1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.
  24  * Copyright 2011 Nexenta Systems, Inc. All rights reserved.
  25  * Copyright (c) 2011 Joyent, Inc. All rights reserved.
  26  */
  27 
  28 /* This file contains all TCP input processing functions. */
  29 
  30 #include <sys/types.h>
  31 #include <sys/stream.h>
  32 #include <sys/strsun.h>
  33 #include <sys/strsubr.h>
  34 #include <sys/stropts.h>
  35 #include <sys/strlog.h>
  36 #define _SUN_TPI_VERSION 2
  37 #include <sys/tihdr.h>
  38 #include <sys/suntpi.h>
  39 #include <sys/xti_inet.h>
  40 #include <sys/squeue_impl.h>
  41 #include <sys/squeue.h>
  42 #include <sys/tsol/tnet.h>
  43 
  44 #include <inet/common.h>
  45 #include <inet/ip.h>
  46 #include <inet/tcp.h>
  47 #include <inet/tcp_impl.h>
  48 #include <inet/tcp_cluster.h>
  49 #include <inet/proto_set.h>
  50 #include <inet/ipsec_impl.h>
  51 
  52 /*
  53  * RFC1323-recommended phrasing of TSTAMP option, for easier parsing
  54  */
  55 
  56 #ifdef _BIG_ENDIAN
  57 #define TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \
  58         (TCPOPT_TSTAMP << 8) | 10)
  59 #else
  60 #define TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \
  61         (TCPOPT_NOP << 8) | TCPOPT_NOP)
  62 #endif
  63 
  64 /*
  65  * Flags returned from tcp_parse_options.
  66  */
  67 #define TCP_OPT_MSS_PRESENT     1
  68 #define TCP_OPT_WSCALE_PRESENT  2
  69 #define TCP_OPT_TSTAMP_PRESENT  4
  70 #define TCP_OPT_SACK_OK_PRESENT 8
  71 #define TCP_OPT_SACK_PRESENT    16
  72 
  73 /*
  74  *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days
  75  */
  76 #define PAWS_TIMEOUT    ((clock_t)(24*24*60*60*hz))
  77 
  78 /*
  79  * Since tcp_listener is not cleared atomically with tcp_detached
  80  * being cleared we need this extra bit to tell a detached connection
  81  * apart from one that is in the process of being accepted.
  82  */
  83 #define TCP_IS_DETACHED_NONEAGER(tcp)   \
  84         (TCP_IS_DETACHED(tcp) &&        \
  85             (!(tcp)->tcp_hard_binding))
  86 
  87 /*
  88  * Steps to do when a tcp_t moves to TIME-WAIT state.
  89  *
  90  * This connection is done, we don't need to account for it.  Decrement
  91  * the listener connection counter if needed.
  92  *
  93  * Decrement the connection counter of the stack.  Note that this counter
  94  * is per CPU.  So the total number of connections in a stack is the sum of all
  95  * of them.  Since there is no lock for handling all of them exclusively, the
  96  * resulting sum is only an approximation.
  97  *
  98  * Unconditionally clear the exclusive binding bit so this TIME-WAIT
  99  * connection won't interfere with new ones.
 100  *
 101  * Start the TIME-WAIT timer.  If upper layer has not closed the connection,
 102  * the timer is handled within the context of this tcp_t.  When the timer
 103  * fires, tcp_clean_death() is called.  If upper layer closes the connection
 104  * during this period, tcp_time_wait_append() will be called to add this
 105  * tcp_t to the global TIME-WAIT list.  Note that this means that the
 106  * actual wait time in TIME-WAIT state will be longer than the
 107  * tcps_time_wait_interval since the period before upper layer closes the
 108  * connection is not accounted for when tcp_time_wait_append() is called.
 109  *
 110  * If uppser layer has closed the connection, call tcp_time_wait_append()
 111  * directly.
 112  *
 113  */
 114 #define SET_TIME_WAIT(tcps, tcp, connp)                         \
 115 {                                                               \
 116         (tcp)->tcp_state = TCPS_TIME_WAIT;                   \
 117         if ((tcp)->tcp_listen_cnt != NULL)                   \
 118                 TCP_DECR_LISTEN_CNT(tcp);                       \
 119         atomic_dec_64(                                          \
 120             (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \
 121         (connp)->conn_exclbind = 0;                          \
 122         if (!TCP_IS_DETACHED(tcp)) {                            \
 123                 TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \
 124         } else {                                                \
 125                 tcp_time_wait_append(tcp);                      \
 126                 TCP_DBGSTAT(tcps, tcp_rput_time_wait);          \
 127         }                                                       \
 128 }
 129 
 130 /*
 131  * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more
 132  * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent
 133  * data, TCP will not respond with an ACK.  RFC 793 requires that
 134  * TCP responds with an ACK for such a bogus ACK.  By not following
 135  * the RFC, we prevent TCP from getting into an ACK storm if somehow
 136  * an attacker successfully spoofs an acceptable segment to our
 137  * peer; or when our peer is "confused."
 138  */
 139 static uint32_t tcp_drop_ack_unsent_cnt = 10;
 140 
 141 /*
 142  * To protect TCP against attacker using a small window and requesting
 143  * large amount of data (DoS attack by conuming memory), TCP checks the
 144  * window advertised in the last ACK of the 3-way handshake.  TCP uses
 145  * the tcp_mss (the size of one packet) value for comparion.  The window
 146  * should be larger than tcp_mss.  But while a sane TCP should advertise
 147  * a receive window larger than or equal to 4*MSS to avoid stop and go
 148  * tarrfic, not all TCP stacks do that.  This is especially true when
 149  * tcp_mss is a big value.
 150  *
 151  * To work around this issue, an additional fixed value for comparison
 152  * is also used.  If the advertised window is smaller than both tcp_mss
 153  * and tcp_init_wnd_chk, the ACK is considered as invalid.  So for large
 154  * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but
 155  * smaller than 8K is considered to be OK.
 156  */
 157 static uint32_t tcp_init_wnd_chk = 4096;
 158 
 159 /* Process ICMP source quench message or not. */
 160 static boolean_t tcp_icmp_source_quench = B_FALSE;
 161 
 162 static boolean_t tcp_outbound_squeue_switch = B_FALSE;
 163 
 164 static mblk_t   *tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,
 165                     ip_recv_attr_t *);
 166 static mblk_t   *tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,
 167                     ip_recv_attr_t *);
 168 static boolean_t        tcp_drop_q0(tcp_t *);
 169 static void     tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);
 170 static mblk_t   *tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,
 171                     ip_recv_attr_t *);
 172 static void     tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);
 173 static int      tcp_parse_options(tcpha_t *, tcp_opt_t *);
 174 static void     tcp_process_options(tcp_t *, tcpha_t *);
 175 static mblk_t   *tcp_reass(tcp_t *, mblk_t *, uint32_t);
 176 static void     tcp_reass_elim_overlap(tcp_t *, mblk_t *);
 177 static void     tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);
 178 static void     tcp_set_rto(tcp_t *, time_t);
 179 static void     tcp_setcred_data(mblk_t *, ip_recv_attr_t *);
 180 
 181 /*
 182  * Set the MSS associated with a particular tcp based on its current value,
 183  * and a new one passed in. Observe minimums and maximums, and reset other
 184  * state variables that we want to view as multiples of MSS.
 185  *
 186  * The value of MSS could be either increased or descreased.
 187  */
 188 void
 189 tcp_mss_set(tcp_t *tcp, uint32_t mss)
 190 {
 191         uint32_t        mss_max;
 192         tcp_stack_t     *tcps = tcp->tcp_tcps;
 193         conn_t          *connp = tcp->tcp_connp;
 194 
 195         if (connp->conn_ipversion == IPV4_VERSION)
 196                 mss_max = tcps->tcps_mss_max_ipv4;
 197         else
 198                 mss_max = tcps->tcps_mss_max_ipv6;
 199 
 200         if (mss < tcps->tcps_mss_min)
 201                 mss = tcps->tcps_mss_min;
 202         if (mss > mss_max)
 203                 mss = mss_max;
 204         /*
 205          * Unless naglim has been set by our client to
 206          * a non-mss value, force naglim to track mss.
 207          * This can help to aggregate small writes.
 208          */
 209         if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)
 210                 tcp->tcp_naglim = mss;
 211         /*
 212          * TCP should be able to buffer at least 4 MSS data for obvious
 213          * performance reason.
 214          */
 215         if ((mss << 2) > connp->conn_sndbuf)
 216                 connp->conn_sndbuf = mss << 2;
 217 
 218         /*
 219          * Set the send lowater to at least twice of MSS.
 220          */
 221         if ((mss << 1) > connp->conn_sndlowat)
 222                 connp->conn_sndlowat = mss << 1;
 223 
 224         /*
 225          * Update tcp_cwnd according to the new value of MSS. Keep the
 226          * previous ratio to preserve the transmit rate.
 227          */
 228         tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;
 229         tcp->tcp_cwnd_cnt = 0;
 230 
 231         tcp->tcp_mss = mss;
 232         (void) tcp_maxpsz_set(tcp, B_TRUE);
 233 }
 234 
 235 /*
 236  * Extract option values from a tcp header.  We put any found values into the
 237  * tcpopt struct and return a bitmask saying which options were found.
 238  */
 239 static int
 240 tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)
 241 {
 242         uchar_t         *endp;
 243         int             len;
 244         uint32_t        mss;
 245         uchar_t         *up = (uchar_t *)tcpha;
 246         int             found = 0;
 247         int32_t         sack_len;
 248         tcp_seq         sack_begin, sack_end;
 249         tcp_t           *tcp;
 250 
 251         endp = up + TCP_HDR_LENGTH(tcpha);
 252         up += TCP_MIN_HEADER_LENGTH;
 253         while (up < endp) {
 254                 len = endp - up;
 255                 switch (*up) {
 256                 case TCPOPT_EOL:
 257                         break;
 258 
 259                 case TCPOPT_NOP:
 260                         up++;
 261                         continue;
 262 
 263                 case TCPOPT_MAXSEG:
 264                         if (len < TCPOPT_MAXSEG_LEN ||
 265                             up[1] != TCPOPT_MAXSEG_LEN)
 266                                 break;
 267 
 268                         mss = BE16_TO_U16(up+2);
 269                         /* Caller must handle tcp_mss_min and tcp_mss_max_* */
 270                         tcpopt->tcp_opt_mss = mss;
 271                         found |= TCP_OPT_MSS_PRESENT;
 272 
 273                         up += TCPOPT_MAXSEG_LEN;
 274                         continue;
 275 
 276                 case TCPOPT_WSCALE:
 277                         if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)
 278                                 break;
 279 
 280                         if (up[2] > TCP_MAX_WINSHIFT)
 281                                 tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;
 282                         else
 283                                 tcpopt->tcp_opt_wscale = up[2];
 284                         found |= TCP_OPT_WSCALE_PRESENT;
 285 
 286                         up += TCPOPT_WS_LEN;
 287                         continue;
 288 
 289                 case TCPOPT_SACK_PERMITTED:
 290                         if (len < TCPOPT_SACK_OK_LEN ||
 291                             up[1] != TCPOPT_SACK_OK_LEN)
 292                                 break;
 293                         found |= TCP_OPT_SACK_OK_PRESENT;
 294                         up += TCPOPT_SACK_OK_LEN;
 295                         continue;
 296 
 297                 case TCPOPT_SACK:
 298                         if (len <= 2 || up[1] <= 2 || len < up[1])
 299                                 break;
 300 
 301                         /* If TCP is not interested in SACK blks... */
 302                         if ((tcp = tcpopt->tcp) == NULL) {
 303                                 up += up[1];
 304                                 continue;
 305                         }
 306                         sack_len = up[1] - TCPOPT_HEADER_LEN;
 307                         up += TCPOPT_HEADER_LEN;
 308 
 309                         /*
 310                          * If the list is empty, allocate one and assume
 311                          * nothing is sack'ed.
 312                          */
 313                         if (tcp->tcp_notsack_list == NULL) {
 314                                 tcp_notsack_update(&(tcp->tcp_notsack_list),
 315                                     tcp->tcp_suna, tcp->tcp_snxt,
 316                                     &(tcp->tcp_num_notsack_blk),
 317                                     &(tcp->tcp_cnt_notsack_list));
 318 
 319                                 /*
 320                                  * Make sure tcp_notsack_list is not NULL.
 321                                  * This happens when kmem_alloc(KM_NOSLEEP)
 322                                  * returns NULL.
 323                                  */
 324                                 if (tcp->tcp_notsack_list == NULL) {
 325                                         up += sack_len;
 326                                         continue;
 327                                 }
 328                                 tcp->tcp_fack = tcp->tcp_suna;
 329                         }
 330 
 331                         while (sack_len > 0) {
 332                                 if (up + 8 > endp) {
 333                                         up = endp;
 334                                         break;
 335                                 }
 336                                 sack_begin = BE32_TO_U32(up);
 337                                 up += 4;
 338                                 sack_end = BE32_TO_U32(up);
 339                                 up += 4;
 340                                 sack_len -= 8;
 341                                 /*
 342                                  * Bounds checking.  Make sure the SACK
 343                                  * info is within tcp_suna and tcp_snxt.
 344                                  * If this SACK blk is out of bound, ignore
 345                                  * it but continue to parse the following
 346                                  * blks.
 347                                  */
 348                                 if (SEQ_LEQ(sack_end, sack_begin) ||
 349                                     SEQ_LT(sack_begin, tcp->tcp_suna) ||
 350                                     SEQ_GT(sack_end, tcp->tcp_snxt)) {
 351                                         continue;
 352                                 }
 353                                 tcp_notsack_insert(&(tcp->tcp_notsack_list),
 354                                     sack_begin, sack_end,
 355                                     &(tcp->tcp_num_notsack_blk),
 356                                     &(tcp->tcp_cnt_notsack_list));
 357                                 if (SEQ_GT(sack_end, tcp->tcp_fack)) {
 358                                         tcp->tcp_fack = sack_end;
 359                                 }
 360                         }
 361                         found |= TCP_OPT_SACK_PRESENT;
 362                         continue;
 363 
 364                 case TCPOPT_TSTAMP:
 365                         if (len < TCPOPT_TSTAMP_LEN ||
 366                             up[1] != TCPOPT_TSTAMP_LEN)
 367                                 break;
 368 
 369                         tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);
 370                         tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);
 371 
 372                         found |= TCP_OPT_TSTAMP_PRESENT;
 373 
 374                         up += TCPOPT_TSTAMP_LEN;
 375                         continue;
 376 
 377                 default:
 378                         if (len <= 1 || len < (int)up[1] || up[1] == 0)
 379                                 break;
 380                         up += up[1];
 381                         continue;
 382                 }
 383                 break;
 384         }
 385         return (found);
 386 }
 387 
 388 /*
 389  * Process all TCP option in SYN segment.  Note that this function should
 390  * be called after tcp_set_destination() is called so that the necessary info
 391  * from IRE is already set in the tcp structure.
 392  *
 393  * This function sets up the correct tcp_mss value according to the
 394  * MSS option value and our header size.  It also sets up the window scale
 395  * and timestamp values, and initialize SACK info blocks.  But it does not
 396  * change receive window size after setting the tcp_mss value.  The caller
 397  * should do the appropriate change.
 398  */
 399 static void
 400 tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)
 401 {
 402         int options;
 403         tcp_opt_t tcpopt;
 404         uint32_t mss_max;
 405         char *tmp_tcph;
 406         tcp_stack_t     *tcps = tcp->tcp_tcps;
 407         conn_t          *connp = tcp->tcp_connp;
 408 
 409         tcpopt.tcp = NULL;
 410         options = tcp_parse_options(tcpha, &tcpopt);
 411 
 412         /*
 413          * Process MSS option.  Note that MSS option value does not account
 414          * for IP or TCP options.  This means that it is equal to MTU - minimum
 415          * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for
 416          * IPv6.
 417          */
 418         if (!(options & TCP_OPT_MSS_PRESENT)) {
 419                 if (connp->conn_ipversion == IPV4_VERSION)
 420                         tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;
 421                 else
 422                         tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;
 423         } else {
 424                 if (connp->conn_ipversion == IPV4_VERSION)
 425                         mss_max = tcps->tcps_mss_max_ipv4;
 426                 else
 427                         mss_max = tcps->tcps_mss_max_ipv6;
 428                 if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)
 429                         tcpopt.tcp_opt_mss = tcps->tcps_mss_min;
 430                 else if (tcpopt.tcp_opt_mss > mss_max)
 431                         tcpopt.tcp_opt_mss = mss_max;
 432         }
 433 
 434         /* Process Window Scale option. */
 435         if (options & TCP_OPT_WSCALE_PRESENT) {
 436                 tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;
 437                 tcp->tcp_snd_ws_ok = B_TRUE;
 438         } else {
 439                 tcp->tcp_snd_ws = B_FALSE;
 440                 tcp->tcp_snd_ws_ok = B_FALSE;
 441                 tcp->tcp_rcv_ws = B_FALSE;
 442         }
 443 
 444         /* Process Timestamp option. */
 445         if ((options & TCP_OPT_TSTAMP_PRESENT) &&
 446             (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {
 447                 tmp_tcph = (char *)tcp->tcp_tcpha;
 448 
 449                 tcp->tcp_snd_ts_ok = B_TRUE;
 450                 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
 451                 tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();
 452                 ASSERT(OK_32PTR(tmp_tcph));
 453                 ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);
 454 
 455                 /* Fill in our template header with basic timestamp option. */
 456                 tmp_tcph += connp->conn_ht_ulp_len;
 457                 tmp_tcph[0] = TCPOPT_NOP;
 458                 tmp_tcph[1] = TCPOPT_NOP;
 459                 tmp_tcph[2] = TCPOPT_TSTAMP;
 460                 tmp_tcph[3] = TCPOPT_TSTAMP_LEN;
 461                 connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;
 462                 connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;
 463                 tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);
 464         } else {
 465                 tcp->tcp_snd_ts_ok = B_FALSE;
 466         }
 467 
 468         /*
 469          * Process SACK options.  If SACK is enabled for this connection,
 470          * then allocate the SACK info structure.  Note the following ways
 471          * when tcp_snd_sack_ok is set to true.
 472          *
 473          * For active connection: in tcp_set_destination() called in
 474          * tcp_connect().
 475          *
 476          * For passive connection: in tcp_set_destination() called in
 477          * tcp_input_listener().
 478          *
 479          * That's the reason why the extra TCP_IS_DETACHED() check is there.
 480          * That check makes sure that if we did not send a SACK OK option,
 481          * we will not enable SACK for this connection even though the other
 482          * side sends us SACK OK option.  For active connection, the SACK
 483          * info structure has already been allocated.  So we need to free
 484          * it if SACK is disabled.
 485          */
 486         if ((options & TCP_OPT_SACK_OK_PRESENT) &&
 487             (tcp->tcp_snd_sack_ok ||
 488             (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {
 489                 ASSERT(tcp->tcp_num_sack_blk == 0);
 490                 ASSERT(tcp->tcp_notsack_list == NULL);
 491 
 492                 tcp->tcp_snd_sack_ok = B_TRUE;
 493                 if (tcp->tcp_snd_ts_ok) {
 494                         tcp->tcp_max_sack_blk = 3;
 495                 } else {
 496                         tcp->tcp_max_sack_blk = 4;
 497                 }
 498         } else if (tcp->tcp_snd_sack_ok) {
 499                 /*
 500                  * Resetting tcp_snd_sack_ok to B_FALSE so that
 501                  * no SACK info will be used for this
 502                  * connection.  This assumes that SACK usage
 503                  * permission is negotiated.  This may need
 504                  * to be changed once this is clarified.
 505                  */
 506                 ASSERT(tcp->tcp_num_sack_blk == 0);
 507                 ASSERT(tcp->tcp_notsack_list == NULL);
 508                 tcp->tcp_snd_sack_ok = B_FALSE;
 509         }
 510 
 511         /*
 512          * Now we know the exact TCP/IP header length, subtract
 513          * that from tcp_mss to get our side's MSS.
 514          */
 515         tcp->tcp_mss -= connp->conn_ht_iphc_len;
 516 
 517         /*
 518          * Here we assume that the other side's header size will be equal to
 519          * our header size.  We calculate the real MSS accordingly.  Need to
 520          * take into additional stuffs IPsec puts in.
 521          *
 522          * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)
 523          */
 524         tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +
 525             tcp->tcp_ipsec_overhead -
 526             ((connp->conn_ipversion == IPV4_VERSION ?
 527             IP_SIMPLE_HDR_LENGTH : IPV6_HDR_LEN) + TCP_MIN_HEADER_LENGTH);
 528 
 529         /*
 530          * Set MSS to the smaller one of both ends of the connection.
 531          * We should not have called tcp_mss_set() before, but our
 532          * side of the MSS should have been set to a proper value
 533          * by tcp_set_destination().  tcp_mss_set() will also set up the
 534          * STREAM head parameters properly.
 535          *
 536          * If we have a larger-than-16-bit window but the other side
 537          * didn't want to do window scale, tcp_rwnd_set() will take
 538          * care of that.
 539          */
 540         tcp_mss_set(tcp, MIN(tcpopt.tcp_opt_mss, tcp->tcp_mss));
 541 
 542         /*
 543          * Initialize tcp_cwnd value. After tcp_mss_set(), tcp_mss has been
 544          * updated properly.
 545          */
 546         TCP_SET_INIT_CWND(tcp, tcp->tcp_mss, tcps->tcps_slow_start_initial);
 547 }
 548 
 549 /*
 550  * Add a new piece to the tcp reassembly queue.  If the gap at the beginning
 551  * is filled, return as much as we can.  The message passed in may be
 552  * multi-part, chained using b_cont.  "start" is the starting sequence
 553  * number for this piece.
 554  */
 555 static mblk_t *
 556 tcp_reass(tcp_t *tcp, mblk_t *mp, uint32_t start)
 557 {
 558         uint32_t        end;
 559         mblk_t          *mp1;
 560         mblk_t          *mp2;
 561         mblk_t          *next_mp;
 562         uint32_t        u1;
 563         tcp_stack_t     *tcps = tcp->tcp_tcps;
 564 
 565 
 566         /* Walk through all the new pieces. */
 567         do {
 568                 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
 569                     (uintptr_t)INT_MAX);
 570                 end = start + (int)(mp->b_wptr - mp->b_rptr);
 571                 next_mp = mp->b_cont;
 572                 if (start == end) {
 573                         /* Empty.  Blast it. */
 574                         freeb(mp);
 575                         continue;
 576                 }
 577                 mp->b_cont = NULL;
 578                 TCP_REASS_SET_SEQ(mp, start);
 579                 TCP_REASS_SET_END(mp, end);
 580                 mp1 = tcp->tcp_reass_tail;
 581                 if (!mp1) {
 582                         tcp->tcp_reass_tail = mp;
 583                         tcp->tcp_reass_head = mp;
 584                         TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
 585                         TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
 586                             end - start);
 587                         continue;
 588                 }
 589                 /* New stuff completely beyond tail? */
 590                 if (SEQ_GEQ(start, TCP_REASS_END(mp1))) {
 591                         /* Link it on end. */
 592                         mp1->b_cont = mp;
 593                         tcp->tcp_reass_tail = mp;
 594                         TCPS_BUMP_MIB(tcps, tcpInDataUnorderSegs);
 595                         TCPS_UPDATE_MIB(tcps, tcpInDataUnorderBytes,
 596                             end - start);
 597                         continue;
 598                 }
 599                 mp1 = tcp->tcp_reass_head;
 600                 u1 = TCP_REASS_SEQ(mp1);
 601                 /* New stuff at the front? */
 602                 if (SEQ_LT(start, u1)) {
 603                         /* Yes... Check for overlap. */
 604                         mp->b_cont = mp1;
 605                         tcp->tcp_reass_head = mp;
 606                         tcp_reass_elim_overlap(tcp, mp);
 607                         continue;
 608                 }
 609                 /*
 610                  * The new piece fits somewhere between the head and tail.
 611                  * We find our slot, where mp1 precedes us and mp2 trails.
 612                  */
 613                 for (; (mp2 = mp1->b_cont) != NULL; mp1 = mp2) {
 614                         u1 = TCP_REASS_SEQ(mp2);
 615                         if (SEQ_LEQ(start, u1))
 616                                 break;
 617                 }
 618                 /* Link ourselves in */
 619                 mp->b_cont = mp2;
 620                 mp1->b_cont = mp;
 621 
 622                 /* Trim overlap with following mblk(s) first */
 623                 tcp_reass_elim_overlap(tcp, mp);
 624 
 625                 /* Trim overlap with preceding mblk */
 626                 tcp_reass_elim_overlap(tcp, mp1);
 627 
 628         } while (start = end, mp = next_mp);
 629         mp1 = tcp->tcp_reass_head;
 630         /* Anything ready to go? */
 631         if (TCP_REASS_SEQ(mp1) != tcp->tcp_rnxt)
 632                 return (NULL);
 633         /* Eat what we can off the queue */
 634         for (;;) {
 635                 mp = mp1->b_cont;
 636                 end = TCP_REASS_END(mp1);
 637                 TCP_REASS_SET_SEQ(mp1, 0);
 638                 TCP_REASS_SET_END(mp1, 0);
 639                 if (!mp) {
 640                         tcp->tcp_reass_tail = NULL;
 641                         break;
 642                 }
 643                 if (end != TCP_REASS_SEQ(mp)) {
 644                         mp1->b_cont = NULL;
 645                         break;
 646                 }
 647                 mp1 = mp;
 648         }
 649         mp1 = tcp->tcp_reass_head;
 650         tcp->tcp_reass_head = mp;
 651         return (mp1);
 652 }
 653 
 654 /* Eliminate any overlap that mp may have over later mblks */
 655 static void
 656 tcp_reass_elim_overlap(tcp_t *tcp, mblk_t *mp)
 657 {
 658         uint32_t        end;
 659         mblk_t          *mp1;
 660         uint32_t        u1;
 661         tcp_stack_t     *tcps = tcp->tcp_tcps;
 662 
 663         end = TCP_REASS_END(mp);
 664         while ((mp1 = mp->b_cont) != NULL) {
 665                 u1 = TCP_REASS_SEQ(mp1);
 666                 if (!SEQ_GT(end, u1))
 667                         break;
 668                 if (!SEQ_GEQ(end, TCP_REASS_END(mp1))) {
 669                         mp->b_wptr -= end - u1;
 670                         TCP_REASS_SET_END(mp, u1);
 671                         TCPS_BUMP_MIB(tcps, tcpInDataPartDupSegs);
 672                         TCPS_UPDATE_MIB(tcps, tcpInDataPartDupBytes,
 673                             end - u1);
 674                         break;
 675                 }
 676                 mp->b_cont = mp1->b_cont;
 677                 TCP_REASS_SET_SEQ(mp1, 0);
 678                 TCP_REASS_SET_END(mp1, 0);
 679                 freeb(mp1);
 680                 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
 681                 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes, end - u1);
 682         }
 683         if (!mp1)
 684                 tcp->tcp_reass_tail = mp;
 685 }
 686 
 687 /*
 688  * This function does PAWS protection check. Returns B_TRUE if the
 689  * segment passes the PAWS test, else returns B_FALSE.
 690  */
 691 boolean_t
 692 tcp_paws_check(tcp_t *tcp, tcpha_t *tcpha, tcp_opt_t *tcpoptp)
 693 {
 694         uint8_t flags;
 695         int     options;
 696         uint8_t *up;
 697         conn_t  *connp = tcp->tcp_connp;
 698 
 699         flags = (unsigned int)tcpha->tha_flags & 0xFF;
 700         /*
 701          * If timestamp option is aligned nicely, get values inline,
 702          * otherwise call general routine to parse.  Only do that
 703          * if timestamp is the only option.
 704          */
 705         if (TCP_HDR_LENGTH(tcpha) == (uint32_t)TCP_MIN_HEADER_LENGTH +
 706             TCPOPT_REAL_TS_LEN &&
 707             OK_32PTR((up = ((uint8_t *)tcpha) +
 708             TCP_MIN_HEADER_LENGTH)) &&
 709             *(uint32_t *)up == TCPOPT_NOP_NOP_TSTAMP) {
 710                 tcpoptp->tcp_opt_ts_val = ABE32_TO_U32((up+4));
 711                 tcpoptp->tcp_opt_ts_ecr = ABE32_TO_U32((up+8));
 712 
 713                 options = TCP_OPT_TSTAMP_PRESENT;
 714         } else {
 715                 if (tcp->tcp_snd_sack_ok) {
 716                         tcpoptp->tcp = tcp;
 717                 } else {
 718                         tcpoptp->tcp = NULL;
 719                 }
 720                 options = tcp_parse_options(tcpha, tcpoptp);
 721         }
 722 
 723         if (options & TCP_OPT_TSTAMP_PRESENT) {
 724                 /*
 725                  * Do PAWS per RFC 1323 section 4.2.  Accept RST
 726                  * regardless of the timestamp, page 18 RFC 1323.bis.
 727                  */
 728                 if ((flags & TH_RST) == 0 &&
 729                     TSTMP_LT(tcpoptp->tcp_opt_ts_val,
 730                     tcp->tcp_ts_recent)) {
 731                         if (LBOLT_FASTPATH64 <
 732                             (tcp->tcp_last_rcv_lbolt + PAWS_TIMEOUT)) {
 733                                 /* This segment is not acceptable. */
 734                                 return (B_FALSE);
 735                         } else {
 736                                 /*
 737                                  * Connection has been idle for
 738                                  * too long.  Reset the timestamp
 739                                  * and assume the segment is valid.
 740                                  */
 741                                 tcp->tcp_ts_recent =
 742                                     tcpoptp->tcp_opt_ts_val;
 743                         }
 744                 }
 745         } else {
 746                 /*
 747                  * If we don't get a timestamp on every packet, we
 748                  * figure we can't really trust 'em, so we stop sending
 749                  * and parsing them.
 750                  */
 751                 tcp->tcp_snd_ts_ok = B_FALSE;
 752 
 753                 connp->conn_ht_iphc_len -= TCPOPT_REAL_TS_LEN;
 754                 connp->conn_ht_ulp_len -= TCPOPT_REAL_TS_LEN;
 755                 tcp->tcp_tcpha->tha_offset_and_reserved -= (3 << 4);
 756                 /*
 757                  * Adjust the tcp_mss and tcp_cwnd accordingly. We avoid
 758                  * doing a slow start here so as to not to lose on the
 759                  * transfer rate built up so far.
 760                  */
 761                 tcp_mss_set(tcp, tcp->tcp_mss + TCPOPT_REAL_TS_LEN);
 762                 if (tcp->tcp_snd_sack_ok)
 763                         tcp->tcp_max_sack_blk = 4;
 764         }
 765         return (B_TRUE);
 766 }
 767 
 768 /*
 769  * Defense for the SYN attack -
 770  * 1. When q0 is full, drop from the tail (tcp_eager_prev_drop_q0) the oldest
 771  *    one from the list of droppable eagers. This list is a subset of q0.
 772  *    see comments before the definition of MAKE_DROPPABLE().
 773  * 2. Don't drop a SYN request before its first timeout. This gives every
 774  *    request at least til the first timeout to complete its 3-way handshake.
 775  * 3. Maintain tcp_syn_rcvd_timeout as an accurate count of how many
 776  *    requests currently on the queue that has timed out. This will be used
 777  *    as an indicator of whether an attack is under way, so that appropriate
 778  *    actions can be taken. (It's incremented in tcp_timer() and decremented
 779  *    either when eager goes into ESTABLISHED, or gets freed up.)
