tcp_eager_lock);
1355 1355 TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1356 1356 if (lconnp->conn_debug) {
1357 1357 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1358 1358 "tcp_input_listener: listen half-open "
1359 1359 "queue (max=%d) full (%d pending) on %s",
1360 1360 tcps->tcps_conn_req_max_q0,
1361 1361 listener->tcp_conn_req_cnt_q0,
1362 1362 tcp_display(listener, NULL,
1363 1363 DISP_PORT_ONLY));
1364 1364 }
1365 1365 goto error2;
1366 1366 }
1367 1367 }
1368 1368
1369 1369 /*
1370 1370 * Enforce the limit set on the number of connections per listener.
1371 1371 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1372 1372 * for comparison.
1373 1373 */
1374 1374 if (listener->tcp_listen_cnt != NULL) {
1375 1375 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1376 1376 int64_t now;
1377 1377
1378 1378 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) {
1379 1379 mutex_exit(&listener->tcp_eager_lock);
1380 1380 now = ddi_get_lbolt64();
1381 1381 atomic_dec_32(&tlc->tlc_cnt);
1382 1382 TCP_STAT(tcps, tcp_listen_cnt_drop);
1383 1383 tlc->tlc_drop++;
1384 1384 if (now - tlc->tlc_report_time >
1385 1385 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1386 1386 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1387 1387 "Listener (port %d) connection max (%u) "
1388 1388 "reached: %u attempts dropped total\n",
1389 1389 ntohs(listener->tcp_connp->conn_lport),
1390 1390 tlc->tlc_max, tlc->tlc_drop);
1391 1391 tlc->tlc_report_time = now;
1392 1392 }
1393 1393 goto error2;
1394 1394 }
1395 1395 tlc_set = B_TRUE;
1396 1396 }
1397 1397
1398 1398 mutex_exit(&listener->tcp_eager_lock);
1399 1399
1400 1400 /*
1401 1401 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1402 1402 * or based on the ring (for packets from GLD). Otherwise it is
1403 1403 * set based on lbolt i.e., a somewhat random number.
1404 1404 */
1405 1405 ASSERT(ira->ira_sqp != NULL);
1406 1406 new_sqp = ira->ira_sqp;
1407 1407
1408 1408 econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1409 1409 if (econnp == NULL)
1410 1410 goto error2;
1411 1411
1412 1412 ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1413 1413 econnp->conn_sqp = new_sqp;
1414 1414 econnp->conn_initial_sqp = new_sqp;
1415 1415 econnp->conn_ixa->ixa_sqp = new_sqp;
1416 1416
1417 1417 econnp->conn_fport = tcpha->tha_lport;
1418 1418 econnp->conn_lport = tcpha->tha_fport;
1419 1419
1420 1420 err = conn_inherit_parent(lconnp, econnp);
1421 1421 if (err != 0)
1422 1422 goto error3;
1423 1423
1424 1424 /* We already know the laddr of the new connection is ours */
1425 1425 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1426 1426
1427 1427 ASSERT(OK_32PTR(mp->b_rptr));
1428 1428 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1429 1429 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1430 1430
1431 1431 if (lconnp->conn_family == AF_INET) {
1432 1432 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1433 1433 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1434 1434 } else {
1435 1435 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1436 1436 }
1437 1437
1438 1438 if (tpi_mp == NULL)
1439 1439 goto error3;
1440 1440
1441 1441 eager = econnp->conn_tcp;
1442 1442 eager->tcp_detached = B_TRUE;
1443 1443 SOCK_CONNID_INIT(eager->tcp_connid);
1444 1444
1445 1445 /*
1446 1446 * Initialize the eager's tcp_t and inherit some parameters from
1447 1447 * the listener.
1448 1448 */
1449 1449 tcp_init_values(eager, listener);
1450 1450
1451 1451 ASSERT((econnp->conn_ixa->ixa_flags &
1452 1452 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1453 1453 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1454 1454 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1455 1455 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1456 1456
1457 1457 if (!tcps->tcps_dev_flow_ctl)
1458 1458 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1459 1459
1460 1460 /* Prepare for diffing against previous packets */
1461 1461 eager->tcp_recvifindex = 0;
1462 1462 eager->tcp_recvhops = 0xffffffffU;
1463 1463
1464 1464 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1465 1465 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1466 1466 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1467 1467 econnp->conn_incoming_ifindex = ifindex;
1468 1468 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1469 1469 econnp->conn_ixa->ixa_scopeid = ifindex;
1470 1470 }
1471 1471 }
1472 1472
1473 1473 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1474 1474 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1475 1475 tcps->tcps_rev_src_routes) {
1476 1476 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1477 1477 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1478 1478
1479 1479 /* Source routing option copyover (reverse it) */
1480 1480 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1481 1481 if (err != 0) {
1482 1482 freemsg(tpi_mp);
1483 1483 goto error3;
1484 1484 }
1485 1485 ip_pkt_source_route_reverse_v4(ipp);
1486 1486 }
1487 1487
1488 1488 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1489 1489 ASSERT(!eager->tcp_tconnind_started);
1490 1490 /*
1491 1491 * If the SYN came with a credential, it's a loopback packet or a
1492 1492 * labeled packet; attach the credential to the TPI message.
1493 1493 */
1494 1494 if (ira->ira_cred != NULL)
1495 1495 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1496 1496
1497 1497 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1498 1498 ASSERT(eager->tcp_ordrel_mp == NULL);
1499 1499
1500 1500 /* Inherit the listener's non-STREAMS flag */
1501 1501 if (IPCL_IS_NONSTR(lconnp)) {
1502 1502 econnp->conn_flags |= IPCL_NONSTR;
1503 1503 /* All non-STREAMS tcp_ts are sockets */
1504 1504 eager->tcp_issocket = B_TRUE;
1505 1505 } else {
1506 1506 /*
1507 1507 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1508 1508 * at close time, we will always have that to send up.
1509 1509 * Otherwise, we need to do special handling in case the
1510 1510 * allocation fails at that time.
1511 1511 */
1512 1512 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1513 1513 goto error3;
1514 1514 }
1515 1515 /*
1516 1516 * Now that the IP addresses and ports are setup in econnp we
1517 1517 * can do the IPsec policy work.
1518 1518 */
1519 1519 if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1520 1520 if (lconnp->conn_policy != NULL) {
1521 1521 /*
1522 1522 * Inherit the policy from the listener; use
1523 1523 * actions from ira
1524 1524 */
1525 1525 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1526 1526 CONN_DEC_REF(econnp);
1527 1527 freemsg(mp);
1528 1528 goto error3;
1529 1529 }
1530 1530 }
1531 1531 }
1532 1532
1533 1533 /*
1534 1534 * tcp_set_destination() may set tcp_rwnd according to the route
1535 1535 * metrics. If it does not, the eager's receive window will be set
1536 1536 * to the listener's receive window later in this function.
1537 1537 */
1538 1538 eager->tcp_rwnd = 0;
1539 1539
1540 1540 if (is_system_labeled()) {
1541 1541 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1542 1542
1543 1543 ASSERT(ira->ira_tsl != NULL);
1544 1544 /* Discard any old label */
1545 1545 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1546 1546 ASSERT(ixa->ixa_tsl != NULL);
1547 1547 label_rele(ixa->ixa_tsl);
1548 1548 ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1549 1549 ixa->ixa_tsl = NULL;
1550 1550 }
1551 1551 if ((lconnp->conn_mlp_type != mlptSingle ||
1552 1552 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1553 1553 ira->ira_tsl != NULL) {
1554 1554 /*
1555 1555 * If this is an MLP connection or a MAC-Exempt
1556 1556 * connection with an unlabeled node, packets are to be
1557 1557 * exchanged using the security label of the received
1558 1558 * SYN packet instead of the server application's label.
1559 1559 * tsol_check_dest called from ip_set_destination
1560 1560 * might later update TSF_UNLABELED by replacing
1561 1561 * ixa_tsl with a new label.
1562 1562 */
1563 1563 label_hold(ira->ira_tsl);
1564 1564 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1565 1565 DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1566 1566 econnp, ts_label_t *, ixa->ixa_tsl)
1567 1567 } else {
1568 1568 ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1569 1569 DTRACE_PROBE2(syn_accept, conn_t *,
1570 1570 econnp, ts_label_t *, ixa->ixa_tsl)
1571 1571 }
1572 1572 /*
1573 1573 * conn_connect() called from tcp_set_destination will verify
1574 1574 * the destination is allowed to receive packets at the
1575 1575 * security label of the SYN-ACK we are generating. As part of
1576 1576 * that, tsol_check_dest() may create a new effective label for
1577 1577 * this connection.
1578 1578 * Finally conn_connect() will call conn_update_label.
1579 1579 * All that remains for TCP to do is to call
1580 1580 * conn_build_hdr_template which is done as part of
1581 1581 * tcp_set_destination.
1582 1582 */
1583 1583 }
1584 1584
1585 1585 /*
1586 1586 * Since we will clear tcp_listener before we clear tcp_detached
1587 1587 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1588 1588 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1589 1589 */
1590 1590 eager->tcp_hard_binding = B_TRUE;
1591 1591
1592 1592 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1593 1593 TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1594 1594
1595 1595 CL_INET_CONNECT(econnp, B_FALSE, err);
1596 1596 if (err != 0) {
1597 1597 tcp_bind_hash_remove(eager);
1598 1598 goto error3;
1599 1599 }
1600 1600
1601 1601 SOCK_CONNID_BUMP(eager->tcp_connid);
1602 1602
1603 1603 /*
1604 1604 * Adapt our mss, ttl, ... based on the remote address.
1605 1605 */
1606 1606
1607 1607 if (tcp_set_destination(eager) != 0) {
1608 1608 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1609 1609 /* Undo the bind_hash_insert */
1610 1610 tcp_bind_hash_remove(eager);
1611 1611 goto error3;
1612 1612 }
1613 1613
1614 1614 /* Process all TCP options. */
1615 1615 tcp_process_options(eager, tcpha);
1616 1616
1617 1617 /* Is the other end ECN capable? */
1618 1618 if (tcps->tcps_ecn_permitted >= 1 &&
1619 1619 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1620 1620 eager->tcp_ecn_ok = B_TRUE;
1621 1621 }
1622 1622
1623 1623 /*
1624 1624 * The listener's conn_rcvbuf should be the default window size or a
1625 1625 * window size changed via SO_RCVBUF option. First round up the
1626 1626 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1627 1627 * scale option value if needed. Call tcp_rwnd_set() to finish the
1628 1628 * setting.
1629 1629 *
1630 1630 * Note if there is a rpipe metric associated with the remote host,
1631 1631 * we should not inherit receive window size from listener.
1632 1632 */
1633 1633 eager->tcp_rwnd = MSS_ROUNDUP(
1634 1634 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1635 1635 eager->tcp_rwnd), eager->tcp_mss);
1636 1636 if (eager->tcp_snd_ws_ok)
1637 1637 tcp_set_ws_value(eager);
1638 1638 /*
1639 1639 * Note that this is the only place tcp_rwnd_set() is called for
1640 1640 * accepting a connection. We need to call it here instead of
1641 1641 * after the 3-way handshake because we need to tell the other
1642 1642 * side our rwnd in the SYN-ACK segment.
1643 1643 */
1644 1644 (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1645 1645
1646 1646 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1647 1647 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1648 1648
1649 1649 ASSERT(econnp->conn_rcvbuf != 0 &&
1650 1650 econnp->conn_rcvbuf == eager->tcp_rwnd);
1651 1651
1652 1652 /* Put a ref on the listener for the eager. */
1653 1653 CONN_INC_REF(lconnp);
1654 1654 mutex_enter(&listener->tcp_eager_lock);
1655 1655 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1656 1656 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1657 1657 listener->tcp_eager_next_q0 = eager;
1658 1658 eager->tcp_eager_prev_q0 = listener;
1659 1659
1660 1660 /* Set tcp_listener before adding it to tcp_conn_fanout */
1661 1661 eager->tcp_listener = listener;
1662 1662 eager->tcp_saved_listener = listener;
1663 1663
1664 1664 /*
1665 1665 * Set tcp_listen_cnt so that when the connection is done, the counter
1666 1666 * is decremented.
1667 1667 */
1668 1668 eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1669 1669
1670 1670 /*
1671 1671 * Tag this detached tcp vector for later retrieval
1672 1672 * by our listener client in tcp_accept().
1673 1673 */
1674 1674 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1675 1675 listener->tcp_conn_req_cnt_q0++;
1676 1676 if (++listener->tcp_conn_req_seqnum == -1) {
1677 1677 /*
1678 1678 * -1 is "special" and defined in TPI as something
1679 1679 * that should never be used in T_CONN_IND
1680 1680 */
1681 1681 ++listener->tcp_conn_req_seqnum;
1682 1682 }
1683 1683 mutex_exit(&listener->tcp_eager_lock);
1684 1684
1685 1685 if (listener->tcp_syn_defense) {
1686 1686 /* Don't drop the SYN that comes from a good IP source */
1687 1687 ipaddr_t *addr_cache;
1688 1688
1689 1689 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1690 1690 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1691 1691 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1692 1692 eager->tcp_dontdrop = B_TRUE;
1693 1693 }
1694 1694 }
1695 1695
1696 1696 /*
1697 1697 * We need to insert the eager in its own perimeter but as soon
1698 1698 * as we do that, we expose the eager to the classifier and
1699 1699 * should not touch any field outside the eager's perimeter.
1700 1700 * So do all the work necessary before inserting the eager
1701 1701 * in its own perimeter. Be optimistic that conn_connect()
1702 1702 * will succeed but undo everything if it fails.
1703 1703 */
1704 1704 seg_seq = ntohl(tcpha->tha_seq);
1705 1705 eager->tcp_irs = seg_seq;
1706 1706 eager->tcp_rack = seg_seq;
1707 1707 eager->tcp_rnxt = seg_seq + 1;
1708 1708 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1709 1709 TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1710 1710 eager->tcp_state = TCPS_SYN_RCVD;
1711 1711 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1712 1712 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1713 1713 int32_t, TCPS_LISTEN);
1714 1714
1715 1715 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1716 1716 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1717 1717 if (mp1 == NULL) {
1718 1718 /*
1719 1719 * Increment the ref count as we are going to
1720 1720 * enqueueing an mp in squeue
1721 1721 */
1722 1722 CONN_INC_REF(econnp);
1723 1723 goto error;
1724 1724 }
1725 1725
1726 1726 /*
1727 1727 * We need to start the rto timer. In normal case, we start
1728 1728 * the timer after sending the packet on the wire (or at
1729 1729 * least believing that packet was sent by waiting for
1730 1730 * conn_ip_output() to return). Since this is the first packet
1731 1731 * being sent on the wire for the eager, our initial tcp_rto
1732 1732 * is at least tcp_rexmit_interval_min which is a fairly
1733 1733 * large value to allow the algorithm to adjust slowly to large
1734 1734 * fluctuations of RTT during first few transmissions.
1735 1735 *
1736 1736 * Starting the timer first and then sending the packet in this
1737 1737 * case shouldn't make much difference since tcp_rexmit_interval_min
1738 1738 * is of the order of several 100ms and starting the timer
1739 1739 * first and then sending the packet will result in difference
1740 1740 * of few micro seconds.
1741 1741 *
1742 1742 * Without this optimization, we are forced to hold the fanout
1743 1743 * lock across the ipcl_bind_insert() and sending the packet
1744 1744 * so that we don't race against an incoming packet (maybe RST)
1745 1745 * for this eager.
1746 1746 *
1747 1747 * It is necessary to acquire an extra reference on the eager
1748 1748 * at this point and hold it until after tcp_send_data() to
1749 1749 * ensure against an eager close race.
1750 1750 */
1751 1751
1752 1752 CONN_INC_REF(econnp);
1753 1753
1754 1754 TCP_TIMER_RESTART(eager, eager->tcp_rto);
1755 1755
1756 1756 /*
1757 1757 * Insert the eager in its own perimeter now. We are ready to deal
1758 1758 * with any packets on eager.
1759 1759 */
1760 1760 if (ipcl_conn_insert(econnp) != 0)
1761 1761 goto error;
1762 1762
1763 1763 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1764 1764 freemsg(mp);
1765 1765 /*
1766 1766 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1767 1767 * only used by one thread at a time.
1768 1768 */
1769 1769 if (econnp->conn_sqp == lconnp->conn_sqp) {
1770 1770 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1771 1771 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1772 1772 tcp_t *, eager, __dtrace_tcp_tcph_t *,
1773 1773 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1774 1774 (void) conn_ip_output(mp1, econnp->conn_ixa);
1775 1775 CONN_DEC_REF(econnp);
1776 1776 } else {
1777 1777 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1778 1778 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1779 1779 }
1780 1780 return;
1781 1781 error:
1782 1782 freemsg(mp1);
1783 1783 eager->tcp_closemp_used = B_TRUE;
1784 1784 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1785 1785 mp1 = &eager->tcp_closemp;
1786 1786 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1787 1787 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1788 1788
1789 1789 /*
1790 1790 * If a connection already exists, send the mp to that connections so
1791 1791 * that it can be appropriately dealt with.
1792 1792 */
1793 1793 ipst = tcps->tcps_netstack->netstack_ip;
1794 1794
1795 1795 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1796 1796 if (!IPCL_IS_CONNECTED(econnp)) {
1797 1797 /*
1798 1798 * Something bad happened. ipcl_conn_insert()
1799 1799 * failed because a connection already existed
1800 1800 * in connected hash but we can't find it
1801 1801 * anymore (someone blew it away). Just
1802 1802 * free this message and hopefully remote
1803 1803 * will retransmit at which time the SYN can be
1804 1804 * treated as a new connection or dealth with
1805 1805 * a TH_RST if a connection already exists.
1806 1806 */
1807 1807 CONN_DEC_REF(econnp);
1808 1808 freemsg(mp);
1809 1809 } else {
1810 1810 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1811 1811 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1812 1812 }
1813 1813 } else {
1814 1814 /* Nobody wants this packet */
1815 1815 freemsg(mp);
1816 1816 }
1817 1817 return;
1818 1818 error3:
1819 1819 CONN_DEC_REF(econnp);
1820 1820 error2:
1821 1821 freemsg(mp);
1822 1822 if (tlc_set)
1823 1823 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt);
1824 1824 }
1825 1825
1826 1826 /*
1827 1827 * In an ideal case of vertical partition in NUMA architecture, its
1828 1828 * beneficial to have the listener and all the incoming connections
1829 1829 * tied to the same squeue. The other constraint is that incoming
1830 1830 * connections should be tied to the squeue attached to interrupted
1831 1831 * CPU for obvious locality reason so this leaves the listener to
1832 1832 * be tied to the same squeue. Our only problem is that when listener
1833 1833 * is binding, the CPU that will get interrupted by the NIC whose
1834 1834 * IP address the listener is binding to is not even known. So
1835 1835 * the code below allows us to change that binding at the time the
1836 1836 * CPU is interrupted by virtue of incoming connection's squeue.
1837 1837 *
1838 1838 * This is usefull only in case of a listener bound to a specific IP
1839 1839 * address. For other kind of listeners, they get bound the
1840 1840 * very first time and there is no attempt to rebind them.
1841 1841 */
1842 1842 void
1843 1843 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1844 1844 ip_recv_attr_t *ira)
1845 1845 {
1846 1846 conn_t *connp = (conn_t *)arg;
1847 1847 squeue_t *sqp = (squeue_t *)arg2;
1848 1848 squeue_t *new_sqp;
1849 1849 uint32_t conn_flags;
1850 1850
1851 1851 /*
1852 1852 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1853 1853 * or based on the ring (for packets from GLD). Otherwise it is
1854 1854 * set based on lbolt i.e., a somewhat random number.
1855 1855 */
1856 1856 ASSERT(ira->ira_sqp != NULL);
1857 1857 new_sqp = ira->ira_sqp;
1858 1858
1859 1859 if (connp->conn_fanout == NULL)
1860 1860 goto done;
1861 1861
1862 1862 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1863 1863 mutex_enter(&connp->conn_fanout->connf_lock);
1864 1864 mutex_enter(&connp->conn_lock);
1865 1865 /*
1866 1866 * No one from read or write side can access us now
1867 1867 * except for already queued packets on this squeue.
1868 1868 * But since we haven't changed the squeue yet, they
1869 1869 * can't execute. If they are processed after we have
1870 1870 * changed the squeue, they are sent back to the
1871 1871 * correct squeue down below.
1872 1872 * But a listner close can race with processing of
1873 1873 * incoming SYN. If incoming SYN processing changes
1874 1874 * the squeue then the listener close which is waiting
1875 1875 * to enter the squeue would operate on the wrong
1876 1876 * squeue. Hence we don't change the squeue here unless
1877 1877 * the refcount is exactly the minimum refcount. The
1878 1878 * minimum refcount of 4 is counted as - 1 each for
1879 1879 * TCP and IP, 1 for being in the classifier hash, and
1880 1880 * 1 for the mblk being processed.
1881 1881 */
1882 1882
1883 1883 if (connp->conn_ref != 4 ||
1884 1884 connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1885 1885 mutex_exit(&connp->conn_lock);
1886 1886 mutex_exit(&connp->conn_fanout->connf_lock);
1887 1887 goto done;
1888 1888 }
1889 1889 if (connp->conn_sqp != new_sqp) {
1890 1890 while (connp->conn_sqp != new_sqp)
1891 1891 (void) atomic_cas_ptr(&connp->conn_sqp, sqp,
1892 1892 new_sqp);
1893 1893 /* No special MT issues for outbound ixa_sqp hint */
1894 1894 connp->conn_ixa->ixa_sqp = new_sqp;
1895 1895 }
1896 1896
1897 1897 do {
1898 1898 conn_flags = connp->conn_flags;
1899 1899 conn_flags |= IPCL_FULLY_BOUND;
1900 1900 (void) atomic_cas_32(&connp->conn_flags,
1901 1901 connp->conn_flags, conn_flags);
1902 1902 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1903 1903
1904 1904 mutex_exit(&connp->conn_fanout->connf_lock);
1905 1905 mutex_exit(&connp->conn_lock);
1906 1906
1907 1907 /*
1908 1908 * Assume we have picked a good squeue for the listener. Make
1909 1909 * subsequent SYNs not try to change the squeue.
1910 1910 */
1911 1911 connp->conn_recv = tcp_input_listener;
1912 1912 }
1913 1913
1914 1914 done:
1915 1915 if (connp->conn_sqp != sqp) {
1916 1916 CONN_INC_REF(connp);
1917 1917 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1918 1918 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1919 1919 } else {
1920 1920 tcp_input_listener(connp, mp, sqp, ira);
1921 1921 }
1922 1922 }
1923 1923
1924 1924 /*
1925 1925 * Send up all messages queued on tcp_rcv_list.
