1/*-
2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * @(#)tcp_subr.c 8.2 (Berkeley) 5/24/95
30 */
31
32#include <sys/cdefs.h>
| 1/*-
2 * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3 * The Regents of the University of California. All rights reserved.
4 *
5 * Redistribution and use in source and binary forms, with or without
6 * modification, are permitted provided that the following conditions
7 * are met:
8 * 1. Redistributions of source code must retain the above copyright
9 * notice, this list of conditions and the following disclaimer.
10 * 2. Redistributions in binary form must reproduce the above copyright
11 * notice, this list of conditions and the following disclaimer in the
12 * documentation and/or other materials provided with the distribution.
13 * 4. Neither the name of the University nor the names of its contributors
14 * may be used to endorse or promote products derived from this software
15 * without specific prior written permission.
16 *
17 * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18 * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19 * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20 * ARE DISCLAIMED. IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21 * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22 * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23 * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24 * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25 * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26 * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27 * SUCH DAMAGE.
28 *
29 * @(#)tcp_subr.c 8.2 (Berkeley) 5/24/95
30 */
31
32#include <sys/cdefs.h>
|
91
92#include <machine/in_cksum.h>
93
94#include <security/mac/mac_framework.h>
95
96static uma_zone_t tcptw_zone;
97static int maxtcptw;
98
99/*
100 * The timed wait queue contains references to each of the TCP sessions
101 * currently in the TIME_WAIT state. The queue pointers, including the
102 * queue pointers in each tcptw structure, are protected using the global
103 * tcbinfo lock, which must be held over queue iteration and modification.
104 */
105#ifdef VIMAGE_GLOBALS
106static TAILQ_HEAD(, tcptw) twq_2msl;
107int nolocaltimewait;
108#endif
109
110static void tcp_tw_2msl_reset(struct tcptw *, int);
111static void tcp_tw_2msl_stop(struct tcptw *);
112
113static int
114tcptw_auto_size(void)
115{
116 INIT_VNET_INET(curvnet);
117 int halfrange;
118
119 /*
120 * Max out at half the ephemeral port range so that TIME_WAIT
121 * sockets don't tie up too many ephemeral ports.
122 */
123 if (V_ipport_lastauto > V_ipport_firstauto)
124 halfrange = (V_ipport_lastauto - V_ipport_firstauto) / 2;
125 else
126 halfrange = (V_ipport_firstauto - V_ipport_lastauto) / 2;
127 /* Protect against goofy port ranges smaller than 32. */
128 return (imin(imax(halfrange, 32), maxsockets / 5));
129}
130
131static int
132sysctl_maxtcptw(SYSCTL_HANDLER_ARGS)
133{
134 int error, new;
135
136 if (maxtcptw == 0)
137 new = tcptw_auto_size();
138 else
139 new = maxtcptw;
140 error = sysctl_handle_int(oidp, &new, 0, req);
141 if (error == 0 && req->newptr)
142 if (new >= 32) {
143 maxtcptw = new;
144 uma_zone_set_max(tcptw_zone, maxtcptw);
145 }
146 return (error);
147}
148
149SYSCTL_PROC(_net_inet_tcp, OID_AUTO, maxtcptw, CTLTYPE_INT|CTLFLAG_RW,
150 &maxtcptw, 0, sysctl_maxtcptw, "IU",
151 "Maximum number of compressed TCP TIME_WAIT entries");
152
153SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, nolocaltimewait,
154 CTLFLAG_RW, nolocaltimewait, 0,
155 "Do not create compressed TCP TIME_WAIT entries for local connections");
156
157void
158tcp_tw_zone_change(void)
159{
160
161 if (maxtcptw == 0)
162 uma_zone_set_max(tcptw_zone, tcptw_auto_size());
163}
164
165void
166tcp_tw_init(void)
167{
168 INIT_VNET_INET(curvnet);
169
170 tcptw_zone = uma_zcreate("tcptw", sizeof(struct tcptw),
171 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
172 TUNABLE_INT_FETCH("net.inet.tcp.maxtcptw", &maxtcptw);
173 if (maxtcptw == 0)
174 uma_zone_set_max(tcptw_zone, tcptw_auto_size());
175 else
176 uma_zone_set_max(tcptw_zone, maxtcptw);
177 TAILQ_INIT(&V_twq_2msl);
178}
179
180/*
181 * Move a TCP connection into TIME_WAIT state.
182 * tcbinfo is locked.
183 * inp is locked, and is unlocked before returning.
184 */
185void
186tcp_twstart(struct tcpcb *tp)
187{
188#if defined(INVARIANTS) || defined(INVARIANT_SUPPORT)
189 INIT_VNET_INET(tp->t_vnet);
190#endif
191 struct tcptw *tw;
192 struct inpcb *inp = tp->t_inpcb;
193 int acknow;
194 struct socket *so;
195
196 INP_INFO_WLOCK_ASSERT(&V_tcbinfo); /* tcp_tw_2msl_reset(). */
197 INP_WLOCK_ASSERT(inp);
198
199 if (V_nolocaltimewait && in_localip(inp->inp_faddr)) {
200 tp = tcp_close(tp);
201 if (tp != NULL)
202 INP_WUNLOCK(inp);
203 return;
204 }
205
206 tw = uma_zalloc(tcptw_zone, M_NOWAIT);
207 if (tw == NULL) {
208 tw = tcp_tw_2msl_scan(1);
209 if (tw == NULL) {
210 tp = tcp_close(tp);
211 if (tp != NULL)
212 INP_WUNLOCK(inp);
213 return;
214 }
215 }
216 tw->tw_inpcb = inp;
217
218 /*
219 * Recover last window size sent.
