sys/netinet/tcp_usrreq.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1988, 1993
   3  *      The Regents of the University of California.
   4  * Copyright (c) 2006-2007 Robert N. M. Watson
   5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
   6  * All rights reserved.
   7  *
   8  * Portions of this software were developed by Robert N. M. Watson under
   9  * contract to Juniper Networks, Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 4. Neither the name of the University nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  *
  35  *      From: @(#)tcp_usrreq.c  8.2 (Berkeley) 1/3/94
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include "opt_ddb.h"
  42 #include "opt_inet.h"
  43 #include "opt_inet6.h"
  44 #include "opt_tcpdebug.h"
  45
  46 #include <sys/param.h>
  47 #include <sys/systm.h>
  48 #include <sys/limits.h>
  49 #include <sys/malloc.h>
  50 #include <sys/refcount.h>
  51 #include <sys/kernel.h>
  52 #include <sys/sysctl.h>
  53 #include <sys/mbuf.h>
  54 #ifdef INET6
  55 #include <sys/domain.h>
  56 #endif /* INET6 */
  57 #include <sys/socket.h>
  58 #include <sys/socketvar.h>
  59 #include <sys/protosw.h>
  60 #include <sys/proc.h>
  61 #include <sys/jail.h>
  62
  63 #ifdef DDB
  64 #include <ddb/ddb.h>
  65 #endif
  66
  67 #include <net/if.h>
  68 #include <net/if_var.h>
  69 #include <net/route.h>
  70 #include <net/vnet.h>
  71
  72 #include <netinet/in.h>
  73 #include <netinet/in_kdtrace.h>
  74 #include <netinet/in_pcb.h>
  75 #include <netinet/in_systm.h>
  76 #include <netinet/in_var.h>
  77 #include <netinet/ip_var.h>
  78 #ifdef INET6
  79 #include <netinet/ip6.h>
  80 #include <netinet6/in6_pcb.h>
  81 #include <netinet6/ip6_var.h>
  82 #include <netinet6/scope6_var.h>
  83 #endif
  84 #ifdef TCP_RFC7413
  85 #include <netinet/tcp_fastopen.h>
  86 #endif
  87 #include <netinet/tcp.h>
  88 #include <netinet/tcp_fsm.h>
  89 #include <netinet/tcp_seq.h>
  90 #include <netinet/tcp_timer.h>
  91 #include <netinet/tcp_var.h>
  92 #include <netinet/tcpip.h>
  93 #include <netinet/cc/cc.h>
  94 #ifdef TCPPCAP
  95 #include <netinet/tcp_pcap.h>
  96 #endif
  97 #ifdef TCPDEBUG
  98 #include <netinet/tcp_debug.h>
  99 #endif
 100 #ifdef TCP_OFFLOAD
 101 #include <netinet/tcp_offload.h>
 102 #endif
 103
 104 /*
 105  * TCP protocol interface to socket abstraction.
 106  */
 107 static int      tcp_attach(struct socket *);
 108 #ifdef INET
 109 static int      tcp_connect(struct tcpcb *, struct sockaddr *,
 110                     struct thread *td);
 111 #endif /* INET */
 112 #ifdef INET6
 113 static int      tcp6_connect(struct tcpcb *, struct sockaddr *,
 114                     struct thread *td);
 115 #endif /* INET6 */
 116 static void     tcp_disconnect(struct tcpcb *);
 117 static void     tcp_usrclosed(struct tcpcb *);
 118 static void     tcp_fill_info(struct tcpcb *, struct tcp_info *);
 119
 120 #ifdef TCPDEBUG
 121 #define TCPDEBUG0       int ostate = 0
 122 #define TCPDEBUG1()     ostate = tp ? tp->t_state : 0
 123 #define TCPDEBUG2(req)  if (tp && (so->so_options & SO_DEBUG)) \
 124                                 tcp_trace(TA_USER, ostate, tp, 0, 0, req)
 125 #else
 126 #define TCPDEBUG0
 127 #define TCPDEBUG1()
 128 #define TCPDEBUG2(req)
 129 #endif
 130
 131 /*
 132  * TCP attaches to socket via pru_attach(), reserving space,
 133  * and an internet control block.
 134  */
 135 static int
 136 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
 137 {
 138         struct inpcb *inp;
 139         struct tcpcb *tp = NULL;
 140         int error;
 141         TCPDEBUG0;
 142
 143         inp = sotoinpcb(so);
 144         KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
 145         TCPDEBUG1();
 146
 147         error = tcp_attach(so);
 148         if (error)
 149                 goto out;
 150
 151         if ((so->so_options & SO_LINGER) && so->so_linger == 0)
 152                 so->so_linger = TCP_LINGERTIME;
 153
 154         inp = sotoinpcb(so);
 155         tp = intotcpcb(inp);
 156 out:
 157         TCPDEBUG2(PRU_ATTACH);
 158         TCP_PROBE2(debug__user, tp, PRU_ATTACH);
 159         return error;
 160 }
 161
 162 /*
 163  * tcp_detach is called when the socket layer loses its final reference
 164  * to the socket, be it a file descriptor reference, a reference from TCP,
 165  * etc.  At this point, there is only one case in which we will keep around
 166  * inpcb state: time wait.
 167  *
 168  * This function can probably be re-absorbed back into tcp_usr_detach() now
 169  * that there is a single detach path.
 170  */
 171 static void
 172 tcp_detach(struct socket *so, struct inpcb *inp)
 173 {
 174         struct tcpcb *tp;
 175
 176         INP_INFO_LOCK_ASSERT(&V_tcbinfo);
 177         INP_WLOCK_ASSERT(inp);
 178
 179         KASSERT(so->so_pcb == inp, ("tcp_detach: so_pcb != inp"));
 180         KASSERT(inp->inp_socket == so, ("tcp_detach: inp_socket != so"));
 181
 182         tp = intotcpcb(inp);
 183
 184         if (inp->inp_flags & INP_TIMEWAIT) {
 185                 /*
 186                  * There are two cases to handle: one in which the time wait
 187                  * state is being discarded (INP_DROPPED), and one in which
 188                  * this connection will remain in timewait.  In the former,
 189                  * it is time to discard all state (except tcptw, which has
 190                  * already been discarded by the timewait close code, which
 191                  * should be further up the call stack somewhere).  In the
 192                  * latter case, we detach from the socket, but leave the pcb
 193                  * present until timewait ends.
 194                  *
 195                  * XXXRW: Would it be cleaner to free the tcptw here?
 196                  *
 197                  * Astute question indeed, from twtcp perspective there are
 198                  * three cases to consider:
 199                  *
 200                  * #1 tcp_detach is called at tcptw creation time by
 201                  *  tcp_twstart, then do not discard the newly created tcptw
 202                  *  and leave inpcb present until timewait ends
 203                  * #2 tcp_detach is called at timewait end (or reuse) by
 204                  *  tcp_twclose, then the tcptw has already been discarded
 205                  *  (or reused) and inpcb is freed here
 206                  * #3 tcp_detach is called() after timewait ends (or reuse)
 207                  *  (e.g. by soclose), then tcptw has already been discarded
 208                  *  (or reused) and inpcb is freed here
 209                  *
 210                  *  In all three cases the tcptw should not be freed here.
 211                  */
 212                 if (inp->inp_flags & INP_DROPPED) {
 213                         KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "
 214                             "INP_DROPPED && tp != NULL"));
 215                         in_pcbdetach(inp);
 216                         in_pcbfree(inp);
 217                 } else {
 218                         in_pcbdetach(inp);
 219                         INP_WUNLOCK(inp);
 220                 }
 221         } else {
 222                 /*
 223                  * If the connection is not in timewait, we consider two
 224                  * two conditions: one in which no further processing is
 225                  * necessary (dropped || embryonic), and one in which TCP is
 226                  * not yet done, but no longer requires the socket, so the
 227                  * pcb will persist for the time being.
 228                  *
 229                  * XXXRW: Does the second case still occur?
 230                  */
 231                 if (inp->inp_flags & INP_DROPPED ||
 232                     tp->t_state < TCPS_SYN_SENT) {
 233                         tcp_discardcb(tp);
 234                         in_pcbdetach(inp);
 235                         in_pcbfree(inp);
 236                 } else {
 237                         in_pcbdetach(inp);
 238                         INP_WUNLOCK(inp);
 239                 }
 240         }
 241 }
 242
 243 /*
 244  * pru_detach() detaches the TCP protocol from the socket.
 245  * If the protocol state is non-embryonic, then can't
 246  * do this directly: have to initiate a pru_disconnect(),
 247  * which may finish later; embryonic TCB's can just
 248  * be discarded here.
 249  */
 250 static void
 251 tcp_usr_detach(struct socket *so)
 252 {
 253         struct inpcb *inp;
 254         int rlock = 0;
 255
 256         inp = sotoinpcb(so);
 257         KASSERT(inp != NULL, ("tcp_usr_detach: inp == NULL"));
 258         if (!INP_INFO_WLOCKED(&V_tcbinfo)) {
 259                 INP_INFO_RLOCK(&V_tcbinfo);
 260                 rlock = 1;
 261         }
 262         INP_WLOCK(inp);
 263         KASSERT(inp->inp_socket != NULL,
 264             ("tcp_usr_detach: inp_socket == NULL"));
 265         tcp_detach(so, inp);
 266         if (rlock)
 267                 INP_INFO_RUNLOCK(&V_tcbinfo);
 268 }
 269
 270 #ifdef INET
 271 /*
 272  * Give the socket an address.
 273  */
 274 static int
 275 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 276 {
 277         int error = 0;
 278         struct inpcb *inp;
 279         struct tcpcb *tp = NULL;
 280         struct sockaddr_in *sinp;
 281
 282         sinp = (struct sockaddr_in *)nam;
 283         if (nam->sa_len != sizeof (*sinp))
 284                 return (EINVAL);
 285         /*
 286          * Must check for multicast addresses and disallow binding
 287          * to them.
