1 /* 2 * CDDL HEADER START 3 * 4 * The contents of this file are subject to the terms of the 5 * Common Development and Distribution License (the "License"). 6 * You may not use this file except in compliance with the License. 7 * 8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 9 * or http://www.opensolaris.org/os/licensing. 10 * See the License for the specific language governing permissions 11 * and limitations under the License. 12 * 13 * When distributing Covered Code, include this CDDL HEADER in each 14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 15 * If applicable, add the following below this CDDL HEADER, with the 16 * fields enclosed by brackets "[]" replaced with your own identifying 17 * information: Portions Copyright [yyyy] [name of copyright owner] 18 * 19 * CDDL HEADER END 20 */ 21 22 /* 23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved. 24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved. 25 * Copyright 2019 Joyent, Inc. 26 * Copyright (c) 2014, 2016 by Delphix. All rights reserved. 27 */ 28 29 /* This file contains all TCP input processing functions. */ 30 31 #include <sys/types.h> 32 #include <sys/stream.h> 33 #include <sys/strsun.h> 34 #include <sys/strsubr.h> 35 #include <sys/stropts.h> 36 #include <sys/strlog.h> 37 #define _SUN_TPI_VERSION 2 38 #include <sys/tihdr.h> 39 #include <sys/suntpi.h> 40 #include <sys/xti_inet.h> 41 #include <sys/squeue_impl.h> 42 #include <sys/squeue.h> 43 #include <sys/tsol/tnet.h> 44 45 #include <inet/common.h> 46 #include <inet/ip.h> 47 #include <inet/tcp.h> 48 #include <inet/tcp_impl.h> 49 #include <inet/tcp_cluster.h> 50 #include <inet/proto_set.h> 51 #include <inet/ipsec_impl.h> 52 53 /* 54 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing 55 */ 56 57 #ifdef _BIG_ENDIAN 58 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \ 59 (TCPOPT_TSTAMP << 8) | 10) 60 #else 61 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \ 62 (TCPOPT_NOP << 8) | TCPOPT_NOP) 63 #endif 64 65 /* 66 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days 67 */ 68 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz)) 69 70 /* 71 * Since tcp_listener is not cleared atomically with tcp_detached 72 * being cleared we need this extra bit to tell a detached connection 73 * apart from one that is in the process of being accepted. 74 */ 75 #define TCP_IS_DETACHED_NONEAGER(tcp) \ 76 (TCP_IS_DETACHED(tcp) && \ 77 (!(tcp)->tcp_hard_binding)) 78 79 /* 80 * Steps to do when a tcp_t moves to TIME-WAIT state. 81 * 82 * This connection is done, we don't need to account for it. Decrement 83 * the listener connection counter if needed. 84 * 85 * Decrement the connection counter of the stack. Note that this counter 86 * is per CPU. So the total number of connections in a stack is the sum of all 87 * of them. Since there is no lock for handling all of them exclusively, the 88 * resulting sum is only an approximation. 89 * 90 * Unconditionally clear the exclusive binding bit so this TIME-WAIT 91 * connection won't interfere with new ones. 92 * 93 * Start the TIME-WAIT timer. If upper layer has not closed the connection, 94 * the timer is handled within the context of this tcp_t. When the timer 95 * fires, tcp_clean_death() is called. If upper layer closes the connection 96 * during this period, tcp_time_wait_append() will be called to add this 97 * tcp_t to the global TIME-WAIT list. Note that this means that the 98 * actual wait time in TIME-WAIT state will be longer than the 99 * tcps_time_wait_interval since the period before upper layer closes the 100 * connection is not accounted for when tcp_time_wait_append() is called. 101 * 102 * If upper layer has closed the connection, call tcp_time_wait_append() 103 * directly. 104 * 105 */ 106 #define SET_TIME_WAIT(tcps, tcp, connp) \ 107 { \ 108 (tcp)->tcp_state = TCPS_TIME_WAIT; \ 109 if ((tcp)->tcp_listen_cnt != NULL) \ 110 TCP_DECR_LISTEN_CNT(tcp); \ 111 atomic_dec_64( \ 112 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \ 113 (connp)->conn_exclbind = 0; \ 114 if (!TCP_IS_DETACHED(tcp)) { \ 115 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \ 116 } else { \ 117 tcp_time_wait_append(tcp); \ 118 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \ 119 } \ 120 } 121 122 /* 123 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more 124 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent 125 * data, TCP will not respond with an ACK. RFC 793 requires that 126 * TCP responds with an ACK for such a bogus ACK. By not following 127 * the RFC, we prevent TCP from getting into an ACK storm if somehow 128 * an attacker successfully spoofs an acceptable segment to our 129 * peer; or when our peer is "confused." 130 */ 131 static uint32_t tcp_drop_ack_unsent_cnt = 10; 132 133 /* 134 * To protect TCP against attacker using a small window and requesting 135 * large amount of data (DoS attack by conuming memory), TCP checks the 136 * window advertised in the last ACK of the 3-way handshake. TCP uses 137 * the tcp_mss (the size of one packet) value for comparion. The window 138 * should be larger than tcp_mss. But while a sane TCP should advertise 139 * a receive window larger than or equal to 4*MSS to avoid stop and go 140 * tarrfic, not all TCP stacks do that. This is especially true when 141 * tcp_mss is a big value. 142 * 143 * To work around this issue, an additional fixed value for comparison 144 * is also used. If the advertised window is smaller than both tcp_mss 145 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large 146 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but 147 * smaller than 8K is considered to be OK. 148 */ 149 static uint32_t tcp_init_wnd_chk = 4096; 150 151 /* Process ICMP source quench message or not. */ 152 static boolean_t tcp_icmp_source_quench = B_FALSE; 153 154 static boolean_t tcp_outbound_squeue_switch = B_FALSE; 155 156 static mblk_t *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *, 157 ip_recv_attr_t *); 158 static mblk_t *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *, 159 ip_recv_attr_t *); 160 static boolean_t tcp_drop_q0(tcp_t *); 161 static void tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *); 162 static mblk_t *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *, 163 ip_recv_attr_t *); 164 static void tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *); 165 static void tcp_process_options(tcp_t *, tcpha_t *); 166 static mblk_t *tcp_reass(tcp_t *, mblk_t *, uint32_t); 167 static void tcp_reass_elim_overlap(tcp_t *, mblk_t *); 168 static void tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *); 169 static void tcp_set_rto(tcp_t *, hrtime_t); 170 static void tcp_setcred_data(mblk_t *, ip_recv_attr_t *); 171 172 /* 173 * Set the MSS associated with a particular tcp based on its current value, 174 * and a new one passed in. Observe minimums and maximums, and reset other 175 * state variables that we want to view as multiples of MSS. 176 * 177 * The value of MSS could be either increased or descreased. 178 */ 179 void 180 tcp_mss_set(tcp_t *tcp, uint32_t mss) 181 { 182 uint32_t mss_max; 183 tcp_stack_t *tcps = tcp->tcp_tcps; 184 conn_t *connp = tcp->tcp_connp; 185 186 if (connp->conn_ipversion == IPV4_VERSION) 187 mss_max = tcps->tcps_mss_max_ipv4; 188 else 189 mss_max = tcps->tcps_mss_max_ipv6; 190 191 if (mss < tcps->tcps_mss_min) 192 mss = tcps->tcps_mss_min; 193 if (mss > mss_max) 194 mss = mss_max; 195 /* 196 * Unless naglim has been set by our client to 197 * a non-mss value, force naglim to track mss. 198 * This can help to aggregate small writes. 199 */ 200 if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim) 201 tcp->tcp_naglim = mss; 202 /* 203 * TCP should be able to buffer at least 4 MSS data for obvious 204 * performance reason. 205 */ 206 if ((mss << 2) > connp->conn_sndbuf) 207 connp->conn_sndbuf = mss << 2; 208 209 /* 210 * Set the send lowater to at least twice of MSS. 211 */ 212 if ((mss << 1) > connp->conn_sndlowat) 213 connp->conn_sndlowat = mss << 1; 214 215 /* 216 * Update tcp_cwnd according to the new value of MSS. Keep the 217 * previous ratio to preserve the transmit rate. 218 */ 219 tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss; 220 tcp->tcp_cwnd_cnt = 0; 221 222 tcp->tcp_mss = mss; 223 (void) tcp_maxpsz_set(tcp, B_TRUE); 224 } 225 226 /* 227 * Extract option values from a tcp header. We put any found values into the 228 * tcpopt struct and return a bitmask saying which options were found. 229 */ 230 int 231 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt) 232 { 233 uchar_t *endp; 234 int len; 235 uint32_t mss; 236 uchar_t *up = (uchar_t *)tcpha; 237 int found = 0; 238 int32_t sack_len; 239 tcp_seq sack_begin, sack_end; 240 tcp_t *tcp; 241 242 endp = up + TCP_HDR_LENGTH(tcpha); 243 up += TCP_MIN_HEADER_LENGTH; 244 /* 245 * If timestamp option is aligned as recommended in RFC 7323 Appendix 246 * A, and is the only option, return quickly. 247 */ 248 if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH + 249 TCPOPT_REAL_TS_LEN && 250 OK_32PTR(up) && 251 *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) { 252 tcpopt->tcp_opt_ts_val = ABE32_TO_U32((up+4)); 253 tcpopt->tcp_opt_ts_ecr = ABE32_TO_U32((up+8)); 254 255 return (TCP_OPT_TSTAMP_PRESENT); 256 } 257 while (up < endp) { 258 len = endp - up; 259 switch (*up) { 260 case TCPOPT_EOL: 261 break; 262 263 case TCPOPT_NOP: 264 up++; 265 continue; 266 267 case TCPOPT_MAXSEG: 268 if (len < TCPOPT_MAXSEG_LEN || 269 up[1] != TCPOPT_MAXSEG_LEN) 270 break; 271 272 mss = BE16_TO_U16(up+2); 273 /* Caller must handle tcp_mss_min and tcp_mss_max_* */ 274 tcpopt->tcp_opt_mss = mss; 275 found |= TCP_OPT_MSS_PRESENT; 276 277 up += TCPOPT_MAXSEG_LEN; 278 continue; 279 280 case TCPOPT_WSCALE: 281 if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN) 282 break; 283 284 if (up[2] > TCP_MAX_WINSHIFT) 285 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT; 286 else 287 tcpopt->tcp_opt_wscale = up[2]; 288 found |= TCP_OPT_WSCALE_PRESENT; 289 290 up += TCPOPT_WS_LEN; 291 continue; 292 293 case TCPOPT_SACK_PERMITTED: 294 if (len < TCPOPT_SACK_OK_LEN || 295 up[1] != TCPOPT_SACK_OK_LEN) 296 break; 297 found |= TCP_OPT_SACK_OK_PRESENT; 298 up += TCPOPT_SACK_OK_LEN; 299 continue; 300 301 case TCPOPT_SACK: 302 if (len <= 2 || up[1] <= 2 || len < up[1]) 303 break; 304 305 /* If TCP is not interested in SACK blks... */ 306 if ((tcp = tcpopt->tcp) == NULL) { 307 up += up[1]; 308 continue; 309 } 310 sack_len = up[1] - TCPOPT_HEADER_LEN; 311 up += TCPOPT_HEADER_LEN; 312 313 /* 314 * If the list is empty, allocate one and assume 315 * nothing is sack'ed. 316 */ 317 if (tcp->tcp_notsack_list == NULL) { 318 tcp_notsack_update(&(tcp->tcp_notsack_list), 319 tcp->tcp_suna, tcp->tcp_snxt, 320 &(tcp->tcp_num_notsack_blk), 321 &(tcp->tcp_cnt_notsack_list)); 322 323 /* 324 * Make sure tcp_notsack_list is not NULL. 325 * This happens when kmem_alloc(KM_NOSLEEP) 326 * returns NULL. 327 */ 328 if (tcp->tcp_notsack_list == NULL) { 329 up += sack_len; 330 continue; 331 } 332 tcp->tcp_fack = tcp->tcp_suna; 333 } 334 335 while (sack_len > 0) { 336 if (up + 8 > endp) { 337 up = endp; 338 break; 339 } 340 sack_begin = BE32_TO_U32(up); 341 up += 4; 342 sack_end = BE32_TO_U32(up); 343 up += 4; 344 sack_len -= 8; 345 /* 346 * Bounds checking. Make sure the SACK 347 * info is within tcp_suna and tcp_snxt. 348 * If this SACK blk is out of bound, ignore 349 * it but continue to parse the following 350 * blks. 351 */ 352 if (SEQ_LEQ(sack_end, sack_begin) || 353 SEQ_LT(sack_begin, tcp->tcp_suna) || 354 SEQ_GT(sack_end, tcp->tcp_snxt)) { 355 continue; 356 } 357 tcp_notsack_insert(&(tcp->tcp_notsack_list), 358 sack_begin, sack_end, 359 &(tcp->tcp_num_notsack_blk), 360 &(tcp->tcp_cnt_notsack_list)); 361 if (SEQ_GT(sack_end, tcp->tcp_fack)) { 362 tcp->tcp_fack = sack_end; 363 } 364 } 365 found |= TCP_OPT_SACK_PRESENT; 366 continue; 367 368 case TCPOPT_TSTAMP: 369 if (len < TCPOPT_TSTAMP_LEN || 370 up[1] != TCPOPT_TSTAMP_LEN) 371 break; 372 373 tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2); 374 tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6); 375 376 found |= TCP_OPT_TSTAMP_PRESENT; 377 378 up += TCPOPT_TSTAMP_LEN; 379 continue; 380 381 default: 382 if (len <= 1 || len < (int)up[1] || up[1] == 0) 383 break; 384 up += up[1]; 385 continue; 386 } 387 break; 388 } 389 return (found); 390 } 391 392 /* 393 * Process all TCP option in SYN segment. Note that this function should 394 * be called after tcp_set_destination() is called so that the necessary info 395 * from IRE is already set in the tcp structure. 396 * 397 * This function sets up the correct tcp_mss value according to the 398 * MSS option value and our header size. It also sets up the window scale 399 * and timestamp values, and initialize SACK info blocks. But it does not 400 * change receive window size after setting the tcp_mss value. The caller 401 * should do the appropriate change. 402 */ 403 static void 404 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha) 405 { 406 int options; 407 tcp_opt_t tcpopt; 408 uint32_t mss_max; 409 char *tmp_tcph; 410 tcp_stack_t *tcps = tcp->tcp_tcps; 411 conn_t *connp = tcp->tcp_connp; 412 413 tcpopt.tcp = NULL; 414 options = tcp_parse_options(tcpha, &tcpopt); 415 416 /* 417 * Process MSS option. Note that MSS option value does not account 418 * for IP or TCP options. This means that it is equal to MTU - minimum 419 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for 420 * IPv6. 421 */ 422 if (!(options & TCP_OPT_MSS_PRESENT)) { 423 if (connp->conn_ipversion == IPV4_VERSION) 424 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4; 425 else 426 tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6; 427 } else { 428 if (connp->conn_ipversion == IPV4_VERSION) 429 mss_max = tcps->tcps_mss_max_ipv4; 430 else 431 mss_max = tcps->tcps_mss_max_ipv6; 432 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min) 433 tcpopt.tcp_opt_mss = tcps->tcps_mss_min; 434 else if (tcpopt.tcp_opt_mss > mss_max) 435 tcpopt.tcp_opt_mss = mss_max; 436 } 437 438 /* Process Window Scale option. */ 439 if (options & TCP_OPT_WSCALE_PRESENT) { 440 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale; 441 tcp->tcp_snd_ws_ok = B_TRUE; 442 } else { 443 tcp->tcp_snd_ws = B_FALSE; 444 tcp->tcp_snd_ws_ok = B_FALSE; 445 tcp->tcp_rcv_ws = B_FALSE; 446 } 447 448 /* Process Timestamp option. */ 449 if ((options & TCP_OPT_TSTAMP_PRESENT) && 450 (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) { 451 tmp_tcph = (char *)tcp->tcp_tcpha; 452 453 tcp->tcp_snd_ts_ok = B_TRUE; 454 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 455 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 456 ASSERT(OK_32PTR(tmp_tcph)); 457 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH); 458 459 /* Fill in our template header with basic timestamp option. */ 460 tmp_tcph += connp->conn_ht_ulp_len; 461 tmp_tcph[0] = TCPOPT_NOP; 462 tmp_tcph[1] = TCPOPT_NOP; 463 tmp_tcph[2] = TCPOPT_TSTAMP; 464 tmp_tcph[3] = TCPOPT_TSTAMP_LEN; 465 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN; 466 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN; 467 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4); 468 } else { 469 tcp->tcp_snd_ts_ok = B_FALSE; 470 } 471 472 /* 473 * Process SACK options. If SACK is enabled for this connection, 474 * then allocate the SACK info structure. Note the following ways 475 * when tcp_snd_sack_ok is set to true. 476 * 477 * For active connection: in tcp_set_destination() called in 478 * tcp_connect(). 479 * 480 * For passive connection: in tcp_set_destination() called in 481 * tcp_input_listener(). 482 * 483 * That's the reason why the extra TCP_IS_DETACHED() check is there. 484 * That check makes sure that if we did not send a SACK OK option, 485 * we will not enable SACK for this connection even though the other 486 * side sends us SACK OK option. For active connection, the SACK 487 * info structure has already been allocated. So we need to free 488 * it if SACK is disabled. 489 */ 490 if ((options & TCP_OPT_SACK_OK_PRESENT) && 491 (tcp->tcp_snd_sack_ok || 492 (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) { 493 ASSERT(tcp->tcp_num_sack_blk == 0); 494 ASSERT(tcp->tcp_notsack_list == NULL); 495 496 tcp->tcp_snd_sack_ok = B_TRUE; 497 if (tcp->tcp_snd_ts_ok) { 498 tcp->tcp_max_sack_blk = 3; 499 } else { 500 tcp->tcp_max_sack_blk = 4; 501 } 502 } else if (tcp->tcp_snd_sack_ok) { 503 /* 504 * Resetting tcp_snd_sack_ok to B_FALSE so that 505 * no SACK info will be used for this 506 * connection. This assumes that SACK usage 507 * permission is negotiated. This may need 508 * to be changed once this is clarified. 509 */ 510 ASSERT(tcp->tcp_num_sack_blk == 0); 511 ASSERT(tcp->tcp_notsack_list == NULL); 512 tcp->tcp_snd_sack_ok = B_FALSE; 513 } 514 515 /* 516 * Now we know the exact TCP/IP header length, subtract 517 * that from tcp_mss to get our side's MSS. 518 */ 519 tcp->tcp_mss -= connp->conn_ht_iphc_len; 520 521 /* 522 * Here we assume that the other side's header size will be equal to 523 * our header size. We calculate the real MSS accordingly. Need to 524 * take into additional stuffs IPsec puts in. 525 * 526 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header) 527 */ 528 tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len + 529 tcp->tcp_ipsec_overhead - 530 ((connp->conn_ipversion == IPV4_VERSION ? 531 IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH); 532 533 /* 534 * Set MSS to the smaller one of both ends of the connection. 535 * We should not have called tcp_mss_set() before, but our 536 * side of the MSS should have been set to a proper value 537 * by tcp_set_destination(). tcp_mss_set() will also set up the 538 * STREAM head parameters properly. 539 * 540 * If we have a larger-than-16-bit window but the other side 541 * didn't want to do window scale, tcp_rwnd_set() will take 542 * care of that. 543 */ 544 tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss)); 545 546 /* 547 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been 548 * updated properly. 549 */ 550 TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial); 551 } 552 553 /* 554 * Add a new piece to the tcp reassembly queue. If the gap at the beginning 555 * is filled, return as much as we can. The message passed in may be 556 * multi-part, chained using b_cont. "start" is the starting sequence 557 * number for this piece. 558 */ 559 static mblk_t * 560 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start) 561 { 562 uint32_t end, bytes; 563 mblk_t *mp1; 564 mblk_t *mp2; 565 mblk_t *next_mp; 566 uint32_t u1; 567 tcp_stack_t *tcps = tcp->tcp_tcps; 568 569 570 /* Walk through all the new pieces. */ 571 do { 572 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 573 (uintptr_t)INT_MAX); 574 end = start + (int)(mp->b_wptr - mp->b_rptr); 575 next_mp = mp->b_cont; 576 if (start == end) { 577 /* Empty. Blast it. */ 578 freeb(mp); 579 continue; 580 } 581 bytes = end - start; 582 mp->b_cont = NULL; 583 TCP_REASS_SET_SEQ(mp, start); 584 TCP_REASS_SET_END(mp, end); 585 mp1 = tcp->tcp_reass_tail; 586 if (mp1 == NULL || SEQ_GEQ(start, TCP_REASS_END(mp1))) { 587 if (mp1 != NULL) { 588 /* 589 * New stuff is beyond the tail; link it on the 590 * end. 591 */ 592 mp1->b_cont = mp; 593 } else { 594 tcp->tcp_reass_head = mp; 595 } 596 tcp->tcp_reass_tail = mp; 597 TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs); 598 TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes, bytes); 599 tcp->tcp_cs.tcp_in_data_unorder_segs++; 600 tcp->tcp_cs.tcp_in_data_unorder_bytes += bytes; 601 continue; 602 } 603 mp1 = tcp->tcp_reass_head; 604 u1 = TCP_REASS_SEQ(mp1); 605 /* New stuff at the front? */ 606 if (SEQ_LT(start, u1)) { 607 /* Yes... Check for overlap. */ 608 mp->b_cont = mp1; 609 tcp->tcp_reass_head = mp; 610 tcp_reass_elim_overlap(tcp, mp); 611 continue; 612 } 613 /* 614 * The new piece fits somewhere between the head and tail. 615 * We find our slot, where mp1 precedes us and mp2 trails. 616 */ 617 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) { 618 u1 = TCP_REASS_SEQ(mp2); 619 if (SEQ_LEQ(start, u1)) 620 break; 621 } 622 /* Link ourselves in */ 623 mp->b_cont = mp2; 624 mp1->b_cont = mp; 625 626 /* Trim overlap with following mblk(s) first */ 627 tcp_reass_elim_overlap(tcp, mp); 628 629 /* Trim overlap with preceding mblk */ 630 tcp_reass_elim_overlap(tcp, mp1); 631 632 } while (start = end, mp = next_mp); 633 mp1 = tcp->tcp_reass_head; 634 /* Anything ready to go? */ 635 if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt) 636 return (NULL); 637 /* Eat what we can off the queue */ 638 for (;;) { 639 mp = mp1->b_cont; 640 end = TCP_REASS_END(mp1); 641 TCP_REASS_SET_SEQ(mp1, 0); 642 TCP_REASS_SET_END(mp1, 0); 643 if (!mp) { 644 tcp->tcp_reass_tail = NULL; 645 break; 646 } 647 if (end != TCP_REASS_SEQ(mp)) { 648 mp1->b_cont = NULL; 649 break; 650 } 651 mp1 = mp; 652 } 653 mp1 = tcp->tcp_reass_head; 654 tcp->tcp_reass_head = mp; 655 return (mp1); 656 } 657 658 /* Eliminate any overlap that mp may have over later mblks */ 659 static void 660 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp) 661 { 662 uint32_t end; 663 mblk_t *mp1; 664 uint32_t u1; 665 tcp_stack_t *tcps = tcp->tcp_tcps; 666 667 end = TCP_REASS_END(mp); 668 while ((mp1 = mp->b_cont) != NULL) { 669 u1 = TCP_REASS_SEQ(mp1); 670 if (!SEQ_GT(end, u1)) 671 break; 672 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) { 673 mp->b_wptr -= end - u1; 674 TCP_REASS_SET_END(mp, u1); 675 TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs); 676 TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes, 677 end - u1); 678 break; 679 } 680 mp->b_cont = mp1->b_cont; 681 TCP_REASS_SET_SEQ(mp1, 0); 682 TCP_REASS_SET_END(mp1, 0); 683 freeb(mp1); 684 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs); 685 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1); 686 } 687 if (!mp1) 688 tcp->tcp_reass_tail = mp; 689 } 690 691 /* 692 * This function does PAWS protection check, per RFC 7323 section 5. Requires 693 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if 694 * the segment passes the PAWS test, else returns B_FALSE. 695 */ 696 boolean_t 697 tcp_paws_check(tcp_t *tcp, const tcp_opt_t *tcpoptp) 698 { 699 if (TSTMP_LT(tcpoptp->tcp_opt_ts_val, 700 tcp->tcp_ts_recent)) { 701 if (LBOLT_FASTPATH64 < 702 (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) { 703 /* This segment is not acceptable. */ 704 return (B_FALSE); 705 } else { 706 /* 707 * Connection has been idle for 708 * too long. Reset the timestamp 709 */ 710 tcp->tcp_ts_recent = 711 tcpoptp->tcp_opt_ts_val; 712 } 713 } 714 return (B_TRUE); 715 } 716 717 /* 718 * Defense for the SYN attack - 719 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest 720 * one from the list of droppable eagers. This list is a subset of q0. 721 * see comments before the definition of MAKE_DROPPABLE(). 722 * 2. Don't drop a SYN request before its first timeout. This gives every 723 * request at least til the first timeout to complete its 3-way handshake. 