sys/netinet/tcp_usrreq.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1988, 1993
   3  *      The Regents of the University of California.
   4  * Copyright (c) 2006-2007 Robert N. M. Watson
   5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
   6  * All rights reserved.
   7  *
   8  * Portions of this software were developed by Robert N. M. Watson under
   9  * contract to Juniper Networks, Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 4. Neither the name of the University nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  *
  35  *      From: @(#)tcp_usrreq.c  8.2 (Berkeley) 1/3/94
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include "opt_ddb.h"
  42 #include "opt_inet.h"
  43 #include "opt_inet6.h"
  44 #include "opt_tcpdebug.h"
  45
  46 #include <sys/param.h>
  47 #include <sys/systm.h>
  48 #include <sys/limits.h>
  49 #include <sys/malloc.h>
  50 #include <sys/refcount.h>
  51 #include <sys/kernel.h>
  52 #include <sys/sysctl.h>
  53 #include <sys/mbuf.h>
  54 #ifdef INET6
  55 #include <sys/domain.h>
  56 #endif /* INET6 */
  57 #include <sys/socket.h>
  58 #include <sys/socketvar.h>
  59 #include <sys/protosw.h>
  60 #include <sys/proc.h>
  61 #include <sys/jail.h>
  62
  63 #ifdef DDB
  64 #include <ddb/ddb.h>
  65 #endif
  66
  67 #include <net/if.h>
  68 #include <net/if_var.h>
  69 #include <net/route.h>
  70 #include <net/vnet.h>
  71
  72 #include <netinet/in.h>
  73 #include <netinet/in_kdtrace.h>
  74 #include <netinet/in_pcb.h>
  75 #include <netinet/in_systm.h>
  76 #include <netinet/in_var.h>
  77 #include <netinet/ip_var.h>
  78 #ifdef INET6
  79 #include <netinet/ip6.h>
  80 #include <netinet6/in6_pcb.h>
  81 #include <netinet6/ip6_var.h>
  82 #include <netinet6/scope6_var.h>
  83 #endif
  84 #ifdef TCP_RFC7413
  85 #include <netinet/tcp_fastopen.h>
  86 #endif
  87 #include <netinet/tcp.h>
  88 #include <netinet/tcp_fsm.h>
  89 #include <netinet/tcp_seq.h>
  90 #include <netinet/tcp_timer.h>
  91 #include <netinet/tcp_var.h>
  92 #include <netinet/tcpip.h>
  93 #include <netinet/cc/cc.h>
  94 #ifdef TCPPCAP
  95 #include <netinet/tcp_pcap.h>
  96 #endif
  97 #ifdef TCPDEBUG
  98 #include <netinet/tcp_debug.h>
  99 #endif
 100 #ifdef TCP_OFFLOAD
 101 #include <netinet/tcp_offload.h>
 102 #endif
 103
 104 /*
 105  * TCP protocol interface to socket abstraction.
 106  */
 107 static int      tcp_attach(struct socket *);
 108 #ifdef INET
 109 static int      tcp_connect(struct tcpcb *, struct sockaddr *,
 110                     struct thread *td);
 111 #endif /* INET */
 112 #ifdef INET6
 113 static int      tcp6_connect(struct tcpcb *, struct sockaddr *,
 114                     struct thread *td);
 115 #endif /* INET6 */
 116 static void     tcp_disconnect(struct tcpcb *);
 117 static void     tcp_usrclosed(struct tcpcb *);
 118 static void     tcp_fill_info(struct tcpcb *, struct tcp_info *);
 119
 120 #ifdef TCPDEBUG
 121 #define TCPDEBUG0       int ostate = 0
 122 #define TCPDEBUG1()     ostate = tp ? tp->t_state : 0
 123 #define TCPDEBUG2(req)  if (tp && (so->so_options & SO_DEBUG)) \
 124                                 tcp_trace(TA_USER, ostate, tp, 0, 0, req)
 125 #else
 126 #define TCPDEBUG0
 127 #define TCPDEBUG1()
 128 #define TCPDEBUG2(req)
 129 #endif
 130
 131 /*
 132  * TCP attaches to socket via pru_attach(), reserving space,
 133  * and an internet control block.
 134  */
 135 static int
 136 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
 137 {
 138         struct inpcb *inp;
 139         struct tcpcb *tp = NULL;
 140         int error;
 141         TCPDEBUG0;
 142
 143         inp = sotoinpcb(so);
 144         KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
 145         TCPDEBUG1();
 146
 147         error = tcp_attach(so);
 148         if (error)
 149                 goto out;
 150
 151         if ((so->so_options & SO_LINGER) && so->so_linger == 0)
 152                 so->so_linger = TCP_LINGERTIME;
 153
 154         inp = sotoinpcb(so);
 155         tp = intotcpcb(inp);
 156 out:
 157         TCPDEBUG2(PRU_ATTACH);
 158         TCP_PROBE2(debug__user, tp, PRU_ATTACH);
 159         return error;
 160 }
 161
 162 /*
 163  * tcp_detach is called when the socket layer loses its final reference
 164  * to the socket, be it a file descriptor reference, a reference from TCP,
 165  * etc.  At this point, there is only one case in which we will keep around
 166  * inpcb state: time wait.
 167  *
 168  * This function can probably be re-absorbed back into tcp_usr_detach() now
 169  * that there is a single detach path.
 170  */
 171 static void
 172 tcp_detach(struct socket *so, struct inpcb *inp)
 173 {
 174         struct tcpcb *tp;
 175
 176         INP_INFO_LOCK_ASSERT(&V_tcbinfo);
 177         INP_WLOCK_ASSERT(inp);
 178
 179         KASSERT(so->so_pcb == inp, ("tcp_detach: so_pcb != inp"));
 180         KASSERT(inp->inp_socket == so, ("tcp_detach: inp_socket != so"));
 181
 182         tp = intotcpcb(inp);
 183
 184         if (inp->inp_flags & INP_TIMEWAIT) {
 185                 /*
 186                  * There are two cases to handle: one in which the time wait
 187                  * state is being discarded (INP_DROPPED), and one in which
 188                  * this connection will remain in timewait.  In the former,
 189                  * it is time to discard all state (except tcptw, which has
 190                  * already been discarded by the timewait close code, which
 191                  * should be further up the call stack somewhere).  In the
 192                  * latter case, we detach from the socket, but leave the pcb
 193                  * present until timewait ends.
 194                  *
 195                  * XXXRW: Would it be cleaner to free the tcptw here?
 196                  *
 197                  * Astute question indeed, from twtcp perspective there are
 198                  * three cases to consider:
 199                  *
 200                  * #1 tcp_detach is called at tcptw creation time by
 201                  *  tcp_twstart, then do not discard the newly created tcptw
 202                  *  and leave inpcb present until timewait ends
 203                  * #2 tcp_detach is called at timewait end (or reuse) by
 204                  *  tcp_twclose, then the tcptw has already been discarded
 205                  *  (or reused) and inpcb is freed here
 206                  * #3 tcp_detach is called() after timewait ends (or reuse)
 207                  *  (e.g. by soclose), then tcptw has already been discarded
 208                  *  (or reused) and inpcb is freed here
 209                  *
 210                  *  In all three cases the tcptw should not be freed here.
 211                  */
 212                 if (inp->inp_flags & INP_DROPPED) {
 213                         KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "
 214                             "INP_DROPPED && tp != NULL"));
 215                         in_pcbdetach(inp);
 216                         in_pcbfree(inp);
 217                 } else {
 218                         in_pcbdetach(inp);
 219                         INP_WUNLOCK(inp);
 220                 }
 221         } else {
 222                 /*
 223                  * If the connection is not in timewait, we consider two
 224                  * two conditions: one in which no further processing is
 225                  * necessary (dropped || embryonic), and one in which TCP is
 226                  * not yet done, but no longer requires the socket, so the
 227                  * pcb will persist for the time being.
 228                  *
 229                  * XXXRW: Does the second case still occur?
 230                  */
 231                 if (inp->inp_flags & INP_DROPPED ||
 232                     tp->t_state < TCPS_SYN_SENT) {
 233                         tcp_discardcb(tp);
 234                         in_pcbdetach(inp);
 235                         in_pcbfree(inp);
 236                 } else {
 237                         in_pcbdetach(inp);
 238                         INP_WUNLOCK(inp);
 239                 }
 240         }
 241 }
 242
 243 /*
 244  * pru_detach() detaches the TCP protocol from the socket.
 245  * If the protocol state is non-embryonic, then can't
 246  * do this directly: have to initiate a pru_disconnect(),
 247  * which may finish later; embryonic TCB's can just
 248  * be discarded here.
 249  */
 250 static void
 251 tcp_usr_detach(struct socket *so)
 252 {
 253         struct inpcb *inp;
 254         int rlock = 0;
 255
 256         inp = sotoinpcb(so);
 257         KASSERT(inp != NULL, ("tcp_usr_detach: inp == NULL"));
 258         if (!INP_INFO_WLOCKED(&V_tcbinfo)) {
 259                 INP_INFO_RLOCK(&V_tcbinfo);
 260                 rlock = 1;
 261         }
 262         INP_WLOCK(inp);
 263         KASSERT(inp->inp_socket != NULL,
 264             ("tcp_usr_detach: inp_socket == NULL"));
 265         tcp_detach(so, inp);
 266         if (rlock)
 267                 INP_INFO_RUNLOCK(&V_tcbinfo);
 268 }
 269
 270 #ifdef INET
 271 /*
 272  * Give the socket an address.
 273  */
 274 static int
 275 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 276 {
 277         int error = 0;
 278         struct inpcb *inp;
 279         struct tcpcb *tp = NULL;
 280         struct sockaddr_in *sinp;
 281
 282         sinp = (struct sockaddr_in *)nam;
 283         if (nam->sa_len != sizeof (*sinp))
 284                 return (EINVAL);
 285         /*
 286          * Must check for multicast addresses and disallow binding
 287          * to them.