1926 1926 */
1927 1927 uint_t
1928 1928 tcp_rcv_drain(tcp_t *tcp)
1929 1929 {
1930 1930 mblk_t *mp;
1931 1931 uint_t ret = 0;
1932 1932 #ifdef DEBUG
1933 1933 uint_t cnt = 0;
1934 1934 #endif
1935 1935 queue_t *q = tcp->tcp_connp->conn_rq;
1936 1936
1937 1937 /* Can't drain on an eager connection */
1938 1938 if (tcp->tcp_listener != NULL)
1939 1939 return (ret);
1940 1940
1941 1941 /* Can't be a non-STREAMS connection */
1942 1942 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1943 1943
1944 1944 /* No need for the push timer now. */
1945 1945 if (tcp->tcp_push_tid != 0) {
1946 1946 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1947 1947 tcp->tcp_push_tid = 0;
1948 1948 }
1949 1949
1950 1950 /*
1951 1951 * Handle two cases here: we are currently fused or we were
1952 1952 * previously fused and have some urgent data to be delivered
1953 1953 * upstream. The latter happens because we either ran out of
1954 1954 * memory or were detached and therefore sending the SIGURG was
1955 1955 * deferred until this point. In either case we pass control
1956 1956 * over to tcp_fuse_rcv_drain() since it may need to complete
1957 1957 * some work.
1958 1958 */
1959 1959 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
1960 1960 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
1961 1961 &tcp->tcp_fused_sigurg_mp))
1962 1962 return (ret);
1963 1963 }
1964 1964
1965 1965 while ((mp = tcp->tcp_rcv_list) != NULL) {
1966 1966 tcp->tcp_rcv_list = mp->b_next;
1967 1967 mp->b_next = NULL;
1968 1968 #ifdef DEBUG
1969 1969 cnt += msgdsize(mp);
1970 1970 #endif
1971 1971 putnext(q, mp);
1972 1972 }
1973 1973 #ifdef DEBUG
1974 1974 ASSERT(cnt == tcp->tcp_rcv_cnt);
1975 1975 #endif
1976 1976 tcp->tcp_rcv_last_head = NULL;
1977 1977 tcp->tcp_rcv_last_tail = NULL;
1978 1978 tcp->tcp_rcv_cnt = 0;
1979 1979
1980 1980 if (canputnext(q))
1981 1981 return (tcp_rwnd_reopen(tcp));
1982 1982
1983 1983 return (ret);
1984 1984 }
1985 1985
1986 1986 /*
1987 1987 * Queue data on tcp_rcv_list which is a b_next chain.
1988 1988 * tcp_rcv_last_head/tail is the last element of this chain.
1989 1989 * Each element of the chain is a b_cont chain.
1990 1990 *
1991 1991 * M_DATA messages are added to the current element.
1992 1992 * Other messages are added as new (b_next) elements.
1993 1993 */
1994 1994 void
1995 1995 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
1996 1996 {
1997 1997 ASSERT(seg_len == msgdsize(mp));
1998 1998 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
1999 1999
2000 2000 if (is_system_labeled()) {
2001 2001 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2002 2002 /*
2003 2003 * Provide for protocols above TCP such as RPC. NOPID leaves
2004 2004 * db_cpid unchanged.
2005 2005 * The cred could have already been set.
2006 2006 */
2007 2007 if (cr != NULL)
2008 2008 mblk_setcred(mp, cr, NOPID);
2009 2009 }
2010 2010
2011 2011 if (tcp->tcp_rcv_list == NULL) {
2012 2012 ASSERT(tcp->tcp_rcv_last_head == NULL);
2013 2013 tcp->tcp_rcv_list = mp;
2014 2014 tcp->tcp_rcv_last_head = mp;
2015 2015 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2016 2016 tcp->tcp_rcv_last_tail->b_cont = mp;
2017 2017 } else {
2018 2018 tcp->tcp_rcv_last_head->b_next = mp;
2019 2019 tcp->tcp_rcv_last_head = mp;
2020 2020 }
2021 2021
2022 2022 while (mp->b_cont)
2023 2023 mp = mp->b_cont;
2024 2024
2025 2025 tcp->tcp_rcv_last_tail = mp;
2026 2026 tcp->tcp_rcv_cnt += seg_len;
2027 2027 tcp->tcp_rwnd -= seg_len;
2028 2028 }
2029 2029
2030 2030 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2031 2031 mblk_t *
2032 2032 tcp_ack_mp(tcp_t *tcp)
2033 2033 {
2034 2034 uint32_t seq_no;
2035 2035 tcp_stack_t *tcps = tcp->tcp_tcps;
2036 2036 conn_t *connp = tcp->tcp_connp;
2037 2037
2038 2038 /*
2039 2039 * There are a few cases to be considered while setting the sequence no.
2040 2040 * Essentially, we can come here while processing an unacceptable pkt
2041 2041 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2042 2042 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2043 2043 * If we are here for a zero window probe, stick with suna. In all
2044 2044 * other cases, we check if suna + swnd encompasses snxt and set
2045 2045 * the sequence number to snxt, if so. If snxt falls outside the
2046 2046 * window (the receiver probably shrunk its window), we will go with
2047 2047 * suna + swnd, otherwise the sequence no will be unacceptable to the
2048 2048 * receiver.
2049 2049 */
2050 2050 if (tcp->tcp_zero_win_probe) {
2051 2051 seq_no = tcp->tcp_suna;
2052 2052 } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2053 2053 ASSERT(tcp->tcp_swnd == 0);
2054 2054 seq_no = tcp->tcp_snxt;
2055 2055 } else {
2056 2056 seq_no = SEQ_GT(tcp->tcp_snxt,
2057 2057 (tcp->tcp_suna + tcp->tcp_swnd)) ?
2058 2058 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2059 2059 }
2060 2060
2061 2061 if (tcp->tcp_valid_bits) {
2062 2062 /*
2063 2063 * For the complex case where we have to send some
2064 2064 * controls (FIN or SYN), let tcp_xmit_mp do it.
2065 2065 */
2066 2066 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2067 2067 NULL, B_FALSE));
2068 2068 } else {
2069 2069 /* Generate a simple ACK */
2070 2070 int data_length;
2071 2071 uchar_t *rptr;
2072 2072 tcpha_t *tcpha;
2073 2073 mblk_t *mp1;
2074 2074 int32_t total_hdr_len;
2075 2075 int32_t tcp_hdr_len;
2076 2076 int32_t num_sack_blk = 0;
2077 2077 int32_t sack_opt_len;
2078 2078 ip_xmit_attr_t *ixa = connp->conn_ixa;
2079 2079
2080 2080 /*
2081 2081 * Allocate space for TCP + IP headers
2082 2082 * and link-level header
2083 2083 */
2084 2084 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2085 2085 num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2086 2086 tcp->tcp_num_sack_blk);
2087 2087 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2088 2088 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2089 2089 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2090 2090 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2091 2091 } else {
2092 2092 total_hdr_len = connp->conn_ht_iphc_len;
2093 2093 tcp_hdr_len = connp->conn_ht_ulp_len;
2094 2094 }
2095 2095 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2096 2096 if (!mp1)
2097 2097 return (NULL);
2098 2098
2099 2099 /* Update the latest receive window size in TCP header. */
2100 2100 tcp->tcp_tcpha->tha_win =
2101 2101 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2102 2102 /* copy in prototype TCP + IP header */
2103 2103 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2104 2104 mp1->b_rptr = rptr;
2105 2105 mp1->b_wptr = rptr + total_hdr_len;
2106 2106 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2107 2107
2108 2108 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2109 2109
2110 2110 /* Set the TCP sequence number. */
2111 2111 tcpha->tha_seq = htonl(seq_no);
2112 2112
2113 2113 /* Set up the TCP flag field. */
2114 2114 tcpha->tha_flags = (uchar_t)TH_ACK;
2115 2115 if (tcp->tcp_ecn_echo_on)
2116 2116 tcpha->tha_flags |= TH_ECE;
2117 2117
2118 2118 tcp->tcp_rack = tcp->tcp_rnxt;
2119 2119 tcp->tcp_rack_cnt = 0;
2120 2120
2121 2121 /* fill in timestamp option if in use */
2122 2122 if (tcp->tcp_snd_ts_ok) {
2123 2123 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2124 2124
2125 2125 U32_TO_BE32(llbolt,
2126 2126 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2127 2127 U32_TO_BE32(tcp->tcp_ts_recent,
2128 2128 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2129 2129 }
2130 2130
2131 2131 /* Fill in SACK options */
2132 2132 if (num_sack_blk > 0) {
2133 2133 uchar_t *wptr = (uchar_t *)tcpha +
2134 2134 connp->conn_ht_ulp_len;
2135 2135 sack_blk_t *tmp;
2136 2136 int32_t i;
2137 2137
2138 2138 wptr[0] = TCPOPT_NOP;
2139 2139 wptr[1] = TCPOPT_NOP;
2140 2140 wptr[2] = TCPOPT_SACK;
2141 2141 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2142 2142 sizeof (sack_blk_t);
2143 2143 wptr += TCPOPT_REAL_SACK_LEN;
2144 2144
2145 2145 tmp = tcp->tcp_sack_list;
2146 2146 for (i = 0; i < num_sack_blk; i++) {
2147 2147 U32_TO_BE32(tmp[i].begin, wptr);
2148 2148 wptr += sizeof (tcp_seq);
2149 2149 U32_TO_BE32(tmp[i].end, wptr);
2150 2150 wptr += sizeof (tcp_seq);
2151 2151 }
2152 2152 tcpha->tha_offset_and_reserved +=
2153 2153 ((num_sack_blk * 2 + 1) << 4);
2154 2154 }
2155 2155
2156 2156 ixa->ixa_pktlen = total_hdr_len;
2157 2157
2158 2158 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2159 2159 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2160 2160 } else {
2161 2161 ip6_t *ip6 = (ip6_t *)rptr;
2162 2162
2163 2163 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2164 2164 }
2165 2165
2166 2166 /*
2167 2167 * Prime pump for checksum calculation in IP. Include the
2168 2168 * adjustment for a source route if any.
2169 2169 */
2170 2170 data_length = tcp_hdr_len + connp->conn_sum;
2171 2171 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2172 2172 tcpha->tha_sum = htons(data_length);
2173 2173
2174 2174 if (tcp->tcp_ip_forward_progress) {
2175 2175 tcp->tcp_ip_forward_progress = B_FALSE;
2176 2176 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2177 2177 } else {
2178 2178 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2179 2179 }
2180 2180 return (mp1);
2181 2181 }
2182 2182 }
2183 2183
2184 2184 /*
2185 2185 * Dummy socket upcalls for if/when the conn_t gets detached from a
2186 2186 * direct-callback sonode via a user-driven close(). Easy to catch with
2187 2187 * DTrace FBT, and should be mostly harmless.
2188 2188 */
2189 2189
2190 2190 /* ARGSUSED */
2191 2191 static sock_upper_handle_t
2192 2192 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2193 2193 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2194 2194 {
2195 2195 ASSERT(0); /* Panic in debug, otherwise ignore. */
2196 2196 return (NULL);
2197 2197 }
2198 2198
2199 2199 /* ARGSUSED */
2200 2200 static void
2201 2201 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2202 2202 pid_t pid)
2203 2203 {
2204 2204 ASSERT(x == NULL);
2205 2205 /* Normally we'd crhold(cr) and attach it to socket state. */
2206 2206 /* LINTED */
2207 2207 }
2208 2208
2209 2209 /* ARGSUSED */
2210 2210 static int
2211 2211 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2212 2212 {
2213 2213 ASSERT(0); /* Panic in debug, otherwise ignore. */
2214 2214 return (-1);
2215 2215 }
2216 2216
2217 2217 /* ARGSUSED */
2218 2218 static void
2219 2219 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2220 2220 {
2221 2221 ASSERT(x == NULL);
2222 2222 /* We really want this one to be a harmless NOP for now. */
2223 2223 /* LINTED */
2224 2224 }
2225 2225
2226 2226 /* ARGSUSED */
2227 2227 static ssize_t
2228 2228 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2229 2229 int *error, boolean_t *push)
2230 2230 {
2231 2231 ASSERT(x == NULL);
2232 2232
2233 2233 /*
2234 2234 * Consume the message, set ESHUTDOWN, and return an error.
2235 2235 * Nobody's home!
2236 2236 */
2237 2237 freemsg(mp);
2238 2238 *error = ESHUTDOWN;
2239 2239 return (-1);
2240 2240 }
2241 2241
2242 2242 /* ARGSUSED */
2243 2243 static void
2244 2244 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2245 2245 {
2246 2246 ASSERT(0); /* Panic in debug, otherwise ignore. */
2247 2247 }
2248 2248
2249 2249 /* ARGSUSED */
2250 2250 static void
2251 2251 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2252 2252 {
2253 2253 ASSERT(0); /* Panic in debug, otherwise ignore. */
2254 2254 }
2255 2255
2256 2256 /* ARGSUSED */
2257 2257 static void
2258 2258 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2259 2259 {
2260 2260 ASSERT(x == NULL);
2261 2261 /* Otherwise, this would signal socket state about OOB data. */
2262 2262 }
2263 2263
2264 2264 /* ARGSUSED */
2265 2265 static void
2266 2266 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2267 2267 {
2268 2268 ASSERT(0); /* Panic in debug, otherwise ignore. */
2269 2269 }
2270 2270
2271 2271 /* ARGSUSED */
2272 2272 static void
2273 2273 tcp_dummy_onearg(sock_upper_handle_t x)
2274 2274 {
2275 2275 ASSERT(0); /* Panic in debug, otherwise ignore. */
2276 2276 }
2277 2277
2278 2278 static sock_upcalls_t tcp_dummy_upcalls = {
2279 2279 tcp_dummy_newconn,
2280 2280 tcp_dummy_connected,
2281 2281 tcp_dummy_disconnected,
2282 2282 tcp_dummy_opctl,
2283 2283 tcp_dummy_recv,
2284 2284 tcp_dummy_set_proto_props,
2285 2285 tcp_dummy_txq_full,
2286 2286 tcp_dummy_signal_oob,
2287 2287 tcp_dummy_onearg,
2288 2288 tcp_dummy_set_error,
2289 2289 tcp_dummy_onearg
2290 2290 };
2291 2291
2292 2292 /*
2293 2293 * Handle M_DATA messages from IP. Its called directly from IP via
2294 2294 * squeue for received IP packets.
2295 2295 *
2296 2296 * The first argument is always the connp/tcp to which the mp belongs.
2297 2297 * There are no exceptions to this rule. The caller has already put
2298 2298 * a reference on this connp/tcp and once tcp_input_data() returns,
2299 2299 * the squeue will do the refrele.
2300 2300 *
2301 2301 * The TH_SYN for the listener directly go to tcp_input_listener via
2302 2302 * squeue. ICMP errors go directly to tcp_icmp_input().
2303 2303 *
2304 2304 * sqp: NULL = recursive, sqp != NULL means called from squeue
2305 2305 */
2306 2306 void
2307 2307 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2308 2308 {
2309 2309 int32_t bytes_acked;
2310 2310 int32_t gap;
2311 2311 mblk_t *mp1;
2312 2312 uint_t flags;
2313 2313 uint32_t new_swnd = 0;
2314 2314 uchar_t *iphdr;
2315 2315 uchar_t *rptr;
2316 2316 int32_t rgap;
2317 2317 uint32_t seg_ack;
2318 2318 int seg_len;
2319 2319 uint_t ip_hdr_len;
2320 2320 uint32_t seg_seq;
2321 2321 tcpha_t *tcpha;
2322 2322 int urp;
2323 2323 tcp_opt_t tcpopt;
2324 2324 ip_pkt_t ipp;
2325 2325 boolean_t ofo_seg = B_FALSE; /* Out of order segment */
2326 2326 uint32_t cwnd;
2327 2327 uint32_t add;
2328 2328 int npkt;
2329 2329 int mss;
2330 2330 conn_t *connp = (conn_t *)arg;
2331 2331 squeue_t *sqp = (squeue_t *)arg2;
2332 2332 tcp_t *tcp = connp->conn_tcp;
2333 2333 tcp_stack_t *tcps = tcp->tcp_tcps;
2334 2334 sock_upcalls_t *sockupcalls;
2335 2335
2336 2336 /*
2337 2337 * RST from fused tcp loopback peer should trigger an unfuse.
2338 2338 */
2339 2339 if (tcp->tcp_fused) {
2340 2340 TCP_STAT(tcps, tcp_fusion_aborted);
2341 2341 tcp_unfuse(tcp);
2342 2342 }
2343 2343
2344 2344 iphdr = mp->b_rptr;
2345 2345 rptr = mp->b_rptr;
2346 2346 ASSERT(OK_32PTR(rptr));
2347 2347
2348 2348 ip_hdr_len = ira->ira_ip_hdr_length;
2349 2349 if (connp->conn_recv_ancillary.crb_all != 0) {
2350 2350 /*
2351 2351 * Record packet information in the ip_pkt_t
2352 2352 */
2353 2353 ipp.ipp_fields = 0;
2354 2354 if (ira->ira_flags & IRAF_IS_IPV4) {
2355 2355 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2356 2356 B_FALSE);
2357 2357 } else {
2358 2358 uint8_t nexthdrp;
2359 2359
2360 2360 /*
2361 2361 * IPv6 packets can only be received by applications
2362 2362 * that are prepared to receive IPv6 addresses.
2363 2363 * The IP fanout must ensure this.
2364 2364 */
2365 2365 ASSERT(connp->conn_family == AF_INET6);
2366 2366
2367 2367 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2368 2368 &nexthdrp);
2369 2369 ASSERT(nexthdrp == IPPROTO_TCP);
2370 2370
2371 2371 /* Could have caused a pullup? */
2372 2372 iphdr = mp->b_rptr;
2373 2373 rptr = mp->b_rptr;
2374 2374 }
2375 2375 }
2376 2376 ASSERT(DB_TYPE(mp) == M_DATA);
2377 2377 ASSERT(mp->b_next == NULL);
2378 2378
2379 2379 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2380 2380 seg_seq = ntohl(tcpha->tha_seq);
2381 2381 seg_ack = ntohl(tcpha->tha_ack);
2382 2382 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2383 2383 seg_len = (int)(mp->b_wptr - rptr) -
2384 2384 (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2385 2385 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2386 2386 do {
2387 2387 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2388 2388 (uintptr_t)INT_MAX);
2389 2389 seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2390 2390 } while ((mp1 = mp1->b_cont) != NULL &&
2391 2391 mp1->b_datap->db_type == M_DATA);
2392 2392 }
2393 2393
2394 2394 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2395 2395 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2396 2396 __dtrace_tcp_tcph_t *, tcpha);
2397 2397
2398 2398 if (tcp->tcp_state == TCPS_TIME_WAIT) {
2399 2399 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2400 2400 seg_len, tcpha, ira);
2401 2401 return;
2402 2402 }
2403 2403
2404 2404 if (sqp != NULL) {
2405 2405 /*
2406 2406 * This is the correct place to update tcp_last_recv_time. Note
|
↓ open down ↓ |
1794 lines elided |
↑ open up ↑ |
2407 2407 * that it is also updated for tcp structure that belongs to
2408 2408 * global and listener queues which do not really need updating.
2409 2409 * But that should not cause any harm. And it is updated for
2410 2410 * all kinds of incoming segments, not only for data segments.
2411 2411 */
2412 2412 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2413 2413 }
2414 2414
2415 2415 flags = (unsigned int)tcpha->tha_flags & 0xFF;
2416 2416
2417 - BUMP_LOCAL(tcp->tcp_ibsegs);
2417 + TCPS_BUMP_MIB(tcps, tcpHCInSegs);
2418 2418 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2419 2419
2420 2420 if ((flags & TH_URG) && sqp != NULL) {
2421 2421 /*
2422 2422 * TCP can't handle urgent pointers that arrive before
2423 2423 * the connection has been accept()ed since it can't
2424 2424 * buffer OOB data. Discard segment if this happens.
2425 2425 *
2426 2426 * We can't just rely on a non-null tcp_listener to indicate
2427 2427 * that the accept() has completed since unlinking of the
2428 2428 * eager and completion of the accept are not atomic.
2429 2429 * tcp_detached, when it is not set (B_FALSE) indicates
2430 2430 * that the accept() has completed.
2431 2431 *
2432 2432 * Nor can it reassemble urgent pointers, so discard
2433 2433 * if it's not the next segment expected.
2434 2434 *
2435 2435 * Otherwise, collapse chain into one mblk (discard if
2436 2436 * that fails). This makes sure the headers, retransmitted
2437 2437 * data, and new data all are in the same mblk.
2438 2438 */
2439 2439 ASSERT(mp != NULL);
2440 2440 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2441 2441 freemsg(mp);
2442 2442 return;
2443 2443 }
2444 2444 /* Update pointers into message */
2445 2445 iphdr = rptr = mp->b_rptr;
2446 2446 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2447 2447 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2448 2448 /*
2449 2449 * Since we can't handle any data with this urgent
2450 2450 * pointer that is out of sequence, we expunge
2451 2451 * the data. This allows us to still register
2452 2452 * the urgent mark and generate the M_PCSIG,
2453 2453 * which we can do.
2454 2454 */
2455 2455 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2456 2456 seg_len = 0;
2457 2457 }
2458 2458 }
2459 2459
2460 2460 sockupcalls = connp->conn_upcalls;
2461 2461 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2462 2462 if (sockupcalls == NULL)
2463 2463 sockupcalls = &tcp_dummy_upcalls;
2464 2464
2465 2465 switch (tcp->tcp_state) {
2466 2466 case TCPS_SYN_SENT:
2467 2467 if (connp->conn_final_sqp == NULL &&
2468 2468 tcp_outbound_squeue_switch && sqp != NULL) {
2469 2469 ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2470 2470 connp->conn_final_sqp = sqp;
2471 2471 if (connp->conn_final_sqp != connp->conn_sqp) {
2472 2472 DTRACE_PROBE1(conn__final__sqp__switch,
2473 2473 conn_t *, connp);
2474 2474 CONN_INC_REF(connp);
2475 2475 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2476 2476 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2477 2477 tcp_input_data, connp, ira, ip_squeue_flag,
2478 2478 SQTAG_CONNECT_FINISH);
2479 2479 return;
2480 2480 }
2481 2481 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2482 2482 }
2483 2483 if (flags & TH_ACK) {
2484 2484 /*
2485 2485 * Note that our stack cannot send data before a
2486 2486 * connection is established, therefore the
2487 2487 * following check is valid. Otherwise, it has
2488 2488 * to be changed.
