| blob | b98eb33a4646a02f1321a1797c52f32102127ca1 |
1 /*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
22 /*
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright (c) 2011 Joyent, Inc. All rights reserved.
26 */
28 /* This file contains all TCP input processing functions. */
30 #include <sys/types.h>
31 #include <sys/stream.h>
32 #include <sys/strsun.h>
33 #include <sys/strsubr.h>
34 #include <sys/stropts.h>
35 #include <sys/strlog.h>
36 #define _SUN_TPI_VERSION 2
37 #include <sys/tihdr.h>
38 #include <sys/suntpi.h>
39 #include <sys/xti_inet.h>
40 #include <sys/squeue_impl.h>
41 #include <sys/squeue.h>
42 #include <sys/tsol/tnet.h>
44 #include <inet/common.h>
45 #include <inet/ip.h>
46 #include <inet/tcp.h>
47 #include <inet/tcp_impl.h>
48 #include <inet/tcp_cluster.h>
49 #include <inet/proto_set.h>
50 #include <inet/ipsec_impl.h>
52 /*
53 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
54 */
56 #ifdef _BIG_ENDIAN
57 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
58 (TCPOPT_TSTAMP << 8) | 10)
59 #else
60 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
61 (TCPOPT_NOP << 8) | TCPOPT_NOP)
62 #endif
64 /*
65 * Flags returned from tcp_parse_options.
66 */
67 #define TCP_OPT_MSS_PRESENT 1
68 #define TCP_OPT_WSCALE_PRESENT 2
69 #define TCP_OPT_TSTAMP_PRESENT 4
70 #define TCP_OPT_SACK_OK_PRESENT 8
71 #define TCP_OPT_SACK_PRESENT 16
73 /*
74 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
75 */
76 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
78 /*
79 * Since tcp_listener is not cleared atomically with tcp_detached
80 * being cleared we need this extra bit to tell a detached connection
81 * apart from one that is in the process of being accepted.
82 */
83 #define TCP_IS_DETACHED_NONEAGER(tcp) \
84 (TCP_IS_DETACHED(tcp) && \
85 (!(tcp)->tcp_hard_binding))
87 /*
88 * Steps to do when a tcp_t moves to TIME-WAIT state.
89 *
90 * This connection is done, we don't need to account for it. Decrement
91 * the listener connection counter if needed.
92 *
93 * Decrement the connection counter of the stack. Note that this counter
94 * is per CPU. So the total number of connections in a stack is the sum of all
95 * of them. Since there is no lock for handling all of them exclusively, the
96 * resulting sum is only an approximation.
97 *
98 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
99 * connection won't interfere with new ones.
100 *
101 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
102 * the timer is handled within the context of this tcp_t. When the timer
103 * fires, tcp_clean_death() is called. If upper layer closes the connection
104 * during this period, tcp_time_wait_append() will be called to add this
105 * tcp_t to the global TIME-WAIT list. Note that this means that the
106 * actual wait time in TIME-WAIT state will be longer than the
107 * tcps_time_wait_interval since the period before upper layer closes the
108 * connection is not accounted for when tcp_time_wait_append() is called.
109 *
110 * If uppser layer has closed the connection, call tcp_time_wait_append()
111 * directly.
112 *
113 */
114 #define SET_TIME_WAIT(tcps, tcp, connp) \
115 { \
116 (tcp)->tcp_state = TCPS_TIME_WAIT; \
117 if ((tcp)->tcp_listen_cnt != NULL) \
118 TCP_DECR_LISTEN_CNT(tcp); \
119 atomic_dec_64( \
120 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
121 (connp)->conn_exclbind = 0; \
122 if (!TCP_IS_DETACHED(tcp)) { \
123 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
124 } else { \
125 tcp_time_wait_append(tcp); \
126 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
127 } \
128 }
130 /*
131 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
132 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
133 * data, TCP will not respond with an ACK. RFC 793 requires that
134 * TCP responds with an ACK for such a bogus ACK. By not following
135 * the RFC, we prevent TCP from getting into an ACK storm if somehow
136 * an attacker successfully spoofs an acceptable segment to our
137 * peer; or when our peer is "confused."
138 */
141 /*
142 * To protect TCP against attacker using a small window and requesting
143 * large amount of data (DoS attack by conuming memory), TCP checks the
144 * window advertised in the last ACK of the 3-way handshake. TCP uses
145 * the tcp_mss (the size of one packet) value for comparion. The window
146 * should be larger than tcp_mss. But while a sane TCP should advertise
147 * a receive window larger than or equal to 4*MSS to avoid stop and go
148 * tarrfic, not all TCP stacks do that. This is especially true when
149 * tcp_mss is a big value.
150 *
151 * To work around this issue, an additional fixed value for comparison
152 * is also used. If the advertised window is smaller than both tcp_mss
153 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
154 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
155 * smaller than 8K is considered to be OK.
156 */
159 /* Process ICMP source quench message or not. */
165 ip_recv_attr_t *);
167 ip_recv_attr_t *);
171 ip_recv_attr_t *);
181 /*
182 * Set the MSS associated with a particular tcp based on its current value,
183 * and a new one passed in. Observe minimums and maximums, and reset other
184 * state variables that we want to view as multiples of MSS.
185 *
186 * The value of MSS could be either increased or descreased.
187 */
188 void
190 {
197 else
204 /*
205 * Unless naglim has been set by our client to
206 * a non-mss value, force naglim to track mss.
207 * This can help to aggregate small writes.
208 */
211 /*
212 * TCP should be able to buffer at least 4 MSS data for obvious
213 * performance reason.
214 */
218 /*
219 * Set the send lowater to at least twice of MSS.
220 */
224 /*
225 * Update tcp_cwnd according to the new value of MSS. Keep the
226 * previous ratio to preserve the transmit rate.
227 */
233 }
235 /*
236 * Extract option values from a tcp header. We put any found values into the
237 * tcpopt struct and return a bitmask saying which options were found.
238 */
239 static int
241 {
260 up++;
269 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
282 else
301 /* If TCP is not interested in SACK blks... */
305 }
309 /*
310 * If the list is empty, allocate one and assume
311 * nothing is sack'ed.
312 */
319 /*
320 * Make sure tcp_notsack_list is not NULL.
321 * This happens when kmem_alloc(KM_NOSLEEP)
322 * returns NULL.
323 */
327 }
329 }
335 }
341 /*
342 * Bounds checking. Make sure the SACK
343 * info is within tcp_suna and tcp_snxt.
344 * If this SACK blk is out of bound, ignore
345 * it but continue to parse the following
346 * blks.
347 */
352 }
359 }
360 }
382 }
384 }
386 }
388 /*
389 * Process all TCP option in SYN segment. Note that this function should
390 * be called after tcp_set_destination() is called so that the necessary info
391 * from IRE is already set in the tcp structure.
392 *
393 * This function sets up the correct tcp_mss value according to the
394 * MSS option value and our header size. It also sets up the window scale
395 * and timestamp values, and initialize SACK info blocks. But it does not
396 * change receive window size after setting the tcp_mss value. The caller
397 * should do the appropriate change.
398 */
399 static void
401 {
403 tcp_opt_t tcpopt;
412 /*
413 * Process MSS option. Note that MSS option value does not account
414 * for IP or TCP options. This means that it is equal to MTU - minimum
415 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
416 * IPv6.
417 */
421 else
426 else
432 }
434 /* Process Window Scale option. */
442 }
444 /* Process Timestamp option. */
455 /* Fill in our template header with basic timestamp option. */
466 }
468 /*
469 * Process SACK options. If SACK is enabled for this connection,
470 * then allocate the SACK info structure. Note the following ways
471 * when tcp_snd_sack_ok is set to true.
472 *
473 * For active connection: in tcp_set_destination() called in
474 * tcp_connect().
475 *
476 * For passive connection: in tcp_set_destination() called in
477 * tcp_input_listener().
478 *
479 * That's the reason why the extra TCP_IS_DETACHED() check is there.
480 * That check makes sure that if we did not send a SACK OK option,
481 * we will not enable SACK for this connection even though the other
482 * side sends us SACK OK option. For active connection, the SACK
483 * info structure has already been allocated. So we need to free
484 * it if SACK is disabled.
485 */
497 }
499 /*
500 * Resetting tcp_snd_sack_ok to B_FALSE so that
501 * no SACK info will be used for this
502 * connection. This assumes that SACK usage
503 * permission is negotiated. This may need
504 * to be changed once this is clarified.
505 */
509 }
511 /*
512 * Now we know the exact TCP/IP header length, subtract
513 * that from tcp_mss to get our side's MSS.
514 */
517 /*
518 * Here we assume that the other side's header size will be equal to
519 * our header size. We calculate the real MSS accordingly. Need to
520 * take into additional stuffs IPsec puts in.
521 *
522 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
523 */
529 /*
530 * Set MSS to the smaller one of both ends of the connection.
531 * We should not have called tcp_mss_set() before, but our
532 * side of the MSS should have been set to a proper value
533 * by tcp_set_destination(). tcp_mss_set() will also set up the
534 * STREAM head parameters properly.
535 *
536 * If we have a larger-than-16-bit window but the other side
537 * didn't want to do window scale, tcp_rwnd_set() will take
538 * care of that.
539 */
542 /*
543 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
544 * updated properly.
545 */
547 }
549 /*
550 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
551 * is filled, return as much as we can. The message passed in may be
552 * multi-part, chained using b_cont. "start" is the starting sequence
553 * number for this piece.
554 */
557 {
566 /* Walk through all the new pieces. */
573 /* Empty. Blast it. */
576 }
588 }
589 /* New stuff completely beyond tail? */
591 /* Link it on end. */
598 }
601 /* New stuff at the front? */
603 /* Yes... Check for overlap. */
608 }
609 /*
610 * The new piece fits somewhere between the head and tail.
611 * We find our slot, where mp1 precedes us and mp2 trails.
612 */
617 }
618 /* Link ourselves in */
622 /* Trim overlap with following mblk(s) first */
625 /* Trim overlap with preceding mblk */
630 /* Anything ready to go? */
633 /* Eat what we can off the queue */
642 }
646 }
648 }
652 }
654 /* Eliminate any overlap that mp may have over later mblks */
655 static void
657 {
675 }
682 }
685 }
687 /*
688 * This function does PAWS protection check. Returns B_TRUE if the
689 * segment passes the PAWS test, else returns B_FALSE.
690 */
691 boolean_t
693 {
700 /*
701 * If timestamp option is aligned nicely, get values inline,
702 * otherwise call general routine to parse. Only do that
703 * if timestamp is the only option.
