xref: /freebsd/sys/netinet/tcp_usrreq.c (revision a0b956f5)
1 /*-
2  * SPDX-License-Identifier: BSD-3-Clause
3  *
4  * Copyright (c) 1982, 1986, 1988, 1993
5  *	The Regents of the University of California.
6  * Copyright (c) 2006-2007 Robert N. M. Watson
7  * Copyright (c) 2010-2011 Juniper Networks, Inc.
8  * All rights reserved.
9  *
10  * Portions of this software were developed by Robert N. M. Watson under
11  * contract to Juniper Networks, Inc.
12  *
13  * Redistribution and use in source and binary forms, with or without
14  * modification, are permitted provided that the following conditions
15  * are met:
16  * 1. Redistributions of source code must retain the above copyright
17  *    notice, this list of conditions and the following disclaimer.
18  * 2. Redistributions in binary form must reproduce the above copyright
19  *    notice, this list of conditions and the following disclaimer in the
20  *    documentation and/or other materials provided with the distribution.
21  * 3. Neither the name of the University nor the names of its contributors
22  *    may be used to endorse or promote products derived from this software
23  *    without specific prior written permission.
24  *
25  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
26  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
27  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
28  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
29  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
30  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
31  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
32  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
33  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
34  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
35  * SUCH DAMAGE.
36  *
37  *	From: @(#)tcp_usrreq.c	8.2 (Berkeley) 1/3/94
38  */
39 
40 #include <sys/cdefs.h>
41 __FBSDID("$FreeBSD$");
42 
43 #include "opt_ddb.h"
44 #include "opt_inet.h"
45 #include "opt_inet6.h"
46 #include "opt_ipsec.h"
47 #include "opt_kern_tls.h"
48 #include "opt_tcpdebug.h"
49 
50 #include <sys/param.h>
51 #include <sys/systm.h>
52 #include <sys/arb.h>
53 #include <sys/limits.h>
54 #include <sys/malloc.h>
55 #include <sys/refcount.h>
56 #include <sys/kernel.h>
57 #include <sys/ktls.h>
58 #include <sys/qmath.h>
59 #include <sys/sysctl.h>
60 #include <sys/mbuf.h>
61 #ifdef INET6
62 #include <sys/domain.h>
63 #endif /* INET6 */
64 #include <sys/socket.h>
65 #include <sys/socketvar.h>
66 #include <sys/protosw.h>
67 #include <sys/proc.h>
68 #include <sys/jail.h>
69 #include <sys/stats.h>
70 
71 #ifdef DDB
72 #include <ddb/ddb.h>
73 #endif
74 
75 #include <net/if.h>
76 #include <net/if_var.h>
77 #include <net/route.h>
78 #include <net/vnet.h>
79 
80 #include <netinet/in.h>
81 #include <netinet/in_kdtrace.h>
82 #include <netinet/in_pcb.h>
83 #include <netinet/in_systm.h>
84 #include <netinet/in_var.h>
85 #include <netinet/ip.h>
86 #include <netinet/ip_var.h>
87 #ifdef INET6
88 #include <netinet/ip6.h>
89 #include <netinet6/in6_pcb.h>
90 #include <netinet6/ip6_var.h>
91 #include <netinet6/scope6_var.h>
92 #endif
93 #include <netinet/tcp.h>
94 #include <netinet/tcp_fsm.h>
95 #include <netinet/tcp_seq.h>
96 #include <netinet/tcp_timer.h>
97 #include <netinet/tcp_var.h>
98 #include <netinet/tcp_log_buf.h>
99 #include <netinet/tcpip.h>
100 #include <netinet/cc/cc.h>
101 #include <netinet/tcp_fastopen.h>
102 #include <netinet/tcp_hpts.h>
103 #ifdef TCPPCAP
104 #include <netinet/tcp_pcap.h>
105 #endif
106 #ifdef TCPDEBUG
107 #include <netinet/tcp_debug.h>
108 #endif
109 #ifdef TCP_OFFLOAD
110 #include <netinet/tcp_offload.h>
111 #endif
112 #include <netipsec/ipsec_support.h>
113 
114 #include <vm/vm.h>
115 #include <vm/vm_param.h>
116 #include <vm/pmap.h>
117 #include <vm/vm_extern.h>
118 #include <vm/vm_map.h>
119 #include <vm/vm_page.h>
120 
121 /*
122  * TCP protocol interface to socket abstraction.
123  */
124 #ifdef INET
125 static int	tcp_connect(struct tcpcb *, struct sockaddr *,
126 		    struct thread *td);
127 #endif /* INET */
128 #ifdef INET6
129 static int	tcp6_connect(struct tcpcb *, struct sockaddr *,
130 		    struct thread *td);
131 #endif /* INET6 */
132 static void	tcp_disconnect(struct tcpcb *);
133 static void	tcp_usrclosed(struct tcpcb *);
134 static void	tcp_fill_info(struct tcpcb *, struct tcp_info *);
135 
136 static int	tcp_pru_options_support(struct tcpcb *tp, int flags);
137 
138 #ifdef TCPDEBUG
139 #define	TCPDEBUG0	int ostate = 0
140 #define	TCPDEBUG1()	ostate = tp ? tp->t_state : 0
141 #define	TCPDEBUG2(req)	if (tp && (so->so_options & SO_DEBUG)) \
142 				tcp_trace(TA_USER, ostate, tp, 0, 0, req)
143 #else
144 #define	TCPDEBUG0
145 #define	TCPDEBUG1()
146 #define	TCPDEBUG2(req)
147 #endif
148 
149 /*
150  * tcp_require_unique port requires a globally-unique source port for each
151  * outgoing connection.  The default is to require the 4-tuple to be unique.
152  */
153 VNET_DEFINE(int, tcp_require_unique_port) = 0;
154 SYSCTL_INT(_net_inet_tcp, OID_AUTO, require_unique_port,
155     CTLFLAG_VNET | CTLFLAG_RW, &VNET_NAME(tcp_require_unique_port), 0,
156     "Require globally-unique ephemeral port for outgoing connections");
157 #define	V_tcp_require_unique_port	VNET(tcp_require_unique_port)
158 
159 /*
160  * TCP attaches to socket via pru_attach(), reserving space,
161  * and an internet control block.
162  */
163 static int
164 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
165 {
166 	struct inpcb *inp;
167 	struct tcpcb *tp = NULL;
168 	int error;
169 	TCPDEBUG0;
170 
171 	inp = sotoinpcb(so);
172 	KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
173 	TCPDEBUG1();
174 
175 	if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
176 		error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
177 		if (error)
178 			goto out;
179 	}
180 
181 	so->so_rcv.sb_flags |= SB_AUTOSIZE;
182 	so->so_snd.sb_flags |= SB_AUTOSIZE;
183 	error = in_pcballoc(so, &V_tcbinfo);
184 	if (error)
185 		goto out;
186 	inp = sotoinpcb(so);
187 #ifdef INET6
188 	if (inp->inp_vflag & INP_IPV6PROTO) {
189 		inp->inp_vflag |= INP_IPV6;
190 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
191 			inp->inp_vflag |= INP_IPV4;
192 		inp->in6p_hops = -1;	/* use kernel default */
193 	}
194 	else
195 #endif
196 		inp->inp_vflag |= INP_IPV4;
197 	tp = tcp_newtcpcb(inp);
198 	if (tp == NULL) {
199 		error = ENOBUFS;
200 		in_pcbdetach(inp);
201 		in_pcbfree(inp);
202 		goto out;
203 	}
204 	tp->t_state = TCPS_CLOSED;
205 	INP_WUNLOCK(inp);
206 	TCPSTATES_INC(TCPS_CLOSED);
207 out:
208 	TCPDEBUG2(PRU_ATTACH);
209 	TCP_PROBE2(debug__user, tp, PRU_ATTACH);
210 	return (error);
211 }
212 
213 /*
214  * tcp_usr_detach is called when the socket layer loses its final reference
215  * to the socket, be it a file descriptor reference, a reference from TCP,
216  * etc.  At this point, there is only one case in which we will keep around
217  * inpcb state: time wait.
218  */
219 static void
220 tcp_usr_detach(struct socket *so)
221 {
222 	struct inpcb *inp;
223 	struct tcpcb *tp;
224 
225 	inp = sotoinpcb(so);
226 	KASSERT(inp != NULL, ("%s: inp == NULL", __func__));
227 	INP_WLOCK(inp);
228 	KASSERT(so->so_pcb == inp && inp->inp_socket == so,
229 		("%s: socket %p inp %p mismatch", __func__, so, inp));
230 
231 	tp = intotcpcb(inp);
232 
233 	if (inp->inp_flags & INP_TIMEWAIT) {
234 		/*
235 		 * There are two cases to handle: one in which the time wait
236 		 * state is being discarded (INP_DROPPED), and one in which
237 		 * this connection will remain in timewait.  In the former,
238 		 * it is time to discard all state (except tcptw, which has
239 		 * already been discarded by the timewait close code, which
240 		 * should be further up the call stack somewhere).  In the
241 		 * latter case, we detach from the socket, but leave the pcb
242 		 * present until timewait ends.
243 		 *
244 		 * XXXRW: Would it be cleaner to free the tcptw here?
245 		 *
246 		 * Astute question indeed, from twtcp perspective there are
247 		 * four cases to consider:
248 		 *
249 		 * #1 tcp_usr_detach is called at tcptw creation time by
250 		 *  tcp_twstart, then do not discard the newly created tcptw
251 		 *  and leave inpcb present until timewait ends
252 		 * #2 tcp_usr_detach is called at tcptw creation time by
253 		 *  tcp_twstart, but connection is local and tw will be
254 		 *  discarded immediately
255 		 * #3 tcp_usr_detach is called at timewait end (or reuse) by
256 		 *  tcp_twclose, then the tcptw has already been discarded
257 		 *  (or reused) and inpcb is freed here
258 		 * #4 tcp_usr_detach is called() after timewait ends (or reuse)
259 		 *  (e.g. by soclose), then tcptw has already been discarded
260 		 *  (or reused) and inpcb is freed here
261 		 *
262 		 *  In all three cases the tcptw should not be freed here.
263 		 */
264 		if (inp->inp_flags & INP_DROPPED) {
265 			KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "
266 			    "INP_DROPPED && tp != NULL"));
267 			in_pcbdetach(inp);
268 			in_pcbfree(inp);
269 		} else {
270 			in_pcbdetach(inp);
271 			INP_WUNLOCK(inp);
272 		}
273 	} else {
274 		/*
275 		 * If the connection is not in timewait, it must be either
276 		 * dropped or embryonic.
277 		 */
278 		KASSERT(inp->inp_flags & INP_DROPPED ||
279 		    tp->t_state < TCPS_SYN_SENT,
280 		    ("%s: inp %p not dropped or embryonic", __func__, inp));
281 		tcp_discardcb(tp);
282 		in_pcbdetach(inp);
283 		in_pcbfree(inp);
284 	}
285 }
286 
287 #ifdef INET
288 /*
289  * Give the socket an address.
290  */
291 static int
292 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
293 {
294 	int error = 0;
295 	struct inpcb *inp;
296 #ifdef KDTRACE_HOOKS
297 	struct tcpcb *tp = NULL;
298 #endif
299 	struct sockaddr_in *sinp;
300 
301 	sinp = (struct sockaddr_in *)nam;
302 	if (nam->sa_family != AF_INET) {
303 		/*
304 		 * Preserve compatibility with old programs.
305 		 */
306 		if (nam->sa_family != AF_UNSPEC ||
307 		    nam->sa_len < offsetof(struct sockaddr_in, sin_zero) ||
308 		    sinp->sin_addr.s_addr != INADDR_ANY)
309 			return (EAFNOSUPPORT);
310 		nam->sa_family = AF_INET;
311 	}
312 	if (nam->sa_len != sizeof(*sinp))
313 		return (EINVAL);
314 
315 	/*
316 	 * Must check for multicast addresses and disallow binding
317 	 * to them.
318 	 */
319 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
320 		return (EAFNOSUPPORT);
321 
322 	TCPDEBUG0;
323 	inp = sotoinpcb(so);
324 	KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
325 	INP_WLOCK(inp);
326 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
327 		error = EINVAL;
328 		goto out;
329 	}
330 #ifdef KDTRACE_HOOKS
331 	tp = intotcpcb(inp);
332 #endif
333 	TCPDEBUG1();
334 	INP_HASH_WLOCK(&V_tcbinfo);
335 	error = in_pcbbind(inp, nam, td->td_ucred);
336 	INP_HASH_WUNLOCK(&V_tcbinfo);
337 out:
338 	TCPDEBUG2(PRU_BIND);
339 	TCP_PROBE2(debug__user, tp, PRU_BIND);
340 	INP_WUNLOCK(inp);
341 
342 	return (error);
343 }
344 #endif /* INET */
345 
346 #ifdef INET6
347 static int
348 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
349 {
350 	int error = 0;
351 	struct inpcb *inp;
352 #ifdef KDTRACE_HOOKS
353 	struct tcpcb *tp = NULL;
354 #endif
355 	struct sockaddr_in6 *sin6;
356 	u_char vflagsav;
357 
358 	sin6 = (struct sockaddr_in6 *)nam;
359 	if (nam->sa_family != AF_INET6)
360 		return (EAFNOSUPPORT);
361 	if (nam->sa_len != sizeof(*sin6))
362 		return (EINVAL);
363 
364 	/*
365 	 * Must check for multicast addresses and disallow binding
366 	 * to them.
367 	 */
368 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr))
369 		return (EAFNOSUPPORT);
370 
371 	TCPDEBUG0;
372 	inp = sotoinpcb(so);
373 	KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
374 	INP_WLOCK(inp);
375 	vflagsav = inp->inp_vflag;
376 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
377 		error = EINVAL;
378 		goto out;
379 	}
380 #ifdef KDTRACE_HOOKS
381 	tp = intotcpcb(inp);
382 #endif
383 	TCPDEBUG1();
384 	INP_HASH_WLOCK(&V_tcbinfo);
385 	inp->inp_vflag &= ~INP_IPV4;
386 	inp->inp_vflag |= INP_IPV6;
387 #ifdef INET
388 	if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
389 		if (IN6_IS_ADDR_UNSPECIFIED(&sin6->sin6_addr))
390 			inp->inp_vflag |= INP_IPV4;
391 		else if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
392 			struct sockaddr_in sin;
393 
394 			in6_sin6_2_sin(&sin, sin6);
395 			if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
396 				error = EAFNOSUPPORT;
397 				INP_HASH_WUNLOCK(&V_tcbinfo);
398 				goto out;
399 			}
400 			inp->inp_vflag |= INP_IPV4;
401 			inp->inp_vflag &= ~INP_IPV6;
402 			error = in_pcbbind(inp, (struct sockaddr *)&sin,
403 			    td->td_ucred);
404 			INP_HASH_WUNLOCK(&V_tcbinfo);
405 			goto out;
406 		}
407 	}
408 #endif
409 	error = in6_pcbbind(inp, nam, td->td_ucred);
410 	INP_HASH_WUNLOCK(&V_tcbinfo);
411 out:
412 	if (error != 0)
413 		inp->inp_vflag = vflagsav;
414 	TCPDEBUG2(PRU_BIND);
415 	TCP_PROBE2(debug__user, tp, PRU_BIND);
416 	INP_WUNLOCK(inp);
417 	return (error);
418 }
419 #endif /* INET6 */
420 
421 #ifdef INET
422 /*
423  * Prepare to accept connections.