724 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many 725 * requests currently on the queue that has timed out. This will be used 726 * as an indicator of whether an attack is under way, so that appropriate 727 * actions can be taken. (It's incremented in tcp_timer() and decremented 728 * either when eager goes into ESTABLISHED, or gets freed up.) 729 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on 730 * # of timeout drops back to <= q0len/32 => SYN alert off 731 */ 732 static boolean_t 733 tcp_drop_q0(tcp_t *tcp) 734 { 735 tcp_t *eager; 736 mblk_t *mp; 737 tcp_stack_t *tcps = tcp->tcp_tcps; 738 739 ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock)); 740 ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0); 741 742 /* Pick oldest eager from the list of droppable eagers */ 743 eager = tcp->tcp_eager_prev_drop_q0; 744 745 /* If list is empty. return B_FALSE */ 746 if (eager == tcp) { 747 return (B_FALSE); 748 } 749 750 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */ 751 if ((mp = allocb(0, BPRI_HI)) == NULL) 752 return (B_FALSE); 753 754 /* 755 * Take this eager out from the list of droppable eagers since we are 756 * going to drop it. 757 */ 758 MAKE_UNDROPPABLE(eager); 759 760 if (tcp->tcp_connp->conn_debug) { 761 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 762 "tcp_drop_q0: listen half-open queue (max=%d) overflow" 763 " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0, 764 tcp->tcp_conn_req_cnt_q0, 765 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 766 } 767 768 TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop); 769 770 /* Put a reference on the conn as we are enqueueing it in the sqeue */ 771 CONN_INC_REF(eager->tcp_connp); 772 773 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 774 tcp_clean_death_wrapper, eager->tcp_connp, NULL, 775 SQ_FILL, SQTAG_TCP_DROP_Q0); 776 777 return (B_TRUE); 778 } 779 780 /* 781 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6 782 */ 783 static mblk_t * 784 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp, 785 ip_recv_attr_t *ira) 786 { 787 tcp_t *ltcp = lconnp->conn_tcp; 788 tcp_t *tcp = connp->conn_tcp; 789 mblk_t *tpi_mp; 790 ipha_t *ipha; 791 ip6_t *ip6h; 792 sin6_t sin6; 793 uint_t ifindex = ira->ira_ruifindex; 794 tcp_stack_t *tcps = tcp->tcp_tcps; 795 796 if (ira->ira_flags & IRAF_IS_IPV4) { 797 ipha = (ipha_t *)mp->b_rptr; 798 799 connp->conn_ipversion = IPV4_VERSION; 800 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 801 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 802 connp->conn_saddr_v6 = connp->conn_laddr_v6; 803 804 sin6 = sin6_null; 805 sin6.sin6_addr = connp->conn_faddr_v6; 806 sin6.sin6_port = connp->conn_fport; 807 sin6.sin6_family = AF_INET6; 808 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 809 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 810 811 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 812 sin6_t sin6d; 813 814 sin6d = sin6_null; 815 sin6d.sin6_addr = connp->conn_laddr_v6; 816 sin6d.sin6_port = connp->conn_lport; 817 sin6d.sin6_family = AF_INET; 818 tpi_mp = mi_tpi_extconn_ind(NULL, 819 (char *)&sin6d, sizeof (sin6_t), 820 (char *)&tcp, 821 (t_scalar_t)sizeof (intptr_t), 822 (char *)&sin6d, sizeof (sin6_t), 823 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 824 } else { 825 tpi_mp = mi_tpi_conn_ind(NULL, 826 (char *)&sin6, sizeof (sin6_t), 827 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 828 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 829 } 830 } else { 831 ip6h = (ip6_t *)mp->b_rptr; 832 833 connp->conn_ipversion = IPV6_VERSION; 834 connp->conn_laddr_v6 = ip6h->ip6_dst; 835 connp->conn_faddr_v6 = ip6h->ip6_src; 836 connp->conn_saddr_v6 = connp->conn_laddr_v6; 837 838 sin6 = sin6_null; 839 sin6.sin6_addr = connp->conn_faddr_v6; 840 sin6.sin6_port = connp->conn_fport; 841 sin6.sin6_family = AF_INET6; 842 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK; 843 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6, 844 IPCL_ZONEID(lconnp), tcps->tcps_netstack); 845 846 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) { 847 /* Pass up the scope_id of remote addr */ 848 sin6.sin6_scope_id = ifindex; 849 } else { 850 sin6.sin6_scope_id = 0; 851 } 852 if (connp->conn_recv_ancillary.crb_recvdstaddr) { 853 sin6_t sin6d; 854 855 sin6d = sin6_null; 856 sin6.sin6_addr = connp->conn_laddr_v6; 857 sin6d.sin6_port = connp->conn_lport; 858 sin6d.sin6_family = AF_INET6; 859 if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6)) 860 sin6d.sin6_scope_id = ifindex; 861 862 tpi_mp = mi_tpi_extconn_ind(NULL, 863 (char *)&sin6d, sizeof (sin6_t), 864 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 865 (char *)&sin6d, sizeof (sin6_t), 866 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 867 } else { 868 tpi_mp = mi_tpi_conn_ind(NULL, 869 (char *)&sin6, sizeof (sin6_t), 870 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 871 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 872 } 873 } 874 875 tcp->tcp_mss = tcps->tcps_mss_def_ipv6; 876 return (tpi_mp); 877 } 878 879 /* Handle a SYN on an AF_INET socket */ 880 static mblk_t * 881 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp, 882 ip_recv_attr_t *ira) 883 { 884 tcp_t *ltcp = lconnp->conn_tcp; 885 tcp_t *tcp = connp->conn_tcp; 886 sin_t sin; 887 mblk_t *tpi_mp = NULL; 888 tcp_stack_t *tcps = tcp->tcp_tcps; 889 ipha_t *ipha; 890 891 ASSERT(ira->ira_flags & IRAF_IS_IPV4); 892 ipha = (ipha_t *)mp->b_rptr; 893 894 connp->conn_ipversion = IPV4_VERSION; 895 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6); 896 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6); 897 connp->conn_saddr_v6 = connp->conn_laddr_v6; 898 899 sin = sin_null; 900 sin.sin_addr.s_addr = connp->conn_faddr_v4; 901 sin.sin_port = connp->conn_fport; 902 sin.sin_family = AF_INET; 903 if (lconnp->conn_recv_ancillary.crb_recvdstaddr) { 904 sin_t sind; 905 906 sind = sin_null; 907 sind.sin_addr.s_addr = connp->conn_laddr_v4; 908 sind.sin_port = connp->conn_lport; 909 sind.sin_family = AF_INET; 910 tpi_mp = mi_tpi_extconn_ind(NULL, 911 (char *)&sind, sizeof (sin_t), (char *)&tcp, 912 (t_scalar_t)sizeof (intptr_t), (char *)&sind, 913 sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum); 914 } else { 915 tpi_mp = mi_tpi_conn_ind(NULL, 916 (char *)&sin, sizeof (sin_t), 917 (char *)&tcp, (t_scalar_t)sizeof (intptr_t), 918 (t_scalar_t)ltcp->tcp_conn_req_seqnum); 919 } 920 921 tcp->tcp_mss = tcps->tcps_mss_def_ipv4; 922 return (tpi_mp); 923 } 924 925 /* 926 * Called via squeue to get on to eager's perimeter. It sends a 927 * TH_RST if eager is in the fanout table. The listener wants the 928 * eager to disappear either by means of tcp_eager_blowoff() or 929 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be 930 * called (via squeue) if the eager cannot be inserted in the 931 * fanout table in tcp_input_listener(). 932 */ 933 /* ARGSUSED */ 934 void 935 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 936 { 937 conn_t *econnp = (conn_t *)arg; 938 tcp_t *eager = econnp->conn_tcp; 939 tcp_t *listener = eager->tcp_listener; 940 941 /* 942 * We could be called because listener is closing. Since 943 * the eager was using listener's queue's, we avoid 944 * using the listeners queues from now on. 945 */ 946 ASSERT(eager->tcp_detached); 947 econnp->conn_rq = NULL; 948 econnp->conn_wq = NULL; 949 950 /* 951 * An eager's conn_fanout will be NULL if it's a duplicate 952 * for an existing 4-tuples in the conn fanout table. 953 * We don't want to send an RST out in such case. 954 */ 955 if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) { 956 tcp_xmit_ctl("tcp_eager_kill, can't wait", 957 eager, eager->tcp_snxt, 0, TH_RST); 958 } 959 960 /* We are here because listener wants this eager gone */ 961 if (listener != NULL) { 962 mutex_enter(&listener->tcp_eager_lock); 963 tcp_eager_unlink(eager); 964 if (eager->tcp_tconnind_started) { 965 /* 966 * The eager has sent a conn_ind up to the 967 * listener but listener decides to close 968 * instead. We need to drop the extra ref 969 * placed on eager in tcp_input_data() before 970 * sending the conn_ind to listener. 971 */ 972 CONN_DEC_REF(econnp); 973 } 974 mutex_exit(&listener->tcp_eager_lock); 975 CONN_DEC_REF(listener->tcp_connp); 976 } 977 978 if (eager->tcp_state != TCPS_CLOSED) 979 tcp_close_detached(eager); 980 } 981 982 /* 983 * Reset any eager connection hanging off this listener marked 984 * with 'seqnum' and then reclaim it's resources. 985 */ 986 boolean_t 987 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum) 988 { 989 tcp_t *eager; 990 mblk_t *mp; 991 992 eager = listener; 993 mutex_enter(&listener->tcp_eager_lock); 994 do { 995 eager = eager->tcp_eager_next_q; 996 if (eager == NULL) { 997 mutex_exit(&listener->tcp_eager_lock); 998 return (B_FALSE); 999 } 1000 } while (eager->tcp_conn_req_seqnum != seqnum); 1001 1002 if (eager->tcp_closemp_used) { 1003 mutex_exit(&listener->tcp_eager_lock); 1004 return (B_TRUE); 1005 } 1006 eager->tcp_closemp_used = B_TRUE; 1007 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1008 CONN_INC_REF(eager->tcp_connp); 1009 mutex_exit(&listener->tcp_eager_lock); 1010 mp = &eager->tcp_closemp; 1011 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill, 1012 eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF); 1013 return (B_TRUE); 1014 } 1015 1016 /* 1017 * Reset any eager connection hanging off this listener 1018 * and then reclaim it's resources. 1019 */ 1020 void 1021 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only) 1022 { 1023 tcp_t *eager; 1024 mblk_t *mp; 1025 tcp_stack_t *tcps = listener->tcp_tcps; 1026 1027 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 1028 1029 if (!q0_only) { 1030 /* First cleanup q */ 1031 TCP_STAT(tcps, tcp_eager_blowoff_q); 1032 eager = listener->tcp_eager_next_q; 1033 while (eager != NULL) { 1034 if (!eager->tcp_closemp_used) { 1035 eager->tcp_closemp_used = B_TRUE; 1036 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1037 CONN_INC_REF(eager->tcp_connp); 1038 mp = &eager->tcp_closemp; 1039 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 1040 tcp_eager_kill, eager->tcp_connp, NULL, 1041 SQ_FILL, SQTAG_TCP_EAGER_CLEANUP); 1042 } 1043 eager = eager->tcp_eager_next_q; 1044 } 1045 } 1046 /* Then cleanup q0 */ 1047 TCP_STAT(tcps, tcp_eager_blowoff_q0); 1048 eager = listener->tcp_eager_next_q0; 1049 while (eager != listener) { 1050 if (!eager->tcp_closemp_used) { 1051 eager->tcp_closemp_used = B_TRUE; 1052 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1053 CONN_INC_REF(eager->tcp_connp); 1054 mp = &eager->tcp_closemp; 1055 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, 1056 tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL, 1057 SQTAG_TCP_EAGER_CLEANUP_Q0); 1058 } 1059 eager = eager->tcp_eager_next_q0; 1060 } 1061 } 1062 1063 /* 1064 * If we are an eager connection hanging off a listener that hasn't 1065 * formally accepted the connection yet, get off its list and blow off 1066 * any data that we have accumulated. 1067 */ 1068 void 1069 tcp_eager_unlink(tcp_t *tcp) 1070 { 1071 tcp_t *listener = tcp->tcp_listener; 1072 1073 ASSERT(listener != NULL); 1074 ASSERT(MUTEX_HELD(&listener->tcp_eager_lock)); 1075 if (tcp->tcp_eager_next_q0 != NULL) { 1076 ASSERT(tcp->tcp_eager_prev_q0 != NULL); 1077 1078 /* Remove the eager tcp from q0 */ 1079 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 = 1080 tcp->tcp_eager_prev_q0; 1081 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 = 1082 tcp->tcp_eager_next_q0; 1083 ASSERT(listener->tcp_conn_req_cnt_q0 > 0); 1084 listener->tcp_conn_req_cnt_q0--; 1085 1086 tcp->tcp_eager_next_q0 = NULL; 1087 tcp->tcp_eager_prev_q0 = NULL; 1088 1089 /* 1090 * Take the eager out, if it is in the list of droppable 1091 * eagers. 1092 */ 1093 MAKE_UNDROPPABLE(tcp); 1094 1095 if (tcp->tcp_syn_rcvd_timeout != 0) { 1096 /* we have timed out before */ 1097 ASSERT(listener->tcp_syn_rcvd_timeout > 0); 1098 listener->tcp_syn_rcvd_timeout--; 1099 } 1100 } else { 1101 tcp_t **tcpp = &listener->tcp_eager_next_q; 1102 tcp_t *prev = NULL; 1103 1104 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) { 1105 if (tcpp[0] == tcp) { 1106 if (listener->tcp_eager_last_q == tcp) { 1107 /* 1108 * If we are unlinking the last 1109 * element on the list, adjust 1110 * tail pointer. Set tail pointer 1111 * to nil when list is empty. 1112 */ 1113 ASSERT(tcp->tcp_eager_next_q == NULL); 1114 if (listener->tcp_eager_last_q == 1115 listener->tcp_eager_next_q) { 1116 listener->tcp_eager_last_q = 1117 NULL; 1118 } else { 1119 /* 1120 * We won't get here if there 1121 * is only one eager in the 1122 * list. 1123 */ 1124 ASSERT(prev != NULL); 1125 listener->tcp_eager_last_q = 1126 prev; 1127 } 1128 } 1129 tcpp[0] = tcp->tcp_eager_next_q; 1130 tcp->tcp_eager_next_q = NULL; 1131 tcp->tcp_eager_last_q = NULL; 1132 ASSERT(listener->tcp_conn_req_cnt_q > 0); 1133 listener->tcp_conn_req_cnt_q--; 1134 break; 1135 } 1136 prev = tcpp[0]; 1137 } 1138 } 1139 tcp->tcp_listener = NULL; 1140 } 1141 1142 /* BEGIN CSTYLED */ 1143 /* 1144 * 1145 * The sockfs ACCEPT path: 1146 * ======================= 1147 * 1148 * The eager is now established in its own perimeter as soon as SYN is 1149 * received in tcp_input_listener(). When sockfs receives conn_ind, it 1150 * completes the accept processing on the acceptor STREAM. The sending 1151 * of conn_ind part is common for both sockfs listener and a TLI/XTI 1152 * listener but a TLI/XTI listener completes the accept processing 1153 * on the listener perimeter. 1154 * 1155 * Common control flow for 3 way handshake: 1156 * ---------------------------------------- 1157 * 1158 * incoming SYN (listener perimeter) -> tcp_input_listener() 1159 * 1160 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data() 1161 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind() 1162 * 1163 * Sockfs ACCEPT Path: 1164 * ------------------- 1165 * 1166 * open acceptor stream (tcp_open allocates tcp_tli_accept() 1167 * as STREAM entry point) 1168 * 1169 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept() 1170 * 1171 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager 1172 * association (we are not behind eager's squeue but sockfs is protecting us 1173 * and no one knows about this stream yet. The STREAMS entry point q->q_info 1174 * is changed to point at tcp_wput(). 1175 * 1176 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to 1177 * listener (done on listener's perimeter). 1178 * 1179 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish 1180 * accept. 1181 * 1182 * TLI/XTI client ACCEPT path: 1183 * --------------------------- 1184 * 1185 * soaccept() sends T_CONN_RES on the listener STREAM. 1186 * 1187 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send 1188 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()). 1189 * 1190 * Locks: 1191 * ====== 1192 * 1193 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and 1194 * and listeners->tcp_eager_next_q. 1195 * 1196 * Referencing: 1197 * ============ 1198 * 1199 * 1) We start out in tcp_input_listener by eager placing a ref on 1200 * listener and listener adding eager to listeners->tcp_eager_next_q0. 1201 * 1202 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before 1203 * doing so we place a ref on the eager. This ref is finally dropped at the 1204 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the 1205 * reference is dropped by the squeue framework. 1206 * 1207 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish 1208 * 1209 * The reference must be released by the same entity that added the reference 1210 * In the above scheme, the eager is the entity that adds and releases the 1211 * references. Note that tcp_accept_finish executes in the squeue of the eager 1212 * (albeit after it is attached to the acceptor stream). Though 1. executes 1213 * in the listener's squeue, the eager is nascent at this point and the 1214 * reference can be considered to have been added on behalf of the eager. 1215 * 1216 * Eager getting a Reset or listener closing: 1217 * ========================================== 1218 * 1219 * Once the listener and eager are linked, the listener never does the unlink. 1220 * If the listener needs to close, tcp_eager_cleanup() is called which queues 1221 * a message on all eager perimeter. The eager then does the unlink, clears 1222 * any pointers to the listener's queue and drops the reference to the 1223 * listener. The listener waits in tcp_close outside the squeue until its 1224 * refcount has dropped to 1. This ensures that the listener has waited for 1225 * all eagers to clear their association with the listener. 1226 * 1227 * Similarly, if eager decides to go away, it can unlink itself and close. 1228 * When the T_CONN_RES comes down, we check if eager has closed. Note that 1229 * the reference to eager is still valid because of the extra ref we put 1230 * in tcp_send_conn_ind. 1231 * 1232 * Listener can always locate the eager under the protection 1233 * of the listener->tcp_eager_lock, and then do a refhold 1234 * on the eager during the accept processing. 1235 * 1236 * The acceptor stream accesses the eager in the accept processing 1237 * based on the ref placed on eager before sending T_conn_ind. 1238 * The only entity that can negate this refhold is a listener close 1239 * which is mutually exclusive with an active acceptor stream. 1240 * 1241 * Eager's reference on the listener 1242 * =================================== 1243 * 1244 * If the accept happens (even on a closed eager) the eager drops its 1245 * reference on the listener at the start of tcp_accept_finish. If the 1246 * eager is killed due to an incoming RST before the T_conn_ind is sent up, 1247 * the reference is dropped in tcp_closei_local. If the listener closes, 1248 * the reference is dropped in tcp_eager_kill. In all cases the reference 1249 * is dropped while executing in the eager's context (squeue). 1250 */ 1251 /* END CSTYLED */ 1252 1253 /* Process the SYN packet, mp, directed at the listener 'tcp' */ 1254 1255 /* 1256 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN. 1257 * tcp_input_data will not see any packets for listeners since the listener 1258 * has conn_recv set to tcp_input_listener. 1259 */ 1260 /* ARGSUSED */ 1261 static void 1262 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 1263 { 1264 tcpha_t *tcpha; 1265 uint32_t seg_seq; 1266 tcp_t *eager; 1267 int err; 1268 conn_t *econnp = NULL; 1269 squeue_t *new_sqp; 1270 mblk_t *mp1; 1271 uint_t ip_hdr_len; 1272 conn_t *lconnp = (conn_t *)arg; 1273 tcp_t *listener = lconnp->conn_tcp; 1274 tcp_stack_t *tcps = listener->tcp_tcps; 1275 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 1276 uint_t flags; 1277 mblk_t *tpi_mp; 1278 uint_t ifindex = ira->ira_ruifindex; 1279 boolean_t tlc_set = B_FALSE; 1280 1281 ip_hdr_len = ira->ira_ip_hdr_length; 1282 tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len]; 1283 flags = (unsigned int)tcpha->tha_flags & 0xFF; 1284 1285 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa, 1286 __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener, 1287 __dtrace_tcp_tcph_t *, tcpha); 1288 1289 if (!(flags & TH_SYN)) { 1290 if ((flags & TH_RST) || (flags & TH_URG)) { 1291 freemsg(mp); 1292 return; 1293 } 1294 if (flags & TH_ACK) { 1295 /* Note this executes in listener's squeue */ 1296 tcp_xmit_listeners_reset(mp, ira, ipst, lconnp); 1297 return; 1298 } 1299 1300 freemsg(mp); 1301 return; 1302 } 1303 1304 if (listener->tcp_state != TCPS_LISTEN) 1305 goto error2; 1306 1307 ASSERT(IPCL_IS_BOUND(lconnp)); 1308 1309 mutex_enter(&listener->tcp_eager_lock); 1310 1311 /* 1312 * The system is under memory pressure, so we need to do our part 1313 * to relieve the pressure. So we only accept new request if there 1314 * is nothing waiting to be accepted or waiting to complete the 3-way 1315 * handshake. This means that busy listener will not get too many 1316 * new requests which they cannot handle in time while non-busy 1317 * listener is still functioning properly. 1318 */ 1319 if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 || 1320 listener->tcp_conn_req_cnt_q0 > 0)) { 1321 mutex_exit(&listener->tcp_eager_lock); 1322 TCP_STAT(tcps, tcp_listen_mem_drop); 1323 goto error2; 1324 } 1325 1326 if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) { 1327 mutex_exit(&listener->tcp_eager_lock); 1328 TCP_STAT(tcps, tcp_listendrop); 1329 TCPS_BUMP_MIB(tcps, tcpListenDrop); 1330 if (lconnp->conn_debug) { 1331 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR, 1332 "tcp_input_listener: listen backlog (max=%d) " 1333 "overflow (%d pending) on %s", 1334 listener->tcp_conn_req_max, 1335 listener->tcp_conn_req_cnt_q, 1336 tcp_display(listener, NULL, DISP_PORT_ONLY)); 1337 } 1338 goto error2; 1339 } 1340 1341 if (listener->tcp_conn_req_cnt_q0 >= 1342 listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) { 1343 /* 1344 * Q0 is full. Drop a pending half-open req from the queue 1345 * to make room for the new SYN req. Also mark the time we 1346 * drop a SYN. 1347 * 1348 * A more aggressive defense against SYN attack will 1349 * be to set the "tcp_syn_defense" flag now. 1350 */ 1351 TCP_STAT(tcps, tcp_listendropq0); 1352 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64(); 1353 if (!tcp_drop_q0(listener)) { 1354 mutex_exit(&listener->tcp_eager_lock); 1355 TCPS_BUMP_MIB(tcps, tcpListenDropQ0); 1356 if (lconnp->conn_debug) { 1357 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE, 1358 "tcp_input_listener: listen half-open " 1359 "queue (max=%d) full (%d pending) on %s", 1360 tcps->tcps_conn_req_max_q0, 1361 listener->tcp_conn_req_cnt_q0, 1362 tcp_display(listener, NULL, 1363 DISP_PORT_ONLY)); 1364 } 1365 goto error2; 1366 } 1367 } 1368 1369 /* 1370 * Enforce the limit set on the number of connections per listener. 1371 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max 1372 * for comparison. 1373 */ 1374 if (listener->tcp_listen_cnt != NULL) { 1375 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt; 1376 int64_t now; 1377 1378 if (atomic_inc_32_nv(&tlc->tlc_cnt) > tlc->tlc_max + 1) { 1379 mutex_exit(&listener->tcp_eager_lock); 1380 now = ddi_get_lbolt64(); 1381 atomic_dec_32(&tlc->tlc_cnt); 1382 TCP_STAT(tcps, tcp_listen_cnt_drop); 1383 tlc->tlc_drop++; 1384 if (now - tlc->tlc_report_time > 1385 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) { 1386 zcmn_err(lconnp->conn_zoneid, CE_WARN, 1387 "Listener (port %d) connection max (%u) " 1388 "reached: %u attempts dropped total\n", 1389 ntohs(listener->tcp_connp->conn_lport), 1390 tlc->tlc_max, tlc->tlc_drop); 1391 tlc->tlc_report_time = now; 1392 } 1393 goto error2; 1394 } 1395 tlc_set = B_TRUE; 1396 } 1397 1398 mutex_exit(&listener->tcp_eager_lock); 1399 1400 /* 1401 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 1402 * or based on the ring (for packets from GLD). Otherwise it is 1403 * set based on lbolt i.e., a somewhat random number. 