xref: /freebsd/sys/netinet/tcp_subr.c (revision 1f4bcc459a76b7aa664f3fd557684cd0ba6da352)
1 /*-
2  * Copyright (c) 1982, 1986, 1988, 1990, 1993, 1995
3  *	The Regents of the University of California.  All rights reserved.
4  *
5  * Redistribution and use in source and binary forms, with or without
6  * modification, are permitted provided that the following conditions
7  * are met:
8  * 1. Redistributions of source code must retain the above copyright
9  *    notice, this list of conditions and the following disclaimer.
10  * 2. Redistributions in binary form must reproduce the above copyright
11  *    notice, this list of conditions and the following disclaimer in the
12  *    documentation and/or other materials provided with the distribution.
13  * 4. Neither the name of the University nor the names of its contributors
14  *    may be used to endorse or promote products derived from this software
15  *    without specific prior written permission.
16  *
17  * THIS SOFTWARE IS PROVIDED BY THE REGENTS AND CONTRIBUTORS ``AS IS'' AND
18  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
19  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
20  * ARE DISCLAIMED.  IN NO EVENT SHALL THE REGENTS OR CONTRIBUTORS BE LIABLE
21  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
22  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
23  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
24  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
25  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
26  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
27  * SUCH DAMAGE.
28  *
29  *	@(#)tcp_subr.c	8.2 (Berkeley) 5/24/95
30  */
31 
32 #include <sys/cdefs.h>
33 __FBSDID("$FreeBSD$");
34 
35 #include "opt_compat.h"
36 #include "opt_inet.h"
37 #include "opt_inet6.h"
38 #include "opt_ipsec.h"
39 #include "opt_tcpdebug.h"
40 
41 #include <sys/param.h>
42 #include <sys/systm.h>
43 #include <sys/callout.h>
44 #include <sys/eventhandler.h>
45 #include <sys/hhook.h>
46 #include <sys/kernel.h>
47 #include <sys/khelp.h>
48 #include <sys/sysctl.h>
49 #include <sys/jail.h>
50 #include <sys/malloc.h>
51 #include <sys/refcount.h>
52 #include <sys/mbuf.h>
53 #ifdef INET6
54 #include <sys/domain.h>
55 #endif
56 #include <sys/priv.h>
57 #include <sys/proc.h>
58 #include <sys/sdt.h>
59 #include <sys/socket.h>
60 #include <sys/socketvar.h>
61 #include <sys/protosw.h>
62 #include <sys/random.h>
63 
64 #include <vm/uma.h>
65 
66 #include <net/route.h>
67 #include <net/if.h>
68 #include <net/if_var.h>
69 #include <net/vnet.h>
70 
71 #include <netinet/in.h>
72 #include <netinet/in_fib.h>
73 #include <netinet/in_kdtrace.h>
74 #include <netinet/in_pcb.h>
75 #include <netinet/in_systm.h>
76 #include <netinet/in_var.h>
77 #include <netinet/ip.h>
78 #include <netinet/ip_icmp.h>
79 #include <netinet/ip_var.h>
80 #ifdef INET6
81 #include <netinet/ip6.h>
82 #include <netinet6/in6_fib.h>
83 #include <netinet6/in6_pcb.h>
84 #include <netinet6/ip6_var.h>
85 #include <netinet6/scope6_var.h>
86 #include <netinet6/nd6.h>
87 #endif
88 
89 #ifdef TCP_RFC7413
90 #include <netinet/tcp_fastopen.h>
91 #endif
92 #include <netinet/tcp.h>
93 #include <netinet/tcp_fsm.h>
94 #include <netinet/tcp_seq.h>
95 #include <netinet/tcp_timer.h>
96 #include <netinet/tcp_var.h>
97 #include <netinet/tcp_syncache.h>
98 #include <netinet/cc/cc.h>
99 #ifdef INET6
100 #include <netinet6/tcp6_var.h>
101 #endif
102 #include <netinet/tcpip.h>
103 #ifdef TCPPCAP
104 #include <netinet/tcp_pcap.h>
105 #endif
106 #ifdef TCPDEBUG
107 #include <netinet/tcp_debug.h>
108 #endif
109 #ifdef INET6
110 #include <netinet6/ip6protosw.h>
111 #endif
112 #ifdef TCP_OFFLOAD
113 #include <netinet/tcp_offload.h>
114 #endif
115 
116 #ifdef IPSEC
117 #include <netipsec/ipsec.h>
118 #include <netipsec/xform.h>
119 #ifdef INET6
120 #include <netipsec/ipsec6.h>
121 #endif
122 #include <netipsec/key.h>
123 #include <sys/syslog.h>
124 #endif /*IPSEC*/
125 
126 #include <machine/in_cksum.h>
127 #include <sys/md5.h>
128 
129 #include <security/mac/mac_framework.h>
130 
131 VNET_DEFINE(int, tcp_mssdflt) = TCP_MSS;
132 #ifdef INET6
133 VNET_DEFINE(int, tcp_v6mssdflt) = TCP6_MSS;
134 #endif
135 
136 struct rwlock tcp_function_lock;
137 
138 static int
139 sysctl_net_inet_tcp_mss_check(SYSCTL_HANDLER_ARGS)
140 {
141 	int error, new;
142 
143 	new = V_tcp_mssdflt;
144 	error = sysctl_handle_int(oidp, &new, 0, req);
145 	if (error == 0 && req->newptr) {
146 		if (new < TCP_MINMSS)
147 			error = EINVAL;
148 		else
149 			V_tcp_mssdflt = new;
150 	}
151 	return (error);
152 }
153 
154 SYSCTL_PROC(_net_inet_tcp, TCPCTL_MSSDFLT, mssdflt,
155     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, &VNET_NAME(tcp_mssdflt), 0,
156     &sysctl_net_inet_tcp_mss_check, "I",
157     "Default TCP Maximum Segment Size");
158 
159 #ifdef INET6
160 static int
161 sysctl_net_inet_tcp_mss_v6_check(SYSCTL_HANDLER_ARGS)
162 {
163 	int error, new;
164 
165 	new = V_tcp_v6mssdflt;
166 	error = sysctl_handle_int(oidp, &new, 0, req);
167 	if (error == 0 && req->newptr) {
168 		if (new < TCP_MINMSS)
169 			error = EINVAL;
170 		else
171 			V_tcp_v6mssdflt = new;
172 	}
173 	return (error);
174 }
175 
176 SYSCTL_PROC(_net_inet_tcp, TCPCTL_V6MSSDFLT, v6mssdflt,
177     CTLFLAG_VNET | CTLTYPE_INT | CTLFLAG_RW, &VNET_NAME(tcp_v6mssdflt), 0,
178     &sysctl_net_inet_tcp_mss_v6_check, "I",
179    "Default TCP Maximum Segment Size for IPv6");
180 #endif /* INET6 */
181 
182 /*
183  * Minimum MSS we accept and use. This prevents DoS attacks where
184  * we are forced to a ridiculous low MSS like 20 and send hundreds
185  * of packets instead of one. The effect scales with the available
186  * bandwidth and quickly saturates the CPU and network interface
187  * with packet generation and sending. Set to zero to disable MINMSS
188  * checking. This setting prevents us from sending too small packets.
189  */
190 VNET_DEFINE(int, tcp_minmss) = TCP_MINMSS;
191 SYSCTL_INT(_net_inet_tcp, OID_AUTO, minmss, CTLFLAG_VNET | CTLFLAG_RW,
192      &VNET_NAME(tcp_minmss), 0,
193     "Minimum TCP Maximum Segment Size");
194 
195 VNET_DEFINE(int, tcp_do_rfc1323) = 1;
196 SYSCTL_INT(_net_inet_tcp, TCPCTL_DO_RFC1323, rfc1323, CTLFLAG_VNET | CTLFLAG_RW,
197     &VNET_NAME(tcp_do_rfc1323), 0,
198     "Enable rfc1323 (high performance TCP) extensions");
199 
200 static int	tcp_log_debug = 0;
201 SYSCTL_INT(_net_inet_tcp, OID_AUTO, log_debug, CTLFLAG_RW,
202     &tcp_log_debug, 0, "Log errors caused by incoming TCP segments");
203 
204 static int	tcp_tcbhashsize;
205 SYSCTL_INT(_net_inet_tcp, OID_AUTO, tcbhashsize, CTLFLAG_RDTUN | CTLFLAG_NOFETCH,
206     &tcp_tcbhashsize, 0, "Size of TCP control-block hashtable");
207 
208 static int	do_tcpdrain = 1;
209 SYSCTL_INT(_net_inet_tcp, OID_AUTO, do_tcpdrain, CTLFLAG_RW, &do_tcpdrain, 0,
210     "Enable tcp_drain routine for extra help when low on mbufs");
211 
212 SYSCTL_UINT(_net_inet_tcp, OID_AUTO, pcbcount, CTLFLAG_VNET | CTLFLAG_RD,
213     &VNET_NAME(tcbinfo.ipi_count), 0, "Number of active PCBs");
214 
215 static VNET_DEFINE(int, icmp_may_rst) = 1;
216 #define	V_icmp_may_rst			VNET(icmp_may_rst)
217 SYSCTL_INT(_net_inet_tcp, OID_AUTO, icmp_may_rst, CTLFLAG_VNET | CTLFLAG_RW,
218     &VNET_NAME(icmp_may_rst), 0,
219     "Certain ICMP unreachable messages may abort connections in SYN_SENT");
220 
221 static VNET_DEFINE(int, tcp_isn_reseed_interval) = 0;
222 #define	V_tcp_isn_reseed_interval	VNET(tcp_isn_reseed_interval)
223 SYSCTL_INT(_net_inet_tcp, OID_AUTO, isn_reseed_interval, CTLFLAG_VNET | CTLFLAG_RW,
224     &VNET_NAME(tcp_isn_reseed_interval), 0,
225     "Seconds between reseeding of ISN secret");
226 
227 static int	tcp_soreceive_stream;
228 SYSCTL_INT(_net_inet_tcp, OID_AUTO, soreceive_stream, CTLFLAG_RDTUN,
229     &tcp_soreceive_stream, 0, "Using soreceive_stream for TCP sockets");
230 
231 #ifdef TCP_SIGNATURE
232 static int	tcp_sig_checksigs = 1;
233 SYSCTL_INT(_net_inet_tcp, OID_AUTO, signature_verify_input, CTLFLAG_RW,
234     &tcp_sig_checksigs, 0, "Verify RFC2385 digests on inbound traffic");
235 #endif
236 
237 VNET_DEFINE(uma_zone_t, sack_hole_zone);
238 #define	V_sack_hole_zone		VNET(sack_hole_zone)
239 
240 VNET_DEFINE(struct hhook_head *, tcp_hhh[HHOOK_TCP_LAST+1]);
241 
242 static struct inpcb *tcp_notify(struct inpcb *, int);
243 static struct inpcb *tcp_mtudisc_notify(struct inpcb *, int);
244 static void tcp_mtudisc(struct inpcb *, int);
245 static char *	tcp_log_addr(struct in_conninfo *inc, struct tcphdr *th,
246 		    void *ip4hdr, const void *ip6hdr);
247 static void	tcp_timer_discard(struct tcpcb *, uint32_t);
248 
249 
250 static struct tcp_function_block tcp_def_funcblk = {
251 	"default",
252 	tcp_output,
253 	tcp_do_segment,
254 	tcp_default_ctloutput,
255 	NULL,
256 	NULL,
257 	NULL,
258 	NULL,
259 	NULL,
260 	NULL,
261 	NULL,
262 	0,
263 	0
264 };
265 
266 struct tcp_funchead t_functions;
267 static struct tcp_function_block *tcp_func_set_ptr = &tcp_def_funcblk;
268 
269 static struct tcp_function_block *
270 find_tcp_functions_locked(struct tcp_function_set *fs)
271 {
272 	struct tcp_function *f;
273 	struct tcp_function_block *blk=NULL;
274 
275 	TAILQ_FOREACH(f, &t_functions, tf_next) {
276 		if (strcmp(f->tf_fb->tfb_tcp_block_name, fs->function_set_name) == 0) {
277 			blk = f->tf_fb;
278 			break;
279 		}
280 	}
281 	return(blk);
282 }
283 
284 static struct tcp_function_block *
285 find_tcp_fb_locked(struct tcp_function_block *blk, struct tcp_function **s)
286 {
287 	struct tcp_function_block *rblk=NULL;
288 	struct tcp_function *f;
289 
290 	TAILQ_FOREACH(f, &t_functions, tf_next) {
291 		if (f->tf_fb == blk) {
292 			rblk = blk;
293 			if (s) {
294 				*s = f;
295 			}
296 			break;
297 		}
298 	}
299 	return (rblk);
300 }
301 
302 struct tcp_function_block *
303 find_and_ref_tcp_functions(struct tcp_function_set *fs)
304 {
305 	struct tcp_function_block *blk;
306 
307 	rw_rlock(&tcp_function_lock);
308 	blk = find_tcp_functions_locked(fs);
309 	if (blk)
310 		refcount_acquire(&blk->tfb_refcnt);
311 	rw_runlock(&tcp_function_lock);
312 	return(blk);
313 }
314 
315 struct tcp_function_block *
316 find_and_ref_tcp_fb(struct tcp_function_block *blk)
317 {
318 	struct tcp_function_block *rblk;
319 
320 	rw_rlock(&tcp_function_lock);
321 	rblk = find_tcp_fb_locked(blk, NULL);
322 	if (rblk)
323 		refcount_acquire(&rblk->tfb_refcnt);
324 	rw_runlock(&tcp_function_lock);
325 	return(rblk);
326 }
327 
328 
329 static int
330 sysctl_net_inet_default_tcp_functions(SYSCTL_HANDLER_ARGS)
331 {
332 	int error=ENOENT;
333 	struct tcp_function_set fs;
334 	struct tcp_function_block *blk;
335 
336 	memset(&fs, 0, sizeof(fs));
337 	rw_rlock(&tcp_function_lock);
338 	blk = find_tcp_fb_locked(tcp_func_set_ptr, NULL);
339 	if (blk) {
340 		/* Found him */
341 		strcpy(fs.function_set_name, blk->tfb_tcp_block_name);
342 		fs.pcbcnt = blk->tfb_refcnt;
343 	}
344 	rw_runlock(&tcp_function_lock);
345 	error = sysctl_handle_string(oidp, fs.function_set_name,
346 				     sizeof(fs.function_set_name), req);
347 
348 	/* Check for error or no change */
349 	if (error != 0 || req->newptr == NULL)
350 		return(error);
351 
352 	rw_wlock(&tcp_function_lock);
353 	blk = find_tcp_functions_locked(&fs);
354 	if ((blk == NULL) ||
355 	    (blk->tfb_flags & TCP_FUNC_BEING_REMOVED)) {
356 		error = ENOENT;
357 		goto done;
358 	}
359 	tcp_func_set_ptr = blk;
360 done:
361 	rw_wunlock(&tcp_function_lock);
362 	return (error);
363 }
364 
365 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, functions_default,
366 	    CTLTYPE_STRING | CTLFLAG_RW,
367 	    NULL, 0, sysctl_net_inet_default_tcp_functions, "A",
368 	    "Set/get the default TCP functions");
369 
370 static int
371 sysctl_net_inet_list_available(SYSCTL_HANDLER_ARGS)
372 {
373 	int error, cnt, linesz;
374 	struct tcp_function *f;
375 	char *buffer, *cp;
376 	size_t bufsz, outsz;
377 
378 	cnt = 0;
379 	rw_rlock(&tcp_function_lock);
380 	TAILQ_FOREACH(f, &t_functions, tf_next) {
381 		cnt++;
382 	}
383 	rw_runlock(&tcp_function_lock);
384 
385 	bufsz = (cnt+2) * (TCP_FUNCTION_NAME_LEN_MAX + 12) + 1;
386 	buffer = malloc(bufsz, M_TEMP, M_WAITOK);
387 
388 	error = 0;
389 	cp = buffer;
390 
391 	linesz = snprintf(cp, bufsz, "\n%-32s%c %s\n", "Stack", 'D', "PCB count");
392 	cp += linesz;
393 	bufsz -= linesz;
394 	outsz = linesz;
395 
396 	rw_rlock(&tcp_function_lock);
397 	TAILQ_FOREACH(f, &t_functions, tf_next) {
398 		linesz = snprintf(cp, bufsz, "%-32s%c %u\n",
399 		    f->tf_fb->tfb_tcp_block_name,
400 		    (f->tf_fb == tcp_func_set_ptr) ? '*' : ' ',
401 		    f->tf_fb->tfb_refcnt);
402 		if (linesz >= bufsz) {
403 			error = EOVERFLOW;
404 			break;
405 		}
406 		cp += linesz;
407 		bufsz -= linesz;
408 		outsz += linesz;
409 	}
410 	rw_runlock(&tcp_function_lock);
411 	if (error == 0)
412 		error = sysctl_handle_string(oidp, buffer, outsz + 1, req);
413 	free(buffer, M_TEMP);
414 	return (error);
415 }
416 
417 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, functions_available,
418 	    CTLTYPE_STRING|CTLFLAG_RD,
419 	    NULL, 0, sysctl_net_inet_list_available, "A",
420 	    "list available TCP Function sets");
421 
422 /*
423  * Target size of TCP PCB hash tables. Must be a power of two.