424  */
425 static int
426 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
427 {
428 	int error = 0;
429 	struct inpcb *inp;
430 	struct tcpcb *tp = NULL;
431 
432 	TCPDEBUG0;
433 	inp = sotoinpcb(so);
434 	KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
435 	INP_WLOCK(inp);
436 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
437 		error = EINVAL;
438 		goto out;
439 	}
440 	tp = intotcpcb(inp);
441 	TCPDEBUG1();
442 	SOCK_LOCK(so);
443 	error = solisten_proto_check(so);
444 	if (error != 0) {
445 		SOCK_UNLOCK(so);
446 		goto out;
447 	}
448 	if (inp->inp_lport == 0) {
449 		INP_HASH_WLOCK(&V_tcbinfo);
450 		error = in_pcbbind(inp, NULL, td->td_ucred);
451 		INP_HASH_WUNLOCK(&V_tcbinfo);
452 	}
453 	if (error == 0) {
454 		tcp_state_change(tp, TCPS_LISTEN);
455 		solisten_proto(so, backlog);
456 #ifdef TCP_OFFLOAD
457 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
458 			tcp_offload_listen_start(tp);
459 #endif
460 	} else {
461 		solisten_proto_abort(so);
462 	}
463 	SOCK_UNLOCK(so);
464 
465 	if (IS_FASTOPEN(tp->t_flags))
466 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
467 
468 out:
469 	TCPDEBUG2(PRU_LISTEN);
470 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
471 	INP_WUNLOCK(inp);
472 	return (error);
473 }
474 #endif /* INET */
475 
476 #ifdef INET6
477 static int
478 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
479 {
480 	int error = 0;
481 	struct inpcb *inp;
482 	struct tcpcb *tp = NULL;
483 	u_char vflagsav;
484 
485 	TCPDEBUG0;
486 	inp = sotoinpcb(so);
487 	KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
488 	INP_WLOCK(inp);
489 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
490 		error = EINVAL;
491 		goto out;
492 	}
493 	vflagsav = inp->inp_vflag;
494 	tp = intotcpcb(inp);
495 	TCPDEBUG1();
496 	SOCK_LOCK(so);
497 	error = solisten_proto_check(so);
498 	if (error != 0) {
499 		SOCK_UNLOCK(so);
500 		goto out;
501 	}
502 	INP_HASH_WLOCK(&V_tcbinfo);
503 	if (inp->inp_lport == 0) {
504 		inp->inp_vflag &= ~INP_IPV4;
505 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
506 			inp->inp_vflag |= INP_IPV4;
507 		error = in6_pcbbind(inp, NULL, td->td_ucred);
508 	}
509 	INP_HASH_WUNLOCK(&V_tcbinfo);
510 	if (error == 0) {
511 		tcp_state_change(tp, TCPS_LISTEN);
512 		solisten_proto(so, backlog);
513 #ifdef TCP_OFFLOAD
514 		if ((so->so_options & SO_NO_OFFLOAD) == 0)
515 			tcp_offload_listen_start(tp);
516 #endif
517 	} else {
518 		solisten_proto_abort(so);
519 	}
520 	SOCK_UNLOCK(so);
521 
522 	if (IS_FASTOPEN(tp->t_flags))
523 		tp->t_tfo_pending = tcp_fastopen_alloc_counter();
524 
525 	if (error != 0)
526 		inp->inp_vflag = vflagsav;
527 
528 out:
529 	TCPDEBUG2(PRU_LISTEN);
530 	TCP_PROBE2(debug__user, tp, PRU_LISTEN);
531 	INP_WUNLOCK(inp);
532 	return (error);
533 }
534 #endif /* INET6 */
535 
536 #ifdef INET
537 /*
538  * Initiate connection to peer.
539  * Create a template for use in transmissions on this connection.
540  * Enter SYN_SENT state, and mark socket as connecting.
541  * Start keep-alive timer, and seed output sequence space.
542  * Send initial segment on connection.
543  */
544 static int
545 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
546 {
547 	struct epoch_tracker et;
548 	int error = 0;
549 	struct inpcb *inp;
550 	struct tcpcb *tp = NULL;
551 	struct sockaddr_in *sinp;
552 
553 	sinp = (struct sockaddr_in *)nam;
554 	if (nam->sa_family != AF_INET)
555 		return (EAFNOSUPPORT);
556 	if (nam->sa_len != sizeof (*sinp))
557 		return (EINVAL);
558 
559 	/*
560 	 * Must disallow TCP ``connections'' to multicast addresses.
561 	 */
562 	if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
563 		return (EAFNOSUPPORT);
564 	if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST)
565 		return (EACCES);
566 	if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
567 		return (error);
568 
569 	TCPDEBUG0;
570 	inp = sotoinpcb(so);
571 	KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
572 	INP_WLOCK(inp);
573 	if (inp->inp_flags & INP_TIMEWAIT) {
574 		error = EADDRINUSE;
575 		goto out;
576 	}
577 	if (inp->inp_flags & INP_DROPPED) {
578 		error = ECONNREFUSED;
579 		goto out;
580 	}
581 	if (SOLISTENING(so)) {
582 		error = EOPNOTSUPP;
583 		goto out;
584 	}
585 	tp = intotcpcb(inp);
586 	TCPDEBUG1();
587 	NET_EPOCH_ENTER(et);
588 	if ((error = tcp_connect(tp, nam, td)) != 0)
589 		goto out_in_epoch;
590 #ifdef TCP_OFFLOAD
591 	if (registered_toedevs > 0 &&
592 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
593 	    (error = tcp_offload_connect(so, nam)) == 0)
594 		goto out_in_epoch;
595 #endif
596 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
597 	error = tcp_output(tp);
598 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
599 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
600 out_in_epoch:
601 	NET_EPOCH_EXIT(et);
602 out:
603 	TCPDEBUG2(PRU_CONNECT);
604 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
605 	INP_WUNLOCK(inp);
606 	return (error);
607 }
608 #endif /* INET */
609 
610 #ifdef INET6
611 static int
612 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
613 {
614 	struct epoch_tracker et;
615 	int error = 0;
616 	struct inpcb *inp;
617 	struct tcpcb *tp = NULL;
618 	struct sockaddr_in6 *sin6;
619 	u_int8_t incflagsav;
620 	u_char vflagsav;
621 
622 	TCPDEBUG0;
623 
624 	sin6 = (struct sockaddr_in6 *)nam;
625 	if (nam->sa_family != AF_INET6)
626 		return (EAFNOSUPPORT);
627 	if (nam->sa_len != sizeof (*sin6))
628 		return (EINVAL);
629 
630 	/*
631 	 * Must disallow TCP ``connections'' to multicast addresses.
632 	 */
633 	if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr))
634 		return (EAFNOSUPPORT);
635 
636 	inp = sotoinpcb(so);
637 	KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
638 	INP_WLOCK(inp);
639 	vflagsav = inp->inp_vflag;
640 	incflagsav = inp->inp_inc.inc_flags;
641 	if (inp->inp_flags & INP_TIMEWAIT) {
642 		error = EADDRINUSE;
643 		goto out;
644 	}
645 	if (inp->inp_flags & INP_DROPPED) {
646 		error = ECONNREFUSED;
647 		goto out;
648 	}
649 	if (SOLISTENING(so)) {
650 		error = EINVAL;
651 		goto out;
652 	}
653 	tp = intotcpcb(inp);
654 	TCPDEBUG1();
655 #ifdef INET
656 	/*
657 	 * XXXRW: Some confusion: V4/V6 flags relate to binding, and
658 	 * therefore probably require the hash lock, which isn't held here.
659 	 * Is this a significant problem?
660 	 */
661 	if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
662 		struct sockaddr_in sin;
663 
664 		if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
665 			error = EINVAL;
666 			goto out;
667 		}
668 		if ((inp->inp_vflag & INP_IPV4) == 0) {
669 			error = EAFNOSUPPORT;
670 			goto out;
671 		}
672 
673 		in6_sin6_2_sin(&sin, sin6);
674 		if (IN_MULTICAST(ntohl(sin.sin_addr.s_addr))) {
675 			error = EAFNOSUPPORT;
676 			goto out;
677 		}
678 		if (ntohl(sin.sin_addr.s_addr) == INADDR_BROADCAST) {
679 			error = EACCES;
680 			goto out;
681 		}
682 		if ((error = prison_remote_ip4(td->td_ucred,
683 		    &sin.sin_addr)) != 0)
684 			goto out;
685 		inp->inp_vflag |= INP_IPV4;
686 		inp->inp_vflag &= ~INP_IPV6;
687 		NET_EPOCH_ENTER(et);
688 		if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)
689 			goto out_in_epoch;
690 #ifdef TCP_OFFLOAD
691 		if (registered_toedevs > 0 &&
692 		    (so->so_options & SO_NO_OFFLOAD) == 0 &&
693 		    (error = tcp_offload_connect(so, nam)) == 0)
694 			goto out_in_epoch;
695 #endif
696 		error = tcp_output(tp);
697 		goto out_in_epoch;
698 	} else {
699 		if ((inp->inp_vflag & INP_IPV6) == 0) {
700 			error = EAFNOSUPPORT;
701 			goto out;
702 		}
703 	}
704 #endif
705 	if ((error = prison_remote_ip6(td->td_ucred, &sin6->sin6_addr)) != 0)
706 		goto out;
707 	inp->inp_vflag &= ~INP_IPV4;
708 	inp->inp_vflag |= INP_IPV6;
709 	inp->inp_inc.inc_flags |= INC_ISIPV6;
710 	if ((error = tcp6_connect(tp, nam, td)) != 0)
711 		goto out;
712 #ifdef TCP_OFFLOAD
713 	if (registered_toedevs > 0 &&
714 	    (so->so_options & SO_NO_OFFLOAD) == 0 &&
715 	    (error = tcp_offload_connect(so, nam)) == 0)
716 		goto out;
717 #endif
718 	tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
719 	NET_EPOCH_ENTER(et);
720 	error = tcp_output(tp);
721 #ifdef INET
722 out_in_epoch:
723 #endif
724 	NET_EPOCH_EXIT(et);
725 out:
726 	KASSERT(error >= 0, ("TCP stack %s requested tcp_drop(%p) at connect()"
727 	    ", error code %d", tp->t_fb->tfb_tcp_block_name, tp, -error));
728 	/*
729 	 * If the implicit bind in the connect call fails, restore
730 	 * the flags we modified.
731 	 */
732 	if (error != 0 && inp->inp_lport == 0) {
733 		inp->inp_vflag = vflagsav;
734 		inp->inp_inc.inc_flags = incflagsav;
735 	}
736 
737 	TCPDEBUG2(PRU_CONNECT);
738 	TCP_PROBE2(debug__user, tp, PRU_CONNECT);
739 	INP_WUNLOCK(inp);
740 	return (error);
741 }
742 #endif /* INET6 */
743 
744 /*
745  * Initiate disconnect from peer.
746  * If connection never passed embryonic stage, just drop;
747  * else if don't need to let data drain, then can just drop anyways,
748  * else have to begin TCP shutdown process: mark socket disconnecting,
749  * drain unread data, state switch to reflect user close, and
750  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
751  * when peer sends FIN and acks ours.
752  *
753  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
754  */
755 static int
756 tcp_usr_disconnect(struct socket *so)
757 {
758 	struct inpcb *inp;
759 	struct tcpcb *tp = NULL;
760 	struct epoch_tracker et;
761 	int error = 0;
762 
763 	TCPDEBUG0;
764 	NET_EPOCH_ENTER(et);
765 	inp = sotoinpcb(so);
766 	KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
767 	INP_WLOCK(inp);
768 	if (inp->inp_flags & INP_TIMEWAIT)
769 		goto out;
770 	if (inp->inp_flags & INP_DROPPED) {
771 		error = ECONNRESET;
772 		goto out;
773 	}
774 	tp = intotcpcb(inp);
775 	TCPDEBUG1();
776 	tcp_disconnect(tp);
777 out:
778 	TCPDEBUG2(PRU_DISCONNECT);
779 	TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
780 	INP_WUNLOCK(inp);
781 	NET_EPOCH_EXIT(et);
782 	return (error);
783 }
784 
785 #ifdef INET
786 /*
787  * Accept a connection.  Essentially all the work is done at higher levels;
788  * just return the address of the peer, storing through addr.
789  */
790 static int
791 tcp_usr_accept(struct socket *so, struct sockaddr **nam)
792 {
793 	int error = 0;
794 	struct inpcb *inp = NULL;
795 #ifdef KDTRACE_HOOKS
796 	struct tcpcb *tp = NULL;
797 #endif
798 	struct in_addr addr;
799 	in_port_t port = 0;
800 	TCPDEBUG0;
801 
802 	if (so->so_state & SS_ISDISCONNECTED)
803 		return (ECONNABORTED);
804 
805 	inp = sotoinpcb(so);
806 	KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
807 	INP_WLOCK(inp);
808 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
809 		error = ECONNABORTED;
810 		goto out;
811 	}
812 #ifdef KDTRACE_HOOKS
813 	tp = intotcpcb(inp);
814 #endif
815 	TCPDEBUG1();
816 
817 	/*
818 	 * We inline in_getpeeraddr and COMMON_END here, so that we can
819 	 * copy the data of interest and defer the malloc until after we
820 	 * release the lock.
821 	 */
822 	port = inp->inp_fport;
823 	addr = inp->inp_faddr;
824 
825 out:
826 	TCPDEBUG2(PRU_ACCEPT);
827 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
828 	INP_WUNLOCK(inp);
829 	if (error == 0)
830 		*nam = in_sockaddr(port, &addr);
831 	return error;
832 }
833 #endif /* INET */
834 
835 #ifdef INET6
836 static int
837 tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
838 {
839 	struct inpcb *inp = NULL;
840 	int error = 0;
841 #ifdef KDTRACE_HOOKS
842 	struct tcpcb *tp = NULL;
843 #endif
844 	struct in_addr addr;
845 	struct in6_addr addr6;
846 	struct epoch_tracker et;
847 	in_port_t port = 0;
848 	int v4 = 0;
849 	TCPDEBUG0;
850 
851 	if (so->so_state & SS_ISDISCONNECTED)
852 		return (ECONNABORTED);
853 
854 	inp = sotoinpcb(so);
855 	KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
856 	NET_EPOCH_ENTER(et);
857 	INP_WLOCK(inp);
858 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
859 		error = ECONNABORTED;
860 		goto out;
861 	}
862 #ifdef KDTRACE_HOOKS
863 	tp = intotcpcb(inp);
864 #endif
865 	TCPDEBUG1();
866 
867 	/*
868 	 * We inline in6_mapped_peeraddr and COMMON_END here, so that we can
869 	 * copy the data of interest and defer the malloc until after we
870 	 * release the lock.
