/*

 * CDDL HEADER START

 *

 * The contents of this file are subject to the terms of the

 * Common Development and Distribution License (the "License").

 * You may not use this file except in compliance with the License.

 *

 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE

 * or http://www.opensolaris.org/os/licensing.

 * See the License for the specific language governing permissions

 * and limitations under the License.

 *

 * When distributing Covered Code, include this CDDL HEADER in each

 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.

 * If applicable, add the following below this CDDL HEADER, with the

 * fields enclosed by brackets "[]" replaced with your own identifying

 * information: Portions Copyright [yyyy] [name of copyright owner]

 *

 * CDDL HEADER END

 */

/*

 * Copyright (c) 2010, Oracle and/or its affiliates. All rights reserved.

 * Copyright 2011 Nexenta Systems, Inc. All rights reserved.

 */

/* This file contains all TCP input processing functions. */

#include <sys/types.h>

#include <sys/stream.h>

#include <sys/strsun.h>

#include <sys/strsubr.h>

#include <sys/stropts.h>

#include <sys/strlog.h>

#define	_SUN_TPI_VERSION 2

#include <sys/tihdr.h>

#include <sys/suntpi.h>

#include <sys/xti_inet.h>

#include <sys/squeue_impl.h>

#include <sys/squeue.h>

#include <sys/tsol/tnet.h>

#include <inet/common.h>

#include <inet/ip.h>

#include <inet/tcp.h>

#include <inet/tcp_impl.h>

#include <inet/tcp_cluster.h>

#include <inet/proto_set.h>

#include <inet/ipsec_impl.h>

/*

 * RFC1323-recommended phrasing of TSTAMP option, for easier parsing

 */

#ifdef _BIG_ENDIAN

#define	TCPOPT_NOP_NOP_TSTAMP ((TCPOPT_NOP << 24) | (TCPOPT_NOP << 16) | \

	(TCPOPT_TSTAMP << 8) | 10)

#else

#define	TCPOPT_NOP_NOP_TSTAMP ((10 << 24) | (TCPOPT_TSTAMP << 16) | \

	(TCPOPT_NOP << 8) | TCPOPT_NOP)

#endif

/*

 * Flags returned from tcp_parse_options.

 */

#define	TCP_OPT_MSS_PRESENT	1

#define	TCP_OPT_WSCALE_PRESENT	2

#define	TCP_OPT_TSTAMP_PRESENT	4

#define	TCP_OPT_SACK_OK_PRESENT	8

#define	TCP_OPT_SACK_PRESENT	16

/*

 *  PAWS needs a timer for 24 days.  This is the number of ticks in 24 days

 */

#define	PAWS_TIMEOUT	((clock_t)(24*24*60*60*hz))

/*

 * Since tcp_listener is not cleared atomically with tcp_detached

 * being cleared we need this extra bit to tell a detached connection

 * apart from one that is in the process of being accepted.

 */

#define	TCP_IS_DETACHED_NONEAGER(tcp)	\

	(TCP_IS_DETACHED(tcp) &&	\

	    (!(tcp)->tcp_hard_binding))

/*

 * Steps to do when a tcp_t moves to TIME-WAIT state.

 *

 * This connection is done, we don't need to account for it.  Decrement

 * the listener connection counter if needed.

 *

 * Decrement the connection counter of the stack.  Note that this counter

 * is per CPU.  So the total number of connections in a stack is the sum of all

 * of them.  Since there is no lock for handling all of them exclusively, the

 * resulting sum is only an approximation.

 *

 * Unconditionally clear the exclusive binding bit so this TIME-WAIT

 * connection won't interfere with new ones.

 *

 * Start the TIME-WAIT timer.  If upper layer has not closed the connection,

 * the timer is handled within the context of this tcp_t.  When the timer

 * fires, tcp_clean_death() is called.  If upper layer closes the connection

 * during this period, tcp_time_wait_append() will be called to add this

 * tcp_t to the global TIME-WAIT list.  Note that this means that the

 * actual wait time in TIME-WAIT state will be longer than the

 * tcps_time_wait_interval since the period before upper layer closes the

 * connection is not accounted for when tcp_time_wait_append() is called.

 *

 * If uppser layer has closed the connection, call tcp_time_wait_append()

 * directly.