424  *
425  * Note that this can be overridden by the kernel environment
426  * variable net.inet.tcp.tcbhashsize
427  */
428 #ifndef TCBHASHSIZE
429 #define TCBHASHSIZE	0
430 #endif
431 
432 /*
433  * XXX
434  * Callouts should be moved into struct tcp directly.  They are currently
435  * separate because the tcpcb structure is exported to userland for sysctl
436  * parsing purposes, which do not know about callouts.
437  */
438 struct tcpcb_mem {
439 	struct	tcpcb		tcb;
440 	struct	tcp_timer	tt;
441 	struct	cc_var		ccv;
442 	struct	osd		osd;
443 };
444 
445 static VNET_DEFINE(uma_zone_t, tcpcb_zone);
446 #define	V_tcpcb_zone			VNET(tcpcb_zone)
447 
448 MALLOC_DEFINE(M_TCPLOG, "tcplog", "TCP address and flags print buffers");
449 MALLOC_DEFINE(M_TCPFUNCTIONS, "tcpfunc", "TCP function set memory");
450 
451 static struct mtx isn_mtx;
452 
453 #define	ISN_LOCK_INIT()	mtx_init(&isn_mtx, "isn_mtx", NULL, MTX_DEF)
454 #define	ISN_LOCK()	mtx_lock(&isn_mtx)
455 #define	ISN_UNLOCK()	mtx_unlock(&isn_mtx)
456 
457 /*
458  * TCP initialization.
459  */
460 static void
461 tcp_zone_change(void *tag)
462 {
463 
464 	uma_zone_set_max(V_tcbinfo.ipi_zone, maxsockets);
465 	uma_zone_set_max(V_tcpcb_zone, maxsockets);
466 	tcp_tw_zone_change();
467 }
468 
469 static int
470 tcp_inpcb_init(void *mem, int size, int flags)
471 {
472 	struct inpcb *inp = mem;
473 
474 	INP_LOCK_INIT(inp, "inp", "tcpinp");
475 	return (0);
476 }
477 
478 /*
479  * Take a value and get the next power of 2 that doesn't overflow.
480  * Used to size the tcp_inpcb hash buckets.
481  */
482 static int
483 maketcp_hashsize(int size)
484 {
485 	int hashsize;
486 
487 	/*
488 	 * auto tune.
489 	 * get the next power of 2 higher than maxsockets.
490 	 */
491 	hashsize = 1 << fls(size);
492 	/* catch overflow, and just go one power of 2 smaller */
493 	if (hashsize < size) {
494 		hashsize = 1 << (fls(size) - 1);
495 	}
496 	return (hashsize);
497 }
498 
499 int
500 register_tcp_functions(struct tcp_function_block *blk, int wait)
501 {
502 	struct tcp_function_block *lblk;
503 	struct tcp_function *n;
504 	struct tcp_function_set fs;
505 
506 	if ((blk->tfb_tcp_output == NULL) ||
507 	    (blk->tfb_tcp_do_segment == NULL) ||
508 	    (blk->tfb_tcp_ctloutput == NULL) ||
509 	    (strlen(blk->tfb_tcp_block_name) == 0)) {
510 		/*
511 		 * These functions are required and you
512 		 * need a name.
513 		 */
514 		return (EINVAL);
515 	}
516 	if (blk->tfb_tcp_timer_stop_all ||
517 	    blk->tfb_tcp_timers_left ||
518 	    blk->tfb_tcp_timer_activate ||
519 	    blk->tfb_tcp_timer_active ||
520 	    blk->tfb_tcp_timer_stop) {
521 		/*
522 		 * If you define one timer function you
523 		 * must have them all.
524 		 */
525 		if ((blk->tfb_tcp_timer_stop_all == NULL) ||
526 		    (blk->tfb_tcp_timers_left  == NULL) ||
527 		    (blk->tfb_tcp_timer_activate == NULL) ||
528 		    (blk->tfb_tcp_timer_active == NULL) ||
529 		    (blk->tfb_tcp_timer_stop == NULL)) {
530 			return (EINVAL);
531 		}
532 	}
533 	n = malloc(sizeof(struct tcp_function), M_TCPFUNCTIONS, wait);
534 	if (n == NULL) {
535 		return (ENOMEM);
536 	}
537 	n->tf_fb = blk;
538 	strcpy(fs.function_set_name, blk->tfb_tcp_block_name);
539 	rw_wlock(&tcp_function_lock);
540 	lblk = find_tcp_functions_locked(&fs);
541 	if (lblk) {
542 		/* Duplicate name space not allowed */
543 		rw_wunlock(&tcp_function_lock);
544 		free(n, M_TCPFUNCTIONS);
545 		return (EALREADY);
546 	}
547 	refcount_init(&blk->tfb_refcnt, 0);
548 	blk->tfb_flags = 0;
549 	TAILQ_INSERT_TAIL(&t_functions, n, tf_next);
550 	rw_wunlock(&tcp_function_lock);
551 	return(0);
552 }
553 
554 int
555 deregister_tcp_functions(struct tcp_function_block *blk)
556 {
557 	struct tcp_function_block *lblk;
558 	struct tcp_function *f;
559 	int error=ENOENT;
560 
561 	if (strcmp(blk->tfb_tcp_block_name, "default") == 0) {
562 		/* You can't un-register the default */
563 		return (EPERM);
564 	}
565 	rw_wlock(&tcp_function_lock);
566 	if (blk == tcp_func_set_ptr) {
567 		/* You can't free the current default */
568 		rw_wunlock(&tcp_function_lock);
569 		return (EBUSY);
570 	}
571 	if (blk->tfb_refcnt) {
572 		/* Still tcb attached, mark it. */
573 		blk->tfb_flags |= TCP_FUNC_BEING_REMOVED;
574 		rw_wunlock(&tcp_function_lock);
575 		return (EBUSY);
576 	}
577 	lblk = find_tcp_fb_locked(blk, &f);
578 	if (lblk) {
579 		/* Found */
580 		TAILQ_REMOVE(&t_functions, f, tf_next);
581 		f->tf_fb = NULL;
582 		free(f, M_TCPFUNCTIONS);
583 		error = 0;
584 	}
585 	rw_wunlock(&tcp_function_lock);
586 	return (error);
587 }
588 
589 void
590 tcp_init(void)
591 {
592 	const char *tcbhash_tuneable;
593 	int hashsize;
594 
595 	tcbhash_tuneable = "net.inet.tcp.tcbhashsize";
596 
597 	if (hhook_head_register(HHOOK_TYPE_TCP, HHOOK_TCP_EST_IN,
598 	    &V_tcp_hhh[HHOOK_TCP_EST_IN], HHOOK_NOWAIT|HHOOK_HEADISINVNET) != 0)
599 		printf("%s: WARNING: unable to register helper hook\n", __func__);
600 	if (hhook_head_register(HHOOK_TYPE_TCP, HHOOK_TCP_EST_OUT,
601 	    &V_tcp_hhh[HHOOK_TCP_EST_OUT], HHOOK_NOWAIT|HHOOK_HEADISINVNET) != 0)
602 		printf("%s: WARNING: unable to register helper hook\n", __func__);
603 	hashsize = TCBHASHSIZE;
604 	TUNABLE_INT_FETCH(tcbhash_tuneable, &hashsize);
605 	if (hashsize == 0) {
606 		/*
607 		 * Auto tune the hash size based on maxsockets.
608 		 * A perfect hash would have a 1:1 mapping
609 		 * (hashsize = maxsockets) however it's been
610 		 * suggested that O(2) average is better.
611 		 */
612 		hashsize = maketcp_hashsize(maxsockets / 4);
613 		/*
614 		 * Our historical default is 512,
615 		 * do not autotune lower than this.
616 		 */
617 		if (hashsize < 512)
618 			hashsize = 512;
619 		if (bootverbose && IS_DEFAULT_VNET(curvnet))
620 			printf("%s: %s auto tuned to %d\n", __func__,
621 			    tcbhash_tuneable, hashsize);
622 	}
623 	/*
624 	 * We require a hashsize to be a power of two.
625 	 * Previously if it was not a power of two we would just reset it
626 	 * back to 512, which could be a nasty surprise if you did not notice
627 	 * the error message.
628 	 * Instead what we do is clip it to the closest power of two lower
629 	 * than the specified hash value.
630 	 */
631 	if (!powerof2(hashsize)) {
632 		int oldhashsize = hashsize;
633 
634 		hashsize = maketcp_hashsize(hashsize);
635 		/* prevent absurdly low value */
636 		if (hashsize < 16)
637 			hashsize = 16;
638 		printf("%s: WARNING: TCB hash size not a power of 2, "
639 		    "clipped from %d to %d.\n", __func__, oldhashsize,
640 		    hashsize);
641 	}
642 	in_pcbinfo_init(&V_tcbinfo, "tcp", &V_tcb, hashsize, hashsize,
643 	    "tcp_inpcb", tcp_inpcb_init, NULL, UMA_ZONE_NOFREE,
644 	    IPI_HASHFIELDS_4TUPLE);
645 
646 	/*
647 	 * These have to be type stable for the benefit of the timers.
648 	 */
649 	V_tcpcb_zone = uma_zcreate("tcpcb", sizeof(struct tcpcb_mem),
650 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
651 	uma_zone_set_max(V_tcpcb_zone, maxsockets);
652 	uma_zone_set_warning(V_tcpcb_zone, "kern.ipc.maxsockets limit reached");
653 
654 	tcp_tw_init();
655 	syncache_init();
656 	tcp_hc_init();
657 
658 	TUNABLE_INT_FETCH("net.inet.tcp.sack.enable", &V_tcp_do_sack);
659 	V_sack_hole_zone = uma_zcreate("sackhole", sizeof(struct sackhole),
660 	    NULL, NULL, NULL, NULL, UMA_ALIGN_PTR, UMA_ZONE_NOFREE);
661 
662 	/* Skip initialization of globals for non-default instances. */
663 	if (!IS_DEFAULT_VNET(curvnet))
664 		return;
665 
666 	tcp_reass_global_init();
667 
668 	/* XXX virtualize those bellow? */
669 	tcp_delacktime = TCPTV_DELACK;
670 	tcp_keepinit = TCPTV_KEEP_INIT;
671 	tcp_keepidle = TCPTV_KEEP_IDLE;
672 	tcp_keepintvl = TCPTV_KEEPINTVL;
673 	tcp_maxpersistidle = TCPTV_KEEP_IDLE;
674 	tcp_msl = TCPTV_MSL;
675 	tcp_rexmit_min = TCPTV_MIN;
676 	if (tcp_rexmit_min < 1)
677 		tcp_rexmit_min = 1;
678 	tcp_persmin = TCPTV_PERSMIN;
679 	tcp_persmax = TCPTV_PERSMAX;
680 	tcp_rexmit_slop = TCPTV_CPU_VAR;
681 	tcp_finwait2_timeout = TCPTV_FINWAIT2_TIMEOUT;
682 	tcp_tcbhashsize = hashsize;
683 	/* Setup the tcp function block list */
684 	TAILQ_INIT(&t_functions);
685 	rw_init_flags(&tcp_function_lock, "tcp_func_lock" , 0);
686 	register_tcp_functions(&tcp_def_funcblk, M_WAITOK);
687 
688 	if (tcp_soreceive_stream) {
689 #ifdef INET
690 		tcp_usrreqs.pru_soreceive = soreceive_stream;
691 #endif
692 #ifdef INET6
693 		tcp6_usrreqs.pru_soreceive = soreceive_stream;
694 #endif /* INET6 */
695 	}
696 
697 #ifdef INET6
698 #define TCP_MINPROTOHDR (sizeof(struct ip6_hdr) + sizeof(struct tcphdr))
699 #else /* INET6 */
700 #define TCP_MINPROTOHDR (sizeof(struct tcpiphdr))
701 #endif /* INET6 */
702 	if (max_protohdr < TCP_MINPROTOHDR)
703 		max_protohdr = TCP_MINPROTOHDR;
704 	if (max_linkhdr + TCP_MINPROTOHDR > MHLEN)
705 		panic("tcp_init");
706 #undef TCP_MINPROTOHDR
707 
708 	ISN_LOCK_INIT();
709 	EVENTHANDLER_REGISTER(shutdown_pre_sync, tcp_fini, NULL,
710 		SHUTDOWN_PRI_DEFAULT);
711 	EVENTHANDLER_REGISTER(maxsockets_change, tcp_zone_change, NULL,
712 		EVENTHANDLER_PRI_ANY);
713 #ifdef TCPPCAP
714 	tcp_pcap_init();
715 #endif
716 
717 #ifdef TCP_RFC7413
718 	tcp_fastopen_init();
719 #endif
720 }
721 
722 #ifdef VIMAGE
723 void
724 tcp_destroy(void)
725 {
726 	int error;
727 
728 #ifdef TCP_RFC7413
729 	tcp_fastopen_destroy();
730 #endif
731 	tcp_hc_destroy();
732 	syncache_destroy();
733 	tcp_tw_destroy();
734 	in_pcbinfo_destroy(&V_tcbinfo);
735 	uma_zdestroy(V_sack_hole_zone);
736 	uma_zdestroy(V_tcpcb_zone);
737 
738 	error = hhook_head_deregister(V_tcp_hhh[HHOOK_TCP_EST_IN]);
739 	if (error != 0) {
740 		printf("%s: WARNING: unable to deregister helper hook "
741 		    "type=%d, id=%d: error %d returned\n", __func__,
742 		    HHOOK_TYPE_TCP, HHOOK_TCP_EST_IN, error);
743 	}
744 	error = hhook_head_deregister(V_tcp_hhh[HHOOK_TCP_EST_OUT]);
745 	if (error != 0) {
746 		printf("%s: WARNING: unable to deregister helper hook "
747 		    "type=%d, id=%d: error %d returned\n", __func__,
748 		    HHOOK_TYPE_TCP, HHOOK_TCP_EST_OUT, error);
749 	}
750 }
751 #endif
752 
753 void
754 tcp_fini(void *xtp)
755 {
756 
757 }
758 
759 /*
760  * Fill in the IP and TCP headers for an outgoing packet, given the tcpcb.