1404 */ 1405 ASSERT(ira->ira_sqp != NULL); 1406 new_sqp = ira->ira_sqp; 1407 1408 econnp = (conn_t *)tcp_get_conn(arg2, tcps); 1409 if (econnp == NULL) 1410 goto error2; 1411 1412 ASSERT(econnp->conn_netstack == lconnp->conn_netstack); 1413 econnp->conn_sqp = new_sqp; 1414 econnp->conn_initial_sqp = new_sqp; 1415 econnp->conn_ixa->ixa_sqp = new_sqp; 1416 1417 econnp->conn_fport = tcpha->tha_lport; 1418 econnp->conn_lport = tcpha->tha_fport; 1419 1420 err = conn_inherit_parent(lconnp, econnp); 1421 if (err != 0) 1422 goto error3; 1423 1424 /* We already know the laddr of the new connection is ours */ 1425 econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation; 1426 1427 ASSERT(OK_32PTR(mp->b_rptr)); 1428 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION || 1429 IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION); 1430 1431 if (lconnp->conn_family == AF_INET) { 1432 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION); 1433 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira); 1434 } else { 1435 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira); 1436 } 1437 1438 if (tpi_mp == NULL) 1439 goto error3; 1440 1441 eager = econnp->conn_tcp; 1442 eager->tcp_detached = B_TRUE; 1443 SOCK_CONNID_INIT(eager->tcp_connid); 1444 1445 /* 1446 * Initialize the eager's tcp_t and inherit some parameters from 1447 * the listener. 1448 */ 1449 tcp_init_values(eager, listener); 1450 1451 ASSERT((econnp->conn_ixa->ixa_flags & 1452 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 1453 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) == 1454 (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE | 1455 IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)); 1456 1457 if (!tcps->tcps_dev_flow_ctl) 1458 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL; 1459 1460 /* Prepare for diffing against previous packets */ 1461 eager->tcp_recvifindex = 0; 1462 eager->tcp_recvhops = 0xffffffffU; 1463 1464 if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) { 1465 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) || 1466 IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) { 1467 econnp->conn_incoming_ifindex = ifindex; 1468 econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET; 1469 econnp->conn_ixa->ixa_scopeid = ifindex; 1470 } 1471 } 1472 1473 if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) == 1474 (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) && 1475 tcps->tcps_rev_src_routes) { 1476 ipha_t *ipha = (ipha_t *)mp->b_rptr; 1477 ip_pkt_t *ipp = &econnp->conn_xmit_ipp; 1478 1479 /* Source routing option copyover (reverse it) */ 1480 err = ip_find_hdr_v4(ipha, ipp, B_TRUE); 1481 if (err != 0) { 1482 freemsg(tpi_mp); 1483 goto error3; 1484 } 1485 ip_pkt_source_route_reverse_v4(ipp); 1486 } 1487 1488 ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL); 1489 ASSERT(!eager->tcp_tconnind_started); 1490 /* 1491 * If the SYN came with a credential, it's a loopback packet or a 1492 * labeled packet; attach the credential to the TPI message. 1493 */ 1494 if (ira->ira_cred != NULL) 1495 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid); 1496 1497 eager->tcp_conn.tcp_eager_conn_ind = tpi_mp; 1498 ASSERT(eager->tcp_ordrel_mp == NULL); 1499 1500 /* Inherit the listener's non-STREAMS flag */ 1501 if (IPCL_IS_NONSTR(lconnp)) { 1502 econnp->conn_flags |= IPCL_NONSTR; 1503 /* All non-STREAMS tcp_ts are sockets */ 1504 eager->tcp_issocket = B_TRUE; 1505 } else { 1506 /* 1507 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that 1508 * at close time, we will always have that to send up. 1509 * Otherwise, we need to do special handling in case the 1510 * allocation fails at that time. 1511 */ 1512 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL) 1513 goto error3; 1514 } 1515 /* 1516 * Now that the IP addresses and ports are setup in econnp we 1517 * can do the IPsec policy work. 1518 */ 1519 if (ira->ira_flags & IRAF_IPSEC_SECURE) { 1520 if (lconnp->conn_policy != NULL) { 1521 /* 1522 * Inherit the policy from the listener; use 1523 * actions from ira 1524 */ 1525 if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) { 1526 CONN_DEC_REF(econnp); 1527 freemsg(mp); 1528 goto error3; 1529 } 1530 } 1531 } 1532 1533 /* 1534 * tcp_set_destination() may set tcp_rwnd according to the route 1535 * metrics. If it does not, the eager's receive window will be set 1536 * to the listener's receive window later in this function. 1537 */ 1538 eager->tcp_rwnd = 0; 1539 1540 if (is_system_labeled()) { 1541 ip_xmit_attr_t *ixa = econnp->conn_ixa; 1542 1543 ASSERT(ira->ira_tsl != NULL); 1544 /* Discard any old label */ 1545 if (ixa->ixa_free_flags & IXA_FREE_TSL) { 1546 ASSERT(ixa->ixa_tsl != NULL); 1547 label_rele(ixa->ixa_tsl); 1548 ixa->ixa_free_flags &= ~IXA_FREE_TSL; 1549 ixa->ixa_tsl = NULL; 1550 } 1551 if ((lconnp->conn_mlp_type != mlptSingle || 1552 lconnp->conn_mac_mode != CONN_MAC_DEFAULT) && 1553 ira->ira_tsl != NULL) { 1554 /* 1555 * If this is an MLP connection or a MAC-Exempt 1556 * connection with an unlabeled node, packets are to be 1557 * exchanged using the security label of the received 1558 * SYN packet instead of the server application's label. 1559 * tsol_check_dest called from ip_set_destination 1560 * might later update TSF_UNLABELED by replacing 1561 * ixa_tsl with a new label. 1562 */ 1563 label_hold(ira->ira_tsl); 1564 ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl); 1565 DTRACE_PROBE2(mlp_syn_accept, conn_t *, 1566 econnp, ts_label_t *, ixa->ixa_tsl) 1567 } else { 1568 ixa->ixa_tsl = crgetlabel(econnp->conn_cred); 1569 DTRACE_PROBE2(syn_accept, conn_t *, 1570 econnp, ts_label_t *, ixa->ixa_tsl) 1571 } 1572 /* 1573 * conn_connect() called from tcp_set_destination will verify 1574 * the destination is allowed to receive packets at the 1575 * security label of the SYN-ACK we are generating. As part of 1576 * that, tsol_check_dest() may create a new effective label for 1577 * this connection. 1578 * Finally conn_connect() will call conn_update_label. 1579 * All that remains for TCP to do is to call 1580 * conn_build_hdr_template which is done as part of 1581 * tcp_set_destination. 1582 */ 1583 } 1584 1585 /* 1586 * Since we will clear tcp_listener before we clear tcp_detached 1587 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress 1588 * so we can tell a TCP_IS_DETACHED_NONEAGER apart. 1589 */ 1590 eager->tcp_hard_binding = B_TRUE; 1591 1592 tcp_bind_hash_insert(&tcps->tcps_bind_fanout[ 1593 TCP_BIND_HASH(econnp->conn_lport)], eager, 0); 1594 1595 CL_INET_CONNECT(econnp, B_FALSE, err); 1596 if (err != 0) { 1597 tcp_bind_hash_remove(eager); 1598 goto error3; 1599 } 1600 1601 SOCK_CONNID_BUMP(eager->tcp_connid); 1602 1603 /* 1604 * Adapt our mss, ttl, ... based on the remote address. 1605 */ 1606 1607 if (tcp_set_destination(eager) != 0) { 1608 TCPS_BUMP_MIB(tcps, tcpAttemptFails); 1609 /* Undo the bind_hash_insert */ 1610 tcp_bind_hash_remove(eager); 1611 goto error3; 1612 } 1613 1614 /* Process all TCP options. */ 1615 tcp_process_options(eager, tcpha); 1616 1617 /* Is the other end ECN capable? */ 1618 if (tcps->tcps_ecn_permitted >= 1 && 1619 (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) { 1620 eager->tcp_ecn_ok = B_TRUE; 1621 } 1622 1623 /* 1624 * The listener's conn_rcvbuf should be the default window size or a 1625 * window size changed via SO_RCVBUF option. First round up the 1626 * eager's tcp_rwnd to the nearest MSS. Then find out the window 1627 * scale option value if needed. Call tcp_rwnd_set() to finish the 1628 * setting. 1629 * 1630 * Note if there is a rpipe metric associated with the remote host, 1631 * we should not inherit receive window size from listener. 1632 */ 1633 eager->tcp_rwnd = MSS_ROUNDUP( 1634 (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf : 1635 eager->tcp_rwnd), eager->tcp_mss); 1636 if (eager->tcp_snd_ws_ok) 1637 tcp_set_ws_value(eager); 1638 /* 1639 * Note that this is the only place tcp_rwnd_set() is called for 1640 * accepting a connection. We need to call it here instead of 1641 * after the 3-way handshake because we need to tell the other 1642 * side our rwnd in the SYN-ACK segment. 1643 */ 1644 (void) tcp_rwnd_set(eager, eager->tcp_rwnd); 1645 1646 ASSERT(eager->tcp_connp->conn_rcvbuf != 0 && 1647 eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd); 1648 1649 ASSERT(econnp->conn_rcvbuf != 0 && 1650 econnp->conn_rcvbuf == eager->tcp_rwnd); 1651 1652 /* Put a ref on the listener for the eager. */ 1653 CONN_INC_REF(lconnp); 1654 mutex_enter(&listener->tcp_eager_lock); 1655 listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager; 1656 eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0; 1657 listener->tcp_eager_next_q0 = eager; 1658 eager->tcp_eager_prev_q0 = listener; 1659 1660 /* Set tcp_listener before adding it to tcp_conn_fanout */ 1661 eager->tcp_listener = listener; 1662 eager->tcp_saved_listener = listener; 1663 1664 /* 1665 * Set tcp_listen_cnt so that when the connection is done, the counter 1666 * is decremented. 1667 */ 1668 eager->tcp_listen_cnt = listener->tcp_listen_cnt; 1669 1670 /* 1671 * Tag this detached tcp vector for later retrieval 1672 * by our listener client in tcp_accept(). 1673 */ 1674 eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum; 1675 listener->tcp_conn_req_cnt_q0++; 1676 if (++listener->tcp_conn_req_seqnum == -1) { 1677 /* 1678 * -1 is "special" and defined in TPI as something 1679 * that should never be used in T_CONN_IND 1680 */ 1681 ++listener->tcp_conn_req_seqnum; 1682 } 1683 mutex_exit(&listener->tcp_eager_lock); 1684 1685 if (listener->tcp_syn_defense) { 1686 /* Don't drop the SYN that comes from a good IP source */ 1687 ipaddr_t *addr_cache; 1688 1689 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache); 1690 if (addr_cache != NULL && econnp->conn_faddr_v4 == 1691 addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) { 1692 eager->tcp_dontdrop = B_TRUE; 1693 } 1694 } 1695 1696 /* 1697 * We need to insert the eager in its own perimeter but as soon 1698 * as we do that, we expose the eager to the classifier and 1699 * should not touch any field outside the eager's perimeter. 1700 * So do all the work necessary before inserting the eager 1701 * in its own perimeter. Be optimistic that conn_connect() 1702 * will succeed but undo everything if it fails. 1703 */ 1704 seg_seq = ntohl(tcpha->tha_seq); 1705 eager->tcp_irs = seg_seq; 1706 eager->tcp_rack = seg_seq; 1707 eager->tcp_rnxt = seg_seq + 1; 1708 eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt); 1709 TCPS_BUMP_MIB(tcps, tcpPassiveOpens); 1710 eager->tcp_state = TCPS_SYN_RCVD; 1711 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 1712 econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL, 1713 int32_t, TCPS_LISTEN); 1714 1715 mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss, 1716 NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE); 1717 if (mp1 == NULL) { 1718 /* 1719 * Increment the ref count as we are going to 1720 * enqueueing an mp in squeue 1721 */ 1722 CONN_INC_REF(econnp); 1723 goto error; 1724 } 1725 1726 /* 1727 * We need to start the rto timer. In normal case, we start 1728 * the timer after sending the packet on the wire (or at 1729 * least believing that packet was sent by waiting for 1730 * conn_ip_output() to return). Since this is the first packet 1731 * being sent on the wire for the eager, our initial tcp_rto 1732 * is at least tcp_rexmit_interval_min which is a fairly 1733 * large value to allow the algorithm to adjust slowly to large 1734 * fluctuations of RTT during first few transmissions. 1735 * 1736 * Starting the timer first and then sending the packet in this 1737 * case shouldn't make much difference since tcp_rexmit_interval_min 1738 * is of the order of several 100ms and starting the timer 1739 * first and then sending the packet will result in difference 1740 * of few micro seconds. 1741 * 1742 * Without this optimization, we are forced to hold the fanout 1743 * lock across the ipcl_bind_insert() and sending the packet 1744 * so that we don't race against an incoming packet (maybe RST) 1745 * for this eager. 1746 * 1747 * It is necessary to acquire an extra reference on the eager 1748 * at this point and hold it until after tcp_send_data() to 1749 * ensure against an eager close race. 1750 */ 1751 1752 CONN_INC_REF(econnp); 1753 1754 TCP_TIMER_RESTART(eager, eager->tcp_rto); 1755 1756 /* 1757 * Insert the eager in its own perimeter now. We are ready to deal 1758 * with any packets on eager. 1759 */ 1760 if (ipcl_conn_insert(econnp) != 0) 1761 goto error; 1762 1763 ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp); 1764 freemsg(mp); 1765 /* 1766 * Send the SYN-ACK. Use the right squeue so that conn_ixa is 1767 * only used by one thread at a time. 1768 */ 1769 if (econnp->conn_sqp == lconnp->conn_sqp) { 1770 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *, 1771 econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr, 1772 tcp_t *, eager, __dtrace_tcp_tcph_t *, 1773 &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]); 1774 (void) conn_ip_output(mp1, econnp->conn_ixa); 1775 CONN_DEC_REF(econnp); 1776 } else { 1777 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack, 1778 econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK); 1779 } 1780 return; 1781 error: 1782 freemsg(mp1); 1783 eager->tcp_closemp_used = B_TRUE; 1784 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15); 1785 mp1 = &eager->tcp_closemp; 1786 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill, 1787 econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2); 1788 1789 /* 1790 * If a connection already exists, send the mp to that connections so 1791 * that it can be appropriately dealt with. 1792 */ 1793 ipst = tcps->tcps_netstack->netstack_ip; 1794 1795 if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) { 1796 if (!IPCL_IS_CONNECTED(econnp)) { 1797 /* 1798 * Something bad happened. ipcl_conn_insert() 1799 * failed because a connection already existed 1800 * in connected hash but we can't find it 1801 * anymore (someone blew it away). Just 1802 * free this message and hopefully remote 1803 * will retransmit at which time the SYN can be 1804 * treated as a new connection or dealth with 1805 * a TH_RST if a connection already exists. 1806 */ 1807 CONN_DEC_REF(econnp); 1808 freemsg(mp); 1809 } else { 1810 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data, 1811 econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1); 1812 } 1813 } else { 1814 /* Nobody wants this packet */ 1815 freemsg(mp); 1816 } 1817 return; 1818 error3: 1819 CONN_DEC_REF(econnp); 1820 error2: 1821 freemsg(mp); 1822 if (tlc_set) 1823 atomic_dec_32(&listener->tcp_listen_cnt->tlc_cnt); 1824 } 1825 1826 /* 1827 * In an ideal case of vertical partition in NUMA architecture, its 1828 * beneficial to have the listener and all the incoming connections 1829 * tied to the same squeue. The other constraint is that incoming 1830 * connections should be tied to the squeue attached to interrupted 1831 * CPU for obvious locality reason so this leaves the listener to 1832 * be tied to the same squeue. Our only problem is that when listener 1833 * is binding, the CPU that will get interrupted by the NIC whose 1834 * IP address the listener is binding to is not even known. So 1835 * the code below allows us to change that binding at the time the 1836 * CPU is interrupted by virtue of incoming connection's squeue. 1837 * 1838 * This is usefull only in case of a listener bound to a specific IP 1839 * address. For other kind of listeners, they get bound the 1840 * very first time and there is no attempt to rebind them. 1841 */ 1842 void 1843 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2, 1844 ip_recv_attr_t *ira) 1845 { 1846 conn_t *connp = (conn_t *)arg; 1847 squeue_t *sqp = (squeue_t *)arg2; 1848 squeue_t *new_sqp; 1849 uint32_t conn_flags; 1850 1851 /* 1852 * IP sets ira_sqp to either the senders conn_sqp (for loopback) 1853 * or based on the ring (for packets from GLD). Otherwise it is 1854 * set based on lbolt i.e., a somewhat random number. 1855 */ 1856 ASSERT(ira->ira_sqp != NULL); 1857 new_sqp = ira->ira_sqp; 1858 1859 if (connp->conn_fanout == NULL) 1860 goto done; 1861 1862 if (!(connp->conn_flags & IPCL_FULLY_BOUND)) { 1863 mutex_enter(&connp->conn_fanout->connf_lock); 1864 mutex_enter(&connp->conn_lock); 1865 /* 1866 * No one from read or write side can access us now 1867 * except for already queued packets on this squeue. 1868 * But since we haven't changed the squeue yet, they 1869 * can't execute. If they are processed after we have 1870 * changed the squeue, they are sent back to the 1871 * correct squeue down below. 1872 * But a listner close can race with processing of 1873 * incoming SYN. If incoming SYN processing changes 1874 * the squeue then the listener close which is waiting 1875 * to enter the squeue would operate on the wrong 1876 * squeue. Hence we don't change the squeue here unless 1877 * the refcount is exactly the minimum refcount. The 1878 * minimum refcount of 4 is counted as - 1 each for 1879 * TCP and IP, 1 for being in the classifier hash, and 1880 * 1 for the mblk being processed. 1881 */ 1882 1883 if (connp->conn_ref != 4 || 1884 connp->conn_tcp->tcp_state != TCPS_LISTEN) { 1885 mutex_exit(&connp->conn_lock); 1886 mutex_exit(&connp->conn_fanout->connf_lock); 1887 goto done; 1888 } 1889 if (connp->conn_sqp != new_sqp) { 1890 while (connp->conn_sqp != new_sqp) 1891 (void) atomic_cas_ptr(&connp->conn_sqp, sqp, 1892 new_sqp); 1893 /* No special MT issues for outbound ixa_sqp hint */ 1894 connp->conn_ixa->ixa_sqp = new_sqp; 1895 } 1896 1897 do { 1898 conn_flags = connp->conn_flags; 1899 conn_flags |= IPCL_FULLY_BOUND; 1900 (void) atomic_cas_32(&connp->conn_flags, 1901 connp->conn_flags, conn_flags); 1902 } while (!(connp->conn_flags & IPCL_FULLY_BOUND)); 1903 1904 mutex_exit(&connp->conn_fanout->connf_lock); 1905 mutex_exit(&connp->conn_lock); 1906 1907 /* 1908 * Assume we have picked a good squeue for the listener. Make 1909 * subsequent SYNs not try to change the squeue. 1910 */ 1911 connp->conn_recv = tcp_input_listener; 1912 } 1913 1914 done: 1915 if (connp->conn_sqp != sqp) { 1916 CONN_INC_REF(connp); 1917 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp, 1918 ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND); 1919 } else { 1920 tcp_input_listener(connp, mp, sqp, ira); 1921 } 1922 } 1923 1924 /* 1925 * Send up all messages queued on tcp_rcv_list. 1926 */ 1927 uint_t 1928 tcp_rcv_drain(tcp_t *tcp) 1929 { 1930 mblk_t *mp; 1931 uint_t ret = 0; 1932 #ifdef DEBUG 1933 uint_t cnt = 0; 1934 #endif 1935 queue_t *q = tcp->tcp_connp->conn_rq; 1936 1937 /* Can't drain on an eager connection */ 1938 if (tcp->tcp_listener != NULL) 1939 return (ret); 1940 1941 /* Can't be a non-STREAMS connection */ 1942 ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp)); 1943 1944 /* No need for the push timer now. */ 1945 if (tcp->tcp_push_tid != 0) { 1946 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid); 1947 tcp->tcp_push_tid = 0; 1948 } 1949 1950 /* 1951 * Handle two cases here: we are currently fused or we were 1952 * previously fused and have some urgent data to be delivered 1953 * upstream. The latter happens because we either ran out of 1954 * memory or were detached and therefore sending the SIGURG was 1955 * deferred until this point. In either case we pass control 1956 * over to tcp_fuse_rcv_drain() since it may need to complete 1957 * some work. 1958 */ 1959 if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) { 1960 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL : 1961 &tcp->tcp_fused_sigurg_mp)) 1962 return (ret); 1963 } 1964 1965 while ((mp = tcp->tcp_rcv_list) != NULL) { 1966 tcp->tcp_rcv_list = mp->b_next; 1967 mp->b_next = NULL; 1968 #ifdef DEBUG 1969 cnt += msgdsize(mp); 1970 #endif 1971 putnext(q, mp); 1972 } 1973 #ifdef DEBUG 1974 ASSERT(cnt == tcp->tcp_rcv_cnt); 1975 #endif 1976 tcp->tcp_rcv_last_head = NULL; 1977 tcp->tcp_rcv_last_tail = NULL; 1978 tcp->tcp_rcv_cnt = 0; 1979 1980 if (canputnext(q)) 1981 return (tcp_rwnd_reopen(tcp)); 1982 1983 return (ret); 1984 } 1985 1986 /* 1987 * Queue data on tcp_rcv_list which is a b_next chain. 1988 * tcp_rcv_last_head/tail is the last element of this chain. 1989 * Each element of the chain is a b_cont chain. 1990 * 1991 * M_DATA messages are added to the current element. 1992 * Other messages are added as new (b_next) elements. 1993 */ 1994 void 1995 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr) 1996 { 1997 ASSERT(seg_len == msgdsize(mp)); 1998 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL); 1999 2000 if (is_system_labeled()) { 2001 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL); 2002 /* 2003 * Provide for protocols above TCP such as RPC. NOPID leaves 2004 * db_cpid unchanged. 2005 * The cred could have already been set. 2006 */ 2007 if (cr != NULL) 2008 mblk_setcred(mp, cr, NOPID); 2009 } 2010 2011 if (tcp->tcp_rcv_list == NULL) { 2012 ASSERT(tcp->tcp_rcv_last_head == NULL); 2013 tcp->tcp_rcv_list = mp; 2014 tcp->tcp_rcv_last_head = mp; 2015 } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) { 2016 tcp->tcp_rcv_last_tail->b_cont = mp; 2017 } else { 2018 tcp->tcp_rcv_last_head->b_next = mp; 2019 tcp->tcp_rcv_last_head = mp; 2020 } 2021 2022 while (mp->b_cont) 2023 mp = mp->b_cont; 2024 2025 tcp->tcp_rcv_last_tail = mp; 2026 tcp->tcp_rcv_cnt += seg_len; 2027 tcp->tcp_rwnd -= seg_len; 2028 } 2029 2030 /* Generate an ACK-only (no data) segment for a TCP endpoint */ 2031 mblk_t * 2032 tcp_ack_mp(tcp_t *tcp) 2033 { 2034 uint32_t seq_no; 2035 tcp_stack_t *tcps = tcp->tcp_tcps; 2036 conn_t *connp = tcp->tcp_connp; 2037 2038 /* 2039 * There are a few cases to be considered while setting the sequence no. 2040 * Essentially, we can come here while processing an unacceptable pkt 2041 * in the TCPS_SYN_RCVD state, in which case we set the sequence number 2042 * to snxt (per RFC 793), note the swnd wouldn't have been set yet. 2043 * If we are here for a zero window probe, stick with suna. In all 2044 * other cases, we check if suna + swnd encompasses snxt and set 2045 * the sequence number to snxt, if so. If snxt falls outside the 2046 * window (the receiver probably shrunk its window), we will go with 2047 * suna + swnd, otherwise the sequence no will be unacceptable to the 2048 * receiver. 2049 */ 2050 if (tcp->tcp_zero_win_probe) { 2051 seq_no = tcp->tcp_suna; 2052 } else if (tcp->tcp_state == TCPS_SYN_RCVD) { 2053 ASSERT(tcp->tcp_swnd == 0); 2054 seq_no = tcp->tcp_snxt; 2055 } else { 2056 seq_no = SEQ_GT(tcp->tcp_snxt, 2057 (tcp->tcp_suna + tcp->tcp_swnd)) ? 