sys/netinet/tcp_usrreq.c

   1 /*-
   2  * Copyright (c) 1982, 1986, 1988, 1993
   3  *      The Regents of the University of California.
   4  * Copyright (c) 2006-2007 Robert N. M. Watson
   5  * Copyright (c) 2010-2011 Juniper Networks, Inc.
   6  * All rights reserved.
   7  *
   8  * Portions of this software were developed by Robert N. M. Watson under
   9  * contract to Juniper Networks, Inc.
  10  *
  11  * Redistribution and use in source and binary forms, with or without
  12  * modification, are permitted provided that the following conditions
  13  * are met:
  14  * 1. Redistributions of source code must retain the above copyright
  15  *    notice, this list of conditions and the following disclaimer.
  16  * 2. Redistributions in binary form must reproduce the above copyright
  17  *    notice, this list of conditions and the following disclaimer in the
  18  *    documentation and/or other materials provided with the distribution.
  19  * 4. Neither the name of the University nor the names of its contributors
  20  *    may be used to endorse or promote products derived from this software
  21  *    without specific prior written permission.
  22  *
  23  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
  24  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  25  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  26  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
  27  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  28  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  29  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  30  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  31  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  32  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  33  * SUCH DAMAGE.
  34  *
  35  *      From: @(#)tcp_usrreq.c  8.2 (Berkeley) 1/3/94
  36  */
  37
  38 #include <sys/cdefs.h>
  39 __FBSDID("$FreeBSD$");
  40
  41 #include "opt_ddb.h"
  42 #include "opt_inet.h"
  43 #include "opt_inet6.h"
  44 #include "opt_tcpdebug.h"
  45
  46 #include <sys/param.h>
  47 #include <sys/systm.h>
  48 #include <sys/limits.h>
  49 #include <sys/malloc.h>
  50 #include <sys/refcount.h>
  51 #include <sys/kernel.h>
  52 #include <sys/sysctl.h>
  53 #include <sys/mbuf.h>
  54 #ifdef INET6
  55 #include <sys/domain.h>
  56 #endif /* INET6 */
  57 #include <sys/socket.h>
  58 #include <sys/socketvar.h>
  59 #include <sys/protosw.h>
  60 #include <sys/proc.h>
  61 #include <sys/jail.h>
  62
  63 #ifdef DDB
  64 #include <ddb/ddb.h>
  65 #endif
  66
  67 #include <net/if.h>
  68 #include <net/if_var.h>
  69 #include <net/route.h>
  70 #include <net/vnet.h>
  71
  72 #include <netinet/in.h>
  73 #include <netinet/in_kdtrace.h>
  74 #include <netinet/in_pcb.h>
  75 #include <netinet/in_systm.h>
  76 #include <netinet/in_var.h>
  77 #include <netinet/ip_var.h>
  78 #ifdef INET6
  79 #include <netinet/ip6.h>
  80 #include <netinet6/in6_pcb.h>
  81 #include <netinet6/ip6_var.h>
  82 #include <netinet6/scope6_var.h>
  83 #endif
  84 #ifdef TCP_RFC7413
  85 #include <netinet/tcp_fastopen.h>
  86 #endif
  87 #include <netinet/tcp.h>
  88 #include <netinet/tcp_fsm.h>
  89 #include <netinet/tcp_seq.h>
  90 #include <netinet/tcp_timer.h>
  91 #include <netinet/tcp_var.h>
  92 #include <netinet/tcpip.h>
  93 #include <netinet/tcp_cc.h>
  94 #ifdef TCPPCAP
  95 #include <netinet/tcp_pcap.h>
  96 #endif
  97 #ifdef TCPDEBUG
  98 #include <netinet/tcp_debug.h>
  99 #endif
 100 #ifdef TCP_OFFLOAD
 101 #include <netinet/tcp_offload.h>
 102 #endif
 103
 104 /*
 105  * TCP protocol interface to socket abstraction.
 106  */
 107 static int      tcp_attach(struct socket *);
 108 #ifdef INET
 109 static int      tcp_connect(struct tcpcb *, struct sockaddr *,
 110                     struct thread *td);
 111 #endif /* INET */
 112 #ifdef INET6
 113 static int      tcp6_connect(struct tcpcb *, struct sockaddr *,
 114                     struct thread *td);
 115 #endif /* INET6 */
 116 static void     tcp_disconnect(struct tcpcb *);
 117 static void     tcp_usrclosed(struct tcpcb *);
 118 static void     tcp_fill_info(struct tcpcb *, struct tcp_info *);
 119
 120 #ifdef TCPDEBUG
 121 #define TCPDEBUG0       int ostate = 0
 122 #define TCPDEBUG1()     ostate = tp ? tp->t_state : 0
 123 #define TCPDEBUG2(req)  if (tp && (so->so_options & SO_DEBUG)) \
 124                                 tcp_trace(TA_USER, ostate, tp, 0, 0, req)
 125 #else
 126 #define TCPDEBUG0
 127 #define TCPDEBUG1()
 128 #define TCPDEBUG2(req)
 129 #endif
 130
 131 /*
 132  * TCP attaches to socket via pru_attach(), reserving space,
 133  * and an internet control block.
 134  */
 135 static int
 136 tcp_usr_attach(struct socket *so, int proto, struct thread *td)
 137 {
 138         struct inpcb *inp;
 139         struct tcpcb *tp = NULL;
 140         int error;
 141         TCPDEBUG0;
 142
 143         inp = sotoinpcb(so);
 144         KASSERT(inp == NULL, ("tcp_usr_attach: inp != NULL"));
 145         TCPDEBUG1();
 146
 147         error = tcp_attach(so);
 148         if (error)
 149                 goto out;
 150
 151         if ((so->so_options & SO_LINGER) && so->so_linger == 0)
 152                 so->so_linger = TCP_LINGERTIME;
 153
 154         inp = sotoinpcb(so);
 155         tp = intotcpcb(inp);
 156 out:
 157         TCPDEBUG2(PRU_ATTACH);
 158         TCP_PROBE2(debug__user, tp, PRU_ATTACH);
 159         return error;
 160 }
 161
 162 /*
 163  * tcp_detach is called when the socket layer loses its final reference
 164  * to the socket, be it a file descriptor reference, a reference from TCP,
 165  * etc.  At this point, there is only one case in which we will keep around
 166  * inpcb state: time wait.
 167  *
 168  * This function can probably be re-absorbed back into tcp_usr_detach() now
 169  * that there is a single detach path.
 170  */
 171 static void
 172 tcp_detach(struct socket *so, struct inpcb *inp)
 173 {
 174         struct tcpcb *tp;
 175
 176         INP_INFO_LOCK_ASSERT(&V_tcbinfo);
 177         INP_WLOCK_ASSERT(inp);
 178
 179         KASSERT(so->so_pcb == inp, ("tcp_detach: so_pcb != inp"));
 180         KASSERT(inp->inp_socket == so, ("tcp_detach: inp_socket != so"));
 181
 182         tp = intotcpcb(inp);
 183
 184         if (inp->inp_flags & INP_TIMEWAIT) {
 185                 /*
 186                  * There are two cases to handle: one in which the time wait
 187                  * state is being discarded (INP_DROPPED), and one in which
 188                  * this connection will remain in timewait.  In the former,
 189                  * it is time to discard all state (except tcptw, which has
 190                  * already been discarded by the timewait close code, which
 191                  * should be further up the call stack somewhere).  In the
 192                  * latter case, we detach from the socket, but leave the pcb
 193                  * present until timewait ends.
 194                  *
 195                  * XXXRW: Would it be cleaner to free the tcptw here?
 196                  *
 197                  * Astute question indeed, from twtcp perspective there are
 198                  * three cases to consider:
 199                  *
 200                  * #1 tcp_detach is called at tcptw creation time by
 201                  *  tcp_twstart, then do not discard the newly created tcptw
 202                  *  and leave inpcb present until timewait ends
 203                  * #2 tcp_detach is called at timewait end (or reuse) by
 204                  *  tcp_twclose, then the tcptw has already been discarded
 205                  *  (or reused) and inpcb is freed here
 206                  * #3 tcp_detach is called() after timewait ends (or reuse)
 207                  *  (e.g. by soclose), then tcptw has already been discarded
 208                  *  (or reused) and inpcb is freed here
 209                  *
 210                  *  In all three cases the tcptw should not be freed here.
 211                  */
 212                 if (inp->inp_flags & INP_DROPPED) {
 213                         KASSERT(tp == NULL, ("tcp_detach: INP_TIMEWAIT && "
 214                             "INP_DROPPED && tp != NULL"));
 215                         in_pcbdetach(inp);
 216                         in_pcbfree(inp);
 217                 } else {
 218                         in_pcbdetach(inp);
 219                         INP_WUNLOCK(inp);
 220                 }
 221         } else {
 222                 /*
 223                  * If the connection is not in timewait, we consider two
 224                  * two conditions: one in which no further processing is
 225                  * necessary (dropped || embryonic), and one in which TCP is
 226                  * not yet done, but no longer requires the socket, so the
 227                  * pcb will persist for the time being.
 228                  *
 229                  * XXXRW: Does the second case still occur?
 230                  */
 231                 if (inp->inp_flags & INP_DROPPED ||
 232                     tp->t_state < TCPS_SYN_SENT) {
 233                         tcp_discardcb(tp);
 234                         in_pcbdetach(inp);
 235                         in_pcbfree(inp);
 236                 } else {
 237                         in_pcbdetach(inp);
 238                         INP_WUNLOCK(inp);
 239                 }
 240         }
 241 }
 242
 243 /*
 244  * pru_detach() detaches the TCP protocol from the socket.
 245  * If the protocol state is non-embryonic, then can't
 246  * do this directly: have to initiate a pru_disconnect(),
 247  * which may finish later; embryonic TCB's can just
 248  * be discarded here.
 249  */
 250 static void
 251 tcp_usr_detach(struct socket *so)
 252 {
 253         struct inpcb *inp;
 254         int rlock = 0;
 255
 256         inp = sotoinpcb(so);
 257         KASSERT(inp != NULL, ("tcp_usr_detach: inp == NULL"));
 258         if (!INP_INFO_WLOCKED(&V_tcbinfo)) {
 259                 INP_INFO_RLOCK(&V_tcbinfo);
 260                 rlock = 1;
 261         }
 262         INP_WLOCK(inp);
 263         KASSERT(inp->inp_socket != NULL,
 264             ("tcp_usr_detach: inp_socket == NULL"));
 265         tcp_detach(so, inp);
 266         if (rlock)
 267                 INP_INFO_RUNLOCK(&V_tcbinfo);
 268 }
 269
 270 #ifdef INET
 271 /*
 272  * Give the socket an address.
 273  */
 274 static int
 275 tcp_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 276 {
 277         int error = 0;
 278         struct inpcb *inp;
 279         struct tcpcb *tp = NULL;
 280         struct sockaddr_in *sinp;
 281
 282         sinp = (struct sockaddr_in *)nam;
 283         if (nam->sa_len != sizeof (*sinp))
 284                 return (EINVAL);
 285         /*
 286          * Must check for multicast addresses and disallow binding
 287          * to them.