761  * tcp_template used to store this data in mbufs, but we now recopy it out
762  * of the tcpcb each time to conserve mbufs.
763  */
764 void
765 tcpip_fillheaders(struct inpcb *inp, void *ip_ptr, void *tcp_ptr)
766 {
767 	struct tcphdr *th = (struct tcphdr *)tcp_ptr;
768 
769 	INP_WLOCK_ASSERT(inp);
770 
771 #ifdef INET6
772 	if ((inp->inp_vflag & INP_IPV6) != 0) {
773 		struct ip6_hdr *ip6;
774 
775 		ip6 = (struct ip6_hdr *)ip_ptr;
776 		ip6->ip6_flow = (ip6->ip6_flow & ~IPV6_FLOWINFO_MASK) |
777 			(inp->inp_flow & IPV6_FLOWINFO_MASK);
778 		ip6->ip6_vfc = (ip6->ip6_vfc & ~IPV6_VERSION_MASK) |
779 			(IPV6_VERSION & IPV6_VERSION_MASK);
780 		ip6->ip6_nxt = IPPROTO_TCP;
781 		ip6->ip6_plen = htons(sizeof(struct tcphdr));
782 		ip6->ip6_src = inp->in6p_laddr;
783 		ip6->ip6_dst = inp->in6p_faddr;
784 	}
785 #endif /* INET6 */
786 #if defined(INET6) && defined(INET)
787 	else
788 #endif
789 #ifdef INET
790 	{
791 		struct ip *ip;
792 
793 		ip = (struct ip *)ip_ptr;
794 		ip->ip_v = IPVERSION;
795 		ip->ip_hl = 5;
796 		ip->ip_tos = inp->inp_ip_tos;
797 		ip->ip_len = 0;
798 		ip->ip_id = 0;
799 		ip->ip_off = 0;
800 		ip->ip_ttl = inp->inp_ip_ttl;
801 		ip->ip_sum = 0;
802 		ip->ip_p = IPPROTO_TCP;
803 		ip->ip_src = inp->inp_laddr;
804 		ip->ip_dst = inp->inp_faddr;
805 	}
806 #endif /* INET */
807 	th->th_sport = inp->inp_lport;
808 	th->th_dport = inp->inp_fport;
809 	th->th_seq = 0;
810 	th->th_ack = 0;
811 	th->th_x2 = 0;
812 	th->th_off = 5;
813 	th->th_flags = 0;
814 	th->th_win = 0;
815 	th->th_urp = 0;
816 	th->th_sum = 0;		/* in_pseudo() is called later for ipv4 */
817 }
818 
819 /*
820  * Create template to be used to send tcp packets on a connection.
821  * Allocates an mbuf and fills in a skeletal tcp/ip header.  The only
822  * use for this function is in keepalives, which use tcp_respond.
823  */
824 struct tcptemp *
825 tcpip_maketemplate(struct inpcb *inp)
826 {
827 	struct tcptemp *t;
828 
829 	t = malloc(sizeof(*t), M_TEMP, M_NOWAIT);
830 	if (t == NULL)
831 		return (NULL);
832 	tcpip_fillheaders(inp, (void *)&t->tt_ipgen, (void *)&t->tt_t);
833 	return (t);
834 }
835 
836 /*
837  * Send a single message to the TCP at address specified by
838  * the given TCP/IP header.  If m == NULL, then we make a copy
839  * of the tcpiphdr at th and send directly to the addressed host.
840  * This is used to force keep alive messages out using the TCP
841  * template for a connection.  If flags are given then we send
842  * a message back to the TCP which originated the segment th,
843  * and discard the mbuf containing it and any other attached mbufs.
844  *
845  * In any case the ack and sequence number of the transmitted
846  * segment are as specified by the parameters.
847  *
848  * NOTE: If m != NULL, then th must point to *inside* the mbuf.
849  */
850 void
851 tcp_respond(struct tcpcb *tp, void *ipgen, struct tcphdr *th, struct mbuf *m,
852     tcp_seq ack, tcp_seq seq, int flags)
853 {
854 	int tlen;
855 	int win = 0;
856 	struct ip *ip;
857 	struct tcphdr *nth;
858 #ifdef INET6
859 	struct ip6_hdr *ip6;
860 	int isipv6;
861 #endif /* INET6 */
862 	int ipflags = 0;
863 	struct inpcb *inp;
864 
865 	KASSERT(tp != NULL || m != NULL, ("tcp_respond: tp and m both NULL"));
866 
867 #ifdef INET6
868 	isipv6 = ((struct ip *)ipgen)->ip_v == (IPV6_VERSION >> 4);
869 	ip6 = ipgen;
870 #endif /* INET6 */
871 	ip = ipgen;
872 
873 	if (tp != NULL) {
874 		inp = tp->t_inpcb;
875 		KASSERT(inp != NULL, ("tcp control block w/o inpcb"));
876 		INP_WLOCK_ASSERT(inp);
877 	} else
878 		inp = NULL;
879 
880 	if (tp != NULL) {
881 		if (!(flags & TH_RST)) {
882 			win = sbspace(&inp->inp_socket->so_rcv);
883 			if (win > (long)TCP_MAXWIN << tp->rcv_scale)
884 				win = (long)TCP_MAXWIN << tp->rcv_scale;
885 		}
886 	}
887 	if (m == NULL) {
888 		m = m_gethdr(M_NOWAIT, MT_DATA);
889 		if (m == NULL)
890 			return;
891 		tlen = 0;
892 		m->m_data += max_linkhdr;
893 #ifdef INET6
894 		if (isipv6) {
895 			bcopy((caddr_t)ip6, mtod(m, caddr_t),
896 			      sizeof(struct ip6_hdr));
897 			ip6 = mtod(m, struct ip6_hdr *);
898 			nth = (struct tcphdr *)(ip6 + 1);
899 		} else
900 #endif /* INET6 */
901 		{
902 			bcopy((caddr_t)ip, mtod(m, caddr_t), sizeof(struct ip));
903 			ip = mtod(m, struct ip *);
904 			nth = (struct tcphdr *)(ip + 1);
905 		}
906 		bcopy((caddr_t)th, (caddr_t)nth, sizeof(struct tcphdr));
907 		flags = TH_ACK;
908 	} else {
909 		/*
910 		 *  reuse the mbuf.
911 		 * XXX MRT We inherrit the FIB, which is lucky.
912 		 */
913 		m_freem(m->m_next);
914 		m->m_next = NULL;
915 		m->m_data = (caddr_t)ipgen;
916 		/* m_len is set later */
917 		tlen = 0;
918 #define xchg(a,b,type) { type t; t=a; a=b; b=t; }
919 #ifdef INET6
920 		if (isipv6) {
921 			xchg(ip6->ip6_dst, ip6->ip6_src, struct in6_addr);
922 			nth = (struct tcphdr *)(ip6 + 1);
923 		} else
924 #endif /* INET6 */
925 		{
926 			xchg(ip->ip_dst.s_addr, ip->ip_src.s_addr, uint32_t);
927 			nth = (struct tcphdr *)(ip + 1);
928 		}
929 		if (th != nth) {
930 			/*
931 			 * this is usually a case when an extension header
932 			 * exists between the IPv6 header and the
933 			 * TCP header.
934 			 */
935 			nth->th_sport = th->th_sport;
936 			nth->th_dport = th->th_dport;
937 		}
938 		xchg(nth->th_dport, nth->th_sport, uint16_t);
939 #undef xchg
940 	}
941 #ifdef INET6
942 	if (isipv6) {
943 		ip6->ip6_flow = 0;
944 		ip6->ip6_vfc = IPV6_VERSION;
945 		ip6->ip6_nxt = IPPROTO_TCP;
946 		tlen += sizeof (struct ip6_hdr) + sizeof (struct tcphdr);
947 		ip6->ip6_plen = htons(tlen - sizeof(*ip6));
948 	}
949 #endif
950 #if defined(INET) && defined(INET6)
951 	else
952 #endif
953 #ifdef INET
954 	{
955 		tlen += sizeof (struct tcpiphdr);
956 		ip->ip_len = htons(tlen);
957 		ip->ip_ttl = V_ip_defttl;
958 		if (V_path_mtu_discovery)
959 			ip->ip_off |= htons(IP_DF);
960 	}
961 #endif
962 	m->m_len = tlen;
963 	m->m_pkthdr.len = tlen;
964 	m->m_pkthdr.rcvif = NULL;
965 #ifdef MAC
966 	if (inp != NULL) {
967 		/*
968 		 * Packet is associated with a socket, so allow the
969 		 * label of the response to reflect the socket label.
970 		 */
971 		INP_WLOCK_ASSERT(inp);
972 		mac_inpcb_create_mbuf(inp, m);
973 	} else {
974 		/*
975 		 * Packet is not associated with a socket, so possibly
976 		 * update the label in place.
977 		 */
978 		mac_netinet_tcp_reply(m);
979 	}
980 #endif
981 	nth->th_seq = htonl(seq);
982 	nth->th_ack = htonl(ack);
983 	nth->th_x2 = 0;
984 	nth->th_off = sizeof (struct tcphdr) >> 2;
985 	nth->th_flags = flags;
986 	if (tp != NULL)
987 		nth->th_win = htons((u_short) (win >> tp->rcv_scale));
988 	else
989 		nth->th_win = htons((u_short)win);
990 	nth->th_urp = 0;
991 
992 	m->m_pkthdr.csum_data = offsetof(struct tcphdr, th_sum);
993 #ifdef INET6
994 	if (isipv6) {
995 		m->m_pkthdr.csum_flags = CSUM_TCP_IPV6;
996 		nth->th_sum = in6_cksum_pseudo(ip6,
997 		    tlen - sizeof(struct ip6_hdr), IPPROTO_TCP, 0);
998 		ip6->ip6_hlim = in6_selecthlim(tp != NULL ? tp->t_inpcb :
999 		    NULL, NULL);
1000 	}
1001 #endif /* INET6 */
1002 #if defined(INET6) && defined(INET)
1003 	else
1004 #endif
1005 #ifdef INET
1006 	{
1007 		m->m_pkthdr.csum_flags = CSUM_TCP;
1008 		nth->th_sum = in_pseudo(ip->ip_src.s_addr, ip->ip_dst.s_addr,
1009 		    htons((u_short)(tlen - sizeof(struct ip) + ip->ip_p)));
1010 	}
1011 #endif /* INET */
1012 #ifdef TCPDEBUG
1013 	if (tp == NULL || (inp->inp_socket->so_options & SO_DEBUG))
1014 		tcp_trace(TA_OUTPUT, 0, tp, mtod(m, void *), th, 0);
1015 #endif
1016 	TCP_PROBE3(debug__input, tp, th, mtod(m, const char *));
1017 	if (flags & TH_RST)
1018 		TCP_PROBE5(accept__refused, NULL, NULL, mtod(m, const char *),
1019 		    tp, nth);
1020 
1021 	TCP_PROBE5(send, NULL, tp, mtod(m, const char *), tp, nth);
1022 #ifdef INET6
1023 	if (isipv6)
1024 		(void) ip6_output(m, NULL, NULL, ipflags, NULL, NULL, inp);
1025 #endif /* INET6 */
1026 #if defined(INET) && defined(INET6)
1027 	else
1028 #endif
1029 #ifdef INET
1030 		(void) ip_output(m, NULL, NULL, ipflags, NULL, inp);
1031 #endif
1032 }
1033 
1034 /*
1035  * Create a new TCP control block, making an
1036  * empty reassembly queue and hooking it to the argument
1037  * protocol control block.  The `inp' parameter must have
1038  * come from the zone allocator set up in tcp_init().
1039  */
1040 struct tcpcb *
1041 tcp_newtcpcb(struct inpcb *inp)
1042 {
1043 	struct tcpcb_mem *tm;
1044 	struct tcpcb *tp;
1045 #ifdef INET6
1046 	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
1047 #endif /* INET6 */
1048 
1049 	tm = uma_zalloc(V_tcpcb_zone, M_NOWAIT | M_ZERO);
1050 	if (tm == NULL)
1051 		return (NULL);
1052 	tp = &tm->tcb;
1053 
1054 	/* Initialise cc_var struct for this tcpcb. */
1055 	tp->ccv = &tm->ccv;
1056 	tp->ccv->type = IPPROTO_TCP;
1057 	tp->ccv->ccvc.tcp = tp;
1058 	rw_rlock(&tcp_function_lock);
1059 	tp->t_fb = tcp_func_set_ptr;
1060 	refcount_acquire(&tp->t_fb->tfb_refcnt);
1061 	rw_runlock(&tcp_function_lock);
1062 	if (tp->t_fb->tfb_tcp_fb_init) {
1063 		(*tp->t_fb->tfb_tcp_fb_init)(tp);
1064 	}
1065 	/*
1066 	 * Use the current system default CC algorithm.
1067 	 */
1068 	CC_LIST_RLOCK();
1069 	KASSERT(!STAILQ_EMPTY(&cc_list), ("cc_list is empty!"));
1070 	CC_ALGO(tp) = CC_DEFAULT();
1071 	CC_LIST_RUNLOCK();
1072 
1073 	if (CC_ALGO(tp)->cb_init != NULL)
1074 		if (CC_ALGO(tp)->cb_init(tp->ccv) > 0) {
1075 			if (tp->t_fb->tfb_tcp_fb_fini)
1076 				(*tp->t_fb->tfb_tcp_fb_fini)(tp);
1077 			refcount_release(&tp->t_fb->tfb_refcnt);
1078 			uma_zfree(V_tcpcb_zone, tm);
1079 			return (NULL);
1080 		}
1081 
1082 	tp->osd = &tm->osd;
1083 	if (khelp_init_osd(HELPER_CLASS_TCP, tp->osd)) {
1084 		if (tp->t_fb->tfb_tcp_fb_fini)
1085 			(*tp->t_fb->tfb_tcp_fb_fini)(tp);
1086 		refcount_release(&tp->t_fb->tfb_refcnt);
1087 		uma_zfree(V_tcpcb_zone, tm);
1088 		return (NULL);
1089 	}
1090 
1091 #ifdef VIMAGE
1092 	tp->t_vnet = inp->inp_vnet;
1093 #endif
1094 	tp->t_timers = &tm->tt;
1095 	/*	LIST_INIT(&tp->t_segq); */	/* XXX covered by M_ZERO */
1096 	tp->t_maxseg =
1097 #ifdef INET6
1098 		isipv6 ? V_tcp_v6mssdflt :
1099 #endif /* INET6 */
1100 		V_tcp_mssdflt;
1101 
1102 	/* Set up our timeouts. */
1103 	callout_init(&tp->t_timers->tt_rexmt, 1);
1104 	callout_init(&tp->t_timers->tt_persist, 1);
1105 	callout_init(&tp->t_timers->tt_keep, 1);
1106 	callout_init(&tp->t_timers->tt_2msl, 1);
1107 	callout_init(&tp->t_timers->tt_delack, 1);
1108 
1109 	if (V_tcp_do_rfc1323)
1110 		tp->t_flags = (TF_REQ_SCALE|TF_REQ_TSTMP);
1111 	if (V_tcp_do_sack)
1112 		tp->t_flags |= TF_SACK_PERMIT;
1113 	TAILQ_INIT(&tp->snd_holes);
1114 	/*
1115 	 * The tcpcb will hold a reference on its inpcb until tcp_discardcb()
1116 	 * is called.
1117 	 */
1118 	in_pcbref(inp);	/* Reference for tcpcb */
1119 	tp->t_inpcb = inp;
1120 
1121 	/*
1122 	 * Init srtt to TCPTV_SRTTBASE (0), so we can tell that we have no
1123 	 * rtt estimate.  Set rttvar so that srtt + 4 * rttvar gives
1124 	 * reasonable initial retransmit time.