871 	 */
872 	if (inp->inp_vflag & INP_IPV4) {
873 		v4 = 1;
874 		port = inp->inp_fport;
875 		addr = inp->inp_faddr;
876 	} else {
877 		port = inp->inp_fport;
878 		addr6 = inp->in6p_faddr;
879 	}
880 
881 out:
882 	TCPDEBUG2(PRU_ACCEPT);
883 	TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
884 	INP_WUNLOCK(inp);
885 	NET_EPOCH_EXIT(et);
886 	if (error == 0) {
887 		if (v4)
888 			*nam = in6_v4mapsin6_sockaddr(port, &addr);
889 		else
890 			*nam = in6_sockaddr(port, &addr6);
891 	}
892 	return error;
893 }
894 #endif /* INET6 */
895 
896 /*
897  * Mark the connection as being incapable of further output.
898  */
899 static int
900 tcp_usr_shutdown(struct socket *so)
901 {
902 	int error = 0;
903 	struct inpcb *inp;
904 	struct tcpcb *tp = NULL;
905 	struct epoch_tracker et;
906 
907 	TCPDEBUG0;
908 	inp = sotoinpcb(so);
909 	KASSERT(inp != NULL, ("inp == NULL"));
910 	INP_WLOCK(inp);
911 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
912 		INP_WUNLOCK(inp);
913 		return (ECONNRESET);
914 	}
915 	tp = intotcpcb(inp);
916 	NET_EPOCH_ENTER(et);
917 	TCPDEBUG1();
918 	socantsendmore(so);
919 	tcp_usrclosed(tp);
920 	if (!(inp->inp_flags & INP_DROPPED))
921 		error = tcp_output_nodrop(tp);
922 	TCPDEBUG2(PRU_SHUTDOWN);
923 	TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
924 	error = tcp_unlock_or_drop(tp, error);
925 	NET_EPOCH_EXIT(et);
926 
927 	return (error);
928 }
929 
930 /*
931  * After a receive, possibly send window update to peer.
932  */
933 static int
934 tcp_usr_rcvd(struct socket *so, int flags)
935 {
936 	struct epoch_tracker et;
937 	struct inpcb *inp;
938 	struct tcpcb *tp = NULL;
939 	int outrv = 0, error = 0;
940 
941 	TCPDEBUG0;
942 	inp = sotoinpcb(so);
943 	KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
944 	INP_WLOCK(inp);
945 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
946 		INP_WUNLOCK(inp);
947 		return (ECONNRESET);
948 	}
949 	tp = intotcpcb(inp);
950 	NET_EPOCH_ENTER(et);
951 	TCPDEBUG1();
952 	/*
953 	 * For passively-created TFO connections, don't attempt a window
954 	 * update while still in SYN_RECEIVED as this may trigger an early
955 	 * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
956 	 * application response data, or failing that, when the DELACK timer
957 	 * expires.
958 	 */
959 	if (IS_FASTOPEN(tp->t_flags) &&
960 	    (tp->t_state == TCPS_SYN_RECEIVED))
961 		goto out;
962 #ifdef TCP_OFFLOAD
963 	if (tp->t_flags & TF_TOE)
964 		tcp_offload_rcvd(tp);
965 	else
966 #endif
967 		outrv = tcp_output_nodrop(tp);
968 out:
969 	TCPDEBUG2(PRU_RCVD);
970 	TCP_PROBE2(debug__user, tp, PRU_RCVD);
971 	(void) tcp_unlock_or_drop(tp, outrv);
972 	NET_EPOCH_EXIT(et);
973 	return (error);
974 }
975 
976 /*
977  * Do a send by putting data in output queue and updating urgent
978  * marker if URG set.  Possibly send more data.  Unlike the other
979  * pru_*() routines, the mbuf chains are our responsibility.  We
980  * must either enqueue them or free them.  The other pru_* routines
981  * generally are caller-frees.
982  */
983 static int
984 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
985     struct sockaddr *nam, struct mbuf *control, struct thread *td)
986 {
987 	struct epoch_tracker et;
988 	int error = 0;
989 	struct inpcb *inp;
990 	struct tcpcb *tp = NULL;
991 #ifdef INET
992 #ifdef INET6
993 	struct sockaddr_in sin;
994 #endif
995 	struct sockaddr_in *sinp;
996 #endif
997 #ifdef INET6
998 	int isipv6;
999 #endif
1000 	u_int8_t incflagsav;
1001 	u_char vflagsav;
1002 	bool restoreflags;
1003 	TCPDEBUG0;
1004 
1005 	if (control != NULL) {
1006 		/* TCP doesn't do control messages (rights, creds, etc) */
1007 		if (control->m_len) {
1008 			m_freem(control);
1009 			return (EINVAL);
1010 		}
1011 		m_freem(control);	/* empty control, just free it */
1012 	}
1013 
1014 	inp = sotoinpcb(so);
1015 	KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
1016 	INP_WLOCK(inp);
1017 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1018 		if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1019 			m_freem(m);
1020 		INP_WUNLOCK(inp);
1021 		return (ECONNRESET);
1022 	}
1023 
1024 	vflagsav = inp->inp_vflag;
1025 	incflagsav = inp->inp_inc.inc_flags;
1026 	restoreflags = false;
1027 	tp = intotcpcb(inp);
1028 
1029 	NET_EPOCH_ENTER(et);
1030 	if ((flags & PRUS_OOB) != 0 &&
1031 	    (error = tcp_pru_options_support(tp, PRUS_OOB)) != 0)
1032 		goto out;
1033 
1034 	TCPDEBUG1();
1035 	if (nam != NULL && tp->t_state < TCPS_SYN_SENT) {
1036 		if (tp->t_state == TCPS_LISTEN) {
1037 			error = EINVAL;
1038 			goto out;
1039 		}
1040 		switch (nam->sa_family) {
1041 #ifdef INET
1042 		case AF_INET:
1043 			sinp = (struct sockaddr_in *)nam;
1044 			if (sinp->sin_len != sizeof(struct sockaddr_in)) {
1045 				error = EINVAL;
1046 				goto out;
1047 			}
1048 			if ((inp->inp_vflag & INP_IPV6) != 0) {
1049 				error = EAFNOSUPPORT;
1050 				goto out;
1051 			}
1052 			if (IN_MULTICAST(ntohl(sinp->sin_addr.s_addr))) {
1053 				error = EAFNOSUPPORT;
1054 				goto out;
1055 			}
1056 			if (ntohl(sinp->sin_addr.s_addr) == INADDR_BROADCAST) {
1057 				error = EACCES;
1058 				goto out;
1059 			}
1060 			if ((error = prison_remote_ip4(td->td_ucred,
1061 			    &sinp->sin_addr)))
1062 				goto out;
1063 #ifdef INET6
1064 			isipv6 = 0;
1065 #endif
1066 			break;
1067 #endif /* INET */
1068 #ifdef INET6
1069 		case AF_INET6:
1070 		{
1071 			struct sockaddr_in6 *sin6;
1072 
1073 			sin6 = (struct sockaddr_in6 *)nam;
1074 			if (sin6->sin6_len != sizeof(*sin6)) {
1075 				error = EINVAL;
1076 				goto out;
1077 			}
1078 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0) {
1079 				error = EAFNOSUPPORT;
1080 				goto out;
1081 			}
1082 			if (IN6_IS_ADDR_MULTICAST(&sin6->sin6_addr)) {
1083 				error = EAFNOSUPPORT;
1084 				goto out;
1085 			}
1086 			if (IN6_IS_ADDR_V4MAPPED(&sin6->sin6_addr)) {
1087 #ifdef INET
1088 				if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
1089 					error = EINVAL;
1090 					goto out;
1091 				}
1092 				if ((inp->inp_vflag & INP_IPV4) == 0) {
1093 					error = EAFNOSUPPORT;
1094 					goto out;
1095 				}
1096 				restoreflags = true;
1097 				inp->inp_vflag &= ~INP_IPV6;
1098 				sinp = &sin;
1099 				in6_sin6_2_sin(sinp, sin6);
1100 				if (IN_MULTICAST(
1101 				    ntohl(sinp->sin_addr.s_addr))) {
1102 					error = EAFNOSUPPORT;
1103 					goto out;
1104 				}
1105 				if ((error = prison_remote_ip4(td->td_ucred,
1106 				    &sinp->sin_addr)))
1107 					goto out;
1108 				isipv6 = 0;
1109 #else /* !INET */
1110 				error = EAFNOSUPPORT;
1111 				goto out;
1112 #endif /* INET */
1113 			} else {
1114 				if ((inp->inp_vflag & INP_IPV6) == 0) {
1115 					error = EAFNOSUPPORT;
1116 					goto out;
1117 				}
1118 				restoreflags = true;
1119 				inp->inp_vflag &= ~INP_IPV4;
1120 				inp->inp_inc.inc_flags |= INC_ISIPV6;
1121 				if ((error = prison_remote_ip6(td->td_ucred,
1122 				    &sin6->sin6_addr)))
1123 					goto out;
1124 				isipv6 = 1;
1125 			}
1126 			break;
1127 		}
1128 #endif /* INET6 */
1129 		default:
1130 			error = EAFNOSUPPORT;
1131 			goto out;
1132 		}
1133 	}
1134 	if (!(flags & PRUS_OOB)) {
1135 		sbappendstream(&so->so_snd, m, flags);
1136 		m = NULL;
1137 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1138 			KASSERT(tp->t_state == TCPS_CLOSED,
1139 			    ("%s: tp %p is listening", __func__, tp));
1140 
1141 			/*
1142 			 * Do implied connect if not yet connected,
1143 			 * initialize window to default value, and
1144 			 * initialize maxseg using peer's cached MSS.
1145 			 */
1146 #ifdef INET6
1147 			if (isipv6)
1148 				error = tcp6_connect(tp, nam, td);
1149 #endif /* INET6 */
1150 #if defined(INET6) && defined(INET)
1151 			else
1152 #endif
1153 #ifdef INET
1154 				error = tcp_connect(tp,
1155 				    (struct sockaddr *)sinp, td);
1156 #endif
1157 			/*
1158 			 * The bind operation in tcp_connect succeeded. We
1159 			 * no longer want to restore the flags if later
1160 			 * operations fail.
1161 			 */
1162 			if (error == 0 || inp->inp_lport != 0)
1163 				restoreflags = false;
1164 
1165 			if (error) {
1166 				/* m is freed if PRUS_NOTREADY is unset. */
1167 				sbflush(&so->so_snd);
1168 				goto out;
1169 			}
1170 			if (IS_FASTOPEN(tp->t_flags))
1171 				tcp_fastopen_connect(tp);
1172 			else {
1173 				tp->snd_wnd = TTCP_CLIENT_SND_WND;
1174 				tcp_mss(tp, -1);
1175 			}
1176 		}
1177 		if (flags & PRUS_EOF) {
1178 			/*
1179 			 * Close the send side of the connection after
1180 			 * the data is sent.
1181 			 */
1182 			socantsendmore(so);
1183 			tcp_usrclosed(tp);
1184 		}
1185 		if (TCPS_HAVEESTABLISHED(tp->t_state) &&
1186 		    ((tp->t_flags2 & TF2_FBYTES_COMPLETE) == 0) &&
1187 		    (tp->t_fbyte_out == 0) &&
1188 		    (so->so_snd.sb_ccc > 0)) {
1189 			tp->t_fbyte_out = ticks;
1190 			if (tp->t_fbyte_out == 0)
1191 				tp->t_fbyte_out = 1;
1192 			if (tp->t_fbyte_out && tp->t_fbyte_in)
1193 				tp->t_flags2 |= TF2_FBYTES_COMPLETE;
1194 		}
1195 		if (!(inp->inp_flags & INP_DROPPED) &&
1196 		    !(flags & PRUS_NOTREADY)) {
1197 			if (flags & PRUS_MORETOCOME)
1198 				tp->t_flags |= TF_MORETOCOME;
1199 			error = tcp_output_nodrop(tp);
1200 			if (flags & PRUS_MORETOCOME)
1201 				tp->t_flags &= ~TF_MORETOCOME;
1202 		}
1203 	} else {
1204 		/*
1205 		 * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
1206 		 */
1207 		SOCKBUF_LOCK(&so->so_snd);
1208 		if (sbspace(&so->so_snd) < -512) {
1209 			SOCKBUF_UNLOCK(&so->so_snd);
1210 			error = ENOBUFS;
1211 			goto out;
1212 		}
1213 		/*
1214 		 * According to RFC961 (Assigned Protocols),
1215 		 * the urgent pointer points to the last octet
1216 		 * of urgent data.  We continue, however,
1217 		 * to consider it to indicate the first octet
1218 		 * of data past the urgent section.
1219 		 * Otherwise, snd_up should be one lower.
1220 		 */
1221 		sbappendstream_locked(&so->so_snd, m, flags);
1222 		SOCKBUF_UNLOCK(&so->so_snd);
1223 		m = NULL;
1224 		if (nam && tp->t_state < TCPS_SYN_SENT) {
1225 			/*
1226 			 * Do implied connect if not yet connected,
1227 			 * initialize window to default value, and
1228 			 * initialize maxseg using peer's cached MSS.
1229 			 */
1230 
1231 			/*
1232 			 * Not going to contemplate SYN|URG
1233 			 */
1234 			if (IS_FASTOPEN(tp->t_flags))
1235 				tp->t_flags &= ~TF_FASTOPEN;
1236 #ifdef INET6
1237 			if (isipv6)
1238 				error = tcp6_connect(tp, nam, td);
1239 #endif /* INET6 */
1240 #if defined(INET6) && defined(INET)
1241 			else
1242 #endif
1243 #ifdef INET
1244 				error = tcp_connect(tp,
1245 				    (struct sockaddr *)sinp, td);
1246 #endif
1247 			/*
1248 			 * The bind operation in tcp_connect succeeded. We
1249 			 * no longer want to restore the flags if later
1250 			 * operations fail.
1251 			 */
1252 			if (error == 0 || inp->inp_lport != 0)
1253 				restoreflags = false;
1254 
1255 			if (error != 0) {
1256 				/* m is freed if PRUS_NOTREADY is unset. */
1257 				sbflush(&so->so_snd);
1258 				goto out;
1259 			}
1260 			tp->snd_wnd = TTCP_CLIENT_SND_WND;
1261 			tcp_mss(tp, -1);
1262 		}
1263 		tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
1264 		if ((flags & PRUS_NOTREADY) == 0) {
1265 			tp->t_flags |= TF_FORCEDATA;
1266 			error = tcp_output_nodrop(tp);
1267 			tp->t_flags &= ~TF_FORCEDATA;
1268 		}
1269 	}
1270 	TCP_LOG_EVENT(tp, NULL,
1271 	    &inp->inp_socket->so_rcv,
1272 	    &inp->inp_socket->so_snd,
1273 	    TCP_LOG_USERSEND, error,
1274 	    0, NULL, false);
1275 
1276 out:
1277 	/*
1278 	 * In case of PRUS_NOTREADY, the caller or tcp_usr_ready() is
1279 	 * responsible for freeing memory.