704 */
706 TCPOPT_REAL_TS_LEN &&
708 TCP_MIN_HEADER_LENGTH)) &&
719 }
721 }
724 /*
725 * Do PAWS per RFC 1323 section 4.2. Accept RST
726 * regardless of the timestamp, page 18 RFC 1323.bis.
727 */
733 /* This segment is not acceptable. */
736 /*
737 * Connection has been idle for
738 * too long. Reset the timestamp
739 * and assume the segment is valid.
740 */
743 }
744 }
746 /*
747 * If we don't get a timestamp on every packet, we
748 * figure we can't really trust 'em, so we stop sending
749 * and parsing them.
750 */
756 /*
757 * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
758 * doing a slow start here so as to not to lose on the
759 * transfer rate built up so far.
760 */
764 }
766 }
768 /*
769 * Defense for the SYN attack -
770 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
771 * one from the list of droppable eagers. This list is a subset of q0.
772 * see comments before the definition of MAKE_DROPPABLE().
773 * 2. Don't drop a SYN request before its first timeout. This gives every
774 * request at least til the first timeout to complete its 3-way handshake.
775 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
776 * requests currently on the queue that has timed out. This will be used
777 * as an indicator of whether an attack is under way, so that appropriate
778 * actions can be taken. (It's incremented in tcp_timer() and decremented
779 * either when eager goes into ESTABLISHED, or gets freed up.)
780 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
781 * # of timeout drops back to <= q0len/32 => SYN alert off
782 */
783 static boolean_t
785 {
793 /* Pick oldest eager from the list of droppable eagers */
796 /* If list is empty. return B_FALSE */
799 }
801 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
805 /*
806 * Take this eager out from the list of droppable eagers since we are
807 * going to drop it.
808 */
813 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
817 }
821 /* Put a reference on the conn as we are enqueueing it in the sqeue */
829 }
831 /*
832 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
833 */
837 {
843 sin6_t sin6;
863 sin6_t sin6d;
880 }
898 /* Pass up the scope_id of remote addr */
902 }
904 sin6_t sin6d;
923 }
924 }
928 }
930 /* Handle a SYN on an AF_INET socket */
934 {
937 sin_t sin;
955 sin_t sind;
970 }
974 }
976 /*
977 * Called via squeue to get on to eager's perimeter. It sends a
978 * TH_RST if eager is in the fanout table. The listener wants the
979 * eager to disappear either by means of tcp_eager_blowoff() or
980 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
981 * called (via squeue) if the eager cannot be inserted in the
982 * fanout table in tcp_input_listener().
983 */
984 /* ARGSUSED */
985 void
987 {
992 /*
993 * We could be called because listener is closing. Since
994 * the eager was using listener's queue's, we avoid
995 * using the listeners queues from now on.
996 */
1001 /*
1002 * An eager's conn_fanout will be NULL if it's a duplicate
1003 * for an existing 4-tuples in the conn fanout table.
1004 * We don't want to send an RST out in such case.
1005 */
1009 }
1011 /* We are here because listener wants this eager gone */
1016 /*
1017 * The eager has sent a conn_ind up to the
1018 * listener but listener decides to close
1019 * instead. We need to drop the extra ref
1020 * placed on eager in tcp_input_data() before
1021 * sending the conn_ind to listener.
1022 */
1024 }
1027 }
1031 }
1033 /*
1034 * Reset any eager connection hanging off this listener marked
1035 * with 'seqnum' and then reclaim it's resources.
1036 */
1037 boolean_t
1039 {
1050 }
1056 }
1065 }
1067 /*
1068 * Reset any eager connection hanging off this listener
1069 * and then reclaim it's resources.
1070 */
1071 void
1073 {
1081 /* First cleanup q */
1093 }
1095 }
1096 }
1097 /* Then cleanup q0 */
1108 SQTAG_TCP_EAGER_CLEANUP_Q0);
1109 }
1111 }
1112 }
1114 /*
1115 * If we are an eager connection hanging off a listener that hasn't
1116 * formally accepted the connection yet, get off his list and blow off
1117 * any data that we have accumulated.
1118 */
1119 void
1121 {
1129 /* Remove the eager tcp from q0 */
1140 /*
1141 * Take the eager out, if it is in the list of droppable
1142 * eagers.
1143 */
1147 /* we have timed out before */
1150 }
1158 /*
1159 * If we are unlinking the last
1160 * element on the list, adjust
1161 * tail pointer. Set tail pointer
1162 * to nil when list is empty.
1163 */
1168 NULL;
1170 /*
1171 * We won't get here if there
1172 * is only one eager in the
1173 * list.
1174 */
1177 prev;
1178 }
1179 }
1186 }
1188 }
1189 }
1191 }
1193 /* BEGIN CSTYLED */
1194 /*
1195 *
1196 * The sockfs ACCEPT path:
1197 * =======================
1198 *
1199 * The eager is now established in its own perimeter as soon as SYN is
1200 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1201 * completes the accept processing on the acceptor STREAM. The sending
1202 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1203 * listener but a TLI/XTI listener completes the accept processing
1204 * on the listener perimeter.
1205 *
1206 * Common control flow for 3 way handshake:
1207 * ----------------------------------------
1208 *
1209 * incoming SYN (listener perimeter) -> tcp_input_listener()
1210 *
1211 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1212 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1213 *
1214 * Sockfs ACCEPT Path:
1215 * -------------------
1216 *
1217 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1218 * as STREAM entry point)
1219 *
1220 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1221 *
1222 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1223 * association (we are not behind eager's squeue but sockfs is protecting us
1224 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1225 * is changed to point at tcp_wput().
1226 *
1227 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1228 * listener (done on listener's perimeter).
1229 *
1230 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1231 * accept.
1232 *
1233 * TLI/XTI client ACCEPT path:
1234 * ---------------------------
1235 *
1236 * soaccept() sends T_CONN_RES on the listener STREAM.
1237 *
1238 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1239 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1240 *
1241 * Locks:
1242 * ======
1243 *
1244 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1245 * and listeners->tcp_eager_next_q.
1246 *
1247 * Referencing:
1248 * ============
1249 *
1250 * 1) We start out in tcp_input_listener by eager placing a ref on
1251 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1252 *
1253 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1254 * doing so we place a ref on the eager. This ref is finally dropped at the
1255 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1256 * reference is dropped by the squeue framework.
1257 *
1258 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1259 *
1260 * The reference must be released by the same entity that added the reference
1261 * In the above scheme, the eager is the entity that adds and releases the
1262 * references. Note that tcp_accept_finish executes in the squeue of the eager
1263 * (albeit after it is attached to the acceptor stream). Though 1. executes
1264 * in the listener's squeue, the eager is nascent at this point and the
1265 * reference can be considered to have been added on behalf of the eager.
1266 *
1267 * Eager getting a Reset or listener closing:
1268 * ==========================================
1269 *
1270 * Once the listener and eager are linked, the listener never does the unlink.
1271 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1272 * a message on all eager perimeter. The eager then does the unlink, clears
1273 * any pointers to the listener's queue and drops the reference to the
1274 * listener. The listener waits in tcp_close outside the squeue until its
1275 * refcount has dropped to 1. This ensures that the listener has waited for
1276 * all eagers to clear their association with the listener.
1277 *
1278 * Similarly, if eager decides to go away, it can unlink itself and close.
1279 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1280 * the reference to eager is still valid because of the extra ref we put
1281 * in tcp_send_conn_ind.
1282 *
1283 * Listener can always locate the eager under the protection
1284 * of the listener->tcp_eager_lock, and then do a refhold
1285 * on the eager during the accept processing.
1286 *
1287 * The acceptor stream accesses the eager in the accept processing
1288 * based on the ref placed on eager before sending T_conn_ind.
1289 * The only entity that can negate this refhold is a listener close
1290 * which is mutually exclusive with an active acceptor stream.
1291 *
1292 * Eager's reference on the listener
1293 * ===================================
1294 *
1295 * If the accept happens (even on a closed eager) the eager drops its
1296 * reference on the listener at the start of tcp_accept_finish. If the
1297 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1298 * the reference is dropped in tcp_closei_local. If the listener closes,
1299 * the reference is dropped in tcp_eager_kill. In all cases the reference
1300 * is dropped while executing in the eager's context (squeue).
1301 */
1302 /* END CSTYLED */
1304 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1306 /*
1307 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1308 * tcp_input_data will not see any packets for listeners since the listener
1309 * has conn_recv set to tcp_input_listener.
1310 */
1311 /* ARGSUSED */
1312 static void
1314 {
1322 uint_t ip_hdr_len;
1327 uint_t flags;
1344 }
1346 /* Note this executes in listener's squeue */
1349 }
1353 }
1362 /*
1363 * The system is under memory pressure, so we need to do our part
1364 * to relieve the pressure. So we only accept new request if there
1365 * is nothing waiting to be accepted or waiting to complete the 3-way
1366 * handshake. This means that busy listener will not get too many
1367 * new requests which they cannot handle in time while non-busy
1368 * listener is still functioning properly.
1369 */
1375 }
1383 "tcp_input_listener: listen backlog (max=%d) "
1388 }
1390 }
1394 /*
1395 * Q0 is full. Drop a pending half-open req from the queue
1396 * to make room for the new SYN req. Also mark the time we
1397 * drop a SYN.
1398 *
1399 * A more aggressive defense against SYN attack will
1400 * be to set the "tcp_syn_defense" flag now.
1401 */
1409 "tcp_input_listener: listen half-open "
1414 DISP_PORT_ONLY));
1415 }
1417 }
1418 }
1420 /*
1421 * Enforce the limit set on the number of connections per listener.
1422 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1423 * for comparison.
1424 */
1438 "Listener (port %d) connection max (%u) "
1443 }
1445 }
1447 }
1451 /*
1452 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1453 * or based on the ring (for packets from GLD). Otherwise it is
1454 * set based on lbolt i.e., a somewhat random number.
1455 */
1475 /* We already know the laddr of the new connection is ours */
1487 }
1496 /*
1497 * Initialize the eager's tcp_t and inherit some parameters from
1498 * the listener.
1499 */
1511 /* Prepare for diffing against previous packets */
1521 }
1522 }
1530 /* Source routing option copyover (reverse it) */
1535 }
1537 }
1541 /*
1542 * If the SYN came with a credential, it's a loopback packet or a
1543 * labeled packet; attach the credential to the TPI message.
1544 */
1551 /* Inherit the listener's non-STREAMS flag */
1554 /* All non-STREAMS tcp_ts are sockets */
1557 /*
1558 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1559 * at close time, we will always have that to send up.