220 */
221 tw->last_win = (tp->rcv_adv - tp->rcv_nxt) >> tp->rcv_scale;
222
223 /*
224 * Set t_recent if timestamps are used on the connection.
225 */
226 if ((tp->t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP|TF_NOOPT)) ==
227 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) {
228 tw->t_recent = tp->ts_recent;
229 tw->ts_offset = tp->ts_offset;
230 } else {
231 tw->t_recent = 0;
232 tw->ts_offset = 0;
233 }
234
235 tw->snd_nxt = tp->snd_nxt;
236 tw->rcv_nxt = tp->rcv_nxt;
237 tw->iss = tp->iss;
238 tw->irs = tp->irs;
239 tw->t_starttime = tp->t_starttime;
240 tw->tw_time = 0;
241
242/* XXX
243 * If this code will
244 * be used for fin-wait-2 state also, then we may need
245 * a ts_recent from the last segment.
246 */
247 acknow = tp->t_flags & TF_ACKNOW;
248
249 /*
250 * First, discard tcpcb state, which includes stopping its timers and
251 * freeing it. tcp_discardcb() used to also release the inpcb, but
252 * that work is now done in the caller.
253 *
254 * Note: soisdisconnected() call used to be made in tcp_discardcb(),
255 * and might not be needed here any longer.
256 */
257 tcp_discardcb(tp);
258 so = inp->inp_socket;
259 soisdisconnected(so);
260 tw->tw_cred = crhold(so->so_cred);
261 SOCK_LOCK(so);
262 tw->tw_so_options = so->so_options;
263 SOCK_UNLOCK(so);
264 if (acknow)
265 tcp_twrespond(tw, TH_ACK);
266 inp->inp_ppcb = tw;
267 inp->inp_vflag |= INP_TIMEWAIT;
268 tcp_tw_2msl_reset(tw, 0);
269
270 /*
271 * If the inpcb owns the sole reference to the socket, then we can
272 * detach and free the socket as it is not needed in time wait.
273 */
274 if (inp->inp_vflag & INP_SOCKREF) {
275 KASSERT(so->so_state & SS_PROTOREF,
276 ("tcp_twstart: !SS_PROTOREF"));
277 inp->inp_vflag &= ~INP_SOCKREF;
278 INP_WUNLOCK(inp);
279 ACCEPT_LOCK();
280 SOCK_LOCK(so);
281 so->so_state &= ~SS_PROTOREF;
282 sofree(so);
283 } else
284 INP_WUNLOCK(inp);
285}
286
287#if 0
288/*
289 * The appromixate rate of ISN increase of Microsoft TCP stacks;
290 * the actual rate is slightly higher due to the addition of
291 * random positive increments.
292 *
293 * Most other new OSes use semi-randomized ISN values, so we
294 * do not need to worry about them.
295 */
296#define MS_ISN_BYTES_PER_SECOND 250000
297
298/*
299 * Determine if the ISN we will generate has advanced beyond the last
300 * sequence number used by the previous connection. If so, indicate
301 * that it is safe to recycle this tw socket by returning 1.
302 */
303int
304tcp_twrecycleable(struct tcptw *tw)
305{
306 INIT_VNET_INET(curvnet);
307 tcp_seq new_iss = tw->iss;
308 tcp_seq new_irs = tw->irs;
309
310 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
311 new_iss += (ticks - tw->t_starttime) * (ISN_BYTES_PER_SECOND / hz);
312 new_irs += (ticks - tw->t_starttime) * (MS_ISN_BYTES_PER_SECOND / hz);
313
314 if (SEQ_GT(new_iss, tw->snd_nxt) && SEQ_GT(new_irs, tw->rcv_nxt))
315 return (1);
316 else
317 return (0);
318}
319#endif
320
321/*
322 * Returns 1 if the TIME_WAIT state was killed and we should start over,
323 * looking for a pcb in the listen state. Returns 0 otherwise.
324 */
325int
326tcp_twcheck(struct inpcb *inp, struct tcpopt *to, struct tcphdr *th,
327 struct mbuf *m, int tlen)
328{
329#if defined(INVARIANTS) || defined(INVARIANT_SUPPORT)
330 INIT_VNET_INET(curvnet);
331#endif
332 struct tcptw *tw;
333 int thflags;
334 tcp_seq seq;
335#ifdef INET6
336 int isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
337#else
338 const int isipv6 = 0;
339#endif
340
341 /* tcbinfo lock required for tcp_twclose(), tcp_tw_2msl_reset(). */
342 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
343 INP_WLOCK_ASSERT(inp);
344
345 /*
346 * XXXRW: Time wait state for inpcb has been recycled, but inpcb is
347 * still present. This is undesirable, but temporarily necessary
348 * until we work out how to handle inpcb's who's timewait state has
349 * been removed.