 *

 */

#define	SET_TIME_WAIT(tcps, tcp, connp)				\

{								\

	(tcp)->tcp_state = TCPS_TIME_WAIT;			\

	if ((tcp)->tcp_listen_cnt != NULL)			\

		TCP_DECR_LISTEN_CNT(tcp);			\

	atomic_dec_64(						\

	    (uint64_t *)&(tcps)->tcps_sc[CPU->cpu_seqid]->tcp_sc_conn_cnt); \

	(connp)->conn_exclbind = 0;				\

	if (!TCP_IS_DETACHED(tcp)) {				\

		TCP_TIMER_RESTART(tcp, (tcps)->tcps_time_wait_interval); \

	} else {						\

		tcp_time_wait_append(tcp);			\

		TCP_DBGSTAT(tcps, tcp_rput_time_wait);		\

	}							\

}

/*

 * If tcp_drop_ack_unsent_cnt is greater than 0, when TCP receives more

 * than tcp_drop_ack_unsent_cnt number of ACKs which acknowledge unsent

 * data, TCP will not respond with an ACK.  RFC 793 requires that

 * TCP responds with an ACK for such a bogus ACK.  By not following

 * the RFC, we prevent TCP from getting into an ACK storm if somehow

 * an attacker successfully spoofs an acceptable segment to our

 * peer; or when our peer is "confused."

 */

static uint32_t tcp_drop_ack_unsent_cnt = 10;

/*

 * To protect TCP against attacker using a small window and requesting

 * large amount of data (DoS attack by conuming memory), TCP checks the

 * window advertised in the last ACK of the 3-way handshake.  TCP uses

 * the tcp_mss (the size of one packet) value for comparion.  The window

 * should be larger than tcp_mss.  But while a sane TCP should advertise

 * a receive window larger than or equal to 4*MSS to avoid stop and go

 * tarrfic, not all TCP stacks do that.  This is especially true when

 * tcp_mss is a big value.

 *

 * To work around this issue, an additional fixed value for comparison

 * is also used.  If the advertised window is smaller than both tcp_mss

 * and tcp_init_wnd_chk, the ACK is considered as invalid.  So for large

 * tcp_mss value (say, 8K), a window larger than tcp_init_wnd_chk but

 * smaller than 8K is considered to be OK.

 */

static uint32_t tcp_init_wnd_chk = 4096;

/* Process ICMP source quench message or not. */

static boolean_t tcp_icmp_source_quench = B_FALSE;

static boolean_t tcp_outbound_squeue_switch = B_FALSE;

static mblk_t	*tcp_conn_create_v4(conn_t *, conn_t *, mblk_t *,

		    ip_recv_attr_t *);

static mblk_t	*tcp_conn_create_v6(conn_t *, conn_t *, mblk_t *,

		    ip_recv_attr_t *);

static boolean_t	tcp_drop_q0(tcp_t *);

static void	tcp_icmp_error_ipv6(tcp_t *, mblk_t *, ip_recv_attr_t *);

static mblk_t	*tcp_input_add_ancillary(tcp_t *, mblk_t *, ip_pkt_t *,

		    ip_recv_attr_t *);

static void	tcp_input_listener(void *, mblk_t *, void *, ip_recv_attr_t *);

static int	tcp_parse_options(tcpha_t *, tcp_opt_t *);

static void	tcp_process_options(tcp_t *, tcpha_t *);

static mblk_t	*tcp_reass(tcp_t *, mblk_t *, uint32_t);

static void	tcp_reass_elim_overlap(tcp_t *, mblk_t *);

static void	tcp_rsrv_input(void *, mblk_t *, void *, ip_recv_attr_t *);

static void	tcp_set_rto(tcp_t *, time_t);

static void	tcp_setcred_data(mblk_t *, ip_recv_attr_t *);

/*

 * Set the MSS associated with a particular tcp based on its current value,

 * and a new one passed in. Observe minimums and maximums, and reset other

 * state variables that we want to view as multiples of MSS.

 *

 * The value of MSS could be either increased or descreased.