 780  * 4. The current threshold is - # of timeout > q0len/4 => SYN alert on
 781  *    # of timeout drops back to <= q0len/32 => SYN alert off
 782  */
 783 static boolean_t
 784 tcp_drop_q0(tcp_t *tcp)
 785 {
 786         tcp_t   *eager;
 787         mblk_t  *mp;
 788         tcp_stack_t     *tcps = tcp->tcp_tcps;
 789 
 790         ASSERT(MUTEX_HELD(&tcp->tcp_eager_lock));
 791         ASSERT(tcp->tcp_eager_next_q0 != tcp->tcp_eager_prev_q0);
 792 
 793         /* Pick oldest eager from the list of droppable eagers */
 794         eager = tcp->tcp_eager_prev_drop_q0;
 795 
 796         /* If list is empty. return B_FALSE */
 797         if (eager == tcp) {
 798                 return (B_FALSE);
 799         }
 800 
 801         /* If allocated, the mp will be freed in tcp_clean_death_wrapper() */
 802         if ((mp = allocb(0, BPRI_HI)) == NULL)
 803                 return (B_FALSE);
 804 
 805         /*
 806          * Take this eager out from the list of droppable eagers since we are
 807          * going to drop it.
 808          */
 809         MAKE_UNDROPPABLE(eager);
 810 
 811         if (tcp->tcp_connp->conn_debug) {
 812                 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
 813                     "tcp_drop_q0: listen half-open queue (max=%d) overflow"
 814                     " (%d pending) on %s, drop one", tcps->tcps_conn_req_max_q0,
 815                     tcp->tcp_conn_req_cnt_q0,
 816                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
 817         }
 818 
 819         TCPS_BUMP_MIB(tcps, tcpHalfOpenDrop);
 820 
 821         /* Put a reference on the conn as we are enqueueing it in the sqeue */
 822         CONN_INC_REF(eager->tcp_connp);
 823 
 824         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
 825             tcp_clean_death_wrapper, eager->tcp_connp, NULL,
 826             SQ_FILL, SQTAG_TCP_DROP_Q0);
 827 
 828         return (B_TRUE);
 829 }
 830 
 831 /*
 832  * Handle a SYN on an AF_INET6 socket; can be either IPv4 or IPv6
 833  */
 834 static mblk_t *
 835 tcp_conn_create_v6(conn_t *lconnp, conn_t *connp, mblk_t *mp,
 836     ip_recv_attr_t *ira)
 837 {
 838         tcp_t           *ltcp = lconnp->conn_tcp;
 839         tcp_t           *tcp = connp->conn_tcp;
 840         mblk_t          *tpi_mp;
 841         ipha_t          *ipha;
 842         ip6_t           *ip6h;
 843         sin6_t          sin6;
 844         uint_t          ifindex = ira->ira_ruifindex;
 845         tcp_stack_t     *tcps = tcp->tcp_tcps;
 846 
 847         if (ira->ira_flags & IRAF_IS_IPV4) {
 848                 ipha = (ipha_t *)mp->b_rptr;
 849 
 850                 connp->conn_ipversion = IPV4_VERSION;
 851                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
 852                 IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
 853                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
 854 
 855                 sin6 = sin6_null;
 856                 sin6.sin6_addr = connp->conn_faddr_v6;
 857                 sin6.sin6_port = connp->conn_fport;
 858                 sin6.sin6_family = AF_INET6;
 859                 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
 860                     IPCL_ZONEID(lconnp), tcps->tcps_netstack);
 861 
 862                 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
 863                         sin6_t  sin6d;
 864 
 865                         sin6d = sin6_null;
 866                         sin6d.sin6_addr = connp->conn_laddr_v6;
 867                         sin6d.sin6_port = connp->conn_lport;
 868                         sin6d.sin6_family = AF_INET;
 869                         tpi_mp = mi_tpi_extconn_ind(NULL,
 870                             (char *)&sin6d, sizeof (sin6_t),
 871                             (char *)&tcp,
 872                             (t_scalar_t)sizeof (intptr_t),
 873                             (char *)&sin6d, sizeof (sin6_t),
 874                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 875                 } else {
 876                         tpi_mp = mi_tpi_conn_ind(NULL,
 877                             (char *)&sin6, sizeof (sin6_t),
 878                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 879                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 880                 }
 881         } else {
 882                 ip6h = (ip6_t *)mp->b_rptr;
 883 
 884                 connp->conn_ipversion = IPV6_VERSION;
 885                 connp->conn_laddr_v6 = ip6h->ip6_dst;
 886                 connp->conn_faddr_v6 = ip6h->ip6_src;
 887                 connp->conn_saddr_v6 = connp->conn_laddr_v6;
 888 
 889                 sin6 = sin6_null;
 890                 sin6.sin6_addr = connp->conn_faddr_v6;
 891                 sin6.sin6_port = connp->conn_fport;
 892                 sin6.sin6_family = AF_INET6;
 893                 sin6.sin6_flowinfo = ip6h->ip6_vcf & ~IPV6_VERS_AND_FLOW_MASK;
 894                 sin6.__sin6_src_id = ip_srcid_find_addr(&connp->conn_laddr_v6,
 895                     IPCL_ZONEID(lconnp), tcps->tcps_netstack);
 896 
 897                 if (IN6_IS_ADDR_LINKSCOPE(&ip6h->ip6_src)) {
 898                         /* Pass up the scope_id of remote addr */
 899                         sin6.sin6_scope_id = ifindex;
 900                 } else {
 901                         sin6.sin6_scope_id = 0;
 902                 }
 903                 if (connp->conn_recv_ancillary.crb_recvdstaddr) {
 904                         sin6_t  sin6d;
 905 
 906                         sin6d = sin6_null;
 907                         sin6.sin6_addr = connp->conn_laddr_v6;
 908                         sin6d.sin6_port = connp->conn_lport;
 909                         sin6d.sin6_family = AF_INET6;
 910                         if (IN6_IS_ADDR_LINKSCOPE(&connp->conn_laddr_v6))
 911                                 sin6d.sin6_scope_id = ifindex;
 912 
 913                         tpi_mp = mi_tpi_extconn_ind(NULL,
 914                             (char *)&sin6d, sizeof (sin6_t),
 915                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 916                             (char *)&sin6d, sizeof (sin6_t),
 917                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 918                 } else {
 919                         tpi_mp = mi_tpi_conn_ind(NULL,
 920                             (char *)&sin6, sizeof (sin6_t),
 921                             (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 922                             (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 923                 }
 924         }
 925 
 926         tcp->tcp_mss = tcps->tcps_mss_def_ipv6;
 927         return (tpi_mp);
 928 }
 929 
 930 /* Handle a SYN on an AF_INET socket */
 931 static mblk_t *
 932 tcp_conn_create_v4(conn_t *lconnp, conn_t *connp, mblk_t *mp,
 933     ip_recv_attr_t *ira)
 934 {
 935         tcp_t           *ltcp = lconnp->conn_tcp;
 936         tcp_t           *tcp = connp->conn_tcp;
 937         sin_t           sin;
 938         mblk_t          *tpi_mp = NULL;
 939         tcp_stack_t     *tcps = tcp->tcp_tcps;
 940         ipha_t          *ipha;
 941 
 942         ASSERT(ira->ira_flags & IRAF_IS_IPV4);
 943         ipha = (ipha_t *)mp->b_rptr;
 944 
 945         connp->conn_ipversion = IPV4_VERSION;
 946         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_dst, &connp->conn_laddr_v6);
 947         IN6_IPADDR_TO_V4MAPPED(ipha->ipha_src, &connp->conn_faddr_v6);
 948         connp->conn_saddr_v6 = connp->conn_laddr_v6;
 949 
 950         sin = sin_null;
 951         sin.sin_addr.s_addr = connp->conn_faddr_v4;
 952         sin.sin_port = connp->conn_fport;
 953         sin.sin_family = AF_INET;
 954         if (lconnp->conn_recv_ancillary.crb_recvdstaddr) {
 955                 sin_t   sind;
 956 
 957                 sind = sin_null;
 958                 sind.sin_addr.s_addr = connp->conn_laddr_v4;
 959                 sind.sin_port = connp->conn_lport;
 960                 sind.sin_family = AF_INET;
 961                 tpi_mp = mi_tpi_extconn_ind(NULL,
 962                     (char *)&sind, sizeof (sin_t), (char *)&tcp,
 963                     (t_scalar_t)sizeof (intptr_t), (char *)&sind,
 964                     sizeof (sin_t), (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 965         } else {
 966                 tpi_mp = mi_tpi_conn_ind(NULL,
 967                     (char *)&sin, sizeof (sin_t),
 968                     (char *)&tcp, (t_scalar_t)sizeof (intptr_t),
 969                     (t_scalar_t)ltcp->tcp_conn_req_seqnum);
 970         }
 971 
 972         tcp->tcp_mss = tcps->tcps_mss_def_ipv4;
 973         return (tpi_mp);
 974 }
 975 
 976 /*
 977  * Called via squeue to get on to eager's perimeter. It sends a
 978  * TH_RST if eager is in the fanout table. The listener wants the
 979  * eager to disappear either by means of tcp_eager_blowoff() or
 980  * tcp_eager_cleanup() being called. tcp_eager_kill() can also be
 981  * called (via squeue) if the eager cannot be inserted in the
 982  * fanout table in tcp_input_listener().
 983  */
 984 /* ARGSUSED */
 985 void
 986 tcp_eager_kill(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
 987 {
 988         conn_t  *econnp = (conn_t *)arg;
 989         tcp_t   *eager = econnp->conn_tcp;
 990         tcp_t   *listener = eager->tcp_listener;
 991 
 992         /*
 993          * We could be called because listener is closing. Since
 994          * the eager was using listener's queue's, we avoid
 995          * using the listeners queues from now on.
 996          */
 997         ASSERT(eager->tcp_detached);
 998         econnp->conn_rq = NULL;
 999         econnp->conn_wq = NULL;
1000 
1001         /*
1002          * An eager's conn_fanout will be NULL if it's a duplicate
1003          * for an existing 4-tuples in the conn fanout table.
1004          * We don't want to send an RST out in such case.
1005          */
1006         if (econnp->conn_fanout != NULL && eager->tcp_state > TCPS_LISTEN) {
1007                 tcp_xmit_ctl("tcp_eager_kill, can't wait",
1008                     eager, eager->tcp_snxt, 0, TH_RST);
1009         }
1010 
1011         /* We are here because listener wants this eager gone */
1012         if (listener != NULL) {
1013                 mutex_enter(&listener->tcp_eager_lock);
1014                 tcp_eager_unlink(eager);
1015                 if (eager->tcp_tconnind_started) {
1016                         /*
1017                          * The eager has sent a conn_ind up to the
1018                          * listener but listener decides to close
1019                          * instead. We need to drop the extra ref
1020                          * placed on eager in tcp_input_data() before
1021                          * sending the conn_ind to listener.
1022                          */
1023                         CONN_DEC_REF(econnp);
1024                 }
1025                 mutex_exit(&listener->tcp_eager_lock);
1026                 CONN_DEC_REF(listener->tcp_connp);
1027         }
1028 
1029         if (eager->tcp_state != TCPS_CLOSED)
1030                 tcp_close_detached(eager);
1031 }
1032 
1033 /*
1034  * Reset any eager connection hanging off this listener marked
1035  * with 'seqnum' and then reclaim it's resources.
1036  */
1037 boolean_t
1038 tcp_eager_blowoff(tcp_t *listener, t_scalar_t seqnum)
1039 {
1040         tcp_t   *eager;
1041         mblk_t  *mp;
1042 
1043         eager = listener;
1044         mutex_enter(&listener->tcp_eager_lock);
1045         do {
1046                 eager = eager->tcp_eager_next_q;
1047                 if (eager == NULL) {
1048                         mutex_exit(&listener->tcp_eager_lock);
1049                         return (B_FALSE);
1050                 }
1051         } while (eager->tcp_conn_req_seqnum != seqnum);
1052 
1053         if (eager->tcp_closemp_used) {
1054                 mutex_exit(&listener->tcp_eager_lock);
1055                 return (B_TRUE);
1056         }
1057         eager->tcp_closemp_used = B_TRUE;
1058         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1059         CONN_INC_REF(eager->tcp_connp);
1060         mutex_exit(&listener->tcp_eager_lock);
1061         mp = &eager->tcp_closemp;
1062         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp, tcp_eager_kill,
1063             eager->tcp_connp, NULL, SQ_FILL, SQTAG_TCP_EAGER_BLOWOFF);
1064         return (B_TRUE);
1065 }
1066 
1067 /*
1068  * Reset any eager connection hanging off this listener
1069  * and then reclaim it's resources.
1070  */
1071 void
1072 tcp_eager_cleanup(tcp_t *listener, boolean_t q0_only)
1073 {
1074         tcp_t   *eager;
1075         mblk_t  *mp;
1076         tcp_stack_t     *tcps = listener->tcp_tcps;
1077 
1078         ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1079 
1080         if (!q0_only) {
1081                 /* First cleanup q */
1082                 TCP_STAT(tcps, tcp_eager_blowoff_q);
1083                 eager = listener->tcp_eager_next_q;
1084                 while (eager != NULL) {
1085                         if (!eager->tcp_closemp_used) {
1086                                 eager->tcp_closemp_used = B_TRUE;
1087                                 TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1088                                 CONN_INC_REF(eager->tcp_connp);
1089                                 mp = &eager->tcp_closemp;
1090                                 SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1091                                     tcp_eager_kill, eager->tcp_connp, NULL,
1092                                     SQ_FILL, SQTAG_TCP_EAGER_CLEANUP);
1093                         }
1094                         eager = eager->tcp_eager_next_q;
1095                 }
1096         }
1097         /* Then cleanup q0 */
1098         TCP_STAT(tcps, tcp_eager_blowoff_q0);
1099         eager = listener->tcp_eager_next_q0;
1100         while (eager != listener) {
1101                 if (!eager->tcp_closemp_used) {
1102                         eager->tcp_closemp_used = B_TRUE;
1103                         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1104                         CONN_INC_REF(eager->tcp_connp);
1105                         mp = &eager->tcp_closemp;
1106                         SQUEUE_ENTER_ONE(eager->tcp_connp->conn_sqp, mp,
1107                             tcp_eager_kill, eager->tcp_connp, NULL, SQ_FILL,
1108                             SQTAG_TCP_EAGER_CLEANUP_Q0);
1109                 }
1110                 eager = eager->tcp_eager_next_q0;
1111         }
1112 }
1113 
1114 /*
1115  * If we are an eager connection hanging off a listener that hasn't
1116  * formally accepted the connection yet, get off his list and blow off
1117  * any data that we have accumulated.
1118  */
1119 void
1120 tcp_eager_unlink(tcp_t *tcp)
1121 {
1122         tcp_t   *listener = tcp->tcp_listener;
1123 
1124         ASSERT(listener != NULL);
1125         ASSERT(MUTEX_HELD(&listener->tcp_eager_lock));
1126         if (tcp->tcp_eager_next_q0 != NULL) {
1127                 ASSERT(tcp->tcp_eager_prev_q0 != NULL);
1128 
1129                 /* Remove the eager tcp from q0 */
1130                 tcp->tcp_eager_next_q0->tcp_eager_prev_q0 =
1131                     tcp->tcp_eager_prev_q0;
1132                 tcp->tcp_eager_prev_q0->tcp_eager_next_q0 =
1133                     tcp->tcp_eager_next_q0;
1134                 ASSERT(listener->tcp_conn_req_cnt_q0 > 0);
1135                 listener->tcp_conn_req_cnt_q0--;
1136 
1137                 tcp->tcp_eager_next_q0 = NULL;
1138                 tcp->tcp_eager_prev_q0 = NULL;
1139 
1140                 /*
1141                  * Take the eager out, if it is in the list of droppable
1142                  * eagers.
1143                  */
1144                 MAKE_UNDROPPABLE(tcp);
1145 
1146                 if (tcp->tcp_syn_rcvd_timeout != 0) {
1147                         /* we have timed out before */
1148                         ASSERT(listener->tcp_syn_rcvd_timeout > 0);
1149                         listener->tcp_syn_rcvd_timeout--;
1150                 }
1151         } else {
1152                 tcp_t   **tcpp = &listener->tcp_eager_next_q;
1153                 tcp_t   *prev = NULL;
1154 
1155                 for (; tcpp[0]; tcpp = &tcpp[0]->tcp_eager_next_q) {
1156                         if (tcpp[0] == tcp) {
1157                                 if (listener->tcp_eager_last_q == tcp) {
1158                                         /*
1159                                          * If we are unlinking the last
1160                                          * element on the list, adjust
1161                                          * tail pointer. Set tail pointer
1162                                          * to nil when list is empty.
1163                                          */
1164                                         ASSERT(tcp->tcp_eager_next_q == NULL);
1165                                         if (listener->tcp_eager_last_q ==
1166                                             listener->tcp_eager_next_q) {
1167                                                 listener->tcp_eager_last_q =
1168                                                     NULL;
1169                                         } else {
1170                                                 /*
1171                                                  * We won't get here if there
1172                                                  * is only one eager in the
1173                                                  * list.
1174                                                  */
1175                                                 ASSERT(prev != NULL);
1176                                                 listener->tcp_eager_last_q =
1177                                                     prev;
1178                                         }
1179                                 }
1180                                 tcpp[0] = tcp->tcp_eager_next_q;
1181                                 tcp->tcp_eager_next_q = NULL;
1182                                 tcp->tcp_eager_last_q = NULL;
1183                                 ASSERT(listener->tcp_conn_req_cnt_q > 0);
1184                                 listener->tcp_conn_req_cnt_q--;
1185                                 break;
1186                         }
1187                         prev = tcpp[0];
1188                 }
1189         }
1190         tcp->tcp_listener = NULL;
1191 }
1192 
1193 /* BEGIN CSTYLED */
1194 /*
1195  *
1196  * The sockfs ACCEPT path:
1197  * =======================
1198  *
1199  * The eager is now established in its own perimeter as soon as SYN is
1200  * received in tcp_input_listener(). When sockfs receives conn_ind, it
1201  * completes the accept processing on the acceptor STREAM. The sending
1202  * of conn_ind part is common for both sockfs listener and a TLI/XTI
1203  * listener but a TLI/XTI listener completes the accept processing
1204  * on the listener perimeter.
1205  *
1206  * Common control flow for 3 way handshake:
1207  * ----------------------------------------
1208  *
1209  * incoming SYN (listener perimeter)    -> tcp_input_listener()
1210  *
1211  * incoming SYN-ACK-ACK (eager perim)   -> tcp_input_data()
1212  * send T_CONN_IND (listener perim)     -> tcp_send_conn_ind()
1213  *
1214  * Sockfs ACCEPT Path:
1215  * -------------------
1216  *
1217  * open acceptor stream (tcp_open allocates tcp_tli_accept()
1218  * as STREAM entry point)
1219  *
1220  * soaccept() sends T_CONN_RES on the acceptor STREAM to tcp_tli_accept()
1221  *
1222  * tcp_tli_accept() extracts the eager and makes the q->q_ptr <-> eager
1223  * association (we are not behind eager's squeue but sockfs is protecting us
1224  * and no one knows about this stream yet. The STREAMS entry point q->q_info
1225  * is changed to point at tcp_wput().
1226  *
1227  * tcp_accept_common() sends any deferred eagers via tcp_send_pending() to
1228  * listener (done on listener's perimeter).
1229  *
1230  * tcp_tli_accept() calls tcp_accept_finish() on eagers perimeter to finish
1231  * accept.
1232  *
1233  * TLI/XTI client ACCEPT path:
1234  * ---------------------------
1235  *
1236  * soaccept() sends T_CONN_RES on the listener STREAM.
1237  *
1238  * tcp_tli_accept() -> tcp_accept_swap() complete the processing and send
1239  * a M_SETOPS mblk to eager perimeter to finish accept (tcp_accept_finish()).
1240  *
1241  * Locks:
1242  * ======
1243  *
1244  * listener->tcp_eager_lock protects the listeners->tcp_eager_next_q0 and
1245  * and listeners->tcp_eager_next_q.
1246  *
1247  * Referencing:
1248  * ============
1249  *
1250  * 1) We start out in tcp_input_listener by eager placing a ref on
1251  * listener and listener adding eager to listeners->tcp_eager_next_q0.
1252  *
1253  * 2) When a SYN-ACK-ACK arrives, we send the conn_ind to listener. Before
1254  * doing so we place a ref on the eager. This ref is finally dropped at the
1255  * end of tcp_accept_finish() while unwinding from the squeue, i.e. the
1256  * reference is dropped by the squeue framework.
1257  *
1258  * 3) The ref on listener placed in 1 above is dropped in tcp_accept_finish
1259  *
1260  * The reference must be released by the same entity that added the reference
1261  * In the above scheme, the eager is the entity that adds and releases the
1262  * references. Note that tcp_accept_finish executes in the squeue of the eager
1263  * (albeit after it is attached to the acceptor stream). Though 1. executes
1264  * in the listener's squeue, the eager is nascent at this point and the
1265  * reference can be considered to have been added on behalf of the eager.
1266  *
1267  * Eager getting a Reset or listener closing:
1268  * ==========================================
1269  *
1270  * Once the listener and eager are linked, the listener never does the unlink.
1271  * If the listener needs to close, tcp_eager_cleanup() is called which queues
1272  * a message on all eager perimeter. The eager then does the unlink, clears
1273  * any pointers to the listener's queue and drops the reference to the
1274  * listener. The listener waits in tcp_close outside the squeue until its
1275  * refcount has dropped to 1. This ensures that the listener has waited for
1276  * all eagers to clear their association with the listener.
1277  *
1278  * Similarly, if eager decides to go away, it can unlink itself and close.
1279  * When the T_CONN_RES comes down, we check if eager has closed. Note that
1280  * the reference to eager is still valid because of the extra ref we put
1281  * in tcp_send_conn_ind.
1282  *
1283  * Listener can always locate the eager under the protection
1284  * of the listener->tcp_eager_lock, and then do a refhold
1285  * on the eager during the accept processing.
1286  *
1287  * The acceptor stream accesses the eager in the accept processing
1288  * based on the ref placed on eager before sending T_conn_ind.
1289  * The only entity that can negate this refhold is a listener close
1290  * which is mutually exclusive with an active acceptor stream.
1291  *
1292  * Eager's reference on the listener
1293  * ===================================
1294  *
1295  * If the accept happens (even on a closed eager) the eager drops its
1296  * reference on the listener at the start of tcp_accept_finish. If the
1297  * eager is killed due to an incoming RST before the T_conn_ind is sent up,
1298  * the reference is dropped in tcp_closei_local. If the listener closes,
1299  * the reference is dropped in tcp_eager_kill. In all cases the reference
1300  * is dropped while executing in the eager's context (squeue).
1301  */
1302 /* END CSTYLED */
1303 
1304 /* Process the SYN packet, mp, directed at the listener 'tcp' */
1305 
1306 /*
1307  * THIS FUNCTION IS DIRECTLY CALLED BY IP VIA SQUEUE FOR SYN.
1308  * tcp_input_data will not see any packets for listeners since the listener
1309  * has conn_recv set to tcp_input_listener.
1310  */
1311 /* ARGSUSED */
1312 static void
1313 tcp_input_listener(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
1314 {
1315         tcpha_t         *tcpha;
1316         uint32_t        seg_seq;
1317         tcp_t           *eager;
1318         int             err;
1319         conn_t          *econnp = NULL;
1320         squeue_t        *new_sqp;
1321         mblk_t          *mp1;
1322         uint_t          ip_hdr_len;
1323         conn_t          *lconnp = (conn_t *)arg;
1324         tcp_t           *listener = lconnp->conn_tcp;
1325         tcp_stack_t     *tcps = listener->tcp_tcps;
1326         ip_stack_t      *ipst = tcps->tcps_netstack->netstack_ip;
1327         uint_t          flags;
1328         mblk_t          *tpi_mp;
1329         uint_t          ifindex = ira->ira_ruifindex;
1330         boolean_t       tlc_set = B_FALSE;
1331 
1332         ip_hdr_len = ira->ira_ip_hdr_length;
1333         tcpha = (tcpha_t *)&mp->b_rptr[ip_hdr_len];
1334         flags = (unsigned int)tcpha->tha_flags & 0xFF;
1335 
1336         DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, lconnp->conn_ixa,
1337             __dtrace_tcp_void_ip_t *, mp->b_rptr, tcp_t *, listener,
1338             __dtrace_tcp_tcph_t *, tcpha);
1339 
1340         if (!(flags & TH_SYN)) {
1341                 if ((flags & TH_RST) || (flags & TH_URG)) {
1342                         freemsg(mp);
1343                         return;
1344                 }
1345                 if (flags & TH_ACK) {
1346                         /* Note this executes in listener's squeue */
1347                         tcp_xmit_listeners_reset(mp, ira, ipst, lconnp);
1348                         return;
1349                 }
1350 
1351                 freemsg(mp);
1352                 return;
1353         }
1354 
1355         if (listener->tcp_state != TCPS_LISTEN)
1356                 goto error2;
1357 
1358         ASSERT(IPCL_IS_BOUND(lconnp));
1359 
1360         mutex_enter(&listener->tcp_eager_lock);
1361 
1362         /*
1363          * The system is under memory pressure, so we need to do our part
1364          * to relieve the pressure.  So we only accept new request if there
1365          * is nothing waiting to be accepted or waiting to complete the 3-way
1366          * handshake.  This means that busy listener will not get too many
1367          * new requests which they cannot handle in time while non-busy
1368          * listener is still functioning properly.
1369          */
1370         if (tcps->tcps_reclaim && (listener->tcp_conn_req_cnt_q > 0 ||
1371             listener->tcp_conn_req_cnt_q0 > 0)) {
1372                 mutex_exit(&listener->tcp_eager_lock);
1373                 TCP_STAT(tcps, tcp_listen_mem_drop);
1374                 goto error2;
1375         }
1376 
1377         if (listener->tcp_conn_req_cnt_q >= listener->tcp_conn_req_max) {
1378                 mutex_exit(&listener->tcp_eager_lock);
1379                 TCP_STAT(tcps, tcp_listendrop);
1380                 TCPS_BUMP_MIB(tcps, tcpListenDrop);
1381                 if (lconnp->conn_debug) {
1382                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE|SL_ERROR,
1383                             "tcp_input_listener: listen backlog (max=%d) "
1384                             "overflow (%d pending) on %s",
1385                             listener->tcp_conn_req_max,
1386                             listener->tcp_conn_req_cnt_q,
1387                             tcp_display(listener, NULL, DISP_PORT_ONLY));
1388                 }
1389                 goto error2;
1390         }
1391 
1392         if (listener->tcp_conn_req_cnt_q0 >=
1393             listener->tcp_conn_req_max + tcps->tcps_conn_req_max_q0) {
1394                 /*
1395                  * Q0 is full. Drop a pending half-open req from the queue
1396                  * to make room for the new SYN req. Also mark the time we
1397                  * drop a SYN.
1398                  *
1399                  * A more aggressive defense against SYN attack will
1400                  * be to set the "tcp_syn_defense" flag now.
1401                  */
1402                 TCP_STAT(tcps, tcp_listendropq0);
1403                 listener->tcp_last_rcv_lbolt = ddi_get_lbolt64();
1404                 if (!tcp_drop_q0(listener)) {
1405                         mutex_exit(&listener->tcp_eager_lock);
1406                         TCPS_BUMP_MIB(tcps, tcpListenDropQ0);
1407                         if (lconnp->conn_debug) {
1408                                 (void) strlog(TCP_MOD_ID, 0, 3, SL_TRACE,
1409                                     "tcp_input_listener: listen half-open "
1410                                     "queue (max=%d) full (%d pending) on %s",
1411                                     tcps->tcps_conn_req_max_q0,
1412                                     listener->tcp_conn_req_cnt_q0,
1413                                     tcp_display(listener, NULL,
1414                                     DISP_PORT_ONLY));
1415                         }
1416                         goto error2;
1417                 }
1418         }
1419 
1420         /*
1421          * Enforce the limit set on the number of connections per listener.
1422          * Note that tlc_cnt starts with 1.  So need to add 1 to tlc_max
1423          * for comparison.
1424          */
1425         if (listener->tcp_listen_cnt != NULL) {
1426                 tcp_listen_cnt_t *tlc = listener->tcp_listen_cnt;
1427                 int64_t now;
1428 
1429                 if (atomic_add_32_nv(&tlc->tlc_cnt, 1) > tlc->tlc_max + 1) {
1430                         mutex_exit(&listener->tcp_eager_lock);
1431                         now = ddi_get_lbolt64();
1432                         atomic_add_32(&tlc->tlc_cnt, -1);
1433                         TCP_STAT(tcps, tcp_listen_cnt_drop);
1434                         tlc->tlc_drop++;
1435                         if (now - tlc->tlc_report_time >
1436                             MSEC_TO_TICK(TCP_TLC_REPORT_INTERVAL)) {
1437                                 zcmn_err(lconnp->conn_zoneid, CE_WARN,
1438                                     "Listener (port %d) connection max (%u) "
1439                                     "reached: %u attempts dropped total\n",
1440                                     ntohs(listener->tcp_connp->conn_lport),
1441                                     tlc->tlc_max, tlc->tlc_drop);
1442                                 tlc->tlc_report_time = now;
1443                         }
1444                         goto error2;
1445                 }
1446                 tlc_set = B_TRUE;
1447         }
1448 
1449         mutex_exit(&listener->tcp_eager_lock);
1450 
1451         /*
1452          * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1453          * or based on the ring (for packets from GLD). Otherwise it is
1454          * set based on lbolt i.e., a somewhat random number.
1455          */
1456         ASSERT(ira->ira_sqp != NULL);
1457         new_sqp = ira->ira_sqp;
1458 
1459         econnp = (conn_t *)tcp_get_conn(arg2, tcps);
1460         if (econnp == NULL)
1461                 goto error2;
1462 
1463         ASSERT(econnp->conn_netstack == lconnp->conn_netstack);
1464         econnp->conn_sqp = new_sqp;
1465         econnp->conn_initial_sqp = new_sqp;
1466         econnp->conn_ixa->ixa_sqp = new_sqp;
1467 
1468         econnp->conn_fport = tcpha->tha_lport;
1469         econnp->conn_lport = tcpha->tha_fport;
1470 
1471         err = conn_inherit_parent(lconnp, econnp);
1472         if (err != 0)
1473                 goto error3;
1474 
1475         /* We already know the laddr of the new connection is ours */
1476         econnp->conn_ixa->ixa_src_generation = ipst->ips_src_generation;
1477 
1478         ASSERT(OK_32PTR(mp->b_rptr));
1479         ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION ||
1480             IPH_HDR_VERSION(mp->b_rptr) == IPV6_VERSION);
1481 
1482         if (lconnp->conn_family == AF_INET) {
1483                 ASSERT(IPH_HDR_VERSION(mp->b_rptr) == IPV4_VERSION);
1484                 tpi_mp = tcp_conn_create_v4(lconnp, econnp, mp, ira);
1485         } else {
1486                 tpi_mp = tcp_conn_create_v6(lconnp, econnp, mp, ira);
1487         }
1488 
1489         if (tpi_mp == NULL)
1490                 goto error3;
1491 
1492         eager = econnp->conn_tcp;
1493         eager->tcp_detached = B_TRUE;
1494         SOCK_CONNID_INIT(eager->tcp_connid);
1495 
1496         /*
1497          * Initialize the eager's tcp_t and inherit some parameters from
1498          * the listener.