1560 * Otherwise, we need to do special handling in case the
1561 * allocation fails at that time.
1562 */
1565 }
1566 /*
1567 * Now that the IP addresses and ports are setup in econnp we
1568 * can do the IPsec policy work.
1569 */
1572 /*
1573 * Inherit the policy from the listener; use
1574 * actions from ira
1575 */
1580 }
1581 }
1582 }
1584 /*
1585 * tcp_set_destination() may set tcp_rwnd according to the route
1586 * metrics. If it does not, the eager's receive window will be set
1587 * to the listener's receive window later in this function.
1588 */
1595 /* Discard any old label */
1601 }
1605 /*
1606 * If this is an MLP connection or a MAC-Exempt
1607 * connection with an unlabeled node, packets are to be
1608 * exchanged using the security label of the received
1609 * SYN packet instead of the server application's label.
1610 * tsol_check_dest called from ip_set_destination
1611 * might later update TSF_UNLABELED by replacing
1612 * ixa_tsl with a new label.
1613 */
1622 }
1623 /*
1624 * conn_connect() called from tcp_set_destination will verify
1625 * the destination is allowed to receive packets at the
1626 * security label of the SYN-ACK we are generating. As part of
1627 * that, tsol_check_dest() may create a new effective label for
1628 * this connection.
1629 * Finally conn_connect() will call conn_update_label.
1630 * All that remains for TCP to do is to call
1631 * conn_build_hdr_template which is done as part of
1632 * tcp_set_destination.
1633 */
1634 }
1636 /*
1637 * Since we will clear tcp_listener before we clear tcp_detached
1638 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1639 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1640 */
1650 }
1654 /*
1655 * Adapt our mss, ttl, ... based on the remote address.
1656 */
1660 /* Undo the bind_hash_insert */
1663 }
1665 /* Process all TCP options. */
1668 /* Is the other end ECN capable? */
1672 }
1674 /*
1675 * The listener's conn_rcvbuf should be the default window size or a
1676 * window size changed via SO_RCVBUF option. First round up the
1677 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1678 * scale option value if needed. Call tcp_rwnd_set() to finish the
1679 * setting.
1680 *
1681 * Note if there is a rpipe metric associated with the remote host,
1682 * we should not inherit receive window size from listener.
1683 */
1689 /*
1690 * Note that this is the only place tcp_rwnd_set() is called for
1691 * accepting a connection. We need to call it here instead of
1692 * after the 3-way handshake because we need to tell the other
1693 * side our rwnd in the SYN-ACK segment.
1694 */
1703 /* Put a ref on the listener for the eager. */
1711 /* Set tcp_listener before adding it to tcp_conn_fanout */
1715 /*
1716 * Set tcp_listen_cnt so that when the connection is done, the counter
1717 * is decremented.
1718 */
1721 /*
1722 * Tag this detached tcp vector for later retrieval
1723 * by our listener client in tcp_accept().
1724 */
1728 /*
1729 * -1 is "special" and defined in TPI as something
1730 * that should never be used in T_CONN_IND
1731 */
1733 }
1737 /* Don't drop the SYN that comes from a good IP source */
1744 }
1745 }
1747 /*
1748 * We need to insert the eager in its own perimeter but as soon
1749 * as we do that, we expose the eager to the classifier and
1750 * should not touch any field outside the eager's perimeter.
1751 * So do all the work necessary before inserting the eager
1752 * in its own perimeter. Be optimistic that conn_connect()
1753 * will succeed but undo everything if it fails.
1754 */
1769 /*
1770 * Increment the ref count as we are going to
1771 * enqueueing an mp in squeue
1772 */
1775 }
1777 /*
1778 * We need to start the rto timer. In normal case, we start
1779 * the timer after sending the packet on the wire (or at
1780 * least believing that packet was sent by waiting for
1781 * conn_ip_output() to return). Since this is the first packet
1782 * being sent on the wire for the eager, our initial tcp_rto
1783 * is at least tcp_rexmit_interval_min which is a fairly
1784 * large value to allow the algorithm to adjust slowly to large
1785 * fluctuations of RTT during first few transmissions.
1786 *
1787 * Starting the timer first and then sending the packet in this
1788 * case shouldn't make much difference since tcp_rexmit_interval_min
1789 * is of the order of several 100ms and starting the timer
1790 * first and then sending the packet will result in difference
1791 * of few micro seconds.
1792 *
1793 * Without this optimization, we are forced to hold the fanout
1794 * lock across the ipcl_bind_insert() and sending the packet
1795 * so that we don't race against an incoming packet (maybe RST)
1796 * for this eager.
1797 *
1798 * It is necessary to acquire an extra reference on the eager
1799 * at this point and hold it until after tcp_send_data() to
1800 * ensure against an eager close race.
1801 */
1807 /*
1808 * Insert the eager in its own perimeter now. We are ready to deal
1809 * with any packets on eager.
1810 */
1816 /*
1817 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1818 * only used by one thread at a time.
1819 */
1830 }
1832 error:
1840 /*
1841 * If a connection already exists, send the mp to that connections so
1842 * that it can be appropriately dealt with.
1843 */
1848 /*
1849 * Something bad happened. ipcl_conn_insert()
1850 * failed because a connection already existed
1851 * in connected hash but we can't find it
1852 * anymore (someone blew it away). Just
1853 * free this message and hopefully remote
1854 * will retransmit at which time the SYN can be
1855 * treated as a new connection or dealth with
1856 * a TH_RST if a connection already exists.
1857 */
1863 }
1865 /* Nobody wants this packet */
1867 }
1869 error3:
1871 error2:
1875 }
1877 /*
1878 * In an ideal case of vertical partition in NUMA architecture, its
1879 * beneficial to have the listener and all the incoming connections
1880 * tied to the same squeue. The other constraint is that incoming
1881 * connections should be tied to the squeue attached to interrupted
1882 * CPU for obvious locality reason so this leaves the listener to
1883 * be tied to the same squeue. Our only problem is that when listener
1884 * is binding, the CPU that will get interrupted by the NIC whose
1885 * IP address the listener is binding to is not even known. So
1886 * the code below allows us to change that binding at the time the
1887 * CPU is interrupted by virtue of incoming connection's squeue.
1888 *
1889 * This is usefull only in case of a listener bound to a specific IP
1890 * address. For other kind of listeners, they get bound the
1891 * very first time and there is no attempt to rebind them.
1892 */
1893 void
1896 {
1902 /*
1903 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1904 * or based on the ring (for packets from GLD). Otherwise it is
1905 * set based on lbolt i.e., a somewhat random number.
1906 */
1916 /*
1917 * No one from read or write side can access us now
1918 * except for already queued packets on this squeue.
1919 * But since we haven't changed the squeue yet, they
1920 * can't execute. If they are processed after we have
1921 * changed the squeue, they are sent back to the
1922 * correct squeue down below.
1923 * But a listner close can race with processing of
1924 * incoming SYN. If incoming SYN processing changes
1925 * the squeue then the listener close which is waiting
1926 * to enter the squeue would operate on the wrong
1927 * squeue. Hence we don't change the squeue here unless
1928 * the refcount is exactly the minimum refcount. The
1929 * minimum refcount of 4 is counted as - 1 each for
1930 * TCP and IP, 1 for being in the classifier hash, and
1931 * 1 for the mblk being processed.
1932 */
1939 }
1943 new_sqp);
1944 /* No special MT issues for outbound ixa_sqp hint */
1946 }
1958 /*
1959 * Assume we have picked a good squeue for the listener. Make
1960 * subsequent SYNs not try to change the squeue.
1961 */
1963 }
1965 done:
1972 }
1973 }
1975 /*
1976 * Send up all messages queued on tcp_rcv_list.
1977 */
1978 uint_t
1980 {
1983 #ifdef DEBUG
1985 #endif
1988 /* Can't drain on an eager connection */
1992 /* Can't be a non-STREAMS connection */
1995 /* No need for the push timer now. */
1999 }
2001 /*
2002 * Handle two cases here: we are currently fused or we were
2003 * previously fused and have some urgent data to be delivered
2004 * upstream. The latter happens because we either ran out of
2005 * memory or were detached and therefore sending the SIGURG was
2006 * deferred until this point. In either case we pass control
2007 * over to tcp_fuse_rcv_drain() since it may need to complete
2008 * some work.
2009 */
2014 }
2019 #ifdef DEBUG
2021 #endif
2023 }
2024 #ifdef DEBUG
2026 #endif
2035 }
2037 /*
2038 * Queue data on tcp_rcv_list which is a b_next chain.
2039 * tcp_rcv_last_head/tail is the last element of this chain.
2040 * Each element of the chain is a b_cont chain.
2041 *
2042 * M_DATA messages are added to the current element.
2043 * Other messages are added as new (b_next) elements.
2044 */
2045 void
2047 {
2053 /*
2054 * Provide for protocols above TCP such as RPC. NOPID leaves
2055 * db_cpid unchanged.
2056 * The cred could have already been set.
2057 */
2060 }
2071 }
2079 }
2081 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2082 mblk_t *
2084 {
2089 /*
2090 * There are a few cases to be considered while setting the sequence no.
2091 * Essentially, we can come here while processing an unacceptable pkt
2092 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2093 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2094 * If we are here for a zero window probe, stick with suna. In all
2095 * other cases, we check if suna + swnd encompasses snxt and set
2096 * the sequence number to snxt, if so. If snxt falls outside the
2097 * window (the receiver probably shrunk its window), we will go with
2098 * suna + swnd, otherwise the sequence no will be unacceptable to the
2099 * receiver.
2100 */
2110 }
2113 /*
2114 * For the complex case where we have to send some
2115 * controls (FIN or SYN), let tcp_xmit_mp do it.
2116 */
2120 /* Generate a simple ACK */
2131 /*
2132 * Allocate space for TCP + IP headers
2133 * and link-level header
2134 */
2145 }
2150 /* Update the latest receive window size in TCP header. */
2153 /* copy in prototype TCP + IP header */
2161 /* Set the TCP sequence number. */
2164 /* Set up the TCP flag field. */
2172 /* fill in timestamp option if in use */
2180 }
2182 /* Fill in SACK options */
2202 }
2205 }
2215 }
2217 /*
2218 * Prime pump for checksum calculation in IP. Include the
2219 * adjustment for a source route if any.
2220 */
2230 }
2232 }
2233 }
2235 /*
2236 * Dummy socket upcalls for if/when the conn_t gets detached from a
2237 * direct-callback sonode via a user-driven close(). Easy to catch with
2238 * DTrace FBT, and should be mostly harmless.