 288          */
 289         if (sinp->sin_family == AF_INET &&
 290             IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 291                 return (EAFNOSUPPORT);
 292
 293         TCPDEBUG0;
 294         inp = sotoinpcb(so);
 295         KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
 296         INP_WLOCK(inp);
 297         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 298                 error = EINVAL;
 299                 goto out;
 300         }
 301         tp = intotcpcb(inp);
 302         TCPDEBUG1();
 303         INP_HASH_WLOCK(&V_tcbinfo);
 304         error = in_pcbbind(inp, nam, td->td_ucred);
 305         INP_HASH_WUNLOCK(&V_tcbinfo);
 306 out:
 307         TCPDEBUG2(PRU_BIND);
 308         TCP_PROBE2(debug__user, tp, PRU_BIND);
 309         INP_WUNLOCK(inp);
 310
 311         return (error);
 312 }
 313 #endif /* INET */
 314
 315 #ifdef INET6
 316 static int
 317 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 318 {
 319         int error = 0;
 320         struct inpcb *inp;
 321         struct tcpcb *tp = NULL;
 322         struct sockaddr_in6 *sin6p;
 323
 324         sin6p = (struct sockaddr_in6 *)nam;
 325         if (nam->sa_len != sizeof (*sin6p))
 326                 return (EINVAL);
 327         /*
 328          * Must check for multicast addresses and disallow binding
 329          * to them.
 330          */
 331         if (sin6p->sin6_family == AF_INET6 &&
 332             IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 333                 return (EAFNOSUPPORT);
 334
 335         TCPDEBUG0;
 336         inp = sotoinpcb(so);
 337         KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
 338         INP_WLOCK(inp);
 339         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 340                 error = EINVAL;
 341                 goto out;
 342         }
 343         tp = intotcpcb(inp);
 344         TCPDEBUG1();
 345         INP_HASH_WLOCK(&V_tcbinfo);
 346         inp->inp_vflag &= ~INP_IPV4;
 347         inp->inp_vflag |= INP_IPV6;
 348 #ifdef INET
 349         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 350                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6p->sin6_addr))
 351                         inp->inp_vflag |= INP_IPV4;
 352                 else if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 353                         struct sockaddr_in sin;
 354
 355                         in6_sin6_2_sin(&sin, sin6p);
 356                         inp->inp_vflag |= INP_IPV4;
 357                         inp->inp_vflag &= ~INP_IPV6;
 358                         error = in_pcbbind(inp, (struct sockaddr *)&sin,
 359                             td->td_ucred);
 360                         INP_HASH_WUNLOCK(&V_tcbinfo);
 361                         goto out;
 362                 }
 363         }
 364 #endif
 365         error = in6_pcbbind(inp, nam, td->td_ucred);
 366         INP_HASH_WUNLOCK(&V_tcbinfo);
 367 out:
 368         TCPDEBUG2(PRU_BIND);
 369         TCP_PROBE2(debug__user, tp, PRU_BIND);
 370         INP_WUNLOCK(inp);
 371         return (error);
 372 }
 373 #endif /* INET6 */
 374
 375 #ifdef INET
 376 /*
 377  * Prepare to accept connections.
 378  */
 379 static int
 380 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
 381 {
 382         int error = 0;
 383         struct inpcb *inp;
 384         struct tcpcb *tp = NULL;
 385
 386         TCPDEBUG0;
 387         inp = sotoinpcb(so);
 388         KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
 389         INP_WLOCK(inp);
 390         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 391                 error = EINVAL;
 392                 goto out;
 393         }
 394         tp = intotcpcb(inp);
 395         TCPDEBUG1();
 396         SOCK_LOCK(so);
 397         error = solisten_proto_check(so);
 398         INP_HASH_WLOCK(&V_tcbinfo);
 399         if (error == 0 && inp->inp_lport == 0)
 400                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 401         INP_HASH_WUNLOCK(&V_tcbinfo);
 402         if (error == 0) {
 403                 tcp_state_change(tp, TCPS_LISTEN);
 404                 solisten_proto(so, backlog);
 405 #ifdef TCP_OFFLOAD
 406                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 407                         tcp_offload_listen_start(tp);
 408 #endif
 409         }
 410         SOCK_UNLOCK(so);
 411
 412 #ifdef TCP_RFC7413
 413         if (tp->t_flags & TF_FASTOPEN)
 414                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 415 #endif
 416 out:
 417         TCPDEBUG2(PRU_LISTEN);
 418         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 419         INP_WUNLOCK(inp);
 420         return (error);
 421 }
 422 #endif /* INET */
 423
 424 #ifdef INET6
 425 static int
 426 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
 427 {
 428         int error = 0;
 429         struct inpcb *inp;
 430         struct tcpcb *tp = NULL;
 431
 432         TCPDEBUG0;
 433         inp = sotoinpcb(so);
 434         KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
 435         INP_WLOCK(inp);
 436         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 437                 error = EINVAL;
 438                 goto out;
 439         }
 440         tp = intotcpcb(inp);
 441         TCPDEBUG1();
 442         SOCK_LOCK(so);
 443         error = solisten_proto_check(so);
 444         INP_HASH_WLOCK(&V_tcbinfo);
 445         if (error == 0 && inp->inp_lport == 0) {
 446                 inp->inp_vflag &= ~INP_IPV4;
 447                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
 448                         inp->inp_vflag |= INP_IPV4;
 449                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 450         }
 451         INP_HASH_WUNLOCK(&V_tcbinfo);
 452         if (error == 0) {
 453                 tcp_state_change(tp, TCPS_LISTEN);
 454                 solisten_proto(so, backlog);
 455 #ifdef TCP_OFFLOAD
 456                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 457                         tcp_offload_listen_start(tp);
 458 #endif
 459         }
 460         SOCK_UNLOCK(so);
 461
 462 #ifdef TCP_RFC7413
 463         if (tp->t_flags & TF_FASTOPEN)
 464                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 465 #endif
 466 out:
 467         TCPDEBUG2(PRU_LISTEN);
 468         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 469         INP_WUNLOCK(inp);
 470         return (error);
 471 }
 472 #endif /* INET6 */
 473
 474 #ifdef INET
 475 /*
 476  * Initiate connection to peer.
 477  * Create a template for use in transmissions on this connection.
 478  * Enter SYN_SENT state, and mark socket as connecting.
 479  * Start keep-alive timer, and seed output sequence space.
 480  * Send initial segment on connection.
 481  */
 482 static int
 483 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 484 {
 485         int error = 0;
 486         struct inpcb *inp;
 487         struct tcpcb *tp = NULL;
 488         struct sockaddr_in *sinp;
 489
 490         sinp = (struct sockaddr_in *)nam;
 491         if (nam->sa_len != sizeof (*sinp))
 492                 return (EINVAL);
 493         /*
 494          * Must disallow TCP ``connections'' to multicast addresses.
 495          */
 496         if (sinp->sin_family == AF_INET
 497             && IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 498                 return (EAFNOSUPPORT);
 499         if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
 500                 return (error);
 501
 502         TCPDEBUG0;
 503         inp = sotoinpcb(so);
 504         KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
 505         INP_WLOCK(inp);
 506         if (inp->inp_flags & INP_TIMEWAIT) {
 507                 error = EADDRINUSE;
 508                 goto out;
 509         }
 510         if (inp->inp_flags & INP_DROPPED) {
 511                 error = ECONNREFUSED;
 512                 goto out;
 513         }
 514         tp = intotcpcb(inp);
 515         TCPDEBUG1();
 516         if ((error = tcp_connect(tp, nam, td)) != 0)
 517                 goto out;
 518 #ifdef TCP_OFFLOAD
 519         if (registered_toedevs > 0 &&
 520             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 521             (error = tcp_offload_connect(so, nam)) == 0)
 522                 goto out;
 523 #endif
 524         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 525         error = tp->t_fb->tfb_tcp_output(tp);
 526 out:
 527         TCPDEBUG2(PRU_CONNECT);
 528         INP_WUNLOCK(inp);
 529         return (error);
 530 }
 531 #endif /* INET */
 532
 533 #ifdef INET6
 534 static int
 535 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 536 {
 537         int error = 0;
 538         struct inpcb *inp;
 539         struct tcpcb *tp = NULL;
 540         struct sockaddr_in6 *sin6p;
 541
 542         TCPDEBUG0;
 543
 544         sin6p = (struct sockaddr_in6 *)nam;
 545         if (nam->sa_len != sizeof (*sin6p))
 546                 return (EINVAL);
 547         /*
 548          * Must disallow TCP ``connections'' to multicast addresses.
 549          */
 550         if (sin6p->sin6_family == AF_INET6
 551             && IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 552                 return (EAFNOSUPPORT);
 553
 554         inp = sotoinpcb(so);
 555         KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
 556         INP_WLOCK(inp);
 557         if (inp->inp_flags & INP_TIMEWAIT) {
 558                 error = EADDRINUSE;
 559                 goto out;
 560         }
 561         if (inp->inp_flags & INP_DROPPED) {
 562                 error = ECONNREFUSED;
 563                 goto out;
 564         }
 565         tp = intotcpcb(inp);
 566         TCPDEBUG1();
 567 #ifdef INET
 568         /*
 569          * XXXRW: Some confusion: V4/V6 flags relate to binding, and
 570          * therefore probably require the hash lock, which isn't held here.
 571          * Is this a significant problem?
 572          */
 573         if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 574                 struct sockaddr_in sin;
 575
 576                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
 577                         error = EINVAL;
 578                         goto out;
 579                 }
 580
 581                 in6_sin6_2_sin(&sin, sin6p);
 582                 inp->inp_vflag |= INP_IPV4;
 583                 inp->inp_vflag &= ~INP_IPV6;
 584                 if ((error = prison_remote_ip4(td->td_ucred,
 585                     &sin.sin_addr)) != 0)
 586                         goto out;
 587                 if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)
 588                         goto out;
 589 #ifdef TCP_OFFLOAD
 590                 if (registered_toedevs > 0 &&
 591                     (so->so_options & SO_NO_OFFLOAD) == 0 &&
 592                     (error = tcp_offload_connect(so, nam)) == 0)
 593                         goto out;
 594 #endif
 595                 error = tp->t_fb->tfb_tcp_output(tp);
 596                 goto out;
 597         }
 598 #endif
 599         inp->inp_vflag &= ~INP_IPV4;
 600         inp->inp_vflag |= INP_IPV6;
 601         inp->inp_inc.inc_flags |= INC_ISIPV6;
 602         if ((error = prison_remote_ip6(td->td_ucred, &sin6p->sin6_addr)) != 0)
 603                 goto out;
 604         if ((error = tcp6_connect(tp, nam, td)) != 0)
 605                 goto out;
 606 #ifdef TCP_OFFLOAD
 607         if (registered_toedevs > 0 &&
 608             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 609             (error = tcp_offload_connect(so, nam)) == 0)
 610                 goto out;
 611 #endif
 612         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 613         error = tp->t_fb->tfb_tcp_output(tp);
 614
 615 out:
 616         TCPDEBUG2(PRU_CONNECT);
 617         TCP_PROBE2(debug__user, tp, PRU_CONNECT);
 618         INP_WUNLOCK(inp);
 619         return (error);
 620 }
 621 #endif /* INET6 */
 622
 623 /*
 624  * Initiate disconnect from peer.