 288          */
 289         if (sinp->sin_family == AF_INET &&
 290             IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 291                 return (EAFNOSUPPORT);
 292
 293         TCPDEBUG0;
 294         inp = sotoinpcb(so);
 295         KASSERT(inp != NULL, ("tcp_usr_bind: inp == NULL"));
 296         INP_WLOCK(inp);
 297         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 298                 error = EINVAL;
 299                 goto out;
 300         }
 301         tp = intotcpcb(inp);
 302         TCPDEBUG1();
 303         INP_HASH_WLOCK(&V_tcbinfo);
 304         error = in_pcbbind(inp, nam, td->td_ucred);
 305         INP_HASH_WUNLOCK(&V_tcbinfo);
 306 out:
 307         TCPDEBUG2(PRU_BIND);
 308         TCP_PROBE2(debug__user, tp, PRU_BIND);
 309         INP_WUNLOCK(inp);
 310
 311         return (error);
 312 }
 313 #endif /* INET */
 314
 315 #ifdef INET6
 316 static int
 317 tcp6_usr_bind(struct socket *so, struct sockaddr *nam, struct thread *td)
 318 {
 319         int error = 0;
 320         struct inpcb *inp;
 321         struct tcpcb *tp = NULL;
 322         struct sockaddr_in6 *sin6p;
 323
 324         sin6p = (struct sockaddr_in6 *)nam;
 325         if (nam->sa_len != sizeof (*sin6p))
 326                 return (EINVAL);
 327         /*
 328          * Must check for multicast addresses and disallow binding
 329          * to them.
 330          */
 331         if (sin6p->sin6_family == AF_INET6 &&
 332             IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 333                 return (EAFNOSUPPORT);
 334
 335         TCPDEBUG0;
 336         inp = sotoinpcb(so);
 337         KASSERT(inp != NULL, ("tcp6_usr_bind: inp == NULL"));
 338         INP_WLOCK(inp);
 339         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 340                 error = EINVAL;
 341                 goto out;
 342         }
 343         tp = intotcpcb(inp);
 344         TCPDEBUG1();
 345         INP_HASH_WLOCK(&V_tcbinfo);
 346         inp->inp_vflag &= ~INP_IPV4;
 347         inp->inp_vflag |= INP_IPV6;
 348 #ifdef INET
 349         if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0) {
 350                 if (IN6_IS_ADDR_UNSPECIFIED(&sin6p->sin6_addr))
 351                         inp->inp_vflag |= INP_IPV4;
 352                 else if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 353                         struct sockaddr_in sin;
 354
 355                         in6_sin6_2_sin(&sin, sin6p);
 356                         inp->inp_vflag |= INP_IPV4;
 357                         inp->inp_vflag &= ~INP_IPV6;
 358                         error = in_pcbbind(inp, (struct sockaddr *)&sin,
 359                             td->td_ucred);
 360                         INP_HASH_WUNLOCK(&V_tcbinfo);
 361                         goto out;
 362                 }
 363         }
 364 #endif
 365         error = in6_pcbbind(inp, nam, td->td_ucred);
 366         INP_HASH_WUNLOCK(&V_tcbinfo);
 367 out:
 368         TCPDEBUG2(PRU_BIND);
 369         TCP_PROBE2(debug__user, tp, PRU_BIND);
 370         INP_WUNLOCK(inp);
 371         return (error);
 372 }
 373 #endif /* INET6 */
 374
 375 #ifdef INET
 376 /*
 377  * Prepare to accept connections.
 378  */
 379 static int
 380 tcp_usr_listen(struct socket *so, int backlog, struct thread *td)
 381 {
 382         int error = 0;
 383         struct inpcb *inp;
 384         struct tcpcb *tp = NULL;
 385
 386         TCPDEBUG0;
 387         inp = sotoinpcb(so);
 388         KASSERT(inp != NULL, ("tcp_usr_listen: inp == NULL"));
 389         INP_WLOCK(inp);
 390         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 391                 error = EINVAL;
 392                 goto out;
 393         }
 394         tp = intotcpcb(inp);
 395         TCPDEBUG1();
 396         SOCK_LOCK(so);
 397         error = solisten_proto_check(so);
 398         INP_HASH_WLOCK(&V_tcbinfo);
 399         if (error == 0 && inp->inp_lport == 0)
 400                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 401         INP_HASH_WUNLOCK(&V_tcbinfo);
 402         if (error == 0) {
 403                 tcp_state_change(tp, TCPS_LISTEN);
 404                 solisten_proto(so, backlog);
 405 #ifdef TCP_OFFLOAD
 406                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 407                         tcp_offload_listen_start(tp);
 408 #endif
 409         }
 410         SOCK_UNLOCK(so);
 411
 412 #ifdef TCP_RFC7413
 413         if (tp->t_flags & TF_FASTOPEN)
 414                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 415 #endif
 416 out:
 417         TCPDEBUG2(PRU_LISTEN);
 418         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 419         INP_WUNLOCK(inp);
 420         return (error);
 421 }
 422 #endif /* INET */
 423
 424 #ifdef INET6
 425 static int
 426 tcp6_usr_listen(struct socket *so, int backlog, struct thread *td)
 427 {
 428         int error = 0;
 429         struct inpcb *inp;
 430         struct tcpcb *tp = NULL;
 431
 432         TCPDEBUG0;
 433         inp = sotoinpcb(so);
 434         KASSERT(inp != NULL, ("tcp6_usr_listen: inp == NULL"));
 435         INP_WLOCK(inp);
 436         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 437                 error = EINVAL;
 438                 goto out;
 439         }
 440         tp = intotcpcb(inp);
 441         TCPDEBUG1();
 442         SOCK_LOCK(so);
 443         error = solisten_proto_check(so);
 444         INP_HASH_WLOCK(&V_tcbinfo);
 445         if (error == 0 && inp->inp_lport == 0) {
 446                 inp->inp_vflag &= ~INP_IPV4;
 447                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) == 0)
 448                         inp->inp_vflag |= INP_IPV4;
 449                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
 450         }
 451         INP_HASH_WUNLOCK(&V_tcbinfo);
 452         if (error == 0) {
 453                 tcp_state_change(tp, TCPS_LISTEN);
 454                 solisten_proto(so, backlog);
 455 #ifdef TCP_OFFLOAD
 456                 if ((so->so_options & SO_NO_OFFLOAD) == 0)
 457                         tcp_offload_listen_start(tp);
 458 #endif
 459         }
 460         SOCK_UNLOCK(so);
 461
 462 #ifdef TCP_RFC7413
 463         if (tp->t_flags & TF_FASTOPEN)
 464                 tp->t_tfo_pending = tcp_fastopen_alloc_counter();
 465 #endif
 466 out:
 467         TCPDEBUG2(PRU_LISTEN);
 468         TCP_PROBE2(debug__user, tp, PRU_LISTEN);
 469         INP_WUNLOCK(inp);
 470         return (error);
 471 }
 472 #endif /* INET6 */
 473
 474 #ifdef INET
 475 /*
 476  * Initiate connection to peer.
 477  * Create a template for use in transmissions on this connection.
 478  * Enter SYN_SENT state, and mark socket as connecting.
 479  * Start keep-alive timer, and seed output sequence space.
 480  * Send initial segment on connection.
 481  */
 482 static int
 483 tcp_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 484 {
 485         int error = 0;
 486         struct inpcb *inp;
 487         struct tcpcb *tp = NULL;
 488         struct sockaddr_in *sinp;
 489
 490         sinp = (struct sockaddr_in *)nam;
 491         if (nam->sa_len != sizeof (*sinp))
 492                 return (EINVAL);
 493         /*
 494          * Must disallow TCP ``connections'' to multicast addresses.
 495          */
 496         if (sinp->sin_family == AF_INET
 497             && IN_MULTICAST(ntohl(sinp->sin_addr.s_addr)))
 498                 return (EAFNOSUPPORT);
 499         if ((error = prison_remote_ip4(td->td_ucred, &sinp->sin_addr)) != 0)
 500                 return (error);
 501
 502         TCPDEBUG0;
 503         inp = sotoinpcb(so);
 504         KASSERT(inp != NULL, ("tcp_usr_connect: inp == NULL"));
 505         INP_WLOCK(inp);
 506         if (inp->inp_flags & INP_TIMEWAIT) {
 507                 error = EADDRINUSE;
 508                 goto out;
 509         }
 510         if (inp->inp_flags & INP_DROPPED) {
 511                 error = ECONNREFUSED;
 512                 goto out;
 513         }
 514         tp = intotcpcb(inp);
 515         TCPDEBUG1();
 516         if ((error = tcp_connect(tp, nam, td)) != 0)
 517                 goto out;
 518 #ifdef TCP_OFFLOAD
 519         if (registered_toedevs > 0 &&
 520             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 521             (error = tcp_offload_connect(so, nam)) == 0)
 522                 goto out;
 523 #endif
 524         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 525         error = tp->t_fb->tfb_tcp_output(tp);
 526 out:
 527         TCPDEBUG2(PRU_CONNECT);
 528         INP_WUNLOCK(inp);
 529         return (error);
 530 }
 531 #endif /* INET */
 532
 533 #ifdef INET6
 534 static int
 535 tcp6_usr_connect(struct socket *so, struct sockaddr *nam, struct thread *td)
 536 {
 537         int error = 0;
 538         struct inpcb *inp;
 539         struct tcpcb *tp = NULL;
 540         struct sockaddr_in6 *sin6p;
 541
 542         TCPDEBUG0;
 543
 544         sin6p = (struct sockaddr_in6 *)nam;
 545         if (nam->sa_len != sizeof (*sin6p))
 546                 return (EINVAL);
 547         /*
 548          * Must disallow TCP ``connections'' to multicast addresses.
 549          */
 550         if (sin6p->sin6_family == AF_INET6
 551             && IN6_IS_ADDR_MULTICAST(&sin6p->sin6_addr))
 552                 return (EAFNOSUPPORT);
 553
 554         inp = sotoinpcb(so);
 555         KASSERT(inp != NULL, ("tcp6_usr_connect: inp == NULL"));
 556         INP_WLOCK(inp);
 557         if (inp->inp_flags & INP_TIMEWAIT) {
 558                 error = EADDRINUSE;
 559                 goto out;
 560         }
 561         if (inp->inp_flags & INP_DROPPED) {
 562                 error = ECONNREFUSED;
 563                 goto out;
 564         }
 565         tp = intotcpcb(inp);
 566         TCPDEBUG1();
 567 #ifdef INET
 568         /*
 569          * XXXRW: Some confusion: V4/V6 flags relate to binding, and
 570          * therefore probably require the hash lock, which isn't held here.
 571          * Is this a significant problem?