2239 */
2241 /* ARGSUSED */
2242 static sock_upper_handle_t
2245 {
2248 }
2250 /* ARGSUSED */
2251 static void
2253 pid_t pid)
2254 {
2256 /* Normally we'd crhold(cr) and attach it to socket state. */
2257 /* LINTED */
2258 }
2260 /* ARGSUSED */
2261 static int
2263 {
2266 }
2268 /* ARGSUSED */
2269 static void
2271 {
2273 /* We really want this one to be a harmless NOP for now. */
2274 /* LINTED */
2275 }
2277 /* ARGSUSED */
2278 static ssize_t
2281 {
2284 /*
2285 * Consume the message, set ESHUTDOWN, and return an error.
2286 * Nobody's home!
2287 */
2291 }
2293 /* ARGSUSED */
2294 static void
2296 {
2298 }
2300 /* ARGSUSED */
2301 static void
2303 {
2305 }
2307 /* ARGSUSED */
2308 static void
2310 {
2312 /* Otherwise, this would signal socket state about OOB data. */
2313 }
2315 /* ARGSUSED */
2316 static void
2318 {
2320 }
2322 /* ARGSUSED */
2323 static void
2325 {
2327 }
2330 tcp_dummy_newconn,
2331 tcp_dummy_connected,
2332 tcp_dummy_disconnected,
2333 tcp_dummy_opctl,
2334 tcp_dummy_recv,
2335 tcp_dummy_set_proto_props,
2336 tcp_dummy_txq_full,
2337 tcp_dummy_signal_oob,
2338 tcp_dummy_onearg,
2339 tcp_dummy_set_error,
2340 tcp_dummy_onearg
2341 };
2343 /*
2344 * Handle M_DATA messages from IP. Its called directly from IP via
2345 * squeue for received IP packets.
2346 *
2347 * The first argument is always the connp/tcp to which the mp belongs.
2348 * There are no exceptions to this rule. The caller has already put
2349 * a reference on this connp/tcp and once tcp_input_data() returns,
2350 * the squeue will do the refrele.
2351 *
2352 * The TH_SYN for the listener directly go to tcp_input_listener via
2353 * squeue. ICMP errors go directly to tcp_icmp_input().
2354 *
2355 * sqp: NULL = recursive, sqp != NULL means called from squeue
2356 */
2357 void
2359 {
2363 uint_t flags;
2370 uint_t ip_hdr_len;
2374 tcp_opt_t tcpopt;
2375 ip_pkt_t ipp;
2387 /*
2388 * RST from fused tcp loopback peer should trigger an unfuse.
2389 */
2393 }
2401 /*
2402 * Record packet information in the ip_pkt_t
2403 */
2407 B_FALSE);
2411 /*
2412 * IPv6 packets can only be received by applications
2413 * that are prepared to receive IPv6 addresses.
2414 * The IP fanout must ensure this.
2415 */
2422 /* Could have caused a pullup? */
2425 }
2426 }
2443 }
2453 }
2456 /*
2457 * This is the correct place to update tcp_last_recv_time. Note
2458 * that it is also updated for tcp structure that belongs to
2459 * global and listener queues which do not really need updating.
2460 * But that should not cause any harm. And it is updated for
2461 * all kinds of incoming segments, not only for data segments.
2462 */
2464 }
2472 /*
2473 * TCP can't handle urgent pointers that arrive before
2474 * the connection has been accept()ed since it can't
2475 * buffer OOB data. Discard segment if this happens.
2476 *
2477 * We can't just rely on a non-null tcp_listener to indicate
2478 * that the accept() has completed since unlinking of the
2479 * eager and completion of the accept are not atomic.
2480 * tcp_detached, when it is not set (B_FALSE) indicates
2481 * that the accept() has completed.
2482 *
2483 * Nor can it reassemble urgent pointers, so discard
2484 * if it's not the next segment expected.
2485 *
2486 * Otherwise, collapse chain into one mblk (discard if
2487 * that fails). This makes sure the headers, retransmitted
2488 * data, and new data all are in the same mblk.
2489 */
2494 }
2495 /* Update pointers into message */
2499 /*
2500 * Since we can't handle any data with this urgent
2501 * pointer that is out of sequence, we expunge
2502 * the data. This allows us to still register
2503 * the urgent mark and generate the M_PCSIG,
2504 * which we can do.
2505 */
2508 }
2509 }
2512 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2529 SQTAG_CONNECT_FINISH);
2531 }
2533 }
2535 /*
2536 * Note that our stack cannot send data before a
2537 * connection is established, therefore the
2538 * following check is valid. Otherwise, it has
2539 * to be changed.
2540 */
2549 }
2551 }
2559 }
2562 }
2566 }
2568 /* Process all TCP options. */
2570 /*
2571 * The following changes our rwnd to be a multiple of the
2572 * MIN(peer MSS, our MSS) for performance reason.
2573 */
2577 /* Is the other end ECN capable? */
2581 }
2582 }
2583 /*
2584 * Clear ECN flags because it may interfere with later
2585 * processing.
2586 */
2594 /* Allocate room for SACK options if needed. */
2603 }
2605 /*
2606 * If we can't get the confirmation upstream, pretend
2607 * we didn't even see this one.
2608 *
2609 * XXX: how can we pretend we didn't see it if we
2610 * have updated rnxt et. al.
2611 *
2612 * For loopback we defer sending up the T_CONN_CON
2613 * until after some checks below.
2614 */
2616 /*
2617 * tcp_sendmsg() checks tcp_state without entering
2618 * the squeue so tcp_state should be updated before
2619 * sending up connection confirmation. Probe the
2620 * state change below when we are sure the connection
2621 * confirmation has been sent.
2622 */
2629 }
2631 /* SYN was acked - making progress */
2634 /* One for the SYN */
2638 /*
2639 * If SYN was retransmitted, need to reset all
2640 * retransmission info. This is because this
2641 * segment will be treated as a dup ACK.
2642 */
2651 /*
2652 * Set tcp_cwnd back to 1 MSS, per
2653 * recommendation from
2654 * draft-floyd-incr-init-win-01.txt,
2655 * Increasing TCP's Initial Window.
2656 */
2658 }
2668 /*
2669 * Always send the three-way handshake ack immediately
2670 * in order to make the connection complete as soon as
2671 * possible on the accepting host.
2672 */
2675 /*
2676 * Trace connect-established here.
2677 */
2682 /* Trace change from SYN_SENT -> ESTABLISHED here */
2687 /*
2688 * Special case for loopback. At this point we have
2689 * received SYN-ACK from the remote endpoint. In
2690 * order to ensure that both endpoints reach the
2691 * fused state prior to any data exchange, the final
2692 * ACK needs to be sent before we indicate T_CONN_CON
2693 * to the module upstream.
2694 */
2700 /*
2701 * For loopback, we always get a pure SYN-ACK
2702 * and only need to send back the final ACK
2703 * with no data (this is because the other
2704 * tcp is ours and we don't do T/TCP). This
2705 * final ACK triggers the passive side to
2706 * perform fusion in ESTABLISHED state.
2707 */
2713 }
2719 /* Send up T_CONN_CON */
2724 }
2733 }
2737 }
2738 /*
2739 * Forget fusion; we need to handle more
2740 * complex cases below. Send the deferred
2741 * T_CONN_CON message upstream and proceed
2742 * as usual. Mark this tcp as not capable
2743 * of fusion.
2744 */
2751 }
2759 }
2760 }
2762 /*
2763 * Check to see if there is data to be sent. If
2764 * yes, set the transmit flag. Then check to see
2765 * if received data processing needs to be done.
2766 * If not, go straight to xmit_check. This short
2767 * cut is OK as we don't support T/TCP.
2768 */
2775 }
2778 seg_seq++;
2780 }
2790 }
2797 /*
2798 * In this state, a SYN|ACK packet is either bogus
2799 * because the other side must be ACKing our SYN which
2800 * indicates it has seen the ACK for their SYN and
2801 * shouldn't retransmit it or we're crossing SYNs
2802 * on active open.
2803 */
2809 }
2810 /*
2811 * NOTE: RFC 793 pg. 72 says this should be
2812 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2813 * but that would mean we have an ack that ignored
2814 * our SYN.
2815 */
2822 }
2823 /*
2824 * No sane TCP stack will send such a small window
2825 * without receiving any data. Just drop this invalid
2826 * ACK. We also shorten the abort timeout in case
2827 * this is an attack.
2828 */
2837 }
2838 }
2841 /*
2842 * Only a TLI listener can come through this path when a
2843 * acceptor is going back to be a listener and a packet
2844 * for the acceptor hits the classifier. For a socket
2845 * listener, this can never happen because a listener
2846 * can never accept connection on itself and hence a
2847 * socket acceptor can not go back to being a listener.
2848 */
2850 /*FALLTHRU*/
2856 /*
2857 * Don't accept any input on a closed tcp as this TCP logically
2858 * does not exist on the system. Don't proceed further with
2859 * this TCP. For instance, this packet could trigger another
2860 * close of this tcp which would be disastrous for tcp_refcnt.
2861 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2862 * be called at most once on a TCP. In this case we need to
2863 * refeed the packet into the classifier and figure out where
2864 * the packet should go.
2865 */
2868 /* Drops ref on new_connp */
2871 }
2872 /* We failed to classify. For now just drop the packet */
2875 }
2877 /*
2878 * Handle the case where the tcp_clean_death() has happened
2879 * on a connection (application hasn't closed yet) but a packet
2880 * was already queued on squeue before tcp_clean_death()
2881 * was processed. Calling tcp_clean_death() twice on same
2882 * connection can result in weird behaviour.
2883 */
2888 }
2890 /*
2891 * Already on the correct queue/perimeter.
2892 * If this is a detached connection and not an eager
2893 * connection hanging off a listener then new data
2894 * (past the FIN) will cause a reset.
2895 * We do a special check here where it
2896 * is out of the main line, rather than check
2897 * if we are detached every time we see new
2898 * data down below.
2899 */
2909 }
2918 /*
2919 * This segment is not acceptable.
2920 * Drop it and send back an ACK.
2921 */
2925 }
2928 /*
2929 * SACK info in already updated in tcp_parse_options. Ignore
2930 * all other TCP options...
2931 */
2933 }
2934 try_again:;
2938 /*
2939 * gap is the amount of sequence space between what we expect to see
2940 * and what we got for seg_seq. A positive value for gap means
2941 * something got lost. A negative value means we got some old stuff.