1280 	 */
1281 	if (m != NULL && (flags & PRUS_NOTREADY) == 0)
1282 		m_freem(m);
1283 
1284 	/*
1285 	 * If the request was unsuccessful and we changed flags,
1286 	 * restore the original flags.
1287 	 */
1288 	if (error != 0 && restoreflags) {
1289 		inp->inp_vflag = vflagsav;
1290 		inp->inp_inc.inc_flags = incflagsav;
1291 	}
1292 	TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :
1293 		  ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
1294 	TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
1295 		   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
1296 	error = tcp_unlock_or_drop(tp, error);
1297 	NET_EPOCH_EXIT(et);
1298 	return (error);
1299 }
1300 
1301 static int
1302 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1303 {
1304 	struct epoch_tracker et;
1305 	struct inpcb *inp;
1306 	struct tcpcb *tp;
1307 	int error;
1308 
1309 	inp = sotoinpcb(so);
1310 	INP_WLOCK(inp);
1311 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1312 		INP_WUNLOCK(inp);
1313 		mb_free_notready(m, count);
1314 		return (ECONNRESET);
1315 	}
1316 	tp = intotcpcb(inp);
1317 
1318 	SOCKBUF_LOCK(&so->so_snd);
1319 	error = sbready(&so->so_snd, m, count);
1320 	SOCKBUF_UNLOCK(&so->so_snd);
1321 	if (error) {
1322 		INP_WUNLOCK(inp);
1323 		return (error);
1324 	}
1325 	NET_EPOCH_ENTER(et);
1326 	error = tcp_output_unlock(tp);
1327 	NET_EPOCH_EXIT(et);
1328 
1329 	return (error);
1330 }
1331 
1332 /*
1333  * Abort the TCP.  Drop the connection abruptly.
1334  */
1335 static void
1336 tcp_usr_abort(struct socket *so)
1337 {
1338 	struct inpcb *inp;
1339 	struct tcpcb *tp = NULL;
1340 	struct epoch_tracker et;
1341 	TCPDEBUG0;
1342 
1343 	inp = sotoinpcb(so);
1344 	KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1345 
1346 	NET_EPOCH_ENTER(et);
1347 	INP_WLOCK(inp);
1348 	KASSERT(inp->inp_socket != NULL,
1349 	    ("tcp_usr_abort: inp_socket == NULL"));
1350 
1351 	/*
1352 	 * If we still have full TCP state, and we're not dropped, drop.
1353 	 */
1354 	if (!(inp->inp_flags & INP_TIMEWAIT) &&
1355 	    !(inp->inp_flags & INP_DROPPED)) {
1356 		tp = intotcpcb(inp);
1357 		TCPDEBUG1();
1358 		tp = tcp_drop(tp, ECONNABORTED);
1359 		if (tp == NULL)
1360 			goto dropped;
1361 		TCPDEBUG2(PRU_ABORT);
1362 		TCP_PROBE2(debug__user, tp, PRU_ABORT);
1363 	}
1364 	if (!(inp->inp_flags & INP_DROPPED)) {
1365 		soref(so);
1366 		inp->inp_flags |= INP_SOCKREF;
1367 	}
1368 	INP_WUNLOCK(inp);
1369 dropped:
1370 	NET_EPOCH_EXIT(et);
1371 }
1372 
1373 /*
1374  * TCP socket is closed.  Start friendly disconnect.
1375  */
1376 static void
1377 tcp_usr_close(struct socket *so)
1378 {
1379 	struct inpcb *inp;
1380 	struct tcpcb *tp = NULL;
1381 	struct epoch_tracker et;
1382 	TCPDEBUG0;
1383 
1384 	inp = sotoinpcb(so);
1385 	KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1386 
1387 	NET_EPOCH_ENTER(et);
1388 	INP_WLOCK(inp);
1389 	KASSERT(inp->inp_socket != NULL,
1390 	    ("tcp_usr_close: inp_socket == NULL"));
1391 
1392 	/*
1393 	 * If we still have full TCP state, and we're not dropped, initiate
1394 	 * a disconnect.
1395 	 */
1396 	if (!(inp->inp_flags & INP_TIMEWAIT) &&
1397 	    !(inp->inp_flags & INP_DROPPED)) {
1398 		tp = intotcpcb(inp);
1399 		tp->t_flags |= TF_CLOSED;
1400 		TCPDEBUG1();
1401 		tcp_disconnect(tp);
1402 		TCPDEBUG2(PRU_CLOSE);
1403 		TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1404 	}
1405 	if (!(inp->inp_flags & INP_DROPPED)) {
1406 		soref(so);
1407 		inp->inp_flags |= INP_SOCKREF;
1408 	}
1409 	INP_WUNLOCK(inp);
1410 	NET_EPOCH_EXIT(et);
1411 }
1412 
1413 static int
1414 tcp_pru_options_support(struct tcpcb *tp, int flags)
1415 {
1416 	/*
1417 	 * If the specific TCP stack has a pru_options
1418 	 * specified then it does not always support
1419 	 * all the PRU_XX options and we must ask it.
1420 	 * If the function is not specified then all
1421 	 * of the PRU_XX options are supported.
1422 	 */
1423 	int ret = 0;
1424 
1425 	if (tp->t_fb->tfb_pru_options) {
1426 		ret = (*tp->t_fb->tfb_pru_options)(tp, flags);
1427 	}
1428 	return (ret);
1429 }
1430 
1431 /*
1432  * Receive out-of-band data.
1433  */
1434 static int
1435 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1436 {
1437 	int error = 0;
1438 	struct inpcb *inp;
1439 	struct tcpcb *tp = NULL;
1440 
1441 	TCPDEBUG0;
1442 	inp = sotoinpcb(so);
1443 	KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1444 	INP_WLOCK(inp);
1445 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1446 		error = ECONNRESET;
1447 		goto out;
1448 	}
1449 	tp = intotcpcb(inp);
1450 	error = tcp_pru_options_support(tp, PRUS_OOB);
1451 	if (error) {
1452 		goto out;
1453 	}
1454 	TCPDEBUG1();
1455 	if ((so->so_oobmark == 0 &&
1456 	     (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1457 	    so->so_options & SO_OOBINLINE ||
1458 	    tp->t_oobflags & TCPOOB_HADDATA) {
1459 		error = EINVAL;
1460 		goto out;
1461 	}
1462 	if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1463 		error = EWOULDBLOCK;
1464 		goto out;
1465 	}
1466 	m->m_len = 1;
1467 	*mtod(m, caddr_t) = tp->t_iobc;
1468 	if ((flags & MSG_PEEK) == 0)
1469 		tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1470 
1471 out:
1472 	TCPDEBUG2(PRU_RCVOOB);
1473 	TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1474 	INP_WUNLOCK(inp);
1475 	return (error);
1476 }
1477 
1478 #ifdef INET
1479 struct pr_usrreqs tcp_usrreqs = {
1480 	.pru_abort =		tcp_usr_abort,
1481 	.pru_accept =		tcp_usr_accept,
1482 	.pru_attach =		tcp_usr_attach,
1483 	.pru_bind =		tcp_usr_bind,
1484 	.pru_connect =		tcp_usr_connect,
1485 	.pru_control =		in_control,
1486 	.pru_detach =		tcp_usr_detach,
1487 	.pru_disconnect =	tcp_usr_disconnect,
1488 	.pru_listen =		tcp_usr_listen,
1489 	.pru_peeraddr =		in_getpeeraddr,
1490 	.pru_rcvd =		tcp_usr_rcvd,
1491 	.pru_rcvoob =		tcp_usr_rcvoob,
1492 	.pru_send =		tcp_usr_send,
1493 	.pru_ready =		tcp_usr_ready,
1494 	.pru_shutdown =		tcp_usr_shutdown,
1495 	.pru_sockaddr =		in_getsockaddr,
1496 	.pru_sosetlabel =	in_pcbsosetlabel,
1497 	.pru_close =		tcp_usr_close,
1498 };
1499 #endif /* INET */
1500 
1501 #ifdef INET6
1502 struct pr_usrreqs tcp6_usrreqs = {
1503 	.pru_abort =		tcp_usr_abort,
1504 	.pru_accept =		tcp6_usr_accept,
1505 	.pru_attach =		tcp_usr_attach,
1506 	.pru_bind =		tcp6_usr_bind,
1507 	.pru_connect =		tcp6_usr_connect,
1508 	.pru_control =		in6_control,
1509 	.pru_detach =		tcp_usr_detach,
1510 	.pru_disconnect =	tcp_usr_disconnect,
1511 	.pru_listen =		tcp6_usr_listen,
1512 	.pru_peeraddr =		in6_mapped_peeraddr,
1513 	.pru_rcvd =		tcp_usr_rcvd,
1514 	.pru_rcvoob =		tcp_usr_rcvoob,
1515 	.pru_send =		tcp_usr_send,
1516 	.pru_ready =		tcp_usr_ready,
1517 	.pru_shutdown =		tcp_usr_shutdown,
1518 	.pru_sockaddr =		in6_mapped_sockaddr,
1519 	.pru_sosetlabel =	in_pcbsosetlabel,
1520 	.pru_close =		tcp_usr_close,
1521 };
1522 #endif /* INET6 */
1523 
1524 #ifdef INET
1525 /*
1526  * Common subroutine to open a TCP connection to remote host specified
1527  * by struct sockaddr_in in mbuf *nam.  Call in_pcbbind to assign a local
1528  * port number if needed.  Call in_pcbconnect_setup to do the routing and
1529  * to choose a local host address (interface).  If there is an existing
1530  * incarnation of the same connection in TIME-WAIT state and if the remote
1531  * host was sending CC options and if the connection duration was < MSL, then
1532  * truncate the previous TIME-WAIT state and proceed.
1533  * Initialize connection parameters and enter SYN-SENT state.
1534  */
1535 static int
1536 tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1537 {
1538 	struct inpcb *inp = tp->t_inpcb, *oinp;
1539 	struct socket *so = inp->inp_socket;
1540 	struct in_addr laddr;
1541 	u_short lport;
1542 	int error;
1543 
1544 	NET_EPOCH_ASSERT();
1545 	INP_WLOCK_ASSERT(inp);
1546 	INP_HASH_WLOCK(&V_tcbinfo);
1547 
1548 	if (V_tcp_require_unique_port && inp->inp_lport == 0) {
1549 		error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1550 		if (error)
1551 			goto out;
1552 	}
1553 
1554 	/*
1555 	 * Cannot simply call in_pcbconnect, because there might be an
1556 	 * earlier incarnation of this same connection still in
1557 	 * TIME_WAIT state, creating an ADDRINUSE error.
1558 	 */
1559 	laddr = inp->inp_laddr;
1560 	lport = inp->inp_lport;
1561 	error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,
1562 	    &inp->inp_faddr.s_addr, &inp->inp_fport, &oinp, td->td_ucred);
1563 	if (error && oinp == NULL)
1564 		goto out;
1565 	if (oinp) {
1566 		error = EADDRINUSE;
1567 		goto out;
1568 	}
1569 	/* Handle initial bind if it hadn't been done in advance. */
1570 	if (inp->inp_lport == 0) {
1571 		inp->inp_lport = lport;
1572 		if (in_pcbinshash(inp) != 0) {
1573 			inp->inp_lport = 0;
1574 			error = EAGAIN;
1575 			goto out;
1576 		}
1577 	}
1578 	inp->inp_laddr = laddr;
1579 	in_pcbrehash(inp);
1580 	INP_HASH_WUNLOCK(&V_tcbinfo);
1581 
1582 	/*
1583 	 * Compute window scaling to request:
1584 	 * Scale to fit into sweet spot.  See tcp_syncache.c.
1585 	 * XXX: This should move to tcp_output().
1586 	 */
1587 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1588 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1589 		tp->request_r_scale++;
1590 
1591 	soisconnecting(so);
1592 	TCPSTAT_INC(tcps_connattempt);
1593 	tcp_state_change(tp, TCPS_SYN_SENT);
1594 	tp->iss = tcp_new_isn(&inp->inp_inc);
1595 	if (tp->t_flags & TF_REQ_TSTMP)
1596 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1597 	tcp_sendseqinit(tp);
1598 
1599 	return 0;
1600 
1601 out:
1602 	INP_HASH_WUNLOCK(&V_tcbinfo);
1603 	return (error);
1604 }
1605 #endif /* INET */
1606 
1607 #ifdef INET6
1608 static int
1609 tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1610 {
1611 	struct inpcb *inp = tp->t_inpcb;
1612 	int error;
1613 
1614 	INP_WLOCK_ASSERT(inp);
1615 	INP_HASH_WLOCK(&V_tcbinfo);
1616 
1617 	if (V_tcp_require_unique_port && inp->inp_lport == 0) {
1618 		error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1619 		if (error)
1620 			goto out;
1621 	}
1622 	error = in6_pcbconnect(inp, nam, td->td_ucred);
1623 	if (error != 0)
1624 		goto out;
1625 	INP_HASH_WUNLOCK(&V_tcbinfo);
1626 
1627 	/* Compute window scaling to request.  */
1628 	while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1629 	    (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1630 		tp->request_r_scale++;
1631 
1632 	soisconnecting(inp->inp_socket);
1633 	TCPSTAT_INC(tcps_connattempt);
1634 	tcp_state_change(tp, TCPS_SYN_SENT);
1635 	tp->iss = tcp_new_isn(&inp->inp_inc);
1636 	if (tp->t_flags & TF_REQ_TSTMP)
1637 		tp->ts_offset = tcp_new_ts_offset(&inp->inp_inc);
1638 	tcp_sendseqinit(tp);
1639 
1640 	return 0;
1641 
1642 out:
1643 	INP_HASH_WUNLOCK(&V_tcbinfo);
1644 	return error;
1645 }
1646 #endif /* INET6 */
1647 
1648 /*
1649  * Export TCP internal state information via a struct tcp_info, based on the
1650  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1651  * (TCP state machine, etc).  We export all information using FreeBSD-native
1652  * constants -- for example, the numeric values for tcpi_state will differ
1653  * from Linux.
1654  */
1655 static void
1656 tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)
1657 {
1658 
1659 	INP_WLOCK_ASSERT(tp->t_inpcb);
1660 	bzero(ti, sizeof(*ti));
1661 
1662 	ti->tcpi_state = tp->t_state;
1663 	if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1664 		ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1665 	if (tp->t_flags & TF_SACK_PERMIT)
1666 		ti->tcpi_options |= TCPI_OPT_SACK;
1667 	if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1668 		ti->tcpi_options |= TCPI_OPT_WSCALE;
1669 		ti->tcpi_snd_wscale = tp->snd_scale;
1670 		ti->tcpi_rcv_wscale = tp->rcv_scale;
1671 	}
1672 	if (tp->t_flags2 & (TF2_ECN_PERMIT | TF2_ACE_PERMIT))
1673 		ti->tcpi_options |= TCPI_OPT_ECN;
1674 
1675 	ti->tcpi_rto = tp->t_rxtcur * tick;
1676 	ti->tcpi_last_data_recv = ((uint32_t)ticks - tp->t_rcvtime) * tick;
1677 	ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1678 	ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1679 
1680 	ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1681 	ti->tcpi_snd_cwnd = tp->snd_cwnd;
1682 
1683 	/*
1684 	 * FreeBSD-specific extension fields for tcp_info.