 */

void

tcp_mss_set(tcp_t *tcp, uint32_t mss)

{

	uint32_t	mss_max;

	tcp_stack_t	*tcps = tcp->tcp_tcps;

	conn_t		*connp = tcp->tcp_connp;

	if (connp->conn_ipversion == IPV4_VERSION)

		mss_max = tcps->tcps_mss_max_ipv4;

	else

		mss_max = tcps->tcps_mss_max_ipv6;

	if (mss < tcps->tcps_mss_min)

		mss = tcps->tcps_mss_min;

	if (mss > mss_max)

		mss = mss_max;

	/*

	 * Unless naglim has been set by our client to

	 * a non-mss value, force naglim to track mss.

	 * This can help to aggregate small writes.

	 */

	if (mss < tcp->tcp_naglim || tcp->tcp_mss == tcp->tcp_naglim)

		tcp->tcp_naglim = mss;

	/*

	 * TCP should be able to buffer at least 4 MSS data for obvious

	 * performance reason.

	 */

	if ((mss << 2) > connp->conn_sndbuf)

		connp->conn_sndbuf = mss << 2;

	/*

	 * Set the send lowater to at least twice of MSS.

	 */

	if ((mss << 1) > connp->conn_sndlowat)

		connp->conn_sndlowat = mss << 1;

	/*

	 * Update tcp_cwnd according to the new value of MSS. Keep the

	 * previous ratio to preserve the transmit rate.

	 */

	tcp->tcp_cwnd = (tcp->tcp_cwnd / tcp->tcp_mss) * mss;

	tcp->tcp_cwnd_cnt = 0;

	tcp->tcp_mss = mss;

	(void) tcp_maxpsz_set(tcp, B_TRUE);

}

/*

 * Extract option values from a tcp header.  We put any found values into the

 * tcpopt struct and return a bitmask saying which options were found.

 */

static int

tcp_parse_options(tcpha_t *tcpha, tcp_opt_t *tcpopt)

{

	uchar_t		*endp;

	int		len;

	uint32_t	mss;

	uchar_t		*up = (uchar_t *)tcpha;

	int		found = 0;

	int32_t		sack_len;

	tcp_seq		sack_begin, sack_end;

	tcp_t		*tcp;

	endp = up + TCP_HDR_LENGTH(tcpha);

	up += TCP_MIN_HEADER_LENGTH;

	while (up < endp) {

		len = endp - up;

		switch (*up) {

		case TCPOPT_EOL:

			break;

		case TCPOPT_NOP:

			up++;

			continue;

		case TCPOPT_MAXSEG:

			if (len < TCPOPT_MAXSEG_LEN ||

			    up[1] != TCPOPT_MAXSEG_LEN)

				break;

			mss = BE16_TO_U16(up+2);

			/* Caller must handle tcp_mss_min and tcp_mss_max_* */

			tcpopt->tcp_opt_mss = mss;

			found |= TCP_OPT_MSS_PRESENT;

			up += TCPOPT_MAXSEG_LEN;

			continue;

		case TCPOPT_WSCALE:

			if (len < TCPOPT_WS_LEN || up[1] != TCPOPT_WS_LEN)

				break;

			if (up[2] > TCP_MAX_WINSHIFT)

				tcpopt->tcp_opt_wscale = TCP_MAX_WINSHIFT;

			else

				tcpopt->tcp_opt_wscale = up[2];

			found |= TCP_OPT_WSCALE_PRESENT;

			up += TCPOPT_WS_LEN;

			continue;

		case TCPOPT_SACK_PERMITTED:

			if (len < TCPOPT_SACK_OK_LEN ||

			    up[1] != TCPOPT_SACK_OK_LEN)

				break;

			found |= TCP_OPT_SACK_OK_PRESENT;

			up += TCPOPT_SACK_OK_LEN;

			continue;

		case TCPOPT_SACK:

			if (len <= 2 || up[1] <= 2 || len < up[1])

				break;

			/* If TCP is not interested in SACK blks... */

			if ((tcp = tcpopt->tcp) == NULL) {

				up += up[1];

				continue;

			}

			sack_len = up[1] - TCPOPT_HEADER_LEN;

			up += TCPOPT_HEADER_LEN;

			/*

			 * If the list is empty, allocate one and assume

			 * nothing is sack'ed.

			 */

			if (tcp->tcp_notsack_list == NULL) {

				tcp_notsack_update(&(tcp->tcp_notsack_list),

				    tcp->tcp_suna, tcp->tcp_snxt,

				    &(tcp->tcp_num_notsack_blk),

				    &(tcp->tcp_cnt_notsack_list));

				/*

				 * Make sure tcp_notsack_list is not NULL.

