4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
23 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
24 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
25 * Copyright 2016 Joyent, Inc.
26 * Copyright (c) 2014 by Delphix. All rights reserved.
29 /* This file contains all TCP input processing functions. */
31 #include <sys/types.h>
32 #include <sys/stream.h>
33 #include <sys/strsun.h>
34 #include <sys/strsubr.h>
35 #include <sys/stropts.h>
36 #include <sys/strlog.h>
37 #define _SUN_TPI_VERSION 2
38 #include <sys/tihdr.h>
39 #include <sys/suntpi.h>
40 #include <sys/xti_inet.h>
41 #include <sys/squeue_impl.h>
42 #include <sys/squeue.h>
44 #include <inet/common.h>
47 #include <inet/tcp_impl.h>
48 #include <inet/proto_set.h>
49 #include <inet/ipsec_impl.h>
52 * RFC7323-recommended phrasing of TSTAMP option, for easier parsing
56 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
57 (TCPOPT_TSTAMP << 8) | 10)
59 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
60 (TCPOPT_NOP << 8) | TCPOPT_NOP)
64 * PAWS needs a timer for 24 days. This is the number of ticks in 24 days
66 #define PAWS_TIMEOUT ((clock_t)(24*24*60*60*hz))
69 * Since tcp_listener is not cleared atomically with tcp_detached
70 * being cleared we need this extra bit to tell a detached connection
71 * apart from one that is in the process of being accepted.
73 #define TCP_IS_DETACHED_NONEAGER(tcp) \
74 (TCP_IS_DETACHED(tcp) && \
75 (!(tcp)->tcp_hard_binding))
78 * Steps to do when a tcp_t moves to TIME-WAIT state.
80 * This connection is done, we don't need to account for it. Decrement
81 * the listener connection counter if needed.
83 * Decrement the connection counter of the stack. Note that this counter
84 * is per CPU. So the total number of connections in a stack is the sum of all
85 * of them. Since there is no lock for handling all of them exclusively, the
86 * resulting sum is only an approximation.
88 * Unconditionally clear the exclusive binding bit so this TIME-WAIT
89 * connection won't interfere with new ones.
91 * Start the TIME-WAIT timer. If upper layer has not closed the connection,
92 * the timer is handled within the context of this tcp_t. When the timer
93 * fires, tcp_clean_death() is called. If upper layer closes the connection
94 * during this period, tcp_time_wait_append() will be called to add this
95 * tcp_t to the global TIME-WAIT list. Note that this means that the
96 * actual wait time in TIME-WAIT state will be longer than the
97 * tcps_time_wait_interval since the period before upper layer closes the
98 * connection is not accounted for when tcp_time_wait_append() is called.
100 * If upper layer has closed the connection, call tcp_time_wait_append()
104 #define SET_TIME_WAIT(tcps, tcp, connp) \
106 (tcp)->tcp_state = TCPS_TIME_WAIT; \
107 if ((tcp)->tcp_listen_cnt != NULL) \
108 TCP_DECR_LISTEN_CNT(tcp); \
110 (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
111 (connp)->conn_exclbind = 0; \
112 if (!TCP_IS_DETACHED(tcp)) { \
113 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
115 tcp_time_wait_append(tcp); \
116 TCP_DBGSTAT(tcps, tcp_rput_time_wait); \
121 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
122 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
123 * data, TCP will not respond with an ACK. RFC 793 requires that
124 * TCP responds with an ACK for such a bogus ACK. By not following
125 * the RFC, we prevent TCP from getting into an ACK storm if somehow
126 * an attacker successfully spoofs an acceptable segment to our
127 * peer; or when our peer is "confused."
129 static uint32_t tcp_drop_ack_unsent_cnt
= 10;
132 * To protect TCP against attacker using a small window and requesting
133 * large amount of data (DoS attack by conuming memory), TCP checks the
134 * window advertised in the last ACK of the 3-way handshake. TCP uses
135 * the tcp_mss (the size of one packet) value for comparion. The window
136 * should be larger than tcp_mss. But while a sane TCP should advertise
137 * a receive window larger than or equal to 4*MSS to avoid stop and go
138 * tarrfic, not all TCP stacks do that. This is especially true when
139 * tcp_mss is a big value.
141 * To work around this issue, an additional fixed value for comparison
142 * is also used. If the advertised window is smaller than both tcp_mss
143 * and tcp_init_wnd_chk, the ACK is considered as invalid. So for large
144 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
145 * smaller than 8K is considered to be OK.
147 static uint32_t tcp_init_wnd_chk
= 4096;
149 /* Process ICMP source quench message or not. */
150 static boolean_t tcp_icmp_source_quench
= B_FALSE
;
152 static boolean_t tcp_outbound_squeue_switch
= B_FALSE
;
154 static mblk_t
*tcp_conn_create_v4(conn_t
*, conn_t
*, mblk_t
*,
156 static mblk_t
*tcp_conn_create_v6(conn_t
*, conn_t
*, mblk_t
*,
158 static boolean_t
tcp_drop_q0(tcp_t
*);
159 static void tcp_icmp_error_ipv6(tcp_t
*, mblk_t
*, ip_recv_attr_t
*);
160 static mblk_t
*tcp_input_add_ancillary(tcp_t
*, mblk_t
*, ip_pkt_t
*,
162 static void tcp_input_listener(void *, mblk_t
*, void *, ip_recv_attr_t
*);
163 static void tcp_process_options(tcp_t
*, tcpha_t
*);
164 static mblk_t
*tcp_reass(tcp_t
*, mblk_t
*, uint32_t);
165 static void tcp_reass_elim_overlap(tcp_t
*, mblk_t
*);
166 static void tcp_rsrv_input(void *, mblk_t
*, void *, ip_recv_attr_t
*);
167 static void tcp_set_rto(tcp_t
*, time_t);
170 * Set the MSS associated with a particular tcp based on its current value,
171 * and a new one passed in. Observe minimums and maximums, and reset other
172 * state variables that we want to view as multiples of MSS.
174 * The value of MSS could be either increased or descreased.
177 tcp_mss_set(tcp_t
*tcp
, uint32_t mss
)
180 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
181 conn_t
*connp
= tcp
->tcp_connp
;
183 if (connp
->conn_ipversion
== IPV4_VERSION
)
184 mss_max
= tcps
->tcps_mss_max_ipv4
;
186 mss_max
= tcps
->tcps_mss_max_ipv6
;
188 if (mss
< tcps
->tcps_mss_min
)
189 mss
= tcps
->tcps_mss_min
;
193 * Unless naglim has been set by our client to
194 * a non-mss value, force naglim to track mss.
195 * This can help to aggregate small writes.
197 if (mss
< tcp
->tcp_naglim
|| tcp
->tcp_mss
== tcp
->tcp_naglim
)
198 tcp
->tcp_naglim
= mss
;
200 * TCP should be able to buffer at least 4 MSS data for obvious
201 * performance reason.
203 if ((mss
<< 2) > connp
->conn_sndbuf
)
204 connp
->conn_sndbuf
= mss
<< 2;
207 * Set the send lowater to at least twice of MSS.
209 if ((mss
<< 1) > connp
->conn_sndlowat
)
210 connp
->conn_sndlowat
= mss
<< 1;
213 * Update tcp_cwnd according to the new value of MSS. Keep the
214 * previous ratio to preserve the transmit rate.
216 tcp
->tcp_cwnd
= (tcp
->tcp_cwnd
/ tcp
->tcp_mss
) * mss
;
217 tcp
->tcp_cwnd_cnt
= 0;
220 (void) tcp_maxpsz_set(tcp
, B_TRUE
);
224 * Extract option values from a tcp header. We put any found values into the
225 * tcpopt struct and return a bitmask saying which options were found.
228 tcp_parse_options(tcpha_t
*tcpha
, tcp_opt_t
*tcpopt
)
233 uchar_t
*up
= (uchar_t
*)tcpha
;
236 tcp_seq sack_begin
, sack_end
;
239 endp
= up
+ TCP_HDR_LENGTH(tcpha
);
240 up
+= TCP_MIN_HEADER_LENGTH
;
242 * If timestamp option is aligned as recommended in RFC 7323 Appendix
243 * A, and is the only option, return quickly.
245 if (TCP_HDR_LENGTH(tcpha
) == (uint32_t)TCP_MIN_HEADER_LENGTH
+
246 TCPOPT_REAL_TS_LEN
&&
248 *(uint32_t *)up
== TCPOPT_NOP_NOP_TSTAMP
) {
249 tcpopt
->tcp_opt_ts_val
= ABE32_TO_U32((up
+4));
250 tcpopt
->tcp_opt_ts_ecr
= ABE32_TO_U32((up
+8));
252 return (TCP_OPT_TSTAMP_PRESENT
);
265 if (len
< TCPOPT_MAXSEG_LEN
||
266 up
[1] != TCPOPT_MAXSEG_LEN
)
269 mss
= BE16_TO_U16(up
+2);
270 /* Caller must handle tcp_mss_min and tcp_mss_max_* */
271 tcpopt
->tcp_opt_mss
= mss
;
272 found
|= TCP_OPT_MSS_PRESENT
;
274 up
+= TCPOPT_MAXSEG_LEN
;
278 if (len
< TCPOPT_WS_LEN
|| up
[1] != TCPOPT_WS_LEN
)
281 if (up
[2] > TCP_MAX_WINSHIFT
)
282 tcpopt
->tcp_opt_wscale
= TCP_MAX_WINSHIFT
;
284 tcpopt
->tcp_opt_wscale
= up
[2];
285 found
|= TCP_OPT_WSCALE_PRESENT
;
290 case TCPOPT_SACK_PERMITTED
:
291 if (len
< TCPOPT_SACK_OK_LEN
||
292 up
[1] != TCPOPT_SACK_OK_LEN
)
294 found
|= TCP_OPT_SACK_OK_PRESENT
;
295 up
+= TCPOPT_SACK_OK_LEN
;
299 if (len
<= 2 || up
[1] <= 2 || len
< up
[1])
302 /* If TCP is not interested in SACK blks... */
303 if ((tcp
= tcpopt
->tcp
) == NULL
) {
307 sack_len
= up
[1] - TCPOPT_HEADER_LEN
;
308 up
+= TCPOPT_HEADER_LEN
;
311 * If the list is empty, allocate one and assume
312 * nothing is sack'ed.
314 if (tcp
->tcp_notsack_list
== NULL
) {
315 tcp_notsack_update(&(tcp
->tcp_notsack_list
),
316 tcp
->tcp_suna
, tcp
->tcp_snxt
,
317 &(tcp
->tcp_num_notsack_blk
),
318 &(tcp
->tcp_cnt_notsack_list
));
321 * Make sure tcp_notsack_list is not NULL.
322 * This happens when kmem_alloc(KM_NOSLEEP)
325 if (tcp
->tcp_notsack_list
== NULL
) {
329 tcp
->tcp_fack
= tcp
->tcp_suna
;
332 while (sack_len
> 0) {
337 sack_begin
= BE32_TO_U32(up
);
339 sack_end
= BE32_TO_U32(up
);
343 * Bounds checking. Make sure the SACK
344 * info is within tcp_suna and tcp_snxt.
345 * If this SACK blk is out of bound, ignore
346 * it but continue to parse the following
349 if (SEQ_LEQ(sack_end
, sack_begin
) ||
350 SEQ_LT(sack_begin
, tcp
->tcp_suna
) ||
351 SEQ_GT(sack_end
, tcp
->tcp_snxt
)) {
354 tcp_notsack_insert(&(tcp
->tcp_notsack_list
),
355 sack_begin
, sack_end
,
356 &(tcp
->tcp_num_notsack_blk
),
357 &(tcp
->tcp_cnt_notsack_list
));
358 if (SEQ_GT(sack_end
, tcp
->tcp_fack
)) {
359 tcp
->tcp_fack
= sack_end
;
362 found
|= TCP_OPT_SACK_PRESENT
;
366 if (len
< TCPOPT_TSTAMP_LEN
||
367 up
[1] != TCPOPT_TSTAMP_LEN
)
370 tcpopt
->tcp_opt_ts_val
= BE32_TO_U32(up
+2);
371 tcpopt
->tcp_opt_ts_ecr
= BE32_TO_U32(up
+6);
373 found
|= TCP_OPT_TSTAMP_PRESENT
;
375 up
+= TCPOPT_TSTAMP_LEN
;
379 if (len
<= 1 || len
< (int)up
[1] || up
[1] == 0)
390 * Process all TCP option in SYN segment. Note that this function should
391 * be called after tcp_set_destination() is called so that the necessary info
392 * from IRE is already set in the tcp structure.
394 * This function sets up the correct tcp_mss value according to the
395 * MSS option value and our header size. It also sets up the window scale
396 * and timestamp values, and initialize SACK info blocks. But it does not
397 * change receive window size after setting the tcp_mss value. The caller
398 * should do the appropriate change.
401 tcp_process_options(tcp_t
*tcp
, tcpha_t
*tcpha
)
407 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
408 conn_t
*connp
= tcp
->tcp_connp
;
411 options
= tcp_parse_options(tcpha
, &tcpopt
);
414 * Process MSS option. Note that MSS option value does not account
415 * for IP or TCP options. This means that it is equal to MTU - minimum
416 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
419 if (!(options
& TCP_OPT_MSS_PRESENT
)) {
420 if (connp
->conn_ipversion
== IPV4_VERSION
)
421 tcpopt
.tcp_opt_mss
= tcps
->tcps_mss_def_ipv4
;
423 tcpopt
.tcp_opt_mss
= tcps
->tcps_mss_def_ipv6
;
425 if (connp
->conn_ipversion
== IPV4_VERSION
)
426 mss_max
= tcps
->tcps_mss_max_ipv4
;
428 mss_max
= tcps
->tcps_mss_max_ipv6
;
429 if (tcpopt
.tcp_opt_mss
< tcps
->tcps_mss_min
)
430 tcpopt
.tcp_opt_mss
= tcps
->tcps_mss_min
;
431 else if (tcpopt
.tcp_opt_mss
> mss_max
)
432 tcpopt
.tcp_opt_mss
= mss_max
;
435 /* Process Window Scale option. */
436 if (options
& TCP_OPT_WSCALE_PRESENT
) {
437 tcp
->tcp_snd_ws
= tcpopt
.tcp_opt_wscale
;
438 tcp
->tcp_snd_ws_ok
= B_TRUE
;
440 tcp
->tcp_snd_ws
= B_FALSE
;
441 tcp
->tcp_snd_ws_ok
= B_FALSE
;
442 tcp
->tcp_rcv_ws
= B_FALSE
;
445 /* Process Timestamp option. */
446 if ((options
& TCP_OPT_TSTAMP_PRESENT
) &&
447 (tcp
->tcp_snd_ts_ok
|| TCP_IS_DETACHED(tcp
))) {
448 tmp_tcph
= (char *)tcp
->tcp_tcpha
;
450 tcp
->tcp_snd_ts_ok
= B_TRUE
;
451 tcp
->tcp_ts_recent
= tcpopt
.tcp_opt_ts_val
;
452 tcp
->tcp_last_rcv_lbolt
= ddi_get_lbolt64();
453 ASSERT(OK_32PTR(tmp_tcph
));
454 ASSERT(connp
->conn_ht_ulp_len
== TCP_MIN_HEADER_LENGTH
);
456 /* Fill in our template header with basic timestamp option. */
457 tmp_tcph
+= connp
->conn_ht_ulp_len
;
458 tmp_tcph
[0] = TCPOPT_NOP
;
459 tmp_tcph
[1] = TCPOPT_NOP
;
460 tmp_tcph
[2] = TCPOPT_TSTAMP
;
461 tmp_tcph
[3] = TCPOPT_TSTAMP_LEN
;
462 connp
->conn_ht_iphc_len
+= TCPOPT_REAL_TS_LEN
;
463 connp
->conn_ht_ulp_len
+= TCPOPT_REAL_TS_LEN
;
464 tcp
->tcp_tcpha
->tha_offset_and_reserved
+= (3 << 4);
466 tcp
->tcp_snd_ts_ok
= B_FALSE
;
470 * Process SACK options. If SACK is enabled for this connection,
471 * then allocate the SACK info structure. Note the following ways
472 * when tcp_snd_sack_ok is set to true.
474 * For active connection: in tcp_set_destination() called in
477 * For passive connection: in tcp_set_destination() called in
478 * tcp_input_listener().
480 * That's the reason why the extra TCP_IS_DETACHED() check is there.
481 * That check makes sure that if we did not send a SACK OK option,
482 * we will not enable SACK for this connection even though the other
483 * side sends us SACK OK option. For active connection, the SACK
484 * info structure has already been allocated. So we need to free
485 * it if SACK is disabled.
487 if ((options
& TCP_OPT_SACK_OK_PRESENT
) &&
488 (tcp
->tcp_snd_sack_ok
||
489 (tcps
->tcps_sack_permitted
!= 0 && TCP_IS_DETACHED(tcp
)))) {
490 ASSERT(tcp
->tcp_num_sack_blk
== 0);
491 ASSERT(tcp
->tcp_notsack_list
== NULL
);
493 tcp
->tcp_snd_sack_ok
= B_TRUE
;
494 if (tcp
->tcp_snd_ts_ok
) {
495 tcp
->tcp_max_sack_blk
= 3;
497 tcp
->tcp_max_sack_blk
= 4;
499 } else if (tcp
->tcp_snd_sack_ok
) {
501 * Resetting tcp_snd_sack_ok to B_FALSE so that
502 * no SACK info will be used for this
503 * connection. This assumes that SACK usage
504 * permission is negotiated. This may need
505 * to be changed once this is clarified.
507 ASSERT(tcp
->tcp_num_sack_blk
== 0);
508 ASSERT(tcp
->tcp_notsack_list
== NULL
);
509 tcp
->tcp_snd_sack_ok
= B_FALSE
;
513 * Now we know the exact TCP/IP header length, subtract
514 * that from tcp_mss to get our side's MSS.
516 tcp
->tcp_mss
-= connp
->conn_ht_iphc_len
;
519 * Here we assume that the other side's header size will be equal to
520 * our header size. We calculate the real MSS accordingly. Need to
521 * take into additional stuffs IPsec puts in.
523 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
525 tcpopt
.tcp_opt_mss
-= connp
->conn_ht_iphc_len
+
526 tcp
->tcp_ipsec_overhead
-
527 ((connp
->conn_ipversion
== IPV4_VERSION
?
528 IP_SIMPLE_HDR_LENGTH
: IPV6_HDR_LEN
) + TCP_MIN_HEADER_LENGTH
);
531 * Set MSS to the smaller one of both ends of the connection.
532 * We should not have called tcp_mss_set() before, but our
533 * side of the MSS should have been set to a proper value
534 * by tcp_set_destination(). tcp_mss_set() will also set up the
535 * STREAM head parameters properly.
537 * If we have a larger-than-16-bit window but the other side
538 * didn't want to do window scale, tcp_rwnd_set() will take
541 tcp_mss_set(tcp
, MIN(tcpopt
.tcp_opt_mss
, tcp
->tcp_mss
));
544 * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
547 TCP_SET_INIT_CWND(tcp
, tcp
->tcp_mss
, tcps
->tcps_slow_start_initial
);
551 * Add a new piece to the tcp reassembly queue. If the gap at the beginning
552 * is filled, return as much as we can. The message passed in may be
553 * multi-part, chained using b_cont. "start" is the starting sequence
554 * number for this piece.
557 tcp_reass(tcp_t
*tcp
, mblk_t
*mp
, uint32_t start
)
564 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
567 /* Walk through all the new pieces. */
569 ASSERT((uintptr_t)(mp
->b_wptr
- mp
->b_rptr
) <=
571 end
= start
+ (int)(mp
->b_wptr
- mp
->b_rptr
);
572 next_mp
= mp
->b_cont
;
574 /* Empty. Blast it. */
579 TCP_REASS_SET_SEQ(mp
, start
);
580 TCP_REASS_SET_END(mp
, end
);
581 mp1
= tcp
->tcp_reass_tail
;
583 tcp
->tcp_reass_tail
= mp
;
584 tcp
->tcp_reass_head
= mp
;
585 TCPS_BUMP_MIB(tcps
, tcpInDataUnorderSegs
);
586 TCPS_UPDATE_MIB(tcps
, tcpInDataUnorderBytes
,
590 /* New stuff completely beyond tail? */
591 if (SEQ_GEQ(start
, TCP_REASS_END(mp1
))) {
592 /* Link it on end. */
594 tcp
->tcp_reass_tail
= mp
;
595 TCPS_BUMP_MIB(tcps
, tcpInDataUnorderSegs
);
596 TCPS_UPDATE_MIB(tcps
, tcpInDataUnorderBytes
,
600 mp1
= tcp
->tcp_reass_head
;
601 u1
= TCP_REASS_SEQ(mp1
);
602 /* New stuff at the front? */
603 if (SEQ_LT(start
, u1
)) {
604 /* Yes... Check for overlap. */
606 tcp
->tcp_reass_head
= mp
;
607 tcp_reass_elim_overlap(tcp
, mp
);
611 * The new piece fits somewhere between the head and tail.
612 * We find our slot, where mp1 precedes us and mp2 trails.
614 for (; (mp2
= mp1
->b_cont
) != NULL
; mp1
= mp2
) {
615 u1
= TCP_REASS_SEQ(mp2
);
616 if (SEQ_LEQ(start
, u1
))
619 /* Link ourselves in */
623 /* Trim overlap with following mblk(s) first */
624 tcp_reass_elim_overlap(tcp
, mp
);
626 /* Trim overlap with preceding mblk */
627 tcp_reass_elim_overlap(tcp
, mp1
);
629 } while (start
= end
, mp
= next_mp
);
630 mp1
= tcp
->tcp_reass_head
;
631 /* Anything ready to go? */
632 if (TCP_REASS_SEQ(mp1
) != tcp
->tcp_rnxt
)
634 /* Eat what we can off the queue */
637 end
= TCP_REASS_END(mp1
);
638 TCP_REASS_SET_SEQ(mp1
, 0);
639 TCP_REASS_SET_END(mp1
, 0);
641 tcp
->tcp_reass_tail
= NULL
;
644 if (end
!= TCP_REASS_SEQ(mp
)) {
650 mp1
= tcp
->tcp_reass_head
;
651 tcp
->tcp_reass_head
= mp
;
655 /* Eliminate any overlap that mp may have over later mblks */
657 tcp_reass_elim_overlap(tcp_t
*tcp
, mblk_t
*mp
)
662 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
664 end
= TCP_REASS_END(mp
);
665 while ((mp1
= mp
->b_cont
) != NULL
) {
666 u1
= TCP_REASS_SEQ(mp1
);
667 if (!SEQ_GT(end
, u1
))
669 if (!SEQ_GEQ(end
, TCP_REASS_END(mp1
))) {
670 mp
->b_wptr
-= end
- u1
;
671 TCP_REASS_SET_END(mp
, u1
);
672 TCPS_BUMP_MIB(tcps
, tcpInDataPartDupSegs
);
673 TCPS_UPDATE_MIB(tcps
, tcpInDataPartDupBytes
,
677 mp
->b_cont
= mp1
->b_cont
;
678 TCP_REASS_SET_SEQ(mp1
, 0);
679 TCP_REASS_SET_END(mp1
, 0);
681 TCPS_BUMP_MIB(tcps
, tcpInDataDupSegs
);
682 TCPS_UPDATE_MIB(tcps
, tcpInDataDupBytes
, end
- u1
);
685 tcp
->tcp_reass_tail
= mp
;
689 * This function does PAWS protection check, per RFC 7323 section 5. Requires
690 * that timestamp options are already processed into tcpoptp. Returns B_TRUE if
691 * the segment passes the PAWS test, else returns B_FALSE.
694 tcp_paws_check(tcp_t
*tcp
, const tcp_opt_t
*tcpoptp
)
696 if (TSTMP_LT(tcpoptp
->tcp_opt_ts_val
,
697 tcp
->tcp_ts_recent
)) {
698 if (LBOLT_FASTPATH64
<
699 (tcp
->tcp_last_rcv_lbolt
+ PAWS_TIMEOUT
)) {
700 /* This segment is not acceptable. */
704 * Connection has been idle for
705 * too long. Reset the timestamp
708 tcpoptp
->tcp_opt_ts_val
;
715 * Defense for the SYN attack -
716 * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
717 * one from the list of droppable eagers. This list is a subset of q0.
718 * see comments before the definition of MAKE_DROPPABLE().
719 * 2. Don't drop a SYN request before its first timeout. This gives every
720 * request at least til the first timeout to complete its 3-way handshake.
721 * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
722 * requests currently on the queue that has timed out. This will be used
723 * as an indicator of whether an attack is under way, so that appropriate
724 * actions can be taken. (It's incremented in tcp_timer() and decremented
725 * either when eager goes into ESTABLISHED, or gets freed up.)