1499          */
1500         tcp_init_values(eager, listener);
1501 
1502         ASSERT((econnp->conn_ixa->ixa_flags &
1503             (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1504             IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO)) ==
1505             (IXAF_SET_ULP_CKSUM | IXAF_VERIFY_SOURCE |
1506             IXAF_VERIFY_PMTU | IXAF_VERIFY_LSO));
1507 
1508         if (!tcps->tcps_dev_flow_ctl)
1509                 econnp->conn_ixa->ixa_flags |= IXAF_NO_DEV_FLOW_CTL;
1510 
1511         /* Prepare for diffing against previous packets */
1512         eager->tcp_recvifindex = 0;
1513         eager->tcp_recvhops = 0xffffffffU;
1514 
1515         if (!(ira->ira_flags & IRAF_IS_IPV4) && econnp->conn_bound_if == 0) {
1516                 if (IN6_IS_ADDR_LINKSCOPE(&econnp->conn_faddr_v6) ||
1517                     IN6_IS_ADDR_LINKSCOPE(&econnp->conn_laddr_v6)) {
1518                         econnp->conn_incoming_ifindex = ifindex;
1519                         econnp->conn_ixa->ixa_flags |= IXAF_SCOPEID_SET;
1520                         econnp->conn_ixa->ixa_scopeid = ifindex;
1521                 }
1522         }
1523 
1524         if ((ira->ira_flags & (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS)) ==
1525             (IRAF_IS_IPV4|IRAF_IPV4_OPTIONS) &&
1526             tcps->tcps_rev_src_routes) {
1527                 ipha_t *ipha = (ipha_t *)mp->b_rptr;
1528                 ip_pkt_t *ipp = &econnp->conn_xmit_ipp;
1529 
1530                 /* Source routing option copyover (reverse it) */
1531                 err = ip_find_hdr_v4(ipha, ipp, B_TRUE);
1532                 if (err != 0) {
1533                         freemsg(tpi_mp);
1534                         goto error3;
1535                 }
1536                 ip_pkt_source_route_reverse_v4(ipp);
1537         }
1538 
1539         ASSERT(eager->tcp_conn.tcp_eager_conn_ind == NULL);
1540         ASSERT(!eager->tcp_tconnind_started);
1541         /*
1542          * If the SYN came with a credential, it's a loopback packet or a
1543          * labeled packet; attach the credential to the TPI message.
1544          */
1545         if (ira->ira_cred != NULL)
1546                 mblk_setcred(tpi_mp, ira->ira_cred, ira->ira_cpid);
1547 
1548         eager->tcp_conn.tcp_eager_conn_ind = tpi_mp;
1549         ASSERT(eager->tcp_ordrel_mp == NULL);
1550 
1551         /* Inherit the listener's non-STREAMS flag */
1552         if (IPCL_IS_NONSTR(lconnp)) {
1553                 econnp->conn_flags |= IPCL_NONSTR;
1554                 /* All non-STREAMS tcp_ts are sockets */
1555                 eager->tcp_issocket = B_TRUE;
1556         } else {
1557                 /*
1558                  * Pre-allocate the T_ordrel_ind mblk for TPI socket so that
1559                  * at close time, we will always have that to send up.
1560                  * Otherwise, we need to do special handling in case the
1561                  * allocation fails at that time.
1562                  */
1563                 if ((eager->tcp_ordrel_mp = mi_tpi_ordrel_ind()) == NULL)
1564                         goto error3;
1565         }
1566         /*
1567          * Now that the IP addresses and ports are setup in econnp we
1568          * can do the IPsec policy work.
1569          */
1570         if (ira->ira_flags & IRAF_IPSEC_SECURE) {
1571                 if (lconnp->conn_policy != NULL) {
1572                         /*
1573                          * Inherit the policy from the listener; use
1574                          * actions from ira
1575                          */
1576                         if (!ip_ipsec_policy_inherit(econnp, lconnp, ira)) {
1577                                 CONN_DEC_REF(econnp);
1578                                 freemsg(mp);
1579                                 goto error3;
1580                         }
1581                 }
1582         }
1583 
1584         /*
1585          * tcp_set_destination() may set tcp_rwnd according to the route
1586          * metrics. If it does not, the eager's receive window will be set
1587          * to the listener's receive window later in this function.
1588          */
1589         eager->tcp_rwnd = 0;
1590 
1591         if (is_system_labeled()) {
1592                 ip_xmit_attr_t *ixa = econnp->conn_ixa;
1593 
1594                 ASSERT(ira->ira_tsl != NULL);
1595                 /* Discard any old label */
1596                 if (ixa->ixa_free_flags & IXA_FREE_TSL) {
1597                         ASSERT(ixa->ixa_tsl != NULL);
1598                         label_rele(ixa->ixa_tsl);
1599                         ixa->ixa_free_flags &= ~IXA_FREE_TSL;
1600                         ixa->ixa_tsl = NULL;
1601                 }
1602                 if ((lconnp->conn_mlp_type != mlptSingle ||
1603                     lconnp->conn_mac_mode != CONN_MAC_DEFAULT) &&
1604                     ira->ira_tsl != NULL) {
1605                         /*
1606                          * If this is an MLP connection or a MAC-Exempt
1607                          * connection with an unlabeled node, packets are to be
1608                          * exchanged using the security label of the received
1609                          * SYN packet instead of the server application's label.
1610                          * tsol_check_dest called from ip_set_destination
1611                          * might later update TSF_UNLABELED by replacing
1612                          * ixa_tsl with a new label.
1613                          */
1614                         label_hold(ira->ira_tsl);
1615                         ip_xmit_attr_replace_tsl(ixa, ira->ira_tsl);
1616                         DTRACE_PROBE2(mlp_syn_accept, conn_t *,
1617                             econnp, ts_label_t *, ixa->ixa_tsl)
1618                 } else {
1619                         ixa->ixa_tsl = crgetlabel(econnp->conn_cred);
1620                         DTRACE_PROBE2(syn_accept, conn_t *,
1621                             econnp, ts_label_t *, ixa->ixa_tsl)
1622                 }
1623                 /*
1624                  * conn_connect() called from tcp_set_destination will verify
1625                  * the destination is allowed to receive packets at the
1626                  * security label of the SYN-ACK we are generating. As part of
1627                  * that, tsol_check_dest() may create a new effective label for
1628                  * this connection.
1629                  * Finally conn_connect() will call conn_update_label.
1630                  * All that remains for TCP to do is to call
1631                  * conn_build_hdr_template which is done as part of
1632                  * tcp_set_destination.
1633                  */
1634         }
1635 
1636         /*
1637          * Since we will clear tcp_listener before we clear tcp_detached
1638          * in the accept code we need tcp_hard_binding aka tcp_accept_inprogress
1639          * so we can tell a TCP_IS_DETACHED_NONEAGER apart.
1640          */
1641         eager->tcp_hard_binding = B_TRUE;
1642 
1643         tcp_bind_hash_insert(&tcps->tcps_bind_fanout[
1644             TCP_BIND_HASH(econnp->conn_lport)], eager, 0);
1645 
1646         CL_INET_CONNECT(econnp, B_FALSE, err);
1647         if (err != 0) {
1648                 tcp_bind_hash_remove(eager);
1649                 goto error3;
1650         }
1651 
1652         SOCK_CONNID_BUMP(eager->tcp_connid);
1653 
1654         /*
1655          * Adapt our mss, ttl, ... based on the remote address.
1656          */
1657 
1658         if (tcp_set_destination(eager) != 0) {
1659                 TCPS_BUMP_MIB(tcps, tcpAttemptFails);
1660                 /* Undo the bind_hash_insert */
1661                 tcp_bind_hash_remove(eager);
1662                 goto error3;
1663         }
1664 
1665         /* Process all TCP options. */
1666         tcp_process_options(eager, tcpha);
1667 
1668         /* Is the other end ECN capable? */
1669         if (tcps->tcps_ecn_permitted >= 1 &&
1670             (tcpha->tha_flags & (TH_ECE|TH_CWR)) == (TH_ECE|TH_CWR)) {
1671                 eager->tcp_ecn_ok = B_TRUE;
1672         }
1673 
1674         /*
1675          * The listener's conn_rcvbuf should be the default window size or a
1676          * window size changed via SO_RCVBUF option. First round up the
1677          * eager's tcp_rwnd to the nearest MSS. Then find out the window
1678          * scale option value if needed. Call tcp_rwnd_set() to finish the
1679          * setting.
1680          *
1681          * Note if there is a rpipe metric associated with the remote host,
1682          * we should not inherit receive window size from listener.
1683          */
1684         eager->tcp_rwnd = MSS_ROUNDUP(
1685             (eager->tcp_rwnd == 0 ? econnp->conn_rcvbuf :
1686             eager->tcp_rwnd), eager->tcp_mss);
1687         if (eager->tcp_snd_ws_ok)
1688                 tcp_set_ws_value(eager);
1689         /*
1690          * Note that this is the only place tcp_rwnd_set() is called for
1691          * accepting a connection.  We need to call it here instead of
1692          * after the 3-way handshake because we need to tell the other
1693          * side our rwnd in the SYN-ACK segment.
1694          */
1695         (void) tcp_rwnd_set(eager, eager->tcp_rwnd);
1696 
1697         ASSERT(eager->tcp_connp->conn_rcvbuf != 0 &&
1698             eager->tcp_connp->conn_rcvbuf == eager->tcp_rwnd);
1699 
1700         ASSERT(econnp->conn_rcvbuf != 0 &&
1701             econnp->conn_rcvbuf == eager->tcp_rwnd);
1702 
1703         /* Put a ref on the listener for the eager. */
1704         CONN_INC_REF(lconnp);
1705         mutex_enter(&listener->tcp_eager_lock);
1706         listener->tcp_eager_next_q0->tcp_eager_prev_q0 = eager;
1707         eager->tcp_eager_next_q0 = listener->tcp_eager_next_q0;
1708         listener->tcp_eager_next_q0 = eager;
1709         eager->tcp_eager_prev_q0 = listener;
1710 
1711         /* Set tcp_listener before adding it to tcp_conn_fanout */
1712         eager->tcp_listener = listener;
1713         eager->tcp_saved_listener = listener;
1714 
1715         /*
1716          * Set tcp_listen_cnt so that when the connection is done, the counter
1717          * is decremented.
1718          */
1719         eager->tcp_listen_cnt = listener->tcp_listen_cnt;
1720 
1721         /*
1722          * Tag this detached tcp vector for later retrieval
1723          * by our listener client in tcp_accept().
1724          */
1725         eager->tcp_conn_req_seqnum = listener->tcp_conn_req_seqnum;
1726         listener->tcp_conn_req_cnt_q0++;
1727         if (++listener->tcp_conn_req_seqnum == -1) {
1728                 /*
1729                  * -1 is "special" and defined in TPI as something
1730                  * that should never be used in T_CONN_IND
1731                  */
1732                 ++listener->tcp_conn_req_seqnum;
1733         }
1734         mutex_exit(&listener->tcp_eager_lock);
1735 
1736         if (listener->tcp_syn_defense) {
1737                 /* Don't drop the SYN that comes from a good IP source */
1738                 ipaddr_t *addr_cache;
1739 
1740                 addr_cache = (ipaddr_t *)(listener->tcp_ip_addr_cache);
1741                 if (addr_cache != NULL && econnp->conn_faddr_v4 ==
1742                     addr_cache[IP_ADDR_CACHE_HASH(econnp->conn_faddr_v4)]) {
1743                         eager->tcp_dontdrop = B_TRUE;
1744                 }
1745         }
1746 
1747         /*
1748          * We need to insert the eager in its own perimeter but as soon
1749          * as we do that, we expose the eager to the classifier and
1750          * should not touch any field outside the eager's perimeter.
1751          * So do all the work necessary before inserting the eager
1752          * in its own perimeter. Be optimistic that conn_connect()
1753          * will succeed but undo everything if it fails.
1754          */
1755         seg_seq = ntohl(tcpha->tha_seq);
1756         eager->tcp_irs = seg_seq;
1757         eager->tcp_rack = seg_seq;
1758         eager->tcp_rnxt = seg_seq + 1;
1759         eager->tcp_tcpha->tha_ack = htonl(eager->tcp_rnxt);
1760         TCPS_BUMP_MIB(tcps, tcpPassiveOpens);
1761         eager->tcp_state = TCPS_SYN_RCVD;
1762         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
1763             econnp->conn_ixa, void, NULL, tcp_t *, eager, void, NULL,
1764             int32_t, TCPS_LISTEN);
1765 
1766         mp1 = tcp_xmit_mp(eager, eager->tcp_xmit_head, eager->tcp_mss,
1767             NULL, NULL, eager->tcp_iss, B_FALSE, NULL, B_FALSE);
1768         if (mp1 == NULL) {
1769                 /*
1770                  * Increment the ref count as we are going to
1771                  * enqueueing an mp in squeue
1772                  */
1773                 CONN_INC_REF(econnp);
1774                 goto error;
1775         }
1776 
1777         /*
1778          * We need to start the rto timer. In normal case, we start
1779          * the timer after sending the packet on the wire (or at
1780          * least believing that packet was sent by waiting for
1781          * conn_ip_output() to return). Since this is the first packet
1782          * being sent on the wire for the eager, our initial tcp_rto
1783          * is at least tcp_rexmit_interval_min which is a fairly
1784          * large value to allow the algorithm to adjust slowly to large
1785          * fluctuations of RTT during first few transmissions.
1786          *
1787          * Starting the timer first and then sending the packet in this
1788          * case shouldn't make much difference since tcp_rexmit_interval_min
1789          * is of the order of several 100ms and starting the timer
1790          * first and then sending the packet will result in difference
1791          * of few micro seconds.
1792          *
1793          * Without this optimization, we are forced to hold the fanout
1794          * lock across the ipcl_bind_insert() and sending the packet
1795          * so that we don't race against an incoming packet (maybe RST)
1796          * for this eager.
1797          *
1798          * It is necessary to acquire an extra reference on the eager
1799          * at this point and hold it until after tcp_send_data() to
1800          * ensure against an eager close race.
1801          */
1802 
1803         CONN_INC_REF(econnp);
1804 
1805         TCP_TIMER_RESTART(eager, eager->tcp_rto);
1806 
1807         /*
1808          * Insert the eager in its own perimeter now. We are ready to deal
1809          * with any packets on eager.
1810          */
1811         if (ipcl_conn_insert(econnp) != 0)
1812                 goto error;
1813 
1814         ASSERT(econnp->conn_ixa->ixa_notify_cookie == econnp->conn_tcp);
1815         freemsg(mp);
1816         /*
1817          * Send the SYN-ACK. Use the right squeue so that conn_ixa is
1818          * only used by one thread at a time.
1819          */
1820         if (econnp->conn_sqp == lconnp->conn_sqp) {
1821                 DTRACE_TCP5(send, mblk_t *, NULL, ip_xmit_attr_t *,
1822                     econnp->conn_ixa, __dtrace_tcp_void_ip_t *, mp1->b_rptr,
1823                     tcp_t *, eager, __dtrace_tcp_tcph_t *,
1824                     &mp1->b_rptr[econnp->conn_ixa->ixa_ip_hdr_length]);
1825                 (void) conn_ip_output(mp1, econnp->conn_ixa);
1826                 CONN_DEC_REF(econnp);
1827         } else {
1828                 SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_send_synack,
1829                     econnp, NULL, SQ_PROCESS, SQTAG_TCP_SEND_SYNACK);
1830         }
1831         return;
1832 error:
1833         freemsg(mp1);
1834         eager->tcp_closemp_used = B_TRUE;
1835         TCP_DEBUG_GETPCSTACK(eager->tcmp_stk, 15);
1836         mp1 = &eager->tcp_closemp;
1837         SQUEUE_ENTER_ONE(econnp->conn_sqp, mp1, tcp_eager_kill,
1838             econnp, NULL, SQ_FILL, SQTAG_TCP_CONN_REQ_2);
1839 
1840         /*
1841          * If a connection already exists, send the mp to that connections so
1842          * that it can be appropriately dealt with.
1843          */
1844         ipst = tcps->tcps_netstack->netstack_ip;
1845 
1846         if ((econnp = ipcl_classify(mp, ira, ipst)) != NULL) {
1847                 if (!IPCL_IS_CONNECTED(econnp)) {
1848                         /*
1849                          * Something bad happened. ipcl_conn_insert()
1850                          * failed because a connection already existed
1851                          * in connected hash but we can't find it
1852                          * anymore (someone blew it away). Just
1853                          * free this message and hopefully remote
1854                          * will retransmit at which time the SYN can be
1855                          * treated as a new connection or dealth with
1856                          * a TH_RST if a connection already exists.
1857                          */
1858                         CONN_DEC_REF(econnp);
1859                         freemsg(mp);
1860                 } else {
1861                         SQUEUE_ENTER_ONE(econnp->conn_sqp, mp, tcp_input_data,
1862                             econnp, ira, SQ_FILL, SQTAG_TCP_CONN_REQ_1);
1863                 }
1864         } else {
1865                 /* Nobody wants this packet */
1866                 freemsg(mp);
1867         }
1868         return;
1869 error3:
1870         CONN_DEC_REF(econnp);
1871 error2:
1872         freemsg(mp);
1873         if (tlc_set)
1874                 atomic_add_32(&listener->tcp_listen_cnt->tlc_cnt, -1);
1875 }
1876 
1877 /*
1878  * In an ideal case of vertical partition in NUMA architecture, its
1879  * beneficial to have the listener and all the incoming connections
1880  * tied to the same squeue. The other constraint is that incoming
1881  * connections should be tied to the squeue attached to interrupted
1882  * CPU for obvious locality reason so this leaves the listener to
1883  * be tied to the same squeue. Our only problem is that when listener
1884  * is binding, the CPU that will get interrupted by the NIC whose
1885  * IP address the listener is binding to is not even known. So
1886  * the code below allows us to change that binding at the time the
1887  * CPU is interrupted by virtue of incoming connection's squeue.
1888  *
1889  * This is usefull only in case of a listener bound to a specific IP
1890  * address. For other kind of listeners, they get bound the
1891  * very first time and there is no attempt to rebind them.
1892  */
1893 void
1894 tcp_input_listener_unbound(void *arg, mblk_t *mp, void *arg2,
1895     ip_recv_attr_t *ira)
1896 {
1897         conn_t          *connp = (conn_t *)arg;
1898         squeue_t        *sqp = (squeue_t *)arg2;
1899         squeue_t        *new_sqp;
1900         uint32_t        conn_flags;
1901 
1902         /*
1903          * IP sets ira_sqp to either the senders conn_sqp (for loopback)
1904          * or based on the ring (for packets from GLD). Otherwise it is
1905          * set based on lbolt i.e., a somewhat random number.
1906          */
1907         ASSERT(ira->ira_sqp != NULL);
1908         new_sqp = ira->ira_sqp;
1909 
1910         if (connp->conn_fanout == NULL)
1911                 goto done;
1912 
1913         if (!(connp->conn_flags & IPCL_FULLY_BOUND)) {
1914                 mutex_enter(&connp->conn_fanout->connf_lock);
1915                 mutex_enter(&connp->conn_lock);
1916                 /*
1917                  * No one from read or write side can access us now
1918                  * except for already queued packets on this squeue.
1919                  * But since we haven't changed the squeue yet, they
1920                  * can't execute. If they are processed after we have
1921                  * changed the squeue, they are sent back to the
1922                  * correct squeue down below.
1923                  * But a listner close can race with processing of
1924                  * incoming SYN. If incoming SYN processing changes
1925                  * the squeue then the listener close which is waiting
1926                  * to enter the squeue would operate on the wrong
1927                  * squeue. Hence we don't change the squeue here unless
1928                  * the refcount is exactly the minimum refcount. The
1929                  * minimum refcount of 4 is counted as - 1 each for
1930                  * TCP and IP, 1 for being in the classifier hash, and
1931                  * 1 for the mblk being processed.
1932                  */
1933 
1934                 if (connp->conn_ref != 4 ||
1935                     connp->conn_tcp->tcp_state != TCPS_LISTEN) {
1936                         mutex_exit(&connp->conn_lock);
1937                         mutex_exit(&connp->conn_fanout->connf_lock);
1938                         goto done;
1939                 }
1940                 if (connp->conn_sqp != new_sqp) {
1941                         while (connp->conn_sqp != new_sqp)
1942                                 (void) casptr(&connp->conn_sqp, sqp, new_sqp);
1943                         /* No special MT issues for outbound ixa_sqp hint */
1944                         connp->conn_ixa->ixa_sqp = new_sqp;
1945                 }
1946 
1947                 do {
1948                         conn_flags = connp->conn_flags;
1949                         conn_flags |= IPCL_FULLY_BOUND;
1950                         (void) cas32(&connp->conn_flags, connp->conn_flags,
1951                             conn_flags);
1952                 } while (!(connp->conn_flags & IPCL_FULLY_BOUND));
1953 
1954                 mutex_exit(&connp->conn_fanout->connf_lock);
1955                 mutex_exit(&connp->conn_lock);
1956 
1957                 /*
1958                  * Assume we have picked a good squeue for the listener. Make
1959                  * subsequent SYNs not try to change the squeue.
1960                  */
1961                 connp->conn_recv = tcp_input_listener;
1962         }
1963 
1964 done:
1965         if (connp->conn_sqp != sqp) {
1966                 CONN_INC_REF(connp);
1967                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp, connp->conn_recv, connp,
1968                     ira, SQ_FILL, SQTAG_TCP_CONN_REQ_UNBOUND);
1969         } else {
1970                 tcp_input_listener(connp, mp, sqp, ira);
1971         }
1972 }
1973 
1974 /*
1975  * Send up all messages queued on tcp_rcv_list.
1976  */
1977 uint_t
1978 tcp_rcv_drain(tcp_t *tcp)
1979 {
1980         mblk_t *mp;
1981         uint_t ret = 0;
1982 #ifdef DEBUG
1983         uint_t cnt = 0;
1984 #endif
1985         queue_t *q = tcp->tcp_connp->conn_rq;
1986 
1987         /* Can't drain on an eager connection */
1988         if (tcp->tcp_listener != NULL)
1989                 return (ret);
1990 
1991         /* Can't be a non-STREAMS connection */
1992         ASSERT(!IPCL_IS_NONSTR(tcp->tcp_connp));
1993 
1994         /* No need for the push timer now. */
1995         if (tcp->tcp_push_tid != 0) {
1996                 (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_push_tid);
1997                 tcp->tcp_push_tid = 0;
1998         }
1999 
2000         /*
2001          * Handle two cases here: we are currently fused or we were
2002          * previously fused and have some urgent data to be delivered
2003          * upstream.  The latter happens because we either ran out of
2004          * memory or were detached and therefore sending the SIGURG was
2005          * deferred until this point.  In either case we pass control
2006          * over to tcp_fuse_rcv_drain() since it may need to complete
2007          * some work.
2008          */
2009         if ((tcp->tcp_fused || tcp->tcp_fused_sigurg)) {
2010                 if (tcp_fuse_rcv_drain(q, tcp, tcp->tcp_fused ? NULL :
2011                     &tcp->tcp_fused_sigurg_mp))
2012                         return (ret);
2013         }
2014 
2015         while ((mp = tcp->tcp_rcv_list) != NULL) {
2016                 tcp->tcp_rcv_list = mp->b_next;
2017                 mp->b_next = NULL;
2018 #ifdef DEBUG
2019                 cnt += msgdsize(mp);
2020 #endif
2021                 putnext(q, mp);
2022         }
2023 #ifdef DEBUG
2024         ASSERT(cnt == tcp->tcp_rcv_cnt);
2025 #endif
2026         tcp->tcp_rcv_last_head = NULL;
2027         tcp->tcp_rcv_last_tail = NULL;
2028         tcp->tcp_rcv_cnt = 0;
2029 
2030         if (canputnext(q))
2031                 return (tcp_rwnd_reopen(tcp));
2032 
2033         return (ret);
2034 }
2035 
2036 /*
2037  * Queue data on tcp_rcv_list which is a b_next chain.
2038  * tcp_rcv_last_head/tail is the last element of this chain.
2039  * Each element of the chain is a b_cont chain.
2040  *
2041  * M_DATA messages are added to the current element.
2042  * Other messages are added as new (b_next) elements.
2043  */
2044 void
2045 tcp_rcv_enqueue(tcp_t *tcp, mblk_t *mp, uint_t seg_len, cred_t *cr)
2046 {
2047         ASSERT(seg_len == msgdsize(mp));
2048         ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_rcv_last_head != NULL);
2049 
2050         if (is_system_labeled()) {
2051                 ASSERT(cr != NULL || msg_getcred(mp, NULL) != NULL);
2052                 /*
2053                  * Provide for protocols above TCP such as RPC. NOPID leaves
2054                  * db_cpid unchanged.
2055                  * The cred could have already been set.
2056                  */
2057                 if (cr != NULL)
2058                         mblk_setcred(mp, cr, NOPID);
2059         }
2060 
2061         if (tcp->tcp_rcv_list == NULL) {
2062                 ASSERT(tcp->tcp_rcv_last_head == NULL);
2063                 tcp->tcp_rcv_list = mp;
2064                 tcp->tcp_rcv_last_head = mp;
2065         } else if (DB_TYPE(mp) == DB_TYPE(tcp->tcp_rcv_last_head)) {
2066                 tcp->tcp_rcv_last_tail->b_cont = mp;
2067         } else {
2068                 tcp->tcp_rcv_last_head->b_next = mp;
2069                 tcp->tcp_rcv_last_head = mp;
2070         }
2071 
2072         while (mp->b_cont)
2073                 mp = mp->b_cont;
2074 
2075         tcp->tcp_rcv_last_tail = mp;
2076         tcp->tcp_rcv_cnt += seg_len;
2077         tcp->tcp_rwnd -= seg_len;
2078 }
2079 
2080 /* Generate an ACK-only (no data) segment for a TCP endpoint */
2081 mblk_t *
2082 tcp_ack_mp(tcp_t *tcp)
2083 {
2084         uint32_t        seq_no;
2085         tcp_stack_t     *tcps = tcp->tcp_tcps;
2086         conn_t          *connp = tcp->tcp_connp;
2087 
2088         /*
2089          * There are a few cases to be considered while setting the sequence no.
2090          * Essentially, we can come here while processing an unacceptable pkt
2091          * in the TCPS_SYN_RCVD state, in which case we set the sequence number
2092          * to snxt (per RFC 793), note the swnd wouldn't have been set yet.
2093          * If we are here for a zero window probe, stick with suna. In all
2094          * other cases, we check if suna + swnd encompasses snxt and set
2095          * the sequence number to snxt, if so. If snxt falls outside the
2096          * window (the receiver probably shrunk its window), we will go with
2097          * suna + swnd, otherwise the sequence no will be unacceptable to the
2098          * receiver.
2099          */
2100         if (tcp->tcp_zero_win_probe) {
2101                 seq_no = tcp->tcp_suna;
2102         } else if (tcp->tcp_state == TCPS_SYN_RCVD) {
2103                 ASSERT(tcp->tcp_swnd == 0);
2104                 seq_no = tcp->tcp_snxt;
2105         } else {
2106                 seq_no = SEQ_GT(tcp->tcp_snxt,
2107                     (tcp->tcp_suna + tcp->tcp_swnd)) ?
2108                     (tcp->tcp_suna + tcp->tcp_swnd) : tcp->tcp_snxt;
2109         }
2110 
2111         if (tcp->tcp_valid_bits) {
2112                 /*
2113                  * For the complex case where we have to send some
2114                  * controls (FIN or SYN), let tcp_xmit_mp do it.
2115                  */
2116                 return (tcp_xmit_mp(tcp, NULL, 0, NULL, NULL, seq_no, B_FALSE,
2117                     NULL, B_FALSE));
2118         } else {
2119                 /* Generate a simple ACK */
2120                 int     data_length;
2121                 uchar_t *rptr;
2122                 tcpha_t *tcpha;
2123                 mblk_t  *mp1;
2124                 int32_t total_hdr_len;
2125                 int32_t tcp_hdr_len;
2126                 int32_t num_sack_blk = 0;
2127                 int32_t sack_opt_len;
2128                 ip_xmit_attr_t *ixa = connp->conn_ixa;
2129 
2130                 /*
2131                  * Allocate space for TCP + IP headers
2132                  * and link-level header
2133                  */
2134                 if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
2135                         num_sack_blk = MIN(tcp->tcp_max_sack_blk,
2136                             tcp->tcp_num_sack_blk);
2137                         sack_opt_len = num_sack_blk * sizeof (sack_blk_t) +
2138                             TCPOPT_NOP_LEN * 2 + TCPOPT_HEADER_LEN;
2139                         total_hdr_len = connp->conn_ht_iphc_len + sack_opt_len;
2140                         tcp_hdr_len = connp->conn_ht_ulp_len + sack_opt_len;
2141                 } else {
2142                         total_hdr_len = connp->conn_ht_iphc_len;
2143                         tcp_hdr_len = connp->conn_ht_ulp_len;
2144                 }
2145                 mp1 = allocb(total_hdr_len + tcps->tcps_wroff_xtra, BPRI_MED);
2146                 if (!mp1)
2147                         return (NULL);
2148 
2149                 /* Update the latest receive window size in TCP header. */
2150                 tcp->tcp_tcpha->tha_win =
2151                     htons(tcp->tcp_rwnd >> tcp->tcp_rcv_ws);
2152                 /* copy in prototype TCP + IP header */
2153                 rptr = mp1->b_rptr + tcps->tcps_wroff_xtra;
2154                 mp1->b_rptr = rptr;
2155                 mp1->b_wptr = rptr + total_hdr_len;
2156                 bcopy(connp->conn_ht_iphc, rptr, connp->conn_ht_iphc_len);
2157 
2158                 tcpha = (tcpha_t *)&rptr[ixa->ixa_ip_hdr_length];
2159 
2160                 /* Set the TCP sequence number. */
2161                 tcpha->tha_seq = htonl(seq_no);
2162 
2163                 /* Set up the TCP flag field. */
2164                 tcpha->tha_flags = (uchar_t)TH_ACK;
2165                 if (tcp->tcp_ecn_echo_on)
2166                         tcpha->tha_flags |= TH_ECE;
2167 
2168                 tcp->tcp_rack = tcp->tcp_rnxt;
2169                 tcp->tcp_rack_cnt = 0;
2170 
2171                 /* fill in timestamp option if in use */
2172                 if (tcp->tcp_snd_ts_ok) {
2173                         uint32_t llbolt = (uint32_t)LBOLT_FASTPATH;
2174 
2175                         U32_TO_BE32(llbolt,
2176                             (char *)tcpha + TCP_MIN_HEADER_LENGTH+4);
2177                         U32_TO_BE32(tcp->tcp_ts_recent,
2178                             (char *)tcpha + TCP_MIN_HEADER_LENGTH+8);
2179                 }
2180 
2181                 /* Fill in SACK options */
2182                 if (num_sack_blk > 0) {
2183                         uchar_t *wptr = (uchar_t *)tcpha +
2184                             connp->conn_ht_ulp_len;
2185                         sack_blk_t *tmp;
2186                         int32_t i;
2187 
2188                         wptr[0] = TCPOPT_NOP;
2189                         wptr[1] = TCPOPT_NOP;
2190                         wptr[2] = TCPOPT_SACK;
2191                         wptr[3] = TCPOPT_HEADER_LEN + num_sack_blk *
2192                             sizeof (sack_blk_t);
2193                         wptr += TCPOPT_REAL_SACK_LEN;
2194 
2195                         tmp = tcp->tcp_sack_list;
2196                         for (i = 0; i < num_sack_blk; i++) {
2197                                 U32_TO_BE32(tmp[i].begin, wptr);
2198                                 wptr += sizeof (tcp_seq);
2199                                 U32_TO_BE32(tmp[i].end, wptr);
2200                                 wptr += sizeof (tcp_seq);
2201                         }
2202                         tcpha->tha_offset_and_reserved +=
2203                             ((num_sack_blk * 2 + 1) << 4);
2204                 }
2205 
2206                 ixa->ixa_pktlen = total_hdr_len;
2207 
2208                 if (ixa->ixa_flags & IXAF_IS_IPV4) {
2209                         ((ipha_t *)rptr)->ipha_length = htons(total_hdr_len);
2210                 } else {
2211                         ip6_t *ip6 = (ip6_t *)rptr;
2212 
2213                         ip6->ip6_plen = htons(total_hdr_len - IPV6_HDR_LEN);
2214                 }
2215 
2216                 /*
2217                  * Prime pump for checksum calculation in IP.  Include the
2218                  * adjustment for a source route if any.