1685 	 */
1686 	ti->tcpi_rcv_space = tp->rcv_wnd;
1687 	ti->tcpi_rcv_nxt = tp->rcv_nxt;
1688 	ti->tcpi_snd_wnd = tp->snd_wnd;
1689 	ti->tcpi_snd_bwnd = 0;		/* Unused, kept for compat. */
1690 	ti->tcpi_snd_nxt = tp->snd_nxt;
1691 	ti->tcpi_snd_mss = tp->t_maxseg;
1692 	ti->tcpi_rcv_mss = tp->t_maxseg;
1693 	ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1694 	ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1695 	ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1696 #ifdef TCP_OFFLOAD
1697 	if (tp->t_flags & TF_TOE) {
1698 		ti->tcpi_options |= TCPI_OPT_TOE;
1699 		tcp_offload_tcp_info(tp, ti);
1700 	}
1701 #endif
1702 }
1703 
1704 /*
1705  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1706  * socket option arguments.  When it re-acquires the lock after the copy, it
1707  * has to revalidate that the connection is still valid for the socket
1708  * option.
1709  */
1710 #define INP_WLOCK_RECHECK_CLEANUP(inp, cleanup) do {			\
1711 	INP_WLOCK(inp);							\
1712 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {		\
1713 		INP_WUNLOCK(inp);					\
1714 		cleanup;						\
1715 		return (ECONNRESET);					\
1716 	}								\
1717 	tp = intotcpcb(inp);						\
1718 } while(0)
1719 #define INP_WLOCK_RECHECK(inp) INP_WLOCK_RECHECK_CLEANUP((inp), /* noop */)
1720 
1721 int
1722 tcp_ctloutput_set(struct inpcb *inp, struct sockopt *sopt)
1723 {
1724 	struct socket *so = inp->inp_socket;
1725 	struct tcpcb *tp = intotcpcb(inp);
1726 	int error = 0;
1727 
1728 	MPASS(sopt->sopt_dir == SOPT_SET);
1729 	INP_WLOCK_ASSERT(inp);
1730 	KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0,
1731 	    ("inp_flags == %x", inp->inp_flags));
1732 	KASSERT(so != NULL, ("inp_socket == NULL"));
1733 
1734 	if (sopt->sopt_level != IPPROTO_TCP) {
1735 		INP_WUNLOCK(inp);
1736 #ifdef INET6
1737 		if (inp->inp_vflag & INP_IPV6PROTO)
1738 			error = ip6_ctloutput(so, sopt);
1739 #endif
1740 #if defined(INET6) && defined(INET)
1741 		else
1742 #endif
1743 #ifdef INET
1744 			error = ip_ctloutput(so, sopt);
1745 #endif
1746 		/*
1747 		 * When an IP-level socket option affects TCP, pass control
1748 		 * down to stack tfb_tcp_ctloutput, otherwise return what
1749 		 * IP level returned.
1750 		 */
1751 		switch (sopt->sopt_level) {
1752 #ifdef INET6
1753 		case IPPROTO_IPV6:
1754 			if ((inp->inp_vflag & INP_IPV6PROTO) == 0)
1755 				return (error);
1756 			switch (sopt->sopt_name) {
1757 			case IPV6_TCLASS:
1758 				/* Notify tcp stacks that care (e.g. RACK). */
1759 				break;
1760 			case IPV6_USE_MIN_MTU:
1761 				/* Update t_maxseg accordingly. */
1762 				break;
1763 			default:
1764 				return (error);
1765 			}
1766 			break;
1767 #endif
1768 #ifdef INET
1769 		case IPPROTO_IP:
1770 			switch (sopt->sopt_name) {
1771 			case IP_TOS:
1772 				inp->inp_ip_tos &= ~IPTOS_ECN_MASK;
1773 				break;
1774 			case IP_TTL:
1775 				/* Notify tcp stacks that care (e.g. RACK). */
1776 				break;
1777 			default:
1778 				return (error);
1779 			}
1780 			break;
1781 #endif
1782 		default:
1783 			return (error);
1784 		}
1785 		INP_WLOCK(inp);
1786 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1787 			INP_WUNLOCK(inp);
1788 			return (ECONNRESET);
1789 		}
1790 	} else if (sopt->sopt_name == TCP_FUNCTION_BLK) {
1791 		/*
1792 		 * Protect the TCP option TCP_FUNCTION_BLK so
1793 		 * that a sub-function can *never* overwrite this.
1794 		 */
1795 		struct tcp_function_set fsn;
1796 		struct tcp_function_block *blk;
1797 
1798 		INP_WUNLOCK(inp);
1799 		error = sooptcopyin(sopt, &fsn, sizeof fsn, sizeof fsn);
1800 		if (error)
1801 			return (error);
1802 
1803 		INP_WLOCK(inp);
1804 		if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1805 			INP_WUNLOCK(inp);
1806 			return (ECONNRESET);
1807 		}
1808 		tp = intotcpcb(inp);
1809 
1810 		blk = find_and_ref_tcp_functions(&fsn);
1811 		if (blk == NULL) {
1812 			INP_WUNLOCK(inp);
1813 			return (ENOENT);
1814 		}
1815 		if (tp->t_fb == blk) {
1816 			/* You already have this */
1817 			refcount_release(&blk->tfb_refcnt);
1818 			INP_WUNLOCK(inp);
1819 			return (0);
1820 		}
1821 		if (tp->t_state != TCPS_CLOSED) {
1822 			/*
1823 			 * The user has advanced the state
1824 			 * past the initial point, we may not
1825 			 * be able to switch.
1826 			 */
1827 			if (blk->tfb_tcp_handoff_ok != NULL) {
1828 				/*
1829 				 * Does the stack provide a
1830 				 * query mechanism, if so it may
1831 				 * still be possible?
1832 				 */
1833 				error = (*blk->tfb_tcp_handoff_ok)(tp);
1834 			} else
1835 				error = EINVAL;
1836 			if (error) {
1837 				refcount_release(&blk->tfb_refcnt);
1838 				INP_WUNLOCK(inp);
1839 				return(error);
1840 			}
1841 		}
1842 		if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1843 			refcount_release(&blk->tfb_refcnt);
1844 			INP_WUNLOCK(inp);
1845 			return (ENOENT);
1846 		}
1847 		/*
1848 		 * Release the old refcnt, the
1849 		 * lookup acquired a ref on the
1850 		 * new one already.
1851 		 */
1852 		if (tp->t_fb->tfb_tcp_fb_fini) {
1853 			struct epoch_tracker et;
1854 			/*
1855 			 * Tell the stack to cleanup with 0 i.e.
1856 			 * the tcb is not going away.
1857 			 */
1858 			NET_EPOCH_ENTER(et);
1859 			(*tp->t_fb->tfb_tcp_fb_fini)(tp, 0);
1860 			NET_EPOCH_EXIT(et);
1861 		}
1862 #ifdef TCPHPTS
1863 		/* Assure that we are not on any hpts */
1864 		tcp_hpts_remove(tp->t_inpcb);
1865 #endif
1866 		if (blk->tfb_tcp_fb_init) {
1867 			error = (*blk->tfb_tcp_fb_init)(tp);
1868 			if (error) {
1869 				refcount_release(&blk->tfb_refcnt);
1870 				if (tp->t_fb->tfb_tcp_fb_init) {
1871 					if((*tp->t_fb->tfb_tcp_fb_init)(tp) != 0)  {
1872 						/* Fall back failed, drop the connection */
1873 						INP_WUNLOCK(inp);
1874 						soabort(so);
1875 						return (error);
1876 					}
1877 				}
1878 				goto err_out;
1879 			}
1880 		}
1881 		refcount_release(&tp->t_fb->tfb_refcnt);
1882 		tp->t_fb = blk;
1883 #ifdef TCP_OFFLOAD
1884 		if (tp->t_flags & TF_TOE) {
1885 			tcp_offload_ctloutput(tp, sopt->sopt_dir,
1886 			     sopt->sopt_name);
1887 		}
1888 #endif
1889 err_out:
1890 		INP_WUNLOCK(inp);
1891 		return (error);
1892 	}
1893 
1894 	/* Pass in the INP locked, callee must unlock it. */
1895 	return (tp->t_fb->tfb_tcp_ctloutput(inp, sopt));
1896 }
1897 
1898 static int
1899 tcp_ctloutput_get(struct inpcb *inp, struct sockopt *sopt)
1900 {
1901 	struct socket *so = inp->inp_socket;
1902 	struct tcpcb *tp = intotcpcb(inp);
1903 	int error = 0;
1904 
1905 	MPASS(sopt->sopt_dir == SOPT_GET);
1906 	INP_WLOCK_ASSERT(inp);
1907 	KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0,
1908 	    ("inp_flags == %x", inp->inp_flags));
1909 	KASSERT(so != NULL, ("inp_socket == NULL"));
1910 
1911 	if (sopt->sopt_level != IPPROTO_TCP) {
1912 		INP_WUNLOCK(inp);
1913 #ifdef INET6
1914 		if (inp->inp_vflag & INP_IPV6PROTO)
1915 			error = ip6_ctloutput(so, sopt);
1916 #endif /* INET6 */
1917 #if defined(INET6) && defined(INET)
1918 		else
1919 #endif
1920 #ifdef INET
1921 			error = ip_ctloutput(so, sopt);
1922 #endif
1923 		return (error);
1924 	}
1925 	if (((sopt->sopt_name == TCP_FUNCTION_BLK) ||
1926 	     (sopt->sopt_name == TCP_FUNCTION_ALIAS))) {
1927 		struct tcp_function_set fsn;
1928 
1929 		if (sopt->sopt_name == TCP_FUNCTION_ALIAS) {
1930 			memset(&fsn, 0, sizeof(fsn));
1931 			find_tcp_function_alias(tp->t_fb, &fsn);
1932 		} else {
1933 			strncpy(fsn.function_set_name,
1934 			    tp->t_fb->tfb_tcp_block_name,
1935 			    TCP_FUNCTION_NAME_LEN_MAX);
1936 			fsn.function_set_name[TCP_FUNCTION_NAME_LEN_MAX - 1] = '\0';
1937 		}
1938 		fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1939 		INP_WUNLOCK(inp);
1940 		error = sooptcopyout(sopt, &fsn, sizeof fsn);
1941 		return (error);
1942 	}
1943 
1944 	/* Pass in the INP locked, callee must unlock it. */
1945 	return (tp->t_fb->tfb_tcp_ctloutput(inp, sopt));
1946 }
1947 
1948 int
1949 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1950 {
1951 	struct	inpcb *inp;
1952 
1953 	inp = sotoinpcb(so);
1954 	KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1955 
1956 	INP_WLOCK(inp);
1957 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1958 		INP_WUNLOCK(inp);
1959 		return (ECONNRESET);
1960 	}
1961 	if (sopt->sopt_dir == SOPT_SET)
1962 		return (tcp_ctloutput_set(inp, sopt));
1963 	else if (sopt->sopt_dir == SOPT_GET)
1964 		return (tcp_ctloutput_get(inp, sopt));
1965 	else
1966 		panic("%s: sopt_dir $%d", __func__, sopt->sopt_dir);
1967 }
1968 
1969 /*
1970  * If this assert becomes untrue, we need to change the size of the buf
1971  * variable in tcp_default_ctloutput().
1972  */
1973 #ifdef CTASSERT
1974 CTASSERT(TCP_CA_NAME_MAX <= TCP_LOG_ID_LEN);
1975 CTASSERT(TCP_LOG_REASON_LEN <= TCP_LOG_ID_LEN);
1976 #endif
1977 
1978 #ifdef KERN_TLS
1979 static int
1980 copyin_tls_enable(struct sockopt *sopt, struct tls_enable *tls)
1981 {
1982 	struct tls_enable_v0 tls_v0;
1983 	int error;
1984 
1985 	if (sopt->sopt_valsize == sizeof(tls_v0)) {
1986 		error = sooptcopyin(sopt, &tls_v0, sizeof(tls_v0),
1987 		    sizeof(tls_v0));
1988 		if (error)
1989 			return (error);
1990 		memset(tls, 0, sizeof(*tls));
1991 		tls->cipher_key = tls_v0.cipher_key;
1992 		tls->iv = tls_v0.iv;
1993 		tls->auth_key = tls_v0.auth_key;
1994 		tls->cipher_algorithm = tls_v0.cipher_algorithm;
1995 		tls->cipher_key_len = tls_v0.cipher_key_len;
1996 		tls->iv_len = tls_v0.iv_len;
1997 		tls->auth_algorithm = tls_v0.auth_algorithm;
1998 		tls->auth_key_len = tls_v0.auth_key_len;
1999 		tls->flags = tls_v0.flags;
2000 		tls->tls_vmajor = tls_v0.tls_vmajor;
2001 		tls->tls_vminor = tls_v0.tls_vminor;
2002 		return (0);
2003 	}
2004 
2005 	return (sooptcopyin(sopt, tls, sizeof(*tls), sizeof(*tls)));
2006 }
2007 #endif
2008 
2009 extern struct cc_algo newreno_cc_algo;
2010 
2011 static int
2012 tcp_set_cc_mod(struct inpcb *inp, struct sockopt *sopt)
2013 {
2014 	struct cc_algo *algo;
2015 	void *ptr = NULL;
2016 	struct tcpcb *tp;
2017 	struct cc_var cc_mem;
2018 	char	buf[TCP_CA_NAME_MAX];
2019 	size_t mem_sz;
2020 	int error;
2021 
2022 	INP_WUNLOCK(inp);
2023 	error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX - 1, 1);
2024 	if (error)
2025 		return(error);
2026 	buf[sopt->sopt_valsize] = '\0';
2027 	CC_LIST_RLOCK();
2028 	STAILQ_FOREACH(algo, &cc_list, entries) {
2029 		if (strncmp(buf, algo->name,
2030 			    TCP_CA_NAME_MAX) == 0) {
2031 			if (algo->flags & CC_MODULE_BEING_REMOVED) {
2032 				/* We can't "see" modules being unloaded */
2033 				continue;
2034 			}
2035 			break;
2036 		}
2037 	}
2038 	if (algo == NULL) {
2039 		CC_LIST_RUNLOCK();
2040 		return(ESRCH);
2041 	}
2042 	/*
2043 	 * With a reference the algorithm cannot be removed
2044 	 * so we hold a reference through the change process.
2045 	 */
2046 	cc_refer(algo);
2047 	CC_LIST_RUNLOCK();
2048 	if (algo->cb_init != NULL) {
2049 		/* We can now pre-get the memory for the CC */
2050 		mem_sz = (*algo->cc_data_sz)();
2051 		if (mem_sz == 0) {
2052 			goto no_mem_needed;
2053 		}
2054 		ptr = malloc(mem_sz, M_CC_MEM, M_WAITOK);
2055 	} else {
2056 no_mem_needed:
2057 		mem_sz = 0;
2058 		ptr = NULL;
2059 	}
2060 	/*
2061 	 * Make sure its all clean and zero and also get
2062 	 * back the inplock.