726 * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
727 * # of timeout drops back to <= q0len/32 => SYN alert off
730 tcp_drop_q0(tcp_t
*tcp
)
734 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
736 ASSERT(MUTEX_HELD(&tcp
->tcp_eager_lock
));
737 ASSERT(tcp
->tcp_eager_next_q0
!= tcp
->tcp_eager_prev_q0
);
739 /* Pick oldest eager from the list of droppable eagers */
740 eager
= tcp
->tcp_eager_prev_drop_q0
;
742 /* If list is empty. return B_FALSE */
747 /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
748 if ((mp
= allocb(0, BPRI_HI
)) == NULL
)
752 * Take this eager out from the list of droppable eagers since we are
755 MAKE_UNDROPPABLE(eager
);
757 if (tcp
->tcp_connp
->conn_debug
) {
758 (void) strlog(TCP_MOD_ID
, 0, 3, SL_TRACE
,
759 "tcp_drop_q0: listen half-open queue (max=%d) overflow"
760 " (%d pending) on %s, drop one", tcps
->tcps_conn_req_max_q0
,
761 tcp
->tcp_conn_req_cnt_q0
,
762 tcp_display(tcp
, NULL
, DISP_PORT_ONLY
));
765 TCPS_BUMP_MIB(tcps
, tcpHalfOpenDrop
);
767 /* Put a reference on the conn as we are enqueueing it in the sqeue */
768 CONN_INC_REF(eager
->tcp_connp
);
770 SQUEUE_ENTER_ONE(eager
->tcp_connp
->conn_sqp
, mp
,
771 tcp_clean_death_wrapper
, eager
->tcp_connp
, NULL
,
772 SQ_FILL
, SQTAG_TCP_DROP_Q0
);
778 * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
781 tcp_conn_create_v6(conn_t
*lconnp
, conn_t
*connp
, mblk_t
*mp
,
784 tcp_t
*ltcp
= lconnp
->conn_tcp
;
785 tcp_t
*tcp
= connp
->conn_tcp
;
790 uint_t ifindex
= ira
->ira_ruifindex
;
791 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
793 if (ira
->ira_flags
& IRAF_IS_IPV4
) {
794 ipha
= (ipha_t
*)mp
->b_rptr
;
796 connp
->conn_ipversion
= IPV4_VERSION
;
797 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_dst
, &connp
->conn_laddr_v6
);
798 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_src
, &connp
->conn_faddr_v6
);
799 connp
->conn_saddr_v6
= connp
->conn_laddr_v6
;
802 sin6
.sin6_addr
= connp
->conn_faddr_v6
;
803 sin6
.sin6_port
= connp
->conn_fport
;
804 sin6
.sin6_family
= AF_INET6
;
805 sin6
.__sin6_src_id
= ip_srcid_find_addr(&connp
->conn_laddr_v6
,
806 IPCL_ZONEID(lconnp
), tcps
->tcps_netstack
);
808 if (connp
->conn_recv_ancillary
.crb_recvdstaddr
) {
812 sin6d
.sin6_addr
= connp
->conn_laddr_v6
;
813 sin6d
.sin6_port
= connp
->conn_lport
;
814 sin6d
.sin6_family
= AF_INET
;
815 tpi_mp
= mi_tpi_extconn_ind(NULL
,
816 (char *)&sin6d
, sizeof (sin6_t
),
818 (t_scalar_t
)sizeof (intptr_t),
819 (char *)&sin6d
, sizeof (sin6_t
),
820 (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
822 tpi_mp
= mi_tpi_conn_ind(NULL
,
823 (char *)&sin6
, sizeof (sin6_t
),
824 (char *)&tcp
, (t_scalar_t
)sizeof (intptr_t),
825 (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
828 ip6h
= (ip6_t
*)mp
->b_rptr
;
830 connp
->conn_ipversion
= IPV6_VERSION
;
831 connp
->conn_laddr_v6
= ip6h
->ip6_dst
;
832 connp
->conn_faddr_v6
= ip6h
->ip6_src
;
833 connp
->conn_saddr_v6
= connp
->conn_laddr_v6
;
836 sin6
.sin6_addr
= connp
->conn_faddr_v6
;
837 sin6
.sin6_port
= connp
->conn_fport
;
838 sin6
.sin6_family
= AF_INET6
;
839 sin6
.sin6_flowinfo
= ip6h
->ip6_vcf
& ~IPV6_VERS_AND_FLOW_MASK
;
840 sin6
.__sin6_src_id
= ip_srcid_find_addr(&connp
->conn_laddr_v6
,
841 IPCL_ZONEID(lconnp
), tcps
->tcps_netstack
);
843 if (IN6_IS_ADDR_LINKSCOPE(&ip6h
->ip6_src
)) {
844 /* Pass up the scope_id of remote addr */
845 sin6
.sin6_scope_id
= ifindex
;
847 sin6
.sin6_scope_id
= 0;
849 if (connp
->conn_recv_ancillary
.crb_recvdstaddr
) {
853 sin6
.sin6_addr
= connp
->conn_laddr_v6
;
854 sin6d
.sin6_port
= connp
->conn_lport
;
855 sin6d
.sin6_family
= AF_INET6
;
856 if (IN6_IS_ADDR_LINKSCOPE(&connp
->conn_laddr_v6
))
857 sin6d
.sin6_scope_id
= ifindex
;
859 tpi_mp
= mi_tpi_extconn_ind(NULL
,
860 (char *)&sin6d
, sizeof (sin6_t
),
861 (char *)&tcp
, (t_scalar_t
)sizeof (intptr_t),
862 (char *)&sin6d
, sizeof (sin6_t
),
863 (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
865 tpi_mp
= mi_tpi_conn_ind(NULL
,
866 (char *)&sin6
, sizeof (sin6_t
),
867 (char *)&tcp
, (t_scalar_t
)sizeof (intptr_t),
868 (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
872 tcp
->tcp_mss
= tcps
->tcps_mss_def_ipv6
;
876 /* Handle a SYN on an AF_INET socket */
878 tcp_conn_create_v4(conn_t
*lconnp
, conn_t
*connp
, mblk_t
*mp
,
881 tcp_t
*ltcp
= lconnp
->conn_tcp
;
882 tcp_t
*tcp
= connp
->conn_tcp
;
884 mblk_t
*tpi_mp
= NULL
;
885 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
888 ASSERT(ira
->ira_flags
& IRAF_IS_IPV4
);
889 ipha
= (ipha_t
*)mp
->b_rptr
;
891 connp
->conn_ipversion
= IPV4_VERSION
;
892 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_dst
, &connp
->conn_laddr_v6
);
893 IN6_IPADDR_TO_V4MAPPED(ipha
->ipha_src
, &connp
->conn_faddr_v6
);
894 connp
->conn_saddr_v6
= connp
->conn_laddr_v6
;
897 sin
.sin_addr
.s_addr
= connp
->conn_faddr_v4
;
898 sin
.sin_port
= connp
->conn_fport
;
899 sin
.sin_family
= AF_INET
;
900 if (lconnp
->conn_recv_ancillary
.crb_recvdstaddr
) {
904 sind
.sin_addr
.s_addr
= connp
->conn_laddr_v4
;
905 sind
.sin_port
= connp
->conn_lport
;
906 sind
.sin_family
= AF_INET
;
907 tpi_mp
= mi_tpi_extconn_ind(NULL
,
908 (char *)&sind
, sizeof (sin_t
), (char *)&tcp
,
909 (t_scalar_t
)sizeof (intptr_t), (char *)&sind
,
910 sizeof (sin_t
), (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
912 tpi_mp
= mi_tpi_conn_ind(NULL
,
913 (char *)&sin
, sizeof (sin_t
),
914 (char *)&tcp
, (t_scalar_t
)sizeof (intptr_t),
915 (t_scalar_t
)ltcp
->tcp_conn_req_seqnum
);
918 tcp
->tcp_mss
= tcps
->tcps_mss_def_ipv4
;
923 * Called via squeue to get on to eager's perimeter. It sends a
924 * TH_RST if eager is in the fanout table. The listener wants the
925 * eager to disappear either by means of tcp_eager_blowoff() or
926 * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
927 * called (via squeue) if the eager cannot be inserted in the
928 * fanout table in tcp_input_listener().
932 tcp_eager_kill(void *arg
, mblk_t
*mp
, void *arg2
, ip_recv_attr_t
*dummy
)
934 conn_t
*econnp
= (conn_t
*)arg
;
935 tcp_t
*eager
= econnp
->conn_tcp
;
936 tcp_t
*listener
= eager
->tcp_listener
;
939 * We could be called because listener is closing. Since
940 * the eager was using listener's queue's, we avoid
941 * using the listeners queues from now on.
943 ASSERT(eager
->tcp_detached
);
944 econnp
->conn_rq
= NULL
;
945 econnp
->conn_wq
= NULL
;
948 * An eager's conn_fanout will be NULL if it's a duplicate
949 * for an existing 4-tuples in the conn fanout table.
950 * We don't want to send an RST out in such case.
952 if (econnp
->conn_fanout
!= NULL
&& eager
->tcp_state
> TCPS_LISTEN
) {
953 tcp_xmit_ctl("tcp_eager_kill, can't wait",
954 eager
, eager
->tcp_snxt
, 0, TH_RST
);
957 /* We are here because listener wants this eager gone */
958 if (listener
!= NULL
) {
959 mutex_enter(&listener
->tcp_eager_lock
);
960 tcp_eager_unlink(eager
);
961 if (eager
->tcp_tconnind_started
) {
963 * The eager has sent a conn_ind up to the
964 * listener but listener decides to close
965 * instead. We need to drop the extra ref
966 * placed on eager in tcp_input_data() before
967 * sending the conn_ind to listener.
969 CONN_DEC_REF(econnp
);
971 mutex_exit(&listener
->tcp_eager_lock
);
972 CONN_DEC_REF(listener
->tcp_connp
);
975 if (eager
->tcp_state
!= TCPS_CLOSED
)
976 tcp_close_detached(eager
);
980 * Reset any eager connection hanging off this listener marked
981 * with 'seqnum' and then reclaim it's resources.
984 tcp_eager_blowoff(tcp_t
*listener
, t_scalar_t seqnum
)
990 mutex_enter(&listener
->tcp_eager_lock
);
992 eager
= eager
->tcp_eager_next_q
;
994 mutex_exit(&listener
->tcp_eager_lock
);
997 } while (eager
->tcp_conn_req_seqnum
!= seqnum
);
999 if (eager
->tcp_closemp_used
) {
1000 mutex_exit(&listener
->tcp_eager_lock
);
1003 eager
->tcp_closemp_used
= B_TRUE
;
1004 TCP_DEBUG_GETPCSTACK(eager
->tcmp_stk
, 15);
1005 CONN_INC_REF(eager
->tcp_connp
);
1006 mutex_exit(&listener
->tcp_eager_lock
);
1007 mp
= &eager
->tcp_closemp
;
1008 SQUEUE_ENTER_ONE(eager
->tcp_connp
->conn_sqp
, mp
, tcp_eager_kill
,
1009 eager
->tcp_connp
, NULL
, SQ_FILL
, SQTAG_TCP_EAGER_BLOWOFF
);
1014 * Reset any eager connection hanging off this listener
1015 * and then reclaim it's resources.
1018 tcp_eager_cleanup(tcp_t
*listener
, boolean_t q0_only
)
1022 tcp_stack_t
*tcps
= listener
->tcp_tcps
;
1024 ASSERT(MUTEX_HELD(&listener
->tcp_eager_lock
));
1027 /* First cleanup q */
1028 TCP_STAT(tcps
, tcp_eager_blowoff_q
);
1029 eager
= listener
->tcp_eager_next_q
;
1030 while (eager
!= NULL
) {
1031 if (!eager
->tcp_closemp_used
) {
1032 eager
->tcp_closemp_used
= B_TRUE
;
1033 TCP_DEBUG_GETPCSTACK(eager
->tcmp_stk
, 15);
1034 CONN_INC_REF(eager
->tcp_connp
);
1035 mp
= &eager
->tcp_closemp
;
1036 SQUEUE_ENTER_ONE(eager
->tcp_connp
->conn_sqp
, mp
,
1037 tcp_eager_kill
, eager
->tcp_connp
, NULL
,
1038 SQ_FILL
, SQTAG_TCP_EAGER_CLEANUP
);
1040 eager
= eager
->tcp_eager_next_q
;
1043 /* Then cleanup q0 */
1044 TCP_STAT(tcps
, tcp_eager_blowoff_q0
);
1045 eager
= listener
->tcp_eager_next_q0
;
1046 while (eager
!= listener
) {
1047 if (!eager
->tcp_closemp_used
) {
1048 eager
->tcp_closemp_used
= B_TRUE
;
1049 TCP_DEBUG_GETPCSTACK(eager
->tcmp_stk
, 15);
1050 CONN_INC_REF(eager
->tcp_connp
);
1051 mp
= &eager
->tcp_closemp
;
1052 SQUEUE_ENTER_ONE(eager
->tcp_connp
->conn_sqp
, mp
,
1053 tcp_eager_kill
, eager
->tcp_connp
, NULL
, SQ_FILL
,
1054 SQTAG_TCP_EAGER_CLEANUP_Q0
);
1056 eager
= eager
->tcp_eager_next_q0
;
1061 * If we are an eager connection hanging off a listener that hasn't
1062 * formally accepted the connection yet, get off its list and blow off
1063 * any data that we have accumulated.
1066 tcp_eager_unlink(tcp_t
*tcp
)
1068 tcp_t
*listener
= tcp
->tcp_listener
;
1070 ASSERT(listener
!= NULL
);
1071 ASSERT(MUTEX_HELD(&listener
->tcp_eager_lock
));
1072 if (tcp
->tcp_eager_next_q0
!= NULL
) {
1073 ASSERT(tcp
->tcp_eager_prev_q0
!= NULL
);
1075 /* Remove the eager tcp from q0 */
1076 tcp
->tcp_eager_next_q0
->tcp_eager_prev_q0
=
1077 tcp
->tcp_eager_prev_q0
;
1078 tcp
->tcp_eager_prev_q0
->tcp_eager_next_q0
=
1079 tcp
->tcp_eager_next_q0
;
1080 ASSERT(listener
->tcp_conn_req_cnt_q0
> 0);
1081 listener
->tcp_conn_req_cnt_q0
--;
1083 tcp
->tcp_eager_next_q0
= NULL
;
1084 tcp
->tcp_eager_prev_q0
= NULL
;
1087 * Take the eager out, if it is in the list of droppable
1090 MAKE_UNDROPPABLE(tcp
);
1092 if (tcp
->tcp_syn_rcvd_timeout
!= 0) {
1093 /* we have timed out before */
1094 ASSERT(listener
->tcp_syn_rcvd_timeout
> 0);
1095 listener
->tcp_syn_rcvd_timeout
--;
1098 tcp_t
**tcpp
= &listener
->tcp_eager_next_q
;
1101 for (; tcpp
[0]; tcpp
= &tcpp
[0]->tcp_eager_next_q
) {
1102 if (tcpp
[0] == tcp
) {
1103 if (listener
->tcp_eager_last_q
== tcp
) {
1105 * If we are unlinking the last
1106 * element on the list, adjust
1107 * tail pointer. Set tail pointer
1108 * to nil when list is empty.
1110 ASSERT(tcp
->tcp_eager_next_q
== NULL
);
1111 if (listener
->tcp_eager_last_q
==
1112 listener
->tcp_eager_next_q
) {
1113 listener
->tcp_eager_last_q
=
1117 * We won't get here if there
1118 * is only one eager in the
1121 ASSERT(prev
!= NULL
);
1122 listener
->tcp_eager_last_q
=
1126 tcpp
[0] = tcp
->tcp_eager_next_q
;
1127 tcp
->tcp_eager_next_q
= NULL
;
1128 tcp
->tcp_eager_last_q
= NULL
;
1129 ASSERT(listener
->tcp_conn_req_cnt_q
> 0);
1130 listener
->tcp_conn_req_cnt_q
--;
1136 tcp
->tcp_listener
= NULL
;
1142 * The sockfs ACCEPT path:
1143 * =======================
1145 * The eager is now established in its own perimeter as soon as SYN is
1146 * received in tcp_input_listener(). When sockfs receives conn_ind, it
1147 * completes the accept processing on the acceptor STREAM. The sending
1148 * of conn_ind part is common for both sockfs listener and a TLI/XTI
1149 * listener but a TLI/XTI listener completes the accept processing
1150 * on the listener perimeter.
1152 * Common control flow for 3 way handshake:
1153 * ----------------------------------------
1155 * incoming SYN (listener perimeter) -> tcp_input_listener()
1157 * incoming SYN-ACK-ACK (eager perim) -> tcp_input_data()
1158 * send T_CONN_IND (listener perim) -> tcp_send_conn_ind()
1160 * Sockfs ACCEPT Path:
1161 * -------------------
1163 * open acceptor stream (tcp_open allocates tcp_tli_accept()
1164 * as STREAM entry point)
1166 * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1168 * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1169 * association (we are not behind eager's squeue but sockfs is protecting us
1170 * and no one knows about this stream yet. The STREAMS entry point q->q_info
1171 * is changed to point at tcp_wput().
1173 * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1174 * listener (done on listener's perimeter).
1176 * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1179 * TLI/XTI client ACCEPT path:
1180 * ---------------------------
1182 * soaccept() sends T_CONN_RES on the listener STREAM.
1184 * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1185 * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1190 * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1191 * and listeners->tcp_eager_next_q.
1196 * 1) We start out in tcp_input_listener by eager placing a ref on
1197 * listener and listener adding eager to listeners->tcp_eager_next_q0.
1199 * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1200 * doing so we place a ref on the eager. This ref is finally dropped at the
1201 * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1202 * reference is dropped by the squeue framework.
1204 * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1206 * The reference must be released by the same entity that added the reference
1207 * In the above scheme, the eager is the entity that adds and releases the
1208 * references. Note that tcp_accept_finish executes in the squeue of the eager
1209 * (albeit after it is attached to the acceptor stream). Though 1. executes
1210 * in the listener's squeue, the eager is nascent at this point and the
1211 * reference can be considered to have been added on behalf of the eager.
1213 * Eager getting a Reset or listener closing:
1214 * ==========================================
1216 * Once the listener and eager are linked, the listener never does the unlink.
1217 * If the listener needs to close, tcp_eager_cleanup() is called which queues
1218 * a message on all eager perimeter. The eager then does the unlink, clears
1219 * any pointers to the listener's queue and drops the reference to the
1220 * listener. The listener waits in tcp_close outside the squeue until its
1221 * refcount has dropped to 1. This ensures that the listener has waited for
1222 * all eagers to clear their association with the listener.
1224 * Similarly, if eager decides to go away, it can unlink itself and close.
1225 * When the T_CONN_RES comes down, we check if eager has closed. Note that
1226 * the reference to eager is still valid because of the extra ref we put
1227 * in tcp_send_conn_ind.
1229 * Listener can always locate the eager under the protection
1230 * of the listener->tcp_eager_lock, and then do a refhold
1231 * on the eager during the accept processing.
1233 * The acceptor stream accesses the eager in the accept processing
1234 * based on the ref placed on eager before sending T_conn_ind.
1235 * The only entity that can negate this refhold is a listener close
1236 * which is mutually exclusive with an active acceptor stream.
1238 * Eager's reference on the listener
1239 * ===================================
1241 * If the accept happens (even on a closed eager) the eager drops its
1242 * reference on the listener at the start of tcp_accept_finish. If the
1243 * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1244 * the reference is dropped in tcp_closei_local. If the listener closes,
1245 * the reference is dropped in tcp_eager_kill. In all cases the reference
1246 * is dropped while executing in the eager's context (squeue).
1250 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1253 * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1254 * tcp_input_data will not see any packets for listeners since the listener
1255 * has conn_recv set to tcp_input_listener.
1259 tcp_input_listener(void *arg
, mblk_t
*mp
, void *arg2
, ip_recv_attr_t
*ira
)
1265 conn_t
*econnp
= NULL
;
1269 conn_t
*lconnp
= (conn_t
*)arg
;
1270 tcp_t
*listener
= lconnp
->conn_tcp
;
1271 tcp_stack_t
*tcps
= listener
->tcp_tcps
;
1272 ip_stack_t
*ipst
= tcps
->tcps_netstack
->netstack_ip
;
1275 uint_t ifindex
= ira
->ira_ruifindex
;
1276 boolean_t tlc_set
= B_FALSE
;
1278 ip_hdr_len
= ira
->ira_ip_hdr_length
;
1279 tcpha
= (tcpha_t
*)&mp
->b_rptr
[ip_hdr_len
];
1280 flags
= (unsigned int)tcpha
->tha_flags
& 0xFF;
1282 DTRACE_TCP5(receive
, mblk_t
*, NULL
, ip_xmit_attr_t
*, lconnp
->conn_ixa
,
1283 __dtrace_tcp_void_ip_t
*, mp
->b_rptr
, tcp_t
*, listener
,
1284 __dtrace_tcp_tcph_t
*, tcpha
);
1286 if (!(flags
& TH_SYN
)) {
1287 if ((flags
& TH_RST
) || (flags
& TH_URG
)) {
1291 if (flags
& TH_ACK
) {
1292 /* Note this executes in listener's squeue */
1293 tcp_xmit_listeners_reset(mp
, ira
, ipst
, lconnp
);
1301 if (listener
->tcp_state
!= TCPS_LISTEN
)
1304 ASSERT(IPCL_IS_BOUND(lconnp
));
1306 mutex_enter(&listener
->tcp_eager_lock
);
1309 * The system is under memory pressure, so we need to do our part
1310 * to relieve the pressure. So we only accept new request if there
1311 * is nothing waiting to be accepted or waiting to complete the 3-way
1312 * handshake. This means that busy listener will not get too many
1313 * new requests which they cannot handle in time while non-busy
1314 * listener is still functioning properly.
1316 if (tcps
->tcps_reclaim
&& (listener
->tcp_conn_req_cnt_q
> 0 ||
1317 listener
->tcp_conn_req_cnt_q0
> 0)) {
1318 mutex_exit(&listener
->tcp_eager_lock
);
1319 TCP_STAT(tcps
, tcp_listen_mem_drop
);
1323 if (listener
->tcp_conn_req_cnt_q
>= listener
->tcp_conn_req_max
) {
1324 mutex_exit(&listener
->tcp_eager_lock
);
1325 TCP_STAT(tcps
, tcp_listendrop
);
1326 TCPS_BUMP_MIB(tcps
, tcpListenDrop
);
1327 if (lconnp
->conn_debug
) {
1328 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
|SL_ERROR
,
1329 "tcp_input_listener: listen backlog (max=%d) "
1330 "overflow (%d pending) on %s",
1331 listener
->tcp_conn_req_max
,
1332 listener
->tcp_conn_req_cnt_q
,
1333 tcp_display(listener
, NULL
, DISP_PORT_ONLY
));
1338 if (listener
->tcp_conn_req_cnt_q0
>=
1339 listener
->tcp_conn_req_max
+ tcps
->tcps_conn_req_max_q0
) {
1341 * Q0 is full. Drop a pending half-open req from the queue
1342 * to make room for the new SYN req. Also mark the time we
1345 * A more aggressive defense against SYN attack will
1346 * be to set the "tcp_syn_defense" flag now.
1348 TCP_STAT(tcps
, tcp_listendropq0
);
1349 listener
->tcp_last_rcv_lbolt
= ddi_get_lbolt64();
1350 if (!tcp_drop_q0(listener
)) {
1351 mutex_exit(&listener
->tcp_eager_lock
);
1352 TCPS_BUMP_MIB(tcps
, tcpListenDropQ0
);
1353 if (lconnp
->conn_debug
) {
1354 (void) strlog(TCP_MOD_ID
, 0, 3, SL_TRACE
,
1355 "tcp_input_listener: listen half-open "
1356 "queue (max=%d) full (%d pending) on %s",
1357 tcps
->tcps_conn_req_max_q0
,
1358 listener
->tcp_conn_req_cnt_q0
,
1359 tcp_display(listener
, NULL
,
1367 * Enforce the limit set on the number of connections per listener.
1368 * Note that tlc_cnt starts with 1. So need to add 1 to tlc_max
1371 if (listener
->tcp_listen_cnt
!= NULL
) {
1372 tcp_listen_cnt_t
*tlc
= listener
->tcp_listen_cnt
;
1375 if (atomic_inc_32_nv(&tlc
->tlc_cnt
) > tlc
->tlc_max
+ 1) {
1376 mutex_exit(&listener
->tcp_eager_lock
);
1377 now
= ddi_get_lbolt64();
1378 atomic_dec_32(&tlc
->tlc_cnt
);
1379 TCP_STAT(tcps
, tcp_listen_cnt_drop
);
1381 if (now
- tlc
->tlc_report_time
>
1382 MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL
)) {
1383 zcmn_err(lconnp
->conn_zoneid
, CE_WARN
,
1384 "Listener (port %d) connection max (%u) "
1385 "reached: %u attempts dropped total\n",
1386 ntohs(listener
->tcp_connp
->conn_lport
),
1387 tlc
->tlc_max
, tlc
->tlc_drop
);
1388 tlc
->tlc_report_time
= now
;
1395 mutex_exit(&listener
->tcp_eager_lock
);
1398 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1399 * or based on the ring (for packets from GLD). Otherwise it is
1400 * set based on lbolt i.e., a somewhat random number.
1402 ASSERT(ira
->ira_sqp
!= NULL
);
1403 new_sqp
= ira
->ira_sqp
;
1405 econnp
= (conn_t
*)tcp_get_conn(arg2
, tcps
);
1409 ASSERT(econnp
->conn_netstack
== lconnp
->conn_netstack
);
1410 econnp
->conn_sqp
= new_sqp
;
1411 econnp
->conn_initial_sqp
= new_sqp
;
1412 econnp
->conn_ixa
->ixa_sqp
= new_sqp
;
1414 econnp
->conn_fport
= tcpha
->tha_lport
;
1415 econnp
->conn_lport
= tcpha
->tha_fport
;
1417 err
= conn_inherit_parent(lconnp
, econnp
);
1421 /* We already know the laddr of the new connection is ours */
1422 econnp
->conn_ixa
->ixa_src_generation
= ipst
->ips_src_generation
;
1424 ASSERT(OK_32PTR(mp
->b_rptr
));
1425 ASSERT(IPH_HDR_VERSION(mp
->b_rptr
) == IPV4_VERSION
||
1426 IPH_HDR_VERSION(mp
->b_rptr
) == IPV6_VERSION
);
1428 if (lconnp
->conn_family
== AF_INET
) {
1429 ASSERT(IPH_HDR_VERSION(mp
->b_rptr
) == IPV4_VERSION
);
1430 tpi_mp
= tcp_conn_create_v4(lconnp
, econnp
, mp
, ira
);
1432 tpi_mp
= tcp_conn_create_v6(lconnp
, econnp
, mp
, ira
);
1438 eager
= econnp
->conn_tcp
;
1439 eager
->tcp_detached
= B_TRUE
;
1440 SOCK_CONNID_INIT(eager
->tcp_connid
);
1443 * Initialize the eager's tcp_t and inherit some parameters from
1446 tcp_init_values(eager
, listener
);
1448 * If listener's tcp_iss is set, the new connection replaces an old
1449 * TIME_WAIT connection and should use the ISS set in tcp_time_wait.c.