1125 	 */
1126 	tp->t_srtt = TCPTV_SRTTBASE;
1127 	tp->t_rttvar = ((TCPTV_RTOBASE - TCPTV_SRTTBASE) << TCP_RTTVAR_SHIFT) / 4;
1128 	tp->t_rttmin = tcp_rexmit_min;
1129 	tp->t_rxtcur = TCPTV_RTOBASE;
1130 	tp->snd_cwnd = TCP_MAXWIN << TCP_MAX_WINSHIFT;
1131 	tp->snd_ssthresh = TCP_MAXWIN << TCP_MAX_WINSHIFT;
1132 	tp->t_rcvtime = ticks;
1133 	/*
1134 	 * IPv4 TTL initialization is necessary for an IPv6 socket as well,
1135 	 * because the socket may be bound to an IPv6 wildcard address,
1136 	 * which may match an IPv4-mapped IPv6 address.
1137 	 */
1138 	inp->inp_ip_ttl = V_ip_defttl;
1139 	inp->inp_ppcb = tp;
1140 #ifdef TCPPCAP
1141 	/*
1142 	 * Init the TCP PCAP queues.
1143 	 */
1144 	tcp_pcap_tcpcb_init(tp);
1145 #endif
1146 	return (tp);		/* XXX */
1147 }
1148 
1149 /*
1150  * Switch the congestion control algorithm back to NewReno for any active
1151  * control blocks using an algorithm which is about to go away.
1152  * This ensures the CC framework can allow the unload to proceed without leaving
1153  * any dangling pointers which would trigger a panic.
1154  * Returning non-zero would inform the CC framework that something went wrong
1155  * and it would be unsafe to allow the unload to proceed. However, there is no
1156  * way for this to occur with this implementation so we always return zero.
1157  */
1158 int
1159 tcp_ccalgounload(struct cc_algo *unload_algo)
1160 {
1161 	struct cc_algo *tmpalgo;
1162 	struct inpcb *inp;
1163 	struct tcpcb *tp;
1164 	VNET_ITERATOR_DECL(vnet_iter);
1165 
1166 	/*
1167 	 * Check all active control blocks across all network stacks and change
1168 	 * any that are using "unload_algo" back to NewReno. If "unload_algo"
1169 	 * requires cleanup code to be run, call it.
1170 	 */
1171 	VNET_LIST_RLOCK();
1172 	VNET_FOREACH(vnet_iter) {
1173 		CURVNET_SET(vnet_iter);
1174 		INP_INFO_WLOCK(&V_tcbinfo);
1175 		/*
1176 		 * New connections already part way through being initialised
1177 		 * with the CC algo we're removing will not race with this code
1178 		 * because the INP_INFO_WLOCK is held during initialisation. We
1179 		 * therefore don't enter the loop below until the connection
1180 		 * list has stabilised.
1181 		 */
1182 		LIST_FOREACH(inp, &V_tcb, inp_list) {
1183 			INP_WLOCK(inp);
1184 			/* Important to skip tcptw structs. */
1185 			if (!(inp->inp_flags & INP_TIMEWAIT) &&
1186 			    (tp = intotcpcb(inp)) != NULL) {
1187 				/*
1188 				 * By holding INP_WLOCK here, we are assured
1189 				 * that the connection is not currently
1190 				 * executing inside the CC module's functions
1191 				 * i.e. it is safe to make the switch back to
1192 				 * NewReno.
1193 				 */
1194 				if (CC_ALGO(tp) == unload_algo) {
1195 					tmpalgo = CC_ALGO(tp);
1196 					/* NewReno does not require any init. */
1197 					CC_ALGO(tp) = &newreno_cc_algo;
1198 					if (tmpalgo->cb_destroy != NULL)
1199 						tmpalgo->cb_destroy(tp->ccv);
1200 				}
1201 			}
1202 			INP_WUNLOCK(inp);
1203 		}
1204 		INP_INFO_WUNLOCK(&V_tcbinfo);
1205 		CURVNET_RESTORE();
1206 	}
1207 	VNET_LIST_RUNLOCK();
1208 
1209 	return (0);
1210 }
1211 
1212 /*
1213  * Drop a TCP connection, reporting
1214  * the specified error.  If connection is synchronized,
1215  * then send a RST to peer.
1216  */
1217 struct tcpcb *
1218 tcp_drop(struct tcpcb *tp, int errno)
1219 {
1220 	struct socket *so = tp->t_inpcb->inp_socket;
1221 
1222 	INP_INFO_LOCK_ASSERT(&V_tcbinfo);
1223 	INP_WLOCK_ASSERT(tp->t_inpcb);
1224 
1225 	if (TCPS_HAVERCVDSYN(tp->t_state)) {
1226 		tcp_state_change(tp, TCPS_CLOSED);
1227 		(void) tp->t_fb->tfb_tcp_output(tp);
1228 		TCPSTAT_INC(tcps_drops);
1229 	} else
1230 		TCPSTAT_INC(tcps_conndrops);
1231 	if (errno == ETIMEDOUT && tp->t_softerror)
1232 		errno = tp->t_softerror;
1233 	so->so_error = errno;
1234 	return (tcp_close(tp));
1235 }
1236 
1237 void
1238 tcp_discardcb(struct tcpcb *tp)
1239 {
1240 	struct inpcb *inp = tp->t_inpcb;
1241 	struct socket *so = inp->inp_socket;
1242 #ifdef INET6
1243 	int isipv6 = (inp->inp_vflag & INP_IPV6) != 0;
1244 #endif /* INET6 */
1245 	int released;
1246 
1247 	INP_WLOCK_ASSERT(inp);
1248 
1249 	/*
1250 	 * Make sure that all of our timers are stopped before we delete the
1251 	 * PCB.
1252 	 *
1253 	 * If stopping a timer fails, we schedule a discard function in same
1254 	 * callout, and the last discard function called will take care of
1255 	 * deleting the tcpcb.
1256 	 */
1257 	tcp_timer_stop(tp, TT_REXMT);
1258 	tcp_timer_stop(tp, TT_PERSIST);
1259 	tcp_timer_stop(tp, TT_KEEP);
1260 	tcp_timer_stop(tp, TT_2MSL);
1261 	tcp_timer_stop(tp, TT_DELACK);
1262 	if (tp->t_fb->tfb_tcp_timer_stop_all) {
1263 		/* Call the stop-all function of the methods */
1264 		tp->t_fb->tfb_tcp_timer_stop_all(tp);
1265 	}
1266 
1267 	/*
1268 	 * If we got enough samples through the srtt filter,
1269 	 * save the rtt and rttvar in the routing entry.
1270 	 * 'Enough' is arbitrarily defined as 4 rtt samples.
1271 	 * 4 samples is enough for the srtt filter to converge
1272 	 * to within enough % of the correct value; fewer samples
1273 	 * and we could save a bogus rtt. The danger is not high
1274 	 * as tcp quickly recovers from everything.
1275 	 * XXX: Works very well but needs some more statistics!
1276 	 */
1277 	if (tp->t_rttupdated >= 4) {
1278 		struct hc_metrics_lite metrics;
1279 		u_long ssthresh;
1280 
1281 		bzero(&metrics, sizeof(metrics));
1282 		/*
1283 		 * Update the ssthresh always when the conditions below
1284 		 * are satisfied. This gives us better new start value
1285 		 * for the congestion avoidance for new connections.
1286 		 * ssthresh is only set if packet loss occured on a session.
1287 		 *
1288 		 * XXXRW: 'so' may be NULL here, and/or socket buffer may be
1289 		 * being torn down.  Ideally this code would not use 'so'.
1290 		 */
1291 		ssthresh = tp->snd_ssthresh;
1292 		if (ssthresh != 0 && ssthresh < so->so_snd.sb_hiwat / 2) {
1293 			/*
1294 			 * convert the limit from user data bytes to
1295 			 * packets then to packet data bytes.
1296 			 */
1297 			ssthresh = (ssthresh + tp->t_maxseg / 2) / tp->t_maxseg;
1298 			if (ssthresh < 2)
1299 				ssthresh = 2;
1300 			ssthresh *= (u_long)(tp->t_maxseg +
1301 #ifdef INET6
1302 			    (isipv6 ? sizeof (struct ip6_hdr) +
1303 				sizeof (struct tcphdr) :
1304 #endif
1305 				sizeof (struct tcpiphdr)
1306 #ifdef INET6
1307 			    )
1308 #endif
1309 			    );
1310 		} else
1311 			ssthresh = 0;
1312 		metrics.rmx_ssthresh = ssthresh;
1313 
1314 		metrics.rmx_rtt = tp->t_srtt;
1315 		metrics.rmx_rttvar = tp->t_rttvar;
1316 		metrics.rmx_cwnd = tp->snd_cwnd;
1317 		metrics.rmx_sendpipe = 0;
1318 		metrics.rmx_recvpipe = 0;
1319 
1320 		tcp_hc_update(&inp->inp_inc, &metrics);
1321 	}
1322 
1323 	/* free the reassembly queue, if any */
1324 	tcp_reass_flush(tp);
1325 
1326 #ifdef TCP_OFFLOAD
1327 	/* Disconnect offload device, if any. */
1328 	if (tp->t_flags & TF_TOE)
1329 		tcp_offload_detach(tp);
1330 #endif
1331 
1332 	tcp_free_sackholes(tp);
1333 
1334 #ifdef TCPPCAP
1335 	/* Free the TCP PCAP queues. */
1336 	tcp_pcap_drain(&(tp->t_inpkts));
1337 	tcp_pcap_drain(&(tp->t_outpkts));
1338 #endif
1339 
1340 	/* Allow the CC algorithm to clean up after itself. */
1341 	if (CC_ALGO(tp)->cb_destroy != NULL)
1342 		CC_ALGO(tp)->cb_destroy(tp->ccv);
1343 
1344 	khelp_destroy_osd(tp->osd);
1345 
1346 	CC_ALGO(tp) = NULL;
1347 	inp->inp_ppcb = NULL;
1348 	if ((tp->t_timers->tt_flags & TT_MASK) == 0) {
1349 		/* We own the last reference on tcpcb, let's free it. */
1350 		if ((tp->t_fb->tfb_tcp_timers_left) &&
1351 		    (tp->t_fb->tfb_tcp_timers_left(tp))) {
1352 			    /* Some fb timers left running! */
1353 			    return;
1354 		}
1355 		if (tp->t_fb->tfb_tcp_fb_fini)
1356 			(*tp->t_fb->tfb_tcp_fb_fini)(tp);
1357 		refcount_release(&tp->t_fb->tfb_refcnt);
1358 		tp->t_inpcb = NULL;
1359 		uma_zfree(V_tcpcb_zone, tp);
1360 		released = in_pcbrele_wlocked(inp);
1361 		KASSERT(!released, ("%s: inp %p should not have been released "
1362 			"here", __func__, inp));
1363 	}
1364 }
1365 
1366 void
1367 tcp_timer_2msl_discard(void *xtp)
1368 {
1369 
1370 	tcp_timer_discard((struct tcpcb *)xtp, TT_2MSL);
1371 }
1372 
1373 void
1374 tcp_timer_keep_discard(void *xtp)
1375 {
1376 
1377 	tcp_timer_discard((struct tcpcb *)xtp, TT_KEEP);
1378 }
1379 
1380 void
1381 tcp_timer_persist_discard(void *xtp)
1382 {
1383 
1384 	tcp_timer_discard((struct tcpcb *)xtp, TT_PERSIST);
1385 }
1386 
1387 void
1388 tcp_timer_rexmt_discard(void *xtp)
1389 {
1390 
1391 	tcp_timer_discard((struct tcpcb *)xtp, TT_REXMT);
1392 }
1393 
1394 void
1395 tcp_timer_delack_discard(void *xtp)
1396 {
1397 
1398 	tcp_timer_discard((struct tcpcb *)xtp, TT_DELACK);
1399 }
1400 
1401 void
1402 tcp_timer_discard(struct tcpcb *tp, uint32_t timer_type)
1403 {
1404 	struct inpcb *inp;
1405 
1406 	CURVNET_SET(tp->t_vnet);
1407 	INP_INFO_RLOCK(&V_tcbinfo);
1408 	inp = tp->t_inpcb;
1409 	KASSERT(inp != NULL, ("%s: tp %p tp->t_inpcb == NULL",
1410 		__func__, tp));
1411 	INP_WLOCK(inp);
1412 	KASSERT((tp->t_timers->tt_flags & TT_STOPPED) != 0,
1413 		("%s: tcpcb has to be stopped here", __func__));
1414 	KASSERT((tp->t_timers->tt_flags & timer_type) != 0,
1415 		("%s: discard callout should be running", __func__));
1416 	tp->t_timers->tt_flags &= ~timer_type;
1417 	if ((tp->t_timers->tt_flags & TT_MASK) == 0) {
1418 		/* We own the last reference on this tcpcb, let's free it. */
1419 		if ((tp->t_fb->tfb_tcp_timers_left) &&
1420 		    (tp->t_fb->tfb_tcp_timers_left(tp))) {
1421 			    /* Some fb timers left running! */
1422 			    goto leave;
1423 		}
1424 		if (tp->t_fb->tfb_tcp_fb_fini)
1425 			(*tp->t_fb->tfb_tcp_fb_fini)(tp);
1426 		refcount_release(&tp->t_fb->tfb_refcnt);
1427 		tp->t_inpcb = NULL;
1428 		uma_zfree(V_tcpcb_zone, tp);
1429 		if (in_pcbrele_wlocked(inp)) {
1430 			INP_INFO_RUNLOCK(&V_tcbinfo);
1431 			CURVNET_RESTORE();
1432 			return;
1433 		}
1434 	}
1435 leave:
1436 	INP_WUNLOCK(inp);
1437 	INP_INFO_RUNLOCK(&V_tcbinfo);
1438 	CURVNET_RESTORE();
1439 }
1440 
1441 /*
1442  * Attempt to close a TCP control block, marking it as dropped, and freeing
1443  * the socket if we hold the only reference.
1444  */
1445 struct tcpcb *
1446 tcp_close(struct tcpcb *tp)
1447 {
1448 	struct inpcb *inp = tp->t_inpcb;
1449 	struct socket *so;
1450 
1451 	INP_INFO_LOCK_ASSERT(&V_tcbinfo);
1452 	INP_WLOCK_ASSERT(inp);
1453 
1454 #ifdef TCP_OFFLOAD
1455 	if (tp->t_state == TCPS_LISTEN)
1456 		tcp_offload_listen_stop(tp);
1457 #endif
1458 #ifdef TCP_RFC7413
1459 	/*
1460 	 * This releases the TFO pending counter resource for TFO listen
1461 	 * sockets as well as passively-created TFO sockets that transition
1462 	 * from SYN_RECEIVED to CLOSED.
1463 	 */
1464 	if (tp->t_tfo_pending) {
1465 		tcp_fastopen_decrement_counter(tp->t_tfo_pending);
1466 		tp->t_tfo_pending = NULL;
1467 	}
1468 #endif
1469 	in_pcbdrop(inp);
1470 	TCPSTAT_INC(tcps_closed);
1471 	TCPSTAT_DEC(tcps_states[tp->t_state]);
1472 	KASSERT(inp->inp_socket != NULL, ("tcp_close: inp_socket NULL"));
1473 	so = inp->inp_socket;
1474 	soisdisconnected(so);
1475 	if (inp->inp_flags & INP_SOCKREF) {
1476 		KASSERT(so->so_state & SS_PROTOREF,
1477 		    ("tcp_close: !SS_PROTOREF"));
1478 		inp->inp_flags &= ~INP_SOCKREF;
1479 		INP_WUNLOCK(inp);
1480 		ACCEPT_LOCK();
1481 		SOCK_LOCK(so);
1482 		so->so_state &= ~SS_PROTOREF;
1483 		sofree(so);
1484 		return (NULL);
1485 	}
1486 	return (tp);
1487 }
1488 
1489 void
1490 tcp_drain(void)
1491 {
1492 	VNET_ITERATOR_DECL(vnet_iter);
1493 
1494 	if (!do_tcpdrain)
1495 		return;
1496 
1497 	VNET_LIST_RLOCK_NOSLEEP();
1498 	VNET_FOREACH(vnet_iter) {
1499 		CURVNET_SET(vnet_iter);
1500 		struct inpcb *inpb;
1501 		struct tcpcb *tcpb;
1502 
1503 	/*
1504 	 * Walk the tcpbs, if existing, and flush the reassembly queue,
1505 	 * if there is one...