2063 	 */
2064 	memset(&cc_mem, 0, sizeof(cc_mem));
2065 	INP_WLOCK(inp);
2066 	if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
2067 		INP_WUNLOCK(inp);
2068 		if (ptr)
2069 			free(ptr, M_CC_MEM);
2070 		/* Release our temp reference */
2071 		CC_LIST_RLOCK();
2072 		cc_release(algo);
2073 		CC_LIST_RUNLOCK();
2074 		return (ECONNRESET);
2075 	}
2076 	tp = intotcpcb(inp);
2077 	if (ptr != NULL)
2078 		memset(ptr, 0, mem_sz);
2079 	cc_mem.ccvc.tcp = tp;
2080 	/*
2081 	 * We once again hold a write lock over the tcb so it's
2082 	 * safe to do these things without ordering concerns.
2083 	 * Note here we init into stack memory.
2084 	 */
2085 	if (algo->cb_init != NULL)
2086 		error = algo->cb_init(&cc_mem, ptr);
2087 	else
2088 		error = 0;
2089 	/*
2090 	 * The CC algorithms, when given their memory
2091 	 * should not fail we could in theory have a
2092 	 * KASSERT here.
2093 	 */
2094 	if (error == 0) {
2095 		/*
2096 		 * Touchdown, lets go ahead and move the
2097 		 * connection to the new CC module by
2098 		 * copying in the cc_mem after we call
2099 		 * the old ones cleanup (if any).
2100 		 */
2101 		if (CC_ALGO(tp)->cb_destroy != NULL)
2102 			CC_ALGO(tp)->cb_destroy(tp->ccv);
2103 		/* Detach the old CC from the tcpcb  */
2104 		cc_detach(tp);
2105 		/* Copy in our temp memory that was inited */
2106 		memcpy(tp->ccv, &cc_mem, sizeof(struct cc_var));
2107 		/* Now attach the new, which takes a reference */
2108 		cc_attach(tp, algo);
2109 		/* Ok now are we where we have gotten past any conn_init? */
2110 		if (TCPS_HAVEESTABLISHED(tp->t_state) && (CC_ALGO(tp)->conn_init != NULL)) {
2111 			/* Yep run the connection init for the new CC */
2112 			CC_ALGO(tp)->conn_init(tp->ccv);
2113 		}
2114 	} else if (ptr)
2115 		free(ptr, M_CC_MEM);
2116 	INP_WUNLOCK(inp);
2117 	/* Now lets release our temp reference */
2118 	CC_LIST_RLOCK();
2119 	cc_release(algo);
2120 	CC_LIST_RUNLOCK();
2121 	return (error);
2122 }
2123 
2124 int
2125 tcp_default_ctloutput(struct inpcb *inp, struct sockopt *sopt)
2126 {
2127 	struct tcpcb *tp = intotcpcb(inp);
2128 	int	error, opt, optval;
2129 	u_int	ui;
2130 	struct	tcp_info ti;
2131 #ifdef KERN_TLS
2132 	struct tls_enable tls;
2133 	struct socket *so = inp->inp_socket;
2134 #endif
2135 	char	*pbuf, buf[TCP_LOG_ID_LEN];
2136 #ifdef STATS
2137 	struct statsblob *sbp;
2138 #endif
2139 	size_t	len;
2140 
2141 	INP_WLOCK_ASSERT(inp);
2142 	KASSERT((inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) == 0,
2143 	    ("inp_flags == %x", inp->inp_flags));
2144 	KASSERT(inp->inp_socket != NULL, ("inp_socket == NULL"));
2145 
2146 	switch (sopt->sopt_level) {
2147 #ifdef INET6
2148 	case IPPROTO_IPV6:
2149 		MPASS(inp->inp_vflag & INP_IPV6PROTO);
2150 		switch (sopt->sopt_name) {
2151 		case IPV6_USE_MIN_MTU:
2152 			tcp6_use_min_mtu(tp);
2153 			/* FALLTHROUGH */
2154 		}
2155 		INP_WUNLOCK(inp);
2156 		return (0);
2157 #endif
2158 #ifdef INET
2159 	case IPPROTO_IP:
2160 		INP_WUNLOCK(inp);
2161 		return (0);
2162 #endif
2163 	}
2164 
2165 	/*
2166 	 * For TCP_CCALGOOPT forward the control to CC module, for both
2167 	 * SOPT_SET and SOPT_GET.
2168 	 */
2169 	switch (sopt->sopt_name) {
2170 	case TCP_CCALGOOPT:
2171 		INP_WUNLOCK(inp);
2172 		if (sopt->sopt_valsize > CC_ALGOOPT_LIMIT)
2173 			return (EINVAL);
2174 		pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
2175 		error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
2176 		    sopt->sopt_valsize);
2177 		if (error) {
2178 			free(pbuf, M_TEMP);
2179 			return (error);
2180 		}
2181 		INP_WLOCK_RECHECK_CLEANUP(inp, free(pbuf, M_TEMP));
2182 		if (CC_ALGO(tp)->ctl_output != NULL)
2183 			error = CC_ALGO(tp)->ctl_output(tp->ccv, sopt, pbuf);
2184 		else
2185 			error = ENOENT;
2186 		INP_WUNLOCK(inp);
2187 		if (error == 0 && sopt->sopt_dir == SOPT_GET)
2188 			error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);
2189 		free(pbuf, M_TEMP);
2190 		return (error);
2191 	}
2192 
2193 	switch (sopt->sopt_dir) {
2194 	case SOPT_SET:
2195 		switch (sopt->sopt_name) {
2196 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2197 		case TCP_MD5SIG:
2198 			INP_WUNLOCK(inp);
2199 			if (!TCPMD5_ENABLED())
2200 				return (ENOPROTOOPT);
2201 			error = TCPMD5_PCBCTL(inp, sopt);
2202 			if (error)
2203 				return (error);
2204 			INP_WLOCK_RECHECK(inp);
2205 			goto unlock_and_done;
2206 #endif /* IPSEC */
2207 
2208 		case TCP_NODELAY:
2209 		case TCP_NOOPT:
2210 		case TCP_LRD:
2211 			INP_WUNLOCK(inp);
2212 			error = sooptcopyin(sopt, &optval, sizeof optval,
2213 			    sizeof optval);
2214 			if (error)
2215 				return (error);
2216 
2217 			INP_WLOCK_RECHECK(inp);
2218 			switch (sopt->sopt_name) {
2219 			case TCP_NODELAY:
2220 				opt = TF_NODELAY;
2221 				break;
2222 			case TCP_NOOPT:
2223 				opt = TF_NOOPT;
2224 				break;
2225 			case TCP_LRD:
2226 				opt = TF_LRD;
2227 				break;
2228 			default:
2229 				opt = 0; /* dead code to fool gcc */
2230 				break;
2231 			}
2232 
2233 			if (optval)
2234 				tp->t_flags |= opt;
2235 			else
2236 				tp->t_flags &= ~opt;
2237 unlock_and_done:
2238 #ifdef TCP_OFFLOAD
2239 			if (tp->t_flags & TF_TOE) {
2240 				tcp_offload_ctloutput(tp, sopt->sopt_dir,
2241 				    sopt->sopt_name);
2242 			}
2243 #endif
2244 			INP_WUNLOCK(inp);
2245 			break;
2246 
2247 		case TCP_NOPUSH:
2248 			INP_WUNLOCK(inp);
2249 			error = sooptcopyin(sopt, &optval, sizeof optval,
2250 			    sizeof optval);
2251 			if (error)
2252 				return (error);
2253 
2254 			INP_WLOCK_RECHECK(inp);
2255 			if (optval)
2256 				tp->t_flags |= TF_NOPUSH;
2257 			else if (tp->t_flags & TF_NOPUSH) {
2258 				tp->t_flags &= ~TF_NOPUSH;
2259 				if (TCPS_HAVEESTABLISHED(tp->t_state)) {
2260 					struct epoch_tracker et;
2261 
2262 					NET_EPOCH_ENTER(et);
2263 					error = tcp_output_nodrop(tp);
2264 					NET_EPOCH_EXIT(et);
2265 				}
2266 			}
2267 			goto unlock_and_done;
2268 
2269 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2270 			INP_WUNLOCK(inp);
2271 			error = sooptcopyin(sopt, &optval, sizeof optval,
2272 			    sizeof optval);
2273 			if (error)
2274 				return (error);
2275 			if ((optval < TCP_TUNNELING_PORT_MIN) ||
2276 			    (optval > TCP_TUNNELING_PORT_MAX)) {
2277 				/* Its got to be in range */
2278 				return (EINVAL);
2279 			}
2280 			if ((V_tcp_udp_tunneling_port == 0) && (optval != 0)) {
2281 				/* You have to have enabled a UDP tunneling port first */
2282 				return (EINVAL);
2283 			}
2284 			INP_WLOCK_RECHECK(inp);
2285 			if (tp->t_state != TCPS_CLOSED) {
2286 				/* You can't change after you are connected */
2287 				error = EINVAL;
2288 			} else {
2289 				/* Ok we are all good set the port */
2290 				tp->t_port = htons(optval);
2291 			}
2292 			goto unlock_and_done;
2293 
2294 		case TCP_MAXSEG:
2295 			INP_WUNLOCK(inp);
2296 			error = sooptcopyin(sopt, &optval, sizeof optval,
2297 			    sizeof optval);
2298 			if (error)
2299 				return (error);
2300 
2301 			INP_WLOCK_RECHECK(inp);
2302 			if (optval > 0 && optval <= tp->t_maxseg &&
2303 			    optval + 40 >= V_tcp_minmss)
2304 				tp->t_maxseg = optval;
2305 			else
2306 				error = EINVAL;
2307 			goto unlock_and_done;
2308 
2309 		case TCP_INFO:
2310 			INP_WUNLOCK(inp);
2311 			error = EINVAL;
2312 			break;
2313 
2314 		case TCP_STATS:
2315 			INP_WUNLOCK(inp);
2316 #ifdef STATS
2317 			error = sooptcopyin(sopt, &optval, sizeof optval,
2318 			    sizeof optval);
2319 			if (error)
2320 				return (error);
2321 
2322 			if (optval > 0)
2323 				sbp = stats_blob_alloc(
2324 				    V_tcp_perconn_stats_dflt_tpl, 0);
2325 			else
2326 				sbp = NULL;
2327 
2328 			INP_WLOCK_RECHECK(inp);
2329 			if ((tp->t_stats != NULL && sbp == NULL) ||
2330 			    (tp->t_stats == NULL && sbp != NULL)) {
2331 				struct statsblob *t = tp->t_stats;
2332 				tp->t_stats = sbp;
2333 				sbp = t;
2334 			}
2335 			INP_WUNLOCK(inp);
2336 
2337 			stats_blob_destroy(sbp);
2338 #else
2339 			return (EOPNOTSUPP);
2340 #endif /* !STATS */
2341 			break;
2342 
2343 		case TCP_CONGESTION:
2344 			error = tcp_set_cc_mod(inp, sopt);
2345 			break;
2346 
2347 		case TCP_REUSPORT_LB_NUMA:
2348 			INP_WUNLOCK(inp);
2349 			error = sooptcopyin(sopt, &optval, sizeof(optval),
2350 			    sizeof(optval));
2351 			INP_WLOCK_RECHECK(inp);
2352 			if (!error)
2353 				error = in_pcblbgroup_numa(inp, optval);
2354 			INP_WUNLOCK(inp);
2355 			break;
2356 
2357 #ifdef KERN_TLS
2358 		case TCP_TXTLS_ENABLE:
2359 			INP_WUNLOCK(inp);
2360 			error = copyin_tls_enable(sopt, &tls);
2361 			if (error)
2362 				break;
2363 			error = ktls_enable_tx(so, &tls);
2364 			break;
2365 		case TCP_TXTLS_MODE:
2366 			INP_WUNLOCK(inp);
2367 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2368 			if (error)
2369 				return (error);
2370 
2371 			INP_WLOCK_RECHECK(inp);
2372 			error = ktls_set_tx_mode(so, ui);
2373 			INP_WUNLOCK(inp);
2374 			break;
2375 		case TCP_RXTLS_ENABLE:
2376 			INP_WUNLOCK(inp);
2377 			error = sooptcopyin(sopt, &tls, sizeof(tls),
2378 			    sizeof(tls));
2379 			if (error)
2380 				break;
2381 			error = ktls_enable_rx(so, &tls);
2382 			break;
2383 #endif
2384 
2385 		case TCP_KEEPIDLE:
2386 		case TCP_KEEPINTVL:
2387 		case TCP_KEEPINIT:
2388 			INP_WUNLOCK(inp);
2389 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2390 			if (error)
2391 				return (error);
2392 
2393 			if (ui > (UINT_MAX / hz)) {
2394 				error = EINVAL;
2395 				break;
2396 			}
2397 			ui *= hz;
2398 
2399 			INP_WLOCK_RECHECK(inp);
2400 			switch (sopt->sopt_name) {
2401 			case TCP_KEEPIDLE:
2402 				tp->t_keepidle = ui;
2403 				/*
2404 				 * XXX: better check current remaining
2405 				 * timeout and "merge" it with new value.
2406 				 */
2407 				if ((tp->t_state > TCPS_LISTEN) &&
2408 				    (tp->t_state <= TCPS_CLOSING))
2409 					tcp_timer_activate(tp, TT_KEEP,
2410 					    TP_KEEPIDLE(tp));
2411 				break;
2412 			case TCP_KEEPINTVL:
2413 				tp->t_keepintvl = ui;
2414 				if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2415 				    (TP_MAXIDLE(tp) > 0))
2416 					tcp_timer_activate(tp, TT_2MSL,
2417 					    TP_MAXIDLE(tp));
2418 				break;
2419 			case TCP_KEEPINIT:
2420 				tp->t_keepinit = ui;
2421 				if (tp->t_state == TCPS_SYN_RECEIVED ||
2422 				    tp->t_state == TCPS_SYN_SENT)
2423 					tcp_timer_activate(tp, TT_KEEP,
2424 					    TP_KEEPINIT(tp));
2425 				break;
2426 			}
2427 			goto unlock_and_done;
2428 
2429 		case TCP_KEEPCNT:
2430 			INP_WUNLOCK(inp);
2431 			error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
2432 			if (error)
2433 				return (error);
2434 
2435 			INP_WLOCK_RECHECK(inp);
2436 			tp->t_keepcnt = ui;
2437 			if ((tp->t_state == TCPS_FIN_WAIT_2) &&
2438 			    (TP_MAXIDLE(tp) > 0))
2439 				tcp_timer_activate(tp, TT_2MSL,
2440 				    TP_MAXIDLE(tp));
2441 			goto unlock_and_done;
2442 
2443 #ifdef TCPPCAP
2444 		case TCP_PCAP_OUT:
2445 		case TCP_PCAP_IN:
2446 			INP_WUNLOCK(inp);
2447 			error = sooptcopyin(sopt, &optval, sizeof optval,
2448 			    sizeof optval);
2449 			if (error)
2450 				return (error);
2451 
2452 			INP_WLOCK_RECHECK(inp);
2453 			if (optval >= 0)
2454 				tcp_pcap_set_sock_max(TCP_PCAP_OUT ?