350 */
351 tw = intotw(inp);
352 if (tw == NULL)
353 goto drop;
354
355 thflags = th->th_flags;
356
357 /*
358 * NOTE: for FIN_WAIT_2 (to be added later),
359 * must validate sequence number before accepting RST
360 */
361
362 /*
363 * If the segment contains RST:
364 * Drop the segment - see Stevens, vol. 2, p. 964 and
365 * RFC 1337.
366 */
367 if (thflags & TH_RST)
368 goto drop;
369
370#if 0
371/* PAWS not needed at the moment */
372 /*
373 * RFC 1323 PAWS: If we have a timestamp reply on this segment
374 * and it's less than ts_recent, drop it.
375 */
376 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
377 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
378 if ((thflags & TH_ACK) == 0)
379 goto drop;
380 goto ack;
381 }
382 /*
383 * ts_recent is never updated because we never accept new segments.
384 */
385#endif
386
387 /*
388 * If a new connection request is received
389 * while in TIME_WAIT, drop the old connection
390 * and start over if the sequence numbers
391 * are above the previous ones.
392 */
393 if ((thflags & TH_SYN) && SEQ_GT(th->th_seq, tw->rcv_nxt)) {
394 tcp_twclose(tw, 0);
395 return (1);
396 }
397
398 /*
399 * Drop the the segment if it does not contain an ACK.
400 */
401 if ((thflags & TH_ACK) == 0)
402 goto drop;
403
404 /*
405 * Reset the 2MSL timer if this is a duplicate FIN.
406 */
407 if (thflags & TH_FIN) {
408 seq = th->th_seq + tlen + (thflags & TH_SYN ? 1 : 0);
409 if (seq + 1 == tw->rcv_nxt)
410 tcp_tw_2msl_reset(tw, 1);
411 }
412
413 /*
414 * Acknowledge the segment if it has data or is not a duplicate ACK.
415 */
416 if (thflags != TH_ACK || tlen != 0 ||
417 th->th_seq != tw->rcv_nxt || th->th_ack != tw->snd_nxt)
418 tcp_twrespond(tw, TH_ACK);
419 goto drop;
420
421 /*
422 * Generate a RST, dropping incoming segment.
423 * Make ACK acceptable to originator of segment.
424 * Don't bother to respond if destination was broadcast/multicast.
425 */
426 if (m->m_flags & (M_BCAST|M_MCAST))
427 goto drop;
428 if (isipv6) {
429#ifdef INET6
430 struct ip6_hdr *ip6;
431
432 /* IPv6 anycast check is done at tcp6_input() */
433 ip6 = mtod(m, struct ip6_hdr *);
434 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
435 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
436 goto drop;
437#endif
438 } else {
439 struct ip *ip;
440
441 ip = mtod(m, struct ip *);
442 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
443 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
444 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
445 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
446 goto drop;
447 }
448 if (thflags & TH_ACK) {
449 tcp_respond(NULL,
450 mtod(m, void *), th, m, 0, th->th_ack, TH_RST);
451 } else {
452 seq = th->th_seq + (thflags & TH_SYN ? 1 : 0);
453 tcp_respond(NULL,
454 mtod(m, void *), th, m, seq, 0, TH_RST|TH_ACK);
455 }
456 INP_WUNLOCK(inp);
457 return (0);
458
459drop:
460 INP_WUNLOCK(inp);
461 m_freem(m);
462 return (0);
463}
464
465void
466tcp_twclose(struct tcptw *tw, int reuse)
467{
468 INIT_VNET_INET(curvnet);
469 struct socket *so;
470 struct inpcb *inp;
471
472 /*
473 * At this point, we are in one of two situations:
474 *
475 * (1) We have no socket, just an inpcb<->twtcp pair. We can free
476 * all state.
477 *
478 * (2) We have a socket -- if we own a reference, release it and
479 * notify the socket layer.
480 */
481 inp = tw->tw_inpcb;
482 KASSERT((inp->inp_vflag & INP_TIMEWAIT), ("tcp_twclose: !timewait"));
483 KASSERT(intotw(inp) == tw, ("tcp_twclose: inp_ppcb != tw"));
484 INP_INFO_WLOCK_ASSERT(&V_tcbinfo); /* tcp_tw_2msl_stop(). */
485 INP_WLOCK_ASSERT(inp);
486
487 tw->tw_inpcb = NULL;
488 tcp_tw_2msl_stop(tw);
489 inp->inp_ppcb = NULL;
490 in_pcbdrop(inp);
491
492 so = inp->inp_socket;
493 if (so != NULL) {
494 /*
495 * If there's a socket, handle two cases: first, we own a
496 * strong reference, which we will now release, or we don't
497 * in which case another reference exists (XXXRW: think
498 * about this more), and we don't need to take action.
499 */
500 if (inp->inp_vflag & INP_SOCKREF) {
501 inp->inp_vflag &= ~INP_SOCKREF;
502 INP_WUNLOCK(inp);
503 ACCEPT_LOCK();
504 SOCK_LOCK(so);
505 KASSERT(so->so_state & SS_PROTOREF,
506 ("tcp_twclose: INP_SOCKREF && !SS_PROTOREF"));
507 so->so_state &= ~SS_PROTOREF;
508 sofree(so);
509 } else {
510 /*
511 * If we don't own the only reference, the socket and
512 * inpcb need to be left around to be handled by
513 * tcp_usr_detach() later.