2942 */
2944 /* Old stuff present. Is the SYN in there? */
2948 seg_seq++;
2949 urp--;
2950 /* Recompute the gaps after noting the SYN. */
2952 }
2956 /* Remove the old stuff from seg_len. */
2958 /*
2959 * Anything left?
2960 * Make sure to check for unack'd FIN when rest of data
2961 * has been previously ack'd.
2962 */
2964 /*
2965 * Resets are only valid if they lie within our offered
2966 * window. If the RST bit is set, we just ignore this
2967 * segment.
2968 */
2972 }
2974 /*
2975 * The arriving of dup data packets indicate that we
2976 * may have postponed an ack for too long, or the other
2977 * side's RTT estimate is out of shape. Start acking
2978 * more often.
2979 */
2984 }
2987 /*
2988 * This segment is "unacceptable". None of its
2989 * sequence space lies within our advertized window.
2990 *
2991 * Adjust seg_len to the original value for tracing.
2992 */
2996 "tcp_rput: unacceptable, gap %d, rgap %d, "
2997 "flags 0x%x, seg_seq %u, seg_ack %u, "
3002 DISP_ADDR_AND_PORT));
3003 }
3005 /*
3006 * Arrange to send an ACK in response to the
3007 * unacceptable segment per RFC 793 page 69. There
3008 * is only one small difference between ours and the
3009 * acceptability test in the RFC - we accept ACK-only
3010 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3011 * will be generated.
3012 *
3013 * Note that we have to ACK an ACK-only packet at least
3014 * for stacks that send 0-length keep-alives with
3015 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3016 * section 4.2.3.6. As long as we don't ever generate
3017 * an unacceptable packet in response to an incoming
3018 * packet that is unacceptable, it should not cause
3019 * "ACK wars".
3020 */
3023 /*
3024 * Continue processing this segment in order to use the
3025 * ACK information it contains, but skip all other
3026 * sequence-number processing. Processing the ACK
3027 * information is necessary in order to
3028 * re-synchronize connections that may have lost
3029 * synchronization.
3030 *
3031 * We clear seg_len and flag fields related to
3032 * sequence number processing as they are not
3033 * to be trusted for an unacceptable segment.
3034 */
3038 }
3040 /* Fix seg_seq, and chew the gap off the front. */
3051 }
3056 /*
3057 * If the urgent data has already been acknowledged, we
3058 * should ignore TH_URG below
3059 */
3062 }
3063 /*
3064 * rgap is the amount of stuff received out of window. A negative
3065 * value is the amount out of window.
3066 */
3075 }
3077 /*
3078 * seg_len does not include the FIN, so if more than
3079 * just the FIN is out of window, we act like we don't
3080 * see it. (If just the FIN is out of window, rgap
3081 * will be zero and we will go ahead and acknowledge
3082 * the FIN.)
3083 */
3086 /* Fix seg_len and make sure there is something left. */
3089 /*
3090 * Resets are only valid if they lie within our offered
3091 * window. If the RST bit is set, we just ignore this
3092 * segment.
3093 */
3097 }
3099 /* Per RFC 793, we need to send back an ACK. */
3102 /*
3103 * Send SIGURG as soon as possible i.e. even
3104 * if the TH_URG was delivered in a window probe
3105 * packet (which will be unacceptable).
3106 *
3107 * We generate a signal if none has been generated
3108 * for this connection or if this is a new urgent
3109 * byte. Also send a zero-length "unmarked" message
3110 * to inform SIOCATMARK that this is not the mark.
3111 *
3112 * tcp_urp_last_valid is cleared when the T_exdata_ind
3113 * is sent up. This plus the check for old data
3114 * (gap >= 0) handles the wraparound of the sequence
3115 * number space without having to always track the
3116 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3117 * this max in its rcv_up variable).
3118 *
3119 * This prevents duplicate SIGURGS due to a "late"
3120 * zero-window probe when the T_EXDATA_IND has already
3121 * been sent up.
3122 */
3130 urp);
3131 }
3137 }
3141 /* Try again on the rexmit. */
3145 }
3146 /*
3147 * If the next byte would be the mark
3148 * then mark with MARKNEXT else mark
3149 * with NOTMARKNEXT.
3150 */
3153 else
3158 }
3161 }
3162 /*
3163 * If this is a zero window probe, continue to
3164 * process the ACK part. But we need to set seg_len
3165 * to 0 to avoid data processing. Otherwise just
3166 * drop the segment and send back an ACK.
3167 */
3175 }
3176 }
3177 /* Pitch out of window stuff off the end. */
3189 }
3191 }
3193 }
3194 ok:;
3195 /*
3196 * TCP should check ECN info for segments inside the window only.
3197 * Therefore the check should be done here.
3198 */
3202 }
3203 /*
3204 * Note that both ECN_CE and CWR can be set in the
3205 * same segment. In this case, we once again turn
3206 * on ECN_ECHO.
3207 */
3213 }
3220 }
3221 }
3222 }
3224 /*
3225 * Check whether we can update tcp_ts_recent. This test is
3226 * NOT the one in RFC 1323 3.4. It is from Braden, 1993, "TCP
3227 * Extensions for High Performance: An Update", Internet Draft.
3228 */
3234 }
3237 /*
3238 * FIN in an out of order segment. We record this in
3239 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3240 * Clear the FIN so that any check on FIN flag will fail.
3241 * Remember that FIN also counts in the sequence number
3242 * space. So we need to ack out of order FIN only segments.
3243 */
3249 }
3251 /* Fill in the SACK blk list. */
3256 }
3258 /*
3259 * Attempt reassembly and see if we have something
3260 * ready to go.
3261 */
3263 /* Always ack out of order packets */
3271 /*
3272 * A gap is filled and the seq num and len
3273 * of the gap match that of a previously
3274 * received FIN, put the FIN flag back in.
3275 */
3281 }
3285 /*
3286 * Restart the timer if there is still
3287 * data in the reassembly queue.
3288 */
3295 }
3296 }
3298 /*
3299 * Keep going even with NULL mp.
3300 * There may be a useful ACK or something else
3301 * we don't want to miss.
3302 *
3303 * But TCP should not perform fast retransmit
3304 * because of the ack number. TCP uses
3305 * seg_len == 0 to determine if it is a pure
3306 * ACK. And this is not a pure ACK.
3307 */
3314 tcp_reass_timer,
3316 }
3317 }
3318 }
3322 /*
3323 * If an out of order FIN was received before, and the seq
3324 * num and len of the new segment match that of the FIN,
3325 * put the FIN flag back in.
3326 */
3331 }
3332 }
3354 }
3356 }
3358 /*
3359 * See RFC 793, Page 71
3360 *
3361 * The seq number must be in the window as it should
3362 * be "fixed" above. If it is outside window, it should
3363 * be already rejected. Note that we allow seg_seq to be
3364 * rnxt + rwnd because we want to accept 0 window probe.
3365 */
3369 /*
3370 * If the ACK flag is not set, just use our snxt as the
3371 * seq number of the RST segment.
3372 */
3375 }
3381 }
3382 /*
3383 * urp could be -1 when the urp field in the packet is 0
3384 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3385 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3386 */
3390 /*
3391 * Non-STREAMS sockets handle the urgent data a litte
3392 * differently from STREAMS based sockets. There is no
3393 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3394 * flags to keep SIOCATMARK happy. Instead a
3395 * su_signal_oob upcall is made to update the mark.
3396 * Neither is a T_EXDATA_IND mblk needed to be
3397 * prepended to the urgent data. The urgent data is
3398 * delivered using the su_recv upcall, where we set
3399 * the MSG_OOB flag to indicate that it is urg data.
3400 *
3401 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3402 * are used by non-STREAMS sockets.
3403 */
3408 }
3410 /*
3411 * If we haven't generated the signal yet for
3412 * this urgent pointer value, do it now. Also,
3413 * send up a zero-length M_DATA indicating
3414 * whether or not this is the mark. The latter
3415 * is not needed when a T_EXDATA_IND is sent up.
3416 * However, if there are allocation failures
3417 * this code relies on the sender retransmitting
3418 * and the socket code for determining the mark
3419 * should not block waiting for the peer to
3420 * transmit. Thus, for simplicity we always
3421 * send up the mark indication.
3422 */
3427 }
3430 SIGURG)) {
3431 /* Try again on the rexmit. */
3435 }
3436 /*
3437 * Mark with NOTMARKNEXT for now.
3438 * The code below will change this to MARKNEXT
3439 * if we are at the mark.
3440 *
3441 * If there are allocation failures (e.g. in
3442 * dupmsg below) the next time tcp_input_data
3443 * sees the urgent segment it will send up the
3444 * MSGMARKNEXT message.
3445 */
3450 #ifdef DEBUG
3452 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3457 }
3461 /*
3462 * An allocation failure prevented the previous
3463 * tcp_input_data from sending up the allocated
3464 * MSG*MARKNEXT message - send it up this time
3465 * around.
3466 */
3468 }
3470 /*
3471 * If the urgent byte is in this segment, make sure that it is
3472 * all by itself. This makes it much easier to deal with the
3473 * possibility of an allocation failure on the T_exdata_ind.
3474 * Note that seg_len is the number of bytes in the segment, and
3475 * urp is the offset into the segment of the urgent byte.
3476 * urp < seg_len means that the urgent byte is in this segment.
3477 */
3481 /*
3482 * Break it up and feed it back in.
3483 * Re-attach the IP header.
3484 */
3487 /*
3488 * There is stuff before the urgent
3489 * byte.
3490 */
3493 /*
3494 * Trim from urgent byte on.
3495 * The rest will come back.
3496 */
3502 }
3504 /* Feed this piece back in. */
3507 /*
3508 * If the data passed back in was not
3509 * processed (ie: bad ACK) sending
3510 * the remainder back in will cause a
3511 * loop. In this case, drop the
3512 * packet and let the sender try
3513 * sending a good packet.
3514 */
3518 }
3519 }
3522 /*
3523 * There is stuff after the urgent
3524 * byte.
3525 */
3528 /*
3529 * Trim everything beyond the
3530 * urgent byte. The rest will
3531 * come back.
3532 */
3538 }
3542 /*
3543 * If the data passed back in was not
3544 * processed (ie: bad ACK) sending
3545 * the remainder back in will cause a
3546 * loop. In this case, drop the
3547 * packet and let the sender try
3548 * sending a good packet.
3549 */
3553 }
3554 }
3557 }
3558 /*
3559 * This segment contains only the urgent byte. We
3560 * have to allocate the T_exdata_ind, if we can.
3561 */
3568 /*
3569 * We should never be in middle of a
3570 * fallback, the squeue guarantees that.