1506 	 * XXX: The "Net/3" implementation doesn't imply that the TCP
1507 	 *      reassembly queue should be flushed, but in a situation
1508 	 *	where we're really low on mbufs, this is potentially
1509 	 *	useful.
1510 	 */
1511 		INP_INFO_WLOCK(&V_tcbinfo);
1512 		LIST_FOREACH(inpb, V_tcbinfo.ipi_listhead, inp_list) {
1513 			if (inpb->inp_flags & INP_TIMEWAIT)
1514 				continue;
1515 			INP_WLOCK(inpb);
1516 			if ((tcpb = intotcpcb(inpb)) != NULL) {
1517 				tcp_reass_flush(tcpb);
1518 				tcp_clean_sackreport(tcpb);
1519 			}
1520 			INP_WUNLOCK(inpb);
1521 		}
1522 		INP_INFO_WUNLOCK(&V_tcbinfo);
1523 		CURVNET_RESTORE();
1524 	}
1525 	VNET_LIST_RUNLOCK_NOSLEEP();
1526 }
1527 
1528 /*
1529  * Notify a tcp user of an asynchronous error;
1530  * store error as soft error, but wake up user
1531  * (for now, won't do anything until can select for soft error).
1532  *
1533  * Do not wake up user since there currently is no mechanism for
1534  * reporting soft errors (yet - a kqueue filter may be added).
1535  */
1536 static struct inpcb *
1537 tcp_notify(struct inpcb *inp, int error)
1538 {
1539 	struct tcpcb *tp;
1540 
1541 	INP_INFO_LOCK_ASSERT(&V_tcbinfo);
1542 	INP_WLOCK_ASSERT(inp);
1543 
1544 	if ((inp->inp_flags & INP_TIMEWAIT) ||
1545 	    (inp->inp_flags & INP_DROPPED))
1546 		return (inp);
1547 
1548 	tp = intotcpcb(inp);
1549 	KASSERT(tp != NULL, ("tcp_notify: tp == NULL"));
1550 
1551 	/*
1552 	 * Ignore some errors if we are hooked up.
1553 	 * If connection hasn't completed, has retransmitted several times,
1554 	 * and receives a second error, give up now.  This is better
1555 	 * than waiting a long time to establish a connection that
1556 	 * can never complete.
1557 	 */
1558 	if (tp->t_state == TCPS_ESTABLISHED &&
1559 	    (error == EHOSTUNREACH || error == ENETUNREACH ||
1560 	     error == EHOSTDOWN)) {
1561 		return (inp);
1562 	} else if (tp->t_state < TCPS_ESTABLISHED && tp->t_rxtshift > 3 &&
1563 	    tp->t_softerror) {
1564 		tp = tcp_drop(tp, error);
1565 		if (tp != NULL)
1566 			return (inp);
1567 		else
1568 			return (NULL);
1569 	} else {
1570 		tp->t_softerror = error;
1571 		return (inp);
1572 	}
1573 #if 0
1574 	wakeup( &so->so_timeo);
1575 	sorwakeup(so);
1576 	sowwakeup(so);
1577 #endif
1578 }
1579 
1580 static int
1581 tcp_pcblist(SYSCTL_HANDLER_ARGS)
1582 {
1583 	int error, i, m, n, pcb_count;
1584 	struct inpcb *inp, **inp_list;
1585 	inp_gen_t gencnt;
1586 	struct xinpgen xig;
1587 
1588 	/*
1589 	 * The process of preparing the TCB list is too time-consuming and
1590 	 * resource-intensive to repeat twice on every request.
1591 	 */
1592 	if (req->oldptr == NULL) {
1593 		n = V_tcbinfo.ipi_count +
1594 		    TCPSTAT_FETCH(tcps_states[TCPS_SYN_RECEIVED]);
1595 		n += imax(n / 8, 10);
1596 		req->oldidx = 2 * (sizeof xig) + n * sizeof(struct xtcpcb);
1597 		return (0);
1598 	}
1599 
1600 	if (req->newptr != NULL)
1601 		return (EPERM);
1602 
1603 	/*
1604 	 * OK, now we're committed to doing something.
1605 	 */
1606 	INP_LIST_RLOCK(&V_tcbinfo);
1607 	gencnt = V_tcbinfo.ipi_gencnt;
1608 	n = V_tcbinfo.ipi_count;
1609 	INP_LIST_RUNLOCK(&V_tcbinfo);
1610 
1611 	m = TCPSTAT_FETCH(tcps_states[TCPS_SYN_RECEIVED]);
1612 
1613 	error = sysctl_wire_old_buffer(req, 2 * (sizeof xig)
1614 		+ (n + m) * sizeof(struct xtcpcb));
1615 	if (error != 0)
1616 		return (error);
1617 
1618 	xig.xig_len = sizeof xig;
1619 	xig.xig_count = n + m;
1620 	xig.xig_gen = gencnt;
1621 	xig.xig_sogen = so_gencnt;
1622 	error = SYSCTL_OUT(req, &xig, sizeof xig);
1623 	if (error)
1624 		return (error);
1625 
1626 	error = syncache_pcblist(req, m, &pcb_count);
1627 	if (error)
1628 		return (error);
1629 
1630 	inp_list = malloc(n * sizeof *inp_list, M_TEMP, M_WAITOK);
1631 	if (inp_list == NULL)
1632 		return (ENOMEM);
1633 
1634 	INP_INFO_WLOCK(&V_tcbinfo);
1635 	for (inp = LIST_FIRST(V_tcbinfo.ipi_listhead), i = 0;
1636 	    inp != NULL && i < n; inp = LIST_NEXT(inp, inp_list)) {
1637 		INP_WLOCK(inp);
1638 		if (inp->inp_gencnt <= gencnt) {
1639 			/*
1640 			 * XXX: This use of cr_cansee(), introduced with
1641 			 * TCP state changes, is not quite right, but for
1642 			 * now, better than nothing.
1643 			 */
1644 			if (inp->inp_flags & INP_TIMEWAIT) {
1645 				if (intotw(inp) != NULL)
1646 					error = cr_cansee(req->td->td_ucred,
1647 					    intotw(inp)->tw_cred);
1648 				else
1649 					error = EINVAL;	/* Skip this inp. */
1650 			} else
1651 				error = cr_canseeinpcb(req->td->td_ucred, inp);
1652 			if (error == 0) {
1653 				in_pcbref(inp);
1654 				inp_list[i++] = inp;
1655 			}
1656 		}
1657 		INP_WUNLOCK(inp);
1658 	}
1659 	INP_INFO_WUNLOCK(&V_tcbinfo);
1660 	n = i;
1661 
1662 	error = 0;
1663 	for (i = 0; i < n; i++) {
1664 		inp = inp_list[i];
1665 		INP_RLOCK(inp);
1666 		if (inp->inp_gencnt <= gencnt) {
1667 			struct xtcpcb xt;
1668 			void *inp_ppcb;
1669 
1670 			bzero(&xt, sizeof(xt));
1671 			xt.xt_len = sizeof xt;
1672 			/* XXX should avoid extra copy */
1673 			bcopy(inp, &xt.xt_inp, sizeof *inp);
1674 			inp_ppcb = inp->inp_ppcb;
1675 			if (inp_ppcb == NULL)
1676 				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
1677 			else if (inp->inp_flags & INP_TIMEWAIT) {
1678 				bzero((char *) &xt.xt_tp, sizeof xt.xt_tp);
1679 				xt.xt_tp.t_state = TCPS_TIME_WAIT;
1680 			} else {
1681 				bcopy(inp_ppcb, &xt.xt_tp, sizeof xt.xt_tp);
1682 				if (xt.xt_tp.t_timers)
1683 					tcp_timer_to_xtimer(&xt.xt_tp, xt.xt_tp.t_timers, &xt.xt_timer);
1684 			}
1685 			if (inp->inp_socket != NULL)
1686 				sotoxsocket(inp->inp_socket, &xt.xt_socket);
1687 			else {
1688 				bzero(&xt.xt_socket, sizeof xt.xt_socket);
1689 				xt.xt_socket.xso_protocol = IPPROTO_TCP;
1690 			}
1691 			xt.xt_inp.inp_gencnt = inp->inp_gencnt;
1692 			INP_RUNLOCK(inp);
1693 			error = SYSCTL_OUT(req, &xt, sizeof xt);
1694 		} else
1695 			INP_RUNLOCK(inp);
1696 	}
1697 	INP_INFO_RLOCK(&V_tcbinfo);
1698 	for (i = 0; i < n; i++) {
1699 		inp = inp_list[i];
1700 		INP_RLOCK(inp);
1701 		if (!in_pcbrele_rlocked(inp))
1702 			INP_RUNLOCK(inp);
1703 	}
1704 	INP_INFO_RUNLOCK(&V_tcbinfo);
1705 
1706 	if (!error) {
1707 		/*
1708 		 * Give the user an updated idea of our state.
1709 		 * If the generation differs from what we told
1710 		 * her before, she knows that something happened
1711 		 * while we were processing this request, and it
1712 		 * might be necessary to retry.
1713 		 */
1714 		INP_LIST_RLOCK(&V_tcbinfo);
1715 		xig.xig_gen = V_tcbinfo.ipi_gencnt;
1716 		xig.xig_sogen = so_gencnt;
1717 		xig.xig_count = V_tcbinfo.ipi_count + pcb_count;
1718 		INP_LIST_RUNLOCK(&V_tcbinfo);
1719 		error = SYSCTL_OUT(req, &xig, sizeof xig);
1720 	}
1721 	free(inp_list, M_TEMP);
1722 	return (error);
1723 }
1724 
1725 SYSCTL_PROC(_net_inet_tcp, TCPCTL_PCBLIST, pcblist,
1726     CTLTYPE_OPAQUE | CTLFLAG_RD, NULL, 0,
1727     tcp_pcblist, "S,xtcpcb", "List of active TCP connections");
1728 
1729 #ifdef INET
1730 static int
1731 tcp_getcred(SYSCTL_HANDLER_ARGS)
1732 {
1733 	struct xucred xuc;
1734 	struct sockaddr_in addrs[2];
1735 	struct inpcb *inp;
1736 	int error;
1737 
1738 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
1739 	if (error)
1740 		return (error);
1741 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
1742 	if (error)
1743 		return (error);
1744 	inp = in_pcblookup(&V_tcbinfo, addrs[1].sin_addr, addrs[1].sin_port,
1745 	    addrs[0].sin_addr, addrs[0].sin_port, INPLOOKUP_RLOCKPCB, NULL);
1746 	if (inp != NULL) {
1747 		if (inp->inp_socket == NULL)
1748 			error = ENOENT;
1749 		if (error == 0)
1750 			error = cr_canseeinpcb(req->td->td_ucred, inp);
1751 		if (error == 0)
1752 			cru2x(inp->inp_cred, &xuc);
1753 		INP_RUNLOCK(inp);
1754 	} else
1755 		error = ENOENT;
1756 	if (error == 0)
1757 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
1758 	return (error);
1759 }
1760 
1761 SYSCTL_PROC(_net_inet_tcp, OID_AUTO, getcred,
1762     CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
1763     tcp_getcred, "S,xucred", "Get the xucred of a TCP connection");
1764 #endif /* INET */
1765 
1766 #ifdef INET6
1767 static int
1768 tcp6_getcred(SYSCTL_HANDLER_ARGS)
1769 {
1770 	struct xucred xuc;
1771 	struct sockaddr_in6 addrs[2];
1772 	struct inpcb *inp;
1773 	int error;
1774 #ifdef INET
1775 	int mapped = 0;
1776 #endif
1777 
1778 	error = priv_check(req->td, PRIV_NETINET_GETCRED);
1779 	if (error)
1780 		return (error);
1781 	error = SYSCTL_IN(req, addrs, sizeof(addrs));
1782 	if (error)
1783 		return (error);
1784 	if ((error = sa6_embedscope(&addrs[0], V_ip6_use_defzone)) != 0 ||
1785 	    (error = sa6_embedscope(&addrs[1], V_ip6_use_defzone)) != 0) {
1786 		return (error);
1787 	}
1788 	if (IN6_IS_ADDR_V4MAPPED(&addrs[0].sin6_addr)) {
1789 #ifdef INET
1790 		if (IN6_IS_ADDR_V4MAPPED(&addrs[1].sin6_addr))
1791 			mapped = 1;
1792 		else
1793 #endif
1794 			return (EINVAL);
1795 	}
1796 
1797 #ifdef INET
1798 	if (mapped == 1)
1799 		inp = in_pcblookup(&V_tcbinfo,
1800 			*(struct in_addr *)&addrs[1].sin6_addr.s6_addr[12],
1801 			addrs[1].sin6_port,
1802 			*(struct in_addr *)&addrs[0].sin6_addr.s6_addr[12],
1803 			addrs[0].sin6_port, INPLOOKUP_RLOCKPCB, NULL);
1804 	else
1805 #endif
1806 		inp = in6_pcblookup(&V_tcbinfo,
1807 			&addrs[1].sin6_addr, addrs[1].sin6_port,
1808 			&addrs[0].sin6_addr, addrs[0].sin6_port,
1809 			INPLOOKUP_RLOCKPCB, NULL);
1810 	if (inp != NULL) {
1811 		if (inp->inp_socket == NULL)
1812 			error = ENOENT;
1813 		if (error == 0)
1814 			error = cr_canseeinpcb(req->td->td_ucred, inp);
1815 		if (error == 0)
1816 			cru2x(inp->inp_cred, &xuc);
1817 		INP_RUNLOCK(inp);
1818 	} else
1819 		error = ENOENT;
1820 	if (error == 0)
1821 		error = SYSCTL_OUT(req, &xuc, sizeof(struct xucred));
1822 	return (error);
1823 }
1824 
1825 SYSCTL_PROC(_net_inet6_tcp6, OID_AUTO, getcred,
1826     CTLTYPE_OPAQUE|CTLFLAG_RW|CTLFLAG_PRISON, 0, 0,
1827     tcp6_getcred, "S,xucred", "Get the xucred of a TCP6 connection");
1828 #endif /* INET6 */
1829 
1830 
1831 #ifdef INET
1832 void
1833 tcp_ctlinput(int cmd, struct sockaddr *sa, void *vip)
1834 {
1835 	struct ip *ip = vip;
1836 	struct tcphdr *th;
1837 	struct in_addr faddr;
1838 	struct inpcb *inp;
1839 	struct tcpcb *tp;
1840 	struct inpcb *(*notify)(struct inpcb *, int) = tcp_notify;
1841 	struct icmp *icp;
1842 	struct in_conninfo inc;
1843 	tcp_seq icmp_tcp_seq;
1844 	int mtu;
1845 
1846 	faddr = ((struct sockaddr_in *)sa)->sin_addr;
1847 	if (sa->sa_family != AF_INET || faddr.s_addr == INADDR_ANY)
1848 		return;
1849 
1850 	if (cmd == PRC_MSGSIZE)
1851 		notify = tcp_mtudisc_notify;
1852 	else if (V_icmp_may_rst && (cmd == PRC_UNREACH_ADMIN_PROHIB ||
1853 		cmd == PRC_UNREACH_PORT || cmd == PRC_TIMXCEED_INTRANS) && ip)
1854 		notify = tcp_drop_syn_sent;
1855 	/*
1856 	 * Redirects don't need to be handled up here.