2219                  */
2220                 data_length = tcp_hdr_len + connp->conn_sum;
2221                 data_length = (data_length >> 16) + (data_length & 0xFFFF);
2222                 tcpha->tha_sum = htons(data_length);
2223 
2224                 if (tcp->tcp_ip_forward_progress) {
2225                         tcp->tcp_ip_forward_progress = B_FALSE;
2226                         connp->conn_ixa->ixa_flags |= IXAF_REACH_CONF;
2227                 } else {
2228                         connp->conn_ixa->ixa_flags &= ~IXAF_REACH_CONF;
2229                 }
2230                 return (mp1);
2231         }
2232 }
2233 
2234 /*
2235  * Dummy socket upcalls for if/when the conn_t gets detached from a
2236  * direct-callback sonode via a user-driven close().  Easy to catch with
2237  * DTrace FBT, and should be mostly harmless.
2238  */
2239 
2240 /* ARGSUSED */
2241 static sock_upper_handle_t
2242 tcp_dummy_newconn(sock_upper_handle_t x, sock_lower_handle_t y,
2243     sock_downcalls_t *z, cred_t *cr, pid_t pid, sock_upcalls_t **ignored)
2244 {
2245         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2246         return (NULL);
2247 }
2248 
2249 /* ARGSUSED */
2250 static void
2251 tcp_dummy_connected(sock_upper_handle_t x, sock_connid_t y, cred_t *cr,
2252     pid_t pid)
2253 {
2254         ASSERT(x == NULL);
2255         /* Normally we'd crhold(cr) and attach it to socket state. */
2256         /* LINTED */
2257 }
2258 
2259 /* ARGSUSED */
2260 static int
2261 tcp_dummy_disconnected(sock_upper_handle_t x, sock_connid_t y, int blah)
2262 {
2263         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2264         return (-1);
2265 }
2266 
2267 /* ARGSUSED */
2268 static void
2269 tcp_dummy_opctl(sock_upper_handle_t x, sock_opctl_action_t y, uintptr_t blah)
2270 {
2271         ASSERT(x == NULL);
2272         /* We really want this one to be a harmless NOP for now. */
2273         /* LINTED */
2274 }
2275 
2276 /* ARGSUSED */
2277 static ssize_t
2278 tcp_dummy_recv(sock_upper_handle_t x, mblk_t *mp, size_t len, int flags,
2279     int *error, boolean_t *push)
2280 {
2281         ASSERT(x == NULL);
2282 
2283         /*
2284          * Consume the message, set ESHUTDOWN, and return an error.
2285          * Nobody's home!
2286          */
2287         freemsg(mp);
2288         *error = ESHUTDOWN;
2289         return (-1);
2290 }
2291 
2292 /* ARGSUSED */
2293 static void
2294 tcp_dummy_set_proto_props(sock_upper_handle_t x, struct sock_proto_props *y)
2295 {
2296         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2297 }
2298 
2299 /* ARGSUSED */
2300 static void
2301 tcp_dummy_txq_full(sock_upper_handle_t x, boolean_t y)
2302 {
2303         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2304 }
2305 
2306 /* ARGSUSED */
2307 static void
2308 tcp_dummy_signal_oob(sock_upper_handle_t x, ssize_t len)
2309 {
2310         ASSERT(x == NULL);
2311         /* Otherwise, this would signal socket state about OOB data. */
2312 }
2313 
2314 /* ARGSUSED */
2315 static void
2316 tcp_dummy_set_error(sock_upper_handle_t x, int err)
2317 {
2318         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2319 }
2320 
2321 /* ARGSUSED */
2322 static void
2323 tcp_dummy_onearg(sock_upper_handle_t x)
2324 {
2325         ASSERT(0);      /* Panic in debug, otherwise ignore. */
2326 }
2327 
2328 static sock_upcalls_t tcp_dummy_upcalls = {
2329         tcp_dummy_newconn,
2330         tcp_dummy_connected,
2331         tcp_dummy_disconnected,
2332         tcp_dummy_opctl,
2333         tcp_dummy_recv,
2334         tcp_dummy_set_proto_props,
2335         tcp_dummy_txq_full,
2336         tcp_dummy_signal_oob,
2337         tcp_dummy_onearg,
2338         tcp_dummy_set_error,
2339         tcp_dummy_onearg
2340 };
2341 
2342 /*
2343  * Handle M_DATA messages from IP. Its called directly from IP via
2344  * squeue for received IP packets.
2345  *
2346  * The first argument is always the connp/tcp to which the mp belongs.
2347  * There are no exceptions to this rule. The caller has already put
2348  * a reference on this connp/tcp and once tcp_input_data() returns,
2349  * the squeue will do the refrele.
2350  *
2351  * The TH_SYN for the listener directly go to tcp_input_listener via
2352  * squeue. ICMP errors go directly to tcp_icmp_input().
2353  *
2354  * sqp: NULL = recursive, sqp != NULL means called from squeue
2355  */
2356 void
2357 tcp_input_data(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
2358 {
2359         int32_t         bytes_acked;
2360         int32_t         gap;
2361         mblk_t          *mp1;
2362         uint_t          flags;
2363         uint32_t        new_swnd = 0;
2364         uchar_t         *iphdr;
2365         uchar_t         *rptr;
2366         int32_t         rgap;
2367         uint32_t        seg_ack;
2368         int             seg_len;
2369         uint_t          ip_hdr_len;
2370         uint32_t        seg_seq;
2371         tcpha_t         *tcpha;
2372         int             urp;
2373         tcp_opt_t       tcpopt;
2374         ip_pkt_t        ipp;
2375         boolean_t       ofo_seg = B_FALSE; /* Out of order segment */
2376         uint32_t        cwnd;
2377         uint32_t        add;
2378         int             npkt;
2379         int             mss;
2380         conn_t          *connp = (conn_t *)arg;
2381         squeue_t        *sqp = (squeue_t *)arg2;
2382         tcp_t           *tcp = connp->conn_tcp;
2383         tcp_stack_t     *tcps = tcp->tcp_tcps;
2384         sock_upcalls_t  *sockupcalls;
2385 
2386         /*
2387          * RST from fused tcp loopback peer should trigger an unfuse.
2388          */
2389         if (tcp->tcp_fused) {
2390                 TCP_STAT(tcps, tcp_fusion_aborted);
2391                 tcp_unfuse(tcp);
2392         }
2393 
2394         iphdr = mp->b_rptr;
2395         rptr = mp->b_rptr;
2396         ASSERT(OK_32PTR(rptr));
2397 
2398         ip_hdr_len = ira->ira_ip_hdr_length;
2399         if (connp->conn_recv_ancillary.crb_all != 0) {
2400                 /*
2401                  * Record packet information in the ip_pkt_t
2402                  */
2403                 ipp.ipp_fields = 0;
2404                 if (ira->ira_flags & IRAF_IS_IPV4) {
2405                         (void) ip_find_hdr_v4((ipha_t *)rptr, &ipp,
2406                             B_FALSE);
2407                 } else {
2408                         uint8_t nexthdrp;
2409 
2410                         /*
2411                          * IPv6 packets can only be received by applications
2412                          * that are prepared to receive IPv6 addresses.
2413                          * The IP fanout must ensure this.
2414                          */
2415                         ASSERT(connp->conn_family == AF_INET6);
2416 
2417                         (void) ip_find_hdr_v6(mp, (ip6_t *)rptr, B_TRUE, &ipp,
2418                             &nexthdrp);
2419                         ASSERT(nexthdrp == IPPROTO_TCP);
2420 
2421                         /* Could have caused a pullup? */
2422                         iphdr = mp->b_rptr;
2423                         rptr = mp->b_rptr;
2424                 }
2425         }
2426         ASSERT(DB_TYPE(mp) == M_DATA);
2427         ASSERT(mp->b_next == NULL);
2428 
2429         tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2430         seg_seq = ntohl(tcpha->tha_seq);
2431         seg_ack = ntohl(tcpha->tha_ack);
2432         ASSERT((uintptr_t)(mp->b_wptr - rptr) <= (uintptr_t)INT_MAX);
2433         seg_len = (int)(mp->b_wptr - rptr) -
2434             (ip_hdr_len + TCP_HDR_LENGTH(tcpha));
2435         if ((mp1 = mp->b_cont) != NULL && mp1->b_datap->db_type == M_DATA) {
2436                 do {
2437                         ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
2438                             (uintptr_t)INT_MAX);
2439                         seg_len += (int)(mp1->b_wptr - mp1->b_rptr);
2440                 } while ((mp1 = mp1->b_cont) != NULL &&
2441                     mp1->b_datap->db_type == M_DATA);
2442         }
2443 
2444         DTRACE_TCP5(receive, mblk_t *, NULL, ip_xmit_attr_t *, connp->conn_ixa,
2445             __dtrace_tcp_void_ip_t *, iphdr, tcp_t *, tcp,
2446             __dtrace_tcp_tcph_t *, tcpha);
2447 
2448         if (tcp->tcp_state == TCPS_TIME_WAIT) {
2449                 tcp_time_wait_processing(tcp, mp, seg_seq, seg_ack,
2450                     seg_len, tcpha, ira);
2451                 return;
2452         }
2453 
2454         if (sqp != NULL) {
2455                 /*
2456                  * This is the correct place to update tcp_last_recv_time. Note
2457                  * that it is also updated for tcp structure that belongs to
2458                  * global and listener queues which do not really need updating.
2459                  * But that should not cause any harm.  And it is updated for
2460                  * all kinds of incoming segments, not only for data segments.
2461                  */
2462                 tcp->tcp_last_recv_time = LBOLT_FASTPATH;
2463         }
2464 
2465         flags = (unsigned int)tcpha->tha_flags & 0xFF;
2466 
2467         BUMP_LOCAL(tcp->tcp_ibsegs);
2468         DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2469 
2470         if ((flags & TH_URG) && sqp != NULL) {
2471                 /*
2472                  * TCP can't handle urgent pointers that arrive before
2473                  * the connection has been accept()ed since it can't
2474                  * buffer OOB data.  Discard segment if this happens.
2475                  *
2476                  * We can't just rely on a non-null tcp_listener to indicate
2477                  * that the accept() has completed since unlinking of the
2478                  * eager and completion of the accept are not atomic.
2479                  * tcp_detached, when it is not set (B_FALSE) indicates
2480                  * that the accept() has completed.
2481                  *
2482                  * Nor can it reassemble urgent pointers, so discard
2483                  * if it's not the next segment expected.
2484                  *
2485                  * Otherwise, collapse chain into one mblk (discard if
2486                  * that fails).  This makes sure the headers, retransmitted
2487                  * data, and new data all are in the same mblk.
2488                  */
2489                 ASSERT(mp != NULL);
2490                 if (tcp->tcp_detached || !pullupmsg(mp, -1)) {
2491                         freemsg(mp);
2492                         return;
2493                 }
2494                 /* Update pointers into message */
2495                 iphdr = rptr = mp->b_rptr;
2496                 tcpha = (tcpha_t *)&rptr[ip_hdr_len];
2497                 if (SEQ_GT(seg_seq, tcp->tcp_rnxt)) {
2498                         /*
2499                          * Since we can't handle any data with this urgent
2500                          * pointer that is out of sequence, we expunge
2501                          * the data.  This allows us to still register
2502                          * the urgent mark and generate the M_PCSIG,
2503                          * which we can do.
2504                          */
2505                         mp->b_wptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2506                         seg_len = 0;
2507                 }
2508         }
2509 
2510         sockupcalls = connp->conn_upcalls;
2511         /* A conn_t may have belonged to a now-closed socket.  Be careful. */
2512         if (sockupcalls == NULL)
2513                 sockupcalls = &tcp_dummy_upcalls;
2514 
2515         switch (tcp->tcp_state) {
2516         case TCPS_SYN_SENT:
2517                 if (connp->conn_final_sqp == NULL &&
2518                     tcp_outbound_squeue_switch && sqp != NULL) {
2519                         ASSERT(connp->conn_initial_sqp == connp->conn_sqp);
2520                         connp->conn_final_sqp = sqp;
2521                         if (connp->conn_final_sqp != connp->conn_sqp) {
2522                                 DTRACE_PROBE1(conn__final__sqp__switch,
2523                                     conn_t *, connp);
2524                                 CONN_INC_REF(connp);
2525                                 SQUEUE_SWITCH(connp, connp->conn_final_sqp);
2526                                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
2527                                     tcp_input_data, connp, ira, ip_squeue_flag,
2528                                     SQTAG_CONNECT_FINISH);
2529                                 return;
2530                         }
2531                         DTRACE_PROBE1(conn__final__sqp__same, conn_t *, connp);
2532                 }
2533                 if (flags & TH_ACK) {
2534                         /*
2535                          * Note that our stack cannot send data before a
2536                          * connection is established, therefore the
2537                          * following check is valid.  Otherwise, it has
2538                          * to be changed.
2539                          */
2540                         if (SEQ_LEQ(seg_ack, tcp->tcp_iss) ||
2541                             SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2542                                 freemsg(mp);
2543                                 if (flags & TH_RST)
2544                                         return;
2545                                 tcp_xmit_ctl("TCPS_SYN_SENT-Bad_seq",
2546                                     tcp, seg_ack, 0, TH_RST);
2547                                 return;
2548                         }
2549                         ASSERT(tcp->tcp_suna + 1 == seg_ack);
2550                 }
2551                 if (flags & TH_RST) {
2552                         if (flags & TH_ACK) {
2553                                 DTRACE_TCP5(connect__refused, mblk_t *, NULL,
2554                                     ip_xmit_attr_t *, connp->conn_ixa,
2555                                     void_ip_t *, iphdr, tcp_t *, tcp,
2556                                     tcph_t *, tcpha);
2557                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
2558                         }
2559                         freemsg(mp);
2560                         return;
2561                 }
2562                 if (!(flags & TH_SYN)) {
2563                         freemsg(mp);
2564                         return;
2565                 }
2566 
2567                 /* Process all TCP options. */
2568                 tcp_process_options(tcp, tcpha);
2569                 /*
2570                  * The following changes our rwnd to be a multiple of the
2571                  * MIN(peer MSS, our MSS) for performance reason.
2572                  */
2573                 (void) tcp_rwnd_set(tcp, MSS_ROUNDUP(connp->conn_rcvbuf,
2574                     tcp->tcp_mss));
2575 
2576                 /* Is the other end ECN capable? */
2577                 if (tcp->tcp_ecn_ok) {
2578                         if ((flags & (TH_ECE|TH_CWR)) != TH_ECE) {
2579                                 tcp->tcp_ecn_ok = B_FALSE;
2580                         }
2581                 }
2582                 /*
2583                  * Clear ECN flags because it may interfere with later
2584                  * processing.
2585                  */
2586                 flags &= ~(TH_ECE|TH_CWR);
2587 
2588                 tcp->tcp_irs = seg_seq;
2589                 tcp->tcp_rack = seg_seq;
2590                 tcp->tcp_rnxt = seg_seq + 1;
2591                 tcp->tcp_tcpha->tha_ack = htonl(tcp->tcp_rnxt);
2592                 if (!TCP_IS_DETACHED(tcp)) {
2593                         /* Allocate room for SACK options if needed. */
2594                         connp->conn_wroff = connp->conn_ht_iphc_len;
2595                         if (tcp->tcp_snd_sack_ok)
2596                                 connp->conn_wroff += TCPOPT_MAX_SACK_LEN;
2597                         if (!tcp->tcp_loopback)
2598                                 connp->conn_wroff += tcps->tcps_wroff_xtra;
2599 
2600                         (void) proto_set_tx_wroff(connp->conn_rq, connp,
2601                             connp->conn_wroff);
2602                 }
2603                 if (flags & TH_ACK) {
2604                         /*
2605                          * If we can't get the confirmation upstream, pretend
2606                          * we didn't even see this one.
2607                          *
2608                          * XXX: how can we pretend we didn't see it if we
2609                          * have updated rnxt et. al.
2610                          *
2611                          * For loopback we defer sending up the T_CONN_CON
2612                          * until after some checks below.
2613                          */
2614                         mp1 = NULL;
2615                         /*
2616                          * tcp_sendmsg() checks tcp_state without entering
2617                          * the squeue so tcp_state should be updated before
2618                          * sending up connection confirmation.  Probe the
2619                          * state change below when we are sure the connection
2620                          * confirmation has been sent.
2621                          */
2622                         tcp->tcp_state = TCPS_ESTABLISHED;
2623                         if (!tcp_conn_con(tcp, iphdr, mp,
2624                             tcp->tcp_loopback ? &mp1 : NULL, ira)) {
2625                                 tcp->tcp_state = TCPS_SYN_SENT;
2626                                 freemsg(mp);
2627                                 return;
2628                         }
2629                         TCPS_CONN_INC(tcps);
2630                         /* SYN was acked - making progress */
2631                         tcp->tcp_ip_forward_progress = B_TRUE;
2632 
2633                         /* One for the SYN */
2634                         tcp->tcp_suna = tcp->tcp_iss + 1;
2635                         tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
2636 
2637                         /*
2638                          * If SYN was retransmitted, need to reset all
2639                          * retransmission info.  This is because this
2640                          * segment will be treated as a dup ACK.
2641                          */
2642                         if (tcp->tcp_rexmit) {
2643                                 tcp->tcp_rexmit = B_FALSE;
2644                                 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
2645                                 tcp->tcp_rexmit_max = tcp->tcp_snxt;
2646                                 tcp->tcp_snd_burst = tcp->tcp_localnet ?
2647                                     TCP_CWND_INFINITE : TCP_CWND_NORMAL;
2648                                 tcp->tcp_ms_we_have_waited = 0;
2649 
2650                                 /*
2651                                  * Set tcp_cwnd back to 1 MSS, per
2652                                  * recommendation from
2653                                  * draft-floyd-incr-init-win-01.txt,
2654                                  * Increasing TCP's Initial Window.
2655                                  */
2656                                 tcp->tcp_cwnd = tcp->tcp_mss;
2657                         }
2658 
2659                         tcp->tcp_swl1 = seg_seq;
2660                         tcp->tcp_swl2 = seg_ack;
2661 
2662                         new_swnd = ntohs(tcpha->tha_win);
2663                         tcp->tcp_swnd = new_swnd;
2664                         if (new_swnd > tcp->tcp_max_swnd)
2665                                 tcp->tcp_max_swnd = new_swnd;
2666 
2667                         /*
2668                          * Always send the three-way handshake ack immediately
2669                          * in order to make the connection complete as soon as
2670                          * possible on the accepting host.
2671                          */
2672                         flags |= TH_ACK_NEEDED;
2673 
2674                         /*
2675                          * Trace connect-established here.
2676                          */
2677                         DTRACE_TCP5(connect__established, mblk_t *, NULL,
2678                             ip_xmit_attr_t *, tcp->tcp_connp->conn_ixa,
2679                             void_ip_t *, iphdr, tcp_t *, tcp, tcph_t *, tcpha);
2680 
2681                         /* Trace change from SYN_SENT -> ESTABLISHED here */
2682                         DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2683                             connp->conn_ixa, void, NULL, tcp_t *, tcp,
2684                             void, NULL, int32_t, TCPS_SYN_SENT);
2685 
2686                         /*
2687                          * Special case for loopback.  At this point we have
2688                          * received SYN-ACK from the remote endpoint.  In
2689                          * order to ensure that both endpoints reach the
2690                          * fused state prior to any data exchange, the final
2691                          * ACK needs to be sent before we indicate T_CONN_CON
2692                          * to the module upstream.
2693                          */
2694                         if (tcp->tcp_loopback) {
2695                                 mblk_t *ack_mp;
2696 
2697                                 ASSERT(!tcp->tcp_unfusable);
2698                                 ASSERT(mp1 != NULL);
2699                                 /*
2700                                  * For loopback, we always get a pure SYN-ACK
2701                                  * and only need to send back the final ACK
2702                                  * with no data (this is because the other
2703                                  * tcp is ours and we don't do T/TCP).  This
2704                                  * final ACK triggers the passive side to
2705                                  * perform fusion in ESTABLISHED state.
2706                                  */
2707                                 if ((ack_mp = tcp_ack_mp(tcp)) != NULL) {
2708                                         if (tcp->tcp_ack_tid != 0) {
2709                                                 (void) TCP_TIMER_CANCEL(tcp,
2710                                                     tcp->tcp_ack_tid);
2711                                                 tcp->tcp_ack_tid = 0;
2712                                         }
2713                                         tcp_send_data(tcp, ack_mp);
2714                                         BUMP_LOCAL(tcp->tcp_obsegs);
2715                                         TCPS_BUMP_MIB(tcps, tcpOutAck);
2716 
2717                                         if (!IPCL_IS_NONSTR(connp)) {
2718                                                 /* Send up T_CONN_CON */
2719                                                 if (ira->ira_cred != NULL) {
2720                                                         mblk_setcred(mp1,
2721                                                             ira->ira_cred,
2722                                                             ira->ira_cpid);
2723                                                 }
2724                                                 putnext(connp->conn_rq, mp1);
2725                                         } else {
2726                                                 (*sockupcalls->su_connected)
2727                                                     (connp->conn_upper_handle,
2728                                                     tcp->tcp_connid,
2729                                                     ira->ira_cred,
2730                                                     ira->ira_cpid);
2731                                                 freemsg(mp1);
2732                                         }
2733 
2734                                         freemsg(mp);
2735                                         return;
2736                                 }
2737                                 /*
2738                                  * Forget fusion; we need to handle more
2739                                  * complex cases below.  Send the deferred
2740                                  * T_CONN_CON message upstream and proceed
2741                                  * as usual.  Mark this tcp as not capable
2742                                  * of fusion.
2743                                  */
2744                                 TCP_STAT(tcps, tcp_fusion_unfusable);
2745                                 tcp->tcp_unfusable = B_TRUE;
2746                                 if (!IPCL_IS_NONSTR(connp)) {
2747                                         if (ira->ira_cred != NULL) {
2748                                                 mblk_setcred(mp1, ira->ira_cred,
2749                                                     ira->ira_cpid);
2750                                         }
2751                                         putnext(connp->conn_rq, mp1);
2752                                 } else {
2753                                         (*sockupcalls->su_connected)
2754                                             (connp->conn_upper_handle,
2755                                             tcp->tcp_connid, ira->ira_cred,
2756                                             ira->ira_cpid);
2757                                         freemsg(mp1);
2758                                 }
2759                         }
2760 
2761                         /*
2762                          * Check to see if there is data to be sent.  If
2763                          * yes, set the transmit flag.  Then check to see
2764                          * if received data processing needs to be done.
2765                          * If not, go straight to xmit_check.  This short
2766                          * cut is OK as we don't support T/TCP.
2767                          */
2768                         if (tcp->tcp_unsent)
2769                                 flags |= TH_XMIT_NEEDED;
2770 
2771                         if (seg_len == 0 && !(flags & TH_URG)) {
2772                                 freemsg(mp);
2773                                 goto xmit_check;
2774                         }
2775 
2776                         flags &= ~TH_SYN;
2777                         seg_seq++;
2778                         break;
2779                 }
2780                 tcp->tcp_state = TCPS_SYN_RCVD;
2781                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
2782                     connp->conn_ixa, void_ip_t *, NULL, tcp_t *, tcp,
2783                     tcph_t *, NULL, int32_t, TCPS_SYN_SENT);
2784                 mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, tcp->tcp_mss,
2785                     NULL, NULL, tcp->tcp_iss, B_FALSE, NULL, B_FALSE);
2786                 if (mp1 != NULL) {
2787                         tcp_send_data(tcp, mp1);
2788                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
2789                 }
2790                 freemsg(mp);
2791                 return;
2792         case TCPS_SYN_RCVD:
2793                 if (flags & TH_ACK) {
2794                         uint32_t pinit_wnd;
2795 
2796                         /*
2797                          * In this state, a SYN|ACK packet is either bogus
2798                          * because the other side must be ACKing our SYN which
2799                          * indicates it has seen the ACK for their SYN and
2800                          * shouldn't retransmit it or we're crossing SYNs
2801                          * on active open.
2802                          */
2803                         if ((flags & TH_SYN) && !tcp->tcp_active_open) {
2804                                 freemsg(mp);
2805                                 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_syn",
2806                                     tcp, seg_ack, 0, TH_RST);
2807                                 return;
2808                         }
2809                         /*
2810                          * NOTE: RFC 793 pg. 72 says this should be
2811                          * tcp->tcp_suna <= seg_ack <= tcp->tcp_snxt
2812                          * but that would mean we have an ack that ignored
2813                          * our SYN.
2814                          */
2815                         if (SEQ_LEQ(seg_ack, tcp->tcp_suna) ||
2816                             SEQ_GT(seg_ack, tcp->tcp_snxt)) {
2817                                 freemsg(mp);
2818                                 tcp_xmit_ctl("TCPS_SYN_RCVD-bad_ack",
2819                                     tcp, seg_ack, 0, TH_RST);
2820                                 return;
2821                         }
2822                         /*
2823                          * No sane TCP stack will send such a small window
2824                          * without receiving any data.  Just drop this invalid
2825                          * ACK.  We also shorten the abort timeout in case
2826                          * this is an attack.
2827                          */
2828                         pinit_wnd = ntohs(tcpha->tha_win) << tcp->tcp_snd_ws;
2829                         if (pinit_wnd < tcp->tcp_mss &&
2830                             pinit_wnd < tcp_init_wnd_chk) {
2831                                 freemsg(mp);
2832                                 TCP_STAT(tcps, tcp_zwin_ack_syn);
2833                                 tcp->tcp_second_ctimer_threshold =
2834                                     tcp_early_abort * SECONDS;
2835                                 return;
2836                         }
2837                 }
2838                 break;
2839         case TCPS_LISTEN:
2840                 /*
2841                  * Only a TLI listener can come through this path when a
2842                  * acceptor is going back to be a listener and a packet
2843                  * for the acceptor hits the classifier. For a socket
2844                  * listener, this can never happen because a listener
2845                  * can never accept connection on itself and hence a
2846                  * socket acceptor can not go back to being a listener.
2847                  */
2848                 ASSERT(!TCP_IS_SOCKET(tcp));
2849                 /*FALLTHRU*/
2850         case TCPS_CLOSED:
2851         case TCPS_BOUND: {
2852                 conn_t  *new_connp;
2853                 ip_stack_t *ipst = tcps->tcps_netstack->netstack_ip;
2854 
2855                 /*
2856                  * Don't accept any input on a closed tcp as this TCP logically
2857                  * does not exist on the system. Don't proceed further with
2858                  * this TCP. For instance, this packet could trigger another
2859                  * close of this tcp which would be disastrous for tcp_refcnt.
2860                  * tcp_close_detached / tcp_clean_death / tcp_closei_local must
2861                  * be called at most once on a TCP. In this case we need to
2862                  * refeed the packet into the classifier and figure out where
2863                  * the packet should go.
2864                  */
2865                 new_connp = ipcl_classify(mp, ira, ipst);
2866                 if (new_connp != NULL) {
2867                         /* Drops ref on new_connp */
2868                         tcp_reinput(new_connp, mp, ira, ipst);
2869                         return;
2870                 }
2871                 /* We failed to classify. For now just drop the packet */
2872                 freemsg(mp);
2873                 return;
2874         }
2875         case TCPS_IDLE:
2876                 /*
2877                  * Handle the case where the tcp_clean_death() has happened
2878                  * on a connection (application hasn't closed yet) but a packet
2879                  * was already queued on squeue before tcp_clean_death()
2880                  * was processed. Calling tcp_clean_death() twice on same
2881                  * connection can result in weird behaviour.
2882                  */
2883                 freemsg(mp);
2884                 return;
2885         default:
2886                 break;
2887         }
2888 
2889         /*
2890          * Already on the correct queue/perimeter.
2891          * If this is a detached connection and not an eager
2892          * connection hanging off a listener then new data
2893          * (past the FIN) will cause a reset.
2894          * We do a special check here where it
2895          * is out of the main line, rather than check
2896          * if we are detached every time we see new
2897          * data down below.
2898          */
2899         if (TCP_IS_DETACHED_NONEAGER(tcp) &&
2900             (seg_len > 0 && SEQ_GT(seg_seq + seg_len, tcp->tcp_rnxt))) {
2901                 TCPS_BUMP_MIB(tcps, tcpInClosed);
2902                 DTRACE_PROBE2(tcp__trace__recv, mblk_t *, mp, tcp_t *, tcp);
2903                 freemsg(mp);
2904                 tcp_xmit_ctl("new data when detached", tcp,
2905                     tcp->tcp_snxt, 0, TH_RST);
2906                 (void) tcp_clean_death(tcp, EPROTO);
2907                 return;
2908         }
2909 
2910         mp->b_rptr = (uchar_t *)tcpha + TCP_HDR_LENGTH(tcpha);
2911         urp = ntohs(tcpha->tha_urp) - TCP_OLD_URP_INTERPRETATION;
2912         new_swnd = ntohs(tcpha->tha_win) <<
2913             ((tcpha->tha_flags & TH_SYN) ? 0 : tcp->tcp_snd_ws);
2914 
2915         if (tcp->tcp_snd_ts_ok) {
2916                 if (!tcp_paws_check(tcp, tcpha, &tcpopt)) {
2917                         /*
2918                          * This segment is not acceptable.
2919                          * Drop it and send back an ACK.
2920                          */
2921                         freemsg(mp);
2922                         flags |= TH_ACK_NEEDED;
2923                         goto ack_check;
2924                 }
2925         } else if (tcp->tcp_snd_sack_ok) {
2926                 tcpopt.tcp = tcp;
2927                 /*
2928                  * SACK info in already updated in tcp_parse_options.  Ignore
2929                  * all other TCP options...
2930                  */
2931                 (void) tcp_parse_options(tcpha, &tcpopt);
2932         }
2933 try_again:;
2934         mss = tcp->tcp_mss;
2935         gap = seg_seq - tcp->tcp_rnxt;
2936         rgap = tcp->tcp_rwnd - (gap + seg_len);
2937         /*
2938          * gap is the amount of sequence space between what we expect to see
2939          * and what we got for seg_seq.  A positive value for gap means
2940          * something got lost.  A negative value means we got some old stuff.
2941          */
2942         if (gap < 0) {
2943                 /* Old stuff present.  Is the SYN in there? */
2944                 if (seg_seq == tcp->tcp_irs && (flags & TH_SYN) &&
2945                     (seg_len != 0)) {
2946                         flags &= ~TH_SYN;
2947                         seg_seq++;
2948                         urp--;
2949                         /* Recompute the gaps after noting the SYN. */
2950                         goto try_again;
2951                 }
2952                 TCPS_BUMP_MIB(tcps, tcpInDataDupSegs);
2953                 TCPS_UPDATE_MIB(tcps, tcpInDataDupBytes,
2954                     (seg_len > -gap ? -gap : seg_len));
2955                 /* Remove the old stuff from seg_len. */
2956                 seg_len += gap;
2957                 /*
2958                  * Anything left?
2959                  * Make sure to check for unack'd FIN when rest of data
2960                  * has been previously ack'd.
2961                  */
2962                 if (seg_len < 0 || (seg_len == 0 && !(flags & TH_FIN))) {
2963                         /*
2964                          * Resets are only valid if they lie within our offered
2965                          * window.  If the RST bit is set, we just ignore this
2966                          * segment.
2967                          */
2968                         if (flags & TH_RST) {
2969                                 freemsg(mp);
2970                                 return;
2971                         }
2972 
2973                         /*
2974                          * The arriving of dup data packets indicate that we
2975                          * may have postponed an ack for too long, or the other
2976                          * side's RTT estimate is out of shape. Start acking
2977                          * more often.