1451 if (listener
->tcp_iss
) {
1452 eager
->tcp_iss
= listener
->tcp_iss
;
1453 listener
->tcp_iss
= 0;
1455 random_get_pseudo_bytes((uint8_t *)&eager
->tcp_iss
,
1456 sizeof(eager
->tcp_iss
));
1459 ASSERT((econnp
->conn_ixa
->ixa_flags
&
1460 (IXAF_SET_ULP_CKSUM
| IXAF_VERIFY_SOURCE
|
1461 IXAF_VERIFY_PMTU
| IXAF_VERIFY_LSO
)) ==
1462 (IXAF_SET_ULP_CKSUM
| IXAF_VERIFY_SOURCE
|
1463 IXAF_VERIFY_PMTU
| IXAF_VERIFY_LSO
));
1465 if (!tcps
->tcps_dev_flow_ctl
)
1466 econnp
->conn_ixa
->ixa_flags
|= IXAF_NO_DEV_FLOW_CTL
;
1468 /* Prepare for diffing against previous packets */
1469 eager
->tcp_recvifindex
= 0;
1470 eager
->tcp_recvhops
= 0xffffffffU
;
1472 if (!(ira
->ira_flags
& IRAF_IS_IPV4
) && econnp
->conn_bound_if
== 0) {
1473 if (IN6_IS_ADDR_LINKSCOPE(&econnp
->conn_faddr_v6
) ||
1474 IN6_IS_ADDR_LINKSCOPE(&econnp
->conn_laddr_v6
)) {
1475 econnp
->conn_incoming_ifindex
= ifindex
;
1476 econnp
->conn_ixa
->ixa_flags
|= IXAF_SCOPEID_SET
;
1477 econnp
->conn_ixa
->ixa_scopeid
= ifindex
;
1481 if ((ira
->ira_flags
& (IRAF_IS_IPV4
|IRAF_IPV4_OPTIONS
)) ==
1482 (IRAF_IS_IPV4
|IRAF_IPV4_OPTIONS
) &&
1483 tcps
->tcps_rev_src_routes
) {
1484 ipha_t
*ipha
= (ipha_t
*)mp
->b_rptr
;
1485 ip_pkt_t
*ipp
= &econnp
->conn_xmit_ipp
;
1487 /* Source routing option copyover (reverse it) */
1488 err
= ip_find_hdr_v4(ipha
, ipp
, B_TRUE
);
1493 ip_pkt_source_route_reverse_v4(ipp
);
1496 ASSERT(eager
->tcp_conn
.tcp_eager_conn_ind
== NULL
);
1497 ASSERT(!eager
->tcp_tconnind_started
);
1499 * If the SYN came with a credential, it's a loopback packet; attach
1500 * the credential to the TPI message.
1502 if (ira
->ira_cred
!= NULL
)
1503 mblk_setcred(tpi_mp
, ira
->ira_cred
, ira
->ira_cpid
);
1505 eager
->tcp_conn
.tcp_eager_conn_ind
= tpi_mp
;
1506 ASSERT(eager
->tcp_ordrel_mp
== NULL
);
1508 /* Inherit the listener's non-STREAMS flag */
1509 if (IPCL_IS_NONSTR(lconnp
)) {
1510 econnp
->conn_flags
|= IPCL_NONSTR
;
1511 /* All non-STREAMS tcp_ts are sockets */
1512 eager
->tcp_issocket
= B_TRUE
;
1515 * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1516 * at close time, we will always have that to send up.
1517 * Otherwise, we need to do special handling in case the
1518 * allocation fails at that time.
1520 if ((eager
->tcp_ordrel_mp
= mi_tpi_ordrel_ind()) == NULL
)
1524 * Now that the IP addresses and ports are setup in econnp we
1525 * can do the IPsec policy work.
1527 if (ira
->ira_flags
& IRAF_IPSEC_SECURE
) {
1528 if (lconnp
->conn_policy
!= NULL
) {
1530 * Inherit the policy from the listener; use
1533 if (!ip_ipsec_policy_inherit(econnp
, lconnp
, ira
)) {
1534 CONN_DEC_REF(econnp
);
1542 * tcp_set_destination() may set tcp_rwnd according to the route
1543 * metrics. If it does not, the eager's receive window will be set
1544 * to the listener's receive window later in this function.
1546 eager
->tcp_rwnd
= 0;
1549 * Since we will clear tcp_listener before we clear tcp_detached
1550 * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1551 * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1553 eager
->tcp_hard_binding
= B_TRUE
;
1555 tcp_bind_hash_insert(&tcps
->tcps_bind_fanout
[
1556 TCP_BIND_HASH(econnp
->conn_lport
)], eager
, 0);
1558 SOCK_CONNID_BUMP(eager
->tcp_connid
);
1561 * Adapt our mss, ttl, ... based on the remote address.
1564 if (tcp_set_destination(eager
) != 0) {
1565 TCPS_BUMP_MIB(tcps
, tcpAttemptFails
);
1566 /* Undo the bind_hash_insert */
1567 tcp_bind_hash_remove(eager
);
1571 /* Process all TCP options. */
1572 tcp_process_options(eager
, tcpha
);
1574 /* Is the other end ECN capable? */
1575 if (tcps
->tcps_ecn_permitted
>= 1 &&
1576 (tcpha
->tha_flags
& (TH_ECE
|TH_CWR
)) == (TH_ECE
|TH_CWR
)) {
1577 eager
->tcp_ecn_ok
= B_TRUE
;
1581 * The listener's conn_rcvbuf should be the default window size or a
1582 * window size changed via SO_RCVBUF option. First round up the
1583 * eager's tcp_rwnd to the nearest MSS. Then find out the window
1584 * scale option value if needed. Call tcp_rwnd_set() to finish the
1587 * Note if there is a rpipe metric associated with the remote host,
1588 * we should not inherit receive window size from listener.
1590 eager
->tcp_rwnd
= MSS_ROUNDUP(
1591 (eager
->tcp_rwnd
== 0 ? econnp
->conn_rcvbuf
:
1592 eager
->tcp_rwnd
), eager
->tcp_mss
);
1593 if (eager
->tcp_snd_ws_ok
)
1594 tcp_set_ws_value(eager
);
1596 * Note that this is the only place tcp_rwnd_set() is called for
1597 * accepting a connection. We need to call it here instead of
1598 * after the 3-way handshake because we need to tell the other
1599 * side our rwnd in the SYN-ACK segment.
1601 (void) tcp_rwnd_set(eager
, eager
->tcp_rwnd
);
1603 ASSERT(eager
->tcp_connp
->conn_rcvbuf
!= 0 &&
1604 eager
->tcp_connp
->conn_rcvbuf
== eager
->tcp_rwnd
);
1606 ASSERT(econnp
->conn_rcvbuf
!= 0 &&
1607 econnp
->conn_rcvbuf
== eager
->tcp_rwnd
);
1609 /* Put a ref on the listener for the eager. */
1610 CONN_INC_REF(lconnp
);
1611 mutex_enter(&listener
->tcp_eager_lock
);
1612 listener
->tcp_eager_next_q0
->tcp_eager_prev_q0
= eager
;
1613 eager
->tcp_eager_next_q0
= listener
->tcp_eager_next_q0
;
1614 listener
->tcp_eager_next_q0
= eager
;
1615 eager
->tcp_eager_prev_q0
= listener
;
1617 /* Set tcp_listener before adding it to tcp_conn_fanout */
1618 eager
->tcp_listener
= listener
;
1619 eager
->tcp_saved_listener
= listener
;
1622 * Set tcp_listen_cnt so that when the connection is done, the counter
1625 eager
->tcp_listen_cnt
= listener
->tcp_listen_cnt
;
1628 * Tag this detached tcp vector for later retrieval
1629 * by our listener client in tcp_accept().
1631 eager
->tcp_conn_req_seqnum
= listener
->tcp_conn_req_seqnum
;
1632 listener
->tcp_conn_req_cnt_q0
++;
1633 if (++listener
->tcp_conn_req_seqnum
== -1) {
1635 * -1 is "special" and defined in TPI as something
1636 * that should never be used in T_CONN_IND
1638 ++listener
->tcp_conn_req_seqnum
;
1640 mutex_exit(&listener
->tcp_eager_lock
);
1642 if (listener
->tcp_syn_defense
) {
1643 /* Don't drop the SYN that comes from a good IP source */
1644 ipaddr_t
*addr_cache
;
1646 addr_cache
= (ipaddr_t
*)(listener
->tcp_ip_addr_cache
);
1647 if (addr_cache
!= NULL
&& econnp
->conn_faddr_v4
==
1648 addr_cache
[IP_ADDR_CACHE_HASH(econnp
->conn_faddr_v4
)]) {
1649 eager
->tcp_dontdrop
= B_TRUE
;
1654 * We need to insert the eager in its own perimeter but as soon
1655 * as we do that, we expose the eager to the classifier and
1656 * should not touch any field outside the eager's perimeter.
1657 * So do all the work necessary before inserting the eager
1658 * in its own perimeter. Be optimistic that conn_connect()
1659 * will succeed but undo everything if it fails.
1661 seg_seq
= ntohl(tcpha
->tha_seq
);
1662 eager
->tcp_irs
= seg_seq
;
1663 eager
->tcp_rack
= seg_seq
;
1664 eager
->tcp_rnxt
= seg_seq
+ 1;
1665 eager
->tcp_tcpha
->tha_ack
= htonl(eager
->tcp_rnxt
);
1666 TCPS_BUMP_MIB(tcps
, tcpPassiveOpens
);
1667 eager
->tcp_state
= TCPS_SYN_RCVD
;
1668 DTRACE_TCP6(state__change
, void, NULL
, ip_xmit_attr_t
*,
1669 econnp
->conn_ixa
, void, NULL
, tcp_t
*, eager
, void, NULL
,
1670 int32_t, TCPS_LISTEN
);
1672 mp1
= tcp_xmit_mp(eager
, eager
->tcp_xmit_head
, eager
->tcp_mss
,
1673 NULL
, NULL
, eager
->tcp_iss
, B_FALSE
, NULL
, B_FALSE
);
1676 * Increment the ref count as we are going to
1677 * enqueueing an mp in squeue
1679 CONN_INC_REF(econnp
);
1684 * We need to start the rto timer. In normal case, we start
1685 * the timer after sending the packet on the wire (or at
1686 * least believing that packet was sent by waiting for
1687 * conn_ip_output() to return). Since this is the first packet
1688 * being sent on the wire for the eager, our initial tcp_rto
1689 * is at least tcp_rexmit_interval_min which is a fairly
1690 * large value to allow the algorithm to adjust slowly to large
1691 * fluctuations of RTT during first few transmissions.
1693 * Starting the timer first and then sending the packet in this
1694 * case shouldn't make much difference since tcp_rexmit_interval_min
1695 * is of the order of several 100ms and starting the timer
1696 * first and then sending the packet will result in difference
1697 * of few micro seconds.
1699 * Without this optimization, we are forced to hold the fanout
1700 * lock across the ipcl_bind_insert() and sending the packet
1701 * so that we don't race against an incoming packet (maybe RST)
1704 * It is necessary to acquire an extra reference on the eager
1705 * at this point and hold it until after tcp_send_data() to
1706 * ensure against an eager close race.
1709 CONN_INC_REF(econnp
);
1711 TCP_TIMER_RESTART(eager
, eager
->tcp_rto
);
1714 * Insert the eager in its own perimeter now. We are ready to deal
1715 * with any packets on eager.
1717 if (ipcl_conn_insert(econnp
) != 0)
1720 ASSERT(econnp
->conn_ixa
->ixa_notify_cookie
== econnp
->conn_tcp
);
1723 * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1724 * only used by one thread at a time.
1726 if (econnp
->conn_sqp
== lconnp
->conn_sqp
) {
1727 DTRACE_TCP5(send
, mblk_t
*, NULL
, ip_xmit_attr_t
*,
1728 econnp
->conn_ixa
, __dtrace_tcp_void_ip_t
*, mp1
->b_rptr
,
1729 tcp_t
*, eager
, __dtrace_tcp_tcph_t
*,
1730 &mp1
->b_rptr
[econnp
->conn_ixa
->ixa_ip_hdr_length
]);
1731 (void) conn_ip_output(mp1
, econnp
->conn_ixa
);
1732 CONN_DEC_REF(econnp
);
1734 SQUEUE_ENTER_ONE(econnp
->conn_sqp
, mp1
, tcp_send_synack
,
1735 econnp
, NULL
, SQ_PROCESS
, SQTAG_TCP_SEND_SYNACK
);
1740 eager
->tcp_closemp_used
= B_TRUE
;
1741 TCP_DEBUG_GETPCSTACK(eager
->tcmp_stk
, 15);
1742 mp1
= &eager
->tcp_closemp
;
1743 SQUEUE_ENTER_ONE(econnp
->conn_sqp
, mp1
, tcp_eager_kill
,
1744 econnp
, NULL
, SQ_FILL
, SQTAG_TCP_CONN_REQ_2
);
1747 * If a connection already exists, send the mp to that connections so
1748 * that it can be appropriately dealt with.
1750 ipst
= tcps
->tcps_netstack
->netstack_ip
;
1752 if ((econnp
= ipcl_classify(mp
, ira
, ipst
)) != NULL
) {
1753 if (!IPCL_IS_CONNECTED(econnp
)) {
1755 * Something bad happened. ipcl_conn_insert()
1756 * failed because a connection already existed
1757 * in connected hash but we can't find it
1758 * anymore (someone blew it away). Just
1759 * free this message and hopefully remote
1760 * will retransmit at which time the SYN can be
1761 * treated as a new connection or dealth with
1762 * a TH_RST if a connection already exists.
1764 CONN_DEC_REF(econnp
);
1767 SQUEUE_ENTER_ONE(econnp
->conn_sqp
, mp
, tcp_input_data
,
1768 econnp
, ira
, SQ_FILL
, SQTAG_TCP_CONN_REQ_1
);
1771 /* Nobody wants this packet */
1776 CONN_DEC_REF(econnp
);
1780 atomic_dec_32(&listener
->tcp_listen_cnt
->tlc_cnt
);
1784 * In an ideal case of vertical partition in NUMA architecture, its
1785 * beneficial to have the listener and all the incoming connections
1786 * tied to the same squeue. The other constraint is that incoming
1787 * connections should be tied to the squeue attached to interrupted
1788 * CPU for obvious locality reason so this leaves the listener to
1789 * be tied to the same squeue. Our only problem is that when listener
1790 * is binding, the CPU that will get interrupted by the NIC whose
1791 * IP address the listener is binding to is not even known. So
1792 * the code below allows us to change that binding at the time the
1793 * CPU is interrupted by virtue of incoming connection's squeue.
1795 * This is usefull only in case of a listener bound to a specific IP
1796 * address. For other kind of listeners, they get bound the
1797 * very first time and there is no attempt to rebind them.
1800 tcp_input_listener_unbound(void *arg
, mblk_t
*mp
, void *arg2
,
1801 ip_recv_attr_t
*ira
)
1803 conn_t
*connp
= (conn_t
*)arg
;
1804 squeue_t
*sqp
= (squeue_t
*)arg2
;
1806 uint32_t conn_flags
;
1809 * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1810 * or based on the ring (for packets from GLD). Otherwise it is
1811 * set based on lbolt i.e., a somewhat random number.
1813 ASSERT(ira
->ira_sqp
!= NULL
);
1814 new_sqp
= ira
->ira_sqp
;
1816 if (connp
->conn_fanout
== NULL
)
1819 if (!(connp
->conn_flags
& IPCL_FULLY_BOUND
)) {
1820 mutex_enter(&connp
->conn_fanout
->connf_lock
);
1821 mutex_enter(&connp
->conn_lock
);
1823 * No one from read or write side can access us now
1824 * except for already queued packets on this squeue.
1825 * But since we haven't changed the squeue yet, they
1826 * can't execute. If they are processed after we have
1827 * changed the squeue, they are sent back to the
1828 * correct squeue down below.
1829 * But a listner close can race with processing of
1830 * incoming SYN. If incoming SYN processing changes
1831 * the squeue then the listener close which is waiting
1832 * to enter the squeue would operate on the wrong
1833 * squeue. Hence we don't change the squeue here unless
1834 * the refcount is exactly the minimum refcount. The
1835 * minimum refcount of 4 is counted as - 1 each for
1836 * TCP and IP, 1 for being in the classifier hash, and
1837 * 1 for the mblk being processed.
1840 if (connp
->conn_ref
!= 4 ||
1841 connp
->conn_tcp
->tcp_state
!= TCPS_LISTEN
) {
1842 mutex_exit(&connp
->conn_lock
);
1843 mutex_exit(&connp
->conn_fanout
->connf_lock
);
1846 if (connp
->conn_sqp
!= new_sqp
) {
1847 while (connp
->conn_sqp
!= new_sqp
)
1848 (void) atomic_cas_ptr(&connp
->conn_sqp
, sqp
,
1850 /* No special MT issues for outbound ixa_sqp hint */
1851 connp
->conn_ixa
->ixa_sqp
= new_sqp
;
1855 conn_flags
= connp
->conn_flags
;
1856 conn_flags
|= IPCL_FULLY_BOUND
;
1857 (void) atomic_cas_32(&connp
->conn_flags
,
1858 connp
->conn_flags
, conn_flags
);
1859 } while (!(connp
->conn_flags
& IPCL_FULLY_BOUND
));
1861 mutex_exit(&connp
->conn_fanout
->connf_lock
);
1862 mutex_exit(&connp
->conn_lock
);
1865 * Assume we have picked a good squeue for the listener. Make
1866 * subsequent SYNs not try to change the squeue.
1868 connp
->conn_recv
= tcp_input_listener
;
1872 if (connp
->conn_sqp
!= sqp
) {
1873 CONN_INC_REF(connp
);
1874 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
, connp
->conn_recv
, connp
,
1875 ira
, SQ_FILL
, SQTAG_TCP_CONN_REQ_UNBOUND
);
1877 tcp_input_listener(connp
, mp
, sqp
, ira
);
1882 * Send up all messages queued on tcp_rcv_list.
1885 tcp_rcv_drain(tcp_t
*tcp
)
1892 queue_t
*q
= tcp
->tcp_connp
->conn_rq
;
1894 /* Can't drain on an eager connection */
1895 if (tcp
->tcp_listener
!= NULL
)
1898 /* Can't be a non-STREAMS connection */
1899 ASSERT(!IPCL_IS_NONSTR(tcp
->tcp_connp
));
1901 /* No need for the push timer now. */
1902 if (tcp
->tcp_push_tid
!= 0) {
1903 (void) TCP_TIMER_CANCEL(tcp
, tcp
->tcp_push_tid
);
1904 tcp
->tcp_push_tid
= 0;
1908 * Handle two cases here: we are currently fused or we were
1909 * previously fused and have some urgent data to be delivered
1910 * upstream. The latter happens because we either ran out of
1911 * memory or were detached and therefore sending the SIGURG was
1912 * deferred until this point. In either case we pass control
1913 * over to tcp_fuse_rcv_drain() since it may need to complete
1916 if ((tcp
->tcp_fused
|| tcp
->tcp_fused_sigurg
)) {
1917 if (tcp_fuse_rcv_drain(q
, tcp
, tcp
->tcp_fused
? NULL
:
1918 &tcp
->tcp_fused_sigurg_mp
))
1922 while ((mp
= tcp
->tcp_rcv_list
) != NULL
) {
1923 tcp
->tcp_rcv_list
= mp
->b_next
;
1926 cnt
+= msgdsize(mp
);
1931 ASSERT(cnt
== tcp
->tcp_rcv_cnt
);
1933 tcp
->tcp_rcv_last_head
= NULL
;
1934 tcp
->tcp_rcv_last_tail
= NULL
;
1935 tcp
->tcp_rcv_cnt
= 0;
1938 return (tcp_rwnd_reopen(tcp
));
1944 * Queue data on tcp_rcv_list which is a b_next chain.
1945 * tcp_rcv_last_head/tail is the last element of this chain.
1946 * Each element of the chain is a b_cont chain.
1948 * M_DATA messages are added to the current element.
1949 * Other messages are added as new (b_next) elements.
1952 tcp_rcv_enqueue(tcp_t
*tcp
, mblk_t
*mp
, uint_t seg_len
, cred_t
*cr
)
1954 ASSERT(seg_len
== msgdsize(mp
));
1955 ASSERT(tcp
->tcp_rcv_list
== NULL
|| tcp
->tcp_rcv_last_head
!= NULL
);
1957 if (tcp
->tcp_rcv_list
== NULL
) {
1958 ASSERT(tcp
->tcp_rcv_last_head
== NULL
);
1959 tcp
->tcp_rcv_list
= mp
;
1960 tcp
->tcp_rcv_last_head
= mp
;
1961 } else if (DB_TYPE(mp
) == DB_TYPE(tcp
->tcp_rcv_last_head
)) {
1962 tcp
->tcp_rcv_last_tail
->b_cont
= mp
;
1964 tcp
->tcp_rcv_last_head
->b_next
= mp
;
1965 tcp
->tcp_rcv_last_head
= mp
;
1971 tcp
->tcp_rcv_last_tail
= mp
;
1972 tcp
->tcp_rcv_cnt
+= seg_len
;
1973 tcp
->tcp_rwnd
-= seg_len
;
1976 /* Generate an ACK-only (no data) segment for a TCP endpoint */
1978 tcp_ack_mp(tcp_t
*tcp
)
1981 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
1982 conn_t
*connp
= tcp
->tcp_connp
;
1985 * There are a few cases to be considered while setting the sequence no.
1986 * Essentially, we can come here while processing an unacceptable pkt
1987 * in the TCPS_SYN_RCVD state, in which case we set the sequence number
1988 * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
1989 * If we are here for a zero window probe, stick with suna. In all
1990 * other cases, we check if suna + swnd encompasses snxt and set
1991 * the sequence number to snxt, if so. If snxt falls outside the
1992 * window (the receiver probably shrunk its window), we will go with
1993 * suna + swnd, otherwise the sequence no will be unacceptable to the
1996 if (tcp
->tcp_zero_win_probe
) {
1997 seq_no
= tcp
->tcp_suna
;
1998 } else if (tcp
->tcp_state
== TCPS_SYN_RCVD
) {
1999 ASSERT(tcp
->tcp_swnd
== 0);
2000 seq_no
= tcp
->tcp_snxt
;
2002 seq_no
= SEQ_GT(tcp
->tcp_snxt
,
2003 (tcp
->tcp_suna
+ tcp
->tcp_swnd
)) ?
2004 (tcp
->tcp_suna
+ tcp
->tcp_swnd
) : tcp
->tcp_snxt
;
2007 if (tcp
->tcp_valid_bits
) {
2009 * For the complex case where we have to send some
2010 * controls (FIN or SYN), let tcp_xmit_mp do it.
2012 return (tcp_xmit_mp(tcp
, NULL
, 0, NULL
, NULL
, seq_no
, B_FALSE
,
2015 /* Generate a simple ACK */
2020 int32_t total_hdr_len
;
2021 int32_t tcp_hdr_len
;
2022 int32_t num_sack_blk
= 0;
2023 int32_t sack_opt_len
;
2024 ip_xmit_attr_t
*ixa
= connp
->conn_ixa
;
2027 * Allocate space for TCP + IP headers
2028 * and link-level header
2030 if (tcp
->tcp_snd_sack_ok
&& tcp
->tcp_num_sack_blk
> 0) {
2031 num_sack_blk
= MIN(tcp
->tcp_max_sack_blk
,
2032 tcp
->tcp_num_sack_blk
);
2033 sack_opt_len
= num_sack_blk
* sizeof (sack_blk_t
) +
2034 TCPOPT_NOP_LEN
* 2 + TCPOPT_HEADER_LEN
;
2035 total_hdr_len
= connp
->conn_ht_iphc_len
+ sack_opt_len
;
2036 tcp_hdr_len
= connp
->conn_ht_ulp_len
+ sack_opt_len
;
2038 total_hdr_len
= connp
->conn_ht_iphc_len
;
2039 tcp_hdr_len
= connp
->conn_ht_ulp_len
;
2041 mp1
= allocb(total_hdr_len
+ tcps
->tcps_wroff_xtra
, BPRI_MED
);
2045 /* Update the latest receive window size in TCP header. */
2046 tcp
->tcp_tcpha
->tha_win
=
2047 htons(tcp
->tcp_rwnd
>> tcp
->tcp_rcv_ws
);
2048 /* copy in prototype TCP + IP header */
2049 rptr
= mp1
->b_rptr
+ tcps
->tcps_wroff_xtra
;
2051 mp1
->b_wptr
= rptr
+ total_hdr_len
;
2052 bcopy(connp
->conn_ht_iphc
, rptr
, connp
->conn_ht_iphc_len
);
2054 tcpha
= (tcpha_t
*)&rptr
[ixa
->ixa_ip_hdr_length
];
2056 /* Set the TCP sequence number. */
2057 tcpha
->tha_seq
= htonl(seq_no
);
2059 /* Set up the TCP flag field. */
2060 tcpha
->tha_flags
= (uchar_t
)TH_ACK
;
2061 if (tcp
->tcp_ecn_echo_on
)
2062 tcpha
->tha_flags
|= TH_ECE
;
2064 tcp
->tcp_rack
= tcp
->tcp_rnxt
;
2065 tcp
->tcp_rack_cnt
= 0;
2067 /* fill in timestamp option if in use */
2068 if (tcp
->tcp_snd_ts_ok
) {
2069 uint32_t llbolt
= (uint32_t)LBOLT_FASTPATH
;
2072 (char *)tcpha
+ TCP_MIN_HEADER_LENGTH
+4);
2073 U32_TO_BE32(tcp
->tcp_ts_recent
,
2074 (char *)tcpha
+ TCP_MIN_HEADER_LENGTH
+8);
2077 /* Fill in SACK options */
2078 if (num_sack_blk
> 0) {
2079 uchar_t
*wptr
= (uchar_t
*)tcpha
+
2080 connp
->conn_ht_ulp_len
;
2084 wptr
[0] = TCPOPT_NOP
;
2085 wptr
[1] = TCPOPT_NOP
;
2086 wptr
[2] = TCPOPT_SACK
;
2087 wptr
[3] = TCPOPT_HEADER_LEN
+ num_sack_blk
*
2088 sizeof (sack_blk_t
);
2089 wptr
+= TCPOPT_REAL_SACK_LEN
;
2091 tmp
= tcp
->tcp_sack_list
;
2092 for (i
= 0; i
< num_sack_blk
; i
++) {
2093 U32_TO_BE32(tmp
[i
].begin
, wptr
);
2094 wptr
+= sizeof (tcp_seq
);
2095 U32_TO_BE32(tmp
[i
].end
, wptr
);
2096 wptr
+= sizeof (tcp_seq
);
2098 tcpha
->tha_offset_and_reserved
+=
2099 ((num_sack_blk
* 2 + 1) << 4);
2102 ixa
->ixa_pktlen
= total_hdr_len
;
2104 if (ixa
->ixa_flags
& IXAF_IS_IPV4
) {
2105 ((ipha_t
*)rptr
)->ipha_length
= htons(total_hdr_len
);
2107 ip6_t
*ip6
= (ip6_t
*)rptr
;
2109 ip6
->ip6_plen
= htons(total_hdr_len
- IPV6_HDR_LEN
);
2113 * Prime pump for checksum calculation in IP. Include the
2114 * adjustment for a source route if any.