2058 (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt; 2059 } 2060 2061 if (tcp->tcp_valid_bits) { 2062 /* 2063 * For the complex case where we have to send some 2064 * controls (FIN or SYN), let tcp_xmit_mp do it. 2065 */ 2066 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE, 2067 NULL, B_FALSE)); 2068 } else { 2069 /* Generate a simple ACK */ 2070 int data_length; 2071 uchar_t *rptr; 2072 tcpha_t *tcpha; 2073 mblk_t *mp1; 2074 int32_t total_hdr_len; 2075 int32_t tcp_hdr_len; 2076 int32_t num_sack_blk = 0; 2077 int32_t sack_opt_len; 2078 ip_xmit_attr_t *ixa = connp->conn_ixa; 2079 2080 /* 2081 * Allocate space for TCP + IP headers 2082 * and link-level header 2083 */ 2084 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 2085 num_sack_blk = MIN(tcp->tcp_max_sack_blk, 2086 tcp->tcp_num_sack_blk); 2087 sack_opt_len = num_sack_blk * sizeof (sack_blk_t) + 2088 TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN; 2089 total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len; 2090 tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len; 2091 } else { 2092 total_hdr_len = connp->conn_ht_iphc_len; 2093 tcp_hdr_len = connp->conn_ht_ulp_len; 2094 } 2095 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED); 2096 if (!mp1) 2097 return (NULL); 2098 2099 /* Update the latest receive window size in TCP header. */ 2100 tcp->tcp_tcpha->tha_win = 2101 htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws); 2102 /* copy in prototype TCP + IP header */ 2103 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra; 2104 mp1->b_rptr = rptr; 2105 mp1->b_wptr = rptr + total_hdr_len; 2106 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len); 2107 2108 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length]; 2109 2110 /* Set the TCP sequence number. */ 2111 tcpha->tha_seq = htonl(seq_no); 2112 2113 /* Set up the TCP flag field. */ 2114 tcpha->tha_flags = (uchar_t)TH_ACK; 2115 if (tcp->tcp_ecn_echo_on) 2116 tcpha->tha_flags |= TH_ECE; 2117 2118 tcp->tcp_rack = tcp->tcp_rnxt; 2119 tcp->tcp_rack_cnt = 0; 2120 2121 /* fill in timestamp option if in use */ 2122 if (tcp->tcp_snd_ts_ok) { 2123 uint32_t llbolt = (uint32_t)LBOLT_FASTPATH; 2124 2125 U32_TO_BE32(llbolt, 2126 (char *)tcpha + TCP_MIN_HEADER_LENGTH+4); 2127 U32_TO_BE32(tcp->tcp_ts_recent, 2128 (char *)tcpha + TCP_MIN_HEADER_LENGTH+8); 2129 } 2130 2131 /* Fill in SACK options */ 2132 if (num_sack_blk > 0) { 2133 uchar_t *wptr = (uchar_t *)tcpha + 2134 connp->conn_ht_ulp_len; 2135 sack_blk_t *tmp; 2136 int32_t i; 2137 2138 wptr[0] = TCPOPT_NOP; 2139 wptr[1] = TCPOPT_NOP; 2140 wptr[2] = TCPOPT_SACK; 2141 wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk * 2142 sizeof (sack_blk_t); 2143 wptr += TCPOPT_REAL_SACK_LEN; 2144 2145 tmp = tcp->tcp_sack_list; 2146 for (i = 0; i < num_sack_blk; i++) { 2147 U32_TO_BE32(tmp[i].begin, wptr); 2148 wptr += sizeof (tcp_seq); 2149 U32_TO_BE32(tmp[i].end, wptr); 2150 wptr += sizeof (tcp_seq); 2151 } 2152 tcpha->tha_offset_and_reserved += 2153 ((num_sack_blk * 2 + 1) << 4); 2154 } 2155 2156 ixa->ixa_pktlen = total_hdr_len; 2157 2158 if (ixa->ixa_flags & IXAF_IS_IPV4) { 2159 ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len); 2160 } else { 2161 ip6_t *ip6 = (ip6_t *)rptr; 2162 2163 ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN); 2164 } 2165 2166 /* 2167 * Prime pump for checksum calculation in IP. Include the 2168 * adjustment for a source route if any. 2169 */ 2170 data_length = tcp_hdr_len + connp->conn_sum; 2171 data_length = (data_length >> 16) + (data_length & 0xFFFF); 2172 tcpha->tha_sum = htons(data_length); 2173 2174 if (tcp->tcp_ip_forward_progress) { 2175 tcp->tcp_ip_forward_progress = B_FALSE; 2176 connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF; 2177 } else { 2178 connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF; 2179 } 2180 return (mp1); 2181 } 2182 } 2183 2184 /* 2185 * Dummy socket upcalls for if/when the conn_t gets detached from a 2186 * direct-callback sonode via a user-driven close(). Easy to catch with 2187 * DTrace FBT, and should be mostly harmless. 2188 */ 2189 2190 /* ARGSUSED */ 2191 static sock_upper_handle_t 2192 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y, 2193 sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored) 2194 { 2195 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2196 return (NULL); 2197 } 2198 2199 /* ARGSUSED */ 2200 static void 2201 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr, 2202 pid_t pid) 2203 { 2204 ASSERT(x == NULL); 2205 /* Normally we'd crhold(cr) and attach it to socket state. */ 2206 /* LINTED */ 2207 } 2208 2209 /* ARGSUSED */ 2210 static int 2211 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah) 2212 { 2213 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2214 return (-1); 2215 } 2216 2217 /* ARGSUSED */ 2218 static void 2219 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah) 2220 { 2221 ASSERT(x == NULL); 2222 /* We really want this one to be a harmless NOP for now. */ 2223 /* LINTED */ 2224 } 2225 2226 /* ARGSUSED */ 2227 static ssize_t 2228 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags, 2229 int *error, boolean_t *push) 2230 { 2231 ASSERT(x == NULL); 2232 2233 /* 2234 * Consume the message, set ESHUTDOWN, and return an error. 2235 * Nobody's home! 2236 */ 2237 freemsg(mp); 2238 *error = ESHUTDOWN; 2239 return (-1); 2240 } 2241 2242 /* ARGSUSED */ 2243 static void 2244 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y) 2245 { 2246 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2247 } 2248 2249 /* ARGSUSED */ 2250 static void 2251 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y) 2252 { 2253 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2254 } 2255 2256 /* ARGSUSED */ 2257 static void 2258 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len) 2259 { 2260 ASSERT(x == NULL); 2261 /* Otherwise, this would signal socket state about OOB data. */ 2262 } 2263 2264 /* ARGSUSED */ 2265 static void 2266 tcp_dummy_set_error(sock_upper_handle_t x, int err) 2267 { 2268 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2269 } 2270 2271 /* ARGSUSED */ 2272 static void 2273 tcp_dummy_onearg(sock_upper_handle_t x) 2274 { 2275 ASSERT(0); /* Panic in debug, otherwise ignore. */ 2276 } 2277 2278 static sock_upcalls_t tcp_dummy_upcalls = { 2279 tcp_dummy_newconn, 2280 tcp_dummy_connected, 2281 tcp_dummy_disconnected, 2282 tcp_dummy_opctl, 2283 tcp_dummy_recv, 2284 tcp_dummy_set_proto_props, 2285 tcp_dummy_txq_full, 2286 tcp_dummy_signal_oob, 2287 tcp_dummy_onearg, 2288 tcp_dummy_set_error, 2289 tcp_dummy_onearg 2290 }; 2291 2292 /* 2293 * Handle M_DATA messages from IP. Its called directly from IP via 2294 * squeue for received IP packets. 2295 * 2296 * The first argument is always the connp/tcp to which the mp belongs. 2297 * There are no exceptions to this rule. The caller has already put 2298 * a reference on this connp/tcp and once tcp_input_data() returns, 2299 * the squeue will do the refrele. 2300 * 2301 * The TH_SYN for the listener directly go to tcp_input_listener via 2302 * squeue. ICMP errors go directly to tcp_icmp_input(). 2303 * 2304 * sqp: NULL = recursive, sqp != NULL means called from squeue 2305 */ 2306 void 2307 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 2308 { 2309 int32_t bytes_acked; 2310 int32_t gap; 2311 mblk_t *mp1; 2312 uint_t flags; 2313 uint32_t new_swnd = 0; 2314 uchar_t *iphdr; 2315 uchar_t *rptr; 2316 int32_t rgap; 2317 uint32_t seg_ack; 2318 int seg_len; 2319 uint_t ip_hdr_len; 2320 uint32_t seg_seq; 2321 tcpha_t *tcpha; 2322 int urp; 2323 tcp_opt_t tcpopt; 2324 ip_pkt_t ipp; 2325 boolean_t ofo_seg = B_FALSE; /* Out of order segment */ 2326 uint32_t cwnd; 2327 uint32_t add; 2328 int npkt; 2329 int mss; 2330 conn_t *connp = (conn_t *)arg; 2331 squeue_t *sqp = (squeue_t *)arg2; 2332 tcp_t *tcp = connp->conn_tcp; 2333 tcp_stack_t *tcps = tcp->tcp_tcps; 2334 sock_upcalls_t *sockupcalls; 2335 2336 /* 2337 * RST from fused tcp loopback peer should trigger an unfuse. 2338 */ 2339 if (tcp->tcp_fused) { 2340 TCP_STAT(tcps, tcp_fusion_aborted); 2341 tcp_unfuse(tcp); 2342 } 2343 2344 iphdr = mp->b_rptr; 2345 rptr = mp->b_rptr; 2346 ASSERT(OK_32PTR(rptr)); 2347 2348 ip_hdr_len = ira->ira_ip_hdr_length; 2349 if (connp->conn_recv_ancillary.crb_all != 0) { 2350 /* 2351 * Record packet information in the ip_pkt_t 2352 */ 2353 ipp.ipp_fields = 0; 2354 if (ira->ira_flags & IRAF_IS_IPV4) { 2355 (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp, 2356 B_FALSE); 2357 } else { 2358 uint8_t nexthdrp; 2359 2360 /* 2361 * IPv6 packets can only be received by applications 2362 * that are prepared to receive IPv6 addresses. 2363 * The IP fanout must ensure this. 2364 */ 2365 ASSERT(connp->conn_family == AF_INET6); 2366 2367 (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp, 2368 &nexthdrp); 2369 ASSERT(nexthdrp == IPPROTO_TCP); 2370 2371 /* Could have caused a pullup? */ 2372 iphdr = mp->b_rptr; 2373 rptr = mp->b_rptr; 2374 } 2375 } 2376 ASSERT(DB_TYPE(mp) == M_DATA); 2377 ASSERT(mp->b_next == NULL); 2378 2379 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 2380 seg_seq = ntohl(tcpha->tha_seq); 2381 seg_ack = ntohl(tcpha->tha_ack); 2382 ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX); 2383 seg_len = (int)(mp->b_wptr - rptr) - 2384 (ip_hdr_len + TCP_HDR_LENGTH(tcpha)); 2385 if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) { 2386 do { 2387 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 2388 (uintptr_t)INT_MAX); 2389 seg_len += (int)(mp1->b_wptr - mp1->b_rptr); 2390 } while ((mp1 = mp1->b_cont) != NULL && 2391 mp1->b_datap->db_type == M_DATA); 2392 } 2393 2394 DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa, 2395 __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp, 2396 __dtrace_tcp_tcph_t *, tcpha); 2397 2398 if (tcp->tcp_state == TCPS_TIME_WAIT) { 2399 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack, 2400 seg_len, tcpha, ira); 2401 return; 2402 } 2403 2404 if (sqp != NULL) { 2405 /* 2406 * This is the correct place to update tcp_last_recv_time. Note 2407 * that it is also updated for tcp structure that belongs to 2408 * global and listener queues which do not really need updating. 2409 * But that should not cause any harm. And it is updated for 2410 * all kinds of incoming segments, not only for data segments. 2411 */ 2412 tcp->tcp_last_recv_time = LBOLT_FASTPATH; 2413 } 2414 2415 flags = (unsigned int)tcpha->tha_flags & 0xFF; 2416 2417 TCPS_BUMP_MIB(tcps, tcpHCInSegs); 2418 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 2419 2420 if ((flags & TH_URG) && sqp != NULL) { 2421 /* 2422 * TCP can't handle urgent pointers that arrive before 2423 * the connection has been accept()ed since it can't 2424 * buffer OOB data. Discard segment if this happens. 2425 * 2426 * We can't just rely on a non-null tcp_listener to indicate 2427 * that the accept() has completed since unlinking of the 2428 * eager and completion of the accept are not atomic. 2429 * tcp_detached, when it is not set (B_FALSE) indicates 2430 * that the accept() has completed. 2431 * 2432 * Nor can it reassemble urgent pointers, so discard 2433 * if it's not the next segment expected. 2434 * 2435 * Otherwise, collapse chain into one mblk (discard if 2436 * that fails). This makes sure the headers, retransmitted 2437 * data, and new data all are in the same mblk. 2438 */ 2439 ASSERT(mp != NULL); 2440 if (tcp->tcp_detached || !pullupmsg(mp, -1)) { 2441 freemsg(mp); 2442 return; 2443 } 2444 /* Update pointers into message */ 2445 iphdr = rptr = mp->b_rptr; 2446 tcpha = (tcpha_t *)&rptr[ip_hdr_len]; 2447 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) { 2448 /* 2449 * Since we can't handle any data with this urgent 2450 * pointer that is out of sequence, we expunge 2451 * the data. This allows us to still register 2452 * the urgent mark and generate the M_PCSIG, 2453 * which we can do. 2454 */ 2455 mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 2456 seg_len = 0; 2457 } 2458 } 2459 2460 sockupcalls = connp->conn_upcalls; 2461 /* A conn_t may have belonged to a now-closed socket. Be careful. */ 2462 if (sockupcalls == NULL) 2463 sockupcalls = &tcp_dummy_upcalls; 2464 2465 switch (tcp->tcp_state) { 2466 case TCPS_SYN_SENT: 2467 if (connp->conn_final_sqp == NULL && 2468 tcp_outbound_squeue_switch && sqp != NULL) { 2469 ASSERT(connp->conn_initial_sqp == connp->conn_sqp); 2470 connp->conn_final_sqp = sqp; 2471 if (connp->conn_final_sqp != connp->conn_sqp) { 2472 DTRACE_PROBE1(conn__final__sqp__switch, 2473 conn_t *, connp); 2474 CONN_INC_REF(connp); 2475 SQUEUE_SWITCH(connp, connp->conn_final_sqp); 2476 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 2477 tcp_input_data, connp, ira, ip_squeue_flag, 2478 SQTAG_CONNECT_FINISH); 2479 return; 2480 } 2481 DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp); 2482 } 2483 if (flags & TH_ACK) { 2484 /* 2485 * Note that our stack cannot send data before a 2486 * connection is established, therefore the 2487 * following check is valid. Otherwise, it has 2488 * to be changed. 2489 */ 2490 if (SEQ_LEQ(seg_ack, tcp->tcp_iss) || 2491 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 2492 freemsg(mp); 2493 if (flags & TH_RST) 2494 return; 2495 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq", 2496 tcp, seg_ack, 0, TH_RST); 2497 return; 2498 } 2499 ASSERT(tcp->tcp_suna + 1 == seg_ack); 2500 } 2501 if (flags & TH_RST) { 2502 if (flags & TH_ACK) { 2503 DTRACE_TCP5(connect__refused, mblk_t *, NULL, 2504 ip_xmit_attr_t *, connp->conn_ixa, 2505 void_ip_t *, iphdr, tcp_t *, tcp, 2506 tcph_t *, tcpha); 2507 (void) tcp_clean_death(tcp, ECONNREFUSED); 2508 } 2509 freemsg(mp); 2510 return; 2511 } 2512 if (!(flags & TH_SYN)) { 2513 freemsg(mp); 2514 return; 2515 } 2516 2517 /* Process all TCP options. */ 2518 tcp_process_options(tcp, tcpha); 2519 /* 2520 * The following changes our rwnd to be a multiple of the 2521 * MIN(peer MSS, our MSS) for performance reason. 2522 */ 2523 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf, 2524 tcp->tcp_mss)); 2525 2526 /* Is the other end ECN capable? */ 2527 if (tcp->tcp_ecn_ok) { 2528 if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) { 2529 tcp->tcp_ecn_ok = B_FALSE; 2530 } 2531 } 2532 /* 2533 * Clear ECN flags because it may interfere with later 2534 * processing. 2535 */ 2536 flags &= ~(TH_ECE|TH_CWR); 2537 2538 tcp->tcp_irs = seg_seq; 2539 tcp->tcp_rack = seg_seq; 2540 tcp->tcp_rnxt = seg_seq + 1; 2541 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt); 2542 if (!TCP_IS_DETACHED(tcp)) { 2543 /* Allocate room for SACK options if needed. */ 2544 connp->conn_wroff = connp->conn_ht_iphc_len; 2545 if (tcp->tcp_snd_sack_ok) 2546 connp->conn_wroff += TCPOPT_MAX_SACK_LEN; 2547 if (!tcp->tcp_loopback) 2548 connp->conn_wroff += tcps->tcps_wroff_xtra; 2549 2550 (void) proto_set_tx_wroff(connp->conn_rq, connp, 2551 connp->conn_wroff); 2552 } 2553 if (flags & TH_ACK) { 2554 /* 2555 * If we can't get the confirmation upstream, pretend 2556 * we didn't even see this one. 2557 * 2558 * XXX: how can we pretend we didn't see it if we 2559 * have updated rnxt et. al. 2560 * 2561 * For loopback we defer sending up the T_CONN_CON 2562 * until after some checks below. 2563 */ 2564 mp1 = NULL; 2565 /* 2566 * tcp_sendmsg() checks tcp_state without entering 2567 * the squeue so tcp_state should be updated before 2568 * sending up connection confirmation. Probe the 2569 * state change below when we are sure the connection 2570 * confirmation has been sent. 2571 */ 2572 tcp->tcp_state = TCPS_ESTABLISHED; 2573 if (!tcp_conn_con(tcp, iphdr, mp, 2574 tcp->tcp_loopback ? &mp1 : NULL, ira)) { 2575 tcp->tcp_state = TCPS_SYN_SENT; 2576 freemsg(mp); 2577 return; 2578 } 2579 TCPS_CONN_INC(tcps); 2580 /* SYN was acked - making progress */ 2581 tcp->tcp_ip_forward_progress = B_TRUE; 2582 2583 /* One for the SYN */ 2584 tcp->tcp_suna = tcp->tcp_iss + 1; 2585 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 2586 2587 /* 2588 * If SYN was retransmitted, need to reset all 2589 * retransmission info. This is because this 2590 * segment will be treated as a dup ACK. 2591 */ 2592 if (tcp->tcp_rexmit) { 2593 tcp->tcp_rexmit = B_FALSE; 2594 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 2595 tcp->tcp_rexmit_max = tcp->tcp_snxt; 2596 tcp->tcp_ms_we_have_waited = 0; 2597 2598 /* 2599 * Set tcp_cwnd back to 1 MSS, per 2600 * recommendation from 2601 * draft-floyd-incr-init-win-01.txt, 2602 * Increasing TCP's Initial Window. 2603 */ 2604 tcp->tcp_cwnd = tcp->tcp_mss; 2605 } 2606 2607 tcp->tcp_swl1 = seg_seq; 2608 tcp->tcp_swl2 = seg_ack; 2609 2610 new_swnd = ntohs(tcpha->tha_win); 2611 tcp->tcp_swnd = new_swnd; 2612 if (new_swnd > tcp->tcp_max_swnd) 2613 tcp->tcp_max_swnd = new_swnd; 2614 2615 /* 2616 * Always send the three-way handshake ack immediately 2617 * in order to make the connection complete as soon as 2618 * possible on the accepting host. 2619 */ 2620 flags |= TH_ACK_NEEDED; 2621 2622 /* 2623 * Trace connect-established here. 2624 */ 2625 DTRACE_TCP5(connect__established, mblk_t *, NULL, 2626 ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa, 2627 void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha); 2628 2629 /* Trace change from SYN_SENT -> ESTABLISHED here */ 2630 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2631 connp->conn_ixa, void, NULL, tcp_t *, tcp, 2632 void, NULL, int32_t, TCPS_SYN_SENT); 2633 2634 /* 2635 * Special case for loopback. At this point we have 2636 * received SYN-ACK from the remote endpoint. In 2637 * order to ensure that both endpoints reach the 2638 * fused state prior to any data exchange, the final 2639 * ACK needs to be sent before we indicate T_CONN_CON 2640 * to the module upstream. 2641 */ 2642 if (tcp->tcp_loopback) { 2643 mblk_t *ack_mp; 2644 2645 ASSERT(!tcp->tcp_unfusable); 2646 ASSERT(mp1 != NULL); 2647 /* 2648 * For loopback, we always get a pure SYN-ACK 2649 * and only need to send back the final ACK 2650 * with no data (this is because the other 2651 * tcp is ours and we don't do T/TCP). This 2652 * final ACK triggers the passive side to 2653 * perform fusion in ESTABLISHED state. 2654 */ 2655 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) { 2656 if (tcp->tcp_ack_tid != 0) { 2657 (void) TCP_TIMER_CANCEL(tcp, 2658 tcp->tcp_ack_tid); 2659 tcp->tcp_ack_tid = 0; 2660 } 2661 tcp_send_data(tcp, ack_mp); 2662 TCPS_BUMP_MIB(tcps, tcpHCOutSegs); 2663 TCPS_BUMP_MIB(tcps, tcpOutAck); 2664 2665 if (!IPCL_IS_NONSTR(connp)) { 2666 /* Send up T_CONN_CON */ 2667 if (ira->ira_cred != NULL) { 2668 mblk_setcred(mp1, 2669 ira->ira_cred, 2670 ira->ira_cpid); 2671 } 2672 putnext(connp->conn_rq, mp1); 2673 } else { 2674 (*sockupcalls->su_connected) 2675 (connp->conn_upper_handle, 2676 tcp->tcp_connid, 2677 ira->ira_cred, 2678 ira->ira_cpid); 2679 freemsg(mp1); 2680 } 2681 2682 freemsg(mp); 2683 return; 2684 } 2685 /* 2686 * Forget fusion; we need to handle more 2687 * complex cases below. Send the deferred 2688 * T_CONN_CON message upstream and proceed 2689 * as usual. Mark this tcp as not capable 2690 * of fusion. 2691 */ 2692 TCP_STAT(tcps, tcp_fusion_unfusable); 2693 tcp->tcp_unfusable = B_TRUE; 2694 if (!IPCL_IS_NONSTR(connp)) { 2695 if (ira->ira_cred != NULL) { 2696 mblk_setcred(mp1, ira->ira_cred, 2697 ira->ira_cpid); 2698 } 2699 putnext(connp->conn_rq, mp1); 2700 } else { 2701 (*sockupcalls->su_connected) 2702 (connp->conn_upper_handle, 2703 tcp->tcp_connid, ira->ira_cred, 2704 ira->ira_cpid); 2705 freemsg(mp1); 2706 } 2707 } 2708 2709 /* 2710 * Check to see if there is data to be sent. If 2711 * yes, set the transmit flag. Then check to see 2712 * if received data processing needs to be done. 2713 * If not, go straight to xmit_check. This short 2714 * cut is OK as we don't support T/TCP. 2715 */ 2716 if (tcp->tcp_unsent) 2717 flags |= TH_XMIT_NEEDED; 2718 2719 if (seg_len == 0 && !(flags & TH_URG)) { 2720 freemsg(mp); 2721 goto xmit_check; 2722 } 2723 2724 flags &= ~TH_SYN; 2725 seg_seq++; 2726 break; 2727 } 2728 tcp->tcp_state = TCPS_SYN_RCVD; 2729 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 2730 connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp, 2731 tcph_t *, NULL, int32_t, TCPS_SYN_SENT); 2732 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss, 2733 NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE); 2734 if (mp1 != NULL) { 2735 tcp_send_data(tcp, mp1); 2736 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 2737 } 2738 freemsg(mp); 2739 return; 2740 case TCPS_SYN_RCVD: 2741 if (flags & TH_ACK) { 2742 uint32_t pinit_wnd; 2743 2744 /* 2745 * In this state, a SYN|ACK packet is either bogus 2746 * because the other side must be ACKing our SYN which 2747 * indicates it has seen the ACK for their SYN and 2748 * shouldn't retransmit it or we're crossing SYNs 2749 * on active open. 2750 */ 2751 if ((flags & TH_SYN) && !tcp->tcp_active_open) { 2752 freemsg(mp); 2753 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn", 2754 tcp, seg_ack, 0, TH_RST); 2755 return; 2756 } 2757 /* 2758 * NOTE: RFC 793 pg. 72 says this should be 2759 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt 2760 * but that would mean we have an ack that ignored 2761 * our SYN. 2762 */ 2763 if (SEQ_LEQ(seg_ack, tcp->tcp_suna) || 2764 SEQ_GT(seg_ack, tcp->tcp_snxt)) { 2765 freemsg(mp); 2766 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack", 2767 tcp, seg_ack, 0, TH_RST); 2768 return; 2769 } 2770 /* 2771 * No sane TCP stack will send such a small window 2772 * without receiving any data. Just drop this invalid 2773 * ACK. We also shorten the abort timeout in case 2774 * this is an attack. 2775 */ 2776 pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws; 2777 if (pinit_wnd < tcp->tcp_mss && 2778 pinit_wnd < tcp_init_wnd_chk) { 2779 freemsg(mp); 2780 TCP_STAT(tcps, tcp_zwin_ack_syn); 2781 tcp->tcp_second_ctimer_threshold = 2782 tcp_early_abort * SECONDS; 2783 return; 2784 } 2785 } 2786 break; 2787 case TCPS_LISTEN: 2788 /* 2789 * Only a TLI listener can come through this path when a 2790 * acceptor is going back to be a listener and a packet 2791 * for the acceptor hits the classifier. For a socket 2792 * listener, this can never happen because a listener 2793 * can never accept connection on itself and hence a 2794 * socket acceptor can not go back to being a listener. 2795 */ 2796 ASSERT(!TCP_IS_SOCKET(tcp)); 2797 /*FALLTHRU*/ 2798 case TCPS_CLOSED: 2799 case TCPS_BOUND: { 2800 conn_t *new_connp; 2801 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip; 2802 2803 /* 2804 * Don't accept any input on a closed tcp as this TCP logically 2805 * does not exist on the system. Don't proceed further with 2806 * this TCP. For instance, this packet could trigger another 2807 * close of this tcp which would be disastrous for tcp_refcnt. 2808 * tcp_close_detached / tcp_clean_death / tcp_closei_local must 2809 * be called at most once on a TCP. In this case we need to 2810 * refeed the packet into the classifier and figure out where 2811 * the packet should go. 2812 */ 2813 new_connp = ipcl_classify(mp, ira, ipst); 2814 if (new_connp != NULL) { 2815 /* Drops ref on new_connp */ 2816 tcp_reinput(new_connp, mp, ira, ipst); 2817 return; 2818 } 2819 /* We failed to classify. For now just drop the packet */ 2820 freemsg(mp); 2821 return; 2822 } 2823 case TCPS_IDLE: 2824 /* 2825 * Handle the case where the tcp_clean_death() has happened 2826 * on a connection (application hasn't closed yet) but a packet 2827 * was already queued on squeue before tcp_clean_death() 2828 * was processed. Calling tcp_clean_death() twice on same 2829 * connection can result in weird behaviour. 2830 */ 2831 freemsg(mp); 2832 return; 2833 default: 2834 break; 2835 } 2836 2837 /* 2838 * Already on the correct queue/perimeter. 2839 * If this is a detached connection and not an eager 2840 * connection hanging off a listener then new data 2841 * (past the FIN) will cause a reset. 2842 * We do a special check here where it 2843 * is out of the main line, rather than check 2844 * if we are detached every time we see new 2845 * data down below. 