 288          */
 289         if (sinp->sin_family == AF_INET &&
 290             IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 291                 return (EAFNOSUPPORT);
 292
 293         TCPDEBUG0;
 294         inp = sotoinpcb(so);
 295         KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
 296         INP_WLOCK(inp);
 297         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 298                 error = EINVAL;
 299                 goto out;
 300         }
 301         tp = intotcpcb(inp);
 302         TCPDEBUG1();
 303         INP_HASH_WLOCK(&V_tcbinfo);
 304         error = in_pcbbind(inp, nam, td->td_ucred);
 305         INP_HASH_WUNLOCK(&V_tcbinfo);
 306 out:
 307         TCPDEBUG2(PRU_BIND);
 308         TCP_PROBE2(debug__user, tp, PRU_BIND);
 309         INP_WUNLOCK(inp);
 310
 311         return (error);
 312 }
 313 #endif /* INET */
 314
 315 #ifdef INET6
 316 static int
 317 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 318 {
 319         int error = 0;
 320         struct inpcb *inp;
 321         struct tcpcb *tp = NULL;
 322         struct sockaddr_in6 *sin6p;
 323
 324         sin6p = (struct sockaddr_in6 *)nam;
 325         if (nam->sa_len != sizeof (*sin6p))
 326                 return (EINVAL);
 327         /*
 328          * Must check for multicast addresses and disallow binding
 329          * to them.
 330          */
 331         if (sin6p->sin6_family == AF_INET6 &&
 332             IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 333                 return (EAFNOSUPPORT);
 334
 335         TCPDEBUG0;
 336         inp = sotoinpcb(so);
 337         KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
 338         INP_WLOCK(inp);
 339         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 340                 error = EINVAL;
 341                 goto out;
 342         }
 343         tp = intotcpcb(inp);
 344         TCPDEBUG1();
 345         INP_HASH_WLOCK(&V_tcbinfo);
 346         inp->inp_vflag &= ~INP_IPV4;
 347         inp->inp_vflag |= INP_IPV6;
 348 #ifdef INET
 349         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 350                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6p->sin6_addr))
 351                         inp->inp_vflag |= INP_IPV4;
 352                 else if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 353                         struct sockaddr_in sin;
 354
 355                         in6_sin6_2_sin(&sin, sin6p);
 356                         inp->inp_vflag |= INP_IPV4;
 357                         inp->inp_vflag &= ~INP_IPV6;
 358                         error = in_pcbbind(inp, (struct sockaddr *)&sin,
 359                             td->td_ucred);
 360                         INP_HASH_WUNLOCK(&V_tcbinfo);
 361                         goto out;
 362                 }
 363         }
 364 #endif
 365         error = in6_pcbbind(inp, nam, td->td_ucred);
 366         INP_HASH_WUNLOCK(&V_tcbinfo);
 367 out:
 368         TCPDEBUG2(PRU_BIND);
 369         TCP_PROBE2(debug__user, tp, PRU_BIND);
 370         INP_WUNLOCK(inp);
 371         return (error);
 372 }
 373 #endif /* INET6 */
 374
 375 #ifdef INET
 376 /*
 377  * Prepare to accept connections.
 378  */
 379 static int
 380 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
 381 {
 382         int error = 0;
 383         struct inpcb *inp;
 384         struct tcpcb *tp = NULL;
 385
 386         TCPDEBUG0;
 387         inp = sotoinpcb(so);
 388         KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
 389         INP_WLOCK(inp);
 390         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 391                 error = EINVAL;
 392                 goto out;
 393         }
 394         tp = intotcpcb(inp);
 395         TCPDEBUG1();
 396         SOCK_LOCK(so);
 397         error = solisten_proto_check(so);
 398         INP_HASH_WLOCK(&V_tcbinfo);
 399         if (error == 0 && inp->inp_lport == 0)
 400                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 401         INP_HASH_WUNLOCK(&V_tcbinfo);
 402         if (error == 0) {
 403                 tcp_state_change(tp, TCPS_LISTEN);
 404                 solisten_proto(so, backlog);
 405 #ifdef TCP_OFFLOAD
 406                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 407                         tcp_offload_listen_start(tp);
 408 #endif
 409         }
 410         SOCK_UNLOCK(so);
 411
 412 #ifdef TCP_RFC7413
 413         if (tp->t_flags & TF_FASTOPEN)
 414                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 415 #endif
 416 out:
 417         TCPDEBUG2(PRU_LISTEN);
 418         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 419         INP_WUNLOCK(inp);
 420         return (error);
 421 }
 422 #endif /* INET */
 423
 424 #ifdef INET6
 425 static int
 426 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
 427 {
 428         int error = 0;
 429         struct inpcb *inp;
 430         struct tcpcb *tp = NULL;
 431
 432         TCPDEBUG0;
 433         inp = sotoinpcb(so);
 434         KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
 435         INP_WLOCK(inp);
 436         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 437                 error = EINVAL;
 438                 goto out;
 439         }
 440         tp = intotcpcb(inp);
 441         TCPDEBUG1();
 442         SOCK_LOCK(so);
 443         error = solisten_proto_check(so);
 444         INP_HASH_WLOCK(&V_tcbinfo);
 445         if (error == 0 && inp->inp_lport == 0) {
 446                 inp->inp_vflag &= ~INP_IPV4;
 447                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
 448                         inp->inp_vflag |= INP_IPV4;
 449                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 450         }
 451         INP_HASH_WUNLOCK(&V_tcbinfo);
 452         if (error == 0) {
 453                 tcp_state_change(tp, TCPS_LISTEN);
 454                 solisten_proto(so, backlog);
 455 #ifdef TCP_OFFLOAD
 456                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 457                         tcp_offload_listen_start(tp);
 458 #endif
 459         }
 460         SOCK_UNLOCK(so);
 461
 462 #ifdef TCP_RFC7413
 463         if (tp->t_flags & TF_FASTOPEN)
 464                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 465 #endif
 466 out:
 467         TCPDEBUG2(PRU_LISTEN);
 468         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 469         INP_WUNLOCK(inp);
 470         return (error);
 471 }
 472 #endif /* INET6 */
 473
 474 #ifdef INET
 475 /*
 476  * Initiate connection to peer.
 477  * Create a template for use in transmissions on this connection.
 478  * Enter SYN_SENT state, and mark socket as connecting.
 479  * Start keep-alive timer, and seed output sequence space.
 480  * Send initial segment on connection.
 481  */
 482 static int
 483 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 484 {
 485         int error = 0;
 486         struct inpcb *inp;
 487         struct tcpcb *tp = NULL;
 488         struct sockaddr_in *sinp;
 489
 490         sinp = (struct sockaddr_in *)nam;
 491         if (nam->sa_len != sizeof (*sinp))
 492                 return (EINVAL);
 493         /*
 494          * Must disallow TCP ``connections'' to multicast addresses.
 495          */
 496         if (sinp->sin_family == AF_INET
 497             && IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 498                 return (EAFNOSUPPORT);
 499         if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
 500                 return (error);
 501
 502         TCPDEBUG0;
 503         inp = sotoinpcb(so);
 504         KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
 505         INP_WLOCK(inp);
 506         if (inp->inp_flags & INP_TIMEWAIT) {
 507                 error = EADDRINUSE;
 508                 goto out;
 509         }
 510         if (inp->inp_flags & INP_DROPPED) {
 511                 error = ECONNREFUSED;
 512                 goto out;
 513         }
 514         tp = intotcpcb(inp);
 515         TCPDEBUG1();
 516         if ((error = tcp_connect(tp, nam, td)) != 0)
 517                 goto out;
 518 #ifdef TCP_OFFLOAD
 519         if (registered_toedevs > 0 &&
 520             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 521             (error = tcp_offload_connect(so, nam)) == 0)
 522                 goto out;
 523 #endif
 524         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 525         error = tp->t_fb->tfb_tcp_output(tp);
 526 out:
 527         TCPDEBUG2(PRU_CONNECT);
 528         TCP_PROBE2(debug__user, tp, PRU_CONNECT);
 529         INP_WUNLOCK(inp);
 530         return (error);
 531 }
 532 #endif /* INET */
 533
 534 #ifdef INET6
 535 static int
 536 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 537 {
 538         int error = 0;
 539         struct inpcb *inp;
 540         struct tcpcb *tp = NULL;
 541         struct sockaddr_in6 *sin6p;
 542
 543         TCPDEBUG0;
 544
 545         sin6p = (struct sockaddr_in6 *)nam;
 546         if (nam->sa_len != sizeof (*sin6p))
 547                 return (EINVAL);
 548         /*
 549          * Must disallow TCP ``connections'' to multicast addresses.
 550          */
 551         if (sin6p->sin6_family == AF_INET6
 552             && IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 553                 return (EAFNOSUPPORT);
 554
 555         inp = sotoinpcb(so);
 556         KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
 557         INP_WLOCK(inp);
 558         if (inp->inp_flags & INP_TIMEWAIT) {
 559                 error = EADDRINUSE;
 560                 goto out;
 561         }
 562         if (inp->inp_flags & INP_DROPPED) {
 563                 error = ECONNREFUSED;
 564                 goto out;
 565         }
 566         tp = intotcpcb(inp);
 567         TCPDEBUG1();
 568 #ifdef INET
 569         /*
 570          * XXXRW: Some confusion: V4/V6 flags relate to binding, and
 571          * therefore probably require the hash lock, which isn't held here.
 572          * Is this a significant problem?