2489 2489 */
2490 2490 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2491 2491 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2492 2492 freemsg(mp);
2493 2493 if (flags & TH_RST)
2494 2494 return;
2495 2495 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2496 2496 tcp, seg_ack, 0, TH_RST);
2497 2497 return;
2498 2498 }
2499 2499 ASSERT(tcp->tcp_suna + 1 == seg_ack);
2500 2500 }
2501 2501 if (flags & TH_RST) {
2502 2502 if (flags & TH_ACK) {
2503 2503 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2504 2504 ip_xmit_attr_t *, connp->conn_ixa,
2505 2505 void_ip_t *, iphdr, tcp_t *, tcp,
2506 2506 tcph_t *, tcpha);
2507 2507 (void) tcp_clean_death(tcp, ECONNREFUSED);
2508 2508 }
2509 2509 freemsg(mp);
2510 2510 return;
2511 2511 }
2512 2512 if (!(flags & TH_SYN)) {
2513 2513 freemsg(mp);
2514 2514 return;
2515 2515 }
2516 2516
2517 2517 /* Process all TCP options. */
2518 2518 tcp_process_options(tcp, tcpha);
2519 2519 /*
2520 2520 * The following changes our rwnd to be a multiple of the
2521 2521 * MIN(peer MSS, our MSS) for performance reason.
2522 2522 */
2523 2523 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2524 2524 tcp->tcp_mss));
2525 2525
2526 2526 /* Is the other end ECN capable? */
2527 2527 if (tcp->tcp_ecn_ok) {
2528 2528 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2529 2529 tcp->tcp_ecn_ok = B_FALSE;
2530 2530 }
2531 2531 }
2532 2532 /*
2533 2533 * Clear ECN flags because it may interfere with later
2534 2534 * processing.
2535 2535 */
2536 2536 flags &= ~(TH_ECE|TH_CWR);
2537 2537
2538 2538 tcp->tcp_irs = seg_seq;
2539 2539 tcp->tcp_rack = seg_seq;
2540 2540 tcp->tcp_rnxt = seg_seq + 1;
2541 2541 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2542 2542 if (!TCP_IS_DETACHED(tcp)) {
2543 2543 /* Allocate room for SACK options if needed. */
2544 2544 connp->conn_wroff = connp->conn_ht_iphc_len;
2545 2545 if (tcp->tcp_snd_sack_ok)
2546 2546 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2547 2547 if (!tcp->tcp_loopback)
2548 2548 connp->conn_wroff += tcps->tcps_wroff_xtra;
2549 2549
2550 2550 (void) proto_set_tx_wroff(connp->conn_rq, connp,
2551 2551 connp->conn_wroff);
2552 2552 }
2553 2553 if (flags & TH_ACK) {
2554 2554 /*
2555 2555 * If we can't get the confirmation upstream, pretend
2556 2556 * we didn't even see this one.
2557 2557 *
2558 2558 * XXX: how can we pretend we didn't see it if we
2559 2559 * have updated rnxt et. al.
2560 2560 *
2561 2561 * For loopback we defer sending up the T_CONN_CON
2562 2562 * until after some checks below.
2563 2563 */
2564 2564 mp1 = NULL;
2565 2565 /*
2566 2566 * tcp_sendmsg() checks tcp_state without entering
2567 2567 * the squeue so tcp_state should be updated before
2568 2568 * sending up connection confirmation. Probe the
2569 2569 * state change below when we are sure the connection
2570 2570 * confirmation has been sent.
2571 2571 */
2572 2572 tcp->tcp_state = TCPS_ESTABLISHED;
2573 2573 if (!tcp_conn_con(tcp, iphdr, mp,
2574 2574 tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2575 2575 tcp->tcp_state = TCPS_SYN_SENT;
2576 2576 freemsg(mp);
2577 2577 return;
2578 2578 }
2579 2579 TCPS_CONN_INC(tcps);
2580 2580 /* SYN was acked - making progress */
2581 2581 tcp->tcp_ip_forward_progress = B_TRUE;
2582 2582
2583 2583 /* One for the SYN */
2584 2584 tcp->tcp_suna = tcp->tcp_iss + 1;
2585 2585 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2586 2586
2587 2587 /*
2588 2588 * If SYN was retransmitted, need to reset all
2589 2589 * retransmission info. This is because this
2590 2590 * segment will be treated as a dup ACK.
2591 2591 */
2592 2592 if (tcp->tcp_rexmit) {
2593 2593 tcp->tcp_rexmit = B_FALSE;
2594 2594 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2595 2595 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2596 2596 tcp->tcp_ms_we_have_waited = 0;
2597 2597
2598 2598 /*
2599 2599 * Set tcp_cwnd back to 1 MSS, per
2600 2600 * recommendation from
2601 2601 * draft-floyd-incr-init-win-01.txt,
2602 2602 * Increasing TCP's Initial Window.
2603 2603 */
2604 2604 tcp->tcp_cwnd = tcp->tcp_mss;
2605 2605 }
2606 2606
2607 2607 tcp->tcp_swl1 = seg_seq;
2608 2608 tcp->tcp_swl2 = seg_ack;
2609 2609
2610 2610 new_swnd = ntohs(tcpha->tha_win);
2611 2611 tcp->tcp_swnd = new_swnd;
2612 2612 if (new_swnd > tcp->tcp_max_swnd)
2613 2613 tcp->tcp_max_swnd = new_swnd;
2614 2614
2615 2615 /*
2616 2616 * Always send the three-way handshake ack immediately
2617 2617 * in order to make the connection complete as soon as
2618 2618 * possible on the accepting host.
2619 2619 */
2620 2620 flags |= TH_ACK_NEEDED;
2621 2621
2622 2622 /*
2623 2623 * Trace connect-established here.
2624 2624 */
2625 2625 DTRACE_TCP5(connect__established, mblk_t *, NULL,
2626 2626 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2627 2627 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2628 2628
2629 2629 /* Trace change from SYN_SENT -> ESTABLISHED here */
2630 2630 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2631 2631 connp->conn_ixa, void, NULL, tcp_t *, tcp,
2632 2632 void, NULL, int32_t, TCPS_SYN_SENT);
2633 2633
2634 2634 /*
2635 2635 * Special case for loopback. At this point we have
2636 2636 * received SYN-ACK from the remote endpoint. In
2637 2637 * order to ensure that both endpoints reach the
2638 2638 * fused state prior to any data exchange, the final
2639 2639 * ACK needs to be sent before we indicate T_CONN_CON
2640 2640 * to the module upstream.
2641 2641 */
2642 2642 if (tcp->tcp_loopback) {
2643 2643 mblk_t *ack_mp;
2644 2644
2645 2645 ASSERT(!tcp->tcp_unfusable);
2646 2646 ASSERT(mp1 != NULL);
2647 2647 /*
2648 2648 * For loopback, we always get a pure SYN-ACK
2649 2649 * and only need to send back the final ACK
2650 2650 * with no data (this is because the other
2651 2651 * tcp is ours and we don't do T/TCP). This
|
↓ open down ↓ |
224 lines elided |
↑ open up ↑ |
2652 2652 * final ACK triggers the passive side to
2653 2653 * perform fusion in ESTABLISHED state.
2654 2654 */
2655 2655 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2656 2656 if (tcp->tcp_ack_tid != 0) {
2657 2657 (void) TCP_TIMER_CANCEL(tcp,
2658 2658 tcp->tcp_ack_tid);
2659 2659 tcp->tcp_ack_tid = 0;
2660 2660 }
2661 2661 tcp_send_data(tcp, ack_mp);
2662 - BUMP_LOCAL(tcp->tcp_obsegs);
2662 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
2663 2663 TCPS_BUMP_MIB(tcps, tcpOutAck);
2664 2664
2665 2665 if (!IPCL_IS_NONSTR(connp)) {
2666 2666 /* Send up T_CONN_CON */
2667 2667 if (ira->ira_cred != NULL) {
2668 2668 mblk_setcred(mp1,
2669 2669 ira->ira_cred,
2670 2670 ira->ira_cpid);
2671 2671 }
2672 2672 putnext(connp->conn_rq, mp1);
2673 2673 } else {
2674 2674 (*sockupcalls->su_connected)
2675 2675 (connp->conn_upper_handle,
2676 2676 tcp->tcp_connid,
2677 2677 ira->ira_cred,
2678 2678 ira->ira_cpid);
2679 2679 freemsg(mp1);
2680 2680 }
2681 2681
2682 2682 freemsg(mp);
2683 2683 return;
2684 2684 }
2685 2685 /*
2686 2686 * Forget fusion; we need to handle more
2687 2687 * complex cases below. Send the deferred
2688 2688 * T_CONN_CON message upstream and proceed
2689 2689 * as usual. Mark this tcp as not capable
2690 2690 * of fusion.
2691 2691 */
2692 2692 TCP_STAT(tcps, tcp_fusion_unfusable);
2693 2693 tcp->tcp_unfusable = B_TRUE;
2694 2694 if (!IPCL_IS_NONSTR(connp)) {
2695 2695 if (ira->ira_cred != NULL) {
2696 2696 mblk_setcred(mp1, ira->ira_cred,
2697 2697 ira->ira_cpid);
2698 2698 }
2699 2699 putnext(connp->conn_rq, mp1);
2700 2700 } else {
2701 2701 (*sockupcalls->su_connected)
2702 2702 (connp->conn_upper_handle,
2703 2703 tcp->tcp_connid, ira->ira_cred,
2704 2704 ira->ira_cpid);
2705 2705 freemsg(mp1);
2706 2706 }
2707 2707 }
2708 2708
2709 2709 /*
2710 2710 * Check to see if there is data to be sent. If
2711 2711 * yes, set the transmit flag. Then check to see
2712 2712 * if received data processing needs to be done.
2713 2713 * If not, go straight to xmit_check. This short
2714 2714 * cut is OK as we don't support T/TCP.
2715 2715 */
2716 2716 if (tcp->tcp_unsent)
2717 2717 flags |= TH_XMIT_NEEDED;
2718 2718
2719 2719 if (seg_len == 0 && !(flags & TH_URG)) {
2720 2720 freemsg(mp);
2721 2721 goto xmit_check;
2722 2722 }
2723 2723
2724 2724 flags &= ~TH_SYN;
2725 2725 seg_seq++;
2726 2726 break;
2727 2727 }
2728 2728 tcp->tcp_state = TCPS_SYN_RCVD;
2729 2729 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2730 2730 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2731 2731 tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2732 2732 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2733 2733 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2734 2734 if (mp1 != NULL) {
2735 2735 tcp_send_data(tcp, mp1);
2736 2736 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2737 2737 }
2738 2738 freemsg(mp);
2739 2739 return;
2740 2740 case TCPS_SYN_RCVD:
2741 2741 if (flags & TH_ACK) {
2742 2742 uint32_t pinit_wnd;
2743 2743
2744 2744 /*
2745 2745 * In this state, a SYN|ACK packet is either bogus
2746 2746 * because the other side must be ACKing our SYN which
2747 2747 * indicates it has seen the ACK for their SYN and
2748 2748 * shouldn't retransmit it or we're crossing SYNs
2749 2749 * on active open.
2750 2750 */
2751 2751 if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2752 2752 freemsg(mp);
2753 2753 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2754 2754 tcp, seg_ack, 0, TH_RST);
2755 2755 return;
2756 2756 }
2757 2757 /*
2758 2758 * NOTE: RFC 793 pg. 72 says this should be
2759 2759 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2760 2760 * but that would mean we have an ack that ignored
2761 2761 * our SYN.
2762 2762 */
2763 2763 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2764 2764 SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2765 2765 freemsg(mp);
2766 2766 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2767 2767 tcp, seg_ack, 0, TH_RST);
2768 2768 return;
2769 2769 }
2770 2770 /*
2771 2771 * No sane TCP stack will send such a small window
2772 2772 * without receiving any data. Just drop this invalid
2773 2773 * ACK. We also shorten the abort timeout in case
2774 2774 * this is an attack.
2775 2775 */
2776 2776 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2777 2777 if (pinit_wnd < tcp->tcp_mss &&
2778 2778 pinit_wnd < tcp_init_wnd_chk) {
2779 2779 freemsg(mp);
2780 2780 TCP_STAT(tcps, tcp_zwin_ack_syn);
2781 2781 tcp->tcp_second_ctimer_threshold =
2782 2782 tcp_early_abort * SECONDS;
2783 2783 return;
2784 2784 }
2785 2785 }
2786 2786 break;
2787 2787 case TCPS_LISTEN:
2788 2788 /*
2789 2789 * Only a TLI listener can come through this path when a
2790 2790 * acceptor is going back to be a listener and a packet
2791 2791 * for the acceptor hits the classifier. For a socket
2792 2792 * listener, this can never happen because a listener
2793 2793 * can never accept connection on itself and hence a
2794 2794 * socket acceptor can not go back to being a listener.
2795 2795 */
2796 2796 ASSERT(!TCP_IS_SOCKET(tcp));
2797 2797 /*FALLTHRU*/
2798 2798 case TCPS_CLOSED:
2799 2799 case TCPS_BOUND: {
2800 2800 conn_t *new_connp;
2801 2801 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2802 2802
2803 2803 /*
2804 2804 * Don't accept any input on a closed tcp as this TCP logically
2805 2805 * does not exist on the system. Don't proceed further with
2806 2806 * this TCP. For instance, this packet could trigger another
2807 2807 * close of this tcp which would be disastrous for tcp_refcnt.
2808 2808 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2809 2809 * be called at most once on a TCP. In this case we need to
2810 2810 * refeed the packet into the classifier and figure out where
2811 2811 * the packet should go.
2812 2812 */
2813 2813 new_connp = ipcl_classify(mp, ira, ipst);
2814 2814 if (new_connp != NULL) {
2815 2815 /* Drops ref on new_connp */
2816 2816 tcp_reinput(new_connp, mp, ira, ipst);
2817 2817 return;
2818 2818 }
2819 2819 /* We failed to classify. For now just drop the packet */
2820 2820 freemsg(mp);
2821 2821 return;
2822 2822 }
2823 2823 case TCPS_IDLE:
2824 2824 /*
2825 2825 * Handle the case where the tcp_clean_death() has happened
2826 2826 * on a connection (application hasn't closed yet) but a packet
2827 2827 * was already queued on squeue before tcp_clean_death()
2828 2828 * was processed. Calling tcp_clean_death() twice on same
2829 2829 * connection can result in weird behaviour.
2830 2830 */
2831 2831 freemsg(mp);
2832 2832 return;
2833 2833 default:
2834 2834 break;
2835 2835 }
2836 2836
2837 2837 /*
2838 2838 * Already on the correct queue/perimeter.
2839 2839 * If this is a detached connection and not an eager
2840 2840 * connection hanging off a listener then new data
2841 2841 * (past the FIN) will cause a reset.
2842 2842 * We do a special check here where it
2843 2843 * is out of the main line, rather than check
2844 2844 * if we are detached every time we see new
2845 2845 * data down below.
2846 2846 */
2847 2847 if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2848 2848 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2849 2849 TCPS_BUMP_MIB(tcps, tcpInClosed);
2850 2850 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2851 2851 freemsg(mp);
2852 2852 tcp_xmit_ctl("new data when detached", tcp,
2853 2853 tcp->tcp_snxt, 0, TH_RST);
2854 2854 (void) tcp_clean_death(tcp, EPROTO);
2855 2855 return;
2856 2856 }
2857 2857
2858 2858 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2859 2859 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2860 2860 new_swnd = ntohs(tcpha->tha_win) <<
2861 2861 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2862 2862
2863 2863 /*
2864 2864 * We are interested in two TCP options: timestamps (if negotiated) and
2865 2865 * SACK (if negotiated). Skip option parsing if neither is negotiated.
2866 2866 */
2867 2867 if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok) {
2868 2868 int options;
2869 2869 if (tcp->tcp_snd_sack_ok)
2870 2870 tcpopt.tcp = tcp;
2871 2871 else
2872 2872 tcpopt.tcp = NULL;
2873 2873 options = tcp_parse_options(tcpha, &tcpopt);
2874 2874 /*
2875 2875 * RST segments must not be subject to PAWS and are not
2876 2876 * required to have timestamps.
2877 2877 * We do not drop keepalive segments without
2878 2878 * timestamps, to maintain compatibility with legacy TCP stacks.
2879 2879 */
2880 2880 boolean_t keepalive = (seg_len == 0 || seg_len == 1) &&
2881 2881 (seg_seq + 1 == tcp->tcp_rnxt);
2882 2882 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) {
2883 2883 /*
2884 2884 * Per RFC 7323 section 3.2., silently drop non-RST
2885 2885 * segments without expected TSopt. This is a 'SHOULD'
2886 2886 * requirement.
2887 2887 * We accept keepalives without TSopt to maintain
2888 2888 * interoperability with tcp implementations that omit
2889 2889 * the TSopt on these. Keepalive data is discarded, so
2890 2890 * there is no risk corrupting data by accepting these.
2891 2891 */
2892 2892 if (!(options & TCP_OPT_TSTAMP_PRESENT)) {
2893 2893 /*
2894 2894 * Leave a breadcrumb for people to detect this
2895 2895 * behavior.
2896 2896 */
2897 2897 DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp);
2898 2898 freemsg(mp);
2899 2899 return;
2900 2900 }
2901 2901
2902 2902 if (!tcp_paws_check(tcp, &tcpopt)) {
2903 2903 /*
2904 2904 * This segment is not acceptable.
2905 2905 * Drop it and send back an ACK.
2906 2906 */
2907 2907 freemsg(mp);
2908 2908 flags |= TH_ACK_NEEDED;
2909 2909 goto ack_check;
2910 2910 }
2911 2911 }
2912 2912 }
2913 2913 try_again:;
2914 2914 mss = tcp->tcp_mss;
2915 2915 gap = seg_seq - tcp->tcp_rnxt;
2916 2916 rgap = tcp->tcp_rwnd - (gap + seg_len);
2917 2917 /*
2918 2918 * gap is the amount of sequence space between what we expect to see
2919 2919 * and what we got for seg_seq. A positive value for gap means
2920 2920 * something got lost. A negative value means we got some old stuff.
2921 2921 */
2922 2922 if (gap < 0) {
2923 2923 /* Old stuff present. Is the SYN in there? */
2924 2924 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2925 2925 (seg_len != 0)) {
2926 2926 flags &= ~TH_SYN;
2927 2927 seg_seq++;
2928 2928 urp--;
2929 2929 /* Recompute the gaps after noting the SYN. */
2930 2930 goto try_again;
2931 2931 }
2932 2932 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2933 2933 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2934 2934 (seg_len > -gap ? -gap : seg_len));
2935 2935 /* Remove the old stuff from seg_len. */
2936 2936 seg_len += gap;
2937 2937 /*
2938 2938 * Anything left?
2939 2939 * Make sure to check for unack'd FIN when rest of data
2940 2940 * has been previously ack'd.
2941 2941 */
2942 2942 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2943 2943 /*
2944 2944 * Resets are only valid if they lie within our offered
2945 2945 * window. If the RST bit is set, we just ignore this
2946 2946 * segment.
2947 2947 */
2948 2948 if (flags & TH_RST) {
2949 2949 freemsg(mp);
2950 2950 return;
2951 2951 }
2952 2952
2953 2953 /*
2954 2954 * The arriving of dup data packets indicate that we
2955 2955 * may have postponed an ack for too long, or the other
2956 2956 * side's RTT estimate is out of shape. Start acking
2957 2957 * more often.
2958 2958 */
2959 2959 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2960 2960 tcp->tcp_rack_cnt >= 1 &&
2961 2961 tcp->tcp_rack_abs_max > 2) {
2962 2962 tcp->tcp_rack_abs_max--;
2963 2963 }
2964 2964 tcp->tcp_rack_cur_max = 1;
2965 2965
2966 2966 /*
2967 2967 * This segment is "unacceptable". None of its
2968 2968 * sequence space lies within our advertized window.
2969 2969 *
2970 2970 * Adjust seg_len to the original value for tracing.
2971 2971 */
2972 2972 seg_len -= gap;
2973 2973 if (connp->conn_debug) {
2974 2974 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2975 2975 "tcp_rput: unacceptable, gap %d, rgap %d, "
2976 2976 "flags 0x%x, seg_seq %u, seg_ack %u, "
2977 2977 "seg_len %d, rnxt %u, snxt %u, %s",
2978 2978 gap, rgap, flags, seg_seq, seg_ack,
2979 2979 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
2980 2980 tcp_display(tcp, NULL,
2981 2981 DISP_ADDR_AND_PORT));
2982 2982 }
2983 2983
2984 2984 /*
2985 2985 * Arrange to send an ACK in response to the
2986 2986 * unacceptable segment per RFC 793 page 69. There
2987 2987 * is only one small difference between ours and the
2988 2988 * acceptability test in the RFC - we accept ACK-only
2989 2989 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
2990 2990 * will be generated.
2991 2991 *
2992 2992 * Note that we have to ACK an ACK-only packet at least
2993 2993 * for stacks that send 0-length keep-alives with
2994 2994 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
2995 2995 * section 4.2.3.6. As long as we don't ever generate
2996 2996 * an unacceptable packet in response to an incoming
2997 2997 * packet that is unacceptable, it should not cause
2998 2998 * "ACK wars".
2999 2999 */
3000 3000 flags |= TH_ACK_NEEDED;
3001 3001
3002 3002 /*
3003 3003 * Continue processing this segment in order to use the
3004 3004 * ACK information it contains, but skip all other
3005 3005 * sequence-number processing. Processing the ACK
3006 3006 * information is necessary in order to
3007 3007 * re-synchronize connections that may have lost
3008 3008 * synchronization.
3009 3009 *
3010 3010 * We clear seg_len and flag fields related to
3011 3011 * sequence number processing as they are not
3012 3012 * to be trusted for an unacceptable segment.
3013 3013 */
3014 3014 seg_len = 0;
3015 3015 flags &= ~(TH_SYN | TH_FIN | TH_URG);
3016 3016 goto process_ack;
3017 3017 }
3018 3018
3019 3019 /* Fix seg_seq, and chew the gap off the front. */
3020 3020 seg_seq = tcp->tcp_rnxt;
3021 3021 urp += gap;
3022 3022 do {
3023 3023 mblk_t *mp2;
3024 3024 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3025 3025 (uintptr_t)UINT_MAX);
3026 3026 gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3027 3027 if (gap > 0) {
3028 3028 mp->b_rptr = mp->b_wptr - gap;
3029 3029 break;
3030 3030 }
3031 3031 mp2 = mp;
3032 3032 mp = mp->b_cont;
3033 3033 freeb(mp2);
3034 3034 } while (gap < 0);
3035 3035 /*
3036 3036 * If the urgent data has already been acknowledged, we
3037 3037 * should ignore TH_URG below
3038 3038 */
3039 3039 if (urp < 0)
3040 3040 flags &= ~TH_URG;
|
↓ open down ↓ |
368 lines elided |
↑ open up ↑ |
3041 3041 }
3042 3042 /*
3043 3043 * rgap is the amount of stuff received out of window. A negative
3044 3044 * value is the amount out of window.