514 */
515 INP_WUNLOCK(inp);
516 }
517 } else
518 in_pcbfree(inp);
519 V_tcpstat.tcps_closed++;
520 crfree(tw->tw_cred);
521 tw->tw_cred = NULL;
522 if (reuse)
523 return;
524 uma_zfree(tcptw_zone, tw);
525}
526
527int
528tcp_twrespond(struct tcptw *tw, int flags)
529{
530 INIT_VNET_INET(curvnet);
531 struct inpcb *inp = tw->tw_inpcb;
532 struct tcphdr *th;
533 struct mbuf *m;
534 struct ip *ip = NULL;
535 u_int hdrlen, optlen;
536 int error;
537 struct tcpopt to;
538#ifdef INET6
539 struct ip6_hdr *ip6 = NULL;
540 int isipv6 = inp->inp_inc.inc_isipv6;
541#endif
542
543 INP_WLOCK_ASSERT(inp);
544
545 m = m_gethdr(M_DONTWAIT, MT_DATA);
546 if (m == NULL)
547 return (ENOBUFS);
548 m->m_data += max_linkhdr;
549
550#ifdef MAC
551 mac_inpcb_create_mbuf(inp, m);
552#endif
553
554#ifdef INET6
555 if (isipv6) {
556 hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
557 ip6 = mtod(m, struct ip6_hdr *);
558 th = (struct tcphdr *)(ip6 + 1);
559 tcpip_fillheaders(inp, ip6, th);
560 } else
561#endif
562 {
563 hdrlen = sizeof(struct tcpiphdr);
564 ip = mtod(m, struct ip *);
565 th = (struct tcphdr *)(ip + 1);
566 tcpip_fillheaders(inp, ip, th);
567 }
568 to.to_flags = 0;
569
570 /*
571 * Send a timestamp and echo-reply if both our side and our peer
572 * have sent timestamps in our SYN's and this is not a RST.
573 */
574 if (tw->t_recent && flags == TH_ACK) {
575 to.to_flags |= TOF_TS;
576 to.to_tsval = ticks + tw->ts_offset;
577 to.to_tsecr = tw->t_recent;
578 }
579 optlen = tcp_addoptions(&to, (u_char *)(th + 1));
580
581 m->m_len = hdrlen + optlen;
582 m->m_pkthdr.len = m->m_len;
583
584 KASSERT(max_linkhdr + m->m_len <= MHLEN, ("tcptw: mbuf too small"));
585
586 th->th_seq = htonl(tw->snd_nxt);
587 th->th_ack = htonl(tw->rcv_nxt);
588 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
589 th->th_flags = flags;
590 th->th_win = htons(tw->last_win);
591
592#ifdef INET6
593 if (isipv6) {
594 th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
595 sizeof(struct tcphdr) + optlen);
596 ip6->ip6_hlim = in6_selecthlim(inp, NULL);
597 error = ip6_output(m, inp->in6p_outputopts, NULL,
598 (tw->tw_so_options & SO_DONTROUTE), NULL, NULL, inp);
599 } else
600#endif
601 {
602 th->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
603 htons(sizeof(struct tcphdr) + optlen + IPPROTO_TCP));
604 m->m_pkthdr.csum_flags = CSUM_TCP;
605 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
606 ip->ip_len = m->m_pkthdr.len;
607 if (V_path_mtu_discovery)
608 ip->ip_off |= IP_DF;
609 error = ip_output(m, inp->inp_options, NULL,
610 ((tw->tw_so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0),
611 NULL, inp);
612 }
613 if (flags & TH_ACK)
614 V_tcpstat.tcps_sndacks++;
615 else
616 V_tcpstat.tcps_sndctrl++;
617 V_tcpstat.tcps_sndtotal++;
618 return (error);
619}
620
621static void
622tcp_tw_2msl_reset(struct tcptw *tw, int rearm)
623{
624 INIT_VNET_INET(curvnet);
625
626 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
627 INP_WLOCK_ASSERT(tw->tw_inpcb);
628 if (rearm)
629 TAILQ_REMOVE(&V_twq_2msl, tw, tw_2msl);
630 tw->tw_time = ticks + 2 * tcp_msl;
631 TAILQ_INSERT_TAIL(&V_twq_2msl, tw, tw_2msl);
632}
633
634static void
635tcp_tw_2msl_stop(struct tcptw *tw)
636{
637 INIT_VNET_INET(curvnet);
638
639 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
640 TAILQ_REMOVE(&V_twq_2msl, tw, tw_2msl);
641}
642
643struct tcptw *
644tcp_tw_2msl_scan(int reuse)
645{
646 INIT_VNET_INET(curvnet);
647 struct tcptw *tw;
648
649 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
650 for (;;) {
651 tw = TAILQ_FIRST(&V_twq_2msl);
652 if (tw == NULL || (!reuse && tw->tw_time > ticks))
653 break;
654 INP_WLOCK(tw->tw_inpcb);
655 tcp_twclose(tw, reuse);
656 if (reuse)
657 return (tw);
658 }
659 return (NULL);
660}
| 92
93#include <machine/in_cksum.h>
94
95#include <security/mac/mac_framework.h>
96
97static uma_zone_t tcptw_zone;
98static int maxtcptw;
99
100/*
101 * The timed wait queue contains references to each of the TCP sessions
102 * currently in the TIME_WAIT state. The queue pointers, including the
103 * queue pointers in each tcptw structure, are protected using the global
104 * tcbinfo lock, which must be held over queue iteration and modification.