 625  * If connection never passed embryonic stage, just drop;
 626  * else if don't need to let data drain, then can just drop anyways,
 627  * else have to begin TCP shutdown process: mark socket disconnecting,
 628  * drain unread data, state switch to reflect user close, and
 629  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
 630  * when peer sends FIN and acks ours.
 631  *
 632  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
 633  */
 634 static int
 635 tcp_usr_disconnect(struct socket *so)
 636 {
 637         struct inpcb *inp;
 638         struct tcpcb *tp = NULL;
 639         int error = 0;
 640
 641         TCPDEBUG0;
 642         INP_INFO_RLOCK(&V_tcbinfo);
 643         inp = sotoinpcb(so);
 644         KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
 645         INP_WLOCK(inp);
 646         if (inp->inp_flags & INP_TIMEWAIT)
 647                 goto out;
 648         if (inp->inp_flags & INP_DROPPED) {
 649                 error = ECONNRESET;
 650                 goto out;
 651         }
 652         tp = intotcpcb(inp);
 653         TCPDEBUG1();
 654         tcp_disconnect(tp);
 655 out:
 656         TCPDEBUG2(PRU_DISCONNECT);
 657         TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
 658         INP_WUNLOCK(inp);
 659         INP_INFO_RUNLOCK(&V_tcbinfo);
 660         return (error);
 661 }
 662
 663 #ifdef INET
 664 /*
 665  * Accept a connection.  Essentially all the work is done at higher levels;
 666  * just return the address of the peer, storing through addr.
 667  */
 668 static int
 669 tcp_usr_accept(struct socket *so, struct sockaddr **nam)
 670 {
 671         int error = 0;
 672         struct inpcb *inp = NULL;
 673         struct tcpcb *tp = NULL;
 674         struct in_addr addr;
 675         in_port_t port = 0;
 676         TCPDEBUG0;
 677
 678         if (so->so_state & SS_ISDISCONNECTED)
 679                 return (ECONNABORTED);
 680
 681         inp = sotoinpcb(so);
 682         KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
 683         INP_WLOCK(inp);
 684         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 685                 error = ECONNABORTED;
 686                 goto out;
 687         }
 688         tp = intotcpcb(inp);
 689         TCPDEBUG1();
 690
 691         /*
 692          * We inline in_getpeeraddr and COMMON_END here, so that we can
 693          * copy the data of interest and defer the malloc until after we
 694          * release the lock.
 695          */
 696         port = inp->inp_fport;
 697         addr = inp->inp_faddr;
 698
 699 out:
 700         TCPDEBUG2(PRU_ACCEPT);
 701         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 702         INP_WUNLOCK(inp);
 703         if (error == 0)
 704                 *nam = in_sockaddr(port, &addr);
 705         return error;
 706 }
 707 #endif /* INET */
 708
 709 #ifdef INET6
 710 static int
 711 tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
 712 {
 713         struct inpcb *inp = NULL;
 714         int error = 0;
 715         struct tcpcb *tp = NULL;
 716         struct in_addr addr;
 717         struct in6_addr addr6;
 718         in_port_t port = 0;
 719         int v4 = 0;
 720         TCPDEBUG0;
 721
 722         if (so->so_state & SS_ISDISCONNECTED)
 723                 return (ECONNABORTED);
 724
 725         inp = sotoinpcb(so);
 726         KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
 727         INP_INFO_RLOCK(&V_tcbinfo);
 728         INP_WLOCK(inp);
 729         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 730                 error = ECONNABORTED;
 731                 goto out;
 732         }
 733         tp = intotcpcb(inp);
 734         TCPDEBUG1();
 735
 736         /*
 737          * We inline in6_mapped_peeraddr and COMMON_END here, so that we can
 738          * copy the data of interest and defer the malloc until after we
 739          * release the lock.
 740          */
 741         if (inp->inp_vflag & INP_IPV4) {
 742                 v4 = 1;
 743                 port = inp->inp_fport;
 744                 addr = inp->inp_faddr;
 745         } else {
 746                 port = inp->inp_fport;
 747                 addr6 = inp->in6p_faddr;
 748         }
 749
 750 out:
 751         TCPDEBUG2(PRU_ACCEPT);
 752         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 753         INP_WUNLOCK(inp);
 754         INP_INFO_RUNLOCK(&V_tcbinfo);
 755         if (error == 0) {
 756                 if (v4)
 757                         *nam = in6_v4mapsin6_sockaddr(port, &addr);
 758                 else
 759                         *nam = in6_sockaddr(port, &addr6);
 760         }
 761         return error;
 762 }
 763 #endif /* INET6 */
 764
 765 /*
 766  * Mark the connection as being incapable of further output.
 767  */
 768 static int
 769 tcp_usr_shutdown(struct socket *so)
 770 {
 771         int error = 0;
 772         struct inpcb *inp;
 773         struct tcpcb *tp = NULL;
 774
 775         TCPDEBUG0;
 776         INP_INFO_RLOCK(&V_tcbinfo);
 777         inp = sotoinpcb(so);
 778         KASSERT(inp != NULL, ("inp == NULL"));
 779         INP_WLOCK(inp);
 780         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 781                 error = ECONNRESET;
 782                 goto out;
 783         }
 784         tp = intotcpcb(inp);
 785         TCPDEBUG1();
 786         socantsendmore(so);
 787         tcp_usrclosed(tp);
 788         if (!(inp->inp_flags & INP_DROPPED))
 789                 error = tp->t_fb->tfb_tcp_output(tp);
 790
 791 out:
 792         TCPDEBUG2(PRU_SHUTDOWN);
 793         TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
 794         INP_WUNLOCK(inp);
 795         INP_INFO_RUNLOCK(&V_tcbinfo);
 796
 797         return (error);
 798 }
 799
 800 /*
 801  * After a receive, possibly send window update to peer.
 802  */
 803 static int
 804 tcp_usr_rcvd(struct socket *so, int flags)
 805 {
 806         struct inpcb *inp;
 807         struct tcpcb *tp = NULL;
 808         int error = 0;
 809
 810         TCPDEBUG0;
 811         inp = sotoinpcb(so);
 812         KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
 813         INP_WLOCK(inp);
 814         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 815                 error = ECONNRESET;
 816                 goto out;
 817         }
 818         tp = intotcpcb(inp);
 819         TCPDEBUG1();
 820 #ifdef TCP_RFC7413
 821         /*
 822          * For passively-created TFO connections, don't attempt a window
 823          * update while still in SYN_RECEIVED as this may trigger an early
 824          * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
 825          * application response data, or failing that, when the DELACK timer
 826          * expires.
 827          */
 828         if ((tp->t_flags & TF_FASTOPEN) &&
 829             (tp->t_state == TCPS_SYN_RECEIVED))
 830                 goto out;
 831 #endif
 832 #ifdef TCP_OFFLOAD
 833         if (tp->t_flags & TF_TOE)
 834                 tcp_offload_rcvd(tp);
 835         else
 836 #endif
 837         tp->t_fb->tfb_tcp_output(tp);
 838
 839 out:
 840         TCPDEBUG2(PRU_RCVD);
 841         TCP_PROBE2(debug__user, tp, PRU_RCVD);
 842         INP_WUNLOCK(inp);
 843         return (error);
 844 }
 845
 846 /*
 847  * Do a send by putting data in output queue and updating urgent
 848  * marker if URG set.  Possibly send more data.  Unlike the other
 849  * pru_*() routines, the mbuf chains are our responsibility.  We
 850  * must either enqueue them or free them.  The other pru_* routines
 851  * generally are caller-frees.
 852  */
 853 static int
 854 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
 855     struct sockaddr *nam, struct mbuf *control, struct thread *td)
 856 {
 857         int error = 0;
 858         struct inpcb *inp;
 859         struct tcpcb *tp = NULL;
 860 #ifdef INET6
 861         int isipv6;
 862 #endif
 863         TCPDEBUG0;
 864
 865         /*
 866          * We require the pcbinfo lock if we will close the socket as part of
 867          * this call.
 868          */
 869         if (flags & PRUS_EOF)
 870                 INP_INFO_RLOCK(&V_tcbinfo);
 871         inp = sotoinpcb(so);
 872         KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
 873         INP_WLOCK(inp);
 874         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 875                 if (control)
 876                         m_freem(control);
 877                 /*
 878                  * In case of PRUS_NOTREADY, tcp_usr_ready() is responsible
 879                  * for freeing memory.
 880                  */
 881                 if (m && (flags & PRUS_NOTREADY) == 0)
 882                         m_freem(m);
 883                 error = ECONNRESET;
 884                 goto out;
 885         }
 886 #ifdef INET6
 887         isipv6 = nam && nam->sa_family == AF_INET6;
 888 #endif /* INET6 */
 889         tp = intotcpcb(inp);
 890         TCPDEBUG1();
 891         if (control) {
 892                 /* TCP doesn't do control messages (rights, creds, etc) */
 893                 if (control->m_len) {
 894                         m_freem(control);
 895                         if (m)
 896                                 m_freem(m);
 897                         error = EINVAL;
 898                         goto out;
 899                 }
 900                 m_freem(control);       /* empty control, just free it */
 901         }
 902         if (!(flags & PRUS_OOB)) {
 903                 sbappendstream(&so->so_snd, m, flags);
 904                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 905                         /*
 906                          * Do implied connect if not yet connected,
 907                          * initialize window to default value, and
 908                          * initialize maxseg using peer's cached MSS.