3045 3045 */
3046 3046 if (rgap < 0) {
3047 3047 mblk_t *mp2;
3048 3048
3049 3049 if (tcp->tcp_rwnd == 0) {
3050 3050 TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3051 + tcp->tcp_cs.tcp_in_zwnd_probes++;
3051 3052 } else {
3052 3053 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3053 3054 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3054 3055 }
3055 3056
3056 3057 /*
3057 3058 * seg_len does not include the FIN, so if more than
3058 3059 * just the FIN is out of window, we act like we don't
3059 3060 * see it. (If just the FIN is out of window, rgap
3060 3061 * will be zero and we will go ahead and acknowledge
3061 3062 * the FIN.)
3062 3063 */
3063 3064 flags &= ~TH_FIN;
3064 3065
3065 3066 /* Fix seg_len and make sure there is something left. */
3066 3067 seg_len += rgap;
3067 3068 if (seg_len <= 0) {
3068 3069 /*
3069 3070 * Resets are only valid if they lie within our offered
3070 3071 * window. If the RST bit is set, we just ignore this
3071 3072 * segment.
3072 3073 */
3073 3074 if (flags & TH_RST) {
3074 3075 freemsg(mp);
3075 3076 return;
3076 3077 }
3077 3078
3078 3079 /* Per RFC 793, we need to send back an ACK. */
3079 3080 flags |= TH_ACK_NEEDED;
3080 3081
3081 3082 /*
3082 3083 * Send SIGURG as soon as possible i.e. even
3083 3084 * if the TH_URG was delivered in a window probe
3084 3085 * packet (which will be unacceptable).
3085 3086 *
3086 3087 * We generate a signal if none has been generated
3087 3088 * for this connection or if this is a new urgent
3088 3089 * byte. Also send a zero-length "unmarked" message
3089 3090 * to inform SIOCATMARK that this is not the mark.
3090 3091 *
3091 3092 * tcp_urp_last_valid is cleared when the T_exdata_ind
3092 3093 * is sent up. This plus the check for old data
3093 3094 * (gap >= 0) handles the wraparound of the sequence
3094 3095 * number space without having to always track the
3095 3096 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3096 3097 * this max in its rcv_up variable).
3097 3098 *
3098 3099 * This prevents duplicate SIGURGS due to a "late"
3099 3100 * zero-window probe when the T_EXDATA_IND has already
3100 3101 * been sent up.
3101 3102 */
3102 3103 if ((flags & TH_URG) &&
3103 3104 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3104 3105 tcp->tcp_urp_last))) {
3105 3106 if (IPCL_IS_NONSTR(connp)) {
3106 3107 if (!TCP_IS_DETACHED(tcp)) {
3107 3108 (*sockupcalls->su_signal_oob)
3108 3109 (connp->conn_upper_handle,
3109 3110 urp);
3110 3111 }
3111 3112 } else {
3112 3113 mp1 = allocb(0, BPRI_MED);
3113 3114 if (mp1 == NULL) {
3114 3115 freemsg(mp);
3115 3116 return;
3116 3117 }
3117 3118 if (!TCP_IS_DETACHED(tcp) &&
3118 3119 !putnextctl1(connp->conn_rq,
3119 3120 M_PCSIG, SIGURG)) {
3120 3121 /* Try again on the rexmit. */
3121 3122 freemsg(mp1);
3122 3123 freemsg(mp);
3123 3124 return;
3124 3125 }
3125 3126 /*
3126 3127 * If the next byte would be the mark
3127 3128 * then mark with MARKNEXT else mark
3128 3129 * with NOTMARKNEXT.
3129 3130 */
3130 3131 if (gap == 0 && urp == 0)
3131 3132 mp1->b_flag |= MSGMARKNEXT;
3132 3133 else
3133 3134 mp1->b_flag |= MSGNOTMARKNEXT;
3134 3135 freemsg(tcp->tcp_urp_mark_mp);
3135 3136 tcp->tcp_urp_mark_mp = mp1;
3136 3137 flags |= TH_SEND_URP_MARK;
3137 3138 }
3138 3139 tcp->tcp_urp_last_valid = B_TRUE;
3139 3140 tcp->tcp_urp_last = urp + seg_seq;
3140 3141 }
3141 3142 /*
3142 3143 * If this is a zero window probe, continue to
3143 3144 * process the ACK part. But we need to set seg_len
3144 3145 * to 0 to avoid data processing. Otherwise just
3145 3146 * drop the segment and send back an ACK.
3146 3147 */
3147 3148 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3148 3149 flags &= ~(TH_SYN | TH_URG);
3149 3150 seg_len = 0;
3150 3151 goto process_ack;
3151 3152 } else {
3152 3153 freemsg(mp);
3153 3154 goto ack_check;
3154 3155 }
3155 3156 }
3156 3157 /* Pitch out of window stuff off the end. */
3157 3158 rgap = seg_len;
3158 3159 mp2 = mp;
3159 3160 do {
3160 3161 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3161 3162 (uintptr_t)INT_MAX);
3162 3163 rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3163 3164 if (rgap < 0) {
3164 3165 mp2->b_wptr += rgap;
3165 3166 if ((mp1 = mp2->b_cont) != NULL) {
3166 3167 mp2->b_cont = NULL;
3167 3168 freemsg(mp1);
3168 3169 }
3169 3170 break;
3170 3171 }
3171 3172 } while ((mp2 = mp2->b_cont) != NULL);
3172 3173 }
3173 3174 ok:;
3174 3175 /*
3175 3176 * TCP should check ECN info for segments inside the window only.
3176 3177 * Therefore the check should be done here.
3177 3178 */
3178 3179 if (tcp->tcp_ecn_ok) {
3179 3180 if (flags & TH_CWR) {
3180 3181 tcp->tcp_ecn_echo_on = B_FALSE;
3181 3182 }
3182 3183 /*
3183 3184 * Note that both ECN_CE and CWR can be set in the
3184 3185 * same segment. In this case, we once again turn
3185 3186 * on ECN_ECHO.
3186 3187 */
3187 3188 if (connp->conn_ipversion == IPV4_VERSION) {
3188 3189 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3189 3190
3190 3191 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3191 3192 tcp->tcp_ecn_echo_on = B_TRUE;
3192 3193 }
3193 3194 } else {
3194 3195 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3195 3196
3196 3197 if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3197 3198 htonl(IPH_ECN_CE << 20)) {
3198 3199 tcp->tcp_ecn_echo_on = B_TRUE;
3199 3200 }
3200 3201 }
3201 3202 }
3202 3203
3203 3204 /*
3204 3205 * Check whether we can update tcp_ts_recent. This test is from RFC
3205 3206 * 7323, section 5.3.
3206 3207 */
3207 3208 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) &&
3208 3209 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3209 3210 SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3210 3211 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3211 3212 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3212 3213 }
3213 3214
3214 3215 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3215 3216 /*
3216 3217 * FIN in an out of order segment. We record this in
3217 3218 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3218 3219 * Clear the FIN so that any check on FIN flag will fail.
3219 3220 * Remember that FIN also counts in the sequence number
3220 3221 * space. So we need to ack out of order FIN only segments.
3221 3222 */
3222 3223 if (flags & TH_FIN) {
3223 3224 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3224 3225 tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3225 3226 flags &= ~TH_FIN;
3226 3227 flags |= TH_ACK_NEEDED;
3227 3228 }
3228 3229 if (seg_len > 0) {
3229 3230 /* Fill in the SACK blk list. */
3230 3231 if (tcp->tcp_snd_sack_ok) {
3231 3232 tcp_sack_insert(tcp->tcp_sack_list,
3232 3233 seg_seq, seg_seq + seg_len,
3233 3234 &(tcp->tcp_num_sack_blk));
3234 3235 }
3235 3236
3236 3237 /*
3237 3238 * Attempt reassembly and see if we have something
3238 3239 * ready to go.
3239 3240 */
3240 3241 mp = tcp_reass(tcp, mp, seg_seq);
3241 3242 /* Always ack out of order packets */
3242 3243 flags |= TH_ACK_NEEDED | TH_PUSH;
3243 3244 if (mp) {
3244 3245 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3245 3246 (uintptr_t)INT_MAX);
3246 3247 seg_len = mp->b_cont ? msgdsize(mp) :
3247 3248 (int)(mp->b_wptr - mp->b_rptr);
3248 3249 seg_seq = tcp->tcp_rnxt;
3249 3250 /*
3250 3251 * A gap is filled and the seq num and len
3251 3252 * of the gap match that of a previously
3252 3253 * received FIN, put the FIN flag back in.
3253 3254 */
3254 3255 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3255 3256 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3256 3257 flags |= TH_FIN;
3257 3258 tcp->tcp_valid_bits &=
3258 3259 ~TCP_OFO_FIN_VALID;
3259 3260 }
3260 3261 if (tcp->tcp_reass_tid != 0) {
3261 3262 (void) TCP_TIMER_CANCEL(tcp,
3262 3263 tcp->tcp_reass_tid);
3263 3264 /*
3264 3265 * Restart the timer if there is still
3265 3266 * data in the reassembly queue.
3266 3267 */
3267 3268 if (tcp->tcp_reass_head != NULL) {
3268 3269 tcp->tcp_reass_tid = TCP_TIMER(
3269 3270 tcp, tcp_reass_timer,
3270 3271 tcps->tcps_reass_timeout);
3271 3272 } else {
3272 3273 tcp->tcp_reass_tid = 0;
3273 3274 }
3274 3275 }
3275 3276 } else {
3276 3277 /*
3277 3278 * Keep going even with NULL mp.
3278 3279 * There may be a useful ACK or something else
3279 3280 * we don't want to miss.
3280 3281 *
3281 3282 * But TCP should not perform fast retransmit
3282 3283 * because of the ack number. TCP uses
3283 3284 * seg_len == 0 to determine if it is a pure
3284 3285 * ACK. And this is not a pure ACK.
3285 3286 */
3286 3287 seg_len = 0;
3287 3288 ofo_seg = B_TRUE;
3288 3289
3289 3290 if (tcps->tcps_reass_timeout != 0 &&
|
↓ open down ↓ |
229 lines elided |
↑ open up ↑ |
3290 3291 tcp->tcp_reass_tid == 0) {
3291 3292 tcp->tcp_reass_tid = TCP_TIMER(tcp,
3292 3293 tcp_reass_timer,
3293 3294 tcps->tcps_reass_timeout);
3294 3295 }
3295 3296 }
3296 3297 }
3297 3298 } else if (seg_len > 0) {
3298 3299 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3299 3300 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3301 + tcp->tcp_cs.tcp_in_data_inorder_segs++;
3302 + tcp->tcp_cs.tcp_in_data_inorder_bytes += seg_len;
3303 +
3300 3304 /*
3301 3305 * If an out of order FIN was received before, and the seq
3302 3306 * num and len of the new segment match that of the FIN,
3303 3307 * put the FIN flag back in.
3304 3308 */
3305 3309 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3306 3310 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3307 3311 flags |= TH_FIN;
3308 3312 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3309 3313 }
3310 3314 }
3311 3315 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3312 3316 if (flags & TH_RST) {
3313 3317 freemsg(mp);
3314 3318 switch (tcp->tcp_state) {
3315 3319 case TCPS_SYN_RCVD:
3316 3320 (void) tcp_clean_death(tcp, ECONNREFUSED);
3317 3321 break;
3318 3322 case TCPS_ESTABLISHED:
3319 3323 case TCPS_FIN_WAIT_1:
3320 3324 case TCPS_FIN_WAIT_2:
3321 3325 case TCPS_CLOSE_WAIT:
3322 3326 (void) tcp_clean_death(tcp, ECONNRESET);
3323 3327 break;
3324 3328 case TCPS_CLOSING:
3325 3329 case TCPS_LAST_ACK:
3326 3330 (void) tcp_clean_death(tcp, 0);
3327 3331 break;
3328 3332 default:
3329 3333 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3330 3334 (void) tcp_clean_death(tcp, ENXIO);
3331 3335 break;
3332 3336 }
3333 3337 return;
3334 3338 }
3335 3339 if (flags & TH_SYN) {
3336 3340 /*
3337 3341 * See RFC 793, Page 71
3338 3342 *
3339 3343 * The seq number must be in the window as it should
3340 3344 * be "fixed" above. If it is outside window, it should
3341 3345 * be already rejected. Note that we allow seg_seq to be
3342 3346 * rnxt + rwnd because we want to accept 0 window probe.
3343 3347 */
3344 3348 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3345 3349 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3346 3350 freemsg(mp);
3347 3351 /*
3348 3352 * If the ACK flag is not set, just use our snxt as the
3349 3353 * seq number of the RST segment.
3350 3354 */
3351 3355 if (!(flags & TH_ACK)) {
3352 3356 seg_ack = tcp->tcp_snxt;
3353 3357 }
3354 3358 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3355 3359 TH_RST|TH_ACK);
3356 3360 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3357 3361 (void) tcp_clean_death(tcp, ECONNRESET);
3358 3362 return;
3359 3363 }
3360 3364 /*
3361 3365 * urp could be -1 when the urp field in the packet is 0
3362 3366 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3363 3367 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3364 3368 */
3365 3369 if ((flags & TH_URG) && urp >= 0) {
3366 3370 if (!tcp->tcp_urp_last_valid ||
3367 3371 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3368 3372 /*
3369 3373 * Non-STREAMS sockets handle the urgent data a litte
3370 3374 * differently from STREAMS based sockets. There is no
3371 3375 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3372 3376 * flags to keep SIOCATMARK happy. Instead a
3373 3377 * su_signal_oob upcall is made to update the mark.
3374 3378 * Neither is a T_EXDATA_IND mblk needed to be
3375 3379 * prepended to the urgent data. The urgent data is
3376 3380 * delivered using the su_recv upcall, where we set
3377 3381 * the MSG_OOB flag to indicate that it is urg data.
3378 3382 *
3379 3383 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3380 3384 * are used by non-STREAMS sockets.
3381 3385 */
3382 3386 if (IPCL_IS_NONSTR(connp)) {
3383 3387 if (!TCP_IS_DETACHED(tcp)) {
3384 3388 (*sockupcalls->su_signal_oob)
3385 3389 (connp->conn_upper_handle, urp);
3386 3390 }
3387 3391 } else {
3388 3392 /*
3389 3393 * If we haven't generated the signal yet for
3390 3394 * this urgent pointer value, do it now. Also,
3391 3395 * send up a zero-length M_DATA indicating
3392 3396 * whether or not this is the mark. The latter
3393 3397 * is not needed when a T_EXDATA_IND is sent up.
3394 3398 * However, if there are allocation failures
3395 3399 * this code relies on the sender retransmitting
3396 3400 * and the socket code for determining the mark
3397 3401 * should not block waiting for the peer to
3398 3402 * transmit. Thus, for simplicity we always
3399 3403 * send up the mark indication.
3400 3404 */
3401 3405 mp1 = allocb(0, BPRI_MED);
3402 3406 if (mp1 == NULL) {
3403 3407 freemsg(mp);
3404 3408 return;
3405 3409 }
3406 3410 if (!TCP_IS_DETACHED(tcp) &&
3407 3411 !putnextctl1(connp->conn_rq, M_PCSIG,
3408 3412 SIGURG)) {
3409 3413 /* Try again on the rexmit. */
3410 3414 freemsg(mp1);
3411 3415 freemsg(mp);
3412 3416 return;
3413 3417 }
3414 3418 /*
3415 3419 * Mark with NOTMARKNEXT for now.
3416 3420 * The code below will change this to MARKNEXT
3417 3421 * if we are at the mark.
3418 3422 *
3419 3423 * If there are allocation failures (e.g. in
3420 3424 * dupmsg below) the next time tcp_input_data
3421 3425 * sees the urgent segment it will send up the
3422 3426 * MSGMARKNEXT message.
3423 3427 */
3424 3428 mp1->b_flag |= MSGNOTMARKNEXT;
3425 3429 freemsg(tcp->tcp_urp_mark_mp);
3426 3430 tcp->tcp_urp_mark_mp = mp1;
3427 3431 flags |= TH_SEND_URP_MARK;
3428 3432 #ifdef DEBUG
3429 3433 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3430 3434 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3431 3435 "last %x, %s",
3432 3436 seg_seq, urp, tcp->tcp_urp_last,
3433 3437 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3434 3438 #endif /* DEBUG */
3435 3439 }
3436 3440 tcp->tcp_urp_last_valid = B_TRUE;
3437 3441 tcp->tcp_urp_last = urp + seg_seq;
3438 3442 } else if (tcp->tcp_urp_mark_mp != NULL) {
3439 3443 /*
3440 3444 * An allocation failure prevented the previous
3441 3445 * tcp_input_data from sending up the allocated
3442 3446 * MSG*MARKNEXT message - send it up this time
3443 3447 * around.
3444 3448 */
3445 3449 flags |= TH_SEND_URP_MARK;
3446 3450 }
3447 3451
3448 3452 /*
3449 3453 * If the urgent byte is in this segment, make sure that it is
3450 3454 * all by itself. This makes it much easier to deal with the
3451 3455 * possibility of an allocation failure on the T_exdata_ind.
3452 3456 * Note that seg_len is the number of bytes in the segment, and
3453 3457 * urp is the offset into the segment of the urgent byte.
3454 3458 * urp < seg_len means that the urgent byte is in this segment.
3455 3459 */
3456 3460 if (urp < seg_len) {
3457 3461 if (seg_len != 1) {
3458 3462 uint32_t tmp_rnxt;
3459 3463 /*
3460 3464 * Break it up and feed it back in.
3461 3465 * Re-attach the IP header.
3462 3466 */
3463 3467 mp->b_rptr = iphdr;
3464 3468 if (urp > 0) {
3465 3469 /*
3466 3470 * There is stuff before the urgent
3467 3471 * byte.
3468 3472 */
3469 3473 mp1 = dupmsg(mp);
3470 3474 if (!mp1) {
3471 3475 /*
3472 3476 * Trim from urgent byte on.
3473 3477 * The rest will come back.
3474 3478 */
3475 3479 (void) adjmsg(mp,
3476 3480 urp - seg_len);
3477 3481 tcp_input_data(connp,
3478 3482 mp, NULL, ira);
3479 3483 return;
3480 3484 }
3481 3485 (void) adjmsg(mp1, urp - seg_len);
3482 3486 /* Feed this piece back in. */
3483 3487 tmp_rnxt = tcp->tcp_rnxt;
3484 3488 tcp_input_data(connp, mp1, NULL, ira);
3485 3489 /*
3486 3490 * If the data passed back in was not
3487 3491 * processed (ie: bad ACK) sending
3488 3492 * the remainder back in will cause a
3489 3493 * loop. In this case, drop the
3490 3494 * packet and let the sender try
3491 3495 * sending a good packet.
3492 3496 */
3493 3497 if (tmp_rnxt == tcp->tcp_rnxt) {
3494 3498 freemsg(mp);
3495 3499 return;
3496 3500 }
3497 3501 }
3498 3502 if (urp != seg_len - 1) {
3499 3503 uint32_t tmp_rnxt;
3500 3504 /*
3501 3505 * There is stuff after the urgent
3502 3506 * byte.
3503 3507 */
3504 3508 mp1 = dupmsg(mp);
3505 3509 if (!mp1) {
3506 3510 /*
3507 3511 * Trim everything beyond the
3508 3512 * urgent byte. The rest will
3509 3513 * come back.
3510 3514 */
3511 3515 (void) adjmsg(mp,
3512 3516 urp + 1 - seg_len);
3513 3517 tcp_input_data(connp,
3514 3518 mp, NULL, ira);
3515 3519 return;
3516 3520 }
3517 3521 (void) adjmsg(mp1, urp + 1 - seg_len);
3518 3522 tmp_rnxt = tcp->tcp_rnxt;
3519 3523 tcp_input_data(connp, mp1, NULL, ira);
3520 3524 /*
3521 3525 * If the data passed back in was not
3522 3526 * processed (ie: bad ACK) sending
3523 3527 * the remainder back in will cause a
3524 3528 * loop. In this case, drop the
3525 3529 * packet and let the sender try
3526 3530 * sending a good packet.
3527 3531 */
3528 3532 if (tmp_rnxt == tcp->tcp_rnxt) {
3529 3533 freemsg(mp);
3530 3534 return;
3531 3535 }
3532 3536 }
3533 3537 tcp_input_data(connp, mp, NULL, ira);
3534 3538 return;
3535 3539 }
3536 3540 /*
3537 3541 * This segment contains only the urgent byte. We
3538 3542 * have to allocate the T_exdata_ind, if we can.
3539 3543 */
3540 3544 if (IPCL_IS_NONSTR(connp)) {
3541 3545 int error;
3542 3546
3543 3547 (*sockupcalls->su_recv)
3544 3548 (connp->conn_upper_handle, mp, seg_len,
3545 3549 MSG_OOB, &error, NULL);
3546 3550 /*
3547 3551 * We should never be in middle of a
3548 3552 * fallback, the squeue guarantees that.
3549 3553 */
3550 3554 ASSERT(error != EOPNOTSUPP);
3551 3555 mp = NULL;
3552 3556 goto update_ack;
3553 3557 } else if (!tcp->tcp_urp_mp) {
3554 3558 struct T_exdata_ind *tei;
3555 3559 mp1 = allocb(sizeof (struct T_exdata_ind),
3556 3560 BPRI_MED);
3557 3561 if (!mp1) {
3558 3562 /*
3559 3563 * Sigh... It'll be back.
3560 3564 * Generate any MSG*MARK message now.
3561 3565 */
3562 3566 freemsg(mp);
3563 3567 seg_len = 0;
3564 3568 if (flags & TH_SEND_URP_MARK) {
3565 3569
3566 3570
3567 3571 ASSERT(tcp->tcp_urp_mark_mp);
3568 3572 tcp->tcp_urp_mark_mp->b_flag &=
3569 3573 ~MSGNOTMARKNEXT;
3570 3574 tcp->tcp_urp_mark_mp->b_flag |=
3571 3575 MSGMARKNEXT;
3572 3576 }
3573 3577 goto ack_check;
3574 3578 }
3575 3579 mp1->b_datap->db_type = M_PROTO;
3576 3580 tei = (struct T_exdata_ind *)mp1->b_rptr;
3577 3581 tei->PRIM_type = T_EXDATA_IND;
3578 3582 tei->MORE_flag = 0;
3579 3583 mp1->b_wptr = (uchar_t *)&tei[1];
3580 3584 tcp->tcp_urp_mp = mp1;
3581 3585 #ifdef DEBUG
3582 3586 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3583 3587 "tcp_rput: allocated exdata_ind %s",
3584 3588 tcp_display(tcp, NULL,
3585 3589 DISP_PORT_ONLY));
3586 3590 #endif /* DEBUG */
3587 3591 /*
3588 3592 * There is no need to send a separate MSG*MARK
3589 3593 * message since the T_EXDATA_IND will be sent
3590 3594 * now.
3591 3595 */
3592 3596 flags &= ~TH_SEND_URP_MARK;
3593 3597 freemsg(tcp->tcp_urp_mark_mp);
3594 3598 tcp->tcp_urp_mark_mp = NULL;
3595 3599 }
3596 3600 /*
3597 3601 * Now we are all set. On the next putnext upstream,
3598 3602 * tcp_urp_mp will be non-NULL and will get prepended
3599 3603 * to what has to be this piece containing the urgent
3600 3604 * byte. If for any reason we abort this segment below,
3601 3605 * if it comes back, we will have this ready, or it
3602 3606 * will get blown off in close.