 573          */
 574         if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 575                 struct sockaddr_in sin;
 576
 577                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
 578                         error = EINVAL;
 579                         goto out;
 580                 }
 581
 582                 in6_sin6_2_sin(&sin, sin6p);
 583                 inp->inp_vflag |= INP_IPV4;
 584                 inp->inp_vflag &= ~INP_IPV6;
 585                 if ((error = prison_remote_ip4(td->td_ucred,
 586                     &sin.sin_addr)) != 0)
 587                         goto out;
 588                 if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)
 589                         goto out;
 590 #ifdef TCP_OFFLOAD
 591                 if (registered_toedevs > 0 &&
 592                     (so->so_options & SO_NO_OFFLOAD) == 0 &&
 593                     (error = tcp_offload_connect(so, nam)) == 0)
 594                         goto out;
 595 #endif
 596                 error = tp->t_fb->tfb_tcp_output(tp);
 597                 goto out;
 598         }
 599 #endif
 600         inp->inp_vflag &= ~INP_IPV4;
 601         inp->inp_vflag |= INP_IPV6;
 602         inp->inp_inc.inc_flags |= INC_ISIPV6;
 603         if ((error = prison_remote_ip6(td->td_ucred, &sin6p->sin6_addr)) != 0)
 604                 goto out;
 605         if ((error = tcp6_connect(tp, nam, td)) != 0)
 606                 goto out;
 607 #ifdef TCP_OFFLOAD
 608         if (registered_toedevs > 0 &&
 609             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 610             (error = tcp_offload_connect(so, nam)) == 0)
 611                 goto out;
 612 #endif
 613         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 614         error = tp->t_fb->tfb_tcp_output(tp);
 615
 616 out:
 617         TCPDEBUG2(PRU_CONNECT);
 618         TCP_PROBE2(debug__user, tp, PRU_CONNECT);
 619         INP_WUNLOCK(inp);
 620         return (error);
 621 }
 622 #endif /* INET6 */
 623
 624 /*
 625  * Initiate disconnect from peer.
 626  * If connection never passed embryonic stage, just drop;
 627  * else if don't need to let data drain, then can just drop anyways,
 628  * else have to begin TCP shutdown process: mark socket disconnecting,
 629  * drain unread data, state switch to reflect user close, and
 630  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
 631  * when peer sends FIN and acks ours.
 632  *
 633  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
 634  */
 635 static int
 636 tcp_usr_disconnect(struct socket *so)
 637 {
 638         struct inpcb *inp;
 639         struct tcpcb *tp = NULL;
 640         int error = 0;
 641
 642         TCPDEBUG0;
 643         INP_INFO_RLOCK(&V_tcbinfo);
 644         inp = sotoinpcb(so);
 645         KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
 646         INP_WLOCK(inp);
 647         if (inp->inp_flags & INP_TIMEWAIT)
 648                 goto out;
 649         if (inp->inp_flags & INP_DROPPED) {
 650                 error = ECONNRESET;
 651                 goto out;
 652         }
 653         tp = intotcpcb(inp);
 654         TCPDEBUG1();
 655         tcp_disconnect(tp);
 656 out:
 657         TCPDEBUG2(PRU_DISCONNECT);
 658         TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
 659         INP_WUNLOCK(inp);
 660         INP_INFO_RUNLOCK(&V_tcbinfo);
 661         return (error);
 662 }
 663
 664 #ifdef INET
 665 /*
 666  * Accept a connection.  Essentially all the work is done at higher levels;
 667  * just return the address of the peer, storing through addr.
 668  */
 669 static int
 670 tcp_usr_accept(struct socket *so, struct sockaddr **nam)
 671 {
 672         int error = 0;
 673         struct inpcb *inp = NULL;
 674         struct tcpcb *tp = NULL;
 675         struct in_addr addr;
 676         in_port_t port = 0;
 677         TCPDEBUG0;
 678
 679         if (so->so_state & SS_ISDISCONNECTED)
 680                 return (ECONNABORTED);
 681
 682         inp = sotoinpcb(so);
 683         KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
 684         INP_WLOCK(inp);
 685         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 686                 error = ECONNABORTED;
 687                 goto out;
 688         }
 689         tp = intotcpcb(inp);
 690         TCPDEBUG1();
 691
 692         /*
 693          * We inline in_getpeeraddr and COMMON_END here, so that we can
 694          * copy the data of interest and defer the malloc until after we
 695          * release the lock.
 696          */
 697         port = inp->inp_fport;
 698         addr = inp->inp_faddr;
 699
 700 out:
 701         TCPDEBUG2(PRU_ACCEPT);
 702         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 703         INP_WUNLOCK(inp);
 704         if (error == 0)
 705                 *nam = in_sockaddr(port, &addr);
 706         return error;
 707 }
 708 #endif /* INET */
 709
 710 #ifdef INET6
 711 static int
 712 tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
 713 {
 714         struct inpcb *inp = NULL;
 715         int error = 0;
 716         struct tcpcb *tp = NULL;
 717         struct in_addr addr;
 718         struct in6_addr addr6;
 719         in_port_t port = 0;
 720         int v4 = 0;
 721         TCPDEBUG0;
 722
 723         if (so->so_state & SS_ISDISCONNECTED)
 724                 return (ECONNABORTED);
 725
 726         inp = sotoinpcb(so);
 727         KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
 728         INP_INFO_RLOCK(&V_tcbinfo);
 729         INP_WLOCK(inp);
 730         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 731                 error = ECONNABORTED;
 732                 goto out;
 733         }
 734         tp = intotcpcb(inp);
 735         TCPDEBUG1();
 736
 737         /*
 738          * We inline in6_mapped_peeraddr and COMMON_END here, so that we can
 739          * copy the data of interest and defer the malloc until after we
 740          * release the lock.
 741          */
 742         if (inp->inp_vflag & INP_IPV4) {
 743                 v4 = 1;
 744                 port = inp->inp_fport;
 745                 addr = inp->inp_faddr;
 746         } else {
 747                 port = inp->inp_fport;
 748                 addr6 = inp->in6p_faddr;
 749         }
 750
 751 out:
 752         TCPDEBUG2(PRU_ACCEPT);
 753         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 754         INP_WUNLOCK(inp);
 755         INP_INFO_RUNLOCK(&V_tcbinfo);
 756         if (error == 0) {
 757                 if (v4)
 758                         *nam = in6_v4mapsin6_sockaddr(port, &addr);
 759                 else
 760                         *nam = in6_sockaddr(port, &addr6);
 761         }
 762         return error;
 763 }
 764 #endif /* INET6 */
 765
 766 /*
 767  * Mark the connection as being incapable of further output.
 768  */
 769 static int
 770 tcp_usr_shutdown(struct socket *so)
 771 {
 772         int error = 0;
 773         struct inpcb *inp;
 774         struct tcpcb *tp = NULL;
 775
 776         TCPDEBUG0;
 777         INP_INFO_RLOCK(&V_tcbinfo);
 778         inp = sotoinpcb(so);
 779         KASSERT(inp != NULL, ("inp == NULL"));
 780         INP_WLOCK(inp);
 781         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 782                 error = ECONNRESET;
 783                 goto out;
 784         }
 785         tp = intotcpcb(inp);
 786         TCPDEBUG1();
 787         socantsendmore(so);
 788         tcp_usrclosed(tp);
 789         if (!(inp->inp_flags & INP_DROPPED))
 790                 error = tp->t_fb->tfb_tcp_output(tp);
 791
 792 out:
 793         TCPDEBUG2(PRU_SHUTDOWN);
 794         TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
 795         INP_WUNLOCK(inp);
 796         INP_INFO_RUNLOCK(&V_tcbinfo);
 797
 798         return (error);
 799 }
 800
 801 /*
 802  * After a receive, possibly send window update to peer.
 803  */
 804 static int
 805 tcp_usr_rcvd(struct socket *so, int flags)
 806 {
 807         struct inpcb *inp;
 808         struct tcpcb *tp = NULL;
 809         int error = 0;
 810
 811         TCPDEBUG0;
 812         inp = sotoinpcb(so);
 813         KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
 814         INP_WLOCK(inp);
 815         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 816                 error = ECONNRESET;
 817                 goto out;
 818         }
 819         tp = intotcpcb(inp);
 820         TCPDEBUG1();
 821 #ifdef TCP_RFC7413
 822         /*
 823          * For passively-created TFO connections, don't attempt a window
 824          * update while still in SYN_RECEIVED as this may trigger an early
 825          * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
 826          * application response data, or failing that, when the DELACK timer
 827          * expires.
 828          */
 829         if ((tp->t_flags & TF_FASTOPEN) &&
 830             (tp->t_state == TCPS_SYN_RECEIVED))
 831                 goto out;
 832 #endif
 833 #ifdef TCP_OFFLOAD
 834         if (tp->t_flags & TF_TOE)
 835                 tcp_offload_rcvd(tp);
 836         else
 837 #endif
 838         tp->t_fb->tfb_tcp_output(tp);
 839
 840 out:
 841         TCPDEBUG2(PRU_RCVD);
 842         TCP_PROBE2(debug__user, tp, PRU_RCVD);
 843         INP_WUNLOCK(inp);
 844         return (error);
 845 }
 846
 847 /*
 848  * Do a send by putting data in output queue and updating urgent
 849  * marker if URG set.  Possibly send more data.  Unlike the other
 850  * pru_*() routines, the mbuf chains are our responsibility.  We
 851  * must either enqueue them or free them.  The other pru_* routines
 852  * generally are caller-frees.
 853  */
 854 static int
 855 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
 856     struct sockaddr *nam, struct mbuf *control, struct thread *td)
 857 {
 858         int error = 0;
 859         struct inpcb *inp;
 860         struct tcpcb *tp = NULL;
 861 #ifdef INET6
 862         int isipv6;
 863 #endif
 864         TCPDEBUG0;
 865
 866         /*
 867          * We require the pcbinfo lock if we will close the socket as part of
 868          * this call.
 869          */
 870         if (flags & PRUS_EOF)
 871                 INP_INFO_RLOCK(&V_tcbinfo);
 872         inp = sotoinpcb(so);
 873         KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
 874         INP_WLOCK(inp);
 875         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 876                 if (control)
 877                         m_freem(control);
 878                 /*
 879                  * In case of PRUS_NOTREADY, tcp_usr_ready() is responsible
 880                  * for freeing memory.
 881                  */
 882                 if (m && (flags & PRUS_NOTREADY) == 0)
 883                         m_freem(m);
 884                 error = ECONNRESET;
 885                 goto out;
 886         }
 887 #ifdef INET6
 888         isipv6 = nam && nam->sa_family == AF_INET6;
 889 #endif /* INET6 */
 890         tp = intotcpcb(inp);
 891         TCPDEBUG1();
 892         if (control) {
 893                 /* TCP doesn't do control messages (rights, creds, etc) */
 894                 if (control->m_len) {
 895                         m_freem(control);
 896                         if (m)
 897                                 m_freem(m);
 898                         error = EINVAL;
 899                         goto out;
 900                 }
 901                 m_freem(control);       /* empty control, just free it */
 902         }
 903         if (!(flags & PRUS_OOB)) {
 904                 sbappendstream(&so->so_snd, m, flags);
 905                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 906                         /*
 907                          * Do implied connect if not yet connected,
 908                          * initialize window to default value, and
 909                          * initialize maxseg using peer's cached MSS.