 909                          */
 910 #ifdef INET6
 911                         if (isipv6)
 912                                 error = tcp6_connect(tp, nam, td);
 913 #endif /* INET6 */
 914 #if defined(INET6) && defined(INET)
 915                         else
 916 #endif
 917 #ifdef INET
 918                                 error = tcp_connect(tp, nam, td);
 919 #endif
 920                         if (error)
 921                                 goto out;
 922                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 923                         tcp_mss(tp, -1);
 924                 }
 925                 if (flags & PRUS_EOF) {
 926                         /*
 927                          * Close the send side of the connection after
 928                          * the data is sent.
 929                          */
 930                         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
 931                         socantsendmore(so);
 932                         tcp_usrclosed(tp);
 933                 }
 934                 if (!(inp->inp_flags & INP_DROPPED) &&
 935                     !(flags & PRUS_NOTREADY)) {
 936                         if (flags & PRUS_MORETOCOME)
 937                                 tp->t_flags |= TF_MORETOCOME;
 938                         error = tp->t_fb->tfb_tcp_output(tp);
 939                         if (flags & PRUS_MORETOCOME)
 940                                 tp->t_flags &= ~TF_MORETOCOME;
 941                 }
 942         } else {
 943                 /*
 944                  * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
 945                  */
 946                 SOCKBUF_LOCK(&so->so_snd);
 947                 if (sbspace(&so->so_snd) < -512) {
 948                         SOCKBUF_UNLOCK(&so->so_snd);
 949                         m_freem(m);
 950                         error = ENOBUFS;
 951                         goto out;
 952                 }
 953                 /*
 954                  * According to RFC961 (Assigned Protocols),
 955                  * the urgent pointer points to the last octet
 956                  * of urgent data.  We continue, however,
 957                  * to consider it to indicate the first octet
 958                  * of data past the urgent section.
 959                  * Otherwise, snd_up should be one lower.
 960                  */
 961                 sbappendstream_locked(&so->so_snd, m, flags);
 962                 SOCKBUF_UNLOCK(&so->so_snd);
 963                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 964                         /*
 965                          * Do implied connect if not yet connected,
 966                          * initialize window to default value, and
 967                          * initialize maxseg using peer's cached MSS.
 968                          */
 969 #ifdef INET6
 970                         if (isipv6)
 971                                 error = tcp6_connect(tp, nam, td);
 972 #endif /* INET6 */
 973 #if defined(INET6) && defined(INET)
 974                         else
 975 #endif
 976 #ifdef INET
 977                                 error = tcp_connect(tp, nam, td);
 978 #endif
 979                         if (error)
 980                                 goto out;
 981                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 982                         tcp_mss(tp, -1);
 983                 }
 984                 tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
 985                 if (!(flags & PRUS_NOTREADY)) {
 986                         tp->t_flags |= TF_FORCEDATA;
 987                         error = tp->t_fb->tfb_tcp_output(tp);
 988                         tp->t_flags &= ~TF_FORCEDATA;
 989                 }
 990         }
 991 out:
 992         TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :
 993                   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 994         TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
 995                    ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 996         INP_WUNLOCK(inp);
 997         if (flags & PRUS_EOF)
 998                 INP_INFO_RUNLOCK(&V_tcbinfo);
 999         return (error);
1000 }
1001
1002 static int
1003 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1004 {
1005         struct inpcb *inp;
1006         struct tcpcb *tp;
1007         int error;
1008
1009         inp = sotoinpcb(so);
1010         INP_WLOCK(inp);
1011         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1012                 INP_WUNLOCK(inp);
1013                 for (int i = 0; i < count; i++)
1014                         m = m_free(m);
1015                 return (ECONNRESET);
1016         }
1017         tp = intotcpcb(inp);
1018
1019         SOCKBUF_LOCK(&so->so_snd);
1020         error = sbready(&so->so_snd, m, count);
1021         SOCKBUF_UNLOCK(&so->so_snd);
1022         if (error == 0)
1023                 error = tp->t_fb->tfb_tcp_output(tp);
1024         INP_WUNLOCK(inp);
1025
1026         return (error);
1027 }
1028
1029 /*
1030  * Abort the TCP.  Drop the connection abruptly.
1031  */
1032 static void
1033 tcp_usr_abort(struct socket *so)
1034 {
1035         struct inpcb *inp;
1036         struct tcpcb *tp = NULL;
1037         TCPDEBUG0;
1038
1039         inp = sotoinpcb(so);
1040         KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1041
1042         INP_INFO_RLOCK(&V_tcbinfo);
1043         INP_WLOCK(inp);
1044         KASSERT(inp->inp_socket != NULL,
1045             ("tcp_usr_abort: inp_socket == NULL"));
1046
1047         /*
1048          * If we still have full TCP state, and we're not dropped, drop.
1049          */
1050         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1051             !(inp->inp_flags & INP_DROPPED)) {
1052                 tp = intotcpcb(inp);
1053                 TCPDEBUG1();
1054                 tcp_drop(tp, ECONNABORTED);
1055                 TCPDEBUG2(PRU_ABORT);
1056                 TCP_PROBE2(debug__user, tp, PRU_ABORT);
1057         }
1058         if (!(inp->inp_flags & INP_DROPPED)) {
1059                 SOCK_LOCK(so);
1060                 so->so_state |= SS_PROTOREF;
1061                 SOCK_UNLOCK(so);
1062                 inp->inp_flags |= INP_SOCKREF;
1063         }
1064         INP_WUNLOCK(inp);
1065         INP_INFO_RUNLOCK(&V_tcbinfo);
1066 }
1067
1068 /*
1069  * TCP socket is closed.  Start friendly disconnect.
1070  */
1071 static void
1072 tcp_usr_close(struct socket *so)
1073 {
1074         struct inpcb *inp;
1075         struct tcpcb *tp = NULL;
1076         TCPDEBUG0;
1077
1078         inp = sotoinpcb(so);
1079         KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1080
1081         INP_INFO_RLOCK(&V_tcbinfo);
1082         INP_WLOCK(inp);
1083         KASSERT(inp->inp_socket != NULL,
1084             ("tcp_usr_close: inp_socket == NULL"));
1085
1086         /*
1087          * If we still have full TCP state, and we're not dropped, initiate
1088          * a disconnect.
1089          */
1090         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1091             !(inp->inp_flags & INP_DROPPED)) {
1092                 tp = intotcpcb(inp);
1093                 TCPDEBUG1();
1094                 tcp_disconnect(tp);
1095                 TCPDEBUG2(PRU_CLOSE);
1096                 TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1097         }
1098         if (!(inp->inp_flags & INP_DROPPED)) {
1099                 SOCK_LOCK(so);
1100                 so->so_state |= SS_PROTOREF;
1101                 SOCK_UNLOCK(so);
1102                 inp->inp_flags |= INP_SOCKREF;
1103         }
1104         INP_WUNLOCK(inp);
1105         INP_INFO_RUNLOCK(&V_tcbinfo);
1106 }
1107
1108 /*
1109  * Receive out-of-band data.
1110  */
1111 static int
1112 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1113 {
1114         int error = 0;
1115         struct inpcb *inp;
1116         struct tcpcb *tp = NULL;
1117
1118         TCPDEBUG0;
1119         inp = sotoinpcb(so);
1120         KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1121         INP_WLOCK(inp);
1122         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1123                 error = ECONNRESET;
1124                 goto out;
1125         }
1126         tp = intotcpcb(inp);
1127         TCPDEBUG1();
1128         if ((so->so_oobmark == 0 &&
1129              (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1130             so->so_options & SO_OOBINLINE ||
1131             tp->t_oobflags & TCPOOB_HADDATA) {
1132                 error = EINVAL;
1133                 goto out;
1134         }
1135         if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1136                 error = EWOULDBLOCK;
1137                 goto out;
1138         }
1139         m->m_len = 1;
1140         *mtod(m, caddr_t) = tp->t_iobc;
1141         if ((flags & MSG_PEEK) == 0)
1142                 tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1143
1144 out:
1145         TCPDEBUG2(PRU_RCVOOB);
1146         TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1147         INP_WUNLOCK(inp);
1148         return (error);
1149 }
1150
1151 #ifdef INET
1152 struct pr_usrreqs tcp_usrreqs = {
1153         .pru_abort =            tcp_usr_abort,
1154         .pru_accept =           tcp_usr_accept,
1155         .pru_attach =           tcp_usr_attach,
1156         .pru_bind =             tcp_usr_bind,
1157         .pru_connect =          tcp_usr_connect,
1158         .pru_control =          in_control,
1159         .pru_detach =           tcp_usr_detach,
1160         .pru_disconnect =       tcp_usr_disconnect,
1161         .pru_listen =           tcp_usr_listen,
1162         .pru_peeraddr =         in_getpeeraddr,
1163         .pru_rcvd =             tcp_usr_rcvd,
1164         .pru_rcvoob =           tcp_usr_rcvoob,
1165         .pru_send =             tcp_usr_send,
1166         .pru_ready =            tcp_usr_ready,
1167         .pru_shutdown =         tcp_usr_shutdown,
1168         .pru_sockaddr =         in_getsockaddr,
1169         .pru_sosetlabel =       in_pcbsosetlabel,
1170         .pru_close =            tcp_usr_close,
1171 };
1172 #endif /* INET */
1173
1174 #ifdef INET6
1175 struct pr_usrreqs tcp6_usrreqs = {
1176         .pru_abort =            tcp_usr_abort,
1177         .pru_accept =           tcp6_usr_accept,
1178         .pru_attach =           tcp_usr_attach,
1179         .pru_bind =             tcp6_usr_bind,
1180         .pru_connect =          tcp6_usr_connect,
1181         .pru_control =          in6_control,
1182         .pru_detach =           tcp_usr_detach,
1183         .pru_disconnect =       tcp_usr_disconnect,
1184         .pru_listen =           tcp6_usr_listen,
1185         .pru_peeraddr =         in6_mapped_peeraddr,
1186         .pru_rcvd =             tcp_usr_rcvd,
1187         .pru_rcvoob =           tcp_usr_rcvoob,
1188         .pru_send =             tcp_usr_send,
1189         .pru_ready =            tcp_usr_ready,
1190         .pru_shutdown =         tcp_usr_shutdown,
1191         .pru_sockaddr =         in6_mapped_sockaddr,
1192         .pru_sosetlabel =       in_pcbsosetlabel,
1193         .pru_close =            tcp_usr_close,
1194 };
1195 #endif /* INET6 */
1196
1197 #ifdef INET
1198 /*
1199  * Common subroutine to open a TCP connection to remote host specified
1200  * by struct sockaddr_in in mbuf *nam.  Call in_pcbbind to assign a local
1201  * port number if needed.  Call in_pcbconnect_setup to do the routing and
1202  * to choose a local host address (interface).  If there is an existing
1203  * incarnation of the same connection in TIME-WAIT state and if the remote
1204  * host was sending CC options and if the connection duration was < MSL, then
1205  * truncate the previous TIME-WAIT state and proceed.