3571 */
3578 BPRI_MED);
3580 /*
3581 * Sigh... It'll be back.
3582 * Generate any MSG*MARK message now.
3583 */
3593 MSGMARKNEXT;
3594 }
3596 }
3603 #ifdef DEBUG
3607 DISP_PORT_ONLY));
3609 /*
3610 * There is no need to send a separate MSG*MARK
3611 * message since the T_EXDATA_IND will be sent
3612 * now.
3613 */
3617 }
3618 /*
3619 * Now we are all set. On the next putnext upstream,
3620 * tcp_urp_mp will be non-NULL and will get prepended
3621 * to what has to be this piece containing the urgent
3622 * byte. If for any reason we abort this segment below,
3623 * if it comes back, we will have this ready, or it
3624 * will get blown off in close.
3625 */
3627 /*
3628 * The urgent byte is the next byte after this sequence
3629 * number. If this endpoint is non-STREAMS, then there
3630 * is nothing to do here since the socket has already
3631 * been notified about the urg pointer by the
3632 * su_signal_oob call above.
3633 *
3634 * In case of STREAMS, some more work might be needed.
3635 * If there is data it is marked with MSGMARKNEXT and
3636 * and any tcp_urp_mark_mp is discarded since it is not
3637 * needed. Otherwise, if the code above just allocated
3638 * a zero-length tcp_urp_mark_mp message, that message
3639 * is tagged with MSGMARKNEXT. Sending up these
3640 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3641 * even though the T_EXDATA_IND will not be sent up
3642 * until the urgent byte arrives.
3643 */
3655 MSGMARKNEXT;
3656 }
3657 }
3658 #ifdef DEBUG
3664 }
3665 #ifdef DEBUG
3667 /* Data left until we hit mark */
3671 DISP_PORT_ONLY));
3672 }
3674 }
3676 process_ack:
3680 }
3681 }
3687 /*
3688 * tcp_sendmsg() checks tcp_state without entering
3689 * the squeue so tcp_state should be updated before
3690 * sending up a connection confirmation or a new
3691 * connection indication.
3692 */
3695 /*
3696 * We are seeing the final ack in the three way
3697 * hand shake of a active open'ed connection
3698 * so we must send up a T_CONN_CON
3699 */
3705 }
3706 /*
3707 * Don't fuse the loopback endpoints for
3708 * simultaneous active opens.
3709 */
3713 }
3714 /*
3715 * For simultaneous active open, trace receipt of final
3716 * ACK as tcp:::connect-established.
3717 */
3722 /*
3723 * 3-way handshake has completed, so notify socket
3724 * of the new connection.
3725 *
3726 * We are here means eager is fine but it can
3727 * get a TH_RST at any point between now and till
3728 * accept completes and disappear. We need to
3729 * ensure that reference to eager is valid after
3730 * we get out of eager's perimeter. So we do
3731 * an extra refhold.
3732 */
3736 /*
3737 * The state-change probe for SYN_RCVD ->
3738 * ESTABLISHED has not fired yet. We reset
3739 * the state to SYN_RCVD so that future
3740 * state-change probes report correct state
3741 * transistions.
3742 */
3745 /* notification did not go up, so drop ref */
3747 /* ... and close the eager */
3751 }
3752 /*
3753 * tcp_newconn_notify() changes conn_upcalls and
3754 * connp->conn_upper_handle. Fix things now, in case
3755 * there's data attached to this ack.
3756 */
3759 /*
3760 * For passive open, trace receipt of final ACK as
3761 * tcp:::accept-established.
3762 */
3767 /*
3768 * 3-way handshake complete - this is a STREAMS based
3769 * socket, so pass up the T_CONN_IND.
3770 */
3777 /*
3778 * We are here means eager is fine but it can
3779 * get a TH_RST at any point between now and till
3780 * accept completes and disappear. We need to
3781 * ensure that reference to eager is valid after
3782 * we get out of eager's perimeter. So we do
3783 * an extra refhold.
3784 */
3787 /*
3788 * The listener also exists because of the refhold
3789 * done in tcp_input_listener. Its possible that it
3790 * might have closed. We will check that once we
3791 * get inside listeners context.
3792 */
3796 /*
3797 * We optimize by not calling an SQUEUE_ENTER
3798 * on the listener since we know that the
3799 * listener and eager squeues are the same.
3800 * We are able to make this check safely only
3801 * because neither the eager nor the listener
3802 * can change its squeue. Only an active connect
3803 * can change its squeue
3804 */
3812 SQTAG_TCP_CONN_IND);
3817 SQTAG_TCP_CONN_IND);
3818 }
3819 /*
3820 * For passive open, trace receipt of final ACK as
3821 * tcp:::accept-established.
3822 */
3826 }
3830 bytes_acked--;
3831 /* SYN was acked - making progress */
3834 /*
3835 * If SYN was retransmitted, need to reset all
3836 * retransmission info as this segment will be
3837 * treated as a dup ACK.
3838 */
3847 }
3849 /*
3850 * We set the send window to zero here.
3851 * This is needed if there is data to be
3852 * processed already on the queue.
3853 * Later (at swnd_update label), the
3854 * "new_swnd > tcp_swnd" condition is satisfied
3855 * the XMIT_NEEDED flag is set in the current
3856 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3857 * called if there is already data on queue in
3858 * this state.
3859 */
3868 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3873 /* Fuse when both sides are in ESTABLISHED state */
3877 }
3878 /* This code follows 4.4BSD-Lite2 mostly. */
3882 /*
3883 * If TCP is ECN capable and the congestion experience bit is
3884 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3885 * done once per window (or more loosely, per RTT).
3886 */
3894 /*
3895 * If the cwnd is 0, use the timer to clock out
3896 * new segments. This is required by the ECN spec.
3897 */
3900 /*
3901 * This makes sure that when the ACK comes
3902 * back, we will increase tcp_cwnd by 1 MSS.
3903 */
3905 }
3907 /*
3908 * This marks the end of the current window of in
3909 * flight data. That is why we don't use
3910 * tcp_suna + tcp_swnd. Only data in flight can
3911 * provide ECN info.
3912 */
3915 }
3916 }
3924 /*
3925 * Fast retransmit. When we have seen exactly three
3926 * identical ACKs while we have unacked data
3927 * outstanding we take it as a hint that our peer
3928 * dropped something.
3929 *
3930 * If TCP is retransmitting, don't do fast retransmit.
3931 */
3934 /* Do Limited Transmit */
3937 /*
3938 * RFC 3042
3939 *
3940 * What we need to do is temporarily
3941 * increase tcp_cwnd so that new
3942 * data can be sent if it is allowed
3943 * by the receive window (tcp_rwnd).
3944 * tcp_wput_data() will take care of
3945 * the rest.
3946 *
3947 * If the connection is SACK capable,
3948 * only do limited xmit when there
3949 * is SACK info.
3950 *
3951 * Note how tcp_cwnd is incremented.
3952 * The first dup ACK will increase
3953 * it by 1 MSS. The second dup ACK
3954 * will increase it by 2 MSS. This
3955 * means that only 1 new segment will
3956 * be sent for each dup ACK.
3957 */
3965 }
3969 /*
3970 * If we have reduced tcp_ssthresh
3971 * because of ECN, do not reduce it again
3972 * unless it is already one window of data
3973 * away. After one window of data, tcp_cwr
3974 * should then be cleared. Note that
3975 * for non ECN capable connection, tcp_cwr
3976 * should always be false.
3977 *
3978 * Adjust cwnd since the duplicate
3979 * ack indicates that a packet was
3980 * dropped (due to congestion.)
3981 */
3986 mss;
3989 }
3994 }
3996 /*
3997 * We do Hoe's algorithm. Refer to her
3998 * paper "Improving the Start-up Behavior
3999 * of a Congestion Control Scheme for TCP,"
4000 * appeared in SIGCOMM'96.
4001 *
4002 * Save highest seq no we have sent so far.
4003 * Be careful about the invisible FIN byte.
4004 */
4010 }
4012 /*
4013 * Do not allow bursty traffic during.
4014 * fast recovery. Refer to Fall and Floyd's
4015 * paper "Simulation-based Comparisons of
4016 * Tahoe, Reno and SACK TCP" (in CCR?)
4017 * This is a best current practise.
4018 */
4021 /*
4022 * For SACK:
4023 * Calculate tcp_pipe, which is the
4024 * estimated number of bytes in
4025 * network.
4026 *
4027 * tcp_fack is the highest sack'ed seq num
4028 * TCP has received.
4029 *
4030 * tcp_pipe is explained in the above quoted
4031 * Fall and Floyd's paper. tcp_fack is
4032 * explained in Mathis and Mahdavi's
4033 * "Forward Acknowledgment: Refining TCP
4034 * Congestion Control" in SIGCOMM '96.
4035 */
4043 /*
4044 * Always initialize tcp_pipe
4045 * even though we don't have
4046 * any SACK info. If later
4047 * we get SACK info and
4048 * tcp_pipe is not initialized,
4049 * funny things will happen.
4050 */
4053 }
4059 /*
4060 * Here we perform congestion
4061 * avoidance, but NOT slow start.
4062 * This is known as the Fast
4063 * Recovery Algorithm.
4064 */
4072 /*
4073 * We know that one more packet has
4074 * left the pipe thus we can update
4075 * cwnd.
4076 */
4083 }
4084 }
4085 }
4087 /*
4088 * If the window has opened, need to arrange
4089 * to send additional data.
4090 */
4092 /* tcp_suna != tcp_snxt */
4093 /* Packet contains a window update */
4099 /*
4100 * Transmit starting with tcp_suna since
4101 * the one byte probe is not ack'ed.
4102 * If TCP has sent more than one identical
4103 * probe, tcp_rexmit will be set. That means
4104 * tcp_ss_rexmit() will send out the one
4105 * byte along with new data. Otherwise,
4106 * fake the retransmission.
4107 */
4114 }
4115 }
4116 }
4118 }
4120 /*
4121 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4122 * If the ACK value acks something that we have not yet sent, it might
4123 * be an old duplicate segment. Send an ACK to re-synchronize the
4124 * other side.
4125 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4126 * state is handled above, so we can always just drop the segment and
4127 * send an ACK here.
4128 *
4129 * In the case where the peer shrinks the window, we see the new window
4130 * update, but all the data sent previously is queued up by the peer.
4131 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4132 * number, which was already sent, and within window, is recorded.
4133 * tcp_snxt is then updated.