 910                          */
 911 #ifdef INET6
 912                         if (isipv6)
 913                                 error = tcp6_connect(tp, nam, td);
 914 #endif /* INET6 */
 915 #if defined(INET6) && defined(INET)
 916                         else
 917 #endif
 918 #ifdef INET
 919                                 error = tcp_connect(tp, nam, td);
 920 #endif
 921                         if (error)
 922                                 goto out;
 923                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 924                         tcp_mss(tp, -1);
 925                 }
 926                 if (flags & PRUS_EOF) {
 927                         /*
 928                          * Close the send side of the connection after
 929                          * the data is sent.
 930                          */
 931                         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
 932                         socantsendmore(so);
 933                         tcp_usrclosed(tp);
 934                 }
 935                 if (!(inp->inp_flags & INP_DROPPED) &&
 936                     !(flags & PRUS_NOTREADY)) {
 937                         if (flags & PRUS_MORETOCOME)
 938                                 tp->t_flags |= TF_MORETOCOME;
 939                         error = tp->t_fb->tfb_tcp_output(tp);
 940                         if (flags & PRUS_MORETOCOME)
 941                                 tp->t_flags &= ~TF_MORETOCOME;
 942                 }
 943         } else {
 944                 /*
 945                  * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
 946                  */
 947                 SOCKBUF_LOCK(&so->so_snd);
 948                 if (sbspace(&so->so_snd) < -512) {
 949                         SOCKBUF_UNLOCK(&so->so_snd);
 950                         m_freem(m);
 951                         error = ENOBUFS;
 952                         goto out;
 953                 }
 954                 /*
 955                  * According to RFC961 (Assigned Protocols),
 956                  * the urgent pointer points to the last octet
 957                  * of urgent data.  We continue, however,
 958                  * to consider it to indicate the first octet
 959                  * of data past the urgent section.
 960                  * Otherwise, snd_up should be one lower.
 961                  */
 962                 sbappendstream_locked(&so->so_snd, m, flags);
 963                 SOCKBUF_UNLOCK(&so->so_snd);
 964                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 965                         /*
 966                          * Do implied connect if not yet connected,
 967                          * initialize window to default value, and
 968                          * initialize maxseg using peer's cached MSS.
 969                          */
 970 #ifdef INET6
 971                         if (isipv6)
 972                                 error = tcp6_connect(tp, nam, td);
 973 #endif /* INET6 */
 974 #if defined(INET6) && defined(INET)
 975                         else
 976 #endif
 977 #ifdef INET
 978                                 error = tcp_connect(tp, nam, td);
 979 #endif
 980                         if (error)
 981                                 goto out;
 982                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 983                         tcp_mss(tp, -1);
 984                 }
 985                 tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
 986                 if (!(flags & PRUS_NOTREADY)) {
 987                         tp->t_flags |= TF_FORCEDATA;
 988                         error = tp->t_fb->tfb_tcp_output(tp);
 989                         tp->t_flags &= ~TF_FORCEDATA;
 990                 }
 991         }
 992 out:
 993         TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :
 994                   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 995         TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
 996                    ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 997         INP_WUNLOCK(inp);
 998         if (flags & PRUS_EOF)
 999                 INP_INFO_RUNLOCK(&V_tcbinfo);
1000         return (error);
1001 }
1002
1003 static int
1004 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1005 {
1006         struct inpcb *inp;
1007         struct tcpcb *tp;
1008         int error;
1009
1010         inp = sotoinpcb(so);
1011         INP_WLOCK(inp);
1012         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1013                 INP_WUNLOCK(inp);
1014                 for (int i = 0; i < count; i++)
1015                         m = m_free(m);
1016                 return (ECONNRESET);
1017         }
1018         tp = intotcpcb(inp);
1019
1020         SOCKBUF_LOCK(&so->so_snd);
1021         error = sbready(&so->so_snd, m, count);
1022         SOCKBUF_UNLOCK(&so->so_snd);
1023         if (error == 0)
1024                 error = tp->t_fb->tfb_tcp_output(tp);
1025         INP_WUNLOCK(inp);
1026
1027         return (error);
1028 }
1029
1030 /*
1031  * Abort the TCP.  Drop the connection abruptly.
1032  */
1033 static void
1034 tcp_usr_abort(struct socket *so)
1035 {
1036         struct inpcb *inp;
1037         struct tcpcb *tp = NULL;
1038         TCPDEBUG0;
1039
1040         inp = sotoinpcb(so);
1041         KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1042
1043         INP_INFO_RLOCK(&V_tcbinfo);
1044         INP_WLOCK(inp);
1045         KASSERT(inp->inp_socket != NULL,
1046             ("tcp_usr_abort: inp_socket == NULL"));
1047
1048         /*
1049          * If we still have full TCP state, and we're not dropped, drop.
1050          */
1051         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1052             !(inp->inp_flags & INP_DROPPED)) {
1053                 tp = intotcpcb(inp);
1054                 TCPDEBUG1();
1055                 tcp_drop(tp, ECONNABORTED);
1056                 TCPDEBUG2(PRU_ABORT);
1057                 TCP_PROBE2(debug__user, tp, PRU_ABORT);
1058         }
1059         if (!(inp->inp_flags & INP_DROPPED)) {
1060                 SOCK_LOCK(so);
1061                 so->so_state |= SS_PROTOREF;
1062                 SOCK_UNLOCK(so);
1063                 inp->inp_flags |= INP_SOCKREF;
1064         }
1065         INP_WUNLOCK(inp);
1066         INP_INFO_RUNLOCK(&V_tcbinfo);
1067 }
1068
1069 /*
1070  * TCP socket is closed.  Start friendly disconnect.
1071  */
1072 static void
1073 tcp_usr_close(struct socket *so)
1074 {
1075         struct inpcb *inp;
1076         struct tcpcb *tp = NULL;
1077         TCPDEBUG0;
1078
1079         inp = sotoinpcb(so);
1080         KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1081
1082         INP_INFO_RLOCK(&V_tcbinfo);
1083         INP_WLOCK(inp);
1084         KASSERT(inp->inp_socket != NULL,
1085             ("tcp_usr_close: inp_socket == NULL"));
1086
1087         /*
1088          * If we still have full TCP state, and we're not dropped, initiate
1089          * a disconnect.
1090          */
1091         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1092             !(inp->inp_flags & INP_DROPPED)) {
1093                 tp = intotcpcb(inp);
1094                 TCPDEBUG1();
1095                 tcp_disconnect(tp);
1096                 TCPDEBUG2(PRU_CLOSE);
1097                 TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1098         }
1099         if (!(inp->inp_flags & INP_DROPPED)) {
1100                 SOCK_LOCK(so);
1101                 so->so_state |= SS_PROTOREF;
1102                 SOCK_UNLOCK(so);
1103                 inp->inp_flags |= INP_SOCKREF;
1104         }
1105         INP_WUNLOCK(inp);
1106         INP_INFO_RUNLOCK(&V_tcbinfo);
1107 }
1108
1109 /*
1110  * Receive out-of-band data.
1111  */
1112 static int
1113 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1114 {
1115         int error = 0;
1116         struct inpcb *inp;
1117         struct tcpcb *tp = NULL;
1118
1119         TCPDEBUG0;
1120         inp = sotoinpcb(so);
1121         KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1122         INP_WLOCK(inp);
1123         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1124                 error = ECONNRESET;
1125                 goto out;
1126         }
1127         tp = intotcpcb(inp);
1128         TCPDEBUG1();
1129         if ((so->so_oobmark == 0 &&
1130              (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1131             so->so_options & SO_OOBINLINE ||
1132             tp->t_oobflags & TCPOOB_HADDATA) {
1133                 error = EINVAL;
1134                 goto out;
1135         }
1136         if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1137                 error = EWOULDBLOCK;
1138                 goto out;
1139         }
1140         m->m_len = 1;
1141         *mtod(m, caddr_t) = tp->t_iobc;
1142         if ((flags & MSG_PEEK) == 0)
1143                 tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1144
1145 out:
1146         TCPDEBUG2(PRU_RCVOOB);
1147         TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1148         INP_WUNLOCK(inp);
1149         return (error);
1150 }
1151
1152 #ifdef INET
1153 struct pr_usrreqs tcp_usrreqs = {
1154         .pru_abort =            tcp_usr_abort,
1155         .pru_accept =           tcp_usr_accept,
1156         .pru_attach =           tcp_usr_attach,
1157         .pru_bind =             tcp_usr_bind,
1158         .pru_connect =          tcp_usr_connect,
1159         .pru_control =          in_control,
1160         .pru_detach =           tcp_usr_detach,
1161         .pru_disconnect =       tcp_usr_disconnect,
1162         .pru_listen =           tcp_usr_listen,
1163         .pru_peeraddr =         in_getpeeraddr,
1164         .pru_rcvd =             tcp_usr_rcvd,
1165         .pru_rcvoob =           tcp_usr_rcvoob,
1166         .pru_send =             tcp_usr_send,
1167         .pru_ready =            tcp_usr_ready,
1168         .pru_shutdown =         tcp_usr_shutdown,
1169         .pru_sockaddr =         in_getsockaddr,
1170         .pru_sosetlabel =       in_pcbsosetlabel,
1171         .pru_close =            tcp_usr_close,
1172 };
1173 #endif /* INET */
1174
1175 #ifdef INET6
1176 struct pr_usrreqs tcp6_usrreqs = {
1177         .pru_abort =            tcp_usr_abort,
1178         .pru_accept =           tcp6_usr_accept,
1179         .pru_attach =           tcp_usr_attach,
1180         .pru_bind =             tcp6_usr_bind,
1181         .pru_connect =          tcp6_usr_connect,
1182         .pru_control =          in6_control,
1183         .pru_detach =           tcp_usr_detach,
1184         .pru_disconnect =       tcp_usr_disconnect,
1185         .pru_listen =           tcp6_usr_listen,
1186         .pru_peeraddr =         in6_mapped_peeraddr,
1187         .pru_rcvd =             tcp_usr_rcvd,
1188         .pru_rcvoob =           tcp_usr_rcvoob,
1189         .pru_send =             tcp_usr_send,
1190         .pru_ready =            tcp_usr_ready,
1191         .pru_shutdown =         tcp_usr_shutdown,
1192         .pru_sockaddr =         in6_mapped_sockaddr,
1193         .pru_sosetlabel =       in_pcbsosetlabel,
1194         .pru_close =            tcp_usr_close,
1195 };
1196 #endif /* INET6 */
1197
1198 #ifdef INET
1199 /*
1200  * Common subroutine to open a TCP connection to remote host specified
1201  * by struct sockaddr_in in mbuf *nam.  Call in_pcbbind to assign a local
1202  * port number if needed.  Call in_pcbconnect_setup to do the routing and
1203  * to choose a local host address (interface).  If there is an existing
1204  * incarnation of the same connection in TIME-WAIT state and if the remote
1205  * host was sending CC options and if the connection duration was < MSL, then
1206  * truncate the previous TIME-WAIT state and proceed.