3603 3607 */
3604 3608 } else if (urp == seg_len) {
3605 3609 /*
3606 3610 * The urgent byte is the next byte after this sequence
3607 3611 * number. If this endpoint is non-STREAMS, then there
3608 3612 * is nothing to do here since the socket has already
3609 3613 * been notified about the urg pointer by the
3610 3614 * su_signal_oob call above.
3611 3615 *
3612 3616 * In case of STREAMS, some more work might be needed.
3613 3617 * If there is data it is marked with MSGMARKNEXT and
3614 3618 * and any tcp_urp_mark_mp is discarded since it is not
3615 3619 * needed. Otherwise, if the code above just allocated
3616 3620 * a zero-length tcp_urp_mark_mp message, that message
3617 3621 * is tagged with MSGMARKNEXT. Sending up these
3618 3622 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3619 3623 * even though the T_EXDATA_IND will not be sent up
3620 3624 * until the urgent byte arrives.
3621 3625 */
3622 3626 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3623 3627 if (seg_len != 0) {
3624 3628 flags |= TH_MARKNEXT_NEEDED;
3625 3629 freemsg(tcp->tcp_urp_mark_mp);
3626 3630 tcp->tcp_urp_mark_mp = NULL;
3627 3631 flags &= ~TH_SEND_URP_MARK;
3628 3632 } else if (tcp->tcp_urp_mark_mp != NULL) {
3629 3633 flags |= TH_SEND_URP_MARK;
3630 3634 tcp->tcp_urp_mark_mp->b_flag &=
3631 3635 ~MSGNOTMARKNEXT;
3632 3636 tcp->tcp_urp_mark_mp->b_flag |=
3633 3637 MSGMARKNEXT;
3634 3638 }
3635 3639 }
3636 3640 #ifdef DEBUG
3637 3641 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3638 3642 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3639 3643 seg_len, flags,
3640 3644 tcp_display(tcp, NULL, DISP_PORT_ONLY));
3641 3645 #endif /* DEBUG */
3642 3646 }
3643 3647 #ifdef DEBUG
3644 3648 else {
3645 3649 /* Data left until we hit mark */
3646 3650 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3647 3651 "tcp_rput: URP %d bytes left, %s",
3648 3652 urp - seg_len, tcp_display(tcp, NULL,
3649 3653 DISP_PORT_ONLY));
3650 3654 }
3651 3655 #endif /* DEBUG */
3652 3656 }
3653 3657
3654 3658 process_ack:
3655 3659 if (!(flags & TH_ACK)) {
3656 3660 freemsg(mp);
3657 3661 goto xmit_check;
3658 3662 }
3659 3663 }
3660 3664 bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3661 3665
3662 3666 if (bytes_acked > 0)
3663 3667 tcp->tcp_ip_forward_progress = B_TRUE;
3664 3668 if (tcp->tcp_state == TCPS_SYN_RCVD) {
3665 3669 /*
3666 3670 * tcp_sendmsg() checks tcp_state without entering
3667 3671 * the squeue so tcp_state should be updated before
3668 3672 * sending up a connection confirmation or a new
3669 3673 * connection indication.
3670 3674 */
3671 3675 tcp->tcp_state = TCPS_ESTABLISHED;
3672 3676
3673 3677 /*
3674 3678 * We are seeing the final ack in the three way
3675 3679 * hand shake of a active open'ed connection
3676 3680 * so we must send up a T_CONN_CON
3677 3681 */
3678 3682 if (tcp->tcp_active_open) {
3679 3683 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3680 3684 freemsg(mp);
3681 3685 tcp->tcp_state = TCPS_SYN_RCVD;
3682 3686 return;
3683 3687 }
3684 3688 /*
3685 3689 * Don't fuse the loopback endpoints for
3686 3690 * simultaneous active opens.
3687 3691 */
3688 3692 if (tcp->tcp_loopback) {
3689 3693 TCP_STAT(tcps, tcp_fusion_unfusable);
3690 3694 tcp->tcp_unfusable = B_TRUE;
3691 3695 }
3692 3696 /*
3693 3697 * For simultaneous active open, trace receipt of final
3694 3698 * ACK as tcp:::connect-established.
3695 3699 */
3696 3700 DTRACE_TCP5(connect__established, mblk_t *, NULL,
3697 3701 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3698 3702 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3699 3703 } else if (IPCL_IS_NONSTR(connp)) {
3700 3704 /*
3701 3705 * 3-way handshake has completed, so notify socket
3702 3706 * of the new connection.
3703 3707 *
3704 3708 * We are here means eager is fine but it can
3705 3709 * get a TH_RST at any point between now and till
3706 3710 * accept completes and disappear. We need to
3707 3711 * ensure that reference to eager is valid after
3708 3712 * we get out of eager's perimeter. So we do
3709 3713 * an extra refhold.
3710 3714 */
3711 3715 CONN_INC_REF(connp);
3712 3716
3713 3717 if (!tcp_newconn_notify(tcp, ira)) {
3714 3718 /*
3715 3719 * The state-change probe for SYN_RCVD ->
3716 3720 * ESTABLISHED has not fired yet. We reset
3717 3721 * the state to SYN_RCVD so that future
3718 3722 * state-change probes report correct state
3719 3723 * transistions.
3720 3724 */
3721 3725 tcp->tcp_state = TCPS_SYN_RCVD;
3722 3726 freemsg(mp);
3723 3727 /* notification did not go up, so drop ref */
3724 3728 CONN_DEC_REF(connp);
3725 3729 /* ... and close the eager */
3726 3730 ASSERT(TCP_IS_DETACHED(tcp));
3727 3731 (void) tcp_close_detached(tcp);
3728 3732 return;
3729 3733 }
3730 3734 /*
3731 3735 * tcp_newconn_notify() changes conn_upcalls and
3732 3736 * connp->conn_upper_handle. Fix things now, in case
3733 3737 * there's data attached to this ack.
3734 3738 */
3735 3739 if (connp->conn_upcalls != NULL)
3736 3740 sockupcalls = connp->conn_upcalls;
3737 3741 /*
3738 3742 * For passive open, trace receipt of final ACK as
3739 3743 * tcp:::accept-established.
3740 3744 */
3741 3745 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3742 3746 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3743 3747 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3744 3748 } else {
3745 3749 /*
3746 3750 * 3-way handshake complete - this is a STREAMS based
3747 3751 * socket, so pass up the T_CONN_IND.
3748 3752 */
3749 3753 tcp_t *listener = tcp->tcp_listener;
3750 3754 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3751 3755
3752 3756 tcp->tcp_tconnind_started = B_TRUE;
3753 3757 tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3754 3758 ASSERT(mp != NULL);
3755 3759 /*
3756 3760 * We are here means eager is fine but it can
3757 3761 * get a TH_RST at any point between now and till
3758 3762 * accept completes and disappear. We need to
3759 3763 * ensure that reference to eager is valid after
3760 3764 * we get out of eager's perimeter. So we do
3761 3765 * an extra refhold.
3762 3766 */
3763 3767 CONN_INC_REF(connp);
3764 3768
3765 3769 /*
3766 3770 * The listener also exists because of the refhold
3767 3771 * done in tcp_input_listener. Its possible that it
3768 3772 * might have closed. We will check that once we
3769 3773 * get inside listeners context.
3770 3774 */
3771 3775 CONN_INC_REF(listener->tcp_connp);
3772 3776 if (listener->tcp_connp->conn_sqp ==
3773 3777 connp->conn_sqp) {
3774 3778 /*
3775 3779 * We optimize by not calling an SQUEUE_ENTER
3776 3780 * on the listener since we know that the
3777 3781 * listener and eager squeues are the same.
3778 3782 * We are able to make this check safely only
3779 3783 * because neither the eager nor the listener
3780 3784 * can change its squeue. Only an active connect
3781 3785 * can change its squeue
3782 3786 */
3783 3787 tcp_send_conn_ind(listener->tcp_connp, mp,
3784 3788 listener->tcp_connp->conn_sqp);
3785 3789 CONN_DEC_REF(listener->tcp_connp);
3786 3790 } else if (!tcp->tcp_loopback) {
3787 3791 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3788 3792 mp, tcp_send_conn_ind,
3789 3793 listener->tcp_connp, NULL, SQ_FILL,
3790 3794 SQTAG_TCP_CONN_IND);
3791 3795 } else {
3792 3796 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3793 3797 mp, tcp_send_conn_ind,
3794 3798 listener->tcp_connp, NULL, SQ_NODRAIN,
3795 3799 SQTAG_TCP_CONN_IND);
3796 3800 }
3797 3801 /*
3798 3802 * For passive open, trace receipt of final ACK as
3799 3803 * tcp:::accept-established.
3800 3804 */
3801 3805 DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3802 3806 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3803 3807 iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3804 3808 }
3805 3809 TCPS_CONN_INC(tcps);
3806 3810
3807 3811 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3808 3812 bytes_acked--;
3809 3813 /* SYN was acked - making progress */
3810 3814 tcp->tcp_ip_forward_progress = B_TRUE;
3811 3815
3812 3816 /*
3813 3817 * If SYN was retransmitted, need to reset all
3814 3818 * retransmission info as this segment will be
3815 3819 * treated as a dup ACK.
3816 3820 */
3817 3821 if (tcp->tcp_rexmit) {
3818 3822 tcp->tcp_rexmit = B_FALSE;
3819 3823 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3820 3824 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3821 3825 tcp->tcp_ms_we_have_waited = 0;
3822 3826 tcp->tcp_cwnd = mss;
3823 3827 }
3824 3828
3825 3829 /*
3826 3830 * We set the send window to zero here.
3827 3831 * This is needed if there is data to be
3828 3832 * processed already on the queue.
3829 3833 * Later (at swnd_update label), the
3830 3834 * "new_swnd > tcp_swnd" condition is satisfied
3831 3835 * the XMIT_NEEDED flag is set in the current
3832 3836 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3833 3837 * called if there is already data on queue in
3834 3838 * this state.
3835 3839 */
3836 3840 tcp->tcp_swnd = 0;
3837 3841
3838 3842 if (new_swnd > tcp->tcp_max_swnd)
3839 3843 tcp->tcp_max_swnd = new_swnd;
3840 3844 tcp->tcp_swl1 = seg_seq;
3841 3845 tcp->tcp_swl2 = seg_ack;
3842 3846 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3843 3847
3844 3848 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3845 3849 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3846 3850 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3847 3851 int32_t, TCPS_SYN_RCVD);
3848 3852
3849 3853 /* Fuse when both sides are in ESTABLISHED state */
3850 3854 if (tcp->tcp_loopback && do_tcp_fusion)
3851 3855 tcp_fuse(tcp, iphdr, tcpha);
3852 3856
3853 3857 }
3854 3858 /* This code follows 4.4BSD-Lite2 mostly. */
3855 3859 if (bytes_acked < 0)
3856 3860 goto est;
3857 3861
3858 3862 /*
3859 3863 * If TCP is ECN capable and the congestion experience bit is
3860 3864 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3861 3865 * done once per window (or more loosely, per RTT).
3862 3866 */
3863 3867 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3864 3868 tcp->tcp_cwr = B_FALSE;
3865 3869 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3866 3870 if (!tcp->tcp_cwr) {
3867 3871 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3868 3872 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3869 3873 tcp->tcp_cwnd = npkt * mss;
3870 3874 /*
3871 3875 * If the cwnd is 0, use the timer to clock out
3872 3876 * new segments. This is required by the ECN spec.
3873 3877 */
3874 3878 if (npkt == 0) {
3875 3879 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3876 3880 /*
3877 3881 * This makes sure that when the ACK comes
3878 3882 * back, we will increase tcp_cwnd by 1 MSS.
3879 3883 */
3880 3884 tcp->tcp_cwnd_cnt = 0;
3881 3885 }
3882 3886 tcp->tcp_cwr = B_TRUE;
3883 3887 /*
3884 3888 * This marks the end of the current window of in
3885 3889 * flight data. That is why we don't use
3886 3890 * tcp_suna + tcp_swnd. Only data in flight can
3887 3891 * provide ECN info.
3888 3892 */
3889 3893 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3890 3894 tcp->tcp_ecn_cwr_sent = B_FALSE;
3891 3895 }
3892 3896 }
3893 3897
3894 3898 mp1 = tcp->tcp_xmit_head;
3895 3899 if (bytes_acked == 0) {
3896 3900 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3897 3901 int dupack_cnt;
3898 3902
3899 3903 TCPS_BUMP_MIB(tcps, tcpInDupAck);
3900 3904 /*
3901 3905 * Fast retransmit. When we have seen exactly three
3902 3906 * identical ACKs while we have unacked data
3903 3907 * outstanding we take it as a hint that our peer
3904 3908 * dropped something.
3905 3909 *
3906 3910 * If TCP is retransmitting, don't do fast retransmit.
3907 3911 */
3908 3912 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3909 3913 ! tcp->tcp_rexmit) {
3910 3914 /* Do Limited Transmit */
3911 3915 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3912 3916 tcps->tcps_dupack_fast_retransmit) {
3913 3917 /*
3914 3918 * RFC 3042
3915 3919 *
3916 3920 * What we need to do is temporarily
3917 3921 * increase tcp_cwnd so that new
3918 3922 * data can be sent if it is allowed
3919 3923 * by the receive window (tcp_rwnd).
3920 3924 * tcp_wput_data() will take care of
3921 3925 * the rest.
3922 3926 *
3923 3927 * If the connection is SACK capable,
3924 3928 * only do limited xmit when there
3925 3929 * is SACK info.
3926 3930 *
3927 3931 * Note how tcp_cwnd is incremented.
3928 3932 * The first dup ACK will increase
3929 3933 * it by 1 MSS. The second dup ACK
3930 3934 * will increase it by 2 MSS. This
3931 3935 * means that only 1 new segment will
3932 3936 * be sent for each dup ACK.
3933 3937 */
3934 3938 if (tcp->tcp_unsent > 0 &&
3935 3939 (!tcp->tcp_snd_sack_ok ||
3936 3940 (tcp->tcp_snd_sack_ok &&
3937 3941 tcp->tcp_notsack_list != NULL))) {
3938 3942 tcp->tcp_cwnd += mss <<
3939 3943 (tcp->tcp_dupack_cnt - 1);
3940 3944 flags |= TH_LIMIT_XMIT;
3941 3945 }
3942 3946 } else if (dupack_cnt ==
3943 3947 tcps->tcps_dupack_fast_retransmit) {
3944 3948
3945 3949 /*
3946 3950 * If we have reduced tcp_ssthresh
3947 3951 * because of ECN, do not reduce it again
3948 3952 * unless it is already one window of data
3949 3953 * away. After one window of data, tcp_cwr
3950 3954 * should then be cleared. Note that
3951 3955 * for non ECN capable connection, tcp_cwr
3952 3956 * should always be false.
3953 3957 *
3954 3958 * Adjust cwnd since the duplicate
3955 3959 * ack indicates that a packet was
3956 3960 * dropped (due to congestion.)
3957 3961 */
3958 3962 if (!tcp->tcp_cwr) {
3959 3963 npkt = ((tcp->tcp_snxt -
3960 3964 tcp->tcp_suna) >> 1) / mss;
3961 3965 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3962 3966 mss;
3963 3967 tcp->tcp_cwnd = (npkt +
3964 3968 tcp->tcp_dupack_cnt) * mss;
3965 3969 }
3966 3970 if (tcp->tcp_ecn_ok) {
3967 3971 tcp->tcp_cwr = B_TRUE;
3968 3972 tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3969 3973 tcp->tcp_ecn_cwr_sent = B_FALSE;
3970 3974 }
3971 3975
3972 3976 /*
3973 3977 * We do Hoe's algorithm. Refer to her
3974 3978 * paper "Improving the Start-up Behavior
3975 3979 * of a Congestion Control Scheme for TCP,"
3976 3980 * appeared in SIGCOMM'96.
3977 3981 *
3978 3982 * Save highest seq no we have sent so far.
3979 3983 * Be careful about the invisible FIN byte.
3980 3984 */
3981 3985 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
3982 3986 (tcp->tcp_unsent == 0)) {
3983 3987 tcp->tcp_rexmit_max = tcp->tcp_fss;
3984 3988 } else {
3985 3989 tcp->tcp_rexmit_max = tcp->tcp_snxt;
3986 3990 }
3987 3991
3988 3992 /*
3989 3993 * For SACK:
3990 3994 * Calculate tcp_pipe, which is the
3991 3995 * estimated number of bytes in
3992 3996 * network.
3993 3997 *
3994 3998 * tcp_fack is the highest sack'ed seq num
3995 3999 * TCP has received.
3996 4000 *
3997 4001 * tcp_pipe is explained in the above quoted
3998 4002 * Fall and Floyd's paper. tcp_fack is
3999 4003 * explained in Mathis and Mahdavi's
4000 4004 * "Forward Acknowledgment: Refining TCP
4001 4005 * Congestion Control" in SIGCOMM '96.
4002 4006 */
4003 4007 if (tcp->tcp_snd_sack_ok) {
4004 4008 if (tcp->tcp_notsack_list != NULL) {
4005 4009 tcp->tcp_pipe = tcp->tcp_snxt -
4006 4010 tcp->tcp_fack;
4007 4011 tcp->tcp_sack_snxt = seg_ack;
4008 4012 flags |= TH_NEED_SACK_REXMIT;
4009 4013 } else {
4010 4014 /*
4011 4015 * Always initialize tcp_pipe
4012 4016 * even though we don't have
4013 4017 * any SACK info. If later
4014 4018 * we get SACK info and
4015 4019 * tcp_pipe is not initialized,
4016 4020 * funny things will happen.
4017 4021 */
4018 4022 tcp->tcp_pipe =
4019 4023 tcp->tcp_cwnd_ssthresh;
4020 4024 }
4021 4025 } else {
4022 4026 flags |= TH_REXMIT_NEEDED;
4023 4027 } /* tcp_snd_sack_ok */
4024 4028
4025 4029 } else {
4026 4030 /*
4027 4031 * Here we perform congestion
4028 4032 * avoidance, but NOT slow start.
4029 4033 * This is known as the Fast
4030 4034 * Recovery Algorithm.
4031 4035 */
4032 4036 if (tcp->tcp_snd_sack_ok &&
4033 4037 tcp->tcp_notsack_list != NULL) {
4034 4038 flags |= TH_NEED_SACK_REXMIT;
4035 4039 tcp->tcp_pipe -= mss;
4036 4040 if (tcp->tcp_pipe < 0)
4037 4041 tcp->tcp_pipe = 0;
4038 4042 } else {
4039 4043 /*
4040 4044 * We know that one more packet has
4041 4045 * left the pipe thus we can update
4042 4046 * cwnd.
4043 4047 */
4044 4048 cwnd = tcp->tcp_cwnd + mss;
4045 4049 if (cwnd > tcp->tcp_cwnd_max)
4046 4050 cwnd = tcp->tcp_cwnd_max;
4047 4051 tcp->tcp_cwnd = cwnd;
4048 4052 if (tcp->tcp_unsent > 0)
4049 4053 flags |= TH_XMIT_NEEDED;
4050 4054 }
4051 4055 }
4052 4056 }
4053 4057 } else if (tcp->tcp_zero_win_probe) {
4054 4058 /*
4055 4059 * If the window has opened, need to arrange
4056 4060 * to send additional data.
4057 4061 */
4058 4062 if (new_swnd != 0) {
4059 4063 /* tcp_suna != tcp_snxt */
4060 4064 /* Packet contains a window update */
4061 4065 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4062 4066 tcp->tcp_zero_win_probe = 0;
4063 4067 tcp->tcp_timer_backoff = 0;
4064 4068 tcp->tcp_ms_we_have_waited = 0;
4065 4069
4066 4070 /*
4067 4071 * Transmit starting with tcp_suna since
4068 4072 * the one byte probe is not ack'ed.
4069 4073 * If TCP has sent more than one identical
4070 4074 * probe, tcp_rexmit will be set. That means
4071 4075 * tcp_ss_rexmit() will send out the one
4072 4076 * byte along with new data. Otherwise,
4073 4077 * fake the retransmission.
4074 4078 */
4075 4079 flags |= TH_XMIT_NEEDED;
4076 4080 if (!tcp->tcp_rexmit) {
4077 4081 tcp->tcp_rexmit = B_TRUE;
4078 4082 tcp->tcp_dupack_cnt = 0;
4079 4083 tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4080 4084 tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4081 4085 }
4082 4086 }
4083 4087 }
4084 4088 goto swnd_update;
4085 4089 }
4086 4090
4087 4091 /*
4088 4092 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4089 4093 * If the ACK value acks something that we have not yet sent, it might
4090 4094 * be an old duplicate segment. Send an ACK to re-synchronize the
4091 4095 * other side.
4092 4096 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4093 4097 * state is handled above, so we can always just drop the segment and
4094 4098 * send an ACK here.
4095 4099 *
4096 4100 * In the case where the peer shrinks the window, we see the new window
4097 4101 * update, but all the data sent previously is queued up by the peer.
4098 4102 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4099 4103 * number, which was already sent, and within window, is recorded.
4100 4104 * tcp_snxt is then updated.
4101 4105 *
4102 4106 * If the window has previously shrunk, and an ACK for data not yet
4103 4107 * sent, according to tcp_snxt is recieved, it may still be valid. If
4104 4108 * the ACK is for data within the window at the time the window was
4105 4109 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4106 4110 * the sequence number ACK'ed.
4107 4111 *
4108 4112 * If the ACK covers all the data sent at the time the window was
4109 4113 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4110 4114 *
4111 4115 * Should we send ACKs in response to ACK only segments?
4112 4116 */
4113 4117
4114 4118 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4115 4119 if ((tcp->tcp_is_wnd_shrnk) &&
4116 4120 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4117 4121 uint32_t data_acked_ahead_snxt;
4118 4122
4119 4123 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4120 4124 tcp_update_xmit_tail(tcp, seg_ack);
4121 4125 tcp->tcp_unsent -= data_acked_ahead_snxt;
4122 4126 } else {
4123 4127 TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4124 4128 /* drop the received segment */
4125 4129 freemsg(mp);
4126 4130
4127 4131 /*
4128 4132 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4129 4133 * greater than 0, check if the number of such
4130 4134 * bogus ACks is greater than that count. If yes,
4131 4135 * don't send back any ACK. This prevents TCP from
4132 4136 * getting into an ACK storm if somehow an attacker
4133 4137 * successfully spoofs an acceptable segment to our
4134 4138 * peer. If this continues (count > 2 X threshold),
4135 4139 * we should abort this connection.