2978                          */
2979                         if (SEQ_GEQ(seg_seq + seg_len - gap, tcp->tcp_rack) &&
2980                             tcp->tcp_rack_cnt >= 1 &&
2981                             tcp->tcp_rack_abs_max > 2) {
2982                                 tcp->tcp_rack_abs_max--;
2983                         }
2984                         tcp->tcp_rack_cur_max = 1;
2985 
2986                         /*
2987                          * This segment is "unacceptable".  None of its
2988                          * sequence space lies within our advertized window.
2989                          *
2990                          * Adjust seg_len to the original value for tracing.
2991                          */
2992                         seg_len -= gap;
2993                         if (connp->conn_debug) {
2994                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
2995                                     "tcp_rput: unacceptable, gap %d, rgap %d, "
2996                                     "flags 0x%x, seg_seq %u, seg_ack %u, "
2997                                     "seg_len %d, rnxt %u, snxt %u, %s",
2998                                     gap, rgap, flags, seg_seq, seg_ack,
2999                                     seg_len, tcp->tcp_rnxt, tcp->tcp_snxt,
3000                                     tcp_display(tcp, NULL,
3001                                     DISP_ADDR_AND_PORT));
3002                         }
3003 
3004                         /*
3005                          * Arrange to send an ACK in response to the
3006                          * unacceptable segment per RFC 793 page 69. There
3007                          * is only one small difference between ours and the
3008                          * acceptability test in the RFC - we accept ACK-only
3009                          * packet with SEG.SEQ = RCV.NXT+RCV.WND and no ACK
3010                          * will be generated.
3011                          *
3012                          * Note that we have to ACK an ACK-only packet at least
3013                          * for stacks that send 0-length keep-alives with
3014                          * SEG.SEQ = SND.NXT-1 as recommended by RFC1122,
3015                          * section 4.2.3.6. As long as we don't ever generate
3016                          * an unacceptable packet in response to an incoming
3017                          * packet that is unacceptable, it should not cause
3018                          * "ACK wars".
3019                          */
3020                         flags |=  TH_ACK_NEEDED;
3021 
3022                         /*
3023                          * Continue processing this segment in order to use the
3024                          * ACK information it contains, but skip all other
3025                          * sequence-number processing.  Processing the ACK
3026                          * information is necessary in order to
3027                          * re-synchronize connections that may have lost
3028                          * synchronization.
3029                          *
3030                          * We clear seg_len and flag fields related to
3031                          * sequence number processing as they are not
3032                          * to be trusted for an unacceptable segment.
3033                          */
3034                         seg_len = 0;
3035                         flags &= ~(TH_SYN | TH_FIN | TH_URG);
3036                         goto process_ack;
3037                 }
3038 
3039                 /* Fix seg_seq, and chew the gap off the front. */
3040                 seg_seq = tcp->tcp_rnxt;
3041                 urp += gap;
3042                 do {
3043                         mblk_t  *mp2;
3044                         ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3045                             (uintptr_t)UINT_MAX);
3046                         gap += (uint_t)(mp->b_wptr - mp->b_rptr);
3047                         if (gap > 0) {
3048                                 mp->b_rptr = mp->b_wptr - gap;
3049                                 break;
3050                         }
3051                         mp2 = mp;
3052                         mp = mp->b_cont;
3053                         freeb(mp2);
3054                 } while (gap < 0);
3055                 /*
3056                  * If the urgent data has already been acknowledged, we
3057                  * should ignore TH_URG below
3058                  */
3059                 if (urp < 0)
3060                         flags &= ~TH_URG;
3061         }
3062         /*
3063          * rgap is the amount of stuff received out of window.  A negative
3064          * value is the amount out of window.
3065          */
3066         if (rgap < 0) {
3067                 mblk_t  *mp2;
3068 
3069                 if (tcp->tcp_rwnd == 0) {
3070                         TCPS_BUMP_MIB(tcps, tcpInWinProbe);
3071                 } else {
3072                         TCPS_BUMP_MIB(tcps, tcpInDataPastWinSegs);
3073                         TCPS_UPDATE_MIB(tcps, tcpInDataPastWinBytes, -rgap);
3074                 }
3075 
3076                 /*
3077                  * seg_len does not include the FIN, so if more than
3078                  * just the FIN is out of window, we act like we don't
3079                  * see it.  (If just the FIN is out of window, rgap
3080                  * will be zero and we will go ahead and acknowledge
3081                  * the FIN.)
3082                  */
3083                 flags &= ~TH_FIN;
3084 
3085                 /* Fix seg_len and make sure there is something left. */
3086                 seg_len += rgap;
3087                 if (seg_len <= 0) {
3088                         /*
3089                          * Resets are only valid if they lie within our offered
3090                          * window.  If the RST bit is set, we just ignore this
3091                          * segment.
3092                          */
3093                         if (flags & TH_RST) {
3094                                 freemsg(mp);
3095                                 return;
3096                         }
3097 
3098                         /* Per RFC 793, we need to send back an ACK. */
3099                         flags |= TH_ACK_NEEDED;
3100 
3101                         /*
3102                          * Send SIGURG as soon as possible i.e. even
3103                          * if the TH_URG was delivered in a window probe
3104                          * packet (which will be unacceptable).
3105                          *
3106                          * We generate a signal if none has been generated
3107                          * for this connection or if this is a new urgent
3108                          * byte. Also send a zero-length "unmarked" message
3109                          * to inform SIOCATMARK that this is not the mark.
3110                          *
3111                          * tcp_urp_last_valid is cleared when the T_exdata_ind
3112                          * is sent up. This plus the check for old data
3113                          * (gap >= 0) handles the wraparound of the sequence
3114                          * number space without having to always track the
3115                          * correct MAX(tcp_urp_last, tcp_rnxt). (BSD tracks
3116                          * this max in its rcv_up variable).
3117                          *
3118                          * This prevents duplicate SIGURGS due to a "late"
3119                          * zero-window probe when the T_EXDATA_IND has already
3120                          * been sent up.
3121                          */
3122                         if ((flags & TH_URG) &&
3123                             (!tcp->tcp_urp_last_valid || SEQ_GT(urp + seg_seq,
3124                             tcp->tcp_urp_last))) {
3125                                 if (IPCL_IS_NONSTR(connp)) {
3126                                         if (!TCP_IS_DETACHED(tcp)) {
3127                                                 (*sockupcalls->su_signal_oob)
3128                                                     (connp->conn_upper_handle,
3129                                                     urp);
3130                                         }
3131                                 } else {
3132                                         mp1 = allocb(0, BPRI_MED);
3133                                         if (mp1 == NULL) {
3134                                                 freemsg(mp);
3135                                                 return;
3136                                         }
3137                                         if (!TCP_IS_DETACHED(tcp) &&
3138                                             !putnextctl1(connp->conn_rq,
3139                                             M_PCSIG, SIGURG)) {
3140                                                 /* Try again on the rexmit. */
3141                                                 freemsg(mp1);
3142                                                 freemsg(mp);
3143                                                 return;
3144                                         }
3145                                         /*
3146                                          * If the next byte would be the mark
3147                                          * then mark with MARKNEXT else mark
3148                                          * with NOTMARKNEXT.
3149                                          */
3150                                         if (gap == 0 && urp == 0)
3151                                                 mp1->b_flag |= MSGMARKNEXT;
3152                                         else
3153                                                 mp1->b_flag |= MSGNOTMARKNEXT;
3154                                         freemsg(tcp->tcp_urp_mark_mp);
3155                                         tcp->tcp_urp_mark_mp = mp1;
3156                                         flags |= TH_SEND_URP_MARK;
3157                                 }
3158                                 tcp->tcp_urp_last_valid = B_TRUE;
3159                                 tcp->tcp_urp_last = urp + seg_seq;
3160                         }
3161                         /*
3162                          * If this is a zero window probe, continue to
3163                          * process the ACK part.  But we need to set seg_len
3164                          * to 0 to avoid data processing.  Otherwise just
3165                          * drop the segment and send back an ACK.
3166                          */
3167                         if (tcp->tcp_rwnd == 0 && seg_seq == tcp->tcp_rnxt) {
3168                                 flags &= ~(TH_SYN | TH_URG);
3169                                 seg_len = 0;
3170                                 goto process_ack;
3171                         } else {
3172                                 freemsg(mp);
3173                                 goto ack_check;
3174                         }
3175                 }
3176                 /* Pitch out of window stuff off the end. */
3177                 rgap = seg_len;
3178                 mp2 = mp;
3179                 do {
3180                         ASSERT((uintptr_t)(mp2->b_wptr - mp2->b_rptr) <=
3181                             (uintptr_t)INT_MAX);
3182                         rgap -= (int)(mp2->b_wptr - mp2->b_rptr);
3183                         if (rgap < 0) {
3184                                 mp2->b_wptr += rgap;
3185                                 if ((mp1 = mp2->b_cont) != NULL) {
3186                                         mp2->b_cont = NULL;
3187                                         freemsg(mp1);
3188                                 }
3189                                 break;
3190                         }
3191                 } while ((mp2 = mp2->b_cont) != NULL);
3192         }
3193 ok:;
3194         /*
3195          * TCP should check ECN info for segments inside the window only.
3196          * Therefore the check should be done here.
3197          */
3198         if (tcp->tcp_ecn_ok) {
3199                 if (flags & TH_CWR) {
3200                         tcp->tcp_ecn_echo_on = B_FALSE;
3201                 }
3202                 /*
3203                  * Note that both ECN_CE and CWR can be set in the
3204                  * same segment.  In this case, we once again turn
3205                  * on ECN_ECHO.
3206                  */
3207                 if (connp->conn_ipversion == IPV4_VERSION) {
3208                         uchar_t tos = ((ipha_t *)rptr)->ipha_type_of_service;
3209 
3210                         if ((tos & IPH_ECN_CE) == IPH_ECN_CE) {
3211                                 tcp->tcp_ecn_echo_on = B_TRUE;
3212                         }
3213                 } else {
3214                         uint32_t vcf = ((ip6_t *)rptr)->ip6_vcf;
3215 
3216                         if ((vcf & htonl(IPH_ECN_CE << 20)) ==
3217                             htonl(IPH_ECN_CE << 20)) {
3218                                 tcp->tcp_ecn_echo_on = B_TRUE;
3219                         }
3220                 }
3221         }
3222 
3223         /*
3224          * Check whether we can update tcp_ts_recent.  This test is
3225          * NOT the one in RFC 1323 3.4.  It is from Braden, 1993, "TCP
3226          * Extensions for High Performance: An Update", Internet Draft.
3227          */
3228         if (tcp->tcp_snd_ts_ok &&
3229             TSTMP_GEQ(tcpopt.tcp_opt_ts_val, tcp->tcp_ts_recent) &&
3230             SEQ_LEQ(seg_seq, tcp->tcp_rack)) {
3231                 tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;
3232                 tcp->tcp_last_rcv_lbolt = LBOLT_FASTPATH64;
3233         }
3234 
3235         if (seg_seq != tcp->tcp_rnxt || tcp->tcp_reass_head) {
3236                 /*
3237                  * FIN in an out of order segment.  We record this in
3238                  * tcp_valid_bits and the seq num of FIN in tcp_ofo_fin_seq.
3239                  * Clear the FIN so that any check on FIN flag will fail.
3240                  * Remember that FIN also counts in the sequence number
3241                  * space.  So we need to ack out of order FIN only segments.
3242                  */
3243                 if (flags & TH_FIN) {
3244                         tcp->tcp_valid_bits |= TCP_OFO_FIN_VALID;
3245                         tcp->tcp_ofo_fin_seq = seg_seq + seg_len;
3246                         flags &= ~TH_FIN;
3247                         flags |= TH_ACK_NEEDED;
3248                 }
3249                 if (seg_len > 0) {
3250                         /* Fill in the SACK blk list. */
3251                         if (tcp->tcp_snd_sack_ok) {
3252                                 tcp_sack_insert(tcp->tcp_sack_list,
3253                                     seg_seq, seg_seq + seg_len,
3254                                     &(tcp->tcp_num_sack_blk));
3255                         }
3256 
3257                         /*
3258                          * Attempt reassembly and see if we have something
3259                          * ready to go.
3260                          */
3261                         mp = tcp_reass(tcp, mp, seg_seq);
3262                         /* Always ack out of order packets */
3263                         flags |= TH_ACK_NEEDED | TH_PUSH;
3264                         if (mp) {
3265                                 ASSERT((uintptr_t)(mp->b_wptr - mp->b_rptr) <=
3266                                     (uintptr_t)INT_MAX);
3267                                 seg_len = mp->b_cont ? msgdsize(mp) :
3268                                     (int)(mp->b_wptr - mp->b_rptr);
3269                                 seg_seq = tcp->tcp_rnxt;
3270                                 /*
3271                                  * A gap is filled and the seq num and len
3272                                  * of the gap match that of a previously
3273                                  * received FIN, put the FIN flag back in.
3274                                  */
3275                                 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3276                                     seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3277                                         flags |= TH_FIN;
3278                                         tcp->tcp_valid_bits &=
3279                                             ~TCP_OFO_FIN_VALID;
3280                                 }
3281                                 if (tcp->tcp_reass_tid != 0) {
3282                                         (void) TCP_TIMER_CANCEL(tcp,
3283                                             tcp->tcp_reass_tid);
3284                                         /*
3285                                          * Restart the timer if there is still
3286                                          * data in the reassembly queue.
3287                                          */
3288                                         if (tcp->tcp_reass_head != NULL) {
3289                                                 tcp->tcp_reass_tid = TCP_TIMER(
3290                                                     tcp, tcp_reass_timer,
3291                                                     tcps->tcps_reass_timeout);
3292                                         } else {
3293                                                 tcp->tcp_reass_tid = 0;
3294                                         }
3295                                 }
3296                         } else {
3297                                 /*
3298                                  * Keep going even with NULL mp.
3299                                  * There may be a useful ACK or something else
3300                                  * we don't want to miss.
3301                                  *
3302                                  * But TCP should not perform fast retransmit
3303                                  * because of the ack number.  TCP uses
3304                                  * seg_len == 0 to determine if it is a pure
3305                                  * ACK.  And this is not a pure ACK.
3306                                  */
3307                                 seg_len = 0;
3308                                 ofo_seg = B_TRUE;
3309 
3310                                 if (tcps->tcps_reass_timeout != 0 &&
3311                                     tcp->tcp_reass_tid == 0) {
3312                                         tcp->tcp_reass_tid = TCP_TIMER(tcp,
3313                                             tcp_reass_timer,
3314                                             tcps->tcps_reass_timeout);
3315                                 }
3316                         }
3317                 }
3318         } else if (seg_len > 0) {
3319                 TCPS_BUMP_MIB(tcps, tcpInDataInorderSegs);
3320                 TCPS_UPDATE_MIB(tcps, tcpInDataInorderBytes, seg_len);
3321                 /*
3322                  * If an out of order FIN was received before, and the seq
3323                  * num and len of the new segment match that of the FIN,
3324                  * put the FIN flag back in.
3325                  */
3326                 if ((tcp->tcp_valid_bits & TCP_OFO_FIN_VALID) &&
3327                     seg_seq + seg_len == tcp->tcp_ofo_fin_seq) {
3328                         flags |= TH_FIN;
3329                         tcp->tcp_valid_bits &= ~TCP_OFO_FIN_VALID;
3330                 }
3331         }
3332         if ((flags & (TH_RST | TH_SYN | TH_URG | TH_ACK)) != TH_ACK) {
3333         if (flags & TH_RST) {
3334                 freemsg(mp);
3335                 switch (tcp->tcp_state) {
3336                 case TCPS_SYN_RCVD:
3337                         (void) tcp_clean_death(tcp, ECONNREFUSED);
3338                         break;
3339                 case TCPS_ESTABLISHED:
3340                 case TCPS_FIN_WAIT_1:
3341                 case TCPS_FIN_WAIT_2:
3342                 case TCPS_CLOSE_WAIT:
3343                         (void) tcp_clean_death(tcp, ECONNRESET);
3344                         break;
3345                 case TCPS_CLOSING:
3346                 case TCPS_LAST_ACK:
3347                         (void) tcp_clean_death(tcp, 0);
3348                         break;
3349                 default:
3350                         ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3351                         (void) tcp_clean_death(tcp, ENXIO);
3352                         break;
3353                 }
3354                 return;
3355         }
3356         if (flags & TH_SYN) {
3357                 /*
3358                  * See RFC 793, Page 71
3359                  *
3360                  * The seq number must be in the window as it should
3361                  * be "fixed" above.  If it is outside window, it should
3362                  * be already rejected.  Note that we allow seg_seq to be
3363                  * rnxt + rwnd because we want to accept 0 window probe.
3364                  */
3365                 ASSERT(SEQ_GEQ(seg_seq, tcp->tcp_rnxt) &&
3366                     SEQ_LEQ(seg_seq, tcp->tcp_rnxt + tcp->tcp_rwnd));
3367                 freemsg(mp);
3368                 /*
3369                  * If the ACK flag is not set, just use our snxt as the
3370                  * seq number of the RST segment.
3371                  */
3372                 if (!(flags & TH_ACK)) {
3373                         seg_ack = tcp->tcp_snxt;
3374                 }
3375                 tcp_xmit_ctl("TH_SYN", tcp, seg_ack, seg_seq + 1,
3376                     TH_RST|TH_ACK);
3377                 ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
3378                 (void) tcp_clean_death(tcp, ECONNRESET);
3379                 return;
3380         }
3381         /*
3382          * urp could be -1 when the urp field in the packet is 0
3383          * and TCP_OLD_URP_INTERPRETATION is set. This implies that the urgent
3384          * byte was at seg_seq - 1, in which case we ignore the urgent flag.
3385          */
3386         if (flags & TH_URG && urp >= 0) {
3387                 if (!tcp->tcp_urp_last_valid ||
3388                     SEQ_GT(urp + seg_seq, tcp->tcp_urp_last)) {
3389                         /*
3390                          * Non-STREAMS sockets handle the urgent data a litte
3391                          * differently from STREAMS based sockets. There is no
3392                          * need to mark any mblks with the MSG{NOT,}MARKNEXT
3393                          * flags to keep SIOCATMARK happy. Instead a
3394                          * su_signal_oob upcall is made to update the mark.
3395                          * Neither is a T_EXDATA_IND mblk needed to be
3396                          * prepended to the urgent data. The urgent data is
3397                          * delivered using the su_recv upcall, where we set
3398                          * the MSG_OOB flag to indicate that it is urg data.
3399                          *
3400                          * Neither TH_SEND_URP_MARK nor TH_MARKNEXT_NEEDED
3401                          * are used by non-STREAMS sockets.
3402                          */
3403                         if (IPCL_IS_NONSTR(connp)) {
3404                                 if (!TCP_IS_DETACHED(tcp)) {
3405                                         (*sockupcalls->su_signal_oob)
3406                                             (connp->conn_upper_handle, urp);
3407                                 }
3408                         } else {
3409                                 /*
3410                                  * If we haven't generated the signal yet for
3411                                  * this urgent pointer value, do it now.  Also,
3412                                  * send up a zero-length M_DATA indicating
3413                                  * whether or not this is the mark. The latter
3414                                  * is not needed when a T_EXDATA_IND is sent up.
3415                                  * However, if there are allocation failures
3416                                  * this code relies on the sender retransmitting
3417                                  * and the socket code for determining the mark
3418                                  * should not block waiting for the peer to
3419                                  * transmit. Thus, for simplicity we always
3420                                  * send up the mark indication.
3421                                  */
3422                                 mp1 = allocb(0, BPRI_MED);
3423                                 if (mp1 == NULL) {
3424                                         freemsg(mp);
3425                                         return;
3426                                 }
3427                                 if (!TCP_IS_DETACHED(tcp) &&
3428                                     !putnextctl1(connp->conn_rq, M_PCSIG,
3429                                     SIGURG)) {
3430                                         /* Try again on the rexmit. */
3431                                         freemsg(mp1);
3432                                         freemsg(mp);
3433                                         return;
3434                                 }
3435                                 /*
3436                                  * Mark with NOTMARKNEXT for now.
3437                                  * The code below will change this to MARKNEXT
3438                                  * if we are at the mark.
3439                                  *
3440                                  * If there are allocation failures (e.g. in
3441                                  * dupmsg below) the next time tcp_input_data
3442                                  * sees the urgent segment it will send up the
3443                                  * MSGMARKNEXT message.
3444                                  */
3445                                 mp1->b_flag |= MSGNOTMARKNEXT;
3446                                 freemsg(tcp->tcp_urp_mark_mp);
3447                                 tcp->tcp_urp_mark_mp = mp1;
3448                                 flags |= TH_SEND_URP_MARK;
3449 #ifdef DEBUG
3450                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3451                                     "tcp_rput: sent M_PCSIG 2 seq %x urp %x "
3452                                     "last %x, %s",
3453                                     seg_seq, urp, tcp->tcp_urp_last,
3454                                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
3455 #endif /* DEBUG */
3456                         }
3457                         tcp->tcp_urp_last_valid = B_TRUE;
3458                         tcp->tcp_urp_last = urp + seg_seq;
3459                 } else if (tcp->tcp_urp_mark_mp != NULL) {
3460                         /*
3461                          * An allocation failure prevented the previous
3462                          * tcp_input_data from sending up the allocated
3463                          * MSG*MARKNEXT message - send it up this time
3464                          * around.
3465                          */
3466                         flags |= TH_SEND_URP_MARK;
3467                 }
3468 
3469                 /*
3470                  * If the urgent byte is in this segment, make sure that it is
3471                  * all by itself.  This makes it much easier to deal with the
3472                  * possibility of an allocation failure on the T_exdata_ind.
3473                  * Note that seg_len is the number of bytes in the segment, and
3474                  * urp is the offset into the segment of the urgent byte.
3475                  * urp < seg_len means that the urgent byte is in this segment.
3476                  */
3477                 if (urp < seg_len) {
3478                         if (seg_len != 1) {
3479                                 uint32_t  tmp_rnxt;
3480                                 /*
3481                                  * Break it up and feed it back in.
3482                                  * Re-attach the IP header.
3483                                  */
3484                                 mp->b_rptr = iphdr;
3485                                 if (urp > 0) {
3486                                         /*
3487                                          * There is stuff before the urgent
3488                                          * byte.
3489                                          */
3490                                         mp1 = dupmsg(mp);
3491                                         if (!mp1) {
3492                                                 /*
3493                                                  * Trim from urgent byte on.
3494                                                  * The rest will come back.
3495                                                  */
3496                                                 (void) adjmsg(mp,
3497                                                     urp - seg_len);
3498                                                 tcp_input_data(connp,
3499                                                     mp, NULL, ira);
3500                                                 return;
3501                                         }
3502                                         (void) adjmsg(mp1, urp - seg_len);
3503                                         /* Feed this piece back in. */
3504                                         tmp_rnxt = tcp->tcp_rnxt;
3505                                         tcp_input_data(connp, mp1, NULL, ira);
3506                                         /*
3507                                          * If the data passed back in was not
3508                                          * processed (ie: bad ACK) sending
3509                                          * the remainder back in will cause a
3510                                          * loop. In this case, drop the
3511                                          * packet and let the sender try
3512                                          * sending a good packet.
3513                                          */
3514                                         if (tmp_rnxt == tcp->tcp_rnxt) {
3515                                                 freemsg(mp);
3516                                                 return;
3517                                         }
3518                                 }
3519                                 if (urp != seg_len - 1) {
3520                                         uint32_t  tmp_rnxt;
3521                                         /*
3522                                          * There is stuff after the urgent
3523                                          * byte.
3524                                          */
3525                                         mp1 = dupmsg(mp);
3526                                         if (!mp1) {
3527                                                 /*
3528                                                  * Trim everything beyond the
3529                                                  * urgent byte.  The rest will
3530                                                  * come back.
3531                                                  */
3532                                                 (void) adjmsg(mp,
3533                                                     urp + 1 - seg_len);
3534                                                 tcp_input_data(connp,
3535                                                     mp, NULL, ira);
3536                                                 return;
3537                                         }
3538                                         (void) adjmsg(mp1, urp + 1 - seg_len);
3539                                         tmp_rnxt = tcp->tcp_rnxt;
3540                                         tcp_input_data(connp, mp1, NULL, ira);
3541                                         /*
3542                                          * If the data passed back in was not
3543                                          * processed (ie: bad ACK) sending
3544                                          * the remainder back in will cause a
3545                                          * loop. In this case, drop the
3546                                          * packet and let the sender try
3547                                          * sending a good packet.
3548                                          */
3549                                         if (tmp_rnxt == tcp->tcp_rnxt) {
3550                                                 freemsg(mp);
3551                                                 return;
3552                                         }
3553                                 }
3554                                 tcp_input_data(connp, mp, NULL, ira);
3555                                 return;
3556                         }
3557                         /*
3558                          * This segment contains only the urgent byte.  We
3559                          * have to allocate the T_exdata_ind, if we can.
3560                          */
3561                         if (IPCL_IS_NONSTR(connp)) {
3562                                 int error;
3563 
3564                                 (*sockupcalls->su_recv)
3565                                     (connp->conn_upper_handle, mp, seg_len,
3566                                     MSG_OOB, &error, NULL);
3567                                 /*
3568                                  * We should never be in middle of a
3569                                  * fallback, the squeue guarantees that.
3570                                  */
3571                                 ASSERT(error != EOPNOTSUPP);
3572                                 mp = NULL;
3573                                 goto update_ack;
3574                         } else if (!tcp->tcp_urp_mp) {
3575                                 struct T_exdata_ind *tei;
3576                                 mp1 = allocb(sizeof (struct T_exdata_ind),
3577                                     BPRI_MED);
3578                                 if (!mp1) {
3579                                         /*
3580                                          * Sigh... It'll be back.
3581                                          * Generate any MSG*MARK message now.
3582                                          */
3583                                         freemsg(mp);
3584                                         seg_len = 0;
3585                                         if (flags & TH_SEND_URP_MARK) {
3586 
3587 
3588                                                 ASSERT(tcp->tcp_urp_mark_mp);
3589                                                 tcp->tcp_urp_mark_mp->b_flag &=
3590                                                     ~MSGNOTMARKNEXT;
3591                                                 tcp->tcp_urp_mark_mp->b_flag |=
3592                                                     MSGMARKNEXT;
3593                                         }
3594                                         goto ack_check;
3595                                 }
3596                                 mp1->b_datap->db_type = M_PROTO;
3597                                 tei = (struct T_exdata_ind *)mp1->b_rptr;
3598                                 tei->PRIM_type = T_EXDATA_IND;
3599                                 tei->MORE_flag = 0;
3600                                 mp1->b_wptr = (uchar_t *)&tei[1];
3601                                 tcp->tcp_urp_mp = mp1;
3602 #ifdef DEBUG
3603                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3604                                     "tcp_rput: allocated exdata_ind %s",
3605                                     tcp_display(tcp, NULL,
3606                                     DISP_PORT_ONLY));
3607 #endif /* DEBUG */
3608                                 /*
3609                                  * There is no need to send a separate MSG*MARK
3610                                  * message since the T_EXDATA_IND will be sent
3611                                  * now.
3612                                  */
3613                                 flags &= ~TH_SEND_URP_MARK;
3614                                 freemsg(tcp->tcp_urp_mark_mp);
3615                                 tcp->tcp_urp_mark_mp = NULL;
3616                         }
3617                         /*
3618                          * Now we are all set.  On the next putnext upstream,
3619                          * tcp_urp_mp will be non-NULL and will get prepended
3620                          * to what has to be this piece containing the urgent
3621                          * byte.  If for any reason we abort this segment below,
3622                          * if it comes back, we will have this ready, or it
3623                          * will get blown off in close.
3624                          */
3625                 } else if (urp == seg_len) {
3626                         /*
3627                          * The urgent byte is the next byte after this sequence
3628                          * number. If this endpoint is non-STREAMS, then there
3629                          * is nothing to do here since the socket has already
3630                          * been notified about the urg pointer by the
3631                          * su_signal_oob call above.
3632                          *
3633                          * In case of STREAMS, some more work might be needed.
3634                          * If there is data it is marked with MSGMARKNEXT and
3635                          * and any tcp_urp_mark_mp is discarded since it is not
3636                          * needed. Otherwise, if the code above just allocated
3637                          * a zero-length tcp_urp_mark_mp message, that message
3638                          * is tagged with MSGMARKNEXT. Sending up these
3639                          * MSGMARKNEXT messages makes SIOCATMARK work correctly
3640                          * even though the T_EXDATA_IND will not be sent up
3641                          * until the urgent byte arrives.
3642                          */
3643                         if (!IPCL_IS_NONSTR(tcp->tcp_connp)) {
3644                                 if (seg_len != 0) {
3645                                         flags |= TH_MARKNEXT_NEEDED;
3646                                         freemsg(tcp->tcp_urp_mark_mp);
3647                                         tcp->tcp_urp_mark_mp = NULL;
3648                                         flags &= ~TH_SEND_URP_MARK;
3649                                 } else if (tcp->tcp_urp_mark_mp != NULL) {
3650                                         flags |= TH_SEND_URP_MARK;
3651                                         tcp->tcp_urp_mark_mp->b_flag &=
3652                                             ~MSGNOTMARKNEXT;
3653                                         tcp->tcp_urp_mark_mp->b_flag |=
3654                                             MSGMARKNEXT;
3655                                 }
3656                         }
3657 #ifdef DEBUG
3658                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3659                             "tcp_rput: AT MARK, len %d, flags 0x%x, %s",
3660                             seg_len, flags,
3661                             tcp_display(tcp, NULL, DISP_PORT_ONLY));
3662 #endif /* DEBUG */
3663                 }
3664 #ifdef DEBUG
3665                 else {
3666                         /* Data left until we hit mark */
3667                         (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
3668                             "tcp_rput: URP %d bytes left, %s",
3669                             urp - seg_len, tcp_display(tcp, NULL,
3670                             DISP_PORT_ONLY));
3671                 }
3672 #endif /* DEBUG */
3673         }
3674 
3675 process_ack:
3676         if (!(flags & TH_ACK)) {
3677                 freemsg(mp);
3678                 goto xmit_check;
3679         }
3680         }
3681         bytes_acked = (int)(seg_ack - tcp->tcp_suna);
3682 
3683         if (bytes_acked > 0)
3684                 tcp->tcp_ip_forward_progress = B_TRUE;
3685         if (tcp->tcp_state == TCPS_SYN_RCVD) {
3686                 /*
3687                  * tcp_sendmsg() checks tcp_state without entering
3688                  * the squeue so tcp_state should be updated before
3689                  * sending up a connection confirmation or a new
3690                  * connection indication.
3691                  */
3692                 tcp->tcp_state = TCPS_ESTABLISHED;
3693 
3694                 /*
3695                  * We are seeing the final ack in the three way
3696                  * hand shake of a active open'ed connection
3697                  * so we must send up a T_CONN_CON
3698                  */
3699                 if (tcp->tcp_active_open) {
3700                         if (!tcp_conn_con(tcp, iphdr, mp, NULL, ira)) {
3701                                 freemsg(mp);
3702                                 tcp->tcp_state = TCPS_SYN_RCVD;
3703                                 return;
3704                         }
3705                         /*
3706                          * Don't fuse the loopback endpoints for
3707                          * simultaneous active opens.
3708                          */
3709                         if (tcp->tcp_loopback) {
3710                                 TCP_STAT(tcps, tcp_fusion_unfusable);
3711                                 tcp->tcp_unfusable = B_TRUE;
3712                         }
3713                         /*
3714                          * For simultaneous active open, trace receipt of final
3715                          * ACK as tcp:::connect-established.
3716                          */
3717                         DTRACE_TCP5(connect__established, mblk_t *, NULL,
3718                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3719                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3720                 } else if (IPCL_IS_NONSTR(connp)) {
3721                         /*
3722                          * 3-way handshake has completed, so notify socket
3723                          * of the new connection.