105 */
106#ifdef VIMAGE_GLOBALS
107static TAILQ_HEAD(, tcptw) twq_2msl;
108int nolocaltimewait;
109#endif
110
111static void tcp_tw_2msl_reset(struct tcptw *, int);
112static void tcp_tw_2msl_stop(struct tcptw *);
113
114static int
115tcptw_auto_size(void)
116{
117 INIT_VNET_INET(curvnet);
118 int halfrange;
119
120 /*
121 * Max out at half the ephemeral port range so that TIME_WAIT
122 * sockets don't tie up too many ephemeral ports.
123 */
124 if (V_ipport_lastauto > V_ipport_firstauto)
125 halfrange = (V_ipport_lastauto - V_ipport_firstauto) / 2;
126 else
127 halfrange = (V_ipport_firstauto - V_ipport_lastauto) / 2;
128 /* Protect against goofy port ranges smaller than 32. */
129 return (imin(imax(halfrange, 32), maxsockets / 5));
130}
131
132static int
133sysctl_maxtcptw(SYSCTL_HANDLER_ARGS)
134{
135 int error, new;
136
137 if (maxtcptw == 0)
138 new = tcptw_auto_size();
139 else
140 new = maxtcptw;
141 error = sysctl_handle_int(oidp, &new, 0, req);
142 if (error == 0 && req->newptr)
143 if (new >= 32) {
144 maxtcptw = new;
145 uma_zone_set_max(tcptw_zone, maxtcptw);
146 }
147 return (error);
148}
149
150SYSCTL_PROC(_net_inet_tcp, OID_AUTO, maxtcptw, CTLTYPE_INT|CTLFLAG_RW,
151 &maxtcptw, 0, sysctl_maxtcptw, "IU",
152 "Maximum number of compressed TCP TIME_WAIT entries");
153
154SYSCTL_V_INT(V_NET, vnet_inet, _net_inet_tcp, OID_AUTO, nolocaltimewait,
155 CTLFLAG_RW, nolocaltimewait, 0,
156 "Do not create compressed TCP TIME_WAIT entries for local connections");
157
158void
159tcp_tw_zone_change(void)
160{
161
162 if (maxtcptw == 0)
163 uma_zone_set_max(tcptw_zone, tcptw_auto_size());
164}
165
166void
167tcp_tw_init(void)
168{
169 INIT_VNET_INET(curvnet);
170
171 tcptw_zone = uma_zcreate("tcptw", sizeof(struct tcptw),
172 NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
173 TUNABLE_INT_FETCH("net.inet.tcp.maxtcptw", &maxtcptw);
174 if (maxtcptw == 0)
175 uma_zone_set_max(tcptw_zone, tcptw_auto_size());
176 else
177 uma_zone_set_max(tcptw_zone, maxtcptw);
178 TAILQ_INIT(&V_twq_2msl);
179}
180
181/*
182 * Move a TCP connection into TIME_WAIT state.
183 * tcbinfo is locked.
184 * inp is locked, and is unlocked before returning.
185 */
186void
187tcp_twstart(struct tcpcb *tp)
188{
189#if defined(INVARIANTS) || defined(INVARIANT_SUPPORT)
190 INIT_VNET_INET(tp->t_vnet);
191#endif
192 struct tcptw *tw;
193 struct inpcb *inp = tp->t_inpcb;
194 int acknow;
195 struct socket *so;
196
197 INP_INFO_WLOCK_ASSERT(&V_tcbinfo); /* tcp_tw_2msl_reset(). */
198 INP_WLOCK_ASSERT(inp);
199
200 if (V_nolocaltimewait && in_localip(inp->inp_faddr)) {
201 tp = tcp_close(tp);
202 if (tp != NULL)
203 INP_WUNLOCK(inp);
204 return;
205 }
206
207 tw = uma_zalloc(tcptw_zone, M_NOWAIT);
208 if (tw == NULL) {
209 tw = tcp_tw_2msl_scan(1);
210 if (tw == NULL) {
211 tp = tcp_close(tp);
212 if (tp != NULL)
213 INP_WUNLOCK(inp);
214 return;
215 }
216 }
217 tw->tw_inpcb = inp;
218
219 /*
220 * Recover last window size sent.
221 */
222 tw->last_win = (tp->rcv_adv - tp->rcv_nxt) >> tp->rcv_scale;
223
224 /*
225 * Set t_recent if timestamps are used on the connection.
226 */
227 if ((tp->t_flags & (TF_REQ_TSTMP|TF_RCVD_TSTMP|TF_NOOPT)) ==
228 (TF_REQ_TSTMP|TF_RCVD_TSTMP)) {
229 tw->t_recent = tp->ts_recent;
230 tw->ts_offset = tp->ts_offset;
231 } else {
232 tw->t_recent = 0;
233 tw->ts_offset = 0;
234 }
235
236 tw->snd_nxt = tp->snd_nxt;
237 tw->rcv_nxt = tp->rcv_nxt;
238 tw->iss = tp->iss;
239 tw->irs = tp->irs;
240 tw->t_starttime = tp->t_starttime;
241 tw->tw_time = 0;
242
243/* XXX
244 * If this code will
245 * be used for fin-wait-2 state also, then we may need
246 * a ts_recent from the last segment.