4136 4140 */
4137 4141 if (tcp_drop_ack_unsent_cnt > 0 &&
4138 4142 ++tcp->tcp_in_ack_unsent >
|
↓ open down ↓ |
829 lines elided |
↑ open up ↑ |
4139 4143 tcp_drop_ack_unsent_cnt) {
4140 4144 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4141 4145 if (tcp->tcp_in_ack_unsent > 2 *
4142 4146 tcp_drop_ack_unsent_cnt) {
4143 4147 (void) tcp_clean_death(tcp, EPROTO);
4144 4148 }
4145 4149 return;
4146 4150 }
4147 4151 mp = tcp_ack_mp(tcp);
4148 4152 if (mp != NULL) {
4149 - BUMP_LOCAL(tcp->tcp_obsegs);
4153 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4150 4154 TCPS_BUMP_MIB(tcps, tcpOutAck);
4151 4155 tcp_send_data(tcp, mp);
4152 4156 }
4153 4157 return;
4154 4158 }
4155 4159 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4156 4160 tcp->tcp_snxt_shrunk)) {
4157 4161 tcp->tcp_is_wnd_shrnk = B_FALSE;
4158 4162 }
4159 4163
4160 4164 /*
4161 4165 * TCP gets a new ACK, update the notsack'ed list to delete those
4162 4166 * blocks that are covered by this ACK.
4163 4167 */
4164 4168 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4165 4169 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4166 4170 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4167 4171 }
4168 4172
4169 4173 /*
4170 4174 * If we got an ACK after fast retransmit, check to see
4171 4175 * if it is a partial ACK. If it is not and the congestion
4172 4176 * window was inflated to account for the other side's
4173 4177 * cached packets, retract it. If it is, do Hoe's algorithm.
4174 4178 */
4175 4179 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4176 4180 ASSERT(tcp->tcp_rexmit == B_FALSE);
4177 4181 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4178 4182 tcp->tcp_dupack_cnt = 0;
4179 4183 /*
4180 4184 * Restore the orig tcp_cwnd_ssthresh after
4181 4185 * fast retransmit phase.
4182 4186 */
4183 4187 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4184 4188 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4185 4189 }
4186 4190 tcp->tcp_rexmit_max = seg_ack;
4187 4191 tcp->tcp_cwnd_cnt = 0;
4188 4192
4189 4193 /*
4190 4194 * Remove all notsack info to avoid confusion with
4191 4195 * the next fast retrasnmit/recovery phase.
4192 4196 */
4193 4197 if (tcp->tcp_snd_sack_ok) {
4194 4198 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4195 4199 tcp);
4196 4200 }
4197 4201 } else {
4198 4202 if (tcp->tcp_snd_sack_ok &&
4199 4203 tcp->tcp_notsack_list != NULL) {
4200 4204 flags |= TH_NEED_SACK_REXMIT;
4201 4205 tcp->tcp_pipe -= mss;
4202 4206 if (tcp->tcp_pipe < 0)
4203 4207 tcp->tcp_pipe = 0;
4204 4208 } else {
4205 4209 /*
4206 4210 * Hoe's algorithm:
4207 4211 *
4208 4212 * Retransmit the unack'ed segment and
4209 4213 * restart fast recovery. Note that we
4210 4214 * need to scale back tcp_cwnd to the
4211 4215 * original value when we started fast
4212 4216 * recovery. This is to prevent overly
4213 4217 * aggressive behaviour in sending new
4214 4218 * segments.
4215 4219 */
4216 4220 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4217 4221 tcps->tcps_dupack_fast_retransmit * mss;
4218 4222 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4219 4223 flags |= TH_REXMIT_NEEDED;
4220 4224 }
4221 4225 }
4222 4226 } else {
4223 4227 tcp->tcp_dupack_cnt = 0;
4224 4228 if (tcp->tcp_rexmit) {
4225 4229 /*
4226 4230 * TCP is retranmitting. If the ACK ack's all
4227 4231 * outstanding data, update tcp_rexmit_max and
4228 4232 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4229 4233 * to the correct value.
4230 4234 *
4231 4235 * Note that SEQ_LEQ() is used. This is to avoid
4232 4236 * unnecessary fast retransmit caused by dup ACKs
4233 4237 * received when TCP does slow start retransmission
4234 4238 * after a time out. During this phase, TCP may
4235 4239 * send out segments which are already received.
4236 4240 * This causes dup ACKs to be sent back.
4237 4241 */
4238 4242 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4239 4243 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4240 4244 tcp->tcp_rexmit_nxt = seg_ack;
4241 4245 }
4242 4246 if (seg_ack != tcp->tcp_rexmit_max) {
4243 4247 flags |= TH_XMIT_NEEDED;
4244 4248 }
4245 4249 } else {
4246 4250 tcp->tcp_rexmit = B_FALSE;
4247 4251 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4248 4252 }
4249 4253 tcp->tcp_ms_we_have_waited = 0;
4250 4254 }
4251 4255 }
4252 4256
4253 4257 TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4254 4258 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4255 4259 tcp->tcp_suna = seg_ack;
4256 4260 if (tcp->tcp_zero_win_probe != 0) {
4257 4261 tcp->tcp_zero_win_probe = 0;
4258 4262 tcp->tcp_timer_backoff = 0;
4259 4263 }
4260 4264
4261 4265 /*
4262 4266 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4263 4267 * Note that it cannot be the SYN being ack'ed. The code flow
4264 4268 * will not reach here.
4265 4269 */
4266 4270 if (mp1 == NULL) {
4267 4271 goto fin_acked;
4268 4272 }
4269 4273
4270 4274 /*
4271 4275 * Update the congestion window.
4272 4276 *
4273 4277 * If TCP is not ECN capable or TCP is ECN capable but the
4274 4278 * congestion experience bit is not set, increase the tcp_cwnd as
4275 4279 * usual.
4276 4280 */
4277 4281 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4278 4282 cwnd = tcp->tcp_cwnd;
4279 4283 add = mss;
4280 4284
4281 4285 if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4282 4286 /*
4283 4287 * This is to prevent an increase of less than 1 MSS of
4284 4288 * tcp_cwnd. With partial increase, tcp_wput_data()
4285 4289 * may send out tinygrams in order to preserve mblk
4286 4290 * boundaries.
4287 4291 *
4288 4292 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4289 4293 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4290 4294 * increased by 1 MSS for every RTTs.
4291 4295 */
4292 4296 if (tcp->tcp_cwnd_cnt <= 0) {
4293 4297 tcp->tcp_cwnd_cnt = cwnd + add;
4294 4298 } else {
4295 4299 tcp->tcp_cwnd_cnt -= add;
4296 4300 add = 0;
4297 4301 }
4298 4302 }
4299 4303 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4300 4304 }
4301 4305
4302 4306 /* See if the latest urgent data has been acknowledged */
4303 4307 if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4304 4308 SEQ_GT(seg_ack, tcp->tcp_urg))
4305 4309 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4306 4310
4307 4311 /*
4308 4312 * Update the RTT estimates. Note that we don't use the TCP
4309 4313 * timestamp option to calculate RTT even if one is present. This is
4310 4314 * because the timestamp option's resolution (CPU tick) is
4311 4315 * too coarse to measure modern datacenter networks' microsecond
4312 4316 * latencies. The timestamp field's resolution is limited by its
4313 4317 * 4-byte width (see RFC1323), and since we always store a
4314 4318 * high-resolution nanosecond presision timestamp along with the data,
4315 4319 * there is no point to ever using the timestamp option.
4316 4320 */
4317 4321 if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4318 4322 /*
4319 4323 * An ACK sequence we haven't seen before, so get the RTT
4320 4324 * and update the RTO. But first check if the timestamp is
4321 4325 * valid to use.
4322 4326 */
4323 4327 if ((mp1->b_next != NULL) &&
4324 4328 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) {
4325 4329 tcp_set_rto(tcp, gethrtime() -
4326 4330 (hrtime_t)(intptr_t)mp1->b_prev);
4327 4331 } else {
4328 4332 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4329 4333 }
4330 4334
4331 4335 /* Remeber the last sequence to be ACKed */
4332 4336 tcp->tcp_csuna = seg_ack;
4333 4337 if (tcp->tcp_set_timer == 1) {
4334 4338 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4335 4339 tcp->tcp_set_timer = 0;
4336 4340 }
4337 4341 } else {
4338 4342 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4339 4343 }
4340 4344
4341 4345 /* Eat acknowledged bytes off the xmit queue. */
4342 4346 for (;;) {
4343 4347 mblk_t *mp2;
4344 4348 uchar_t *wptr;
4345 4349
4346 4350 wptr = mp1->b_wptr;
4347 4351 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4348 4352 bytes_acked -= (int)(wptr - mp1->b_rptr);
4349 4353 if (bytes_acked < 0) {
4350 4354 mp1->b_rptr = wptr + bytes_acked;
4351 4355 /*
4352 4356 * Set a new timestamp if all the bytes timed by the
4353 4357 * old timestamp have been ack'ed.
4354 4358 */
4355 4359 if (SEQ_GT(seg_ack,
4356 4360 (uint32_t)(uintptr_t)(mp1->b_next))) {
4357 4361 mp1->b_prev =
4358 4362 (mblk_t *)(intptr_t)gethrtime();
4359 4363 mp1->b_next = NULL;
4360 4364 }
4361 4365 break;
4362 4366 }
4363 4367 mp1->b_next = NULL;
4364 4368 mp1->b_prev = NULL;
4365 4369 mp2 = mp1;
4366 4370 mp1 = mp1->b_cont;
4367 4371
4368 4372 /*
4369 4373 * This notification is required for some zero-copy
4370 4374 * clients to maintain a copy semantic. After the data
4371 4375 * is ack'ed, client is safe to modify or reuse the buffer.
4372 4376 */
4373 4377 if (tcp->tcp_snd_zcopy_aware &&
4374 4378 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4375 4379 tcp_zcopy_notify(tcp);
4376 4380 freeb(mp2);
4377 4381 if (bytes_acked == 0) {
4378 4382 if (mp1 == NULL) {
4379 4383 /* Everything is ack'ed, clear the tail. */
4380 4384 tcp->tcp_xmit_tail = NULL;
4381 4385 /*
4382 4386 * Cancel the timer unless we are still
4383 4387 * waiting for an ACK for the FIN packet.
4384 4388 */
4385 4389 if (tcp->tcp_timer_tid != 0 &&
4386 4390 tcp->tcp_snxt == tcp->tcp_suna) {
4387 4391 (void) TCP_TIMER_CANCEL(tcp,
4388 4392 tcp->tcp_timer_tid);
4389 4393 tcp->tcp_timer_tid = 0;
4390 4394 }
4391 4395 goto pre_swnd_update;
4392 4396 }
4393 4397 if (mp2 != tcp->tcp_xmit_tail)
4394 4398 break;
4395 4399 tcp->tcp_xmit_tail = mp1;
4396 4400 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4397 4401 (uintptr_t)INT_MAX);
4398 4402 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4399 4403 mp1->b_rptr);
4400 4404 break;
4401 4405 }
4402 4406 if (mp1 == NULL) {
4403 4407 /*
4404 4408 * More was acked but there is nothing more
4405 4409 * outstanding. This means that the FIN was
4406 4410 * just acked or that we're talking to a clown.
4407 4411 */
4408 4412 fin_acked:
4409 4413 ASSERT(tcp->tcp_fin_sent);
4410 4414 tcp->tcp_xmit_tail = NULL;
4411 4415 if (tcp->tcp_fin_sent) {
4412 4416 /* FIN was acked - making progress */
4413 4417 if (!tcp->tcp_fin_acked)
4414 4418 tcp->tcp_ip_forward_progress = B_TRUE;
4415 4419 tcp->tcp_fin_acked = B_TRUE;
4416 4420 if (tcp->tcp_linger_tid != 0 &&
4417 4421 TCP_TIMER_CANCEL(tcp,
4418 4422 tcp->tcp_linger_tid) >= 0) {
4419 4423 tcp_stop_lingering(tcp);
4420 4424 freemsg(mp);
4421 4425 mp = NULL;
4422 4426 }
4423 4427 } else {
4424 4428 /*
4425 4429 * We should never get here because
4426 4430 * we have already checked that the
4427 4431 * number of bytes ack'ed should be
4428 4432 * smaller than or equal to what we
4429 4433 * have sent so far (it is the
4430 4434 * acceptability check of the ACK).
4431 4435 * We can only get here if the send
4432 4436 * queue is corrupted.
4433 4437 *
4434 4438 * Terminate the connection and
4435 4439 * panic the system. It is better
4436 4440 * for us to panic instead of
4437 4441 * continuing to avoid other disaster.
4438 4442 */
4439 4443 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4440 4444 tcp->tcp_rnxt, TH_RST|TH_ACK);
4441 4445 panic("Memory corruption "
4442 4446 "detected for connection %s.",
4443 4447 tcp_display(tcp, NULL,
4444 4448 DISP_ADDR_AND_PORT));
4445 4449 /*NOTREACHED*/
4446 4450 }
4447 4451 goto pre_swnd_update;
4448 4452 }
4449 4453 ASSERT(mp2 != tcp->tcp_xmit_tail);
4450 4454 }
4451 4455 if (tcp->tcp_unsent) {
4452 4456 flags |= TH_XMIT_NEEDED;
4453 4457 }
4454 4458 pre_swnd_update:
4455 4459 tcp->tcp_xmit_head = mp1;
4456 4460 swnd_update:
4457 4461 /*
4458 4462 * The following check is different from most other implementations.
4459 4463 * For bi-directional transfer, when segments are dropped, the
4460 4464 * "normal" check will not accept a window update in those
4461 4465 * retransmitted segemnts. Failing to do that, TCP may send out
4462 4466 * segments which are outside receiver's window. As TCP accepts
4463 4467 * the ack in those retransmitted segments, if the window update in
4464 4468 * the same segment is not accepted, TCP will incorrectly calculates
4465 4469 * that it can send more segments. This can create a deadlock
4466 4470 * with the receiver if its window becomes zero.
4467 4471 */
4468 4472 if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4469 4473 SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4470 4474 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4471 4475 /*
4472 4476 * The criteria for update is:
4473 4477 *
4474 4478 * 1. the segment acknowledges some data. Or
4475 4479 * 2. the segment is new, i.e. it has a higher seq num. Or
4476 4480 * 3. the segment is not old and the advertised window is
4477 4481 * larger than the previous advertised window.
4478 4482 */
4479 4483 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4480 4484 flags |= TH_XMIT_NEEDED;
4481 4485 tcp->tcp_swnd = new_swnd;
4482 4486 if (new_swnd > tcp->tcp_max_swnd)
4483 4487 tcp->tcp_max_swnd = new_swnd;
4484 4488 tcp->tcp_swl1 = seg_seq;
4485 4489 tcp->tcp_swl2 = seg_ack;
4486 4490 }
4487 4491 est:
4488 4492 if (tcp->tcp_state > TCPS_ESTABLISHED) {
4489 4493
4490 4494 switch (tcp->tcp_state) {
4491 4495 case TCPS_FIN_WAIT_1:
4492 4496 if (tcp->tcp_fin_acked) {
4493 4497 tcp->tcp_state = TCPS_FIN_WAIT_2;
4494 4498 DTRACE_TCP6(state__change, void, NULL,
4495 4499 ip_xmit_attr_t *, connp->conn_ixa,
4496 4500 void, NULL, tcp_t *, tcp, void, NULL,
4497 4501 int32_t, TCPS_FIN_WAIT_1);
4498 4502 /*
4499 4503 * We implement the non-standard BSD/SunOS
4500 4504 * FIN_WAIT_2 flushing algorithm.
4501 4505 * If there is no user attached to this
4502 4506 * TCP endpoint, then this TCP struct
4503 4507 * could hang around forever in FIN_WAIT_2
4504 4508 * state if the peer forgets to send us
4505 4509 * a FIN. To prevent this, we wait only
4506 4510 * 2*MSL (a convenient time value) for
4507 4511 * the FIN to arrive. If it doesn't show up,
4508 4512 * we flush the TCP endpoint. This algorithm,
4509 4513 * though a violation of RFC-793, has worked
4510 4514 * for over 10 years in BSD systems.
4511 4515 * Note: SunOS 4.x waits 675 seconds before
4512 4516 * flushing the FIN_WAIT_2 connection.
4513 4517 */
4514 4518 TCP_TIMER_RESTART(tcp,
4515 4519 tcp->tcp_fin_wait_2_flush_interval);
4516 4520 }
4517 4521 break;
4518 4522 case TCPS_FIN_WAIT_2:
4519 4523 break; /* Shutdown hook? */
4520 4524 case TCPS_LAST_ACK:
4521 4525 freemsg(mp);
4522 4526 if (tcp->tcp_fin_acked) {
4523 4527 (void) tcp_clean_death(tcp, 0);
4524 4528 return;
4525 4529 }
4526 4530 goto xmit_check;
4527 4531 case TCPS_CLOSING:
4528 4532 if (tcp->tcp_fin_acked) {
4529 4533 SET_TIME_WAIT(tcps, tcp, connp);
4530 4534 DTRACE_TCP6(state__change, void, NULL,
4531 4535 ip_xmit_attr_t *, connp->conn_ixa, void,
4532 4536 NULL, tcp_t *, tcp, void, NULL, int32_t,
4533 4537 TCPS_CLOSING);
4534 4538 }
4535 4539 /*FALLTHRU*/
4536 4540 case TCPS_CLOSE_WAIT:
4537 4541 freemsg(mp);
4538 4542 goto xmit_check;
4539 4543 default:
4540 4544 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4541 4545 break;
4542 4546 }
4543 4547 }
4544 4548 if (flags & TH_FIN) {
4545 4549 /* Make sure we ack the fin */
4546 4550 flags |= TH_ACK_NEEDED;
4547 4551 if (!tcp->tcp_fin_rcvd) {
4548 4552 tcp->tcp_fin_rcvd = B_TRUE;
4549 4553 tcp->tcp_rnxt++;
4550 4554 tcpha = tcp->tcp_tcpha;
4551 4555 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4552 4556
4553 4557 /*
4554 4558 * Generate the ordrel_ind at the end unless the
4555 4559 * conn is detached or it is a STREAMS based eager.
4556 4560 * In the eager case we defer the notification until
4557 4561 * tcp_accept_finish has run.
4558 4562 */
4559 4563 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4560 4564 (tcp->tcp_listener == NULL &&
4561 4565 !tcp->tcp_hard_binding)))
4562 4566 flags |= TH_ORDREL_NEEDED;
4563 4567 switch (tcp->tcp_state) {
4564 4568 case TCPS_SYN_RCVD:
4565 4569 tcp->tcp_state = TCPS_CLOSE_WAIT;
4566 4570 DTRACE_TCP6(state__change, void, NULL,
4567 4571 ip_xmit_attr_t *, connp->conn_ixa,
4568 4572 void, NULL, tcp_t *, tcp, void, NULL,
4569 4573 int32_t, TCPS_SYN_RCVD);
4570 4574 /* Keepalive? */
4571 4575 break;
4572 4576 case TCPS_ESTABLISHED:
4573 4577 tcp->tcp_state = TCPS_CLOSE_WAIT;
4574 4578 DTRACE_TCP6(state__change, void, NULL,
4575 4579 ip_xmit_attr_t *, connp->conn_ixa,
4576 4580 void, NULL, tcp_t *, tcp, void, NULL,
4577 4581 int32_t, TCPS_ESTABLISHED);
4578 4582 /* Keepalive? */
4579 4583 break;
4580 4584 case TCPS_FIN_WAIT_1:
4581 4585 if (!tcp->tcp_fin_acked) {
4582 4586 tcp->tcp_state = TCPS_CLOSING;
4583 4587 DTRACE_TCP6(state__change, void, NULL,
4584 4588 ip_xmit_attr_t *, connp->conn_ixa,
4585 4589 void, NULL, tcp_t *, tcp, void,
4586 4590 NULL, int32_t, TCPS_FIN_WAIT_1);
4587 4591 break;
4588 4592 }
4589 4593 /* FALLTHRU */
4590 4594 case TCPS_FIN_WAIT_2:
4591 4595 SET_TIME_WAIT(tcps, tcp, connp);
4592 4596 DTRACE_TCP6(state__change, void, NULL,
4593 4597 ip_xmit_attr_t *, connp->conn_ixa, void,
4594 4598 NULL, tcp_t *, tcp, void, NULL, int32_t,
4595 4599 TCPS_FIN_WAIT_2);
4596 4600 if (seg_len) {
4597 4601 /*
4598 4602 * implies data piggybacked on FIN.
4599 4603 * break to handle data.
4600 4604 */
4601 4605 break;
4602 4606 }
4603 4607 freemsg(mp);
4604 4608 goto ack_check;
4605 4609 }
4606 4610 }
4607 4611 }
4608 4612 if (mp == NULL)
4609 4613 goto xmit_check;
4610 4614 if (seg_len == 0) {
4611 4615 freemsg(mp);
4612 4616 goto xmit_check;
4613 4617 }
4614 4618 if (mp->b_rptr == mp->b_wptr) {
4615 4619 /*
4616 4620 * The header has been consumed, so we remove the
4617 4621 * zero-length mblk here.
4618 4622 */
4619 4623 mp1 = mp;
4620 4624 mp = mp->b_cont;
4621 4625 freeb(mp1);
4622 4626 }
4623 4627 update_ack:
4624 4628 tcpha = tcp->tcp_tcpha;
4625 4629 tcp->tcp_rack_cnt++;
4626 4630 {
4627 4631 uint32_t cur_max;
4628 4632
4629 4633 cur_max = tcp->tcp_rack_cur_max;
4630 4634 if (tcp->tcp_rack_cnt >= cur_max) {
4631 4635 /*
4632 4636 * We have more unacked data than we should - send
4633 4637 * an ACK now.
4634 4638 */
4635 4639 flags |= TH_ACK_NEEDED;
4636 4640 cur_max++;
4637 4641 if (cur_max > tcp->tcp_rack_abs_max)
4638 4642 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4639 4643 else
4640 4644 tcp->tcp_rack_cur_max = cur_max;
4641 4645 } else if (TCP_IS_DETACHED(tcp)) {
4642 4646 /* We don't have an ACK timer for detached TCP. */
4643 4647 flags |= TH_ACK_NEEDED;
4644 4648 } else if (seg_len < mss) {
4645 4649 /*
4646 4650 * If we get a segment that is less than an mss, and we
4647 4651 * already have unacknowledged data, and the amount
4648 4652 * unacknowledged is not a multiple of mss, then we
4649 4653 * better generate an ACK now. Otherwise, this may be
4650 4654 * the tail piece of a transaction, and we would rather
4651 4655 * wait for the response.