1207  * Initialize connection parameters and enter SYN-SENT state.
1208  */
1209 static int
1210 tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1211 {
1212         struct inpcb *inp = tp->t_inpcb, *oinp;
1213         struct socket *so = inp->inp_socket;
1214         struct in_addr laddr;
1215         u_short lport;
1216         int error;
1217
1218         INP_WLOCK_ASSERT(inp);
1219         INP_HASH_WLOCK(&V_tcbinfo);
1220
1221         if (inp->inp_lport == 0) {
1222                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1223                 if (error)
1224                         goto out;
1225         }
1226
1227         /*
1228          * Cannot simply call in_pcbconnect, because there might be an
1229          * earlier incarnation of this same connection still in
1230          * TIME_WAIT state, creating an ADDRINUSE error.
1231          */
1232         laddr = inp->inp_laddr;
1233         lport = inp->inp_lport;
1234         error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,
1235             &inp->inp_faddr.s_addr, &inp->inp_fport, &oinp, td->td_ucred);
1236         if (error && oinp == NULL)
1237                 goto out;
1238         if (oinp) {
1239                 error = EADDRINUSE;
1240                 goto out;
1241         }
1242         inp->inp_laddr = laddr;
1243         in_pcbrehash(inp);
1244         INP_HASH_WUNLOCK(&V_tcbinfo);
1245
1246         /*
1247          * Compute window scaling to request:
1248          * Scale to fit into sweet spot.  See tcp_syncache.c.
1249          * XXX: This should move to tcp_output().
1250          */
1251         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1252             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1253                 tp->request_r_scale++;
1254
1255         soisconnecting(so);
1256         TCPSTAT_INC(tcps_connattempt);
1257         tcp_state_change(tp, TCPS_SYN_SENT);
1258         tp->iss = tcp_new_isn(tp);
1259         tcp_sendseqinit(tp);
1260
1261         return 0;
1262
1263 out:
1264         INP_HASH_WUNLOCK(&V_tcbinfo);
1265         return (error);
1266 }
1267 #endif /* INET */
1268
1269 #ifdef INET6
1270 static int
1271 tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1272 {
1273         struct inpcb *inp = tp->t_inpcb;
1274         int error;
1275
1276         INP_WLOCK_ASSERT(inp);
1277         INP_HASH_WLOCK(&V_tcbinfo);
1278
1279         if (inp->inp_lport == 0) {
1280                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1281                 if (error)
1282                         goto out;
1283         }
1284         error = in6_pcbconnect(inp, nam, td->td_ucred);
1285         if (error != 0)
1286                 goto out;
1287         INP_HASH_WUNLOCK(&V_tcbinfo);
1288
1289         /* Compute window scaling to request.  */
1290         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1291             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1292                 tp->request_r_scale++;
1293
1294         soisconnecting(inp->inp_socket);
1295         TCPSTAT_INC(tcps_connattempt);
1296         tcp_state_change(tp, TCPS_SYN_SENT);
1297         tp->iss = tcp_new_isn(tp);
1298         tcp_sendseqinit(tp);
1299
1300         return 0;
1301
1302 out:
1303         INP_HASH_WUNLOCK(&V_tcbinfo);
1304         return error;
1305 }
1306 #endif /* INET6 */
1307
1308 /*
1309  * Export TCP internal state information via a struct tcp_info, based on the
1310  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1311  * (TCP state machine, etc).  We export all information using FreeBSD-native
1312  * constants -- for example, the numeric values for tcpi_state will differ
1313  * from Linux.
1314  */
1315 static void
1316 tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)
1317 {
1318
1319         INP_WLOCK_ASSERT(tp->t_inpcb);
1320         bzero(ti, sizeof(*ti));
1321
1322         ti->tcpi_state = tp->t_state;
1323         if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1324                 ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1325         if (tp->t_flags & TF_SACK_PERMIT)
1326                 ti->tcpi_options |= TCPI_OPT_SACK;
1327         if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1328                 ti->tcpi_options |= TCPI_OPT_WSCALE;
1329                 ti->tcpi_snd_wscale = tp->snd_scale;
1330                 ti->tcpi_rcv_wscale = tp->rcv_scale;
1331         }
1332
1333         ti->tcpi_rto = tp->t_rxtcur * tick;
1334         ti->tcpi_last_data_recv = (long)(ticks - (int)tp->t_rcvtime) * tick;
1335         ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1336         ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1337
1338         ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1339         ti->tcpi_snd_cwnd = tp->snd_cwnd;
1340
1341         /*
1342          * FreeBSD-specific extension fields for tcp_info.
1343          */
1344         ti->tcpi_rcv_space = tp->rcv_wnd;
1345         ti->tcpi_rcv_nxt = tp->rcv_nxt;
1346         ti->tcpi_snd_wnd = tp->snd_wnd;
1347         ti->tcpi_snd_bwnd = 0;          /* Unused, kept for compat. */
1348         ti->tcpi_snd_nxt = tp->snd_nxt;
1349         ti->tcpi_snd_mss = tp->t_maxseg;
1350         ti->tcpi_rcv_mss = tp->t_maxseg;
1351         if (tp->t_flags & TF_TOE)
1352                 ti->tcpi_options |= TCPI_OPT_TOE;
1353         ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1354         ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1355         ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1356 }
1357
1358 /*
1359  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1360  * socket option arguments.  When it re-acquires the lock after the copy, it
1361  * has to revalidate that the connection is still valid for the socket
1362  * option.
1363  */
1364 #define INP_WLOCK_RECHECK(inp) do {                                     \
1365         INP_WLOCK(inp);                                                 \
1366         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {            \
1367                 INP_WUNLOCK(inp);                                       \
1368                 return (ECONNRESET);                                    \
1369         }                                                               \
1370         tp = intotcpcb(inp);                                            \
1371 } while(0)
1372
1373 int
1374 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1375 {
1376         int     error;
1377         struct  inpcb *inp;
1378         struct  tcpcb *tp;
1379         struct tcp_function_block *blk;
1380         struct tcp_function_set fsn;
1381
1382         error = 0;
1383         inp = sotoinpcb(so);
1384         KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1385         INP_WLOCK(inp);
1386         if (sopt->sopt_level != IPPROTO_TCP) {
1387 #ifdef INET6
1388                 if (inp->inp_vflag & INP_IPV6PROTO) {
1389                         INP_WUNLOCK(inp);
1390                         error = ip6_ctloutput(so, sopt);
1391                 }
1392 #endif /* INET6 */
1393 #if defined(INET6) && defined(INET)
1394                 else
1395 #endif
1396 #ifdef INET
1397                 {
1398                         INP_WUNLOCK(inp);
1399                         error = ip_ctloutput(so, sopt);
1400                 }
1401 #endif
1402                 return (error);
1403         }
1404         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1405                 INP_WUNLOCK(inp);
1406                 return (ECONNRESET);
1407         }
1408         tp = intotcpcb(inp);
1409         /*
1410          * Protect the TCP option TCP_FUNCTION_BLK so
1411          * that a sub-function can *never* overwrite this.
1412          */
1413         if ((sopt->sopt_dir == SOPT_SET) &&
1414             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1415                 INP_WUNLOCK(inp);
1416                 error = sooptcopyin(sopt, &fsn, sizeof fsn,
1417                     sizeof fsn);
1418                 if (error)
1419                         return (error);
1420                 INP_WLOCK_RECHECK(inp);
1421                 if (tp->t_state != TCPS_CLOSED) {
1422                         /*
1423                          * The user has advanced the state
1424                          * past the initial point, we can't
1425                          * switch since we are down the road
1426                          * and a new set of functions may
1427                          * not be compatibile.
1428                          */
1429                         INP_WUNLOCK(inp);
1430                         return(EINVAL);
1431                 }
1432                 blk = find_and_ref_tcp_functions(&fsn);
1433                 if (blk == NULL) {
1434                         INP_WUNLOCK(inp);
1435                         return (ENOENT);
1436                 }
1437                 if (tp->t_fb != blk) {
1438                         if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1439                                 refcount_release(&blk->tfb_refcnt);
1440                                 INP_WUNLOCK(inp);
1441                                 return (ENOENT);
1442                         }
1443                         /*
1444                          * Release the old refcnt, the
1445                          * lookup acquires a ref on the
1446                          * new one.