247 */
248 acknow = tp->t_flags & TF_ACKNOW;
249
250 /*
251 * First, discard tcpcb state, which includes stopping its timers and
252 * freeing it. tcp_discardcb() used to also release the inpcb, but
253 * that work is now done in the caller.
254 *
255 * Note: soisdisconnected() call used to be made in tcp_discardcb(),
256 * and might not be needed here any longer.
257 */
258 tcp_discardcb(tp);
259 so = inp->inp_socket;
260 soisdisconnected(so);
261 tw->tw_cred = crhold(so->so_cred);
262 SOCK_LOCK(so);
263 tw->tw_so_options = so->so_options;
264 SOCK_UNLOCK(so);
265 if (acknow)
266 tcp_twrespond(tw, TH_ACK);
267 inp->inp_ppcb = tw;
268 inp->inp_vflag |= INP_TIMEWAIT;
269 tcp_tw_2msl_reset(tw, 0);
270
271 /*
272 * If the inpcb owns the sole reference to the socket, then we can
273 * detach and free the socket as it is not needed in time wait.
274 */
275 if (inp->inp_vflag & INP_SOCKREF) {
276 KASSERT(so->so_state & SS_PROTOREF,
277 ("tcp_twstart: !SS_PROTOREF"));
278 inp->inp_vflag &= ~INP_SOCKREF;
279 INP_WUNLOCK(inp);
280 ACCEPT_LOCK();
281 SOCK_LOCK(so);
282 so->so_state &= ~SS_PROTOREF;
283 sofree(so);
284 } else
285 INP_WUNLOCK(inp);
286}
287
288#if 0
289/*
290 * The appromixate rate of ISN increase of Microsoft TCP stacks;
291 * the actual rate is slightly higher due to the addition of
292 * random positive increments.
293 *
294 * Most other new OSes use semi-randomized ISN values, so we
295 * do not need to worry about them.
296 */
297#define MS_ISN_BYTES_PER_SECOND 250000
298
299/*
300 * Determine if the ISN we will generate has advanced beyond the last
301 * sequence number used by the previous connection. If so, indicate
302 * that it is safe to recycle this tw socket by returning 1.
303 */
304int
305tcp_twrecycleable(struct tcptw *tw)
306{
307 INIT_VNET_INET(curvnet);
308 tcp_seq new_iss = tw->iss;
309 tcp_seq new_irs = tw->irs;
310
311 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
312 new_iss += (ticks - tw->t_starttime) * (ISN_BYTES_PER_SECOND / hz);
313 new_irs += (ticks - tw->t_starttime) * (MS_ISN_BYTES_PER_SECOND / hz);
314
315 if (SEQ_GT(new_iss, tw->snd_nxt) && SEQ_GT(new_irs, tw->rcv_nxt))
316 return (1);
317 else
318 return (0);
319}
320#endif
321
322/*
323 * Returns 1 if the TIME_WAIT state was killed and we should start over,
324 * looking for a pcb in the listen state. Returns 0 otherwise.
325 */
326int
327tcp_twcheck(struct inpcb *inp, struct tcpopt *to, struct tcphdr *th,
328 struct mbuf *m, int tlen)
329{
330#if defined(INVARIANTS) || defined(INVARIANT_SUPPORT)
331 INIT_VNET_INET(curvnet);
332#endif
333 struct tcptw *tw;
334 int thflags;
335 tcp_seq seq;
336#ifdef INET6
337 int isipv6 = (mtod(m, struct ip *)->ip_v == 6) ? 1 : 0;
338#else
339 const int isipv6 = 0;
340#endif
341
342 /* tcbinfo lock required for tcp_twclose(), tcp_tw_2msl_reset(). */
343 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
344 INP_WLOCK_ASSERT(inp);
345
346 /*
347 * XXXRW: Time wait state for inpcb has been recycled, but inpcb is
348 * still present. This is undesirable, but temporarily necessary
349 * until we work out how to handle inpcb's who's timewait state has
350 * been removed.
351 */
352 tw = intotw(inp);
353 if (tw == NULL)
354 goto drop;
355
356 thflags = th->th_flags;
357
358 /*
359 * NOTE: for FIN_WAIT_2 (to be added later),
360 * must validate sequence number before accepting RST
361 */
362
363 /*
364 * If the segment contains RST:
365 * Drop the segment - see Stevens, vol. 2, p. 964 and
366 * RFC 1337.
367 */
368 if (thflags & TH_RST)
369 goto drop;
370
371#if 0
372/* PAWS not needed at the moment */
373 /*
374 * RFC 1323 PAWS: If we have a timestamp reply on this segment
375 * and it's less than ts_recent, drop it.
376 */
377 if ((to.to_flags & TOF_TS) != 0 && tp->ts_recent &&
378 TSTMP_LT(to.to_tsval, tp->ts_recent)) {
379 if ((thflags & TH_ACK) == 0)
380 goto drop;
381 goto ack;
382 }
383 /*
384 * ts_recent is never updated because we never accept new segments.