 572          */
 573         if (IN6_IS_ADDR_V4MAPPED(&sin6p->sin6_addr)) {
 574                 struct sockaddr_in sin;
 575
 576                 if ((inp->inp_flags & IN6P_IPV6_V6ONLY) != 0) {
 577                         error = EINVAL;
 578                         goto out;
 579                 }
 580
 581                 in6_sin6_2_sin(&sin, sin6p);
 582                 inp->inp_vflag |= INP_IPV4;
 583                 inp->inp_vflag &= ~INP_IPV6;
 584                 if ((error = prison_remote_ip4(td->td_ucred,
 585                     &sin.sin_addr)) != 0)
 586                         goto out;
 587                 if ((error = tcp_connect(tp, (struct sockaddr *)&sin, td)) != 0)
 588                         goto out;
 589 #ifdef TCP_OFFLOAD
 590                 if (registered_toedevs > 0 &&
 591                     (so->so_options & SO_NO_OFFLOAD) == 0 &&
 592                     (error = tcp_offload_connect(so, nam)) == 0)
 593                         goto out;
 594 #endif
 595                 error = tp->t_fb->tfb_tcp_output(tp);
 596                 goto out;
 597         }
 598 #endif
 599         inp->inp_vflag &= ~INP_IPV4;
 600         inp->inp_vflag |= INP_IPV6;
 601         inp->inp_inc.inc_flags |= INC_ISIPV6;
 602         if ((error = prison_remote_ip6(td->td_ucred, &sin6p->sin6_addr)) != 0)
 603                 goto out;
 604         if ((error = tcp6_connect(tp, nam, td)) != 0)
 605                 goto out;
 606 #ifdef TCP_OFFLOAD
 607         if (registered_toedevs > 0 &&
 608             (so->so_options & SO_NO_OFFLOAD) == 0 &&
 609             (error = tcp_offload_connect(so, nam)) == 0)
 610                 goto out;
 611 #endif
 612         tcp_timer_activate(tp, TT_KEEP, TP_KEEPINIT(tp));
 613         error = tp->t_fb->tfb_tcp_output(tp);
 614
 615 out:
 616         TCPDEBUG2(PRU_CONNECT);
 617         TCP_PROBE2(debug__user, tp, PRU_CONNECT);
 618         INP_WUNLOCK(inp);
 619         return (error);
 620 }
 621 #endif /* INET6 */
 622
 623 /*
 624  * Initiate disconnect from peer.
 625  * If connection never passed embryonic stage, just drop;
 626  * else if don't need to let data drain, then can just drop anyways,
 627  * else have to begin TCP shutdown process: mark socket disconnecting,
 628  * drain unread data, state switch to reflect user close, and
 629  * send segment (e.g. FIN) to peer.  Socket will be really disconnected
 630  * when peer sends FIN and acks ours.
 631  *
 632  * SHOULD IMPLEMENT LATER PRU_CONNECT VIA REALLOC TCPCB.
 633  */
 634 static int
 635 tcp_usr_disconnect(struct socket *so)
 636 {
 637         struct inpcb *inp;
 638         struct tcpcb *tp = NULL;
 639         int error = 0;
 640
 641         TCPDEBUG0;
 642         INP_INFO_RLOCK(&V_tcbinfo);
 643         inp = sotoinpcb(so);
 644         KASSERT(inp != NULL, ("tcp_usr_disconnect: inp == NULL"));
 645         INP_WLOCK(inp);
 646         if (inp->inp_flags & INP_TIMEWAIT)
 647                 goto out;
 648         if (inp->inp_flags & INP_DROPPED) {
 649                 error = ECONNRESET;
 650                 goto out;
 651         }
 652         tp = intotcpcb(inp);
 653         TCPDEBUG1();
 654         tcp_disconnect(tp);
 655 out:
 656         TCPDEBUG2(PRU_DISCONNECT);
 657         TCP_PROBE2(debug__user, tp, PRU_DISCONNECT);
 658         INP_WUNLOCK(inp);
 659         INP_INFO_RUNLOCK(&V_tcbinfo);
 660         return (error);
 661 }
 662
 663 #ifdef INET
 664 /*
 665  * Accept a connection.  Essentially all the work is done at higher levels;
 666  * just return the address of the peer, storing through addr.
 667  */
 668 static int
 669 tcp_usr_accept(struct socket *so, struct sockaddr **nam)
 670 {
 671         int error = 0;
 672         struct inpcb *inp = NULL;
 673         struct tcpcb *tp = NULL;
 674         struct in_addr addr;
 675         in_port_t port = 0;
 676         TCPDEBUG0;
 677
 678         if (so->so_state & SS_ISDISCONNECTED)
 679                 return (ECONNABORTED);
 680
 681         inp = sotoinpcb(so);
 682         KASSERT(inp != NULL, ("tcp_usr_accept: inp == NULL"));
 683         INP_WLOCK(inp);
 684         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 685                 error = ECONNABORTED;
 686                 goto out;
 687         }
 688         tp = intotcpcb(inp);
 689         TCPDEBUG1();
 690
 691         /*
 692          * We inline in_getpeeraddr and COMMON_END here, so that we can
 693          * copy the data of interest and defer the malloc until after we
 694          * release the lock.
 695          */
 696         port = inp->inp_fport;
 697         addr = inp->inp_faddr;
 698
 699 out:
 700         TCPDEBUG2(PRU_ACCEPT);
 701         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 702         INP_WUNLOCK(inp);
 703         if (error == 0)
 704                 *nam = in_sockaddr(port, &addr);
 705         return error;
 706 }
 707 #endif /* INET */
 708
 709 #ifdef INET6
 710 static int
 711 tcp6_usr_accept(struct socket *so, struct sockaddr **nam)
 712 {
 713         struct inpcb *inp = NULL;
 714         int error = 0;
 715         struct tcpcb *tp = NULL;
 716         struct in_addr addr;
 717         struct in6_addr addr6;
 718         in_port_t port = 0;
 719         int v4 = 0;
 720         TCPDEBUG0;
 721
 722         if (so->so_state & SS_ISDISCONNECTED)
 723                 return (ECONNABORTED);
 724
 725         inp = sotoinpcb(so);
 726         KASSERT(inp != NULL, ("tcp6_usr_accept: inp == NULL"));
 727         INP_INFO_RLOCK(&V_tcbinfo);
 728         INP_WLOCK(inp);
 729         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 730                 error = ECONNABORTED;
 731                 goto out;
 732         }
 733         tp = intotcpcb(inp);
 734         TCPDEBUG1();
 735
 736         /*
 737          * We inline in6_mapped_peeraddr and COMMON_END here, so that we can
 738          * copy the data of interest and defer the malloc until after we
 739          * release the lock.
 740          */
 741         if (inp->inp_vflag & INP_IPV4) {
 742                 v4 = 1;
 743                 port = inp->inp_fport;
 744                 addr = inp->inp_faddr;
 745         } else {
 746                 port = inp->inp_fport;
 747                 addr6 = inp->in6p_faddr;
 748         }
 749
 750 out:
 751         TCPDEBUG2(PRU_ACCEPT);
 752         TCP_PROBE2(debug__user, tp, PRU_ACCEPT);
 753         INP_WUNLOCK(inp);
 754         INP_INFO_RUNLOCK(&V_tcbinfo);
 755         if (error == 0) {
 756                 if (v4)
 757                         *nam = in6_v4mapsin6_sockaddr(port, &addr);
 758                 else
 759                         *nam = in6_sockaddr(port, &addr6);
 760         }
 761         return error;
 762 }
 763 #endif /* INET6 */
 764
 765 /*
 766  * Mark the connection as being incapable of further output.
 767  */
 768 static int
 769 tcp_usr_shutdown(struct socket *so)
 770 {
 771         int error = 0;
 772         struct inpcb *inp;
 773         struct tcpcb *tp = NULL;
 774
 775         TCPDEBUG0;
 776         INP_INFO_RLOCK(&V_tcbinfo);
 777         inp = sotoinpcb(so);
 778         KASSERT(inp != NULL, ("inp == NULL"));
 779         INP_WLOCK(inp);
 780         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 781                 error = ECONNRESET;
 782                 goto out;
 783         }
 784         tp = intotcpcb(inp);
 785         TCPDEBUG1();
 786         socantsendmore(so);
 787         tcp_usrclosed(tp);
 788         if (!(inp->inp_flags & INP_DROPPED))
 789                 error = tp->t_fb->tfb_tcp_output(tp);
 790
 791 out:
 792         TCPDEBUG2(PRU_SHUTDOWN);
 793         TCP_PROBE2(debug__user, tp, PRU_SHUTDOWN);
 794         INP_WUNLOCK(inp);
 795         INP_INFO_RUNLOCK(&V_tcbinfo);
 796
 797         return (error);
 798 }
 799
 800 /*
 801  * After a receive, possibly send window update to peer.
 802  */
 803 static int
 804 tcp_usr_rcvd(struct socket *so, int flags)
 805 {
 806         struct inpcb *inp;
 807         struct tcpcb *tp = NULL;
 808         int error = 0;
 809
 810         TCPDEBUG0;
 811         inp = sotoinpcb(so);
 812         KASSERT(inp != NULL, ("tcp_usr_rcvd: inp == NULL"));
 813         INP_WLOCK(inp);
 814         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 815                 error = ECONNRESET;
 816                 goto out;
 817         }
 818         tp = intotcpcb(inp);
 819         TCPDEBUG1();
 820 #ifdef TCP_RFC7413
 821         /*
 822          * For passively-created TFO connections, don't attempt a window
 823          * update while still in SYN_RECEIVED as this may trigger an early
 824          * SYN|ACK.  It is preferable to have the SYN|ACK be sent along with
 825          * application response data, or failing that, when the DELACK timer
 826          * expires.
 827          */
 828         if ((tp->t_flags & TF_FASTOPEN) &&
 829             (tp->t_state == TCPS_SYN_RECEIVED))
 830                 goto out;
 831 #endif
 832 #ifdef TCP_OFFLOAD
 833         if (tp->t_flags & TF_TOE)
 834                 tcp_offload_rcvd(tp);
 835         else
 836 #endif
 837         tp->t_fb->tfb_tcp_output(tp);
 838
 839 out:
 840         TCPDEBUG2(PRU_RCVD);
 841         TCP_PROBE2(debug__user, tp, PRU_RCVD);
 842         INP_WUNLOCK(inp);
 843         return (error);
 844 }
 845
 846 /*
 847  * Do a send by putting data in output queue and updating urgent
 848  * marker if URG set.  Possibly send more data.  Unlike the other
 849  * pru_*() routines, the mbuf chains are our responsibility.  We
 850  * must either enqueue them or free them.  The other pru_* routines
 851  * generally are caller-frees.
 852  */
 853 static int
 854 tcp_usr_send(struct socket *so, int flags, struct mbuf *m,
 855     struct sockaddr *nam, struct mbuf *control, struct thread *td)
 856 {
 857         int error = 0;
 858         struct inpcb *inp;
 859         struct tcpcb *tp = NULL;
 860 #ifdef INET6
 861         int isipv6;
 862 #endif
 863         TCPDEBUG0;
 864
 865         /*
 866          * We require the pcbinfo lock if we will close the socket as part of
 867          * this call.
 868          */
 869         if (flags & PRUS_EOF)
 870                 INP_INFO_RLOCK(&V_tcbinfo);
 871         inp = sotoinpcb(so);
 872         KASSERT(inp != NULL, ("tcp_usr_send: inp == NULL"));
 873         INP_WLOCK(inp);
 874         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
 875                 if (control)
 876                         m_freem(control);
 877                 /*
 878                  * In case of PRUS_NOTREADY, tcp_usr_ready() is responsible
 879                  * for freeing memory.
 880                  */
 881                 if (m && (flags & PRUS_NOTREADY) == 0)
 882                         m_freem(m);
 883                 error = ECONNRESET;
 884                 goto out;
 885         }
 886 #ifdef INET6
 887         isipv6 = nam && nam->sa_family == AF_INET6;
 888 #endif /* INET6 */
 889         tp = intotcpcb(inp);
 890         TCPDEBUG1();
 891         if (control) {
 892                 /* TCP doesn't do control messages (rights, creds, etc) */
 893                 if (control->m_len) {
 894                         m_freem(control);
 895                         if (m)
 896                                 m_freem(m);
 897                         error = EINVAL;
 898                         goto out;
 899                 }
 900                 m_freem(control);       /* empty control, just free it */
 901         }
 902         if (!(flags & PRUS_OOB)) {
 903                 sbappendstream(&so->so_snd, m, flags);
 904                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 905                         /*
 906                          * Do implied connect if not yet connected,
 907                          * initialize window to default value, and
 908                          * initialize maxseg using peer's cached MSS.