4652 4656 */
4653 4657 uint32_t udif;
4654 4658 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4655 4659 (uintptr_t)INT_MAX);
4656 4660 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4657 4661 if (udif && (udif % mss))
4658 4662 flags |= TH_ACK_NEEDED;
4659 4663 else
4660 4664 flags |= TH_ACK_TIMER_NEEDED;
4661 4665 } else {
4662 4666 /* Start delayed ack timer */
4663 4667 flags |= TH_ACK_TIMER_NEEDED;
4664 4668 }
4665 4669 }
4666 4670 tcp->tcp_rnxt += seg_len;
4667 4671 tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4668 4672
4669 4673 if (mp == NULL)
4670 4674 goto xmit_check;
4671 4675
4672 4676 /* Update SACK list */
4673 4677 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4674 4678 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4675 4679 &(tcp->tcp_num_sack_blk));
4676 4680 }
4677 4681
4678 4682 if (tcp->tcp_urp_mp) {
4679 4683 tcp->tcp_urp_mp->b_cont = mp;
4680 4684 mp = tcp->tcp_urp_mp;
4681 4685 tcp->tcp_urp_mp = NULL;
4682 4686 /* Ready for a new signal. */
4683 4687 tcp->tcp_urp_last_valid = B_FALSE;
4684 4688 #ifdef DEBUG
4685 4689 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4686 4690 "tcp_rput: sending exdata_ind %s",
4687 4691 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4688 4692 #endif /* DEBUG */
4689 4693 }
4690 4694
4691 4695 /*
4692 4696 * Check for ancillary data changes compared to last segment.
4693 4697 */
4694 4698 if (connp->conn_recv_ancillary.crb_all != 0) {
4695 4699 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4696 4700 if (mp == NULL)
4697 4701 return;
4698 4702 }
4699 4703
4700 4704 if (IPCL_IS_NONSTR(connp)) {
4701 4705 /*
4702 4706 * Non-STREAMS socket
4703 4707 */
4704 4708 boolean_t push = flags & (TH_PUSH|TH_FIN);
4705 4709 int error;
4706 4710
4707 4711 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4708 4712 mp, seg_len, 0, &error, &push) <= 0) {
4709 4713 /*
4710 4714 * We should never be in middle of a
4711 4715 * fallback, the squeue guarantees that.
4712 4716 */
4713 4717 ASSERT(error != EOPNOTSUPP);
4714 4718 if (error == ENOSPC)
4715 4719 tcp->tcp_rwnd -= seg_len;
4716 4720 } else if (push) {
4717 4721 /* PUSH bit set and sockfs is not flow controlled */
4718 4722 flags |= tcp_rwnd_reopen(tcp);
4719 4723 }
4720 4724 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4721 4725 /*
4722 4726 * Side queue inbound data until the accept happens.
4723 4727 * tcp_accept/tcp_rput drains this when the accept happens.
4724 4728 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4725 4729 * T_EXDATA_IND) it is queued on b_next.
4726 4730 * XXX Make urgent data use this. Requires:
4727 4731 * Removing tcp_listener check for TH_URG
4728 4732 * Making M_PCPROTO and MARK messages skip the eager case
4729 4733 */
4730 4734
4731 4735 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4732 4736 } else {
4733 4737 /* Active STREAMS socket */
4734 4738 if (mp->b_datap->db_type != M_DATA ||
4735 4739 (flags & TH_MARKNEXT_NEEDED)) {
4736 4740 if (tcp->tcp_rcv_list != NULL) {
4737 4741 flags |= tcp_rcv_drain(tcp);
4738 4742 }
4739 4743 ASSERT(tcp->tcp_rcv_list == NULL ||
4740 4744 tcp->tcp_fused_sigurg);
4741 4745
4742 4746 if (flags & TH_MARKNEXT_NEEDED) {
4743 4747 #ifdef DEBUG
4744 4748 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4745 4749 "tcp_rput: sending MSGMARKNEXT %s",
4746 4750 tcp_display(tcp, NULL,
4747 4751 DISP_PORT_ONLY));
4748 4752 #endif /* DEBUG */
4749 4753 mp->b_flag |= MSGMARKNEXT;
4750 4754 flags &= ~TH_MARKNEXT_NEEDED;
4751 4755 }
4752 4756
4753 4757 if (is_system_labeled())
4754 4758 tcp_setcred_data(mp, ira);
4755 4759
4756 4760 putnext(connp->conn_rq, mp);
4757 4761 if (!canputnext(connp->conn_rq))
4758 4762 tcp->tcp_rwnd -= seg_len;
4759 4763 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4760 4764 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4761 4765 if (tcp->tcp_rcv_list != NULL) {
4762 4766 /*
4763 4767 * Enqueue the new segment first and then
4764 4768 * call tcp_rcv_drain() to send all data
4765 4769 * up. The other way to do this is to
4766 4770 * send all queued data up and then call
4767 4771 * putnext() to send the new segment up.
4768 4772 * This way can remove the else part later
4769 4773 * on.
4770 4774 *
4771 4775 * We don't do this to avoid one more call to
4772 4776 * canputnext() as tcp_rcv_drain() needs to
4773 4777 * call canputnext().
4774 4778 */
4775 4779 tcp_rcv_enqueue(tcp, mp, seg_len,
4776 4780 ira->ira_cred);
4777 4781 flags |= tcp_rcv_drain(tcp);
4778 4782 } else {
4779 4783 if (is_system_labeled())
4780 4784 tcp_setcred_data(mp, ira);
4781 4785
4782 4786 putnext(connp->conn_rq, mp);
4783 4787 if (!canputnext(connp->conn_rq))
4784 4788 tcp->tcp_rwnd -= seg_len;
4785 4789 }
4786 4790 } else {
4787 4791 /*
4788 4792 * Enqueue all packets when processing an mblk
4789 4793 * from the co queue and also enqueue normal packets.
4790 4794 */
4791 4795 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4792 4796 }
4793 4797 /*
4794 4798 * Make sure the timer is running if we have data waiting
4795 4799 * for a push bit. This provides resiliency against
4796 4800 * implementations that do not correctly generate push bits.
4797 4801 */
4798 4802 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4799 4803 /*
4800 4804 * The connection may be closed at this point, so don't
4801 4805 * do anything for a detached tcp.
4802 4806 */
4803 4807 if (!TCP_IS_DETACHED(tcp))
4804 4808 tcp->tcp_push_tid = TCP_TIMER(tcp,
4805 4809 tcp_push_timer,
4806 4810 tcps->tcps_push_timer_interval);
4807 4811 }
4808 4812 }
4809 4813
4810 4814 xmit_check:
4811 4815 /* Is there anything left to do? */
4812 4816 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4813 4817 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4814 4818 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4815 4819 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4816 4820 goto done;
4817 4821
4818 4822 /* Any transmit work to do and a non-zero window? */
4819 4823 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4820 4824 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4821 4825 if (flags & TH_REXMIT_NEEDED) {
4822 4826 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4823 4827
4824 4828 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4825 4829 if (snd_size > mss)
4826 4830 snd_size = mss;
4827 4831 if (snd_size > tcp->tcp_swnd)
4828 4832 snd_size = tcp->tcp_swnd;
4829 4833 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
|
↓ open down ↓ |
670 lines elided |
↑ open up ↑ |
4830 4834 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4831 4835 B_TRUE);
4832 4836
4833 4837 if (mp1 != NULL) {
4834 4838 tcp->tcp_xmit_head->b_prev =
4835 4839 (mblk_t *)(intptr_t)gethrtime();
4836 4840 tcp->tcp_csuna = tcp->tcp_snxt;
4837 4841 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4838 4842 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4839 4843 snd_size);
4844 + tcp->tcp_cs.tcp_out_retrans_segs++;
4845 + tcp->tcp_cs.tcp_out_retrans_bytes += snd_size;
4840 4846 tcp_send_data(tcp, mp1);
4841 4847 }
4842 4848 }
4843 4849 if (flags & TH_NEED_SACK_REXMIT) {
4844 4850 tcp_sack_rexmit(tcp, &flags);
4845 4851 }
4846 4852 /*
4847 4853 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4848 4854 * out new segment. Note that tcp_rexmit should not be
4849 4855 * set, otherwise TH_LIMIT_XMIT should not be set.
4850 4856 */
4851 4857 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4852 4858 if (!tcp->tcp_rexmit) {
4853 4859 tcp_wput_data(tcp, NULL, B_FALSE);
4854 4860 } else {
4855 4861 tcp_ss_rexmit(tcp);
4856 4862 }
4857 4863 }
4858 4864 /*
4859 4865 * Adjust tcp_cwnd back to normal value after sending
4860 4866 * new data segments.
4861 4867 */
4862 4868 if (flags & TH_LIMIT_XMIT) {
4863 4869 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4864 4870 /*
4865 4871 * This will restart the timer. Restarting the
4866 4872 * timer is used to avoid a timeout before the
4867 4873 * limited transmitted segment's ACK gets back.
4868 4874 */
4869 4875 if (tcp->tcp_xmit_head != NULL) {
4870 4876 tcp->tcp_xmit_head->b_prev =
4871 4877 (mblk_t *)(intptr_t)gethrtime();
4872 4878 }
4873 4879 }
4874 4880
4875 4881 /* Anything more to do? */
4876 4882 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4877 4883 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4878 4884 goto done;
4879 4885 }
4880 4886 ack_check:
4881 4887 if (flags & TH_SEND_URP_MARK) {
4882 4888 ASSERT(tcp->tcp_urp_mark_mp);
4883 4889 ASSERT(!IPCL_IS_NONSTR(connp));
4884 4890 /*
4885 4891 * Send up any queued data and then send the mark message
4886 4892 */
4887 4893 if (tcp->tcp_rcv_list != NULL) {
4888 4894 flags |= tcp_rcv_drain(tcp);
4889 4895
4890 4896 }
4891 4897 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4892 4898 mp1 = tcp->tcp_urp_mark_mp;
4893 4899 tcp->tcp_urp_mark_mp = NULL;
4894 4900 if (is_system_labeled())
4895 4901 tcp_setcred_data(mp1, ira);
4896 4902
4897 4903 putnext(connp->conn_rq, mp1);
4898 4904 #ifdef DEBUG
4899 4905 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4900 4906 "tcp_rput: sending zero-length %s %s",
4901 4907 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4902 4908 "MSGNOTMARKNEXT"),
4903 4909 tcp_display(tcp, NULL, DISP_PORT_ONLY));
4904 4910 #endif /* DEBUG */
|
↓ open down ↓ |
55 lines elided |
↑ open up ↑ |
4905 4911 flags &= ~TH_SEND_URP_MARK;
4906 4912 }
4907 4913 if (flags & TH_ACK_NEEDED) {
4908 4914 /*
4909 4915 * Time to send an ack for some reason.
4910 4916 */
4911 4917 mp1 = tcp_ack_mp(tcp);
4912 4918
4913 4919 if (mp1 != NULL) {
4914 4920 tcp_send_data(tcp, mp1);
4915 - BUMP_LOCAL(tcp->tcp_obsegs);
4921 + TCPS_BUMP_MIB(tcps, tcpHCOutSegs);
4916 4922 TCPS_BUMP_MIB(tcps, tcpOutAck);
4917 4923 }
4918 4924 if (tcp->tcp_ack_tid != 0) {
4919 4925 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4920 4926 tcp->tcp_ack_tid = 0;
4921 4927 }
4922 4928 }
4923 4929 if (flags & TH_ACK_TIMER_NEEDED) {
4924 4930 /*
4925 4931 * Arrange for deferred ACK or push wait timeout.
4926 4932 * Start timer if it is not already running.
4927 4933 */
4928 4934 if (tcp->tcp_ack_tid == 0) {
4929 4935 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4930 4936 tcp->tcp_localnet ?
4931 4937 tcps->tcps_local_dack_interval :
4932 4938 tcps->tcps_deferred_ack_interval);
4933 4939 }
4934 4940 }
4935 4941 if (flags & TH_ORDREL_NEEDED) {
4936 4942 /*
4937 4943 * Notify upper layer about an orderly release. If this is
4938 4944 * a non-STREAMS socket, then just make an upcall. For STREAMS
4939 4945 * we send up an ordrel_ind, unless this is an eager, in which
4940 4946 * case the ordrel will be sent when tcp_accept_finish runs.
4941 4947 * Note that for non-STREAMS we make an upcall even if it is an
4942 4948 * eager, because we have an upper handle to send it to.
4943 4949 */
4944 4950 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4945 4951 ASSERT(!tcp->tcp_detached);
4946 4952
4947 4953 if (IPCL_IS_NONSTR(connp)) {
4948 4954 ASSERT(tcp->tcp_ordrel_mp == NULL);
4949 4955 tcp->tcp_ordrel_done = B_TRUE;
4950 4956 (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4951 4957 SOCK_OPCTL_SHUT_RECV, 0);
4952 4958 goto done;
4953 4959 }
4954 4960
4955 4961 if (tcp->tcp_rcv_list != NULL) {
4956 4962 /*
4957 4963 * Push any mblk(s) enqueued from co processing.
4958 4964 */
4959 4965 flags |= tcp_rcv_drain(tcp);
4960 4966 }
4961 4967 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4962 4968
4963 4969 mp1 = tcp->tcp_ordrel_mp;
4964 4970 tcp->tcp_ordrel_mp = NULL;
4965 4971 tcp->tcp_ordrel_done = B_TRUE;
4966 4972 putnext(connp->conn_rq, mp1);
4967 4973 }
4968 4974 done:
4969 4975 ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4970 4976 }
4971 4977
4972 4978 /*
4973 4979 * Attach ancillary data to a received TCP segments for the
4974 4980 * ancillary pieces requested by the application that are
4975 4981 * different than they were in the previous data segment.
4976 4982 *
4977 4983 * Save the "current" values once memory allocation is ok so that
4978 4984 * when memory allocation fails we can just wait for the next data segment.
4979 4985 */
4980 4986 static mblk_t *
4981 4987 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
4982 4988 ip_recv_attr_t *ira)
4983 4989 {
4984 4990 struct T_optdata_ind *todi;
4985 4991 int optlen;
4986 4992 uchar_t *optptr;
4987 4993 struct T_opthdr *toh;
4988 4994 crb_t addflag; /* Which pieces to add */
4989 4995 mblk_t *mp1;
4990 4996 conn_t *connp = tcp->tcp_connp;
4991 4997
4992 4998 optlen = 0;
4993 4999 addflag.crb_all = 0;
4994 5000 /* If app asked for pktinfo and the index has changed ... */
4995 5001 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
4996 5002 ira->ira_ruifindex != tcp->tcp_recvifindex) {
4997 5003 optlen += sizeof (struct T_opthdr) +
4998 5004 sizeof (struct in6_pktinfo);
4999 5005 addflag.crb_ip_recvpktinfo = 1;
5000 5006 }
5001 5007 /* If app asked for hoplimit and it has changed ... */
5002 5008 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5003 5009 ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5004 5010 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5005 5011 addflag.crb_ipv6_recvhoplimit = 1;
5006 5012 }
5007 5013 /* If app asked for tclass and it has changed ... */
5008 5014 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5009 5015 ipp->ipp_tclass != tcp->tcp_recvtclass) {
5010 5016 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5011 5017 addflag.crb_ipv6_recvtclass = 1;
5012 5018 }
5013 5019 /*
5014 5020 * If app asked for hopbyhop headers and it has changed ...
5015 5021 * For security labels, note that (1) security labels can't change on
5016 5022 * a connected socket at all, (2) we're connected to at most one peer,
5017 5023 * (3) if anything changes, then it must be some other extra option.
5018 5024 */
5019 5025 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5020 5026 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5021 5027 (ipp->ipp_fields & IPPF_HOPOPTS),
5022 5028 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5023 5029 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5024 5030 addflag.crb_ipv6_recvhopopts = 1;
5025 5031 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5026 5032 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5027 5033 ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5028 5034 return (mp);
5029 5035 }
5030 5036 /* If app asked for dst headers before routing headers ... */
5031 5037 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5032 5038 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5033 5039 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5034 5040 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5035 5041 optlen += sizeof (struct T_opthdr) +
5036 5042 ipp->ipp_rthdrdstoptslen;
5037 5043 addflag.crb_ipv6_recvrthdrdstopts = 1;
5038 5044 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5039 5045 &tcp->tcp_rthdrdstoptslen,
5040 5046 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5041 5047 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5042 5048 return (mp);
5043 5049 }
5044 5050 /* If app asked for routing headers and it has changed ... */
5045 5051 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5046 5052 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5047 5053 (ipp->ipp_fields & IPPF_RTHDR),
5048 5054 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5049 5055 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5050 5056 addflag.crb_ipv6_recvrthdr = 1;
5051 5057 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5052 5058 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5053 5059 ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5054 5060 return (mp);
5055 5061 }
5056 5062 /* If app asked for dest headers and it has changed ... */
5057 5063 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5058 5064 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5059 5065 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5060 5066 (ipp->ipp_fields & IPPF_DSTOPTS),
5061 5067 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5062 5068 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5063 5069 addflag.crb_ipv6_recvdstopts = 1;
5064 5070 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5065 5071 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5066 5072 ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5067 5073 return (mp);
5068 5074 }
5069 5075
5070 5076 if (optlen == 0) {
5071 5077 /* Nothing to add */
5072 5078 return (mp);
5073 5079 }
5074 5080 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5075 5081 if (mp1 == NULL) {
5076 5082 /*
5077 5083 * Defer sending ancillary data until the next TCP segment
5078 5084 * arrives.
5079 5085 */
5080 5086 return (mp);
5081 5087 }
5082 5088 mp1->b_cont = mp;
5083 5089 mp = mp1;
5084 5090 mp->b_wptr += sizeof (*todi) + optlen;
5085 5091 mp->b_datap->db_type = M_PROTO;
5086 5092 todi = (struct T_optdata_ind *)mp->b_rptr;
5087 5093 todi->PRIM_type = T_OPTDATA_IND;
5088 5094 todi->DATA_flag = 1; /* MORE data */
5089 5095 todi->OPT_length = optlen;
5090 5096 todi->OPT_offset = sizeof (*todi);
5091 5097 optptr = (uchar_t *)&todi[1];
5092 5098 /*
5093 5099 * If app asked for pktinfo and the index has changed ...
5094 5100 * Note that the local address never changes for the connection.
5095 5101 */
5096 5102 if (addflag.crb_ip_recvpktinfo) {
5097 5103 struct in6_pktinfo *pkti;
5098 5104 uint_t ifindex;
5099 5105
5100 5106 ifindex = ira->ira_ruifindex;
5101 5107 toh = (struct T_opthdr *)optptr;
5102 5108 toh->level = IPPROTO_IPV6;
5103 5109 toh->name = IPV6_PKTINFO;
5104 5110 toh->len = sizeof (*toh) + sizeof (*pkti);
5105 5111 toh->status = 0;
5106 5112 optptr += sizeof (*toh);
5107 5113 pkti = (struct in6_pktinfo *)optptr;
5108 5114 pkti->ipi6_addr = connp->conn_laddr_v6;
5109 5115 pkti->ipi6_ifindex = ifindex;
5110 5116 optptr += sizeof (*pkti);
5111 5117 ASSERT(OK_32PTR(optptr));
5112 5118 /* Save as "last" value */
5113 5119 tcp->tcp_recvifindex = ifindex;
5114 5120 }
5115 5121 /* If app asked for hoplimit and it has changed ... */
5116 5122 if (addflag.crb_ipv6_recvhoplimit) {
5117 5123 toh = (struct T_opthdr *)optptr;
5118 5124 toh->level = IPPROTO_IPV6;
5119 5125 toh->name = IPV6_HOPLIMIT;
5120 5126 toh->len = sizeof (*toh) + sizeof (uint_t);
5121 5127 toh->status = 0;
5122 5128 optptr += sizeof (*toh);
5123 5129 *(uint_t *)optptr = ipp->ipp_hoplimit;
5124 5130 optptr += sizeof (uint_t);
5125 5131 ASSERT(OK_32PTR(optptr));
5126 5132 /* Save as "last" value */
5127 5133 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5128 5134 }
5129 5135 /* If app asked for tclass and it has changed ... */
5130 5136 if (addflag.crb_ipv6_recvtclass) {
5131 5137 toh = (struct T_opthdr *)optptr;
5132 5138 toh->level = IPPROTO_IPV6;
5133 5139 toh->name = IPV6_TCLASS;
5134 5140 toh->len = sizeof (*toh) + sizeof (uint_t);
5135 5141 toh->status = 0;
5136 5142 optptr += sizeof (*toh);
5137 5143 *(uint_t *)optptr = ipp->ipp_tclass;
5138 5144 optptr += sizeof (uint_t);
5139 5145 ASSERT(OK_32PTR(optptr));
5140 5146 /* Save as "last" value */
5141 5147 tcp->tcp_recvtclass = ipp->ipp_tclass;
5142 5148 }
5143 5149 if (addflag.crb_ipv6_recvhopopts) {
5144 5150 toh = (struct T_opthdr *)optptr;
5145 5151 toh->level = IPPROTO_IPV6;
5146 5152 toh->name = IPV6_HOPOPTS;
5147 5153 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5148 5154 toh->status = 0;
5149 5155 optptr += sizeof (*toh);
5150 5156 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5151 5157 optptr += ipp->ipp_hopoptslen;
5152 5158 ASSERT(OK_32PTR(optptr));
5153 5159 /* Save as last value */
5154 5160 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5155 5161 (ipp->ipp_fields & IPPF_HOPOPTS),
5156 5162 ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5157 5163 }
5158 5164 if (addflag.crb_ipv6_recvrthdrdstopts) {
5159 5165 toh = (struct T_opthdr *)optptr;
5160 5166 toh->level = IPPROTO_IPV6;
5161 5167 toh->name = IPV6_RTHDRDSTOPTS;
5162 5168 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5163 5169 toh->status = 0;
5164 5170 optptr += sizeof (*toh);
5165 5171 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5166 5172 optptr += ipp->ipp_rthdrdstoptslen;
5167 5173 ASSERT(OK_32PTR(optptr));
5168 5174 /* Save as last value */
5169 5175 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5170 5176 &tcp->tcp_rthdrdstoptslen,
5171 5177 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5172 5178 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5173 5179 }
5174 5180 if (addflag.crb_ipv6_recvrthdr) {
5175 5181 toh = (struct T_opthdr *)optptr;
5176 5182 toh->level = IPPROTO_IPV6;
5177 5183 toh->name = IPV6_RTHDR;
5178 5184 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5179 5185 toh->status = 0;
5180 5186 optptr += sizeof (*toh);
5181 5187 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5182 5188 optptr += ipp->ipp_rthdrlen;
5183 5189 ASSERT(OK_32PTR(optptr));
5184 5190 /* Save as last value */
5185 5191 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5186 5192 (ipp->ipp_fields & IPPF_RTHDR),
5187 5193 ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5188 5194 }
5189 5195 if (addflag.crb_ipv6_recvdstopts) {
5190 5196 toh = (struct T_opthdr *)optptr;
5191 5197 toh->level = IPPROTO_IPV6;
5192 5198 toh->name = IPV6_DSTOPTS;
5193 5199 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5194 5200 toh->status = 0;
5195 5201 optptr += sizeof (*toh);
5196 5202 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5197 5203 optptr += ipp->ipp_dstoptslen;
5198 5204 ASSERT(OK_32PTR(optptr));
5199 5205 /* Save as last value */
5200 5206 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5201 5207 (ipp->ipp_fields & IPPF_DSTOPTS),
5202 5208 ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5203 5209 }
5204 5210 ASSERT(optptr == mp->b_wptr);
5205 5211 return (mp);
5206 5212 }
5207 5213
5208 5214 /* The minimum of smoothed mean deviation in RTO calculation (nsec). */
5209 5215 #define TCP_SD_MIN 400000000
5210 5216
5211 5217 /*
5212 5218 * Set RTO for this connection based on a new round-trip time measurement.