2846 */ 2847 if (TCP_IS_DETACHED_NONEAGER(tcp) && 2848 (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) { 2849 TCPS_BUMP_MIB(tcps, tcpInClosed); 2850 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp); 2851 freemsg(mp); 2852 tcp_xmit_ctl("new data when detached", tcp, 2853 tcp->tcp_snxt, 0, TH_RST); 2854 (void) tcp_clean_death(tcp, EPROTO); 2855 return; 2856 } 2857 2858 mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha); 2859 urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION; 2860 new_swnd = ntohs(tcpha->tha_win) << 2861 ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws); 2862 2863 /* 2864 * We are interested in two TCP options: timestamps (if negotiated) and 2865 * SACK (if negotiated). Skip option parsing if neither is negotiated. 2866 */ 2867 if (tcp->tcp_snd_ts_ok || tcp->tcp_snd_sack_ok) { 2868 int options; 2869 if (tcp->tcp_snd_sack_ok) 2870 tcpopt.tcp = tcp; 2871 else 2872 tcpopt.tcp = NULL; 2873 options = tcp_parse_options(tcpha, &tcpopt); 2874 /* 2875 * RST segments must not be subject to PAWS and are not 2876 * required to have timestamps. 2877 * We do not drop keepalive segments without 2878 * timestamps, to maintain compatibility with legacy TCP stacks. 2879 */ 2880 boolean_t keepalive = (seg_len == 0 || seg_len == 1) && 2881 (seg_seq + 1 == tcp->tcp_rnxt); 2882 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && !keepalive) { 2883 /* 2884 * Per RFC 7323 section 3.2., silently drop non-RST 2885 * segments without expected TSopt. This is a 'SHOULD' 2886 * requirement. 2887 * We accept keepalives without TSopt to maintain 2888 * interoperability with tcp implementations that omit 2889 * the TSopt on these. Keepalive data is discarded, so 2890 * there is no risk corrupting data by accepting these. 2891 */ 2892 if (!(options & TCP_OPT_TSTAMP_PRESENT)) { 2893 /* 2894 * Leave a breadcrumb for people to detect this 2895 * behavior. 2896 */ 2897 DTRACE_TCP1(droppedtimestamp, tcp_t *, tcp); 2898 freemsg(mp); 2899 return; 2900 } 2901 2902 if (!tcp_paws_check(tcp, &tcpopt)) { 2903 /* 2904 * This segment is not acceptable. 2905 * Drop it and send back an ACK. 2906 */ 2907 freemsg(mp); 2908 flags |= TH_ACK_NEEDED; 2909 goto ack_check; 2910 } 2911 } 2912 } 2913 try_again:; 2914 mss = tcp->tcp_mss; 2915 gap = seg_seq - tcp->tcp_rnxt; 2916 rgap = tcp->tcp_rwnd - (gap + seg_len); 2917 /* 2918 * gap is the amount of sequence space between what we expect to see 2919 * and what we got for seg_seq. A positive value for gap means 2920 * something got lost. A negative value means we got some old stuff. 2921 */ 2922 if (gap < 0) { 2923 /* Old stuff present. Is the SYN in there? */ 2924 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) && 2925 (seg_len != 0)) { 2926 flags &= ~TH_SYN; 2927 seg_seq++; 2928 urp--; 2929 /* Recompute the gaps after noting the SYN. */ 2930 goto try_again; 2931 } 2932 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs); 2933 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, 2934 (seg_len > -gap ? -gap : seg_len)); 2935 /* Remove the old stuff from seg_len. */ 2936 seg_len += gap; 2937 /* 2938 * Anything left? 2939 * Make sure to check for unack'd FIN when rest of data 2940 * has been previously ack'd. 2941 */ 2942 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) { 2943 /* 2944 * Resets are only valid if they lie within our offered 2945 * window. If the RST bit is set, we just ignore this 2946 * segment. 2947 */ 2948 if (flags & TH_RST) { 2949 freemsg(mp); 2950 return; 2951 } 2952 2953 /* 2954 * The arriving of dup data packets indicate that we 2955 * may have postponed an ack for too long, or the other 2956 * side's RTT estimate is out of shape. Start acking 2957 * more often. 2958 */ 2959 if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) && 2960 tcp->tcp_rack_cnt >= 1 && 2961 tcp->tcp_rack_abs_max > 2) { 2962 tcp->tcp_rack_abs_max--; 2963 } 2964 tcp->tcp_rack_cur_max = 1; 2965 2966 /* 2967 * This segment is "unacceptable". None of its 2968 * sequence space lies within our advertized window. 2969 * 2970 * Adjust seg_len to the original value for tracing. 2971 */ 2972 seg_len -= gap; 2973 if (connp->conn_debug) { 2974 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 2975 "tcp_rput: unacceptable, gap %d, rgap %d, " 2976 "flags 0x%x, seg_seq %u, seg_ack %u, " 2977 "seg_len %d, rnxt %u, snxt %u, %s", 2978 gap, rgap, flags, seg_seq, seg_ack, 2979 seg_len, tcp->tcp_rnxt, tcp->tcp_snxt, 2980 tcp_display(tcp, NULL, 2981 DISP_ADDR_AND_PORT)); 2982 } 2983 2984 /* 2985 * Arrange to send an ACK in response to the 2986 * unacceptable segment per RFC 793 page 69. There 2987 * is only one small difference between ours and the 2988 * acceptability test in the RFC - we accept ACK-only 2989 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK 2990 * will be generated. 2991 * 2992 * Note that we have to ACK an ACK-only packet at least 2993 * for stacks that send 0-length keep-alives with 2994 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122, 2995 * section 4.2.3.6. As long as we don't ever generate 2996 * an unacceptable packet in response to an incoming 2997 * packet that is unacceptable, it should not cause 2998 * "ACK wars". 2999 */ 3000 flags |= TH_ACK_NEEDED; 3001 3002 /* 3003 * Continue processing this segment in order to use the 3004 * ACK information it contains, but skip all other 3005 * sequence-number processing. Processing the ACK 3006 * information is necessary in order to 3007 * re-synchronize connections that may have lost 3008 * synchronization. 3009 * 3010 * We clear seg_len and flag fields related to 3011 * sequence number processing as they are not 3012 * to be trusted for an unacceptable segment. 3013 */ 3014 seg_len = 0; 3015 flags &= ~(TH_SYN | TH_FIN | TH_URG); 3016 goto process_ack; 3017 } 3018 3019 /* Fix seg_seq, and chew the gap off the front. */ 3020 seg_seq = tcp->tcp_rnxt; 3021 urp += gap; 3022 do { 3023 mblk_t *mp2; 3024 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 3025 (uintptr_t)UINT_MAX); 3026 gap += (uint_t)(mp->b_wptr - mp->b_rptr); 3027 if (gap > 0) { 3028 mp->b_rptr = mp->b_wptr - gap; 3029 break; 3030 } 3031 mp2 = mp; 3032 mp = mp->b_cont; 3033 freeb(mp2); 3034 } while (gap < 0); 3035 /* 3036 * If the urgent data has already been acknowledged, we 3037 * should ignore TH_URG below 3038 */ 3039 if (urp < 0) 3040 flags &= ~TH_URG; 3041 } 3042 /* 3043 * rgap is the amount of stuff received out of window. A negative 3044 * value is the amount out of window. 3045 */ 3046 if (rgap < 0) { 3047 mblk_t *mp2; 3048 3049 if (tcp->tcp_rwnd == 0) { 3050 TCPS_BUMP_MIB(tcps, tcpInWinProbe); 3051 tcp->tcp_cs.tcp_in_zwnd_probes++; 3052 } else { 3053 TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs); 3054 TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap); 3055 } 3056 3057 /* 3058 * seg_len does not include the FIN, so if more than 3059 * just the FIN is out of window, we act like we don't 3060 * see it. (If just the FIN is out of window, rgap 3061 * will be zero and we will go ahead and acknowledge 3062 * the FIN.) 3063 */ 3064 flags &= ~TH_FIN; 3065 3066 /* Fix seg_len and make sure there is something left. */ 3067 seg_len += rgap; 3068 if (seg_len <= 0) { 3069 /* 3070 * Resets are only valid if they lie within our offered 3071 * window. If the RST bit is set, we just ignore this 3072 * segment. 3073 */ 3074 if (flags & TH_RST) { 3075 freemsg(mp); 3076 return; 3077 } 3078 3079 /* Per RFC 793, we need to send back an ACK. */ 3080 flags |= TH_ACK_NEEDED; 3081 3082 /* 3083 * Send SIGURG as soon as possible i.e. even 3084 * if the TH_URG was delivered in a window probe 3085 * packet (which will be unacceptable). 3086 * 3087 * We generate a signal if none has been generated 3088 * for this connection or if this is a new urgent 3089 * byte. Also send a zero-length "unmarked" message 3090 * to inform SIOCATMARK that this is not the mark. 3091 * 3092 * tcp_urp_last_valid is cleared when the T_exdata_ind 3093 * is sent up. This plus the check for old data 3094 * (gap >= 0) handles the wraparound of the sequence 3095 * number space without having to always track the 3096 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks 3097 * this max in its rcv_up variable). 3098 * 3099 * This prevents duplicate SIGURGS due to a "late" 3100 * zero-window probe when the T_EXDATA_IND has already 3101 * been sent up. 3102 */ 3103 if ((flags & TH_URG) && 3104 (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq, 3105 tcp->tcp_urp_last))) { 3106 if (IPCL_IS_NONSTR(connp)) { 3107 if (!TCP_IS_DETACHED(tcp)) { 3108 (*sockupcalls->su_signal_oob) 3109 (connp->conn_upper_handle, 3110 urp); 3111 } 3112 } else { 3113 mp1 = allocb(0, BPRI_MED); 3114 if (mp1 == NULL) { 3115 freemsg(mp); 3116 return; 3117 } 3118 if (!TCP_IS_DETACHED(tcp) && 3119 !putnextctl1(connp->conn_rq, 3120 M_PCSIG, SIGURG)) { 3121 /* Try again on the rexmit. */ 3122 freemsg(mp1); 3123 freemsg(mp); 3124 return; 3125 } 3126 /* 3127 * If the next byte would be the mark 3128 * then mark with MARKNEXT else mark 3129 * with NOTMARKNEXT. 3130 */ 3131 if (gap == 0 && urp == 0) 3132 mp1->b_flag |= MSGMARKNEXT; 3133 else 3134 mp1->b_flag |= MSGNOTMARKNEXT; 3135 freemsg(tcp->tcp_urp_mark_mp); 3136 tcp->tcp_urp_mark_mp = mp1; 3137 flags |= TH_SEND_URP_MARK; 3138 } 3139 tcp->tcp_urp_last_valid = B_TRUE; 3140 tcp->tcp_urp_last = urp + seg_seq; 3141 } 3142 /* 3143 * If this is a zero window probe, continue to 3144 * process the ACK part. But we need to set seg_len 3145 * to 0 to avoid data processing. Otherwise just 3146 * drop the segment and send back an ACK. 3147 */ 3148 if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) { 3149 flags &= ~(TH_SYN | TH_URG); 3150 seg_len = 0; 3151 goto process_ack; 3152 } else { 3153 freemsg(mp); 3154 goto ack_check; 3155 } 3156 } 3157 /* Pitch out of window stuff off the end. */ 3158 rgap = seg_len; 3159 mp2 = mp; 3160 do { 3161 ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <= 3162 (uintptr_t)INT_MAX); 3163 rgap -= (int)(mp2->b_wptr - mp2->b_rptr); 3164 if (rgap < 0) { 3165 mp2->b_wptr += rgap; 3166 if ((mp1 = mp2->b_cont) != NULL) { 3167 mp2->b_cont = NULL; 3168 freemsg(mp1); 3169 } 3170 break; 3171 } 3172 } while ((mp2 = mp2->b_cont) != NULL); 3173 } 3174 ok:; 3175 /* 3176 * TCP should check ECN info for segments inside the window only. 3177 * Therefore the check should be done here. 3178 */ 3179 if (tcp->tcp_ecn_ok) { 3180 if (flags & TH_CWR) { 3181 tcp->tcp_ecn_echo_on = B_FALSE; 3182 } 3183 /* 3184 * Note that both ECN_CE and CWR can be set in the 3185 * same segment. In this case, we once again turn 3186 * on ECN_ECHO. 3187 */ 3188 if (connp->conn_ipversion == IPV4_VERSION) { 3189 uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service; 3190 3191 if ((tos & IPH_ECN_CE) == IPH_ECN_CE) { 3192 tcp->tcp_ecn_echo_on = B_TRUE; 3193 } 3194 } else { 3195 uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf; 3196 3197 if ((vcf & htonl(IPH_ECN_CE << 20)) == 3198 htonl(IPH_ECN_CE << 20)) { 3199 tcp->tcp_ecn_echo_on = B_TRUE; 3200 } 3201 } 3202 } 3203 3204 /* 3205 * Check whether we can update tcp_ts_recent. This test is from RFC 3206 * 7323, section 5.3. 3207 */ 3208 if (tcp->tcp_snd_ts_ok && !(flags & TH_RST) && 3209 TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) && 3210 SEQ_LEQ(seg_seq, tcp->tcp_rack)) { 3211 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val; 3212 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64; 3213 } 3214 3215 if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) { 3216 /* 3217 * FIN in an out of order segment. We record this in 3218 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq. 3219 * Clear the FIN so that any check on FIN flag will fail. 3220 * Remember that FIN also counts in the sequence number 3221 * space. So we need to ack out of order FIN only segments. 3222 */ 3223 if (flags & TH_FIN) { 3224 tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID; 3225 tcp->tcp_ofo_fin_seq = seg_seq + seg_len; 3226 flags &= ~TH_FIN; 3227 flags |= TH_ACK_NEEDED; 3228 } 3229 if (seg_len > 0) { 3230 /* Fill in the SACK blk list. */ 3231 if (tcp->tcp_snd_sack_ok) { 3232 tcp_sack_insert(tcp->tcp_sack_list, 3233 seg_seq, seg_seq + seg_len, 3234 &(tcp->tcp_num_sack_blk)); 3235 } 3236 3237 /* 3238 * Attempt reassembly and see if we have something 3239 * ready to go. 3240 */ 3241 mp = tcp_reass(tcp, mp, seg_seq); 3242 /* Always ack out of order packets */ 3243 flags |= TH_ACK_NEEDED | TH_PUSH; 3244 if (mp) { 3245 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <= 3246 (uintptr_t)INT_MAX); 3247 seg_len = mp->b_cont ? msgdsize(mp) : 3248 (int)(mp->b_wptr - mp->b_rptr); 3249 seg_seq = tcp->tcp_rnxt; 3250 /* 3251 * A gap is filled and the seq num and len 3252 * of the gap match that of a previously 3253 * received FIN, put the FIN flag back in. 3254 */ 3255 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 3256 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 3257 flags |= TH_FIN; 3258 tcp->tcp_valid_bits &= 3259 ~TCP_OFO_FIN_VALID; 3260 } 3261 if (tcp->tcp_reass_tid != 0) { 3262 (void) TCP_TIMER_CANCEL(tcp, 3263 tcp->tcp_reass_tid); 3264 /* 3265 * Restart the timer if there is still 3266 * data in the reassembly queue. 3267 */ 3268 if (tcp->tcp_reass_head != NULL) { 3269 tcp->tcp_reass_tid = TCP_TIMER( 3270 tcp, tcp_reass_timer, 3271 tcps->tcps_reass_timeout); 3272 } else { 3273 tcp->tcp_reass_tid = 0; 3274 } 3275 } 3276 } else { 3277 /* 3278 * Keep going even with NULL mp. 3279 * There may be a useful ACK or something else 3280 * we don't want to miss. 3281 * 3282 * But TCP should not perform fast retransmit 3283 * because of the ack number. TCP uses 3284 * seg_len == 0 to determine if it is a pure 3285 * ACK. And this is not a pure ACK. 3286 */ 3287 seg_len = 0; 3288 ofo_seg = B_TRUE; 3289 3290 if (tcps->tcps_reass_timeout != 0 && 3291 tcp->tcp_reass_tid == 0) { 3292 tcp->tcp_reass_tid = TCP_TIMER(tcp, 3293 tcp_reass_timer, 3294 tcps->tcps_reass_timeout); 3295 } 3296 } 3297 } 3298 } else if (seg_len > 0) { 3299 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs); 3300 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len); 3301 tcp->tcp_cs.tcp_in_data_inorder_segs++; 3302 tcp->tcp_cs.tcp_in_data_inorder_bytes += seg_len; 3303 3304 /* 3305 * If an out of order FIN was received before, and the seq 3306 * num and len of the new segment match that of the FIN, 3307 * put the FIN flag back in. 3308 */ 3309 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) && 3310 seg_seq + seg_len == tcp->tcp_ofo_fin_seq) { 3311 flags |= TH_FIN; 3312 tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID; 3313 } 3314 } 3315 if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) { 3316 if (flags & TH_RST) { 3317 freemsg(mp); 3318 switch (tcp->tcp_state) { 3319 case TCPS_SYN_RCVD: 3320 (void) tcp_clean_death(tcp, ECONNREFUSED); 3321 break; 3322 case TCPS_ESTABLISHED: 3323 case TCPS_FIN_WAIT_1: 3324 case TCPS_FIN_WAIT_2: 3325 case TCPS_CLOSE_WAIT: 3326 (void) tcp_clean_death(tcp, ECONNRESET); 3327 break; 3328 case TCPS_CLOSING: 3329 case TCPS_LAST_ACK: 3330 (void) tcp_clean_death(tcp, 0); 3331 break; 3332 default: 3333 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 3334 (void) tcp_clean_death(tcp, ENXIO); 3335 break; 3336 } 3337 return; 3338 } 3339 if (flags & TH_SYN) { 3340 /* 3341 * See RFC 793, Page 71 3342 * 3343 * The seq number must be in the window as it should 3344 * be "fixed" above. If it is outside window, it should 3345 * be already rejected. Note that we allow seg_seq to be 3346 * rnxt + rwnd because we want to accept 0 window probe. 3347 */ 3348 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) && 3349 SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd)); 3350 freemsg(mp); 3351 /* 3352 * If the ACK flag is not set, just use our snxt as the 3353 * seq number of the RST segment. 3354 */ 3355 if (!(flags & TH_ACK)) { 3356 seg_ack = tcp->tcp_snxt; 3357 } 3358 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1, 3359 TH_RST|TH_ACK); 3360 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 3361 (void) tcp_clean_death(tcp, ECONNRESET); 3362 return; 3363 } 3364 /* 3365 * urp could be -1 when the urp field in the packet is 0 3366 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent 3367 * byte was at seg_seq - 1, in which case we ignore the urgent flag. 3368 */ 3369 if ((flags & TH_URG) && urp >= 0) { 3370 if (!tcp->tcp_urp_last_valid || 3371 SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) { 3372 /* 3373 * Non-STREAMS sockets handle the urgent data a litte 3374 * differently from STREAMS based sockets. There is no 3375 * need to mark any mblks with the MSG{NOT,}MARKNEXT 3376 * flags to keep SIOCATMARK happy. Instead a 3377 * su_signal_oob upcall is made to update the mark. 3378 * Neither is a T_EXDATA_IND mblk needed to be 3379 * prepended to the urgent data. The urgent data is 3380 * delivered using the su_recv upcall, where we set 3381 * the MSG_OOB flag to indicate that it is urg data. 3382 * 3383 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED 3384 * are used by non-STREAMS sockets. 3385 */ 3386 if (IPCL_IS_NONSTR(connp)) { 3387 if (!TCP_IS_DETACHED(tcp)) { 3388 (*sockupcalls->su_signal_oob) 3389 (connp->conn_upper_handle, urp); 3390 } 3391 } else { 3392 /* 3393 * If we haven't generated the signal yet for 3394 * this urgent pointer value, do it now. Also, 3395 * send up a zero-length M_DATA indicating 3396 * whether or not this is the mark. The latter 3397 * is not needed when a T_EXDATA_IND is sent up. 3398 * However, if there are allocation failures 3399 * this code relies on the sender retransmitting 3400 * and the socket code for determining the mark 3401 * should not block waiting for the peer to 3402 * transmit. Thus, for simplicity we always 3403 * send up the mark indication. 3404 */ 3405 mp1 = allocb(0, BPRI_MED); 3406 if (mp1 == NULL) { 3407 freemsg(mp); 3408 return; 3409 } 3410 if (!TCP_IS_DETACHED(tcp) && 3411 !putnextctl1(connp->conn_rq, M_PCSIG, 3412 SIGURG)) { 3413 /* Try again on the rexmit. */ 3414 freemsg(mp1); 3415 freemsg(mp); 3416 return; 3417 } 3418 /* 3419 * Mark with NOTMARKNEXT for now. 3420 * The code below will change this to MARKNEXT 3421 * if we are at the mark. 3422 * 3423 * If there are allocation failures (e.g. in 3424 * dupmsg below) the next time tcp_input_data 3425 * sees the urgent segment it will send up the 3426 * MSGMARKNEXT message. 3427 */ 3428 mp1->b_flag |= MSGNOTMARKNEXT; 3429 freemsg(tcp->tcp_urp_mark_mp); 3430 tcp->tcp_urp_mark_mp = mp1; 3431 flags |= TH_SEND_URP_MARK; 3432 #ifdef DEBUG 3433 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3434 "tcp_rput: sent M_PCSIG 2 seq %x urp %x " 3435 "last %x, %s", 3436 seg_seq, urp, tcp->tcp_urp_last, 3437 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 3438 #endif /* DEBUG */ 3439 } 3440 tcp->tcp_urp_last_valid = B_TRUE; 3441 tcp->tcp_urp_last = urp + seg_seq; 3442 } else if (tcp->tcp_urp_mark_mp != NULL) { 3443 /* 3444 * An allocation failure prevented the previous 3445 * tcp_input_data from sending up the allocated 3446 * MSG*MARKNEXT message - send it up this time 3447 * around. 3448 */ 3449 flags |= TH_SEND_URP_MARK; 3450 } 3451 3452 /* 3453 * If the urgent byte is in this segment, make sure that it is 3454 * all by itself. This makes it much easier to deal with the 3455 * possibility of an allocation failure on the T_exdata_ind. 3456 * Note that seg_len is the number of bytes in the segment, and 3457 * urp is the offset into the segment of the urgent byte. 3458 * urp < seg_len means that the urgent byte is in this segment. 3459 */ 3460 if (urp < seg_len) { 3461 if (seg_len != 1) { 3462 uint32_t tmp_rnxt; 3463 /* 3464 * Break it up and feed it back in. 3465 * Re-attach the IP header. 3466 */ 3467 mp->b_rptr = iphdr; 3468 if (urp > 0) { 3469 /* 3470 * There is stuff before the urgent 3471 * byte. 3472 */ 3473 mp1 = dupmsg(mp); 3474 if (!mp1) { 3475 /* 3476 * Trim from urgent byte on. 3477 * The rest will come back. 3478 */ 3479 (void) adjmsg(mp, 3480 urp - seg_len); 3481 tcp_input_data(connp, 3482 mp, NULL, ira); 3483 return; 3484 } 3485 (void) adjmsg(mp1, urp - seg_len); 3486 /* Feed this piece back in. */ 3487 tmp_rnxt = tcp->tcp_rnxt; 3488 tcp_input_data(connp, mp1, NULL, ira); 3489 /* 3490 * If the data passed back in was not 3491 * processed (ie: bad ACK) sending 3492 * the remainder back in will cause a 3493 * loop. In this case, drop the 3494 * packet and let the sender try 3495 * sending a good packet. 3496 */ 3497 if (tmp_rnxt == tcp->tcp_rnxt) { 3498 freemsg(mp); 3499 return; 3500 } 3501 } 3502 if (urp != seg_len - 1) { 3503 uint32_t tmp_rnxt; 3504 /* 3505 * There is stuff after the urgent 3506 * byte. 3507 */ 3508 mp1 = dupmsg(mp); 3509 if (!mp1) { 3510 /* 3511 * Trim everything beyond the 3512 * urgent byte. The rest will 3513 * come back. 3514 */ 3515 (void) adjmsg(mp, 3516 urp + 1 - seg_len); 3517 tcp_input_data(connp, 3518 mp, NULL, ira); 3519 return; 3520 } 3521 (void) adjmsg(mp1, urp + 1 - seg_len); 3522 tmp_rnxt = tcp->tcp_rnxt; 3523 tcp_input_data(connp, mp1, NULL, ira); 3524 /* 3525 * If the data passed back in was not 3526 * processed (ie: bad ACK) sending 3527 * the remainder back in will cause a 3528 * loop. In this case, drop the 3529 * packet and let the sender try 3530 * sending a good packet. 3531 */ 3532 if (tmp_rnxt == tcp->tcp_rnxt) { 3533 freemsg(mp); 3534 return; 3535 } 3536 } 3537 tcp_input_data(connp, mp, NULL, ira); 3538 return; 3539 } 3540 /* 3541 * This segment contains only the urgent byte. We 3542 * have to allocate the T_exdata_ind, if we can. 3543 */ 3544 if (IPCL_IS_NONSTR(connp)) { 3545 int error; 3546 3547 (*sockupcalls->su_recv) 3548 (connp->conn_upper_handle, mp, seg_len, 3549 MSG_OOB, &error, NULL); 3550 /* 3551 * We should never be in middle of a 3552 * fallback, the squeue guarantees that. 3553 */ 3554 ASSERT(error != EOPNOTSUPP); 3555 mp = NULL; 3556 goto update_ack; 3557 } else if (!tcp->tcp_urp_mp) { 3558 struct T_exdata_ind *tei; 3559 mp1 = allocb(sizeof (struct T_exdata_ind), 3560 BPRI_MED); 3561 if (!mp1) { 3562 /* 3563 * Sigh... It'll be back. 3564 * Generate any MSG*MARK message now. 3565 */ 3566 freemsg(mp); 3567 seg_len = 0; 3568 if (flags & TH_SEND_URP_MARK) { 3569 3570 3571 ASSERT(tcp->tcp_urp_mark_mp); 3572 tcp->tcp_urp_mark_mp->b_flag &= 3573 ~MSGNOTMARKNEXT; 3574 tcp->tcp_urp_mark_mp->b_flag |= 3575 MSGMARKNEXT; 3576 } 3577 goto ack_check; 3578 } 3579 mp1->b_datap->db_type = M_PROTO; 3580 tei = (struct T_exdata_ind *)mp1->b_rptr; 3581 tei->PRIM_type = T_EXDATA_IND; 3582 tei->MORE_flag = 0; 3583 mp1->b_wptr = (uchar_t *)&tei[1]; 3584 tcp->tcp_urp_mp = mp1; 3585 #ifdef DEBUG 3586 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3587 "tcp_rput: allocated exdata_ind %s", 3588 tcp_display(tcp, NULL, 3589 DISP_PORT_ONLY)); 3590 #endif /* DEBUG */ 3591 /* 3592 * There is no need to send a separate MSG*MARK 3593 * message since the T_EXDATA_IND will be sent 3594 * now. 3595 */ 3596 flags &= ~TH_SEND_URP_MARK; 3597 freemsg(tcp->tcp_urp_mark_mp); 3598 tcp->tcp_urp_mark_mp = NULL; 3599 } 3600 /* 3601 * Now we are all set. On the next putnext upstream, 3602 * tcp_urp_mp will be non-NULL and will get prepended 3603 * to what has to be this piece containing the urgent 3604 * byte. If for any reason we abort this segment below, 3605 * if it comes back, we will have this ready, or it 3606 * will get blown off in close. 3607 */ 3608 } else if (urp == seg_len) { 3609 /* 3610 * The urgent byte is the next byte after this sequence 3611 * number. If this endpoint is non-STREAMS, then there 3612 * is nothing to do here since the socket has already 3613 * been notified about the urg pointer by the 3614 * su_signal_oob call above. 