 909                          */
 910 #ifdef INET6
 911                         if (isipv6)
 912                                 error = tcp6_connect(tp, nam, td);
 913 #endif /* INET6 */
 914 #if defined(INET6) && defined(INET)
 915                         else
 916 #endif
 917 #ifdef INET
 918                                 error = tcp_connect(tp, nam, td);
 919 #endif
 920                         if (error)
 921                                 goto out;
 922                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 923                         tcp_mss(tp, -1);
 924                 }
 925                 if (flags & PRUS_EOF) {
 926                         /*
 927                          * Close the send side of the connection after
 928                          * the data is sent.
 929                          */
 930                         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
 931                         socantsendmore(so);
 932                         tcp_usrclosed(tp);
 933                 }
 934                 if (!(inp->inp_flags & INP_DROPPED) &&
 935                     !(flags & PRUS_NOTREADY)) {
 936                         if (flags & PRUS_MORETOCOME)
 937                                 tp->t_flags |= TF_MORETOCOME;
 938                         error = tp->t_fb->tfb_tcp_output(tp);
 939                         if (flags & PRUS_MORETOCOME)
 940                                 tp->t_flags &= ~TF_MORETOCOME;
 941                 }
 942         } else {
 943                 /*
 944                  * XXXRW: PRUS_EOF not implemented with PRUS_OOB?
 945                  */
 946                 SOCKBUF_LOCK(&so->so_snd);
 947                 if (sbspace(&so->so_snd) < -512) {
 948                         SOCKBUF_UNLOCK(&so->so_snd);
 949                         m_freem(m);
 950                         error = ENOBUFS;
 951                         goto out;
 952                 }
 953                 /*
 954                  * According to RFC961 (Assigned Protocols),
 955                  * the urgent pointer points to the last octet
 956                  * of urgent data.  We continue, however,
 957                  * to consider it to indicate the first octet
 958                  * of data past the urgent section.
 959                  * Otherwise, snd_up should be one lower.
 960                  */
 961                 sbappendstream_locked(&so->so_snd, m, flags);
 962                 SOCKBUF_UNLOCK(&so->so_snd);
 963                 if (nam && tp->t_state < TCPS_SYN_SENT) {
 964                         /*
 965                          * Do implied connect if not yet connected,
 966                          * initialize window to default value, and
 967                          * initialize maxseg using peer's cached MSS.
 968                          */
 969 #ifdef INET6
 970                         if (isipv6)
 971                                 error = tcp6_connect(tp, nam, td);
 972 #endif /* INET6 */
 973 #if defined(INET6) && defined(INET)
 974                         else
 975 #endif
 976 #ifdef INET
 977                                 error = tcp_connect(tp, nam, td);
 978 #endif
 979                         if (error)
 980                                 goto out;
 981                         tp->snd_wnd = TTCP_CLIENT_SND_WND;
 982                         tcp_mss(tp, -1);
 983                 }
 984                 tp->snd_up = tp->snd_una + sbavail(&so->so_snd);
 985                 if (!(flags & PRUS_NOTREADY)) {
 986                         tp->t_flags |= TF_FORCEDATA;
 987                         error = tp->t_fb->tfb_tcp_output(tp);
 988                         tp->t_flags &= ~TF_FORCEDATA;
 989                 }
 990         }
 991 out:
 992         TCPDEBUG2((flags & PRUS_OOB) ? PRU_SENDOOB :
 993                   ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 994         TCP_PROBE2(debug__user, tp, (flags & PRUS_OOB) ? PRU_SENDOOB :
 995                    ((flags & PRUS_EOF) ? PRU_SEND_EOF : PRU_SEND));
 996         INP_WUNLOCK(inp);
 997         if (flags & PRUS_EOF)
 998                 INP_INFO_RUNLOCK(&V_tcbinfo);
 999         return (error);
1000 }
1001
1002 static int
1003 tcp_usr_ready(struct socket *so, struct mbuf *m, int count)
1004 {
1005         struct inpcb *inp;
1006         struct tcpcb *tp;
1007         int error;
1008
1009         inp = sotoinpcb(so);
1010         INP_WLOCK(inp);
1011         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1012                 INP_WUNLOCK(inp);
1013                 for (int i = 0; i < count; i++)
1014                         m = m_free(m);
1015                 return (ECONNRESET);
1016         }
1017         tp = intotcpcb(inp);
1018
1019         SOCKBUF_LOCK(&so->so_snd);
1020         error = sbready(&so->so_snd, m, count);
1021         SOCKBUF_UNLOCK(&so->so_snd);
1022         if (error == 0)
1023                 error = tp->t_fb->tfb_tcp_output(tp);
1024         INP_WUNLOCK(inp);
1025
1026         return (error);
1027 }
1028
1029 /*
1030  * Abort the TCP.  Drop the connection abruptly.
1031  */
1032 static void
1033 tcp_usr_abort(struct socket *so)
1034 {
1035         struct inpcb *inp;
1036         struct tcpcb *tp = NULL;
1037         TCPDEBUG0;
1038
1039         inp = sotoinpcb(so);
1040         KASSERT(inp != NULL, ("tcp_usr_abort: inp == NULL"));
1041
1042         INP_INFO_RLOCK(&V_tcbinfo);
1043         INP_WLOCK(inp);
1044         KASSERT(inp->inp_socket != NULL,
1045             ("tcp_usr_abort: inp_socket == NULL"));
1046
1047         /*
1048          * If we still have full TCP state, and we're not dropped, drop.
1049          */
1050         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1051             !(inp->inp_flags & INP_DROPPED)) {
1052                 tp = intotcpcb(inp);
1053                 TCPDEBUG1();
1054                 tcp_drop(tp, ECONNABORTED);
1055                 TCPDEBUG2(PRU_ABORT);
1056                 TCP_PROBE2(debug__user, tp, PRU_ABORT);
1057         }
1058         if (!(inp->inp_flags & INP_DROPPED)) {
1059                 SOCK_LOCK(so);
1060                 so->so_state |= SS_PROTOREF;
1061                 SOCK_UNLOCK(so);
1062                 inp->inp_flags |= INP_SOCKREF;
1063         }
1064         INP_WUNLOCK(inp);
1065         INP_INFO_RUNLOCK(&V_tcbinfo);
1066 }
1067
1068 /*
1069  * TCP socket is closed.  Start friendly disconnect.
1070  */
1071 static void
1072 tcp_usr_close(struct socket *so)
1073 {
1074         struct inpcb *inp;
1075         struct tcpcb *tp = NULL;
1076         TCPDEBUG0;
1077
1078         inp = sotoinpcb(so);
1079         KASSERT(inp != NULL, ("tcp_usr_close: inp == NULL"));
1080
1081         INP_INFO_RLOCK(&V_tcbinfo);
1082         INP_WLOCK(inp);
1083         KASSERT(inp->inp_socket != NULL,
1084             ("tcp_usr_close: inp_socket == NULL"));
1085
1086         /*
1087          * If we still have full TCP state, and we're not dropped, initiate
1088          * a disconnect.
1089          */
1090         if (!(inp->inp_flags & INP_TIMEWAIT) &&
1091             !(inp->inp_flags & INP_DROPPED)) {
1092                 tp = intotcpcb(inp);
1093                 TCPDEBUG1();
1094                 tcp_disconnect(tp);
1095                 TCPDEBUG2(PRU_CLOSE);
1096                 TCP_PROBE2(debug__user, tp, PRU_CLOSE);
1097         }
1098         if (!(inp->inp_flags & INP_DROPPED)) {
1099                 SOCK_LOCK(so);
1100                 so->so_state |= SS_PROTOREF;
1101                 SOCK_UNLOCK(so);
1102                 inp->inp_flags |= INP_SOCKREF;
1103         }
1104         INP_WUNLOCK(inp);
1105         INP_INFO_RUNLOCK(&V_tcbinfo);
1106 }
1107
1108 /*
1109  * Receive out-of-band data.
1110  */
1111 static int
1112 tcp_usr_rcvoob(struct socket *so, struct mbuf *m, int flags)
1113 {
1114         int error = 0;
1115         struct inpcb *inp;
1116         struct tcpcb *tp = NULL;
1117
1118         TCPDEBUG0;
1119         inp = sotoinpcb(so);
1120         KASSERT(inp != NULL, ("tcp_usr_rcvoob: inp == NULL"));
1121         INP_WLOCK(inp);
1122         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1123                 error = ECONNRESET;
1124                 goto out;
1125         }
1126         tp = intotcpcb(inp);
1127         TCPDEBUG1();
1128         if ((so->so_oobmark == 0 &&
1129              (so->so_rcv.sb_state & SBS_RCVATMARK) == 0) ||
1130             so->so_options & SO_OOBINLINE ||
1131             tp->t_oobflags & TCPOOB_HADDATA) {
1132                 error = EINVAL;
1133                 goto out;
1134         }
1135         if ((tp->t_oobflags & TCPOOB_HAVEDATA) == 0) {
1136                 error = EWOULDBLOCK;
1137                 goto out;
1138         }
1139         m->m_len = 1;
1140         *mtod(m, caddr_t) = tp->t_iobc;
1141         if ((flags & MSG_PEEK) == 0)
1142                 tp->t_oobflags ^= (TCPOOB_HAVEDATA | TCPOOB_HADDATA);
1143
1144 out:
1145         TCPDEBUG2(PRU_RCVOOB);
1146         TCP_PROBE2(debug__user, tp, PRU_RCVOOB);
1147         INP_WUNLOCK(inp);
1148         return (error);
1149 }
1150
1151 #ifdef INET
1152 struct pr_usrreqs tcp_usrreqs = {
1153         .pru_abort =            tcp_usr_abort,
1154         .pru_accept =           tcp_usr_accept,
1155         .pru_attach =           tcp_usr_attach,
1156         .pru_bind =             tcp_usr_bind,
1157         .pru_connect =          tcp_usr_connect,
1158         .pru_control =          in_control,
1159         .pru_detach =           tcp_usr_detach,
1160         .pru_disconnect =       tcp_usr_disconnect,
1161         .pru_listen =           tcp_usr_listen,
1162         .pru_peeraddr =         in_getpeeraddr,
1163         .pru_rcvd =             tcp_usr_rcvd,
1164         .pru_rcvoob =           tcp_usr_rcvoob,
1165         .pru_send =             tcp_usr_send,
1166         .pru_ready =            tcp_usr_ready,
1167         .pru_shutdown =         tcp_usr_shutdown,
1168         .pru_sockaddr =         in_getsockaddr,
1169         .pru_sosetlabel =       in_pcbsosetlabel,
1170         .pru_close =            tcp_usr_close,
1171 };
1172 #endif /* INET */
1173
1174 #ifdef INET6
1175 struct pr_usrreqs tcp6_usrreqs = {
1176         .pru_abort =            tcp_usr_abort,
1177         .pru_accept =           tcp6_usr_accept,
1178         .pru_attach =           tcp_usr_attach,
1179         .pru_bind =             tcp6_usr_bind,
1180         .pru_connect =          tcp6_usr_connect,
1181         .pru_control =          in6_control,
1182         .pru_detach =           tcp_usr_detach,
1183         .pru_disconnect =       tcp_usr_disconnect,
1184         .pru_listen =           tcp6_usr_listen,
1185         .pru_peeraddr =         in6_mapped_peeraddr,
1186         .pru_rcvd =             tcp_usr_rcvd,
1187         .pru_rcvoob =           tcp_usr_rcvoob,
1188         .pru_send =             tcp_usr_send,
1189         .pru_ready =            tcp_usr_ready,
1190         .pru_shutdown =         tcp_usr_shutdown,
1191         .pru_sockaddr =         in6_mapped_sockaddr,
1192         .pru_sosetlabel =       in_pcbsosetlabel,
1193         .pru_close =            tcp_usr_close,
1194 };
1195 #endif /* INET6 */
1196
1197 #ifdef INET
1198 /*
1199  * Common subroutine to open a TCP connection to remote host specified
1200  * by struct sockaddr_in in mbuf *nam.  Call in_pcbbind to assign a local
1201  * port number if needed.  Call in_pcbconnect_setup to do the routing and
1202  * to choose a local host address (interface).  If there is an existing
1203  * incarnation of the same connection in TIME-WAIT state and if the remote
1204  * host was sending CC options and if the connection duration was < MSL, then
1205  * truncate the previous TIME-WAIT state and proceed.