385 */
386#endif
387
388 /*
389 * If a new connection request is received
390 * while in TIME_WAIT, drop the old connection
391 * and start over if the sequence numbers
392 * are above the previous ones.
393 */
394 if ((thflags & TH_SYN) && SEQ_GT(th->th_seq, tw->rcv_nxt)) {
395 tcp_twclose(tw, 0);
396 return (1);
397 }
398
399 /*
400 * Drop the the segment if it does not contain an ACK.
401 */
402 if ((thflags & TH_ACK) == 0)
403 goto drop;
404
405 /*
406 * Reset the 2MSL timer if this is a duplicate FIN.
407 */
408 if (thflags & TH_FIN) {
409 seq = th->th_seq + tlen + (thflags & TH_SYN ? 1 : 0);
410 if (seq + 1 == tw->rcv_nxt)
411 tcp_tw_2msl_reset(tw, 1);
412 }
413
414 /*
415 * Acknowledge the segment if it has data or is not a duplicate ACK.
416 */
417 if (thflags != TH_ACK || tlen != 0 ||
418 th->th_seq != tw->rcv_nxt || th->th_ack != tw->snd_nxt)
419 tcp_twrespond(tw, TH_ACK);
420 goto drop;
421
422 /*
423 * Generate a RST, dropping incoming segment.
424 * Make ACK acceptable to originator of segment.
425 * Don't bother to respond if destination was broadcast/multicast.
426 */
427 if (m->m_flags & (M_BCAST|M_MCAST))
428 goto drop;
429 if (isipv6) {
430#ifdef INET6
431 struct ip6_hdr *ip6;
432
433 /* IPv6 anycast check is done at tcp6_input() */
434 ip6 = mtod(m, struct ip6_hdr *);
435 if (IN6_IS_ADDR_MULTICAST(&ip6->ip6_dst) ||
436 IN6_IS_ADDR_MULTICAST(&ip6->ip6_src))
437 goto drop;
438#endif
439 } else {
440 struct ip *ip;
441
442 ip = mtod(m, struct ip *);
443 if (IN_MULTICAST(ntohl(ip->ip_dst.s_addr)) ||
444 IN_MULTICAST(ntohl(ip->ip_src.s_addr)) ||
445 ip->ip_src.s_addr == htonl(INADDR_BROADCAST) ||
446 in_broadcast(ip->ip_dst, m->m_pkthdr.rcvif))
447 goto drop;
448 }
449 if (thflags & TH_ACK) {
450 tcp_respond(NULL,
451 mtod(m, void *), th, m, 0, th->th_ack, TH_RST);
452 } else {
453 seq = th->th_seq + (thflags & TH_SYN ? 1 : 0);
454 tcp_respond(NULL,
455 mtod(m, void *), th, m, seq, 0, TH_RST|TH_ACK);
456 }
457 INP_WUNLOCK(inp);
458 return (0);
459
460drop:
461 INP_WUNLOCK(inp);
462 m_freem(m);
463 return (0);
464}
465
466void
467tcp_twclose(struct tcptw *tw, int reuse)
468{
469 INIT_VNET_INET(curvnet);
470 struct socket *so;
471 struct inpcb *inp;
472
473 /*
474 * At this point, we are in one of two situations:
475 *
476 * (1) We have no socket, just an inpcb<->twtcp pair. We can free
477 * all state.
478 *
479 * (2) We have a socket -- if we own a reference, release it and
480 * notify the socket layer.
481 */
482 inp = tw->tw_inpcb;
483 KASSERT((inp->inp_vflag & INP_TIMEWAIT), ("tcp_twclose: !timewait"));
484 KASSERT(intotw(inp) == tw, ("tcp_twclose: inp_ppcb != tw"));
485 INP_INFO_WLOCK_ASSERT(&V_tcbinfo); /* tcp_tw_2msl_stop(). */
486 INP_WLOCK_ASSERT(inp);
487
488 tw->tw_inpcb = NULL;
489 tcp_tw_2msl_stop(tw);
490 inp->inp_ppcb = NULL;
491 in_pcbdrop(inp);
492
493 so = inp->inp_socket;
494 if (so != NULL) {
495 /*
496 * If there's a socket, handle two cases: first, we own a
497 * strong reference, which we will now release, or we don't
498 * in which case another reference exists (XXXRW: think
499 * about this more), and we don't need to take action.
500 */
501 if (inp->inp_vflag & INP_SOCKREF) {
502 inp->inp_vflag &= ~INP_SOCKREF;
503 INP_WUNLOCK(inp);
504 ACCEPT_LOCK();
505 SOCK_LOCK(so);
506 KASSERT(so->so_state & SS_PROTOREF,
507 ("tcp_twclose: INP_SOCKREF && !SS_PROTOREF"));
508 so->so_state &= ~SS_PROTOREF;
509 sofree(so);
510 } else {
511 /*
512 * If we don't own the only reference, the socket and
513 * inpcb need to be left around to be handled by
514 * tcp_usr_detach() later.