2116 data_length
= tcp_hdr_len
+ connp
->conn_sum
;
2117 data_length
= (data_length
>> 16) + (data_length
& 0xFFFF);
2118 tcpha
->tha_sum
= htons(data_length
);
2120 if (tcp
->tcp_ip_forward_progress
) {
2121 tcp
->tcp_ip_forward_progress
= B_FALSE
;
2122 connp
->conn_ixa
->ixa_flags
|= IXAF_REACH_CONF
;
2124 connp
->conn_ixa
->ixa_flags
&= ~IXAF_REACH_CONF
;
2131 * Dummy socket upcalls for if/when the conn_t gets detached from a
2132 * direct-callback sonode via a user-driven close(). Easy to catch with
2133 * DTrace FBT, and should be mostly harmless.
2137 static sock_upper_handle_t
2138 tcp_dummy_newconn(sock_upper_handle_t x
, sock_lower_handle_t y
,
2139 sock_downcalls_t
*z
, cred_t
*cr
, pid_t pid
, sock_upcalls_t
**ignored
)
2141 ASSERT(0); /* Panic in debug, otherwise ignore. */
2147 tcp_dummy_connected(sock_upper_handle_t x
, sock_connid_t y
, cred_t
*cr
,
2151 /* Normally we'd crhold(cr) and attach it to socket state. */
2157 tcp_dummy_disconnected(sock_upper_handle_t x
, sock_connid_t y
, int blah
)
2159 ASSERT(0); /* Panic in debug, otherwise ignore. */
2165 tcp_dummy_opctl(sock_upper_handle_t x
, sock_opctl_action_t y
, uintptr_t blah
)
2168 /* We really want this one to be a harmless NOP for now. */
2174 tcp_dummy_recv(sock_upper_handle_t x
, mblk_t
*mp
, size_t len
, int flags
,
2175 int *error
, boolean_t
*push
)
2180 * Consume the message, set ESHUTDOWN, and return an error.
2190 tcp_dummy_set_proto_props(sock_upper_handle_t x
, struct sock_proto_props
*y
)
2192 ASSERT(0); /* Panic in debug, otherwise ignore. */
2197 tcp_dummy_txq_full(sock_upper_handle_t x
, boolean_t y
)
2199 ASSERT(0); /* Panic in debug, otherwise ignore. */
2204 tcp_dummy_signal_oob(sock_upper_handle_t x
, ssize_t len
)
2207 /* Otherwise, this would signal socket state about OOB data. */
2212 tcp_dummy_set_error(sock_upper_handle_t x
, int err
)
2214 ASSERT(0); /* Panic in debug, otherwise ignore. */
2219 tcp_dummy_onearg(sock_upper_handle_t x
)
2221 ASSERT(0); /* Panic in debug, otherwise ignore. */
2224 static sock_upcalls_t tcp_dummy_upcalls
= {
2226 tcp_dummy_connected
,
2227 tcp_dummy_disconnected
,
2230 tcp_dummy_set_proto_props
,
2232 tcp_dummy_signal_oob
,
2234 tcp_dummy_set_error
,
2239 * Handle M_DATA messages from IP. Its called directly from IP via
2240 * squeue for received IP packets.
2242 * The first argument is always the connp/tcp to which the mp belongs.
2243 * There are no exceptions to this rule. The caller has already put
2244 * a reference on this connp/tcp and once tcp_input_data() returns,
2245 * the squeue will do the refrele.
2247 * The TH_SYN for the listener directly go to tcp_input_listener via
2248 * squeue. ICMP errors go directly to tcp_icmp_input().
2250 * sqp: NULL = recursive, sqp != NULL means called from squeue
2253 tcp_input_data(void *arg
, mblk_t
*mp
, void *arg2
, ip_recv_attr_t
*ira
)
2255 int32_t bytes_acked
;
2259 uint32_t new_swnd
= 0;
2271 boolean_t ofo_seg
= B_FALSE
; /* Out of order segment */
2276 conn_t
*connp
= (conn_t
*)arg
;
2277 squeue_t
*sqp
= (squeue_t
*)arg2
;
2278 tcp_t
*tcp
= connp
->conn_tcp
;
2279 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
2280 sock_upcalls_t
*sockupcalls
;
2283 * RST from fused tcp loopback peer should trigger an unfuse.
2285 if (tcp
->tcp_fused
) {
2286 TCP_STAT(tcps
, tcp_fusion_aborted
);
2292 ASSERT(OK_32PTR(rptr
));
2294 ip_hdr_len
= ira
->ira_ip_hdr_length
;
2295 if (connp
->conn_recv_ancillary
.crb_all
!= 0) {
2297 * Record packet information in the ip_pkt_t
2300 if (ira
->ira_flags
& IRAF_IS_IPV4
) {
2301 (void) ip_find_hdr_v4((ipha_t
*)rptr
, &ipp
,
2307 * IPv6 packets can only be received by applications
2308 * that are prepared to receive IPv6 addresses.
2309 * The IP fanout must ensure this.
2311 ASSERT(connp
->conn_family
== AF_INET6
);
2313 (void) ip_find_hdr_v6(mp
, (ip6_t
*)rptr
, &ipp
,
2315 ASSERT(nexthdrp
== IPPROTO_TCP
);
2317 /* Could have caused a pullup? */
2322 ASSERT(DB_TYPE(mp
) == M_DATA
);
2323 ASSERT(mp
->b_next
== NULL
);
2325 tcpha
= (tcpha_t
*)&rptr
[ip_hdr_len
];
2326 seg_seq
= ntohl(tcpha
->tha_seq
);
2327 seg_ack
= ntohl(tcpha
->tha_ack
);
2328 ASSERT((uintptr_t)(mp
->b_wptr
- rptr
) <= (uintptr_t)INT_MAX
);
2329 seg_len
= (int)(mp
->b_wptr
- rptr
) -
2330 (ip_hdr_len
+ TCP_HDR_LENGTH(tcpha
));
2331 if ((mp1
= mp
->b_cont
) != NULL
&& mp1
->b_datap
->db_type
== M_DATA
) {
2333 ASSERT((uintptr_t)(mp1
->b_wptr
- mp1
->b_rptr
) <=
2334 (uintptr_t)INT_MAX
);
2335 seg_len
+= (int)(mp1
->b_wptr
- mp1
->b_rptr
);
2336 } while ((mp1
= mp1
->b_cont
) != NULL
&&
2337 mp1
->b_datap
->db_type
== M_DATA
);
2340 DTRACE_TCP5(receive
, mblk_t
*, NULL
, ip_xmit_attr_t
*, connp
->conn_ixa
,
2341 __dtrace_tcp_void_ip_t
*, iphdr
, tcp_t
*, tcp
,
2342 __dtrace_tcp_tcph_t
*, tcpha
);
2344 if (tcp
->tcp_state
== TCPS_TIME_WAIT
) {
2345 tcp_time_wait_processing(tcp
, mp
, seg_seq
, seg_ack
,
2346 seg_len
, tcpha
, ira
);
2352 * This is the correct place to update tcp_last_recv_time. Note
2353 * that it is also updated for tcp structure that belongs to
2354 * global and listener queues which do not really need updating.
2355 * But that should not cause any harm. And it is updated for
2356 * all kinds of incoming segments, not only for data segments.
2358 tcp
->tcp_last_recv_time
= LBOLT_FASTPATH
;
2361 flags
= (unsigned int)tcpha
->tha_flags
& 0xFF;
2363 BUMP_LOCAL(tcp
->tcp_ibsegs
);
2364 DTRACE_PROBE2(tcp__trace__recv
, mblk_t
*, mp
, tcp_t
*, tcp
);
2366 if ((flags
& TH_URG
) && sqp
!= NULL
) {
2368 * TCP can't handle urgent pointers that arrive before
2369 * the connection has been accept()ed since it can't
2370 * buffer OOB data. Discard segment if this happens.
2372 * We can't just rely on a non-null tcp_listener to indicate
2373 * that the accept() has completed since unlinking of the
2374 * eager and completion of the accept are not atomic.
2375 * tcp_detached, when it is not set (B_FALSE) indicates
2376 * that the accept() has completed.
2378 * Nor can it reassemble urgent pointers, so discard
2379 * if it's not the next segment expected.
2381 * Otherwise, collapse chain into one mblk (discard if
2382 * that fails). This makes sure the headers, retransmitted
2383 * data, and new data all are in the same mblk.
2386 if (tcp
->tcp_detached
|| !pullupmsg(mp
, -1)) {
2390 /* Update pointers into message */
2391 iphdr
= rptr
= mp
->b_rptr
;
2392 tcpha
= (tcpha_t
*)&rptr
[ip_hdr_len
];
2393 if (SEQ_GT(seg_seq
, tcp
->tcp_rnxt
)) {
2395 * Since we can't handle any data with this urgent
2396 * pointer that is out of sequence, we expunge
2397 * the data. This allows us to still register
2398 * the urgent mark and generate the M_PCSIG,
2401 mp
->b_wptr
= (uchar_t
*)tcpha
+ TCP_HDR_LENGTH(tcpha
);
2406 sockupcalls
= connp
->conn_upcalls
;
2407 /* A conn_t may have belonged to a now-closed socket. Be careful. */
2408 if (sockupcalls
== NULL
)
2409 sockupcalls
= &tcp_dummy_upcalls
;
2411 switch (tcp
->tcp_state
) {
2413 if (connp
->conn_final_sqp
== NULL
&&
2414 tcp_outbound_squeue_switch
&& sqp
!= NULL
) {
2415 ASSERT(connp
->conn_initial_sqp
== connp
->conn_sqp
);
2416 connp
->conn_final_sqp
= sqp
;
2417 if (connp
->conn_final_sqp
!= connp
->conn_sqp
) {
2418 DTRACE_PROBE1(conn__final__sqp__switch
,
2420 CONN_INC_REF(connp
);
2421 SQUEUE_SWITCH(connp
, connp
->conn_final_sqp
);
2422 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
,
2423 tcp_input_data
, connp
, ira
, ip_squeue_flag
,
2424 SQTAG_CONNECT_FINISH
);
2427 DTRACE_PROBE1(conn__final__sqp__same
, conn_t
*, connp
);
2429 if (flags
& TH_ACK
) {
2431 * Note that our stack cannot send data before a
2432 * connection is established, therefore the
2433 * following check is valid. Otherwise, it has
2436 if (SEQ_LEQ(seg_ack
, tcp
->tcp_iss
) ||
2437 SEQ_GT(seg_ack
, tcp
->tcp_snxt
)) {
2441 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2442 tcp
, seg_ack
, 0, TH_RST
);
2445 ASSERT(tcp
->tcp_suna
+ 1 == seg_ack
);
2447 if (flags
& TH_RST
) {
2448 if (flags
& TH_ACK
) {
2449 DTRACE_TCP5(connect__refused
, mblk_t
*, NULL
,
2450 ip_xmit_attr_t
*, connp
->conn_ixa
,
2451 void_ip_t
*, iphdr
, tcp_t
*, tcp
,
2453 (void) tcp_clean_death(tcp
, ECONNREFUSED
);
2458 if (!(flags
& TH_SYN
)) {
2463 /* Process all TCP options. */
2464 tcp_process_options(tcp
, tcpha
);
2466 * The following changes our rwnd to be a multiple of the
2467 * MIN(peer MSS, our MSS) for performance reason.
2469 (void) tcp_rwnd_set(tcp
, MSS_ROUNDUP(connp
->conn_rcvbuf
,
2472 /* Is the other end ECN capable? */
2473 if (tcp
->tcp_ecn_ok
) {
2474 if ((flags
& (TH_ECE
|TH_CWR
)) != TH_ECE
) {
2475 tcp
->tcp_ecn_ok
= B_FALSE
;
2479 * Clear ECN flags because it may interfere with later
2482 flags
&= ~(TH_ECE
|TH_CWR
);
2484 tcp
->tcp_irs
= seg_seq
;
2485 tcp
->tcp_rack
= seg_seq
;
2486 tcp
->tcp_rnxt
= seg_seq
+ 1;
2487 tcp
->tcp_tcpha
->tha_ack
= htonl(tcp
->tcp_rnxt
);
2488 if (!TCP_IS_DETACHED(tcp
)) {
2489 /* Allocate room for SACK options if needed. */
2490 connp
->conn_wroff
= connp
->conn_ht_iphc_len
;
2491 if (tcp
->tcp_snd_sack_ok
)
2492 connp
->conn_wroff
+= TCPOPT_MAX_SACK_LEN
;
2493 if (!tcp
->tcp_loopback
)
2494 connp
->conn_wroff
+= tcps
->tcps_wroff_xtra
;
2496 (void) proto_set_tx_wroff(connp
->conn_rq
, connp
,
2499 if (flags
& TH_ACK
) {
2501 * If we can't get the confirmation upstream, pretend
2502 * we didn't even see this one.
2504 * XXX: how can we pretend we didn't see it if we
2505 * have updated rnxt et. al.
2507 * For loopback we defer sending up the T_CONN_CON
2508 * until after some checks below.
2512 * tcp_sendmsg() checks tcp_state without entering
2513 * the squeue so tcp_state should be updated before
2514 * sending up connection confirmation. Probe the
2515 * state change below when we are sure the connection
2516 * confirmation has been sent.
2518 tcp
->tcp_state
= TCPS_ESTABLISHED
;
2519 if (!tcp_conn_con(tcp
, iphdr
, mp
,
2520 tcp
->tcp_loopback
? &mp1
: NULL
, ira
)) {
2521 tcp
->tcp_state
= TCPS_SYN_SENT
;
2525 TCPS_CONN_INC(tcps
);
2526 /* SYN was acked - making progress */
2527 tcp
->tcp_ip_forward_progress
= B_TRUE
;
2529 /* One for the SYN */
2530 tcp
->tcp_suna
= tcp
->tcp_iss
+ 1;
2531 tcp
->tcp_valid_bits
&= ~TCP_ISS_VALID
;
2534 * If SYN was retransmitted, need to reset all
2535 * retransmission info. This is because this
2536 * segment will be treated as a dup ACK.
2538 if (tcp
->tcp_rexmit
) {
2539 tcp
->tcp_rexmit
= B_FALSE
;
2540 tcp
->tcp_rexmit_nxt
= tcp
->tcp_snxt
;
2541 tcp
->tcp_rexmit_max
= tcp
->tcp_snxt
;
2542 tcp
->tcp_ms_we_have_waited
= 0;
2545 * Set tcp_cwnd back to 1 MSS, per
2546 * recommendation from
2547 * draft-floyd-incr-init-win-01.txt,
2548 * Increasing TCP's Initial Window.
2550 tcp
->tcp_cwnd
= tcp
->tcp_mss
;
2553 tcp
->tcp_swl1
= seg_seq
;
2554 tcp
->tcp_swl2
= seg_ack
;
2556 new_swnd
= ntohs(tcpha
->tha_win
);
2557 tcp
->tcp_swnd
= new_swnd
;
2558 if (new_swnd
> tcp
->tcp_max_swnd
)
2559 tcp
->tcp_max_swnd
= new_swnd
;
2562 * Always send the three-way handshake ack immediately
2563 * in order to make the connection complete as soon as
2564 * possible on the accepting host.
2566 flags
|= TH_ACK_NEEDED
;
2569 * Trace connect-established here.
2571 DTRACE_TCP5(connect__established
, mblk_t
*, NULL
,
2572 ip_xmit_attr_t
*, tcp
->tcp_connp
->conn_ixa
,
2573 void_ip_t
*, iphdr
, tcp_t
*, tcp
, tcph_t
*, tcpha
);
2575 /* Trace change from SYN_SENT -> ESTABLISHED here */
2576 DTRACE_TCP6(state__change
, void, NULL
, ip_xmit_attr_t
*,
2577 connp
->conn_ixa
, void, NULL
, tcp_t
*, tcp
,
2578 void, NULL
, int32_t, TCPS_SYN_SENT
);
2581 * Special case for loopback. At this point we have
2582 * received SYN-ACK from the remote endpoint. In
2583 * order to ensure that both endpoints reach the
2584 * fused state prior to any data exchange, the final
2585 * ACK needs to be sent before we indicate T_CONN_CON
2586 * to the module upstream.
2588 if (tcp
->tcp_loopback
) {
2591 ASSERT(!tcp
->tcp_unfusable
);
2592 ASSERT(mp1
!= NULL
);
2594 * For loopback, we always get a pure SYN-ACK
2595 * and only need to send back the final ACK
2596 * with no data (this is because the other
2597 * tcp is ours and we don't do T/TCP). This
2598 * final ACK triggers the passive side to
2599 * perform fusion in ESTABLISHED state.
2601 if ((ack_mp
= tcp_ack_mp(tcp
)) != NULL
) {
2602 if (tcp
->tcp_ack_tid
!= 0) {
2603 (void) TCP_TIMER_CANCEL(tcp
,
2605 tcp
->tcp_ack_tid
= 0;
2607 tcp_send_data(tcp
, ack_mp
);
2608 BUMP_LOCAL(tcp
->tcp_obsegs
);
2609 TCPS_BUMP_MIB(tcps
, tcpOutAck
);
2611 if (!IPCL_IS_NONSTR(connp
)) {
2612 /* Send up T_CONN_CON */
2613 if (ira
->ira_cred
!= NULL
) {
2618 putnext(connp
->conn_rq
, mp1
);
2620 (*sockupcalls
->su_connected
)
2621 (connp
->conn_upper_handle
,
2632 * Forget fusion; we need to handle more
2633 * complex cases below. Send the deferred
2634 * T_CONN_CON message upstream and proceed
2635 * as usual. Mark this tcp as not capable
2638 TCP_STAT(tcps
, tcp_fusion_unfusable
);
2639 tcp
->tcp_unfusable
= B_TRUE
;
2640 if (!IPCL_IS_NONSTR(connp
)) {
2641 if (ira
->ira_cred
!= NULL
) {
2642 mblk_setcred(mp1
, ira
->ira_cred
,
2645 putnext(connp
->conn_rq
, mp1
);
2647 (*sockupcalls
->su_connected
)
2648 (connp
->conn_upper_handle
,
2649 tcp
->tcp_connid
, ira
->ira_cred
,
2656 * Check to see if there is data to be sent. If
2657 * yes, set the transmit flag. Then check to see
2658 * if received data processing needs to be done.
2659 * If not, go straight to xmit_check. This short
2660 * cut is OK as we don't support T/TCP.
2662 if (tcp
->tcp_unsent
)
2663 flags
|= TH_XMIT_NEEDED
;
2665 if (seg_len
== 0 && !(flags
& TH_URG
)) {
2674 tcp
->tcp_state
= TCPS_SYN_RCVD
;
2675 DTRACE_TCP6(state__change
, void, NULL
, ip_xmit_attr_t
*,
2676 connp
->conn_ixa
, void_ip_t
*, NULL
, tcp_t
*, tcp
,
2677 tcph_t
*, NULL
, int32_t, TCPS_SYN_SENT
);
2678 mp1
= tcp_xmit_mp(tcp
, tcp
->tcp_xmit_head
, tcp
->tcp_mss
,
2679 NULL
, NULL
, tcp
->tcp_iss
, B_FALSE
, NULL
, B_FALSE
);
2681 tcp_send_data(tcp
, mp1
);
2682 TCP_TIMER_RESTART(tcp
, tcp
->tcp_rto
);
2687 if (flags
& TH_ACK
) {
2691 * In this state, a SYN|ACK packet is either bogus
2692 * because the other side must be ACKing our SYN which
2693 * indicates it has seen the ACK for their SYN and
2694 * shouldn't retransmit it or we're crossing SYNs
2697 if ((flags
& TH_SYN
) && !tcp
->tcp_active_open
) {
2699 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2700 tcp
, seg_ack
, 0, TH_RST
);
2704 * NOTE: RFC 793 pg. 72 says this should be
2705 * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2706 * but that would mean we have an ack that ignored
2709 if (SEQ_LEQ(seg_ack
, tcp
->tcp_suna
) ||
2710 SEQ_GT(seg_ack
, tcp
->tcp_snxt
)) {
2712 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2713 tcp
, seg_ack
, 0, TH_RST
);
2717 * No sane TCP stack will send such a small window
2718 * without receiving any data. Just drop this invalid
2719 * ACK. We also shorten the abort timeout in case
2720 * this is an attack.
2722 pinit_wnd
= ntohs(tcpha
->tha_win
) << tcp
->tcp_snd_ws
;
2723 if (pinit_wnd
< tcp
->tcp_mss
&&
2724 pinit_wnd
< tcp_init_wnd_chk
) {
2726 TCP_STAT(tcps
, tcp_zwin_ack_syn
);
2727 tcp
->tcp_second_ctimer_threshold
=
2728 tcp_early_abort
* SECONDS
;
2735 * Only a TLI listener can come through this path when a
2736 * acceptor is going back to be a listener and a packet
2737 * for the acceptor hits the classifier. For a socket
2738 * listener, this can never happen because a listener
2739 * can never accept connection on itself and hence a
2740 * socket acceptor can not go back to being a listener.
2742 ASSERT(!TCP_IS_SOCKET(tcp
));
2747 ip_stack_t
*ipst
= tcps
->tcps_netstack
->netstack_ip
;
2750 * Don't accept any input on a closed tcp as this TCP logically
2751 * does not exist on the system. Don't proceed further with
2752 * this TCP. For instance, this packet could trigger another
2753 * close of this tcp which would be disastrous for tcp_refcnt.
2754 * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2755 * be called at most once on a TCP. In this case we need to
2756 * refeed the packet into the classifier and figure out where
2757 * the packet should go.
2759 new_connp
= ipcl_classify(mp
, ira
, ipst
);
2760 if (new_connp
!= NULL
) {
2761 /* Drops ref on new_connp */
2762 tcp_reinput(new_connp
, mp
, ira
, ipst
);
2765 /* We failed to classify. For now just drop the packet */
2771 * Handle the case where the tcp_clean_death() has happened
2772 * on a connection (application hasn't closed yet) but a packet
2773 * was already queued on squeue before tcp_clean_death()
2774 * was processed. Calling tcp_clean_death() twice on same
2775 * connection can result in weird behaviour.
2784 * Already on the correct queue/perimeter.
2785 * If this is a detached connection and not an eager
2786 * connection hanging off a listener then new data
2787 * (past the FIN) will cause a reset.
2788 * We do a special check here where it
2789 * is out of the main line, rather than check
2790 * if we are detached every time we see new
2793 if (TCP_IS_DETACHED_NONEAGER(tcp
) &&
2794 (seg_len
> 0 && SEQ_GT(seg_seq
+ seg_len
, tcp
->tcp_rnxt
))) {
2795 TCPS_BUMP_MIB(tcps
, tcpInClosed
);
2796 DTRACE_PROBE2(tcp__trace__recv
, mblk_t
*, mp
, tcp_t
*, tcp
);
2798 tcp_xmit_ctl("new data when detached", tcp
,
2799 tcp
->tcp_snxt
, 0, TH_RST
);
2800 (void) tcp_clean_death(tcp
, EPROTO
);
2804 mp
->b_rptr
= (uchar_t
*)tcpha
+ TCP_HDR_LENGTH(tcpha
);
2805 urp
= ntohs(tcpha
->tha_urp
) - TCP_OLD_URP_INTERPRETATION
;
2806 new_swnd
= ntohs(tcpha
->tha_win
) <<
2807 ((tcpha
->tha_flags
& TH_SYN
) ? 0 : tcp
->tcp_snd_ws
);
2810 * We are interested in two TCP options: timestamps (if negotiated) and
2811 * SACK (if negotiated). Skip option parsing if neither is negotiated.
2813 if (tcp
->tcp_snd_ts_ok
|| tcp
->tcp_snd_sack_ok
) {
2815 if (tcp
->tcp_snd_sack_ok
)
2819 options
= tcp_parse_options(tcpha
, &tcpopt
);
2821 * RST segments must not be subject to PAWS and are not
2822 * required to have timestamps.
2823 * In addition, some TCP stacks (eg. Microsoft's) send
2824 * keepalive segments without timestamps even if timestamps are
2825 * negotiated on the connection. Keepalive segments are not
2826 * well-specified, but in practice they are ACK segments,
2827 * either empty or containing one garbage byte.
2829 boolean_t keepalive
= (flags
== TH_ACK
) && (seg_len
== 0 ||
2830 seg_len
== 1) && (seg_seq
+ 1 == tcp
->tcp_rnxt
);
2831 if (tcp
->tcp_snd_ts_ok
&& !(flags
& TH_RST
) && !keepalive
) {
2833 * Per RFC 7323 section 3.2., silently drop non-RST
2834 * segments without expected TSopt. This is a 'SHOULD'
2837 if (!(options
& TCP_OPT_TSTAMP_PRESENT
)) {
2839 * Leave a breadcrumb for people to detect this
2842 DTRACE_TCP1(droppedtimestamp
, tcp_t
*, tcp
);
2847 if (!tcp_paws_check(tcp
, &tcpopt
)) {
2849 * This segment is not acceptable.
2850 * Drop it and send back an ACK.
2853 flags
|= TH_ACK_NEEDED
;
2860 gap
= seg_seq
- tcp
->tcp_rnxt
;
2861 rgap
= tcp
->tcp_rwnd
- (gap
+ seg_len
);
2863 * gap is the amount of sequence space between what we expect to see
2864 * and what we got for seg_seq. A positive value for gap means
2865 * something got lost. A negative value means we got some old stuff.
2868 /* Old stuff present. Is the SYN in there? */
2869 if (seg_seq
== tcp
->tcp_irs
&& (flags
& TH_SYN
) &&
2874 /* Recompute the gaps after noting the SYN. */
2877 TCPS_BUMP_MIB(tcps
, tcpInDataDupSegs
);
2878 TCPS_UPDATE_MIB(tcps
, tcpInDataDupBytes
,
2879 (seg_len
> -gap
? -gap
: seg_len
));
2880 /* Remove the old stuff from seg_len. */
2884 * Make sure to check for unack'd FIN when rest of data
2885 * has been previously ack'd.