4134 *
4135 * If the window has previously shrunk, and an ACK for data not yet
4136 * sent, according to tcp_snxt is recieved, it may still be valid. If
4137 * the ACK is for data within the window at the time the window was
4138 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4139 * the sequence number ACK'ed.
4140 *
4141 * If the ACK covers all the data sent at the time the window was
4142 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4143 *
4144 * Should we send ACKs in response to ACK only segments?
4145 */
4157 /* drop the received segment */
4160 /*
4161 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4162 * greater than 0, check if the number of such
4163 * bogus ACks is greater than that count. If yes,
4164 * don't send back any ACK. This prevents TCP from
4165 * getting into an ACK storm if somehow an attacker
4166 * successfully spoofs an acceptable segment to our
4167 * peer. If this continues (count > 2 X threshold),
4168 * we should abort this connection.
4169 */
4172 tcp_drop_ack_unsent_cnt) {
4175 tcp_drop_ack_unsent_cnt) {
4177 }
4179 }
4185 }
4187 }
4191 }
4193 /*
4194 * TCP gets a new ACK, update the notsack'ed list to delete those
4195 * blocks that are covered by this ACK.
4196 */
4200 }
4202 /*
4203 * If we got an ACK after fast retransmit, check to see
4204 * if it is a partial ACK. If it is not and the congestion
4205 * window was inflated to account for the other side's
4206 * cached packets, retract it. If it is, do Hoe's algorithm.
4207 */
4212 /*
4213 * Restore the orig tcp_cwnd_ssthresh after
4214 * fast retransmit phase.
4215 */
4218 }
4224 /*
4225 * Remove all notsack info to avoid confusion with
4226 * the next fast retrasnmit/recovery phase.
4227 */
4230 tcp);
4231 }
4240 /*
4241 * Hoe's algorithm:
4242 *
4243 * Retransmit the unack'ed segment and
4244 * restart fast recovery. Note that we
4245 * need to scale back tcp_cwnd to the
4246 * original value when we started fast
4247 * recovery. This is to prevent overly
4248 * aggressive behaviour in sending new
4249 * segments.
4250 */
4255 }
4256 }
4260 /*
4261 * TCP is retranmitting. If the ACK ack's all
4262 * outstanding data, update tcp_rexmit_max and
4263 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4264 * to the correct value.
4265 *
4266 * Note that SEQ_LEQ() is used. This is to avoid
4267 * unnecessary fast retransmit caused by dup ACKs
4268 * received when TCP does slow start retransmission
4269 * after a time out. During this phase, TCP may
4270 * send out segments which are already received.
4271 * This causes dup ACKs to be sent back.
4272 */
4276 }
4279 }
4285 }
4287 }
4288 }
4296 }
4298 /*
4299 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4300 * Note that it cannot be the SYN being ack'ed. The code flow
4301 * will not reach here.
4302 */
4305 }
4307 /*
4308 * Update the congestion window.
4309 *
4310 * If TCP is not ECN capable or TCP is ECN capable but the
4311 * congestion experience bit is not set, increase the tcp_cwnd as
4312 * usual.
4313 */
4319 /*
4320 * This is to prevent an increase of less than 1 MSS of
4321 * tcp_cwnd. With partial increase, tcp_wput_data()
4322 * may send out tinygrams in order to preserve mblk
4323 * boundaries.
4324 *
4325 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4326 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4327 * increased by 1 MSS for every RTTs.
4328 */
4334 }
4335 }
4337 }
4339 /* See if the latest urgent data has been acknowledged */
4344 /* Can we update the RTT estimates? */
4346 /* Ignore zero timestamp echo-reply. */
4350 }
4352 /* If needed, restart the timer. */
4356 }
4357 /*
4358 * Update tcp_csuna in case the other side stops sending
4359 * us timestamps.
4360 */
4363 /*
4364 * An ACK sequence we haven't seen before, so get the RTT
4365 * and update the RTO. But first check if the timestamp is
4366 * valid to use.
4367 */
4372 else
4375 /* Remeber the last sequence to be ACKed */
4380 }
4383 }
4385 /* Eat acknowledged bytes off the xmit queue. */
4395 /*
4396 * Set a new timestamp if all the bytes timed by the
4397 * old timestamp have been ack'ed.
4398 */
4404 }
4406 }
4412 /*
4413 * This notification is required for some zero-copy
4414 * clients to maintain a copy semantic. After the data
4415 * is ack'ed, client is safe to modify or reuse the buffer.
4416 */
4423 /* Everything is ack'ed, clear the tail. */
4425 /*
4426 * Cancel the timer unless we are still
4427 * waiting for an ACK for the FIN packet.
4428 */
4434 }
4436 }
4445 }
4447 /*
4448 * More was acked but there is nothing more
4449 * outstanding. This means that the FIN was
4450 * just acked or that we're talking to a clown.
4451 */
4452 fin_acked:
4456 /* FIN was acked - making progress */
4466 }
4468 /*
4469 * We should never get here because
4470 * we have already checked that the
4471 * number of bytes ack'ed should be
4472 * smaller than or equal to what we
4473 * have sent so far (it is the
4474 * acceptability check of the ACK).
4475 * We can only get here if the send
4476 * queue is corrupted.
4477 *
4478 * Terminate the connection and
4479 * panic the system. It is better
4480 * for us to panic instead of
4481 * continuing to avoid other disaster.
4482 */
4488 DISP_ADDR_AND_PORT));
4489 /*NOTREACHED*/
4490 }
4492 }
4494 }
4497 }
4498 pre_swnd_update:
4500 swnd_update:
4501 /*
4502 * The following check is different from most other implementations.
4503 * For bi-directional transfer, when segments are dropped, the
4504 * "normal" check will not accept a window update in those
4505 * retransmitted segemnts. Failing to do that, TCP may send out
4506 * segments which are outside receiver's window. As TCP accepts
4507 * the ack in those retransmitted segments, if the window update in
4508 * the same segment is not accepted, TCP will incorrectly calculates
4509 * that it can send more segments. This can create a deadlock
4510 * with the receiver if its window becomes zero.
4511 */
4515 /*
4516 * The criteria for update is:
4517 *
4518 * 1. the segment acknowledges some data. Or
4519 * 2. the segment is new, i.e. it has a higher seq num. Or
4520 * 3. the segment is not old and the advertised window is
4521 * larger than the previous advertised window.
4522 */
4530 }
4531 est:
4542 /*
4543 * We implement the non-standard BSD/SunOS
4544 * FIN_WAIT_2 flushing algorithm.
4545 * If there is no user attached to this
4546 * TCP endpoint, then this TCP struct
4547 * could hang around forever in FIN_WAIT_2
4548 * state if the peer forgets to send us
4549 * a FIN. To prevent this, we wait only
4550 * 2*MSL (a convenient time value) for
4551 * the FIN to arrive. If it doesn't show up,
4552 * we flush the TCP endpoint. This algorithm,
4553 * though a violation of RFC-793, has worked
4554 * for over 10 years in BSD systems.
4555 * Note: SunOS 4.x waits 675 seconds before
4556 * flushing the FIN_WAIT_2 connection.
4557 */
4560 }
4569 }
4577 TCPS_CLOSING);
4578 }
4579 /*FALLTHRU*/
4586 }
4587 }
4589 /* Make sure we ack the fin */
4597 /*
4598 * Generate the ordrel_ind at the end unless the
4599 * conn is detached or it is a STREAMS based eager.
4600 * In the eager case we defer the notification until
4601 * tcp_accept_finish has run.
4602 */
4614 /* Keepalive? */
4622 /* Keepalive? */
4632 }
4633 /* FALLTHRU */
4639 TCPS_FIN_WAIT_2);
4641 /*
4642 * implies data piggybacked on FIN.
4643 * break to handle data.
4644 */
4646 }
4649 }
4650 }
4651 }
4657 }
4659 /*
4660 * The header has been consumed, so we remove the
4661 * zero-length mblk here.
4662 */
4666 }
4667 update_ack:
4670 {
4675 /*
4676 * We have more unacked data than we should - send
4677 * an ACK now.
4678 */
4680 cur_max++;
4683 else
4686 /* We don't have an ACK timer for detached TCP. */
4689 /*
4690 * If we get a segment that is less than an mss, and we
4691 * already have unacknowledged data, and the amount
4692 * unacknowledged is not a multiple of mss, then we
4693 * better generate an ACK now. Otherwise, this may be
4694 * the tail piece of a transaction, and we would rather
4695 * wait for the response.
4696 */
4703 else
4706 /* Start delayed ack timer */
4708 }
4709 }
4716 /* Update SACK list */
4720 }
4726 /* Ready for a new signal. */
4728 #ifdef DEBUG
4733 }
4735 /*
4736 * Check for ancillary data changes compared to last segment.
4737 */
4742 }
4745 /*
4746 * Non-STREAMS socket
4747 */
4753 /*
4754 * We should never be in middle of a
4755 * fallback, the squeue guarantees that.
4756 */
4761 /* PUSH bit set and sockfs is not flow controlled */
4763 }
4765 /*
4766 * Side queue inbound data until the accept happens.
4767 * tcp_accept/tcp_rput drains this when the accept happens.
4768 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4769 * T_EXDATA_IND) it is queued on b_next.
4770 * XXX Make urgent data use this. Requires:
4771 * Removing tcp_listener check for TH_URG
4772 * Making M_PCPROTO and MARK messages skip the eager case
4773 */
4777 /* Active STREAMS socket */
4782 }
4787 #ifdef DEBUG
4791 DISP_PORT_ONLY));
4795 }
4806 /*
4807 * Enqueue the new segment first and then
4808 * call tcp_rcv_drain() to send all data
4809 * up. The other way to do this is to
4810 * send all queued data up and then call
4811 * putnext() to send the new segment up.
4812 * This way can remove the else part later
4813 * on.
4814 *
4815 * We don't do this to avoid one more call to
4816 * canputnext() as tcp_rcv_drain() needs to
4817 * call canputnext().
4818 */
4829 }
4831 /*
4832 * Enqueue all packets when processing an mblk
4833 * from the co queue and also enqueue normal packets.
4834 */
4836 }
4837 /*
4838 * Make sure the timer is running if we have data waiting
4839 * for a push bit. This provides resiliency against
4840 * implementations that do not correctly generate push bits.
4841 */
4843 /*
4844 * The connection may be closed at this point, so don't
4845 * do anything for a detached tcp.
4846 */
4849 tcp_push_timer,
4851 }
4852 }
4854 xmit_check:
4855 /* Is there anything left to do? */
4862 /* Any transmit work to do and a non-zero window? */
4875 B_TRUE);
4883 snd_size);
4885 }
4886 }
4889 }
4890 /*
4891 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4892 * out new segment. Note that tcp_rexmit should not be
4893 * set, otherwise TH_LIMIT_XMIT should not be set.