2455 					&(tp->t_outpkts) : &(tp->t_inpkts),
2456 					optval);
2457 			else
2458 				error = EINVAL;
2459 			goto unlock_and_done;
2460 #endif
2461 
2462 		case TCP_FASTOPEN: {
2463 			struct tcp_fastopen tfo_optval;
2464 
2465 			INP_WUNLOCK(inp);
2466 			if (!V_tcp_fastopen_client_enable &&
2467 			    !V_tcp_fastopen_server_enable)
2468 				return (EPERM);
2469 
2470 			error = sooptcopyin(sopt, &tfo_optval,
2471 				    sizeof(tfo_optval), sizeof(int));
2472 			if (error)
2473 				return (error);
2474 
2475 			INP_WLOCK_RECHECK(inp);
2476 			if ((tp->t_state != TCPS_CLOSED) &&
2477 			    (tp->t_state != TCPS_LISTEN)) {
2478 				error = EINVAL;
2479 				goto unlock_and_done;
2480 			}
2481 			if (tfo_optval.enable) {
2482 				if (tp->t_state == TCPS_LISTEN) {
2483 					if (!V_tcp_fastopen_server_enable) {
2484 						error = EPERM;
2485 						goto unlock_and_done;
2486 					}
2487 
2488 					if (tp->t_tfo_pending == NULL)
2489 						tp->t_tfo_pending =
2490 						    tcp_fastopen_alloc_counter();
2491 				} else {
2492 					/*
2493 					 * If a pre-shared key was provided,
2494 					 * stash it in the client cookie
2495 					 * field of the tcpcb for use during
2496 					 * connect.
2497 					 */
2498 					if (sopt->sopt_valsize ==
2499 					    sizeof(tfo_optval)) {
2500 						memcpy(tp->t_tfo_cookie.client,
2501 						       tfo_optval.psk,
2502 						       TCP_FASTOPEN_PSK_LEN);
2503 						tp->t_tfo_client_cookie_len =
2504 						    TCP_FASTOPEN_PSK_LEN;
2505 					}
2506 				}
2507 				tp->t_flags |= TF_FASTOPEN;
2508 			} else
2509 				tp->t_flags &= ~TF_FASTOPEN;
2510 			goto unlock_and_done;
2511 		}
2512 
2513 #ifdef TCP_BLACKBOX
2514 		case TCP_LOG:
2515 			INP_WUNLOCK(inp);
2516 			error = sooptcopyin(sopt, &optval, sizeof optval,
2517 			    sizeof optval);
2518 			if (error)
2519 				return (error);
2520 
2521 			INP_WLOCK_RECHECK(inp);
2522 			error = tcp_log_state_change(tp, optval);
2523 			goto unlock_and_done;
2524 
2525 		case TCP_LOGBUF:
2526 			INP_WUNLOCK(inp);
2527 			error = EINVAL;
2528 			break;
2529 
2530 		case TCP_LOGID:
2531 			INP_WUNLOCK(inp);
2532 			error = sooptcopyin(sopt, buf, TCP_LOG_ID_LEN - 1, 0);
2533 			if (error)
2534 				break;
2535 			buf[sopt->sopt_valsize] = '\0';
2536 			INP_WLOCK_RECHECK(inp);
2537 			error = tcp_log_set_id(tp, buf);
2538 			/* tcp_log_set_id() unlocks the INP. */
2539 			break;
2540 
2541 		case TCP_LOGDUMP:
2542 		case TCP_LOGDUMPID:
2543 			INP_WUNLOCK(inp);
2544 			error =
2545 			    sooptcopyin(sopt, buf, TCP_LOG_REASON_LEN - 1, 0);
2546 			if (error)
2547 				break;
2548 			buf[sopt->sopt_valsize] = '\0';
2549 			INP_WLOCK_RECHECK(inp);
2550 			if (sopt->sopt_name == TCP_LOGDUMP) {
2551 				error = tcp_log_dump_tp_logbuf(tp, buf,
2552 				    M_WAITOK, true);
2553 				INP_WUNLOCK(inp);
2554 			} else {
2555 				tcp_log_dump_tp_bucket_logbufs(tp, buf);
2556 				/*
2557 				 * tcp_log_dump_tp_bucket_logbufs() drops the
2558 				 * INP lock.
2559 				 */
2560 			}
2561 			break;
2562 #endif
2563 
2564 		default:
2565 			INP_WUNLOCK(inp);
2566 			error = ENOPROTOOPT;
2567 			break;
2568 		}
2569 		break;
2570 
2571 	case SOPT_GET:
2572 		tp = intotcpcb(inp);
2573 		switch (sopt->sopt_name) {
2574 #if defined(IPSEC_SUPPORT) || defined(TCP_SIGNATURE)
2575 		case TCP_MD5SIG:
2576 			INP_WUNLOCK(inp);
2577 			if (!TCPMD5_ENABLED())
2578 				return (ENOPROTOOPT);
2579 			error = TCPMD5_PCBCTL(inp, sopt);
2580 			break;
2581 #endif
2582 
2583 		case TCP_NODELAY:
2584 			optval = tp->t_flags & TF_NODELAY;
2585 			INP_WUNLOCK(inp);
2586 			error = sooptcopyout(sopt, &optval, sizeof optval);
2587 			break;
2588 		case TCP_MAXSEG:
2589 			optval = tp->t_maxseg;
2590 			INP_WUNLOCK(inp);
2591 			error = sooptcopyout(sopt, &optval, sizeof optval);
2592 			break;
2593 		case TCP_REMOTE_UDP_ENCAPS_PORT:
2594 			optval = ntohs(tp->t_port);
2595 			INP_WUNLOCK(inp);
2596 			error = sooptcopyout(sopt, &optval, sizeof optval);
2597 			break;
2598 		case TCP_NOOPT:
2599 			optval = tp->t_flags & TF_NOOPT;
2600 			INP_WUNLOCK(inp);
2601 			error = sooptcopyout(sopt, &optval, sizeof optval);
2602 			break;
2603 		case TCP_NOPUSH:
2604 			optval = tp->t_flags & TF_NOPUSH;
2605 			INP_WUNLOCK(inp);
2606 			error = sooptcopyout(sopt, &optval, sizeof optval);
2607 			break;
2608 		case TCP_INFO:
2609 			tcp_fill_info(tp, &ti);
2610 			INP_WUNLOCK(inp);
2611 			error = sooptcopyout(sopt, &ti, sizeof ti);
2612 			break;
2613 		case TCP_STATS:
2614 			{
2615 #ifdef STATS
2616 			int nheld;
2617 			TYPEOF_MEMBER(struct statsblob, flags) sbflags = 0;
2618 
2619 			error = 0;
2620 			socklen_t outsbsz = sopt->sopt_valsize;
2621 			if (tp->t_stats == NULL)
2622 				error = ENOENT;
2623 			else if (outsbsz >= tp->t_stats->cursz)
2624 				outsbsz = tp->t_stats->cursz;
2625 			else if (outsbsz >= sizeof(struct statsblob))
2626 				outsbsz = sizeof(struct statsblob);
2627 			else
2628 				error = EINVAL;
2629 			INP_WUNLOCK(inp);
2630 			if (error)
2631 				break;
2632 
2633 			sbp = sopt->sopt_val;
2634 			nheld = atop(round_page(((vm_offset_t)sbp) +
2635 			    (vm_size_t)outsbsz) - trunc_page((vm_offset_t)sbp));
2636 			vm_page_t ma[nheld];
2637 			if (vm_fault_quick_hold_pages(
2638 			    &curproc->p_vmspace->vm_map, (vm_offset_t)sbp,
2639 			    outsbsz, VM_PROT_READ | VM_PROT_WRITE, ma,
2640 			    nheld) < 0) {
2641 				error = EFAULT;
2642 				break;
2643 			}
2644 
2645 			if ((error = copyin_nofault(&(sbp->flags), &sbflags,
2646 			    SIZEOF_MEMBER(struct statsblob, flags))))
2647 				goto unhold;
2648 
2649 			INP_WLOCK_RECHECK(inp);
2650 			error = stats_blob_snapshot(&sbp, outsbsz, tp->t_stats,
2651 			    sbflags | SB_CLONE_USRDSTNOFAULT);
2652 			INP_WUNLOCK(inp);
2653 			sopt->sopt_valsize = outsbsz;
2654 unhold:
2655 			vm_page_unhold_pages(ma, nheld);
2656 #else
2657 			INP_WUNLOCK(inp);
2658 			error = EOPNOTSUPP;
2659 #endif /* !STATS */
2660 			break;
2661 			}
2662 		case TCP_CONGESTION:
2663 			len = strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
2664 			INP_WUNLOCK(inp);
2665 			error = sooptcopyout(sopt, buf, len + 1);
2666 			break;
2667 		case TCP_KEEPIDLE:
2668 		case TCP_KEEPINTVL:
2669 		case TCP_KEEPINIT:
2670 		case TCP_KEEPCNT:
2671 			switch (sopt->sopt_name) {
2672 			case TCP_KEEPIDLE:
2673 				ui = TP_KEEPIDLE(tp) / hz;
2674 				break;
2675 			case TCP_KEEPINTVL:
2676 				ui = TP_KEEPINTVL(tp) / hz;
2677 				break;
2678 			case TCP_KEEPINIT:
2679 				ui = TP_KEEPINIT(tp) / hz;
2680 				break;
2681 			case TCP_KEEPCNT:
2682 				ui = TP_KEEPCNT(tp);
2683 				break;
2684 			}
2685 			INP_WUNLOCK(inp);
2686 			error = sooptcopyout(sopt, &ui, sizeof(ui));
2687 			break;
2688 #ifdef TCPPCAP
2689 		case TCP_PCAP_OUT:
2690 		case TCP_PCAP_IN:
2691 			optval = tcp_pcap_get_sock_max(TCP_PCAP_OUT ?
2692 					&(tp->t_outpkts) : &(tp->t_inpkts));
2693 			INP_WUNLOCK(inp);
2694 			error = sooptcopyout(sopt, &optval, sizeof optval);
2695 			break;
2696 #endif
2697 		case TCP_FASTOPEN:
2698 			optval = tp->t_flags & TF_FASTOPEN;
2699 			INP_WUNLOCK(inp);
2700 			error = sooptcopyout(sopt, &optval, sizeof optval);
2701 			break;
2702 #ifdef TCP_BLACKBOX
2703 		case TCP_LOG:
2704 			optval = tp->t_logstate;
2705 			INP_WUNLOCK(inp);
2706 			error = sooptcopyout(sopt, &optval, sizeof(optval));
2707 			break;
2708 		case TCP_LOGBUF:
2709 			/* tcp_log_getlogbuf() does INP_WUNLOCK(inp) */
2710 			error = tcp_log_getlogbuf(sopt, tp);
2711 			break;
2712 		case TCP_LOGID:
2713 			len = tcp_log_get_id(tp, buf);
2714 			INP_WUNLOCK(inp);
2715 			error = sooptcopyout(sopt, buf, len + 1);
2716 			break;
2717 		case TCP_LOGDUMP:
2718 		case TCP_LOGDUMPID:
2719 			INP_WUNLOCK(inp);
2720 			error = EINVAL;
2721 			break;
2722 #endif
2723 #ifdef KERN_TLS
2724 		case TCP_TXTLS_MODE:
2725 			error = ktls_get_tx_mode(so, &optval);
2726 			INP_WUNLOCK(inp);
2727 			if (error == 0)
2728 				error = sooptcopyout(sopt, &optval,
2729 				    sizeof(optval));
2730 			break;
2731 		case TCP_RXTLS_MODE:
2732 			error = ktls_get_rx_mode(so, &optval);
2733 			INP_WUNLOCK(inp);
2734 			if (error == 0)
2735 				error = sooptcopyout(sopt, &optval,
2736 				    sizeof(optval));
2737 			break;
2738 #endif
2739 		case TCP_LRD:
2740 			optval = tp->t_flags & TF_LRD;
2741 			INP_WUNLOCK(inp);
2742 			error = sooptcopyout(sopt, &optval, sizeof optval);
2743 			break;
2744 		default:
2745 			INP_WUNLOCK(inp);
2746 			error = ENOPROTOOPT;
2747 			break;
2748 		}
2749 		break;
2750 	}
2751 	return (error);
2752 }
2753 #undef INP_WLOCK_RECHECK
2754 #undef INP_WLOCK_RECHECK_CLEANUP
2755 
2756 /*
2757  * Initiate (or continue) disconnect.
2758  * If embryonic state, just send reset (once).
2759  * If in ``let data drain'' option and linger null, just drop.
2760  * Otherwise (hard), mark socket disconnecting and drop
2761  * current input data; switch states based on user close, and
2762  * send segment to peer (with FIN).
2763  */
2764 static void
2765 tcp_disconnect(struct tcpcb *tp)
2766 {
2767 	struct inpcb *inp = tp->t_inpcb;
2768 	struct socket *so = inp->inp_socket;
2769 
2770 	NET_EPOCH_ASSERT();
2771 	INP_WLOCK_ASSERT(inp);
2772 
2773 	/*
2774 	 * Neither tcp_close() nor tcp_drop() should return NULL, as the
2775 	 * socket is still open.
2776 	 */
2777 	if (tp->t_state < TCPS_ESTABLISHED &&
2778 	    !(tp->t_state > TCPS_LISTEN && IS_FASTOPEN(tp->t_flags))) {
2779 		tp = tcp_close(tp);
2780 		KASSERT(tp != NULL,
2781 		    ("tcp_disconnect: tcp_close() returned NULL"));
2782 	} else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
2783 		tp = tcp_drop(tp, 0);
2784 		KASSERT(tp != NULL,
2785 		    ("tcp_disconnect: tcp_drop() returned NULL"));
2786 	} else {
2787 		soisdisconnecting(so);
2788 		sbflush(&so->so_rcv);
2789 		tcp_usrclosed(tp);
2790 		if (!(inp->inp_flags & INP_DROPPED))
2791 			/* Ignore stack's drop request, we already at it. */
2792 			(void)tcp_output_nodrop(tp);
2793 	}
2794 }
2795 
2796 /*
2797  * User issued close, and wish to trail through shutdown states:
2798  * if never received SYN, just forget it.  If got a SYN from peer,
2799  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
2800  * If already got a FIN from peer, then almost done; go to LAST_ACK
2801  * state.  In all other cases, have already sent FIN to peer (e.g.
2802  * after PRU_SHUTDOWN), and just have to play tedious game waiting
2803  * for peer to send FIN or not respond to keep-alives, etc.
2804  * We can let the user exit from the close as soon as the FIN is acked.