3724                          *
3725                          * We are here means eager is fine but it can
3726                          * get a TH_RST at any point between now and till
3727                          * accept completes and disappear. We need to
3728                          * ensure that reference to eager is valid after
3729                          * we get out of eager's perimeter. So we do
3730                          * an extra refhold.
3731                          */
3732                         CONN_INC_REF(connp);
3733 
3734                         if (!tcp_newconn_notify(tcp, ira)) {
3735                                 /*
3736                                  * The state-change probe for SYN_RCVD ->
3737                                  * ESTABLISHED has not fired yet. We reset
3738                                  * the state to SYN_RCVD so that future
3739                                  * state-change probes report correct state
3740                                  * transistions.
3741                                  */
3742                                 tcp->tcp_state = TCPS_SYN_RCVD;
3743                                 freemsg(mp);
3744                                 /* notification did not go up, so drop ref */
3745                                 CONN_DEC_REF(connp);
3746                                 /* ... and close the eager */
3747                                 ASSERT(TCP_IS_DETACHED(tcp));
3748                                 (void) tcp_close_detached(tcp);
3749                                 return;
3750                         }
3751                         /*
3752                          * tcp_newconn_notify() changes conn_upcalls and
3753                          * connp->conn_upper_handle.  Fix things now, in case
3754                          * there's data attached to this ack.
3755                          */
3756                         if (connp->conn_upcalls != NULL)
3757                                 sockupcalls = connp->conn_upcalls;
3758                         /*
3759                          * For passive open, trace receipt of final ACK as
3760                          * tcp:::accept-established.
3761                          */
3762                         DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3763                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3764                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3765                 } else {
3766                         /*
3767                          * 3-way handshake complete - this is a STREAMS based
3768                          * socket, so pass up the T_CONN_IND.
3769                          */
3770                         tcp_t   *listener = tcp->tcp_listener;
3771                         mblk_t  *mp = tcp->tcp_conn.tcp_eager_conn_ind;
3772 
3773                         tcp->tcp_tconnind_started = B_TRUE;
3774                         tcp->tcp_conn.tcp_eager_conn_ind = NULL;
3775                         ASSERT(mp != NULL);
3776                         /*
3777                          * We are here means eager is fine but it can
3778                          * get a TH_RST at any point between now and till
3779                          * accept completes and disappear. We need to
3780                          * ensure that reference to eager is valid after
3781                          * we get out of eager's perimeter. So we do
3782                          * an extra refhold.
3783                          */
3784                         CONN_INC_REF(connp);
3785 
3786                         /*
3787                          * The listener also exists because of the refhold
3788                          * done in tcp_input_listener. Its possible that it
3789                          * might have closed. We will check that once we
3790                          * get inside listeners context.
3791                          */
3792                         CONN_INC_REF(listener->tcp_connp);
3793                         if (listener->tcp_connp->conn_sqp ==
3794                             connp->conn_sqp) {
3795                                 /*
3796                                  * We optimize by not calling an SQUEUE_ENTER
3797                                  * on the listener since we know that the
3798                                  * listener and eager squeues are the same.
3799                                  * We are able to make this check safely only
3800                                  * because neither the eager nor the listener
3801                                  * can change its squeue. Only an active connect
3802                                  * can change its squeue
3803                                  */
3804                                 tcp_send_conn_ind(listener->tcp_connp, mp,
3805                                     listener->tcp_connp->conn_sqp);
3806                                 CONN_DEC_REF(listener->tcp_connp);
3807                         } else if (!tcp->tcp_loopback) {
3808                                 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3809                                     mp, tcp_send_conn_ind,
3810                                     listener->tcp_connp, NULL, SQ_FILL,
3811                                     SQTAG_TCP_CONN_IND);
3812                         } else {
3813                                 SQUEUE_ENTER_ONE(listener->tcp_connp->conn_sqp,
3814                                     mp, tcp_send_conn_ind,
3815                                     listener->tcp_connp, NULL, SQ_NODRAIN,
3816                                     SQTAG_TCP_CONN_IND);
3817                         }
3818                         /*
3819                          * For passive open, trace receipt of final ACK as
3820                          * tcp:::accept-established.
3821                          */
3822                         DTRACE_TCP5(accept__established, mlbk_t *, NULL,
3823                             ip_xmit_attr_t *, connp->conn_ixa, void_ip_t *,
3824                             iphdr, tcp_t *, tcp, tcph_t *, tcpha);
3825                 }
3826                 TCPS_CONN_INC(tcps);
3827 
3828                 tcp->tcp_suna = tcp->tcp_iss + 1; /* One for the SYN */
3829                 bytes_acked--;
3830                 /* SYN was acked - making progress */
3831                 tcp->tcp_ip_forward_progress = B_TRUE;
3832 
3833                 /*
3834                  * If SYN was retransmitted, need to reset all
3835                  * retransmission info as this segment will be
3836                  * treated as a dup ACK.
3837                  */
3838                 if (tcp->tcp_rexmit) {
3839                         tcp->tcp_rexmit = B_FALSE;
3840                         tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
3841                         tcp->tcp_rexmit_max = tcp->tcp_snxt;
3842                         tcp->tcp_snd_burst = tcp->tcp_localnet ?
3843                             TCP_CWND_INFINITE : TCP_CWND_NORMAL;
3844                         tcp->tcp_ms_we_have_waited = 0;
3845                         tcp->tcp_cwnd = mss;
3846                 }
3847 
3848                 /*
3849                  * We set the send window to zero here.
3850                  * This is needed if there is data to be
3851                  * processed already on the queue.
3852                  * Later (at swnd_update label), the
3853                  * "new_swnd > tcp_swnd" condition is satisfied
3854                  * the XMIT_NEEDED flag is set in the current
3855                  * (SYN_RCVD) state. This ensures tcp_wput_data() is
3856                  * called if there is already data on queue in
3857                  * this state.
3858                  */
3859                 tcp->tcp_swnd = 0;
3860 
3861                 if (new_swnd > tcp->tcp_max_swnd)
3862                         tcp->tcp_max_swnd = new_swnd;
3863                 tcp->tcp_swl1 = seg_seq;
3864                 tcp->tcp_swl2 = seg_ack;
3865                 tcp->tcp_valid_bits &= ~TCP_ISS_VALID;
3866 
3867                 /* Trace change from SYN_RCVD -> ESTABLISHED here */
3868                 DTRACE_TCP6(state__change, void, NULL, ip_xmit_attr_t *,
3869                     connp->conn_ixa, void, NULL, tcp_t *, tcp, void, NULL,
3870                     int32_t, TCPS_SYN_RCVD);
3871 
3872                 /* Fuse when both sides are in ESTABLISHED state */
3873                 if (tcp->tcp_loopback && do_tcp_fusion)
3874                         tcp_fuse(tcp, iphdr, tcpha);
3875 
3876         }
3877         /* This code follows 4.4BSD-Lite2 mostly. */
3878         if (bytes_acked < 0)
3879                 goto est;
3880 
3881         /*
3882          * If TCP is ECN capable and the congestion experience bit is
3883          * set, reduce tcp_cwnd and tcp_ssthresh.  But this should only be
3884          * done once per window (or more loosely, per RTT).
3885          */
3886         if (tcp->tcp_cwr && SEQ_GT(seg_ack, tcp->tcp_cwr_snd_max))
3887                 tcp->tcp_cwr = B_FALSE;
3888         if (tcp->tcp_ecn_ok && (flags & TH_ECE)) {
3889                 if (!tcp->tcp_cwr) {
3890                         npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) / mss;
3891                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * mss;
3892                         tcp->tcp_cwnd = npkt * mss;
3893                         /*
3894                          * If the cwnd is 0, use the timer to clock out
3895                          * new segments.  This is required by the ECN spec.
3896                          */
3897                         if (npkt == 0) {
3898                                 TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
3899                                 /*
3900                                  * This makes sure that when the ACK comes
3901                                  * back, we will increase tcp_cwnd by 1 MSS.
3902                                  */
3903                                 tcp->tcp_cwnd_cnt = 0;
3904                         }
3905                         tcp->tcp_cwr = B_TRUE;
3906                         /*
3907                          * This marks the end of the current window of in
3908                          * flight data.  That is why we don't use
3909                          * tcp_suna + tcp_swnd.  Only data in flight can
3910                          * provide ECN info.
3911                          */
3912                         tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3913                         tcp->tcp_ecn_cwr_sent = B_FALSE;
3914                 }
3915         }
3916 
3917         mp1 = tcp->tcp_xmit_head;
3918         if (bytes_acked == 0) {
3919                 if (!ofo_seg && seg_len == 0 && new_swnd == tcp->tcp_swnd) {
3920                         int dupack_cnt;
3921 
3922                         TCPS_BUMP_MIB(tcps, tcpInDupAck);
3923                         /*
3924                          * Fast retransmit.  When we have seen exactly three
3925                          * identical ACKs while we have unacked data
3926                          * outstanding we take it as a hint that our peer
3927                          * dropped something.
3928                          *
3929                          * If TCP is retransmitting, don't do fast retransmit.
3930                          */
3931                         if (mp1 && tcp->tcp_suna != tcp->tcp_snxt &&
3932                             ! tcp->tcp_rexmit) {
3933                                 /* Do Limited Transmit */
3934                                 if ((dupack_cnt = ++tcp->tcp_dupack_cnt) <
3935                                     tcps->tcps_dupack_fast_retransmit) {
3936                                         /*
3937                                          * RFC 3042
3938                                          *
3939                                          * What we need to do is temporarily
3940                                          * increase tcp_cwnd so that new
3941                                          * data can be sent if it is allowed
3942                                          * by the receive window (tcp_rwnd).
3943                                          * tcp_wput_data() will take care of
3944                                          * the rest.
3945                                          *
3946                                          * If the connection is SACK capable,
3947                                          * only do limited xmit when there
3948                                          * is SACK info.
3949                                          *
3950                                          * Note how tcp_cwnd is incremented.
3951                                          * The first dup ACK will increase
3952                                          * it by 1 MSS.  The second dup ACK
3953                                          * will increase it by 2 MSS.  This
3954                                          * means that only 1 new segment will
3955                                          * be sent for each dup ACK.
3956                                          */
3957                                         if (tcp->tcp_unsent > 0 &&
3958                                             (!tcp->tcp_snd_sack_ok ||
3959                                             (tcp->tcp_snd_sack_ok &&
3960                                             tcp->tcp_notsack_list != NULL))) {
3961                                                 tcp->tcp_cwnd += mss <<
3962                                                     (tcp->tcp_dupack_cnt - 1);
3963                                                 flags |= TH_LIMIT_XMIT;
3964                                         }
3965                                 } else if (dupack_cnt ==
3966                                     tcps->tcps_dupack_fast_retransmit) {
3967 
3968                                 /*
3969                                  * If we have reduced tcp_ssthresh
3970                                  * because of ECN, do not reduce it again
3971                                  * unless it is already one window of data
3972                                  * away.  After one window of data, tcp_cwr
3973                                  * should then be cleared.  Note that
3974                                  * for non ECN capable connection, tcp_cwr
3975                                  * should always be false.
3976                                  *
3977                                  * Adjust cwnd since the duplicate
3978                                  * ack indicates that a packet was
3979                                  * dropped (due to congestion.)
3980                                  */
3981                                 if (!tcp->tcp_cwr) {
3982                                         npkt = ((tcp->tcp_snxt -
3983                                             tcp->tcp_suna) >> 1) / mss;
3984                                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) *
3985                                             mss;
3986                                         tcp->tcp_cwnd = (npkt +
3987                                             tcp->tcp_dupack_cnt) * mss;
3988                                 }
3989                                 if (tcp->tcp_ecn_ok) {
3990                                         tcp->tcp_cwr = B_TRUE;
3991                                         tcp->tcp_cwr_snd_max = tcp->tcp_snxt;
3992                                         tcp->tcp_ecn_cwr_sent = B_FALSE;
3993                                 }
3994 
3995                                 /*
3996                                  * We do Hoe's algorithm.  Refer to her
3997                                  * paper "Improving the Start-up Behavior
3998                                  * of a Congestion Control Scheme for TCP,"
3999                                  * appeared in SIGCOMM'96.
4000                                  *
4001                                  * Save highest seq no we have sent so far.
4002                                  * Be careful about the invisible FIN byte.
4003                                  */
4004                                 if ((tcp->tcp_valid_bits & TCP_FSS_VALID) &&
4005                                     (tcp->tcp_unsent == 0)) {
4006                                         tcp->tcp_rexmit_max = tcp->tcp_fss;
4007                                 } else {
4008                                         tcp->tcp_rexmit_max = tcp->tcp_snxt;
4009                                 }
4010 
4011                                 /*
4012                                  * Do not allow bursty traffic during.
4013                                  * fast recovery.  Refer to Fall and Floyd's
4014                                  * paper "Simulation-based Comparisons of
4015                                  * Tahoe, Reno and SACK TCP" (in CCR?)
4016                                  * This is a best current practise.
4017                                  */
4018                                 tcp->tcp_snd_burst = TCP_CWND_SS;
4019 
4020                                 /*
4021                                  * For SACK:
4022                                  * Calculate tcp_pipe, which is the
4023                                  * estimated number of bytes in
4024                                  * network.
4025                                  *
4026                                  * tcp_fack is the highest sack'ed seq num
4027                                  * TCP has received.
4028                                  *
4029                                  * tcp_pipe is explained in the above quoted
4030                                  * Fall and Floyd's paper.  tcp_fack is
4031                                  * explained in Mathis and Mahdavi's
4032                                  * "Forward Acknowledgment: Refining TCP
4033                                  * Congestion Control" in SIGCOMM '96.
4034                                  */
4035                                 if (tcp->tcp_snd_sack_ok) {
4036                                         if (tcp->tcp_notsack_list != NULL) {
4037                                                 tcp->tcp_pipe = tcp->tcp_snxt -
4038                                                     tcp->tcp_fack;
4039                                                 tcp->tcp_sack_snxt = seg_ack;
4040                                                 flags |= TH_NEED_SACK_REXMIT;
4041                                         } else {
4042                                                 /*
4043                                                  * Always initialize tcp_pipe
4044                                                  * even though we don't have
4045                                                  * any SACK info.  If later
4046                                                  * we get SACK info and
4047                                                  * tcp_pipe is not initialized,
4048                                                  * funny things will happen.
4049                                                  */
4050                                                 tcp->tcp_pipe =
4051                                                     tcp->tcp_cwnd_ssthresh;
4052                                         }
4053                                 } else {
4054                                         flags |= TH_REXMIT_NEEDED;
4055                                 } /* tcp_snd_sack_ok */
4056 
4057                                 } else {
4058                                         /*
4059                                          * Here we perform congestion
4060                                          * avoidance, but NOT slow start.
4061                                          * This is known as the Fast
4062                                          * Recovery Algorithm.
4063                                          */
4064                                         if (tcp->tcp_snd_sack_ok &&
4065                                             tcp->tcp_notsack_list != NULL) {
4066                                                 flags |= TH_NEED_SACK_REXMIT;
4067                                                 tcp->tcp_pipe -= mss;
4068                                                 if (tcp->tcp_pipe < 0)
4069                                                         tcp->tcp_pipe = 0;
4070                                         } else {
4071                                         /*
4072                                          * We know that one more packet has
4073                                          * left the pipe thus we can update
4074                                          * cwnd.
4075                                          */
4076                                         cwnd = tcp->tcp_cwnd + mss;
4077                                         if (cwnd > tcp->tcp_cwnd_max)
4078                                                 cwnd = tcp->tcp_cwnd_max;
4079                                         tcp->tcp_cwnd = cwnd;
4080                                         if (tcp->tcp_unsent > 0)
4081                                                 flags |= TH_XMIT_NEEDED;
4082                                         }
4083                                 }
4084                         }
4085                 } else if (tcp->tcp_zero_win_probe) {
4086                         /*
4087                          * If the window has opened, need to arrange
4088                          * to send additional data.
4089                          */
4090                         if (new_swnd != 0) {
4091                                 /* tcp_suna != tcp_snxt */
4092                                 /* Packet contains a window update */
4093                                 TCPS_BUMP_MIB(tcps, tcpInWinUpdate);
4094                                 tcp->tcp_zero_win_probe = 0;
4095                                 tcp->tcp_timer_backoff = 0;
4096                                 tcp->tcp_ms_we_have_waited = 0;
4097 
4098                                 /*
4099                                  * Transmit starting with tcp_suna since
4100                                  * the one byte probe is not ack'ed.
4101                                  * If TCP has sent more than one identical
4102                                  * probe, tcp_rexmit will be set.  That means
4103                                  * tcp_ss_rexmit() will send out the one
4104                                  * byte along with new data.  Otherwise,
4105                                  * fake the retransmission.
4106                                  */
4107                                 flags |= TH_XMIT_NEEDED;
4108                                 if (!tcp->tcp_rexmit) {
4109                                         tcp->tcp_rexmit = B_TRUE;
4110                                         tcp->tcp_dupack_cnt = 0;
4111                                         tcp->tcp_rexmit_nxt = tcp->tcp_suna;
4112                                         tcp->tcp_rexmit_max = tcp->tcp_suna + 1;
4113                                 }
4114                         }
4115                 }
4116                 goto swnd_update;
4117         }
4118 
4119         /*
4120          * Check for "acceptability" of ACK value per RFC 793, pages 72 - 73.
4121          * If the ACK value acks something that we have not yet sent, it might
4122          * be an old duplicate segment.  Send an ACK to re-synchronize the
4123          * other side.
4124          * Note: reset in response to unacceptable ACK in SYN_RECEIVE
4125          * state is handled above, so we can always just drop the segment and
4126          * send an ACK here.
4127          *
4128          * In the case where the peer shrinks the window, we see the new window
4129          * update, but all the data sent previously is queued up by the peer.
4130          * To account for this, in tcp_process_shrunk_swnd(), the sequence
4131          * number, which was already sent, and within window, is recorded.
4132          * tcp_snxt is then updated.
4133          *
4134          * If the window has previously shrunk, and an ACK for data not yet
4135          * sent, according to tcp_snxt is recieved, it may still be valid. If
4136          * the ACK is for data within the window at the time the window was
4137          * shrunk, then the ACK is acceptable. In this case tcp_snxt is set to
4138          * the sequence number ACK'ed.
4139          *
4140          * If the ACK covers all the data sent at the time the window was
4141          * shrunk, we can now set tcp_is_wnd_shrnk to B_FALSE.
4142          *
4143          * Should we send ACKs in response to ACK only segments?
4144          */
4145 
4146         if (SEQ_GT(seg_ack, tcp->tcp_snxt)) {
4147                 if ((tcp->tcp_is_wnd_shrnk) &&
4148                     (SEQ_LEQ(seg_ack, tcp->tcp_snxt_shrunk))) {
4149                         uint32_t data_acked_ahead_snxt;
4150 
4151                         data_acked_ahead_snxt = seg_ack - tcp->tcp_snxt;
4152                         tcp_update_xmit_tail(tcp, seg_ack);
4153                         tcp->tcp_unsent -= data_acked_ahead_snxt;
4154                 } else {
4155                         TCPS_BUMP_MIB(tcps, tcpInAckUnsent);
4156                         /* drop the received segment */
4157                         freemsg(mp);
4158 
4159                         /*
4160                          * Send back an ACK.  If tcp_drop_ack_unsent_cnt is
4161                          * greater than 0, check if the number of such
4162                          * bogus ACks is greater than that count.  If yes,
4163                          * don't send back any ACK.  This prevents TCP from
4164                          * getting into an ACK storm if somehow an attacker
4165                          * successfully spoofs an acceptable segment to our
4166                          * peer.  If this continues (count > 2 X threshold),
4167                          * we should abort this connection.
4168                          */
4169                         if (tcp_drop_ack_unsent_cnt > 0 &&
4170                             ++tcp->tcp_in_ack_unsent >
4171                             tcp_drop_ack_unsent_cnt) {
4172                                 TCP_STAT(tcps, tcp_in_ack_unsent_drop);
4173                                 if (tcp->tcp_in_ack_unsent > 2 *
4174                                     tcp_drop_ack_unsent_cnt) {
4175                                         (void) tcp_clean_death(tcp, EPROTO);
4176                                 }
4177                                 return;
4178                         }
4179                         mp = tcp_ack_mp(tcp);
4180                         if (mp != NULL) {
4181                                 BUMP_LOCAL(tcp->tcp_obsegs);
4182                                 TCPS_BUMP_MIB(tcps, tcpOutAck);
4183                                 tcp_send_data(tcp, mp);
4184                         }
4185                         return;
4186                 }
4187         } else if (tcp->tcp_is_wnd_shrnk && SEQ_GEQ(seg_ack,
4188             tcp->tcp_snxt_shrunk)) {
4189                         tcp->tcp_is_wnd_shrnk = B_FALSE;
4190         }
4191 
4192         /*
4193          * TCP gets a new ACK, update the notsack'ed list to delete those
4194          * blocks that are covered by this ACK.
4195          */
4196         if (tcp->tcp_snd_sack_ok && tcp->tcp_notsack_list != NULL) {
4197                 tcp_notsack_remove(&(tcp->tcp_notsack_list), seg_ack,
4198                     &(tcp->tcp_num_notsack_blk), &(tcp->tcp_cnt_notsack_list));
4199         }
4200 
4201         /*
4202          * If we got an ACK after fast retransmit, check to see
4203          * if it is a partial ACK.  If it is not and the congestion
4204          * window was inflated to account for the other side's
4205          * cached packets, retract it.  If it is, do Hoe's algorithm.
4206          */
4207         if (tcp->tcp_dupack_cnt >= tcps->tcps_dupack_fast_retransmit) {
4208                 ASSERT(tcp->tcp_rexmit == B_FALSE);
4209                 if (SEQ_GEQ(seg_ack, tcp->tcp_rexmit_max)) {
4210                         tcp->tcp_dupack_cnt = 0;
4211                         /*
4212                          * Restore the orig tcp_cwnd_ssthresh after
4213                          * fast retransmit phase.
4214                          */
4215                         if (tcp->tcp_cwnd > tcp->tcp_cwnd_ssthresh) {
4216                                 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh;
4217                         }
4218                         tcp->tcp_rexmit_max = seg_ack;
4219                         tcp->tcp_cwnd_cnt = 0;
4220                         tcp->tcp_snd_burst = tcp->tcp_localnet ?
4221                             TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4222 
4223                         /*
4224                          * Remove all notsack info to avoid confusion with
4225                          * the next fast retrasnmit/recovery phase.
4226                          */
4227                         if (tcp->tcp_snd_sack_ok) {
4228                                 TCP_NOTSACK_REMOVE_ALL(tcp->tcp_notsack_list,
4229                                     tcp);
4230                         }
4231                 } else {
4232                         if (tcp->tcp_snd_sack_ok &&
4233                             tcp->tcp_notsack_list != NULL) {
4234                                 flags |= TH_NEED_SACK_REXMIT;
4235                                 tcp->tcp_pipe -= mss;
4236                                 if (tcp->tcp_pipe < 0)
4237                                         tcp->tcp_pipe = 0;
4238                         } else {
4239                                 /*
4240                                  * Hoe's algorithm:
4241                                  *
4242                                  * Retransmit the unack'ed segment and
4243                                  * restart fast recovery.  Note that we
4244                                  * need to scale back tcp_cwnd to the
4245                                  * original value when we started fast
4246                                  * recovery.  This is to prevent overly
4247                                  * aggressive behaviour in sending new
4248                                  * segments.
4249                                  */
4250                                 tcp->tcp_cwnd = tcp->tcp_cwnd_ssthresh +
4251                                     tcps->tcps_dupack_fast_retransmit * mss;
4252                                 tcp->tcp_cwnd_cnt = tcp->tcp_cwnd;
4253                                 flags |= TH_REXMIT_NEEDED;
4254                         }
4255                 }
4256         } else {
4257                 tcp->tcp_dupack_cnt = 0;
4258                 if (tcp->tcp_rexmit) {
4259                         /*
4260                          * TCP is retranmitting.  If the ACK ack's all
4261                          * outstanding data, update tcp_rexmit_max and
4262                          * tcp_rexmit_nxt.  Otherwise, update tcp_rexmit_nxt
4263                          * to the correct value.
4264                          *
4265                          * Note that SEQ_LEQ() is used.  This is to avoid
4266                          * unnecessary fast retransmit caused by dup ACKs
4267                          * received when TCP does slow start retransmission
4268                          * after a time out.  During this phase, TCP may
4269                          * send out segments which are already received.
4270                          * This causes dup ACKs to be sent back.
4271                          */
4272                         if (SEQ_LEQ(seg_ack, tcp->tcp_rexmit_max)) {
4273                                 if (SEQ_GT(seg_ack, tcp->tcp_rexmit_nxt)) {
4274                                         tcp->tcp_rexmit_nxt = seg_ack;
4275                                 }
4276                                 if (seg_ack != tcp->tcp_rexmit_max) {
4277                                         flags |= TH_XMIT_NEEDED;
4278                                 }
4279                         } else {
4280                                 tcp->tcp_rexmit = B_FALSE;
4281                                 tcp->tcp_rexmit_nxt = tcp->tcp_snxt;
4282                                 tcp->tcp_snd_burst = tcp->tcp_localnet ?
4283                                     TCP_CWND_INFINITE : TCP_CWND_NORMAL;
4284                         }
4285                         tcp->tcp_ms_we_have_waited = 0;
4286                 }
4287         }
4288 
4289         TCPS_BUMP_MIB(tcps, tcpInAckSegs);
4290         TCPS_UPDATE_MIB(tcps, tcpInAckBytes, bytes_acked);
4291         tcp->tcp_suna = seg_ack;
4292         if (tcp->tcp_zero_win_probe != 0) {
4293                 tcp->tcp_zero_win_probe = 0;
4294                 tcp->tcp_timer_backoff = 0;
4295         }
4296 
4297         /*
4298          * If tcp_xmit_head is NULL, then it must be the FIN being ack'ed.
4299          * Note that it cannot be the SYN being ack'ed.  The code flow
4300          * will not reach here.
4301          */
4302         if (mp1 == NULL) {
4303                 goto fin_acked;
4304         }
4305 
4306         /*
4307          * Update the congestion window.
4308          *
4309          * If TCP is not ECN capable or TCP is ECN capable but the
4310          * congestion experience bit is not set, increase the tcp_cwnd as
4311          * usual.
4312          */
4313         if (!tcp->tcp_ecn_ok || !(flags & TH_ECE)) {
4314                 cwnd = tcp->tcp_cwnd;
4315                 add = mss;
4316 
4317                 if (cwnd >= tcp->tcp_cwnd_ssthresh) {
4318                         /*
4319                          * This is to prevent an increase of less than 1 MSS of
4320                          * tcp_cwnd.  With partial increase, tcp_wput_data()
4321                          * may send out tinygrams in order to preserve mblk
4322                          * boundaries.
4323                          *
4324                          * By initializing tcp_cwnd_cnt to new tcp_cwnd and
4325                          * decrementing it by 1 MSS for every ACKs, tcp_cwnd is
4326                          * increased by 1 MSS for every RTTs.
4327                          */
4328                         if (tcp->tcp_cwnd_cnt <= 0) {
4329                                 tcp->tcp_cwnd_cnt = cwnd + add;
4330                         } else {
4331                                 tcp->tcp_cwnd_cnt -= add;
4332                                 add = 0;
4333                         }
4334                 }
4335                 tcp->tcp_cwnd = MIN(cwnd + add, tcp->tcp_cwnd_max);
4336         }
4337 
4338         /* See if the latest urgent data has been acknowledged */
4339         if ((tcp->tcp_valid_bits & TCP_URG_VALID) &&
4340             SEQ_GT(seg_ack, tcp->tcp_urg))
4341                 tcp->tcp_valid_bits &= ~TCP_URG_VALID;
4342 
4343         /* Can we update the RTT estimates? */
4344         if (tcp->tcp_snd_ts_ok) {
4345                 /* Ignore zero timestamp echo-reply. */
4346                 if (tcpopt.tcp_opt_ts_ecr != 0) {
4347                         tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4348                             (int32_t)tcpopt.tcp_opt_ts_ecr);
4349                 }
4350 
4351                 /* If needed, restart the timer. */
4352                 if (tcp->tcp_set_timer == 1) {
4353                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4354                         tcp->tcp_set_timer = 0;
4355                 }
4356                 /*
4357                  * Update tcp_csuna in case the other side stops sending
4358                  * us timestamps.
4359                  */
4360                 tcp->tcp_csuna = tcp->tcp_snxt;
4361         } else if (SEQ_GT(seg_ack, tcp->tcp_csuna)) {
4362                 /*
4363                  * An ACK sequence we haven't seen before, so get the RTT
4364                  * and update the RTO. But first check if the timestamp is
4365                  * valid to use.
4366                  */
4367                 if ((mp1->b_next != NULL) &&
4368                     SEQ_GT(seg_ack, (uint32_t)(uintptr_t)(mp1->b_next)))
4369                         tcp_set_rto(tcp, (int32_t)LBOLT_FASTPATH -
4370                             (int32_t)(intptr_t)mp1->b_prev);
4371                 else
4372                         TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4373 
4374                 /* Remeber the last sequence to be ACKed */
4375                 tcp->tcp_csuna = seg_ack;
4376                 if (tcp->tcp_set_timer == 1) {
4377                         TCP_TIMER_RESTART(tcp, tcp->tcp_rto);
4378                         tcp->tcp_set_timer = 0;
4379                 }
4380         } else {
4381                 TCPS_BUMP_MIB(tcps, tcpRttNoUpdate);
4382         }
4383 
4384         /* Eat acknowledged bytes off the xmit queue. */
4385         for (;;) {
4386                 mblk_t  *mp2;
4387                 uchar_t *wptr;
4388 
4389                 wptr = mp1->b_wptr;
4390                 ASSERT((uintptr_t)(wptr - mp1->b_rptr) <= (uintptr_t)INT_MAX);
4391                 bytes_acked -= (int)(wptr - mp1->b_rptr);
4392                 if (bytes_acked < 0) {
4393                         mp1->b_rptr = wptr + bytes_acked;
4394                         /*
4395                          * Set a new timestamp if all the bytes timed by the
4396                          * old timestamp have been ack'ed.
4397                          */
4398                         if (SEQ_GT(seg_ack,
4399                             (uint32_t)(uintptr_t)(mp1->b_next))) {
4400                                 mp1->b_prev =
4401                                     (mblk_t *)(uintptr_t)LBOLT_FASTPATH;
4402                                 mp1->b_next = NULL;
4403                         }
4404                         break;
4405                 }
4406                 mp1->b_next = NULL;
4407                 mp1->b_prev = NULL;
4408                 mp2 = mp1;
4409                 mp1 = mp1->b_cont;
4410 
4411                 /*
4412                  * This notification is required for some zero-copy
4413                  * clients to maintain a copy semantic. After the data
4414                  * is ack'ed, client is safe to modify or reuse the buffer.
4415                  */
4416                 if (tcp->tcp_snd_zcopy_aware &&
4417                     (mp2->b_datap->db_struioflag & STRUIO_ZCNOTIFY))
4418                         tcp_zcopy_notify(tcp);
4419                 freeb(mp2);
4420                 if (bytes_acked == 0) {
4421                         if (mp1 == NULL) {
4422                                 /* Everything is ack'ed, clear the tail. */
4423                                 tcp->tcp_xmit_tail = NULL;
4424                                 /*
4425                                  * Cancel the timer unless we are still
4426                                  * waiting for an ACK for the FIN packet.