				 * This happens when kmem_alloc(KM_NOSLEEP)

				 * returns NULL.

				 */

				if (tcp->tcp_notsack_list == NULL) {

					up += sack_len;

					continue;

				}

				tcp->tcp_fack = tcp->tcp_suna;

			}

			while (sack_len > 0) {

				if (up + 8 > endp) {

					up = endp;

					break;

				}

				sack_begin = BE32_TO_U32(up);

				up += 4;

				sack_end = BE32_TO_U32(up);

				up += 4;

				sack_len -= 8;

				/*

				 * Bounds checking.  Make sure the SACK

				 * info is within tcp_suna and tcp_snxt.

				 * If this SACK blk is out of bound, ignore

				 * it but continue to parse the following

				 * blks.

				 */

				if (SEQ_LEQ(sack_end, sack_begin) ||

				    SEQ_LT(sack_begin, tcp->tcp_suna) ||

				    SEQ_GT(sack_end, tcp->tcp_snxt)) {

					continue;

				}

				tcp_notsack_insert(&(tcp->tcp_notsack_list),

				    sack_begin, sack_end,

				    &(tcp->tcp_num_notsack_blk),

				    &(tcp->tcp_cnt_notsack_list));

				if (SEQ_GT(sack_end, tcp->tcp_fack)) {

					tcp->tcp_fack = sack_end;

				}

			}

			found |= TCP_OPT_SACK_PRESENT;

			continue;

		case TCPOPT_TSTAMP:

			if (len < TCPOPT_TSTAMP_LEN ||

			    up[1] != TCPOPT_TSTAMP_LEN)

				break;

			tcpopt->tcp_opt_ts_val = BE32_TO_U32(up+2);

			tcpopt->tcp_opt_ts_ecr = BE32_TO_U32(up+6);

			found |= TCP_OPT_TSTAMP_PRESENT;

			up += TCPOPT_TSTAMP_LEN;

			continue;

		default:

			if (len <= 1 || len < (int)up[1] || up[1] == 0)

				break;

			up += up[1];

			continue;

		}

		break;

	}

	return (found);

}

/*

 * Process all TCP option in SYN segment.  Note that this function should

 * be called after tcp_set_destination() is called so that the necessary info

 * from IRE is already set in the tcp structure.

 *

 * This function sets up the correct tcp_mss value according to the

 * MSS option value and our header size.  It also sets up the window scale

 * and timestamp values, and initialize SACK info blocks.  But it does not

 * change receive window size after setting the tcp_mss value.  The caller

 * should do the appropriate change.

 */

static void

tcp_process_options(tcp_t *tcp, tcpha_t *tcpha)

{

	int options;

	tcp_opt_t tcpopt;

	uint32_t mss_max;

	char *tmp_tcph;

	tcp_stack_t	*tcps = tcp->tcp_tcps;

	conn_t		*connp = tcp->tcp_connp;

	tcpopt.tcp = NULL;

	options = tcp_parse_options(tcpha, &tcpopt);

	/*

	 * Process MSS option.  Note that MSS option value does not account

	 * for IP or TCP options.  This means that it is equal to MTU - minimum

	 * IP+TCP header size, which is 40 bytes for IPv4 and 60 bytes for

	 * IPv6.

	 */

	if (!(options & TCP_OPT_MSS_PRESENT)) {

		if (connp->conn_ipversion == IPV4_VERSION)

			tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv4;

		else

			tcpopt.tcp_opt_mss = tcps->tcps_mss_def_ipv6;

	} else {

		if (connp->conn_ipversion == IPV4_VERSION)

			mss_max = tcps->tcps_mss_max_ipv4;

		else

			mss_max = tcps->tcps_mss_max_ipv6;

		if (tcpopt.tcp_opt_mss < tcps->tcps_mss_min)

			tcpopt.tcp_opt_mss = tcps->tcps_mss_min;

		else if (tcpopt.tcp_opt_mss > mss_max)

			tcpopt.tcp_opt_mss = mss_max;