4894 */
4900 }
4901 }
4902 /*
4903 * Adjust tcp_cwnd back to normal value after sending
4904 * new data segments.
4905 */
4908 /*
4909 * This will restart the timer. Restarting the
4910 * timer is used to avoid a timeout before the
4911 * limited transmitted segment's ACK gets back.
4912 */
4916 }
4918 /* Anything more to do? */
4922 }
4923 ack_check:
4927 /*
4928 * Send up any queued data and then send the mark message
4929 */
4933 }
4941 #ifdef DEBUG
4949 }
4951 /*
4952 * Time to send an ack for some reason.
4953 */
4960 }
4964 }
4965 }
4967 /*
4968 * Arrange for deferred ACK or push wait timeout.
4969 * Start timer if it is not already running.
4970 */
4976 }
4977 }
4979 /*
4980 * Notify upper layer about an orderly release. If this is
4981 * a non-STREAMS socket, then just make an upcall. For STREAMS
4982 * we send up an ordrel_ind, unless this is an eager, in which
4983 * case the ordrel will be sent when tcp_accept_finish runs.
4984 * Note that for non-STREAMS we make an upcall even if it is an
4985 * eager, because we have an upper handle to send it to.
4986 */
4996 }
4999 /*
5000 * Push any mblk(s) enqueued from co processing.
5001 */
5003 }
5010 }
5011 done:
5013 }
5015 /*
5016 * Attach ancillary data to a received TCP segments for the
5017 * ancillary pieces requested by the application that are
5018 * different than they were in the previous data segment.
5019 *
5020 * Save the "current" values once memory allocation is ok so that
5021 * when memory allocation fails we can just wait for the next data segment.
5022 */
5026 {
5037 /* If app asked for pktinfo and the index has changed ... */
5043 }
5044 /* If app asked for hoplimit and it has changed ... */
5049 }
5050 /* If app asked for tclass and it has changed ... */
5055 }
5056 /*
5057 * If app asked for hopbyhop headers and it has changed ...
5058 * For security labels, note that (1) security labels can't change on
5059 * a connected socket at all, (2) we're connected to at most one peer,
5060 * (3) if anything changes, then it must be some other extra option.
5061 */
5072 }
5073 /* If app asked for dst headers before routing headers ... */
5086 }
5087 /* If app asked for routing headers and it has changed ... */
5098 }
5099 /* If app asked for dest headers and it has changed ... */
5111 }
5114 /* Nothing to add */
5116 }
5119 /*
5120 * Defer sending ancillary data until the next TCP segment
5121 * arrives.
5122 */
5124 }
5135 /*
5136 * If app asked for pktinfo and the index has changed ...
5137 * Note that the local address never changes for the connection.
5138 */
5141 uint_t ifindex;
5155 /* Save as "last" value */
5157 }
5158 /* If app asked for hoplimit and it has changed ... */
5169 /* Save as "last" value */
5171 }
5172 /* If app asked for tclass and it has changed ... */
5183 /* Save as "last" value */
5185 }
5196 /* Save as last value */
5200 }
5211 /* Save as last value */
5216 }
5227 /* Save as last value */
5231 }
5242 /* Save as last value */
5246 }
5249 }
5251 /* The minimum of smoothed mean deviation in RTO calculation. */
5252 #define TCP_SD_MIN 400
5254 /*
5255 * Set RTO for this connection. The formula is from Jacobson and Karels'
5256 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names
5257 * are the same as those in Appendix A.2 of that paper.
5258 *
5259 * m = new measurement
5260 * sa = smoothed RTT average (8 * average estimates).
5261 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5262 */
5263 static void
5265 {
5275 /* tcp_rtt_sa is not 0 means this is a new sample. */
5277 /*
5278 * Update average estimator:
5279 * new rtt = 7/8 old rtt + 1/8 Error
5280 */
5282 /* m is now Error in estimate. */
5285 /*
5286 * Don't allow the smoothed average to be negative.
5287 * We use 0 to denote reinitialization of the
5288 * variables.
5289 */
5291 }
5293 /*
5294 * Update deviation estimator:
5295 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5296 */
5302 /*
5303 * This follows BSD's implementation. So the reinitialized
5304 * RTO is 3 * m. We cannot go less than 2 because if the
5305 * link is bandwidth dominated, doubling the window size
5306 * during slow start means doubling the RTT. We want to be
5307 * more conservative when we reinitialize our estimates. 3
5308 * is just a convenient number.
5309 */
5312 }
5314 /*
5315 * We do not know that if sa captures the delay ACK
5316 * effect as in a long train of segments, a receiver
5317 * does not delay its ACKs. So set the minimum of sv
5318 * to be TCP_SD_MIN, which is default to 400 ms, twice
5319 * of BSD DATO. That means the minimum of mean
5320 * deviation is 100 ms.
5321 *
5322 */
5324 }
5327 /*
5328 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5329 *
5330 * Add tcp_rexmit_interval extra in case of extreme environment
5331 * where the algorithm fails to work. The default value of
5332 * tcp_rexmit_interval_extra should be 0.
5333 *
5334 * As we use a finer grained clock than BSD and update
5335 * RTO for every ACKs, add in another .25 of RTT to the
5336 * deviation of RTO to accomodate burstiness of 1/4 of
5337 * window size.
5338 */
5343 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5345 }
5347 /*
5348 * On a labeled system we have some protocols above TCP, such as RPC, which
5349 * appear to assume that every mblk in a chain has a db_credp.
5350 */
5351 static void
5353 {
5360 }
5361 }
5363 uint_t
5365 {
5367 uint_t thwin;
5370 /* Learn the latest rwnd information that we sent to the other side. */
5373 /* This is peer's calculated send window (our receive window). */
5375 /*
5376 * Increase the receive window to max. But we need to do receiver
5377 * SWS avoidance. This means that we need to check the increase of
5378 * of receive window is at least 1 MSS.
5379 */
5381 /*
5382 * If the window that the other side knows is less than max
5383 * deferred acks segments, send an update immediately.
5384 */
5388 }
5390 }
5392 }
5394 /*
5395 * Handle a packet that has been reclassified by TCP.
5396 * This function drops the ref on connp that the caller had.
5397 */
5398 void
5400 {
5408 }
5421 }
5425 /* Note that mp is NULL */
5429 }
5430 }
5433 /*
5434 * do not drain, certain use cases can blow
5435 * the stack
5436 */
5441 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5443 ira);
5445 }
5447 }
5449 /* ARGSUSED */
5450 static void
5452 {
5464 }
5469 }
5472 /* Not flow-controlled, open rwnd */
5475 /*
5476 * Send back a window update immediately if TCP is above
5477 * ESTABLISHED state and the increase of the rcv window
5478 * that the other side knows is at least 1 MSS after flow
5479 * control is lifted.
5480 */
5486 }
5487 }
5488 }
5490 /*
5491 * The read side service routine is called mostly when we get back-enabled as a
5492 * result of flow control relief. Since we don't actually queue anything in
5493 * TCP, we have no data to send out of here. What we do is clear the receive
5494 * window, and send out a window update.
5495 */
5496 void
5498 {
5503 /* No code does a putq on the read side */
5506 /*
5507 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5508 * been run. So just return.
5509 */
5514 }
5521 }
5523 /* At minimum we need 8 bytes in the TCP header for the lookup */
5524 #define ICMP_MIN_TCP_HDR 8
5526 /*
5527 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5528 * passed up by IP. The message is always received on the correct tcp_t.
5529 * Assumes that IP has pulled up everything up to and including the ICMP header.
5530 */
5531 /* ARGSUSED2 */
5532 void
5534 {
5543 /* Assume IP provides aligned packets */
5547 /*
5548 * It's possible we have a closed, but not yet destroyed, TCP
5549 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5550 * in the closed state, so don't take any chances and drop the packet.
5551 */
5555 }
5557 /*
5558 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5559 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5560 */
5564 }
5566 /* Skip past the outer IP and ICMP headers */
5569 /*
5570 * If we don't have the correct outer IP header length
5571 * or if we don't have a complete inner IP header
5572 * drop it.
5573 */
5576 noticmpv4:
5579 }
5582 /* Skip past the inner IP and find the ULP header */
5585 /*
5586 * If we don't have the correct inner IP header length or if the ULP
5587 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5588 * bytes of TCP header, drop it.
5589 */
5594 }
5601 /*
5602 * Update Path MTU, then try to send something out.
5603 */
5612 /*
5613 * ICMP can snipe away incipient
5614 * TCP connections as long as
5615 * seq number is same as initial
5616 * send seq number.
5617 */
5620 ECONNREFUSED);
5621 }
5623 }
5627 /* Record the error in case we finally time out. */
5630 else
5635 /*
5636 * Ditch the half-open connection if we
5637 * suspect a SYN attack is under way.
5638 */
5641 }
5642 }
5646 }
5649 /*
5650 * use a global boolean to control
5651 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5652 * The default is false.
5653 */
5655 /*
5656 * Reduce the sending rate as if we got a
5657 * retransmit timeout
5658 */
5666 }
5668 }
5669 }
5671 }
5673 /*
5674 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5675 * error messages passed up by IP.
5676 * Assumes that IP has pulled up all the extension headers as well
5677 * as the ICMPv6 header.
5678 */
5679 static void
5681 {
5689 /*
5690 * Verify that we have a complete IP header.
5691 */
5696 /*
5697 * Verify if we have a complete ICMP and inner IP header.
5698 */
5700 noticmpv6:
5703 }
5708 /*
5709 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5710 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5711 * packet.
5712 */
5716 }
5721 /*
5722 * Update Path MTU, then try to send something out.
5723 */
5734 }
5740 /* Record the error in case we finally time out. */
5747 /*
5748 * Ditch the half-open connection if we
5749 * suspect a SYN attack is under way.
5750 */
5753 }
5754 }
5760 }
5763 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5770 }
5772 }
5778 }
5780 }
5782 /*
5783 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5784 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5785 *
5786 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5787 * error messages received by IP. The message is always received on the correct
5788 * tcp_t.
5789 */
5790 /* ARGSUSED */
5791 boolean_t
5794 {
5799 /*
5800 * TCP sequence number contained in payload of the ICMP error message
5801 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5802 * the message is either a stale ICMP error, or an attack from the
5803 * network. Fail the verification.
5804 */
5808 /* For "too big" we also check the ignore flag */
5820 }
5822 }