4427                                  */
4428                                 if (tcp->tcp_timer_tid != 0 &&
4429                                     tcp->tcp_snxt == tcp->tcp_suna) {
4430                                         (void) TCP_TIMER_CANCEL(tcp,
4431                                             tcp->tcp_timer_tid);
4432                                         tcp->tcp_timer_tid = 0;
4433                                 }
4434                                 goto pre_swnd_update;
4435                         }
4436                         if (mp2 != tcp->tcp_xmit_tail)
4437                                 break;
4438                         tcp->tcp_xmit_tail = mp1;
4439                         ASSERT((uintptr_t)(mp1->b_wptr - mp1->b_rptr) <=
4440                             (uintptr_t)INT_MAX);
4441                         tcp->tcp_xmit_tail_unsent = (int)(mp1->b_wptr -
4442                             mp1->b_rptr);
4443                         break;
4444                 }
4445                 if (mp1 == NULL) {
4446                         /*
4447                          * More was acked but there is nothing more
4448                          * outstanding.  This means that the FIN was
4449                          * just acked or that we're talking to a clown.
4450                          */
4451 fin_acked:
4452                         ASSERT(tcp->tcp_fin_sent);
4453                         tcp->tcp_xmit_tail = NULL;
4454                         if (tcp->tcp_fin_sent) {
4455                                 /* FIN was acked - making progress */
4456                                 if (!tcp->tcp_fin_acked)
4457                                         tcp->tcp_ip_forward_progress = B_TRUE;
4458                                 tcp->tcp_fin_acked = B_TRUE;
4459                                 if (tcp->tcp_linger_tid != 0 &&
4460                                     TCP_TIMER_CANCEL(tcp,
4461                                     tcp->tcp_linger_tid) >= 0) {
4462                                         tcp_stop_lingering(tcp);
4463                                         freemsg(mp);
4464                                         mp = NULL;
4465                                 }
4466                         } else {
4467                                 /*
4468                                  * We should never get here because
4469                                  * we have already checked that the
4470                                  * number of bytes ack'ed should be
4471                                  * smaller than or equal to what we
4472                                  * have sent so far (it is the
4473                                  * acceptability check of the ACK).
4474                                  * We can only get here if the send
4475                                  * queue is corrupted.
4476                                  *
4477                                  * Terminate the connection and
4478                                  * panic the system.  It is better
4479                                  * for us to panic instead of
4480                                  * continuing to avoid other disaster.
4481                                  */
4482                                 tcp_xmit_ctl(NULL, tcp, tcp->tcp_snxt,
4483                                     tcp->tcp_rnxt, TH_RST|TH_ACK);
4484                                 panic("Memory corruption "
4485                                     "detected for connection %s.",
4486                                     tcp_display(tcp, NULL,
4487                                     DISP_ADDR_AND_PORT));
4488                                 /*NOTREACHED*/
4489                         }
4490                         goto pre_swnd_update;
4491                 }
4492                 ASSERT(mp2 != tcp->tcp_xmit_tail);
4493         }
4494         if (tcp->tcp_unsent) {
4495                 flags |= TH_XMIT_NEEDED;
4496         }
4497 pre_swnd_update:
4498         tcp->tcp_xmit_head = mp1;
4499 swnd_update:
4500         /*
4501          * The following check is different from most other implementations.
4502          * For bi-directional transfer, when segments are dropped, the
4503          * "normal" check will not accept a window update in those
4504          * retransmitted segemnts.  Failing to do that, TCP may send out
4505          * segments which are outside receiver's window.  As TCP accepts
4506          * the ack in those retransmitted segments, if the window update in
4507          * the same segment is not accepted, TCP will incorrectly calculates
4508          * that it can send more segments.  This can create a deadlock
4509          * with the receiver if its window becomes zero.
4510          */
4511         if (SEQ_LT(tcp->tcp_swl2, seg_ack) ||
4512             SEQ_LT(tcp->tcp_swl1, seg_seq) ||
4513             (tcp->tcp_swl1 == seg_seq && new_swnd > tcp->tcp_swnd)) {
4514                 /*
4515                  * The criteria for update is:
4516                  *
4517                  * 1. the segment acknowledges some data.  Or
4518                  * 2. the segment is new, i.e. it has a higher seq num. Or
4519                  * 3. the segment is not old and the advertised window is
4520                  * larger than the previous advertised window.
4521                  */
4522                 if (tcp->tcp_unsent && new_swnd > tcp->tcp_swnd)
4523                         flags |= TH_XMIT_NEEDED;
4524                 tcp->tcp_swnd = new_swnd;
4525                 if (new_swnd > tcp->tcp_max_swnd)
4526                         tcp->tcp_max_swnd = new_swnd;
4527                 tcp->tcp_swl1 = seg_seq;
4528                 tcp->tcp_swl2 = seg_ack;
4529         }
4530 est:
4531         if (tcp->tcp_state > TCPS_ESTABLISHED) {
4532 
4533                 switch (tcp->tcp_state) {
4534                 case TCPS_FIN_WAIT_1:
4535                         if (tcp->tcp_fin_acked) {
4536                                 tcp->tcp_state = TCPS_FIN_WAIT_2;
4537                                 DTRACE_TCP6(state__change, void, NULL,
4538                                     ip_xmit_attr_t *, connp->conn_ixa,
4539                                     void, NULL, tcp_t *, tcp, void, NULL,
4540                                     int32_t, TCPS_FIN_WAIT_1);
4541                                 /*
4542                                  * We implement the non-standard BSD/SunOS
4543                                  * FIN_WAIT_2 flushing algorithm.
4544                                  * If there is no user attached to this
4545                                  * TCP endpoint, then this TCP struct
4546                                  * could hang around forever in FIN_WAIT_2
4547                                  * state if the peer forgets to send us
4548                                  * a FIN.  To prevent this, we wait only
4549                                  * 2*MSL (a convenient time value) for
4550                                  * the FIN to arrive.  If it doesn't show up,
4551                                  * we flush the TCP endpoint.  This algorithm,
4552                                  * though a violation of RFC-793, has worked
4553                                  * for over 10 years in BSD systems.
4554                                  * Note: SunOS 4.x waits 675 seconds before
4555                                  * flushing the FIN_WAIT_2 connection.
4556                                  */
4557                                 TCP_TIMER_RESTART(tcp,
4558                                     tcp->tcp_fin_wait_2_flush_interval);
4559                         }
4560                         break;
4561                 case TCPS_FIN_WAIT_2:
4562                         break;  /* Shutdown hook? */
4563                 case TCPS_LAST_ACK:
4564                         freemsg(mp);
4565                         if (tcp->tcp_fin_acked) {
4566                                 (void) tcp_clean_death(tcp, 0);
4567                                 return;
4568                         }
4569                         goto xmit_check;
4570                 case TCPS_CLOSING:
4571                         if (tcp->tcp_fin_acked) {
4572                                 SET_TIME_WAIT(tcps, tcp, connp);
4573                                 DTRACE_TCP6(state__change, void, NULL,
4574                                     ip_xmit_attr_t *, connp->conn_ixa, void,
4575                                     NULL, tcp_t *, tcp, void, NULL, int32_t,
4576                                     TCPS_CLOSING);
4577                         }
4578                         /*FALLTHRU*/
4579                 case TCPS_CLOSE_WAIT:
4580                         freemsg(mp);
4581                         goto xmit_check;
4582                 default:
4583                         ASSERT(tcp->tcp_state != TCPS_TIME_WAIT);
4584                         break;
4585                 }
4586         }
4587         if (flags & TH_FIN) {
4588                 /* Make sure we ack the fin */
4589                 flags |= TH_ACK_NEEDED;
4590                 if (!tcp->tcp_fin_rcvd) {
4591                         tcp->tcp_fin_rcvd = B_TRUE;
4592                         tcp->tcp_rnxt++;
4593                         tcpha = tcp->tcp_tcpha;
4594                         tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4595 
4596                         /*
4597                          * Generate the ordrel_ind at the end unless the
4598                          * conn is detached or it is a STREAMS based eager.
4599                          * In the eager case we defer the notification until
4600                          * tcp_accept_finish has run.
4601                          */
4602                         if (!TCP_IS_DETACHED(tcp) && (IPCL_IS_NONSTR(connp) ||
4603                             (tcp->tcp_listener == NULL &&
4604                             !tcp->tcp_hard_binding)))
4605                                 flags |= TH_ORDREL_NEEDED;
4606                         switch (tcp->tcp_state) {
4607                         case TCPS_SYN_RCVD:
4608                                 tcp->tcp_state = TCPS_CLOSE_WAIT;
4609                                 DTRACE_TCP6(state__change, void, NULL,
4610                                     ip_xmit_attr_t *, connp->conn_ixa,
4611                                     void, NULL, tcp_t *, tcp, void, NULL,
4612                                     int32_t, TCPS_SYN_RCVD);
4613                                 /* Keepalive? */
4614                                 break;
4615                         case TCPS_ESTABLISHED:
4616                                 tcp->tcp_state = TCPS_CLOSE_WAIT;
4617                                 DTRACE_TCP6(state__change, void, NULL,
4618                                     ip_xmit_attr_t *, connp->conn_ixa,
4619                                     void, NULL, tcp_t *, tcp, void, NULL,
4620                                     int32_t, TCPS_ESTABLISHED);
4621                                 /* Keepalive? */
4622                                 break;
4623                         case TCPS_FIN_WAIT_1:
4624                                 if (!tcp->tcp_fin_acked) {
4625                                         tcp->tcp_state = TCPS_CLOSING;
4626                                         DTRACE_TCP6(state__change, void, NULL,
4627                                             ip_xmit_attr_t *, connp->conn_ixa,
4628                                             void, NULL, tcp_t *, tcp, void,
4629                                             NULL, int32_t, TCPS_FIN_WAIT_1);
4630                                         break;
4631                                 }
4632                                 /* FALLTHRU */
4633                         case TCPS_FIN_WAIT_2:
4634                                 SET_TIME_WAIT(tcps, tcp, connp);
4635                                 DTRACE_TCP6(state__change, void, NULL,
4636                                     ip_xmit_attr_t *, connp->conn_ixa, void,
4637                                     NULL, tcp_t *, tcp, void, NULL, int32_t,
4638                                     TCPS_FIN_WAIT_2);
4639                                 if (seg_len) {
4640                                         /*
4641                                          * implies data piggybacked on FIN.
4642                                          * break to handle data.
4643                                          */
4644                                         break;
4645                                 }
4646                                 freemsg(mp);
4647                                 goto ack_check;
4648                         }
4649                 }
4650         }
4651         if (mp == NULL)
4652                 goto xmit_check;
4653         if (seg_len == 0) {
4654                 freemsg(mp);
4655                 goto xmit_check;
4656         }
4657         if (mp->b_rptr == mp->b_wptr) {
4658                 /*
4659                  * The header has been consumed, so we remove the
4660                  * zero-length mblk here.
4661                  */
4662                 mp1 = mp;
4663                 mp = mp->b_cont;
4664                 freeb(mp1);
4665         }
4666 update_ack:
4667         tcpha = tcp->tcp_tcpha;
4668         tcp->tcp_rack_cnt++;
4669         {
4670                 uint32_t cur_max;
4671 
4672                 cur_max = tcp->tcp_rack_cur_max;
4673                 if (tcp->tcp_rack_cnt >= cur_max) {
4674                         /*
4675                          * We have more unacked data than we should - send
4676                          * an ACK now.
4677                          */
4678                         flags |= TH_ACK_NEEDED;
4679                         cur_max++;
4680                         if (cur_max > tcp->tcp_rack_abs_max)
4681                                 tcp->tcp_rack_cur_max = tcp->tcp_rack_abs_max;
4682                         else
4683                                 tcp->tcp_rack_cur_max = cur_max;
4684                 } else if (TCP_IS_DETACHED(tcp)) {
4685                         /* We don't have an ACK timer for detached TCP. */
4686                         flags |= TH_ACK_NEEDED;
4687                 } else if (seg_len < mss) {
4688                         /*
4689                          * If we get a segment that is less than an mss, and we
4690                          * already have unacknowledged data, and the amount
4691                          * unacknowledged is not a multiple of mss, then we
4692                          * better generate an ACK now.  Otherwise, this may be
4693                          * the tail piece of a transaction, and we would rather
4694                          * wait for the response.
4695                          */
4696                         uint32_t udif;
4697                         ASSERT((uintptr_t)(tcp->tcp_rnxt - tcp->tcp_rack) <=
4698                             (uintptr_t)INT_MAX);
4699                         udif = (int)(tcp->tcp_rnxt - tcp->tcp_rack);
4700                         if (udif && (udif % mss))
4701                                 flags |= TH_ACK_NEEDED;
4702                         else
4703                                 flags |= TH_ACK_TIMER_NEEDED;
4704                 } else {
4705                         /* Start delayed ack timer */
4706                         flags |= TH_ACK_TIMER_NEEDED;
4707                 }
4708         }
4709         tcp->tcp_rnxt += seg_len;
4710         tcpha->tha_ack = htonl(tcp->tcp_rnxt);
4711 
4712         if (mp == NULL)
4713                 goto xmit_check;
4714 
4715         /* Update SACK list */
4716         if (tcp->tcp_snd_sack_ok && tcp->tcp_num_sack_blk > 0) {
4717                 tcp_sack_remove(tcp->tcp_sack_list, tcp->tcp_rnxt,
4718                     &(tcp->tcp_num_sack_blk));
4719         }
4720 
4721         if (tcp->tcp_urp_mp) {
4722                 tcp->tcp_urp_mp->b_cont = mp;
4723                 mp = tcp->tcp_urp_mp;
4724                 tcp->tcp_urp_mp = NULL;
4725                 /* Ready for a new signal. */
4726                 tcp->tcp_urp_last_valid = B_FALSE;
4727 #ifdef DEBUG
4728                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4729                     "tcp_rput: sending exdata_ind %s",
4730                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
4731 #endif /* DEBUG */
4732         }
4733 
4734         /*
4735          * Check for ancillary data changes compared to last segment.
4736          */
4737         if (connp->conn_recv_ancillary.crb_all != 0) {
4738                 mp = tcp_input_add_ancillary(tcp, mp, &ipp, ira);
4739                 if (mp == NULL)
4740                         return;
4741         }
4742 
4743         if (IPCL_IS_NONSTR(connp)) {
4744                 /*
4745                  * Non-STREAMS socket
4746                  */
4747                 boolean_t push = flags & (TH_PUSH|TH_FIN);
4748                 int error;
4749 
4750                 if ((*sockupcalls->su_recv)(connp->conn_upper_handle,
4751                     mp, seg_len, 0, &error, &push) <= 0) {
4752                         /*
4753                          * We should never be in middle of a
4754                          * fallback, the squeue guarantees that.
4755                          */
4756                         ASSERT(error != EOPNOTSUPP);
4757                         if (error == ENOSPC)
4758                                 tcp->tcp_rwnd -= seg_len;
4759                 } else if (push) {
4760                         /* PUSH bit set and sockfs is not flow controlled */
4761                         flags |= tcp_rwnd_reopen(tcp);
4762                 }
4763         } else if (tcp->tcp_listener != NULL || tcp->tcp_hard_binding) {
4764                 /*
4765                  * Side queue inbound data until the accept happens.
4766                  * tcp_accept/tcp_rput drains this when the accept happens.
4767                  * M_DATA is queued on b_cont. Otherwise (T_OPTDATA_IND or
4768                  * T_EXDATA_IND) it is queued on b_next.
4769                  * XXX Make urgent data use this. Requires:
4770                  *      Removing tcp_listener check for TH_URG
4771                  *      Making M_PCPROTO and MARK messages skip the eager case
4772                  */
4773 
4774                 tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4775         } else {
4776                 /* Active STREAMS socket */
4777                 if (mp->b_datap->db_type != M_DATA ||
4778                     (flags & TH_MARKNEXT_NEEDED)) {
4779                         if (tcp->tcp_rcv_list != NULL) {
4780                                 flags |= tcp_rcv_drain(tcp);
4781                         }
4782                         ASSERT(tcp->tcp_rcv_list == NULL ||
4783                             tcp->tcp_fused_sigurg);
4784 
4785                         if (flags & TH_MARKNEXT_NEEDED) {
4786 #ifdef DEBUG
4787                                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4788                                     "tcp_rput: sending MSGMARKNEXT %s",
4789                                     tcp_display(tcp, NULL,
4790                                     DISP_PORT_ONLY));
4791 #endif /* DEBUG */
4792                                 mp->b_flag |= MSGMARKNEXT;
4793                                 flags &= ~TH_MARKNEXT_NEEDED;
4794                         }
4795 
4796                         if (is_system_labeled())
4797                                 tcp_setcred_data(mp, ira);
4798 
4799                         putnext(connp->conn_rq, mp);
4800                         if (!canputnext(connp->conn_rq))
4801                                 tcp->tcp_rwnd -= seg_len;
4802                 } else if ((flags & (TH_PUSH|TH_FIN)) ||
4803                     tcp->tcp_rcv_cnt + seg_len >= connp->conn_rcvbuf >> 3) {
4804                         if (tcp->tcp_rcv_list != NULL) {
4805                                 /*
4806                                  * Enqueue the new segment first and then
4807                                  * call tcp_rcv_drain() to send all data
4808                                  * up.  The other way to do this is to
4809                                  * send all queued data up and then call
4810                                  * putnext() to send the new segment up.
4811                                  * This way can remove the else part later
4812                                  * on.
4813                                  *
4814                                  * We don't do this to avoid one more call to
4815                                  * canputnext() as tcp_rcv_drain() needs to
4816                                  * call canputnext().
4817                                  */
4818                                 tcp_rcv_enqueue(tcp, mp, seg_len,
4819                                     ira->ira_cred);
4820                                 flags |= tcp_rcv_drain(tcp);
4821                         } else {
4822                                 if (is_system_labeled())
4823                                         tcp_setcred_data(mp, ira);
4824 
4825                                 putnext(connp->conn_rq, mp);
4826                                 if (!canputnext(connp->conn_rq))
4827                                         tcp->tcp_rwnd -= seg_len;
4828                         }
4829                 } else {
4830                         /*
4831                          * Enqueue all packets when processing an mblk
4832                          * from the co queue and also enqueue normal packets.
4833                          */
4834                         tcp_rcv_enqueue(tcp, mp, seg_len, ira->ira_cred);
4835                 }
4836                 /*
4837                  * Make sure the timer is running if we have data waiting
4838                  * for a push bit. This provides resiliency against
4839                  * implementations that do not correctly generate push bits.
4840                  */
4841                 if (tcp->tcp_rcv_list != NULL && tcp->tcp_push_tid == 0) {
4842                         /*
4843                          * The connection may be closed at this point, so don't
4844                          * do anything for a detached tcp.
4845                          */
4846                         if (!TCP_IS_DETACHED(tcp))
4847                                 tcp->tcp_push_tid = TCP_TIMER(tcp,
4848                                     tcp_push_timer,
4849                                     tcps->tcps_push_timer_interval);
4850                 }
4851         }
4852 
4853 xmit_check:
4854         /* Is there anything left to do? */
4855         ASSERT(!(flags & TH_MARKNEXT_NEEDED));
4856         if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_ACK_NEEDED|
4857             TH_NEED_SACK_REXMIT|TH_LIMIT_XMIT|TH_ACK_TIMER_NEEDED|
4858             TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4859                 goto done;
4860 
4861         /* Any transmit work to do and a non-zero window? */
4862         if ((flags & (TH_REXMIT_NEEDED|TH_XMIT_NEEDED|TH_NEED_SACK_REXMIT|
4863             TH_LIMIT_XMIT)) && tcp->tcp_swnd != 0) {
4864                 if (flags & TH_REXMIT_NEEDED) {
4865                         uint32_t snd_size = tcp->tcp_snxt - tcp->tcp_suna;
4866 
4867                         TCPS_BUMP_MIB(tcps, tcpOutFastRetrans);
4868                         if (snd_size > mss)
4869                                 snd_size = mss;
4870                         if (snd_size > tcp->tcp_swnd)
4871                                 snd_size = tcp->tcp_swnd;
4872                         mp1 = tcp_xmit_mp(tcp, tcp->tcp_xmit_head, snd_size,
4873                             NULL, NULL, tcp->tcp_suna, B_TRUE, &snd_size,
4874                             B_TRUE);
4875 
4876                         if (mp1 != NULL) {
4877                                 tcp->tcp_xmit_head->b_prev =
4878                                     (mblk_t *)LBOLT_FASTPATH;
4879                                 tcp->tcp_csuna = tcp->tcp_snxt;
4880                                 TCPS_BUMP_MIB(tcps, tcpRetransSegs);
4881                                 TCPS_UPDATE_MIB(tcps, tcpRetransBytes,
4882                                     snd_size);
4883                                 tcp_send_data(tcp, mp1);
4884                         }
4885                 }
4886                 if (flags & TH_NEED_SACK_REXMIT) {
4887                         tcp_sack_rexmit(tcp, &flags);
4888                 }
4889                 /*
4890                  * For TH_LIMIT_XMIT, tcp_wput_data() is called to send
4891                  * out new segment.  Note that tcp_rexmit should not be
4892                  * set, otherwise TH_LIMIT_XMIT should not be set.
4893                  */
4894                 if (flags & (TH_XMIT_NEEDED|TH_LIMIT_XMIT)) {
4895                         if (!tcp->tcp_rexmit) {
4896                                 tcp_wput_data(tcp, NULL, B_FALSE);
4897                         } else {
4898                                 tcp_ss_rexmit(tcp);
4899                         }
4900                 }
4901                 /*
4902                  * Adjust tcp_cwnd back to normal value after sending
4903                  * new data segments.
4904                  */
4905                 if (flags & TH_LIMIT_XMIT) {
4906                         tcp->tcp_cwnd -= mss << (tcp->tcp_dupack_cnt - 1);
4907                         /*
4908                          * This will restart the timer.  Restarting the
4909                          * timer is used to avoid a timeout before the
4910                          * limited transmitted segment's ACK gets back.
4911                          */
4912                         if (tcp->tcp_xmit_head != NULL)
4913                                 tcp->tcp_xmit_head->b_prev =
4914                                     (mblk_t *)LBOLT_FASTPATH;
4915                 }
4916 
4917                 /* Anything more to do? */
4918                 if ((flags & (TH_ACK_NEEDED|TH_ACK_TIMER_NEEDED|
4919                     TH_ORDREL_NEEDED|TH_SEND_URP_MARK)) == 0)
4920                         goto done;
4921         }
4922 ack_check:
4923         if (flags & TH_SEND_URP_MARK) {
4924                 ASSERT(tcp->tcp_urp_mark_mp);
4925                 ASSERT(!IPCL_IS_NONSTR(connp));
4926                 /*
4927                  * Send up any queued data and then send the mark message
4928                  */
4929                 if (tcp->tcp_rcv_list != NULL) {
4930                         flags |= tcp_rcv_drain(tcp);
4931 
4932                 }
4933                 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
4934                 mp1 = tcp->tcp_urp_mark_mp;
4935                 tcp->tcp_urp_mark_mp = NULL;
4936                 if (is_system_labeled())
4937                         tcp_setcred_data(mp1, ira);
4938 
4939                 putnext(connp->conn_rq, mp1);
4940 #ifdef DEBUG
4941                 (void) strlog(TCP_MOD_ID, 0, 1, SL_TRACE,
4942                     "tcp_rput: sending zero-length %s %s",
4943                     ((mp1->b_flag & MSGMARKNEXT) ? "MSGMARKNEXT" :
4944                     "MSGNOTMARKNEXT"),
4945                     tcp_display(tcp, NULL, DISP_PORT_ONLY));
4946 #endif /* DEBUG */
4947                 flags &= ~TH_SEND_URP_MARK;
4948         }
4949         if (flags & TH_ACK_NEEDED) {
4950                 /*
4951                  * Time to send an ack for some reason.
4952                  */
4953                 mp1 = tcp_ack_mp(tcp);
4954 
4955                 if (mp1 != NULL) {
4956                         tcp_send_data(tcp, mp1);
4957                         BUMP_LOCAL(tcp->tcp_obsegs);
4958                         TCPS_BUMP_MIB(tcps, tcpOutAck);
4959                 }
4960                 if (tcp->tcp_ack_tid != 0) {
4961                         (void) TCP_TIMER_CANCEL(tcp, tcp->tcp_ack_tid);
4962                         tcp->tcp_ack_tid = 0;
4963                 }
4964         }
4965         if (flags & TH_ACK_TIMER_NEEDED) {
4966                 /*
4967                  * Arrange for deferred ACK or push wait timeout.
4968                  * Start timer if it is not already running.
4969                  */
4970                 if (tcp->tcp_ack_tid == 0) {
4971                         tcp->tcp_ack_tid = TCP_TIMER(tcp, tcp_ack_timer,
4972                             tcp->tcp_localnet ?
4973                             tcps->tcps_local_dack_interval :
4974                             tcps->tcps_deferred_ack_interval);
4975                 }
4976         }
4977         if (flags & TH_ORDREL_NEEDED) {
4978                 /*
4979                  * Notify upper layer about an orderly release. If this is
4980                  * a non-STREAMS socket, then just make an upcall. For STREAMS
4981                  * we send up an ordrel_ind, unless this is an eager, in which
4982                  * case the ordrel will be sent when tcp_accept_finish runs.
4983                  * Note that for non-STREAMS we make an upcall even if it is an
4984                  * eager, because we have an upper handle to send it to.
4985                  */
4986                 ASSERT(IPCL_IS_NONSTR(connp) || tcp->tcp_listener == NULL);
4987                 ASSERT(!tcp->tcp_detached);
4988 
4989                 if (IPCL_IS_NONSTR(connp)) {
4990                         ASSERT(tcp->tcp_ordrel_mp == NULL);
4991                         tcp->tcp_ordrel_done = B_TRUE;
4992                         (*sockupcalls->su_opctl)(connp->conn_upper_handle,
4993                             SOCK_OPCTL_SHUT_RECV, 0);
4994                         goto done;
4995                 }
4996 
4997                 if (tcp->tcp_rcv_list != NULL) {
4998                         /*
4999                          * Push any mblk(s) enqueued from co processing.
5000                          */
5001                         flags |= tcp_rcv_drain(tcp);
5002                 }
5003                 ASSERT(tcp->tcp_rcv_list == NULL || tcp->tcp_fused_sigurg);
5004 
5005                 mp1 = tcp->tcp_ordrel_mp;
5006                 tcp->tcp_ordrel_mp = NULL;
5007                 tcp->tcp_ordrel_done = B_TRUE;
5008                 putnext(connp->conn_rq, mp1);
5009         }
5010 done:
5011         ASSERT(!(flags & TH_MARKNEXT_NEEDED));
5012 }
5013 
5014 /*
5015  * Attach ancillary data to a received TCP segments for the
5016  * ancillary pieces requested by the application that are
5017  * different than they were in the previous data segment.
5018  *
5019  * Save the "current" values once memory allocation is ok so that
5020  * when memory allocation fails we can just wait for the next data segment.
5021  */
5022 static mblk_t *
5023 tcp_input_add_ancillary(tcp_t *tcp, mblk_t *mp, ip_pkt_t *ipp,
5024     ip_recv_attr_t *ira)
5025 {
5026         struct T_optdata_ind *todi;
5027         int optlen;
5028         uchar_t *optptr;
5029         struct T_opthdr *toh;
5030         crb_t addflag;  /* Which pieces to add */
5031         mblk_t *mp1;
5032         conn_t  *connp = tcp->tcp_connp;
5033 
5034         optlen = 0;
5035         addflag.crb_all = 0;
5036         /* If app asked for pktinfo and the index has changed ... */
5037         if (connp->conn_recv_ancillary.crb_ip_recvpktinfo &&
5038             ira->ira_ruifindex != tcp->tcp_recvifindex) {
5039                 optlen += sizeof (struct T_opthdr) +
5040                     sizeof (struct in6_pktinfo);
5041                 addflag.crb_ip_recvpktinfo = 1;
5042         }
5043         /* If app asked for hoplimit and it has changed ... */
5044         if (connp->conn_recv_ancillary.crb_ipv6_recvhoplimit &&
5045             ipp->ipp_hoplimit != tcp->tcp_recvhops) {
5046                 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5047                 addflag.crb_ipv6_recvhoplimit = 1;
5048         }
5049         /* If app asked for tclass and it has changed ... */
5050         if (connp->conn_recv_ancillary.crb_ipv6_recvtclass &&
5051             ipp->ipp_tclass != tcp->tcp_recvtclass) {
5052                 optlen += sizeof (struct T_opthdr) + sizeof (uint_t);
5053                 addflag.crb_ipv6_recvtclass = 1;
5054         }
5055         /*
5056          * If app asked for hopbyhop headers and it has changed ...
5057          * For security labels, note that (1) security labels can't change on
5058          * a connected socket at all, (2) we're connected to at most one peer,
5059          * (3) if anything changes, then it must be some other extra option.
5060          */
5061         if (connp->conn_recv_ancillary.crb_ipv6_recvhopopts &&
5062             ip_cmpbuf(tcp->tcp_hopopts, tcp->tcp_hopoptslen,
5063             (ipp->ipp_fields & IPPF_HOPOPTS),
5064             ipp->ipp_hopopts, ipp->ipp_hopoptslen)) {
5065                 optlen += sizeof (struct T_opthdr) + ipp->ipp_hopoptslen;
5066                 addflag.crb_ipv6_recvhopopts = 1;
5067                 if (!ip_allocbuf((void **)&tcp->tcp_hopopts,
5068                     &tcp->tcp_hopoptslen, (ipp->ipp_fields & IPPF_HOPOPTS),
5069                     ipp->ipp_hopopts, ipp->ipp_hopoptslen))
5070                         return (mp);
5071         }
5072         /* If app asked for dst headers before routing headers ... */
5073         if (connp->conn_recv_ancillary.crb_ipv6_recvrthdrdstopts &&
5074             ip_cmpbuf(tcp->tcp_rthdrdstopts, tcp->tcp_rthdrdstoptslen,
5075             (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5076             ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen)) {
5077                 optlen += sizeof (struct T_opthdr) +
5078                     ipp->ipp_rthdrdstoptslen;
5079                 addflag.crb_ipv6_recvrthdrdstopts = 1;
5080                 if (!ip_allocbuf((void **)&tcp->tcp_rthdrdstopts,
5081                     &tcp->tcp_rthdrdstoptslen,
5082                     (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5083                     ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen))
5084                         return (mp);
5085         }
5086         /* If app asked for routing headers and it has changed ... */
5087         if (connp->conn_recv_ancillary.crb_ipv6_recvrthdr &&
5088             ip_cmpbuf(tcp->tcp_rthdr, tcp->tcp_rthdrlen,
5089             (ipp->ipp_fields & IPPF_RTHDR),
5090             ipp->ipp_rthdr, ipp->ipp_rthdrlen)) {
5091                 optlen += sizeof (struct T_opthdr) + ipp->ipp_rthdrlen;
5092                 addflag.crb_ipv6_recvrthdr = 1;
5093                 if (!ip_allocbuf((void **)&tcp->tcp_rthdr,
5094                     &tcp->tcp_rthdrlen, (ipp->ipp_fields & IPPF_RTHDR),
5095                     ipp->ipp_rthdr, ipp->ipp_rthdrlen))
5096                         return (mp);
5097         }
5098         /* If app asked for dest headers and it has changed ... */
5099         if ((connp->conn_recv_ancillary.crb_ipv6_recvdstopts ||
5100             connp->conn_recv_ancillary.crb_old_ipv6_recvdstopts) &&
5101             ip_cmpbuf(tcp->tcp_dstopts, tcp->tcp_dstoptslen,
5102             (ipp->ipp_fields & IPPF_DSTOPTS),
5103             ipp->ipp_dstopts, ipp->ipp_dstoptslen)) {
5104                 optlen += sizeof (struct T_opthdr) + ipp->ipp_dstoptslen;
5105                 addflag.crb_ipv6_recvdstopts = 1;
5106                 if (!ip_allocbuf((void **)&tcp->tcp_dstopts,
5107                     &tcp->tcp_dstoptslen, (ipp->ipp_fields & IPPF_DSTOPTS),
5108                     ipp->ipp_dstopts, ipp->ipp_dstoptslen))
5109                         return (mp);
5110         }
5111 
5112         if (optlen == 0) {
5113                 /* Nothing to add */
5114                 return (mp);
5115         }
5116         mp1 = allocb(sizeof (struct T_optdata_ind) + optlen, BPRI_MED);
5117         if (mp1 == NULL) {
5118                 /*
5119                  * Defer sending ancillary data until the next TCP segment
5120                  * arrives.