1857 	 */
1858 	else if (PRC_IS_REDIRECT(cmd))
1859 		return;
1860 	/*
1861 	 * Hostdead is ugly because it goes linearly through all PCBs.
1862 	 * XXX: We never get this from ICMP, otherwise it makes an
1863 	 * excellent DoS attack on machines with many connections.
1864 	 */
1865 	else if (cmd == PRC_HOSTDEAD)
1866 		ip = NULL;
1867 	else if ((unsigned)cmd >= PRC_NCMDS || inetctlerrmap[cmd] == 0)
1868 		return;
1869 
1870 	if (ip == NULL) {
1871 		in_pcbnotifyall(&V_tcbinfo, faddr, inetctlerrmap[cmd], notify);
1872 		return;
1873 	}
1874 
1875 	icp = (struct icmp *)((caddr_t)ip - offsetof(struct icmp, icmp_ip));
1876 	th = (struct tcphdr *)((caddr_t)ip + (ip->ip_hl << 2));
1877 	INP_INFO_RLOCK(&V_tcbinfo);
1878 	inp = in_pcblookup(&V_tcbinfo, faddr, th->th_dport, ip->ip_src,
1879 	    th->th_sport, INPLOOKUP_WLOCKPCB, NULL);
1880 	if (inp != NULL)  {
1881 		if (!(inp->inp_flags & INP_TIMEWAIT) &&
1882 		    !(inp->inp_flags & INP_DROPPED) &&
1883 		    !(inp->inp_socket == NULL)) {
1884 			icmp_tcp_seq = ntohl(th->th_seq);
1885 			tp = intotcpcb(inp);
1886 			if (SEQ_GEQ(icmp_tcp_seq, tp->snd_una) &&
1887 			    SEQ_LT(icmp_tcp_seq, tp->snd_max)) {
1888 				if (cmd == PRC_MSGSIZE) {
1889 					/*
1890 					 * MTU discovery:
1891 					 * If we got a needfrag set the MTU
1892 					 * in the route to the suggested new
1893 					 * value (if given) and then notify.
1894 					 */
1895 				    	mtu = ntohs(icp->icmp_nextmtu);
1896 					/*
1897 					 * If no alternative MTU was
1898 					 * proposed, try the next smaller
1899 					 * one.
1900 					 */
1901 					if (!mtu)
1902 						mtu = ip_next_mtu(
1903 						    ntohs(ip->ip_len), 1);
1904 					if (mtu < V_tcp_minmss +
1905 					    sizeof(struct tcpiphdr))
1906 						mtu = V_tcp_minmss +
1907 						    sizeof(struct tcpiphdr);
1908 					/*
1909 					 * Only process the offered MTU if it
1910 					 * is smaller than the current one.
1911 					 */
1912 					if (mtu < tp->t_maxseg +
1913 					    sizeof(struct tcpiphdr)) {
1914 						bzero(&inc, sizeof(inc));
1915 						inc.inc_faddr = faddr;
1916 						inc.inc_fibnum =
1917 						    inp->inp_inc.inc_fibnum;
1918 						tcp_hc_updatemtu(&inc, mtu);
1919 						tcp_mtudisc(inp, mtu);
1920 					}
1921 				} else
1922 					inp = (*notify)(inp,
1923 					    inetctlerrmap[cmd]);
1924 			}
1925 		}
1926 		if (inp != NULL)
1927 			INP_WUNLOCK(inp);
1928 	} else {
1929 		bzero(&inc, sizeof(inc));
1930 		inc.inc_fport = th->th_dport;
1931 		inc.inc_lport = th->th_sport;
1932 		inc.inc_faddr = faddr;
1933 		inc.inc_laddr = ip->ip_src;
1934 		syncache_unreach(&inc, th);
1935 	}
1936 	INP_INFO_RUNLOCK(&V_tcbinfo);
1937 }
1938 #endif /* INET */
1939 
1940 #ifdef INET6
1941 void
1942 tcp6_ctlinput(int cmd, struct sockaddr *sa, void *d)
1943 {
1944 	struct tcphdr th;
1945 	struct inpcb *(*notify)(struct inpcb *, int) = tcp_notify;
1946 	struct ip6_hdr *ip6;
1947 	struct mbuf *m;
1948 	struct ip6ctlparam *ip6cp = NULL;
1949 	const struct sockaddr_in6 *sa6_src = NULL;
1950 	int off;
1951 	struct tcp_portonly {
1952 		u_int16_t th_sport;
1953 		u_int16_t th_dport;
1954 	} *thp;
1955 
1956 	if (sa->sa_family != AF_INET6 ||
1957 	    sa->sa_len != sizeof(struct sockaddr_in6))
1958 		return;
1959 
1960 	if (cmd == PRC_MSGSIZE)
1961 		notify = tcp_mtudisc_notify;
1962 	else if (!PRC_IS_REDIRECT(cmd) &&
1963 		 ((unsigned)cmd >= PRC_NCMDS || inet6ctlerrmap[cmd] == 0))
1964 		return;
1965 
1966 	/* if the parameter is from icmp6, decode it. */
1967 	if (d != NULL) {
1968 		ip6cp = (struct ip6ctlparam *)d;
1969 		m = ip6cp->ip6c_m;
1970 		ip6 = ip6cp->ip6c_ip6;
1971 		off = ip6cp->ip6c_off;
1972 		sa6_src = ip6cp->ip6c_src;
1973 	} else {
1974 		m = NULL;
1975 		ip6 = NULL;
1976 		off = 0;	/* fool gcc */
1977 		sa6_src = &sa6_any;
1978 	}
1979 
1980 	if (ip6 != NULL) {
1981 		struct in_conninfo inc;
1982 		/*
1983 		 * XXX: We assume that when IPV6 is non NULL,
1984 		 * M and OFF are valid.
1985 		 */
1986 
1987 		/* check if we can safely examine src and dst ports */
1988 		if (m->m_pkthdr.len < off + sizeof(*thp))
1989 			return;
1990 
1991 		bzero(&th, sizeof(th));
1992 		m_copydata(m, off, sizeof(*thp), (caddr_t)&th);
1993 
1994 		in6_pcbnotify(&V_tcbinfo, sa, th.th_dport,
1995 		    (struct sockaddr *)ip6cp->ip6c_src,
1996 		    th.th_sport, cmd, NULL, notify);
1997 
1998 		bzero(&inc, sizeof(inc));
1999 		inc.inc_fport = th.th_dport;
2000 		inc.inc_lport = th.th_sport;
2001 		inc.inc6_faddr = ((struct sockaddr_in6 *)sa)->sin6_addr;
2002 		inc.inc6_laddr = ip6cp->ip6c_src->sin6_addr;
2003 		inc.inc_flags |= INC_ISIPV6;
2004 		INP_INFO_RLOCK(&V_tcbinfo);
2005 		syncache_unreach(&inc, &th);
2006 		INP_INFO_RUNLOCK(&V_tcbinfo);
2007 	} else
2008 		in6_pcbnotify(&V_tcbinfo, sa, 0, (const struct sockaddr *)sa6_src,
2009 			      0, cmd, NULL, notify);
2010 }
2011 #endif /* INET6 */
2012 
2013 
2014 /*
2015  * Following is where TCP initial sequence number generation occurs.
2016  *
2017  * There are two places where we must use initial sequence numbers:
2018  * 1.  In SYN-ACK packets.
2019  * 2.  In SYN packets.
2020  *
2021  * All ISNs for SYN-ACK packets are generated by the syncache.  See
2022  * tcp_syncache.c for details.
2023  *
2024  * The ISNs in SYN packets must be monotonic; TIME_WAIT recycling
2025  * depends on this property.  In addition, these ISNs should be
2026  * unguessable so as to prevent connection hijacking.  To satisfy
2027  * the requirements of this situation, the algorithm outlined in
2028  * RFC 1948 is used, with only small modifications.
2029  *
2030  * Implementation details:
2031  *
2032  * Time is based off the system timer, and is corrected so that it
2033  * increases by one megabyte per second.  This allows for proper
2034  * recycling on high speed LANs while still leaving over an hour
2035  * before rollover.
2036  *
2037  * As reading the *exact* system time is too expensive to be done
2038  * whenever setting up a TCP connection, we increment the time
2039  * offset in two ways.  First, a small random positive increment
2040  * is added to isn_offset for each connection that is set up.
2041  * Second, the function tcp_isn_tick fires once per clock tick
2042  * and increments isn_offset as necessary so that sequence numbers
2043  * are incremented at approximately ISN_BYTES_PER_SECOND.  The
2044  * random positive increments serve only to ensure that the same
2045  * exact sequence number is never sent out twice (as could otherwise
2046  * happen when a port is recycled in less than the system tick
2047  * interval.)
2048  *
2049  * net.inet.tcp.isn_reseed_interval controls the number of seconds
2050  * between seeding of isn_secret.  This is normally set to zero,
2051  * as reseeding should not be necessary.
2052  *
2053  * Locking of the global variables isn_secret, isn_last_reseed, isn_offset,
2054  * isn_offset_old, and isn_ctx is performed using the TCP pcbinfo lock.  In
2055  * general, this means holding an exclusive (write) lock.
2056  */
2057 
2058 #define ISN_BYTES_PER_SECOND 1048576
2059 #define ISN_STATIC_INCREMENT 4096
2060 #define ISN_RANDOM_INCREMENT (4096 - 1)
2061 
2062 static VNET_DEFINE(u_char, isn_secret[32]);
2063 static VNET_DEFINE(int, isn_last);
2064 static VNET_DEFINE(int, isn_last_reseed);
2065 static VNET_DEFINE(u_int32_t, isn_offset);
2066 static VNET_DEFINE(u_int32_t, isn_offset_old);
2067 
2068 #define	V_isn_secret			VNET(isn_secret)
2069 #define	V_isn_last			VNET(isn_last)
2070 #define	V_isn_last_reseed		VNET(isn_last_reseed)
2071 #define	V_isn_offset			VNET(isn_offset)
2072 #define	V_isn_offset_old		VNET(isn_offset_old)
2073 
2074 tcp_seq
2075 tcp_new_isn(struct tcpcb *tp)
2076 {
2077 	MD5_CTX isn_ctx;
2078 	u_int32_t md5_buffer[4];
2079 	tcp_seq new_isn;
2080 	u_int32_t projected_offset;
2081 
2082 	INP_WLOCK_ASSERT(tp->t_inpcb);
2083 
2084 	ISN_LOCK();
2085 	/* Seed if this is the first use, reseed if requested. */
2086 	if ((V_isn_last_reseed == 0) || ((V_tcp_isn_reseed_interval > 0) &&
2087 	     (((u_int)V_isn_last_reseed + (u_int)V_tcp_isn_reseed_interval*hz)
2088 		< (u_int)ticks))) {
2089 		read_random(&V_isn_secret, sizeof(V_isn_secret));
2090 		V_isn_last_reseed = ticks;
2091 	}
2092 
2093 	/* Compute the md5 hash and return the ISN. */
2094 	MD5Init(&isn_ctx);
2095 	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_fport, sizeof(u_short));
2096 	MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_lport, sizeof(u_short));
2097 #ifdef INET6
2098 	if ((tp->t_inpcb->inp_vflag & INP_IPV6) != 0) {
2099 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_faddr,
2100 			  sizeof(struct in6_addr));
2101 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->in6p_laddr,
2102 			  sizeof(struct in6_addr));
2103 	} else
2104 #endif
2105 	{
2106 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_faddr,
2107 			  sizeof(struct in_addr));
2108 		MD5Update(&isn_ctx, (u_char *) &tp->t_inpcb->inp_laddr,
2109 			  sizeof(struct in_addr));
2110 	}
2111 	MD5Update(&isn_ctx, (u_char *) &V_isn_secret, sizeof(V_isn_secret));
2112 	MD5Final((u_char *) &md5_buffer, &isn_ctx);
2113 	new_isn = (tcp_seq) md5_buffer[0];
2114 	V_isn_offset += ISN_STATIC_INCREMENT +
2115 		(arc4random() & ISN_RANDOM_INCREMENT);
2116 	if (ticks != V_isn_last) {
2117 		projected_offset = V_isn_offset_old +
2118 		    ISN_BYTES_PER_SECOND / hz * (ticks - V_isn_last);
2119 		if (SEQ_GT(projected_offset, V_isn_offset))
2120 			V_isn_offset = projected_offset;
2121 		V_isn_offset_old = V_isn_offset;
2122 		V_isn_last = ticks;
2123 	}
2124 	new_isn += V_isn_offset;
2125 	ISN_UNLOCK();
2126 	return (new_isn);
2127 }
2128 
2129 /*
2130  * When a specific ICMP unreachable message is received and the
2131  * connection state is SYN-SENT, drop the connection.  This behavior
2132  * is controlled by the icmp_may_rst sysctl.
2133  */
2134 struct inpcb *
2135 tcp_drop_syn_sent(struct inpcb *inp, int errno)
2136 {
2137 	struct tcpcb *tp;
2138 
2139 	INP_INFO_RLOCK_ASSERT(&V_tcbinfo);
2140 	INP_WLOCK_ASSERT(inp);
2141 
2142 	if ((inp->inp_flags & INP_TIMEWAIT) ||
2143 	    (inp->inp_flags & INP_DROPPED))
2144 		return (inp);
2145 
2146 	tp = intotcpcb(inp);
2147 	if (tp->t_state != TCPS_SYN_SENT)
2148 		return (inp);
2149 
2150 	tp = tcp_drop(tp, errno);
2151 	if (tp != NULL)
2152 		return (inp);
2153 	else
2154 		return (NULL);
2155 }
2156 
2157 /*
2158  * When `need fragmentation' ICMP is received, update our idea of the MSS
2159  * based on the new value. Also nudge TCP to send something, since we
2160  * know the packet we just sent was dropped.
2161  * This duplicates some code in the tcp_mss() function in tcp_input.c.
2162  */
2163 static struct inpcb *
2164 tcp_mtudisc_notify(struct inpcb *inp, int error)
2165 {
2166 
2167 	tcp_mtudisc(inp, -1);
2168 	return (inp);
2169 }
2170 
2171 static void
2172 tcp_mtudisc(struct inpcb *inp, int mtuoffer)
2173 {
2174 	struct tcpcb *tp;
2175 	struct socket *so;
2176 
2177 	INP_WLOCK_ASSERT(inp);
2178 	if ((inp->inp_flags & INP_TIMEWAIT) ||
2179 	    (inp->inp_flags & INP_DROPPED))
2180 		return;
2181 
2182 	tp = intotcpcb(inp);
2183 	KASSERT(tp != NULL, ("tcp_mtudisc: tp == NULL"));
2184 
2185 	tcp_mss_update(tp, -1, mtuoffer, NULL, NULL);
2186 
2187 	so = inp->inp_socket;
2188 	SOCKBUF_LOCK(&so->so_snd);
2189 	/* If the mss is larger than the socket buffer, decrease the mss. */
2190 	if (so->so_snd.sb_hiwat < tp->t_maxseg)
2191 		tp->t_maxseg = so->so_snd.sb_hiwat;
2192 	SOCKBUF_UNLOCK(&so->so_snd);
2193 
2194 	TCPSTAT_INC(tcps_mturesent);
2195 	tp->t_rtttime = 0;
2196 	tp->snd_nxt = tp->snd_una;
2197 	tcp_free_sackholes(tp);
2198 	tp->snd_recover = tp->snd_max;
2199 	if (tp->t_flags & TF_SACK_PERMIT)
2200 		EXIT_FASTRECOVERY(tp->t_flags);
2201 	tp->t_fb->tfb_tcp_output(tp);
2202 }
2203 
2204 #ifdef INET
2205 /*
2206  * Look-up the routing entry to the peer of this inpcb.  If no route
2207  * is found and it cannot be allocated, then return 0.  This routine
2208  * is called by TCP routines that access the rmx structure and by
2209  * tcp_mss_update to get the peer/interface MTU.