3615 * 3616 * In case of STREAMS, some more work might be needed. 3617 * If there is data it is marked with MSGMARKNEXT and 3618 * and any tcp_urp_mark_mp is discarded since it is not 3619 * needed. Otherwise, if the code above just allocated 3620 * a zero-length tcp_urp_mark_mp message, that message 3621 * is tagged with MSGMARKNEXT. Sending up these 3622 * MSGMARKNEXT messages makes SIOCATMARK work correctly 3623 * even though the T_EXDATA_IND will not be sent up 3624 * until the urgent byte arrives. 3625 */ 3626 if (!IPCL_IS_NONSTR(tcp->tcp_connp)) { 3627 if (seg_len != 0) { 3628 flags |= TH_MARKNEXT_NEEDED; 3629 freemsg(tcp->tcp_urp_mark_mp); 3630 tcp->tcp_urp_mark_mp = NULL; 3631 flags &= ~TH_SEND_URP_MARK; 3632 } else if (tcp->tcp_urp_mark_mp != NULL) { 3633 flags |= TH_SEND_URP_MARK; 3634 tcp->tcp_urp_mark_mp->b_flag &= 3635 ~MSGNOTMARKNEXT; 3636 tcp->tcp_urp_mark_mp->b_flag |= 3637 MSGMARKNEXT; 3638 } 3639 } 3640 #ifdef DEBUG 3641 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3642 "tcp_rput: AT MARK, len %d, flags 0x%x, %s", 3643 seg_len, flags, 3644 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 3645 #endif /* DEBUG */ 3646 } 3647 #ifdef DEBUG 3648 else { 3649 /* Data left until we hit mark */ 3650 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 3651 "tcp_rput: URP %d bytes left, %s", 3652 urp - seg_len, tcp_display(tcp, NULL, 3653 DISP_PORT_ONLY)); 3654 } 3655 #endif /* DEBUG */ 3656 } 3657 3658 process_ack: 3659 if (!(flags & TH_ACK)) { 3660 freemsg(mp); 3661 goto xmit_check; 3662 } 3663 } 3664 bytes_acked = (int)(seg_ack - tcp->tcp_suna); 3665 3666 if (bytes_acked > 0) 3667 tcp->tcp_ip_forward_progress = B_TRUE; 3668 if (tcp->tcp_state == TCPS_SYN_RCVD) { 3669 /* 3670 * tcp_sendmsg() checks tcp_state without entering 3671 * the squeue so tcp_state should be updated before 3672 * sending up a connection confirmation or a new 3673 * connection indication. 3674 */ 3675 tcp->tcp_state = TCPS_ESTABLISHED; 3676 3677 /* 3678 * We are seeing the final ack in the three way 3679 * hand shake of a active open'ed connection 3680 * so we must send up a T_CONN_CON 3681 */ 3682 if (tcp->tcp_active_open) { 3683 if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) { 3684 freemsg(mp); 3685 tcp->tcp_state = TCPS_SYN_RCVD; 3686 return; 3687 } 3688 /* 3689 * Don't fuse the loopback endpoints for 3690 * simultaneous active opens. 3691 */ 3692 if (tcp->tcp_loopback) { 3693 TCP_STAT(tcps, tcp_fusion_unfusable); 3694 tcp->tcp_unfusable = B_TRUE; 3695 } 3696 /* 3697 * For simultaneous active open, trace receipt of final 3698 * ACK as tcp:::connect-established. 3699 */ 3700 DTRACE_TCP5(connect__established, mblk_t *, NULL, 3701 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3702 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3703 } else if (IPCL_IS_NONSTR(connp)) { 3704 /* 3705 * 3-way handshake has completed, so notify socket 3706 * of the new connection. 3707 * 3708 * We are here means eager is fine but it can 3709 * get a TH_RST at any point between now and till 3710 * accept completes and disappear. We need to 3711 * ensure that reference to eager is valid after 3712 * we get out of eager's perimeter. So we do 3713 * an extra refhold. 3714 */ 3715 CONN_INC_REF(connp); 3716 3717 if (!tcp_newconn_notify(tcp, ira)) { 3718 /* 3719 * The state-change probe for SYN_RCVD -> 3720 * ESTABLISHED has not fired yet. We reset 3721 * the state to SYN_RCVD so that future 3722 * state-change probes report correct state 3723 * transistions. 3724 */ 3725 tcp->tcp_state = TCPS_SYN_RCVD; 3726 freemsg(mp); 3727 /* notification did not go up, so drop ref */ 3728 CONN_DEC_REF(connp); 3729 /* ... and close the eager */ 3730 ASSERT(TCP_IS_DETACHED(tcp)); 3731 (void) tcp_close_detached(tcp); 3732 return; 3733 } 3734 /* 3735 * tcp_newconn_notify() changes conn_upcalls and 3736 * connp->conn_upper_handle. Fix things now, in case 3737 * there's data attached to this ack. 3738 */ 3739 if (connp->conn_upcalls != NULL) 3740 sockupcalls = connp->conn_upcalls; 3741 /* 3742 * For passive open, trace receipt of final ACK as 3743 * tcp:::accept-established. 3744 */ 3745 DTRACE_TCP5(accept__established, mlbk_t *, NULL, 3746 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3747 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3748 } else { 3749 /* 3750 * 3-way handshake complete - this is a STREAMS based 3751 * socket, so pass up the T_CONN_IND. 3752 */ 3753 tcp_t *listener = tcp->tcp_listener; 3754 mblk_t *mp = tcp->tcp_conn.tcp_eager_conn_ind; 3755 3756 tcp->tcp_tconnind_started = B_TRUE; 3757 tcp->tcp_conn.tcp_eager_conn_ind = NULL; 3758 ASSERT(mp != NULL); 3759 /* 3760 * We are here means eager is fine but it can 3761 * get a TH_RST at any point between now and till 3762 * accept completes and disappear. We need to 3763 * ensure that reference to eager is valid after 3764 * we get out of eager's perimeter. So we do 3765 * an extra refhold. 3766 */ 3767 CONN_INC_REF(connp); 3768 3769 /* 3770 * The listener also exists because of the refhold 3771 * done in tcp_input_listener. Its possible that it 3772 * might have closed. We will check that once we 3773 * get inside listeners context. 3774 */ 3775 CONN_INC_REF(listener->tcp_connp); 3776 if (listener->tcp_connp->conn_sqp == 3777 connp->conn_sqp) { 3778 /* 3779 * We optimize by not calling an SQUEUE_ENTER 3780 * on the listener since we know that the 3781 * listener and eager squeues are the same. 3782 * We are able to make this check safely only 3783 * because neither the eager nor the listener 3784 * can change its squeue. Only an active connect 3785 * can change its squeue 3786 */ 3787 tcp_send_conn_ind(listener->tcp_connp, mp, 3788 listener->tcp_connp->conn_sqp); 3789 CONN_DEC_REF(listener->tcp_connp); 3790 } else if (!tcp->tcp_loopback) { 3791 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 3792 mp, tcp_send_conn_ind, 3793 listener->tcp_connp, NULL, SQ_FILL, 3794 SQTAG_TCP_CONN_IND); 3795 } else { 3796 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp, 3797 mp, tcp_send_conn_ind, 3798 listener->tcp_connp, NULL, SQ_NODRAIN, 3799 SQTAG_TCP_CONN_IND); 3800 } 3801 /* 3802 * For passive open, trace receipt of final ACK as 3803 * tcp:::accept-established. 3804 */ 3805 DTRACE_TCP5(accept__established, mlbk_t *, NULL, 3806 ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *, 3807 iphdr, tcp_t *, tcp, tcph_t *, tcpha); 3808 } 3809 TCPS_CONN_INC(tcps); 3810 3811 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */ 3812 bytes_acked--; 3813 /* SYN was acked - making progress */ 3814 tcp->tcp_ip_forward_progress = B_TRUE; 3815 3816 /* 3817 * If SYN was retransmitted, need to reset all 3818 * retransmission info as this segment will be 3819 * treated as a dup ACK. 3820 */ 3821 if (tcp->tcp_rexmit) { 3822 tcp->tcp_rexmit = B_FALSE; 3823 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 3824 tcp->tcp_rexmit_max = tcp->tcp_snxt; 3825 tcp->tcp_ms_we_have_waited = 0; 3826 tcp->tcp_cwnd = mss; 3827 } 3828 3829 /* 3830 * We set the send window to zero here. 3831 * This is needed if there is data to be 3832 * processed already on the queue. 3833 * Later (at swnd_update label), the 3834 * "new_swnd > tcp_swnd" condition is satisfied 3835 * the XMIT_NEEDED flag is set in the current 3836 * (SYN_RCVD) state. This ensures tcp_wput_data() is 3837 * called if there is already data on queue in 3838 * this state. 3839 */ 3840 tcp->tcp_swnd = 0; 3841 3842 if (new_swnd > tcp->tcp_max_swnd) 3843 tcp->tcp_max_swnd = new_swnd; 3844 tcp->tcp_swl1 = seg_seq; 3845 tcp->tcp_swl2 = seg_ack; 3846 tcp->tcp_valid_bits &= ~TCP_ISS_VALID; 3847 3848 /* Trace change from SYN_RCVD -> ESTABLISHED here */ 3849 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *, 3850 connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL, 3851 int32_t, TCPS_SYN_RCVD); 3852 3853 /* Fuse when both sides are in ESTABLISHED state */ 3854 if (tcp->tcp_loopback && do_tcp_fusion) 3855 tcp_fuse(tcp, iphdr, tcpha); 3856 3857 } 3858 /* This code follows 4.4BSD-Lite2 mostly. */ 3859 if (bytes_acked < 0) 3860 goto est; 3861 3862 /* 3863 * If TCP is ECN capable and the congestion experience bit is 3864 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be 3865 * done once per window (or more loosely, per RTT). 3866 */ 3867 if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max)) 3868 tcp->tcp_cwr = B_FALSE; 3869 if (tcp->tcp_ecn_ok && (flags & TH_ECE)) { 3870 if (!tcp->tcp_cwr) { 3871 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss; 3872 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss; 3873 tcp->tcp_cwnd = npkt * mss; 3874 /* 3875 * If the cwnd is 0, use the timer to clock out 3876 * new segments. This is required by the ECN spec. 3877 */ 3878 if (npkt == 0) { 3879 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 3880 /* 3881 * This makes sure that when the ACK comes 3882 * back, we will increase tcp_cwnd by 1 MSS. 3883 */ 3884 tcp->tcp_cwnd_cnt = 0; 3885 } 3886 tcp->tcp_cwr = B_TRUE; 3887 /* 3888 * This marks the end of the current window of in 3889 * flight data. That is why we don't use 3890 * tcp_suna + tcp_swnd. Only data in flight can 3891 * provide ECN info. 3892 */ 3893 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 3894 tcp->tcp_ecn_cwr_sent = B_FALSE; 3895 } 3896 } 3897 3898 mp1 = tcp->tcp_xmit_head; 3899 if (bytes_acked == 0) { 3900 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) { 3901 int dupack_cnt; 3902 3903 TCPS_BUMP_MIB(tcps, tcpInDupAck); 3904 /* 3905 * Fast retransmit. When we have seen exactly three 3906 * identical ACKs while we have unacked data 3907 * outstanding we take it as a hint that our peer 3908 * dropped something. 3909 * 3910 * If TCP is retransmitting, don't do fast retransmit. 3911 */ 3912 if (mp1 && tcp->tcp_suna != tcp->tcp_snxt && 3913 ! tcp->tcp_rexmit) { 3914 /* Do Limited Transmit */ 3915 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) < 3916 tcps->tcps_dupack_fast_retransmit) { 3917 /* 3918 * RFC 3042 3919 * 3920 * What we need to do is temporarily 3921 * increase tcp_cwnd so that new 3922 * data can be sent if it is allowed 3923 * by the receive window (tcp_rwnd). 3924 * tcp_wput_data() will take care of 3925 * the rest. 3926 * 3927 * If the connection is SACK capable, 3928 * only do limited xmit when there 3929 * is SACK info. 3930 * 3931 * Note how tcp_cwnd is incremented. 3932 * The first dup ACK will increase 3933 * it by 1 MSS. The second dup ACK 3934 * will increase it by 2 MSS. This 3935 * means that only 1 new segment will 3936 * be sent for each dup ACK. 3937 */ 3938 if (tcp->tcp_unsent > 0 && 3939 (!tcp->tcp_snd_sack_ok || 3940 (tcp->tcp_snd_sack_ok && 3941 tcp->tcp_notsack_list != NULL))) { 3942 tcp->tcp_cwnd += mss << 3943 (tcp->tcp_dupack_cnt - 1); 3944 flags |= TH_LIMIT_XMIT; 3945 } 3946 } else if (dupack_cnt == 3947 tcps->tcps_dupack_fast_retransmit) { 3948 3949 /* 3950 * If we have reduced tcp_ssthresh 3951 * because of ECN, do not reduce it again 3952 * unless it is already one window of data 3953 * away. After one window of data, tcp_cwr 3954 * should then be cleared. Note that 3955 * for non ECN capable connection, tcp_cwr 3956 * should always be false. 3957 * 3958 * Adjust cwnd since the duplicate 3959 * ack indicates that a packet was 3960 * dropped (due to congestion.) 3961 */ 3962 if (!tcp->tcp_cwr) { 3963 npkt = ((tcp->tcp_snxt - 3964 tcp->tcp_suna) >> 1) / mss; 3965 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * 3966 mss; 3967 tcp->tcp_cwnd = (npkt + 3968 tcp->tcp_dupack_cnt) * mss; 3969 } 3970 if (tcp->tcp_ecn_ok) { 3971 tcp->tcp_cwr = B_TRUE; 3972 tcp->tcp_cwr_snd_max = tcp->tcp_snxt; 3973 tcp->tcp_ecn_cwr_sent = B_FALSE; 3974 } 3975 3976 /* 3977 * We do Hoe's algorithm. Refer to her 3978 * paper "Improving the Start-up Behavior 3979 * of a Congestion Control Scheme for TCP," 3980 * appeared in SIGCOMM'96. 3981 * 3982 * Save highest seq no we have sent so far. 3983 * Be careful about the invisible FIN byte. 3984 */ 3985 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) && 3986 (tcp->tcp_unsent == 0)) { 3987 tcp->tcp_rexmit_max = tcp->tcp_fss; 3988 } else { 3989 tcp->tcp_rexmit_max = tcp->tcp_snxt; 3990 } 3991 3992 /* 3993 * For SACK: 3994 * Calculate tcp_pipe, which is the 3995 * estimated number of bytes in 3996 * network. 3997 * 3998 * tcp_fack is the highest sack'ed seq num 3999 * TCP has received. 4000 * 4001 * tcp_pipe is explained in the above quoted 4002 * Fall and Floyd's paper. tcp_fack is 4003 * explained in Mathis and Mahdavi's 4004 * "Forward Acknowledgment: Refining TCP 4005 * Congestion Control" in SIGCOMM '96. 4006 */ 4007 if (tcp->tcp_snd_sack_ok) { 4008 if (tcp->tcp_notsack_list != NULL) { 4009 tcp->tcp_pipe = tcp->tcp_snxt - 4010 tcp->tcp_fack; 4011 tcp->tcp_sack_snxt = seg_ack; 4012 flags |= TH_NEED_SACK_REXMIT; 4013 } else { 4014 /* 4015 * Always initialize tcp_pipe 4016 * even though we don't have 4017 * any SACK info. If later 4018 * we get SACK info and 4019 * tcp_pipe is not initialized, 4020 * funny things will happen. 4021 */ 4022 tcp->tcp_pipe = 4023 tcp->tcp_cwnd_ssthresh; 4024 } 4025 } else { 4026 flags |= TH_REXMIT_NEEDED; 4027 } /* tcp_snd_sack_ok */ 4028 4029 } else { 4030 /* 4031 * Here we perform congestion 4032 * avoidance, but NOT slow start. 4033 * This is known as the Fast 4034 * Recovery Algorithm. 4035 */ 4036 if (tcp->tcp_snd_sack_ok && 4037 tcp->tcp_notsack_list != NULL) { 4038 flags |= TH_NEED_SACK_REXMIT; 4039 tcp->tcp_pipe -= mss; 4040 if (tcp->tcp_pipe < 0) 4041 tcp->tcp_pipe = 0; 4042 } else { 4043 /* 4044 * We know that one more packet has 4045 * left the pipe thus we can update 4046 * cwnd. 4047 */ 4048 cwnd = tcp->tcp_cwnd + mss; 4049 if (cwnd > tcp->tcp_cwnd_max) 4050 cwnd = tcp->tcp_cwnd_max; 4051 tcp->tcp_cwnd = cwnd; 4052 if (tcp->tcp_unsent > 0) 4053 flags |= TH_XMIT_NEEDED; 4054 } 4055 } 4056 } 4057 } else if (tcp->tcp_zero_win_probe) { 4058 /* 4059 * If the window has opened, need to arrange 4060 * to send additional data. 4061 */ 4062 if (new_swnd != 0) { 4063 /* tcp_suna != tcp_snxt */ 4064 /* Packet contains a window update */ 4065 TCPS_BUMP_MIB(tcps, tcpInWinUpdate); 4066 tcp->tcp_zero_win_probe = 0; 4067 tcp->tcp_timer_backoff = 0; 4068 tcp->tcp_ms_we_have_waited = 0; 4069 4070 /* 4071 * Transmit starting with tcp_suna since 4072 * the one byte probe is not ack'ed. 4073 * If TCP has sent more than one identical 4074 * probe, tcp_rexmit will be set. That means 4075 * tcp_ss_rexmit() will send out the one 4076 * byte along with new data. Otherwise, 4077 * fake the retransmission. 4078 */ 4079 flags |= TH_XMIT_NEEDED; 4080 if (!tcp->tcp_rexmit) { 4081 tcp->tcp_rexmit = B_TRUE; 4082 tcp->tcp_dupack_cnt = 0; 4083 tcp->tcp_rexmit_nxt = tcp->tcp_suna; 4084 tcp->tcp_rexmit_max = tcp->tcp_suna + 1; 4085 } 4086 } 4087 } 4088 goto swnd_update; 4089 } 4090 4091 /* 4092 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73. 4093 * If the ACK value acks something that we have not yet sent, it might 4094 * be an old duplicate segment. Send an ACK to re-synchronize the 4095 * other side. 4096 * Note: reset in response to unacceptable ACK in SYN_RECEIVE 4097 * state is handled above, so we can always just drop the segment and 4098 * send an ACK here. 4099 * 4100 * In the case where the peer shrinks the window, we see the new window 4101 * update, but all the data sent previously is queued up by the peer. 4102 * To account for this, in tcp_process_shrunk_swnd(), the sequence 4103 * number, which was already sent, and within window, is recorded. 4104 * tcp_snxt is then updated. 4105 * 4106 * If the window has previously shrunk, and an ACK for data not yet 4107 * sent, according to tcp_snxt is recieved, it may still be valid. If 4108 * the ACK is for data within the window at the time the window was 4109 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to 4110 * the sequence number ACK'ed. 4111 * 4112 * If the ACK covers all the data sent at the time the window was 4113 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE. 4114 * 4115 * Should we send ACKs in response to ACK only segments? 4116 */ 4117 4118 if (SEQ_GT(seg_ack, tcp->tcp_snxt)) { 4119 if ((tcp->tcp_is_wnd_shrnk) && 4120 (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) { 4121 uint32_t data_acked_ahead_snxt; 4122 4123 data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt; 4124 tcp_update_xmit_tail(tcp, seg_ack); 4125 tcp->tcp_unsent -= data_acked_ahead_snxt; 4126 } else { 4127 TCPS_BUMP_MIB(tcps, tcpInAckUnsent); 4128 /* drop the received segment */ 4129 freemsg(mp); 4130 4131 /* 4132 * Send back an ACK. If tcp_drop_ack_unsent_cnt is 4133 * greater than 0, check if the number of such 4134 * bogus ACks is greater than that count. If yes, 4135 * don't send back any ACK. This prevents TCP from 4136 * getting into an ACK storm if somehow an attacker 4137 * successfully spoofs an acceptable segment to our 4138 * peer. If this continues (count > 2 X threshold), 4139 * we should abort this connection. 4140 */ 4141 if (tcp_drop_ack_unsent_cnt > 0 && 4142 ++tcp->tcp_in_ack_unsent > 4143 tcp_drop_ack_unsent_cnt) { 4144 TCP_STAT(tcps, tcp_in_ack_unsent_drop); 4145 if (tcp->tcp_in_ack_unsent > 2 * 4146 tcp_drop_ack_unsent_cnt) { 4147 (void) tcp_clean_death(tcp, EPROTO); 4148 } 4149 return; 4150 } 4151 mp = tcp_ack_mp(tcp); 4152 if (mp != NULL) { 4153 TCPS_BUMP_MIB(tcps, tcpHCOutSegs); 4154 TCPS_BUMP_MIB(tcps, tcpOutAck); 4155 tcp_send_data(tcp, mp); 4156 } 4157 return; 4158 } 4159 } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack, 4160 tcp->tcp_snxt_shrunk)) { 4161 tcp->tcp_is_wnd_shrnk = B_FALSE; 4162 } 4163 4164 /* 4165 * TCP gets a new ACK, update the notsack'ed list to delete those 4166 * blocks that are covered by this ACK. 4167 */ 4168 if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) { 4169 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack, 4170 &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list)); 4171 } 4172 4173 /* 4174 * If we got an ACK after fast retransmit, check to see 4175 * if it is a partial ACK. If it is not and the congestion 4176 * window was inflated to account for the other side's 4177 * cached packets, retract it. If it is, do Hoe's algorithm. 4178 */ 4179 if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) { 4180 ASSERT(tcp->tcp_rexmit == B_FALSE); 4181 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) { 4182 tcp->tcp_dupack_cnt = 0; 4183 /* 4184 * Restore the orig tcp_cwnd_ssthresh after 4185 * fast retransmit phase. 4186 */ 4187 if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) { 4188 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh; 4189 } 4190 tcp->tcp_rexmit_max = seg_ack; 4191 tcp->tcp_cwnd_cnt = 0; 4192 4193 /* 4194 * Remove all notsack info to avoid confusion with 4195 * the next fast retrasnmit/recovery phase. 4196 */ 4197 if (tcp->tcp_snd_sack_ok) { 4198 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list, 4199 tcp); 4200 } 4201 } else { 4202 if (tcp->tcp_snd_sack_ok && 4203 tcp->tcp_notsack_list != NULL) { 4204 flags |= TH_NEED_SACK_REXMIT; 4205 tcp->tcp_pipe -= mss; 4206 if (tcp->tcp_pipe < 0) 4207 tcp->tcp_pipe = 0; 4208 } else { 4209 /* 4210 * Hoe's algorithm: 4211 * 4212 * Retransmit the unack'ed segment and 4213 * restart fast recovery. Note that we 4214 * need to scale back tcp_cwnd to the 4215 * original value when we started fast 4216 * recovery. This is to prevent overly 4217 * aggressive behaviour in sending new 4218 * segments. 4219 */ 4220 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh + 4221 tcps->tcps_dupack_fast_retransmit * mss; 4222 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd; 4223 flags |= TH_REXMIT_NEEDED; 4224 } 4225 } 4226 } else { 4227 tcp->tcp_dupack_cnt = 0; 4228 if (tcp->tcp_rexmit) { 4229 /* 4230 * TCP is retranmitting. If the ACK ack's all 4231 * outstanding data, update tcp_rexmit_max and 4232 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt 4233 * to the correct value. 4234 * 4235 * Note that SEQ_LEQ() is used. This is to avoid 4236 * unnecessary fast retransmit caused by dup ACKs 4237 * received when TCP does slow start retransmission 4238 * after a time out. During this phase, TCP may 4239 * send out segments which are already received. 4240 * This causes dup ACKs to be sent back. 4241 */ 4242 if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) { 4243 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) { 4244 tcp->tcp_rexmit_nxt = seg_ack; 4245 } 4246 if (seg_ack != tcp->tcp_rexmit_max) { 4247 flags |= TH_XMIT_NEEDED; 4248 } 4249 } else { 4250 tcp->tcp_rexmit = B_FALSE; 4251 tcp->tcp_rexmit_nxt = tcp->tcp_snxt; 4252 } 4253 tcp->tcp_ms_we_have_waited = 0; 4254 } 4255 } 4256 4257 TCPS_BUMP_MIB(tcps, tcpInAckSegs); 4258 TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked); 4259 tcp->tcp_suna = seg_ack; 4260 if (tcp->tcp_zero_win_probe != 0) { 4261 tcp->tcp_zero_win_probe = 0; 4262 tcp->tcp_timer_backoff = 0; 4263 } 4264 4265 /* 4266 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed. 4267 * Note that it cannot be the SYN being ack'ed. The code flow 4268 * will not reach here. 4269 */ 4270 if (mp1 == NULL) { 4271 goto fin_acked; 4272 } 4273 4274 /* 4275 * Update the congestion window. 4276 * 4277 * If TCP is not ECN capable or TCP is ECN capable but the 4278 * congestion experience bit is not set, increase the tcp_cwnd as 4279 * usual. 4280 */ 4281 if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) { 4282 cwnd = tcp->tcp_cwnd; 4283 add = mss; 4284 4285 if (cwnd >= tcp->tcp_cwnd_ssthresh) { 4286 /* 4287 * This is to prevent an increase of less than 1 MSS of 4288 * tcp_cwnd. With partial increase, tcp_wput_data() 4289 * may send out tinygrams in order to preserve mblk 4290 * boundaries. 4291 * 4292 * By initializing tcp_cwnd_cnt to new tcp_cwnd and 4293 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is 4294 * increased by 1 MSS for every RTTs. 4295 */ 4296 if (tcp->tcp_cwnd_cnt <= 0) { 4297 tcp->tcp_cwnd_cnt = cwnd + add; 4298 } else { 4299 tcp->tcp_cwnd_cnt -= add; 4300 add = 0; 4301 } 4302 } 4303 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max); 4304 } 4305 4306 /* See if the latest urgent data has been acknowledged */ 4307 if ((tcp->tcp_valid_bits & TCP_URG_VALID) && 4308 SEQ_GT(seg_ack, tcp->tcp_urg)) 4309 tcp->tcp_valid_bits &= ~TCP_URG_VALID; 4310 4311 /* 4312 * Update the RTT estimates. Note that we don't use the TCP 4313 * timestamp option to calculate RTT even if one is present. This is 4314 * because the timestamp option's resolution (CPU tick) is 4315 * too coarse to measure modern datacenter networks' microsecond 4316 * latencies. The timestamp field's resolution is limited by its 4317 * 4-byte width (see RFC1323), and since we always store a 4318 * high-resolution nanosecond presision timestamp along with the data, 4319 * there is no point to ever using the timestamp option. 