1206  * Initialize connection parameters and enter SYN-SENT state.
1207  */
1208 static int
1209 tcp_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1210 {
1211         struct inpcb *inp = tp->t_inpcb, *oinp;
1212         struct socket *so = inp->inp_socket;
1213         struct in_addr laddr;
1214         u_short lport;
1215         int error;
1216
1217         INP_WLOCK_ASSERT(inp);
1218         INP_HASH_WLOCK(&V_tcbinfo);
1219
1220         if (inp->inp_lport == 0) {
1221                 error = in_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1222                 if (error)
1223                         goto out;
1224         }
1225
1226         /*
1227          * Cannot simply call in_pcbconnect, because there might be an
1228          * earlier incarnation of this same connection still in
1229          * TIME_WAIT state, creating an ADDRINUSE error.
1230          */
1231         laddr = inp->inp_laddr;
1232         lport = inp->inp_lport;
1233         error = in_pcbconnect_setup(inp, nam, &laddr.s_addr, &lport,
1234             &inp->inp_faddr.s_addr, &inp->inp_fport, &oinp, td->td_ucred);
1235         if (error && oinp == NULL)
1236                 goto out;
1237         if (oinp) {
1238                 error = EADDRINUSE;
1239                 goto out;
1240         }
1241         inp->inp_laddr = laddr;
1242         in_pcbrehash(inp);
1243         INP_HASH_WUNLOCK(&V_tcbinfo);
1244
1245         /*
1246          * Compute window scaling to request:
1247          * Scale to fit into sweet spot.  See tcp_syncache.c.
1248          * XXX: This should move to tcp_output().
1249          */
1250         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1251             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1252                 tp->request_r_scale++;
1253
1254         soisconnecting(so);
1255         TCPSTAT_INC(tcps_connattempt);
1256         tcp_state_change(tp, TCPS_SYN_SENT);
1257         tp->iss = tcp_new_isn(tp);
1258         tcp_sendseqinit(tp);
1259
1260         return 0;
1261
1262 out:
1263         INP_HASH_WUNLOCK(&V_tcbinfo);
1264         return (error);
1265 }
1266 #endif /* INET */
1267
1268 #ifdef INET6
1269 static int
1270 tcp6_connect(struct tcpcb *tp, struct sockaddr *nam, struct thread *td)
1271 {
1272         struct inpcb *inp = tp->t_inpcb;
1273         int error;
1274
1275         INP_WLOCK_ASSERT(inp);
1276         INP_HASH_WLOCK(&V_tcbinfo);
1277
1278         if (inp->inp_lport == 0) {
1279                 error = in6_pcbbind(inp, (struct sockaddr *)0, td->td_ucred);
1280                 if (error)
1281                         goto out;
1282         }
1283         error = in6_pcbconnect(inp, nam, td->td_ucred);
1284         if (error != 0)
1285                 goto out;
1286         INP_HASH_WUNLOCK(&V_tcbinfo);
1287
1288         /* Compute window scaling to request.  */
1289         while (tp->request_r_scale < TCP_MAX_WINSHIFT &&
1290             (TCP_MAXWIN << tp->request_r_scale) < sb_max)
1291                 tp->request_r_scale++;
1292
1293         soisconnecting(inp->inp_socket);
1294         TCPSTAT_INC(tcps_connattempt);
1295         tcp_state_change(tp, TCPS_SYN_SENT);
1296         tp->iss = tcp_new_isn(tp);
1297         tcp_sendseqinit(tp);
1298
1299         return 0;
1300
1301 out:
1302         INP_HASH_WUNLOCK(&V_tcbinfo);
1303         return error;
1304 }
1305 #endif /* INET6 */
1306
1307 /*
1308  * Export TCP internal state information via a struct tcp_info, based on the
1309  * Linux 2.6 API.  Not ABI compatible as our constants are mapped differently
1310  * (TCP state machine, etc).  We export all information using FreeBSD-native
1311  * constants -- for example, the numeric values for tcpi_state will differ
1312  * from Linux.
1313  */
1314 static void
1315 tcp_fill_info(struct tcpcb *tp, struct tcp_info *ti)
1316 {
1317
1318         INP_WLOCK_ASSERT(tp->t_inpcb);
1319         bzero(ti, sizeof(*ti));
1320
1321         ti->tcpi_state = tp->t_state;
1322         if ((tp->t_flags & TF_REQ_TSTMP) && (tp->t_flags & TF_RCVD_TSTMP))
1323                 ti->tcpi_options |= TCPI_OPT_TIMESTAMPS;
1324         if (tp->t_flags & TF_SACK_PERMIT)
1325                 ti->tcpi_options |= TCPI_OPT_SACK;
1326         if ((tp->t_flags & TF_REQ_SCALE) && (tp->t_flags & TF_RCVD_SCALE)) {
1327                 ti->tcpi_options |= TCPI_OPT_WSCALE;
1328                 ti->tcpi_snd_wscale = tp->snd_scale;
1329                 ti->tcpi_rcv_wscale = tp->rcv_scale;
1330         }
1331
1332         ti->tcpi_rto = tp->t_rxtcur * tick;
1333         ti->tcpi_last_data_recv = (long)(ticks - (int)tp->t_rcvtime) * tick;
1334         ti->tcpi_rtt = ((u_int64_t)tp->t_srtt * tick) >> TCP_RTT_SHIFT;
1335         ti->tcpi_rttvar = ((u_int64_t)tp->t_rttvar * tick) >> TCP_RTTVAR_SHIFT;
1336
1337         ti->tcpi_snd_ssthresh = tp->snd_ssthresh;
1338         ti->tcpi_snd_cwnd = tp->snd_cwnd;
1339
1340         /*
1341          * FreeBSD-specific extension fields for tcp_info.
1342          */
1343         ti->tcpi_rcv_space = tp->rcv_wnd;
1344         ti->tcpi_rcv_nxt = tp->rcv_nxt;
1345         ti->tcpi_snd_wnd = tp->snd_wnd;
1346         ti->tcpi_snd_bwnd = 0;          /* Unused, kept for compat. */
1347         ti->tcpi_snd_nxt = tp->snd_nxt;
1348         ti->tcpi_snd_mss = tp->t_maxseg;
1349         ti->tcpi_rcv_mss = tp->t_maxseg;
1350         if (tp->t_flags & TF_TOE)
1351                 ti->tcpi_options |= TCPI_OPT_TOE;
1352         ti->tcpi_snd_rexmitpack = tp->t_sndrexmitpack;
1353         ti->tcpi_rcv_ooopack = tp->t_rcvoopack;
1354         ti->tcpi_snd_zerowin = tp->t_sndzerowin;
1355 }
1356
1357 /*
1358  * tcp_ctloutput() must drop the inpcb lock before performing copyin on
1359  * socket option arguments.  When it re-acquires the lock after the copy, it
1360  * has to revalidate that the connection is still valid for the socket
1361  * option.
1362  */
1363 #define INP_WLOCK_RECHECK(inp) do {                                     \
1364         INP_WLOCK(inp);                                                 \
1365         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {            \
1366                 INP_WUNLOCK(inp);                                       \
1367                 return (ECONNRESET);                                    \
1368         }                                                               \
1369         tp = intotcpcb(inp);                                            \
1370 } while(0)
1371
1372 int
1373 tcp_ctloutput(struct socket *so, struct sockopt *sopt)
1374 {
1375         int     error;
1376         struct  inpcb *inp;
1377         struct  tcpcb *tp;
1378         struct tcp_function_block *blk;
1379         struct tcp_function_set fsn;
1380
1381         error = 0;
1382         inp = sotoinpcb(so);
1383         KASSERT(inp != NULL, ("tcp_ctloutput: inp == NULL"));
1384         INP_WLOCK(inp);
1385         if (sopt->sopt_level != IPPROTO_TCP) {
1386 #ifdef INET6
1387                 if (inp->inp_vflag & INP_IPV6PROTO) {
1388                         INP_WUNLOCK(inp);
1389                         error = ip6_ctloutput(so, sopt);
1390                 }
1391 #endif /* INET6 */
1392 #if defined(INET6) && defined(INET)
1393                 else
1394 #endif
1395 #ifdef INET
1396                 {
1397                         INP_WUNLOCK(inp);
1398                         error = ip_ctloutput(so, sopt);
1399                 }
1400 #endif
1401                 return (error);
1402         }
1403         if (inp->inp_flags & (INP_TIMEWAIT | INP_DROPPED)) {
1404                 INP_WUNLOCK(inp);
1405                 return (ECONNRESET);
1406         }
1407         tp = intotcpcb(inp);
1408         /*
1409          * Protect the TCP option TCP_FUNCTION_BLK so
1410          * that a sub-function can *never* overwrite this.
1411          */
1412         if ((sopt->sopt_dir == SOPT_SET) &&
1413             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1414                 INP_WUNLOCK(inp);
1415                 error = sooptcopyin(sopt, &fsn, sizeof fsn,
1416                     sizeof fsn);
1417                 if (error)
1418                         return (error);
1419                 INP_WLOCK_RECHECK(inp);
1420                 if (tp->t_state != TCPS_CLOSED) {
1421                         /*
1422                          * The user has advanced the state
1423                          * past the initial point, we can't
1424                          * switch since we are down the road
1425                          * and a new set of functions may
1426                          * not be compatibile.
1427                          */
1428                         INP_WUNLOCK(inp);
1429                         return(EINVAL);
1430                 }
1431                 blk = find_and_ref_tcp_functions(&fsn);
1432                 if (blk == NULL) {
1433                         INP_WUNLOCK(inp);
1434                         return (ENOENT);
1435                 }
1436                 if (tp->t_fb != blk) {
1437                         if (blk->tfb_flags & TCP_FUNC_BEING_REMOVED) {
1438                                 refcount_release(&blk->tfb_refcnt);
1439                                 INP_WUNLOCK(inp);
1440                                 return (ENOENT);
1441                         }
1442                         /*
1443                          * Release the old refcnt, the
1444                          * lookup acquires a ref on the
1445                          * new one.