1206  * Initialize connection parameters and enter SYN-SENT state.
1207  */
1208 static int
1209 tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1210 {
1211         struct inpcb *inp = tp->t_inpcb, *oinp;
1212         struct socket *so = inp->inp_socket;
1213         struct in_addr laddr;
1214         u_short lport;
1215         int error;
1216
1217         INP_WLOCK_ASSERT(inp);
1218         INP_HASH_WLOCK(&V_tcbinfo);
1219
1220         if (inp->inp_lport == 0) {
1221                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1222                 if (error)
1223                         goto out;
1224         }
1225
1226         /*
1227          * Cannot simply call in_pcbconnect, because there might be an
1228          * earlier incarnation of this same connection still in
1229          * TIME_WAIT state, creating an ADDRINUSE error.
1230          */
1231         laddr = inp->inp_laddr;
1232         lport = inp->inp_lport;
1233         error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,
1234             &inp->inp_faddr.s_addr, &inp->inp_fport, &oinp, td->td_ucred);
1235         if (error && oinp == NULL)
1236                 goto out;
1237         if (oinp) {
1238                 error = EADDRINUSE;
1239                 goto out;
1240         }
1241         inp->inp_laddr = laddr;
1242         in_pcbrehash(inp);
1243         INP_HASH_WUNLOCK(&V_tcbinfo);
1244
1245         /*
1246          * Compute window scaling to request:
1247          * Scale to fit into sweet spot.  See tcp_syncache.c.
1248          * XXX: This should move to tcp_output().
1249          */
1250         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1251             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1252                 tp->request_r_scale++;
1253
1254         soisconnecting(so);
1255         TCPSTAT_INC(tcps_connattempt);
1256         tcp_state_change(tp, TCPS_SYN_SENT);
1257         tp->iss = tcp_new_isn(tp);
1258         tcp_sendseqinit(tp);
1259
1260         return 0;
1261
1262 out:
1263         INP_HASH_WUNLOCK(&V_tcbinfo);
1264         return (error);
1265 }
1266 #endif /* INET */
1267
1268 #ifdef INET6
1269 static int
1270 tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1271 {
1272         struct inpcb *inp = tp->t_inpcb;
1273         int error;
1274
1275         INP_WLOCK_ASSERT(inp);
1276         INP_HASH_WLOCK(&V_tcbinfo);
1277
1278         if (inp->inp_lport == 0) {
1279                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1280                 if (error)
1281                         goto out;
1282         }
1283         error = in6_pcbconnect(inp, nam, td->td_ucred);
1284         if (error != 0)
1285                 goto out;
1286         INP_HASH_WUNLOCK(&V_tcbinfo);
1287
1288         /* Compute window scaling to request.  */
1289         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1290             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1291                 tp->request_r_scale++;
1292
1293         soisconnecting(inp->inp_socket);
1294         TCPSTAT_INC(tcps_connattempt);
1295         tcp_state_change(tp, TCPS_SYN_SENT);
1296         tp->iss = tcp_new_isn(tp);
1297         tcp_sendseqinit(tp);
1298
1299         return 0;
1300
1301 out:
1302         INP_HASH_WUNLOCK(&V_tcbinfo);
1303         return error;
1304 }
1305 #endif /* INET6 */
1306
1307 /*
1308  * Export TCP internal state information via a struct tcp_info, based on the
1309  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1310  * (TCP state machine, etc).  We export all information using FreeBSD-native
1311  * constants -- for example, the numeric values for tcpi_state will differ
1312  * from Linux.
1313  */
1314 static void
1315 tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)
1316 {
1317
1318         INP_WLOCK_ASSERT(tp->t_inpcb);
1319         bzero(ti, sizeof(*ti));
1320
1321         ti->tcpi_state = tp->t_state;
1322         if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1323                 ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1324         if (tp->t_flags & TF_SACK_PERMIT)
1325                 ti->tcpi_options |= TCPI_OPT_SACK;
1326         if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1327                 ti->tcpi_options |= TCPI_OPT_WSCALE;
1328                 ti->tcpi_snd_wscale = tp->snd_scale;
1329                 ti->tcpi_rcv_wscale = tp->rcv_scale;
1330         }
1331
1332         ti->tcpi_rto = tp->t_rxtcur * tick;
1333         ti->tcpi_last_data_recv = (long)(ticks - (int)tp->t_rcvtime) * tick;
1334         ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1335         ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1336
1337         ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1338         ti->tcpi_snd_cwnd = tp->snd_cwnd;
1339
1340         /*
1341          * FreeBSD-specific extension fields for tcp_info.
1342          */
1343         ti->tcpi_rcv_space = tp->rcv_wnd;
1344         ti->tcpi_rcv_nxt = tp->rcv_nxt;
1345         ti->tcpi_snd_wnd = tp->snd_wnd;
1346         ti->tcpi_snd_bwnd = 0;          /* Unused, kept for compat. */
1347         ti->tcpi_snd_nxt = tp->snd_nxt;
1348         ti->tcpi_snd_mss = tp->t_maxseg;
1349         ti->tcpi_rcv_mss = tp->t_maxseg;
1350         if (tp->t_flags & TF_TOE)
1351                 ti->tcpi_options |= TCPI_OPT_TOE;
1352         ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1353         ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1354         ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1355 }
1356
1357 /*
1358  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1359  * socket option arguments.  When it re-acquires the lock after the copy, it
1360  * has to revalidate that the connection is still valid for the socket
1361  * option.
1362  */
1363 #define INP_WLOCK_RECHECK(inp) do {                                     \
1364         INP_WLOCK(inp);                                                 \
1365         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {            \
1366                 INP_WUNLOCK(inp);                                       \
1367                 return (ECONNRESET);                                    \
1368         }                                                               \
1369         tp = intotcpcb(inp);                                            \
1370 } while(0)
1371
1372 int
1373 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1374 {
1375         int     error;
1376         struct  inpcb *inp;
1377         struct  tcpcb *tp;
1378         struct tcp_function_block *blk;
1379         struct tcp_function_set fsn;
1380
1381         error = 0;
1382         inp = sotoinpcb(so);
1383         KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1384         INP_WLOCK(inp);
1385         if (sopt->sopt_level != IPPROTO_TCP) {
1386 #ifdef INET6
1387                 if (inp->inp_vflag & INP_IPV6PROTO) {
1388                         INP_WUNLOCK(inp);
1389                         error = ip6_ctloutput(so, sopt);
1390                 }
1391 #endif /* INET6 */
1392 #if defined(INET6) && defined(INET)
1393                 else
1394 #endif
1395 #ifdef INET
1396                 {
1397                         INP_WUNLOCK(inp);
1398                         error = ip_ctloutput(so, sopt);
1399                 }
1400 #endif
1401                 return (error);
1402         }
1403         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1404                 INP_WUNLOCK(inp);
1405                 return (ECONNRESET);
1406         }
1407         tp = intotcpcb(inp);
1408         /*
1409          * Protect the TCP option TCP_FUNCTION_BLK so
1410          * that a sub-function can *never* overwrite this.
1411          */
1412         if ((sopt->sopt_dir == SOPT_SET) &&
1413             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1414                 INP_WUNLOCK(inp);
1415                 error = sooptcopyin(sopt, &fsn, sizeof fsn,
1416                     sizeof fsn);
1417                 if (error)
1418                         return (error);
1419                 INP_WLOCK_RECHECK(inp);
1420                 if (tp->t_state != TCPS_CLOSED) {
1421                         /*
1422                          * The user has advanced the state
1423                          * past the initial point, we can't
1424                          * switch since we are down the road
1425                          * and a new set of functions may
1426                          * not be compatibile.
1427                          */
1428                         INP_WUNLOCK(inp);
1429                         return(EINVAL);
1430                 }
1431                 blk = find_and_ref_tcp_functions(&fsn);
1432                 if (blk == NULL) {
1433                         INP_WUNLOCK(inp);
1434                         return (ENOENT);
1435                 }
1436                 if (tp->t_fb != blk) {
1437                         if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1438                                 refcount_release(&blk->tfb_refcnt);
1439                                 INP_WUNLOCK(inp);
1440                                 return (ENOENT);
1441                         }
1442                         /*
1443                          * Release the old refcnt, the
1444                          * lookup acquires a ref on the
1445                          * new one.
1446                          */
1447                         if (tp->t_fb->tfb_tcp_fb_fini)
1448                                 (*tp->t_fb->tfb_tcp_fb_fini)(tp);
1449                         refcount_release(&tp->t_fb->tfb_refcnt);
1450                         tp->t_fb = blk;
1451                         if (tp->t_fb->tfb_tcp_fb_init) {
1452                                 (*tp->t_fb->tfb_tcp_fb_init)(tp);
1453                         }
1454                 }
1455 #ifdef TCP_OFFLOAD
1456                 if (tp->t_flags & TF_TOE) {
1457                         tcp_offload_ctloutput(tp, sopt->sopt_dir,
1458                              sopt->sopt_name);
1459                 }
1460 #endif
1461                 INP_WUNLOCK(inp);
1462                 return (error);
1463         } else if ((sopt->sopt_dir == SOPT_GET) &&
1464             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1465                 strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);
1466                 fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1467                 INP_WUNLOCK(inp);
1468                 error = sooptcopyout(sopt, &fsn, sizeof fsn);
1469                 return (error);
1470         }
1471         /* Pass in the INP locked, called must unlock it */
1472         return (tp->t_fb->tfb_tcp_ctloutput(so, sopt, inp, tp));
1473 }
1474
1475 int
1476 tcp_default_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp, struct tcpcb *tp)
1477 {
1478         int     error, opt, optval;
1479         u_int   ui;
1480         struct  tcp_info ti;
1481         struct cc_algo *algo;
1482         char    *pbuf, buf[TCP_CA_NAME_MAX];
1483         size_t  len;
1484
1485         /*
1486          * For TCP_CCALGOOPT forward the control to CC module, for both
1487          * SOPT_SET and SOPT_GET.