2210  */
2211 u_long
2212 tcp_maxmtu(struct in_conninfo *inc, struct tcp_ifcap *cap)
2213 {
2214 	struct nhop4_extended nh4;
2215 	struct ifnet *ifp;
2216 	u_long maxmtu = 0;
2217 
2218 	KASSERT(inc != NULL, ("tcp_maxmtu with NULL in_conninfo pointer"));
2219 
2220 	if (inc->inc_faddr.s_addr != INADDR_ANY) {
2221 
2222 		if (fib4_lookup_nh_ext(inc->inc_fibnum, inc->inc_faddr,
2223 		    NHR_REF, 0, &nh4) != 0)
2224 			return (0);
2225 
2226 		ifp = nh4.nh_ifp;
2227 		maxmtu = nh4.nh_mtu;
2228 
2229 		/* Report additional interface capabilities. */
2230 		if (cap != NULL) {
2231 			if (ifp->if_capenable & IFCAP_TSO4 &&
2232 			    ifp->if_hwassist & CSUM_TSO) {
2233 				cap->ifcap |= CSUM_TSO;
2234 				cap->tsomax = ifp->if_hw_tsomax;
2235 				cap->tsomaxsegcount = ifp->if_hw_tsomaxsegcount;
2236 				cap->tsomaxsegsize = ifp->if_hw_tsomaxsegsize;
2237 			}
2238 		}
2239 		fib4_free_nh_ext(inc->inc_fibnum, &nh4);
2240 	}
2241 	return (maxmtu);
2242 }
2243 #endif /* INET */
2244 
2245 #ifdef INET6
2246 u_long
2247 tcp_maxmtu6(struct in_conninfo *inc, struct tcp_ifcap *cap)
2248 {
2249 	struct nhop6_extended nh6;
2250 	struct in6_addr dst6;
2251 	uint32_t scopeid;
2252 	struct ifnet *ifp;
2253 	u_long maxmtu = 0;
2254 
2255 	KASSERT(inc != NULL, ("tcp_maxmtu6 with NULL in_conninfo pointer"));
2256 
2257 	if (!IN6_IS_ADDR_UNSPECIFIED(&inc->inc6_faddr)) {
2258 		in6_splitscope(&inc->inc6_faddr, &dst6, &scopeid);
2259 		if (fib6_lookup_nh_ext(inc->inc_fibnum, &dst6, scopeid, 0,
2260 		    0, &nh6) != 0)
2261 			return (0);
2262 
2263 		ifp = nh6.nh_ifp;
2264 		maxmtu = nh6.nh_mtu;
2265 
2266 		/* Report additional interface capabilities. */
2267 		if (cap != NULL) {
2268 			if (ifp->if_capenable & IFCAP_TSO6 &&
2269 			    ifp->if_hwassist & CSUM_TSO) {
2270 				cap->ifcap |= CSUM_TSO;
2271 				cap->tsomax = ifp->if_hw_tsomax;
2272 				cap->tsomaxsegcount = ifp->if_hw_tsomaxsegcount;
2273 				cap->tsomaxsegsize = ifp->if_hw_tsomaxsegsize;
2274 			}
2275 		}
2276 		fib6_free_nh_ext(inc->inc_fibnum, &nh6);
2277 	}
2278 
2279 	return (maxmtu);
2280 }
2281 #endif /* INET6 */
2282 
2283 /*
2284  * Calculate effective SMSS per RFC5681 definition for a given TCP
2285  * connection at its current state, taking into account SACK and etc.
2286  */
2287 u_int
2288 tcp_maxseg(const struct tcpcb *tp)
2289 {
2290 	u_int optlen;
2291 
2292 	if (tp->t_flags & TF_NOOPT)
2293 		return (tp->t_maxseg);
2294 
2295 	/*
2296 	 * Here we have a simplified code from tcp_addoptions(),
2297 	 * without a proper loop, and having most of paddings hardcoded.
2298 	 * We might make mistakes with padding here in some edge cases,
2299 	 * but this is harmless, since result of tcp_maxseg() is used
2300 	 * only in cwnd and ssthresh estimations.
2301 	 */
2302 #define	PAD(len)	((((len) / 4) + !!((len) % 4)) * 4)
2303 	if (TCPS_HAVEESTABLISHED(tp->t_state)) {
2304 		if (tp->t_flags & TF_RCVD_TSTMP)
2305 			optlen = TCPOLEN_TSTAMP_APPA;
2306 		else
2307 			optlen = 0;
2308 #ifdef TCP_SIGNATURE
2309 		if (tp->t_flags & TF_SIGNATURE)
2310 			optlen += PAD(TCPOLEN_SIGNATURE);
2311 #endif
2312 		if ((tp->t_flags & TF_SACK_PERMIT) && tp->rcv_numsacks > 0) {
2313 			optlen += TCPOLEN_SACKHDR;
2314 			optlen += tp->rcv_numsacks * TCPOLEN_SACK;
2315 			optlen = PAD(optlen);
2316 		}
2317 	} else {
2318 		if (tp->t_flags & TF_REQ_TSTMP)
2319 			optlen = TCPOLEN_TSTAMP_APPA;
2320 		else
2321 			optlen = PAD(TCPOLEN_MAXSEG);
2322 		if (tp->t_flags & TF_REQ_SCALE)
2323 			optlen += PAD(TCPOLEN_WINDOW);
2324 #ifdef TCP_SIGNATURE
2325 		if (tp->t_flags & TF_SIGNATURE)
2326 			optlen += PAD(TCPOLEN_SIGNATURE);
2327 #endif
2328 		if (tp->t_flags & TF_SACK_PERMIT)
2329 			optlen += PAD(TCPOLEN_SACK_PERMITTED);
2330 	}
2331 #undef PAD
2332 	optlen = min(optlen, TCP_MAXOLEN);
2333 	return (tp->t_maxseg - optlen);
2334 }
2335 
2336 #ifdef IPSEC
2337 /* compute ESP/AH header size for TCP, including outer IP header. */
2338 size_t
2339 ipsec_hdrsiz_tcp(struct tcpcb *tp)
2340 {
2341 	struct inpcb *inp;
2342 	struct mbuf *m;
2343 	size_t hdrsiz;
2344 	struct ip *ip;
2345 #ifdef INET6
2346 	struct ip6_hdr *ip6;
2347 #endif
2348 	struct tcphdr *th;
2349 
2350 	if ((tp == NULL) || ((inp = tp->t_inpcb) == NULL) ||
2351 		(!key_havesp(IPSEC_DIR_OUTBOUND)))
2352 		return (0);
2353 	m = m_gethdr(M_NOWAIT, MT_DATA);
2354 	if (!m)
2355 		return (0);
2356 
2357 #ifdef INET6
2358 	if ((inp->inp_vflag & INP_IPV6) != 0) {
2359 		ip6 = mtod(m, struct ip6_hdr *);
2360 		th = (struct tcphdr *)(ip6 + 1);
2361 		m->m_pkthdr.len = m->m_len =
2362 			sizeof(struct ip6_hdr) + sizeof(struct tcphdr);
2363 		tcpip_fillheaders(inp, ip6, th);
2364 		hdrsiz = ipsec_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
2365 	} else
2366 #endif /* INET6 */
2367 	{
2368 		ip = mtod(m, struct ip *);
2369 		th = (struct tcphdr *)(ip + 1);
2370 		m->m_pkthdr.len = m->m_len = sizeof(struct tcpiphdr);
2371 		tcpip_fillheaders(inp, ip, th);
2372 		hdrsiz = ipsec_hdrsiz(m, IPSEC_DIR_OUTBOUND, inp);
2373 	}
2374 
2375 	m_free(m);
2376 	return (hdrsiz);
2377 }
2378 #endif /* IPSEC */
2379 
2380 #ifdef TCP_SIGNATURE
2381 /*
2382  * Callback function invoked by m_apply() to digest TCP segment data
2383  * contained within an mbuf chain.
2384  */
2385 static int
2386 tcp_signature_apply(void *fstate, void *data, u_int len)
2387 {
2388 
2389 	MD5Update(fstate, (u_char *)data, len);
2390 	return (0);
2391 }
2392 
2393 /*
2394  * XXX The key is retrieved from the system's PF_KEY SADB, by keying a
2395  * search with the destination IP address, and a 'magic SPI' to be
2396  * determined by the application. This is hardcoded elsewhere to 1179
2397 */
2398 struct secasvar *
2399 tcp_get_sav(struct mbuf *m, u_int direction)
2400 {
2401 	union sockaddr_union dst;
2402 	struct secasvar *sav;
2403 	struct ip *ip;
2404 #ifdef INET6
2405 	struct ip6_hdr *ip6;
2406 	char ip6buf[INET6_ADDRSTRLEN];
2407 #endif
2408 
2409 	/* Extract the destination from the IP header in the mbuf. */
2410 	bzero(&dst, sizeof(union sockaddr_union));
2411 	ip = mtod(m, struct ip *);
2412 #ifdef INET6
2413 	ip6 = NULL;	/* Make the compiler happy. */
2414 #endif
2415 	switch (ip->ip_v) {
2416 #ifdef INET
2417 	case IPVERSION:
2418 		dst.sa.sa_len = sizeof(struct sockaddr_in);
2419 		dst.sa.sa_family = AF_INET;
2420 		dst.sin.sin_addr = (direction == IPSEC_DIR_INBOUND) ?
2421 		    ip->ip_src : ip->ip_dst;
2422 		break;
2423 #endif
2424 #ifdef INET6
2425 	case (IPV6_VERSION >> 4):
2426 		ip6 = mtod(m, struct ip6_hdr *);
2427 		dst.sa.sa_len = sizeof(struct sockaddr_in6);
2428 		dst.sa.sa_family = AF_INET6;
2429 		dst.sin6.sin6_addr = (direction == IPSEC_DIR_INBOUND) ?
2430 		    ip6->ip6_src : ip6->ip6_dst;
2431 		break;
2432 #endif
2433 	default:
2434 		return (NULL);
2435 		/* NOTREACHED */
2436 		break;
2437 	}
2438 
2439 	/* Look up an SADB entry which matches the address of the peer. */
2440 	sav = KEY_ALLOCSA(&dst, IPPROTO_TCP, htonl(TCP_SIG_SPI));
2441 	if (sav == NULL) {
2442 		ipseclog((LOG_ERR, "%s: SADB lookup failed for %s\n", __func__,
2443 		    (ip->ip_v == IPVERSION) ? inet_ntoa(dst.sin.sin_addr) :
2444 #ifdef INET6
2445 			(ip->ip_v == (IPV6_VERSION >> 4)) ?
2446 			    ip6_sprintf(ip6buf, &dst.sin6.sin6_addr) :
2447 #endif
2448 			"(unsupported)"));
2449 	}
2450 
2451 	return (sav);
2452 }
2453 
2454 /*
2455  * Compute TCP-MD5 hash of a TCP segment. (RFC2385)
2456  *
2457  * Parameters:
2458  * m		pointer to head of mbuf chain
2459  * len		length of TCP segment data, excluding options
2460  * optlen	length of TCP segment options
2461  * buf		pointer to storage for computed MD5 digest
2462  * sav		pointer to security assosiation
2463  *
2464  * We do this over ip, tcphdr, segment data, and the key in the SADB.
2465  * When called from tcp_input(), we can be sure that th_sum has been
2466  * zeroed out and verified already.
2467  *
2468  * Releases reference to SADB key before return.
2469  *
2470  * Return 0 if successful, otherwise return -1.
2471  *
2472  */
2473 int
2474 tcp_signature_do_compute(struct mbuf *m, int len, int optlen,
2475     u_char *buf, struct secasvar *sav)
2476 {
2477 #ifdef INET
2478 	struct ippseudo ippseudo;
2479 #endif
2480 	MD5_CTX ctx;
2481 	int doff;
2482 	struct ip *ip;
2483 #ifdef INET
2484 	struct ipovly *ipovly;
2485 #endif
2486 	struct tcphdr *th;
2487 #ifdef INET6
2488 	struct ip6_hdr *ip6;
2489 	struct in6_addr in6;
2490 	uint32_t plen;
2491 	uint16_t nhdr;
2492 #endif
2493 	u_short savecsum;
2494 
2495 	KASSERT(m != NULL, ("NULL mbuf chain"));
2496 	KASSERT(buf != NULL, ("NULL signature pointer"));
2497 
2498 	/* Extract the destination from the IP header in the mbuf. */
2499 	ip = mtod(m, struct ip *);
2500 #ifdef INET6
2501 	ip6 = NULL;	/* Make the compiler happy. */
2502 #endif
2503 
2504 	MD5Init(&ctx);
2505 	/*
2506 	 * Step 1: Update MD5 hash with IP(v6) pseudo-header.
2507 	 *
2508 	 * XXX The ippseudo header MUST be digested in network byte order,
2509 	 * or else we'll fail the regression test. Assume all fields we've
2510 	 * been doing arithmetic on have been in host byte order.
2511 	 * XXX One cannot depend on ipovly->ih_len here. When called from
2512 	 * tcp_output(), the underlying ip_len member has not yet been set.
2513 	 */
2514 	switch (ip->ip_v) {
2515 #ifdef INET
2516 	case IPVERSION:
2517 		ipovly = (struct ipovly *)ip;
2518 		ippseudo.ippseudo_src = ipovly->ih_src;
2519 		ippseudo.ippseudo_dst = ipovly->ih_dst;
2520 		ippseudo.ippseudo_pad = 0;
2521 		ippseudo.ippseudo_p = IPPROTO_TCP;
2522 		ippseudo.ippseudo_len = htons(len + sizeof(struct tcphdr) +
2523 		    optlen);
2524 		MD5Update(&ctx, (char *)&ippseudo, sizeof(struct ippseudo));
2525 
2526 		th = (struct tcphdr *)((u_char *)ip + sizeof(struct ip));
2527 		doff = sizeof(struct ip) + sizeof(struct tcphdr) + optlen;
2528 		break;
2529 #endif
2530 #ifdef INET6
2531 	/*
2532 	 * RFC 2385, 2.0  Proposal
2533 	 * For IPv6, the pseudo-header is as described in RFC 2460, namely the
2534 	 * 128-bit source IPv6 address, 128-bit destination IPv6 address, zero-
2535 	 * extended next header value (to form 32 bits), and 32-bit segment
2536 	 * length.
2537 	 * Note: Upper-Layer Packet Length comes before Next Header.
2538 	 */
2539 	case (IPV6_VERSION >> 4):
2540 		in6 = ip6->ip6_src;
2541 		in6_clearscope(&in6);
2542 		MD5Update(&ctx, (char *)&in6, sizeof(struct in6_addr));
2543 		in6 = ip6->ip6_dst;
2544 		in6_clearscope(&in6);
2545 		MD5Update(&ctx, (char *)&in6, sizeof(struct in6_addr));
2546 		plen = htonl(len + sizeof(struct tcphdr) + optlen);
2547 		MD5Update(&ctx, (char *)&plen, sizeof(uint32_t));
2548 		nhdr = 0;
2549 		MD5Update(&ctx, (char *)&nhdr, sizeof(uint8_t));
2550 		MD5Update(&ctx, (char *)&nhdr, sizeof(uint8_t));
2551 		MD5Update(&ctx, (char *)&nhdr, sizeof(uint8_t));
2552 		nhdr = IPPROTO_TCP;
2553 		MD5Update(&ctx, (char *)&nhdr, sizeof(uint8_t));
2554 
2555 		th = (struct tcphdr *)((u_char *)ip6 + sizeof(struct ip6_hdr));
2556 		doff = sizeof(struct ip6_hdr) + sizeof(struct tcphdr) + optlen;
2557 		break;
2558 #endif
2559 	default:
2560 		KEY_FREESAV(&sav);
2561 		return (-1);
2562 		/* NOTREACHED */
2563 		break;
2564 	}
2565 
2566 
2567 	/*
2568 	 * Step 2: Update MD5 hash with TCP header, excluding options.