2887 if (seg_len
< 0 || (seg_len
== 0 && !(flags
& TH_FIN
))) {
2889 * Resets are only valid if they lie within our offered
2890 * window. If the RST bit is set, we just ignore this
2893 if (flags
& TH_RST
) {
2899 * The arriving of dup data packets indicate that we
2900 * may have postponed an ack for too long, or the other
2901 * side's RTT estimate is out of shape. Start acking
2904 if (SEQ_GEQ(seg_seq
+ seg_len
- gap
, tcp
->tcp_rack
) &&
2905 tcp
->tcp_rack_cnt
>= 1 &&
2906 tcp
->tcp_rack_abs_max
> 2) {
2907 tcp
->tcp_rack_abs_max
--;
2909 tcp
->tcp_rack_cur_max
= 1;
2912 * This segment is "unacceptable". None of its
2913 * sequence space lies within our advertized window.
2915 * Adjust seg_len to the original value for tracing.
2918 if (connp
->conn_debug
) {
2919 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
2920 "tcp_rput: unacceptable, gap %d, rgap %d, "
2921 "flags 0x%x, seg_seq %u, seg_ack %u, "
2922 "seg_len %d, rnxt %u, snxt %u, %s",
2923 gap
, rgap
, flags
, seg_seq
, seg_ack
,
2924 seg_len
, tcp
->tcp_rnxt
, tcp
->tcp_snxt
,
2925 tcp_display(tcp
, NULL
,
2926 DISP_ADDR_AND_PORT
));
2930 * Arrange to send an ACK in response to the
2931 * unacceptable segment per RFC 793 page 69. There
2932 * is only one small difference between ours and the
2933 * acceptability test in the RFC - we accept ACK-only
2934 * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
2935 * will be generated.
2937 * Note that we have to ACK an ACK-only packet at least
2938 * for stacks that send 0-length keep-alives with
2939 * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
2940 * section 4.2.3.6. As long as we don't ever generate
2941 * an unacceptable packet in response to an incoming
2942 * packet that is unacceptable, it should not cause
2945 flags
|= TH_ACK_NEEDED
;
2948 * Continue processing this segment in order to use the
2949 * ACK information it contains, but skip all other
2950 * sequence-number processing. Processing the ACK
2951 * information is necessary in order to
2952 * re-synchronize connections that may have lost
2955 * We clear seg_len and flag fields related to
2956 * sequence number processing as they are not
2957 * to be trusted for an unacceptable segment.
2960 flags
&= ~(TH_SYN
| TH_FIN
| TH_URG
);
2964 /* Fix seg_seq, and chew the gap off the front. */
2965 seg_seq
= tcp
->tcp_rnxt
;
2969 ASSERT((uintptr_t)(mp
->b_wptr
- mp
->b_rptr
) <=
2970 (uintptr_t)UINT_MAX
);
2971 gap
+= (uint_t
)(mp
->b_wptr
- mp
->b_rptr
);
2973 mp
->b_rptr
= mp
->b_wptr
- gap
;
2981 * If the urgent data has already been acknowledged, we
2982 * should ignore TH_URG below
2988 * rgap is the amount of stuff received out of window. A negative
2989 * value is the amount out of window.
2994 if (tcp
->tcp_rwnd
== 0) {
2995 TCPS_BUMP_MIB(tcps
, tcpInWinProbe
);
2997 TCPS_BUMP_MIB(tcps
, tcpInDataPastWinSegs
);
2998 TCPS_UPDATE_MIB(tcps
, tcpInDataPastWinBytes
, -rgap
);
3002 * seg_len does not include the FIN, so if more than
3003 * just the FIN is out of window, we act like we don't
3004 * see it. (If just the FIN is out of window, rgap
3005 * will be zero and we will go ahead and acknowledge
3010 /* Fix seg_len and make sure there is something left. */
3014 * Resets are only valid if they lie within our offered
3015 * window. If the RST bit is set, we just ignore this
3018 if (flags
& TH_RST
) {
3023 /* Per RFC 793, we need to send back an ACK. */
3024 flags
|= TH_ACK_NEEDED
;
3027 * Send SIGURG as soon as possible i.e. even
3028 * if the TH_URG was delivered in a window probe
3029 * packet (which will be unacceptable).
3031 * We generate a signal if none has been generated
3032 * for this connection or if this is a new urgent
3033 * byte. Also send a zero-length "unmarked" message
3034 * to inform SIOCATMARK that this is not the mark.
3036 * tcp_urp_last_valid is cleared when the T_exdata_ind
3037 * is sent up. This plus the check for old data
3038 * (gap >= 0) handles the wraparound of the sequence
3039 * number space without having to always track the
3040 * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3041 * this max in its rcv_up variable).
3043 * This prevents duplicate SIGURGS due to a "late"
3044 * zero-window probe when the T_EXDATA_IND has already
3047 if ((flags
& TH_URG
) &&
3048 (!tcp
->tcp_urp_last_valid
|| SEQ_GT(urp
+ seg_seq
,
3049 tcp
->tcp_urp_last
))) {
3050 if (IPCL_IS_NONSTR(connp
)) {
3051 if (!TCP_IS_DETACHED(tcp
)) {
3052 (*sockupcalls
->su_signal_oob
)
3053 (connp
->conn_upper_handle
,
3057 mp1
= allocb(0, BPRI_MED
);
3062 if (!TCP_IS_DETACHED(tcp
) &&
3063 !putnextctl1(connp
->conn_rq
,
3065 /* Try again on the rexmit. */
3071 * If the next byte would be the mark
3072 * then mark with MARKNEXT else mark
3075 if (gap
== 0 && urp
== 0)
3076 mp1
->b_flag
|= MSGMARKNEXT
;
3078 mp1
->b_flag
|= MSGNOTMARKNEXT
;
3079 freemsg(tcp
->tcp_urp_mark_mp
);
3080 tcp
->tcp_urp_mark_mp
= mp1
;
3081 flags
|= TH_SEND_URP_MARK
;
3083 tcp
->tcp_urp_last_valid
= B_TRUE
;
3084 tcp
->tcp_urp_last
= urp
+ seg_seq
;
3087 * If this is a zero window probe, continue to
3088 * process the ACK part. But we need to set seg_len
3089 * to 0 to avoid data processing. Otherwise just
3090 * drop the segment and send back an ACK.
3092 if (tcp
->tcp_rwnd
== 0 && seg_seq
== tcp
->tcp_rnxt
) {
3093 flags
&= ~(TH_SYN
| TH_URG
);
3101 /* Pitch out of window stuff off the end. */
3105 ASSERT((uintptr_t)(mp2
->b_wptr
- mp2
->b_rptr
) <=
3106 (uintptr_t)INT_MAX
);
3107 rgap
-= (int)(mp2
->b_wptr
- mp2
->b_rptr
);
3109 mp2
->b_wptr
+= rgap
;
3110 if ((mp1
= mp2
->b_cont
) != NULL
) {
3116 } while ((mp2
= mp2
->b_cont
) != NULL
);
3120 * TCP should check ECN info for segments inside the window only.
3121 * Therefore the check should be done here.
3123 if (tcp
->tcp_ecn_ok
) {
3124 if (flags
& TH_CWR
) {
3125 tcp
->tcp_ecn_echo_on
= B_FALSE
;
3128 * Note that both ECN_CE and CWR can be set in the
3129 * same segment. In this case, we once again turn
3132 if (connp
->conn_ipversion
== IPV4_VERSION
) {
3133 uchar_t tos
= ((ipha_t
*)rptr
)->ipha_type_of_service
;
3135 if ((tos
& IPH_ECN_CE
) == IPH_ECN_CE
) {
3136 tcp
->tcp_ecn_echo_on
= B_TRUE
;
3139 uint32_t vcf
= ((ip6_t
*)rptr
)->ip6_vcf
;
3141 if ((vcf
& htonl(IPH_ECN_CE
<< 20)) ==
3142 htonl(IPH_ECN_CE
<< 20)) {
3143 tcp
->tcp_ecn_echo_on
= B_TRUE
;
3149 * Check whether we can update tcp_ts_recent. This test is from RFC
3150 * 7323, section 5.3.
3152 if (tcp
->tcp_snd_ts_ok
&& !(flags
& TH_RST
) &&
3153 TSTMP_GEQ(tcpopt
.tcp_opt_ts_val
, tcp
->tcp_ts_recent
) &&
3154 SEQ_LEQ(seg_seq
, tcp
->tcp_rack
)) {
3155 tcp
->tcp_ts_recent
= tcpopt
.tcp_opt_ts_val
;
3156 tcp
->tcp_last_rcv_lbolt
= LBOLT_FASTPATH64
;
3159 if (seg_seq
!= tcp
->tcp_rnxt
|| tcp
->tcp_reass_head
) {
3161 * FIN in an out of order segment. We record this in
3162 * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3163 * Clear the FIN so that any check on FIN flag will fail.
3164 * Remember that FIN also counts in the sequence number
3165 * space. So we need to ack out of order FIN only segments.
3167 if (flags
& TH_FIN
) {
3168 tcp
->tcp_valid_bits
|= TCP_OFO_FIN_VALID
;
3169 tcp
->tcp_ofo_fin_seq
= seg_seq
+ seg_len
;
3171 flags
|= TH_ACK_NEEDED
;
3174 /* Fill in the SACK blk list. */
3175 if (tcp
->tcp_snd_sack_ok
) {
3176 tcp_sack_insert(tcp
->tcp_sack_list
,
3177 seg_seq
, seg_seq
+ seg_len
,
3178 &(tcp
->tcp_num_sack_blk
));
3182 * Attempt reassembly and see if we have something
3185 mp
= tcp_reass(tcp
, mp
, seg_seq
);
3186 /* Always ack out of order packets */
3187 flags
|= TH_ACK_NEEDED
| TH_PUSH
;
3189 ASSERT((uintptr_t)(mp
->b_wptr
- mp
->b_rptr
) <=
3190 (uintptr_t)INT_MAX
);
3191 seg_len
= mp
->b_cont
? msgdsize(mp
) :
3192 (int)(mp
->b_wptr
- mp
->b_rptr
);
3193 seg_seq
= tcp
->tcp_rnxt
;
3195 * A gap is filled and the seq num and len
3196 * of the gap match that of a previously
3197 * received FIN, put the FIN flag back in.
3199 if ((tcp
->tcp_valid_bits
& TCP_OFO_FIN_VALID
) &&
3200 seg_seq
+ seg_len
== tcp
->tcp_ofo_fin_seq
) {
3202 tcp
->tcp_valid_bits
&=
3205 if (tcp
->tcp_reass_tid
!= 0) {
3206 (void) TCP_TIMER_CANCEL(tcp
,
3207 tcp
->tcp_reass_tid
);
3209 * Restart the timer if there is still
3210 * data in the reassembly queue.
3212 if (tcp
->tcp_reass_head
!= NULL
) {
3213 tcp
->tcp_reass_tid
= TCP_TIMER(
3214 tcp
, tcp_reass_timer
,
3215 tcps
->tcps_reass_timeout
);
3217 tcp
->tcp_reass_tid
= 0;
3222 * Keep going even with NULL mp.
3223 * There may be a useful ACK or something else
3224 * we don't want to miss.
3226 * But TCP should not perform fast retransmit
3227 * because of the ack number. TCP uses
3228 * seg_len == 0 to determine if it is a pure
3229 * ACK. And this is not a pure ACK.
3234 if (tcps
->tcps_reass_timeout
!= 0 &&
3235 tcp
->tcp_reass_tid
== 0) {
3236 tcp
->tcp_reass_tid
= TCP_TIMER(tcp
,
3238 tcps
->tcps_reass_timeout
);
3242 } else if (seg_len
> 0) {
3243 TCPS_BUMP_MIB(tcps
, tcpInDataInorderSegs
);
3244 TCPS_UPDATE_MIB(tcps
, tcpInDataInorderBytes
, seg_len
);
3246 * If an out of order FIN was received before, and the seq
3247 * num and len of the new segment match that of the FIN,
3248 * put the FIN flag back in.
3250 if ((tcp
->tcp_valid_bits
& TCP_OFO_FIN_VALID
) &&
3251 seg_seq
+ seg_len
== tcp
->tcp_ofo_fin_seq
) {
3253 tcp
->tcp_valid_bits
&= ~TCP_OFO_FIN_VALID
;
3256 if ((flags
& (TH_RST
| TH_SYN
| TH_URG
| TH_ACK
)) != TH_ACK
) {
3257 if (flags
& TH_RST
) {
3259 switch (tcp
->tcp_state
) {
3261 (void) tcp_clean_death(tcp
, ECONNREFUSED
);
3263 case TCPS_ESTABLISHED
:
3264 case TCPS_FIN_WAIT_1
:
3265 case TCPS_FIN_WAIT_2
:
3266 case TCPS_CLOSE_WAIT
:
3267 (void) tcp_clean_death(tcp
, ECONNRESET
);
3271 (void) tcp_clean_death(tcp
, 0);
3274 ASSERT(tcp
->tcp_state
!= TCPS_TIME_WAIT
);
3275 (void) tcp_clean_death(tcp
, ENXIO
);
3280 if (flags
& TH_SYN
) {
3282 * See RFC 793, Page 71
3284 * The seq number must be in the window as it should
3285 * be "fixed" above. If it is outside window, it should
3286 * be already rejected. Note that we allow seg_seq to be
3287 * rnxt + rwnd because we want to accept 0 window probe.
3289 ASSERT(SEQ_GEQ(seg_seq
, tcp
->tcp_rnxt
) &&
3290 SEQ_LEQ(seg_seq
, tcp
->tcp_rnxt
+ tcp
->tcp_rwnd
));
3293 * If the ACK flag is not set, just use our snxt as the
3294 * seq number of the RST segment.
3296 if (!(flags
& TH_ACK
)) {
3297 seg_ack
= tcp
->tcp_snxt
;
3299 tcp_xmit_ctl("TH_SYN", tcp
, seg_ack
, seg_seq
+ 1,
3301 ASSERT(tcp
->tcp_state
!= TCPS_TIME_WAIT
);
3302 (void) tcp_clean_death(tcp
, ECONNRESET
);
3306 * urp could be -1 when the urp field in the packet is 0
3307 * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3308 * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3310 if (flags
& TH_URG
&& urp
>= 0) {
3311 if (!tcp
->tcp_urp_last_valid
||
3312 SEQ_GT(urp
+ seg_seq
, tcp
->tcp_urp_last
)) {
3314 * Non-STREAMS sockets handle the urgent data a litte
3315 * differently from STREAMS based sockets. There is no
3316 * need to mark any mblks with the MSG{NOT,}MARKNEXT
3317 * flags to keep SIOCATMARK happy. Instead a
3318 * su_signal_oob upcall is made to update the mark.
3319 * Neither is a T_EXDATA_IND mblk needed to be
3320 * prepended to the urgent data. The urgent data is
3321 * delivered using the su_recv upcall, where we set
3322 * the MSG_OOB flag to indicate that it is urg data.
3324 * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3325 * are used by non-STREAMS sockets.
3327 if (IPCL_IS_NONSTR(connp
)) {
3328 if (!TCP_IS_DETACHED(tcp
)) {
3329 (*sockupcalls
->su_signal_oob
)
3330 (connp
->conn_upper_handle
, urp
);
3334 * If we haven't generated the signal yet for
3335 * this urgent pointer value, do it now. Also,
3336 * send up a zero-length M_DATA indicating
3337 * whether or not this is the mark. The latter
3338 * is not needed when a T_EXDATA_IND is sent up.
3339 * However, if there are allocation failures
3340 * this code relies on the sender retransmitting
3341 * and the socket code for determining the mark
3342 * should not block waiting for the peer to
3343 * transmit. Thus, for simplicity we always
3344 * send up the mark indication.
3346 mp1
= allocb(0, BPRI_MED
);
3351 if (!TCP_IS_DETACHED(tcp
) &&
3352 !putnextctl1(connp
->conn_rq
, M_PCSIG
,
3354 /* Try again on the rexmit. */
3360 * Mark with NOTMARKNEXT for now.
3361 * The code below will change this to MARKNEXT
3362 * if we are at the mark.
3364 * If there are allocation failures (e.g. in
3365 * dupmsg below) the next time tcp_input_data
3366 * sees the urgent segment it will send up the
3367 * MSGMARKNEXT message.
3369 mp1
->b_flag
|= MSGNOTMARKNEXT
;
3370 freemsg(tcp
->tcp_urp_mark_mp
);
3371 tcp
->tcp_urp_mark_mp
= mp1
;
3372 flags
|= TH_SEND_URP_MARK
;
3374 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
3375 "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3377 seg_seq
, urp
, tcp
->tcp_urp_last
,
3378 tcp_display(tcp
, NULL
, DISP_PORT_ONLY
));
3381 tcp
->tcp_urp_last_valid
= B_TRUE
;
3382 tcp
->tcp_urp_last
= urp
+ seg_seq
;
3383 } else if (tcp
->tcp_urp_mark_mp
!= NULL
) {
3385 * An allocation failure prevented the previous
3386 * tcp_input_data from sending up the allocated
3387 * MSG*MARKNEXT message - send it up this time
3390 flags
|= TH_SEND_URP_MARK
;
3394 * If the urgent byte is in this segment, make sure that it is
3395 * all by itself. This makes it much easier to deal with the
3396 * possibility of an allocation failure on the T_exdata_ind.
3397 * Note that seg_len is the number of bytes in the segment, and
3398 * urp is the offset into the segment of the urgent byte.
3399 * urp < seg_len means that the urgent byte is in this segment.
3401 if (urp
< seg_len
) {
3405 * Break it up and feed it back in.
3406 * Re-attach the IP header.
3411 * There is stuff before the urgent
3417 * Trim from urgent byte on.
3418 * The rest will come back.
3422 tcp_input_data(connp
,
3426 (void) adjmsg(mp1
, urp
- seg_len
);
3427 /* Feed this piece back in. */
3428 tmp_rnxt
= tcp
->tcp_rnxt
;
3429 tcp_input_data(connp
, mp1
, NULL
, ira
);
3431 * If the data passed back in was not
3432 * processed (ie: bad ACK) sending
3433 * the remainder back in will cause a
3434 * loop. In this case, drop the
3435 * packet and let the sender try
3436 * sending a good packet.
3438 if (tmp_rnxt
== tcp
->tcp_rnxt
) {
3443 if (urp
!= seg_len
- 1) {
3446 * There is stuff after the urgent
3452 * Trim everything beyond the
3453 * urgent byte. The rest will
3458 tcp_input_data(connp
,
3462 (void) adjmsg(mp1
, urp
+ 1 - seg_len
);
3463 tmp_rnxt
= tcp
->tcp_rnxt
;
3464 tcp_input_data(connp
, mp1
, NULL
, ira
);
3466 * If the data passed back in was not
3467 * processed (ie: bad ACK) sending
3468 * the remainder back in will cause a
3469 * loop. In this case, drop the
3470 * packet and let the sender try
3471 * sending a good packet.
3473 if (tmp_rnxt
== tcp
->tcp_rnxt
) {
3478 tcp_input_data(connp
, mp
, NULL
, ira
);
3482 * This segment contains only the urgent byte. We
3483 * have to allocate the T_exdata_ind, if we can.
3485 if (IPCL_IS_NONSTR(connp
)) {
3488 (*sockupcalls
->su_recv
)
3489 (connp
->conn_upper_handle
, mp
, seg_len
,
3490 MSG_OOB
, &error
, NULL
);
3492 * We should never be in middle of a
3493 * fallback, the squeue guarantees that.
3495 ASSERT(error
!= EOPNOTSUPP
);
3498 } else if (!tcp
->tcp_urp_mp
) {
3499 struct T_exdata_ind
*tei
;
3500 mp1
= allocb(sizeof (struct T_exdata_ind
),
3504 * Sigh... It'll be back.
3505 * Generate any MSG*MARK message now.
3509 if (flags
& TH_SEND_URP_MARK
) {
3512 ASSERT(tcp
->tcp_urp_mark_mp
);
3513 tcp
->tcp_urp_mark_mp
->b_flag
&=
3515 tcp
->tcp_urp_mark_mp
->b_flag
|=
3520 mp1
->b_datap
->db_type
= M_PROTO
;
3521 tei
= (struct T_exdata_ind
*)mp1
->b_rptr
;
3522 tei
->PRIM_type
= T_EXDATA_IND
;
3524 mp1
->b_wptr
= (uchar_t
*)&tei
[1];
3525 tcp
->tcp_urp_mp
= mp1
;
3527 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
3528 "tcp_rput: allocated exdata_ind %s",
3529 tcp_display(tcp
, NULL
,
3533 * There is no need to send a separate MSG*MARK
3534 * message since the T_EXDATA_IND will be sent
3537 flags
&= ~TH_SEND_URP_MARK
;
3538 freemsg(tcp
->tcp_urp_mark_mp
);
3539 tcp
->tcp_urp_mark_mp
= NULL
;
3542 * Now we are all set. On the next putnext upstream,
3543 * tcp_urp_mp will be non-NULL and will get prepended
3544 * to what has to be this piece containing the urgent
3545 * byte. If for any reason we abort this segment below,
3546 * if it comes back, we will have this ready, or it
3547 * will get blown off in close.
3549 } else if (urp
== seg_len
) {
3551 * The urgent byte is the next byte after this sequence
3552 * number. If this endpoint is non-STREAMS, then there
3553 * is nothing to do here since the socket has already
3554 * been notified about the urg pointer by the
3555 * su_signal_oob call above.
3557 * In case of STREAMS, some more work might be needed.
3558 * If there is data it is marked with MSGMARKNEXT and
3559 * and any tcp_urp_mark_mp is discarded since it is not
3560 * needed. Otherwise, if the code above just allocated
3561 * a zero-length tcp_urp_mark_mp message, that message
3562 * is tagged with MSGMARKNEXT. Sending up these
3563 * MSGMARKNEXT messages makes SIOCATMARK work correctly
3564 * even though the T_EXDATA_IND will not be sent up
3565 * until the urgent byte arrives.
3567 if (!IPCL_IS_NONSTR(tcp
->tcp_connp
)) {
3569 flags
|= TH_MARKNEXT_NEEDED
;
3570 freemsg(tcp
->tcp_urp_mark_mp
);
3571 tcp
->tcp_urp_mark_mp
= NULL
;
3572 flags
&= ~TH_SEND_URP_MARK
;
3573 } else if (tcp
->tcp_urp_mark_mp
!= NULL
) {
3574 flags
|= TH_SEND_URP_MARK
;
3575 tcp
->tcp_urp_mark_mp
->b_flag
&=
3577 tcp
->tcp_urp_mark_mp
->b_flag
|=
3582 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
3583 "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3585 tcp_display(tcp
, NULL
, DISP_PORT_ONLY
));
3590 /* Data left until we hit mark */
3591 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
3592 "tcp_rput: URP %d bytes left, %s",
3593 urp
- seg_len
, tcp_display(tcp
, NULL
,
3600 if (!(flags
& TH_ACK
)) {
3605 bytes_acked
= (int)(seg_ack
- tcp
->tcp_suna
);
3607 if (bytes_acked
> 0)
3608 tcp
->tcp_ip_forward_progress
= B_TRUE
;
3609 if (tcp
->tcp_state
== TCPS_SYN_RCVD
) {
3611 * tcp_sendmsg() checks tcp_state without entering
3612 * the squeue so tcp_state should be updated before
3613 * sending up a connection confirmation or a new
3614 * connection indication.
3616 tcp
->tcp_state
= TCPS_ESTABLISHED
;
3619 * We are seeing the final ack in the three way
3620 * hand shake of a active open'ed connection
3621 * so we must send up a T_CONN_CON
3623 if (tcp
->tcp_active_open
) {
3624 if (!tcp_conn_con(tcp
, iphdr
, mp
, NULL
, ira
)) {
3626 tcp
->tcp_state
= TCPS_SYN_RCVD
;
3630 * Don't fuse the loopback endpoints for
3631 * simultaneous active opens.
3633 if (tcp
->tcp_loopback
) {
3634 TCP_STAT(tcps
, tcp_fusion_unfusable
);
3635 tcp
->tcp_unfusable
= B_TRUE
;
3638 * For simultaneous active open, trace receipt of final
3639 * ACK as tcp:::connect-established.
3641 DTRACE_TCP5(connect__established
, mblk_t
*, NULL
,
3642 ip_xmit_attr_t
*, connp
->conn_ixa
, void_ip_t
*,
3643 iphdr
, tcp_t
*, tcp
, tcph_t
*, tcpha
);
3644 } else if (IPCL_IS_NONSTR(connp
)) {
3646 * 3-way handshake has completed, so notify socket
3647 * of the new connection.
3649 * We are here means eager is fine but it can
3650 * get a TH_RST at any point between now and till
3651 * accept completes and disappear. We need to
3652 * ensure that reference to eager is valid after
3653 * we get out of eager's perimeter. So we do
3656 CONN_INC_REF(connp
);
3658 if (!tcp_newconn_notify(tcp
, ira
)) {
3660 * The state-change probe for SYN_RCVD ->
3661 * ESTABLISHED has not fired yet. We reset
3662 * the state to SYN_RCVD so that future
3663 * state-change probes report correct state
3666 tcp
->tcp_state
= TCPS_SYN_RCVD
;
3668 /* notification did not go up, so drop ref */
3669 CONN_DEC_REF(connp
);
3670 /* ... and close the eager */
3671 ASSERT(TCP_IS_DETACHED(tcp
));
3672 (void) tcp_close_detached(tcp
);
3676 * tcp_newconn_notify() changes conn_upcalls and
3677 * connp->conn_upper_handle. Fix things now, in case
3678 * there's data attached to this ack.
3680 if (connp
->conn_upcalls
!= NULL
)
3681 sockupcalls
= connp
->conn_upcalls
;
3683 * For passive open, trace receipt of final ACK as
3684 * tcp:::accept-established.
3686 DTRACE_TCP5(accept__established
, mlbk_t
*, NULL
,
3687 ip_xmit_attr_t
*, connp
->conn_ixa
, void_ip_t
*,
3688 iphdr
, tcp_t
*, tcp
, tcph_t
*, tcpha
);
3691 * 3-way handshake complete - this is a STREAMS based
3692 * socket, so pass up the T_CONN_IND.