1488          */
1489         switch (sopt->sopt_name) {
1490         case TCP_CCALGOOPT:
1491                 INP_WUNLOCK(inp);
1492                 pbuf = malloc(sopt->sopt_valsize, M_TEMP, M_WAITOK | M_ZERO);
1493                 error = sooptcopyin(sopt, pbuf, sopt->sopt_valsize,
1494                     sopt->sopt_valsize);
1495                 if (error) {
1496                         free(pbuf, M_TEMP);
1497                         return (error);
1498                 }
1499                 INP_WLOCK_RECHECK(inp);
1500                 if (CC_ALGO(tp)->ctl_output != NULL)
1501                         error = CC_ALGO(tp)->ctl_output(tp->ccv, sopt, pbuf);
1502                 else
1503                         error = ENOENT;
1504                 INP_WUNLOCK(inp);
1505                 if (error == 0 && sopt->sopt_dir == SOPT_GET)
1506                         error = sooptcopyout(sopt, pbuf, sopt->sopt_valsize);
1507                 free(pbuf, M_TEMP);
1508                 return (error);
1509         }
1510
1511         switch (sopt->sopt_dir) {
1512         case SOPT_SET:
1513                 switch (sopt->sopt_name) {
1514 #ifdef TCP_SIGNATURE
1515                 case TCP_MD5SIG:
1516                         INP_WUNLOCK(inp);
1517                         error = sooptcopyin(sopt, &optval, sizeof optval,
1518                             sizeof optval);
1519                         if (error)
1520                                 return (error);
1521
1522                         INP_WLOCK_RECHECK(inp);
1523                         if (optval > 0)
1524                                 tp->t_flags |= TF_SIGNATURE;
1525                         else
1526                                 tp->t_flags &= ~TF_SIGNATURE;
1527                         goto unlock_and_done;
1528 #endif /* TCP_SIGNATURE */
1529
1530                 case TCP_NODELAY:
1531                 case TCP_NOOPT:
1532                         INP_WUNLOCK(inp);
1533                         error = sooptcopyin(sopt, &optval, sizeof optval,
1534                             sizeof optval);
1535                         if (error)
1536                                 return (error);
1537
1538                         INP_WLOCK_RECHECK(inp);
1539                         switch (sopt->sopt_name) {
1540                         case TCP_NODELAY:
1541                                 opt = TF_NODELAY;
1542                                 break;
1543                         case TCP_NOOPT:
1544                                 opt = TF_NOOPT;
1545                                 break;
1546                         default:
1547                                 opt = 0; /* dead code to fool gcc */
1548                                 break;
1549                         }
1550
1551                         if (optval)
1552                                 tp->t_flags |= opt;
1553                         else
1554                                 tp->t_flags &= ~opt;
1555 unlock_and_done:
1556 #ifdef TCP_OFFLOAD
1557                         if (tp->t_flags & TF_TOE) {
1558                                 tcp_offload_ctloutput(tp, sopt->sopt_dir,
1559                                     sopt->sopt_name);
1560                         }
1561 #endif
1562                         INP_WUNLOCK(inp);
1563                         break;
1564
1565                 case TCP_NOPUSH:
1566                         INP_WUNLOCK(inp);
1567                         error = sooptcopyin(sopt, &optval, sizeof optval,
1568                             sizeof optval);
1569                         if (error)
1570                                 return (error);
1571
1572                         INP_WLOCK_RECHECK(inp);
1573                         if (optval)
1574                                 tp->t_flags |= TF_NOPUSH;
1575                         else if (tp->t_flags & TF_NOPUSH) {
1576                                 tp->t_flags &= ~TF_NOPUSH;
1577                                 if (TCPS_HAVEESTABLISHED(tp->t_state))
1578                                         error = tp->t_fb->tfb_tcp_output(tp);
1579                         }
1580                         goto unlock_and_done;
1581
1582                 case TCP_MAXSEG:
1583                         INP_WUNLOCK(inp);
1584                         error = sooptcopyin(sopt, &optval, sizeof optval,
1585                             sizeof optval);
1586                         if (error)
1587                                 return (error);
1588
1589                         INP_WLOCK_RECHECK(inp);
1590                         if (optval > 0 && optval <= tp->t_maxseg &&
1591                             optval + 40 >= V_tcp_minmss)
1592                                 tp->t_maxseg = optval;
1593                         else
1594                                 error = EINVAL;
1595                         goto unlock_and_done;
1596
1597                 case TCP_INFO:
1598                         INP_WUNLOCK(inp);
1599                         error = EINVAL;
1600                         break;
1601
1602                 case TCP_CONGESTION:
1603                         INP_WUNLOCK(inp);
1604                         error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX - 1, 1);
1605                         if (error)
1606                                 break;
1607                         buf[sopt->sopt_valsize] = '\0';
1608                         INP_WLOCK_RECHECK(inp);
1609                         CC_LIST_RLOCK();
1610                         STAILQ_FOREACH(algo, &cc_list, entries)
1611                                 if (strncmp(buf, algo->name,
1612                                     TCP_CA_NAME_MAX) == 0)
1613                                         break;
1614                         CC_LIST_RUNLOCK();
1615                         if (algo == NULL) {
1616                                 INP_WUNLOCK(inp);
1617                                 error = EINVAL;
1618                                 break;
1619                         }
1620                         /*
1621                          * We hold a write lock over the tcb so it's safe to
1622                          * do these things without ordering concerns.
1623                          */
1624                         if (CC_ALGO(tp)->cb_destroy != NULL)
1625                                 CC_ALGO(tp)->cb_destroy(tp->ccv);
1626                         CC_ALGO(tp) = algo;
1627                         /*
1628                          * If something goes pear shaped initialising the new
1629                          * algo, fall back to newreno (which does not
1630                          * require initialisation).
1631                          */
1632                         if (algo->cb_init != NULL &&
1633                             algo->cb_init(tp->ccv) != 0) {
1634                                 CC_ALGO(tp) = &newreno_cc_algo;
1635                                 /*
1636                                  * The only reason init should fail is
1637                                  * because of malloc.
1638                                  */
1639                                 error = ENOMEM;
1640                         }
1641                         INP_WUNLOCK(inp);
1642                         break;
1643
1644                 case TCP_KEEPIDLE:
1645                 case TCP_KEEPINTVL:
1646                 case TCP_KEEPINIT:
1647                         INP_WUNLOCK(inp);
1648                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1649                         if (error)
1650                                 return (error);
1651
1652                         if (ui > (UINT_MAX / hz)) {
1653                                 error = EINVAL;
1654                                 break;
1655                         }
1656                         ui *= hz;
1657
1658                         INP_WLOCK_RECHECK(inp);
1659                         switch (sopt->sopt_name) {
1660                         case TCP_KEEPIDLE:
1661                                 tp->t_keepidle = ui;
1662                                 /*
1663                                  * XXX: better check current remaining
1664                                  * timeout and "merge" it with new value.
1665                                  */
1666                                 if ((tp->t_state > TCPS_LISTEN) &&
1667                                     (tp->t_state <= TCPS_CLOSING))
1668                                         tcp_timer_activate(tp, TT_KEEP,
1669                                             TP_KEEPIDLE(tp));
1670                                 break;
1671                         case TCP_KEEPINTVL:
1672                                 tp->t_keepintvl = ui;
1673                                 if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1674                                     (TP_MAXIDLE(tp) > 0))
1675                                         tcp_timer_activate(tp, TT_2MSL,
1676                                             TP_MAXIDLE(tp));
1677                                 break;
1678                         case TCP_KEEPINIT:
1679                                 tp->t_keepinit = ui;
1680                                 if (tp->t_state == TCPS_SYN_RECEIVED ||
1681                                     tp->t_state == TCPS_SYN_SENT)
1682                                         tcp_timer_activate(tp, TT_KEEP,
1683                                             TP_KEEPINIT(tp));
1684                                 break;
1685                         }
1686                         goto unlock_and_done;
1687
1688                 case TCP_KEEPCNT:
1689                         INP_WUNLOCK(inp);
1690                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1691                         if (error)
1692                                 return (error);
1693
1694                         INP_WLOCK_RECHECK(inp);
1695                         tp->t_keepcnt = ui;
1696                         if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1697                             (TP_MAXIDLE(tp) > 0))
1698                                 tcp_timer_activate(tp, TT_2MSL,
1699                                     TP_MAXIDLE(tp));
1700                         goto unlock_and_done;
1701
1702 #ifdef TCPPCAP
1703                 case TCP_PCAP_OUT:
1704                 case TCP_PCAP_IN:
1705                         INP_WUNLOCK(inp);
1706                         error = sooptcopyin(sopt, &optval, sizeof optval,
1707                             sizeof optval);
1708                         if (error)
1709                                 return (error);
1710
1711                         INP_WLOCK_RECHECK(inp);
1712                         if (optval >= 0)
1713                                 tcp_pcap_set_sock_max(TCP_PCAP_OUT ?