1447                          */
1448                         if (tp->t_fb->tfb_tcp_fb_fini)
1449                                 (*tp->t_fb->tfb_tcp_fb_fini)(tp);
1450                         refcount_release(&tp->t_fb->tfb_refcnt);
1451                         tp->t_fb = blk;
1452                         if (tp->t_fb->tfb_tcp_fb_init) {
1453                                 (*tp->t_fb->tfb_tcp_fb_init)(tp);
1454                         }
1455                 }
1456 #ifdef TCP_OFFLOAD
1457                 if (tp->t_flags & TF_TOE) {
1458                         tcp_offload_ctloutput(tp, sopt->sopt_dir,
1459                              sopt->sopt_name);
1460                 }
1461 #endif
1462                 INP_WUNLOCK(inp);
1463                 return (error);
1464         } else if ((sopt->sopt_dir == SOPT_GET) &&
1465             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1466                 strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);
1467                 fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1468                 INP_WUNLOCK(inp);
1469                 error = sooptcopyout(sopt, &fsn, sizeof fsn);
1470                 return (error);
1471         }
1472         /* Pass in the INP locked, called must unlock it */
1473         return (tp->t_fb->tfb_tcp_ctloutput(so, sopt, inp, tp));
1474 }
1475
1476 int
1477 tcp_default_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp, struct tcpcb *tp)
1478 {
1479         int     error, opt, optval;
1480         u_int   ui;
1481         struct  tcp_info ti;
1482         struct cc_algo *algo;
1483         char    *pbuf, buf[TCP_CA_NAME_MAX];
1484         size_t  len;
1485
1486         /*
1487          * For TCP_CCALGOOPT forward the control to CC module, for both
1488          * SOPT_SET and SOPT_GET.
1489          */
1490         switch (sopt->sopt_name) {
1491         case TCP_CCALGOOPT:
1492                 INP_WUNLOCK(inp);
1493                 pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
1494                 error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
1495                     sopt->sopt_valsize);
1496                 if (error) {
1497                         free(pbuf, M_TEMP);
1498                         return (error);
1499                 }
1500                 INP_WLOCK_RECHECK(inp);
1501                 if (CC_ALGO(tp)->ctl_output != NULL)
1502                         error = CC_ALGO(tp)->ctl_output(tp->ccv, sopt, pbuf);
1503                 else
1504                         error = ENOENT;
1505                 INP_WUNLOCK(inp);
1506                 if (error == 0 && sopt->sopt_dir == SOPT_GET)
1507                         error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);
1508                 free(pbuf, M_TEMP);
1509                 return (error);
1510         }
1511
1512         switch (sopt->sopt_dir) {
1513         case SOPT_SET:
1514                 switch (sopt->sopt_name) {
1515 #ifdef TCP_SIGNATURE
1516                 case TCP_MD5SIG:
1517                         INP_WUNLOCK(inp);
1518                         error = sooptcopyin(sopt, &optval, sizeof optval,
1519                             sizeof optval);
1520                         if (error)
1521                                 return (error);
1522
1523                         INP_WLOCK_RECHECK(inp);
1524                         if (optval > 0)
1525                                 tp->t_flags |= TF_SIGNATURE;
1526                         else
1527                                 tp->t_flags &= ~TF_SIGNATURE;
1528                         goto unlock_and_done;
1529 #endif /* TCP_SIGNATURE */
1530
1531                 case TCP_NODELAY:
1532                 case TCP_NOOPT:
1533                         INP_WUNLOCK(inp);
1534                         error = sooptcopyin(sopt, &optval, sizeof optval,
1535                             sizeof optval);
1536                         if (error)
1537                                 return (error);
1538
1539                         INP_WLOCK_RECHECK(inp);
1540                         switch (sopt->sopt_name) {
1541                         case TCP_NODELAY:
1542                                 opt = TF_NODELAY;
1543                                 break;
1544                         case TCP_NOOPT:
1545                                 opt = TF_NOOPT;
1546                                 break;
1547                         default:
1548                                 opt = 0; /* dead code to fool gcc */
1549                                 break;
1550                         }
1551
1552                         if (optval)
1553                                 tp->t_flags |= opt;
1554                         else
1555                                 tp->t_flags &= ~opt;
1556 unlock_and_done:
1557 #ifdef TCP_OFFLOAD
1558                         if (tp->t_flags & TF_TOE) {
1559                                 tcp_offload_ctloutput(tp, sopt->sopt_dir,
1560                                     sopt->sopt_name);
1561                         }
1562 #endif
1563                         INP_WUNLOCK(inp);
1564                         break;
1565
1566                 case TCP_NOPUSH:
1567                         INP_WUNLOCK(inp);
1568                         error = sooptcopyin(sopt, &optval, sizeof optval,
1569                             sizeof optval);
1570                         if (error)
1571                                 return (error);
1572
1573                         INP_WLOCK_RECHECK(inp);
1574                         if (optval)
1575                                 tp->t_flags |= TF_NOPUSH;
1576                         else if (tp->t_flags & TF_NOPUSH) {
1577                                 tp->t_flags &= ~TF_NOPUSH;
1578                                 if (TCPS_HAVEESTABLISHED(tp->t_state))
1579                                         error = tp->t_fb->tfb_tcp_output(tp);
1580                         }
1581                         goto unlock_and_done;
1582
1583                 case TCP_MAXSEG:
1584                         INP_WUNLOCK(inp);
1585                         error = sooptcopyin(sopt, &optval, sizeof optval,
1586                             sizeof optval);
1587                         if (error)
1588                                 return (error);
1589
1590                         INP_WLOCK_RECHECK(inp);
1591                         if (optval > 0 && optval <= tp->t_maxseg &&
1592                             optval + 40 >= V_tcp_minmss)
1593                                 tp->t_maxseg = optval;
1594                         else
1595                                 error = EINVAL;
1596                         goto unlock_and_done;
1597
1598                 case TCP_INFO:
1599                         INP_WUNLOCK(inp);
1600                         error = EINVAL;
1601                         break;
1602
1603                 case TCP_CONGESTION:
1604                         INP_WUNLOCK(inp);
1605                         error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX - 1, 1);
1606                         if (error)
1607                                 break;
1608                         buf[sopt->sopt_valsize] = '\0';
1609                         INP_WLOCK_RECHECK(inp);
1610                         CC_LIST_RLOCK();
1611                         STAILQ_FOREACH(algo, &cc_list, entries)
1612                                 if (strncmp(buf, algo->name,
1613                                     TCP_CA_NAME_MAX) == 0)
1614                                         break;
1615                         CC_LIST_RUNLOCK();
1616                         if (algo == NULL) {
1617                                 INP_WUNLOCK(inp);
1618                                 error = EINVAL;
1619                                 break;
1620                         }
1621                         /*
1622                          * We hold a write lock over the tcb so it's safe to
1623                          * do these things without ordering concerns.
1624                          */
1625                         if (CC_ALGO(tp)->cb_destroy != NULL)
1626                                 CC_ALGO(tp)->cb_destroy(tp->ccv);
1627                         CC_ALGO(tp) = algo;
1628                         /*
1629                          * If something goes pear shaped initialising the new
1630                          * algo, fall back to newreno (which does not
1631                          * require initialisation).
1632                          */
1633                         if (algo->cb_init != NULL &&
1634                             algo->cb_init(tp->ccv) != 0) {
1635                                 CC_ALGO(tp) = &newreno_cc_algo;
1636                                 /*
1637                                  * The only reason init should fail is
1638                                  * because of malloc.
1639                                  */
1640                                 error = ENOMEM;
1641                         }
1642                         INP_WUNLOCK(inp);
1643                         break;
1644
1645                 case TCP_KEEPIDLE:
1646                 case TCP_KEEPINTVL:
1647                 case TCP_KEEPINIT:
1648                         INP_WUNLOCK(inp);
1649                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1650                         if (error)
1651                                 return (error);
1652
1653                         if (ui > (UINT_MAX / hz)) {
1654                                 error = EINVAL;
1655                                 break;
1656                         }
1657                         ui *= hz;
1658
1659                         INP_WLOCK_RECHECK(inp);
1660                         switch (sopt->sopt_name) {
1661                         case TCP_KEEPIDLE:
1662                                 tp->t_keepidle = ui;
1663                                 /*
1664                                  * XXX: better check current remaining
1665                                  * timeout and "merge" it with new value.
1666                                  */
1667                                 if ((tp->t_state > TCPS_LISTEN) &&
1668                                     (tp->t_state <= TCPS_CLOSING))
1669                                         tcp_timer_activate(tp, TT_KEEP,
1670                                             TP_KEEPIDLE(tp));
1671                                 break;
1672                         case TCP_KEEPINTVL:
1673                                 tp->t_keepintvl = ui;
1674                                 if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1675                                     (TP_MAXIDLE(tp) > 0))
1676                                         tcp_timer_activate(tp, TT_2MSL,
1677                                             TP_MAXIDLE(tp));
1678                                 break;
1679                         case TCP_KEEPINIT:
1680                                 tp->t_keepinit = ui;
1681                                 if (tp->t_state == TCPS_SYN_RECEIVED ||
1682                                     tp->t_state == TCPS_SYN_SENT)
1683                                         tcp_timer_activate(tp, TT_KEEP,
1684                                             TP_KEEPINIT(tp));
1685                                 break;
1686                         }
1687                         goto unlock_and_done;
1688
1689                 case TCP_KEEPCNT:
1690                         INP_WUNLOCK(inp);
1691                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1692                         if (error)
1693                                 return (error);
1694
1695                         INP_WLOCK_RECHECK(inp);
1696                         tp->t_keepcnt = ui;
1697                         if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1698                             (TP_MAXIDLE(tp) > 0))
1699                                 tcp_timer_activate(tp, TT_2MSL,
1700                                     TP_MAXIDLE(tp));
1701                         goto unlock_and_done;
1702
1703 #ifdef TCPPCAP
1704                 case TCP_PCAP_OUT:
1705                 case TCP_PCAP_IN:
1706                         INP_WUNLOCK(inp);
1707                         error = sooptcopyin(sopt, &optval, sizeof optval,
1708                             sizeof optval);
1709                         if (error)
1710                                 return (error);
1711
1712                         INP_WLOCK_RECHECK(inp);
1713                         if (optval >= 0)
1714                                 tcp_pcap_set_sock_max(TCP_PCAP_OUT ?