2805  */
2806 static void
2807 tcp_usrclosed(struct tcpcb *tp)
2808 {
2809 
2810 	NET_EPOCH_ASSERT();
2811 	INP_WLOCK_ASSERT(tp->t_inpcb);
2812 
2813 	switch (tp->t_state) {
2814 	case TCPS_LISTEN:
2815 #ifdef TCP_OFFLOAD
2816 		tcp_offload_listen_stop(tp);
2817 #endif
2818 		tcp_state_change(tp, TCPS_CLOSED);
2819 		/* FALLTHROUGH */
2820 	case TCPS_CLOSED:
2821 		tp = tcp_close(tp);
2822 		/*
2823 		 * tcp_close() should never return NULL here as the socket is
2824 		 * still open.
2825 		 */
2826 		KASSERT(tp != NULL,
2827 		    ("tcp_usrclosed: tcp_close() returned NULL"));
2828 		break;
2829 
2830 	case TCPS_SYN_SENT:
2831 	case TCPS_SYN_RECEIVED:
2832 		tp->t_flags |= TF_NEEDFIN;
2833 		break;
2834 
2835 	case TCPS_ESTABLISHED:
2836 		tcp_state_change(tp, TCPS_FIN_WAIT_1);
2837 		break;
2838 
2839 	case TCPS_CLOSE_WAIT:
2840 		tcp_state_change(tp, TCPS_LAST_ACK);
2841 		break;
2842 	}
2843 	if (tp->t_state >= TCPS_FIN_WAIT_2) {
2844 		soisdisconnected(tp->t_inpcb->inp_socket);
2845 		/* Prevent the connection hanging in FIN_WAIT_2 forever. */
2846 		if (tp->t_state == TCPS_FIN_WAIT_2) {
2847 			int timeout;
2848 
2849 			timeout = (tcp_fast_finwait2_recycle) ?
2850 			    tcp_finwait2_timeout : TP_MAXIDLE(tp);
2851 			tcp_timer_activate(tp, TT_2MSL, timeout);
2852 		}
2853 	}
2854 }
2855 
2856 #ifdef DDB
2857 static void
2858 db_print_indent(int indent)
2859 {
2860 	int i;
2861 
2862 	for (i = 0; i < indent; i++)
2863 		db_printf(" ");
2864 }
2865 
2866 static void
2867 db_print_tstate(int t_state)
2868 {
2869 
2870 	switch (t_state) {
2871 	case TCPS_CLOSED:
2872 		db_printf("TCPS_CLOSED");
2873 		return;
2874 
2875 	case TCPS_LISTEN:
2876 		db_printf("TCPS_LISTEN");
2877 		return;
2878 
2879 	case TCPS_SYN_SENT:
2880 		db_printf("TCPS_SYN_SENT");
2881 		return;
2882 
2883 	case TCPS_SYN_RECEIVED:
2884 		db_printf("TCPS_SYN_RECEIVED");
2885 		return;
2886 
2887 	case TCPS_ESTABLISHED:
2888 		db_printf("TCPS_ESTABLISHED");
2889 		return;
2890 
2891 	case TCPS_CLOSE_WAIT:
2892 		db_printf("TCPS_CLOSE_WAIT");
2893 		return;
2894 
2895 	case TCPS_FIN_WAIT_1:
2896 		db_printf("TCPS_FIN_WAIT_1");
2897 		return;
2898 
2899 	case TCPS_CLOSING:
2900 		db_printf("TCPS_CLOSING");
2901 		return;
2902 
2903 	case TCPS_LAST_ACK:
2904 		db_printf("TCPS_LAST_ACK");
2905 		return;
2906 
2907 	case TCPS_FIN_WAIT_2:
2908 		db_printf("TCPS_FIN_WAIT_2");
2909 		return;
2910 
2911 	case TCPS_TIME_WAIT:
2912 		db_printf("TCPS_TIME_WAIT");
2913 		return;
2914 
2915 	default:
2916 		db_printf("unknown");
2917 		return;
2918 	}
2919 }
2920 
2921 static void
2922 db_print_tflags(u_int t_flags)
2923 {
2924 	int comma;
2925 
2926 	comma = 0;
2927 	if (t_flags & TF_ACKNOW) {
2928 		db_printf("%sTF_ACKNOW", comma ? ", " : "");
2929 		comma = 1;
2930 	}
2931 	if (t_flags & TF_DELACK) {
2932 		db_printf("%sTF_DELACK", comma ? ", " : "");
2933 		comma = 1;
2934 	}
2935 	if (t_flags & TF_NODELAY) {
2936 		db_printf("%sTF_NODELAY", comma ? ", " : "");
2937 		comma = 1;
2938 	}
2939 	if (t_flags & TF_NOOPT) {
2940 		db_printf("%sTF_NOOPT", comma ? ", " : "");
2941 		comma = 1;
2942 	}
2943 	if (t_flags & TF_SENTFIN) {
2944 		db_printf("%sTF_SENTFIN", comma ? ", " : "");
2945 		comma = 1;
2946 	}
2947 	if (t_flags & TF_REQ_SCALE) {
2948 		db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2949 		comma = 1;
2950 	}
2951 	if (t_flags & TF_RCVD_SCALE) {
2952 		db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2953 		comma = 1;
2954 	}
2955 	if (t_flags & TF_REQ_TSTMP) {
2956 		db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2957 		comma = 1;
2958 	}
2959 	if (t_flags & TF_RCVD_TSTMP) {
2960 		db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2961 		comma = 1;
2962 	}
2963 	if (t_flags & TF_SACK_PERMIT) {
2964 		db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2965 		comma = 1;
2966 	}
2967 	if (t_flags & TF_NEEDSYN) {
2968 		db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2969 		comma = 1;
2970 	}
2971 	if (t_flags & TF_NEEDFIN) {
2972 		db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2973 		comma = 1;
2974 	}
2975 	if (t_flags & TF_NOPUSH) {
2976 		db_printf("%sTF_NOPUSH", comma ? ", " : "");
2977 		comma = 1;
2978 	}
2979 	if (t_flags & TF_PREVVALID) {
2980 		db_printf("%sTF_PREVVALID", comma ? ", " : "");
2981 		comma = 1;
2982 	}
2983 	if (t_flags & TF_MORETOCOME) {
2984 		db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2985 		comma = 1;
2986 	}
2987 	if (t_flags & TF_LQ_OVERFLOW) {
2988 		db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");
2989 		comma = 1;
2990 	}
2991 	if (t_flags & TF_LASTIDLE) {
2992 		db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2993 		comma = 1;
2994 	}
2995 	if (t_flags & TF_RXWIN0SENT) {
2996 		db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2997 		comma = 1;
2998 	}
2999 	if (t_flags & TF_FASTRECOVERY) {
3000 		db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
3001 		comma = 1;
3002 	}
3003 	if (t_flags & TF_CONGRECOVERY) {
3004 		db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
3005 		comma = 1;
3006 	}
3007 	if (t_flags & TF_WASFRECOVERY) {
3008 		db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
3009 		comma = 1;
3010 	}
3011 	if (t_flags & TF_WASCRECOVERY) {
3012 		db_printf("%sTF_WASCRECOVERY", comma ? ", " : "");
3013 		comma = 1;
3014 	}
3015 	if (t_flags & TF_SIGNATURE) {
3016 		db_printf("%sTF_SIGNATURE", comma ? ", " : "");
3017 		comma = 1;
3018 	}
3019 	if (t_flags & TF_FORCEDATA) {
3020 		db_printf("%sTF_FORCEDATA", comma ? ", " : "");
3021 		comma = 1;
3022 	}
3023 	if (t_flags & TF_TSO) {
3024 		db_printf("%sTF_TSO", comma ? ", " : "");
3025 		comma = 1;
3026 	}
3027 	if (t_flags & TF_FASTOPEN) {
3028 		db_printf("%sTF_FASTOPEN", comma ? ", " : "");
3029 		comma = 1;
3030 	}
3031 }
3032 
3033 static void
3034 db_print_tflags2(u_int t_flags2)
3035 {
3036 	int comma;
3037 
3038 	comma = 0;
3039 	if (t_flags2 & TF2_PLPMTU_BLACKHOLE) {
3040 		db_printf("%sTF2_PLPMTU_BLACKHOLE", comma ? ", " : "");
3041 		comma = 1;
3042 	}
3043 	if (t_flags2 & TF2_PLPMTU_PMTUD) {
3044 		db_printf("%sTF2_PLPMTU_PMTUD", comma ? ", " : "");
3045 		comma = 1;
3046 	}
3047 	if (t_flags2 & TF2_PLPMTU_MAXSEGSNT) {
3048 		db_printf("%sTF2_PLPMTU_MAXSEGSNT", comma ? ", " : "");
3049 		comma = 1;
3050 	}
3051 	if (t_flags2 & TF2_LOG_AUTO) {
3052 		db_printf("%sTF2_LOG_AUTO", comma ? ", " : "");
3053 		comma = 1;
3054 	}
3055 	if (t_flags2 & TF2_DROP_AF_DATA) {
3056 		db_printf("%sTF2_DROP_AF_DATA", comma ? ", " : "");
3057 		comma = 1;
3058 	}
3059 	if (t_flags2 & TF2_ECN_PERMIT) {
3060 		db_printf("%sTF2_ECN_PERMIT", comma ? ", " : "");
3061 		comma = 1;
3062 	}
3063 	if (t_flags2 & TF2_ECN_SND_CWR) {
3064 		db_printf("%sTF2_ECN_SND_CWR", comma ? ", " : "");
3065 		comma = 1;
3066 	}
3067 	if (t_flags2 & TF2_ECN_SND_ECE) {
3068 		db_printf("%sTF2_ECN_SND_ECE", comma ? ", " : "");
3069 		comma = 1;
3070 	}
3071 	if (t_flags2 & TF2_ACE_PERMIT) {
3072 		db_printf("%sTF2_ACE_PERMIT", comma ? ", " : "");
3073 		comma = 1;
3074 	}
3075 	if (t_flags2 & TF2_FBYTES_COMPLETE) {
3076 		db_printf("%sTF2_FBYTES_COMPLETE", comma ? ", " : "");
3077 		comma = 1;
3078 	}
3079 }
3080 
3081 static void
3082 db_print_toobflags(char t_oobflags)
3083 {
3084 	int comma;
3085 
3086 	comma = 0;
3087 	if (t_oobflags & TCPOOB_HAVEDATA) {
3088 		db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
3089 		comma = 1;
3090 	}
3091 	if (t_oobflags & TCPOOB_HADDATA) {
3092 		db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
3093 		comma = 1;
3094 	}
3095 }
3096 
3097 static void
3098 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
3099 {
3100 
3101 	db_print_indent(indent);
3102 	db_printf("%s at %p\n", name, tp);
3103 
3104 	indent += 2;
3105 
3106 	db_print_indent(indent);
3107 	db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
3108 	   TAILQ_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
3109 
3110 	db_print_indent(indent);
3111 	db_printf("tt_rexmt: %p   tt_persist: %p   tt_keep: %p\n",
3112 	    &tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);
3113 
3114 	db_print_indent(indent);
3115 	db_printf("tt_2msl: %p   tt_delack: %p   t_inpcb: %p\n", &tp->t_timers->tt_2msl,
3116 	    &tp->t_timers->tt_delack, tp->t_inpcb);
3117 
3118 	db_print_indent(indent);
3119 	db_printf("t_state: %d (", tp->t_state);
3120 	db_print_tstate(tp->t_state);
3121 	db_printf(")\n");
3122 
3123 	db_print_indent(indent);
3124 	db_printf("t_flags: 0x%x (", tp->t_flags);
3125 	db_print_tflags(tp->t_flags);
3126 	db_printf(")\n");
3127 
3128 	db_print_indent(indent);
3129 	db_printf("t_flags2: 0x%x (", tp->t_flags2);
3130 	db_print_tflags2(tp->t_flags2);
3131 	db_printf(")\n");
3132 
3133 	db_print_indent(indent);
3134 	db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: x0%08x\n",
3135 	    tp->snd_una, tp->snd_max, tp->snd_nxt);
3136 
3137 	db_print_indent(indent);
3138 	db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
3139 	   tp->snd_up, tp->snd_wl1, tp->snd_wl2);
3140 
3141 	db_print_indent(indent);
3142 	db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
3143 	    tp->iss, tp->irs, tp->rcv_nxt);
3144 
3145 	db_print_indent(indent);
3146 	db_printf("rcv_adv: 0x%08x   rcv_wnd: %u   rcv_up: 0x%08x\n",
3147 	    tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
3148 
3149 	db_print_indent(indent);
3150 	db_printf("snd_wnd: %u   snd_cwnd: %u\n",
3151 	   tp->snd_wnd, tp->snd_cwnd);
3152 
3153 	db_print_indent(indent);
3154 	db_printf("snd_ssthresh: %u   snd_recover: "
3155 	    "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
3156 
3157 	db_print_indent(indent);
3158 	db_printf("t_rcvtime: %u   t_startime: %u\n",
3159 	    tp->t_rcvtime, tp->t_starttime);
3160 
3161 	db_print_indent(indent);
3162 	db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
3163 	    tp->t_rtttime, tp->t_rtseq);
3164 
3165 	db_print_indent(indent);
3166 	db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
3167 	    tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
3168 
3169 	db_print_indent(indent);
3170 	db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u   "
3171 	    "t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,
3172 	    tp->t_rttbest);
3173 
3174 	db_print_indent(indent);
3175 	db_printf("t_rttupdated: %lu   max_sndwnd: %u   t_softerror: %d\n",
3176 	    tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
3177 
3178 	db_print_indent(indent);
3179 	db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
3180 	db_print_toobflags(tp->t_oobflags);
3181 	db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
3182 
3183 	db_print_indent(indent);
3184 	db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
3185 	    tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
3186 
3187 	db_print_indent(indent);
3188 	db_printf("ts_recent: %u   ts_recent_age: %u\n",
3189 	    tp->ts_recent, tp->ts_recent_age);
3190 
3191 	db_print_indent(indent);
3192 	db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
3193 	    "%u\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
3194 
3195 	db_print_indent(indent);
3196 	db_printf("snd_ssthresh_prev: %u   snd_recover_prev: 0x%08x   "
3197 	    "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
3198 	    tp->snd_recover_prev, tp->t_badrxtwin);
3199 
3200 	db_print_indent(indent);
3201 	db_printf("snd_numholes: %d  snd_holes first: %p\n",
3202 	    tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
3203 
3204 	db_print_indent(indent);
3205 	db_printf("snd_fack: 0x%08x   rcv_numsacks: %d\n",
3206 	    tp->snd_fack, tp->rcv_numsacks);
3207 
3208 	/* Skip sackblks, sackhint. */
3209 
3210 	db_print_indent(indent);
3211 	db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
3212 	    tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
3213 }
3214 
3215 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
3216 {
3217 	struct tcpcb *tp;
3218 
3219 	if (!have_addr) {
3220 		db_printf("usage: show tcpcb <addr>\n");
3221 		return;
3222 	}
3223 	tp = (struct tcpcb *)addr;
3224 
3225 	db_print_tcpcb(tp, "tcpcb", 0);
3226 }
3227 #endif
3228