3694 tcp_t
*listener
= tcp
->tcp_listener
;
3695 mblk_t
*mp
= tcp
->tcp_conn
.tcp_eager_conn_ind
;
3697 tcp
->tcp_tconnind_started
= B_TRUE
;
3698 tcp
->tcp_conn
.tcp_eager_conn_ind
= NULL
;
3701 * We are here means eager is fine but it can
3702 * get a TH_RST at any point between now and till
3703 * accept completes and disappear. We need to
3704 * ensure that reference to eager is valid after
3705 * we get out of eager's perimeter. So we do
3708 CONN_INC_REF(connp
);
3711 * The listener also exists because of the refhold
3712 * done in tcp_input_listener. Its possible that it
3713 * might have closed. We will check that once we
3714 * get inside listeners context.
3716 CONN_INC_REF(listener
->tcp_connp
);
3717 if (listener
->tcp_connp
->conn_sqp
==
3720 * We optimize by not calling an SQUEUE_ENTER
3721 * on the listener since we know that the
3722 * listener and eager squeues are the same.
3723 * We are able to make this check safely only
3724 * because neither the eager nor the listener
3725 * can change its squeue. Only an active connect
3726 * can change its squeue
3728 tcp_send_conn_ind(listener
->tcp_connp
, mp
,
3729 listener
->tcp_connp
->conn_sqp
);
3730 CONN_DEC_REF(listener
->tcp_connp
);
3731 } else if (!tcp
->tcp_loopback
) {
3732 SQUEUE_ENTER_ONE(listener
->tcp_connp
->conn_sqp
,
3733 mp
, tcp_send_conn_ind
,
3734 listener
->tcp_connp
, NULL
, SQ_FILL
,
3735 SQTAG_TCP_CONN_IND
);
3737 SQUEUE_ENTER_ONE(listener
->tcp_connp
->conn_sqp
,
3738 mp
, tcp_send_conn_ind
,
3739 listener
->tcp_connp
, NULL
, SQ_NODRAIN
,
3740 SQTAG_TCP_CONN_IND
);
3743 * For passive open, trace receipt of final ACK as
3744 * tcp:::accept-established.
3746 DTRACE_TCP5(accept__established
, mlbk_t
*, NULL
,
3747 ip_xmit_attr_t
*, connp
->conn_ixa
, void_ip_t
*,
3748 iphdr
, tcp_t
*, tcp
, tcph_t
*, tcpha
);
3750 TCPS_CONN_INC(tcps
);
3752 tcp
->tcp_suna
= tcp
->tcp_iss
+ 1; /* One for the SYN */
3754 /* SYN was acked - making progress */
3755 tcp
->tcp_ip_forward_progress
= B_TRUE
;
3758 * If SYN was retransmitted, need to reset all
3759 * retransmission info as this segment will be
3760 * treated as a dup ACK.
3762 if (tcp
->tcp_rexmit
) {
3763 tcp
->tcp_rexmit
= B_FALSE
;
3764 tcp
->tcp_rexmit_nxt
= tcp
->tcp_snxt
;
3765 tcp
->tcp_rexmit_max
= tcp
->tcp_snxt
;
3766 tcp
->tcp_ms_we_have_waited
= 0;
3767 tcp
->tcp_cwnd
= mss
;
3771 * We set the send window to zero here.
3772 * This is needed if there is data to be
3773 * processed already on the queue.
3774 * Later (at swnd_update label), the
3775 * "new_swnd > tcp_swnd" condition is satisfied
3776 * the XMIT_NEEDED flag is set in the current
3777 * (SYN_RCVD) state. This ensures tcp_wput_data() is
3778 * called if there is already data on queue in
3783 if (new_swnd
> tcp
->tcp_max_swnd
)
3784 tcp
->tcp_max_swnd
= new_swnd
;
3785 tcp
->tcp_swl1
= seg_seq
;
3786 tcp
->tcp_swl2
= seg_ack
;
3787 tcp
->tcp_valid_bits
&= ~TCP_ISS_VALID
;
3789 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3790 DTRACE_TCP6(state__change
, void, NULL
, ip_xmit_attr_t
*,
3791 connp
->conn_ixa
, void, NULL
, tcp_t
*, tcp
, void, NULL
,
3792 int32_t, TCPS_SYN_RCVD
);
3794 /* Fuse when both sides are in ESTABLISHED state */
3795 if (tcp
->tcp_loopback
&& do_tcp_fusion
)
3796 tcp_fuse(tcp
, iphdr
, tcpha
);
3799 /* This code follows 4.4BSD-Lite2 mostly. */
3800 if (bytes_acked
< 0)
3804 * If TCP is ECN capable and the congestion experience bit is
3805 * set, reduce tcp_cwnd and tcp_ssthresh. But this should only be
3806 * done once per window (or more loosely, per RTT).
3808 if (tcp
->tcp_cwr
&& SEQ_GT(seg_ack
, tcp
->tcp_cwr_snd_max
))
3809 tcp
->tcp_cwr
= B_FALSE
;
3810 if (tcp
->tcp_ecn_ok
&& (flags
& TH_ECE
)) {
3811 if (!tcp
->tcp_cwr
) {
3812 npkt
= ((tcp
->tcp_snxt
- tcp
->tcp_suna
) >> 1) / mss
;
3813 tcp
->tcp_cwnd_ssthresh
= MAX(npkt
, 2) * mss
;
3814 tcp
->tcp_cwnd
= npkt
* mss
;
3816 * If the cwnd is 0, use the timer to clock out
3817 * new segments. This is required by the ECN spec.
3820 TCP_TIMER_RESTART(tcp
, tcp
->tcp_rto
);
3822 * This makes sure that when the ACK comes
3823 * back, we will increase tcp_cwnd by 1 MSS.
3825 tcp
->tcp_cwnd_cnt
= 0;
3827 tcp
->tcp_cwr
= B_TRUE
;
3829 * This marks the end of the current window of in
3830 * flight data. That is why we don't use
3831 * tcp_suna + tcp_swnd. Only data in flight can
3834 tcp
->tcp_cwr_snd_max
= tcp
->tcp_snxt
;
3835 tcp
->tcp_ecn_cwr_sent
= B_FALSE
;
3839 mp1
= tcp
->tcp_xmit_head
;
3840 if (bytes_acked
== 0) {
3841 if (!ofo_seg
&& seg_len
== 0 && new_swnd
== tcp
->tcp_swnd
) {
3844 TCPS_BUMP_MIB(tcps
, tcpInDupAck
);
3846 * Fast retransmit. When we have seen exactly three
3847 * identical ACKs while we have unacked data
3848 * outstanding we take it as a hint that our peer
3849 * dropped something.
3851 * If TCP is retransmitting, don't do fast retransmit.
3853 if (mp1
&& tcp
->tcp_suna
!= tcp
->tcp_snxt
&&
3854 ! tcp
->tcp_rexmit
) {
3855 /* Do Limited Transmit */
3856 if ((dupack_cnt
= ++tcp
->tcp_dupack_cnt
) <
3857 tcps
->tcps_dupack_fast_retransmit
) {
3861 * What we need to do is temporarily
3862 * increase tcp_cwnd so that new
3863 * data can be sent if it is allowed
3864 * by the receive window (tcp_rwnd).
3865 * tcp_wput_data() will take care of
3868 * If the connection is SACK capable,
3869 * only do limited xmit when there
3872 * Note how tcp_cwnd is incremented.
3873 * The first dup ACK will increase
3874 * it by 1 MSS. The second dup ACK
3875 * will increase it by 2 MSS. This
3876 * means that only 1 new segment will
3877 * be sent for each dup ACK.
3879 if (tcp
->tcp_unsent
> 0 &&
3880 (!tcp
->tcp_snd_sack_ok
||
3881 (tcp
->tcp_snd_sack_ok
&&
3882 tcp
->tcp_notsack_list
!= NULL
))) {
3883 tcp
->tcp_cwnd
+= mss
<<
3884 (tcp
->tcp_dupack_cnt
- 1);
3885 flags
|= TH_LIMIT_XMIT
;
3887 } else if (dupack_cnt
==
3888 tcps
->tcps_dupack_fast_retransmit
) {
3891 * If we have reduced tcp_ssthresh
3892 * because of ECN, do not reduce it again
3893 * unless it is already one window of data
3894 * away. After one window of data, tcp_cwr
3895 * should then be cleared. Note that
3896 * for non ECN capable connection, tcp_cwr
3897 * should always be false.
3899 * Adjust cwnd since the duplicate
3900 * ack indicates that a packet was
3901 * dropped (due to congestion.)
3903 if (!tcp
->tcp_cwr
) {
3904 npkt
= ((tcp
->tcp_snxt
-
3905 tcp
->tcp_suna
) >> 1) / mss
;
3906 tcp
->tcp_cwnd_ssthresh
= MAX(npkt
, 2) *
3908 tcp
->tcp_cwnd
= (npkt
+
3909 tcp
->tcp_dupack_cnt
) * mss
;
3911 if (tcp
->tcp_ecn_ok
) {
3912 tcp
->tcp_cwr
= B_TRUE
;
3913 tcp
->tcp_cwr_snd_max
= tcp
->tcp_snxt
;
3914 tcp
->tcp_ecn_cwr_sent
= B_FALSE
;
3918 * We do Hoe's algorithm. Refer to her
3919 * paper "Improving the Start-up Behavior
3920 * of a Congestion Control Scheme for TCP,"
3921 * appeared in SIGCOMM'96.
3923 * Save highest seq no we have sent so far.
3924 * Be careful about the invisible FIN byte.
3926 if ((tcp
->tcp_valid_bits
& TCP_FSS_VALID
) &&
3927 (tcp
->tcp_unsent
== 0)) {
3928 tcp
->tcp_rexmit_max
= tcp
->tcp_fss
;
3930 tcp
->tcp_rexmit_max
= tcp
->tcp_snxt
;
3935 * Calculate tcp_pipe, which is the
3936 * estimated number of bytes in
3939 * tcp_fack is the highest sack'ed seq num
3942 * tcp_pipe is explained in the above quoted
3943 * Fall and Floyd's paper. tcp_fack is
3944 * explained in Mathis and Mahdavi's
3945 * "Forward Acknowledgment: Refining TCP
3946 * Congestion Control" in SIGCOMM '96.
3948 if (tcp
->tcp_snd_sack_ok
) {
3949 if (tcp
->tcp_notsack_list
!= NULL
) {
3950 tcp
->tcp_pipe
= tcp
->tcp_snxt
-
3952 tcp
->tcp_sack_snxt
= seg_ack
;
3953 flags
|= TH_NEED_SACK_REXMIT
;
3956 * Always initialize tcp_pipe
3957 * even though we don't have
3958 * any SACK info. If later
3959 * we get SACK info and
3960 * tcp_pipe is not initialized,
3961 * funny things will happen.
3964 tcp
->tcp_cwnd_ssthresh
;
3967 flags
|= TH_REXMIT_NEEDED
;
3968 } /* tcp_snd_sack_ok */
3972 * Here we perform congestion
3973 * avoidance, but NOT slow start.
3974 * This is known as the Fast
3975 * Recovery Algorithm.
3977 if (tcp
->tcp_snd_sack_ok
&&
3978 tcp
->tcp_notsack_list
!= NULL
) {
3979 flags
|= TH_NEED_SACK_REXMIT
;
3980 tcp
->tcp_pipe
-= mss
;
3981 if (tcp
->tcp_pipe
< 0)
3985 * We know that one more packet has
3986 * left the pipe thus we can update
3989 cwnd
= tcp
->tcp_cwnd
+ mss
;
3990 if (cwnd
> tcp
->tcp_cwnd_max
)
3991 cwnd
= tcp
->tcp_cwnd_max
;
3992 tcp
->tcp_cwnd
= cwnd
;
3993 if (tcp
->tcp_unsent
> 0)
3994 flags
|= TH_XMIT_NEEDED
;
3998 } else if (tcp
->tcp_zero_win_probe
) {
4000 * If the window has opened, need to arrange
4001 * to send additional data.
4003 if (new_swnd
!= 0) {
4004 /* tcp_suna != tcp_snxt */
4005 /* Packet contains a window update */
4006 TCPS_BUMP_MIB(tcps
, tcpInWinUpdate
);
4007 tcp
->tcp_zero_win_probe
= 0;
4008 tcp
->tcp_timer_backoff
= 0;
4009 tcp
->tcp_ms_we_have_waited
= 0;
4012 * Transmit starting with tcp_suna since
4013 * the one byte probe is not ack'ed.
4014 * If TCP has sent more than one identical
4015 * probe, tcp_rexmit will be set. That means
4016 * tcp_ss_rexmit() will send out the one
4017 * byte along with new data. Otherwise,
4018 * fake the retransmission.
4020 flags
|= TH_XMIT_NEEDED
;
4021 if (!tcp
->tcp_rexmit
) {
4022 tcp
->tcp_rexmit
= B_TRUE
;
4023 tcp
->tcp_dupack_cnt
= 0;
4024 tcp
->tcp_rexmit_nxt
= tcp
->tcp_suna
;
4025 tcp
->tcp_rexmit_max
= tcp
->tcp_suna
+ 1;
4033 * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4034 * If the ACK value acks something that we have not yet sent, it might
4035 * be an old duplicate segment. Send an ACK to re-synchronize the
4037 * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4038 * state is handled above, so we can always just drop the segment and
4041 * In the case where the peer shrinks the window, we see the new window
4042 * update, but all the data sent previously is queued up by the peer.
4043 * To account for this, in tcp_process_shrunk_swnd(), the sequence
4044 * number, which was already sent, and within window, is recorded.
4045 * tcp_snxt is then updated.
4047 * If the window has previously shrunk, and an ACK for data not yet
4048 * sent, according to tcp_snxt is recieved, it may still be valid. If
4049 * the ACK is for data within the window at the time the window was
4050 * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4051 * the sequence number ACK'ed.
4053 * If the ACK covers all the data sent at the time the window was
4054 * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4056 * Should we send ACKs in response to ACK only segments?
4059 if (SEQ_GT(seg_ack
, tcp
->tcp_snxt
)) {
4060 if ((tcp
->tcp_is_wnd_shrnk
) &&
4061 (SEQ_LEQ(seg_ack
, tcp
->tcp_snxt_shrunk
))) {
4062 uint32_t data_acked_ahead_snxt
;
4064 data_acked_ahead_snxt
= seg_ack
- tcp
->tcp_snxt
;
4065 tcp_update_xmit_tail(tcp
, seg_ack
);
4066 tcp
->tcp_unsent
-= data_acked_ahead_snxt
;
4068 TCPS_BUMP_MIB(tcps
, tcpInAckUnsent
);
4069 /* drop the received segment */
4073 * Send back an ACK. If tcp_drop_ack_unsent_cnt is
4074 * greater than 0, check if the number of such
4075 * bogus ACks is greater than that count. If yes,
4076 * don't send back any ACK. This prevents TCP from
4077 * getting into an ACK storm if somehow an attacker
4078 * successfully spoofs an acceptable segment to our
4079 * peer. If this continues (count > 2 X threshold),
4080 * we should abort this connection.
4082 if (tcp_drop_ack_unsent_cnt
> 0 &&
4083 ++tcp
->tcp_in_ack_unsent
>
4084 tcp_drop_ack_unsent_cnt
) {
4085 TCP_STAT(tcps
, tcp_in_ack_unsent_drop
);
4086 if (tcp
->tcp_in_ack_unsent
> 2 *
4087 tcp_drop_ack_unsent_cnt
) {
4088 (void) tcp_clean_death(tcp
, EPROTO
);
4092 mp
= tcp_ack_mp(tcp
);
4094 BUMP_LOCAL(tcp
->tcp_obsegs
);
4095 TCPS_BUMP_MIB(tcps
, tcpOutAck
);
4096 tcp_send_data(tcp
, mp
);
4100 } else if (tcp
->tcp_is_wnd_shrnk
&& SEQ_GEQ(seg_ack
,
4101 tcp
->tcp_snxt_shrunk
)) {
4102 tcp
->tcp_is_wnd_shrnk
= B_FALSE
;
4106 * TCP gets a new ACK, update the notsack'ed list to delete those
4107 * blocks that are covered by this ACK.
4109 if (tcp
->tcp_snd_sack_ok
&& tcp
->tcp_notsack_list
!= NULL
) {
4110 tcp_notsack_remove(&(tcp
->tcp_notsack_list
), seg_ack
,
4111 &(tcp
->tcp_num_notsack_blk
), &(tcp
->tcp_cnt_notsack_list
));
4115 * If we got an ACK after fast retransmit, check to see
4116 * if it is a partial ACK. If it is not and the congestion
4117 * window was inflated to account for the other side's
4118 * cached packets, retract it. If it is, do Hoe's algorithm.
4120 if (tcp
->tcp_dupack_cnt
>= tcps
->tcps_dupack_fast_retransmit
) {
4121 ASSERT(tcp
->tcp_rexmit
== B_FALSE
);
4122 if (SEQ_GEQ(seg_ack
, tcp
->tcp_rexmit_max
)) {
4123 tcp
->tcp_dupack_cnt
= 0;
4125 * Restore the orig tcp_cwnd_ssthresh after
4126 * fast retransmit phase.
4128 if (tcp
->tcp_cwnd
> tcp
->tcp_cwnd_ssthresh
) {
4129 tcp
->tcp_cwnd
= tcp
->tcp_cwnd_ssthresh
;
4131 tcp
->tcp_rexmit_max
= seg_ack
;
4132 tcp
->tcp_cwnd_cnt
= 0;
4135 * Remove all notsack info to avoid confusion with
4136 * the next fast retrasnmit/recovery phase.
4138 if (tcp
->tcp_snd_sack_ok
) {
4139 TCP_NOTSACK_REMOVE_ALL(tcp
->tcp_notsack_list
,
4143 if (tcp
->tcp_snd_sack_ok
&&
4144 tcp
->tcp_notsack_list
!= NULL
) {
4145 flags
|= TH_NEED_SACK_REXMIT
;
4146 tcp
->tcp_pipe
-= mss
;
4147 if (tcp
->tcp_pipe
< 0)
4153 * Retransmit the unack'ed segment and
4154 * restart fast recovery. Note that we
4155 * need to scale back tcp_cwnd to the
4156 * original value when we started fast
4157 * recovery. This is to prevent overly
4158 * aggressive behaviour in sending new
4161 tcp
->tcp_cwnd
= tcp
->tcp_cwnd_ssthresh
+
4162 tcps
->tcps_dupack_fast_retransmit
* mss
;
4163 tcp
->tcp_cwnd_cnt
= tcp
->tcp_cwnd
;
4164 flags
|= TH_REXMIT_NEEDED
;
4168 tcp
->tcp_dupack_cnt
= 0;
4169 if (tcp
->tcp_rexmit
) {
4171 * TCP is retranmitting. If the ACK ack's all
4172 * outstanding data, update tcp_rexmit_max and
4173 * tcp_rexmit_nxt. Otherwise, update tcp_rexmit_nxt
4174 * to the correct value.
4176 * Note that SEQ_LEQ() is used. This is to avoid
4177 * unnecessary fast retransmit caused by dup ACKs
4178 * received when TCP does slow start retransmission
4179 * after a time out. During this phase, TCP may
4180 * send out segments which are already received.
4181 * This causes dup ACKs to be sent back.
4183 if (SEQ_LEQ(seg_ack
, tcp
->tcp_rexmit_max
)) {
4184 if (SEQ_GT(seg_ack
, tcp
->tcp_rexmit_nxt
)) {
4185 tcp
->tcp_rexmit_nxt
= seg_ack
;
4187 if (seg_ack
!= tcp
->tcp_rexmit_max
) {
4188 flags
|= TH_XMIT_NEEDED
;
4191 tcp
->tcp_rexmit
= B_FALSE
;
4192 tcp
->tcp_rexmit_nxt
= tcp
->tcp_snxt
;
4194 tcp
->tcp_ms_we_have_waited
= 0;
4198 TCPS_BUMP_MIB(tcps
, tcpInAckSegs
);
4199 TCPS_UPDATE_MIB(tcps
, tcpInAckBytes
, bytes_acked
);
4200 tcp
->tcp_suna
= seg_ack
;
4201 if (tcp
->tcp_zero_win_probe
!= 0) {
4202 tcp
->tcp_zero_win_probe
= 0;
4203 tcp
->tcp_timer_backoff
= 0;
4207 * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4208 * Note that it cannot be the SYN being ack'ed. The code flow
4209 * will not reach here.
4216 * Update the congestion window.
4218 * If TCP is not ECN capable or TCP is ECN capable but the
4219 * congestion experience bit is not set, increase the tcp_cwnd as
4222 if (!tcp
->tcp_ecn_ok
|| !(flags
& TH_ECE
)) {
4223 cwnd
= tcp
->tcp_cwnd
;
4226 if (cwnd
>= tcp
->tcp_cwnd_ssthresh
) {
4228 * This is to prevent an increase of less than 1 MSS of
4229 * tcp_cwnd. With partial increase, tcp_wput_data()
4230 * may send out tinygrams in order to preserve mblk
4233 * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4234 * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4235 * increased by 1 MSS for every RTTs.
4237 if (tcp
->tcp_cwnd_cnt
<= 0) {
4238 tcp
->tcp_cwnd_cnt
= cwnd
+ add
;
4240 tcp
->tcp_cwnd_cnt
-= add
;
4244 tcp
->tcp_cwnd
= MIN(cwnd
+ add
, tcp
->tcp_cwnd_max
);
4247 /* See if the latest urgent data has been acknowledged */
4248 if ((tcp
->tcp_valid_bits
& TCP_URG_VALID
) &&
4249 SEQ_GT(seg_ack
, tcp
->tcp_urg
))
4250 tcp
->tcp_valid_bits
&= ~TCP_URG_VALID
;
4252 /* Can we update the RTT estimates? */
4253 if (tcp
->tcp_snd_ts_ok
&& tcpopt
.tcp_opt_ts_ecr
!= 0) {
4254 tcp_set_rto(tcp
, (int32_t)LBOLT_FASTPATH
-
4255 (int32_t)tcpopt
.tcp_opt_ts_ecr
);
4257 /* If needed, restart the timer. */
4258 if (tcp
->tcp_set_timer
== 1) {
4259 TCP_TIMER_RESTART(tcp
, tcp
->tcp_rto
);
4260 tcp
->tcp_set_timer
= 0;
4263 * Update tcp_csuna in case the other side stops sending
4266 tcp
->tcp_csuna
= tcp
->tcp_snxt
;
4267 } else if (SEQ_GT(seg_ack
, tcp
->tcp_csuna
)) {
4269 * An ACK sequence we haven't seen before, so get the RTT
4270 * and update the RTO. But first check if the timestamp is
4273 if ((mp1
->b_next
!= NULL
) &&
4274 SEQ_GT(seg_ack
, (uint32_t)(uintptr_t)(mp1
->b_next
)))
4275 tcp_set_rto(tcp
, (int32_t)LBOLT_FASTPATH
-
4276 (int32_t)(intptr_t)mp1
->b_prev
);
4278 TCPS_BUMP_MIB(tcps
, tcpRttNoUpdate
);
4280 /* Remeber the last sequence to be ACKed */
4281 tcp
->tcp_csuna
= seg_ack
;
4282 if (tcp
->tcp_set_timer
== 1) {
4283 TCP_TIMER_RESTART(tcp
, tcp
->tcp_rto
);
4284 tcp
->tcp_set_timer
= 0;
4287 TCPS_BUMP_MIB(tcps
, tcpRttNoUpdate
);
4290 /* Eat acknowledged bytes off the xmit queue. */
4296 ASSERT((uintptr_t)(wptr
- mp1
->b_rptr
) <= (uintptr_t)INT_MAX
);
4297 bytes_acked
-= (int)(wptr
- mp1
->b_rptr
);
4298 if (bytes_acked
< 0) {
4299 mp1
->b_rptr
= wptr
+ bytes_acked
;
4301 * Set a new timestamp if all the bytes timed by the
4302 * old timestamp have been ack'ed.
4305 (uint32_t)(uintptr_t)(mp1
->b_next
))) {
4307 (mblk_t
*)(uintptr_t)LBOLT_FASTPATH
;
4318 * This notification is required for some zero-copy
4319 * clients to maintain a copy semantic. After the data
4320 * is ack'ed, client is safe to modify or reuse the buffer.
4322 if (tcp
->tcp_snd_zcopy_aware
&&
4323 (mp2
->b_datap
->db_struioflag
& STRUIO_ZCNOTIFY
))
4324 tcp_zcopy_notify(tcp
);
4326 if (bytes_acked
== 0) {
4328 /* Everything is ack'ed, clear the tail. */
4329 tcp
->tcp_xmit_tail
= NULL
;
4331 * Cancel the timer unless we are still
4332 * waiting for an ACK for the FIN packet.
4334 if (tcp
->tcp_timer_tid
!= 0 &&
4335 tcp
->tcp_snxt
== tcp
->tcp_suna
) {
4336 (void) TCP_TIMER_CANCEL(tcp
,
4337 tcp
->tcp_timer_tid
);
4338 tcp
->tcp_timer_tid
= 0;
4340 goto pre_swnd_update
;
4342 if (mp2
!= tcp
->tcp_xmit_tail
)
4344 tcp
->tcp_xmit_tail
= mp1
;
4345 ASSERT((uintptr_t)(mp1
->b_wptr
- mp1
->b_rptr
) <=
4346 (uintptr_t)INT_MAX
);
4347 tcp
->tcp_xmit_tail_unsent
= (int)(mp1
->b_wptr
-
4353 * More was acked but there is nothing more
4354 * outstanding. This means that the FIN was
4355 * just acked or that we're talking to a clown.
4358 ASSERT(tcp
->tcp_fin_sent
);
4359 tcp
->tcp_xmit_tail
= NULL
;
4360 if (tcp
->tcp_fin_sent
) {
4361 /* FIN was acked - making progress */
4362 if (!tcp
->tcp_fin_acked
)
4363 tcp
->tcp_ip_forward_progress
= B_TRUE
;
4364 tcp
->tcp_fin_acked
= B_TRUE
;
4365 if (tcp
->tcp_linger_tid
!= 0 &&
4366 TCP_TIMER_CANCEL(tcp
,
4367 tcp
->tcp_linger_tid
) >= 0) {
4368 tcp_stop_lingering(tcp
);
4374 * We should never get here because
4375 * we have already checked that the
4376 * number of bytes ack'ed should be
4377 * smaller than or equal to what we
4378 * have sent so far (it is the
4379 * acceptability check of the ACK).