1715                                         &(tp->t_outpkts) : &(tp->t_inpkts),
1716                                         optval);
1717                         else
1718                                 error = EINVAL;
1719                         goto unlock_and_done;
1720 #endif
1721
1722 #ifdef TCP_RFC7413
1723                 case TCP_FASTOPEN:
1724                         INP_WUNLOCK(inp);
1725                         if (!V_tcp_fastopen_enabled)
1726                                 return (EPERM);
1727
1728                         error = sooptcopyin(sopt, &optval, sizeof optval,
1729                             sizeof optval);
1730                         if (error)
1731                                 return (error);
1732
1733                         INP_WLOCK_RECHECK(inp);
1734                         if (optval) {
1735                                 tp->t_flags |= TF_FASTOPEN;
1736                                 if ((tp->t_state == TCPS_LISTEN) &&
1737                                     (tp->t_tfo_pending == NULL))
1738                                         tp->t_tfo_pending =
1739                                             tcp_fastopen_alloc_counter();
1740                         } else
1741                                 tp->t_flags &= ~TF_FASTOPEN;
1742                         goto unlock_and_done;
1743 #endif
1744
1745                 default:
1746                         INP_WUNLOCK(inp);
1747                         error = ENOPROTOOPT;
1748                         break;
1749                 }
1750                 break;
1751
1752         case SOPT_GET:
1753                 tp = intotcpcb(inp);
1754                 switch (sopt->sopt_name) {
1755 #ifdef TCP_SIGNATURE
1756                 case TCP_MD5SIG:
1757                         optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0;
1758                         INP_WUNLOCK(inp);
1759                         error = sooptcopyout(sopt, &optval, sizeof optval);
1760                         break;
1761 #endif
1762
1763                 case TCP_NODELAY:
1764                         optval = tp->t_flags & TF_NODELAY;
1765                         INP_WUNLOCK(inp);
1766                         error = sooptcopyout(sopt, &optval, sizeof optval);
1767                         break;
1768                 case TCP_MAXSEG:
1769                         optval = tp->t_maxseg;
1770                         INP_WUNLOCK(inp);
1771                         error = sooptcopyout(sopt, &optval, sizeof optval);
1772                         break;
1773                 case TCP_NOOPT:
1774                         optval = tp->t_flags & TF_NOOPT;
1775                         INP_WUNLOCK(inp);
1776                         error = sooptcopyout(sopt, &optval, sizeof optval);
1777                         break;
1778                 case TCP_NOPUSH:
1779                         optval = tp->t_flags & TF_NOPUSH;
1780                         INP_WUNLOCK(inp);
1781                         error = sooptcopyout(sopt, &optval, sizeof optval);
1782                         break;
1783                 case TCP_INFO:
1784                         tcp_fill_info(tp, &ti);
1785                         INP_WUNLOCK(inp);
1786                         error = sooptcopyout(sopt, &ti, sizeof ti);
1787                         break;
1788                 case TCP_CONGESTION:
1789                         len = strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
1790                         INP_WUNLOCK(inp);
1791                         error = sooptcopyout(sopt, buf, len + 1);
1792                         break;
1793                 case TCP_KEEPIDLE:
1794                 case TCP_KEEPINTVL:
1795                 case TCP_KEEPINIT:
1796                 case TCP_KEEPCNT:
1797                         switch (sopt->sopt_name) {
1798                         case TCP_KEEPIDLE:
1799                                 ui = tp->t_keepidle / hz;
1800                                 break;
1801                         case TCP_KEEPINTVL:
1802                                 ui = tp->t_keepintvl / hz;
1803                                 break;
1804                         case TCP_KEEPINIT:
1805                                 ui = tp->t_keepinit / hz;
1806                                 break;
1807                         case TCP_KEEPCNT:
1808                                 ui = tp->t_keepcnt;
1809                                 break;
1810                         }
1811                         INP_WUNLOCK(inp);
1812                         error = sooptcopyout(sopt, &ui, sizeof(ui));
1813                         break;
1814 #ifdef TCPPCAP
1815                 case TCP_PCAP_OUT:
1816                 case TCP_PCAP_IN:
1817                         optval = tcp_pcap_get_sock_max(TCP_PCAP_OUT ?
1818                                         &(tp->t_outpkts) : &(tp->t_inpkts));
1819                         INP_WUNLOCK(inp);
1820                         error = sooptcopyout(sopt, &optval, sizeof optval);
1821                         break;
1822 #endif
1823
1824 #ifdef TCP_RFC7413
1825                 case TCP_FASTOPEN:
1826                         optval = tp->t_flags & TF_FASTOPEN;
1827                         INP_WUNLOCK(inp);
1828                         error = sooptcopyout(sopt, &optval, sizeof optval);
1829                         break;
1830 #endif
1831                 default:
1832                         INP_WUNLOCK(inp);
1833                         error = ENOPROTOOPT;
1834                         break;
1835                 }
1836                 break;
1837         }
1838         return (error);
1839 }
1840 #undef INP_WLOCK_RECHECK
1841
1842 /*
1843  * Attach TCP protocol to socket, allocating
1844  * internet protocol control block, tcp control block,
1845  * bufer space, and entering LISTEN state if to accept connections.
1846  */
1847 static int
1848 tcp_attach(struct socket *so)
1849 {
1850         struct tcpcb *tp;
1851         struct inpcb *inp;
1852         int error;
1853
1854         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1855                 error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
1856                 if (error)
1857                         return (error);
1858         }
1859         so->so_rcv.sb_flags |= SB_AUTOSIZE;
1860         so->so_snd.sb_flags |= SB_AUTOSIZE;
1861         INP_INFO_RLOCK(&V_tcbinfo);
1862         error = in_pcballoc(so, &V_tcbinfo);
1863         if (error) {
1864                 INP_INFO_RUNLOCK(&V_tcbinfo);
1865                 return (error);
1866         }
1867         inp = sotoinpcb(so);
1868 #ifdef INET6
1869         if (inp->inp_vflag & INP_IPV6PROTO) {
1870                 inp->inp_vflag |= INP_IPV6;
1871                 inp->in6p_hops = -1;    /* use kernel default */
1872         }
1873         else
1874 #endif
1875         inp->inp_vflag |= INP_IPV4;
1876         tp = tcp_newtcpcb(inp);
1877         if (tp == NULL) {
1878                 in_pcbdetach(inp);
1879                 in_pcbfree(inp);
1880                 INP_INFO_RUNLOCK(&V_tcbinfo);
1881                 return (ENOBUFS);
1882         }
1883         tp->t_state = TCPS_CLOSED;
1884         INP_WUNLOCK(inp);
1885         INP_INFO_RUNLOCK(&V_tcbinfo);
1886         TCPSTATES_INC(TCPS_CLOSED);
1887         return (0);
1888 }
1889
1890 /*
1891  * Initiate (or continue) disconnect.
1892  * If embryonic state, just send reset (once).
1893  * If in ``let data drain'' option and linger null, just drop.
1894  * Otherwise (hard), mark socket disconnecting and drop
1895  * current input data; switch states based on user close, and
1896  * send segment to peer (with FIN).
1897  */
1898 static void
1899 tcp_disconnect(struct tcpcb *tp)
1900 {
1901         struct inpcb *inp = tp->t_inpcb;
1902         struct socket *so = inp->inp_socket;
1903
1904         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1905         INP_WLOCK_ASSERT(inp);
1906
1907         /*
1908          * Neither tcp_close() nor tcp_drop() should return NULL, as the
1909          * socket is still open.
1910          */
1911         if (tp->t_state < TCPS_ESTABLISHED) {
1912                 tp = tcp_close(tp);
1913                 KASSERT(tp != NULL,
1914                     ("tcp_disconnect: tcp_close() returned NULL"));
1915         } else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
1916                 tp = tcp_drop(tp, 0);
1917                 KASSERT(tp != NULL,
1918                     ("tcp_disconnect: tcp_drop() returned NULL"));
1919         } else {
1920                 soisdisconnecting(so);
1921                 sbflush(&so->so_rcv);
1922                 tcp_usrclosed(tp);
1923                 if (!(inp->inp_flags & INP_DROPPED))
1924                         tp->t_fb->tfb_tcp_output(tp);
1925         }
1926 }
1927
1928 /*
1929  * User issued close, and wish to trail through shutdown states:
1930  * if never received SYN, just forget it.  If got a SYN from peer,
1931  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
1932  * If already got a FIN from peer, then almost done; go to LAST_ACK
1933  * state.  In all other cases, have already sent FIN to peer (e.g.
1934  * after PRU_SHUTDOWN), and just have to play tedious game waiting
1935  * for peer to send FIN or not respond to keep-alives, etc.
1936  * We can let the user exit from the close as soon as the FIN is acked.
1937  */
1938 static void
1939 tcp_usrclosed(struct tcpcb *tp)
1940 {
1941
1942         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1943         INP_WLOCK_ASSERT(tp->t_inpcb);
1944
1945         switch (tp->t_state) {
1946         case TCPS_LISTEN:
1947 #ifdef TCP_OFFLOAD
1948                 tcp_offload_listen_stop(tp);
1949 #endif
1950                 tcp_state_change(tp, TCPS_CLOSED);
1951                 /* FALLTHROUGH */
1952         case TCPS_CLOSED:
1953                 tp = tcp_close(tp);
1954                 /*
1955                  * tcp_close() should never return NULL here as the socket is
1956                  * still open.
1957                  */
1958                 KASSERT(tp != NULL,
1959                     ("tcp_usrclosed: tcp_close() returned NULL"));
1960                 break;
1961
1962         case TCPS_SYN_SENT:
1963         case TCPS_SYN_RECEIVED:
1964                 tp->t_flags |= TF_NEEDFIN;
1965                 break;
1966
1967         case TCPS_ESTABLISHED:
1968                 tcp_state_change(tp, TCPS_FIN_WAIT_1);
1969                 break;
1970
1971         case TCPS_CLOSE_WAIT:
1972                 tcp_state_change(tp, TCPS_LAST_ACK);
1973                 break;
1974         }
1975         if (tp->t_state >= TCPS_FIN_WAIT_2) {
1976                 soisdisconnected(tp->t_inpcb->inp_socket);
1977                 /* Prevent the connection hanging in FIN_WAIT_2 forever. */
1978                 if (tp->t_state == TCPS_FIN_WAIT_2) {
1979                         int timeout;
1980
1981                         timeout = (tcp_fast_finwait2_recycle) ?