4320 */ 4321 if (SEQ_GT(seg_ack, tcp->tcp_csuna)) { 4322 /* 4323 * An ACK sequence we haven't seen before, so get the RTT 4324 * and update the RTO. But first check if the timestamp is 4325 * valid to use. 4326 */ 4327 if ((mp1->b_next != NULL) && 4328 SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next))) { 4329 tcp_set_rto(tcp, gethrtime() - 4330 (hrtime_t)(intptr_t)mp1->b_prev); 4331 } else { 4332 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate); 4333 } 4334 4335 /* Remeber the last sequence to be ACKed */ 4336 tcp->tcp_csuna = seg_ack; 4337 if (tcp->tcp_set_timer == 1) { 4338 TCP_TIMER_RESTART(tcp, tcp->tcp_rto); 4339 tcp->tcp_set_timer = 0; 4340 } 4341 } else { 4342 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate); 4343 } 4344 4345 /* Eat acknowledged bytes off the xmit queue. */ 4346 for (;;) { 4347 mblk_t *mp2; 4348 uchar_t *wptr; 4349 4350 wptr = mp1->b_wptr; 4351 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX); 4352 bytes_acked -= (int)(wptr - mp1->b_rptr); 4353 if (bytes_acked < 0) { 4354 mp1->b_rptr = wptr + bytes_acked; 4355 /* 4356 * Set a new timestamp if all the bytes timed by the 4357 * old timestamp have been ack'ed. 4358 */ 4359 if (SEQ_GT(seg_ack, 4360 (uint32_t)(uintptr_t)(mp1->b_next))) { 4361 mp1->b_prev = 4362 (mblk_t *)(intptr_t)gethrtime(); 4363 mp1->b_next = NULL; 4364 } 4365 break; 4366 } 4367 mp1->b_next = NULL; 4368 mp1->b_prev = NULL; 4369 mp2 = mp1; 4370 mp1 = mp1->b_cont; 4371 4372 /* 4373 * This notification is required for some zero-copy 4374 * clients to maintain a copy semantic. After the data 4375 * is ack'ed, client is safe to modify or reuse the buffer. 4376 */ 4377 if (tcp->tcp_snd_zcopy_aware && 4378 (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY)) 4379 tcp_zcopy_notify(tcp); 4380 freeb(mp2); 4381 if (bytes_acked == 0) { 4382 if (mp1 == NULL) { 4383 /* Everything is ack'ed, clear the tail. */ 4384 tcp->tcp_xmit_tail = NULL; 4385 /* 4386 * Cancel the timer unless we are still 4387 * waiting for an ACK for the FIN packet. 4388 */ 4389 if (tcp->tcp_timer_tid != 0 && 4390 tcp->tcp_snxt == tcp->tcp_suna) { 4391 (void) TCP_TIMER_CANCEL(tcp, 4392 tcp->tcp_timer_tid); 4393 tcp->tcp_timer_tid = 0; 4394 } 4395 goto pre_swnd_update; 4396 } 4397 if (mp2 != tcp->tcp_xmit_tail) 4398 break; 4399 tcp->tcp_xmit_tail = mp1; 4400 ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <= 4401 (uintptr_t)INT_MAX); 4402 tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr - 4403 mp1->b_rptr); 4404 break; 4405 } 4406 if (mp1 == NULL) { 4407 /* 4408 * More was acked but there is nothing more 4409 * outstanding. This means that the FIN was 4410 * just acked or that we're talking to a clown. 4411 */ 4412 fin_acked: 4413 ASSERT(tcp->tcp_fin_sent); 4414 tcp->tcp_xmit_tail = NULL; 4415 if (tcp->tcp_fin_sent) { 4416 /* FIN was acked - making progress */ 4417 if (!tcp->tcp_fin_acked) 4418 tcp->tcp_ip_forward_progress = B_TRUE; 4419 tcp->tcp_fin_acked = B_TRUE; 4420 if (tcp->tcp_linger_tid != 0 && 4421 TCP_TIMER_CANCEL(tcp, 4422 tcp->tcp_linger_tid) >= 0) { 4423 tcp_stop_lingering(tcp); 4424 freemsg(mp); 4425 mp = NULL; 4426 } 4427 } else { 4428 /* 4429 * We should never get here because 4430 * we have already checked that the 4431 * number of bytes ack'ed should be 4432 * smaller than or equal to what we 4433 * have sent so far (it is the 4434 * acceptability check of the ACK). 4435 * We can only get here if the send 4436 * queue is corrupted. 4437 * 4438 * Terminate the connection and 4439 * panic the system. It is better 4440 * for us to panic instead of 4441 * continuing to avoid other disaster. 4442 */ 4443 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt, 4444 tcp->tcp_rnxt, TH_RST|TH_ACK); 4445 panic("Memory corruption " 4446 "detected for connection %s.", 4447 tcp_display(tcp, NULL, 4448 DISP_ADDR_AND_PORT)); 4449 /*NOTREACHED*/ 4450 } 4451 goto pre_swnd_update; 4452 } 4453 ASSERT(mp2 != tcp->tcp_xmit_tail); 4454 } 4455 if (tcp->tcp_unsent) { 4456 flags |= TH_XMIT_NEEDED; 4457 } 4458 pre_swnd_update: 4459 tcp->tcp_xmit_head = mp1; 4460 swnd_update: 4461 /* 4462 * The following check is different from most other implementations. 4463 * For bi-directional transfer, when segments are dropped, the 4464 * "normal" check will not accept a window update in those 4465 * retransmitted segemnts. Failing to do that, TCP may send out 4466 * segments which are outside receiver's window. As TCP accepts 4467 * the ack in those retransmitted segments, if the window update in 4468 * the same segment is not accepted, TCP will incorrectly calculates 4469 * that it can send more segments. This can create a deadlock 4470 * with the receiver if its window becomes zero. 4471 */ 4472 if (SEQ_LT(tcp->tcp_swl2, seg_ack) || 4473 SEQ_LT(tcp->tcp_swl1, seg_seq) || 4474 (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) { 4475 /* 4476 * The criteria for update is: 4477 * 4478 * 1. the segment acknowledges some data. Or 4479 * 2. the segment is new, i.e. it has a higher seq num. Or 4480 * 3. the segment is not old and the advertised window is 4481 * larger than the previous advertised window. 4482 */ 4483 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd) 4484 flags |= TH_XMIT_NEEDED; 4485 tcp->tcp_swnd = new_swnd; 4486 if (new_swnd > tcp->tcp_max_swnd) 4487 tcp->tcp_max_swnd = new_swnd; 4488 tcp->tcp_swl1 = seg_seq; 4489 tcp->tcp_swl2 = seg_ack; 4490 } 4491 est: 4492 if (tcp->tcp_state > TCPS_ESTABLISHED) { 4493 4494 switch (tcp->tcp_state) { 4495 case TCPS_FIN_WAIT_1: 4496 if (tcp->tcp_fin_acked) { 4497 tcp->tcp_state = TCPS_FIN_WAIT_2; 4498 DTRACE_TCP6(state__change, void, NULL, 4499 ip_xmit_attr_t *, connp->conn_ixa, 4500 void, NULL, tcp_t *, tcp, void, NULL, 4501 int32_t, TCPS_FIN_WAIT_1); 4502 /* 4503 * We implement the non-standard BSD/SunOS 4504 * FIN_WAIT_2 flushing algorithm. 4505 * If there is no user attached to this 4506 * TCP endpoint, then this TCP struct 4507 * could hang around forever in FIN_WAIT_2 4508 * state if the peer forgets to send us 4509 * a FIN. To prevent this, we wait only 4510 * 2*MSL (a convenient time value) for 4511 * the FIN to arrive. If it doesn't show up, 4512 * we flush the TCP endpoint. This algorithm, 4513 * though a violation of RFC-793, has worked 4514 * for over 10 years in BSD systems. 4515 * Note: SunOS 4.x waits 675 seconds before 4516 * flushing the FIN_WAIT_2 connection. 4517 */ 4518 TCP_TIMER_RESTART(tcp, 4519 tcp->tcp_fin_wait_2_flush_interval); 4520 } 4521 break; 4522 case TCPS_FIN_WAIT_2: 4523 break; /* Shutdown hook? */ 4524 case TCPS_LAST_ACK: 4525 freemsg(mp); 4526 if (tcp->tcp_fin_acked) { 4527 (void) tcp_clean_death(tcp, 0); 4528 return; 4529 } 4530 goto xmit_check; 4531 case TCPS_CLOSING: 4532 if (tcp->tcp_fin_acked) { 4533 SET_TIME_WAIT(tcps, tcp, connp); 4534 DTRACE_TCP6(state__change, void, NULL, 4535 ip_xmit_attr_t *, connp->conn_ixa, void, 4536 NULL, tcp_t *, tcp, void, NULL, int32_t, 4537 TCPS_CLOSING); 4538 } 4539 /*FALLTHRU*/ 4540 case TCPS_CLOSE_WAIT: 4541 freemsg(mp); 4542 goto xmit_check; 4543 default: 4544 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT); 4545 break; 4546 } 4547 } 4548 if (flags & TH_FIN) { 4549 /* Make sure we ack the fin */ 4550 flags |= TH_ACK_NEEDED; 4551 if (!tcp->tcp_fin_rcvd) { 4552 tcp->tcp_fin_rcvd = B_TRUE; 4553 tcp->tcp_rnxt++; 4554 tcpha = tcp->tcp_tcpha; 4555 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 4556 4557 /* 4558 * Generate the ordrel_ind at the end unless the 4559 * conn is detached or it is a STREAMS based eager. 4560 * In the eager case we defer the notification until 4561 * tcp_accept_finish has run. 4562 */ 4563 if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) || 4564 (tcp->tcp_listener == NULL && 4565 !tcp->tcp_hard_binding))) 4566 flags |= TH_ORDREL_NEEDED; 4567 switch (tcp->tcp_state) { 4568 case TCPS_SYN_RCVD: 4569 tcp->tcp_state = TCPS_CLOSE_WAIT; 4570 DTRACE_TCP6(state__change, void, NULL, 4571 ip_xmit_attr_t *, connp->conn_ixa, 4572 void, NULL, tcp_t *, tcp, void, NULL, 4573 int32_t, TCPS_SYN_RCVD); 4574 /* Keepalive? */ 4575 break; 4576 case TCPS_ESTABLISHED: 4577 tcp->tcp_state = TCPS_CLOSE_WAIT; 4578 DTRACE_TCP6(state__change, void, NULL, 4579 ip_xmit_attr_t *, connp->conn_ixa, 4580 void, NULL, tcp_t *, tcp, void, NULL, 4581 int32_t, TCPS_ESTABLISHED); 4582 /* Keepalive? */ 4583 break; 4584 case TCPS_FIN_WAIT_1: 4585 if (!tcp->tcp_fin_acked) { 4586 tcp->tcp_state = TCPS_CLOSING; 4587 DTRACE_TCP6(state__change, void, NULL, 4588 ip_xmit_attr_t *, connp->conn_ixa, 4589 void, NULL, tcp_t *, tcp, void, 4590 NULL, int32_t, TCPS_FIN_WAIT_1); 4591 break; 4592 } 4593 /* FALLTHRU */ 4594 case TCPS_FIN_WAIT_2: 4595 SET_TIME_WAIT(tcps, tcp, connp); 4596 DTRACE_TCP6(state__change, void, NULL, 4597 ip_xmit_attr_t *, connp->conn_ixa, void, 4598 NULL, tcp_t *, tcp, void, NULL, int32_t, 4599 TCPS_FIN_WAIT_2); 4600 if (seg_len) { 4601 /* 4602 * implies data piggybacked on FIN. 4603 * break to handle data. 4604 */ 4605 break; 4606 } 4607 freemsg(mp); 4608 goto ack_check; 4609 } 4610 } 4611 } 4612 if (mp == NULL) 4613 goto xmit_check; 4614 if (seg_len == 0) { 4615 freemsg(mp); 4616 goto xmit_check; 4617 } 4618 if (mp->b_rptr == mp->b_wptr) { 4619 /* 4620 * The header has been consumed, so we remove the 4621 * zero-length mblk here. 4622 */ 4623 mp1 = mp; 4624 mp = mp->b_cont; 4625 freeb(mp1); 4626 } 4627 update_ack: 4628 tcpha = tcp->tcp_tcpha; 4629 tcp->tcp_rack_cnt++; 4630 { 4631 uint32_t cur_max; 4632 4633 cur_max = tcp->tcp_rack_cur_max; 4634 if (tcp->tcp_rack_cnt >= cur_max) { 4635 /* 4636 * We have more unacked data than we should - send 4637 * an ACK now. 4638 */ 4639 flags |= TH_ACK_NEEDED; 4640 cur_max++; 4641 if (cur_max > tcp->tcp_rack_abs_max) 4642 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max; 4643 else 4644 tcp->tcp_rack_cur_max = cur_max; 4645 } else if (TCP_IS_DETACHED(tcp)) { 4646 /* We don't have an ACK timer for detached TCP. */ 4647 flags |= TH_ACK_NEEDED; 4648 } else if (seg_len < mss) { 4649 /* 4650 * If we get a segment that is less than an mss, and we 4651 * already have unacknowledged data, and the amount 4652 * unacknowledged is not a multiple of mss, then we 4653 * better generate an ACK now. Otherwise, this may be 4654 * the tail piece of a transaction, and we would rather 4655 * wait for the response. 4656 */ 4657 uint32_t udif; 4658 ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <= 4659 (uintptr_t)INT_MAX); 4660 udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack); 4661 if (udif && (udif % mss)) 4662 flags |= TH_ACK_NEEDED; 4663 else 4664 flags |= TH_ACK_TIMER_NEEDED; 4665 } else { 4666 /* Start delayed ack timer */ 4667 flags |= TH_ACK_TIMER_NEEDED; 4668 } 4669 } 4670 tcp->tcp_rnxt += seg_len; 4671 tcpha->tha_ack = htonl(tcp->tcp_rnxt); 4672 4673 if (mp == NULL) 4674 goto xmit_check; 4675 4676 /* Update SACK list */ 4677 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) { 4678 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt, 4679 &(tcp->tcp_num_sack_blk)); 4680 } 4681 4682 if (tcp->tcp_urp_mp) { 4683 tcp->tcp_urp_mp->b_cont = mp; 4684 mp = tcp->tcp_urp_mp; 4685 tcp->tcp_urp_mp = NULL; 4686 /* Ready for a new signal. */ 4687 tcp->tcp_urp_last_valid = B_FALSE; 4688 #ifdef DEBUG 4689 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4690 "tcp_rput: sending exdata_ind %s", 4691 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 4692 #endif /* DEBUG */ 4693 } 4694 4695 /* 4696 * Check for ancillary data changes compared to last segment. 4697 */ 4698 if (connp->conn_recv_ancillary.crb_all != 0) { 4699 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira); 4700 if (mp == NULL) 4701 return; 4702 } 4703 4704 if (IPCL_IS_NONSTR(connp)) { 4705 /* 4706 * Non-STREAMS socket 4707 */ 4708 boolean_t push = flags & (TH_PUSH|TH_FIN); 4709 int error; 4710 4711 if ((*sockupcalls->su_recv)(connp->conn_upper_handle, 4712 mp, seg_len, 0, &error, &push) <= 0) { 4713 /* 4714 * We should never be in middle of a 4715 * fallback, the squeue guarantees that. 4716 */ 4717 ASSERT(error != EOPNOTSUPP); 4718 if (error == ENOSPC) 4719 tcp->tcp_rwnd -= seg_len; 4720 } else if (push) { 4721 /* PUSH bit set and sockfs is not flow controlled */ 4722 flags |= tcp_rwnd_reopen(tcp); 4723 } 4724 } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) { 4725 /* 4726 * Side queue inbound data until the accept happens. 4727 * tcp_accept/tcp_rput drains this when the accept happens. 4728 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or 4729 * T_EXDATA_IND) it is queued on b_next. 4730 * XXX Make urgent data use this. Requires: 4731 * Removing tcp_listener check for TH_URG 4732 * Making M_PCPROTO and MARK messages skip the eager case 4733 */ 4734 4735 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 4736 } else { 4737 /* Active STREAMS socket */ 4738 if (mp->b_datap->db_type != M_DATA || 4739 (flags & TH_MARKNEXT_NEEDED)) { 4740 if (tcp->tcp_rcv_list != NULL) { 4741 flags |= tcp_rcv_drain(tcp); 4742 } 4743 ASSERT(tcp->tcp_rcv_list == NULL || 4744 tcp->tcp_fused_sigurg); 4745 4746 if (flags & TH_MARKNEXT_NEEDED) { 4747 #ifdef DEBUG 4748 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4749 "tcp_rput: sending MSGMARKNEXT %s", 4750 tcp_display(tcp, NULL, 4751 DISP_PORT_ONLY)); 4752 #endif /* DEBUG */ 4753 mp->b_flag |= MSGMARKNEXT; 4754 flags &= ~TH_MARKNEXT_NEEDED; 4755 } 4756 4757 if (is_system_labeled()) 4758 tcp_setcred_data(mp, ira); 4759 4760 putnext(connp->conn_rq, mp); 4761 if (!canputnext(connp->conn_rq)) 4762 tcp->tcp_rwnd -= seg_len; 4763 } else if ((flags & (TH_PUSH|TH_FIN)) || 4764 tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) { 4765 if (tcp->tcp_rcv_list != NULL) { 4766 /* 4767 * Enqueue the new segment first and then 4768 * call tcp_rcv_drain() to send all data 4769 * up. The other way to do this is to 4770 * send all queued data up and then call 4771 * putnext() to send the new segment up. 4772 * This way can remove the else part later 4773 * on. 4774 * 4775 * We don't do this to avoid one more call to 4776 * canputnext() as tcp_rcv_drain() needs to 4777 * call canputnext(). 4778 */ 4779 tcp_rcv_enqueue(tcp, mp, seg_len, 4780 ira->ira_cred); 4781 flags |= tcp_rcv_drain(tcp); 4782 } else { 4783 if (is_system_labeled()) 4784 tcp_setcred_data(mp, ira); 4785 4786 putnext(connp->conn_rq, mp); 4787 if (!canputnext(connp->conn_rq)) 4788 tcp->tcp_rwnd -= seg_len; 4789 } 4790 } else { 4791 /* 4792 * Enqueue all packets when processing an mblk 4793 * from the co queue and also enqueue normal packets. 4794 */ 4795 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred); 4796 } 4797 /* 4798 * Make sure the timer is running if we have data waiting 4799 * for a push bit. This provides resiliency against 4800 * implementations that do not correctly generate push bits. 4801 */ 4802 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) { 4803 /* 4804 * The connection may be closed at this point, so don't 4805 * do anything for a detached tcp. 4806 */ 4807 if (!TCP_IS_DETACHED(tcp)) 4808 tcp->tcp_push_tid = TCP_TIMER(tcp, 4809 tcp_push_timer, 4810 tcps->tcps_push_timer_interval); 4811 } 4812 } 4813 4814 xmit_check: 4815 /* Is there anything left to do? */ 4816 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 4817 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED| 4818 TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED| 4819 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 4820 goto done; 4821 4822 /* Any transmit work to do and a non-zero window? */ 4823 if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT| 4824 TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) { 4825 if (flags & TH_REXMIT_NEEDED) { 4826 uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna; 4827 4828 TCPS_BUMP_MIB(tcps, tcpOutFastRetrans); 4829 if (snd_size > mss) 4830 snd_size = mss; 4831 if (snd_size > tcp->tcp_swnd) 4832 snd_size = tcp->tcp_swnd; 4833 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size, 4834 NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size, 4835 B_TRUE); 4836 4837 if (mp1 != NULL) { 4838 tcp->tcp_xmit_head->b_prev = 4839 (mblk_t *)(intptr_t)gethrtime(); 4840 tcp->tcp_csuna = tcp->tcp_snxt; 4841 TCPS_BUMP_MIB(tcps, tcpRetransSegs); 4842 TCPS_UPDATE_MIB(tcps, tcpRetransBytes, 4843 snd_size); 4844 tcp->tcp_cs.tcp_out_retrans_segs++; 4845 tcp->tcp_cs.tcp_out_retrans_bytes += snd_size; 4846 tcp_send_data(tcp, mp1); 4847 } 4848 } 4849 if (flags & TH_NEED_SACK_REXMIT) { 4850 tcp_sack_rexmit(tcp, &flags); 4851 } 4852 /* 4853 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send 4854 * out new segment. Note that tcp_rexmit should not be 4855 * set, otherwise TH_LIMIT_XMIT should not be set. 4856 */ 4857 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) { 4858 if (!tcp->tcp_rexmit) { 4859 tcp_wput_data(tcp, NULL, B_FALSE); 4860 } else { 4861 tcp_ss_rexmit(tcp); 4862 } 4863 } 4864 /* 4865 * Adjust tcp_cwnd back to normal value after sending 4866 * new data segments. 4867 */ 4868 if (flags & TH_LIMIT_XMIT) { 4869 tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1); 4870 /* 4871 * This will restart the timer. Restarting the 4872 * timer is used to avoid a timeout before the 4873 * limited transmitted segment's ACK gets back. 4874 */ 4875 if (tcp->tcp_xmit_head != NULL) { 4876 tcp->tcp_xmit_head->b_prev = 4877 (mblk_t *)(intptr_t)gethrtime(); 4878 } 4879 } 4880 4881 /* Anything more to do? */ 4882 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED| 4883 TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0) 4884 goto done; 4885 } 4886 ack_check: 4887 if (flags & TH_SEND_URP_MARK) { 4888 ASSERT(tcp->tcp_urp_mark_mp); 4889 ASSERT(!IPCL_IS_NONSTR(connp)); 4890 /* 4891 * Send up any queued data and then send the mark message 4892 */ 4893 if (tcp->tcp_rcv_list != NULL) { 4894 flags |= tcp_rcv_drain(tcp); 4895 4896 } 4897 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 4898 mp1 = tcp->tcp_urp_mark_mp; 4899 tcp->tcp_urp_mark_mp = NULL; 4900 if (is_system_labeled()) 4901 tcp_setcred_data(mp1, ira); 4902 4903 putnext(connp->conn_rq, mp1); 4904 #ifdef DEBUG 4905 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE, 4906 "tcp_rput: sending zero-length %s %s", 4907 ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" : 4908 "MSGNOTMARKNEXT"), 4909 tcp_display(tcp, NULL, DISP_PORT_ONLY)); 4910 #endif /* DEBUG */ 4911 flags &= ~TH_SEND_URP_MARK; 4912 } 4913 if (flags & TH_ACK_NEEDED) { 4914 /* 4915 * Time to send an ack for some reason. 4916 */ 4917 mp1 = tcp_ack_mp(tcp); 4918 4919 if (mp1 != NULL) { 4920 tcp_send_data(tcp, mp1); 4921 TCPS_BUMP_MIB(tcps, tcpHCOutSegs); 4922 TCPS_BUMP_MIB(tcps, tcpOutAck); 4923 } 4924 if (tcp->tcp_ack_tid != 0) { 4925 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid); 4926 tcp->tcp_ack_tid = 0; 4927 } 4928 } 4929 if (flags & TH_ACK_TIMER_NEEDED) { 4930 /* 4931 * Arrange for deferred ACK or push wait timeout. 4932 * Start timer if it is not already running. 4933 */ 4934 if (tcp->tcp_ack_tid == 0) { 4935 tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer, 4936 tcp->tcp_localnet ? 4937 tcps->tcps_local_dack_interval : 4938 tcps->tcps_deferred_ack_interval); 4939 } 4940 } 4941 if (flags & TH_ORDREL_NEEDED) { 4942 /* 4943 * Notify upper layer about an orderly release. If this is 4944 * a non-STREAMS socket, then just make an upcall. For STREAMS 4945 * we send up an ordrel_ind, unless this is an eager, in which 4946 * case the ordrel will be sent when tcp_accept_finish runs. 4947 * Note that for non-STREAMS we make an upcall even if it is an 4948 * eager, because we have an upper handle to send it to. 4949 */ 4950 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL); 4951 ASSERT(!tcp->tcp_detached); 4952 4953 if (IPCL_IS_NONSTR(connp)) { 4954 ASSERT(tcp->tcp_ordrel_mp == NULL); 4955 tcp->tcp_ordrel_done = B_TRUE; 4956 (*sockupcalls->su_opctl)(connp->conn_upper_handle, 4957 SOCK_OPCTL_SHUT_RECV, 0); 4958 goto done; 4959 } 4960 4961 if (tcp->tcp_rcv_list != NULL) { 4962 /* 4963 * Push any mblk(s) enqueued from co processing. 4964 */ 4965 flags |= tcp_rcv_drain(tcp); 4966 } 4967 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg); 4968 4969 mp1 = tcp->tcp_ordrel_mp; 4970 tcp->tcp_ordrel_mp = NULL; 4971 tcp->tcp_ordrel_done = B_TRUE; 4972 putnext(connp->conn_rq, mp1); 4973 } 4974 done: 4975 ASSERT(!(flags & TH_MARKNEXT_NEEDED)); 4976 } 4977 4978 /* 4979 * Attach ancillary data to a received TCP segments for the 4980 * ancillary pieces requested by the application that are 4981 * different than they were in the previous data segment. 4982 * 4983 * Save the "current" values once memory allocation is ok so that 4984 * when memory allocation fails we can just wait for the next data segment. 4985 */ 4986 static mblk_t * 4987 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp, 4988 ip_recv_attr_t *ira) 4989 { 4990 struct T_optdata_ind *todi; 4991 int optlen; 4992 uchar_t *optptr; 4993 struct T_opthdr *toh; 4994 crb_t addflag; /* Which pieces to add */ 4995 mblk_t *mp1; 4996 conn_t *connp = tcp->tcp_connp; 4997 4998 optlen = 0; 4999 addflag.crb_all = 0; 5000 /* If app asked for pktinfo and the index has changed ... */ 5001 if (connp->conn_recv_ancillary.crb_ip_recvpktinfo && 5002 ira->ira_ruifindex != tcp->tcp_recvifindex) { 5003 optlen += sizeof (struct T_opthdr) + 5004 sizeof (struct in6_pktinfo); 5005 addflag.crb_ip_recvpktinfo = 1; 5006 } 5007 /* If app asked for hoplimit and it has changed ... */ 5008 if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit && 5009 ipp->ipp_hoplimit != tcp->tcp_recvhops) { 5010 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 5011 addflag.crb_ipv6_recvhoplimit = 1; 5012 } 5013 /* If app asked for tclass and it has changed ... */ 5014 if (connp->conn_recv_ancillary.crb_ipv6_recvtclass && 5015 ipp->ipp_tclass != tcp->tcp_recvtclass) { 5016 optlen += sizeof (struct T_opthdr) + sizeof (uint_t); 5017 addflag.crb_ipv6_recvtclass = 1; 5018 } 5019 /* 5020 * If app asked for hopbyhop headers and it has changed ... 5021 * For security labels, note that (1) security labels can't change on 5022 * a connected socket at all, (2) we're connected to at most one peer, 5023 * (3) if anything changes, then it must be some other extra option. 5024 */ 5025 if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts && 5026 ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen, 5027 (ipp->ipp_fields & IPPF_HOPOPTS), 5028 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) { 5029 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen; 5030 addflag.crb_ipv6_recvhopopts = 1; 5031 if (!ip_allocbuf((void **)&tcp->tcp_hopopts, 5032 &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS), 5033 ipp->ipp_hopopts, ipp->ipp_hopoptslen)) 5034 return (mp); 5035 } 5036 /* If app asked for dst headers before routing headers ... */ 5037 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts && 5038 ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen, 5039 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5040 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) { 5041 optlen += sizeof (struct T_opthdr) + 5042 ipp->ipp_rthdrdstoptslen; 5043 addflag.crb_ipv6_recvrthdrdstopts = 1; 5044 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts, 5045 &tcp->tcp_rthdrdstoptslen, 5046 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5047 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) 5048 return (mp); 5049 } 5050 /* If app asked for routing headers and it has changed ... */ 5051 if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr && 5052 ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen, 5053 (ipp->ipp_fields & IPPF_RTHDR), 5054 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) { 5055 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen; 5056 addflag.crb_ipv6_recvrthdr = 1; 5057 if (!ip_allocbuf((void **)&tcp->tcp_rthdr, 5058 &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR), 5059 ipp->ipp_rthdr, ipp->ipp_rthdrlen)) 5060 return (mp); 5061 } 5062 /* If app asked for dest headers and it has changed ... */ 5063 if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts || 5064 connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) && 5065 ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen, 5066 (ipp->ipp_fields & IPPF_DSTOPTS), 5067 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) { 5068 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen; 5069 addflag.crb_ipv6_recvdstopts = 1; 5070 if (!ip_allocbuf((void **)&tcp->tcp_dstopts, 5071 &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS), 5072 ipp->ipp_dstopts, ipp->ipp_dstoptslen)) 5073 return (mp); 5074 } 5075 5076 if (optlen == 0) { 5077 /* Nothing to add */ 5078 return (mp); 5079 } 5080 mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED); 5081 if (mp1 == NULL) { 5082 /* 5083 * Defer sending ancillary data until the next TCP segment 5084 * arrives. 