4380 * We can only get here if the send
4381 * queue is corrupted.
4383 * Terminate the connection and
4384 * panic the system. It is better
4385 * for us to panic instead of
4386 * continuing to avoid other disaster.
4388 tcp_xmit_ctl(NULL
, tcp
, tcp
->tcp_snxt
,
4389 tcp
->tcp_rnxt
, TH_RST
|TH_ACK
);
4390 panic("Memory corruption "
4391 "detected for connection %s.",
4392 tcp_display(tcp
, NULL
,
4393 DISP_ADDR_AND_PORT
));
4396 goto pre_swnd_update
;
4398 ASSERT(mp2
!= tcp
->tcp_xmit_tail
);
4400 if (tcp
->tcp_unsent
) {
4401 flags
|= TH_XMIT_NEEDED
;
4404 tcp
->tcp_xmit_head
= mp1
;
4407 * The following check is different from most other implementations.
4408 * For bi-directional transfer, when segments are dropped, the
4409 * "normal" check will not accept a window update in those
4410 * retransmitted segemnts. Failing to do that, TCP may send out
4411 * segments which are outside receiver's window. As TCP accepts
4412 * the ack in those retransmitted segments, if the window update in
4413 * the same segment is not accepted, TCP will incorrectly calculates
4414 * that it can send more segments. This can create a deadlock
4415 * with the receiver if its window becomes zero.
4417 if (SEQ_LT(tcp
->tcp_swl2
, seg_ack
) ||
4418 SEQ_LT(tcp
->tcp_swl1
, seg_seq
) ||
4419 (tcp
->tcp_swl1
== seg_seq
&& new_swnd
> tcp
->tcp_swnd
)) {
4421 * The criteria for update is:
4423 * 1. the segment acknowledges some data. Or
4424 * 2. the segment is new, i.e. it has a higher seq num. Or
4425 * 3. the segment is not old and the advertised window is
4426 * larger than the previous advertised window.
4428 if (tcp
->tcp_unsent
&& new_swnd
> tcp
->tcp_swnd
)
4429 flags
|= TH_XMIT_NEEDED
;
4430 tcp
->tcp_swnd
= new_swnd
;
4431 if (new_swnd
> tcp
->tcp_max_swnd
)
4432 tcp
->tcp_max_swnd
= new_swnd
;
4433 tcp
->tcp_swl1
= seg_seq
;
4434 tcp
->tcp_swl2
= seg_ack
;
4437 if (tcp
->tcp_state
> TCPS_ESTABLISHED
) {
4439 switch (tcp
->tcp_state
) {
4440 case TCPS_FIN_WAIT_1
:
4441 if (tcp
->tcp_fin_acked
) {
4442 tcp
->tcp_state
= TCPS_FIN_WAIT_2
;
4443 DTRACE_TCP6(state__change
, void, NULL
,
4444 ip_xmit_attr_t
*, connp
->conn_ixa
,
4445 void, NULL
, tcp_t
*, tcp
, void, NULL
,
4446 int32_t, TCPS_FIN_WAIT_1
);
4448 * We implement the non-standard BSD/SunOS
4449 * FIN_WAIT_2 flushing algorithm.
4450 * If there is no user attached to this
4451 * TCP endpoint, then this TCP struct
4452 * could hang around forever in FIN_WAIT_2
4453 * state if the peer forgets to send us
4454 * a FIN. To prevent this, we wait only
4455 * 2*MSL (a convenient time value) for
4456 * the FIN to arrive. If it doesn't show up,
4457 * we flush the TCP endpoint. This algorithm,
4458 * though a violation of RFC-793, has worked
4459 * for over 10 years in BSD systems.
4460 * Note: SunOS 4.x waits 675 seconds before
4461 * flushing the FIN_WAIT_2 connection.
4463 TCP_TIMER_RESTART(tcp
,
4464 tcp
->tcp_fin_wait_2_flush_interval
);
4467 case TCPS_FIN_WAIT_2
:
4468 break; /* Shutdown hook? */
4471 if (tcp
->tcp_fin_acked
) {
4472 (void) tcp_clean_death(tcp
, 0);
4477 if (tcp
->tcp_fin_acked
) {
4478 SET_TIME_WAIT(tcps
, tcp
, connp
);
4479 DTRACE_TCP6(state__change
, void, NULL
,
4480 ip_xmit_attr_t
*, connp
->conn_ixa
, void,
4481 NULL
, tcp_t
*, tcp
, void, NULL
, int32_t,
4485 case TCPS_CLOSE_WAIT
:
4489 ASSERT(tcp
->tcp_state
!= TCPS_TIME_WAIT
);
4493 if (flags
& TH_FIN
) {
4494 /* Make sure we ack the fin */
4495 flags
|= TH_ACK_NEEDED
;
4496 if (!tcp
->tcp_fin_rcvd
) {
4497 tcp
->tcp_fin_rcvd
= B_TRUE
;
4499 tcpha
= tcp
->tcp_tcpha
;
4500 tcpha
->tha_ack
= htonl(tcp
->tcp_rnxt
);
4503 * Generate the ordrel_ind at the end unless the
4504 * conn is detached or it is a STREAMS based eager.
4505 * In the eager case we defer the notification until
4506 * tcp_accept_finish has run.
4508 if (!TCP_IS_DETACHED(tcp
) && (IPCL_IS_NONSTR(connp
) ||
4509 (tcp
->tcp_listener
== NULL
&&
4510 !tcp
->tcp_hard_binding
)))
4511 flags
|= TH_ORDREL_NEEDED
;
4512 switch (tcp
->tcp_state
) {
4514 tcp
->tcp_state
= TCPS_CLOSE_WAIT
;
4515 DTRACE_TCP6(state__change
, void, NULL
,
4516 ip_xmit_attr_t
*, connp
->conn_ixa
,
4517 void, NULL
, tcp_t
*, tcp
, void, NULL
,
4518 int32_t, TCPS_SYN_RCVD
);
4521 case TCPS_ESTABLISHED
:
4522 tcp
->tcp_state
= TCPS_CLOSE_WAIT
;
4523 DTRACE_TCP6(state__change
, void, NULL
,
4524 ip_xmit_attr_t
*, connp
->conn_ixa
,
4525 void, NULL
, tcp_t
*, tcp
, void, NULL
,
4526 int32_t, TCPS_ESTABLISHED
);
4529 case TCPS_FIN_WAIT_1
:
4530 if (!tcp
->tcp_fin_acked
) {
4531 tcp
->tcp_state
= TCPS_CLOSING
;
4532 DTRACE_TCP6(state__change
, void, NULL
,
4533 ip_xmit_attr_t
*, connp
->conn_ixa
,
4534 void, NULL
, tcp_t
*, tcp
, void,
4535 NULL
, int32_t, TCPS_FIN_WAIT_1
);
4539 case TCPS_FIN_WAIT_2
:
4540 SET_TIME_WAIT(tcps
, tcp
, connp
);
4541 DTRACE_TCP6(state__change
, void, NULL
,
4542 ip_xmit_attr_t
*, connp
->conn_ixa
, void,
4543 NULL
, tcp_t
*, tcp
, void, NULL
, int32_t,
4547 * implies data piggybacked on FIN.
4548 * break to handle data.
4563 if (mp
->b_rptr
== mp
->b_wptr
) {
4565 * The header has been consumed, so we remove the
4566 * zero-length mblk here.
4573 tcpha
= tcp
->tcp_tcpha
;
4574 tcp
->tcp_rack_cnt
++;
4578 cur_max
= tcp
->tcp_rack_cur_max
;
4579 if (tcp
->tcp_rack_cnt
>= cur_max
) {
4581 * We have more unacked data than we should - send
4584 flags
|= TH_ACK_NEEDED
;
4586 if (cur_max
> tcp
->tcp_rack_abs_max
)
4587 tcp
->tcp_rack_cur_max
= tcp
->tcp_rack_abs_max
;
4589 tcp
->tcp_rack_cur_max
= cur_max
;
4590 } else if (TCP_IS_DETACHED(tcp
)) {
4591 /* We don't have an ACK timer for detached TCP. */
4592 flags
|= TH_ACK_NEEDED
;
4593 } else if (seg_len
< mss
) {
4595 * If we get a segment that is less than an mss, and we
4596 * already have unacknowledged data, and the amount
4597 * unacknowledged is not a multiple of mss, then we
4598 * better generate an ACK now. Otherwise, this may be
4599 * the tail piece of a transaction, and we would rather
4600 * wait for the response.
4603 ASSERT((uintptr_t)(tcp
->tcp_rnxt
- tcp
->tcp_rack
) <=
4604 (uintptr_t)INT_MAX
);
4605 udif
= (int)(tcp
->tcp_rnxt
- tcp
->tcp_rack
);
4606 if (udif
&& (udif
% mss
))
4607 flags
|= TH_ACK_NEEDED
;
4609 flags
|= TH_ACK_TIMER_NEEDED
;
4611 /* Start delayed ack timer */
4612 flags
|= TH_ACK_TIMER_NEEDED
;
4615 tcp
->tcp_rnxt
+= seg_len
;
4616 tcpha
->tha_ack
= htonl(tcp
->tcp_rnxt
);
4621 /* Update SACK list */
4622 if (tcp
->tcp_snd_sack_ok
&& tcp
->tcp_num_sack_blk
> 0) {
4623 tcp_sack_remove(tcp
->tcp_sack_list
, tcp
->tcp_rnxt
,
4624 &(tcp
->tcp_num_sack_blk
));
4627 if (tcp
->tcp_urp_mp
) {
4628 tcp
->tcp_urp_mp
->b_cont
= mp
;
4629 mp
= tcp
->tcp_urp_mp
;
4630 tcp
->tcp_urp_mp
= NULL
;
4631 /* Ready for a new signal. */
4632 tcp
->tcp_urp_last_valid
= B_FALSE
;
4634 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
4635 "tcp_rput: sending exdata_ind %s",
4636 tcp_display(tcp
, NULL
, DISP_PORT_ONLY
));
4641 * Check for ancillary data changes compared to last segment.
4643 if (connp
->conn_recv_ancillary
.crb_all
!= 0) {
4644 mp
= tcp_input_add_ancillary(tcp
, mp
, &ipp
, ira
);
4649 if (IPCL_IS_NONSTR(connp
)) {
4651 * Non-STREAMS socket
4653 boolean_t push
= flags
& (TH_PUSH
|TH_FIN
);
4656 if ((*sockupcalls
->su_recv
)(connp
->conn_upper_handle
,
4657 mp
, seg_len
, 0, &error
, &push
) <= 0) {
4659 * We should never be in middle of a
4660 * fallback, the squeue guarantees that.
4662 ASSERT(error
!= EOPNOTSUPP
);
4663 if (error
== ENOSPC
)
4664 tcp
->tcp_rwnd
-= seg_len
;
4666 /* PUSH bit set and sockfs is not flow controlled */
4667 flags
|= tcp_rwnd_reopen(tcp
);
4669 } else if (tcp
->tcp_listener
!= NULL
|| tcp
->tcp_hard_binding
) {
4671 * Side queue inbound data until the accept happens.
4672 * tcp_accept/tcp_rput drains this when the accept happens.
4673 * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4674 * T_EXDATA_IND) it is queued on b_next.
4675 * XXX Make urgent data use this. Requires:
4676 * Removing tcp_listener check for TH_URG
4677 * Making M_PCPROTO and MARK messages skip the eager case
4680 tcp_rcv_enqueue(tcp
, mp
, seg_len
, ira
->ira_cred
);
4682 /* Active STREAMS socket */
4683 if (mp
->b_datap
->db_type
!= M_DATA
||
4684 (flags
& TH_MARKNEXT_NEEDED
)) {
4685 if (tcp
->tcp_rcv_list
!= NULL
) {
4686 flags
|= tcp_rcv_drain(tcp
);
4688 ASSERT(tcp
->tcp_rcv_list
== NULL
||
4689 tcp
->tcp_fused_sigurg
);
4691 if (flags
& TH_MARKNEXT_NEEDED
) {
4693 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
4694 "tcp_rput: sending MSGMARKNEXT %s",
4695 tcp_display(tcp
, NULL
,
4698 mp
->b_flag
|= MSGMARKNEXT
;
4699 flags
&= ~TH_MARKNEXT_NEEDED
;
4702 putnext(connp
->conn_rq
, mp
);
4703 if (!canputnext(connp
->conn_rq
))
4704 tcp
->tcp_rwnd
-= seg_len
;
4705 } else if ((flags
& (TH_PUSH
|TH_FIN
)) ||
4706 tcp
->tcp_rcv_cnt
+ seg_len
>= connp
->conn_rcvbuf
>> 3) {
4707 if (tcp
->tcp_rcv_list
!= NULL
) {
4709 * Enqueue the new segment first and then
4710 * call tcp_rcv_drain() to send all data
4711 * up. The other way to do this is to
4712 * send all queued data up and then call
4713 * putnext() to send the new segment up.
4714 * This way can remove the else part later
4717 * We don't do this to avoid one more call to
4718 * canputnext() as tcp_rcv_drain() needs to
4719 * call canputnext().
4721 tcp_rcv_enqueue(tcp
, mp
, seg_len
,
4723 flags
|= tcp_rcv_drain(tcp
);
4725 putnext(connp
->conn_rq
, mp
);
4726 if (!canputnext(connp
->conn_rq
))
4727 tcp
->tcp_rwnd
-= seg_len
;
4731 * Enqueue all packets when processing an mblk
4732 * from the co queue and also enqueue normal packets.
4734 tcp_rcv_enqueue(tcp
, mp
, seg_len
, ira
->ira_cred
);
4737 * Make sure the timer is running if we have data waiting
4738 * for a push bit. This provides resiliency against
4739 * implementations that do not correctly generate push bits.
4741 if (tcp
->tcp_rcv_list
!= NULL
&& tcp
->tcp_push_tid
== 0) {
4743 * The connection may be closed at this point, so don't
4744 * do anything for a detached tcp.
4746 if (!TCP_IS_DETACHED(tcp
))
4747 tcp
->tcp_push_tid
= TCP_TIMER(tcp
,
4749 tcps
->tcps_push_timer_interval
);
4754 /* Is there anything left to do? */
4755 ASSERT(!(flags
& TH_MARKNEXT_NEEDED
));
4756 if ((flags
& (TH_REXMIT_NEEDED
|TH_XMIT_NEEDED
|TH_ACK_NEEDED
|
4757 TH_NEED_SACK_REXMIT
|TH_LIMIT_XMIT
|TH_ACK_TIMER_NEEDED
|
4758 TH_ORDREL_NEEDED
|TH_SEND_URP_MARK
)) == 0)
4761 /* Any transmit work to do and a non-zero window? */
4762 if ((flags
& (TH_REXMIT_NEEDED
|TH_XMIT_NEEDED
|TH_NEED_SACK_REXMIT
|
4763 TH_LIMIT_XMIT
)) && tcp
->tcp_swnd
!= 0) {
4764 if (flags
& TH_REXMIT_NEEDED
) {
4765 uint32_t snd_size
= tcp
->tcp_snxt
- tcp
->tcp_suna
;
4767 TCPS_BUMP_MIB(tcps
, tcpOutFastRetrans
);
4770 if (snd_size
> tcp
->tcp_swnd
)
4771 snd_size
= tcp
->tcp_swnd
;
4772 mp1
= tcp_xmit_mp(tcp
, tcp
->tcp_xmit_head
, snd_size
,
4773 NULL
, NULL
, tcp
->tcp_suna
, B_TRUE
, &snd_size
,
4777 tcp
->tcp_xmit_head
->b_prev
=
4778 (mblk_t
*)LBOLT_FASTPATH
;
4779 tcp
->tcp_csuna
= tcp
->tcp_snxt
;
4780 TCPS_BUMP_MIB(tcps
, tcpRetransSegs
);
4781 TCPS_UPDATE_MIB(tcps
, tcpRetransBytes
,
4783 tcp_send_data(tcp
, mp1
);
4786 if (flags
& TH_NEED_SACK_REXMIT
) {
4787 tcp_sack_rexmit(tcp
, &flags
);
4790 * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4791 * out new segment. Note that tcp_rexmit should not be
4792 * set, otherwise TH_LIMIT_XMIT should not be set.
4794 if (flags
& (TH_XMIT_NEEDED
|TH_LIMIT_XMIT
)) {
4795 if (!tcp
->tcp_rexmit
) {
4796 tcp_wput_data(tcp
, NULL
, B_FALSE
);
4802 * Adjust tcp_cwnd back to normal value after sending
4803 * new data segments.
4805 if (flags
& TH_LIMIT_XMIT
) {
4806 tcp
->tcp_cwnd
-= mss
<< (tcp
->tcp_dupack_cnt
- 1);
4808 * This will restart the timer. Restarting the
4809 * timer is used to avoid a timeout before the
4810 * limited transmitted segment's ACK gets back.
4812 if (tcp
->tcp_xmit_head
!= NULL
)
4813 tcp
->tcp_xmit_head
->b_prev
=
4814 (mblk_t
*)LBOLT_FASTPATH
;
4817 /* Anything more to do? */
4818 if ((flags
& (TH_ACK_NEEDED
|TH_ACK_TIMER_NEEDED
|
4819 TH_ORDREL_NEEDED
|TH_SEND_URP_MARK
)) == 0)
4823 if (flags
& TH_SEND_URP_MARK
) {
4824 ASSERT(tcp
->tcp_urp_mark_mp
);
4825 ASSERT(!IPCL_IS_NONSTR(connp
));
4827 * Send up any queued data and then send the mark message
4829 if (tcp
->tcp_rcv_list
!= NULL
) {
4830 flags
|= tcp_rcv_drain(tcp
);
4833 ASSERT(tcp
->tcp_rcv_list
== NULL
|| tcp
->tcp_fused_sigurg
);
4834 mp1
= tcp
->tcp_urp_mark_mp
;
4835 tcp
->tcp_urp_mark_mp
= NULL
;
4837 putnext(connp
->conn_rq
, mp1
);
4839 (void) strlog(TCP_MOD_ID
, 0, 1, SL_TRACE
,
4840 "tcp_rput: sending zero-length %s %s",
4841 ((mp1
->b_flag
& MSGMARKNEXT
) ? "MSGMARKNEXT" :
4843 tcp_display(tcp
, NULL
, DISP_PORT_ONLY
));
4845 flags
&= ~TH_SEND_URP_MARK
;
4847 if (flags
& TH_ACK_NEEDED
) {
4849 * Time to send an ack for some reason.
4851 mp1
= tcp_ack_mp(tcp
);
4854 tcp_send_data(tcp
, mp1
);
4855 BUMP_LOCAL(tcp
->tcp_obsegs
);
4856 TCPS_BUMP_MIB(tcps
, tcpOutAck
);
4858 if (tcp
->tcp_ack_tid
!= 0) {
4859 (void) TCP_TIMER_CANCEL(tcp
, tcp
->tcp_ack_tid
);
4860 tcp
->tcp_ack_tid
= 0;
4863 if (flags
& TH_ACK_TIMER_NEEDED
) {
4865 * Arrange for deferred ACK or push wait timeout.
4866 * Start timer if it is not already running.
4868 if (tcp
->tcp_ack_tid
== 0) {
4869 tcp
->tcp_ack_tid
= TCP_TIMER(tcp
, tcp_ack_timer
,
4871 tcps
->tcps_local_dack_interval
:
4872 tcps
->tcps_deferred_ack_interval
);
4875 if (flags
& TH_ORDREL_NEEDED
) {
4877 * Notify upper layer about an orderly release. If this is
4878 * a non-STREAMS socket, then just make an upcall. For STREAMS
4879 * we send up an ordrel_ind, unless this is an eager, in which
4880 * case the ordrel will be sent when tcp_accept_finish runs.
4881 * Note that for non-STREAMS we make an upcall even if it is an
4882 * eager, because we have an upper handle to send it to.
4884 ASSERT(IPCL_IS_NONSTR(connp
) || tcp
->tcp_listener
== NULL
);
4885 ASSERT(!tcp
->tcp_detached
);
4887 if (IPCL_IS_NONSTR(connp
)) {
4888 ASSERT(tcp
->tcp_ordrel_mp
== NULL
);
4889 tcp
->tcp_ordrel_done
= B_TRUE
;
4890 (*sockupcalls
->su_opctl
)(connp
->conn_upper_handle
,
4891 SOCK_OPCTL_SHUT_RECV
, 0);
4895 if (tcp
->tcp_rcv_list
!= NULL
) {
4897 * Push any mblk(s) enqueued from co processing.
4899 flags
|= tcp_rcv_drain(tcp
);
4901 ASSERT(tcp
->tcp_rcv_list
== NULL
|| tcp
->tcp_fused_sigurg
);
4903 mp1
= tcp
->tcp_ordrel_mp
;
4904 tcp
->tcp_ordrel_mp
= NULL
;
4905 tcp
->tcp_ordrel_done
= B_TRUE
;
4906 putnext(connp
->conn_rq
, mp1
);
4909 ASSERT(!(flags
& TH_MARKNEXT_NEEDED
));
4913 * Attach ancillary data to a received TCP segments for the
4914 * ancillary pieces requested by the application that are
4915 * different than they were in the previous data segment.
4917 * Save the "current" values once memory allocation is ok so that
4918 * when memory allocation fails we can just wait for the next data segment.
4921 tcp_input_add_ancillary(tcp_t
*tcp
, mblk_t
*mp
, ip_pkt_t
*ipp
,
4922 ip_recv_attr_t
*ira
)
4924 struct T_optdata_ind
*todi
;
4927 struct T_opthdr
*toh
;
4928 crb_t addflag
; /* Which pieces to add */
4930 conn_t
*connp
= tcp
->tcp_connp
;
4933 addflag
.crb_all
= 0;
4934 /* If app asked for pktinfo and the index has changed ... */
4935 if (connp
->conn_recv_ancillary
.crb_ip_recvpktinfo
&&
4936 ira
->ira_ruifindex
!= tcp
->tcp_recvifindex
) {
4937 optlen
+= sizeof (struct T_opthdr
) +
4938 sizeof (struct in6_pktinfo
);
4939 addflag
.crb_ip_recvpktinfo
= 1;
4941 /* If app asked for hoplimit and it has changed ... */
4942 if (connp
->conn_recv_ancillary
.crb_ipv6_recvhoplimit
&&
4943 ipp
->ipp_hoplimit
!= tcp
->tcp_recvhops
) {
4944 optlen
+= sizeof (struct T_opthdr
) + sizeof (uint_t
);
4945 addflag
.crb_ipv6_recvhoplimit
= 1;
4947 /* If app asked for tclass and it has changed ... */
4948 if (connp
->conn_recv_ancillary
.crb_ipv6_recvtclass
&&
4949 ipp
->ipp_tclass
!= tcp
->tcp_recvtclass
) {
4950 optlen
+= sizeof (struct T_opthdr
) + sizeof (uint_t
);
4951 addflag
.crb_ipv6_recvtclass
= 1;
4954 * If app asked for hopbyhop headers and it has changed ...
4956 if (connp
->conn_recv_ancillary
.crb_ipv6_recvhopopts
&&
4957 ip_cmpbuf(tcp
->tcp_hopopts
, tcp
->tcp_hopoptslen
,
4958 (ipp
->ipp_fields
& IPPF_HOPOPTS
),
4959 ipp
->ipp_hopopts
, ipp
->ipp_hopoptslen
)) {
4960 optlen
+= sizeof (struct T_opthdr
) + ipp
->ipp_hopoptslen
;
4961 addflag
.crb_ipv6_recvhopopts
= 1;
4962 if (!ip_allocbuf((void **)&tcp
->tcp_hopopts
,
4963 &tcp
->tcp_hopoptslen
, (ipp
->ipp_fields
& IPPF_HOPOPTS
),
4964 ipp
->ipp_hopopts
, ipp
->ipp_hopoptslen
))
4967 /* If app asked for dst headers before routing headers ... */
4968 if (connp
->conn_recv_ancillary
.crb_ipv6_recvrthdrdstopts
&&
4969 ip_cmpbuf(tcp
->tcp_rthdrdstopts
, tcp
->tcp_rthdrdstoptslen
,
4970 (ipp
->ipp_fields
& IPPF_RTHDRDSTOPTS
),
4971 ipp
->ipp_rthdrdstopts
, ipp
->ipp_rthdrdstoptslen
)) {
4972 optlen
+= sizeof (struct T_opthdr
) +
4973 ipp
->ipp_rthdrdstoptslen
;
4974 addflag
.crb_ipv6_recvrthdrdstopts
= 1;
4975 if (!ip_allocbuf((void **)&tcp
->tcp_rthdrdstopts
,
4976 &tcp
->tcp_rthdrdstoptslen
,
4977 (ipp
->ipp_fields
& IPPF_RTHDRDSTOPTS
),
4978 ipp
->ipp_rthdrdstopts
, ipp
->ipp_rthdrdstoptslen
))
4981 /* If app asked for routing headers and it has changed ... */
4982 if (connp
->conn_recv_ancillary
.crb_ipv6_recvrthdr
&&
4983 ip_cmpbuf(tcp
->tcp_rthdr
, tcp
->tcp_rthdrlen
,
4984 (ipp
->ipp_fields
& IPPF_RTHDR
),
4985 ipp
->ipp_rthdr
, ipp
->ipp_rthdrlen
)) {
4986 optlen
+= sizeof (struct T_opthdr
) + ipp
->ipp_rthdrlen
;
4987 addflag
.crb_ipv6_recvrthdr
= 1;
4988 if (!ip_allocbuf((void **)&tcp
->tcp_rthdr
,
4989 &tcp
->tcp_rthdrlen
, (ipp
->ipp_fields
& IPPF_RTHDR
),
4990 ipp
->ipp_rthdr
, ipp
->ipp_rthdrlen
))
4993 /* If app asked for dest headers and it has changed ... */
4994 if ((connp
->conn_recv_ancillary
.crb_ipv6_recvdstopts
||
4995 connp
->conn_recv_ancillary
.crb_old_ipv6_recvdstopts
) &&
4996 ip_cmpbuf(tcp
->tcp_dstopts
, tcp
->tcp_dstoptslen
,
4997 (ipp
->ipp_fields
& IPPF_DSTOPTS
),
4998 ipp
->ipp_dstopts
, ipp
->ipp_dstoptslen
)) {
4999 optlen
+= sizeof (struct T_opthdr
) + ipp
->ipp_dstoptslen
;
5000 addflag
.crb_ipv6_recvdstopts
= 1;
5001 if (!ip_allocbuf((void **)&tcp
->tcp_dstopts
,
5002 &tcp
->tcp_dstoptslen
, (ipp
->ipp_fields
& IPPF_DSTOPTS
),
5003 ipp
->ipp_dstopts
, ipp
->ipp_dstoptslen
))
5008 /* Nothing to add */
5011 mp1
= allocb(sizeof (struct T_optdata_ind
) + optlen
, BPRI_MED
);
5014 * Defer sending ancillary data until the next TCP segment
5021 mp
->b_wptr
+= sizeof (*todi
) + optlen
;
5022 mp
->b_datap
->db_type
= M_PROTO
;
5023 todi
= (struct T_optdata_ind
*)mp
->b_rptr
;
5024 todi
->PRIM_type
= T_OPTDATA_IND
;
5025 todi
->DATA_flag
= 1; /* MORE data */
5026 todi
->OPT_length
= optlen
;
5027 todi
->OPT_offset
= sizeof (*todi
);
5028 optptr
= (uchar_t
*)&todi
[1];
5030 * If app asked for pktinfo and the index has changed ...