1982                             tcp_finwait2_timeout : TP_MAXIDLE(tp);
1983                         tcp_timer_activate(tp, TT_2MSL, timeout);
1984                 }
1985         }
1986 }
1987
1988 #ifdef DDB
1989 static void
1990 db_print_indent(int indent)
1991 {
1992         int i;
1993
1994         for (i = 0; i < indent; i++)
1995                 db_printf(" ");
1996 }
1997
1998 static void
1999 db_print_tstate(int t_state)
2000 {
2001
2002         switch (t_state) {
2003         case TCPS_CLOSED:
2004                 db_printf("TCPS_CLOSED");
2005                 return;
2006
2007         case TCPS_LISTEN:
2008                 db_printf("TCPS_LISTEN");
2009                 return;
2010
2011         case TCPS_SYN_SENT:
2012                 db_printf("TCPS_SYN_SENT");
2013                 return;
2014
2015         case TCPS_SYN_RECEIVED:
2016                 db_printf("TCPS_SYN_RECEIVED");
2017                 return;
2018
2019         case TCPS_ESTABLISHED:
2020                 db_printf("TCPS_ESTABLISHED");
2021                 return;
2022
2023         case TCPS_CLOSE_WAIT:
2024                 db_printf("TCPS_CLOSE_WAIT");
2025                 return;
2026
2027         case TCPS_FIN_WAIT_1:
2028                 db_printf("TCPS_FIN_WAIT_1");
2029                 return;
2030
2031         case TCPS_CLOSING:
2032                 db_printf("TCPS_CLOSING");
2033                 return;
2034
2035         case TCPS_LAST_ACK:
2036                 db_printf("TCPS_LAST_ACK");
2037                 return;
2038
2039         case TCPS_FIN_WAIT_2:
2040                 db_printf("TCPS_FIN_WAIT_2");
2041                 return;
2042
2043         case TCPS_TIME_WAIT:
2044                 db_printf("TCPS_TIME_WAIT");
2045                 return;
2046
2047         default:
2048                 db_printf("unknown");
2049                 return;
2050         }
2051 }
2052
2053 static void
2054 db_print_tflags(u_int t_flags)
2055 {
2056         int comma;
2057
2058         comma = 0;
2059         if (t_flags & TF_ACKNOW) {
2060                 db_printf("%sTF_ACKNOW", comma ? ", " : "");
2061                 comma = 1;
2062         }
2063         if (t_flags & TF_DELACK) {
2064                 db_printf("%sTF_DELACK", comma ? ", " : "");
2065                 comma = 1;
2066         }
2067         if (t_flags & TF_NODELAY) {
2068                 db_printf("%sTF_NODELAY", comma ? ", " : "");
2069                 comma = 1;
2070         }
2071         if (t_flags & TF_NOOPT) {
2072                 db_printf("%sTF_NOOPT", comma ? ", " : "");
2073                 comma = 1;
2074         }
2075         if (t_flags & TF_SENTFIN) {
2076                 db_printf("%sTF_SENTFIN", comma ? ", " : "");
2077                 comma = 1;
2078         }
2079         if (t_flags & TF_REQ_SCALE) {
2080                 db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2081                 comma = 1;
2082         }
2083         if (t_flags & TF_RCVD_SCALE) {
2084                 db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2085                 comma = 1;
2086         }
2087         if (t_flags & TF_REQ_TSTMP) {
2088                 db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2089                 comma = 1;
2090         }
2091         if (t_flags & TF_RCVD_TSTMP) {
2092                 db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2093                 comma = 1;
2094         }
2095         if (t_flags & TF_SACK_PERMIT) {
2096                 db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2097                 comma = 1;
2098         }
2099         if (t_flags & TF_NEEDSYN) {
2100                 db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2101                 comma = 1;
2102         }
2103         if (t_flags & TF_NEEDFIN) {
2104                 db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2105                 comma = 1;
2106         }
2107         if (t_flags & TF_NOPUSH) {
2108                 db_printf("%sTF_NOPUSH", comma ? ", " : "");
2109                 comma = 1;
2110         }
2111         if (t_flags & TF_MORETOCOME) {
2112                 db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2113                 comma = 1;
2114         }
2115         if (t_flags & TF_LQ_OVERFLOW) {
2116                 db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");
2117                 comma = 1;
2118         }
2119         if (t_flags & TF_LASTIDLE) {
2120                 db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2121                 comma = 1;
2122         }
2123         if (t_flags & TF_RXWIN0SENT) {
2124                 db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2125                 comma = 1;
2126         }
2127         if (t_flags & TF_FASTRECOVERY) {
2128                 db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
2129                 comma = 1;
2130         }
2131         if (t_flags & TF_CONGRECOVERY) {
2132                 db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
2133                 comma = 1;
2134         }
2135         if (t_flags & TF_WASFRECOVERY) {
2136                 db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
2137                 comma = 1;
2138         }
2139         if (t_flags & TF_SIGNATURE) {
2140                 db_printf("%sTF_SIGNATURE", comma ? ", " : "");
2141                 comma = 1;
2142         }
2143         if (t_flags & TF_FORCEDATA) {
2144                 db_printf("%sTF_FORCEDATA", comma ? ", " : "");
2145                 comma = 1;
2146         }
2147         if (t_flags & TF_TSO) {
2148                 db_printf("%sTF_TSO", comma ? ", " : "");
2149                 comma = 1;
2150         }
2151         if (t_flags & TF_ECN_PERMIT) {
2152                 db_printf("%sTF_ECN_PERMIT", comma ? ", " : "");
2153                 comma = 1;
2154         }
2155         if (t_flags & TF_FASTOPEN) {
2156                 db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2157                 comma = 1;
2158         }
2159 }
2160
2161 static void
2162 db_print_toobflags(char t_oobflags)
2163 {
2164         int comma;
2165
2166         comma = 0;
2167         if (t_oobflags & TCPOOB_HAVEDATA) {
2168                 db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
2169                 comma = 1;
2170         }
2171         if (t_oobflags & TCPOOB_HADDATA) {
2172                 db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
2173                 comma = 1;
2174         }
2175 }
2176
2177 static void
2178 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
2179 {
2180
2181         db_print_indent(indent);
2182         db_printf("%s at %p\n", name, tp);
2183
2184         indent += 2;
2185
2186         db_print_indent(indent);
2187         db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
2188            LIST_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
2189
2190         db_print_indent(indent);
2191         db_printf("tt_rexmt: %p   tt_persist: %p   tt_keep: %p\n",
2192             &tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);
2193
2194         db_print_indent(indent);
2195         db_printf("tt_2msl: %p   tt_delack: %p   t_inpcb: %p\n", &tp->t_timers->tt_2msl,
2196             &tp->t_timers->tt_delack, tp->t_inpcb);
2197
2198         db_print_indent(indent);
2199         db_printf("t_state: %d (", tp->t_state);
2200         db_print_tstate(tp->t_state);
2201         db_printf(")\n");
2202
2203         db_print_indent(indent);
2204         db_printf("t_flags: 0x%x (", tp->t_flags);
2205         db_print_tflags(tp->t_flags);
2206         db_printf(")\n");
2207
2208         db_print_indent(indent);
2209         db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: x0%08x\n",
2210             tp->snd_una, tp->snd_max, tp->snd_nxt);
2211
2212         db_print_indent(indent);
2213         db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
2214            tp->snd_up, tp->snd_wl1, tp->snd_wl2);
2215
2216         db_print_indent(indent);
2217         db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
2218             tp->iss, tp->irs, tp->rcv_nxt);
2219
2220         db_print_indent(indent);
2221         db_printf("rcv_adv: 0x%08x   rcv_wnd: %lu   rcv_up: 0x%08x\n",
2222             tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
2223
2224         db_print_indent(indent);
2225         db_printf("snd_wnd: %lu   snd_cwnd: %lu\n",
2226            tp->snd_wnd, tp->snd_cwnd);
2227
2228         db_print_indent(indent);
2229         db_printf("snd_ssthresh: %lu   snd_recover: "
2230             "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
2231
2232         db_print_indent(indent);
2233         db_printf("t_rcvtime: %u   t_startime: %u\n",
2234             tp->t_rcvtime, tp->t_starttime);
2235
2236         db_print_indent(indent);
2237         db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
2238             tp->t_rtttime, tp->t_rtseq);
2239
2240         db_print_indent(indent);
2241         db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
2242             tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
2243
2244         db_print_indent(indent);
2245         db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u   "
2246             "t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,
2247             tp->t_rttbest);
2248
2249         db_print_indent(indent);
2250         db_printf("t_rttupdated: %lu   max_sndwnd: %lu   t_softerror: %d\n",
2251             tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
2252
2253         db_print_indent(indent);
2254         db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
2255         db_print_toobflags(tp->t_oobflags);
2256         db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
2257
2258         db_print_indent(indent);
2259         db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
2260             tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
2261
2262         db_print_indent(indent);
2263         db_printf("ts_recent: %u   ts_recent_age: %u\n",
2264             tp->ts_recent, tp->ts_recent_age);
2265
2266         db_print_indent(indent);
2267         db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
2268             "%lu\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
2269
2270         db_print_indent(indent);
2271         db_printf("snd_ssthresh_prev: %lu   snd_recover_prev: 0x%08x   "
2272             "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
2273             tp->snd_recover_prev, tp->t_badrxtwin);
2274
2275         db_print_indent(indent);
2276         db_printf("snd_numholes: %d  snd_holes first: %p\n",
2277             tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
2278
2279         db_print_indent(indent);
2280         db_printf("snd_fack: 0x%08x   rcv_numsacks: %d   sack_newdata: "
2281             "0x%08x\n", tp->snd_fack, tp->rcv_numsacks, tp->sack_newdata);
2282
2283         /* Skip sackblks, sackhint. */
2284
2285         db_print_indent(indent);
2286         db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
2287             tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
2288 }
2289
2290 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
2291 {
2292         struct tcpcb *tp;
2293
2294         if (!have_addr) {
2295                 db_printf("usage: show tcpcb <addr>\n");
2296                 return;
2297         }
2298         tp = (struct tcpcb *)addr;
2299
2300         db_print_tcpcb(tp, "tcpcb", 0);
2301 }
2302 #endif