5085 */ 5086 return (mp); 5087 } 5088 mp1->b_cont = mp; 5089 mp = mp1; 5090 mp->b_wptr += sizeof (*todi) + optlen; 5091 mp->b_datap->db_type = M_PROTO; 5092 todi = (struct T_optdata_ind *)mp->b_rptr; 5093 todi->PRIM_type = T_OPTDATA_IND; 5094 todi->DATA_flag = 1; /* MORE data */ 5095 todi->OPT_length = optlen; 5096 todi->OPT_offset = sizeof (*todi); 5097 optptr = (uchar_t *)&todi[1]; 5098 /* 5099 * If app asked for pktinfo and the index has changed ... 5100 * Note that the local address never changes for the connection. 5101 */ 5102 if (addflag.crb_ip_recvpktinfo) { 5103 struct in6_pktinfo *pkti; 5104 uint_t ifindex; 5105 5106 ifindex = ira->ira_ruifindex; 5107 toh = (struct T_opthdr *)optptr; 5108 toh->level = IPPROTO_IPV6; 5109 toh->name = IPV6_PKTINFO; 5110 toh->len = sizeof (*toh) + sizeof (*pkti); 5111 toh->status = 0; 5112 optptr += sizeof (*toh); 5113 pkti = (struct in6_pktinfo *)optptr; 5114 pkti->ipi6_addr = connp->conn_laddr_v6; 5115 pkti->ipi6_ifindex = ifindex; 5116 optptr += sizeof (*pkti); 5117 ASSERT(OK_32PTR(optptr)); 5118 /* Save as "last" value */ 5119 tcp->tcp_recvifindex = ifindex; 5120 } 5121 /* If app asked for hoplimit and it has changed ... */ 5122 if (addflag.crb_ipv6_recvhoplimit) { 5123 toh = (struct T_opthdr *)optptr; 5124 toh->level = IPPROTO_IPV6; 5125 toh->name = IPV6_HOPLIMIT; 5126 toh->len = sizeof (*toh) + sizeof (uint_t); 5127 toh->status = 0; 5128 optptr += sizeof (*toh); 5129 *(uint_t *)optptr = ipp->ipp_hoplimit; 5130 optptr += sizeof (uint_t); 5131 ASSERT(OK_32PTR(optptr)); 5132 /* Save as "last" value */ 5133 tcp->tcp_recvhops = ipp->ipp_hoplimit; 5134 } 5135 /* If app asked for tclass and it has changed ... */ 5136 if (addflag.crb_ipv6_recvtclass) { 5137 toh = (struct T_opthdr *)optptr; 5138 toh->level = IPPROTO_IPV6; 5139 toh->name = IPV6_TCLASS; 5140 toh->len = sizeof (*toh) + sizeof (uint_t); 5141 toh->status = 0; 5142 optptr += sizeof (*toh); 5143 *(uint_t *)optptr = ipp->ipp_tclass; 5144 optptr += sizeof (uint_t); 5145 ASSERT(OK_32PTR(optptr)); 5146 /* Save as "last" value */ 5147 tcp->tcp_recvtclass = ipp->ipp_tclass; 5148 } 5149 if (addflag.crb_ipv6_recvhopopts) { 5150 toh = (struct T_opthdr *)optptr; 5151 toh->level = IPPROTO_IPV6; 5152 toh->name = IPV6_HOPOPTS; 5153 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen; 5154 toh->status = 0; 5155 optptr += sizeof (*toh); 5156 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen); 5157 optptr += ipp->ipp_hopoptslen; 5158 ASSERT(OK_32PTR(optptr)); 5159 /* Save as last value */ 5160 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen, 5161 (ipp->ipp_fields & IPPF_HOPOPTS), 5162 ipp->ipp_hopopts, ipp->ipp_hopoptslen); 5163 } 5164 if (addflag.crb_ipv6_recvrthdrdstopts) { 5165 toh = (struct T_opthdr *)optptr; 5166 toh->level = IPPROTO_IPV6; 5167 toh->name = IPV6_RTHDRDSTOPTS; 5168 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen; 5169 toh->status = 0; 5170 optptr += sizeof (*toh); 5171 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen); 5172 optptr += ipp->ipp_rthdrdstoptslen; 5173 ASSERT(OK_32PTR(optptr)); 5174 /* Save as last value */ 5175 ip_savebuf((void **)&tcp->tcp_rthdrdstopts, 5176 &tcp->tcp_rthdrdstoptslen, 5177 (ipp->ipp_fields & IPPF_RTHDRDSTOPTS), 5178 ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen); 5179 } 5180 if (addflag.crb_ipv6_recvrthdr) { 5181 toh = (struct T_opthdr *)optptr; 5182 toh->level = IPPROTO_IPV6; 5183 toh->name = IPV6_RTHDR; 5184 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen; 5185 toh->status = 0; 5186 optptr += sizeof (*toh); 5187 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen); 5188 optptr += ipp->ipp_rthdrlen; 5189 ASSERT(OK_32PTR(optptr)); 5190 /* Save as last value */ 5191 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen, 5192 (ipp->ipp_fields & IPPF_RTHDR), 5193 ipp->ipp_rthdr, ipp->ipp_rthdrlen); 5194 } 5195 if (addflag.crb_ipv6_recvdstopts) { 5196 toh = (struct T_opthdr *)optptr; 5197 toh->level = IPPROTO_IPV6; 5198 toh->name = IPV6_DSTOPTS; 5199 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen; 5200 toh->status = 0; 5201 optptr += sizeof (*toh); 5202 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen); 5203 optptr += ipp->ipp_dstoptslen; 5204 ASSERT(OK_32PTR(optptr)); 5205 /* Save as last value */ 5206 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen, 5207 (ipp->ipp_fields & IPPF_DSTOPTS), 5208 ipp->ipp_dstopts, ipp->ipp_dstoptslen); 5209 } 5210 ASSERT(optptr == mp->b_wptr); 5211 return (mp); 5212 } 5213 5214 /* The minimum of smoothed mean deviation in RTO calculation (nsec). */ 5215 #define TCP_SD_MIN 400000000 5216 5217 /* 5218 * Set RTO for this connection based on a new round-trip time measurement. 5219 * The formula is from Jacobson and Karels' "Congestion Avoidance and Control" 5220 * in SIGCOMM '88. The variable names are the same as those in Appendix A.2 5221 * of that paper. 5222 * 5223 * m = new measurement 5224 * sa = smoothed RTT average (8 * average estimates). 5225 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates). 5226 */ 5227 static void 5228 tcp_set_rto(tcp_t *tcp, hrtime_t rtt) 5229 { 5230 hrtime_t m = rtt; 5231 hrtime_t sa = tcp->tcp_rtt_sa; 5232 hrtime_t sv = tcp->tcp_rtt_sd; 5233 tcp_stack_t *tcps = tcp->tcp_tcps; 5234 5235 TCPS_BUMP_MIB(tcps, tcpRttUpdate); 5236 tcp->tcp_rtt_update++; 5237 tcp->tcp_rtt_sum += m; 5238 tcp->tcp_rtt_cnt++; 5239 5240 /* tcp_rtt_sa is not 0 means this is a new sample. */ 5241 if (sa != 0) { 5242 /* 5243 * Update average estimator (see section 2.3 of RFC6298): 5244 * SRTT = 7/8 SRTT + 1/8 rtt 5245 * 5246 * We maintain tcp_rtt_sa as 8 * SRTT, so this reduces to: 5247 * tcp_rtt_sa = 7 * SRTT + rtt 5248 * tcp_rtt_sa = 7 * (tcp_rtt_sa / 8) + rtt 5249 * tcp_rtt_sa = tcp_rtt_sa - (tcp_rtt_sa / 8) + rtt 5250 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 8)) 5251 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa / 2^3)) 5252 * tcp_rtt_sa = tcp_rtt_sa + (rtt - (tcp_rtt_sa >> 3)) 5253 * 5254 * (rtt - tcp_rtt_sa / 8) is simply the difference 5255 * between the new rtt measurement and the existing smoothed 5256 * RTT average. This is referred to as "Error" in subsequent 5257 * calculations. 5258 */ 5259 5260 /* m is now Error. */ 5261 m -= sa >> 3; 5262 if ((sa += m) <= 0) { 5263 /* 5264 * Don't allow the smoothed average to be negative. 5265 * We use 0 to denote reinitialization of the 5266 * variables. 5267 */ 5268 sa = 1; 5269 } 5270 5271 /* 5272 * Update deviation estimator: 5273 * mdev = 3/4 mdev + 1/4 abs(Error) 5274 * 5275 * We maintain tcp_rtt_sd as 4 * mdev, so this reduces to: 5276 * tcp_rtt_sd = 3 * mdev + abs(Error) 5277 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 4) + abs(Error) 5278 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd / 2^2) + abs(Error) 5279 * tcp_rtt_sd = tcp_rtt_sd - (tcp_rtt_sd >> 2) + abs(Error) 5280 */ 5281 if (m < 0) 5282 m = -m; 5283 m -= sv >> 2; 5284 sv += m; 5285 } else { 5286 /* 5287 * This follows BSD's implementation. So the reinitialized 5288 * RTO is 3 * m. We cannot go less than 2 because if the 5289 * link is bandwidth dominated, doubling the window size 5290 * during slow start means doubling the RTT. We want to be 5291 * more conservative when we reinitialize our estimates. 3 5292 * is just a convenient number. 5293 */ 5294 sa = m << 3; 5295 sv = m << 1; 5296 } 5297 if (sv < TCP_SD_MIN) { 5298 /* 5299 * Since a receiver doesn't delay its ACKs during a long run of 5300 * segments, sa may not have captured the effect of delayed ACK 5301 * timeouts on the RTT. To make sure we always account for the 5302 * possible delay (and avoid the unnecessary retransmission), 5303 * TCP_SD_MIN is set to 400ms, twice the delayed ACK timeout of 5304 * 200ms on older SunOS/BSD systems and modern Windows systems 5305 * (as of 2019). This means that the minimum possible mean 5306 * deviation is 100 ms. 5307 */ 5308 sv = TCP_SD_MIN; 5309 } 5310 tcp->tcp_rtt_sa = sa; 5311 tcp->tcp_rtt_sd = sv; 5312 5313 tcp->tcp_rto = tcp_calculate_rto(tcp, tcps, 0); 5314 5315 /* Now, we can reset tcp_timer_backoff to use the new RTO... */ 5316 tcp->tcp_timer_backoff = 0; 5317 } 5318 5319 /* 5320 * On a labeled system we have some protocols above TCP, such as RPC, which 5321 * appear to assume that every mblk in a chain has a db_credp. 5322 */ 5323 static void 5324 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira) 5325 { 5326 ASSERT(is_system_labeled()); 5327 ASSERT(ira->ira_cred != NULL); 5328 5329 while (mp != NULL) { 5330 mblk_setcred(mp, ira->ira_cred, NOPID); 5331 mp = mp->b_cont; 5332 } 5333 } 5334 5335 uint_t 5336 tcp_rwnd_reopen(tcp_t *tcp) 5337 { 5338 uint_t ret = 0; 5339 uint_t thwin; 5340 conn_t *connp = tcp->tcp_connp; 5341 5342 /* Learn the latest rwnd information that we sent to the other side. */ 5343 thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win)) 5344 << tcp->tcp_rcv_ws; 5345 /* This is peer's calculated send window (our receive window). */ 5346 thwin -= tcp->tcp_rnxt - tcp->tcp_rack; 5347 /* 5348 * Increase the receive window to max. But we need to do receiver 5349 * SWS avoidance. This means that we need to check the increase of 5350 * of receive window is at least 1 MSS. 5351 */ 5352 if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) { 5353 /* 5354 * If the window that the other side knows is less than max 5355 * deferred acks segments, send an update immediately. 5356 */ 5357 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) { 5358 TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate); 5359 ret = TH_ACK_NEEDED; 5360 } 5361 tcp->tcp_rwnd = connp->conn_rcvbuf; 5362 } 5363 return (ret); 5364 } 5365 5366 /* 5367 * Handle a packet that has been reclassified by TCP. 5368 * This function drops the ref on connp that the caller had. 5369 */ 5370 void 5371 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst) 5372 { 5373 ipsec_stack_t *ipss = ipst->ips_netstack->netstack_ipsec; 5374 5375 if (connp->conn_incoming_ifindex != 0 && 5376 connp->conn_incoming_ifindex != ira->ira_ruifindex) { 5377 freemsg(mp); 5378 CONN_DEC_REF(connp); 5379 return; 5380 } 5381 5382 if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) || 5383 (ira->ira_flags & IRAF_IPSEC_SECURE)) { 5384 ip6_t *ip6h; 5385 ipha_t *ipha; 5386 5387 if (ira->ira_flags & IRAF_IS_IPV4) { 5388 ipha = (ipha_t *)mp->b_rptr; 5389 ip6h = NULL; 5390 } else { 5391 ipha = NULL; 5392 ip6h = (ip6_t *)mp->b_rptr; 5393 } 5394 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira); 5395 if (mp == NULL) { 5396 BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards); 5397 /* Note that mp is NULL */ 5398 ip_drop_input("ipIfStatsInDiscards", mp, NULL); 5399 CONN_DEC_REF(connp); 5400 return; 5401 } 5402 } 5403 5404 if (IPCL_IS_TCP(connp)) { 5405 /* 5406 * do not drain, certain use cases can blow 5407 * the stack 5408 */ 5409 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, 5410 connp->conn_recv, connp, ira, 5411 SQ_NODRAIN, SQTAG_IP_TCP_INPUT); 5412 } else { 5413 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */ 5414 (connp->conn_recv)(connp, mp, NULL, 5415 ira); 5416 CONN_DEC_REF(connp); 5417 } 5418 5419 } 5420 5421 /* ARGSUSED */ 5422 static void 5423 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy) 5424 { 5425 conn_t *connp = (conn_t *)arg; 5426 tcp_t *tcp = connp->conn_tcp; 5427 queue_t *q = connp->conn_rq; 5428 5429 ASSERT(!IPCL_IS_NONSTR(connp)); 5430 mutex_enter(&tcp->tcp_rsrv_mp_lock); 5431 tcp->tcp_rsrv_mp = mp; 5432 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5433 5434 if (TCP_IS_DETACHED(tcp) || q == NULL) { 5435 return; 5436 } 5437 5438 if (tcp->tcp_fused) { 5439 tcp_fuse_backenable(tcp); 5440 return; 5441 } 5442 5443 if (canputnext(q)) { 5444 /* Not flow-controlled, open rwnd */ 5445 tcp->tcp_rwnd = connp->conn_rcvbuf; 5446 5447 /* 5448 * Send back a window update immediately if TCP is above 5449 * ESTABLISHED state and the increase of the rcv window 5450 * that the other side knows is at least 1 MSS after flow 5451 * control is lifted. 5452 */ 5453 if (tcp->tcp_state >= TCPS_ESTABLISHED && 5454 tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) { 5455 tcp_xmit_ctl(NULL, tcp, 5456 (tcp->tcp_swnd == 0) ? tcp->tcp_suna : 5457 tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK); 5458 } 5459 } 5460 } 5461 5462 /* 5463 * The read side service routine is called mostly when we get back-enabled as a 5464 * result of flow control relief. Since we don't actually queue anything in 5465 * TCP, we have no data to send out of here. What we do is clear the receive 5466 * window, and send out a window update. 5467 */ 5468 int 5469 tcp_rsrv(queue_t *q) 5470 { 5471 conn_t *connp = Q_TO_CONN(q); 5472 tcp_t *tcp = connp->conn_tcp; 5473 mblk_t *mp; 5474 5475 /* No code does a putq on the read side */ 5476 ASSERT(q->q_first == NULL); 5477 5478 /* 5479 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already 5480 * been run. So just return. 5481 */ 5482 mutex_enter(&tcp->tcp_rsrv_mp_lock); 5483 if ((mp = tcp->tcp_rsrv_mp) == NULL) { 5484 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5485 return (0); 5486 } 5487 tcp->tcp_rsrv_mp = NULL; 5488 mutex_exit(&tcp->tcp_rsrv_mp_lock); 5489 5490 CONN_INC_REF(connp); 5491 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp, 5492 NULL, SQ_PROCESS, SQTAG_TCP_RSRV); 5493 return (0); 5494 } 5495 5496 /* At minimum we need 8 bytes in the TCP header for the lookup */ 5497 #define ICMP_MIN_TCP_HDR 8 5498 5499 /* 5500 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages 5501 * passed up by IP. The message is always received on the correct tcp_t. 5502 * Assumes that IP has pulled up everything up to and including the ICMP header. 5503 */ 5504 /* ARGSUSED2 */ 5505 void 5506 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira) 5507 { 5508 conn_t *connp = (conn_t *)arg1; 5509 icmph_t *icmph; 5510 ipha_t *ipha; 5511 int iph_hdr_length; 5512 tcpha_t *tcpha; 5513 uint32_t seg_seq; 5514 tcp_t *tcp = connp->conn_tcp; 5515 5516 /* Assume IP provides aligned packets */ 5517 ASSERT(OK_32PTR(mp->b_rptr)); 5518 ASSERT((MBLKL(mp) >= sizeof (ipha_t))); 5519 5520 /* 5521 * It's possible we have a closed, but not yet destroyed, TCP 5522 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid 5523 * in the closed state, so don't take any chances and drop the packet. 5524 */ 5525 if (tcp->tcp_state == TCPS_CLOSED) { 5526 freemsg(mp); 5527 return; 5528 } 5529 5530 /* 5531 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent 5532 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6. 5533 */ 5534 if (!(ira->ira_flags & IRAF_IS_IPV4)) { 5535 tcp_icmp_error_ipv6(tcp, mp, ira); 5536 return; 5537 } 5538 5539 /* Skip past the outer IP and ICMP headers */ 5540 iph_hdr_length = ira->ira_ip_hdr_length; 5541 icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length]; 5542 /* 5543 * If we don't have the correct outer IP header length 5544 * or if we don't have a complete inner IP header 5545 * drop it. 5546 */ 5547 if (iph_hdr_length < sizeof (ipha_t) || 5548 (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) { 5549 noticmpv4: 5550 freemsg(mp); 5551 return; 5552 } 5553 ipha = (ipha_t *)&icmph[1]; 5554 5555 /* Skip past the inner IP and find the ULP header */ 5556 iph_hdr_length = IPH_HDR_LENGTH(ipha); 5557 tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length); 5558 /* 5559 * If we don't have the correct inner IP header length or if the ULP 5560 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR 5561 * bytes of TCP header, drop it. 5562 */ 5563 if (iph_hdr_length < sizeof (ipha_t) || 5564 ipha->ipha_protocol != IPPROTO_TCP || 5565 (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) { 5566 goto noticmpv4; 5567 } 5568 5569 seg_seq = ntohl(tcpha->tha_seq); 5570 switch (icmph->icmph_type) { 5571 case ICMP_DEST_UNREACHABLE: 5572 switch (icmph->icmph_code) { 5573 case ICMP_FRAGMENTATION_NEEDED: 5574 /* 5575 * Update Path MTU, then try to send something out. 5576 */ 5577 tcp_update_pmtu(tcp, B_TRUE); 5578 tcp_rexmit_after_error(tcp); 5579 break; 5580 case ICMP_PORT_UNREACHABLE: 5581 case ICMP_PROTOCOL_UNREACHABLE: 5582 switch (tcp->tcp_state) { 5583 case TCPS_SYN_SENT: 5584 case TCPS_SYN_RCVD: 5585 /* 5586 * ICMP can snipe away incipient 5587 * TCP connections as long as 5588 * seq number is same as initial 5589 * send seq number. 5590 */ 5591 if (seg_seq == tcp->tcp_iss) { 5592 (void) tcp_clean_death(tcp, 5593 ECONNREFUSED); 5594 } 5595 break; 5596 } 5597 break; 5598 case ICMP_HOST_UNREACHABLE: 5599 case ICMP_NET_UNREACHABLE: 5600 /* Record the error in case we finally time out. */ 5601 if (icmph->icmph_code == ICMP_HOST_UNREACHABLE) 5602 tcp->tcp_client_errno = EHOSTUNREACH; 5603 else 5604 tcp->tcp_client_errno = ENETUNREACH; 5605 if (tcp->tcp_state == TCPS_SYN_RCVD) { 5606 if (tcp->tcp_listener != NULL && 5607 tcp->tcp_listener->tcp_syn_defense) { 5608 /* 5609 * Ditch the half-open connection if we 5610 * suspect a SYN attack is under way. 5611 */ 5612 (void) tcp_clean_death(tcp, 5613 tcp->tcp_client_errno); 5614 } 5615 } 5616 break; 5617 default: 5618 break; 5619 } 5620 break; 5621 case ICMP_SOURCE_QUENCH: { 5622 /* 5623 * use a global boolean to control 5624 * whether TCP should respond to ICMP_SOURCE_QUENCH. 5625 * The default is false. 5626 */ 5627 if (tcp_icmp_source_quench) { 5628 /* 5629 * Reduce the sending rate as if we got a 5630 * retransmit timeout 5631 */ 5632 uint32_t npkt; 5633 5634 npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / 5635 tcp->tcp_mss; 5636 tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss; 5637 tcp->tcp_cwnd = tcp->tcp_mss; 5638 tcp->tcp_cwnd_cnt = 0; 5639 } 5640 break; 5641 } 5642 } 5643 freemsg(mp); 5644 } 5645 5646 /* 5647 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6 5648 * error messages passed up by IP. 5649 * Assumes that IP has pulled up all the extension headers as well 5650 * as the ICMPv6 header. 5651 */ 5652 static void 5653 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira) 5654 { 5655 icmp6_t *icmp6; 5656 ip6_t *ip6h; 5657 uint16_t iph_hdr_length = ira->ira_ip_hdr_length; 5658 tcpha_t *tcpha; 5659 uint8_t *nexthdrp; 5660 uint32_t seg_seq; 5661 5662 /* 5663 * Verify that we have a complete IP header. 5664 */ 5665 ASSERT((MBLKL(mp) >= sizeof (ip6_t))); 5666 5667 icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length]; 5668 ip6h = (ip6_t *)&icmp6[1]; 5669 /* 5670 * Verify if we have a complete ICMP and inner IP header. 5671 */ 5672 if ((uchar_t *)&ip6h[1] > mp->b_wptr) { 5673 noticmpv6: 5674 freemsg(mp); 5675 return; 5676 } 5677 5678 if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp)) 5679 goto noticmpv6; 5680 tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length); 5681 /* 5682 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't 5683 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the 5684 * packet. 5685 */ 5686 if ((*nexthdrp != IPPROTO_TCP) || 5687 ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) { 5688 goto noticmpv6; 5689 } 5690 5691 seg_seq = ntohl(tcpha->tha_seq); 5692 switch (icmp6->icmp6_type) { 5693 case ICMP6_PACKET_TOO_BIG: 5694 /* 5695 * Update Path MTU, then try to send something out. 5696 */ 5697 tcp_update_pmtu(tcp, B_TRUE); 5698 tcp_rexmit_after_error(tcp); 5699 break; 5700 case ICMP6_DST_UNREACH: 5701 switch (icmp6->icmp6_code) { 5702 case ICMP6_DST_UNREACH_NOPORT: 5703 if (((tcp->tcp_state == TCPS_SYN_SENT) || 5704 (tcp->tcp_state == TCPS_SYN_RCVD)) && 5705 (seg_seq == tcp->tcp_iss)) { 5706 (void) tcp_clean_death(tcp, ECONNREFUSED); 5707 } 5708 break; 5709 case ICMP6_DST_UNREACH_ADMIN: 5710 case ICMP6_DST_UNREACH_NOROUTE: 5711 case ICMP6_DST_UNREACH_BEYONDSCOPE: 5712 case ICMP6_DST_UNREACH_ADDR: 5713 /* Record the error in case we finally time out. */ 5714 tcp->tcp_client_errno = EHOSTUNREACH; 5715 if (((tcp->tcp_state == TCPS_SYN_SENT) || 5716 (tcp->tcp_state == TCPS_SYN_RCVD)) && 5717 (seg_seq == tcp->tcp_iss)) { 5718 if (tcp->tcp_listener != NULL && 5719 tcp->tcp_listener->tcp_syn_defense) { 5720 /* 5721 * Ditch the half-open connection if we 5722 * suspect a SYN attack is under way. 5723 */ 5724 (void) tcp_clean_death(tcp, 5725 tcp->tcp_client_errno); 5726 } 5727 } 5728 5729 5730 break; 5731 default: 5732 break; 5733 } 5734 break; 5735 case ICMP6_PARAM_PROB: 5736 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */ 5737 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER && 5738 (uchar_t *)ip6h + icmp6->icmp6_pptr == 5739 (uchar_t *)nexthdrp) { 5740 if (tcp->tcp_state == TCPS_SYN_SENT || 5741 tcp->tcp_state == TCPS_SYN_RCVD) { 5742 (void) tcp_clean_death(tcp, ECONNREFUSED); 5743 } 5744 break; 5745 } 5746 break; 5747 5748 case ICMP6_TIME_EXCEEDED: 5749 default: 5750 break; 5751 } 5752 freemsg(mp); 5753 } 5754 5755 /* 5756 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might 5757 * change. But it can refer to fields like tcp_suna and tcp_snxt. 5758 * 5759 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP 5760 * error messages received by IP. The message is always received on the correct 5761 * tcp_t. 5762 */ 5763 /* ARGSUSED */ 5764 boolean_t 5765 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6, 5766 ip_recv_attr_t *ira) 5767 { 5768 tcpha_t *tcpha = (tcpha_t *)arg2; 5769 uint32_t seq = ntohl(tcpha->tha_seq); 5770 tcp_t *tcp = connp->conn_tcp; 5771 5772 /* 5773 * TCP sequence number contained in payload of the ICMP error message 5774 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise, 5775 * the message is either a stale ICMP error, or an attack from the 5776 * network. Fail the verification. 5777 */ 5778 if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt)) 5779 return (B_FALSE); 5780 5781 /* For "too big" we also check the ignore flag */ 5782 if (ira->ira_flags & IRAF_IS_IPV4) { 5783 ASSERT(icmph != NULL); 5784 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE && 5785 icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED && 5786 tcp->tcp_tcps->tcps_ignore_path_mtu) 5787 return (B_FALSE); 5788 } else { 5789 ASSERT(icmp6 != NULL); 5790 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG && 5791 tcp->tcp_tcps->tcps_ignore_path_mtu) 5792 return (B_FALSE); 5793 } 5794 return (B_TRUE); 5795 }