1446                          */
1447                         if (tp->t_fb->tfb_tcp_fb_fini)
1448                                 (*tp->t_fb->tfb_tcp_fb_fini)(tp);
1449                         refcount_release(&tp->t_fb->tfb_refcnt);
1450                         tp->t_fb = blk;
1451                         if (tp->t_fb->tfb_tcp_fb_init) {
1452                                 (*tp->t_fb->tfb_tcp_fb_init)(tp);
1453                         }
1454                 }
1455 #ifdef TCP_OFFLOAD
1456                 if (tp->t_flags & TF_TOE) {
1457                         tcp_offload_ctloutput(tp, sopt->sopt_dir,
1458                              sopt->sopt_name);
1459                 }
1460 #endif
1461                 INP_WUNLOCK(inp);
1462                 return (error);
1463         } else if ((sopt->sopt_dir == SOPT_GET) &&
1464             (sopt->sopt_name == TCP_FUNCTION_BLK)) {
1465                 strcpy(fsn.function_set_name, tp->t_fb->tfb_tcp_block_name);
1466                 fsn.pcbcnt = tp->t_fb->tfb_refcnt;
1467                 INP_WUNLOCK(inp);
1468                 error = sooptcopyout(sopt, &fsn, sizeof fsn);
1469                 return (error);
1470         }
1471         /* Pass in the INP locked, called must unlock it */
1472         return (tp->t_fb->tfb_tcp_ctloutput(so, sopt, inp, tp));
1473 }
1474
1475 int
1476 tcp_default_ctloutput(struct socket *so, struct sockopt *sopt, struct inpcb *inp, struct tcpcb *tp)
1477 {
1478         int     error, opt, optval;
1479         u_int   ui;
1480         struct  tcp_info ti;
1481         struct cc_algo *algo;
1482         char    *buf;
1483
1484         switch (sopt->sopt_dir) {
1485         case SOPT_SET:
1486                 switch (sopt->sopt_name) {
1487 #ifdef TCP_SIGNATURE
1488                 case TCP_MD5SIG:
1489                         INP_WUNLOCK(inp);
1490                         error = sooptcopyin(sopt, &optval, sizeof optval,
1491                             sizeof optval);
1492                         if (error)
1493                                 return (error);
1494
1495                         INP_WLOCK_RECHECK(inp);
1496                         if (optval > 0)
1497                                 tp->t_flags |= TF_SIGNATURE;
1498                         else
1499                                 tp->t_flags &= ~TF_SIGNATURE;
1500                         goto unlock_and_done;
1501 #endif /* TCP_SIGNATURE */
1502
1503                 case TCP_NODELAY:
1504                 case TCP_NOOPT:
1505                         INP_WUNLOCK(inp);
1506                         error = sooptcopyin(sopt, &optval, sizeof optval,
1507                             sizeof optval);
1508                         if (error)
1509                                 return (error);
1510
1511                         INP_WLOCK_RECHECK(inp);
1512                         switch (sopt->sopt_name) {
1513                         case TCP_NODELAY:
1514                                 opt = TF_NODELAY;
1515                                 break;
1516                         case TCP_NOOPT:
1517                                 opt = TF_NOOPT;
1518                                 break;
1519                         default:
1520                                 opt = 0; /* dead code to fool gcc */
1521                                 break;
1522                         }
1523
1524                         if (optval)
1525                                 tp->t_flags |= opt;
1526                         else
1527                                 tp->t_flags &= ~opt;
1528 unlock_and_done:
1529 #ifdef TCP_OFFLOAD
1530                         if (tp->t_flags & TF_TOE) {
1531                                 tcp_offload_ctloutput(tp, sopt->sopt_dir,
1532                                     sopt->sopt_name);
1533                         }
1534 #endif
1535                         INP_WUNLOCK(inp);
1536                         break;
1537
1538                 case TCP_NOPUSH:
1539                         INP_WUNLOCK(inp);
1540                         error = sooptcopyin(sopt, &optval, sizeof optval,
1541                             sizeof optval);
1542                         if (error)
1543                                 return (error);
1544
1545                         INP_WLOCK_RECHECK(inp);
1546                         if (optval)
1547                                 tp->t_flags |= TF_NOPUSH;
1548                         else if (tp->t_flags & TF_NOPUSH) {
1549                                 tp->t_flags &= ~TF_NOPUSH;
1550                                 if (TCPS_HAVEESTABLISHED(tp->t_state))
1551                                         error = tp->t_fb->tfb_tcp_output(tp);
1552                         }
1553                         goto unlock_and_done;
1554
1555                 case TCP_MAXSEG:
1556                         INP_WUNLOCK(inp);
1557                         error = sooptcopyin(sopt, &optval, sizeof optval,
1558                             sizeof optval);
1559                         if (error)
1560                                 return (error);
1561
1562                         INP_WLOCK_RECHECK(inp);
1563                         if (optval > 0 && optval <= tp->t_maxseg &&
1564                             optval + 40 >= V_tcp_minmss)
1565                                 tp->t_maxseg = optval;
1566                         else
1567                                 error = EINVAL;
1568                         goto unlock_and_done;
1569
1570                 case TCP_INFO:
1571                         INP_WUNLOCK(inp);
1572                         error = EINVAL;
1573                         break;
1574
1575                 case TCP_CONGESTION:
1576                         INP_WUNLOCK(inp);
1577                         buf = malloc(TCP_CA_NAME_MAX, M_TEMP, M_WAITOK|M_ZERO);
1578                         error = sooptcopyin(sopt, buf, TCP_CA_NAME_MAX, 1);
1579                         if (error) {
1580                                 free(buf, M_TEMP);
1581                                 break;
1582                         }
1583                         CC_LIST_RLOCK();
1584                         STAILQ_FOREACH(algo, &cc_list, entries)
1585                                 if (strncmp(buf, algo->name,
1586                                     TCP_CA_NAME_MAX) == 0)
1587                                         break;
1588                         CC_LIST_RUNLOCK();
1589                         free(buf, M_TEMP);
1590                         if (algo == NULL) {
1591                                 error = EINVAL;
1592                                 break;
1593                         }
1594                         INP_WLOCK_RECHECK(inp);
1595                         /*
1596                          * We hold a write lock over the tcb so it's safe to
1597                          * do these things without ordering concerns.
1598                          */
1599                         if (CC_ALGO(tp)->cb_destroy != NULL)
1600                                 CC_ALGO(tp)->cb_destroy(tp->ccv);
1601                         CC_ALGO(tp) = algo;
1602                         /*
1603                          * If something goes pear shaped initialising the new
1604                          * algo, fall back to newreno (which does not
1605                          * require initialisation).
1606                          */
1607                         if (algo->cb_init != NULL &&
1608                             algo->cb_init(tp->ccv) != 0) {
1609                                 CC_ALGO(tp) = &newreno_cc_algo;
1610                                 /*
1611                                  * The only reason init should fail is
1612                                  * because of malloc.
1613                                  */
1614                                 error = ENOMEM;
1615                         }
1616                         INP_WUNLOCK(inp);
1617                         break;
1618
1619                 case TCP_KEEPIDLE:
1620                 case TCP_KEEPINTVL:
1621                 case TCP_KEEPINIT:
1622                         INP_WUNLOCK(inp);
1623                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1624                         if (error)
1625                                 return (error);
1626
1627                         if (ui > (UINT_MAX / hz)) {
1628                                 error = EINVAL;
1629                                 break;
1630                         }
1631                         ui *= hz;
1632
1633                         INP_WLOCK_RECHECK(inp);
1634                         switch (sopt->sopt_name) {
1635                         case TCP_KEEPIDLE:
1636                                 tp->t_keepidle = ui;
1637                                 /*
1638                                  * XXX: better check current remaining
1639                                  * timeout and "merge" it with new value.
1640                                  */
1641                                 if ((tp->t_state > TCPS_LISTEN) &&
1642                                     (tp->t_state <= TCPS_CLOSING))
1643                                         tcp_timer_activate(tp, TT_KEEP,
1644                                             TP_KEEPIDLE(tp));
1645                                 break;
1646                         case TCP_KEEPINTVL:
1647                                 tp->t_keepintvl = ui;
1648                                 if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1649                                     (TP_MAXIDLE(tp) > 0))
1650                                         tcp_timer_activate(tp, TT_2MSL,
1651                                             TP_MAXIDLE(tp));
1652                                 break;
1653                         case TCP_KEEPINIT:
1654                                 tp->t_keepinit = ui;
1655                                 if (tp->t_state == TCPS_SYN_RECEIVED ||
1656                                     tp->t_state == TCPS_SYN_SENT)
1657                                         tcp_timer_activate(tp, TT_KEEP,
1658                                             TP_KEEPINIT(tp));
1659                                 break;
1660                         }
1661                         goto unlock_and_done;
1662
1663                 case TCP_KEEPCNT:
1664                         INP_WUNLOCK(inp);
1665                         error = sooptcopyin(sopt, &ui, sizeof(ui), sizeof(ui));
1666                         if (error)
1667                                 return (error);
1668
1669                         INP_WLOCK_RECHECK(inp);
1670                         tp->t_keepcnt = ui;
1671                         if ((tp->t_state == TCPS_FIN_WAIT_2) &&
1672                             (TP_MAXIDLE(tp) > 0))
1673                                 tcp_timer_activate(tp, TT_2MSL,
1674                                     TP_MAXIDLE(tp));
1675                         goto unlock_and_done;
1676
1677 #ifdef TCPPCAP
1678                 case TCP_PCAP_OUT:
1679                 case TCP_PCAP_IN:
1680                         INP_WUNLOCK(inp);
1681                         error = sooptcopyin(sopt, &optval, sizeof optval,
1682                             sizeof optval);
1683                         if (error)
1684                                 return (error);
1685
1686                         INP_WLOCK_RECHECK(inp);
1687                         if (optval >= 0)
1688                                 tcp_pcap_set_sock_max(TCP_PCAP_OUT ?