515 */
516 INP_WUNLOCK(inp);
517 }
518 } else
519 in_pcbfree(inp);
520 V_tcpstat.tcps_closed++;
521 crfree(tw->tw_cred);
522 tw->tw_cred = NULL;
523 if (reuse)
524 return;
525 uma_zfree(tcptw_zone, tw);
526}
527
528int
529tcp_twrespond(struct tcptw *tw, int flags)
530{
531 INIT_VNET_INET(curvnet);
532 struct inpcb *inp = tw->tw_inpcb;
533 struct tcphdr *th;
534 struct mbuf *m;
535 struct ip *ip = NULL;
536 u_int hdrlen, optlen;
537 int error;
538 struct tcpopt to;
539#ifdef INET6
540 struct ip6_hdr *ip6 = NULL;
541 int isipv6 = inp->inp_inc.inc_isipv6;
542#endif
543
544 INP_WLOCK_ASSERT(inp);
545
546 m = m_gethdr(M_DONTWAIT, MT_DATA);
547 if (m == NULL)
548 return (ENOBUFS);
549 m->m_data += max_linkhdr;
550
551#ifdef MAC
552 mac_inpcb_create_mbuf(inp, m);
553#endif
554
555#ifdef INET6
556 if (isipv6) {
557 hdrlen = sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
558 ip6 = mtod(m, struct ip6_hdr *);
559 th = (struct tcphdr *)(ip6 + 1);
560 tcpip_fillheaders(inp, ip6, th);
561 } else
562#endif
563 {
564 hdrlen = sizeof(struct tcpiphdr);
565 ip = mtod(m, struct ip *);
566 th = (struct tcphdr *)(ip + 1);
567 tcpip_fillheaders(inp, ip, th);
568 }
569 to.to_flags = 0;
570
571 /*
572 * Send a timestamp and echo-reply if both our side and our peer
573 * have sent timestamps in our SYN's and this is not a RST.
574 */
575 if (tw->t_recent && flags == TH_ACK) {
576 to.to_flags |= TOF_TS;
577 to.to_tsval = ticks + tw->ts_offset;
578 to.to_tsecr = tw->t_recent;
579 }
580 optlen = tcp_addoptions(&to, (u_char *)(th + 1));
581
582 m->m_len = hdrlen + optlen;
583 m->m_pkthdr.len = m->m_len;
584
585 KASSERT(max_linkhdr + m->m_len <= MHLEN, ("tcptw: mbuf too small"));
586
587 th->th_seq = htonl(tw->snd_nxt);
588 th->th_ack = htonl(tw->rcv_nxt);
589 th->th_off = (sizeof(struct tcphdr) + optlen) >> 2;
590 th->th_flags = flags;
591 th->th_win = htons(tw->last_win);
592
593#ifdef INET6
594 if (isipv6) {
595 th->th_sum = in6_cksum(m, IPPROTO_TCP, sizeof(struct ip6_hdr),
596 sizeof(struct tcphdr) + optlen);
597 ip6->ip6_hlim = in6_selecthlim(inp, NULL);
598 error = ip6_output(m, inp->in6p_outputopts, NULL,
599 (tw->tw_so_options & SO_DONTROUTE), NULL, NULL, inp);
600 } else
601#endif
602 {
603 th->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
604 htons(sizeof(struct tcphdr) + optlen + IPPROTO_TCP));
605 m->m_pkthdr.csum_flags = CSUM_TCP;
606 m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
607 ip->ip_len = m->m_pkthdr.len;
608 if (V_path_mtu_discovery)
609 ip->ip_off |= IP_DF;
610 error = ip_output(m, inp->inp_options, NULL,
611 ((tw->tw_so_options & SO_DONTROUTE) ? IP_ROUTETOIF : 0),
612 NULL, inp);
613 }
614 if (flags & TH_ACK)
615 V_tcpstat.tcps_sndacks++;
616 else
617 V_tcpstat.tcps_sndctrl++;
618 V_tcpstat.tcps_sndtotal++;
619 return (error);
620}
621
622static void
623tcp_tw_2msl_reset(struct tcptw *tw, int rearm)
624{
625 INIT_VNET_INET(curvnet);
626
627 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
628 INP_WLOCK_ASSERT(tw->tw_inpcb);
629 if (rearm)
630 TAILQ_REMOVE(&V_twq_2msl, tw, tw_2msl);
631 tw->tw_time = ticks + 2 * tcp_msl;
632 TAILQ_INSERT_TAIL(&V_twq_2msl, tw, tw_2msl);
633}
634
635static void
636tcp_tw_2msl_stop(struct tcptw *tw)
637{
638 INIT_VNET_INET(curvnet);
639
640 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
641 TAILQ_REMOVE(&V_twq_2msl, tw, tw_2msl);
642}
643
644struct tcptw *
645tcp_tw_2msl_scan(int reuse)
646{
647 INIT_VNET_INET(curvnet);
648 struct tcptw *tw;
649
650 INP_INFO_WLOCK_ASSERT(&V_tcbinfo);
651 for (;;) {
652 tw = TAILQ_FIRST(&V_twq_2msl);
653 if (tw == NULL || (!reuse && tw->tw_time > ticks))
654 break;
655 INP_WLOCK(tw->tw_inpcb);
656 tcp_twclose(tw, reuse);
657 if (reuse)
658 return (tw);
659 }
660 return (NULL);
661}
|