1714                                         &(tp->t_outpkts) : &(tp->t_inpkts),
1715                                         optval);
1716                         else
1717                                 error = EINVAL;
1718                         goto unlock_and_done;
1719 #endif
1720
1721 #ifdef TCP_RFC7413
1722                 case TCP_FASTOPEN:
1723                         INP_WUNLOCK(inp);
1724                         if (!V_tcp_fastopen_enabled)
1725                                 return (EPERM);
1726
1727                         error = sooptcopyin(sopt, &optval, sizeof optval,
1728                             sizeof optval);
1729                         if (error)
1730                                 return (error);
1731
1732                         INP_WLOCK_RECHECK(inp);
1733                         if (optval) {
1734                                 tp->t_flags |= TF_FASTOPEN;
1735                                 if ((tp->t_state == TCPS_LISTEN) &&
1736                                     (tp->t_tfo_pending == NULL))
1737                                         tp->t_tfo_pending =
1738                                             tcp_fastopen_alloc_counter();
1739                         } else
1740                                 tp->t_flags &= ~TF_FASTOPEN;
1741                         goto unlock_and_done;
1742 #endif
1743
1744                 default:
1745                         INP_WUNLOCK(inp);
1746                         error = ENOPROTOOPT;
1747                         break;
1748                 }
1749                 break;
1750
1751         case SOPT_GET:
1752                 tp = intotcpcb(inp);
1753                 switch (sopt->sopt_name) {
1754 #ifdef TCP_SIGNATURE
1755                 case TCP_MD5SIG:
1756                         optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0;
1757                         INP_WUNLOCK(inp);
1758                         error = sooptcopyout(sopt, &optval, sizeof optval);
1759                         break;
1760 #endif
1761
1762                 case TCP_NODELAY:
1763                         optval = tp->t_flags & TF_NODELAY;
1764                         INP_WUNLOCK(inp);
1765                         error = sooptcopyout(sopt, &optval, sizeof optval);
1766                         break;
1767                 case TCP_MAXSEG:
1768                         optval = tp->t_maxseg;
1769                         INP_WUNLOCK(inp);
1770                         error = sooptcopyout(sopt, &optval, sizeof optval);
1771                         break;
1772                 case TCP_NOOPT:
1773                         optval = tp->t_flags & TF_NOOPT;
1774                         INP_WUNLOCK(inp);
1775                         error = sooptcopyout(sopt, &optval, sizeof optval);
1776                         break;
1777                 case TCP_NOPUSH:
1778                         optval = tp->t_flags & TF_NOPUSH;
1779                         INP_WUNLOCK(inp);
1780                         error = sooptcopyout(sopt, &optval, sizeof optval);
1781                         break;
1782                 case TCP_INFO:
1783                         tcp_fill_info(tp, &ti);
1784                         INP_WUNLOCK(inp);
1785                         error = sooptcopyout(sopt, &ti, sizeof ti);
1786                         break;
1787                 case TCP_CONGESTION:
1788                         len = strlcpy(buf, CC_ALGO(tp)->name, TCP_CA_NAME_MAX);
1789                         INP_WUNLOCK(inp);
1790                         error = sooptcopyout(sopt, buf, len + 1);
1791                         break;
1792                 case TCP_KEEPIDLE:
1793                 case TCP_KEEPINTVL:
1794                 case TCP_KEEPINIT:
1795                 case TCP_KEEPCNT:
1796                         switch (sopt->sopt_name) {
1797                         case TCP_KEEPIDLE:
1798                                 ui = tp->t_keepidle / hz;
1799                                 break;
1800                         case TCP_KEEPINTVL:
1801                                 ui = tp->t_keepintvl / hz;
1802                                 break;
1803                         case TCP_KEEPINIT:
1804                                 ui = tp->t_keepinit / hz;
1805                                 break;
1806                         case TCP_KEEPCNT:
1807                                 ui = tp->t_keepcnt;
1808                                 break;
1809                         }
1810                         INP_WUNLOCK(inp);
1811                         error = sooptcopyout(sopt, &ui, sizeof(ui));
1812                         break;
1813 #ifdef TCPPCAP
1814                 case TCP_PCAP_OUT:
1815                 case TCP_PCAP_IN:
1816                         optval = tcp_pcap_get_sock_max(TCP_PCAP_OUT ?
1817                                         &(tp->t_outpkts) : &(tp->t_inpkts));
1818                         INP_WUNLOCK(inp);
1819                         error = sooptcopyout(sopt, &optval, sizeof optval);
1820                         break;
1821 #endif
1822
1823 #ifdef TCP_RFC7413
1824                 case TCP_FASTOPEN:
1825                         optval = tp->t_flags & TF_FASTOPEN;
1826                         INP_WUNLOCK(inp);
1827                         error = sooptcopyout(sopt, &optval, sizeof optval);
1828                         break;
1829 #endif
1830                 default:
1831                         INP_WUNLOCK(inp);
1832                         error = ENOPROTOOPT;
1833                         break;
1834                 }
1835                 break;
1836         }
1837         return (error);
1838 }
1839 #undef INP_WLOCK_RECHECK
1840
1841 /*
1842  * Attach TCP protocol to socket, allocating
1843  * internet protocol control block, tcp control block,
1844  * bufer space, and entering LISTEN state if to accept connections.
1845  */
1846 static int
1847 tcp_attach(struct socket *so)
1848 {
1849         struct tcpcb *tp;
1850         struct inpcb *inp;
1851         int error;
1852
1853         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1854                 error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
1855                 if (error)
1856                         return (error);
1857         }
1858         so->so_rcv.sb_flags |= SB_AUTOSIZE;
1859         so->so_snd.sb_flags |= SB_AUTOSIZE;
1860         INP_INFO_RLOCK(&V_tcbinfo);
1861         error = in_pcballoc(so, &V_tcbinfo);
1862         if (error) {
1863                 INP_INFO_RUNLOCK(&V_tcbinfo);
1864                 return (error);
1865         }
1866         inp = sotoinpcb(so);
1867 #ifdef INET6
1868         if (inp->inp_vflag & INP_IPV6PROTO) {
1869                 inp->inp_vflag |= INP_IPV6;
1870                 inp->in6p_hops = -1;    /* use kernel default */
1871         }
1872         else
1873 #endif
1874         inp->inp_vflag |= INP_IPV4;
1875         tp = tcp_newtcpcb(inp);
1876         if (tp == NULL) {
1877                 in_pcbdetach(inp);
1878                 in_pcbfree(inp);
1879                 INP_INFO_RUNLOCK(&V_tcbinfo);
1880                 return (ENOBUFS);
1881         }
1882         tp->t_state = TCPS_CLOSED;
1883         INP_WUNLOCK(inp);
1884         INP_INFO_RUNLOCK(&V_tcbinfo);
1885         TCPSTAT_INC(tcps_states[TCPS_CLOSED]);
1886         return (0);
1887 }
1888
1889 /*
1890  * Initiate (or continue) disconnect.
1891  * If embryonic state, just send reset (once).
1892  * If in ``let data drain'' option and linger null, just drop.
1893  * Otherwise (hard), mark socket disconnecting and drop
1894  * current input data; switch states based on user close, and
1895  * send segment to peer (with FIN).
1896  */
1897 static void
1898 tcp_disconnect(struct tcpcb *tp)
1899 {
1900         struct inpcb *inp = tp->t_inpcb;
1901         struct socket *so = inp->inp_socket;
1902
1903         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1904         INP_WLOCK_ASSERT(inp);
1905
1906         /*
1907          * Neither tcp_close() nor tcp_drop() should return NULL, as the
1908          * socket is still open.
1909          */
1910         if (tp->t_state < TCPS_ESTABLISHED) {
1911                 tp = tcp_close(tp);
1912                 KASSERT(tp != NULL,
1913                     ("tcp_disconnect: tcp_close() returned NULL"));
1914         } else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
1915                 tp = tcp_drop(tp, 0);
1916                 KASSERT(tp != NULL,
1917                     ("tcp_disconnect: tcp_drop() returned NULL"));
1918         } else {
1919                 soisdisconnecting(so);
1920                 sbflush(&so->so_rcv);
1921                 tcp_usrclosed(tp);
1922                 if (!(inp->inp_flags & INP_DROPPED))
1923                         tp->t_fb->tfb_tcp_output(tp);
1924         }
1925 }
1926
1927 /*
1928  * User issued close, and wish to trail through shutdown states:
1929  * if never received SYN, just forget it.  If got a SYN from peer,
1930  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
1931  * If already got a FIN from peer, then almost done; go to LAST_ACK
1932  * state.  In all other cases, have already sent FIN to peer (e.g.
1933  * after PRU_SHUTDOWN), and just have to play tedious game waiting
1934  * for peer to send FIN or not respond to keep-alives, etc.
1935  * We can let the user exit from the close as soon as the FIN is acked.
1936  */
1937 static void
1938 tcp_usrclosed(struct tcpcb *tp)
1939 {
1940
1941         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1942         INP_WLOCK_ASSERT(tp->t_inpcb);
1943
1944         switch (tp->t_state) {
1945         case TCPS_LISTEN:
1946 #ifdef TCP_OFFLOAD
1947                 tcp_offload_listen_stop(tp);
1948 #endif
1949                 tcp_state_change(tp, TCPS_CLOSED);
1950                 /* FALLTHROUGH */
1951         case TCPS_CLOSED:
1952                 tp = tcp_close(tp);
1953                 /*
1954                  * tcp_close() should never return NULL here as the socket is
1955                  * still open.
1956                  */
1957                 KASSERT(tp != NULL,
1958                     ("tcp_usrclosed: tcp_close() returned NULL"));
1959                 break;
1960
1961         case TCPS_SYN_SENT:
1962         case TCPS_SYN_RECEIVED:
1963                 tp->t_flags |= TF_NEEDFIN;
1964                 break;
1965
1966         case TCPS_ESTABLISHED:
1967                 tcp_state_change(tp, TCPS_FIN_WAIT_1);
1968                 break;
1969
1970         case TCPS_CLOSE_WAIT:
1971                 tcp_state_change(tp, TCPS_LAST_ACK);
1972                 break;
1973         }
1974         if (tp->t_state >= TCPS_FIN_WAIT_2) {
1975                 soisdisconnected(tp->t_inpcb->inp_socket);
1976                 /* Prevent the connection hanging in FIN_WAIT_2 forever. */
1977                 if (tp->t_state == TCPS_FIN_WAIT_2) {
1978                         int timeout;
1979
1980                         timeout = (tcp_fast_finwait2_recycle) ?