	}

	/* Process Window Scale option. */

	if (options & TCP_OPT_WSCALE_PRESENT) {

		tcp->tcp_snd_ws = tcpopt.tcp_opt_wscale;

		tcp->tcp_snd_ws_ok = B_TRUE;

	} else {

		tcp->tcp_snd_ws = B_FALSE;

		tcp->tcp_snd_ws_ok = B_FALSE;

		tcp->tcp_rcv_ws = B_FALSE;

	}

	/* Process Timestamp option. */

	if ((options & TCP_OPT_TSTAMP_PRESENT) &&

	    (tcp->tcp_snd_ts_ok || TCP_IS_DETACHED(tcp))) {

		tmp_tcph = (char *)tcp->tcp_tcpha;

		tcp->tcp_snd_ts_ok = B_TRUE;

		tcp->tcp_ts_recent = tcpopt.tcp_opt_ts_val;

		tcp->tcp_last_rcv_lbolt = ddi_get_lbolt64();

		ASSERT(OK_32PTR(tmp_tcph));

		ASSERT(connp->conn_ht_ulp_len == TCP_MIN_HEADER_LENGTH);

		/* Fill in our template header with basic timestamp option. */

		tmp_tcph += connp->conn_ht_ulp_len;

		tmp_tcph[0] = TCPOPT_NOP;

		tmp_tcph[1] = TCPOPT_NOP;

		tmp_tcph[2] = TCPOPT_TSTAMP;

		tmp_tcph[3] = TCPOPT_TSTAMP_LEN;

		connp->conn_ht_iphc_len += TCPOPT_REAL_TS_LEN;

		connp->conn_ht_ulp_len += TCPOPT_REAL_TS_LEN;

		tcp->tcp_tcpha->tha_offset_and_reserved += (3 << 4);

	} else {

		tcp->tcp_snd_ts_ok = B_FALSE;

	}

	/*

	 * Process SACK options.  If SACK is enabled for this connection,

	 * then allocate the SACK info structure.  Note the following ways

	 * when tcp_snd_sack_ok is set to true.

	 *

	 * For active connection: in tcp_set_destination() called in

	 * tcp_connect().

	 *

	 * For passive connection: in tcp_set_destination() called in

	 * tcp_input_listener().

	 *

	 * That's the reason why the extra TCP_IS_DETACHED() check is there.

	 * That check makes sure that if we did not send a SACK OK option,

	 * we will not enable SACK for this connection even though the other

	 * side sends us SACK OK option.  For active connection, the SACK

	 * info structure has already been allocated.  So we need to free

	 * it if SACK is disabled.

	 */

	if ((options & TCP_OPT_SACK_OK_PRESENT) &&

	    (tcp->tcp_snd_sack_ok ||

	    (tcps->tcps_sack_permitted != 0 && TCP_IS_DETACHED(tcp)))) {

		ASSERT(tcp->tcp_num_sack_blk == 0);

		ASSERT(tcp->tcp_notsack_list == NULL);

		tcp->tcp_snd_sack_ok = B_TRUE;

		if (tcp->tcp_snd_ts_ok) {

			tcp->tcp_max_sack_blk = 3;

		} else {

			tcp->tcp_max_sack_blk = 4;

		}

	} else if (tcp->tcp_snd_sack_ok) {

		/*

		 * Resetting tcp_snd_sack_ok to B_FALSE so that

		 * no SACK info will be used for this

		 * connection.  This assumes that SACK usage

		 * permission is negotiated.  This may need

		 * to be changed once this is clarified.

		 */

		ASSERT(tcp->tcp_num_sack_blk == 0);

		ASSERT(tcp->tcp_notsack_list == NULL);

		tcp->tcp_snd_sack_ok = B_FALSE;

	}

	/*

	 * Now we know the exact TCP/IP header length, subtract

	 * that from tcp_mss to get our side's MSS.

	 */

	tcp->tcp_mss -= connp->conn_ht_iphc_len;

	/*

	 * Here we assume that the other side's header size will be equal to

	 * our header size.  We calculate the real MSS accordingly.  Need to

	 * take into additional stuffs IPsec puts in.

	 *

	 * Real MSS = Opt.MSS - (our TCP/IP header - min TCP/IP header)

	 */

	tcpopt.tcp_opt_mss -= connp->conn_ht_iphc_len +

	    tcp->tcp_ipsec_overhead -