1689                                         &(tp->t_outpkts) : &(tp->t_inpkts),
1690                                         optval);
1691                         else
1692                                 error = EINVAL;
1693                         goto unlock_and_done;
1694 #endif
1695
1696 #ifdef TCP_RFC7413
1697                 case TCP_FASTOPEN:
1698                         INP_WUNLOCK(inp);
1699                         if (!V_tcp_fastopen_enabled)
1700                                 return (EPERM);
1701
1702                         error = sooptcopyin(sopt, &optval, sizeof optval,
1703                             sizeof optval);
1704                         if (error)
1705                                 return (error);
1706
1707                         INP_WLOCK_RECHECK(inp);
1708                         if (optval) {
1709                                 tp->t_flags |= TF_FASTOPEN;
1710                                 if ((tp->t_state == TCPS_LISTEN) &&
1711                                     (tp->t_tfo_pending == NULL))
1712                                         tp->t_tfo_pending =
1713                                             tcp_fastopen_alloc_counter();
1714                         } else
1715                                 tp->t_flags &= ~TF_FASTOPEN;
1716                         goto unlock_and_done;
1717 #endif
1718
1719                 default:
1720                         INP_WUNLOCK(inp);
1721                         error = ENOPROTOOPT;
1722                         break;
1723                 }
1724                 break;
1725
1726         case SOPT_GET:
1727                 tp = intotcpcb(inp);
1728                 switch (sopt->sopt_name) {
1729 #ifdef TCP_SIGNATURE
1730                 case TCP_MD5SIG:
1731                         optval = (tp->t_flags & TF_SIGNATURE) ? 1 : 0;
1732                         INP_WUNLOCK(inp);
1733                         error = sooptcopyout(sopt, &optval, sizeof optval);
1734                         break;
1735 #endif
1736
1737                 case TCP_NODELAY:
1738                         optval = tp->t_flags & TF_NODELAY;
1739                         INP_WUNLOCK(inp);
1740                         error = sooptcopyout(sopt, &optval, sizeof optval);
1741                         break;
1742                 case TCP_MAXSEG:
1743                         optval = tp->t_maxseg;
1744                         INP_WUNLOCK(inp);
1745                         error = sooptcopyout(sopt, &optval, sizeof optval);
1746                         break;
1747                 case TCP_NOOPT:
1748                         optval = tp->t_flags & TF_NOOPT;
1749                         INP_WUNLOCK(inp);
1750                         error = sooptcopyout(sopt, &optval, sizeof optval);
1751                         break;
1752                 case TCP_NOPUSH:
1753                         optval = tp->t_flags & TF_NOPUSH;
1754                         INP_WUNLOCK(inp);
1755                         error = sooptcopyout(sopt, &optval, sizeof optval);
1756                         break;
1757                 case TCP_INFO:
1758                         tcp_fill_info(tp, &ti);
1759                         INP_WUNLOCK(inp);
1760                         error = sooptcopyout(sopt, &ti, sizeof ti);
1761                         break;
1762                 case TCP_CONGESTION:
1763                         INP_WUNLOCK(inp);
1764                         error = sooptcopyout(sopt, CC_ALGO(tp)->name,
1765                             TCP_CA_NAME_MAX);
1766                         break;
1767                 case TCP_KEEPIDLE:
1768                 case TCP_KEEPINTVL:
1769                 case TCP_KEEPINIT:
1770                 case TCP_KEEPCNT:
1771                         switch (sopt->sopt_name) {
1772                         case TCP_KEEPIDLE:
1773                                 ui = tp->t_keepidle / hz;
1774                                 break;
1775                         case TCP_KEEPINTVL:
1776                                 ui = tp->t_keepintvl / hz;
1777                                 break;
1778                         case TCP_KEEPINIT:
1779                                 ui = tp->t_keepinit / hz;
1780                                 break;
1781                         case TCP_KEEPCNT:
1782                                 ui = tp->t_keepcnt;
1783                                 break;
1784                         }
1785                         INP_WUNLOCK(inp);
1786                         error = sooptcopyout(sopt, &ui, sizeof(ui));
1787                         break;
1788 #ifdef TCPPCAP
1789                 case TCP_PCAP_OUT:
1790                 case TCP_PCAP_IN:
1791                         optval = tcp_pcap_get_sock_max(TCP_PCAP_OUT ?
1792                                         &(tp->t_outpkts) : &(tp->t_inpkts));
1793                         INP_WUNLOCK(inp);
1794                         error = sooptcopyout(sopt, &optval, sizeof optval);
1795                         break;
1796 #endif
1797
1798 #ifdef TCP_RFC7413
1799                 case TCP_FASTOPEN:
1800                         optval = tp->t_flags & TF_FASTOPEN;
1801                         INP_WUNLOCK(inp);
1802                         error = sooptcopyout(sopt, &optval, sizeof optval);
1803                         break;
1804 #endif
1805                 default:
1806                         INP_WUNLOCK(inp);
1807                         error = ENOPROTOOPT;
1808                         break;
1809                 }
1810                 break;
1811         }
1812         return (error);
1813 }
1814 #undef INP_WLOCK_RECHECK
1815
1816 /*
1817  * Attach TCP protocol to socket, allocating
1818  * internet protocol control block, tcp control block,
1819  * bufer space, and entering LISTEN state if to accept connections.
1820  */
1821 static int
1822 tcp_attach(struct socket *so)
1823 {
1824         struct tcpcb *tp;
1825         struct inpcb *inp;
1826         int error;
1827
1828         if (so->so_snd.sb_hiwat == 0 || so->so_rcv.sb_hiwat == 0) {
1829                 error = soreserve(so, V_tcp_sendspace, V_tcp_recvspace);
1830                 if (error)
1831                         return (error);
1832         }
1833         so->so_rcv.sb_flags |= SB_AUTOSIZE;
1834         so->so_snd.sb_flags |= SB_AUTOSIZE;
1835         INP_INFO_RLOCK(&V_tcbinfo);
1836         error = in_pcballoc(so, &V_tcbinfo);
1837         if (error) {
1838                 INP_INFO_RUNLOCK(&V_tcbinfo);
1839                 return (error);
1840         }
1841         inp = sotoinpcb(so);
1842 #ifdef INET6
1843         if (inp->inp_vflag & INP_IPV6PROTO) {
1844                 inp->inp_vflag |= INP_IPV6;
1845                 inp->in6p_hops = -1;    /* use kernel default */
1846         }
1847         else
1848 #endif
1849         inp->inp_vflag |= INP_IPV4;
1850         tp = tcp_newtcpcb(inp);
1851         if (tp == NULL) {
1852                 in_pcbdetach(inp);
1853                 in_pcbfree(inp);
1854                 INP_INFO_RUNLOCK(&V_tcbinfo);
1855                 return (ENOBUFS);
1856         }
1857         tp->t_state = TCPS_CLOSED;
1858         INP_WUNLOCK(inp);
1859         INP_INFO_RUNLOCK(&V_tcbinfo);
1860         return (0);
1861 }
1862
1863 /*
1864  * Initiate (or continue) disconnect.
1865  * If embryonic state, just send reset (once).
1866  * If in ``let data drain'' option and linger null, just drop.
1867  * Otherwise (hard), mark socket disconnecting and drop
1868  * current input data; switch states based on user close, and
1869  * send segment to peer (with FIN).
1870  */
1871 static void
1872 tcp_disconnect(struct tcpcb *tp)
1873 {
1874         struct inpcb *inp = tp->t_inpcb;
1875         struct socket *so = inp->inp_socket;
1876
1877         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1878         INP_WLOCK_ASSERT(inp);
1879
1880         /*
1881          * Neither tcp_close() nor tcp_drop() should return NULL, as the
1882          * socket is still open.
1883          */
1884         if (tp->t_state < TCPS_ESTABLISHED) {
1885                 tp = tcp_close(tp);
1886                 KASSERT(tp != NULL,
1887                     ("tcp_disconnect: tcp_close() returned NULL"));
1888         } else if ((so->so_options & SO_LINGER) && so->so_linger == 0) {
1889                 tp = tcp_drop(tp, 0);
1890                 KASSERT(tp != NULL,
1891                     ("tcp_disconnect: tcp_drop() returned NULL"));
1892         } else {
1893                 soisdisconnecting(so);
1894                 sbflush(&so->so_rcv);
1895                 tcp_usrclosed(tp);
1896                 if (!(inp->inp_flags & INP_DROPPED))
1897                         tp->t_fb->tfb_tcp_output(tp);
1898         }
1899 }
1900
1901 /*
1902  * User issued close, and wish to trail through shutdown states:
1903  * if never received SYN, just forget it.  If got a SYN from peer,
1904  * but haven't sent FIN, then go to FIN_WAIT_1 state to send peer a FIN.
1905  * If already got a FIN from peer, then almost done; go to LAST_ACK
1906  * state.  In all other cases, have already sent FIN to peer (e.g.
1907  * after PRU_SHUTDOWN), and just have to play tedious game waiting
1908  * for peer to send FIN or not respond to keep-alives, etc.
1909  * We can let the user exit from the close as soon as the FIN is acked.
1910  */
1911 static void
1912 tcp_usrclosed(struct tcpcb *tp)
1913 {
1914
1915         INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
1916         INP_WLOCK_ASSERT(tp->t_inpcb);
1917
1918         switch (tp->t_state) {
1919         case TCPS_LISTEN:
1920 #ifdef TCP_OFFLOAD
1921                 tcp_offload_listen_stop(tp);
1922 #endif
1923                 tcp_state_change(tp, TCPS_CLOSED);
1924                 /* FALLTHROUGH */
1925         case TCPS_CLOSED:
1926                 tp = tcp_close(tp);
1927                 /*
1928                  * tcp_close() should never return NULL here as the socket is
1929                  * still open.
1930                  */
1931                 KASSERT(tp != NULL,
1932                     ("tcp_usrclosed: tcp_close() returned NULL"));
1933                 break;
1934
1935         case TCPS_SYN_SENT:
1936         case TCPS_SYN_RECEIVED:
1937                 tp->t_flags |= TF_NEEDFIN;
1938                 break;
1939
1940         case TCPS_ESTABLISHED:
1941                 tcp_state_change(tp, TCPS_FIN_WAIT_1);
1942                 break;
1943
1944         case TCPS_CLOSE_WAIT:
1945                 tcp_state_change(tp, TCPS_LAST_ACK);
1946                 break;
1947         }
1948         if (tp->t_state >= TCPS_FIN_WAIT_2) {
1949                 soisdisconnected(tp->t_inpcb->inp_socket);
1950                 /* Prevent the connection hanging in FIN_WAIT_2 forever. */
1951                 if (tp->t_state == TCPS_FIN_WAIT_2) {
1952                         int timeout;
1953
1954                         timeout = (tcp_fast_finwait2_recycle) ?