5121                  */
5122                 return (mp);
5123         }
5124         mp1->b_cont = mp;
5125         mp = mp1;
5126         mp->b_wptr += sizeof (*todi) + optlen;
5127         mp->b_datap->db_type = M_PROTO;
5128         todi = (struct T_optdata_ind *)mp->b_rptr;
5129         todi->PRIM_type = T_OPTDATA_IND;
5130         todi->DATA_flag = 1; /* MORE data */
5131         todi->OPT_length = optlen;
5132         todi->OPT_offset = sizeof (*todi);
5133         optptr = (uchar_t *)&todi[1];
5134         /*
5135          * If app asked for pktinfo and the index has changed ...
5136          * Note that the local address never changes for the connection.
5137          */
5138         if (addflag.crb_ip_recvpktinfo) {
5139                 struct in6_pktinfo *pkti;
5140                 uint_t ifindex;
5141 
5142                 ifindex = ira->ira_ruifindex;
5143                 toh = (struct T_opthdr *)optptr;
5144                 toh->level = IPPROTO_IPV6;
5145                 toh->name = IPV6_PKTINFO;
5146                 toh->len = sizeof (*toh) + sizeof (*pkti);
5147                 toh->status = 0;
5148                 optptr += sizeof (*toh);
5149                 pkti = (struct in6_pktinfo *)optptr;
5150                 pkti->ipi6_addr = connp->conn_laddr_v6;
5151                 pkti->ipi6_ifindex = ifindex;
5152                 optptr += sizeof (*pkti);
5153                 ASSERT(OK_32PTR(optptr));
5154                 /* Save as "last" value */
5155                 tcp->tcp_recvifindex = ifindex;
5156         }
5157         /* If app asked for hoplimit and it has changed ... */
5158         if (addflag.crb_ipv6_recvhoplimit) {
5159                 toh = (struct T_opthdr *)optptr;
5160                 toh->level = IPPROTO_IPV6;
5161                 toh->name = IPV6_HOPLIMIT;
5162                 toh->len = sizeof (*toh) + sizeof (uint_t);
5163                 toh->status = 0;
5164                 optptr += sizeof (*toh);
5165                 *(uint_t *)optptr = ipp->ipp_hoplimit;
5166                 optptr += sizeof (uint_t);
5167                 ASSERT(OK_32PTR(optptr));
5168                 /* Save as "last" value */
5169                 tcp->tcp_recvhops = ipp->ipp_hoplimit;
5170         }
5171         /* If app asked for tclass and it has changed ... */
5172         if (addflag.crb_ipv6_recvtclass) {
5173                 toh = (struct T_opthdr *)optptr;
5174                 toh->level = IPPROTO_IPV6;
5175                 toh->name = IPV6_TCLASS;
5176                 toh->len = sizeof (*toh) + sizeof (uint_t);
5177                 toh->status = 0;
5178                 optptr += sizeof (*toh);
5179                 *(uint_t *)optptr = ipp->ipp_tclass;
5180                 optptr += sizeof (uint_t);
5181                 ASSERT(OK_32PTR(optptr));
5182                 /* Save as "last" value */
5183                 tcp->tcp_recvtclass = ipp->ipp_tclass;
5184         }
5185         if (addflag.crb_ipv6_recvhopopts) {
5186                 toh = (struct T_opthdr *)optptr;
5187                 toh->level = IPPROTO_IPV6;
5188                 toh->name = IPV6_HOPOPTS;
5189                 toh->len = sizeof (*toh) + ipp->ipp_hopoptslen;
5190                 toh->status = 0;
5191                 optptr += sizeof (*toh);
5192                 bcopy((uchar_t *)ipp->ipp_hopopts, optptr, ipp->ipp_hopoptslen);
5193                 optptr += ipp->ipp_hopoptslen;
5194                 ASSERT(OK_32PTR(optptr));
5195                 /* Save as last value */
5196                 ip_savebuf((void **)&tcp->tcp_hopopts, &tcp->tcp_hopoptslen,
5197                     (ipp->ipp_fields & IPPF_HOPOPTS),
5198                     ipp->ipp_hopopts, ipp->ipp_hopoptslen);
5199         }
5200         if (addflag.crb_ipv6_recvrthdrdstopts) {
5201                 toh = (struct T_opthdr *)optptr;
5202                 toh->level = IPPROTO_IPV6;
5203                 toh->name = IPV6_RTHDRDSTOPTS;
5204                 toh->len = sizeof (*toh) + ipp->ipp_rthdrdstoptslen;
5205                 toh->status = 0;
5206                 optptr += sizeof (*toh);
5207                 bcopy(ipp->ipp_rthdrdstopts, optptr, ipp->ipp_rthdrdstoptslen);
5208                 optptr += ipp->ipp_rthdrdstoptslen;
5209                 ASSERT(OK_32PTR(optptr));
5210                 /* Save as last value */
5211                 ip_savebuf((void **)&tcp->tcp_rthdrdstopts,
5212                     &tcp->tcp_rthdrdstoptslen,
5213                     (ipp->ipp_fields & IPPF_RTHDRDSTOPTS),
5214                     ipp->ipp_rthdrdstopts, ipp->ipp_rthdrdstoptslen);
5215         }
5216         if (addflag.crb_ipv6_recvrthdr) {
5217                 toh = (struct T_opthdr *)optptr;
5218                 toh->level = IPPROTO_IPV6;
5219                 toh->name = IPV6_RTHDR;
5220                 toh->len = sizeof (*toh) + ipp->ipp_rthdrlen;
5221                 toh->status = 0;
5222                 optptr += sizeof (*toh);
5223                 bcopy(ipp->ipp_rthdr, optptr, ipp->ipp_rthdrlen);
5224                 optptr += ipp->ipp_rthdrlen;
5225                 ASSERT(OK_32PTR(optptr));
5226                 /* Save as last value */
5227                 ip_savebuf((void **)&tcp->tcp_rthdr, &tcp->tcp_rthdrlen,
5228                     (ipp->ipp_fields & IPPF_RTHDR),
5229                     ipp->ipp_rthdr, ipp->ipp_rthdrlen);
5230         }
5231         if (addflag.crb_ipv6_recvdstopts) {
5232                 toh = (struct T_opthdr *)optptr;
5233                 toh->level = IPPROTO_IPV6;
5234                 toh->name = IPV6_DSTOPTS;
5235                 toh->len = sizeof (*toh) + ipp->ipp_dstoptslen;
5236                 toh->status = 0;
5237                 optptr += sizeof (*toh);
5238                 bcopy(ipp->ipp_dstopts, optptr, ipp->ipp_dstoptslen);
5239                 optptr += ipp->ipp_dstoptslen;
5240                 ASSERT(OK_32PTR(optptr));
5241                 /* Save as last value */
5242                 ip_savebuf((void **)&tcp->tcp_dstopts, &tcp->tcp_dstoptslen,
5243                     (ipp->ipp_fields & IPPF_DSTOPTS),
5244                     ipp->ipp_dstopts, ipp->ipp_dstoptslen);
5245         }
5246         ASSERT(optptr == mp->b_wptr);
5247         return (mp);
5248 }
5249 
5250 /* The minimum of smoothed mean deviation in RTO calculation. */
5251 #define TCP_SD_MIN      400
5252 
5253 /*
5254  * Set RTO for this connection.  The formula is from Jacobson and Karels'
5255  * "Congestion Avoidance and Control" in SIGCOMM '88.  The variable names
5256  * are the same as those in Appendix A.2 of that paper.
5257  *
5258  * m = new measurement
5259  * sa = smoothed RTT average (8 * average estimates).
5260  * sv = smoothed mean deviation (mdev) of RTT (4 * deviation estimates).
5261  */
5262 static void
5263 tcp_set_rto(tcp_t *tcp, clock_t rtt)
5264 {
5265         long m = TICK_TO_MSEC(rtt);
5266         clock_t sa = tcp->tcp_rtt_sa;
5267         clock_t sv = tcp->tcp_rtt_sd;
5268         clock_t rto;
5269         tcp_stack_t     *tcps = tcp->tcp_tcps;
5270 
5271         TCPS_BUMP_MIB(tcps, tcpRttUpdate);
5272         tcp->tcp_rtt_update++;
5273 
5274         /* tcp_rtt_sa is not 0 means this is a new sample. */
5275         if (sa != 0) {
5276                 /*
5277                  * Update average estimator:
5278                  *      new rtt = 7/8 old rtt + 1/8 Error
5279                  */
5280 
5281                 /* m is now Error in estimate. */
5282                 m -= sa >> 3;
5283                 if ((sa += m) <= 0) {
5284                         /*
5285                          * Don't allow the smoothed average to be negative.
5286                          * We use 0 to denote reinitialization of the
5287                          * variables.
5288                          */
5289                         sa = 1;
5290                 }
5291 
5292                 /*
5293                  * Update deviation estimator:
5294                  *      new mdev = 3/4 old mdev + 1/4 (abs(Error) - old mdev)
5295                  */
5296                 if (m < 0)
5297                         m = -m;
5298                 m -= sv >> 2;
5299                 sv += m;
5300         } else {
5301                 /*
5302                  * This follows BSD's implementation.  So the reinitialized
5303                  * RTO is 3 * m.  We cannot go less than 2 because if the
5304                  * link is bandwidth dominated, doubling the window size
5305                  * during slow start means doubling the RTT.  We want to be
5306                  * more conservative when we reinitialize our estimates.  3
5307                  * is just a convenient number.
5308                  */
5309                 sa = m << 3;
5310                 sv = m << 1;
5311         }
5312         if (sv < TCP_SD_MIN) {
5313                 /*
5314                  * We do not know that if sa captures the delay ACK
5315                  * effect as in a long train of segments, a receiver
5316                  * does not delay its ACKs.  So set the minimum of sv
5317                  * to be TCP_SD_MIN, which is default to 400 ms, twice
5318                  * of BSD DATO.  That means the minimum of mean
5319                  * deviation is 100 ms.
5320                  *
5321                  */
5322                 sv = TCP_SD_MIN;
5323         }
5324         tcp->tcp_rtt_sa = sa;
5325         tcp->tcp_rtt_sd = sv;
5326         /*
5327          * RTO = average estimates (sa / 8) + 4 * deviation estimates (sv)
5328          *
5329          * Add tcp_rexmit_interval extra in case of extreme environment
5330          * where the algorithm fails to work.  The default value of
5331          * tcp_rexmit_interval_extra should be 0.
5332          *
5333          * As we use a finer grained clock than BSD and update
5334          * RTO for every ACKs, add in another .25 of RTT to the
5335          * deviation of RTO to accomodate burstiness of 1/4 of
5336          * window size.
5337          */
5338         rto = (sa >> 3) + sv + tcps->tcps_rexmit_interval_extra + (sa >> 5);
5339 
5340         TCP_SET_RTO(tcp, rto);
5341 
5342         /* Now, we can reset tcp_timer_backoff to use the new RTO... */
5343         tcp->tcp_timer_backoff = 0;
5344 }
5345 
5346 /*
5347  * On a labeled system we have some protocols above TCP, such as RPC, which
5348  * appear to assume that every mblk in a chain has a db_credp.
5349  */
5350 static void
5351 tcp_setcred_data(mblk_t *mp, ip_recv_attr_t *ira)
5352 {
5353         ASSERT(is_system_labeled());
5354         ASSERT(ira->ira_cred != NULL);
5355 
5356         while (mp != NULL) {
5357                 mblk_setcred(mp, ira->ira_cred, NOPID);
5358                 mp = mp->b_cont;
5359         }
5360 }
5361 
5362 uint_t
5363 tcp_rwnd_reopen(tcp_t *tcp)
5364 {
5365         uint_t ret = 0;
5366         uint_t thwin;
5367         conn_t *connp = tcp->tcp_connp;
5368 
5369         /* Learn the latest rwnd information that we sent to the other side. */
5370         thwin = ((uint_t)ntohs(tcp->tcp_tcpha->tha_win))
5371             << tcp->tcp_rcv_ws;
5372         /* This is peer's calculated send window (our receive window). */
5373         thwin -= tcp->tcp_rnxt - tcp->tcp_rack;
5374         /*
5375          * Increase the receive window to max.  But we need to do receiver
5376          * SWS avoidance.  This means that we need to check the increase of
5377          * of receive window is at least 1 MSS.
5378          */
5379         if (connp->conn_rcvbuf - thwin >= tcp->tcp_mss) {
5380                 /*
5381                  * If the window that the other side knows is less than max
5382                  * deferred acks segments, send an update immediately.
5383                  */
5384                 if (thwin < tcp->tcp_rack_cur_max * tcp->tcp_mss) {
5385                         TCPS_BUMP_MIB(tcp->tcp_tcps, tcpOutWinUpdate);
5386                         ret = TH_ACK_NEEDED;
5387                 }
5388                 tcp->tcp_rwnd = connp->conn_rcvbuf;
5389         }
5390         return (ret);
5391 }
5392 
5393 /*
5394  * Handle a packet that has been reclassified by TCP.
5395  * This function drops the ref on connp that the caller had.
5396  */
5397 void
5398 tcp_reinput(conn_t *connp, mblk_t *mp, ip_recv_attr_t *ira, ip_stack_t *ipst)
5399 {
5400         ipsec_stack_t   *ipss = ipst->ips_netstack->netstack_ipsec;
5401 
5402         if (connp->conn_incoming_ifindex != 0 &&
5403             connp->conn_incoming_ifindex != ira->ira_ruifindex) {
5404                 freemsg(mp);
5405                 CONN_DEC_REF(connp);
5406                 return;
5407         }
5408 
5409         if (CONN_INBOUND_POLICY_PRESENT_V6(connp, ipss) ||
5410             (ira->ira_flags & IRAF_IPSEC_SECURE)) {
5411                 ip6_t *ip6h;
5412                 ipha_t *ipha;
5413 
5414                 if (ira->ira_flags & IRAF_IS_IPV4) {
5415                         ipha = (ipha_t *)mp->b_rptr;
5416                         ip6h = NULL;
5417                 } else {
5418                         ipha = NULL;
5419                         ip6h = (ip6_t *)mp->b_rptr;
5420                 }
5421                 mp = ipsec_check_inbound_policy(mp, connp, ipha, ip6h, ira);
5422                 if (mp == NULL) {
5423                         BUMP_MIB(&ipst->ips_ip_mib, ipIfStatsInDiscards);
5424                         /* Note that mp is NULL */
5425                         ip_drop_input("ipIfStatsInDiscards", mp, NULL);
5426                         CONN_DEC_REF(connp);
5427                         return;
5428                 }
5429         }
5430 
5431         if (IPCL_IS_TCP(connp)) {
5432                 /*
5433                  * do not drain, certain use cases can blow
5434                  * the stack
5435                  */
5436                 SQUEUE_ENTER_ONE(connp->conn_sqp, mp,
5437                     connp->conn_recv, connp, ira,
5438                     SQ_NODRAIN, SQTAG_IP_TCP_INPUT);
5439         } else {
5440                 /* Not TCP; must be SOCK_RAW, IPPROTO_TCP */
5441                 (connp->conn_recv)(connp, mp, NULL,
5442                     ira);
5443                 CONN_DEC_REF(connp);
5444         }
5445 
5446 }
5447 
5448 /* ARGSUSED */
5449 static void
5450 tcp_rsrv_input(void *arg, mblk_t *mp, void *arg2, ip_recv_attr_t *dummy)
5451 {
5452         conn_t  *connp = (conn_t *)arg;
5453         tcp_t   *tcp = connp->conn_tcp;
5454         queue_t *q = connp->conn_rq;
5455 
5456         ASSERT(!IPCL_IS_NONSTR(connp));
5457         mutex_enter(&tcp->tcp_rsrv_mp_lock);
5458         tcp->tcp_rsrv_mp = mp;
5459         mutex_exit(&tcp->tcp_rsrv_mp_lock);
5460 
5461         if (TCP_IS_DETACHED(tcp) || q == NULL) {
5462                 return;
5463         }
5464 
5465         if (tcp->tcp_fused) {
5466                 tcp_fuse_backenable(tcp);
5467                 return;
5468         }
5469 
5470         if (canputnext(q)) {
5471                 /* Not flow-controlled, open rwnd */
5472                 tcp->tcp_rwnd = connp->conn_rcvbuf;
5473 
5474                 /*
5475                  * Send back a window update immediately if TCP is above
5476                  * ESTABLISHED state and the increase of the rcv window
5477                  * that the other side knows is at least 1 MSS after flow
5478                  * control is lifted.
5479                  */
5480                 if (tcp->tcp_state >= TCPS_ESTABLISHED &&
5481                     tcp_rwnd_reopen(tcp) == TH_ACK_NEEDED) {
5482                         tcp_xmit_ctl(NULL, tcp,
5483                             (tcp->tcp_swnd == 0) ? tcp->tcp_suna :
5484                             tcp->tcp_snxt, tcp->tcp_rnxt, TH_ACK);
5485                 }
5486         }
5487 }
5488 
5489 /*
5490  * The read side service routine is called mostly when we get back-enabled as a
5491  * result of flow control relief.  Since we don't actually queue anything in
5492  * TCP, we have no data to send out of here.  What we do is clear the receive
5493  * window, and send out a window update.
5494  */
5495 void
5496 tcp_rsrv(queue_t *q)
5497 {
5498         conn_t          *connp = Q_TO_CONN(q);
5499         tcp_t           *tcp = connp->conn_tcp;
5500         mblk_t          *mp;
5501 
5502         /* No code does a putq on the read side */
5503         ASSERT(q->q_first == NULL);
5504 
5505         /*
5506          * If tcp->tcp_rsrv_mp == NULL, it means that tcp_rsrv() has already
5507          * been run.  So just return.
5508          */
5509         mutex_enter(&tcp->tcp_rsrv_mp_lock);
5510         if ((mp = tcp->tcp_rsrv_mp) == NULL) {
5511                 mutex_exit(&tcp->tcp_rsrv_mp_lock);
5512                 return;
5513         }
5514         tcp->tcp_rsrv_mp = NULL;
5515         mutex_exit(&tcp->tcp_rsrv_mp_lock);
5516 
5517         CONN_INC_REF(connp);
5518         SQUEUE_ENTER_ONE(connp->conn_sqp, mp, tcp_rsrv_input, connp,
5519             NULL, SQ_PROCESS, SQTAG_TCP_RSRV);
5520 }
5521 
5522 /* At minimum we need 8 bytes in the TCP header for the lookup */
5523 #define ICMP_MIN_TCP_HDR        8
5524 
5525 /*
5526  * tcp_icmp_input is called as conn_recvicmp to process ICMP error messages
5527  * passed up by IP. The message is always received on the correct tcp_t.
5528  * Assumes that IP has pulled up everything up to and including the ICMP header.
5529  */
5530 /* ARGSUSED2 */
5531 void
5532 tcp_icmp_input(void *arg1, mblk_t *mp, void *arg2, ip_recv_attr_t *ira)
5533 {
5534         conn_t          *connp = (conn_t *)arg1;
5535         icmph_t         *icmph;
5536         ipha_t          *ipha;
5537         int             iph_hdr_length;
5538         tcpha_t         *tcpha;
5539         uint32_t        seg_seq;
5540         tcp_t           *tcp = connp->conn_tcp;
5541 
5542         /* Assume IP provides aligned packets */
5543         ASSERT(OK_32PTR(mp->b_rptr));
5544         ASSERT((MBLKL(mp) >= sizeof (ipha_t)));
5545 
5546         /*
5547          * It's possible we have a closed, but not yet destroyed, TCP
5548          * connection. Several fields (e.g. conn_ixa->ixa_ire) are invalid
5549          * in the closed state, so don't take any chances and drop the packet.
5550          */
5551         if (tcp->tcp_state == TCPS_CLOSED) {
5552                 freemsg(mp);
5553                 return;
5554         }
5555 
5556         /*
5557          * Verify IP version. Anything other than IPv4 or IPv6 packet is sent
5558          * upstream. ICMPv6 is handled in tcp_icmp_error_ipv6.
5559          */
5560         if (!(ira->ira_flags & IRAF_IS_IPV4)) {
5561                 tcp_icmp_error_ipv6(tcp, mp, ira);
5562                 return;
5563         }
5564 
5565         /* Skip past the outer IP and ICMP headers */
5566         iph_hdr_length = ira->ira_ip_hdr_length;
5567         icmph = (icmph_t *)&mp->b_rptr[iph_hdr_length];
5568         /*
5569          * If we don't have the correct outer IP header length
5570          * or if we don't have a complete inner IP header
5571          * drop it.
5572          */
5573         if (iph_hdr_length < sizeof (ipha_t) ||
5574             (ipha_t *)&icmph[1] + 1 > (ipha_t *)mp->b_wptr) {
5575 noticmpv4:
5576                 freemsg(mp);
5577                 return;
5578         }
5579         ipha = (ipha_t *)&icmph[1];
5580 
5581         /* Skip past the inner IP and find the ULP header */
5582         iph_hdr_length = IPH_HDR_LENGTH(ipha);
5583         tcpha = (tcpha_t *)((char *)ipha + iph_hdr_length);
5584         /*
5585          * If we don't have the correct inner IP header length or if the ULP
5586          * is not IPPROTO_TCP or if we don't have at least ICMP_MIN_TCP_HDR
5587          * bytes of TCP header, drop it.
5588          */
5589         if (iph_hdr_length < sizeof (ipha_t) ||
5590             ipha->ipha_protocol != IPPROTO_TCP ||
5591             (uchar_t *)tcpha + ICMP_MIN_TCP_HDR > mp->b_wptr) {
5592                 goto noticmpv4;
5593         }
5594 
5595         seg_seq = ntohl(tcpha->tha_seq);
5596         switch (icmph->icmph_type) {
5597         case ICMP_DEST_UNREACHABLE:
5598                 switch (icmph->icmph_code) {
5599                 case ICMP_FRAGMENTATION_NEEDED:
5600                         /*
5601                          * Update Path MTU, then try to send something out.
5602                          */
5603                         tcp_update_pmtu(tcp, B_TRUE);
5604                         tcp_rexmit_after_error(tcp);
5605                         break;
5606                 case ICMP_PORT_UNREACHABLE:
5607                 case ICMP_PROTOCOL_UNREACHABLE:
5608                         switch (tcp->tcp_state) {
5609                         case TCPS_SYN_SENT:
5610                         case TCPS_SYN_RCVD:
5611                                 /*
5612                                  * ICMP can snipe away incipient
5613                                  * TCP connections as long as
5614                                  * seq number is same as initial
5615                                  * send seq number.
5616                                  */
5617                                 if (seg_seq == tcp->tcp_iss) {
5618                                         (void) tcp_clean_death(tcp,
5619                                             ECONNREFUSED);
5620                                 }
5621                                 break;
5622                         }
5623                         break;
5624                 case ICMP_HOST_UNREACHABLE:
5625                 case ICMP_NET_UNREACHABLE:
5626                         /* Record the error in case we finally time out. */
5627                         if (icmph->icmph_code == ICMP_HOST_UNREACHABLE)
5628                                 tcp->tcp_client_errno = EHOSTUNREACH;
5629                         else
5630                                 tcp->tcp_client_errno = ENETUNREACH;
5631                         if (tcp->tcp_state == TCPS_SYN_RCVD) {
5632                                 if (tcp->tcp_listener != NULL &&
5633                                     tcp->tcp_listener->tcp_syn_defense) {
5634                                         /*
5635                                          * Ditch the half-open connection if we
5636                                          * suspect a SYN attack is under way.
5637                                          */
5638                                         (void) tcp_clean_death(tcp,
5639                                             tcp->tcp_client_errno);
5640                                 }
5641                         }
5642                         break;
5643                 default:
5644                         break;
5645                 }
5646                 break;
5647         case ICMP_SOURCE_QUENCH: {
5648                 /*
5649                  * use a global boolean to control
5650                  * whether TCP should respond to ICMP_SOURCE_QUENCH.
5651                  * The default is false.
5652                  */
5653                 if (tcp_icmp_source_quench) {
5654                         /*
5655                          * Reduce the sending rate as if we got a
5656                          * retransmit timeout
5657                          */
5658                         uint32_t npkt;
5659 
5660                         npkt = ((tcp->tcp_snxt - tcp->tcp_suna) >> 1) /
5661                             tcp->tcp_mss;
5662                         tcp->tcp_cwnd_ssthresh = MAX(npkt, 2) * tcp->tcp_mss;
5663                         tcp->tcp_cwnd = tcp->tcp_mss;
5664                         tcp->tcp_cwnd_cnt = 0;
5665                 }
5666                 break;
5667         }
5668         }
5669         freemsg(mp);
5670 }
5671 
5672 /*
5673  * tcp_icmp_error_ipv6 is called from tcp_icmp_input to process ICMPv6
5674  * error messages passed up by IP.
5675  * Assumes that IP has pulled up all the extension headers as well
5676  * as the ICMPv6 header.
5677  */
5678 static void
5679 tcp_icmp_error_ipv6(tcp_t *tcp, mblk_t *mp, ip_recv_attr_t *ira)
5680 {
5681         icmp6_t         *icmp6;
5682         ip6_t           *ip6h;
5683         uint16_t        iph_hdr_length = ira->ira_ip_hdr_length;
5684         tcpha_t         *tcpha;
5685         uint8_t         *nexthdrp;
5686         uint32_t        seg_seq;
5687 
5688         /*
5689          * Verify that we have a complete IP header.
5690          */
5691         ASSERT((MBLKL(mp) >= sizeof (ip6_t)));
5692 
5693         icmp6 = (icmp6_t *)&mp->b_rptr[iph_hdr_length];
5694         ip6h = (ip6_t *)&icmp6[1];
5695         /*
5696          * Verify if we have a complete ICMP and inner IP header.
5697          */
5698         if ((uchar_t *)&ip6h[1] > mp->b_wptr) {
5699 noticmpv6:
5700                 freemsg(mp);
5701                 return;
5702         }
5703 
5704         if (!ip_hdr_length_nexthdr_v6(mp, ip6h, &iph_hdr_length, &nexthdrp))
5705                 goto noticmpv6;
5706         tcpha = (tcpha_t *)((char *)ip6h + iph_hdr_length);
5707         /*
5708          * Validate inner header. If the ULP is not IPPROTO_TCP or if we don't
5709          * have at least ICMP_MIN_TCP_HDR bytes of  TCP header drop the
5710          * packet.
5711          */
5712         if ((*nexthdrp != IPPROTO_TCP) ||
5713             ((uchar_t *)tcpha + ICMP_MIN_TCP_HDR) > mp->b_wptr) {
5714                 goto noticmpv6;
5715         }
5716 
5717         seg_seq = ntohl(tcpha->tha_seq);
5718         switch (icmp6->icmp6_type) {
5719         case ICMP6_PACKET_TOO_BIG:
5720                 /*
5721                  * Update Path MTU, then try to send something out.
5722                  */
5723                 tcp_update_pmtu(tcp, B_TRUE);
5724                 tcp_rexmit_after_error(tcp);
5725                 break;
5726         case ICMP6_DST_UNREACH:
5727                 switch (icmp6->icmp6_code) {
5728                 case ICMP6_DST_UNREACH_NOPORT:
5729                         if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5730                             (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5731                             (seg_seq == tcp->tcp_iss)) {
5732                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
5733                         }
5734                         break;
5735                 case ICMP6_DST_UNREACH_ADMIN:
5736                 case ICMP6_DST_UNREACH_NOROUTE:
5737                 case ICMP6_DST_UNREACH_BEYONDSCOPE:
5738                 case ICMP6_DST_UNREACH_ADDR:
5739                         /* Record the error in case we finally time out. */
5740                         tcp->tcp_client_errno = EHOSTUNREACH;
5741                         if (((tcp->tcp_state == TCPS_SYN_SENT) ||
5742                             (tcp->tcp_state == TCPS_SYN_RCVD)) &&
5743                             (seg_seq == tcp->tcp_iss)) {
5744                                 if (tcp->tcp_listener != NULL &&
5745                                     tcp->tcp_listener->tcp_syn_defense) {
5746                                         /*
5747                                          * Ditch the half-open connection if we
5748                                          * suspect a SYN attack is under way.
5749                                          */
5750                                         (void) tcp_clean_death(tcp,
5751                                             tcp->tcp_client_errno);
5752                                 }
5753                         }
5754 
5755 
5756                         break;
5757                 default:
5758                         break;
5759                 }
5760                 break;
5761         case ICMP6_PARAM_PROB:
5762                 /* If this corresponds to an ICMP_PROTOCOL_UNREACHABLE */
5763                 if (icmp6->icmp6_code == ICMP6_PARAMPROB_NEXTHEADER &&
5764                     (uchar_t *)ip6h + icmp6->icmp6_pptr ==
5765                     (uchar_t *)nexthdrp) {
5766                         if (tcp->tcp_state == TCPS_SYN_SENT ||
5767                             tcp->tcp_state == TCPS_SYN_RCVD) {
5768                                 (void) tcp_clean_death(tcp, ECONNREFUSED);
5769                         }
5770                         break;
5771                 }
5772                 break;
5773 
5774         case ICMP6_TIME_EXCEEDED:
5775         default:
5776                 break;
5777         }
5778         freemsg(mp);
5779 }
5780 
5781 /*
5782  * CALLED OUTSIDE OF SQUEUE! It can not follow any pointers that tcp might
5783  * change. But it can refer to fields like tcp_suna and tcp_snxt.
5784  *
5785  * Function tcp_verifyicmp is called as conn_verifyicmp to verify the ICMP
5786  * error messages received by IP. The message is always received on the correct
5787  * tcp_t.
5788  */
5789 /* ARGSUSED */
5790 boolean_t
5791 tcp_verifyicmp(conn_t *connp, void *arg2, icmph_t *icmph, icmp6_t *icmp6,
5792     ip_recv_attr_t *ira)
5793 {
5794         tcpha_t         *tcpha = (tcpha_t *)arg2;
5795         uint32_t        seq = ntohl(tcpha->tha_seq);
5796         tcp_t           *tcp = connp->conn_tcp;
5797 
5798         /*
5799          * TCP sequence number contained in payload of the ICMP error message
5800          * should be within the range SND.UNA <= SEG.SEQ < SND.NXT. Otherwise,
5801          * the message is either a stale ICMP error, or an attack from the
5802          * network. Fail the verification.
5803          */
5804         if (SEQ_LT(seq, tcp->tcp_suna) || SEQ_GEQ(seq, tcp->tcp_snxt))
5805                 return (B_FALSE);
5806 
5807         /* For "too big" we also check the ignore flag */
5808         if (ira->ira_flags & IRAF_IS_IPV4) {
5809                 ASSERT(icmph != NULL);
5810                 if (icmph->icmph_type == ICMP_DEST_UNREACHABLE &&
5811                     icmph->icmph_code == ICMP_FRAGMENTATION_NEEDED &&
5812                     tcp->tcp_tcps->tcps_ignore_path_mtu)
5813                         return (B_FALSE);
5814         } else {
5815                 ASSERT(icmp6 != NULL);
5816                 if (icmp6->icmp6_type == ICMP6_PACKET_TOO_BIG &&
5817                     tcp->tcp_tcps->tcps_ignore_path_mtu)
5818                         return (B_FALSE);
5819         }
5820         return (B_TRUE);
5821 }