5031 * Note that the local address never changes for the connection.
5033 if (addflag
.crb_ip_recvpktinfo
) {
5034 struct in6_pktinfo
*pkti
;
5037 ifindex
= ira
->ira_ruifindex
;
5038 toh
= (struct T_opthdr
*)optptr
;
5039 toh
->level
= IPPROTO_IPV6
;
5040 toh
->name
= IPV6_PKTINFO
;
5041 toh
->len
= sizeof (*toh
) + sizeof (*pkti
);
5043 optptr
+= sizeof (*toh
);
5044 pkti
= (struct in6_pktinfo
*)optptr
;
5045 pkti
->ipi6_addr
= connp
->conn_laddr_v6
;
5046 pkti
->ipi6_ifindex
= ifindex
;
5047 optptr
+= sizeof (*pkti
);
5048 ASSERT(OK_32PTR(optptr
));
5049 /* Save as "last" value */
5050 tcp
->tcp_recvifindex
= ifindex
;
5052 /* If app asked for hoplimit and it has changed ... */
5053 if (addflag
.crb_ipv6_recvhoplimit
) {
5054 toh
= (struct T_opthdr
*)optptr
;
5055 toh
->level
= IPPROTO_IPV6
;
5056 toh
->name
= IPV6_HOPLIMIT
;
5057 toh
->len
= sizeof (*toh
) + sizeof (uint_t
);
5059 optptr
+= sizeof (*toh
);
5060 *(uint_t
*)optptr
= ipp
->ipp_hoplimit
;
5061 optptr
+= sizeof (uint_t
);
5062 ASSERT(OK_32PTR(optptr
));
5063 /* Save as "last" value */
5064 tcp
->tcp_recvhops
= ipp
->ipp_hoplimit
;
5066 /* If app asked for tclass and it has changed ... */
5067 if (addflag
.crb_ipv6_recvtclass
) {
5068 toh
= (struct T_opthdr
*)optptr
;
5069 toh
->level
= IPPROTO_IPV6
;
5070 toh
->name
= IPV6_TCLASS
;
5071 toh
->len
= sizeof (*toh
) + sizeof (uint_t
);
5073 optptr
+= sizeof (*toh
);
5074 *(uint_t
*)optptr
= ipp
->ipp_tclass
;
5075 optptr
+= sizeof (uint_t
);
5076 ASSERT(OK_32PTR(optptr
));
5077 /* Save as "last" value */
5078 tcp
->tcp_recvtclass
= ipp
->ipp_tclass
;
5080 if (addflag
.crb_ipv6_recvhopopts
) {
5081 toh
= (struct T_opthdr
*)optptr
;
5082 toh
->level
= IPPROTO_IPV6
;
5083 toh
->name
= IPV6_HOPOPTS
;
5084 toh
->len
= sizeof (*toh
) + ipp
->ipp_hopoptslen
;
5086 optptr
+= sizeof (*toh
);
5087 bcopy((uchar_t
*)ipp
->ipp_hopopts
, optptr
, ipp
->ipp_hopoptslen
);
5088 optptr
+= ipp
->ipp_hopoptslen
;
5089 ASSERT(OK_32PTR(optptr
));
5090 /* Save as last value */
5091 ip_savebuf((void **)&tcp
->tcp_hopopts
, &tcp
->tcp_hopoptslen
,
5092 (ipp
->ipp_fields
& IPPF_HOPOPTS
),
5093 ipp
->ipp_hopopts
, ipp
->ipp_hopoptslen
);
5095 if (addflag
.crb_ipv6_recvrthdrdstopts
) {
5096 toh
= (struct T_opthdr
*)optptr
;
5097 toh
->level
= IPPROTO_IPV6
;
5098 toh
->name
= IPV6_RTHDRDSTOPTS
;
5099 toh
->len
= sizeof (*toh
) + ipp
->ipp_rthdrdstoptslen
;
5101 optptr
+= sizeof (*toh
);
5102 bcopy(ipp
->ipp_rthdrdstopts
, optptr
, ipp
->ipp_rthdrdstoptslen
);
5103 optptr
+= ipp
->ipp_rthdrdstoptslen
;
5104 ASSERT(OK_32PTR(optptr
));
5105 /* Save as last value */
5106 ip_savebuf((void **)&tcp
->tcp_rthdrdstopts
,
5107 &tcp
->tcp_rthdrdstoptslen
,
5108 (ipp
->ipp_fields
& IPPF_RTHDRDSTOPTS
),
5109 ipp
->ipp_rthdrdstopts
, ipp
->ipp_rthdrdstoptslen
);
5111 if (addflag
.crb_ipv6_recvrthdr
) {
5112 toh
= (struct T_opthdr
*)optptr
;
5113 toh
->level
= IPPROTO_IPV6
;
5114 toh
->name
= IPV6_RTHDR
;
5115 toh
->len
= sizeof (*toh
) + ipp
->ipp_rthdrlen
;
5117 optptr
+= sizeof (*toh
);
5118 bcopy(ipp
->ipp_rthdr
, optptr
, ipp
->ipp_rthdrlen
);
5119 optptr
+= ipp
->ipp_rthdrlen
;
5120 ASSERT(OK_32PTR(optptr
));
5121 /* Save as last value */
5122 ip_savebuf((void **)&tcp
->tcp_rthdr
, &tcp
->tcp_rthdrlen
,
5123 (ipp
->ipp_fields
& IPPF_RTHDR
),
5124 ipp
->ipp_rthdr
, ipp
->ipp_rthdrlen
);
5126 if (addflag
.crb_ipv6_recvdstopts
) {
5127 toh
= (struct T_opthdr
*)optptr
;
5128 toh
->level
= IPPROTO_IPV6
;
5129 toh
->name
= IPV6_DSTOPTS
;
5130 toh
->len
= sizeof (*toh
) + ipp
->ipp_dstoptslen
;
5132 optptr
+= sizeof (*toh
);
5133 bcopy(ipp
->ipp_dstopts
, optptr
, ipp
->ipp_dstoptslen
);
5134 optptr
+= ipp
->ipp_dstoptslen
;
5135 ASSERT(OK_32PTR(optptr
));
5136 /* Save as last value */
5137 ip_savebuf((void **)&tcp
->tcp_dstopts
, &tcp
->tcp_dstoptslen
,
5138 (ipp
->ipp_fields
& IPPF_DSTOPTS
),
5139 ipp
->ipp_dstopts
, ipp
->ipp_dstoptslen
);
5141 ASSERT(optptr
== mp
->b_wptr
);
5145 /* The minimum of smoothed mean deviation in RTO calculation. */
5146 #define TCP_SD_MIN 400
5149 * Set RTO for this connection. The formula is from Jacobson and Karels'
5150 * "Congestion Avoidance and Control" in SIGCOMM '88. The variable names
5151 * are the same as those in Appendix A.2 of that paper.
5153 * m = new measurement
5154 * sa = smoothed RTT average (8 * average estimates).
5155 * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5158 tcp_set_rto(tcp_t
*tcp
, clock_t rtt
)
5160 long m
= TICK_TO_MSEC(rtt
);
5161 clock_t sa
= tcp
->tcp_rtt_sa
;
5162 clock_t sv
= tcp
->tcp_rtt_sd
;
5164 tcp_stack_t
*tcps
= tcp
->tcp_tcps
;
5166 TCPS_BUMP_MIB(tcps
, tcpRttUpdate
);
5167 tcp
->tcp_rtt_update
++;
5169 /* tcp_rtt_sa is not 0 means this is a new sample. */
5172 * Update average estimator:
5173 * new rtt = 7/8 old rtt + 1/8 Error
5176 /* m is now Error in estimate. */
5178 if ((sa
+= m
) <= 0) {
5180 * Don't allow the smoothed average to be negative.
5181 * We use 0 to denote reinitialization of the
5188 * Update deviation estimator:
5189 * new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5197 * This follows BSD's implementation. So the reinitialized
5198 * RTO is 3 * m. We cannot go less than 2 because if the
5199 * link is bandwidth dominated, doubling the window size
5200 * during slow start means doubling the RTT. We want to be
5201 * more conservative when we reinitialize our estimates. 3
5202 * is just a convenient number.
5207 if (sv
< TCP_SD_MIN
) {
5209 * We do not know that if sa captures the delay ACK
5210 * effect as in a long train of segments, a receiver
5211 * does not delay its ACKs. So set the minimum of sv
5212 * to be TCP_SD_MIN, which is default to 400 ms, twice
5213 * of BSD DATO. That means the minimum of mean
5214 * deviation is 100 ms.
5219 tcp
->tcp_rtt_sa
= sa
;
5220 tcp
->tcp_rtt_sd
= sv
;
5222 * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5224 * Add tcp_rexmit_interval extra in case of extreme environment
5225 * where the algorithm fails to work. The default value of
5226 * tcp_rexmit_interval_extra should be 0.
5228 * As we use a finer grained clock than BSD and update
5229 * RTO for every ACKs, add in another .25 of RTT to the
5230 * deviation of RTO to accomodate burstiness of 1/4 of
5233 rto
= (sa
>> 3) + sv
+ tcps
->tcps_rexmit_interval_extra
+ (sa
>> 5);
5235 TCP_SET_RTO(tcp
, rto
);
5237 /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5238 tcp
->tcp_timer_backoff
= 0;
5242 tcp_rwnd_reopen(tcp_t
*tcp
)
5246 conn_t
*connp
= tcp
->tcp_connp
;
5248 /* Learn the latest rwnd information that we sent to the other side. */
5249 thwin
= ((uint_t
)ntohs(tcp
->tcp_tcpha
->tha_win
))
5251 /* This is peer's calculated send window (our receive window). */
5252 thwin
-= tcp
->tcp_rnxt
- tcp
->tcp_rack
;
5254 * Increase the receive window to max. But we need to do receiver
5255 * SWS avoidance. This means that we need to check the increase of
5256 * of receive window is at least 1 MSS.
5258 if (connp
->conn_rcvbuf
- thwin
>= tcp
->tcp_mss
) {
5260 * If the window that the other side knows is less than max
5261 * deferred acks segments, send an update immediately.
5263 if (thwin
< tcp
->tcp_rack_cur_max
* tcp
->tcp_mss
) {
5264 TCPS_BUMP_MIB(tcp
->tcp_tcps
, tcpOutWinUpdate
);
5265 ret
= TH_ACK_NEEDED
;
5267 tcp
->tcp_rwnd
= connp
->conn_rcvbuf
;
5273 * Handle a packet that has been reclassified by TCP.
5274 * This function drops the ref on connp that the caller had.
5277 tcp_reinput(conn_t
*connp
, mblk_t
*mp
, ip_recv_attr_t
*ira
, ip_stack_t
*ipst
)
5279 ipsec_stack_t
*ipss
= ipst
->ips_netstack
->netstack_ipsec
;
5281 if (connp
->conn_incoming_ifindex
!= 0 &&
5282 connp
->conn_incoming_ifindex
!= ira
->ira_ruifindex
) {
5284 CONN_DEC_REF(connp
);
5288 if (CONN_INBOUND_POLICY_PRESENT_V6(connp
, ipss
) ||
5289 (ira
->ira_flags
& IRAF_IPSEC_SECURE
)) {
5293 if (ira
->ira_flags
& IRAF_IS_IPV4
) {
5294 ipha
= (ipha_t
*)mp
->b_rptr
;
5298 ip6h
= (ip6_t
*)mp
->b_rptr
;
5300 mp
= ipsec_check_inbound_policy(mp
, connp
, ipha
, ip6h
, ira
);
5302 BUMP_MIB(&ipst
->ips_ip_mib
, ipIfStatsInDiscards
);
5303 /* Note that mp is NULL */
5304 ip_drop_input("ipIfStatsInDiscards", mp
, NULL
);
5305 CONN_DEC_REF(connp
);
5310 if (IPCL_IS_TCP(connp
)) {
5312 * do not drain, certain use cases can blow
5315 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
,
5316 connp
->conn_recv
, connp
, ira
,
5317 SQ_NODRAIN
, SQTAG_IP_TCP_INPUT
);
5319 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5320 (connp
->conn_recv
)(connp
, mp
, NULL
,
5322 CONN_DEC_REF(connp
);
5329 tcp_rsrv_input(void *arg
, mblk_t
*mp
, void *arg2
, ip_recv_attr_t
*dummy
)
5331 conn_t
*connp
= (conn_t
*)arg
;
5332 tcp_t
*tcp
= connp
->conn_tcp
;
5333 queue_t
*q
= connp
->conn_rq
;
5335 ASSERT(!IPCL_IS_NONSTR(connp
));
5336 mutex_enter(&tcp
->tcp_rsrv_mp_lock
);
5337 tcp
->tcp_rsrv_mp
= mp
;
5338 mutex_exit(&tcp
->tcp_rsrv_mp_lock
);
5340 if (TCP_IS_DETACHED(tcp
) || q
== NULL
) {
5344 if (tcp
->tcp_fused
) {
5345 tcp_fuse_backenable(tcp
);
5349 if (canputnext(q
)) {
5350 /* Not flow-controlled, open rwnd */
5351 tcp
->tcp_rwnd
= connp
->conn_rcvbuf
;
5354 * Send back a window update immediately if TCP is above
5355 * ESTABLISHED state and the increase of the rcv window
5356 * that the other side knows is at least 1 MSS after flow
5357 * control is lifted.
5359 if (tcp
->tcp_state
>= TCPS_ESTABLISHED
&&
5360 tcp_rwnd_reopen(tcp
) == TH_ACK_NEEDED
) {
5361 tcp_xmit_ctl(NULL
, tcp
,
5362 (tcp
->tcp_swnd
== 0) ? tcp
->tcp_suna
:
5363 tcp
->tcp_snxt
, tcp
->tcp_rnxt
, TH_ACK
);
5369 * The read side service routine is called mostly when we get back-enabled as a
5370 * result of flow control relief. Since we don't actually queue anything in
5371 * TCP, we have no data to send out of here. What we do is clear the receive
5372 * window, and send out a window update.
5375 tcp_rsrv(queue_t
*q
)
5377 conn_t
*connp
= Q_TO_CONN(q
);
5378 tcp_t
*tcp
= connp
->conn_tcp
;
5381 /* No code does a putq on the read side */
5382 ASSERT(q
->q_first
== NULL
);
5385 * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5386 * been run. So just return.
5388 mutex_enter(&tcp
->tcp_rsrv_mp_lock
);
5389 if ((mp
= tcp
->tcp_rsrv_mp
) == NULL
) {
5390 mutex_exit(&tcp
->tcp_rsrv_mp_lock
);
5393 tcp
->tcp_rsrv_mp
= NULL
;
5394 mutex_exit(&tcp
->tcp_rsrv_mp_lock
);
5396 CONN_INC_REF(connp
);
5397 SQUEUE_ENTER_ONE(connp
->conn_sqp
, mp
, tcp_rsrv_input
, connp
,
5398 NULL
, SQ_PROCESS
, SQTAG_TCP_RSRV
);
5402 /* At minimum we need 8 bytes in the TCP header for the lookup */
5403 #define ICMP_MIN_TCP_HDR 8
5406 * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5407 * passed up by IP. The message is always received on the correct tcp_t.
5408 * Assumes that IP has pulled up everything up to and including the ICMP header.
5412 tcp_icmp_input(void *arg1
, mblk_t
*mp
, void *arg2
, ip_recv_attr_t
*ira
)
5414 conn_t
*connp
= (conn_t
*)arg1
;
5420 tcp_t
*tcp
= connp
->conn_tcp
;
5422 /* Assume IP provides aligned packets */
5423 ASSERT(OK_32PTR(mp
->b_rptr
));
5424 ASSERT((MBLKL(mp
) >= sizeof (ipha_t
)));
5427 * It's possible we have a closed, but not yet destroyed, TCP
5428 * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5429 * in the closed state, so don't take any chances and drop the packet.
5431 if (tcp
->tcp_state
== TCPS_CLOSED
) {
5437 * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5438 * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5440 if (!(ira
->ira_flags
& IRAF_IS_IPV4
)) {
5441 tcp_icmp_error_ipv6(tcp
, mp
, ira
);
5445 /* Skip past the outer IP and ICMP headers */
5446 iph_hdr_length
= ira
->ira_ip_hdr_length
;
5447 icmph
= (icmph_t
*)&mp
->b_rptr
[iph_hdr_length
];
5449 * If we don't have the correct outer IP header length
5450 * or if we don't have a complete inner IP header
5453 if (iph_hdr_length
< sizeof (ipha_t
) ||
5454 (ipha_t
*)&icmph
[1] + 1 > (ipha_t
*)mp
->b_wptr
) {
5459 ipha
= (ipha_t
*)&icmph
[1];
5461 /* Skip past the inner IP and find the ULP header */
5462 iph_hdr_length
= IPH_HDR_LENGTH(ipha
);
5463 tcpha
= (tcpha_t
*)((char *)ipha
+ iph_hdr_length
);
5465 * If we don't have the correct inner IP header length or if the ULP
5466 * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5467 * bytes of TCP header, drop it.
5469 if (iph_hdr_length
< sizeof (ipha_t
) ||
5470 ipha
->ipha_protocol
!= IPPROTO_TCP
||
5471 (uchar_t
*)tcpha
+ ICMP_MIN_TCP_HDR
> mp
->b_wptr
) {
5475 seg_seq
= ntohl(tcpha
->tha_seq
);
5476 switch (icmph
->icmph_type
) {
5477 case ICMP_DEST_UNREACHABLE
:
5478 switch (icmph
->icmph_code
) {
5479 case ICMP_FRAGMENTATION_NEEDED
:
5481 * Update Path MTU, then try to send something out.
5483 tcp_update_pmtu(tcp
, B_TRUE
);
5484 tcp_rexmit_after_error(tcp
);
5486 case ICMP_PORT_UNREACHABLE
:
5487 case ICMP_PROTOCOL_UNREACHABLE
:
5488 switch (tcp
->tcp_state
) {
5492 * ICMP can snipe away incipient
5493 * TCP connections as long as
5494 * seq number is same as initial
5497 if (seg_seq
== tcp
->tcp_iss
) {
5498 (void) tcp_clean_death(tcp
,
5504 case ICMP_HOST_UNREACHABLE
:
5505 case ICMP_NET_UNREACHABLE
:
5506 /* Record the error in case we finally time out. */
5507 if (icmph
->icmph_code
== ICMP_HOST_UNREACHABLE
)
5508 tcp
->tcp_client_errno
= EHOSTUNREACH
;
5510 tcp
->tcp_client_errno
= ENETUNREACH
;
5511 if (tcp
->tcp_state
== TCPS_SYN_RCVD
) {
5512 if (tcp
->tcp_listener
!= NULL
&&
5513 tcp
->tcp_listener
->tcp_syn_defense
) {
5515 * Ditch the half-open connection if we
5516 * suspect a SYN attack is under way.
5518 (void) tcp_clean_death(tcp
,
5519 tcp
->tcp_client_errno
);
5527 case ICMP_SOURCE_QUENCH
: {
5529 * use a global boolean to control
5530 * whether TCP should respond to ICMP_SOURCE_QUENCH.
5531 * The default is false.
5533 if (tcp_icmp_source_quench
) {
5535 * Reduce the sending rate as if we got a
5536 * retransmit timeout
5540 npkt
= ((tcp
->tcp_snxt
- tcp
->tcp_suna
) >> 1) /
5542 tcp
->tcp_cwnd_ssthresh
= MAX(npkt
, 2) * tcp
->tcp_mss
;
5543 tcp
->tcp_cwnd
= tcp
->tcp_mss
;
5544 tcp
->tcp_cwnd_cnt
= 0;
5553 * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5554 * error messages passed up by IP.
5555 * Assumes that IP has pulled up all the extension headers as well
5556 * as the ICMPv6 header.
5559 tcp_icmp_error_ipv6(tcp_t
*tcp
, mblk_t
*mp
, ip_recv_attr_t
*ira
)
5563 uint16_t iph_hdr_length
= ira
->ira_ip_hdr_length
;
5569 * Verify that we have a complete IP header.
5571 ASSERT((MBLKL(mp
) >= sizeof (ip6_t
)));
5573 icmp6
= (icmp6_t
*)&mp
->b_rptr
[iph_hdr_length
];
5574 ip6h
= (ip6_t
*)&icmp6
[1];
5576 * Verify if we have a complete ICMP and inner IP header.
5578 if ((uchar_t
*)&ip6h
[1] > mp
->b_wptr
) {
5584 if (!ip_hdr_length_nexthdr_v6(mp
, ip6h
, &iph_hdr_length
, &nexthdrp
))
5586 tcpha
= (tcpha_t
*)((char *)ip6h
+ iph_hdr_length
);
5588 * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5589 * have at least ICMP_MIN_TCP_HDR bytes of TCP header drop the
5592 if ((*nexthdrp
!= IPPROTO_TCP
) ||
5593 ((uchar_t
*)tcpha
+ ICMP_MIN_TCP_HDR
) > mp
->b_wptr
) {
5597 seg_seq
= ntohl(tcpha
->tha_seq
);
5598 switch (icmp6
->icmp6_type
) {
5599 case ICMP6_PACKET_TOO_BIG
:
5601 * Update Path MTU, then try to send something out.
5603 tcp_update_pmtu(tcp
, B_TRUE
);
5604 tcp_rexmit_after_error(tcp
);
5606 case ICMP6_DST_UNREACH
:
5607 switch (icmp6
->icmp6_code
) {
5608 case ICMP6_DST_UNREACH_NOPORT
:
5609 if (((tcp
->tcp_state
== TCPS_SYN_SENT
) ||
5610 (tcp
->tcp_state
== TCPS_SYN_RCVD
)) &&
5611 (seg_seq
== tcp
->tcp_iss
)) {
5612 (void) tcp_clean_death(tcp
, ECONNREFUSED
);
5615 case ICMP6_DST_UNREACH_ADMIN
:
5616 case ICMP6_DST_UNREACH_NOROUTE
:
5617 case ICMP6_DST_UNREACH_BEYONDSCOPE
:
5618 case ICMP6_DST_UNREACH_ADDR
:
5619 /* Record the error in case we finally time out. */
5620 tcp
->tcp_client_errno
= EHOSTUNREACH
;
5621 if (((tcp
->tcp_state
== TCPS_SYN_SENT
) ||
5622 (tcp
->tcp_state
== TCPS_SYN_RCVD
)) &&
5623 (seg_seq
== tcp
->tcp_iss
)) {
5624 if (tcp
->tcp_listener
!= NULL
&&
5625 tcp
->tcp_listener
->tcp_syn_defense
) {
5627 * Ditch the half-open connection if we
5628 * suspect a SYN attack is under way.
5630 (void) tcp_clean_death(tcp
,
5631 tcp
->tcp_client_errno
);
5641 case ICMP6_PARAM_PROB
:
5642 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5643 if (icmp6
->icmp6_code
== ICMP6_PARAMPROB_NEXTHEADER
&&
5644 (uchar_t
*)ip6h
+ icmp6
->icmp6_pptr
==
5645 (uchar_t
*)nexthdrp
) {
5646 if (tcp
->tcp_state
== TCPS_SYN_SENT
||
5647 tcp
->tcp_state
== TCPS_SYN_RCVD
) {
5648 (void) tcp_clean_death(tcp
, ECONNREFUSED
);
5654 case ICMP6_TIME_EXCEEDED
:
5662 * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5663 * change. But it can refer to fields like tcp_suna and tcp_snxt.
5665 * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5666 * error messages received by IP. The message is always received on the correct
5671 tcp_verifyicmp(conn_t
*connp
, void *arg2
, icmph_t
*icmph
, icmp6_t
*icmp6
,
5672 ip_recv_attr_t
*ira
)
5674 tcpha_t
*tcpha
= (tcpha_t
*)arg2
;
5675 uint32_t seq
= ntohl(tcpha
->tha_seq
);
5676 tcp_t
*tcp
= connp
->conn_tcp
;
5679 * TCP sequence number contained in payload of the ICMP error message
5680 * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5681 * the message is either a stale ICMP error, or an attack from the
5682 * network. Fail the verification.
5684 if (SEQ_LT(seq
, tcp
->tcp_suna
) || SEQ_GEQ(seq
, tcp
->tcp_snxt
))
5687 /* For "too big" we also check the ignore flag */
5688 if (ira
->ira_flags
& IRAF_IS_IPV4
) {
5689 ASSERT(icmph
!= NULL
);
5690 if (icmph
->icmph_type
== ICMP_DEST_UNREACHABLE
&&
5691 icmph
->icmph_code
== ICMP_FRAGMENTATION_NEEDED
&&
5692 tcp
->tcp_tcps
->tcps_ignore_path_mtu
)
5695 ASSERT(icmp6
!= NULL
);
5696 if (icmp6
->icmp6_type
== ICMP6_PACKET_TOO_BIG
&&
5697 tcp
->tcp_tcps
->tcps_ignore_path_mtu
)