1955                             tcp_finwait2_timeout : TP_MAXIDLE(tp);
1956                         tcp_timer_activate(tp, TT_2MSL, timeout);
1957                 }
1958         }
1959 }
1960
1961 #ifdef DDB
1962 static void
1963 db_print_indent(int indent)
1964 {
1965         int i;
1966
1967         for (i = 0; i < indent; i++)
1968                 db_printf(" ");
1969 }
1970
1971 static void
1972 db_print_tstate(int t_state)
1973 {
1974
1975         switch (t_state) {
1976         case TCPS_CLOSED:
1977                 db_printf("TCPS_CLOSED");
1978                 return;
1979
1980         case TCPS_LISTEN:
1981                 db_printf("TCPS_LISTEN");
1982                 return;
1983
1984         case TCPS_SYN_SENT:
1985                 db_printf("TCPS_SYN_SENT");
1986                 return;
1987
1988         case TCPS_SYN_RECEIVED:
1989                 db_printf("TCPS_SYN_RECEIVED");
1990                 return;
1991
1992         case TCPS_ESTABLISHED:
1993                 db_printf("TCPS_ESTABLISHED");
1994                 return;
1995
1996         case TCPS_CLOSE_WAIT:
1997                 db_printf("TCPS_CLOSE_WAIT");
1998                 return;
1999
2000         case TCPS_FIN_WAIT_1:
2001                 db_printf("TCPS_FIN_WAIT_1");
2002                 return;
2003
2004         case TCPS_CLOSING:
2005                 db_printf("TCPS_CLOSING");
2006                 return;
2007
2008         case TCPS_LAST_ACK:
2009                 db_printf("TCPS_LAST_ACK");
2010                 return;
2011
2012         case TCPS_FIN_WAIT_2:
2013                 db_printf("TCPS_FIN_WAIT_2");
2014                 return;
2015
2016         case TCPS_TIME_WAIT:
2017                 db_printf("TCPS_TIME_WAIT");
2018                 return;
2019
2020         default:
2021                 db_printf("unknown");
2022                 return;
2023         }
2024 }
2025
2026 static void
2027 db_print_tflags(u_int t_flags)
2028 {
2029         int comma;
2030
2031         comma = 0;
2032         if (t_flags & TF_ACKNOW) {
2033                 db_printf("%sTF_ACKNOW", comma ? ", " : "");
2034                 comma = 1;
2035         }
2036         if (t_flags & TF_DELACK) {
2037                 db_printf("%sTF_DELACK", comma ? ", " : "");
2038                 comma = 1;
2039         }
2040         if (t_flags & TF_NODELAY) {
2041                 db_printf("%sTF_NODELAY", comma ? ", " : "");
2042                 comma = 1;
2043         }
2044         if (t_flags & TF_NOOPT) {
2045                 db_printf("%sTF_NOOPT", comma ? ", " : "");
2046                 comma = 1;
2047         }
2048         if (t_flags & TF_SENTFIN) {
2049                 db_printf("%sTF_SENTFIN", comma ? ", " : "");
2050                 comma = 1;
2051         }
2052         if (t_flags & TF_REQ_SCALE) {
2053                 db_printf("%sTF_REQ_SCALE", comma ? ", " : "");
2054                 comma = 1;
2055         }
2056         if (t_flags & TF_RCVD_SCALE) {
2057                 db_printf("%sTF_RECVD_SCALE", comma ? ", " : "");
2058                 comma = 1;
2059         }
2060         if (t_flags & TF_REQ_TSTMP) {
2061                 db_printf("%sTF_REQ_TSTMP", comma ? ", " : "");
2062                 comma = 1;
2063         }
2064         if (t_flags & TF_RCVD_TSTMP) {
2065                 db_printf("%sTF_RCVD_TSTMP", comma ? ", " : "");
2066                 comma = 1;
2067         }
2068         if (t_flags & TF_SACK_PERMIT) {
2069                 db_printf("%sTF_SACK_PERMIT", comma ? ", " : "");
2070                 comma = 1;
2071         }
2072         if (t_flags & TF_NEEDSYN) {
2073                 db_printf("%sTF_NEEDSYN", comma ? ", " : "");
2074                 comma = 1;
2075         }
2076         if (t_flags & TF_NEEDFIN) {
2077                 db_printf("%sTF_NEEDFIN", comma ? ", " : "");
2078                 comma = 1;
2079         }
2080         if (t_flags & TF_NOPUSH) {
2081                 db_printf("%sTF_NOPUSH", comma ? ", " : "");
2082                 comma = 1;
2083         }
2084         if (t_flags & TF_MORETOCOME) {
2085                 db_printf("%sTF_MORETOCOME", comma ? ", " : "");
2086                 comma = 1;
2087         }
2088         if (t_flags & TF_LQ_OVERFLOW) {
2089                 db_printf("%sTF_LQ_OVERFLOW", comma ? ", " : "");
2090                 comma = 1;
2091         }
2092         if (t_flags & TF_LASTIDLE) {
2093                 db_printf("%sTF_LASTIDLE", comma ? ", " : "");
2094                 comma = 1;
2095         }
2096         if (t_flags & TF_RXWIN0SENT) {
2097                 db_printf("%sTF_RXWIN0SENT", comma ? ", " : "");
2098                 comma = 1;
2099         }
2100         if (t_flags & TF_FASTRECOVERY) {
2101                 db_printf("%sTF_FASTRECOVERY", comma ? ", " : "");
2102                 comma = 1;
2103         }
2104         if (t_flags & TF_CONGRECOVERY) {
2105                 db_printf("%sTF_CONGRECOVERY", comma ? ", " : "");
2106                 comma = 1;
2107         }
2108         if (t_flags & TF_WASFRECOVERY) {
2109                 db_printf("%sTF_WASFRECOVERY", comma ? ", " : "");
2110                 comma = 1;
2111         }
2112         if (t_flags & TF_SIGNATURE) {
2113                 db_printf("%sTF_SIGNATURE", comma ? ", " : "");
2114                 comma = 1;
2115         }
2116         if (t_flags & TF_FORCEDATA) {
2117                 db_printf("%sTF_FORCEDATA", comma ? ", " : "");
2118                 comma = 1;
2119         }
2120         if (t_flags & TF_TSO) {
2121                 db_printf("%sTF_TSO", comma ? ", " : "");
2122                 comma = 1;
2123         }
2124         if (t_flags & TF_ECN_PERMIT) {
2125                 db_printf("%sTF_ECN_PERMIT", comma ? ", " : "");
2126                 comma = 1;
2127         }
2128         if (t_flags & TF_FASTOPEN) {
2129                 db_printf("%sTF_FASTOPEN", comma ? ", " : "");
2130                 comma = 1;
2131         }
2132 }
2133
2134 static void
2135 db_print_toobflags(char t_oobflags)
2136 {
2137         int comma;
2138
2139         comma = 0;
2140         if (t_oobflags & TCPOOB_HAVEDATA) {
2141                 db_printf("%sTCPOOB_HAVEDATA", comma ? ", " : "");
2142                 comma = 1;
2143         }
2144         if (t_oobflags & TCPOOB_HADDATA) {
2145                 db_printf("%sTCPOOB_HADDATA", comma ? ", " : "");
2146                 comma = 1;
2147         }
2148 }
2149
2150 static void
2151 db_print_tcpcb(struct tcpcb *tp, const char *name, int indent)
2152 {
2153
2154         db_print_indent(indent);
2155         db_printf("%s at %p\n", name, tp);
2156
2157         indent += 2;
2158
2159         db_print_indent(indent);
2160         db_printf("t_segq first: %p   t_segqlen: %d   t_dupacks: %d\n",
2161            LIST_FIRST(&tp->t_segq), tp->t_segqlen, tp->t_dupacks);
2162
2163         db_print_indent(indent);
2164         db_printf("tt_rexmt: %p   tt_persist: %p   tt_keep: %p\n",
2165             &tp->t_timers->tt_rexmt, &tp->t_timers->tt_persist, &tp->t_timers->tt_keep);
2166
2167         db_print_indent(indent);
2168         db_printf("tt_2msl: %p   tt_delack: %p   t_inpcb: %p\n", &tp->t_timers->tt_2msl,
2169             &tp->t_timers->tt_delack, tp->t_inpcb);
2170
2171         db_print_indent(indent);
2172         db_printf("t_state: %d (", tp->t_state);
2173         db_print_tstate(tp->t_state);
2174         db_printf(")\n");
2175
2176         db_print_indent(indent);
2177         db_printf("t_flags: 0x%x (", tp->t_flags);
2178         db_print_tflags(tp->t_flags);
2179         db_printf(")\n");
2180
2181         db_print_indent(indent);
2182         db_printf("snd_una: 0x%08x   snd_max: 0x%08x   snd_nxt: x0%08x\n",
2183             tp->snd_una, tp->snd_max, tp->snd_nxt);
2184
2185         db_print_indent(indent);
2186         db_printf("snd_up: 0x%08x   snd_wl1: 0x%08x   snd_wl2: 0x%08x\n",
2187            tp->snd_up, tp->snd_wl1, tp->snd_wl2);
2188
2189         db_print_indent(indent);
2190         db_printf("iss: 0x%08x   irs: 0x%08x   rcv_nxt: 0x%08x\n",
2191             tp->iss, tp->irs, tp->rcv_nxt);
2192
2193         db_print_indent(indent);
2194         db_printf("rcv_adv: 0x%08x   rcv_wnd: %lu   rcv_up: 0x%08x\n",
2195             tp->rcv_adv, tp->rcv_wnd, tp->rcv_up);
2196
2197         db_print_indent(indent);
2198         db_printf("snd_wnd: %lu   snd_cwnd: %lu\n",
2199            tp->snd_wnd, tp->snd_cwnd);
2200
2201         db_print_indent(indent);
2202         db_printf("snd_ssthresh: %lu   snd_recover: "
2203             "0x%08x\n", tp->snd_ssthresh, tp->snd_recover);
2204
2205         db_print_indent(indent);
2206         db_printf("t_rcvtime: %u   t_startime: %u\n",
2207             tp->t_rcvtime, tp->t_starttime);
2208
2209         db_print_indent(indent);
2210         db_printf("t_rttime: %u   t_rtsq: 0x%08x\n",
2211             tp->t_rtttime, tp->t_rtseq);
2212
2213         db_print_indent(indent);
2214         db_printf("t_rxtcur: %d   t_maxseg: %u   t_srtt: %d\n",
2215             tp->t_rxtcur, tp->t_maxseg, tp->t_srtt);
2216
2217         db_print_indent(indent);
2218         db_printf("t_rttvar: %d   t_rxtshift: %d   t_rttmin: %u   "
2219             "t_rttbest: %u\n", tp->t_rttvar, tp->t_rxtshift, tp->t_rttmin,
2220             tp->t_rttbest);
2221
2222         db_print_indent(indent);
2223         db_printf("t_rttupdated: %lu   max_sndwnd: %lu   t_softerror: %d\n",
2224             tp->t_rttupdated, tp->max_sndwnd, tp->t_softerror);
2225
2226         db_print_indent(indent);
2227         db_printf("t_oobflags: 0x%x (", tp->t_oobflags);
2228         db_print_toobflags(tp->t_oobflags);
2229         db_printf(")   t_iobc: 0x%02x\n", tp->t_iobc);
2230
2231         db_print_indent(indent);
2232         db_printf("snd_scale: %u   rcv_scale: %u   request_r_scale: %u\n",
2233             tp->snd_scale, tp->rcv_scale, tp->request_r_scale);
2234
2235         db_print_indent(indent);
2236         db_printf("ts_recent: %u   ts_recent_age: %u\n",
2237             tp->ts_recent, tp->ts_recent_age);
2238
2239         db_print_indent(indent);
2240         db_printf("ts_offset: %u   last_ack_sent: 0x%08x   snd_cwnd_prev: "
2241             "%lu\n", tp->ts_offset, tp->last_ack_sent, tp->snd_cwnd_prev);
2242
2243         db_print_indent(indent);
2244         db_printf("snd_ssthresh_prev: %lu   snd_recover_prev: 0x%08x   "
2245             "t_badrxtwin: %u\n", tp->snd_ssthresh_prev,
2246             tp->snd_recover_prev, tp->t_badrxtwin);
2247
2248         db_print_indent(indent);
2249         db_printf("snd_numholes: %d  snd_holes first: %p\n",
2250             tp->snd_numholes, TAILQ_FIRST(&tp->snd_holes));
2251
2252         db_print_indent(indent);
2253         db_printf("snd_fack: 0x%08x   rcv_numsacks: %d   sack_newdata: "
2254             "0x%08x\n", tp->snd_fack, tp->rcv_numsacks, tp->sack_newdata);
2255
2256         /* Skip sackblks, sackhint. */
2257
2258         db_print_indent(indent);
2259         db_printf("t_rttlow: %d   rfbuf_ts: %u   rfbuf_cnt: %d\n",
2260             tp->t_rttlow, tp->rfbuf_ts, tp->rfbuf_cnt);
2261 }
2262
2263 DB_SHOW_COMMAND(tcpcb, db_show_tcpcb)
2264 {
2265         struct tcpcb *tp;
2266
2267         if (!have_addr) {
2268                 db_printf("usage: show tcpcb <addr>\n");
2269                 return;
2270         }
2271         tp = (struct tcpcb *)addr;
2272
2273         db_print_tcpcb(tp, "tcpcb", 0);
2274 }
2275 #endif