1981                             tcp_finwait2_timeout : TP_MAXIDLE(tp);
1982                         tcp_timer_activate(tp, TT_2MSL, timeout);
1983                 }
1984         }
1985 }
1986
1987 #ifdef DDB
1988 static void
1989 db_print_indent(int indent)
1990 {
1991         int i;
1992
1993         for (i = 0; i < indent; i++)
1994                 db_printf(" ");
1995 }
1996
1997 static void
1998 db_print_tstate(int t_state)
1999 {
2000
2001         switch (t_state) {
2002         case TCPS_CLOSED:
2003                 db_printf("TCPS_CLOSED");
2004                 return;
2005
2006         case TCPS_LISTEN:
2007                 db_printf("TCPS_LISTEN");
2008                 return;
2009
2010         case TCPS_SYN_SENT:
2011                 db_printf("TCPS_SYN_SENT");
2012                 return;
2013
2014         case TCPS_SYN_RECEIVED:
2015                 db_printf("TCPS_SYN_RECEIVED");
2016                 return;
2017
2018         case TCPS_ESTABLISHED:
2019                 db_printf("TCPS_ESTABLISHED");
2020                 return;
2021
2022         case TCPS_CLOSE_WAIT:
2023                 db_printf("TCPS_CLOSE_WAIT");
2024                 return;
2025
2026         case TCPS_FIN_WAIT_1:
2027                 db_printf("TCPS_FIN_WAIT_1");
2028                 return;
2029
2030         case TCPS_CLOSING:
2031                 db_printf("TCPS_CLOSING");
2032                 return;
2033
2034         case TCPS_LAST_ACK:
2035                 db_printf("TCPS_LAST_ACK");
2036                 return;
2037
2038         case TCPS_FIN_WAIT_2:
2039                 db_printf("TCPS_FIN_WAIT_2");
2040                 return;
2041
2042         case TCPS_TIME_WAIT:
2043                 db_printf("TCPS_TIME_WAIT");
2044                 return;
2045
2046         default:
2047                 db_printf("unknown");
2048                 return;
2049         }
2050 }
2051
2052 static void
2053 db_print_tflags(u_int t_flags)
2054 {
2055         int comma;
2056
2057         comma = 0;
2058         if (t_flags & TF_ACKNOW) {
2059                 db_printf("%sTF_ACKNOW", comma ? ", " : "");
2060                 comma = 1;
2061         }
2062         if (t_flags & TF_DELACK) {
2063                 db_printf("%sTF_DELACK", comma ? ", " : "");
2064                 comma = 1;
2065         }
2066         if (t_flags & TF_NODELAY) {
2067                 db_printf("%sTF_NODELAY", comma ? ", " : "");
2068                 comma = 1;
2069         }
2070         if (t_flags & TF_NOOPT) {
2071                 db_printf("%sTF_NOOPT", comma ? ", " : "");
2072                 comma = 1;
2073         }
2074         if (t_flags & TF_SENTFIN) {
2075                 db_printf("%sTF_SENTFIN", comma ? ", " : "");
2076                 comma = 1;
2077         }
2078         if (t_flags & TF_REQ_SCALE) {
2079                 db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2080                 comma = 1;
2081         }
2082         if (t_flags & TF_RCVD_SCALE) {
2083                 db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2084                 comma = 1;
2085         }
2086         if (t_flags & TF_REQ_TSTMP) {
2087                 db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2088                 comma = 1;
2089         }
2090         if (t_flags & TF_RCVD_TSTMP) {
2091                 db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2092                 comma = 1;
2093         }
2094         if (t_flags & TF_SACK_PERMIT) {
2095                 db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2096                 comma = 1;
2097         }
2098         if (t_flags & TF_NEEDSYN) {
2099                 db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2100                 comma = 1;
2101         }
2102         if (t_flags & TF_NEEDFIN) {
2103                 db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2104                 comma = 1;
2105         }
2106         if (t_flags & TF_NOPUSH) {
2107                 db_printf("%sTF_NOPUSH", comma ? ", " : "");
2108                 comma = 1;
2109         }
2110         if (t_flags & TF_MORETOCOME) {
2111                 db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2112                 comma = 1;
2113         }
2114         if (t_flags & TF_LQ_OVERFLOW) {
2115                 db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");
2116                 comma = 1;
2117         }
2118         if (t_flags & TF_LASTIDLE) {
2119                 db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2120                 comma = 1;
2121         }
2122         if (t_flags & TF_RXWIN0SENT) {
2123                 db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2124                 comma = 1;
2125         }
2126         if (t_flags & TF_FASTRECOVERY) {
2127                 db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
2128                 comma = 1;
2129         }
2130         if (t_flags & TF_CONGRECOVERY) {
2131                 db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
2132                 comma = 1;
2133         }
2134         if (t_flags & TF_WASFRECOVERY) {
2135                 db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
2136                 comma = 1;
2137         }
2138         if (t_flags & TF_SIGNATURE) {
2139                 db_printf("%sTF_SIGNATURE", comma ? ", " : "");
2140                 comma = 1;
2141         }
2142         if (t_flags & TF_FORCEDATA) {
2143                 db_printf("%sTF_FORCEDATA", comma ? ", " : "");
2144                 comma = 1;
2145         }
2146         if (t_flags & TF_TSO) {
2147                 db_printf("%sTF_TSO", comma ? ", " : "");
2148                 comma = 1;
2149         }
2150         if (t_flags & TF_ECN_PERMIT) {
2151                 db_printf("%sTF_ECN_PERMIT", comma ? ", " : "");
2152                 comma = 1;
2153         }
2154         if (t_flags & TF_FASTOPEN) {
2155                 db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2156                 comma = 1;
2157         }
2158 }
2159
2160 static void
2161 db_print_toobflags(char t_oobflags)
2162 {
2163         int comma;
2164
2165         comma = 0;
2166         if (t_oobflags & TCPOOB_HAVEDATA) {
2167                 db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
2168                 comma = 1;
2169         }
2170         if (t_oobflags & TCPOOB_HADDATA) {
2171                 db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
2172                 comma = 1;
2173         }
2174 }
2175
2176 static void
2177 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
2178 {
2179
2180         db_print_indent(indent);
2181         db_printf("%s at %p\n", name, tp);
2182
2183         indent += 2;
2184
2185         db_print_indent(indent);
2186         db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
2187            LIST_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
2188
2189         db_print_indent(indent);
2190         db_printf("tt_rexmt: %p   tt_persist: %p   tt_keep: %p\n",
2191             &tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);
2192
2193         db_print_indent(indent);
2194         db_printf("tt_2msl: %p   tt_delack: %p   t_inpcb: %p\n", &tp->t_timers->tt_2msl,
2195             &tp->t_timers->tt_delack, tp->t_inpcb);
2196
2197         db_print_indent(indent);
2198         db_printf("t_state: %d (", tp->t_state);
2199         db_print_tstate(tp->t_state);
2200         db_printf(")\n");
2201
2202         db_print_indent(indent);
2203         db_printf("t_flags: 0x%x (", tp->t_flags);
2204         db_print_tflags(tp->t_flags);
2205         db_printf(")\n");
2206
2207         db_print_indent(indent);
2208         db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: x0%08x\n",
2209             tp->snd_una, tp->snd_max, tp->snd_nxt);
2210
2211         db_print_indent(indent);
2212         db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
2213            tp->snd_up, tp->snd_wl1, tp->snd_wl2);
2214
2215         db_print_indent(indent);
2216         db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
2217             tp->iss, tp->irs, tp->rcv_nxt);
2218
2219         db_print_indent(indent);
2220         db_printf("rcv_adv: 0x%08x   rcv_wnd: %lu   rcv_up: 0x%08x\n",
2221             tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
2222
2223         db_print_indent(indent);
2224         db_printf("snd_wnd: %lu   snd_cwnd: %lu\n",
2225            tp->snd_wnd, tp->snd_cwnd);
2226
2227         db_print_indent(indent);
2228         db_printf("snd_ssthresh: %lu   snd_recover: "
2229             "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
2230
2231         db_print_indent(indent);
2232         db_printf("t_rcvtime: %u   t_startime: %u\n",
2233             tp->t_rcvtime, tp->t_starttime);
2234
2235         db_print_indent(indent);
2236         db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
2237             tp->t_rtttime, tp->t_rtseq);
2238
2239         db_print_indent(indent);
2240         db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
2241             tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
2242
2243         db_print_indent(indent);
2244         db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u   "
2245             "t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,
2246             tp->t_rttbest);
2247
2248         db_print_indent(indent);
2249         db_printf("t_rttupdated: %lu   max_sndwnd: %lu   t_softerror: %d\n",
2250             tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
2251
2252         db_print_indent(indent);
2253         db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
2254         db_print_toobflags(tp->t_oobflags);
2255         db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
2256
2257         db_print_indent(indent);
2258         db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
2259             tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
2260
2261         db_print_indent(indent);
2262         db_printf("ts_recent: %u   ts_recent_age: %u\n",
2263             tp->ts_recent, tp->ts_recent_age);
2264
2265         db_print_indent(indent);
2266         db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
2267             "%lu\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
2268
2269         db_print_indent(indent);
2270         db_printf("snd_ssthresh_prev: %lu   snd_recover_prev: 0x%08x   "
2271             "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
2272             tp->snd_recover_prev, tp->t_badrxtwin);
2273
2274         db_print_indent(indent);
2275         db_printf("snd_numholes: %d  snd_holes first: %p\n",
2276             tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
2277
2278         db_print_indent(indent);
2279         db_printf("snd_fack: 0x%08x   rcv_numsacks: %d   sack_newdata: "
2280             "0x%08x\n", tp->snd_fack, tp->rcv_numsacks, tp->sack_newdata);
2281
2282         /* Skip sackblks, sackhint. */
2283
2284         db_print_indent(indent);
2285         db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
2286             tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
2287 }
2288
2289 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
2290 {
2291         struct tcpcb *tp;
2292
2293         if (!have_addr) {
2294                 db_printf("usage: show tcpcb <addr>\n");
2295                 return;
2296         }
2297         tp = (struct tcpcb *)addr;
2298
2299         db_print_tcpcb(tp, "tcpcb", 0);
2300 }
2301 #endif