2569 	 * The TCP checksum must be set to zero.
2570 	 */
2571 	savecsum = th->th_sum;
2572 	th->th_sum = 0;
2573 	MD5Update(&ctx, (char *)th, sizeof(struct tcphdr));
2574 	th->th_sum = savecsum;
2575 
2576 	/*
2577 	 * Step 3: Update MD5 hash with TCP segment data.
2578 	 *         Use m_apply() to avoid an early m_pullup().
2579 	 */
2580 	if (len > 0)
2581 		m_apply(m, doff, len, tcp_signature_apply, &ctx);
2582 
2583 	/*
2584 	 * Step 4: Update MD5 hash with shared secret.
2585 	 */
2586 	MD5Update(&ctx, sav->key_auth->key_data, _KEYLEN(sav->key_auth));
2587 	MD5Final(buf, &ctx);
2588 
2589 	key_sa_recordxfer(sav, m);
2590 	KEY_FREESAV(&sav);
2591 	return (0);
2592 }
2593 
2594 /*
2595  * Compute TCP-MD5 hash of a TCP segment. (RFC2385)
2596  *
2597  * Return 0 if successful, otherwise return -1.
2598  */
2599 int
2600 tcp_signature_compute(struct mbuf *m, int _unused, int len, int optlen,
2601     u_char *buf, u_int direction)
2602 {
2603 	struct secasvar *sav;
2604 
2605 	if ((sav = tcp_get_sav(m, direction)) == NULL)
2606 		return (-1);
2607 
2608 	return (tcp_signature_do_compute(m, len, optlen, buf, sav));
2609 }
2610 
2611 /*
2612  * Verify the TCP-MD5 hash of a TCP segment. (RFC2385)
2613  *
2614  * Parameters:
2615  * m		pointer to head of mbuf chain
2616  * len		length of TCP segment data, excluding options
2617  * optlen	length of TCP segment options
2618  * buf		pointer to storage for computed MD5 digest
2619  * direction	direction of flow (IPSEC_DIR_INBOUND or OUTBOUND)
2620  *
2621  * Return 1 if successful, otherwise return 0.
2622  */
2623 int
2624 tcp_signature_verify(struct mbuf *m, int off0, int tlen, int optlen,
2625     struct tcpopt *to, struct tcphdr *th, u_int tcpbflag)
2626 {
2627 	char tmpdigest[TCP_SIGLEN];
2628 
2629 	if (tcp_sig_checksigs == 0)
2630 		return (1);
2631 	if ((tcpbflag & TF_SIGNATURE) == 0) {
2632 		if ((to->to_flags & TOF_SIGNATURE) != 0) {
2633 
2634 			/*
2635 			 * If this socket is not expecting signature but
2636 			 * the segment contains signature just fail.
2637 			 */
2638 			TCPSTAT_INC(tcps_sig_err_sigopt);
2639 			TCPSTAT_INC(tcps_sig_rcvbadsig);
2640 			return (0);
2641 		}
2642 
2643 		/* Signature is not expected, and not present in segment. */
2644 		return (1);
2645 	}
2646 
2647 	/*
2648 	 * If this socket is expecting signature but the segment does not
2649 	 * contain any just fail.
2650 	 */
2651 	if ((to->to_flags & TOF_SIGNATURE) == 0) {
2652 		TCPSTAT_INC(tcps_sig_err_nosigopt);
2653 		TCPSTAT_INC(tcps_sig_rcvbadsig);
2654 		return (0);
2655 	}
2656 	if (tcp_signature_compute(m, off0, tlen, optlen, &tmpdigest[0],
2657 	    IPSEC_DIR_INBOUND) == -1) {
2658 		TCPSTAT_INC(tcps_sig_err_buildsig);
2659 		TCPSTAT_INC(tcps_sig_rcvbadsig);
2660 		return (0);
2661 	}
2662 
2663 	if (bcmp(to->to_signature, &tmpdigest[0], TCP_SIGLEN) != 0) {
2664 		TCPSTAT_INC(tcps_sig_rcvbadsig);
2665 		return (0);
2666 	}
2667 	TCPSTAT_INC(tcps_sig_rcvgoodsig);
2668 	return (1);
2669 }
2670 #endif /* TCP_SIGNATURE */
2671 
2672 static int
2673 sysctl_drop(SYSCTL_HANDLER_ARGS)
2674 {
2675 	/* addrs[0] is a foreign socket, addrs[1] is a local one. */
2676 	struct sockaddr_storage addrs[2];
2677 	struct inpcb *inp;
2678 	struct tcpcb *tp;
2679 	struct tcptw *tw;
2680 	struct sockaddr_in *fin, *lin;
2681 #ifdef INET6
2682 	struct sockaddr_in6 *fin6, *lin6;
2683 #endif
2684 	int error;
2685 
2686 	inp = NULL;
2687 	fin = lin = NULL;
2688 #ifdef INET6
2689 	fin6 = lin6 = NULL;
2690 #endif
2691 	error = 0;
2692 
2693 	if (req->oldptr != NULL || req->oldlen != 0)
2694 		return (EINVAL);
2695 	if (req->newptr == NULL)
2696 		return (EPERM);
2697 	if (req->newlen < sizeof(addrs))
2698 		return (ENOMEM);
2699 	error = SYSCTL_IN(req, &addrs, sizeof(addrs));
2700 	if (error)
2701 		return (error);
2702 
2703 	switch (addrs[0].ss_family) {
2704 #ifdef INET6
2705 	case AF_INET6:
2706 		fin6 = (struct sockaddr_in6 *)&addrs[0];
2707 		lin6 = (struct sockaddr_in6 *)&addrs[1];
2708 		if (fin6->sin6_len != sizeof(struct sockaddr_in6) ||
2709 		    lin6->sin6_len != sizeof(struct sockaddr_in6))
2710 			return (EINVAL);
2711 		if (IN6_IS_ADDR_V4MAPPED(&fin6->sin6_addr)) {
2712 			if (!IN6_IS_ADDR_V4MAPPED(&lin6->sin6_addr))
2713 				return (EINVAL);
2714 			in6_sin6_2_sin_in_sock((struct sockaddr *)&addrs[0]);
2715 			in6_sin6_2_sin_in_sock((struct sockaddr *)&addrs[1]);
2716 			fin = (struct sockaddr_in *)&addrs[0];
2717 			lin = (struct sockaddr_in *)&addrs[1];
2718 			break;
2719 		}
2720 		error = sa6_embedscope(fin6, V_ip6_use_defzone);
2721 		if (error)
2722 			return (error);
2723 		error = sa6_embedscope(lin6, V_ip6_use_defzone);
2724 		if (error)
2725 			return (error);
2726 		break;
2727 #endif
2728 #ifdef INET
2729 	case AF_INET:
2730 		fin = (struct sockaddr_in *)&addrs[0];
2731 		lin = (struct sockaddr_in *)&addrs[1];
2732 		if (fin->sin_len != sizeof(struct sockaddr_in) ||
2733 		    lin->sin_len != sizeof(struct sockaddr_in))
2734 			return (EINVAL);
2735 		break;
2736 #endif
2737 	default:
2738 		return (EINVAL);
2739 	}
2740 	INP_INFO_RLOCK(&V_tcbinfo);
2741 	switch (addrs[0].ss_family) {
2742 #ifdef INET6
2743 	case AF_INET6:
2744 		inp = in6_pcblookup(&V_tcbinfo, &fin6->sin6_addr,
2745 		    fin6->sin6_port, &lin6->sin6_addr, lin6->sin6_port,
2746 		    INPLOOKUP_WLOCKPCB, NULL);
2747 		break;
2748 #endif
2749 #ifdef INET
2750 	case AF_INET:
2751 		inp = in_pcblookup(&V_tcbinfo, fin->sin_addr, fin->sin_port,
2752 		    lin->sin_addr, lin->sin_port, INPLOOKUP_WLOCKPCB, NULL);
2753 		break;
2754 #endif
2755 	}
2756 	if (inp != NULL) {
2757 		if (inp->inp_flags & INP_TIMEWAIT) {
2758 			/*
2759 			 * XXXRW: There currently exists a state where an
2760 			 * inpcb is present, but its timewait state has been
2761 			 * discarded.  For now, don't allow dropping of this
2762 			 * type of inpcb.
2763 			 */
2764 			tw = intotw(inp);
2765 			if (tw != NULL)
2766 				tcp_twclose(tw, 0);
2767 			else
2768 				INP_WUNLOCK(inp);
2769 		} else if (!(inp->inp_flags & INP_DROPPED) &&
2770 			   !(inp->inp_socket->so_options & SO_ACCEPTCONN)) {
2771 			tp = intotcpcb(inp);
2772 			tp = tcp_drop(tp, ECONNABORTED);
2773 			if (tp != NULL)
2774 				INP_WUNLOCK(inp);
2775 		} else
2776 			INP_WUNLOCK(inp);
2777 	} else
2778 		error = ESRCH;
2779 	INP_INFO_RUNLOCK(&V_tcbinfo);
2780 	return (error);
2781 }
2782 
2783 SYSCTL_PROC(_net_inet_tcp, TCPCTL_DROP, drop,
2784     CTLFLAG_VNET | CTLTYPE_STRUCT | CTLFLAG_WR | CTLFLAG_SKIP, NULL,
2785     0, sysctl_drop, "", "Drop TCP connection");
2786 
2787 /*
2788  * Generate a standardized TCP log line for use throughout the
2789  * tcp subsystem.  Memory allocation is done with M_NOWAIT to
2790  * allow use in the interrupt context.
2791  *
2792  * NB: The caller MUST free(s, M_TCPLOG) the returned string.
2793  * NB: The function may return NULL if memory allocation failed.
2794  *
2795  * Due to header inclusion and ordering limitations the struct ip
2796  * and ip6_hdr pointers have to be passed as void pointers.
2797  */
2798 char *
2799 tcp_log_vain(struct in_conninfo *inc, struct tcphdr *th, void *ip4hdr,
2800     const void *ip6hdr)
2801 {
2802 
2803 	/* Is logging enabled? */
2804 	if (tcp_log_in_vain == 0)
2805 		return (NULL);
2806 
2807 	return (tcp_log_addr(inc, th, ip4hdr, ip6hdr));
2808 }
2809 
2810 char *
2811 tcp_log_addrs(struct in_conninfo *inc, struct tcphdr *th, void *ip4hdr,
2812     const void *ip6hdr)
2813 {
2814 
2815 	/* Is logging enabled? */
2816 	if (tcp_log_debug == 0)
2817 		return (NULL);
2818 
2819 	return (tcp_log_addr(inc, th, ip4hdr, ip6hdr));
2820 }
2821 
2822 static char *
2823 tcp_log_addr(struct in_conninfo *inc, struct tcphdr *th, void *ip4hdr,
2824     const void *ip6hdr)
2825 {
2826 	char *s, *sp;
2827 	size_t size;
2828 	struct ip *ip;
2829 #ifdef INET6
2830 	const struct ip6_hdr *ip6;
2831 
2832 	ip6 = (const struct ip6_hdr *)ip6hdr;
2833 #endif /* INET6 */
2834 	ip = (struct ip *)ip4hdr;
2835 
2836 	/*
2837 	 * The log line looks like this:
2838 	 * "TCP: [1.2.3.4]:50332 to [1.2.3.4]:80 tcpflags 0x2<SYN>"
2839 	 */
2840 	size = sizeof("TCP: []:12345 to []:12345 tcpflags 0x2<>") +
2841 	    sizeof(PRINT_TH_FLAGS) + 1 +
2842 #ifdef INET6
2843 	    2 * INET6_ADDRSTRLEN;
2844 #else
2845 	    2 * INET_ADDRSTRLEN;
2846 #endif /* INET6 */
2847 
2848 	s = malloc(size, M_TCPLOG, M_ZERO|M_NOWAIT);
2849 	if (s == NULL)
2850 		return (NULL);
2851 
2852 	strcat(s, "TCP: [");
2853 	sp = s + strlen(s);
2854 
2855 	if (inc && ((inc->inc_flags & INC_ISIPV6) == 0)) {
2856 		inet_ntoa_r(inc->inc_faddr, sp);
2857 		sp = s + strlen(s);
2858 		sprintf(sp, "]:%i to [", ntohs(inc->inc_fport));
2859 		sp = s + strlen(s);
2860 		inet_ntoa_r(inc->inc_laddr, sp);
2861 		sp = s + strlen(s);
2862 		sprintf(sp, "]:%i", ntohs(inc->inc_lport));
2863 #ifdef INET6
2864 	} else if (inc) {
2865 		ip6_sprintf(sp, &inc->inc6_faddr);
2866 		sp = s + strlen(s);
2867 		sprintf(sp, "]:%i to [", ntohs(inc->inc_fport));
2868 		sp = s + strlen(s);
2869 		ip6_sprintf(sp, &inc->inc6_laddr);
2870 		sp = s + strlen(s);
2871 		sprintf(sp, "]:%i", ntohs(inc->inc_lport));
2872 	} else if (ip6 && th) {
2873 		ip6_sprintf(sp, &ip6->ip6_src);
2874 		sp = s + strlen(s);
2875 		sprintf(sp, "]:%i to [", ntohs(th->th_sport));
2876 		sp = s + strlen(s);
2877 		ip6_sprintf(sp, &ip6->ip6_dst);
2878 		sp = s + strlen(s);
2879 		sprintf(sp, "]:%i", ntohs(th->th_dport));
2880 #endif /* INET6 */
2881 #ifdef INET
2882 	} else if (ip && th) {
2883 		inet_ntoa_r(ip->ip_src, sp);
2884 		sp = s + strlen(s);
2885 		sprintf(sp, "]:%i to [", ntohs(th->th_sport));
2886 		sp = s + strlen(s);
2887 		inet_ntoa_r(ip->ip_dst, sp);
2888 		sp = s + strlen(s);
2889 		sprintf(sp, "]:%i", ntohs(th->th_dport));
2890 #endif /* INET */
2891 	} else {
2892 		free(s, M_TCPLOG);
2893 		return (NULL);
2894 	}
2895 	sp = s + strlen(s);
2896 	if (th)
2897 		sprintf(sp, " tcpflags 0x%b", th->th_flags, PRINT_TH_FLAGS);
2898 	if (*(s + size - 1) != '\0')
2899 		panic("%s: string too long", __func__);
2900 	return (s);
2901 }
2902 
2903 /*
2904  * A subroutine which makes it easy to track TCP state changes with DTrace.
2905  * This function shouldn't be called for t_state initializations that don't
2906  * correspond to actual TCP state transitions.
2907  */
2908 void
2909 tcp_state_change(struct tcpcb *tp, int newstate)
2910 {
2911 #if defined(KDTRACE_HOOKS)
2912 	int pstate = tp->t_state;
2913 #endif
2914 
2915 	TCPSTAT_DEC(tcps_states[tp->t_state]);
2916 	TCPSTAT_INC(tcps_states[newstate]);
2917 	tp->t_state = newstate;
2918 	TCP_PROBE6(state__change, NULL, tp, NULL, tp, NULL, pstate);
2919 }
2920