5213 5219 * The formula is from Jacobson and Karels' "Congestion Avoidance and Control"
5214 5220 * in SIGCOMM '88. The variable names are the same as those in Appendix A.2
5215 5221 * of that paper.
5216 5222 *
5217 5223 * m = new measurement
5218 5224 * sa = smoothed RTT average (8 * average estimates).
5219 5225 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5220 5226 */
|
↓ open down ↓ |
295 lines elided |
↑ open up ↑ |
5221 5227 static void
5222 5228 tcp_set_rto(tcp_t *tcp, hrtime_t rtt)
5223 5229 {
5224 5230 hrtime_t m = rtt;
5225 5231 hrtime_t sa = tcp->tcp_rtt_sa;
5226 5232 hrtime_t sv = tcp->tcp_rtt_sd;
5227 5233 tcp_stack_t *tcps = tcp->tcp_tcps;
5228 5234
5229 5235 TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5230 5236 tcp->tcp_rtt_update++;
5237 + tcp->tcp_rtt_sum += m;
5238 + tcp->tcp_rtt_cnt++;
5231 5239
5232 5240 /* tcp_rtt_sa is not 0 means this is a new sample. */
5233 5241 if (sa != 0) {
5234 5242 /*
5235 5243 * Update average estimator (see section 2.3 of RFC6298):
5236 5244 * SRTT = 7/8 SRTT + 1/8 rtt
5237 5245 *
5238 5246 * We maintain tcp_rtt_sa as 8 * SRTT, so this reduces to:
5239 5247 * tcp_rtt_sa = 7 * SRTT + rtt
5240 5248 * tcp_rtt_sa = 7 * (tcp_rtt_sa / 8) + rtt
5241 5249 * tcp_rtt_sa = tcp_rtt_sa - (tcp_rtt_sa / 8) + rtt
5242 5250 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 8))
5243 5251 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 2^3))
5244 5252 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa >> 3))
5245 5253 *
5246 5254 * (rtt - tcp_rtt_sa / 8) is simply the difference
5247 5255 * between the new rtt measurement and the existing smoothed
5248 5256 * RTT average. This is referred to as "Error" in subsequent
5249 5257 * calculations.
5250 5258 */
5251 5259
5252 5260 /* m is now Error. */
5253 5261 m -= sa >> 3;
5254 5262 if ((sa += m) <= 0) {
5255 5263 /*
5256 5264 * Don't allow the smoothed average to be negative.
5257 5265 * We use 0 to denote reinitialization of the
5258 5266 * variables.
5259 5267 */
5260 5268 sa = 1;
5261 5269 }
5262 5270
5263 5271 /*
5264 5272 * Update deviation estimator:
5265 5273 * mdev = 3/4 mdev + 1/4 abs(Error)
5266 5274 *
5267 5275 * We maintain tcp_rtt_sd as 4 * mdev, so this reduces to:
5268 5276 * tcp_rtt_sd = 3 * mdev + abs(Error)
5269 5277 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 4) + abs(Error)
5270 5278 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 2^2) + abs(Error)
5271 5279 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd >> 2) + abs(Error)
5272 5280 */
5273 5281 if (m < 0)
5274 5282 m = -m;
5275 5283 m -= sv >> 2;
5276 5284 sv += m;
5277 5285 } else {
5278 5286 /*
5279 5287 * This follows BSD's implementation. So the reinitialized
5280 5288 * RTO is 3 * m. We cannot go less than 2 because if the
5281 5289 * link is bandwidth dominated, doubling the window size
5282 5290 * during slow start means doubling the RTT. We want to be
5283 5291 * more conservative when we reinitialize our estimates. 3
5284 5292 * is just a convenient number.
5285 5293 */
5286 5294 sa = m << 3;
5287 5295 sv = m << 1;
5288 5296 }
5289 5297 if (sv < TCP_SD_MIN) {
5290 5298 /*
5291 5299 * Since a receiver doesn't delay its ACKs during a long run of
5292 5300 * segments, sa may not have captured the effect of delayed ACK
5293 5301 * timeouts on the RTT. To make sure we always account for the
5294 5302 * possible delay (and avoid the unnecessary retransmission),
5295 5303 * TCP_SD_MIN is set to 400ms, twice the delayed ACK timeout of
5296 5304 * 200ms on older SunOS/BSD systems and modern Windows systems
5297 5305 * (as of 2019). This means that the minimum possible mean
5298 5306 * deviation is 100 ms.
5299 5307 */
5300 5308 sv = TCP_SD_MIN;
5301 5309 }
5302 5310 tcp->tcp_rtt_sa = sa;
5303 5311 tcp->tcp_rtt_sd = sv;
5304 5312
5305 5313 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0);
5306 5314
5307 5315 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5308 5316 tcp->tcp_timer_backoff = 0;
5309 5317 }
5310 5318
5311 5319 /*
5312 5320 * On a labeled system we have some protocols above TCP, such as RPC, which
5313 5321 * appear to assume that every mblk in a chain has a db_credp.
5314 5322 */
5315 5323 static void
5316 5324 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5317 5325 {
5318 5326 ASSERT(is_system_labeled());
5319 5327 ASSERT(ira->ira_cred != NULL);
5320 5328
5321 5329 while (mp != NULL) {
5322 5330 mblk_setcred(mp, ira->ira_cred, NOPID);
5323 5331 mp = mp->b_cont;
5324 5332 }
5325 5333 }
5326 5334
5327 5335 uint_t
5328 5336 tcp_rwnd_reopen(tcp_t *tcp)
5329 5337 {
5330 5338 uint_t ret = 0;
5331 5339 uint_t thwin;
5332 5340 conn_t *connp = tcp->tcp_connp;
5333 5341
5334 5342 /* Learn the latest rwnd information that we sent to the other side. */
5335 5343 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5336 5344 << tcp->tcp_rcv_ws;
5337 5345 /* This is peer's calculated send window (our receive window). */
5338 5346 thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5339 5347 /*
5340 5348 * Increase the receive window to max. But we need to do receiver
5341 5349 * SWS avoidance. This means that we need to check the increase of
5342 5350 * of receive window is at least 1 MSS.
5343 5351 */
5344 5352 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5345 5353 /*
5346 5354 * If the window that the other side knows is less than max
5347 5355 * deferred acks segments, send an update immediately.
5348 5356 */
5349 5357 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5350 5358 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5351 5359 ret = TH_ACK_NEEDED;
5352 5360 }
5353 5361 tcp->tcp_rwnd = connp->conn_rcvbuf;
5354 5362 }
5355 5363 return (ret);
5356 5364 }
5357 5365
5358 5366 /*
5359 5367 * Handle a packet that has been reclassified by TCP.
5360 5368 * This function drops the ref on connp that the caller had.
5361 5369 */
5362 5370 void
5363 5371 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5364 5372 {
5365 5373 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec;
5366 5374
5367 5375 if (connp->conn_incoming_ifindex != 0 &&
5368 5376 connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5369 5377 freemsg(mp);
5370 5378 CONN_DEC_REF(connp);
5371 5379 return;
5372 5380 }
5373 5381
5374 5382 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5375 5383 (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5376 5384 ip6_t *ip6h;
5377 5385 ipha_t *ipha;
5378 5386
5379 5387 if (ira->ira_flags & IRAF_IS_IPV4) {
5380 5388 ipha = (ipha_t *)mp->b_rptr;
5381 5389 ip6h = NULL;
5382 5390 } else {
5383 5391 ipha = NULL;
5384 5392 ip6h = (ip6_t *)mp->b_rptr;
5385 5393 }
5386 5394 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5387 5395 if (mp == NULL) {
5388 5396 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5389 5397 /* Note that mp is NULL */
5390 5398 ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5391 5399 CONN_DEC_REF(connp);
5392 5400 return;
5393 5401 }
5394 5402 }
5395 5403
5396 5404 if (IPCL_IS_TCP(connp)) {
5397 5405 /*
5398 5406 * do not drain, certain use cases can blow
5399 5407 * the stack
5400 5408 */
5401 5409 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5402 5410 connp->conn_recv, connp, ira,
5403 5411 SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5404 5412 } else {
5405 5413 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5406 5414 (connp->conn_recv)(connp, mp, NULL,
5407 5415 ira);
5408 5416 CONN_DEC_REF(connp);
5409 5417 }
5410 5418
5411 5419 }
5412 5420
5413 5421 /* ARGSUSED */
5414 5422 static void
5415 5423 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5416 5424 {
5417 5425 conn_t *connp = (conn_t *)arg;
5418 5426 tcp_t *tcp = connp->conn_tcp;
5419 5427 queue_t *q = connp->conn_rq;
5420 5428
5421 5429 ASSERT(!IPCL_IS_NONSTR(connp));
5422 5430 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5423 5431 tcp->tcp_rsrv_mp = mp;
5424 5432 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5425 5433
5426 5434 if (TCP_IS_DETACHED(tcp) || q == NULL) {
5427 5435 return;
5428 5436 }
5429 5437
5430 5438 if (tcp->tcp_fused) {
5431 5439 tcp_fuse_backenable(tcp);
5432 5440 return;
5433 5441 }
5434 5442
5435 5443 if (canputnext(q)) {
5436 5444 /* Not flow-controlled, open rwnd */
5437 5445 tcp->tcp_rwnd = connp->conn_rcvbuf;
5438 5446
5439 5447 /*
5440 5448 * Send back a window update immediately if TCP is above
5441 5449 * ESTABLISHED state and the increase of the rcv window
5442 5450 * that the other side knows is at least 1 MSS after flow
5443 5451 * control is lifted.
5444 5452 */
5445 5453 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5446 5454 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5447 5455 tcp_xmit_ctl(NULL, tcp,
5448 5456 (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5449 5457 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5450 5458 }
5451 5459 }
5452 5460 }
5453 5461
5454 5462 /*
5455 5463 * The read side service routine is called mostly when we get back-enabled as a
5456 5464 * result of flow control relief. Since we don't actually queue anything in
5457 5465 * TCP, we have no data to send out of here. What we do is clear the receive
5458 5466 * window, and send out a window update.
5459 5467 */
5460 5468 int
5461 5469 tcp_rsrv(queue_t *q)
5462 5470 {
5463 5471 conn_t *connp = Q_TO_CONN(q);
5464 5472 tcp_t *tcp = connp->conn_tcp;
5465 5473 mblk_t *mp;
5466 5474
5467 5475 /* No code does a putq on the read side */
5468 5476 ASSERT(q->q_first == NULL);
5469 5477
5470 5478 /*
5471 5479 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5472 5480 * been run. So just return.
5473 5481 */
5474 5482 mutex_enter(&tcp->tcp_rsrv_mp_lock);
5475 5483 if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5476 5484 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5477 5485 return (0);
5478 5486 }
5479 5487 tcp->tcp_rsrv_mp = NULL;
5480 5488 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5481 5489
5482 5490 CONN_INC_REF(connp);
5483 5491 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5484 5492 NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5485 5493 return (0);
5486 5494 }
5487 5495
5488 5496 /* At minimum we need 8 bytes in the TCP header for the lookup */
5489 5497 #define ICMP_MIN_TCP_HDR 8
5490 5498
5491 5499 /*
5492 5500 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5493 5501 * passed up by IP. The message is always received on the correct tcp_t.
5494 5502 * Assumes that IP has pulled up everything up to and including the ICMP header.
5495 5503 */
5496 5504 /* ARGSUSED2 */
5497 5505 void
5498 5506 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5499 5507 {
5500 5508 conn_t *connp = (conn_t *)arg1;
5501 5509 icmph_t *icmph;
5502 5510 ipha_t *ipha;
5503 5511 int iph_hdr_length;
5504 5512 tcpha_t *tcpha;
5505 5513 uint32_t seg_seq;
5506 5514 tcp_t *tcp = connp->conn_tcp;
5507 5515
5508 5516 /* Assume IP provides aligned packets */
5509 5517 ASSERT(OK_32PTR(mp->b_rptr));
5510 5518 ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5511 5519
5512 5520 /*
5513 5521 * It's possible we have a closed, but not yet destroyed, TCP
5514 5522 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5515 5523 * in the closed state, so don't take any chances and drop the packet.
5516 5524 */
5517 5525 if (tcp->tcp_state == TCPS_CLOSED) {
5518 5526 freemsg(mp);
5519 5527 return;
5520 5528 }
5521 5529
5522 5530 /*
5523 5531 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5524 5532 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5525 5533 */
5526 5534 if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5527 5535 tcp_icmp_error_ipv6(tcp, mp, ira);
5528 5536 return;
5529 5537 }
5530 5538
5531 5539 /* Skip past the outer IP and ICMP headers */
5532 5540 iph_hdr_length = ira->ira_ip_hdr_length;
5533 5541 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5534 5542 /*
5535 5543 * If we don't have the correct outer IP header length
5536 5544 * or if we don't have a complete inner IP header
5537 5545 * drop it.
5538 5546 */
5539 5547 if (iph_hdr_length < sizeof (ipha_t) ||
5540 5548 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5541 5549 noticmpv4:
5542 5550 freemsg(mp);
5543 5551 return;
5544 5552 }
5545 5553 ipha = (ipha_t *)&icmph[1];
5546 5554
5547 5555 /* Skip past the inner IP and find the ULP header */
5548 5556 iph_hdr_length = IPH_HDR_LENGTH(ipha);
5549 5557 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5550 5558 /*
5551 5559 * If we don't have the correct inner IP header length or if the ULP
5552 5560 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5553 5561 * bytes of TCP header, drop it.
5554 5562 */
5555 5563 if (iph_hdr_length < sizeof (ipha_t) ||
5556 5564 ipha->ipha_protocol != IPPROTO_TCP ||
5557 5565 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5558 5566 goto noticmpv4;
5559 5567 }
5560 5568
5561 5569 seg_seq = ntohl(tcpha->tha_seq);
5562 5570 switch (icmph->icmph_type) {
5563 5571 case ICMP_DEST_UNREACHABLE:
5564 5572 switch (icmph->icmph_code) {
5565 5573 case ICMP_FRAGMENTATION_NEEDED:
5566 5574 /*
5567 5575 * Update Path MTU, then try to send something out.
5568 5576 */
5569 5577 tcp_update_pmtu(tcp, B_TRUE);
5570 5578 tcp_rexmit_after_error(tcp);
5571 5579 break;
5572 5580 case ICMP_PORT_UNREACHABLE:
5573 5581 case ICMP_PROTOCOL_UNREACHABLE:
5574 5582 switch (tcp->tcp_state) {
5575 5583 case TCPS_SYN_SENT:
5576 5584 case TCPS_SYN_RCVD:
5577 5585 /*
5578 5586 * ICMP can snipe away incipient
5579 5587 * TCP connections as long as
5580 5588 * seq number is same as initial
5581 5589 * send seq number.
5582 5590 */
5583 5591 if (seg_seq == tcp->tcp_iss) {
5584 5592 (void) tcp_clean_death(tcp,
5585 5593 ECONNREFUSED);
5586 5594 }
5587 5595 break;
5588 5596 }
5589 5597 break;
5590 5598 case ICMP_HOST_UNREACHABLE:
5591 5599 case ICMP_NET_UNREACHABLE:
5592 5600 /* Record the error in case we finally time out. */
5593 5601 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5594 5602 tcp->tcp_client_errno = EHOSTUNREACH;
5595 5603 else
5596 5604 tcp->tcp_client_errno = ENETUNREACH;
5597 5605 if (tcp->tcp_state == TCPS_SYN_RCVD) {
5598 5606 if (tcp->tcp_listener != NULL &&
5599 5607 tcp->tcp_listener->tcp_syn_defense) {
5600 5608 /*
5601 5609 * Ditch the half-open connection if we
5602 5610 * suspect a SYN attack is under way.
5603 5611 */
5604 5612 (void) tcp_clean_death(tcp,
5605 5613 tcp->tcp_client_errno);
5606 5614 }
5607 5615 }
5608 5616 break;
5609 5617 default:
5610 5618 break;
5611 5619 }
5612 5620 break;
5613 5621 case ICMP_SOURCE_QUENCH: {
5614 5622 /*
5615 5623 * use a global boolean to control
5616 5624 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5617 5625 * The default is false.
5618 5626 */
5619 5627 if (tcp_icmp_source_quench) {
5620 5628 /*
5621 5629 * Reduce the sending rate as if we got a
5622 5630 * retransmit timeout
5623 5631 */
5624 5632 uint32_t npkt;
5625 5633
5626 5634 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5627 5635 tcp->tcp_mss;
5628 5636 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5629 5637 tcp->tcp_cwnd = tcp->tcp_mss;
5630 5638 tcp->tcp_cwnd_cnt = 0;
5631 5639 }
5632 5640 break;
5633 5641 }
5634 5642 }
5635 5643 freemsg(mp);
5636 5644 }
5637 5645
5638 5646 /*
5639 5647 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5640 5648 * error messages passed up by IP.
5641 5649 * Assumes that IP has pulled up all the extension headers as well
5642 5650 * as the ICMPv6 header.
5643 5651 */
5644 5652 static void
5645 5653 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5646 5654 {
5647 5655 icmp6_t *icmp6;
5648 5656 ip6_t *ip6h;
5649 5657 uint16_t iph_hdr_length = ira->ira_ip_hdr_length;
5650 5658 tcpha_t *tcpha;
5651 5659 uint8_t *nexthdrp;
5652 5660 uint32_t seg_seq;
5653 5661
5654 5662 /*
5655 5663 * Verify that we have a complete IP header.
5656 5664 */
5657 5665 ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5658 5666
5659 5667 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5660 5668 ip6h = (ip6_t *)&icmp6[1];
5661 5669 /*
5662 5670 * Verify if we have a complete ICMP and inner IP header.
5663 5671 */
5664 5672 if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5665 5673 noticmpv6:
5666 5674 freemsg(mp);
5667 5675 return;
5668 5676 }
5669 5677
5670 5678 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5671 5679 goto noticmpv6;
5672 5680 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5673 5681 /*
5674 5682 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5675 5683 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5676 5684 * packet.
5677 5685 */
5678 5686 if ((*nexthdrp != IPPROTO_TCP) ||
5679 5687 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5680 5688 goto noticmpv6;
5681 5689 }
5682 5690
5683 5691 seg_seq = ntohl(tcpha->tha_seq);
5684 5692 switch (icmp6->icmp6_type) {
5685 5693 case ICMP6_PACKET_TOO_BIG:
5686 5694 /*
5687 5695 * Update Path MTU, then try to send something out.
5688 5696 */
5689 5697 tcp_update_pmtu(tcp, B_TRUE);
5690 5698 tcp_rexmit_after_error(tcp);
5691 5699 break;
5692 5700 case ICMP6_DST_UNREACH:
5693 5701 switch (icmp6->icmp6_code) {
5694 5702 case ICMP6_DST_UNREACH_NOPORT:
5695 5703 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5696 5704 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5697 5705 (seg_seq == tcp->tcp_iss)) {
5698 5706 (void) tcp_clean_death(tcp, ECONNREFUSED);
5699 5707 }
5700 5708 break;
5701 5709 case ICMP6_DST_UNREACH_ADMIN:
5702 5710 case ICMP6_DST_UNREACH_NOROUTE:
5703 5711 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5704 5712 case ICMP6_DST_UNREACH_ADDR:
5705 5713 /* Record the error in case we finally time out. */
5706 5714 tcp->tcp_client_errno = EHOSTUNREACH;
5707 5715 if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5708 5716 (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5709 5717 (seg_seq == tcp->tcp_iss)) {
5710 5718 if (tcp->tcp_listener != NULL &&
5711 5719 tcp->tcp_listener->tcp_syn_defense) {
5712 5720 /*
5713 5721 * Ditch the half-open connection if we
5714 5722 * suspect a SYN attack is under way.
5715 5723 */
5716 5724 (void) tcp_clean_death(tcp,
5717 5725 tcp->tcp_client_errno);
5718 5726 }
5719 5727 }
5720 5728
5721 5729
5722 5730 break;
5723 5731 default:
5724 5732 break;
5725 5733 }
5726 5734 break;
5727 5735 case ICMP6_PARAM_PROB:
5728 5736 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5729 5737 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5730 5738 (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5731 5739 (uchar_t *)nexthdrp) {
5732 5740 if (tcp->tcp_state == TCPS_SYN_SENT ||
5733 5741 tcp->tcp_state == TCPS_SYN_RCVD) {
5734 5742 (void) tcp_clean_death(tcp, ECONNREFUSED);
5735 5743 }
5736 5744 break;
5737 5745 }
5738 5746 break;
5739 5747
5740 5748 case ICMP6_TIME_EXCEEDED:
5741 5749 default:
5742 5750 break;
5743 5751 }
5744 5752 freemsg(mp);
5745 5753 }
5746 5754
5747 5755 /*
5748 5756 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5749 5757 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5750 5758 *
5751 5759 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5752 5760 * error messages received by IP. The message is always received on the correct
5753 5761 * tcp_t.
5754 5762 */
5755 5763 /* ARGSUSED */
5756 5764 boolean_t
5757 5765 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5758 5766 ip_recv_attr_t *ira)
5759 5767 {
5760 5768 tcpha_t *tcpha = (tcpha_t *)arg2;
5761 5769 uint32_t seq = ntohl(tcpha->tha_seq);
5762 5770 tcp_t *tcp = connp->conn_tcp;
5763 5771
5764 5772 /*
5765 5773 * TCP sequence number contained in payload of the ICMP error message
5766 5774 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5767 5775 * the message is either a stale ICMP error, or an attack from the
5768 5776 * network. Fail the verification.
5769 5777 */
5770 5778 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5771 5779 return (B_FALSE);
5772 5780
5773 5781 /* For "too big" we also check the ignore flag */
5774 5782 if (ira->ira_flags & IRAF_IS_IPV4) {
5775 5783 ASSERT(icmph != NULL);
5776 5784 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5777 5785 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5778 5786 tcp->tcp_tcps->tcps_ignore_path_mtu)
5779 5787 return (B_FALSE);
5780 5788 } else {
5781 5789 ASSERT(icmp6 != NULL);
5782 5790 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5783 5791 tcp->tcp_tcps->tcps_ignore_path_mtu)
5784 5792 return (B_FALSE);
5785 5793 }
5786 5794 return (B_TRUE);
5787 5795 }
|
↓ open down ↓ |
547 lines elided |
↑ open up ↑ |
XXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXXX